From cb0d1a9e50e2dd7d0908a60dc002f3af02380682 Mon Sep 17 00:00:00 2001
From: Erik Boasson <eb@ilities.com>
Date: Wed, 27 Mar 2019 09:15:41 +0100
Subject: [PATCH 001/238] timely initialization of builtin topics (#138)

The rtps_init function used to initialize all data structures and start
all threads used by the protocol stack, allowing discovery of remote
entities before the built-in topic data structures were initialized.
(Very) early discovery of a remote participant thus led to a crash.

This commit splits the initialisation, providing a separate function for
starting, in particular, the threads receiving data from the network.
In terms of threads created, it matches exactly with the rtps_stop /
rtps_fini split that already existed to address the exact same problem
on termination.

Signed-off-by: Erik Boasson <eb@ilities.com>
---
 src/core/ddsc/src/dds_init.c            | 15 +++-
 src/core/ddsi/include/dds/ddsi/q_rtps.h |  1 +
 src/core/ddsi/src/q_init.c              | 98 ++++++++++++++-----------
 3 files changed, 67 insertions(+), 47 deletions(-)

diff --git a/src/core/ddsc/src/dds_init.c b/src/core/ddsc/src/dds_init.c
index 1a434b5..3aa8751 100644
--- a/src/core/ddsc/src/dds_init.c
+++ b/src/core/ddsc/src/dds_init.c
@@ -113,6 +113,7 @@ dds_init(dds_domainid_t domain)
     goto fail_rtps_config;
   }
 
+  upgrade_main_thread();
   ut_avlInit(&dds_domaintree_def, &dds_global.m_domains);
 
   /* Start monitoring the liveliness of all threads. */
@@ -129,7 +130,7 @@ dds_init(dds_domainid_t domain)
     }
   }
 
-  if (rtps_init() < 0)
+  if (rtps_init () < 0)
   {
     DDS_LOG(DDS_LC_CONFIG, "Failed to initialize RTPS\n");
     ret = DDS_ERRNO(DDS_RETCODE_ERROR);
@@ -138,6 +139,13 @@ dds_init(dds_domainid_t domain)
 
   dds__builtin_init ();
 
+  if (rtps_start () < 0)
+  {
+    DDS_LOG(DDS_LC_CONFIG, "Failed to start RTPS\n");
+    ret = DDS_ERRNO(DDS_RETCODE_ERROR);
+    goto fail_rtps_start;
+  }
+
   if (gv.servicelease && nn_servicelease_start_renewing(gv.servicelease) < 0)
   {
     DDS_ERROR("Failed to start the servicelease\n");
@@ -145,8 +153,6 @@ dds_init(dds_domainid_t domain)
     goto fail_servicelease_start;
   }
 
-  upgrade_main_thread();
-
   /* Set additional default participant properties */
 
   gv.default_plist_pp.process_id = (unsigned)ddsrt_getpid();
@@ -173,6 +179,8 @@ fail_servicelease_start:
   if (gv.servicelease)
     nn_servicelease_stop_renewing (gv.servicelease);
   rtps_stop ();
+fail_rtps_start:
+  dds__builtin_fini ();
   rtps_fini ();
 fail_rtps_init:
   if (gv.servicelease)
@@ -181,6 +189,7 @@ fail_rtps_init:
     gv.servicelease = NULL;
   }
 fail_servicelease_new:
+  downgrade_main_thread ();
   thread_states_fini();
 fail_rtps_config:
 fail_config_domainid:
diff --git a/src/core/ddsi/include/dds/ddsi/q_rtps.h b/src/core/ddsi/include/dds/ddsi/q_rtps.h
index e9793d6..731fbd9 100644
--- a/src/core/ddsi/include/dds/ddsi/q_rtps.h
+++ b/src/core/ddsi/include/dds/ddsi/q_rtps.h
@@ -76,6 +76,7 @@ struct cfgst;
 int rtps_config_prep (struct cfgst *cfgst);
 int rtps_config_open (void);
 int rtps_init (void);
+int rtps_start (void);
 void ddsi_plugin_init (void);
 void rtps_stop (void);
 void rtps_fini (void);
diff --git a/src/core/ddsi/src/q_init.c b/src/core/ddsi/src/q_init.c
index d5ca562..97ae856 100644
--- a/src/core/ddsi/src/q_init.c
+++ b/src/core/ddsi/src/q_init.c
@@ -1275,61 +1275,20 @@ int rtps_init (void)
   gv.rtps_keepgoing = 1;
   ddsrt_rwlock_init (&gv.qoslock);
 
-  {
-    int r;
-    gv.builtins_dqueue = nn_dqueue_new ("builtins", config.delivery_queue_maxsamples, builtins_dqueue_handler, NULL);
-    if ((r = xeventq_start (gv.xevents, NULL)) < 0)
-    {
-      DDS_FATAL("failed to start global event processing thread (%d)\n", r);
-    }
-  }
-
   if (config.xpack_send_async)
   {
     nn_xpack_sendq_init();
     nn_xpack_sendq_start();
   }
 
+  gv.builtins_dqueue = nn_dqueue_new ("builtins", config.delivery_queue_maxsamples, builtins_dqueue_handler, NULL);
 #ifdef DDSI_INCLUDE_NETWORK_CHANNELS
-  /* Create a delivery queue and start tev for each channel */
-  {
-    struct config_channel_listelem * chptr = config.channels;
-    while (chptr)
-    {
-      chptr->dqueue = nn_dqueue_new (chptr->name, config.delivery_queue_maxsamples, user_dqueue_handler, NULL);
-      if (chptr->evq)
-      {
-        int r;
-        if ((r = xeventq_start (chptr->evq, chptr->name)) < 0)
-          DDS_FATAL("failed to start event processing thread for channel '%s' (%d)\n", chptr->name, r);
-      }
-      chptr = chptr->next;
-    }
-  }
+  for (struct config_channel_listelem *chptr = config.channels; chptr; chptr = chptr->next)
+    chptr->dqueue = nn_dqueue_new (chptr->name, config.delivery_queue_maxsamples, user_dqueue_handler, NULL);
 #else
   gv.user_dqueue = nn_dqueue_new ("user", config.delivery_queue_maxsamples, user_dqueue_handler, NULL);
 #endif
 
-  if (setup_and_start_recv_threads () < 0)
-  {
-    DDS_FATAL("failed to start receive threads\n");
-  }
-
-  if (gv.listener)
-  {
-    gv.listen_ts = create_thread ("listen", (uint32_t (*) (void *)) listen_thread, gv.listener);
-  }
-
-  if (gv.startup_mode)
-  {
-    qxev_end_startup_mode (add_duration_to_mtime (now_mt (), config.startup_mode_duration));
-  }
-
-  if (config.monitor_port >= 0)
-  {
-    gv.debmon = new_debug_monitor (config.monitor_port);
-  }
-
   return 0;
 
 err_mc_conn:
@@ -1402,6 +1361,57 @@ err_udp_tcp_init:
   return -1;
 }
 
+#ifdef DDSI_INCLUDE_NETWORK_CHANNELS
+static void stop_all_xeventq_upto (struct config_channel_listelem *chptr)
+{
+  for (struct config_channel_listelem *chptr1 = config.channels; chptr1 != chptr; chptr1 = chptr1->next)
+    if (chptr1->evq)
+      xeventq_stop (chptr1->evq);
+}
+#endif
+
+int rtps_start (void)
+{
+  if (xeventq_start (gv.xevents, NULL) < 0)
+    return -1;
+#ifdef DDSI_INCLUDE_NETWORK_CHANNELS
+  for (struct config_channel_listelem *chptr = config.channels; chptr; chptr = chptr->next)
+  {
+    if (chptr->evq)
+    {
+      if (xeventq_start (chptr->evq, chptr->name) < 0)
+      {
+        stop_all_xeventq_upto (chptr);
+        xeventq_stop (gv.xevents);
+        return -1;
+      }
+    }
+  }
+#endif
+
+  if (setup_and_start_recv_threads () < 0)
+  {
+#ifdef DDSI_INCLUDE_NETWORK_CHANNELS
+    stop_all_xeventq_upto (NULL);
+#endif
+    xeventq_stop (gv.xevents);
+    return -1;
+  }
+  if (gv.listener)
+  {
+    gv.listen_ts = create_thread ("listen", (uint32_t (*) (void *)) listen_thread, gv.listener);
+  }
+  if (gv.startup_mode)
+  {
+    qxev_end_startup_mode (add_duration_to_mtime (now_mt (), config.startup_mode_duration));
+  }
+  if (config.monitor_port >= 0)
+  {
+    gv.debmon = new_debug_monitor (config.monitor_port);
+  }
+  return 0;
+}
+
 struct dq_builtins_ready_arg {
   ddsrt_mutex_t lock;
   ddsrt_cond_t cond;

From dc0ebb55ff34b80af785b4c351924417d8edba80 Mon Sep 17 00:00:00 2001
From: Erik Boasson <eb@ilities.com>
Date: Wed, 27 Mar 2019 09:21:09 +0100
Subject: [PATCH 002/238] trace correct thread id during thread creation

The rewrite of the abstraction layer changed some details in thread ids
used in tracing and functions to get those ids, with a result of always
printing the parent thread's id in create_thread rather than the newly
create thread's id. As all supported platforms use thread names in the
trace, it is a rather insignificant matter, and so this provides the
trivial fix by letting the new thread log the message.

Signed-off-by: Erik Boasson <eb@ilities.com>
---
 src/core/ddsi/src/q_thread.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/core/ddsi/src/q_thread.c b/src/core/ddsi/src/q_thread.c
index cadbb6e..4d3fe45 100644
--- a/src/core/ddsi/src/q_thread.c
+++ b/src/core/ddsi/src/q_thread.c
@@ -172,6 +172,7 @@ static uint32_t create_thread_wrapper (void *ptr)
 {
   uint32_t ret;
   struct thread_context *ctx = ptr;
+  DDS_TRACE ("started new thread %"PRIdTID": %s\n", ddsrt_gettid (), ctx->self->name);
   ctx->self->tid = ddsrt_thread_self ();
   ret = ctx->f (ctx->arg);
   ddsrt_free (ctx);
@@ -272,7 +273,6 @@ struct thread_state1 *create_thread (const char *name, uint32_t (*f) (void *arg)
     DDS_FATAL("create_thread: %s: ddsrt_thread_create failed\n", name);
     goto fatal;
   }
-  DDS_TRACE("started new thread %"PRIdTID" : %s\n", ddsrt_gettid(), name);
   ts1->extTid = tid; /* overwrite the temporary value with the correct external one */
   ddsrt_mutex_unlock (&thread_states.lock);
   return ts1;

From bfe44a9785aa6334095b301837b09d7c48df8ab9 Mon Sep 17 00:00:00 2001
From: Erik Boasson <eb@ilities.com>
Date: Wed, 27 Mar 2019 09:25:09 +0100
Subject: [PATCH 003/238] avoid debmon thread shutdown logging write errors

During shutdown, the optional "debmon" thread for getting some
information about internal state of the DDSI stack had a tendency to run
into errors from calling write on a connection that had already been
closed immediately after connecting successfully to wake the thread.

Instead of blindly writing into the connection, it now checks whether it
is supposed to shutdown before doing anything, avoiding this particular
problem.

Signed-off-by: Erik Boasson <eb@ilities.com>
---
 src/core/ddsi/src/q_debmon.c | 49 +++++++++++++++++++++---------------
 1 file changed, 29 insertions(+), 20 deletions(-)

diff --git a/src/core/ddsi/src/q_debmon.c b/src/core/ddsi/src/q_debmon.c
index eb83d81..beaa9bf 100644
--- a/src/core/ddsi/src/q_debmon.c
+++ b/src/core/ddsi/src/q_debmon.c
@@ -300,37 +300,46 @@ static int print_proxy_participants (struct thread_state1 *self, ddsi_tran_conn_
   return x;
 }
 
+static void debmon_handle_connection (struct debug_monitor *dm, ddsi_tran_conn_t conn)
+{
+  struct plugin *p;
+  int r = 0;
+  r += print_participants (dm->servts, conn);
+  if (r == 0)
+    r += print_proxy_participants (dm->servts, conn);
+
+  /* Note: can only add plugins (at the tail) */
+  ddsrt_mutex_lock (&dm->lock);
+  p = dm->plugins;
+  while (r == 0 && p != NULL)
+  {
+    ddsrt_mutex_unlock (&dm->lock);
+    r += p->fn (conn, cpf, p->arg);
+    ddsrt_mutex_lock (&dm->lock);
+    p = p->next;
+  }
+  ddsrt_mutex_unlock (&dm->lock);
+}
+
 static uint32_t debmon_main (void *vdm)
 {
   struct debug_monitor *dm = vdm;
   ddsrt_mutex_lock (&dm->lock);
   while (!dm->stop)
   {
-    ddsi_tran_conn_t conn;
     ddsrt_mutex_unlock (&dm->lock);
-    if ((conn = ddsi_listener_accept (dm->servsock)) != NULL)
+    ddsi_tran_conn_t conn = ddsi_listener_accept (dm->servsock);
+    ddsrt_mutex_lock (&dm->lock);
+    if (conn != NULL && !dm->stop)
     {
-      struct plugin *p;
-      int r = 0;
-      r += print_participants (dm->servts, conn);
-      if (r == 0)
-        r += print_proxy_participants (dm->servts, conn);
-
-      /* Note: can only add plugins (at the tail) */
-      ddsrt_mutex_lock (&dm->lock);
-      p = dm->plugins;
-      while (r == 0 && p != NULL)
-      {
-        ddsrt_mutex_unlock (&dm->lock);
-        r += p->fn (conn, cpf, p->arg);
-        ddsrt_mutex_lock (&dm->lock);
-        p = p->next;
-      }
       ddsrt_mutex_unlock (&dm->lock);
-
+      debmon_handle_connection (dm, conn);
+      ddsrt_mutex_lock (&dm->lock);
+    }
+    if (conn != NULL)
+    {
       ddsi_conn_free (conn);
     }
-    ddsrt_mutex_lock (&dm->lock);
   }
   ddsrt_mutex_unlock (&dm->lock);
   return 0;

From 73ec5beef4da4ff44878014a85e29387cc35544a Mon Sep 17 00:00:00 2001
From: Erik Boasson <eb@ilities.com>
Date: Wed, 27 Mar 2019 17:14:44 +0100
Subject: [PATCH 004/238] gracefully handle a too small ReceiveBufferSize

Sizing/ReceiveBufferSize must be >= Sizing/ReceiveBufferChunkSize + N
for some small N, and if it is not, Cyclone will crash reading beyond
allocated memory in a nasty way. Ordinarily this should be handled by
the configuration validation, but that would put the burden of knowing
the details of computing N upon the user, an unreasonable requirement.

The old state of an assertion presupposes a check, and brings us back
that same requirement.

Thus, a change to ensure that ReceiveBufferSize will be taken as the
minimum of the configured value and the actual minimal value as
determined by ChunkSize and whatever N happens to be.

Signed-off-by: Erik Boasson <eb@ilities.com>
---
 src/core/ddsi/src/q_config.c | 2 +-
 src/core/ddsi/src/q_radmin.c | 8 +++++++-
 2 files changed, 8 insertions(+), 2 deletions(-)

diff --git a/src/core/ddsi/src/q_config.c b/src/core/ddsi/src/q_config.c
index e318181..de2cceb 100644
--- a/src/core/ddsi/src/q_config.c
+++ b/src/core/ddsi/src/q_config.c
@@ -654,7 +654,7 @@ END_MARKER
 static const struct cfgelem sizing_cfgelems[] =
 {
     { LEAF("ReceiveBufferSize"), 1, "1 MiB", ABSOFF(rbuf_size), 0, uf_memsize, 0, pf_memsize,
-    "<p>This element sets the size of a single receive buffer. Many receive buffers may be needed. Their size must be greater than ReceiveBufferChunkSize by a modest amount.</p>" },
+    "<p>This element sets the size of a single receive buffer. Many receive buffers may be needed. The minimum workable size a little bit larger than Sizing/ReceiveBufferChunkSize, and the value used is taken as the configured value and the actual minimum workable size.</p>" },
     { LEAF("ReceiveBufferChunkSize"), 1, "128 KiB", ABSOFF(rmsg_chunk_size), 0, uf_memsize, 0, pf_memsize,
     "<p>This element specifies the size of one allocation unit in the receive buffer. Must be greater than the maximum packet size by a modest amount (too large packets are dropped). Each allocation is shrunk immediately after processing a message, or freed straightaway.</p>" },
     END_MARKER
diff --git a/src/core/ddsi/src/q_radmin.c b/src/core/ddsi/src/q_radmin.c
index c6f4a22..41c6192 100644
--- a/src/core/ddsi/src/q_radmin.c
+++ b/src/core/ddsi/src/q_radmin.c
@@ -330,7 +330,13 @@ struct nn_rbufpool *nn_rbufpool_new (uint32_t rbuf_size, uint32_t max_rmsg_size)
   struct nn_rbufpool *rbp;
 
   assert (max_rmsg_size > 0);
-  assert (rbuf_size >= max_rmsg_size_w_hdr (max_rmsg_size));
+
+  /* raise rbuf_size to minimum possible considering max_rmsg_size, there is
+     no reason to bother the user with the small difference between the two
+     when he tries to configure things, and the crash is horrible when
+     rbuf_size is too small */
+  if (rbuf_size < max_rmsg_size_w_hdr (max_rmsg_size))
+    rbuf_size = max_rmsg_size_w_hdr (max_rmsg_size);
 
   if ((rbp = ddsrt_malloc (sizeof (*rbp))) == NULL)
     goto fail_rbp;

From 371a9cf1079ef5065a48da5a85a82b310580fbd9 Mon Sep 17 00:00:00 2001
From: Erik Boasson <eb@ilities.com>
Date: Wed, 27 Mar 2019 17:28:03 +0100
Subject: [PATCH 005/238] clarify "spdp" token in AllowMulticast option

Signed-off-by: Erik Boasson <eb@ilities.com>
---
 src/core/ddsi/src/q_config.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/core/ddsi/src/q_config.c b/src/core/ddsi/src/q_config.c
index de2cceb..596fb3e 100644
--- a/src/core/ddsi/src/q_config.c
+++ b/src/core/ddsi/src/q_config.c
@@ -248,7 +248,7 @@ static const struct cfgelem general_cfgelems[] = {
 "<p>This element controls whether DDSI2E uses multicasts for data traffic.</p>\n\
 <p>It is a comma-separated list of some of the following keywords: \"spdp\", \"asm\", \"ssm\", or either of \"false\" or \"true\".</p>\n\
 <ul>\n\
-<li><i>spdp</i>: enables the use of ASM (any-source multicast) for participant discovery</li>\n\
+<li><i>spdp</i>: enables the use of ASM (any-source multicast) for participant discovery, joining the multicast group on the discovery socket, transmitting SPDP messages to this group, but never advertising nor using any multicast address in any discovery message, thus forcing unicast communications for all endpoint discovery and user data.</li>\n\
 <li><i>asm</i>: enables the use of ASM for all traffic (including SPDP)</li>\n\
 <li><i>ssm</i>: enables the use of SSM (source-specific multicast) for all non-SPDP traffic (if supported)</li>\n\
 </ul>\n\

From f0fdde1345b7487b07e909c99d5587609bcb3ae5 Mon Sep 17 00:00:00 2001
From: Erik Boasson <eb@ilities.com>
Date: Wed, 27 Mar 2019 17:29:26 +0100
Subject: [PATCH 006/238] remove rmbias_and_adjust assert on threadid (#121)

The introduction of multiple receive threads could trigger the assertion
because a set of samples ready for delivery may have been received by
multiple threads (the problem manifests itself most easily with
fragmented samples). This is actually a non-issue:

* while synchronously processing a packet, there is a bias of 2**31
  added to the refcount, to prevent any thread under any circumstance
  from ever freeing the data;
* while data lives in the defragment buffers or reorder buffer of the
  proxy writer, a bias of 2**20 is added to it until this particular
  function is called, after delivery of the data to the readers, and
  (if needed) after inserting the samples in the reorder buffer of
  any readers that are out-of-sync with the proxy writer;
* the relevant refcount is updated atomically in such a manner that this
  particular operation atomically removes the bias and performs the
  delayed increment of the refcount to account for the data being stored
  in any of the defragmenting or reorder buffers;
* the only ordinary decrementing of the refcount happens either
  synchronously (if synchronous delivery is chosen), or asynchronously
  in a delivery queue thread, and so the entire mechanism exists to
  avoid premature freeing of the underlying data because the data is
  delivered very quickly (possibly synchronously);
* as the biases are removed after all the delayed refcount increments
  are taken into account and there are no increments following the call
  to rmbias_and_adjust, the "ordinary" decrements can do no harm.
* the case of data from multiple writers being combined in a single
  packet is dealt with by the 2**20 bias, and so there is potentially a
  problem if there are more than 2**20 out-of-sync readers attached to
  a single proxy writer, or data submessages from more than 2**11
  writers in a single packet. The minimum possible data message is 32
  bytes (headers, encoding, data, padding), so packets up to 64kB are
  safe.

None of this is in any way related to which threads originally accepted
the packets, and therefore I see no argument for the existence of the
assertion.

That said, it is a rather complicated mechanism of unknown benefit, and
a major simplification is definitely something to be considered. In UDP
mode I see no chance of abuse, but there may be network protocols (TCP,
for sure) where there might be packets larger than 64kB and those could,
under worst-case assumptions, cause trouble. That, too, is a reason to
rethink it.

The call to rmbias_and_adjust was sometimes called with the proxy writer
locked, and sometimes after unlocking it. This commit changes it to
consistently call it with the lock held.

Signed-off-by: Erik Boasson <eb@ilities.com>
---
 src/core/ddsi/src/q_radmin.c  | 46 +++++++----------------------------
 src/core/ddsi/src/q_receive.c |  4 +--
 2 files changed, 11 insertions(+), 39 deletions(-)

diff --git a/src/core/ddsi/src/q_radmin.c b/src/core/ddsi/src/q_radmin.c
index 41c6192..20eaa66 100644
--- a/src/core/ddsi/src/q_radmin.c
+++ b/src/core/ddsi/src/q_radmin.c
@@ -639,11 +639,10 @@ static void nn_rmsg_addbias (struct nn_rmsg *rmsg)
 static void nn_rmsg_rmbias_and_adjust (struct nn_rmsg *rmsg, int adjust)
 {
   /* This can happen to any rmsg referenced by an sample still
-     progressing through the pipeline, but only by the receive
+     progressing through the pipeline, but only by a receive
      thread.  Can't require it to be uncommitted. */
   uint32_t sub;
   DDS_LOG(DDS_LC_RADMIN, "rmsg_rmbias_and_adjust(%p, %d)\n", (void *) rmsg, adjust);
-  ASSERT_RBUFPOOL_OWNER (rmsg->chunk.rbuf->rbufpool);
   assert (adjust >= 0);
   assert ((uint32_t) adjust < RMSG_REFCOUNT_RDATA_BIAS);
   sub = RMSG_REFCOUNT_RDATA_BIAS - (uint32_t) adjust;
@@ -652,15 +651,6 @@ static void nn_rmsg_rmbias_and_adjust (struct nn_rmsg *rmsg, int adjust)
     nn_rmsg_free (rmsg);
 }
 
-static void nn_rmsg_rmbias_anythread (struct nn_rmsg *rmsg)
-{
-  /* For removing garbage when freeing a nn_defrag. */
-  uint32_t sub = RMSG_REFCOUNT_RDATA_BIAS;
-  DDS_LOG(DDS_LC_RADMIN, "rmsg_rmbias_anythread(%p)\n", (void *) rmsg);
-  assert (ddsrt_atomic_ld32 (&rmsg->refcount) >= sub);
-  if (ddsrt_atomic_sub32_nv (&rmsg->refcount, sub) == 0)
-    nn_rmsg_free (rmsg);
-}
 static void nn_rmsg_unref (struct nn_rmsg *rmsg)
 {
   DDS_LOG(DDS_LC_RADMIN, "rmsg_unref(%p)\n", (void *) rmsg);
@@ -752,16 +742,6 @@ static void nn_rdata_rmbias_and_adjust (struct nn_rdata *rdata, int adjust)
   nn_rmsg_rmbias_and_adjust (rdata->rmsg, adjust);
 }
 
-static void nn_rdata_rmbias_anythread (struct nn_rdata *rdata)
-{
-  DDS_LOG(DDS_LC_RADMIN, "rdata_rmbias_anythread(%p)\n", (void *) rdata);
-#ifndef NDEBUG
-  if (ddsrt_atomic_dec32_ov (&rdata->refcount_bias_added) != 1)
-    abort ();
-#endif
-  nn_rmsg_rmbias_anythread (rdata->rmsg);
-}
-
 static void nn_rdata_unref (struct nn_rdata *rdata)
 {
   DDS_LOG(DDS_LC_RADMIN, "rdata_rdata_unref(%p)\n", (void *) rdata);
@@ -900,29 +880,21 @@ struct nn_defrag *nn_defrag_new (enum nn_defrag_drop_mode drop_mode, uint32_t ma
 
 void nn_fragchain_adjust_refcount (struct nn_rdata *frag, int adjust)
 {
-  struct nn_rdata *frag1;
   DDS_LOG(DDS_LC_RADMIN, "fragchain_adjust_refcount(%p, %d)\n", (void *) frag, adjust);
   while (frag)
   {
-    frag1 = frag->nextfrag;
+    struct nn_rdata * const frag1 = frag->nextfrag;
     nn_rdata_rmbias_and_adjust (frag, adjust);
     frag = frag1;
   }
 }
 
-static void nn_fragchain_rmbias_anythread (struct nn_rdata *frag, UNUSED_ARG (int adjust))
+static void nn_fragchain_rmbias (struct nn_rdata *frag)
 {
-  struct nn_rdata *frag1;
-  DDS_LOG(DDS_LC_RADMIN, "fragchain_rmbias_anythread(%p)\n", (void *) frag);
-  while (frag)
-  {
-    frag1 = frag->nextfrag;
-    nn_rdata_rmbias_anythread (frag);
-    frag = frag1;
-  }
+  nn_fragchain_adjust_refcount (frag, 0);
 }
 
-static void defrag_rsample_drop (struct nn_defrag *defrag, struct nn_rsample *rsample, void (*fragchain_free) (struct nn_rdata *frag, int adjust))
+static void defrag_rsample_drop (struct nn_defrag *defrag, struct nn_rsample *rsample)
 {
   /* Can't reference rsample after the first fragchain_free, because
      we don't know which rdata/rmsg provides the storage for the
@@ -938,7 +910,7 @@ static void defrag_rsample_drop (struct nn_defrag *defrag, struct nn_rsample *rs
   assert (defrag->n_samples > 0);
   defrag->n_samples--;
   for (iv = ut_avlIterFirst (&rsample_defrag_fragtree_treedef, &rsample->u.defrag.fragtree, &iter); iv; iv = ut_avlIterNext (&iter))
-    fragchain_free (iv->first, 0);
+    nn_fragchain_rmbias (iv->first);
 }
 
 void nn_defrag_free (struct nn_defrag *defrag)
@@ -948,7 +920,7 @@ void nn_defrag_free (struct nn_defrag *defrag)
   while (s)
   {
     DDS_LOG(DDS_LC_RADMIN, "defrag_free(%p, sample %p seq %"PRId64")\n", (void *) defrag, (void *) s, s->u.defrag.seq);
-    defrag_rsample_drop (defrag, s, nn_fragchain_rmbias_anythread);
+    defrag_rsample_drop (defrag, s);
     s = ut_avlFindMin (&defrag_sampletree_treedef, &defrag->sampletree);
   }
   assert (defrag->n_samples == 0);
@@ -1312,7 +1284,7 @@ static int defrag_limit_samples (struct nn_defrag *defrag, seqno_t seq, seqno_t
       break;
   }
   assert (sample_to_drop != NULL);
-  defrag_rsample_drop (defrag, sample_to_drop, nn_fragchain_adjust_refcount);
+  defrag_rsample_drop (defrag, sample_to_drop);
   if (sample_to_drop == defrag->max_sample)
   {
     defrag->max_sample = ut_avlFindMax (&defrag_sampletree_treedef, &defrag->sampletree);
@@ -1444,7 +1416,7 @@ void nn_defrag_notegap (struct nn_defrag *defrag, seqno_t min, seqno_t maxp1)
   while (s && s->u.defrag.seq < maxp1)
   {
     struct nn_rsample *s1 = ut_avlFindSucc (&defrag_sampletree_treedef, &defrag->sampletree, s);
-    defrag_rsample_drop (defrag, s, nn_fragchain_adjust_refcount);
+    defrag_rsample_drop (defrag, s);
     s = s1;
   }
   defrag->max_sample = ut_avlFindMax (&defrag_sampletree_treedef, &defrag->sampletree);
diff --git a/src/core/ddsi/src/q_receive.c b/src/core/ddsi/src/q_receive.c
index 7de04a6..d09c89d 100644
--- a/src/core/ddsi/src/q_receive.c
+++ b/src/core/ddsi/src/q_receive.c
@@ -2304,8 +2304,8 @@ static int handle_SPDP (const struct nn_rsample_info *sampleinfo, struct nn_rdat
   fragchain = nn_rsample_fragchain (rsample);
   if ((rres = nn_reorder_rsample (&sc, gv.spdp_reorder, rsample, &refc_adjust, nn_dqueue_is_full (gv.builtins_dqueue))) > 0)
     nn_dqueue_enqueue (gv.builtins_dqueue, &sc, rres);
-  ddsrt_mutex_unlock (&gv.spdp_lock);
   nn_fragchain_adjust_refcount (fragchain, refc_adjust);
+  ddsrt_mutex_unlock (&gv.spdp_lock);
   return 0;
 }
 
@@ -2342,8 +2342,8 @@ static void drop_oversize (struct receiver_state *rst, struct nn_rmsg *rmsg, con
     ddsrt_mutex_lock (&pwr->e.lock);
     wn = ut_avlLookup (&pwr_readers_treedef, &pwr->readers, &dst);
     gap_was_valuable = handle_one_gap (pwr, wn, sampleinfo->seq, sampleinfo->seq+1, gap, &refc_adjust);
-    ddsrt_mutex_unlock (&pwr->e.lock);
     nn_fragchain_adjust_refcount (gap, refc_adjust);
+    ddsrt_mutex_unlock (&pwr->e.lock);
 
     if (gap_was_valuable)
     {

From 2c878c3c6290aac35877d9ea42a2755a8748723e Mon Sep 17 00:00:00 2001
From: Martin Bremmer <martin.bremmer@adlinktech.com>
Date: Thu, 28 Mar 2019 09:43:24 +0100
Subject: [PATCH 007/238] Cleanup log tests.

Signed-off-by: Martin Bremmer <martin.bremmer@adlinktech.com>
---
 src/ddsrt/tests/log.c | 20 ++++++++++++++------
 1 file changed, 14 insertions(+), 6 deletions(-)

diff --git a/src/ddsrt/tests/log.c b/src/ddsrt/tests/log.c
index ab5fcc6..2c619c9 100644
--- a/src/ddsrt/tests/log.c
+++ b/src/ddsrt/tests/log.c
@@ -115,6 +115,14 @@ static void copy(void *ptr, const dds_log_data_t *data)
   *(char **)ptr = ddsrt_strdup(data->message);
 }
 
+static void reset(void)
+{
+  /* Reset log internals to default. */
+  dds_set_log_mask(DDS_LC_ERROR | DDS_LC_WARNING);
+  dds_set_trace_sink(NULL, NULL);
+  dds_set_log_sink(NULL, NULL);
+}
+
 static void setup(void)
 {
   fh = fmemopen(NULL, 1024, "wb+");
@@ -123,6 +131,7 @@ static void setup(void)
 
 static void teardown(void)
 {
+  reset();
   (void)fclose(fh);
 }
 
@@ -178,7 +187,7 @@ CU_Test(dds_log, same_file, .init=setup, .fini=teardown)
 /* The sinks are considered to be the same only if the callback and userdata
    both are an exact match. If the userdata is different, the function should
    be called twice for log messages. */
-CU_Test(dds_log, same_sink_function)
+CU_Test(dds_log, same_sink_function, .fini=reset)
 {
   int log_cnt = 0, trace_cnt = 0;
 
@@ -190,7 +199,7 @@ CU_Test(dds_log, same_sink_function)
   CU_ASSERT_EQUAL(trace_cnt, 1);
 }
 
-CU_Test(dds_log, exact_same_sink)
+CU_Test(dds_log, exact_same_sink, .fini=reset)
 {
   int cnt = 0;
 
@@ -266,7 +275,7 @@ CU_Test(dds_log, no_sink, .init=setup, .fini=teardown)
 /* A newline terminates the message. Until that a newline is encountered, the
    messages must be concatenated in the buffer. The newline is replaced by a
    NULL byte if it is flushed to a sink. */
-CU_Test(dds_log, newline_terminates)
+CU_Test(dds_log, newline_terminates, .fini=reset)
 {
   char *msg = NULL;
 
@@ -282,10 +291,9 @@ CU_Test(dds_log, newline_terminates)
 }
 
 /* Nothing must be written unless a category is enabled. */
-CU_Test(dds_log, disabled_categories_discarded)
+CU_Test(dds_log, disabled_categories_discarded, .fini=reset)
 {
   char *msg = NULL;
-
   dds_set_log_sink(&copy, &msg);
   DDS_INFO("foobar\n");
   CU_ASSERT_PTR_NULL_FATAL(msg);
@@ -336,7 +344,7 @@ static uint32_t run(void *ptr)
 /* Log and trace sinks can be changed at runtime. However, the operation must
    be synchronous! Verify the dds_set_log_sink blocks while other threads
    reside in the log or trace sinks. */
-CU_Test(dds_log, synchronous_sink_changes)
+CU_Test(dds_log, synchronous_sink_changes, .fini=reset)
 {
   struct arg arg;
   dds_time_t diff, stamp;

From 79d0e1a43cfb34b770ae6bbf5cbbf3f6e504eb34 Mon Sep 17 00:00:00 2001
From: Erik Boasson <eb@ilities.com>
Date: Tue, 2 Apr 2019 14:11:21 +0200
Subject: [PATCH 008/238] ignore all-zero durability service QoS in SEDP

For compatibility with TwinOaks CoreDX, ignore an all-zero durability
service QoS received over SEDP for volatile and transient-local
endpoints.

Signed-off-by: Erik Boasson <eb@ilities.com>
---
 src/core/ddsi/src/q_plist.c | 102 ++++++++++++++++++++++++++++++++----
 src/docs/config.rst         |  20 +++----
 2 files changed, 100 insertions(+), 22 deletions(-)

diff --git a/src/core/ddsi/src/q_plist.c b/src/core/ddsi/src/q_plist.c
index 99c7f12..8ee2ccd 100644
--- a/src/core/ddsi/src/q_plist.c
+++ b/src/core/ddsi/src/q_plist.c
@@ -593,6 +593,11 @@ static void bswap_history_qospolicy (nn_history_qospolicy_t *q)
   q->depth = bswap4 (q->depth);
 }
 
+static int history_qospolicy_allzero (const nn_history_qospolicy_t *q)
+{
+  return q->kind == NN_KEEP_LAST_HISTORY_QOS && q->depth == 0;
+}
+
 int validate_history_qospolicy (const nn_history_qospolicy_t *q)
 {
   /* Validity of history setting and of resource limits are dependent,
@@ -630,6 +635,11 @@ static void bswap_resource_limits_qospolicy (nn_resource_limits_qospolicy_t *q)
   q->max_samples_per_instance = bswap4 (q->max_samples_per_instance);
 }
 
+static int resource_limits_qospolicy_allzero (const nn_resource_limits_qospolicy_t *q)
+{
+  return q->max_samples == 0 && q->max_instances == 0 && q->max_samples_per_instance == 0;
+}
+
 int validate_resource_limits_qospolicy (const nn_resource_limits_qospolicy_t *q)
 {
   const int unlimited = NN_DDS_LENGTH_UNLIMITED;
@@ -707,9 +717,18 @@ static void bswap_durability_service_qospolicy (nn_durability_service_qospolicy_
   bswap_resource_limits_qospolicy (&q->resource_limits);
 }
 
-int validate_durability_service_qospolicy (const nn_durability_service_qospolicy_t *q)
+static int durability_service_qospolicy_allzero (const nn_durability_service_qospolicy_t *q)
+{
+  return (history_qospolicy_allzero (&q->history) &&
+          resource_limits_qospolicy_allzero (&q->resource_limits) &&
+          q->service_cleanup_delay.seconds == 0 && q->service_cleanup_delay.fraction == 0);
+}
+
+static int validate_durability_service_qospolicy_acceptzero (const nn_durability_service_qospolicy_t *q, bool acceptzero)
 {
   int res;
+  if (acceptzero && durability_service_qospolicy_allzero (q))
+    return 0;
   if ((res = validate_duration (&q->service_cleanup_delay)) < 0)
   {
     DDS_TRACE("plist/validate_durability_service_qospolicy: duration invalid\n");
@@ -723,6 +742,11 @@ int validate_durability_service_qospolicy (const nn_durability_service_qospolicy
   return 0;
 }
 
+int validate_durability_service_qospolicy (const nn_durability_service_qospolicy_t *q)
+{
+  return validate_durability_service_qospolicy_acceptzero (q, false);
+}
+
 static void bswap_liveliness_qospolicy (nn_liveliness_qospolicy_t *q)
 {
   q->kind = bswap4u (q->kind);
@@ -1300,8 +1324,9 @@ static int do_guid (nn_guid_t *dst, uint64_t *present, uint64_t fl, int (*valid)
   *dst = nn_ntoh_guid (*dst);
   if (valid (dst, dd) < 0)
   {
-    if (fl == PP_PARTICIPANT_GUID && vendor_is_twinoaks (dd->vendorid) &&
-        dst->entityid.u == 0 && ! NN_STRICT_P)
+    /* CoreDX once upon a time used to send out PARTICIPANT_GUID parameters with a 0 entity id, but it
+       that has long since changed (even if I don't know exactly when) */
+    if (fl == PP_PARTICIPANT_GUID && vendor_is_twinoaks (dd->vendorid) && dst->entityid.u == 0 && ! NN_STRICT_P)
     {
       DDS_LOG(DDS_LC_DISCOVERY, "plist(vendor %u.%u): rewriting invalid participant guid %x:%x:%x:%x\n",
               dd->vendorid.id[0], dd->vendorid.id[1], PGUID (*dst));
@@ -1523,7 +1548,6 @@ static int init_one_parameter
     }                                                                   \
     return 0
       Q (DURABILITY, durability);
-      Q (DURABILITY_SERVICE, durability_service);
       Q (LIVELINESS, liveliness);
       Q (DESTINATION_ORDER, destination_order);
       Q (HISTORY, history);
@@ -1534,6 +1558,27 @@ static int init_one_parameter
       Q (TRANSPORT_PRIORITY, transport_priority);
 #undef Q
 
+    case PID_DURABILITY_SERVICE:
+      if (dd->bufsz < sizeof (nn_durability_service_qospolicy_t))
+      {
+        DDS_TRACE("plist/init_one_parameter[pid=DURABILITY_SERVICE]: buffer too small\n");
+        return ERR_INVALID;
+      }
+      else
+      {
+        nn_durability_service_qospolicy_t *q = &dest->qos.durability_service;
+        /* All-zero durability service is illegal, but at least CoreDX sometimes advertises
+           it in some harmless cases. So accept all-zero durability service, then handle it
+           in final_validation, where we can determine whether it really is harmless or not */
+        memcpy (q, dd->buf, sizeof (*q));
+        if (dd->bswap)
+          bswap_durability_service_qospolicy (q);
+        if ((res = validate_durability_service_qospolicy_acceptzero (q, true)) < 0)
+          return res;
+        dest->qos.present |= QP_DURABILITY_SERVICE;
+      }
+      return 0;
+
       /* PID_RELIABILITY handled differently because it (formally, for
          static typing reasons) has a different type on the network
          than internally, with the transformation between the two
@@ -2253,9 +2298,9 @@ nn_plist_t *nn_plist_dup (const nn_plist_t *src)
   return dst;
 }
 
-static int final_validation (nn_plist_t *dest)
+static int final_validation (nn_plist_t *dest, nn_protocol_version_t protocol_version, nn_vendorid_t vendorid)
 {
-    /* Resource limits & history are related, so if only one is given,
+  /* Resource limits & history are related, so if only one is given,
      set the other to the default, claim it has been provided &
      validate the combination. They can't be changed afterward, so
      this is a reasonable interpretation. */
@@ -2276,6 +2321,46 @@ static int final_validation (nn_plist_t *dest)
     if ((res = validate_history_and_resource_limits (&dest->qos.history, &dest->qos.resource_limits)) < 0)
       return res;
   }
+
+  /* Durability service is sort-of accepted if all zeros, but only
+     for some protocol versions and vendors.  We don't handle want
+     to deal with that case internally. Now that all QoS have been
+     parsed we know the setting of the durability QoS (the default
+     is always VOLATILE), and hence we can verify that the setting
+     is valid or delete it if irrelevant. */
+  if (dest->qos.present & QP_DURABILITY_SERVICE)
+  {
+    const nn_durability_kind_t durkind = (dest->qos.present & QP_DURABILITY) ? dest->qos.durability.kind : NN_VOLATILE_DURABILITY_QOS;
+    bool acceptzero;
+    /* Use a somewhat convoluted rule to decide whether or not to
+       "accept" an all-zero durability service setting, to find a
+       reasonable mix of strictness and compatibility */
+    if (protocol_version_is_newer (protocol_version))
+      acceptzero = true;
+    else if (NN_STRICT_P)
+      acceptzero = vendor_is_twinoaks (vendorid);
+    else
+      acceptzero = !vendor_is_eclipse (vendorid);
+    switch (durkind)
+    {
+      case NN_VOLATILE_DURABILITY_QOS:
+      case NN_TRANSIENT_LOCAL_DURABILITY_QOS:
+        /* pretend we never saw it if it is all zero */
+        if (acceptzero && durability_service_qospolicy_allzero (&dest->qos.durability_service))
+          dest->qos.present &= ~QP_DURABILITY_SERVICE;
+        break;
+      case NN_TRANSIENT_DURABILITY_QOS:
+      case NN_PERSISTENT_DURABILITY_QOS:
+        break;
+    }
+    /* if it is still present, it must be valid */
+    if (dest->qos.present & QP_DURABILITY_SERVICE)
+    {
+      int res;
+      if ((res = validate_durability_service_qospolicy (&dest->qos.durability_service)) < 0)
+        return res;
+    }
+  }
   return 0;
 }
 
@@ -2341,10 +2426,9 @@ int nn_plist_init_frommsg
     length = (unsigned short) (dd.bswap ? bswap2u (par->length) : par->length);
     if (pid == PID_SENTINEL)
     {
-      /* Sentinel terminates list, the length is ignored, DDSI
-         9.4.2.11. */
+      /* Sentinel terminates list, the length is ignored, DDSI 9.4.2.11. */
       DDS_LOG(DDS_LC_PLIST, "%4x PID %x\n", (unsigned) (pl - src->buf), pid);
-      if ((res = final_validation (dest)) < 0)
+      if ((res = final_validation (dest, src->protocol_version, src->vendorid)) < 0)
       {
         nn_plist_fini (dest);
         return ERR_INVALID;
diff --git a/src/docs/config.rst b/src/docs/config.rst
index 7223357..bd8b182 100644
--- a/src/docs/config.rst
+++ b/src/docs/config.rst
@@ -1117,20 +1117,14 @@ OpenSplice.
 Compatibility issues with TwinOaks
 ----------------------------------
 
-Interoperability with TwinOaks CoreDX require (or used to require at some point in the
-past):
+In the default configuration there should be no interoperability issues with TwinOaks CoreDX,
+although there is the aforementioned difference in interpretation of the meaning of the
+‘autodispose_unregistered_instances’ QoS on the writer.
+
+Interoperability with very old versions of CoreDX may require setting:
 
 + ``Compatibility/ManySocketsMode``: *true*
-+ ``Compatibility/StandardsConformance``: *lax*
-+ ``Compatibility/AckNackNumbitsEmptySet``: *0*
 + ``Compatibility/ExplicitlyPublishQosSetToDefault``: *true*
 
-The ``ManySocketsMode`` option needed to be changed from the default, to ensure that
-each domain participant has a unique locator; this was needed because TwinOaks CoreDX
-DDS did not include the full GUID of a reader or writer if it needs to address just one,
-but this is probably no longer the case.  Note that the (old) behaviour of TwinOaks
-CoreDX DDS has always been allowed by the specification.
-
-The ``Compatibility/ExplicitlyPublishQosSetToDefault`` settings work around TwinOaks
-CoreDX DDS’ use of incorrect default values for some of the QoS settings if they are not
-explicitly supplied during discovery.  It may be that this is no longer the case.
+The exact version number of CoreDX starting with which these settings are no longer needed is
+unknown, but it has certainly not been needed for several years.

From 4200f9a8467491fc64eafbb86145740fa57e3e27 Mon Sep 17 00:00:00 2001
From: Jeroen Koekkoek <jeroen@koekkoek.nl>
Date: Mon, 1 Apr 2019 12:03:09 +0200
Subject: [PATCH 009/238] Fix format strings and signatures for fixed size
 integers

Signed-off-by: Jeroen Koekkoek <jeroen@koekkoek.nl>
---
 src/core/CMakeLists.txt                    |   2 +
 src/core/ddsc/src/dds_write.c              |   8 +-
 src/core/ddsi/include/dds/ddsi/ddsi_tran.h |   6 +
 src/core/ddsi/include/dds/ddsi/q_bitset.h  |  23 +--
 src/core/ddsi/include/dds/ddsi/q_error.h   |  22 +--
 src/core/ddsi/include/dds/ddsi/q_time.h    |   6 +-
 src/core/ddsi/src/ddsi_ipaddr.c            |   4 +-
 src/core/ddsi/src/ddsi_tcp.c               |   6 +-
 src/core/ddsi/src/ddsi_udp.c               |   2 +-
 src/core/ddsi/src/q_bitset_inlines.c       |  10 +-
 src/core/ddsi/src/q_config.c               |   6 +-
 src/core/ddsi/src/q_ddsi_discovery.c       |  10 +-
 src/core/ddsi/src/q_entity.c               |  36 ++--
 src/core/ddsi/src/q_lease.c                |   4 +-
 src/core/ddsi/src/q_nwif.c                 |   6 +-
 src/core/ddsi/src/q_plist.c                | 206 ++++++++++-----------
 src/core/ddsi/src/q_receive.c              |  24 +--
 src/core/ddsi/src/q_security.c             |   2 +-
 src/core/ddsi/src/q_servicelease.c         |   2 +-
 src/core/ddsi/src/q_sockwaitset.c          |   2 +-
 src/core/ddsi/src/q_thread.c               |   2 +-
 src/core/ddsi/src/q_time.c                 |  12 +-
 src/core/ddsi/src/q_transmit.c             |  12 +-
 src/core/ddsi/src/q_xevent.c               |   2 +-
 src/core/ddsi/src/q_xmsg.c                 |   4 +-
 src/core/xtests/rhc_torture.c              |   2 +-
 src/ddsrt/include/dds/ddsrt/misc.h         |   2 +-
 src/ddsrt/include/dds/ddsrt/sockets.h      |   8 +-
 src/examples/helloworld/publisher.c        |   2 +-
 src/examples/helloworld/subscriber.c       |   2 +-
 src/examples/throughput/publisher.c        |   2 +-
 src/tools/ddsls/ddsls.c                    |   6 +-
 src/tools/pubsub/common.c                  |   4 +-
 src/tools/pubsub/pubsub.c                  |  24 +--
 src/util/CMakeLists.txt                    |   4 +
 35 files changed, 245 insertions(+), 230 deletions(-)

diff --git a/src/core/CMakeLists.txt b/src/core/CMakeLists.txt
index 6eb4a82..2ef2fc3 100644
--- a/src/core/CMakeLists.txt
+++ b/src/core/CMakeLists.txt
@@ -52,6 +52,8 @@ include(ddsc/CMakeLists.txt)
 
 target_link_libraries(ddsc PRIVATE util)
 target_link_libraries(ddsc PRIVATE ddsrt)
+target_compile_definitions(
+  ddsc PUBLIC $<BUILD_INTERFACE:$<TARGET_PROPERTY:ddsrt,INTERFACE_COMPILE_DEFINITIONS>>)
 target_include_directories(
   ddsc PUBLIC $<BUILD_INTERFACE:$<TARGET_PROPERTY:ddsrt,INTERFACE_INCLUDE_DIRECTORIES>>)
 
diff --git a/src/core/ddsc/src/dds_write.c b/src/core/ddsc/src/dds_write.c
index 969c6f3..3f3bb5e 100644
--- a/src/core/ddsc/src/dds_write.c
+++ b/src/core/ddsc/src/dds_write.c
@@ -185,10 +185,10 @@ dds_return_t dds_write_impl (dds_writer *wr, const void * data, dds_time_t tstam
     if (!config.whc_batch)
       nn_xpack_send (wr->m_xp, false);
     ret = DDS_RETCODE_OK;
-  } else if (w_rc == ERR_TIMEOUT) {
+  } else if (w_rc == Q_ERR_TIMEOUT) {
     DDS_ERROR ("The writer could not deliver data on time, probably due to a reader resources being full\n");
     ret = DDS_ERRNO (DDS_RETCODE_TIMEOUT);
-  } else if (w_rc == ERR_INVALID_DATA) {
+  } else if (w_rc == Q_ERR_INVALID_DATA) {
     DDS_ERROR ("Invalid data provided\n");
     ret = DDS_ERRNO (DDS_RETCODE_ERROR);
   } else {
@@ -224,10 +224,10 @@ dds_return_t dds_writecdr_impl_lowlevel (struct writer *ddsi_wr, struct nn_xpack
     if (!config.whc_batch && xp != NULL)
       nn_xpack_send (xp, false);
     ret = DDS_RETCODE_OK;
-  } else if (w_rc == ERR_TIMEOUT) {
+  } else if (w_rc == Q_ERR_TIMEOUT) {
     DDS_ERROR ("The writer could not deliver data on time, probably due to a reader resources being full\n");
     ret = DDS_ERRNO(DDS_RETCODE_TIMEOUT);
-  } else if (w_rc == ERR_INVALID_DATA) {
+  } else if (w_rc == Q_ERR_INVALID_DATA) {
     DDS_ERROR ("Invalid data provided\n");
     ret = DDS_ERRNO (DDS_RETCODE_ERROR);
   } else {
diff --git a/src/core/ddsi/include/dds/ddsi/ddsi_tran.h b/src/core/ddsi/include/dds/ddsi/ddsi_tran.h
index 7946ca9..fa10474 100644
--- a/src/core/ddsi/include/dds/ddsi/ddsi_tran.h
+++ b/src/core/ddsi/include/dds/ddsi/ddsi_tran.h
@@ -26,6 +26,12 @@
 
 #define DDSI_TRAN_ON_CONNECT 0x0001
 
+#if DDSRT_HAVE_IPV6 == 1
+# define DDSI_LOCATORSTRLEN INET6_ADDRSTRLEN_EXTENDED
+#else
+# define DDSI_LOCATORSTRLEN INET_ADDRSTRLEN_EXTENDED
+#endif
+
 /* Core types */
 
 typedef struct ddsi_tran_base * ddsi_tran_base_t;
diff --git a/src/core/ddsi/include/dds/ddsi/q_bitset.h b/src/core/ddsi/include/dds/ddsi/q_bitset.h
index efe9ba0..ec81027 100644
--- a/src/core/ddsi/include/dds/ddsi/q_bitset.h
+++ b/src/core/ddsi/include/dds/ddsi/q_bitset.h
@@ -13,41 +13,42 @@
 #define NN_BITSET_H
 
 #include <assert.h>
+#include <stdint.h>
 #include <string.h>
 
 #include "dds/ddsi/q_unused.h"
 
-inline int nn_bitset_isset (unsigned numbits, const unsigned *bits, unsigned idx)
+inline int nn_bitset_isset (uint32_t numbits, const uint32_t *bits, uint32_t idx)
 {
-  return idx < numbits && (bits[idx/32] & (1u << (31 - (idx%32))));
+  return idx < numbits && (bits[idx/32] & (UINT32_C(1) << (31 - (idx%32))));
 }
 
-inline void nn_bitset_set (UNUSED_ARG_NDEBUG (unsigned numbits), unsigned *bits, unsigned idx)
+inline void nn_bitset_set (UNUSED_ARG_NDEBUG (uint32_t numbits), uint32_t *bits, uint32_t idx)
 {
   assert (idx < numbits);
-  bits[idx/32] |= 1u << (31 - (idx%32));
+  bits[idx/32] |= UINT32_C(1) << (31 - (idx%32));
 }
 
-inline void nn_bitset_clear (UNUSED_ARG_NDEBUG (unsigned numbits), unsigned *bits, unsigned idx)
+inline void nn_bitset_clear (UNUSED_ARG_NDEBUG (uint32_t numbits), uint32_t *bits, uint32_t idx)
 {
   assert (idx < numbits);
-  bits[idx/32] &= ~(1u << (31 - (idx%32)));
+  bits[idx/32] &= ~(UINT32_C(1) << (31 - (idx%32)));
 }
 
-inline void nn_bitset_zero (unsigned numbits, unsigned *bits)
+inline void nn_bitset_zero (uint32_t numbits, uint32_t *bits)
 {
   memset (bits, 0, 4 * ((numbits + 31) / 32));
 }
 
-inline void nn_bitset_one (unsigned numbits, unsigned *bits)
+inline void nn_bitset_one (uint32_t numbits, uint32_t *bits)
 {
   memset (bits, 0xff, 4 * ((numbits + 31) / 32));
 
   /* clear bits "accidentally" set */
   {
-    const unsigned k = numbits / 32;
-    const unsigned n = numbits % 32;
-    bits[k] &= ~(~0u >> n);
+    const uint32_t k = numbits / 32;
+    const uint32_t n = numbits % 32;
+    bits[k] &= ~(~UINT32_C(0) >> n);
   }
 }
 
diff --git a/src/core/ddsi/include/dds/ddsi/q_error.h b/src/core/ddsi/include/dds/ddsi/q_error.h
index c915b12..8c4f840 100644
--- a/src/core/ddsi/include/dds/ddsi/q_error.h
+++ b/src/core/ddsi/include/dds/ddsi/q_error.h
@@ -12,16 +12,16 @@
 #ifndef NN_ERROR_H
 #define NN_ERROR_H
 
-#define ERR_UNSPECIFIED         -1
-#define ERR_INVALID             -2
-#define ERR_OUT_OF_MEMORY       -3
-#define ERR_ENTITY_EXISTS       -4
-#define ERR_UNKNOWN_ENTITY      -5
-#define ERR_OUT_OF_IDS          -6
-#define ERR_INVALID_DATA        -7
-#define ERR_BUSY                -8
-#define ERR_NO_ADDRESS          -9
-#define ERR_TIMEOUT             -10
-#define ERR_INCOMPATIBLE        -11
+#define Q_ERR_UNSPECIFIED       -1
+#define Q_ERR_INVALID           -2
+#define Q_ERR_OUT_OF_MEMORY     -3
+#define Q_ERR_ENTITY_EXISTS     -4
+#define Q_ERR_UNKNOWN_ENTITY    -5
+#define Q_ERR_OUT_OF_IDS        -6
+#define Q_ERR_INVALID_DATA      -7
+#define Q_ERR_BUSY              -8
+#define Q_ERR_NO_ADDRESS        -9
+#define Q_ERR_TIMEOUT           -10
+#define Q_ERR_INCOMPATIBLE      -11
 
 #endif /* NN_ERROR_H */
diff --git a/src/core/ddsi/include/dds/ddsi/q_time.h b/src/core/ddsi/include/dds/ddsi/q_time.h
index 8048cfd..5c89cfa 100644
--- a/src/core/ddsi/include/dds/ddsi/q_time.h
+++ b/src/core/ddsi/include/dds/ddsi/q_time.h
@@ -53,9 +53,9 @@ int valid_ddsi_timestamp (nn_ddsi_time_t t);
 DDS_EXPORT nn_wctime_t now (void);       /* wall clock time */
 DDS_EXPORT nn_mtime_t now_mt (void);     /* monotonic time */
 DDS_EXPORT nn_etime_t now_et (void);     /* elapsed time */
-DDS_EXPORT void mtime_to_sec_usec (int * __restrict sec, int * __restrict usec, nn_mtime_t t);
-DDS_EXPORT void wctime_to_sec_usec (int * __restrict sec, int * __restrict usec, nn_wctime_t t);
-DDS_EXPORT void etime_to_sec_usec (int * __restrict sec, int * __restrict usec, nn_etime_t t);
+DDS_EXPORT void mtime_to_sec_usec (int32_t * __restrict sec, int32_t * __restrict usec, nn_mtime_t t);
+DDS_EXPORT void wctime_to_sec_usec (int32_t * __restrict sec, int32_t * __restrict usec, nn_wctime_t t);
+DDS_EXPORT void etime_to_sec_usec (int32_t * __restrict sec, int32_t * __restrict usec, nn_etime_t t);
 DDS_EXPORT nn_mtime_t mtime_round_up (nn_mtime_t t, int64_t round);
 DDS_EXPORT nn_mtime_t add_duration_to_mtime (nn_mtime_t t, int64_t d);
 DDS_EXPORT nn_wctime_t add_duration_to_wctime (nn_wctime_t t, int64_t d);
diff --git a/src/core/ddsi/src/ddsi_ipaddr.c b/src/core/ddsi/src/ddsi_ipaddr.c
index dc84dc7..c124b89 100644
--- a/src/core/ddsi/src/ddsi_ipaddr.c
+++ b/src/core/ddsi/src/ddsi_ipaddr.c
@@ -131,7 +131,7 @@ char *ddsi_ipaddr_to_string (ddsi_tran_factory_t tran, char *dst, size_t sizeof_
       if (with_port) {
         pos = strlen (dst);
         assert(pos <= sizeof_dst);
-        snprintf (dst + pos, sizeof_dst - pos, ":%d", loc->port);
+        snprintf (dst + pos, sizeof_dst - pos, ":%"PRIu32, loc->port);
       }
       break;
 #if DDSRT_HAVE_IPV6
@@ -141,7 +141,7 @@ char *ddsi_ipaddr_to_string (ddsi_tran_factory_t tran, char *dst, size_t sizeof_
       pos = strlen (dst);
       if (with_port) {
         assert(pos <= sizeof_dst);
-        snprintf (dst + pos, sizeof_dst - pos, "]:%u", loc->port);
+        snprintf (dst + pos, sizeof_dst - pos, "]:%"PRIu32, loc->port);
       } else {
         snprintf (dst + pos, sizeof_dst - pos, "]");
       }
diff --git a/src/core/ddsi/src/ddsi_tcp.c b/src/core/ddsi/src/ddsi_tcp.c
index 4309baf..2bb6576 100644
--- a/src/core/ddsi/src/ddsi_tcp.c
+++ b/src/core/ddsi/src/ddsi_tcp.c
@@ -390,7 +390,7 @@ static ssize_t ddsi_tcp_conn_read (ddsi_tran_conn_t conn, unsigned char * buf, s
 {
   dds_retcode_t rc;
   ddsi_tcp_conn_t tcp = (ddsi_tcp_conn_t) conn;
-  ssize_t (*rd) (ddsi_tcp_conn_t, void *, size_t, int * err) = ddsi_tcp_conn_read_plain;
+  ssize_t (*rd) (ddsi_tcp_conn_t, void *, size_t, dds_retcode_t * err) = ddsi_tcp_conn_read_plain;
   size_t pos = 0;
   ssize_t n;
 
@@ -467,7 +467,7 @@ static ssize_t ddsi_tcp_conn_write_ssl (ddsi_tcp_conn_t conn, const void * buf,
 
 static ssize_t ddsi_tcp_block_write
 (
-  ssize_t (*wr) (ddsi_tcp_conn_t, const void *, size_t, int *),
+  ssize_t (*wr) (ddsi_tcp_conn_t, const void *, size_t, dds_retcode_t *),
   ddsi_tcp_conn_t conn,
   const void * buf,
   size_t sz
@@ -654,7 +654,7 @@ static ssize_t ddsi_tcp_conn_write (ddsi_tran_conn_t base, const nn_locator_t *d
 
   if (piecewise)
   {
-    ssize_t (*wr) (ddsi_tcp_conn_t, const void *, size_t, int *) = ddsi_tcp_conn_write_plain;
+    ssize_t (*wr) (ddsi_tcp_conn_t, const void *, size_t, dds_retcode_t *) = ddsi_tcp_conn_write_plain;
     int i = 0;
 #ifdef DDSI_INCLUDE_SSL
     if (ddsi_tcp_ssl_plugin.write)
diff --git a/src/core/ddsi/src/ddsi_udp.c b/src/core/ddsi/src/ddsi_udp.c
index 0234c8f..a228097 100644
--- a/src/core/ddsi/src/ddsi_udp.c
+++ b/src/core/ddsi/src/ddsi_udp.c
@@ -490,7 +490,7 @@ static char *ddsi_udp_locator_to_string (ddsi_tran_factory_t tran, char *dst, si
       pos += (size_t)cnt;
     }
     if (with_port && pos < sizeof_dst) {
-      snprintf (dst + pos, sizeof_dst - pos, ":%d", loc->port);
+      snprintf (dst + pos, sizeof_dst - pos, ":%"PRIu32, loc->port);
     }
     return dst;
   }
diff --git a/src/core/ddsi/src/q_bitset_inlines.c b/src/core/ddsi/src/q_bitset_inlines.c
index 89d4b34..dbb9364 100644
--- a/src/core/ddsi/src/q_bitset_inlines.c
+++ b/src/core/ddsi/src/q_bitset_inlines.c
@@ -11,9 +11,9 @@
  */
 #include "dds/ddsi/q_bitset.h"
 
-extern inline int nn_bitset_isset (unsigned numbits, const unsigned *bits, unsigned idx);
-extern inline void nn_bitset_set (unsigned numbits, unsigned *bits, unsigned idx);
-extern inline void nn_bitset_clear (unsigned numbits, unsigned *bits, unsigned idx);
-extern inline void nn_bitset_zero (unsigned numbits, unsigned *bits);
-extern inline void nn_bitset_one (unsigned numbits, unsigned *bits);
+extern inline int nn_bitset_isset (uint32_t numbits, const uint32_t *bits, uint32_t idx);
+extern inline void nn_bitset_set (uint32_t numbits, uint32_t *bits, uint32_t idx);
+extern inline void nn_bitset_clear (uint32_t numbits, uint32_t *bits, uint32_t idx);
+extern inline void nn_bitset_zero (uint32_t numbits, uint32_t *bits);
+extern inline void nn_bitset_one (uint32_t numbits, uint32_t *bits);
 
diff --git a/src/core/ddsi/src/q_config.c b/src/core/ddsi/src/q_config.c
index 596fb3e..07ddc4b 100644
--- a/src/core/ddsi/src/q_config.c
+++ b/src/core/ddsi/src/q_config.c
@@ -116,7 +116,7 @@ static const uint32_t xcheck_codes[] = {
 
 /* We want the tracing/verbosity settings to be fixed while parsing
 the configuration, so we update this variable instead. */
-static unsigned enabled_logcats;
+static uint32_t enabled_logcats;
 
 static int cfgst_node_cmp(const void *va, const void *vb);
 static const ut_avlTreedef_t cfgst_found_treedef =
@@ -1827,7 +1827,7 @@ static int uf_maybe_int32(struct cfgst *cfgst, void *parent, struct cfgelem cons
         elem->isdefault = 1;
         elem->value = 0;
         return 1;
-    } else if ( sscanf(value, "%d%n", &elem->value, &pos) == 1 && value[pos] == 0 ) {
+    } else if ( sscanf(value, "%"PRId32"%n", &elem->value, &pos) == 1 && value[pos] == 0 ) {
         elem->isdefault = 0;
         return 1;
     } else {
@@ -1971,7 +1971,7 @@ static int uf_domainId(struct cfgst *cfgst, void *parent, struct cfgelem const *
     elem->isdefault = 1;
     elem->value = 0;
     return 1;
-  } else if (sscanf(value, "%d%n", &elem->value, &pos) == 1 && value[pos] == 0 && elem->value >= 0 && elem->value <= 230) {
+  } else if (sscanf(value, "%"PRId32"%n", &elem->value, &pos) == 1 && value[pos] == 0 && elem->value >= 0 && elem->value <= 230) {
     elem->isdefault = 0;
     return 1;
   } else {
diff --git a/src/core/ddsi/src/q_ddsi_discovery.c b/src/core/ddsi/src/q_ddsi_discovery.c
index ca34713..3f5a4b6 100644
--- a/src/core/ddsi/src/q_ddsi_discovery.c
+++ b/src/core/ddsi/src/q_ddsi_discovery.c
@@ -799,7 +799,7 @@ static void handle_SPDP (const struct receiver_state *rst, nn_wctime_t timestamp
     src.bufsz = len - 4;
     if ((plist_ret = nn_plist_init_frommsg (&decoded_data, NULL, ~(uint64_t)0, ~(uint64_t)0, &src)) < 0)
     {
-      if (plist_ret != ERR_INCOMPATIBLE)
+      if (plist_ret != Q_ERR_INCOMPATIBLE)
         DDS_WARNING("SPDP (vendor %u.%u): invalid qos/parameters\n", src.vendorid.id[0], src.vendorid.id[1]);
       return;
     }
@@ -1341,7 +1341,7 @@ static void handle_SEDP (const struct receiver_state *rst, nn_wctime_t timestamp
     src.bufsz = len - 4;
     if ((plist_ret = nn_plist_init_frommsg (&decoded_data, NULL, ~(uint64_t)0, ~(uint64_t)0, &src)) < 0)
     {
-      if (plist_ret != ERR_INCOMPATIBLE)
+      if (plist_ret != Q_ERR_INCOMPATIBLE)
         DDS_WARNING("SEDP (vendor %u.%u): invalid qos/parameters\n", src.vendorid.id[0], src.vendorid.id[1]);
       return;
     }
@@ -1469,7 +1469,7 @@ static void handle_SEDP_CM (const struct receiver_state *rst, nn_entityid_t wr_e
     src.bufsz = len - 4;
     if ((plist_ret = nn_plist_init_frommsg (&decoded_data, NULL, ~(uint64_t)0, ~(uint64_t)0, &src)) < 0)
     {
-      if (plist_ret != ERR_INCOMPATIBLE)
+      if (plist_ret != Q_ERR_INCOMPATIBLE)
         DDS_WARNING("SEDP_CM (vendor %u.%u): invalid qos/parameters\n", src.vendorid.id[0], src.vendorid.id[1]);
       return;
     }
@@ -1631,7 +1631,7 @@ static void handle_SEDP_GROUP (const struct receiver_state *rst, nn_wctime_t tim
     src.bufsz = len - 4;
     if ((plist_ret = nn_plist_init_frommsg (&decoded_data, NULL, ~(uint64_t)0, ~(uint64_t)0, &src)) < 0)
     {
-      if (plist_ret != ERR_INCOMPATIBLE)
+      if (plist_ret != Q_ERR_INCOMPATIBLE)
         DDS_WARNING("SEDP_GROUP (vendor %u.%u): invalid qos/parameters\n", src.vendorid.id[0], src.vendorid.id[1]);
       return;
     }
@@ -1754,7 +1754,7 @@ int builtins_dqueue_handler (const struct nn_rsample_info *sampleinfo, const str
     src.bufsz = NN_RDATA_PAYLOAD_OFF (fragchain) - qos_offset;
     if ((plist_ret = nn_plist_init_frommsg (&qos, NULL, PP_STATUSINFO | PP_KEYHASH, 0, &src)) < 0)
     {
-      if (plist_ret != ERR_INCOMPATIBLE)
+      if (plist_ret != Q_ERR_INCOMPATIBLE)
         DDS_WARNING("data(builtin, vendor %u.%u): %x:%x:%x:%x #%"PRId64": invalid inline qos\n",
                     src.vendorid.id[0], src.vendorid.id[1], PGUID (srcguid), sampleinfo->seq);
       goto done_upd_deliv;
diff --git a/src/core/ddsi/src/q_entity.c b/src/core/ddsi/src/q_entity.c
index 39e15c2..d83f225 100644
--- a/src/core/ddsi/src/q_entity.c
+++ b/src/core/ddsi/src/q_entity.c
@@ -381,7 +381,7 @@ int pp_allocate_entityid(nn_entityid_t *id, unsigned kind, struct participant *p
   else
   {
     DDS_ERROR("pp_allocate_entityid(%x:%x:%x:%x): all ids in use\n", PGUID(pp->e.guid));
-    ret = ERR_OUT_OF_IDS;
+    ret = Q_ERR_OUT_OF_IDS;
   }
   ddsrt_mutex_unlock (&pp->e.lock);
   return ret;
@@ -412,7 +412,7 @@ int new_participant_guid (const nn_guid_t *ppguid, unsigned flags, const nn_plis
      used to exist, but is currently being deleted and we're trying to
      recreate it. */
   if (ephash_lookup_participant_guid (ppguid) != NULL)
-    return ERR_ENTITY_EXISTS;
+    return Q_ERR_ENTITY_EXISTS;
 
   if (config.max_participants == 0)
   {
@@ -432,7 +432,7 @@ int new_participant_guid (const nn_guid_t *ppguid, unsigned flags, const nn_plis
     {
       ddsrt_mutex_unlock (&gv.participant_set_lock);
       DDS_ERROR("new_participant(%x:%x:%x:%x, %x) failed: max participants reached\n", PGUID (*ppguid), flags);
-      return ERR_OUT_OF_IDS;
+      return Q_ERR_OUT_OF_IDS;
     }
   }
 
@@ -659,7 +659,7 @@ int new_participant (nn_guid_t *p_ppguid, unsigned flags, const nn_plist_t *plis
   if (gv.next_ppguid.prefix.u[2]++ == ~0u)
   {
     ddsrt_mutex_unlock (&gv.privileged_pp_lock);
-    return ERR_OUT_OF_IDS;
+    return Q_ERR_OUT_OF_IDS;
   }
   ddsrt_mutex_unlock (&gv.privileged_pp_lock);
   *p_ppguid = ppguid;
@@ -854,7 +854,7 @@ int delete_participant (const struct nn_guid *ppguid)
 {
   struct participant *pp;
   if ((pp = ephash_lookup_participant_guid (ppguid)) == NULL)
-    return ERR_UNKNOWN_ENTITY;
+    return Q_ERR_UNKNOWN_ENTITY;
   ddsi_plugin.builtintopic_write (&pp->e, now(), false);
   remember_deleted_participant_guid (&pp->e.guid);
   ephash_remove_participant_guid (pp);
@@ -1105,7 +1105,7 @@ static void rebuild_trace_covered(int nreaders, int nlocs, const nn_locator_t *l
   int i, j;
   for (i = 0; i < nlocs; i++)
   {
-    char buf[INET6_ADDRSTRLEN_EXTENDED];
+    char buf[DDSI_LOCATORSTRLEN];
     ddsi_locator_to_string(buf, sizeof(buf), &locs[i]);
     DDS_LOG(DDS_LC_DISCOVERY, "  loc %2d = %-20s %2d {", i, buf, locs_nrds[i]);
     for (j = 0; j < nreaders; j++)
@@ -1140,7 +1140,7 @@ static int rebuild_select(int nlocs, const nn_locator_t *locs, const int *locs_n
 
 static void rebuild_add(struct addrset *newas, int locidx, int nreaders, int nlocs, const nn_locator_t *locs, const int8_t *covered)
 {
-  char str[INET6_ADDRSTRLEN_EXTENDED];
+  char str[DDSI_LOCATORSTRLEN];
   if (locs[locidx].kind != NN_LOCATOR_KIND_UDPv4MCGEN)
   {
     ddsi_locator_to_string(str, sizeof(str), &locs[locidx]);
@@ -2987,7 +2987,7 @@ int delete_writer_nolinger (const struct nn_guid *guid)
   if ((wr = ephash_lookup_writer_guid (guid)) == NULL)
   {
     DDS_LOG(DDS_LC_DISCOVERY, "delete_writer_nolinger(guid %x:%x:%x:%x) - unknown guid\n", PGUID (*guid));
-    return ERR_UNKNOWN_ENTITY;
+    return Q_ERR_UNKNOWN_ENTITY;
   }
   DDS_LOG(DDS_LC_DISCOVERY, "delete_writer_nolinger(guid %x:%x:%x:%x) ...\n", PGUID (*guid));
   ddsrt_mutex_lock (&wr->e.lock);
@@ -3010,7 +3010,7 @@ int delete_writer (const struct nn_guid *guid)
   if ((wr = ephash_lookup_writer_guid (guid)) == NULL)
   {
     DDS_LOG(DDS_LC_DISCOVERY, "delete_writer(guid %x:%x:%x:%x) - unknown guid\n", PGUID (*guid));
-    return ERR_UNKNOWN_ENTITY;
+    return Q_ERR_UNKNOWN_ENTITY;
   }
   DDS_LOG(DDS_LC_DISCOVERY, "delete_writer(guid %x:%x:%x:%x) ...\n", PGUID (*guid));
   ddsrt_mutex_lock (&wr->e.lock);
@@ -3029,12 +3029,12 @@ int delete_writer (const struct nn_guid *guid)
   else
   {
     nn_mtime_t tsched;
-    int tsec, tusec;
+    int32_t tsec, tusec;
     writer_set_state (wr, WRST_LINGERING);
     ddsrt_mutex_unlock (&wr->e.lock);
     tsched = add_duration_to_mtime (now_mt (), config.writer_linger_duration);
     mtime_to_sec_usec (&tsec, &tusec, tsched);
-    DDS_LOG(DDS_LC_DISCOVERY, "delete_writer(guid %x:%x:%x:%x) - unack'ed samples, will delete when ack'd or at t = %d.%06d\n",
+    DDS_LOG(DDS_LC_DISCOVERY, "delete_writer(guid %x:%x:%x:%x) - unack'ed samples, will delete when ack'd or at t = %"PRId32".%06"PRId32"\n",
             PGUID (*guid), tsec, tusec);
     qxev_delete_writer (tsched, &wr->e.guid);
   }
@@ -3388,7 +3388,7 @@ int delete_reader (const struct nn_guid *guid)
   if ((rd = ephash_lookup_reader_guid (guid)) == NULL)
   {
     DDS_LOG(DDS_LC_DISCOVERY, "delete_reader_guid(guid %x:%x:%x:%x) - unknown guid\n", PGUID (*guid));
-    return ERR_UNKNOWN_ENTITY;
+    return Q_ERR_UNKNOWN_ENTITY;
   }
   if (rd->rhc)
   {
@@ -3900,7 +3900,7 @@ int delete_proxy_participant_by_guid (const struct nn_guid * guid, nn_wctime_t t
   {
     ddsrt_mutex_unlock (&gv.lock);
     DDS_LOG(DDS_LC_DISCOVERY, "- unknown\n");
-    return ERR_UNKNOWN_ENTITY;
+    return Q_ERR_UNKNOWN_ENTITY;
   }
   DDS_LOG(DDS_LC_DISCOVERY, "- deleting\n");
   ddsi_plugin.builtintopic_write (&ppt->e, timestamp, false);
@@ -3955,7 +3955,7 @@ int new_proxy_group (const struct nn_guid *guid, const char *name, const struct
         break;
       default:
         DDS_WARNING("new_proxy_group: unrecognised entityid: %x\n", guid->entityid.u);
-        return ERR_INVALID_DATA;
+        return Q_ERR_INVALID_DATA;
     }
     ddsrt_mutex_lock (&proxypp->e.lock);
     if ((pgroup = ut_avlLookupIPath (&proxypp_groups_treedef, &proxypp->groups, guid, &ipath)) != NULL)
@@ -4084,7 +4084,7 @@ int new_proxy_writer (const struct nn_guid *ppguid, const struct nn_guid *guid,
   if ((proxypp = ephash_lookup_proxy_participant_guid (ppguid)) == NULL)
   {
     DDS_WARNING("new_proxy_writer(%x:%x:%x:%x): proxy participant unknown\n", PGUID (*guid));
-    return ERR_UNKNOWN_ENTITY;
+    return Q_ERR_UNKNOWN_ENTITY;
   }
 
   pwr = ddsrt_malloc (sizeof (*pwr));
@@ -4277,7 +4277,7 @@ int delete_proxy_writer (const struct nn_guid *guid, nn_wctime_t timestamp, int
   {
     ddsrt_mutex_unlock (&gv.lock);
     DDS_LOG(DDS_LC_DISCOVERY, "- unknown\n");
-    return ERR_UNKNOWN_ENTITY;
+    return Q_ERR_UNKNOWN_ENTITY;
   }
   /* Set "deleting" flag in particular for Lite, to signal to the receive path it can't
      trust rdary[] anymore, which is because removing the proxy writer from the hash
@@ -4310,7 +4310,7 @@ int new_proxy_reader (const struct nn_guid *ppguid, const struct nn_guid *guid,
   if ((proxypp = ephash_lookup_proxy_participant_guid (ppguid)) == NULL)
   {
     DDS_WARNING("new_proxy_reader(%x:%x:%x:%x): proxy participant unknown\n", PGUID (*guid));
-    return ERR_UNKNOWN_ENTITY;
+    return Q_ERR_UNKNOWN_ENTITY;
   }
 
   prd = ddsrt_malloc (sizeof (*prd));
@@ -4408,7 +4408,7 @@ int delete_proxy_reader (const struct nn_guid *guid, nn_wctime_t timestamp, int
   {
     ddsrt_mutex_unlock (&gv.lock);
     DDS_LOG(DDS_LC_DISCOVERY, "- unknown\n");
-    return ERR_UNKNOWN_ENTITY;
+    return Q_ERR_UNKNOWN_ENTITY;
   }
   ddsi_plugin.builtintopic_write (&prd->e, timestamp, false);
   ephash_remove_proxy_reader_guid (prd);
diff --git a/src/core/ddsi/src/q_lease.c b/src/core/ddsi/src/q_lease.c
index 438c0bf..1dac32c 100644
--- a/src/core/ddsi/src/q_lease.c
+++ b/src/core/ddsi/src/q_lease.c
@@ -164,14 +164,14 @@ void lease_renew (struct lease *l, nn_etime_t tnowE)
 
   if (did_update && (dds_get_log_mask() & DDS_LC_TRACE))
   {
-    int tsec, tusec;
+    int32_t tsec, tusec;
     DDS_TRACE(" L(");
     if (l->entity->guid.entityid.u == NN_ENTITYID_PARTICIPANT)
       DDS_TRACE(":%x", l->entity->guid.entityid.u);
     else
       DDS_TRACE("%x:%x:%x:%x", PGUID (l->entity->guid));
     etime_to_sec_usec (&tsec, &tusec, tend_new);
-    DDS_TRACE(" %d.%06d)", tsec, tusec);
+    DDS_TRACE(" %"PRId32".%06"PRId32")", tsec, tusec);
   }
 }
 
diff --git a/src/core/ddsi/src/q_nwif.c b/src/core/ddsi/src/q_nwif.c
index d6a7109..66c49bf 100644
--- a/src/core/ddsi/src/q_nwif.c
+++ b/src/core/ddsi/src/q_nwif.c
@@ -39,7 +39,7 @@ static void print_sockerror (const char *msg)
 
 unsigned locator_to_hopefully_unique_uint32 (const nn_locator_t *src)
 {
-  unsigned id;
+  unsigned id = 0;
   if (src->kind == NN_LOCATOR_KIND_UDPv4 || src->kind == NN_LOCATOR_KIND_TCPv4)
     memcpy (&id, src->address + 12, sizeof (id));
   else
@@ -93,7 +93,7 @@ static void set_socket_nodelay (ddsrt_socket_t sock)
 static int set_rcvbuf (ddsrt_socket_t socket)
 {
   uint32_t ReceiveBufferSize;
-  uint32_t optlen = (uint32_t) sizeof (ReceiveBufferSize);
+  socklen_t optlen = (socklen_t) sizeof (ReceiveBufferSize);
   uint32_t socket_min_rcvbuf_size;
   if (config.socket_min_rcvbuf_size.isdefault)
     socket_min_rcvbuf_size = 1048576;
@@ -137,7 +137,7 @@ static int set_rcvbuf (ddsrt_socket_t socket)
 static int set_sndbuf (ddsrt_socket_t socket)
 {
   unsigned SendBufferSize;
-  uint32_t optlen = (uint32_t) sizeof(SendBufferSize);
+  socklen_t optlen = (socklen_t) sizeof(SendBufferSize);
   if (ddsrt_getsockopt(socket, SOL_SOCKET, SO_SNDBUF,(char *)&SendBufferSize, &optlen) != DDS_RETCODE_OK)
   {
     print_sockerror ("get SO_SNDBUF");
diff --git a/src/core/ddsi/src/q_plist.c b/src/core/ddsi/src/q_plist.c
index 8ee2ccd..ad97995 100644
--- a/src/core/ddsi/src/q_plist.c
+++ b/src/core/ddsi/src/q_plist.c
@@ -92,18 +92,18 @@ static int validate_string (const struct dd *dd, size_t *len)
   if (dd->bufsz < sizeof (struct cdrstring))
   {
     DDS_TRACE("plist/validate_string: buffer too small (header)\n");
-    return ERR_INVALID;
+    return Q_ERR_INVALID;
   }
   *len = dd->bswap ? bswap4u (x->length) : x->length;
   if (*len < 1 || *len > dd->bufsz - offsetof (struct cdrstring, contents))
   {
     DDS_TRACE("plist/validate_string: length %" PRIuSIZE " out of range\n", *len);
-    return ERR_INVALID;
+    return Q_ERR_INVALID;
   }
   if (x->contents[*len-1] != 0)
   {
     DDS_TRACE("plist/validate_string: terminator missing\n");
-    return ERR_INVALID;
+    return Q_ERR_INVALID;
   }
   return 0;
 }
@@ -142,10 +142,10 @@ static int validate_octetseq (const struct dd *dd, size_t *len)
 {
   const struct cdroctetseq *x = (const struct cdroctetseq *) dd->buf;
   if (dd->bufsz < offsetof (struct cdroctetseq, value))
-    return ERR_INVALID;
+    return Q_ERR_INVALID;
   *len = dd->bswap ? bswap4u (x->len) : x->len;
   if (*len > dd->bufsz - offsetof (struct cdroctetseq, value))
-    return ERR_INVALID;
+    return Q_ERR_INVALID;
   return 0;
 }
 
@@ -193,7 +193,7 @@ static int validate_stringseq (const struct dd *dd)
   if (dd->bufsz < sizeof (int))
   {
     DDS_TRACE("plist/validate_stringseq: buffer too small (header)\n");
-    return ERR_INVALID;
+    return Q_ERR_INVALID;
   }
   memcpy (&n, seq, sizeof (n));
   if (dd->bswap)
@@ -202,7 +202,7 @@ static int validate_stringseq (const struct dd *dd)
   if (n < 0)
   {
     DDS_TRACE("plist/validate_stringseq: length %d out of range\n", n);
-    return ERR_INVALID;
+    return Q_ERR_INVALID;
   }
   else if (n == 0)
   {
@@ -226,7 +226,7 @@ static int validate_stringseq (const struct dd *dd)
     if (i < n)
     {
       DDS_TRACE("plist/validate_stringseq: buffer too small (contents)\n");
-      return ERR_INVALID;
+      return Q_ERR_INVALID;
     }
   }
   /* Should I worry about junk between the last string & the end of
@@ -248,7 +248,7 @@ static int alias_stringseq (nn_stringseq_t *strseq, const struct dd *dd)
   if (dd->bufsz < sizeof (int))
   {
     DDS_TRACE("plist/alias_stringseq: buffer too small (header)\n");
-    return ERR_INVALID;
+    return Q_ERR_INVALID;
   }
   memcpy (&strseq->n, seq, sizeof (strseq->n));
   if (dd->bswap)
@@ -257,7 +257,7 @@ static int alias_stringseq (nn_stringseq_t *strseq, const struct dd *dd)
   if (strseq->n >= UINT_MAX / sizeof(*strs))
   {
     DDS_TRACE("plist/alias_stringseq: length %u out of range\n", strseq->n);
-    return ERR_INVALID;
+    return Q_ERR_INVALID;
   }
   else if (strseq->n == 0)
   {
@@ -284,7 +284,7 @@ static int alias_stringseq (nn_stringseq_t *strseq, const struct dd *dd)
     if (i != strseq->n)
     {
       DDS_TRACE("plist/validate_stringseq: buffer too small (contents)\n");
-      result = ERR_INVALID;
+      result = Q_ERR_INVALID;
       goto fail;
     }
     strseq->strs = strs;
@@ -535,7 +535,7 @@ static int validate_time (const nn_ddsi_time_t *t)
   else
   {
     DDS_TRACE("plist/validate_time: invalid timestamp (%08x.%08x)\n", t->seconds, t->fraction);
-    return ERR_INVALID;
+    return Q_ERR_INVALID;
   }
 }
 
@@ -555,7 +555,7 @@ static int do_duration (nn_duration_t *q, uint64_t *present, uint64_t fl, const
   if (dd->bufsz < sizeof (*q))
   {
     DDS_TRACE("plist/do_duration: buffer too small\n");
-    return ERR_INVALID;
+    return Q_ERR_INVALID;
   }
   memcpy (q, dd->buf, sizeof (*q));
   if (dd->bswap)
@@ -582,7 +582,7 @@ int validate_durability_qospolicy (const nn_durability_qospolicy_t *q)
       break;
     default:
       DDS_TRACE("plist/validate_durability_qospolicy: invalid kind (%d)\n", (int) q->kind);
-      return ERR_INVALID;
+      return Q_ERR_INVALID;
   }
   return 0;
 }
@@ -614,7 +614,7 @@ int validate_history_qospolicy (const nn_history_qospolicy_t *q)
       break;
     default:
       DDS_TRACE("plist/validate_history_qospolicy: invalid kind (%d)\n", (int) q->kind);
-      return ERR_INVALID;
+      return Q_ERR_INVALID;
   }
   /* Accept all values for depth if kind = ALL */
   if (q->kind == NN_KEEP_LAST_HISTORY_QOS)
@@ -622,7 +622,7 @@ int validate_history_qospolicy (const nn_history_qospolicy_t *q)
     if (q->depth < 1)
     {
       DDS_TRACE("plist/validate_history_qospolicy: invalid depth (%d)\n", (int) q->depth);
-      return ERR_INVALID;
+      return Q_ERR_INVALID;
     }
   }
   return 0;
@@ -649,17 +649,17 @@ int validate_resource_limits_qospolicy (const nn_resource_limits_qospolicy_t *q)
   if (q->max_samples < 1 && q->max_samples != unlimited)
   {
     DDS_TRACE("plist/validate_resource_limits_qospolicy: max_samples invalid (%d)\n", (int) q->max_samples);
-    return ERR_INVALID;
+    return Q_ERR_INVALID;
   }
   if (q->max_instances < 1 && q->max_instances != unlimited)
   {
     DDS_TRACE("plist/validate_resource_limits_qospolicy: max_instances invalid (%d)\n", (int) q->max_instances);
-    return ERR_INVALID;
+    return Q_ERR_INVALID;
   }
   if (q->max_samples_per_instance < 1 && q->max_samples_per_instance != unlimited)
   {
     DDS_TRACE("plist/validate_resource_limits_qospolicy: max_samples_per_instance invalid (%d)\n", (int) q->max_samples_per_instance);
-    return ERR_INVALID;
+    return Q_ERR_INVALID;
   }
   if (q->max_samples != unlimited && q->max_samples_per_instance != unlimited)
   {
@@ -668,7 +668,7 @@ int validate_resource_limits_qospolicy (const nn_resource_limits_qospolicy_t *q)
     if (q->max_samples < q->max_samples_per_instance)
     {
       DDS_TRACE("plist/validate_resource_limits_qospolicy: max_samples (%d) and max_samples_per_instance (%d) incompatible\n", (int) q->max_samples, (int) q->max_samples_per_instance);
-      return ERR_INVALID;
+      return Q_ERR_INVALID;
     }
   }
   return 0;
@@ -695,7 +695,7 @@ int validate_history_and_resource_limits (const nn_history_qospolicy_t *qh, cons
       if (qr->max_samples_per_instance != unlimited)
       {
         DDS_TRACE("plist/validate_history_and_resource_limits: max_samples_per_instance (%d) incompatible with KEEP_ALL policy\n", (int) qr->max_samples_per_instance);
-        return ERR_INVALID;
+        return Q_ERR_INVALID;
       }
 #endif
       break;
@@ -703,7 +703,7 @@ int validate_history_and_resource_limits (const nn_history_qospolicy_t *qh, cons
       if (qr->max_samples_per_instance != unlimited && qh->depth > qr->max_samples_per_instance)
       {
         DDS_TRACE("plist/validate_history_and_resource_limits: depth (%d) and max_samples_per_instance (%d) incompatible with KEEP_LAST policy\n", (int) qh->depth, (int) qr->max_samples_per_instance);
-        return ERR_INVALID;
+        return Q_ERR_INVALID;
       }
       break;
   }
@@ -766,7 +766,7 @@ int validate_liveliness_qospolicy (const nn_liveliness_qospolicy_t *q)
       return res;
     default:
       DDS_TRACE("plist/validate_liveliness_qospolicy: invalid kind (%d)\n", (int) q->kind);
-      return ERR_INVALID;
+      return Q_ERR_INVALID;
   }
 }
 
@@ -794,7 +794,7 @@ static int validate_xform_reliability_qospolicy (nn_reliability_qospolicy_t *qds
         return res;
       default:
         DDS_TRACE("plist/validate_xform_reliability_qospolicy[pedantic]: invalid kind (%d)\n", (int) qext->kind);
-        return ERR_INVALID;
+        return Q_ERR_INVALID;
     }
   }
   else
@@ -811,7 +811,7 @@ static int validate_xform_reliability_qospolicy (nn_reliability_qospolicy_t *qds
         return res;
       default:
         DDS_TRACE("plist/validate_xform_reliability_qospolicy[!pedantic]: invalid kind (%d)\n", (int) qext->kind);
-        return ERR_INVALID;
+        return Q_ERR_INVALID;
     }
   }
 }
@@ -830,7 +830,7 @@ int validate_destination_order_qospolicy (const nn_destination_order_qospolicy_t
       return 0;
     default:
       DDS_TRACE("plist/validate_destination_order_qospolicy: invalid kind (%d)\n", (int) q->kind);
-      return ERR_INVALID;
+      return Q_ERR_INVALID;
   }
 }
 
@@ -848,7 +848,7 @@ int validate_ownership_qospolicy (const nn_ownership_qospolicy_t *q)
       return 0;
     default:
       DDS_TRACE("plist/validate_ownership_qospolicy: invalid kind (%d)\n", (int) q->kind);
-      return ERR_INVALID;
+      return Q_ERR_INVALID;
   }
 }
 
@@ -877,18 +877,18 @@ int validate_presentation_qospolicy (const nn_presentation_qospolicy_t *q)
       break;
     default:
       DDS_TRACE("plist/validate_presentation_qospolicy: invalid access_scope (%d)\n", (int) q->access_scope);
-      return ERR_INVALID;
+      return Q_ERR_INVALID;
   }
   /* Bools must be 0 or 1, i.e., only the lsb may be set */
   if (q->coherent_access & ~1)
   {
     DDS_TRACE("plist/validate_presentation_qospolicy: coherent_access invalid (%d)\n", (int) q->coherent_access);
-    return ERR_INVALID;
+    return Q_ERR_INVALID;
   }
   if (q->ordered_access & ~1)
   {
     DDS_TRACE("plist/validate_presentation_qospolicy: ordered_access invalid (%d)\n", (int) q->ordered_access);
-    return ERR_INVALID;
+    return Q_ERR_INVALID;
   }
   /* coherent_access & ordered_access are a bit irrelevant for
      instance presentation qos, but it appears as if their values are
@@ -964,7 +964,7 @@ static int do_locator
   if (dd->bufsz < sizeof (loc))
   {
     DDS_TRACE("plist/do_locator: buffer too small\n");
-    return ERR_INVALID;
+    return Q_ERR_INVALID;
   }
   memcpy (&loc, dd->buf, sizeof (loc));
   if (dd->bswap)
@@ -979,12 +979,12 @@ static int do_locator
       if (loc.port <= 0 || loc.port > 65535)
       {
         DDS_TRACE("plist/do_locator[kind=IPv4]: invalid port (%d)\n", (int) loc.port);
-        return ERR_INVALID;
+        return Q_ERR_INVALID;
       }
       if (!locator_address_prefix12_zero (&loc))
       {
         DDS_TRACE("plist/do_locator[kind=IPv4]: junk in address prefix\n");
-        return ERR_INVALID;
+        return Q_ERR_INVALID;
       }
       break;
     case NN_LOCATOR_KIND_UDPv6:
@@ -992,7 +992,7 @@ static int do_locator
       if (loc.port <= 0 || loc.port > 65535)
       {
         DDS_TRACE("plist/do_locator[kind=IPv6]: invalid port (%d)\n", (int) loc.port);
-        return ERR_INVALID;
+        return Q_ERR_INVALID;
       }
       break;
     case NN_LOCATOR_KIND_UDPv4MCGEN: {
@@ -1002,12 +1002,12 @@ static int do_locator
       if (loc.port <= 0 || loc.port > 65536)
       {
         DDS_TRACE("plist/do_locator[kind=IPv4MCGEN]: invalid port (%d)\n", (int) loc.port);
-        return ERR_INVALID;
+        return Q_ERR_INVALID;
       }
       if ((int)x->base + x->count >= 28 || x->count == 0 || x->idx >= x->count)
       {
         DDS_TRACE("plist/do_locator[kind=IPv4MCGEN]: invalid base/count/idx (%u,%u,%u)\n", x->base, x->count, x->idx);
-        return ERR_INVALID;
+        return Q_ERR_INVALID;
       }
       break;
     }
@@ -1015,12 +1015,12 @@ static int do_locator
       if (!locator_address_zero (&loc))
       {
         DDS_TRACE("plist/do_locator[kind=INVALID]: junk in address\n");
-        return ERR_INVALID;
+        return Q_ERR_INVALID;
       }
       if (loc.port != 0)
       {
         DDS_TRACE("plist/do_locator[kind=INVALID]: junk in port\n");
-        return ERR_INVALID;
+        return Q_ERR_INVALID;
       }
       /* silently dropped correctly formatted "invalid" locators. */
       return 0;
@@ -1029,7 +1029,7 @@ static int do_locator
       return 0;
     default:
       DDS_TRACE("plist/do_locator: invalid kind (%d)\n", (int) loc.kind);
-      return NN_PEDANTIC_P ? ERR_INVALID : 0;
+      return NN_PEDANTIC_P ? Q_ERR_INVALID : 0;
   }
   return add_locator (ls, present, wanted, fl, &loc);
 }
@@ -1052,7 +1052,7 @@ static int do_ipv4address (nn_plist_t *dest, nn_ipaddress_params_tmp_t *dest_tmp
   if (dd->bufsz < sizeof (*a))
   {
     DDS_TRACE("plist/do_ipv4address: buffer too small\n");
-    return ERR_INVALID;
+    return Q_ERR_INVALID;
   }
   switch (fl_tmp)
   {
@@ -1122,7 +1122,7 @@ static int do_port (nn_plist_t *dest, nn_ipaddress_params_tmp_t *dest_tmp, uint6
   if (dd->bufsz < sizeof (*p))
   {
     DDS_TRACE("plist/do_port: buffer too small\n");
-    return ERR_INVALID;
+    return Q_ERR_INVALID;
   }
   switch (fl_tmp)
   {
@@ -1156,7 +1156,7 @@ static int do_port (nn_plist_t *dest, nn_ipaddress_params_tmp_t *dest_tmp, uint6
   if (*p <= 0 || *p > 65535)
   {
     DDS_TRACE("plist/do_port: invalid port (%d)\n", (int) *p);
-    return ERR_INVALID;
+    return Q_ERR_INVALID;
   }
   dest_tmp->present |= fl_tmp;
   if ((dest_tmp->present & (fl_tmp | fl1_tmp)) == (fl_tmp | fl1_tmp))
@@ -1185,7 +1185,7 @@ static int valid_participant_guid (const nn_guid_t *g, UNUSED_ARG (const struct
     else
     {
       DDS_TRACE("plist/valid_participant_guid: prefix is 0 but entityid is not (%u)\n", g->entityid.u);
-      return ERR_INVALID;
+      return Q_ERR_INVALID;
     }
   }
   else if (g->entityid.u == NN_ENTITYID_PARTICIPANT)
@@ -1195,7 +1195,7 @@ static int valid_participant_guid (const nn_guid_t *g, UNUSED_ARG (const struct
   else
   {
     DDS_TRACE("plist/valid_participant_guid: entityid not a participant entityid (%u)\n", g->entityid.u);
-    return ERR_INVALID;
+    return Q_ERR_INVALID;
   }
 }
 
@@ -1209,7 +1209,7 @@ static int valid_group_guid (const nn_guid_t *g, UNUSED_ARG (const struct dd *dd
     else
     {
       DDS_TRACE("plist/valid_group_guid: prefix is 0 but entityid is not (%u)\n", g->entityid.u);
-      return ERR_INVALID;
+      return Q_ERR_INVALID;
     }
   }
   else if (g->entityid.u != 0)
@@ -1220,7 +1220,7 @@ static int valid_group_guid (const nn_guid_t *g, UNUSED_ARG (const struct dd *dd
   else
   {
     DDS_TRACE("plist/valid_group_guid: entityid is 0\n");
-    return ERR_INVALID;
+    return Q_ERR_INVALID;
   }
 }
 
@@ -1234,7 +1234,7 @@ static int valid_endpoint_guid (const nn_guid_t *g, const struct dd *dd)
     else
     {
       DDS_TRACE("plist/valid_endpoint_guid: prefix is 0 but entityid is not (%x)\n", g->entityid.u);
-      return ERR_INVALID;
+      return Q_ERR_INVALID;
     }
   }
   switch (g->entityid.u & NN_ENTITYID_SOURCE_MASK)
@@ -1255,7 +1255,7 @@ static int valid_endpoint_guid (const nn_guid_t *g, const struct dd *dd)
             DDS_TRACE("plist/valid_endpoint_guid[src=USER,proto=%u.%u]: invalid kind (%x)\n",
                     dd->protocol_version.major, dd->protocol_version.minor,
                     g->entityid.u & NN_ENTITYID_KIND_MASK);
-            return ERR_INVALID;
+            return Q_ERR_INVALID;
           }
       }
     case NN_ENTITYID_SOURCE_BUILTIN:
@@ -1279,7 +1279,7 @@ static int valid_endpoint_guid (const nn_guid_t *g, const struct dd *dd)
           {
             DDS_TRACE("plist/valid_endpoint_guid[src=BUILTIN,proto=%u.%u]: invalid entityid (%x)\n",
                     dd->protocol_version.major, dd->protocol_version.minor, g->entityid.u);
-            return ERR_INVALID;
+            return Q_ERR_INVALID;
           }
       }
     case NN_ENTITYID_SOURCE_VENDOR:
@@ -1309,7 +1309,7 @@ static int valid_endpoint_guid (const nn_guid_t *g, const struct dd *dd)
       }
     default:
       DDS_TRACE("plist/valid_endpoint_guid: invalid source (%x)\n", g->entityid.u);
-      return ERR_INVALID;
+      return Q_ERR_INVALID;
   }
 }
 
@@ -1318,7 +1318,7 @@ static int do_guid (nn_guid_t *dst, uint64_t *present, uint64_t fl, int (*valid)
   if (dd->bufsz < sizeof (*dst))
   {
     DDS_TRACE("plist/do_guid: buffer too small\n");
-    return ERR_INVALID;
+    return Q_ERR_INVALID;
   }
   memcpy (dst, dd->buf, sizeof (*dst));
   *dst = nn_ntoh_guid (*dst);
@@ -1334,7 +1334,7 @@ static int do_guid (nn_guid_t *dst, uint64_t *present, uint64_t fl, int (*valid)
     }
     else
     {
-      return ERR_INVALID;
+      return Q_ERR_INVALID;
     }
   }
   *present |= fl;
@@ -1358,7 +1358,7 @@ static int do_prismtech_participant_version_info (nn_prismtech_participant_versi
   else if (dd->bufsz < NN_PRISMTECH_PARTICIPANT_VERSION_INFO_FIXED_CDRSIZE)
   {
     DDS_TRACE("plist/do_prismtech_participant_version_info[pid=PRISMTECH_PARTICIPANT_VERSION_INFO]: buffer too small\n");
-    return ERR_INVALID;
+    return Q_ERR_INVALID;
   }
   else
   {
@@ -1393,13 +1393,13 @@ static int do_subscription_keys_qospolicy (nn_subscription_keys_qospolicy_t *q,
   if (dd->bufsz < 4)
   {
     DDS_TRACE("plist/do_subscription_keys: buffer too small\n");
-    return ERR_INVALID;
+    return Q_ERR_INVALID;
   }
   q->use_key_list = (unsigned char) dd->buf[0];
   if (q->use_key_list != 0 && q->use_key_list != 1)
   {
     DDS_TRACE("plist/do_subscription_keys: invalid use_key_list (%d)\n", (int) q->use_key_list);
-    return ERR_INVALID;
+    return Q_ERR_INVALID;
   }
   dd1 = *dd;
   dd1.buf += 4;
@@ -1423,7 +1423,7 @@ static int do_reader_lifespan_qospolicy (nn_reader_lifespan_qospolicy_t *q, uint
   if (dd->bufsz < sizeof (*q))
   {
     DDS_TRACE("plist/do_reader_lifespan: buffer too small\n");
-    return ERR_INVALID;
+    return Q_ERR_INVALID;
   }
   *q = *((nn_reader_lifespan_qospolicy_t *) dd->buf);
   if (dd->bswap)
@@ -1431,7 +1431,7 @@ static int do_reader_lifespan_qospolicy (nn_reader_lifespan_qospolicy_t *q, uint
   if (q->use_lifespan != 0 && q->use_lifespan != 1)
   {
     DDS_TRACE("plist/do_reader_lifespan: invalid use_lifespan (%d)\n", (int) q->use_lifespan);
-    return ERR_INVALID;
+    return Q_ERR_INVALID;
   }
   if ((res = validate_duration (&q->duration)) >= 0)
     *present |= fl;
@@ -1443,13 +1443,13 @@ static int do_entity_factory_qospolicy (nn_entity_factory_qospolicy_t *q, uint64
   if (dd->bufsz < sizeof (*q))
   {
     DDS_TRACE("plist/do_entity_factory: buffer too small\n");
-    return ERR_INVALID;
+    return Q_ERR_INVALID;
   }
   q->autoenable_created_entities = dd->buf[0];
   if (q->autoenable_created_entities != 0 && q->autoenable_created_entities != 1)
   {
     DDS_TRACE("plist/do_entity_factory: invalid autoenable_created_entities (%d)\n", (int) q->autoenable_created_entities);
-    return ERR_INVALID;
+    return Q_ERR_INVALID;
   }
   *present |= fl;
   return 0;
@@ -1461,17 +1461,17 @@ int validate_reader_data_lifecycle (const nn_reader_data_lifecycle_qospolicy_t *
       validate_duration (&q->autopurge_disposed_samples_delay) < 0)
   {
     DDS_TRACE("plist/init_one_parameter[pid=PRISMTECH_READER_DATA_LIFECYCLE]: invalid autopurge_nowriter_sample_delay or autopurge_disposed_samples_delay\n");
-    return ERR_INVALID;
+    return Q_ERR_INVALID;
   }
   if (q->autopurge_dispose_all != 0 && q->autopurge_dispose_all != 1)
   {
     DDS_TRACE("plist/init_one_parameter[pid=PRISMTECH_READER_DATA_LIFECYCLE]: invalid autopurge_dispose_all\n");
-    return ERR_INVALID;
+    return Q_ERR_INVALID;
   }
   if (q->enable_invalid_samples != 0 && q->enable_invalid_samples != 1)
   {
     DDS_TRACE("plist/init_one_parameter[pid=PRISMTECH_READER_DATA_LIFECYCLE]: invalid enable_invalid_samples\n");
-    return ERR_INVALID;
+    return Q_ERR_INVALID;
   }
   /* Don't check consistency between enable_invalid_samples and invalid_samples_mode (yet) */
   switch (q->invalid_sample_visibility)
@@ -1482,7 +1482,7 @@ int validate_reader_data_lifecycle (const nn_reader_data_lifecycle_qospolicy_t *
       break;
     default:
       DDS_TRACE("plist/init_one_parameter[pid=PRISMTECH_READER_DATA_LIFECYCLE]: invalid invalid_sample_visibility\n");
-      return ERR_INVALID;
+      return Q_ERR_INVALID;
   }
   return 0;
 }
@@ -1535,7 +1535,7 @@ static int init_one_parameter
     if (dd->bufsz < sizeof (nn_##name_##_qospolicy_t))                  \
     {                                                                   \
       DDS_TRACE("plist/init_one_parameter[pid=%s]: buffer too small\n", #NAME_); \
-      return ERR_INVALID;                                               \
+      return Q_ERR_INVALID;                                             \
     }                                                                   \
     else                                                                \
     {                                                                   \
@@ -1562,7 +1562,7 @@ static int init_one_parameter
       if (dd->bufsz < sizeof (nn_durability_service_qospolicy_t))
       {
         DDS_TRACE("plist/init_one_parameter[pid=DURABILITY_SERVICE]: buffer too small\n");
-        return ERR_INVALID;
+        return Q_ERR_INVALID;
       }
       else
       {
@@ -1589,7 +1589,7 @@ static int init_one_parameter
       if (dd->bufsz < sizeof (nn_external_reliability_qospolicy_t))
       {
         DDS_TRACE("plist/init_one_parameter[pid=RELIABILITY]: buffer too small\n");
-        return ERR_INVALID;
+        return Q_ERR_INVALID;
       }
       else
       {
@@ -1640,7 +1640,7 @@ static int init_one_parameter
         else
         {
           DDS_TRACE("plist/init_one_parameter[pid=PRISMTECH_READER_DATA_LIFECYCLE]: buffer too small\n");
-          ret = ERR_INVALID;
+          ret = Q_ERR_INVALID;
         }
         if (ret >= 0)
           dest->qos.present |= QP_PRISMTECH_READER_DATA_LIFECYCLE;
@@ -1655,7 +1655,7 @@ static int init_one_parameter
         if (dd->bufsz < 1)
         {
           DDS_TRACE("plist/init_one_parameter[pid=PRISMTECH_WRITER_DATA_LIFECYCLE]: buffer too small\n");
-          return ERR_INVALID;
+          return Q_ERR_INVALID;
         }
         else if (dd->bufsz < sizeof (*q))
         {
@@ -1676,13 +1676,13 @@ static int init_one_parameter
         if (q->autodispose_unregistered_instances & ~1)
         {
           DDS_TRACE("plist/init_one_parameter[pid=PRISMTECH_WRITER_DATA_LIFECYCLE]: invalid autodispose_unregistered_instances (%d)\n", (int) q->autodispose_unregistered_instances);
-          return ERR_INVALID;
+          return Q_ERR_INVALID;
         }
         if (validate_duration (&q->autounregister_instance_delay) < 0 ||
             validate_duration (&q->autopurge_suspended_samples_delay) < 0)
         {
           DDS_TRACE("plist/init_one_parameter[pid=PRISMTECH_WRITER_DATA_LIFECYCLE]: invalid autounregister_instance_delay or autopurge_suspended_samples_delay\n");
-          return ERR_INVALID;
+          return Q_ERR_INVALID;
         }
         dest->qos.present |= QP_PRISMTECH_WRITER_DATA_LIFECYCLE;
         return 0;
@@ -1694,7 +1694,7 @@ static int init_one_parameter
       else if (dd->bufsz < sizeof (dest->qos.relaxed_qos_matching))
       {
         DDS_TRACE("plist/init_one_parameter[pid=PRISMTECH_RELAXED_QOS_MATCHING]: buffer too small\n");
-        return ERR_INVALID;
+        return Q_ERR_INVALID;
       }
       else
       {
@@ -1703,7 +1703,7 @@ static int init_one_parameter
         if (rqm->value != 0 && rqm->value != 1)
         {
           DDS_TRACE("plist/init_one_parameter[pid=PRISMTECH_RELAXED_QOS_MATCHING]: invalid\n");
-          return ERR_INVALID;
+          return Q_ERR_INVALID;
         }
         dest->qos.present |= QP_PRISMTECH_RELAXED_QOS_MATCHING;
         return 0;
@@ -1715,7 +1715,7 @@ static int init_one_parameter
       else if (dd->bufsz < sizeof (dest->qos.synchronous_endpoint))
       {
         DDS_TRACE("plist/init_one_parameter[pid=PRISMTECH_SYNCHRONOUS_ENDPOINT]: buffer too small\n");
-        return ERR_INVALID;
+        return Q_ERR_INVALID;
       }
       else
       {
@@ -1724,7 +1724,7 @@ static int init_one_parameter
         if (q->value != 0 && q->value != 1)
         {
           DDS_TRACE("plist/init_one_parameter[pid=PRISMTECH_SYNCHRONOUS_ENDPOINT]: invalid value for synchronous flag\n");
-          return ERR_INVALID;
+          return Q_ERR_INVALID;
         }
         dest->qos.present |= QP_PRISMTECH_SYNCHRONOUS_ENDPOINT;
         return 0;
@@ -1735,7 +1735,7 @@ static int init_one_parameter
       if (dd->bufsz < sizeof (nn_protocol_version_t))
       {
         DDS_TRACE("plist/init_one_parameter[pid=PROTOCOL_VERSION]: buffer too small\n");
-        return ERR_INVALID;
+        return Q_ERR_INVALID;
       }
       memcpy (&dest->protocol_version, dd->buf, sizeof (dest->protocol_version));
       if (NN_STRICT_P &&
@@ -1748,14 +1748,14 @@ static int init_one_parameter
         DDS_TRACE("plist/init_one_parameter[pid=PROTOCOL_VERSION,mode=STRICT]: version (%u.%u) mismatch with message (%u.%u)\n",
                 dest->protocol_version.major, dest->protocol_version.minor,
                 dd->protocol_version.major, dd->protocol_version.minor);
-        return ERR_INVALID;
+        return Q_ERR_INVALID;
       }
       dest->present |= PP_PROTOCOL_VERSION;
       return 0;
 
     case PID_VENDORID:
       if (dd->bufsz < sizeof (nn_vendorid_t))
-        return ERR_INVALID;
+        return Q_ERR_INVALID;
       memcpy (&dest->vendorid, dd->buf, sizeof (dest->vendorid));
       if (NN_STRICT_P &&
           (dest->vendorid.id[0] != dd->vendorid.id[0] ||
@@ -1764,7 +1764,7 @@ static int init_one_parameter
         /* see PROTOCOL_VERSION */
         DDS_TRACE("plist/init_one_parameter[pid=VENDORID,mode=STRICT]: vendor (%u.%u) mismatch with message (%u.%u)\n",
                 dest->vendorid.id[0], dest->vendorid.id[1], dd->vendorid.id[0], dd->vendorid.id[1]);
-        return ERR_INVALID;
+        return Q_ERR_INVALID;
       }
       dest->present |= PP_VENDORID;
       return 0;
@@ -1808,7 +1808,7 @@ static int init_one_parameter
       if (dd->bufsz < sizeof (dest->expects_inline_qos))
       {
         DDS_TRACE("plist/init_one_parameter[pid=EXPECTS_INLINE_QOS]: buffer too small\n");
-        return ERR_INVALID;
+        return Q_ERR_INVALID;
       }
       dest->expects_inline_qos = dd->buf[0];
       /* boolean: only lsb may be set */
@@ -1816,7 +1816,7 @@ static int init_one_parameter
       {
         DDS_TRACE("plist/init_one_parameter[pid=EXPECTS_INLINE_QOS]: invalid expects_inline_qos (%d)\n",
                 (int) dest->expects_inline_qos);
-        return ERR_INVALID;
+        return Q_ERR_INVALID;
       }
       dest->present |= PP_EXPECTS_INLINE_QOS;
       return 0;
@@ -1828,7 +1828,7 @@ static int init_one_parameter
       if (dd->bufsz < sizeof (dest->participant_manual_liveliness_count))
       {
         DDS_TRACE("plist/init_one_parameter[pid=PARTICIPANT_MANUAL_LIVELINESS_COUNT]: buffer too small\n");
-        return ERR_INVALID;
+        return Q_ERR_INVALID;
       }
       memcpy (&dest->participant_manual_liveliness_count, dd->buf, sizeof (dest->participant_manual_liveliness_count));
       if (dd->bswap)
@@ -1862,7 +1862,7 @@ static int init_one_parameter
       if (dd->bufsz < sizeof (dest->builtin_endpoint_set))
       {
         DDS_TRACE("plist/init_one_parameter[pid=BUILTIN_ENDPOINT_SET(%u)]: buffer too small\n", pid);
-        return ERR_INVALID;
+        return Q_ERR_INVALID;
       }
       memcpy (&dest->builtin_endpoint_set, dd->buf, sizeof (dest->builtin_endpoint_set));
       if (dd->bswap)
@@ -1887,7 +1887,7 @@ static int init_one_parameter
       {
         DDS_TRACE("plist/init_one_parameter[pid=BUILTIN_ENDPOINT_SET(%u),mode=STRICT,proto=%u.%u]: invalid set (0x%x)\n",
                 pid, dd->protocol_version.major, dd->protocol_version.minor, dest->builtin_endpoint_set);
-        return ERR_INVALID;
+        return Q_ERR_INVALID;
       }
       dest->present |= PP_BUILTIN_ENDPOINT_SET;
       return 0;
@@ -1898,7 +1898,7 @@ static int init_one_parameter
       else if (dd->bufsz < sizeof (dest->prismtech_builtin_endpoint_set))
       {
         DDS_TRACE("plist/init_one_parameter[pid=PRISMTECH_BUILTIN_ENDPOINT_SET(%u)]: buffer too small\n", pid);
-        return ERR_INVALID;
+        return Q_ERR_INVALID;
       }
       else
       {
@@ -1921,7 +1921,7 @@ static int init_one_parameter
       if (dd->bufsz < sizeof (dest->keyhash))
       {
         DDS_TRACE("plist/init_one_parameter[pid=KEYHASH]: buffer too small\n");
-        return ERR_INVALID;
+        return Q_ERR_INVALID;
       }
       memcpy (&dest->keyhash, dd->buf, sizeof (dest->keyhash));
       dest->present |= PP_KEYHASH;
@@ -1931,7 +1931,7 @@ static int init_one_parameter
       if (dd->bufsz < sizeof (dest->statusinfo))
       {
         DDS_TRACE("plist/init_one_parameter[pid=STATUSINFO]: buffer too small\n");
-        return ERR_INVALID;
+        return Q_ERR_INVALID;
       }
       memcpy (&dest->statusinfo, dd->buf, sizeof (dest->statusinfo));
       dest->statusinfo = fromBE4u (dest->statusinfo);
@@ -1942,7 +1942,7 @@ static int init_one_parameter
            may use them in this version of the specification */
         DDS_TRACE("plist/init_one_parameter[pid=STATUSINFO,mode=STRICT,proto=%u.%u]: invalid statusinfo (0x%x)\n",
                 dd->protocol_version.major, dd->protocol_version.minor, dest->statusinfo);
-        return ERR_INVALID;
+        return Q_ERR_INVALID;
       }
       /* Clear all bits we don't understand, then add the extended bits if present */
       dest->statusinfo &= NN_STATUSINFO_STANDARDIZED;
@@ -1962,7 +1962,7 @@ static int init_one_parameter
       if (dd->bufsz < sizeof (dest->coherent_set_seqno))
       {
         DDS_TRACE("plist/init_one_parameter[pid=COHERENT_SET]: buffer too small\n");
-        return ERR_INVALID;
+        return Q_ERR_INVALID;
       }
       else
       {
@@ -1978,7 +1978,7 @@ static int init_one_parameter
         if (seqno <= 0 && seqno != NN_SEQUENCE_NUMBER_UNKNOWN)
         {
           DDS_TRACE("plist/init_one_parameter[pid=COHERENT_SET]: invalid sequence number (%" PRId64 ")\n", seqno);
-          return ERR_INVALID;
+          return Q_ERR_INVALID;
         }
         dest->present |= PP_COHERENT_SET;
         return 0;
@@ -1999,7 +1999,7 @@ static int init_one_parameter
            ignore it. */
         DDS_TRACE("plist/init_one_parameter[pid=ENDPOINT_GUID,mode=PEDANTIC,proto=%u.%u]: undefined pid\n",
                 dd->protocol_version.major, dd->protocol_version.minor);
-        return ERR_INVALID;
+        return Q_ERR_INVALID;
       }
       return do_guid (&dest->endpoint_guid, &dest->present, PP_ENDPOINT_GUID, valid_endpoint_guid, dd);
 
@@ -2056,7 +2056,7 @@ static int init_one_parameter
       if (dd->bufsz < sizeof (dest->service_type))
       {
         DDS_TRACE("plist/init_one_parameter[pid=PRISMTECH_SERVICE_TYPE]: buffer too small\n");
-        return ERR_INVALID;
+        return Q_ERR_INVALID;
       }
       memcpy (&dest->service_type, dd->buf, sizeof (dest->service_type));
       if (dd->bswap)
@@ -2070,7 +2070,7 @@ static int init_one_parameter
       if (dd->bufsz < sizeof (dest->process_id))
       {
         DDS_TRACE("plist/init_one_parameter[pid=PRISMTECH_PROCESS_ID]: buffer too small\n");
-        return ERR_INVALID;
+        return Q_ERR_INVALID;
       }
       memcpy (&dest->process_id, dd->buf, sizeof (dest->process_id));
       if (dd->bswap)
@@ -2089,7 +2089,7 @@ static int init_one_parameter
       else if (dd->bufsz < 2*sizeof (uint32_t))
       {
         DDS_TRACE("plist/init_one_parameter[pid=PRISMTECH_EOTINFO]: buffer too small (1)\n");
-        return ERR_INVALID;
+        return Q_ERR_INVALID;
       }
       else
       {
@@ -2105,7 +2105,7 @@ static int init_one_parameter
         if (q->n > (dd->bufsz - 2*sizeof (uint32_t)) / sizeof (nn_prismtech_eotgroup_tid_t))
         {
           DDS_TRACE("plist/init_one_parameter[pid=PRISMTECH_EOTINFO]: buffer too small (2)\n");
-          return ERR_INVALID;
+          return Q_ERR_INVALID;
         }
         if (q->n == 0)
           q->tids = NULL;
@@ -2134,7 +2134,7 @@ static int init_one_parameter
       if (dd->bufsz < sizeof (dest->reader_favours_ssm))
       {
         DDS_TRACE("plist/init_one_parameter[pid=READER_FAVOURS_SSM]: buffer too small\n");
-        return ERR_INVALID;
+        return Q_ERR_INVALID;
       }
       else
       {
@@ -2174,13 +2174,13 @@ static int init_one_parameter
          bugs & the buffer overflows originate! */
       if (pid & PID_UNRECOGNIZED_INCOMPATIBLE_FLAG) {
         dest->present |= PP_INCOMPATIBLE;
-        return ERR_INCOMPATIBLE;
+        return Q_ERR_INCOMPATIBLE;
       } else if (pid & PID_VENDORSPECIFIC_FLAG) {
         return 0;
       } else if (!protocol_version_is_newer (dd->protocol_version) && NN_STRICT_P) {
         DDS_TRACE("plist/init_one_parameter[pid=%u,mode=STRICT,proto=%u.%u]: undefined paramter id\n",
                 pid, dd->protocol_version.major, dd->protocol_version.minor);
-        return ERR_INVALID;
+        return Q_ERR_INVALID;
       } else {
         return 0;
       }
@@ -2188,7 +2188,7 @@ static int init_one_parameter
 
   assert (0);
   DDS_TRACE("plist/init_one_parameter: can't happen\n");
-  return ERR_INVALID;
+  return Q_ERR_INVALID;
 }
 
 static void default_resource_limits (nn_resource_limits_qospolicy_t *q)
@@ -2404,7 +2404,7 @@ int nn_plist_init_frommsg
     default:
       DDS_WARNING ("plist(vendor %u.%u): unknown encoding (%d)\n",
                    src->vendorid.id[0], src->vendorid.id[1], src->encoding);
-      return ERR_INVALID;
+      return Q_ERR_INVALID;
   }
   nn_plist_init_empty (dest);
   dest->unalias_needs_bswap = dd.bswap;
@@ -2431,7 +2431,7 @@ int nn_plist_init_frommsg
       if ((res = final_validation (dest, src->protocol_version, src->vendorid)) < 0)
       {
         nn_plist_fini (dest);
-        return ERR_INVALID;
+        return Q_ERR_INVALID;
       }
       else
       {
@@ -2446,14 +2446,14 @@ int nn_plist_init_frommsg
       DDS_WARNING("plist(vendor %u.%u): parameter length %u out of bounds\n",
                   src->vendorid.id[0], src->vendorid.id[1], length);
       nn_plist_fini (dest);
-      return ERR_INVALID;
+      return Q_ERR_INVALID;
     }
     if ((length % 4) != 0) /* DDSI 9.4.2.11 */
     {
       DDS_WARNING("plist(vendor %u.%u): parameter length %u mod 4 != 0\n",
                   src->vendorid.id[0], src->vendorid.id[1], length);
       nn_plist_fini (dest);
-      return ERR_INVALID;
+      return Q_ERR_INVALID;
     }
 
     if (dds_get_log_mask() & DDS_LC_PLIST)
@@ -2479,7 +2479,7 @@ int nn_plist_init_frommsg
   DDS_WARNING("plist(vendor %u.%u): invalid parameter list: sentinel missing\n",
               src->vendorid.id[0], src->vendorid.id[1]);
   nn_plist_fini (dest);
-  return ERR_INVALID;
+  return Q_ERR_INVALID;
 }
 
 const unsigned char *nn_plist_findparam_native_unchecked (const void *src, nn_parameterid_t pid)
diff --git a/src/core/ddsi/src/q_receive.c b/src/core/ddsi/src/q_receive.c
index d09c89d..bd628f8 100644
--- a/src/core/ddsi/src/q_receive.c
+++ b/src/core/ddsi/src/q_receive.c
@@ -573,7 +573,7 @@ static int valid_DataFrag (const struct receiver_state *rst, struct nn_rmsg *rms
   return 1;
 }
 
-static int add_Gap (struct nn_xmsg *msg, struct writer *wr, struct proxy_reader *prd, seqno_t start, seqno_t base, unsigned numbits, const unsigned *bits)
+static int add_Gap (struct nn_xmsg *msg, struct writer *wr, struct proxy_reader *prd, seqno_t start, seqno_t base, uint32_t numbits, const uint32_t *bits)
 {
   struct nn_xmsg_marker sm_marker;
   Gap_t *gap;
@@ -614,7 +614,7 @@ static void force_heartbeat_to_peer (struct writer *wr, const struct whc_state *
        it is as-if a Data submessage had once been sent with that
        sequence number and it now receives an unsollicited response to
        a NACK ... */
-    unsigned bits = 0;
+    uint32_t bits = 0;
     seqno_t seq;
     if (wr->seq > 0)
       seq = wr->seq;
@@ -708,7 +708,7 @@ static int handle_AckNack (struct receiver_state *rst, nn_etime_t tnow, const Ac
   nn_count_t *countp;
   seqno_t gapstart = -1, gapend = -1;
   unsigned gapnumbits = 0;
-  unsigned gapbits[256 / 32];
+  uint32_t gapbits[256 / 32];
   int accelerate_rexmit = 0;
   int is_pure_ack;
   int is_pure_nonhist_ack;
@@ -1531,7 +1531,7 @@ static int handle_NackFrag (struct receiver_state *rst, nn_etime_t tnow, const N
   }
   else
   {
-    static unsigned zero = 0;
+    static uint32_t zero = 0;
     struct nn_xmsg *m;
     DDS_TRACE(" msg not available: scheduling Gap\n");
     m = nn_xmsg_new (gv.xmsgpool, &wr->e.guid.prefix, 0, NN_XMSG_KIND_CONTROL);
@@ -1979,7 +1979,7 @@ static int deliver_user_data (const struct nn_rsample_info *sampleinfo, const st
     src.bufsz = NN_RDATA_PAYLOAD_OFF (fragchain) - qos_offset;
     if ((plist_ret = nn_plist_init_frommsg (&qos, NULL, PP_STATUSINFO | PP_KEYHASH | PP_COHERENT_SET | PP_PRISMTECH_EOTINFO, 0, &src)) < 0)
     {
-      if (plist_ret != ERR_INCOMPATIBLE)
+      if (plist_ret != Q_ERR_INCOMPATIBLE)
         DDS_WARNING ("data(application, vendor %u.%u): %x:%x:%x:%x #%"PRId64": invalid inline qos\n",
                      src.vendorid.id[0], src.vendorid.id[1], PGUID (pwr->e.guid), sampleinfo->seq);
       return 0;
@@ -2545,7 +2545,7 @@ static void malformed_packet_received
       if (smsize >= sizeof (AckNack_t))
       {
         const AckNack_t *x = (const AckNack_t *) submsg;
-        (void) snprintf (tmp + pos, sizeof (tmp) - pos, " {{%x,%x,%u},%x,%x,%"PRId64",%u}",
+        (void) snprintf (tmp + pos, sizeof (tmp) - pos, " {{%x,%x,%u},%"PRIx32",%"PRIx32",%"PRId64",%"PRIu32"}",
                          x->smhdr.submessageId, x->smhdr.flags, x->smhdr.octetsToNextHeader,
                          x->readerId.u, x->writerId.u, fromSN (x->readerSNState.bitmap_base),
                          x->readerSNState.numbits);
@@ -2555,7 +2555,7 @@ static void malformed_packet_received
       if (smsize >= sizeof (Heartbeat_t))
       {
         const Heartbeat_t *x = (const Heartbeat_t *) submsg;
-        (void) snprintf (tmp + pos, sizeof (tmp) - pos, " {{%x,%x,%u},%x,%x,%"PRId64",%"PRId64"}",
+        (void) snprintf (tmp + pos, sizeof (tmp) - pos, " {{%x,%x,%u},%"PRIx32",%"PRIx32",%"PRId64",%"PRId64"}",
                          x->smhdr.submessageId, x->smhdr.flags, x->smhdr.octetsToNextHeader,
                          x->readerId.u, x->writerId.u, fromSN (x->firstSN), fromSN (x->lastSN));
       }
@@ -2564,7 +2564,7 @@ static void malformed_packet_received
       if (smsize >= sizeof (Gap_t))
       {
         const Gap_t *x = (const Gap_t *) submsg;
-        (void) snprintf (tmp + pos, sizeof (tmp) - pos, " {{%x,%x,%u},%x,%x,%"PRId64",%"PRId64",%u}",
+        (void) snprintf (tmp + pos, sizeof (tmp) - pos, " {{%x,%x,%u},%"PRIx32",%"PRIx32",%"PRId64",%"PRId64",%"PRIu32"}",
                          x->smhdr.submessageId, x->smhdr.flags, x->smhdr.octetsToNextHeader,
                          x->readerId.u, x->writerId.u, fromSN (x->gapStart),
                          fromSN (x->gapList.bitmap_base), x->gapList.numbits);
@@ -2574,7 +2574,7 @@ static void malformed_packet_received
       if (smsize >= sizeof (NackFrag_t))
       {
         const NackFrag_t *x = (const NackFrag_t *) submsg;
-        (void) snprintf (tmp + pos, sizeof (tmp) - pos, " {{%x,%x,%u},%x,%x,%"PRId64",%u,%u}",
+        (void) snprintf (tmp + pos, sizeof (tmp) - pos, " {{%x,%x,%u},%"PRIx32",%"PRIx32",%"PRId64",%u,%"PRIu32"}",
                          x->smhdr.submessageId, x->smhdr.flags, x->smhdr.octetsToNextHeader,
                          x->readerId.u, x->writerId.u, fromSN (x->writerSN),
                          x->fragmentNumberState.bitmap_base, x->fragmentNumberState.numbits);
@@ -2584,7 +2584,7 @@ static void malformed_packet_received
       if (smsize >= sizeof (HeartbeatFrag_t))
       {
         const HeartbeatFrag_t *x = (const HeartbeatFrag_t *) submsg;
-        (void) snprintf (tmp + pos, sizeof (tmp) - pos, " {{%x,%x,%u},%x,%x,%"PRId64",%u}",
+        (void) snprintf (tmp + pos, sizeof (tmp) - pos, " {{%x,%x,%u},%"PRIx32",%"PRIx32",%"PRId64",%u}",
                          x->smhdr.submessageId, x->smhdr.flags, x->smhdr.octetsToNextHeader,
                          x->readerId.u, x->writerId.u, fromSN (x->writerSN),
                          x->lastFragmentNum);
@@ -2594,7 +2594,7 @@ static void malformed_packet_received
       if (smsize >= sizeof (Data_t))
       {
         const Data_t *x = (const Data_t *) submsg;
-        (void) snprintf (tmp + pos, sizeof (tmp) - pos, " {{%x,%x,%u},%x,%u,%x,%x,%"PRId64"}",
+        (void) snprintf (tmp + pos, sizeof (tmp) - pos, " {{%x,%x,%u},%x,%u,%"PRIx32",%"PRIx32",%"PRId64"}",
                          x->x.smhdr.submessageId, x->x.smhdr.flags, x->x.smhdr.octetsToNextHeader,
                          x->x.extraFlags, x->x.octetsToInlineQos,
                          x->x.readerId.u, x->x.writerId.u, fromSN (x->x.writerSN));
@@ -2604,7 +2604,7 @@ static void malformed_packet_received
       if (smsize >= sizeof (DataFrag_t))
       {
         const DataFrag_t *x = (const DataFrag_t *) submsg;
-        (void) snprintf (tmp + pos, sizeof (tmp) - pos, " {{%x,%x,%u},%x,%u,%x,%x,%"PRId64",%u,%u,%u,%u}",
+        (void) snprintf (tmp + pos, sizeof (tmp) - pos, " {{%x,%x,%u},%x,%u,%"PRIx32",%"PRIx32",%"PRId64",%u,%u,%u,%"PRIu32"}",
                          x->x.smhdr.submessageId, x->x.smhdr.flags, x->x.smhdr.octetsToNextHeader,
                          x->x.extraFlags, x->x.octetsToInlineQos,
                          x->x.readerId.u, x->x.writerId.u, fromSN (x->x.writerSN),
diff --git a/src/core/ddsi/src/q_security.c b/src/core/ddsi/src/q_security.c
index b6ba901..408c077 100644
--- a/src/core/ddsi/src/q_security.c
+++ b/src/core/ddsi/src/q_security.c
@@ -1657,7 +1657,7 @@ static os_ssize_t q_security_sendmsg
   char stbuf[2048], *buf;
   size_t sz, data_size;
   uint32_t sz32, data_size32;
-  ssize_t ret = ERR_UNSPECIFIED;
+  ssize_t ret = Q_ERR_UNSPECIFIED;
   PT_InfoContainer_t * securityHeader;
   unsigned i;
 
diff --git a/src/core/ddsi/src/q_servicelease.c b/src/core/ddsi/src/q_servicelease.c
index 4c7fa87..2ab892a 100644
--- a/src/core/ddsi/src/q_servicelease.c
+++ b/src/core/ddsi/src/q_servicelease.c
@@ -217,7 +217,7 @@ int nn_servicelease_start_renewing (struct nn_servicelease *sl)
 
  fail_thread:
   sl->keepgoing = -1;
-  return ERR_UNSPECIFIED;
+  return Q_ERR_UNSPECIFIED;
 }
 
 void nn_servicelease_statechange_barrier (struct nn_servicelease *sl)
diff --git a/src/core/ddsi/src/q_sockwaitset.c b/src/core/ddsi/src/q_sockwaitset.c
index f0187b1..7d811e7 100644
--- a/src/core/ddsi/src/q_sockwaitset.c
+++ b/src/core/ddsi/src/q_sockwaitset.c
@@ -831,7 +831,7 @@ void os_sockWaitsetRemove (os_sockWaitset ws, ddsi_tran_conn_t conn)
 
 os_sockWaitsetCtx os_sockWaitsetWait (os_sockWaitset ws)
 {
-  int n = -1;
+  int32_t n = -1;
   unsigned u;
   int fdmax;
   fd_set * rdset = NULL;
diff --git a/src/core/ddsi/src/q_thread.c b/src/core/ddsi/src/q_thread.c
index 4d3fe45..6789407 100644
--- a/src/core/ddsi/src/q_thread.c
+++ b/src/core/ddsi/src/q_thread.c
@@ -301,7 +301,7 @@ int join_thread (struct thread_state1 *ts1)
   if (ddsrt_thread_join (ts1->extTid, NULL) == DDS_RETCODE_OK)
     ret = 0;
   else
-    ret = ERR_UNSPECIFIED;
+    ret = Q_ERR_UNSPECIFIED;
   assert (vtime_asleep_p (ts1->vtime));
   reap_thread_state (ts1, 1);
   return ret;
diff --git a/src/core/ddsi/src/q_time.c b/src/core/ddsi/src/q_time.c
index add0d0b..05878b3 100644
--- a/src/core/ddsi/src/q_time.c
+++ b/src/core/ddsi/src/q_time.c
@@ -51,23 +51,23 @@ nn_etime_t now_et (void)
   return t;
 }
 
-static void time_to_sec_usec (int * __restrict sec, int * __restrict usec, int64_t t)
+static void time_to_sec_usec (int32_t * __restrict sec, int32_t * __restrict usec, int64_t t)
 {
-  *sec = (int) (t / T_SECOND);
-  *usec = (int) (t % T_SECOND) / 1000;
+  *sec = (int32_t) (t / T_SECOND);
+  *usec = (int32_t) (t % T_SECOND) / 1000;
 }
 
-void mtime_to_sec_usec (int * __restrict sec, int * __restrict usec, nn_mtime_t t)
+void mtime_to_sec_usec (int32_t * __restrict sec, int32_t * __restrict usec, nn_mtime_t t)
 {
   time_to_sec_usec (sec, usec, t.v);
 }
 
-void wctime_to_sec_usec (int * __restrict sec, int * __restrict usec, nn_wctime_t t)
+void wctime_to_sec_usec (int32_t * __restrict sec, int32_t * __restrict usec, nn_wctime_t t)
 {
   time_to_sec_usec (sec, usec, t.v);
 }
 
-void etime_to_sec_usec (int * __restrict sec, int * __restrict usec, nn_etime_t t)
+void etime_to_sec_usec (int32_t * __restrict sec, int32_t * __restrict usec, nn_etime_t t)
 {
   time_to_sec_usec (sec, usec, t.v);
 }
diff --git a/src/core/ddsi/src/q_transmit.c b/src/core/ddsi/src/q_transmit.c
index 85d1874..27abfc7 100644
--- a/src/core/ddsi/src/q_transmit.c
+++ b/src/core/ddsi/src/q_transmit.c
@@ -424,7 +424,7 @@ static int create_fragment_message_simple (struct writer *wr, seqno_t seq, struc
   ASSERT_MUTEX_HELD (&wr->e.lock);
 
   if ((*pmsg = nn_xmsg_new (gv.xmsgpool, &wr->e.guid.prefix, sizeof (InfoTimestamp_t) + sizeof (Data_t) + expected_inline_qos_size, NN_XMSG_KIND_DATA)) == NULL)
-    return ERR_OUT_OF_MEMORY;
+    return Q_ERR_OUT_OF_MEMORY;
 
 #ifdef DDSI_INCLUDE_NETWORK_PARTITIONS
   /* use the partition_id from the writer to select the proper encoder */
@@ -503,13 +503,13 @@ int create_fragment_message (struct writer *wr, seqno_t seq, const struct nn_pli
        an non-existent fragment, which a malicious (or buggy) remote
        reader can trigger.  So we return an error instead of asserting
        as we used to. */
-    return ERR_INVALID;
+    return Q_ERR_INVALID;
   }
 
   fragging = (config.fragment_size < size);
 
   if ((*pmsg = nn_xmsg_new (gv.xmsgpool, &wr->e.guid.prefix, sizeof (InfoTimestamp_t) + sizeof (DataFrag_t) + expected_inline_qos_size, xmsg_kind)) == NULL)
-    return ERR_OUT_OF_MEMORY;
+    return Q_ERR_OUT_OF_MEMORY;
 
 #ifdef DDSI_INCLUDE_NETWORK_PARTITIONS
   /* use the partition_id from the writer to select the proper encoder */
@@ -522,7 +522,7 @@ int create_fragment_message (struct writer *wr, seqno_t seq, const struct nn_pli
     {
       nn_xmsg_free (*pmsg);
       *pmsg = NULL;
-      return ERR_NO_ADDRESS;
+      return Q_ERR_NO_ADDRESS;
     }
     /* retransmits: latency budget doesn't apply */
   }
@@ -1050,7 +1050,7 @@ static int write_sample_eot (struct nn_xpack *xp, struct writer *wr, struct nn_p
                  ddsi_serdata_size (serdata), config.max_sample_size,
                  PGUID (wr->e.guid), tname, ttname, ppbuf,
                  tmp < (int) sizeof (ppbuf) ? "" : " (trunc)");
-    r = ERR_INVALID_DATA;
+    r = Q_ERR_INVALID_DATA;
     goto drop;
   }
 
@@ -1082,7 +1082,7 @@ static int write_sample_eot (struct nn_xpack *xp, struct writer *wr, struct nn_p
       if (ores == DDS_RETCODE_TIMEOUT)
       {
         ddsrt_mutex_unlock (&wr->e.lock);
-        r = ERR_TIMEOUT;
+        r = Q_ERR_TIMEOUT;
         goto drop;
       }
     }
diff --git a/src/core/ddsi/src/q_xevent.c b/src/core/ddsi/src/q_xevent.c
index 8189c77..0e60a2a 100644
--- a/src/core/ddsi/src/q_xevent.c
+++ b/src/core/ddsi/src/q_xevent.c
@@ -521,7 +521,7 @@ int xeventq_start (struct xeventq *evq, const char *name)
   {
     ddsrt_free (evqname);
   }
-  return (evq->ts == NULL) ? ERR_UNSPECIFIED : 0;
+  return (evq->ts == NULL) ? Q_ERR_UNSPECIFIED : 0;
 }
 
 void xeventq_stop (struct xeventq *evq)
diff --git a/src/core/ddsi/src/q_xmsg.c b/src/core/ddsi/src/q_xmsg.c
index 6f6d11d..ec1495d 100644
--- a/src/core/ddsi/src/q_xmsg.c
+++ b/src/core/ddsi/src/q_xmsg.c
@@ -591,7 +591,7 @@ int nn_xmsg_setdstPRD (struct nn_xmsg *m, const struct proxy_reader *prd)
   else
   {
     DDS_WARNING("nn_xmsg_setdstPRD: no address for %x:%x:%x:%x", PGUID (prd->e.guid));
-    return ERR_NO_ADDRESS;
+    return Q_ERR_NO_ADDRESS;
   }
 }
 
@@ -604,7 +604,7 @@ int nn_xmsg_setdstPWR (struct nn_xmsg *m, const struct proxy_writer *pwr)
     return 0;
   }
   DDS_WARNING("nn_xmsg_setdstPRD: no address for %x:%x:%x:%x", PGUID (pwr->e.guid));
-  return ERR_NO_ADDRESS;
+  return Q_ERR_NO_ADDRESS;
 }
 
 void nn_xmsg_setdstN (struct nn_xmsg *m, struct addrset *as, struct addrset *as_group)
diff --git a/src/core/xtests/rhc_torture.c b/src/core/xtests/rhc_torture.c
index 9d66de1..827d04d 100644
--- a/src/core/xtests/rhc_torture.c
+++ b/src/core/xtests/rhc_torture.c
@@ -265,7 +265,7 @@ static void print_seq (int n, const dds_sample_info_t *iseq, const RhcTypes_T *m
     char buf[64];
     assert(si->instance_handle);
     assert(si->publication_handle);
-    printf ("[%2d] %c%c%c %16"PRIx64" %16"PRIx64" %4d %4d %2d %2d %2d %2"PRId32,
+    printf ("[%2d] %c%c%c %16"PRIx64" %16"PRIx64" %4"PRIu32" %4"PRIu32" %2"PRIu32" %2"PRIu32" %2"PRIu32" %2"PRId32,
             i, si2ss(si), si2vs(si), si2is(si),
             si->instance_handle, si->publication_handle,
             si->disposed_generation_count, si->no_writers_generation_count,
diff --git a/src/ddsrt/include/dds/ddsrt/misc.h b/src/ddsrt/include/dds/ddsrt/misc.h
index f01b397..1d165b1 100644
--- a/src/ddsrt/include/dds/ddsrt/misc.h
+++ b/src/ddsrt/include/dds/ddsrt/misc.h
@@ -20,7 +20,7 @@ extern "C" {
 
 #if defined(__GNUC__) && ((__GNUC__ * 100) + __GNUC_MINOR__) >= 402
 # define DDSRT_GNUC_STR(s) #s
-# define DDSRT_GNUC_JOINSTR(x,y) DDSRT_GNUC_DIAG_STR(x ## y)
+# define DDSRT_GNUC_JOINSTR(x,y) DDSRT_GNUC_STR(x ## y)
 # define DDSRT_GNUC_DO_PRAGMA(x) _Pragma (#x)
 # define DDSRT_GNUC_PRAGMA(x) DDSRT_GNUC_DO_PRAGMA(GCC diagnostic x)
 # if ((__GNUC__ * 100) + __GNUC_MINOR__) >= 406
diff --git a/src/ddsrt/include/dds/ddsrt/sockets.h b/src/ddsrt/include/dds/ddsrt/sockets.h
index 4d25387..645af42 100644
--- a/src/ddsrt/include/dds/ddsrt/sockets.h
+++ b/src/ddsrt/include/dds/ddsrt/sockets.h
@@ -8,12 +8,14 @@
 #include "dds/ddsrt/attributes.h"
 #include "dds/ddsrt/retcode.h"
 #include "dds/ddsrt/time.h"
-#if !defined(_WIN32)
-#include "dds/ddsrt/sockets/posix.h"
-#else
+#if _WIN32
 #include "dds/ddsrt/sockets/windows.h"
+#else
+#include "dds/ddsrt/sockets/posix.h"
 #endif
 
+#define INET_ADDRSTRLEN_EXTENDED (INET_ADDRSTRLEN + 6) /* ":12345" */
+
 #if DDSRT_HAVE_IPV6
 #define INET6_ADDRSTRLEN_EXTENDED (INET6_ADDRSTRLEN + 8) /* "[]:12345" */
 extern const struct in6_addr ddsrt_in6addr_any;
diff --git a/src/examples/helloworld/publisher.c b/src/examples/helloworld/publisher.c
index eeb2d54..2dec98e 100644
--- a/src/examples/helloworld/publisher.c
+++ b/src/examples/helloworld/publisher.c
@@ -52,7 +52,7 @@ int main (int argc, char ** argv)
   msg.message = "Hello World";
 
   printf ("=== [Publisher]  Writing : ");
-  printf ("Message (%d, %s)\n", msg.userID, msg.message);
+  printf ("Message (%"PRId32", %s)\n", msg.userID, msg.message);
   fflush (stdout);
 
   rc = dds_write (writer, &msg);
diff --git a/src/examples/helloworld/subscriber.c b/src/examples/helloworld/subscriber.c
index f35f80a..aee6208 100644
--- a/src/examples/helloworld/subscriber.c
+++ b/src/examples/helloworld/subscriber.c
@@ -61,7 +61,7 @@ int main (int argc, char ** argv)
       /* Print Message. */
       msg = (HelloWorldData_Msg*) samples[0];
       printf ("=== [Subscriber] Received : ");
-      printf ("Message (%d, %s)\n", msg->userID, msg->message);
+      printf ("Message (%"PRId32", %s)\n", msg->userID, msg->message);
       fflush (stdout);
       break;
     }
diff --git a/src/examples/throughput/publisher.c b/src/examples/throughput/publisher.c
index 8fd49d7..5109d6b 100644
--- a/src/examples/throughput/publisher.c
+++ b/src/examples/throughput/publisher.c
@@ -126,7 +126,7 @@ static int parse_args(
     *partitionName = argv[5]; /* The name of the partition */
   }
 
-  printf ("payloadSize: %u bytes burstInterval: %u ms burstSize: %u timeOut: %u seconds partitionName: %s\n",
+  printf ("payloadSize: %"PRIu32" bytes burstInterval: %u ms burstSize: %"PRId32" timeOut: %u seconds partitionName: %s\n",
     *payloadSize, *burstInterval, *burstSize, *timeOut, *partitionName);
   fflush (stdout);
 
diff --git a/src/tools/ddsls/ddsls.c b/src/tools/ddsls/ddsls.c
index bd53700..fed04c4 100644
--- a/src/tools/ddsls/ddsls.c
+++ b/src/tools/ddsls/ddsls.c
@@ -150,17 +150,17 @@ void qp_resource_limits_1 (FILE *fp, int32_t max_samples, int32_t max_instances,
   if (max_samples == DDS_LENGTH_UNLIMITED)
     fprintf (fp, "unlimited");
   else
-    fprintf (fp, "%d", max_samples);
+    fprintf (fp, "%"PRId32, max_samples);
   fprintf (fp, ", max_instances = ");
   if (max_instances == DDS_LENGTH_UNLIMITED)
     fprintf (fp, "unlimited");
   else
-    fprintf (fp, "%d", max_instances);
+    fprintf (fp, "%"PRId32, max_instances);
   fprintf (fp, ", max_samples_per_instance = ");
   if (max_samples_per_instance == DDS_LENGTH_UNLIMITED)
     fprintf (fp, "unlimited\n");
   else
-    fprintf (fp, "%d\n", max_samples_per_instance);
+    fprintf (fp, "%"PRId32"\n", max_samples_per_instance);
 }
 
 void qp_resource_limits (const dds_qos_t *q, FILE *fp)
diff --git a/src/tools/pubsub/common.c b/src/tools/pubsub/common.c
index a24abaf..43322f4 100644
--- a/src/tools/pubsub/common.c
+++ b/src/tools/pubsub/common.c
@@ -705,7 +705,7 @@ static int one_resource_limit(int32_t *val, const char **arg) {
         *val = DDS_LENGTH_UNLIMITED;
         (*arg) += 3;
         return 1;
-    } else if (sscanf(*arg, "%d%n", val, &pos) == 1) {
+    } else if (sscanf(*arg, "%"PRId32"%n", val, &pos) == 1) {
         (*arg) += pos;
         return 1;
     } else {
@@ -957,7 +957,7 @@ bool dds_err_check (dds_return_t err, unsigned flags, const char * where)
     if (flags & (DDS_CHECK_REPORT | DDS_CHECK_FAIL))
     {
       char msg[DDS_ERR_MSG_MAX];
-      (void) snprintf (msg, DDS_ERR_MSG_MAX, "Error %d:M%d:%s", dds_err_file_id(err), dds_err_line(err), dds_err_str(err));
+      (void) snprintf (msg, DDS_ERR_MSG_MAX, "Error %"PRId32":M%"PRId32":%s", dds_err_file_id(err), dds_err_line(err), dds_err_str(err));
       if (flags & DDS_CHECK_REPORT)
       {
         printf ("%s: %s\n", where, msg);
diff --git a/src/tools/pubsub/pubsub.c b/src/tools/pubsub/pubsub.c
index cf7cde2..e775f10 100644
--- a/src/tools/pubsub/pubsub.c
+++ b/src/tools/pubsub/pubsub.c
@@ -45,7 +45,7 @@
 //#define NUMSTR "0123456789"
 //#define HOSTNAMESTR "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ-." NUMSTR
 
-typedef int (*write_oper_t) (dds_entity_t wr, const void *d, const dds_time_t ts);
+typedef dds_return_t (*write_oper_t) (dds_entity_t wr, const void *d, const dds_time_t ts);
 
 enum topicsel { UNSPEC, KS, K32, K64, K128, K256, OU, ARB };
 enum readermode { MODE_PRINT, MODE_CHECK, MODE_ZEROLOAD, MODE_DUMP, MODE_NONE };
@@ -860,11 +860,11 @@ static void print_K(dds_time_t *tstart, dds_time_t tnow, dds_entity_t rd, const
     print_sampleinfo(tstart, tnow, si, tag);
     if (si->valid_data) {
         if(printmode == TGPM_MULTILINE) {
-            printf ("{\n%*.*s.seq = %u,\n%*.*s.keyval = %d }\n", 4, 4, "", seq, 4, 4, "", keyval);
+            printf ("{\n%*.*s.seq = %"PRIu32",\n%*.*s.keyval = %"PRId32" }\n", 4, 4, "", seq, 4, 4, "", keyval);
         } else if(printmode == TGPM_DENSE) {
-            printf ("{%u,%d}\n", seq, keyval);
+            printf ("{%"PRIu32",%"PRId32"}\n", seq, keyval);
         } else {
-            printf ("{ .seq = %u, .keyval = %d }\n", seq, keyval);
+            printf ("{ .seq = %"PRIu32", .keyval = %"PRId32" }\n", seq, keyval);
         }
     } else {
         /* May not look at mseq->_buffer[i] but want the key value
@@ -877,11 +877,11 @@ static void print_K(dds_time_t *tstart, dds_time_t tnow, dds_entity_t rd, const
         int32_t d_key;
         if ((result = getkeyval(rd, &d_key, si->instance_handle)) == DDS_RETCODE_OK) {
             if(printmode == TGPM_MULTILINE) {
-                printf ("{\n%*.*s.seq = NA,\n%*.*s.keyval = %d }\n", 4, 4, "", 4, 4, "", keyval);
+                printf ("{\n%*.*s.seq = NA,\n%*.*s.keyval = %"PRId32" }\n", 4, 4, "", 4, 4, "", keyval);
             } else if(printmode == TGPM_DENSE) {
-                printf ("{NA,%d}\n", keyval);
+                printf ("{NA,%"PRId32"}\n", keyval);
             } else {
-                printf ("{ .seq = NA, .keyval = %d }\n", keyval);
+                printf ("{ .seq = NA, .keyval = %"PRId32" }\n", keyval);
             }
         } else
             printf ("get_key_value: error (%s)\n", dds_err_str(result));
@@ -930,11 +930,11 @@ static void print_seq_OU(dds_time_t *tstart, dds_time_t tnow, dds_entity_t rd __
         print_sampleinfo(tstart, tnow, si, tag);
         if (si->valid_data) {
             if(printmode == TGPM_MULTILINE) {
-                printf ("{\n%*.*s.seq = %u }\n", 4, 4, "", mseq[i]->seq);
+                printf ("{\n%*.*s.seq = %"PRIu32" }\n", 4, 4, "", mseq[i]->seq);
             } else if(printmode == TGPM_DENSE) {
-                printf ("{%u}\n", mseq[i]->seq);
+                printf ("{%"PRIu32"}\n", mseq[i]->seq);
             } else {
-                printf ("{ .seq = %u }\n", mseq[i]->seq);
+                printf ("{ .seq = %"PRIu32" }\n", mseq[i]->seq);
             }
         } else {
             printf ("NA\n");
@@ -1109,7 +1109,7 @@ static void wr_on_publication_matched(dds_entity_t wr __attribute__((unused)), c
     }
 }
 
-static int register_instance_wrapper(dds_entity_t wr, const void *d, const dds_time_t tstamp) {
+static dds_return_t register_instance_wrapper(dds_entity_t wr, const void *d, const dds_time_t tstamp) {
     dds_instance_handle_t handle;
     (void)tstamp;
     return dds_register_instance(wr, &handle, d);
@@ -1795,7 +1795,7 @@ static uint32_t subthread(void *vspec) {
                     rc = dds_get_subscription_matched_status(rd, &status);
                     error_report(rc, "dds_get_subscription_matched_status failed");
                     if (rc == DDS_RETCODE_OK) {
-                        printf("[pre-read: subscription-matched: total=(%"PRIu32" change %d) current=(%"PRIu32" change %d) handle=%"PRIu64"]\n",
+                        printf("[pre-read: subscription-matched: total=(%"PRIu32" change %"PRId32") current=(%"PRIu32" change %"PRId32") handle=%"PRIu64"]\n",
                                 status.total_count, status.total_count_change,
                                 status.current_count,
                                 status.current_count_change,
diff --git a/src/util/CMakeLists.txt b/src/util/CMakeLists.txt
index 00bc5ac..4f44a70 100644
--- a/src/util/CMakeLists.txt
+++ b/src/util/CMakeLists.txt
@@ -25,6 +25,10 @@ generate_export_header(
 
 # util must NOT link with ddsrt to avoid duplicate symbols in ddsc!
 # ddsrt include directories are required though.
+target_compile_definitions(
+  util
+  PUBLIC
+    $<BUILD_INTERFACE:$<TARGET_PROPERTY:ddsrt,INTERFACE_COMPILE_DEFINITIONS>>)
 target_include_directories(
   util
   PUBLIC

From c38d9761f31ce82e1d18e5cb88a4fba07185a56d Mon Sep 17 00:00:00 2001
From: Jeroen Koekkoek <jeroen@koekkoek.nl>
Date: Wed, 10 Apr 2019 14:23:33 +0200
Subject: [PATCH 010/238] Move md5 from ddsi to ddsrt

Signed-off-by: Jeroen Koekkoek <jeroen@koekkoek.nl>
---
 src/core/ddsc/src/dds_key.c                   | 11 +++--
 src/core/ddsc/src/dds_serdata_builtintopic.c  |  2 +-
 src/core/ddsc/src/dds_sertopic_builtintopic.c |  2 +-
 src/core/ddsc/src/dds_stream.c                | 14 +++---
 src/core/ddsi/CMakeLists.txt                  |  2 -
 src/core/ddsi/src/ddsi_serdata.c              |  2 +-
 src/core/ddsi/src/ddsi_serdata_default.c      | 14 +++---
 src/core/ddsi/src/ddsi_sertopic.c             | 15 +++---
 src/core/ddsi/src/ddsi_sertopic_default.c     |  2 +-
 src/core/ddsi/src/q_ddsi_discovery.c          |  3 +-
 src/core/ddsi/src/q_init.c                    |  2 +-
 src/core/ddsi/src/q_misc.c                    |  3 +-
 src/core/ddsi/src/q_nwif.c                    | 13 ++---
 src/core/ddsi/src/q_receive.c                 |  5 +-
 src/ddsrt/CMakeLists.txt                      |  2 +-
 .../q_md5.h => ddsrt/include/dds/ddsrt/md5.h} | 26 +++++-----
 .../ddsi/src/q_md5.c => ddsrt/src/md5.c}      | 47 ++++++++++---------
 17 files changed, 84 insertions(+), 81 deletions(-)
 rename src/{core/ddsi/include/dds/ddsi/q_md5.h => ddsrt/include/dds/ddsrt/md5.h} (83%)
 rename src/{core/ddsi/src/q_md5.c => ddsrt/src/md5.c} (91%)

diff --git a/src/core/ddsc/src/dds_key.c b/src/core/ddsc/src/dds_key.c
index d0ab249..b919c85 100644
--- a/src/core/ddsc/src/dds_key.c
+++ b/src/core/ddsc/src/dds_key.c
@@ -11,11 +11,12 @@
  */
 #include <assert.h>
 #include <string.h>
+
+#include "dds/ddsrt/md5.h"
 #include "dds__key.h"
 #include "dds__stream.h"
 #include "dds/ddsi/ddsi_serdata.h"
 #include "dds/ddsi/q_bswap.h"
-#include "dds/ddsi/q_md5.h"
 
 #ifndef NDEBUG
 static bool keyhash_is_reset(const dds_key_hash_t *kh)
@@ -112,14 +113,14 @@ void dds_key_gen (const dds_topic_descriptor_t * const desc, dds_key_hash_t * kh
   else
   {
     dds_stream_t os;
-    md5_state_t md5st;
+    ddsrt_md5_state_t md5st;
     kh->m_iskey = 0;
     dds_stream_init(&os, 64);
     os.m_endian = 0;
     dds_key_gen_stream (desc, &os, sample);
-    md5_init (&md5st);
-    md5_append (&md5st, os.m_buffer.p8, os.m_index);
-    md5_finish (&md5st, (unsigned char *) kh->m_hash);
+    ddsrt_md5_init (&md5st);
+    ddsrt_md5_append (&md5st, os.m_buffer.p8, os.m_index);
+    ddsrt_md5_finish (&md5st, (unsigned char *) kh->m_hash);
     dds_stream_fini (&os);
   }
 }
diff --git a/src/core/ddsc/src/dds_serdata_builtintopic.c b/src/core/ddsc/src/dds_serdata_builtintopic.c
index 4d45df5..b62d405 100644
--- a/src/core/ddsc/src/dds_serdata_builtintopic.c
+++ b/src/core/ddsc/src/dds_serdata_builtintopic.c
@@ -15,7 +15,7 @@
 #include <string.h>
 
 #include "dds/ddsrt/heap.h"
-#include "dds/ddsi/q_md5.h"
+#include "dds/ddsrt/md5.h"
 #include "dds/ddsi/q_bswap.h"
 #include "dds/ddsi/q_config.h"
 #include "dds/ddsi/q_freelist.h"
diff --git a/src/core/ddsc/src/dds_sertopic_builtintopic.c b/src/core/ddsc/src/dds_sertopic_builtintopic.c
index 87bfe0d..05c9544 100644
--- a/src/core/ddsc/src/dds_sertopic_builtintopic.c
+++ b/src/core/ddsc/src/dds_sertopic_builtintopic.c
@@ -16,7 +16,7 @@
 
 #include "dds/dds.h"
 #include "dds/ddsrt/heap.h"
-#include "dds/ddsi/q_md5.h"
+#include "dds/ddsrt/md5.h"
 #include "dds/ddsi/q_bswap.h"
 #include "dds/ddsi/q_config.h"
 #include "dds/ddsi/q_freelist.h"
diff --git a/src/core/ddsc/src/dds_stream.c b/src/core/ddsc/src/dds_stream.c
index 2fbee03..9d7505c 100644
--- a/src/core/ddsc/src/dds_stream.c
+++ b/src/core/ddsc/src/dds_stream.c
@@ -11,19 +11,19 @@
  */
 #include <assert.h>
 #include <string.h>
+
+#include "dds/ddsrt/endian.h"
+#include "dds/ddsrt/md5.h"
 #include "dds/ddsi/q_bswap.h"
 #include "dds/ddsi/q_config.h"
 #include "dds__stream.h"
 #include "dds__key.h"
 #include "dds__alloc.h"
-#include "dds/ddsi/q_md5.h"
-#include "dds/ddsrt/endian.h"
 
 //#define OP_DEBUG_READ 1
 //#define OP_DEBUG_WRITE 1
 //#define OP_DEBUG_KEY 1
 
-
 #if defined OP_DEBUG_WRITE || defined OP_DEBUG_READ || defined OP_DEBUG_KEY
 static const char * stream_op_type[11] =
 {
@@ -1612,14 +1612,14 @@ void dds_stream_read_keyhash
   else
   {
     dds_stream_t os;
-    md5_state_t md5st;
+    ddsrt_md5_state_t md5st;
     kh->m_iskey = 0;
     dds_stream_init (&os, 0);
     os.m_endian = 0;
     dds_stream_extract_key (is, &os, desc->m_ops, just_key);
-    md5_init (&md5st);
-    md5_append (&md5st, os.m_buffer.p8, os.m_index);
-    md5_finish (&md5st, (unsigned char *) kh->m_hash);
+    ddsrt_md5_init (&md5st);
+    ddsrt_md5_append (&md5st, os.m_buffer.p8, os.m_index);
+    ddsrt_md5_finish (&md5st, (unsigned char *) kh->m_hash);
     dds_stream_fini (&os);
   }
 }
diff --git a/src/core/ddsi/CMakeLists.txt b/src/core/ddsi/CMakeLists.txt
index 29725a1..8821665 100644
--- a/src/core/ddsi/CMakeLists.txt
+++ b/src/core/ddsi/CMakeLists.txt
@@ -39,7 +39,6 @@ PREPEND(srcs_ddsi "${CMAKE_CURRENT_LIST_DIR}/src"
     q_init.c
     q_lat_estim.c
     q_lease.c
-    q_md5.c
     q_misc.c
     q_nwif.c
     q_pcap.c
@@ -97,7 +96,6 @@ PREPEND(hdrs_private_ddsi "${CMAKE_CURRENT_LIST_DIR}/include/dds/ddsi"
     q_lat_estim.h
     q_lease.h
     q_log.h
-    q_md5.h
     q_misc.h
     q_nwif.h
     q_pcap.h
diff --git a/src/core/ddsi/src/ddsi_serdata.c b/src/core/ddsi/src/ddsi_serdata.c
index 524241c..140c049 100644
--- a/src/core/ddsi/src/ddsi_serdata.c
+++ b/src/core/ddsi/src/ddsi_serdata.c
@@ -14,7 +14,7 @@
 #include <assert.h>
 #include <string.h>
 
-#include "dds/ddsi/q_md5.h"
+#include "dds/ddsrt/md5.h"
 #include "dds/ddsi/q_bswap.h"
 #include "dds/ddsi/q_config.h"
 #include "dds/ddsi/q_freelist.h"
diff --git a/src/core/ddsi/src/ddsi_serdata_default.c b/src/core/ddsi/src/ddsi_serdata_default.c
index 9e938a8..c7c2cf9 100644
--- a/src/core/ddsi/src/ddsi_serdata_default.c
+++ b/src/core/ddsi/src/ddsi_serdata_default.c
@@ -16,7 +16,7 @@
 
 #include "dds/ddsrt/heap.h"
 #include "dds/ddsrt/log.h"
-#include "dds/ddsi/q_md5.h"
+#include "dds/ddsrt/md5.h"
 #include "dds/ddsi/q_bswap.h"
 #include "dds/ddsi/q_config.h"
 #include "dds/ddsi/q_freelist.h"
@@ -377,16 +377,16 @@ static struct ddsi_serdata *serdata_default_from_sample_plist (const struct ddsi
       const char *topic_name = (const char *) (rawkey + sizeof(uint32_t));
       uint32_t topic_name_sz;
       uint32_t topic_name_sz_BE;
-      md5_state_t md5st;
-      md5_byte_t digest[16];
+      ddsrt_md5_state_t md5st;
+      ddsrt_md5_byte_t digest[16];
       topic_name_sz = (uint32_t) strlen (topic_name) + 1;
       topic_name_sz_BE = toBE4u (topic_name_sz);
       d->keyhash.m_set = 1;
       d->keyhash.m_iskey = 0;
-      md5_init (&md5st);
-      md5_append (&md5st, (const md5_byte_t *) &topic_name_sz_BE, sizeof (topic_name_sz_BE));
-      md5_append (&md5st, (const md5_byte_t *) topic_name, topic_name_sz);
-      md5_finish (&md5st, digest);
+      ddsrt_md5_init (&md5st);
+      ddsrt_md5_append (&md5st, (const ddsrt_md5_byte_t *) &topic_name_sz_BE, sizeof (topic_name_sz_BE));
+      ddsrt_md5_append (&md5st, (const ddsrt_md5_byte_t *) topic_name, topic_name_sz);
+      ddsrt_md5_finish (&md5st, digest);
       memcpy (d->keyhash.m_hash, digest, 16);
 #ifndef NDEBUG
       keysize = sizeof (uint32_t) + topic_name_sz;
diff --git a/src/core/ddsi/src/ddsi_sertopic.c b/src/core/ddsi/src/ddsi_sertopic.c
index be68930..c4971b2 100644
--- a/src/core/ddsi/src/ddsi_sertopic.c
+++ b/src/core/ddsi/src/ddsi_sertopic.c
@@ -15,13 +15,12 @@
 #include <string.h>
 
 #include "dds/ddsrt/heap.h"
-#include "dds/ddsi/q_md5.h"
+#include "dds/ddsrt/md5.h"
 #include "dds/ddsi/q_bswap.h"
 #include "dds/ddsi/q_config.h"
 #include "dds/ddsi/q_freelist.h"
 #include "dds/ddsi/ddsi_sertopic.h"
 #include "dds/ddsi/ddsi_serdata.h"
-#include "dds/ddsi/q_md5.h"
 
 struct ddsi_sertopic *ddsi_sertopic_ref (const struct ddsi_sertopic *sertopic_const)
 {
@@ -48,13 +47,13 @@ void ddsi_sertopic_unref (struct ddsi_sertopic *sertopic)
 
 uint32_t ddsi_sertopic_compute_serdata_basehash (const struct ddsi_serdata_ops *ops)
 {
-  md5_state_t md5st;
-  md5_byte_t digest[16];
+  ddsrt_md5_state_t md5st;
+  ddsrt_md5_byte_t digest[16];
   uint32_t res;
-  md5_init (&md5st);
-  md5_append (&md5st, (const md5_byte_t *) &ops, sizeof (ops));
-  md5_append (&md5st, (const md5_byte_t *) ops, sizeof (*ops));
-  md5_finish (&md5st, digest);
+  ddsrt_md5_init (&md5st);
+  ddsrt_md5_append (&md5st, (const ddsrt_md5_byte_t *) &ops, sizeof (ops));
+  ddsrt_md5_append (&md5st, (const ddsrt_md5_byte_t *) ops, sizeof (*ops));
+  ddsrt_md5_finish (&md5st, digest);
   memcpy (&res, digest, sizeof (res));
   return res;
 }
diff --git a/src/core/ddsi/src/ddsi_sertopic_default.c b/src/core/ddsi/src/ddsi_sertopic_default.c
index be90044..3fff736 100644
--- a/src/core/ddsi/src/ddsi_sertopic_default.c
+++ b/src/core/ddsi/src/ddsi_sertopic_default.c
@@ -14,7 +14,7 @@
 #include <assert.h>
 #include <string.h>
 
-#include "dds/ddsi/q_md5.h"
+#include "dds/ddsrt/md5.h"
 #include "dds/ddsi/q_bswap.h"
 #include "dds/ddsi/q_config.h"
 #include "dds/ddsi/q_freelist.h"
diff --git a/src/core/ddsi/src/q_ddsi_discovery.c b/src/core/ddsi/src/q_ddsi_discovery.c
index 3f5a4b6..be434dd 100644
--- a/src/core/ddsi/src/q_ddsi_discovery.c
+++ b/src/core/ddsi/src/q_ddsi_discovery.c
@@ -18,6 +18,7 @@
 #include "dds/version.h"
 #include "dds/ddsrt/heap.h"
 #include "dds/ddsrt/log.h"
+#include "dds/ddsrt/md5.h"
 #include "dds/ddsrt/sync.h"
 #include "dds/util/ut_avl.h"
 #include "dds/ddsi/q_protocol.h"
@@ -30,6 +31,7 @@
 #include "dds/ddsi/q_xevent.h"
 #include "dds/ddsi/q_addrset.h"
 #include "dds/ddsi/q_ddsi_discovery.h"
+
 #include "dds/ddsi/q_radmin.h"
 #include "dds/ddsi/q_ephash.h"
 #include "dds/ddsi/q_entity.h"
@@ -40,7 +42,6 @@
 #include "dds/ddsi/q_lease.h"
 #include "dds/ddsi/q_error.h"
 #include "dds/ddsi/ddsi_serdata_default.h"
-#include "dds/ddsi/q_md5.h"
 #include "dds/ddsi/q_feature_check.h"
 
 static int get_locator (nn_locator_t *loc, const nn_locators_t *locs, int uc_same_subnet)
diff --git a/src/core/ddsi/src/q_init.c b/src/core/ddsi/src/q_init.c
index 97ae856..9fddd09 100644
--- a/src/core/ddsi/src/q_init.c
+++ b/src/core/ddsi/src/q_init.c
@@ -13,6 +13,7 @@
 #include <stddef.h>
 
 #include "dds/ddsrt/heap.h"
+#include "dds/ddsrt/md5.h"
 #include "dds/ddsrt/process.h"
 #include "dds/ddsrt/time.h"
 #include "dds/ddsrt/string.h"
@@ -21,7 +22,6 @@
 #include "dds/util/ut_avl.h"
 #include "dds/util/ut_thread_pool.h"
 
-#include "dds/ddsi/q_md5.h"
 #include "dds/ddsi/q_protocol.h"
 #include "dds/ddsi/q_rtps.h"
 #include "dds/ddsi/q_misc.h"
diff --git a/src/core/ddsi/src/q_misc.c b/src/core/ddsi/src/q_misc.c
index 3c97d19..8569c01 100644
--- a/src/core/ddsi/src/q_misc.c
+++ b/src/core/ddsi/src/q_misc.c
@@ -12,8 +12,9 @@
 #include <string.h>
 
 #include "dds/ddsi/q_misc.h"
+
+#include "dds/ddsrt/md5.h"
 #include "dds/ddsi/q_bswap.h"
-#include "dds/ddsi/q_md5.h"
 
 extern inline seqno_t fromSN (const nn_sequence_number_t sn);
 extern inline nn_sequence_number_t toSN (seqno_t n);
diff --git a/src/core/ddsi/src/q_nwif.c b/src/core/ddsi/src/q_nwif.c
index 66c49bf..c013080 100644
--- a/src/core/ddsi/src/q_nwif.c
+++ b/src/core/ddsi/src/q_nwif.c
@@ -17,15 +17,16 @@
 
 #include "dds/ddsrt/ifaddrs.h"
 #include "dds/ddsrt/heap.h"
+#include "dds/ddsrt/md5.h"
 #include "dds/ddsrt/string.h"
 #include "dds/ddsrt/sockets.h"
 
 #include "dds/ddsi/q_log.h"
 #include "dds/ddsi/q_nwif.h"
+
 #include "dds/ddsi/q_globals.h"
 #include "dds/ddsi/q_config.h"
 #include "dds/ddsi/q_unused.h"
-#include "dds/ddsi/q_md5.h"
 #include "dds/ddsi/q_misc.h"
 #include "dds/ddsi/q_addrset.h" /* unspec locator */
 #include "dds/ddsi/q_feature_check.h"
@@ -45,11 +46,11 @@ unsigned locator_to_hopefully_unique_uint32 (const nn_locator_t *src)
   else
   {
 #if DDSRT_HAVE_IPV6
-    md5_state_t st;
-    md5_byte_t digest[16];
-    md5_init (&st);
-    md5_append (&st, (const md5_byte_t *) ((const struct sockaddr_in6 *) src)->sin6_addr.s6_addr, 16);
-    md5_finish (&st, digest);
+    ddsrt_md5_state_t st;
+    ddsrt_md5_byte_t digest[16];
+    ddsrt_md5_init (&st);
+    ddsrt_md5_append (&st, (const ddsrt_md5_byte_t *) ((const struct sockaddr_in6 *) src)->sin6_addr.s6_addr, 16);
+    ddsrt_md5_finish (&st, digest);
     memcpy (&id, digest, sizeof (id));
 #else
     DDS_FATAL("IPv6 unavailable\n");
diff --git a/src/core/ddsi/src/q_receive.c b/src/core/ddsi/src/q_receive.c
index bd628f8..f463392 100644
--- a/src/core/ddsi/src/q_receive.c
+++ b/src/core/ddsi/src/q_receive.c
@@ -15,11 +15,11 @@
 #include <stddef.h>
 
 #include "dds/ddsrt/heap.h"
+#include "dds/ddsrt/log.h"
+#include "dds/ddsrt/md5.h"
 #include "dds/ddsrt/sync.h"
 #include "dds/ddsrt/string.h"
-#include "dds/ddsrt/log.h"
 
-#include "dds/ddsi/q_md5.h"
 #include "dds/util/ut_avl.h"
 #include "dds__stream.h"
 #include "dds/ddsi/q_protocol.h"
@@ -44,6 +44,7 @@
 #include "dds/ddsi/q_entity.h"
 #include "dds/ddsi/q_xmsg.h"
 #include "dds/ddsi/q_receive.h"
+
 #include "dds/ddsi/q_transmit.h"
 #include "dds/ddsi/q_globals.h"
 #include "dds/ddsi/q_static_assert.h"
diff --git a/src/ddsrt/CMakeLists.txt b/src/ddsrt/CMakeLists.txt
index e8b62a6..5179742 100644
--- a/src/ddsrt/CMakeLists.txt
+++ b/src/ddsrt/CMakeLists.txt
@@ -89,7 +89,7 @@ list(APPEND sources
 # network stack. In order to mix-and-match various compilers, architectures,
 # operating systems, etc input from the build system is required.
 foreach(feature atomics cdtors environ heap ifaddrs random rusage
-                sockets string sync threads time)
+                sockets string sync threads time md5)
   if(EXISTS "${include_path}/dds/ddsrt/${feature}.h")
     list(APPEND headers "${include_path}/dds/ddsrt/${feature}.h")
     file(GLOB
diff --git a/src/core/ddsi/include/dds/ddsi/q_md5.h b/src/ddsrt/include/dds/ddsrt/md5.h
similarity index 83%
rename from src/core/ddsi/include/dds/ddsi/q_md5.h
rename to src/ddsrt/include/dds/ddsrt/md5.h
index e040de0..4777d04 100644
--- a/src/core/ddsi/include/dds/ddsi/q_md5.h
+++ b/src/ddsrt/include/dds/ddsrt/md5.h
@@ -59,8 +59,8 @@
   1999-05-03 lpd Original version.
  */
 
-#ifndef md5_INCLUDED
-#  define md5_INCLUDED
+#ifndef DDSRT_MD5_H
+#define DDSRT_MD5_H
 
 #include <stddef.h>
 
@@ -74,15 +74,15 @@
  * efficiently on either one than if ARCH_IS_BIG_ENDIAN is defined.
  */
 
-typedef unsigned char md5_byte_t; /* 8-bit byte */
-typedef unsigned int md5_word_t; /* 32-bit word */
+typedef unsigned char ddsrt_md5_byte_t; /* 8-bit byte */
+typedef unsigned int ddsrt_md5_word_t; /* 32-bit word */
 
 /* Define the state of the MD5 Algorithm. */
-typedef struct md5_state_s {
-    md5_word_t count[2];        /* message length in bits, lsw first */
-    md5_word_t abcd[4];         /* digest buffer */
-    md5_byte_t buf[64];         /* accumulate block */
-} md5_state_t;
+typedef struct ddsrt_md5_state_s {
+    ddsrt_md5_word_t count[2];        /* message length in bits, lsw first */
+    ddsrt_md5_word_t abcd[4];         /* digest buffer */
+    ddsrt_md5_byte_t buf[64];         /* accumulate block */
+} ddsrt_md5_state_t;
 
 #ifdef __cplusplus
 extern "C"
@@ -90,16 +90,16 @@ extern "C"
 #endif
 
 /* Initialize the algorithm. */
-void md5_init(md5_state_t *pms);
+void ddsrt_md5_init(ddsrt_md5_state_t *pms);
 
 /* Append a string to the message. */
-void md5_append(md5_state_t *pms, const md5_byte_t *data, unsigned nbytes);
+void ddsrt_md5_append(ddsrt_md5_state_t *pms, const ddsrt_md5_byte_t *data, unsigned nbytes);
 
 /* Finish the message and return the digest. */
-void md5_finish(md5_state_t *pms, md5_byte_t digest[16]);
+void ddsrt_md5_finish(ddsrt_md5_state_t *pms, ddsrt_md5_byte_t digest[16]);
 
 #ifdef __cplusplus
 }  /* end extern "C" */
 #endif
 
-#endif /* md5_INCLUDED */
+#endif /* DDSRT_MD5_H */
diff --git a/src/core/ddsi/src/q_md5.c b/src/ddsrt/src/md5.c
similarity index 91%
rename from src/core/ddsi/src/q_md5.c
rename to src/ddsrt/src/md5.c
index 1a041c2..3116749 100644
--- a/src/core/ddsi/src/q_md5.c
+++ b/src/ddsrt/src/md5.c
@@ -63,9 +63,10 @@
   1999-05-03 lpd Original version.
  */
 
-#include "dds/ddsi/q_md5.h"
 #include <string.h>
+
 #include "dds/ddsrt/endian.h" /* big or little endianness */
+#include "dds/ddsrt/md5.h"
 
 /* Byte order stuff hacked to use OSPL's macros */
 #undef BYTE_ORDER       /* 1 = big-endian, -1 = little-endian, 0 = unknown */
@@ -77,7 +78,7 @@
 #  error "DDSRT_ENDIAN not defined"
 #endif
 
-#define T_MASK ((md5_word_t)~0)
+#define T_MASK ((ddsrt_md5_word_t)~0)
 #define T1 /* 0xd76aa478 */ (T_MASK ^ 0x28955b87)
 #define T2 /* 0xe8c7b756 */ (T_MASK ^ 0x173848a9)
 #define T3    0x242070db
@@ -145,19 +146,19 @@
 
 
 static void
-md5_process(md5_state_t *pms, const md5_byte_t *data /*[64]*/)
+md5_process(ddsrt_md5_state_t *pms, const ddsrt_md5_byte_t *data /*[64]*/)
 {
-    md5_word_t
+    ddsrt_md5_word_t
         a = pms->abcd[0], b = pms->abcd[1],
         c = pms->abcd[2], d = pms->abcd[3];
-    md5_word_t t;
+    ddsrt_md5_word_t t;
 #if BYTE_ORDER > 0
     /* Define storage only for big-endian CPUs. */
-    md5_word_t X[16];
+    ddsrt_md5_word_t X[16];
 #else
     /* Define storage for little-endian or both types of CPUs. */
-    md5_word_t xbuf[16];
-    const md5_word_t *X;
+    ddsrt_md5_word_t xbuf[16];
+    const ddsrt_md5_word_t *X;
 #endif
 
     {
@@ -169,7 +170,7 @@ md5_process(md5_state_t *pms, const md5_byte_t *data /*[64]*/)
          */
         static const int w = 1;
 
-        if (*((const md5_byte_t *)&w)) /* dynamic little-endian */
+        if (*((const ddsrt_md5_byte_t *)&w)) /* dynamic little-endian */
 #endif
 #if BYTE_ORDER <= 0             /* little-endian */
         {
@@ -177,9 +178,9 @@ md5_process(md5_state_t *pms, const md5_byte_t *data /*[64]*/)
              * On little-endian machines, we can process properly aligned
              * data without copying it.
              */
-            if (!((data - (const md5_byte_t *)0) & 3)) {
+            if (!((data - (const ddsrt_md5_byte_t *)0) & 3)) {
                 /* data are properly aligned */
-                X = (const md5_word_t *)data;
+                X = (const ddsrt_md5_word_t *)data;
             } else {
                 /* not aligned */
                 memcpy(xbuf, data, 64);
@@ -196,7 +197,7 @@ md5_process(md5_state_t *pms, const md5_byte_t *data /*[64]*/)
              * On big-endian machines, we must arrange the bytes in the
              * right order.
              */
-            const md5_byte_t *xp = data;
+            const ddsrt_md5_byte_t *xp = data;
             int i;
 
 #  if BYTE_ORDER == 0
@@ -326,7 +327,7 @@ md5_process(md5_state_t *pms, const md5_byte_t *data /*[64]*/)
 }
 
 void
-md5_init(md5_state_t *pms)
+ddsrt_md5_init(ddsrt_md5_state_t *pms)
 {
     pms->count[0] = pms->count[1] = 0;
     pms->abcd[0] = 0x67452301;
@@ -336,12 +337,12 @@ md5_init(md5_state_t *pms)
 }
 
 void
-md5_append(md5_state_t *pms, const md5_byte_t *data, unsigned nbytes)
+ddsrt_md5_append(ddsrt_md5_state_t *pms, const ddsrt_md5_byte_t *data, unsigned nbytes)
 {
-    const md5_byte_t *p = data;
+    const ddsrt_md5_byte_t *p = data;
     unsigned left = nbytes;
     unsigned offset = (pms->count[0] >> 3) & 63;
-    md5_word_t nbits = (md5_word_t)(nbytes << 3);
+    ddsrt_md5_word_t nbits = (ddsrt_md5_word_t)(nbytes << 3);
 
     if (nbytes == 0)
         return;
@@ -374,24 +375,24 @@ md5_append(md5_state_t *pms, const md5_byte_t *data, unsigned nbytes)
 }
 
 void
-md5_finish(md5_state_t *pms, md5_byte_t digest[16])
+ddsrt_md5_finish(ddsrt_md5_state_t *pms, ddsrt_md5_byte_t digest[16])
 {
-    static const md5_byte_t pad[64] = {
+    static const ddsrt_md5_byte_t pad[64] = {
         0x80, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
         0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
         0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
         0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0
     };
-    md5_byte_t data[8];
+    ddsrt_md5_byte_t data[8];
     int i;
 
     /* Save the length before padding. */
     for (i = 0; i < 8; ++i)
-        data[i] = (md5_byte_t)(pms->count[i >> 2] >> ((i & 3) << 3));
+        data[i] = (ddsrt_md5_byte_t)(pms->count[i >> 2] >> ((i & 3) << 3));
     /* Pad to 56 bytes mod 64. */
-    md5_append(pms, pad, ((55 - (pms->count[0] >> 3)) & 63) + 1);
+    ddsrt_md5_append(pms, pad, ((55 - (pms->count[0] >> 3)) & 63) + 1);
     /* Append the length. */
-    md5_append(pms, data, 8);
+    ddsrt_md5_append(pms, data, 8);
     for (i = 0; i < 16; ++i)
-        digest[i] = (md5_byte_t)(pms->abcd[i >> 2] >> ((i & 3) << 3));
+        digest[i] = (ddsrt_md5_byte_t)(pms->abcd[i >> 2] >> ((i & 3) << 3));
 }

From d4f8456479d7979042b3e2500bda4e2aeccc3c3f Mon Sep 17 00:00:00 2001
From: Erik Boasson <eb@ilities.com>
Date: Tue, 9 Apr 2019 21:12:46 +0200
Subject: [PATCH 011/238] ignore data until a heartbeat is received (#146)

When data arrives before a heartbeat has been received, it is impossible
to know whether this is a new "live" sample or a retransmit, and for
this reason the requesting of historical data is delayed until a
heartbeat arrives that informs the readers of the range of sequence
numbers to request as historical data.

However, by this time, and without this new condition in place, the
reader may have already received some data directly, and may
consequently request some data twice.  That's not right.

Requiring a heartbeat to have been received before delivering the data
avoids this problem, but potentially delays receiving data after a new
writer/reader pair has been matched.  The delay caused by a full
handshake at that point seems less bad that the odd case of stuttering
where that isn't expected.  There are almost certainly some tricks
possible to avoid that delay in the common cases, but there are more
important things to do ...

Best-effort readers on a reliable proxy writer are a bit special: if
there are only best-effort readers, there is no guarantee that a
heartbeat will be received, and so the condition does not apply.  This
commit attempts to deal with that by only requiring a heartbeat if some
reliable readers exist, but that doesn't allow a smooth transition from
"only best-effort readers" to "some reliable readers".

One could moreover argue that this condition should not be imposed on
volatile readers (at worst you get a little bit of data from before the
match), but equally well that it should (there's no guarantee that no
sample would be skipped in the case of a keep-all writer, if the first
sample happened to be a retransmit).

Signed-off-by: Erik Boasson <eb@ilities.com>
---
 src/core/ddsi/src/q_entity.c  |  5 +++--
 src/core/ddsi/src/q_receive.c | 26 ++++++++++++++++++++++++++
 2 files changed, 29 insertions(+), 2 deletions(-)

diff --git a/src/core/ddsi/src/q_entity.c b/src/core/ddsi/src/q_entity.c
index d83f225..0b0c8fa 100644
--- a/src/core/ddsi/src/q_entity.c
+++ b/src/core/ddsi/src/q_entity.c
@@ -4111,12 +4111,13 @@ int new_proxy_writer (const struct nn_guid *ppguid, const struct nn_guid *guid,
   } else {
     pwr->deliver_synchronously = 0;
   }
-  pwr->have_seen_heartbeat = 0;
+  /* Pretend we have seen a heartbeat if the proxy writer is a best-effort one */
+  isreliable = (pwr->c.xqos->reliability.kind != NN_BEST_EFFORT_RELIABILITY_QOS);
+  pwr->have_seen_heartbeat = !isreliable;
   pwr->local_matching_inprogress = 1;
 #ifdef DDSI_INCLUDE_SSM
   pwr->supports_ssm = (addrset_contains_ssm (as) && config.allowMulticast & AMC_SSM) ? 1 : 0;
 #endif
-  isreliable = (pwr->c.xqos->reliability.kind != NN_BEST_EFFORT_RELIABILITY_QOS);
 
   /* Only assert PP lease on receipt of data if enabled (duh) and the proxy participant is a
      "real" participant, rather than the thing we use for endpoints discovered via the DS */
diff --git a/src/core/ddsi/src/q_receive.c b/src/core/ddsi/src/q_receive.c
index f463392..8671a5b 100644
--- a/src/core/ddsi/src/q_receive.c
+++ b/src/core/ddsi/src/q_receive.c
@@ -1745,6 +1745,13 @@ static int handle_Gap (struct receiver_state *rst, nn_etime_t tnow, struct nn_rm
   }
   DDS_TRACE("%x:%x:%x:%x -> %x:%x:%x:%x", PGUID (src), PGUID (dst));
 
+  if (!pwr->have_seen_heartbeat && pwr->n_reliable_readers > 0)
+  {
+    DDS_TRACE(": no heartbeat seen yet", PGUID (pwr->e.guid), PGUID (dst));
+    ddsrt_mutex_unlock (&pwr->e.lock);
+    return 1;
+  }
+
   /* Notify reordering in proxy writer & and the addressed reader (if
      it is out-of-sync, &c.), while delivering samples that become
      available because preceding ones are now known to be missing. */
@@ -2173,6 +2180,25 @@ static void handle_regular (struct receiver_state *rst, nn_etime_t tnow, struct
 
   /* Shouldn't lock the full writer, but will do so for now */
   ddsrt_mutex_lock (&pwr->e.lock);
+
+  /* Don't accept data when reliable readers exist and we haven't yet seen
+     a heartbeat telling us what the "current" sequence number of the writer
+     is. If no reliable readers are present, we can't request a heartbeat and
+     therefore must not require one.
+
+     This should be fine except for the one case where one transitions from
+     having only best-effort readers to also having a reliable reader (in
+     the same process): in that case, the requirement that a heartbeat has
+     been seen could potentially result in a disruption of the data flow to
+     the best-effort readers.  That state should last only for a very short
+     time, but it is rather inelegant.  */
+  if (!pwr->have_seen_heartbeat && pwr->n_reliable_readers > 0)
+  {
+    ddsrt_mutex_unlock (&pwr->e.lock);
+    DDS_TRACE(" %x:%x:%x:%x -> %x:%x:%x:%x: no heartbeat seen yet", PGUID (pwr->e.guid), PGUID (dst));
+    return;
+  }
+
   if (ut_avlIsEmpty (&pwr->readers) || pwr->local_matching_inprogress)
   {
     ddsrt_mutex_unlock (&pwr->e.lock);

From 58f21af36e8f5593a633f17cafdd35082e8f94dc Mon Sep 17 00:00:00 2001
From: Erik Boasson <eb@ilities.com>
Date: Wed, 10 Apr 2019 11:00:10 +0200
Subject: [PATCH 012/238] set DATA_AVAILABLE when deleting writer (#148)

Deleting a writer causes unregisters (and possibly disposes) in the rest
of the network, and these updates to the instances should trigger
DATA_AVAILABLE.

Signed-off-by: Erik Boasson <eb@ilities.com>
---
 src/core/ddsc/src/dds_rhc.c    |  17 ++++-
 src/core/ddsc/tests/listener.c | 110 ++++++++++++++++++++++++++++++++-
 2 files changed, 124 insertions(+), 3 deletions(-)

diff --git a/src/core/ddsc/src/dds_rhc.c b/src/core/ddsc/src/dds_rhc.c
index b427df3..30dc4f3 100644
--- a/src/core/ddsc/src/dds_rhc.c
+++ b/src/core/ddsc/src/dds_rhc.c
@@ -1523,6 +1523,7 @@ void dds_rhc_unregister_wr (struct rhc * __restrict rhc, const struct proxy_writ
      built-in topics and in get_instance_handle, and one used internally
      for tracking registrations and unregistrations. */
   bool trigger_waitsets = false;
+  bool notify_data_available = false;
   struct rhc_instance *inst;
   struct ut_hhIter iter;
   const uint64_t wr_iid = pwr_info->iid;
@@ -1568,16 +1569,28 @@ void dds_rhc_unregister_wr (struct rhc * __restrict rhc, const struct proxy_writ
 
       TRACE ("\n");
 
+      notify_data_available = true;
       if (trigger_info_differs (&pre, &post, &trig_qc) && update_conditions_locked (rhc, true, &pre, &post, &trig_qc, inst))
         trigger_waitsets = true;
       assert (rhc_check_counts_locked (rhc, true, false));
     }
   }
   TRACE (")\n");
+
   ddsrt_mutex_unlock (&rhc->lock);
 
-  if (trigger_waitsets)
-    dds_entity_status_signal (&rhc->reader->m_entity);
+  if (rhc->reader)
+  {
+    if (notify_data_available && (rhc->reader->m_entity.m_status_enable & DDS_DATA_AVAILABLE_STATUS))
+    {
+      ddsrt_atomic_inc32 (&rhc->n_cbs);
+      dds_reader_data_available_cb (rhc->reader);
+      ddsrt_atomic_dec32 (&rhc->n_cbs);
+    }
+
+    if (trigger_waitsets)
+      dds_entity_status_signal (&rhc->reader->m_entity);
+  }
 }
 
 void dds_rhc_relinquish_ownership (struct rhc * __restrict rhc, const uint64_t wr_iid)
diff --git a/src/core/ddsc/tests/listener.c b/src/core/ddsc/tests/listener.c
index e3f5c65..d049c85 100644
--- a/src/core/ddsc/tests/listener.c
+++ b/src/core/ddsc/tests/listener.c
@@ -400,7 +400,8 @@ static void
 fini_triggering_test(void)
 {
     dds_delete(g_reader);
-    dds_delete(g_writer);
+    if (g_writer)
+      dds_delete(g_writer);
     fini_triggering_base();
 }
 
@@ -847,6 +848,113 @@ CU_Test(ddsc_listener, data_available, .init=init_triggering_test, .fini=fini_tr
     ret = dds_read_status(g_reader, &status, DDS_DATA_AVAILABLE_STATUS);
     CU_ASSERT_EQUAL_FATAL(ret, DDS_RETCODE_OK);
     CU_ASSERT_EQUAL_FATAL(status, 0);
+
+    /* Deleting the writer causes unregisters (or dispose+unregister), and those
+       should trigger DATA_AVAILABLE as well */
+    cb_called = 0;
+    cb_reader = 0;
+    ret = dds_delete (g_writer);
+    CU_ASSERT_EQUAL_FATAL(ret, DDS_RETCODE_OK);
+    g_writer = 0;
+    triggered = waitfor_cb(DDS_DATA_AVAILABLE_STATUS);
+    CU_ASSERT_EQUAL_FATAL(triggered & DDS_DATA_AVAILABLE_STATUS, DDS_DATA_AVAILABLE_STATUS);
+    CU_ASSERT_EQUAL_FATAL(cb_reader, g_reader);
+
+    /* The listener should have swallowed the status. */
+    ret = dds_read_status(g_subscriber, &status, DDS_DATA_ON_READERS_STATUS);
+    CU_ASSERT_EQUAL_FATAL(ret, DDS_RETCODE_OK);
+    CU_ASSERT_EQUAL_FATAL(status, 0);
+    ret = dds_read_status(g_reader, &status, DDS_DATA_AVAILABLE_STATUS);
+    CU_ASSERT_EQUAL_FATAL(ret, DDS_RETCODE_OK);
+    CU_ASSERT_EQUAL_FATAL(status, 0);
+}
+
+CU_Test(ddsc_listener, data_available_delete_writer, .init=init_triggering_test, .fini=fini_triggering_test)
+{
+    dds_return_t ret;
+    uint32_t triggered;
+    uint32_t status;
+    RoundTripModule_DataType sample;
+    memset (&sample, 0, sizeof (sample));
+
+    /* We are interested in data available notifications. */
+    dds_lset_data_available(g_listener, data_available_cb);
+    ret = dds_set_listener(g_reader, g_listener);
+    CU_ASSERT_EQUAL_FATAL(ret, DDS_RETCODE_OK);
+
+    /* Write sample, wait for the listener to swallow the status. */
+    ret = dds_write(g_writer, &sample);
+    CU_ASSERT_EQUAL_FATAL(ret, DDS_RETCODE_OK);
+    triggered = waitfor_cb(DDS_DATA_AVAILABLE_STATUS);
+    CU_ASSERT_EQUAL_FATAL(triggered & DDS_DATA_AVAILABLE_STATUS, DDS_DATA_AVAILABLE_STATUS);
+    CU_ASSERT_EQUAL_FATAL(cb_reader, g_reader);
+
+    /* Deleting the writer must trigger DATA_AVAILABLE as well */
+    cb_called = 0;
+    cb_reader = 0;
+    ret = dds_delete (g_writer);
+    CU_ASSERT_EQUAL_FATAL(ret, DDS_RETCODE_OK);
+    g_writer = 0;
+    triggered = waitfor_cb(DDS_DATA_AVAILABLE_STATUS);
+    CU_ASSERT_EQUAL_FATAL(triggered & DDS_DATA_AVAILABLE_STATUS, DDS_DATA_AVAILABLE_STATUS);
+    CU_ASSERT_EQUAL_FATAL(cb_reader, g_reader);
+
+    /* The listener should have swallowed the status. */
+    ret = dds_read_status(g_subscriber, &status, DDS_DATA_ON_READERS_STATUS);
+    CU_ASSERT_EQUAL_FATAL(ret, DDS_RETCODE_OK);
+    CU_ASSERT_EQUAL_FATAL(status, 0);
+    ret = dds_read_status(g_reader, &status, DDS_DATA_AVAILABLE_STATUS);
+    CU_ASSERT_EQUAL_FATAL(ret, DDS_RETCODE_OK);
+    CU_ASSERT_EQUAL_FATAL(status, 0);
+}
+
+CU_Test(ddsc_listener, data_available_delete_writer_disposed, .init=init_triggering_test, .fini=fini_triggering_test)
+{
+    dds_return_t ret;
+    uint32_t triggered;
+    uint32_t status;
+    RoundTripModule_DataType sample;
+    memset (&sample, 0, sizeof (sample));
+
+    /* We are interested in data available notifications. */
+    dds_lset_data_available(g_listener, data_available_cb);
+    ret = dds_set_listener(g_reader, g_listener);
+    CU_ASSERT_EQUAL_FATAL(ret, DDS_RETCODE_OK);
+
+    /* Write & dispose sample and take it so that the instance is empty & disposed.  Then deleting
+       the writer should silently drop the instance. */
+    ret = dds_write(g_writer, &sample);
+    CU_ASSERT_EQUAL_FATAL(ret, DDS_RETCODE_OK);
+    ret = dds_dispose(g_writer, &sample);
+    CU_ASSERT_EQUAL_FATAL(ret, DDS_RETCODE_OK);
+    triggered = waitfor_cb(DDS_DATA_AVAILABLE_STATUS);
+    CU_ASSERT_EQUAL_FATAL(triggered & DDS_DATA_AVAILABLE_STATUS, DDS_DATA_AVAILABLE_STATUS);
+    CU_ASSERT_EQUAL_FATAL(cb_reader, g_reader);
+
+    /* Take all data so that the instance becomes empty & disposed */
+    do {
+      void *sampleptr = &sample;
+      dds_sample_info_t info;
+      ret = dds_take (g_reader, &sampleptr, &info, 1, 1);
+    } while (ret > 0);
+
+    /* Deleting the writer should not trigger DATA_AVAILABLE with all instances empty & disposed */
+    cb_called = 0;
+    cb_reader = 0;
+    ret = dds_delete (g_writer);
+    CU_ASSERT_EQUAL_FATAL(ret, DDS_RETCODE_OK);
+    g_writer = 0;
+    triggered = waitfor_cb(DDS_DATA_AVAILABLE_STATUS);
+    CU_ASSERT_EQUAL_FATAL(triggered & DDS_DATA_AVAILABLE_STATUS, DDS_DATA_AVAILABLE_STATUS);
+    CU_ASSERT_EQUAL_FATAL(cb_reader, g_reader);
+
+    /* The listener should have swallowed the status. */
+    ret = dds_read_status(g_subscriber, &status, DDS_DATA_ON_READERS_STATUS);
+    CU_ASSERT_EQUAL_FATAL(ret, DDS_RETCODE_OK);
+    CU_ASSERT_EQUAL_FATAL(status, 0);
+    ret = dds_read_status(g_reader, &status, DDS_DATA_AVAILABLE_STATUS);
+    CU_ASSERT_EQUAL_FATAL(ret, DDS_RETCODE_OK);
+    CU_ASSERT_EQUAL_FATAL(status, 0);
 }
 
 CU_Test(ddsc_listener, data_on_readers, .init=init_triggering_test, .fini=fini_triggering_test)

From 2700dce0eba3430453c375e988ce818ba19892c4 Mon Sep 17 00:00:00 2001
From: Jeroen Koekkoek <jeroen@koekkoek.nl>
Date: Thu, 18 Apr 2019 17:34:14 +0200
Subject: [PATCH 013/238] Remove dependency on jdk8 Chocolatey package

Signed-off-by: Jeroen Koekkoek <jeroen@koekkoek.nl>
---
 .travis.yml | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/.travis.yml b/.travis.yml
index 1abb951..8274805 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -64,6 +64,9 @@ before_install:
   - if [ "${TRAVIS_OS_NAME}" = "windows" ]; then
       eval "unset CC";
       eval "unset CXX";
+      JAVA_HOME=$(find "/c/Program Files/Android/jdk/" -name "*openjdk*" | sort | head -n 1);
+      export JAVA_HOME;
+      export PATH="${PATH}:${JAVA_HOME}/bin";
     else
       eval "export CC=${C_COMPILER}";
       eval "export CXX=${CXX_COMPILER}";
@@ -83,13 +86,10 @@ before_install:
 # issue, JAVA_HOME is read from the registry and exported by this script.
 install:
   - if [ "${TRAVIS_OS_NAME}" = "windows" ]; then
-      choco install innoextract maven;
+      choco install innoextract;
+      choco install maven --ignore-dependencies;
       wget -q https://dl.bintray.com/conan/installers/conan-win-64_1_10_0.exe;
       innoextract conan-win-64_1_10_0.exe;
-      KEY='HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment';
-      VALUE='JAVA_HOME';
-      JAVA_HOME=$(REG QUERY "${KEY}" -v "${VALUE}" | sed -n 's/^.*JAVA_HOME \+[_A-Z]\+ \+//ip');
-      eval "export JAVA_HOME=\"${JAVA_HOME}\"";
       eval "export PATH=\"$(pwd)/app/conan:${PATH}\"";
     elif [ "${TRAVIS_OS_NAME}" = "osx" ]; then
       eval "$(pyenv init -)";

From 47ba0ba8c64525ed73d66447bd03d6c590ce998b Mon Sep 17 00:00:00 2001
From: Jeroen Koekkoek <jeroen@koekkoek.nl>
Date: Thu, 18 Apr 2019 18:45:10 +0200
Subject: [PATCH 014/238] Remove JAVA_HOME regarding registry from .travis.yml

Signed-off-by: Jeroen Koekkoek <jeroen@koekkoek.nl>
---
 .travis.yml | 7 -------
 1 file changed, 7 deletions(-)

diff --git a/.travis.yml b/.travis.yml
index 8274805..e619bf6 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -77,13 +77,6 @@ before_install:
 # The real fix is to wait until Python and pip are both available on the
 # target. Until then download Conan from the official website and simply add
 # the extracted folder to the path.
-#
-# Maven requires JAVA_HOME to be set (at least on Windows), but Windows targets
-# do not come with Java installed. For now it is installed through Chocolatey
-# as a dependency of Maven, hence JAVA_HOME is only available after the
-# package is installed. The problem is that the shell cannot be restarted and
-# the path is not fixed as it contains the version number. To workaround this
-# issue, JAVA_HOME is read from the registry and exported by this script.
 install:
   - if [ "${TRAVIS_OS_NAME}" = "windows" ]; then
       choco install innoextract;

From 19a3f6bcad038fe0bbdb7bfd5379d4516fb8f1e7 Mon Sep 17 00:00:00 2001
From: Erik Boasson <eb@ilities.com>
Date: Sat, 20 Apr 2019 10:28:33 +0200
Subject: [PATCH 015/238] fix race: delete reader & delete writer (#159)

Adding and removing reader/writer matches can be done by multiple
threads, and this can result in two threads simultaneously trying to do
this on a single reader/writer pair.  The code therefore always checks
first whether the pair is (not) matched before proceeding.

However, removing a reader from a proxy writer had part of the code
outside this check.  Therefore, if both entities are being deleted
simultanously, there is a risk that local_reader_ary_remove is called
twice for the same argument, and in that case, it asserts in one of them
because the reader can no longer be found.  The counting of the number
of matched reliable readers suffers from the same race condition.

This commit eliminates these race conditions by moving these operations
into the block guarded by the aforementioned check.

Signed-off-by: Erik Boasson <eb@ilities.com>
---
 src/core/ddsi/src/q_entity.c | 12 ++++--------
 1 file changed, 4 insertions(+), 8 deletions(-)

diff --git a/src/core/ddsi/src/q_entity.c b/src/core/ddsi/src/q_entity.c
index 0b0c8fa..c832a9b 100644
--- a/src/core/ddsi/src/q_entity.c
+++ b/src/core/ddsi/src/q_entity.c
@@ -1371,8 +1371,8 @@ static void writer_drop_local_connection (const struct nn_guid *wr_guid, struct
     if ((m = ut_avlLookup (&wr_local_readers_treedef, &wr->local_readers, &rd->e.guid)) != NULL)
     {
       ut_avlDelete (&wr_local_readers_treedef, &wr->local_readers, m);
+      local_reader_ary_remove (&wr->rdary, rd);
     }
-    local_reader_ary_remove (&wr->rdary, rd);
     ddsrt_mutex_unlock (&wr->e.lock);
     if (m != NULL && wr->status_cb)
     {
@@ -1490,15 +1490,11 @@ static void proxy_writer_drop_connection (const struct nn_guid *pwr_guid, struct
     {
       ut_avlDelete (&pwr_readers_treedef, &pwr->readers, m);
       if (m->in_sync != PRMSS_SYNC)
-      {
         pwr->n_readers_out_of_sync--;
-      }
+      if (rd->reliable)
+        pwr->n_reliable_readers--;
+      local_reader_ary_remove (&pwr->rdary, rd);
     }
-    if (rd->reliable)
-    {
-      pwr->n_reliable_readers--;
-    }
-    local_reader_ary_remove (&pwr->rdary, rd);
     ddsrt_mutex_unlock (&pwr->e.lock);
     if (m != NULL)
     {

From 83f3a51a477db1cedad8fa835cc69c3f1dac82ae Mon Sep 17 00:00:00 2001
From: Erik Boasson <eb@ilities.com>
Date: Tue, 19 Feb 2019 10:53:09 +0100
Subject: [PATCH 016/238] small performance improvement in RHC

The introduction of properly functioning query conditions adds some
overhead, this commit removes some of that cost by avoiding some calls
to update_conditions when there are no query conditions.

It also removes the has_changed field from the instance, instead using a
local boolean to track whether DATA_AVAILABLE should be raised or not.

Signed-off-by: Erik Boasson <eb@ilities.com>
---
 src/core/ddsc/src/dds_rhc.c | 76 ++++++++++++++++++-------------------
 1 file changed, 36 insertions(+), 40 deletions(-)

diff --git a/src/core/ddsc/src/dds_rhc.c b/src/core/ddsc/src/dds_rhc.c
index 30dc4f3..7f3029b 100644
--- a/src/core/ddsc/src/dds_rhc.c
+++ b/src/core/ddsc/src/dds_rhc.c
@@ -250,7 +250,6 @@ struct rhc_instance {
   unsigned isnew : 1;          /* NEW or NOT_NEW view state */
   unsigned a_sample_free : 1;  /* whether or not a_sample is in use */
   unsigned isdisposed : 1;     /* DISPOSED or NOT_DISPOSED (if not disposed, wrcount determines ALIVE/NOT_ALIVE_NO_WRITERS) */
-  unsigned has_changed : 1;    /* To track changes in an instance - if number of samples are added or data is overwritten */
   unsigned wr_iid_islive : 1;  /* whether wr_iid is of a live writer */
   unsigned inv_exists : 1;     /* whether or not state change occurred since last sample (i.e., must return invalid sample) */
   unsigned inv_isread : 1;     /* whether or not that state change has been read before */
@@ -313,7 +312,6 @@ struct trigger_info_cmn {
   unsigned qminst;
   bool has_read;
   bool has_not_read;
-  bool has_changed;
 };
 
 struct trigger_info_pre {
@@ -552,7 +550,7 @@ static void inst_clear_invsample_if_exists (struct rhc *rhc, struct rhc_instance
     inst_clear_invsample (rhc, inst, trig_qc);
 }
 
-static void inst_set_invsample (struct rhc *rhc, struct rhc_instance *inst, struct trigger_info_qcond *trig_qc)
+static void inst_set_invsample (struct rhc *rhc, struct rhc_instance *inst, struct trigger_info_qcond *trig_qc, bool *nda)
 {
   if (!inst->inv_exists || inst->inv_isread)
   {
@@ -563,6 +561,7 @@ static void inst_set_invsample (struct rhc *rhc, struct rhc_instance *inst, stru
     inst->inv_exists = 1;
     inst->inv_isread = 0;
     rhc->n_invsamples++;
+    *nda = true;
   }
 }
 
@@ -651,7 +650,6 @@ static void init_trigger_info_cmn_nonmatch (struct trigger_info_cmn *info)
   info->qminst = ~0u;
   info->has_read = false;
   info->has_not_read = false;
-  info->has_changed = false;
 }
 
 static void get_trigger_info_cmn (struct trigger_info_cmn *info, struct rhc_instance *inst)
@@ -659,12 +657,10 @@ static void get_trigger_info_cmn (struct trigger_info_cmn *info, struct rhc_inst
   info->qminst = qmask_of_inst (inst);
   info->has_read = inst_has_read (inst);
   info->has_not_read = inst_has_unread (inst);
-  info->has_changed = inst->has_changed;
 }
 
 static void get_trigger_info_pre (struct trigger_info_pre *info, struct rhc_instance *inst)
 {
-  inst->has_changed = 0;
   get_trigger_info_cmn (&info->c, inst);
 }
 
@@ -680,15 +676,19 @@ static void init_trigger_info_qcond (struct trigger_info_qcond *qc)
   qc->inc_conds_sample = 0;
 }
 
-static bool trigger_info_differs (const struct trigger_info_pre *pre, const struct trigger_info_post *post, const struct trigger_info_qcond *trig_qc)
+static bool trigger_info_differs (const struct rhc *rhc, const struct trigger_info_pre *pre, const struct trigger_info_post *post, const struct trigger_info_qcond *trig_qc)
 {
-  return (pre->c.qminst != post->c.qminst ||
-          pre->c.has_read != post->c.has_read ||
-          pre->c.has_not_read != post->c.has_not_read ||
-          pre->c.has_changed != post->c.has_changed ||
-          trig_qc->dec_conds_invsample != trig_qc->inc_conds_invsample ||
-          trig_qc->dec_conds_sample != trig_qc->inc_conds_sample ||
-          trig_qc->dec_invsample_read != trig_qc->inc_invsample_read);
+  if (pre->c.qminst != post->c.qminst ||
+      pre->c.has_read != post->c.has_read ||
+      pre->c.has_not_read != post->c.has_not_read)
+    return true;
+  else if (rhc->nqconds == 0)
+    return false;
+  else
+    return (trig_qc->dec_conds_invsample != trig_qc->inc_conds_invsample ||
+            trig_qc->dec_conds_sample != trig_qc->inc_conds_sample ||
+            trig_qc->dec_invsample_read != trig_qc->inc_invsample_read ||
+            trig_qc->dec_sample_read != trig_qc->inc_sample_read);
 }
 
 static bool add_sample (struct rhc *rhc, struct rhc_instance *inst, const struct proxy_writer_info *pwr_info, const struct ddsi_serdata *sample, status_cb_data_t *cb_data, struct trigger_info_qcond *trig_qc)
@@ -722,9 +722,6 @@ static bool add_sample (struct rhc *rhc, struct rhc_instance *inst, const struct
       inst->nvread--;
       rhc->n_vread--;
     }
-
-    /* set a flag to indicate instance has changed to notify data_available since the sample is overwritten */
-    inst->has_changed = 1;
   }
   else
   {
@@ -1042,7 +1039,7 @@ static int rhc_unregister_isreg_w_sideeffects (struct rhc *rhc, const struct rhc
   }
 }
 
-static int rhc_unregister_updateinst (struct rhc *rhc, struct rhc_instance *inst, const struct proxy_writer_info * __restrict pwr_info, nn_wctime_t tstamp, struct trigger_info_qcond *trig_qc)
+static int rhc_unregister_updateinst (struct rhc *rhc, struct rhc_instance *inst, const struct proxy_writer_info * __restrict pwr_info, nn_wctime_t tstamp, struct trigger_info_qcond *trig_qc, bool *nda)
 {
   assert (inst->wrcount > 0);
 
@@ -1074,7 +1071,7 @@ static int rhc_unregister_updateinst (struct rhc *rhc, struct rhc_instance *inst
        care.) */
       if (inst->latest == NULL || inst->latest->isread)
       {
-        inst_set_invsample (rhc, inst, trig_qc);
+        inst_set_invsample (rhc, inst, trig_qc, nda);
         update_inst (inst, pwr_info, false, tstamp);
       }
       if (!inst->isdisposed)
@@ -1096,7 +1093,7 @@ static int rhc_unregister_updateinst (struct rhc *rhc, struct rhc_instance *inst
       /* Add invalid samples for transition to no-writers */
       TRACE (",#0,empty,nowriters");
       assert (inst_is_empty (inst));
-      inst_set_invsample (rhc, inst, trig_qc);
+      inst_set_invsample (rhc, inst, trig_qc, nda);
       update_inst (inst, pwr_info, false, tstamp);
       account_for_empty_to_nonempty_transition (rhc, inst);
       inst->wr_iid_islive = 0;
@@ -1105,8 +1102,10 @@ static int rhc_unregister_updateinst (struct rhc *rhc, struct rhc_instance *inst
   }
 }
 
-static void dds_rhc_unregister (struct rhc *rhc, struct rhc_instance *inst, const struct proxy_writer_info * __restrict pwr_info, nn_wctime_t tstamp, struct trigger_info_post *post, struct trigger_info_qcond *trig_qc)
+static bool dds_rhc_unregister (struct rhc *rhc, struct rhc_instance *inst, const struct proxy_writer_info * __restrict pwr_info, nn_wctime_t tstamp, struct trigger_info_post *post, struct trigger_info_qcond *trig_qc)
 {
+  bool notify_data_available = false;
+
   /* 'post' always gets set; instance may have been freed upon return. */
   TRACE (" unregister:");
   if (!rhc_unregister_isreg_w_sideeffects (rhc, inst, pwr_info->iid))
@@ -1114,7 +1113,7 @@ static void dds_rhc_unregister (struct rhc *rhc, struct rhc_instance *inst, cons
     /* other registrations remain */
     get_trigger_info_cmn (&post->c, inst);
   }
-  else if (rhc_unregister_updateinst (rhc, inst, pwr_info, tstamp, trig_qc))
+  else if (rhc_unregister_updateinst (rhc, inst, pwr_info, tstamp, trig_qc, &notify_data_available))
   {
     /* instance dropped */
     init_trigger_info_cmn_nonmatch (&post->c);
@@ -1124,6 +1123,7 @@ static void dds_rhc_unregister (struct rhc *rhc, struct rhc_instance *inst, cons
     /* no writers remain, but instance not empty */
     get_trigger_info_cmn (&post->c, inst);
   }
+  return notify_data_available;
 }
 
 static struct rhc_instance *alloc_new_instance (const struct rhc *rhc, const struct proxy_writer_info *pwr_info, struct ddsi_serdata *serdata, struct ddsi_tkmap_instance *tk)
@@ -1207,7 +1207,8 @@ static rhc_store_result_t rhc_store_new_instance (struct rhc_instance **out_inst
   else
   {
     if (inst->isdisposed) {
-      inst_set_invsample (rhc, inst, trig_qc);
+      bool nda_dummy = false;
+      inst_set_invsample (rhc, inst, trig_qc, &nda_dummy);
     }
   }
 
@@ -1242,6 +1243,7 @@ bool dds_rhc_store (struct rhc * __restrict rhc, const struct proxy_writer_info
   rhc_store_result_t stored;
   status_cb_data_t cb_data;   /* Callback data for reader status callback */
   bool delivered = true;
+  bool notify_data_available = false;
 
   TRACE ("rhc_store(%"PRIx64",%"PRIx64" si %x has_data %d:", tk->m_iid, wr_iid, statusinfo, has_data);
   if (!has_data && statusinfo == 0)
@@ -1282,6 +1284,7 @@ bool dds_rhc_store (struct rhc * __restrict rhc, const struct proxy_writer_info
         goto error_or_nochange;
       }
       init_trigger_info_cmn_nonmatch (&pre.c);
+      notify_data_available = true;
     }
   }
   else if (!inst_accepts_sample (rhc, inst, pwr_info, sample, has_data))
@@ -1300,7 +1303,8 @@ bool dds_rhc_store (struct rhc * __restrict rhc, const struct proxy_writer_info
     }
     if (statusinfo & NN_STATUSINFO_UNREGISTER)
     {
-      dds_rhc_unregister (rhc, inst, pwr_info, sample->timestamp, &post, &trig_qc);
+      if (dds_rhc_unregister (rhc, inst, pwr_info, sample->timestamp, &post, &trig_qc))
+        notify_data_available = true;
     }
     else
     {
@@ -1389,11 +1393,12 @@ bool dds_rhc_store (struct rhc * __restrict rhc, const struct proxy_writer_info
             inst->disposed_gen--;
           goto error_or_nochange;
         }
+        notify_data_available = true;
       }
 
       /* If instance became disposed, add an invalid sample if there are no samples left */
       if (inst_became_disposed && inst->latest == NULL)
-        inst_set_invsample (rhc, inst, &trig_qc);
+        inst_set_invsample (rhc, inst, &trig_qc, &notify_data_available);
 
       update_inst (inst, pwr_info, true, sample->timestamp);
 
@@ -1449,18 +1454,7 @@ bool dds_rhc_store (struct rhc * __restrict rhc, const struct proxy_writer_info
 
   TRACE (")\n");
 
-  const bool update_read_conditions = trigger_info_differs (&pre, &post, &trig_qc);
-  bool notify_data_available;
-  /* do not send data available notification when an instance is dropped */
-  if ((post.c.qminst == ~0u) && (post.c.has_read == 0) && (post.c.has_not_read == 0) && (post.c.has_changed == false))
-    notify_data_available = false;
-  else /* FIXME: now that trigger_info_differs incorporates details on samples added/removed, this might well be wrong */
-    notify_data_available = update_read_conditions;
-
-  if (update_read_conditions)
-    trigger_waitsets = update_conditions_locked (rhc, true, &pre, &post, &trig_qc, inst);
-  else
-    trigger_waitsets = false;
+  trigger_waitsets = trigger_info_differs (rhc, &pre, &post, &trig_qc) && update_conditions_locked (rhc, true, &pre, &post, &trig_qc, inst);
 
   assert (rhc_check_counts_locked (rhc, true, true));
 
@@ -1557,7 +1551,7 @@ void dds_rhc_unregister_wr (struct rhc * __restrict rhc, const struct proxy_writ
         else
         {
           const bool was_empty = inst_is_empty (inst);
-          inst_set_invsample (rhc, inst, &trig_qc);
+          inst_set_invsample (rhc, inst, &trig_qc, &notify_data_available);
           if (was_empty)
             account_for_empty_to_nonempty_transition (rhc, inst);
           else
@@ -1570,7 +1564,7 @@ void dds_rhc_unregister_wr (struct rhc * __restrict rhc, const struct proxy_writ
       TRACE ("\n");
 
       notify_data_available = true;
-      if (trigger_info_differs (&pre, &post, &trig_qc) && update_conditions_locked (rhc, true, &pre, &post, &trig_qc, inst))
+      if (trigger_info_differs (rhc, &pre, &post, &trig_qc) && update_conditions_locked (rhc, true, &pre, &post, &trig_qc, inst))
         trigger_waitsets = true;
       assert (rhc_check_counts_locked (rhc, true, false));
     }
@@ -1589,7 +1583,9 @@ void dds_rhc_unregister_wr (struct rhc * __restrict rhc, const struct proxy_writ
     }
 
     if (trigger_waitsets)
-      dds_entity_status_signal (&rhc->reader->m_entity);
+    {
+      dds_entity_status_signal(&rhc->reader->m_entity);
+    }
   }
 }
 

From 9bfac607a4edb12b9c9c60f1cc66f35a4f518111 Mon Sep 17 00:00:00 2001
From: Erik Boasson <eb@ilities.com>
Date: Wed, 3 Apr 2019 17:03:17 +0200
Subject: [PATCH 017/238] move MT19937 random generator to ddsrt

Signed-off-by: Erik Boasson <eb@ilities.com>
---
 src/core/ddsi/src/q_xmsg.c            |   2 +-
 src/core/xtests/CMakeLists.txt        |   2 +-
 src/core/xtests/mt19937ar.c           | 184 -----------------------
 src/core/xtests/mt19937ar.h           |  46 ------
 src/core/xtests/rhc_torture.c         |  18 ++-
 src/ddsrt/CMakeLists.txt              |   2 +-
 src/ddsrt/include/dds/ddsrt/random.h  |  23 ++-
 src/ddsrt/src/cdtors.c                |   3 +
 src/ddsrt/src/random.c                | 205 +++++++++++++++++++++++---
 src/ddsrt/src/random/posix/random.c   |  17 +++
 src/ddsrt/src/random/windows/random.c |  14 ++
 src/ddsrt/tests/CMakeLists.txt        |   1 +
 src/ddsrt/tests/random.c              |  92 ++++++++++++
 13 files changed, 345 insertions(+), 264 deletions(-)
 delete mode 100644 src/core/xtests/mt19937ar.c
 delete mode 100644 src/core/xtests/mt19937ar.h
 create mode 100644 src/ddsrt/src/random/posix/random.c
 create mode 100644 src/ddsrt/src/random/windows/random.c
 create mode 100644 src/ddsrt/tests/random.c

diff --git a/src/core/ddsi/src/q_xmsg.c b/src/core/ddsi/src/q_xmsg.c
index ec1495d..d1c83cb 100644
--- a/src/core/ddsi/src/q_xmsg.c
+++ b/src/core/ddsi/src/q_xmsg.c
@@ -1261,7 +1261,7 @@ static ssize_t nn_xpack_send1 (const nn_locator_t *loc, void * varg)
   {
     /* We drop APPROXIMATELY a fraction of xmit_lossiness * 10**(-3)
        of all packets to be sent */
-    if ((ddsrt_random () % 1000) < config.xmit_lossiness)
+    if ((ddsrt_random () % 1000) < (uint32_t) config.xmit_lossiness)
     {
       DDS_TRACE("(dropped)");
       xp->call_flags = 0;
diff --git a/src/core/xtests/CMakeLists.txt b/src/core/xtests/CMakeLists.txt
index 9a67a6c..0b1d362 100644
--- a/src/core/xtests/CMakeLists.txt
+++ b/src/core/xtests/CMakeLists.txt
@@ -11,7 +11,7 @@
 #
 idlc_generate(RhcTypes RhcTypes.idl)
 
-add_executable(rhc_torture rhc_torture.c mt19937ar.c mt19937ar.h)
+add_executable(rhc_torture rhc_torture.c)
 
 target_include_directories(
   rhc_torture PRIVATE
diff --git a/src/core/xtests/mt19937ar.c b/src/core/xtests/mt19937ar.c
deleted file mode 100644
index 31e347e..0000000
--- a/src/core/xtests/mt19937ar.c
+++ /dev/null
@@ -1,184 +0,0 @@
-/*
- * Copyright(c) 2019 ADLINK Technology Limited and others
- *
- * This program and the accompanying materials are made available under the
- * terms of the Eclipse Public License v. 2.0 which is available at
- * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
- * v. 1.0 which is available at
- * http://www.eclipse.org/org/documents/edl-v10.php.
- *
- * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
- */
-
-/*
-   A C-program for MT19937, with initialization improved 2002/1/26.
-   Coded by Takuji Nishimura and Makoto Matsumoto.
-
-   Before using, initialize the state by using init_genrand(seed)
-   or init_by_array(init_key, key_length).
-
-   Copyright (C) 1997 - 2002, Makoto Matsumoto and Takuji Nishimura,
-   All rights reserved.
-
-   Redistribution and use in source and binary forms, with or without
-   modification, are permitted provided that the following conditions
-   are met:
-
-     1. Redistributions of source code must retain the above copyright
-        notice, this list of conditions and the following disclaimer.
-
-     2. Redistributions in binary form must reproduce the above copyright
-        notice, this list of conditions and the following disclaimer in the
-        documentation and/or other materials provided with the distribution.
-
-     3. The names of its contributors may not be used to endorse or promote
-        products derived from this software without specific prior written
-        permission.
-
-   THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-   "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-   LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-   A PARTICULAR PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT OWNER OR
-   CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
-   EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
-   PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
-   PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
-   LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
-   NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
-   SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-
-
-   Any feedback is very welcome.
-   http://www.math.sci.hiroshima-u.ac.jp/~m-mat/MT/emt.html
-   email: m-mat @ math.sci.hiroshima-u.ac.jp (remove space)
-*/
-
-#include "mt19937ar.h"
-
-/* Period parameters */
-#define N 624
-#define M 397
-#define MATRIX_A 0x9908b0dfU   /* constant vector a */
-#define UPPER_MASK 0x80000000U /* most significant w-r bits */
-#define LOWER_MASK 0x7fffffffU /* least significant r bits */
-
-static uint32_t mt[N]; /* the array for the state vector  */
-static uint32_t mti=N+1; /* mti==N+1 means mt[N] is not initialized */
-
-/* initializes mt[N] with a seed */
-void init_genrand(uint32_t s)
-{
-    mt[0]= s & 0xffffffffU;
-    for (mti=1; mti<N; mti++) {
-        mt[mti] =
-            (1812433253U * (mt[mti-1] ^ (mt[mti-1] >> 30)) + mti);
-        /* See Knuth TAOCP Vol2. 3rd Ed. P.106 for multiplier. */
-        /* In the previous versions, MSBs of the seed affect   */
-        /* only MSBs of the array mt[].                        */
-        /* 2002/01/09 modified by Makoto Matsumoto             */
-        mt[mti] &= 0xffffffffU;
-        /* for >32 bit machines */
-    }
-}
-
-/* initialize by an array with array-length */
-/* init_key is the array for initializing keys */
-/* key_length is its length */
-/* slight change for C++, 2004/2/26 */
-void init_by_array(uint32_t init_key[], size_t key_length)
-{
-    uint32_t i, j, k;
-    init_genrand(19650218U);
-    i=1; j=0;
-    k = (N>key_length ? N : (uint32_t)key_length);
-    for (; k; k--) {
-        mt[i] = (mt[i] ^ ((mt[i-1] ^ (mt[i-1] >> 30)) * 1664525U))
-          + init_key[j] + j; /* non linear */
-        mt[i] &= 0xffffffffU; /* for WORDSIZE > 32 machines */
-        i++; j++;
-        if (i>=N) { mt[0] = mt[N-1]; i=1; }
-        if (j>=(uint32_t)key_length) j=0;
-    }
-    for (k=N-1; k; k--) {
-        mt[i] = (mt[i] ^ ((mt[i-1] ^ (mt[i-1] >> 30)) * 1566083941U))
-          - i; /* non linear */
-        mt[i] &= 0xffffffffU; /* for WORDSIZE > 32 machines */
-        i++;
-        if (i>=N) { mt[0] = mt[N-1]; i=1; }
-    }
-
-    mt[0] = 0x80000000U; /* MSB is 1; assuring non-zero initial array */
-}
-
-/* generates a random number on [0,0xffffffff]-interval */
-uint32_t genrand_int32(void)
-{
-    uint32_t y;
-    static uint32_t mag01[2]={0x0U, MATRIX_A};
-    /* mag01[x] = x * MATRIX_A  for x=0,1 */
-
-    if (mti >= N) { /* generate N words at one time */
-        int kk;
-
-        if (mti == N+1)   /* if init_genrand() has not been called, */
-            init_genrand(5489U); /* a default initial seed is used */
-
-        for (kk=0;kk<N-M;kk++) {
-            y = (mt[kk]&UPPER_MASK)|(mt[kk+1]&LOWER_MASK);
-            mt[kk] = mt[kk+M] ^ (y >> 1) ^ mag01[y & 0x1U];
-        }
-        for (;kk<N-1;kk++) {
-            y = (mt[kk]&UPPER_MASK)|(mt[kk+1]&LOWER_MASK);
-            mt[kk] = mt[kk+(M-N)] ^ (y >> 1) ^ mag01[y & 0x1U];
-        }
-        y = (mt[N-1]&UPPER_MASK)|(mt[0]&LOWER_MASK);
-        mt[N-1] = mt[M-1] ^ (y >> 1) ^ mag01[y & 0x1U];
-
-        mti = 0;
-    }
-
-    y = mt[mti++];
-
-    /* Tempering */
-    y ^= (y >> 11);
-    y ^= (y << 7) & 0x9d2c5680U;
-    y ^= (y << 15) & 0xefc60000U;
-    y ^= (y >> 18);
-
-    return (uint32_t) y;
-}
-
-/* generates a random number on [0,0x7fffffff]-interval */
-int32_t genrand_int31(void)
-{
-    return (int32_t)(genrand_int32()>>1);
-}
-
-/* generates a random number on [0,1]-real-interval */
-double genrand_real1(void)
-{
-    return genrand_int32()*(1.0/4294967295.0);
-    /* divided by 2^32-1 */
-}
-
-/* generates a random number on [0,1)-real-interval */
-double genrand_real2(void)
-{
-    return genrand_int32()*(1.0/4294967296.0);
-    /* divided by 2^32 */
-}
-
-/* generates a random number on (0,1)-real-interval */
-double genrand_real3(void)
-{
-    return (((double)genrand_int32()) + 0.5)*(1.0/4294967296.0);
-    /* divided by 2^32 */
-}
-
-/* generates a random number on [0,1) with 53-bit resolution*/
-double genrand_res53(void)
-{
-    uint32_t a=genrand_int32()>>5, b=genrand_int32()>>6;
-    return(a*67108864.0+b)*(1.0/9007199254740992.0);
-}
-/* These real versions are due to Isaku Wada, 2002/01/09 added */
diff --git a/src/core/xtests/mt19937ar.h b/src/core/xtests/mt19937ar.h
deleted file mode 100644
index aaa08c8..0000000
--- a/src/core/xtests/mt19937ar.h
+++ /dev/null
@@ -1,46 +0,0 @@
-/*
- * Copyright(c) 2019 ADLINK Technology Limited and others
- *
- * This program and the accompanying materials are made available under the
- * terms of the Eclipse Public License v. 2.0 which is available at
- * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
- * v. 1.0 which is available at
- * http://www.eclipse.org/org/documents/edl-v10.php.
- *
- * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
- */
-#ifndef MT19937AR_H
-#define MT19937AR_H
-
-#include <stdint.h>
-#include <stddef.h>
-
-/* initializes mt[N] with a seed */
-void init_genrand(uint32_t s);
-
-/* initialize by an array with array-length */
-/* init_key is the array for initializing keys */
-/* key_length is its length */
-/* slight change for C++, 2004/2/26 */
-void init_by_array(uint32_t init_key[], size_t key_length);
-
-/* generates a random number on [0,0xffffffff]-interval */
-uint32_t genrand_int32(void);
-
-/* generates a random number on [0,0x7fffffff]-interval */
-int32_t genrand_int31(void);
-
-/* generates a random number on [0,1]-real-interval */
-double genrand_real1(void);
-
-/* generates a random number on [0,1)-real-interval */
-double genrand_real2(void);
-
-/* generates a random number on (0,1)-real-interval */
-double genrand_real3(void);
-
-/* generates a random number on [0,1) with 53-bit resolution*/
-double genrand_res53(void);
-/* These real versions are due to Isaku Wada, 2002/01/09 added */
-
-#endif
diff --git a/src/core/xtests/rhc_torture.c b/src/core/xtests/rhc_torture.c
index 827d04d..bc7c4fb 100644
--- a/src/core/xtests/rhc_torture.c
+++ b/src/core/xtests/rhc_torture.c
@@ -18,6 +18,7 @@
 #include "dds/ddsrt/heap.h"
 #include "dds/ddsrt/process.h"
 #include "dds/ddsrt/sync.h"
+#include "dds/ddsrt/random.h"
 #include "dds/dds.h"
 #include "dds/ddsi/ddsi_tkmap.h"
 #include "dds__entity.h"
@@ -32,7 +33,6 @@
 #include "dds__rhc.h"
 #include "dds/ddsi/ddsi_iid.h"
 
-#include "mt19937ar.h"
 #include "RhcTypes.h"
 
 #ifndef _MSC_VER
@@ -41,6 +41,8 @@
 #define STATIC_ARRAY_DIM
 #endif
 
+static ddsrt_prng_t prng;
+
 static struct ddsi_sertopic *mdtopic;
 static struct thread_state1 *mainthread;
 static dds_time_t tref_dds;
@@ -669,14 +671,14 @@ static void test_conditions (dds_entity_t pp, dds_entity_t tp, const int count,
   int lastprint_pct = 0;
   for (int i = 0; i < count; i++)
   {
-    const int32_t keyval = (int32_t) (genrand_int32 () % N_KEYVALS);
-    const uint32_t which = genrand_int32 () % 3;
+    const int32_t keyval = (int32_t) (ddsrt_prng_random (&prng) % N_KEYVALS);
+    const uint32_t which = ddsrt_prng_random (&prng) % 3;
     uint32_t oper_base;
     uint32_t oper;
 
     /* generate uniform number in range 0 .. N, then map to operation following the frequency table */
     do {
-      oper_base = genrand_int32 ();
+      oper_base = ddsrt_prng_random (&prng);
     } while (oper_base >= opthres[sizeof (opfreqs) / sizeof (opfreqs[0]) - 1]);
     for (oper = 0; oper < sizeof (opfreqs) / sizeof (opfreqs[0]); oper++)
     {
@@ -745,19 +747,19 @@ static void test_conditions (dds_entity_t pp, dds_entity_t tp, const int count,
           tkall (rhc[k], NULL, print && k == 0, states_seen);
         break;
       case 8: {
-        uint32_t cond = genrand_int32 () % (uint32_t) nconds;
+        uint32_t cond = ddsrt_prng_random (&prng) % (uint32_t) nconds;
         for (size_t k = 0; k < nrd; k++)
           rdcond (rhc[k], rhcconds[cond], NULL, 0, print && k == 0, states_seen);
         break;
       }
       case 9: {
-        uint32_t cond = genrand_int32 () % (uint32_t) nconds;
+        uint32_t cond = ddsrt_prng_random (&prng) % (uint32_t) nconds;
         for (size_t k = 0; k < nrd; k++)
           tkcond (rhc[k], rhcconds[cond], NULL, 0, print && k == 0, states_seen);
         break;
       }
       case 10: {
-        uint32_t cond = genrand_int32 () % (uint32_t) nconds;
+        uint32_t cond = ddsrt_prng_random (&prng) % (uint32_t) nconds;
         for (size_t k = 0; k < nrd; k++)
           tkcond (rhc[k], rhcconds[cond], NULL, 1, print && k == 0, states_seen);
         break;
@@ -826,7 +828,7 @@ int main (int argc, char **argv)
     print = (atoi (argv[4]) != 0);
 
   printf ("prng seed %u first %d count %d print %d\n", seed, first, count, print);
-  init_genrand (seed);
+  ddsrt_prng_init_simple (&prng, seed);
 
   memset (rres_mseq, 0, sizeof (rres_mseq));
   for (size_t i = 0; i < sizeof (rres_iseq) / sizeof(rres_iseq[0]); i++)
diff --git a/src/ddsrt/CMakeLists.txt b/src/ddsrt/CMakeLists.txt
index 5179742..7830104 100644
--- a/src/ddsrt/CMakeLists.txt
+++ b/src/ddsrt/CMakeLists.txt
@@ -165,7 +165,7 @@ find_package(Threads REQUIRED)
 target_link_libraries(ddsrt INTERFACE Threads::Threads)
 
 if(WIN32)
-  target_link_libraries(ddsrt INTERFACE wsock32 ws2_32 iphlpapi)
+  target_link_libraries(ddsrt INTERFACE wsock32 ws2_32 iphlpapi bcrypt)
 elseif(UNIX)
   check_library_exists(c clock_gettime "" HAVE_CLOCK_GETTIME)
   if(NOT HAVE_CLOCK_GETTIME)
diff --git a/src/ddsrt/include/dds/ddsrt/random.h b/src/ddsrt/include/dds/ddsrt/random.h
index 4e44c82..0ef600f 100644
--- a/src/ddsrt/include/dds/ddsrt/random.h
+++ b/src/ddsrt/include/dds/ddsrt/random.h
@@ -12,13 +12,34 @@
 #ifndef DDSRT_RANDOM_H
 #define DDSRT_RANDOM_H
 
+#include <stdint.h>
+#include <stdbool.h>
 #include "dds/export.h"
 
 #if defined (__cplusplus)
 extern "C" {
 #endif
 
-DDS_EXPORT long ddsrt_random(void);
+#define DDSRT_MT19937_N 624
+
+typedef struct ddsrt_prng_seed {
+  uint32_t key[8];
+} ddsrt_prng_seed_t;
+
+typedef struct ddsrt_prng {
+  uint32_t mt[DDSRT_MT19937_N];
+  uint32_t mti;
+} ddsrt_prng_t;
+
+DDS_EXPORT void ddsrt_random_init (void);
+DDS_EXPORT void ddsrt_random_fini (void);
+
+DDS_EXPORT void ddsrt_prng_init_simple (ddsrt_prng_t *prng, uint32_t seed);
+DDS_EXPORT bool ddsrt_prng_makeseed (struct ddsrt_prng_seed *seed);
+DDS_EXPORT void ddsrt_prng_init (ddsrt_prng_t *prng, const struct ddsrt_prng_seed *seed);
+DDS_EXPORT uint32_t ddsrt_prng_random (ddsrt_prng_t *prng);
+
+DDS_EXPORT uint32_t ddsrt_random (void);
 
 #if defined (__cplusplus)
 }
diff --git a/src/ddsrt/src/cdtors.c b/src/ddsrt/src/cdtors.c
index a3088fb..3888c87 100644
--- a/src/ddsrt/src/cdtors.c
+++ b/src/ddsrt/src/cdtors.c
@@ -13,6 +13,7 @@
 #include "dds/ddsrt/cdtors.h"
 #include "dds/ddsrt/sync.h"
 #include "dds/ddsrt/time.h"
+#include "dds/ddsrt/random.h"
 
 #if _WIN32
 /* Sockets API initialization is only necessary on Microsoft Windows. The
@@ -41,6 +42,7 @@ retry:
     ddsrt_winsock_init();
     ddsrt_time_init();
 #endif
+    ddsrt_random_init();
     ddsrt_atomic_or32(&init_status, INIT_STATUS_OK);
   } else {
     while (v > 1 && !(v & INIT_STATUS_OK)) {
@@ -65,6 +67,7 @@ void ddsrt_fini (void)
   if (nv == 1)
   {
     ddsrt_mutex_destroy(&init_mutex);
+    ddsrt_random_fini();
 #if _WIN32
     ddsrt_winsock_fini();
     ddsrt_time_fini();
diff --git a/src/ddsrt/src/random.c b/src/ddsrt/src/random.c
index 582cb48..7f2943a 100644
--- a/src/ddsrt/src/random.c
+++ b/src/ddsrt/src/random.c
@@ -9,36 +9,197 @@
  *
  * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
  */
+
+/*
+ A C-program for MT19937, with initialization improved 2002/1/26.
+ Coded by Takuji Nishimura and Makoto Matsumoto.
+
+ Before using, initialize the state by using init_genrand(seed)
+ or init_by_array(init_key, key_length).
+
+ Copyright (C) 1997 - 2002, Makoto Matsumoto and Takuji Nishimura,
+ All rights reserved.
+
+ Redistribution and use in source and binary forms, with or without
+ modification, are permitted provided that the following conditions
+ are met:
+
+ 1. Redistributions of source code must retain the above copyright
+    notice, this list of conditions and the following disclaimer.
+
+ 2. Redistributions in binary form must reproduce the above copyright
+    notice, this list of conditions and the following disclaimer in the
+    documentation and/or other materials provided with the distribution.
+
+ 3. The names of its contributors may not be used to endorse or promote
+    products derived from this software without specific prior written
+    permission.
+
+ THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ A PARTICULAR PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT OWNER OR
+ CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
+ LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
+ NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+
+ Any feedback is very welcome.
+ http://www.math.sci.hiroshima-u.ac.jp/~m-mat/MT/emt.html
+ email: m-mat @ math.sci.hiroshima-u.ac.jp (remove space)
+*/
+
 #include <assert.h>
 #include <stdlib.h>
+#include <string.h>
 
 #include "dds/ddsrt/random.h"
+#include "dds/ddsrt/sync.h"
+#include "dds/ddsrt/time.h"
+#include "dds/ddsrt/process.h"
 
-#if _WIN32
-#define _CRT_RAND_S
-#include <errno.h>
+#define N DDSRT_MT19937_N
+#define M 397
+#define MATRIX_A 0x9908b0dfU   /* constant vector a */
+#define UPPER_MASK 0x80000000U /* most significant w-r bits */
+#define LOWER_MASK 0x7fffffffU /* least significant r bits */
 
-long random (void)
+static ddsrt_prng_t default_prng;
+static ddsrt_mutex_t default_prng_lock;
+
+/* initializes mt[N] with a seed */
+static void init_genrand (ddsrt_prng_t *prng, uint32_t s)
 {
-  /* rand() is a really terribly bad PRNG */
-  /* FIXME: Indeed (especially if not seeded), use rand_s instead. */
-  union { long x; unsigned char c[4]; } t;
-  int i;
-  for (i = 0; i < 4; i++)
-    t.c[i] = (unsigned char) ((rand () >> 4) & 0xff);
-#if RAND_MAX == INT32_MAX || RAND_MAX == 0x7fff
-  t.x &= RAND_MAX;
-#elif RAND_MAX <= 0x7ffffffe
-  t.x %= (RAND_MAX+1);
-#else
-#error "RAND_MAX out of range"
-#endif
-  return t.x;
+  prng->mt[0] = s;
+  for (prng->mti = 1; prng->mti < N; prng->mti++)
+  {
+    prng->mt[prng->mti] = (1812433253U * (prng->mt[prng->mti-1] ^ (prng->mt[prng->mti-1] >> 30)) + prng->mti);
+    /* See Knuth TAOCP Vol2. 3rd Ed. P.106 for multiplier. */
+    /* In the previous versions, MSBs of the seed affect   */
+    /* only MSBs of the array mt[].                        */
+    /* 2002/01/09 modified by Makoto Matsumoto             */
+  }
 }
-#endif
 
-long ddsrt_random(void)
+/* initialize by an array with array-length */
+/* init_key is the array for initializing keys */
+/* key_length is its length */
+/* slight change for C++, 2004/2/26 */
+static void init_by_array (ddsrt_prng_t *prng, const uint32_t init_key[], size_t key_length)
 {
-  /* FIXME: Not MT-safe, should use random_r (or a real PRNG) instead. */
-  return random();
+  uint32_t i, j, k;
+  init_genrand (prng, 19650218U);
+  i = 1; j = 0;
+  k = (N > key_length ? N : (uint32_t) key_length);
+  for (; k; k--)
+  {
+    prng->mt[i] = (prng->mt[i] ^ ((prng->mt[i-1] ^ (prng->mt[i-1] >> 30)) * 1664525U)) + init_key[j] + j; /* non linear */
+    i++; j++;
+    if (i >= N)
+    {
+      prng->mt[0] = prng->mt[N-1];
+      i=1;
+    }
+    if (j >= key_length)
+    {
+      j = 0;
+    }
+  }
+  for (k = N-1; k; k--)
+  {
+    prng->mt[i] = (prng->mt[i] ^ ((prng->mt[i-1] ^ (prng->mt[i-1] >> 30)) * 1566083941U)) - i; /* non linear */
+    i++;
+    if (i >= N)
+    {
+      prng->mt[0] = prng->mt[N-1];
+      i = 1;
+    }
+  }
+  prng->mt[0] = 0x80000000U; /* MSB is 1; assuring non-zero initial array */
+}
+
+void ddsrt_prng_init_simple (ddsrt_prng_t *prng, uint32_t seed)
+{
+  init_genrand (prng, seed);
+}
+
+void ddsrt_prng_init (ddsrt_prng_t *prng, const struct ddsrt_prng_seed *seed)
+{
+  init_by_array (prng, seed->key, sizeof (seed->key) / sizeof (seed->key[0]));
+}
+
+/* generates a random number on [0,0xffffffff]-interval */
+uint32_t ddsrt_prng_random (ddsrt_prng_t *prng)
+{
+  /* mag01[x] = x * MATRIX_A  for x=0,1 */
+  static const uint32_t mag01[2] = { 0x0U, MATRIX_A };
+  uint32_t y;
+
+  if (prng->mti >= N)
+  {
+    /* generate N words at one time */
+    int kk;
+
+    for (kk=0; kk < N-M; kk++)
+    {
+      y = (prng->mt[kk] & UPPER_MASK) | (prng->mt[kk+1] & LOWER_MASK);
+      prng->mt[kk] = prng->mt[kk+M] ^ (y >> 1) ^ mag01[y & 0x1U];
+    }
+    for (; kk < N-1; kk++)
+    {
+      y = (prng->mt[kk] & UPPER_MASK) | (prng->mt[kk+1] & LOWER_MASK);
+      prng->mt[kk] = prng->mt[kk+(M-N)] ^ (y >> 1) ^ mag01[y & 0x1U];
+    }
+    y = (prng->mt[N-1] & UPPER_MASK) | (prng->mt[0] & LOWER_MASK);
+    prng->mt[N-1] = prng->mt[M-1] ^ (y >> 1) ^ mag01[y & 0x1U];
+
+    prng->mti = 0;
+  }
+
+  y = prng->mt[prng->mti++];
+
+  /* Tempering */
+  y ^= (y >> 11);
+  y ^= (y << 7) & 0x9d2c5680U;
+  y ^= (y << 15) & 0xefc60000U;
+  y ^= (y >> 18);
+
+  return y;
+}
+
+uint32_t ddsrt_random (void)
+{
+  uint32_t x;
+  ddsrt_mutex_lock (&default_prng_lock);
+  x = ddsrt_prng_random (&default_prng);
+  ddsrt_mutex_unlock (&default_prng_lock);
+  return x;
+}
+
+void ddsrt_random_init (void)
+{
+  ddsrt_prng_seed_t seed;
+  if (!ddsrt_prng_makeseed (&seed))
+  {
+    /* Poor man's initialisation */
+    struct lengthof_seed_large_enough {
+      char ok[sizeof (seed.key) / sizeof (seed.key[0]) >= 3 ? 1 : -1];
+    };
+    memset (&seed, 0, sizeof (seed));
+    dds_time_t now = dds_time ();
+    seed.key[0] = (uint32_t) ddsrt_getpid ();
+    seed.key[1] = (uint32_t) ((uint64_t) now >> 32);
+    seed.key[2] = (uint32_t) now;
+  }
+  ddsrt_prng_init (&default_prng, &seed);
+  ddsrt_mutex_init (&default_prng_lock);
+}
+
+void ddsrt_random_fini (void)
+{
+  ddsrt_mutex_destroy (&default_prng_lock);
 }
diff --git a/src/ddsrt/src/random/posix/random.c b/src/ddsrt/src/random/posix/random.c
new file mode 100644
index 0000000..067f42b
--- /dev/null
+++ b/src/ddsrt/src/random/posix/random.c
@@ -0,0 +1,17 @@
+#include <stdio.h>
+#include <string.h>
+#include "dds/ddsrt/random.h"
+
+bool ddsrt_prng_makeseed (struct ddsrt_prng_seed *seed)
+{
+  FILE *rndfile;
+  memset (seed->key, 0, sizeof (seed->key));
+  if ((rndfile = fopen ("/dev/urandom", "rb")) == NULL)
+    return false;
+  else
+  {
+    size_t n = fread (seed->key, sizeof (seed->key), 1, rndfile);
+    fclose (rndfile);
+    return (n == 1);
+  }
+}
diff --git a/src/ddsrt/src/random/windows/random.c b/src/ddsrt/src/random/windows/random.c
new file mode 100644
index 0000000..6c912b3
--- /dev/null
+++ b/src/ddsrt/src/random/windows/random.c
@@ -0,0 +1,14 @@
+#include <ntstatus.h>
+#define WIN32_NO_STATUS
+#include <windows.h>
+#include "bcrypt.h"
+#include <string.h>
+#include "dds/ddsrt/random.h"
+
+bool ddsrt_prng_makeseed (struct ddsrt_prng_seed *seed)
+{
+  NTSTATUS res;
+  memset (seed->key, 0, sizeof (seed->key));
+  res = BCryptGenRandom (NULL, (PUCHAR) seed->key, (ULONG) sizeof (seed->key), BCRYPT_USE_SYSTEM_PREFERRED_RNG);
+  return (res >= 0);
+}
diff --git a/src/ddsrt/tests/CMakeLists.txt b/src/ddsrt/tests/CMakeLists.txt
index 2b3483d..552cfd2 100644
--- a/src/ddsrt/tests/CMakeLists.txt
+++ b/src/ddsrt/tests/CMakeLists.txt
@@ -22,6 +22,7 @@ set(sources
     "thread_cleanup.c"
     "string.c"
     "log.c"
+    "random.c"
     "strlcpy.c"
     "socket.c"
     "select.c")
diff --git a/src/ddsrt/tests/random.c b/src/ddsrt/tests/random.c
new file mode 100644
index 0000000..f1f2dca
--- /dev/null
+++ b/src/ddsrt/tests/random.c
@@ -0,0 +1,92 @@
+/*
+ * Copyright(c) 2006 to 2018 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+#include <assert.h>
+#include <errno.h>
+#include <stdio.h>
+#include <string.h>
+
+#include "CUnit/Test.h"
+#include "dds/ddsrt/random.h"
+
+#define N_PRNG 4
+#define N_DATA 10
+
+CU_Test(ddsrt_random, mt19937)
+{
+  static const uint32_t refdata[N_DATA] = {
+    3499211612u, 581869302u, 3890346734u, 3586334585u, 545404204u,
+    4161255391u, 3922919429u, 949333985u, 2715962298u, 1323567403u
+  };
+  ddsrt_prng_t prng;
+  ddsrt_prng_init_simple (&prng, 5489U);
+  for (size_t i = 0; i < N_DATA; i++)
+  {
+    uint32_t x = ddsrt_prng_random (&prng);
+    CU_ASSERT_EQUAL_FATAL(x, refdata[i]);
+  }
+}
+
+CU_Test(ddsrt_random, makeseed)
+{
+  ddsrt_prng_seed_t seeds[N_PRNG];
+
+  /* Until proven otherwise, assume all platforms have a good way of getting multiple seeds */
+  memset (seeds, 0, sizeof (seeds));
+  for (size_t i = 0; i < N_PRNG; i++)
+  {
+    bool ok = ddsrt_prng_makeseed (&seeds[i]);
+    CU_ASSERT_FATAL(ok);
+  }
+
+  /* Any pair the same is possible, but the likelihood should be so small that it is worth accepting
+     an intermittently failing test */
+  for (size_t i = 0; i < N_PRNG; i++)
+  {
+    for (size_t j = i + 1; j < N_PRNG; j++)
+      CU_ASSERT_FATAL (memcmp (&seeds[i], &seeds[j], sizeof (seeds[i])) != 0);
+  }
+
+  /* A short random sequence generated from each of the different seeds should be unique -- again,
+     there is no guarantee but only an overwhelming likelihood */
+  ddsrt_prng_t prngs[N_PRNG];
+  uint32_t data[N_PRNG][N_DATA];
+  memset (data, 0, sizeof (data));
+  for (size_t i = 0; i < N_PRNG; i++)
+  {
+    ddsrt_prng_init (&prngs[i], &seeds[i]);
+    for (size_t j = 0; j < N_DATA; j++)
+      data[i][j] = ddsrt_prng_random (&prngs[i]);
+  }
+  for (size_t i = 0; i < N_PRNG; i++)
+  {
+    for (size_t j = i + 1; j < N_PRNG; j++)
+      CU_ASSERT_FATAL (memcmp (&data[i], &data[j], sizeof (data[i])) != 0);
+  }
+}
+
+CU_Test(ddsrt_random, default_random)
+{
+#define N_BINS 128
+#define N_PER_BIN 100
+  uint32_t bins[N_BINS];
+  memset (bins, 0, sizeof (bins));
+  for (size_t i = 0; i < N_PER_BIN * N_BINS; i++)
+  {
+    uint32_t x = ddsrt_random ();
+    bins[x % N_BINS]++;
+  }
+  double chisq = 0.0;
+  for (size_t i = 0; i < N_BINS; i++)
+    chisq += ((bins[i] - N_PER_BIN) * (bins[i] - N_PER_BIN)) / (double) N_PER_BIN;
+  /* Solve[CDF[ChiSquareDistribution[127], x] == 999/1000] */
+  CU_ASSERT (chisq < 181.993);
+}

From a94a2296fe404138d60bec717782d14bf25f840c Mon Sep 17 00:00:00 2001
From: Erik Boasson <eb@ilities.com>
Date: Thu, 4 Apr 2019 15:35:11 +0200
Subject: [PATCH 018/238] install core/ddsi and util header files

Some of the former are required to implement alternative serialisation
methods; the latter is just generally useful. For the time being these
are not part of the formal API and not subject to backwards
compatibility. Still, they have value for quickly building tools on that
use Cyclone and happen to need any of these functions.

Signed-off-by: Erik Boasson <eb@ilities.com>
---
 src/core/CMakeLists.txt                        |  8 ++++++--
 src/core/ddsi/CMakeLists.txt                   |  6 +++++-
 .../ddsi/include/dds/ddsi/probes-constants.h   | 18 ------------------
 src/util/CMakeLists.txt                        |  5 +++++
 4 files changed, 16 insertions(+), 21 deletions(-)
 delete mode 100644 src/core/ddsi/include/dds/ddsi/probes-constants.h

diff --git a/src/core/CMakeLists.txt b/src/core/CMakeLists.txt
index 2ef2fc3..39a580f 100644
--- a/src/core/CMakeLists.txt
+++ b/src/core/CMakeLists.txt
@@ -53,9 +53,13 @@ include(ddsc/CMakeLists.txt)
 target_link_libraries(ddsc PRIVATE util)
 target_link_libraries(ddsc PRIVATE ddsrt)
 target_compile_definitions(
-  ddsc PUBLIC $<BUILD_INTERFACE:$<TARGET_PROPERTY:ddsrt,INTERFACE_COMPILE_DEFINITIONS>>)
+  ddsc PUBLIC
+  $<BUILD_INTERFACE:$<TARGET_PROPERTY:ddsrt,INTERFACE_COMPILE_DEFINITIONS>>
+  $<BUILD_INTERFACE:$<TARGET_PROPERTY:util,INTERFACE_COMPILE_DEFINITIONS>>)
 target_include_directories(
-  ddsc PUBLIC $<BUILD_INTERFACE:$<TARGET_PROPERTY:ddsrt,INTERFACE_INCLUDE_DIRECTORIES>>)
+  ddsc PUBLIC
+  $<BUILD_INTERFACE:$<TARGET_PROPERTY:ddsrt,INTERFACE_INCLUDE_DIRECTORIES>>
+  $<BUILD_INTERFACE:$<TARGET_PROPERTY:util,INTERFACE_INCLUDE_DIRECTORIES>>)
 
 # SOVERSION should increase on incompatible ABI change
 set_target_properties(ddsc PROPERTIES VERSION ${PROJECT_VERSION} SOVERSION ${PROJECT_VERSION_MAJOR})
diff --git a/src/core/ddsi/CMakeLists.txt b/src/core/ddsi/CMakeLists.txt
index 8821665..683ad6e 100644
--- a/src/core/ddsi/CMakeLists.txt
+++ b/src/core/ddsi/CMakeLists.txt
@@ -78,7 +78,6 @@ PREPEND(hdrs_private_ddsi "${CMAKE_CURRENT_LIST_DIR}/include/dds/ddsi"
     ddsi_iid.h
     ddsi_tkmap.h
     ddsi_vendor.h
-    probes-constants.h
     q_addrset.h
     q_bitset.h
     q_bswap.h
@@ -126,3 +125,8 @@ target_sources(ddsc
 
 target_include_directories(ddsc
   PRIVATE "${CMAKE_CURRENT_LIST_DIR}/include")
+
+install(
+  DIRECTORY "${CMAKE_CURRENT_LIST_DIR}/include/dds"
+  DESTINATION "${CMAKE_INSTALL_INCLUDEDIR}"
+  COMPONENT dev)
diff --git a/src/core/ddsi/include/dds/ddsi/probes-constants.h b/src/core/ddsi/include/dds/ddsi/probes-constants.h
deleted file mode 100644
index 83b15ab..0000000
--- a/src/core/ddsi/include/dds/ddsi/probes-constants.h
+++ /dev/null
@@ -1,18 +0,0 @@
-/*
- * Copyright(c) 2006 to 2018 ADLINK Technology Limited and others
- *
- * This program and the accompanying materials are made available under the
- * terms of the Eclipse Public License v. 2.0 which is available at
- * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
- * v. 1.0 which is available at
- * http://www.eclipse.org/org/documents/edl-v10.php.
- *
- * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
- */
-#ifndef PROBES_CONSTANTS_H
-#define PROBES_CONSTANTS_H
-#define DROP_QUEUE_FULL 1
-#define DROP_TOO_OLD 2
-#define DROP_REORDER_FULL 3
-#define DROP_DUPLICATE 4
-#endif
diff --git a/src/util/CMakeLists.txt b/src/util/CMakeLists.txt
index 4f44a70..84088c3 100644
--- a/src/util/CMakeLists.txt
+++ b/src/util/CMakeLists.txt
@@ -37,6 +37,11 @@ target_include_directories(
     "$<BUILD_INTERFACE:${CMAKE_CURRENT_BINARY_DIR}/include>"
     "$<BUILD_INTERFACE:$<TARGET_PROPERTY:ddsrt,INTERFACE_INCLUDE_DIRECTORIES>>")
 
+install(
+  DIRECTORY "${CMAKE_CURRENT_LIST_DIR}/include/dds"
+  DESTINATION "${CMAKE_INSTALL_INCLUDEDIR}"
+  COMPONENT dev)
+
 # TODO: improve test inclusion.
 if((BUILD_TESTING) AND ((NOT DEFINED MSVC_VERSION) OR (MSVC_VERSION GREATER "1800")))
   add_subdirectory(tests)

From 069688bb76adb0fc15448f7be609e99fd356818a Mon Sep 17 00:00:00 2001
From: Erik Boasson <eb@ilities.com>
Date: Sun, 7 Apr 2019 17:30:32 +0200
Subject: [PATCH 019/238] fix trace print of tkmap_instance address

Fix the trace to contain a print of the address of the tkamp_instance
(along with the instance id), rather than the address of the stack
variable pointing to the tkmap_instance.

Signed-off-by: Erik Boasson <eb@ilities.com>
---
 src/core/ddsi/src/ddsi_tkmap.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/core/ddsi/src/ddsi_tkmap.c b/src/core/ddsi/src/ddsi_tkmap.c
index fbc6094..0d1c6bd 100644
--- a/src/core/ddsi/src/ddsi_tkmap.c
+++ b/src/core/ddsi/src/ddsi_tkmap.c
@@ -203,7 +203,7 @@ retry:
 
   if (tk && rd)
   {
-    DDS_TRACE("tk=%p iid=%"PRIx64" ", (void *) &tk, tk->m_iid);
+    DDS_TRACE("tk=%p iid=%"PRIx64" ", (void *) tk, tk->m_iid);
   }
   return tk;
 }

From 7d281df24a947dc2384687fe80396cc1007aeaaa Mon Sep 17 00:00:00 2001
From: Erik Boasson <eb@ilities.com>
Date: Tue, 19 Feb 2019 10:57:21 +0100
Subject: [PATCH 020/238] lift limits on handle allocation and reuse (#95)

The old entity handle mechanism suffered from a number of problems, the
most terrible one being that it would only ever allocate 1000 handles
(not even have at most 1000 in use at the same time).  Secondarily, it
was protected by a single mutex that actually does show up as a limiting
factor in, say, a polling-based throughput test with small messages.
Thirdly, it tried to provide for various use cases that don't exist in
practice but add complexity and overhead.

This commit totally rewrites the mechanism, by replacing the old array
with a hash table and allowing a near-arbitrary number of handles as
well as reuse of handles.  It also removes the entity "kind" bits in the
most significant bits of the handles, because they only resulted in
incorrect checking of argument validity.  All that is taken out, but
there is still more cleaning up to be done.  It furthermore removes an
indirection in the handle-to-entity lookup by embedding the
"dds_handle_link" structure in the entity.

Handle allocation is randomized to avoid the have a high probability of
quickly finding an available handle (the total number of handles is
limited to a number much smaller than the domain from which they are
allocated).  The likelihood of handle reuse is still dependent on the
number of allocated handles -- the fewer handles there are, the longer
the expected time to reuse.  Non-randomized handles would give a few
guarantees more, though.

It moreover moves the code from the "util" to the "core/ddsc" component,
because it really is only used for entities, and besides the new
implementation relies on the deferred freeing (a.k.a. garbage collection
mechanism) implemented in the core.

The actual handle management has two variants, selectable with a macro:
the preferred embodiment uses a concurrent hash table, the actually used
one performs all operations inside a single mutex and uses a
non-concurrent version of the hash table.  The reason the
less-predeferred embodiment is used is that the concurrent version
requires the freeing of entity objects to be deferred (much like the
GUID-to-entity hash tables in DDSI function, or indeed the key value to
instance handle mapping).  That is a fair bit of work, and the
non-concurrent version is a reasonable intermediate step.

Signed-off-by: Erik Boasson <eb@ilities.com>
---
 src/CMakeLists.txt                            |   1 -
 src/cmake/modules/FileIDs.cmake               | 146 -------
 src/core/CMakeLists.txt                       |   2 -
 src/core/ddsc/.fileids                        |  33 --
 src/core/ddsc/CMakeLists.txt                  |   2 +
 src/core/ddsc/include/dds/dds.h               |  11 +-
 .../ddsc/include/dds/ddsc/dds_public_impl.h   |   4 +-
 src/core/ddsc/src/dds__entity.h               |  30 +-
 src/core/ddsc/src/dds__err.h                  |  15 +-
 .../ddsc/src/dds__handles.h}                  | 131 ++----
 src/core/ddsc/src/dds__publisher.h            |   3 +
 src/core/ddsc/src/dds__subscriber.h           |   3 +-
 src/core/ddsc/src/dds__types.h                |   7 +-
 src/core/ddsc/src/dds_coherent.c              |  46 +-
 src/core/ddsc/src/dds_entity.c                | 205 ++++-----
 src/core/ddsc/src/dds_guardcond.c             |   6 +-
 src/core/ddsc/src/dds_handles.c               | 267 ++++++++++++
 src/core/ddsc/src/dds_init.c                  |  36 +-
 src/core/ddsc/src/dds_participant.c           |   8 +-
 src/core/ddsc/src/dds_publisher.c             |  54 +--
 src/core/ddsc/src/dds_querycond.c             |   4 +-
 src/core/ddsc/src/dds_read.c                  |   6 +-
 src/core/ddsc/src/dds_readcond.c              |  39 +-
 src/core/ddsc/src/dds_reader.c                | 201 +++++----
 src/core/ddsc/src/dds_subscriber.c            |   3 +
 src/core/ddsc/src/dds_topic.c                 |  10 +-
 src/core/ddsc/src/dds_waitset.c               |  14 +-
 src/core/ddsc/src/dds_writer.c                |  87 ++--
 src/core/ddsc/tests/CMakeLists.txt            |   2 +-
 src/core/ddsc/tests/builtin_topics.c          |   9 +-
 src/core/ddsc/tests/dispose.c                 |  24 +-
 src/core/ddsc/tests/entity_hierarchy.c        |  50 +--
 src/core/ddsc/tests/entity_status.c           | 100 ++---
 src/core/ddsc/tests/file_id.c                 |  37 --
 src/core/ddsc/tests/publisher.c               |  29 +-
 src/core/ddsc/tests/querycondition.c          |  12 +-
 src/core/ddsc/tests/read_instance.c           |  16 +-
 src/core/ddsc/tests/readcondition.c           |  12 +-
 src/core/ddsc/tests/reader.c                  |  32 +-
 src/core/ddsc/tests/reader_iterator.c         |  16 +-
 src/core/ddsc/tests/register.c                |   4 +-
 src/core/ddsc/tests/take_instance.c           |  16 +-
 src/core/ddsc/tests/topic.c                   |   4 +-
 src/core/ddsc/tests/unregister.c              |  16 +-
 src/core/ddsc/tests/unsupported.c             |   4 +-
 src/core/ddsc/tests/waitset.c                 |  30 +-
 src/core/ddsc/tests/write.c                   |   2 +-
 src/core/ddsc/tests/writer.c                  |   4 +-
 src/core/ddsi/.fileids                        |  40 --
 src/core/ddsi/src/q_thread_inlines.c          |   1 -
 src/tools/pubsub/common.c                     |   1 -
 src/util/CMakeLists.txt                       |   2 +-
 src/util/src/ut_handleserver.c                | 393 ------------------
 src/util/tests/CMakeLists.txt                 |  18 +-
 src/util/tests/handleserver.c                 | 304 --------------
 55 files changed, 871 insertions(+), 1681 deletions(-)
 delete mode 100644 src/cmake/modules/FileIDs.cmake
 delete mode 100644 src/core/ddsc/.fileids
 rename src/{util/include/dds/util/ut_handleserver.h => core/ddsc/src/dds__handles.h} (58%)
 create mode 100644 src/core/ddsc/src/dds_handles.c
 delete mode 100644 src/core/ddsc/tests/file_id.c
 delete mode 100644 src/core/ddsi/.fileids
 delete mode 100644 src/util/src/ut_handleserver.c
 delete mode 100644 src/util/tests/handleserver.c

diff --git a/src/CMakeLists.txt b/src/CMakeLists.txt
index 19b0515..52a062e 100644
--- a/src/CMakeLists.txt
+++ b/src/CMakeLists.txt
@@ -152,7 +152,6 @@ if(NOT (${USE_SANITIZER} STREQUAL "none"))
   link_libraries(-fno-omit-frame-pointer -fsanitize=${USE_SANITIZER})
 endif()
 
-include(FileIDs)
 include(GNUInstallDirs)
 include(AnalyzeBuild)
 # Include Coverage before CTest so that COVERAGE_COMMAND can be modified
diff --git a/src/cmake/modules/FileIDs.cmake b/src/cmake/modules/FileIDs.cmake
deleted file mode 100644
index 5c79198..0000000
--- a/src/cmake/modules/FileIDs.cmake
+++ /dev/null
@@ -1,146 +0,0 @@
-#
-# Copyright(c) 2006 to 2018 ADLINK Technology Limited and others
-#
-# This program and the accompanying materials are made available under the
-# terms of the Eclipse Public License v. 2.0 which is available at
-# http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
-# v. 1.0 which is available at
-# http://www.eclipse.org/org/documents/edl-v10.php.
-#
-# SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
-#
-
-# To uniquely identify the origin of every error all source files must be
-# assigned a pseudo unique identifier (or module). Because only 32 bits are
-# available in the return code (for now) to store the sign bit (1), return
-# code (4), line number (8) and file identifier, using a deterministic hash
-# will likely lead to collisions. To work around this issue a static map is
-# applied, which also ensures that file identifiers are persisted accross
-# versions/branches. Of course one could choose to specify the module manually
-# with every return, but that is tedious and error prone.
-
-if(FILE_IDS_INCLUDED)
-  return()
-endif()
-set(FILE_IDS_INCLUDED true)
-
-
-# Verify syntax for all .fileids files and ensure no source file id is used
-# more than once.
-file(GLOB_RECURSE fils__ LIST_DIRECTORIES false "${CMAKE_SOURCE_DIR}/.fileids")
-
-set(ids__)
-foreach(fil__ ${fils__})
-  file(READ "${fil__}" lines__)
-  string(REGEX REPLACE "\n" ";" lines__ ${lines__})
-  foreach(line__ ${lines__})
-    if("${line__}" MATCHES "^[ \t]*([0-9]+)[ \t]+.*$")
-      set(id__ "${CMAKE_MATCH_1}")
-      if(${id__} IN_LIST ids__)
-        set(dup__ true)
-        message(STATUS "Id ${id__} used more than once")
-      else()
-        list(APPEND ids__ ${id__})
-      endif()
-    elseif(NOT "${line__}" MATCHES "^[ \t]*#")
-      message(FATAL_ERROR "Syntax error in ${fil__}")
-    endif()
-  endforeach()
-endforeach()
-
-if(dup__)
-  message(FATAL_ERROR "Duplicate ids")
-endif()
-
-function(JOIN lst glue var)
-  string(REPLACE ";" "${glue}" tmp "${${lst}}")
-  set(${var} "${tmp}" PARENT_SCOPE)
-endfunction()
-
-function(FILE_ID src var) # private
-  # .fileids files may reside in subdirectories to keep them together with the
-  # files they assign an identifier to, much like .gitignore files
-  set(dir "${CMAKE_SOURCE_DIR}")
-  set(parts "${src}")
-  string(REGEX REPLACE "[/\\]+" ";" parts "${parts}")
-  while(parts)
-    set(map "${dir}/.fileids")
-    join(parts "/" fil)
-    list(APPEND maps "${map}^${fil}")
-    list(GET parts 0 part)
-    list(REMOVE_AT parts 0)
-    set(dir "${dir}/${part}")
-  endwhile()
-
-  set(id)
-  foreach(entry ${maps})
-    string(REPLACE "^" ";" entry "${entry}")
-    list(GET entry 0 map)
-    list(GET entry 1 fil)
-    if(EXISTS "${map}")
-      file(READ "${map}" contents)
-      string(REGEX REPLACE "\n" ";" lines "${contents}")
-
-      foreach(line ${lines})
-        if("${line}" MATCHES "^[ \t]*([0-9]+)[ \t]+(.*)$")
-          set(id "${CMAKE_MATCH_1}")
-          string(STRIP "${CMAKE_MATCH_2}" expr)
-          if("${fil}" STREQUAL "${expr}")
-            set(${var} ${id} PARENT_SCOPE)
-            return()
-          endif()
-        elseif(NOT "${line}" MATCHES "^[ \t]*#")
-          message(FATAL_ERROR "Syntax error in ${map}")
-        endif()
-      endforeach()
-    endif()
-  endforeach()
-endfunction()
-
-# Source file properties are visible only to targets added in the same
-# directory (CMakeLists.txt).
-# https://cmake.org/cmake/help/latest/command/set_source_files_properties.html
-function(SET_TARGET_FILE_IDS tgt)
-  get_target_property(external ${tgt} IMPORTED)
-  get_target_property(alias ${tgt} ALIASED_TARGET)
-  string(LENGTH "${CMAKE_SOURCE_DIR}" len)
-  math(EXPR len "${len} + 1") # strip slash following source dir too
-
-  if((NOT external) AND (NOT alias))
-    get_target_property(srcs ${tgt} SOURCES)
-    get_target_property(src_dir ${tgt} SOURCE_DIR)
-    foreach(src ${srcs})
-      set(id)
-      if(IS_ABSOLUTE "${src}")
-        set(fil "${src}")
-      else()
-        set(fil "${src_dir}/${src}")
-      endif()
-
-      get_filename_component(fil "${fil}" ABSOLUTE)
-
-      string(FIND "${fil}" "${CMAKE_SOURCE_DIR}" pos)
-      if(${pos} EQUAL 0)
-        string(SUBSTRING "${fil}" ${len} -1 rel)
-        file_id("${rel}" id)
-      endif()
-
-      if(id)
-        if(("${source_file_id_${id}}" STREQUAL "") OR
-           ("${source_file_id_${id}}" STREQUAL "${rel}"))
-          set("source_file_id_${id}" "${rel}" CACHE INTERNAL "")
-          set_source_files_properties(
-            "${src}" PROPERTIES COMPILE_DEFINITIONS __FILE_ID__=${id})
-        else()
-          message(FATAL_ERROR "Same file id for ${rel} and ${source_file_id_${id}}")
-        endif()
-      else()
-        get_filename_component(ext "${rel}" EXT)
-        if (NOT "${ext}" MATCHES "\.h*")
-            message(FATAL_ERROR "No source file id for ${rel}")
-        endif()
-      endif()
-    endforeach()
-  endif()
-endfunction()
-
diff --git a/src/core/CMakeLists.txt b/src/core/CMakeLists.txt
index 39a580f..071d6e6 100644
--- a/src/core/CMakeLists.txt
+++ b/src/core/CMakeLists.txt
@@ -64,8 +64,6 @@ target_include_directories(
 # SOVERSION should increase on incompatible ABI change
 set_target_properties(ddsc PROPERTIES VERSION ${PROJECT_VERSION} SOVERSION ${PROJECT_VERSION_MAJOR})
 
-set_target_file_ids(ddsc)
-
 # Create a pseudo-target that other targets (i.e. examples, tests) can depend
 # on and can also be provided as import-target by a package-file when building
 # those targets outside the regular Cyclone build-tree (i.e. the installed tree)
diff --git a/src/core/ddsc/.fileids b/src/core/ddsc/.fileids
deleted file mode 100644
index f24df98..0000000
--- a/src/core/ddsc/.fileids
+++ /dev/null
@@ -1,33 +0,0 @@
-# ddsc sources
-40  src/dds_alloc.c
-41  src/dds_coherent.c
-42  src/dds_iid.c
-43  src/dds_participant.c
-44  src/dds_reader.c
-45  src/dds_thread.c
-46  src/dds_writer.c
-47  src/dds_init.c
-48  src/dds_publisher.c
-49  src/dds_rhc.c
-50  src/dds_time.c
-51  src/q_osplser.c
-52  src/dds_domain.c
-53  src/dds_instance.c
-54  src/dds_qos.c
-55  src/dds_tkmap.c
-56  src/dds_entity.c
-57  src/dds_key.c
-58  src/dds_querycond.c
-59  src/dds_topic.c
-60  src/dds_err.c
-61  src/dds_listener.c
-62  src/dds_read.c
-63  src/dds_stream.c
-64  src/dds_waitset.c
-65  src/dds_log.c
-66  src/dds_readcond.c
-67  src/dds_subscriber.c
-68  src/dds_write.c
-70  src/dds_builtin.c
-72  src/dds_guardcond.c
-73  src/dds_whc.c
diff --git a/src/core/ddsc/CMakeLists.txt b/src/core/ddsc/CMakeLists.txt
index 5b3658e..a97ccda 100644
--- a/src/core/ddsc/CMakeLists.txt
+++ b/src/core/ddsc/CMakeLists.txt
@@ -22,6 +22,7 @@ PREPEND(srcs_ddsc "${CMAKE_CURRENT_LIST_DIR}/src"
     dds_domain.c
     dds_instance.c
     dds_qos.c
+    dds_handles.c
     dds_entity.c
     dds_key.c
     dds_querycond.c
@@ -54,6 +55,7 @@ PREPEND(hdrs_private_ddsc "${CMAKE_CURRENT_LIST_DIR}/src"
     dds__alloc.h
     dds__builtin.h
     dds__domain.h
+    dds__handles.h
     dds__entity.h
     dds__init.h
     dds__key.h
diff --git a/src/core/ddsc/include/dds/dds.h b/src/core/ddsc/include/dds/dds.h
index 124a2e6..3d5dc42 100644
--- a/src/core/ddsc/include/dds/dds.h
+++ b/src/core/ddsc/include/dds/dds.h
@@ -69,6 +69,9 @@ struct ddsi_serdata;
  */
 DDS_EXPORT dds_domainid_t dds_domain_default (void);
 
+
+#define DDS_MIN_PSEUDO_HANDLE ((dds_entity_t) 0x7fff0000)
+
 /* @defgroup builtintopic_constants Convenience constants for referring to builtin topics
  *
  * These constants can be used in place of an actual dds_topic_t, when creating
@@ -76,10 +79,10 @@ DDS_EXPORT dds_domainid_t dds_domain_default (void);
  *
  * @{
  */
-extern DDS_EXPORT const dds_entity_t DDS_BUILTIN_TOPIC_DCPSPARTICIPANT;
-extern DDS_EXPORT const dds_entity_t DDS_BUILTIN_TOPIC_DCPSTOPIC;
-extern DDS_EXPORT const dds_entity_t DDS_BUILTIN_TOPIC_DCPSPUBLICATION;
-extern DDS_EXPORT const dds_entity_t DDS_BUILTIN_TOPIC_DCPSSUBSCRIPTION;
+#define DDS_BUILTIN_TOPIC_DCPSPARTICIPANT  ((dds_entity_t) (DDS_MIN_PSEUDO_HANDLE + 1))
+#define DDS_BUILTIN_TOPIC_DCPSTOPIC        ((dds_entity_t) (DDS_MIN_PSEUDO_HANDLE + 2))
+#define DDS_BUILTIN_TOPIC_DCPSPUBLICATION  ((dds_entity_t) (DDS_MIN_PSEUDO_HANDLE + 3))
+#define DDS_BUILTIN_TOPIC_DCPSSUBSCRIPTION ((dds_entity_t) (DDS_MIN_PSEUDO_HANDLE + 4))
 /** @}*/
 
 /** @name Communication Status definitions
diff --git a/src/core/ddsc/include/dds/ddsc/dds_public_impl.h b/src/core/ddsc/include/dds/ddsc/dds_public_impl.h
index 923ea24..d031570 100644
--- a/src/core/ddsc/include/dds/ddsc/dds_public_impl.h
+++ b/src/core/ddsc/include/dds/ddsc/dds_public_impl.h
@@ -96,7 +96,6 @@ dds_topic_descriptor_t;
 #define DDS_HANDLE_NIL 0
 #define DDS_ENTITY_NIL 0
 
-#define DDS_ENTITY_KIND_MASK (0x7F000000) /* Should be same as UT_HANDLE_KIND_MASK. */
 typedef enum dds_entity_kind
 {
   DDS_KIND_DONTCARE    = 0x00000000,
@@ -109,8 +108,7 @@ typedef enum dds_entity_kind
   DDS_KIND_COND_READ   = 0x07000000,
   DDS_KIND_COND_QUERY  = 0x08000000,
   DDS_KIND_COND_GUARD  = 0x09000000,
-  DDS_KIND_WAITSET     = 0x0A000000,
-  DDS_KIND_INTERNAL    = 0x0B000000,
+  DDS_KIND_WAITSET     = 0x0A000000
 }
 dds_entity_kind_t;
 
diff --git a/src/core/ddsc/src/dds__entity.h b/src/core/ddsc/src/dds__entity.h
index 77ae66b..992c15a 100644
--- a/src/core/ddsc/src/dds__entity.h
+++ b/src/core/ddsc/src/dds__entity.h
@@ -53,6 +53,10 @@ dds_entity_add_ref_nolock(dds_entity *e);
   qualifier_ dds_retcode_t type_##_lock (dds_entity_t hdl, type_ **x); \
   qualifier_ void type_##_unlock (type_ *x);
 
+DDS_EXPORT inline dds_entity *dds_entity_from_handle_link (struct dds_handle_link *hdllink) {
+  return (dds_entity *) ((char *) hdllink - offsetof (struct dds_entity, m_hdllink));
+}
+
 DDS_EXPORT inline bool dds_entity_is_enabled (const dds_entity *e) {
   return (e->m_flags & DDS_ENTITY_ENABLED) != 0;
 }
@@ -68,11 +72,7 @@ DDS_EXPORT inline bool dds_entity_status_match (const dds_entity *e, uint32_t t)
 }
 
 DDS_EXPORT inline dds_entity_kind_t dds_entity_kind (const dds_entity *e) {
-  return (dds_entity_kind_t) (e->m_hdl & DDS_ENTITY_KIND_MASK);
-}
-
-DDS_EXPORT inline dds_entity_kind_t dds_entity_kind_from_handle (dds_entity_t hdl) {
-  return (hdl > 0) ? (dds_entity_kind_t) (hdl & DDS_ENTITY_KIND_MASK) : DDS_KIND_DONTCARE;
+  return e->m_kind;
 }
 
 DDS_EXPORT void dds_entity_status_signal (dds_entity *e);
@@ -80,7 +80,9 @@ DDS_EXPORT void dds_entity_status_signal (dds_entity *e);
 DDS_EXPORT void dds_entity_invoke_listener (const dds_entity *entity, enum dds_status_id which, const void *vst);
 
 DDS_EXPORT dds_retcode_t
-dds_valid_hdl(dds_entity_t hdl, dds_entity_kind_t kind);
+dds_entity_claim (
+  dds_entity_t hdl,
+  dds_entity **eptr);
 
 DDS_EXPORT dds_retcode_t
 dds_entity_lock(
@@ -118,14 +120,22 @@ dds_delete_impl(
   dds_entity_t entity,
   bool keep_if_explicit);
 
-DDS_EXPORT const char *
-dds__entity_kind_str(
-  dds_entity_t e);
-
 DDS_EXPORT dds_domain *
 dds__entity_domain(
   dds_entity* e);
 
+DDS_EXPORT dds_return_t
+dds_generic_unimplemented_operation_manykinds(
+        dds_entity_t handle,
+        size_t nkinds,
+        const dds_entity_kind_t *kinds);
+
+DDS_EXPORT dds_return_t
+dds_generic_unimplemented_operation(
+        dds_entity_t handle,
+        dds_entity_kind_t kind);
+
+
 #if defined (__cplusplus)
 }
 #endif
diff --git a/src/core/ddsc/src/dds__err.h b/src/core/ddsc/src/dds__err.h
index 917051a..a54be27 100644
--- a/src/core/ddsc/src/dds__err.h
+++ b/src/core/ddsc/src/dds__err.h
@@ -20,20 +20,7 @@
 extern "C" {
 #endif
 
-/* To construct return status
- * Use '+' instead of '|'. Otherwise, the SAL checking doesn't
- * understand when a return value is negative or positive and
- * complains a lot about "A successful path through the function
- * does not set the named _Out_ parameter." */
-#if !defined(__FILE_ID__)
-#error "__FILE_ID__ not defined"
-#endif
-
-#define DDS__FILE_ID__ (((__FILE_ID__ & 0x1ff)) << 22)
-#define DDS__LINE__ ((__LINE__ & 0x3fff) << 8)
-
-#define DDS_ERRNO(err) \
-    (assert(err > DDS_RETCODE_OK), -(DDS__FILE_ID__ + DDS__LINE__ + (err)))
+#define DDS_ERRNO(err) (assert(err > DDS_RETCODE_OK), -(err))
 
 #if defined (__cplusplus)
 }
diff --git a/src/util/include/dds/util/ut_handleserver.h b/src/core/ddsc/src/dds__handles.h
similarity index 58%
rename from src/util/include/dds/util/ut_handleserver.h
rename to src/core/ddsc/src/dds__handles.h
index f0a91e0..7ceee26 100644
--- a/src/util/include/dds/util/ut_handleserver.h
+++ b/src/core/ddsc/src/dds__handles.h
@@ -1,5 +1,5 @@
 /*
- * Copyright(c) 2006 to 2018 ADLINK Technology Limited and others
+ * Copyright(c) 2006 to 2019 ADLINK Technology Limited and others
  *
  * This program and the accompanying materials are made available under the
  * terms of the Eclipse Public License v. 2.0 which is available at
@@ -9,19 +9,20 @@
  *
  * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
  */
-#ifndef UT_HANDLESERVER_H
-#define UT_HANDLESERVER_H
+#ifndef DDS__HANDLES_H
+#define DDS__HANDLES_H
 
-#include <stdbool.h>
-#include <stdint.h>
-
-#include "dds/export.h"
 #include "dds/ddsrt/time.h"
+#include "dds/ddsrt/retcode.h"
+#include "dds/ddsrt/atomics.h"
+#include "dds/dds.h"
 
 #if defined (__cplusplus)
 extern "C" {
 #endif
 
+struct dds_entity;
+
 /********************************************************************************************
  *
  * TODO CHAM-138: Header file improvements
@@ -51,46 +52,8 @@ extern "C" {
  */
 
 
-/*
- * Some error return values.
- */
-typedef enum ut_handle_retcode_t {
-    UT_HANDLE_OK               =  0,
-    UT_HANDLE_ERROR            = -1,     /* General error.                                      */
-    UT_HANDLE_CLOSED           = -2,     /* Handle has been previously close.                   */
-    UT_HANDLE_DELETED          = -3,     /* Handle has been previously deleted.                 */
-    UT_HANDLE_INVALID          = -4,     /* Handle is not a valid handle.                       */
-    UT_HANDLE_UNEQUAL_KIND     = -5,     /* Handle does not contain expected kind.              */
-    UT_HANDLE_TIMEOUT          = -6,     /* Operation timed out.                                */
-    UT_HANDLE_OUT_OF_RESOURCES = -7,     /* Action isn't possible because of limited resources. */
-    UT_HANDLE_NOT_INITALIZED   = -8      /* Not initialized.                                    */
-} ut_handle_retcode_t;
 
-
-/*
- * The 32 bit handle
- *      |  bits |     # values | description                                                 |
- *      --------------------------------------------------------------------------------------
- *      |    31 |            2 | positive/negative (negative can be used to indicate errors) |
- *      | 24-30 |          127 | handle kind       (value determined by client)              |
- *      |  0-23 |   16.777.215 | index or hash     (maintained by the handleserver)          |
- *
- * When the handle is negative, it'll contain a ut_handle_retcode_t error value.
- *
- * FYI: the entity id within DDSI is also 24 bits...
- */
-typedef int32_t ut_handle_t;
-
-/*
- * Handle bits
- *   +kkk kkkk iiii iiii iiii iiii iiii iiii
- * 31|   | 24|                            0|
- */
-#define UT_HANDLE_SIGN_MASK (0x80000000)
-#define UT_HANDLE_KIND_MASK (0x7F000000)
-#define UT_HANDLE_IDX_MASK  (0x00FFFFFF)
-
-#define UT_HANDLE_DONTCARE_KIND (0)
+typedef int32_t dds_handle_t;
 
 /*
  * The handle link type.
@@ -106,14 +69,16 @@ typedef int32_t ut_handle_t;
  * This handlelink is invalid after the related handle is deleted and should
  * never be used afterwards.
  */
-struct ut_handlelink;
-
+struct dds_handle_link {
+  dds_handle_t hdl;
+  ddsrt_atomic_uint32_t cnt_flags;
+};
 
 /*
  * Initialize handleserver singleton.
  */
-DDS_EXPORT ut_handle_retcode_t
-ut_handleserver_init(void);
+DDS_EXPORT dds_return_t
+dds_handle_server_init(void (*free_via_gc) (void *x));
 
 
 /*
@@ -121,7 +86,7 @@ ut_handleserver_init(void);
  * The handleserver is destroyed when fini() is called as often as init().
  */
 DDS_EXPORT void
-ut_handleserver_fini(void);
+dds_handle_server_fini(void);
 
 
 /*
@@ -142,8 +107,9 @@ ut_handleserver_fini(void);
  * Valid handle when returned value is positive.
  * Otherwise negative handle is returned.
  */
-DDS_EXPORT ut_handle_t
-ut_handle_create(int32_t kind, void *arg);
+DDS_EXPORT dds_handle_t
+dds_handle_create(
+        struct dds_handle_link *link);
 
 
 /*
@@ -153,7 +119,8 @@ ut_handle_create(int32_t kind, void *arg);
  * This is a noop on an already closed handle.
  */
 DDS_EXPORT void
-ut_handle_close(ut_handle_t hdl, struct ut_handlelink *link);
+dds_handle_close(
+        struct dds_handle_link *link);
 
 
 /*
@@ -165,23 +132,10 @@ ut_handle_close(ut_handle_t hdl, struct ut_handlelink *link);
  * It will delete the information when there are no more active claims. It'll
  * block when necessary to wait for all possible claims to be released.
  */
-DDS_EXPORT ut_handle_retcode_t
-ut_handle_delete(
-    ut_handle_t hdl,
-    struct ut_handlelink *link,
-    dds_time_t timeout);
-
-
-/*
- * Returns the status the given handle; valid/deleted/closed/etc.
- *
- * Returns OK when valid.
- */
-ut_handle_retcode_t
-ut_handle_status(
-    ut_handle_t hdl,
-    struct ut_handlelink *link,
-    int32_t kind);
+DDS_EXPORT int32_t
+dds_handle_delete(
+        struct dds_handle_link *link,
+        dds_time_t timeout);
 
 
 /*
@@ -190,21 +144,23 @@ ut_handle_status(
  *
  * Returns OK when succeeded.
  */
-DDS_EXPORT ut_handle_retcode_t
-ut_handle_claim(
-    ut_handle_t hdl,
-    struct ut_handlelink *link,
-    int32_t kind,
-    void **arg);
+DDS_EXPORT int32_t
+dds_handle_claim(
+        dds_handle_t hdl,
+        struct dds_handle_link **entity);
+
+
+DDS_EXPORT void
+dds_handle_claim_inc(
+        struct dds_handle_link *link);
 
 
 /*
  * The active claims count is decreased.
  */
 DDS_EXPORT void
-ut_handle_release(
-    ut_handle_t hdl,
-    struct ut_handlelink *link);
+dds_handle_release(
+        struct dds_handle_link *link);
 
 
 /*
@@ -217,21 +173,12 @@ ut_handle_release(
  * possible.
  */
 DDS_EXPORT bool
-ut_handle_is_closed(
-    ut_handle_t hdl,
-    struct ut_handlelink *link);
+dds_handle_is_closed(
+        struct dds_handle_link *link);
 
 
-/*
- * This will get the link of the handle, which can be used for performance
- * increase.
- */
-DDS_EXPORT struct ut_handlelink*
-ut_handle_get_link(
-    ut_handle_t hdl);
-
 #if defined (__cplusplus)
 }
 #endif
 
-#endif /* UT_HANDLESERVER_H */
+#endif /* DDS__HANDLES_H */
diff --git a/src/core/ddsc/src/dds__publisher.h b/src/core/ddsc/src/dds__publisher.h
index 61427df..517abff 100644
--- a/src/core/ddsc/src/dds__publisher.h
+++ b/src/core/ddsc/src/dds__publisher.h
@@ -13,11 +13,14 @@
 #define _DDS_PUBLISHER_H_
 
 #include "dds/dds.h"
+#include "dds__entity.h"
 
 #if defined (__cplusplus)
 extern "C" {
 #endif
 
+DEFINE_ENTITY_LOCK_UNLOCK(inline, dds_publisher, DDS_KIND_PUBLISHER)
+
 dds_return_t dds_publisher_begin_coherent (dds_entity_t e);
 dds_return_t dds_publisher_end_coherent (dds_entity_t e);
 
diff --git a/src/core/ddsc/src/dds__subscriber.h b/src/core/ddsc/src/dds__subscriber.h
index 0609b03..c104255 100644
--- a/src/core/ddsc/src/dds__subscriber.h
+++ b/src/core/ddsc/src/dds__subscriber.h
@@ -13,12 +13,13 @@
 #define _DDS_SUBSCRIBER_H_
 
 #include "dds/dds.h"
+#include "dds__entity.h"
 
 #if defined (__cplusplus)
 extern "C" {
 #endif
 
-struct dds_entity;
+DEFINE_ENTITY_LOCK_UNLOCK(inline, dds_subscriber, DDS_KIND_SUBSCRIBER)
 
 dds_entity_t
 dds__create_subscriber_l(
diff --git a/src/core/ddsc/src/dds__types.h b/src/core/ddsc/src/dds__types.h
index 75c53b8..187aee4 100644
--- a/src/core/ddsc/src/dds__types.h
+++ b/src/core/ddsc/src/dds__types.h
@@ -18,7 +18,7 @@
 #include "dds/ddsrt/sync.h"
 #include "dds/ddsi/q_rtps.h"
 #include "dds/util/ut_avl.h"
-#include "dds/util/ut_handleserver.h"
+#include "dds__handles.h"
 
 #if defined (__cplusplus)
 extern "C" {
@@ -125,7 +125,8 @@ dds_entity_observer;
 
 typedef struct dds_entity
 {
-  ut_handle_t m_hdl;
+  struct dds_handle_link m_hdllink;
+  dds_entity_kind_t m_kind;
   dds_entity_deriver m_deriver;
   uint32_t m_refc;
   struct dds_entity * m_next;
@@ -147,8 +148,6 @@ typedef struct dds_entity
   uint32_t m_status_enable;
   uint32_t m_cb_count;
   dds_entity_observer *m_observers;
-
-  struct ut_handlelink *m_hdllink;
 }
 dds_entity;
 
diff --git a/src/core/ddsc/src/dds_coherent.c b/src/core/ddsc/src/dds_coherent.c
index 7f35660..6123a47 100644
--- a/src/core/ddsc/src/dds_coherent.c
+++ b/src/core/ddsc/src/dds_coherent.c
@@ -21,52 +21,14 @@ dds_return_t
 dds_begin_coherent(
   dds_entity_t entity)
 {
-  dds_return_t ret;
-
-  switch(dds_entity_kind_from_handle(entity)) {
-    case DDS_KIND_READER:
-    case DDS_KIND_WRITER:
-      /* Invoking on a writer/reader behaves as if invoked on
-       * its parent publisher/subscriber. */
-      ret = dds_begin_coherent(dds_get_parent(entity));
-      break;
-    case DDS_KIND_PUBLISHER:
-      ret = dds_publisher_begin_coherent(entity);
-      break;
-    case DDS_KIND_SUBSCRIBER:
-      ret = dds_subscriber_begin_coherent(entity);
-      break;
-    default:
-      DDS_ERROR("Given entity can not control coherency\n");
-      ret = DDS_ERRNO(DDS_RETCODE_BAD_PARAMETER);
-      break;
-  }
-  return ret;
+  static const dds_entity_kind_t kinds[] = { DDS_KIND_READER, DDS_KIND_WRITER, DDS_KIND_PUBLISHER, DDS_KIND_SUBSCRIBER };
+  return dds_generic_unimplemented_operation_manykinds (entity, sizeof (kinds) / sizeof (kinds[0]), kinds);
 }
 
 dds_return_t
 dds_end_coherent(
   dds_entity_t entity)
 {
-  dds_return_t ret;
-
-  switch(dds_entity_kind_from_handle(entity)) {
-    case DDS_KIND_READER:
-    case DDS_KIND_WRITER:
-      /* Invoking on a writer/reader behaves as if invoked on
-       * its parent publisher/subscriber. */
-      ret = dds_end_coherent(dds_get_parent(entity));
-      break;
-    case DDS_KIND_PUBLISHER:
-      ret = dds_publisher_end_coherent(entity);
-      break;
-    case DDS_KIND_SUBSCRIBER:
-      ret = dds_subscriber_end_coherent(entity);
-      break;
-    default:
-      DDS_ERROR("Given entity can not control coherency\n");
-      ret = DDS_ERRNO(DDS_RETCODE_BAD_PARAMETER);
-      break;
-  }
-  return ret;
+  static const dds_entity_kind_t kinds[] = { DDS_KIND_READER, DDS_KIND_WRITER, DDS_KIND_PUBLISHER, DDS_KIND_SUBSCRIBER };
+  return dds_generic_unimplemented_operation_manykinds (entity, sizeof (kinds) / sizeof (kinds[0]), kinds);
 }
diff --git a/src/core/ddsc/src/dds_entity.c b/src/core/ddsc/src/dds_entity.c
index cbb34d3..f8a4e14 100644
--- a/src/core/ddsc/src/dds_entity.c
+++ b/src/core/ddsc/src/dds_entity.c
@@ -22,16 +22,11 @@
 #include "dds__err.h"
 #include "dds/version.h"
 
-/* Sanity check. */
-#if DDS_ENTITY_KIND_MASK != UT_HANDLE_KIND_MASK
-#error "DDS_ENTITY_KIND_MASK != UT_HANDLE_KIND_MASK"
-#endif
-
+extern inline dds_entity *dds_entity_from_handle_link (struct dds_handle_link *hdllink);
 extern inline bool dds_entity_is_enabled (const dds_entity *e);
 extern inline void dds_entity_status_reset (dds_entity *e, uint32_t t);
 extern inline bool dds_entity_status_match (const dds_entity *e, uint32_t t);
 extern inline dds_entity_kind_t dds_entity_kind (const dds_entity *e);
-extern inline dds_entity_kind_t dds_entity_kind_from_handle (dds_entity_t hdl);
 
 static void dds_entity_observers_signal (dds_entity *observed, uint32_t status);
 static void dds_entity_observers_delete (dds_entity *observed);
@@ -71,10 +66,13 @@ static dds_entity *dds__nonself_parent (dds_entity *e)
 
 dds_entity_t dds_entity_init (dds_entity *e, dds_entity *parent, dds_entity_kind_t kind, dds_qos_t *qos, const dds_listener_t *listener, uint32_t mask)
 {
+  dds_handle_t handle;
+
   assert ((kind == DDS_KIND_PARTICIPANT) == (parent == NULL));
   assert (e);
 
   e->m_refc = 1;
+  e->m_kind = kind;
   e->m_qos = qos;
   e->m_cb_count = 0;
   e->m_observers = NULL;
@@ -116,29 +114,11 @@ dds_entity_t dds_entity_init (dds_entity *e, dds_entity *parent, dds_entity_kind
     ddsrt_mutex_unlock (&e->m_observers_lock);
   }
 
-  e->m_hdllink = NULL;
-  e->m_hdl = ut_handle_create ((int32_t) kind, e);
-  if (e->m_hdl > 0)
-  {
-    e->m_hdllink = ut_handle_get_link (e->m_hdl);
-    assert(e->m_hdllink);
-  }
-  else
-  {
-    if (e->m_hdl == UT_HANDLE_OUT_OF_RESOURCES) {
-      DDS_ERROR ("Can not create new entity; too many where created previously\n");
-      e->m_hdl = DDS_ERRNO (DDS_RETCODE_OUT_OF_RESOURCES);
-    } else if (e->m_hdl == UT_HANDLE_NOT_INITALIZED) {
-      DDS_ERROR (DDS_PROJECT_NAME" is not yet initialized. Please create a participant before executing an other method\n");
-      e->m_hdl = DDS_ERRNO (DDS_RETCODE_PRECONDITION_NOT_MET);
-    } else {
-      DDS_ERROR ("An internal error has occurred\n");
-      e->m_hdl = DDS_ERRNO (DDS_RETCODE_ERROR);
-    }
-  }
+  if ((handle = dds_handle_create (&e->m_hdllink)) <= 0)
+    return (dds_entity_t) handle;
 
-  /* An ut_handle_t is directly used as dds_entity_t. */
-  return (dds_entity_t) e->m_hdl;
+  /* An dds_handle_t is directly used as dds_entity_t. */
+  return (dds_entity_t) handle;
 }
 
 dds_return_t dds_delete (dds_entity_t entity)
@@ -164,7 +144,7 @@ dds_return_t dds_delete_impl (dds_entity_t entity, bool keep_if_explicit)
   dds_return_t ret;
   dds_retcode_t rc;
 
-  rc = dds_entity_lock (entity, UT_HANDLE_DONTCARE_KIND, &e);
+  rc = dds_entity_lock (entity, DDS_KIND_DONTCARE, &e);
   if (rc != DDS_RETCODE_OK)
   {
     DDS_TRACE ("dds_delete_impl: error on locking entity %"PRIu32" keep_if_explicit %d\n", entity, (int) keep_if_explicit);
@@ -183,7 +163,7 @@ dds_return_t dds_delete_impl (dds_entity_t entity, bool keep_if_explicit)
     return DDS_RETCODE_OK;
   }
 
-  ut_handle_close (e->m_hdl, e->m_hdllink);
+  dds_handle_close (&e->m_hdllink);
   ddsrt_mutex_lock (&e->m_observers_lock);
   while (e->m_cb_count > 0)
     ddsrt_cond_wait (&e->m_observers_cond, &e->m_observers_lock);
@@ -219,7 +199,7 @@ dds_return_t dds_delete_impl (dds_entity_t entity, bool keep_if_explicit)
   {
     next = next_non_topic_child (child->m_next);
     /* This will probably delete the child entry from the current children's list */
-    ret = dds_delete (child->m_hdl);
+    ret = dds_delete (child->m_hdllink.hdl);
     child = next;
   }
   child = e->m_children;
@@ -227,7 +207,7 @@ dds_return_t dds_delete_impl (dds_entity_t entity, bool keep_if_explicit)
   {
     next = child->m_next;
     assert (dds_entity_kind (child) == DDS_KIND_TOPIC);
-    ret = dds_delete (child->m_hdl);
+    ret = dds_delete (child->m_hdllink.hdl);
     child = next;
   }
   if (ret == DDS_RETCODE_OK && e->m_deriver.close)
@@ -239,11 +219,11 @@ dds_return_t dds_delete_impl (dds_entity_t entity, bool keep_if_explicit)
 
   if (ret == DDS_RETCODE_OK)
   {
-    /* The ut_handle_delete will wait until the last active claim on that handle
+    /* The dds_handle_delete will wait until the last active claim on that handle
      * is released. It is possible that this last release will be done by a thread
      * that was kicked during the close(). */
-    if (ut_handle_delete (e->m_hdl, e->m_hdllink, timeout) != UT_HANDLE_OK)
-      return DDS_ERRNO (DDS_RETCODE_TIMEOUT);
+    if ((ret = dds_handle_delete (&e->m_hdllink, timeout)) != DDS_RETCODE_OK)
+      return ret;
   }
 
   if (ret == DDS_RETCODE_OK)
@@ -301,7 +281,7 @@ dds_entity_t dds_get_parent (dds_entity_t entity)
       hdl = DDS_ENTITY_NIL;
     else
     {
-      hdl = parent->m_hdl;
+      hdl = parent->m_hdllink.hdl;
       dds_set_explicit (hdl);
     }
     dds_entity_unlock (e);
@@ -317,7 +297,7 @@ dds_entity_t dds_get_participant (dds_entity_t entity)
     return DDS_ERRNO (rc);
   else
   {
-    dds_entity_t hdl = e->m_participant->m_hdl;
+    dds_entity_t hdl = e->m_participant->m_hdllink.hdl;
     dds_entity_unlock (e);
     return hdl;
   }
@@ -343,8 +323,8 @@ dds_return_t dds_get_children (dds_entity_t entity, dds_entity_t *children, size
     {
       if ((size_t) n < size)
       {
-        children[n] = iter->m_hdl;
-        dds_set_explicit (iter->m_hdl);
+        children[n] = iter->m_hdllink.hdl;
+        dds_set_explicit (iter->m_hdllink.hdl);
       }
       n++;
       iter = iter->m_next;
@@ -437,65 +417,65 @@ void dds_entity_invoke_listener (const dds_entity *entity, enum dds_status_id wh
   {
     case DDS_INCONSISTENT_TOPIC_STATUS_ID: {
       struct dds_inconsistent_topic_status const * const st = vst;
-      lst->on_inconsistent_topic (entity->m_hdl, *st, lst->on_inconsistent_topic_arg);
+      lst->on_inconsistent_topic (entity->m_hdllink.hdl, *st, lst->on_inconsistent_topic_arg);
       break;
     }
     case DDS_REQUESTED_DEADLINE_MISSED_STATUS_ID: {
       struct dds_requested_deadline_missed_status const * const st = vst;
-      lst->on_requested_deadline_missed (entity->m_hdl, *st, lst->on_requested_deadline_missed_arg);
+      lst->on_requested_deadline_missed (entity->m_hdllink.hdl, *st, lst->on_requested_deadline_missed_arg);
       break;
     }
     case DDS_REQUESTED_INCOMPATIBLE_QOS_STATUS_ID: {
       struct dds_requested_incompatible_qos_status const * const st = vst;
-      lst->on_requested_incompatible_qos (entity->m_hdl, *st, lst->on_requested_incompatible_qos_arg);
+      lst->on_requested_incompatible_qos (entity->m_hdllink.hdl, *st, lst->on_requested_incompatible_qos_arg);
       break;
     }
     case DDS_SAMPLE_LOST_STATUS_ID: {
       struct dds_sample_lost_status const * const st = vst;
-      lst->on_sample_lost (entity->m_hdl, *st, lst->on_sample_lost_arg);
+      lst->on_sample_lost (entity->m_hdllink.hdl, *st, lst->on_sample_lost_arg);
       break;
     }
     case DDS_SAMPLE_REJECTED_STATUS_ID: {
       struct dds_sample_rejected_status const * const st = vst;
-      lst->on_sample_rejected (entity->m_hdl, *st, lst->on_sample_rejected_arg);
+      lst->on_sample_rejected (entity->m_hdllink.hdl, *st, lst->on_sample_rejected_arg);
       break;
     }
     case DDS_LIVELINESS_CHANGED_STATUS_ID: {
       struct dds_liveliness_changed_status const * const st = vst;
-      lst->on_liveliness_changed (entity->m_hdl, *st, lst->on_liveliness_changed_arg);
+      lst->on_liveliness_changed (entity->m_hdllink.hdl, *st, lst->on_liveliness_changed_arg);
       break;
     }
     case DDS_SUBSCRIPTION_MATCHED_STATUS_ID: {
       struct dds_subscription_matched_status const * const st = vst;
-      lst->on_subscription_matched (entity->m_hdl, *st, lst->on_subscription_matched_arg);
+      lst->on_subscription_matched (entity->m_hdllink.hdl, *st, lst->on_subscription_matched_arg);
       break;
     }
     case DDS_OFFERED_DEADLINE_MISSED_STATUS_ID: {
       struct dds_offered_deadline_missed_status const * const st = vst;
-      lst->on_offered_deadline_missed (entity->m_hdl, *st, lst->on_offered_deadline_missed_arg);
+      lst->on_offered_deadline_missed (entity->m_hdllink.hdl, *st, lst->on_offered_deadline_missed_arg);
       break;
     }
     case DDS_LIVELINESS_LOST_STATUS_ID: {
       struct dds_liveliness_lost_status const * const st = vst;
-      lst->on_liveliness_lost (entity->m_hdl, *st, lst->on_liveliness_lost_arg);
+      lst->on_liveliness_lost (entity->m_hdllink.hdl, *st, lst->on_liveliness_lost_arg);
       break;
     }
     case DDS_OFFERED_INCOMPATIBLE_QOS_STATUS_ID: {
       struct dds_offered_incompatible_qos_status const * const st = vst;
-      lst->on_offered_incompatible_qos (entity->m_hdl, *st, lst->on_offered_incompatible_qos_arg);
+      lst->on_offered_incompatible_qos (entity->m_hdllink.hdl, *st, lst->on_offered_incompatible_qos_arg);
       break;
     }
     case DDS_PUBLICATION_MATCHED_STATUS_ID: {
       struct dds_publication_matched_status const * const st = vst;
-      lst->on_publication_matched (entity->m_hdl, *st, lst->on_publication_matched_arg);
+      lst->on_publication_matched (entity->m_hdllink.hdl, *st, lst->on_publication_matched_arg);
       break;
     }
     case DDS_DATA_AVAILABLE_STATUS_ID: {
-      lst->on_data_available (entity->m_hdl, lst->on_data_available_arg);
+      lst->on_data_available (entity->m_hdllink.hdl, lst->on_data_available_arg);
       break;
     }
     case DDS_DATA_ON_READERS_STATUS_ID: {
-      lst->on_data_on_readers (entity->m_hdl, lst->on_data_on_readers_arg);
+      lst->on_data_on_readers (entity->m_hdllink.hdl, lst->on_data_on_readers_arg);
       break;
     }
   }
@@ -768,45 +748,36 @@ dds_return_t dds_get_instance_handle (dds_entity_t entity, dds_instance_handle_t
   return ret;
 }
 
-
-dds_retcode_t dds_valid_hdl (dds_entity_t hdl, dds_entity_kind_t kind)
+dds_retcode_t dds_entity_claim (dds_entity_t hdl, dds_entity **eptr)
 {
-  ut_handle_t utr;
-  if ((utr = ut_handle_status (hdl, NULL, (int32_t) kind)) == UT_HANDLE_OK)
-    return DDS_RETCODE_OK;
-  else if (hdl < 0)
-    return DDS_RETCODE_BAD_PARAMETER;
+  dds_retcode_t hres;
+  struct dds_handle_link *hdllink;
+  if ((hres = dds_handle_claim (hdl, &hdllink)) != DDS_RETCODE_OK)
+    return hres;
   else
   {
-    switch (utr)
-    {
-      case UT_HANDLE_OK:
-        assert (0);
-        /* FALLS THROUGH */
-      case UT_HANDLE_UNEQUAL_KIND:
-        return DDS_RETCODE_ILLEGAL_OPERATION;
-      case UT_HANDLE_INVALID:
-        return DDS_RETCODE_BAD_PARAMETER;
-      case UT_HANDLE_DELETED:
-      case UT_HANDLE_CLOSED:
-        return DDS_RETCODE_ALREADY_DELETED;
-      default:
-        return DDS_RETCODE_ERROR;
-    }
+    *eptr = dds_entity_from_handle_link (hdllink);
+    return DDS_RETCODE_OK;
   }
 }
 
 dds_retcode_t dds_entity_lock (dds_entity_t hdl, dds_entity_kind_t kind, dds_entity **eptr)
 {
-  ut_handle_t utr;
-  void *raw;
+  dds_retcode_t hres;
+  dds_entity *e;
 
   /* When the given handle already contains an error, then return that
    * same error to retain the original information. */
-  if ((utr = ut_handle_claim (hdl, NULL, (int32_t) kind, &raw)) == UT_HANDLE_OK)
+  if ((hres = dds_entity_claim (hdl, &e)) != DDS_RETCODE_OK)
+    return hres;
+  else
   {
-    dds_entity *e;
-    *eptr = e = raw;
+    if (dds_entity_kind (e) != kind && kind != DDS_KIND_DONTCARE)
+    {
+      dds_handle_release (&e->m_hdllink);
+      return DDS_RETCODE_ILLEGAL_OPERATION;
+    }
+
     ddsrt_mutex_lock (&e->m_mutex);
     /* FIXME: The handle could have been closed while we were waiting for the mutex -- that should be handled differently!
 
@@ -815,41 +786,20 @@ dds_retcode_t dds_entity_lock (dds_entity_t hdl, dds_entity_kind_t kind, dds_ent
          (2) preventing dds_delete_impl from doing anything once the entity is being deleted.
 
        Without (1), it would be possible to add children while trying to delete them, without (2) you're looking at crashes. */
-    if (ut_handle_is_closed (hdl, e->m_hdllink))
+    if (dds_handle_is_closed (&e->m_hdllink))
     {
       dds_entity_unlock (e);
-      return DDS_RETCODE_ALREADY_DELETED;
+      return DDS_RETCODE_BAD_PARAMETER;
     }
+    *eptr = e;
     return DDS_RETCODE_OK;
   }
-  else if (hdl < 0)
-  {
-    return DDS_RETCODE_BAD_PARAMETER;
-  }
-  else
-  {
-    switch (utr)
-    {
-      case UT_HANDLE_OK:
-        assert (0);
-        /* FALLS THROUGH */
-      case UT_HANDLE_UNEQUAL_KIND:
-        return DDS_RETCODE_ILLEGAL_OPERATION;
-      case UT_HANDLE_INVALID:
-        return DDS_RETCODE_BAD_PARAMETER;
-      case UT_HANDLE_DELETED:
-      case UT_HANDLE_CLOSED:
-        return DDS_RETCODE_ALREADY_DELETED;
-      default:
-        return DDS_RETCODE_ERROR;
-    }
-  }
 }
 
 void dds_entity_unlock (dds_entity *e)
 {
   ddsrt_mutex_unlock (&e->m_mutex);
-  ut_handle_release (e->m_hdl, e->m_hdllink);
+  dds_handle_release (&e->m_hdllink);
 }
 
 dds_return_t dds_triggered (dds_entity_t entity)
@@ -965,7 +915,7 @@ static void dds_entity_observers_delete (dds_entity *observed)
 static void dds_entity_observers_signal (dds_entity *observed, uint32_t status)
 {
   for (dds_entity_observer *idx = observed->m_observers; idx; idx = idx->m_next)
-    idx->m_cb (idx->m_observer, observed->m_hdl, status);
+    idx->m_cb (idx->m_observer, observed->m_hdllink.hdl, status);
 }
 
 void dds_entity_status_signal (dds_entity *e)
@@ -996,19 +946,19 @@ dds_entity_t dds_get_topic (dds_entity_t entity)
   {
     case DDS_KIND_READER: {
       dds_reader *rd = (dds_reader *) e;
-      hdl = rd->m_topic->m_entity.m_hdl;
+      hdl = rd->m_topic->m_entity.m_hdllink.hdl;
       break;
     }
     case DDS_KIND_WRITER: {
       dds_writer *wr = (dds_writer *) e;
-      hdl = wr->m_topic->m_entity.m_hdl;
+      hdl = wr->m_topic->m_entity.m_hdllink.hdl;
       break;
     }
     case DDS_KIND_COND_READ:
     case DDS_KIND_COND_QUERY: {
       assert (dds_entity_kind (e->m_parent) == DDS_KIND_READER);
       dds_reader *rd = (dds_reader *) e->m_parent;
-      hdl = rd->m_topic->m_entity.m_hdl;
+      hdl = rd->m_topic->m_entity.m_hdllink.hdl;
       break;
     }
     default: {
@@ -1020,21 +970,32 @@ dds_entity_t dds_get_topic (dds_entity_t entity)
   return hdl;
 }
 
-const char *dds__entity_kind_str (dds_entity_t e)
+dds_return_t dds_generic_unimplemented_operation_manykinds (dds_entity_t handle, size_t nkinds, const dds_entity_kind_t *kinds)
 {
-  if (e <= 0)
-    return "(ERROR)";
-  switch (e & DDS_ENTITY_KIND_MASK)
+  dds_entity *e;
+  dds_retcode_t ret;
+  if ((ret = dds_entity_claim (handle, &e)) != DDS_RETCODE_OK)
+    return DDS_ERRNO (ret);
+  else
   {
-    case DDS_KIND_TOPIC:        return "Topic";
-    case DDS_KIND_PARTICIPANT:  return "Participant";
-    case DDS_KIND_READER:       return "Reader";
-    case DDS_KIND_WRITER:       return "Writer";
-    case DDS_KIND_SUBSCRIBER:   return "Subscriber";
-    case DDS_KIND_PUBLISHER:    return "Publisher";
-    case DDS_KIND_COND_READ:    return "ReadCondition";
-    case DDS_KIND_COND_QUERY:   return "QueryCondition";
-    case DDS_KIND_WAITSET:      return "WaitSet";
-    default:                    return "(INVALID_ENTITY)";
+    const dds_entity_kind_t actual = dds_entity_kind (e);
+    ret = DDS_RETCODE_ILLEGAL_OPERATION;
+    for (size_t i = 0; i < nkinds; i++)
+    {
+      if (kinds[i] == actual)
+      {
+        /* If the handle happens to be for an entity of the right kind, return unsupported */
+        ret = DDS_RETCODE_UNSUPPORTED;
+        break;
+      }
+    }
+    dds_handle_release (&e->m_hdllink);
+    return DDS_ERRNO (ret);
   }
 }
+
+dds_return_t dds_generic_unimplemented_operation (dds_entity_t handle, dds_entity_kind_t kind)
+{
+  return dds_generic_unimplemented_operation_manykinds (handle, 1, &kind);
+}
+
diff --git a/src/core/ddsc/src/dds_guardcond.c b/src/core/ddsc/src/dds_guardcond.c
index c1e289a..c4feee0 100644
--- a/src/core/ddsc/src/dds_guardcond.c
+++ b/src/core/ddsc/src/dds_guardcond.c
@@ -43,7 +43,7 @@ dds_return_t dds_set_guardcondition (dds_entity_t condition, bool triggered)
   dds_retcode_t rc;
 
   if ((rc = dds_guardcond_lock (condition, &gcond)) != DDS_RETCODE_OK)
-    return DDS_ERRNO (dds_valid_hdl (condition, DDS_KIND_COND_GUARD));
+    return DDS_ERRNO (DDS_RETCODE_BAD_PARAMETER);
   else
   {
     ddsrt_mutex_lock (&gcond->m_entity.m_observers_lock);
@@ -67,7 +67,7 @@ dds_return_t dds_read_guardcondition (dds_entity_t condition, bool *triggered)
 
   *triggered = false;
   if ((rc = dds_guardcond_lock (condition, &gcond)) != DDS_RETCODE_OK)
-    return DDS_ERRNO (dds_valid_hdl (condition, DDS_KIND_COND_GUARD));
+    return DDS_ERRNO (DDS_RETCODE_BAD_PARAMETER);
   else
   {
     ddsrt_mutex_lock (&gcond->m_entity.m_observers_lock);
@@ -88,7 +88,7 @@ dds_return_t dds_take_guardcondition (dds_entity_t condition, bool *triggered)
 
   *triggered = false;
   if ((rc = dds_guardcond_lock (condition, &gcond)) != DDS_RETCODE_OK)
-    return DDS_ERRNO (dds_valid_hdl (condition, DDS_KIND_COND_GUARD));
+    return DDS_ERRNO (DDS_RETCODE_BAD_PARAMETER);
   else
   {
     ddsrt_mutex_lock (&gcond->m_entity.m_observers_lock);
diff --git a/src/core/ddsc/src/dds_handles.c b/src/core/ddsc/src/dds_handles.c
new file mode 100644
index 0000000..5e4acd3
--- /dev/null
+++ b/src/core/ddsc/src/dds_handles.c
@@ -0,0 +1,267 @@
+/*
+ * Copyright(c) 2006 to 2018 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+#include <string.h>
+#include <assert.h>
+#include "dds/ddsrt/time.h"
+#include "dds/ddsrt/sync.h"
+#include "dds/ddsrt/heap.h"
+#include "dds/ddsrt/random.h"
+#include "dds/util/ut_hopscotch.h"
+#include "dds/ddsi/q_thread.h"
+#include "dds__handles.h"
+#include "dds__types.h"
+#include "dds__err.h"
+
+/* FIXME: this code isn't really correct when USE_CHH is set:
+   - the DDS entity code doesn't really play by the awake/asleep mechanism
+   - there is no provision in the code for a handle being deleted concurrent to a lookup,
+     that is, deleting handle links should also go through the GC
+   entity framework needs a fair bit of rewriting anyway ... */
+#define USE_CHH 0
+
+#define HDL_FLAG_CLOSED    (0x80000000u)
+#define HDL_COUNT_MASK     (0x00ffffffu)
+
+/* Maximum number of handles is INT32_MAX - 1, but as the allocator relies on a
+   random generator for finding a free one, the time spent in the dds_handle_create
+   increases with an increasing number of handles.  16M handles seems likely to be
+   enough and makes the likely cost of allocating a new handle somewhat more
+   reasonable */
+#define MAX_HANDLES (INT32_MAX / 128)
+
+struct dds_handle_server {
+#if USE_CHH
+  struct ut_chh *ht;
+#else
+  struct ut_hh *ht;
+#endif
+  size_t count;
+  ddsrt_mutex_t lock;
+  ddsrt_cond_t cond;
+};
+
+static struct dds_handle_server handles;
+
+static uint32_t handle_hash (const void *va)
+{
+  /* handles are already pseudo-random numbers, so not much point in hashing it again */
+  const struct dds_handle_link *a = va;
+  return (uint32_t) a->hdl;
+}
+
+static int handle_equal (const void *va, const void *vb)
+{
+  const struct dds_handle_link *a = va;
+  const struct dds_handle_link *b = vb;
+  return a->hdl == b->hdl;
+}
+
+dds_return_t dds_handle_server_init (void (*free_via_gc) (void *x))
+{
+#if USE_CHH
+  handles.ht = ut_chhNew (128, handle_hash, handle_equal, free_via_gc);
+#else
+  handles.ht = ut_hhNew (128, handle_hash, handle_equal);
+  (void) free_via_gc;
+#endif
+  handles.count = 0;
+  ddsrt_mutex_init (&handles.lock);
+  ddsrt_cond_init (&handles.cond);
+  return DDS_RETCODE_OK;
+}
+
+void dds_handle_server_fini (void)
+{
+#if USE_CHH
+#ifndef NDEBUG
+  struct ut_chhIter it;
+  assert (ut_chhIterFirst (handles.ht, &it) == NULL);
+#endif
+  ut_chhFree (handles.ht);
+#else /* USE_CHH */
+#ifndef NDEBUG
+  struct ut_hhIter it;
+  assert (ut_hhIterFirst (handles.ht, &it) == NULL);
+#endif
+  ut_hhFree (handles.ht);
+#endif /* USE_CHH */
+  ddsrt_cond_destroy (&handles.cond);
+  ddsrt_mutex_destroy (&handles.lock);
+  handles.ht = NULL;
+}
+
+#if USE_CHH
+static bool hhadd (struct ut_chh *ht, void *elem) { return ut_chhAdd (ht, elem); }
+#else
+static bool hhadd (struct ut_hh *ht, void *elem) { return ut_hhAdd (ht, elem); }
+#endif
+static dds_handle_t dds_handle_create_int (struct dds_handle_link *link)
+{
+  ddsrt_atomic_st32 (&link->cnt_flags, 0);
+  do {
+    do {
+      link->hdl = (int32_t) (ddsrt_random () & INT32_MAX);
+    } while (link->hdl == 0 || link->hdl >= DDS_MIN_PSEUDO_HANDLE);
+  } while (!hhadd (handles.ht, link));
+  return link->hdl;
+}
+
+dds_handle_t dds_handle_create (struct dds_handle_link *link)
+{
+  dds_handle_t ret;
+#if USE_CHH
+  struct thread_state1 * const self = lookup_thread_state ();
+  const bool asleep = vtime_asleep_p (self->vtime);
+  if (asleep)
+    thread_state_awake (self);
+#endif
+  ddsrt_mutex_lock (&handles.lock);
+  if (handles.count == MAX_HANDLES)
+  {
+    ddsrt_mutex_unlock (&handles.lock);
+    ret = DDS_ERRNO (DDS_RETCODE_OUT_OF_RESOURCES);
+  }
+  else
+  {
+    handles.count++;
+#if USE_CHH
+    ddsrt_mutex_unlock (&handles.lock);
+    ret = dds_handle_create_int (link);
+#else
+    ret = dds_handle_create_int (link);
+    ddsrt_mutex_unlock (&handles.lock);
+#endif
+    assert (ret > 0);
+  }
+#if USE_CHH
+  if (asleep)
+    thread_state_asleep (self);
+#endif
+  return ret;
+}
+
+void dds_handle_close (struct dds_handle_link *link)
+{
+  ddsrt_atomic_or32 (&link->cnt_flags, HDL_FLAG_CLOSED);
+}
+
+int32_t dds_handle_delete (struct dds_handle_link *link, dds_duration_t timeout)
+{
+  assert (ddsrt_atomic_ld32 (&link->cnt_flags) & HDL_FLAG_CLOSED);
+
+  ddsrt_mutex_lock (&handles.lock);
+  if ((ddsrt_atomic_ld32 (&link->cnt_flags) & HDL_COUNT_MASK) != 0)
+  {
+    /* FIXME: */
+    const dds_time_t abstimeout = dds_time () + timeout;
+    while ((ddsrt_atomic_ld32 (&link->cnt_flags) & HDL_COUNT_MASK) != 0)
+    {
+      if (!ddsrt_cond_waituntil (&handles.cond, &handles.lock, abstimeout))
+      {
+        ddsrt_mutex_unlock (&handles.lock);
+        fprintf (stderr, "** timeout in handle_delete **\n");
+        return DDS_RETCODE_TIMEOUT;
+      }
+    }
+  }
+#if USE_CHH
+  struct thread_state1 * const self = lookup_thread_state ();
+  const bool asleep = vtime_asleep_p (self->vtime);
+  if (asleep)
+    thread_state_awake (self);
+  int x = ut_chhRemove (handles.ht, link);
+  if (asleep)
+    thread_state_asleep (self);
+#else
+  int x = ut_hhRemove (handles.ht, link);
+#endif
+  assert(x);
+  (void)x;
+  assert (handles.count > 0);
+  handles.count--;
+  ddsrt_mutex_unlock (&handles.lock);
+  return DDS_RETCODE_OK;
+}
+
+int32_t dds_handle_claim (dds_handle_t hdl, struct dds_handle_link **link)
+{
+  struct dds_handle_link dummy = { .hdl = hdl };
+  int32_t rc;
+  /* it makes sense to check here for initialization: the first thing any operation
+     (other than create_participant) does is to call dds_handle_claim on the supplied
+     entity, so checking here whether the library has been initialised helps avoid
+     crashes if someone forgets to create a participant (or allows a program to
+     continue after failing to create one).
+
+     One could check that the handle is > 0, but that would catch fewer errors
+     without any advantages. */
+  if (handles.ht == NULL)
+    return DDS_RETCODE_PRECONDITION_NOT_MET;
+
+#if USE_CHH
+  struct thread_state1 * const self = lookup_thread_state ();
+  const bool asleep = vtime_asleep_p (self->vtime);
+  if (asleep)
+    thread_state_awake (self);
+  *link = ut_chhLookup (handles.ht, &dummy);
+#else
+  ddsrt_mutex_lock (&handles.lock);
+  *link = ut_hhLookup (handles.ht, &dummy);
+#endif
+  if (*link == NULL)
+    rc = DDS_RETCODE_BAD_PARAMETER;
+  else
+  {
+    uint32_t cnt_flags;
+    /* Assume success; bail out if the object turns out to be in the process of
+       being deleted */
+    rc = DDS_RETCODE_OK;
+    do {
+      cnt_flags = ddsrt_atomic_ld32 (&(*link)->cnt_flags);
+      if (cnt_flags & HDL_FLAG_CLOSED)
+      {
+        rc = DDS_RETCODE_BAD_PARAMETER;
+        break;
+      }
+    } while (!ddsrt_atomic_cas32 (&(*link)->cnt_flags, cnt_flags, cnt_flags + 1));
+  }
+
+#if USE_CHH
+  if (asleep)
+    thread_state_asleep (self);
+#else
+  ddsrt_mutex_unlock (&handles.lock);
+#endif
+  return rc;
+}
+
+void dds_handle_claim_inc (struct dds_handle_link *link)
+{
+  uint32_t x = ddsrt_atomic_inc32_nv (&link->cnt_flags);
+  assert (!(x & HDL_FLAG_CLOSED));
+  (void) x;
+}
+
+void dds_handle_release (struct dds_handle_link *link)
+{
+  if (ddsrt_atomic_dec32_ov (&link->cnt_flags) == (HDL_FLAG_CLOSED | 1))
+  {
+    ddsrt_mutex_lock (&handles.lock);
+    ddsrt_cond_broadcast (&handles.cond);
+    ddsrt_mutex_unlock (&handles.lock);
+  }
+}
+
+bool dds_handle_is_closed (struct dds_handle_link *link)
+{
+  return (ddsrt_atomic_ld32 (&link->cnt_flags) & HDL_FLAG_CLOSED) != 0;
+}
diff --git a/src/core/ddsc/src/dds_init.c b/src/core/ddsc/src/dds_init.c
index 3aa8751..31a1c0a 100644
--- a/src/core/ddsc/src/dds_init.c
+++ b/src/core/ddsc/src/dds_init.c
@@ -16,6 +16,7 @@
 #include "dds/ddsrt/cdtors.h"
 #include "dds/ddsrt/environ.h"
 #include "dds/ddsrt/process.h"
+#include "dds/ddsrt/heap.h"
 #include "dds__init.h"
 #include "dds__rhc.h"
 #include "dds__domain.h"
@@ -28,6 +29,7 @@
 #include "dds/ddsi/q_servicelease.h"
 #include "dds/ddsi/q_entity.h"
 #include "dds/ddsi/q_config.h"
+#include "dds/ddsi/q_gc.h"
 #include "dds/version.h"
 
 #define DOMAIN_ID_MIN 0
@@ -38,6 +40,20 @@ struct q_globals gv;
 dds_globals dds_global = { .m_default_domain = DDS_DOMAIN_DEFAULT };
 static struct cfgst * dds_cfgst = NULL;
 
+static void free_via_gc_cb (struct gcreq *gcreq)
+{
+  void *bs = gcreq->arg;
+  gcreq_free (gcreq);
+  ddsrt_free (bs);
+}
+
+static void free_via_gc (void *bs)
+{
+  struct gcreq *gcreq = gcreq_new (gv.gcreq_queue, free_via_gc_cb);
+  gcreq->arg = bs;
+  gcreq_enqueue (gcreq);
+}
+
 dds_return_t
 dds_init(dds_domainid_t domain)
 {
@@ -60,13 +76,6 @@ dds_init(dds_domainid_t domain)
     goto skip;
   }
 
-  if (ut_handleserver_init() != UT_HANDLE_OK)
-  {
-    DDS_ERROR("Failed to initialize internal handle server\n");
-    ret = DDS_ERRNO(DDS_RETCODE_ERROR);
-    goto fail_handleserver;
-  }
-
   gv.tstart = now ();
   gv.exception = false;
   ddsrt_mutex_init (&dds_global.m_mutex);
@@ -137,6 +146,13 @@ dds_init(dds_domainid_t domain)
     goto fail_rtps_init;
   }
 
+  if (dds_handle_server_init (free_via_gc) != DDS_RETCODE_OK)
+  {
+    DDS_ERROR("Failed to initialize internal handle server\n");
+    ret = DDS_ERRNO(DDS_RETCODE_ERROR);
+    goto fail_handleserver;
+  }
+
   dds__builtin_init ();
 
   if (rtps_start () < 0)
@@ -178,6 +194,8 @@ skip:
 fail_servicelease_start:
   if (gv.servicelease)
     nn_servicelease_stop_renewing (gv.servicelease);
+  dds_handle_server_fini();
+fail_handleserver:
   rtps_stop ();
 fail_rtps_start:
   dds__builtin_fini ();
@@ -198,8 +216,6 @@ fail_config_domainid:
   dds_cfgst = NULL;
 fail_config:
   ddsrt_mutex_destroy (&dds_global.m_mutex);
-  ut_handleserver_fini();
-fail_handleserver:
   dds_global.m_init_count--;
   ddsrt_mutex_unlock(init_mutex);
   ddsrt_fini();
@@ -217,6 +233,7 @@ extern void dds_fini (void)
   {
     if (gv.servicelease)
       nn_servicelease_stop_renewing (gv.servicelease);
+    dds_handle_server_fini();
     rtps_stop ();
     dds__builtin_fini ();
     rtps_fini ();
@@ -229,7 +246,6 @@ extern void dds_fini (void)
     config_fini (dds_cfgst);
     dds_cfgst = NULL;
     ddsrt_mutex_destroy (&dds_global.m_mutex);
-    ut_handleserver_fini();
     dds_global.m_default_domain = DDS_DOMAIN_DEFAULT;
   }
   ddsrt_mutex_unlock(init_mutex);
diff --git a/src/core/ddsc/src/dds_participant.c b/src/core/ddsc/src/dds_participant.c
index 94d42a0..35521c0 100644
--- a/src/core/ddsc/src/dds_participant.c
+++ b/src/core/ddsc/src/dds_participant.c
@@ -55,7 +55,7 @@ dds_participant_delete(
 
     assert(e);
     assert(thr);
-    assert(dds_entity_kind_from_handle(e->m_hdl) == DDS_KIND_PARTICIPANT);
+    assert(dds_entity_kind(e) == DDS_KIND_PARTICIPANT);
 
     if (asleep) {
       thread_state_awake(thr);
@@ -278,9 +278,9 @@ dds_lookup_participant(
         ddsrt_mutex_lock (&dds_global.m_mutex);
         iter = dds_pp_head;
         while (iter) {
-            if(iter->m_domainid == domain_id) {
-                if((size_t)ret < size) {
-                    participants[ret] = iter->m_hdl;
+            if (iter->m_domainid == domain_id) {
+                if ((size_t)ret < size) {
+                    participants[ret] = iter->m_hdllink.hdl;
                 }
                 ret++;
             }
diff --git a/src/core/ddsc/src/dds_publisher.c b/src/core/ddsc/src/dds_publisher.c
index 689ba11..47365c7 100644
--- a/src/core/ddsc/src/dds_publisher.c
+++ b/src/core/ddsc/src/dds_publisher.c
@@ -13,11 +13,14 @@
 #include <string.h>
 #include "dds/ddsrt/misc.h"
 #include "dds__listener.h"
+#include "dds__publisher.h"
 #include "dds__qos.h"
 #include "dds__err.h"
 #include "dds/ddsi/q_entity.h"
 #include "dds/version.h"
 
+DECL_ENTITY_LOCK_UNLOCK(extern inline, dds_publisher)
+
 #define DDS_PUBLISHER_STATUS_MASK   0u
 
 static dds_return_t
@@ -145,36 +148,14 @@ DDS_EXPORT dds_return_t
 dds_suspend(
     dds_entity_t publisher)
 {
-    dds_return_t ret;
-
-    if(dds_entity_kind_from_handle(publisher) != DDS_KIND_PUBLISHER) {
-        DDS_ERROR("Provided entity is not a publisher kind\n");
-        ret = DDS_ERRNO(DDS_RETCODE_BAD_PARAMETER);
-        goto err;
-    }
-    /* TODO: CHAM-123 Currently unsupported. */
-    DDS_ERROR("Suspend publication operation does not being supported yet\n");
-    ret = DDS_ERRNO(DDS_RETCODE_UNSUPPORTED);
-err:
-    return ret;
+  return dds_generic_unimplemented_operation (publisher, DDS_KIND_PUBLISHER);
 }
 
 dds_return_t
 dds_resume(
     dds_entity_t publisher)
 {
-    dds_return_t ret = DDS_RETCODE_OK;
-
-    if(dds_entity_kind_from_handle(publisher) != DDS_KIND_PUBLISHER) {
-        DDS_ERROR("Provided entity is not a publisher kind\n");
-        ret = DDS_ERRNO(DDS_RETCODE_BAD_PARAMETER);
-        goto err;
-    }
-    /* TODO: CHAM-123 Currently unsupported. */
-    DDS_ERROR("Suspend publication operation does not being supported yet\n");
-    ret = DDS_ERRNO(DDS_RETCODE_UNSUPPORTED);
-err:
-    return ret;
+  return dds_generic_unimplemented_operation (publisher, DDS_KIND_PUBLISHER);
 }
 
 dds_return_t
@@ -182,27 +163,10 @@ dds_wait_for_acks(
     dds_entity_t publisher_or_writer,
     dds_duration_t timeout)
 {
-    dds_return_t ret;
-
-    /* TODO: CHAM-125 Currently unsupported. */
-    DDSRT_UNUSED_ARG(timeout);
-
-    switch(dds_entity_kind_from_handle(publisher_or_writer)) {
-        case DDS_KIND_WRITER:
-            DDS_ERROR("Wait for acknowledgments on a writer is not being supported yet\n");
-            ret = DDS_ERRNO(DDS_RETCODE_UNSUPPORTED);
-            break;
-        case DDS_KIND_PUBLISHER:
-            DDS_ERROR("Wait for acknowledgments on a publisher is not being supported yet\n");
-            ret = DDS_ERRNO(DDS_RETCODE_UNSUPPORTED);
-            break;
-        default:
-            DDS_ERROR("Provided entity is not a publisher nor a writer\n");
-            ret = DDS_ERRNO(DDS_RETCODE_BAD_PARAMETER);
-            break;
-    }
-
-    return ret;
+  if (timeout < 0)
+    return DDS_ERRNO (DDS_RETCODE_BAD_PARAMETER);
+  static const dds_entity_kind_t kinds[] = { DDS_KIND_WRITER, DDS_KIND_PUBLISHER };
+  return dds_generic_unimplemented_operation_manykinds (publisher_or_writer, sizeof (kinds) / sizeof (kinds[0]), kinds);
 }
 
 dds_return_t
diff --git a/src/core/ddsc/src/dds_querycond.c b/src/core/ddsc/src/dds_querycond.c
index 490fc3c..0a5e50d 100644
--- a/src/core/ddsc/src/dds_querycond.c
+++ b/src/core/ddsc/src/dds_querycond.c
@@ -39,9 +39,9 @@ dds_create_querycondition(
         const bool success = (cond->m_entity.m_deriver.delete != 0);
         dds_reader_unlock(r);
         if (success) {
-            hdl = cond->m_entity.m_hdl;
+            hdl = cond->m_entity.m_hdllink.hdl;
         } else {
-            dds_delete (cond->m_entity.m_hdl);
+            dds_delete (cond->m_entity.m_hdllink.hdl);
             hdl = DDS_ERRNO(DDS_RETCODE_OUT_OF_RESOURCES);
         }
     } else {
diff --git a/src/core/ddsc/src/dds_read.c b/src/core/ddsc/src/dds_read.c
index 9353829..af239f6 100644
--- a/src/core/ddsc/src/dds_read.c
+++ b/src/core/ddsc/src/dds_read.c
@@ -47,7 +47,7 @@ static dds_retcode_t dds_read_lock (dds_entity_t hdl, dds_reader **reader, dds_r
     DDS_ERROR ("Given entity is a reader nor a condition\n");
     return DDS_RETCODE_ILLEGAL_OPERATION;
   }
-  else if ((rc = dds_entity_lock (entity->m_parent->m_hdl, DDS_KIND_READER, &parent_entity)) != DDS_RETCODE_OK)
+  else if ((rc = dds_entity_lock (entity->m_parent->m_hdllink.hdl, DDS_KIND_READER, &parent_entity)) != DDS_RETCODE_OK)
   {
     dds_entity_unlock (entity);
     DDS_ERROR ("Failed to lock condition's reader\n");
@@ -168,7 +168,7 @@ dds_read_impl(
     /* read/take resets data available status */
     dds_entity_status_reset(&rd->m_entity, DDS_DATA_AVAILABLE_STATUS);
     /* reset DATA_ON_READERS status on subscriber after successful read/take */
-    if (dds_entity_kind_from_handle(rd->m_entity.m_parent->m_hdl) == DDS_KIND_SUBSCRIBER) {
+    if (dds_entity_kind(rd->m_entity.m_parent) == DDS_KIND_SUBSCRIBER) {
         dds_entity_status_reset(rd->m_entity.m_parent, DDS_DATA_ON_READERS_STATUS);
     }
     dds_read_unlock(rd, cond);
@@ -225,7 +225,7 @@ dds_readcdr_impl(
 
       /* reset DATA_ON_READERS status on subscriber after successful read/take */
 
-      if (dds_entity_kind_from_handle(rd->m_entity.m_parent->m_hdl) == DDS_KIND_SUBSCRIBER)
+      if (dds_entity_kind(rd->m_entity.m_parent) == DDS_KIND_SUBSCRIBER)
       {
         dds_entity_status_reset(rd->m_entity.m_parent, DDS_DATA_ON_READERS_STATUS);
       }
diff --git a/src/core/ddsc/src/dds_readcond.c b/src/core/ddsc/src/dds_readcond.c
index 3d169de..322af8e 100644
--- a/src/core/ddsc/src/dds_readcond.c
+++ b/src/core/ddsc/src/dds_readcond.c
@@ -36,7 +36,7 @@ dds_create_readcond(
 {
     dds_readcond * cond = dds_alloc(sizeof(*cond));
     assert((kind == DDS_KIND_COND_READ && filter == 0) || (kind == DDS_KIND_COND_QUERY && filter != 0));
-    cond->m_entity.m_hdl = dds_entity_init(&cond->m_entity, (dds_entity*)rd, kind, NULL, NULL, 0);
+    (void) dds_entity_init(&cond->m_entity, (dds_entity*)rd, kind, NULL, NULL, 0);
     cond->m_entity.m_deriver.delete = dds_readcond_delete;
     cond->m_rhc = rd->m_rd->rhc;
     cond->m_sample_states = mask & DDS_ANY_SAMPLE_STATE;
@@ -70,7 +70,7 @@ dds_create_readcondition(
         dds_readcond *cond = dds_create_readcond(rd, DDS_KIND_COND_READ, mask, 0);
         assert(cond);
         assert(cond->m_entity.m_deriver.delete);
-        hdl = cond->m_entity.m_hdl;
+        hdl = cond->m_entity.m_hdllink.hdl;
         dds_reader_unlock(rd);
     } else {
         DDS_ERROR("Error occurred on locking reader\n");
@@ -82,20 +82,31 @@ dds_create_readcondition(
 
 dds_entity_t dds_get_datareader (dds_entity_t condition)
 {
-    dds_entity_t hdl;
-
-    if (dds_entity_kind_from_handle(condition) == DDS_KIND_COND_READ) {
-        hdl = dds_get_parent(condition);
-    } else if (dds_entity_kind_from_handle(condition) == DDS_KIND_COND_QUERY) {
-        hdl = dds_get_parent(condition);
-    } else {
-        DDS_ERROR("Argument condition is not valid\n");
-        hdl = DDS_ERRNO(dds_valid_hdl(condition, DDS_KIND_COND_READ));
+  struct dds_entity *e;
+  dds_retcode_t rc;
+  if ((rc = dds_entity_claim (condition, &e)) != DDS_RETCODE_OK)
+    return DDS_ERRNO (rc);
+  else
+  {
+    dds_entity_t rdh;
+    switch (dds_entity_kind (e))
+    {
+      case DDS_KIND_COND_READ:
+      case DDS_KIND_COND_QUERY:
+        assert (dds_entity_kind (e->m_parent) == DDS_KIND_READER);
+        rdh = e->m_parent->m_hdllink.hdl;
+        break;
+      default:
+        rdh = DDS_ERRNO (DDS_RETCODE_ILLEGAL_OPERATION);
+        break;
     }
-
-    return hdl;
+    dds_handle_release (&e->m_hdllink);
+    return rdh;
+  }
 }
 
+
+
 dds_return_t dds_get_mask (dds_entity_t condition, uint32_t *mask)
 {
   dds_entity *entity;
@@ -109,7 +120,7 @@ dds_return_t dds_get_mask (dds_entity_t condition, uint32_t *mask)
   else if (dds_entity_kind (entity) != DDS_KIND_COND_READ && dds_entity_kind (entity) != DDS_KIND_COND_QUERY)
   {
     dds_entity_unlock (entity);
-    return DDS_ERRNO (dds_valid_hdl (condition, DDS_KIND_COND_READ));
+    return DDS_ERRNO (DDS_RETCODE_ILLEGAL_OPERATION);
   }
   else
   {
diff --git a/src/core/ddsc/src/dds_reader.c b/src/core/ddsc/src/dds_reader.c
index 2f37d8a..bd16e39 100644
--- a/src/core/ddsc/src/dds_reader.c
+++ b/src/core/ddsc/src/dds_reader.c
@@ -81,10 +81,10 @@ dds_reader_delete(
     dds_reader *rd = (dds_reader*)e;
     dds_return_t ret;
     assert(e);
-    ret = dds_delete(rd->m_topic->m_entity.m_hdl);
+    ret = dds_delete(rd->m_topic->m_entity.m_hdllink.hdl);
     if(ret == DDS_RETCODE_OK){
-        ret = dds_delete_impl(e->m_parent->m_hdl, true);
-        if(dds_err_nr(ret) == DDS_RETCODE_ALREADY_DELETED){
+        ret = dds_delete_impl(e->m_parent->m_hdllink.hdl, true);
+        if(dds_err_nr(ret) == DDS_RETCODE_BAD_PARAMETER){
             ret = DDS_RETCODE_OK;
         }
     }
@@ -185,7 +185,7 @@ void dds_reader_data_available_cb (struct dds_reader *rd)
     sub->m_cb_count++;
     ddsrt_mutex_unlock (&sub->m_observers_lock);
 
-    lst->on_data_on_readers (sub->m_hdl, lst->on_data_on_readers_arg);
+    lst->on_data_on_readers (sub->m_hdllink.hdl, lst->on_data_on_readers_arg);
 
     ddsrt_mutex_lock (&rd->m_entity.m_observers_lock);
     ddsrt_mutex_lock (&sub->m_observers_lock);
@@ -196,7 +196,7 @@ void dds_reader_data_available_cb (struct dds_reader *rd)
   else if (rd->m_entity.m_listener.on_data_available)
   {
     ddsrt_mutex_unlock (&rd->m_entity.m_observers_lock);
-    lst->on_data_available (rd->m_entity.m_hdl, lst->on_data_available_arg);
+    lst->on_data_available (rd->m_entity.m_hdllink.hdl, lst->on_data_available_arg);
     ddsrt_mutex_lock (&rd->m_entity.m_observers_lock);
   }
   else
@@ -222,7 +222,7 @@ void dds_reader_status_cb (void *ventity, const status_cb_data_t *data)
   {
     /* Release the initial claim that was done during the create. This
      * will indicate that further API deletion is now possible. */
-    ut_handle_release (entity->m_hdl, entity->m_hdllink);
+    dds_handle_release (&entity->m_hdllink);
     return;
   }
 
@@ -361,7 +361,7 @@ dds_create_reader(
 {
     dds_qos_t * rqos;
     dds_retcode_t rc;
-    dds_entity * sub = NULL;
+    dds_subscriber * sub = NULL;
     dds_entity_t subscriber;
     dds_reader * rd;
     struct rhc * rhc;
@@ -371,31 +371,43 @@ dds_create_reader(
     struct thread_state1 * const thr = lookup_thread_state ();
     const bool asleep = !vtime_awake_p (thr->vtime);
     dds_return_t ret = DDS_RETCODE_OK;
+    bool internal_topic;
 
-    if (dds_entity_kind_from_handle(topic) != DDS_KIND_INTERNAL) {
-        /* Try claiming a participant. If that's not working, then it could be a subscriber. */
-        if (dds_entity_kind_from_handle(participant_or_subscriber) == DDS_KIND_PARTICIPANT) {
-            subscriber = dds_create_subscriber(participant_or_subscriber, qos, NULL);
-        } else {
-            subscriber = participant_or_subscriber;
+    switch (topic) {
+        case DDS_BUILTIN_TOPIC_DCPSPARTICIPANT:
+        case DDS_BUILTIN_TOPIC_DCPSTOPIC:
+        case DDS_BUILTIN_TOPIC_DCPSPUBLICATION:
+        case DDS_BUILTIN_TOPIC_DCPSSUBSCRIPTION:
+            internal_topic = true;
+            subscriber = dds__get_builtin_subscriber(participant_or_subscriber);
+            t = dds__get_builtin_topic (subscriber, topic);
+            break;
+
+        default: {
+            dds_entity *p_or_s;
+            if ((rc = dds_entity_claim (participant_or_subscriber, &p_or_s)) != DDS_RETCODE_OK) {
+                return DDS_ERRNO (rc);
+            }
+            if (dds_entity_kind (p_or_s) == DDS_KIND_PARTICIPANT) {
+                subscriber = dds_create_subscriber(participant_or_subscriber, qos, NULL);
+            } else {
+                subscriber = participant_or_subscriber;
+            }
+            dds_handle_release (&p_or_s->m_hdllink);
+            internal_topic = false;
+            t = topic;
+            break;
         }
-        t = topic;
-    } else {
-        subscriber = dds__get_builtin_subscriber(participant_or_subscriber);
-        t = dds__get_builtin_topic(subscriber, topic);
     }
 
-    rc = dds_entity_lock(subscriber, DDS_KIND_SUBSCRIBER, &sub);
-    if (rc != DDS_RETCODE_OK) {
-        DDS_ERROR("Error occurred on locking subscriber\n");
-        reader = DDS_ERRNO(rc);
+    if ((rc = dds_subscriber_lock (subscriber, &sub)) != DDS_RETCODE_OK) {
+        reader = DDS_ERRNO (rc);
         goto err_sub_lock;
     }
 
-    if ((subscriber != participant_or_subscriber) &&
-        (dds_entity_kind_from_handle(topic) != DDS_KIND_INTERNAL)) {
+    if ((subscriber != participant_or_subscriber) && !internal_topic) {
         /* Delete implicit subscriber if reader creation fails */
-        sub->m_flags |= DDS_ENTITY_IMPLICIT;
+        sub->m_entity.m_flags |= DDS_ENTITY_IMPLICIT;
     }
 
     rc = dds_topic_lock(t, &tp);
@@ -405,7 +417,7 @@ dds_create_reader(
         goto err_tp_lock;
     }
     assert (tp->m_stopic);
-    assert (sub->m_domain == tp->m_entity.m_domain);
+    assert (sub->m_entity.m_domain == tp->m_entity.m_domain);
 
     /* Merge qos from topic and subscriber */
     rqos = dds_create_qos ();
@@ -415,8 +427,8 @@ dds_create_reader(
         (void)dds_copy_qos(rqos, qos);
     }
 
-    if(sub->m_qos){
-        dds_merge_qos (rqos, sub->m_qos);
+    if(sub->m_entity.m_qos){
+        dds_merge_qos (rqos, sub->m_entity.m_qos);
     }
 
     if (tp->m_entity.m_qos) {
@@ -435,7 +447,7 @@ dds_create_reader(
     }
 
     /* Additional checks required for built-in topics */
-    if (dds_entity_kind_from_handle(topic) == DDS_KIND_INTERNAL && !dds__validate_builtin_reader_qos(topic, qos)) {
+    if (internal_topic && !dds__validate_builtin_reader_qos(topic, qos)) {
         dds_delete_qos(rqos);
         DDS_ERROR("Invalid QoS specified for built-in topic reader");
         reader = DDS_ERRNO(DDS_RETCODE_INCONSISTENT_POLICY);
@@ -444,7 +456,7 @@ dds_create_reader(
 
     /* Create reader and associated read cache */
     rd = dds_alloc (sizeof (*rd));
-    reader = dds_entity_init (&rd->m_entity, sub, DDS_KIND_READER, rqos, listener, DDS_READER_STATUS_MASK);
+    reader = dds_entity_init (&rd->m_entity, &sub->m_entity, DDS_KIND_READER, rqos, listener, DDS_READER_STATUS_MASK);
     rd->m_sample_rejected_status.last_reason = DDS_NOT_REJECTED;
     rd->m_topic = tp;
     rhc = dds_rhc_new (rd, tp->m_stopic);
@@ -457,19 +469,17 @@ dds_create_reader(
 
     /* Extra claim of this reader to make sure that the delete waits until DDSI
      * has deleted its reader as well. This can be known through the callback. */
-    if (ut_handle_claim(rd->m_entity.m_hdl, rd->m_entity.m_hdllink, DDS_KIND_READER, NULL) != UT_HANDLE_OK) {
-        assert(0);
-    }
+    dds_handle_claim_inc (&rd->m_entity.m_hdllink);
 
     ddsrt_mutex_unlock(&tp->m_entity.m_mutex);
-    ddsrt_mutex_unlock(&sub->m_mutex);
+    ddsrt_mutex_unlock(&sub->m_entity.m_mutex);
 
     if (asleep) {
         thread_state_awake (thr);
     }
-    rd->m_rd = new_reader(&rd->m_entity.m_guid, NULL, &sub->m_participant->m_guid, tp->m_stopic,
+    rd->m_rd = new_reader(&rd->m_entity.m_guid, NULL, &sub->m_entity.m_participant->m_guid, tp->m_stopic,
                           rqos, rhc, dds_reader_status_cb, rd);
-    ddsrt_mutex_lock(&sub->m_mutex);
+    ddsrt_mutex_lock(&sub->m_entity.m_mutex);
     ddsrt_mutex_lock(&tp->m_entity.m_mutex);
     assert (rd->m_rd);
     if (asleep) {
@@ -481,9 +491,9 @@ dds_create_reader(
         (dds_global.m_dur_reader) (rd, rhc);
     }
     dds_topic_unlock(tp);
-    dds_entity_unlock(sub);
+    dds_subscriber_unlock(sub);
 
-    if (dds_entity_kind_from_handle(topic) == DDS_KIND_INTERNAL) {
+    if (internal_topic) {
         /* If topic is builtin, then the topic entity is local and should
          * be deleted because the application won't. */
         dds_delete(t);
@@ -494,12 +504,12 @@ dds_create_reader(
 err_bad_qos:
     dds_topic_unlock(tp);
 err_tp_lock:
-    dds_entity_unlock(sub);
-    if((sub->m_flags & DDS_ENTITY_IMPLICIT) != 0){
+    dds_subscriber_unlock(sub);
+    if((sub->m_entity.m_flags & DDS_ENTITY_IMPLICIT) != 0){
         (void)dds_delete(subscriber);
     }
 err_sub_lock:
-    if (dds_entity_kind_from_handle(topic) == DDS_KIND_INTERNAL) {
+    if (internal_topic) {
         /* If topic is builtin, then the topic entity is local and should
          * be deleted because the application won't. */
         dds_delete(t);
@@ -509,47 +519,53 @@ err_sub_lock:
 
 void dds_reader_ddsi2direct (dds_entity_t entity, ddsi2direct_directread_cb_t cb, void *cbarg)
 {
-  dds_reader *dds_rd;
+  dds_entity *dds_entity;
+  if (dds_entity_claim(entity, &dds_entity) != DDS_RETCODE_OK)
+    return;
 
-  if (ut_handle_claim(entity, NULL, DDS_KIND_READER, (void**)&dds_rd) == UT_HANDLE_OK)
+  if (dds_entity_kind (dds_entity) != DDS_KIND_READER)
   {
-    struct reader *rd = dds_rd->m_rd;
-    nn_guid_t pwrguid;
-    struct proxy_writer *pwr;
-    struct rd_pwr_match *m;
-    memset (&pwrguid, 0, sizeof (pwrguid));
-    ddsrt_mutex_lock (&rd->e.lock);
+    dds_handle_release (&dds_entity->m_hdllink);
+    return;
+  }
 
-    rd->ddsi2direct_cb = cb;
-    rd->ddsi2direct_cbarg = cbarg;
-    while ((m = ut_avlLookupSuccEq (&rd_writers_treedef, &rd->writers, &pwrguid)) != NULL)
+  dds_reader *dds_rd = (dds_reader *) dds_entity;
+  struct reader *rd = dds_rd->m_rd;
+  nn_guid_t pwrguid;
+  struct proxy_writer *pwr;
+  struct rd_pwr_match *m;
+  memset (&pwrguid, 0, sizeof (pwrguid));
+  ddsrt_mutex_lock (&rd->e.lock);
+
+  rd->ddsi2direct_cb = cb;
+  rd->ddsi2direct_cbarg = cbarg;
+  while ((m = ut_avlLookupSuccEq (&rd_writers_treedef, &rd->writers, &pwrguid)) != NULL)
+  {
+    /* have to be careful walking the tree -- pretty is different, but
+     I want to check this before I write a lookup_succ function. */
+    struct rd_pwr_match *m_next;
+    nn_guid_t pwrguid_next;
+    pwrguid = m->pwr_guid;
+    if ((m_next = ut_avlFindSucc (&rd_writers_treedef, &rd->writers, m)) != NULL)
+      pwrguid_next = m_next->pwr_guid;
+    else
     {
-      /* have to be careful walking the tree -- pretty is different, but
-       I want to check this before I write a lookup_succ function. */
-      struct rd_pwr_match *m_next;
-      nn_guid_t pwrguid_next;
-      pwrguid = m->pwr_guid;
-      if ((m_next = ut_avlFindSucc (&rd_writers_treedef, &rd->writers, m)) != NULL)
-        pwrguid_next = m_next->pwr_guid;
-      else
-      {
-        memset (&pwrguid_next, 0xff, sizeof (pwrguid_next));
-        pwrguid_next.entityid.u = (pwrguid_next.entityid.u & ~(uint32_t)0xff) | NN_ENTITYID_KIND_WRITER_NO_KEY;
-      }
-      ddsrt_mutex_unlock (&rd->e.lock);
-      if ((pwr = ephash_lookup_proxy_writer_guid (&pwrguid)) != NULL)
-      {
-        ddsrt_mutex_lock (&pwr->e.lock);
-        pwr->ddsi2direct_cb = cb;
-        pwr->ddsi2direct_cbarg = cbarg;
-        ddsrt_mutex_unlock (&pwr->e.lock);
-      }
-      pwrguid = pwrguid_next;
-      ddsrt_mutex_lock (&rd->e.lock);
+      memset (&pwrguid_next, 0xff, sizeof (pwrguid_next));
+      pwrguid_next.entityid.u = (pwrguid_next.entityid.u & ~(uint32_t)0xff) | NN_ENTITYID_KIND_WRITER_NO_KEY;
     }
     ddsrt_mutex_unlock (&rd->e.lock);
-    ut_handle_release(entity, dds_rd->m_entity.m_hdllink);
+    if ((pwr = ephash_lookup_proxy_writer_guid (&pwrguid)) != NULL)
+    {
+      ddsrt_mutex_lock (&pwr->e.lock);
+      pwr->ddsi2direct_cb = cb;
+      pwr->ddsi2direct_cbarg = cbarg;
+      ddsrt_mutex_unlock (&pwr->e.lock);
+    }
+    pwrguid = pwrguid_next;
+    ddsrt_mutex_lock (&rd->e.lock);
   }
+  ddsrt_mutex_unlock (&rd->e.lock);
+  dds_handle_release (&dds_rd->m_entity.m_hdllink);
 }
 
 uint32_t dds_reader_lock_samples (dds_entity_t reader)
@@ -587,23 +603,32 @@ int dds_reader_wait_for_historical_data (dds_entity_t reader, dds_duration_t max
 
 dds_entity_t dds_get_subscriber (dds_entity_t entity)
 {
-  dds_entity_t hdl;
-  if (dds_entity_kind_from_handle (entity) == DDS_KIND_READER)
-    hdl = dds_get_parent (entity);
-  else if (dds_entity_kind_from_handle (entity) == DDS_KIND_COND_READ || dds_entity_kind_from_handle (entity) == DDS_KIND_COND_QUERY)
-  {
-    hdl = dds_get_parent (entity);
-    if (hdl > 0)
-      hdl = dds_get_subscriber (hdl);
-    DDS_ERROR ("Reader of this condition is already deleted\n");
-  }
+  dds_entity *e;
+  dds_retcode_t ret;
+  if ((ret = dds_entity_claim (entity, &e)) != DDS_RETCODE_OK)
+    return (dds_entity_t) DDS_ERRNO (ret);
   else
   {
-    DDS_ERROR ("Provided entity is not a reader nor a condition\n");
-    hdl = DDS_ERRNO (dds_valid_hdl (entity, DDS_KIND_READER));
+    dds_entity_t subh;
+    switch (dds_entity_kind (e))
+    {
+      case DDS_KIND_READER:
+        assert (dds_entity_kind (e->m_parent) == DDS_KIND_SUBSCRIBER);
+        subh = e->m_parent->m_hdllink.hdl;
+        break;
+      case DDS_KIND_COND_READ:
+      case DDS_KIND_COND_QUERY:
+        assert (dds_entity_kind (e->m_parent) == DDS_KIND_READER);
+        assert (dds_entity_kind (e->m_parent->m_parent) == DDS_KIND_SUBSCRIBER);
+        subh = e->m_parent->m_parent->m_hdllink.hdl;
+        break;
+      default:
+        subh = DDS_ERRNO (DDS_RETCODE_ILLEGAL_OPERATION);
+        break;
+    }
+    dds_handle_release (&e->m_hdllink);
+    return subh;
   }
-
-  return hdl;
 }
 
 dds_return_t
diff --git a/src/core/ddsc/src/dds_subscriber.c b/src/core/ddsc/src/dds_subscriber.c
index 7a3281e..1a51775 100644
--- a/src/core/ddsc/src/dds_subscriber.c
+++ b/src/core/ddsc/src/dds_subscriber.c
@@ -13,9 +13,12 @@
 #include "dds__listener.h"
 #include "dds__qos.h"
 #include "dds__err.h"
+#include "dds__subscriber.h"
 #include "dds/ddsi/q_entity.h"
 #include "dds/version.h"
 
+DECL_ENTITY_LOCK_UNLOCK(extern inline, dds_subscriber)
+
 #define DDS_SUBSCRIBER_STATUS_MASK                               \
                         DDS_DATA_ON_READERS_STATUS
 
diff --git a/src/core/ddsc/src/dds_topic.c b/src/core/ddsc/src/dds_topic.c
index 940d493..acd36ac 100644
--- a/src/core/ddsc/src/dds_topic.c
+++ b/src/core/ddsc/src/dds_topic.c
@@ -40,12 +40,6 @@ const ut_avlTreedef_t dds_topictree_def = UT_AVL_TREEDEF_INITIALIZER_INDKEY
   0
 );
 
-/* builtin-topic handles */
-const dds_entity_t DDS_BUILTIN_TOPIC_DCPSPARTICIPANT = (DDS_KIND_INTERNAL + 1);
-const dds_entity_t DDS_BUILTIN_TOPIC_DCPSTOPIC = (DDS_KIND_INTERNAL + 2);
-const dds_entity_t DDS_BUILTIN_TOPIC_DCPSPUBLICATION = (DDS_KIND_INTERNAL + 3);
-const dds_entity_t DDS_BUILTIN_TOPIC_DCPSSUBSCRIPTION = (DDS_KIND_INTERNAL + 4);
-
 static bool
 is_valid_name(
     const char *name)
@@ -198,7 +192,7 @@ dds_find_topic(
             st = dds_topic_lookup_locked (p->m_domain, name);
             if (st) {
                 dds_entity_add_ref (&st->status_cb_entity->m_entity);
-                tp = st->status_cb_entity->m_entity.m_hdl;
+                tp = st->status_cb_entity->m_entity.m_hdllink.hdl;
             } else {
                 DDS_ERROR("Topic is not being created yet\n");
                 tp = DDS_ERRNO(DDS_RETCODE_PRECONDITION_NOT_MET);
@@ -370,7 +364,7 @@ dds_create_topic_arbitrary (
             hdl = DDS_ERRNO(DDS_RETCODE_INCONSISTENT_POLICY);
         } else {
             dds_entity_add_ref (&stgeneric->status_cb_entity->m_entity);
-            hdl = stgeneric->status_cb_entity->m_entity.m_hdl;
+            hdl = stgeneric->status_cb_entity->m_entity.m_hdllink.hdl;
         }
         ddsrt_mutex_unlock (&dds_global.m_mutex);
     } else {
diff --git a/src/core/ddsc/src/dds_waitset.c b/src/core/ddsc/src/dds_waitset.c
index a594049..787ce2c 100644
--- a/src/core/ddsc/src/dds_waitset.c
+++ b/src/core/ddsc/src/dds_waitset.c
@@ -152,7 +152,7 @@ dds_waitset_close_list(
     dds_attachment *next;
     while (idx != NULL) {
         next = idx->next;
-        (void)dds_entity_observer_unregister(idx->entity->m_hdl, waitset);
+        (void)dds_entity_observer_unregister(idx->entity->m_hdllink.hdl, waitset);
         ddsrt_free(idx);
         idx = next;
     }
@@ -168,7 +168,7 @@ dds_waitset_remove_from_list(
     dds_attachment *prev = NULL;
 
     while (idx != NULL) {
-        if (idx->entity->m_hdl == observed) {
+        if (idx->entity->m_hdllink.hdl == observed) {
             if (prev == NULL) {
                 *list = idx->next;
             } else {
@@ -191,8 +191,8 @@ dds_waitset_close(
 {
     dds_waitset *ws = (dds_waitset*)e;
 
-    dds_waitset_close_list(&ws->observed,  e->m_hdl);
-    dds_waitset_close_list(&ws->triggered, e->m_hdl);
+    dds_waitset_close_list(&ws->observed,  e->m_hdllink.hdl);
+    dds_waitset_close_list(&ws->triggered, e->m_hdllink.hdl);
 
     /* Trigger waitset to wake up. */
     ddsrt_cond_broadcast(&e->m_cond);
@@ -242,7 +242,7 @@ dds_waitset_get_entities(
         iter = ws->observed;
         while (iter) {
             if (((size_t)ret < size) && (entities != NULL)) {
-                entities[ret] = iter->entity->m_hdl;
+                entities[ret] = iter->entity->m_hdllink.hdl;
             }
             ret++;
             iter = iter->next;
@@ -251,7 +251,7 @@ dds_waitset_get_entities(
         iter = ws->triggered;
         while (iter) {
             if (((size_t)ret < size) && (entities != NULL)) {
-                entities[ret] = iter->entity->m_hdl;
+                entities[ret] = iter->entity->m_hdllink.hdl;
             }
             ret++;
             iter = iter->next;
@@ -275,7 +275,7 @@ dds_waitset_move(
     dds_attachment *idx = *src;
     dds_attachment *prev = NULL;
     while (idx != NULL) {
-        if (idx->entity->m_hdl == entity) {
+        if (idx->entity->m_hdllink.hdl == entity) {
             /* Swap idx from src to dst. */
             dds_waitset_swap(dst, src, prev, idx);
 
diff --git a/src/core/ddsc/src/dds_writer.c b/src/core/ddsc/src/dds_writer.c
index e15bbbf..f804fe1 100644
--- a/src/core/ddsc/src/dds_writer.c
+++ b/src/core/ddsc/src/dds_writer.c
@@ -22,6 +22,7 @@
 #include "dds__qos.h"
 #include "dds__err.h"
 #include "dds__init.h"
+#include "dds__publisher.h"
 #include "dds__topic.h"
 #include "dds/ddsi/ddsi_tkmap.h"
 #include "dds__whc.h"
@@ -75,7 +76,7 @@ static void dds_writer_status_cb (void *ventity, const status_cb_data_t *data)
   {
     /* Release the initial claim that was done during the create. This
      * will indicate that further API deletion is now possible. */
-    ut_handle_release (entity->m_hdl, entity->m_hdllink);
+    dds_handle_release (&entity->m_hdllink);
     return;
   }
 
@@ -235,10 +236,10 @@ dds_writer_delete(
     if (asleep) {
         thread_state_asleep(thr);
     }
-    ret = dds_delete(wr->m_topic->m_entity.m_hdl);
+    ret = dds_delete(wr->m_topic->m_entity.m_hdllink.hdl);
     if(ret == DDS_RETCODE_OK){
-        ret = dds_delete_impl(e->m_parent->m_hdl, true);
-        if(dds_err_nr(ret) == DDS_RETCODE_ALREADY_DELETED){
+        ret = dds_delete_impl(e->m_parent->m_hdllink.hdl, true);
+        if(dds_err_nr(ret) == DDS_RETCODE_BAD_PARAMETER){
             ret = DDS_RETCODE_OK;
         }
     }
@@ -399,7 +400,7 @@ dds_create_writer(
     dds_qos_t * wqos;
     dds_writer * wr;
     dds_entity_t writer;
-    dds_entity * pub = NULL;
+    dds_publisher * pub = NULL;
     dds_topic * tp;
     dds_entity_t publisher;
     struct thread_state1 * const thr = lookup_thread_state();
@@ -407,22 +408,26 @@ dds_create_writer(
     ddsi_tran_conn_t conn = gv.data_conn_uc;
     dds_return_t ret;
 
-    /* Try claiming a participant. If that's not working, then it could be a subscriber. */
-    if(dds_entity_kind_from_handle(participant_or_publisher) == DDS_KIND_PARTICIPANT){
-        publisher = dds_create_publisher(participant_or_publisher, qos, NULL);
-    } else{
-        publisher = participant_or_publisher;
+    {
+        dds_entity *p_or_p;
+        if ((rc = dds_entity_claim (participant_or_publisher, &p_or_p)) != DDS_RETCODE_OK) {
+            return DDS_ERRNO (rc);
+        }
+        if (dds_entity_kind (p_or_p) == DDS_KIND_PARTICIPANT) {
+            publisher = dds_create_publisher(participant_or_publisher, qos, NULL);
+        } else {
+            publisher = participant_or_publisher;
+        }
+        dds_handle_release (&p_or_p->m_hdllink);
     }
-    rc = dds_entity_lock(publisher, DDS_KIND_PUBLISHER, &pub);
 
-    if (rc != DDS_RETCODE_OK) {
-        DDS_ERROR("Error occurred on locking publisher\n");
+    if ((rc = dds_publisher_lock(publisher, &pub)) != DDS_RETCODE_OK) {
         writer = DDS_ERRNO(rc);
         goto err_pub_lock;
     }
 
     if (publisher != participant_or_publisher) {
-        pub->m_flags |= DDS_ENTITY_IMPLICIT;
+        pub->m_entity.m_flags |= DDS_ENTITY_IMPLICIT;
     }
 
     rc = dds_topic_lock(topic, &tp);
@@ -432,7 +437,7 @@ dds_create_writer(
         goto err_tp_lock;
     }
     assert(tp->m_stopic);
-    assert(pub->m_domain == tp->m_entity.m_domain);
+    assert(pub->m_entity.m_domain == tp->m_entity.m_domain);
 
     /* Merge Topic & Publisher qos */
     wqos = dds_create_qos();
@@ -442,8 +447,8 @@ dds_create_writer(
         (void)dds_copy_qos(wqos, qos);
     }
 
-    if (pub->m_qos) {
-        dds_merge_qos(wqos, pub->m_qos);
+    if (pub->m_entity.m_qos) {
+        dds_merge_qos(wqos, pub->m_entity.m_qos);
     }
 
     if (tp->m_entity.m_qos) {
@@ -461,7 +466,7 @@ dds_create_writer(
 
     /* Create writer */
     wr = dds_alloc(sizeof (*wr));
-    writer = dds_entity_init(&wr->m_entity, pub, DDS_KIND_WRITER, wqos, listener, DDS_WRITER_STATUS_MASK);
+    writer = dds_entity_init(&wr->m_entity, &pub->m_entity, DDS_KIND_WRITER, wqos, listener, DDS_WRITER_STATUS_MASK);
 
     wr->m_topic = tp;
     dds_entity_add_ref_nolock(&tp->m_entity);
@@ -475,32 +480,30 @@ dds_create_writer(
 
     /* Extra claim of this writer to make sure that the delete waits until DDSI
      * has deleted its writer as well. This can be known through the callback. */
-    if (ut_handle_claim(wr->m_entity.m_hdl, wr->m_entity.m_hdllink, DDS_KIND_WRITER, NULL) != UT_HANDLE_OK) {
-        assert(0);
-    }
+    dds_handle_claim_inc (&wr->m_entity.m_hdllink);
 
-    ddsrt_mutex_unlock(&tp->m_entity.m_mutex);
-    ddsrt_mutex_unlock(&pub->m_mutex);
+    ddsrt_mutex_unlock (&tp->m_entity.m_mutex);
+    ddsrt_mutex_unlock (&pub->m_entity.m_mutex);
 
     if (asleep) {
         thread_state_awake(thr);
     }
-    wr->m_wr = new_writer(&wr->m_entity.m_guid, NULL, &pub->m_participant->m_guid, tp->m_stopic, wqos, wr->m_whc, dds_writer_status_cb, wr);
-    ddsrt_mutex_lock(&pub->m_mutex);
-    ddsrt_mutex_lock(&tp->m_entity.m_mutex);
+    wr->m_wr = new_writer(&wr->m_entity.m_guid, NULL, &pub->m_entity.m_participant->m_guid, tp->m_stopic, wqos, wr->m_whc, dds_writer_status_cb, wr);
+    ddsrt_mutex_lock (&pub->m_entity.m_mutex);
+    ddsrt_mutex_lock (&tp->m_entity.m_mutex);
     assert(wr->m_wr);
     if (asleep) {
         thread_state_asleep(thr);
     }
     dds_topic_unlock(tp);
-    dds_entity_unlock(pub);
+    dds_publisher_unlock(pub);
     return writer;
 
 err_bad_qos:
     dds_topic_unlock(tp);
 err_tp_lock:
-    dds_entity_unlock(pub);
-    if((pub->m_flags & DDS_ENTITY_IMPLICIT) != 0){
+    dds_publisher_unlock(pub);
+    if((pub->m_entity.m_flags & DDS_ENTITY_IMPLICIT) != 0){
         (void)dds_delete(publisher);
     }
 err_pub_lock:
@@ -511,17 +514,23 @@ dds_entity_t
 dds_get_publisher(
     dds_entity_t writer)
 {
-    dds_entity_t hdl = DDS_RETCODE_OK;
-
-    hdl = dds_valid_hdl(writer, DDS_KIND_WRITER);
-    if(hdl != DDS_RETCODE_OK){
-        DDS_ERROR("Provided handle is not writer kind, so it is not valid\n");
-        hdl = DDS_ERRNO(hdl);
-    } else{
-        hdl = dds_get_parent(writer);
+  dds_entity *e;
+  dds_retcode_t rc;
+  if ((rc = dds_entity_claim (writer, &e)) != DDS_RETCODE_OK)
+    return DDS_ERRNO (rc);
+  else
+  {
+    dds_entity_t pubh;
+    if (dds_entity_kind (e) != DDS_KIND_WRITER)
+      pubh = DDS_ERRNO (DDS_RETCODE_ILLEGAL_OPERATION);
+    else
+    {
+      assert (dds_entity_kind (e->m_parent) == DDS_KIND_PUBLISHER);
+      pubh = e->m_parent->m_hdllink.hdl;
     }
-
-    return hdl;
+    dds_handle_release (&e->m_hdllink);
+    return pubh;
+  }
 }
 
 dds_return_t
diff --git a/src/core/ddsc/tests/CMakeLists.txt b/src/core/ddsc/tests/CMakeLists.txt
index bd44687..978d0c3 100644
--- a/src/core/ddsc/tests/CMakeLists.txt
+++ b/src/core/ddsc/tests/CMakeLists.txt
@@ -23,7 +23,7 @@ set(ddsc_test_sources
     "entity_api.c"
     "entity_hierarchy.c"
     "entity_status.c"
-    "file_id.c"
+    "err.c"
     "instance_get_key.c"
     "listener.c"
     "participant.c"
diff --git a/src/core/ddsc/tests/builtin_topics.c b/src/core/ddsc/tests/builtin_topics.c
index 3a63478..e4d2ff0 100644
--- a/src/core/ddsc/tests/builtin_topics.c
+++ b/src/core/ddsc/tests/builtin_topics.c
@@ -63,7 +63,7 @@ teardown(void)
 }
 
 static void
-check_default_qos_of_builtin_entity(dds_entity_t entity)
+check_default_qos_of_builtin_entity(dds_entity_t entity, bool isread)
 {
   dds_return_t ret;
   int64_t deadline;
@@ -110,8 +110,7 @@ check_default_qos_of_builtin_entity(dds_entity_t entity)
   dds_qget_partition(qos, &plen, &partitions);
   // no getter for ENTITY_FACTORY
 
-  CU_ASSERT_FATAL((entity & DDS_ENTITY_KIND_MASK) == DDS_KIND_SUBSCRIBER || (entity & DDS_ENTITY_KIND_MASK) == DDS_KIND_READER);
-  if ((entity & DDS_ENTITY_KIND_MASK) == DDS_KIND_SUBSCRIBER) {
+  if (!isread) {
       CU_ASSERT_FATAL(plen == 1);
       CU_ASSERT_STRING_EQUAL_FATAL(partitions[0], "__BUILT-IN PARTITION__");
   } else {
@@ -303,9 +302,9 @@ CU_Test(ddsc_builtin_topics, builtin_qos, .init = setup, .fini = teardown)
 
   dds_sub_rdr = dds_create_reader(g_participant, DDS_BUILTIN_TOPIC_DCPSSUBSCRIPTION, NULL, NULL);
   CU_ASSERT_FATAL(dds_sub_rdr > 0);
-  check_default_qos_of_builtin_entity(dds_sub_rdr);
+  check_default_qos_of_builtin_entity(dds_sub_rdr, 1);
 
   dds_sub_subscriber = dds_get_parent(dds_sub_rdr);
   CU_ASSERT_FATAL(dds_sub_subscriber > 0);
-  check_default_qos_of_builtin_entity(dds_sub_subscriber);
+  check_default_qos_of_builtin_entity(dds_sub_subscriber, 0);
 }
diff --git a/src/core/ddsc/tests/dispose.c b/src/core/ddsc/tests/dispose.c
index ee504fc..0e10c60 100644
--- a/src/core/ddsc/tests/dispose.c
+++ b/src/core/ddsc/tests/dispose.c
@@ -153,7 +153,7 @@ CU_Test(ddsc_writedispose, deleted, .init=disposing_init, .fini=disposing_fini)
     DDSRT_WARNING_MSVC_OFF(6387); /* Disable SAL warning on intentional misuse of the API */
     ret = dds_writedispose(g_writer, NULL);
     DDSRT_WARNING_MSVC_ON(6387);
-    CU_ASSERT_EQUAL_FATAL(dds_err_nr(ret), DDS_RETCODE_ALREADY_DELETED);
+    CU_ASSERT_EQUAL_FATAL(dds_err_nr(ret), DDS_RETCODE_BAD_PARAMETER);
 }
 /*************************************************************************************************/
 
@@ -170,7 +170,7 @@ CU_Test(ddsc_writedispose, null, .init=disposing_init, .fini=disposing_fini)
 
 /*************************************************************************************************/
 CU_TheoryDataPoints(ddsc_writedispose, invalid_writers) = {
-        CU_DataPoints(dds_entity_t, -2, -1, 0, 1, 100, INT_MAX, INT_MIN),
+        CU_DataPoints(dds_entity_t, -2, -1, 0, INT_MAX, INT_MIN),
 };
 CU_Theory((dds_entity_t writer), ddsc_writedispose, invalid_writers, .init=disposing_init, .fini=disposing_fini)
 {
@@ -310,7 +310,7 @@ CU_Test(ddsc_writedispose_ts, deleted, .init=disposing_init, .fini=disposing_fin
     DDSRT_WARNING_MSVC_OFF(6387); /* Disable SAL warning on intentional misuse of the API */
     ret = dds_writedispose_ts(g_writer, NULL, g_present);
     DDSRT_WARNING_MSVC_ON(6387);
-    CU_ASSERT_EQUAL(dds_err_nr(ret), DDS_RETCODE_ALREADY_DELETED);
+    CU_ASSERT_EQUAL(dds_err_nr(ret), DDS_RETCODE_BAD_PARAMETER);
 }
 /*************************************************************************************************/
 
@@ -341,7 +341,7 @@ CU_Test(ddsc_writedispose_ts, timeout, .init=disposing_init, .fini=disposing_fin
 
 /*************************************************************************************************/
 CU_TheoryDataPoints(ddsc_writedispose_ts, invalid_writers) = {
-        CU_DataPoints(dds_entity_t, -2, -1, 0, 1, 100, INT_MAX, INT_MIN),
+        CU_DataPoints(dds_entity_t, -2, -1, 0, INT_MAX, INT_MIN),
 };
 CU_Theory((dds_entity_t writer), ddsc_writedispose_ts, invalid_writers, .init=disposing_init, .fini=disposing_fini)
 {
@@ -510,7 +510,7 @@ CU_Test(ddsc_dispose, deleted, .init=disposing_init, .fini=disposing_fini)
     DDSRT_WARNING_MSVC_OFF(6387); /* Disable SAL warning on intentional misuse of the API */
     ret = dds_dispose(g_writer, NULL);
     DDSRT_WARNING_MSVC_ON(6387);
-    CU_ASSERT_EQUAL_FATAL(dds_err_nr(ret), DDS_RETCODE_ALREADY_DELETED);
+    CU_ASSERT_EQUAL_FATAL(dds_err_nr(ret), DDS_RETCODE_BAD_PARAMETER);
 }
 /*************************************************************************************************/
 
@@ -541,7 +541,7 @@ CU_Test(ddsc_dispose, timeout, .init=disposing_init, .fini=disposing_fini)
 
 /*************************************************************************************************/
 CU_TheoryDataPoints(ddsc_dispose, invalid_writers) = {
-        CU_DataPoints(dds_entity_t, -2, -1, 0, 1, 100, INT_MAX, INT_MIN),
+        CU_DataPoints(dds_entity_t, -2, -1, 0, INT_MAX, INT_MIN),
 };
 CU_Theory((dds_entity_t writer), ddsc_dispose, invalid_writers, .init=disposing_init, .fini=disposing_fini)
 {
@@ -665,7 +665,7 @@ CU_Test(ddsc_dispose_ts, deleted, .init=disposing_init, .fini=disposing_fini)
     DDSRT_WARNING_MSVC_OFF(6387); /* Disable SAL warning on intentional misuse of the API */
     ret = dds_dispose_ts(g_writer, NULL, g_present);
     DDSRT_WARNING_MSVC_ON(6387); /* Disable SAL warning on intentional misuse of the API */
-    CU_ASSERT_EQUAL_FATAL(dds_err_nr(ret), DDS_RETCODE_ALREADY_DELETED);
+    CU_ASSERT_EQUAL_FATAL(dds_err_nr(ret), DDS_RETCODE_BAD_PARAMETER);
 }
 /*************************************************************************************************/
 
@@ -696,7 +696,7 @@ CU_Test(ddsc_dispose_ts, timeout, .init=disposing_init, .fini=disposing_fini)
 
 /*************************************************************************************************/
 CU_TheoryDataPoints(ddsc_dispose_ts, invalid_writers) = {
-        CU_DataPoints(dds_entity_t, -2, -1, 0, 1, 100, INT_MAX, INT_MIN),
+        CU_DataPoints(dds_entity_t, -2, -1, 0, INT_MAX, INT_MIN),
 };
 CU_Theory((dds_entity_t writer), ddsc_dispose_ts, invalid_writers, .init=disposing_init, .fini=disposing_fini)
 {
@@ -861,7 +861,7 @@ CU_Test(ddsc_dispose_ih, deleted, .init=disposing_init, .fini=disposing_fini)
     dds_return_t ret;
     dds_delete(g_writer);
     ret = dds_dispose_ih(g_writer, DDS_HANDLE_NIL);
-    CU_ASSERT_EQUAL_FATAL(dds_err_nr(ret), DDS_RETCODE_ALREADY_DELETED);
+    CU_ASSERT_EQUAL_FATAL(dds_err_nr(ret), DDS_RETCODE_BAD_PARAMETER);
 }
 /*************************************************************************************************/
 
@@ -879,7 +879,7 @@ CU_Theory((dds_instance_handle_t handle), ddsc_dispose_ih, invalid_handles, .ini
 
 /*************************************************************************************************/
 CU_TheoryDataPoints(ddsc_dispose_ih, invalid_writers) = {
-        CU_DataPoints(dds_entity_t, -2, -1, 0, 1, 100, INT_MAX, INT_MIN),
+        CU_DataPoints(dds_entity_t, -2, -1, 0, INT_MAX, INT_MIN),
 };
 CU_Theory((dds_entity_t writer), ddsc_dispose_ih, invalid_writers, .init=disposing_init, .fini=disposing_fini)
 {
@@ -959,7 +959,7 @@ CU_Test(ddsc_dispose_ih_ts, deleted, .init=disposing_init, .fini=disposing_fini)
     dds_return_t ret;
     dds_delete(g_writer);
     ret = dds_dispose_ih_ts(g_writer, DDS_HANDLE_NIL, g_present);
-    CU_ASSERT_EQUAL_FATAL(dds_err_nr(ret), DDS_RETCODE_ALREADY_DELETED);
+    CU_ASSERT_EQUAL_FATAL(dds_err_nr(ret), DDS_RETCODE_BAD_PARAMETER);
 }
 /*************************************************************************************************/
 
@@ -977,7 +977,7 @@ CU_Theory((dds_instance_handle_t handle), ddsc_dispose_ih_ts, invalid_handles, .
 
 /*************************************************************************************************/
 CU_TheoryDataPoints(ddsc_dispose_ih_ts, invalid_writers) = {
-        CU_DataPoints(dds_entity_t, -2, -1, 0, 1, 100, INT_MAX, INT_MIN),
+        CU_DataPoints(dds_entity_t, -2, -1, 0, INT_MAX, INT_MIN),
 };
 CU_Theory((dds_entity_t writer), ddsc_dispose_ih_ts, invalid_writers, .init=disposing_init, .fini=disposing_fini)
 {
diff --git a/src/core/ddsc/tests/entity_hierarchy.c b/src/core/ddsc/tests/entity_hierarchy.c
index ef2f1f4..ec7e2dc 100644
--- a/src/core/ddsc/tests/entity_hierarchy.c
+++ b/src/core/ddsc/tests/entity_hierarchy.c
@@ -147,21 +147,21 @@ CU_Test(ddsc_entity_delete, recursive, .init=hierarchy_init, .fini=hierarchy_fin
 
     /* Check if all the entities are deleted now. */
     ret = dds_get_domainid(g_participant, &id);
-    CU_ASSERT_EQUAL_FATAL(dds_err_nr(ret), DDS_RETCODE_ALREADY_DELETED);
+    CU_ASSERT_EQUAL_FATAL(dds_err_nr(ret), DDS_RETCODE_BAD_PARAMETER);
     ret = dds_get_domainid(g_topic, &id);
-    CU_ASSERT_EQUAL_FATAL(dds_err_nr(ret), DDS_RETCODE_ALREADY_DELETED);
+    CU_ASSERT_EQUAL_FATAL(dds_err_nr(ret), DDS_RETCODE_BAD_PARAMETER);
     ret = dds_get_domainid(g_publisher, &id);
-    CU_ASSERT_EQUAL_FATAL(dds_err_nr(ret), DDS_RETCODE_ALREADY_DELETED);
+    CU_ASSERT_EQUAL_FATAL(dds_err_nr(ret), DDS_RETCODE_BAD_PARAMETER);
     ret = dds_get_domainid(g_subscriber, &id);
-    CU_ASSERT_EQUAL_FATAL(dds_err_nr(ret), DDS_RETCODE_ALREADY_DELETED);
+    CU_ASSERT_EQUAL_FATAL(dds_err_nr(ret), DDS_RETCODE_BAD_PARAMETER);
     ret = dds_get_domainid(g_writer, &id);
-    CU_ASSERT_EQUAL_FATAL(dds_err_nr(ret), DDS_RETCODE_ALREADY_DELETED);
+    CU_ASSERT_EQUAL_FATAL(dds_err_nr(ret), DDS_RETCODE_BAD_PARAMETER);
     ret = dds_get_domainid(g_reader, &id);
-    CU_ASSERT_EQUAL_FATAL(dds_err_nr(ret), DDS_RETCODE_ALREADY_DELETED);
+    CU_ASSERT_EQUAL_FATAL(dds_err_nr(ret), DDS_RETCODE_BAD_PARAMETER);
     ret = dds_get_domainid(g_readcond, &id);
-    CU_ASSERT_EQUAL_FATAL(dds_err_nr(ret), DDS_RETCODE_ALREADY_DELETED);
+    CU_ASSERT_EQUAL_FATAL(dds_err_nr(ret), DDS_RETCODE_BAD_PARAMETER);
     ret = dds_get_domainid(g_querycond, &id);
-    CU_ASSERT_EQUAL_FATAL(dds_err_nr(ret), DDS_RETCODE_ALREADY_DELETED);
+    CU_ASSERT_EQUAL_FATAL(dds_err_nr(ret), DDS_RETCODE_BAD_PARAMETER);
 }
 /*************************************************************************************************/
 
@@ -201,11 +201,11 @@ CU_Test(ddsc_entity_delete, recursive_with_deleted_topic)
 
     /* Check if the entities are actually deleted. */
     ret = dds_get_domainid(g_participant, &id);
-    CU_ASSERT_EQUAL_FATAL(dds_err_nr(ret), DDS_RETCODE_ALREADY_DELETED );
+    CU_ASSERT_EQUAL_FATAL(dds_err_nr(ret), DDS_RETCODE_BAD_PARAMETER );
     ret = dds_get_domainid(g_topic, &id);
-    CU_ASSERT_EQUAL_FATAL(dds_err_nr(ret), DDS_RETCODE_ALREADY_DELETED);
+    CU_ASSERT_EQUAL_FATAL(dds_err_nr(ret), DDS_RETCODE_BAD_PARAMETER);
     ret = dds_get_domainid(g_writer, &id);
-    CU_ASSERT_EQUAL_FATAL(dds_err_nr(ret), DDS_RETCODE_ALREADY_DELETED);
+    CU_ASSERT_EQUAL_FATAL(dds_err_nr(ret), DDS_RETCODE_BAD_PARAMETER);
 
     dds_delete(g_keep);
 }
@@ -240,13 +240,13 @@ CU_Theory((dds_entity_t *entity), ddsc_entity_get_participant, deleted_entities,
     dds_entity_t participant;
     dds_delete(*entity);
     participant = dds_get_participant(*entity);
-    CU_ASSERT_EQUAL_FATAL(dds_err_nr(participant), DDS_RETCODE_ALREADY_DELETED);
+    CU_ASSERT_EQUAL_FATAL(dds_err_nr(participant), DDS_RETCODE_BAD_PARAMETER);
 }
 /*************************************************************************************************/
 
 /*************************************************************************************************/
 CU_TheoryDataPoints(ddsc_entity_get_participant, invalid_entities) = {
-        CU_DataPoints(dds_entity_t, -2, -1, 0, 1, 100, INT_MAX, INT_MIN),
+        CU_DataPoints(dds_entity_t, -2, -1, 0, INT_MAX, INT_MIN),
 };
 CU_Theory((dds_entity_t entity), ddsc_entity_get_participant, invalid_entities, .init=hierarchy_init, .fini=hierarchy_fini)
 {
@@ -327,13 +327,13 @@ CU_Theory((dds_entity_t *entity), ddsc_entity_get_parent, deleted_entities, .ini
     dds_entity_t parent;
     dds_delete(*entity);
     parent = dds_get_parent(*entity);
-    CU_ASSERT_EQUAL_FATAL(dds_err_nr(parent), DDS_RETCODE_ALREADY_DELETED);
+    CU_ASSERT_EQUAL_FATAL(dds_err_nr(parent), DDS_RETCODE_BAD_PARAMETER);
 }
 /*************************************************************************************************/
 
 /*************************************************************************************************/
 CU_TheoryDataPoints(ddsc_entity_get_parent, invalid_entities) = {
-        CU_DataPoints(dds_entity_t, -2, -1, 0, 1, 100, INT_MAX, INT_MIN),
+        CU_DataPoints(dds_entity_t, -2, -1, 0, INT_MAX, INT_MIN),
 };
 CU_Theory((dds_entity_t entity), ddsc_entity_get_parent, invalid_entities, .init=hierarchy_init, .fini=hierarchy_fini)
 {
@@ -478,13 +478,13 @@ CU_Theory((dds_entity_t *entity), ddsc_entity_get_children, deleted_entities, .i
     dds_entity_t children[4];
     dds_delete(*entity);
     ret = dds_get_children(*entity, children, 4);
-    CU_ASSERT_EQUAL_FATAL(dds_err_nr(ret), DDS_RETCODE_ALREADY_DELETED);
+    CU_ASSERT_EQUAL_FATAL(dds_err_nr(ret), DDS_RETCODE_BAD_PARAMETER);
 }
 /*************************************************************************************************/
 
 /*************************************************************************************************/
 CU_TheoryDataPoints(ddsc_entity_get_children, invalid_entities) = {
-        CU_DataPoints(dds_entity_t, -2, -1, 0, 1, 100, INT_MAX, INT_MIN),
+        CU_DataPoints(dds_entity_t, -2, -1, 0, INT_MAX, INT_MIN),
 };
 CU_Theory((dds_entity_t entity), ddsc_entity_get_children, invalid_entities, .init=hierarchy_init, .fini=hierarchy_fini)
 {
@@ -527,13 +527,13 @@ CU_Theory((dds_entity_t *entity), ddsc_entity_get_topic, deleted_entities, .init
     dds_entity_t topic;
     dds_delete(*entity);
     topic = dds_get_topic(*entity);
-    CU_ASSERT_EQUAL_FATAL(dds_err_nr(topic), DDS_RETCODE_ALREADY_DELETED);
+    CU_ASSERT_EQUAL_FATAL(dds_err_nr(topic), DDS_RETCODE_BAD_PARAMETER);
 }
 /*************************************************************************************************/
 
 /*************************************************************************************************/
 CU_TheoryDataPoints(ddsc_entity_get_topic, invalid_entities) = {
-        CU_DataPoints(dds_entity_t, -2, -1, 0, 1, 100, INT_MAX, INT_MIN),
+        CU_DataPoints(dds_entity_t, -2, -1, 0, INT_MAX, INT_MIN),
 };
 CU_Theory((dds_entity_t entity), ddsc_entity_get_topic, invalid_entities, .init=hierarchy_init, .fini=hierarchy_fini)
 {
@@ -581,13 +581,13 @@ CU_Test(ddsc_entity_get_publisher, deleted_writer, .init=hierarchy_init, .fini=h
     dds_entity_t publisher;
     dds_delete(g_writer);
     publisher = dds_get_publisher(g_writer);
-    CU_ASSERT_EQUAL_FATAL(dds_err_nr(publisher), DDS_RETCODE_ALREADY_DELETED);
+    CU_ASSERT_EQUAL_FATAL(dds_err_nr(publisher), DDS_RETCODE_BAD_PARAMETER);
 }
 /*************************************************************************************************/
 
 /*************************************************************************************************/
 CU_TheoryDataPoints(ddsc_entity_get_publisher, invalid_writers) = {
-        CU_DataPoints(dds_entity_t, -2, -1, 0, 1, 100, INT_MAX, INT_MIN),
+        CU_DataPoints(dds_entity_t, -2, -1, 0, INT_MAX, INT_MIN),
 };
 CU_Theory((dds_entity_t entity), ddsc_entity_get_publisher, invalid_writers, .init=hierarchy_init, .fini=hierarchy_fini)
 {
@@ -640,13 +640,13 @@ CU_Theory((dds_entity_t *entity), ddsc_entity_get_subscriber, deleted_readers, .
     dds_entity_t subscriber;
     dds_delete(*entity);
     subscriber = dds_get_subscriber(*entity);
-    CU_ASSERT_EQUAL_FATAL(dds_err_nr(subscriber), DDS_RETCODE_ALREADY_DELETED);
+    CU_ASSERT_EQUAL_FATAL(dds_err_nr(subscriber), DDS_RETCODE_BAD_PARAMETER);
 }
 /*************************************************************************************************/
 
 /*************************************************************************************************/
 CU_TheoryDataPoints(ddsc_entity_get_subscriber, invalid_readers) = {
-        CU_DataPoints(dds_entity_t, -2, -1, 0, 1, 100, INT_MAX, INT_MIN),
+        CU_DataPoints(dds_entity_t, -2, -1, 0, INT_MAX, INT_MIN),
 };
 CU_Theory((dds_entity_t entity), ddsc_entity_get_subscriber, invalid_readers, .init=hierarchy_init, .fini=hierarchy_fini)
 {
@@ -701,13 +701,13 @@ CU_Theory((dds_entity_t *cond), ddsc_entity_get_datareader, deleted_conds, .init
     dds_entity_t reader;
     dds_delete(*cond);
     reader = dds_get_datareader(*cond);
-    CU_ASSERT_EQUAL_FATAL(dds_err_nr(reader), DDS_RETCODE_ALREADY_DELETED);
+    CU_ASSERT_EQUAL_FATAL(dds_err_nr(reader), DDS_RETCODE_BAD_PARAMETER);
 }
 /*************************************************************************************************/
 
 /*************************************************************************************************/
 CU_TheoryDataPoints(ddsc_entity_get_datareader, invalid_conds) = {
-        CU_DataPoints(dds_entity_t, -2, -1, 0, 1, 100, INT_MAX, INT_MIN),
+        CU_DataPoints(dds_entity_t, -2, -1, 0, INT_MAX, INT_MIN),
 };
 CU_Theory((dds_entity_t cond), ddsc_entity_get_datareader, invalid_conds, .init=hierarchy_init, .fini=hierarchy_fini)
 {
diff --git a/src/core/ddsc/tests/entity_status.c b/src/core/ddsc/tests/entity_status.c
index f14245f..45883fe 100644
--- a/src/core/ddsc/tests/entity_status.c
+++ b/src/core/ddsc/tests/entity_status.c
@@ -589,9 +589,9 @@ CU_Test(ddsc_entity, all_data_available, .init=init_entity_status, .fini=fini_en
 
 /*************************************************************************************************/
 CU_TheoryDataPoints(ddsc_get_enabled_status, bad_param) = {
-        CU_DataPoints(dds_entity_t, -2, -1, 0, 1, 100, INT_MAX, INT_MIN),
+        CU_DataPoints(dds_entity_t, -2, -1, 0, INT_MAX, INT_MIN),
 };
-CU_Theory((dds_entity_t e), ddsc_get_enabled_status, bad_param)
+CU_Theory((dds_entity_t e), ddsc_get_enabled_status, bad_param, .init=init_entity_status, .fini=fini_entity_status)
 {
     uint32_t mask;
     dds_return_t exp = DDS_RETCODE_BAD_PARAMETER * -1;
@@ -605,7 +605,7 @@ CU_Test(ddsc_get_enabled_status, deleted_reader, .init=init_entity_status, .fini
     uint32_t mask;
     dds_delete(rea);
     ret = dds_get_status_mask(rea, &mask);
-    CU_ASSERT_EQUAL_FATAL(dds_err_nr(ret), DDS_RETCODE_ALREADY_DELETED);
+    CU_ASSERT_EQUAL_FATAL(dds_err_nr(ret), DDS_RETCODE_BAD_PARAMETER);
 }
 
 CU_Test(ddsc_get_enabled_status, illegal, .init=init_entity_status, .fini=fini_entity_status)
@@ -628,9 +628,9 @@ CU_Theory((dds_entity_t *e), ddsc_get_enabled_status, status_ok, .init=init_enti
 
 /*************************************************************************************************/
 CU_TheoryDataPoints(ddsc_set_enabled_status, bad_param) = {
-        CU_DataPoints(dds_entity_t, -2, -1, 0, 1, 100, INT_MAX, INT_MIN),
+        CU_DataPoints(dds_entity_t, -2, -1, 0, INT_MAX, INT_MIN),
 };
-CU_Theory((dds_entity_t e), ddsc_set_enabled_status, bad_param)
+CU_Theory((dds_entity_t e), ddsc_set_enabled_status, bad_param, .init=init_entity_status, .fini=fini_entity_status)
 {
     dds_entity_t exp = DDS_RETCODE_BAD_PARAMETER * -1;
 
@@ -642,7 +642,7 @@ CU_Test(ddsc_set_enabled_status, deleted_reader, .init=init_entity_status, .fini
 {
     dds_delete(rea);
     ret = dds_set_status_mask(rea, 0 /*mask*/);
-    CU_ASSERT_EQUAL_FATAL(dds_err_nr(ret), DDS_RETCODE_ALREADY_DELETED);
+    CU_ASSERT_EQUAL_FATAL(dds_err_nr(ret), DDS_RETCODE_BAD_PARAMETER);
 }
 
 CU_Test(ddsc_set_enabled_status, illegal, .init=init_entity_status, .fini=fini_entity_status)
@@ -663,9 +663,9 @@ CU_Theory((dds_entity_t *entity), ddsc_set_enabled_status, status_ok, .init=init
 
 /*************************************************************************************************/
 CU_TheoryDataPoints(ddsc_read_status, bad_param) = {
-        CU_DataPoints(dds_entity_t, -2, -1, 0, 1, 100, INT_MAX, INT_MIN),
+        CU_DataPoints(dds_entity_t, -2, -1, 0, INT_MAX, INT_MIN),
 };
-CU_Theory((dds_entity_t e), ddsc_read_status, bad_param)
+CU_Theory((dds_entity_t e), ddsc_read_status, bad_param, .init=init_entity_status, .fini=fini_entity_status)
 {
     uint32_t status;
     dds_entity_t exp = DDS_RETCODE_BAD_PARAMETER * -1;
@@ -679,7 +679,7 @@ CU_Test(ddsc_read_status, deleted_reader, .init=init_entity_status, .fini=fini_e
     uint32_t status;
     dds_delete(rea);
     ret = dds_read_status(rea, &status, 0 /*mask*/);
-    CU_ASSERT_EQUAL_FATAL(dds_err_nr(ret), DDS_RETCODE_ALREADY_DELETED);
+    CU_ASSERT_EQUAL_FATAL(dds_err_nr(ret), DDS_RETCODE_BAD_PARAMETER);
 }
 
 CU_Test(ddsc_read_status, illegal, .init=init_entity_status, .fini=fini_entity_status)
@@ -715,9 +715,9 @@ CU_Test(ddsc_read_status, invalid_status_on_writer, .init=init_entity_status, .f
 
 /*************************************************************************************************/
 CU_TheoryDataPoints(ddsc_take_status, bad_param) = {
-        CU_DataPoints(dds_entity_t, -2, -1, 0, 1, 100, INT_MAX, INT_MIN),
+        CU_DataPoints(dds_entity_t, -2, -1, 0, INT_MAX, INT_MIN),
 };
-CU_Theory((dds_entity_t e), ddsc_take_status, bad_param)
+CU_Theory((dds_entity_t e), ddsc_take_status, bad_param, .init=init_entity_status, .fini=fini_entity_status)
 {
     uint32_t status;
     dds_entity_t exp = DDS_RETCODE_BAD_PARAMETER * -1;
@@ -731,7 +731,7 @@ CU_Test(ddsc_take_status, deleted_reader, .init=init_entity_status, .fini=fini_e
     uint32_t status;
     dds_delete(rea);
     ret = dds_take_status(rea, &status, 0 /*mask*/);
-    CU_ASSERT_EQUAL_FATAL(dds_err_nr(ret), DDS_RETCODE_ALREADY_DELETED);
+    CU_ASSERT_EQUAL_FATAL(dds_err_nr(ret), DDS_RETCODE_BAD_PARAMETER);
 }
 CU_Test(ddsc_take_status, illegal, .init=init_entity_status, .fini=fini_entity_status)
 {
@@ -754,9 +754,9 @@ CU_Theory((dds_entity_t *e), ddsc_take_status, status_ok, .init=init_entity_stat
 
 /*************************************************************************************************/
 CU_TheoryDataPoints(ddsc_get_status_changes, bad_param) = {
-        CU_DataPoints(dds_entity_t, -2, -1, 0, 1, 100, INT_MAX, INT_MIN),
+        CU_DataPoints(dds_entity_t, -2, -1, 0, INT_MAX, INT_MIN),
 };
-CU_Theory((dds_entity_t e), ddsc_get_status_changes, bad_param)
+CU_Theory((dds_entity_t e), ddsc_get_status_changes, bad_param, .init=init_entity_status, .fini=fini_entity_status)
 {
     uint32_t status;
     dds_entity_t exp = DDS_RETCODE_BAD_PARAMETER * -1;
@@ -770,7 +770,7 @@ CU_Test(ddsc_get_status_changes, deleted_reader, .init=init_entity_status, .fini
     uint32_t status;
     dds_delete(rea);
     ret = dds_get_status_changes(rea, &status);
-    CU_ASSERT_EQUAL_FATAL(dds_err_nr(ret), DDS_RETCODE_ALREADY_DELETED);
+    CU_ASSERT_EQUAL_FATAL(dds_err_nr(ret), DDS_RETCODE_BAD_PARAMETER);
 }
 
 CU_Test(ddsc_get_status_changes, illegal, .init=init_entity_status, .fini=fini_entity_status)
@@ -793,9 +793,9 @@ CU_Theory((dds_entity_t *e), ddsc_get_status_changes, status_ok, .init=init_enti
 
 /*************************************************************************************************/
 CU_TheoryDataPoints(ddsc_triggered, bad_param) = {
-        CU_DataPoints(dds_entity_t, -2, -1, 0, 1, 100, INT_MAX, INT_MIN),
+        CU_DataPoints(dds_entity_t, -2, -1, 0, INT_MAX, INT_MIN),
 };
-CU_Theory((dds_entity_t e), ddsc_triggered, bad_param)
+CU_Theory((dds_entity_t e), ddsc_triggered, bad_param, .init=init_entity_status, .fini=fini_entity_status)
 {
     dds_entity_t exp = DDS_RETCODE_BAD_PARAMETER * -1;
 
@@ -807,7 +807,7 @@ CU_Test(ddsc_triggered, deleted_reader, .init=init_entity_status, .fini=fini_ent
 {
     dds_delete(rea);
     ret = dds_triggered(rea);
-    CU_ASSERT_EQUAL_FATAL(dds_err_nr(ret), DDS_RETCODE_ALREADY_DELETED);
+    CU_ASSERT_EQUAL_FATAL(dds_err_nr(ret), DDS_RETCODE_BAD_PARAMETER);
 }
 
 CU_TheoryDataPoints(ddsc_triggered, status_ok) = {
@@ -833,9 +833,9 @@ CU_Test(ddsc_get_inconsistent_topic_status, inconsistent_topic_status, .init=ini
 
 /*************************************************************************************************/
 CU_TheoryDataPoints(ddsc_get_inconsistent_topic_status, bad_params) = {
-        CU_DataPoints(dds_entity_t, -2, -1, 0, 1, 100, INT_MAX, INT_MIN),
+        CU_DataPoints(dds_entity_t, -2, -1, 0, INT_MAX, INT_MIN),
 };
-CU_Theory((dds_entity_t topic), ddsc_get_inconsistent_topic_status, bad_params)
+CU_Theory((dds_entity_t topic), ddsc_get_inconsistent_topic_status, bad_params, .init=init_entity_status, .fini=fini_entity_status)
 {
     dds_inconsistent_topic_status_t topic_status;
     dds_entity_t exp = DDS_RETCODE_BAD_PARAMETER * -1;
@@ -876,9 +876,9 @@ CU_Test(ddsc_get_inconsistent_topic_status, deleted_topic, .init=init_entity_sta
 
 /*************************************************************************************************/
 CU_TheoryDataPoints(ddsc_get_publication_matched_status, bad_params) = {
-        CU_DataPoints(dds_entity_t, -2, -1, 0, 1, 100, INT_MAX, INT_MIN),
+        CU_DataPoints(dds_entity_t, -2, -1, 0, INT_MAX, INT_MIN),
 };
-CU_Theory((dds_entity_t writer), ddsc_get_publication_matched_status, bad_params)
+CU_Theory((dds_entity_t writer), ddsc_get_publication_matched_status, bad_params, .init=init_entity_status, .fini=fini_entity_status)
 {
     dds_publication_matched_status_t status;
     dds_entity_t exp = DDS_RETCODE_BAD_PARAMETER * -1;
@@ -913,7 +913,7 @@ CU_Test(ddsc_get_publication_matched_status, deleted_writer, .init=init_entity_s
 {
     dds_delete(wri);
     ret = dds_get_publication_matched_status(wri, NULL);
-    CU_ASSERT_EQUAL_FATAL(dds_err_nr(ret), DDS_RETCODE_ALREADY_DELETED);
+    CU_ASSERT_EQUAL_FATAL(dds_err_nr(ret), DDS_RETCODE_BAD_PARAMETER);
 }
 /*************************************************************************************************/
 
@@ -930,9 +930,9 @@ CU_Test(ddsc_get_liveliness_lost_status, liveliness_lost_status, .init=init_enti
 
 /*************************************************************************************************/
 CU_TheoryDataPoints(ddsc_get_liveliness_lost_status, bad_params) = {
-        CU_DataPoints(dds_entity_t, -2, -1, 0, 1, 100, INT_MAX, INT_MIN),
+        CU_DataPoints(dds_entity_t, -2, -1, 0, INT_MAX, INT_MIN),
 };
-CU_Theory((dds_entity_t writer), ddsc_get_liveliness_lost_status, bad_params)
+CU_Theory((dds_entity_t writer), ddsc_get_liveliness_lost_status, bad_params, .init=init_entity_status, .fini=fini_entity_status)
 {
     dds_liveliness_lost_status_t status;
     dds_entity_t exp = DDS_RETCODE_BAD_PARAMETER * -1;
@@ -967,7 +967,7 @@ CU_Test(ddsc_get_liveliness_lost_status, deleted_writer, .init=init_entity_statu
 {
     dds_delete(wri);
     ret = dds_get_liveliness_lost_status(wri, NULL);
-    CU_ASSERT_EQUAL_FATAL(dds_err_nr(ret), DDS_RETCODE_ALREADY_DELETED);
+    CU_ASSERT_EQUAL_FATAL(dds_err_nr(ret), DDS_RETCODE_BAD_PARAMETER);
 }
 /*************************************************************************************************/
 
@@ -985,9 +985,9 @@ CU_Test(ddsc_get_offered_deadline_missed_status, offered_deadline_missed_status,
 
 /*************************************************************************************************/
 CU_TheoryDataPoints(ddsc_get_offered_deadline_missed_status, bad_params) = {
-        CU_DataPoints(dds_entity_t, -2, -1, 0, 1, 100, INT_MAX, INT_MIN),
+        CU_DataPoints(dds_entity_t, -2, -1, 0, INT_MAX, INT_MIN),
 };
-CU_Theory((dds_entity_t writer), ddsc_get_offered_deadline_missed_status, bad_params)
+CU_Theory((dds_entity_t writer), ddsc_get_offered_deadline_missed_status, bad_params, .init=init_entity_status, .fini=fini_entity_status)
 {
     dds_offered_deadline_missed_status_t status;
     dds_entity_t exp = DDS_RETCODE_BAD_PARAMETER * -1;
@@ -1022,15 +1022,15 @@ CU_Test(ddsc_get_offered_deadline_missed_status, deleted_writer, .init=init_enti
 {
     dds_delete(wri);
     ret = dds_get_offered_deadline_missed_status(wri, NULL);
-    CU_ASSERT_EQUAL_FATAL(dds_err_nr(ret), DDS_RETCODE_ALREADY_DELETED);
+    CU_ASSERT_EQUAL_FATAL(dds_err_nr(ret), DDS_RETCODE_BAD_PARAMETER);
 }
 /*************************************************************************************************/
 
 /*************************************************************************************************/
 CU_TheoryDataPoints(ddsc_get_offered_incompatible_qos_status, bad_params) = {
-        CU_DataPoints(dds_entity_t, -2, -1, 0, 1, 100, INT_MAX, INT_MIN),
+        CU_DataPoints(dds_entity_t, -2, -1, 0, INT_MAX, INT_MIN),
 };
-CU_Theory((dds_entity_t writer), ddsc_get_offered_incompatible_qos_status, bad_params)
+CU_Theory((dds_entity_t writer), ddsc_get_offered_incompatible_qos_status, bad_params, .init=init_entity_status, .fini=fini_entity_status)
 {
     dds_offered_incompatible_qos_status_t status;
     dds_entity_t exp = DDS_RETCODE_BAD_PARAMETER * -1;
@@ -1065,15 +1065,15 @@ CU_Test(ddsc_get_offered_incompatible_qos_status, deleted_writer, .init=init_ent
 {
     dds_delete(wri);
     ret = dds_get_offered_incompatible_qos_status(wri, NULL);
-    CU_ASSERT_EQUAL_FATAL(dds_err_nr(ret), DDS_RETCODE_ALREADY_DELETED);
+    CU_ASSERT_EQUAL_FATAL(dds_err_nr(ret), DDS_RETCODE_BAD_PARAMETER);
 }
 /*************************************************************************************************/
 
 /*************************************************************************************************/
 CU_TheoryDataPoints(ddsc_get_subscription_matched_status, bad_params) = {
-        CU_DataPoints(dds_entity_t, -2, -1, 0, 1, 100, INT_MAX, INT_MIN),
+        CU_DataPoints(dds_entity_t, -2, -1, 0, INT_MAX, INT_MIN),
 };
-CU_Theory((dds_entity_t reader), ddsc_get_subscription_matched_status, bad_params)
+CU_Theory((dds_entity_t reader), ddsc_get_subscription_matched_status, bad_params, .init=init_entity_status, .fini=fini_entity_status)
 {
     dds_subscription_matched_status_t status;
     dds_entity_t exp = DDS_RETCODE_BAD_PARAMETER * -1;
@@ -1108,15 +1108,15 @@ CU_Test(ddsc_get_subscription_matched_status, deleted_reader, .init=init_entity_
 {
     dds_delete(rea);
     ret = dds_get_subscription_matched_status(rea, NULL);
-    CU_ASSERT_EQUAL_FATAL(dds_err_nr(ret), DDS_RETCODE_ALREADY_DELETED);
+    CU_ASSERT_EQUAL_FATAL(dds_err_nr(ret), DDS_RETCODE_BAD_PARAMETER);
 }
 /*************************************************************************************************/
 
 /*************************************************************************************************/
 CU_TheoryDataPoints(ddsc_get_liveliness_changed_status, bad_params) = {
-        CU_DataPoints(dds_entity_t, -2, -1, 0, 1, 100, INT_MAX, INT_MIN),
+        CU_DataPoints(dds_entity_t, -2, -1, 0, INT_MAX, INT_MIN),
 };
-CU_Theory((dds_entity_t reader), ddsc_get_liveliness_changed_status, bad_params)
+CU_Theory((dds_entity_t reader), ddsc_get_liveliness_changed_status, bad_params, .init=init_entity_status, .fini=fini_entity_status)
 {
     dds_liveliness_changed_status_t status;
     dds_entity_t exp = DDS_RETCODE_BAD_PARAMETER * -1;
@@ -1151,15 +1151,15 @@ CU_Test(ddsc_get_liveliness_changed_status, deleted_reader, .init=init_entity_st
 {
     dds_delete(rea);
     ret = dds_get_liveliness_changed_status(rea, NULL);
-    CU_ASSERT_EQUAL_FATAL(dds_err_nr(ret), DDS_RETCODE_ALREADY_DELETED);
+    CU_ASSERT_EQUAL_FATAL(dds_err_nr(ret), DDS_RETCODE_BAD_PARAMETER);
 }
 /*************************************************************************************************/
 
 /*************************************************************************************************/
 CU_TheoryDataPoints(ddsc_get_sample_rejected_status, bad_params) = {
-        CU_DataPoints(dds_entity_t, -2, -1, 0, 1, 100, INT_MAX, INT_MIN),
+        CU_DataPoints(dds_entity_t, -2, -1, 0, INT_MAX, INT_MIN),
 };
-CU_Theory((dds_entity_t reader), ddsc_get_sample_rejected_status, bad_params)
+CU_Theory((dds_entity_t reader), ddsc_get_sample_rejected_status, bad_params, .init=init_entity_status, .fini=fini_entity_status)
 {
     dds_sample_rejected_status_t status;
     dds_entity_t exp = DDS_RETCODE_BAD_PARAMETER * -1;
@@ -1194,15 +1194,15 @@ CU_Test(ddsc_get_sample_rejected_status, deleted_reader, .init=init_entity_statu
 {
     dds_delete(rea);
     ret = dds_get_sample_rejected_status(rea, NULL);
-    CU_ASSERT_EQUAL_FATAL(dds_err_nr(ret), DDS_RETCODE_ALREADY_DELETED);
+    CU_ASSERT_EQUAL_FATAL(dds_err_nr(ret), DDS_RETCODE_BAD_PARAMETER);
 }
 /*************************************************************************************************/
 
 /*************************************************************************************************/
 CU_TheoryDataPoints(ddsc_get_sample_lost_status, bad_params) = {
-        CU_DataPoints(dds_entity_t, -2, -1, 0, 1, 100, INT_MAX, INT_MIN),
+        CU_DataPoints(dds_entity_t, -2, -1, 0, INT_MAX, INT_MIN),
 };
-CU_Theory((dds_entity_t reader), ddsc_get_sample_lost_status, bad_params)
+CU_Theory((dds_entity_t reader), ddsc_get_sample_lost_status, bad_params, .init=init_entity_status, .fini=fini_entity_status)
 {
     dds_sample_lost_status_t status;
     dds_entity_t exp = DDS_RETCODE_BAD_PARAMETER * -1;
@@ -1237,7 +1237,7 @@ CU_Test(ddsc_get_sample_lost_status, deleted_reader, .init=init_entity_status, .
 {
     dds_delete(rea);
     ret = dds_get_sample_lost_status(rea, NULL);
-    CU_ASSERT_EQUAL_FATAL(dds_err_nr(ret), DDS_RETCODE_ALREADY_DELETED);
+    CU_ASSERT_EQUAL_FATAL(dds_err_nr(ret), DDS_RETCODE_BAD_PARAMETER);
 }
 /*************************************************************************************************/
 
@@ -1255,9 +1255,9 @@ CU_Test(ddsc_get_requested_deadline_missed_status, requested_deadline_missed_sta
 
 /*************************************************************************************************/
 CU_TheoryDataPoints(ddsc_get_requested_deadline_missed_status, bad_params) = {
-        CU_DataPoints(dds_entity_t, -2, -1, 0, 1, 100, INT_MAX, INT_MIN),
+        CU_DataPoints(dds_entity_t, -2, -1, 0, INT_MAX, INT_MIN),
 };
-CU_Theory((dds_entity_t reader), ddsc_get_requested_deadline_missed_status, bad_params)
+CU_Theory((dds_entity_t reader), ddsc_get_requested_deadline_missed_status, bad_params, .init=init_entity_status, .fini=fini_entity_status)
 {
     dds_requested_deadline_missed_status_t status;
     dds_entity_t exp = DDS_RETCODE_BAD_PARAMETER * -1;
@@ -1292,15 +1292,15 @@ CU_Test(ddsc_get_requested_deadline_missed_status, deleted_reader, .init=init_en
 {
     dds_delete(rea);
     ret = dds_get_requested_deadline_missed_status(rea, NULL);
-    CU_ASSERT_EQUAL_FATAL(dds_err_nr(ret), DDS_RETCODE_ALREADY_DELETED);
+    CU_ASSERT_EQUAL_FATAL(dds_err_nr(ret), DDS_RETCODE_BAD_PARAMETER);
 }
 /*************************************************************************************************/
 
 /*************************************************************************************************/
 CU_TheoryDataPoints(ddsc_get_requested_incompatible_qos_status, bad_params) = {
-        CU_DataPoints(dds_entity_t, -2, -1, 0, 1, 100, INT_MAX, INT_MIN),
+        CU_DataPoints(dds_entity_t, -2, -1, 0, INT_MAX, INT_MIN),
 };
-CU_Theory((dds_entity_t reader), ddsc_get_requested_incompatible_qos_status, bad_params)
+CU_Theory((dds_entity_t reader), ddsc_get_requested_incompatible_qos_status, bad_params, .init=init_entity_status, .fini=fini_entity_status)
 {
     dds_requested_incompatible_qos_status_t status;
     dds_entity_t exp = DDS_RETCODE_BAD_PARAMETER * -1;
@@ -1335,7 +1335,7 @@ CU_Test(ddsc_get_requested_incompatible_qos_status, deleted_reader, .init=init_e
 {
     dds_delete(rea);
     ret = dds_get_requested_incompatible_qos_status(rea, NULL);
-    CU_ASSERT_EQUAL_FATAL(dds_err_nr(ret), DDS_RETCODE_ALREADY_DELETED);
+    CU_ASSERT_EQUAL_FATAL(dds_err_nr(ret), DDS_RETCODE_BAD_PARAMETER);
 }
 /*************************************************************************************************/
 
diff --git a/src/core/ddsc/tests/file_id.c b/src/core/ddsc/tests/file_id.c
deleted file mode 100644
index a2ce5b8..0000000
--- a/src/core/ddsc/tests/file_id.c
+++ /dev/null
@@ -1,37 +0,0 @@
-/*
- * Copyright(c) 2006 to 2018 ADLINK Technology Limited and others
- *
- * This program and the accompanying materials are made available under the
- * terms of the Eclipse Public License v. 2.0 which is available at
- * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
- * v. 1.0 which is available at
- * http://www.eclipse.org/org/documents/edl-v10.php.
- *
- * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
- */
-#include "dds/dds.h"
-#include "CUnit/Test.h"
-
-#include "dds/ddsrt/misc.h"
-
-CU_Test(ddsc_err, unique_file_id)
-{
-  dds_entity_t participant, reader, writer;
-
-  participant = dds_create_participant(DDS_DOMAIN_DEFAULT, NULL, NULL);
-  CU_ASSERT_FATAL(participant > 0);
-
-  /* Disable SAL warning on intentional misuse of the API */
-  DDSRT_WARNING_MSVC_OFF(28020);
-  reader = dds_create_reader(0, 0, NULL, NULL);
-  CU_ASSERT_FATAL(reader < 0);
-
-  writer = dds_create_writer(0, 0, NULL, NULL);
-  CU_ASSERT_FATAL(writer < 0);
-
-  DDSRT_WARNING_MSVC_ON(28020);
-
-  CU_ASSERT_NOT_EQUAL_FATAL(dds_err_file_id(reader), dds_err_file_id(writer));
-
-  dds_delete(participant);
-}
diff --git a/src/core/ddsc/tests/publisher.c b/src/core/ddsc/tests/publisher.c
index 5ea49d3..78c5bb1 100644
--- a/src/core/ddsc/tests/publisher.c
+++ b/src/core/ddsc/tests/publisher.c
@@ -42,7 +42,7 @@ CU_Test(ddsc_publisher, create)
 
   /* Use NULL participant */
   publisher = dds_create_publisher(0, NULL, NULL);
-  CU_ASSERT_EQUAL_FATAL(dds_err_nr(publisher), DDS_RETCODE_BAD_PARAMETER);
+  CU_ASSERT_EQUAL_FATAL(dds_err_nr(publisher), DDS_RETCODE_PRECONDITION_NOT_MET);
 
   participant = dds_create_participant (DDS_DOMAIN_DEFAULT, NULL, NULL);
   CU_ASSERT_FATAL(participant >  0);
@@ -143,21 +143,21 @@ CU_Test(ddsc_publisher, suspend_resume)
 
   /* Suspend a 0 publisher */
   status = dds_suspend(0);
-  cu_assert_status_eq(status, DDS_RETCODE_BAD_PARAMETER);
+  cu_assert_status_eq(status, DDS_RETCODE_PRECONDITION_NOT_MET);
 
   /* Resume a 0 publisher */
   status = dds_resume(0);
-  cu_assert_status_eq(status, DDS_RETCODE_BAD_PARAMETER);
+  cu_assert_status_eq(status, DDS_RETCODE_PRECONDITION_NOT_MET);
 
   /* Uae dds_suspend on something else than a publisher */
   participant = dds_create_participant (DDS_DOMAIN_DEFAULT, NULL, NULL);
   CU_ASSERT_FATAL(participant > 0);
   status = dds_suspend(participant);
-  cu_assert_status_eq(status, DDS_RETCODE_BAD_PARAMETER);
+  cu_assert_status_eq(status, DDS_RETCODE_ILLEGAL_OPERATION);
 
   /* Use dds_resume on something else than a publisher */
   status = dds_resume(participant);
-  cu_assert_status_eq(status, DDS_RETCODE_BAD_PARAMETER);
+  cu_assert_status_eq(status, DDS_RETCODE_ILLEGAL_OPERATION);
 
   /* Use dds_resume without calling dds_suspend */
   publisher = dds_create_publisher(participant, NULL, NULL);
@@ -193,15 +193,15 @@ CU_Test(ddsc_publisher, wait_for_acks)
 
   /* Wait_for_acks on NULL publisher or writer and zeroSec timeout */
   status = dds_wait_for_acks(0, zeroSec);
-  cu_assert_status_eq(status, DDS_RETCODE_BAD_PARAMETER);
+  cu_assert_status_eq(status, DDS_RETCODE_PRECONDITION_NOT_MET);
 
   /* wait_for_acks on NULL publisher or writer and oneSec timeout */
   status = dds_wait_for_acks(0, oneSec);
-  cu_assert_status_eq(status, DDS_RETCODE_BAD_PARAMETER);
+  cu_assert_status_eq(status, DDS_RETCODE_PRECONDITION_NOT_MET);
 
   /* wait_for_acks on NULL publisher or writer and DDS_INFINITE timeout */
   status = dds_wait_for_acks(0, DDS_INFINITY);
-  cu_assert_status_eq(status, DDS_RETCODE_BAD_PARAMETER);
+  cu_assert_status_eq(status, DDS_RETCODE_PRECONDITION_NOT_MET);
 
   participant = dds_create_participant (DDS_DOMAIN_DEFAULT, NULL, NULL);
   CU_ASSERT_FATAL(participant > 0);
@@ -212,22 +212,23 @@ CU_Test(ddsc_publisher, wait_for_acks)
 
   /* Wait_for_acks on participant and zeroSec timeout */
   status = dds_wait_for_acks(participant, zeroSec);
-  cu_assert_status_eq(status, DDS_RETCODE_BAD_PARAMETER);
+  cu_assert_status_eq(status, DDS_RETCODE_ILLEGAL_OPERATION);
 
   /* Wait_for_acks on participant and oneSec timeout */
   status = dds_wait_for_acks(participant, oneSec);
-  cu_assert_status_eq(status, DDS_RETCODE_BAD_PARAMETER);
+  cu_assert_status_eq(status, DDS_RETCODE_ILLEGAL_OPERATION);
 
   /* Wait_for_acks on participant and DDS_INFINITE timeout */
   status = dds_wait_for_acks(participant, DDS_INFINITY);
-  cu_assert_status_eq(status, DDS_RETCODE_BAD_PARAMETER);
+  cu_assert_status_eq(status, DDS_RETCODE_ILLEGAL_OPERATION);
 
   publisher = dds_create_publisher(participant, NULL, NULL);
   CU_ASSERT_FATAL(publisher > 0);
 
-  /* Wait_for_acks on publisher and minusOneSec timeout */
+  /* Wait_for_acks on publisher and minusOneSec timeout --
+     either BAD_PARAMETER or UNSUPPORTED would be both be ok, really */
   status = dds_wait_for_acks(publisher, minusOneSec);
-  cu_assert_status_eq(status, DDS_RETCODE_UNSUPPORTED);
+  cu_assert_status_eq(status, DDS_RETCODE_BAD_PARAMETER);
 
   /* Wait_for_acks on publisher and zeroSec timeout */
   status = dds_wait_for_acks(publisher, zeroSec);
@@ -248,7 +249,7 @@ CU_Test(ddsc_publisher, wait_for_acks)
 
   /* Wait_for_acks on suspended publisher and minusOneSec timeout */
   status = dds_wait_for_acks(publisher, minusOneSec);
-  cu_assert_status_eq(status, DDS_RETCODE_UNSUPPORTED);
+  cu_assert_status_eq(status, DDS_RETCODE_BAD_PARAMETER);
 
   /* Wait_for_acks on suspended publisher and zeroSec timeout */
   status = dds_wait_for_acks(publisher, zeroSec);
diff --git a/src/core/ddsc/tests/querycondition.c b/src/core/ddsc/tests/querycondition.c
index 1638a79..107fdd1 100644
--- a/src/core/ddsc/tests/querycondition.c
+++ b/src/core/ddsc/tests/querycondition.c
@@ -245,13 +245,13 @@ CU_Test(ddsc_querycondition_create, deleted_reader, .init=querycondition_init, .
     dds_entity_t cond;
     dds_delete(g_reader);
     cond = dds_create_querycondition(g_reader, mask, filter_mod2);
-    CU_ASSERT_EQUAL_FATAL(dds_err_nr(cond), DDS_RETCODE_ALREADY_DELETED);
+    CU_ASSERT_EQUAL_FATAL(dds_err_nr(cond), DDS_RETCODE_BAD_PARAMETER);
 }
 /*************************************************************************************************/
 
 /*************************************************************************************************/
 CU_TheoryDataPoints(ddsc_querycondition_create, invalid_readers) = {
-        CU_DataPoints(dds_entity_t, -2, -1, 0, 1, 100, INT_MAX, INT_MIN),
+        CU_DataPoints(dds_entity_t, -2, -1, 0, INT_MAX, INT_MIN),
 };
 CU_Theory((dds_entity_t rdr), ddsc_querycondition_create, invalid_readers, .init=querycondition_init, .fini=querycondition_fini)
 {
@@ -297,7 +297,7 @@ CU_Test(ddsc_querycondition_get_mask, deleted, .init=querycondition_init, .fini=
     dds_delete(condition);
     mask = 0;
     ret = dds_get_mask(condition, &mask);
-    CU_ASSERT_EQUAL_FATAL(dds_err_nr(ret), DDS_RETCODE_ALREADY_DELETED);
+    CU_ASSERT_EQUAL_FATAL(dds_err_nr(ret), DDS_RETCODE_BAD_PARAMETER);
 }
 /*************************************************************************************************/
 
@@ -319,7 +319,7 @@ CU_Test(ddsc_querycondition_get_mask, null, .init=querycondition_init, .fini=que
 
 /*************************************************************************************************/
 CU_TheoryDataPoints(ddsc_querycondition_get_mask, invalid_conditions) = {
-        CU_DataPoints(dds_entity_t, -2, -1, 0, 1, 100, INT_MAX, INT_MIN),
+        CU_DataPoints(dds_entity_t, -2, -1, 0, INT_MAX, INT_MIN),
 };
 CU_Theory((dds_entity_t cond), ddsc_querycondition_get_mask, invalid_conditions, .init=querycondition_init, .fini=querycondition_fini)
 {
@@ -924,7 +924,7 @@ CU_Test(ddsc_querycondition_read, already_deleted, .init=querycondition_init, .f
 
     /* Try to read with a deleted condition. */
     ret = dds_read(condition, g_samples, g_info, MAX_SAMPLES, MAX_SAMPLES);
-    CU_ASSERT_EQUAL_FATAL(dds_err_nr(ret), DDS_RETCODE_ALREADY_DELETED);
+    CU_ASSERT_EQUAL_FATAL(dds_err_nr(ret), DDS_RETCODE_BAD_PARAMETER);
 }
 /*************************************************************************************************/
 
@@ -1487,7 +1487,7 @@ CU_Test(ddsc_querycondition_take, already_deleted, .init=querycondition_init, .f
 
     /* Try to take with a deleted condition. */
     ret = dds_take(condition, g_samples, g_info, MAX_SAMPLES, MAX_SAMPLES);
-    CU_ASSERT_EQUAL(dds_err_nr(ret), DDS_RETCODE_ALREADY_DELETED);
+    CU_ASSERT_EQUAL(dds_err_nr(ret), DDS_RETCODE_BAD_PARAMETER);
 }
 /*************************************************************************************************/
 
diff --git a/src/core/ddsc/tests/read_instance.c b/src/core/ddsc/tests/read_instance.c
index 7ef1384..063d003 100644
--- a/src/core/ddsc/tests/read_instance.c
+++ b/src/core/ddsc/tests/read_instance.c
@@ -450,7 +450,7 @@ CU_Theory((dds_entity_t *rdr, dds_instance_handle_t hdl), ddsc_read_instance_mas
  *************************************************************************************************/
 /*************************************************************************************************/
 CU_TheoryDataPoints(ddsc_read_instance, invalid_readers) = {
-        CU_DataPoints(dds_entity_t, -2, -1, 0, 1, 100, INT_MAX, INT_MIN),
+        CU_DataPoints(dds_entity_t, -2, -1, 0, INT_MAX, INT_MIN),
 };
 CU_Theory((dds_entity_t rdr), ddsc_read_instance, invalid_readers, .init=read_instance_init, .fini=read_instance_fini)
 {
@@ -464,7 +464,7 @@ CU_Theory((dds_entity_t rdr), ddsc_read_instance, invalid_readers, .init=read_in
 
 /*************************************************************************************************/
 CU_TheoryDataPoints(ddsc_read_instance_wl, invalid_readers) = {
-        CU_DataPoints(dds_entity_t, -2, -1, 0, 1, 100, INT_MAX, INT_MIN),
+        CU_DataPoints(dds_entity_t, -2, -1, 0, INT_MAX, INT_MIN),
 };
 CU_Theory((dds_entity_t rdr), ddsc_read_instance_wl, invalid_readers, .init=read_instance_init, .fini=read_instance_fini)
 {
@@ -478,7 +478,7 @@ CU_Theory((dds_entity_t rdr), ddsc_read_instance_wl, invalid_readers, .init=read
 
 /*************************************************************************************************/
 CU_TheoryDataPoints(ddsc_read_instance_mask, invalid_readers) = {
-        CU_DataPoints(dds_entity_t, -2, -1, 0, 1, 100, INT_MAX, INT_MIN),
+        CU_DataPoints(dds_entity_t, -2, -1, 0, INT_MAX, INT_MIN),
 };
 CU_Theory((dds_entity_t rdr), ddsc_read_instance_mask, invalid_readers, .init=read_instance_init, .fini=read_instance_fini)
 {
@@ -493,7 +493,7 @@ CU_Theory((dds_entity_t rdr), ddsc_read_instance_mask, invalid_readers, .init=re
 
 /*************************************************************************************************/
 CU_TheoryDataPoints(ddsc_read_instance_mask_wl, invalid_readers) = {
-        CU_DataPoints(dds_entity_t, -2, -1, 0, 1, 100, INT_MAX, INT_MIN),
+        CU_DataPoints(dds_entity_t, -2, -1, 0, INT_MAX, INT_MIN),
 };
 CU_Theory((dds_entity_t rdr), ddsc_read_instance_mask_wl, invalid_readers, .init=read_instance_init, .fini=read_instance_fini)
 {
@@ -586,7 +586,7 @@ CU_Theory((dds_entity_t *rdr), ddsc_read_instance, already_deleted, .init=read_i
     ret = dds_delete(*rdr);
     CU_ASSERT_EQUAL_FATAL(ret, DDS_RETCODE_OK);
     ret = dds_read_instance(*rdr, g_samples, g_info, MAX_SAMPLES, MAX_SAMPLES, g_hdl_valid);
-    CU_ASSERT_EQUAL_FATAL(dds_err_nr(ret), DDS_RETCODE_ALREADY_DELETED);
+    CU_ASSERT_EQUAL_FATAL(dds_err_nr(ret), DDS_RETCODE_BAD_PARAMETER);
 }
 /*************************************************************************************************/
 
@@ -600,7 +600,7 @@ CU_Theory((dds_entity_t *rdr), ddsc_read_instance_wl, already_deleted, .init=rea
     ret = dds_delete(*rdr);
     CU_ASSERT_EQUAL_FATAL(ret, DDS_RETCODE_OK);
     ret = dds_read_instance_wl(*rdr, g_loans, g_info, MAX_SAMPLES, g_hdl_valid);
-    CU_ASSERT_EQUAL_FATAL(dds_err_nr(ret), DDS_RETCODE_ALREADY_DELETED);
+    CU_ASSERT_EQUAL_FATAL(dds_err_nr(ret), DDS_RETCODE_BAD_PARAMETER);
 }
 /*************************************************************************************************/
 
@@ -615,7 +615,7 @@ CU_Theory((dds_entity_t *rdr), ddsc_read_instance_mask, already_deleted, .init=r
     ret = dds_delete(*rdr);
     CU_ASSERT_EQUAL_FATAL(ret, DDS_RETCODE_OK);
     ret = dds_read_instance_mask(*rdr, g_samples, g_info, MAX_SAMPLES, MAX_SAMPLES, g_hdl_valid, mask);
-    CU_ASSERT_EQUAL_FATAL(dds_err_nr(ret), DDS_RETCODE_ALREADY_DELETED);
+    CU_ASSERT_EQUAL_FATAL(dds_err_nr(ret), DDS_RETCODE_BAD_PARAMETER);
 }
 /*************************************************************************************************/
 
@@ -630,7 +630,7 @@ CU_Theory((dds_entity_t *rdr), ddsc_read_instance_mask_wl, already_deleted, .ini
     ret = dds_delete(*rdr);
     CU_ASSERT_EQUAL_FATAL(ret, DDS_RETCODE_OK);
     ret = dds_read_instance_mask_wl(*rdr, g_loans, g_info, MAX_SAMPLES, g_hdl_valid, mask);
-    CU_ASSERT_EQUAL_FATAL(dds_err_nr(ret), DDS_RETCODE_ALREADY_DELETED);
+    CU_ASSERT_EQUAL_FATAL(dds_err_nr(ret), DDS_RETCODE_BAD_PARAMETER);
 }
 /*************************************************************************************************/
 
diff --git a/src/core/ddsc/tests/readcondition.c b/src/core/ddsc/tests/readcondition.c
index 534f51c..694d463 100644
--- a/src/core/ddsc/tests/readcondition.c
+++ b/src/core/ddsc/tests/readcondition.c
@@ -227,13 +227,13 @@ CU_Test(ddsc_readcondition_create, deleted_reader, .init=readcondition_init, .fi
     dds_entity_t cond;
     dds_delete(g_reader);
     cond = dds_create_readcondition(g_reader, mask);
-    CU_ASSERT_EQUAL_FATAL(dds_err_nr(cond), DDS_RETCODE_ALREADY_DELETED);
+    CU_ASSERT_EQUAL_FATAL(dds_err_nr(cond), DDS_RETCODE_BAD_PARAMETER);
 }
 /*************************************************************************************************/
 
 /*************************************************************************************************/
 CU_TheoryDataPoints(ddsc_readcondition_create, invalid_readers) = {
-        CU_DataPoints(dds_entity_t, -2, -1, 0, 1, 100, INT_MAX, INT_MIN),
+        CU_DataPoints(dds_entity_t, -2, -1, 0, INT_MAX, INT_MIN),
 };
 CU_Theory((dds_entity_t rdr), ddsc_readcondition_create, invalid_readers, .init=readcondition_init, .fini=readcondition_fini)
 {
@@ -279,7 +279,7 @@ CU_Test(ddsc_readcondition_get_mask, deleted, .init=readcondition_init, .fini=re
     dds_delete(condition);
     mask = 0;
     ret = dds_get_mask(condition, &mask);
-    CU_ASSERT_EQUAL_FATAL(dds_err_nr(ret), DDS_RETCODE_ALREADY_DELETED);
+    CU_ASSERT_EQUAL_FATAL(dds_err_nr(ret), DDS_RETCODE_BAD_PARAMETER);
 }
 /*************************************************************************************************/
 
@@ -301,7 +301,7 @@ CU_Test(ddsc_readcondition_get_mask, null, .init=readcondition_init, .fini=readc
 
 /*************************************************************************************************/
 CU_TheoryDataPoints(ddsc_readcondition_get_mask, invalid_conditions) = {
-        CU_DataPoints(dds_entity_t, -2, -1, 0, 1, 100, INT_MAX, INT_MIN),
+        CU_DataPoints(dds_entity_t, -2, -1, 0, INT_MAX, INT_MIN),
 };
 CU_Theory((dds_entity_t cond), ddsc_readcondition_get_mask, invalid_conditions, .init=readcondition_init, .fini=readcondition_fini)
 {
@@ -906,7 +906,7 @@ CU_Test(ddsc_readcondition_read, already_deleted, .init=readcondition_init, .fin
 
     /* Try to read with a deleted condition. */
     ret = dds_read(condition, g_samples, g_info, MAX_SAMPLES, MAX_SAMPLES);
-    CU_ASSERT_EQUAL_FATAL(dds_err_nr(ret), DDS_RETCODE_ALREADY_DELETED);
+    CU_ASSERT_EQUAL_FATAL(dds_err_nr(ret), DDS_RETCODE_BAD_PARAMETER);
 }
 /*************************************************************************************************/
 
@@ -1462,7 +1462,7 @@ CU_Test(ddsc_readcondition_take, already_deleted, .init=readcondition_init, .fin
 
     /* Try to take with a deleted condition. */
     ret = dds_take(condition, g_samples, g_info, MAX_SAMPLES, MAX_SAMPLES);
-    CU_ASSERT_EQUAL_FATAL(dds_err_nr(ret), DDS_RETCODE_ALREADY_DELETED);
+    CU_ASSERT_EQUAL_FATAL(dds_err_nr(ret), DDS_RETCODE_BAD_PARAMETER);
 }
 /*************************************************************************************************/
 
diff --git a/src/core/ddsc/tests/reader.c b/src/core/ddsc/tests/reader.c
index 4698172..ad80be7 100644
--- a/src/core/ddsc/tests/reader.c
+++ b/src/core/ddsc/tests/reader.c
@@ -316,7 +316,7 @@ CU_Theory((void **buf, dds_sample_info_t *si, size_t bufsz, uint32_t maxs), ddsc
 
 /*************************************************************************************************/
 CU_TheoryDataPoints(ddsc_read, invalid_readers) = {
-        CU_DataPoints(dds_entity_t, -2, -1, 0, 1, 100, INT_MAX, INT_MIN),
+        CU_DataPoints(dds_entity_t, -2, -1, 0, INT_MAX, INT_MIN),
 };
 CU_Theory((dds_entity_t rdr), ddsc_read, invalid_readers, .init=reader_init, .fini=reader_fini)
 {
@@ -347,7 +347,7 @@ CU_Test(ddsc_read, already_deleted, .init=reader_init, .fini=reader_fini)
     /* Try to read with a deleted reader. */
     dds_delete(g_reader);
     ret = dds_read(g_reader, g_samples, g_info, MAX_SAMPLES, MAX_SAMPLES);
-    CU_ASSERT_EQUAL(dds_err_nr(ret), DDS_RETCODE_ALREADY_DELETED);
+    CU_ASSERT_EQUAL(dds_err_nr(ret), DDS_RETCODE_BAD_PARAMETER);
 }
 /*************************************************************************************************/
 
@@ -426,7 +426,7 @@ CU_Theory((void **buf, dds_sample_info_t *si, uint32_t maxs), ddsc_read_wl, inva
 
 /*************************************************************************************************/
 CU_TheoryDataPoints(ddsc_read_wl, invalid_readers) = {
-        CU_DataPoints(dds_entity_t, -2, -1, 0, 1, 100, INT_MAX, INT_MIN),
+        CU_DataPoints(dds_entity_t, -2, -1, 0, INT_MAX, INT_MIN),
 };
 CU_Theory((dds_entity_t rdr), ddsc_read_wl, invalid_readers, .init=reader_init, .fini=reader_fini)
 {
@@ -457,7 +457,7 @@ CU_Test(ddsc_read_wl, already_deleted, .init=reader_init, .fini=reader_fini)
     /* Try to read with a deleted reader. */
     dds_delete(g_reader);
     ret = dds_read_wl(g_reader, g_loans, g_info, MAX_SAMPLES);
-    CU_ASSERT_EQUAL(dds_err_nr(ret), DDS_RETCODE_ALREADY_DELETED);
+    CU_ASSERT_EQUAL(dds_err_nr(ret), DDS_RETCODE_BAD_PARAMETER);
 }
 /*************************************************************************************************/
 
@@ -550,7 +550,7 @@ CU_Theory((void **buf, dds_sample_info_t *si, size_t bufsz, uint32_t maxs), ddsc
 
 /*************************************************************************************************/
 CU_TheoryDataPoints(ddsc_read_mask, invalid_readers) = {
-        CU_DataPoints(dds_entity_t, -2, -1, 0, 1, 100, INT_MAX, INT_MIN),
+        CU_DataPoints(dds_entity_t, -2, -1, 0, INT_MAX, INT_MIN),
 };
 CU_Theory((dds_entity_t rdr), ddsc_read_mask, invalid_readers, .init=reader_init, .fini=reader_fini)
 {
@@ -584,7 +584,7 @@ CU_Test(ddsc_read_mask, already_deleted, .init=reader_init, .fini=reader_fini)
     /* Try to read with a deleted reader. */
     dds_delete(g_reader);
     ret = dds_read_mask(g_reader, g_samples, g_info, MAX_SAMPLES, MAX_SAMPLES, mask);
-    CU_ASSERT_EQUAL(dds_err_nr(ret), DDS_RETCODE_ALREADY_DELETED);
+    CU_ASSERT_EQUAL(dds_err_nr(ret), DDS_RETCODE_BAD_PARAMETER);
 }
 /*************************************************************************************************/
 
@@ -1098,7 +1098,7 @@ CU_Theory((void **buf, dds_sample_info_t *si, uint32_t maxs), ddsc_read_mask_wl,
 
 /*************************************************************************************************/
 CU_TheoryDataPoints(ddsc_read_mask_wl, invalid_readers) = {
-        CU_DataPoints(dds_entity_t, -2, -1, 0, 1, 100, INT_MAX, INT_MIN),
+        CU_DataPoints(dds_entity_t, -2, -1, 0, INT_MAX, INT_MIN),
 };
 CU_Theory((dds_entity_t rdr), ddsc_read_mask_wl, invalid_readers, .init=reader_init, .fini=reader_fini)
 {
@@ -1132,7 +1132,7 @@ CU_Test(ddsc_read_mask_wl, already_deleted, .init=reader_init, .fini=reader_fini
     /* Try to read with a deleted reader. */
     dds_delete(g_reader);
     ret = dds_read_mask_wl(g_reader, g_loans, g_info, MAX_SAMPLES, mask);
-    CU_ASSERT_EQUAL(dds_err_nr(ret), DDS_RETCODE_ALREADY_DELETED);
+    CU_ASSERT_EQUAL(dds_err_nr(ret), DDS_RETCODE_BAD_PARAMETER);
 }
 /*************************************************************************************************/
 
@@ -1686,7 +1686,7 @@ CU_Theory((void **buf, dds_sample_info_t *si, size_t bufsz, uint32_t maxs), ddsc
 
 /*************************************************************************************************/
 CU_TheoryDataPoints(ddsc_take, invalid_readers) = {
-        CU_DataPoints(dds_entity_t, -2, -1, 0, 1, 100, INT_MAX, INT_MIN),
+        CU_DataPoints(dds_entity_t, -2, -1, 0, INT_MAX, INT_MIN),
 };
 CU_Theory((dds_entity_t rdr), ddsc_take, invalid_readers, .init=reader_init, .fini=reader_fini)
 {
@@ -1717,7 +1717,7 @@ CU_Test(ddsc_take, already_deleted, .init=reader_init, .fini=reader_fini)
     /* Try to take with a deleted reader. */
     dds_delete(g_reader);
     ret = dds_take(g_reader, g_samples, g_info, MAX_SAMPLES, MAX_SAMPLES);
-    CU_ASSERT_EQUAL(dds_err_nr(ret), DDS_RETCODE_ALREADY_DELETED);
+    CU_ASSERT_EQUAL(dds_err_nr(ret), DDS_RETCODE_BAD_PARAMETER);
 }
 /*************************************************************************************************/
 
@@ -1796,7 +1796,7 @@ CU_Theory((void **buf, dds_sample_info_t *si, uint32_t maxs), ddsc_take_wl, inva
 
 /*************************************************************************************************/
 CU_TheoryDataPoints(ddsc_take_wl, invalid_readers) = {
-        CU_DataPoints(dds_entity_t, -2, -1, 0, 1, 100, INT_MAX, INT_MIN),
+        CU_DataPoints(dds_entity_t, -2, -1, 0, INT_MAX, INT_MIN),
 };
 CU_Theory((dds_entity_t rdr), ddsc_take_wl, invalid_readers, .init=reader_init, .fini=reader_fini)
 {
@@ -1827,7 +1827,7 @@ CU_Test(ddsc_take_wl, already_deleted, .init=reader_init, .fini=reader_fini)
     /* Try to read with a deleted reader. */
     dds_delete(g_reader);
     ret = dds_take_wl(g_reader, g_loans, g_info, MAX_SAMPLES);
-    CU_ASSERT_EQUAL(dds_err_nr(ret), DDS_RETCODE_ALREADY_DELETED);
+    CU_ASSERT_EQUAL(dds_err_nr(ret), DDS_RETCODE_BAD_PARAMETER);
 }
 /*************************************************************************************************/
 
@@ -1921,7 +1921,7 @@ CU_Theory((void **buf, dds_sample_info_t *si, size_t bufsz, uint32_t maxs), ddsc
 
 /*************************************************************************************************/
 CU_TheoryDataPoints(ddsc_take_mask, invalid_readers) = {
-        CU_DataPoints(dds_entity_t, -2, -1, 0, 1, 100, INT_MAX, INT_MIN),
+        CU_DataPoints(dds_entity_t, -2, -1, 0, INT_MAX, INT_MIN),
 };
 CU_Theory((dds_entity_t rdr), ddsc_take_mask, invalid_readers, .init=reader_init, .fini=reader_fini)
 {
@@ -1955,7 +1955,7 @@ CU_Test(ddsc_take_mask, already_deleted, .init=reader_init, .fini=reader_fini)
     /* Try to read with a deleted reader. */
     dds_delete(g_reader);
     ret = dds_take_mask(g_reader, g_samples, g_info, MAX_SAMPLES, MAX_SAMPLES, mask);
-    CU_ASSERT_EQUAL(dds_err_nr(ret), DDS_RETCODE_ALREADY_DELETED);
+    CU_ASSERT_EQUAL(dds_err_nr(ret), DDS_RETCODE_BAD_PARAMETER);
 }
 /*************************************************************************************************/
 
@@ -2602,7 +2602,7 @@ CU_Theory((void **buf, dds_sample_info_t *si, uint32_t maxs), ddsc_take_mask_wl,
 
 /*************************************************************************************************/
 CU_TheoryDataPoints(ddsc_take_mask_wl, invalid_readers) = {
-        CU_DataPoints(dds_entity_t, -2, -1, 0, 1, 100, INT_MAX, INT_MIN),
+        CU_DataPoints(dds_entity_t, -2, -1, 0, INT_MAX, INT_MIN),
 };
 CU_Theory((dds_entity_t rdr), ddsc_take_mask_wl, invalid_readers, .init=reader_init, .fini=reader_fini)
 {
@@ -2636,7 +2636,7 @@ CU_Test(ddsc_take_mask_wl, already_deleted, .init=reader_init, .fini=reader_fini
     /* Try to read with a deleted reader. */
     dds_delete(g_reader);
     ret = dds_take_mask_wl(g_reader, g_loans, g_info, MAX_SAMPLES, mask);
-    CU_ASSERT_EQUAL_FATAL(dds_err_nr(ret), DDS_RETCODE_ALREADY_DELETED);
+    CU_ASSERT_EQUAL_FATAL(dds_err_nr(ret), DDS_RETCODE_BAD_PARAMETER);
 }
 /*************************************************************************************************/
 
diff --git a/src/core/ddsc/tests/reader_iterator.c b/src/core/ddsc/tests/reader_iterator.c
index 7a840ca..c0dbe6a 100644
--- a/src/core/ddsc/tests/reader_iterator.c
+++ b/src/core/ddsc/tests/reader_iterator.c
@@ -356,7 +356,7 @@ CU_Test(ddsc_read_next, reader, .init=reader_iterator_init, .fini=reader_iterato
 
 /*************************************************************************************************/
 CU_TheoryDataPoints(ddsc_read_next, invalid_readers) = {
-        CU_DataPoints(dds_entity_t, -2, -1, 0, 1, 100, INT_MAX, INT_MIN),
+        CU_DataPoints(dds_entity_t, -2, -1, 0, INT_MAX, INT_MIN),
 };
 CU_Theory((dds_entity_t rdr), ddsc_read_next, invalid_readers, .init=reader_iterator_init, .fini=reader_iterator_fini)
 {
@@ -390,7 +390,7 @@ CU_Theory((dds_entity_t *rdr), ddsc_read_next, already_deleted, .init=reader_ite
     ret = dds_delete(*rdr);
     CU_ASSERT_EQUAL_FATAL(ret, DDS_RETCODE_OK);
     ret = dds_read_next(*rdr, g_samples, g_info);
-    CU_ASSERT_EQUAL_FATAL(dds_err_nr(ret), DDS_RETCODE_ALREADY_DELETED);
+    CU_ASSERT_EQUAL_FATAL(dds_err_nr(ret), DDS_RETCODE_BAD_PARAMETER);
 }
 
 /*************************************************************************************************/
@@ -472,7 +472,7 @@ CU_Test(ddsc_read_next_wl, reader, .init=reader_iterator_init, .fini=reader_iter
 
 /*************************************************************************************************/
 CU_TheoryDataPoints(ddsc_read_next_wl, invalid_readers) = {
-        CU_DataPoints(dds_entity_t, -2, -1, 0, 1, 100, INT_MAX, INT_MIN),
+        CU_DataPoints(dds_entity_t, -2, -1, 0, INT_MAX, INT_MIN),
 };
 CU_Theory((dds_entity_t rdr), ddsc_read_next_wl, invalid_readers, .init=reader_iterator_init, .fini=reader_iterator_fini)
 {
@@ -506,7 +506,7 @@ CU_Theory((dds_entity_t *rdr), ddsc_read_next_wl, already_deleted, .init=reader_
     ret = dds_delete(*rdr);
     CU_ASSERT_EQUAL_FATAL(ret, DDS_RETCODE_OK);
     ret = dds_read_next_wl(*rdr, g_loans, g_info);
-    CU_ASSERT_EQUAL_FATAL(dds_err_nr(ret), DDS_RETCODE_ALREADY_DELETED);
+    CU_ASSERT_EQUAL_FATAL(dds_err_nr(ret), DDS_RETCODE_BAD_PARAMETER);
 }
 
 /*************************************************************************************************/
@@ -582,7 +582,7 @@ CU_Test(ddsc_take_next, reader, .init=reader_iterator_init, .fini=reader_iterato
 }
 /*************************************************************************************************/
 CU_TheoryDataPoints(ddsc_take_next, invalid_readers) = {
-        CU_DataPoints(dds_entity_t, -2, -1, 0, 1, 100, INT_MAX, INT_MIN),
+        CU_DataPoints(dds_entity_t, -2, -1, 0, INT_MAX, INT_MIN),
 };
 CU_Theory((dds_entity_t rdr), ddsc_take_next, invalid_readers, .init=reader_iterator_init, .fini=reader_iterator_fini)
 {
@@ -616,7 +616,7 @@ CU_Theory((dds_entity_t *rdr), ddsc_take_next, already_deleted, .init=reader_ite
     ret = dds_delete(*rdr);
     CU_ASSERT_EQUAL_FATAL(ret, DDS_RETCODE_OK);
     ret = dds_take_next(*rdr, g_samples, g_info);
-    CU_ASSERT_EQUAL_FATAL(dds_err_nr(ret), DDS_RETCODE_ALREADY_DELETED);
+    CU_ASSERT_EQUAL_FATAL(dds_err_nr(ret), DDS_RETCODE_BAD_PARAMETER);
 }
 
 /*************************************************************************************************/
@@ -695,7 +695,7 @@ CU_Test(ddsc_take_next_wl, reader, .init=reader_iterator_init, .fini=reader_iter
 }
 /*************************************************************************************************/
 CU_TheoryDataPoints(ddsc_take_next_wl, invalid_readers) = {
-        CU_DataPoints(dds_entity_t, -2, -1, 0, 1, 100, INT_MAX, INT_MIN),
+        CU_DataPoints(dds_entity_t, -2, -1, 0, INT_MAX, INT_MIN),
 };
 CU_Theory((dds_entity_t rdr), ddsc_take_next_wl, invalid_readers, .init=reader_iterator_init, .fini=reader_iterator_fini)
 {
@@ -729,7 +729,7 @@ CU_Theory((dds_entity_t *rdr), ddsc_take_next_wl, already_deleted, .init=reader_
     ret = dds_delete(*rdr);
     CU_ASSERT_EQUAL_FATAL(ret, DDS_RETCODE_OK);
     ret = dds_take_next_wl(*rdr, g_loans, g_info);
-    CU_ASSERT_EQUAL_FATAL(dds_err_nr(ret), DDS_RETCODE_ALREADY_DELETED);
+    CU_ASSERT_EQUAL_FATAL(dds_err_nr(ret), DDS_RETCODE_BAD_PARAMETER);
 }
 /*************************************************************************************************/
 
diff --git a/src/core/ddsc/tests/register.c b/src/core/ddsc/tests/register.c
index a075ae5..11249dd 100644
--- a/src/core/ddsc/tests/register.c
+++ b/src/core/ddsc/tests/register.c
@@ -150,7 +150,7 @@ CU_Test(ddsc_register_instance, deleted_entity, .init=registering_init, .fini=re
     dds_instance_handle_t handle;
     dds_delete(g_writer);
     ret = dds_register_instance(g_writer, &handle, g_data);
-    CU_ASSERT_EQUAL_FATAL(dds_err_nr(ret), DDS_RETCODE_ALREADY_DELETED);
+    CU_ASSERT_EQUAL_FATAL(dds_err_nr(ret), DDS_RETCODE_BAD_PARAMETER);
 }
 
 static dds_instance_handle_t hndle = 0;
@@ -173,7 +173,7 @@ CU_Theory((dds_instance_handle_t *hndl2, void *datap), ddsc_register_instance, i
 }
 
 CU_TheoryDataPoints(ddsc_register_instance, invalid_writers) = {
-        CU_DataPoints(dds_entity_t, -2, -1, 0, 1, 100, INT_MAX, INT_MIN),
+        CU_DataPoints(dds_entity_t, -2, -1, 0, INT_MAX, INT_MIN),
 };
 CU_Theory((dds_entity_t writer), ddsc_register_instance, invalid_writers, .init=registering_init, .fini=registering_fini)
 {
diff --git a/src/core/ddsc/tests/take_instance.c b/src/core/ddsc/tests/take_instance.c
index d9ef401..6fba4a6 100644
--- a/src/core/ddsc/tests/take_instance.c
+++ b/src/core/ddsc/tests/take_instance.c
@@ -447,7 +447,7 @@ CU_Theory((dds_entity_t *rdr, dds_instance_handle_t hdl), ddsc_take_instance_mas
  *************************************************************************************************/
 /*************************************************************************************************/
 CU_TheoryDataPoints(ddsc_take_instance, invalid_readers) = {
-        CU_DataPoints(dds_entity_t, -2, -1, 0, 1, 100, INT_MAX, INT_MIN),
+        CU_DataPoints(dds_entity_t, -2, -1, 0, INT_MAX, INT_MIN),
 };
 CU_Theory((dds_entity_t rdr), ddsc_take_instance, invalid_readers, .init=take_instance_init, .fini=take_instance_fini)
 {
@@ -461,7 +461,7 @@ CU_Theory((dds_entity_t rdr), ddsc_take_instance, invalid_readers, .init=take_in
 
 /*************************************************************************************************/
 CU_TheoryDataPoints(ddsc_take_instance_wl, invalid_readers) = {
-        CU_DataPoints(dds_entity_t, -2, -1, 0, 1, 100, INT_MAX, INT_MIN),
+        CU_DataPoints(dds_entity_t, -2, -1, 0, INT_MAX, INT_MIN),
 };
 CU_Theory((dds_entity_t rdr), ddsc_take_instance_wl, invalid_readers, .init=take_instance_init, .fini=take_instance_fini)
 {
@@ -475,7 +475,7 @@ CU_Theory((dds_entity_t rdr), ddsc_take_instance_wl, invalid_readers, .init=take
 
 /*************************************************************************************************/
 CU_TheoryDataPoints(ddsc_take_instance_mask, invalid_readers) = {
-        CU_DataPoints(dds_entity_t, -2, -1, 0, 1, 100, INT_MAX, INT_MIN),
+        CU_DataPoints(dds_entity_t, -2, -1, 0, INT_MAX, INT_MIN),
 };
 CU_Theory((dds_entity_t rdr), ddsc_take_instance_mask, invalid_readers, .init=take_instance_init, .fini=take_instance_fini)
 {
@@ -490,7 +490,7 @@ CU_Theory((dds_entity_t rdr), ddsc_take_instance_mask, invalid_readers, .init=ta
 
 /*************************************************************************************************/
 CU_TheoryDataPoints(ddsc_take_instance_mask_wl, invalid_readers) = {
-        CU_DataPoints(dds_entity_t, -2, -1, 0, 1, 100, INT_MAX, INT_MIN),
+        CU_DataPoints(dds_entity_t, -2, -1, 0, INT_MAX, INT_MIN),
 };
 CU_Theory((dds_entity_t rdr), ddsc_take_instance_mask_wl, invalid_readers, .init=take_instance_init, .fini=take_instance_fini)
 {
@@ -583,7 +583,7 @@ CU_Theory((dds_entity_t *rdr), ddsc_take_instance, already_deleted, .init=take_i
     ret = dds_delete(*rdr);
     CU_ASSERT_EQUAL_FATAL(ret, DDS_RETCODE_OK);
     ret = dds_take_instance(*rdr, g_samples, g_info, MAX_SAMPLES, MAX_SAMPLES, g_hdl_valid);
-    CU_ASSERT_EQUAL_FATAL(dds_err_nr(ret), DDS_RETCODE_ALREADY_DELETED);
+    CU_ASSERT_EQUAL_FATAL(dds_err_nr(ret), DDS_RETCODE_BAD_PARAMETER);
 }
 /*************************************************************************************************/
 
@@ -597,7 +597,7 @@ CU_Theory((dds_entity_t *rdr), ddsc_take_instance_wl, already_deleted, .init=tak
     ret = dds_delete(*rdr);
     CU_ASSERT_EQUAL_FATAL(ret, DDS_RETCODE_OK);
     ret = dds_take_instance_wl(*rdr, g_loans, g_info, MAX_SAMPLES, g_hdl_valid);
-    CU_ASSERT_EQUAL_FATAL(dds_err_nr(ret), DDS_RETCODE_ALREADY_DELETED);
+    CU_ASSERT_EQUAL_FATAL(dds_err_nr(ret), DDS_RETCODE_BAD_PARAMETER);
 }
 /*************************************************************************************************/
 
@@ -612,7 +612,7 @@ CU_Theory((dds_entity_t *rdr), ddsc_take_instance_mask, already_deleted, .init=t
     ret = dds_delete(*rdr);
     CU_ASSERT_EQUAL_FATAL(ret, DDS_RETCODE_OK);
     ret = dds_take_instance_mask(*rdr, g_samples, g_info, MAX_SAMPLES, MAX_SAMPLES, g_hdl_valid, mask);
-    CU_ASSERT_EQUAL_FATAL(dds_err_nr(ret), DDS_RETCODE_ALREADY_DELETED);
+    CU_ASSERT_EQUAL_FATAL(dds_err_nr(ret), DDS_RETCODE_BAD_PARAMETER);
 }
 /*************************************************************************************************/
 
@@ -627,7 +627,7 @@ CU_Theory((dds_entity_t *rdr), ddsc_take_instance_mask_wl, already_deleted, .ini
     ret = dds_delete(*rdr);
     CU_ASSERT_EQUAL_FATAL(ret, DDS_RETCODE_OK);
     ret = dds_take_instance_mask_wl(*rdr, g_loans, g_info, MAX_SAMPLES, g_hdl_valid, mask);
-    CU_ASSERT_EQUAL_FATAL(dds_err_nr(ret), DDS_RETCODE_ALREADY_DELETED);
+    CU_ASSERT_EQUAL_FATAL(dds_err_nr(ret), DDS_RETCODE_BAD_PARAMETER);
 }
 /*************************************************************************************************/
 
diff --git a/src/core/ddsc/tests/topic.c b/src/core/ddsc/tests/topic.c
index 665d38d..43dde13 100644
--- a/src/core/ddsc/tests/topic.c
+++ b/src/core/ddsc/tests/topic.c
@@ -314,7 +314,7 @@ CU_Test(ddsc_topic_get_name, deleted, .init=ddsc_topic_init, .fini=ddsc_topic_fi
     dds_return_t ret;
     dds_delete(g_topicRtmDataType);
     ret = dds_get_name(g_topicRtmDataType, name, MAX_NAME_SIZE);
-    CU_ASSERT_EQUAL_FATAL(dds_err_nr(ret), DDS_RETCODE_ALREADY_DELETED);
+    CU_ASSERT_EQUAL_FATAL(dds_err_nr(ret), DDS_RETCODE_BAD_PARAMETER);
 }
 /*************************************************************************************************/
 
@@ -387,7 +387,7 @@ CU_Test(ddsc_topic_get_type_name, deleted, .init=ddsc_topic_init, .fini=ddsc_top
     dds_return_t ret;
     dds_delete(g_topicRtmDataType);
     ret = dds_get_type_name(g_topicRtmDataType, name, MAX_NAME_SIZE);
-    CU_ASSERT_EQUAL_FATAL(dds_err_nr(ret), DDS_RETCODE_ALREADY_DELETED);
+    CU_ASSERT_EQUAL_FATAL(dds_err_nr(ret), DDS_RETCODE_BAD_PARAMETER);
 }
 /*************************************************************************************************/
 
diff --git a/src/core/ddsc/tests/unregister.c b/src/core/ddsc/tests/unregister.c
index c79cb9a..e27eb32 100644
--- a/src/core/ddsc/tests/unregister.c
+++ b/src/core/ddsc/tests/unregister.c
@@ -152,7 +152,7 @@ CU_Test(ddsc_unregister_instance, deleted, .init=unregistering_init, .fini=unreg
     dds_delete(g_writer);
 
     ret = dds_unregister_instance(g_writer, g_data);
-    CU_ASSERT_EQUAL_FATAL(dds_err_nr(ret), DDS_RETCODE_ALREADY_DELETED);
+    CU_ASSERT_EQUAL_FATAL(dds_err_nr(ret), DDS_RETCODE_BAD_PARAMETER);
 }
 /*************************************************************************************************/
 
@@ -167,7 +167,7 @@ CU_Test(ddsc_unregister_instance, null, .init=unregistering_init, .fini=unregist
 
 /*************************************************************************************************/
 CU_TheoryDataPoints(ddsc_unregister_instance, invalid_writers) = {
-        CU_DataPoints(dds_entity_t, -2, -1, 0, 1, 100, INT_MAX, INT_MIN),
+        CU_DataPoints(dds_entity_t, -2, -1, 0, INT_MAX, INT_MIN),
 };
 CU_Theory((dds_entity_t writer), ddsc_unregister_instance, invalid_writers, .init=unregistering_init, .fini=unregistering_fini)
 {
@@ -246,7 +246,7 @@ CU_Test(ddsc_unregister_instance_ts, deleted, .init=unregistering_init, .fini=un
     dds_return_t ret;
     dds_delete(g_writer);
     ret = dds_unregister_instance_ts(g_writer, g_data, g_present);
-    CU_ASSERT_EQUAL_FATAL(dds_err_nr(ret), DDS_RETCODE_ALREADY_DELETED);
+    CU_ASSERT_EQUAL_FATAL(dds_err_nr(ret), DDS_RETCODE_BAD_PARAMETER);
 }
 /*************************************************************************************************/
 
@@ -261,7 +261,7 @@ CU_Test(ddsc_unregister_instance_ts, null, .init=unregistering_init, .fini=unreg
 
 /*************************************************************************************************/
 CU_TheoryDataPoints(ddsc_unregister_instance_ts, invalid_writers) = {
-        CU_DataPoints(dds_entity_t, -2, -1, 0, 1, 100, INT_MAX, INT_MIN),
+        CU_DataPoints(dds_entity_t, -2, -1, 0, INT_MAX, INT_MIN),
 };
 CU_Theory((dds_entity_t writer), ddsc_unregister_instance_ts, invalid_writers, .init=unregistering_init, .fini=unregistering_fini)
 {
@@ -383,7 +383,7 @@ CU_Test(ddsc_unregister_instance_ih, deleted, .init=unregistering_init, .fini=un
     dds_return_t ret;
     dds_delete(g_writer);
     ret = dds_unregister_instance_ih(g_writer, DDS_HANDLE_NIL);
-    CU_ASSERT_EQUAL_FATAL(dds_err_nr(ret), DDS_RETCODE_ALREADY_DELETED);
+    CU_ASSERT_EQUAL_FATAL(dds_err_nr(ret), DDS_RETCODE_BAD_PARAMETER);
 }
 /*************************************************************************************************/
 
@@ -401,7 +401,7 @@ CU_Theory((dds_instance_handle_t handle), ddsc_unregister_instance_ih, invalid_h
 
 /*************************************************************************************************/
 CU_TheoryDataPoints(ddsc_unregister_instance_ih, invalid_writers) = {
-        CU_DataPoints(dds_entity_t, -2, -1, 0, 1, 100, INT_MAX, INT_MIN),
+        CU_DataPoints(dds_entity_t, -2, -1, 0, INT_MAX, INT_MIN),
 };
 CU_Theory((dds_entity_t writer), ddsc_unregister_instance_ih, invalid_writers, .init=unregistering_init, .fini=unregistering_fini)
 {
@@ -481,7 +481,7 @@ CU_Test(ddsc_unregister_instance_ih_ts, deleted, .init=unregistering_init, .fini
     dds_return_t ret;
     dds_delete(g_writer);
     ret = dds_unregister_instance_ih_ts(g_writer, DDS_HANDLE_NIL, g_present);
-    CU_ASSERT_EQUAL_FATAL(dds_err_nr(ret), DDS_RETCODE_ALREADY_DELETED);
+    CU_ASSERT_EQUAL_FATAL(dds_err_nr(ret), DDS_RETCODE_BAD_PARAMETER);
 }
 /*************************************************************************************************/
 
@@ -499,7 +499,7 @@ CU_Theory((dds_instance_handle_t handle), ddsc_unregister_instance_ih_ts, invali
 
 /*************************************************************************************************/
 CU_TheoryDataPoints(ddsc_unregister_instance_ih_ts, invalid_writers) = {
-        CU_DataPoints(dds_entity_t, -2, -1, 0, 1, 100, INT_MAX, INT_MIN),
+        CU_DataPoints(dds_entity_t, -2, -1, 0, INT_MAX, INT_MIN),
 };
 CU_Theory((dds_entity_t writer), ddsc_unregister_instance_ih_ts, invalid_writers, .init=unregistering_init, .fini=unregistering_fini)
 {
diff --git a/src/core/ddsc/tests/unsupported.c b/src/core/ddsc/tests/unsupported.c
index 2a15f25..68bf4a5 100644
--- a/src/core/ddsc/tests/unsupported.c
+++ b/src/core/ddsc/tests/unsupported.c
@@ -50,7 +50,7 @@ setup(void)
     CU_ASSERT_FATAL(e[REA] > 0);
     e[RCD] = dds_create_readcondition(e[REA], DDS_ANY_STATE);
     CU_ASSERT_FATAL(e[RCD] > 0);
-    e[BAD] = 1;
+    e[BAD] = 314159265;
 }
 
 static void
@@ -104,7 +104,7 @@ CU_Test(ddsc_unsupported, dds_suspend_resume, .init = setup, .fini = teardown)
     dds_return_t result;
     static struct index_result pars[] = {
         {PUB, DDS_RETCODE_UNSUPPORTED},
-        {WRI, DDS_RETCODE_BAD_PARAMETER},
+        {WRI, DDS_RETCODE_ILLEGAL_OPERATION},
         {BAD, DDS_RETCODE_BAD_PARAMETER}
     };
 
diff --git a/src/core/ddsc/tests/waitset.c b/src/core/ddsc/tests/waitset.c
index 24c9954..9c401cb 100644
--- a/src/core/ddsc/tests/waitset.c
+++ b/src/core/ddsc/tests/waitset.c
@@ -226,13 +226,13 @@ CU_Test(ddsc_waitset_create, deleted_participant, .init=ddsc_waitset_basic_init,
     deleted = dds_create_participant(DDS_DOMAIN_DEFAULT, NULL, NULL);
     dds_delete(deleted);
     ws = dds_create_waitset(deleted);
-    CU_ASSERT_EQUAL_FATAL(dds_err_nr(ws), DDS_RETCODE_ALREADY_DELETED);
+    CU_ASSERT_EQUAL_FATAL(dds_err_nr(ws), DDS_RETCODE_BAD_PARAMETER);
 }
 /*************************************************************************************************/
 
 /*************************************************************************************************/
 CU_TheoryDataPoints(ddsc_waitset_create, invalid_params) = {
-        CU_DataPoints(dds_entity_t, -2, -1, 0, 1, 100, INT_MAX, INT_MIN),
+        CU_DataPoints(dds_entity_t, -2, -1, 0, INT_MAX, INT_MIN),
 };
 CU_Theory((dds_entity_t par), ddsc_waitset_create, invalid_params, .init=ddsc_waitset_basic_init, .fini=ddsc_waitset_basic_fini)
 {
@@ -269,7 +269,7 @@ CU_Theory((dds_entity_t *par), ddsc_waitset_create, non_participants, .init=ddsc
  *************************************************************************************************/
 /*************************************************************************************************/
 CU_TheoryDataPoints(ddsc_waitset_attach, invalid_params) = {
-        CU_DataPoints(dds_entity_t, -2, -1, 0, 1, 100, INT_MAX, INT_MIN),
+        CU_DataPoints(dds_entity_t, -2, -1, 0, INT_MAX, INT_MIN),
         CU_DataPoints(dds_attach_t,  (dds_attach_t)NULL, (dds_attach_t)&reader, (dds_attach_t)3, (dds_attach_t)0, (dds_attach_t)0, (dds_attach_t)0, (dds_attach_t)0),
 };
 CU_Theory((dds_entity_t e, dds_attach_t a), ddsc_waitset_attach, invalid_params, .init=ddsc_waitset_basic_init, .fini=ddsc_waitset_basic_fini)
@@ -282,7 +282,7 @@ CU_Theory((dds_entity_t e, dds_attach_t a), ddsc_waitset_attach, invalid_params,
 
 /*************************************************************************************************/
 CU_TheoryDataPoints(ddsc_waitset_attach, invalid_waitsets) = {
-        CU_DataPoints(dds_entity_t, -2, -1, 0, 1, 100, INT_MAX, INT_MIN),
+        CU_DataPoints(dds_entity_t, -2, -1, 0, INT_MAX, INT_MIN),
         CU_DataPoints(dds_attach_t,  (dds_attach_t)NULL, (dds_attach_t)&reader, (dds_attach_t)3, (dds_attach_t)0, (dds_attach_t)0, (dds_attach_t)0, (dds_attach_t)0),
 };
 CU_Theory((dds_entity_t ws, dds_attach_t a), ddsc_waitset_attach, invalid_waitsets, .init=ddsc_waitset_basic_init, .fini=ddsc_waitset_basic_fini)
@@ -315,7 +315,7 @@ CU_Test(ddsc_waitset_attach, deleted_waitset, .init=ddsc_waitset_basic_init, .fi
     dds_return_t ret;
     dds_delete(waitset);
     ret = dds_waitset_attach(waitset, participant, 0);
-    CU_ASSERT_EQUAL_FATAL(dds_err_nr(ret), DDS_RETCODE_ALREADY_DELETED);
+    CU_ASSERT_EQUAL_FATAL(dds_err_nr(ret), DDS_RETCODE_BAD_PARAMETER);
 }
 /*************************************************************************************************/
 
@@ -393,7 +393,7 @@ CU_Test(ddsc_waitset_attach_detach, second, .init=ddsc_waitset_basic_init, .fini
  *************************************************************************************************/
 /*************************************************************************************************/
 CU_TheoryDataPoints(ddsc_waitset_detach, invalid_params) = {
-        CU_DataPoints(dds_entity_t, -2, -1, 0, 1, 100, INT_MAX, INT_MIN),
+        CU_DataPoints(dds_entity_t, -2, -1, 0, INT_MAX, INT_MIN),
 };
 CU_Theory((dds_entity_t e), ddsc_waitset_detach, invalid_params, .init=ddsc_waitset_basic_init, .fini=ddsc_waitset_basic_fini)
 {
@@ -405,7 +405,7 @@ CU_Theory((dds_entity_t e), ddsc_waitset_detach, invalid_params, .init=ddsc_wait
 
 /*************************************************************************************************/
 CU_TheoryDataPoints(ddsc_waitset_detach, invalid_waitsets) = {
-        CU_DataPoints(dds_entity_t, -2, -1, 0, 1, 100, INT_MAX, INT_MIN),
+        CU_DataPoints(dds_entity_t, -2, -1, 0, INT_MAX, INT_MIN),
 };
 CU_Theory((dds_entity_t ws), ddsc_waitset_detach, invalid_waitsets, .init=ddsc_waitset_basic_init, .fini=ddsc_waitset_basic_fini)
 {
@@ -580,13 +580,13 @@ CU_Test(ddsc_waitset_set_trigger, deleted_waitset, .init=ddsc_waitset_basic_init
     dds_return_t ret;
     dds_delete(waitset);
     ret = dds_waitset_set_trigger(waitset, true);
-    CU_ASSERT_EQUAL_FATAL(dds_err_nr(ret), DDS_RETCODE_ALREADY_DELETED);
+    CU_ASSERT_EQUAL_FATAL(dds_err_nr(ret), DDS_RETCODE_BAD_PARAMETER);
 }
 /*************************************************************************************************/
 
 /*************************************************************************************************/
 CU_TheoryDataPoints(ddsc_waitset_set_trigger, invalid_params) = {
-        CU_DataPoints(dds_entity_t, -2, -1, 0, 1, 100, INT_MAX, INT_MIN),
+        CU_DataPoints(dds_entity_t, -2, -1, 0, INT_MAX, INT_MIN),
 };
 CU_Theory((dds_entity_t ws), ddsc_waitset_set_trigger, invalid_params, .init=ddsc_waitset_basic_init, .fini=ddsc_waitset_basic_fini)
 {
@@ -625,13 +625,13 @@ CU_Test(ddsc_waitset_wait, deleted_waitset, .init=ddsc_waitset_attached_init, .f
     dds_return_t ret;
     dds_delete(waitset);
     ret = dds_waitset_wait(waitset, &triggered, 1, DDS_SECS(1));
-    CU_ASSERT_EQUAL_FATAL(dds_err_nr(ret), DDS_RETCODE_ALREADY_DELETED);
+    CU_ASSERT_EQUAL_FATAL(dds_err_nr(ret), DDS_RETCODE_BAD_PARAMETER);
 }
 /*************************************************************************************************/
 
 /*************************************************************************************************/
 CU_TheoryDataPoints(ddsc_waitset_wait, invalid_waitsets) = {
-        CU_DataPoints(dds_entity_t, -2, -1, 0, 1, 100, INT_MAX, INT_MIN),
+        CU_DataPoints(dds_entity_t, -2, -1, 0, INT_MAX, INT_MIN),
 };
 CU_Theory((dds_entity_t ws), ddsc_waitset_wait, invalid_waitsets, .init=ddsc_waitset_basic_init, .fini=ddsc_waitset_basic_fini)
 {
@@ -683,13 +683,13 @@ CU_Test(ddsc_waitset_wait_until, deleted_waitset, .init=ddsc_waitset_attached_in
     dds_return_t ret;
     dds_delete(waitset);
     ret = dds_waitset_wait_until(waitset, &triggered, 1, dds_time());
-    CU_ASSERT_EQUAL_FATAL(dds_err_nr(ret), DDS_RETCODE_ALREADY_DELETED);
+    CU_ASSERT_EQUAL_FATAL(dds_err_nr(ret), DDS_RETCODE_BAD_PARAMETER);
 }
 /*************************************************************************************************/
 
 /*************************************************************************************************/
 CU_TheoryDataPoints(ddsc_waitset_wait_until, invalid_waitsets) = {
-        CU_DataPoints(dds_entity_t, -2, -1, 0, 1, 100, INT_MAX, INT_MIN),
+        CU_DataPoints(dds_entity_t, -2, -1, 0, INT_MAX, INT_MIN),
 };
 CU_Theory((dds_entity_t ws), ddsc_waitset_wait_until, invalid_waitsets, .init=ddsc_waitset_basic_init, .fini=ddsc_waitset_basic_fini)
 {
@@ -843,13 +843,13 @@ CU_Test(ddsc_waitset_get_entities, deleted_waitset, .init=ddsc_waitset_attached_
     dds_entity_t entities[MAX_ENTITIES_CNT];
     dds_delete(waitset);
     ret = dds_waitset_get_entities(waitset, entities, MAX_ENTITIES_CNT);
-    CU_ASSERT_EQUAL_FATAL(dds_err_nr(ret), DDS_RETCODE_ALREADY_DELETED);
+    CU_ASSERT_EQUAL_FATAL(dds_err_nr(ret), DDS_RETCODE_BAD_PARAMETER);
 }
 /*************************************************************************************************/
 
 /*************************************************************************************************/
 CU_TheoryDataPoints(ddsc_waitset_get_entities, invalid_params) = {
-        CU_DataPoints(dds_entity_t, -2, -1, 0, 1, 100, INT_MAX, INT_MIN),
+        CU_DataPoints(dds_entity_t, -2, -1, 0, INT_MAX, INT_MIN),
 };
 CU_Theory((dds_entity_t ws), ddsc_waitset_get_entities, invalid_params, .init=ddsc_waitset_attached_init, .fini=ddsc_waitset_attached_fini)
 {
diff --git a/src/core/ddsc/tests/write.c b/src/core/ddsc/tests/write.c
index 93dae69..2cd3f15 100644
--- a/src/core/ddsc/tests/write.c
+++ b/src/core/ddsc/tests/write.c
@@ -95,7 +95,7 @@ CU_Test(ddsc_write, closed_writer, .init = setup, .fini = teardown)
     CU_ASSERT_EQUAL_FATAL(dds_err_nr(status), DDS_RETCODE_OK);
     status = dds_write(writer, &data);
     writer = 0;
-    CU_ASSERT_EQUAL_FATAL(dds_err_nr(status), DDS_RETCODE_ALREADY_DELETED);
+    CU_ASSERT_EQUAL_FATAL(dds_err_nr(status), DDS_RETCODE_BAD_PARAMETER);
 }
 
 CU_Test(ddsc_write, null_sample, .init = setup, .fini = teardown)
diff --git a/src/core/ddsc/tests/writer.c b/src/core/ddsc/tests/writer.c
index f738ddb..66ce1ea 100644
--- a/src/core/ddsc/tests/writer.c
+++ b/src/core/ddsc/tests/writer.c
@@ -83,7 +83,7 @@ CU_Test(ddsc_create_writer, deleted_publisher, .init = setup, .fini = teardown)
     dds_delete(publisher);
 
     writer = dds_create_writer(publisher, topic, NULL, NULL);
-    CU_ASSERT_EQUAL_FATAL(dds_err_nr(writer), DDS_RETCODE_ALREADY_DELETED);
+    CU_ASSERT_EQUAL_FATAL(dds_err_nr(writer), DDS_RETCODE_BAD_PARAMETER);
 }
 
 CU_Test(ddsc_create_writer, null_topic, .init = setup, .fini = teardown)
@@ -105,5 +105,5 @@ CU_Test(ddsc_create_writer, deleted_topic, .init = setup, .fini = teardown)
     dds_delete(topic);
 
     writer = dds_create_writer(publisher, topic, NULL, NULL);
-    CU_ASSERT_EQUAL_FATAL(dds_err_nr(writer), DDS_RETCODE_ALREADY_DELETED);
+    CU_ASSERT_EQUAL_FATAL(dds_err_nr(writer), DDS_RETCODE_BAD_PARAMETER);
 }
diff --git a/src/core/ddsi/.fileids b/src/core/ddsi/.fileids
deleted file mode 100644
index 0fd013b..0000000
--- a/src/core/ddsi/.fileids
+++ /dev/null
@@ -1,40 +0,0 @@
-# ddsi sources
-1   src/ddsi_ser.c
-2   src/ddsi_ssl.c
-3   src/ddsi_tcp.c
-4   src/ddsi_tran.c
-5   src/ddsi_udp.c
-6   src/q_addrset.c
-7   src/q_bitset_inlines.c
-8   src/q_bswap.c
-9   src/q_bswap_inlines.c
-10  src/q_config.c
-11  src/q_ddsi_discovery.c
-12  src/q_debmon.c
-13  src/q_entity.c
-14  src/q_ephash.c
-15  src/q_gc.c
-16  src/q_init.c
-17  src/q_lat_estim.c
-18  src/q_lease.c
-20  src/q_md5.c
-21  src/q_misc.c
-22  src/q_nwif.c
-23  src/q_pcap.c
-24  src/q_plist.c
-25  src/q_qosmatch.c
-26  src/q_radmin.c
-27  src/q_receive.c
-28  src/q_security.c
-29  src/q_servicelease.c
-30  src/q_sockwaitset.c
-31  src/q_thread.c
-32  src/q_thread_inlines.c
-33  src/q_time.c
-34  src/q_transmit.c
-36  src/q_xevent.c
-37  src/q_xmsg.c
-38  src/q_freelist.c
-39  src/sysdeps.c
-71  src/q_builtin_topic.c
-
diff --git a/src/core/ddsi/src/q_thread_inlines.c b/src/core/ddsi/src/q_thread_inlines.c
index 4d26a63..b16f324 100644
--- a/src/core/ddsi/src/q_thread_inlines.c
+++ b/src/core/ddsi/src/q_thread_inlines.c
@@ -19,4 +19,3 @@ extern inline void thread_state_asleep (struct thread_state1 *ts1);
 extern inline void thread_state_awake (struct thread_state1 *ts1);
 extern inline void thread_state_blocked (struct thread_state1 *ts1);
 extern inline void thread_state_unblocked (struct thread_state1 *ts1);
-
diff --git a/src/tools/pubsub/common.c b/src/tools/pubsub/common.c
index 43322f4..be217cb 100644
--- a/src/tools/pubsub/common.c
+++ b/src/tools/pubsub/common.c
@@ -390,7 +390,6 @@ static void inapplicable_qos(dds_entity_kind_t qt, const char *n) {
     case DDS_KIND_COND_READ: en = "cond read"; break;
     case DDS_KIND_COND_QUERY: en = "cond query"; break;
     case DDS_KIND_WAITSET: en = "waitset"; break;
-    case DDS_KIND_INTERNAL: en = "internal"; break;
     default: en = "?"; break;
     }
     fprintf(stderr, "warning: %s entity ignoring inapplicable QoS \"%s\"\n", en, n);
diff --git a/src/util/CMakeLists.txt b/src/util/CMakeLists.txt
index 84088c3..282c131 100644
--- a/src/util/CMakeLists.txt
+++ b/src/util/CMakeLists.txt
@@ -11,7 +11,7 @@
 #
 include (GenerateExportHeader)
 
-PREPEND(srcs_util "${CMAKE_CURRENT_SOURCE_DIR}/src" ut_avl.c ut_crc.c ut_expand_envvars.c ut_fibheap.c ut_handleserver.c ut_hopscotch.c ut_thread_pool.c ut_xmlparser.c)
+PREPEND(srcs_util "${CMAKE_CURRENT_SOURCE_DIR}/src" ut_avl.c ut_crc.c ut_expand_envvars.c ut_fibheap.c ut_hopscotch.c ut_thread_pool.c ut_xmlparser.c)
 
 add_library(util ${srcs_util})
 set_property(TARGET util PROPERTY POSITION_INDEPENDENT_CODE TRUE)
diff --git a/src/util/src/ut_handleserver.c b/src/util/src/ut_handleserver.c
deleted file mode 100644
index 657f05e..0000000
--- a/src/util/src/ut_handleserver.c
+++ /dev/null
@@ -1,393 +0,0 @@
-/*
- * Copyright(c) 2006 to 2018 ADLINK Technology Limited and others
- *
- * This program and the accompanying materials are made available under the
- * terms of the Eclipse Public License v. 2.0 which is available at
- * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
- * v. 1.0 which is available at
- * http://www.eclipse.org/org/documents/edl-v10.php.
- *
- * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
- */
-#include <string.h>
-#include <assert.h>
-
-#include "dds/ddsrt/cdtors.h"
-#include "dds/ddsrt/heap.h"
-#include "dds/ddsrt/sync.h"
-#include "dds/util/ut_handleserver.h"
-
-/* Arbitrarily number of max handles. Should be enough for the mock. */
-#define MAX_NR_OF_HANDLES  (1000)
-
-#define HDL_FLAG_NONE      (0x00)
-#define HDL_FLAG_CLOSED    (0x01)
-
-typedef struct ut_handlelink {
-    ut_handle_t hdl;
-    void *arg;
-    uint32_t cnt;
-    uint8_t flags;
-} ut_handlelink;
-
-typedef struct ut_handleserver {
-    ut_handlelink *hdls[MAX_NR_OF_HANDLES];
-    int32_t last;
-    ddsrt_mutex_t mutex;
-} ut_handleserver;
-
-
-/* Singleton handle server. */
-static ut_handleserver *hs = NULL;
-
-
-static ut_handle_retcode_t
-lookup_handle(ut_handle_t hdl, int32_t kind, ut_handlelink **link);
-
-static ut_handle_t
-check_handle(ut_handle_t hdl, int32_t kind);
-
-static void
-delete_handle(int32_t idx);
-
-
-ut_handle_retcode_t
-ut_handleserver_init(void)
-{
-    ddsrt_init();
-    /* TODO Allow re-entry (something like ddsrt_init()). */
-    assert(hs == NULL);
-    hs = ddsrt_malloc(sizeof(ut_handleserver));
-    hs->last = 0;
-    ddsrt_mutex_init(&hs->mutex);
-    return UT_HANDLE_OK;
-}
-
-
-void
-ut_handleserver_fini(void)
-{
-    int32_t i;
-
-    /* TODO Only destroy when this is the last fini (something like ddsrt_fini()). */
-    assert(hs);
-
-    /* Every handle should have been deleted, but make sure. */
-    for (i = 0; i < hs->last; i++) {
-        if (hs->hdls[i] != NULL) {
-            /* TODO CHAM-138: Print warning. */
-            ddsrt_free(hs->hdls[i]);
-        }
-    }
-    ddsrt_mutex_destroy(&hs->mutex);
-    ddsrt_free(hs);
-    hs = NULL;
-    ddsrt_fini();
-}
-
-
-ut_handle_t
-ut_handle_create(
-    int32_t kind,
-    void *arg)
-{
-    ut_handle_t hdl = (ut_handle_t)UT_HANDLE_OUT_OF_RESOURCES;
-
-    /* A kind is obligatory. */
-    assert(kind & UT_HANDLE_KIND_MASK);
-    /* The kind should extent outside its boundaries. */
-    assert(!(kind & ~UT_HANDLE_KIND_MASK));
-
-    if (hs == NULL) {
-        return (ut_handle_t)UT_HANDLE_NOT_INITALIZED;
-    }
-
-    ddsrt_mutex_lock(&hs->mutex);
-
-    /* TODO CHAM-138: Improve the creation and management of handles. */
-    if (hs->last < MAX_NR_OF_HANDLES) {
-        hdl  = hs->last;
-        hdl |= kind;
-        hs->hdls[hs->last] = ddsrt_malloc(sizeof(ut_handlelink));
-        hs->hdls[hs->last]->cnt   = 0;
-        hs->hdls[hs->last]->arg   = arg;
-        hs->hdls[hs->last]->hdl   = hdl;
-        hs->hdls[hs->last]->flags = HDL_FLAG_NONE;
-        hs->last++;
-    }
-
-    ddsrt_mutex_unlock(&hs->mutex);
-
-    return hdl;
-}
-
-void
-ut_handle_close(
-    ut_handle_t hdl,
-    struct ut_handlelink *link)
-{
-    struct ut_handlelink *info = link;
-    ut_handle_retcode_t   ret = UT_HANDLE_OK;
-
-    assert(hs);
-
-    ddsrt_mutex_lock(&hs->mutex);
-    if (info == NULL) {
-        ret = lookup_handle(hdl, UT_HANDLE_DONTCARE_KIND, &info);
-    }
-    if (ret == UT_HANDLE_OK) {
-        assert(info);
-        assert(hdl == info->hdl);
-        info->flags |= HDL_FLAG_CLOSED;
-    }
-    ddsrt_mutex_unlock(&hs->mutex);
-}
-
-ut_handle_retcode_t
-ut_handle_delete(
-    ut_handle_t hdl,
-    struct ut_handlelink *link,
-    dds_time_t timeout)
-{
-    struct ut_handlelink *info = link;
-    ut_handle_retcode_t   ret = UT_HANDLE_OK;
-
-    assert(hs);
-
-    ddsrt_mutex_lock(&hs->mutex);
-    if (info == NULL) {
-        ret = lookup_handle(hdl, UT_HANDLE_DONTCARE_KIND, &info);
-    }
-    if (ret == UT_HANDLE_OK) {
-        assert(info);
-        assert(hdl == info->hdl);
-        info->flags |= HDL_FLAG_CLOSED;
-
-        /* FIXME: Replace this polling with conditional wait. */
-        ddsrt_mutex_unlock(&hs->mutex);
-        {
-            dds_duration_t delay = DDS_MSECS(10);
-            while ((info->cnt != 0) && timeout > 0) {
-                dds_sleepfor(delay);
-                timeout = (delay < timeout ? timeout - delay : 0);
-            }
-        }
-        ddsrt_mutex_lock(&hs->mutex);
-
-        if (info->cnt == 0) {
-            delete_handle(hdl & UT_HANDLE_IDX_MASK);
-        } else {
-            ret = UT_HANDLE_TIMEOUT;
-        }
-    }
-    ddsrt_mutex_unlock(&hs->mutex);
-
-    return ret;
-}
-
-ut_handle_retcode_t
-ut_handle_status(
-    ut_handle_t hdl,
-    struct ut_handlelink *link,
-    int32_t kind)
-{
-    struct ut_handlelink *info = link;
-    ut_handle_retcode_t   ret = UT_HANDLE_OK;
-
-    if (hs == NULL) {
-        return (ut_handle_t)UT_HANDLE_INVALID;
-    }
-
-    ddsrt_mutex_lock(&hs->mutex);
-    if (info == NULL) {
-        ret = lookup_handle(hdl, kind, &info);
-    }
-    if (ret == UT_HANDLE_OK) {
-        assert(info);
-        assert(hdl == info->hdl);
-        if (info->flags & HDL_FLAG_CLOSED) {
-            ret = UT_HANDLE_CLOSED;
-        }
-    }
-    ddsrt_mutex_unlock(&hs->mutex);
-
-    return ret;
-}
-
-ut_handle_retcode_t
-ut_handle_claim(
-    ut_handle_t hdl,
-    struct ut_handlelink *link,
-    int32_t kind,
-    void **arg)
-{
-    struct ut_handlelink *info = link;
-    ut_handle_retcode_t   ret = UT_HANDLE_OK;
-
-    if (arg != NULL) {
-        *arg = NULL;
-    }
-
-    if (hs == NULL) {
-        return (ut_handle_t)UT_HANDLE_INVALID;
-    }
-
-    ddsrt_mutex_lock(&hs->mutex);
-    if (info == NULL) {
-        ret = lookup_handle(hdl, kind, &info);
-    }
-    if (ret == UT_HANDLE_OK) {
-        assert(info);
-        assert(hdl == info->hdl);
-        if (info->flags & HDL_FLAG_CLOSED) {
-            ret = UT_HANDLE_CLOSED;
-        }
-    }
-    if (ret == UT_HANDLE_OK) {
-        info->cnt++;
-        if (arg != NULL) {
-            *arg = info->arg;
-        }
-    }
-    ddsrt_mutex_unlock(&hs->mutex);
-
-    return ret;
-}
-
-
-void
-ut_handle_release(
-    ut_handle_t hdl,
-    struct ut_handlelink *link)
-{
-    struct ut_handlelink *info = link;
-    ut_handle_retcode_t   ret = UT_HANDLE_OK;
-
-    assert(hs);
-
-    ddsrt_mutex_lock(&hs->mutex);
-    if (info == NULL) {
-        ret = lookup_handle(hdl, UT_HANDLE_DONTCARE_KIND, &info);
-    }
-    if (ret == UT_HANDLE_OK) {
-        assert(info);
-        assert(hdl == info->hdl);
-        assert(info->cnt > 0);
-        info->cnt--;
-    }
-    ddsrt_mutex_unlock(&hs->mutex);
-}
-
-bool
-ut_handle_is_closed(
-    ut_handle_t hdl,
-    struct ut_handlelink *link)
-{
-    struct ut_handlelink *info = link;
-    ut_handle_retcode_t   ret = UT_HANDLE_OK;
-
-    assert(hs);
-
-    ddsrt_mutex_lock(&hs->mutex);
-    if (info == NULL) {
-        ret = lookup_handle(hdl, UT_HANDLE_DONTCARE_KIND, &info);
-    }
-    if (ret == UT_HANDLE_OK) {
-        assert(info);
-        assert(hdl == info->hdl);
-        if (info->flags & HDL_FLAG_CLOSED) {
-            ret = UT_HANDLE_CLOSED;
-        }
-    }
-    ddsrt_mutex_unlock(&hs->mutex);
-
-    /* Simulate closed for every error. */
-    return (ret != UT_HANDLE_OK);
-}
-
-struct ut_handlelink*
-ut_handle_get_link(
-    ut_handle_t hdl)
-{
-    struct ut_handlelink *info;
-    ut_handle_retcode_t   ret;
-
-    assert(hs);
-
-    ddsrt_mutex_lock(&hs->mutex);
-    ret = lookup_handle(hdl, UT_HANDLE_DONTCARE_KIND, &info);
-    assert(((ret == UT_HANDLE_OK) && (info != NULL)) ||
-           ((ret != UT_HANDLE_OK) && (info == NULL)) );
-    (void)ret;
-    ddsrt_mutex_unlock(&hs->mutex);
-
-    return info;
-}
-
-
-static ut_handle_retcode_t
-lookup_handle(
-    ut_handle_t hdl,
-    int32_t kind,
-    ut_handlelink **link)
-{
-    ut_handle_retcode_t ret;
-    *link = NULL;
-    ret = check_handle(hdl, kind);
-    if (ret == UT_HANDLE_OK) {
-        int32_t idx = (hdl & UT_HANDLE_IDX_MASK);
-        assert(idx < MAX_NR_OF_HANDLES);
-        *link = hs->hdls[idx];
-    }
-    return ret;
-}
-
-static ut_handle_t
-check_handle(
-    ut_handle_t hdl,
-    int32_t kind)
-{
-    /* When handle is negative, it contains a retcode. */
-    ut_handle_retcode_t ret = UT_HANDLE_OK;
-    if (hdl > 0) {
-        if (hdl & UT_HANDLE_KIND_MASK) {
-            int32_t idx = (hdl & UT_HANDLE_IDX_MASK);
-            if (idx < hs->last) {
-                assert(idx < MAX_NR_OF_HANDLES);
-                ut_handlelink *info = hs->hdls[idx];
-                if (info != NULL) {
-                    if ((info->hdl & UT_HANDLE_KIND_MASK) == (hdl & UT_HANDLE_KIND_MASK)) {
-                        if ((kind != UT_HANDLE_DONTCARE_KIND) &&
-                            (kind != (hdl & UT_HANDLE_KIND_MASK))) {
-                            /* It's a valid handle, but the caller expected a different kind. */
-                            ret = UT_HANDLE_UNEQUAL_KIND;
-                        }
-                    } else {
-                        ret = UT_HANDLE_UNEQUAL_KIND;
-                    }
-                } else {
-                    ret = UT_HANDLE_DELETED;
-                }
-            } else {
-                ret = UT_HANDLE_INVALID;
-            }
-        } else {
-            ret = UT_HANDLE_INVALID;
-        }
-    } else if (hdl == 0) {
-        ret = UT_HANDLE_INVALID;
-    } else {
-        /* When handle is negative, it contains a retcode. */
-        ret = (ut_handle_retcode_t)hdl;
-    }
-    return ret;
-}
-
-static void
-delete_handle(int32_t idx)
-{
-    assert(hs);
-    assert(idx < MAX_NR_OF_HANDLES);
-    ddsrt_free(hs->hdls[idx]);
-    hs->hdls[idx] = NULL;
-}
diff --git a/src/util/tests/CMakeLists.txt b/src/util/tests/CMakeLists.txt
index 0d88ea0..7828517 100644
--- a/src/util/tests/CMakeLists.txt
+++ b/src/util/tests/CMakeLists.txt
@@ -11,19 +11,5 @@
 #
 include(CUnit)
 
-add_cunit_executable(cunit_util "handleserver.c")
-target_link_libraries(cunit_util PRIVATE util)
-target_link_libraries(cunit_util PRIVATE ddsrt)
-
-# Create a dummy export header. generate_export_header can only be used with
-# library targets, but since the targets are linked statically,
-# __declspec(dllimport) is not required anyway.
-set(export_dir "${CMAKE_CURRENT_BINARY_DIR}/include/dds")
-set(export_header "${export_dir}/export.h")
-if(NOT EXISTS "${export_header}")
-  file(MAKE_DIRECTORY "${export_dir}")
-  file(WRITE "${export_header}" "#define DDS_EXPORT\n")
-endif()
-
-target_include_directories(
-  cunit_util PRIVATE "$<BUILD_INTERFACE:${CMAKE_CURRENT_BINARY_DIR}/include>")
+#add_cunit_executable(CUnit_util "handleserver.c")
+#target_link_libraries(CUnit_util util)
diff --git a/src/util/tests/handleserver.c b/src/util/tests/handleserver.c
deleted file mode 100644
index ced5832..0000000
--- a/src/util/tests/handleserver.c
+++ /dev/null
@@ -1,304 +0,0 @@
-/*
- * Copyright(c) 2006 to 2018 ADLINK Technology Limited and others
- *
- * This program and the accompanying materials are made available under the
- * terms of the Eclipse Public License v. 2.0 which is available at
- * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
- * v. 1.0 which is available at
- * http://www.eclipse.org/org/documents/edl-v10.php.
- *
- * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
- */
-#include "dds/util/ut_handleserver.h"
-#include "CUnit/Test.h"
-#include "dds/ddsrt/retcode.h"
-#include "dds/ddsrt/threads.h"
-#include "dds/ddsrt/time.h"
-
-/*****************************************************************************************/
-CU_Test(util_handleserver, basic)
-{
-    int32_t kind = 0x10000000;
-    ut_handle_retcode_t ret;
-    ut_handle_t hdl;
-    int arg = 1;
-    void *argx;
-
-    ret = ut_handleserver_init();
-    CU_ASSERT_EQUAL_FATAL(ret, UT_HANDLE_OK);
-
-    hdl = ut_handle_create(kind, (void*)&arg);
-    CU_ASSERT_FATAL(hdl > 0);
-
-    ret = ut_handle_claim(hdl, NULL, kind, &argx);
-    CU_ASSERT_EQUAL_FATAL(ret, UT_HANDLE_OK);
-    CU_ASSERT_EQUAL_FATAL(argx, &arg);
-
-    ut_handle_release(hdl, NULL);
-
-    ret = ut_handle_delete(hdl, NULL, 0);
-    CU_ASSERT_EQUAL_FATAL(ret, UT_HANDLE_OK);
-
-    ret = ut_handle_claim(hdl, NULL, kind, &argx);
-    CU_ASSERT_EQUAL_FATAL(ret, UT_HANDLE_DELETED);
-
-    ut_handleserver_fini();
-}
-
-
-/*****************************************************************************************/
-CU_Test(util_handleserver, close)
-{
-    int32_t kind = 0x10000000;
-    ut_handle_retcode_t ret;
-    ut_handle_t hdl;
-    int arg = 1;
-    void *argx;
-    bool closed;
-
-    ret = ut_handleserver_init();
-    CU_ASSERT_EQUAL_FATAL(ret, UT_HANDLE_OK);
-
-    hdl = ut_handle_create(kind, (void*)&arg);
-    CU_ASSERT_FATAL(hdl > 0);
-
-    closed = ut_handle_is_closed(hdl, NULL);
-    CU_ASSERT_EQUAL_FATAL(closed, false);
-
-    ut_handle_close(hdl, NULL);
-
-    closed = ut_handle_is_closed(hdl, NULL);
-    CU_ASSERT_EQUAL_FATAL(closed, true);
-
-    ret = ut_handle_claim(hdl, NULL, kind, &argx);
-    CU_ASSERT_EQUAL_FATAL(ret, UT_HANDLE_CLOSED);
-
-    ret = ut_handle_delete(hdl, NULL, 0);
-    CU_ASSERT_EQUAL_FATAL(ret, UT_HANDLE_OK);
-
-    ret = ut_handle_claim(hdl, NULL, kind, &argx);
-    CU_ASSERT_EQUAL_FATAL(ret, UT_HANDLE_DELETED);
-
-    ut_handleserver_fini();
-}
-
-/*****************************************************************************************/
-CU_Test(util_handleserver, link)
-{
-    int32_t kind = 0x10000000;
-    ut_handle_retcode_t ret;
-    struct ut_handlelink *link;
-    ut_handle_t hdl;
-    int arg = 1;
-    void *argx;
-
-    ret = ut_handleserver_init();
-    CU_ASSERT_EQUAL_FATAL(ret, UT_HANDLE_OK);
-
-    hdl = ut_handle_create(kind, (void*)&arg);
-    CU_ASSERT_FATAL(hdl > 0);
-
-    link = ut_handle_get_link(hdl);
-    CU_ASSERT_NOT_EQUAL_FATAL(link, NULL);
-
-    ret = ut_handle_claim(hdl, link, kind, &argx);
-    CU_ASSERT_EQUAL_FATAL(ret, UT_HANDLE_OK);
-    CU_ASSERT_EQUAL_FATAL(argx, &arg);
-
-    ut_handle_release(hdl, link);
-
-    ret = ut_handle_delete(hdl, link, 0);
-    CU_ASSERT_EQUAL_FATAL(ret, UT_HANDLE_OK);
-
-    link = ut_handle_get_link(hdl);
-    CU_ASSERT_EQUAL_FATAL(link, NULL);
-
-    ut_handleserver_fini();
-}
-
-
-/*****************************************************************************************/
-CU_Test(util_handleserver, types)
-{
-    int32_t kind1 = 0x10000000;
-    int32_t kind2 = 0x20000000;
-    ut_handle_retcode_t ret;
-    ut_handle_t hdl1a;
-    ut_handle_t hdl1b;
-    ut_handle_t hdl2;
-    int arg1a = (int)'a';
-    int arg1b = (int)'b';
-    int arg2  = (int)'2';
-    void *argx;
-
-    ret = ut_handleserver_init();
-    CU_ASSERT_EQUAL_FATAL(ret, UT_HANDLE_OK);
-
-    hdl1a = ut_handle_create(kind1, (void*)&arg1a);
-    CU_ASSERT_FATAL(hdl1a > 0);
-
-    hdl1b = ut_handle_create(kind1, (void*)&arg1b);
-    CU_ASSERT_FATAL(hdl1b > 0);
-
-    hdl2 = ut_handle_create(kind2, (void*)&arg2);
-    CU_ASSERT_FATAL(hdl2 > 0);
-
-    ret = ut_handle_claim(hdl1a, NULL, kind1, &argx);
-    CU_ASSERT_EQUAL_FATAL(ret, UT_HANDLE_OK);
-    CU_ASSERT_EQUAL_FATAL(argx, &arg1a);
-
-    ret = ut_handle_claim(hdl1b, NULL, kind1, &argx);
-    CU_ASSERT_EQUAL_FATAL(ret, UT_HANDLE_OK);
-    CU_ASSERT_EQUAL_FATAL(argx, &arg1b);
-
-    ret = ut_handle_claim(hdl2, NULL, kind2, &argx);
-    CU_ASSERT_EQUAL_FATAL(ret, UT_HANDLE_OK);
-    CU_ASSERT_EQUAL_FATAL(argx, &arg2);
-
-    ret = ut_handle_claim(hdl1a, NULL, kind2, &argx);
-    CU_ASSERT_EQUAL_FATAL(ret, UT_HANDLE_UNEQUAL_KIND);
-
-    ret = ut_handle_claim(hdl1a, NULL, kind2, &argx);
-    CU_ASSERT_EQUAL_FATAL(ret, UT_HANDLE_UNEQUAL_KIND);
-
-    ret = ut_handle_claim(hdl2, NULL, kind1, &argx);
-    CU_ASSERT_EQUAL_FATAL(ret, UT_HANDLE_UNEQUAL_KIND);
-
-    ut_handle_release(hdl1a, NULL);
-    ut_handle_release(hdl1b, NULL);
-    ut_handle_release(hdl2,  NULL);
-
-    ret = ut_handle_delete(hdl1a, NULL, 0);
-    CU_ASSERT_EQUAL_FATAL(ret, UT_HANDLE_OK);
-    ret = ut_handle_delete(hdl1b, NULL, 0);
-    CU_ASSERT_EQUAL_FATAL(ret, UT_HANDLE_OK);
-    ret = ut_handle_delete(hdl2,  NULL, 0);
-    CU_ASSERT_EQUAL_FATAL(ret, UT_HANDLE_OK);
-
-    ut_handleserver_fini();
-}
-
-
-/*****************************************************************************************/
-CU_Test(util_handleserver, timeout)
-{
-    int32_t kind = 0x10000000;
-    ut_handle_retcode_t ret;
-    ut_handle_t hdl;
-    int arg = 1;
-    void *argx;
-
-    ret = ut_handleserver_init();
-    CU_ASSERT_EQUAL_FATAL(ret, UT_HANDLE_OK);
-
-    hdl = ut_handle_create(kind, (void*)&arg);
-    CU_ASSERT_FATAL(hdl > 0);
-
-    ret = ut_handle_claim(hdl, NULL, kind, &argx);
-    CU_ASSERT_EQUAL_FATAL(ret, UT_HANDLE_OK);
-    CU_ASSERT_EQUAL_FATAL(argx, &arg);
-
-    ret = ut_handle_delete(hdl, NULL, 0);
-    CU_ASSERT_EQUAL_FATAL(ret, UT_HANDLE_TIMEOUT);
-
-    ut_handle_release(hdl, NULL);
-
-    ret = ut_handle_delete(hdl, NULL, 0);
-    CU_ASSERT_EQUAL_FATAL(ret, UT_HANDLE_OK);
-
-    ut_handleserver_fini();
-}
-
-
-/*****************************************************************************************/
-typedef enum thread_state_t {
-    STARTING,
-    DELETING,
-    STOPPED
-} thread_state_t;
-
-typedef struct thread_arg_t {
-    thread_state_t state;
-    ut_handle_t    hdl;
-} thread_arg_t;
-
-static uint32_t
-deleting_thread(void *a)
-{
-    thread_arg_t *arg = (thread_arg_t*)a;
-    const dds_time_t ten = DDS_SECS(10);
-    ut_handle_t ret;
-
-    arg->state = DELETING;
-    /* This should block until the main test released all claims. */
-    ret = ut_handle_delete(arg->hdl, NULL, ten);
-    CU_ASSERT_EQUAL_FATAL(ret, UT_HANDLE_OK);
-    arg->state = STOPPED;
-
-    return 0;
-}
-
-dds_retcode_t
-thread_reached_state(thread_state_t *actual, thread_state_t expected, int32_t msec)
-{
-    /* Convenience function. */
-    dds_time_t msec10 = DDS_MSECS(10);
-    while ((msec > 0) && (*actual != expected)) {
-        dds_sleepfor(msec10);
-        msec -= 10;
-    }
-    return (*actual == expected) ? DDS_RETCODE_OK : DDS_RETCODE_TIMEOUT;
-}
-
-CU_Test(util_handleserver, wakeup)
-{
-    int32_t kind = 0x10000000;
-    ut_handle_retcode_t ret;
-    ut_handle_t hdl;
-    int arg = 1;
-    void *argx;
-
-    ddsrt_thread_t   thread_id;
-    thread_arg_t  thread_arg;
-    ddsrt_threadattr_t thread_attr;
-    dds_retcode_t rc;
-
-    ret = ut_handleserver_init();
-    CU_ASSERT_EQUAL_FATAL(ret, UT_HANDLE_OK);
-
-    hdl = ut_handle_create(kind, (void*)&arg);
-    CU_ASSERT_FATAL(hdl > 0);
-
-    ret = ut_handle_claim(hdl, NULL, kind, &argx);
-    CU_ASSERT_EQUAL_FATAL(ret, UT_HANDLE_OK);
-
-    ret = ut_handle_claim(hdl, NULL, kind, &argx);
-    CU_ASSERT_EQUAL_FATAL(ret, UT_HANDLE_OK);
-
-    /* Try deleting in other thread, which should block. */
-    thread_arg.hdl   = hdl;
-    thread_arg.state = STARTING;
-    ddsrt_threadattr_init(&thread_attr);
-    rc = ddsrt_thread_create(&thread_id, "deleting_thread", &thread_attr, deleting_thread, (void*)&thread_arg);
-    CU_ASSERT_EQUAL_FATAL(rc, DDS_RETCODE_OK);
-    rc = thread_reached_state(&thread_arg.state, DELETING, 1000);
-    CU_ASSERT_EQUAL_FATAL(rc, DDS_RETCODE_OK);
-    rc = thread_reached_state(&thread_arg.state, STOPPED, 500);
-    CU_ASSERT_EQUAL_FATAL(rc, DDS_RETCODE_TIMEOUT);
-
-    /* First release of the hdl should not unblock the thread. */
-    ut_handle_release(hdl, NULL);
-    rc = thread_reached_state(&thread_arg.state, STOPPED, 500);
-    CU_ASSERT_EQUAL_FATAL(rc, DDS_RETCODE_TIMEOUT);
-
-    /* Second release of the hdl should unblock the thread. */
-    ut_handle_release(hdl, NULL);
-    rc = thread_reached_state(&thread_arg.state, STOPPED, 500);
-    CU_ASSERT_EQUAL_FATAL(rc, DDS_RETCODE_OK);
-    ddsrt_thread_join(thread_id, NULL);
-
-    /* The handle is deleted within the thread. */
-
-    ut_handleserver_fini();
-}
-

From bb7373b90df1a79ac77a6af4ce50fedcd9c68999 Mon Sep 17 00:00:00 2001
From: Erik Boasson <eb@ilities.com>
Date: Sun, 7 Apr 2019 18:47:27 +0200
Subject: [PATCH 021/238] nestable calls to thread_[state_]awake

Remove all the "if asleep then awake ..." stuff from the code by making
awake/asleep calls nestable, whereas before it "awake ; awake" really
meant a transition through "asleep".  This self-evidently necessitates
fixing those places where the old behaviour was relied on upon, but
fortunately those are few.

Signed-off-by: Erik Boasson <eb@ilities.com>
---
 src/core/ddsc/src/dds_builtin.c               |   5 +-
 src/core/ddsc/src/dds_handles.c               |  35 +++--
 src/core/ddsc/src/dds_init.c                  |  40 +++---
 src/core/ddsc/src/dds_instance.c              |  90 ++++---------
 src/core/ddsc/src/dds_participant.c           |  23 +---
 src/core/ddsc/src/dds_read.c                  |  30 ++---
 src/core/ddsc/src/dds_reader.c                |  21 +--
 src/core/ddsc/src/dds_topic.c                 |  10 +-
 src/core/ddsc/src/dds_write.c                 |  38 ++----
 src/core/ddsc/src/dds_writer.c                |  54 ++------
 src/core/ddsi/CMakeLists.txt                  |   5 +-
 .../ddsi/include/dds/ddsi/ddsi_threadmon.h    |  31 +++++
 src/core/ddsi/include/dds/ddsi/q_config.h     |   4 +-
 src/core/ddsi/include/dds/ddsi/q_globals.h    |   2 +-
 src/core/ddsi/include/dds/ddsi/q_lease.h      |   3 +-
 .../ddsi/include/dds/ddsi/q_servicelease.h    |  31 -----
 src/core/ddsi/include/dds/ddsi/q_thread.h     | 104 +++++++--------
 src/core/ddsi/include/dds/ddsi/q_transmit.h   |   9 +-
 .../{q_servicelease.c => ddsi_threadmon.c}    | 108 +++++-----------
 src/core/ddsi/src/ddsi_tkmap.c                |   8 +-
 src/core/ddsi/src/q_config.c                  |  69 ++++------
 src/core/ddsi/src/q_ddsi_discovery.c          |   3 +-
 src/core/ddsi/src/q_debmon.c                  |  19 +--
 src/core/ddsi/src/q_entity.c                  |  10 +-
 src/core/ddsi/src/q_gc.c                      |  24 ++--
 src/core/ddsi/src/q_init.c                    |  19 +--
 src/core/ddsi/src/q_lease.c                   |   2 +-
 src/core/ddsi/src/q_radmin.c                  |   9 +-
 src/core/ddsi/src/q_receive.c                 |  46 ++++---
 src/core/ddsi/src/q_thread.c                  | 121 ++++++++++--------
 src/core/ddsi/src/q_thread_inlines.c          |  21 ---
 src/core/ddsi/src/q_transmit.c                |  32 ++---
 src/core/ddsi/src/q_xevent.c                  |  46 +++----
 src/core/ddsi/src/q_xmsg.c                    |   2 +-
 src/core/ddsi/src/sysdeps.c                   |  12 +-
 src/core/xtests/rhc_torture.c                 |  27 ++--
 36 files changed, 450 insertions(+), 663 deletions(-)
 create mode 100644 src/core/ddsi/include/dds/ddsi/ddsi_threadmon.h
 delete mode 100644 src/core/ddsi/include/dds/ddsi/q_servicelease.h
 rename src/core/ddsi/src/{q_servicelease.c => ddsi_threadmon.c} (55%)
 delete mode 100644 src/core/ddsi/src/q_thread_inlines.c

diff --git a/src/core/ddsc/src/dds_builtin.c b/src/core/ddsc/src/dds_builtin.c
index 1cdb382..3f50c60 100644
--- a/src/core/ddsc/src/dds_builtin.c
+++ b/src/core/ddsc/src/dds_builtin.c
@@ -65,12 +65,11 @@ void dds__builtin_init (void)
 void dds__builtin_fini (void)
 {
   /* No more sources for builtin topic samples */
-  struct thread_state1 * const self = lookup_thread_state ();
-  thread_state_awake (self);
+  thread_state_awake (lookup_thread_state ());
   delete_local_orphan_writer (builtintopic_writer_participant);
   delete_local_orphan_writer (builtintopic_writer_publications);
   delete_local_orphan_writer (builtintopic_writer_subscriptions);
-  thread_state_asleep (self);
+  thread_state_asleep (lookup_thread_state ());
 
   ddsi_sertopic_unref (builtin_participant_topic);
   ddsi_sertopic_unref (builtin_reader_topic);
diff --git a/src/core/ddsc/src/dds_handles.c b/src/core/ddsc/src/dds_handles.c
index 5e4acd3..560e661 100644
--- a/src/core/ddsc/src/dds_handles.c
+++ b/src/core/ddsc/src/dds_handles.c
@@ -117,12 +117,12 @@ static dds_handle_t dds_handle_create_int (struct dds_handle_link *link)
 
 dds_handle_t dds_handle_create (struct dds_handle_link *link)
 {
+#if USE_CHH
+  struct thread_state1 * const ts1 = lookup_thread_state ();
+#endif
   dds_handle_t ret;
 #if USE_CHH
-  struct thread_state1 * const self = lookup_thread_state ();
-  const bool asleep = vtime_asleep_p (self->vtime);
-  if (asleep)
-    thread_state_awake (self);
+  thread_state_awake (ts1);
 #endif
   ddsrt_mutex_lock (&handles.lock);
   if (handles.count == MAX_HANDLES)
@@ -143,8 +143,7 @@ dds_handle_t dds_handle_create (struct dds_handle_link *link)
     assert (ret > 0);
   }
 #if USE_CHH
-  if (asleep)
-    thread_state_asleep (self);
+  thread_state_asleep (ts1);
 #endif
   return ret;
 }
@@ -156,8 +155,10 @@ void dds_handle_close (struct dds_handle_link *link)
 
 int32_t dds_handle_delete (struct dds_handle_link *link, dds_duration_t timeout)
 {
+#if USE_CHH
+  struct thread_state1 * const ts1 = lookup_thread_state ();
+#endif
   assert (ddsrt_atomic_ld32 (&link->cnt_flags) & HDL_FLAG_CLOSED);
-
   ddsrt_mutex_lock (&handles.lock);
   if ((ddsrt_atomic_ld32 (&link->cnt_flags) & HDL_COUNT_MASK) != 0)
   {
@@ -174,13 +175,9 @@ int32_t dds_handle_delete (struct dds_handle_link *link, dds_duration_t timeout)
     }
   }
 #if USE_CHH
-  struct thread_state1 * const self = lookup_thread_state ();
-  const bool asleep = vtime_asleep_p (self->vtime);
-  if (asleep)
-    thread_state_awake (self);
+  thread_state_awake (ts1);
   int x = ut_chhRemove (handles.ht, link);
-  if (asleep)
-    thread_state_asleep (self);
+  thread_state_asleep (ts1);
 #else
   int x = ut_hhRemove (handles.ht, link);
 #endif
@@ -194,6 +191,9 @@ int32_t dds_handle_delete (struct dds_handle_link *link, dds_duration_t timeout)
 
 int32_t dds_handle_claim (dds_handle_t hdl, struct dds_handle_link **link)
 {
+#if USE_CHH
+  struct thread_state1 * const ts1 = lookup_thread_state ();
+#endif
   struct dds_handle_link dummy = { .hdl = hdl };
   int32_t rc;
   /* it makes sense to check here for initialization: the first thing any operation
@@ -208,10 +208,7 @@ int32_t dds_handle_claim (dds_handle_t hdl, struct dds_handle_link **link)
     return DDS_RETCODE_PRECONDITION_NOT_MET;
 
 #if USE_CHH
-  struct thread_state1 * const self = lookup_thread_state ();
-  const bool asleep = vtime_asleep_p (self->vtime);
-  if (asleep)
-    thread_state_awake (self);
+  thread_state_awake (ts1);
   *link = ut_chhLookup (handles.ht, &dummy);
 #else
   ddsrt_mutex_lock (&handles.lock);
@@ -234,10 +231,8 @@ int32_t dds_handle_claim (dds_handle_t hdl, struct dds_handle_link **link)
       }
     } while (!ddsrt_atomic_cas32 (&(*link)->cnt_flags, cnt_flags, cnt_flags + 1));
   }
-
 #if USE_CHH
-  if (asleep)
-    thread_state_asleep (self);
+  thread_state_asleep (ts1);
 #else
   ddsrt_mutex_unlock (&handles.lock);
 #endif
diff --git a/src/core/ddsc/src/dds_init.c b/src/core/ddsc/src/dds_init.c
index 31a1c0a..1efd81d 100644
--- a/src/core/ddsc/src/dds_init.c
+++ b/src/core/ddsc/src/dds_init.c
@@ -26,7 +26,7 @@
 #include "dds/ddsi/ddsi_iid.h"
 #include "dds/ddsi/ddsi_tkmap.h"
 #include "dds/ddsi/ddsi_serdata.h"
-#include "dds/ddsi/q_servicelease.h"
+#include "dds/ddsi/ddsi_threadmon.h"
 #include "dds/ddsi/q_entity.h"
 #include "dds/ddsi/q_config.h"
 #include "dds/ddsi/q_gc.h"
@@ -127,15 +127,15 @@ dds_init(dds_domainid_t domain)
 
   /* Start monitoring the liveliness of all threads. */
   if (!config.liveliness_monitoring)
-    gv.servicelease = NULL;
+    gv.threadmon = NULL;
   else
   {
-    gv.servicelease = nn_servicelease_new(0, 0);
-    if (gv.servicelease == NULL)
+    gv.threadmon = ddsi_threadmon_new ();
+    if (gv.threadmon == NULL)
     {
-      DDS_ERROR("Failed to create a servicelease\n");
+      DDS_ERROR("Failed to create a thread monitor\n");
       ret = DDS_ERRNO(DDS_RETCODE_OUT_OF_RESOURCES);
-      goto fail_servicelease_new;
+      goto fail_threadmon_new;
     }
   }
 
@@ -162,11 +162,11 @@ dds_init(dds_domainid_t domain)
     goto fail_rtps_start;
   }
 
-  if (gv.servicelease && nn_servicelease_start_renewing(gv.servicelease) < 0)
+  if (gv.threadmon && ddsi_threadmon_start(gv.threadmon) < 0)
   {
     DDS_ERROR("Failed to start the servicelease\n");
     ret = DDS_ERRNO(DDS_RETCODE_ERROR);
-    goto fail_servicelease_start;
+    goto fail_threadmon_start;
   }
 
   /* Set additional default participant properties */
@@ -191,9 +191,9 @@ skip:
   ddsrt_mutex_unlock(init_mutex);
   return DDS_RETCODE_OK;
 
-fail_servicelease_start:
-  if (gv.servicelease)
-    nn_servicelease_stop_renewing (gv.servicelease);
+fail_threadmon_start:
+  if (gv.threadmon)
+    ddsi_threadmon_stop (gv.threadmon);
   dds_handle_server_fini();
 fail_handleserver:
   rtps_stop ();
@@ -201,12 +201,12 @@ fail_rtps_start:
   dds__builtin_fini ();
   rtps_fini ();
 fail_rtps_init:
-  if (gv.servicelease)
+  if (gv.threadmon)
   {
-    nn_servicelease_free (gv.servicelease);
-    gv.servicelease = NULL;
+    ddsi_threadmon_free (gv.threadmon);
+    gv.threadmon = NULL;
   }
-fail_servicelease_new:
+fail_threadmon_new:
   downgrade_main_thread ();
   thread_states_fini();
 fail_rtps_config:
@@ -231,15 +231,15 @@ extern void dds_fini (void)
   dds_global.m_init_count--;
   if (dds_global.m_init_count == 0)
   {
-    if (gv.servicelease)
-      nn_servicelease_stop_renewing (gv.servicelease);
+    if (gv.threadmon)
+      ddsi_threadmon_stop (gv.threadmon);
     dds_handle_server_fini();
     rtps_stop ();
     dds__builtin_fini ();
     rtps_fini ();
-    if (gv.servicelease)
-      nn_servicelease_free (gv.servicelease);
-    gv.servicelease = NULL;
+    if (gv.threadmon)
+      ddsi_threadmon_free (gv.threadmon);
+    gv.threadmon = NULL;
     downgrade_main_thread ();
     thread_states_fini ();
 
diff --git a/src/core/ddsc/src/dds_instance.c b/src/core/ddsc/src/dds_instance.c
index 4ed3b20..5d15275 100644
--- a/src/core/ddsc/src/dds_instance.c
+++ b/src/core/ddsc/src/dds_instance.c
@@ -127,8 +127,7 @@ dds_register_instance(
     dds_instance_handle_t *handle,
     const void *data)
 {
-    struct thread_state1 * const thr = lookup_thread_state();
-    const bool asleep = !vtime_awake_p(thr->vtime);
+    struct thread_state1 * const ts1 = lookup_thread_state ();
     struct ddsi_tkmap_instance * inst;
     dds_writer *wr;
     dds_return_t ret;
@@ -150,9 +149,7 @@ dds_register_instance(
         ret = DDS_ERRNO(rc);
         goto err;
     }
-    if (asleep) {
-        thread_state_awake(thr);
-    }
+    thread_state_awake (ts1);
     inst = dds_instance_find (wr->m_topic, data, true);
     if(inst != NULL){
         *handle = inst->m_iid;
@@ -161,9 +158,7 @@ dds_register_instance(
         DDS_ERROR("Unable to create instance\n");
         ret = DDS_ERRNO(DDS_RETCODE_ERROR);
     }
-    if (asleep) {
-        thread_state_asleep(thr);
-    }
+    thread_state_asleep (ts1);
     dds_writer_unlock(wr);
 err:
     return ret;
@@ -191,8 +186,7 @@ dds_unregister_instance_ts(
     const void *data,
     dds_time_t timestamp)
 {
-    struct thread_state1 * const thr = lookup_thread_state();
-    const bool asleep = !vtime_awake_p(thr->vtime);
+    struct thread_state1 * const ts1 = lookup_thread_state ();
     dds_return_t ret = DDS_RETCODE_OK;
     dds_retcode_t rc;
     bool autodispose = true;
@@ -219,17 +213,13 @@ dds_unregister_instance_ts(
     if (wr->m_entity.m_qos) {
         dds_qget_writer_data_lifecycle (wr->m_entity.m_qos, &autodispose);
     }
-    if (asleep) {
-        thread_state_awake(thr);
-    }
+    thread_state_awake (ts1);
     if (autodispose) {
         dds_instance_remove (wr->m_topic, data, DDS_HANDLE_NIL);
         action |= DDS_WR_DISPOSE_BIT;
     }
     ret = dds_write_impl (wr, data, timestamp, action);
-    if (asleep) {
-        thread_state_asleep(thr);
-    }
+    thread_state_asleep (ts1);
     dds_writer_unlock(wr);
 err:
     return ret;
@@ -241,8 +231,7 @@ dds_unregister_instance_ih_ts(
     dds_instance_handle_t handle,
     dds_time_t timestamp)
 {
-    struct thread_state1 * const thr = lookup_thread_state();
-    const bool asleep = !vtime_awake_p(thr->vtime);
+    struct thread_state1 * const ts1 = lookup_thread_state ();
     dds_return_t ret = DDS_RETCODE_OK;
     dds_retcode_t rc;
     bool autodispose = true;
@@ -265,9 +254,7 @@ dds_unregister_instance_ih_ts(
         action |= DDS_WR_DISPOSE_BIT;
     }
 
-    if (asleep) {
-        thread_state_awake(thr);
-    }
+    thread_state_awake (ts1);
     tk = ddsi_tkmap_find_by_id (gv.m_tkmap, handle);
     if (tk) {
         struct ddsi_sertopic *tp = wr->m_topic->m_stopic;
@@ -280,9 +267,7 @@ dds_unregister_instance_ih_ts(
         DDS_ERROR("No instance related with the provided handle is found\n");
         ret = DDS_ERRNO(DDS_RETCODE_PRECONDITION_NOT_MET);
     }
-    if (asleep) {
-        thread_state_asleep(thr);
-    }
+    thread_state_asleep (ts1);
     dds_writer_unlock(wr);
 err:
     return ret;
@@ -294,24 +279,19 @@ dds_writedispose_ts(
     const void *data,
     dds_time_t timestamp)
 {
+    struct thread_state1 * const ts1 = lookup_thread_state ();
     dds_return_t ret;
     dds_retcode_t rc;
     dds_writer *wr;
 
     rc = dds_writer_lock(writer, &wr);
     if (rc == DDS_RETCODE_OK) {
-        struct thread_state1 * const thr = lookup_thread_state();
-        const bool asleep = !vtime_awake_p(thr->vtime);
-        if (asleep) {
-            thread_state_awake(thr);
-        }
+        thread_state_awake (ts1);
         ret = dds_write_impl (wr, data, timestamp, DDS_WR_ACTION_WRITE_DISPOSE);
         if (ret == DDS_RETCODE_OK) {
             dds_instance_remove (wr->m_topic, data, DDS_HANDLE_NIL);
         }
-        if (asleep) {
-            thread_state_asleep(thr);
-        }
+        thread_state_asleep (ts1);
         dds_writer_unlock(wr);
     } else {
         DDS_ERROR("Error occurred on locking writer\n");
@@ -329,7 +309,7 @@ dds_dispose_impl(
     dds_time_t timestamp)
 {
     dds_return_t ret;
-    assert(vtime_awake_p(lookup_thread_state()->vtime));
+    assert(thread_is_awake ());
     assert(wr);
     ret = dds_write_impl(wr, data, timestamp, DDS_WR_ACTION_DISPOSE);
     if (ret == DDS_RETCODE_OK) {
@@ -344,21 +324,16 @@ dds_dispose_ts(
     const void *data,
     dds_time_t timestamp)
 {
+    struct thread_state1 * const ts1 = lookup_thread_state ();
     dds_return_t ret;
     dds_retcode_t rc;
     dds_writer *wr;
 
     rc = dds_writer_lock(writer, &wr);
     if (rc == DDS_RETCODE_OK) {
-        struct thread_state1 * const thr = lookup_thread_state();
-        const bool asleep = !vtime_awake_p(thr->vtime);
-        if (asleep) {
-            thread_state_awake(thr);
-        }
+        thread_state_awake (ts1);
         ret = dds_dispose_impl(wr, data, DDS_HANDLE_NIL, timestamp);
-        if (asleep) {
-            thread_state_asleep(thr);
-        }
+        thread_state_asleep (ts1);
         dds_writer_unlock(wr);
     } else {
         DDS_ERROR("Error occurred on locking writer\n");
@@ -374,18 +349,15 @@ dds_dispose_ih_ts(
     dds_instance_handle_t handle,
     dds_time_t timestamp)
 {
+    struct thread_state1 * const ts1 = lookup_thread_state ();
     dds_return_t ret;
     dds_retcode_t rc;
     dds_writer *wr;
 
     rc = dds_writer_lock(writer, &wr);
     if (rc == DDS_RETCODE_OK) {
-        struct thread_state1 * const thr = lookup_thread_state();
-        const bool asleep = !vtime_awake_p(thr->vtime);
         struct ddsi_tkmap_instance *tk;
-        if (asleep) {
-            thread_state_awake(thr);
-        }
+        thread_state_awake (ts1);
         if ((tk = ddsi_tkmap_find_by_id (gv.m_tkmap, handle)) != NULL) {
             struct ddsi_sertopic *tp = wr->m_topic->m_stopic;
             void *sample = ddsi_sertopic_alloc_sample (tp);
@@ -397,9 +369,7 @@ dds_dispose_ih_ts(
             DDS_ERROR("No instance related with the provided handle is found\n");
             ret = DDS_ERRNO(DDS_RETCODE_PRECONDITION_NOT_MET);
         }
-        if (asleep) {
-            thread_state_asleep(thr);
-        }
+        thread_state_asleep (ts1);
         dds_writer_unlock(wr);
     } else {
         DDS_ERROR("Error occurred on locking writer\n");
@@ -414,6 +384,7 @@ dds_lookup_instance(
     dds_entity_t entity,
     const void *data)
 {
+    struct thread_state1 * const ts1 = lookup_thread_state ();
     dds_instance_handle_t ih = DDS_HANDLE_NIL;
     const dds_topic * topic;
     struct ddsi_tkmap * map = gv.m_tkmap;
@@ -426,17 +397,11 @@ dds_lookup_instance(
 
     topic = dds_instance_info_by_hdl (entity);
     if (topic) {
-        struct thread_state1 * const thr = lookup_thread_state();
-        const bool asleep = !vtime_awake_p(thr->vtime);
-        if (asleep) {
-            thread_state_awake(thr);
-        }
+        thread_state_awake (ts1);
         sd = ddsi_serdata_from_sample (topic->m_stopic, SDK_KEY, data);
         ih = ddsi_tkmap_lookup (map, sd);
         ddsi_serdata_unref (sd);
-        if (asleep) {
-            thread_state_asleep(thr);
-        }
+        thread_state_asleep (ts1);
     } else {
         DDS_ERROR("Acquired topic is NULL\n");
     }
@@ -458,8 +423,7 @@ dds_instance_get_key(
     dds_instance_handle_t ih,
     void *data)
 {
-    struct thread_state1 * const thr = lookup_thread_state();
-    const bool asleep = !vtime_awake_p(thr->vtime);
+    struct thread_state1 * const ts1 = lookup_thread_state ();
     dds_return_t ret;
     const dds_topic * topic;
     struct ddsi_tkmap_instance * tk;
@@ -476,9 +440,7 @@ dds_instance_get_key(
         ret = DDS_ERRNO(DDS_RETCODE_BAD_PARAMETER);
         goto err;
     }
-    if (asleep) {
-        thread_state_awake(thr);
-    }
+    thread_state_awake (ts1);
     if ((tk = ddsi_tkmap_find_by_id(gv.m_tkmap, ih)) != NULL) {
         ddsi_sertopic_zero_sample (topic->m_stopic, data);
         ddsi_serdata_topicless_to_sample (topic->m_stopic, tk->m_sample, data, NULL, NULL);
@@ -488,9 +450,7 @@ dds_instance_get_key(
         DDS_ERROR("No instance related with the provided entity is found\n");
         ret = DDS_ERRNO(DDS_RETCODE_BAD_PARAMETER);
     }
-    if (asleep) {
-        thread_state_asleep(thr);
-    }
+    thread_state_asleep (ts1);
 err:
     return ret;
 }
diff --git a/src/core/ddsc/src/dds_participant.c b/src/core/ddsc/src/dds_participant.c
index 35521c0..587951a 100644
--- a/src/core/ddsc/src/dds_participant.c
+++ b/src/core/ddsc/src/dds_participant.c
@@ -48,18 +48,13 @@ static dds_return_t
 dds_participant_delete(
     dds_entity *e)
 {
-    struct thread_state1 * const thr = lookup_thread_state ();
-    const bool asleep = !vtime_awake_p (thr->vtime);
     dds_entity *prev = NULL;
     dds_entity *iter;
 
     assert(e);
-    assert(thr);
     assert(dds_entity_kind(e) == DDS_KIND_PARTICIPANT);
 
-    if (asleep) {
-      thread_state_awake(thr);
-    }
+    thread_state_awake (lookup_thread_state ());
 
     dds_domain_free (e->m_domain);
 
@@ -81,9 +76,7 @@ dds_participant_delete(
 
     assert (iter);
 
-    if (asleep) {
-      thread_state_asleep(thr);
-    }
+    thread_state_asleep (lookup_thread_state ());
 
     /* Every dds_init needs a dds_fini. */
     dds_fini();
@@ -155,8 +148,6 @@ dds_create_participant(
     dds_participant * pp;
     nn_plist_t plist;
     dds_qos_t * new_qos = NULL;
-    struct thread_state1 * thr;
-    bool asleep;
 
     /* Make sure DDS instance is initialized. */
     ret = dds_init(domain);
@@ -192,15 +183,9 @@ dds_create_participant(
     nn_plist_init_empty(&plist);
     dds_merge_qos (&plist.qos, new_qos);
 
-    thr = lookup_thread_state ();
-    asleep = !vtime_awake_p (thr->vtime);
-    if (asleep) {
-        thread_state_awake (thr);
-    }
+    thread_state_awake (lookup_thread_state ());
     q_rc = new_participant (&guid, 0, &plist);
-    if (asleep) {
-        thread_state_asleep (thr);
-    }
+    thread_state_asleep (lookup_thread_state ());
     nn_plist_fini (&plist);
     if (q_rc != 0) {
         DDS_ERROR("Internal error");
diff --git a/src/core/ddsc/src/dds_read.c b/src/core/ddsc/src/dds_read.c
index af239f6..b4c5adf 100644
--- a/src/core/ddsc/src/dds_read.c
+++ b/src/core/ddsc/src/dds_read.c
@@ -88,16 +88,12 @@ dds_read_impl(
         bool lock,
         bool only_reader)
 {
+    struct thread_state1 * const ts1 = lookup_thread_state ();
     dds_return_t ret = DDS_RETCODE_OK;
     dds_retcode_t rc;
     struct dds_reader * rd;
     struct dds_readcond * cond;
-    struct thread_state1 * const thr = lookup_thread_state ();
-    const bool asleep = !vtime_awake_p (thr->vtime);
 
-    if (asleep) {
-        thread_state_awake (thr);
-    }
     if (buf == NULL) {
         DDS_ERROR("The provided buffer is NULL\n");
         ret = DDS_ERRNO(DDS_RETCODE_BAD_PARAMETER);
@@ -124,18 +120,19 @@ dds_read_impl(
         goto fail;
     }
 
+    thread_state_awake (ts1);
     rc = dds_read_lock(reader_or_condition, &rd, &cond, only_reader);
     if (rc != DDS_RETCODE_OK) {
         DDS_ERROR("Error occurred on locking entity\n");
         ret = DDS_ERRNO(rc);
-        goto fail;
+        goto fail_awake;
     }
     if (hand != DDS_HANDLE_NIL) {
         if (ddsi_tkmap_find_by_id(gv.m_tkmap, hand) == NULL) {
             DDS_ERROR("Could not find instance\n");
             ret = DDS_ERRNO(DDS_RETCODE_PRECONDITION_NOT_MET);
             dds_read_unlock(rd, cond);
-            goto fail;
+            goto fail_awake;
         }
     }
     /* Allocate samples if not provided (assuming all or none provided) */
@@ -173,10 +170,9 @@ dds_read_impl(
     }
     dds_read_unlock(rd, cond);
 
+fail_awake:
+    thread_state_asleep (ts1);
 fail:
-    if (asleep) {
-        thread_state_asleep (thr);
-    }
     return ret;
 }
 
@@ -191,12 +187,11 @@ dds_readcdr_impl(
         dds_instance_handle_t hand,
         bool lock)
 {
+  struct thread_state1 * const ts1 = lookup_thread_state ();
   dds_return_t ret = DDS_RETCODE_OK;
   dds_retcode_t rc;
   struct dds_reader * rd;
   struct dds_readcond * cond;
-  struct thread_state1 * const thr = lookup_thread_state ();
-  const bool asleep = !vtime_awake_p (thr->vtime);
 
   assert (take);
   assert (buf);
@@ -205,10 +200,7 @@ dds_readcdr_impl(
   assert (maxs > 0);
   (void)take;
 
-  if (asleep)
-  {
-    thread_state_awake (thr);
-  }
+  thread_state_awake (ts1);
   rc = dds_read_lock(reader_or_condition, &rd, &cond, false);
   if (rc >= DDS_RETCODE_OK) {
       ret = dds_rhc_takecdr
@@ -235,11 +227,7 @@ dds_readcdr_impl(
       ret = DDS_ERRNO(rc);
   }
 
-  if (asleep)
-  {
-    thread_state_asleep (thr);
-  }
-
+  thread_state_asleep (ts1);
   return ret;
 }
 
diff --git a/src/core/ddsc/src/dds_reader.c b/src/core/ddsc/src/dds_reader.c
index bd16e39..2c14994 100644
--- a/src/core/ddsc/src/dds_reader.c
+++ b/src/core/ddsc/src/dds_reader.c
@@ -54,23 +54,16 @@ dds_reader_close(
 {
     dds_retcode_t rc;
     dds_return_t ret = DDS_RETCODE_OK;
-    struct thread_state1 * const thr = lookup_thread_state();
-    const bool asleep = !vtime_awake_p(thr->vtime);
 
     assert(e);
-    assert(thr);
 
-    if (asleep) {
-      thread_state_awake(thr);
-    }
+    thread_state_awake (lookup_thread_state ());
     if (delete_reader(&e->m_guid) != 0) {
         DDS_ERROR("Internal error");
         rc = DDS_RETCODE_ERROR;
         ret = DDS_ERRNO(rc);
     }
-    if (asleep) {
-      thread_state_asleep(thr);
-    }
+    thread_state_asleep (lookup_thread_state ());
     return ret;
 }
 
@@ -368,8 +361,6 @@ dds_create_reader(
     dds_topic * tp;
     dds_entity_t reader;
     dds_entity_t t;
-    struct thread_state1 * const thr = lookup_thread_state ();
-    const bool asleep = !vtime_awake_p (thr->vtime);
     dds_return_t ret = DDS_RETCODE_OK;
     bool internal_topic;
 
@@ -474,17 +465,13 @@ dds_create_reader(
     ddsrt_mutex_unlock(&tp->m_entity.m_mutex);
     ddsrt_mutex_unlock(&sub->m_entity.m_mutex);
 
-    if (asleep) {
-        thread_state_awake (thr);
-    }
+    thread_state_awake (lookup_thread_state ());
     rd->m_rd = new_reader(&rd->m_entity.m_guid, NULL, &sub->m_entity.m_participant->m_guid, tp->m_stopic,
                           rqos, rhc, dds_reader_status_cb, rd);
     ddsrt_mutex_lock(&sub->m_entity.m_mutex);
     ddsrt_mutex_lock(&tp->m_entity.m_mutex);
     assert (rd->m_rd);
-    if (asleep) {
-        thread_state_asleep (thr);
-    }
+    thread_state_asleep (lookup_thread_state ());
 
     /* For persistent data register reader with durability */
     if (dds_global.m_dur_reader && (rd->m_entity.m_qos->durability.kind > NN_TRANSIENT_LOCAL_DURABILITY_QOS)) {
diff --git a/src/core/ddsc/src/dds_topic.c b/src/core/ddsc/src/dds_topic.c
index acd36ac..1561afd 100644
--- a/src/core/ddsc/src/dds_topic.c
+++ b/src/core/ddsc/src/dds_topic.c
@@ -313,8 +313,6 @@ dds_create_topic_arbitrary (
     dds_qos_t *new_qos = NULL;
     dds_entity_t hdl;
     struct participant *ddsi_pp;
-    struct thread_state1 *const thr = lookup_thread_state ();
-    const bool asleep = !vtime_awake_p (thr->vtime);
 
     if (sertopic == NULL){
         DDS_ERROR("Topic description is NULL\n");
@@ -389,17 +387,13 @@ dds_create_topic_arbitrary (
         ddsrt_mutex_unlock (&dds_global.m_mutex);
 
         /* Publish Topic */
-        if (asleep) {
-            thread_state_awake (thr);
-        }
+        thread_state_awake (lookup_thread_state ());
         ddsi_pp = ephash_lookup_participant_guid (&par->m_guid);
         assert (ddsi_pp);
         if (sedp_plist) {
             sedp_write_topic (ddsi_pp, sedp_plist);
         }
-        if (asleep) {
-            thread_state_asleep (thr);
-        }
+        thread_state_asleep (lookup_thread_state ());
     }
 
 qos_err:
diff --git a/src/core/ddsc/src/dds_write.c b/src/core/ddsc/src/dds_write.c
index 3f3bb5e..3c1526c 100644
--- a/src/core/ddsc/src/dds_write.c
+++ b/src/core/ddsc/src/dds_write.c
@@ -148,8 +148,7 @@ static dds_return_t deliver_locally (struct writer *wr, struct ddsi_serdata *pay
 
 dds_return_t dds_write_impl (dds_writer *wr, const void * data, dds_time_t tstamp, dds_write_action action)
 {
-  struct thread_state1 * const thr = lookup_thread_state ();
-  const bool asleep = !vtime_awake_p (thr->vtime);
+  struct thread_state1 * const ts1 = lookup_thread_state ();
   const bool writekey = action & DDS_WR_KEY_BIT;
   struct writer *ddsi_wr = wr->m_wr;
   struct ddsi_tkmap_instance *tk;
@@ -168,8 +167,7 @@ dds_return_t dds_write_impl (dds_writer *wr, const void * data, dds_time_t tstam
     if (!(wr->m_topic->filter_fn) (data, wr->m_topic->filter_ctx))
       return DDS_RETCODE_OK;
 
-  if (asleep)
-    thread_state_awake (thr);
+  thread_state_awake (ts1);
 
   /* Serialize and write data or key */
   d = ddsi_serdata_from_sample (ddsi_wr->topic, writekey ? SDK_KEY : SDK_DATA, data);
@@ -177,7 +175,7 @@ dds_return_t dds_write_impl (dds_writer *wr, const void * data, dds_time_t tstam
   d->timestamp.v = tstamp;
   ddsi_serdata_ref (d);
   tk = ddsi_tkmap_lookup_instance_ref (d);
-  w_rc = write_sample_gc (wr->m_xp, ddsi_wr, d, tk);
+  w_rc = write_sample_gc (ts1, wr->m_xp, ddsi_wr, d, tk);
 
   if (w_rc >= 0)
   {
@@ -199,26 +197,21 @@ dds_return_t dds_write_impl (dds_writer *wr, const void * data, dds_time_t tstam
     ret = deliver_locally (ddsi_wr, d, tk);
   ddsi_serdata_unref (d);
   ddsi_tkmap_instance_unref (tk);
-
-  if (asleep)
-    thread_state_asleep (thr);
+  thread_state_asleep (ts1);
   return ret;
 }
 
 dds_return_t dds_writecdr_impl_lowlevel (struct writer *ddsi_wr, struct nn_xpack *xp, struct ddsi_serdata *d)
 {
-  struct thread_state1 * const thr = lookup_thread_state ();
-  const bool asleep = !vtime_awake_p (thr->vtime);
+  struct thread_state1 * const ts1 = lookup_thread_state ();
   struct ddsi_tkmap_instance * tk;
   int ret = DDS_RETCODE_OK;
   int w_rc;
 
-  if (asleep)
-    thread_state_awake (thr);
-
+  thread_state_awake (ts1);
   ddsi_serdata_ref (d);
   tk = ddsi_tkmap_lookup_instance_ref (d);
-  w_rc = write_sample_gc (xp, ddsi_wr, d, tk);
+  w_rc = write_sample_gc (ts1, xp, ddsi_wr, d, tk);
   if (w_rc >= 0) {
     /* Flush out write unless configured to batch */
     if (!config.whc_batch && xp != NULL)
@@ -239,10 +232,7 @@ dds_return_t dds_writecdr_impl_lowlevel (struct writer *ddsi_wr, struct nn_xpack
     ret = deliver_locally (ddsi_wr, d, tk);
   ddsi_serdata_unref (d);
   ddsi_tkmap_instance_unref (tk);
-
-  if (asleep)
-    thread_state_asleep (thr);
-
+  thread_state_asleep (ts1);
   return ret;
 }
 
@@ -263,13 +253,10 @@ void dds_write_set_batch (bool enable)
 
 void dds_write_flush (dds_entity_t writer)
 {
-  struct thread_state1 * const thr = lookup_thread_state ();
-  const bool asleep = !vtime_awake_p (thr->vtime);
+  struct thread_state1 * const ts1 = lookup_thread_state ();
   dds_writer *wr;
   dds_retcode_t rc;
-
-  if (asleep)
-    thread_state_awake (thr);
+  thread_state_awake (ts1);
   if ((rc = dds_writer_lock (writer, &wr)) != DDS_RETCODE_OK)
     DDS_ERROR ("Error occurred on locking writer\n");
   else
@@ -277,8 +264,5 @@ void dds_write_flush (dds_entity_t writer)
     nn_xpack_send (wr->m_xp, true);
     dds_writer_unlock (wr);
   }
-
-  if (asleep)
-    thread_state_asleep (thr);
-  return;
+  thread_state_asleep (ts1);
 }
diff --git a/src/core/ddsc/src/dds_writer.c b/src/core/ddsc/src/dds_writer.c
index f804fe1..06a13ef 100644
--- a/src/core/ddsc/src/dds_writer.c
+++ b/src/core/ddsc/src/dds_writer.c
@@ -192,24 +192,16 @@ dds_writer_close(
 {
     dds_return_t ret = DDS_RETCODE_OK;
     dds_writer *wr = (dds_writer*)e;
-    struct thread_state1 * const thr = lookup_thread_state();
-    const bool asleep = thr ? !vtime_awake_p(thr->vtime) : false;
 
     assert(e);
 
-    if (asleep) {
-        thread_state_awake(thr);
-    }
-    if (thr) {
-        nn_xpack_send (wr->m_xp, false);
-    }
+    thread_state_awake (lookup_thread_state ());
+    nn_xpack_send (wr->m_xp, false);
     if (delete_writer (&e->m_guid) != 0) {
         DDS_ERROR("Internal error");
         ret = DDS_ERRNO(DDS_RETCODE_ERROR);
     }
-    if (asleep) {
-        thread_state_asleep(thr);
-    }
+    thread_state_asleep (lookup_thread_state ());
     return ret;
 }
 
@@ -218,24 +210,11 @@ dds_writer_delete(
         dds_entity *e)
 {
     dds_writer *wr = (dds_writer*)e;
-    struct thread_state1 * const thr = lookup_thread_state();
-    const bool asleep = thr ? !vtime_awake_p(thr->vtime) : false;
     dds_return_t ret;
-
-    assert(e);
-    assert(thr);
-
     /* FIXME: not freeing WHC here because it is owned by the DDSI entity */
-
-    if (asleep) {
-        thread_state_awake(thr);
-    }
-    if (thr) {
-        nn_xpack_free(wr->m_xp);
-    }
-    if (asleep) {
-        thread_state_asleep(thr);
-    }
+    thread_state_awake (lookup_thread_state ());
+    nn_xpack_free(wr->m_xp);
+    thread_state_asleep (lookup_thread_state ());
     ret = dds_delete(wr->m_topic->m_entity.m_hdllink.hdl);
     if(ret == DDS_RETCODE_OK){
         ret = dds_delete_impl(e->m_parent->m_hdllink.hdl, true);
@@ -304,15 +283,11 @@ dds_writer_qos_set(
             dds_qget_ownership (e->m_qos, &kind);
 
             if (kind == DDS_OWNERSHIP_EXCLUSIVE) {
-                struct thread_state1 * const thr = lookup_thread_state ();
-                const bool asleep = !vtime_awake_p (thr->vtime);
                 struct writer * ddsi_wr = ((dds_writer*)e)->m_wr;
 
                 dds_qset_ownership_strength (e->m_qos, qos->ownership_strength.value);
 
-                if (asleep) {
-                    thread_state_awake (thr);
-                }
+                thread_state_awake (lookup_thread_state ());
 
                 /* FIXME: with QoS changes being unsupported by the underlying stack I wonder what will happen; locking the underlying DDSI writer is of doubtful value as well */
                 ddsrt_mutex_lock (&ddsi_wr->e.lock);
@@ -320,10 +295,7 @@ dds_writer_qos_set(
                     ddsi_wr->xqos->ownership_strength.value = qos->ownership_strength.value;
                 }
                 ddsrt_mutex_unlock (&ddsi_wr->e.lock);
-
-                if (asleep) {
-                    thread_state_asleep (thr);
-                }
+                thread_state_asleep (lookup_thread_state ());
             } else {
                 DDS_ERROR("Setting ownership strength doesn't make sense when the ownership is shared\n");
                 ret = DDS_ERRNO(DDS_RETCODE_ERROR);
@@ -403,8 +375,6 @@ dds_create_writer(
     dds_publisher * pub = NULL;
     dds_topic * tp;
     dds_entity_t publisher;
-    struct thread_state1 * const thr = lookup_thread_state();
-    const bool asleep = !vtime_awake_p(thr->vtime);
     ddsi_tran_conn_t conn = gv.data_conn_uc;
     dds_return_t ret;
 
@@ -485,16 +455,12 @@ dds_create_writer(
     ddsrt_mutex_unlock (&tp->m_entity.m_mutex);
     ddsrt_mutex_unlock (&pub->m_entity.m_mutex);
 
-    if (asleep) {
-        thread_state_awake(thr);
-    }
+    thread_state_awake (lookup_thread_state ());
     wr->m_wr = new_writer(&wr->m_entity.m_guid, NULL, &pub->m_entity.m_participant->m_guid, tp->m_stopic, wqos, wr->m_whc, dds_writer_status_cb, wr);
     ddsrt_mutex_lock (&pub->m_entity.m_mutex);
     ddsrt_mutex_lock (&tp->m_entity.m_mutex);
     assert(wr->m_wr);
-    if (asleep) {
-        thread_state_asleep(thr);
-    }
+    thread_state_asleep (lookup_thread_state ());
     dds_topic_unlock(tp);
     dds_publisher_unlock(pub);
     return writer;
diff --git a/src/core/ddsi/CMakeLists.txt b/src/core/ddsi/CMakeLists.txt
index 683ad6e..4a6bb0f 100644
--- a/src/core/ddsi/CMakeLists.txt
+++ b/src/core/ddsi/CMakeLists.txt
@@ -26,6 +26,7 @@ PREPEND(srcs_ddsi "${CMAKE_CURRENT_LIST_DIR}/src"
     ddsi_iid.c
     ddsi_tkmap.c
     ddsi_vendor.c
+    ddsi_threadmon.c
     q_addrset.c
     q_bitset_inlines.c
     q_bswap.c
@@ -47,10 +48,8 @@ PREPEND(srcs_ddsi "${CMAKE_CURRENT_LIST_DIR}/src"
     q_radmin.c
     q_receive.c
     q_security.c
-    q_servicelease.c
     q_sockwaitset.c
     q_thread.c
-    q_thread_inlines.c
     q_time.c
     q_transmit.c
     q_inverse_uint32_set.c
@@ -78,6 +77,7 @@ PREPEND(hdrs_private_ddsi "${CMAKE_CURRENT_LIST_DIR}/include/dds/ddsi"
     ddsi_iid.h
     ddsi_tkmap.h
     ddsi_vendor.h
+    ddsi_threadmon.h
     q_addrset.h
     q_bitset.h
     q_bswap.h
@@ -105,7 +105,6 @@ PREPEND(hdrs_private_ddsi "${CMAKE_CURRENT_LIST_DIR}/include/dds/ddsi"
     q_receive.h
     q_rtps.h
     q_security.h
-    q_servicelease.h
     q_sockwaitset.h
     q_static_assert.h
     q_thread.h
diff --git a/src/core/ddsi/include/dds/ddsi/ddsi_threadmon.h b/src/core/ddsi/include/dds/ddsi/ddsi_threadmon.h
new file mode 100644
index 0000000..7d9d346
--- /dev/null
+++ b/src/core/ddsi/include/dds/ddsi/ddsi_threadmon.h
@@ -0,0 +1,31 @@
+/*
+ * Copyright(c) 2006 to 2019 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+#ifndef DDSI_THREADMON_H
+#define DDSI_THREADMON_H
+
+#if defined (__cplusplus)
+extern "C" {
+#endif
+
+struct ddsi_threadmon;
+
+struct ddsi_threadmon *ddsi_threadmon_new (void);
+int ddsi_threadmon_start (struct ddsi_threadmon *sl);
+void ddsi_threadmon_stop (struct ddsi_threadmon *sl);
+void ddsi_threadmon_free (struct ddsi_threadmon *sl);
+void ddsi_threadmon_statechange_barrier (struct ddsi_threadmon *sl);
+
+#if defined (__cplusplus)
+}
+#endif
+
+#endif /* DDSI_THREADMON_H */
diff --git a/src/core/ddsi/include/dds/ddsi/q_config.h b/src/core/ddsi/include/dds/ddsi/q_config.h
index c37a40e..c313682 100644
--- a/src/core/ddsi/include/dds/ddsi/q_config.h
+++ b/src/core/ddsi/include/dds/ddsi/q_config.h
@@ -267,6 +267,7 @@ struct config
   int forward_all_messages;
   int liveliness_monitoring;
   int noprogress_log_stacktraces;
+  int64_t liveliness_monitoring_interval;
   int prioritize_retransmit;
   int xpack_send_async;
   int multiple_recv_threads;
@@ -277,9 +278,6 @@ struct config
 
   unsigned delivery_queue_maxsamples;
 
-  float servicelease_expiry_time;
-  float servicelease_update_factor;
-
   int enableLoopback;
   enum durability_cdr durability_cdr;
 
diff --git a/src/core/ddsi/include/dds/ddsi/q_globals.h b/src/core/ddsi/include/dds/ddsi/q_globals.h
index 177793c..770c569 100644
--- a/src/core/ddsi/include/dds/ddsi/q_globals.h
+++ b/src/core/ddsi/include/dds/ddsi/q_globals.h
@@ -105,7 +105,7 @@ struct q_globals {
 
   /* Queue for garbage collection requests */
   struct gcreq_queue *gcreq_queue;
-  struct nn_servicelease *servicelease;
+  struct ddsi_threadmon *threadmon;
 
   /* Lease junk */
   ddsrt_mutex_t leaseheap_lock;
diff --git a/src/core/ddsi/include/dds/ddsi/q_lease.h b/src/core/ddsi/include/dds/ddsi/q_lease.h
index 2a24abe..a139075 100644
--- a/src/core/ddsi/include/dds/ddsi/q_lease.h
+++ b/src/core/ddsi/include/dds/ddsi/q_lease.h
@@ -22,7 +22,6 @@ struct receiver_state;
 struct participant;
 struct lease;
 struct entity_common;
-struct thread_state1;
 
 void lease_management_init (void);
 void lease_management_term (void);
@@ -31,7 +30,7 @@ void lease_register (struct lease *l);
 void lease_free (struct lease *l);
 void lease_renew (struct lease *l, nn_etime_t tnow);
 void lease_set_expiry (struct lease *l, nn_etime_t when);
-int64_t check_and_handle_lease_expiration (struct thread_state1 *self, nn_etime_t tnow);
+int64_t check_and_handle_lease_expiration (nn_etime_t tnow);
 
 void handle_PMD (const struct receiver_state *rst, nn_wctime_t timestamp, unsigned statusinfo, const void *vdata, unsigned len);
 
diff --git a/src/core/ddsi/include/dds/ddsi/q_servicelease.h b/src/core/ddsi/include/dds/ddsi/q_servicelease.h
deleted file mode 100644
index bc9c15d..0000000
--- a/src/core/ddsi/include/dds/ddsi/q_servicelease.h
+++ /dev/null
@@ -1,31 +0,0 @@
-/*
- * Copyright(c) 2006 to 2018 ADLINK Technology Limited and others
- *
- * This program and the accompanying materials are made available under the
- * terms of the Eclipse Public License v. 2.0 which is available at
- * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
- * v. 1.0 which is available at
- * http://www.eclipse.org/org/documents/edl-v10.php.
- *
- * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
- */
-#ifndef NN_SERVICELEASE_H
-#define NN_SERVICELEASE_H
-
-#if defined (__cplusplus)
-extern "C" {
-#endif
-
-struct nn_servicelease;
-
-struct nn_servicelease *nn_servicelease_new (void (*renew_cb) (void *arg), void *renew_arg);
-int nn_servicelease_start_renewing (struct nn_servicelease *sl);
-void nn_servicelease_stop_renewing (struct nn_servicelease *sl);
-void nn_servicelease_free (struct nn_servicelease *sl);
-void nn_servicelease_statechange_barrier (struct nn_servicelease *sl);
-
-#if defined (__cplusplus)
-}
-#endif
-
-#endif /* NN_SERVICELEASE_H */
diff --git a/src/core/ddsi/include/dds/ddsi/q_thread.h b/src/core/ddsi/include/dds/ddsi/q_thread.h
index fef01ea..71c9e5e 100644
--- a/src/core/ddsi/include/dds/ddsi/q_thread.h
+++ b/src/core/ddsi/include/dds/ddsi/q_thread.h
@@ -12,6 +12,7 @@
 #ifndef Q_THREAD_H
 #define Q_THREAD_H
 
+#include <assert.h>
 #include "dds/export.h"
 #include "dds/ddsrt/atomics.h"
 #include "dds/ddsrt/sync.h"
@@ -30,6 +31,9 @@ extern "C" {
 
 typedef uint32_t vtime_t;
 typedef int32_t svtime_t; /* signed version */
+#define VTIME_NEST_MASK 0xfu
+#define VTIME_TIME_MASK 0xfffffff0u
+#define VTIME_TIME_SHIFT 4
 
 /* GCC has a nifty feature allowing the specification of the required
    alignment: __attribute__ ((aligned (CACHE_LINE_SIZE))) in this
@@ -59,7 +63,6 @@ struct logbuf;
  */
 #define THREAD_BASE                             \
   volatile vtime_t vtime;                       \
-  volatile vtime_t watchdog;                    \
   ddsrt_thread_t tid;                           \
   ddsrt_thread_t extTid;                        \
   enum thread_state state;                      \
@@ -94,8 +97,7 @@ DDS_EXPORT void thread_states_fini (void);
 DDS_EXPORT void upgrade_main_thread (void);
 DDS_EXPORT void downgrade_main_thread (void);
 DDS_EXPORT const struct config_thread_properties_listelem *lookup_thread_properties (const char *name);
-DDS_EXPORT struct thread_state1 *create_thread (const char *name, uint32_t (*f) (void *arg), void *arg);
-DDS_EXPORT struct thread_state1 *lookup_thread_state (void);
+DDS_EXPORT dds_retcode_t create_thread (struct thread_state1 **ts, const char *name, uint32_t (*f) (void *arg), void *arg);
 DDS_EXPORT struct thread_state1 *lookup_thread_state_real (void);
 DDS_EXPORT int join_thread (struct thread_state1 *ts1);
 DDS_EXPORT void log_stack_traces (void);
@@ -104,83 +106,69 @@ DDS_EXPORT struct thread_state1 * init_thread_state (const char *tname);
 DDS_EXPORT void reset_thread_state (struct thread_state1 *ts1);
 DDS_EXPORT int thread_exists (const char *name);
 
-DDS_EXPORT inline int vtime_awake_p (vtime_t vtime)
-{
-  return (vtime % 2) == 0;
+DDS_EXPORT inline struct thread_state1 *lookup_thread_state (void) {
+  struct thread_state1 *ts1 = tsd_thread_state;
+  if (ts1)
+    return ts1;
+  else
+    return lookup_thread_state_real ();
 }
 
-DDS_EXPORT inline int vtime_asleep_p (vtime_t vtime)
+DDS_EXPORT inline bool vtime_awake_p (vtime_t vtime)
 {
-  return (vtime % 2) == 1;
+  return (vtime & VTIME_NEST_MASK) != 0;
 }
 
-DDS_EXPORT inline int vtime_gt (vtime_t vtime1, vtime_t vtime0)
+DDS_EXPORT inline bool vtime_asleep_p (vtime_t vtime)
+{
+  return (vtime & VTIME_NEST_MASK) == 0;
+}
+
+DDS_EXPORT inline bool vtime_gt (vtime_t vtime1, vtime_t vtime0)
 {
   Q_STATIC_ASSERT_CODE (sizeof (vtime_t) == sizeof (svtime_t));
-  return (svtime_t) (vtime1 - vtime0) > 0;
+  return (svtime_t) ((vtime1 & VTIME_TIME_MASK) - (vtime0 & VTIME_TIME_MASK)) > 0;
+}
+
+DDS_EXPORT inline bool thread_is_awake (void)
+{
+  return vtime_awake_p (lookup_thread_state ()->vtime);
+}
+
+DDS_EXPORT inline bool thread_is_asleep (void)
+{
+  return vtime_asleep_p (lookup_thread_state ()->vtime);
 }
 
 DDS_EXPORT inline void thread_state_asleep (struct thread_state1 *ts1)
 {
   vtime_t vt = ts1->vtime;
-  vtime_t wd = ts1->watchdog;
-  if (vtime_awake_p (vt))
-  {
-    ddsrt_atomic_fence_rel ();
-    ts1->vtime = vt + 1;
-  }
+  assert (vtime_awake_p (vt));
+  /* nested calls a rare and an extra fence doesn't break things */
+  ddsrt_atomic_fence_rel ();
+  if ((vt & VTIME_NEST_MASK) == 1)
+    vt += (1u << VTIME_TIME_SHIFT) - 1u;
   else
-  {
-    ddsrt_atomic_fence_rel ();
-    ts1->vtime = vt + 2;
-    ddsrt_atomic_fence_acq ();
-  }
-
-  if ( wd % 2 ){
-    ts1->watchdog = wd + 2;
-  } else {
-    ts1->watchdog = wd + 1;
-  }
+    vt -= 1u;
+  ts1->vtime = vt;
 }
 
 DDS_EXPORT inline void thread_state_awake (struct thread_state1 *ts1)
 {
   vtime_t vt = ts1->vtime;
-  vtime_t wd = ts1->watchdog;
-  if (vtime_asleep_p (vt))
-    ts1->vtime = vt + 1;
-  else
-  {
-    ddsrt_atomic_fence_rel ();
-    ts1->vtime = vt + 2;
-  }
+  assert ((vt & VTIME_NEST_MASK) < VTIME_NEST_MASK);
+  ts1->vtime = vt + 1u;
+  /* nested calls a rare and an extra fence doesn't break things */
   ddsrt_atomic_fence_acq ();
-
-  if ( wd % 2 ){
-    ts1->watchdog = wd + 1;
-  } else {
-    ts1->watchdog = wd + 2;
-  }
 }
 
-DDS_EXPORT inline void thread_state_blocked (struct thread_state1 *ts1)
+DDS_EXPORT inline void thread_state_awake_to_awake_no_nest (struct thread_state1 *ts1)
 {
-  vtime_t wd = ts1->watchdog;
-  if ( wd % 2 ){
-    ts1->watchdog = wd + 2;
-  } else {
-    ts1->watchdog = wd + 1;
-  }
-}
-
-DDS_EXPORT inline void thread_state_unblocked (struct thread_state1 *ts1)
-{
-  vtime_t wd = ts1->watchdog;
-  if ( wd % 2 ){
-    ts1->watchdog = wd + 1;
-  } else {
-    ts1->watchdog = wd + 2;
-  }
+  vtime_t vt = ts1->vtime;
+  assert ((vt & VTIME_NEST_MASK) == 1);
+  ddsrt_atomic_fence_rel ();
+  ts1->vtime = vt + (1u << VTIME_TIME_SHIFT);
+  ddsrt_atomic_fence_acq ();
 }
 
 #if defined (__cplusplus)
diff --git a/src/core/ddsi/include/dds/ddsi/q_transmit.h b/src/core/ddsi/include/dds/ddsi/q_transmit.h
index 14330a2..19cc947 100644
--- a/src/core/ddsi/include/dds/ddsi/q_transmit.h
+++ b/src/core/ddsi/include/dds/ddsi/q_transmit.h
@@ -25,6 +25,7 @@ struct whc_state;
 struct proxy_reader;
 struct ddsi_serdata;
 struct ddsi_tkmap_instance;
+struct thread_state1;
 
 /* Writing new data; serdata_twrite (serdata) is assumed to be really
    recentish; serdata is unref'd.  If xp == NULL, data is queued, else
@@ -33,10 +34,10 @@ struct ddsi_tkmap_instance;
    "nogc": no GC may occur, so it may not block to throttle the writer if the high water mark of the WHC is reached, which implies true KEEP_LAST behaviour.  This is true for all the DDSI built-in writers.
    "gc": GC may occur, which means the writer history and watermarks can be anything.  This must be used for all application data.
  */
-int write_sample_gc (struct nn_xpack *xp, struct writer *wr, struct ddsi_serdata *serdata, struct ddsi_tkmap_instance *tk);
-int write_sample_nogc (struct nn_xpack *xp, struct writer *wr, struct ddsi_serdata *serdata, struct ddsi_tkmap_instance *tk);
-int write_sample_gc_notk (struct nn_xpack *xp, struct writer *wr, struct ddsi_serdata *serdata);
-int write_sample_nogc_notk (struct nn_xpack *xp, struct writer *wr, struct ddsi_serdata *serdata);
+int write_sample_gc (struct thread_state1 * const ts1, struct nn_xpack *xp, struct writer *wr, struct ddsi_serdata *serdata, struct ddsi_tkmap_instance *tk);
+int write_sample_nogc (struct thread_state1 * const ts1, struct nn_xpack *xp, struct writer *wr, struct ddsi_serdata *serdata, struct ddsi_tkmap_instance *tk);
+int write_sample_gc_notk (struct thread_state1 * const ts1, struct nn_xpack *xp, struct writer *wr, struct ddsi_serdata *serdata);
+int write_sample_nogc_notk (struct thread_state1 * const ts1, struct nn_xpack *xp, struct writer *wr, struct ddsi_serdata *serdata);
 
 /* When calling the following functions, wr->lock must be held */
 int create_fragment_message (struct writer *wr, seqno_t seq, const struct nn_plist *plist, struct ddsi_serdata *serdata, unsigned fragnum, struct proxy_reader *prd,struct nn_xmsg **msg, int isnew);
diff --git a/src/core/ddsi/src/q_servicelease.c b/src/core/ddsi/src/ddsi_threadmon.c
similarity index 55%
rename from src/core/ddsi/src/q_servicelease.c
rename to src/core/ddsi/src/ddsi_threadmon.c
index 2ab892a..755848c 100644
--- a/src/core/ddsi/src/q_servicelease.c
+++ b/src/core/ddsi/src/ddsi_threadmon.c
@@ -15,7 +15,7 @@
 #include "dds/ddsrt/sync.h"
 #include "dds/ddsrt/threads.h"
 
-#include "dds/ddsi/q_servicelease.h"
+#include "dds/ddsi/ddsi_threadmon.h"
 #include "dds/ddsi/q_config.h"
 #include "dds/ddsi/q_log.h"
 #include "dds/ddsi/q_thread.h"
@@ -25,32 +25,14 @@
 #include "dds/ddsi/q_globals.h" /* for mattr, cattr */
 #include "dds/ddsi/q_receive.h"
 
-static dds_time_t nn_retrieve_lease_settings (void)
-{
-  const double leaseSec = config.servicelease_expiry_time;
-  double sleepSec = leaseSec * config.servicelease_update_factor;
-
-  /* Run at no less than 1Hz: internal liveliness monitoring is slaved
-   to this interval as well.  1Hz lease renewals and liveliness
-   checks is no large burden, and performing liveliness checks once
-   a second is a lot more useful than doing it once every few
-   seconds.  Besides -- we're now also gathering CPU statistics. */
-  if (sleepSec > 1.0f)
-    return DDS_NSECS_IN_SEC;
-
-  return ((dds_time_t)(sleepSec * DDS_NSECS_IN_SEC)) +
-         ((dds_time_t)(sleepSec * (double)DDS_NSECS_IN_SEC) % DDS_NSECS_IN_SEC);
-}
-
-struct alive_wd {
-  char alive;
-  vtime_t wd;
+struct alive_vt {
+  bool alive;
+  vtime_t vt;
 };
 
-struct nn_servicelease {
-  dds_time_t sleepTime;
+struct ddsi_threadmon {
   int keepgoing;
-  struct alive_wd *av_ary;
+  struct alive_vt *av_ary;
   void (*renew_cb) (void *arg);
   void *renew_arg;
 
@@ -59,37 +41,38 @@ struct nn_servicelease {
   struct thread_state1 *ts;
 };
 
-static uint32_t lease_renewal_thread (struct nn_servicelease *sl)
+static uint32_t threadmon_thread (struct ddsi_threadmon *sl)
 {
   /* Do not check more often than once every 100ms (no particular
      reason why it has to be 100ms), regardless of the lease settings.
      Note: can't trust sl->self, may have been scheduled before the
      assignment. */
-  const int64_t min_progress_check_intv = 100 * T_MILLISECOND;
-  struct thread_state1 *self = lookup_thread_state ();
   nn_mtime_t next_thread_cputime = { 0 };
   nn_mtime_t tlast = { 0 };
-  int was_alive = 1;
+  bool was_alive = true;
   unsigned i;
   for (i = 0; i < thread_states.nthreads; i++)
   {
-    sl->av_ary[i].alive = 1;
-    sl->av_ary[i].wd = thread_states.ts[i].watchdog - 1;
+    sl->av_ary[i].alive = true;
   }
   ddsrt_mutex_lock (&sl->lock);
   while (sl->keepgoing)
   {
+    /* Guard against spurious wakeups by checking only when cond_waitfor signals a timeout */
+    if (ddsrt_cond_waitfor (&sl->cond, &sl->lock, config.liveliness_monitoring_interval))
+      continue;
+
     unsigned n_alive = 0;
     nn_mtime_t tnow = now_mt ();
 
     LOG_THREAD_CPUTIME (next_thread_cputime);
 
-    DDS_TRACE("servicelease: tnow %"PRId64":", tnow.v);
+    DDS_TRACE("threadmon: tnow %"PRId64":", tnow.v);
 
     /* Check progress only if enough time has passed: there is no
        guarantee that os_cond_timedwait wont ever return early, and we
        do want to avoid spurious warnings. */
-    if (tnow.v < tlast.v + min_progress_check_intv)
+    if (tnow.v < tlast.v)
     {
       n_alive = thread_states.nthreads;
     }
@@ -103,11 +86,10 @@ static uint32_t lease_renewal_thread (struct nn_servicelease *sl)
         else
         {
           vtime_t vt = thread_states.ts[i].vtime;
-          vtime_t wd = thread_states.ts[i].watchdog;
-          int alive = vtime_asleep_p (vt) || vtime_asleep_p (wd) || vtime_gt (wd, sl->av_ary[i].wd);
+          bool alive = vtime_asleep_p (vt) || vtime_asleep_p (sl->av_ary[i].vt) || vtime_gt (vt, sl->av_ary[i].vt);
           n_alive += (unsigned) alive;
-          DDS_TRACE(" %u(%s):%c:%u:%u->%u:", i, thread_states.ts[i].name, alive ? 'a' : 'd', vt, sl->av_ary[i].wd, wd);
-          sl->av_ary[i].wd = wd;
+          DDS_TRACE(" %u(%s):%c:%x->%x", i, thread_states.ts[i].name, alive ? 'a' : 'd', sl->av_ary[i].vt, vt);
+          sl->av_ary[i].vt = vt;
           if (sl->av_ary[i].alive != alive)
           {
             const char *name = thread_states.ts[i].name;
@@ -117,31 +99,23 @@ static uint32_t lease_renewal_thread (struct nn_servicelease *sl)
             else
               msg = "once again made progress";
             DDS_INFO("thread %s %s\n", name ? name : "(anon)", msg);
-            sl->av_ary[i].alive = (char) alive;
+            sl->av_ary[i].alive = alive;
           }
         }
       }
     }
 
-    /* Only renew the lease if all threads are alive, so that one
-       thread blocking for a while but not too extremely long will
-       cause warnings for that thread in the log file, but won't cause
-       the DDSI2 service to be marked as dead. */
     if (n_alive == thread_states.nthreads)
     {
-      DDS_TRACE(": [%u] renewing\n", n_alive);
-      /* FIXME: perhaps it would be nice to control automatic
-         liveliness updates from here.
-         FIXME: should terminate failure of renew_cb() */
-      sl->renew_cb (sl->renew_arg);
-      was_alive = 1;
+      DDS_TRACE(": [%u] OK\n", n_alive);
+      was_alive = true;
     }
     else
     {
-      DDS_TRACE(": [%u] NOT renewing\n", n_alive);
+      DDS_TRACE(": [%u] FAIL\n", n_alive);
       if (was_alive)
         log_stack_traces ();
-      was_alive = 0;
+      was_alive = false;
     }
 
     if (dds_get_log_mask() & DDS_LC_TIMING)
@@ -151,20 +125,14 @@ static uint32_t lease_renewal_thread (struct nn_servicelease *sl)
       {
         DDS_LOG(DDS_LC_TIMING,
                 "rusage: utime %d.%09d stime %d.%09d maxrss %ld data %ld vcsw %ld ivcsw %ld\n",
-                (int) u.utime / DDS_NSECS_IN_SEC,
-                (int) u.utime % DDS_NSECS_IN_SEC,
-                (int) u.stime / DDS_NSECS_IN_SEC,
-                (int) u.stime % DDS_NSECS_IN_SEC,
+                (int) (u.utime / DDS_NSECS_IN_SEC),
+                (int) (u.utime % DDS_NSECS_IN_SEC),
+                (int) (u.stime / DDS_NSECS_IN_SEC),
+                (int) (u.stime % DDS_NSECS_IN_SEC),
                 u.maxrss, u.idrss, u.nvcsw, u.nivcsw);
       }
     }
 
-    ddsrt_cond_waitfor (&sl->cond, &sl->lock, sl->sleepTime);
-
-    /* We are never active in a way that matters for the garbage
-       collection of old writers, &c. */
-    thread_state_asleep (self);
-
     /* While deaf, we need to make sure the receive thread wakes up
        every now and then to try recreating sockets & rejoining multicast
        groups */
@@ -175,19 +143,12 @@ static uint32_t lease_renewal_thread (struct nn_servicelease *sl)
   return 0;
 }
 
-static void dummy_renew_cb (UNUSED_ARG (void *arg))
+struct ddsi_threadmon *ddsi_threadmon_new (void)
 {
-}
-
-struct nn_servicelease *nn_servicelease_new (void (*renew_cb) (void *arg), void *renew_arg)
-{
-  struct nn_servicelease *sl;
+  struct ddsi_threadmon *sl;
 
   sl = ddsrt_malloc (sizeof (*sl));
-  sl->sleepTime = nn_retrieve_lease_settings ();
   sl->keepgoing = -1;
-  sl->renew_cb = renew_cb ? renew_cb : dummy_renew_cb;
-  sl->renew_arg = renew_arg;
   sl->ts = NULL;
 
   if ((sl->av_ary = ddsrt_malloc (thread_states.nthreads * sizeof (*sl->av_ary))) == NULL)
@@ -203,15 +164,14 @@ struct nn_servicelease *nn_servicelease_new (void (*renew_cb) (void *arg), void
   return NULL;
 }
 
-int nn_servicelease_start_renewing (struct nn_servicelease *sl)
+int ddsi_threadmon_start (struct ddsi_threadmon *sl)
 {
   ddsrt_mutex_lock (&sl->lock);
   assert (sl->keepgoing == -1);
   sl->keepgoing = 1;
   ddsrt_mutex_unlock (&sl->lock);
 
-  sl->ts = create_thread ("lease", (uint32_t (*) (void *)) lease_renewal_thread, sl);
-  if (sl->ts == NULL)
+  if (create_thread (&sl->ts, "lease", (uint32_t (*) (void *)) threadmon_thread, sl) != DDS_RETCODE_OK)
     goto fail_thread;
   return 0;
 
@@ -220,13 +180,13 @@ int nn_servicelease_start_renewing (struct nn_servicelease *sl)
   return Q_ERR_UNSPECIFIED;
 }
 
-void nn_servicelease_statechange_barrier (struct nn_servicelease *sl)
+void ddsi_threadmon_statechange_barrier (struct ddsi_threadmon *sl)
 {
   ddsrt_mutex_lock (&sl->lock);
   ddsrt_mutex_unlock (&sl->lock);
 }
 
-void nn_servicelease_stop_renewing (struct nn_servicelease *sl)
+void ddsi_threadmon_stop (struct ddsi_threadmon *sl)
 {
   if (sl->keepgoing != -1)
   {
@@ -238,7 +198,7 @@ void nn_servicelease_stop_renewing (struct nn_servicelease *sl)
   }
 }
 
-void nn_servicelease_free (struct nn_servicelease *sl)
+void ddsi_threadmon_free (struct ddsi_threadmon *sl)
 {
   ddsrt_cond_destroy (&sl->cond);
   ddsrt_mutex_destroy (&sl->lock);
diff --git a/src/core/ddsi/src/ddsi_tkmap.c b/src/core/ddsi/src/ddsi_tkmap.c
index 0d1c6bd..b688e09 100644
--- a/src/core/ddsi/src/ddsi_tkmap.c
+++ b/src/core/ddsi/src/ddsi_tkmap.c
@@ -113,7 +113,7 @@ uint64_t ddsi_tkmap_lookup (struct ddsi_tkmap * map, const struct ddsi_serdata *
 {
   struct ddsi_tkmap_instance dummy;
   struct ddsi_tkmap_instance * tk;
-  assert (vtime_awake_p(lookup_thread_state()->vtime));
+  assert (thread_is_awake ());
   dummy.m_sample = (struct ddsi_serdata *) sd;
   tk = ut_chhLookup (map->m_hh, &dummy);
   return (tk) ? tk->m_iid : DDS_HANDLE_NIL;
@@ -125,7 +125,7 @@ struct ddsi_tkmap_instance *ddsi_tkmap_find_by_id (struct ddsi_tkmap *map, uint6
   struct ut_chhIter it;
   struct ddsi_tkmap_instance *tk;
   uint32_t refc;
-  assert (vtime_awake_p(lookup_thread_state()->vtime));
+  assert (thread_is_awake ());
   for (tk = ut_chhIterFirst (map->m_hh, &it); tk; tk = ut_chhIterNext (&it))
     if (tk->m_iid == iid)
       break;
@@ -162,7 +162,7 @@ ddsi_tkmap_find(
   struct ddsi_tkmap_instance * tk;
   struct ddsi_tkmap * map = gv.m_tkmap;
 
-  assert (vtime_awake_p(lookup_thread_state()->vtime));
+  assert (thread_is_awake ());
   dummy.m_sample = sd;
 retry:
   if ((tk = ut_chhLookup(map->m_hh, &dummy)) != NULL)
@@ -221,7 +221,7 @@ void ddsi_tkmap_instance_ref (struct ddsi_tkmap_instance *tk)
 void ddsi_tkmap_instance_unref (struct ddsi_tkmap_instance * tk)
 {
   uint32_t old, new;
-  assert (vtime_awake_p(lookup_thread_state()->vtime));
+  assert (thread_is_awake ());
   do {
     old = ddsrt_atomic_ld32(&tk->m_refc);
     if (old == 1)
diff --git a/src/core/ddsi/src/q_config.c b/src/core/ddsi/src/q_config.c
index 07ddc4b..b613df8 100644
--- a/src/core/ddsi/src/q_config.c
+++ b/src/core/ddsi/src/q_config.c
@@ -141,7 +141,6 @@ DU(tracingOutputFileName);
 DU(verbosity);
 DUPF(logcat);
 DUPF(xcheck);
-DUPF(float);
 DUPF(int);
 DUPF(uint);
 DUPF(int32);
@@ -158,6 +157,7 @@ DU(duration_inf);
 DU(duration_ms_1hr);
 DU(duration_ms_1s);
 DU(duration_us_1s);
+DU(duration_100ms_1hr);
 PF(duration);
 DUPF(standards_conformance);
 DUPF(besmode);
@@ -516,6 +516,8 @@ static const struct cfgelem heartbeat_interval_attrs[] = {
 static const struct cfgelem liveliness_monitoring_attrs[] = {
   { ATTR("StackTraces"), 1, "true", ABSOFF(noprogress_log_stacktraces), 0, uf_boolean, 0, pf_boolean,
     "<p>This element controls whether or not to write stack traces to the DDSI2 trace when a thread fails to make progress (on select platforms only).</p>" },
+  { ATTR("Interval"), 1, "1s", ABSOFF(liveliness_monitoring_interval), 0, uf_duration_100ms_1hr, 0, pf_duration,
+    "<p>This element controls the interval at which to check whether threads have been making progress.</p>" },
   END_MARKER
 };
 
@@ -878,23 +880,14 @@ static const struct cfgelem ddsi2_cfgelems[] = {
     END_MARKER
 };
 
-/* Note: using 2e-1 instead of 0.2 to avoid use of the decimal
-separator, which is locale dependent. */
-static const struct cfgelem lease_expiry_time_cfgattrs[] = {
-    { ATTR("update_factor"), 1, "2e-1", ABSOFF(servicelease_update_factor), 0, uf_float, 0, pf_float, NULL },
-    END_MARKER
+static const struct cfgelem deprecated_lease_cfgelems[] = {
+  WILDCARD,
+  END_MARKER
 };
 
-static const struct cfgelem lease_cfgelems[] = {
-    { LEAF_W_ATTRS("ExpiryTime", lease_expiry_time_cfgattrs), 1, "10", ABSOFF(servicelease_expiry_time), 0, uf_float, 0, pf_float, NULL },
-    END_MARKER
-};
-
-
 static const struct cfgelem domain_cfgelems[] = {
-    { GROUP("Lease", lease_cfgelems), NULL },
     { LEAF("Id"), 1, "any", ABSOFF(domainId), 0, uf_domainId, 0, pf_domainId, NULL },
-    WILDCARD,
+    { GROUP("|Lease", deprecated_lease_cfgelems), NULL },
     END_MARKER
 };
 
@@ -908,7 +901,7 @@ static const struct cfgelem root_cfgelems[] = {
     { "DDSI2E|DDSI2", ddsi2_cfgelems, NULL, NODATA,
     "<p>DDSI2 settings ...</p>" },
     { "Durability", durability_cfgelems, NULL, NODATA, NULL },
-    { "Lease", lease_cfgelems, NULL, NODATA, NULL },
+    { GROUP("|Lease", deprecated_lease_cfgelems), NULL },
     END_MARKER
 };
 
@@ -1529,7 +1522,7 @@ static int uf_string(struct cfgst *cfgst, void *parent, struct cfgelem const * c
 }
 
 DDSRT_WARNING_MSVC_OFF(4996);
-static int uf_natint64_unit(struct cfgst *cfgst, int64_t *elem, const char *value, const struct unit *unittab, int64_t def_mult, int64_t max)
+static int uf_natint64_unit(struct cfgst *cfgst, int64_t *elem, const char *value, const struct unit *unittab, int64_t def_mult, int64_t min, int64_t max)
 {
     int pos;
     double v_dbl;
@@ -1542,14 +1535,14 @@ static int uf_natint64_unit(struct cfgst *cfgst, int64_t *elem, const char *valu
         return cfg_error(cfgst, "%s: empty string is not a valid value", value);
     } else if ( sscanf(value, "%lld%n", (long long int *) &v_int, &pos) == 1 && (mult = lookup_multiplier(cfgst, unittab, value, pos, v_int == 0, def_mult, 0)) != 0 ) {
         assert(mult > 0);
-        if ( v_int < 0 || v_int > max / mult )
+        if ( v_int < 0 || v_int > max / mult || mult * v_int < min)
             return cfg_error(cfgst, "%s: value out of range", value);
         *elem = mult * v_int;
         return 1;
     } else if ( sscanf(value, "%lf%n", &v_dbl, &pos) == 1 && (mult = lookup_multiplier(cfgst, unittab, value, pos, v_dbl == 0, def_mult, 1)) != 0 ) {
         double dmult = (double) mult;
         assert(dmult > 0);
-        if ( v_dbl < 0 || (int64_t) (v_dbl * dmult + 0.5) > max )
+        if ( (int64_t) (v_dbl * dmult + 0.5) < min || (int64_t) (v_dbl * dmult + 0.5) > max )
             return cfg_error(cfgst, "%s: value out of range", value);
         *elem = (int64_t) (v_dbl * dmult + 0.5);
         return 1;
@@ -1587,7 +1580,7 @@ static int uf_bandwidth(struct cfgst *cfgst, void *parent, struct cfgelem const
 static int uf_memsize(struct cfgst *cfgst, void *parent, struct cfgelem const * const cfgelem, UNUSED_ARG(int first), const char *value)
 {
     int64_t size = 0;
-    if ( !uf_natint64_unit(cfgst, &size, value, unittab_memsize, 1, INT32_MAX) )
+    if ( !uf_natint64_unit(cfgst, &size, value, unittab_memsize, 1, 0, INT32_MAX) )
         return 0;
     else {
         uint32_t *elem = cfg_address(cfgst, parent, cfgelem);
@@ -1844,7 +1837,7 @@ static int uf_maybe_memsize(struct cfgst *cfgst, void *parent, struct cfgelem co
         elem->isdefault = 1;
         elem->value = 0;
         return 1;
-    } else if ( !uf_natint64_unit(cfgst, &size, value, unittab_memsize, 1, INT32_MAX) ) {
+    } else if ( !uf_natint64_unit(cfgst, &size, value, unittab_memsize, 1, 0, INT32_MAX) ) {
         return 0;
     } else {
         elem->isdefault = 0;
@@ -1853,19 +1846,6 @@ static int uf_maybe_memsize(struct cfgst *cfgst, void *parent, struct cfgelem co
     }
 }
 
-
-static int uf_float(struct cfgst *cfgst, void *parent, struct cfgelem const * const cfgelem, UNUSED_ARG(int first), const char *value)
-{
-    float *elem = cfg_address(cfgst, parent, cfgelem);
-    char *endptr;
-    float f;
-    dds_retcode_t rc = ddsrt_strtof(value, &endptr, &f);
-    if (rc != DDS_RETCODE_OK || *value == 0 || *endptr != 0 )
-        return cfg_error(cfgst, "%s: not a floating point number", value);
-    *elem = f;
-    return 1;
-}
-
 static int uf_int(struct cfgst *cfgst, void *parent, struct cfgelem const * const cfgelem, UNUSED_ARG(int first), const char *value)
 {
     int *elem = cfg_address(cfgst, parent, cfgelem);
@@ -1879,9 +1859,9 @@ static int uf_int(struct cfgst *cfgst, void *parent, struct cfgelem const * cons
     return 1;
 }
 
-static int uf_duration_gen(struct cfgst *cfgst, void *parent, struct cfgelem const * const cfgelem, const char *value, int64_t def_mult, int64_t max_ns)
+static int uf_duration_gen(struct cfgst *cfgst, void *parent, struct cfgelem const * const cfgelem, const char *value, int64_t def_mult, int64_t min_ns, int64_t max_ns)
 {
-    return uf_natint64_unit(cfgst, cfg_address(cfgst, parent, cfgelem), value, unittab_duration, def_mult, max_ns);
+    return uf_natint64_unit(cfgst, cfg_address(cfgst, parent, cfgelem), value, unittab_duration, def_mult, min_ns, max_ns);
 }
 
 static int uf_duration_inf(struct cfgst *cfgst, void *parent, struct cfgelem const * const cfgelem, UNUSED_ARG(int first), const char *value)
@@ -1891,23 +1871,28 @@ static int uf_duration_inf(struct cfgst *cfgst, void *parent, struct cfgelem con
         *elem = T_NEVER;
         return 1;
     } else {
-        return uf_duration_gen(cfgst, parent, cfgelem, value, 0, T_NEVER - 1);
+        return uf_duration_gen(cfgst, parent, cfgelem, value, 0, 0, T_NEVER - 1);
     }
 }
 
 static int uf_duration_ms_1hr(struct cfgst *cfgst, void *parent, struct cfgelem const * const cfgelem, UNUSED_ARG(int first), const char *value)
 {
-    return uf_duration_gen(cfgst, parent, cfgelem, value, T_MILLISECOND, 3600 * T_SECOND);
+    return uf_duration_gen(cfgst, parent, cfgelem, value, T_MILLISECOND, 0, 3600 * T_SECOND);
 }
 
 static int uf_duration_ms_1s(struct cfgst *cfgst, void *parent, struct cfgelem const * const cfgelem, UNUSED_ARG(int first), const char *value)
 {
-    return uf_duration_gen(cfgst, parent, cfgelem, value, T_MILLISECOND, T_SECOND);
+    return uf_duration_gen(cfgst, parent, cfgelem, value, T_MILLISECOND, 0, T_SECOND);
 }
 
 static int uf_duration_us_1s(struct cfgst *cfgst, void *parent, struct cfgelem const * const cfgelem, UNUSED_ARG(int first), const char *value)
 {
-    return uf_duration_gen(cfgst, parent, cfgelem, value, 1000, T_SECOND);
+    return uf_duration_gen(cfgst, parent, cfgelem, value, 1000, 0, T_SECOND);
+}
+
+static int uf_duration_100ms_1hr(struct cfgst *cfgst, void *parent, struct cfgelem const * const cfgelem, UNUSED_ARG(int first), const char *value)
+{
+  return uf_duration_gen(cfgst, parent, cfgelem, value, 0, 100 * T_MILLISECOND, 3600 * T_SECOND);
 }
 
 static int uf_int32(struct cfgst *cfgst, void *parent, struct cfgelem const * const cfgelem, UNUSED_ARG(int first), const char *value)
@@ -2309,12 +2294,6 @@ static void pf_domainId(struct cfgst *cfgst, void *parent, struct cfgelem const
     cfg_log(cfgst, "%d%s", p->value, is_default ? " [def]" : "");
 }
 
-static void pf_float(struct cfgst *cfgst, void *parent, struct cfgelem const * const cfgelem, int is_default)
-{
-    float *p = cfg_address(cfgst, parent, cfgelem);
-    cfg_log(cfgst, "%f%s", *p, is_default ? " [def]" : "");
-}
-
 static void pf_boolean(struct cfgst *cfgst, void *parent, struct cfgelem const * const cfgelem, int is_default)
 {
     int *p = cfg_address(cfgst, parent, cfgelem);
diff --git a/src/core/ddsi/src/q_ddsi_discovery.c b/src/core/ddsi/src/q_ddsi_discovery.c
index be434dd..bf5ec02 100644
--- a/src/core/ddsi/src/q_ddsi_discovery.c
+++ b/src/core/ddsi/src/q_ddsi_discovery.c
@@ -172,13 +172,14 @@ static void maybe_add_pp_as_meta_to_as_disc (const struct addrset *as_meta)
 
 static int write_mpayload (struct writer *wr, int alive, nn_parameterid_t keyparam, struct nn_xmsg *mpayload)
 {
+  struct thread_state1 * const ts1 = lookup_thread_state ();
   struct ddsi_plist_sample plist_sample;
   struct ddsi_serdata *serdata;
   nn_xmsg_payload_to_plistsample (&plist_sample, keyparam, mpayload);
   serdata = ddsi_serdata_from_sample (gv.plist_topic, alive ? SDK_DATA : SDK_KEY, &plist_sample);
   serdata->statusinfo = alive ? 0 : NN_STATUSINFO_DISPOSE | NN_STATUSINFO_UNREGISTER;
   serdata->timestamp = now ();
-  return write_sample_nogc_notk (NULL, wr, serdata);
+  return write_sample_nogc_notk (ts1, NULL, wr, serdata);
 }
 
 int spdp_write (struct participant *pp)
diff --git a/src/core/ddsi/src/q_debmon.c b/src/core/ddsi/src/q_debmon.c
index beaa9bf..8043229 100644
--- a/src/core/ddsi/src/q_debmon.c
+++ b/src/core/ddsi/src/q_debmon.c
@@ -142,12 +142,12 @@ static int print_proxy_endpoint_common (ddsi_tran_conn_t conn, const char *label
 }
 
 
-static int print_participants (struct thread_state1 *self, ddsi_tran_conn_t conn)
+static int print_participants (struct thread_state1 * const ts1, ddsi_tran_conn_t conn)
 {
   struct ephash_enum_participant e;
   struct participant *p;
   int x = 0;
-  thread_state_awake (self);
+  thread_state_awake (ts1);
   ephash_enum_participant_init (&e);
   while ((p = ephash_enum_participant_next (&e)) != NULL)
   {
@@ -223,16 +223,16 @@ static int print_participants (struct thread_state1 *self, ddsi_tran_conn_t conn
     }
   }
   ephash_enum_participant_fini (&e);
-  thread_state_asleep (self);
+  thread_state_asleep (ts1);
   return x;
 }
 
-static int print_proxy_participants (struct thread_state1 *self, ddsi_tran_conn_t conn)
+static int print_proxy_participants (struct thread_state1 * const ts1, ddsi_tran_conn_t conn)
 {
   struct ephash_enum_proxy_participant e;
   struct proxy_participant *p;
   int x = 0;
-  thread_state_awake (self);
+  thread_state_awake (ts1);
   ephash_enum_proxy_participant_init (&e);
   while ((p = ephash_enum_proxy_participant_next (&e)) != NULL)
   {
@@ -296,17 +296,18 @@ static int print_proxy_participants (struct thread_state1 *self, ddsi_tran_conn_
     }
   }
   ephash_enum_proxy_participant_fini (&e);
-  thread_state_asleep (self);
+  thread_state_asleep (ts1);
   return x;
 }
 
 static void debmon_handle_connection (struct debug_monitor *dm, ddsi_tran_conn_t conn)
 {
+  struct thread_state1 * const ts1 = lookup_thread_state ();
   struct plugin *p;
   int r = 0;
-  r += print_participants (dm->servts, conn);
+  r += print_participants (ts1, conn);
   if (r == 0)
-    r += print_proxy_participants (dm->servts, conn);
+    r += print_proxy_participants (ts1, conn);
 
   /* Note: can only add plugins (at the tail) */
   ddsrt_mutex_lock (&dm->lock);
@@ -379,7 +380,7 @@ struct debug_monitor *new_debug_monitor (int port)
   if (ddsi_listener_listen (dm->servsock) < 0)
     goto err_listen;
   dm->stop = 0;
-  dm->servts = create_thread("debmon", debmon_main, dm);
+  create_thread(&dm->servts, "debmon", debmon_main, dm);
   return dm;
 
 err_listen:
diff --git a/src/core/ddsi/src/q_entity.c b/src/core/ddsi/src/q_entity.c
index c832a9b..685543b 100644
--- a/src/core/ddsi/src/q_entity.c
+++ b/src/core/ddsi/src/q_entity.c
@@ -3862,14 +3862,11 @@ void purge_proxy_participants (const nn_locator_t *loc, bool delete_from_as_disc
 {
   /* FIXME: check whether addr:port can't be reused for a new connection by the time we get here. */
   /* NOTE: This function exists for the sole purpose of cleaning up after closing a TCP connection in ddsi_tcp_close_conn and the state of the calling thread could be anything at this point. Because of that we do the unspeakable and toggle the thread state conditionally. We can't afford to have it in "asleep", as that causes a race with the garbage collector. */
-  struct thread_state1 * const self = lookup_thread_state();
-  const int self_is_awake = vtime_awake_p (self->vtime);
+  struct thread_state1 * const ts1 = lookup_thread_state ();
   struct ephash_enum_proxy_participant est;
   struct proxy_purge_data data;
 
-  if (!self_is_awake)
-    thread_state_awake(self);
-
+  thread_state_awake (ts1);
   data.loc = loc;
   data.timestamp = now();
   ephash_enum_proxy_participant_init (&est);
@@ -3881,8 +3878,7 @@ void purge_proxy_participants (const nn_locator_t *loc, bool delete_from_as_disc
   if (delete_from_as_disc)
     remove_from_addrset (gv.as_disc, loc);
 
-  if (!self_is_awake)
-    thread_state_asleep(self);
+  thread_state_asleep (ts1);
 }
 
 int delete_proxy_participant_by_guid (const struct nn_guid * guid, nn_wctime_t timestamp, int isimplicit)
diff --git a/src/core/ddsi/src/q_gc.c b/src/core/ddsi/src/q_gc.c
index 915c92b..42fc0ef 100644
--- a/src/core/ddsi/src/q_gc.c
+++ b/src/core/ddsi/src/q_gc.c
@@ -79,7 +79,7 @@ static int threads_vtime_check (unsigned *nivs, struct idx_vtime *ivs)
 
 static uint32_t gcreq_queue_thread (struct gcreq_queue *q)
 {
-  struct thread_state1 *self = lookup_thread_state ();
+  struct thread_state1 * const ts1 = lookup_thread_state ();
   nn_mtime_t next_thread_cputime = { 0 };
   dds_time_t shortsleep = 1 * T_MILLISECOND;
   int64_t delay = T_MILLISECOND; /* force evaluation after startup */
@@ -124,9 +124,9 @@ static uint32_t gcreq_queue_thread (struct gcreq_queue *q)
        very little impact on its primary purpose and be less of a
        burden on the system than having a separate thread or adding it
        to the workload of the data handling threads. */
-    thread_state_awake (self);
-    delay = check_and_handle_lease_expiration (self, now_et ());
-    thread_state_asleep (self);
+    thread_state_awake (ts1);
+    delay = check_and_handle_lease_expiration (now_et ());
+    thread_state_asleep (ts1);
 
     if (gcreq)
     {
@@ -151,9 +151,9 @@ static uint32_t gcreq_queue_thread (struct gcreq_queue *q)
            multi-phase delete) or freeing the delete request.  Reset
            the current gcreq as this one obviously is no more.  */
         DDS_TRACE("gc %p: deleting\n", (void*)gcreq);
-        thread_state_awake (self);
+        thread_state_awake (ts1);
         gcreq->cb (gcreq);
-        thread_state_asleep (self);
+        thread_state_asleep (ts1);
         gcreq = NULL;
         trace_shortsleep = 1;
       }
@@ -174,9 +174,15 @@ struct gcreq_queue *gcreq_queue_new (void)
   q->count = 0;
   ddsrt_mutex_init (&q->lock);
   ddsrt_cond_init (&q->cond);
-  q->ts = create_thread ("gc", (uint32_t (*) (void *)) gcreq_queue_thread, q);
-  assert (q->ts);
-  return q;
+  if (create_thread (&q->ts, "gc", (uint32_t (*) (void *)) gcreq_queue_thread, q) == DDS_RETCODE_OK)
+    return q;
+  else
+  {
+    ddsrt_mutex_destroy (&q->lock);
+    ddsrt_cond_destroy (&q->cond);
+    ddsrt_free (q);
+    return NULL;
+  }
 }
 
 void gcreq_queue_drain (struct gcreq_queue *q)
diff --git a/src/core/ddsi/src/q_init.c b/src/core/ddsi/src/q_init.c
index 9fddd09..0b89411 100644
--- a/src/core/ddsi/src/q_init.c
+++ b/src/core/ddsi/src/q_init.c
@@ -839,7 +839,7 @@ static int setup_and_start_recv_threads (void)
         goto fail;
       }
     }
-    if ((gv.recv_threads[i].ts = create_thread (gv.recv_threads[i].name, recv_thread, &gv.recv_threads[i].arg)) == NULL)
+    if (create_thread (&gv.recv_threads[i].ts, gv.recv_threads[i].name, recv_thread, &gv.recv_threads[i].arg) != DDS_RETCODE_OK)
     {
       DDS_ERROR("rtps_init: failed to start thread %s\n", gv.recv_threads[i].name);
       goto fail;
@@ -1399,7 +1399,7 @@ int rtps_start (void)
   }
   if (gv.listener)
   {
-    gv.listen_ts = create_thread ("listen", (uint32_t (*) (void *)) listen_thread, gv.listener);
+    create_thread (&gv.listen_ts, "listen", (uint32_t (*) (void *)) listen_thread, gv.listener);
   }
   if (gv.startup_mode)
   {
@@ -1429,7 +1429,8 @@ static void builtins_dqueue_ready_cb (void *varg)
 
 void rtps_stop (void)
 {
-  struct thread_state1 *self = lookup_thread_state ();
+  struct thread_state1 * const ts1 = lookup_thread_state ();
+
 #ifdef DDSI_INCLUDE_NETWORK_CHANNELS
   struct config_channel_listelem * chptr;
 #endif
@@ -1496,14 +1497,14 @@ void rtps_stop (void)
     /* Clean up proxy readers, proxy writers and proxy
        participants. Deleting a proxy participants deletes all its
        readers and writers automatically */
-    thread_state_awake (self);
+    thread_state_awake (ts1);
     ephash_enum_proxy_participant_init (&est);
     while ((proxypp = ephash_enum_proxy_participant_next (&est)) != NULL)
     {
       delete_proxy_participant_by_guid(&proxypp->e.guid, tnow, 1);
     }
     ephash_enum_proxy_participant_fini (&est);
-    thread_state_asleep (self);
+    thread_state_asleep (ts1);
   }
 
   {
@@ -1518,7 +1519,7 @@ void rtps_stop (void)
        rwriters to get all SEDP and SPDP dispose+unregister messages
        out. FIXME: need to keep xevent thread alive for a while
        longer. */
-    thread_state_awake (self);
+    thread_state_awake (ts1);
     ephash_enum_writer_init (&est_wr);
     while ((wr = ephash_enum_writer_next (&est_wr)) != NULL)
     {
@@ -1526,7 +1527,7 @@ void rtps_stop (void)
         delete_writer_nolinger (&wr->e.guid);
     }
     ephash_enum_writer_fini (&est_wr);
-    thread_state_awake (self);
+    thread_state_awake_to_awake_no_nest (ts1);
     ephash_enum_reader_init (&est_rd);
     while ((rd = ephash_enum_reader_next (&est_rd)) != NULL)
     {
@@ -1534,14 +1535,14 @@ void rtps_stop (void)
         (void)delete_reader (&rd->e.guid);
     }
     ephash_enum_reader_fini (&est_rd);
-    thread_state_awake (self);
+    thread_state_awake_to_awake_no_nest (ts1);
     ephash_enum_participant_init (&est_pp);
     while ((pp = ephash_enum_participant_next (&est_pp)) != NULL)
     {
       delete_participant (&pp->e.guid);
     }
     ephash_enum_participant_fini (&est_pp);
-    thread_state_asleep (self);
+    thread_state_asleep (ts1);
   }
 
   /* Wait until all participants are really gone => by then we can be
diff --git a/src/core/ddsi/src/q_lease.c b/src/core/ddsi/src/q_lease.c
index 1dac32c..0e2d99c 100644
--- a/src/core/ddsi/src/q_lease.c
+++ b/src/core/ddsi/src/q_lease.c
@@ -205,7 +205,7 @@ void lease_set_expiry (struct lease *l, nn_etime_t when)
     force_lease_check();
 }
 
-int64_t check_and_handle_lease_expiration (UNUSED_ARG (struct thread_state1 *self), nn_etime_t tnowE)
+int64_t check_and_handle_lease_expiration (nn_etime_t tnowE)
 {
   struct lease *l;
   int64_t delay;
diff --git a/src/core/ddsi/src/q_radmin.c b/src/core/ddsi/src/q_radmin.c
index 20eaa66..1ca2e83 100644
--- a/src/core/ddsi/src/q_radmin.c
+++ b/src/core/ddsi/src/q_radmin.c
@@ -2397,7 +2397,7 @@ static enum dqueue_elem_kind dqueue_elem_kind (const struct nn_rsample_chain_ele
 
 static uint32_t dqueue_thread (struct nn_dqueue *q)
 {
-  struct thread_state1 *self = lookup_thread_state ();
+  struct thread_state1 * const ts1 = lookup_thread_state ();
   nn_mtime_t next_thread_cputime = { 0 };
   int keepgoing = 1;
   nn_guid_t rdguid, *prdguid = NULL;
@@ -2416,6 +2416,7 @@ static uint32_t dqueue_thread (struct nn_dqueue *q)
     q->sc.first = q->sc.last = NULL;
     ddsrt_mutex_unlock (&q->lock);
 
+    thread_state_awake (ts1);
     while (sc.first)
     {
       struct nn_rsample_chain_elem *e = sc.first;
@@ -2424,7 +2425,7 @@ static uint32_t dqueue_thread (struct nn_dqueue *q)
       if (ddsrt_atomic_dec32_ov (&q->nof_samples) == 1) {
         ddsrt_cond_broadcast (&q->cond);
       }
-      thread_state_awake (self);
+      thread_state_awake_to_awake_no_nest (ts1);
       switch (dqueue_elem_kind (e))
       {
         case DQEK_DATA:
@@ -2474,9 +2475,9 @@ static uint32_t dqueue_thread (struct nn_dqueue *q)
             break;
           }
       }
-      thread_state_asleep (self);
     }
 
+    thread_state_asleep (ts1);
     ddsrt_mutex_lock (&q->lock);
   }
   ddsrt_mutex_unlock (&q->lock);
@@ -2506,7 +2507,7 @@ struct nn_dqueue *nn_dqueue_new (const char *name, uint32_t max_samples, nn_dque
   if ((thrname = ddsrt_malloc (thrnamesz)) == NULL)
     goto fail_thrname;
   snprintf (thrname, thrnamesz, "dq.%s", name);
-  if ((q->ts = create_thread (thrname, (uint32_t (*) (void *)) dqueue_thread, q)) == NULL)
+  if (create_thread (&q->ts, thrname, (uint32_t (*) (void *)) dqueue_thread, q) != DDS_RETCODE_OK)
     goto fail_thread;
   ddsrt_free (thrname);
   return q;
diff --git a/src/core/ddsi/src/q_receive.c b/src/core/ddsi/src/q_receive.c
index 8671a5b..9e7f899 100644
--- a/src/core/ddsi/src/q_receive.c
+++ b/src/core/ddsi/src/q_receive.c
@@ -2660,9 +2660,9 @@ static struct receiver_state *rst_cow_if_needed (int *rst_live, struct nn_rmsg *
 
 static int handle_submsg_sequence
 (
+  struct thread_state1 * const ts1,
   ddsi_tran_conn_t conn,
   const nn_locator_t *srcloc,
-  struct thread_state1 * const self,
   nn_wctime_t tnowWC,
   nn_etime_t tnowE,
   const nn_guid_prefix_t * const src_prefix,
@@ -2709,10 +2709,12 @@ static int handle_submsg_sequence
   ts_for_latmeas = 0;
   timestamp = invalid_ddsi_timestamp;
 
+  assert (thread_is_asleep ());
+  thread_state_awake (ts1);
   while (submsg <= (end - sizeof (SubmessageHeader_t)))
   {
     Submessage_t *sm = (Submessage_t *) submsg;
-    int byteswap;
+    bool byteswap;
     unsigned octetsToNextHeader;
 
     if (sm->smhdr.flags & SMFLAG_ENDIANNESS)
@@ -2749,7 +2751,7 @@ static int handle_submsg_sequence
       break;
     }
 
-    thread_state_awake (self);
+    thread_state_awake_to_awake_no_nest (ts1);
     state_smkind = sm->smhdr.submessageId;
     switch (sm->smhdr.submessageId)
     {
@@ -2855,9 +2857,7 @@ static int handle_submsg_sequence
           unsigned char *datap;
           /* valid_Data does not validate the payload */
           if (!valid_Data (rst, rmsg, &sm->data, submsg_size, byteswap, &sampleinfo, &datap))
-          {
             goto malformed;
-          }
           sampleinfo.timestamp = timestamp;
           sampleinfo.reception_timestamp = tnowWC;
           handle_Data (rst, tnowE, rmsg, &sm->data, submsg_size, &sampleinfo, datap);
@@ -2886,8 +2886,10 @@ static int handle_submsg_sequence
                 size_t len2 = decode_container (submsg1, len1);
                 if ( len2 != 0 ) {
                   TRACE ((")\n"));
-                  if (handle_submsg_sequence (conn, srcloc, self, tnowWC, tnowE, src_prefix, dst_prefix, msg, (size_t) (submsg1 - msg) + len2, submsg1, rmsg) < 0)
-                    goto malformed;
+                  thread_state_asleep (ts1);
+                  if (handle_submsg_sequence (conn, srcloc, tnowWC, tnowE, src_prefix, dst_prefix, msg, (size_t) (submsg1 - msg) + len2, submsg1, rmsg) < 0)
+                    goto malformed_asleep;
+                  thread_state_awake (ts1);
                 }
                 TRACE (("PT_INFO_CONTAINER END"));
               }
@@ -2952,19 +2954,24 @@ static int handle_submsg_sequence
     state = "parse:shortmsg";
     state_smkind = SMID_PAD;
     DDS_TRACE("short (size %"PRIuSIZE" exp %p act %p)", submsg_size, (void *) submsg, (void *) end);
-    goto malformed;
+    goto malformed_asleep;
   }
+  thread_state_asleep (ts1);
+  assert (thread_is_asleep ());
   return 0;
 
 malformed:
-
+  thread_state_asleep (ts1);
+  assert (thread_is_asleep ());
+malformed_asleep:
+  assert (thread_is_asleep ());
   malformed_packet_received (msg, submsg, len, state, state_smkind, hdr->vendorid);
   return -1;
 }
 
 static bool do_packet
 (
-  struct thread_state1 *self,
+  struct thread_state1 * const ts1,
   ddsi_tran_conn_t conn,
   const nn_guid_prefix_t * guidprefix,
   struct nn_rbufpool *rbpool
@@ -3052,7 +3059,7 @@ static bool do_packet
   if (sz > 0 && !gv.deaf)
   {
     nn_rmsg_setsize (rmsg, (uint32_t) sz);
-    assert (vtime_asleep_p (self->vtime));
+    assert (thread_is_asleep ());
 
     if ((size_t)sz < RTPS_MESSAGE_HEADER_SIZE || *(uint32_t *)buff != NN_PROTOCOLID_AS_UINT32)
     {
@@ -3078,9 +3085,8 @@ static bool do_packet
                   PGUIDPREFIX (hdr->guid_prefix), hdr->vendorid.id[0], hdr->vendorid.id[1], (unsigned long) sz, addrstr);
       }
 
-      handle_submsg_sequence (conn, &srcloc, self, now (), now_et (), &hdr->guid_prefix, guidprefix, buff, (size_t) sz, buff + RTPS_MESSAGE_HEADER_SIZE, rmsg);
+      handle_submsg_sequence (ts1, conn, &srcloc, now (), now_et (), &hdr->guid_prefix, guidprefix, buff, (size_t) sz, buff + RTPS_MESSAGE_HEADER_SIZE, rmsg);
     }
-    thread_state_asleep (self);
   }
   nn_rmsg_commit (rmsg);
   return (sz > 0);
@@ -3144,13 +3150,13 @@ static void local_participant_set_fini (struct local_participant_set *lps)
   ddsrt_free (lps->ps);
 }
 
-static void rebuild_local_participant_set (struct thread_state1 *self, struct local_participant_set *lps)
+static void rebuild_local_participant_set (struct thread_state1 * const ts1, struct local_participant_set *lps)
 {
   struct ephash_enum_participant est;
   struct participant *pp;
   unsigned nps_alloc;
   DDS_TRACE("pp set gen changed: local %u global %"PRIu32"\n", lps->gen, ddsrt_atomic_ld32(&gv.participant_set_generation));
-  thread_state_awake (self);
+  thread_state_awake (ts1);
  restart:
   lps->gen = ddsrt_atomic_ld32 (&gv.participant_set_generation);
   /* Actual local set of participants may never be older than the
@@ -3195,7 +3201,7 @@ static void rebuild_local_participant_set (struct thread_state1 *self, struct lo
     DDS_TRACE("  set changed - restarting\n");
     goto restart;
   }
-  thread_state_asleep (self);
+  thread_state_asleep (ts1);
 
   /* The definition of the hash enumeration allows visiting one
      participant multiple times, so guard against that, too.  Note
@@ -3361,8 +3367,8 @@ void trigger_recv_threads (void)
 
 uint32_t recv_thread (void *vrecv_thread_arg)
 {
+  struct thread_state1 * const ts1 = lookup_thread_state ();
   struct recv_thread_arg *recv_thread_arg = vrecv_thread_arg;
-  struct thread_state1 *self = lookup_thread_state ();
   struct nn_rbufpool *rbpool = recv_thread_arg->rbpool;
   os_sockWaitset waitset = recv_thread_arg->mode == RTM_MANY ? recv_thread_arg->u.many.ws : NULL;
   nn_mtime_t next_thread_cputime = { 0 };
@@ -3373,7 +3379,7 @@ uint32_t recv_thread (void *vrecv_thread_arg)
     while (gv.rtps_keepgoing)
     {
       LOG_THREAD_CPUTIME (next_thread_cputime);
-      (void) do_packet (self, recv_thread_arg->u.single.conn, NULL, rbpool);
+      (void) do_packet (ts1, recv_thread_arg->u.single.conn, NULL, rbpool);
     }
   }
   else
@@ -3422,7 +3428,7 @@ uint32_t recv_thread (void *vrecv_thread_arg)
       {
         /* first rebuild local participant set - unless someone's toggling "deafness", this
          only happens when the participant set has changed, so might as well rebuild it */
-        rebuild_local_participant_set (self, &lps);
+        rebuild_local_participant_set (ts1, &lps);
         os_sockWaitsetPurge (waitset, num_fixed);
         for (i = 0; i < lps.nps; i++)
         {
@@ -3443,7 +3449,7 @@ uint32_t recv_thread (void *vrecv_thread_arg)
           else
             guid_prefix = &lps.ps[(unsigned)idx - num_fixed].guid_prefix;
           /* Process message and clean out connection if failed or closed */
-          if (!do_packet (self, conn, guid_prefix, rbpool) && !conn->m_connless)
+          if (!do_packet (ts1, conn, guid_prefix, rbpool) && !conn->m_connless)
             ddsi_conn_free (conn);
         }
       }
diff --git a/src/core/ddsi/src/q_thread.c b/src/core/ddsi/src/q_thread.c
index 6789407..9ca93fc 100644
--- a/src/core/ddsi/src/q_thread.c
+++ b/src/core/ddsi/src/q_thread.c
@@ -22,7 +22,7 @@
 #include "dds/ddsrt/misc.h"
 
 #include "dds/ddsi/q_thread.h"
-#include "dds/ddsi/q_servicelease.h"
+#include "dds/ddsi/ddsi_threadmon.h"
 #include "dds/ddsi/q_error.h"
 #include "dds/ddsi/q_log.h"
 #include "dds/ddsi/q_config.h"
@@ -34,6 +34,16 @@ static char main_thread_name[] = "main";
 struct thread_states thread_states;
 ddsrt_thread_local struct thread_state1 *tsd_thread_state;
 
+extern inline bool vtime_awake_p (vtime_t vtime);
+extern inline bool vtime_asleep_p (vtime_t vtime);
+extern inline bool vtime_gt (vtime_t vtime1, vtime_t vtime0);
+
+extern inline struct thread_state1 *lookup_thread_state (void);
+extern inline bool thread_is_asleep (void);
+extern inline bool thread_is_awake (void);
+extern inline void thread_state_asleep (struct thread_state1 *ts1);
+extern inline void thread_state_awake (struct thread_state1 *ts1);
+extern inline void thread_state_awake_to_awake_no_nest (struct thread_state1 *ts1);
 
 void *ddsrt_malloc_aligned_cacheline (size_t size)
 {
@@ -63,9 +73,10 @@ static void ddsrt_free_aligned (void *ptr)
 
 void thread_states_init_static (void)
 {
-    static struct thread_state1 ts =
-        { .state = THREAD_STATE_ALIVE, .vtime = 1, .watchdog = 1, .name = "(anon)" };
-    tsd_thread_state = &ts;
+  static struct thread_state1 ts = {
+    .state = THREAD_STATE_ALIVE, .vtime = 0u, .name = "(anon)"
+  };
+  tsd_thread_state = &ts;
 }
 
 void thread_states_init (unsigned maxthreads)
@@ -82,8 +93,7 @@ DDSRT_WARNING_MSVC_OFF(6386);
   for (i = 0; i < thread_states.nthreads; i++)
   {
     thread_states.ts[i].state = THREAD_STATE_ZERO;
-    thread_states.ts[i].vtime = 1;
-    thread_states.ts[i].watchdog = 1;
+    thread_states.ts[i].vtime = 0u;
     thread_states.ts[i].name = NULL;
   }
 DDSRT_WARNING_MSVC_ON(6386);
@@ -115,43 +125,9 @@ static void cleanup_thread_state (void *data)
   ddsrt_fini();
 }
 
-struct thread_state1 *lookup_thread_state (void)
-{
-  struct thread_state1 *ts1 = NULL;
-  char name[128];
-  ddsrt_thread_t thr;
-
-  if ((ts1 = tsd_thread_state) == NULL) {
-    if ((ts1 = lookup_thread_state_real()) == NULL) {
-      /* This situation only arises for threads that were not created using
-         create_thread, aka application threads. Since registering thread
-         state should be fully automatic the name is simply the identifier. */
-      thr = ddsrt_thread_self();
-      ddsrt_thread_getname(name, sizeof(name));
-      ddsrt_mutex_lock(&thread_states.lock);
-      ts1 = init_thread_state(name);
-      if (ts1 != NULL) {
-        ddsrt_init();
-        ts1->extTid = thr;
-        ts1->tid = thr;
-        DDS_TRACE("started application thread %s\n", name);
-        ddsrt_thread_cleanup_push(&cleanup_thread_state, NULL);
-      }
-      ddsrt_mutex_unlock(&thread_states.lock);
-    }
-
-    tsd_thread_state = ts1;
-  }
-
-  assert(ts1 != NULL);
-
-  return ts1;
-}
-
-struct thread_state1 *lookup_thread_state_real (void)
+static struct thread_state1 *find_thread_state (ddsrt_thread_t tid)
 {
   if (thread_states.ts) {
-    ddsrt_thread_t tid = ddsrt_thread_self ();
     unsigned i;
     for (i = 0; i < thread_states.nthreads; i++) {
       if (ddsrt_thread_equal (thread_states.ts[i].tid, tid)) {
@@ -162,6 +138,40 @@ struct thread_state1 *lookup_thread_state_real (void)
   return NULL;
 }
 
+static struct thread_state1 *lazy_create_thread_state (ddsrt_thread_t self)
+{
+  /* This situation only arises for threads that were not created using
+     create_thread, aka application threads. Since registering thread
+     state should be fully automatic the name is simply the identifier. */
+  struct thread_state1 *ts1;
+  char name[128];
+  ddsrt_thread_getname (name, sizeof (name));
+  ddsrt_mutex_lock (&thread_states.lock);
+  if ((ts1 = init_thread_state (name)) != NULL) {
+    ddsrt_init ();
+    ts1->extTid = self;
+    ts1->tid = self;
+    DDS_TRACE ("started application thread %s\n", name);
+    ddsrt_thread_cleanup_push (&cleanup_thread_state, NULL);
+  }
+  ddsrt_mutex_unlock (&thread_states.lock);
+  return ts1;
+}
+
+struct thread_state1 *lookup_thread_state_real (void)
+{
+  struct thread_state1 *ts1 = tsd_thread_state;
+  if (ts1 == NULL)
+  {
+    ddsrt_thread_t self = ddsrt_thread_self ();
+    if ((ts1 = find_thread_state (self)) == NULL)
+      ts1 = lazy_create_thread_state (self);
+    tsd_thread_state = ts1;
+  }
+  assert(ts1 != NULL);
+  return ts1;
+}
+
 struct thread_context {
   struct thread_state1 *self;
   uint32_t (*f) (void *arg);
@@ -221,7 +231,7 @@ const struct config_thread_properties_listelem *lookup_thread_properties (const
   return e;
 }
 
-struct thread_state1 * init_thread_state (const char *tname)
+struct thread_state1 *init_thread_state (const char *tname)
 {
   int cand;
   struct thread_state1 *ts;
@@ -231,29 +241,29 @@ struct thread_state1 * init_thread_state (const char *tname)
 
   ts = &thread_states.ts[cand];
   if (ts->state == THREAD_STATE_ZERO)
+  {
     assert (vtime_asleep_p (ts->vtime));
+  }
   ts->name = ddsrt_strdup (tname);
   ts->state = THREAD_STATE_ALIVE;
 
   return ts;
 }
 
-struct thread_state1 *create_thread (const char *name, uint32_t (*f) (void *arg), void *arg)
+dds_retcode_t create_thread (struct thread_state1 **ts1, const char *name, uint32_t (*f) (void *arg), void *arg)
 {
   struct config_thread_properties_listelem const * const tprops = lookup_thread_properties (name);
   ddsrt_threadattr_t tattr;
-  struct thread_state1 *ts1;
   ddsrt_thread_t tid;
   struct thread_context *ctxt;
   ctxt = ddsrt_malloc (sizeof (*ctxt));
   ddsrt_mutex_lock (&thread_states.lock);
 
-  ts1 = init_thread_state (name);
-
-  if (ts1 == NULL)
+  *ts1 = init_thread_state (name);
+  if (*ts1 == NULL)
     goto fatal;
 
-  ctxt->self = ts1;
+  ctxt->self = *ts1;
   ctxt->f = f;
   ctxt->arg = arg;
   ddsrt_threadattr_init (&tattr);
@@ -269,26 +279,27 @@ struct thread_state1 *create_thread (const char *name, uint32_t (*f) (void *arg)
 
   if (ddsrt_thread_create (&tid, name, &tattr, &create_thread_wrapper, ctxt) != DDS_RETCODE_OK)
   {
-    ts1->state = THREAD_STATE_ZERO;
+    (*ts1)->state = THREAD_STATE_ZERO;
     DDS_FATAL("create_thread: %s: ddsrt_thread_create failed\n", name);
     goto fatal;
   }
-  ts1->extTid = tid; /* overwrite the temporary value with the correct external one */
+  (*ts1)->extTid = tid; /* overwrite the temporary value with the correct external one */
   ddsrt_mutex_unlock (&thread_states.lock);
-  return ts1;
+  return DDS_RETCODE_OK;
  fatal:
   ddsrt_mutex_unlock (&thread_states.lock);
   ddsrt_free (ctxt);
+  *ts1 = NULL;
   abort ();
-  return NULL;
+  return DDS_RETCODE_ERROR;
 }
 
 static void reap_thread_state (struct thread_state1 *ts1, int sync_with_servicelease)
 {
   ddsrt_mutex_lock (&thread_states.lock);
   ts1->state = THREAD_STATE_ZERO;
-  if (sync_with_servicelease && gv.servicelease)
-    nn_servicelease_statechange_barrier (gv.servicelease);
+  if (sync_with_servicelease && gv.threadmon)
+    ddsi_threadmon_statechange_barrier (gv.threadmon);
   if (ts1->name != main_thread_name)
     ddsrt_free (ts1->name);
   ddsrt_mutex_unlock (&thread_states.lock);
@@ -319,7 +330,7 @@ void reset_thread_state (struct thread_state1 *ts1)
 void downgrade_main_thread (void)
 {
   struct thread_state1 *ts1 = lookup_thread_state ();
-  thread_state_asleep (ts1);
+  assert (vtime_asleep_p (ts1->vtime));
   /* no need to sync with service lease: already stopped */
   reap_thread_state (ts1, 0);
   thread_states_init_static ();
diff --git a/src/core/ddsi/src/q_thread_inlines.c b/src/core/ddsi/src/q_thread_inlines.c
deleted file mode 100644
index b16f324..0000000
--- a/src/core/ddsi/src/q_thread_inlines.c
+++ /dev/null
@@ -1,21 +0,0 @@
-/*
- * Copyright(c) 2006 to 2018 ADLINK Technology Limited and others
- *
- * This program and the accompanying materials are made available under the
- * terms of the Eclipse Public License v. 2.0 which is available at
- * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
- * v. 1.0 which is available at
- * http://www.eclipse.org/org/documents/edl-v10.php.
- *
- * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
- */
-#include "dds/ddsi/q_thread.h"
-
-extern inline int vtime_awake_p (vtime_t vtime);
-extern inline int vtime_asleep_p (vtime_t vtime);
-extern inline int vtime_gt (vtime_t vtime1, vtime_t vtime0);
-
-extern inline void thread_state_asleep (struct thread_state1 *ts1);
-extern inline void thread_state_awake (struct thread_state1 *ts1);
-extern inline void thread_state_blocked (struct thread_state1 *ts1);
-extern inline void thread_state_unblocked (struct thread_state1 *ts1);
diff --git a/src/core/ddsi/src/q_transmit.c b/src/core/ddsi/src/q_transmit.c
index 27abfc7..086187e 100644
--- a/src/core/ddsi/src/q_transmit.c
+++ b/src/core/ddsi/src/q_transmit.c
@@ -911,7 +911,7 @@ static int writer_may_continue (const struct writer *wr, const struct whc_state
 }
 
 
-static dds_retcode_t throttle_writer (struct nn_xpack *xp, struct writer *wr)
+static dds_retcode_t throttle_writer (struct thread_state1 * const ts1, struct nn_xpack *xp, struct writer *wr)
 {
   /* Sleep (cond_wait) without updating the thread's vtime: the
      garbage collector won't free the writer while we leave it
@@ -956,7 +956,7 @@ static dds_retcode_t throttle_writer (struct nn_xpack *xp, struct writer *wr)
   {
     ASSERT_MUTEX_HELD (&wr->e.lock);
     assert (wr->throttling == 0);
-    assert (vtime_awake_p (lookup_thread_state ()->vtime));
+    assert (thread_is_awake ());
     assert (!is_builtin_entityid(wr->e.guid.entityid, NN_VENDORID_ECLIPSE));
   }
 
@@ -988,10 +988,10 @@ static dds_retcode_t throttle_writer (struct nn_xpack *xp, struct writer *wr)
     result = DDS_RETCODE_TIMEOUT;
     if (reltimeout > 0)
     {
-      thread_state_asleep (lookup_thread_state());
+      thread_state_asleep (ts1);
       if (ddsrt_cond_waitfor (&wr->throttle_cond, &wr->e.lock, reltimeout))
         result = DDS_RETCODE_OK;
-      thread_state_awake (lookup_thread_state());
+      thread_state_awake (ts1);
       whc_get_state(wr->whc, &whcst);
     }
     if (result == DDS_RETCODE_TIMEOUT)
@@ -1028,7 +1028,7 @@ static int maybe_grow_whc (struct writer *wr)
   return 0;
 }
 
-static int write_sample_eot (struct nn_xpack *xp, struct writer *wr, struct nn_plist *plist, struct ddsi_serdata *serdata, struct ddsi_tkmap_instance *tk, int end_of_txn, int gc_allowed)
+static int write_sample_eot (struct thread_state1 * const ts1, struct nn_xpack *xp, struct writer *wr, struct nn_plist *plist, struct ddsi_serdata *serdata, struct ddsi_tkmap_instance *tk, int end_of_txn, int gc_allowed)
 {
   int r;
   seqno_t seq;
@@ -1070,14 +1070,14 @@ static int write_sample_eot (struct nn_xpack *xp, struct writer *wr, struct nn_p
       dds_retcode_t ores;
       assert(gc_allowed); /* also see beginning of the function */
       if (config.prioritize_retransmit && wr->retransmitting)
-        ores = throttle_writer (xp, wr);
+        ores = throttle_writer (ts1, xp, wr);
       else
       {
         maybe_grow_whc (wr);
         if (whcst.unacked_bytes <= wr->whc_high)
           ores = DDS_RETCODE_OK;
         else
-          ores = throttle_writer (xp, wr);
+          ores = throttle_writer (ts1, xp, wr);
       }
       if (ores == DDS_RETCODE_TIMEOUT)
       {
@@ -1168,32 +1168,34 @@ drop:
   return r;
 }
 
-int write_sample_gc (struct nn_xpack *xp, struct writer *wr, struct ddsi_serdata *serdata, struct ddsi_tkmap_instance *tk)
+int write_sample_gc (struct thread_state1 * const ts1, struct nn_xpack *xp, struct writer *wr, struct ddsi_serdata *serdata, struct ddsi_tkmap_instance *tk)
 {
-  return write_sample_eot (xp, wr, NULL, serdata, tk, 0, 1);
+  return write_sample_eot (ts1, xp, wr, NULL, serdata, tk, 0, 1);
 }
 
-int write_sample_nogc (struct nn_xpack *xp, struct writer *wr, struct ddsi_serdata *serdata, struct ddsi_tkmap_instance *tk)
+int write_sample_nogc (struct thread_state1 * const ts1, struct nn_xpack *xp, struct writer *wr, struct ddsi_serdata *serdata, struct ddsi_tkmap_instance *tk)
 {
-  return write_sample_eot (xp, wr, NULL, serdata, tk, 0, 0);
+  return write_sample_eot (ts1, xp, wr, NULL, serdata, tk, 0, 0);
 }
 
-int write_sample_gc_notk (struct nn_xpack *xp, struct writer *wr, struct ddsi_serdata *serdata)
+int write_sample_gc_notk (struct thread_state1 * const ts1, struct nn_xpack *xp, struct writer *wr, struct ddsi_serdata *serdata)
 {
   struct ddsi_tkmap_instance *tk;
   int res;
+  assert (thread_is_awake ());
   tk = ddsi_tkmap_lookup_instance_ref (serdata);
-  res = write_sample_eot (xp, wr, NULL, serdata, tk, 0, 1);
+  res = write_sample_eot (ts1, xp, wr, NULL, serdata, tk, 0, 1);
   ddsi_tkmap_instance_unref (tk);
   return res;
 }
 
-int write_sample_nogc_notk (struct nn_xpack *xp, struct writer *wr, struct ddsi_serdata *serdata)
+int write_sample_nogc_notk (struct thread_state1 * const ts1, struct nn_xpack *xp, struct writer *wr, struct ddsi_serdata *serdata)
 {
   struct ddsi_tkmap_instance *tk;
   int res;
+  assert (thread_is_awake ());
   tk = ddsi_tkmap_lookup_instance_ref (serdata);
-  res = write_sample_eot (xp, wr, NULL, serdata, tk, 0, 0);
+  res = write_sample_eot (ts1, xp, wr, NULL, serdata, tk, 0, 0);
   ddsi_tkmap_instance_unref (tk);
   return res;
 }
diff --git a/src/core/ddsi/src/q_xevent.c b/src/core/ddsi/src/q_xevent.c
index 0e60a2a..b5d6c86 100644
--- a/src/core/ddsi/src/q_xevent.c
+++ b/src/core/ddsi/src/q_xevent.c
@@ -504,6 +504,7 @@ struct xeventq * xeventq_new
 
 int xeventq_start (struct xeventq *evq, const char *name)
 {
+  dds_retcode_t rc;
   char * evqname = "tev";
   assert (evq->ts == NULL);
 
@@ -515,13 +516,13 @@ int xeventq_start (struct xeventq *evq, const char *name)
   }
 
   evq->terminate = 0;
-  evq->ts = create_thread (evqname, (uint32_t (*) (void *)) xevent_thread, evq);
+  rc = create_thread (&evq->ts, evqname, (uint32_t (*) (void *)) xevent_thread, evq);
 
   if (name)
   {
     ddsrt_free (evqname);
   }
-  return (evq->ts == NULL) ? Q_ERR_UNSPECIFIED : 0;
+  return (rc != DDS_RETCODE_OK) ? Q_ERR_UNSPECIFIED : 0;
 }
 
 void xeventq_stop (struct xeventq *evq)
@@ -1114,7 +1115,7 @@ static void handle_xevk_spdp (UNUSED_ARG (struct nn_xpack *xp), struct xevent *e
   }
 }
 
-static void write_pmd_message (struct nn_xpack *xp, struct participant *pp, unsigned pmd_kind)
+static void write_pmd_message (struct thread_state1 * const ts1, struct nn_xpack *xp, struct participant *pp, unsigned pmd_kind)
 {
 #define PMD_DATA_LENGTH 1
   struct writer *wr;
@@ -1146,12 +1147,12 @@ static void write_pmd_message (struct nn_xpack *xp, struct participant *pp, unsi
   serdata->timestamp = now ();
 
   tk = ddsi_tkmap_lookup_instance_ref(serdata);
-  write_sample_nogc (xp, wr, serdata, tk);
+  write_sample_nogc (ts1, xp, wr, serdata, tk);
   ddsi_tkmap_instance_unref(tk);
 #undef PMD_DATA_LENGTH
 }
 
-static void handle_xevk_pmd_update (struct nn_xpack *xp, struct xevent *ev, nn_mtime_t tnow)
+static void handle_xevk_pmd_update (struct thread_state1 * const ts1, struct nn_xpack *xp, struct xevent *ev, nn_mtime_t tnow)
 {
   struct participant *pp;
   int64_t intv;
@@ -1162,7 +1163,7 @@ static void handle_xevk_pmd_update (struct nn_xpack *xp, struct xevent *ev, nn_m
     return;
   }
 
-  write_pmd_message (xp, pp, PARTICIPANT_MESSAGE_DATA_KIND_AUTOMATIC_LIVELINESS_UPDATE);
+  write_pmd_message (ts1, xp, pp, PARTICIPANT_MESSAGE_DATA_KIND_AUTOMATIC_LIVELINESS_UPDATE);
 
   /* QoS changes can't change lease durations. So the only thing that
      could cause trouble here is that the addition or removal of a
@@ -1217,7 +1218,7 @@ static void handle_xevk_delete_writer (UNUSED_ARG (struct nn_xpack *xp), struct
   delete_xevent (ev);
 }
 
-static void handle_individual_xevent (struct xevent *xev, struct nn_xpack *xp, nn_mtime_t tnow)
+static void handle_individual_xevent (struct thread_state1 * const ts1, struct xevent *xev, struct nn_xpack *xp, nn_mtime_t tnow)
 {
   switch (xev->kind)
   {
@@ -1231,7 +1232,7 @@ static void handle_individual_xevent (struct xevent *xev, struct nn_xpack *xp, n
       handle_xevk_spdp (xp, xev, tnow);
       break;
     case XEVK_PMD_UPDATE:
-      handle_xevk_pmd_update (xp, xev, tnow);
+      handle_xevk_pmd_update (ts1, xp, xev, tnow);
       break;
     case XEVK_END_STARTUP_MODE:
       handle_xevk_end_startup_mode (xp, xev, tnow);
@@ -1262,7 +1263,7 @@ static void handle_individual_xevent_nt (struct xevent_nt *xev, struct nn_xpack
   ddsrt_free (xev);
 }
 
-static void handle_timed_xevent (struct thread_state1 *self, struct xevent *xev, struct nn_xpack *xp, nn_mtime_t tnow /* monotonic */)
+static void handle_timed_xevent (struct thread_state1 * const ts1, struct xevent *xev, struct nn_xpack *xp, nn_mtime_t tnow /* monotonic */)
 {
    /* This function handles the individual xevent irrespective of
       whether it is a "timed" or "non-timed" xevent */
@@ -1276,14 +1277,13 @@ static void handle_timed_xevent (struct thread_state1 *self, struct xevent *xev,
   assert (xev->tsched.v != TSCHED_DELETE);
 
   ddsrt_mutex_unlock (&xevq->lock);
-  thread_state_awake (self);
-  handle_individual_xevent (xev, xp, tnow /* monotonic */);
+  handle_individual_xevent (ts1, xev, xp, tnow /* monotonic */);
   ddsrt_mutex_lock (&xevq->lock);
 
   ASSERT_MUTEX_HELD (&xevq->lock);
 }
 
-static void handle_nontimed_xevent (struct thread_state1 *self, struct xevent_nt *xev, struct nn_xpack *xp)
+static void handle_nontimed_xevent (struct xevent_nt *xev, struct nn_xpack *xp)
 {
    /* This function handles the individual xevent irrespective of
       whether it is a "timed" or "non-timed" xevent */
@@ -1296,7 +1296,6 @@ static void handle_nontimed_xevent (struct thread_state1 *self, struct xevent_nt
   assert (xev->evq == xevq);
 
   ddsrt_mutex_unlock (&xevq->lock);
-  thread_state_awake (self);
   handle_individual_xevent_nt (xev, xp);
   /* non-timed xevents are freed by the handlers */
   ddsrt_mutex_lock (&xevq->lock);
@@ -1304,11 +1303,12 @@ static void handle_nontimed_xevent (struct thread_state1 *self, struct xevent_nt
   ASSERT_MUTEX_HELD (&xevq->lock);
 }
 
-static void handle_xevents (struct thread_state1 *self, struct xeventq *xevq, struct nn_xpack *xp, nn_mtime_t tnow /* monotonic */)
+static void handle_xevents (struct thread_state1 * const ts1, struct xeventq *xevq, struct nn_xpack *xp, nn_mtime_t tnow /* monotonic */)
 {
   int xeventsToProcess = 1;
 
   ASSERT_MUTEX_HELD (&xevq->lock);
+  assert (thread_is_awake ());
 
   /* The following loops give priority to the "timed" events (heartbeats,
      acknacks etc) if there are any.  The algorithm is that we handle all
@@ -1334,7 +1334,8 @@ static void handle_xevents (struct thread_state1 *self, struct xeventq *xevq, st
            scheduled or not), so set to TSCHED_NEVER to indicate it
            currently isn't. */
         xev->tsched.v = T_NEVER;
-        handle_timed_xevent (self, xev, xp, tnow);
+        thread_state_awake_to_awake_no_nest (ts1);
+        handle_timed_xevent (ts1, xev, xp, tnow);
       }
 
       /* Limited-bandwidth channels means events can take a LONG time
@@ -1345,7 +1346,8 @@ static void handle_xevents (struct thread_state1 *self, struct xeventq *xevq, st
     if (!non_timed_xmit_list_is_empty (xevq))
     {
       struct xevent_nt *xev = getnext_from_non_timed_xmit_list (xevq);
-      handle_nontimed_xevent (self, xev, xp);
+      thread_state_awake_to_awake_no_nest (ts1);
+      handle_nontimed_xevent (xev, xp);
       tnow = now_mt ();
     }
     else
@@ -1359,7 +1361,7 @@ static void handle_xevents (struct thread_state1 *self, struct xeventq *xevq, st
 
 static uint32_t xevent_thread (struct xeventq * xevq)
 {
-  struct thread_state1 *self = lookup_thread_state ();
+  struct thread_state1 * const ts1 = lookup_thread_state ();
   struct nn_xpack *xp;
   nn_mtime_t next_thread_cputime = { 0 };
 
@@ -1372,15 +1374,13 @@ static uint32_t xevent_thread (struct xeventq * xevq)
 
     LOG_THREAD_CPUTIME (next_thread_cputime);
 
-    handle_xevents (self, xevq, xp, tnow);
-
-    /* Send to the network unlocked, as it may sleep due to bandwidth
-       limitation */
+    thread_state_awake (ts1);
+    handle_xevents (ts1, xevq, xp, tnow);
+    /* Send to the network unlocked, as it may sleep due to bandwidth limitation */
     ddsrt_mutex_unlock (&xevq->lock);
     nn_xpack_send (xp, false);
     ddsrt_mutex_lock (&xevq->lock);
-
-    thread_state_asleep (self);
+    thread_state_asleep (ts1);
 
     if (!non_timed_xmit_list_is_empty (xevq) || xevq->terminate)
     {
diff --git a/src/core/ddsi/src/q_xmsg.c b/src/core/ddsi/src/q_xmsg.c
index d1c83cb..4fc0e57 100644
--- a/src/core/ddsi/src/q_xmsg.c
+++ b/src/core/ddsi/src/q_xmsg.c
@@ -1459,7 +1459,7 @@ void nn_xpack_sendq_init (void)
 
 void nn_xpack_sendq_start (void)
 {
-  gv.sendq_ts = create_thread("sendq", nn_xpack_sendq_thread, NULL);
+  create_thread (&gv.sendq_ts, "sendq", nn_xpack_sendq_thread, NULL);
 }
 
 void nn_xpack_sendq_stop (void)
diff --git a/src/core/ddsi/src/sysdeps.c b/src/core/ddsi/src/sysdeps.c
index e362823..13fa3f1 100644
--- a/src/core/ddsi/src/sysdeps.c
+++ b/src/core/ddsi/src/sysdeps.c
@@ -51,14 +51,14 @@ void log_stacktrace (const char *name, ddsrt_thread_t tid)
   if (dds_get_log_mask() == 0)
     ; /* no op if nothing logged */
   else if (!config.noprogress_log_stacktraces)
-    DDS_LOG(~0u, "-- stack trace of %s requested, but traces disabled --\n", name);
+    DDS_LOG(~DDS_LC_FATAL, "-- stack trace of %s requested, but traces disabled --\n", name);
   else
   {
     const dds_time_t d = 1000000;
     struct sigaction act, oact;
     char **strs;
     int i;
-    DDS_LOG(~0u, "-- stack trace of %s requested --\n", name);
+    DDS_LOG(~DDS_LC_FATAL, "-- stack trace of %s requested --\n", name);
     act.sa_handler = log_stacktrace_sigh;
     act.sa_flags = 0;
     sigfillset (&act.sa_mask);
@@ -70,15 +70,15 @@ void log_stacktrace (const char *name, ddsrt_thread_t tid)
       dds_sleepfor (d);
     sigaction (SIGXCPU, &oact, NULL);
     if (pthread_kill (tid.v, 0) != 0)
-      DDS_LOG(~0u, "-- thread exited --\n");
+      DDS_LOG(~DDS_LC_FATAL, "-- thread exited --\n");
     else
     {
-      DDS_LOG(~0u, "-- stack trace follows --\n");
+      DDS_LOG(~DDS_LC_FATAL, "-- stack trace follows --\n");
       strs = backtrace_symbols (log_stacktrace_stk.stk, log_stacktrace_stk.depth);
       for (i = 0; i < log_stacktrace_stk.depth; i++)
-        DDS_LOG(~0u, "%s\n", strs[i]);
+        DDS_LOG(~DDS_LC_FATAL, "%s\n", strs[i]);
       free (strs);
-      DDS_LOG(~0u, "-- end of stack trace --\n");
+      DDS_LOG(~DDS_LC_FATAL, "-- end of stack trace --\n");
     }
     ddsrt_atomic_st32 (&log_stacktrace_flag, 0);
   }
diff --git a/src/core/xtests/rhc_torture.c b/src/core/xtests/rhc_torture.c
index bc7c4fb..245d057 100644
--- a/src/core/xtests/rhc_torture.c
+++ b/src/core/xtests/rhc_torture.c
@@ -108,7 +108,7 @@ static uint64_t store (struct rhc *rhc, struct proxy_writer *wr, struct ddsi_ser
   /* beware: unrefs sd */
   struct ddsi_tkmap_instance *tk;
   struct proxy_writer_info pwr_info;
-  thread_state_awake (mainthread);
+  thread_state_awake (lookup_thread_state ());
   tk = ddsi_tkmap_lookup_instance_ref(sd);
   uint64_t iid = tk->m_iid;
   if (print)
@@ -132,7 +132,7 @@ static uint64_t store (struct rhc *rhc, struct proxy_writer *wr, struct ddsi_ser
   pwr_info.ownership_strength = wr->c.xqos->ownership_strength.value;
   dds_rhc_store (rhc, &pwr_info, sd, tk);
   ddsi_tkmap_instance_unref (tk);
-  thread_state_asleep (mainthread);
+  thread_state_asleep (lookup_thread_state ());
   ddsi_serdata_unref (sd);
   return iid;
 }
@@ -171,18 +171,18 @@ static struct rhc *mkrhc (dds_reader *rd, nn_history_kind_t hk, int32_t hdepth,
   rqos.history.depth = hdepth;
   rqos.destination_order.kind = dok;
   nn_xqos_mergein_missing (&rqos, &gv.default_xqos_rd);
-  thread_state_awake (mainthread);
+  thread_state_awake (lookup_thread_state ());
   rhc = dds_rhc_new (rd, mdtopic);
   dds_rhc_set_qos(rhc, &rqos);
-  thread_state_asleep (mainthread);
+  thread_state_asleep (lookup_thread_state ());
   return rhc;
 }
 
 static void frhc (struct rhc *rhc)
 {
-  thread_state_awake (mainthread);
+  thread_state_awake (lookup_thread_state ());
   dds_rhc_free (rhc);
-  thread_state_asleep (mainthread);
+  thread_state_asleep (lookup_thread_state ());
 }
 
 static char si2is (const dds_sample_info_t *si)
@@ -288,9 +288,9 @@ static void rdtkcond (struct rhc *rhc, dds_readcond *cond, const struct check *c
   if (print)
     printf ("%s:\n", opname);
 
-  thread_state_awake (mainthread);
+  thread_state_awake (lookup_thread_state ());
   cnt = op (rhc, true, rres_ptrs, rres_iseq, (max <= 0) ? (uint32_t) (sizeof (rres_iseq) / sizeof (rres_iseq[0])) : (uint32_t) max, cond ? NO_STATE_MASK_SET : (DDS_ANY_SAMPLE_STATE | DDS_ANY_VIEW_STATE | DDS_ANY_INSTANCE_STATE), 0, cond);
-  thread_state_asleep (mainthread);
+  thread_state_asleep (lookup_thread_state ());
   if (max > 0 && cnt > max) {
     printf ("%s TOO MUCH DATA (%d > %d)\n", opname, cnt, max);
     abort ();
@@ -764,8 +764,8 @@ static void test_conditions (dds_entity_t pp, dds_entity_t tp, const int count,
           tkcond (rhc[k], rhcconds[cond], NULL, 1, print && k == 0, states_seen);
         break;
       }
-      case 11:
-        thread_state_awake (mainthread);
+      case 11: {
+        thread_state_awake (lookup_thread_state ());
         struct proxy_writer_info wr_info;
         wr_info.auto_dispose = wr[which]->c.xqos->writer_data_lifecycle.autodispose_unregistered_instances;
         wr_info.guid = wr[which]->e.guid;
@@ -773,8 +773,9 @@ static void test_conditions (dds_entity_t pp, dds_entity_t tp, const int count,
         wr_info.ownership_strength = wr[which]->c.xqos->ownership_strength.value;
         for (size_t k = 0; k < nrd; k++)
           dds_rhc_unregister_wr (rhc[k], &wr_info);
-        thread_state_asleep (mainthread);
+        thread_state_asleep (lookup_thread_state ());
         break;
+      }
     }
 
     if ((i % 200) == 0)
@@ -869,14 +870,14 @@ int main (int argc, char **argv)
       { 0, 0, 0, 0, 0, 0, 0, 0 }
     };
     rdall (rhc, c1, print, states_seen);
-    thread_state_awake (mainthread);
+    thread_state_awake (lookup_thread_state ());
     struct proxy_writer_info wr0_info;
     wr0_info.auto_dispose = wr0->c.xqos->writer_data_lifecycle.autodispose_unregistered_instances;
     wr0_info.guid = wr0->e.guid;
     wr0_info.iid = wr0->e.iid;
     wr0_info.ownership_strength = wr0->c.xqos->ownership_strength.value;
     dds_rhc_unregister_wr (rhc, &wr0_info);
-    thread_state_asleep (mainthread);
+    thread_state_asleep (lookup_thread_state ());
     const struct check c2[] = {
       { "ROU", iid0, wr0->e.iid, 0,0, 1, 0,1 },
       { "ROU", iid0, 0, 0,0, 0, 0,0 },

From 21a1c4aa333daa8aa9b4b1b312fc429ea74dc614 Mon Sep 17 00:00:00 2001
From: Erik Boasson <eb@ilities.com>
Date: Thu, 11 Apr 2019 15:12:17 +0200
Subject: [PATCH 022/238] enable printf format checking for dds_log

Also remove superfluous parameters in a TRACE statement and fix a format
specification in pong.c.

Signed-off-by: Erik Boasson <eb@ilities.com>
---
 src/core/ddsi/src/q_receive.c     | 2 +-
 src/ddsrt/include/dds/ddsrt/log.h | 4 +++-
 src/examples/roundtrip/pong.c     | 2 +-
 3 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/src/core/ddsi/src/q_receive.c b/src/core/ddsi/src/q_receive.c
index 9e7f899..a442e86 100644
--- a/src/core/ddsi/src/q_receive.c
+++ b/src/core/ddsi/src/q_receive.c
@@ -1747,7 +1747,7 @@ static int handle_Gap (struct receiver_state *rst, nn_etime_t tnow, struct nn_rm
 
   if (!pwr->have_seen_heartbeat && pwr->n_reliable_readers > 0)
   {
-    DDS_TRACE(": no heartbeat seen yet", PGUID (pwr->e.guid), PGUID (dst));
+    DDS_TRACE(": no heartbeat seen yet");
     ddsrt_mutex_unlock (&pwr->e.lock);
     return 1;
   }
diff --git a/src/ddsrt/include/dds/ddsrt/log.h b/src/ddsrt/include/dds/ddsrt/log.h
index b6450c0..4a08a46 100644
--- a/src/ddsrt/include/dds/ddsrt/log.h
+++ b/src/ddsrt/include/dds/ddsrt/log.h
@@ -25,6 +25,7 @@
 #include <stdio.h>
 
 #include "dds/export.h"
+#include "dds/ddsrt/attributes.h"
 
 #if defined (__cplusplus)
 extern "C" {
@@ -199,7 +200,8 @@ dds_log(
     uint32_t line,
     const char *func,
     const char *fmt,
-    ...);
+    ...)
+  ddsrt_attribute_format((__printf__, 5, 6));
 
 /**
  * @brief Undecorated function name of the current function.
diff --git a/src/examples/roundtrip/pong.c b/src/examples/roundtrip/pong.c
index ef692f5..010c0c5 100644
--- a/src/examples/roundtrip/pong.c
+++ b/src/examples/roundtrip/pong.c
@@ -60,7 +60,7 @@ static void data_available(dds_entity_t rd, void *arg)
       RoundTripModule_DataType * valid_sample = &data[j];
       status = dds_write_ts (writer, valid_sample, info[j].source_timestamp);
       if (status < 0)
-        DDS_FATAL("dds_write_ts: %s\n", -status);
+        DDS_FATAL("dds_write_ts: %d\n", -status);
     }
   }
 }

From 7f5c56e8196abc8f6e6f009f248301b5182f9bf8 Mon Sep 17 00:00:00 2001
From: Erik Boasson <eb@ilities.com>
Date: Sat, 13 Apr 2019 17:08:07 +0200
Subject: [PATCH 023/238] defer triggering dqueue thread until end-of-packet

There appears to be a minor performance benefit to not waking up the
delivery thread (if used) immediately upon enqueueing the first sample,
but rather to wait (typically) until the end of the packet.  In a
latency measurement it probably makes little difference: one shouldn't
use asynchronous delivery if one needs the lowest possible latency, and
the end of the packet is reached rather quickly normally.

Signed-off-by: Erik Boasson <eb@ilities.com>
---
 src/core/ddsi/include/dds/ddsi/q_radmin.h |  2 ++
 src/core/ddsi/src/q_radmin.c              | 22 +++++++++++++
 src/core/ddsi/src/q_receive.c             | 38 +++++++++++++++++------
 3 files changed, 52 insertions(+), 10 deletions(-)

diff --git a/src/core/ddsi/include/dds/ddsi/q_radmin.h b/src/core/ddsi/include/dds/ddsi/q_radmin.h
index 829cdcd..e61c029 100644
--- a/src/core/ddsi/include/dds/ddsi/q_radmin.h
+++ b/src/core/ddsi/include/dds/ddsi/q_radmin.h
@@ -228,6 +228,8 @@ seqno_t nn_reorder_next_seq (const struct nn_reorder *reorder);
 
 struct nn_dqueue *nn_dqueue_new (const char *name, uint32_t max_samples, nn_dqueue_handler_t handler, void *arg);
 void nn_dqueue_free (struct nn_dqueue *q);
+bool nn_dqueue_enqueue_deferred_wakeup (struct nn_dqueue *q, struct nn_rsample_chain *sc, nn_reorder_result_t rres);
+void dd_dqueue_enqueue_trigger (struct nn_dqueue *q);
 void nn_dqueue_enqueue (struct nn_dqueue *q, struct nn_rsample_chain *sc, nn_reorder_result_t rres);
 void nn_dqueue_enqueue1 (struct nn_dqueue *q, const nn_guid_t *rdguid, struct nn_rsample_chain *sc, nn_reorder_result_t rres);
 void nn_dqueue_enqueue_callback (struct nn_dqueue *q, nn_dqueue_callback_t cb, void *arg);
diff --git a/src/core/ddsi/src/q_radmin.c b/src/core/ddsi/src/q_radmin.c
index 1ca2e83..8b49c64 100644
--- a/src/core/ddsi/src/q_radmin.c
+++ b/src/core/ddsi/src/q_radmin.c
@@ -2541,6 +2541,26 @@ static int nn_dqueue_enqueue_locked (struct nn_dqueue *q, struct nn_rsample_chai
   return must_signal;
 }
 
+bool nn_dqueue_enqueue_deferred_wakeup (struct nn_dqueue *q, struct nn_rsample_chain *sc, nn_reorder_result_t rres)
+{
+  bool signal;
+  assert (rres > 0);
+  assert (sc->first);
+  assert (sc->last->next == NULL);
+  ddsrt_mutex_lock (&q->lock);
+  ddsrt_atomic_add32 (&q->nof_samples, (uint32_t) rres);
+  signal = nn_dqueue_enqueue_locked (q, sc);
+  ddsrt_mutex_unlock (&q->lock);
+  return signal;
+}
+
+void dd_dqueue_enqueue_trigger (struct nn_dqueue *q)
+{
+  ddsrt_mutex_lock (&q->lock);
+  ddsrt_cond_broadcast (&q->cond);
+  ddsrt_mutex_unlock (&q->lock);
+}
+
 void nn_dqueue_enqueue (struct nn_dqueue *q, struct nn_rsample_chain *sc, nn_reorder_result_t rres)
 {
   assert (rres > 0);
@@ -2622,6 +2642,8 @@ void nn_dqueue_wait_until_empty_if_full (struct nn_dqueue *q)
   if (count >= q->max_samples)
   {
     ddsrt_mutex_lock (&q->lock);
+    /* In case the wakeups are were all deferred */
+    ddsrt_cond_broadcast (&q->cond);
     while (ddsrt_atomic_ld32 (&q->nof_samples) > 0)
       ddsrt_cond_wait (&q->cond, &q->lock);
     ddsrt_mutex_unlock (&q->lock);
diff --git a/src/core/ddsi/src/q_receive.c b/src/core/ddsi/src/q_receive.c
index a442e86..8ea8c47 100644
--- a/src/core/ddsi/src/q_receive.c
+++ b/src/core/ddsi/src/q_receive.c
@@ -2151,7 +2151,7 @@ static void clean_defrag (struct proxy_writer *pwr)
   nn_defrag_notegap (pwr->defrag, 1, seq);
 }
 
-static void handle_regular (struct receiver_state *rst, nn_etime_t tnow, struct nn_rmsg *rmsg, const Data_DataFrag_common_t *msg, const struct nn_rsample_info *sampleinfo, uint32_t fragnum, struct nn_rdata *rdata)
+static void handle_regular (struct receiver_state *rst, nn_etime_t tnow, struct nn_rmsg *rmsg, const Data_DataFrag_common_t *msg, const struct nn_rsample_info *sampleinfo, uint32_t fragnum, struct nn_rdata *rdata, struct nn_dqueue **deferred_wakeup)
 {
   struct proxy_writer *pwr;
   struct nn_rsample *rsample;
@@ -2251,10 +2251,23 @@ static void handle_regular (struct receiver_state *rst, nn_etime_t tnow, struct
          receive thread's data gets interleaved -- arguably delivery
          needn't be exactly in-order, which would allow us to do this
          without pwr->e.lock held. */
-      if (!pwr->deliver_synchronously)
-        nn_dqueue_enqueue (pwr->dqueue, &sc, rres);
-      else
+      if (pwr->deliver_synchronously)
+      {
+        /* FIXME: just in case the synchronous delivery runs into a delay caused
+           by the current mishandling of resource limits */
+        if (*deferred_wakeup)
+          dd_dqueue_enqueue_trigger (*deferred_wakeup);
         deliver_user_data_synchronously (&sc);
+      }
+      else
+      {
+        if (nn_dqueue_enqueue_deferred_wakeup (pwr->dqueue, &sc, rres))
+        {
+          if (*deferred_wakeup && *deferred_wakeup != pwr->dqueue)
+            dd_dqueue_enqueue_trigger (*deferred_wakeup);
+          *deferred_wakeup = pwr->dqueue;
+        }
+      }
       if (pwr->n_readers_out_of_sync > 0)
       {
         /* Those readers catching up with TL but in sync with the proxy
@@ -2384,7 +2397,7 @@ static void drop_oversize (struct receiver_state *rst, struct nn_rmsg *rmsg, con
   }
 }
 
-static int handle_Data (struct receiver_state *rst, nn_etime_t tnow, struct nn_rmsg *rmsg, const Data_t *msg, size_t size, struct nn_rsample_info *sampleinfo, unsigned char *datap)
+static int handle_Data (struct receiver_state *rst, nn_etime_t tnow, struct nn_rmsg *rmsg, const Data_t *msg, size_t size, struct nn_rsample_info *sampleinfo, unsigned char *datap, struct nn_dqueue **deferred_wakeup)
 {
   DDS_TRACE("DATA(%x:%x:%x:%x -> %x:%x:%x:%x #%"PRId64"",
           PGUIDPREFIX (rst->src_guid_prefix), msg->x.writerId.u,
@@ -2421,14 +2434,14 @@ static int handle_Data (struct receiver_state *rst, nn_etime_t tnow, struct nn_r
     }
     else
     {
-      handle_regular (rst, tnow, rmsg, &msg->x, sampleinfo, ~0u, rdata);
+      handle_regular (rst, tnow, rmsg, &msg->x, sampleinfo, ~0u, rdata, deferred_wakeup);
     }
   }
   DDS_TRACE(")");
   return 1;
 }
 
-static int handle_DataFrag (struct receiver_state *rst, nn_etime_t tnow, struct nn_rmsg *rmsg, const DataFrag_t *msg, size_t size, struct nn_rsample_info *sampleinfo, unsigned char *datap)
+static int handle_DataFrag (struct receiver_state *rst, nn_etime_t tnow, struct nn_rmsg *rmsg, const DataFrag_t *msg, size_t size, struct nn_rsample_info *sampleinfo, unsigned char *datap, struct nn_dqueue **deferred_wakeup)
 {
   DDS_TRACE("DATAFRAG(%x:%x:%x:%x -> %x:%x:%x:%x #%"PRId64"/[%u..%u]",
           PGUIDPREFIX (rst->src_guid_prefix), msg->x.writerId.u,
@@ -2494,7 +2507,7 @@ static int handle_DataFrag (struct receiver_state *rst, nn_etime_t tnow, struct
        wrong, it'll simply generate a request for retransmitting a
        non-existent fragment.  The other side SHOULD be capable of
        dealing with that. */
-    handle_regular (rst, tnow, rmsg, &msg->x, sampleinfo, msg->fragmentStartingNum + msg->fragmentsInSubmessage - 2, rdata);
+    handle_regular (rst, tnow, rmsg, &msg->x, sampleinfo, msg->fragmentStartingNum + msg->fragmentsInSubmessage - 2, rdata, deferred_wakeup);
   }
   DDS_TRACE(")");
   return 1;
@@ -2681,6 +2694,7 @@ static int handle_submsg_sequence
   nn_ddsi_time_t timestamp;
   size_t submsg_size = 0;
   unsigned char * end = msg + len;
+  struct nn_dqueue *deferred_wakeup = NULL;
 
   /* Receiver state is dynamically allocated with lifetime bound to
      the message.  Updates cause a new copy to be created if the
@@ -2845,7 +2859,7 @@ static int handle_submsg_sequence
             goto malformed;
           sampleinfo.timestamp = timestamp;
           sampleinfo.reception_timestamp = tnowWC;
-          handle_DataFrag (rst, tnowE, rmsg, &sm->datafrag, submsg_size, &sampleinfo, datap);
+          handle_DataFrag (rst, tnowE, rmsg, &sm->datafrag, submsg_size, &sampleinfo, datap, &deferred_wakeup);
           rst_live = 1;
           ts_for_latmeas = 0;
         }
@@ -2860,7 +2874,7 @@ static int handle_submsg_sequence
             goto malformed;
           sampleinfo.timestamp = timestamp;
           sampleinfo.reception_timestamp = tnowWC;
-          handle_Data (rst, tnowE, rmsg, &sm->data, submsg_size, &sampleinfo, datap);
+          handle_Data (rst, tnowE, rmsg, &sm->data, submsg_size, &sampleinfo, datap, &deferred_wakeup);
           rst_live = 1;
           ts_for_latmeas = 0;
         }
@@ -2958,6 +2972,8 @@ static int handle_submsg_sequence
   }
   thread_state_asleep (ts1);
   assert (thread_is_asleep ());
+  if (deferred_wakeup)
+    dd_dqueue_enqueue_trigger (deferred_wakeup);
   return 0;
 
 malformed:
@@ -2966,6 +2982,8 @@ malformed:
 malformed_asleep:
   assert (thread_is_asleep ());
   malformed_packet_received (msg, submsg, len, state, state_smkind, hdr->vendorid);
+  if (deferred_wakeup)
+    dd_dqueue_enqueue_trigger (deferred_wakeup);
   return -1;
 }
 

From 7382c682de4f0c6032282b01bf3d8f049c5344e9 Mon Sep 17 00:00:00 2001
From: Erik Boasson <eb@ilities.com>
Date: Sat, 13 Apr 2019 17:19:25 +0200
Subject: [PATCH 024/238] eliminate clang static analyzer false positive

Signed-off-by: Erik Boasson <eb@ilities.com>
---
 src/core/ddsc/src/dds_read.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/core/ddsc/src/dds_read.c b/src/core/ddsc/src/dds_read.c
index b4c5adf..d595272 100644
--- a/src/core/ddsc/src/dds_read.c
+++ b/src/core/ddsc/src/dds_read.c
@@ -202,7 +202,7 @@ dds_readcdr_impl(
 
   thread_state_awake (ts1);
   rc = dds_read_lock(reader_or_condition, &rd, &cond, false);
-  if (rc >= DDS_RETCODE_OK) {
+  if (rc == DDS_RETCODE_OK) {
       ret = dds_rhc_takecdr
         (
          rd->m_rd->rhc, lock, buf, si, maxs,

From 1dad5d6493fead623d59a8d716ccc120f984c0d1 Mon Sep 17 00:00:00 2001
From: Erik Boasson <eb@ilities.com>
Date: Tue, 16 Apr 2019 17:07:09 +0200
Subject: [PATCH 025/238] add dds_entity_release counterpart to entity_claim

Signed-off-by: Erik Boasson <eb@ilities.com>
---
 src/core/ddsc/src/dds__entity.h  | 3 +++
 src/core/ddsc/src/dds_entity.c   | 7 ++++++-
 src/core/ddsc/src/dds_readcond.c | 4 +---
 src/core/ddsc/src/dds_reader.c   | 8 ++++----
 src/core/ddsc/src/dds_writer.c   | 4 ++--
 5 files changed, 16 insertions(+), 10 deletions(-)

diff --git a/src/core/ddsc/src/dds__entity.h b/src/core/ddsc/src/dds__entity.h
index 992c15a..34c13c5 100644
--- a/src/core/ddsc/src/dds__entity.h
+++ b/src/core/ddsc/src/dds__entity.h
@@ -84,6 +84,9 @@ dds_entity_claim (
   dds_entity_t hdl,
   dds_entity **eptr);
 
+DDS_EXPORT void dds_entity_release (
+  dds_entity *e);
+
 DDS_EXPORT dds_retcode_t
 dds_entity_lock(
   dds_entity_t hdl,
diff --git a/src/core/ddsc/src/dds_entity.c b/src/core/ddsc/src/dds_entity.c
index f8a4e14..e06beee 100644
--- a/src/core/ddsc/src/dds_entity.c
+++ b/src/core/ddsc/src/dds_entity.c
@@ -761,6 +761,11 @@ dds_retcode_t dds_entity_claim (dds_entity_t hdl, dds_entity **eptr)
   }
 }
 
+void dds_entity_release (dds_entity *e)
+{
+  dds_handle_release (&e->m_hdllink);
+}
+
 dds_retcode_t dds_entity_lock (dds_entity_t hdl, dds_entity_kind_t kind, dds_entity **eptr)
 {
   dds_retcode_t hres;
@@ -989,7 +994,7 @@ dds_return_t dds_generic_unimplemented_operation_manykinds (dds_entity_t handle,
         break;
       }
     }
-    dds_handle_release (&e->m_hdllink);
+    dds_entity_release (e);
     return DDS_ERRNO (ret);
   }
 }
diff --git a/src/core/ddsc/src/dds_readcond.c b/src/core/ddsc/src/dds_readcond.c
index 322af8e..ee37521 100644
--- a/src/core/ddsc/src/dds_readcond.c
+++ b/src/core/ddsc/src/dds_readcond.c
@@ -100,13 +100,11 @@ dds_entity_t dds_get_datareader (dds_entity_t condition)
         rdh = DDS_ERRNO (DDS_RETCODE_ILLEGAL_OPERATION);
         break;
     }
-    dds_handle_release (&e->m_hdllink);
+    dds_entity_release (e);
     return rdh;
   }
 }
 
-
-
 dds_return_t dds_get_mask (dds_entity_t condition, uint32_t *mask)
 {
   dds_entity *entity;
diff --git a/src/core/ddsc/src/dds_reader.c b/src/core/ddsc/src/dds_reader.c
index 2c14994..dcc3289 100644
--- a/src/core/ddsc/src/dds_reader.c
+++ b/src/core/ddsc/src/dds_reader.c
@@ -384,7 +384,7 @@ dds_create_reader(
             } else {
                 subscriber = participant_or_subscriber;
             }
-            dds_handle_release (&p_or_s->m_hdllink);
+            dds_entity_release (p_or_s);
             internal_topic = false;
             t = topic;
             break;
@@ -512,7 +512,7 @@ void dds_reader_ddsi2direct (dds_entity_t entity, ddsi2direct_directread_cb_t cb
 
   if (dds_entity_kind (dds_entity) != DDS_KIND_READER)
   {
-    dds_handle_release (&dds_entity->m_hdllink);
+    dds_entity_release (dds_entity);
     return;
   }
 
@@ -552,7 +552,7 @@ void dds_reader_ddsi2direct (dds_entity_t entity, ddsi2direct_directread_cb_t cb
     ddsrt_mutex_lock (&rd->e.lock);
   }
   ddsrt_mutex_unlock (&rd->e.lock);
-  dds_handle_release (&dds_rd->m_entity.m_hdllink);
+  dds_entity_release (dds_entity);
 }
 
 uint32_t dds_reader_lock_samples (dds_entity_t reader)
@@ -613,7 +613,7 @@ dds_entity_t dds_get_subscriber (dds_entity_t entity)
         subh = DDS_ERRNO (DDS_RETCODE_ILLEGAL_OPERATION);
         break;
     }
-    dds_handle_release (&e->m_hdllink);
+    dds_entity_release (e);
     return subh;
   }
 }
diff --git a/src/core/ddsc/src/dds_writer.c b/src/core/ddsc/src/dds_writer.c
index 06a13ef..5bd81d6 100644
--- a/src/core/ddsc/src/dds_writer.c
+++ b/src/core/ddsc/src/dds_writer.c
@@ -388,7 +388,7 @@ dds_create_writer(
         } else {
             publisher = participant_or_publisher;
         }
-        dds_handle_release (&p_or_p->m_hdllink);
+        dds_entity_release (p_or_p);
     }
 
     if ((rc = dds_publisher_lock(publisher, &pub)) != DDS_RETCODE_OK) {
@@ -494,7 +494,7 @@ dds_get_publisher(
       assert (dds_entity_kind (e->m_parent) == DDS_KIND_PUBLISHER);
       pubh = e->m_parent->m_hdllink.hdl;
     }
-    dds_handle_release (&e->m_hdllink);
+    dds_entity_release (e);
     return pubh;
   }
 }

From e085130a3995f594f86699c99c260f267c2fc557 Mon Sep 17 00:00:00 2001
From: Erik Boasson <eb@ilities.com>
Date: Mon, 15 Apr 2019 10:38:12 +0200
Subject: [PATCH 026/238] fix deadlock between listener, deleting reader, &c

If a (proxy) writer delivers data to a reader that has a data_available
listener calling read/take while that reader is being deleted, blocked
in set_listener waiting for the listeners to complete, then a deadlock
can occur:

* listener calling read/take then attempt to lock reader;
* deleting the reader locks the reader, then waits for the listeners to
  complete while holding the lock

This commits unlocks the reader before waiting for the listeners to
complete.

Signed-off-by: Erik Boasson <eb@ilities.com>
---
 src/core/ddsc/src/dds_entity.c | 32 ++++++++++++++++++++------------
 1 file changed, 20 insertions(+), 12 deletions(-)

diff --git a/src/core/ddsc/src/dds_entity.c b/src/core/ddsc/src/dds_entity.c
index e06beee..6704b6e 100644
--- a/src/core/ddsc/src/dds_entity.c
+++ b/src/core/ddsc/src/dds_entity.c
@@ -163,18 +163,23 @@ dds_return_t dds_delete_impl (dds_entity_t entity, bool keep_if_explicit)
     return DDS_RETCODE_OK;
   }
 
+  /* FIXME: "closing" the handle here means a listener invoked on X
+     can still discover that X has become inaccessible */
+  /* FIXME: RHC reads m_status_enable outside lock and might still
+     just invoke the listener */
   dds_handle_close (&e->m_hdllink);
-  ddsrt_mutex_lock (&e->m_observers_lock);
-  while (e->m_cb_count > 0)
-    ddsrt_cond_wait (&e->m_observers_cond, &e->m_observers_lock);
   e->m_status_enable = 0;
   dds_reset_listener (&e->m_listener);
   e->m_trigger |= DDS_DELETING_STATUS;
-  ddsrt_mutex_unlock (&e->m_observers_lock);
   dds_entity_unlock(e);
 
-  /* Signal observers that this entity will be deleted. */
-  dds_entity_status_signal (e);
+  /* Signal observers that this entity will be deleted and wait for
+     all listeners to complete. */
+  ddsrt_mutex_lock (&e->m_observers_lock);
+  dds_entity_observers_signal (e, e->m_trigger);
+  while (e->m_cb_count > 0)
+    ddsrt_cond_wait (&e->m_observers_cond, &e->m_observers_lock);
+  ddsrt_mutex_unlock (&e->m_observers_lock);
 
   /*
    * Recursively delete children.
@@ -547,7 +552,7 @@ dds_return_t dds_set_listener (dds_entity_t entity, const dds_listener_t *listen
   dds_entity *e, *x;
   dds_retcode_t rc;
 
-  if ((rc = dds_entity_lock (entity, DDS_KIND_DONTCARE, &e)) != DDS_RETCODE_OK)
+  if ((rc = dds_entity_claim (entity, &e)) != DDS_RETCODE_OK)
     return DDS_ERRNO (rc);
 
   ddsrt_mutex_lock (&e->m_observers_lock);
@@ -568,7 +573,7 @@ dds_return_t dds_set_listener (dds_entity_t entity, const dds_listener_t *listen
   }
   clear_status_with_listener (e);
   ddsrt_mutex_unlock (&e->m_observers_lock);
-  dds_entity_unlock (e);
+  dds_entity_release (e);
   pushdown_listener (entity);
   return DDS_RETCODE_OK;
 }
@@ -625,7 +630,7 @@ dds_return_t dds_get_status_mask (dds_entity_t entity, uint32_t *mask)
   if (mask == NULL)
     return DDS_ERRNO (DDS_RETCODE_BAD_PARAMETER);
 
-  if ((rc = dds_entity_lock (entity, DDS_KIND_DONTCARE, &e)) != DDS_RETCODE_OK)
+  if ((rc = dds_entity_claim (entity, &e)) != DDS_RETCODE_OK)
     return DDS_ERRNO (rc);
 
   if (e->m_deriver.validate_status == 0)
@@ -637,7 +642,7 @@ dds_return_t dds_get_status_mask (dds_entity_t entity, uint32_t *mask)
     ddsrt_mutex_unlock (&e->m_observers_lock);
     ret = DDS_RETCODE_OK;
   }
-  dds_entity_unlock(e);
+  dds_entity_release(e);
   return ret;
 }
 
@@ -652,7 +657,7 @@ dds_return_t dds_set_status_mask (dds_entity_t entity, uint32_t mask)
   dds_retcode_t rc;
   dds_return_t ret;
 
-  if ((rc = dds_entity_lock (entity, DDS_KIND_DONTCARE, &e)) != DDS_RETCODE_OK)
+  if ((rc = dds_entity_claim (entity, &e)) != DDS_RETCODE_OK)
     return DDS_ERRNO (rc);
 
   if (e->m_deriver.validate_status == 0)
@@ -660,13 +665,16 @@ dds_return_t dds_set_status_mask (dds_entity_t entity, uint32_t mask)
   else if ((ret = e->m_deriver.validate_status (mask)) == DDS_RETCODE_OK)
   {
     ddsrt_mutex_lock (&e->m_observers_lock);
+    while (e->m_cb_count > 0)
+      ddsrt_cond_wait (&e->m_observers_cond, &e->m_observers_lock);
+
     /* Don't block internal status triggers. */
     mask |= DDS_INTERNAL_STATUS_MASK;
     e->m_status_enable = mask;
     e->m_trigger &= mask;
     ddsrt_mutex_unlock (&e->m_observers_lock);
   }
-  dds_entity_unlock(e);
+  dds_entity_release (e);
   return ret;
 }
 

From 59270173dc07da2deef422aa9afe97d4bcb161bf Mon Sep 17 00:00:00 2001
From: Erik Boasson <eb@ilities.com>
Date: Tue, 16 Apr 2019 17:09:08 +0200
Subject: [PATCH 027/238] remove dds_rhc_fini abomination

It was called strangely early in the deleting of the reader, even before
the DDSI reader was no longer being accessed by other threads.  The
immediate and obvious problem is that it resets the pointer to the
upper-layer entity even though this can still be dereferenced in
invoking a listener, resulting in a crash.

Secondly it blocks until there are no listener calls any more (and the
resetting of that pointer will prevent any further listener
invocations), but a similar piece of logic is already in generic entity
code that resets the mask and then waits for all listener invocations to
complete.  Having both is a problem.

Signed-off-by: Erik Boasson <eb@ilities.com>
---
 src/core/ddsc/src/dds__rhc.h                  |  1 -
 src/core/ddsc/src/dds_init.c                  |  1 -
 src/core/ddsc/src/dds_reader.c                | 10 ++++-
 src/core/ddsc/src/dds_rhc.c                   | 44 +++----------------
 .../ddsi/include/dds/ddsi/ddsi_rhc_plugin.h   |  1 -
 src/core/ddsi/src/q_entity.c                  |  4 --
 6 files changed, 13 insertions(+), 48 deletions(-)

diff --git a/src/core/ddsc/src/dds__rhc.h b/src/core/ddsc/src/dds__rhc.h
index e01f7c4..fc08a7f 100644
--- a/src/core/ddsc/src/dds__rhc.h
+++ b/src/core/ddsc/src/dds__rhc.h
@@ -26,7 +26,6 @@ struct proxy_writer_info;
 
 DDS_EXPORT struct rhc *dds_rhc_new (dds_reader *reader, const struct ddsi_sertopic *topic);
 DDS_EXPORT void dds_rhc_free (struct rhc *rhc);
-DDS_EXPORT void dds_rhc_fini (struct rhc *rhc);
 
 DDS_EXPORT uint32_t dds_rhc_lock_samples (struct rhc *rhc);
 
diff --git a/src/core/ddsc/src/dds_init.c b/src/core/ddsc/src/dds_init.c
index 1efd81d..e6558d5 100644
--- a/src/core/ddsc/src/dds_init.c
+++ b/src/core/ddsc/src/dds_init.c
@@ -273,7 +273,6 @@ void ddsi_plugin_init (void)
   ddsi_plugin.builtintopic_write = dds__builtin_write;
 
   ddsi_plugin.rhc_plugin.rhc_free_fn = dds_rhc_free;
-  ddsi_plugin.rhc_plugin.rhc_fini_fn = dds_rhc_fini;
   ddsi_plugin.rhc_plugin.rhc_store_fn = dds_rhc_store;
   ddsi_plugin.rhc_plugin.rhc_unregister_wr_fn = dds_rhc_unregister_wr;
   ddsi_plugin.rhc_plugin.rhc_relinquish_ownership_fn = dds_rhc_relinquish_ownership;
diff --git a/src/core/ddsc/src/dds_reader.c b/src/core/ddsc/src/dds_reader.c
index dcc3289..b3f241b 100644
--- a/src/core/ddsc/src/dds_reader.c
+++ b/src/core/ddsc/src/dds_reader.c
@@ -160,14 +160,20 @@ void dds_reader_data_available_cb (struct dds_reader *rd)
      status on the subscriber; secondly it is the only one for which
      overhead really matters.  Otherwise, it is pretty much like
      dds_reader_status_cb. */
-  struct dds_listener const * const lst = &rd->m_entity.m_listener;
-  dds_entity * const sub = rd->m_entity.m_parent;
 
   ddsrt_mutex_lock (&rd->m_entity.m_observers_lock);
+  if (!(rd->m_entity.m_status_enable & DDS_DATA_AVAILABLE_STATUS))
+  {
+    ddsrt_mutex_unlock (&rd->m_entity.m_observers_lock);
+    return;
+  }
+
   while (rd->m_entity.m_cb_count > 0)
     ddsrt_cond_wait (&rd->m_entity.m_observers_cond, &rd->m_entity.m_observers_lock);
   rd->m_entity.m_cb_count++;
 
+  struct dds_listener const * const lst = &rd->m_entity.m_listener;
+  dds_entity * const sub = rd->m_entity.m_parent;
   if (lst->on_data_on_readers)
   {
     ddsrt_mutex_unlock (&rd->m_entity.m_observers_lock);
diff --git a/src/core/ddsc/src/dds_rhc.c b/src/core/ddsc/src/dds_rhc.c
index 7f3029b..4eb64dc 100644
--- a/src/core/ddsc/src/dds_rhc.c
+++ b/src/core/ddsc/src/dds_rhc.c
@@ -277,7 +277,6 @@ struct rhc {
 
   /* Instance/Sample maximums from resource limits QoS */
 
-  ddsrt_atomic_uint32_t n_cbs;       /* # callbacks in progress */
   int32_t max_instances; /* FIXME: probably better as uint32_t with MAX_UINT32 for unlimited */
   int32_t max_samples;   /* FIXME: probably better as uint32_t with MAX_UINT32 for unlimited */
   int32_t max_samples_per_instance; /* FIXME: probably better as uint32_t with MAX_UINT32 for unlimited */
@@ -631,20 +630,6 @@ void dds_rhc_free (struct rhc *rhc)
   ddsrt_free (rhc);
 }
 
-void dds_rhc_fini (struct rhc * rhc)
-{
-  ddsrt_mutex_lock (&rhc->lock);
-  rhc->reader = NULL;
-  ddsrt_mutex_unlock (&rhc->lock);
-
-  /* Wait for all callbacks to complete */
-
-  while (ddsrt_atomic_ld32 (&rhc->n_cbs) > 0)
-  {
-    dds_sleepfor (DDS_MSECS (1));
-  }
-}
-
 static void init_trigger_info_cmn_nonmatch (struct trigger_info_cmn *info)
 {
   info->qminst = ~0u;
@@ -1462,17 +1447,10 @@ bool dds_rhc_store (struct rhc * __restrict rhc, const struct proxy_writer_info
 
   if (rhc->reader)
   {
-    if (notify_data_available && (rhc->reader->m_entity.m_status_enable & DDS_DATA_AVAILABLE_STATUS))
-    {
-      ddsrt_atomic_inc32 (&rhc->n_cbs);
+    if (notify_data_available)
       dds_reader_data_available_cb (rhc->reader);
-      ddsrt_atomic_dec32 (&rhc->n_cbs);
-    }
-
     if (trigger_waitsets)
-    {
-      dds_entity_status_signal(&rhc->reader->m_entity);
-    }
+      dds_entity_status_signal (&rhc->reader->m_entity);
   }
 
   return delivered;
@@ -1489,13 +1467,8 @@ error_or_nochange:
 
   /* Make any reader status callback */
 
-  if (cb_data.raw_status_id >= 0 && rhc->reader && rhc->reader->m_entity.m_status_enable)
-  {
-    ddsrt_atomic_inc32 (&rhc->n_cbs);
+  if (cb_data.raw_status_id >= 0 && rhc->reader)
     dds_reader_status_cb (&rhc->reader->m_entity, &cb_data);
-    ddsrt_atomic_dec32 (&rhc->n_cbs);
-  }
-
   return delivered;
 }
 
@@ -1575,17 +1548,10 @@ void dds_rhc_unregister_wr (struct rhc * __restrict rhc, const struct proxy_writ
 
   if (rhc->reader)
   {
-    if (notify_data_available && (rhc->reader->m_entity.m_status_enable & DDS_DATA_AVAILABLE_STATUS))
-    {
-      ddsrt_atomic_inc32 (&rhc->n_cbs);
+    if (notify_data_available)
       dds_reader_data_available_cb (rhc->reader);
-      ddsrt_atomic_dec32 (&rhc->n_cbs);
-    }
-
     if (trigger_waitsets)
-    {
-      dds_entity_status_signal(&rhc->reader->m_entity);
-    }
+      dds_entity_status_signal (&rhc->reader->m_entity);
   }
 }
 
diff --git a/src/core/ddsi/include/dds/ddsi/ddsi_rhc_plugin.h b/src/core/ddsi/include/dds/ddsi/ddsi_rhc_plugin.h
index 7f884fa..57c8813 100644
--- a/src/core/ddsi/include/dds/ddsi/ddsi_rhc_plugin.h
+++ b/src/core/ddsi/include/dds/ddsi/ddsi_rhc_plugin.h
@@ -30,7 +30,6 @@ struct proxy_writer_info
 struct ddsi_rhc_plugin
 {
   void (*rhc_free_fn) (struct rhc *rhc);
-  void (*rhc_fini_fn) (struct rhc *rhc);
   bool (*rhc_store_fn)
   (struct rhc * __restrict rhc, const struct proxy_writer_info * __restrict pwr_info,
    struct ddsi_serdata * __restrict sample, struct ddsi_tkmap_instance * __restrict tk);
diff --git a/src/core/ddsi/src/q_entity.c b/src/core/ddsi/src/q_entity.c
index 685543b..3dffa18 100644
--- a/src/core/ddsi/src/q_entity.c
+++ b/src/core/ddsi/src/q_entity.c
@@ -3386,10 +3386,6 @@ int delete_reader (const struct nn_guid *guid)
     DDS_LOG(DDS_LC_DISCOVERY, "delete_reader_guid(guid %x:%x:%x:%x) - unknown guid\n", PGUID (*guid));
     return Q_ERR_UNKNOWN_ENTITY;
   }
-  if (rd->rhc)
-  {
-    (ddsi_plugin.rhc_plugin.rhc_fini_fn) (rd->rhc);
-  }
   DDS_LOG(DDS_LC_DISCOVERY, "delete_reader_guid(guid %x:%x:%x:%x) ...\n", PGUID (*guid));
   ddsi_plugin.builtintopic_write (&rd->e, now(), false);
   ephash_remove_reader_guid (rd);

From c891fdc685182209d17734e60d909cf8dc88c6f2 Mon Sep 17 00:00:00 2001
From: Erik Boasson <eb@ilities.com>
Date: Mon, 15 Apr 2019 10:49:51 +0200
Subject: [PATCH 028/238] block signals in ddsrt_thread_create

Signal handling in multi-threaded processes is bad enough at the best of
times, and as we don't really use any signals in the Cyclone code, it
makes more sense to create all threads with most signals blocked.  That
way an application that wants to handle signals using sigwait() need not
block all signals prior to creating a participant.

Note that instead of blocking all signals, we block all except SIGXCPU.
The reason is that the liveliness monitoring and stack trace dumping
code currently relies on that signal.

Signed-off-by: Erik Boasson <eb@ilities.com>
---
 src/ddsrt/src/threads/posix/threads.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/src/ddsrt/src/threads/posix/threads.c b/src/ddsrt/src/threads/posix/threads.c
index 278d796..f8dbf4c 100644
--- a/src/ddsrt/src/threads/posix/threads.c
+++ b/src/ddsrt/src/threads/posix/threads.c
@@ -193,6 +193,7 @@ ddsrt_thread_create (
   thread_context_t *ctx;
   ddsrt_threadattr_t tattr;
   int result, create_ret;
+  sigset_t set, oset;
 
   assert (threadptr != NULL);
   assert (name != NULL);
@@ -281,11 +282,18 @@ ddsrt_thread_create (
   strcpy (ctx->name, name);
   ctx->routine = start_routine;
   ctx->arg = arg;
+
+  /* Block signal delivery in our own threads (SIGXCPU is excluded so we have a way of
+     dumping stack traces, but that should be improved upon) */
+  sigfillset (&set);
+  sigdelset (&set, SIGXCPU);
+  sigprocmask (SIG_BLOCK, &set, &oset);
   if ((create_ret = pthread_create (&threadptr->v, &attr, os_startRoutineWrapper, ctx)) != 0)
   {
     DDS_ERROR ("os_threadCreate(%s): pthread_create failed with error %d\n", name, create_ret);
     goto err_create;
   }
+  sigprocmask (SIG_SETMASK, &oset, NULL);
   pthread_attr_destroy (&attr);
   return DDS_RETCODE_OK;
 

From 6e2068173a8258cd0ded53a7c7a6fc977d883a6f Mon Sep 17 00:00:00 2001
From: Erik Boasson <eb@ilities.com>
Date: Mon, 15 Apr 2019 11:04:26 +0200
Subject: [PATCH 029/238] crash invoking data available on built-in reader

The DDSI reader/writer pointers are now returned as out parameters
instead of as a return value, so that the upper-layer reference is set
before any listener can be invoked.

Signed-off-by: Erik Boasson <eb@ilities.com>
---
 src/core/ddsc/src/dds_reader.c            |  6 +-
 src/core/ddsc/src/dds_writer.c            |  4 +-
 src/core/ddsi/include/dds/ddsi/q_entity.h |  4 +-
 src/core/ddsi/src/q_entity.c              | 68 ++++++++++++-----------
 4 files changed, 42 insertions(+), 40 deletions(-)

diff --git a/src/core/ddsc/src/dds_reader.c b/src/core/ddsc/src/dds_reader.c
index b3f241b..b039495 100644
--- a/src/core/ddsc/src/dds_reader.c
+++ b/src/core/ddsc/src/dds_reader.c
@@ -472,11 +472,11 @@ dds_create_reader(
     ddsrt_mutex_unlock(&sub->m_entity.m_mutex);
 
     thread_state_awake (lookup_thread_state ());
-    rd->m_rd = new_reader(&rd->m_entity.m_guid, NULL, &sub->m_entity.m_participant->m_guid, tp->m_stopic,
-                          rqos, rhc, dds_reader_status_cb, rd);
+    ret = new_reader(&rd->m_rd, &rd->m_entity.m_guid, NULL, &sub->m_entity.m_participant->m_guid, tp->m_stopic,
+                     rqos, rhc, dds_reader_status_cb, rd);
     ddsrt_mutex_lock(&sub->m_entity.m_mutex);
     ddsrt_mutex_lock(&tp->m_entity.m_mutex);
-    assert (rd->m_rd);
+    assert (ret == DDS_RETCODE_OK);
     thread_state_asleep (lookup_thread_state ());
 
     /* For persistent data register reader with durability */
diff --git a/src/core/ddsc/src/dds_writer.c b/src/core/ddsc/src/dds_writer.c
index 5bd81d6..cd83d3e 100644
--- a/src/core/ddsc/src/dds_writer.c
+++ b/src/core/ddsc/src/dds_writer.c
@@ -456,10 +456,10 @@ dds_create_writer(
     ddsrt_mutex_unlock (&pub->m_entity.m_mutex);
 
     thread_state_awake (lookup_thread_state ());
-    wr->m_wr = new_writer(&wr->m_entity.m_guid, NULL, &pub->m_entity.m_participant->m_guid, tp->m_stopic, wqos, wr->m_whc, dds_writer_status_cb, wr);
+    ret = new_writer(&wr->m_wr, &wr->m_entity.m_guid, NULL, &pub->m_entity.m_participant->m_guid, tp->m_stopic, wqos, wr->m_whc, dds_writer_status_cb, wr);
     ddsrt_mutex_lock (&pub->m_entity.m_mutex);
     ddsrt_mutex_lock (&tp->m_entity.m_mutex);
-    assert(wr->m_wr);
+    assert(ret == DDS_RETCODE_OK);
     thread_state_asleep (lookup_thread_state ());
     dds_topic_unlock(tp);
     dds_publisher_unlock(pub);
diff --git a/src/core/ddsi/include/dds/ddsi/q_entity.h b/src/core/ddsi/include/dds/ddsi/q_entity.h
index 6f79aac..9138e02 100644
--- a/src/core/ddsi/include/dds/ddsi/q_entity.h
+++ b/src/core/ddsi/include/dds/ddsi/q_entity.h
@@ -479,9 +479,9 @@ struct writer *get_builtin_writer (const struct participant *pp, unsigned entity
    GUID "ppguid". May return NULL if participant unknown or
    writer/reader already known. */
 
-struct writer *new_writer (struct nn_guid *wrguid, const struct nn_guid *group_guid, const struct nn_guid *ppguid, const struct ddsi_sertopic *topic, const struct nn_xqos *xqos, struct whc * whc, status_cb_t status_cb, void *status_cb_arg);
+dds_retcode_t new_writer (struct writer **wr_out, struct nn_guid *wrguid, const struct nn_guid *group_guid, const struct nn_guid *ppguid, const struct ddsi_sertopic *topic, const struct nn_xqos *xqos, struct whc * whc, status_cb_t status_cb, void *status_cb_arg);
 
-struct reader *new_reader (struct nn_guid *rdguid, const struct nn_guid *group_guid, const struct nn_guid *ppguid, const struct ddsi_sertopic *topic, const struct nn_xqos *xqos, struct rhc * rhc, status_cb_t status_cb, void *status_cb_arg);
+dds_retcode_t new_reader (struct reader **rd_out, struct nn_guid *rdguid, const struct nn_guid *group_guid, const struct nn_guid *ppguid, const struct ddsi_sertopic *topic, const struct nn_xqos *xqos, struct rhc * rhc, status_cb_t status_cb, void *status_cb_arg);
 
 struct whc_node;
 struct whc_state;
diff --git a/src/core/ddsi/src/q_entity.c b/src/core/ddsi/src/q_entity.c
index 3dffa18..565c72b 100644
--- a/src/core/ddsi/src/q_entity.c
+++ b/src/core/ddsi/src/q_entity.c
@@ -88,8 +88,8 @@ static const unsigned prismtech_builtin_writers_besmask =
   NN_DISC_BUILTIN_ENDPOINT_CM_PUBLISHER_WRITER |
   NN_DISC_BUILTIN_ENDPOINT_CM_SUBSCRIBER_WRITER;
 
-static struct writer * new_writer_guid (const struct nn_guid *guid, const struct nn_guid *group_guid, struct participant *pp, const struct ddsi_sertopic *topic, const struct nn_xqos *xqos, struct whc *whc, status_cb_t status_cb, void *status_cbarg);
-static struct reader * new_reader_guid (const struct nn_guid *guid, const struct nn_guid *group_guid, struct participant *pp, const struct ddsi_sertopic *topic, const struct nn_xqos *xqos, struct rhc *rhc, status_cb_t status_cb, void *status_cbarg);
+static dds_retcode_t new_writer_guid (struct writer **wr_out, const struct nn_guid *guid, const struct nn_guid *group_guid, struct participant *pp, const struct ddsi_sertopic *topic, const struct nn_xqos *xqos, struct whc *whc, status_cb_t status_cb, void *status_cbarg);
+static dds_retcode_t new_reader_guid (struct reader **rd_out, const struct nn_guid *guid, const struct nn_guid *group_guid, struct participant *pp, const struct ddsi_sertopic *topic, const struct nn_xqos *xqos, struct rhc *rhc, status_cb_t status_cb, void *status_cbarg);
 static struct participant *ref_participant (struct participant *pp, const struct nn_guid *guid_of_refing_entity);
 static void unref_participant (struct participant *pp, const struct nn_guid *guid_of_refing_entity);
 static void delete_proxy_group_locked (struct proxy_group *pgroup, nn_wctime_t timestamp, int isimplicit);
@@ -488,7 +488,7 @@ int new_participant_guid (const nn_guid_t *ppguid, unsigned flags, const nn_plis
   if (!(flags & RTPS_PF_NO_BUILTIN_WRITERS))
   {
     subguid.entityid = to_entityid (NN_ENTITYID_SPDP_BUILTIN_PARTICIPANT_WRITER);
-    new_writer_guid (&subguid, &group_guid, pp, NULL, &gv.spdp_endpoint_xqos, whc_new(1, 1, 1), LAST_WR_PARAMS);
+    new_writer_guid (NULL, &subguid, &group_guid, pp, NULL, &gv.spdp_endpoint_xqos, whc_new(1, 1, 1), LAST_WR_PARAMS);
     /* But we need the as_disc address set for SPDP, because we need to
        send it to everyone regardless of the existence of readers. */
     {
@@ -511,23 +511,23 @@ int new_participant_guid (const nn_guid_t *ppguid, unsigned flags, const nn_plis
   if (!(flags & RTPS_PF_NO_BUILTIN_WRITERS))
   {
     subguid.entityid = to_entityid (NN_ENTITYID_SEDP_BUILTIN_SUBSCRIPTIONS_WRITER);
-    new_writer_guid (&subguid, &group_guid, pp, NULL, &gv.builtin_endpoint_xqos_wr, whc_new(1, 1, 1), LAST_WR_PARAMS);
+    new_writer_guid (NULL, &subguid, &group_guid, pp, NULL, &gv.builtin_endpoint_xqos_wr, whc_new(1, 1, 1), LAST_WR_PARAMS);
     pp->bes |= NN_DISC_BUILTIN_ENDPOINT_SUBSCRIPTION_ANNOUNCER;
 
     subguid.entityid = to_entityid (NN_ENTITYID_SEDP_BUILTIN_PUBLICATIONS_WRITER);
-    new_writer_guid (&subguid, &group_guid, pp, NULL, &gv.builtin_endpoint_xqos_wr, whc_new(1, 1, 1), LAST_WR_PARAMS);
+    new_writer_guid (NULL, &subguid, &group_guid, pp, NULL, &gv.builtin_endpoint_xqos_wr, whc_new(1, 1, 1), LAST_WR_PARAMS);
     pp->bes |= NN_DISC_BUILTIN_ENDPOINT_PUBLICATION_ANNOUNCER;
 
     subguid.entityid = to_entityid (NN_ENTITYID_SEDP_BUILTIN_CM_PARTICIPANT_WRITER);
-    new_writer_guid (&subguid, &group_guid, pp, NULL, &gv.builtin_endpoint_xqos_wr, whc_new(1, 1, 1), LAST_WR_PARAMS);
+    new_writer_guid (NULL, &subguid, &group_guid, pp, NULL, &gv.builtin_endpoint_xqos_wr, whc_new(1, 1, 1), LAST_WR_PARAMS);
     pp->prismtech_bes |= NN_DISC_BUILTIN_ENDPOINT_CM_PARTICIPANT_WRITER;
 
     subguid.entityid = to_entityid (NN_ENTITYID_SEDP_BUILTIN_CM_PUBLISHER_WRITER);
-    new_writer_guid (&subguid, &group_guid, pp, NULL, &gv.builtin_endpoint_xqos_wr, whc_new(1, 1, 1), LAST_WR_PARAMS);
+    new_writer_guid (NULL, &subguid, &group_guid, pp, NULL, &gv.builtin_endpoint_xqos_wr, whc_new(1, 1, 1), LAST_WR_PARAMS);
     pp->prismtech_bes |= NN_DISC_BUILTIN_ENDPOINT_CM_PUBLISHER_WRITER;
 
     subguid.entityid = to_entityid (NN_ENTITYID_SEDP_BUILTIN_CM_SUBSCRIBER_WRITER);
-    new_writer_guid (&subguid, &group_guid, pp, NULL, &gv.builtin_endpoint_xqos_wr, whc_new(1, 1, 1), LAST_WR_PARAMS);
+    new_writer_guid (NULL, &subguid, &group_guid, pp, NULL, &gv.builtin_endpoint_xqos_wr, whc_new(1, 1, 1), LAST_WR_PARAMS);
     pp->prismtech_bes |= NN_DISC_BUILTIN_ENDPOINT_CM_SUBSCRIBER_WRITER;
   }
 
@@ -535,7 +535,7 @@ int new_participant_guid (const nn_guid_t *ppguid, unsigned flags, const nn_plis
   {
     /* TODO: make this one configurable, we don't want all participants to publish all topics (or even just those that they use themselves) */
     subguid.entityid = to_entityid (NN_ENTITYID_SEDP_BUILTIN_TOPIC_WRITER);
-    new_writer_guid (&subguid, &group_guid, pp, NULL, &gv.builtin_endpoint_xqos_wr, whc_new(1, 1, 1), LAST_WR_PARAMS);
+    new_writer_guid (NULL, &subguid, &group_guid, pp, NULL, &gv.builtin_endpoint_xqos_wr, whc_new(1, 1, 1), LAST_WR_PARAMS);
     pp->bes |= NN_DISC_BUILTIN_ENDPOINT_TOPIC_ANNOUNCER;
   }
 
@@ -543,7 +543,7 @@ int new_participant_guid (const nn_guid_t *ppguid, unsigned flags, const nn_plis
   if (!(flags & RTPS_PF_NO_BUILTIN_WRITERS))
   {
     subguid.entityid = to_entityid (NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_MESSAGE_WRITER);
-    new_writer_guid (&subguid, &group_guid, pp, NULL, &gv.builtin_endpoint_xqos_wr, whc_new(1, 1, 1), LAST_WR_PARAMS);
+    new_writer_guid (NULL, &subguid, &group_guid, pp, NULL, &gv.builtin_endpoint_xqos_wr, whc_new(1, 1, 1), LAST_WR_PARAMS);
     pp->bes |= NN_BUILTIN_ENDPOINT_PARTICIPANT_MESSAGE_DATA_WRITER;
   }
 
@@ -551,31 +551,31 @@ int new_participant_guid (const nn_guid_t *ppguid, unsigned flags, const nn_plis
   if (!(flags & RTPS_PF_NO_BUILTIN_READERS))
   {
     subguid.entityid = to_entityid (NN_ENTITYID_SPDP_BUILTIN_PARTICIPANT_READER);
-    new_reader_guid (&subguid, &group_guid, pp, NULL, &gv.spdp_endpoint_xqos, NULL, NULL, NULL);
+    new_reader_guid (NULL, &subguid, &group_guid, pp, NULL, &gv.spdp_endpoint_xqos, NULL, NULL, NULL);
     pp->bes |= NN_DISC_BUILTIN_ENDPOINT_PARTICIPANT_DETECTOR;
 
     subguid.entityid = to_entityid (NN_ENTITYID_SEDP_BUILTIN_SUBSCRIPTIONS_READER);
-    new_reader_guid (&subguid, &group_guid, pp, NULL, &gv.builtin_endpoint_xqos_rd, NULL, NULL, NULL);
+    new_reader_guid (NULL, &subguid, &group_guid, pp, NULL, &gv.builtin_endpoint_xqos_rd, NULL, NULL, NULL);
     pp->bes |= NN_DISC_BUILTIN_ENDPOINT_SUBSCRIPTION_DETECTOR;
 
     subguid.entityid = to_entityid (NN_ENTITYID_SEDP_BUILTIN_PUBLICATIONS_READER);
-    new_reader_guid (&subguid, &group_guid, pp, NULL, &gv.builtin_endpoint_xqos_rd, NULL, NULL, NULL);
+    new_reader_guid (NULL, &subguid, &group_guid, pp, NULL, &gv.builtin_endpoint_xqos_rd, NULL, NULL, NULL);
     pp->bes |= NN_DISC_BUILTIN_ENDPOINT_PUBLICATION_DETECTOR;
 
     subguid.entityid = to_entityid (NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_MESSAGE_READER);
-    new_reader_guid (&subguid, &group_guid, pp, NULL, &gv.builtin_endpoint_xqos_rd, NULL, NULL, NULL);
+    new_reader_guid (NULL, &subguid, &group_guid, pp, NULL, &gv.builtin_endpoint_xqos_rd, NULL, NULL, NULL);
     pp->bes |= NN_BUILTIN_ENDPOINT_PARTICIPANT_MESSAGE_DATA_READER;
 
     subguid.entityid = to_entityid (NN_ENTITYID_SEDP_BUILTIN_CM_PARTICIPANT_READER);
-    new_reader_guid (&subguid, &group_guid, pp, NULL, &gv.builtin_endpoint_xqos_rd, NULL, NULL, NULL);
+    new_reader_guid (NULL, &subguid, &group_guid, pp, NULL, &gv.builtin_endpoint_xqos_rd, NULL, NULL, NULL);
     pp->prismtech_bes |= NN_DISC_BUILTIN_ENDPOINT_CM_PARTICIPANT_READER;
 
     subguid.entityid = to_entityid (NN_ENTITYID_SEDP_BUILTIN_CM_PUBLISHER_READER);
-    new_reader_guid (&subguid, &group_guid, pp, NULL, &gv.builtin_endpoint_xqos_rd, NULL, NULL, NULL);
+    new_reader_guid (NULL, &subguid, &group_guid, pp, NULL, &gv.builtin_endpoint_xqos_rd, NULL, NULL, NULL);
     pp->prismtech_bes |= NN_DISC_BUILTIN_ENDPOINT_CM_PUBLISHER_READER;
 
     subguid.entityid = to_entityid (NN_ENTITYID_SEDP_BUILTIN_CM_SUBSCRIBER_READER);
-    new_reader_guid (&subguid, &group_guid, pp, NULL, &gv.builtin_endpoint_xqos_rd, NULL, NULL, NULL);
+    new_reader_guid (NULL, &subguid, &group_guid, pp, NULL, &gv.builtin_endpoint_xqos_rd, NULL, NULL, NULL);
     pp->prismtech_bes |= NN_DISC_BUILTIN_ENDPOINT_CM_SUBSCRIBER_READER;
 
   }
@@ -2779,7 +2779,7 @@ static void new_writer_guid_common_init (struct writer *wr, const struct ddsi_se
   local_reader_ary_init (&wr->rdary);
 }
 
-static struct writer *new_writer_guid (const struct nn_guid *guid, const struct nn_guid *group_guid, struct participant *pp, const struct ddsi_sertopic *topic, const struct nn_xqos *xqos, struct whc *whc, status_cb_t status_cb, void *status_entity)
+static dds_retcode_t new_writer_guid (struct writer **wr_out, const struct nn_guid *guid, const struct nn_guid *group_guid, struct participant *pp, const struct ddsi_sertopic *topic, const struct nn_xqos *xqos, struct whc *whc, status_cb_t status_cb, void *status_entity)
 {
   struct writer *wr;
   nn_mtime_t tnow = now_mt ();
@@ -2790,6 +2790,8 @@ static struct writer *new_writer_guid (const struct nn_guid *guid, const struct
 
   new_reader_writer_common (guid, topic, xqos);
   wr = ddsrt_malloc (sizeof (*wr));
+  if (wr_out)
+    *wr_out = wr;
 
   /* want a pointer to the participant so that a parallel call to
    delete_participant won't interfere with our ability to address
@@ -2822,27 +2824,25 @@ static struct writer *new_writer_guid (const struct nn_guid *guid, const struct
     resched_xevent_if_earlier (pp->pmd_update_xevent, tsched);
   }
 
-  return wr;
+  return DDS_RETCODE_OK;
 }
 
-struct writer *new_writer (struct nn_guid *wrguid, const struct nn_guid *group_guid, const struct nn_guid *ppguid, const struct ddsi_sertopic *topic, const struct nn_xqos *xqos, struct whc * whc, status_cb_t status_cb, void *status_cb_arg)
+dds_retcode_t new_writer (struct writer **wr_out, struct nn_guid *wrguid, const struct nn_guid *group_guid, const struct nn_guid *ppguid, const struct ddsi_sertopic *topic, const struct nn_xqos *xqos, struct whc * whc, status_cb_t status_cb, void *status_cb_arg)
 {
   struct participant *pp;
-  struct writer * wr;
 
   if ((pp = ephash_lookup_participant_guid (ppguid)) == NULL)
   {
     DDS_LOG(DDS_LC_DISCOVERY, "new_writer - participant %x:%x:%x:%x not found\n", PGUID (*ppguid));
-    return NULL;
+    return DDS_RETCODE_NOT_FOUND;
   }
   /* participant can't be freed while we're mucking around cos we are
      awake and do not touch the thread's vtime (ephash_lookup already
      verifies we're awake) */
   wrguid->prefix = pp->e.guid.prefix;
   if (pp_allocate_entityid (&wrguid->entityid, NN_ENTITYID_KIND_WRITER_WITH_KEY, pp) < 0)
-    return NULL;
-  wr = new_writer_guid (wrguid, group_guid, pp, topic, xqos, whc, status_cb, status_cb_arg);
-  return wr;
+    return DDS_RETCODE_OUT_OF_RESOURCES;
+  return new_writer_guid (wr_out, wrguid, group_guid, pp, topic, xqos, whc, status_cb, status_cb_arg);
 }
 
 struct local_orphan_writer *new_local_orphan_writer (nn_entityid_t entityid, struct ddsi_sertopic *topic, const struct nn_xqos *xqos, struct whc *whc)
@@ -3170,8 +3170,9 @@ static void leave_mcast_helper (const nn_locator_t *n, void * varg)
 }
 #endif /* DDSI_INCLUDE_NETWORK_PARTITIONS */
 
-static struct reader * new_reader_guid
+static dds_retcode_t new_reader_guid
 (
+  struct reader **rd_out,
   const struct nn_guid *guid,
   const struct nn_guid *group_guid,
   struct participant *pp,
@@ -3193,6 +3194,8 @@ static struct reader * new_reader_guid
 
   new_reader_writer_common (guid, topic, xqos);
   rd = ddsrt_malloc (sizeof (*rd));
+  if (rd_out)
+    *rd_out = rd;
 
   endpoint_common_init (&rd->e, &rd->c, EK_READER, guid, group_guid, pp);
 
@@ -3300,11 +3303,12 @@ static struct reader * new_reader_guid
   match_reader_with_local_writers (rd, tnow);
   ddsi_plugin.builtintopic_write (&rd->e, now(), true);
   sedp_write_reader (rd);
-  return rd;
+  return DDS_RETCODE_OK;
 }
 
-struct reader * new_reader
+dds_retcode_t new_reader
 (
+  struct reader **rd_out,
   struct nn_guid *rdguid,
   const struct nn_guid *group_guid,
   const struct nn_guid *ppguid,
@@ -3316,18 +3320,16 @@ struct reader * new_reader
 )
 {
   struct participant * pp;
-  struct reader * rd;
 
   if ((pp = ephash_lookup_participant_guid (ppguid)) == NULL)
   {
     DDS_LOG(DDS_LC_DISCOVERY, "new_reader - participant %x:%x:%x:%x not found\n", PGUID (*ppguid));
-    return NULL;
+    return DDS_RETCODE_NOT_FOUND;
   }
   rdguid->prefix = pp->e.guid.prefix;
   if (pp_allocate_entityid (&rdguid->entityid, NN_ENTITYID_KIND_READER_WITH_KEY, pp) < 0)
-    return NULL;
-  rd = new_reader_guid (rdguid, group_guid, pp, topic, xqos, rhc, status_cb, status_cbarg);
-  return rd;
+    return DDS_RETCODE_OUT_OF_RESOURCES;
+  return new_reader_guid (rd_out, rdguid, group_guid, pp, topic, xqos, rhc, status_cb, status_cbarg);
 }
 
 static void gc_delete_reader (struct gcreq *gcreq)

From 14148aceb54c8171e0236d7da0127e45aa56bc0b Mon Sep 17 00:00:00 2001
From: Erik Boasson <eb@ilities.com>
Date: Mon, 15 Apr 2019 11:42:56 +0200
Subject: [PATCH 030/238] add QoS to ignore local readers/writers (#78)

Adds a new "ignorelocal" QoS to the readers/writers to ignore local
matching readers/writers, with three settings:

* DDS_IGNORELOCAL_NONE: default
* DDS_IGNORELOCAL_PARTICIPANT: ignores readers/writers in the same
  participant
* DDS_IGNORELOCAL_PROCESS: ignores readers/writers in the same process

These can be set/got using dds_qset_ignorelocal and
dds_qget_ignorelocal.

If a matching reader or writer is ignored because of this setting, it is
as-if that reader or writer doesn't exist.  No traffic will be generated
or data retained on its behalf.

There are no consequences for interoperability as this is (by
definition) a local affair.

Signed-off-by: Erik Boasson <eb@ilities.com>
---
 .../ddsc/include/dds/ddsc/dds_public_qos.h    | 33 +++++++++++++++++++
 src/core/ddsc/src/dds_qos.c                   | 21 ++++++++++++
 src/core/ddsi/include/dds/ddsi/q_xqos.h       | 12 +++++++
 src/core/ddsi/src/q_entity.c                  | 27 +++++++++++++++
 src/core/ddsi/src/q_plist.c                   | 10 ++++++
 5 files changed, 103 insertions(+)

diff --git a/src/core/ddsc/include/dds/ddsc/dds_public_qos.h b/src/core/ddsc/include/dds/ddsc/dds_public_qos.h
index 4ffceb4..8f319c1 100644
--- a/src/core/ddsc/include/dds/ddsc/dds_public_qos.h
+++ b/src/core/ddsc/include/dds/ddsc/dds_public_qos.h
@@ -136,6 +136,16 @@ typedef enum dds_presentation_access_scope_kind
 }
 dds_presentation_access_scope_kind_t;
 
+/** Ignore-local QoS: Applies to DataReader, DataWriter */
+typedef enum dds_ignorelocal_kind
+{
+    DDS_IGNORELOCAL_NONE,
+    DDS_IGNORELOCAL_PARTICIPANT,
+    DDS_IGNORELOCAL_PROCESS
+}
+dds_ignorelocal_kind_t;
+
+
 /**
  * @brief Allocate memory and initialize default QoS-policies
  *
@@ -465,6 +475,16 @@ dds_qset_durability_service (
   int32_t max_instances,
   int32_t max_samples_per_instance);
 
+/**
+ * @brief Set the ignore-local policy of a qos structure
+ *
+ * @param[in,out] qos - Pointer to a dds_qos_t structure that will store the policy
+ * @param[in] ignore - True if readers and writers owned by the same participant should be ignored
+ */
+DDS_EXPORT void dds_qset_ignorelocal (
+  dds_qos_t * __restrict qos,
+  dds_ignorelocal_kind_t ignore);
+
 /**
  * @brief Get the userdata from a qos structure
  *
@@ -753,6 +773,19 @@ dds_qget_durability_service (
   int32_t *max_instances,
   int32_t *max_samples_per_instance);
 
+  /**
+   * @brief Get the ignore-local qos policy
+   *
+   * @param[in] qos - Pointer to a dds_qos_t structure storing the policy
+   * @param[in,out] ignore - Pointer that will store whether to ignore readers/writers owned by the same participant (optional)
+   *
+   * @returns - false iff any of the arguments is invalid or the qos is not present in the qos object
+   */
+DDS_EXPORT bool
+dds_qget_ignorelocal (
+  const dds_qos_t * __restrict qos,
+  dds_ignorelocal_kind_t *ignore);
+
 #if defined (__cplusplus)
 }
 #endif
diff --git a/src/core/ddsc/src/dds_qos.c b/src/core/ddsc/src/dds_qos.c
index bc1869c..25a3ce6 100644
--- a/src/core/ddsc/src/dds_qos.c
+++ b/src/core/ddsc/src/dds_qos.c
@@ -658,6 +658,16 @@ void dds_qset_durability_service
     }
 }
 
+void dds_qset_ignorelocal (dds_qos_t * __restrict qos, dds_ignorelocal_kind_t ignore)
+{
+  if (qos) {
+    qos->ignorelocal.value = (nn_ignorelocal_kind_t) ignore;
+    qos->present |= QP_CYCLONE_IGNORELOCAL;
+  } else {
+    DDS_ERROR("Argument QoS is NULL\n");
+  }
+}
+
 bool dds_qget_userdata (const dds_qos_t * __restrict qos, void **value, size_t *sz)
 {
     if (!qos || !(qos->present & QP_USER_DATA)) {
@@ -931,3 +941,14 @@ bool dds_qget_durability_service (const dds_qos_t * __restrict qos, dds_duration
     }
     return true;
 }
+
+bool dds_qget_ignorelocal (const dds_qos_t * __restrict qos, dds_ignorelocal_kind_t *ignore)
+{
+  if (!qos || !(qos->present & QP_CYCLONE_IGNORELOCAL)) {
+    return false;
+  }
+  if (ignore) {
+    *ignore = (dds_ignorelocal_kind_t) qos->ignorelocal.value;
+  }
+  return true;
+}
diff --git a/src/core/ddsi/include/dds/ddsi/q_xqos.h b/src/core/ddsi/include/dds/ddsi/q_xqos.h
index 46a15bf..d13207d 100644
--- a/src/core/ddsi/include/dds/ddsi/q_xqos.h
+++ b/src/core/ddsi/include/dds/ddsi/q_xqos.h
@@ -205,6 +205,16 @@ typedef struct nn_share_qospolicy {
   char *name;
 } nn_share_qospolicy_t;
 
+typedef enum nn_ignorelocal_kind {
+  NN_NONE_IGNORELOCAL_QOS,
+  NN_PARTICIPANT_IGNORELOCAL_QOS,
+  NN_PROCESS_IGNORELOCAL_QOS
+} nn_ignorelocal_kind_t;
+
+typedef struct nn_ignorelocal_qospolicy {
+  nn_ignorelocal_kind_t value;
+} nn_ignorelocal_qospolicy_t;
+
 /***/
 
 /* Qos Present bit indices */
@@ -237,6 +247,7 @@ typedef struct nn_share_qospolicy {
 #define QP_PRISMTECH_ENTITY_FACTORY          ((uint64_t)1 << 27)
 #define QP_PRISMTECH_SYNCHRONOUS_ENDPOINT    ((uint64_t)1 << 28)
 #define QP_RTI_TYPECODE                      ((uint64_t)1 << 29)
+#define QP_CYCLONE_IGNORELOCAL               ((uint64_t)1 << 30)
 
 /* Partition QoS is not RxO according to the specification (DDS 1.2,
    section 7.1.3), but communication will not take place unless it
@@ -290,6 +301,7 @@ typedef struct nn_xqos {
   /*x xR*/nn_reader_lifespan_qospolicy_t reader_lifespan;
   /*x xR*/nn_share_qospolicy_t share;
   /*xxx */nn_synchronous_endpoint_qospolicy_t synchronous_endpoint;
+  /* x  */nn_ignorelocal_qospolicy_t ignorelocal;
 
   /*   X*/nn_octetseq_t rti_typecode;
 } nn_xqos_t;
diff --git a/src/core/ddsi/src/q_entity.c b/src/core/ddsi/src/q_entity.c
index 565c72b..3626afd 100644
--- a/src/core/ddsi/src/q_entity.c
+++ b/src/core/ddsi/src/q_entity.c
@@ -2058,12 +2058,39 @@ static void connect_proxy_writer_with_reader (struct proxy_writer *pwr, struct r
   proxy_writer_add_connection (pwr, rd, tnow, init_count);
 }
 
+static bool ignore_local_p (const nn_guid_t *guid1, const nn_guid_t *guid2, const struct nn_xqos *xqos1, const struct nn_xqos *xqos2)
+{
+  assert (xqos1->present & QP_CYCLONE_IGNORELOCAL);
+  assert (xqos2->present & QP_CYCLONE_IGNORELOCAL);
+  switch (xqos1->ignorelocal.value)
+  {
+    case NN_NONE_IGNORELOCAL_QOS:
+      break;
+    case NN_PARTICIPANT_IGNORELOCAL_QOS:
+      return memcmp (&guid1->prefix, &guid2->prefix, sizeof (guid1->prefix)) == 0;
+    case NN_PROCESS_IGNORELOCAL_QOS:
+      return true;
+  }
+  switch (xqos2->ignorelocal.value)
+  {
+    case NN_NONE_IGNORELOCAL_QOS:
+      break;
+    case NN_PARTICIPANT_IGNORELOCAL_QOS:
+      return memcmp (&guid1->prefix, &guid2->prefix, sizeof (guid1->prefix)) == 0;
+    case NN_PROCESS_IGNORELOCAL_QOS:
+      return true;
+  }
+  return false;
+}
+
 static void connect_writer_with_reader (struct writer *wr, struct reader *rd, nn_mtime_t tnow)
 {
   int32_t reason;
   (void)tnow;
   if (!is_local_orphan_endpoint (&wr->e) && (is_builtin_entityid (wr->e.guid.entityid, NN_VENDORID_ECLIPSE) || is_builtin_entityid (rd->e.guid.entityid, NN_VENDORID_ECLIPSE)))
     return;
+  if (ignore_local_p (&wr->e.guid, &rd->e.guid, wr->xqos, rd->xqos))
+    return;
   if ((reason = qos_match_p (rd->xqos, wr->xqos)) >= 0)
   {
     writer_qos_mismatch (wr, (uint32_t)reason);
diff --git a/src/core/ddsi/src/q_plist.c b/src/core/ddsi/src/q_plist.c
index ad97995..c7a8222 100644
--- a/src/core/ddsi/src/q_plist.c
+++ b/src/core/ddsi/src/q_plist.c
@@ -2656,6 +2656,9 @@ static void xqos_init_default_common (nn_xqos_t *xqos)
 
   xqos->present |= QP_PRISMTECH_SYNCHRONOUS_ENDPOINT;
   xqos->synchronous_endpoint.value = 0;
+
+  xqos->present |= QP_CYCLONE_IGNORELOCAL;
+  xqos->ignorelocal.value = NN_NONE_IGNORELOCAL_QOS;
 }
 
 void nn_xqos_init_default_reader (nn_xqos_t *xqos)
@@ -2810,6 +2813,7 @@ void nn_xqos_mergein_missing (nn_xqos_t *a, const nn_xqos_t *b)
   CQ (PRISMTECH_READER_LIFESPAN, reader_lifespan);
   CQ (PRISMTECH_ENTITY_FACTORY, entity_factory);
   CQ (PRISMTECH_SYNCHRONOUS_ENDPOINT, synchronous_endpoint);
+  CQ (CYCLONE_IGNORELOCAL, ignorelocal);
 #undef CQ
 
   /* For allocated ones it is Not strictly necessary to use tmp, as
@@ -3197,6 +3201,10 @@ uint64_t nn_xqos_delta (const nn_xqos_t *a, const nn_xqos_t *b, uint64_t mask)
     if (octetseqs_differ (&a->rti_typecode, &b->rti_typecode))
       delta |= QP_RTI_TYPECODE;
   }
+  if (check & QP_CYCLONE_IGNORELOCAL) {
+    if (a->ignorelocal.value != b->ignorelocal.value)
+      delta |= QP_CYCLONE_IGNORELOCAL;
+  }
   return delta;
 }
 
@@ -3257,6 +3265,7 @@ void nn_xqos_addtomsg (struct nn_xmsg *m, const nn_xqos_t *xqos, uint64_t wanted
   SIMPLE (PRISMTECH_ENTITY_FACTORY, entity_factory);
   SIMPLE (PRISMTECH_SYNCHRONOUS_ENDPOINT, synchronous_endpoint);
   FUNC_BY_REF (RTI_TYPECODE, rti_typecode, octetseq);
+  /* CYCLONE_IGNORELOCAL is not visible on the wire */
 #undef FUNC_BY_REF
 #undef FUNC_BY_VAL
 #undef SIMPLE
@@ -3467,6 +3476,7 @@ void nn_log_xqos (uint32_t cat, const nn_xqos_t *xqos)
     log_octetseq (cat, xqos->rti_typecode.length, xqos->rti_typecode.value);
     DDS_LOG(cat, ">");
   });
+  DO (CYCLONE_IGNORELOCAL, { LOGB1 ("ignorelocal=%u", xqos->ignorelocal.value); });
 
 #undef PRINTARG_DUR
 #undef FMT_DUR

From e6f35cdab88d7a3cd59b61e5947305ed17864123 Mon Sep 17 00:00:00 2001
From: Erik Boasson <eb@ilities.com>
Date: Mon, 15 Apr 2019 11:43:39 +0200
Subject: [PATCH 031/238] publish built-in topics prior to matching

The built-in topics for readers and writers should be published before a
subscription or publication matched listener is invoked, otherwise the
instance handle provided to the listener is not yet available in a
reader for the corresponding topic.

Signed-off-by: Erik Boasson <eb@ilities.com>
---
 src/core/ddsi/src/q_entity.c | 25 ++++++++++++++++++++-----
 1 file changed, 20 insertions(+), 5 deletions(-)

diff --git a/src/core/ddsi/src/q_entity.c b/src/core/ddsi/src/q_entity.c
index 3626afd..2c5105c 100644
--- a/src/core/ddsi/src/q_entity.c
+++ b/src/core/ddsi/src/q_entity.c
@@ -2832,7 +2832,10 @@ static dds_retcode_t new_writer_guid (struct writer **wr_out, const struct nn_gu
    the order if hash insert & matching creates a window during which
    neither of two endpoints being created in parallel can discover
    the other. */
+  ddsrt_mutex_lock (&wr->e.lock);
   ephash_insert_writer_guid (wr);
+  ddsi_plugin.builtintopic_write (&wr->e, now(), true);
+  ddsrt_mutex_unlock (&wr->e.lock);
 
   /* once it exists, match it with proxy writers and broadcast
    existence (I don't think it matters much what the order of these
@@ -2842,7 +2845,6 @@ static dds_retcode_t new_writer_guid (struct writer **wr_out, const struct nn_gu
    deleted while we do so */
   match_writer_with_proxy_readers (wr, tnow);
   match_writer_with_local_readers (wr, tnow);
-  ddsi_plugin.builtintopic_write (&wr->e, now(), true);
   sedp_write_writer (wr);
 
   if (wr->lease_duration != T_NEVER)
@@ -2890,8 +2892,8 @@ struct local_orphan_writer *new_local_orphan_writer (nn_entityid_t entityid, str
   memset (&wr->c.group_guid, 0, sizeof (wr->c.group_guid));
   new_writer_guid_common_init (wr, topic, xqos, whc, 0, NULL);
   ephash_insert_writer_guid (wr);
-  match_writer_with_local_readers (wr, tnow);
   ddsi_plugin.builtintopic_write (&wr->e, now(), true);
+  match_writer_with_local_readers (wr, tnow);
   return lowr;
 }
 
@@ -3325,10 +3327,13 @@ static dds_retcode_t new_reader_guid
   ut_avlInit (&rd_writers_treedef, &rd->writers);
   ut_avlInit (&rd_local_writers_treedef, &rd->local_writers);
 
+  ddsrt_mutex_lock (&rd->e.lock);
   ephash_insert_reader_guid (rd);
+  ddsi_plugin.builtintopic_write (&rd->e, now(), true);
+  ddsrt_mutex_unlock (&rd->e.lock);
+
   match_reader_with_proxy_writers (rd, tnow);
   match_reader_with_local_writers (rd, tnow);
-  ddsi_plugin.builtintopic_write (&rd->e, now(), true);
   sedp_write_reader (rd);
   return DDS_RETCODE_OK;
 }
@@ -4170,9 +4175,14 @@ int new_proxy_writer (const struct nn_guid *ppguid, const struct nn_guid *guid,
   pwr->ddsi2direct_cbarg = 0;
 
   local_reader_ary_init (&pwr->rdary);
+
+  /* locking the entity prevents matching while the built-in topic hasn't been published yet */
+  ddsrt_mutex_lock (&pwr->e.lock);
   ephash_insert_proxy_writer_guid (pwr);
-  match_proxy_writer_with_readers (pwr, tnow);
   ddsi_plugin.builtintopic_write (&pwr->e, timestamp, true);
+  ddsrt_mutex_unlock (&pwr->e.lock);
+
+  match_proxy_writer_with_readers (pwr, tnow);
 
   ddsrt_mutex_lock (&pwr->e.lock);
   pwr->local_matching_inprogress = 0;
@@ -4344,9 +4354,14 @@ int new_proxy_reader (const struct nn_guid *ppguid, const struct nn_guid *guid,
   prd->assert_pp_lease = (unsigned) !!config.arrival_of_data_asserts_pp_and_ep_liveliness;
 
   ut_avlInit (&prd_writers_treedef, &prd->writers);
+
+  /* locking the entity prevents matching while the built-in topic hasn't been published yet */
+  ddsrt_mutex_lock (&prd->e.lock);
   ephash_insert_proxy_reader_guid (prd);
-  match_proxy_reader_with_writers (prd, tnow);
   ddsi_plugin.builtintopic_write (&prd->e, timestamp, true);
+  ddsrt_mutex_unlock (&prd->e.lock);
+
+  match_proxy_reader_with_writers (prd, tnow);
   return 0;
 }
 

From f12b36e112043dd0b5379aece3b4ccd63919cd56 Mon Sep 17 00:00:00 2001
From: Erik Boasson <eb@ilities.com>
Date: Mon, 15 Apr 2019 11:19:30 +0200
Subject: [PATCH 032/238] add setter for partition QoS for a single name

This adds dds_qset_partition1 as a convenience function to set the
partition QoS to a single name.

Signed-off-by: Erik Boasson <eb@ilities.com>
---
 src/core/ddsc/include/dds/ddsc/dds_public_qos.h | 14 +++++++++++++-
 src/core/ddsc/src/dds_qos.c                     |  8 ++++++++
 2 files changed, 21 insertions(+), 1 deletion(-)

diff --git a/src/core/ddsc/include/dds/ddsc/dds_public_qos.h b/src/core/ddsc/include/dds/ddsc/dds_public_qos.h
index 8f319c1..95fa4fe 100644
--- a/src/core/ddsc/include/dds/ddsc/dds_public_qos.h
+++ b/src/core/ddsc/include/dds/ddsc/dds_public_qos.h
@@ -391,7 +391,7 @@ dds_qset_time_based_filter (
  *
  * @param[in,out] qos - Pointer to a dds_qos_t structure that will store the policy
  * @param[in] n - Number of partitions stored in ps
- * @param[in[ ps - Pointer to string(s) storing partition name(s)
+ * @param[in] ps - Pointer to string(s) storing partition name(s)
  */
 DDS_EXPORT void
 dds_qset_partition (
@@ -399,6 +399,18 @@ dds_qset_partition (
   uint32_t n,
   const char ** __restrict ps);
 
+/**
+ * @brief Convenience function to set the partition policy of a qos structure to a
+ * single name.  Name may be a null pointer.
+ *
+ * @param[in,out] qos - Pointer to a dds_qos_t structure that will store the policy
+ * @param[in] name - Pointer to the name
+ */
+DDS_EXPORT void
+dds_qset_partition1 (
+  dds_qos_t * __restrict qos,
+  const char * __restrict name);
+
 /**
  * @brief Set the reliability policy of a qos structure
  *
diff --git a/src/core/ddsc/src/dds_qos.c b/src/core/ddsc/src/dds_qos.c
index 25a3ce6..02988bf 100644
--- a/src/core/ddsc/src/dds_qos.c
+++ b/src/core/ddsc/src/dds_qos.c
@@ -558,6 +558,14 @@ void dds_qset_partition
     qos->present |= QP_PARTITION;
 }
 
+void dds_qset_partition1 (dds_qos_t * __restrict qos, const char * __restrict name)
+{
+  if (name == NULL)
+    dds_qset_partition (qos, 0, NULL);
+  else
+    dds_qset_partition (qos, 1, (const char **) &name);
+}
+
 void dds_qset_reliability
 (
     dds_qos_t * __restrict qos,

From 42500e7fb86ca1e11c45332e8cba8f95f3088c2c Mon Sep 17 00:00:00 2001
From: Erik Boasson <eb@ilities.com>
Date: Mon, 15 Apr 2019 11:21:52 +0200
Subject: [PATCH 033/238] add participant instance handle to builtin topics

Extend the endpoint built-in topic data with the participant instance
handle (the GUID was already present).  Having the instance handle
available makes it trivial to look up the participant, whereas a lookup
of the GUID is rather impractical.

Signed-off-by: Erik Boasson <eb@ilities.com>
---
 src/core/ddsc/include/dds/dds.h               | 1 +
 src/core/ddsc/src/dds__serdata_builtintopic.h | 1 +
 src/core/ddsc/src/dds_serdata_builtintopic.c  | 7 +++++++
 3 files changed, 9 insertions(+)

diff --git a/src/core/ddsc/include/dds/dds.h b/src/core/ddsc/include/dds/dds.h
index 3d5dc42..d701117 100644
--- a/src/core/ddsc/include/dds/dds.h
+++ b/src/core/ddsc/include/dds/dds.h
@@ -210,6 +210,7 @@ typedef struct dds_builtintopic_endpoint
 {
   dds_builtintopic_guid_t key;
   dds_builtintopic_guid_t participant_key;
+  dds_instance_handle_t participant_instance_handle;
   char *topic_name;
   char *type_name;
   dds_qos_t *qos;
diff --git a/src/core/ddsc/src/dds__serdata_builtintopic.h b/src/core/ddsc/src/dds__serdata_builtintopic.h
index 46ccf88..6afe2d1 100644
--- a/src/core/ddsc/src/dds__serdata_builtintopic.h
+++ b/src/core/ddsc/src/dds__serdata_builtintopic.h
@@ -19,6 +19,7 @@
 struct ddsi_serdata_builtintopic {
   struct ddsi_serdata c;
   nn_guid_t key;
+  dds_instance_handle_t pphandle;
   nn_xqos_t xqos;
 };
 
diff --git a/src/core/ddsc/src/dds_serdata_builtintopic.c b/src/core/ddsc/src/dds_serdata_builtintopic.c
index b62d405..33da2ca 100644
--- a/src/core/ddsc/src/dds_serdata_builtintopic.c
+++ b/src/core/ddsc/src/dds_serdata_builtintopic.c
@@ -73,11 +73,13 @@ static struct ddsi_serdata_builtintopic *serdata_builtin_new(const struct ddsi_s
 static void from_entity_pp (struct ddsi_serdata_builtintopic *d, const struct participant *pp)
 {
   nn_xqos_copy(&d->xqos, &pp->plist->qos);
+  d->pphandle = pp->e.iid;
 }
 
 static void from_entity_proxypp (struct ddsi_serdata_builtintopic *d, const struct proxy_participant *proxypp)
 {
   nn_xqos_copy(&d->xqos, &proxypp->plist->qos);
+  d->pphandle = proxypp->e.iid;
 }
 
 static void set_topic_type_from_sertopic (struct ddsi_serdata_builtintopic *d, const struct ddsi_sertopic *tp)
@@ -96,12 +98,14 @@ static void set_topic_type_from_sertopic (struct ddsi_serdata_builtintopic *d, c
 
 static void from_entity_rd (struct ddsi_serdata_builtintopic *d, const struct reader *rd)
 {
+  d->pphandle = rd->c.pp->e.iid;
   nn_xqos_copy(&d->xqos, rd->xqos);
   set_topic_type_from_sertopic(d, rd->topic);
 }
 
 static void from_entity_prd (struct ddsi_serdata_builtintopic *d, const struct proxy_reader *prd)
 {
+  d->pphandle = prd->c.proxypp->e.iid;
   nn_xqos_copy(&d->xqos, prd->c.xqos);
   assert (d->xqos.present & QP_TOPIC_NAME);
   assert (d->xqos.present & QP_TYPE_NAME);
@@ -109,12 +113,14 @@ static void from_entity_prd (struct ddsi_serdata_builtintopic *d, const struct p
 
 static void from_entity_wr (struct ddsi_serdata_builtintopic *d, const struct writer *wr)
 {
+  d->pphandle = wr->c.pp->e.iid;
   nn_xqos_copy(&d->xqos, wr->xqos);
   set_topic_type_from_sertopic(d, wr->topic);
 }
 
 static void from_entity_pwr (struct ddsi_serdata_builtintopic *d, const struct proxy_writer *pwr)
 {
+  d->pphandle = pwr->c.proxypp->e.iid;
   nn_xqos_copy(&d->xqos, pwr->c.xqos);
   assert (d->xqos.present & QP_TOPIC_NAME);
   assert (d->xqos.present & QP_TYPE_NAME);
@@ -219,6 +225,7 @@ static bool to_sample_endpoint (const struct ddsi_serdata_builtintopic *d, struc
   ppguid = d->key;
   ppguid.entityid.u = NN_ENTITYID_PARTICIPANT;
   convkey (&sample->participant_key, &ppguid);
+  sample->participant_instance_handle = d->pphandle;
   if (d->c.kind == SDK_DATA)
   {
     assert (d->xqos.present & QP_TOPIC_NAME);

From 712ca3149f5521139ec22af834e6a1e1cc89afb8 Mon Sep 17 00:00:00 2001
From: Erik Boasson <eb@ilities.com>
Date: Tue, 16 Apr 2019 10:23:32 +0200
Subject: [PATCH 034/238] move util library into ddsrt

As was the plan with the introduction of ddsrt; this includes renaming
the identifiers to match the capitalization style and removes old junk.

Signed-off-by: Erik Boasson <eb@ilities.com>
---
 docs/dev/modules.md                           |   4 -
 src/CMakeLists.txt                            |   1 -
 src/core/CMakeLists.txt                       |   7 +-
 src/core/ddsc/src/dds__domain.h               |   2 +-
 src/core/ddsc/src/dds__handles.h              |   4 +-
 src/core/ddsc/src/dds__types.h                |  10 +-
 src/core/ddsc/src/dds_domain.c                |  10 +-
 src/core/ddsc/src/dds_handles.c               |  34 +-
 src/core/ddsc/src/dds_init.c                  |   2 +-
 src/core/ddsc/src/dds_reader.c                |   4 +-
 src/core/ddsc/src/dds_rhc.c                   |  50 +-
 src/core/ddsc/src/dds_topic.c                 |  14 +-
 src/core/ddsc/src/dds_whc.c                   | 112 ++---
 src/core/ddsc/src/dds_write.c                 |   4 +-
 .../include/dds/ddsi/ddsi_serdata_default.h   |   2 +-
 .../ddsi/include/dds/ddsi/ddsi_sertopic.h     |   4 +-
 src/core/ddsi/include/dds/ddsi/q_addrset.h    |   6 +-
 src/core/ddsi/include/dds/ddsi/q_entity.h     |  44 +-
 src/core/ddsi/include/dds/ddsi/q_ephash.h     |   4 +-
 src/core/ddsi/include/dds/ddsi/q_globals.h    |   8 +-
 .../include/dds/ddsi/q_inverse_uint32_set.h   |   6 +-
 src/core/ddsi/src/ddsi_mcgroup.c              |  36 +-
 src/core/ddsi/src/ddsi_tcp.c                  |  38 +-
 src/core/ddsi/src/ddsi_tkmap.c                |  24 +-
 src/core/ddsi/src/q_addrset.c                 | 108 ++---
 src/core/ddsi/src/q_config.c                  |  56 +--
 src/core/ddsi/src/q_ddsi_discovery.c          |   4 +-
 src/core/ddsi/src/q_debmon.c                  |  18 +-
 src/core/ddsi/src/q_entity.c                  | 220 ++++-----
 src/core/ddsi/src/q_ephash.c                  |  22 +-
 src/core/ddsi/src/q_init.c                    |  10 +-
 src/core/ddsi/src/q_inverse_uint32_set.c      |  38 +-
 src/core/ddsi/src/q_lease.c                   |  26 +-
 src/core/ddsi/src/q_nwif.c                    |   2 +-
 src/core/ddsi/src/q_plist.c                   |   2 +-
 src/core/ddsi/src/q_radmin.c                  | 172 +++----
 src/core/ddsi/src/q_receive.c                 |  56 +--
 src/core/ddsi/src/q_transmit.c                |  16 +-
 src/core/ddsi/src/q_xevent.c                  |  52 +-
 src/core/ddsi/src/q_xmsg.c                    |   6 +-
 src/core/xtests/CMakeLists.txt                |   2 +-
 src/ddsrt/CMakeLists.txt                      |  15 +
 src/ddsrt/include/dds/ddsrt/avl.h             | 359 ++++++++++++++
 .../include/dds/ddsrt/expand_envvars.h}       |   8 +-
 src/ddsrt/include/dds/ddsrt/fibheap.h         |  54 +++
 src/ddsrt/include/dds/ddsrt/hopscotch.h       | 104 ++++
 .../include/dds/ddsrt/thread_pool.h}          |  26 +-
 src/ddsrt/include/dds/ddsrt/xmlparser.h       |  52 ++
 src/{util/src/ut_avl.c => ddsrt/src/avl.c}    | 452 +++++++++---------
 .../src/expand_envvars.c}                     |  14 +-
 .../src/ut_fibheap.c => ddsrt/src/fibheap.c}  |  92 ++--
 .../ut_hopscotch.c => ddsrt/src/hopscotch.c}  | 310 ++++++------
 .../src/thread_pool.c}                        |  28 +-
 .../ut_xmlparser.c => ddsrt/src/xmlparser.c}  |  74 +--
 src/util/CMakeLists.txt                       |  48 --
 src/util/include/dds/util/ut_avl.h            | 359 --------------
 src/util/include/dds/util/ut_crc.h            |  31 --
 src/util/include/dds/util/ut_fibheap.h        |  54 ---
 src/util/include/dds/util/ut_hopscotch.h      | 110 -----
 src/util/include/dds/util/ut_xmlparser.h      |  52 --
 src/util/src/ut_crc.c                         |  74 ---
 src/util/tests/CMakeLists.txt                 |  15 -
 62 files changed, 1702 insertions(+), 1869 deletions(-)
 create mode 100644 src/ddsrt/include/dds/ddsrt/avl.h
 rename src/{util/include/dds/util/ut_expand_envvars.h => ddsrt/include/dds/ddsrt/expand_envvars.h} (78%)
 create mode 100644 src/ddsrt/include/dds/ddsrt/fibheap.h
 create mode 100644 src/ddsrt/include/dds/ddsrt/hopscotch.h
 rename src/{util/include/dds/util/ut_thread_pool.h => ddsrt/include/dds/ddsrt/thread_pool.h} (69%)
 create mode 100644 src/ddsrt/include/dds/ddsrt/xmlparser.h
 rename src/{util/src/ut_avl.c => ddsrt/src/avl.c} (52%)
 rename src/{util/src/ut_expand_envvars.c => ddsrt/src/expand_envvars.c} (93%)
 rename src/{util/src/ut_fibheap.c => ddsrt/src/fibheap.c} (68%)
 rename src/{util/src/ut_hopscotch.c => ddsrt/src/hopscotch.c} (67%)
 rename src/{util/src/ut_thread_pool.c => ddsrt/src/thread_pool.c} (88%)
 rename src/{util/src/ut_xmlparser.c => ddsrt/src/xmlparser.c} (89%)
 delete mode 100644 src/util/CMakeLists.txt
 delete mode 100644 src/util/include/dds/util/ut_avl.h
 delete mode 100644 src/util/include/dds/util/ut_crc.h
 delete mode 100644 src/util/include/dds/util/ut_fibheap.h
 delete mode 100644 src/util/include/dds/util/ut_hopscotch.h
 delete mode 100644 src/util/include/dds/util/ut_xmlparser.h
 delete mode 100644 src/util/src/ut_crc.c
 delete mode 100644 src/util/tests/CMakeLists.txt

diff --git a/docs/dev/modules.md b/docs/dev/modules.md
index 721c7a7..435516c 100644
--- a/docs/dev/modules.md
+++ b/docs/dev/modules.md
@@ -22,10 +22,6 @@ but does offer a neat way to separate features logically.
      |   |  ddsi   |  RTPS-DDSI specification.
      |   |         |
      |   |---------|
-     |   |         |  util is a collection of snippets that do not require
-     |   |  util   |  per-target implementations and may be used by the ddsc
-     |   |         |  and ddsi targets. util will be merged into ddsrt.
-     |   |---------|
      |             |  ddsrt offers target agnostic implementations of
      |      ddsrt  |  functionality required by the ddsc and ddsi targets, but
      |             |  also exports a subset of the dds\_ api directly. e.g.
diff --git a/src/CMakeLists.txt b/src/CMakeLists.txt
index 52a062e..cc63136 100644
--- a/src/CMakeLists.txt
+++ b/src/CMakeLists.txt
@@ -173,7 +173,6 @@ set(CMAKE_ARCHIVE_OUTPUT_DIRECTORY "${CMAKE_BINARY_DIR}/lib")
 add_subdirectory(idlc)
 add_subdirectory(ddsrt)
 add_subdirectory(etc)
-add_subdirectory(util)
 add_subdirectory(core)
 add_subdirectory(tools)
 add_subdirectory(scripts)
diff --git a/src/core/CMakeLists.txt b/src/core/CMakeLists.txt
index 071d6e6..8f36723 100644
--- a/src/core/CMakeLists.txt
+++ b/src/core/CMakeLists.txt
@@ -50,16 +50,13 @@ endif()
 include(ddsi/CMakeLists.txt)
 include(ddsc/CMakeLists.txt)
 
-target_link_libraries(ddsc PRIVATE util)
 target_link_libraries(ddsc PRIVATE ddsrt)
 target_compile_definitions(
   ddsc PUBLIC
-  $<BUILD_INTERFACE:$<TARGET_PROPERTY:ddsrt,INTERFACE_COMPILE_DEFINITIONS>>
-  $<BUILD_INTERFACE:$<TARGET_PROPERTY:util,INTERFACE_COMPILE_DEFINITIONS>>)
+  $<BUILD_INTERFACE:$<TARGET_PROPERTY:ddsrt,INTERFACE_COMPILE_DEFINITIONS>>)
 target_include_directories(
   ddsc PUBLIC
-  $<BUILD_INTERFACE:$<TARGET_PROPERTY:ddsrt,INTERFACE_INCLUDE_DIRECTORIES>>
-  $<BUILD_INTERFACE:$<TARGET_PROPERTY:util,INTERFACE_INCLUDE_DIRECTORIES>>)
+  $<BUILD_INTERFACE:$<TARGET_PROPERTY:ddsrt,INTERFACE_INCLUDE_DIRECTORIES>>)
 
 # SOVERSION should increase on incompatible ABI change
 set_target_properties(ddsc PROPERTIES VERSION ${PROJECT_VERSION} SOVERSION ${PROJECT_VERSION_MAJOR})
diff --git a/src/core/ddsc/src/dds__domain.h b/src/core/ddsc/src/dds__domain.h
index d136184..0b13070 100644
--- a/src/core/ddsc/src/dds__domain.h
+++ b/src/core/ddsc/src/dds__domain.h
@@ -18,7 +18,7 @@
 extern "C" {
 #endif
 
-extern DDS_EXPORT const ut_avlTreedef_t dds_domaintree_def;
+extern DDS_EXPORT const ddsrt_avl_treedef_t dds_domaintree_def;
 
 DDS_EXPORT dds_domain * dds_domain_create (dds_domainid_t id);
 DDS_EXPORT void dds_domain_free (dds_domain * domain);
diff --git a/src/core/ddsc/src/dds__handles.h b/src/core/ddsc/src/dds__handles.h
index 7ceee26..c13bc59 100644
--- a/src/core/ddsc/src/dds__handles.h
+++ b/src/core/ddsc/src/dds__handles.h
@@ -94,9 +94,9 @@ dds_handle_server_fini(void);
  * user data.
  *
  * A kind value != 0 has to be provided, just to make sure that no 0 handles
- * will be created. It should also fit the UT_HANDLE_KIND_MASK.
+ * will be created. It should also fit the DDSRT_HANDLE_KIND_MASK.
  * In other words handle creation will fail if
- * ((kind & ~UT_HANDLE_KIND_MASK != 0) || (kind & UT_HANDLE_KIND_MASK == 0)).
+ * ((kind & ~DDSRT_HANDLE_KIND_MASK != 0) || (kind & DDSRT_HANDLE_KIND_MASK == 0)).
  *
  * It has to do something clever to make sure that a deleted handle is not
  * re-issued very quickly after it was deleted.
diff --git a/src/core/ddsc/src/dds__types.h b/src/core/ddsc/src/dds__types.h
index 187aee4..61c7c57 100644
--- a/src/core/ddsc/src/dds__types.h
+++ b/src/core/ddsc/src/dds__types.h
@@ -17,7 +17,7 @@
 #include "dds/dds.h"
 #include "dds/ddsrt/sync.h"
 #include "dds/ddsi/q_rtps.h"
-#include "dds/util/ut_avl.h"
+#include "dds/ddsrt/avl.h"
 #include "dds__handles.h"
 
 #if defined (__cplusplus)
@@ -94,9 +94,9 @@ struct dds_listener {
 
 typedef struct dds_domain
 {
-  ut_avlNode_t m_node;
+  ddsrt_avl_node_t m_node;
   dds_domainid_t m_id;
-  ut_avlTree_t m_topics;
+  ddsrt_avl_tree_t m_topics;
   uint32_t m_refc;
 }
 dds_domain;
@@ -151,7 +151,7 @@ typedef struct dds_entity
 }
 dds_entity;
 
-extern const ut_avlTreedef_t dds_topictree_def;
+extern const ddsrt_avl_treedef_t dds_topictree_def;
 
 typedef struct dds_subscriber
 {
@@ -283,7 +283,7 @@ typedef struct dds_globals
   int (*m_dur_wait) (struct dds_reader * reader, dds_duration_t timeout);
   void (*m_dur_init) (void);
   void (*m_dur_fini) (void);
-  ut_avlTree_t m_domains;
+  ddsrt_avl_tree_t m_domains;
   ddsrt_mutex_t m_mutex;
 }
 dds_globals;
diff --git a/src/core/ddsc/src/dds_domain.c b/src/core/ddsc/src/dds_domain.c
index f2dfaa4..b8c12d8 100644
--- a/src/core/ddsc/src/dds_domain.c
+++ b/src/core/ddsc/src/dds_domain.c
@@ -17,7 +17,7 @@ static int dds_domain_compare (const int32_t * a, const int32_t * b)
   return (*a == *b) ? 0 : (*a < *b) ? -1 : 1;
 }
 
-const ut_avlTreedef_t dds_domaintree_def = UT_AVL_TREEDEF_INITIALIZER
+const ddsrt_avl_treedef_t dds_domaintree_def = DDSRT_AVL_TREEDEF_INITIALIZER
 (
   offsetof (dds_domain, m_node),
   offsetof (dds_domain, m_id),
@@ -27,7 +27,7 @@ const ut_avlTreedef_t dds_domaintree_def = UT_AVL_TREEDEF_INITIALIZER
 
 dds_domain * dds_domain_find_locked (dds_domainid_t id)
 {
-  return ut_avlLookup (&dds_domaintree_def, &dds_global.m_domains, &id);
+  return ddsrt_avl_lookup (&dds_domaintree_def, &dds_global.m_domains, &id);
 }
 
 dds_domain * dds_domain_create (dds_domainid_t id)
@@ -39,8 +39,8 @@ dds_domain * dds_domain_create (dds_domainid_t id)
   {
     domain = dds_alloc (sizeof (*domain));
     domain->m_id = id;
-    ut_avlInit (&dds_topictree_def, &domain->m_topics);
-    ut_avlInsert (&dds_domaintree_def, &dds_global.m_domains, domain);
+    ddsrt_avl_init (&dds_topictree_def, &domain->m_topics);
+    ddsrt_avl_insert (&dds_domaintree_def, &dds_global.m_domains, domain);
   }
   domain->m_refc++;
   ddsrt_mutex_unlock (&dds_global.m_mutex);
@@ -52,7 +52,7 @@ void dds_domain_free (dds_domain * domain)
   ddsrt_mutex_lock (&dds_global.m_mutex);
   if (--domain->m_refc == 0)
   {
-    ut_avlDelete (&dds_domaintree_def, &dds_global.m_domains, domain);
+    ddsrt_avl_delete (&dds_domaintree_def, &dds_global.m_domains, domain);
     dds_free (domain);
   }
   ddsrt_mutex_unlock (&dds_global.m_mutex);
diff --git a/src/core/ddsc/src/dds_handles.c b/src/core/ddsc/src/dds_handles.c
index 560e661..dd509dd 100644
--- a/src/core/ddsc/src/dds_handles.c
+++ b/src/core/ddsc/src/dds_handles.c
@@ -15,7 +15,7 @@
 #include "dds/ddsrt/sync.h"
 #include "dds/ddsrt/heap.h"
 #include "dds/ddsrt/random.h"
-#include "dds/util/ut_hopscotch.h"
+#include "dds/ddsrt/hopscotch.h"
 #include "dds/ddsi/q_thread.h"
 #include "dds__handles.h"
 #include "dds__types.h"
@@ -40,9 +40,9 @@
 
 struct dds_handle_server {
 #if USE_CHH
-  struct ut_chh *ht;
+  struct ddsrt_chh *ht;
 #else
-  struct ut_hh *ht;
+  struct ddsrt_hh *ht;
 #endif
   size_t count;
   ddsrt_mutex_t lock;
@@ -68,9 +68,9 @@ static int handle_equal (const void *va, const void *vb)
 dds_return_t dds_handle_server_init (void (*free_via_gc) (void *x))
 {
 #if USE_CHH
-  handles.ht = ut_chhNew (128, handle_hash, handle_equal, free_via_gc);
+  handles.ht = ddsrt_chh_new (128, handle_hash, handle_equal, free_via_gc);
 #else
-  handles.ht = ut_hhNew (128, handle_hash, handle_equal);
+  handles.ht = ddsrt_hh_new (128, handle_hash, handle_equal);
   (void) free_via_gc;
 #endif
   handles.count = 0;
@@ -83,16 +83,16 @@ void dds_handle_server_fini (void)
 {
 #if USE_CHH
 #ifndef NDEBUG
-  struct ut_chhIter it;
-  assert (ut_chhIterFirst (handles.ht, &it) == NULL);
+  struct ddsrt_chh_iter it;
+  assert (ddsrt_chh_iter_first (handles.ht, &it) == NULL);
 #endif
-  ut_chhFree (handles.ht);
+  ddsrt_chh_free (handles.ht);
 #else /* USE_CHH */
 #ifndef NDEBUG
-  struct ut_hhIter it;
-  assert (ut_hhIterFirst (handles.ht, &it) == NULL);
+  struct ddsrt_hh_iter it;
+  assert (ddsrt_hh_iter_first (handles.ht, &it) == NULL);
 #endif
-  ut_hhFree (handles.ht);
+  ddsrt_hh_free (handles.ht);
 #endif /* USE_CHH */
   ddsrt_cond_destroy (&handles.cond);
   ddsrt_mutex_destroy (&handles.lock);
@@ -100,9 +100,9 @@ void dds_handle_server_fini (void)
 }
 
 #if USE_CHH
-static bool hhadd (struct ut_chh *ht, void *elem) { return ut_chhAdd (ht, elem); }
+static bool hhadd (struct ddsrt_chh *ht, void *elem) { return ddsrt_chh_add (ht, elem); }
 #else
-static bool hhadd (struct ut_hh *ht, void *elem) { return ut_hhAdd (ht, elem); }
+static bool hhadd (struct ddsrt_hh *ht, void *elem) { return ddsrt_hh_add (ht, elem); }
 #endif
 static dds_handle_t dds_handle_create_int (struct dds_handle_link *link)
 {
@@ -176,10 +176,10 @@ int32_t dds_handle_delete (struct dds_handle_link *link, dds_duration_t timeout)
   }
 #if USE_CHH
   thread_state_awake (ts1);
-  int x = ut_chhRemove (handles.ht, link);
+  int x = ddsrt_chh_remove (handles.ht, link);
   thread_state_asleep (ts1);
 #else
-  int x = ut_hhRemove (handles.ht, link);
+  int x = ddsrt_hh_remove (handles.ht, link);
 #endif
   assert(x);
   (void)x;
@@ -209,10 +209,10 @@ int32_t dds_handle_claim (dds_handle_t hdl, struct dds_handle_link **link)
 
 #if USE_CHH
   thread_state_awake (ts1);
-  *link = ut_chhLookup (handles.ht, &dummy);
+  *link = ddsrt_chh_lookup (handles.ht, &dummy);
 #else
   ddsrt_mutex_lock (&handles.lock);
-  *link = ut_hhLookup (handles.ht, &dummy);
+  *link = ddsrt_hh_lookup (handles.ht, &dummy);
 #endif
   if (*link == NULL)
     rc = DDS_RETCODE_BAD_PARAMETER;
diff --git a/src/core/ddsc/src/dds_init.c b/src/core/ddsc/src/dds_init.c
index e6558d5..d51bfb0 100644
--- a/src/core/ddsc/src/dds_init.c
+++ b/src/core/ddsc/src/dds_init.c
@@ -123,7 +123,7 @@ dds_init(dds_domainid_t domain)
   }
 
   upgrade_main_thread();
-  ut_avlInit(&dds_domaintree_def, &dds_global.m_domains);
+  ddsrt_avl_init(&dds_domaintree_def, &dds_global.m_domains);
 
   /* Start monitoring the liveliness of all threads. */
   if (!config.liveliness_monitoring)
diff --git a/src/core/ddsc/src/dds_reader.c b/src/core/ddsc/src/dds_reader.c
index b039495..10951e2 100644
--- a/src/core/ddsc/src/dds_reader.c
+++ b/src/core/ddsc/src/dds_reader.c
@@ -532,14 +532,14 @@ void dds_reader_ddsi2direct (dds_entity_t entity, ddsi2direct_directread_cb_t cb
 
   rd->ddsi2direct_cb = cb;
   rd->ddsi2direct_cbarg = cbarg;
-  while ((m = ut_avlLookupSuccEq (&rd_writers_treedef, &rd->writers, &pwrguid)) != NULL)
+  while ((m = ddsrt_avl_lookup_succ_eq (&rd_writers_treedef, &rd->writers, &pwrguid)) != NULL)
   {
     /* have to be careful walking the tree -- pretty is different, but
      I want to check this before I write a lookup_succ function. */
     struct rd_pwr_match *m_next;
     nn_guid_t pwrguid_next;
     pwrguid = m->pwr_guid;
-    if ((m_next = ut_avlFindSucc (&rd_writers_treedef, &rd->writers, m)) != NULL)
+    if ((m_next = ddsrt_avl_find_succ (&rd_writers_treedef, &rd->writers, m)) != NULL)
       pwrguid_next = m_next->pwr_guid;
     else
     {
diff --git a/src/core/ddsc/src/dds_rhc.c b/src/core/ddsc/src/dds_rhc.c
index 4eb64dc..74133c0 100644
--- a/src/core/ddsc/src/dds_rhc.c
+++ b/src/core/ddsc/src/dds_rhc.c
@@ -27,8 +27,8 @@
 #include "dds__reader.h"
 #include "dds__rhc.h"
 #include "dds/ddsi/ddsi_tkmap.h"
-#include "dds/util/ut_hopscotch.h"
-#include "dds/util/ut_avl.h"
+#include "dds/ddsrt/hopscotch.h"
+#include "dds/ddsrt/avl.h"
 #include "dds/ddsi/q_xqos.h"
 #include "dds/ddsi/q_error.h"
 #include "dds/ddsi/q_unused.h"
@@ -174,7 +174,7 @@ struct lwreg
 
 struct lwregs
 {
-  struct ut_ehh * regs;
+  struct ddsrt_ehh * regs;
 };
 
 static uint32_t lwreg_hash (const void *vl)
@@ -192,36 +192,36 @@ static int lwreg_equals (const void *va, const void *vb)
 
 static void lwregs_init (struct lwregs *rt)
 {
-  rt->regs = ut_ehhNew (sizeof (struct lwreg), 1, lwreg_hash, lwreg_equals);
+  rt->regs = ddsrt_ehh_new (sizeof (struct lwreg), 1, lwreg_hash, lwreg_equals);
 }
 
 static void lwregs_fini (struct lwregs *rt)
 {
-  ut_ehhFree (rt->regs);
+  ddsrt_ehh_free (rt->regs);
 }
 
 static int lwregs_contains (struct lwregs *rt, uint64_t iid, uint64_t wr_iid)
 {
   struct lwreg dummy = { .iid = iid, .wr_iid = wr_iid };
-  return ut_ehhLookup (rt->regs, &dummy) != NULL;
+  return ddsrt_ehh_lookup (rt->regs, &dummy) != NULL;
 }
 
 static int lwregs_add (struct lwregs *rt, uint64_t iid, uint64_t wr_iid)
 {
   struct lwreg dummy = { .iid = iid, .wr_iid = wr_iid };
-  return ut_ehhAdd (rt->regs, &dummy);
+  return ddsrt_ehh_add (rt->regs, &dummy);
 }
 
 static int lwregs_delete (struct lwregs *rt, uint64_t iid, uint64_t wr_iid)
 {
   struct lwreg dummy = { .iid = iid, .wr_iid = wr_iid };
-  return ut_ehhRemove (rt->regs, &dummy);
+  return ddsrt_ehh_remove (rt->regs, &dummy);
 }
 
 void lwregs_dump (struct lwregs *rt)
 {
-  struct ut_ehhIter it;
-  for (struct lwreg *r = ut_ehhIterFirst(rt->regs, &it); r; r = ut_ehhIterNext(&it))
+  struct ddsrt_ehh_iter it;
+  for (struct lwreg *r = ddsrt_ehh_iter_first(rt->regs, &it); r; r = ddsrt_ehh_iter_next(&it))
     printf("iid=%"PRIu64" wr_iid=%"PRIu64"\n", r->iid, r->wr_iid);
 }
 
@@ -271,7 +271,7 @@ typedef enum rhc_store_result {
 } rhc_store_result_t;
 
 struct rhc {
-  struct ut_hh *instances;
+  struct ddsrt_hh *instances;
   struct rhc_instance *nonempty_instances; /* circular, points to most recently added one, NULL if none */
   struct lwregs registrations;       /* should be a global one (with lock-free lookups) */
 
@@ -458,7 +458,7 @@ struct rhc * dds_rhc_new (dds_reader * reader, const struct ddsi_sertopic * topi
 
   lwregs_init (&rhc->registrations);
   ddsrt_mutex_init (&rhc->lock);
-  rhc->instances = ut_hhNew (1, instance_iid_hash, instance_iid_eq);
+  rhc->instances = ddsrt_hh_new (1, instance_iid_hash, instance_iid_eq);
   rhc->topic = topic;
   rhc->reader = reader;
 
@@ -620,9 +620,9 @@ static void free_instance_rhc_free_wrap (void *vnode, void *varg)
 void dds_rhc_free (struct rhc *rhc)
 {
   assert (rhc_check_counts_locked (rhc, true, true));
-  ut_hhEnum (rhc->instances, free_instance_rhc_free_wrap, rhc);
+  ddsrt_hh_enum (rhc->instances, free_instance_rhc_free_wrap, rhc);
   assert (rhc->nonempty_instances == NULL);
-  ut_hhFree (rhc->instances);
+  ddsrt_hh_free (rhc->instances);
   lwregs_fini (&rhc->registrations);
   if (rhc->qcond_eval_samplebuf != NULL)
     ddsi_sertopic_free_sample (rhc->topic, rhc->qcond_eval_samplebuf, DDS_FREE_ALL);
@@ -848,7 +848,7 @@ static void drop_instance_noupdate_no_writers (struct rhc *rhc, struct rhc_insta
 
   rhc->n_instances--;
 
-  ret = ut_hhRemove (rhc->instances, inst);
+  ret = ddsrt_hh_remove (rhc->instances, inst);
   assert (ret);
   (void) ret;
 
@@ -1198,7 +1198,7 @@ static rhc_store_result_t rhc_store_new_instance (struct rhc_instance **out_inst
   }
 
   account_for_empty_to_nonempty_transition (rhc, inst);
-  ret = ut_hhAdd (rhc->instances, inst);
+  ret = ddsrt_hh_add (rhc->instances, inst);
   assert (ret);
   (void) ret;
   rhc->n_instances++;
@@ -1248,7 +1248,7 @@ bool dds_rhc_store (struct rhc * __restrict rhc, const struct proxy_writer_info
 
   ddsrt_mutex_lock (&rhc->lock);
 
-  inst = ut_hhLookup (rhc->instances, &dummy_instance);
+  inst = ddsrt_hh_lookup (rhc->instances, &dummy_instance);
   if (inst == NULL)
   {
     /* New instance for this reader.  If no data content -- not (also)
@@ -1492,13 +1492,13 @@ void dds_rhc_unregister_wr (struct rhc * __restrict rhc, const struct proxy_writ
   bool trigger_waitsets = false;
   bool notify_data_available = false;
   struct rhc_instance *inst;
-  struct ut_hhIter iter;
+  struct ddsrt_hh_iter iter;
   const uint64_t wr_iid = pwr_info->iid;
   const int auto_dispose = pwr_info->auto_dispose;
 
   ddsrt_mutex_lock (&rhc->lock);
   TRACE ("rhc_unregister_wr_iid(%"PRIx64",%d:\n", wr_iid, auto_dispose);
-  for (inst = ut_hhIterFirst (rhc->instances, &iter); inst; inst = ut_hhIterNext (&iter))
+  for (inst = ddsrt_hh_iter_first (rhc->instances, &iter); inst; inst = ddsrt_hh_iter_next (&iter))
   {
     if ((inst->wr_iid_islive && inst->wr_iid == wr_iid) || lwregs_contains (&rhc->registrations, inst->iid, wr_iid))
     {
@@ -1558,10 +1558,10 @@ void dds_rhc_unregister_wr (struct rhc * __restrict rhc, const struct proxy_writ
 void dds_rhc_relinquish_ownership (struct rhc * __restrict rhc, const uint64_t wr_iid)
 {
   struct rhc_instance *inst;
-  struct ut_hhIter iter;
+  struct ddsrt_hh_iter iter;
   ddsrt_mutex_lock (&rhc->lock);
   TRACE ("rhc_relinquish_ownership(%"PRIx64":\n", wr_iid);
-  for (inst = ut_hhIterFirst (rhc->instances, &iter); inst; inst = ut_hhIterNext (&iter))
+  for (inst = ddsrt_hh_iter_first (rhc->instances, &iter); inst; inst = ddsrt_hh_iter_next (&iter))
   {
     if (inst->wr_iid_islive && inst->wr_iid == wr_iid)
     {
@@ -2234,7 +2234,7 @@ bool dds_rhc_add_readcondition (dds_readcond *cond)
      between those attached to a waitset or not. */
 
   struct rhc *rhc = cond->m_rhc;
-  struct ut_hhIter it;
+  struct ddsrt_hh_iter it;
 
   assert ((dds_entity_kind (&cond->m_entity) == DDS_KIND_COND_READ && cond->m_query.m_filter == 0) ||
           (dds_entity_kind (&cond->m_entity) == DDS_KIND_COND_QUERY && cond->m_query.m_filter != 0));
@@ -2296,7 +2296,7 @@ bool dds_rhc_add_readcondition (dds_readcond *cond)
        samples, except for those that match the predicate. */
     const dds_querycond_mask_t qcmask = cond->m_query.m_qcmask;
     uint32_t trigger = 0;
-    for (struct rhc_instance *inst = ut_hhIterFirst (rhc->instances, &it); inst != NULL; inst = ut_hhIterNext (&it))
+    for (struct rhc_instance *inst = ddsrt_hh_iter_first (rhc->instances, &it); inst != NULL; inst = ddsrt_hh_iter_next (&it))
     {
       const bool instmatch = eval_predicate_invsample (rhc, inst, cond->m_query.m_filter);;
       uint32_t matches = 0;
@@ -2612,7 +2612,7 @@ static int rhc_check_counts_locked (struct rhc *rhc, bool check_conds, bool chec
   unsigned cond_match_count[CHECK_MAX_CONDS];
   dds_querycond_mask_t enabled_qcmask = 0;
   struct rhc_instance *inst;
-  struct ut_hhIter iter;
+  struct ddsrt_hh_iter iter;
   dds_readcond *rciter;
   uint32_t i;
 
@@ -2628,7 +2628,7 @@ static int rhc_check_counts_locked (struct rhc *rhc, bool check_conds, bool chec
     enabled_qcmask |= rciter->m_query.m_qcmask;
   }
 
-  for (inst = ut_hhIterFirst (rhc->instances, &iter); inst; inst = ut_hhIterNext (&iter))
+  for (inst = ddsrt_hh_iter_first (rhc->instances, &iter); inst; inst = ddsrt_hh_iter_next (&iter))
   {
     unsigned n_vsamples_in_instance = 0, n_read_vsamples_in_instance = 0;
     bool a_sample_free = true;
diff --git a/src/core/ddsc/src/dds_topic.c b/src/core/ddsc/src/dds_topic.c
index 1561afd..636c4ae 100644
--- a/src/core/ddsc/src/dds_topic.c
+++ b/src/core/ddsc/src/dds_topic.c
@@ -32,7 +32,7 @@ DECL_ENTITY_LOCK_UNLOCK(extern inline, dds_topic)
 #define DDS_TOPIC_STATUS_MASK                                    \
                         DDS_INCONSISTENT_TOPIC_STATUS
 
-const ut_avlTreedef_t dds_topictree_def = UT_AVL_TREEDEF_INITIALIZER_INDKEY
+const ddsrt_avl_treedef_t dds_topictree_def = DDSRT_AVL_TREEDEF_INITIALIZER_INDKEY
 (
   offsetof (struct ddsi_sertopic, avlnode),
   offsetof (struct ddsi_sertopic, name_typename),
@@ -118,17 +118,17 @@ dds_topic_lookup_locked(
         const char *name)
 {
     struct ddsi_sertopic *st = NULL;
-    ut_avlIter_t iter;
+    ddsrt_avl_iter_t iter;
 
     assert (domain);
     assert (name);
 
-    st = ut_avlIterFirst (&dds_topictree_def, &domain->m_topics, &iter);
+    st = ddsrt_avl_iter_first (&dds_topictree_def, &domain->m_topics, &iter);
     while (st) {
         if (strcmp (st->name, name) == 0) {
             break;
         }
-        st = ut_avlIterNext (&iter);
+        st = ddsrt_avl_iter_next (&iter);
     }
     return st;
 }
@@ -155,9 +155,9 @@ dds_topic_free(
     assert (st);
 
     ddsrt_mutex_lock (&dds_global.m_mutex);
-    domain = ut_avlLookup (&dds_domaintree_def, &dds_global.m_domains, &domainid);
+    domain = ddsrt_avl_lookup (&dds_domaintree_def, &dds_global.m_domains, &domainid);
     if (domain != NULL) {
-        ut_avlDelete (&dds_topictree_def, &domain->m_topics, st);
+        ddsrt_avl_delete (&dds_topictree_def, &domain->m_topics, st);
     }
     ddsrt_mutex_unlock (&dds_global.m_mutex);
     st->status_cb_entity = NULL;
@@ -172,7 +172,7 @@ dds_topic_add_locked(
     dds_domain * dom;
     dom = dds_domain_find_locked (id);
     assert (dom);
-    ut_avlInsert (&dds_topictree_def, &dom->m_topics, st);
+    ddsrt_avl_insert (&dds_topictree_def, &dom->m_topics, st);
 }
 
 DDS_EXPORT dds_entity_t
diff --git a/src/core/ddsc/src/dds_whc.c b/src/core/ddsc/src/dds_whc.c
index 1301ef9..5408c69 100644
--- a/src/core/ddsc/src/dds_whc.c
+++ b/src/core/ddsc/src/dds_whc.c
@@ -22,8 +22,8 @@
 #include "dds__whc.h"
 #include "dds/ddsi/ddsi_tkmap.h"
 
-#include "dds/util/ut_avl.h"
-#include "dds/util/ut_hopscotch.h"
+#include "dds/ddsrt/avl.h"
+#include "dds/ddsrt/hopscotch.h"
 #include "dds/ddsi/q_time.h"
 #include "dds/ddsi/q_rtps.h"
 #include "dds/ddsi/q_freelist.h"
@@ -47,7 +47,7 @@ struct whc_node {
 };
 
 struct whc_intvnode {
-  ut_avlNode_t avlnode;
+  ddsrt_avl_node_t avlnode;
   seqno_t min;
   seqno_t maxp1;
   struct whc_node *first; /* linked list of seqs with contiguous sequence numbers [min,maxp1) */
@@ -89,12 +89,12 @@ struct whc_impl {
   struct whc_node *maxseq_node; /* NULL if empty; if not in open_intv, open_intv is empty */
   struct nn_freelist freelist; /* struct whc_node *; linked via whc_node::next_seq */
 #if USE_EHH
-  struct ut_ehh *seq_hash;
+  struct ddsrt_ehh *seq_hash;
 #else
-  struct ut_hh *seq_hash;
+  struct ddsrt_hh *seq_hash;
 #endif
-  struct ut_hh *idx_hash;
-  ut_avlTree_t seq;
+  struct ddsrt_hh *idx_hash;
+  ddsrt_avl_tree_t seq;
 };
 
 struct whc_sample_iter_impl {
@@ -140,8 +140,8 @@ static void whc_default_sample_iter_init (const struct whc *whc, struct whc_samp
 static bool whc_default_sample_iter_borrow_next (struct whc_sample_iter *opaque_it, struct whc_borrowed_sample *sample);
 static void whc_default_free (struct whc *whc);
 
-static const ut_avlTreedef_t whc_seq_treedef =
-  UT_AVL_TREEDEF_INITIALIZER (offsetof (struct whc_intvnode, avlnode), offsetof (struct whc_intvnode, min), compare_seq, 0);
+static const ddsrt_avl_treedef_t whc_seq_treedef =
+  DDSRT_AVL_TREEDEF_INITIALIZER (offsetof (struct whc_intvnode, avlnode), offsetof (struct whc_intvnode, min), compare_seq, 0);
 
 static const struct whc_ops whc_ops = {
   .insert = whc_default_insert,
@@ -225,7 +225,7 @@ static struct whc_node *whc_findmax_procedurally (const struct whc_impl *whc)
   }
   else
   {
-    struct whc_intvnode *intv = ut_avlFindPred (&whc_seq_treedef, &whc->seq, whc->open_intv);
+    struct whc_intvnode *intv = ddsrt_avl_find_pred (&whc_seq_treedef, &whc->seq, whc->open_intv);
     assert (intv && intv->first);
     return intv->last;
   }
@@ -239,8 +239,8 @@ static void check_whc (const struct whc_impl *whc)
      contiguous; all samples in seq & in seqhash; tlidx \subseteq seq;
      seq-number ordered list correct; &c. */
   assert (whc->open_intv != NULL);
-  assert (whc->open_intv == ut_avlFindMax (&whc_seq_treedef, &whc->seq));
-  assert (ut_avlFindSucc (&whc_seq_treedef, &whc->seq, whc->open_intv) == NULL);
+  assert (whc->open_intv == ddsrt_avl_find_max (&whc_seq_treedef, &whc->seq));
+  assert (ddsrt_avl_find_succ (&whc_seq_treedef, &whc->seq, whc->open_intv) == NULL);
   if (whc->maxseq_node)
   {
     assert (whc->maxseq_node->next_seq == NULL);
@@ -264,7 +264,7 @@ static void check_whc (const struct whc_impl *whc)
     struct whc_intvnode *firstintv;
     struct whc_node *cur;
     seqno_t prevseq = 0;
-    firstintv = ut_avlFindMin (&whc_seq_treedef, &whc->seq);
+    firstintv = ddsrt_avl_find_min (&whc_seq_treedef, &whc->seq);
     assert (firstintv);
     cur = firstintv->first;
     while (cur)
@@ -283,10 +283,10 @@ static void insert_whcn_in_hash (struct whc_impl *whc, struct whc_node *whcn)
   /* precondition: whcn is not in hash */
 #if USE_EHH
   struct whc_seq_entry e = { .seq = whcn->seq, .whcn = whcn };
-  if (!ut_ehhAdd (whc->seq_hash, &e))
+  if (!ddsrt_ehh_add (whc->seq_hash, &e))
     assert(0);
 #else
-  if (!ut_hhAdd (whc->seq_hash, whcn))
+  if (!ddsrt_hh_add (whc->seq_hash, whcn))
     assert(0);
 #endif
 }
@@ -296,10 +296,10 @@ static void remove_whcn_from_hash (struct whc_impl *whc, struct whc_node *whcn)
   /* precondition: whcn is in hash */
 #if USE_EHH
   struct whc_seq_entry e = { .seq = whcn->seq };
-  if (!ut_ehhRemove(whc->seq_hash, &e))
+  if (!ddsrt_ehh_remove(whc->seq_hash, &e))
     assert(0);
 #else
-  if (!ut_hhRemove(whc->seq_hash, whcn))
+  if (!ddsrt_hh_remove(whc->seq_hash, whcn))
     assert(0);
 #endif
 }
@@ -308,14 +308,14 @@ static struct whc_node *whc_findseq (const struct whc_impl *whc, seqno_t seq)
 {
 #if USE_EHH
   struct whc_seq_entry e = { .seq = seq }, *r;
-  if ((r = ut_ehhLookup(whc->seq_hash, &e)) != NULL)
+  if ((r = ddsrt_ehh_lookup(whc->seq_hash, &e)) != NULL)
     return r->whcn;
   else
     return NULL;
 #else
   struct whc_node template;
   template.seq = seq;
-  return ut_hhLookup(whc->seq_hash, &template);
+  return ddsrt_hh_lookup(whc->seq_hash, &template);
 #endif
 }
 
@@ -328,7 +328,7 @@ static struct whc_node *whc_findkey (const struct whc_impl *whc, const struct dd
   struct whc_idxnode *n;
   check_whc (whc);
   template.idxn.iid = ddsi_tkmap_lookup(gv.m_tkmap, serdata_key);
-  n = ut_hhLookup (whc->idx_hash, &template.idxn);
+  n = ddsrt_hh_lookup (whc->idx_hash, &template.idxn);
   if (n == NULL)
     return NULL;
   else
@@ -359,22 +359,22 @@ struct whc *whc_new (int is_transient_local, unsigned hdepth, unsigned tldepth)
   whc->total_bytes = 0;
   whc->sample_overhead = sample_overhead;
 #if USE_EHH
-  whc->seq_hash = ut_ehhNew (sizeof (struct whc_seq_entry), 32, whc_seq_entry_hash, whc_seq_entry_eq);
+  whc->seq_hash = ddsrt_ehh_new (sizeof (struct whc_seq_entry), 32, whc_seq_entry_hash, whc_seq_entry_eq);
 #else
-  whc->seq_hash = ut_hhNew(32, whc_node_hash, whc_node_eq);
+  whc->seq_hash = ddsrt_hh_new(32, whc_node_hash, whc_node_eq);
 #endif
 
   if (whc->idxdepth > 0)
-    whc->idx_hash = ut_hhNew(32, whc_idxnode_hash_key, whc_idxnode_eq_key);
+    whc->idx_hash = ddsrt_hh_new(32, whc_idxnode_hash_key, whc_idxnode_eq_key);
   else
     whc->idx_hash = NULL;
 
   /* seq interval tree: always has an "open" node */
-  ut_avlInit (&whc_seq_treedef, &whc->seq);
+  ddsrt_avl_init (&whc_seq_treedef, &whc->seq);
   intv = ddsrt_malloc (sizeof (*intv));
   intv->min = intv->maxp1 = 1;
   intv->first = intv->last = NULL;
-  ut_avlInsert (&whc_seq_treedef, &whc->seq, intv);
+  ddsrt_avl_insert (&whc_seq_treedef, &whc->seq, intv);
   whc->open_intv = intv;
   whc->maxseq_node = NULL;
 
@@ -402,11 +402,11 @@ void whc_default_free (struct whc *whc_generic)
 
   if (whc->idx_hash)
   {
-    struct ut_hhIter it;
+    struct ddsrt_hh_iter it;
     struct whc_idxnode *n;
-    for (n = ut_hhIterFirst(whc->idx_hash, &it); n != NULL; n = ut_hhIterNext(&it))
+    for (n = ddsrt_hh_iter_first(whc->idx_hash, &it); n != NULL; n = ddsrt_hh_iter_next(&it))
       ddsrt_free(n);
-    ut_hhFree(whc->idx_hash);
+    ddsrt_hh_free(whc->idx_hash);
   }
 
   {
@@ -423,13 +423,13 @@ DDSRT_WARNING_MSVC_ON(6001);
     }
   }
 
-  ut_avlFree (&whc_seq_treedef, &whc->seq, ddsrt_free);
+  ddsrt_avl_free (&whc_seq_treedef, &whc->seq, ddsrt_free);
   nn_freelist_fini (&whc->freelist, ddsrt_free);
 
 #if USE_EHH
-  ut_ehhFree (whc->seq_hash);
+  ddsrt_ehh_free (whc->seq_hash);
 #else
-  ut_hhFree (whc->seq_hash);
+  ddsrt_hh_free (whc->seq_hash);
 #endif
   ddsrt_mutex_destroy (&whc->lock);
   ddsrt_free (whc);
@@ -445,7 +445,7 @@ static void get_state_locked(const struct whc_impl *whc, struct whc_state *st)
   else
   {
     const struct whc_intvnode *intv;
-    intv = ut_avlFindMin (&whc_seq_treedef, &whc->seq);
+    intv = ddsrt_avl_find_min (&whc_seq_treedef, &whc->seq);
     /* not empty, open node may be anything but is (by definition)
      findmax, and whc is claimed to be non-empty, so min interval
      can't be empty */
@@ -476,12 +476,12 @@ static struct whc_node *find_nextseq_intv (struct whc_intvnode **p_intv, const s
        SEQ < Y can't exist */
 #ifndef NDEBUG
     {
-      struct whc_intvnode *predintv = ut_avlLookupPredEq (&whc_seq_treedef, &whc->seq, &seq);
+      struct whc_intvnode *predintv = ddsrt_avl_lookup_pred_eq (&whc_seq_treedef, &whc->seq, &seq);
       assert (predintv == NULL || predintv->maxp1 <= seq);
     }
 #endif
-    if ((intv = ut_avlLookupSuccEq (&whc_seq_treedef, &whc->seq, &seq)) == NULL) {
-      assert (ut_avlLookupPredEq (&whc_seq_treedef, &whc->seq, &seq) == whc->open_intv);
+    if ((intv = ddsrt_avl_lookup_succ_eq (&whc_seq_treedef, &whc->seq, &seq)) == NULL) {
+      assert (ddsrt_avl_lookup_pred_eq (&whc_seq_treedef, &whc->seq, &seq) == whc->open_intv);
       return NULL;
     } else if (intv->min < intv->maxp1) { /* only if not empty interval */
       assert (intv->min > seq);
@@ -502,7 +502,7 @@ static struct whc_node *find_nextseq_intv (struct whc_intvnode **p_intv, const s
     assert (whc->maxseq_node != NULL);
     assert (n->seq < whc->maxseq_node->seq);
     n = n->next_seq;
-    *p_intv = ut_avlLookupPredEq (&whc_seq_treedef, &whc->seq, &n->seq);
+    *p_intv = ddsrt_avl_lookup_pred_eq (&whc_seq_treedef, &whc->seq, &n->seq);
     return n;
   }
 }
@@ -538,7 +538,7 @@ static void delete_one_sample_from_idx (struct whc_impl *whc, struct whc_node *w
     for (i = 0; i < whc->idxdepth; i++)
       assert (i == idxn->headidx || idxn->hist[i] == NULL);
 #endif
-    if (!ut_hhRemove (whc->idx_hash, idxn))
+    if (!ddsrt_hh_remove (whc->idx_hash, idxn))
       assert (0);
     ddsi_tkmap_instance_unref(idxn->tk);
     ddsrt_free (idxn);
@@ -568,7 +568,7 @@ static void free_one_instance_from_idx (struct whc_impl *whc, seqno_t max_drop_s
 
 static void delete_one_instance_from_idx (struct whc_impl *whc, seqno_t max_drop_seq, struct whc_idxnode *idxn)
 {
-  if (!ut_hhRemove (whc->idx_hash, idxn))
+  if (!ddsrt_hh_remove (whc->idx_hash, idxn))
     assert (0);
   free_one_instance_from_idx (whc, max_drop_seq, idxn);
 }
@@ -612,11 +612,11 @@ static unsigned whc_default_downgrade_to_volatile (struct whc *whc_generic, stru
     whc->tldepth = 0;
     if (whc->hdepth == 0)
     {
-      struct ut_hhIter it;
+      struct ddsrt_hh_iter it;
       struct whc_idxnode *n;
-      for (n = ut_hhIterFirst(whc->idx_hash, &it); n != NULL; n = ut_hhIterNext(&it))
+      for (n = ddsrt_hh_iter_first(whc->idx_hash, &it); n != NULL; n = ddsrt_hh_iter_next(&it))
         free_one_instance_from_idx (whc, 0, n);
-      ut_hhFree(whc->idx_hash);
+      ddsrt_hh_free(whc->idx_hash);
       whc->idxdepth = 0;
       whc->idx_hash = NULL;
     }
@@ -680,9 +680,9 @@ static void whc_delete_one_intv (struct whc_impl *whc, struct whc_intvnode **p_i
     if (whcn == intv->last && intv != whc->open_intv)
     {
       struct whc_intvnode *tmp = intv;
-      *p_intv = ut_avlFindSucc (&whc_seq_treedef, &whc->seq, intv);
+      *p_intv = ddsrt_avl_find_succ (&whc_seq_treedef, &whc->seq, intv);
       /* only sample in interval and not the open interval => delete interval */
-      ut_avlDelete (&whc_seq_treedef, &whc->seq, tmp);
+      ddsrt_avl_delete (&whc_seq_treedef, &whc->seq, tmp);
       ddsrt_free (tmp);
     }
     else
@@ -703,7 +703,7 @@ static void whc_delete_one_intv (struct whc_impl *whc, struct whc_intvnode **p_i
     assert (whcn->prev_seq->seq + 1 == whcn->seq);
     intv->last = whcn->prev_seq;
     intv->maxp1--;
-    *p_intv = ut_avlFindSucc (&whc_seq_treedef, &whc->seq, intv);
+    *p_intv = ddsrt_avl_find_succ (&whc_seq_treedef, &whc->seq, intv);
   }
   else
   {
@@ -712,7 +712,7 @@ static void whc_delete_one_intv (struct whc_impl *whc, struct whc_intvnode **p_i
        issue only, and so we can (for now) get away with splitting
        it greedily */
     struct whc_intvnode *new_intv;
-    ut_avlIPath_t path;
+    ddsrt_avl_ipath_t path;
 
     new_intv = ddsrt_malloc (sizeof (*new_intv));
 
@@ -730,9 +730,9 @@ static void whc_delete_one_intv (struct whc_impl *whc, struct whc_intvnode **p_i
 
     /* insert new node & continue the loop with intv set to the
        new interval */
-    if (ut_avlLookupIPath (&whc_seq_treedef, &whc->seq, &new_intv->min, &path) != NULL)
+    if (ddsrt_avl_lookup_ipath (&whc_seq_treedef, &whc->seq, &new_intv->min, &path) != NULL)
       assert (0);
-    ut_avlInsertIPath (&whc_seq_treedef, &whc->seq, new_intv, &path);
+    ddsrt_avl_insert_ipath (&whc_seq_treedef, &whc->seq, new_intv, &path);
 
     if (intv == whc->open_intv)
       whc->open_intv = new_intv;
@@ -744,7 +744,7 @@ static void whc_delete_one (struct whc_impl *whc, struct whc_node *whcn)
 {
   struct whc_intvnode *intv;
   struct whc_node *whcn_tmp = whcn;
-  intv = ut_avlLookupPredEq (&whc_seq_treedef, &whc->seq, &whcn->seq);
+  intv = ddsrt_avl_lookup_pred_eq (&whc_seq_treedef, &whc->seq, &whcn->seq);
   assert (intv != NULL);
   whc_delete_one_intv (whc, &intv, &whcn);
   if (whcn_tmp->prev_seq)
@@ -804,7 +804,7 @@ static unsigned whc_default_remove_acked_messages_noidx (struct whc_impl *whc, s
 #ifndef NDEBUG
   whcn = find_nextseq_intv (&intv, whc, whc->max_drop_seq);
   assert (whcn == NULL || whcn->prev_seq == NULL);
-  assert (ut_avlIsSingleton (&whc->seq));
+  assert (ddsrt_avl_is_singleton (&whc->seq));
 #endif
   intv = whc->open_intv;
 
@@ -894,7 +894,7 @@ static unsigned whc_default_remove_acked_messages_full (struct whc_impl *whc, se
       }
 
       if (whcn == intv->last)
-        intv = ut_avlFindSucc (&whc_seq_treedef, &whc->seq, intv);
+        intv = ddsrt_avl_find_succ (&whc_seq_treedef, &whc->seq, intv);
       if (prev_seq)
         prev_seq->next_seq = whcn;
       whcn->prev_seq = prev_seq;
@@ -975,7 +975,7 @@ static unsigned whc_default_remove_acked_messages_full (struct whc_impl *whc, se
           DDS_LOG(DDS_LC_WHC, " del %p %"PRId64, (void *) oldn, oldn->seq);
           whc_delete_one (whc, oldn);
 #ifndef NDEBUG
-          assert(ut_hhLookup(whc->idx_hash, &template) == idxn);
+          assert(ddsrt_hh_lookup(whc->idx_hash, &template) == idxn);
           ddsi_serdata_unref(whcn_template.serdata);
 #endif
         }
@@ -1069,14 +1069,14 @@ static struct whc_node *whc_default_insert_seq (struct whc_impl *whc, seqno_t ma
   {
     /* gap => need new open_intv */
     struct whc_intvnode *intv1;
-    ut_avlIPath_t path;
+    ddsrt_avl_ipath_t path;
     intv1 = ddsrt_malloc (sizeof (*intv1));
     intv1->min = seq;
     intv1->maxp1 = seq + 1;
     intv1->first = intv1->last = newn;
-    if (ut_avlLookupIPath (&whc_seq_treedef, &whc->seq, &seq, &path) != NULL)
+    if (ddsrt_avl_lookup_ipath (&whc_seq_treedef, &whc->seq, &seq, &path) != NULL)
       assert (0);
-    ut_avlInsertIPath (&whc_seq_treedef, &whc->seq, intv1, &path);
+    ddsrt_avl_insert_ipath (&whc_seq_treedef, &whc->seq, intv1, &path);
     whc->open_intv = intv1;
   }
 
@@ -1128,7 +1128,7 @@ static int whc_default_insert (struct whc *whc_generic, seqno_t max_drop_seq, se
   }
 
   template.idxn.iid = tk->m_iid;
-  if ((idxn = ut_hhLookup (whc->idx_hash, &template)) != NULL)
+  if ((idxn = ddsrt_hh_lookup (whc->idx_hash, &template)) != NULL)
   {
     /* Unregisters cause deleting of index entry, non-unregister of adding/overwriting in history */
     DDS_LOG(DDS_LC_WHC, " idxn %p", (void *)idxn);
@@ -1203,7 +1203,7 @@ static int whc_default_insert (struct whc *whc_generic, seqno_t max_drop_seq, se
         idxn->hist[i] = NULL;
       newn->idxnode = idxn;
       newn->idxnode_pos = 0;
-      if (!ut_hhAdd (whc->idx_hash, idxn))
+      if (!ddsrt_hh_add (whc->idx_hash, idxn))
         assert (0);
     }
     else
diff --git a/src/core/ddsc/src/dds_write.c b/src/core/ddsc/src/dds_write.c
index 3c1526c..98a590b 100644
--- a/src/core/ddsc/src/dds_write.c
+++ b/src/core/ddsc/src/dds_write.c
@@ -123,14 +123,14 @@ static dds_return_t deliver_locally (struct writer *wr, struct ddsi_serdata *pay
      we fall back to using the GUIDs so that we can deliver all
      samples we received from it. As writer being deleted any
      reliable samples that are rejected are simply discarded. */
-    ut_avlIter_t it;
+    ddsrt_avl_iter_t it;
     struct pwr_rd_match *m;
     struct proxy_writer_info pwr_info;
     dds_duration_t max_block_ms = nn_from_ddsi_duration (wr->xqos->reliability.max_blocking_time);
     ddsrt_mutex_unlock (&wr->rdary.rdary_lock);
     make_proxy_writer_info (&pwr_info, &wr->e, wr->xqos);
     ddsrt_mutex_lock (&wr->e.lock);
-    for (m = ut_avlIterFirst (&wr_local_readers_treedef, &wr->local_readers, &it); m != NULL; m = ut_avlIterNext (&it))
+    for (m = ddsrt_avl_iter_first (&wr_local_readers_treedef, &wr->local_readers, &it); m != NULL; m = ddsrt_avl_iter_next (&it))
     {
       struct reader *rd;
       if ((rd = ephash_lookup_reader_guid (&m->rd_guid)) != NULL)
diff --git a/src/core/ddsi/include/dds/ddsi/ddsi_serdata_default.h b/src/core/ddsi/include/dds/ddsi/ddsi_serdata_default.h
index 403a1c0..7775e1c 100644
--- a/src/core/ddsi/include/dds/ddsi/ddsi_serdata_default.h
+++ b/src/core/ddsi/include/dds/ddsi/ddsi_serdata_default.h
@@ -15,7 +15,7 @@
 #include "dds/ddsrt/endian.h"
 #include "dds/ddsi/q_plist.h" /* for nn_prismtech_writer_info */
 #include "dds/ddsi/q_freelist.h"
-#include "dds/util/ut_avl.h"
+#include "dds/ddsrt/avl.h"
 #include "dds/ddsi/ddsi_serdata.h"
 #include "dds/ddsi/ddsi_sertopic.h"
 
diff --git a/src/core/ddsi/include/dds/ddsi/ddsi_sertopic.h b/src/core/ddsi/include/dds/ddsi/ddsi_sertopic.h
index 2b48ad5..edd0b02 100644
--- a/src/core/ddsi/include/dds/ddsi/ddsi_sertopic.h
+++ b/src/core/ddsi/include/dds/ddsi/ddsi_sertopic.h
@@ -13,7 +13,7 @@
 #define DDSI_SERTOPIC_H
 
 #include "dds/ddsrt/atomics.h"
-#include "dds/util/ut_avl.h"
+#include "dds/ddsrt/avl.h"
 #include "dds/ddsc/dds_public_alloc.h"
 
 struct ddsi_serdata;
@@ -25,7 +25,7 @@ typedef void (*topic_cb_t) (struct dds_topic * topic);
 struct ddsi_sertopic_ops;
 
 struct ddsi_sertopic {
-  ut_avlNode_t avlnode; /* index on name_typename */
+  ddsrt_avl_node_t avlnode; /* index on name_typename */
   const struct ddsi_sertopic_ops *ops;
   const struct ddsi_serdata_ops *serdata_ops;
   uint32_t serdata_basehash;
diff --git a/src/core/ddsi/include/dds/ddsi/q_addrset.h b/src/core/ddsi/include/dds/ddsi/q_addrset.h
index 500337f..22476d5 100644
--- a/src/core/ddsi/include/dds/ddsi/q_addrset.h
+++ b/src/core/ddsi/include/dds/ddsi/q_addrset.h
@@ -13,7 +13,7 @@
 #define NN_ADDRSET_H
 
 #include "dds/ddsrt/sync.h"
-#include "dds/util/ut_avl.h"
+#include "dds/ddsrt/avl.h"
 #include "dds/ddsi/q_log.h"
 #include "dds/ddsi/q_protocol.h"
 #include "dds/ddsi/q_feature_check.h"
@@ -23,14 +23,14 @@ extern "C" {
 #endif
 
 typedef struct addrset_node {
-  ut_avlNode_t avlnode;
+  ddsrt_avl_node_t avlnode;
   nn_locator_t loc;
 } * addrset_node_t;
 
 struct addrset {
   ddsrt_mutex_t lock;
   ddsrt_atomic_uint32_t refc;
-  ut_avlCTree_t ucaddrs, mcaddrs;
+  ddsrt_avl_ctree_t ucaddrs, mcaddrs;
 };
 
 typedef void (*addrset_forall_fun_t) (const nn_locator_t *loc, void *arg);
diff --git a/src/core/ddsi/include/dds/ddsi/q_entity.h b/src/core/ddsi/include/dds/ddsi/q_entity.h
index 9138e02..f6f1f8e 100644
--- a/src/core/ddsi/include/dds/ddsi/q_entity.h
+++ b/src/core/ddsi/include/dds/ddsi/q_entity.h
@@ -13,7 +13,7 @@
 #define Q_ENTITY_H
 
 #include "dds/ddsrt/atomics.h"
-#include "dds/util/ut_avl.h"
+#include "dds/ddsrt/avl.h"
 #include "dds/ddsi/q_rtps.h"
 #include "dds/ddsi/q_protocol.h"
 #include "dds/ddsi/q_lat_estim.h"
@@ -54,12 +54,12 @@ status_cb_data_t;
 typedef void (*status_cb_t) (void *entity, const status_cb_data_t *data);
 
 struct prd_wr_match {
-  ut_avlNode_t avlnode;
+  ddsrt_avl_node_t avlnode;
   nn_guid_t wr_guid;
 };
 
 struct rd_pwr_match {
-  ut_avlNode_t avlnode;
+  ddsrt_avl_node_t avlnode;
   nn_guid_t pwr_guid;
 #ifdef DDSI_INCLUDE_SSM
   nn_locator_t ssm_mc_loc;
@@ -68,17 +68,17 @@ struct rd_pwr_match {
 };
 
 struct wr_rd_match {
-  ut_avlNode_t avlnode;
+  ddsrt_avl_node_t avlnode;
   nn_guid_t rd_guid;
 };
 
 struct rd_wr_match {
-  ut_avlNode_t avlnode;
+  ddsrt_avl_node_t avlnode;
   nn_guid_t wr_guid;
 };
 
 struct wr_prd_match {
-  ut_avlNode_t avlnode;
+  ddsrt_avl_node_t avlnode;
   nn_guid_t prd_guid; /* guid of the proxy reader */
   unsigned assumed_in_sync: 1; /* set to 1 upon receipt of ack not nack'ing msgs */
   unsigned has_replied_to_hb: 1; /* we must keep sending HBs until all readers have this set */
@@ -105,7 +105,7 @@ enum pwr_rd_match_syncstate {
 };
 
 struct pwr_rd_match {
-  ut_avlNode_t avlnode;
+  ddsrt_avl_node_t avlnode;
   nn_guid_t rd_guid;
   nn_mtime_t tcreate;
   nn_count_t count; /* most recent acknack sequence number */
@@ -247,8 +247,8 @@ struct writer
   nn_etime_t t_rexmit_end; /* time of last 1->0 transition of "retransmitting" */
   nn_etime_t t_whc_high_upd; /* time "whc_high" was last updated for controlled ramp-up of throughput */
   int num_reliable_readers; /* number of matching reliable PROXY readers */
-  ut_avlTree_t readers; /* all matching PROXY readers, see struct wr_prd_match */
-  ut_avlTree_t local_readers; /* all matching LOCAL readers, see struct wr_rd_match */
+  ddsrt_avl_tree_t readers; /* all matching PROXY readers, see struct wr_prd_match */
+  ddsrt_avl_tree_t local_readers; /* all matching LOCAL readers, see struct wr_rd_match */
 #ifdef DDSI_INCLUDE_NETWORK_PARTITIONS
   uint32_t partition_id;
 #endif
@@ -280,8 +280,8 @@ struct reader
   struct addrset *as;
 #endif
   const struct ddsi_sertopic * topic; /* topic is NULL for built-in readers */
-  ut_avlTree_t writers; /* all matching PROXY writers, see struct rd_pwr_match */
-  ut_avlTree_t local_writers; /* all matching LOCAL writers, see struct rd_wr_match */
+  ddsrt_avl_tree_t writers; /* all matching PROXY writers, see struct rd_pwr_match */
+  ddsrt_avl_tree_t local_writers; /* all matching LOCAL writers, see struct rd_wr_match */
   ddsi2direct_directread_cb_t ddsi2direct_cb;
   void *ddsi2direct_cbarg;
 };
@@ -299,7 +299,7 @@ struct proxy_participant
   struct addrset *as_default; /* default address set to use for user data traffic */
   struct addrset *as_meta; /* default address set to use for discovery traffic */
   struct proxy_endpoint_common *endpoints; /* all proxy endpoints can be reached from here */
-  ut_avlTree_t groups; /* table of all groups (publisher, subscriber), see struct proxy_group */
+  ddsrt_avl_tree_t groups; /* table of all groups (publisher, subscriber), see struct proxy_group */
   unsigned kernel_sequence_numbers : 1; /* whether this proxy participant generates OSPL kernel sequence numbers */
   unsigned implicitly_created : 1; /* participants are implicitly created for Cloud/Fog discovered endpoints */
   unsigned is_ddsi2_pp: 1; /* if this is the federation-leader on the remote node */
@@ -318,7 +318,7 @@ struct proxy_participant
    tables, but "groups" only live in the context of a proxy
    participant. */
 struct proxy_group {
-  ut_avlNode_t avlnode;
+  ddsrt_avl_node_t avlnode;
   nn_guid_t guid;
   char *name;
   struct proxy_participant *proxypp; /* uncounted backref to proxy participant */
@@ -340,7 +340,7 @@ struct proxy_endpoint_common
 struct proxy_writer {
   struct entity_common e;
   struct proxy_endpoint_common c;
-  ut_avlTree_t readers; /* matching LOCAL readers, see pwr_rd_match */
+  ddsrt_avl_tree_t readers; /* matching LOCAL readers, see pwr_rd_match */
   int n_reliable_readers; /* number of those that are reliable */
   int n_readers_out_of_sync; /* number of those that require special handling (accepting historical data, waiting for historical data set to become complete) */
   seqno_t last_seq; /* highest known seq published by the writer, not last delivered */
@@ -373,16 +373,16 @@ struct proxy_reader {
 #ifdef DDSI_INCLUDE_SSM
   unsigned favours_ssm: 1; /* iff 1, this proxy reader favours SSM when available */
 #endif
-  ut_avlTree_t writers; /* matching LOCAL writers */
+  ddsrt_avl_tree_t writers; /* matching LOCAL writers */
 };
 
-extern const ut_avlTreedef_t wr_readers_treedef;
-extern const ut_avlTreedef_t wr_local_readers_treedef;
-extern const ut_avlTreedef_t rd_writers_treedef;
-extern const ut_avlTreedef_t rd_local_writers_treedef;
-extern const ut_avlTreedef_t pwr_readers_treedef;
-extern const ut_avlTreedef_t prd_writers_treedef;
-extern const ut_avlTreedef_t deleted_participants_treedef;
+extern const ddsrt_avl_treedef_t wr_readers_treedef;
+extern const ddsrt_avl_treedef_t wr_local_readers_treedef;
+extern const ddsrt_avl_treedef_t rd_writers_treedef;
+extern const ddsrt_avl_treedef_t rd_local_writers_treedef;
+extern const ddsrt_avl_treedef_t pwr_readers_treedef;
+extern const ddsrt_avl_treedef_t prd_writers_treedef;
+extern const ddsrt_avl_treedef_t deleted_participants_treedef;
 
 #define DPG_LOCAL 1
 #define DPG_REMOTE 2
diff --git a/src/core/ddsi/include/dds/ddsi/q_ephash.h b/src/core/ddsi/include/dds/ddsi/q_ephash.h
index e6e0d4a..cf218c3 100644
--- a/src/core/ddsi/include/dds/ddsi/q_ephash.h
+++ b/src/core/ddsi/include/dds/ddsi/q_ephash.h
@@ -12,7 +12,7 @@
 #ifndef Q_EPHASH_H
 #define Q_EPHASH_H
 
-#include "dds/util/ut_hopscotch.h"
+#include "dds/ddsrt/hopscotch.h"
 
 #if defined (__cplusplus)
 extern "C" {
@@ -39,7 +39,7 @@ struct nn_guid;
   
 struct ephash_enum
 {
-  struct ut_chhIter it;
+  struct ddsrt_chh_iter it;
   enum entity_kind kind;
   struct entity_common *cur;
 };
diff --git a/src/core/ddsi/include/dds/ddsi/q_globals.h b/src/core/ddsi/include/dds/ddsi/q_globals.h
index 770c569..517b699 100644
--- a/src/core/ddsi/include/dds/ddsi/q_globals.h
+++ b/src/core/ddsi/include/dds/ddsi/q_globals.h
@@ -18,7 +18,7 @@
 #include "dds/ddsrt/atomics.h"
 #include "dds/ddsrt/sockets.h"
 #include "dds/ddsrt/sync.h"
-#include "dds/util/ut_fibheap.h"
+#include "dds/ddsrt/fibheap.h"
 
 #include "dds/ddsi/q_plist.h"
 #include "dds/ddsi/q_protocol.h"
@@ -47,7 +47,7 @@ struct lease;
 struct ddsi_tran_conn;
 struct ddsi_tran_listener;
 struct ddsi_tran_factory;
-struct ut_thread_pool_s;
+struct ddsrt_thread_pool_s;
 struct debug_monitor;
 struct ddsi_tkmap;
 
@@ -110,7 +110,7 @@ struct q_globals {
   /* Lease junk */
   ddsrt_mutex_t leaseheap_lock;
   ddsrt_mutex_t lease_locks[N_LEASE_LOCKS];
-  ut_fibheap_t leaseheap;
+  ddsrt_fibheap_t leaseheap;
 
   /* Transport factory */
 
@@ -133,7 +133,7 @@ struct q_globals {
 
   /* Thread pool */
 
-  struct ut_thread_pool_s * thread_pool;
+  struct ddsrt_thread_pool_s * thread_pool;
 
   /* In many sockets mode, the receive threads maintain a local array
      with participant GUIDs and sockets, participant_set_generation is
diff --git a/src/core/ddsi/include/dds/ddsi/q_inverse_uint32_set.h b/src/core/ddsi/include/dds/ddsi/q_inverse_uint32_set.h
index 927d94c..d48cf96 100644
--- a/src/core/ddsi/include/dds/ddsi/q_inverse_uint32_set.h
+++ b/src/core/ddsi/include/dds/ddsi/q_inverse_uint32_set.h
@@ -12,14 +12,14 @@
 #ifndef NN_INVERSE_UINT32_SET_H
 #define NN_INVERSE_UINT32_SET_H
 
-#include "dds/util/ut_avl.h"
+#include "dds/ddsrt/avl.h"
 
 struct inverse_uint32_set_node {
-  ut_avlNode_t avlnode;
+  ddsrt_avl_node_t avlnode;
   uint32_t min, max;
 };
 struct inverse_uint32_set {
-  ut_avlTree_t ids;
+  ddsrt_avl_tree_t ids;
   uint32_t cursor;
   uint32_t min, max;
 };
diff --git a/src/core/ddsi/src/ddsi_mcgroup.c b/src/core/ddsi/src/ddsi_mcgroup.c
index 744ace4..51ca755 100644
--- a/src/core/ddsi/src/ddsi_mcgroup.c
+++ b/src/core/ddsi/src/ddsi_mcgroup.c
@@ -20,10 +20,10 @@
 #include "dds/ddsi/ddsi_mcgroup.h"
 #include "dds/ddsi/q_config.h"
 #include "dds/ddsi/q_log.h"
-#include "dds/util/ut_avl.h"
+#include "dds/ddsrt/avl.h"
 
 struct nn_group_membership_node {
-  ut_avlNode_t avlnode;
+  ddsrt_avl_node_t avlnode;
   ddsi_tran_conn_t conn;
   nn_locator_t srcloc;
   nn_locator_t mcloc;
@@ -32,7 +32,7 @@ struct nn_group_membership_node {
 
 struct nn_group_membership {
   ddsrt_mutex_t lock;
-  ut_avlTree_t mships;
+  ddsrt_avl_tree_t mships;
 };
 
 static int locator_compare_no_port (const nn_locator_t *as, const nn_locator_t *bs)
@@ -60,19 +60,19 @@ static int cmp_group_membership (const void *va, const void *vb)
     return 0;
 }
 
-static ut_avlTreedef_t mship_td = UT_AVL_TREEDEF_INITIALIZER(offsetof (struct nn_group_membership_node, avlnode), 0, cmp_group_membership, 0);
+static ddsrt_avl_treedef_t mship_td = DDSRT_AVL_TREEDEF_INITIALIZER(offsetof (struct nn_group_membership_node, avlnode), 0, cmp_group_membership, 0);
 
 struct nn_group_membership *new_group_membership (void)
 {
   struct nn_group_membership *mship = ddsrt_malloc (sizeof (*mship));
   ddsrt_mutex_init (&mship->lock);
-  ut_avlInit (&mship_td, &mship->mships);
+  ddsrt_avl_init (&mship_td, &mship->mships);
   return mship;
 }
 
 void free_group_membership (struct nn_group_membership *mship)
 {
-  ut_avlFree (&mship_td, &mship->mships, ddsrt_free);
+  ddsrt_avl_free (&mship_td, &mship->mships, ddsrt_free);
   ddsrt_mutex_destroy (&mship->lock);
   ddsrt_free (mship);
 }
@@ -80,7 +80,7 @@ void free_group_membership (struct nn_group_membership *mship)
 static int reg_group_membership (struct nn_group_membership *mship, ddsi_tran_conn_t conn, const nn_locator_t *srcloc, const nn_locator_t *mcloc)
 {
   struct nn_group_membership_node key, *n;
-  ut_avlIPath_t ip;
+  ddsrt_avl_ipath_t ip;
   int isnew;
   key.conn = conn;
   if (srcloc)
@@ -88,7 +88,7 @@ static int reg_group_membership (struct nn_group_membership *mship, ddsi_tran_co
   else
     memset (&key.srcloc, 0, sizeof (key.srcloc));
   key.mcloc = *mcloc;
-  if ((n = ut_avlLookupIPath (&mship_td, &mship->mships, &key, &ip)) != NULL) {
+  if ((n = ddsrt_avl_lookup_ipath (&mship_td, &mship->mships, &key, &ip)) != NULL) {
     isnew = 0;
     n->count++;
   } else {
@@ -98,7 +98,7 @@ static int reg_group_membership (struct nn_group_membership *mship, ddsi_tran_co
     n->srcloc = key.srcloc;
     n->mcloc = key.mcloc;
     n->count = 1;
-    ut_avlInsertIPath (&mship_td, &mship->mships, n, &ip);
+    ddsrt_avl_insert_ipath (&mship_td, &mship->mships, n, &ip);
   }
   return isnew;
 }
@@ -106,7 +106,7 @@ static int reg_group_membership (struct nn_group_membership *mship, ddsi_tran_co
 static int unreg_group_membership (struct nn_group_membership *mship, ddsi_tran_conn_t conn, const nn_locator_t *srcloc, const nn_locator_t *mcloc)
 {
   struct nn_group_membership_node key, *n;
-  ut_avlDPath_t dp;
+  ddsrt_avl_dpath_t dp;
   int mustdel;
   key.conn = conn;
   if (srcloc)
@@ -114,7 +114,7 @@ static int unreg_group_membership (struct nn_group_membership *mship, ddsi_tran_
   else
     memset (&key.srcloc, 0, sizeof (key.srcloc));
   key.mcloc = *mcloc;
-  n = ut_avlLookupDPath (&mship_td, &mship->mships, &key, &dp);
+  n = ddsrt_avl_lookup_dpath (&mship_td, &mship->mships, &key, &dp);
   assert (n != NULL);
   assert (n->count > 0);
   if (--n->count > 0)
@@ -122,7 +122,7 @@ static int unreg_group_membership (struct nn_group_membership *mship, ddsi_tran_
   else
   {
     mustdel = 1;
-    ut_avlDeleteDPath (&mship_td, &mship->mships, n, &dp);
+    ddsrt_avl_delete_dpath (&mship_td, &mship->mships, n, &dp);
     ddsrt_free (n);
   }
   return mustdel;
@@ -268,13 +268,13 @@ void ddsi_transfer_group_membership (ddsi_tran_conn_t conn, ddsi_tran_conn_t new
    are neither 0 nor maximum representable, min and max define the range of key values that relate to
    oldsock */
   ddsrt_mutex_lock (&gv.mship->lock);
-  n = ut_avlLookupSuccEq (&mship_td, &gv.mship->mships, &min);
+  n = ddsrt_avl_lookup_succ_eq (&mship_td, &gv.mship->mships, &min);
   while (n != NULL && cmp_group_membership (n, &max) <= 0)
   {
-    struct nn_group_membership_node * const nn = ut_avlFindSucc (&mship_td, &gv.mship->mships, n);
-    ut_avlDelete (&mship_td, &gv.mship->mships, n);
+    struct nn_group_membership_node * const nn = ddsrt_avl_find_succ (&mship_td, &gv.mship->mships, n);
+    ddsrt_avl_delete (&mship_td, &gv.mship->mships, n);
     n->conn = newconn;
-    ut_avlInsert (&mship_td, &gv.mship->mships, n);
+    ddsrt_avl_insert (&mship_td, &gv.mship->mships, n);
     n = nn;
   }
   ddsrt_mutex_unlock (&gv.mship->lock);
@@ -283,13 +283,13 @@ void ddsi_transfer_group_membership (ddsi_tran_conn_t conn, ddsi_tran_conn_t new
 int ddsi_rejoin_transferred_mcgroups (ddsi_tran_conn_t conn)
 {
   struct nn_group_membership_node *n, min, max;
-  ut_avlIter_t it;
+  ddsrt_avl_iter_t it;
   int ret = 0;
   memset(&min, 0, sizeof(min));
   memset(&max, 0xff, sizeof(max));
   min.conn = max.conn = conn;
   ddsrt_mutex_lock (&gv.mship->lock);
-  for (n = ut_avlIterSuccEq (&mship_td, &gv.mship->mships, &it, &min); n != NULL && ret >= 0 && cmp_group_membership(n, &max) <= 0; n = ut_avlIterNext (&it))
+  for (n = ddsrt_avl_iter_succ_eq (&mship_td, &gv.mship->mships, &it, &min); n != NULL && ret >= 0 && cmp_group_membership(n, &max) <= 0; n = ddsrt_avl_iter_next (&it))
   {
     int have_srcloc = (memcmp(&n->srcloc, &min.srcloc, sizeof(n->srcloc)) != 0);
     assert (n->conn == conn);
diff --git a/src/core/ddsi/src/ddsi_tcp.c b/src/core/ddsi/src/ddsi_tcp.c
index 2bb6576..0adbd73 100644
--- a/src/core/ddsi/src/ddsi_tcp.c
+++ b/src/core/ddsi/src/ddsi_tcp.c
@@ -20,7 +20,7 @@
 #include "dds/ddsi/ddsi_tran.h"
 #include "dds/ddsi/ddsi_tcp.h"
 #include "dds/ddsi/ddsi_ipaddr.h"
-#include "dds/util/ut_avl.h"
+#include "dds/ddsrt/avl.h"
 #include "dds/ddsi/q_nwif.h"
 #include "dds/ddsi/q_config.h"
 #include "dds/ddsi/q_log.h"
@@ -93,12 +93,12 @@ static int ddsi_tcp_cmp_conn_wrap (const void *a, const void *b)
 
 typedef struct ddsi_tcp_node
 {
-  ut_avlNode_t m_avlnode;
+  ddsrt_avl_node_t m_avlnode;
   ddsi_tcp_conn_t m_conn;
 }
 * ddsi_tcp_node_t;
 
-static const ut_avlTreedef_t ddsi_tcp_treedef = UT_AVL_TREEDEF_INITIALIZER_INDKEY
+static const ddsrt_avl_treedef_t ddsi_tcp_treedef = DDSRT_AVL_TREEDEF_INITIALIZER_INDKEY
 (
   offsetof (struct ddsi_tcp_node, m_avlnode),
   offsetof (struct ddsi_tcp_node, m_conn),
@@ -107,7 +107,7 @@ static const ut_avlTreedef_t ddsi_tcp_treedef = UT_AVL_TREEDEF_INITIALIZER_INDKE
 );
 
 static ddsrt_mutex_t ddsi_tcp_cache_lock_g;
-static ut_avlTree_t ddsi_tcp_cache_g;
+static ddsrt_avl_tree_t ddsi_tcp_cache_g;
 static struct ddsi_tran_factory ddsi_tcp_factory_g;
 
 static ddsi_tcp_conn_t ddsi_tcp_new_conn (ddsrt_socket_t, bool, struct sockaddr *);
@@ -125,11 +125,11 @@ static char *sockaddr_to_string_with_port (char *dst, size_t sizeof_dst, const s
 static void ddsi_tcp_cache_dump (void)
 {
   char buff[64];
-  ut_avlIter_t iter;
+  ddsrt_avl_iter_t iter;
   ddsi_tcp_node_t n;
   unsigned i = 0;
 
-  n = ut_avlIterFirst (&ddsi_tcp_treedef, &ddsi_tcp_cache_g, &iter);
+  n = ddsrt_avl_iter_first (&ddsi_tcp_treedef, &ddsi_tcp_cache_g, &iter);
   while (n)
   {
     os_sockaddrAddressPortToString ((const os_sockaddr *) &n->m_conn->m_peer_addr, buff, sizeof (buff));
@@ -140,7 +140,7 @@ static void ddsi_tcp_cache_dump (void)
       ddsi_name, i++, n->m_conn->m_base.m_server ? "server" : "client",
       n->m_conn->m_sock, n->m_conn->m_base.m_base.m_port, buff
     );
-    n = ut_avlIterNext (&iter);
+    n = ddsrt_avl_iter_next (&iter);
   }
 }
 */
@@ -242,7 +242,7 @@ static void ddsi_tcp_conn_connect (ddsi_tcp_conn_t conn, const ddsrt_msghdr_t *
   }
 }
 
-static void ddsi_tcp_cache_add (ddsi_tcp_conn_t conn, ut_avlIPath_t * path)
+static void ddsi_tcp_cache_add (ddsi_tcp_conn_t conn, ddsrt_avl_ipath_t * path)
 {
   const char * action = "added";
   ddsi_tcp_node_t node;
@@ -255,11 +255,11 @@ static void ddsi_tcp_cache_add (ddsi_tcp_conn_t conn, ut_avlIPath_t * path)
   {
     node = ddsrt_malloc (sizeof (*node));
     node->m_conn = conn;
-    ut_avlInsertIPath (&ddsi_tcp_treedef, &ddsi_tcp_cache_g, node, path);
+    ddsrt_avl_insert_ipath (&ddsi_tcp_treedef, &ddsi_tcp_cache_g, node, path);
   }
   else
   {
-    node = ut_avlLookup (&ddsi_tcp_treedef, &ddsi_tcp_cache_g, conn);
+    node = ddsrt_avl_lookup (&ddsi_tcp_treedef, &ddsi_tcp_cache_g, conn);
     if (node)
     {
       /* Replace connection in cache */
@@ -272,7 +272,7 @@ static void ddsi_tcp_cache_add (ddsi_tcp_conn_t conn, ut_avlIPath_t * path)
     {
       node = ddsrt_malloc (sizeof (*node));
       node->m_conn = conn;
-      ut_avlInsert (&ddsi_tcp_treedef, &ddsi_tcp_cache_g, node);
+      ddsrt_avl_insert (&ddsi_tcp_treedef, &ddsi_tcp_cache_g, node);
     }
   }
 
@@ -284,15 +284,15 @@ static void ddsi_tcp_cache_remove (ddsi_tcp_conn_t conn)
 {
   char buff[DDSI_LOCSTRLEN];
   ddsi_tcp_node_t node;
-  ut_avlDPath_t path;
+  ddsrt_avl_dpath_t path;
 
   ddsrt_mutex_lock (&ddsi_tcp_cache_lock_g);
-  node = ut_avlLookupDPath (&ddsi_tcp_treedef, &ddsi_tcp_cache_g, conn, &path);
+  node = ddsrt_avl_lookup_dpath (&ddsi_tcp_treedef, &ddsi_tcp_cache_g, conn, &path);
   if (node)
   {
     sockaddr_to_string_with_port(buff, sizeof(buff), (struct sockaddr *)&conn->m_peer_addr);
     DDS_LOG(DDS_LC_TCP, "%s cache removed socket %"PRIdSOCK" to %s\n", ddsi_name, conn->m_sock, buff);
-    ut_avlDeleteDPath (&ddsi_tcp_treedef, &ddsi_tcp_cache_g, node, &path);
+    ddsrt_avl_delete_dpath (&ddsi_tcp_treedef, &ddsi_tcp_cache_g, node, &path);
     ddsi_tcp_node_free (node);
   }
   ddsrt_mutex_unlock (&ddsi_tcp_cache_lock_g);
@@ -305,7 +305,7 @@ static void ddsi_tcp_cache_remove (ddsi_tcp_conn_t conn)
 
 static ddsi_tcp_conn_t ddsi_tcp_cache_find (const ddsrt_msghdr_t * msg)
 {
-  ut_avlIPath_t path;
+  ddsrt_avl_ipath_t path;
   ddsi_tcp_node_t node;
   struct ddsi_tcp_conn key;
   ddsi_tcp_conn_t ret = NULL;
@@ -317,12 +317,12 @@ static ddsi_tcp_conn_t ddsi_tcp_cache_find (const ddsrt_msghdr_t * msg)
   /* Check cache for existing connection to target */
 
   ddsrt_mutex_lock (&ddsi_tcp_cache_lock_g);
-  node = ut_avlLookupIPath (&ddsi_tcp_treedef, &ddsi_tcp_cache_g, &key, &path);
+  node = ddsrt_avl_lookup_ipath (&ddsi_tcp_treedef, &ddsi_tcp_cache_g, &key, &path);
   if (node)
   {
     if (node->m_conn->m_base.m_closed)
     {
-      ut_avlDelete (&ddsi_tcp_treedef, &ddsi_tcp_cache_g, node);
+      ddsrt_avl_delete (&ddsi_tcp_treedef, &ddsi_tcp_cache_g, node);
       ddsi_tcp_node_free (node);
     }
     else
@@ -1010,7 +1010,7 @@ static void ddsi_tcp_release_listener (ddsi_tran_listener_t listener)
 static void ddsi_tcp_release_factory (void)
 {
   if (ddsrt_atomic_dec32_nv (&ddsi_tcp_init_g) == 0) {
-    ut_avlFree (&ddsi_tcp_treedef, &ddsi_tcp_cache_g, ddsi_tcp_node_free);
+    ddsrt_avl_free (&ddsi_tcp_treedef, &ddsi_tcp_cache_g, ddsi_tcp_node_free);
     ddsrt_mutex_destroy (&ddsi_tcp_cache_lock_g);
 #ifdef DDSI_INCLUDE_SSL
     if (ddsi_tcp_ssl_plugin.fini)
@@ -1095,7 +1095,7 @@ int ddsi_tcp_init (void)
     }
 #endif
 
-    ut_avlInit (&ddsi_tcp_treedef, &ddsi_tcp_cache_g);
+    ddsrt_avl_init (&ddsi_tcp_treedef, &ddsi_tcp_cache_g);
     ddsrt_mutex_init (&ddsi_tcp_cache_lock_g);
 
     DDS_LOG(DDS_LC_CONFIG, "%s initialized\n", ddsi_name);
diff --git a/src/core/ddsi/src/ddsi_tkmap.c b/src/core/ddsi/src/ddsi_tkmap.c
index b688e09..132fd5d 100644
--- a/src/core/ddsi/src/ddsi_tkmap.c
+++ b/src/core/ddsi/src/ddsi_tkmap.c
@@ -22,7 +22,7 @@
 #include "dds/ddsi/q_config.h"
 #include "dds/ddsi/ddsi_iid.h"
 #include "dds/ddsi/ddsi_tkmap.h"
-#include "dds/util/ut_hopscotch.h"
+#include "dds/ddsrt/hopscotch.h"
 #include "dds__stream.h"
 #include "dds/ddsi/ddsi_serdata.h"
 
@@ -31,7 +31,7 @@
 
 struct ddsi_tkmap
 {
-  struct ut_chh * m_hh;
+  struct ddsrt_chh * m_hh;
   ddsrt_mutex_t m_lock;
   ddsrt_cond_t m_cond;
 };
@@ -87,7 +87,7 @@ static int dds_tk_equals_void (const void *a, const void *b)
 struct ddsi_tkmap *ddsi_tkmap_new (void)
 {
   struct ddsi_tkmap *tkmap = dds_alloc (sizeof (*tkmap));
-  tkmap->m_hh = ut_chhNew (1, dds_tk_hash_void, dds_tk_equals_void, gc_buckets);
+  tkmap->m_hh = ddsrt_chh_new (1, dds_tk_hash_void, dds_tk_equals_void, gc_buckets);
   ddsrt_mutex_init (&tkmap->m_lock);
   ddsrt_cond_init (&tkmap->m_cond);
   return tkmap;
@@ -102,8 +102,8 @@ static void free_tkmap_instance (void *vtk, UNUSED_ARG(void *f_arg))
 
 void ddsi_tkmap_free (struct ddsi_tkmap * map)
 {
-  ut_chhEnumUnsafe (map->m_hh, free_tkmap_instance, NULL);
-  ut_chhFree (map->m_hh);
+  ddsrt_chh_enum_unsafe (map->m_hh, free_tkmap_instance, NULL);
+  ddsrt_chh_free (map->m_hh);
   ddsrt_cond_destroy (&map->m_cond);
   ddsrt_mutex_destroy (&map->m_lock);
   dds_free (map);
@@ -115,18 +115,18 @@ uint64_t ddsi_tkmap_lookup (struct ddsi_tkmap * map, const struct ddsi_serdata *
   struct ddsi_tkmap_instance * tk;
   assert (thread_is_awake ());
   dummy.m_sample = (struct ddsi_serdata *) sd;
-  tk = ut_chhLookup (map->m_hh, &dummy);
+  tk = ddsrt_chh_lookup (map->m_hh, &dummy);
   return (tk) ? tk->m_iid : DDS_HANDLE_NIL;
 }
 
 struct ddsi_tkmap_instance *ddsi_tkmap_find_by_id (struct ddsi_tkmap *map, uint64_t iid)
 {
   /* This is not a function that should be used liberally, as it linearly scans the key-to-iid map. */
-  struct ut_chhIter it;
+  struct ddsrt_chh_iter it;
   struct ddsi_tkmap_instance *tk;
   uint32_t refc;
   assert (thread_is_awake ());
-  for (tk = ut_chhIterFirst (map->m_hh, &it); tk; tk = ut_chhIterNext (&it))
+  for (tk = ddsrt_chh_iter_first (map->m_hh, &it); tk; tk = ddsrt_chh_iter_next (&it))
     if (tk->m_iid == iid)
       break;
   if (tk == NULL)
@@ -165,7 +165,7 @@ ddsi_tkmap_find(
   assert (thread_is_awake ());
   dummy.m_sample = sd;
 retry:
-  if ((tk = ut_chhLookup(map->m_hh, &dummy)) != NULL)
+  if ((tk = ddsrt_chh_lookup(map->m_hh, &dummy)) != NULL)
   {
     uint32_t new;
     new = ddsrt_atomic_inc32_nv(&tk->m_refc);
@@ -178,7 +178,7 @@ retry:
        we can block until someone signals some entry is removed from the map if we take
        some lock & wait for some condition */
       ddsrt_mutex_lock(&map->m_lock);
-      while ((tk = ut_chhLookup(map->m_hh, &dummy)) != NULL && (ddsrt_atomic_ld32(&tk->m_refc) & REFC_DELETE))
+      while ((tk = ddsrt_chh_lookup(map->m_hh, &dummy)) != NULL && (ddsrt_atomic_ld32(&tk->m_refc) & REFC_DELETE))
         ddsrt_cond_wait(&map->m_cond, &map->m_lock);
       ddsrt_mutex_unlock(&map->m_lock);
       goto retry;
@@ -192,7 +192,7 @@ retry:
     tk->m_sample = ddsi_serdata_to_topicless (sd);
     ddsrt_atomic_st32 (&tk->m_refc, 1);
     tk->m_iid = ddsi_iid_gen ();
-    if (!ut_chhAdd (map->m_hh, tk))
+    if (!ddsrt_chh_add (map->m_hh, tk))
     {
       /* Lost a race from another thread, retry */
       ddsi_serdata_unref (tk->m_sample);
@@ -237,7 +237,7 @@ void ddsi_tkmap_instance_unref (struct ddsi_tkmap_instance * tk)
     struct ddsi_tkmap *map = gv.m_tkmap;
 
     /* Remove from hash table */
-    int removed = ut_chhRemove(map->m_hh, tk);
+    int removed = ddsrt_chh_remove(map->m_hh, tk);
     assert (removed);
     (void)removed;
 
diff --git a/src/core/ddsi/src/q_addrset.c b/src/core/ddsi/src/q_addrset.c
index 48d9a4a..f8694d8 100644
--- a/src/core/ddsi/src/q_addrset.c
+++ b/src/core/ddsi/src/q_addrset.c
@@ -17,7 +17,7 @@
 #include "dds/ddsrt/log.h"
 #include "dds/ddsrt/string.h"
 #include "dds/ddsrt/misc.h"
-#include "dds/util/ut_avl.h"
+#include "dds/ddsrt/avl.h"
 #include "dds/ddsi/q_log.h"
 #include "dds/ddsi/q_misc.h"
 #include "dds/ddsi/q_config.h"
@@ -39,8 +39,8 @@
 
 static int compare_locators_vwrap (const void *va, const void *vb);
 
-static const ut_avlCTreedef_t addrset_treedef =
-  UT_AVL_CTREEDEF_INITIALIZER (offsetof (struct addrset_node, avlnode), offsetof (struct addrset_node, loc), compare_locators_vwrap, 0);
+static const ddsrt_avl_ctreedef_t addrset_treedef =
+  DDSRT_AVL_CTREEDEF_INITIALIZER (offsetof (struct addrset_node, avlnode), offsetof (struct addrset_node, loc), compare_locators_vwrap, 0);
 
 static int add_addresses_to_addrset_1 (struct addrset *as, const char *ip, int port_mode, const char *msgtag, int req_mc, int mcgen_base, int mcgen_count, int mcgen_idx)
 {
@@ -203,8 +203,8 @@ struct addrset *new_addrset (void)
   struct addrset *as = ddsrt_malloc (sizeof (*as));
   ddsrt_atomic_st32 (&as->refc, 1);
   ddsrt_mutex_init (&as->lock);
-  ut_avlCInit (&addrset_treedef, &as->ucaddrs);
-  ut_avlCInit (&addrset_treedef, &as->mcaddrs);
+  ddsrt_avl_cinit (&addrset_treedef, &as->ucaddrs);
+  ddsrt_avl_cinit (&addrset_treedef, &as->mcaddrs);
   return as;
 }
 
@@ -221,8 +221,8 @@ void unref_addrset (struct addrset *as)
 {
   if ((as != NULL) && (ddsrt_atomic_dec32_ov (&as->refc) == 1))
   {
-    ut_avlCFree (&addrset_treedef, &as->ucaddrs, ddsrt_free);
-    ut_avlCFree (&addrset_treedef, &as->mcaddrs, ddsrt_free);
+    ddsrt_avl_cfree (&addrset_treedef, &as->ucaddrs, ddsrt_free);
+    ddsrt_avl_cfree (&addrset_treedef, &as->mcaddrs, ddsrt_free);
     ddsrt_mutex_destroy (&as->lock);
     ddsrt_free (as);
   }
@@ -247,9 +247,9 @@ int is_unspec_locator (const nn_locator_t *loc)
 int addrset_contains_ssm (const struct addrset *as)
 {
   struct addrset_node *n;
-  ut_avlCIter_t it;
+  ddsrt_avl_citer_t it;
   LOCK (as);
-  for (n = ut_avlCIterFirst (&addrset_treedef, &as->mcaddrs, &it); n; n = ut_avlCIterNext (&it))
+  for (n = ddsrt_avl_citer_first (&addrset_treedef, &as->mcaddrs, &it); n; n = ddsrt_avl_citer_next (&it))
   {
     if (ddsi_is_ssm_mcaddr (&n->loc))
     {
@@ -264,9 +264,9 @@ int addrset_contains_ssm (const struct addrset *as)
 int addrset_any_ssm (const struct addrset *as, nn_locator_t *dst)
 {
   struct addrset_node *n;
-  ut_avlCIter_t it;
+  ddsrt_avl_citer_t it;
   LOCK (as);
-  for (n = ut_avlCIterFirst (&addrset_treedef, &as->mcaddrs, &it); n; n = ut_avlCIterNext (&it))
+  for (n = ddsrt_avl_citer_first (&addrset_treedef, &as->mcaddrs, &it); n; n = ddsrt_avl_citer_next (&it))
   {
     if (ddsi_is_ssm_mcaddr (&n->loc))
     {
@@ -282,9 +282,9 @@ int addrset_any_ssm (const struct addrset *as, nn_locator_t *dst)
 int addrset_any_non_ssm_mc (const struct addrset *as, nn_locator_t *dst)
 {
   struct addrset_node *n;
-  ut_avlCIter_t it;
+  ddsrt_avl_citer_t it;
   LOCK (as);
-  for (n = ut_avlCIterFirst (&addrset_treedef, &as->mcaddrs, &it); n; n = ut_avlCIterNext (&it))
+  for (n = ddsrt_avl_citer_first (&addrset_treedef, &as->mcaddrs, &it); n; n = ddsrt_avl_citer_next (&it))
   {
     if (!ddsi_is_ssm_mcaddr (&n->loc))
     {
@@ -301,8 +301,8 @@ int addrset_any_non_ssm_mc (const struct addrset *as, nn_locator_t *dst)
 int addrset_purge (struct addrset *as)
 {
   LOCK (as);
-  ut_avlCFree (&addrset_treedef, &as->ucaddrs, ddsrt_free);
-  ut_avlCFree (&addrset_treedef, &as->mcaddrs, ddsrt_free);
+  ddsrt_avl_cfree (&addrset_treedef, &as->ucaddrs, ddsrt_free);
+  ddsrt_avl_cfree (&addrset_treedef, &as->mcaddrs, ddsrt_free);
   UNLOCK (as);
   return 0;
 }
@@ -311,14 +311,14 @@ void add_to_addrset (struct addrset *as, const nn_locator_t *loc)
 {
   if (!is_unspec_locator (loc))
   {
-    ut_avlIPath_t path;
-    ut_avlCTree_t *tree = ddsi_is_mcaddr (loc) ? &as->mcaddrs : &as->ucaddrs;
+    ddsrt_avl_ipath_t path;
+    ddsrt_avl_ctree_t *tree = ddsi_is_mcaddr (loc) ? &as->mcaddrs : &as->ucaddrs;
     LOCK (as);
-    if (ut_avlCLookupIPath (&addrset_treedef, tree, loc, &path) == NULL)
+    if (ddsrt_avl_clookup_ipath (&addrset_treedef, tree, loc, &path) == NULL)
     {
       struct addrset_node *n = ddsrt_malloc (sizeof (*n));
       n->loc = *loc;
-      ut_avlCInsertIPath (&addrset_treedef, tree, n, &path);
+      ddsrt_avl_cinsert_ipath (&addrset_treedef, tree, n, &path);
     }
     UNLOCK (as);
   }
@@ -326,13 +326,13 @@ void add_to_addrset (struct addrset *as, const nn_locator_t *loc)
 
 void remove_from_addrset (struct addrset *as, const nn_locator_t *loc)
 {
-  ut_avlDPath_t path;
-  ut_avlCTree_t *tree = ddsi_is_mcaddr (loc) ? &as->mcaddrs : &as->ucaddrs;
+  ddsrt_avl_dpath_t path;
+  ddsrt_avl_ctree_t *tree = ddsi_is_mcaddr (loc) ? &as->mcaddrs : &as->ucaddrs;
   struct addrset_node *n;
   LOCK (as);
-  if ((n = ut_avlCLookupDPath (&addrset_treedef, tree, loc, &path)) != NULL)
+  if ((n = ddsrt_avl_clookup_dpath (&addrset_treedef, tree, loc, &path)) != NULL)
   {
-    ut_avlCDeleteDPath (&addrset_treedef, tree, n, &path);
+    ddsrt_avl_cdelete_dpath (&addrset_treedef, tree, n, &path);
     ddsrt_free (n);
   }
   UNLOCK (as);
@@ -341,9 +341,9 @@ void remove_from_addrset (struct addrset *as, const nn_locator_t *loc)
 void copy_addrset_into_addrset_uc (struct addrset *as, const struct addrset *asadd)
 {
   struct addrset_node *n;
-  ut_avlCIter_t it;
+  ddsrt_avl_citer_t it;
   LOCK (asadd);
-  for (n = ut_avlCIterFirst (&addrset_treedef, &asadd->ucaddrs, &it); n; n = ut_avlCIterNext (&it))
+  for (n = ddsrt_avl_citer_first (&addrset_treedef, &asadd->ucaddrs, &it); n; n = ddsrt_avl_citer_next (&it))
     add_to_addrset (as, &n->loc);
   UNLOCK (asadd);
 }
@@ -351,9 +351,9 @@ void copy_addrset_into_addrset_uc (struct addrset *as, const struct addrset *asa
 void copy_addrset_into_addrset_mc (struct addrset *as, const struct addrset *asadd)
 {
   struct addrset_node *n;
-  ut_avlCIter_t it;
+  ddsrt_avl_citer_t it;
   LOCK (asadd);
-  for (n = ut_avlCIterFirst (&addrset_treedef, &asadd->mcaddrs, &it); n; n = ut_avlCIterNext (&it))
+  for (n = ddsrt_avl_citer_first (&addrset_treedef, &asadd->mcaddrs, &it); n; n = ddsrt_avl_citer_next (&it))
     add_to_addrset (as, &n->loc);
   UNLOCK (asadd);
 }
@@ -368,9 +368,9 @@ void copy_addrset_into_addrset (struct addrset *as, const struct addrset *asadd)
 void copy_addrset_into_addrset_no_ssm_mc (struct addrset *as, const struct addrset *asadd)
 {
   struct addrset_node *n;
-  ut_avlCIter_t it;
+  ddsrt_avl_citer_t it;
   LOCK (asadd);
-  for (n = ut_avlCIterFirst (&addrset_treedef, &asadd->mcaddrs, &it); n; n = ut_avlCIterNext (&it))
+  for (n = ddsrt_avl_citer_first (&addrset_treedef, &asadd->mcaddrs, &it); n; n = ddsrt_avl_citer_next (&it))
   {
     if (!ddsi_is_ssm_mcaddr (&n->loc))
       add_to_addrset (as, &n->loc);
@@ -389,14 +389,14 @@ void addrset_purge_ssm (struct addrset *as)
 {
   struct addrset_node *n;
   LOCK (as);
-  n = ut_avlCFindMin (&addrset_treedef, &as->mcaddrs);
+  n = ddsrt_avl_cfind_min (&addrset_treedef, &as->mcaddrs);
   while (n)
   {
     struct addrset_node *n1 = n;
-    n = ut_avlCFindSucc (&addrset_treedef, &as->mcaddrs, n);
+    n = ddsrt_avl_cfind_succ (&addrset_treedef, &as->mcaddrs, n);
     if (ddsi_is_ssm_mcaddr (&n1->loc))
     {
-      ut_avlCDelete (&addrset_treedef, &as->mcaddrs, n1);
+      ddsrt_avl_cdelete (&addrset_treedef, &as->mcaddrs, n1);
       ddsrt_free (n1);
     }
   }
@@ -412,7 +412,7 @@ size_t addrset_count (const struct addrset *as)
   {
     size_t count;
     LOCK (as);
-    count = ut_avlCCount (&as->ucaddrs) + ut_avlCCount (&as->mcaddrs);
+    count = ddsrt_avl_ccount (&as->ucaddrs) + ddsrt_avl_ccount (&as->mcaddrs);
     UNLOCK (as);
     return count;
   }
@@ -426,7 +426,7 @@ size_t addrset_count_uc (const struct addrset *as)
   {
     size_t count;
     LOCK (as);
-    count = ut_avlCCount (&as->ucaddrs);
+    count = ddsrt_avl_ccount (&as->ucaddrs);
     UNLOCK (as);
     return count;
   }
@@ -440,7 +440,7 @@ size_t addrset_count_mc (const struct addrset *as)
   {
     size_t count;
     LOCK (as);
-    count = ut_avlCCount (&as->mcaddrs);
+    count = ddsrt_avl_ccount (&as->mcaddrs);
     UNLOCK (as);
     return count;
   }
@@ -450,7 +450,7 @@ int addrset_empty_uc (const struct addrset *as)
 {
   int isempty;
   LOCK (as);
-  isempty = ut_avlCIsEmpty (&as->ucaddrs);
+  isempty = ddsrt_avl_cis_empty (&as->ucaddrs);
   UNLOCK (as);
   return isempty;
 }
@@ -459,7 +459,7 @@ int addrset_empty_mc (const struct addrset *as)
 {
   int isempty;
   LOCK (as);
-  isempty = ut_avlCIsEmpty (&as->mcaddrs);
+  isempty = ddsrt_avl_cis_empty (&as->mcaddrs);
   UNLOCK (as);
   return isempty;
 }
@@ -468,7 +468,7 @@ int addrset_empty (const struct addrset *as)
 {
   int isempty;
   LOCK (as);
-  isempty = ut_avlCIsEmpty (&as->ucaddrs) && ut_avlCIsEmpty (&as->mcaddrs);
+  isempty = ddsrt_avl_cis_empty (&as->ucaddrs) && ddsrt_avl_cis_empty (&as->mcaddrs);
   UNLOCK (as);
   return isempty;
 }
@@ -476,14 +476,14 @@ int addrset_empty (const struct addrset *as)
 int addrset_any_uc (const struct addrset *as, nn_locator_t *dst)
 {
   LOCK (as);
-  if (ut_avlCIsEmpty (&as->ucaddrs))
+  if (ddsrt_avl_cis_empty (&as->ucaddrs))
   {
     UNLOCK (as);
     return 0;
   }
   else
   {
-    const struct addrset_node *n = ut_avlCRootNonEmpty (&addrset_treedef, &as->ucaddrs);
+    const struct addrset_node *n = ddsrt_avl_croot_non_empty (&addrset_treedef, &as->ucaddrs);
     *dst = n->loc;
     UNLOCK (as);
     return 1;
@@ -493,14 +493,14 @@ int addrset_any_uc (const struct addrset *as, nn_locator_t *dst)
 int addrset_any_mc (const struct addrset *as, nn_locator_t *dst)
 {
   LOCK (as);
-  if (ut_avlCIsEmpty (&as->mcaddrs))
+  if (ddsrt_avl_cis_empty (&as->mcaddrs))
   {
     UNLOCK (as);
     return 0;
   }
   else
   {
-    const struct addrset_node *n = ut_avlCRootNonEmpty (&addrset_treedef, &as->mcaddrs);
+    const struct addrset_node *n = ddsrt_avl_croot_non_empty (&addrset_treedef, &as->mcaddrs);
     *dst = n->loc;
     UNLOCK (as);
     return 1;
@@ -527,9 +527,9 @@ size_t addrset_forall_count (struct addrset *as, addrset_forall_fun_t f, void *a
   arg1.f = f;
   arg1.arg = arg;
   LOCK (as);
-  ut_avlCWalk (&addrset_treedef, &as->mcaddrs, addrset_forall_helper, &arg1);
-  ut_avlCWalk (&addrset_treedef, &as->ucaddrs, addrset_forall_helper, &arg1);
-  count = ut_avlCCount (&as->ucaddrs) + ut_avlCCount (&as->mcaddrs);
+  ddsrt_avl_cwalk (&addrset_treedef, &as->mcaddrs, addrset_forall_helper, &arg1);
+  ddsrt_avl_cwalk (&addrset_treedef, &as->ucaddrs, addrset_forall_helper, &arg1);
+  count = ddsrt_avl_ccount (&as->ucaddrs) + ddsrt_avl_ccount (&as->mcaddrs);
   UNLOCK (as);
   return count;
 }
@@ -543,22 +543,22 @@ int addrset_forone (struct addrset *as, addrset_forone_fun_t f, void *arg)
 {
   unsigned i;
   addrset_node_t n;
-  ut_avlCTree_t *trees[2];
-  ut_avlCIter_t iter;
+  ddsrt_avl_ctree_t *trees[2];
+  ddsrt_avl_citer_t iter;
 
   trees[0] = &as->mcaddrs;
   trees[1] = &as->ucaddrs;
 
   for (i = 0; i < 2u; i++)
   {
-    n = (addrset_node_t) ut_avlCIterFirst (&addrset_treedef, trees[i], &iter);
+    n = (addrset_node_t) ddsrt_avl_citer_first (&addrset_treedef, trees[i], &iter);
     while (n)
     {
       if ((f) (&n->loc, arg) > 0)
       {
         return 0;
       }
-      n = (addrset_node_t) ut_avlCIterNext (&iter);
+      n = (addrset_node_t) ddsrt_avl_citer_next (&iter);
     }
   }
   return -1;
@@ -588,14 +588,14 @@ void nn_log_addrset (uint32_t tf, const char *prefix, const struct addrset *as)
   }
 }
 
-static int addrset_eq_onesidederr1 (const ut_avlCTree_t *at, const ut_avlCTree_t *bt)
+static int addrset_eq_onesidederr1 (const ddsrt_avl_ctree_t *at, const ddsrt_avl_ctree_t *bt)
 {
   /* Just checking the root */
-  if (ut_avlCIsEmpty (at) && ut_avlCIsEmpty (bt)) {
+  if (ddsrt_avl_cis_empty (at) && ddsrt_avl_cis_empty (bt)) {
     return 1;
-  } else if (ut_avlCIsSingleton (at) && ut_avlCIsSingleton (bt)) {
-    const struct addrset_node *a = ut_avlCRootNonEmpty (&addrset_treedef, at);
-    const struct addrset_node *b = ut_avlCRootNonEmpty (&addrset_treedef, bt);
+  } else if (ddsrt_avl_cis_singleton (at) && ddsrt_avl_cis_singleton (bt)) {
+    const struct addrset_node *a = ddsrt_avl_croot_non_empty (&addrset_treedef, at);
+    const struct addrset_node *b = ddsrt_avl_croot_non_empty (&addrset_treedef, bt);
     return compare_locators (&a->loc, &b->loc) == 0;
   } else {
     return 0;
diff --git a/src/core/ddsi/src/q_config.c b/src/core/ddsi/src/q_config.c
index b613df8..5a412e8 100644
--- a/src/core/ddsi/src/q_config.c
+++ b/src/core/ddsi/src/q_config.c
@@ -24,15 +24,15 @@
 #include "dds/ddsrt/misc.h"
 #include "dds/ddsi/q_config.h"
 #include "dds/ddsi/q_log.h"
-#include "dds/util/ut_avl.h"
+#include "dds/ddsrt/avl.h"
 #include "dds/ddsi/q_unused.h"
 #include "dds/ddsi/q_misc.h"
 #include "dds/ddsi/q_addrset.h"
 #include "dds/ddsi/q_nwif.h"
 #include "dds/ddsi/q_error.h"
 
-#include "dds/util/ut_xmlparser.h"
-#include "dds/util/ut_expand_envvars.h"
+#include "dds/ddsrt/xmlparser.h"
+#include "dds/ddsrt/expand_envvars.h"
 
 #include "dds/version.h"
 
@@ -77,7 +77,7 @@ struct cfgst_nodekey {
 };
 
 struct cfgst_node {
-    ut_avlNode_t avlnode;
+    ddsrt_avl_node_t avlnode;
     struct cfgst_nodekey key;
     int count;
     int failed;
@@ -85,7 +85,7 @@ struct cfgst_node {
 };
 
 struct cfgst {
-    ut_avlTree_t found;
+    ddsrt_avl_tree_t found;
     struct config *cfg;
     /* error flag set so that we can continue parsing for some errors and still fail properly */
     int error;
@@ -119,8 +119,8 @@ the configuration, so we update this variable instead. */
 static uint32_t enabled_logcats;
 
 static int cfgst_node_cmp(const void *va, const void *vb);
-static const ut_avlTreedef_t cfgst_found_treedef =
-UT_AVL_TREEDEF_INITIALIZER(offsetof(struct cfgst_node, avlnode), offsetof(struct cfgst_node, key), cfgst_node_cmp, 0);
+static const ddsrt_avl_treedef_t cfgst_found_treedef =
+DDSRT_AVL_TREEDEF_INITIALIZER(offsetof(struct cfgst_node, avlnode), offsetof(struct cfgst_node, key), cfgst_node_cmp, 0);
 
 #define DU(fname) static int uf_##fname (struct cfgst *cfgst, void *parent, struct cfgelem const * const cfgelem, int first, const char *value)
 #define PF(fname) static void pf_##fname (struct cfgst *cfgst, void *parent, struct cfgelem const * const cfgelem, int is_default)
@@ -2067,10 +2067,10 @@ static int do_update(struct cfgst *cfgst, update_fun_t upd, void *parent, struct
 {
     struct cfgst_node *n;
     struct cfgst_nodekey key;
-    ut_avlIPath_t np;
+    ddsrt_avl_ipath_t np;
     int ok;
     key.e = cfgelem;
-    if ( (n = ut_avlLookupIPath(&cfgst_found_treedef, &cfgst->found, &key, &np)) == NULL ) {
+    if ( (n = ddsrt_avl_lookup_ipath(&cfgst_found_treedef, &cfgst->found, &key, &np)) == NULL ) {
         if ( (n = ddsrt_malloc(sizeof(*n))) == NULL )
             return cfg_error(cfgst, "out of memory");
 
@@ -2078,7 +2078,7 @@ static int do_update(struct cfgst *cfgst, update_fun_t upd, void *parent, struct
         n->count = 0;
         n->failed = 0;
         n->is_default = is_default;
-        ut_avlInsertIPath(&cfgst_found_treedef, &cfgst->found, n, &np);
+        ddsrt_avl_insert_ipath(&cfgst_found_treedef, &cfgst->found, n, &np);
     }
     if ( cfgelem->multiplicity == 0 || n->count < cfgelem->multiplicity )
         ok = upd(cfgst, parent, cfgelem, (n->count == n->failed), value);
@@ -2108,7 +2108,7 @@ static int set_defaults(struct cfgst *cfgst, void *parent, int isattr, struct cf
         key.e = ce;
         cfgst_push(cfgst, isattr, ce, parent);
         if ( ce->multiplicity == 1 ) {
-            if ( ut_avlLookup(&cfgst_found_treedef, &cfgst->found, &key) == NULL ) {
+            if ( ddsrt_avl_lookup(&cfgst_found_treedef, &cfgst->found, &key) == NULL ) {
                 if ( ce->update ) {
                     int ok1;
                     cfgst_push(cfgst, 0, NULL, NULL);
@@ -2117,9 +2117,9 @@ static int set_defaults(struct cfgst *cfgst, void *parent, int isattr, struct cf
                     ok = ok && ok1;
                 }
             }
-            if ( (n = ut_avlLookup(&cfgst_found_treedef, &cfgst->found, &key)) != NULL ) {
+            if ( (n = ddsrt_avl_lookup(&cfgst_found_treedef, &cfgst->found, &key)) != NULL ) {
                 if ( clear_found ) {
-                    ut_avlDelete(&cfgst_found_treedef, &cfgst->found, n);
+                    ddsrt_avl_delete(&cfgst_found_treedef, &cfgst->found, n);
                     ddsrt_free(n);
                 }
             }
@@ -2419,7 +2419,7 @@ static void print_configitems(struct cfgst *cfgst, void *parent, int isattr, str
         key.e = ce;
         cfgst_push(cfgst, isattr, ce, parent);
         if ( ce->multiplicity == 1 ) {
-            if ( (n = ut_avlLookup(&cfgst_found_treedef, &cfgst->found, &key)) != NULL ) {
+            if ( (n = ddsrt_avl_lookup(&cfgst_found_treedef, &cfgst->found, &key)) != NULL ) {
                 cfgst_push(cfgst, 0, NULL, NULL);
                 ce->print(cfgst, parent, ce, n->is_default);
                 cfgst_pop(cfgst);
@@ -2496,7 +2496,7 @@ static void free_configured_elements(struct cfgst *cfgst, void *parent, struct c
         if ( ce->name[0] == '>' ) /* moved, so don't care */
             continue;
         key.e = ce;
-        if ( (n = ut_avlLookup(&cfgst_found_treedef, &cfgst->found, &key)) != NULL ) {
+        if ( (n = ddsrt_avl_lookup(&cfgst_found_treedef, &cfgst->found, &key)) != NULL ) {
             if ( ce->free && n->count > n->failed )
                 ce->free(cfgst, parent, ce);
         }
@@ -2646,7 +2646,7 @@ static int proc_attr(void *varg, UNUSED_ARG(uintptr_t eleminfo), const char *nam
         return cfg_error(cfgst, "%s: unknown attribute", name);
     else {
         void *parent = cfgst_parent(cfgst);
-        char *xvalue = ut_expand_envvars(value);
+        char *xvalue = ddsrt_expand_envvars(value);
         int ok;
         cfgst_push(cfgst, 1, cfg_attr, parent);
         ok = do_update(cfgst, cfg_attr->update, parent, cfg_attr, xvalue, 0);
@@ -2666,7 +2666,7 @@ static int proc_elem_data(void *varg, UNUSED_ARG(uintptr_t eleminfo), const char
         return cfg_error(cfgst, "%s: no data expected", value);
     else {
         void *parent = cfgst_parent(cfgst);
-        char *xvalue = ut_expand_envvars(value);
+        char *xvalue = ddsrt_expand_envvars(value);
         int ok;
         cfgst_push(cfgst, 0, NULL, parent);
         ok = do_update(cfgst, cfgelem->update, parent, cfgelem, xvalue, 0);
@@ -2802,14 +2802,14 @@ struct cfgst * config_init (const char *configfile)
     cfgst = ddsrt_malloc(sizeof(*cfgst));
     memset(cfgst, 0, sizeof(*cfgst));
 
-    ut_avlInit(&cfgst_found_treedef, &cfgst->found);
+    ddsrt_avl_init(&cfgst_found_treedef, &cfgst->found);
     cfgst->cfg = &config;
     cfgst->error = 0;
 
     /* configfile == NULL will get you the default configuration */
     if (configfile) {
         char *copy = ddsrt_strdup(configfile), *cursor = copy;
-        struct ut_xmlpCallbacks cb;
+        struct ddsrt_xmlp_callbacks cb;
 
         cb.attr = proc_attr;
         cb.elem_close = proc_elem_close;
@@ -2818,14 +2818,14 @@ struct cfgst * config_init (const char *configfile)
         cb.error = proc_error;
 
         while (ok && cursor && cursor[0]) {
-            struct ut_xmlpState *qx;
+            struct ddsrt_xmlp_state *qx;
             FILE *fp;
             char *tok;
             tok = cursor;
             if (tok[0] == '<') {
                 /* Read XML directly from input string */
-                qx = ut_xmlpNewString (tok, cfgst, &cb);
-                ut_xmlpSetRequireEOF (qx, 0);
+                qx = ddsrt_xmlp_new_string (tok, cfgst, &cb);
+                ddsrt_xmlp_set_requireEOF (qx, 0);
                 fp = NULL;
             } else {
                 char *comma;
@@ -2845,11 +2845,11 @@ struct cfgst * config_init (const char *configfile)
                     }
                 }
                 DDSRT_WARNING_MSVC_ON(4996);
-                qx = ut_xmlpNewFile(fp, cfgst, &cb);
+                qx = ddsrt_xmlp_new_file(fp, cfgst, &cb);
             }
             cfgst_push(cfgst, 0, &root_cfgelem, &config);
 
-            ok = (ut_xmlpParse(qx) >= 0) && !cfgst->error;
+            ok = (ddsrt_xmlp_parse(qx) >= 0) && !cfgst->error;
             /* Pop until stack empty: error handling is rather brutal */
             assert(!ok || cfgst->path_depth == 1);
             while (cfgst->path_depth > 0) {
@@ -2858,9 +2858,9 @@ struct cfgst * config_init (const char *configfile)
             if (fp) {
                 fclose(fp);
             } else if (ok) {
-                cursor = tok + ut_xmlpGetBufpos (qx);
+                cursor = tok + ddsrt_xmlp_get_bufpos (qx);
             }
-            ut_xmlpFree(qx);
+            ddsrt_xmlp_free(qx);
             while (cursor && cursor[0] == ',') {
                 cursor++;
             }
@@ -3019,7 +3019,7 @@ struct cfgst * config_init (const char *configfile)
         config.valid = 1;
         return cfgst;
     } else {
-        ut_avlFree(&cfgst_found_treedef, &cfgst->found, ddsrt_free);
+        ddsrt_avl_free(&cfgst_found_treedef, &cfgst->found, ddsrt_free);
         ddsrt_free(cfgst);
         return NULL;
     }
@@ -3047,7 +3047,7 @@ void config_fini(struct cfgst *cfgst)
     memset(&config, 0, sizeof(config));
     config.valid = 0;
 
-    ut_avlFree(&cfgst_found_treedef, &cfgst->found, ddsrt_free);
+    ddsrt_avl_free(&cfgst_found_treedef, &cfgst->found, ddsrt_free);
     ddsrt_free(cfgst);
 }
 
diff --git a/src/core/ddsi/src/q_ddsi_discovery.c b/src/core/ddsi/src/q_ddsi_discovery.c
index bf5ec02..12ab0bc 100644
--- a/src/core/ddsi/src/q_ddsi_discovery.c
+++ b/src/core/ddsi/src/q_ddsi_discovery.c
@@ -20,7 +20,7 @@
 #include "dds/ddsrt/log.h"
 #include "dds/ddsrt/md5.h"
 #include "dds/ddsrt/sync.h"
-#include "dds/util/ut_avl.h"
+#include "dds/ddsrt/avl.h"
 #include "dds/ddsi/q_protocol.h"
 #include "dds/ddsi/q_rtps.h"
 #include "dds/ddsi/q_misc.h"
@@ -1767,7 +1767,7 @@ int builtins_dqueue_handler (const struct nn_rsample_info *sampleinfo, const str
     statusinfo = (qos.present & PP_STATUSINFO) ? qos.statusinfo : 0;
   }
 
-  if (pwr && ut_avlIsEmpty (&pwr->readers))
+  if (pwr && ddsrt_avl_is_empty (&pwr->readers))
   {
     /* Wasn't empty when enqueued, but needn't still be; SPDP has no
        proxy writer, and is always accepted */
diff --git a/src/core/ddsi/src/q_debmon.c b/src/core/ddsi/src/q_debmon.c
index 8043229..2e5358a 100644
--- a/src/core/ddsi/src/q_debmon.c
+++ b/src/core/ddsi/src/q_debmon.c
@@ -18,7 +18,7 @@
 #include "dds/ddsrt/sync.h"
 #include "dds/ddsrt/misc.h"
 
-#include "dds/util/ut_avl.h"
+#include "dds/ddsrt/avl.h"
 
 #include "dds/ddsi/q_entity.h"
 #include "dds/ddsi/q_config.h"
@@ -161,7 +161,7 @@ static int print_participants (struct thread_state1 * const ts1, ddsi_tran_conn_
       ephash_enum_reader_init (&er);
       while ((r = ephash_enum_reader_next (&er)) != NULL)
       {
-        ut_avlIter_t writ;
+        ddsrt_avl_iter_t writ;
         struct rd_pwr_match *m;
         if (r->c.pp != p)
           continue;
@@ -170,7 +170,7 @@ static int print_participants (struct thread_state1 * const ts1, ddsi_tran_conn_
 #ifdef DDSI_INCLUDE_NETWORK_PARTITIONS
         x += print_addrset_if_notempty (conn, "    as", r->as, "\n");
 #endif
-        for (m = ut_avlIterFirst (&rd_writers_treedef, &r->writers, &writ); m; m = ut_avlIterNext (&writ))
+        for (m = ddsrt_avl_iter_first (&rd_writers_treedef, &r->writers, &writ); m; m = ddsrt_avl_iter_next (&writ))
           x += cpf (conn, "    pwr %x:%x:%x:%x\n", PGUID (m->pwr_guid));
         ddsrt_mutex_unlock (&r->e.lock);
       }
@@ -183,7 +183,7 @@ static int print_participants (struct thread_state1 * const ts1, ddsi_tran_conn_
       ephash_enum_writer_init (&ew);
       while ((w = ephash_enum_writer_next (&ew)) != NULL)
       {
-        ut_avlIter_t rdit;
+        ddsrt_avl_iter_t rdit;
         struct wr_prd_match *m;
         struct whc_state whcst;
         if (w->c.pp != p)
@@ -207,7 +207,7 @@ static int print_participants (struct thread_state1 * const ts1, ddsi_tran_conn_
           x += cpf (conn, "    max-drop-seq %lld\n", writer_max_drop_seq (w));
         }
         x += print_addrset_if_notempty (conn, "    as", w->as, "\n");
-        for (m = ut_avlIterFirst (&wr_readers_treedef, &w->readers, &rdit); m; m = ut_avlIterNext (&rdit))
+        for (m = ddsrt_avl_iter_first (&wr_readers_treedef, &w->readers, &rdit); m; m = ddsrt_avl_iter_next (&rdit))
         {
           char wr_prd_flags[4];
           wr_prd_flags[0] = m->is_reliable ? 'R' : 'U';
@@ -248,13 +248,13 @@ static int print_proxy_participants (struct thread_state1 * const ts1, ddsi_tran
       ephash_enum_proxy_reader_init (&er);
       while ((r = ephash_enum_proxy_reader_next (&er)) != NULL)
       {
-        ut_avlIter_t writ;
+        ddsrt_avl_iter_t writ;
         struct prd_wr_match *m;
         if (r->c.proxypp != p)
           continue;
         ddsrt_mutex_lock (&r->e.lock);
         print_proxy_endpoint_common (conn, "prd", &r->e, &r->c);
-        for (m = ut_avlIterFirst (&rd_writers_treedef, &r->writers, &writ); m; m = ut_avlIterNext (&writ))
+        for (m = ddsrt_avl_iter_first (&rd_writers_treedef, &r->writers, &writ); m; m = ddsrt_avl_iter_next (&writ))
           x += cpf (conn, "    wr %x:%x:%x:%x\n", PGUID (m->wr_guid));
         ddsrt_mutex_unlock (&r->e.lock);
       }
@@ -267,14 +267,14 @@ static int print_proxy_participants (struct thread_state1 * const ts1, ddsi_tran
       ephash_enum_proxy_writer_init (&ew);
       while ((w = ephash_enum_proxy_writer_next (&ew)) != NULL)
       {
-        ut_avlIter_t rdit;
+        ddsrt_avl_iter_t rdit;
         struct pwr_rd_match *m;
         if (w->c.proxypp != p)
           continue;
         ddsrt_mutex_lock (&w->e.lock);
         print_proxy_endpoint_common (conn, "pwr", &w->e, &w->c);
         x += cpf (conn, "    last_seq %lld last_fragnum %u\n", w->last_seq, w->last_fragnum);
-        for (m = ut_avlIterFirst (&wr_readers_treedef, &w->readers, &rdit); m; m = ut_avlIterNext (&rdit))
+        for (m = ddsrt_avl_iter_first (&wr_readers_treedef, &w->readers, &rdit); m; m = ddsrt_avl_iter_next (&rdit))
         {
           x += cpf (conn, "    rd %x:%x:%x:%x (nack %lld %lld)\n",
                     PGUID (m->rd_guid), m->seq_last_nack, m->t_last_nack);
diff --git a/src/core/ddsi/src/q_entity.c b/src/core/ddsi/src/q_entity.c
index 2c5105c..25ef9ea 100644
--- a/src/core/ddsi/src/q_entity.c
+++ b/src/core/ddsi/src/q_entity.c
@@ -25,7 +25,7 @@
 #include "dds/ddsi/q_time.h"
 #include "dds/ddsi/q_misc.h"
 #include "dds/ddsi/q_log.h"
-#include "dds/util/ut_avl.h"
+#include "dds/ddsrt/avl.h"
 #include "dds/ddsi/q_plist.h"
 #include "dds/ddsi/q_lease.h"
 #include "dds/ddsi/q_qosmatch.h"
@@ -49,34 +49,34 @@
 #include "dds/ddsi/ddsi_tkmap.h"
 
 struct deleted_participant {
-  ut_avlNode_t avlnode;
+  ddsrt_avl_node_t avlnode;
   nn_guid_t guid;
   unsigned for_what;
   nn_mtime_t t_prune;
 };
 
 static ddsrt_mutex_t deleted_participants_lock;
-static ut_avlTree_t deleted_participants;
+static ddsrt_avl_tree_t deleted_participants;
 
 static int compare_guid (const void *va, const void *vb);
 static void augment_wr_prd_match (void *vnode, const void *vleft, const void *vright);
 
-const ut_avlTreedef_t wr_readers_treedef =
-  UT_AVL_TREEDEF_INITIALIZER (offsetof (struct wr_prd_match, avlnode), offsetof (struct wr_prd_match, prd_guid), compare_guid, augment_wr_prd_match);
-const ut_avlTreedef_t wr_local_readers_treedef =
-  UT_AVL_TREEDEF_INITIALIZER (offsetof (struct wr_rd_match, avlnode), offsetof (struct wr_rd_match, rd_guid), compare_guid, 0);
-const ut_avlTreedef_t rd_writers_treedef =
-  UT_AVL_TREEDEF_INITIALIZER (offsetof (struct rd_pwr_match, avlnode), offsetof (struct rd_pwr_match, pwr_guid), compare_guid, 0);
-const ut_avlTreedef_t rd_local_writers_treedef =
-  UT_AVL_TREEDEF_INITIALIZER (offsetof (struct rd_wr_match, avlnode), offsetof (struct rd_wr_match, wr_guid), compare_guid, 0);
-const ut_avlTreedef_t pwr_readers_treedef =
-  UT_AVL_TREEDEF_INITIALIZER (offsetof (struct pwr_rd_match, avlnode), offsetof (struct pwr_rd_match, rd_guid), compare_guid, 0);
-const ut_avlTreedef_t prd_writers_treedef =
-  UT_AVL_TREEDEF_INITIALIZER (offsetof (struct prd_wr_match, avlnode), offsetof (struct prd_wr_match, wr_guid), compare_guid, 0);
-const ut_avlTreedef_t deleted_participants_treedef =
-  UT_AVL_TREEDEF_INITIALIZER (offsetof (struct deleted_participant, avlnode), offsetof (struct deleted_participant, guid), compare_guid, 0);
-const ut_avlTreedef_t proxypp_groups_treedef =
-  UT_AVL_TREEDEF_INITIALIZER (offsetof (struct proxy_group, avlnode), offsetof (struct proxy_group, guid), compare_guid, 0);
+const ddsrt_avl_treedef_t wr_readers_treedef =
+  DDSRT_AVL_TREEDEF_INITIALIZER (offsetof (struct wr_prd_match, avlnode), offsetof (struct wr_prd_match, prd_guid), compare_guid, augment_wr_prd_match);
+const ddsrt_avl_treedef_t wr_local_readers_treedef =
+  DDSRT_AVL_TREEDEF_INITIALIZER (offsetof (struct wr_rd_match, avlnode), offsetof (struct wr_rd_match, rd_guid), compare_guid, 0);
+const ddsrt_avl_treedef_t rd_writers_treedef =
+  DDSRT_AVL_TREEDEF_INITIALIZER (offsetof (struct rd_pwr_match, avlnode), offsetof (struct rd_pwr_match, pwr_guid), compare_guid, 0);
+const ddsrt_avl_treedef_t rd_local_writers_treedef =
+  DDSRT_AVL_TREEDEF_INITIALIZER (offsetof (struct rd_wr_match, avlnode), offsetof (struct rd_wr_match, wr_guid), compare_guid, 0);
+const ddsrt_avl_treedef_t pwr_readers_treedef =
+  DDSRT_AVL_TREEDEF_INITIALIZER (offsetof (struct pwr_rd_match, avlnode), offsetof (struct pwr_rd_match, rd_guid), compare_guid, 0);
+const ddsrt_avl_treedef_t prd_writers_treedef =
+  DDSRT_AVL_TREEDEF_INITIALIZER (offsetof (struct prd_wr_match, avlnode), offsetof (struct prd_wr_match, wr_guid), compare_guid, 0);
+const ddsrt_avl_treedef_t deleted_participants_treedef =
+  DDSRT_AVL_TREEDEF_INITIALIZER (offsetof (struct deleted_participant, avlnode), offsetof (struct deleted_participant, guid), compare_guid, 0);
+const ddsrt_avl_treedef_t proxypp_groups_treedef =
+  DDSRT_AVL_TREEDEF_INITIALIZER (offsetof (struct proxy_group, avlnode), offsetof (struct proxy_group, guid), compare_guid, 0);
 
 static const unsigned builtin_writers_besmask =
   NN_DISC_BUILTIN_ENDPOINT_PARTICIPANT_ANNOUNCER |
@@ -267,13 +267,13 @@ nn_vendorid_t get_entity_vendorid (const struct entity_common *e)
 int deleted_participants_admin_init (void)
 {
   ddsrt_mutex_init (&deleted_participants_lock);
-  ut_avlInit (&deleted_participants_treedef, &deleted_participants);
+  ddsrt_avl_init (&deleted_participants_treedef, &deleted_participants);
   return 0;
 }
 
 void deleted_participants_admin_fini (void)
 {
-  ut_avlFree (&deleted_participants_treedef, &deleted_participants, ddsrt_free);
+  ddsrt_avl_free (&deleted_participants_treedef, &deleted_participants, ddsrt_free);
   ddsrt_mutex_destroy (&deleted_participants_lock);
 }
 
@@ -283,13 +283,13 @@ static void prune_deleted_participant_guids_unlocked (nn_mtime_t tnow)
      all circumstances, but I expect the tree to be very small at all
      times, so a full scan is fine, too ... */
   struct deleted_participant *dpp;
-  dpp = ut_avlFindMin (&deleted_participants_treedef, &deleted_participants);
+  dpp = ddsrt_avl_find_min (&deleted_participants_treedef, &deleted_participants);
   while (dpp)
   {
-    struct deleted_participant *dpp1 = ut_avlFindSucc (&deleted_participants_treedef, &deleted_participants, dpp);
+    struct deleted_participant *dpp1 = ddsrt_avl_find_succ (&deleted_participants_treedef, &deleted_participants, dpp);
     if (dpp->t_prune.v < tnow.v)
     {
-      ut_avlDelete (&deleted_participants_treedef, &deleted_participants, dpp);
+      ddsrt_avl_delete (&deleted_participants_treedef, &deleted_participants, dpp);
       ddsrt_free (dpp);
     }
     dpp = dpp1;
@@ -306,16 +306,16 @@ static void prune_deleted_participant_guids (nn_mtime_t tnow)
 static void remember_deleted_participant_guid (const struct nn_guid *guid)
 {
   struct deleted_participant *n;
-  ut_avlIPath_t path;
+  ddsrt_avl_ipath_t path;
   ddsrt_mutex_lock (&deleted_participants_lock);
-  if (ut_avlLookupIPath (&deleted_participants_treedef, &deleted_participants, guid, &path) == NULL)
+  if (ddsrt_avl_lookup_ipath (&deleted_participants_treedef, &deleted_participants, guid, &path) == NULL)
   {
     if ((n = ddsrt_malloc (sizeof (*n))) != NULL)
     {
       n->guid = *guid;
       n->t_prune.v = T_NEVER;
       n->for_what = DPG_LOCAL | DPG_REMOTE;
-      ut_avlInsertIPath (&deleted_participants_treedef, &deleted_participants, n, &path);
+      ddsrt_avl_insert_ipath (&deleted_participants_treedef, &deleted_participants, n, &path);
     }
   }
   ddsrt_mutex_unlock (&deleted_participants_lock);
@@ -327,7 +327,7 @@ int is_deleted_participant_guid (const struct nn_guid *guid, unsigned for_what)
   int known;
   ddsrt_mutex_lock (&deleted_participants_lock);
   prune_deleted_participant_guids_unlocked (now_mt());
-  if ((n = ut_avlLookup (&deleted_participants_treedef, &deleted_participants, guid)) == NULL)
+  if ((n = ddsrt_avl_lookup (&deleted_participants_treedef, &deleted_participants, guid)) == NULL)
     known = 0;
   else
     known = ((n->for_what & for_what) != 0);
@@ -340,7 +340,7 @@ static void remove_deleted_participant_guid (const struct nn_guid *guid, unsigne
   struct deleted_participant *n;
   DDS_LOG(DDS_LC_DISCOVERY, "remove_deleted_participant_guid(%x:%x:%x:%x for_what=%x)\n", PGUID (*guid), for_what);
   ddsrt_mutex_lock (&deleted_participants_lock);
-  if ((n = ut_avlLookup (&deleted_participants_treedef, &deleted_participants, guid)) != NULL)
+  if ((n = ddsrt_avl_lookup (&deleted_participants_treedef, &deleted_participants, guid)) != NULL)
   {
     if (config.prune_deleted_ppant.enforce_delay)
     {
@@ -357,7 +357,7 @@ static void remove_deleted_participant_guid (const struct nn_guid *guid, unsigne
       }
       else
       {
-        ut_avlDelete (&deleted_participants_treedef, &deleted_participants, n);
+        ddsrt_avl_delete (&deleted_participants_treedef, &deleted_participants, n);
         ddsrt_free (n);
       }
     }
@@ -971,13 +971,13 @@ static struct addrset *rebuild_make_all_addrs (int *nreaders, struct writer *wr)
 {
   struct addrset *all_addrs = new_addrset();
   struct wr_prd_match *m;
-  ut_avlIter_t it;
+  ddsrt_avl_iter_t it;
 #ifdef DDSI_INCLUDE_SSM
   if (wr->supports_ssm && wr->ssm_as)
     copy_addrset_into_addrset_mc (all_addrs, wr->ssm_as);
 #endif
   *nreaders = 0;
-  for (m = ut_avlIterFirst (&wr_readers_treedef, &wr->readers, &it); m; m = ut_avlIterNext (&it))
+  for (m = ddsrt_avl_iter_first (&wr_readers_treedef, &wr->readers, &it); m; m = ddsrt_avl_iter_next (&it))
   {
     struct proxy_reader *prd;
     if ((prd = ephash_lookup_proxy_reader_guid (&m->prd_guid)) == NULL)
@@ -1030,7 +1030,7 @@ static void rebuild_make_covered(int8_t **covered, const struct writer *wr, int
 {
   struct rebuild_flatten_locs_arg flarg;
   struct wr_prd_match *m;
-  ut_avlIter_t it;
+  ddsrt_avl_iter_t it;
   int rdidx, i, j;
   int8_t *cov = ddsrt_malloc((size_t) *nreaders * (size_t) nlocs * sizeof (*cov));
   for (i = 0; i < *nreaders * nlocs; i++)
@@ -1040,7 +1040,7 @@ static void rebuild_make_covered(int8_t **covered, const struct writer *wr, int
 #ifndef NDEBUG
   flarg.size = nlocs;
 #endif
-  for (m = ut_avlIterFirst (&wr_readers_treedef, &wr->readers, &it); m; m = ut_avlIterNext (&it))
+  for (m = ddsrt_avl_iter_first (&wr_readers_treedef, &wr->readers, &it); m; m = ddsrt_avl_iter_next (&it))
   {
     struct proxy_reader *prd;
     struct addrset *ass[] = { NULL, NULL, NULL };
@@ -1337,10 +1337,10 @@ static void writer_drop_connection (const struct nn_guid * wr_guid, const struct
     struct whc_node *deferred_free_list = NULL;
     struct wr_prd_match *m;
     ddsrt_mutex_lock (&wr->e.lock);
-    if ((m = ut_avlLookup (&wr_readers_treedef, &wr->readers, &prd->e.guid)) != NULL)
+    if ((m = ddsrt_avl_lookup (&wr_readers_treedef, &wr->readers, &prd->e.guid)) != NULL)
     {
       struct whc_state whcst;
-      ut_avlDelete (&wr_readers_treedef, &wr->readers, m);
+      ddsrt_avl_delete (&wr_readers_treedef, &wr->readers, m);
       rebuild_writer_addrset (wr);
       remove_acked_messages (wr, &whcst, &deferred_free_list);
       wr->num_reliable_readers -= m->is_reliable;
@@ -1368,9 +1368,9 @@ static void writer_drop_local_connection (const struct nn_guid *wr_guid, struct
     struct wr_rd_match *m;
 
     ddsrt_mutex_lock (&wr->e.lock);
-    if ((m = ut_avlLookup (&wr_local_readers_treedef, &wr->local_readers, &rd->e.guid)) != NULL)
+    if ((m = ddsrt_avl_lookup (&wr_local_readers_treedef, &wr->local_readers, &rd->e.guid)) != NULL)
     {
-      ut_avlDelete (&wr_local_readers_treedef, &wr->local_readers, m);
+      ddsrt_avl_delete (&wr_local_readers_treedef, &wr->local_readers, m);
       local_reader_ary_remove (&wr->rdary, rd);
     }
     ddsrt_mutex_unlock (&wr->e.lock);
@@ -1393,8 +1393,8 @@ static void reader_drop_connection (const struct nn_guid *rd_guid, const struct
   {
     struct rd_pwr_match *m;
     ddsrt_mutex_lock (&rd->e.lock);
-    if ((m = ut_avlLookup (&rd_writers_treedef, &rd->writers, &pwr->e.guid)) != NULL)
-      ut_avlDelete (&rd_writers_treedef, &rd->writers, m);
+    if ((m = ddsrt_avl_lookup (&rd_writers_treedef, &rd->writers, &pwr->e.guid)) != NULL)
+      ddsrt_avl_delete (&rd_writers_treedef, &rd->writers, m);
     ddsrt_mutex_unlock (&rd->e.lock);
     free_rd_pwr_match (m);
 
@@ -1427,8 +1427,8 @@ static void reader_drop_local_connection (const struct nn_guid *rd_guid, const s
   {
     struct rd_wr_match *m;
     ddsrt_mutex_lock (&rd->e.lock);
-    if ((m = ut_avlLookup (&rd_local_writers_treedef, &rd->local_writers, &wr->e.guid)) != NULL)
-      ut_avlDelete (&rd_local_writers_treedef, &rd->local_writers, m);
+    if ((m = ddsrt_avl_lookup (&rd_local_writers_treedef, &rd->local_writers, &wr->e.guid)) != NULL)
+      ddsrt_avl_delete (&rd_local_writers_treedef, &rd->local_writers, m);
     ddsrt_mutex_unlock (&rd->e.lock);
     free_rd_wr_match (m);
 
@@ -1486,9 +1486,9 @@ static void proxy_writer_drop_connection (const struct nn_guid *pwr_guid, struct
     struct pwr_rd_match *m;
 
     ddsrt_mutex_lock (&pwr->e.lock);
-    if ((m = ut_avlLookup (&pwr_readers_treedef, &pwr->readers, &rd->e.guid)) != NULL)
+    if ((m = ddsrt_avl_lookup (&pwr_readers_treedef, &pwr->readers, &rd->e.guid)) != NULL)
     {
-      ut_avlDelete (&pwr_readers_treedef, &pwr->readers, m);
+      ddsrt_avl_delete (&pwr_readers_treedef, &pwr->readers, m);
       if (m->in_sync != PRMSS_SYNC)
         pwr->n_readers_out_of_sync--;
       if (rd->reliable)
@@ -1512,10 +1512,10 @@ static void proxy_reader_drop_connection
   {
     struct prd_wr_match *m;
     ddsrt_mutex_lock (&prd->e.lock);
-    m = ut_avlLookup (&prd_writers_treedef, &prd->writers, &wr->e.guid);
+    m = ddsrt_avl_lookup (&prd_writers_treedef, &prd->writers, &wr->e.guid);
     if (m)
     {
-      ut_avlDelete (&prd_writers_treedef, &prd->writers, m);
+      ddsrt_avl_delete (&prd_writers_treedef, &prd->writers, m);
     }
     ddsrt_mutex_unlock (&prd->e.lock);
     free_prd_wr_match (m);
@@ -1525,7 +1525,7 @@ static void proxy_reader_drop_connection
 static void writer_add_connection (struct writer *wr, struct proxy_reader *prd)
 {
   struct wr_prd_match *m = ddsrt_malloc (sizeof (*m));
-  ut_avlIPath_t path;
+  ddsrt_avl_ipath_t path;
   int pretend_everything_acked;
   m->prd_guid = prd->e.guid;
   m->is_reliable = (prd->c.xqos->reliability.kind > NN_BEST_EFFORT_RELIABILITY_QOS);
@@ -1564,7 +1564,7 @@ static void writer_add_connection (struct writer *wr, struct proxy_reader *prd)
     m->seq = MAX_SEQ_NUMBER;
   else
     m->seq = wr->seq;
-  if (ut_avlLookupIPath (&wr_readers_treedef, &wr->readers, &prd->e.guid, &path))
+  if (ddsrt_avl_lookup_ipath (&wr_readers_treedef, &wr->readers, &prd->e.guid, &path))
   {
     DDS_LOG(DDS_LC_DISCOVERY, "  writer_add_connection(wr %x:%x:%x:%x prd %x:%x:%x:%x) - already connected\n", PGUID (wr->e.guid), PGUID (prd->e.guid));
     ddsrt_mutex_unlock (&wr->e.lock);
@@ -1574,7 +1574,7 @@ static void writer_add_connection (struct writer *wr, struct proxy_reader *prd)
   else
   {
     DDS_LOG(DDS_LC_DISCOVERY, "  writer_add_connection(wr %x:%x:%x:%x prd %x:%x:%x:%x) - ack seq %"PRId64"\n", PGUID (wr->e.guid), PGUID (prd->e.guid), m->seq);
-    ut_avlInsertIPath (&wr_readers_treedef, &wr->readers, m, &path);
+    ddsrt_avl_insert_ipath (&wr_readers_treedef, &wr->readers, m, &path);
     rebuild_writer_addrset (wr);
     wr->num_reliable_readers += m->is_reliable;
     ddsrt_mutex_unlock (&wr->e.lock);
@@ -1618,10 +1618,10 @@ static void writer_add_connection (struct writer *wr, struct proxy_reader *prd)
 static void writer_add_local_connection (struct writer *wr, struct reader *rd)
 {
   struct wr_rd_match *m = ddsrt_malloc (sizeof (*m));
-  ut_avlIPath_t path;
+  ddsrt_avl_ipath_t path;
 
   ddsrt_mutex_lock (&wr->e.lock);
-  if (ut_avlLookupIPath (&wr_local_readers_treedef, &wr->local_readers, &rd->e.guid, &path))
+  if (ddsrt_avl_lookup_ipath (&wr_local_readers_treedef, &wr->local_readers, &rd->e.guid, &path))
   {
     DDS_LOG(DDS_LC_DISCOVERY, "  writer_add_local_connection(wr %x:%x:%x:%x rd %x:%x:%x:%x) - already connected\n", PGUID (wr->e.guid), PGUID (rd->e.guid));
     ddsrt_mutex_unlock (&wr->e.lock);
@@ -1631,7 +1631,7 @@ static void writer_add_local_connection (struct writer *wr, struct reader *rd)
 
   DDS_LOG(DDS_LC_DISCOVERY, "  writer_add_local_connection(wr %x:%x:%x:%x rd %x:%x:%x:%x)", PGUID (wr->e.guid), PGUID (rd->e.guid));
   m->rd_guid = rd->e.guid;
-  ut_avlInsertIPath (&wr_local_readers_treedef, &wr->local_readers, m, &path);
+  ddsrt_avl_insert_ipath (&wr_local_readers_treedef, &wr->local_readers, m, &path);
   local_reader_ary_insert (&wr->rdary, rd);
 
   /* Store available data into the late joining reader when it is reliable (we don't do
@@ -1672,7 +1672,7 @@ static void writer_add_local_connection (struct writer *wr, struct reader *rd)
 static void reader_add_connection (struct reader *rd, struct proxy_writer *pwr, nn_count_t *init_count)
 {
   struct rd_pwr_match *m = ddsrt_malloc (sizeof (*m));
-  ut_avlIPath_t path;
+  ddsrt_avl_ipath_t path;
 
   m->pwr_guid = pwr->e.guid;
 
@@ -1687,7 +1687,7 @@ static void reader_add_connection (struct reader *rd, struct proxy_writer *pwr,
   DDS_LOG(DDS_LC_DISCOVERY, "  reader %x:%x:%x:%x init_acknack_count = %d\n", PGUID (rd->e.guid), rd->init_acknack_count);
   *init_count = rd->init_acknack_count;
 
-  if (ut_avlLookupIPath (&rd_writers_treedef, &rd->writers, &pwr->e.guid, &path))
+  if (ddsrt_avl_lookup_ipath (&rd_writers_treedef, &rd->writers, &pwr->e.guid, &path))
   {
     DDS_LOG(DDS_LC_DISCOVERY, "  reader_add_connection(pwr %x:%x:%x:%x rd %x:%x:%x:%x) - already connected\n",
             PGUID (pwr->e.guid), PGUID (rd->e.guid));
@@ -1698,7 +1698,7 @@ static void reader_add_connection (struct reader *rd, struct proxy_writer *pwr,
   {
     DDS_LOG(DDS_LC_DISCOVERY, "  reader_add_connection(pwr %x:%x:%x:%x rd %x:%x:%x:%x)\n",
             PGUID (pwr->e.guid), PGUID (rd->e.guid));
-    ut_avlInsertIPath (&rd_writers_treedef, &rd->writers, m, &path);
+    ddsrt_avl_insert_ipath (&rd_writers_treedef, &rd->writers, m, &path);
     ddsrt_mutex_unlock (&rd->e.lock);
 
 #ifdef DDSI_INCLUDE_SSM
@@ -1736,13 +1736,13 @@ static void reader_add_connection (struct reader *rd, struct proxy_writer *pwr,
 static void reader_add_local_connection (struct reader *rd, struct writer *wr)
 {
   struct rd_wr_match *m = ddsrt_malloc (sizeof (*m));
-  ut_avlIPath_t path;
+  ddsrt_avl_ipath_t path;
 
   m->wr_guid = wr->e.guid;
 
   ddsrt_mutex_lock (&rd->e.lock);
 
-  if (ut_avlLookupIPath (&rd_local_writers_treedef, &rd->local_writers, &wr->e.guid, &path))
+  if (ddsrt_avl_lookup_ipath (&rd_local_writers_treedef, &rd->local_writers, &wr->e.guid, &path))
   {
     DDS_LOG(DDS_LC_DISCOVERY, "  reader_add_local_connection(wr %x:%x:%x:%x rd %x:%x:%x:%x) - already connected\n", PGUID (wr->e.guid), PGUID (rd->e.guid));
     ddsrt_mutex_unlock (&rd->e.lock);
@@ -1751,7 +1751,7 @@ static void reader_add_local_connection (struct reader *rd, struct writer *wr)
   else
   {
     DDS_LOG(DDS_LC_DISCOVERY, "  reader_add_local_connection(wr %x:%x:%x:%x rd %x:%x:%x:%x)\n", PGUID (wr->e.guid), PGUID (rd->e.guid));
-    ut_avlInsertIPath (&rd_local_writers_treedef, &rd->local_writers, m, &path);
+    ddsrt_avl_insert_ipath (&rd_local_writers_treedef, &rd->local_writers, m, &path);
     ddsrt_mutex_unlock (&rd->e.lock);
 
     if (rd->status_cb)
@@ -1772,11 +1772,11 @@ static void reader_add_local_connection (struct reader *rd, struct writer *wr)
 static void proxy_writer_add_connection (struct proxy_writer *pwr, struct reader *rd, nn_mtime_t tnow, nn_count_t init_count)
 {
   struct pwr_rd_match *m = ddsrt_malloc (sizeof (*m));
-  ut_avlIPath_t path;
+  ddsrt_avl_ipath_t path;
   seqno_t last_deliv_seq;
 
   ddsrt_mutex_lock (&pwr->e.lock);
-  if (ut_avlLookupIPath (&pwr_readers_treedef, &pwr->readers, &rd->e.guid, &path))
+  if (ddsrt_avl_lookup_ipath (&pwr_readers_treedef, &pwr->readers, &rd->e.guid, &path))
     goto already_matched;
 
   if (pwr->c.topic == NULL && rd->topic)
@@ -1816,7 +1816,7 @@ static void proxy_writer_add_connection (struct proxy_writer *pwr, struct reader
   {
     m->in_sync = PRMSS_SYNC;
   }
-  else if (!config.conservative_builtin_reader_startup && is_builtin_entityid (rd->e.guid.entityid, NN_VENDORID_ECLIPSE) && !ut_avlIsEmpty (&pwr->readers))
+  else if (!config.conservative_builtin_reader_startup && is_builtin_entityid (rd->e.guid.entityid, NN_VENDORID_ECLIPSE) && !ddsrt_avl_is_empty (&pwr->readers))
   {
     /* builtins really don't care about multiple copies */
     m->in_sync = PRMSS_SYNC;
@@ -1860,7 +1860,7 @@ static void proxy_writer_add_connection (struct proxy_writer *pwr, struct reader
       nn_reorder_new (NN_REORDER_MODE_MONOTONICALLY_INCREASING, config.secondary_reorder_maxsamples);
   }
 
-  ut_avlInsertIPath (&pwr_readers_treedef, &pwr->readers, m, &path);
+  ddsrt_avl_insert_ipath (&pwr_readers_treedef, &pwr->readers, m, &path);
   local_reader_ary_insert(&pwr->rdary, rd);
   ddsrt_mutex_unlock (&pwr->e.lock);
   qxev_pwr_entityid (pwr, &rd->e.guid.prefix);
@@ -1890,13 +1890,13 @@ already_matched:
 static void proxy_reader_add_connection (struct proxy_reader *prd, struct writer *wr)
 {
   struct prd_wr_match *m = ddsrt_malloc (sizeof (*m));
-  ut_avlIPath_t path;
+  ddsrt_avl_ipath_t path;
 
   m->wr_guid = wr->e.guid;
   ddsrt_mutex_lock (&prd->e.lock);
   if (prd->c.topic == NULL)
     prd->c.topic = ddsi_sertopic_ref (wr->topic);
-  if (ut_avlLookupIPath (&prd_writers_treedef, &prd->writers, &wr->e.guid, &path))
+  if (ddsrt_avl_lookup_ipath (&prd_writers_treedef, &prd->writers, &wr->e.guid, &path))
   {
     DDS_LOG(DDS_LC_DISCOVERY, "  proxy_reader_add_connection(wr %x:%x:%x:%x prd %x:%x:%x:%x) - already connected\n",
             PGUID (wr->e.guid), PGUID (prd->e.guid));
@@ -1907,7 +1907,7 @@ static void proxy_reader_add_connection (struct proxy_reader *prd, struct writer
   {
     DDS_LOG(DDS_LC_DISCOVERY, "  proxy_reader_add_connection(wr %x:%x:%x:%x prd %x:%x:%x:%x)\n",
             PGUID (wr->e.guid), PGUID (prd->e.guid));
-    ut_avlInsertIPath (&prd_writers_treedef, &prd->writers, m, &path);
+    ddsrt_avl_insert_ipath (&prd_writers_treedef, &prd->writers, m, &path);
     ddsrt_mutex_unlock (&prd->e.lock);
     qxev_prd_entityid (prd, &wr->e.guid.prefix);
   }
@@ -2539,15 +2539,15 @@ static void augment_wr_prd_match (void *vnode, const void *vleft, const void *vr
 seqno_t writer_max_drop_seq (const struct writer *wr)
 {
   const struct wr_prd_match *n;
-  if (ut_avlIsEmpty (&wr->readers))
+  if (ddsrt_avl_is_empty (&wr->readers))
     return wr->seq;
-  n = ut_avlRootNonEmpty (&wr_readers_treedef, &wr->readers);
+  n = ddsrt_avl_root_non_empty (&wr_readers_treedef, &wr->readers);
   return (n->min_seq == MAX_SEQ_NUMBER) ? wr->seq : n->min_seq;
 }
 
 int writer_must_have_hb_scheduled (const struct writer *wr, const struct whc_state *whcst)
 {
-  if (ut_avlIsEmpty (&wr->readers) || whcst->max_seq < 0)
+  if (ddsrt_avl_is_empty (&wr->readers) || whcst->max_seq < 0)
   {
     /* Can't transmit a valid heartbeat if there is no data; and it
        wouldn't actually be sent anywhere if there are no readers, so
@@ -2558,7 +2558,7 @@ int writer_must_have_hb_scheduled (const struct writer *wr, const struct whc_sta
        a heartbeat if no data is available. */
     return 0;
   }
-  else if (!((const struct wr_prd_match *) ut_avlRootNonEmpty (&wr_readers_treedef, &wr->readers))->all_have_replied_to_hb)
+  else if (!((const struct wr_prd_match *) ddsrt_avl_root_non_empty (&wr_readers_treedef, &wr->readers))->all_have_replied_to_hb)
   {
     /* Labouring under the belief that heartbeats must be sent
        regardless of ack state */
@@ -2800,8 +2800,8 @@ static void new_writer_guid_common_init (struct writer *wr, const struct ddsi_se
   assert (!is_builtin_entityid(wr->e.guid.entityid, NN_VENDORID_ECLIPSE) || (wr->whc_low == wr->whc_high && wr->whc_low == INT32_MAX));
 
   /* Connection admin */
-  ut_avlInit (&wr_readers_treedef, &wr->readers);
-  ut_avlInit (&wr_local_readers_treedef, &wr->local_readers);
+  ddsrt_avl_init (&wr_readers_treedef, &wr->readers);
+  ddsrt_avl_init (&wr_local_readers_treedef, &wr->local_readers);
 
   local_reader_ary_init (&wr->rdary);
 }
@@ -2917,17 +2917,17 @@ static void gc_delete_writer (struct gcreq *gcreq)
       us now, because we can't be found via guid_hash anymore.  We
       therefore need not take lock. */
 
-  while (!ut_avlIsEmpty (&wr->readers))
+  while (!ddsrt_avl_is_empty (&wr->readers))
   {
-    struct wr_prd_match *m = ut_avlRootNonEmpty (&wr_readers_treedef, &wr->readers);
-    ut_avlDelete (&wr_readers_treedef, &wr->readers, m);
+    struct wr_prd_match *m = ddsrt_avl_root_non_empty (&wr_readers_treedef, &wr->readers);
+    ddsrt_avl_delete (&wr_readers_treedef, &wr->readers, m);
     proxy_reader_drop_connection (&m->prd_guid, wr);
     free_wr_prd_match (m);
   }
-  while (!ut_avlIsEmpty (&wr->local_readers))
+  while (!ddsrt_avl_is_empty (&wr->local_readers))
   {
-    struct wr_rd_match *m = ut_avlRootNonEmpty (&wr_local_readers_treedef, &wr->local_readers);
-    ut_avlDelete (&wr_local_readers_treedef, &wr->local_readers, m);
+    struct wr_rd_match *m = ddsrt_avl_root_non_empty (&wr_local_readers_treedef, &wr->local_readers);
+    ddsrt_avl_delete (&wr_local_readers_treedef, &wr->local_readers, m);
     reader_drop_local_connection (&m->rd_guid, wr);
     free_wr_rd_match (m);
   }
@@ -3324,8 +3324,8 @@ static dds_retcode_t new_reader_guid
 #endif
 #endif
 
-  ut_avlInit (&rd_writers_treedef, &rd->writers);
-  ut_avlInit (&rd_local_writers_treedef, &rd->local_writers);
+  ddsrt_avl_init (&rd_writers_treedef, &rd->writers);
+  ddsrt_avl_init (&rd_local_writers_treedef, &rd->local_writers);
 
   ddsrt_mutex_lock (&rd->e.lock);
   ephash_insert_reader_guid (rd);
@@ -3371,17 +3371,17 @@ static void gc_delete_reader (struct gcreq *gcreq)
   DDS_LOG(DDS_LC_DISCOVERY, "gc_delete_reader(%p, %x:%x:%x:%x)\n", (void *) gcreq, PGUID (rd->e.guid));
   gcreq_free (gcreq);
 
-  while (!ut_avlIsEmpty (&rd->writers))
+  while (!ddsrt_avl_is_empty (&rd->writers))
   {
-    struct rd_pwr_match *m = ut_avlRootNonEmpty (&rd_writers_treedef, &rd->writers);
-    ut_avlDelete (&rd_writers_treedef, &rd->writers, m);
+    struct rd_pwr_match *m = ddsrt_avl_root_non_empty (&rd_writers_treedef, &rd->writers);
+    ddsrt_avl_delete (&rd_writers_treedef, &rd->writers, m);
     proxy_writer_drop_connection (&m->pwr_guid, rd);
     free_rd_pwr_match (m);
   }
-  while (!ut_avlIsEmpty (&rd->local_writers))
+  while (!ddsrt_avl_is_empty (&rd->local_writers))
   {
-    struct rd_wr_match *m = ut_avlRootNonEmpty (&rd_local_writers_treedef, &rd->local_writers);
-    ut_avlDelete (&rd_local_writers_treedef, &rd->local_writers, m);
+    struct rd_wr_match *m = ddsrt_avl_root_non_empty (&rd_local_writers_treedef, &rd->local_writers);
+    ddsrt_avl_delete (&rd_local_writers_treedef, &rd->local_writers, m);
     writer_drop_local_connection (&m->wr_guid, rd);
     free_rd_wr_match (m);
   }
@@ -3552,7 +3552,7 @@ void new_proxy_participant
   proxypp->as_meta = as_meta;
   proxypp->endpoints = NULL;
   proxypp->plist = nn_plist_dup (plist);
-  ut_avlInit (&proxypp_groups_treedef, &proxypp->groups);
+  ddsrt_avl_init (&proxypp_groups_treedef, &proxypp->groups);
 
 
   if (custom_flags & CF_INC_KERNEL_SEQUENCE_NUMBERS)
@@ -3851,8 +3851,8 @@ static void delete_ppt (struct proxy_participant * proxypp, nn_wctime_t timestam
     proxypp->lease_expired = 1;
 
   DDS_LOG(DDS_LC_DISCOVERY, "delete_ppt(%x:%x:%x:%x) - deleting groups\n", PGUID (proxypp->e.guid));
-  while (!ut_avlIsEmpty (&proxypp->groups))
-    delete_proxy_group_locked (ut_avlRoot (&proxypp_groups_treedef, &proxypp->groups), timestamp, isimplicit);
+  while (!ddsrt_avl_is_empty (&proxypp->groups))
+    delete_proxy_group_locked (ddsrt_avl_root (&proxypp_groups_treedef, &proxypp->groups), timestamp, isimplicit);
 
   DDS_LOG(DDS_LC_DISCOVERY, "delete_ppt(%x:%x:%x:%x) - deleting endpoints\n", PGUID (proxypp->e.guid));
   c = proxypp->endpoints;
@@ -3965,7 +3965,7 @@ int new_proxy_group (const struct nn_guid *guid, const char *name, const struct
   else
   {
     struct proxy_group *pgroup;
-    ut_avlIPath_t ipath;
+    ddsrt_avl_ipath_t ipath;
     int is_sub;
     switch (guid->entityid.u & (NN_ENTITYID_SOURCE_MASK | NN_ENTITYID_KIND_MASK))
     {
@@ -3980,7 +3980,7 @@ int new_proxy_group (const struct nn_guid *guid, const char *name, const struct
         return Q_ERR_INVALID_DATA;
     }
     ddsrt_mutex_lock (&proxypp->e.lock);
-    if ((pgroup = ut_avlLookupIPath (&proxypp_groups_treedef, &proxypp->groups, guid, &ipath)) != NULL)
+    if ((pgroup = ddsrt_avl_lookup_ipath (&proxypp_groups_treedef, &proxypp->groups, guid, &ipath)) != NULL)
     {
       /* Complete proxy group definition if it was a partial
          definition made by creating a proxy reader or writer,
@@ -3997,7 +3997,7 @@ int new_proxy_group (const struct nn_guid *guid, const char *name, const struct
       pgroup->proxypp = proxypp;
       pgroup->name = NULL;
       pgroup->xqos = NULL;
-      ut_avlInsertIPath (&proxypp_groups_treedef, &proxypp->groups, pgroup, &ipath);
+      ddsrt_avl_insert_ipath (&proxypp_groups_treedef, &proxypp->groups, pgroup, &ipath);
     }
     if (name)
     {
@@ -4021,7 +4021,7 @@ static void delete_proxy_group_locked (struct proxy_group *pgroup, nn_wctime_t t
   (void)isimplicit;
   assert ((pgroup->xqos != NULL) == (pgroup->name != NULL));
   DDS_LOG(DDS_LC_DISCOVERY, "delete_proxy_group_locked %x:%x:%x:%x\n", PGUID (pgroup->guid));
-  ut_avlDelete (&proxypp_groups_treedef, &proxypp->groups, pgroup);
+  ddsrt_avl_delete (&proxypp_groups_treedef, &proxypp->groups, pgroup);
   /* Publish corresponding built-in topic only if it is not a place
      holder: in that case we haven't announced its presence and
      therefore don't need to dispose it, and this saves us from having
@@ -4046,7 +4046,7 @@ void delete_proxy_group (const nn_guid_t *guid, nn_wctime_t timestamp, int isimp
   {
     struct proxy_group *pgroup;
     ddsrt_mutex_lock (&proxypp->e.lock);
-    if ((pgroup = ut_avlLookup (&proxypp_groups_treedef, &proxypp->groups, guid)) != NULL)
+    if ((pgroup = ddsrt_avl_lookup (&proxypp_groups_treedef, &proxypp->groups, guid)) != NULL)
       delete_proxy_group_locked (pgroup, timestamp, isimplicit);
     ddsrt_mutex_unlock (&proxypp->e.lock);
   }
@@ -4112,7 +4112,7 @@ int new_proxy_writer (const struct nn_guid *ppguid, const struct nn_guid *guid,
   pwr = ddsrt_malloc (sizeof (*pwr));
   proxy_endpoint_common_init (&pwr->e, &pwr->c, EK_PROXY_WRITER, guid, timestamp, proxypp, as, plist);
 
-  ut_avlInit (&pwr_readers_treedef, &pwr->readers);
+  ddsrt_avl_init (&pwr_readers_treedef, &pwr->readers);
   pwr->n_reliable_readers = 0;
   pwr->n_readers_out_of_sync = 0;
   pwr->last_seq = 0;
@@ -4195,7 +4195,7 @@ void update_proxy_writer (struct proxy_writer * pwr, struct addrset * as)
 {
   struct reader * rd;
   struct  pwr_rd_match * m;
-  ut_avlIter_t iter;
+  ddsrt_avl_iter_t iter;
 
   /* Update proxy writer endpoints (from SEDP alive) */
 
@@ -4208,7 +4208,7 @@ void update_proxy_writer (struct proxy_writer * pwr, struct addrset * as)
     unref_addrset (pwr->c.as);
     ref_addrset (as);
     pwr->c.as = as;
-    m = ut_avlIterFirst (&pwr_readers_treedef, &pwr->readers, &iter);
+    m = ddsrt_avl_iter_first (&pwr_readers_treedef, &pwr->readers, &iter);
     while (m)
     {
       rd = ephash_lookup_reader_guid (&m->rd_guid);
@@ -4216,7 +4216,7 @@ void update_proxy_writer (struct proxy_writer * pwr, struct addrset * as)
       {
         qxev_pwr_entityid (pwr, &rd->e.guid.prefix);
       }
-      m = ut_avlIterNext (&iter);
+      m = ddsrt_avl_iter_next (&iter);
     }
   }
   ddsrt_mutex_unlock (&pwr->e.lock);
@@ -4240,14 +4240,14 @@ void update_proxy_reader (struct proxy_reader * prd, struct addrset * as)
 
     /* Rebuild writer endpoints */
 
-    while ((m = ut_avlLookupSuccEq (&prd_writers_treedef, &prd->writers, &wrguid)) != NULL)
+    while ((m = ddsrt_avl_lookup_succ_eq (&prd_writers_treedef, &prd->writers, &wrguid)) != NULL)
     {
       struct prd_wr_match *next;
       nn_guid_t guid_next;
       struct writer * wr;
 
       wrguid = m->wr_guid;
-      next = ut_avlFindSucc (&prd_writers_treedef, &prd->writers, m);
+      next = ddsrt_avl_find_succ (&prd_writers_treedef, &prd->writers, m);
       if (next)
       {
         guid_next = next->wr_guid;
@@ -4280,10 +4280,10 @@ static void gc_delete_proxy_writer (struct gcreq *gcreq)
   DDS_LOG(DDS_LC_DISCOVERY, "gc_delete_proxy_writer(%p, %x:%x:%x:%x)\n", (void *) gcreq, PGUID (pwr->e.guid));
   gcreq_free (gcreq);
 
-  while (!ut_avlIsEmpty (&pwr->readers))
+  while (!ddsrt_avl_is_empty (&pwr->readers))
   {
-    struct pwr_rd_match *m = ut_avlRootNonEmpty (&pwr_readers_treedef, &pwr->readers);
-    ut_avlDelete (&pwr_readers_treedef, &pwr->readers, m);
+    struct pwr_rd_match *m = ddsrt_avl_root_non_empty (&pwr_readers_treedef, &pwr->readers);
+    ddsrt_avl_delete (&pwr_readers_treedef, &pwr->readers, m);
     reader_drop_connection (&m->rd_guid, pwr);
     update_reader_init_acknack_count (&m->rd_guid, m->count);
     free_pwr_rd_match (m);
@@ -4353,7 +4353,7 @@ int new_proxy_reader (const struct nn_guid *ppguid, const struct nn_guid *guid,
      "real" participant, rather than the thing we use for endpoints discovered via the DS */
   prd->assert_pp_lease = (unsigned) !!config.arrival_of_data_asserts_pp_and_ep_liveliness;
 
-  ut_avlInit (&prd_writers_treedef, &prd->writers);
+  ddsrt_avl_init (&prd_writers_treedef, &prd->writers);
 
   /* locking the entity prevents matching while the built-in topic hasn't been published yet */
   ddsrt_mutex_lock (&prd->e.lock);
@@ -4374,14 +4374,14 @@ static void proxy_reader_set_delete_and_ack_all_messages (struct proxy_reader *p
   memset (&wrguid, 0, sizeof (wrguid));
   ddsrt_mutex_lock (&prd->e.lock);
   prd->deleting = 1;
-  while ((m = ut_avlLookupSuccEq (&prd_writers_treedef, &prd->writers, &wrguid)) != NULL)
+  while ((m = ddsrt_avl_lookup_succ_eq (&prd_writers_treedef, &prd->writers, &wrguid)) != NULL)
   {
     /* have to be careful walking the tree -- pretty is different, but
        I want to check this before I write a lookup_succ function. */
     struct prd_wr_match *m_a_next;
     nn_guid_t wrguid_next;
     wrguid = m->wr_guid;
-    if ((m_a_next = ut_avlFindSucc (&prd_writers_treedef, &prd->writers, m)) != NULL)
+    if ((m_a_next = ddsrt_avl_find_succ (&prd_writers_treedef, &prd->writers, m)) != NULL)
       wrguid_next = m_a_next->wr_guid;
     else
     {
@@ -4395,11 +4395,11 @@ static void proxy_reader_set_delete_and_ack_all_messages (struct proxy_reader *p
       struct whc_node *deferred_free_list = NULL;
       struct wr_prd_match *m_wr;
       ddsrt_mutex_lock (&wr->e.lock);
-      if ((m_wr = ut_avlLookup (&wr_readers_treedef, &wr->readers, &prd->e.guid)) != NULL)
+      if ((m_wr = ddsrt_avl_lookup (&wr_readers_treedef, &wr->readers, &prd->e.guid)) != NULL)
       {
         struct whc_state whcst;
         m_wr->seq = MAX_SEQ_NUMBER;
-        ut_avlAugmentUpdate (&wr_readers_treedef, m_wr);
+        ddsrt_avl_augment_update (&wr_readers_treedef, m_wr);
         (void)remove_acked_messages (wr, &whcst, &deferred_free_list);
         writer_clear_retransmitting (wr);
       }
@@ -4419,10 +4419,10 @@ static void gc_delete_proxy_reader (struct gcreq *gcreq)
   DDS_LOG(DDS_LC_DISCOVERY, "gc_delete_proxy_reader(%p, %x:%x:%x:%x)\n", (void *) gcreq, PGUID (prd->e.guid));
   gcreq_free (gcreq);
 
-  while (!ut_avlIsEmpty (&prd->writers))
+  while (!ddsrt_avl_is_empty (&prd->writers))
   {
-    struct prd_wr_match *m = ut_avlRootNonEmpty (&prd_writers_treedef, &prd->writers);
-    ut_avlDelete (&prd_writers_treedef, &prd->writers, m);
+    struct prd_wr_match *m = ddsrt_avl_root_non_empty (&prd_writers_treedef, &prd->writers);
+    ddsrt_avl_delete (&prd_writers_treedef, &prd->writers, m);
     writer_drop_connection (&m->wr_guid, prd);
     free_prd_wr_match (m);
   }
diff --git a/src/core/ddsi/src/q_ephash.c b/src/core/ddsi/src/q_ephash.c
index f287aae..d02fcba 100644
--- a/src/core/ddsi/src/q_ephash.c
+++ b/src/core/ddsi/src/q_ephash.c
@@ -15,7 +15,7 @@
 #include "dds/ddsrt/heap.h"
 #include "dds/ddsrt/misc.h"
 
-#include "dds/util/ut_hopscotch.h"
+#include "dds/ddsrt/hopscotch.h"
 #include "dds/ddsi/q_ephash.h"
 #include "dds/ddsi/q_config.h"
 #include "dds/ddsi/q_globals.h"
@@ -25,7 +25,7 @@
 #include "dds/ddsi/q_thread.h" /* for assert(thread is awake) */
 
 struct ephash {
-  struct ut_chh *hash;
+  struct ddsrt_chh *hash;
 };
 
 static const uint64_t unihashconsts[] = {
@@ -80,7 +80,7 @@ struct ephash *ephash_new (void)
 {
   struct ephash *ephash;
   ephash = ddsrt_malloc (sizeof (*ephash));
-  ephash->hash = ut_chhNew (32, hash_entity_guid_wrapper, entity_guid_eq_wrapper, gc_buckets);
+  ephash->hash = ddsrt_chh_new (32, hash_entity_guid_wrapper, entity_guid_eq_wrapper, gc_buckets);
   if (ephash->hash == NULL) {
     ddsrt_free (ephash);
     return NULL;
@@ -91,7 +91,7 @@ struct ephash *ephash_new (void)
 
 void ephash_free (struct ephash *ephash)
 {
-  ut_chhFree (ephash->hash);
+  ddsrt_chh_free (ephash->hash);
   ephash->hash = NULL;
   ddsrt_free (ephash);
 }
@@ -101,7 +101,7 @@ static void ephash_guid_insert (struct entity_common *e)
   int x;
   assert(gv.guid_hash);
   assert(gv.guid_hash->hash);
-  x = ut_chhAdd (gv.guid_hash->hash, e);
+  x = ddsrt_chh_add (gv.guid_hash->hash, e);
   (void)x;
   assert (x);
 }
@@ -111,7 +111,7 @@ static void ephash_guid_remove (struct entity_common *e)
   int x;
   assert(gv.guid_hash);
   assert(gv.guid_hash->hash);
-  x = ut_chhRemove (gv.guid_hash->hash, e);
+  x = ddsrt_chh_remove (gv.guid_hash->hash, e);
   (void)x;
   assert (x);
 }
@@ -121,7 +121,7 @@ void *ephash_lookup_guid_untyped (const struct nn_guid *guid)
   /* FIXME: could (now) require guid to be first in entity_common; entity_common already is first in entity */
   struct entity_common e;
   e.guid = *guid;
-  return ut_chhLookup (gv.guid_hash->hash, &e);
+  return ddsrt_chh_lookup (gv.guid_hash->hash, &e);
 }
 
 static void *ephash_lookup_guid_int (const struct ephash *ephash, const struct nn_guid *guid, enum entity_kind kind)
@@ -246,9 +246,9 @@ struct proxy_reader *ephash_lookup_proxy_reader_guid (const struct nn_guid *guid
 static void ephash_enum_init_int (struct ephash_enum *st, struct ephash *ephash, enum entity_kind kind)
 {
   st->kind = kind;
-  st->cur = ut_chhIterFirst (ephash->hash, &st->it);
+  st->cur = ddsrt_chh_iter_first (ephash->hash, &st->it);
   while (st->cur && st->cur->kind != st->kind)
-    st->cur = ut_chhIterNext (&st->it);
+    st->cur = ddsrt_chh_iter_next (&st->it);
 }
 
 void ephash_enum_init (struct ephash_enum *st, enum entity_kind kind)
@@ -291,9 +291,9 @@ void *ephash_enum_next (struct ephash_enum *st)
   void *res = st->cur;
   if (st->cur)
   {
-    st->cur = ut_chhIterNext (&st->it);
+    st->cur = ddsrt_chh_iter_next (&st->it);
     while (st->cur && st->cur->kind != st->kind)
-      st->cur = ut_chhIterNext (&st->it);
+      st->cur = ddsrt_chh_iter_next (&st->it);
   }
   return res;
 }
diff --git a/src/core/ddsi/src/q_init.c b/src/core/ddsi/src/q_init.c
index 0b89411..ee25e6c 100644
--- a/src/core/ddsi/src/q_init.c
+++ b/src/core/ddsi/src/q_init.c
@@ -19,8 +19,8 @@
 #include "dds/ddsrt/string.h"
 #include "dds/ddsrt/sync.h"
 
-#include "dds/util/ut_avl.h"
-#include "dds/util/ut_thread_pool.h"
+#include "dds/ddsrt/avl.h"
+#include "dds/ddsrt/thread_pool.h"
 
 #include "dds/ddsi/q_protocol.h"
 #include "dds/ddsi/q_rtps.h"
@@ -895,7 +895,7 @@ int rtps_init (void)
 
   if (config.tp_enable)
   {
-    gv.thread_pool = ut_thread_pool_new
+    gv.thread_pool = ddsrt_thread_pool_new
       (config.tp_threads, config.tp_max_threads, 0, NULL);
   }
 
@@ -1357,7 +1357,7 @@ err_find_own_ip:
     ddsi_tran_factories_fini ();
 err_udp_tcp_init:
   if (config.tp_enable)
-    ut_thread_pool_free (gv.thread_pool);
+    ddsrt_thread_pool_free (gv.thread_pool);
   return -1;
 }
 
@@ -1609,7 +1609,7 @@ void rtps_fini (void)
   }
 #endif
 
-  ut_thread_pool_free (gv.thread_pool);
+  ddsrt_thread_pool_free (gv.thread_pool);
 
   (void) joinleave_spdp_defmcip (0);
 
diff --git a/src/core/ddsi/src/q_inverse_uint32_set.c b/src/core/ddsi/src/q_inverse_uint32_set.c
index 99d24ac..0750425 100644
--- a/src/core/ddsi/src/q_inverse_uint32_set.c
+++ b/src/core/ddsi/src/q_inverse_uint32_set.c
@@ -12,14 +12,14 @@
 #include <assert.h>
 #include <stddef.h>
 #include "dds/ddsrt/heap.h"
-#include "dds/util/ut_avl.h"
+#include "dds/ddsrt/avl.h"
 #include "dds/ddsi/q_config.h"
 #include "dds/ddsi/q_log.h"
 #include "dds/ddsi/q_inverse_uint32_set.h"
 
 static int uint32_t_cmp(const void *va, const void *vb);
 
-static ut_avlTreedef_t inverse_uint32_set_td = UT_AVL_TREEDEF_INITIALIZER(offsetof(struct inverse_uint32_set_node, avlnode), offsetof(struct inverse_uint32_set_node, min), uint32_t_cmp, 0);
+static ddsrt_avl_treedef_t inverse_uint32_set_td = DDSRT_AVL_TREEDEF_INITIALIZER(offsetof(struct inverse_uint32_set_node, avlnode), offsetof(struct inverse_uint32_set_node, min), uint32_t_cmp, 0);
 
 static int uint32_t_cmp(const void *va, const void *vb)
 {
@@ -31,12 +31,12 @@ static int uint32_t_cmp(const void *va, const void *vb)
 static void check(const struct inverse_uint32_set *set)
 {
 #ifndef NDEBUG
-  ut_avlIter_t it;
+  ddsrt_avl_iter_t it;
   struct inverse_uint32_set_node *pn = NULL, *n;
   assert(set->min <= set->max);
   assert(set->cursor >= set->min);
   assert(set->cursor <= set->max);
-  for (n = ut_avlIterFirst(&inverse_uint32_set_td, &set->ids, &it); n; pn = n, n = ut_avlIterNext(&it))
+  for (n = ddsrt_avl_iter_first(&inverse_uint32_set_td, &set->ids, &it); n; pn = n, n = ddsrt_avl_iter_next(&it))
   {
     assert(n->min <= n->max);
     assert(n->min >= set->min);
@@ -51,20 +51,20 @@ static void check(const struct inverse_uint32_set *set)
 void inverse_uint32_set_init(struct inverse_uint32_set *set, uint32_t min, uint32_t max)
 {
   struct inverse_uint32_set_node *n;
-  ut_avlInit(&inverse_uint32_set_td, &set->ids);
+  ddsrt_avl_init(&inverse_uint32_set_td, &set->ids);
   set->cursor = min;
   set->min = min;
   set->max = max;
   n = ddsrt_malloc(sizeof(*n));
   n->min = min;
   n->max = max;
-  ut_avlInsert(&inverse_uint32_set_td, &set->ids, n);
+  ddsrt_avl_insert(&inverse_uint32_set_td, &set->ids, n);
   check(set);
 }
 
 void inverse_uint32_set_fini(struct inverse_uint32_set *set)
 {
-  ut_avlFree(&inverse_uint32_set_td, &set->ids, ddsrt_free);
+  ddsrt_avl_free(&inverse_uint32_set_td, &set->ids, ddsrt_free);
 }
 
 static uint32_t inverse_uint32_set_alloc_use_min(struct inverse_uint32_set *set, struct inverse_uint32_set_node *n)
@@ -72,7 +72,7 @@ static uint32_t inverse_uint32_set_alloc_use_min(struct inverse_uint32_set *set,
   const uint32_t id = n->min;
   if (n->min == n->max)
   {
-    ut_avlDelete(&inverse_uint32_set_td, &set->ids, n);
+    ddsrt_avl_delete(&inverse_uint32_set_td, &set->ids, n);
     ddsrt_free(n);
   }
   else
@@ -86,7 +86,7 @@ static uint32_t inverse_uint32_set_alloc_use_min(struct inverse_uint32_set *set,
 int inverse_uint32_set_alloc(uint32_t * const id, struct inverse_uint32_set *set)
 {
   struct inverse_uint32_set_node *n;
-  if ((n = ut_avlLookupPredEq(&inverse_uint32_set_td, &set->ids, &set->cursor)) != NULL && set->cursor <= n->max) {
+  if ((n = ddsrt_avl_lookup_pred_eq(&inverse_uint32_set_td, &set->ids, &set->cursor)) != NULL && set->cursor <= n->max) {
     /* n is [a,b] s.t. a <= C <= b, so C is available */
     *id = set->cursor;
     if (n->min == set->cursor)
@@ -105,15 +105,15 @@ int inverse_uint32_set_alloc(uint32_t * const id, struct inverse_uint32_set *set
       n1->min = set->cursor + 1;
       n1->max = n->max;
       n->max = set->cursor - 1;
-      ut_avlInsert(&inverse_uint32_set_td, &set->ids, n1);
+      ddsrt_avl_insert(&inverse_uint32_set_td, &set->ids, n1);
     }
   }
-  else if ((n = ut_avlLookupSucc(&inverse_uint32_set_td, &set->ids, &set->cursor)) != NULL)
+  else if ((n = ddsrt_avl_lookup_succ(&inverse_uint32_set_td, &set->ids, &set->cursor)) != NULL)
   {
     /* n is [a,b] s.t. a > C and all intervals [a',b'] in tree have a' <= C */
     *id = inverse_uint32_set_alloc_use_min(set, n);
   }
-  else if ((n = ut_avlFindMin(&inverse_uint32_set_td, &set->ids)) != NULL)
+  else if ((n = ddsrt_avl_find_min(&inverse_uint32_set_td, &set->ids)) != NULL)
   {
     /* no available ids >= cursor: wrap around and use the first available */
     assert(n->max < set->cursor);
@@ -133,8 +133,8 @@ void inverse_uint32_set_free(struct inverse_uint32_set *set, uint32_t id)
 {
   struct inverse_uint32_set_node *n;
   const uint32_t idp1 = id + 1;
-  ut_avlIPath_t ip;
-  if ((n = ut_avlLookupPredEq(&inverse_uint32_set_td, &set->ids, &id)) != NULL && id <= n->max + 1) {
+  ddsrt_avl_ipath_t ip;
+  if ((n = ddsrt_avl_lookup_pred_eq(&inverse_uint32_set_td, &set->ids, &id)) != NULL && id <= n->max + 1) {
     if (id <= n->max)
     {
       /* n is [a,b] s.t. a <= I <= b: so it is already in the set */
@@ -143,18 +143,18 @@ void inverse_uint32_set_free(struct inverse_uint32_set *set, uint32_t id)
     else
     {
       struct inverse_uint32_set_node *n1;
-      ut_avlDPath_t dp;
+      ddsrt_avl_dpath_t dp;
       /* grow the interval, possibly coalesce with next */
-      if ((n1 = ut_avlLookupDPath(&inverse_uint32_set_td, &set->ids, &idp1, &dp)) == NULL) {
+      if ((n1 = ddsrt_avl_lookup_dpath(&inverse_uint32_set_td, &set->ids, &idp1, &dp)) == NULL) {
         n->max = id;
       } else {
         n->max = n1->max;
-        ut_avlDeleteDPath(&inverse_uint32_set_td, &set->ids, n1, &dp);
+        ddsrt_avl_delete_dpath(&inverse_uint32_set_td, &set->ids, n1, &dp);
         ddsrt_free(n1);
       }
     }
   }
-  else if ((n = ut_avlLookupIPath(&inverse_uint32_set_td, &set->ids, &idp1, &ip)) != NULL) {
+  else if ((n = ddsrt_avl_lookup_ipath(&inverse_uint32_set_td, &set->ids, &idp1, &ip)) != NULL) {
     /* changing the key in-place here: the key value may be changing, but the structure of the tree is not or the previous case would have applied */
     n->min = id;
   }
@@ -163,7 +163,7 @@ void inverse_uint32_set_free(struct inverse_uint32_set *set, uint32_t id)
     /* no adjacent interval */
     n = ddsrt_malloc(sizeof(*n));
     n->min = n->max = id;
-    ut_avlInsertIPath(&inverse_uint32_set_td, &set->ids, n, &ip);
+    ddsrt_avl_insert_ipath(&inverse_uint32_set_td, &set->ids, n, &ip);
   }
   check(set);
 }
diff --git a/src/core/ddsi/src/q_lease.c b/src/core/ddsi/src/q_lease.c
index 0e2d99c..22dc1f4 100644
--- a/src/core/ddsi/src/q_lease.c
+++ b/src/core/ddsi/src/q_lease.c
@@ -16,7 +16,7 @@
 #include "dds/ddsrt/heap.h"
 #include "dds/ddsrt/sync.h"
 
-#include "dds/util/ut_fibheap.h"
+#include "dds/ddsrt/fibheap.h"
 
 #include "dds/ddsi/ddsi_serdata_default.h"
 #include "dds/ddsi/q_protocol.h"
@@ -44,7 +44,7 @@
 #define TSCHED_NOT_ON_HEAP INT64_MIN
 
 struct lease {
-  ut_fibheapNode_t heapnode;
+  ddsrt_fibheap_node_t heapnode;
   nn_etime_t tsched;  /* access guarded by leaseheap_lock */
   nn_etime_t tend;    /* access guarded by lock_lease/unlock_lease */
   int64_t tdur;      /* constant (renew depends on it) */
@@ -53,7 +53,7 @@ struct lease {
 
 static int compare_lease_tsched (const void *va, const void *vb);
 
-static const ut_fibheapDef_t lease_fhdef = UT_FIBHEAPDEF_INITIALIZER(offsetof (struct lease, heapnode), compare_lease_tsched);
+static const ddsrt_fibheap_def_t lease_fhdef = DDSRT_FIBHEAPDEF_INITIALIZER(offsetof (struct lease, heapnode), compare_lease_tsched);
 
 static void force_lease_check (void)
 {
@@ -73,13 +73,13 @@ void lease_management_init (void)
   ddsrt_mutex_init (&gv.leaseheap_lock);
   for (i = 0; i < N_LEASE_LOCKS; i++)
     ddsrt_mutex_init (&gv.lease_locks[i]);
-  ut_fibheapInit (&lease_fhdef, &gv.leaseheap);
+  ddsrt_fibheap_init (&lease_fhdef, &gv.leaseheap);
 }
 
 void lease_management_term (void)
 {
   int i;
-  assert (ut_fibheapMin (&lease_fhdef, &gv.leaseheap) == NULL);
+  assert (ddsrt_fibheap_min (&lease_fhdef, &gv.leaseheap) == NULL);
   for (i = 0; i < N_LEASE_LOCKS; i++)
     ddsrt_mutex_destroy (&gv.lease_locks[i]);
   ddsrt_mutex_destroy (&gv.leaseheap_lock);
@@ -125,7 +125,7 @@ void lease_register (struct lease *l)
   if (l->tend.v != T_NEVER)
   {
     l->tsched = l->tend;
-    ut_fibheapInsert (&lease_fhdef, &gv.leaseheap, l);
+    ddsrt_fibheap_insert (&lease_fhdef, &gv.leaseheap, l);
   }
   unlock_lease (l);
   ddsrt_mutex_unlock (&gv.leaseheap_lock);
@@ -139,7 +139,7 @@ void lease_free (struct lease *l)
   DDS_TRACE("lease_free(l %p guid %x:%x:%x:%x)\n", (void *) l, PGUID (l->entity->guid));
   ddsrt_mutex_lock (&gv.leaseheap_lock);
   if (l->tsched.v != TSCHED_NOT_ON_HEAP)
-    ut_fibheapDelete (&lease_fhdef, &gv.leaseheap, l);
+    ddsrt_fibheap_delete (&lease_fhdef, &gv.leaseheap, l);
   ddsrt_mutex_unlock (&gv.leaseheap_lock);
   ddsrt_free (l);
 
@@ -187,14 +187,14 @@ void lease_set_expiry (struct lease *l, nn_etime_t when)
     /* moved forward and currently scheduled (by virtue of
        TSCHED_NOT_ON_HEAP == INT64_MIN) */
     l->tsched = l->tend;
-    ut_fibheapDecreaseKey (&lease_fhdef, &gv.leaseheap, l);
+    ddsrt_fibheap_decrease_key (&lease_fhdef, &gv.leaseheap, l);
     trigger = true;
   }
   else if (l->tsched.v == TSCHED_NOT_ON_HEAP && l->tend.v < T_NEVER)
   {
     /* not currently scheduled, with a finite new expiry time */
     l->tsched = l->tend;
-    ut_fibheapInsert (&lease_fhdef, &gv.leaseheap, l);
+    ddsrt_fibheap_insert (&lease_fhdef, &gv.leaseheap, l);
     trigger = true;
   }
   unlock_lease (l);
@@ -210,13 +210,13 @@ int64_t check_and_handle_lease_expiration (nn_etime_t tnowE)
   struct lease *l;
   int64_t delay;
   ddsrt_mutex_lock (&gv.leaseheap_lock);
-  while ((l = ut_fibheapMin (&lease_fhdef, &gv.leaseheap)) != NULL && l->tsched.v <= tnowE.v)
+  while ((l = ddsrt_fibheap_min (&lease_fhdef, &gv.leaseheap)) != NULL && l->tsched.v <= tnowE.v)
   {
     nn_guid_t g = l->entity->guid;
     enum entity_kind k = l->entity->kind;
 
     assert (l->tsched.v != TSCHED_NOT_ON_HEAP);
-    ut_fibheapExtractMin (&lease_fhdef, &gv.leaseheap);
+    ddsrt_fibheap_extract_min (&lease_fhdef, &gv.leaseheap);
 
     lock_lease (l);
     if (tnowE.v < l->tend.v)
@@ -228,7 +228,7 @@ int64_t check_and_handle_lease_expiration (nn_etime_t tnowE)
       } else {
         l->tsched = l->tend;
         unlock_lease (l);
-        ut_fibheapInsert (&lease_fhdef, &gv.leaseheap, l);
+        ddsrt_fibheap_insert (&lease_fhdef, &gv.leaseheap, l);
       }
       continue;
     }
@@ -270,7 +270,7 @@ int64_t check_and_handle_lease_expiration (nn_etime_t tnowE)
                 PGUID (proxypp->privileged_pp_guid));
         l->tsched = l->tend = add_duration_to_etime (tnowE, 200 * T_MILLISECOND);
         unlock_lease (l);
-        ut_fibheapInsert (&lease_fhdef, &gv.leaseheap, l);
+        ddsrt_fibheap_insert (&lease_fhdef, &gv.leaseheap, l);
         continue;
       }
     }
diff --git a/src/core/ddsi/src/q_nwif.c b/src/core/ddsi/src/q_nwif.c
index c013080..6e8cbef 100644
--- a/src/core/ddsi/src/q_nwif.c
+++ b/src/core/ddsi/src/q_nwif.c
@@ -31,7 +31,7 @@
 #include "dds/ddsi/q_addrset.h" /* unspec locator */
 #include "dds/ddsi/q_feature_check.h"
 #include "dds/ddsi/ddsi_ipaddr.h"
-#include "dds/util/ut_avl.h"
+#include "dds/ddsrt/avl.h"
 
 static void print_sockerror (const char *msg)
 {
diff --git a/src/core/ddsi/src/q_plist.c b/src/core/ddsi/src/q_plist.c
index c7a8222..fed7f43 100644
--- a/src/core/ddsi/src/q_plist.c
+++ b/src/core/ddsi/src/q_plist.c
@@ -32,7 +32,7 @@
 #include "dds/ddsi/q_radmin.h" /* for nn_plist_quickscan */
 #include "dds/ddsi/q_static_assert.h"
 
-#include "dds/util/ut_avl.h"
+#include "dds/ddsrt/avl.h"
 #include "dds/ddsi/q_misc.h" /* for vendor_is_... */
 
 /* These are internal to the parameter list processing. We never
diff --git a/src/core/ddsi/src/q_radmin.c b/src/core/ddsi/src/q_radmin.c
index 8b49c64..4a739fd 100644
--- a/src/core/ddsi/src/q_radmin.c
+++ b/src/core/ddsi/src/q_radmin.c
@@ -28,7 +28,7 @@
 #include "dds/ddsrt/string.h"
 #include "dds/ddsrt/log.h"
 
-#include "dds/util/ut_avl.h"
+#include "dds/ddsrt/avl.h"
 #include "dds/ddsi/q_protocol.h"
 #include "dds/ddsi/q_rtps.h"
 #include "dds/ddsi/q_misc.h"
@@ -812,7 +812,7 @@ static void nn_rdata_unref (struct nn_rdata *rdata)
    anyway). */
 
 struct nn_defrag_iv {
-  ut_avlNode_t avlnode; /* for nn_rsample.defrag::fragtree */
+  ddsrt_avl_node_t avlnode; /* for nn_rsample.defrag::fragtree */
   uint32_t min, maxp1;
   struct nn_rdata *first;
   struct nn_rdata *last;
@@ -821,14 +821,14 @@ struct nn_defrag_iv {
 struct nn_rsample {
   union {
     struct nn_rsample_defrag {
-      ut_avlNode_t avlnode; /* for nn_defrag::sampletree */
-      ut_avlTree_t fragtree;
+      ddsrt_avl_node_t avlnode; /* for nn_defrag::sampletree */
+      ddsrt_avl_tree_t fragtree;
       struct nn_defrag_iv *lastfrag;
       struct nn_rsample_info *sampleinfo;
       seqno_t seq;
     } defrag;
     struct nn_rsample_reorder {
-      ut_avlNode_t avlnode;       /* for nn_reorder::sampleivtree, if head of a chain */
+      ddsrt_avl_node_t avlnode;       /* for nn_reorder::sampleivtree, if head of a chain */
       struct nn_rsample_chain sc; /* this interval's samples, covering ... */
       seqno_t min, maxp1;        /* ... seq nos: [min,maxp1), but possibly with holes in it */
       uint32_t n_samples;        /* so this is the actual length of the chain */
@@ -837,7 +837,7 @@ struct nn_rsample {
 };
 
 struct nn_defrag {
-  ut_avlTree_t sampletree;
+  ddsrt_avl_tree_t sampletree;
   struct nn_rsample *max_sample; /* = max(sampletree) */
   uint32_t n_samples;
   uint32_t max_samples;
@@ -847,8 +847,8 @@ struct nn_defrag {
 static int compare_uint32 (const void *va, const void *vb);
 static int compare_seqno (const void *va, const void *vb);
 
-static const ut_avlTreedef_t defrag_sampletree_treedef = UT_AVL_TREEDEF_INITIALIZER (offsetof (struct nn_rsample, u.defrag.avlnode), offsetof (struct nn_rsample, u.defrag.seq), compare_seqno, 0);
-static const ut_avlTreedef_t rsample_defrag_fragtree_treedef = UT_AVL_TREEDEF_INITIALIZER (offsetof (struct nn_defrag_iv, avlnode), offsetof (struct nn_defrag_iv, min), compare_uint32, 0);
+static const ddsrt_avl_treedef_t defrag_sampletree_treedef = DDSRT_AVL_TREEDEF_INITIALIZER (offsetof (struct nn_rsample, u.defrag.avlnode), offsetof (struct nn_rsample, u.defrag.seq), compare_seqno, 0);
+static const ddsrt_avl_treedef_t rsample_defrag_fragtree_treedef = DDSRT_AVL_TREEDEF_INITIALIZER (offsetof (struct nn_defrag_iv, avlnode), offsetof (struct nn_defrag_iv, min), compare_uint32, 0);
 
 static int compare_uint32 (const void *va, const void *vb)
 {
@@ -870,7 +870,7 @@ struct nn_defrag *nn_defrag_new (enum nn_defrag_drop_mode drop_mode, uint32_t ma
   assert (max_samples >= 1);
   if ((d = ddsrt_malloc (sizeof (*d))) == NULL)
     return NULL;
-  ut_avlInit (&defrag_sampletree_treedef, &d->sampletree);
+  ddsrt_avl_init (&defrag_sampletree_treedef, &d->sampletree);
   d->drop_mode = drop_mode;
   d->max_samples = max_samples;
   d->n_samples = 0;
@@ -903,25 +903,25 @@ static void defrag_rsample_drop (struct nn_defrag *defrag, struct nn_rsample *rs
      So we need to walk the fragments while guaranteeing strict
      "forward progress" in the memory accesses, which this particular
      inorder treewalk does provide. */
-  ut_avlIter_t iter;
+  ddsrt_avl_iter_t iter;
   struct nn_defrag_iv *iv;
   DDS_LOG(DDS_LC_RADMIN, "  defrag_rsample_drop (%p, %p)\n", (void *) defrag, (void *) rsample);
-  ut_avlDelete (&defrag_sampletree_treedef, &defrag->sampletree, rsample);
+  ddsrt_avl_delete (&defrag_sampletree_treedef, &defrag->sampletree, rsample);
   assert (defrag->n_samples > 0);
   defrag->n_samples--;
-  for (iv = ut_avlIterFirst (&rsample_defrag_fragtree_treedef, &rsample->u.defrag.fragtree, &iter); iv; iv = ut_avlIterNext (&iter))
+  for (iv = ddsrt_avl_iter_first (&rsample_defrag_fragtree_treedef, &rsample->u.defrag.fragtree, &iter); iv; iv = ddsrt_avl_iter_next (&iter))
     nn_fragchain_rmbias (iv->first);
 }
 
 void nn_defrag_free (struct nn_defrag *defrag)
 {
   struct nn_rsample *s;
-  s = ut_avlFindMin (&defrag_sampletree_treedef, &defrag->sampletree);
+  s = ddsrt_avl_find_min (&defrag_sampletree_treedef, &defrag->sampletree);
   while (s)
   {
     DDS_LOG(DDS_LC_RADMIN, "defrag_free(%p, sample %p seq %"PRId64")\n", (void *) defrag, (void *) s, s->u.defrag.seq);
     defrag_rsample_drop (defrag, s);
-    s = ut_avlFindMin (&defrag_sampletree_treedef, &defrag->sampletree);
+    s = ddsrt_avl_find_min (&defrag_sampletree_treedef, &defrag->sampletree);
   }
   assert (defrag->n_samples == 0);
   ddsrt_free (defrag);
@@ -940,7 +940,7 @@ static int defrag_try_merge_with_succ (struct nn_rsample_defrag *sample, struct
     return 0;
   }
 
-  succ = ut_avlFindSucc (&rsample_defrag_fragtree_treedef, &sample->fragtree, node);
+  succ = ddsrt_avl_find_succ (&rsample_defrag_fragtree_treedef, &sample->fragtree, node);
   assert (succ != NULL);
   DDS_LOG(DDS_LC_RADMIN, "  succ is %p [%u..%u)\n", (void *) succ, succ->min, succ->maxp1);
   if (succ->min > node->maxp1)
@@ -955,7 +955,7 @@ static int defrag_try_merge_with_succ (struct nn_rsample_defrag *sample, struct
     /* no longer a gap between node & succ => succ will be removed
        from the interval tree and therefore node will become the
        last interval if succ currently is */
-    ut_avlDelete (&rsample_defrag_fragtree_treedef, &sample->fragtree, succ);
+    ddsrt_avl_delete (&rsample_defrag_fragtree_treedef, &sample->fragtree, succ);
     if (sample->lastfrag == succ)
     {
       DDS_LOG(DDS_LC_RADMIN, "  succ is lastfrag\n");
@@ -987,7 +987,7 @@ static int defrag_try_merge_with_succ (struct nn_rsample_defrag *sample, struct
   }
 }
 
-static void defrag_rsample_addiv (struct nn_rsample_defrag *sample, struct nn_rdata *rdata, ut_avlIPath_t *path)
+static void defrag_rsample_addiv (struct nn_rsample_defrag *sample, struct nn_rdata *rdata, ddsrt_avl_ipath_t *path)
 {
   struct nn_defrag_iv *newiv;
   if ((newiv = nn_rmsg_alloc (rdata->rmsg, sizeof (*newiv))) == NULL)
@@ -997,7 +997,7 @@ static void defrag_rsample_addiv (struct nn_rsample_defrag *sample, struct nn_rd
   newiv->min = rdata->min;
   newiv->maxp1 = rdata->maxp1;
   nn_rdata_addbias (rdata);
-  ut_avlInsertIPath (&rsample_defrag_fragtree_treedef, &sample->fragtree, newiv, path);
+  ddsrt_avl_insert_ipath (&rsample_defrag_fragtree_treedef, &sample->fragtree, newiv, path);
   if (sample->lastfrag == NULL || rdata->min > sample->lastfrag->min)
     sample->lastfrag = newiv;
 }
@@ -1010,7 +1010,7 @@ static struct nn_rsample *defrag_rsample_new (struct nn_rdata *rdata, const stru
 {
   struct nn_rsample *rsample;
   struct nn_rsample_defrag *dfsample;
-  ut_avlIPath_t ivpath;
+  ddsrt_avl_ipath_t ivpath;
 
   if ((rsample = nn_rmsg_alloc (rdata->rmsg, sizeof (*rsample))) == NULL)
     return NULL;
@@ -1022,7 +1022,7 @@ static struct nn_rsample *defrag_rsample_new (struct nn_rdata *rdata, const stru
     return NULL;
   *dfsample->sampleinfo = *sampleinfo;
 
-  ut_avlInit (&rsample_defrag_fragtree_treedef, &dfsample->fragtree);
+  ddsrt_avl_init (&rsample_defrag_fragtree_treedef, &dfsample->fragtree);
 
   /* add sentinel if rdata is not the first fragment of the message */
   if (rdata->min > 0)
@@ -1032,12 +1032,12 @@ static struct nn_rsample *defrag_rsample_new (struct nn_rdata *rdata, const stru
       return NULL;
     sentinel->first = sentinel->last = NULL;
     sentinel->min = sentinel->maxp1 = 0;
-    ut_avlLookupIPath (&rsample_defrag_fragtree_treedef, &dfsample->fragtree, &sentinel->min, &ivpath);
-    ut_avlInsertIPath (&rsample_defrag_fragtree_treedef, &dfsample->fragtree, sentinel, &ivpath);
+    ddsrt_avl_lookup_ipath (&rsample_defrag_fragtree_treedef, &dfsample->fragtree, &sentinel->min, &ivpath);
+    ddsrt_avl_insert_ipath (&rsample_defrag_fragtree_treedef, &dfsample->fragtree, sentinel, &ivpath);
   }
 
   /* add an interval for the first received fragment */
-  ut_avlLookupIPath (&rsample_defrag_fragtree_treedef, &dfsample->fragtree, &rdata->min, &ivpath);
+  ddsrt_avl_lookup_ipath (&rsample_defrag_fragtree_treedef, &dfsample->fragtree, &rdata->min, &ivpath);
   defrag_rsample_addiv (dfsample, rdata, &ivpath);
   return rsample;
 }
@@ -1084,7 +1084,7 @@ static int is_complete (const struct nn_rsample_defrag *sample)
      one interval covering all bytes. One interval because of the
      greedy coalescing in add_fragment(). There is at least one
      interval if we get here. */
-  const struct nn_defrag_iv *iv = ut_avlRoot (&rsample_defrag_fragtree_treedef, &sample->fragtree);
+  const struct nn_defrag_iv *iv = ddsrt_avl_root (&rsample_defrag_fragtree_treedef, &sample->fragtree);
   assert (iv != NULL);
   if (iv->min == 0 && iv->maxp1 >= sample->sampleinfo->size)
   {
@@ -1094,7 +1094,7 @@ static int is_complete (const struct nn_rsample_defrag *sample)
        samples that will never be completed; dropping them in the
        defragmenter would be feasible by discarding all fragments of
        that sample collected so far. */
-    assert (ut_avlIsSingleton (&sample->fragtree));
+    assert (ddsrt_avl_is_singleton (&sample->fragtree));
     return 1;
   }
   else
@@ -1111,14 +1111,14 @@ static void rsample_convert_defrag_to_reorder (struct nn_rsample *sample)
      self-respecting compiler will optimise them away, and any
      self-respecting CPU would need to copy them via registers anyway
      because it uses a load-store architecture. */
-  struct nn_defrag_iv *iv = ut_avlRootNonEmpty (&rsample_defrag_fragtree_treedef, &sample->u.defrag.fragtree);
+  struct nn_defrag_iv *iv = ddsrt_avl_root_non_empty (&rsample_defrag_fragtree_treedef, &sample->u.defrag.fragtree);
   struct nn_rdata *fragchain = iv->first;
   struct nn_rsample_info *sampleinfo = sample->u.defrag.sampleinfo;
   struct nn_rsample_chain_elem *sce;
   seqno_t seq = sample->u.defrag.seq;
 
   /* re-use memory fragment interval node for sample chain */
-  sce = (struct nn_rsample_chain_elem *) ut_avlRootNonEmpty (&rsample_defrag_fragtree_treedef, &sample->u.defrag.fragtree);
+  sce = (struct nn_rsample_chain_elem *) ddsrt_avl_root_non_empty (&rsample_defrag_fragtree_treedef, &sample->u.defrag.fragtree);
   sce->fragchain = fragchain;
   sce->next = NULL;
   sce->sampleinfo = sampleinfo;
@@ -1145,7 +1145,7 @@ static struct nn_rsample *defrag_add_fragment (struct nn_rsample *sample, struct
   /* there must be a last fragment */
   assert (dfsample->lastfrag);
   /* relatively expensive test: lastfrag, tree must be consistent */
-  assert (dfsample->lastfrag == ut_avlFindMax (&rsample_defrag_fragtree_treedef, &dfsample->fragtree));
+  assert (dfsample->lastfrag == ddsrt_avl_find_max (&rsample_defrag_fragtree_treedef, &dfsample->fragtree));
 
   DDS_LOG(DDS_LC_RADMIN, "  lastfrag %p [%u..%u)\n",
                  (void *) dfsample->lastfrag,
@@ -1162,7 +1162,7 @@ static struct nn_rsample *defrag_add_fragment (struct nn_rsample *sample, struct
   else
   {
     /* Slow path: find preceding fragment by tree search */
-    predeq = ut_avlLookupPredEq (&rsample_defrag_fragtree_treedef, &dfsample->fragtree, &min);
+    predeq = ddsrt_avl_lookup_pred_eq (&rsample_defrag_fragtree_treedef, &dfsample->fragtree, &min);
     assert (predeq);
     DDS_LOG(DDS_LC_RADMIN, "  slow path: predeq = lookup %u => %p [%u..%u)\n",
                    min, (void *) predeq, predeq->min, predeq->maxp1);
@@ -1206,7 +1206,7 @@ static struct nn_rsample *defrag_add_fragment (struct nn_rsample *sample, struct
     return is_complete (dfsample) ? sample : NULL;
   }
   else if (predeq != dfsample->lastfrag && /* if predeq is last frag, there is no succ */
-           (succ = ut_avlFindSucc (&rsample_defrag_fragtree_treedef, &dfsample->fragtree, predeq)) != NULL &&
+           (succ = ddsrt_avl_find_succ (&rsample_defrag_fragtree_treedef, &dfsample->fragtree, predeq)) != NULL &&
            succ->min <= maxp1)
   {
     /* extends succ (at the low end; no guarantee each individual
@@ -1236,9 +1236,9 @@ static struct nn_rsample *defrag_add_fragment (struct nn_rsample *sample, struct
   {
     /* doesn't extend either predeq at the end or succ at the head =>
        new interval; rdata did not cause completion of sample */
-    ut_avlIPath_t path;
+    ddsrt_avl_ipath_t path;
     DDS_LOG(DDS_LC_RADMIN, "  new interval\n");
-    if (ut_avlLookupIPath (&rsample_defrag_fragtree_treedef, &dfsample->fragtree, &min, &path))
+    if (ddsrt_avl_lookup_ipath (&rsample_defrag_fragtree_treedef, &dfsample->fragtree, &min, &path))
       assert (0);
     defrag_rsample_addiv (dfsample, rdata, &path);
     return NULL;
@@ -1274,7 +1274,7 @@ static int defrag_limit_samples (struct nn_defrag *defrag, seqno_t seq, seqno_t
       break;
     case NN_DEFRAG_DROP_OLDEST:
       DDS_LOG(DDS_LC_RADMIN, "  drop mode = DROP_OLDEST\n");
-      sample_to_drop = ut_avlFindMin (&defrag_sampletree_treedef, &defrag->sampletree);
+      sample_to_drop = ddsrt_avl_find_min (&defrag_sampletree_treedef, &defrag->sampletree);
       assert (sample_to_drop);
       if (seq < sample_to_drop->u.defrag.seq)
       {
@@ -1287,7 +1287,7 @@ static int defrag_limit_samples (struct nn_defrag *defrag, seqno_t seq, seqno_t
   defrag_rsample_drop (defrag, sample_to_drop);
   if (sample_to_drop == defrag->max_sample)
   {
-    defrag->max_sample = ut_avlFindMax (&defrag_sampletree_treedef, &defrag->sampletree);
+    defrag->max_sample = ddsrt_avl_find_max (&defrag_sampletree_treedef, &defrag->sampletree);
     *max_seq = defrag->max_sample ? defrag->max_sample->u.defrag.seq : 0;
     DDS_LOG(DDS_LC_RADMIN, "  updating max_sample: now %p %"PRId64"\n",
                    (void *) defrag->max_sample,
@@ -1322,7 +1322,7 @@ struct nn_rsample *nn_defrag_rsample (struct nn_defrag *defrag, struct nn_rdata
      by adding BIAS to the refcount. */
   struct nn_rsample *sample, *result;
   seqno_t max_seq;
-  ut_avlIPath_t path;
+  ddsrt_avl_ipath_t path;
 
   assert (defrag->n_samples <= defrag->max_samples);
 
@@ -1334,7 +1334,7 @@ struct nn_rsample *nn_defrag_rsample (struct nn_defrag *defrag, struct nn_rdata
   /* max_seq is used for the fast path, and is 0 when there is no
      last message in 'defrag'. max_seq and max_sample must be
      consistent. Max_sample must be consistent with tree */
-  assert (defrag->max_sample == ut_avlFindMax (&defrag_sampletree_treedef, &defrag->sampletree));
+  assert (defrag->max_sample == ddsrt_avl_find_max (&defrag_sampletree_treedef, &defrag->sampletree));
   max_seq = defrag->max_sample ? defrag->max_sample->u.defrag.seq : 0;
   DDS_LOG(DDS_LC_RADMIN, "defrag_rsample(%p, %p [%u..%u) msg %p, %p seq %"PRId64" size %u) max_seq %p %"PRId64":\n",
           (void *) defrag, (void *) rdata, rdata->min, rdata->maxp1, (void *) rdata->rmsg,
@@ -1358,22 +1358,22 @@ struct nn_rsample *nn_defrag_rsample (struct nn_defrag *defrag, struct nn_rdata
        child of the old maximum node */
     /* FIXME: MERGE THIS ONE WITH THE NEXT */
     DDS_LOG(DDS_LC_RADMIN, "  new max sample\n");
-    ut_avlLookupIPath (&defrag_sampletree_treedef, &defrag->sampletree, &sampleinfo->seq, &path);
+    ddsrt_avl_lookup_ipath (&defrag_sampletree_treedef, &defrag->sampletree, &sampleinfo->seq, &path);
     if ((sample = defrag_rsample_new (rdata, sampleinfo)) == NULL)
       return NULL;
-    ut_avlInsertIPath (&defrag_sampletree_treedef, &defrag->sampletree, sample, &path);
+    ddsrt_avl_insert_ipath (&defrag_sampletree_treedef, &defrag->sampletree, sample, &path);
     defrag->max_sample = sample;
     defrag->n_samples++;
     result = NULL;
   }
-  else if ((sample = ut_avlLookupIPath (&defrag_sampletree_treedef, &defrag->sampletree, &sampleinfo->seq, &path)) == NULL)
+  else if ((sample = ddsrt_avl_lookup_ipath (&defrag_sampletree_treedef, &defrag->sampletree, &sampleinfo->seq, &path)) == NULL)
   {
     /* a new sequence number, but smaller than the maximum */
     DDS_LOG(DDS_LC_RADMIN, "  new sample less than max\n");
     assert (sampleinfo->seq < max_seq);
     if ((sample = defrag_rsample_new (rdata, sampleinfo)) == NULL)
       return NULL;
-    ut_avlInsertIPath (&defrag_sampletree_treedef, &defrag->sampletree, sample, &path);
+    ddsrt_avl_insert_ipath (&defrag_sampletree_treedef, &defrag->sampletree, sample, &path);
     defrag->n_samples++;
     result = NULL;
   }
@@ -1390,12 +1390,12 @@ struct nn_rsample *nn_defrag_rsample (struct nn_defrag *defrag, struct nn_rdata
        reorder format. If it is the sample with the maximum sequence in
        the tree, an update of max_sample is required. */
     DDS_LOG(DDS_LC_RADMIN, "  complete\n");
-    ut_avlDelete (&defrag_sampletree_treedef, &defrag->sampletree, result);
+    ddsrt_avl_delete (&defrag_sampletree_treedef, &defrag->sampletree, result);
     assert (defrag->n_samples > 0);
     defrag->n_samples--;
     if (result == defrag->max_sample)
     {
-      defrag->max_sample = ut_avlFindMax (&defrag_sampletree_treedef, &defrag->sampletree);
+      defrag->max_sample = ddsrt_avl_find_max (&defrag_sampletree_treedef, &defrag->sampletree);
       DDS_LOG(DDS_LC_RADMIN, "  updating max_sample: now %p %"PRId64"\n",
               (void *) defrag->max_sample,
               defrag->max_sample ? defrag->max_sample->u.defrag.seq : 0);
@@ -1403,7 +1403,7 @@ struct nn_rsample *nn_defrag_rsample (struct nn_defrag *defrag, struct nn_rdata
     rsample_convert_defrag_to_reorder (result);
   }
 
-  assert (defrag->max_sample == ut_avlFindMax (&defrag_sampletree_treedef, &defrag->sampletree));
+  assert (defrag->max_sample == ddsrt_avl_find_max (&defrag_sampletree_treedef, &defrag->sampletree));
   return result;
 }
 
@@ -1412,14 +1412,14 @@ void nn_defrag_notegap (struct nn_defrag *defrag, seqno_t min, seqno_t maxp1)
   /* All sequence numbers in [min,maxp1) are unavailable so any
      fragments in that range must be discarded.  Used both for
      Hearbeats (by setting min=1) and for Gaps. */
-  struct nn_rsample *s = ut_avlLookupSuccEq (&defrag_sampletree_treedef, &defrag->sampletree, &min);
+  struct nn_rsample *s = ddsrt_avl_lookup_succ_eq (&defrag_sampletree_treedef, &defrag->sampletree, &min);
   while (s && s->u.defrag.seq < maxp1)
   {
-    struct nn_rsample *s1 = ut_avlFindSucc (&defrag_sampletree_treedef, &defrag->sampletree, s);
+    struct nn_rsample *s1 = ddsrt_avl_find_succ (&defrag_sampletree_treedef, &defrag->sampletree, s);
     defrag_rsample_drop (defrag, s);
     s = s1;
   }
-  defrag->max_sample = ut_avlFindMax (&defrag_sampletree_treedef, &defrag->sampletree);
+  defrag->max_sample = ddsrt_avl_find_max (&defrag_sampletree_treedef, &defrag->sampletree);
 }
 
 int nn_defrag_nackmap (struct nn_defrag *defrag, seqno_t seq, uint32_t maxfragnum, struct nn_fragment_number_set *map, uint32_t maxsz)
@@ -1428,7 +1428,7 @@ int nn_defrag_nackmap (struct nn_defrag *defrag, seqno_t seq, uint32_t maxfragnu
   struct nn_defrag_iv *iv;
   uint32_t i, fragsz, nfrags;
   assert (maxsz <= 256);
-  s = ut_avlLookup (&defrag_sampletree_treedef, &defrag->sampletree, &seq);
+  s = ddsrt_avl_lookup (&defrag_sampletree_treedef, &defrag->sampletree, &seq);
   if (s == NULL)
   {
     if (maxfragnum == UINT32_MAX)
@@ -1465,7 +1465,7 @@ int nn_defrag_nackmap (struct nn_defrag *defrag, seqno_t seq, uint32_t maxfragnu
        are missing the first fragment. */
     struct nn_defrag_iv *liv = s->u.defrag.lastfrag;
     nn_fragment_number_t map_end;
-    iv = ut_avlFindMin (&rsample_defrag_fragtree_treedef, &s->u.defrag.fragtree);
+    iv = ddsrt_avl_find_min (&rsample_defrag_fragtree_treedef, &s->u.defrag.fragtree);
     assert (iv != NULL);
     /* iv is first interval, iv->maxp1 is first byte beyond that =>
        divide by fragsz to get first missing fragment */
@@ -1485,7 +1485,7 @@ int nn_defrag_nackmap (struct nn_defrag *defrag, seqno_t seq, uint32_t maxfragnu
        map->bitmap_base, but there is nothing to request in that
        case. */
     map->numbits = (map_end < map->bitmap_base) ? 0 : map_end - map->bitmap_base + 1;
-    iv = ut_avlFindSucc (&rsample_defrag_fragtree_treedef, &s->u.defrag.fragtree, iv);
+    iv = ddsrt_avl_find_succ (&rsample_defrag_fragtree_treedef, &s->u.defrag.fragtree, iv);
   }
 
   /* Clear bitmap, then set bits for gaps in available fragments */
@@ -1515,7 +1515,7 @@ int nn_defrag_nackmap (struct nn_defrag *defrag, seqno_t seq, uint32_t maxfragnu
        at fragment containing maxp1 (because we don't have that byte
        yet), and runs until the next interval begins */
     i = iv->maxp1 / fragsz;
-    iv = ut_avlFindSucc (&rsample_defrag_fragtree_treedef, &s->u.defrag.fragtree, iv);
+    iv = ddsrt_avl_find_succ (&rsample_defrag_fragtree_treedef, &s->u.defrag.fragtree, iv);
   }
   /* and set bits for missing fragments beyond the highest interval */
   for (; i < map->bitmap_base + map->numbits; i++)
@@ -1603,7 +1603,7 @@ int nn_defrag_nackmap (struct nn_defrag *defrag, seqno_t seq, uint32_t maxfragnu
    in the overview comment at the top of this file. */
 
 struct nn_reorder {
-  ut_avlTree_t sampleivtree;
+  ddsrt_avl_tree_t sampleivtree;
   struct nn_rsample *max_sampleiv; /* = max(sampleivtree) */
   seqno_t next_seq;
   enum nn_reorder_mode mode;
@@ -1611,15 +1611,15 @@ struct nn_reorder {
   uint32_t n_samples;
 };
 
-static const ut_avlTreedef_t reorder_sampleivtree_treedef =
-  UT_AVL_TREEDEF_INITIALIZER (offsetof (struct nn_rsample, u.reorder.avlnode), offsetof (struct nn_rsample, u.reorder.min), compare_seqno, 0);
+static const ddsrt_avl_treedef_t reorder_sampleivtree_treedef =
+  DDSRT_AVL_TREEDEF_INITIALIZER (offsetof (struct nn_rsample, u.reorder.avlnode), offsetof (struct nn_rsample, u.reorder.min), compare_seqno, 0);
 
 struct nn_reorder *nn_reorder_new (enum nn_reorder_mode mode, uint32_t max_samples)
 {
   struct nn_reorder *r;
   if ((r = ddsrt_malloc (sizeof (*r))) == NULL)
     return NULL;
-  ut_avlInit (&reorder_sampleivtree_treedef, &r->sampleivtree);
+  ddsrt_avl_init (&reorder_sampleivtree_treedef, &r->sampleivtree);
   r->max_sampleiv = NULL;
   r->next_seq = 1;
   r->mode = mode;
@@ -1644,10 +1644,10 @@ void nn_reorder_free (struct nn_reorder *r)
   struct nn_rsample *iv;
   struct nn_rsample_chain_elem *sce;
   /* FXIME: instead of findmin/delete, a treewalk can be used. */
-  iv = ut_avlFindMin (&reorder_sampleivtree_treedef, &r->sampleivtree);
+  iv = ddsrt_avl_find_min (&reorder_sampleivtree_treedef, &r->sampleivtree);
   while (iv)
   {
-    ut_avlDelete (&reorder_sampleivtree_treedef, &r->sampleivtree, iv);
+    ddsrt_avl_delete (&reorder_sampleivtree_treedef, &r->sampleivtree, iv);
     sce = iv->u.reorder.sc.first;
     while (sce)
     {
@@ -1655,17 +1655,17 @@ void nn_reorder_free (struct nn_reorder *r)
       nn_fragchain_unref (sce->fragchain);
       sce = sce1;
     }
-    iv = ut_avlFindMin (&reorder_sampleivtree_treedef, &r->sampleivtree);
+    iv = ddsrt_avl_find_min (&reorder_sampleivtree_treedef, &r->sampleivtree);
   }
   ddsrt_free (r);
 }
 
 static void reorder_add_rsampleiv (struct nn_reorder *reorder, struct nn_rsample *rsample)
 {
-  ut_avlIPath_t path;
-  if (ut_avlLookupIPath (&reorder_sampleivtree_treedef, &reorder->sampleivtree, &rsample->u.reorder.min, &path) != NULL)
+  ddsrt_avl_ipath_t path;
+  if (ddsrt_avl_lookup_ipath (&reorder_sampleivtree_treedef, &reorder->sampleivtree, &rsample->u.reorder.min, &path) != NULL)
     assert (0);
-  ut_avlInsertIPath (&reorder_sampleivtree_treedef, &reorder->sampleivtree, rsample, &path);
+  ddsrt_avl_insert_ipath (&reorder_sampleivtree_treedef, &reorder->sampleivtree, rsample, &path);
 }
 
 #ifndef NDEBUG
@@ -1713,7 +1713,7 @@ static int reorder_try_append_and_discard (struct nn_reorder *reorder, struct nn
             appendto->u.reorder.min, appendto->u.reorder.maxp1, (void *) appendto,
             todiscard->u.reorder.min, todiscard->u.reorder.maxp1, (void *) todiscard);
     assert (todiscard->u.reorder.min == appendto->u.reorder.maxp1);
-    ut_avlDelete (&reorder_sampleivtree_treedef, &reorder->sampleivtree, todiscard);
+    ddsrt_avl_delete (&reorder_sampleivtree_treedef, &reorder->sampleivtree, todiscard);
     append_rsample_interval (appendto, todiscard);
     DDS_LOG(DDS_LC_RADMIN, "  try_append_and_discard: max_sampleiv needs update? %s\n",
             (todiscard == reorder->max_sampleiv) ? "yes" : "no");
@@ -1793,8 +1793,8 @@ static void delete_last_sample (struct nn_reorder *reorder)
        recalc max_sampleiv. */
     DDS_LOG(DDS_LC_RADMIN, "  delete_last_sample: in singleton interval\n");
     fragchain = last->sc.first->fragchain;
-    ut_avlDelete (&reorder_sampleivtree_treedef, &reorder->sampleivtree, reorder->max_sampleiv);
-    reorder->max_sampleiv = ut_avlFindMax (&reorder_sampleivtree_treedef, &reorder->sampleivtree);
+    ddsrt_avl_delete (&reorder_sampleivtree_treedef, &reorder->sampleivtree, reorder->max_sampleiv);
+    reorder->max_sampleiv = ddsrt_avl_find_max (&reorder_sampleivtree_treedef, &reorder->sampleivtree);
     /* No harm done if it the sampleivtree is empty, except that we
        chose not to allow it */
     assert (reorder->max_sampleiv != NULL);
@@ -1847,7 +1847,7 @@ nn_reorder_result_t nn_reorder_rsample (struct nn_rsample_chain *sc, struct nn_r
      seq; max must be set iff the reorder is non-empty. */
 #ifndef NDEBUG
   {
-    struct nn_rsample *min = ut_avlFindMin (&reorder_sampleivtree_treedef, &reorder->sampleivtree);
+    struct nn_rsample *min = ddsrt_avl_find_min (&reorder_sampleivtree_treedef, &reorder->sampleivtree);
     if (min)
       DDS_LOG(DDS_LC_RADMIN, "  min = %"PRId64" @ %p\n", min->u.reorder.min, (void *) min);
     assert (min == NULL || reorder->next_seq < min->u.reorder.min);
@@ -1855,8 +1855,8 @@ nn_reorder_result_t nn_reorder_rsample (struct nn_rsample_chain *sc, struct nn_r
             (reorder->max_sampleiv != NULL && min != NULL));
   }
 #endif
-  assert ((!!ut_avlIsEmpty (&reorder->sampleivtree)) == (reorder->max_sampleiv == NULL));
-  assert (reorder->max_sampleiv == NULL || reorder->max_sampleiv == ut_avlFindMax (&reorder_sampleivtree_treedef, &reorder->sampleivtree));
+  assert ((!!ddsrt_avl_is_empty (&reorder->sampleivtree)) == (reorder->max_sampleiv == NULL));
+  assert (reorder->max_sampleiv == NULL || reorder->max_sampleiv == ddsrt_avl_find_max (&reorder_sampleivtree_treedef, &reorder->sampleivtree));
   assert (reorder->n_samples <= reorder->max_samples);
   if (reorder->max_sampleiv)
     DDS_LOG(DDS_LC_RADMIN, "  max = [%"PRId64",%"PRId64") @ %p\n", reorder->max_sampleiv->u.reorder.min, reorder->max_sampleiv->u.reorder.maxp1, (void *) reorder->max_sampleiv);
@@ -1883,7 +1883,7 @@ nn_reorder_result_t nn_reorder_rsample (struct nn_rsample_chain *sc, struct nn_r
        out-of-order either ends up here or in discard.)  */
     if (reorder->max_sampleiv != NULL)
     {
-      struct nn_rsample *min = ut_avlFindMin (&reorder_sampleivtree_treedef, &reorder->sampleivtree);
+      struct nn_rsample *min = ddsrt_avl_find_min (&reorder_sampleivtree_treedef, &reorder->sampleivtree);
       DDS_LOG(DDS_LC_RADMIN, "  try append_and_discard\n");
       if (reorder_try_append_and_discard (reorder, rsampleiv, min))
         reorder->max_sampleiv = NULL;
@@ -1908,7 +1908,7 @@ nn_reorder_result_t nn_reorder_rsample (struct nn_rsample_chain *sc, struct nn_r
     DDS_LOG(DDS_LC_RADMIN, "  discard: too old\n");
     return NN_REORDER_TOO_OLD; /* don't want refcount increment */
   }
-  else if (ut_avlIsEmpty (&reorder->sampleivtree))
+  else if (ddsrt_avl_is_empty (&reorder->sampleivtree))
   {
     /* else, if nothing's stored simply add this one, max_samples = 0
        is technically allowed, and potentially useful, so check for
@@ -1989,7 +1989,7 @@ nn_reorder_result_t nn_reorder_rsample (struct nn_rsample_chain *sc, struct nn_r
       return NN_REORDER_REJECT;
     }
 
-    predeq = ut_avlLookupPredEq (&reorder_sampleivtree_treedef, &reorder->sampleivtree, &s->min);
+    predeq = ddsrt_avl_lookup_pred_eq (&reorder_sampleivtree_treedef, &reorder->sampleivtree, &s->min);
     if (predeq)
       DDS_LOG(DDS_LC_RADMIN, "  predeq = [%"PRId64",%"PRId64") @ %p\n",
               predeq->u.reorder.min, predeq->u.reorder.maxp1, (void *) predeq);
@@ -2002,7 +2002,7 @@ nn_reorder_result_t nn_reorder_rsample (struct nn_rsample_chain *sc, struct nn_r
       return NN_REORDER_REJECT;
     }
 
-    immsucc = ut_avlLookup (&reorder_sampleivtree_treedef, &reorder->sampleivtree, &s->maxp1);
+    immsucc = ddsrt_avl_lookup (&reorder_sampleivtree_treedef, &reorder->sampleivtree, &s->maxp1);
     if (immsucc)
       DDS_LOG(DDS_LC_RADMIN, "  immsucc = [%"PRId64",%"PRId64") @ %p\n",
               immsucc->u.reorder.min, immsucc->u.reorder.maxp1, (void *) immsucc);
@@ -2040,7 +2040,7 @@ nn_reorder_result_t nn_reorder_rsample (struct nn_rsample_chain *sc, struct nn_r
          Therefore, we can swap rsampleiv in for immsucc and avoid the
          case above. */
       rsampleiv->u.reorder = immsucc->u.reorder;
-      ut_avlSwapNode (&reorder_sampleivtree_treedef, &reorder->sampleivtree, immsucc, rsampleiv);
+      ddsrt_avl_swap_node (&reorder_sampleivtree_treedef, &reorder->sampleivtree, immsucc, rsampleiv);
       if (immsucc == reorder->max_sampleiv)
         reorder->max_sampleiv = rsampleiv;
     }
@@ -2072,12 +2072,12 @@ static struct nn_rsample *coalesce_intervals_touching_range (struct nn_reorder *
   struct nn_rsample *s, *t;
   *valuable = 0;
   /* Find first (lowest m) interval [m,n) s.t. n >= min && m <= maxp1 */
-  s = ut_avlLookupPredEq (&reorder_sampleivtree_treedef, &reorder->sampleivtree, &min);
+  s = ddsrt_avl_lookup_pred_eq (&reorder_sampleivtree_treedef, &reorder->sampleivtree, &min);
   if (s && s->u.reorder.maxp1 >= min)
   {
     /* m <= min && n >= min (note: pred of s [m',n') necessarily has n' < m) */
 #ifndef NDEBUG
-    struct nn_rsample *q = ut_avlFindPred (&reorder_sampleivtree_treedef, &reorder->sampleivtree, s);
+    struct nn_rsample *q = ddsrt_avl_find_pred (&reorder_sampleivtree_treedef, &reorder->sampleivtree, s);
     assert (q == NULL || q->u.reorder.maxp1 < min);
 #endif
   }
@@ -2086,15 +2086,15 @@ static struct nn_rsample *coalesce_intervals_touching_range (struct nn_reorder *
     /* No good, but the first (if s = NULL) or the next one (if s !=
        NULL) may still have m <= maxp1 (m > min is implied now).  If
        not, no such interval.  */
-    s = ut_avlFindSucc (&reorder_sampleivtree_treedef, &reorder->sampleivtree, s);
+    s = ddsrt_avl_find_succ (&reorder_sampleivtree_treedef, &reorder->sampleivtree, s);
     if (!(s && s->u.reorder.min <= maxp1))
       return NULL;
   }
   /* Append successors [m',n') s.t. m' <= maxp1 to s */
   assert (s->u.reorder.min + s->u.reorder.n_samples <= s->u.reorder.maxp1);
-  while ((t = ut_avlFindSucc (&reorder_sampleivtree_treedef, &reorder->sampleivtree, s)) != NULL && t->u.reorder.min <= maxp1)
+  while ((t = ddsrt_avl_find_succ (&reorder_sampleivtree_treedef, &reorder->sampleivtree, s)) != NULL && t->u.reorder.min <= maxp1)
   {
-    ut_avlDelete (&reorder_sampleivtree_treedef, &reorder->sampleivtree, t);
+    ddsrt_avl_delete (&reorder_sampleivtree_treedef, &reorder->sampleivtree, t);
     assert (t->u.reorder.min + t->u.reorder.n_samples <= t->u.reorder.maxp1);
     append_rsample_interval (s, t);
     *valuable = 1;
@@ -2126,8 +2126,8 @@ static int reorder_insert_gap (struct nn_reorder *reorder, struct nn_rdata *rdat
 {
   struct nn_rsample_chain_elem *sce;
   struct nn_rsample *s;
-  ut_avlIPath_t path;
-  if (ut_avlLookupIPath (&reorder_sampleivtree_treedef, &reorder->sampleivtree, &min, &path) != NULL)
+  ddsrt_avl_ipath_t path;
+  if (ddsrt_avl_lookup_ipath (&reorder_sampleivtree_treedef, &reorder->sampleivtree, &min, &path) != NULL)
     assert (0);
   if ((sce = nn_rmsg_alloc (rdata->rmsg, sizeof (*sce))) == NULL)
     return 0;
@@ -2140,7 +2140,7 @@ static int reorder_insert_gap (struct nn_reorder *reorder, struct nn_rdata *rdat
   s->u.reorder.min = min;
   s->u.reorder.maxp1 = maxp1;
   s->u.reorder.n_samples = 1;
-  ut_avlInsertIPath (&reorder_sampleivtree_treedef, &reorder->sampleivtree, s, &path);
+  ddsrt_avl_insert_ipath (&reorder_sampleivtree_treedef, &reorder->sampleivtree, s, &path);
   return 1;
 }
 
@@ -2225,7 +2225,7 @@ nn_reorder_result_t nn_reorder_gap (struct nn_rsample_chain *sc, struct nn_reord
         delete_last_sample (reorder);
       (*refcount_adjust)++;
     }
-    reorder->max_sampleiv = ut_avlFindMax (&reorder_sampleivtree_treedef, &reorder->sampleivtree);
+    reorder->max_sampleiv = ddsrt_avl_find_max (&reorder_sampleivtree_treedef, &reorder->sampleivtree);
     return res;
   }
   else if (coalesced->u.reorder.min <= reorder->next_seq)
@@ -2233,11 +2233,11 @@ nn_reorder_result_t nn_reorder_gap (struct nn_rsample_chain *sc, struct nn_reord
     DDS_LOG(DDS_LC_RADMIN, "  coalesced = [%"PRId64",%"PRId64") @ %p containing %d samples\n",
             coalesced->u.reorder.min, coalesced->u.reorder.maxp1,
             (void *) coalesced, coalesced->u.reorder.n_samples);
-    ut_avlDelete (&reorder_sampleivtree_treedef, &reorder->sampleivtree, coalesced);
+    ddsrt_avl_delete (&reorder_sampleivtree_treedef, &reorder->sampleivtree, coalesced);
     if (coalesced->u.reorder.min <= reorder->next_seq)
       assert (min <= reorder->next_seq);
     reorder->next_seq = coalesced->u.reorder.maxp1;
-    reorder->max_sampleiv = ut_avlFindMax (&reorder_sampleivtree_treedef, &reorder->sampleivtree);
+    reorder->max_sampleiv = ddsrt_avl_find_max (&reorder_sampleivtree_treedef, &reorder->sampleivtree);
     DDS_LOG(DDS_LC_RADMIN, "  next expected: %"PRId64"\n", reorder->next_seq);
     *sc = coalesced->u.reorder.sc;
 
@@ -2251,7 +2251,7 @@ nn_reorder_result_t nn_reorder_gap (struct nn_rsample_chain *sc, struct nn_reord
   {
     DDS_LOG(DDS_LC_RADMIN, "  coalesced = [%"PRId64",%"PRId64") @ %p - that is all\n",
             coalesced->u.reorder.min, coalesced->u.reorder.maxp1, (void *) coalesced);
-    reorder->max_sampleiv = ut_avlFindMax (&reorder_sampleivtree_treedef, &reorder->sampleivtree);
+    reorder->max_sampleiv = ddsrt_avl_find_max (&reorder_sampleivtree_treedef, &reorder->sampleivtree);
     return valuable ? NN_REORDER_ACCEPT : NN_REORDER_REJECT;
   }
 }
@@ -2264,7 +2264,7 @@ int nn_reorder_wantsample (struct nn_reorder *reorder, seqno_t seq)
     return 0;
   /* Find interval that contains seq, if we know seq.  We are
      interested if seq is outside this interval (if any). */
-  s = ut_avlLookupPredEq (&reorder_sampleivtree_treedef, &reorder->sampleivtree, &seq);
+  s = ddsrt_avl_lookup_pred_eq (&reorder_sampleivtree_treedef, &reorder->sampleivtree, &seq);
   return (s == NULL || s->u.reorder.maxp1 <= seq);
 }
 
@@ -2307,7 +2307,7 @@ unsigned nn_reorder_nackmap (struct nn_reorder *reorder, seqno_t base, seqno_t m
     map->numbits = (uint32_t) (maxseq + 1 - base);
   nn_bitset_zero (map->numbits, map->bits);
 
-  if ((iv = ut_avlFindMin (&reorder_sampleivtree_treedef, &reorder->sampleivtree)) != NULL)
+  if ((iv = ddsrt_avl_find_min (&reorder_sampleivtree_treedef, &reorder->sampleivtree)) != NULL)
     assert (iv->u.reorder.min > base);
   i = base;
   while (iv && i < base + map->numbits)
@@ -2318,7 +2318,7 @@ unsigned nn_reorder_nackmap (struct nn_reorder *reorder, seqno_t base, seqno_t m
       nn_bitset_set (map->numbits, map->bits, x);
     }
     i = iv->u.reorder.maxp1;
-    iv = ut_avlFindSucc (&reorder_sampleivtree_treedef, &reorder->sampleivtree, iv);
+    iv = ddsrt_avl_find_succ (&reorder_sampleivtree_treedef, &reorder->sampleivtree, iv);
   }
   if (notail && i < base + map->numbits)
     map->numbits = (unsigned) (i - base);
diff --git a/src/core/ddsi/src/q_receive.c b/src/core/ddsi/src/q_receive.c
index 8ea8c47..520c334 100644
--- a/src/core/ddsi/src/q_receive.c
+++ b/src/core/ddsi/src/q_receive.c
@@ -20,7 +20,7 @@
 #include "dds/ddsrt/sync.h"
 #include "dds/ddsrt/string.h"
 
-#include "dds/util/ut_avl.h"
+#include "dds/ddsrt/avl.h"
 #include "dds__stream.h"
 #include "dds/ddsi/q_protocol.h"
 #include "dds/ddsi/q_rtps.h"
@@ -767,7 +767,7 @@ static int handle_AckNack (struct receiver_state *rst, nn_etime_t tnow, const Ac
   }
 
   ddsrt_mutex_lock (&wr->e.lock);
-  if ((rn = ut_avlLookup (&wr_readers_treedef, &wr->readers, &src)) == NULL)
+  if ((rn = ddsrt_avl_lookup (&wr_readers_treedef, &wr->readers, &src)) == NULL)
   {
     DDS_TRACE(" %x:%x:%x:%x -> %x:%x:%x:%x not a connection)", PGUID (src), PGUID (dst));
     goto out;
@@ -823,7 +823,7 @@ static int handle_AckNack (struct receiver_state *rst, nn_etime_t tnow, const Ac
          that rn->seq <= wr->seq) */
       rn->seq = wr->seq;
     }
-    ut_avlAugmentUpdate (&wr_readers_treedef, rn);
+    ddsrt_avl_augment_update (&wr_readers_treedef, rn);
     n = remove_acked_messages (wr, &whcst, &deferred_free_list);
     DDS_TRACE(" ACK%"PRId64" RM%u", n_ack, n);
   }
@@ -850,7 +850,7 @@ static int handle_AckNack (struct receiver_state *rst, nn_etime_t tnow, const Ac
          that rn->seq <= wr->seq) */
       rn->seq = wr->seq;
     }
-    ut_avlAugmentUpdate (&wr_readers_treedef, rn);
+    ddsrt_avl_augment_update (&wr_readers_treedef, rn);
     DDS_LOG(DDS_LC_THROTTLE, "writer %x:%x:%x:%x considering reader %x:%x:%x:%x responsive again\n", PGUID (wr->e.guid), PGUID (rn->prd_guid));
   }
 
@@ -867,7 +867,7 @@ static int handle_AckNack (struct receiver_state *rst, nn_etime_t tnow, const Ac
     rn->has_replied_to_hb = 1;
     /* walk the whole tree to ensure all proxy readers for this writer
        have their unack'ed info updated */
-    ut_avlAugmentUpdate (&wr_readers_treedef, rn);
+    ddsrt_avl_augment_update (&wr_readers_treedef, rn);
   }
   if (is_preemptive_ack)
   {
@@ -1075,7 +1075,7 @@ static int handle_AckNack (struct receiver_state *rst, nn_etime_t tnow, const Ac
   return 1;
 }
 
-static void handle_forall_destinations (const nn_guid_t *dst, struct proxy_writer *pwr, ut_avlWalk_t fun, void *arg)
+static void handle_forall_destinations (const nn_guid_t *dst, struct proxy_writer *pwr, ddsrt_avl_walk_t fun, void *arg)
 {
   /* prefix:  id:   to:
      0        0     all matched readers
@@ -1093,12 +1093,12 @@ static void handle_forall_destinations (const nn_guid_t *dst, struct proxy_write
   switch ((haveprefix << 1) | haveid)
   {
     case (0 << 1) | 0: /* all: full treewalk */
-      ut_avlWalk (&pwr_readers_treedef, &pwr->readers, fun, arg);
+      ddsrt_avl_walk (&pwr_readers_treedef, &pwr->readers, fun, arg);
       break;
     case (0 << 1) | 1: /* all with correct entityid: special filtering treewalk */
       {
         struct pwr_rd_match *wn;
-        for (wn = ut_avlFindMin (&pwr_readers_treedef, &pwr->readers); wn; wn = ut_avlFindSucc (&pwr_readers_treedef, &pwr->readers, wn))
+        for (wn = ddsrt_avl_find_min (&pwr_readers_treedef, &pwr->readers); wn; wn = ddsrt_avl_find_succ (&pwr_readers_treedef, &pwr->readers, wn))
         {
           if (wn->rd_guid.entityid.u == dst->entityid.u)
             fun (wn, arg);
@@ -1110,13 +1110,13 @@ static void handle_forall_destinations (const nn_guid_t *dst, struct proxy_write
         nn_guid_t a, b;
         a = *dst; a.entityid.u = 0;
         b = *dst; b.entityid.u = ~0u;
-        ut_avlWalkRange (&pwr_readers_treedef, &pwr->readers, &a, &b, fun, arg);
+        ddsrt_avl_walk_range (&pwr_readers_treedef, &pwr->readers, &a, &b, fun, arg);
       }
       break;
     case (1 << 1) | 1: /* fully addressed: dst should exist (but for removal) */
       {
         struct pwr_rd_match *wn;
-        if ((wn = ut_avlLookup (&pwr_readers_treedef, &pwr->readers, dst)) != NULL)
+        if ((wn = ddsrt_avl_lookup (&pwr_readers_treedef, &pwr->readers, dst)) != NULL)
           fun (wn, arg);
       }
       break;
@@ -1289,7 +1289,7 @@ static int handle_Heartbeat (struct receiver_state *rst, nn_etime_t tnow, struct
       else
         nn_dqueue_enqueue (pwr->dqueue, &sc, res);
     }
-    for (wn = ut_avlFindMin (&pwr_readers_treedef, &pwr->readers); wn; wn = ut_avlFindSucc (&pwr_readers_treedef, &pwr->readers, wn))
+    for (wn = ddsrt_avl_find_min (&pwr_readers_treedef, &pwr->readers); wn; wn = ddsrt_avl_find_succ (&pwr_readers_treedef, &pwr->readers, wn))
       if (wn->in_sync != PRMSS_SYNC)
       {
         seqno_t last_deliv_seq = 0;
@@ -1324,7 +1324,7 @@ static int handle_Heartbeat (struct receiver_state *rst, nn_etime_t tnow, struct
   arg.timestamp = timestamp;
   arg.tnow = tnow;
   arg.tnow_mt = now_mt ();
-  handle_forall_destinations (&dst, pwr, (ut_avlWalk_t) handle_Heartbeat_helper, &arg);
+  handle_forall_destinations (&dst, pwr, (ddsrt_avl_walk_t) handle_Heartbeat_helper, &arg);
   DDS_TRACE(")");
 
   ddsrt_mutex_unlock (&pwr->e.lock);
@@ -1380,7 +1380,7 @@ static int handle_HeartbeatFrag (struct receiver_state *rst, UNUSED_ARG(nn_etime
      discover a missing fragment, which differs significantly from
      handle_Heartbeat's scheduling of an AckNack event when it must
      respond.  Why?  Just because. */
-  if (ut_avlIsEmpty (&pwr->readers) || pwr->local_matching_inprogress)
+  if (ddsrt_avl_is_empty (&pwr->readers) || pwr->local_matching_inprogress)
     DDS_TRACE(" no readers");
   else
   {
@@ -1392,19 +1392,19 @@ static int handle_HeartbeatFrag (struct receiver_state *rst, UNUSED_ARG(nn_etime
          assuming a reliable writer -> unreliable reader is rare, and
          so scanning the readers is acceptable if the first guess
          fails */
-      m = ut_avlRootNonEmpty (&pwr_readers_treedef, &pwr->readers);
+      m = ddsrt_avl_root_non_empty (&pwr_readers_treedef, &pwr->readers);
       if (m->acknack_xevent == NULL)
       {
-        m = ut_avlFindMin (&pwr_readers_treedef, &pwr->readers);
+        m = ddsrt_avl_find_min (&pwr_readers_treedef, &pwr->readers);
         while (m && m->acknack_xevent == NULL)
-          m = ut_avlFindSucc (&pwr_readers_treedef, &pwr->readers, m);
+          m = ddsrt_avl_find_succ (&pwr_readers_treedef, &pwr->readers, m);
       }
     }
     else if (seq < nn_reorder_next_seq (pwr->reorder))
     {
       /* Check out-of-sync readers -- should add a bit to cheaply test
          whether there are any (usually there aren't) */
-      m = ut_avlFindMin (&pwr_readers_treedef, &pwr->readers);
+      m = ddsrt_avl_find_min (&pwr_readers_treedef, &pwr->readers);
       while (m)
       {
         if ((m->in_sync == PRMSS_OUT_OF_SYNC) && m->acknack_xevent != NULL && nn_reorder_wantsample (m->u.not_in_sync.reorder, seq))
@@ -1414,7 +1414,7 @@ static int handle_HeartbeatFrag (struct receiver_state *rst, UNUSED_ARG(nn_etime
              reader to decide which fragments to nack */
           break;
         }
-        m = ut_avlFindSucc (&pwr_readers_treedef, &pwr->readers, m);
+        m = ddsrt_avl_find_succ (&pwr_readers_treedef, &pwr->readers, m);
       }
     }
 
@@ -1495,7 +1495,7 @@ static int handle_NackFrag (struct receiver_state *rst, nn_etime_t tnow, const N
   }
 
   ddsrt_mutex_lock (&wr->e.lock);
-  if ((rn = ut_avlLookup (&wr_readers_treedef, &wr->readers, &src)) == NULL)
+  if ((rn = ddsrt_avl_lookup (&wr_readers_treedef, &wr->readers, &src)) == NULL)
   {
     DDS_TRACE(" %x:%x:%x:%x -> %x:%x:%x:%x not a connection", PGUID (src), PGUID (dst));
     goto out;
@@ -1737,7 +1737,7 @@ static int handle_Gap (struct receiver_state *rst, nn_etime_t tnow, struct nn_rm
     lease_renew (ddsrt_atomic_ldvoidp (&pwr->c.proxypp->lease), tnow);
 
   ddsrt_mutex_lock (&pwr->e.lock);
-  if ((wn = ut_avlLookup (&pwr_readers_treedef, &pwr->readers, &dst)) == NULL)
+  if ((wn = ddsrt_avl_lookup (&pwr_readers_treedef, &pwr->readers, &dst)) == NULL)
   {
     DDS_TRACE("%x:%x:%x:%x -> %x:%x:%x:%x not a connection)", PGUID (src), PGUID (dst));
     ddsrt_mutex_unlock (&pwr->e.lock);
@@ -2069,11 +2069,11 @@ retry:
              we fall back to using the GUIDs so that we can deliver all
              samples we received from it. As writer being deleted any
              reliable samples that are rejected are simply discarded. */
-          ut_avlIter_t it;
+          ddsrt_avl_iter_t it;
           struct pwr_rd_match *m;
           ddsrt_mutex_unlock (&pwr->rdary.rdary_lock);
           if (!pwr_locked) ddsrt_mutex_lock (&pwr->e.lock);
-          for (m = ut_avlIterFirst (&pwr_readers_treedef, &pwr->readers, &it); m != NULL; m = ut_avlIterNext (&it))
+          for (m = ddsrt_avl_iter_first (&pwr_readers_treedef, &pwr->readers, &it); m != NULL; m = ddsrt_avl_iter_next (&it))
           {
             struct reader *rd;
             if ((rd = ephash_lookup_reader_guid (&m->rd_guid)) != NULL)
@@ -2138,7 +2138,7 @@ static void clean_defrag (struct proxy_writer *pwr)
   if (pwr->n_readers_out_of_sync > 0)
   {
     struct pwr_rd_match *wn;
-    for (wn = ut_avlFindMin (&pwr_readers_treedef, &pwr->readers); wn != NULL; wn = ut_avlFindSucc (&pwr_readers_treedef, &pwr->readers, wn))
+    for (wn = ddsrt_avl_find_min (&pwr_readers_treedef, &pwr->readers); wn != NULL; wn = ddsrt_avl_find_succ (&pwr_readers_treedef, &pwr->readers, wn))
     {
       if (wn->in_sync == PRMSS_OUT_OF_SYNC)
       {
@@ -2199,7 +2199,7 @@ static void handle_regular (struct receiver_state *rst, nn_etime_t tnow, struct
     return;
   }
 
-  if (ut_avlIsEmpty (&pwr->readers) || pwr->local_matching_inprogress)
+  if (ddsrt_avl_is_empty (&pwr->readers) || pwr->local_matching_inprogress)
   {
     ddsrt_mutex_unlock (&pwr->e.lock);
     DDS_TRACE(" %x:%x:%x:%x -> %x:%x:%x:%x: no readers", PGUID (pwr->e.guid), PGUID (dst));
@@ -2274,9 +2274,9 @@ static void handle_regular (struct receiver_state *rst, nn_etime_t tnow, struct
            writer may have become in sync with the proxy writer and the
            writer; those catching up with TL all by themselves go through
            the "TOO_OLD" path below. */
-        ut_avlIter_t it;
+        ddsrt_avl_iter_t it;
         struct pwr_rd_match *wn;
-        for (wn = ut_avlIterFirst (&pwr_readers_treedef, &pwr->readers, &it); wn != NULL; wn = ut_avlIterNext (&it))
+        for (wn = ddsrt_avl_iter_first (&pwr_readers_treedef, &pwr->readers, &it); wn != NULL; wn = ddsrt_avl_iter_next (&it))
           if (wn->in_sync == PRMSS_TLCATCHUP)
             maybe_set_reader_in_sync (pwr, wn, sampleinfo->seq);
       }
@@ -2286,7 +2286,7 @@ static void handle_regular (struct receiver_state *rst, nn_etime_t tnow, struct
       struct pwr_rd_match *wn;
       struct nn_rsample *rsample_dup = NULL;
       int reuse_rsample_dup = 0;
-      for (wn = ut_avlFindMin (&pwr_readers_treedef, &pwr->readers); wn != NULL; wn = ut_avlFindSucc (&pwr_readers_treedef, &pwr->readers, wn))
+      for (wn = ddsrt_avl_find_min (&pwr_readers_treedef, &pwr->readers); wn != NULL; wn = ddsrt_avl_find_succ (&pwr_readers_treedef, &pwr->readers, wn))
       {
         nn_reorder_result_t rres2;
         if (wn->in_sync != PRMSS_OUT_OF_SYNC || sampleinfo->seq > wn->u.not_in_sync.end_of_out_of_sync_seq)
@@ -2380,7 +2380,7 @@ static void drop_oversize (struct receiver_state *rst, struct nn_rmsg *rmsg, con
     dst.entityid = msg->readerId;
 
     ddsrt_mutex_lock (&pwr->e.lock);
-    wn = ut_avlLookup (&pwr_readers_treedef, &pwr->readers, &dst);
+    wn = ddsrt_avl_lookup (&pwr_readers_treedef, &pwr->readers, &dst);
     gap_was_valuable = handle_one_gap (pwr, wn, sampleinfo->seq, sampleinfo->seq+1, gap, &refc_adjust);
     nn_fragchain_adjust_refcount (gap, refc_adjust);
     ddsrt_mutex_unlock (&pwr->e.lock);
diff --git a/src/core/ddsi/src/q_transmit.c b/src/core/ddsi/src/q_transmit.c
index 086187e..4d67295 100644
--- a/src/core/ddsi/src/q_transmit.c
+++ b/src/core/ddsi/src/q_transmit.c
@@ -15,7 +15,7 @@
 #include "dds/ddsrt/heap.h"
 #include "dds/ddsrt/sync.h"
 
-#include "dds/util/ut_avl.h"
+#include "dds/ddsrt/avl.h"
 #include "dds/ddsi/q_entity.h"
 #include "dds/ddsi/q_addrset.h"
 #include "dds/ddsi/q_xmsg.h"
@@ -51,12 +51,12 @@
 
 static const struct wr_prd_match *root_rdmatch (const struct writer *wr)
 {
-  return ut_avlRoot (&wr_readers_treedef, &wr->readers);
+  return ddsrt_avl_root (&wr_readers_treedef, &wr->readers);
 }
 
 static int have_reliable_subs (const struct writer *wr)
 {
-  if (ut_avlIsEmpty (&wr->readers) || root_rdmatch (wr)->min_seq == MAX_SEQ_NUMBER)
+  if (ddsrt_avl_is_empty (&wr->readers) || root_rdmatch (wr)->min_seq == MAX_SEQ_NUMBER)
     return 0;
   else
     return 1;
@@ -152,7 +152,7 @@ struct nn_xmsg *writer_hbcontrol_create_heartbeat (struct writer *wr, const stru
     /* out of memory at worst slows down traffic */
     return NULL;
 
-  if (ut_avlIsEmpty (&wr->readers) || wr->num_reliable_readers == 0)
+  if (ddsrt_avl_is_empty (&wr->readers) || wr->num_reliable_readers == 0)
   {
     /* Not really supposed to come here, at least not for the first
        case. Secondly, there really seems to be little use for
@@ -192,9 +192,9 @@ struct nn_xmsg *writer_hbcontrol_create_heartbeat (struct writer *wr, const stru
     DDS_TRACE("unicasting to prd %x:%x:%x:%x ", PGUID (*prd_guid));
   DDS_TRACE("(rel-prd %d seq-eq-max %d seq %"PRId64" maxseq %"PRId64")\n",
           wr->num_reliable_readers,
-          ut_avlIsEmpty (&wr->readers) ? -1 : root_rdmatch (wr)->num_reliable_readers_where_seq_equals_max,
+          ddsrt_avl_is_empty (&wr->readers) ? -1 : root_rdmatch (wr)->num_reliable_readers_where_seq_equals_max,
           wr->seq,
-          ut_avlIsEmpty (&wr->readers) ? (seqno_t) -1 : root_rdmatch (wr)->max_seq);
+          ddsrt_avl_is_empty (&wr->readers) ? (seqno_t) -1 : root_rdmatch (wr)->max_seq);
 
   if (prd_guid == NULL)
   {
@@ -312,8 +312,8 @@ struct nn_xmsg *writer_hbcontrol_piggyback (struct writer *wr, const struct whc_
             PGUID (wr->e.guid),
             *hbansreq ? "" : " final",
             (hbc->tsched.v == T_NEVER) ? POS_INFINITY_DOUBLE : (double) (hbc->tsched.v - tnow.v) / 1e9,
-            ut_avlIsEmpty (&wr->readers) ? -1 : root_rdmatch (wr)->min_seq,
-            ut_avlIsEmpty (&wr->readers) || root_rdmatch (wr)->all_have_replied_to_hb ? "" : "!",
+            ddsrt_avl_is_empty (&wr->readers) ? -1 : root_rdmatch (wr)->min_seq,
+            ddsrt_avl_is_empty (&wr->readers) || root_rdmatch (wr)->all_have_replied_to_hb ? "" : "!",
             whcst->max_seq, READ_SEQ_XMIT(wr));
   }
 
diff --git a/src/core/ddsi/src/q_xevent.c b/src/core/ddsi/src/q_xevent.c
index b5d6c86..bbeb9c2 100644
--- a/src/core/ddsi/src/q_xevent.c
+++ b/src/core/ddsi/src/q_xevent.c
@@ -16,8 +16,8 @@
 #include "dds/ddsrt/heap.h"
 #include "dds/ddsrt/sync.h"
 
-#include "dds/util/ut_avl.h"
-#include "dds/util/ut_fibheap.h"
+#include "dds/ddsrt/avl.h"
+#include "dds/ddsrt/fibheap.h"
 
 #include "dds/ddsi/q_time.h"
 #include "dds/ddsi/q_log.h"
@@ -70,7 +70,7 @@ enum xeventkind
 
 struct xevent
 {
-  ut_fibheapNode_t heapnode;
+  ddsrt_fibheap_node_t heapnode;
   struct xeventq *evq;
   nn_mtime_t tsched;
   enum xeventkind kind;
@@ -133,7 +133,7 @@ struct xevent_nt
       /* xmsg is self-contained / relies on reference counts */
       struct nn_xmsg *msg;
       size_t queued_rexmit_bytes;
-      ut_avlNode_t msg_avlnode;
+      ddsrt_avl_node_t msg_avlnode;
     } msg_rexmit;
     struct {
       /* xmsg is self-contained / relies on reference counts */
@@ -143,8 +143,8 @@ struct xevent_nt
 };
 
 struct xeventq {
-  ut_fibheap_t xevents;
-  ut_avlTree_t msg_xevents;
+  ddsrt_fibheap_t xevents;
+  ddsrt_avl_tree_t msg_xevents;
   struct xevent_nt *non_timed_xmit_list_oldest;
   struct xevent_nt *non_timed_xmit_list_newest; /* undefined if ..._oldest == NULL */
   size_t queued_rexmit_bytes;
@@ -164,9 +164,9 @@ static nn_mtime_t earliest_in_xeventq (struct xeventq *evq);
 static int msg_xevents_cmp (const void *a, const void *b);
 static int compare_xevent_tsched (const void *va, const void *vb);
 
-static const ut_avlTreedef_t msg_xevents_treedef = UT_AVL_TREEDEF_INITIALIZER_INDKEY (offsetof (struct xevent_nt, u.msg_rexmit.msg_avlnode), offsetof (struct xevent_nt, u.msg_rexmit.msg), msg_xevents_cmp, 0);
+static const ddsrt_avl_treedef_t msg_xevents_treedef = DDSRT_AVL_TREEDEF_INITIALIZER_INDKEY (offsetof (struct xevent_nt, u.msg_rexmit.msg_avlnode), offsetof (struct xevent_nt, u.msg_rexmit.msg), msg_xevents_cmp, 0);
 
-static const ut_fibheapDef_t evq_xevents_fhdef = UT_FIBHEAPDEF_INITIALIZER(offsetof (struct xevent, heapnode), compare_xevent_tsched);
+static const ddsrt_fibheap_def_t evq_xevents_fhdef = DDSRT_FIBHEAPDEF_INITIALIZER(offsetof (struct xevent, heapnode), compare_xevent_tsched);
 
 static int compare_xevent_tsched (const void *va, const void *vb)
 {
@@ -209,21 +209,21 @@ static struct xevent_nt *lookup_msg (struct xeventq *evq, struct nn_xmsg *msg)
 {
   assert (nn_xmsg_kind (msg) == NN_XMSG_KIND_DATA_REXMIT);
   trace_msg ("lookup-msg", msg);
-  return ut_avlLookup (&msg_xevents_treedef, &evq->msg_xevents, msg);
+  return ddsrt_avl_lookup (&msg_xevents_treedef, &evq->msg_xevents, msg);
 }
 
 static void remember_msg (struct xeventq *evq, struct xevent_nt *ev)
 {
   assert (ev->kind == XEVK_MSG_REXMIT);
   trace_msg ("remember-msg", ev->u.msg_rexmit.msg);
-  ut_avlInsert (&msg_xevents_treedef, &evq->msg_xevents, ev);
+  ddsrt_avl_insert (&msg_xevents_treedef, &evq->msg_xevents, ev);
 }
 
 static void forget_msg (struct xeventq *evq, struct xevent_nt *ev)
 {
   assert (ev->kind == XEVK_MSG_REXMIT);
   trace_msg ("forget-msg", ev->u.msg_rexmit.msg);
-  ut_avlDelete (&msg_xevents_treedef, &evq->msg_xevents, ev);
+  ddsrt_avl_delete (&msg_xevents_treedef, &evq->msg_xevents, ev);
 }
 
 static void add_to_non_timed_xmit_list (struct xeventq *evq, struct xevent_nt *ev)
@@ -330,7 +330,7 @@ static void free_xevent_nt (struct xeventq *evq, struct xevent_nt *ev)
       nn_xmsg_free (ev->u.msg.msg);
       break;
     case XEVK_MSG_REXMIT:
-      assert (ut_avlLookup (&msg_xevents_treedef, &evq->msg_xevents, ev->u.msg_rexmit.msg) == NULL);
+      assert (ddsrt_avl_lookup (&msg_xevents_treedef, &evq->msg_xevents, ev->u.msg_rexmit.msg) == NULL);
       update_rexmit_counts (evq, ev);
       nn_xmsg_free (ev->u.msg_rexmit.msg);
       break;
@@ -351,12 +351,12 @@ void delete_xevent (struct xevent *ev)
   if (ev->tsched.v != T_NEVER)
   {
     ev->tsched.v = TSCHED_DELETE;
-    ut_fibheapDecreaseKey (&evq_xevents_fhdef, &evq->xevents, ev);
+    ddsrt_fibheap_decrease_key (&evq_xevents_fhdef, &evq->xevents, ev);
   }
   else
   {
     ev->tsched.v = TSCHED_DELETE;
-    ut_fibheapInsert (&evq_xevents_fhdef, &evq->xevents, ev);
+    ddsrt_fibheap_insert (&evq_xevents_fhdef, &evq->xevents, ev);
   }
   /* TSCHED_DELETE is absolute minimum time, so chances are we need to
      wake up the thread.  The superfluous signal is harmless. */
@@ -384,12 +384,12 @@ int resched_xevent_if_earlier (struct xevent *ev, nn_mtime_t tsched)
     if (ev->tsched.v != T_NEVER)
     {
       ev->tsched = tsched;
-      ut_fibheapDecreaseKey (&evq_xevents_fhdef, &evq->xevents, ev);
+      ddsrt_fibheap_decrease_key (&evq_xevents_fhdef, &evq->xevents, ev);
     }
     else
     {
       ev->tsched = tsched;
-      ut_fibheapInsert (&evq_xevents_fhdef, &evq->xevents, ev);
+      ddsrt_fibheap_insert (&evq_xevents_fhdef, &evq->xevents, ev);
     }
     is_resched = 1;
     if (tsched.v < tbefore.v)
@@ -435,7 +435,7 @@ static nn_mtime_t earliest_in_xeventq (struct xeventq *evq)
 {
   struct xevent *min;
   ASSERT_MUTEX_HELD (&evq->lock);
-  if ((min = ut_fibheapMin (&evq_xevents_fhdef, &evq->xevents)) != NULL)
+  if ((min = ddsrt_fibheap_min (&evq_xevents_fhdef, &evq->xevents)) != NULL)
     return min->tsched;
   else
   {
@@ -453,7 +453,7 @@ static void qxev_insert (struct xevent *ev)
   if (ev->tsched.v != T_NEVER)
   {
     nn_mtime_t tbefore = earliest_in_xeventq (evq);
-    ut_fibheapInsert (&evq_xevents_fhdef, &evq->xevents, ev);
+    ddsrt_fibheap_insert (&evq_xevents_fhdef, &evq->xevents, ev);
     if (ev->tsched.v < tbefore.v)
       ddsrt_cond_signal (&evq->cond);
   }
@@ -485,8 +485,8 @@ struct xeventq * xeventq_new
   /* limit to 2GB to prevent overflow (4GB - 64kB should be ok, too) */
   if (max_queued_rexmit_bytes > 2147483648u)
     max_queued_rexmit_bytes = 2147483648u;
-  ut_fibheapInit (&evq_xevents_fhdef, &evq->xevents);
-  ut_avlInit (&msg_xevents_treedef, &evq->msg_xevents);
+  ddsrt_fibheap_init (&evq_xevents_fhdef, &evq->xevents);
+  ddsrt_avl_init (&msg_xevents_treedef, &evq->msg_xevents);
   evq->non_timed_xmit_list_oldest = NULL;
   evq->non_timed_xmit_list_newest = NULL;
   evq->terminate = 0;
@@ -540,7 +540,7 @@ void xeventq_free (struct xeventq *evq)
 {
   struct xevent *ev;
   assert (evq->ts == NULL);
-  while ((ev = ut_fibheapExtractMin (&evq_xevents_fhdef, &evq->xevents)) != NULL)
+  while ((ev = ddsrt_fibheap_extract_min (&evq_xevents_fhdef, &evq->xevents)) != NULL)
   {
     if (ev->tsched.v == TSCHED_DELETE || ev->kind != XEVK_CALLBACK)
       free_xevent (evq, ev);
@@ -559,7 +559,7 @@ void xeventq_free (struct xeventq *evq)
   }
   while (!non_timed_xmit_list_is_empty(evq))
     free_xevent_nt (evq, getnext_from_non_timed_xmit_list (evq));
-  assert (ut_avlIsEmpty (&evq->msg_xevents));
+  assert (ddsrt_avl_is_empty (&evq->msg_xevents));
   ddsrt_cond_destroy (&evq->cond);
   ddsrt_mutex_destroy (&evq->lock);
   ddsrt_free (evq);
@@ -636,8 +636,8 @@ static void handle_xevk_heartbeat (struct nn_xpack *xp, struct xevent *ev, nn_mt
           hbansreq ? "" : " final",
           msg ? "sent" : "suppressed",
           (t_next.v == T_NEVER) ? POS_INFINITY_DOUBLE : (double)(t_next.v - tnow.v) / 1e9,
-          ut_avlIsEmpty (&wr->readers) ? (seqno_t) -1 : ((struct wr_prd_match *) ut_avlRootNonEmpty (&wr_readers_treedef, &wr->readers))->min_seq,
-          ut_avlIsEmpty (&wr->readers) || ((struct wr_prd_match *) ut_avlRootNonEmpty (&wr_readers_treedef, &wr->readers))->all_have_replied_to_hb ? "" : "!",
+          ddsrt_avl_is_empty (&wr->readers) ? (seqno_t) -1 : ((struct wr_prd_match *) ddsrt_avl_root_non_empty (&wr_readers_treedef, &wr->readers))->min_seq,
+          ddsrt_avl_is_empty (&wr->readers) || ((struct wr_prd_match *) ddsrt_avl_root_non_empty (&wr_readers_treedef, &wr->readers))->all_have_replied_to_hb ? "" : "!",
           whcst.max_seq, READ_SEQ_XMIT(wr));
   resched_xevent_if_earlier (ev, t_next);
   wr->hbcontrol.tsched = t_next;
@@ -888,7 +888,7 @@ static void handle_xevk_acknack (UNUSED_ARG (struct nn_xpack *xp), struct xevent
   }
 
   ddsrt_mutex_lock (&pwr->e.lock);
-  if ((rwn = ut_avlLookup (&pwr_readers_treedef, &pwr->readers, &ev->u.acknack.rd_guid)) == NULL)
+  if ((rwn = ddsrt_avl_lookup (&pwr_readers_treedef, &pwr->readers, &ev->u.acknack.rd_guid)) == NULL)
   {
     ddsrt_mutex_unlock (&pwr->e.lock);
     return;
@@ -1322,7 +1322,7 @@ static void handle_xevents (struct thread_state1 * const ts1, struct xeventq *xe
   {
     while (earliest_in_xeventq(xevq).v <= tnow.v)
     {
-      struct xevent *xev = ut_fibheapExtractMin (&evq_xevents_fhdef, &xevq->xevents);
+      struct xevent *xev = ddsrt_fibheap_extract_min (&evq_xevents_fhdef, &xevq->xevents);
       if (xev->tsched.v == TSCHED_DELETE)
       {
         free_xevent (xevq, xev);
diff --git a/src/core/ddsi/src/q_xmsg.c b/src/core/ddsi/src/q_xmsg.c
index 4fc0e57..6e3a6ef 100644
--- a/src/core/ddsi/src/q_xmsg.c
+++ b/src/core/ddsi/src/q_xmsg.c
@@ -23,8 +23,8 @@
 #include "dds/ddsrt/heap.h"
 #include "dds/ddsrt/random.h"
 
-#include "dds/util/ut_avl.h"
-#include "dds/util/ut_thread_pool.h"
+#include "dds/ddsrt/avl.h"
+#include "dds/ddsrt/thread_pool.h"
 
 #include "dds/ddsi/q_protocol.h"
 #include "dds/ddsi/q_xqos.h"
@@ -1340,7 +1340,7 @@ static void nn_xpack_send1_threaded (const nn_locator_t *loc, void * varg)
   arg->xp = (struct nn_xpack *) varg;
   arg->loc = loc;
   ddsrt_atomic_inc32 (&arg->xp->calls);
-  ut_thread_pool_submit (gv.thread_pool, nn_xpack_send1_thread, arg);
+  ddsrt_thread_pool_submit (gv.thread_pool, nn_xpack_send1_thread, arg);
 }
 
 static void nn_xpack_send_real (struct nn_xpack * xp)
diff --git a/src/core/xtests/CMakeLists.txt b/src/core/xtests/CMakeLists.txt
index 0b1d362..02b7bfd 100644
--- a/src/core/xtests/CMakeLists.txt
+++ b/src/core/xtests/CMakeLists.txt
@@ -18,7 +18,7 @@ target_include_directories(
   "$<BUILD_INTERFACE:${CMAKE_CURRENT_SOURCE_DIR}/../ddsc/src>"
   "$<BUILD_INTERFACE:${CMAKE_CURRENT_SOURCE_DIR}/../ddsi/include>")
 
-target_link_libraries(rhc_torture RhcTypes ddsc util)
+target_link_libraries(rhc_torture RhcTypes ddsc)
 
 add_test(
   NAME rhc_torture
diff --git a/src/ddsrt/CMakeLists.txt b/src/ddsrt/CMakeLists.txt
index 7830104..404f425 100644
--- a/src/ddsrt/CMakeLists.txt
+++ b/src/ddsrt/CMakeLists.txt
@@ -78,6 +78,21 @@ list(APPEND sources
   "${source_path}/strtod.c"
   "${source_path}/strtol.c")
 
+list(APPEND headers
+  "${source_path}/dds/ddsrt/avl.h"
+  "${source_path}/dds/ddsrt/expand_envvars.h"
+  "${source_path}/dds/ddsrt/fibheap.h"
+  "${source_path}/dds/ddsrt/hopscotch.h"
+  "${source_path}/dds/ddsrt/thread_pool.h")
+
+list(APPEND sources
+  "${source_path}/avl.c"
+  "${source_path}/expand_envvars.c"
+  "${source_path}/fibheap.c"
+  "${source_path}/hopscotch.c"
+  "${source_path}/thread_pool.c"
+  "${source_path}/xmlparser.c")
+
 # Not every target offers the same set of features. For embedded targets the
 # set of features may even be different between builds. e.g. a FreeRTOS build
 # could use the lightweight IP stack, but later change to FreeRTOS+TCP.
diff --git a/src/ddsrt/include/dds/ddsrt/avl.h b/src/ddsrt/include/dds/ddsrt/avl.h
new file mode 100644
index 0000000..a99f206
--- /dev/null
+++ b/src/ddsrt/include/dds/ddsrt/avl.h
@@ -0,0 +1,359 @@
+/*
+ * Copyright(c) 2006 to 2018 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+#ifndef DDSRT_AVL_H
+#define DDSRT_AVL_H
+
+/* The tree library never performs memory allocations or deallocations internally.
+
+   - Treedef_t: defines the properties of the tree, offsets,
+     comparison functions, augmented structures, flags -- these are
+     related to the code/data structure in which the tree is embedded,
+     and in nearly all cases known at compile time.
+   - avlTree_t: represents the tree, i.e., pointer to the root.
+   - avlNode_t: contains the administrative data for a single node in
+     the tree.
+
+   For a tree node:
+     struct T {
+       avlNode_t avlnode;
+       int key;
+     };
+   by definition, avlnodeoffset == offsetof(struct T, avlnode) and
+   keyoffset = offsetof(struct T, key). The user of the library only
+   ever deals in pointers to (in this case) struct T, never with
+   pointers to the avlNode_t, and the compare function operations on
+   pointers to keys, in this case pointers to "int"s. If you wish, you
+   can also do: keyoffset = 0, in which case the compare function
+   would be operating on struct T's.
+
+   The compare function is assumed to behave just like all compare
+   functions in the C library: < 0, =0, >0 for left argument less
+   than, equal to or greater than the right argument.
+
+   The "augment" function is automatically called whenever some of the
+   children of a node change, as well as when the "augment" function
+   has been called on some of the children. It allows you to maintain
+   a "summary" of the subtree -- currently only used in ddsi2e, in one
+   spot.
+
+   Trees come in various "variants", configured through "treedef"
+   flags:
+   - direct/indirect key: direct meaning the key value is embedded in
+     the structure containing the avlNode_t, indirect meaning a
+     pointer to the key value is. The compare function doesn't deal
+     with tree nodes, but with key values.
+   - re-entrant: in the style of the C library, meaning, the
+     comparison function gets a user-supplied 3rd argument (in
+     particular used by mmstat).
+   - unique keys/duplicate keys: when keys must be unique, some
+     optimizations apply; it is up to the caller to ensure one doesn't
+     violate the uniqueness of the keys (it'll happily crash in insert
+     if you don't); when duplicate keys are allowed, a forward scan of
+     the tree will visit them in the order of insertion.
+
+   For a tree node:
+     struct T {
+       avlnode_t avlnode;
+      char *key;
+     };
+   you could set the "indirect" flag, and then you simply use
+   strcmp(), avoiding the need for passing templates in looking up key
+   values. Much nicer.
+
+   There is also an orthogonal variant that is enforced through the
+   type system -- note that would be possible for all of the above as
+   well, but the number of cases simply explodes and none of the above
+   flags affects the dynamically changing data structures (just the
+   tree definition), unlike this one.
+
+   - the "C" variant keeps track of the number of nodes in the tree to
+     support a "count" operation in O(1) time, but is otherwise
+     identical.
+
+   The various initializer macros and TreedefInit functions should
+   make sense with this.
+
+   All functions for looking up nodes return NULL if there is no node
+   satisfying the requirements.
+
+   - Init: initializes a tree (really just: root = NULL, perhaps count = 0)
+   - Free: calls "freefun" on each node, which may free the node
+   - FreeArg: as "Free", but with an extra, user-supplied, argument
+   - Root: returns the root node
+   - Lookup: returns a node with key value "key" (ref allowdups flag)
+   - LookupIPath: like Lookup, but also filling an IPath_t structure
+     for efficient insertion in case of a failed lookup (or inserting
+     duplicates)
+   - LookupDPath: like Lookup, but also filling a DPath_t structure
+     that helps with deleting a node
+   - LookupPredEq: locates the node with the greatest key value <= "key"
+   - LookupSuccEq: similar, but smallest key value >= "key"
+   - LookupPred: similar, < "key"
+   - LookupSucc: similar, > "key"
+   - Insert: convenience function: LookupIPath ; InsertIPath
+   - Delete: convenience function: LookupDPath ; DeleteDPath
+   - InsertIPath: insert node based on the "path" obtained from LookupIPath
+   - DeleteDPath: delete node, using information in "path" to do so efficiently
+   - SwapNode: replace "oldn" by "newn" without modifying the tree
+     structure (the key need not be equal, but must be
+     FindPred(oldn).key < newn.key < FindSucc(oldn).key, where a
+     non-existing predecessor has key -inf and a non-existing
+     successor has key +inf, and where it is understood that the <
+     operator becomes <= if allowdups is set
+   - AugmentUpdate: to be called when something in "node" changes that
+     affects the subtree "summary" computed by the configured
+     "augment" function
+   - IsEmpty: returns 1 if tree is empty, 0 if not
+   - IsSingleton: returns 1 if tree contains exactly one node, 0 if not
+   - FindMin: returns the node with the smallest key value in the tree
+   - FindMax: similar, largest key value
+   - FindPred: preceding node in in-order treewalk
+   - FindSucc: similar, following node
+
+   - Walk: calls "f" with user-supplied argument "a" once for each
+     node, starting at FindMin and ending at FindMax
+   - ConstWalk: same, but with a const tree
+   - WalkRange: like Walk, but only visiting nodes with key values in
+     range [min,max] (that's inclusive)
+   - ConstWalkRange: same, but with a const tree
+   - WalkRangeReverse: like WalkRange, but in the reverse direction
+   - ConstWalkRangeReverse: same, but with a const tree
+   - IterFirst: starts forward iteration, starting at (and returning) FindMin
+   - IterSuccEq: similar, starting at LookupSuccEq
+   - IterSucc: similar, starting at LookupSucc
+   - IterNext: returns FindSucc(last returned node); may not be called
+     if preceding IterXXX call on same "iter" returned NULL
+
+   That's all there is to it.
+
+   Note that all calls to Walk(f,a) can be rewritten as:
+     for(n=IterFirst(&it); n; n=IterNext(&it)) { f(n,a) }
+   or as
+     for(n=FindMin(); n; n=FindSucc(n)) { f(n,a) }
+
+   The walk functions and iterators may not alter the tree
+   structure. If that is desired, the latter can easily be rewritten
+   as:
+     n=FindMin() ; while(n) { nn=FindSucc(n); f(n,a); n=nn }
+   because FindMin/FindSucc doesn't store any information to allow
+   fast processing. That'll allow every operation, with the obvious
+   exception of f(n) calling Delete(FindSucc(n)).
+
+   Currently, all trees maintain parent pointers, but it may be worth
+   doing a separate set without it, as it reduces the size of
+   avlNode_t. But in that case, the FindMin/FindSucc option would no
+   longer be a reasonable option because it would be prohibitively
+   expensive, whereas the IterFirst/IterNext option are alway
+   efficiently. If one were to do a threaded tree variant, the
+   implemetantion of IterFirst/IterNext would become absolute trivial
+   and faster still, but at the cost of significantly more overhead in
+   memory and updates. */
+
+#include <stdint.h>
+#include <stdlib.h>
+
+#include "dds/export.h"
+#include "dds/ddsrt/attributes.h"
+
+#if defined (__cplusplus)
+extern "C" {
+#endif
+
+#define DDSRT_AVL_MAX_TREEHEIGHT (12 * sizeof (void *))
+
+typedef int (*ddsrt_avl_compare_t) (const void *a, const void *b);
+typedef int (*ddsrt_avl_compare_r_t) (const void *a, const void *b, void *arg);
+typedef void (*ddsrt_avl_augment_t) (void *node, const void *left, const void *right);
+typedef void (*ddsrt_avl_walk_t) (void *node, void *arg);
+typedef void (*ddsrt_avl_const_walk_t) (const void *node, void *arg);
+
+typedef struct ddsrt_avl_node {
+    struct ddsrt_avl_node *cs[2]; /* 0 = left, 1 = right */
+    struct ddsrt_avl_node *parent;
+    int height;
+} ddsrt_avl_node_t;
+
+#define DDSRT_AVL_TREEDEF_FLAG_INDKEY 1
+#define DDSRT_AVL_TREEDEF_FLAG_R 2
+#define DDSRT_AVL_TREEDEF_FLAG_ALLOWDUPS 4
+
+typedef struct ddsrt_avl_treedef {
+#if defined (__cplusplus)
+    ddsrt_avl_treedef() {}
+#endif
+    size_t avlnodeoffset;
+    size_t keyoffset;
+    union {
+        ddsrt_avl_compare_t comparekk;
+        ddsrt_avl_compare_r_t comparekk_r;
+    } u;
+    ddsrt_avl_augment_t augment;
+    uint32_t flags;
+    void *cmp_arg; /* for _r variant */
+} ddsrt_avl_treedef_t;
+
+typedef struct ddsrt_avl_ctreedef {
+    ddsrt_avl_treedef_t t;
+} ddsrt_avl_ctreedef_t;
+
+typedef struct ddsrt_avl_tree {
+    ddsrt_avl_node_t *root;
+} ddsrt_avl_tree_t;
+
+typedef struct ddsrt_avl_ctree {
+    ddsrt_avl_tree_t t;
+    size_t count;
+} ddsrt_avl_ctree_t;
+
+typedef struct ddsrt_avl_path {
+    int depth; /* total depth of path */
+    int pnodeidx;
+    ddsrt_avl_node_t *parent; /* (nodeidx == 0 ? NULL : *(path[nodeidx-1])) */
+    ddsrt_avl_node_t **pnode[DDSRT_AVL_MAX_TREEHEIGHT];
+} ddsrt_avl_path_t;
+
+typedef struct ddsrt_avl_ipath {
+    ddsrt_avl_path_t p;
+} ddsrt_avl_ipath_t;
+
+typedef struct ddsrt_avl_dpath {
+    ddsrt_avl_path_t p;
+} ddsrt_avl_dpath_t;
+
+typedef struct ddsrt_avl_iter {
+    const ddsrt_avl_treedef_t *td;
+    ddsrt_avl_node_t *right;
+    ddsrt_avl_node_t **todop;
+    ddsrt_avl_node_t *todo[1+DDSRT_AVL_MAX_TREEHEIGHT];
+} ddsrt_avl_iter_t;
+
+typedef struct ddsrt_avl_citer {
+    ddsrt_avl_iter_t t;
+} ddsrt_avl_citer_t;
+
+/* avlnodeoffset and keyoffset must both be in [0,2**31-1] */
+#define DDSRT_AVL_TREEDEF_INITIALIZER(avlnodeoffset, keyoffset, comparekk_, augment) { (avlnodeoffset), (keyoffset), { .comparekk = (comparekk_) }, (augment), 0, 0 }
+#define DDSRT_AVL_TREEDEF_INITIALIZER_INDKEY(avlnodeoffset, keyoffset, comparekk_, augment) { (avlnodeoffset), (keyoffset), { .comparekk = (comparekk_) }, (augment), DDSRT_AVL_TREEDEF_FLAG_INDKEY, 0 }
+#define DDSRT_AVL_TREEDEF_INITIALIZER_ALLOWDUPS(avlnodeoffset, keyoffset, comparekk_, augment) { (avlnodeoffset), (keyoffset), { .comparekk = (comparekk_) }, (augment), DDSRT_AVL_TREEDEF_FLAG_ALLOWDUPS, 0 }
+#define DDSRT_AVL_TREEDEF_INITIALIZER_INDKEY_ALLOWDUPS(avlnodeoffset, keyoffset, comparekk_, augment) { (avlnodeoffset), (keyoffset), { .comparekk = (comparekk_) }, (augment), DDSRT_AVL_TREEDEF_FLAG_INDKEY|DDSRT_AVL_TREEDEF_FLAG_ALLOWDUPS, 0 }
+#define DDSRT_AVL_TREEDEF_INITIALIZER_R(avlnodeoffset, keyoffset, comparekk_, cmparg, augment) { (avlnodeoffset), (keyoffset), { .comparekk_r = (comparekk_) }, (augment), DDSRT_AVL_TREEDEF_FLAG_R, (cmparg) }
+#define DDSRT_AVL_TREEDEF_INITIALIZER_INDKEY_R(avlnodeoffset, keyoffset, comparekk_, cmparg, augment) { (avlnodeoffset), (keyoffset), { .comparekk_r = (comparekk_) }, (augment), DDSRT_AVL_TREEDEF_FLAG_INDKEY|DDSRT_AVL_TREEDEF_FLAG_R, (cmparg) }
+#define DDSRT_AVL_TREEDEF_INITIALIZER_R_ALLOWDUPS(avlnodeoffset, keyoffset, comparekk_, cmparg, augment) { (avlnodeoffset), (keyoffset), { .comparekk_r = (comparekk_) }, (augment), DDSRT_AVL_TREEDEF_FLAG_R|DDSRT_AVL_TREEDEF_FLAG_ALLOWDUPS, (cmparg) }
+#define DDSRT_AVL_TREEDEF_INITIALIZER_INDKEY_R_ALLOWDUPS(avlnodeoffset, keyoffset, comparekk_, cmparg, augment) { (avlnodeoffset), (keyoffset), { .comparekk_r = (comparekk_) }, (augment), DDSRT_AVL_TREEDEF_FLAG_INDKEY|DDSRT_AVL_TREEDEF_FLAG_R|DDSRT_AVL_TREEDEF_FLAG_ALLOWDUPS, (cmparg) }
+
+/* Not maintaining # nodes */
+
+DDS_EXPORT void ddsrt_avl_treedef_init (ddsrt_avl_treedef_t *td, size_t avlnodeoffset, size_t keyoffset, ddsrt_avl_compare_t comparekk, ddsrt_avl_augment_t augment, uint32_t flags) ddsrt_nonnull((1,4));
+DDS_EXPORT void ddsrt_avl_treedef_init_r (ddsrt_avl_treedef_t *td, size_t avlnodeoffset, size_t keyoffset, ddsrt_avl_compare_r_t comparekk_r, void *cmp_arg, ddsrt_avl_augment_t augment, uint32_t flags) ddsrt_nonnull((1,4));
+
+DDS_EXPORT void ddsrt_avl_init (const ddsrt_avl_treedef_t *td, ddsrt_avl_tree_t *tree) ddsrt_nonnull_all;
+DDS_EXPORT void ddsrt_avl_free (const ddsrt_avl_treedef_t *td, ddsrt_avl_tree_t *tree, void (*freefun) (void *node)) ddsrt_nonnull((1,2));
+DDS_EXPORT void ddsrt_avl_free_arg (const ddsrt_avl_treedef_t *td, ddsrt_avl_tree_t *tree, void (*freefun) (void *node, void *arg), void *arg) ddsrt_nonnull((1,2));
+
+DDS_EXPORT void *ddsrt_avl_root (const ddsrt_avl_treedef_t *td, const ddsrt_avl_tree_t *tree) ddsrt_nonnull_all;
+DDS_EXPORT void *ddsrt_avl_root_non_empty (const ddsrt_avl_treedef_t *td, const ddsrt_avl_tree_t *tree) ddsrt_nonnull_all;
+DDS_EXPORT void *ddsrt_avl_lookup (const ddsrt_avl_treedef_t *td, const ddsrt_avl_tree_t *tree, const void *key) ddsrt_nonnull_all;
+DDS_EXPORT void *ddsrt_avl_lookup_ipath (const ddsrt_avl_treedef_t *td, const ddsrt_avl_tree_t *tree, const void *key, ddsrt_avl_ipath_t *path) ddsrt_nonnull_all;
+DDS_EXPORT void *ddsrt_avl_lookup_dpath (const ddsrt_avl_treedef_t *td, const ddsrt_avl_tree_t *tree, const void *key, ddsrt_avl_dpath_t *path) ddsrt_nonnull_all;
+DDS_EXPORT void *ddsrt_avl_lookup_pred_eq (const ddsrt_avl_treedef_t *td, const ddsrt_avl_tree_t *tree, const void *key) ddsrt_nonnull_all;
+DDS_EXPORT void *ddsrt_avl_lookup_succ_eq (const ddsrt_avl_treedef_t *td, const ddsrt_avl_tree_t *tree, const void *key) ddsrt_nonnull_all;
+DDS_EXPORT void *ddsrt_avl_lookup_pred (const ddsrt_avl_treedef_t *td, const ddsrt_avl_tree_t *tree, const void *key) ddsrt_nonnull_all;
+DDS_EXPORT void *ddsrt_avl_lookup_succ (const ddsrt_avl_treedef_t *td, const ddsrt_avl_tree_t *tree, const void *key) ddsrt_nonnull_all;
+
+DDS_EXPORT void ddsrt_avl_insert (const ddsrt_avl_treedef_t *td, ddsrt_avl_tree_t *tree, void *node) ddsrt_nonnull_all;
+DDS_EXPORT void ddsrt_avl_delete (const ddsrt_avl_treedef_t *td, ddsrt_avl_tree_t *tree, void *node) ddsrt_nonnull_all;
+DDS_EXPORT void ddsrt_avl_insert_ipath (const ddsrt_avl_treedef_t *td, ddsrt_avl_tree_t *tree, void *node, ddsrt_avl_ipath_t *path) ddsrt_nonnull_all;
+DDS_EXPORT void ddsrt_avl_delete_dpath (const ddsrt_avl_treedef_t *td, ddsrt_avl_tree_t *tree, void *node, ddsrt_avl_dpath_t *path) ddsrt_nonnull_all;
+DDS_EXPORT void ddsrt_avl_swap_node (const ddsrt_avl_treedef_t *td, ddsrt_avl_tree_t *tree, void *oldn, void *newn) ddsrt_nonnull_all;
+DDS_EXPORT void ddsrt_avl_augment_update (const ddsrt_avl_treedef_t *td, void *node) ddsrt_nonnull_all;
+
+DDS_EXPORT int ddsrt_avl_is_empty (const ddsrt_avl_tree_t *tree) ddsrt_nonnull_all;
+DDS_EXPORT int ddsrt_avl_is_singleton (const ddsrt_avl_tree_t *tree) ddsrt_nonnull_all;
+
+DDS_EXPORT void *ddsrt_avl_find_min (const ddsrt_avl_treedef_t *td, const ddsrt_avl_tree_t *tree) ddsrt_nonnull_all;
+DDS_EXPORT void *ddsrt_avl_find_max (const ddsrt_avl_treedef_t *td, const ddsrt_avl_tree_t *tree) ddsrt_nonnull_all;
+DDS_EXPORT void *ddsrt_avl_find_pred (const ddsrt_avl_treedef_t *td, const ddsrt_avl_tree_t *tree, const void *vnode) ddsrt_nonnull((1,2));
+DDS_EXPORT void *ddsrt_avl_find_succ (const ddsrt_avl_treedef_t *td, const ddsrt_avl_tree_t *tree, const void *vnode) ddsrt_nonnull((1,2));
+
+DDS_EXPORT void ddsrt_avl_walk (const ddsrt_avl_treedef_t *td, ddsrt_avl_tree_t *tree, ddsrt_avl_walk_t f, void *a) ddsrt_nonnull((1,2,3));
+DDS_EXPORT void ddsrt_avl_const_walk (const ddsrt_avl_treedef_t *td, const ddsrt_avl_tree_t *tree, ddsrt_avl_const_walk_t f, void *a) ddsrt_nonnull((1,2,3));
+DDS_EXPORT void ddsrt_avl_walk_range (const ddsrt_avl_treedef_t *td, ddsrt_avl_tree_t *tree, const void *min, const void *max, ddsrt_avl_walk_t f, void *a)  ddsrt_nonnull((1,2,3,4,5));
+DDS_EXPORT void ddsrt_avl_const_walk_range (const ddsrt_avl_treedef_t *td, const ddsrt_avl_tree_t *tree, const void *min, const void *max, ddsrt_avl_const_walk_t f, void *a) ddsrt_nonnull((1,2,3,4,5));
+DDS_EXPORT void ddsrt_avl_walk_range_reverse (const ddsrt_avl_treedef_t *td, ddsrt_avl_tree_t *tree, const void *min, const void *max, ddsrt_avl_walk_t f, void *a) ddsrt_nonnull((1,2,3));
+DDS_EXPORT void ddsrt_avl_const_walk_range_reverse (const ddsrt_avl_treedef_t *td, const ddsrt_avl_tree_t *tree, const void *min, const void *max, ddsrt_avl_const_walk_t f, void *a) ddsrt_nonnull((1,2,3));
+
+DDS_EXPORT void *ddsrt_avl_iter_first (const ddsrt_avl_treedef_t *td, const ddsrt_avl_tree_t *tree, ddsrt_avl_iter_t *iter) ddsrt_nonnull_all;
+DDS_EXPORT void *ddsrt_avl_iter_succ_eq (const ddsrt_avl_treedef_t *td, const ddsrt_avl_tree_t *tree, ddsrt_avl_iter_t *iter, const void *key) ddsrt_nonnull_all;
+DDS_EXPORT void *ddsrt_avl_iter_succ (const ddsrt_avl_treedef_t *td, const ddsrt_avl_tree_t *tree, ddsrt_avl_iter_t *iter, const void *key) ddsrt_nonnull_all;
+DDS_EXPORT void *ddsrt_avl_iter_next (ddsrt_avl_iter_t *iter) ddsrt_nonnull_all;
+
+/* Maintaining # nodes */
+
+#define DDSRT_AVL_CTREEDEF_INITIALIZER(avlnodeoffset, keyoffset, comparekk, augment) { DDSRT_AVL_TREEDEF_INITIALIZER (avlnodeoffset, keyoffset, comparekk, augment) }
+#define DDSRT_AVL_CTREEDEF_INITIALIZER_INDKEY(avlnodeoffset, keyoffset, comparekk, augment) { DDSRT_AVL_TREEDEF_INITIALIZER_INDKEY (avlnodeoffset, keyoffset, comparekk, augment) }
+#define DDSRT_AVL_CTREEDEF_INITIALIZER_ALLOWDUPS(avlnodeoffset, keyoffset, comparekk, augment) { DDSRT_AVL_TREEDEF_INITIALIZER_ALLOWDUPS (avlnodeoffset, keyoffset, comparekk, augment) }
+#define DDSRT_AVL_CTREEDEF_INITIALIZER_INDKEY_ALLOWDUPS(avlnodeoffset, keyoffset, comparekk, augment) { DDSRT_AVL_TREEDEF_INITIALIZER_INDKEY_ALLOWDUPS (avlnodeoffset, keyoffset, comparekk, augment) }
+#define DDSRT_AVL_CTREEDEF_INITIALIZER_R(avlnodeoffset, keyoffset, comparekk, cmparg, augment) { DDSRT_AVL_TREEDEF_INITIALIZER_R (avlnodeoffset, keyoffset, comparekk, cmparg, augment) }
+#define DDSRT_AVL_CTREEDEF_INITIALIZER_INDKEY_R(avlnodeoffset, keyoffset, comparekk, cmparg, augment) { DDSRT_AVL_TREEDEF_INITIALIZER_INDKEY_R (avlnodeoffset, keyoffset, comparekk, cmparg, augment) }
+#define DDSRT_AVL_CTREEDEF_INITIALIZER_R_ALLOWDUPS(avlnodeoffset, keyoffset, comparekk, cmparg, augment) { DDSRT_AVL_TREEDEF_INITIALIZER_R_ALLOWDUPS (avlnodeoffset, keyoffset, comparekk, cmparg, augment) }
+#define DDSRT_AVL_CTREEDEF_INITIALIZER_INDKEY_R_ALLOWDUPS(avlnodeoffset, keyoffset, comparekk, cmparg, augment) { DDSRT_AVL_TREEDEF_INITIALIZER_INDKEY_R_ALLOWDUPS (avlnodeoffset, keyoffset, comparekk, cmparg, augment) }
+
+DDS_EXPORT void ddsrt_avl_ctreedef_init (ddsrt_avl_ctreedef_t *td, size_t avlnodeoffset, size_t keyoffset, ddsrt_avl_compare_t comparekk, ddsrt_avl_augment_t augment, uint32_t flags) ddsrt_nonnull((1,4));
+DDS_EXPORT void ddsrt_avl_ctreedef_init_r (ddsrt_avl_ctreedef_t *td, size_t avlnodeoffset, size_t keyoffset, ddsrt_avl_compare_r_t comparekk_r, void *cmp_arg, ddsrt_avl_augment_t augment, uint32_t flags) ddsrt_nonnull((1,4));
+
+DDS_EXPORT void ddsrt_avl_cinit (const ddsrt_avl_ctreedef_t *td, ddsrt_avl_ctree_t *tree) ddsrt_nonnull_all;
+DDS_EXPORT void ddsrt_avl_cfree (const ddsrt_avl_ctreedef_t *td, ddsrt_avl_ctree_t *tree, void (*freefun) (void *node)) ddsrt_nonnull((1,2));
+DDS_EXPORT void ddsrt_avl_cfree_arg (const ddsrt_avl_ctreedef_t *td, ddsrt_avl_ctree_t *tree, void (*freefun) (void *node, void *arg), void *arg) ddsrt_nonnull((1,2));
+
+DDS_EXPORT void *ddsrt_avl_croot (const ddsrt_avl_ctreedef_t *td, const ddsrt_avl_ctree_t *tree) ddsrt_nonnull_all;
+DDS_EXPORT void *ddsrt_avl_croot_non_empty (const ddsrt_avl_ctreedef_t *td, const ddsrt_avl_ctree_t *tree) ddsrt_nonnull_all;
+DDS_EXPORT void *ddsrt_avl_clookup (const ddsrt_avl_ctreedef_t *td, const ddsrt_avl_ctree_t *tree, const void *key) ddsrt_nonnull_all;
+DDS_EXPORT void *ddsrt_avl_clookup_ipath (const ddsrt_avl_ctreedef_t *td, const ddsrt_avl_ctree_t *tree, const void *key, ddsrt_avl_ipath_t *path) ddsrt_nonnull_all;
+DDS_EXPORT void *ddsrt_avl_clookup_dpath (const ddsrt_avl_ctreedef_t *td, const ddsrt_avl_ctree_t *tree, const void *key, ddsrt_avl_dpath_t *path) ddsrt_nonnull_all;
+DDS_EXPORT void *ddsrt_avl_clookup_pred_eq (const ddsrt_avl_ctreedef_t *td, const ddsrt_avl_ctree_t *tree, const void *key) ddsrt_nonnull_all;
+DDS_EXPORT void *ddsrt_avl_clookup_succ_eq (const ddsrt_avl_ctreedef_t *td, const ddsrt_avl_ctree_t *tree, const void *key) ddsrt_nonnull_all;
+DDS_EXPORT void *ddsrt_avl_clookup_pred (const ddsrt_avl_ctreedef_t *td, const ddsrt_avl_ctree_t *tree, const void *key) ddsrt_nonnull_all;
+DDS_EXPORT void *ddsrt_avl_clookup_succ (const ddsrt_avl_ctreedef_t *td, const ddsrt_avl_ctree_t *tree, const void *key) ddsrt_nonnull_all;
+
+DDS_EXPORT void ddsrt_avl_cinsert (const ddsrt_avl_ctreedef_t *td, ddsrt_avl_ctree_t *tree, void *node) ddsrt_nonnull_all;
+DDS_EXPORT void ddsrt_avl_cdelete (const ddsrt_avl_ctreedef_t *td, ddsrt_avl_ctree_t *tree, void *node) ddsrt_nonnull_all;
+DDS_EXPORT void ddsrt_avl_cinsert_ipath (const ddsrt_avl_ctreedef_t *td, ddsrt_avl_ctree_t *tree, void *node, ddsrt_avl_ipath_t *path) ddsrt_nonnull_all;
+DDS_EXPORT void ddsrt_avl_cdelete_dpath (const ddsrt_avl_ctreedef_t *td, ddsrt_avl_ctree_t *tree, void *node, ddsrt_avl_dpath_t *path) ddsrt_nonnull_all;
+DDS_EXPORT void ddsrt_avl_cswap_node (const ddsrt_avl_ctreedef_t *td, ddsrt_avl_ctree_t *tree, void *oldn, void *newn) ddsrt_nonnull_all;
+DDS_EXPORT void ddsrt_avl_caugment_update (const ddsrt_avl_ctreedef_t *td, void *node) ddsrt_nonnull_all;
+
+DDS_EXPORT int ddsrt_avl_cis_empty (const ddsrt_avl_ctree_t *tree) ddsrt_nonnull_all;
+DDS_EXPORT int ddsrt_avl_cis_singleton (const ddsrt_avl_ctree_t *tree) ddsrt_nonnull_all;
+DDS_EXPORT size_t ddsrt_avl_ccount (const ddsrt_avl_ctree_t *tree) ddsrt_nonnull_all;
+
+DDS_EXPORT void *ddsrt_avl_cfind_min (const ddsrt_avl_ctreedef_t *td, const ddsrt_avl_ctree_t *tree) ddsrt_nonnull_all;
+DDS_EXPORT void *ddsrt_avl_cfind_max (const ddsrt_avl_ctreedef_t *td, const ddsrt_avl_ctree_t *tree) ddsrt_nonnull_all;
+DDS_EXPORT void *ddsrt_avl_cfind_pred (const ddsrt_avl_ctreedef_t *td, const ddsrt_avl_ctree_t *tree, const void *vnode) ddsrt_nonnull((1,2));
+DDS_EXPORT void *ddsrt_avl_cfind_succ (const ddsrt_avl_ctreedef_t *td, const ddsrt_avl_ctree_t *tree, const void *vnode) ddsrt_nonnull((1,2));
+
+DDS_EXPORT void ddsrt_avl_cwalk (const ddsrt_avl_ctreedef_t *td, ddsrt_avl_ctree_t *tree, ddsrt_avl_walk_t f, void *a) ddsrt_nonnull((1,2,3));
+DDS_EXPORT void ddsrt_avl_cconst_walk (const ddsrt_avl_ctreedef_t *td, const ddsrt_avl_ctree_t *tree, ddsrt_avl_const_walk_t f, void *a) ddsrt_nonnull((1,2,3));
+DDS_EXPORT void ddsrt_avl_cwalk_range (const ddsrt_avl_ctreedef_t *td, ddsrt_avl_ctree_t *tree, const void *min, const void *max, ddsrt_avl_walk_t f, void *a) ddsrt_nonnull((1,2,3,4,5));
+DDS_EXPORT void ddsrt_avl_cconst_walk_range (const ddsrt_avl_ctreedef_t *td, const ddsrt_avl_ctree_t *tree, const void *min, const void *max, ddsrt_avl_const_walk_t f, void *a) ddsrt_nonnull((1,2,3,4,5));
+DDS_EXPORT void ddsrt_avl_cwalk_range_reverse (const ddsrt_avl_ctreedef_t *td, ddsrt_avl_ctree_t *tree, const void *min, const void *max, ddsrt_avl_walk_t f, void *a) ddsrt_nonnull((1,2,3,4,5));
+DDS_EXPORT void ddsrt_avl_cconst_walk_range_reverse (const ddsrt_avl_ctreedef_t *td, const ddsrt_avl_ctree_t *tree, const void *min, const void *max, ddsrt_avl_const_walk_t f, void *a) ddsrt_nonnull((1,2,3,4,5));
+
+DDS_EXPORT void *ddsrt_avl_citer_first (const ddsrt_avl_ctreedef_t *td, const ddsrt_avl_ctree_t *tree, ddsrt_avl_citer_t *iter) ddsrt_nonnull_all;
+DDS_EXPORT void *ddsrt_avl_citer_succ_eq (const ddsrt_avl_ctreedef_t *td, const ddsrt_avl_ctree_t *tree, ddsrt_avl_citer_t *iter, const void *key) ddsrt_nonnull_all;
+DDS_EXPORT void *ddsrt_avl_citer_succ (const ddsrt_avl_ctreedef_t *td, const ddsrt_avl_ctree_t *tree, ddsrt_avl_citer_t *iter, const void *key) ddsrt_nonnull_all;
+DDS_EXPORT void *ddsrt_avl_citer_next (ddsrt_avl_citer_t *iter) ddsrt_nonnull_all;
+
+#if defined (__cplusplus)
+}
+#endif
+
+#endif /* DDSRT_AVL_H */
diff --git a/src/util/include/dds/util/ut_expand_envvars.h b/src/ddsrt/include/dds/ddsrt/expand_envvars.h
similarity index 78%
rename from src/util/include/dds/util/ut_expand_envvars.h
rename to src/ddsrt/include/dds/ddsrt/expand_envvars.h
index c101679..d7b66f4 100644
--- a/src/util/include/dds/util/ut_expand_envvars.h
+++ b/src/ddsrt/include/dds/ddsrt/expand_envvars.h
@@ -9,8 +9,8 @@
  *
  * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
  */
-#ifndef UT_EXPAND_ENVVARS_H
-#define UT_EXPAND_ENVVARS_H
+#ifndef DDSRT_EXPAND_ENVVARS_H
+#define DDSRT_EXPAND_ENVVARS_H
 
 #include "dds/export.h"
 
@@ -19,10 +19,10 @@ extern "C" {
 #endif
 
     /* Expands ${X}, ${X:-Y}, ${X:+Y}, ${X:?Y} forms, but not $X */
-    DDS_EXPORT char *ut_expand_envvars(const char *string);
+    DDS_EXPORT char *ddsrt_expand_envvars(const char *string);
 
     /* Expands $X, ${X}, ${X:-Y}, ${X:+Y}, ${X:?Y} forms, $ and \ can be escaped with \ */
-    DDS_EXPORT char *ut_expand_envvars_sh(const char *string);
+    DDS_EXPORT char *ddsrt_expand_envvars_sh(const char *string);
 
 #if defined (__cplusplus)
 }
diff --git a/src/ddsrt/include/dds/ddsrt/fibheap.h b/src/ddsrt/include/dds/ddsrt/fibheap.h
new file mode 100644
index 0000000..4a2c330
--- /dev/null
+++ b/src/ddsrt/include/dds/ddsrt/fibheap.h
@@ -0,0 +1,54 @@
+/*
+ * Copyright(c) 2006 to 2018 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+#ifndef DDSRT_FIBHEAP_H
+#define DDSRT_FIBHEAP_H
+
+#include <stdint.h>
+
+#include "dds/export.h"
+
+#if defined (__cplusplus)
+extern "C" {
+#endif
+
+typedef struct ddsrt_fibheap_node {
+  struct ddsrt_fibheap_node *parent, *children;
+  struct ddsrt_fibheap_node *prev, *next;
+  unsigned mark: 1;
+  unsigned degree: 31;
+} ddsrt_fibheap_node_t;
+
+typedef struct ddsrt_fibheap_def {
+    uintptr_t offset;
+    int (*cmp) (const void *va, const void *vb);
+} ddsrt_fibheap_def_t;
+
+typedef struct ddsrt_fibheap {
+  ddsrt_fibheap_node_t *roots; /* points to root with min key value */
+} ddsrt_fibheap_t;
+
+#define DDSRT_FIBHEAPDEF_INITIALIZER(offset, cmp) { (offset), (cmp) }
+
+DDS_EXPORT void ddsrt_fibheap_def_init (ddsrt_fibheap_def_t *fhdef, uintptr_t offset, int (*cmp) (const void *va, const void *vb));
+DDS_EXPORT void ddsrt_fibheap_init (const ddsrt_fibheap_def_t *fhdef, ddsrt_fibheap_t *fh);
+DDS_EXPORT void *ddsrt_fibheap_min (const ddsrt_fibheap_def_t *fhdef, const ddsrt_fibheap_t *fh);
+DDS_EXPORT void ddsrt_fibheap_merge (const ddsrt_fibheap_def_t *fhdef, ddsrt_fibheap_t *a, ddsrt_fibheap_t *b);
+DDS_EXPORT void ddsrt_fibheap_insert (const ddsrt_fibheap_def_t *fhdef, ddsrt_fibheap_t *fh, const void *vnode);
+DDS_EXPORT void ddsrt_fibheap_delete (const ddsrt_fibheap_def_t *fhdef, ddsrt_fibheap_t *fh, const void *vnode);
+DDS_EXPORT void *ddsrt_fibheap_extract_min (const ddsrt_fibheap_def_t *fhdef, ddsrt_fibheap_t *fh);
+DDS_EXPORT void ddsrt_fibheap_decrease_key (const ddsrt_fibheap_def_t *fhdef, ddsrt_fibheap_t *fh, const void *vnode); /* to be called AFTER decreasing the key */
+
+#if defined (__cplusplus)
+}
+#endif
+
+#endif /* DDSRT_FIBHEAP_H */
diff --git a/src/ddsrt/include/dds/ddsrt/hopscotch.h b/src/ddsrt/include/dds/ddsrt/hopscotch.h
new file mode 100644
index 0000000..24d9213
--- /dev/null
+++ b/src/ddsrt/include/dds/ddsrt/hopscotch.h
@@ -0,0 +1,104 @@
+/*
+ * Copyright(c) 2006 to 2018 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+#ifndef DDSRT_HOPSCOTCH_H
+#define DDSRT_HOPSCOTCH_H
+
+#include <stdint.h>
+
+#include "dds/export.h"
+
+#if defined (__cplusplus)
+extern "C" {
+#endif
+
+/* Concurrent version */
+struct ddsrt_chh;
+struct ddsrt_chh_bucket;
+struct ddsrt_chh_iter {
+  struct ddsrt_chh_bucket *bs;
+  uint32_t size;
+  uint32_t cursor;
+};
+
+/*
+ * The hopscotch hash table is dependent on a proper functioning hash.
+ * If the hash function generates a lot of hash collisions, then it will
+ * not be able to handle that by design.
+ * It is capable of handling some collisions, but not more than 32 per
+ * bucket (less, when other hash values are clustered around the
+ * collision value).
+ * When proper distributed hash values are generated, then hopscotch
+ * works nice and quickly.
+ */
+typedef uint32_t (*ddsrt_hh_hash_fn) (const void *);
+
+/*
+ * Hopscotch needs to be able to compare two elements.
+ * Returns 0 when not equal.
+ */
+typedef int (*ddsrt_hh_equals_fn) (const void *, const void *);
+
+/*
+ * Hopscotch is will resize its internal buckets list when needed. It will
+ * call this garbage collection function with the old buckets list. The
+ * caller has to delete the list when it deems it safe to do so.
+ */
+typedef void (*ddsrt_hh_buckets_gc_fn) (void *);
+
+DDS_EXPORT struct ddsrt_chh *ddsrt_chh_new (uint32_t init_size, ddsrt_hh_hash_fn hash, ddsrt_hh_equals_fn equals, ddsrt_hh_buckets_gc_fn gc_buckets);
+DDS_EXPORT void ddsrt_chh_free (struct ddsrt_chh * __restrict hh);
+DDS_EXPORT void *ddsrt_chh_lookup (struct ddsrt_chh * __restrict rt, const void * __restrict template);
+DDS_EXPORT int ddsrt_chh_add (struct ddsrt_chh * __restrict rt, const void * __restrict data);
+DDS_EXPORT int ddsrt_chh_remove (struct ddsrt_chh * __restrict rt, const void * __restrict template);
+DDS_EXPORT void ddsrt_chh_enum_unsafe (struct ddsrt_chh * __restrict rt, void (*f) (void *a, void *f_arg), void *f_arg); /* may delete a */
+void *ddsrt_chh_iter_first (struct ddsrt_chh * __restrict rt, struct ddsrt_chh_iter *it);
+void *ddsrt_chh_iter_next (struct ddsrt_chh_iter *it);
+
+/* Sequential version */
+struct ddsrt_hh;
+
+struct ddsrt_hh_iter {
+    struct ddsrt_hh *hh;
+    uint32_t cursor;
+};
+
+DDS_EXPORT struct ddsrt_hh *ddsrt_hh_new (uint32_t init_size, ddsrt_hh_hash_fn hash, ddsrt_hh_equals_fn equals);
+DDS_EXPORT void ddsrt_hh_free (struct ddsrt_hh * __restrict hh);
+DDS_EXPORT void *ddsrt_hh_lookup (const struct ddsrt_hh * __restrict rt, const void * __restrict template);
+DDS_EXPORT int ddsrt_hh_add (struct ddsrt_hh * __restrict rt, const void * __restrict data);
+DDS_EXPORT int ddsrt_hh_remove (struct ddsrt_hh * __restrict rt, const void * __restrict template);
+DDS_EXPORT void ddsrt_hh_enum (struct ddsrt_hh * __restrict rt, void (*f) (void *a, void *f_arg), void *f_arg); /* may delete a */
+DDS_EXPORT void *ddsrt_hh_iter_first (struct ddsrt_hh * __restrict rt, struct ddsrt_hh_iter * __restrict iter); /* may delete nodes */
+DDS_EXPORT void *ddsrt_hh_iter_next (struct ddsrt_hh_iter * __restrict iter);
+
+/* Sequential version, embedded data */
+struct ddsrt_ehh;
+
+struct ddsrt_ehh_iter {
+    struct ddsrt_ehh *hh;
+    uint32_t cursor;
+};
+
+DDS_EXPORT struct ddsrt_ehh *ddsrt_ehh_new (size_t elemsz, uint32_t init_size, ddsrt_hh_hash_fn hash, ddsrt_hh_equals_fn equals);
+DDS_EXPORT void ddsrt_ehh_free (struct ddsrt_ehh * __restrict hh);
+DDS_EXPORT void *ddsrt_ehh_lookup (const struct ddsrt_ehh * __restrict rt, const void * __restrict template);
+DDS_EXPORT int ddsrt_ehh_add (struct ddsrt_ehh * __restrict rt, const void * __restrict data);
+DDS_EXPORT int ddsrt_ehh_remove (struct ddsrt_ehh * __restrict rt, const void * __restrict template);
+DDS_EXPORT void ddsrt_ehh_enum (struct ddsrt_ehh * __restrict rt, void (*f) (void *a, void *f_arg), void *f_arg); /* may delete a */
+DDS_EXPORT void *ddsrt_ehh_iter_first (struct ddsrt_ehh * __restrict rt, struct ddsrt_ehh_iter * __restrict iter); /* may delete nodes */
+DDS_EXPORT void *ddsrt_ehh_iter_next (struct ddsrt_ehh_iter * __restrict iter);
+
+#if defined (__cplusplus)
+}
+#endif
+
+#endif
diff --git a/src/util/include/dds/util/ut_thread_pool.h b/src/ddsrt/include/dds/ddsrt/thread_pool.h
similarity index 69%
rename from src/util/include/dds/util/ut_thread_pool.h
rename to src/ddsrt/include/dds/ddsrt/thread_pool.h
index 50863a9..f03fe46 100644
--- a/src/util/include/dds/util/ut_thread_pool.h
+++ b/src/ddsrt/include/dds/ddsrt/thread_pool.h
@@ -9,8 +9,8 @@
  *
  * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
  */
-#ifndef UT_THREAD_POOL_H
-#define UT_THREAD_POOL_H
+#ifndef DDSRT_THREAD_POOL_H
+#define DDSRT_THREAD_POOL_H
 
 #include <stdint.h>
 
@@ -22,16 +22,16 @@
 extern "C" {
 #endif
 
-typedef struct ut_thread_pool_s *ut_thread_pool;
+typedef struct ddsrt_thread_pool_s *ddsrt_thread_pool;
 
 /*
-  ut_thread_pool_new: Creates a new thread pool. Returns NULL if
+  ddsrt_thread_pool_new: Creates a new thread pool. Returns NULL if
   cannot create initial set of threads. Threads are created with
   the optional atribute argument. Additional threads may be created
   on demand up to max_threads.
 */
 
-DDS_EXPORT ut_thread_pool ut_thread_pool_new
+DDS_EXPORT ddsrt_thread_pool ddsrt_thread_pool_new
 (
   uint32_t threads,     /* Initial number of threads in pool (can be 0) */
   uint32_t max_threads, /* Maximum number of threads in pool (0 == infinite) */
@@ -39,25 +39,25 @@ DDS_EXPORT ut_thread_pool ut_thread_pool_new
   ddsrt_threadattr_t * attr   /* Attributes used to create pool threads (can be NULL) */
 );
 
-/* ut_thread_pool_free: Frees pool, destroying threads. */
+/* ddsrt_thread_pool_free: Frees pool, destroying threads. */
 
-DDS_EXPORT void ut_thread_pool_free (ut_thread_pool pool);
+DDS_EXPORT void ddsrt_thread_pool_free (ddsrt_thread_pool pool);
 
-/* ut_thread_pool_purge: Purge threads from pool back to initial set. */
+/* ddsrt_thread_pool_purge: Purge threads from pool back to initial set. */
 
-DDS_EXPORT void ut_thread_pool_purge (ut_thread_pool pool);
+DDS_EXPORT void ddsrt_thread_pool_purge (ddsrt_thread_pool pool);
 
 /*
-  ut_thread_pool_submit: Submit a thread function and associated argument
+  ddsrt_thread_pool_submit: Submit a thread function and associated argument
   to be invoked by a thread from the pool. If no threads are available a
   new thread will be created on demand to handle the function unless the
   pool thread maximum has been reached, in which case the function is queued.
   Note that if the pool queue has reached it's maximum DDS_RETCODE_TRY_AGAIN is returned.
 */
 
-DDS_EXPORT dds_retcode_t ut_thread_pool_submit
+DDS_EXPORT dds_retcode_t ddsrt_thread_pool_submit
 (
-  ut_thread_pool pool,  /* Thread pool instance */
+  ddsrt_thread_pool pool,  /* Thread pool instance */
   void (*fn) (void *arg),  /* Function to be invoked by thread from pool */
   void * arg            /* Argument passed to invoked function */
 );
@@ -66,4 +66,4 @@ DDS_EXPORT dds_retcode_t ut_thread_pool_submit
 }
 #endif
 
-#endif /* UT_THREAD_POOL_H */
+#endif /* DDSRT_THREAD_POOL_H */
diff --git a/src/ddsrt/include/dds/ddsrt/xmlparser.h b/src/ddsrt/include/dds/ddsrt/xmlparser.h
new file mode 100644
index 0000000..120be63
--- /dev/null
+++ b/src/ddsrt/include/dds/ddsrt/xmlparser.h
@@ -0,0 +1,52 @@
+/*
+ * Copyright(c) 2006 to 2018 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+#ifndef DDSRT_XMLPARSER_H
+#define DDSRT_XMLPARSER_H
+
+#include <stdint.h>
+
+#include "dds/export.h"
+
+#if defined (__cplusplus)
+extern "C" {
+#endif
+
+    typedef int (*ddsrt_xmlp_proc_elem_open_t) (void *varg, uintptr_t parentinfo, uintptr_t *eleminfo, const char *name);
+    typedef int (*ddsrt_xmlp_proc_attr_t) (void *varg, uintptr_t eleminfo, const char *name, const char *value);
+    typedef int (*ddsrt_xmlp_proc_elem_data_t) (void *varg, uintptr_t eleminfo, const char *data);
+    typedef int (*ddsrt_xmlp_proc_elem_close_t) (void *varg, uintptr_t eleminfo);
+    typedef void (*ddsrt_xmlp_error) (void *varg, const char *msg, int line);
+
+    struct ddsrt_xmlp_callbacks {
+        ddsrt_xmlp_proc_elem_open_t elem_open;
+        ddsrt_xmlp_proc_attr_t attr;
+        ddsrt_xmlp_proc_elem_data_t elem_data;
+        ddsrt_xmlp_proc_elem_close_t elem_close;
+        ddsrt_xmlp_error error;
+    };
+
+    struct ddsrt_xmlp_state;
+
+    DDS_EXPORT struct ddsrt_xmlp_state *ddsrt_xmlp_new_file (FILE *fp, void *varg, const struct ddsrt_xmlp_callbacks *cb);
+    DDS_EXPORT struct ddsrt_xmlp_state *ddsrt_xmlp_new_string (const char *string, void *varg, const struct ddsrt_xmlp_callbacks *cb);
+    DDS_EXPORT void ddsrt_xmlp_set_requireEOF (struct ddsrt_xmlp_state *st, int require_eof);
+    DDS_EXPORT size_t ddsrt_xmlp_get_bufpos (const struct ddsrt_xmlp_state *st);
+    DDS_EXPORT void ddsrt_xmlp_free (struct ddsrt_xmlp_state *st);
+    DDS_EXPORT int ddsrt_xmlp_parse (struct ddsrt_xmlp_state *st);
+
+    DDS_EXPORT int ddsrt_xmlUnescapeInsitu (char *buffer, size_t *n);
+
+#if defined (__cplusplus)
+}
+#endif
+
+#endif
diff --git a/src/util/src/ut_avl.c b/src/ddsrt/src/avl.c
similarity index 52%
rename from src/util/src/ut_avl.c
rename to src/ddsrt/src/avl.c
index 3dc05e3..52ceddb 100644
--- a/src/util/src/ut_avl.c
+++ b/src/ddsrt/src/avl.c
@@ -15,20 +15,20 @@
 #include <string.h>
 
 #include "dds/ddsrt/attributes.h"
-#include "dds/util/ut_avl.h"
+#include "dds/ddsrt/avl.h"
 
 #define LOAD_DIRKEY(avlnode, tree) (((char *) (avlnode)) - (tree)->avlnodeoffset + (tree)->keyoffset)
 #define LOAD_INDKEY(avlnode, tree) (*((char **) (((char *) (avlnode)) - (tree)->avlnodeoffset + (tree)->keyoffset)))
 
-static int comparenk (const ut_avlTreedef_t *td, const ut_avlNode_t *a, const void *b)
+static int comparenk (const ddsrt_avl_treedef_t *td, const ddsrt_avl_node_t *a, const void *b)
 {
     const void *ka;
-    if (td->flags & UT_AVL_TREEDEF_FLAG_INDKEY) {
+    if (td->flags & DDSRT_AVL_TREEDEF_FLAG_INDKEY) {
         ka = LOAD_INDKEY (a, td);
     } else {
         ka = LOAD_DIRKEY (a, td);
     }
-    if (td->flags & UT_AVL_TREEDEF_FLAG_R) {
+    if (td->flags & DDSRT_AVL_TREEDEF_FLAG_R) {
         return td->u.comparekk_r (ka, b, td->cmp_arg);
     } else {
         return td->u.comparekk (ka, b);
@@ -36,17 +36,17 @@ static int comparenk (const ut_avlTreedef_t *td, const ut_avlNode_t *a, const vo
 }
 
 #if 0
-static int comparenn_direct (const ut_avlTreedef_t *td, const ut_avlNode_t *a, const ut_avlNode_t *b)
+static int comparenn_direct (const ddsrt_avl_treedef_t *td, const ddsrt_avl_node_t *a, const ddsrt_avl_node_t *b)
 {
     return td->comparekk (LOAD_DIRKEY (a, td), LOAD_DIRKEY (b, td));
 }
 
-static int comparenn_indirect (const ut_avlTreedef_t *td, const ut_avlNode_t *a, const ut_avlNode_t *b)
+static int comparenn_indirect (const ddsrt_avl_treedef_t *td, const ddsrt_avl_node_t *a, const ddsrt_avl_node_t *b)
 {
     return td->comparekk (LOAD_INDKEY (a, td), LOAD_INDKEY (b, td));
 }
 
-static int comparenn (const ut_avlTreedef_t *td, const ut_avlNode_t *a, const ut_avlNode_t *b)
+static int comparenn (const ddsrt_avl_treedef_t *td, const ddsrt_avl_node_t *a, const ddsrt_avl_node_t *b)
 {
     if (IS_INDKEY (td->keyoffset)) {
         return comparenn_indirect (td, a, b);
@@ -56,25 +56,25 @@ static int comparenn (const ut_avlTreedef_t *td, const ut_avlNode_t *a, const ut
 }
 #endif
 
-static ut_avlNode_t *node_from_onode (const ut_avlTreedef_t *td, char *onode)
+static ddsrt_avl_node_t *node_from_onode (const ddsrt_avl_treedef_t *td, char *onode)
 {
     if (onode == NULL) {
         return NULL;
     } else {
-        return (ut_avlNode_t *) (onode + td->avlnodeoffset);
+        return (ddsrt_avl_node_t *) (onode + td->avlnodeoffset);
     }
 }
 
-static const ut_avlNode_t *cnode_from_onode (const ut_avlTreedef_t *td, const char *onode)
+static const ddsrt_avl_node_t *cnode_from_onode (const ddsrt_avl_treedef_t *td, const char *onode)
 {
     if (onode == NULL) {
         return NULL;
     } else {
-        return (const ut_avlNode_t *) (onode + td->avlnodeoffset);
+        return (const ddsrt_avl_node_t *) (onode + td->avlnodeoffset);
     }
 }
 
-static char *onode_from_node (const ut_avlTreedef_t *td, ut_avlNode_t *node)
+static char *onode_from_node (const ddsrt_avl_treedef_t *td, ddsrt_avl_node_t *node)
 {
     if (node == NULL) {
         return NULL;
@@ -83,7 +83,7 @@ static char *onode_from_node (const ut_avlTreedef_t *td, ut_avlNode_t *node)
     }
 }
 
-static const char *conode_from_node (const ut_avlTreedef_t *td, const ut_avlNode_t *node)
+static const char *conode_from_node (const ddsrt_avl_treedef_t *td, const ddsrt_avl_node_t *node)
 {
     if (node == NULL) {
         return NULL;
@@ -92,7 +92,7 @@ static const char *conode_from_node (const ut_avlTreedef_t *td, const ut_avlNode
     }
 }
 
-static void treedef_init_common (ut_avlTreedef_t *td, size_t avlnodeoffset, size_t keyoffset, ut_avlAugment_t augment, uint32_t flags)
+static void treedef_init_common (ddsrt_avl_treedef_t *td, size_t avlnodeoffset, size_t keyoffset, ddsrt_avl_augment_t augment, uint32_t flags)
 {
     assert (avlnodeoffset <= 0x7fffffff);
     assert (keyoffset <= 0x7fffffff);
@@ -102,26 +102,26 @@ static void treedef_init_common (ut_avlTreedef_t *td, size_t avlnodeoffset, size
     td->flags = flags;
 }
 
-void ut_avlTreedefInit (ut_avlTreedef_t *td, size_t avlnodeoffset, size_t keyoffset, ut_avlCompare_t comparekk, ut_avlAugment_t augment, uint32_t flags)
+void ddsrt_avl_treedef_init (ddsrt_avl_treedef_t *td, size_t avlnodeoffset, size_t keyoffset, ddsrt_avl_compare_t comparekk, ddsrt_avl_augment_t augment, uint32_t flags)
 {
     treedef_init_common (td, avlnodeoffset, keyoffset, augment, flags);
     td->u.comparekk = comparekk;
 }
 
-void ut_avlTreedefInit_r (ut_avlTreedef_t *td, size_t avlnodeoffset, size_t keyoffset, ut_avlCompare_r_t comparekk_r, void *cmp_arg, ut_avlAugment_t augment, uint32_t flags)
+void ddsrt_avl_treedef_init_r (ddsrt_avl_treedef_t *td, size_t avlnodeoffset, size_t keyoffset, ddsrt_avl_compare_r_t comparekk_r, void *cmp_arg, ddsrt_avl_augment_t augment, uint32_t flags)
 {
-    treedef_init_common (td, avlnodeoffset, keyoffset, augment, flags | UT_AVL_TREEDEF_FLAG_R);
+    treedef_init_common (td, avlnodeoffset, keyoffset, augment, flags | DDSRT_AVL_TREEDEF_FLAG_R);
     td->cmp_arg = cmp_arg;
     td->u.comparekk_r = comparekk_r;
 }
 
-void ut_avlInit (const ut_avlTreedef_t *td, ut_avlTree_t *tree)
+void ddsrt_avl_init (const ddsrt_avl_treedef_t *td, ddsrt_avl_tree_t *tree)
 {
     tree->root = NULL;
     (void) td;
 }
 
-static void treedestroy (const ut_avlTreedef_t *td, ut_avlNode_t *n, void (*freefun) (void *node))
+static void treedestroy (const ddsrt_avl_treedef_t *td, ddsrt_avl_node_t *n, void (*freefun) (void *node))
 {
     if (n) {
         n->parent = NULL;
@@ -133,7 +133,7 @@ static void treedestroy (const ut_avlTreedef_t *td, ut_avlNode_t *n, void (*free
     }
 }
 
-static void treedestroy_arg (const ut_avlTreedef_t *td, ut_avlNode_t *n, void (*freefun) (void *node, void *arg), void *arg)
+static void treedestroy_arg (const ddsrt_avl_treedef_t *td, ddsrt_avl_node_t *n, void (*freefun) (void *node, void *arg), void *arg)
 {
     if (n) {
         n->parent = NULL;
@@ -145,30 +145,30 @@ static void treedestroy_arg (const ut_avlTreedef_t *td, ut_avlNode_t *n, void (*
     }
 }
 
-void ut_avlFree (const ut_avlTreedef_t *td, ut_avlTree_t *tree, void (*freefun) (void *node))
+void ddsrt_avl_free (const ddsrt_avl_treedef_t *td, ddsrt_avl_tree_t *tree, void (*freefun) (void *node))
 {
-    ut_avlNode_t *n = tree->root;
+    ddsrt_avl_node_t *n = tree->root;
     tree->root = NULL;
     if (freefun) {
         treedestroy (td, n, freefun);
     }
 }
 
-void ut_avlFreeArg (const ut_avlTreedef_t *td, ut_avlTree_t *tree, void (*freefun) (void *node, void *arg), void *arg)
+void ddsrt_avl_free_arg (const ddsrt_avl_treedef_t *td, ddsrt_avl_tree_t *tree, void (*freefun) (void *node, void *arg), void *arg)
 {
-    ut_avlNode_t *n = tree->root;
+    ddsrt_avl_node_t *n = tree->root;
     tree->root = NULL;
     if (freefun) {
         treedestroy_arg (td, n, freefun, arg);
     }
 }
 
-static void augment (const ut_avlTreedef_t *td, ut_avlNode_t *n)
+static void augment (const ddsrt_avl_treedef_t *td, ddsrt_avl_node_t *n)
 {
     td->augment (onode_from_node (td, n), conode_from_node (td, n->cs[0]), conode_from_node (td, n->cs[1]));
 }
 
-static ut_avlNode_t *rotate_single (const ut_avlTreedef_t *td, ut_avlNode_t **pnode, ut_avlNode_t *node, int dir)
+static ddsrt_avl_node_t *rotate_single (const ddsrt_avl_treedef_t *td, ddsrt_avl_node_t **pnode, ddsrt_avl_node_t *node, int dir)
 {
     /* rotate_single(N, dir) performs one rotation, e.g., for dir=1, a
        right rotation as depicted below, for dir=0 a left rotation:
@@ -179,9 +179,9 @@ static ut_avlNode_t *rotate_single (const ut_avlTreedef_t *td, ut_avlNode_t **pn
 
        Since a right rotation is only ever done with the left side is
        overweight, _ND must be != NULL.  */
-    ut_avlNode_t * const parent = node->parent;
-    ut_avlNode_t * const node_ND = node->cs[1-dir];
-    ut_avlNode_t * const node_ND_D = node_ND->cs[dir];
+    ddsrt_avl_node_t * const parent = node->parent;
+    ddsrt_avl_node_t * const node_ND = node->cs[1-dir];
+    ddsrt_avl_node_t * const node_ND_D = node_ND->cs[dir];
     assert (node_ND);
     node_ND->cs[dir] = node;
     node_ND->parent = parent;
@@ -200,7 +200,7 @@ static ut_avlNode_t *rotate_single (const ut_avlTreedef_t *td, ut_avlNode_t **pn
     return parent;
 }
 
-static ut_avlNode_t *rotate_double (const ut_avlTreedef_t *td, ut_avlNode_t **pnode, ut_avlNode_t *node, int dir)
+static ddsrt_avl_node_t *rotate_double (const ddsrt_avl_treedef_t *td, ddsrt_avl_node_t **pnode, ddsrt_avl_node_t *node, int dir)
 {
     /* rotate_double() performs one double rotation, which is slightly
        faster when written out than the equivalent:
@@ -218,9 +218,9 @@ static ut_avlNode_t *rotate_double (const ut_avlTreedef_t *td, ut_avlNode_t **pn
        Since a right double rotation is only ever done with the N is
        overweight on the left side and _ND is overweight on the right
        side, both _ND and _ND_D must be != NULL. */
-    ut_avlNode_t * const parent = node->parent;
-    ut_avlNode_t * const node_ND = node->cs[1-dir];
-    ut_avlNode_t * const node_ND_D = node_ND->cs[dir];
+    ddsrt_avl_node_t * const parent = node->parent;
+    ddsrt_avl_node_t * const node_ND = node->cs[1-dir];
+    ddsrt_avl_node_t * const node_ND_D = node_ND->cs[dir];
     assert (node_ND);
     assert (node_ND_D);
     node_ND->cs[dir] = node_ND_D->cs[1-dir];
@@ -251,16 +251,16 @@ static ut_avlNode_t *rotate_double (const ut_avlTreedef_t *td, ut_avlNode_t **pn
     return parent;
 }
 
-static ut_avlNode_t *rotate (const ut_avlTreedef_t *td, ut_avlNode_t **pnode, ut_avlNode_t *node, int dir)
+static ddsrt_avl_node_t *rotate (const ddsrt_avl_treedef_t *td, ddsrt_avl_node_t **pnode, ddsrt_avl_node_t *node, int dir)
 {
     /* _D => child in the direction of rotation (1 for right, 0 for
        left); _ND => child in the opposite direction.  So in a right
        rotation, _ND_D means the grandchild that is the right child of
        the left child. */
-    ut_avlNode_t * const node_ND = node->cs[1-dir];
+    ddsrt_avl_node_t * const node_ND = node->cs[1-dir];
     assert (node_ND != NULL);
-    ut_avlNode_t * const node_ND_ND = node_ND->cs[1-dir];
-    ut_avlNode_t * const node_ND_D = node_ND->cs[dir];
+    ddsrt_avl_node_t * const node_ND_ND = node_ND->cs[1-dir];
+    ddsrt_avl_node_t * const node_ND_D = node_ND->cs[dir];
     int height_ND_ND, height_ND_D;
     assert (dir == !!dir);
     height_ND_ND = node_ND_ND ? node_ND_ND->height : 0;
@@ -272,10 +272,10 @@ static ut_avlNode_t *rotate (const ut_avlTreedef_t *td, ut_avlNode_t **pnode, ut
     }
 }
 
-static ut_avlNode_t *rebalance_one (const ut_avlTreedef_t *td, ut_avlNode_t **pnode, ut_avlNode_t *node)
+static ddsrt_avl_node_t *rebalance_one (const ddsrt_avl_treedef_t *td, ddsrt_avl_node_t **pnode, ddsrt_avl_node_t *node)
 {
-    ut_avlNode_t *node_L = node->cs[0];
-    ut_avlNode_t *node_R = node->cs[1];
+    ddsrt_avl_node_t *node_L = node->cs[0];
+    ddsrt_avl_node_t *node_R = node->cs[1];
     int height_L = node_L ? node_L->height : 0;
     int height_R = node_R ? node_R->height : 0;
     if (height_L > height_R + 1) {
@@ -301,7 +301,7 @@ static ut_avlNode_t *rebalance_one (const ut_avlTreedef_t *td, ut_avlNode_t **pn
     }
 }
 
-static void rebalance_path (const ut_avlTreedef_t *td, ut_avlPath_t *path, ut_avlNode_t *node)
+static void rebalance_path (const ddsrt_avl_treedef_t *td, ddsrt_avl_path_t *path, ddsrt_avl_node_t *node)
 {
     while (node) {
         assert (*path->pnode[path->depth] == node);
@@ -310,25 +310,25 @@ static void rebalance_path (const ut_avlTreedef_t *td, ut_avlPath_t *path, ut_av
     }
 }
 
-static ut_avlNode_t **nodeptr_from_node (ut_avlTree_t *tree, ut_avlNode_t *node)
+static ddsrt_avl_node_t **nodeptr_from_node (ddsrt_avl_tree_t *tree, ddsrt_avl_node_t *node)
 {
-    ut_avlNode_t *parent = node->parent;
+    ddsrt_avl_node_t *parent = node->parent;
     return (parent == NULL) ? &tree->root
         : (node == parent->cs[0]) ? &parent->cs[0]
         : &parent->cs[1];
 }
 
-static void rebalance_nopath (const ut_avlTreedef_t *td, ut_avlTree_t *tree, ut_avlNode_t *node)
+static void rebalance_nopath (const ddsrt_avl_treedef_t *td, ddsrt_avl_tree_t *tree, ddsrt_avl_node_t *node)
 {
     while (node) {
-        ut_avlNode_t **pnode = nodeptr_from_node (tree, node);
+        ddsrt_avl_node_t **pnode = nodeptr_from_node (tree, node);
         node = rebalance_one (td, pnode, node);
     }
 }
 
-void *ut_avlLookup (const ut_avlTreedef_t *td, const ut_avlTree_t *tree, const void *key)
+void *ddsrt_avl_lookup (const ddsrt_avl_treedef_t *td, const ddsrt_avl_tree_t *tree, const void *key)
 {
-    const ut_avlNode_t *cursor = tree->root;
+    const ddsrt_avl_node_t *cursor = tree->root;
     int c;
     while (cursor && (c = comparenk (td, cursor, key)) != 0) {
         const int dir = (c <= 0);
@@ -337,59 +337,59 @@ void *ut_avlLookup (const ut_avlTreedef_t *td, const ut_avlTree_t *tree, const v
     return (void *) conode_from_node (td, cursor);
 }
 
-static const ut_avlNode_t *lookup_path (const ut_avlTreedef_t *td, const ut_avlTree_t *tree, const void *key, ut_avlPath_t *path)
+static const ddsrt_avl_node_t *lookup_path (const ddsrt_avl_treedef_t *td, const ddsrt_avl_tree_t *tree, const void *key, ddsrt_avl_path_t *path)
 {
-    const ut_avlNode_t *cursor = tree->root;
-    const ut_avlNode_t *prev = NULL;
+    const ddsrt_avl_node_t *cursor = tree->root;
+    const ddsrt_avl_node_t *prev = NULL;
     int c;
     path->depth = 0;
-    path->pnode[0] = (ut_avlNode_t **) &tree->root;
+    path->pnode[0] = (ddsrt_avl_node_t **) &tree->root;
     while (cursor && (c = comparenk (td, cursor, key)) != 0) {
         const int dir = (c <= 0);
         prev = cursor;
-        path->pnode[++path->depth] = (ut_avlNode_t **) &cursor->cs[dir];
+        path->pnode[++path->depth] = (ddsrt_avl_node_t **) &cursor->cs[dir];
         cursor = cursor->cs[dir];
     }
     path->pnodeidx = path->depth;
-    path->parent = (ut_avlNode_t *) prev;
+    path->parent = (ddsrt_avl_node_t *) prev;
     return cursor;
 }
 
-void *ut_avlLookupDPath (const ut_avlTreedef_t *td, const ut_avlTree_t *tree, const void *key, ut_avlDPath_t *path)
+void *ddsrt_avl_lookup_dpath (const ddsrt_avl_treedef_t *td, const ddsrt_avl_tree_t *tree, const void *key, ddsrt_avl_dpath_t *path)
 {
-    const ut_avlNode_t *node = lookup_path (td, tree, key, &path->p);
+    const ddsrt_avl_node_t *node = lookup_path (td, tree, key, &path->p);
     return (void *) conode_from_node (td, node);
 }
 
-void *ut_avlLookupIPath (const ut_avlTreedef_t *td, const ut_avlTree_t *tree, const void *key, ut_avlIPath_t *path)
+void *ddsrt_avl_lookup_ipath (const ddsrt_avl_treedef_t *td, const ddsrt_avl_tree_t *tree, const void *key, ddsrt_avl_ipath_t *path)
 {
-    const ut_avlNode_t *node = lookup_path (td, tree, key, &path->p);
+    const ddsrt_avl_node_t *node = lookup_path (td, tree, key, &path->p);
     /* If no duplicates allowed, path may not be used for insertion,
        and hence there is no need to continue descending the tree.
        Since we can invalidate it very efficiently, do so. */
     if (node) {
-        if (!(td->flags & UT_AVL_TREEDEF_FLAG_ALLOWDUPS)) {
+        if (!(td->flags & DDSRT_AVL_TREEDEF_FLAG_ALLOWDUPS)) {
             path->p.pnode[path->p.depth] = NULL;
         } else {
-            const ut_avlNode_t *cursor = node;
-            const ut_avlNode_t *prev;
+            const ddsrt_avl_node_t *cursor = node;
+            const ddsrt_avl_node_t *prev;
             int c, dir;
             do {
                 c = comparenk (td, cursor, key);
                 dir = (c <= 0);
                 prev = cursor;
-                path->p.pnode[++path->p.depth] = (ut_avlNode_t **) &cursor->cs[dir];
+                path->p.pnode[++path->p.depth] = (ddsrt_avl_node_t **) &cursor->cs[dir];
                 cursor = cursor->cs[dir];
             } while (cursor);
-            path->p.parent = (ut_avlNode_t *) prev;
+            path->p.parent = (ddsrt_avl_node_t *) prev;
         }
     }
     return (void *) conode_from_node (td, node);
 }
 
-void ut_avlInsertIPath (const ut_avlTreedef_t *td, ut_avlTree_t *tree, void *vnode, ut_avlIPath_t *path)
+void ddsrt_avl_insert_ipath (const ddsrt_avl_treedef_t *td, ddsrt_avl_tree_t *tree, void *vnode, ddsrt_avl_ipath_t *path)
 {
-    ut_avlNode_t *node = node_from_onode (td, vnode);
+    ddsrt_avl_node_t *node = node_from_onode (td, vnode);
     (void) tree;
     node->cs[0] = NULL;
     node->cs[1] = NULL;
@@ -405,25 +405,25 @@ void ut_avlInsertIPath (const ut_avlTreedef_t *td, ut_avlTree_t *tree, void *vno
     rebalance_path (td, &path->p, node->parent);
 }
 
-void ut_avlInsert (const ut_avlTreedef_t *td, ut_avlTree_t *tree, void *vnode)
+void ddsrt_avl_insert (const ddsrt_avl_treedef_t *td, ddsrt_avl_tree_t *tree, void *vnode)
 {
     const void *node = cnode_from_onode (td, vnode);
     const void *key;
-    ut_avlIPath_t path;
-    if (td->flags & UT_AVL_TREEDEF_FLAG_INDKEY) {
+    ddsrt_avl_ipath_t path;
+    if (td->flags & DDSRT_AVL_TREEDEF_FLAG_INDKEY) {
         key = LOAD_INDKEY (node, td);
     } else {
         key = LOAD_DIRKEY (node, td);
     }
-    ut_avlLookupIPath (td, tree, key, &path);
-    ut_avlInsertIPath (td, tree, vnode, &path);
+    ddsrt_avl_lookup_ipath (td, tree, key, &path);
+    ddsrt_avl_insert_ipath (td, tree, vnode, &path);
 }
 
-static void delete_generic (const ut_avlTreedef_t *td, ut_avlTree_t *tree, void *vnode, ut_avlDPath_t *path)
+static void delete_generic (const ddsrt_avl_treedef_t *td, ddsrt_avl_tree_t *tree, void *vnode, ddsrt_avl_dpath_t *path)
 {
-    ut_avlNode_t *node = node_from_onode (td, vnode);
-    ut_avlNode_t **pnode;
-    ut_avlNode_t *whence;
+    ddsrt_avl_node_t *node = node_from_onode (td, vnode);
+    ddsrt_avl_node_t **pnode;
+    ddsrt_avl_node_t *whence;
 
     if (path) {
         assert (tree == NULL);
@@ -448,7 +448,7 @@ static void delete_generic (const ut_avlTreedef_t *td, ut_avlTree_t *tree, void
     }
     else
     {
-        ut_avlNode_t *subst;
+        ddsrt_avl_node_t *subst;
 
         assert (node->cs[0] != NULL);
         assert (node->cs[1] != NULL);
@@ -502,21 +502,21 @@ static void delete_generic (const ut_avlTreedef_t *td, ut_avlTree_t *tree, void
     }
 }
 
-void ut_avlDeleteDPath (const ut_avlTreedef_t *td, ut_avlTree_t *tree, void *vnode, ut_avlDPath_t *path)
+void ddsrt_avl_delete_dpath (const ddsrt_avl_treedef_t *td, ddsrt_avl_tree_t *tree, void *vnode, ddsrt_avl_dpath_t *path)
 {
     (void) tree;
     delete_generic (td, NULL, vnode, path);
 }
 
-void ut_avlDelete (const ut_avlTreedef_t *td, ut_avlTree_t *tree, void *vnode)
+void ddsrt_avl_delete (const ddsrt_avl_treedef_t *td, ddsrt_avl_tree_t *tree, void *vnode)
 {
     delete_generic (td, tree, vnode, NULL);
 }
 
-void ut_avlSwapNode (const ut_avlTreedef_t *td, ut_avlTree_t *tree, void *vold, void *vnew)
+void ddsrt_avl_swap_node (const ddsrt_avl_treedef_t *td, ddsrt_avl_tree_t *tree, void *vold, void *vnew)
 {
-    ut_avlNode_t *old = node_from_onode (td, vold);
-    ut_avlNode_t *new = node_from_onode (td, vnew);
+    ddsrt_avl_node_t *old = node_from_onode (td, vold);
+    ddsrt_avl_node_t *new = node_from_onode (td, vnew);
     *nodeptr_from_node (tree, old) = new;
     /* use memmove so partially overlap between old & new is allowed
        (yikes!, but exploited by the memory allocator, and not a big
@@ -533,7 +533,7 @@ void ut_avlSwapNode (const ut_avlTreedef_t *td, ut_avlTree_t *tree, void *vold,
     }
 }
 
-static ut_avlNode_t *find_neighbour (const ut_avlNode_t *n, int dir)
+static ddsrt_avl_node_t *find_neighbour (const ddsrt_avl_node_t *n, int dir)
 {
     /* dir = 0 => pred; dir = 1 = succ */
     if (n->cs[dir]) {
@@ -541,62 +541,62 @@ static ut_avlNode_t *find_neighbour (const ut_avlNode_t *n, int dir)
         while (n->cs[1-dir]) {
             n = n->cs[1-dir];
         }
-        return (ut_avlNode_t *) n;
+        return (ddsrt_avl_node_t *) n;
     } else {
-        const ut_avlNode_t *p = n->parent;
+        const ddsrt_avl_node_t *p = n->parent;
         while (p && n == p->cs[dir]) {
             n = p;
             p = p->parent;
         }
-        return (ut_avlNode_t *) p;
+        return (ddsrt_avl_node_t *) p;
     }
 }
 
-static ut_avlNode_t *find_extremum (const ut_avlTree_t *tree, int dir)
+static ddsrt_avl_node_t *find_extremum (const ddsrt_avl_tree_t *tree, int dir)
 {
-    const ut_avlNode_t *n = tree->root;
+    const ddsrt_avl_node_t *n = tree->root;
     if (n) {
         while (n->cs[dir]) {
             n = n->cs[dir];
         }
     }
-    return (ut_avlNode_t *) n;
+    return (ddsrt_avl_node_t *) n;
 }
 
-void *ut_avlFindMin (const ut_avlTreedef_t *td, const ut_avlTree_t *tree)
+void *ddsrt_avl_find_min (const ddsrt_avl_treedef_t *td, const ddsrt_avl_tree_t *tree)
 {
     return (void *) conode_from_node (td, find_extremum (tree, 0));
 }
 
-void *ut_avlFindMax (const ut_avlTreedef_t *td, const ut_avlTree_t *tree)
+void *ddsrt_avl_find_max (const ddsrt_avl_treedef_t *td, const ddsrt_avl_tree_t *tree)
 {
     return (void *) conode_from_node (td, find_extremum (tree, 1));
 }
 
-void *ut_avlFindPred (const ut_avlTreedef_t *td, const ut_avlTree_t *tree, const void *vnode)
+void *ddsrt_avl_find_pred (const ddsrt_avl_treedef_t *td, const ddsrt_avl_tree_t *tree, const void *vnode)
 {
-    const ut_avlNode_t *n = cnode_from_onode (td, vnode);
+    const ddsrt_avl_node_t *n = cnode_from_onode (td, vnode);
     if (n == NULL) {
-        return ut_avlFindMax (td, tree);
+        return ddsrt_avl_find_max (td, tree);
     } else {
         return (void *) conode_from_node (td, find_neighbour (n, 0));
     }
 }
 
-void *ut_avlFindSucc (const ut_avlTreedef_t *td, const ut_avlTree_t *tree, const void *vnode)
+void *ddsrt_avl_find_succ (const ddsrt_avl_treedef_t *td, const ddsrt_avl_tree_t *tree, const void *vnode)
 {
-    const ut_avlNode_t *n = cnode_from_onode (td, vnode);
+    const ddsrt_avl_node_t *n = cnode_from_onode (td, vnode);
     if (n == NULL) {
-        return ut_avlFindMin (td, tree);
+        return ddsrt_avl_find_min (td, tree);
     } else {
         return (void *) conode_from_node (td, find_neighbour (n, 1));
     }
 }
 
-static void avl_iter_downleft (ut_avlIter_t *iter)
+static void avl_iter_downleft (ddsrt_avl_iter_t *iter)
 {
     if (*iter->todop) {
-        ut_avlNode_t *n;
+        ddsrt_avl_node_t *n;
         n = (*iter->todop)->cs[0];
         while (n) {
             assert ((int) (iter->todop - iter->todo) < (int) (sizeof (iter->todo) / sizeof (*iter->todo)));
@@ -607,16 +607,16 @@ static void avl_iter_downleft (ut_avlIter_t *iter)
     }
 }
 
-void *ut_avlIterFirst (const ut_avlTreedef_t *td, const ut_avlTree_t *tree, ut_avlIter_t *iter)
+void *ddsrt_avl_iter_first (const ddsrt_avl_treedef_t *td, const ddsrt_avl_tree_t *tree, ddsrt_avl_iter_t *iter)
 {
     iter->td = td;
     iter->todop = iter->todo+1;
-    *iter->todop = (ut_avlNode_t *) tree->root;
+    *iter->todop = (ddsrt_avl_node_t *) tree->root;
     avl_iter_downleft (iter);
     return onode_from_node (td, *iter->todop);
 }
 
-void *ut_avlIterNext (ut_avlIter_t *iter)
+void *ddsrt_avl_iter_next (ddsrt_avl_iter_t *iter)
 {
     if (iter->todop-- > iter->todo+1 && iter->right == NULL) {
         iter->right = (*iter->todop)->cs[1];
@@ -628,13 +628,13 @@ void *ut_avlIterNext (ut_avlIter_t *iter)
     return onode_from_node (iter->td, *iter->todop);
 }
 
-void ut_avlWalk (const ut_avlTreedef_t *td, ut_avlTree_t *tree, ut_avlWalk_t f, void *a)
+void ddsrt_avl_walk (const ddsrt_avl_treedef_t *td, ddsrt_avl_tree_t *tree, ddsrt_avl_walk_t f, void *a)
 {
-    const ut_avlNode_t *todo[1+UT_AVL_MAX_TREEHEIGHT];
-    const ut_avlNode_t **todop = todo+1;
+    const ddsrt_avl_node_t *todo[1+DDSRT_AVL_MAX_TREEHEIGHT];
+    const ddsrt_avl_node_t **todop = todo+1;
     *todop = tree->root;
     while (*todop) {
-        ut_avlNode_t *right, *n;
+        ddsrt_avl_node_t *right, *n;
         /* First locate the minimum value in this subtree */
         n = (*todop)->cs[0];
         while (n) {
@@ -654,27 +654,27 @@ void ut_avlWalk (const ut_avlTreedef_t *td, ut_avlTree_t *tree, ut_avlWalk_t f,
     }
 }
 
-void ut_avlConstWalk (const ut_avlTreedef_t *td, const ut_avlTree_t *tree, ut_avlConstWalk_t f, void *a)
+void ddsrt_avl_const_walk (const ddsrt_avl_treedef_t *td, const ddsrt_avl_tree_t *tree, ddsrt_avl_const_walk_t f, void *a)
 {
-    ut_avlWalk (td, (ut_avlTree_t *) tree, (ut_avlWalk_t) f, a);
+    ddsrt_avl_walk (td, (ddsrt_avl_tree_t *) tree, (ddsrt_avl_walk_t) f, a);
 }
 
-int ut_avlIsEmpty (const ut_avlTree_t *tree)
+int ddsrt_avl_is_empty (const ddsrt_avl_tree_t *tree)
 {
     return tree->root == NULL;
 }
 
-int ut_avlIsSingleton (const ut_avlTree_t *tree)
+int ddsrt_avl_is_singleton (const ddsrt_avl_tree_t *tree)
 {
     int r = (tree->root && tree->root->height == 1);
     assert (!r || (tree->root->cs[0] == NULL && tree->root->cs[1] == NULL));
     return r;
 }
 
-void ut_avlAugmentUpdate (const ut_avlTreedef_t *td, void *vnode)
+void ddsrt_avl_augment_update (const ddsrt_avl_treedef_t *td, void *vnode)
 {
     if (td->augment) {
-        ut_avlNode_t *node = node_from_onode (td, vnode);
+        ddsrt_avl_node_t *node = node_from_onode (td, vnode);
         while (node) {
             augment (td, node);
             node = node->parent;
@@ -682,11 +682,11 @@ void ut_avlAugmentUpdate (const ut_avlTreedef_t *td, void *vnode)
     }
 }
 
-static const ut_avlNode_t *fixup_predsucceq (const ut_avlTreedef_t *td, const void *key, const ut_avlNode_t *tmp, const ut_avlNode_t *cand, int dir)
+static const ddsrt_avl_node_t *fixup_predsucceq (const ddsrt_avl_treedef_t *td, const void *key, const ddsrt_avl_node_t *tmp, const ddsrt_avl_node_t *cand, int dir)
 {
     if (tmp == NULL) {
         return cand;
-    } else if (!(td->flags & UT_AVL_TREEDEF_FLAG_ALLOWDUPS)) {
+    } else if (!(td->flags & DDSRT_AVL_TREEDEF_FLAG_ALLOWDUPS)) {
         return tmp;
     } else {
         /* key exists - but it there's no guarantee we hit the first
@@ -705,10 +705,10 @@ static const ut_avlNode_t *fixup_predsucceq (const ut_avlTreedef_t *td, const vo
     }
 }
 
-static const ut_avlNode_t *lookup_predeq (const ut_avlTreedef_t *td, const ut_avlTree_t *tree, const void *key)
+static const ddsrt_avl_node_t *lookup_predeq (const ddsrt_avl_treedef_t *td, const ddsrt_avl_tree_t *tree, const void *key)
 {
-    const ut_avlNode_t *tmp = tree->root;
-    const ut_avlNode_t *cand = NULL;
+    const ddsrt_avl_node_t *tmp = tree->root;
+    const ddsrt_avl_node_t *cand = NULL;
     int c;
     while (tmp && (c = comparenk (td, tmp, key)) != 0) {
         if (c < 0) {
@@ -721,10 +721,10 @@ static const ut_avlNode_t *lookup_predeq (const ut_avlTreedef_t *td, const ut_av
     return fixup_predsucceq (td, key, tmp, cand, 0);
 }
 
-static const ut_avlNode_t *lookup_succeq (const ut_avlTreedef_t *td, const ut_avlTree_t *tree, const void *key)
+static const ddsrt_avl_node_t *lookup_succeq (const ddsrt_avl_treedef_t *td, const ddsrt_avl_tree_t *tree, const void *key)
 {
-    const ut_avlNode_t *tmp = tree->root;
-    const ut_avlNode_t *cand = NULL;
+    const ddsrt_avl_node_t *tmp = tree->root;
+    const ddsrt_avl_node_t *cand = NULL;
     int c;
     while (tmp && (c = comparenk (td, tmp, key)) != 0) {
         if (c > 0) {
@@ -737,12 +737,12 @@ static const ut_avlNode_t *lookup_succeq (const ut_avlTreedef_t *td, const ut_av
     return fixup_predsucceq (td, key, tmp, cand, 1);
 }
 
-static const ut_avlNode_t *fixup_predsucc (const ut_avlTreedef_t *td, const void *key, const ut_avlNode_t *tmp, const ut_avlNode_t *cand, int dir)
+static const ddsrt_avl_node_t *fixup_predsucc (const ddsrt_avl_treedef_t *td, const void *key, const ddsrt_avl_node_t *tmp, const ddsrt_avl_node_t *cand, int dir)
 {
     /* dir=0: pred, dir=1: succ */
     if (tmp == NULL || tmp->cs[dir] == NULL) {
         return cand;
-    } else if (!(td->flags & UT_AVL_TREEDEF_FLAG_ALLOWDUPS)) {
+    } else if (!(td->flags & DDSRT_AVL_TREEDEF_FLAG_ALLOWDUPS)) {
         /* No duplicates, therefore the extremum in the subtree */
         tmp = tmp->cs[dir];
         while (tmp->cs[1-dir]) {
@@ -766,10 +766,10 @@ static const ut_avlNode_t *fixup_predsucc (const ut_avlTreedef_t *td, const void
     }
 }
 
-static const ut_avlNode_t *lookup_pred (const ut_avlTreedef_t *td, const ut_avlTree_t *tree, const void *key)
+static const ddsrt_avl_node_t *lookup_pred (const ddsrt_avl_treedef_t *td, const ddsrt_avl_tree_t *tree, const void *key)
 {
-    const ut_avlNode_t *tmp = tree->root;
-    const ut_avlNode_t *cand = NULL;
+    const ddsrt_avl_node_t *tmp = tree->root;
+    const ddsrt_avl_node_t *cand = NULL;
     int c;
     while (tmp && (c = comparenk (td, tmp, key)) != 0) {
         if (c < 0) {
@@ -782,10 +782,10 @@ static const ut_avlNode_t *lookup_pred (const ut_avlTreedef_t *td, const ut_avlT
     return fixup_predsucc (td, key, tmp, cand, 0);
 }
 
-static const ut_avlNode_t *lookup_succ (const ut_avlTreedef_t *td, const ut_avlTree_t *tree, const void *key)
+static const ddsrt_avl_node_t *lookup_succ (const ddsrt_avl_treedef_t *td, const ddsrt_avl_tree_t *tree, const void *key)
 {
-    const ut_avlNode_t *tmp = tree->root;
-    const ut_avlNode_t *cand = NULL;
+    const ddsrt_avl_node_t *tmp = tree->root;
+    const ddsrt_avl_node_t *cand = NULL;
     int c;
     while (tmp && (c = comparenk (td, tmp, key)) != 0) {
         if (c > 0) {
@@ -798,43 +798,43 @@ static const ut_avlNode_t *lookup_succ (const ut_avlTreedef_t *td, const ut_avlT
     return fixup_predsucc (td, key, tmp, cand, 1);
 }
 
-void *ut_avlLookupSuccEq (const ut_avlTreedef_t *td, const ut_avlTree_t *tree, const void *key)
+void *ddsrt_avl_lookup_succ_eq (const ddsrt_avl_treedef_t *td, const ddsrt_avl_tree_t *tree, const void *key)
 {
     return (void *) conode_from_node (td, lookup_succeq (td, tree, key));
 }
 
-void *ut_avlLookupPredEq (const ut_avlTreedef_t *td, const ut_avlTree_t *tree, const void *key)
+void *ddsrt_avl_lookup_pred_eq (const ddsrt_avl_treedef_t *td, const ddsrt_avl_tree_t *tree, const void *key)
 {
     return (void *) conode_from_node (td, lookup_predeq (td, tree, key));
 }
 
-void *ut_avlLookupSucc (const ut_avlTreedef_t *td, const ut_avlTree_t *tree, const void *key)
+void *ddsrt_avl_lookup_succ (const ddsrt_avl_treedef_t *td, const ddsrt_avl_tree_t *tree, const void *key)
 {
     return (void *) conode_from_node (td, lookup_succ (td, tree, key));
 }
 
-void *ut_avlLookupPred (const ut_avlTreedef_t *td, const ut_avlTree_t *tree, const void *key)
+void *ddsrt_avl_lookup_pred (const ddsrt_avl_treedef_t *td, const ddsrt_avl_tree_t *tree, const void *key)
 {
     return (void *) conode_from_node (td, lookup_pred (td, tree, key));
 }
 
-void *ut_avlIterSuccEq (const ut_avlTreedef_t *td, const ut_avlTree_t *tree, ut_avlIter_t *iter, const void *key)
+void *ddsrt_avl_iter_succ_eq (const ddsrt_avl_treedef_t *td, const ddsrt_avl_tree_t *tree, ddsrt_avl_iter_t *iter, const void *key)
 {
-    const ut_avlNode_t *tmp = tree->root;
+    const ddsrt_avl_node_t *tmp = tree->root;
     int c;
     iter->td = td;
     iter->todop = iter->todo;
     while (tmp && (c = comparenk (td, tmp, key)) != 0) {
         if (c > 0) {
-            *++iter->todop = (ut_avlNode_t *) tmp;
+            *++iter->todop = (ddsrt_avl_node_t *) tmp;
             tmp = tmp->cs[0];
         } else {
             tmp = tmp->cs[1];
         }
     }
     if (tmp != NULL) {
-        *++iter->todop = (ut_avlNode_t *) tmp;
-        if (td->flags & UT_AVL_TREEDEF_FLAG_ALLOWDUPS) {
+        *++iter->todop = (ddsrt_avl_node_t *) tmp;
+        if (td->flags & DDSRT_AVL_TREEDEF_FLAG_ALLOWDUPS) {
             /* key exists - but it there's no guarantee we hit the
                first one in the in-order enumeration of the tree */
             tmp = tmp->cs[0];
@@ -842,7 +842,7 @@ void *ut_avlIterSuccEq (const ut_avlTreedef_t *td, const ut_avlTree_t *tree, ut_
                 if (comparenk (td, tmp, key) != 0) {
                     tmp = tmp->cs[1];
                 } else {
-                    *++iter->todop = (ut_avlNode_t *) tmp;
+                    *++iter->todop = (ddsrt_avl_node_t *) tmp;
                     tmp = tmp->cs[0];
                 }
             }
@@ -856,26 +856,26 @@ void *ut_avlIterSuccEq (const ut_avlTreedef_t *td, const ut_avlTree_t *tree, ut_
     }
 }
 
-void *ut_avlIterSucc (const ut_avlTreedef_t *td, const ut_avlTree_t *tree, ut_avlIter_t *iter, const void *key)
+void *ddsrt_avl_iter_succ (const ddsrt_avl_treedef_t *td, const ddsrt_avl_tree_t *tree, ddsrt_avl_iter_t *iter, const void *key)
 {
-    const ut_avlNode_t *tmp = tree->root;
+    const ddsrt_avl_node_t *tmp = tree->root;
     int c;
     iter->td = td;
     iter->todop = iter->todo;
     while (tmp && (c = comparenk (td, tmp, key)) != 0) {
         if (c > 0) {
-            *++iter->todop = (ut_avlNode_t *) tmp;
+            *++iter->todop = (ddsrt_avl_node_t *) tmp;
             tmp = tmp->cs[0];
         } else {
             tmp = tmp->cs[1];
         }
     }
     if (tmp != NULL) {
-      if (!(td->flags & UT_AVL_TREEDEF_FLAG_ALLOWDUPS)) {
+      if (!(td->flags & DDSRT_AVL_TREEDEF_FLAG_ALLOWDUPS)) {
             tmp = tmp->cs[1];
             if (tmp) {
                 do {
-                    *++iter->todop = (ut_avlNode_t *) tmp;
+                    *++iter->todop = (ddsrt_avl_node_t *) tmp;
                     tmp = tmp->cs[0];
                 } while (tmp);
             }
@@ -883,7 +883,7 @@ void *ut_avlIterSucc (const ut_avlTreedef_t *td, const ut_avlTree_t *tree, ut_av
             tmp = tmp->cs[1];
             while (tmp) {
                 if (comparenk (td, tmp, key) != 0) {
-                    *++iter->todop = (ut_avlNode_t *) tmp;
+                    *++iter->todop = (ddsrt_avl_node_t *) tmp;
                     tmp = tmp->cs[0];
                 } else {
                     tmp = tmp->cs[1];
@@ -899,10 +899,10 @@ void *ut_avlIterSucc (const ut_avlTreedef_t *td, const ut_avlTree_t *tree, ut_av
     }
 }
 
-void ut_avlWalkRange (const ut_avlTreedef_t *td, ut_avlTree_t *tree, const void *min, const void *max, ut_avlWalk_t f, void *a)
+void ddsrt_avl_walk_range (const ddsrt_avl_treedef_t *td, ddsrt_avl_tree_t *tree, const void *min, const void *max, ddsrt_avl_walk_t f, void *a)
 {
-    ut_avlNode_t *n, *nn;
-    n = (ut_avlNode_t *) lookup_succeq (td, tree, min);
+    ddsrt_avl_node_t *n, *nn;
+    n = (ddsrt_avl_node_t *) lookup_succeq (td, tree, min);
     while (n && comparenk (td, n, max) <= 0) {
         nn = find_neighbour (n, 1);
         f (onode_from_node (td, n), a);
@@ -910,15 +910,15 @@ void ut_avlWalkRange (const ut_avlTreedef_t *td, ut_avlTree_t *tree, const void
     }
 }
 
-void ut_avlConstWalkRange (const ut_avlTreedef_t *td, const ut_avlTree_t *tree, const void *min, const void *max, ut_avlConstWalk_t f, void *a)
+void ddsrt_avl_const_walk_range (const ddsrt_avl_treedef_t *td, const ddsrt_avl_tree_t *tree, const void *min, const void *max, ddsrt_avl_const_walk_t f, void *a)
 {
-    ut_avlWalkRange (td, (ut_avlTree_t *) tree, min, max, (ut_avlWalk_t) f, a);
+    ddsrt_avl_walk_range (td, (ddsrt_avl_tree_t *) tree, min, max, (ddsrt_avl_walk_t) f, a);
 }
 
-void ut_avlWalkRangeReverse (const ut_avlTreedef_t *td, ut_avlTree_t *tree, const void *min, const void *max, ut_avlWalk_t f, void *a)
+void ddsrt_avl_walk_range_reverse (const ddsrt_avl_treedef_t *td, ddsrt_avl_tree_t *tree, const void *min, const void *max, ddsrt_avl_walk_t f, void *a)
 {
-    ut_avlNode_t *n, *nn;
-    n = (ut_avlNode_t *) lookup_predeq (td, tree, max);
+    ddsrt_avl_node_t *n, *nn;
+    n = (ddsrt_avl_node_t *) lookup_predeq (td, tree, max);
     while (n && comparenk (td, n, min) >= 0) {
         nn = find_neighbour (n, 0);
         f (onode_from_node (td, n), a);
@@ -926,17 +926,17 @@ void ut_avlWalkRangeReverse (const ut_avlTreedef_t *td, ut_avlTree_t *tree, cons
     }
 }
 
-void ut_avlConstWalkRangeReverse (const ut_avlTreedef_t *td, const ut_avlTree_t *tree, const void *min, const void *max, ut_avlConstWalk_t f, void *a)
+void ddsrt_avl_const_walk_range_reverse (const ddsrt_avl_treedef_t *td, const ddsrt_avl_tree_t *tree, const void *min, const void *max, ddsrt_avl_const_walk_t f, void *a)
 {
-    ut_avlWalkRangeReverse (td, (ut_avlTree_t *) tree, min, max, (ut_avlWalk_t) f, a);
+    ddsrt_avl_walk_range_reverse (td, (ddsrt_avl_tree_t *) tree, min, max, (ddsrt_avl_walk_t) f, a);
 }
 
-void *ut_avlRoot (const ut_avlTreedef_t *td, const ut_avlTree_t *tree)
+void *ddsrt_avl_root (const ddsrt_avl_treedef_t *td, const ddsrt_avl_tree_t *tree)
 {
     return (void *) conode_from_node (td, tree->root);
 }
 
-void *ut_avlRootNonEmpty (const ut_avlTreedef_t *td, const ut_avlTree_t *tree)
+void *ddsrt_avl_root_non_empty (const ddsrt_avl_treedef_t *td, const ddsrt_avl_tree_t *tree)
 {
     assert (tree->root);
     return (void *) conode_from_node (td, tree->root);
@@ -948,201 +948,201 @@ void *ut_avlRootNonEmpty (const ut_avlTreedef_t *td, const ut_avlTree_t *tree)
  ****
  **************************************************************************************/
 
-void ut_avlCTreedefInit (ut_avlCTreedef_t *td, size_t avlnodeoffset, size_t keyoffset, ut_avlCompare_t comparekk, ut_avlAugment_t augment, uint32_t flags)
+void ddsrt_avl_ctreedef_init (ddsrt_avl_ctreedef_t *td, size_t avlnodeoffset, size_t keyoffset, ddsrt_avl_compare_t comparekk, ddsrt_avl_augment_t augment, uint32_t flags)
 {
     treedef_init_common (&td->t, avlnodeoffset, keyoffset, augment, flags);
     td->t.u.comparekk = comparekk;
 }
 
-void ut_avlCTreedefInit_r (ut_avlCTreedef_t *td, size_t avlnodeoffset, size_t keyoffset, ut_avlCompare_r_t comparekk_r, void *cmp_arg, ut_avlAugment_t augment, uint32_t flags)
+void ddsrt_avl_ctreedef_init_r (ddsrt_avl_ctreedef_t *td, size_t avlnodeoffset, size_t keyoffset, ddsrt_avl_compare_r_t comparekk_r, void *cmp_arg, ddsrt_avl_augment_t augment, uint32_t flags)
 {
-    treedef_init_common (&td->t, avlnodeoffset, keyoffset, augment, flags | UT_AVL_TREEDEF_FLAG_R);
+    treedef_init_common (&td->t, avlnodeoffset, keyoffset, augment, flags | DDSRT_AVL_TREEDEF_FLAG_R);
     td->t.cmp_arg = cmp_arg;
     td->t.u.comparekk_r = comparekk_r;
 }
 
-void ut_avlCInit (const ut_avlCTreedef_t *td, ut_avlCTree_t *tree)
+void ddsrt_avl_cinit (const ddsrt_avl_ctreedef_t *td, ddsrt_avl_ctree_t *tree)
 {
-    ut_avlInit (&td->t, &tree->t);
+    ddsrt_avl_init (&td->t, &tree->t);
     tree->count = 0;
 }
 
-void ut_avlCFree (const ut_avlCTreedef_t *td, ut_avlCTree_t *tree, void (*freefun) (void *node))
+void ddsrt_avl_cfree (const ddsrt_avl_ctreedef_t *td, ddsrt_avl_ctree_t *tree, void (*freefun) (void *node))
 {
     tree->count = 0;
-    ut_avlFree (&td->t, &tree->t, freefun);
+    ddsrt_avl_free (&td->t, &tree->t, freefun);
 }
 
-void ut_avlCFreeArg (const ut_avlCTreedef_t *td, ut_avlCTree_t *tree, void (*freefun) (void *node, void *arg), void *arg)
+void ddsrt_avl_cfree_arg (const ddsrt_avl_ctreedef_t *td, ddsrt_avl_ctree_t *tree, void (*freefun) (void *node, void *arg), void *arg)
 {
     tree->count = 0;
-    ut_avlFreeArg (&td->t, &tree->t, freefun, arg);
+    ddsrt_avl_free_arg (&td->t, &tree->t, freefun, arg);
 }
 
-void *ut_avlCRoot (const ut_avlCTreedef_t *td, const ut_avlCTree_t *tree)
+void *ddsrt_avl_croot (const ddsrt_avl_ctreedef_t *td, const ddsrt_avl_ctree_t *tree)
 {
-    return ut_avlRoot (&td->t, &tree->t);
+    return ddsrt_avl_root (&td->t, &tree->t);
 }
 
-void *ut_avlCRootNonEmpty (const ut_avlCTreedef_t *td, const ut_avlCTree_t *tree)
+void *ddsrt_avl_croot_non_empty (const ddsrt_avl_ctreedef_t *td, const ddsrt_avl_ctree_t *tree)
 {
-    return ut_avlRootNonEmpty (&td->t, &tree->t);
+    return ddsrt_avl_root_non_empty (&td->t, &tree->t);
 }
 
-void *ut_avlCLookup (const ut_avlCTreedef_t *td, const ut_avlCTree_t *tree, const void *key)
+void *ddsrt_avl_clookup (const ddsrt_avl_ctreedef_t *td, const ddsrt_avl_ctree_t *tree, const void *key)
 {
-    return ut_avlLookup (&td->t, &tree->t, key);
+    return ddsrt_avl_lookup (&td->t, &tree->t, key);
 }
 
-void *ut_avlCLookupIPath (const ut_avlCTreedef_t *td, const ut_avlCTree_t *tree, const void *key, ut_avlIPath_t *path)
+void *ddsrt_avl_clookup_ipath (const ddsrt_avl_ctreedef_t *td, const ddsrt_avl_ctree_t *tree, const void *key, ddsrt_avl_ipath_t *path)
 {
-    return ut_avlLookupIPath (&td->t, &tree->t, key, path);
+    return ddsrt_avl_lookup_ipath (&td->t, &tree->t, key, path);
 }
 
-void *ut_avlCLookupDPath (const ut_avlCTreedef_t *td, const ut_avlCTree_t *tree, const void *key, ut_avlDPath_t *path)
+void *ddsrt_avl_clookup_dpath (const ddsrt_avl_ctreedef_t *td, const ddsrt_avl_ctree_t *tree, const void *key, ddsrt_avl_dpath_t *path)
 {
-    return ut_avlLookupDPath (&td->t, &tree->t, key, path);
+    return ddsrt_avl_lookup_dpath (&td->t, &tree->t, key, path);
 }
 
-void *ut_avlCLookupPredEq (const ut_avlCTreedef_t *td, const ut_avlCTree_t *tree, const void *key)
+void *ddsrt_avl_clookup_pred_eq (const ddsrt_avl_ctreedef_t *td, const ddsrt_avl_ctree_t *tree, const void *key)
 {
-    return ut_avlLookupPredEq (&td->t, &tree->t, key);
+    return ddsrt_avl_lookup_pred_eq (&td->t, &tree->t, key);
 }
 
-void *ut_avlCLookupSuccEq (const ut_avlCTreedef_t *td, const ut_avlCTree_t *tree, const void *key)
+void *ddsrt_avl_clookup_succ_eq (const ddsrt_avl_ctreedef_t *td, const ddsrt_avl_ctree_t *tree, const void *key)
 {
-    return ut_avlLookupSuccEq (&td->t, &tree->t, key);
+    return ddsrt_avl_lookup_succ_eq (&td->t, &tree->t, key);
 }
 
-void *ut_avlCLookupPred (const ut_avlCTreedef_t *td, const ut_avlCTree_t *tree, const void *key)
+void *ddsrt_avl_clookup_pred (const ddsrt_avl_ctreedef_t *td, const ddsrt_avl_ctree_t *tree, const void *key)
 {
-    return ut_avlLookupPred (&td->t, &tree->t, key);
+    return ddsrt_avl_lookup_pred (&td->t, &tree->t, key);
 }
 
-void *ut_avlCLookupSucc (const ut_avlCTreedef_t *td, const ut_avlCTree_t *tree, const void *key)
+void *ddsrt_avl_clookup_succ (const ddsrt_avl_ctreedef_t *td, const ddsrt_avl_ctree_t *tree, const void *key)
 {
-    return ut_avlLookupSucc (&td->t, &tree->t, key);
+    return ddsrt_avl_lookup_succ (&td->t, &tree->t, key);
 }
 
-void ut_avlCInsert (const ut_avlCTreedef_t *td, ut_avlCTree_t *tree, void *node)
+void ddsrt_avl_cinsert (const ddsrt_avl_ctreedef_t *td, ddsrt_avl_ctree_t *tree, void *node)
 {
     tree->count++;
-    ut_avlInsert (&td->t, &tree->t, node);
+    ddsrt_avl_insert (&td->t, &tree->t, node);
 }
 
-void ut_avlCDelete (const ut_avlCTreedef_t *td, ut_avlCTree_t *tree, void *node)
+void ddsrt_avl_cdelete (const ddsrt_avl_ctreedef_t *td, ddsrt_avl_ctree_t *tree, void *node)
 {
     assert (tree->count > 0);
     tree->count--;
-    ut_avlDelete (&td->t, &tree->t, node);
+    ddsrt_avl_delete (&td->t, &tree->t, node);
 }
 
-void ut_avlCInsertIPath (const ut_avlCTreedef_t *td, ut_avlCTree_t *tree, void *node, ut_avlIPath_t *path)
+void ddsrt_avl_cinsert_ipath (const ddsrt_avl_ctreedef_t *td, ddsrt_avl_ctree_t *tree, void *node, ddsrt_avl_ipath_t *path)
 {
     tree->count++;
-    ut_avlInsertIPath (&td->t, &tree->t, node, path);
+    ddsrt_avl_insert_ipath (&td->t, &tree->t, node, path);
 }
 
-void ut_avlCDeleteDPath (const ut_avlCTreedef_t *td, ut_avlCTree_t *tree, void *node, ut_avlDPath_t *path)
+void ddsrt_avl_cdelete_dpath (const ddsrt_avl_ctreedef_t *td, ddsrt_avl_ctree_t *tree, void *node, ddsrt_avl_dpath_t *path)
 {
     assert (tree->count > 0);
     tree->count--;
-    ut_avlDeleteDPath (&td->t, &tree->t, node, path);
+    ddsrt_avl_delete_dpath (&td->t, &tree->t, node, path);
 }
 
-void ut_avlCSwapNode (const ut_avlCTreedef_t *td, ut_avlCTree_t *tree, void *old, void *new)
+void ddsrt_avl_cswap_node (const ddsrt_avl_ctreedef_t *td, ddsrt_avl_ctree_t *tree, void *old, void *new)
 {
-    ut_avlSwapNode (&td->t, &tree->t, old, new);
+    ddsrt_avl_swap_node (&td->t, &tree->t, old, new);
 }
 
-void ut_avlCAugmentUpdate (const ut_avlCTreedef_t *td, void *node)
+void ddsrt_avl_caugment_update (const ddsrt_avl_ctreedef_t *td, void *node)
 {
-    ut_avlAugmentUpdate (&td->t, node);
+    ddsrt_avl_augment_update (&td->t, node);
 }
 
-int ut_avlCIsEmpty (const ut_avlCTree_t *tree)
+int ddsrt_avl_cis_empty (const ddsrt_avl_ctree_t *tree)
 {
-    return ut_avlIsEmpty (&tree->t);
+    return ddsrt_avl_is_empty (&tree->t);
 }
 
-int ut_avlCIsSingleton (const ut_avlCTree_t *tree)
+int ddsrt_avl_cis_singleton (const ddsrt_avl_ctree_t *tree)
 {
-    return ut_avlIsSingleton (&tree->t);
+    return ddsrt_avl_is_singleton (&tree->t);
 }
 
-size_t ut_avlCCount (const ut_avlCTree_t *tree)
+size_t ddsrt_avl_ccount (const ddsrt_avl_ctree_t *tree)
 {
     return tree->count;
 }
 
-void *ut_avlCFindMin (const ut_avlCTreedef_t *td, const ut_avlCTree_t *tree)
+void *ddsrt_avl_cfind_min (const ddsrt_avl_ctreedef_t *td, const ddsrt_avl_ctree_t *tree)
 {
-    return ut_avlFindMin (&td->t, &tree->t);
+    return ddsrt_avl_find_min (&td->t, &tree->t);
 }
 
-void *ut_avlCFindMax (const ut_avlCTreedef_t *td, const ut_avlCTree_t *tree)
+void *ddsrt_avl_cfind_max (const ddsrt_avl_ctreedef_t *td, const ddsrt_avl_ctree_t *tree)
 {
-    return ut_avlFindMax (&td->t, &tree->t);
+    return ddsrt_avl_find_max (&td->t, &tree->t);
 }
 
-void *ut_avlCFindPred (const ut_avlCTreedef_t *td, const ut_avlCTree_t *tree, const void *vnode)
+void *ddsrt_avl_cfind_pred (const ddsrt_avl_ctreedef_t *td, const ddsrt_avl_ctree_t *tree, const void *vnode)
 {
-    return ut_avlFindPred (&td->t, &tree->t, vnode);
+    return ddsrt_avl_find_pred (&td->t, &tree->t, vnode);
 }
 
-void *ut_avlCFindSucc (const ut_avlCTreedef_t *td, const ut_avlCTree_t *tree, const void *vnode)
+void *ddsrt_avl_cfind_succ (const ddsrt_avl_ctreedef_t *td, const ddsrt_avl_ctree_t *tree, const void *vnode)
 {
-    return ut_avlFindSucc (&td->t, &tree->t, vnode);
+    return ddsrt_avl_find_succ (&td->t, &tree->t, vnode);
 }
 
-void ut_avlCWalk (const ut_avlCTreedef_t *td, ut_avlCTree_t *tree, ut_avlWalk_t f, void *a)
+void ddsrt_avl_cwalk (const ddsrt_avl_ctreedef_t *td, ddsrt_avl_ctree_t *tree, ddsrt_avl_walk_t f, void *a)
 {
-    ut_avlWalk (&td->t, &tree->t, f, a);
+    ddsrt_avl_walk (&td->t, &tree->t, f, a);
 }
 
-void ut_avlCConstWalk (const ut_avlCTreedef_t *td, const ut_avlCTree_t *tree, ut_avlConstWalk_t f, void *a)
+void ddsrt_avl_cconst_walk (const ddsrt_avl_ctreedef_t *td, const ddsrt_avl_ctree_t *tree, ddsrt_avl_const_walk_t f, void *a)
 {
-    ut_avlConstWalk (&td->t, &tree->t, f, a);
+    ddsrt_avl_const_walk (&td->t, &tree->t, f, a);
 }
 
-void ut_avlCWalkRange (const ut_avlCTreedef_t *td, ut_avlCTree_t *tree, const void *min, const void *max, ut_avlWalk_t f, void *a)
+void ddsrt_avl_cwalk_range (const ddsrt_avl_ctreedef_t *td, ddsrt_avl_ctree_t *tree, const void *min, const void *max, ddsrt_avl_walk_t f, void *a)
 {
-    ut_avlWalkRange (&td->t, &tree->t, min, max, f, a);
+    ddsrt_avl_walk_range (&td->t, &tree->t, min, max, f, a);
 }
 
-void ut_avlCConstWalkRange (const ut_avlCTreedef_t *td, const ut_avlCTree_t *tree, const void *min, const void *max, ut_avlConstWalk_t f, void *a)
+void ddsrt_avl_cconst_walk_range (const ddsrt_avl_ctreedef_t *td, const ddsrt_avl_ctree_t *tree, const void *min, const void *max, ddsrt_avl_const_walk_t f, void *a)
 {
-    ut_avlConstWalkRange (&td->t, &tree->t, min, max, f, a);
+    ddsrt_avl_const_walk_range (&td->t, &tree->t, min, max, f, a);
 }
 
-void ut_avlCWalkRangeReverse (const ut_avlCTreedef_t *td, ut_avlCTree_t *tree, const void *min, const void *max, ut_avlWalk_t f, void *a)
+void ddsrt_avl_cwalk_range_reverse (const ddsrt_avl_ctreedef_t *td, ddsrt_avl_ctree_t *tree, const void *min, const void *max, ddsrt_avl_walk_t f, void *a)
 {
-    ut_avlWalkRangeReverse (&td->t, &tree->t, min, max, f, a);
+    ddsrt_avl_walk_range_reverse (&td->t, &tree->t, min, max, f, a);
 }
 
-void ut_avlCConstWalkRangeReverse (const ut_avlCTreedef_t *td, const ut_avlCTree_t *tree, const void *min, const void *max, ut_avlConstWalk_t f, void *a)
+void ddsrt_avl_cconst_walk_range_reverse (const ddsrt_avl_ctreedef_t *td, const ddsrt_avl_ctree_t *tree, const void *min, const void *max, ddsrt_avl_const_walk_t f, void *a)
 {
-    ut_avlConstWalkRangeReverse (&td->t, &tree->t, min, max, f, a);
+    ddsrt_avl_const_walk_range_reverse (&td->t, &tree->t, min, max, f, a);
 }
 
-void *ut_avlCIterFirst (const ut_avlCTreedef_t *td, const ut_avlCTree_t *tree, ut_avlCIter_t *iter)
+void *ddsrt_avl_citer_first (const ddsrt_avl_ctreedef_t *td, const ddsrt_avl_ctree_t *tree, ddsrt_avl_citer_t *iter)
 {
-    return ut_avlIterFirst (&td->t, &tree->t, &iter->t);
+    return ddsrt_avl_iter_first (&td->t, &tree->t, &iter->t);
 }
 
-void *ut_avlCIterSuccEq (const ut_avlCTreedef_t *td, const ut_avlCTree_t *tree, ut_avlCIter_t *iter, const void *key)
+void *ddsrt_avl_citer_succ_eq (const ddsrt_avl_ctreedef_t *td, const ddsrt_avl_ctree_t *tree, ddsrt_avl_citer_t *iter, const void *key)
 {
-    return ut_avlIterSuccEq (&td->t, &tree->t, &iter->t, key);
+    return ddsrt_avl_iter_succ_eq (&td->t, &tree->t, &iter->t, key);
 }
 
-void *ut_avlCIterSucc (const ut_avlCTreedef_t *td, const ut_avlCTree_t *tree, ut_avlCIter_t *iter, const void *key)
+void *ddsrt_avl_citer_succ (const ddsrt_avl_ctreedef_t *td, const ddsrt_avl_ctree_t *tree, ddsrt_avl_citer_t *iter, const void *key)
 {
-    return ut_avlIterSucc (&td->t, &tree->t, &iter->t, key);
+    return ddsrt_avl_iter_succ (&td->t, &tree->t, &iter->t, key);
 }
 
-void *ut_avlCIterNext (ut_avlCIter_t *iter)
+void *ddsrt_avl_citer_next (ddsrt_avl_citer_t *iter)
 {
     /* Added this in-between t variable to satisfy SAL. */
-    ut_avlIter_t *t = &(iter->t);
-    return ut_avlIterNext(t);
+    ddsrt_avl_iter_t *t = &(iter->t);
+    return ddsrt_avl_iter_next(t);
 }
diff --git a/src/util/src/ut_expand_envvars.c b/src/ddsrt/src/expand_envvars.c
similarity index 93%
rename from src/util/src/ut_expand_envvars.c
rename to src/ddsrt/src/expand_envvars.c
index 3b2b999..ded0d0a 100644
--- a/src/util/src/ut_expand_envvars.c
+++ b/src/ddsrt/src/expand_envvars.c
@@ -19,7 +19,7 @@
 #include "dds/ddsrt/heap.h"
 #include "dds/ddsrt/log.h"
 #include "dds/ddsrt/string.h"
-#include "dds/util/ut_expand_envvars.h"
+#include "dds/ddsrt/expand_envvars.h"
 
 typedef char * (*expand_fn)(const char *src0);
 
@@ -157,7 +157,7 @@ static char *expand_envchar (const char **src, expand_fn expand)
     return expand_env (name, 0, NULL, expand);
 }
 
-char *ut_expand_envvars_sh (const char *src0)
+char *ddsrt_expand_envvars_sh (const char *src0)
 {
     /* Expands $X, ${X}, ${X:-Y}, ${X:+Y}, ${X:?Y} forms; $ and \ can be escaped with \ */
     const char *src = src0;
@@ -180,11 +180,11 @@ char *ut_expand_envvars_sh (const char *src0)
                 ddsrt_free(dst);
                 return NULL;
             } else if (*src == '{') {
-                x = expand_envbrace (&src, &ut_expand_envvars_sh);
+                x = expand_envbrace (&src, &ddsrt_expand_envvars_sh);
             } else if (isalnum ((unsigned char) *src) || *src == '_') {
-                x = expand_envsimple (&src, &ut_expand_envvars_sh);
+                x = expand_envsimple (&src, &ddsrt_expand_envvars_sh);
             } else {
-                x = expand_envchar (&src, &ut_expand_envvars_sh);
+                x = expand_envchar (&src, &ddsrt_expand_envvars_sh);
             }
             if (x == NULL) {
                 ddsrt_free(dst);
@@ -203,7 +203,7 @@ char *ut_expand_envvars_sh (const char *src0)
     return dst;
 }
 
-char *ut_expand_envvars (const char *src0)
+char *ddsrt_expand_envvars (const char *src0)
 {
     /* Expands ${X}, ${X:-Y}, ${X:+Y}, ${X:?Y} forms, but not $X */
     const char *src = src0;
@@ -213,7 +213,7 @@ char *ut_expand_envvars (const char *src0)
         if (*src == '$' && *(src + 1) == '{') {
             char *x, *xp;
             src++;
-            x = expand_envbrace (&src, &ut_expand_envvars);
+            x = expand_envbrace (&src, &ddsrt_expand_envvars);
             if (x == NULL) {
                 ddsrt_free(dst);
                 return NULL;
diff --git a/src/util/src/ut_fibheap.c b/src/ddsrt/src/fibheap.c
similarity index 68%
rename from src/util/src/ut_fibheap.c
rename to src/ddsrt/src/fibheap.c
index a92d186..2e3bcf8 100644
--- a/src/util/src/ut_fibheap.c
+++ b/src/ddsrt/src/fibheap.c
@@ -14,7 +14,7 @@
 #include <assert.h>
 
 #include "dds/ddsrt/misc.h"
-#include "dds/util/ut_fibheap.h"
+#include "dds/ddsrt/fibheap.h"
 
 /* max degree: n >= F_{d+2} >= \phi^d ==> d <= log_\phi n, where \phi
    (as usual) is the golden ratio ~= 1.618.  We know n <= (size of
@@ -23,24 +23,24 @@
    space). */
 #define MAX_DEGREE ((unsigned) (sizeof (void *) * CHAR_BIT - 1))
 
-static int cmp (const ut_fibheapDef_t *fhdef, const ut_fibheapNode_t *a, const ut_fibheapNode_t *b)
+static int cmp (const ddsrt_fibheap_def_t *fhdef, const ddsrt_fibheap_node_t *a, const ddsrt_fibheap_node_t *b)
 {
     return fhdef->cmp ((const char *) a - fhdef->offset, (const char *) b - fhdef->offset);
 }
 
-void ut_fibheapDefInit (ut_fibheapDef_t *fhdef, uintptr_t offset, int (*cmp) (const void *va, const void *vb))
+void ddsrt_fibheap_def_init (ddsrt_fibheap_def_t *fhdef, uintptr_t offset, int (*cmp) (const void *va, const void *vb))
 {
     fhdef->offset = offset;
     fhdef->cmp = cmp;
 }
 
-void ut_fibheapInit (const ut_fibheapDef_t *fhdef, ut_fibheap_t *fh)
+void ddsrt_fibheap_init (const ddsrt_fibheap_def_t *fhdef, ddsrt_fibheap_t *fh)
 {
     DDSRT_UNUSED_ARG(fhdef);
     fh->roots = NULL;
 }
 
-void *ut_fibheapMin (const ut_fibheapDef_t *fhdef, const ut_fibheap_t *fh)
+void *ddsrt_fibheap_min (const ddsrt_fibheap_def_t *fhdef, const ddsrt_fibheap_t *fh)
 {
     if (fh->roots) {
         return (void *) ((char *) fh->roots - fhdef->offset);
@@ -49,16 +49,16 @@ void *ut_fibheapMin (const ut_fibheapDef_t *fhdef, const ut_fibheap_t *fh)
     }
 }
 
-static void ut_fibheap_merge_nonempty_list (ut_fibheapNode_t **markptr, ut_fibheapNode_t *list)
+static void ddsrt_fibheap_merge_nonempty_list (ddsrt_fibheap_node_t **markptr, ddsrt_fibheap_node_t *list)
 {
     assert (list != NULL);
 
     if (*markptr == NULL) {
         *markptr = list;
     } else {
-        ut_fibheapNode_t * const mark = *markptr;
-        ut_fibheapNode_t * const old_mark_next = mark->next;
-        ut_fibheapNode_t * const old_list_prev = list->prev;
+        ddsrt_fibheap_node_t * const mark = *markptr;
+        ddsrt_fibheap_node_t * const old_mark_next = mark->next;
+        ddsrt_fibheap_node_t * const old_list_prev = list->prev;
         mark->next = list;
         old_mark_next->prev = old_list_prev;
         list->prev = mark;
@@ -66,7 +66,7 @@ static void ut_fibheap_merge_nonempty_list (ut_fibheapNode_t **markptr, ut_fibhe
     }
 }
 
-static void ut_fibheap_merge_into (const ut_fibheapDef_t *fhdef, ut_fibheap_t *a, ut_fibheapNode_t * const br)
+static void ddsrt_fibheap_merge_into (const ddsrt_fibheap_def_t *fhdef, ddsrt_fibheap_t *a, ddsrt_fibheap_node_t * const br)
 {
     if (br == NULL) {
         return;
@@ -74,25 +74,25 @@ static void ut_fibheap_merge_into (const ut_fibheapDef_t *fhdef, ut_fibheap_t *a
         a->roots = br;
     } else {
         const int c = cmp (fhdef, br, a->roots);
-        ut_fibheap_merge_nonempty_list (&a->roots, br);
+        ddsrt_fibheap_merge_nonempty_list (&a->roots, br);
         if (c < 0)
             a->roots = br;
     }
 }
 
-void ut_fibheapMerge (const ut_fibheapDef_t *fhdef, ut_fibheap_t *a, ut_fibheap_t *b)
+void ddsrt_fibheap_merge (const ddsrt_fibheap_def_t *fhdef, ddsrt_fibheap_t *a, ddsrt_fibheap_t *b)
 {
     /* merges nodes from b into a, thereafter, b is empty */
-    ut_fibheap_merge_into (fhdef, a, b->roots);
+    ddsrt_fibheap_merge_into (fhdef, a, b->roots);
     b->roots = NULL;
 }
 
-void ut_fibheapInsert (const ut_fibheapDef_t *fhdef, ut_fibheap_t *fh, const void *vnode)
+void ddsrt_fibheap_insert (const ddsrt_fibheap_def_t *fhdef, ddsrt_fibheap_t *fh, const void *vnode)
 {
     /* fibheap node is opaque => nothing in node changes as far as
      caller is concerned => declare as const argument, then drop the
      const qualifier */
-    ut_fibheapNode_t *node = (ut_fibheapNode_t *) ((char *) vnode + fhdef->offset);
+    ddsrt_fibheap_node_t *node = (ddsrt_fibheap_node_t *) ((char *) vnode + fhdef->offset);
 
     /* new heap of degree 0 (i.e., only containing NODE) */
     node->parent = node->children = NULL;
@@ -101,24 +101,24 @@ void ut_fibheapInsert (const ut_fibheapDef_t *fhdef, ut_fibheap_t *fh, const voi
     node->degree = 0;
 
     /* then merge it in */
-    ut_fibheap_merge_into (fhdef, fh, node);
+    ddsrt_fibheap_merge_into (fhdef, fh, node);
 }
 
-static void ut_fibheap_add_as_child (ut_fibheapNode_t *parent, ut_fibheapNode_t *child)
+static void ddsrt_fibheap_add_as_child (ddsrt_fibheap_node_t *parent, ddsrt_fibheap_node_t *child)
 {
     parent->degree++;
     child->parent = parent;
     child->prev = child->next = child;
-    ut_fibheap_merge_nonempty_list (&parent->children, child);
+    ddsrt_fibheap_merge_nonempty_list (&parent->children, child);
 }
 
-static void ut_fibheap_delete_one_from_list (ut_fibheapNode_t **markptr, ut_fibheapNode_t *node)
+static void ddsrt_fibheap_delete_one_from_list (ddsrt_fibheap_node_t **markptr, ddsrt_fibheap_node_t *node)
 {
     if (node->next == node) {
         *markptr = NULL;
     } else {
-        ut_fibheapNode_t * const node_prev = node->prev;
-        ut_fibheapNode_t * const node_next = node->next;
+        ddsrt_fibheap_node_t * const node_prev = node->prev;
+        ddsrt_fibheap_node_t * const node_next = node->next;
         node_prev->next = node_next;
         node_next->prev = node_prev;
         if (*markptr == node) {
@@ -127,10 +127,10 @@ static void ut_fibheap_delete_one_from_list (ut_fibheapNode_t **markptr, ut_fibh
     }
 }
 
-void *ut_fibheapExtractMin (const ut_fibheapDef_t *fhdef, ut_fibheap_t *fh)
+void *ddsrt_fibheap_extract_min (const ddsrt_fibheap_def_t *fhdef, ddsrt_fibheap_t *fh)
 {
-    ut_fibheapNode_t *roots[MAX_DEGREE + 1];
-    ut_fibheapNode_t * const min = fh->roots;
+    ddsrt_fibheap_node_t *roots[MAX_DEGREE + 1];
+    ddsrt_fibheap_node_t * const min = fh->roots;
     unsigned min_degree_noninit = 0;
 
     /* empty heap => return that, alternative would be to require the
@@ -147,7 +147,7 @@ void *ut_fibheapExtractMin (const ut_fibheapDef_t *fhdef, ut_fibheap_t *fh)
     }
 
     /* remove min from fh->roots */
-    ut_fibheap_delete_one_from_list (&fh->roots, min);
+    ddsrt_fibheap_delete_one_from_list (&fh->roots, min);
 
     /* FIXME: can speed up by combining a few things & improving
        locality of reference by scanning lists only once */
@@ -155,30 +155,30 @@ void *ut_fibheapExtractMin (const ut_fibheapDef_t *fhdef, ut_fibheap_t *fh)
     /* insert min'schildren as new roots -- must fix parent pointers,
        and reset marks because roots are always unmarked */
     if (min->children) {
-        ut_fibheapNode_t * const mark = min->children;
-        ut_fibheapNode_t *n = mark;
+        ddsrt_fibheap_node_t * const mark = min->children;
+        ddsrt_fibheap_node_t *n = mark;
         do {
             n->parent = NULL;
             n->mark = 0;
             n = n->next;
         } while (n != mark);
 
-        ut_fibheap_merge_nonempty_list (&fh->roots, min->children);
+        ddsrt_fibheap_merge_nonempty_list (&fh->roots, min->children);
     }
 
     /* iteratively merge roots of equal degree, completely messing up
        fh->roots, ... */
     {
-        ut_fibheapNode_t *const mark = fh->roots;
-        ut_fibheapNode_t *n = mark;
+        ddsrt_fibheap_node_t *const mark = fh->roots;
+        ddsrt_fibheap_node_t *n = mark;
         do {
-            ut_fibheapNode_t * const n1 = n->next;
+            ddsrt_fibheap_node_t * const n1 = n->next;
 
             /* if n is first root with this high a degree, there's certainly
                not going to be another root to merge with yet */
             while (n->degree < min_degree_noninit && roots[n->degree]) {
                 unsigned const degree = n->degree;
-                ut_fibheapNode_t *u, *v;
+                ddsrt_fibheap_node_t *u, *v;
 
                 if (cmp (fhdef, roots[degree], n) < 0) {
                     u = roots[degree]; v = n;
@@ -186,7 +186,7 @@ void *ut_fibheapExtractMin (const ut_fibheapDef_t *fhdef, ut_fibheap_t *fh)
                     u = n; v = roots[degree];
                 }
                 roots[degree] = NULL;
-                ut_fibheap_add_as_child (u, v);
+                ddsrt_fibheap_add_as_child (u, v);
                 n = u;
             }
 
@@ -206,7 +206,7 @@ void *ut_fibheapExtractMin (const ut_fibheapDef_t *fhdef, ut_fibheap_t *fh)
        memory at an astonishing rate, and we need to compare the root
        keys anyway to find the minimum */
     {
-        ut_fibheapNode_t *mark, *cursor, *newmin;
+        ddsrt_fibheap_node_t *mark, *cursor, *newmin;
         unsigned i;
         for (i = 0; roots[i] == NULL; i++) {
             assert (i+1 < min_degree_noninit);
@@ -216,7 +216,7 @@ void *ut_fibheapExtractMin (const ut_fibheapDef_t *fhdef, ut_fibheap_t *fh)
         mark = cursor = roots[i];
         for (++i; i < min_degree_noninit; i++) {
             if (roots[i]) {
-                ut_fibheapNode_t * const r = roots[i];
+                ddsrt_fibheap_node_t * const r = roots[i];
                 if (cmp (fhdef, r, newmin) < 0)
                     newmin = r;
                 r->prev = cursor;
@@ -233,17 +233,17 @@ void *ut_fibheapExtractMin (const ut_fibheapDef_t *fhdef, ut_fibheap_t *fh)
     return (void *) ((char *) min - fhdef->offset);
 }
 
-static void ut_fibheap_cutnode (ut_fibheap_t *fh, ut_fibheapNode_t *node)
+static void ddsrt_fibheap_cutnode (ddsrt_fibheap_t *fh, ddsrt_fibheap_node_t *node)
 {
     /* by marking the node, we ensure it gets cut */
     node->mark = 1;
 
     /* traverse towards the root, cutting marked nodes on the way */
     while (node->parent && node->mark) {
-        ut_fibheapNode_t *parent = node->parent;
+        ddsrt_fibheap_node_t *parent = node->parent;
 
         assert (parent->degree > 0);
-        ut_fibheap_delete_one_from_list (&parent->children, node);
+        ddsrt_fibheap_delete_one_from_list (&parent->children, node);
         parent->degree--;
 
         node->mark = 0;
@@ -252,7 +252,7 @@ static void ut_fibheap_cutnode (ut_fibheap_t *fh, ut_fibheapNode_t *node)
 
         /* we assume heap properties haven't been violated, and therefore
            none of the nodes we cut can become the new minimum */
-        ut_fibheap_merge_nonempty_list (&fh->roots, node);
+        ddsrt_fibheap_merge_nonempty_list (&fh->roots, node);
 
         node = parent;
     }
@@ -264,12 +264,12 @@ static void ut_fibheap_cutnode (ut_fibheap_t *fh, ut_fibheapNode_t *node)
     }
 }
 
-void ut_fibheapDecreaseKey (const ut_fibheapDef_t *fhdef, ut_fibheap_t *fh, const void *vnode)
+void ddsrt_fibheap_decrease_key (const ddsrt_fibheap_def_t *fhdef, ddsrt_fibheap_t *fh, const void *vnode)
 {
     /* fibheap node is opaque => nothing in node changes as far as
        caller is concerned => declare as const argument, then drop the
        const qualifier */
-    ut_fibheapNode_t *node = (ut_fibheapNode_t *) ((char *) vnode + fhdef->offset);
+    ddsrt_fibheap_node_t *node = (ddsrt_fibheap_node_t *) ((char *) vnode + fhdef->offset);
 
     if (node->parent && cmp (fhdef, node->parent, node) <= 0) {
         /* heap property not violated, do nothing */
@@ -278,7 +278,7 @@ void ut_fibheapDecreaseKey (const ut_fibheapDef_t *fhdef, ut_fibheap_t *fh, cons
             /* heap property violated by decreasing the key, but we cut it
                pretending nothing has happened yet, then fix up the minimum if
                this node is the new minimum */
-            ut_fibheap_cutnode (fh, node);
+            ddsrt_fibheap_cutnode (fh, node);
         }
         if (cmp (fhdef, node, fh->roots) < 0) {
             fh->roots = node;
@@ -286,19 +286,19 @@ void ut_fibheapDecreaseKey (const ut_fibheapDef_t *fhdef, ut_fibheap_t *fh, cons
     }
 }
 
-void ut_fibheapDelete (const ut_fibheapDef_t *fhdef, ut_fibheap_t *fh, const void *vnode)
+void ddsrt_fibheap_delete (const ddsrt_fibheap_def_t *fhdef, ddsrt_fibheap_t *fh, const void *vnode)
 {
     /* fibheap node is opaque => nothing in node changes as far as
        caller is concerned => declare as const argument, then drop the
        const qualifier */
-    ut_fibheapNode_t *node = (ut_fibheapNode_t *) ((char *) vnode + fhdef->offset);
+    ddsrt_fibheap_node_t *node = (ddsrt_fibheap_node_t *) ((char *) vnode + fhdef->offset);
     
     /* essentially decreasekey(node);extractmin while pretending the
        node key is -infinity.  That means we can't directly call
        decreasekey, because it considers the actual value of the key. */
     if (node->parent != NULL) {
-        ut_fibheap_cutnode (fh, node);
+        ddsrt_fibheap_cutnode (fh, node);
     }
     fh->roots = node;
-    (void) ut_fibheapExtractMin (fhdef, fh);
+    (void) ddsrt_fibheap_extract_min (fhdef, fh);
 }
diff --git a/src/util/src/ut_hopscotch.c b/src/ddsrt/src/hopscotch.c
similarity index 67%
rename from src/util/src/ut_hopscotch.c
rename to src/ddsrt/src/hopscotch.c
index 276c9cb..eef7efb 100644
--- a/src/util/src/ut_hopscotch.c
+++ b/src/ddsrt/src/hopscotch.c
@@ -15,7 +15,7 @@
 #include "dds/ddsrt/atomics.h"
 #include "dds/ddsrt/heap.h"
 #include "dds/ddsrt/sync.h"
-#include "dds/util/ut_hopscotch.h"
+#include "dds/ddsrt/hopscotch.h"
 
 #define HH_HOP_RANGE 32
 #define HH_ADD_RANGE 64
@@ -27,45 +27,45 @@
 #define N_BACKING_LOCKS 32
 #define N_RESIZE_LOCKS 8
 
-struct ut_chhBucket {
+struct ddsrt_chh_bucket {
     ddsrt_atomic_uint32_t hopinfo;
     ddsrt_atomic_uint32_t timestamp;
     ddsrt_atomic_uint32_t lock;
     ddsrt_atomic_voidp_t data;
 };
 
-struct ut_chhBucketArray {
+struct ddsrt_chh_bucket_array {
     uint32_t size; /* power of 2 */
-    struct ut_chhBucket bs[];
+    struct ddsrt_chh_bucket bs[];
 };
 
-struct ut_chhBackingLock {
+struct ddsrt_chh_backing_lock {
     ddsrt_mutex_t lock;
     ddsrt_cond_t cv;
 };
 
-struct ut_chh {
-    ddsrt_atomic_voidp_t buckets; /* struct ut_chhBucketArray * */
-    struct ut_chhBackingLock backingLocks[N_BACKING_LOCKS];
-    ut_hhHash_fn hash;
-    ut_hhEquals_fn equals;
+struct ddsrt_chh {
+    ddsrt_atomic_voidp_t buckets; /* struct ddsrt_chh_bucket_array * */
+    struct ddsrt_chh_backing_lock backingLocks[N_BACKING_LOCKS];
+    ddsrt_hh_hash_fn hash;
+    ddsrt_hh_equals_fn equals;
     ddsrt_rwlock_t resize_locks[N_RESIZE_LOCKS];
-    ut_hhBucketsGc_fn gc_buckets;
+    ddsrt_hh_buckets_gc_fn gc_buckets;
 };
 
 #define CHH_MAX_TRIES 4
 #define CHH_BUSY ((void *) 1)
 
-static int ut_chhDataValid_p (void *data)
+static int ddsrt_chh_data_valid_p (void *data)
 {
     return data != NULL && data != CHH_BUSY;
 }
 
-static int ut_chhInit (struct ut_chh *rt, uint32_t init_size, ut_hhHash_fn hash, ut_hhEquals_fn equals, ut_hhBucketsGc_fn gc_buckets)
+static int ddsrt_chh_init (struct ddsrt_chh *rt, uint32_t init_size, ddsrt_hh_hash_fn hash, ddsrt_hh_equals_fn equals, ddsrt_hh_buckets_gc_fn gc_buckets)
 {
     uint32_t size;
     uint32_t i;
-    struct ut_chhBucketArray *buckets;
+    struct ddsrt_chh_bucket_array *buckets;
 
     size = HH_HOP_RANGE;
     while (size < init_size) {
@@ -75,11 +75,11 @@ static int ut_chhInit (struct ut_chh *rt, uint32_t init_size, ut_hhHash_fn hash,
     rt->equals = equals;
     rt->gc_buckets = gc_buckets;
 
-    buckets = ddsrt_malloc (offsetof (struct ut_chhBucketArray, bs) + size * sizeof (*buckets->bs));
+    buckets = ddsrt_malloc (offsetof (struct ddsrt_chh_bucket_array, bs) + size * sizeof (*buckets->bs));
     ddsrt_atomic_stvoidp (&rt->buckets, buckets);
     buckets->size = size;
     for (i = 0; i < size; i++) {
-        struct ut_chhBucket *b = &buckets->bs[i];
+        struct ddsrt_chh_bucket *b = &buckets->bs[i];
         ddsrt_atomic_st32 (&b->hopinfo, 0);
         ddsrt_atomic_st32 (&b->timestamp, 0);
         ddsrt_atomic_st32 (&b->lock, 0);
@@ -87,7 +87,7 @@ static int ut_chhInit (struct ut_chh *rt, uint32_t init_size, ut_hhHash_fn hash,
     }
 
     for (i = 0; i < N_BACKING_LOCKS; i++) {
-        struct ut_chhBackingLock *s = &rt->backingLocks[i];
+        struct ddsrt_chh_backing_lock *s = &rt->backingLocks[i];
         ddsrt_mutex_init (&s->lock);
         ddsrt_cond_init (&s->cv);
     }
@@ -97,12 +97,12 @@ static int ut_chhInit (struct ut_chh *rt, uint32_t init_size, ut_hhHash_fn hash,
     return 0;
 }
 
-static void ut_chhFini (struct ut_chh *rt)
+static void ddsrt_chh_fini (struct ddsrt_chh *rt)
 {
     int i;
     ddsrt_free (ddsrt_atomic_ldvoidp (&rt->buckets));
     for (i = 0; i < N_BACKING_LOCKS; i++) {
-        struct ut_chhBackingLock *s = &rt->backingLocks[i];
+        struct ddsrt_chh_backing_lock *s = &rt->backingLocks[i];
         ddsrt_cond_destroy (&s->cv);
         ddsrt_mutex_destroy (&s->lock);
     }
@@ -111,10 +111,10 @@ static void ut_chhFini (struct ut_chh *rt)
     }
 }
 
-struct ut_chh *ut_chhNew (uint32_t init_size, ut_hhHash_fn hash, ut_hhEquals_fn equals, ut_hhBucketsGc_fn gc_buckets)
+struct ddsrt_chh *ddsrt_chh_new (uint32_t init_size, ddsrt_hh_hash_fn hash, ddsrt_hh_equals_fn equals, ddsrt_hh_buckets_gc_fn gc_buckets)
 {
-    struct ut_chh *hh = ddsrt_malloc (sizeof (*hh));
-    if (ut_chhInit (hh, init_size, hash, equals, gc_buckets) < 0) {
+    struct ddsrt_chh *hh = ddsrt_malloc (sizeof (*hh));
+    if (ddsrt_chh_init (hh, init_size, hash, equals, gc_buckets) < 0) {
         ddsrt_free (hh);
         return NULL;
     } else {
@@ -122,22 +122,22 @@ struct ut_chh *ut_chhNew (uint32_t init_size, ut_hhHash_fn hash, ut_hhEquals_fn
     }
 }
 
-void ut_chhFree (struct ut_chh * UT_HH_RESTRICT hh)
+void ddsrt_chh_free (struct ddsrt_chh * __restrict hh)
 {
-    ut_chhFini (hh);
+    ddsrt_chh_fini (hh);
     ddsrt_free (hh);
 }
 
 #define LOCKBIT ((uint32_t)1 << 31)
 
-static void ut_chhLockBucket (struct ut_chh *rt, uint32_t bidx)
+static void ddsrt_chh_lock_bucket (struct ddsrt_chh *rt, uint32_t bidx)
 {
     /* Lock: MSB <=> LOCKBIT, LSBs <=> wait count; note that
        (o&LOCKBIT)==0 means a thread can sneak in when there are
        already waiters, changing it to o==0 would avoid that. */
-    struct ut_chhBucketArray * const bsary = ddsrt_atomic_ldvoidp (&rt->buckets);
-    struct ut_chhBucket * const b = &bsary->bs[bidx];
-    struct ut_chhBackingLock * const s = &rt->backingLocks[bidx % N_BACKING_LOCKS];
+    struct ddsrt_chh_bucket_array * const bsary = ddsrt_atomic_ldvoidp (&rt->buckets);
+    struct ddsrt_chh_bucket * const b = &bsary->bs[bidx];
+    struct ddsrt_chh_backing_lock * const s = &rt->backingLocks[bidx % N_BACKING_LOCKS];
     uint32_t o, n;
  fastpath_retry:
     o = ddsrt_atomic_ld32 (&b->lock);
@@ -162,11 +162,11 @@ static void ut_chhLockBucket (struct ut_chh *rt, uint32_t bidx)
     }
 }
 
-static void ut_chhUnlockBucket (struct ut_chh *rt, uint32_t bidx)
+static void ddsrt_chh_unlock_bucket (struct ddsrt_chh *rt, uint32_t bidx)
 {
-    struct ut_chhBucketArray * const bsary = ddsrt_atomic_ldvoidp (&rt->buckets);
-    struct ut_chhBucket * const b = &bsary->bs[bidx];
-    struct ut_chhBackingLock * const s = &rt->backingLocks[bidx % N_BACKING_LOCKS];
+    struct ddsrt_chh_bucket_array * const bsary = ddsrt_atomic_ldvoidp (&rt->buckets);
+    struct ddsrt_chh_bucket * const b = &bsary->bs[bidx];
+    struct ddsrt_chh_backing_lock * const s = &rt->backingLocks[bidx % N_BACKING_LOCKS];
     uint32_t o, n;
  retry:
     o = ddsrt_atomic_ld32 (&b->lock);
@@ -190,9 +190,9 @@ static void ut_chhUnlockBucket (struct ut_chh *rt, uint32_t bidx)
     }
 }
 
-static void *ut_chhLookupInternal (struct ut_chhBucketArray const * const bsary, ut_hhEquals_fn equals, const uint32_t bucket, const void *template)
+static void *ddsrt_chh_lookup_internal (struct ddsrt_chh_bucket_array const * const bsary, ddsrt_hh_equals_fn equals, const uint32_t bucket, const void *template)
 {
-    struct ut_chhBucket const * const bs = bsary->bs;
+    struct ddsrt_chh_bucket const * const bs = bsary->bs;
     const uint32_t idxmask = bsary->size - 1;
     uint32_t timestamp;
     int try_counter = 0;
@@ -205,7 +205,7 @@ static void *ut_chhLookupInternal (struct ut_chhBucketArray const * const bsary,
         for (idx = 0; hopinfo != 0; hopinfo >>= 1, idx++) {
             const uint32_t bidx = (bucket + idx) & idxmask;
             void *data = ddsrt_atomic_ldvoidp (&bs[bidx].data);
-            if (ut_chhDataValid_p (data) && equals (data, template)) {
+            if (ddsrt_chh_data_valid_p (data) && equals (data, template)) {
                 return data;
             }
         }
@@ -218,7 +218,7 @@ static void *ut_chhLookupInternal (struct ut_chhBucketArray const * const bsary,
         for (idx = 0; idx < HH_HOP_RANGE; idx++) {
             const uint32_t bidx = (bucket + idx) & idxmask;
             void *data = ddsrt_atomic_ldvoidp (&bs[bidx].data);
-            if (ut_chhDataValid_p (data) && equals (data, template)) {
+            if (ddsrt_chh_data_valid_p (data) && equals (data, template)) {
                 return data;
             }
         }
@@ -232,19 +232,19 @@ static void *ut_chhLookupInternal (struct ut_chhBucketArray const * const bsary,
         ddsrt_atomic_st32 (var__, (expr_));                                  \
     } while (0)
 
-void *ut_chhLookup (struct ut_chh * UT_HH_RESTRICT rt, const void * UT_HH_RESTRICT template)
+void *ddsrt_chh_lookup (struct ddsrt_chh * __restrict rt, const void * __restrict template)
 {
-    struct ut_chhBucketArray const * const bsary = ddsrt_atomic_ldvoidp (&rt->buckets);
+    struct ddsrt_chh_bucket_array const * const bsary = ddsrt_atomic_ldvoidp (&rt->buckets);
     const uint32_t hash = rt->hash (template);
     const uint32_t idxmask = bsary->size - 1;
     const uint32_t bucket = hash & idxmask;
-    return ut_chhLookupInternal (bsary, rt->equals, bucket, template);
+    return ddsrt_chh_lookup_internal (bsary, rt->equals, bucket, template);
 }
 
-static uint32_t ut_chhFindCloserFreeBucket (struct ut_chh *rt, uint32_t free_bucket, uint32_t *free_distance)
+static uint32_t ddsrt_chh_find_closer_free_bucket (struct ddsrt_chh *rt, uint32_t free_bucket, uint32_t *free_distance)
 {
-    struct ut_chhBucketArray * const bsary = ddsrt_atomic_ldvoidp (&rt->buckets);
-    struct ut_chhBucket * const bs = bsary->bs;
+    struct ddsrt_chh_bucket_array * const bsary = ddsrt_atomic_ldvoidp (&rt->buckets);
+    struct ddsrt_chh_bucket * const bs = bsary->bs;
     const uint32_t idxmask = bsary->size - 1;
     uint32_t move_bucket, free_dist;
     move_bucket = (free_bucket - (HH_HOP_RANGE - 1)) & idxmask;
@@ -260,7 +260,7 @@ static uint32_t ut_chhFindCloserFreeBucket (struct ut_chh *rt, uint32_t free_buc
             }
         }
         if (move_free_distance != NOT_A_BUCKET) {
-            ut_chhLockBucket (rt, move_bucket);
+            ddsrt_chh_lock_bucket (rt, move_bucket);
             if (start_hop_info == ddsrt_atomic_ld32 (&bs[move_bucket].hopinfo))
             {
                 uint32_t new_free_bucket = (move_bucket + move_free_distance) & idxmask;
@@ -272,31 +272,31 @@ static uint32_t ut_chhFindCloserFreeBucket (struct ut_chh *rt, uint32_t free_buc
                 ddsrt_atomic_rmw32_nonatomic (&bs[move_bucket].hopinfo, x, x & ~(1u << move_free_distance));
 
                 *free_distance -= free_dist - move_free_distance;
-                ut_chhUnlockBucket (rt, move_bucket);
+                ddsrt_chh_unlock_bucket (rt, move_bucket);
                 return new_free_bucket;
             }
-            ut_chhUnlockBucket (rt, move_bucket);
+            ddsrt_chh_unlock_bucket (rt, move_bucket);
         }
         move_bucket = (move_bucket + 1) & idxmask;
     }
     return NOT_A_BUCKET;
 }
 
-static void ut_chhResize (struct ut_chh *rt)
+static void ddsrt_chh_resize (struct ddsrt_chh *rt)
 {
     /* doubles the size => bucket index gains one bit at the msb =>
        start bucket is unchanged or moved into the added half of the set
        => those for which the (new) msb is 0 are guaranteed to fit, and
        so are those for which the (new) msb is 1 => never have to resize
        recursively */
-    struct ut_chhBucketArray * const bsary0 = ddsrt_atomic_ldvoidp (&rt->buckets);
-    struct ut_chhBucket * const bs0 = bsary0->bs;
-    struct ut_chhBucketArray *bsary1;
-    struct ut_chhBucket *bs1;
+    struct ddsrt_chh_bucket_array * const bsary0 = ddsrt_atomic_ldvoidp (&rt->buckets);
+    struct ddsrt_chh_bucket * const bs0 = bsary0->bs;
+    struct ddsrt_chh_bucket_array *bsary1;
+    struct ddsrt_chh_bucket *bs1;
     uint32_t i, idxmask0, idxmask1;
 
     assert (bsary0->size > 0);
-    bsary1 = ddsrt_malloc (offsetof (struct ut_chhBucketArray, bs) + 2 * bsary0->size * sizeof (*bsary1->bs));
+    bsary1 = ddsrt_malloc (offsetof (struct ddsrt_chh_bucket_array, bs) + 2 * bsary0->size * sizeof (*bsary1->bs));
     bsary1->size = 2 * bsary0->size;
     bs1 = bsary1->bs;
 
@@ -327,15 +327,15 @@ static void ut_chhResize (struct ut_chh *rt)
     rt->gc_buckets (bsary0);
 }
 
-int ut_chhAdd (struct ut_chh * UT_HH_RESTRICT rt, const void * UT_HH_RESTRICT data)
+int ddsrt_chh_add (struct ddsrt_chh * __restrict rt, const void * __restrict data)
 {
     const uint32_t hash = rt->hash (data);
     uint32_t size;
     ddsrt_rwlock_read (&rt->resize_locks[hash % N_RESIZE_LOCKS]);
 
     {
-        struct ut_chhBucketArray * const bsary = ddsrt_atomic_ldvoidp (&rt->buckets);
-        struct ut_chhBucket * const bs = bsary->bs;
+        struct ddsrt_chh_bucket_array * const bsary = ddsrt_atomic_ldvoidp (&rt->buckets);
+        struct ddsrt_chh_bucket * const bs = bsary->bs;
         uint32_t idxmask;
         uint32_t start_bucket, free_distance, free_bucket;
 
@@ -343,9 +343,9 @@ int ut_chhAdd (struct ut_chh * UT_HH_RESTRICT rt, const void * UT_HH_RESTRICT da
         idxmask = size - 1;
         start_bucket = hash & idxmask;
 
-        ut_chhLockBucket (rt, start_bucket);
-        if (ut_chhLookupInternal (bsary, rt->equals, start_bucket, data)) {
-            ut_chhUnlockBucket (rt, start_bucket);
+        ddsrt_chh_lock_bucket (rt, start_bucket);
+        if (ddsrt_chh_lookup_internal (bsary, rt->equals, start_bucket, data)) {
+            ddsrt_chh_unlock_bucket (rt, start_bucket);
             ddsrt_rwlock_unlock (&rt->resize_locks[hash % N_RESIZE_LOCKS]);
             return 0;
         }
@@ -365,77 +365,77 @@ int ut_chhAdd (struct ut_chh * UT_HH_RESTRICT rt, const void * UT_HH_RESTRICT da
                     ddsrt_atomic_rmw32_nonatomic (&bs[start_bucket].hopinfo, x, x | (1u << free_distance));
                     ddsrt_atomic_fence ();
                     ddsrt_atomic_stvoidp (&bs[free_bucket].data, (void *) data);
-                    ut_chhUnlockBucket (rt, start_bucket);
+                    ddsrt_chh_unlock_bucket (rt, start_bucket);
                     ddsrt_rwlock_unlock (&rt->resize_locks[hash % N_RESIZE_LOCKS]);
                     return 1;
                 }
-                free_bucket = ut_chhFindCloserFreeBucket (rt, free_bucket, &free_distance);
+                free_bucket = ddsrt_chh_find_closer_free_bucket (rt, free_bucket, &free_distance);
                 assert (free_bucket == NOT_A_BUCKET || free_bucket <= idxmask);
             } while (free_bucket != NOT_A_BUCKET);
         }
-        ut_chhUnlockBucket (rt, start_bucket);
+        ddsrt_chh_unlock_bucket (rt, start_bucket);
     }
 
     ddsrt_rwlock_unlock (&rt->resize_locks[hash % N_RESIZE_LOCKS]);
 
     {
         int i;
-        struct ut_chhBucketArray *bsary1;
+        struct ddsrt_chh_bucket_array *bsary1;
         for (i = 0; i < N_RESIZE_LOCKS; i++) {
             ddsrt_rwlock_write (&rt->resize_locks[i]);
         }
         /* another thread may have sneaked past and grown the hash table */
         bsary1 = ddsrt_atomic_ldvoidp (&rt->buckets);
         if (bsary1->size == size) {
-            ut_chhResize (rt);
+            ddsrt_chh_resize (rt);
         }
         for (i = 0; i < N_RESIZE_LOCKS; i++) {
             ddsrt_rwlock_unlock (&rt->resize_locks[i]);
         }
     }
 
-    return ut_chhAdd (rt, data);
+    return ddsrt_chh_add (rt, data);
 }
 
-int ut_chhRemove (struct ut_chh * UT_HH_RESTRICT rt, const void * UT_HH_RESTRICT template)
+int ddsrt_chh_remove (struct ddsrt_chh * __restrict rt, const void * __restrict template)
 {
     const uint32_t hash = rt->hash (template);
     ddsrt_rwlock_read (&rt->resize_locks[hash % N_RESIZE_LOCKS]);
 
     {
-        struct ut_chhBucketArray * const bsary = ddsrt_atomic_ldvoidp (&rt->buckets);
-        struct ut_chhBucket * const bs = bsary->bs;
+        struct ddsrt_chh_bucket_array * const bsary = ddsrt_atomic_ldvoidp (&rt->buckets);
+        struct ddsrt_chh_bucket * const bs = bsary->bs;
         const uint32_t size = bsary->size;
         const uint32_t idxmask = size - 1;
         const uint32_t bucket = hash & idxmask;
         uint32_t hopinfo;
         uint32_t idx;
-        ut_chhLockBucket (rt, bucket);
+        ddsrt_chh_lock_bucket (rt, bucket);
         hopinfo = ddsrt_atomic_ld32 (&bs[bucket].hopinfo);
         for (idx = 0; hopinfo != 0; hopinfo >>= 1, idx++) {
             if (hopinfo & 1) {
                 const uint32_t bidx = (bucket + idx) & idxmask;
                 void *data = ddsrt_atomic_ldvoidp (&bs[bidx].data);
-                if (ut_chhDataValid_p (data) && rt->equals (data, template)) {
+                if (ddsrt_chh_data_valid_p (data) && rt->equals (data, template)) {
                     ddsrt_atomic_stvoidp (&bs[bidx].data, NULL);
                     ddsrt_atomic_rmw32_nonatomic (&bs[bucket].hopinfo, x, x & ~(1u << idx));
-                    ut_chhUnlockBucket (rt, bucket);
+                    ddsrt_chh_unlock_bucket (rt, bucket);
                     ddsrt_rwlock_unlock (&rt->resize_locks[hash % N_RESIZE_LOCKS]);
                     return 1;
                 }
             }
         }
-        ut_chhUnlockBucket (rt, bucket);
+        ddsrt_chh_unlock_bucket (rt, bucket);
     }
 
     ddsrt_rwlock_unlock (&rt->resize_locks[hash % N_RESIZE_LOCKS]);
     return 0;
 }
 
-void ut_chhEnumUnsafe (struct ut_chh * UT_HH_RESTRICT rt, void (*f) (void *a, void *f_arg), void *f_arg)
+void ddsrt_chh_enum_unsafe (struct ddsrt_chh * __restrict rt, void (*f) (void *a, void *f_arg), void *f_arg)
 {
-    struct ut_chhBucketArray * const bsary = ddsrt_atomic_ldvoidp (&rt->buckets);
-    struct ut_chhBucket * const bs = bsary->bs;
+    struct ddsrt_chh_bucket_array * const bsary = ddsrt_atomic_ldvoidp (&rt->buckets);
+    struct ddsrt_chh_bucket * const bs = bsary->bs;
     uint32_t i;
     for (i = 0; i < bsary->size; i++) {
         void *data = ddsrt_atomic_ldvoidp (&bs[i].data);
@@ -445,7 +445,7 @@ void ut_chhEnumUnsafe (struct ut_chh * UT_HH_RESTRICT rt, void (*f) (void *a, vo
     }
 }
 
-void *ut_chhIterNext (struct ut_chhIter *it)
+void *ddsrt_chh_iter_next (struct ddsrt_chh_iter *it)
 {
   uint32_t i;
   for (i = it->cursor; i < it->size; i++) {
@@ -458,30 +458,30 @@ void *ut_chhIterNext (struct ut_chhIter *it)
   return NULL;
 }
 
-void *ut_chhIterFirst (struct ut_chh * UT_HH_RESTRICT rt, struct ut_chhIter *it)
+void *ddsrt_chh_iter_first (struct ddsrt_chh * __restrict rt, struct ddsrt_chh_iter *it)
 {
-  struct ut_chhBucketArray * const bsary = ddsrt_atomic_ldvoidp (&rt->buckets);
+  struct ddsrt_chh_bucket_array * const bsary = ddsrt_atomic_ldvoidp (&rt->buckets);
   it->bs = bsary->bs;
   it->size = bsary->size;
   it->cursor = 0;
-  return ut_chhIterNext (it);
+  return ddsrt_chh_iter_next (it);
 }
 
 /************* SEQUENTIAL VERSION ***************/
 
-struct ut_hhBucket {
+struct ddsrt_hh_bucket {
     uint32_t hopinfo;
     void *data;
 };
 
-struct ut_hh {
+struct ddsrt_hh {
     uint32_t size; /* power of 2 */
-    struct ut_hhBucket *buckets;
-    ut_hhHash_fn hash;
-    ut_hhEquals_fn equals;
+    struct ddsrt_hh_bucket *buckets;
+    ddsrt_hh_hash_fn hash;
+    ddsrt_hh_equals_fn equals;
 };
 
-static void ut_hhInit (struct ut_hh *rt, uint32_t init_size, ut_hhHash_fn hash, ut_hhEquals_fn equals)
+static void ddsrt_hh_init (struct ddsrt_hh *rt, uint32_t init_size, ddsrt_hh_hash_fn hash, ddsrt_hh_equals_fn equals)
 {
     uint32_t size = HH_HOP_RANGE;
     uint32_t i;
@@ -498,25 +498,25 @@ static void ut_hhInit (struct ut_hh *rt, uint32_t init_size, ut_hhHash_fn hash,
     }
 }
 
-static void ut_hhFini (struct ut_hh *rt)
+static void ddsrt_hh_fini (struct ddsrt_hh *rt)
 {
     ddsrt_free (rt->buckets);
 }
 
-struct ut_hh *ut_hhNew (uint32_t init_size, ut_hhHash_fn hash, ut_hhEquals_fn equals)
+struct ddsrt_hh *ddsrt_hh_new (uint32_t init_size, ddsrt_hh_hash_fn hash, ddsrt_hh_equals_fn equals)
 {
-    struct ut_hh *hh = ddsrt_malloc (sizeof (*hh));
-    ut_hhInit (hh, init_size, hash, equals);
+    struct ddsrt_hh *hh = ddsrt_malloc (sizeof (*hh));
+    ddsrt_hh_init (hh, init_size, hash, equals);
     return hh;
 }
 
-void ut_hhFree (struct ut_hh * UT_HH_RESTRICT hh)
+void ddsrt_hh_free (struct ddsrt_hh * __restrict hh)
 {
-    ut_hhFini (hh);
+    ddsrt_hh_fini (hh);
     ddsrt_free (hh);
 }
 
-static void *ut_hhLookupInternal (const struct ut_hh *rt, const uint32_t bucket, const void *template)
+static void *ddsrt_hh_lookup_internal (const struct ddsrt_hh *rt, const uint32_t bucket, const void *template)
 {
     const uint32_t idxmask = rt->size - 1;
     uint32_t hopinfo = rt->buckets[bucket].hopinfo;
@@ -530,15 +530,15 @@ static void *ut_hhLookupInternal (const struct ut_hh *rt, const uint32_t bucket,
     return NULL;
 }
 
-void *ut_hhLookup (const struct ut_hh * UT_HH_RESTRICT rt, const void * UT_HH_RESTRICT template)
+void *ddsrt_hh_lookup (const struct ddsrt_hh * __restrict rt, const void * __restrict template)
 {
     const uint32_t hash = rt->hash (template);
     const uint32_t idxmask = rt->size - 1;
     const uint32_t bucket = hash & idxmask;
-    return ut_hhLookupInternal (rt, bucket, template);
+    return ddsrt_hh_lookup_internal (rt, bucket, template);
 }
 
-static uint32_t ut_hhFindCloserFreeBucket (struct ut_hh *rt, uint32_t free_bucket, uint32_t *free_distance)
+static uint32_t ddsrt_hh_find_closer_free_bucket (struct ddsrt_hh *rt, uint32_t free_bucket, uint32_t *free_distance)
 {
     const uint32_t idxmask = rt->size - 1;
     uint32_t move_bucket, free_dist;
@@ -567,9 +567,9 @@ static uint32_t ut_hhFindCloserFreeBucket (struct ut_hh *rt, uint32_t free_bucke
     return NOT_A_BUCKET;
 }
 
-static void ut_hhResize (struct ut_hh *rt)
+static void ddsrt_hh_resize (struct ddsrt_hh *rt)
 {
-    struct ut_hhBucket *bs1;
+    struct ddsrt_hh_bucket *bs1;
     uint32_t i, idxmask0, idxmask1;
 
     bs1 = ddsrt_malloc (2 * rt->size * sizeof (*rt->buckets));
@@ -599,14 +599,14 @@ static void ut_hhResize (struct ut_hh *rt)
     rt->buckets = bs1;
 }
 
-int ut_hhAdd (struct ut_hh * UT_HH_RESTRICT rt, const void * UT_HH_RESTRICT data)
+int ddsrt_hh_add (struct ddsrt_hh * __restrict rt, const void * __restrict data)
 {
     const uint32_t hash = rt->hash (data);
     const uint32_t idxmask = rt->size - 1;
     const uint32_t start_bucket = hash & idxmask;
     uint32_t free_distance, free_bucket;
 
-    if (ut_hhLookupInternal (rt, start_bucket, data)) {
+    if (ddsrt_hh_lookup_internal (rt, start_bucket, data)) {
         return 0;
     }
 
@@ -624,16 +624,16 @@ int ut_hhAdd (struct ut_hh * UT_HH_RESTRICT rt, const void * UT_HH_RESTRICT data
                 rt->buckets[free_bucket].data = (void *) data;
                 return 1;
             }
-            free_bucket = ut_hhFindCloserFreeBucket (rt, free_bucket, &free_distance);
+            free_bucket = ddsrt_hh_find_closer_free_bucket (rt, free_bucket, &free_distance);
             assert (free_bucket == NOT_A_BUCKET || free_bucket <= idxmask);
         } while (free_bucket != NOT_A_BUCKET);
     }
 
-    ut_hhResize (rt);
-    return ut_hhAdd (rt, data);
+    ddsrt_hh_resize (rt);
+    return ddsrt_hh_add (rt, data);
 }
 
-int ut_hhRemove (struct ut_hh * UT_HH_RESTRICT rt, const void * UT_HH_RESTRICT template)
+int ddsrt_hh_remove (struct ddsrt_hh * __restrict rt, const void * __restrict template)
 {
     const uint32_t hash = rt->hash (template);
     const uint32_t idxmask = rt->size - 1;
@@ -655,7 +655,7 @@ int ut_hhRemove (struct ut_hh * UT_HH_RESTRICT rt, const void * UT_HH_RESTRICT t
     return 0;
 }
 
-void ut_hhEnum (struct ut_hh * UT_HH_RESTRICT rt, void (*f) (void *a, void *f_arg), void *f_arg)
+void ddsrt_hh_enum (struct ddsrt_hh * __restrict rt, void (*f) (void *a, void *f_arg), void *f_arg)
 {
     uint32_t i;
     for (i = 0; i < rt->size; i++) {
@@ -666,16 +666,16 @@ void ut_hhEnum (struct ut_hh * UT_HH_RESTRICT rt, void (*f) (void *a, void *f_ar
     }
 }
 
-void *ut_hhIterFirst (struct ut_hh * UT_HH_RESTRICT rt, struct ut_hhIter * UT_HH_RESTRICT iter)
+void *ddsrt_hh_iter_first (struct ddsrt_hh * __restrict rt, struct ddsrt_hh_iter * __restrict iter)
 {
     iter->hh = rt;
     iter->cursor = 0;
-    return ut_hhIterNext (iter);
+    return ddsrt_hh_iter_next (iter);
 }
 
-void *ut_hhIterNext (struct ut_hhIter * UT_HH_RESTRICT iter)
+void *ddsrt_hh_iter_next (struct ddsrt_hh_iter * __restrict iter)
 {
-    struct ut_hh *rt = iter->hh;
+    struct ddsrt_hh *rt = iter->hh;
     while (iter->cursor < rt->size) {
         void *data = rt->buckets[iter->cursor].data;
         iter->cursor++;
@@ -688,22 +688,22 @@ void *ut_hhIterNext (struct ut_hhIter * UT_HH_RESTRICT iter)
 
 /************* SEQUENTIAL VERSION WITH EMBEDDED DATA ***************/
 
-struct ut_ehhBucket {
+struct ddsrt_ehh_bucket {
     uint32_t hopinfo;
     uint32_t inuse;
     char data[];
 };
 
-struct ut_ehh {
+struct ddsrt_ehh {
     uint32_t size; /* power of 2 */
     size_t elemsz;
     size_t bucketsz;
     char *buckets; /* ehhBucket, but embedded data messes up the layout */
-    ut_hhHash_fn hash;
-    ut_hhEquals_fn equals;
+    ddsrt_hh_hash_fn hash;
+    ddsrt_hh_equals_fn equals;
 };
 
-static void ut_ehhInit (struct ut_ehh *rt, size_t elemsz, uint32_t init_size, ut_hhHash_fn hash, ut_hhEquals_fn equals)
+static void ddsrt_ehh_init (struct ddsrt_ehh *rt, size_t elemsz, uint32_t init_size, ddsrt_hh_hash_fn hash, ddsrt_hh_equals_fn equals)
 {
     uint32_t size = HH_HOP_RANGE;
     uint32_t i;
@@ -714,36 +714,36 @@ static void ut_ehhInit (struct ut_ehh *rt, size_t elemsz, uint32_t init_size, ut
     rt->equals = equals;
     rt->size = size;
     rt->elemsz = elemsz;
-    rt->bucketsz = sizeof (struct ut_ehhBucket) + ((elemsz+7) & ~(size_t)7);
+    rt->bucketsz = sizeof (struct ddsrt_ehh_bucket) + ((elemsz+7) & ~(size_t)7);
     rt->buckets = ddsrt_malloc (size * rt->bucketsz);
     for (i = 0; i < size; i++) {
-        struct ut_ehhBucket *b = (struct ut_ehhBucket *) (rt->buckets + i * rt->bucketsz);
+        struct ddsrt_ehh_bucket *b = (struct ddsrt_ehh_bucket *) (rt->buckets + i * rt->bucketsz);
         b->hopinfo = 0;
         b->inuse = 0;
     }
 }
 
-static void ut_ehhFini (struct ut_ehh *rt)
+static void ddsrt_ehh_fini (struct ddsrt_ehh *rt)
 {
     ddsrt_free (rt->buckets);
 }
 
-struct ut_ehh *ut_ehhNew (size_t elemsz, uint32_t init_size, ut_hhHash_fn hash, ut_hhEquals_fn equals)
+struct ddsrt_ehh *ddsrt_ehh_new (size_t elemsz, uint32_t init_size, ddsrt_hh_hash_fn hash, ddsrt_hh_equals_fn equals)
 {
-    struct ut_ehh *hh = ddsrt_malloc (sizeof (*hh));
-    ut_ehhInit (hh, elemsz, init_size, hash, equals);
+    struct ddsrt_ehh *hh = ddsrt_malloc (sizeof (*hh));
+    ddsrt_ehh_init (hh, elemsz, init_size, hash, equals);
     return hh;
 }
 
-void ut_ehhFree (struct ut_ehh * UT_HH_RESTRICT hh)
+void ddsrt_ehh_free (struct ddsrt_ehh * __restrict hh)
 {
-    ut_ehhFini (hh);
+    ddsrt_ehh_fini (hh);
     ddsrt_free (hh);
 }
 
-static void *ut_ehhLookupInternal (const struct ut_ehh *rt, uint32_t bucket, const void *template)
+static void *ddsrt_ehh_lookup_internal (const struct ddsrt_ehh *rt, uint32_t bucket, const void *template)
 {
-    const struct ut_ehhBucket *b = (const struct ut_ehhBucket *) (rt->buckets + bucket * rt->bucketsz);
+    const struct ddsrt_ehh_bucket *b = (const struct ddsrt_ehh_bucket *) (rt->buckets + bucket * rt->bucketsz);
     uint32_t hopinfo = b->hopinfo;
 
     if (hopinfo & 1) {
@@ -758,7 +758,7 @@ static void *ut_ehhLookupInternal (const struct ut_ehh *rt, uint32_t bucket, con
             bucket = 0;
         }
         if (hopinfo & 1) {
-            b = (const struct ut_ehhBucket *) (rt->buckets + bucket * rt->bucketsz);
+            b = (const struct ddsrt_ehh_bucket *) (rt->buckets + bucket * rt->bucketsz);
             if (b->inuse && rt->equals (b->data, template)) {
                 return (void *) b->data;
             }
@@ -767,21 +767,21 @@ static void *ut_ehhLookupInternal (const struct ut_ehh *rt, uint32_t bucket, con
     return NULL;
 }
 
-void *ut_ehhLookup (const struct ut_ehh * UT_HH_RESTRICT rt, const void * UT_HH_RESTRICT template)
+void *ddsrt_ehh_lookup (const struct ddsrt_ehh * __restrict rt, const void * __restrict template)
 {
     const uint32_t hash = rt->hash (template);
     const uint32_t idxmask = rt->size - 1;
     const uint32_t bucket = hash & idxmask;
-    return ut_ehhLookupInternal (rt, bucket, template);
+    return ddsrt_ehh_lookup_internal (rt, bucket, template);
 }
 
-static uint32_t ut_ehhFindCloserFreeBucket (struct ut_ehh *rt, uint32_t free_bucket, uint32_t *free_distance)
+static uint32_t ddsrt_ehh_find_closer_free_bucket (struct ddsrt_ehh *rt, uint32_t free_bucket, uint32_t *free_distance)
 {
     const uint32_t idxmask = rt->size - 1;
     uint32_t move_bucket, free_dist;
     move_bucket = (free_bucket - (HH_HOP_RANGE - 1)) & idxmask;
     for (free_dist = HH_HOP_RANGE - 1; free_dist > 0; free_dist--) {
-        struct ut_ehhBucket * const mb = (struct ut_ehhBucket *) (rt->buckets + move_bucket * rt->bucketsz);
+        struct ddsrt_ehh_bucket * const mb = (struct ddsrt_ehh_bucket *) (rt->buckets + move_bucket * rt->bucketsz);
         uint32_t move_free_distance = NOT_A_BUCKET;
         uint32_t mask = 1;
         uint32_t i;
@@ -793,8 +793,8 @@ static uint32_t ut_ehhFindCloserFreeBucket (struct ut_ehh *rt, uint32_t free_buc
         }
         if (move_free_distance != NOT_A_BUCKET) {
             uint32_t new_free_bucket = (move_bucket + move_free_distance) & idxmask;
-            struct ut_ehhBucket * const fb = (struct ut_ehhBucket *) (rt->buckets + free_bucket * rt->bucketsz);
-            struct ut_ehhBucket * const nfb = (struct ut_ehhBucket *) (rt->buckets + new_free_bucket * rt->bucketsz);
+            struct ddsrt_ehh_bucket * const fb = (struct ddsrt_ehh_bucket *) (rt->buckets + free_bucket * rt->bucketsz);
+            struct ddsrt_ehh_bucket * const nfb = (struct ddsrt_ehh_bucket *) (rt->buckets + new_free_bucket * rt->bucketsz);
             mb->hopinfo |= 1u << free_dist;
             fb->inuse = 1;
             memcpy (fb->data, nfb->data, rt->elemsz);
@@ -808,7 +808,7 @@ static uint32_t ut_ehhFindCloserFreeBucket (struct ut_ehh *rt, uint32_t free_buc
     return NOT_A_BUCKET;
 }
 
-static void ut_ehhResize (struct ut_ehh *rt)
+static void ddsrt_ehh_resize (struct ddsrt_ehh *rt)
 {
     char *bs1;
     uint32_t i, idxmask0, idxmask1;
@@ -816,22 +816,22 @@ static void ut_ehhResize (struct ut_ehh *rt)
     bs1 = ddsrt_malloc (2 * rt->size * rt->bucketsz);
 
     for (i = 0; i < 2 * rt->size; i++) {
-        struct ut_ehhBucket *b = (struct ut_ehhBucket *) (bs1 + i * rt->bucketsz);
+        struct ddsrt_ehh_bucket *b = (struct ddsrt_ehh_bucket *) (bs1 + i * rt->bucketsz);
         b->hopinfo = 0;
         b->inuse = 0;
     }
     idxmask0 = rt->size - 1;
     idxmask1 = 2 * rt->size - 1;
     for (i = 0; i < rt->size; i++) {
-        struct ut_ehhBucket const * const b = (struct ut_ehhBucket *) (rt->buckets + i * rt->bucketsz);
+        struct ddsrt_ehh_bucket const * const b = (struct ddsrt_ehh_bucket *) (rt->buckets + i * rt->bucketsz);
         if (b->inuse) {
             const uint32_t hash = rt->hash (b->data);
             const uint32_t old_start_bucket = hash & idxmask0;
             const uint32_t new_start_bucket = hash & idxmask1;
             const uint32_t dist = (i >= old_start_bucket) ? (i - old_start_bucket) : (rt->size + i - old_start_bucket);
             const uint32_t newb = (new_start_bucket + dist) & idxmask1;
-            struct ut_ehhBucket * const nsb = (struct ut_ehhBucket *) (bs1 + new_start_bucket * rt->bucketsz);
-            struct ut_ehhBucket * const nb = (struct ut_ehhBucket *) (bs1 + newb * rt->bucketsz);
+            struct ddsrt_ehh_bucket * const nsb = (struct ddsrt_ehh_bucket *) (bs1 + new_start_bucket * rt->bucketsz);
+            struct ddsrt_ehh_bucket * const nb = (struct ddsrt_ehh_bucket *) (bs1 + newb * rt->bucketsz);
             assert (dist < HH_HOP_RANGE);
             assert (!nb->inuse);
             nsb->hopinfo |= 1u << dist;
@@ -845,20 +845,20 @@ static void ut_ehhResize (struct ut_ehh *rt)
     rt->buckets = bs1;
 }
 
-int ut_ehhAdd (struct ut_ehh * UT_HH_RESTRICT rt, const void * UT_HH_RESTRICT data)
+int ddsrt_ehh_add (struct ddsrt_ehh * __restrict rt, const void * __restrict data)
 {
     const uint32_t hash = rt->hash (data);
     const uint32_t idxmask = rt->size - 1;
     const uint32_t start_bucket = hash & idxmask;
     uint32_t free_distance, free_bucket;
 
-    if (ut_ehhLookupInternal (rt, start_bucket, data)) {
+    if (ddsrt_ehh_lookup_internal (rt, start_bucket, data)) {
         return 0;
     }
 
     free_bucket = start_bucket;
     for (free_distance = 0; free_distance < HH_ADD_RANGE; free_distance++) {
-        struct ut_ehhBucket const * const fb = (struct ut_ehhBucket *) (rt->buckets + free_bucket * rt->bucketsz);
+        struct ddsrt_ehh_bucket const * const fb = (struct ddsrt_ehh_bucket *) (rt->buckets + free_bucket * rt->bucketsz);
         if (!fb->inuse) {
             break;
         }
@@ -867,73 +867,73 @@ int ut_ehhAdd (struct ut_ehh * UT_HH_RESTRICT rt, const void * UT_HH_RESTRICT da
     if (free_distance < HH_ADD_RANGE) {
         do {
             if (free_distance < HH_HOP_RANGE) {
-                struct ut_ehhBucket * const sb = (struct ut_ehhBucket *) (rt->buckets + start_bucket * rt->bucketsz);
-                struct ut_ehhBucket * const fb = (struct ut_ehhBucket *) (rt->buckets + free_bucket * rt->bucketsz);
+                struct ddsrt_ehh_bucket * const sb = (struct ddsrt_ehh_bucket *) (rt->buckets + start_bucket * rt->bucketsz);
+                struct ddsrt_ehh_bucket * const fb = (struct ddsrt_ehh_bucket *) (rt->buckets + free_bucket * rt->bucketsz);
                 assert ((uint32_t) free_bucket == ((start_bucket + free_distance) & idxmask));
                 sb->hopinfo |= 1u << free_distance;
                 fb->inuse = 1;
                 memcpy (fb->data, data, rt->elemsz);
-                assert (ut_ehhLookupInternal (rt, start_bucket, data));
+                assert (ddsrt_ehh_lookup_internal (rt, start_bucket, data));
                 return 1;
             }
-            free_bucket = ut_ehhFindCloserFreeBucket (rt, free_bucket, &free_distance);
+            free_bucket = ddsrt_ehh_find_closer_free_bucket (rt, free_bucket, &free_distance);
             assert (free_bucket == NOT_A_BUCKET || free_bucket <= idxmask);
         } while (free_bucket != NOT_A_BUCKET);
     }
 
-    ut_ehhResize (rt);
-    return ut_ehhAdd (rt, data);
+    ddsrt_ehh_resize (rt);
+    return ddsrt_ehh_add (rt, data);
 }
 
-int ut_ehhRemove (struct ut_ehh * UT_HH_RESTRICT rt, const void * UT_HH_RESTRICT template)
+int ddsrt_ehh_remove (struct ddsrt_ehh * __restrict rt, const void * __restrict template)
 {
     const uint32_t hash = rt->hash (template);
     const uint32_t idxmask = rt->size - 1;
     const uint32_t bucket = hash & idxmask;
     uint32_t hopinfo;
-    struct ut_ehhBucket *sb;
+    struct ddsrt_ehh_bucket *sb;
     uint32_t idx;
-    sb = (struct ut_ehhBucket *) (rt->buckets + bucket * rt->bucketsz);
+    sb = (struct ddsrt_ehh_bucket *) (rt->buckets + bucket * rt->bucketsz);
     hopinfo = sb->hopinfo;
     for (idx = 0; hopinfo != 0; hopinfo >>= 1, idx++) {
         if (hopinfo & 1) {
             const uint32_t bidx = (bucket + idx) & idxmask;
-            struct ut_ehhBucket *b = (struct ut_ehhBucket *) (rt->buckets + bidx * rt->bucketsz);
+            struct ddsrt_ehh_bucket *b = (struct ddsrt_ehh_bucket *) (rt->buckets + bidx * rt->bucketsz);
             if (b->inuse && rt->equals (b->data, template)) {
-                assert (ut_ehhLookupInternal(rt, bucket, template));
+                assert (ddsrt_ehh_lookup_internal(rt, bucket, template));
                 b->inuse = 0;
                 sb->hopinfo &= ~(1u << idx);
                 return 1;
             }
         }
     }
-    assert (!ut_ehhLookupInternal(rt, bucket, template));
+    assert (!ddsrt_ehh_lookup_internal(rt, bucket, template));
     return 0;
 }
 
-void ut_ehhEnum (struct ut_ehh * UT_HH_RESTRICT rt, void (*f) (void *a, void *f_arg), void *f_arg)
+void ddsrt_ehh_enum (struct ddsrt_ehh * __restrict rt, void (*f) (void *a, void *f_arg), void *f_arg)
 {
     uint32_t i;
     for (i = 0; i < rt->size; i++) {
-        struct ut_ehhBucket *b = (struct ut_ehhBucket *) (rt->buckets + i * rt->bucketsz);
+        struct ddsrt_ehh_bucket *b = (struct ddsrt_ehh_bucket *) (rt->buckets + i * rt->bucketsz);
         if (b->inuse) {
             f (b->data, f_arg);
         }
     }
 }
 
-void *ut_ehhIterFirst (struct ut_ehh * UT_HH_RESTRICT rt, struct ut_ehhIter * UT_HH_RESTRICT iter)
+void *ddsrt_ehh_iter_first (struct ddsrt_ehh * __restrict rt, struct ddsrt_ehh_iter * __restrict iter)
 {
     iter->hh = rt;
     iter->cursor = 0;
-    return ut_ehhIterNext (iter);
+    return ddsrt_ehh_iter_next (iter);
 }
 
-void *ut_ehhIterNext (struct ut_ehhIter * UT_HH_RESTRICT iter)
+void *ddsrt_ehh_iter_next (struct ddsrt_ehh_iter * __restrict iter)
 {
-    struct ut_ehh *rt = iter->hh;
+    struct ddsrt_ehh *rt = iter->hh;
     while (iter->cursor < rt->size) {
-        struct ut_ehhBucket *b = (struct ut_ehhBucket *) (rt->buckets + iter->cursor * rt->bucketsz);
+        struct ddsrt_ehh_bucket *b = (struct ddsrt_ehh_bucket *) (rt->buckets + iter->cursor * rt->bucketsz);
         iter->cursor++;
         if (b->inuse) {
             return b->data;
diff --git a/src/util/src/ut_thread_pool.c b/src/ddsrt/src/thread_pool.c
similarity index 88%
rename from src/util/src/ut_thread_pool.c
rename to src/ddsrt/src/thread_pool.c
index acc4258..48cba27 100644
--- a/src/util/src/ut_thread_pool.c
+++ b/src/ddsrt/src/thread_pool.c
@@ -15,7 +15,7 @@
 #include "dds/ddsrt/heap.h"
 #include "dds/ddsrt/sync.h"
 #include "dds/ddsrt/threads.h"
-#include "dds/util/ut_thread_pool.h"
+#include "dds/ddsrt/thread_pool.h"
 
 typedef struct ddsi_work_queue_job
 {
@@ -25,7 +25,7 @@ typedef struct ddsi_work_queue_job
 }
 * ddsi_work_queue_job_t;
 
-struct ut_thread_pool_s
+struct ddsrt_thread_pool_s
 {
     ddsi_work_queue_job_t m_jobs;      /* Job queue */
     ddsi_work_queue_job_t m_jobs_tail; /* Tail of job queue */
@@ -42,10 +42,10 @@ struct ut_thread_pool_s
     ddsrt_mutex_t m_mutex;                  /* Pool guard mutex */
 };
 
-static uint32_t ut_thread_start_fn (void * arg)
+static uint32_t ddsrt_thread_start_fn (void * arg)
 {
     ddsi_work_queue_job_t job;
-    ut_thread_pool pool = (ut_thread_pool) arg;
+    ddsrt_thread_pool pool = (ddsrt_thread_pool) arg;
 
     /* Thread loops, pulling jobs from queue */
 
@@ -88,7 +88,7 @@ static uint32_t ut_thread_start_fn (void * arg)
     return 0;
 }
 
-static dds_retcode_t ut_thread_pool_new_thread (ut_thread_pool pool)
+static dds_retcode_t ddsrt_thread_pool_new_thread (ddsrt_thread_pool pool)
 {
     static unsigned char pools = 0; /* Pool counter - TODO make atomic */
 
@@ -97,7 +97,7 @@ static dds_retcode_t ut_thread_pool_new_thread (ut_thread_pool pool)
     dds_retcode_t res;
 
     (void) snprintf (name, sizeof (name), "OSPL-%u-%u", pools++, pool->m_count++);
-    res = ddsrt_thread_create (&id, name, &pool->m_attr, &ut_thread_start_fn, pool);
+    res = ddsrt_thread_create (&id, name, &pool->m_attr, &ddsrt_thread_start_fn, pool);
 
     if (res == DDS_RETCODE_OK)
     {
@@ -110,9 +110,9 @@ static dds_retcode_t ut_thread_pool_new_thread (ut_thread_pool pool)
     return res;
 }
 
-ut_thread_pool ut_thread_pool_new (uint32_t threads, uint32_t max_threads, uint32_t max_queue, ddsrt_threadattr_t * attr)
+ddsrt_thread_pool ddsrt_thread_pool_new (uint32_t threads, uint32_t max_threads, uint32_t max_queue, ddsrt_threadattr_t * attr)
 {
-    ut_thread_pool pool;
+    ddsrt_thread_pool pool;
     ddsi_work_queue_job_t job;
 
     /* Sanity check QoS */
@@ -144,9 +144,9 @@ ut_thread_pool ut_thread_pool_new (uint32_t threads, uint32_t max_threads, uint3
 
     while (threads--)
     {
-        if (ut_thread_pool_new_thread (pool) != DDS_RETCODE_OK)
+        if (ddsrt_thread_pool_new_thread (pool) != DDS_RETCODE_OK)
         {
-            ut_thread_pool_free (pool);
+            ddsrt_thread_pool_free (pool);
             pool = NULL;
             break;
         }
@@ -158,7 +158,7 @@ ut_thread_pool ut_thread_pool_new (uint32_t threads, uint32_t max_threads, uint3
     return pool;
 }
 
-void ut_thread_pool_free (ut_thread_pool pool)
+void ddsrt_thread_pool_free (ddsrt_thread_pool pool)
 {
     ddsi_work_queue_job_t job;
 
@@ -205,7 +205,7 @@ void ut_thread_pool_free (ut_thread_pool pool)
     ddsrt_free (pool);
 }
 
-dds_retcode_t ut_thread_pool_submit (ut_thread_pool pool, void (*fn) (void *arg), void * arg)
+dds_retcode_t ddsrt_thread_pool_submit (ddsrt_thread_pool pool, void (*fn) (void *arg), void * arg)
 {
     dds_retcode_t res = DDS_RETCODE_OK;
     ddsi_work_queue_job_t job;
@@ -255,7 +255,7 @@ dds_retcode_t ut_thread_pool_submit (ut_thread_pool pool, void (*fn) (void *arg)
             if ((pool->m_thread_max == 0) || (pool->m_threads < pool->m_thread_max))
             {
                 /* OK if fails as have queued job */
-                (void) ut_thread_pool_new_thread (pool);
+                (void) ddsrt_thread_pool_new_thread (pool);
             }
         }
 
@@ -269,7 +269,7 @@ dds_retcode_t ut_thread_pool_submit (ut_thread_pool pool, void (*fn) (void *arg)
     return res;
 }
 
-void ut_thread_pool_purge (ut_thread_pool pool)
+void ddsrt_thread_pool_purge (ddsrt_thread_pool pool)
 {
     uint32_t total;
 
diff --git a/src/util/src/ut_xmlparser.c b/src/ddsrt/src/xmlparser.c
similarity index 89%
rename from src/util/src/ut_xmlparser.c
rename to src/ddsrt/src/xmlparser.c
index 2d31a54..7a7e0cb 100644
--- a/src/util/src/ut_xmlparser.c
+++ b/src/ddsrt/src/xmlparser.c
@@ -18,7 +18,7 @@
 #include "dds/ddsrt/heap.h"
 #include "dds/ddsrt/misc.h"
 #include "dds/ddsrt/string.h"
-#include "dds/util/ut_xmlparser.h"
+#include "dds/ddsrt/xmlparser.h"
 
 #define TOK_EOF -1
 #define TOK_OPEN_TAG -2
@@ -30,7 +30,7 @@
 
 #define NOMARKER (~(size_t)0)
 
-struct ut_xmlpState {
+struct ddsrt_xmlp_state {
     size_t cbufp; /* current position in cbuf */
     size_t cbufn; /* number of bytes in cbuf (cbufp <= cbufn) */
     size_t cbufmax; /* allocated size of cbuf (cbufn <= cbufmax) */
@@ -50,7 +50,7 @@ struct ut_xmlpState {
     int nest; /* current nesting level */
     void *varg; /* user argument to callback functions */
     int require_eof; /* if false, junk may follow top-level closing tag */
-    struct ut_xmlpCallbacks cb; /* user-supplied callbacks (or stubs) */
+    struct ddsrt_xmlp_callbacks cb; /* user-supplied callbacks (or stubs) */
 };
 
 static int cb_null_elem_open (void *varg, uintptr_t parentinfo, uintptr_t *eleminfo, const char *name)
@@ -93,7 +93,7 @@ static void cb_null_error (void *varg, const char *msg, int line)
     DDSRT_UNUSED_ARG (line);
 }
 
-static void ut_xmlpNewCommon (struct ut_xmlpState *st)
+static void ddsrt_xmlp_new_common (struct ddsrt_xmlp_state *st)
 {
     st->cbufp = 0;
     st->cbufmark = NOMARKER;
@@ -111,7 +111,7 @@ static void ut_xmlpNewCommon (struct ut_xmlpState *st)
     st->require_eof = 1;
 }
 
-static void ut_xmlpNewSetCB (struct ut_xmlpState *st, void *varg, const struct ut_xmlpCallbacks *cb)
+static void ddsrt_xmlp_new_setCB (struct ddsrt_xmlp_state *st, void *varg, const struct ddsrt_xmlp_callbacks *cb)
 {
     st->varg = varg;
     st->cb = *cb;
@@ -122,43 +122,43 @@ static void ut_xmlpNewSetCB (struct ut_xmlpState *st, void *varg, const struct u
     if (st->cb.error == 0) st->cb.error = cb_null_error;
 }
 
-struct ut_xmlpState *ut_xmlpNewFile (FILE *fp, void *varg, const struct ut_xmlpCallbacks *cb)
+struct ddsrt_xmlp_state *ddsrt_xmlp_new_file (FILE *fp, void *varg, const struct ddsrt_xmlp_callbacks *cb)
 {
-    struct ut_xmlpState *st;
+    struct ddsrt_xmlp_state *st;
     st = ddsrt_malloc (sizeof (*st));
     st->cbufn = 0;
     st->cbufmax = 8192;
     st->cbuf = ddsrt_malloc (st->cbufmax);
     st->fp = fp;
-    ut_xmlpNewCommon (st);
-    ut_xmlpNewSetCB (st, varg, cb);
+    ddsrt_xmlp_new_common (st);
+    ddsrt_xmlp_new_setCB (st, varg, cb);
     return st;
 }
 
-struct ut_xmlpState *ut_xmlpNewString (const char *string, void *varg, const struct ut_xmlpCallbacks *cb)
+struct ddsrt_xmlp_state *ddsrt_xmlp_new_string (const char *string, void *varg, const struct ddsrt_xmlp_callbacks *cb)
 {
-    struct ut_xmlpState *st;
+    struct ddsrt_xmlp_state *st;
     st = ddsrt_malloc (sizeof (*st));
     st->cbufn = strlen (string);
     st->cbufmax = st->cbufn;
     st->cbuf = (char *) string;
     st->fp = NULL;
-    ut_xmlpNewCommon (st);
-    ut_xmlpNewSetCB (st, varg, cb);
+    ddsrt_xmlp_new_common (st);
+    ddsrt_xmlp_new_setCB (st, varg, cb);
     return st;
 }
 
-void ut_xmlpSetRequireEOF (struct ut_xmlpState *st, int require_eof)
+void ddsrt_xmlp_set_requireEOF (struct ddsrt_xmlp_state *st, int require_eof)
 {
     st->require_eof = require_eof;
 }
 
-size_t ut_xmlpGetBufpos (const struct ut_xmlpState *st)
+size_t ddsrt_xmlp_get_bufpos (const struct ddsrt_xmlp_state *st)
 {
     return st->cbufp;
 }
 
-void ut_xmlpFree (struct ut_xmlpState *st)
+void ddsrt_xmlp_free (struct ddsrt_xmlp_state *st)
 {
     if (st->fp != NULL) {
         ddsrt_free (st->cbuf);
@@ -167,7 +167,7 @@ void ut_xmlpFree (struct ut_xmlpState *st)
     ddsrt_free (st);
 }
 
-static int make_chars_available (struct ut_xmlpState *st, size_t nmin)
+static int make_chars_available (struct ddsrt_xmlp_state *st, size_t nmin)
 {
     size_t n, pos;
     pos = (st->cbufmark != NOMARKER) ? st->cbufmark : st->cbufp;
@@ -201,21 +201,21 @@ static int make_chars_available (struct ut_xmlpState *st, size_t nmin)
     return (st->cbufn - st->cbufp >= nmin);
 }
 
-static void set_input_marker (struct ut_xmlpState *st)
+static void set_input_marker (struct ddsrt_xmlp_state *st)
 {
     assert (st->cbufmark == NOMARKER);
     st->cbufmark = st->cbufp;
     st->linemark = st->line;
 }
 
-static void discard_input_marker (struct ut_xmlpState *st)
+static void discard_input_marker (struct ddsrt_xmlp_state *st)
 {
     assert (st->cbufmark != NOMARKER);
     st->cbufmark = NOMARKER;
     st->linemark = 0;
 }
 
-static void rewind_to_input_marker (struct ut_xmlpState *st)
+static void rewind_to_input_marker (struct ddsrt_xmlp_state *st)
 {
     assert (st->cbufmark != NOMARKER);
     st->cbufp = st->cbufmark;
@@ -223,7 +223,7 @@ static void rewind_to_input_marker (struct ut_xmlpState *st)
     discard_input_marker (st);
 }
 
-static int next_char (struct ut_xmlpState *st)
+static int next_char (struct ddsrt_xmlp_state *st)
 {
     char c;
     if (!make_chars_available (st, 1)) {
@@ -236,7 +236,7 @@ static int next_char (struct ut_xmlpState *st)
     return c;
 }
 
-static int peek_char (struct ut_xmlpState *st)
+static int peek_char (struct ddsrt_xmlp_state *st)
 {
     if (!make_chars_available (st, 1)) {
         return TOK_EOF;
@@ -244,7 +244,7 @@ static int peek_char (struct ut_xmlpState *st)
     return st->cbuf[st->cbufp];
 }
 
-static int peek_chars (struct ut_xmlpState *st, const char *seq, int consume)
+static int peek_chars (struct ddsrt_xmlp_state *st, const char *seq, int consume)
 {
     size_t n = strlen (seq);
     if (!make_chars_available (st, n)) {
@@ -354,13 +354,13 @@ static int unescape_insitu (char *buffer, size_t *n)
 }
 DDSRT_WARNING_MSVC_ON(4996);
 
-static void discard_payload (struct ut_xmlpState *st)
+static void discard_payload (struct ddsrt_xmlp_state *st)
 {
     st->tpp = 0;
     st->tpescp = 0;
 }
 
-static int append_to_payload (struct ut_xmlpState *st, int c, int islit)
+static int append_to_payload (struct ddsrt_xmlp_state *st, int c, int islit)
 {
     if (!islit) {
         st->tp[st->tpp++] = (char) c;
@@ -383,7 +383,7 @@ static int append_to_payload (struct ut_xmlpState *st, int c, int islit)
     return 0;
 }
 
-static int save_payload (char **payload, struct ut_xmlpState *st, int trim)
+static int save_payload (char **payload, struct ddsrt_xmlp_state *st, int trim)
 {
     char *p;
     if (st->tpescp < st->tpp) {
@@ -424,7 +424,7 @@ static int save_payload (char **payload, struct ut_xmlpState *st, int trim)
     return 0;
 }
 
-static int next_token_ident (struct ut_xmlpState *st, char **payload)
+static int next_token_ident (struct ddsrt_xmlp_state *st, char **payload)
 {
     while (qq_isidentcont (peek_char (st))) {
         if (append_to_payload (st, next_char (st), 0) < 0) {
@@ -438,7 +438,7 @@ static int next_token_ident (struct ut_xmlpState *st, char **payload)
     }
 }
 
-static int next_token_tag_withoutclose (struct ut_xmlpState *st, char **payload)
+static int next_token_tag_withoutclose (struct ddsrt_xmlp_state *st, char **payload)
 {
     if (peek_chars (st, "<![CDATA[", 0)) {
         return next_char (st);
@@ -459,7 +459,7 @@ static int next_token_tag_withoutclose (struct ut_xmlpState *st, char **payload)
     }
 }
 
-static int next_token_string (struct ut_xmlpState *st, char **payload)
+static int next_token_string (struct ddsrt_xmlp_state *st, char **payload)
 {
     /* pre: peek_char(st) == ('"' or '\'') */
     int endm = next_char (st);
@@ -478,7 +478,7 @@ static int next_token_string (struct ut_xmlpState *st, char **payload)
     }
 }
 
-static int skip_comment (struct ut_xmlpState *st)
+static int skip_comment (struct ddsrt_xmlp_state *st)
 {
     if (!peek_chars (st, "<!--", 1)) {
         return 0;
@@ -493,7 +493,7 @@ static int skip_comment (struct ut_xmlpState *st)
     }
 }
 
-static void processing_instruction (struct ut_xmlpState *st, const char *end)
+static void processing_instruction (struct ddsrt_xmlp_state *st, const char *end)
 {
     /* just after <?; skip everything up to and include ?> */
     while (peek_char (st) != TOK_EOF && !peek_chars (st, end, 1)) {
@@ -501,7 +501,7 @@ static void processing_instruction (struct ut_xmlpState *st, const char *end)
     }
 }
 
-static void drop_peek_token (struct ut_xmlpState *st)
+static void drop_peek_token (struct ddsrt_xmlp_state *st)
 {
     st->peektok = 0;
     if (st->peekpayload) {
@@ -510,7 +510,7 @@ static void drop_peek_token (struct ut_xmlpState *st)
     }
 }
 
-static int next_token (struct ut_xmlpState *st, char **payload)
+static int next_token (struct ddsrt_xmlp_state *st, char **payload)
 {
     /* Always return a valid pointer to allocated memory or a null
      pointer, regardless of token type */
@@ -566,7 +566,7 @@ static int next_token (struct ut_xmlpState *st, char **payload)
     }
 }
 
-static int peek_token (struct ut_xmlpState *st)
+static int peek_token (struct ddsrt_xmlp_state *st)
 {
     int tok;
     char *payload;
@@ -576,7 +576,7 @@ static int peek_token (struct ut_xmlpState *st)
     return tok;
 }
 
-static int parse_element (struct ut_xmlpState *st, uintptr_t parentinfo)
+static int parse_element (struct ddsrt_xmlp_state *st, uintptr_t parentinfo)
 {
 #define PE_ERROR2(c,c1,c2) do { errc = (c); errc1 = (c1); errc2 = (c2); goto err; } while (0)
 #define PE_ERROR(c,c1) PE_ERROR2(c,c1,0)
@@ -703,7 +703,7 @@ ok:
 #undef PE_ERROR2
 }
 
-int ut_xmlpParse (struct ut_xmlpState *st)
+int ddsrt_xmlp_parse (struct ddsrt_xmlp_state *st)
 {
     if (peek_token (st) == TOK_EOF) {
         return 0;
@@ -717,6 +717,6 @@ int ut_xmlpParse (struct ut_xmlpState *st)
     }
 }
 
-int ut_xmlUnescapeInsitu (char *buffer, size_t *n) {
+int ddsrt_xmlUnescapeInsitu (char *buffer, size_t *n) {
     return unescape_insitu (buffer, n);
 }
diff --git a/src/util/CMakeLists.txt b/src/util/CMakeLists.txt
deleted file mode 100644
index 282c131..0000000
--- a/src/util/CMakeLists.txt
+++ /dev/null
@@ -1,48 +0,0 @@
-#
-# Copyright(c) 2006 to 2018 ADLINK Technology Limited and others
-#
-# This program and the accompanying materials are made available under the
-# terms of the Eclipse Public License v. 2.0 which is available at
-# http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
-# v. 1.0 which is available at
-# http://www.eclipse.org/org/documents/edl-v10.php.
-#
-# SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
-#
-include (GenerateExportHeader)
-
-PREPEND(srcs_util "${CMAKE_CURRENT_SOURCE_DIR}/src" ut_avl.c ut_crc.c ut_expand_envvars.c ut_fibheap.c ut_hopscotch.c ut_thread_pool.c ut_xmlparser.c)
-
-add_library(util ${srcs_util})
-set_property(TARGET util PROPERTY POSITION_INDEPENDENT_CODE TRUE)
-
-generate_export_header(
-  util
-  BASE_NAME
-    dds
-  EXPORT_FILE_NAME
-    "${CMAKE_CURRENT_BINARY_DIR}/include/dds/export.h")
-
-# util must NOT link with ddsrt to avoid duplicate symbols in ddsc!
-# ddsrt include directories are required though.
-target_compile_definitions(
-  util
-  PUBLIC
-    $<BUILD_INTERFACE:$<TARGET_PROPERTY:ddsrt,INTERFACE_COMPILE_DEFINITIONS>>)
-target_include_directories(
-  util
-  PUBLIC
-    "$<BUILD_INTERFACE:${CMAKE_CURRENT_SOURCE_DIR}/include>"
-  PRIVATE
-    "$<BUILD_INTERFACE:${CMAKE_CURRENT_BINARY_DIR}/include>"
-    "$<BUILD_INTERFACE:$<TARGET_PROPERTY:ddsrt,INTERFACE_INCLUDE_DIRECTORIES>>")
-
-install(
-  DIRECTORY "${CMAKE_CURRENT_LIST_DIR}/include/dds"
-  DESTINATION "${CMAKE_INSTALL_INCLUDEDIR}"
-  COMPONENT dev)
-
-# TODO: improve test inclusion.
-if((BUILD_TESTING) AND ((NOT DEFINED MSVC_VERSION) OR (MSVC_VERSION GREATER "1800")))
-  add_subdirectory(tests)
-endif()
diff --git a/src/util/include/dds/util/ut_avl.h b/src/util/include/dds/util/ut_avl.h
deleted file mode 100644
index 8d3b76b..0000000
--- a/src/util/include/dds/util/ut_avl.h
+++ /dev/null
@@ -1,359 +0,0 @@
-/*
- * Copyright(c) 2006 to 2018 ADLINK Technology Limited and others
- *
- * This program and the accompanying materials are made available under the
- * terms of the Eclipse Public License v. 2.0 which is available at
- * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
- * v. 1.0 which is available at
- * http://www.eclipse.org/org/documents/edl-v10.php.
- *
- * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
- */
-#ifndef UT_AVL_H
-#define UT_AVL_H
-
-/* The tree library never performs memory allocations or deallocations internally.
-
-   - Treedef_t: defines the properties of the tree, offsets,
-     comparison functions, augmented structures, flags -- these are
-     related to the code/data structure in which the tree is embedded,
-     and in nearly all cases known at compile time.
-   - avlTree_t: represents the tree, i.e., pointer to the root.
-   - avlNode_t: contains the administrative data for a single node in
-     the tree.
-
-   For a tree node:
-     struct T {
-       avlNode_t avlnode;
-       int key;
-     };
-   by definition, avlnodeoffset == offsetof(struct T, avlnode) and
-   keyoffset = offsetof(struct T, key). The user of the library only
-   ever deals in pointers to (in this case) struct T, never with
-   pointers to the avlNode_t, and the compare function operations on
-   pointers to keys, in this case pointers to "int"s. If you wish, you
-   can also do: keyoffset = 0, in which case the compare function
-   would be operating on struct T's.
-
-   The compare function is assumed to behave just like all compare
-   functions in the C library: < 0, =0, >0 for left argument less
-   than, equal to or greater than the right argument.
-
-   The "augment" function is automatically called whenever some of the
-   children of a node change, as well as when the "augment" function
-   has been called on some of the children. It allows you to maintain
-   a "summary" of the subtree -- currently only used in ddsi2e, in one
-   spot.
-
-   Trees come in various "variants", configured through "treedef"
-   flags:
-   - direct/indirect key: direct meaning the key value is embedded in
-     the structure containing the avlNode_t, indirect meaning a
-     pointer to the key value is. The compare function doesn't deal
-     with tree nodes, but with key values.
-   - re-entrant: in the style of the C library, meaning, the
-     comparison function gets a user-supplied 3rd argument (in
-     particular used by mmstat).
-   - unique keys/duplicate keys: when keys must be unique, some
-     optimizations apply; it is up to the caller to ensure one doesn't
-     violate the uniqueness of the keys (it'll happily crash in insert
-     if you don't); when duplicate keys are allowed, a forward scan of
-     the tree will visit them in the order of insertion.
-
-   For a tree node:
-     struct T {
-       avlnode_t avlnode;
-      char *key;
-     };
-   you could set the "indirect" flag, and then you simply use
-   strcmp(), avoiding the need for passing templates in looking up key
-   values. Much nicer.
-
-   There is also an orthogonal variant that is enforced through the
-   type system -- note that would be possible for all of the above as
-   well, but the number of cases simply explodes and none of the above
-   flags affects the dynamically changing data structures (just the
-   tree definition), unlike this one.
-
-   - the "C" variant keeps track of the number of nodes in the tree to
-     support a "count" operation in O(1) time, but is otherwise
-     identical.
-
-   The various initializer macros and TreedefInit functions should
-   make sense with this.
-
-   All functions for looking up nodes return NULL if there is no node
-   satisfying the requirements.
-
-   - Init: initializes a tree (really just: root = NULL, perhaps count = 0)
-   - Free: calls "freefun" on each node, which may free the node
-   - FreeArg: as "Free", but with an extra, user-supplied, argument
-   - Root: returns the root node
-   - Lookup: returns a node with key value "key" (ref allowdups flag)
-   - LookupIPath: like Lookup, but also filling an IPath_t structure
-     for efficient insertion in case of a failed lookup (or inserting
-     duplicates)
-   - LookupDPath: like Lookup, but also filling a DPath_t structure
-     that helps with deleting a node
-   - LookupPredEq: locates the node with the greatest key value <= "key"
-   - LookupSuccEq: similar, but smallest key value >= "key"
-   - LookupPred: similar, < "key"
-   - LookupSucc: similar, > "key"
-   - Insert: convenience function: LookupIPath ; InsertIPath
-   - Delete: convenience function: LookupDPath ; DeleteDPath
-   - InsertIPath: insert node based on the "path" obtained from LookupIPath
-   - DeleteDPath: delete node, using information in "path" to do so efficiently
-   - SwapNode: replace "oldn" by "newn" without modifying the tree
-     structure (the key need not be equal, but must be
-     FindPred(oldn).key < newn.key < FindSucc(oldn).key, where a
-     non-existing predecessor has key -inf and a non-existing
-     successor has key +inf, and where it is understood that the <
-     operator becomes <= if allowdups is set
-   - AugmentUpdate: to be called when something in "node" changes that
-     affects the subtree "summary" computed by the configured
-     "augment" function
-   - IsEmpty: returns 1 if tree is empty, 0 if not
-   - IsSingleton: returns 1 if tree contains exactly one node, 0 if not
-   - FindMin: returns the node with the smallest key value in the tree
-   - FindMax: similar, largest key value
-   - FindPred: preceding node in in-order treewalk
-   - FindSucc: similar, following node
-
-   - Walk: calls "f" with user-supplied argument "a" once for each
-     node, starting at FindMin and ending at FindMax
-   - ConstWalk: same, but with a const tree
-   - WalkRange: like Walk, but only visiting nodes with key values in
-     range [min,max] (that's inclusive)
-   - ConstWalkRange: same, but with a const tree
-   - WalkRangeReverse: like WalkRange, but in the reverse direction
-   - ConstWalkRangeReverse: same, but with a const tree
-   - IterFirst: starts forward iteration, starting at (and returning) FindMin
-   - IterSuccEq: similar, starting at LookupSuccEq
-   - IterSucc: similar, starting at LookupSucc
-   - IterNext: returns FindSucc(last returned node); may not be called
-     if preceding IterXXX call on same "iter" returned NULL
-
-   That's all there is to it.
-
-   Note that all calls to Walk(f,a) can be rewritten as:
-     for(n=IterFirst(&it); n; n=IterNext(&it)) { f(n,a) }
-   or as
-     for(n=FindMin(); n; n=FindSucc(n)) { f(n,a) }
-
-   The walk functions and iterators may not alter the tree
-   structure. If that is desired, the latter can easily be rewritten
-   as:
-     n=FindMin() ; while(n) { nn=FindSucc(n); f(n,a); n=nn }
-   because FindMin/FindSucc doesn't store any information to allow
-   fast processing. That'll allow every operation, with the obvious
-   exception of f(n) calling Delete(FindSucc(n)).
-
-   Currently, all trees maintain parent pointers, but it may be worth
-   doing a separate set without it, as it reduces the size of
-   avlNode_t. But in that case, the FindMin/FindSucc option would no
-   longer be a reasonable option because it would be prohibitively
-   expensive, whereas the IterFirst/IterNext option are alway
-   efficiently. If one were to do a threaded tree variant, the
-   implemetantion of IterFirst/IterNext would become absolute trivial
-   and faster still, but at the cost of significantly more overhead in
-   memory and updates. */
-
-#include <stdint.h>
-#include <stdlib.h>
-
-#include "dds/export.h"
-#include "dds/ddsrt/attributes.h"
-
-#if defined (__cplusplus)
-extern "C" {
-#endif
-
-#define UT_AVL_MAX_TREEHEIGHT (12 * sizeof (void *))
-
-typedef int (*ut_avlCompare_t) (const void *a, const void *b);
-typedef int (*ut_avlCompare_r_t) (const void *a, const void *b, void *arg);
-typedef void (*ut_avlAugment_t) (void *node, const void *left, const void *right);
-typedef void (*ut_avlWalk_t) (void *node, void *arg);
-typedef void (*ut_avlConstWalk_t) (const void *node, void *arg);
-
-typedef struct ut_avlNode {
-    struct ut_avlNode *cs[2]; /* 0 = left, 1 = right */
-    struct ut_avlNode *parent;
-    int height;
-} ut_avlNode_t;
-
-#define UT_AVL_TREEDEF_FLAG_INDKEY 1
-#define UT_AVL_TREEDEF_FLAG_R 2
-#define UT_AVL_TREEDEF_FLAG_ALLOWDUPS 4
-
-typedef struct ut_avlTreedef {
-#if defined (__cplusplus)
-    ut_avlTreedef() {}
-#endif
-    size_t avlnodeoffset;
-    size_t keyoffset;
-    union {
-        ut_avlCompare_t comparekk;
-        ut_avlCompare_r_t comparekk_r;
-    } u;
-    ut_avlAugment_t augment;
-    uint32_t flags;
-    void *cmp_arg; /* for _r variant */
-} ut_avlTreedef_t;
-
-typedef struct ut_avlCTreedef {
-    ut_avlTreedef_t t;
-} ut_avlCTreedef_t;
-
-typedef struct ut_avlTree {
-    ut_avlNode_t *root;
-} ut_avlTree_t;
-
-typedef struct ut_avlCTree {
-    ut_avlTree_t t;
-    size_t count;
-} ut_avlCTree_t;
-
-typedef struct ut_avlPath {
-    int depth; /* total depth of path */
-    int pnodeidx;
-    ut_avlNode_t *parent; /* (nodeidx == 0 ? NULL : *(path[nodeidx-1])) */
-    ut_avlNode_t **pnode[UT_AVL_MAX_TREEHEIGHT];
-} ut_avlPath_t;
-
-typedef struct ut_avlIPath {
-    ut_avlPath_t p;
-} ut_avlIPath_t;
-
-typedef struct ut_avlDPath {
-    ut_avlPath_t p;
-} ut_avlDPath_t;
-
-typedef struct ut_avlIter {
-    const ut_avlTreedef_t *td;
-    ut_avlNode_t *right;
-    ut_avlNode_t **todop;
-    ut_avlNode_t *todo[1+UT_AVL_MAX_TREEHEIGHT];
-} ut_avlIter_t;
-
-typedef struct ut_avlCIter {
-    ut_avlIter_t t;
-} ut_avlCIter_t;
-
-/* avlnodeoffset and keyoffset must both be in [0,2**31-1] */
-#define UT_AVL_TREEDEF_INITIALIZER(avlnodeoffset, keyoffset, comparekk_, augment) { (avlnodeoffset), (keyoffset), { .comparekk = (comparekk_) }, (augment), 0, 0 }
-#define UT_AVL_TREEDEF_INITIALIZER_INDKEY(avlnodeoffset, keyoffset, comparekk_, augment) { (avlnodeoffset), (keyoffset), { .comparekk = (comparekk_) }, (augment), UT_AVL_TREEDEF_FLAG_INDKEY, 0 }
-#define UT_AVL_TREEDEF_INITIALIZER_ALLOWDUPS(avlnodeoffset, keyoffset, comparekk_, augment) { (avlnodeoffset), (keyoffset), { .comparekk = (comparekk_) }, (augment), UT_AVL_TREEDEF_FLAG_ALLOWDUPS, 0 }
-#define UT_AVL_TREEDEF_INITIALIZER_INDKEY_ALLOWDUPS(avlnodeoffset, keyoffset, comparekk_, augment) { (avlnodeoffset), (keyoffset), { .comparekk = (comparekk_) }, (augment), UT_AVL_TREEDEF_FLAG_INDKEY|UT_AVL_TREEDEF_FLAG_ALLOWDUPS, 0 }
-#define UT_AVL_TREEDEF_INITIALIZER_R(avlnodeoffset, keyoffset, comparekk_, cmparg, augment) { (avlnodeoffset), (keyoffset), { .comparekk_r = (comparekk_) }, (augment), UT_AVL_TREEDEF_FLAG_R, (cmparg) }
-#define UT_AVL_TREEDEF_INITIALIZER_INDKEY_R(avlnodeoffset, keyoffset, comparekk_, cmparg, augment) { (avlnodeoffset), (keyoffset), { .comparekk_r = (comparekk_) }, (augment), UT_AVL_TREEDEF_FLAG_INDKEY|UT_AVL_TREEDEF_FLAG_R, (cmparg) }
-#define UT_AVL_TREEDEF_INITIALIZER_R_ALLOWDUPS(avlnodeoffset, keyoffset, comparekk_, cmparg, augment) { (avlnodeoffset), (keyoffset), { .comparekk_r = (comparekk_) }, (augment), UT_AVL_TREEDEF_FLAG_R|UT_AVL_TREEDEF_FLAG_ALLOWDUPS, (cmparg) }
-#define UT_AVL_TREEDEF_INITIALIZER_INDKEY_R_ALLOWDUPS(avlnodeoffset, keyoffset, comparekk_, cmparg, augment) { (avlnodeoffset), (keyoffset), { .comparekk_r = (comparekk_) }, (augment), UT_AVL_TREEDEF_FLAG_INDKEY|UT_AVL_TREEDEF_FLAG_R|UT_AVL_TREEDEF_FLAG_ALLOWDUPS, (cmparg) }
-
-/* Not maintaining # nodes */
-
-DDS_EXPORT void ut_avlTreedefInit (ut_avlTreedef_t *td, size_t avlnodeoffset, size_t keyoffset, ut_avlCompare_t comparekk, ut_avlAugment_t augment, uint32_t flags) ddsrt_nonnull((1,4));
-DDS_EXPORT void ut_avlTreedefInit_r (ut_avlTreedef_t *td, size_t avlnodeoffset, size_t keyoffset, ut_avlCompare_r_t comparekk_r, void *cmp_arg, ut_avlAugment_t augment, uint32_t flags) ddsrt_nonnull((1,4));
-
-DDS_EXPORT void ut_avlInit (const ut_avlTreedef_t *td, ut_avlTree_t *tree) ddsrt_nonnull_all;
-DDS_EXPORT void ut_avlFree (const ut_avlTreedef_t *td, ut_avlTree_t *tree, void (*freefun) (void *node)) ddsrt_nonnull((1,2));
-DDS_EXPORT void ut_avlFreeArg (const ut_avlTreedef_t *td, ut_avlTree_t *tree, void (*freefun) (void *node, void *arg), void *arg) ddsrt_nonnull((1,2));
-
-DDS_EXPORT void *ut_avlRoot (const ut_avlTreedef_t *td, const ut_avlTree_t *tree) ddsrt_nonnull_all;
-DDS_EXPORT void *ut_avlRootNonEmpty (const ut_avlTreedef_t *td, const ut_avlTree_t *tree) ddsrt_nonnull_all;
-DDS_EXPORT void *ut_avlLookup (const ut_avlTreedef_t *td, const ut_avlTree_t *tree, const void *key) ddsrt_nonnull_all;
-DDS_EXPORT void *ut_avlLookupIPath (const ut_avlTreedef_t *td, const ut_avlTree_t *tree, const void *key, ut_avlIPath_t *path) ddsrt_nonnull_all;
-DDS_EXPORT void *ut_avlLookupDPath (const ut_avlTreedef_t *td, const ut_avlTree_t *tree, const void *key, ut_avlDPath_t *path) ddsrt_nonnull_all;
-DDS_EXPORT void *ut_avlLookupPredEq (const ut_avlTreedef_t *td, const ut_avlTree_t *tree, const void *key) ddsrt_nonnull_all;
-DDS_EXPORT void *ut_avlLookupSuccEq (const ut_avlTreedef_t *td, const ut_avlTree_t *tree, const void *key) ddsrt_nonnull_all;
-DDS_EXPORT void *ut_avlLookupPred (const ut_avlTreedef_t *td, const ut_avlTree_t *tree, const void *key) ddsrt_nonnull_all;
-DDS_EXPORT void *ut_avlLookupSucc (const ut_avlTreedef_t *td, const ut_avlTree_t *tree, const void *key) ddsrt_nonnull_all;
-
-DDS_EXPORT void ut_avlInsert (const ut_avlTreedef_t *td, ut_avlTree_t *tree, void *node) ddsrt_nonnull_all;
-DDS_EXPORT void ut_avlDelete (const ut_avlTreedef_t *td, ut_avlTree_t *tree, void *node) ddsrt_nonnull_all;
-DDS_EXPORT void ut_avlInsertIPath (const ut_avlTreedef_t *td, ut_avlTree_t *tree, void *node, ut_avlIPath_t *path) ddsrt_nonnull_all;
-DDS_EXPORT void ut_avlDeleteDPath (const ut_avlTreedef_t *td, ut_avlTree_t *tree, void *node, ut_avlDPath_t *path) ddsrt_nonnull_all;
-DDS_EXPORT void ut_avlSwapNode (const ut_avlTreedef_t *td, ut_avlTree_t *tree, void *oldn, void *newn) ddsrt_nonnull_all;
-DDS_EXPORT void ut_avlAugmentUpdate (const ut_avlTreedef_t *td, void *node) ddsrt_nonnull_all;
-
-DDS_EXPORT int ut_avlIsEmpty (const ut_avlTree_t *tree) ddsrt_nonnull_all;
-DDS_EXPORT int ut_avlIsSingleton (const ut_avlTree_t *tree) ddsrt_nonnull_all;
-
-DDS_EXPORT void *ut_avlFindMin (const ut_avlTreedef_t *td, const ut_avlTree_t *tree) ddsrt_nonnull_all;
-DDS_EXPORT void *ut_avlFindMax (const ut_avlTreedef_t *td, const ut_avlTree_t *tree) ddsrt_nonnull_all;
-DDS_EXPORT void *ut_avlFindPred (const ut_avlTreedef_t *td, const ut_avlTree_t *tree, const void *vnode) ddsrt_nonnull((1,2));
-DDS_EXPORT void *ut_avlFindSucc (const ut_avlTreedef_t *td, const ut_avlTree_t *tree, const void *vnode) ddsrt_nonnull((1,2));
-
-DDS_EXPORT void ut_avlWalk (const ut_avlTreedef_t *td, ut_avlTree_t *tree, ut_avlWalk_t f, void *a) ddsrt_nonnull((1,2,3));
-DDS_EXPORT void ut_avlConstWalk (const ut_avlTreedef_t *td, const ut_avlTree_t *tree, ut_avlConstWalk_t f, void *a) ddsrt_nonnull((1,2,3));
-DDS_EXPORT void ut_avlWalkRange (const ut_avlTreedef_t *td, ut_avlTree_t *tree, const void *min, const void *max, ut_avlWalk_t f, void *a)  ddsrt_nonnull((1,2,3,4,5));
-DDS_EXPORT void ut_avlConstWalkRange (const ut_avlTreedef_t *td, const ut_avlTree_t *tree, const void *min, const void *max, ut_avlConstWalk_t f, void *a) ddsrt_nonnull((1,2,3,4,5));
-DDS_EXPORT void ut_avlWalkRangeReverse (const ut_avlTreedef_t *td, ut_avlTree_t *tree, const void *min, const void *max, ut_avlWalk_t f, void *a) ddsrt_nonnull((1,2,3));
-DDS_EXPORT void ut_avlConstWalkRangeReverse (const ut_avlTreedef_t *td, const ut_avlTree_t *tree, const void *min, const void *max, ut_avlConstWalk_t f, void *a) ddsrt_nonnull((1,2,3));
-
-DDS_EXPORT void *ut_avlIterFirst (const ut_avlTreedef_t *td, const ut_avlTree_t *tree, ut_avlIter_t *iter) ddsrt_nonnull_all;
-DDS_EXPORT void *ut_avlIterSuccEq (const ut_avlTreedef_t *td, const ut_avlTree_t *tree, ut_avlIter_t *iter, const void *key) ddsrt_nonnull_all;
-DDS_EXPORT void *ut_avlIterSucc (const ut_avlTreedef_t *td, const ut_avlTree_t *tree, ut_avlIter_t *iter, const void *key) ddsrt_nonnull_all;
-DDS_EXPORT void *ut_avlIterNext (ut_avlIter_t *iter) ddsrt_nonnull_all;
-
-/* Maintaining # nodes */
-
-#define UT_AVL_CTREEDEF_INITIALIZER(avlnodeoffset, keyoffset, comparekk, augment) { UT_AVL_TREEDEF_INITIALIZER (avlnodeoffset, keyoffset, comparekk, augment) }
-#define UT_AVL_CTREEDEF_INITIALIZER_INDKEY(avlnodeoffset, keyoffset, comparekk, augment) { UT_AVL_TREEDEF_INITIALIZER_INDKEY (avlnodeoffset, keyoffset, comparekk, augment) }
-#define UT_AVL_CTREEDEF_INITIALIZER_ALLOWDUPS(avlnodeoffset, keyoffset, comparekk, augment) { UT_AVL_TREEDEF_INITIALIZER_ALLOWDUPS (avlnodeoffset, keyoffset, comparekk, augment) }
-#define UT_AVL_CTREEDEF_INITIALIZER_INDKEY_ALLOWDUPS(avlnodeoffset, keyoffset, comparekk, augment) { UT_AVL_TREEDEF_INITIALIZER_INDKEY_ALLOWDUPS (avlnodeoffset, keyoffset, comparekk, augment) }
-#define UT_AVL_CTREEDEF_INITIALIZER_R(avlnodeoffset, keyoffset, comparekk, cmparg, augment) { UT_AVL_TREEDEF_INITIALIZER_R (avlnodeoffset, keyoffset, comparekk, cmparg, augment) }
-#define UT_AVL_CTREEDEF_INITIALIZER_INDKEY_R(avlnodeoffset, keyoffset, comparekk, cmparg, augment) { UT_AVL_TREEDEF_INITIALIZER_INDKEY_R (avlnodeoffset, keyoffset, comparekk, cmparg, augment) }
-#define UT_AVL_CTREEDEF_INITIALIZER_R_ALLOWDUPS(avlnodeoffset, keyoffset, comparekk, cmparg, augment) { UT_AVL_TREEDEF_INITIALIZER_R_ALLOWDUPS (avlnodeoffset, keyoffset, comparekk, cmparg, augment) }
-#define UT_AVL_CTREEDEF_INITIALIZER_INDKEY_R_ALLOWDUPS(avlnodeoffset, keyoffset, comparekk, cmparg, augment) { UT_AVL_TREEDEF_INITIALIZER_INDKEY_R_ALLOWDUPS (avlnodeoffset, keyoffset, comparekk, cmparg, augment) }
-
-DDS_EXPORT void ut_avlCTreedefInit (ut_avlCTreedef_t *td, size_t avlnodeoffset, size_t keyoffset, ut_avlCompare_t comparekk, ut_avlAugment_t augment, uint32_t flags) ddsrt_nonnull((1,4));
-DDS_EXPORT void ut_avlCTreedefInit_r (ut_avlCTreedef_t *td, size_t avlnodeoffset, size_t keyoffset, ut_avlCompare_r_t comparekk_r, void *cmp_arg, ut_avlAugment_t augment, uint32_t flags) ddsrt_nonnull((1,4));
-
-DDS_EXPORT void ut_avlCInit (const ut_avlCTreedef_t *td, ut_avlCTree_t *tree) ddsrt_nonnull_all;
-DDS_EXPORT void ut_avlCFree (const ut_avlCTreedef_t *td, ut_avlCTree_t *tree, void (*freefun) (void *node)) ddsrt_nonnull((1,2));
-DDS_EXPORT void ut_avlCFreeArg (const ut_avlCTreedef_t *td, ut_avlCTree_t *tree, void (*freefun) (void *node, void *arg), void *arg) ddsrt_nonnull((1,2));
-
-DDS_EXPORT void *ut_avlCRoot (const ut_avlCTreedef_t *td, const ut_avlCTree_t *tree) ddsrt_nonnull_all;
-DDS_EXPORT void *ut_avlCRootNonEmpty (const ut_avlCTreedef_t *td, const ut_avlCTree_t *tree) ddsrt_nonnull_all;
-DDS_EXPORT void *ut_avlCLookup (const ut_avlCTreedef_t *td, const ut_avlCTree_t *tree, const void *key) ddsrt_nonnull_all;
-DDS_EXPORT void *ut_avlCLookupIPath (const ut_avlCTreedef_t *td, const ut_avlCTree_t *tree, const void *key, ut_avlIPath_t *path) ddsrt_nonnull_all;
-DDS_EXPORT void *ut_avlCLookupDPath (const ut_avlCTreedef_t *td, const ut_avlCTree_t *tree, const void *key, ut_avlDPath_t *path) ddsrt_nonnull_all;
-DDS_EXPORT void *ut_avlCLookupPredEq (const ut_avlCTreedef_t *td, const ut_avlCTree_t *tree, const void *key) ddsrt_nonnull_all;
-DDS_EXPORT void *ut_avlCLookupSuccEq (const ut_avlCTreedef_t *td, const ut_avlCTree_t *tree, const void *key) ddsrt_nonnull_all;
-DDS_EXPORT void *ut_avlCLookupPred (const ut_avlCTreedef_t *td, const ut_avlCTree_t *tree, const void *key) ddsrt_nonnull_all;
-DDS_EXPORT void *ut_avlCLookupSucc (const ut_avlCTreedef_t *td, const ut_avlCTree_t *tree, const void *key) ddsrt_nonnull_all;
-
-DDS_EXPORT void ut_avlCInsert (const ut_avlCTreedef_t *td, ut_avlCTree_t *tree, void *node) ddsrt_nonnull_all;
-DDS_EXPORT void ut_avlCDelete (const ut_avlCTreedef_t *td, ut_avlCTree_t *tree, void *node) ddsrt_nonnull_all;
-DDS_EXPORT void ut_avlCInsertIPath (const ut_avlCTreedef_t *td, ut_avlCTree_t *tree, void *node, ut_avlIPath_t *path) ddsrt_nonnull_all;
-DDS_EXPORT void ut_avlCDeleteDPath (const ut_avlCTreedef_t *td, ut_avlCTree_t *tree, void *node, ut_avlDPath_t *path) ddsrt_nonnull_all;
-DDS_EXPORT void ut_avlCSwapNode (const ut_avlCTreedef_t *td, ut_avlCTree_t *tree, void *oldn, void *newn) ddsrt_nonnull_all;
-DDS_EXPORT void ut_avlCAugmentUpdate (const ut_avlCTreedef_t *td, void *node) ddsrt_nonnull_all;
-
-DDS_EXPORT int ut_avlCIsEmpty (const ut_avlCTree_t *tree) ddsrt_nonnull_all;
-DDS_EXPORT int ut_avlCIsSingleton (const ut_avlCTree_t *tree) ddsrt_nonnull_all;
-DDS_EXPORT size_t ut_avlCCount (const ut_avlCTree_t *tree) ddsrt_nonnull_all;
-
-DDS_EXPORT void *ut_avlCFindMin (const ut_avlCTreedef_t *td, const ut_avlCTree_t *tree) ddsrt_nonnull_all;
-DDS_EXPORT void *ut_avlCFindMax (const ut_avlCTreedef_t *td, const ut_avlCTree_t *tree) ddsrt_nonnull_all;
-DDS_EXPORT void *ut_avlCFindPred (const ut_avlCTreedef_t *td, const ut_avlCTree_t *tree, const void *vnode) ddsrt_nonnull((1,2));
-DDS_EXPORT void *ut_avlCFindSucc (const ut_avlCTreedef_t *td, const ut_avlCTree_t *tree, const void *vnode) ddsrt_nonnull((1,2));
-
-DDS_EXPORT void ut_avlCWalk (const ut_avlCTreedef_t *td, ut_avlCTree_t *tree, ut_avlWalk_t f, void *a) ddsrt_nonnull((1,2,3));
-DDS_EXPORT void ut_avlCConstWalk (const ut_avlCTreedef_t *td, const ut_avlCTree_t *tree, ut_avlConstWalk_t f, void *a) ddsrt_nonnull((1,2,3));
-DDS_EXPORT void ut_avlCWalkRange (const ut_avlCTreedef_t *td, ut_avlCTree_t *tree, const void *min, const void *max, ut_avlWalk_t f, void *a) ddsrt_nonnull((1,2,3,4,5));
-DDS_EXPORT void ut_avlCConstWalkRange (const ut_avlCTreedef_t *td, const ut_avlCTree_t *tree, const void *min, const void *max, ut_avlConstWalk_t f, void *a) ddsrt_nonnull((1,2,3,4,5));
-DDS_EXPORT void ut_avlCWalkRangeReverse (const ut_avlCTreedef_t *td, ut_avlCTree_t *tree, const void *min, const void *max, ut_avlWalk_t f, void *a) ddsrt_nonnull((1,2,3,4,5));
-DDS_EXPORT void ut_avlCConstWalkRangeReverse (const ut_avlCTreedef_t *td, const ut_avlCTree_t *tree, const void *min, const void *max, ut_avlConstWalk_t f, void *a) ddsrt_nonnull((1,2,3,4,5));
-
-DDS_EXPORT void *ut_avlCIterFirst (const ut_avlCTreedef_t *td, const ut_avlCTree_t *tree, ut_avlCIter_t *iter) ddsrt_nonnull_all;
-DDS_EXPORT void *ut_avlCIterSuccEq (const ut_avlCTreedef_t *td, const ut_avlCTree_t *tree, ut_avlCIter_t *iter, const void *key) ddsrt_nonnull_all;
-DDS_EXPORT void *ut_avlCIterSucc (const ut_avlCTreedef_t *td, const ut_avlCTree_t *tree, ut_avlCIter_t *iter, const void *key) ddsrt_nonnull_all;
-DDS_EXPORT void *ut_avlCIterNext (ut_avlCIter_t *iter) ddsrt_nonnull_all;
-
-#if defined (__cplusplus)
-}
-#endif
-
-#endif /* UT_AVL_H */
diff --git a/src/util/include/dds/util/ut_crc.h b/src/util/include/dds/util/ut_crc.h
deleted file mode 100644
index 144009f..0000000
--- a/src/util/include/dds/util/ut_crc.h
+++ /dev/null
@@ -1,31 +0,0 @@
-/*
- * Copyright(c) 2006 to 2018 ADLINK Technology Limited and others
- *
- * This program and the accompanying materials are made available under the
- * terms of the Eclipse Public License v. 2.0 which is available at
- * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
- * v. 1.0 which is available at
- * http://www.eclipse.org/org/documents/edl-v10.php.
- *
- * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
- */
-#ifndef UT_CRC_H
-#define UT_CRC_H
-
-#include <stdint.h>
-#include <stddef.h>
-
-#include "dds/export.h"
-#include "dds/ddsrt/attributes.h"
-
-#if defined (__cplusplus)
-extern "C" {
-#endif
-
-DDS_EXPORT uint32_t ut_crcCalculate (const void *buf, size_t length) ddsrt_nonnull_all ddsrt_attribute_pure;
-
-#if defined (__cplusplus)
-}
-#endif
-
-#endif /* UT_CRC_H */
diff --git a/src/util/include/dds/util/ut_fibheap.h b/src/util/include/dds/util/ut_fibheap.h
deleted file mode 100644
index d02b9c8..0000000
--- a/src/util/include/dds/util/ut_fibheap.h
+++ /dev/null
@@ -1,54 +0,0 @@
-/*
- * Copyright(c) 2006 to 2018 ADLINK Technology Limited and others
- *
- * This program and the accompanying materials are made available under the
- * terms of the Eclipse Public License v. 2.0 which is available at
- * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
- * v. 1.0 which is available at
- * http://www.eclipse.org/org/documents/edl-v10.php.
- *
- * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
- */
-#ifndef UT_FIBHEAP_H
-#define UT_FIBHEAP_H
-
-#include <stdint.h>
-
-#include "dds/export.h"
-
-#if defined (__cplusplus)
-extern "C" {
-#endif
-
-typedef struct ut_fibheapNode {
-  struct ut_fibheapNode *parent, *children;
-  struct ut_fibheapNode *prev, *next;
-  unsigned mark: 1;
-  unsigned degree: 31;
-} ut_fibheapNode_t;
-
-typedef struct ut_fibheapDef {
-    uintptr_t offset;
-    int (*cmp) (const void *va, const void *vb);
-} ut_fibheapDef_t;
-
-typedef struct ut_fibheap {
-  ut_fibheapNode_t *roots; /* points to root with min key value */
-} ut_fibheap_t;
-
-#define UT_FIBHEAPDEF_INITIALIZER(offset, cmp) { (offset), (cmp) }
-
-DDS_EXPORT void ut_fibheapDefInit (ut_fibheapDef_t *fhdef, uintptr_t offset, int (*cmp) (const void *va, const void *vb));
-DDS_EXPORT void ut_fibheapInit (const ut_fibheapDef_t *fhdef, ut_fibheap_t *fh);
-DDS_EXPORT void *ut_fibheapMin (const ut_fibheapDef_t *fhdef, const ut_fibheap_t *fh);
-DDS_EXPORT void ut_fibheapMerge (const ut_fibheapDef_t *fhdef, ut_fibheap_t *a, ut_fibheap_t *b);
-DDS_EXPORT void ut_fibheapInsert (const ut_fibheapDef_t *fhdef, ut_fibheap_t *fh, const void *vnode);
-DDS_EXPORT void ut_fibheapDelete (const ut_fibheapDef_t *fhdef, ut_fibheap_t *fh, const void *vnode);
-DDS_EXPORT void *ut_fibheapExtractMin (const ut_fibheapDef_t *fhdef, ut_fibheap_t *fh);
-DDS_EXPORT void ut_fibheapDecreaseKey (const ut_fibheapDef_t *fhdef, ut_fibheap_t *fh, const void *vnode); /* to be called AFTER decreasing the key */
-
-#if defined (__cplusplus)
-}
-#endif
-
-#endif /* UT_FIBHEAP_H */
diff --git a/src/util/include/dds/util/ut_hopscotch.h b/src/util/include/dds/util/ut_hopscotch.h
deleted file mode 100644
index 9c632a8..0000000
--- a/src/util/include/dds/util/ut_hopscotch.h
+++ /dev/null
@@ -1,110 +0,0 @@
-/*
- * Copyright(c) 2006 to 2018 ADLINK Technology Limited and others
- *
- * This program and the accompanying materials are made available under the
- * terms of the Eclipse Public License v. 2.0 which is available at
- * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
- * v. 1.0 which is available at
- * http://www.eclipse.org/org/documents/edl-v10.php.
- *
- * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
- */
-#ifndef UT_HOPSCOTCH_H
-#define UT_HOPSCOTCH_H
-
-#include <stdint.h>
-
-#include "dds/export.h"
-
-#if defined (__cplusplus)
-extern "C" {
-#endif
-
-#if __STDC_VERSION__ >= 199901L
-#define UT_HH_RESTRICT restrict
-#else
-#define UT_HH_RESTRICT
-#endif
-
-/* Concurrent version */
-struct ut_chh;
-struct ut_chhBucket;
-struct ut_chhIter {
-  struct ut_chhBucket *bs;
-  uint32_t size;
-  uint32_t cursor;
-};
-
-/*
- * The hopscotch hash table is dependent on a proper functioning hash.
- * If the hash function generates a lot of hash collisions, then it will
- * not be able to handle that by design.
- * It is capable of handling some collisions, but not more than 32 per
- * bucket (less, when other hash values are clustered around the
- * collision value).
- * When proper distributed hash values are generated, then hopscotch
- * works nice and quickly.
- */
-typedef uint32_t (*ut_hhHash_fn) (const void *);
-
-/*
- * Hopscotch needs to be able to compare two elements.
- * Returns 0 when not equal.
- */
-typedef int (*ut_hhEquals_fn) (const void *, const void *);
-
-/*
- * Hopscotch is will resize its internal buckets list when needed. It will
- * call this garbage collection function with the old buckets list. The
- * caller has to delete the list when it deems it safe to do so.
- */
-typedef void (*ut_hhBucketsGc_fn) (void *);
-
-DDS_EXPORT struct ut_chh *ut_chhNew (uint32_t init_size, ut_hhHash_fn hash, ut_hhEquals_fn equals, ut_hhBucketsGc_fn gc_buckets);
-DDS_EXPORT void ut_chhFree (struct ut_chh * UT_HH_RESTRICT hh);
-DDS_EXPORT void *ut_chhLookup (struct ut_chh * UT_HH_RESTRICT rt, const void * UT_HH_RESTRICT template);
-DDS_EXPORT int ut_chhAdd (struct ut_chh * UT_HH_RESTRICT rt, const void * UT_HH_RESTRICT data);
-DDS_EXPORT int ut_chhRemove (struct ut_chh * UT_HH_RESTRICT rt, const void * UT_HH_RESTRICT template);
-DDS_EXPORT void ut_chhEnumUnsafe (struct ut_chh * UT_HH_RESTRICT rt, void (*f) (void *a, void *f_arg), void *f_arg); /* may delete a */
-void *ut_chhIterFirst (struct ut_chh * UT_HH_RESTRICT rt, struct ut_chhIter *it);
-void *ut_chhIterNext (struct ut_chhIter *it);
-
-/* Sequential version */
-struct ut_hh;
-
-struct ut_hhIter {
-    struct ut_hh *hh;
-    uint32_t cursor;
-};
-
-DDS_EXPORT struct ut_hh *ut_hhNew (uint32_t init_size, ut_hhHash_fn hash, ut_hhEquals_fn equals);
-DDS_EXPORT void ut_hhFree (struct ut_hh * UT_HH_RESTRICT hh);
-DDS_EXPORT void *ut_hhLookup (const struct ut_hh * UT_HH_RESTRICT rt, const void * UT_HH_RESTRICT template);
-DDS_EXPORT int ut_hhAdd (struct ut_hh * UT_HH_RESTRICT rt, const void * UT_HH_RESTRICT data);
-DDS_EXPORT int ut_hhRemove (struct ut_hh * UT_HH_RESTRICT rt, const void * UT_HH_RESTRICT template);
-DDS_EXPORT void ut_hhEnum (struct ut_hh * UT_HH_RESTRICT rt, void (*f) (void *a, void *f_arg), void *f_arg); /* may delete a */
-DDS_EXPORT void *ut_hhIterFirst (struct ut_hh * UT_HH_RESTRICT rt, struct ut_hhIter * UT_HH_RESTRICT iter); /* may delete nodes */
-DDS_EXPORT void *ut_hhIterNext (struct ut_hhIter * UT_HH_RESTRICT iter);
-
-/* Sequential version, embedded data */
-struct ut_ehh;
-
-struct ut_ehhIter {
-    struct ut_ehh *hh;
-    uint32_t cursor;
-};
-
-DDS_EXPORT struct ut_ehh *ut_ehhNew (size_t elemsz, uint32_t init_size, ut_hhHash_fn hash, ut_hhEquals_fn equals);
-DDS_EXPORT void ut_ehhFree (struct ut_ehh * UT_HH_RESTRICT hh);
-DDS_EXPORT void *ut_ehhLookup (const struct ut_ehh * UT_HH_RESTRICT rt, const void * UT_HH_RESTRICT template);
-DDS_EXPORT int ut_ehhAdd (struct ut_ehh * UT_HH_RESTRICT rt, const void * UT_HH_RESTRICT data);
-DDS_EXPORT int ut_ehhRemove (struct ut_ehh * UT_HH_RESTRICT rt, const void * UT_HH_RESTRICT template);
-DDS_EXPORT void ut_ehhEnum (struct ut_ehh * UT_HH_RESTRICT rt, void (*f) (void *a, void *f_arg), void *f_arg); /* may delete a */
-DDS_EXPORT void *ut_ehhIterFirst (struct ut_ehh * UT_HH_RESTRICT rt, struct ut_ehhIter * UT_HH_RESTRICT iter); /* may delete nodes */
-DDS_EXPORT void *ut_ehhIterNext (struct ut_ehhIter * UT_HH_RESTRICT iter);
-
-#if defined (__cplusplus)
-}
-#endif
-
-#endif
diff --git a/src/util/include/dds/util/ut_xmlparser.h b/src/util/include/dds/util/ut_xmlparser.h
deleted file mode 100644
index b7d5076..0000000
--- a/src/util/include/dds/util/ut_xmlparser.h
+++ /dev/null
@@ -1,52 +0,0 @@
-/*
- * Copyright(c) 2006 to 2018 ADLINK Technology Limited and others
- *
- * This program and the accompanying materials are made available under the
- * terms of the Eclipse Public License v. 2.0 which is available at
- * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
- * v. 1.0 which is available at
- * http://www.eclipse.org/org/documents/edl-v10.php.
- *
- * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
- */
-#ifndef UT_XMLPARSER_H
-#define UT_XMLPARSER_H
-
-#include <stdint.h>
-
-#include "dds/export.h"
-
-#if defined (__cplusplus)
-extern "C" {
-#endif
-
-    typedef int (*ut_xmlpProcElemOpen_t) (void *varg, uintptr_t parentinfo, uintptr_t *eleminfo, const char *name);
-    typedef int (*ut_xmlpProcAttr_t) (void *varg, uintptr_t eleminfo, const char *name, const char *value);
-    typedef int (*ut_xmlpProcElemData_t) (void *varg, uintptr_t eleminfo, const char *data);
-    typedef int (*ut_xmlpProcElemClose_t) (void *varg, uintptr_t eleminfo);
-    typedef void (*ut_xmlpError) (void *varg, const char *msg, int line);
-
-    struct ut_xmlpCallbacks {
-        ut_xmlpProcElemOpen_t elem_open;
-        ut_xmlpProcAttr_t attr;
-        ut_xmlpProcElemData_t elem_data;
-        ut_xmlpProcElemClose_t elem_close;
-        ut_xmlpError error;
-    };
-
-    struct ut_xmlpState;
-
-    DDS_EXPORT struct ut_xmlpState *ut_xmlpNewFile (FILE *fp, void *varg, const struct ut_xmlpCallbacks *cb);
-    DDS_EXPORT struct ut_xmlpState *ut_xmlpNewString (const char *string, void *varg, const struct ut_xmlpCallbacks *cb);
-    DDS_EXPORT void ut_xmlpSetRequireEOF (struct ut_xmlpState *st, int require_eof);
-    DDS_EXPORT size_t ut_xmlpGetBufpos (const struct ut_xmlpState *st);
-    DDS_EXPORT void ut_xmlpFree (struct ut_xmlpState *st);
-    DDS_EXPORT int ut_xmlpParse (struct ut_xmlpState *st);
-
-    DDS_EXPORT int ut_xmlUnescapeInsitu (char *buffer, size_t *n);
-
-#if defined (__cplusplus)
-}
-#endif
-
-#endif
diff --git a/src/util/src/ut_crc.c b/src/util/src/ut_crc.c
deleted file mode 100644
index 87778a9..0000000
--- a/src/util/src/ut_crc.c
+++ /dev/null
@@ -1,74 +0,0 @@
-/*
- * Copyright(c) 2006 to 2018 ADLINK Technology Limited and others
- *
- * This program and the accompanying materials are made available under the
- * terms of the Eclipse Public License v. 2.0 which is available at
- * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
- * v. 1.0 which is available at
- * http://www.eclipse.org/org/documents/edl-v10.php.
- *
- * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
- */
-#include "dds/util/ut_crc.h"
-
-static const uint32_t crc32_table[] = {
-  0x00000000, 0x04c11db7, 0x09823b6e, 0x0d4326d9, 0x130476dc, 0x17c56b6b,
-  0x1a864db2, 0x1e475005, 0x2608edb8, 0x22c9f00f, 0x2f8ad6d6, 0x2b4bcb61,
-  0x350c9b64, 0x31cd86d3, 0x3c8ea00a, 0x384fbdbd, 0x4c11db70, 0x48d0c6c7,
-  0x4593e01e, 0x4152fda9, 0x5f15adac, 0x5bd4b01b, 0x569796c2, 0x52568b75,
-  0x6a1936c8, 0x6ed82b7f, 0x639b0da6, 0x675a1011, 0x791d4014, 0x7ddc5da3,
-  0x709f7b7a, 0x745e66cd, 0x9823b6e0, 0x9ce2ab57, 0x91a18d8e, 0x95609039,
-  0x8b27c03c, 0x8fe6dd8b, 0x82a5fb52, 0x8664e6e5, 0xbe2b5b58, 0xbaea46ef,
-  0xb7a96036, 0xb3687d81, 0xad2f2d84, 0xa9ee3033, 0xa4ad16ea, 0xa06c0b5d,
-  0xd4326d90, 0xd0f37027, 0xddb056fe, 0xd9714b49, 0xc7361b4c, 0xc3f706fb,
-  0xceb42022, 0xca753d95, 0xf23a8028, 0xf6fb9d9f, 0xfbb8bb46, 0xff79a6f1,
-  0xe13ef6f4, 0xe5ffeb43, 0xe8bccd9a, 0xec7dd02d, 0x34867077, 0x30476dc0,
-  0x3d044b19, 0x39c556ae, 0x278206ab, 0x23431b1c, 0x2e003dc5, 0x2ac12072,
-  0x128e9dcf, 0x164f8078, 0x1b0ca6a1, 0x1fcdbb16, 0x018aeb13, 0x054bf6a4,
-  0x0808d07d, 0x0cc9cdca, 0x7897ab07, 0x7c56b6b0, 0x71159069, 0x75d48dde,
-  0x6b93dddb, 0x6f52c06c, 0x6211e6b5, 0x66d0fb02, 0x5e9f46bf, 0x5a5e5b08,
-  0x571d7dd1, 0x53dc6066, 0x4d9b3063, 0x495a2dd4, 0x44190b0d, 0x40d816ba,
-  0xaca5c697, 0xa864db20, 0xa527fdf9, 0xa1e6e04e, 0xbfa1b04b, 0xbb60adfc,
-  0xb6238b25, 0xb2e29692, 0x8aad2b2f, 0x8e6c3698, 0x832f1041, 0x87ee0df6,
-  0x99a95df3, 0x9d684044, 0x902b669d, 0x94ea7b2a, 0xe0b41de7, 0xe4750050,
-  0xe9362689, 0xedf73b3e, 0xf3b06b3b, 0xf771768c, 0xfa325055, 0xfef34de2,
-  0xc6bcf05f, 0xc27dede8, 0xcf3ecb31, 0xcbffd686, 0xd5b88683, 0xd1799b34,
-  0xdc3abded, 0xd8fba05a, 0x690ce0ee, 0x6dcdfd59, 0x608edb80, 0x644fc637,
-  0x7a089632, 0x7ec98b85, 0x738aad5c, 0x774bb0eb, 0x4f040d56, 0x4bc510e1,
-  0x46863638, 0x42472b8f, 0x5c007b8a, 0x58c1663d, 0x558240e4, 0x51435d53,
-  0x251d3b9e, 0x21dc2629, 0x2c9f00f0, 0x285e1d47, 0x36194d42, 0x32d850f5,
-  0x3f9b762c, 0x3b5a6b9b, 0x0315d626, 0x07d4cb91, 0x0a97ed48, 0x0e56f0ff,
-  0x1011a0fa, 0x14d0bd4d, 0x19939b94, 0x1d528623, 0xf12f560e, 0xf5ee4bb9,
-  0xf8ad6d60, 0xfc6c70d7, 0xe22b20d2, 0xe6ea3d65, 0xeba91bbc, 0xef68060b,
-  0xd727bbb6, 0xd3e6a601, 0xdea580d8, 0xda649d6f, 0xc423cd6a, 0xc0e2d0dd,
-  0xcda1f604, 0xc960ebb3, 0xbd3e8d7e, 0xb9ff90c9, 0xb4bcb610, 0xb07daba7,
-  0xae3afba2, 0xaafbe615, 0xa7b8c0cc, 0xa379dd7b, 0x9b3660c6, 0x9ff77d71,
-  0x92b45ba8, 0x9675461f, 0x8832161a, 0x8cf30bad, 0x81b02d74, 0x857130c3,
-  0x5d8a9099, 0x594b8d2e, 0x5408abf7, 0x50c9b640, 0x4e8ee645, 0x4a4ffbf2,
-  0x470cdd2b, 0x43cdc09c, 0x7b827d21, 0x7f436096, 0x7200464f, 0x76c15bf8,
-  0x68860bfd, 0x6c47164a, 0x61043093, 0x65c52d24, 0x119b4be9, 0x155a565e,
-  0x18197087, 0x1cd86d30, 0x029f3d35, 0x065e2082, 0x0b1d065b, 0x0fdc1bec,
-  0x3793a651, 0x3352bbe6, 0x3e119d3f, 0x3ad08088, 0x2497d08d, 0x2056cd3a,
-  0x2d15ebe3, 0x29d4f654, 0xc5a92679, 0xc1683bce, 0xcc2b1d17, 0xc8ea00a0,
-  0xd6ad50a5, 0xd26c4d12, 0xdf2f6bcb, 0xdbee767c, 0xe3a1cbc1, 0xe760d676,
-  0xea23f0af, 0xeee2ed18, 0xf0a5bd1d, 0xf464a0aa, 0xf9278673, 0xfde69bc4,
-  0x89b8fd09, 0x8d79e0be, 0x803ac667, 0x84fbdbd0, 0x9abc8bd5, 0x9e7d9662,
-  0x933eb0bb, 0x97ffad0c, 0xafb010b1, 0xab710d06, 0xa6322bdf, 0xa2f33668,
-  0xbcb4666d, 0xb8757bda, 0xb5365d03, 0xb1f740b4
-};
-
-uint32_t ut_crcCalculate (const void *buf, size_t length)
-{
-  const unsigned char *vptr = buf;
-  size_t i;
-  uint32_t reg = 0;
-  unsigned char top;
-  for (i = 0; i < length; i++)
-  {
-    top = (unsigned char) (reg >> 24);
-    top ^= *vptr;
-    reg = (reg << 8) ^ crc32_table[top];
-    vptr++;
-  }
-  return reg;
-}
diff --git a/src/util/tests/CMakeLists.txt b/src/util/tests/CMakeLists.txt
deleted file mode 100644
index 7828517..0000000
--- a/src/util/tests/CMakeLists.txt
+++ /dev/null
@@ -1,15 +0,0 @@
-#
-# Copyright(c) 2006 to 2018 ADLINK Technology Limited and others
-#
-# This program and the accompanying materials are made available under the
-# terms of the Eclipse Public License v. 2.0 which is available at
-# http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
-# v. 1.0 which is available at
-# http://www.eclipse.org/org/documents/edl-v10.php.
-#
-# SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
-#
-include(CUnit)
-
-#add_cunit_executable(CUnit_util "handleserver.c")
-#target_link_libraries(CUnit_util util)

From 986db690b82e2a84d4d8684c0655259acd5ecee9 Mon Sep 17 00:00:00 2001
From: Erik Boasson <eb@ilities.com>
Date: Tue, 16 Apr 2019 15:22:04 +0200
Subject: [PATCH 035/238] always append 0 byte to user/group/topic data

Changes the semantics of dds_qget_{user,group,topic}data to always
append a 0 byte to any non-empty value without counting it in the size.
(An empty value is always represented by a null pointer and a size of
0).  The advantage is that any code treating the data as the octet
sequence it formally is will do exactly the same, but any code written
with the knowledge that it should be a string can safely interpret it as
one.

Signed-off-by: Erik Boasson <eb@ilities.com>
---
 src/core/ddsc/include/dds/ddsc/dds_public_qos.h |  6 +++---
 src/core/ddsc/src/dds_qos.c                     | 10 ++++++----
 src/core/ddsi/src/q_plist.c                     |  6 +++---
 3 files changed, 12 insertions(+), 10 deletions(-)

diff --git a/src/core/ddsc/include/dds/ddsc/dds_public_qos.h b/src/core/ddsc/include/dds/ddsc/dds_public_qos.h
index 95fa4fe..b8fc7fa 100644
--- a/src/core/ddsc/include/dds/ddsc/dds_public_qos.h
+++ b/src/core/ddsc/include/dds/ddsc/dds_public_qos.h
@@ -501,7 +501,7 @@ DDS_EXPORT void dds_qset_ignorelocal (
  * @brief Get the userdata from a qos structure
  *
  * @param[in] qos - Pointer to a dds_qos_t structure storing the policy
- * @param[in,out] value - Pointer that will store the userdata
+ * @param[in,out] value - Pointer that will store the userdata.  If sz = 0, then a null pointer, else it is a pointer to an allocated buffer of sz+1 bytes where the last byte is always 0
  * @param[in,out] sz - Pointer that will store the size of userdata
  *
  * @returns - false iff any of the arguments is invalid or the qos is not present in the qos object
@@ -512,7 +512,7 @@ DDS_EXPORT bool dds_qget_userdata (const dds_qos_t * __restrict qos, void **valu
  * @brief Get the topicdata from a qos structure
  *
  * @param[in] qos - Pointer to a dds_qos_t structure storing the policy
- * @param[in,out] value - Pointer that will store the topicdata
+ * @param[in,out] value - Pointer that will store the topicdata.  If sz = 0, then a null pointer, else it is a pointer to an allocated buffer of sz+1 bytes where the last byte is always 0
  * @param[in,out] sz - Pointer that will store the size of topicdata
  *
  * @returns - false iff any of the arguments is invalid or the qos is not present in the qos object
@@ -523,7 +523,7 @@ DDS_EXPORT bool dds_qget_topicdata (const dds_qos_t * __restrict qos, void **val
  * @brief Get the groupdata from a qos structure
  *
  * @param[in] qos - Pointer to a dds_qos_t structure storing the policy
- * @param[in,out] value - Pointer that will store the groupdata
+ * @param[in,out] value - Pointer that will store the groupdata.  If sz = 0, then a null pointer, else it is a pointer to an allocated buffer of sz+1 bytes where the last byte is always 0
  * @param[in,out] sz - Pointer that will store the size of groupdata
  *
  * @returns - false iff any of the arguments is invalid or the qos is not present in the qos object
diff --git a/src/core/ddsc/src/dds_qos.c b/src/core/ddsc/src/dds_qos.c
index 02988bf..d95add8 100644
--- a/src/core/ddsc/src/dds_qos.c
+++ b/src/core/ddsc/src/dds_qos.c
@@ -43,6 +43,7 @@ dds_qos_data_copy_out(
     void ** value,
     size_t * sz)
 {
+    assert (data->length < UINT32_MAX);
     if (sz == NULL && value != NULL) {
         return false;
     }
@@ -51,9 +52,10 @@ dds_qos_data_copy_out(
     }
     if (value) {
         if (data->length != 0) {
-            assert(data->value);
-            *value = dds_alloc(data->length);
-            memcpy(*value, data->value, data->length);
+            assert (data->value);
+            *value = dds_alloc (data->length + 1);
+            memcpy (*value, data->value, data->length);
+            ((char *) (*value))[data->length] = 0;
         } else {
             *value = NULL;
         }
@@ -66,7 +68,7 @@ validate_octetseq(
     const nn_octetseq_t* seq)
 {
     /* default value is NULL with length 0 */
-    return (((seq->length == 0) && (seq->value == NULL)) || (seq->length > 0));
+    return (((seq->length == 0) && (seq->value == NULL)) || (seq->length > 0 && seq->length < UINT32_MAX));
 }
 
 bool
diff --git a/src/core/ddsi/src/q_plist.c b/src/core/ddsi/src/q_plist.c
index fed7f43..d44cec1 100644
--- a/src/core/ddsi/src/q_plist.c
+++ b/src/core/ddsi/src/q_plist.c
@@ -144,7 +144,7 @@ static int validate_octetseq (const struct dd *dd, size_t *len)
   if (dd->bufsz < offsetof (struct cdroctetseq, value))
     return Q_ERR_INVALID;
   *len = dd->bswap ? bswap4u (x->len) : x->len;
-  if (*len > dd->bufsz - offsetof (struct cdroctetseq, value))
+  if (*len > dd->bufsz - offsetof (struct cdroctetseq, value) || *len >= UINT32_MAX)
     return Q_ERR_INVALID;
   return 0;
 }
@@ -158,7 +158,7 @@ static int alias_octetseq (nn_octetseq_t *oseq, const struct dd *dd)
   else
   {
     const struct cdroctetseq *x = (const struct cdroctetseq *) dd->buf;
-    assert(len <= UINT32_MAX); /* it really is an uint32_t on the wire */
+    assert(len < UINT32_MAX); /* it really is an uint32_t on the wire */
     oseq->length = (uint32_t)len;
     oseq->value = (len == 0) ? NULL : (unsigned char *) x->value;
     return 0;
@@ -167,7 +167,7 @@ static int alias_octetseq (nn_octetseq_t *oseq, const struct dd *dd)
 
 static int alias_blob (nn_octetseq_t *oseq, const struct dd *dd)
 {
-  assert (dd->bufsz <= UINT32_MAX);
+  assert (dd->bufsz < UINT32_MAX);
   oseq->length = (uint32_t)dd->bufsz;
   oseq->value = (oseq->length == 0) ? NULL : (unsigned char *) dd->buf;
   return 0;

From e350aa903c72dde99592b6082fd1fb0f9483c983 Mon Sep 17 00:00:00 2001
From: Erik Boasson <eb@ilities.com>
Date: Tue, 16 Apr 2019 17:04:21 +0200
Subject: [PATCH 036/238] suppress EHOSTUNREACH and EHOSTDOWN errors in log

Signed-off-by: Erik Boasson <eb@ilities.com>
---
 src/core/ddsi/src/ddsi_udp.c         | 2 +-
 src/ddsrt/src/sockets/posix/socket.c | 3 +++
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/src/core/ddsi/src/ddsi_udp.c b/src/core/ddsi/src/ddsi_udp.c
index a228097..0ab4489 100644
--- a/src/core/ddsi/src/ddsi_udp.c
+++ b/src/core/ddsi/src/ddsi_udp.c
@@ -167,7 +167,7 @@ static ssize_t ddsi_udp_conn_write (ddsi_tran_conn_t conn, const nn_locator_t *d
            rc != DDS_RETCODE_NOT_ALLOWED &&
            rc != DDS_RETCODE_NO_CONNECTION)
   {
-    DDS_ERROR("ddsi_udp_conn_write failed with retcode %d", rc);
+    DDS_ERROR("ddsi_udp_conn_write failed with retcode %d\n", rc);
   }
   return (rc == DDS_RETCODE_OK ? ret : -1);
 }
diff --git a/src/ddsrt/src/sockets/posix/socket.c b/src/ddsrt/src/sockets/posix/socket.c
index 35b80d8..94b7f89 100644
--- a/src/ddsrt/src/sockets/posix/socket.c
+++ b/src/ddsrt/src/sockets/posix/socket.c
@@ -455,6 +455,9 @@ send_error_to_retcode(int errnum)
     case ENOBUFS:
     case ENOMEM:
       return DDS_RETCODE_OUT_OF_RESOURCES;
+    case EHOSTUNREACH:
+    case EHOSTDOWN:
+      return DDS_RETCODE_NO_CONNECTION;
     default:
       break;
   }

From 410e0afb3b43b84bd041649b53e7b737fe7e8d4e Mon Sep 17 00:00:00 2001
From: Erik Boasson <eb@ilities.com>
Date: Fri, 19 Apr 2019 22:01:11 +0200
Subject: [PATCH 037/238] remove "Error occurred on locking entity" messages

Those should not be printed to stderr (or wherever), there are errors
returned in these cases ...

Signed-off-by: Erik Boasson <eb@ilities.com>
---
 src/core/ddsc/src/dds_entity.c      |  6 ++----
 src/core/ddsc/src/dds_instance.c    | 21 +--------------------
 src/core/ddsc/src/dds_participant.c |  1 -
 src/core/ddsc/src/dds_read.c        |  3 ---
 src/core/ddsc/src/dds_topic.c       |  2 --
 src/core/ddsc/src/dds_waitset.c     |  1 -
 6 files changed, 3 insertions(+), 31 deletions(-)

diff --git a/src/core/ddsc/src/dds_entity.c b/src/core/ddsc/src/dds_entity.c
index 6704b6e..7d62349 100644
--- a/src/core/ddsc/src/dds_entity.c
+++ b/src/core/ddsc/src/dds_entity.c
@@ -269,8 +269,8 @@ dds_return_t dds_delete_impl (dds_entity_t entity, bool keep_if_explicit)
     dds_free (e);
   }
 
-    return ret;
-  }
+  return ret;
+}
 
 dds_entity_t dds_get_parent (dds_entity_t entity)
 {
@@ -404,11 +404,9 @@ dds_return_t dds_get_listener (dds_entity_t entity, dds_listener_t *listener)
       ddsrt_mutex_unlock (&e->m_observers_lock);
       dds_entity_unlock(e);
     } else {
-      DDS_ERROR("Error occurred on locking entity\n");
       ret = DDS_ERRNO(rc);
     }
   } else {
-    DDS_ERROR("Argument listener is NULL\n");
     ret = DDS_ERRNO(DDS_RETCODE_BAD_PARAMETER);
   }
 
diff --git a/src/core/ddsc/src/dds_instance.c b/src/core/ddsc/src/dds_instance.c
index 5d15275..25156fe 100644
--- a/src/core/ddsc/src/dds_instance.c
+++ b/src/core/ddsc/src/dds_instance.c
@@ -134,18 +134,15 @@ dds_register_instance(
     dds_retcode_t rc;
 
     if(data == NULL){
-        DDS_ERROR("Argument data is NULL\n");
         ret = DDS_ERRNO(DDS_RETCODE_BAD_PARAMETER);
         goto err;
     }
     if(handle == NULL){
-        DDS_ERROR("Argument handle is NULL\n");
         ret = DDS_ERRNO(DDS_RETCODE_BAD_PARAMETER);
         goto err;
     }
     rc = dds_writer_lock(writer, &wr);
     if (rc != DDS_RETCODE_OK) {
-        DDS_ERROR("Error occurred on locking writer\n");
         ret = DDS_ERRNO(rc);
         goto err;
     }
@@ -155,7 +152,6 @@ dds_register_instance(
         *handle = inst->m_iid;
         ret = DDS_RETCODE_OK;
     } else {
-        DDS_ERROR("Unable to create instance\n");
         ret = DDS_ERRNO(DDS_RETCODE_ERROR);
     }
     thread_state_asleep (ts1);
@@ -194,19 +190,16 @@ dds_unregister_instance_ts(
     dds_writer *wr;
 
     if (data == NULL){
-        DDS_ERROR("Argument data is NULL\n");
         ret = DDS_ERRNO(DDS_RETCODE_BAD_PARAMETER);
         goto err;
     }
     if(timestamp < 0){
-        DDS_ERROR("Argument timestamp has negative value\n");
         ret = DDS_ERRNO(DDS_RETCODE_BAD_PARAMETER);
         goto err;
     }
     rc = dds_writer_lock(writer, &wr);
     if (rc != DDS_RETCODE_OK) {
-        DDS_ERROR("Error occurred on locking writer\n");
-        ret =  DDS_ERRNO(rc);
+        ret = DDS_ERRNO(rc);
         goto err;
     }
 
@@ -241,7 +234,6 @@ dds_unregister_instance_ih_ts(
 
     rc = dds_writer_lock(writer, &wr);
     if (rc != DDS_RETCODE_OK) {
-        DDS_ERROR("Error occurred on locking writer\n");
         ret = DDS_ERRNO(rc);
         goto err;
     }
@@ -264,7 +256,6 @@ dds_unregister_instance_ih_ts(
         ret = dds_write_impl (wr, sample, timestamp, action);
         ddsi_sertopic_free_sample (tp, sample, DDS_FREE_ALL);
     } else {
-        DDS_ERROR("No instance related with the provided handle is found\n");
         ret = DDS_ERRNO(DDS_RETCODE_PRECONDITION_NOT_MET);
     }
     thread_state_asleep (ts1);
@@ -294,7 +285,6 @@ dds_writedispose_ts(
         thread_state_asleep (ts1);
         dds_writer_unlock(wr);
     } else {
-        DDS_ERROR("Error occurred on locking writer\n");
         ret = DDS_ERRNO(rc);
     }
 
@@ -336,7 +326,6 @@ dds_dispose_ts(
         thread_state_asleep (ts1);
         dds_writer_unlock(wr);
     } else {
-        DDS_ERROR("Error occurred on locking writer\n");
         ret = DDS_ERRNO(rc);
     }
 
@@ -366,13 +355,11 @@ dds_dispose_ih_ts(
             ret = dds_dispose_impl (wr, sample, handle, timestamp);
             ddsi_sertopic_free_sample (tp, sample, DDS_FREE_ALL);
         } else {
-            DDS_ERROR("No instance related with the provided handle is found\n");
             ret = DDS_ERRNO(DDS_RETCODE_PRECONDITION_NOT_MET);
         }
         thread_state_asleep (ts1);
         dds_writer_unlock(wr);
     } else {
-        DDS_ERROR("Error occurred on locking writer\n");
         ret = DDS_ERRNO(rc);
     }
 
@@ -391,7 +378,6 @@ dds_lookup_instance(
     struct ddsi_serdata *sd;
 
     if(data == NULL){
-        DDS_ERROR("Argument data is NULL\n");
         goto err;
     }
 
@@ -402,8 +388,6 @@ dds_lookup_instance(
         ih = ddsi_tkmap_lookup (map, sd);
         ddsi_serdata_unref (sd);
         thread_state_asleep (ts1);
-    } else {
-        DDS_ERROR("Acquired topic is NULL\n");
     }
 err:
     return ih;
@@ -429,14 +413,12 @@ dds_instance_get_key(
     struct ddsi_tkmap_instance * tk;
 
     if(data == NULL){
-        DDS_ERROR("Argument data is NULL\n");
         ret = DDS_ERRNO(DDS_RETCODE_BAD_PARAMETER);
         goto err;
     }
 
     topic = dds_instance_info_by_hdl (entity);
     if(topic == NULL){
-        DDS_ERROR("Could not find topic related to the given entity\n");
         ret = DDS_ERRNO(DDS_RETCODE_BAD_PARAMETER);
         goto err;
     }
@@ -447,7 +429,6 @@ dds_instance_get_key(
         ddsi_tkmap_instance_unref (tk);
         ret = DDS_RETCODE_OK;
     } else {
-        DDS_ERROR("No instance related with the provided entity is found\n");
         ret = DDS_ERRNO(DDS_RETCODE_BAD_PARAMETER);
     }
     thread_state_asleep (ts1);
diff --git a/src/core/ddsc/src/dds_participant.c b/src/core/ddsc/src/dds_participant.c
index 587951a..a0c3c03 100644
--- a/src/core/ddsc/src/dds_participant.c
+++ b/src/core/ddsc/src/dds_participant.c
@@ -37,7 +37,6 @@ dds_participant_status_validate(
     dds_return_t ret = DDS_RETCODE_OK;
 
     if (mask & ~(DDS_PARTICIPANT_STATUS_MASK)) {
-        DDS_ERROR("Argument mask is invalid\n");
         ret = DDS_ERRNO(DDS_RETCODE_BAD_PARAMETER);
     }
 
diff --git a/src/core/ddsc/src/dds_read.c b/src/core/ddsc/src/dds_read.c
index d595272..5be40d1 100644
--- a/src/core/ddsc/src/dds_read.c
+++ b/src/core/ddsc/src/dds_read.c
@@ -123,7 +123,6 @@ dds_read_impl(
     thread_state_awake (ts1);
     rc = dds_read_lock(reader_or_condition, &rd, &cond, only_reader);
     if (rc != DDS_RETCODE_OK) {
-        DDS_ERROR("Error occurred on locking entity\n");
         ret = DDS_ERRNO(rc);
         goto fail_awake;
     }
@@ -223,7 +222,6 @@ dds_readcdr_impl(
       }
       dds_read_unlock(rd, cond);
   } else {
-      DDS_ERROR("Error occurred on locking entity\n");
       ret = DDS_ERRNO(rc);
   }
 
@@ -695,7 +693,6 @@ dds_return_loan(
 
     rc = dds_read_lock(reader_or_condition, &rd, &cond, false);
     if (rc != DDS_RETCODE_OK) {
-        DDS_ERROR("Error occurred on locking entity\n");
         ret = DDS_ERRNO(rc);
         goto fail;
     }
diff --git a/src/core/ddsc/src/dds_topic.c b/src/core/ddsc/src/dds_topic.c
index 636c4ae..5d62fdf 100644
--- a/src/core/ddsc/src/dds_topic.c
+++ b/src/core/ddsc/src/dds_topic.c
@@ -200,7 +200,6 @@ dds_find_topic(
             ddsrt_mutex_unlock (&dds_global.m_mutex);
             dds_entity_unlock(p);
         } else {
-            DDS_ERROR("Error occurred on locking entity\n");
             tp = DDS_ERRNO(rc);
         }
     } else {
@@ -334,7 +333,6 @@ dds_create_topic_arbitrary (
 
     rc = dds_entity_lock(participant, DDS_KIND_PARTICIPANT, &par);
     if (rc != DDS_RETCODE_OK) {
-        DDS_ERROR("Error occurred on locking entity\n");
         hdl = DDS_ERRNO(rc);
         goto lock_err;
     }
diff --git a/src/core/ddsc/src/dds_waitset.c b/src/core/ddsc/src/dds_waitset.c
index 787ce2c..4d5bd4b 100644
--- a/src/core/ddsc/src/dds_waitset.c
+++ b/src/core/ddsc/src/dds_waitset.c
@@ -217,7 +217,6 @@ dds_create_waitset(
         waitset->triggered = NULL;
         dds_entity_unlock(par);
     } else {
-        DDS_ERROR("Error occurred on locking entity\n");
         hdl = DDS_ERRNO(rc);
     }
 

From d8cfececaebed9eae622e38d71f67ffd7b25cad6 Mon Sep 17 00:00:00 2001
From: Erik Boasson <eb@ilities.com>
Date: Sat, 20 Apr 2019 17:14:23 +0200
Subject: [PATCH 038/238] Fix DATA_AVAILABLE race condition

The DATA_AVAILABLE status was reset by read and take while holding the
upper-layer reader lock, but after completing the read/take operation on
the RHC.  As data can be written into the RHC without holding the
upper-layer reader lock, new data could arrive in between the
reading/taking and the resetting of the DATA_AVAILABLE status, leading
to a missed detection.  Resetting DATA_AVAILABLE prior to accessing the
RHC solves this.

Signed-off-by: Erik Boasson <eb@ilities.com>
---
 src/core/ddsc/src/dds_read.c | 30 +++++++++++++++---------------
 1 file changed, 15 insertions(+), 15 deletions(-)

diff --git a/src/core/ddsc/src/dds_read.c b/src/core/ddsc/src/dds_read.c
index 5be40d1..6a9dc73 100644
--- a/src/core/ddsc/src/dds_read.c
+++ b/src/core/ddsc/src/dds_read.c
@@ -156,17 +156,19 @@ dds_read_impl(
             rd->m_loan_out = true;
         }
     }
+
+    /* read/take resets data available status -- must reset before reading because
+       the actual writing is protected by RHC lock, not by rd->m_entity.m_lock */
+    dds_entity_status_reset (&rd->m_entity, DDS_DATA_AVAILABLE_STATUS);
+    /* reset DATA_ON_READERS status on subscriber after successful read/take */
+    if (dds_entity_kind (rd->m_entity.m_parent) == DDS_KIND_SUBSCRIBER) {
+      dds_entity_status_reset (rd->m_entity.m_parent, DDS_DATA_ON_READERS_STATUS);
+    }
     if (take) {
         ret = (dds_return_t)dds_rhc_take(rd->m_rd->rhc, lock, buf, si, maxs, mask, hand, cond);
     } else {
         ret = (dds_return_t)dds_rhc_read(rd->m_rd->rhc, lock, buf, si, maxs, mask, hand, cond);
     }
-    /* read/take resets data available status */
-    dds_entity_status_reset(&rd->m_entity, DDS_DATA_AVAILABLE_STATUS);
-    /* reset DATA_ON_READERS status on subscriber after successful read/take */
-    if (dds_entity_kind(rd->m_entity.m_parent) == DDS_KIND_SUBSCRIBER) {
-        dds_entity_status_reset(rd->m_entity.m_parent, DDS_DATA_ON_READERS_STATUS);
-    }
     dds_read_unlock(rd, cond);
 
 fail_awake:
@@ -202,6 +204,13 @@ dds_readcdr_impl(
   thread_state_awake (ts1);
   rc = dds_read_lock(reader_or_condition, &rd, &cond, false);
   if (rc == DDS_RETCODE_OK) {
+      /* read/take resets data available status -- must reset before reading because
+         the actual writing is protected by RHC lock, not by rd->m_entity.m_lock */
+      dds_entity_status_reset (&rd->m_entity, DDS_DATA_AVAILABLE_STATUS);
+      /* reset DATA_ON_READERS status on subscriber after successful read/take */
+      if (dds_entity_kind (rd->m_entity.m_parent) == DDS_KIND_SUBSCRIBER) {
+        dds_entity_status_reset (rd->m_entity.m_parent, DDS_DATA_ON_READERS_STATUS);
+      }
       ret = dds_rhc_takecdr
         (
          rd->m_rd->rhc, lock, buf, si, maxs,
@@ -211,15 +220,6 @@ dds_readcdr_impl(
          hand
          );
 
-      /* read/take resets data available status */
-      dds_entity_status_reset(&rd->m_entity, DDS_DATA_AVAILABLE_STATUS);
-
-      /* reset DATA_ON_READERS status on subscriber after successful read/take */
-
-      if (dds_entity_kind(rd->m_entity.m_parent) == DDS_KIND_SUBSCRIBER)
-      {
-        dds_entity_status_reset(rd->m_entity.m_parent, DDS_DATA_ON_READERS_STATUS);
-      }
       dds_read_unlock(rd, cond);
   } else {
       ret = DDS_ERRNO(rc);

From 053229e5082c7aea7de16ed324c260bf23f9a194 Mon Sep 17 00:00:00 2001
From: Erik Boasson <eb@ilities.com>
Date: Sat, 20 Apr 2019 17:17:47 +0200
Subject: [PATCH 039/238] missing m_observer_lock on (re)setting statuses

Most of the places where the status flags were reset, this happened
without holding m_observer_lock protecting these status flags.  For most
of these statuses, they are only ever set/reset while also holding the
entity lock, but this is not true for all of them (DATA_AVAILABLE for
example), and thus there are some cases where retrieving the status
could lead to losing the raising of a (at least a DATA_AVAILABLE)
status.

The problem was introduced in ba46cb1140ea86c7e5321e27bc6a20dedb745ff4.

Signed-off-by: Erik Boasson <eb@ilities.com>
---
 src/core/ddsc/src/dds_read.c   |  6 ++++++
 src/core/ddsc/src/dds_reader.c | 12 ++++++++++++
 src/core/ddsc/src/dds_topic.c  |  2 ++
 src/core/ddsc/src/dds_writer.c |  8 ++++++++
 4 files changed, 28 insertions(+)

diff --git a/src/core/ddsc/src/dds_read.c b/src/core/ddsc/src/dds_read.c
index 6a9dc73..114e6ff 100644
--- a/src/core/ddsc/src/dds_read.c
+++ b/src/core/ddsc/src/dds_read.c
@@ -159,11 +159,14 @@ dds_read_impl(
 
     /* read/take resets data available status -- must reset before reading because
        the actual writing is protected by RHC lock, not by rd->m_entity.m_lock */
+    ddsrt_mutex_lock (&rd->m_entity.m_observers_lock);
     dds_entity_status_reset (&rd->m_entity, DDS_DATA_AVAILABLE_STATUS);
     /* reset DATA_ON_READERS status on subscriber after successful read/take */
     if (dds_entity_kind (rd->m_entity.m_parent) == DDS_KIND_SUBSCRIBER) {
       dds_entity_status_reset (rd->m_entity.m_parent, DDS_DATA_ON_READERS_STATUS);
     }
+    ddsrt_mutex_unlock (&rd->m_entity.m_observers_lock);
+
     if (take) {
         ret = (dds_return_t)dds_rhc_take(rd->m_rd->rhc, lock, buf, si, maxs, mask, hand, cond);
     } else {
@@ -206,11 +209,14 @@ dds_readcdr_impl(
   if (rc == DDS_RETCODE_OK) {
       /* read/take resets data available status -- must reset before reading because
          the actual writing is protected by RHC lock, not by rd->m_entity.m_lock */
+      ddsrt_mutex_lock (&rd->m_entity.m_observers_lock);
       dds_entity_status_reset (&rd->m_entity, DDS_DATA_AVAILABLE_STATUS);
       /* reset DATA_ON_READERS status on subscriber after successful read/take */
       if (dds_entity_kind (rd->m_entity.m_parent) == DDS_KIND_SUBSCRIBER) {
         dds_entity_status_reset (rd->m_entity.m_parent, DDS_DATA_ON_READERS_STATUS);
       }
+      ddsrt_mutex_unlock (&rd->m_entity.m_observers_lock);
+
       ret = dds_rhc_takecdr
         (
          rd->m_rd->rhc, lock, buf, si, maxs,
diff --git a/src/core/ddsc/src/dds_reader.c b/src/core/ddsc/src/dds_reader.c
index 10951e2..6ce57b9 100644
--- a/src/core/ddsc/src/dds_reader.c
+++ b/src/core/ddsc/src/dds_reader.c
@@ -643,11 +643,13 @@ dds_get_subscription_matched_status (
     if (status) {
         *status = rd->m_subscription_matched_status;
     }
+    ddsrt_mutex_lock (&rd->m_entity.m_observers_lock);
     if (rd->m_entity.m_status_enable & DDS_SUBSCRIPTION_MATCHED_STATUS) {
         rd->m_subscription_matched_status.total_count_change = 0;
         rd->m_subscription_matched_status.current_count_change = 0;
         dds_entity_status_reset(&rd->m_entity, DDS_SUBSCRIPTION_MATCHED_STATUS);
     }
+    ddsrt_mutex_unlock (&rd->m_entity.m_observers_lock);
     dds_reader_unlock(rd);
 fail:
     return ret;
@@ -672,11 +674,13 @@ dds_get_liveliness_changed_status (
     if (status) {
         *status = rd->m_liveliness_changed_status;
     }
+    ddsrt_mutex_lock (&rd->m_entity.m_observers_lock);
     if (rd->m_entity.m_status_enable & DDS_LIVELINESS_CHANGED_STATUS) {
         rd->m_liveliness_changed_status.alive_count_change = 0;
         rd->m_liveliness_changed_status.not_alive_count_change = 0;
         dds_entity_status_reset(&rd->m_entity, DDS_LIVELINESS_CHANGED_STATUS);
     }
+    ddsrt_mutex_unlock (&rd->m_entity.m_observers_lock);
     dds_reader_unlock(rd);
 fail:
     return ret;
@@ -700,11 +704,13 @@ dds_return_t dds_get_sample_rejected_status (
     if (status) {
         *status = rd->m_sample_rejected_status;
     }
+    ddsrt_mutex_lock (&rd->m_entity.m_observers_lock);
     if (rd->m_entity.m_status_enable & DDS_SAMPLE_REJECTED_STATUS) {
         rd->m_sample_rejected_status.total_count_change = 0;
         rd->m_sample_rejected_status.last_reason = DDS_NOT_REJECTED;
         dds_entity_status_reset(&rd->m_entity, DDS_SAMPLE_REJECTED_STATUS);
     }
+    ddsrt_mutex_unlock (&rd->m_entity.m_observers_lock);
     dds_reader_unlock(rd);
 fail:
     return ret;
@@ -728,10 +734,12 @@ dds_return_t dds_get_sample_lost_status (
     if (status) {
         *status = rd->m_sample_lost_status;
     }
+    ddsrt_mutex_lock (&rd->m_entity.m_observers_lock);
     if (rd->m_entity.m_status_enable & DDS_SAMPLE_LOST_STATUS) {
         rd->m_sample_lost_status.total_count_change = 0;
         dds_entity_status_reset(&rd->m_entity, DDS_SAMPLE_LOST_STATUS);
     }
+    ddsrt_mutex_unlock (&rd->m_entity.m_observers_lock);
     dds_reader_unlock(rd);
 fail:
     return ret;
@@ -755,10 +763,12 @@ dds_return_t dds_get_requested_deadline_missed_status (
     if (status) {
         *status = rd->m_requested_deadline_missed_status;
     }
+    ddsrt_mutex_lock (&rd->m_entity.m_observers_lock);
     if (rd->m_entity.m_status_enable & DDS_REQUESTED_DEADLINE_MISSED_STATUS) {
         rd->m_requested_deadline_missed_status.total_count_change = 0;
         dds_entity_status_reset(&rd->m_entity, DDS_REQUESTED_DEADLINE_MISSED_STATUS);
     }
+    ddsrt_mutex_unlock (&rd->m_entity.m_observers_lock);
     dds_reader_unlock(rd);
 fail:
     return ret;
@@ -782,10 +792,12 @@ dds_return_t dds_get_requested_incompatible_qos_status (
     if (status) {
         *status = rd->m_requested_incompatible_qos_status;
     }
+    ddsrt_mutex_lock (&rd->m_entity.m_observers_lock);
     if (rd->m_entity.m_status_enable & DDS_REQUESTED_INCOMPATIBLE_QOS_STATUS) {
         rd->m_requested_incompatible_qos_status.total_count_change = 0;
         dds_entity_status_reset(&rd->m_entity, DDS_REQUESTED_INCOMPATIBLE_QOS_STATUS);
     }
+    ddsrt_mutex_unlock (&rd->m_entity.m_observers_lock);
     dds_reader_unlock(rd);
 fail:
     return ret;
diff --git a/src/core/ddsc/src/dds_topic.c b/src/core/ddsc/src/dds_topic.c
index 5d62fdf..f834f00 100644
--- a/src/core/ddsc/src/dds_topic.c
+++ b/src/core/ddsc/src/dds_topic.c
@@ -669,10 +669,12 @@ dds_get_inconsistent_topic_status(
     if (status) {
         *status = t->m_inconsistent_topic_status;
     }
+    ddsrt_mutex_lock (&t->m_entity.m_observers_lock);
     if (t->m_entity.m_status_enable & DDS_INCONSISTENT_TOPIC_STATUS) {
         t->m_inconsistent_topic_status.total_count_change = 0;
         dds_entity_status_reset(&t->m_entity, DDS_INCONSISTENT_TOPIC_STATUS);
     }
+    ddsrt_mutex_unlock (&t->m_entity.m_observers_lock);
     dds_topic_unlock(t);
 fail:
     return ret;
diff --git a/src/core/ddsc/src/dds_writer.c b/src/core/ddsc/src/dds_writer.c
index cd83d3e..f98d70c 100644
--- a/src/core/ddsc/src/dds_writer.c
+++ b/src/core/ddsc/src/dds_writer.c
@@ -518,11 +518,13 @@ dds_get_publication_matched_status (
     if (status) {
         *status = wr->m_publication_matched_status;
     }
+    ddsrt_mutex_lock (&wr->m_entity.m_observers_lock);
     if (wr->m_entity.m_status_enable & DDS_PUBLICATION_MATCHED_STATUS) {
         wr->m_publication_matched_status.total_count_change = 0;
         wr->m_publication_matched_status.current_count_change = 0;
         dds_entity_status_reset(&wr->m_entity, DDS_PUBLICATION_MATCHED_STATUS);
     }
+    ddsrt_mutex_unlock (&wr->m_entity.m_observers_lock);
     dds_writer_unlock(wr);
 fail:
     return ret;
@@ -547,10 +549,12 @@ dds_get_liveliness_lost_status (
     if (status) {
       *status = wr->m_liveliness_lost_status;
     }
+    ddsrt_mutex_lock (&wr->m_entity.m_observers_lock);
     if (wr->m_entity.m_status_enable & DDS_LIVELINESS_LOST_STATUS) {
       wr->m_liveliness_lost_status.total_count_change = 0;
       dds_entity_status_reset(&wr->m_entity, DDS_LIVELINESS_LOST_STATUS);
     }
+    ddsrt_mutex_unlock (&wr->m_entity.m_observers_lock);
     dds_writer_unlock(wr);
 fail:
     return ret;
@@ -575,10 +579,12 @@ dds_get_offered_deadline_missed_status(
     if (status) {
       *status = wr->m_offered_deadline_missed_status;
     }
+    ddsrt_mutex_lock (&wr->m_entity.m_observers_lock);
     if (wr->m_entity.m_status_enable & DDS_OFFERED_DEADLINE_MISSED_STATUS) {
       wr->m_offered_deadline_missed_status.total_count_change = 0;
       dds_entity_status_reset(&wr->m_entity, DDS_OFFERED_DEADLINE_MISSED_STATUS);
     }
+    ddsrt_mutex_unlock (&wr->m_entity.m_observers_lock);
     dds_writer_unlock(wr);
 fail:
     return ret;
@@ -603,10 +609,12 @@ dds_get_offered_incompatible_qos_status (
     if (status) {
       *status = wr->m_offered_incompatible_qos_status;
     }
+    ddsrt_mutex_lock (&wr->m_entity.m_observers_lock);
     if (wr->m_entity.m_status_enable & DDS_OFFERED_INCOMPATIBLE_QOS_STATUS) {
       wr->m_offered_incompatible_qos_status.total_count_change = 0;
       dds_entity_status_reset(&wr->m_entity, DDS_OFFERED_INCOMPATIBLE_QOS_STATUS);
     }
+    ddsrt_mutex_unlock (&wr->m_entity.m_observers_lock);
     dds_writer_unlock(wr);
 fail:
     return ret;

From 8c6055f92cd013d693951c774f320ae1629b08ca Mon Sep 17 00:00:00 2001
From: Erik Boasson <eb@ilities.com>
Date: Mon, 15 Apr 2019 11:52:43 +0200
Subject: [PATCH 040/238] initial version of permance/network check tool

The current situation for performance measurements and checking network
behaviour is rather unsatisfactory, as the only tools available are
``pubsub`` and the ``roundtrip`` and ``throughput`` examples.  The first
can do many things thanks to its thousand-and-one options, but its
purpose really is to be able to read/write arbitrary data with arbitrary
QoS -- though the arbitrary data bit was lost in the hacked conversion
from the original code.  The latter two have a terrible user interface,
don't perform any verification that the measurement was successful and
do not provide the results in a convenient form.

Furthermore, the abuse of the two examples as the primary means for
measuring performance has resulted in a reduction of their value as an
example, e.g., they can do waitset- or listener-based reading (and the
throughput one also polling-based), but that kind of complication does
not help a new user understand what is going on.  Especially not given
that these features were simply hacked in.

Hence the need for a new tool, one that integrates the common
measurements and can be used to verify that the results make sense.  It
is not quite done yet, in particular it is lacking in a number of
aspects:

* no measurement of CPU- and network load, memory usage and context
  switches yet;
* very limited statistics (min/max/average, if you're lucky; no
  interesting things such as jitter on a throughput test yet);
* it can't yet gather the data from all participants in the network
  using DDS;
* it doesn't output the data in a convenient file format yet;
* it doesn't allow specifying boundaries within which the results
  must fall for the run to be successful.

What it does verify is that all the endpoint matches that should exist
given the discovered participant do in fact come into existence,
reporting an error (and exiting with an exit status code of 1) if they
don't, as well as checking the number of participants.  With the way the
DDSI protocol works, this is a pretty decent network connectivity check.

The raw measurements needed for the desired statistics (apart from
system-level measurements) are pretty much made, so the main thing that
still needs to be done is exploit them and output them.  It can already
replace the examples for most benchmarks (only the 50%/90%/99%
percentiles are still missing for a complete replacement).

Signed-off-by: Erik Boasson <eb@ilities.com>
---
 src/core/ddsc/src/dds_read.c        |    5 +-
 src/tools/CMakeLists.txt            |    1 +
 src/tools/ddsperf/CMakeLists.txt    |   23 +
 src/tools/ddsperf/ddsperf.c         | 2036 +++++++++++++++++++++++++++
 src/tools/ddsperf/ddsperf_types.idl |   29 +
 5 files changed, 2091 insertions(+), 3 deletions(-)
 create mode 100644 src/tools/ddsperf/CMakeLists.txt
 create mode 100644 src/tools/ddsperf/ddsperf.c
 create mode 100644 src/tools/ddsperf/ddsperf_types.idl

diff --git a/src/core/ddsc/src/dds_read.c b/src/core/ddsc/src/dds_read.c
index 114e6ff..37e35ec 100644
--- a/src/core/ddsc/src/dds_read.c
+++ b/src/core/ddsc/src/dds_read.c
@@ -686,13 +686,12 @@ dds_return_loan(
     dds_readcond *cond;
     dds_return_t ret = DDS_RETCODE_OK;
 
-    if (!buf ) {
+    if (!buf) {
         DDS_ERROR("Argument buf is NULL\n");
         ret = DDS_ERRNO(DDS_RETCODE_BAD_PARAMETER);
         goto fail;
     }
-    if(*buf == NULL && bufsz > 0){
-        DDS_ERROR("Argument buf is NULL\n");
+    if (*buf == NULL && bufsz > 0) {
         ret = DDS_ERRNO(DDS_RETCODE_BAD_PARAMETER);
         goto fail;
     }
diff --git a/src/tools/CMakeLists.txt b/src/tools/CMakeLists.txt
index 7e615a1..9c2d51c 100644
--- a/src/tools/CMakeLists.txt
+++ b/src/tools/CMakeLists.txt
@@ -13,6 +13,7 @@ set(CMAKE_INSTALL_TOOLSDIR "${CMAKE_INSTALL_DATADIR}/${CMAKE_PROJECT_NAME}/tools
 add_subdirectory(pubsub)
 add_subdirectory(config)
 add_subdirectory(ddsls)
+add_subdirectory(ddsperf)
 
 # VxWorks build machines use OpenJDK 8, which lack jfxrt.jar. Do not build launcher on that platform.
 #
diff --git a/src/tools/ddsperf/CMakeLists.txt b/src/tools/ddsperf/CMakeLists.txt
new file mode 100644
index 0000000..c1c12e0
--- /dev/null
+++ b/src/tools/ddsperf/CMakeLists.txt
@@ -0,0 +1,23 @@
+#
+# Copyright(c) 2006 to 2018 ADLINK Technology Limited and others
+#
+# This program and the accompanying materials are made available under the
+# terms of the Eclipse Public License v. 2.0 which is available at
+# http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+# v. 1.0 which is available at
+# http://www.eclipse.org/org/documents/edl-v10.php.
+#
+# SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+#
+idlc_generate(ddsperf_types ddsperf_types.idl)
+add_executable(ddsperf ddsperf.c)
+target_link_libraries(ddsperf ddsperf_types ddsc)
+if(WIN32)
+  target_compile_definitions(ddsperf PRIVATE _CRT_SECURE_NO_WARNINGS)
+endif()
+
+install(
+  TARGETS ddsperf
+  DESTINATION "${CMAKE_INSTALL_BINDIR}"
+  COMPONENT dev
+)
diff --git a/src/tools/ddsperf/ddsperf.c b/src/tools/ddsperf/ddsperf.c
new file mode 100644
index 0000000..51874a4
--- /dev/null
+++ b/src/tools/ddsperf/ddsperf.c
@@ -0,0 +1,2036 @@
+/*
+ * Copyright(c) 2019 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+#define _ISOC99_SOURCE
+#include <stdio.h>
+#include <string.h>
+#include <stdlib.h>
+#include <stdint.h>
+#include <stdbool.h>
+#include <signal.h>
+#include <assert.h>
+#include <limits.h>
+#include <math.h>
+#ifndef _WIN32
+#include <errno.h>
+#endif
+#include <getopt.h>
+
+#include "dds/dds.h"
+#include "ddsperf_types.h"
+
+#include "dds/ddsrt/process.h"
+#include "dds/ddsrt/string.h"
+#include "dds/ddsrt/sync.h"
+#include "dds/ddsrt/sockets.h"
+#include "dds/ddsrt/threads.h"
+#include "dds/ddsrt/random.h"
+#include "dds/ddsrt/avl.h"
+#include "dds/ddsrt/fibheap.h"
+
+#define UDATA_MAGIC "DDSPerf:"
+#define UDATA_MAGIC_SIZE (sizeof (UDATA_MAGIC) - 1)
+
+enum topicsel {
+  KS,   /* KeyedSeq type: seq#, key, sequence-of-octet */
+  K32,  /* Keyed32  type: seq#, key, array-of-24-octet (sizeof = 32) */
+  K256, /* Keyed256 type: seq#, key, array-of-248-octet (sizeof = 256) */
+  OU    /* OneULong type: seq# */
+};
+
+enum submode {
+  SM_NONE,    /* no subscriber at all */
+  SM_WAITSET, /* subscriber using a waitset */
+  SM_POLLING, /* ... using polling, sleeping for 1ms if no data */
+  SM_LISTENER /* ... using a DATA_AVAILABLE listener */
+};
+
+static const char *argv0;
+static volatile sig_atomic_t termflag = 0;
+
+/* Domain participant, guard condition for termination, domain id */
+static dds_entity_t dp;
+static dds_instance_handle_t dp_handle;
+static dds_entity_t termcond;
+static dds_domainid_t did = DDS_DOMAIN_DEFAULT;
+
+/* Readers for built-in topics to get discovery information */
+static dds_entity_t rd_participants, rd_subscriptions, rd_publications;
+
+/* Topics, readers, writers (except for pong writers: there are
+   many of those) */
+static dds_entity_t tp_data, tp_ping, tp_pong;
+static char tpname_data[32], tpname_ping[32], tpname_pong[32];
+static dds_entity_t sub, pub, wr_data, wr_ping, rd_data, rd_ping, rd_pong;
+
+/* Number of different key values to use (must be 1 for OU type) */
+static unsigned nkeyvals = 1;
+
+/* Topic type to use */
+static enum topicsel topicsel = OU;
+
+/* Data and ping/pong subscriber triggering modes */
+static enum submode submode = SM_LISTENER;
+static enum submode pingpongmode = SM_LISTENER;
+
+/* Size of the sequence in KeyedSeq type in bytes */
+static unsigned baggagesize = 0;
+
+/* Whether or not to register instances prior to writing */
+static bool register_instances = true;
+
+/* Maximum run time in seconds */
+static double dur = HUGE_VAL;
+
+/* Minimum number of peers (if not met, exit status is 1) */
+static uint32_t minmatch = 0;
+
+/* Maximum time it may take to discover all MINMATCH peers */
+static double maxwait = HUGE_VAL;
+
+/* Number of participants for which all expected endpoints
+   have been matched (this includes the local participant
+   if ignorelocal is DDS_IGNORELOCAL_NONE) [protected by
+   disc_lock] */
+static uint32_t matchcount = 0;
+
+/* An error is always signalled if not all endpoints of a
+   participant have been discovered within a set amount of
+   time (5s, currently) [protected by disc_lock] */
+static uint32_t matchtimeout = 0;
+
+/* Data is published in bursts of this many samples */
+static unsigned burstsize = 1;
+
+/* Whether to use reliable or best-effort readers/writers */
+static bool reliable = true;
+
+/* History depth for throughput data reader and writer; 0 is
+   KEEP_ALL, otherwise it is KEEP_LAST histdepth.  Ping/pong
+   always uses KEEP_LAST 1. */
+static int32_t histdepth = 0;
+
+/* Publishing rate in Hz, HUGE_VAL means as fast as possible,
+   0 means no throughput data is published at all */
+static double rate;
+
+/* Fraction of throughput data samples that double as a ping
+   message */
+static uint32_t ping_frac = 0;
+
+/* Setting for "ignore local" reader/writer QoS: whether or
+   not to ignore readers and writers in the same particiapnt
+   that would otherwise match */
+static dds_ignorelocal_kind_t ignorelocal = DDS_IGNORELOCAL_PARTICIPANT;
+
+/* Pinging interval for roundtrip testing, 0 means as fast as
+   possible, DDS_INFINITY means never */
+static dds_duration_t ping_intv;
+
+static ddsrt_mutex_t disc_lock;
+
+/* Publisher statistics and lock protecting it */
+struct hist {
+  unsigned nbins;
+  uint64_t binwidth;
+  uint64_t bin0; /* bins are [bin0,bin0+binwidth),[bin0+binwidth,bin0+2*binwidth) */
+  uint64_t binN; /* bin0 + nbins*binwidth */
+  uint64_t min, max; /* min and max observed since last reset */
+  uint64_t under, over; /* < bin0, >= binN */
+  uint64_t bins[];
+};
+
+static ddsrt_mutex_t pubstat_lock;
+static struct hist *pubstat_hist;
+
+/* Subscriber statistics for tracking number of samples received
+   and lost per source */
+struct eseq_stat {
+  /* totals */
+  uint64_t nrecv;
+  uint64_t nlost;
+  uint64_t nrecv_bytes;
+
+  /* stats printer state */
+  uint64_t nrecv_ref;
+  uint64_t nlost_ref;
+  uint64_t nrecv_bytes_ref;
+};
+
+struct eseq_admin {
+  ddsrt_mutex_t lock;
+  unsigned nkeys;
+  unsigned nph;
+  dds_instance_handle_t *ph;
+  struct eseq_stat *stats;
+  uint32_t **eseq;
+};
+
+static struct eseq_admin eseq_admin;
+
+/* Entry for mapping ping/data publication handle to pong writer */
+struct subthread_arg_pongwr {
+  dds_instance_handle_t pubhandle;
+  dds_instance_handle_t pphandle;
+  dds_entity_t wr_pong;
+};
+
+/* Entry for mapping pong publication handle to latency statistics */
+struct subthread_arg_pongstat {
+  dds_instance_handle_t pubhandle;
+  dds_instance_handle_t pphandle;
+  uint64_t min, max;
+  uint64_t sum;
+  uint32_t cnt;
+};
+
+/* Pong statistics is stored in n array of npongstat entries
+   [protected by pongstat_lock] */
+static ddsrt_mutex_t pongstat_lock;
+static uint32_t npongstat;
+static struct subthread_arg_pongstat *pongstat;
+
+/* All topics have a sequence number, this is the one of the
+   latest ping sent and the number of pongs received for that
+   sequence number.  Also the time at which it was sent for
+   generating new ping messages in the case of loss of topology
+   changes, and a timestamp after which a warning is printed
+   when a new ping is published.  [All protected by
+   pongwr_lock] */
+static dds_time_t cur_ping_time;
+static dds_time_t twarn_ping_timeout;
+static uint32_t cur_ping_seq;
+static uint32_t n_pong_seen;
+
+/* Number of pongs expected for each ping [protected by
+   pongwr_lock] */
+static uint32_t n_pong_expected;
+
+/* Table mapping data and ping publication handles to writers
+   of pongs (one per participant in a unique partition so that
+   a participant only receives responses to its own pings) is
+   a simply array of npongwr entries [protected by pongwr_lock] */
+static ddsrt_mutex_t pongwr_lock;
+static uint32_t npongwr;
+static struct subthread_arg_pongwr *pongwr;
+
+/* Each subscriber thread gets its own not-quite-pre-allocated
+   set of samples (it does use a loan, but that loan gets reused) */
+struct subthread_arg {
+  dds_entity_t rd;
+  uint32_t max_samples;
+  dds_sample_info_t *iseq;
+  void **mseq;
+};
+
+/* Type used for converting GUIDs to strings, used for generating
+   the per-participant partition names */
+struct guidstr {
+  char str[36];
+};
+
+/* Endpoints that can be matched; all endpoints except for a data
+   subscriber always exist; the data subscriber is only created if
+   requested */
+#define MM_RD_DATA   1u
+#define MM_RD_PING   2u
+#define MM_RD_PONG   4u
+#define MM_WR_DATA   8u
+#define MM_WR_PING  16u
+#define MM_WR_PONG  32u
+#define MM_ALL (2 * MM_WR_PONG - 1)
+
+struct ppant {
+  ddsrt_avl_node_t avlnode;     /* embedded AVL node for handle index */
+  ddsrt_fibheap_node_t fhnode;  /* prio queue for timeout handling */
+  dds_instance_handle_t handle; /* participant instance handle */
+  dds_builtintopic_guid_t guid; /* participant GUID */
+  char *hostname;               /* hostname is taken from user_data QoS */
+  uint32_t pid;                 /* pid is also taken from user_data QoS */
+  dds_time_t tdisc;             /* time at which it was discovered */
+  dds_time_t tdeadline;         /* by what time must unmatched be 0 */
+  uint32_t unmatched;           /* expected but not yet detected endpoints */
+};
+
+static int cmp_instance_handle (const void *va, const void *vb)
+{
+  const dds_instance_handle_t *a = va;
+  const dds_instance_handle_t *b = vb;
+  return (*a == *b) ? 0 : (*a < *b) ? -1 : 1;
+}
+
+/* AVL tree of ppant structures indexed on handle using cmp_instance_handle */
+static ddsrt_avl_treedef_t ppants_td = DDSRT_AVL_TREEDEF_INITIALIZER (offsetof (struct ppant, avlnode), offsetof (struct ppant, handle), cmp_instance_handle, 0);
+static ddsrt_avl_tree_t ppants;
+
+/* Priority queue (Fibonacci heap) of ppant structures with tdeadline as key */
+static int cmp_ppant_tdeadline (const void *va, const void *vb)
+{
+  const struct ppant *a = va;
+  const struct ppant *b = vb;
+  return (a->tdeadline == b->tdeadline) ? 0 : (a->tdeadline < b->tdeadline) ? -1 : 1;
+}
+
+static ddsrt_fibheap_def_t ppants_to_match_fhd = DDSRT_FIBHEAPDEF_INITIALIZER (offsetof (struct ppant, fhnode), cmp_ppant_tdeadline);
+static ddsrt_fibheap_t ppants_to_match;
+
+/* Printing error messages: error2 is for DDS errors, error3 is for usage errors */
+static void verrorx (int exitcode, const char *fmt, va_list ap) ddsrt_attribute_noreturn;
+static void error2 (const char *fmt, ...) ddsrt_attribute_format ((printf, 1, 2)) ddsrt_attribute_noreturn;
+static void error3 (const char *fmt, ...) ddsrt_attribute_format ((printf, 1, 2)) ddsrt_attribute_noreturn;
+
+static void publication_matched_listener (dds_entity_t wr, const dds_publication_matched_status_t status, void *arg);
+
+struct seq_keyval {
+  uint32_t seq;
+  int32_t keyval;
+};
+
+union data {
+  uint32_t seq;
+  struct seq_keyval seq_keyval;
+  KeyedSeq ks;
+  Keyed32 k32;
+  Keyed256 k256;
+  OneULong ou;
+};
+
+static void verrorx (int exitcode, const char *fmt, va_list ap)
+{
+  vprintf (fmt, ap);
+  fflush (stdout);
+  exit (exitcode);
+}
+
+static void error2 (const char *fmt, ...)
+{
+  va_list ap;
+  va_start (ap, fmt);
+  verrorx (2, fmt, ap);
+}
+
+static void error3 (const char *fmt, ...)
+{
+  va_list ap;
+  va_start (ap, fmt);
+  verrorx (3, fmt, ap);
+}
+
+static char *make_guidstr (struct guidstr *buf, const dds_builtintopic_guid_t *guid)
+{
+  snprintf (buf->str, sizeof (buf->str), "%02x%02x%02x%02x_%02x%02x%02x%02x_%02x%02x%02x%02x_%02x%02x%02x%02x",
+            guid->v[0], guid->v[1], guid->v[2], guid->v[3],
+            guid->v[4], guid->v[5], guid->v[6], guid->v[7],
+            guid->v[8], guid->v[9], guid->v[10], guid->v[11],
+            guid->v[12], guid->v[13], guid->v[14], guid->v[15]);
+  return buf->str;
+}
+
+static void hist_reset_minmax (struct hist *h)
+{
+  h->min = UINT64_MAX;
+  h->max = 0;
+}
+
+static void hist_reset (struct hist *h)
+{
+  hist_reset_minmax (h);
+  h->under = 0;
+  h->over = 0;
+  memset (h->bins, 0, h->nbins * sizeof (*h->bins));
+}
+
+static struct hist *hist_new (unsigned nbins, uint64_t binwidth, uint64_t bin0)
+{
+  struct hist *h = malloc (sizeof (*h) + nbins * sizeof (*h->bins));
+  h->nbins = nbins;
+  h->binwidth = binwidth;
+  h->bin0 = bin0;
+  h->binN = h->bin0 + h->nbins * h->binwidth;
+  hist_reset (h);
+  return h;
+}
+
+static void hist_free (struct hist *h)
+{
+  free (h);
+}
+
+static void hist_record (struct hist *h, uint64_t x, unsigned weight)
+{
+  if (x < h->min)
+    h->min = x;
+  if (x > h->max)
+    h->max = x;
+  if (x < h->bin0)
+    h->under += weight;
+  else if (x >= h->binN)
+    h->over += weight;
+  else
+    h->bins[(x - h->bin0) / h->binwidth] += weight;
+}
+
+static void xsnprintf(char *buf, size_t bufsz, size_t *p, const char *fmt, ...)
+{
+  if (*p < bufsz)
+  {
+    int n;
+    va_list ap;
+    va_start (ap, fmt);
+    n = vsnprintf (buf + *p, bufsz - *p, fmt, ap);
+    va_end (ap);
+    *p += (size_t) n;
+  }
+}
+
+static void hist_print (const char *prefix, struct hist *h, dds_time_t dt, int reset)
+{
+  const size_t l_size = sizeof(char) * h->nbins + 200 + strlen (prefix);
+  const size_t hist_size = sizeof(char) * h->nbins + 1;
+  char *l = (char *) malloc(l_size);
+  char *hist = (char *) malloc(hist_size);
+  double dt_s = (double)dt / 1e9, avg;
+  uint64_t peak = 0, cnt = h->under + h->over;
+  size_t p = 0;
+
+  xsnprintf (l, l_size, &p, "%s", prefix);
+
+  hist[h->nbins] = 0;
+  for (unsigned i = 0; i < h->nbins; i++)
+  {
+    cnt += h->bins[i];
+    if (h->bins[i] > peak)
+      peak = h->bins[i];
+  }
+
+  const uint64_t p1 = peak / 100;
+  const uint64_t p10 = peak / 10;
+  const uint64_t p20 = 1 * peak / 5;
+  const uint64_t p40 = 2 * peak / 5;
+  const uint64_t p60 = 3 * peak / 5;
+  const uint64_t p80 = 4 * peak / 5;
+  for (unsigned i = 0; i < h->nbins; i++)
+  {
+    if (h->bins[i] == 0) hist[i] = ' ';
+    else if (h->bins[i] <= p1) hist[i] = '.';
+    else if (h->bins[i] <= p10) hist[i] = '_';
+    else if (h->bins[i] <= p20) hist[i] = '-';
+    else if (h->bins[i] <= p40) hist[i] = '=';
+    else if (h->bins[i] <= p60) hist[i] = 'x';
+    else if (h->bins[i] <= p80) hist[i] = 'X';
+    else hist[i] = '@';
+  }
+
+  avg = (double) cnt / dt_s;
+  if (avg < 999.5)
+    xsnprintf (l, l_size, &p, "%5.3g", avg);
+  else if (avg < 1e6)
+    xsnprintf (l, l_size, &p, "%4.3gk", avg / 1e3);
+  else
+    xsnprintf (l, l_size, &p, "%4.3gM", avg / 1e6);
+  xsnprintf (l, l_size, &p, "/s ");
+
+  if (h->min == UINT64_MAX)
+    xsnprintf (l, l_size, &p, " inf ");
+  else if (h->min < 1000)
+    xsnprintf (l, l_size, &p, "%3"PRIu64"n ", h->min);
+  else if (h->min + 500 < 1000000)
+    xsnprintf (l, l_size, &p, "%3"PRIu64"u ", (h->min + 500) / 1000);
+  else if (h->min + 500000 < 1000000000)
+    xsnprintf (l, l_size, &p, "%3"PRIu64"m ", (h->min + 500000) / 1000000);
+  else
+    xsnprintf (l, l_size, &p, "%3"PRIu64"s ", (h->min + 500000000) / 1000000000);
+
+  if (h->bin0 > 0) {
+    int pct = (cnt == 0) ? 0 : 100 * (int) ((h->under + cnt/2) / cnt);
+    xsnprintf (l, l_size, &p, "%3d%% ", pct);
+  }
+
+  {
+    int pct = (cnt == 0) ? 0 : 100 * (int) ((h->over + cnt/2) / cnt);
+    xsnprintf (l, l_size, &p, "|%s| %3d%%", hist, pct);
+  }
+
+  if (h->max < 1000)
+    xsnprintf (l, l_size, &p, " %3"PRIu64"n", h->max);
+  else if (h->max + 500 < 1000000)
+    xsnprintf (l, l_size, &p, " %3"PRIu64"u", (h->max + 500) / 1000);
+  else if (h->max + 500000 < 1000000000)
+    xsnprintf (l, l_size, &p, " %3"PRIu64"m", (h->max + 500000) / 1000000);
+  else
+    xsnprintf (l, l_size, &p, " %3"PRIu64"s", (h->max + 500000000) / 1000000000);
+
+  (void) p;
+  puts (l);
+  fflush (stdout);
+  free (l);
+  free (hist);
+  if (reset)
+    hist_reset (h);
+}
+
+static void *make_baggage (dds_sequence_t *b, unsigned cnt)
+{
+  b->_maximum = b->_length = cnt;
+  if (cnt == 0)
+    b->_buffer = NULL;
+  else
+  {
+    b->_buffer = malloc (b->_maximum);
+    memset(b->_buffer, 0xee, b->_maximum);
+  }
+  return b->_buffer;
+}
+
+static void *init_sample (union data *data, uint32_t seq)
+{
+  void *baggage = NULL;
+  switch (topicsel)
+  {
+    case KS:
+      data->ks.seq = seq;
+      data->ks.keyval = 0;
+      baggage = make_baggage (&data->ks.baggage, baggagesize);
+      break;
+    case K32:
+      data->k32.seq = seq;
+      data->k32.keyval = 0;
+      memset (data->k32.baggage, 0xee, sizeof (data->k32.baggage));
+      break;
+    case K256:
+      data->k256.seq = seq;
+      data->k256.keyval = 0;
+      memset (data->k256.baggage, 0xee, sizeof (data->k256.baggage));
+      break;
+    case OU:
+      data->ou.seq = seq;
+      break;
+  }
+  return baggage;
+}
+
+static uint32_t pubthread (void *varg)
+{
+  int result;
+  dds_instance_handle_t *ihs;
+  dds_time_t ntot = 0, tfirst, tfirst0;
+  union data data;
+  uint64_t timeouts = 0;
+  void *baggage = NULL;
+  (void) varg;
+
+  memset (&data, 0, sizeof (data));
+  assert (nkeyvals > 0);
+  assert (topicsel != OU || nkeyvals == 1);
+
+  baggage = init_sample (&data, 0);
+  ihs = malloc (nkeyvals * sizeof (dds_instance_handle_t));
+  for (unsigned k = 0; k < nkeyvals; k++)
+  {
+    data.seq_keyval.keyval = (int32_t) k;
+    if (register_instances)
+      dds_register_instance (wr_data, &ihs[k], &data);
+    else
+      ihs[k] = 0;
+  }
+  data.seq_keyval.keyval = 0;
+
+  tfirst0 = tfirst = dds_time();
+
+  unsigned bi = 0;
+  while (!termflag)
+  {
+    /* lsb of timestamp is abused to signal whether the sample is a ping requiring a response or not */
+    bool reqresp = (ping_frac == 0) ? 0 : (ping_frac == UINT32_MAX) ? 1 : (ddsrt_random () <= ping_frac);
+    const dds_time_t t_write = (dds_time () & ~1) | reqresp;
+    if ((result = dds_write_ts (wr_data, &data, t_write)) != DDS_RETCODE_OK)
+    {
+      printf ("write error: %d\n", result);
+      fflush (stdout);
+      if (dds_err_nr (result) != DDS_RETCODE_TIMEOUT)
+        exit (2);
+      timeouts++;
+      /* retry with original timestamp, it really is just a way of reporting
+         blocking for an exceedingly long time */
+      continue;
+    }
+    if (reqresp)
+    {
+      dds_write_flush (wr_data);
+    }
+
+    const dds_time_t t_post_write = dds_time ();
+    dds_time_t t = t_post_write;
+    ddsrt_mutex_lock (&pubstat_lock);
+    hist_record (pubstat_hist, (uint64_t) ((t_post_write - t_write) / 1), 1);
+    ntot++;
+    ddsrt_mutex_unlock (&pubstat_lock);
+
+    data.seq_keyval.keyval = (data.seq_keyval.keyval + 1) % (int32_t) nkeyvals;
+    data.seq++;
+
+    if (rate < HUGE_VAL)
+    {
+      if (++bi == burstsize)
+      {
+        /* FIXME: should average rate over a short-ish period, rather than over the entire run */
+        while (((double) (ntot / burstsize) / ((double) (t - tfirst0) / 1e9 + 5e-3)) > rate && !termflag)
+        {
+          /* FIXME: flushing manually because batching is not yet implemented properly */
+          dds_write_flush (wr_data);
+          dds_sleepfor (DDS_MSECS (1));
+          t = dds_time ();
+        }
+        bi = 0;
+      }
+    }
+  }
+  if (baggage)
+    free (baggage);
+  free (ihs);
+  return 0;
+}
+
+static void init_eseq_admin (struct eseq_admin *ea, unsigned nkeys)
+{
+  ddsrt_mutex_init (&ea->lock);
+  ea->nkeys = nkeys;
+  ea->nph = 0;
+  ea->ph = NULL;
+  ea->stats = NULL;
+  ea->eseq = NULL;
+}
+
+static void fini_eseq_admin (struct eseq_admin *ea)
+{
+  free (ea->ph);
+  free (ea->stats);
+  for (unsigned i = 0; i < ea->nph; i++)
+    free (ea->eseq[i]);
+  ddsrt_mutex_destroy (&ea->lock);
+  free (ea->eseq);
+}
+
+static int check_eseq (struct eseq_admin *ea, uint32_t seq, uint32_t keyval, uint32_t size, const dds_instance_handle_t pubhandle)
+{
+  uint32_t *eseq;
+  if (keyval >= ea->nkeys)
+  {
+    printf ("received key %u >= nkeys %u\n", keyval, ea->nkeys);
+    exit (3);
+  }
+  ddsrt_mutex_lock (&ea->lock);
+  for (uint32_t i = 0; i < ea->nph; i++)
+    if (pubhandle == ea->ph[i])
+    {
+      uint32_t e = ea->eseq[i][keyval];
+      ea->eseq[i][keyval] = seq + ea->nkeys;
+      ea->stats[i].nrecv++;
+      ea->stats[i].nrecv_bytes += size;
+      ea->stats[i].nlost += seq - e;
+      ddsrt_mutex_unlock (&ea->lock);
+      return seq == e;
+    }
+  ea->ph = realloc (ea->ph, (ea->nph + 1) * sizeof (*ea->ph));
+  ea->ph[ea->nph] = pubhandle;
+  ea->eseq = realloc (ea->eseq, (ea->nph + 1) * sizeof (*ea->eseq));
+  ea->eseq[ea->nph] = malloc (ea->nkeys * sizeof (*ea->eseq[ea->nph]));
+  eseq = ea->eseq[ea->nph];
+  for (unsigned i = 0; i < ea->nkeys; i++)
+    eseq[i] = seq + (i - keyval) + (i <= keyval ? ea->nkeys : 0);
+  ea->stats = realloc (ea->stats, (ea->nph + 1) * sizeof (*ea->stats));
+  memset (&ea->stats[ea->nph], 0, sizeof (ea->stats[ea->nph]));
+  ea->stats[ea->nph].nrecv = 1;
+  ea->stats[ea->nph].nrecv_bytes = size;
+  ea->nph++;
+  ddsrt_mutex_unlock (&ea->lock);
+  return 1;
+}
+
+static dds_instance_handle_t get_pphandle_for_pubhandle (dds_instance_handle_t pubhandle)
+{
+  /* FIXME: implement the get_matched_... interfaces so there's no need for keeping a reader
+   (and having to GC it, which I'm skipping here ...) */
+  int32_t n;
+  void *msg = NULL;
+  dds_sample_info_t info;
+  if ((n = dds_read_instance (rd_publications, &msg, &info, 1, 1, pubhandle)) < 0)
+    error2 ("dds_read_instance(rd_publications, %"PRIx64") failed: %d\n", pubhandle, (int) n);
+  else if (n == 0 || !info.valid_data)
+  {
+    printf ("get_pong_writer: publication handle %"PRIx64" not found\n", pubhandle);
+    fflush (stdout);
+    return 0;
+  }
+  else
+  {
+    const dds_builtintopic_endpoint_t *sample = msg;
+    dds_instance_handle_t pphandle = sample->participant_instance_handle;
+    dds_return_loan (rd_publications, &msg, n);
+    return pphandle;
+  }
+}
+
+static bool update_roundtrip (dds_instance_handle_t pubhandle, uint64_t tdelta, bool isping, uint32_t seq)
+{
+  bool allseen;
+  ddsrt_mutex_lock (&pongstat_lock);
+  if (isping && seq == cur_ping_seq)
+    allseen = (++n_pong_seen == n_pong_expected);
+  else
+    allseen = false;
+  for (uint32_t i = 0; i < npongstat; i++)
+    if (pongstat[i].pubhandle == pubhandle)
+    {
+      struct subthread_arg_pongstat * const x = &pongstat[i];
+      if (tdelta < x->min) x->min = tdelta;
+      if (tdelta > x->max) x->max = tdelta;
+      x->sum += tdelta;
+      x->cnt++;
+      ddsrt_mutex_unlock (&pongstat_lock);
+      return allseen;
+    }
+  pongstat = realloc (pongstat, (npongstat + 1) * sizeof (*pongstat));
+  struct subthread_arg_pongstat * const x = &pongstat[npongstat];
+  x->pubhandle = pubhandle;
+  x->pphandle = get_pphandle_for_pubhandle (pubhandle);
+  x->min = x->max = x->sum = tdelta;
+  x->cnt = 1;
+  npongstat++;
+  ddsrt_mutex_unlock (&pongstat_lock);
+  return allseen;
+}
+
+static dds_entity_t get_pong_writer_locked (dds_instance_handle_t pubhandle)
+{
+  dds_instance_handle_t pphandle;
+
+  for (uint32_t j = 0; j < npongwr; j++)
+    if (pongwr[j].pubhandle == pubhandle)
+      return pongwr[j].wr_pong;
+
+  /* FIXME: implement the get_matched_... interfaces so there's no need for keeping a reader
+     (and having to GC it, which I'm skipping here ...) */
+  pphandle = get_pphandle_for_pubhandle (pubhandle);
+
+  /* This gets called when no writer is associaed yet with pubhandle, but it may be that a writer
+     is associated already with pphandle (because there is the data writer and the ping writer) */
+  for (uint32_t i = 0; i < npongwr; i++)
+  {
+    if (pongwr[i].pphandle == pphandle)
+    {
+      dds_entity_t wr_pong = pongwr[i].wr_pong;
+      if (pongwr[i].pubhandle == 0)
+      {
+        pongwr[i].pubhandle = pubhandle;
+        ddsrt_mutex_unlock (&pongwr_lock);
+        return wr_pong;
+      }
+      else
+      {
+        pongwr = realloc (pongwr, (npongwr + 1) * sizeof (*pongwr));
+        pongwr[npongwr].pubhandle = pubhandle;
+        pongwr[npongwr].pphandle = pphandle;
+        pongwr[npongwr].wr_pong = wr_pong;
+        npongwr++;
+        ddsrt_mutex_unlock (&pongwr_lock);
+        return wr_pong;
+      }
+    }
+  }
+  printf ("get_pong_writer: participant handle %"PRIx64" not found\n", pphandle);
+  fflush (stdout);
+  return 0;
+}
+
+static dds_entity_t get_pong_writer (dds_instance_handle_t pubhandle)
+{
+  dds_entity_t wr_pong = 0;
+  ddsrt_mutex_lock (&pongwr_lock);
+  wr_pong = get_pong_writer_locked (pubhandle);
+  ddsrt_mutex_unlock (&pongwr_lock);
+  return wr_pong;
+}
+
+static bool process_data (dds_entity_t rd, struct subthread_arg *arg)
+{
+  uint32_t max_samples = arg->max_samples;
+  dds_sample_info_t *iseq = arg->iseq;
+  void **mseq = arg->mseq;
+  int32_t nread_data;
+  if ((nread_data = dds_take (rd, mseq, iseq, max_samples, max_samples)) < 0)
+    error2 ("dds_take (rd_data): %d\n", (int) nread_data);
+  for (int32_t i = 0; i < nread_data; i++)
+  {
+    if (iseq[i].valid_data)
+    {
+      uint32_t seq, keyval, size;
+      switch (topicsel)
+      {
+        case KS:   { KeyedSeq *d = (KeyedSeq *) mseq[i]; keyval = d->keyval; seq = d->seq; size = 12 + d->baggage._length; } break;
+        case K32:  { Keyed32 *d  = (Keyed32 *)  mseq[i]; keyval = d->keyval; seq = d->seq; size = 32; } break;
+        case K256: { Keyed256 *d = (Keyed256 *) mseq[i]; keyval = d->keyval; seq = d->seq; size = 256; } break;
+        case OU:   { OneULong *d = (OneULong *) mseq[i]; keyval = 0;         seq = d->seq; size = 4; } break;
+      }
+      (void) check_eseq (&eseq_admin, seq, keyval, size, iseq[i].publication_handle);
+      if (iseq[i].source_timestamp & 1)
+      {
+        dds_entity_t wr_pong = 0;
+        if ((wr_pong = get_pong_writer (iseq[i].publication_handle)) != 0)
+        {
+          dds_return_t rc;
+          if ((rc = dds_write_ts (wr_pong, mseq[i], iseq[i].source_timestamp - 1)) < 0 && dds_err_nr(rc) != DDS_RETCODE_TIMEOUT)
+            error2 ("dds_write_ts (wr_pong, mseq[i], iseq[i].source_timestamp): %d\n", (int) rc);
+          dds_write_flush (wr_pong);
+        }
+      }
+    }
+  }
+  return (nread_data > 0);
+}
+
+static bool process_ping (dds_entity_t rd, struct subthread_arg *arg)
+{
+  /* Ping sends back Pongs with the lsb 1; Data sends back Pongs with the lsb 0.  This way, the Pong handler can
+     figure out whether to Ping again or not by looking at the lsb.  If it is 1, another Ping is required */
+  uint32_t max_samples = arg->max_samples;
+  dds_sample_info_t *iseq = arg->iseq;
+  void **mseq = arg->mseq;
+  int32_t nread_ping;
+  if ((nread_ping = dds_take (rd, mseq, iseq, max_samples, max_samples)) < 0)
+    error2 ("dds_take (rd_data): %d\n", (int) nread_ping);
+  for (int32_t i = 0; i < nread_ping; i++)
+  {
+    if (iseq[i].valid_data)
+    {
+      dds_entity_t wr_pong;
+      if ((wr_pong = get_pong_writer (iseq[i].publication_handle)) != 0)
+      {
+        dds_return_t rc;
+        if ((rc = dds_write_ts (wr_pong, mseq[i], iseq[i].source_timestamp | 1)) < 0 && dds_err_nr(rc) != DDS_RETCODE_TIMEOUT)
+          error2 ("dds_write_ts (wr_pong, mseq[i], iseq[i].source_timestamp): %d\n", (int) rc);
+        dds_write_flush (wr_pong);
+      }
+    }
+  }
+  return (nread_ping > 0);
+}
+
+static bool process_pong (dds_entity_t rd, struct subthread_arg *arg)
+{
+  uint32_t max_samples = arg->max_samples;
+  dds_sample_info_t *iseq = arg->iseq;
+  void **mseq = arg->mseq;
+  int32_t nread_pong;
+  if ((nread_pong = dds_take (rd, mseq, iseq, max_samples, max_samples)) < 0)
+    error2 ("dds_take (rd_pong): %d\n", (int) nread_pong);
+  else if (nread_pong > 0)
+  {
+    dds_time_t tnow = dds_time ();
+    for (int32_t i = 0; i < nread_pong; i++)
+      if (iseq[i].valid_data)
+      {
+        uint32_t * const seq = mseq[i];
+        const bool isping = (iseq[i].source_timestamp & 1) != 0;
+        const bool all = update_roundtrip (iseq[i].publication_handle, (uint64_t) (tnow - iseq[i].source_timestamp) / 2, isping, *seq);
+        if (isping && all && ping_intv == 0)
+        {
+          /* If it is a pong sent in response to a ping, and all known nodes have responded, send out a new ping */
+          dds_return_t rc;
+          ddsrt_mutex_lock (&pongwr_lock);
+          n_pong_seen = 0;
+          cur_ping_time = dds_time ();
+          cur_ping_seq = ++(*seq);
+          ddsrt_mutex_unlock (&pongwr_lock);
+          if ((rc = dds_write_ts (wr_ping, mseq[i], dds_time () | 1)) < 0 && dds_err_nr(rc) != DDS_RETCODE_TIMEOUT)
+            error2 ("dds_write (wr_ping, mseq[i]): %d\n", (int) rc);
+          dds_write_flush (wr_ping);
+        }
+      }
+  }
+  return (nread_pong > 0);
+}
+
+static void maybe_send_new_ping (dds_time_t tnow, dds_time_t *tnextping)
+{
+  void *baggage;
+  union data data;
+  int32_t rc;
+  assert (ping_intv != DDS_INFINITY);
+  ddsrt_mutex_lock (&pongwr_lock);
+  if (tnow < cur_ping_time + (ping_intv == 0 ? DDS_SECS (1) : ping_intv))
+  {
+    if (ping_intv == 0)
+      *tnextping = cur_ping_time + DDS_SECS (1);
+    ddsrt_mutex_unlock (&pongwr_lock);
+  }
+  else
+  {
+    if (tnow > twarn_ping_timeout)
+    {
+      printf ("[%"PRIdPID"] ping timed out ... sending new ping\n", ddsrt_getpid ());
+      fflush (stdout);
+    }
+    n_pong_seen = 0;
+    cur_ping_time = tnow;
+    if (ping_intv > 0)
+      *tnextping = cur_ping_time + ping_intv;
+    else if (ping_intv == 0)
+      *tnextping = cur_ping_time + DDS_SECS (1);
+    if (ping_intv > 0 && *tnextping > twarn_ping_timeout)
+      twarn_ping_timeout = *tnextping + ping_intv / 2;
+    cur_ping_seq++;
+    baggage = init_sample (&data, cur_ping_seq);
+    ddsrt_mutex_unlock (&pongwr_lock);
+    if ((rc = dds_write_ts (wr_ping, &data, dds_time () | 1)) < 0 && dds_err_nr (rc) != DDS_RETCODE_TIMEOUT)
+      error2 ("send_new_ping: dds_write (wr_ping, &data): %d\n", (int) rc);
+    dds_write_flush (wr_ping);
+    if (baggage)
+      free (baggage);
+  }
+}
+
+static uint32_t subthread_waitset (void *varg)
+{
+  struct subthread_arg * const arg = varg;
+  dds_entity_t ws;
+  int32_t rc;
+  ws = dds_create_waitset (dp);
+  if ((rc = dds_waitset_attach (ws, termcond, 0)) < 0)
+    error2 ("dds_waitset_attach (termcond, 0): %d\n", (int) rc);
+  if ((rc = dds_set_status_mask (rd_data, DDS_DATA_AVAILABLE_STATUS)) < 0)
+    error2 ("dds_set_status_mask (rd_data, DDS_DATA_AVAILABLE_STATUS): %d\n", (int) rc);
+  if ((rc = dds_waitset_attach (ws, rd_data, 1)) < 0)
+    error2 ("dds_waitset_attach (ws, rd_data, 1): %d\n", (int) rc);
+  while (!termflag)
+  {
+    if (!process_data (rd_data, arg))
+    {
+      /* when we use DATA_AVAILABLE, we must read until nothing remains, or we would deadlock
+         if more than max_samples were available and nothing further is received */
+      int32_t nxs;
+      if ((nxs = dds_waitset_wait (ws, NULL, 0, DDS_INFINITY)) < 0)
+        error2 ("dds_waitset_wait: %d\n", (int) nxs);
+    }
+  }
+  return 0;
+}
+
+static uint32_t subpingthread_waitset (void *varg)
+{
+  struct subthread_arg * const arg = varg;
+  dds_entity_t ws;
+  int32_t rc;
+  ws = dds_create_waitset (dp);
+  if ((rc = dds_waitset_attach (ws, termcond, 0)) < 0)
+    error2 ("dds_waitset_attach (termcond, 0): %d\n", (int) rc);
+  if ((rc = dds_set_status_mask (rd_ping, DDS_DATA_AVAILABLE_STATUS)) < 0)
+    error2 ("dds_set_status_mask (rd_ping, DDS_DATA_AVAILABLE_STATUS): %d\n", (int) rc);
+  if ((rc = dds_waitset_attach (ws, rd_ping, 1)) < 0)
+    error2 ("dds_waitset_attach (ws, rd_ping, 1): %d\n", (int) rc);
+  while (!termflag)
+  {
+    int32_t nxs;
+    if ((nxs = dds_waitset_wait (ws, NULL, 0, DDS_INFINITY)) < 0)
+      error2 ("dds_waitset_wait: %d\n", (int) nxs);
+    process_ping (rd_ping, arg);
+  }
+  return 0;
+}
+
+static uint32_t subpongthread_waitset (void *varg)
+{
+  struct subthread_arg * const arg = varg;
+  dds_entity_t ws;
+  int32_t rc;
+  ws = dds_create_waitset (dp);
+  if ((rc = dds_waitset_attach (ws, termcond, 0)) < 0)
+    error2 ("dds_waitset_attach (termcond, 0): %d\n", (int) rc);
+  if ((rc = dds_set_status_mask (rd_pong, DDS_DATA_AVAILABLE_STATUS)) < 0)
+    error2 ("dds_set_status_mask (rd_pong, DDS_DATA_AVAILABLE_STATUS): %d\n", (int) rc);
+  if ((rc = dds_waitset_attach (ws, rd_pong, 1)) < 0)
+    error2 ("dds_waitset_attach (ws, rd_pong, 1): %d\n", (int) rc);
+  while (!termflag)
+  {
+    int32_t nxs;
+    if ((nxs = dds_waitset_wait (ws, NULL, 0, DDS_INFINITY)) < 0)
+      error2 ("dds_waitset_wait: %d\n", (int) nxs);
+    process_pong (rd_pong, arg);
+  }
+  return 0;
+}
+
+static uint32_t subthread_polling (void *varg)
+{
+  struct subthread_arg * const arg = varg;
+  while (!termflag)
+  {
+    if (!process_data (rd_data, arg))
+      dds_sleepfor (DDS_MSECS (1));
+  }
+  return 0;
+}
+
+static void data_available_listener (dds_entity_t rd, void *arg)
+{
+  process_data (rd, arg);
+}
+
+static void ping_available_listener (dds_entity_t rd, void *arg)
+{
+  process_ping (rd, arg);
+}
+
+static void pong_available_listener (dds_entity_t rd, void *arg)
+{
+  process_pong (rd, arg);
+}
+
+static dds_entity_t create_pong_writer (dds_instance_handle_t pphandle, const struct guidstr *guidstr)
+{
+  dds_qos_t *qos;
+  dds_listener_t *listener;
+  dds_entity_t pongpub;
+  dds_entity_t wr_pong;
+
+  //printf ("[%"PRIdPID"] create_pong_writer: creating writer in partition %s pubhandle %"PRIx64"\n", ddsrt_getpid (), guidstr->str, pphandle);
+  //fflush (stdout);
+
+  qos = dds_create_qos ();
+  dds_qset_partition1 (qos, guidstr->str);
+  if ((pongpub = dds_create_publisher (dp, qos, NULL)) < 0)
+    error2 ("dds_create_publisher failed: %d\n", (int) pongpub);
+  dds_delete_qos (qos);
+
+  listener = dds_create_listener ((void *) (uintptr_t) MM_RD_PONG);
+  dds_lset_publication_matched (listener, publication_matched_listener);
+  qos = dds_create_qos ();
+  dds_qset_history (qos, DDS_HISTORY_KEEP_LAST, 1);
+  dds_qset_ignorelocal (qos, ignorelocal);
+  if ((wr_pong = dds_create_writer (pongpub, tp_pong, qos, listener)) < 0)
+    error2 ("dds_create_writer(%s) failed: %d\n", tpname_pong, (int) wr_pong);
+  dds_delete_qos (qos);
+  dds_delete_listener (listener);
+
+  ddsrt_mutex_lock (&pongwr_lock);
+  pongwr = realloc (pongwr, (npongwr + 1) * sizeof (*pongwr));
+  pongwr[npongwr].pubhandle = 0;
+  pongwr[npongwr].pphandle = pphandle;
+  pongwr[npongwr].wr_pong = wr_pong;
+  npongwr++;
+  ddsrt_mutex_unlock (&pongwr_lock);
+  return wr_pong;
+}
+
+static void delete_pong_writer (dds_instance_handle_t pphandle)
+{
+  uint32_t i = 0;
+  dds_entity_t wr_pong = 0;
+  ddsrt_mutex_lock (&pongwr_lock);
+  while (i < npongwr)
+  {
+    if (pongwr[i].pphandle != pphandle)
+      i++;
+    else
+    {
+      assert (wr_pong == 0 || wr_pong == pongwr[i].wr_pong);
+      memmove (&pongwr[i], &pongwr[i+1], (npongwr - i) * sizeof (pongwr[0]));
+      npongwr--;
+    }
+  }
+  ddsrt_mutex_unlock (&pongwr_lock);
+  if (wr_pong)
+    dds_delete (wr_pong);
+}
+
+static void participant_data_listener (dds_entity_t rd, void *arg)
+{
+  dds_sample_info_t info;
+  void *msg = NULL;
+  uint32_t n_pong_expected_delta = 0;
+  int32_t n;
+  (void) arg;
+  while ((n = dds_take (rd, &msg, &info, 1, 1)) > 0)
+  {
+    struct ppant *pp;
+    assert (info.instance_state != DDS_ALIVE_INSTANCE_STATE || info.valid_data);
+    if (info.instance_state != DDS_ALIVE_INSTANCE_STATE)
+    {
+      ddsrt_avl_dpath_t dpath;
+      ddsrt_mutex_lock (&disc_lock);
+      if ((pp = ddsrt_avl_lookup_dpath (&ppants_td, &ppants, &info.instance_handle, &dpath)) != NULL)
+      {
+        printf ("[%"PRIdPID"] participant %s:%"PRIu32": gone\n", ddsrt_getpid (), pp->hostname, pp->pid);
+        fflush (stdout);
+
+        if (pp->handle != dp_handle || ignorelocal == DDS_IGNORELOCAL_NONE)
+        {
+          delete_pong_writer (pp->handle);
+          n_pong_expected_delta--;
+        }
+
+        ddsrt_avl_delete_dpath (&ppants_td, &ppants, pp, &dpath);
+        if (pp->tdeadline != DDS_NEVER)
+          ddsrt_fibheap_delete (&ppants_to_match_fhd, &ppants_to_match, pp);
+        free (pp);
+      }
+      ddsrt_mutex_unlock (&disc_lock);
+    }
+    else
+    {
+      const dds_builtintopic_participant_t *sample = msg;
+      void *vudata;
+      size_t usz;
+      ddsrt_avl_ipath_t ipath;
+      /* only add unknown participants with the magic user_data value: DDSPerf:X:HOSTNAME, where X is decimal  */
+      if (dds_qget_userdata (sample->qos, &vudata, &usz) && usz > 0)
+      {
+        const char *udata = vudata;
+        int has_reader, pos;
+        long pid;
+        if (sscanf (udata, UDATA_MAGIC "%d:%ld%n", &has_reader, &pid, &pos) == 2 && udata[pos] == ':' && strlen (udata + pos) == usz - (unsigned) pos)
+        {
+          size_t sz = usz - (unsigned) pos;
+          char *hostname = malloc (sz);
+          memcpy (hostname, udata + pos + 1, sz);
+          ddsrt_mutex_lock (&disc_lock);
+          if ((pp = ddsrt_avl_lookup_ipath (&ppants_td, &ppants, &info.instance_handle, &ipath)) != NULL)
+            free (hostname);
+          else
+          {
+            printf ("[%"PRIdPID"] participant %s:%"PRIu32": new%s\n", ddsrt_getpid (), hostname, (uint32_t) pid, (info.instance_handle == dp_handle) ? " (self)" : "");
+            pp = malloc (sizeof (*pp));
+            pp->handle = info.instance_handle;
+            pp->guid = sample->key;
+            pp->hostname = hostname;
+            pp->pid = (uint32_t) pid;
+            pp->tdisc = dds_time ();
+            pp->tdeadline = pp->tdisc + DDS_SECS (5);
+            if (pp->handle != dp_handle || ignorelocal == DDS_IGNORELOCAL_NONE)
+              pp->unmatched = MM_ALL & ~(has_reader ? 0 : MM_RD_DATA) & ~(rd_data ? 0 : MM_WR_DATA);
+            else
+              pp->unmatched = 0;
+            ddsrt_fibheap_insert (&ppants_to_match_fhd, &ppants_to_match, pp);
+            ddsrt_avl_insert_ipath (&ppants_td, &ppants, pp, &ipath);
+
+            if (pp->handle != dp_handle || ignorelocal == DDS_IGNORELOCAL_NONE)
+            {
+              struct guidstr guidstr;
+              make_guidstr (&guidstr, &sample->key);
+              create_pong_writer (pp->handle, &guidstr);
+              n_pong_expected_delta++;
+            }
+          }
+          ddsrt_mutex_unlock (&disc_lock);
+        }
+        dds_free (vudata);
+      }
+    }
+    dds_return_loan (rd, &msg, n);
+  }
+  if (n < 0)
+    error2 ("dds_take(rd_participants): error %d\n", (int) n);
+
+  if (n_pong_expected_delta)
+  {
+    ddsrt_mutex_lock (&pongstat_lock);
+    n_pong_expected += n_pong_expected_delta;
+    /* potential initial packet loss & lazy writer creation conspire against receiving
+       the expected number of responses, so allow for a few attempts before starting to
+       warn about timeouts */
+    twarn_ping_timeout = dds_time () + DDS_MSECS (3333);
+    //printf ("[%"PRIdPID"] n_pong_expected = %u\n", ddsrt_getpid (), n_pong_expected);
+    ddsrt_mutex_unlock (&pongstat_lock);
+  }
+}
+
+static void endpoint_matched_listener (uint32_t match_mask, dds_entity_t rd_epinfo, dds_instance_handle_t remote_endpoint)
+{
+  dds_sample_info_t info;
+  void *msg = NULL;
+  int32_t n;
+
+  /* update participant data so this remote endpoint's participant will be known */
+  participant_data_listener (rd_participants, NULL);
+
+  /* FIXME: implement the get_matched_... interfaces so there's no need for keeping a reader
+     (and having to GC it, which I'm skipping here ...) */
+  if ((n = dds_read_instance (rd_epinfo, &msg, &info, 1, 1, remote_endpoint)) < 0)
+    error2 ("dds_read_instance(rd_epinfo, %"PRIx64") failed: %d\n", remote_endpoint, (int) n);
+  else if (n == 0)
+    printf ("[%"PRIdPID"] endpoint %"PRIx64" not found\n", ddsrt_getpid (), remote_endpoint);
+  else
+  {
+    if (info.valid_data)
+    {
+      const dds_builtintopic_endpoint_t *sample = msg;
+      struct ppant *pp;
+      ddsrt_mutex_lock (&disc_lock);
+      if ((pp = ddsrt_avl_lookup (&ppants_td, &ppants, &sample->participant_instance_handle)) == NULL)
+        printf ("[%"PRIdPID"] participant %"PRIx64" no longer exists\n", ddsrt_getpid (), sample->participant_instance_handle);
+      else
+      {
+        pp->unmatched &= ~match_mask;
+        if (pp->unmatched == 0)
+          matchcount++;
+      }
+      ddsrt_mutex_unlock (&disc_lock);
+    }
+    dds_return_loan (rd_epinfo, &msg, n);
+  }
+  fflush (stdout);
+}
+
+static const char *match_mask1_to_string (uint32_t mask)
+{
+  assert ((mask & ~MM_ALL) == 0);
+  switch (mask)
+  {
+    case MM_WR_DATA: return "data writer";
+    case MM_RD_DATA: return "data reader";
+    case MM_WR_PING: return "ping writer";
+    case MM_RD_PING: return "ping reader";
+    case MM_WR_PONG: return "pong writer";
+    case MM_RD_PONG: return "pong reader";
+  }
+  return "?";
+}
+
+static char *match_mask_to_string (char *buf, size_t size, uint32_t mask)
+{
+  size_t pos = 0;
+  while (pos < size && mask != 0)
+  {
+    uint32_t mask1 = mask & (~mask + 1u);
+    mask &= ~mask1;
+    int n = snprintf (buf + pos, size - (unsigned) pos, "%s%s", (pos > 0) ? ", " : "", match_mask1_to_string (mask1));
+    if (n >= 0) pos += (size_t) n;
+  }
+  return buf;
+}
+
+static void subscription_matched_listener (dds_entity_t rd, const dds_subscription_matched_status_t status, void *arg)
+{
+  /* this only works because the listener is called for every match; but I don't think that is something the
+     spec guarantees, and I don't think Cyclone should guarantee that either -- and if it isn't guaranteed
+     _really_ needs the get_matched_... interfaces to not have to implement the matching logic ... */
+  (void) rd;
+  if (status.current_count_change > 0)
+  {
+    uint32_t mask = (uint32_t) (uintptr_t) arg;
+    //printf ("[%"PRIdPID"] subscription match: %s\n", ddsrt_getpid (), match_mask1_to_string (mask));
+    endpoint_matched_listener (mask, rd_publications, status.last_publication_handle);
+  }
+}
+
+static void publication_matched_listener (dds_entity_t wr, const dds_publication_matched_status_t status, void *arg)
+{
+  /* this only works because the listener is called for every match; but I don't think that is something the
+   spec guarantees, and I don't think Cyclone should guarantee that either -- and if it isn't guaranteed
+   _really_ needs the get_matched_... interfaces to not have to implement the matching logic ... */
+  (void) wr;
+  if (status.current_count_change > 0)
+  {
+    uint32_t mask = (uint32_t) (uintptr_t) arg;
+    //printf ("[%"PRIdPID"] publication match: %s\n", ddsrt_getpid (), match_mask1_to_string (mask));
+    endpoint_matched_listener (mask, rd_subscriptions, status.last_subscription_handle);
+  }
+}
+
+static void set_data_available_listener (dds_entity_t rd, const char *rd_name, dds_on_data_available_fn fn, void *arg)
+{
+  /* This convoluted code is so that we leave all listeners unchanged, except the
+   data_available one.  There is no real need for these complications, but it is
+   a nice exercise. */
+  dds_listener_t *listener = dds_create_listener (arg);
+  dds_return_t rc;
+  dds_lset_data_available (listener, fn);
+  dds_listener_t *tmplistener = dds_create_listener (NULL);
+  if ((rc = dds_get_listener (rd, tmplistener)) < 0)
+    error2 ("dds_get_listener(%s) failed: %d\n", rd_name, (int) rc);
+  dds_merge_listener (listener, tmplistener);
+  dds_delete_listener (tmplistener);
+
+  if ((rc = dds_set_listener (rd, listener)) < 0)
+    error2 ("dds_set_listener(%s) failed: %d\n", rd_name, (int) rc);
+  dds_delete_listener (listener);
+}
+
+static void print_stats (dds_time_t tstart, dds_time_t tnow, dds_time_t tprev)
+{
+  char prefix[128];
+  const double ts = (double) (tnow - tstart) / 1e9;
+  snprintf (prefix, sizeof (prefix), "[%"PRIdPID"] %.3f ", ddsrt_getpid (), ts);
+
+  if (rate > 0)
+  {
+    ddsrt_mutex_lock (&pubstat_lock);
+    hist_print (prefix, pubstat_hist, tnow - tprev, 1);
+    ddsrt_mutex_unlock (&pubstat_lock);
+  }
+
+  if (submode != SM_NONE)
+  {
+    struct eseq_admin * const ea = &eseq_admin;
+    uint64_t tot_nrecv = 0, nrecv = 0, nrecv_bytes = 0, nlost = 0;
+    ddsrt_mutex_lock (&ea->lock);
+    for (uint32_t i = 0; i < ea->nph; i++)
+    {
+      struct eseq_stat * const x = &ea->stats[i];
+      tot_nrecv += x->nrecv;
+      nrecv += x->nrecv - x->nrecv_ref;
+      nlost += x->nlost - x->nlost_ref;
+      nrecv_bytes += x->nrecv_bytes - x->nrecv_bytes_ref;
+      x->nrecv_ref = x->nrecv;
+      x->nlost_ref = x->nlost;
+      x->nrecv_bytes_ref = x->nrecv_bytes;
+    }
+    ddsrt_mutex_unlock (&ea->lock);
+
+    if (nrecv > 0)
+    {
+      printf ("%s ntot %"PRIu64" delta: %"PRIu64" lost %"PRIu64" rate %.2f Mb/s\n",
+              prefix, tot_nrecv, nrecv, nlost, (double) nrecv_bytes * 8 / 1e6 / (1e9 * (double) (tnow - tprev)));
+    }
+  }
+
+  ddsrt_mutex_lock (&pongstat_lock);
+  for (uint32_t i = 0; i < npongstat; i++)
+  {
+    struct subthread_arg_pongstat * const x = &pongstat[i];
+    if (x->cnt > 0)
+    {
+      struct ppant *pp;
+      ddsrt_mutex_lock (&disc_lock);
+      if ((pp = ddsrt_avl_lookup (&ppants_td, &ppants, &x->pphandle)) == NULL)
+        printf ("%s  %"PRIx64" min %.3fus mean %.3fus max %.3fus cnt %"PRIu32"\n",
+                prefix, x->pubhandle, (double) x->min / 1e3,
+                (double) x->sum / (double) x->cnt / 1e3, (double) x->max / 1e3, x->cnt);
+      else
+        printf ("%s  %s:%d min %.3fus mean %.3fus max %.3fus cnt %"PRIu32"\n",
+                prefix, pp->hostname, pp->pid, (double) x->min / 1e3,
+                (double) x->sum / (double) x->cnt / 1e3, (double) x->max / 1e3, x->cnt);
+      ddsrt_mutex_unlock (&disc_lock);
+      x->min = UINT64_MAX;
+      x->max = x->sum = x->cnt = 0;
+    }
+  }
+  ddsrt_mutex_unlock (&pongstat_lock);
+  fflush (stdout);
+}
+
+static void subthread_arg_init (struct subthread_arg *arg, dds_entity_t rd, uint32_t max_samples)
+{
+  arg->rd = rd;
+  arg->max_samples = max_samples;
+  arg->mseq = malloc (arg->max_samples * sizeof (arg->mseq[0]));
+  arg->iseq = malloc (arg->max_samples * sizeof (arg->iseq[0]));
+  for (uint32_t i = 0; i < arg->max_samples; i++)
+    arg->mseq[i] = NULL;
+}
+
+static void subthread_arg_fini (struct subthread_arg *arg)
+{
+  dds_return_loan(arg->rd, arg->mseq, (int32_t) arg->max_samples);
+  free (arg->mseq);
+  free (arg->iseq);
+}
+
+static void signal_handler (int sig)
+{
+  (void) sig;
+  termflag = 1;
+  dds_set_guardcondition (termcond, true);
+}
+
+#ifndef _WIN32
+static uint32_t sigthread (void *varg)
+{
+  sigset_t *set = varg;
+  int sig;
+  if (sigwait (set, &sig) == 0)
+    signal_handler (sig);
+  else
+    error2 ("sigwait failed: %d\n", errno);
+  return 0;
+}
+#endif
+
+/********************
+ COMMAND LINE PARSING
+ ********************/
+
+static void usage (void)
+{
+  printf ("\
+%s help\n\
+%s [OPTIONS] MODE...\n\
+\n\
+OPTIONS:\n\
+  -T KS|K32|K256|OU   topic:\n\
+                        KS   seq num, key value, sequence-of-octets\n\
+                        K32  seq num, key value, array of 24 octets\n\
+                        K256 seq num, key value, array of 248 octets\n\
+                        OU   seq num\n\
+  -L                  allow matching with local endpoints\n\
+  -u                  best-effort instead of reliable\n\
+  -k all|N            keep-all or keep-last-N for data (ping/pong is\n\
+                      always keep-last-1)\n\
+  -n N                number of key values to use for data (only for\n\
+                      topics with a key value)\n\
+  -D DUR              run for at most DUR seconds\n\
+  -N COUNT            require at least COUNT matching participants\n\
+  -M DUR              require those participants to match within DUR seconds\n\
+\n\
+MODE... is zero or more of:\n\
+  ping [R[Hz]] [waitset|listener]\n\
+    Send a ping upon receiving all expected pongs, or send a ping at\n\
+    rate R (optionally suffixed with Hz).  The triggering mode is either\n\
+    a listener (default, unless -L has been specified) or a waitset.\n\
+  pong [waitset|listener]\n\
+    A \"dummy\" mode that serves two purposes: configuring the triggering.\n\
+    mode (but it is shared with ping's mode), and suppressing the 1Hz ping\n\
+    if no other options are selected.  It always responds to pings.\n\
+  sub [waitset|listener|polling]\n\
+    Subscribe to data, with calls to take occurring either in a listener\n\
+    (default), when a waitset is triggered, or by polling at 1kHz.\n\
+  pub [R[Hz]] [burst N] [[ping] X%%]\n\
+    Publish bursts of data at rate R, optionally suffixed with Hz.  If\n\
+    no rate is given or R is \"inf\", data is published as fast as\n\
+    possible.  Each burst is a single sample by default, but can be set\n\
+    to larger value using \"burst N\".\n\
+    If desired, a fraction of the samples can be treated as if it were a\n\
+    ping, for this, specify a percentage either as \"ping X%%\" (the\n\
+    \"ping\" keyword is optional, the %% sign is not).\n\
+\n\
+If no MODE specified, it defaults to a 1Hz ping + responding to any pings.\n\
+", argv0, argv0);
+  fflush (stdout);
+  exit (3);
+}
+
+struct string_int_map_elem {
+  const char *name;
+  int value;
+};
+
+static const struct string_int_map_elem modestrings[] = {
+  { "ping", 1 },
+  { "pong", 2 },
+  { "sub", 3 },
+  { "pub", 4 },
+  { NULL, 0 }
+};
+
+static const struct string_int_map_elem pingpongmodes[] = {
+  { "waitset", SM_WAITSET },
+  { "listener", SM_LISTENER },
+  { NULL, 0 }
+};
+
+static int exact_string_int_map_lookup (const struct string_int_map_elem *elems, const char *label, const char *str, bool notfound_error)
+{
+  for (size_t i = 0; elems[i].name; i++)
+    if (strcmp (elems[i].name, str) == 0)
+      return elems[i].value;
+  if (notfound_error)
+    error3 ("%s: undefined %s", str, label);
+  return -1;
+}
+
+static int string_int_map_lookup (const struct string_int_map_elem *elems, const char *label, const char *str, bool notfound_error)
+{
+  size_t match = SIZE_MAX;
+  size_t len = strlen (str);
+  bool ambiguous = false;
+  for (size_t i = 0; elems[i].name; i++)
+  {
+    if (strcmp (elems[i].name, str) == 0)
+      return elems[match].value;
+    else if (len >= 3 && strlen (elems[i].name) >= 3 && strncmp (elems[i].name, str, len) == 0)
+    {
+      if (match == SIZE_MAX)
+        match = i;
+      else
+        ambiguous = true;
+    }
+  }
+  if (ambiguous)
+    error3 ("%s: ambiguous %sspecification", str, label);
+  if (match == SIZE_MAX && notfound_error)
+    error3 ("%s: undefined %s", str, label);
+  return (match == SIZE_MAX) ? -1 : elems[match].value;
+}
+
+static void set_mode_ping (int *xoptind, int xargc, char * const xargv[])
+{
+  ping_intv = 0;
+  pingpongmode = SM_LISTENER;
+  while (*xoptind < xargc && exact_string_int_map_lookup (modestrings, "mode string", xargv[*xoptind], false) == -1)
+  {
+    int pos;
+    double r;
+    if (strcmp (xargv[*xoptind], "inf") == 0)
+    {
+      ping_intv = 0;
+    }
+    else if (sscanf (xargv[*xoptind], "%lf%n", &r, &pos) == 1 && (xargv[*xoptind][pos] == 0 || strcmp (xargv[*xoptind] + pos, "Hz") == 0))
+    {
+      if (r == 0) ping_intv = DDS_INFINITY;
+      else if (r > 0) ping_intv = (dds_duration_t) (1e9 / rate + 0.5);
+      else error3 ("%s: invalid ping rate\n", xargv[*xoptind]);
+    }
+    else
+    {
+      pingpongmode = (enum submode) string_int_map_lookup (pingpongmodes, "ping mode", xargv[*xoptind], true);
+    }
+    (*xoptind)++;
+  }
+}
+
+static void set_mode_pong (int *xoptind, int xargc, char * const xargv[])
+{
+  pingpongmode = SM_LISTENER;
+  while (*xoptind < xargc && exact_string_int_map_lookup (modestrings, "mode string", xargv[*xoptind], false) == -1)
+  {
+    pingpongmode = (enum submode) string_int_map_lookup (pingpongmodes, "pong mode", xargv[*xoptind], true);
+    (*xoptind)++;
+  }
+}
+
+static void set_mode_sub (int *xoptind, int xargc, char * const xargv[])
+{
+  static const struct string_int_map_elem submodes[] = {
+    { "waitset", SM_WAITSET },
+    { "polling", SM_POLLING },
+    { "listener", SM_LISTENER },
+    { NULL, 0 }
+  };
+  submode = SM_LISTENER;
+  while (*xoptind < xargc && exact_string_int_map_lookup (modestrings, "mode string", xargv[*xoptind], false) == -1)
+  {
+    submode = (enum submode) string_int_map_lookup (submodes, "subscription mode", xargv[*xoptind], true);
+    (*xoptind)++;
+  }
+}
+
+static void set_mode_pub (int *xoptind, int xargc, char * const xargv[])
+{
+  rate = HUGE_VAL;
+  burstsize = 1;
+  ping_frac = 0;
+  while (*xoptind < xargc && exact_string_int_map_lookup (modestrings, "mode string", xargv[*xoptind], false) == -1)
+  {
+    int pos = 0;
+    double r;
+    if (strcmp (xargv[*xoptind], "inf") == 0 || strcmp (xargv[*xoptind], "infHz") == 0)
+    {
+      rate = HUGE_VAL;
+    }
+    else if (sscanf (xargv[*xoptind], "%lf%n", &r, &pos) == 1 && (xargv[*xoptind][pos] == 0 || strcmp (xargv[*xoptind] + pos, "Hz") == 0))
+    {
+      if (r < 0) error3 ("%s: invalid publish rate\n", xargv[*xoptind]);
+      rate = r;
+    }
+    else if (strcmp (xargv[*xoptind], "burst") == 0)
+    {
+      unsigned b;
+      if (++(*xoptind) == xargc)
+        error3 ("argument missing in burst size specification\n");
+      if (sscanf (xargv[*xoptind], "%u%n", &b, &pos) == 1 && xargv[*xoptind][pos] == 0)
+        burstsize = b;
+      else
+        error3 ("%s: invalid burst size specification\n", xargv[*xoptind]);
+    }
+    else if (sscanf (xargv[*xoptind], "%lf%n", &r, &pos) == 1 && strcmp (xargv[*xoptind] + pos, "%") == 0)
+    {
+      if (r < 0 || r > 100) error3 ("%s: ping fraction out of range\n", xargv[*xoptind]);
+      ping_frac = (uint32_t) (UINT32_MAX * (r / 100.0) + 0.5);
+    }
+    else if (strcmp (xargv[*xoptind], "ping") == 0 && *xoptind + 1 < xargc && sscanf (xargv[*xoptind + 1], "%lf%%%n", &rate, &pos) == 1 && xargv[*xoptind + 1][pos] == 0)
+    {
+      ++(*xoptind);
+      if (r < 0 || r > 100) error3 ("%s: ping fraction out of range\n", xargv[*xoptind]);
+      ping_frac = (uint32_t) (UINT32_MAX * (r / 100.0) + 0.5);
+    }
+    else
+    {
+      error3 ("%s: unrecognised publish specification\n", xargv[*xoptind]);
+    }
+    (*xoptind)++;
+  }
+}
+
+static void set_mode (int xoptind, int xargc, char * const xargv[])
+{
+  int code;
+  rate = 0.0;
+  submode = SM_NONE;
+  pingpongmode = SM_LISTENER;
+  ping_intv = (xoptind == xargc) ? DDS_SECS (1) : DDS_INFINITY;
+  ping_frac = 0;
+  while (xoptind < xargc && (code = exact_string_int_map_lookup (modestrings, "mode string", xargv[xoptind], true)) != -1)
+  {
+    xoptind++;
+    switch (code)
+    {
+      case 1: set_mode_ping (&xoptind, xargc, xargv); break;
+      case 2: set_mode_pong (&xoptind, xargc, xargv); break;
+      case 3: set_mode_sub (&xoptind, xargc, xargv); break;
+      case 4: set_mode_pub (&xoptind, xargc, xargv); break;
+    }
+  }
+  if (xoptind != xargc)
+  {
+    error3 ("%s: unrecognized argument\n", xargv[xoptind]);
+  }
+}
+
+int main (int argc, char *argv[])
+{
+  dds_entity_t ws;
+  dds_return_t rc;
+  dds_qos_t *qos;
+  dds_listener_t *listener;
+  int opt;
+  ddsrt_threadattr_t attr;
+  ddsrt_thread_t pubtid, subtid, subpingtid, subpongtid;
+#ifndef _WIN32
+  sigset_t sigset, osigset;
+  ddsrt_thread_t sigtid;
+#endif
+  ddsrt_threadattr_init (&attr);
+
+  argv0 = argv[0];
+
+  if (argc == 2 && strcmp (argv[1], "help") == 0)
+    usage ();
+  while ((opt = getopt (argc, argv, "D:n:z:k:uLT:M:N:h")) != EOF)
+  {
+    switch (opt)
+    {
+      case 'D': dur = atof (optarg); if (dur <= 0) dur = HUGE_VAL; break;
+      case 'n': nkeyvals = (unsigned) atoi (optarg); break;
+      case 'u': reliable = false; break;
+      case 'k': histdepth = atoi (optarg); if (histdepth < 0) histdepth = 0; break;
+      case 'L': ignorelocal = DDS_IGNORELOCAL_NONE; break;
+      case 'T':
+        if (strcmp (optarg, "KS") == 0) topicsel = KS;
+        else if (strcmp (optarg, "K32") == 0) topicsel = K32;
+        else if (strcmp (optarg, "K256") == 0) topicsel = K256;
+        else if (strcmp (optarg, "OU") == 0) topicsel = OU;
+        else error3 ("%s: unknown topic\n", optarg);
+        break;
+      case 'M': maxwait = atof (optarg); if (maxwait <= 0) maxwait = HUGE_VAL; break;
+      case 'N': minmatch = (unsigned) atoi (optarg); break;
+      case 'z': baggagesize = (unsigned) atoi (optarg); break;
+      case 'h': usage (); break;
+      default: error3 ("-%c: unknown option\n", opt); break;
+    }
+  }
+  set_mode (optind, argc, argv);
+
+  if (nkeyvals == 0)
+    nkeyvals = 1;
+  if (topicsel == OU && nkeyvals != 1)
+    error3 ("-n%u invalid: topic OU has no key\n", nkeyvals);
+  if (topicsel != KS && baggagesize != 0)
+    error3 ("-z%u invalid: only topic KS has a sequence\n", baggagesize);
+
+  ddsrt_avl_init (&ppants_td, &ppants);
+  ddsrt_fibheap_init (&ppants_to_match_fhd, &ppants_to_match);
+
+  ddsrt_mutex_init (&disc_lock);
+  ddsrt_mutex_init (&pongstat_lock);
+  ddsrt_mutex_init (&pongwr_lock);
+  ddsrt_mutex_init (&pubstat_lock);
+
+  pubstat_hist = hist_new (30, 1000, 0);
+
+  qos = dds_create_qos ();
+  /* set user data: magic cookie, whether we have a reader for the Data topic
+     (all other endpoints always exist), and our hostname */
+  {
+    unsigned pos;
+    char udata[256];
+    pos = (unsigned) snprintf (udata, sizeof (udata), UDATA_MAGIC"%d:%"PRIdPID":", submode != SM_NONE, ddsrt_getpid ());
+    assert (pos < sizeof (udata));
+    if (ddsrt_gethostname (udata + pos, sizeof (udata) - pos) != DDS_RETCODE_OK)
+      strcpy (udata + UDATA_MAGIC_SIZE, "?");
+    dds_qset_userdata (qos, udata, strlen (udata));
+  }
+  if ((dp = dds_create_participant (did, qos, NULL)) < 0)
+    error2 ("dds_create_participant(domain %d) failed: %d\n", (int) did, (int) dp);
+  dds_delete_qos (qos);
+  dds_write_set_batch (true);
+  if ((rc = dds_get_instance_handle (dp, &dp_handle)) < 0)
+    error2 ("dds_get_instance_handle(participant) failed: %d\n", (int) rc);
+
+  qos = dds_create_qos ();
+  dds_qset_partition1 (qos, "DDSPerf");
+  if ((sub = dds_create_subscriber (dp, NULL, NULL)) < 0)
+    error2 ("dds_create_subscriber failed: %d\n", (int) dp);
+  if ((pub = dds_create_publisher (dp, NULL, NULL)) < 0)
+    error2 ("dds_create_publisher failed: %d\n", (int) dp);
+  dds_delete_qos (qos);
+
+  {
+    const char *tp_suf = "";
+    const dds_topic_descriptor_t *tp_desc = NULL;
+    switch (topicsel)
+    {
+      case KS:   tp_suf = "KS";   tp_desc = &KeyedSeq_desc; break;
+      case K32:  tp_suf = "K32";  tp_desc = &Keyed32_desc;  break;
+      case K256: tp_suf = "K256"; tp_desc = &Keyed256_desc; break;
+      case OU:   tp_suf = "OU";   tp_desc = &OneULong_desc; break;
+    }
+    snprintf (tpname_data, sizeof (tpname_data), "DDSPerf%cData%s", reliable ? 'R' : 'U', tp_suf);
+    snprintf (tpname_ping, sizeof (tpname_ping), "DDSPerf%cPing%s", reliable ? 'R' : 'U', tp_suf);
+    snprintf (tpname_pong, sizeof (tpname_pong), "DDSPerf%cPong%s", reliable ? 'R' : 'U', tp_suf);
+    qos = dds_create_qos ();
+    dds_qset_reliability (qos, reliable ? DDS_RELIABILITY_RELIABLE : DDS_RELIABILITY_BEST_EFFORT, DDS_SECS (1));
+    if ((tp_data = dds_create_topic (dp, tp_desc, tpname_data, qos, NULL)) < 0)
+      error2 ("dds_create_topic(%s) failed: %d\n", tpname_data, (int) tp_data);
+    if ((tp_ping = dds_create_topic (dp, tp_desc, tpname_ping, qos, NULL)) < 0)
+      error2 ("dds_create_topic(%s) failed: %d\n", tpname_ping, (int) tp_ping);
+    if ((tp_pong = dds_create_topic (dp, tp_desc, tpname_pong, qos, NULL)) < 0)
+      error2 ("dds_create_topic(%s) failed: %d\n", tpname_pong, (int) tp_pong);
+    dds_delete_qos (qos);
+  }
+
+  /* participants reader must exist before the "publication matched" or "subscription matched"
+     listener is invoked, or it won't be able to get the details (FIXME: even the DDS spec
+     has convenience functions for that ...) */
+  listener = dds_create_listener (NULL);
+  dds_lset_data_available (listener, participant_data_listener);
+  if ((rd_participants = dds_create_reader (dp, DDS_BUILTIN_TOPIC_DCPSPARTICIPANT, NULL, listener)) < 0)
+    error2 ("dds_create_reader(participants) failed: %d\n", (int) rd_participants);
+  dds_delete_listener (listener);
+  if ((rd_subscriptions = dds_create_reader (dp, DDS_BUILTIN_TOPIC_DCPSSUBSCRIPTION, NULL, NULL)) < 0)
+    error2 ("dds_create_reader(subscriptions) failed: %d\n", (int) rd_subscriptions);
+  if ((rd_publications = dds_create_reader (dp, DDS_BUILTIN_TOPIC_DCPSPUBLICATION, NULL, NULL)) < 0)
+    error2 ("dds_create_reader(publications) failed: %d\n", (int) rd_publications);
+
+  /* ping reader/writer uses keep-last-1 history; not checking matching on these (yet) */
+  qos = dds_create_qos ();
+  dds_qset_history (qos, DDS_HISTORY_KEEP_LAST, 1);
+  dds_qset_ignorelocal (qos, ignorelocal);
+  listener = dds_create_listener ((void *) (uintptr_t) MM_WR_PING);
+  dds_lset_subscription_matched (listener, subscription_matched_listener);
+  if ((rd_ping = dds_create_reader (sub, tp_ping, qos, listener)) < 0)
+    error2 ("dds_create_reader(%s) failed: %d\n", tpname_ping, (int) rd_ping);
+  dds_delete_listener (listener);
+  listener = dds_create_listener ((void *) (uintptr_t) MM_RD_PING);
+  dds_lset_publication_matched (listener, publication_matched_listener);
+  if ((wr_ping = dds_create_writer (pub, tp_ping, qos, listener)) < 0)
+    error2 ("dds_create_writer(%s) failed: %d\n", tpname_ping, (int) wr_ping);
+  dds_delete_listener (listener);
+  dds_delete_qos (qos);
+
+  /* data reader/writer use a keep-all history with generous resource limits. */
+  qos = dds_create_qos ();
+  if (histdepth == 0)
+    dds_qset_history (qos, DDS_HISTORY_KEEP_ALL, 1);
+  else
+    dds_qset_history (qos, DDS_HISTORY_KEEP_LAST, histdepth);
+  dds_qset_resource_limits (qos, 10000, DDS_LENGTH_UNLIMITED, DDS_LENGTH_UNLIMITED);
+  dds_qset_ignorelocal (qos, ignorelocal);
+  listener = dds_create_listener ((void *) (uintptr_t) MM_WR_DATA);
+  dds_lset_subscription_matched (listener, subscription_matched_listener);
+  if (submode != SM_NONE && (rd_data = dds_create_reader (sub, tp_data, qos, listener)) < 0)
+    error2 ("dds_create_reader(%s) failed: %d\n", tpname_data, (int) rd_data);
+  dds_delete_listener (listener);
+  listener = dds_create_listener ((void *) (uintptr_t) MM_RD_DATA);
+  dds_lset_publication_matched (listener, publication_matched_listener);
+  if ((wr_data = dds_create_writer (pub, tp_data, qos, listener)) < 0)
+    error2 ("dds_create_writer(%s) failed: %d\n", tpname_data, (int) wr_data);
+  dds_delete_listener (listener);
+
+  /* We only need a pong reader when sending data with a non-zero probability
+     of it being a "ping", or when sending "real" pings.  I.e., if
+       rate > 0 && ping_frac > 0) || ping_intv != DDS_NEVER
+     but it doesn't really hurt to have the reader either, and always creating
+     it and futhermore eagerly creating the pong writers means we can do more
+     checking.  */
+  {
+    /* participant listener should have already been called for "dp", so we
+       can simply look up the details on ourself to get at the GUID of the
+       participant */
+    struct guidstr guidstr;
+    struct ppant *pp;
+    dds_entity_t sub_pong;
+    ddsrt_mutex_lock (&disc_lock);
+    if ((pp = ddsrt_avl_lookup (&ppants_td, &ppants, &dp_handle)) == NULL)
+    {
+      printf ("participant %"PRIx64" (self) not found\n", dp_handle);
+      exit (2);
+    }
+    make_guidstr (&guidstr, &pp->guid);
+    ddsrt_mutex_unlock (&disc_lock);
+    dds_qos_t *subqos = dds_create_qos ();
+    dds_qset_partition1 (subqos, guidstr.str);
+    if ((sub_pong = dds_create_subscriber (dp, subqos, NULL)) < 0)
+      error2 ("dds_create_subscriber(pong) failed: %d\n", (int) sub_pong);
+    dds_delete_qos (subqos);
+    listener = dds_create_listener ((void *) (uintptr_t) MM_WR_PONG);
+    dds_lset_subscription_matched (listener, subscription_matched_listener);
+    if ((rd_pong = dds_create_reader (sub_pong, tp_pong, qos, listener)) < 0)
+      error2 ("dds_create_reader(%s) failed: %d\n", tpname_pong, (int) rd_pong);
+    dds_delete_listener (listener);
+  }
+  dds_delete_qos (qos);
+
+  if ((termcond = dds_create_guardcondition (dp)) < 0)
+    error2 ("dds_create_guardcondition(termcond) failed: %d\n", (int) termcond);
+  if ((ws = dds_create_waitset (dp)) < 0)
+    error2 ("dds_create_waitset(main) failed: %d\n", (int) ws);
+  if ((rc = dds_waitset_attach (ws, termcond, 0)) < 0)
+    error2 ("dds_waitset_attach(main, termcond) failed: %d\n", (int) rc);
+
+  /* I hate Unix signals in multi-threaded processes ... */
+#ifdef _WIN32
+  signal (SIGINT, signal_handler);
+#else
+  sigemptyset (&sigset);
+  sigaddset (&sigset, SIGINT);
+  sigaddset (&sigset, SIGTERM);
+  sigprocmask (SIG_BLOCK, &sigset, &osigset);
+  ddsrt_thread_create (&sigtid, "sigthread", &attr, sigthread, &sigset);
+#endif
+
+  /* Make publisher & subscriber thread arguments and start the threads we
+     need (so what if we allocate memory for reading data even if we don't
+     have a reader or will never really be receiving data) */
+  struct subthread_arg subarg_data, subarg_ping, subarg_pong;
+  init_eseq_admin (&eseq_admin, nkeyvals);
+  subthread_arg_init (&subarg_data, rd_data, 100);
+  subthread_arg_init (&subarg_ping, rd_ping, 100);
+  subthread_arg_init (&subarg_pong, rd_pong, 100);
+  uint32_t (*subthread_func) (void *arg) = 0;
+  switch (submode)
+  {
+    case SM_NONE:     break;
+    case SM_WAITSET:  subthread_func = subthread_waitset; break;
+    case SM_POLLING:  subthread_func = subthread_polling; break;
+    case SM_LISTENER: break;
+  }
+  memset (&pubtid, 0, sizeof (pubtid));
+  memset (&subtid, 0, sizeof (subtid));
+  memset (&subpingtid, 0, sizeof (subpingtid));
+  memset (&subpongtid, 0, sizeof (subpongtid));
+  if (rate > 0)
+    ddsrt_thread_create (&pubtid, "pub", &attr, pubthread, NULL);
+  if (subthread_func != 0)
+    ddsrt_thread_create (&subtid, "sub", &attr, subthread_func, &subarg_data);
+  else if (submode == SM_LISTENER)
+    set_data_available_listener (rd_data, "rd_data", data_available_listener, &subarg_data);
+  /* Need to handle incoming "pong"s only if we can be sending "ping"s (whether that
+     be pings from the "ping" mode (i.e. ping_intv != DDS_NEVER), or pings embedded
+     in the published data stream (i.e. rate > 0 && ping_frac > 0).  The trouble with
+     the first category is that a publication/subscription pair in the same process
+     would result in a "thread awake nesting" overflow (and otherwise in a stack
+     overflow) because each sample triggers the next.  So in that particular case we
+     had better create a waitset. */
+  const bool pingpong_waitset = (ping_intv != DDS_NEVER && ignorelocal == DDS_IGNORELOCAL_NONE) || pingpongmode == SM_WAITSET;
+  if (pingpong_waitset)
+  {
+    ddsrt_thread_create (&subpingtid, "sub", &attr, subpingthread_waitset, &subarg_pong);
+    ddsrt_thread_create (&subpongtid, "sub", &attr, subpongthread_waitset, &subarg_pong);
+  }
+  else
+  {
+    set_data_available_listener (rd_ping, "rd_ping", ping_available_listener, &subarg_ping);
+    set_data_available_listener (rd_pong, "rd_pong", pong_available_listener, &subarg_pong);
+  }
+
+  /* Run until time limit reached or a signal received.  (The time calculations
+     ignore the possibility of overflow around the year 2260.) */
+  dds_time_t tnow = dds_time ();
+  const dds_time_t tstart = tnow;
+  dds_time_t tmatch = (maxwait == HUGE_VAL) ? DDS_NEVER : tstart + (int64_t) (maxwait * 1e9 + 0.5);
+  const dds_time_t tstop = (dur == HUGE_VAL) ? DDS_NEVER : tstart + (int64_t) (dur * 1e9 + 0.5);
+  dds_time_t tnext = tstart + DDS_SECS (1);
+  dds_time_t tlast = tstart;
+  dds_time_t tnextping = (ping_intv == DDS_INFINITY) ? DDS_NEVER : (ping_intv == 0) ? tstart + DDS_SECS (1) : tstart + ping_intv;
+  while (!termflag && tnow < tstop)
+  {
+    dds_time_t twakeup = DDS_NEVER;
+    int32_t nxs;
+
+    /* bail out if too few readers discovered within the deadline */
+    if (tnow >= tmatch)
+    {
+      bool ok;
+      ddsrt_mutex_lock (&disc_lock);
+      ok = (matchcount >= minmatch);
+      ddsrt_mutex_unlock (&disc_lock);
+      if (ok)
+        tmatch = DDS_NEVER;
+      else
+      {
+        /* set minmatch to an impossible value to avoid a match occurring between now and
+           the determining of the exit status from causing a successful return */
+        minmatch = UINT32_MAX;
+        break;
+      }
+    }
+
+    /* sometimes multicast only works one way, thus it makes sense to verify
+       reader/writer matching takes place within a set amount of time after
+       discovering the participant. */
+    {
+      struct ppant *pp;
+      ddsrt_mutex_lock (&disc_lock);
+      while ((pp = ddsrt_fibheap_min (&ppants_to_match_fhd, &ppants_to_match)) != NULL && pp->tdeadline < tnow)
+      {
+        (void) ddsrt_fibheap_extract_min (&ppants_to_match_fhd, &ppants_to_match);
+        if (pp->unmatched != 0)
+        {
+          printf ("[%"PRIdPID"] participant %s:%"PRIu32": failed to match in %.3fs\n", ddsrt_getpid (), pp->hostname, pp->pid, (double) (pp->tdeadline - pp->tdisc) / 1e9);
+          fflush (stdout);
+          matchtimeout++;
+        }
+        /* keep the participant in the admin so we will never look at it again */
+        pp->tdeadline = DDS_NEVER;
+      }
+      if (pp && pp->tdeadline < tnext)
+      {
+        twakeup = pp->tdeadline;
+      }
+      ddsrt_mutex_unlock (&disc_lock);
+    }
+
+    /* next wakeup should be when the next event occurs */
+    if (tnext < twakeup)
+      twakeup = tnext;
+    if (tstop < twakeup)
+      twakeup = tstop;
+    if (tmatch < twakeup)
+      twakeup = tmatch;
+    if (tnextping < twakeup)
+      twakeup = tnextping;
+
+    if ((nxs = dds_waitset_wait_until (ws, NULL, 0, twakeup)) < 0)
+      error2 ("dds_waitset_wait_until(main): error %d\n", (int) nxs);
+
+    /* try to print exactly once per second, but do gracefully handle a very late wakeup */
+    tnow = dds_time ();
+    if (tnext <= tnow)
+    {
+      print_stats (tstart, tnow, tlast);
+      tlast = tnow;
+      if (tnow > tnext + DDS_MSECS (500))
+        tnext = tnow + DDS_SECS (1);
+      else
+        tnext += DDS_SECS (1);
+    }
+
+    /* If a "real" ping doesn't result in the expected number of pongs within a reasonable
+       time, send a new ping to restart the process.  This can happen as a result of starting
+       or stopping a process, as a result of packet loss if best-effort reliability is
+       selected, or as a result of overwhelming the ping/pong from the data publishing thread
+       (as the QoS is a simple keep-last-1) */
+    if (tnextping <= tnow)
+    {
+      maybe_send_new_ping (tnow, &tnextping);
+    }
+  }
+
+#if _WIN32
+  signal_handler (SIGINT);
+#else
+  {
+    /* get the attention of the signal handler thread */
+    void (*osigint) (int);
+    void (*osigterm) (int);
+    kill (getpid (), SIGTERM);
+    ddsrt_thread_join (sigtid, NULL);
+    osigint = signal (SIGINT, SIG_IGN);
+    osigterm = signal (SIGTERM, SIG_IGN);
+    sigprocmask (SIG_SETMASK, &osigset, NULL);
+    signal (SIGINT, osigint);
+    signal (SIGINT, osigterm);
+  }
+#endif
+
+  if (rate > 0)
+    ddsrt_thread_join (pubtid, NULL);
+  if (subthread_func != 0)
+    ddsrt_thread_join (subtid, NULL);
+  if (pingpong_waitset)
+  {
+    ddsrt_thread_join (subpingtid, NULL);
+    ddsrt_thread_join (subpongtid, NULL);
+  }
+
+  /* stop the listeners before deleting the readers: otherwise they may
+     still try to access a reader that has already become inaccessible
+     (not quite good, but ...) */
+  dds_set_listener (rd_ping, NULL);
+  dds_set_listener (rd_pong, NULL);
+  dds_set_listener (rd_data, NULL);
+  dds_set_listener (rd_participants, NULL);
+  dds_set_listener (rd_subscriptions, NULL);
+  dds_set_listener (rd_publications, NULL);
+
+  /* Delete rd_data early to workaround a deadlock deleting a reader
+     or writer while the receive thread (or a delivery thread) got
+     stuck trying to write into a reader that hit its resource limits.
+
+     The deadlock is that the deleting of a reader/writer requires
+     waiting for the DDSI-level entity to be deleted (a multi-stage
+     GC process), and a "stuck" receive thread prevents the GC from
+     making progress.
+
+     The fix is to eliminate the waiting and retrying, and instead
+     flip the reader's state to out-of-sync and rely on retransmits
+     to let it make progress once room is available again.  */
+  dds_delete (rd_data);
+
+  uint64_t nlost = 0;
+  for (uint32_t i = 0; i < eseq_admin.nph; i++)
+    nlost += eseq_admin.stats[i].nlost;
+  fini_eseq_admin (&eseq_admin);
+  subthread_arg_fini (&subarg_data);
+  subthread_arg_fini (&subarg_ping);
+  subthread_arg_fini (&subarg_pong);
+  dds_delete (dp);
+  ddsrt_mutex_destroy (&disc_lock);
+  ddsrt_mutex_destroy (&pongwr_lock);
+  ddsrt_mutex_destroy (&pongstat_lock);
+  ddsrt_mutex_destroy (&pubstat_lock);
+  hist_free (pubstat_hist);
+
+  bool ok = true;
+
+  {
+    ddsrt_avl_iter_t it;
+    struct ppant *pp;
+    for (pp = ddsrt_avl_iter_first (&ppants_td, &ppants, &it); pp; pp = ddsrt_avl_iter_next (&it))
+      if (pp->unmatched != 0)
+      {
+        char buf[256];
+        printf ("[%"PRIdPID"] error: %s:%"PRIu32" failed to match %s\n", ddsrt_getpid (), pp->hostname, pp->pid, match_mask_to_string (buf, sizeof (buf), pp->unmatched));
+        ok = false;
+      }
+  }
+  if (matchcount < minmatch)
+  {
+    printf ("[%"PRIdPID"] error: too few matching participants (%"PRIu32" instead of %"PRIu32")\n", ddsrt_getpid (), matchcount, minmatch);
+    ok = false;
+  }
+  if (nlost > 0 && (reliable && histdepth == 0))
+  {
+    printf ("[%"PRIdPID"] error: %"PRIu64" samples lost\n", ddsrt_getpid (), nlost);
+    ok = false;
+  }
+  return ok ? 0 : 1;
+}
diff --git a/src/tools/ddsperf/ddsperf_types.idl b/src/tools/ddsperf/ddsperf_types.idl
new file mode 100644
index 0000000..806f30d
--- /dev/null
+++ b/src/tools/ddsperf/ddsperf_types.idl
@@ -0,0 +1,29 @@
+struct OneULong
+{
+  unsigned long seq;
+};
+#pragma keylist OneULong
+
+struct Keyed32
+{
+  unsigned long seq;
+  unsigned long keyval;
+  octet baggage[24];
+};
+#pragma keylist Keyed32 keyval
+
+struct Keyed256
+{
+  unsigned long seq;
+  unsigned long keyval;
+  octet baggage[248];
+};
+#pragma keylist Keyed256 keyval
+
+struct KeyedSeq
+{
+  unsigned long seq;
+  unsigned long keyval;
+  sequence<octet> baggage;
+};
+#pragma keylist KeyedSeq keyval

From 386d5d30294bdaee71e4a11ca5fa999473cd0cf5 Mon Sep 17 00:00:00 2001
From: Erik Boasson <eb@ilities.com>
Date: Tue, 23 Apr 2019 13:25:40 +0200
Subject: [PATCH 041/238] remove Lease element from test config

The element has long been meaningless and got deprecated in commit
c3dca32a2f8dc43be79745e65adcc1066d75dc36.

Signed-off-by: Erik Boasson <eb@ilities.com>
---
 src/core/ddsc/tests/config_simple_udp.xml | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/src/core/ddsc/tests/config_simple_udp.xml b/src/core/ddsc/tests/config_simple_udp.xml
index 27329bd..f96c737 100644
--- a/src/core/ddsc/tests/config_simple_udp.xml
+++ b/src/core/ddsc/tests/config_simple_udp.xml
@@ -16,9 +16,6 @@
   <Domain>
     <Id>3</Id>
   </Domain>
-  <Lease>
-    <ExpiryTime update_factor="2e-1"/>
-  </Lease>
   <DDSI2E>
     <General>
       <NetworkInterfaceAddress>127.0.0.1</NetworkInterfaceAddress>

From 5a8197fa2be16c28d121bccf20bf792fdd75b9f9 Mon Sep 17 00:00:00 2001
From: Martin Bremmer <martin.bremmer@adlinktech.com>
Date: Fri, 5 Apr 2019 15:00:48 +0200
Subject: [PATCH 042/238] Rudimentary process management.

Signed-off-by: Martin Bremmer <martin.bremmer@adlinktech.com>
---
 src/ddsrt/CMakeLists.txt                |   3 +-
 src/ddsrt/include/dds/ddsrt/process.h   | 173 ++++++++-
 src/ddsrt/src/process.c                 |  27 --
 src/ddsrt/src/process/posix/process.c   | 303 ++++++++++++++++
 src/ddsrt/src/process/windows/process.c | 447 ++++++++++++++++++++++++
 src/ddsrt/tests/CMakeLists.txt          |  24 ++
 src/ddsrt/tests/process.c               | 284 +++++++++++++++
 src/ddsrt/tests/process_app.c           | 108 ++++++
 src/ddsrt/tests/process_test.h.in       |  42 +++
 9 files changed, 1378 insertions(+), 33 deletions(-)
 delete mode 100644 src/ddsrt/src/process.c
 create mode 100644 src/ddsrt/src/process/posix/process.c
 create mode 100644 src/ddsrt/src/process/windows/process.c
 create mode 100644 src/ddsrt/tests/process.c
 create mode 100644 src/ddsrt/tests/process_app.c
 create mode 100644 src/ddsrt/tests/process_test.h.in

diff --git a/src/ddsrt/CMakeLists.txt b/src/ddsrt/CMakeLists.txt
index 404f425..5b49248 100644
--- a/src/ddsrt/CMakeLists.txt
+++ b/src/ddsrt/CMakeLists.txt
@@ -74,7 +74,6 @@ list(APPEND sources
   "${source_path}/io.c"
   "${source_path}/log.c"
   "${source_path}/retcode.c"
-  "${source_path}/process.c"
   "${source_path}/strtod.c"
   "${source_path}/strtol.c")
 
@@ -104,7 +103,7 @@ list(APPEND sources
 # network stack. In order to mix-and-match various compilers, architectures,
 # operating systems, etc input from the build system is required.
 foreach(feature atomics cdtors environ heap ifaddrs random rusage
-                sockets string sync threads time md5)
+                sockets string sync threads time md5 process)
   if(EXISTS "${include_path}/dds/ddsrt/${feature}.h")
     list(APPEND headers "${include_path}/dds/ddsrt/${feature}.h")
     file(GLOB
diff --git a/src/ddsrt/include/dds/ddsrt/process.h b/src/ddsrt/include/dds/ddsrt/process.h
index b2be585..45e7099 100644
--- a/src/ddsrt/include/dds/ddsrt/process.h
+++ b/src/ddsrt/include/dds/ddsrt/process.h
@@ -13,11 +13,9 @@
 #define DDSRT_PROCESS_H
 
 #include "dds/export.h"
+#include "dds/ddsrt/time.h"
 #include "dds/ddsrt/types.h"
-
-#if defined (__cplusplus)
-extern "C" {
-#endif
+#include "dds/ddsrt/retcode.h"
 
 #if defined(_WIN32)
 typedef DWORD ddsrt_pid_t;
@@ -33,6 +31,11 @@ typedef pid_t ddsrt_pid_t;
 #endif
 #endif /* _WIN32 */
 
+
+#if defined (__cplusplus)
+extern "C" {
+#endif
+
 /**
  * @brief Return process ID (PID) of the calling process.
  *
@@ -41,6 +44,168 @@ typedef pid_t ddsrt_pid_t;
 DDS_EXPORT ddsrt_pid_t
 ddsrt_getpid(void);
 
+
+/**
+ * @brief Create new process.
+ *
+ * Creates a new process using the provided executable file. It will have
+ * default priority and scheduling.
+ *
+ * Process arguments are represented by argv, which can be null. If argv is
+ * not null, then the array must be null terminated. The argv array only has
+ * to contain the arguments, the executable filename doesn't have to be in
+ * the first element, which is normally the convention.
+ *
+ * @param[in]   executable     Executable file name.
+ * @param[in]   argv           Arguments array.
+ * @param[out]  pid            ID of the created process.
+ *
+ * @returns A dds_retcode_t indicating success or failure.
+ *
+ * @retval DDS_RETCODE_OK
+ *             Process successfully created.
+ * @retval DDS_RETCODE_BAD_PARAMETER
+ *             Provided file is not available or not executable.
+ * @retval DDS_RETCODE_NOT_ALLOWED
+ *             Caller is not permitted to start the process.
+ * @retval DDS_RETCODE_OUT_OF_RESOURCES
+ *             Not enough resources to start the process.
+ * @retval DDS_RETCODE_ERROR
+ *             Process could not be created.
+ */
+DDS_EXPORT dds_retcode_t
+ddsrt_proc_create(
+  const char *executable,
+  char *const argv[],
+  ddsrt_pid_t *pid);
+
+/**
+ * @brief Wait for a specific child process to have finished.
+ *
+ * This function takes a process id and will wait until the related process
+ * has finished or the timeout is reached.
+ *
+ * If the process finished, then the exit code of that process will be copied
+ * into the given 'code' argument.
+ *
+ * Internally, the timeout can be round-up to the nearest milliseconds or
+ * seconds, depending on the platform.
+ *
+ * See ddsrt_proc_waitpids() for waiting on all child processes.
+ *
+ * @param[in]   pid            Process ID (PID) to get the exit code from.
+ * @param[in]   timemout       Time within the process is expected to finish.
+ * @param[out]  code           The exit code of the process.
+ *
+ * @returns A dds_retcode_t indicating success or failure.
+ *
+ * @retval DDS_RETCODE_OK
+ *             Process has terminated and its exit code has been captured.
+ * @retval DDS_RETCODE_PRECONDITION_NOT_MET
+ *             Process is still alive (only when timeout == 0).
+ * @retval DDS_RETCODE_TIMEOUT
+ *             Process is still alive (even after the timeout).
+ * @retval DDS_RETCODE_BAD_PARAMETER
+ *             Negative timeout.
+ * @retval DDS_RETCODE_NOT_FOUND
+ *             Process unknown.
+ * @retval DDS_RETCODE_ERROR
+ *             Getting the exit code failed for an unknown reason.
+ */
+DDS_EXPORT dds_retcode_t
+ddsrt_proc_waitpid(
+  ddsrt_pid_t pid,
+  dds_duration_t timeout,
+  int32_t *code);
+
+/**
+ * @brief Wait for a random child process to have finished.
+ *
+ * This function will wait until anyone of the child processes has
+ * finished or the timeout is reached.
+ *
+ * If a process finished, then the exit code of that process will be
+ * copied into the given 'code' argument. The pid of the process will
+ * be put in the 'pid' argument.
+ *
+ * Internally, the timeout can be round-up to the nearest milliseconds or
+ * seconds, depending on the platform.
+ *
+ * See ddsrt_proc_waitpid() for waiting on a specific child process.
+ *
+ * @param[in]   timemout       Time within a process is expected to finish.
+ * @param[out]  pid            Process ID (PID) of the finished process.
+ * @param[out]  code           The exit code of the process.
+ *
+ * @returns A dds_retcode_t indicating success or failure.
+ *
+ * @retval DDS_RETCODE_OK
+ *             A process has terminated.
+ *             Its exit code and pid have been captured.
+ * @retval DDS_RETCODE_PRECONDITION_NOT_MET
+ *             All child processes are still alive (only when timeout == 0).
+ * @retval DDS_RETCODE_TIMEOUT
+ *             All child processes are still alive (even after the timeout).
+ * @retval DDS_RETCODE_BAD_PARAMETER
+ *             Negative timeout.
+ * @retval DDS_RETCODE_NOT_FOUND
+ *             There are no processes to wait for.
+ * @retval DDS_RETCODE_ERROR
+ *             Getting the exit code failed for an unknown reason.
+ */
+DDS_EXPORT dds_retcode_t
+ddsrt_proc_waitpids(
+  dds_duration_t timeout,
+  ddsrt_pid_t *pid,
+  int32_t *code);
+
+/**
+ * @brief Checks if a process exists.
+ *
+ * @param[in]   pid            Process ID (PID) to check if it exists.
+ *
+ * @returns A dds_retcode_t indicating success or failure.
+ *
+ * @retval DDS_RETCODE_OK
+ *             The process exists.
+ * @retval DDS_RETCODE_NOT_FOUND
+ *             The process does not exist.
+ * @retval DDS_RETCODE_ERROR
+ *             Determining if a process exists or not, failed.
+ */
+DDS_EXPORT dds_retcode_t
+ddsrt_proc_exists(
+  ddsrt_pid_t pid);
+
+/**
+ * @brief Kill a process.
+ *
+ * This function will try to forcefully kill the process (identified
+ * by pid).
+ *
+ * When DDS_RETCODE_OK is returned, it doesn't mean that the process
+ * was actually killed. It only indicates that the process was
+ * 'told' to terminate. Call ddsrt_proc_exists() to know
+ * for sure if the process was killed.
+ *
+ * @param[in]   pid       Process ID (PID) of the process to terminate.
+ *
+ * @returns A dds_retcode_t indicating success or failure.
+ *
+ * @retval DDS_RETCODE_OK
+ *             Kill attempt has been started.
+ * @retval DDS_RETCODE_BAD_PARAMETER
+ *             Process unknown.
+ * @retval DDS_RETCODE_ILLEGAL_OPERATION
+ *             Caller is not allowed to kill the process.
+ * @retval DDS_RETCODE_ERROR
+ *             Kill failed for an unknown reason.
+ */
+DDS_EXPORT dds_retcode_t
+ddsrt_proc_kill(
+  ddsrt_pid_t pid);
+
+
 #if defined (__cplusplus)
 }
 #endif
diff --git a/src/ddsrt/src/process.c b/src/ddsrt/src/process.c
deleted file mode 100644
index 4aed282..0000000
--- a/src/ddsrt/src/process.c
+++ /dev/null
@@ -1,27 +0,0 @@
-/*
- * Copyright(c) 2006 to 2018 ADLINK Technology Limited and others
- *
- * This program and the accompanying materials are made available under the
- * terms of the Eclipse Public License v. 2.0 which is available at
- * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
- * v. 1.0 which is available at
- * http://www.eclipse.org/org/documents/edl-v10.php.
- *
- * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
- */
-#include "dds/ddsrt/process.h"
-
-#if !defined(_WIN32)
-# include <unistd.h>
-#endif
-
-ddsrt_pid_t
-ddsrt_getpid(void)
-{
-#if defined(_WIN32)
-    return GetCurrentProcessId();
-#else
-    /* Mapped to taskIdSelf() in VxWorks kernel mode. */
-    return getpid();
-#endif
-}
diff --git a/src/ddsrt/src/process/posix/process.c b/src/ddsrt/src/process/posix/process.c
new file mode 100644
index 0000000..f6ed5db
--- /dev/null
+++ b/src/ddsrt/src/process/posix/process.c
@@ -0,0 +1,303 @@
+/*
+ * Copyright(c) 2006 to 2018 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+#include <stdio.h>
+#include <errno.h>
+#include <fcntl.h>
+#include <string.h>
+#include <unistd.h>
+#include <assert.h>
+#include <signal.h>
+#include <stdlib.h>
+#include <sys/wait.h>
+#include <sys/types.h>
+#include "dds/ddsrt/process.h"
+#include "dds/ddsrt/string.h"
+#include "dds/ddsrt/heap.h"
+
+
+ddsrt_pid_t
+ddsrt_getpid(void)
+{
+  /* Mapped to taskIdSelf() in VxWorks kernel mode. */
+  return getpid();
+}
+
+
+/*
+ * This'll take a argv and prefixes it with the given prefix.
+ * If argv is NULL, the new argv array will only contain the prefix and a NULL.
+ * The result array is always terminated with NULL.
+ */
+static char**
+prefix_argv(const char *prefix, char *const argv_in[])
+{
+  char **argv_out;
+  size_t argc = 0;
+
+  assert(prefix);
+
+  if (argv_in != NULL) {
+    while (argv_in[argc] != NULL) {
+      argc++;
+    }
+  }
+
+  argv_out = ddsrt_calloc((argc + 2), sizeof(char*));
+  if (argv_out) {
+    size_t argi;
+    argv_out[0] = (char*)prefix;
+    for (argi = 0; argi < argc; argi++) {
+      argv_out[argi + 1] = (char*)argv_in[argi];
+    }
+    argv_out[argc + 1] = NULL;
+  }
+
+  return argv_out;
+}
+
+
+static void no_op(int sig)
+{
+  (void)sig;
+}
+
+
+static dds_retcode_t
+waitpids(
+  ddsrt_pid_t request_pid,
+  dds_duration_t timeout,
+  ddsrt_pid_t *child_pid,
+  int32_t *code)
+{
+  struct sigaction sigactold;
+  struct sigaction sigact;
+  dds_retcode_t rv;
+  int options = 0;
+  int ret;
+  int s;
+
+  if (timeout < 0) {
+    return DDS_RETCODE_BAD_PARAMETER;
+  }
+
+  if (timeout == 0) {
+    options = WNOHANG;
+  } else if (timeout != DDS_INFINITY) {
+    /* Round-up timemout to alarm seconds. */
+    unsigned secs;
+    secs = (unsigned)(timeout / DDS_NSECS_IN_SEC);
+    if ((timeout % DDS_NSECS_IN_SEC) != 0) {
+      secs++;
+    }
+    /* Be sure that the SIGALRM only wakes up waitpid. */
+    sigemptyset (&sigact.sa_mask);
+    sigact.sa_handler = no_op;
+    sigact.sa_flags = 0;
+    sigaction (SIGALRM, &sigact, &sigactold);
+    /* Now, set the alarm. */
+    alarm(secs);
+  }
+
+  ret = waitpid(request_pid, &s, options);
+  if (ret > 0) {
+    if (code) {
+      if (WIFEXITED(s)) {
+        *code = WEXITSTATUS(s);
+      } else {
+        *code = 1;
+      }
+    }
+    if (child_pid) {
+      *child_pid = ret;
+    }
+    rv = DDS_RETCODE_OK;
+  } else if (ret == 0) {
+    /* Process is still alive. */
+    rv = DDS_RETCODE_PRECONDITION_NOT_MET;
+  } else if ((ret == -1) && (errno == EINTR)) {
+    /* Interrupted,
+     * so process(es) likely didn't change state and are/is alive. */
+    rv = DDS_RETCODE_TIMEOUT;
+  } else if ((ret == -1) && (errno == ECHILD)) {
+    /* Unknown pid. */
+    rv = DDS_RETCODE_NOT_FOUND;
+  } else {
+    /* Unknown error. */
+    rv = DDS_RETCODE_ERROR;
+  }
+
+  if ((timeout != 0) && (timeout != DDS_INFINITY)) {
+    /* Clean the alarm. */
+    alarm(0);
+    /* Reset SIGALRM actions. */
+    sigaction(SIGALRM, &sigactold, NULL);
+  }
+
+  return rv;
+}
+
+
+
+dds_retcode_t
+ddsrt_proc_create(
+  const char *executable,
+  char *const argv[],
+  ddsrt_pid_t *pid)
+{
+  dds_retcode_t rv;
+  char **exec_argv;
+  int exec_fds[2];
+  int exec_err;
+  pid_t spawn;
+  ssize_t nr;
+
+  assert(executable != NULL);
+  assert(pid != NULL);
+
+  /* Prefix the argv with the executable, which is the convention. */
+  exec_argv = prefix_argv(executable, argv);
+  if (exec_argv == NULL) {
+    return DDS_RETCODE_OUT_OF_RESOURCES;
+  }
+
+  /* Prepare pipe to know the result of the exec. */
+  if (pipe(exec_fds) == -1) {
+    rv = DDS_RETCODE_OUT_OF_RESOURCES;
+    goto fail_pipe;
+  }
+  if ((fcntl(exec_fds[0], F_SETFD, fcntl(exec_fds[0], F_GETFD) | FD_CLOEXEC) == -1) ||
+      (fcntl(exec_fds[1], F_SETFD, fcntl(exec_fds[1], F_GETFD) | FD_CLOEXEC) == -1) ){
+    rv = DDS_RETCODE_ERROR;
+    goto fail_fctl;
+  }
+
+  /* Create a new process. */
+  spawn = fork();
+  if (spawn == -1)
+  {
+    rv = DDS_RETCODE_ERROR;
+    goto fail_fork;
+  }
+  else if (spawn == 0)
+  {
+    /* Child process */
+
+    /* Run the executable, replacing current process. */
+    execv(executable, exec_argv);
+
+    /* If executing this, something has gone wrong */
+    exec_err = errno;
+    (void)write(exec_fds[1], &exec_err, sizeof(int));
+    close(exec_fds[1]);
+    close(exec_fds[0]);
+    ddsrt_free(exec_argv);
+    _exit(1);
+  }
+  else
+  {
+    /* Parent process */
+
+    /* Get execv result. */
+    rv = DDS_RETCODE_ERROR;
+    close(exec_fds[1]);
+    nr = read(exec_fds[0], &exec_err, sizeof(int));
+    if (nr == 0) {
+      /* Pipe closed by successful execv. */
+      rv = DDS_RETCODE_OK;
+    } else if (nr == sizeof(int)) {
+      /* Translate execv error. */
+      if ((exec_err == ENOENT ) ||
+          (exec_err == ENOEXEC) ){
+        rv = DDS_RETCODE_BAD_PARAMETER;
+      } else if (exec_err == EACCES) {
+        rv = DDS_RETCODE_NOT_ALLOWED;
+      }
+    }
+    close(exec_fds[0]);
+
+    if (rv == DDS_RETCODE_OK) {
+      /* Remember child pid. */
+      *pid = spawn;
+    } else {
+      /* Remove the failed fork pid from the system list. */
+      waitpid(spawn, NULL, 0);
+    }
+  }
+
+  ddsrt_free(exec_argv);
+  return rv;
+
+fail_fork:
+fail_fctl:
+  close(exec_fds[0]);
+  close(exec_fds[1]);
+fail_pipe:
+  ddsrt_free(exec_argv);
+  return rv;
+}
+
+
+
+dds_retcode_t
+ddsrt_proc_waitpid(
+  ddsrt_pid_t pid,
+  dds_duration_t timeout,
+  int32_t *code)
+{
+  if (pid > 0) {
+    return waitpids(pid, timeout, NULL, code);
+  }
+  return DDS_RETCODE_BAD_PARAMETER;
+}
+
+
+
+dds_retcode_t
+ddsrt_proc_waitpids(
+  dds_duration_t timeout,
+  ddsrt_pid_t *pid,
+  int32_t *code)
+{
+  return waitpids(0, timeout, pid, code);
+}
+
+
+
+dds_retcode_t
+ddsrt_proc_exists(
+  ddsrt_pid_t pid)
+{
+  if (kill(pid, 0) == 0)
+    return DDS_RETCODE_OK;
+  else if (errno == EPERM)
+    return DDS_RETCODE_OK;
+  else if (errno == ESRCH)
+    return DDS_RETCODE_NOT_FOUND;
+  else
+    return DDS_RETCODE_ERROR;
+}
+
+
+
+dds_retcode_t
+ddsrt_proc_kill(
+  ddsrt_pid_t pid)
+{
+  if (kill(pid, SIGKILL) == 0)
+    return DDS_RETCODE_OK;
+  else if (errno == EPERM)
+    return DDS_RETCODE_ILLEGAL_OPERATION;
+  else if (errno == ESRCH)
+    return DDS_RETCODE_BAD_PARAMETER;
+  else
+    return DDS_RETCODE_ERROR;
+}
diff --git a/src/ddsrt/src/process/windows/process.c b/src/ddsrt/src/process/windows/process.c
new file mode 100644
index 0000000..91cebec
--- /dev/null
+++ b/src/ddsrt/src/process/windows/process.c
@@ -0,0 +1,447 @@
+/*
+ * Copyright(c) 2006 to 2018 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+#include <stdio.h>
+#include <errno.h>
+#include <assert.h>
+#include <process.h>
+#include "dds/ddsrt/heap.h"
+#include "dds/ddsrt/time.h"
+#include "dds/ddsrt/string.h"
+#include "dds/ddsrt/atomics.h"
+#include "dds/ddsrt/process.h"
+#include "dds/ddsrt/timeconv.h"
+
+
+ddsrt_pid_t
+ddsrt_getpid(void)
+{
+  return GetCurrentProcessId();
+}
+
+
+
+static HANDLE        pid_to_phdl          (ddsrt_pid_t pid);
+static dds_retcode_t process_get_exit_code(HANDLE phdl, int32_t *code);
+static dds_retcode_t process_kill         (HANDLE phdl);
+static char*         commandline          (const char *exe, char *const argv_in[]);
+static BOOL          child_add            (HANDLE phdl);
+static void          child_remove         (HANDLE phdl);
+static DWORD         child_list           (HANDLE *list, DWORD max);
+static HANDLE        child_handle         (ddsrt_pid_t pid);
+
+
+
+dds_retcode_t
+ddsrt_proc_create(
+  const char *executable,
+  char *const argv[],
+  ddsrt_pid_t *pid)
+{
+  dds_retcode_t rv = DDS_RETCODE_ERROR;
+  PROCESS_INFORMATION process_info;
+  STARTUPINFO si;
+  char *cmd;
+  LPTCH environment;
+
+  assert(executable != NULL);
+  assert(pid != NULL);
+
+  cmd = commandline(executable, argv);
+  if (cmd == NULL) {
+    return DDS_RETCODE_OUT_OF_RESOURCES;
+  }
+
+  memset(&si, 0, sizeof(STARTUPINFO));
+  si.cb = sizeof(STARTUPINFO);
+
+  /* The new process will inherit the input/output handles. */
+  /* TODO: Redirect is not working yet. */
+  si.dwFlags = STARTF_USESTDHANDLES;
+  si.hStdOutput = GetStdHandle(STD_OUTPUT_HANDLE);
+  si.hStdInput  = GetStdHandle(STD_INPUT_HANDLE);
+  si.hStdError  = GetStdHandle(STD_ERROR_HANDLE);
+
+  /* Get the environment variables to pass along. */
+  environment = GetEnvironmentStrings();
+  if(environment){
+    BOOL created;
+    created = CreateProcess(executable,               // ApplicationName
+                            cmd,                      // CommandLine
+                            NULL,                     // ProcessAttributes
+                            NULL,                     // ThreadAttributes
+                            TRUE,                     // InheritHandles
+                            CREATE_NO_WINDOW,         // dwCreationFlags
+                            (LPVOID)environment,      // Environment
+                            NULL,                     // CurrentDirectory
+                            &si,                      // StartupInfo
+                            &process_info);           // ProcessInformation
+    if (created) {
+      if (child_add(process_info.hProcess)) {
+        *pid = process_info.dwProcessId;
+        rv = DDS_RETCODE_OK;
+      } else {
+        process_kill(process_info.hProcess);
+        rv = DDS_RETCODE_OUT_OF_RESOURCES;
+      }
+    } else {
+      DWORD error = GetLastError();
+      if ((ERROR_FILE_NOT_FOUND == error) ||
+          (ERROR_PATH_NOT_FOUND == error)) {
+        rv = DDS_RETCODE_BAD_PARAMETER;
+      } else if (ERROR_ACCESS_DENIED  == error) {
+        rv = DDS_RETCODE_NOT_ALLOWED;
+      }
+    }
+    FreeEnvironmentStrings(environment);
+  }
+
+  ddsrt_free(cmd);
+
+  return rv;
+}
+
+
+
+dds_retcode_t
+ddsrt_proc_waitpid(
+  ddsrt_pid_t pid,
+  dds_duration_t timeout,
+  int32_t *code)
+{
+  dds_retcode_t rv = DDS_RETCODE_OK;
+  HANDLE phdl;
+  DWORD ret;
+
+  if (timeout < 0) {
+    return DDS_RETCODE_BAD_PARAMETER;
+  }
+
+  phdl = child_handle(pid);
+  if (phdl == 0) {
+    return DDS_RETCODE_NOT_FOUND;
+  }
+
+  if (timeout > 0) {
+    ret = WaitForSingleObject(phdl, ddsrt_duration_to_msecs_ceil(timeout));
+    if (ret != WAIT_OBJECT_0) {
+      if (ret == WAIT_TIMEOUT) {
+        rv = DDS_RETCODE_TIMEOUT;
+      } else {
+        rv = DDS_RETCODE_ERROR;
+      }
+    }
+  }
+
+  if (rv == DDS_RETCODE_OK) {
+    rv = process_get_exit_code(phdl, code);
+  }
+
+  if (rv == DDS_RETCODE_OK) {
+    child_remove(phdl);
+  }
+
+
+  return rv;
+}
+
+
+
+dds_retcode_t
+ddsrt_proc_waitpids(
+  dds_duration_t timeout,
+  ddsrt_pid_t *pid,
+  int32_t *code)
+{
+  dds_retcode_t rv = DDS_RETCODE_OK;
+  HANDLE hdls[MAXIMUM_WAIT_OBJECTS];
+  HANDLE phdl;
+  DWORD cnt;
+  DWORD ret;
+
+  if (timeout < 0) {
+    return DDS_RETCODE_BAD_PARAMETER;
+  }
+
+  cnt = child_list(hdls, MAXIMUM_WAIT_OBJECTS);
+  if (cnt == 0) {
+    return DDS_RETCODE_NOT_FOUND;
+  }
+
+  ret = WaitForMultipleObjects(cnt, hdls, FALSE, ddsrt_duration_to_msecs_ceil(timeout));
+  if ((ret < WAIT_OBJECT_0) || (ret >= (WAIT_OBJECT_0 + cnt))) {
+    if (ret == WAIT_TIMEOUT) {
+      if (timeout == 0) {
+        rv = DDS_RETCODE_PRECONDITION_NOT_MET;
+      } else {
+        rv = DDS_RETCODE_TIMEOUT;
+      }
+    } else {
+      rv = DDS_RETCODE_ERROR;
+    }
+  } else {
+    /* Get the handle of the specific child that was triggered. */
+    phdl = hdls[ret - WAIT_OBJECT_0];
+  }
+
+  if (rv == DDS_RETCODE_OK) {
+    rv = process_get_exit_code(phdl, code);
+  }
+
+  if (rv == DDS_RETCODE_OK) {
+    if (pid) {
+      *pid = GetProcessId(phdl);
+    }
+    child_remove(phdl);
+  }
+
+  return rv;
+}
+
+
+
+dds_retcode_t
+ddsrt_proc_exists(
+  ddsrt_pid_t pid)
+{
+  dds_retcode_t rv = DDS_RETCODE_NOT_FOUND;
+  HANDLE phdl;
+
+  phdl = pid_to_phdl(pid);
+  if (phdl != 0) {
+    rv = process_get_exit_code(phdl, NULL);
+    if (rv == DDS_RETCODE_PRECONDITION_NOT_MET) {
+      /* Process still exists. */
+      rv = DDS_RETCODE_OK;
+    } else if (rv == DDS_RETCODE_OK) {
+      /* The process has gone. */
+      rv = DDS_RETCODE_NOT_FOUND;
+    } else {
+      rv = DDS_RETCODE_ERROR;
+    }
+    CloseHandle(phdl);
+  }
+
+  return rv;
+}
+
+
+
+dds_retcode_t
+ddsrt_proc_kill(
+  ddsrt_pid_t pid)
+{
+  dds_retcode_t rv = DDS_RETCODE_BAD_PARAMETER;
+  HANDLE phdl;
+
+  phdl = pid_to_phdl(pid);
+  if (phdl != 0) {
+    /* Forcefully kill. */
+    rv = process_kill(phdl);
+    CloseHandle(phdl);
+  }
+
+  return rv;
+}
+
+
+
+static HANDLE
+pid_to_phdl(ddsrt_pid_t pid)
+{
+  return OpenProcess(PROCESS_QUERY_LIMITED_INFORMATION | SYNCHRONIZE | PROCESS_TERMINATE, FALSE, pid);
+}
+
+
+
+static dds_retcode_t
+process_get_exit_code(
+  HANDLE phdl,
+  int32_t *code)
+{
+  dds_retcode_t rv = DDS_RETCODE_ERROR;
+  DWORD tr;
+
+  assert(phdl != 0);
+
+  if (GetExitCodeProcess(phdl, &tr)) {
+    if (tr == STILL_ACTIVE) {
+      rv = DDS_RETCODE_PRECONDITION_NOT_MET;
+    } else {
+      if (code) {
+        *code = (int32_t)tr;
+      }
+      rv = DDS_RETCODE_OK;
+    }
+  }
+
+  return rv;
+}
+
+
+
+/* Forcefully kill the given process. */
+static dds_retcode_t
+process_kill(HANDLE phdl)
+{
+  assert(phdl != 0);
+  if (TerminateProcess(phdl, 1 /* exit code */) != 0) {
+    return DDS_RETCODE_OK;
+  }
+  return DDS_RETCODE_ERROR;
+}
+
+
+
+/* Add quotes to a given string, escape it and add it to a buffer. */
+static char*
+insert_char(char *buf, size_t *len, size_t *max, char c)
+{
+  static const size_t buf_inc = 64;
+  if (*len == *max) {
+    *max += buf_inc;
+    buf = ddsrt_realloc(buf, *max);
+  }
+  if (buf) {
+    buf[(*len)++] = c;
+  }
+  return buf;
+}
+static char*
+stringify_cat(char *buf, size_t *len, size_t *max, const char *str)
+{
+  char last = '\0';
+
+  /* Start stringification with an opening double-quote. */
+  buf = insert_char(buf, len, max, '\"');
+  if (!buf) goto end;
+
+  /* Copy and escape the string. */
+  while ((*str) != '\0') {
+    if (*str == '\"') {
+      buf = insert_char(buf, len, max, '\\');
+      if (!buf) goto end;
+    }
+    buf = insert_char(buf, len, max, *str);
+    if (!buf) goto end;
+    last = *str;
+    str++;
+  }
+
+  /* For some reason, only the last backslash will be stripped.
+   * No need to escape the other backslashes. */
+  if (last == '\\') {
+    buf = insert_char(buf, len, max, '\\');
+    if (!buf) goto end;
+  }
+
+  /* End stringification. */
+  buf = insert_char(buf, len, max, '\"');
+  if (!buf) goto end;
+  buf = insert_char(buf, len, max, ' ');
+
+end:
+  return buf;
+}
+
+
+
+/* Create command line with executable and arguments. */
+static char*
+commandline(const char *exe, char *const argv_in[])
+{
+  char *cmd = NULL;
+  size_t len = 0;
+  size_t max = 0;
+  size_t argi;
+
+  assert(exe);
+
+  /* Add quoted and escaped executable. */
+  cmd = stringify_cat(cmd, &len, &max, exe);
+  if (!cmd) goto end;
+
+  /* Add quoted and escaped arguments. */
+  if (argv_in != NULL) {
+    for (argi = 0; argv_in[argi] != NULL; argi++) {
+      cmd = stringify_cat(cmd, &len, &max, argv_in[argi]);
+      if (!cmd) goto end;
+    }
+  }
+
+  /* Terminate command line string. */
+  cmd = insert_char(cmd, &len, &max, '\0');
+
+end:
+  return cmd;
+}
+
+
+/* Maintain a list of children to be able to wait for all them. */
+static ddsrt_atomic_voidp_t g_children[MAXIMUM_WAIT_OBJECTS] = {0};
+
+static BOOL
+child_update(HANDLE old, HANDLE new)
+{
+  BOOL updated = FALSE;
+  for (int i = 0; (i < MAXIMUM_WAIT_OBJECTS) && (!updated); i++)
+  {
+    updated = ddsrt_atomic_casvoidp(&(g_children[i]), old, new);
+  }
+  return updated;
+}
+
+static BOOL
+child_add(HANDLE phdl)
+{
+  return child_update(0, phdl);
+}
+
+static void
+child_remove(HANDLE phdl)
+{
+  (void)child_update(phdl, 0);
+}
+
+static DWORD
+child_list(HANDLE *list, DWORD max)
+{
+  HANDLE hdl;
+  int cnt = 0;
+  assert(list);
+  assert(max <= MAXIMUM_WAIT_OBJECTS);
+  for (int i = 0; (i < MAXIMUM_WAIT_OBJECTS); i++)
+  {
+    hdl = ddsrt_atomic_ldvoidp(&(g_children[i]));
+    if (hdl != 0) {
+      list[cnt++] = hdl;
+    }
+  }
+  return cnt;
+}
+
+static HANDLE
+child_handle(ddsrt_pid_t pid)
+{
+  HANDLE phdl = 0;
+
+  for (int i = 0; (i < MAXIMUM_WAIT_OBJECTS) && (phdl == 0); i++)
+  {
+    phdl = ddsrt_atomic_ldvoidp(&(g_children[i]));
+    if (phdl != 0) {
+      if (GetProcessId(phdl) != pid) {
+        phdl = 0;
+      }
+    }
+  }
+
+  return phdl;
+}
diff --git a/src/ddsrt/tests/CMakeLists.txt b/src/ddsrt/tests/CMakeLists.txt
index 552cfd2..02c92ef 100644
--- a/src/ddsrt/tests/CMakeLists.txt
+++ b/src/ddsrt/tests/CMakeLists.txt
@@ -25,6 +25,7 @@ set(sources
     "random.c"
     "strlcpy.c"
     "socket.c"
+    "process.c"
     "select.c")
 
 add_cunit_executable(cunit_ddsrt ${sources})
@@ -42,3 +43,26 @@ endif()
 
 target_include_directories(
   cunit_ddsrt PRIVATE "$<BUILD_INTERFACE:${CMAKE_CURRENT_BINARY_DIR}/include>")
+
+# Create a separate test application that will be used to
+# test process management.
+add_executable(process_app process_app.c)
+target_link_libraries(process_app PRIVATE ddsrt)
+target_include_directories(
+        process_app
+        PRIVATE
+        "$<BUILD_INTERFACE:${CMAKE_CURRENT_BINARY_DIR}/include>")
+# Force the app to be at the same location, no matter what platform or build type.
+set_target_properties(
+        process_app
+        PROPERTIES
+        RUNTIME_OUTPUT_DIRECTORY                ${CMAKE_CURRENT_BINARY_DIR}
+        RUNTIME_OUTPUT_DIRECTORY_DEBUG          ${CMAKE_CURRENT_BINARY_DIR}
+        RUNTIME_OUTPUT_DIRECTORY_RELEASE        ${CMAKE_CURRENT_BINARY_DIR}
+        RUNTIME_OUTPUT_DIRECTORY_RELWITHDEBINFO ${CMAKE_CURRENT_BINARY_DIR}
+        RUNTIME_OUTPUT_DIRECTORY_MINSIZEREL     ${CMAKE_CURRENT_BINARY_DIR} )
+# Let the cunit application know the location and name of the test application.
+set(process_app_name "${CMAKE_CURRENT_BINARY_DIR}/process_app${CMAKE_EXECUTABLE_SUFFIX}")
+configure_file(
+        "process_test.h.in" "${CMAKE_CURRENT_BINARY_DIR}/include/process_test.h" @ONLY)
+
diff --git a/src/ddsrt/tests/process.c b/src/ddsrt/tests/process.c
new file mode 100644
index 0000000..c000cf7
--- /dev/null
+++ b/src/ddsrt/tests/process.c
@@ -0,0 +1,284 @@
+/*
+ * Copyright(c) 2019 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+#include <stdio.h>
+#include <string.h>
+#include <assert.h>
+#include "CUnit/Test.h"
+#include "process_test.h"
+#include "dds/ddsrt/time.h"
+#include "dds/ddsrt/strtol.h"
+#include "dds/ddsrt/environ.h"
+#include "dds/ddsrt/process.h"
+
+
+/*
+ * Create a process that is expected to exit quickly.
+ * Compare the exit code with the expected exit code.
+ */
+static void create_and_test_exit(const char *arg, int code)
+{
+  dds_retcode_t ret;
+  ddsrt_pid_t pid;
+  int32_t status;
+  char *argv[] = { NULL, NULL };
+
+  argv[0] = (char*)arg;
+  ret = ddsrt_proc_create(TEST_APPLICATION, argv, &pid);
+  CU_ASSERT_EQUAL_FATAL(ret, DDS_RETCODE_OK);
+
+  ret = ddsrt_proc_waitpid(pid, DDS_SECS(10), &status);
+  CU_ASSERT_EQUAL(ret, DDS_RETCODE_OK);
+
+  /* Check result. */
+  CU_ASSERT_EQUAL(status, code);
+
+  /* Garbage collection when needed. */
+  if (ret != DDS_RETCODE_OK) {
+    ddsrt_proc_kill(pid);
+  }
+}
+
+
+/*
+ * Try to create a process without arguments.
+ * The exit status of the process should be PROCESS_DONE_NOTHING_EXIT_CODE.
+ */
+CU_Test(ddsrt_process, create)
+{
+  create_and_test_exit(NULL, TEST_CREATE_EXIT);
+}
+
+
+/*
+ * Create a process that'll sleep for a while.
+ * Try to kill that process.
+ */
+CU_Test(ddsrt_process, kill)
+{
+  dds_retcode_t ret;
+  ddsrt_pid_t pid;
+
+  /* Sleep for 20 seconds. It should be killed before then. */
+  char *argv[] = { TEST_SLEEP_ARG, "20", NULL };
+
+  ret = ddsrt_proc_create(TEST_APPLICATION, argv, &pid);
+  CU_ASSERT_EQUAL_FATAL(ret, DDS_RETCODE_OK);
+  CU_ASSERT_NOT_EQUAL_FATAL(pid, 0);
+
+  /* Check if process is running. */
+  ret = ddsrt_proc_exists(pid);
+  CU_ASSERT_EQUAL(ret, DDS_RETCODE_OK);
+
+  /* Kill it. */
+  ret = ddsrt_proc_kill(pid);
+  CU_ASSERT_EQUAL_FATAL(ret, DDS_RETCODE_OK);
+
+  /* Check if process is actually gone. */
+  ret = ddsrt_proc_waitpid(pid, DDS_SECS(10), NULL);
+  CU_ASSERT_EQUAL(ret, DDS_RETCODE_OK);
+  ret = ddsrt_proc_exists(pid);
+  CU_ASSERT_EQUAL(ret, DDS_RETCODE_NOT_FOUND);
+}
+
+
+/*
+ * Create a process that'll return it's own pid value (reduced
+ * to fit the exit code range). It should match the pid that was
+ * returned by the process create (also reduced to be able to
+ * match the returned semi-pid value).
+ */
+CU_Test(ddsrt_process, pid)
+{
+  dds_retcode_t ret;
+  ddsrt_pid_t pid;
+  int32_t status;
+  char *argv[] = { TEST_PID_ARG, NULL };
+
+  ret = ddsrt_proc_create(TEST_APPLICATION, argv, &pid);
+  CU_ASSERT_EQUAL_FATAL(ret, DDS_RETCODE_OK);
+  CU_ASSERT_NOT_EQUAL_FATAL(pid, 0);
+
+  ret = ddsrt_proc_waitpid(pid, DDS_SECS(10), &status);
+  CU_ASSERT_EQUAL(ret, DDS_RETCODE_OK);
+
+  /* Compare the pid values. */
+  CU_ASSERT_EQUAL(status, TEST_PID_EXIT(pid));
+
+  /* Garbage collection when needed. */
+  if (ret != DDS_RETCODE_OK) {
+    ddsrt_proc_kill(pid);
+  }
+}
+
+
+/*
+ * Set a environment variable in the parent process.
+ * Create a process that should have access to that env var.
+ */
+CU_Test(ddsrt_process, env)
+{
+  dds_retcode_t ret;
+
+  ret = ddsrt_setenv(TEST_ENV_VAR_NAME, TEST_ENV_VAR_VALUE);
+  CU_ASSERT_EQUAL_FATAL(ret, DDS_RETCODE_OK);
+
+  create_and_test_exit(TEST_ENV_ARG, TEST_ENV_EXIT);
+}
+
+
+/*
+ * Try to create a process with an non-existing executable file.
+ * It should fail.
+ */
+CU_Test(ddsrt_process, invalid)
+{
+  dds_retcode_t ret;
+  ddsrt_pid_t pid;
+
+  ret = ddsrt_proc_create("ProbablyNotAnValidExecutable", NULL, &pid);
+  CU_ASSERT_EQUAL_FATAL(ret, DDS_RETCODE_BAD_PARAMETER);
+
+  /* Garbage collection when needed. */
+  if (ret == DDS_RETCODE_OK) {
+    ddsrt_proc_kill(pid);
+  }
+}
+
+
+/*
+ * Create a process with a backslash in the argument
+ */
+CU_Test(ddsrt_process, arg_bslash)
+{
+  create_and_test_exit(TEST_BSLASH_ARG, TEST_BSLASH_EXIT);
+}
+
+
+/*
+ * Create a process with a double-quote in the argument
+ */
+CU_Test(ddsrt_process, arg_dquote)
+{
+  create_and_test_exit(TEST_DQUOTE_ARG, TEST_DQUOTE_EXIT);
+}
+
+
+/*
+ * Create two processes and wait for them simultaneously.
+ */
+CU_Test(ddsrt_process, waitpids)
+{
+  dds_retcode_t ret;
+  ddsrt_pid_t child;
+  ddsrt_pid_t pid1 = 0;
+  ddsrt_pid_t pid2 = 0;
+  int32_t status;
+
+  /* Use retpid option to identify return values. */
+  char *argv[] = { TEST_PID_ARG, NULL };
+
+  /* Start two processes. */
+  ret = ddsrt_proc_create(TEST_APPLICATION, argv, &pid1);
+  CU_ASSERT_EQUAL(ret, DDS_RETCODE_OK);
+  ret = ddsrt_proc_create(TEST_APPLICATION, argv, &pid2);
+  CU_ASSERT_EQUAL(ret, DDS_RETCODE_OK);
+
+  /* Wait for both processes to have finished. */
+  while (((pid1 != 0) || (pid2 != 0)) && (ret == DDS_RETCODE_OK)) {
+    ret = ddsrt_proc_waitpids(DDS_SECS(10), &child, &status);
+    CU_ASSERT_EQUAL(ret, DDS_RETCODE_OK);
+    if (child == pid1) {
+      CU_ASSERT_EQUAL(status, TEST_PID_EXIT(pid1));
+      pid1 = 0;
+    } else if (child == pid2) {
+      CU_ASSERT_EQUAL(status, TEST_PID_EXIT(pid2));
+      pid2 = 0;
+    } else {
+      CU_ASSERT(0);
+    }
+  }
+
+  ret = ddsrt_proc_waitpids(DDS_SECS(10), &child, &status);
+  CU_ASSERT_EQUAL(ret, DDS_RETCODE_NOT_FOUND);
+
+  /* Garbage collection when needed. */
+  if (pid1 != 0) {
+    ddsrt_proc_kill(pid1);
+  }
+  if (pid2 != 0) {
+    ddsrt_proc_kill(pid2);
+  }
+}
+
+
+/*
+ * Create a sleeping process. Waiting for it should timeout.
+ */
+CU_Test(ddsrt_process, waitpid_timeout)
+{
+  dds_retcode_t ret;
+  ddsrt_pid_t pid;
+
+  /* Sleep for 20 seconds. We should have a timeout before then. */
+  char *argv[] = { TEST_SLEEP_ARG, "20", NULL };
+  ret = ddsrt_proc_create(TEST_APPLICATION, argv, &pid);
+  CU_ASSERT_EQUAL_FATAL(ret, DDS_RETCODE_OK);
+  CU_ASSERT_NOT_EQUAL_FATAL(pid, 0);
+
+  /* Timeout 0 should return DDS_RETCODE_PRECONDITION_NOT_MET when alive. */
+  ret = ddsrt_proc_waitpid(pid, 0, NULL);
+  CU_ASSERT_EQUAL(ret, DDS_RETCODE_PRECONDITION_NOT_MET);
+
+  /* Valid timeout should return DDS_RETCODE_TIMEOUT when alive. */
+  ret = ddsrt_proc_waitpid(pid, DDS_SECS(1), NULL);
+  CU_ASSERT_EQUAL(ret, DDS_RETCODE_TIMEOUT);
+
+  /* Kill it. */
+  ret = ddsrt_proc_kill(pid);
+  CU_ASSERT_EQUAL_FATAL(ret, DDS_RETCODE_OK);
+
+  /* When killed, DDS_RETCODE_OK should be returned. */
+  ret = ddsrt_proc_waitpid(pid, DDS_SECS(10), NULL);
+  CU_ASSERT_EQUAL(ret, DDS_RETCODE_OK);
+}
+
+
+/*
+ * Create a sleeping process. Waiting for it should timeout.
+ */
+CU_Test(ddsrt_process, waitpids_timeout)
+{
+  dds_retcode_t ret;
+  ddsrt_pid_t pid;
+
+  /* Sleep for 20 seconds. We should have a timeout before then. */
+  char *argv[] = { TEST_SLEEP_ARG, "20", NULL };
+  ret = ddsrt_proc_create(TEST_APPLICATION, argv, &pid);
+  CU_ASSERT_EQUAL_FATAL(ret, DDS_RETCODE_OK);
+  CU_ASSERT_NOT_EQUAL_FATAL(pid, 0);
+
+  /* Timeout 0 should return DDS_RETCODE_PRECONDITION_NOT_MET when alive. */
+  ret = ddsrt_proc_waitpids(0, NULL, NULL);
+  CU_ASSERT_EQUAL(ret, DDS_RETCODE_PRECONDITION_NOT_MET);
+
+  /* Valid timeout should return DDS_RETCODE_TIMEOUT when alive. */
+  ret = ddsrt_proc_waitpids(DDS_SECS(1), NULL, NULL);
+  CU_ASSERT_EQUAL(ret, DDS_RETCODE_TIMEOUT);
+
+  /* Kill it. */
+  ret = ddsrt_proc_kill(pid);
+  CU_ASSERT_EQUAL_FATAL(ret, DDS_RETCODE_OK);
+
+  /* When killed, DDS_RETCODE_OK should be returned. */
+  ret = ddsrt_proc_waitpids(DDS_SECS(10), NULL, NULL);
+  CU_ASSERT_EQUAL(ret, DDS_RETCODE_OK);
+}
diff --git a/src/ddsrt/tests/process_app.c b/src/ddsrt/tests/process_app.c
new file mode 100644
index 0000000..a0c402a
--- /dev/null
+++ b/src/ddsrt/tests/process_app.c
@@ -0,0 +1,108 @@
+/*
+ * Copyright(c) 2019 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+#include <stdio.h>
+#include <string.h>
+#include <assert.h>
+#include "process_test.h"
+#include "dds/ddsrt/strtol.h"
+#include "dds/ddsrt/environ.h"
+#include "dds/ddsrt/process.h"
+
+
+static int test_create(void)
+{
+  printf(" Process: created without args.\n");
+  return TEST_CREATE_EXIT;
+}
+
+static int test_sleep(int argi, int argc, char **argv)
+{
+  argi++;
+  if (argi < argc) {
+    long long dorment;
+    ddsrt_strtoll(argv[argi], NULL, 0, &dorment);
+    printf(" Process: sleep %d seconds.\n", (int)dorment);
+    dds_sleepfor(DDS_SECS((int64_t)dorment));
+  } else {
+    printf(" Process: no --sleep value.\n");
+    return TEST_EXIT_WRONG_ARGS;
+  }
+  /* Expected to be destroyed before reaching this. */
+  return TEST_EXIT_FAILURE;
+}
+
+static int test_pid(void)
+{
+  int ret;
+  ddsrt_pid_t pid;
+  pid = ddsrt_getpid();
+  ret = TEST_PID_EXIT(pid);
+  printf(" Process: pid %d reduced to %d exit code.\n", (int)pid, ret);
+  return ret;
+}
+
+static int test_env(void)
+{
+  int ret = TEST_EXIT_FAILURE;
+  char *envptr = NULL;
+  if (ddsrt_getenv(TEST_ENV_VAR_NAME, &envptr) == DDS_RETCODE_OK) {
+    printf(" Process: env %s=%s.\n", TEST_ENV_VAR_NAME, envptr);
+    if (strcmp(envptr, TEST_ENV_VAR_VALUE) == 0) {
+      ret = TEST_ENV_EXIT;
+    }
+  } else {
+    printf(" Process: failed to get environment variable.\n");
+  }
+  return ret;
+}
+
+static int test_bslash(void)
+{
+  printf(" Process: backslash argument.\n");
+  return TEST_BSLASH_EXIT;
+}
+
+static int test_dquote(void)
+{
+  printf(" Process: double-quote argument.\n");
+  return TEST_DQUOTE_EXIT;
+}
+
+
+/*
+ * The spawned application used in the process tests.
+ */
+int main(int argc, char **argv)
+{
+  int ret;
+
+  if (argc == 1) {
+    ret = test_create();
+  } else {
+    if (strcmp(argv[1], TEST_SLEEP_ARG) == 0) {
+      ret = test_sleep(1, argc, argv);
+    } else if (strcmp(argv[1], TEST_PID_ARG) == 0) {
+      ret = test_pid();
+    } else if (strcmp(argv[1], TEST_ENV_ARG) == 0) {
+      ret = test_env();
+    } else if (strcmp(argv[1], TEST_BSLASH_ARG) == 0) {
+      ret = test_bslash();
+    } else if (strcmp(argv[1], TEST_DQUOTE_ARG) == 0) {
+      ret = test_dquote();
+    } else {
+      printf(" Process: unknown argument.\n");
+      ret = TEST_EXIT_WRONG_ARGS;
+    }
+  }
+
+  return ret;
+}
diff --git a/src/ddsrt/tests/process_test.h.in b/src/ddsrt/tests/process_test.h.in
new file mode 100644
index 0000000..25cd632
--- /dev/null
+++ b/src/ddsrt/tests/process_test.h.in
@@ -0,0 +1,42 @@
+/*
+ * Copyright(c) 2006 to 2018 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+#ifndef DDSRT_TEST_PROCESS_TEST_H
+#define DDSRT_TEST_PROCESS_TEST_H
+
+/* Get the application name from cmake to automatically
+ * get the proper extension and location. */
+#define TEST_APPLICATION "@process_app_name@"
+
+#define TEST_SLEEP_ARG        "--sleep"
+
+#define TEST_EXIT_GENERIC_OK  (0)
+#define TEST_EXIT_FAILURE     (1)
+#define TEST_EXIT_WRONG_ARGS  (2)
+
+#define TEST_CREATE_ARG       NULL
+#define TEST_CREATE_EXIT      (0)
+
+#define TEST_PID_ARG          "--retpid"
+#define TEST_PID_EXIT(pid)    ((int)(int32_t)(pid % 127))
+
+#define TEST_ENV_ARG          "--checkenv"
+#define TEST_ENV_EXIT         (12)
+#define TEST_ENV_VAR_NAME     "TEST_ENV_VAR_NAME"
+#define TEST_ENV_VAR_VALUE    "TEST_ENV_VAR_VALUE"
+
+#define TEST_BSLASH_ARG       "\\left\\\\right\\"
+#define TEST_BSLASH_EXIT      (int)('\\')
+
+#define TEST_DQUOTE_ARG       "\"left\"\"right\""
+#define TEST_DQUOTE_EXIT      (int)('"')
+
+#endif /* DDSRT_TEST_PROCESS_TEST_H */

From 597ca2528734b682ee8c80aa4d842cfdb1d46e7d Mon Sep 17 00:00:00 2001
From: Martin Bremmer <martin.bremmer@adlinktech.com>
Date: Wed, 10 Apr 2019 17:57:29 +0200
Subject: [PATCH 043/238] Multi Process Testing framework

Signed-off-by: Martin Bremmer <martin.bremmer@adlinktech.com>
---
 docs/dev/mpt_req.md                          |  86 +++
 docs/dev/multi_process_testing.md            |  86 +++
 docs/dev/pictures/mpt_flow.png               | Bin 0 -> 74078 bytes
 docs/dev/pictures/mpt_tree.png               | Bin 0 -> 19753 bytes
 src/CMakeLists.txt                           |   6 +
 src/ddsrt/include/dds/ddsrt/log.h            |   2 +-
 src/mpt/CMakeLists.txt                       |  22 +
 src/mpt/mpt/CMakeLists.txt                   |  17 +
 src/mpt/mpt/cmake/MPT.cmake                  | 184 +++++
 src/mpt/mpt/include/mpt/mpt.h                | 158 +++++
 src/mpt/mpt/include/mpt/private/mpt.h        | 153 ++++
 src/mpt/mpt/include/mpt/resource.h.in        |   6 +
 src/mpt/mpt/src/main.c.in                    | 551 ++++++++++++++
 src/mpt/tests/CMakeLists.txt                 |  19 +
 src/mpt/tests/basic/CMakeLists.txt           |  23 +
 src/mpt/tests/basic/etc/config_any.xml       |  30 +
 src/mpt/tests/basic/etc/config_specific.xml  |  30 +
 src/mpt/tests/basic/helloworld.c             |  63 ++
 src/mpt/tests/basic/multi.c                  |  50 ++
 src/mpt/tests/basic/procs/hello.c            | 239 +++++++
 src/mpt/tests/basic/procs/hello.h            |  52 ++
 src/mpt/tests/basic/procs/helloworlddata.idl |   9 +
 src/mpt/tests/self/CMakeLists.txt            |  25 +
 src/mpt/tests/self/asserts.c                 | 711 +++++++++++++++++++
 src/mpt/tests/self/environments.c            |  96 +++
 src/mpt/tests/self/etc/file                  |   0
 src/mpt/tests/self/fixtures.c                |  72 ++
 src/mpt/tests/self/ipc.c                     |  29 +
 src/mpt/tests/self/resources.c               |  30 +
 src/mpt/tests/self/usage.c                   | 186 +++++
 30 files changed, 2934 insertions(+), 1 deletion(-)
 create mode 100644 docs/dev/mpt_req.md
 create mode 100644 docs/dev/multi_process_testing.md
 create mode 100644 docs/dev/pictures/mpt_flow.png
 create mode 100644 docs/dev/pictures/mpt_tree.png
 create mode 100644 src/mpt/CMakeLists.txt
 create mode 100644 src/mpt/mpt/CMakeLists.txt
 create mode 100644 src/mpt/mpt/cmake/MPT.cmake
 create mode 100644 src/mpt/mpt/include/mpt/mpt.h
 create mode 100644 src/mpt/mpt/include/mpt/private/mpt.h
 create mode 100644 src/mpt/mpt/include/mpt/resource.h.in
 create mode 100644 src/mpt/mpt/src/main.c.in
 create mode 100644 src/mpt/tests/CMakeLists.txt
 create mode 100644 src/mpt/tests/basic/CMakeLists.txt
 create mode 100644 src/mpt/tests/basic/etc/config_any.xml
 create mode 100644 src/mpt/tests/basic/etc/config_specific.xml
 create mode 100644 src/mpt/tests/basic/helloworld.c
 create mode 100644 src/mpt/tests/basic/multi.c
 create mode 100644 src/mpt/tests/basic/procs/hello.c
 create mode 100644 src/mpt/tests/basic/procs/hello.h
 create mode 100644 src/mpt/tests/basic/procs/helloworlddata.idl
 create mode 100644 src/mpt/tests/self/CMakeLists.txt
 create mode 100644 src/mpt/tests/self/asserts.c
 create mode 100644 src/mpt/tests/self/environments.c
 create mode 100644 src/mpt/tests/self/etc/file
 create mode 100644 src/mpt/tests/self/fixtures.c
 create mode 100644 src/mpt/tests/self/ipc.c
 create mode 100644 src/mpt/tests/self/resources.c
 create mode 100644 src/mpt/tests/self/usage.c

diff --git a/docs/dev/mpt_req.md b/docs/dev/mpt_req.md
new file mode 100644
index 0000000..bcd2a90
--- /dev/null
+++ b/docs/dev/mpt_req.md
@@ -0,0 +1,86 @@
+# Eclipse Cyclone DDS Multi Process Testing Requirements
+
+This document present some requirements and considerations regarding the
+[Multi Process Test Framework](multi_process_testing.md).
+
+## Requirements
+1.1) To test certain Cyclone DDS features, multiple processes running Cyclone
+     DDS are needed to force communication through the whole stack.
+
+1.2) Should be buildable and runnable on platforms that support multiprocess
+     and filesystems including the ones used in the continues integration
+     context.
+
+1.3) Results should be easily analyzable within the continues integration
+     context and when running locally. This can be done by reporting the
+     results in a standard format like xunit or cunit.
+
+1.4) No processes must be left behind (f.i. deadlock in child process) when the
+     test finished (or timed out).
+
+1.5) When running tests parallel, they should not interfere with each other.
+
+1.6) Processes of the same test should be able to communicate (for settings,
+     syncing, etc).
+
+1.7) It should be possible to analyze output/messages/tracing of the parent
+     and child processes to be able to draw a proper test conclusion.
+
+
+## Considerations
+2.1)
+The files that actually contain the tests, should be focused on those tests.
+This means that the process management and setting up (and usage of) IPC
+between test processes should be handled by a test framework so that the
+test files can remain as clean as possible.
+
+2.2)
+If possible, there shouldn't be a need for writing log files to a file system
+when running the tests normally. It could be helpful, however, that these log
+files are written when debugging related tests.
+
+2.3)
+Preferably, the DDS communication between the processes should not leave
+localhost.
+
+
+## Intentions
+There doesn't seem to be a 3rd party test framework that addresses our
+requirements in a satisfactory manner.
+
+After some discussions with a few people (different people in different
+meetings), it was decided to create our own framework and to go in the
+following direction:
+
+- Process creation/destruction/etc is (re)introduced in the ddsrt.<br>
+  [1.1/1.2]
+
+- The files that contain the tests, should be easy to understand and focus on
+  the tests themselves.<br>
+  [2.1]
+
+- Other files (generated or in the framework) should take care of the
+  intricacies of starting/monitoring the proper processes with the proper
+  settings.<br>
+  [1.4/1.6/2.1]
+
+- To do this, a similar approach of the current CUnit build will be used;
+  CMake will scan the test files and create runners according to macros within
+  the test files.<br>
+  [2.1]
+
+- The tests should be executed by CTest. For now this means that a proper
+  runner exit code for pass/fail is enough. We would like to add CUnit like
+  output in the future.<br>
+  [1.2/1.3]
+
+- The Cyclone DDS API contains the possibility to monitor generated log traces.
+  This means we won't be needing to monitor actual log files. Just register a
+  log callback and go from there.<br>
+  [1.7/2.2]
+
+- The framework should be able to generate unique domain ids and unique topic
+  names when necessary. That way, tests won't interfere with each other when
+  running in parallel.<br>
+  [1.5]
+
diff --git a/docs/dev/multi_process_testing.md b/docs/dev/multi_process_testing.md
new file mode 100644
index 0000000..aa33f9d
--- /dev/null
+++ b/docs/dev/multi_process_testing.md
@@ -0,0 +1,86 @@
+# Eclipse Cyclone DDS Multi Process Testing
+
+Some features and functionalities of Cyclone DDS can only be tested when
+there's communication between processes. Examples are durability, security,
+etc. To really make sure that these kind of features work, extended tests
+with multiple processes are needed.
+
+This results in a number of [requirements](mpt_req.md).
+
+There doesn't seem to be a 3rd party test framework that addresses our
+requirements in a satisfactory manner. Therefore, it was decided to create
+our own Multi Process Testing (MPT) framework.
+
+This document will provide an overview of the MPT framework.
+
+
+## Overview
+
+An MPT application is basically divided into two components
+1. Tests
+2. Runner
+
+The Tests are created by the developer. They don't need to worry about the
+process management. They only have to provide process entry point(s), tests
+and test processes that use these entry points. E.g.
+```cpp
+MPT_ProcessEntry(publisher, MPT_Args(int domain))
+{
+  /* Publish a sample on the given domain. */
+  MPT_ASSERT(success, "publisher failed");
+}
+MPT_ProcessEntry(subscriber, MPT_Args(int domain))
+{
+  /* Subscribe to a sample from the given domain. */
+  MPT_ASSERT(success, "subscriber failed");
+}
+
+MPT_TestProcess(helloworld, domain0, pub, publisher,  MPT_ArgValues(0));
+MPT_TestProcess(helloworld, domain0, sub, subscriber, MPT_ArgValues(0));
+MPT_Test(helloworld, domain0);
+
+MPT_TestProcess(helloworld, domain42, pub, publisher,  MPT_ArgValues(42));
+MPT_TestProcess(helloworld, domain42, sub, subscriber, MPT_ArgValues(42));
+MPT_Test(helloworld, domain42);
+```
+
+There are more options, but see the
+[usage test](../../src/mpt/tests/self/usage.c) for more elaborate examples.
+
+CMake will identify suites, tests and processes depending on those MPT
+macros.<br>
+It'll use that to generate part of the MPT Runner. The Runner takes care
+of starting test(s) and handling the process management.
+
+The runner also takes care of preparing IPC between test processes so that
+these processes can sync if they need to (NB, this will be a future extension).
+
+
+#### Suite-Test-Process tree
+
+A process is related to a test and that test is related to a suite.<br>
+A suite can have multiple tests and tests can have multiple processes.<br>
+
+This results in the following tree quite naturally.
+
+<img src="pictures/mpt_tree.png" alt="Suite-Test-Process tree">
+
+
+#### Test execution
+
+There are 3 main ways to start an MPT application.
+1. Without argument.<br>
+   All tests will be run.
+2. With suite and/or test name patterns as arguments.<br>
+   A subset of tests will be run depending on the provided patterns.<br>
+   This allows ctest to execute single tests.
+3. With a specific suite/test/process combination as arguments.<br>
+   An user will normally not use this.
+
+The third option is used by the MPT application itself to start a specific
+test related process. It does so by restarting itself with the proper
+suite/test/process combination as indicated by the test. This results
+in the following flow.
+
+<img src="pictures/mpt_flow.png" alt="MPT application flow">
+
diff --git a/docs/dev/pictures/mpt_flow.png b/docs/dev/pictures/mpt_flow.png
new file mode 100644
index 0000000000000000000000000000000000000000..271e74bd4b2256079fb2525f72757e9237ad5aab
GIT binary patch
literal 74078
zcmc$`cUV+gwmn)HQAAJ#1O!AB1O!yFL_tKdk~2!qITrCKIVw?-faIJr1!4fn8Kj6x
zE^?OqW^wv-_v^m>?!CYFzVGex#{t<@d+inG8e_~cm;ZAaG5m|<7ZC^qzWB2zatOp}
z8wBD^3GONQmx}ZR2Ke7O9Z9h#h-2)3NvMo)1mY$_{K;blr})KD7Y&8}qvJJ>)3`S8
z0ts(AK0o#CYjIEQjk_ES3bmisp7!j#Ka!JVCZ4y+-B6V8We;h3NW^NK_2iwuLr-n0
zK~&SCS8QgI&6R1!*RM5ZcA5mnd5GF3aMcY@7tE$KrNnTUE*%cJykA>Vb4ig%>BfcD
zBsuq`vmnlm*15S1mzz&E2IF14SX_p^@Go8@=du{tUK+L>uQSJB;N~NtZ)Rx^(^6C0
z5_q}T*yLAoaBy%Wqgg0<Y^L1u;jKRr8ZZ%Ol$SefFAk-Mg>ptPcoUMcXk6zo>5J#F
z#b7YYhUV}+KKIqLxJwK>wd!1}-X+X-B-H3Nhq<T`AP}Ap-sdSqMMPYiWJ@E|neR!<
z%F1$FEH~`@V3_Duo|~IXmWG2su=}WF-K?-24+#yeAAV6#yDmZNxVku6Q=wh&{^mTv
zSefY{ravc6`6hhf<F68Dch_54Sv4xHDpHDzi|h6<IX+9i1k~=Btc-K`<aSfv--S@}
zb|eZOe<Rh7NRfgD^7}<z)M>LR*V@uayLNYfXQke9T!7)ZR;AU?yo#~nii+qzZ)=m*
zL>w(>AMYvmo}&_U*FakRUj4bdF}pHcA&c8xq}w##o6#A|k+W;O4*f_>Oe{??oUh4C
zK@pc8oR^tdiQF>jZAAb0QCVHxQZv53z7Ac~*!1YpqrLroF7x_3ckTp_92F=V8)w-K
zj-DpqTkR4d;4rTr%-7uCsXrbqEovXKl#%J^P7#aa9O&&WkxdkkrihD-EQ1b958m3?
zpkOz8&bFie;)QiZJ#xF@Jate&fC<{Y^8>$2Q+=^ky}Ra0LFC*RYXA4zWL)|9xck0&
zYZNoIGXC%bx3x}tEQd73{^}P3*_elE#=0H{YfU?2E(ONAE<4MIEldUM=8MT9zDL^?
z^&IAA$47_9dxP~YmE+LMXf&EP#0`2l*0p5baoo-DpkK${-hQw^dr%<Q&rhYyM6q|f
z2EGP*h|Ao}cDqKmDWtNpGCi1*)9i;2K1D3&_C}{*Xh?`f%QO6IUj_!sjV<f*@|Nn{
z_Rn3qev{vPyw2^508BCqn^(=v&C*OkhsE04t?omt`}+0fhV^Yq<>ySw)bf<#Vq(N)
zIc$!5G98xCJdYl6nwy1ZFs2nrf7mr$SJ0>3$4>UbLL*nRa6A%W?njRV*1yv_a(r!Q
zc$_A8fu`DVWo+uOy1M%E4eml?-MA8MS=mmyBXbqMF_a6JbN$iLQ8>M<1^S0CwR`36
zepykG@nHU_X0UmOv-@hp`4#ROT}#UXrG+Xw40ONQx_gb|N}bc%uXMP>o!WWo9bKo=
z-tI1kb3MvsXAG8MZzB?k<aDk-eeROc`r<x}`pp%0Uc0%Z!|=>2(nqI7ao76fWsOPa
zmY?M*E#wb!%yy>u`T5a}9CRHVUZ&v8g<dq)UD<Yd8huTC#l&yZ_ey<*++!-&)rO#;
zAi7JJE?#_OI}=3s>-#&}KvLGRD%%Xg&mA2Wn7*vFwYBzL#AyU#<b{+}&_ooaXw`5G
zW1bcYDNeAry|lkIs7)>4%Kh-+dSft!WYj&lKZeUvOI+OFRUabUK?6*3Se7!m3UBGO
z!vtM_Ta9MORr1+P;r_e|U&?jwHPbWfB*@q7OceA`PB}O{?2PBpox2+F#h0M|aC;c$
z1F`TuwbHvZG>?6RVWpGbRAOu;)pmVg(wA979u^y`W?5dGOe+>r3-fScuwbPtS%fVc
zT72J6C5zj3rcJfnEaqLp<m6<WYr!2@{y~-Ha@JAzR3934+|WgKB=9<Re-z!Rrh-MT
z3sLAf#25I~1G@x$2t(1#>JCk1mhiECh%g%c{r&J~ZMUud`lGFa`1l(%UKts)w4r=g
ziHSK}f3NZ$X<1<J^;a1>)i*E@8y5$2t-r7DeKiSu{b6N!@!8D$d=laN{1*_2h#<I&
zkO>FjxqgL7-4pr=PX`+KoKr_1?`FFa`JSU4d?>;b?kdE+3_peb^ZkgEdj;U$Pt3ds
zgwU>EBr~F75k4_Zt5lA-_ZqrjnvKgIr;_dD&f=*ly~nv`S1QY)<L|1%XuiBsD>{Le
zfQaw<wS~k})atLFRIrW1KFrD-+n$qWltupajKGP%ek#I#6LnGX*_%o*)+dkcVdm9P
z|LfiEpZxS6S}l}&27zc1%QeIKt?U4OhV28yQ6%MGjrh;av6UzF<efZexL$X6_iL4*
zTYvVC+5Yy@YtdDbKmMOyK*A2TH2u~nN^UD5q?+Xw*WPq#h^pz?`0!e+I%!w)G;16>
z;(07lTTz<|TuM~D4)<7CmXm#{!ju|e{#|>mlJ$hOcJ*~i%4EZv^Px9*ZXI1`()KvC
z4}Q8aV%u3n2Satu8*XxNaOlmDB^AD>RjV>LQd|OIW2J7tqoLtvzp^%mwLc7%$CF%z
zOfoiuA82%XTG}CON@#V5G1m=gnkTNVwc+96S$NP(zfbF=3EMCJu<l6}Cl8((bsUe>
znf~MSdG~`gF-OOpXf0%OUq3XhFQdnZJv|?1Z+dF#%$YMV0jq0jX5r_vXAh6|S8|l{
zVmZxYvm{|=WQM9_8HLkHt5sMe1P4otih2`%9vs}+8TY6tEoHaYgtl!J;pQ8`dNwdH
zP*hZ;d}K!`Tnh_Q4?AI`+LRba-#^eTHy@_+a)O}N+uPgT-Y%_q1xAtz`^Q@64F$$X
z!e0rFV>I$GJHF|_+;`d@GAz)n+3uAU6yJr(BlL%wUhZwpva`%<^h7(c#)A6?Qm2F_
zRnDA;ueqeQT83=9QL5DTG{t)7xTLf5HsX59*(P{C;_hP`n_{ExL8bDqEw3((X<ygL
zPQ-Vo!%4F4*||N4osB~0zG83u?unfX2r}$4L)<)#T?q)ild0!<$q%M9;w=t#79$>>
zOyPh2&|5Kg_d1C*#(VeJ?P(BFZ&Y@vMSL#3$bz?OX>3e~?UaFmAwB<@HF676_Ug+y
zd1ahZPBbgEsp$e0KhkWpy1$PYM~LVO)A7P|w03@een)F-U`PlRn?c)9iD59AqNb*s
zY)<vy@cEZEJ<+o6?(Sx0i(VIqf)3W-T^VOXz+ydMjg-*0u&}VSq^73UR#tXgpKAX4
z_3OmMOI}`HR@MR@+Zm&JXAuz*2yS0Ke}4Vujl8@(5fRbh!NH9iH#9UgAy6r1$vQjl
z29dG3y1DT>EM6xga|R6M<HByUUsYAr$+r>o=FOKk1Oo3PB2qPV*EcsuY8(sLZ`0F@
zrO8D`MM-?Yf;AG70oY{Wwc-Wbkg$B}>gu+)w_)M*8nFi}UneKuLz@=hle6EweLEEb
zw(n)itHN#ZJZ${@`~m`XwzD0uOy$<_L&=4Ro@oofRC1b*RQ4jQKUfbm+B`kBN`!vq
zLYrtex<WRJY-wpRXnX&2cGl3)ko4+Ro5ddwXubk`gZ*W8W@cu2nTnKDSwrKVeVxs;
zgq~h%N{a5wmlMmQHDweJW_SsOOjC^iSQed@6+GO8w@z(}<20AcQm8-LTY$+5kPh3A
zGi@;t_X{+t<S<=;7d$;ZYis#}pW1FOsxmR<uo-q3vBv`R0{kKF_B7<i?qW&j%<QbP
zqGEd-R{@MXz=JIZleTRR@^&IwzO{pm&hc93lBA@Ye0&<XFP=Y7>Neuz;{(J?yVcy$
zK_VOx5%KKH;o+fdJh%16O#6=?Kj4wGi5_*SskdoqQ{XwUs{||mfVNCbOqdSl8?(pa
zQ*b)DxJVvi0m0V7pkydMW!XKoWm&pq4*5f~k={d$`>xqgu_&(fudf%RQ>d*_iO)rr
zf?a#;>kaMT!;8)IiM38^I+~iJFy8>{LZgm0GXzCNMI!-ClaL4;ZuVlwzpu*U_y`6y
z=TGzrn5|6vd86z3Q$`$qkshm?y|U`+>NVBX=%Jyi>gs&8vTQA1*lI23x{`Y)VNTR;
zbnx~}wzWw~O13hqmq$cJnea+_oYSatRYj`F%j=q&?k^P7bIN%pFD3Fi%HY0GP`J&{
zZ#Cihpva~<?2cRw`!G$JDSPY#-NxFrMv6bXftX3@*;0?!6Ig>Yp+#~lFIv;4kMw?N
zndTMA?N9gSYu0d>4m^X`{j}vSyj9M1BtGcgITw~r3^1Z#*y-ozvov4RB%@O^=I7^y
z{c3A#H)cCc@w$xIUA7nB)g{HQQsO3whS$-no;fa9n`}ztbAHIh#U&`{fi5)`_A4zd
zU0t<;MMq7Y=#588a_yQCuZxq@GlGMIgK~?}*ocU!pFg`ZWD_A)(mYX8ijqhp2Uz{*
zRberjo0o^3T$Z7YW`bN?g98Ht&CTLS%;cnQTag{6PaOGD7kf=kOeCGGCtjtw#l?I4
zM&orTLSgcck}EGx8<Eeq&H^3-%=b1-b@Gy%FvVYQS?#p;v8u{hNXXMd*TJD2mT^Tz
z#ijz11EK;weG@#bzhBX0Wu&TP^V9bgAw*tKRTkcJLQ_*yc*UjO*RNk^W@h&F_4)bX
zmZ_m&6^-(;D>6oITPvJgii-UJwqe?<s;J!ct{3sWTvb_l9i8xQcxQF>E-Nc53rkd3
z+VYk->~E2gkv)?&hrv{h3M!#$hrab*?0hD?yfro1IG#`T)~#)A_hJ6j*v*H9g*^no
zHskuKjQlut!9CP?cW-Z?uTRgw0Emq#1**2z#KgqL#)gld-<vQdCPr=&)*2HdV@qqR
zxw*MF;qLBk<07e$DbUTw)6>&{8IzNfP0Fe>Gv_8l1qX(iX=!zV!$5<gqM}$>SRhKb
zwY3coy8!)yeXfT^6X*ddJw5%xF!YRVqJW!0=LffifxOS3KUa*qtMB&!idzRbi$?<u
ziDK1uR~9pr^4_YfsWG*D-tW@qsEF|N(a_M)0`NDe?SU#UFXy4Q%A<4bL7`Bzw6qyg
zF<}V_dEG`2A3jX=<9YeXQ(4P-dT(pt+qZ8(Y(xC~tQ;K)aB-b}`O}lIYTfh7%*)d(
zH&YGY!AlZ_jR7t?CGx4+*$SWntE;OJaAn@#f3-T%fUHqeQmWgXiG!^`Mn(pY<lZxJ
z@uKo_5@9oRDZ~By_wU_n>*&abxMXZ>yhV2|Xrzu%2dKMpzJ|4<BM{G(#Nz`)8n3i8
zAkcty$;ik?tL+!Y>pcpzP|Mqh6_r=~5Tm7~rS0wPZm=7@O-?!2B?VFN-o1Mo_3mzL
zf)i?v`{Ja+W@EKH_wN@1`G*h=3_gNgx!Qb~lZ~z9)2C0cBp>neTB1wEF}3Ey<wW!{
zn~Osw5L$r5Sai7Klxkp!K%HBSgiEA8-Yqw-vac<1*nfbaH*jPUs+7fCUvCtj<<9v#
z<_s2z51l#y9^LZ&JE8E@%uF2waEOx}_M)&`Z&|m>;Jr;u6hv;$g@s*(2?v~0BKiUB
z@pmr<PCUN>h~V=rZp2+OELi=|d;I?b7|f)zB+aLKq>&1#e=(#+MEDP#zzd<YZX+qp
z)5}7!aX%9Pc1R4oCT)ObB%J{U`g*8^<PYq9NqTZhKe2%I{{<fTpS1Npz<tEadw?1~
zqfFV!iIyn=$N$+-Pxv2mTZ;(sj&ms6{_w~w|0yBKCs+(FRPsbj?1XtBVvVr~+Vlh~
z{rNBdz)BJdN=oH0HG#?3AOTZ-^74z6xCXk#+qZAuzyGnC2FS$A%M13leQjd+R$BNo
zyXn9^ny>5At&)<G_QS0$ElRm6$xF};NjJVq+_{K{y_lGpHOovQEnIYTbgZq5HnaUD
z0H1aNK79@`o75w|uun!&g7su*i{z5YWmFz2VhM)SpFO|HYc(O{<W%|Q%^UVt^HWm_
z8XC18$L>0J(9jKcq;@P{Z<t>|1nZW|Rh1G&^~k3);@o}y7qZJ8q#`G;cHS@uk4TN~
z!QiOf(MkI#9{oa16?<LC&pxA;mFRKg{MGLYC@r3_fa>dye-vR=53z8Co*d-@*l6GD
z4Q?Gklmo)*=-^-hGuq0^N?7=Hgof`WvX63E5c*2_WfLBy$z_?Dn@cO-^E?I$8_Ujr
z@(|T#g*#o0OJk@SSSngtS}*_*^&UB`PJH^~^kA;4?aH<aAjK6<mO#t8U4u`aIDiz#
zJ&xU8z4{rg?Vi<bRCl<oKHm?x0YH)oFTm?^01$N9*FI4bGDXVpieMkG2Y@C^K11O6
zV8h?vpN578q8B{OW4Bd%pg^0|9>RL!16`kj0?VclN(g4Gn$@?<e0_ZCw$Y|<&f#CY
zaA6)4Ay{O~KLiB?1RyYQb8~ZWa6EYMfSdbAM+abAQ{YT;U7+b1fLP(`>I&pJB_)Mo
z2p!3!e2bQrl9KZD>C-@g%;)A<G%C9awCgWZKH@uA{UR1}<BBjy5$E}ln_WvUEiCd!
zbGPGbfBy=!wzg(c&R;~A<p4!_{=Dngw?Jqfll}Eac1B7{N=Rfi;m7Q36F^kh2!DCd
z#i-f>LKN_DtTYIl{yW_>U1z>Zq~Z0x!l)s>FSf<7k+Nz52>Y0P83I(T)z8nM$mMHP
z^+1riLi@C@zh9g+Ej`_RZypOAAZ&lQ|LQa4enx7lD^M51j(Go&5C>b^;VN50Rn;Mo
z%;e<dl?$|(y;Q1f^q)QZ9(G3(AZB8G{K)r#qk~z&;o)HbtyBW8Dsi3^d!U*DI+v7?
zpp%Z>Y-8&L5Eeo$c=XvDPw@Dlr0*3(<<sXcZ?3HwJIVa|^$TMzUHwWD_tmRcS4c_e
zrB%{XQ|(s9P@t}&EszA#OoD>PvL1W#88QhDi$7@c;<#)Y5hHmd&h(Yrt!ML8BoCUu
zq6YSs&j>oLzEn~9G2I#syQ~)>&=x@M;aV-7ot@3iYwPPhb!zJB3lkGoAba{!A@8!Y
zv$L>R07e$}gWyU}p8==`RLG}$p}<tfYMt>-Rf=@J9UbmF!ehPW`f~<1=X=wh85*r{
za&m&4($U%JXm3v}4DzdESJLCNXV1a}sgA?P#}5t)(kOiS$0qyj+fzV_KJYoOr;3NS
zwYLkxJV2w>EG<_cio8g9%3&jeA$zFz3^u3_9!I-P)E<2F^oHNx(#WSv6_u1wuo(og
z?;Fi^35$r(-ns>lZ0}bfD?oZ>OxJfZ&LinFN%|I;Q;4Lcu#YM*p{|*JaN8cjQkX|}
zcj@S!;=YTFgyjfQZ|ahzxw+eP3o*l{k*)?TK5s%$xGMn^(H`>i@s%#YmJ0G`Yg^kj
zVL(T79oxoa=o&y7d3kwQDH~pw)6Nc-B)SPm5f2ZKupfhb`lTD(tEio^{pFe!026?w
zlq@3x0|S?Nx|wd?yvfdP2fHu~8###NFo%M8N&(;lc!MCZ71H!9_e^a1*`}6#LES(0
zMPkWLp<lz^y7&7x?Dko(fP`_Gn3w>`iHV8LD;nGX2E9wJr#hu^-*nLV;>C*}KYoNs
z3BA&1vegpF1Zb2Im8z7pQdx#a$^x$t5gjcV_#NPs52gx$<gzZqV}ZT76p-y<$I^D+
z)z{F7_x2V=y=Z7?fLB7>euO}47oANf`+*OLnQDoFs+yV!1qBZ~%~x2E$Ge>#mjV2O
zg4ZKnH_Ub^$r>vF(WS^`9j%3W<f>O#4CJZ;RL;-L{NCQq@3fk<nO#w_v-<N3y>x6u
zLIShbT?Pgi8y9Km;N(2Ap?X-i`S~pD><W2Gq{PH-ATXn&M@B~h+ztO8ICbjO2S8BY
z0!aa<nVNz;XOQ{9eqkVi&$$?q44_U&vuaa4(DCXMa9*E+DZhd)liX3F7`0sot@ZYu
zJ1EflVI5aFZ_KRJ9}8HH)piQ(OH~Z}U7>|QI_%|jhL%7Y_mzc39cV<bwE+@?aLV!X
z(&_uRVR(6XVn9$x-vmbJetftCAshfY#CxZycVe*e3s715u(<yC;}2N1fRFiIwt*Iz
z9{jS=-P_;YW!9?Y=Hsgc)I&rkb)C<ta67Hab{0S>==%~2pMA=KqW%+d+M2m$FCFtx
ze{XXh&>^+^?^kMSu?|nI4t}q}gWdMG`)hu)cwK*}_Z@T_kL8gn_rpDqi5@UAO5i4|
zgNFP0vkq({TP$;CQ(d=B%8*OwGFgG$DNmf!siM0z{9h280k9qT`x`e@EEeL9sjU%A
zH@qEiY?T>K?KT1_7PvpR#R#|j;3*-ho*lN5NRT#7U^xJg1L9Yjg@<#qgv7P=G9u|4
z#OeoJT(S}pCWHA2S*AEQv8v<55yRcP_w6qrmWfHQsOWzpz_jeO1Qc{ETFP6azJK4Y
zS+Y%Rmg@;%cqO<za#J3_Uy{9vZIMl9dK#dZgHo5ktcxlFS>v)bT;s<@?Q2s%$m(cN
z(&_*qo>!I=GjZ74i`8pcjy9~#h1`}O><Qb%rT95Rp@(4vh3R8io`?SIPU3bH$&@tG
za9GS%OtYD9X?a}Hgq5jfyjo9fz*5YdQsZ1>$G|pMUw-TJ#BB9xV`@}_yOZH`J4M|n
z74>1uMS89kR-#$0W<J#98?L(1%C9Msp|i)1C1V!Cek}nMH3CQKdp}D97DPiVv~*|P
ztaL1k-{}T3?C*CfQ~xN(%miQEaEL;k3k{Av3L(@v`pz<`y??h*xsvc>>CK(IcYmxb
zc9>e4*6T>9Bqm#<XeWaTv{$xq5JF4?<vP;@ykW0h2$s=?&oVsUQaj{QaM)J$)xA2h
z4Iyx<J)GVhu3!usyHT)YnW-6_ETB#zlV7FDVcP!Kl-GAu94}0ZVgu9UD^^>}zA-Mi
zNxgMU75KjE8CRql%DF*1+agN#c%LgIU(1_kw%=f;F%+dcbarUA?r5TYNL)<Q?Ubdm
z(v)GsgY`4ysv@tJz0=L95r|R^^Seq~thF{6-_g$F6$6?lE8qQV2AQvK|2l=&y6s&R
z6H`yMJ6=$XR#mMiDW<v_U5HdlCH(xnhDF3p0?+2yZ8fJtt^>`(f78op#(URSZa|~?
z(I~^sCytfL7E9(!y#yJkqAf1tna*!Hl3%_&U@uRI+@fq%ic<%a6CV`5-C?1`Nm={G
zg<~m#JiDO>trWF%8ri;Rsfz)r4_TV5vOC!kJV1G)hW`reUmQ-0A^nyI#jMjseizct
zRz)qDr@g%GWwpH-O?BO5P(M@FdQ3D@A}wzAUM@PCczQ4}(x-ZqkySA+hSz0oXp*ui
zwxXm~cZhP-jlK@G_PoV+I7(*aT9^6i*WdYWKJ3K>HF-35Unbof233>!nYw>uY<0D+
zF@<HMcB0_AAe)E1eVL$Z*)lx+G7D7&6H~TDq<VP;v2X;jX5^!j7KEn6RS^D~_E;>l
zx60>wl6JIWF6UDnsnMRFlgH4~iuuvJV$no0V=z`^M)PFnNTg<mT1{Sat2e)WL5sS^
z$gn)EEHARmd}~P}OGGs5Xk1)R3g4%^!10ae8asJ#mLvjky-x{%f~}csb6I>0^<rGf
zk=T5Fv!p!BhrM};83scFkMXx-E?lgn!hn&Mj~CsH{gNFtefGGkk=~nuBh`8)^JO<^
zzP3}O)h|kB<>Xxvwws%CSh9IKIeJ4ARn32;XlXQBqF@?E==GwlsI%(R5RUXk_|ec~
zOxdlbXXJCwK!fTX1v!;X*TUH>+8QrH`!bIG3JjT%9yAs5z-no8*vm*!@?f}LBJHYh
zE}z1ygSVkXI(-H+$0ZZ;qm7ZQ0`p|oA0Y=^2JzO*SrU|#A}n7G9VO#@am;l$|Jl*X
zxlM^*wqWrU)^XhQ@krs^;2Yi+$%|%-38#ejgQb5z&*N;}TbdiVBi|a3k37rIXa7w`
zWR#Jq#UVc?(Oqvak0MQGc?{O@1m#HU_aeu8yeq<c<!QYIT90y+auP;dKREv^=(%Oz
z+`q_-r+t@|p|E(qYa^>$o310zk-n1f^Lz63l8(92x_7BevueL&=@1BWRhSS)kFi>G
z>63fX|Eyf&z2p!1%M0*-s$%~K)~G-p+}Ou4!U0SXbJeP|>}#Ubh-v!a;s)CZS2|I|
zv1C%Zdtl~LDp_o~L!T$jxI&#%;tuy$%$xmMF@%vnX!k%LJ#9cN{u_N{0Bm)VGs3FZ
z*uVWZ8vB1}-9LnRDPzEVjFF5C4C2E!m_7z*uc>LyFr;CJe*6G^f$h$nwBlm9v{2B)
zzATL^8jAd>#`_>S7NYvTzB%7j4a)zguON*BK*@2dhJ-JGDU5^D?sRlcPR_>q`p1-%
zrXVs~5XIGx4T0#vM%FVK5D?%)QBhp{u&!hc6KMxZE|M}kCnv7N&D(TT>^wUeBn_m@
zKmmn)_(WmM&dvtCN;Z~Vyy6XemC-*b_To9mDM~r*ZEdMdpiChv3My>v?YI6#kiU~<
ztE2NVF)<NnY);NXPC*@`*ZY5=QuvX#y>J0ThlUaWZN7Y2Mp_yLuTyC~IRe+{=;W_o
z0fB*OMf&>skYiZg*eEF}!MkvQ$6@h3;m6wAk?+V$9GHvv_?neguT)f20PDJJ&RGMt
z2&UlL+uK7A56i}JN~d%iRS?~{VP<GJJ3Y+-DN=KlKK0~xV&_Zs9gD!UQb`Kr56H;?
z7!Dw(1kC7foCN8DWliM4bllvPySxct6#yX-*wqb6%2^O)b-wydHibft7wF>=5Z4PA
zFJ@<Ea@%7f2z91gBEfv|0dfl(8Y7gF65`@Kc5`oQYHA2?fwa}#y$0~6ATN(n(B0L{
z%nUFP;Vn*1;CBZ=k;lfyfN6$DO$HaxgOvVCS43P~9Lw2(FGeuP1NP<wDGu`SAmRc|
zF$6sgh&rioWmVPENLBCn_%WzdpmA<(ZpH%xPQDn-_b7>(R_T=IJZkkbUZ~*FZy<G8
zgbcX8&&3`f6hK;(^F})40LG7xc7QQu#?-VnH}3)kVbQKz#9$b`R0>}<WGm+M^!6?-
zF0zxi`xDW_2rVrwQM)WY5K+Ic0GYh-)V|1=7-wh@FghM?Zd@8r9jPGW0o?&~i;~wN
zUeIH#sYwj?%Ju6`6<aW7*X5_+osip$3|{ZKt$)!cy4oE4wmy%&d>_9#2OXpl5DA=I
zZZ;_?3HZMI&Zr~Ig-X|5n=jZGn^#O~*ST^7A;tPHG(-=j+!RXf0r@4EN<jCFd($~Q
z9AR=ZMw$SH`||>NT2fvPX_tV+#PNYV_3*GT$a260>ixbMmyG>6_59G#5F}|}P|&9%
z$XT^&jVvr!_|4V$pOOq^$<xpO5qxq*9H(Xg&3a3fk(TD|>%0FOd)?EhEKEug!cDFa
zrVZ`rnm>icHDJOKy7CX=!BP992V5kOXKZv6->`x-lZ~}?){fl2>()kwh8aqOiEr*J
zgh`}@Q8_s~LlS;!YRU<Tyh!tqjV-MadN?*V7P1x|9>;WpDHUrLvcmA1@KwOro;>kV
z%hRf|nTEIYCIl9Q&&0kyw_JWMDe@Jh&#%3LIDs|B2n&C9`w{(jHgj9L5K=2<Cpt6T
zf2BuD;r?7+9$VE~Y24l4C%ArpB2rlkKs(afdJSeFa5k7E|E?xOdsnilL`28(ASVU3
zldi7kWonuV3Y%+9)TXjB*paQKi@+(p3|Tg~An*D73?5z}B#1$f9ZwuJ|96#`F*3Wj
zc)gu#+|Jh4*2YGy@a1C(i2z7z5$XVqfMgW#4bXiax|4#A%*Muscj*#VhAAo8NSBUF
z-G)$i{@gjNwF6d8%F|#-lGf%RFA+Oez}x|G`vw)&7;uCOM0A&^_*C}8#!gn1IT{!^
zd`J;JUV``*7NzNwftW8@m7WgVajqB16(DpyhchAbKJR4XsMJ4?Q1g$Ej|WcEZ+Zi?
zp<?}3DLDeqa`0h1ffxtk+lNQ?CNK$tJT3@P%+Aj{ul*8*ENs$}&J_)R9bH|bt5>fQ
z5mD4dynp}x?OQ?$3YX&?*k6s#6v_D;w8!4@QmJ!w1|yY)3urk3#7w2&JwQaffv*Sh
z1{cVEkTUNvmz9zN2SAh-#|vY)VebkPvB}ZF?ypdyD0G&@JT{{&N~6T6@a2Leh>Hl%
zu(gG*$OQ;ZKY#wbeED*ZS6X<uJd7|1Ca}|&{I;J1Js48t(GH*GkSz-E`R5P+Rdz%m
zE<VjwU^hmB+6q@#)`^G=N>*>j^FQU!AdlJ?^QGYtQi||OcjRNL5lLGUGCy6UtBFPw
zoID^Ce&PTTI(NLAa}2U?dfsWHZiDTLD{Tfi2sCFtwwHxU{y*QkrHGhX|AoFW6y7Gw
zdw+F%vID=^QYk9jA=CuenY5Lx&h!UqNyF`mUE`f7mm+K3dx?E38KZG4$0|foG`d65
zFSAjCJPtmV&n$Zfpp$Q}H%Ulqj&>IesykZoRnv-Z2TxLE<z;c&Uy$ymHS>zIe4CX6
z_X*>^V%aD0I5xI4ems`ySnkH|*caK>yL_aXwq5-3AWt$~|Indtph5rTqM5me$WryC
zt*mOr58K_t^S+KsW3@krm)5!qa;<DOjviVs!zXzKoF<2ZCHbm1osK-X7MAF|GIJ}7
z7AEV{sAY00wWj7~I2^{#({IyJ@N9?ZQ)oBtBo+u1n)kO;+?iRr=Ymf~!Eu=2qf4=E
z?5aI|=dAYa4t~d9o)Vd_si?1WxcS?kZ$c8+?YpidHJ#IX<aY41x!<q8mTbhOaBSVq
z?RXbMn`J6lFkMzr=HWCkXGmXfZea21;2rsf)&hUeE^SSa$5P5Ct)IevJ+DV9o}Q~K
z;VnSr9Rg!^^J&})2{P>%8c;unKvb%)H?>eZ+&;TQHB#33RtASga8ZTJWX2}T?aRUJ
z4eC{={nm{NOU2tL9<AZ=6EaqQFJ8m8#$+J&&49z@nsAcaD9)MwP=Zh=XXBZAk2yii
zF+a(J<aZW~Wyp=!^$Mf+5|4H)0q$S4?Et_NOzqNC96X``ys$vf$=0Fgg>vGj;Yi|L
zRYUR+=I;W7g|d_T=+(g=+YXlt%z0Fm)%TmnKaAH-u!cvwcNc!wCUD<c7u*IOLFe@h
zsT)5=+rMNvJGJ*YEFvV~AYW6U!ePwFg)~%9R5pAqb#(0+zH!G8ylC-T=PL)upONx{
zi_3?Lw!(g6?}$Q=H%c(s>cW1XN7~x7L!U@%_jI(N2fFp2X}s?H^JV|WJl_wk4D;~6
zH0WNAA)O(e(x?oxuO71!8I{O4$e@<l-xyJpu^5BoB2dpJ8Fws;F{9;5<E((xG7lL&
z6H^OXb;#-bjtTd`dx7eJ_2Q01K6abN8lbJ_iwPgoSq0oS6ZJ)R@m;n<g2ErBy`wLg
z4Nr;ZKY#>mj_k|&E3A443!ZCYCT-$1!?YZ!Jcbk!=?@v?sreCi6WU55K?N}yZ73Qh
zx+3hS^`>cA<*<=;Uk*t7bG5goLt_IS^Eg>?B^mXbpH4<FV1p%FA-liiRvAC@33+wA
zh}%tRkvW{VE>{*)RpR@Bf6O}9nYWcU%6uyQ^{I0*t}c_w5d;;?31bXN!xR2%n){cs
zxXM#%Rw(!97^|XEIN2QSw)Q%$2n1=K0OezNj45`U?{jkAl9`!L8DHEt(|<80O7nH8
z<sxZkM<aFC1NtS4(7v}b@!<09f}X%G;iA&uik5;->LF2+tel*~pE>rSqEc2?Yn7U+
zFYI$hicxulA9Lrj`x;K(;l^mKHzDh>Zb9A~TNF*TWW_%*-)t^%<F+3#s3-0BA{^Z(
zSQ_&%lD6-ct>G+iaa;VDFcdXVzNM77wf&&7;5^@gi75;;r3RlDq1;6~r%&>--p5=x
zz0aK0rqjHs=?|QHc!yt8Q|HR%5Ljs2|ElQ>7L=ovjUA&cD=yEg(`2yEyxV`w>mO@d
zj!*e8A`7!K5BapH$2rRzR5(d@!fdY`v=#B+8MHBQFSP8~qfR@fW0kIQ!elVTWWXT1
zi6B=-Yr!I-tXy+kvXe&RgSIEbOwM75dsuB2!m`o^ZM+D%EF+GJS<~{%pW=2Wrwo_1
zk_9{3+HGOBpL{KM)Mi9Q0Ytx8+(|sGPsTIw9=pOGZ&#HFuH@8d8e6<FUYN+e%E&-9
zAHvbs)K&M$VI6O-n{{ht16Zs@RHW-xsMo~U8wwdkjLDRqiQ*{Zpb>`ekzlG^4pTlU
zb^osSJDUV{5i!i}%T9SQhYK_q6Vq+W$YZn92+tWmKm{QoN1b~8u%Wb%|7yDMz=Un%
zSamhaVzPxaar4q8O8y1Z!dYkaXc<@u6@_NUU7kOAmFml_X7wrdL*Q+>bTVc8+t)oT
zR5lkHC?OhhZp+{#A2!mtW-7%&T(*N=&=*xky{7t5t&@>#5lO7iJJ=>GSiCS0EJyFS
zQnVqkdU;uYN=3JY(?A|VNjY<Z`&N%?ncC9S%tjlYM`V<~ebZBE?c54k+I>c*y4cw3
ziPjKp(=H-6vofQj`f{Xk*OoU>Uz$1=Ih=wv`?}tltUxLqX6|%1<$^h7e4g2&hTH4n
z9*_948P9jvmDpPIHh<@tWWIr=>Th9Z@joJ^eLu(s!|q^#;%$g?E|0S`@SvdadYbZ1
z-}L^ISZ%I;vpXxS2zHqcl?$b+Ut9Ly0DYHeym%9Kr+*|=;g|ntKKswa_@%_3E;L{{
z=qSkjfFBL)Iir{V*_8(A2}U=_s!)svE<at~{e$eWdgK6jlPTuM|4dnq6kre|93arX
zSFy5MMVFbD$pSqdE;Cggz06vFU<2+7$PU`sZGy#*MYGy&;W+5}gIg>tGDwXVFS@^L
zVa%rhuWmh3P*!erdj2$4z-^D25|m}V-g4crUlelB$UL)7c(>1G%2;U4hYu`Xnc3NB
zFa-kdvEzNl_741G;4Op)(aU})-4iq^Ljx8^ni(4peb*wlc!GO{oSYo&HzXt^H*Uno
z#$u&w>&Zs&x>VKFG=2L<OiC)L3kl_avx+_WcemTWlWX*|6hdM3+HI@UY%Q0iGN4Z0
zUS7as4<VN#>=(mkn4Xc*)YRm-JOb|UYOOUeli7t*@t4M-tbV?RCY0aK>+0$PXONG#
zcNwVpVxd%!;TWs5PAMoTK%ovxje9{?D@Xs|oO)kAj%~c0;yHsp^@fQKgmiH1L6=&<
zi$Nm7T|z=)2TW{s^B*f_GZNjiyNy7zh%2c<Qou<6uj#PTFuhE?ilQPm8z3gu1oa1@
z*B|@>M?X;U(9qChNWOs$h>?*|CgIT?ukYW#8$rbZSc0HbqPnuuY^2iqv)6@a7ELwa
zKtI3u!pni{E@LU3xef|0VAestaw8>F0EjN+mjLRzxw?{D@GvmUgF&C*;>Fm9`Ynav
ziM({(3MeH!2_^_I0VnX{2;*{bRY2AZTtA8YE)F1}eE9GIIO=^nsvtgJA@$Y7(64Pr
zoB&r5=webWr=LJ_w2Sqc#i-rb^;;s41t8xzfNh7%a;&tx{AeF2IJN@f6{!#BL*t&?
z3<UZH2JocSo-|1S-@<;70`m3p(x|dYtFA^u_82-KT2Afd%Ot{E^z^fVtaU(+i$Mt@
z)M<Eq7T~^wtZYR|3HTbJ1HrHZ&MJ?^q9!jwn27ikcT5LzhrsE#ZT$4954dv)b>Q{D
zY$WXW>WdHfd^Ax=Mf3}P^e-^y--oFQi79?i4uDrta9K!6N%gr<rAx*1lo-m=eEsTA
zB)B^j4x$Jz<kGphFOjp)!2rqS2KoEHdvyNnS!u`y)~wXUfiDhTg5tw@+Ro%n#x6_|
zc)`<22?+_ox?t4(5k@2U22b%=4t$fK^SU0GgxuYaU<SsP<B3qLt**YM(lay!Bf5)=
zi>YMT-${8t7%jmViOuexT$q8pIFK|TTMr!WpG|Jm#vf%YQ!EtK<j9GHxp{dd3D6am
ztX`ly`Ha2kAz}4;52FnUcL&JB!`J}PzC^((wel9GmN)_EHE@->lol0rFW+HiX6EA?
zftA(NWcc&5H)Mu|aZ$4k-)%E1t|o0g7}SzD^$pr2j0@nyJ`S?O5PyKF^{-wPKXI>B
z7+8#VJx#T|PU96Ftqg`G8JUobj10nCP<dpM3m)67tmd}1&7GaWkT8Qq@E6=}XTX4#
z2Nwu*Xqb}Vr~~l~M43&_i!@-zNE;;+sa}_}Tod-g&M=TgczAYOS?hxW14{}E@7t7Y
zUAuPeiKr-;0-ip3lG%@e{;?RXR>b|eurR#J*T?jwi^ojuj!@tivpa~ppZ}3Xlqa58
zSrPoNU0^%g0RDpFAL>hheeY>XGps*o_4YRS1b$<6p{z>qi~zYF1b>{K9z@!V;^H2-
zzI_u-lLK$uym^EJr0mtRQozRX?&9d^D8<;Pd{dZ<t<kLG5XDh0AC@JYot-r`HI0li
z)$&*v8TWoqhNd~3boP%a9nYv+e@|uxynOZQ0hnl(eiewD4VQybc@Iopko1JCJ(y?1
z(6H2QT)+MU2tD*@5IIM7Vc~P!B9Mr{^#y$d?kh-QgMB?qAsglt*SIUz3f|mo3=0ap
z24F`-Qlv2#fNvBP0((U2yY-olgt*vP%-kHeQP)irWn(CHVq|20g{8L04j<W<&Q8m<
zU*CW{gIJIN_KS&zH)X8z`~+LqANdL`kbr}Nh$uzJSaBC@;<tMYlTR>MJz%gii49Rg
zDc!&K_py~-5W~{*&l;(xt{8%hgvk3E#jFnI91s$W<VjDJzBm|@Kp5Qt$01nslnbmk
z=ei-W$tKRf69bugkdx))<Z2w2q%`rmo?c<XNs3(E+yp!A$E=+DWb=avoclEY<BaBi
z=ll9ojGwrS^~=9@y!ciCFa5J2A>z`zy2O}2#Sm;!8RB~2t}s?AzzPnrcOE@bvohBY
z{PbsC#z|4fznR!ibP_1&VPRsb$%%%KNkK`>lcJ)c3l}ax))!w}0%Fp$XMVxKsAEM)
z&$7SfZHS!vyK({YAB0deZv*VJ5EDRL-dP!k9oYc$5N<vS9QyApTtgDxJqd+&c6Qf<
z!AF>IB4Vh3^6?L;<bisY2Kqv4PmdgpS9my)JhsTB$S*R0go?_2;uFqNZ((8K;r>os
z{tamT8<jK4rLdLZ(ZD7ISE(#C<C@<Ps3L!v!h*2B{9Pge``w8nyWvlfB{B;Sp+;~N
zb`D|G`nM8;wzT6sNF$*id6Jj|hLeX*^7N01tA?i`O3knqK5XK}(*V-sS5E3$5UT(C
zN`k+Gxi|aQ{wsAPT>ZhF#ij%bz43b)<Ot6w;SVZRhP^#8hvx2RlxS2QN5i`KA^f;|
z6l!iQ<x==?Il&S7BkdiHk_iSA;*J`telyukDc(M=mZPjLZ;rVdn=eWVDYIpUjTy^d
z|G(w8M`v9eop1B49Mm&ejsZWW)z-ocqC)$qHh+AQ%m^L7TSdMW&Bg1xeSFJ$xr*q#
zf-v#s?@yWYlDWLx80OB5g%lsm?$Jj7`SQGK=ajFt3Hk*Mx+&@Px|uI>e)==AGIXhn
zqu%r|3smmBL~YIO!L4F)gHc+okS#x6{nXtl<38Lr^7(hgd`JfRw=@SI4So}+dk>7~
zJ3YTh!Nq46m-#DA6KNp%=l-L}qOWaQZr^9OlSg1;Z996_ay<JP(zdp|{v^+7rpjG4
z<ItbWaXxS9h66qGGo*Q24mCB^+Iml$$8ncO-?7U*9bwv01(U6rvmRO1sse{A<B%LB
zo{3kEi=hw%qUKFl?^drnAa))&M(0tjWqbTPOAE=0qLsT|zqclof#J&fhJa;2krm(A
za&{FR6>eWvmUytV+m3hi(0QIz*w1I0EIZ@=&gVhuS{~l{%pBQ?rIvt$TsC1pNTlLZ
z*mLmx!1oC5R~P56{zi{_AhWXD{ht*R1&S&LlwsD`58e;#2*k_O8J5@De<tlwiEc8u
z-Mlux);!#mH0>pEU%Zct*<E-CBLgY>;YZb%{3YM+QJkd4jUO-96Sxzz?Yr@2oNv2_
z=HK{y@H!q(xmae9!Xi^05}})4j6FWov^2M?r^!`0+0XxI?)+ZV7{Tm(Ff?mM8ShO<
zAh4GjX!xn%e0><&MXXW0DEBVw!a=hLtzqr(*uYrh7=y{)uU@fZRi%i63O<po%ywpW
za%q{y=9YkB2PMw229y^el7iw@W|$9u**A(^l1*2eh!S7O5!-BCSmgTU9ppi2RM|e0
zh~c$pc~4|hK@XK)*Ly~WTBsc@N|z^oEcxToJb|eNN#e<9HwMrm?lONbGqW_E-Sq5h
zAL`XczC1Bcd~+sMWbDVNzC(W?QCeyZSm!<KHFue-Z%N5H3*9y{B+^N>!aY!%FiqJS
z^=wUY|2Oh+{^pOdwD8TODYX!|qq|=ciSGU)i~9n}oU!Mi|7HDBKhd@OR=<WR2+~|D
z&F42|a7NF`2CaabL(Fm9Cph><ZnA_OL9*7`)4H=6q3$IsC6S`eq~3(!642n|<r;C>
zklmu>O53^DPvP>n_sUht%F5x5DqmCD-2!#+8T0?bUJ#jn+J2tpGdV`dhNC9GJpC?f
z&e-j=2fBE+Y%40;$6K{Y`<3eBhDRl&kr=@mr%xqtPwCCUhHoOcH2SQ*=lM)cvniqm
zztcFb2$s4WCv)^G3NE2*m$!-n9SqdfhB4;sPKD<fjh&t!GmlyE|0m65YZ2v~fqpMd
z_DFIoYH`I0yJR24mf^b3{P+-N%EKo3gUj$Rw8tYnI$eWrt2eSuzJuxrY(F~|TEH`N
zaz>Ab_In6VlwE7Pt&8)dRrbw&J*MEzi{p~;7>brtR;Trv>*`)YPX{&D@Khu1U2f?N
z*RV!vwRRh^gTV!KyPzAUQbS?7H3H27`;wZPOCX9#;;mDW-_O<Z1^Mw5a#QkfzZRxo
zoc<l{Lt2{3or%koqnlBNnIHb$)xcP$W~qxpEl|O5k~=q1IOCOq$-|W0o+^P_E~}q-
zFfbHz@KBOWw(LRNLpx!+CURSNXQ4^RO~ZA}hF50)Xp7=6FTnb9Q6kPYYvCYt+kpp(
zYxZ#E`Zs$1(;{M>$Q9({v4OPSmVkBUd&7e4FMo&h7ch@F4>i`MBs+`-U&qMXmmDNg
zkQ^ed#6ZXhM#&2q)fZi$&h9r*t*0CX8;5GQVnLE`M*a`uOm%(Hp$?9X-q6Kr`;@-s
zQJ2M90&vxws7~W<b&fkYUpkIzSyw(=LieW_+}l{`RyHA^<}DeVcpz6%{3|ERe~pa(
za;8Fdl2~E@(%8S05;Z-aM=!Y0_OG4^P#K$R-i{R(jj1cGyu??OTS>AD<g#;DlDe?K
z#-8t}7f+}&Zpak6tYWz^VWzJ;iy?}LJeq`XOumfb!OoR=e#xyy(0yE+!VQ98>+~Wd
z4^F?Ji-Rztj3s7zA&WZWQ;wBk5DRXwxBn%)y!|<tEMf{mowO#TQ9O-LDpvnbss;bP
z$N#OwFzKN^j?h9fwm1O3m=4PhK>JD3aTnbMnD>(I5>zV0L0Jy`t59oHeEhxld1hBm
zQeP5u`ot&MnSV1+Fus616<96-jxA%b-$!&yiSY%{D`8<_FwcL9hHMw)ydd+n;-LtC
z4xW&)y7TBSd%OsgDS^9STV@q(4T6I8ki!RL<?HPoQ!NEI(^L{^G=pIfE(u9V<vg{t
z;ScZMt3aV0%H$(VM#Lsq=#%Z}?}3rqn-Gfj4YRMpI}nyc1`Jqz{#%0T&#YE)X{iG4
z&#9@eC$Q_Lad{ZjngX6bfB8n206rexaJ@(Ud<$T=t~XGu`x0_#Cze)lwJyoSgU;%d
z%guvV|0J`e4`rkJUH^>eCcyI?PWTI0K{^XIhecq(r0xT6qFv|8!^XA|XIb~ao*BO8
z+!dxsCNR~~(arp=5)Nu-o;-O1kQZ22)&dMm7dF=iv_`8~PaHg)P*NHk+|Ij#EofVT
zItECNL1LX%wRj4Wmg)IW+B!jitsUQ989(lkWKDQvFM)f7jI7F}pAnQQnkQOXV2<7Z
ze<cyk6VOgzG@t-L=a(A1sh1xB$gdKj59qkbFD5|i(!brRyan=E{qfO0q@5F8*ZqNf
zAM9>;>@RVl!rwu6L3Ly+7<hrJIxLS2fw{k844IRijX4^G$&&==yVn$b=C<iC=z|x2
zk?DO0M&Dz(A(@Cv(jfiix8h3UpOwh3ha`w9N#%ob{UPhtdrN6ddFRo=$)BXWMOXKq
z<o|W2l=o1}{?8-XTgBK4=4CdWX_P+NsR{d?m6j@J>Xnx}vmGZ@h``0RgI^N4<JFUX
zLG|P}@*+6{iOW_Jcs0;4j#pPSI3-lJEN)<%HZk_9T#ky_^w#rc`E2;B_bnw(<<?*$
zW~PhK9B<t#weu16m{IP5uaG$nf<^FgfW3dvhF$}HwIO6$Q8UGVmB(-w)aU(B6=zcL
z;DFu!a3;<Y#5Qn@BcbR3$P5^3((@%b^NtWWh)<}uu$=rN8%=q`o%8G;LE-%fEn}nv
zAyaTSr>@ele>XHECRL?5VItUgeh0~Qeg}HSv*t4tmPrkYqi6JB_S~lmoH%zSmHd_-
zv{FRn%wP(00g@|(!x|<Hw*k{}-~}Gt`;oAEF|V#1)cZ*|24V~JOI6O0zE)gG*O3Nz
z-q)LM$P{B^DnN$>uV$Rq8Tw1jfu5HULh1ugNgGtR>PSzz(%iH>OuWn`*!U#^flewf
z!<8ASO7vTSFJmy*zY?#wvLA|lDmqC?K)ty%#`uBwCHM+B9^j%hQ)FBm1qB5Yr3uV7
z2dJ#T1fcVQG=u6Sjbw$I3#|VF6VRoRzK1^bQVm-@wKYg^O=9nYv3KA^E|Li!J3^&r
z^UUEnmUnceYy01l@Tv_}ocDa{3SJ%%l&GO(7}Q7;j9Su@yrrlF@Mh0`a9M^0#Rtxv
zQp_O~%!M-$r-2BCl?n#Fb|&zWUb*tXZmtVVEiu(B2*m2~P|Z#yU4E^{1ik0$>x9p*
zF<!N}_4@tuLbbab<#M7z-HIQOIOc=>17#CuaWu13%med?(@ao-PQK{kTlN(y1$hJ1
zTie-O&xM4};^5FI5Pm;6dY|Deck_YJ_clF&mHN+mGgEQR_g%RSXHq4>pTKF3W_R<8
zyuLL<5`>-fb1_iQ36+{1O)XH=23`<mwNf~RfrXp<H!N(JK8=lyQiEqPAOX-aGGai5
zh1G{W*aS|DfePm1jl|>onxwF3?WlZp?>t3SUDkzuL+p8l7hO#m+w<br{dLt}?^^&d
zc<8_Q;BSCXVD<A9)LPWKHU^PFO$4YkaH2$3c6N^&WWf-NO(+%r7nX-#K0H{1^Ebdk
z0oC$skHEK>tGf9a7%ym)<4}+?(;f#thk)JZ5I}^;qIJ@af{|QMbEA1Gu<(_XD+C+R
zR=nPVw}^z46r{h@q@)QbZG`tPE-ajbvOi_0|NcTC2o<@QVn%qd%*4~&sb85DPj0DJ
z+s#8AlQxLoQ1$|WhBaUsbOE_67`SAp56nKN0)ku0$B*FN0zn8|R1UlA`oexvbb$c@
zHda>f?Uq(ng|}?((9`pR6rrMW>H7Vb;Gr`iDW)#b{dKsvl|sFV=?^57Q&v`%lhXkm
z%hFPo6$+&2yr3F-E**Q^2Ft6xR(GwC6zxNLl0ev3T3cHg0`@@g-QS#-fAQim_ICG!
z-w#mex$YDwa|f9gHi;(itG)Vs2Du9g>Ns*C?>qt3_v!T$-;!&<N6=TVUb_ahY6Cxh
zTqh+36I*{zPgq=>sg91#YzJk)N4<wbAg3|}m^ji@%pEOoebd1@Gv=GXqekxq#qX?w
zf{BD6{s^;X7^0Qo6ozk+CFemgfU_Ph)YV?m^6B@u&V7g)(<yR-YJ&i3@aw=9BEt%b
zc;~#gogM=t<3|tJ2k0nO=PbU%K|xGh&vxEIzM@x<lZy+_`!h(vpebIbprD2V0FV`n
zY-;eTo<$!klu|G;1RyusxiX~Vl;q_%z*q$e8(hmde=vdU@cUfRRrZFS$5t#M$O^0v
z^58dU^P7`k^ywi`z%LYVTK)9>yWi1^WDw|X62b`(U~+@Y*~#gBY%Ih`s4}49vC)G{
z3Meyjg|%B!T#QSz#4>e@bA;Y~bM6K7F$@<RDFLP%P&_f~*i$9A-^^<aUk-t1-XaME
zli@YN>Z&RRBoncw4os8zF$v^^dU9swvzvrnDVQY_BcmVX=IZbam_YrkQ@3OsH5aG{
zKJX)w;*u(${rO`O{569vP{;)JsZd=5din;GfP%|w#N;d#8-adk3uWQ(1+du#goIqa
zbg2{s^ok0C%a=cZeK3I=Oq-xsFD@-X0SUX~vIdg9wz~QeGjm>56%UjrW2-@v8({y2
zf})#*a5zDE&0BxBBo4Dm*?4-W8G%pPL1HHz&sZDu(dW<Kg3qU*V8ycj&_GA$vz_Ru
zPG9B=kp6m<Ot1P+ff|N3$*Zx>QA0d$j8e&>P8rK{{r%JT#fulvqi}LhM@!2`!+c}W
ze#8O{1RS~mr!PS6?HEo#g0kJK!cdF@kAZ3<5N<)V1{5ZA)5yrkFEq3QR$Oth8axVY
zl2X#r!<w1BT;u#d?$hP(fB=sKYajNs35l|+Ea1_?c2K>C2b7INC&3X($9oF}7%s@6
zL4L@1Ckx`mz~CT!y;iML_t+Q=;8v`1k3|V&CpM+<)RNQJFGKCx_SV*tU7Y4U5%m?}
zXy%f5l5wY;bf+50KN5o8vv?8;!*;sSEk@lf@(HSc;<zklEC|vbf)!LTN2yHB393t`
zsm;yIE>jDPI1EEh2hJaWDjDV$Jcto>*eFteAm{uON_&Qn-dQ*%yC==cByyUofvXdi
z7;M~b5MAIHn*3v;&s0#2bPe~6w(HtAD1k|p%Suet20I-DCEh`Fb2vSu1^J*j2M$ny
z^auc@W6-Z5=umT*D9n=IyL;El);7gu9D5EI6!DcWuyb&1&2@`}4`8cuAb!?E;bH<)
z`o2`cqsaNIo8dD}K2%?1JT1O1UazInzMtWWf5(pKu<}xL0vG`SspaM7&W$e2&PGEC
zx0BMB5?>7#M=Pt}6K@FmYO$wGJi84xENpd^U_)l+T`1j$7Xokz6<dnVhaLx$)NXs5
zQ2zn}3$F5#5;jiG^u()y-@uFslN(9~p#pZe)HwXj8xbfy--BlBHD6V1cVBO&hq@jb
z)GidsLUwB5=g$XbKMJAnH79Eo&Lsd`t9<Yp)`B`?Bt(y#toV<a<#%3O;{a6uEksdc
zT=+#Fq%<H=Ib<=k6qTC0M5j~44G+C}GYR^8d3ia&Q7rVz1#e+k72uwS>c`CSV>@|J
z_bH)($KSsh2Fr4^Ix;Nm)>VI)wxst|ZbrBA_N_zhBerVu#tkpwWMAK=g8HNEbTviG
z+EL2kY=dcC5k=lmYQf8JGF)MymA(Ba9DGIN^?_KX-!RpgpLH}1j)HRDU#buby8d%=
zas#r0rga1yf_!RAXB5xZl7n2$-k_4}y7ucVe}p)0vKWejocujwI`2&-jL#VLvo<+m
z7LK6EO+xG$4hnf)%L=*IM4eq+R^ULlQRyQnIm1?2y2poyr`%v7X8W8STTy0S0x9d`
z!xfMDcJKsBj9-lo3)6vfw(34FE}GfeZouS$k2^vEEv)x!t=H+<snLxs<>uLp;;K2)
zUv-L}-L7`sU5Bp6k{>7NHY$|Iah(QBz3psBU|=hpKhj^1SIq#c4>0Hv>{5UdAVso*
z+R^$mUk;VOY!4qk>a(dK+RV;Y+VFQ79?0cWFU+Q#gH#Zt4#8y&4o*0lt)5-UA(LvW
zrgT(1gk!{)oQf*X;dS<DE&Q(%U1!*e)}h|<#zQ^a!)RkTf-9ivI?kgEID+Ag&#1Ju
z?WIG~Xd^-<m=lr_bm~yDW_kX=Uyh%cseec%>-`m_{@T2}SY}2>7?>p9KfdZ%%gJ3u
z#UB;t0PW)-mb+GF(w_}`8JtT6=YPm%YY9JA6sHW1#7N31`mA?kWo9OgYvxG9iED&c
zuYNqz?2^t?uLyB>1@paV!!=P9)HFg(u33$LcGPe}lCokMWo)Ig^qXunoFXEy%O)mw
z&3>kh>?5a=L+M{HIOH4A=<B;KlcaECHQV7PK6V$2Qg=WI9d~K_>;mZ8YXZA69Npys
zTM{gLn(PdnrOj3b1FwFou>n9x;3K`u^3Zg@KLNvZ080|mc>u1)VDFC}NYBgC<3;r@
zE-ucU7fycb?&$RvQUj1P^?P#b-LuX4jKm(Y<uo{nfq3sR>^X2cjrprr$-m!OD1G_I
z3sf+FD@x8z02BH}Z{cqbpq4txo!+kKgAzJns*)%%Wbcbe5s{HOfs?ev+2^4#>JCtb
zhz&H*HH}S8K-ns=1+3Uu$f|8&X4dwM|C1(UCpZ6qz-4G+5^!3)24Dvypz5Hi88VSR
zKIgtI@t*oaD7+n#ccQmmn3yoSy$OMw4A`U7((WAIb2A(RdjVP|?B&a@m}95N95C*~
z1;JNJTpUUQCG_>vVq#Qt46p?9EFMXw@pEZ!n<~Crw{8Kfh2%G!bK(pw)K+t@xdS^7
z2RnNgQx}myY1&A7Y?y-iM+rCw2DYK6PoF|A{Et5xV0yz*Rv&j~G%bf38j=AvBqe=n
zZk|sw&vu?%TK=K5a5n^BaS6_+Xw@rjX_0tj2Bn-rYYH`qFT@sJ)Jx9S$$gsymu<Ts
zWjg@@zK1zZ_3NTBi9Po**du*>eUD+mz`EJq+&t*?IQpW%Un{4iL`R6LaEL$o_P>VZ
z-y_s$!kfW@O@GxN)C%agxg18Q2A;h<dX<F`w;XmK7)~e!g@spBS9b&pD?mI@LHe5n
zZc$ko<RF*q*0N{J6)m=5yM%NnRAri=U&#LizYCmM2apH}egx4#lJ4=^>~tH&I}l(D
z4GgXd!>MicP$lZn`rJZZT0EQcg(zKk^R$is6P^Eywf6w$^6%TnFQbfvik8HuDA^=J
zMvCl_y(J0R8KsPhgocJhWMt1|E32p|WhR*^Wkf2Y6n^KW@An?hbN`;_e;ogx<37H1
zi_ho!T;u&dU+3#Q&zFtOB#`Nlqxgfe#a+(jy$pVa#a&5Zr#jlxvN(}f1X=})EVdu)
z!+BPfW(8`0pPp`Q&zzs>ZDEgT5@l1+vQAGg96TlNuHa^zQEqpD-A^+mIT_T>I;@)>
zfY%+_(O0hMJTQJxczyFLO3m)+*`T)JbP4B4B#*>PI3C0&hL;-pib+_EKYsYotkd!O
zwaS45veMF6>#wS^ty<O6)1#@^{z_r-^T&_&=<vcLZj_r@4*ueL4-ho+UAoeBxUelD
zND5x~=I2qju{^o~4<(x#_S5&fh9E)ddQ40g#NH#*NFsRu@gvSdyFp$Sj&)0>!RW+<
zJR)82TGwXsa-BQUvf|TnI<{r?^^)m)@SIy)_hSn~5qbi~@^RNZ&GJkXh0_zg=3m<(
z+nB{hI#+OB2wiSL_$6R7P)c%tbMMg9j*NW?Az7T+S@yeRu|0+2x?y+S0JQuqejrQ!
zE_27-faq;JJU@Q^#GS3iv$|fZYvaVel`L0`WcPMx8_{$co%KuE7r4IS_U4{f8rDDZ
zPg#aVVU5PZ_2Sj5K)89(Q@6CRs7P0FX+5_uWC*zk$LBtXB25I_UdaRI?3bJ4cS22~
z>`LRH>~XEV_L#?!x2$#Qx>pt+)L`k_EwfGdsw#-K)Pp0C3}Mx`6E}sm8oN8L3|KaH
zYatUevyJf4I66w(J&S}7m~VL^sGMQ*9Sjr}E_py7#3ux^8jgcy`nL)S&5S7_Ny*ps
z^+%9J<WyqVJ}^4!_w9q4Uy?4LMWOvA=uYr-!gPSnu2<<7nPqqTWMDTri#iZ}czn3R
z@Y_|>SCHl4;K0`gB5-(JTAPdPZi#I#AB{A(w~HQrauGWb02Vss*Q*z{1^^A?KB$j7
zE*PxmW^`!0i$+nP*}QA5pTJ(ZnJ4PuvNZ9|x0$v4SB5(_+%GJQ(m;C5P1F^@vNOJs
zlI}w`1MHFsK=|0d&-zXEFDqd>Tly$T%)>}4G_C4970vSIY-9-Wxsiq$W5KmLw?va7
z9wf`!w1d+Q61WvpdT<{Z+3MspdJ5Yq04S^`0tmL*z54`2B~$Gdg0)%Xq3c>(i(GFQ
zE)M|(dLzNx*Vp(3ebZ(D5p2+46%{CUaMPe`3+Ccz1s^I*-LTY3#I?cSHU4&&-})((
zjKD-F`LWJwc6My!NZY5ce-5Y0)^-aeB{lU3U~^-XK3jd3qbDQ^U=k2LQ-VAZzxH1+
zAst8q<7gwzT&MmhUhHdoJC=9jOamu-`;S9Ikhv*8Ee6=T86DmI_ASmZ|AZ_hn9PlU
z5@Yk`&4>ks_i41-@jrrp1`1FcDsL1Opb<uoAqX}rIy$<#T46qFJ0q#L!js@#7-7YD
zw+|m|6R)ntkp^}+*^{2uF;E0ItqIJ;25)ZO9UjhD-*Hp%afVcA^J2F9#AhlZo|IWZ
z)ux>wPb%CrJE@)bFIo<$xTT8cT?{+-QFIg?u|&GEbpi~&PwMurSw9UKbu&xc#VCn6
zc@MvdDJ-+gmM=da9L!f`aK0FfGhg^4`rVWdc)VAwT7{%UEYhXJ8(zXGQtqt=%7x%_
z-)+<?y6vU%pVv}|yAnlvc+ldU9-=gf$`qD@YfoClJgjOnq;LnwAD-dhc|cR86dN*`
zG`u10l{rzvbb9;l3?(kgT$_1jkeEkFZAPhlx%Zfnk`gs}PZJy-ZZcEM@8)_&EJ8QD
zoPL4>fZGaRkmG65n-)8<KjKwr!iUBK2^9*SYkOpH+N|=E@!Fd9eAsHre-J({nCTRd
zpN9PbNdhIXNqI$im!_p{^DFJ_=!l7pwJkkvkS&oZ3PveSo!UO;)-6^g6rnG@C`64g
zZgjaXxdw`*F~UjLZ;ic8Q^QlF^o%R;cgveM!xIzQfn_!O$UIe2Dz%aWzL*zYLPU*>
z-wBr^58M;VTnDV&<j8nnh{tlRDiNpJO-f#5eO=AW-lFaV-EnGqRJqx(!EH(mdczv>
zT~$tpMM=Df@ADUZT;6x$Q@k%~2`;E5kO@FKxNx@tXp-p$k(7PI8b?9r-^yFH{@h-7
zLie0?!L<STuM=lZRZgqnwBTrw7r0MJiCi{-BY`BoKs|<C8cHf3U-Ii{g^CT6A6!@~
z`|8y<KB+6lV&m6PQxn8`P){%E*$v!(2)Nreob@3!D~o@wZM%z~fbWu2Qzb_8iHQeM
zvu)3%D2a<<zROf9r_Hl9yTFxPyvTHRg}~4BqN4V$u9HBxNJ0LPUm1mG66X%up9t(3
z&)lPk8s>+W$=fDA1Z>%BetpCuBY<!YR|}8Rda6$xxZS1tPCx}k20xH5fqGCxNQhJZ
z^a({p;xVi-vXgS;eV8YG(QmA>B<33HwL5pTaYl`ibdh@XY6}7v!1o=PHIffpKy8IQ
zJ|$I6O(uU4@O`#Ji?z4P{J<lg^VykdA&fhPmSTtF)m%r<g!(h$!UYE>CrBhyZCUrA
z^?>V#;;*b{EwRAzxL@<7IwYfvEG+4>EWMPcUdk`-KJXmzU%hG5?}1vHGy&>y0TGee
zsVSadurvrQ<5w^=H9h%b@=zKh%@e4Uo?&_6W+hpg;K;wC@q#09d})a9T>I{M>1QwM
zD*p55Mfe88e17eqVgvL<!-nswYMynqJZeZ(?`CFZYuVYcM~Yc)B<?L+UTgU1)^3%`
zpENP6t@wq7@q+<q<ZLGiIaVe4-;?{0?WudduQB@lQD07(W8}|C6hU<hTw-owvgg!H
z4gzslHt(rvp(Yxe&3}5HexS2y*6%x`IIn{%)Ly8Du&J>rEAQVw;6N2*#450>K2*%(
zqTlzG;=Ep}C|RI*T%&XWa1)-&Tf%gN3EjB?&b0i)gE+|?cIv~l;mIl&*B?51^g!U)
zY9dH{%E;%|!lkgo?YBcCcO<O=h(^c@XhQHISaOW@^&fjF<4GLO{rnIq8h_yUpC?z?
zyu=wrb<Z62KDiSsni-zmXx2l_E6z$^!QoKP8%6i--NN6Iy+gNhW1Wo)QL{x;J2rD&
znXIpj{q9fOcOAb&QxtXm`c6O(WL-3WVuVo;@vXpHRo`c4)1$!_ABOi4xKh)Yk$AB$
zr=8hVSz<!v(C`*J^=4g!A!2nzNw1N>$Hc@0F)wcFjE65fvW*`<e#{=$*4=#y&mgJ<
z%?>7l2|YJ_;YDImqBqZmtx+28&LE3o;jCTSYz)1$xD;>=l=}bjLG+7^ATa6y6%}0F
zOtb2uBCn1ta7{*2b7*m)i0J6(sL0tstPkBg>00~ovZAYZ=2;(#{v!=<UTz<Wi_}4P
z_U3$6abDr>%={pc=Gl$JJ0<4}cWscNBPxSUx++b?dtO`<588`=P@hdzwD4i5k-897
zQR6H{>6X#jJBuq}S+Sw;$&qN{_ZgE+*@`Q^SmhaGR=>UbD<kx|Fx3yD;9$C!<oZi`
zZiy6qC4m>rn(yyx5cB6v8iFP!_Sa=dHAn8)d&cD?bF?M(FmIju6R!h5uwn6W>r-E9
zy8Ei^^J>Lc+(zPR5&Jsu%155vQ1sYdR3QC>S}_#g&L6Y9_~+X-^%VP(m2EVN+qsSI
zD}PF+s8lAg+o{X9U9o#ougOG6)Tyr>X;zfPw}tG~`&z3#?D8%S&;*IsslRSXp#gi}
zyjGl7VZ`@$Yjqh@Vn3^Zsk)&%j<0A%%(c)TJ56%9&ix`zD=uDRWV;e12PAv-#*HE<
zQn9<EmPE$mHP-t+<7RVD;a|m5GW)sf`iS_MlUUF|C(c0EJ@N6Q59(pGY0?DFy7ELn
z2jzP0`gQO|%JgEQq6qkV1m~d@(u319#(W^cM>>>@=Lc2fxKir6yJf}2J%L_OrD;Yl
zCxThGu+r1puK8%c;cqPf?`=3v1uZKi<m4<1>;M?aZ0f|l=ho*in$)+o0X^MDOX3&G
zVC)mGyri2g@eCoy3j)&#L`l(uvr0hqg@O_0<QQSCbSOBnCeEO*gSgXGN-$vJC8Pou
zPD3_}rDs64PTiGE)i!slRHm0k#tt;gF~W3jLKb!feEYy4o?4|8>9m5v5fs8IAboBj
zV^VFe`EJRn_2>ON-hbz%A_Rj?8a7;DPGr2ia{gRVyWX>Y!WrUf75p?+3zb1_L6VMW
zNjH0$84<J+-y{BfkBc>|Xj#jqAkzy`n}UXktbsQJGE4(LbQY>a4O^W$v!WMa=<e*!
z=6S`HyO?Hpy)7>tw@eWKZpqzrcZ(`Qk1-Km%L}g2uyQK0Z{pZ=*8Q;{tslXunDc?y
zPp7-=>GJJ1d^hDxPW?Qye@l$$AtgLU@P#UJzp3!f1_Gm`pp`>LHt8g+rKd$yYWKZE
z=c1z63sb2x&X_b%{rNbOhh5H6J*vtPxvGjA#RH%kQNY;H$pj-5+rg|rijI!uNN@ti
z12BQX!T!h*v4fPLZU6Y7wc6|5h8SloVz{rWB7m#Vp=FB_^3jW<qOdub`ukTF79Q8r
zTjl?ur^5RfY9&D5lH%eHkCVhkaT`*#IIjm#9vR8KI_%@CguvMeOVCw_)Iul}`eGFQ
z`;kaegIoYE4(wLFJw2c_QCjccf>2fir0-ph80pOCnkTu#;7C}Fk^hA>xcaN_KY!Mw
z2aIa*I7GzmL$pKlSx|^r=ihX9BcrP#E35I(dWOmbtajOs(4k<ZcVPCRmG%ZS0l|%4
z)wZQl2Qbp2!Yi!y5#qPn;WnRqw{Pz0*|XGslykgP8KKZ<G@k^M0W8VQJ%FU_Ua;O+
z8(~zz6Gn0^$Stib-*NO0OYii{ggtD(C&Z%D<M%F|IkQ()Rn^C5=Fc(<#srbOkZO;;
ze}6qT_H9p3&aZ2@rIE1R#H(?W+|dAA&=wIDW!*YZV^0Q8#DjA{tqgKc49F0T&6qz+
zEp)H;_M`n;(y&;=5w2;Rv=xLStkTf^!#4nWxB||7R9|TN-^a&}jorw(?)ZObs+18y
z%zJY_WFgK^MR2V^07_CRaq;9Yn{G7Np{oGNEpD2X%*<))Rx1r3;)IhM1r#3f8!;7B
zWmiJi=|WiF(c2q8!tbU2G};mq8~n+};bDkB!jlnDIxG%;{`ZH5>o_D}i2CVh;xisP
zLp<hqD@48}1@?dk1Jka&WfjG4=5rUqz>u0HEF?sRARtJ~LiiQ3sxMuVgPi~y)ZV?d
zi@#qjikit2+dU?z8{wnJ3KAO=gT!YCbO5I8WU$#@RpklyMx-OoIT~AuPX5V$lV%-r
z!I6*-1Ef91mBz)Khx6pEYxXFY4eCs6AcD$NW0`X)3k$Q=Xuu^TXCOU*%uVfft4`$$
zuTr~LR(8uOy}aC%kBzj~fRlRj<_EMNz!?>Sn=9A@BE0V+LqMB-idjljG*Kkct|Bj5
z7KJ>R^C8cl0Mj@llCC|fdIpAuQ3VBGp`#e~mS6bs9%>4Wra3lcm?zK}jCbM6HnSF7
z+x_MZ=@mh7i@pYq1uJ=ONj&&AWc%U?ME3>pXlUbTXhaD6sIO~|wwxJmIVZn*cu@dx
z0=M#31PM*jh0z!&hc3=8E+pV}{Qc(v1OQAI2kTdaCxf^aVWmIMH_~6d7`X7AD?GUh
zxEl$ypvn4RrI+y-49@Fc?nP7AIALUL932;@sq<NhzTn<HNJ#X4cRvy0kaVVJU`XPE
zbVpf5<schx^mFAcE$BV9=jZbqWs#p^5y7bk_YA#zR{*>)<YG8alXFSx?Kl+Nhiz@&
zbSbQC_O|>v-hBN5+fPSC834B-!~~&|^N4R84on>Jm_&ER#N52pOaWnl5)yE4i1G5m
zezOBrE*=A>_LW4%wWz3KWEc3^lDi=o<+kVjsNRv6hA=zid{m{S+2a>RJHI&m3T8!E
zUHxG?I=Xs6>7qxEl+Gx^zmjNT3;1kiCWFAnyoc6=&8?D!Q|Bh`e!M;hfd_(skxz0p
zIy&71Jv^M2{S_REkiVc6jC&I643atCgRS2YE`x-Vf&ve$j;^Dj6X*JEdk2QO(dI7)
zz6U8XTsxGKl5%zHfmWSeQc^64=EJRDXy25apQ=|K@Srlv>GisZdT>Jq2CXHf_m?`E
z2+8yPW!20N+!io4*U#2-|FH|6A4H!_egCdM!J~?-TyJlLLg8d!6~LWAeI_v}i6SrG
z2QfioqZ4W%V85Nab{)CrNiZLJckz5|WP_b&xy6>N>({T}<3DHc^A5+peUCAw1CJAl
zE9b#4jLdPmB(RdKCfINU@sm*!Wo0K|>}Y&N=Ci~~I3k{5%Hagw9Q4w$Ssoqx?aPM4
zr^qj_spIa%{F&lkH<o%=yOFeaS%dnf?r~?u*&RYcsYfMJW)<XWb-lfJwRso6hxLg}
zphM>qJ2*gR&ahSrAHRsm71qIb?~)qkvhs2bimOZnwN+J-C4<%Yx+)KtO}7V#V|MZK
zDgq6q%f}YB9|QoX*4~osGMRaKm+#nISjZXaQiDtY4@084*N_`yWv=2^dJ_$9R#v6A
z^C=jbf+z;m6K`OHitk+ZLLUd{d%eMq?AoZSSDcy^rquQHoJK1WY+*-drohj%oE#Wa
zT*w&<hKB5vI(SP+rPZfbPvd10pH_U63h7&m-QB?d1vVLAC6HhYOiXsk!Zw?2dEbBV
z1W{$=>G=(TDD;%&%a<d24*`}T3;r$4fff&ZgkW1k4{b^!uCK4}>eZ_-qt)0*4a?Q3
zTm69*_vr4^cfM1gCF<1Y4G@J6eGM4*TeojtuMT*Tdx!eYz8pJ_i*cT-@{SUT6r<5}
zwd>nBkyV456n7O*;QTG%Iu0%_l4%HB{MFB7%pe$K(x81|hsBvd8sY}|E8r(CZ`k?d
z(WB&h_nPs5d=*1#I5s9DL&JFK<0|}7;+ES)!J0IQW;EKDIZ!3$<~>z^VcwtuyA*#E
zg0zv%Y<lt}>?}A#^Md<Qse;mW%XFs(JZ8E<^fFdP38wZOLbqLw{^ZQ(4Hf)J>{CXb
z^iRxVLIl<jR*dHc=A2*L5<_`sS!l0y`t%-3Z~%9dI!3WP_HwLQdm$?BocrBV^i#w}
zrJVMo;mpsmyD41&1R`IlPW|$uBheLSR`5~DAY0>A3+K&nt`<XvTy7&zPEQ?QMJKvp
z<o(JW@HL4g2^0XI=B0lfrMuYbv?5Q87-qz&O&`9u-<Y=ulQVQ!!z!p-HYJX+3QTkL
z9#W&<`{(<CqCwqyWs%T7u?n2ryGkHNnAU`@;NTUCP-f`wm5JVF7oyDa=!2emaecvW
zZhqp^{iuVQ=%p=K9i+@EkaU|{wT1OQRYlZmTiyjhDz9bwUzrQ88UNVxIYNV)@FMVI
z?5qNNqkmj4_z{;v<&`fGs1N>x-j+AW2*l>Z$m|8tC-eCJSfD=S7)AJnTgic6HLBl>
z6SpZw)c2@uc||o8mPh>DS;kVM4KR^|=@Wvr^>%4oG3ymsFk*uIk$a5BPp(e8(Q*Z~
z;Z;m9f5PNKQ_>}Y+I2z3e}5ywW#0>nO=)xk3`lb^!n}%^!;-HGgnFqJ&Hs8?i=<yI
zM<uV+FBLOOKjPY=)&6+d4Wb90l^VtiQ8miFQlgh|QOYuKz)VHP7Z=E>TkuaxSXbxd
zXmYbcB{TYQNTR(y%c0kRgSZEx{eOW^JuS<JJWpcLQ&g-$NL5AP;sU@d`emTG7C<3k
zF?e=^@WYLIkxRiU(GJk>FSyh>y$<XrAY?_L<&b5q!AhdJ7fn2<BVe~e#}!H^Zv-D<
zQ~?WuUx6C2!^akJ{|{JfFl`gYkLB<LN1{_Ezo-uuwmnlH{j}m=tEW_1KY2aPBM6`S
z1qEuVs(k$X2%mXy`?fj6me|38Rl>tTffyB&xEf*2sywj@feUDW#K*-!4uItg+;8x0
zPXeNwYphC4D_3eQwBJ3zGIZ5CZ2x`R`fv<z0Bv{D&(EsN{fw2>-(>&D5?9~gb300v
z=U)X?;xU5AvPWYL^dzJes0Uo6)U>scN1K5b3ko(g2US8_(2XLsVE>^1(IC)rJZK1I
zDs<o>A@xY^yeVv{E>cujcvmEEOYol4KcMt!wqy&pOgg!esBuIK1xq7LxiVk`vClz-
zGjd%8$;4=+-{^dZS{2zwa419C26@fH%F5aC?&u{MVFW(xiA#e8;Cpa%J47}hoEBuu
z$WsWNKp!J>pG_Ha-T?U9p3l$EAANC4&)RzNL&KWDz(6Hc{7UxCdRt`keh2wJ!i6;a
z|1QI79UZz1E@g4SzuY1KVyt!RqR~BSeGUl~ywBMVriS_=x%?QIP*+F3HJfsS-F-M3
z+nz%?d@DX)OF?+Y4oWac_tGq_#~XiyW%h6Vy`bca?5!ANhk<PyKG%dmFEBJDO*6cc
ziIRdYJ|rXny@x6e62n<}i&}egQqb!>YHQm%tAnoXzHF128#neVq<wnE2b&z4*z-YF
zcc22{Hwr+jaq6&4_P=YlbOSHBHvVakD=8RV_R5NFP02#}0!;|q(^!f5M7}uW7<~8n
z!BDVz${cZWP#kB=s{+U0y0yOkB-FHdcpgRRwdpB<6b~2D!R{6Lm4J+!I)}MhtCXNf
zffJOEjggLNy`qS(hlgIrH_*W&bRi)j)MsE(t-*$iFYrk1?WD4?V~&KTPcE(sL(h8{
z!*wu7&Y?RkD@`J^5$S2z+^{2V*zG=mIUIMQqNZEp+k{v4GZVvPXc$Pdyp$9>SgM0r
z&nP0w9XVrVs9*3;VwRks4bx6>2eT&Wl95_J=Rj~yPfv@-X!5bGRsvUGkgKLcrA&`^
z4vzeT8MDpG(H;b7MBykZ+FVm(gMt|u-$@DLqCctw34>ix2?_aXh8W*~FL1tC6Oihh
znUf;{kg;>;F$af4W8GcbuWs9gQ9^4NLjcu~PjyC@@8YFPM=CZEHk@Du&m-LK-`h4K
zy>*a1Ay*Bf3=EmXkStalyH@+ZbZ!~80=yvdszWMO%@A#wuC6ZBD}ZbO4%BCAnwuk8
z2gk?b(N&~(bah=A&CY-8zaqAMvUQ#y;%0vTM4C)k7(-hKK|J`=#ocP;(~7<`YT!{k
zA&_}Ewex97s{J>37+$3ri%B)Mwu7)Vqap%_G!2zG-yJv$;s3o?RK!G2uiMtHkqrUe
zf6#_8P!jxSOs%Z$gocJzS67qG;pt;0G{mr&j8UsGEfv8RjJqQw<lS=)Y)saD^n0$}
zzCHHwqomz4*16|(REh~pNK6P^KB1`Zw7j<Z=SPkLlbj!73JU!Y4c=)n>X0ZM*S@=g
z=m{Zh60rw&(#wPA!Lee@+1yhsjaN8jZ&p>h{eLbPhreAS6n&S5Ek*H#%YZ97yKKcU
z*T{~oYz5*XB1mRFHgy=v9Lxgr#q%E=iLC^s@BDkNMQ(Csn<O7(R03#oHv=D`awD|_
zprgQ!C-RMA2?L`%*85=gSbpV`nr<2*SBVUri~_y@cLE({KgyZ&MH^_59}tE!29d@5
zdr0ije*F!F4HO$Jc#6>b=E+Jg?|3ayLDXy}8GyutxSVT+EmY~rDUl7<rv%8-6b@y)
zJ4(4W0c0sW>gtk~lk>-6;~XVbf726d8t+vg3ugF^gCo(c0dpYdKj#G)OWxht*@uTM
zse^pTF;hV@i-?8~QF;fN8)ESDhI0YDg@rG(u3opU6J$qyBWSx{xc35}GlV#<Rl`8*
zc(&6<OJYEn9BQTew6Sp%@#0&9k!QWbwM$J$r`l_zRUrQ%rqHE6{Dzc!kadtDE@#=C
zWAbJ~qBJY5Wf?K?=wTFL7IaczZ#ASFHt3XMF+mt3#-~^z{|%%GSOHiKGKZs5^w=;$
zj1<qjyd`!n(}^naxTqT(Ctk7$8U&1%+_ekthj3QtYDpm{W#4(cXL?60q`1&@)ngmp
zkg=M$bsiRLAw@Ud;Yw&;QIJi89l@rELKkZY1OU||rz+VoD+f{r+*E7UuYYC`Pc%DP
ze#ymPie~CM^?`FJj3EYY!<_+A8!_u>gzju(rwWoh#0rhQmmTPb;K<QYC#7fTN&o36
zkn_AG#1Z0-hUpq5$R<C3`t;OG8jZK5i@OT7Cnu+igToJeJaNkv#J#IQBh<tcU0_~r
ziuF3;hdo$*)FQSOjKjizeAR?WE&XideXfa_Wj>F@7;3oi&#}_Sx1kZ)y+O<pv>QRV
zL*3T~s7U_ZOAm0Mwive(ZYFl}UGe9#{|A58sG;x!g2Cwk1qFurHn|$H7ewseBJDmv
zv>7^tn|CNZzylx&?WA*;c-ji8Z9t|$mr-PD-q}M=dctA{dJ~)CA~@a-w?Qyt*RHir
z=%eV&MS4k24(W0SLVzuPSAI&bJ#-RCwahuWHU30cw0ylmp=E#E)tjc;5pE9+^_{y@
zy%N1VJbn(}y#h-4+xPD=dGzZ^pH&5tKh)4N!8Q{Ar)LL}g#&g1@Q$**HhcG;K_mq#
zW=aZ<2|I`L18sf%>*sUHL3McC0>_IxWh`0l-TWAOX7gBD{3N=9NW?^l$PeU>fZw@_
zxr?~KfNK@+i-S1$Y~)TKOk~u5s&c^ESU4J*QF5Y0mJ!^55f?9_OhpNZ6NlziBCsHT
zBjQf*z92sEm>OCwaxMNi09_^oknu}jP-<Ye8A*qHPE+#*C<job2w))f00RTf;DI6k
zgfVEpVIiD54Vd$(>Q)8uAZSj%6DJUV@fpjE6aQ%_cri{3u6dpOou_7;GYv=vGVNQ5
zPI0%mvff6cye!iKlQ_TvR@UZhV-Yl5>p8lh62+;}<pajUSfGHfgCTP_N79hD3R=ry
z&6?}@)cuf0@bW72tOhqJVscMWINCR32*n%tAQ=RShA6SHTtT&Ls8t;MC9Y(b0N3)Y
zw<mEh5cgn@K)@_|o(vRlTWrcJH|<7(!)+@BxgrwF(lR%fB|_K@0&KE@fjA3H@&FDx
z+BBQ=F;q7@K5_KT>t<34Pr)6O9tbHw4{&vSJg2`T0uqpQufK_@M$dBb_St)ns4he$
zG8)?s0b$TnU{N_({0Ql#NP_`x*vP>FDLD!N@IQRv-)3g8w7WgH{Tp5jq@K#p@5TT+
zX(QxUDg^w#m7LMjV}VaD>pP*##(TX1_oHThTZt)@OXMmt^$`{dArX;uK7L-_`o2CZ
z{}Al!An(v?CU*>gX0+D~D}$A?)8D$7es46~C9pOEoEdxoBvA$bRy~LGf9DK;w33MS
z`t>%D$)x-kBf%hrCa2v(ZjSc`l!su0)9K`3T^Ol>0Q>{ju#~@273(Bhblj{XXE&2U
z@jks97#ovgS~xm3hTbJ0>3pk6W-g0{;94kuT0^@KGW!NvtT}IJL1Q;5x%i&VI&8i#
z+$2mf^C>D_REP%e)N{aA3sO?Rhc0{tJIXn^ee{(=cQ~2sf~^ENI^*S&M##P50xWcO
zZJeD?V}VDNKICG)%iO@g?$DvVvrJ+2gXkdpog`V56qJBkA#BRIX2nkUQPgy#-YY9w
zcX~9-?Daj*T{=6yghEU*cd6*D9ePL@8YALjD!4ZPA9Bzq$$X=jMQMrAC*4{G#TEtz
z`{}X51awC`n7bVCy_~h&u=qH@zVhW1zENxtqlZ)1DhL*sJhX4xIJ65FC-0qniiB)1
zM8WFy1-VXiCCX3LF#?42GaL<qD8a`o=*C@%ehrJx>DdTOB}(iDwRnZ~+kcRZ24j{A
zBkkFsAOh`Ce6g^w=<B!Pk=3q_8+>&KvpPWlVw2hFK2QS<ogBve^-e>#wN3LDCIGSw
zIWbTw{ie4BBi%eRe-iT$u}VOz3yEo|j9FIJ&0RSba>{|%boo;H=_xz{0>{9XKwrwU
z8ghhmuk)ueL0X3dG?OH5<tdO`d;ux9JMIl(L&U^IX<6B02VK_rULF+H?Rbg!;Si;y
z!S_Dy?z+`$ihdpHdi$1NA>hX(Wu!g*?!th<XIiuF!{*lyQb`=G^P(aW7m*6Pq!As>
z(7Q`d*|u#PJVn?7rV6)Qy};^;S$AkO8F6e}@Ac8z`ix@YiA~r5Hg1Gk;ufZ^fwhHP
z6EnJunn=kiribaaCB`zMjE5N#O%)V|I4|F^>{b_f4yCsj<){s1#TusmM-bm~`g>mK
zXDoquATj2!!IG1+S338#-X<(C4X<8BH`sw7_Il$tIdEoh2i_Ax*EtWA_Mb-oT_U=Y
zh4QVle_1Z1<CU0EsIJ}^yX)96-{+B$4dBVVM-6hT*K!OG-5xa>&ZP}<-Tt4|p4d_D
zCcqhzAmP{w;}iScOJKMF>4I4y41pm?yV@1xEJ~Jr`_2J(z(u0So%m&w@&6_WMG1br
zZ@<=1qfVxi>Gj4AiR^IAZP%X<tq!ZJsTqL$1eT4_W>P8J*C)Sw_X#*yAuV82Mg_pm
z#+Kn!cvm+4?)Yw5S&aNpK5ziU!o&ObJ*P)I!nIIwqsC#N;3&!AoJ;2gAo3Kb4_r}n
zS~1eh0eo+4pbS<5Cm+>y08PhH(xXQ+#eTDTap9DS$t|$5Iy%M|lc`x!m$am0T(vN!
zyvAcSyLWFA$QSa4$(fldJdN7g%=6ApPH;|U8}RRfOy%1*tiQ>!46qDiRGpxZ5Dhi8
z%-3YpK`@ix&caTK-kuyt^~_AiY<nDT>cJgylUXVc*vW`)00T4&02NWmdtq|~?7_O$
zVca*G>0|yn#dEr;<atXA#B3gTM1a^(zWG6>BvVwrF}CzH`gG9DDJUoa_gBx4yM<TP
z_;@>f@+#s~dWJd*%OeUje}8{cBQZv*nf_Hf7oUA#UU(j`9mX^qH=eclsHh_@F1bJD
z+dr@#tln3_{BE@w1HkW!6>A3GA61y6J)^_;)^_wwbNXR%l%%*;;LkPJQ8U3uR#;q&
zI$75u=#4+mYBevfDXh>Hze0*YcI-o8PAZMi<}#D(Xl^FckkCcN%Dn-#1r&j&ehRJ|
zX)D)WV|lWAs)R&|Cz?7tr6eS7jPMh?U)0svA>ImwXfMK;^z^Rwk<u1G_km*U^=TSJ
zGo4qNT?M1f`n+7byGXRgYvaGna?8+uv_E_p8wRsV4Fd(@oKLUmcL$wk73kvIvj+fU
z2;xSU1a)m~tE$uG-%^K&_4`XR|JDKkWjcdbRsk2cE%@|whcPI$#^+#w0PxrZNDz9D
z&X$)$4PGPz4CXAv+_NF_1u@-ss*ouPnm?jhzE1rnHU##c$3jz+v#$j(;+sK+&_!gq
zgz{D(-k1n#!qI5798z1nkcVP~u-RFsK6B8^q*Wm~8_1h@!&GpsW4KBU?MQr`{qr+o
zb?QcUA8d!91z#Y4@pH~lgZPARR`((UjEURtWNW*$Thzk-dd;n86l=UzCayYt@bdvZ
zwl>~jw##a$e9lA1hOg$ci=4Ed%tclN`FzdoXFkf*7mF)~bZPkZFxIhYNoKc%-6fQD
ze8{>TK$!4}k#yO(G?$<W&te2hF+~n67_{WP;GmDgCS89^?3U_;9ZY9wf;Rs7>lB`^
zKY!K6$@1}$oG&wU8v>Jx&LZFShV=r>#2Z?2_BL`RQ&XWZ^(_Alga}fh@o!n1Smh%)
z%O88C5;c49a`;KOLfsyIRdI0{$J+M{RVHwv^`CASwz2csw1m%6?d%O_l?I~iF&YR(
zxQ<vYtFj(EU%{Yi)>rv+VwUq#NYN-{WN6642$gG5eo&154zlHc&A7n#gN&}U6|_VN
z`D#JYCXf*0!N!oby?d!BACRX6DI71w4(3hN)ixC}gv|=F$~+N<Esa-P{91Ab-gb==
zP%{Yxp=+v!%Z8Mr2%a_hxf(4?)bY_D$D*U67-#|Q)O#Psov$!qClt|ntqz!n%1oP-
z4nPWvauzTHR@<dtT?e9Y9p45tO3+Qp&lhR)o)1BluCC7bUdyq7iLj~06G)DL+!72*
z3d5{{83U(U4rs1hMtnYdQo!82%$?%j#7e2d11c-bf!y{-9ngbFV~cz9@Z|A;0C@_}
zmMxE-JUKrSP6Sy((HslLsUZPKFKG|I&{b7TBV5JGD(d`3R7d9(YLMpV&>29zjhH%E
z_TWV6axGjP#)Bo1KMK)jV6^sayAGxkVf|C%-BK8IfI+I`+wcehfMRLokZ@>*2?UK`
zdP>AvA#$*wvvUr-Lu6@4$%^%JG>nysii`V<F(y#t+tdVM^DTKGL=0B~?T}uuU{)HM
zb5JITS~3&&*q5;>>$O8X3iZZ~=!<{))KiBGO!mN~`|X=&crtEx*dRxSAT37MDkDE1
z3I1VAf))IV;d9%9H(gynL0L>)0SAGJ3;X~s&d$iT!zKVNisQ5=mbCxsavB-x>+3@`
zXjqh!wL>ebH6`=Eq3@oFl08q`zpM%f-23!{C#gk8Y~3wkTE%rgd@hgA{Zh{P9RVI0
za@nc*HWr27&HP5&czIi{fO1Aq%#kCw)6=<{pO3h`bdmatW}S1I9UQcsdkV8clJ1H3
zPgaiR7aZ(@Y!+&j;iru!wGH(*8l|e~BQp>cEO1p$W~N@T5FTPKU^dKl^@o9g6p>?F
zBRibzR9+%g@rNHQ1bDa{Ifm5%L1&3vvtylZc=j7#%>YOSD86E_FgBhAoJ`W)ZBs+|
zm7^DtbrWo}ssf*&AT;`o*1q;mPU?YlvEN9J6<yi%qhZ<k`A|5xcS{=XI$~>^e8^D5
z#R)22aGa!<75_u)8s63o7&y`TnovxDyb|5HljsLyL7uu+R#t}f9tvF{q}1V{U)-c4
z1kads#V(b6ZKwV5$j;6A#b|D0V`L!DR@Q5S)73GmJX?bC3$<{yb~K`N!>x?!11%eL
zG(oTI@%%tPf8$K;qUEaWtjyoPPm@<}hmtBhKKO!e0T>I_7w!OfHE)zIBmAdPMYz1V
z_l}fWh<uruowa^=LX5(LZYV^N@MS6=JlF~*CtA=H9KmC+0-{Eg=UkpAc%tcPElo|H
zU@*@)*3}ECx6u>$yER>g;U;KJn;k!1_)P{hv2e5o&uZM$D4F?n>>ZCCL%EV&wPR&A
zZYxxOux$Y%;^?qTol&%bci73CXx{m^{Kp331emg19UU2%nX52-6sr|!3<Z^l?yq&F
z->yA-;#fU#^5J5K1TQ5mtwbh@iqQF+oOP=Ge?!iu(B&BJ0%aU40W`qM#pQ-WK60cO
z<5!TX0G)VA?^<H&oaVM}XiMRigv|g7Ka6hQykUbW@LEjFPq=jj@<(73h>e9G_91Fc
zlpv%b1y4R^+<<=9zZgYB==`B^=iP4TS)?-%@rnmd_AYJ~o32QV25S3Dnb%gzBO@&h
zu;>QliC|KZUZZW-IWgK0*AA6^Fe|_nX2U}>)ZW)u)jhU+Sn{;&Q=g&v*6uAv)DBd(
zyzW@DJ3-i7-XyJLtvE71&WS4J@Drx3cQ0E8iu_+xie}!&soj_LzeGUaQfJem-G7I!
zxiou_DPA2fOg1;&BV3>4JP^-fu37#s-wc_!yIJ@F?ZjZW^x8jN)-&_BIB!8gTBH2W
zAG^1<``ae`81uV-{#eMHJ#!bI3!hnog+)1s)@E6qx($0?u%slNHSwtWxF85O0jvQU
z?j9FnTpmvmjQ@N&v|_JqShrJbSPJU^A{@z1EBdwXpIL0ErIR1{$9wFZostb0v9?$)
z{LjNf6Znt#v&QnDFE~sj>|7goP2wIS&VgA(6w&N`A*xwRbc<%&7mq+2%3p7Tc5@N)
z-YlVD=jILgRxzu<&%(m82)EE(4$Pzr`Ch)?=_($=>%7}16KD(ux(}_4eO!<f7<p5M
z@h3+G3tk+k67wf$3$Ec~o1FXT?mWEa;<(SUytP3SHKoU$JNrc-aGV^!x4h}yn`V{^
z``?~*V18R)N}djpzrOtsedOCm|Necx51V@xokIV7*lSp@m)?L?iDz{~FvA)M2*8yr
zqppR#8eKjH3Thf`WitMAMT*?(F|!3LGW?adgxB6JVyfA-yxDQ-{CuPCXFk@v>GDb?
z*e)@LgY<NR*hO=37QR1>aa^SYi+5`35Lq3Ync2ULgA3+XR8+l9JiXKlrNmI}rR(wU
zhXeM0t&rJ%dgw|@?%yY$m;8JftPy6KyzencB^=7kkFSTx_-o?}NhUKjLv+m)9FEWY
z{6>fT^#ox*MXvHBv!<kq4P8ww4DycTt&Lq>F=WC+^7Ab4HUCR9`yy;ekXym!P~|u6
zgh9heN$(&kI*l6T^l5ajv7W^Uvj%mebFat(L0m?8`A;x(Q&+H2O)2$0toR=mg)l3z
zo0H$ZscUHo2@6|c2r_yM$d?6zm4jytG81I!ilPT+e26uU=ErLW7ThO$>A^anr;f5}
zOE5|rglvrAq{8M8>(ORWn;JAuafXMF1_EtO2rpl!>$wWglp&s<dhXqX;xBYy(PA1#
zlM$n6(0)Mbv#Wpk|D@)8c0+JG8{?;@+rC((0NT(80(O;@mhM8Ghe@sw4{I9J)$Cxq
zw^@D%siu984PaPMDR3>erm1B&G&@s|Y&~!p75dTcr&$;3$=s=Ix6tC@=fY5U?F~$u
z3Zy4>@SV$;a2J$}eOXsY>M(1wSMZ_hjT0S{r*y!*i&rrnR5szI`9E~*Q}T`9BRBak
zd1T|0C)+3#WK%d`><oB0ToSZnw_F9clLa1aWRx&rM7KauKkh-0xU}?1RDQS{kcezn
z;=Do5<0E?VJgdWO<DtiaR126R!z_W79Al4|W5+l0LKwh%Nvcm&N-7Y=Rv;#dm2@}S
zK|scbE(wZ}<#cpy*WVPb#OWV~c@WrpV1nreDr`hcWB7X$*ym@@ATbu8*g@k>GDiXP
zGL_mG#ACqk4RWYB;6QgeP`{A0bUDJSQMp37lmRVN@i-bO-@ktsv97W(GaDTlfezcQ
z+#;`jHc$E1_-aM{w-qneRIuP;gme|sv0w)R;9y&~Zs&Z1?~}hF6&4sg4d}5Cd0tiZ
zBK5Ol$2^~3{x)Y@@WXm>E_!eWNMwW%3%F_MXyw1T4#q+$X%emTw<qrQ=9QK0#;ms%
z1rX(NadALVPrWP?{ihDR@M5oMo1T5%7kD4cRRkocm@lpKYPq$wH93aZ?<XXJ>o#w$
zLOum{a9BSzW5ku`mt=2)!^0UTz%3=-ioIh5291>-E^9Uo1Y-b|0|oR&&8{F`Ji<*J
z>NuugpsOPmp{u3U1heV8fq|MZjWJXxxK6lbQ2s-}VU%Z~Hs8eogby|}4lWq<Cm;)G
zwf4)jpTAt9L!Tt_+F%c|8ua^&cvi1c!c=PaSskE@4N|UgGkyN0i6VL4K0XT=>xI%{
zIN}&C&@XrsVX#fhrXi(eM2&{~RI3b-TJ&??)nTx;fE17VQZ6PTaq+?hRc-ABykB47
z;(T;of6EL51?(U`xF1R=G(iA00cCQ2=b+aD^o&eojVtHDji7N|;G^R?J7`A4qqB#v
z1Ek)Xt<+uuNxIMyY{Kwk4B!G=(RcC_=g?77bqT5gN%iEk?${i>6&Zlx{!R&Rgxd!Q
z(iBq8w|jQ&LJtjdMxfjUtAcO0SZ{jD|1dV5El~hECwxuD4{WL_{lc?sfcEs&qJYPp
z4`|-?_xD4b>1Pg=J-JoYPyo)ro**V0;Bcv4fjvLRq=4Gew1=FI2CXF?_U1Nszf-4R
zQ9%Qd=3MWdy3*?E3sDbiN*`|wiilJ$V_u{vnxFplE5al*0hufitW?<4Qlm5ft@BEG
zhdxomzg~K1i^VG<i`&S@3vVt7?PDuS85ofZF`XGdb`oy}#tQx0-?P<=P4J5)Qrj{b
z5A+kdECu)P0_xmvft(1#{SF^Gq-SD+k}K)QEdWhUPI!y6(3ssCr5+=^hG?%%<iGtc
zd08{9?U4he^|bq(d7$h(=!lyO&E}}+?c2A*3(@jQ++ZW&5PrANa#ZStB13a-vw6e8
zMo!RnH-jV5d`Ze)9rQr7uTjt<hKLX9YrO0lVbWj)S%x&!7bx+8q8TVtG?@l|FoeKL
z5u~kD)*?siH!M;2*UyGCYs_`aVtWNclE~%WmFhY`tv<ZvuYY#(3QZk60J>y&!-qQ)
zLG8?M&zf|#xU3Q|y)<!8LQIT8ZU>3ks})5K-7qqDzeMG*j{H2zId-zjOWe&A#}++f
z?$~{3$$uU$xe(<HLEdU5yjKm~`kHY*cqw}6{+u|^pe;t?mh{9hbL%y~XZ?vZ7os?O
zjS`2#i4zwU(l<A6xHw)ClD$mvD64>Mg%I>{uO~mX)5x6XR^In)Ip;p|<rg^sd!7>&
zH2vCgHT3c<zXq=nHnjaO$4T&5Q>xD*8lkWu;+5LQH$iTnX7V2PgQWnEk;r~pcADTA
zUXt3KS^2}q^$S@}q8nTl?-wLDB@!^=Yq8w*U3WPr2_%2`j8c`fT&cBPV49#Yo*eJF
zOlsfAmpJAj7Bg~S+w#h~(&MruN}L>TrxAP_<zY9^fl>31|K+=JH6NRwL=CLi^YmZ7
zx#>{}#a@`XjmGWkzr5-?vD=^C+;pXqsQs58?MeMhikI=PFJO^=J0o-j-<dId20Xzw
z%kTjd6}<XuB!m-b=K<qRb@u0<nF)V)3-iu#D{Fk8hO3#DdM}b4T&=YCS>`YjKVH<-
zaP#o+fJuhh0hWaG=g(vFm_+*=xj$N3F0QT<4(I-^mi}*M2|IP7@@ce*binTuXRhH9
zf)@MN+?=>&r!`qJrKE^jE+Zx{L)4CC4s*&dw-C2ro<+Gh?pw6>F~U0!F;&;s!Z~!A
zQx;?XwrR(mKpqIH3?$cM*}&wEo*OhZT(GA8M=_o|i?KWMlZIWf_rZG&1_fa(zQ>OX
z@bO)Uh*%T0AGQa$D6&d`@ibIbS;O{YZ>T;sn}@+^DCc2TL8_a(J~Poj$!7!tG4^*R
zuukLM*8dp0hNQRMyWgPo)6p>v7sR-v!2f8~$4>Fq6{Zl7D!S-cpkECq@Wso%|B1k9
zy_W^X1}9;rxYLS5%(f1JN3E{Kz{sFq?k%+#;&&cp_BWNIqyQnI&kUsY;sxB8hhVTU
z(%1PfLcT0}3UMz%moE-ZL;%{$Tnh5Ao}j{?>y-WjtQwD5L7@y53)&_S7hoSj&H&9k
zZ)$>cs$NT)c&IY+;QxhYZ&BgYEN5qX$0F75V9Gv~M=CRXDjq?D)KQc&_km<@eT|lb
z{Dyk%uTAIKjX6`j4X8ZMZDB6Da^WtYlX8KM9u>uT?_PVw$gBNao!e6tm4YH^zn!d}
z^V=mYJ=^o8vRpa<f1b)L1ry`t>nkECi1Gk1DmORR1*v0&9dK$0%gI&3p@FU}mQ;Mk
zyN%FU;Bq&*#2D*St6;E)ic1R`on((rrYYGQl>Ou+AILgk;XClr;aX>Y!&Cw!4cHwy
zvI_xBa3I*(O@?pZwaZXXk9^%t%%M&8=&)RP{I1CCO`%%D7y6WDAX+q%V8+$q{D9Ru
z49d{(@MIY-r3;ua3ed`>5Fj|AN)@d0c5ddSTRvNA6#hMS5s3oD_KsvhliAsR!4h!F
z&rfFhEdP~DmxiKh=Fu;19|Liw1Q@_PT~bwLrK~)J6s5u6vboNq$W)A#@#deda5QVk
z-cfsZ?p-KXnHxSX8A)Q_g2QH2LefHJDY(VpNb~{pA4j6=qQ&unoh73Fpsp?kry7`=
zZYcH44w1Wk<M(AnCkS@1HKui~=ZV+0F0@}+YEBHFOv!co@_R<TMQswyiNY@~^sns`
z!2IcnfRv)Apx^)!0B(ZS%b*;=Gx;}HGBIVW16ab)Qruz<cHnTZWga;)gucD~Gz4sM
z5Mly_Xlj-qIMu+Q{l1o!7Q^PKs;YptPP|xCGJX%f+4tH3WC9T*{EpC`WR$u*Ic#t5
zgH9tdV!#Js&8x4gV^uN}q79mOj`=fS$KdIxUYHXg2Ppxm<8n{DDR}(snQBi9RZvP~
za<?4VR#-t8t@=UuW@Uvp*=J{DuqwfGbh0C5;`@GjG@U5Hbx)t-fWK#<9sS|myH%W=
zatQL+uptJ@vUs^uH|JDUJ|+kz80&*PqgGMAbj;HlR86sI5qtw!R`ChiT@MwQ7#u>u
z=<hEVQ7<kf<+gLP(gpB3p`i!Roq}@#&1}FoJdEZ-AK3W`uN63jV4blp<3@w^fX#O|
z!R?XaP;|c%mJv|2=gyv`r=Y_I1n7Ev6{MnQB4Qqke)>gVTg?58?frGB$zDoQ5=~pI
zsSmOCjWh}3cwo@~DaCuj0Bj$SDT-!#X6Bc#UL}YfRw-meCkpfv*?-4jqa^@QHjw1h
z^fZ<R2ypL16oxyHIrRF?n@^zPt;e5hVZG4ThmR^THy5*h@t~Lsu{r0{1nobyxFAO%
zSK^*CM37w=VwWyn+;7(K3Y9$Ce!yt57-)kgI^%s+RKd7&U;sfR51wE6<$b*(ZSCzb
zV)p|Wy@3HTjszRcaRoED3B0@{&eg&$|Gw=;kRIHr#$c<NmcNHM8P_Y9Iq{CHuQuWu
z8ymBr$U)_ZZO-5)q;ZI3+q7vD%2Q}1m3v()J5FGKg77vGEzhK+0w7yZ_R#E>n(;mB
zqahd$q(-&dQIIOR1e$gBJS;d0@izlKJ;G(ql+j#W+d2~@5@`m<p60efXgAs)*HQUN
zI*xVA7FM?3Ur$cj*jwzk8t(jaP;z{%YI^o85&>fqJ6iI7L3r;QT7>o%ZO7=+vvkzX
zZV!|xey2Xa5d&x+m8pg~k^H9LR7PT=%|Oi=><A7>Ytqob?9_)q{dig<>gN!-rCd!R
zn%N_bW;9XfKi=R@4DVqMJ&tTW)JUT)T3Ra|uNh&Q3OdR-RDZNU@n~!%vE3$UVGyy$
z6Z~Ol2zw~!o)fx|Lc^*FZw!JWNR{}*hkHUFpPZX=#0`OR1yz%9+9eu-vd;`Hw>_W}
zpu)rNO``rtsaKl>+3>cjD<m{j#Ij-vH#O=5SXDr?AhmC!<EMF7szkcT<X@<|6;Gjs
zgC4XC<c;_dl&)F_1V~W~noyYY3`PXwT+pW3ucAT*5W+s__vY}aFTMib$hUv&0A1YV
zcL>h##F9-R;PRdpb>`4Q2-20FfsDjrP7n8#JRnE8&v<NUsZ_Deg9%@Os&N`3X)k&7
zzd>W4h9WyS61`_nkuKb!khtuHYU}s>e5Ml+!>boBypY-V;kr)QbH;#b^8)9M1pT@R
za|UkORv)*Wk&++|AlG8Jqyqo$V^p%B7Qo|zMkc9nkEh$DH(dsMgL4C}V|$+iRj~5g
zIiH?VT=t5%%*+uK-D9Jpu6+;H=z+cbamLYgK+J2IHyoMMAbs$uB81clR;i0d)bwYH
z=9O0*9LAD=zqoiD5+W=exFo1NFi~y4<yS5Gme;RuUcZhJ-7yl5*G{~rW!*yFj0$F9
zMXMF*Q*y_sMkJtOL`sR+`iq#50#X58nK0QcL3z9`{<7L<ky?Bq$Eq@x^`M!VI(-+Y
z=d#CCMA*5d`&9hUqhMf}RZ8T9w1ENc33ozqkej^8&ony}p}}Zs+J)*qLUt_?xnIJA
zj%Yrv+Wnh@h?GPv3E^r{*<Du77rD+~{yZ572#>seXVb%9*Gj5yCO)VUW8juUoQxcd
z;T{L5u4!xcpf!w`+F41A3_nXA0YS*@*s|rUjq8#ml73k$*(@elsZ*BZkleJYP$J_O
z=p%7=p>fK(bZmGVMe<@}ifhoH7YQaD|GWUzzr4Vt2pS-$wMmRvMne?<+z8*t2B!0s
zmHz0+;Hzva?peIj;tVwJXqI<jBW-A4Xh>z10}KY;0&f+(&sah6as8paSyaZ#1uSbe
z&j-IF7B(;(6bfQQPe7h=_CTvsAwUT%2CE-lWzL}{{Py5;Oo~9?097F{3fLQOPtT3$
zpn{gK=QJqwg-!y(eyD%oWr0Z9m;4EDZ@JSy+(S9+3QRP&>BFhbiiH37pFVZo*S55b
z56Yc~3GhpQHPXpWguY)TT)UNyXm~^w7V5^hKOeaP>cW|iU)9!9BqeYD+HtwT$I;mt
z?OsceRr!oqkiFsrME=$Sz&0TzCf3s2j2ULH8XE`QcVpGX2gb)n!vJb(SF=T|C1ijR
zlmN&aM)@TnVE|2!{6?$~C|8mE8>4Bze}5es*<k0eG~gKpr_zw!1*jT;b-aBLd?5Ng
z#U&*q@d!nA?e<5&Dr3XLal1XvW)(u&1N%98S@Ku)vrRBc?oSYo{n4W&*=4jf5ISc7
zESwe?j}edad!ko1%M1hj5Qd4jG&C>(NW{r_CV&;P&GY+7cBR{R)RgICWPNenSM6{d
z8<VN7JXlm%A>t^Tv)6M{UD!jj<T=&?gluizGhlcKLU6R>A$o-P2OKB<3+3;C`))LB
zu^qd3U&Zt3ht_xd7}9g3v;>3%1!1Uedgl&m7xx%K<s06)zj2-cxtbv(gaK*A^N6q8
zCqy!*P_TLKj>Cz=BC@awUCFG>OsJXQeIP9=iHSj-{AG|}I|H}o4q~|h<%(syY0D?~
z-58^Z2pebxQ1*b-yS3+}xS>2khTw=n?S+@ZwuhJ;t9Qi}KOfF86froaN+_D`U{3+(
zU+Z1Vz;vf<UC3@3nZaAm(NIOQDuK7pC<X1)InRat{`T$esWzN<cJ?SBs))9hA~I4k
z#j4OmaM`jDNM3Qb;Jz^}gig{+W*&;P_Cc&Isf|dVpr_z$o!;`neK&%n=dhT<I1Q=h
ziQME&=sp*rzR@}cdrFz<2Oy~6NQ7&Sx_EkuQ$9eOhnEYEgcUVy<u}Isj;2q=I*D4U
z0;zjHm99IE$GrlN&{_%)0+#*8CMFiJo+cp94-ZUmBudDQm+&+`ApvI^PBR2kc(Ou`
zkJ{KMR*LT2DGU89Mpc1hg9r{qp;;~$pdENm+%9P?tCjx7v%j}mlsKCrgB6tpFj~+m
zh?AuJ<D;WH1(6YLfw&f2t<l_&kY$GGKOnyPK;_UNyH)mWkpX$Cpvza+_(EP{8Yj$A
zVprHjM(~4A$5{dN02qO)`t#_h`rVcahf8t?A?*bce)RY;I=^c4NKj~RYdb8uzC9fZ
zz2L|nKTbf}VZWmBnb!xA#kBs*{}Djm-gOF7%dzvzulyE<3ep2H6X?~S#LfoO7E*F(
z!_ZBx92p~3_YpnMo@G>3$%}}*BAqIaYzs0T0lDKsuZ=*nQCRgvu4_Pc$m!%|MC~Cg
zpJui8g}$HP9I~}VNXc7dIXD>&Ve>>raXqKm?7q7#0pP5GAahL$$m~JjS?usVx1|tQ
zqLU!s+ueOzCI-EPjjL9{>ZL>9(%Gq_r8Pe32VEty?~XY+A;-F?xY$u*qxaB>Hv4|O
zHoU}ezkYQL)d>bFft+gv3yT6Q643E$#OJ#1{03(PXiuOSS~|K<pFX|1C3e?z8JGk}
zr$IRYz&wOPm7CiJMjqJ8@g(4EAgvs39O2N%2-t%B;o+lW-rrA-uOWt0fR#}oEG@;V
zd=Jh(c<>9W(AAh2X`jy~GV$`zN#Jh8ldYeC2ugEPQ(S(;utRJ0q^?f)y$_<Y5Q=Os
zx*p8|P7{*w13Ql2z~Q0Q>H}pZ3LpC>t8&l!h6Xid<&Z%AT$K}8^{}3U+nkx`?QUuD
zfX^475U=aB^ILw^Tw{NKLaogvSs%e|+tP;kwo*P|jRO%5T^$-9ovp28CR8Jd=JDd7
zyVKGnaU2jo{Qa~OUe}gXecN-#v=h$U(_O3?xPA6!#o!xyMn<zzS58VD-W2f!JuAE_
z{3^LID{V7Q($|@pwOtz#5DM0OEmC~%?>egs4VxcY#DDMThgWfuD<%ndZ<%9n92^__
z1+)tkSQ4wN#Bvzg+js9M6MRHs=+fSqoR;P@(#nese#?Dmc0ED~LXM8yhFRmmcZSK*
z62tsuc9;i&0T=&io5uJ5f9&&n)@&kVE~wlk--n3gUIOUA2Q|QwMI51zSNYO&Z-%@R
zSC?hQ3iF323d#=u1O24J#ZP~7aiJ3EfM^i^8<WsN<-Q+)LvaO+s<h;ir08y7W~#5h
zbwZI)TuoW30p9WKCMM4;fvAucX!d9vQ+cv7GH~+oUx&^E1YwzkdlZ|nU$1i!#K?ES
zRU9ttvR%PU@GuB>UEPnm<RP-;ko*8ofB)yZNLvR5^bX4>ITl32ncz0WR*XQNen@oh
z+{w$$?e!|Uj}$XF<qSelI7P@FBv=(L8mT9<3mCB~p=t(LcwO``IoTE)XAdI|LCe}Y
z5D`?^qhMmB`8n$_1PqQ>MW_lQ3%7mbqf!*-&b_f8UJrbM?1$@A>p9X7bP;Xu&!5&z
zD2{#x>!__g0lgy(PlJ6npha{8hw@AdmtXlxOE9*oGZZ_vZTt3xN@GHocX|~O<RBXJ
z0v1(Z0e?t|d#(>a=7Mf-2&z-uv1K&0gxZ;+gG$Al?$zn?5*MCB`jdz%Zo`HK+X8wD
zkPU`YuA|r?tqR)e!OJ*b%T~Uci84WcwTF*STH8o_Q0n>fDr#yCfTmZCsMmRaTUBk#
zdWLk|FI(32<_$FP&PZ?ulw(@HRaVv<OIA-3l^46?*kRe~N>u^gSQt=2C6&3s7=me!
zLRIdHgR17ybhZXoR*;dHT3Be3)3*^555MI+png5)I>mL@O5{tvcSl?wSbZs01rf-q
zmi}R;Q3SUzw(NfYSx!o@cDk{F0UsY9f@7oxnHdS56|L%FDorU+A>pew2dG~Jt2i1@
zNMS@>gWw*Fj_^1@OI%y#n40qbvaT&0QFY|>5&-(8k-IsN>GixLg6e8}8eMD1p7dGM
zsOD=$O~0rL-n;LH<bEgmNS80K^%W#6wcpOY0r|Aa^>DZ4!0l_NTid3Cyle{*;hGQt
zl^-Hnz)F(V;Pke7PBt%&-dXE{iS^}W3v#0Yrx+D&!xoMTx&*47E5pr!z9g5lXUfQ$
zBO_iFSFT)1NJu~@aQ)$P6UnmMj`kWqU9e<*wDNq$;=I*&!_eDAP*^w}L#z657>v<@
zkh_zOyN-@kN<h(tw)Kok&%lAbCz~6%s6dujEmL8lxpjD1!}$eu37NtKTuD{hl&I#%
z5|WZwcsId`ipEMXD_EI77PtUp`Si$u!2k%6gUunz19Cerz(4>*&<tzLd$?<xt;5cj
zwKih8M|q*h7ipw)Wv^Bu1~#}sF-X~uwfp(=W4N=hW#qmFzetMYV27~4?M|j#&3^q_
zTcqK@FdyY`K_EBfrm`8zLREnzx?#<;Z~E-mQds8%TCnOhk5h7kUA0Wo3ztcIGap=m
zpGRdfJcIZ1ZTB|iPP0_f7|!2M<H)O63Pzw}T}xcy6TC3vzy2U)&VZ#&_{>>+e5^KJ
zr&I;@ehZtelSs3q{^z^UhVeT7+>~aiE;MDFjP)k58&&#h)oZWh55G-iQwrqWh!Uwn
zE+vXvuR^1BTSJ%#J?FptHbV=ij+n+<N5A1M|8hKa*+=c{d&RaduT836y%HN^@8(u@
z*62IFo68@>)rQWHFFU9ua75-_O3_ar&Gs)zBK4fgPvydzEQeML*&OMAx2p7Iinrq)
zCB3;czvRK%aNk{=8P!K#ekpzVaI|rl*pJ~7?zk+#IEd%aQd7gZ#l+{vmoNKZU7T$~
zye*`qkS2j5z&Kk`1bY;i0D12c6Z<+l3nTU_UoWEO%4A#Pmo%&Rj1%`p0@X^t1y`-j
zbNl@2=^fRP3N%U!jhH4B4(4kZx2T==p$^^0oL^P#{$6xdC{M#$*Y!T1AJ9#6ZLH^{
zSEK_=f@v<#P^Mu+#Qy=VCks5lH5(h7D;rudMg%>=lh_17|ANvJ;O9pGiH*Izr1xk$
zI{Fu6We5k$=!-_$znp4@#JMH{CAF7Z7OYiL^^fNhKPR?R=;AN2y5bpaKfj%&6Z;<9
zJk6V9tl0W}Z!DAL(2ooz4?5~*dC+ZG2tAG;=McAhhGiJ_AjXhfi;RRsw+thiH%n9L
zsi@c^IT9@bAS=r<_oSSh&)@_Qx`qxqAS5EH>N&Z+XwW(Zh2(I%1B@c9i&$P9-P}aZ
zX82_ZkDRx&JL0#aQ4)bAIWwGV-xap?9m!*-*j<^;m6DFy+nL_*to3y0fj7H3?l1hx
ztN2Fq&i&@ZW*0g2E35~NrWSN-=Br&lt=ic1vgz5;^mAF~sVQ~7C+c*i-rrE@zfqZ+
zmzR;vmnmJc@NR@F!Q`z&ps(NQwy3J3ogprMQv>R+PtAk|Y@PZ&bEQShDAjDeWDAeb
zR~NNIyDq8xX1>TdkQg|m`)xXMUG>6<nvnS|!>=b7+YX6*8jH;cklp4qcr9R!!k13x
z@d!y~uH7Xp`P}AtXZg8ywhcO3SdG4yTAt9{8S)@i{^Tj!vBN&5xz8=K^Jgz5wY=s0
znH2QP^p(bm@!;U+F(tz14GL%Pno{}|_T1cag>`k+^sBbTS)Qq()BZb)+n>61mRpCN
zo-fadgZF=TwNvG<s1LzPa{3)ZwU-S(j5B6-eXYr6&X+tH70qV!<=5!T2)d9_v+#tx
z4Xq#7HD$|F?4Ip@94rv?GQq#KYAc7Lre7az;|vI#l`Jg%<;S=08vlkBi_CPre`Ez7
z-E-L5KlfKFY<>UUqz0=Ew*7AqV?v6(N(s-yD;rU85x9;$qk~BG1^i35>V_ou=TGo+
z#W`y?ZZyNZkeP8H)2^EdjAwP;TUO-kM|8LPO1Yt$_j$DoU!`}X7HmJb+U-M*?7MAS
ze|<fh6s!?5rd_tVOzQcuv1gYyi?!31jemDNeZqRNJMhzH?YW{4TGKCirOE+PZxu`g
zce@2P$wievYd3ozvB<Gu&NiUXE1dOy_b(%=Y}>_3)1&tvzF6+y{PlNy+YgVmqvxK-
z9D8iZf`Rw18E?m1Nik4fCIno&ZFcjkv6vxcX8-6wfxnlQfw}7n-|@rtrjrc!hxqxV
zE~g8254l&_g#A=((kjfGpMMJ7cHH;lk3K7GY2&hL`mFfjxsU8*7sJS_aLqYK-F!OP
z4QzHs51WpxQM%LjV&^@B^pD&3Tzbwak;W3Gzgj78^U10c-!FV$rt#$E{Q;G}yht;r
z;-%}h*#DcOvg1^|t<c-!r=DDTzZf^==H{<-A+y-t@1S0G61D1$J2GeP9~K=yD1%<n
z<$BvAM~~{ep@IdMfd6Kc0(QAMJ3~wHq4)<%&~is!F7!LV30q3@dOxRj$kJ$SJa!=A
z)C|MWg0bmA4f+CavAFWn%{RL`11(RAi1u7c%6^fna7awwQX`C2+%E1A*NW*=Ejedj
zgjc_}7U|w;7Lu2kmNZ=Wc;V|8Y2J_ygZZ$8+0JHtSMLss`k$YFwdA-3Y<}LXcWsQf
z5FfI0WC-_nhR$~XmISl+e7<d^<)2$izZkA(yqgx=N3TN(cHhl|6aS-r-pnQDfzQI;
z5{qSq@?8(ALoOMK@Jg44_^&WwmzNzk9A;d8bF?JyyrWKp46F3we2s9fq0#kptL$cW
zL6_p|u0w{#r=MvFO<TzE>=3@fdd*AV)$97m2N!-tzxEFunL2nQex^gwi9Mbr^9ZMv
z%Qt=z8$+Ick;$%+#6-aZokp>X@tlhyvBv)4|A({pj>r1{+lQ3~O`)tLDY926La8W1
zc6LLuviEFA8c1e@Wbb6}O0u#^cA43GulqRb`uwizdtKlAzJ8C}AD_qP5$AfJulMWq
zd>+qZd<b#AW5~Iwz4NF}BhTN9-444jY+_0ddZ0?7J<2g@`z*_j3r;Ya$Jhfm3fOq^
zz=|>K!6dWujgJ%g8gN%+xDz6NGBe-6pt?x~BWX}z;d%76vC$I6uKP>CEVZFR1W+G_
z@&K0exwkNW0kaF{5|xz+DB~I$HnsM3e6SD<9iN;ugVZS@;mn;XN>h!i^r_au+6Xj4
zS+GVtYMbAGJa_i4>TaR6*|gkUMO5>j*JVaCL?RaGQd>>3V>~v*&%E;px3mx|IPJs9
z&JuMyTH@eHXcC3QGs`w*vA8?+1vS*WGT01HeK4IlX!`WwE3GRxv)azdN_gf69#i=t
zbH$r%rg#QHoQ7-125am3iuZhwFJ8<~EVRvhqMpQQ)mkfFp{jPCq+x8<!lJBu=2_7I
zzB7g%w(63!<k9Q>&I^xrU5L!@jS!DB(cXjaE5Y#O99^W4^SkK=8`8-(8*YZ8=??Kg
zO{tEl2$BSqYb<FZ6pGcth3(0SOZ7$$+?Ui(9CR?PcHwAFpenSbN?Y+Cc_yslu{C0S
z$5AfM$#b|Y{-$<2r4PJ~)dr9j;FMEMs7Q+(584%s`9iM&FUUX+b?DD106Jin%BlV#
zIy2M%(~U1>WqAb!6cT8T5o};&Y8oDb0p^G@X15S|$9jz+ZVY8$O1QBY+)MG4fL->}
z3ttSdcXZ^VegSj_)CJ5Sk<8A+%<Qr98ys^S%xLk~=)gO-08|2qje5^lO!^6Prr=;S
zMn|ZrgZ=%#=<xwGC%A5lzc+Q4_AKaEi;F&%cIRzl^2?@*wyfi(U-X)S_V3=bI(z5y
zE#}3jR+<4>T_1Cy7CvRecr%XLyGrAf`e>svH-kPl7;K)B@iUx>B{j0`3fDZ+eDw8E
zj~D!})Lyz!`q^wM#`YbSVcTN#lyIBbUf+3aD2sxG@zA5J54wToJ?;6_6W1w|s;*J<
z)xL~ON>1nzSsB_)G(4H@D64o^!iXYGFu`h$vl_RffQk*iFKM<J_m_=AEo&XWR3cuj
z_lCuIWxvnfe(vOd+%&Yg`T41s`xBfWhI)ICadVrQnYp2z#6TYyyg#ij;xg=Qw)s^O
zhI-GR8waZH!j48r+ks|V*p(n?g^C33Gi(8K3k#-!O4)F(1Kk$Gxu~Qh8Im?cas5rU
zgwN%l$xs4}0{|HzS3%@Z<hEy?o=3H<$qUmXr!UA7FP41Wv5&ET&PV>)Y?3O2mAc*M
z@oOJNCs>swD!lqw)4~r42%2*-T;+1r9^mP^+H>{Z&);HCT8}FSxW#iMtlzu$`90~^
zl<=kR^-8re?8fS;x1;%t65G1(*gc#1;ZA02IL<J{Pdl=#UBJmCW2Id$v=US@se4QI
zr^Sv!)=!U2g7#gkHD)1`7>j!?S`b#}Vk|11miU2d!kX6Rd&l=O9?MC7x*@?-ipg`A
z@AbAYr&+pKWo<CcAG2jSAVEuadT3FsuV)_?eVm0uRBW~w?cSq~!ROi>f^FL}a1^9M
z5($(GR5MEp3r2UyGt0}$y7H`~ke>ye!5=*pGCcms*8I?aQXRB$-s)m%nhO7u#n!tJ
zP#;t@+q<W|I8Rz%pV><iWVPD>E18?X*HBj{#HD=uHiiQQLTT_`p^NJEzP~`N{Yq6w
zEcmRKtNW^M=Wz2~yP3L4r-iQJY25rfy@&hq8f{k#H=C7R&Yl^a;Qv{l=#(+%z0NW=
zu)krV`F+!hk}2PZOzs_T7Shi|#U|tm>uDv8hGbL;{<0i2DS8<jcb+xL$BTc>z4+^R
z<DQhLVy0u8h2gSM(}!E4Ug&;V6WPcLPtfSODg4kR;r{t-H7BN_3<{5Yn(C^Cjn#7F
zk(9!RV?<6xI=eo^5}zVvyzrF<XT*E@yFUuc<enTSA)ErbZbr_IiVdwy$JFw)^!Byh
z%b?ep=ihWyQ@kc>8+eJOZ|Co`SKm^mPKb>+e*LPCxd+fRVwkp^HopNUIh9)D@Q67c
zK0ZKTFuMV=`2g`)%RPqEn6Q9~1ad2+#^9R5QR^Gw3XZ`xxwu8DtfGR%e*yE8me$sx
z0hhv2!RKY~b|vH#ZY&$O=fd}b@i^v%18z{(@FNb8FrY67lnf9OnSTU84pOvF#D31b
zZuU`=Q=V<?Ch>Ip&#PT7^tG}rZ|br*(!1}XqRIT4%iJETUq>wM?U^!V>g?Tf`bTZ|
z(;%8{8Mg?|F+kBU*)6u{lN=G=4<_J_M+azWrE6yW0s_XpqqM@t(m(|#SbN9C1;Iy(
z1S9%-4C|DY5!F!xYiB-welS$vR}K?!Y>-1BxxRZh1J7HD3ivV={rUN0rT}zglVAk!
z!38NYu~zJ0DPk}}@Vmv%3BN%y3Fr+aNzg%Hr2SSp#PIvl3mSfC;viUqfeKjr0Jb4p
zy`tSHrvHul(xo!cC7?2bKQxBqv!uyIU*@MIrT15QKiFR|{k4KMw4IvwfZNymx$oP?
z(01VbmJbyiM`MoW3F9M7QwuEzc3DbCM#X9)V#cIB^9pp-A+`hye^_z&2V{v^Tpoiz
z1R!91f>>GjaN+g#3e+J<U>ygql9ClB+?W=F=S5~0{cdn%1VNFP!?v)vS5#F2ugHei
zVM|K@+5e;tg!Y*F0CEh0P;SSg^IfyAe1KtAR#o9fn}<qLMuz?D*}@u<Pyt|{rhrlV
z`=bHB8XMD5Pyp7(2l#h90d^kJCjj&a2x4Z!`}Z&NW8H-x0a*4nmcE#vsdb>m`gk&k
zZda}hqccN|jueE>j)7|fnEH*_syV$yLv6^AvNkU--|vs?;G0`xj{h!h;##hoC4PCb
zR~~4h<8fAJ!V2=<PXiAELU<|yd;x-EfB;mMSvI73aIY!Rm#r9S-hYY5_mAo{af$HM
z?LWtnFQu_O9vt6uK{wmECdvEg_>_Y7^v%+_;4>}~s;4Dwj%u7Ip?-Qa{L5gf<x|sw
zBaH53e|vS(J4M=wbF%Xn%N{j1{p!$ktA5jC7Us|r(6D97UF4cA_bc0+YQVJ?+`Ouw
z#F(GP5Jve877D&AS+JHs=D@%FzD-Q#Zr@mi7D}kDc%qHPns&V+=uw@!sr^a&t)Hrs
z4?bG;X{IQw6<Qd&Egzk!F)nE@Eo-x$*IBpN9oAMEpBs`Q_tIedr(Z8ilP0-4PbbgH
z&QtFe+9R^i^=M^(SiYvnIj5Uj?<}^s#A$E6Ov@V`@Knfht5($f)fU@whl~Ag#k{x3
zpIpG_v;EM9wtGqZ!L^UV?k_(lOGg!3)3nugPZZ4hW)2V6bms5h`-r}yxUXc6hatMM
zUd7v|ip=il(Sy-?TL*AY;p=Lj5#T29?B&Dzd%UBEy_>jBNa2Qnkr0X$_K9=nzFq7Z
zusGd6WVT_h`NOWwbZ6q1cy5=<Y~SXxu^`vw)e+zR-nGQ;kzI1(fjXK}6_vX~mj1Ji
zl_Hs@Kf-JB?utfl$E(jqv|dZ})FL0xml%d!*s_=r9&}i9a|(wj$GyxFk@dR0sSB&!
z>wOZ!PcFPN9gx))yfHZQX||@6*gOB4ya>t@?)RrHip`(y(tgmYk;pD~xMyalG)ev7
zq>=Rt6}7{*`Bq#-Z6hI)n*X+kk4Q0K`(+uM@|@A8bQ7(`OQeCwgiDc-_N)vIZ#t2$
zSQZz*))?u_8SPBFSiGU7D(69__(nIYdtKU6A~HN-WafrcV$I@M{(D)UBU+V?bsP0&
z?%_Qfyv-Te+n+vA``ZYxCU-Bkgi-C^)sjUiuFdb>;p#L>A%Vi_YVNDywKkTmN6r$_
z*K?X)XX5zV=Tg~G9((xYh22NOe3dZI4dRB^iD}!1vW5nQ&I1qZJsmUogkt7oZ3mVv
zebXOMzV)SErQ5MVG_eB5k`e{iT^-Rkoxcu>=Dx`j?3|x!lE0hszHQhBh$kA!U=3sE
zX*Z?|y5Gz~&@HaH*;v0e9_Tkjcf0Xz;E~Atz%ZHK4-r9Q&%%zV^cPKcZnNP$A(q7C
zZW3YFSGu~=vmvr*-WYenEYXfDud-x4wlU)1>$#@4I{R(;PF5t_hgLJYpDlWQ_eMgv
zH9HJPPI1}Q2a74oT_MSH>|gG!VXCF#pb@El*fD52skuG*+4`b>Smg{K-P`oCSvxr<
zsgKn5Ex%Bp%xs3bMddiADJ5TWGOf$CSc@Pf9#4@c;m!JfReoft>Bg2Nzt5!p08InK
zGhZDu#5#S098B2sczArp;R6s`(&vb*=y_>NbF(#4ZRuviI}X!M5}x`I-6^iZw%L!1
z^Ju*!U#v97ab&sLij<VHhs<4a8)@r3@WN*PA1**tr)<yQ2brGYNpq!fjp`1q1uU<P
z65(O$q(*};KPmEyU(-e$+QrAd;q6vrQfF{5|6z#7ySja=<t0P@l&ZUP4~{iz+!1gX
z$=ap;sZmvASXIZS>`7;{VqMFHSG_YNi~#WBBUPXMOB<P3)9bvjZtz`5+~>~kla=$Y
z)C(QHjLyv@51rWhwchCet-oxsbQ)FiZ|P^3G2XtqZ%cb*hwR(42)hJWk2y5XIn^{B
z+4brba2J03_+dV(r>_rPBz*Lz6XoqA3I|mp$X@yS@&ZB=5Xb^~8Ih?a10PHTJ0N3#
z89I(6s9>9wcAeN8tGx@Zl_wzYLMbiHh2wV;bCVDKgc=6@A~t`F#Tf)ms2A;FS_V>|
zwWZ|<*bShwrAZ}W8i4dHgeYR{w~w0VCuFAXi_=%=iT+Q+>Ab6>MZ$-1#P6r_%=Cm!
zKz5{bwLEGw7uU&*&);@QT$WXFVUU@ZOTO&u*zljNV?t>PX>p+4c9jp7d@F-%ij}d?
zW`E%Sg(VplJ&N;$8KX}Ir9{Sc8m-o3OFWLeradh$ZaR7^*qU8l_CjP2NzpF~FP~Hy
z`?^%8<=<XC8|j_G?H&wPj%YWPLz^o{ZT!;AM^B!t44_mE-P=rg+(UJA$|xhT_d?P@
z5#^l#<^DX*#q_167Ak#}>?E<6{C9Ezk@e2H#Ma8yQugw%`C>HBe%6$ip9CKr<9f_K
zz$QSr;N0S31W3%_jziBXc_Ii03&u`h;1-VL<hYDP0ha~elVIP4vdWJ|9?B;J+w~cY
zok7-Q5Ow@=gNG2?4gT$yFBfTOt`v%s3XEF<G3|Wvf<Vy1%e~rsX>lOxRW){$l^|W$
zHo$QKTClr<w)(Z>ms_oQ&<CT3L^Xm!2y`H1K_&E!|LrrI?};TyC1Lt^%|}%iwgK}7
z^DvG5&^8A01d^Cb9Os{{2x^Lo;W5O-#PG`qzN!zX;t!DoI(g3B_%7v-jp#l+;1_B9
z&T&?c%_`Tl$#UNl<w7R{I39Y8WnbuxtA3H%Ys)2eOpOIx<RLHKs`Z~ts&b1re5(^g
zm19wspZZkeg3Imm`j;}!OY0;x{nMTr(}2Yq@2}AjAMmC?<$rB9XG+d`h9u?=1?~)(
z+r9n&vgM4X39SL+g^;BnDY=6%&sqi2vb<~)boUKfbVcsqtFiFYgf%Yg10H<}7IP8K
z(muRz2=jb!^@o&7ipG^r5W;#9D@DRcFrV94F-GE@kI#O)PZ-*x)<l~GfL)>jlXIlq
zU~Ge6o#WresRWJM2QX+unTmi(3E2WI!l<_Il@?gk%9d>{8Jtj<ONh#Jfj5k#Zl^-T
zFe;rnfp3UFE&1{p>j}LC?Ds)-w8KdPqjR)qf6S+Uxj2KU1r83TV89#TaHCXLhX&Y8
z{YUB{M{<Qt?aNWVz}i+L`dFp5QdlZV8z+rgDOF1pyV(zQCgITgD(PKzgEM4L%DZUE
z>p3?4moCVk;g)^t)a}Z5aaG~!A;##);_1)DB};1Gc@=4R+xkDY+C887ad=;)n~Lg7
z^-p(gR`iXCr54W=GDjw^UAS{)+{~E5LzXAjgKhgw@tWje<t?KMjw%5*7I97S8Qp-d
zeVroOPUl#J<$C*8#V6=H1$D7j-KLQE5tHTirp_RKvU#tgeO6_XR*zQ7=H(*KF8F+W
z-BG(-RJW8<nj|)0sMU=}g*|0>dlycm7@7)#M9a(DR_x-W&`^G+oIt1nx0t|F?8;YB
zRTZ=vyt*;p(ILk8<=a?9&)b9q*2T6*{{NnC^T1q?E?T~+eBbcssFjZp@gtwjt+>gn
zDl0ASio?|E+G8*%!8B^t<kBgRgKseikBARLXCvuFdugw2w#J|9&ilsnJ)K$MYHT_7
zdlfFKp*hkvz9C^oz4%by@Pu}%4#`v+H^Z2wvM?Qs3(x@Y+^A*i0JxtqFA)-c<6c1P
zcVCCJDrb{ARJz%;?F-aDLawPjlK;&f##P%awo-a`GvQ?Fuaf-vxK2GiL)|^6$8TFn
z$|_mdRGj{lb1ObHJ^Ao>iCbZ8cNKfZzW1%8F-MJs&-oFMS_PZ3ogEe)&K*bHU$&Hg
zrE!(e?XxxX_^!}%z}HQuE;d}Kho-Q-U!{1Xd1)^CU7FOzRLi^{);tA8|E1x5?n%@x
z3o?JGSuyx1QL*1arW)_eYl0WA=G7Dom}aJ?NJvO3(9G7>ZopUT%p0GeUXa^aPo6}!
z#0e0>GwQ^Y6cu}QaaU1D#8-xNwt9GMj(EoVM&hRQ-$Z3z11+|D&b;=+5G~`IH`CGm
zV6JRrc~4uLerE_Ypwaq}ZlTWsDG5}ZNxXcFt}F&`O|6}MUaMv_IHHhWh(vHDv%ICl
z5onXJJ3B8<5QtD9`a-~`$!TJ?Tl8yr*Sb@UTCW$eFvqlHZ5zG3UAcp&2-%hNmf6Jy
z{%_iY8c!`_C=Tu?mpJXbxp!ihvJdOZyfo)Tv+zheC2534(CgROAYc3W-9|Vn_<QK+
z0YBm7RE!`5kufs<0-pgLV{Gl0=>&0LgFv{zGl@-GZbp+0hnjKl@^<VyY!5O6+AdJ2
z4UCP2?%l<38Dlk&7Qo8~PY!J_lq3G%MB6Ma$D#BnDC^fa0MbQsvh;{iuzm(xL23!u
z-mDxPFP=WdAD^+G`UwZiguWUe#Yd0cU;TLu?@U{}3x1+0k&zGBV1-TlC(I3=96)T)
zV>fq7gNLN*BY)_5Kv<aQf9s*axz6H%Vfvv$aDvXuE9`p5znaHijd%BIVrEM6XQ^o+
zuVq!NpyX9b3pvupC@0a&?ccs3sJsHCxKE#MA|9=;d~<X{pKynww1W#rZbrdUtC`s<
zAry6XmcSg#5@{~XiN!b&+;_-oQSpE@49$hG+pCMer|j*vq_>Ts^#(YatX+@|$41)7
zLc2*FHQj_#@G*52W<8+I{ys7-X)ms^j;jR95#nU9On^neVV3!<cOA@W_R<Od9v%iz
zflvj)`G^84<xqCg_J*-{se@3N3=cp3+a||QzDn$fl!=7?dBpa2^T*J<yfdaxYNf7S
zs|Tl*gwfgbNq0<CfUMMsm^ZnS><M>x!MLqIkQ;SVzGZwuj*S%1NSth_E#x&gXMY|L
zY21U(_gwj}^Npe&{%5<3p2sI7Xy;p#lAic^{PcY?{O6kaV5Z1t=N%2_2!m=-Qf~qm
z8nbt$%S!pX*JzGP|Cd>}#%FEA<LZm~YRYx@F=;oi+(&e7zq?@&ISIwd2e8YKhM(q+
zM>oyPB7%c)K2?-#{Ot~_;vRZ=)nJbInD(|1foA;H*e0z&dqFvuI7S%`=8z8?w;lth
z1?&>=Goe@mrvM|2L0xfpZ^Kcek8$A|fxdk4yu7>_?p1ulSn&Grct2zeRS-twAlrg!
z*6W?h!p_0bS?G`fmuJZ2anr+M6k-r)doYIbX-oYGhe;g0$;ljy7p0`i>*{>m2;_MD
zQulbI4a=Wb*=bimd7|@yqOc3VAW&c6`GSre2p6M!A@W@SfZ@gmk`6Ld^Fa;S<^M84
zfeNk>?#@o+o&OG*>z+G)dY&D$8;}SQVbm)a8W91Ffj!tlsLCcDiqdhlZ6VvL^?{iF
z(Qc{ytz3bxuD%;f14IW`Xu_eNgBlM+91x}>BX45H4u}tjQO%+0*;$AP#I1jmF&>8z
z9BysgW$uXm2!;1D!iUr}HCIttU{Z=LlG)vy!8{@`P!P8)cvZ}P>MAPpAgzr&h(`~P
z_X4gKH2L5*Ap<++(3lZ{a&}JoW_yhJ&8;Ugk=%|XGZ?qK3Wud8B;*0=0NnsSd?eiu
zQJu`coW>jj01<q7Vu#~EQ9)IM6B3#|&=q4XrK{lB<guS2H9r0~h}f2&j*t@2nc$o4
zcZTrvQ?NK@XJIK9-2)*{yu>F>fP3$BV6<{T0;Ka$S7g8bi>OI}ekZEoXdSG#Os)4)
z61X9b9^e_rJn{j##w*`tmLgt0zQnXN1S~~$f4I((c+E3uc4{gYTRv78t|_cBSoaPy
zaTC7z<0KQdtVcT^kT2E$p<c%5z-<C|xGmfQ@%}+~K(p<~EZf-HO7%S-U-f@yWuD2i
zURf%Q;yMi`9_e}60uT{d=B>}8AcM8Rl=b<ubQJA~v!lg^i~=3Yxa{j!$Z<@|o*l&2
zaf<dH@*4=Qpk%EoV2R%>_3-zn1nU>hnt!D?yVKVv9y3o65jpPDBHgFG?J4DUpQ(xO
z1gcJO1gSUo^_gFBB!xeJyku*1?m67~G+`&<wg&5F?-J`)?$d(NeslfT8{b@6Jd4}<
zf|eoN3|Y==v~m9Y`zU?U)fYUqtN;9Vp#0F(b{VlX$_G@3>FQ@2)562JWcdG*XWH*a
z9GiN0oA{(?pI-Xho6aD)zZ*s77V%3zVM%eSiJm_r+?V1)DBj$TMri|L*JmGhd+#++
zu{-0_Ia~XanBiX^FvVDTMbqwz^Lfwz_5i==uv-(}al_|N{_8Ku-q_Ecxl(O<e(qoY
z-GI9x!X>cZYWknO>z}t|{lY*|^y*vp*nj=|-!D={c)dvd>&gF;eeQjfKVbhUeTxKR
zG6xwpw*CM5f!*Wzhmv_8khi=4Asb21O(|{DF*mtipCxqu%Qk7U|DZMf^DNpIUpBP`
zpCcXr%T4;{&(EpJT)nzR@cWJsmmly(8>XIqYdfPJ;4)0<+{r+)#;%0C!^YZLxo_zY
z^)CF&_jvA<rIpp+0w1aFUpb?jhJnpP9D(EU){DLQyAw;c63A6&8EuFNZ|<Z*6BnqE
z(j@RC`@BusfGRrRoqHy^y~GF+Rtr%>slv{BC7X>_ucs{pa%nv)_-Wgs0=l+--Ekk^
z{ZYr$BSemgwYn2bO#PmOzc|PChr1a`IQGG4%`=0wD`bb*W=R?UTl25X$k>lG1sHw&
zpH{v1DIJmf7ToqkBsDN@#$%6&yIw6KSYV>3AdDLHU}=Me4``9?<Vg%Re*T5tL4@8)
zObjW24nFm*bg}h0rF4(|L}3pz70IDqfFmdVn>orvbU(E|^$0{m<EZ?A3R9!6i2Q{e
z@Q?N0aj+5D*hcWau@9ryZAS-%u`FUDag(1pTnnKKFk}KX4&o8tdsIXu^o`P2GR=Q|
z1}~ESwE5csDOi?W$6yPG`6Y&fM3>_h7A~Wz5JmA1Z3PM}bVoRdB}pp3eT!}|z<dUN
zrj>dcnwlsCsVFI7Pz7zI;PK<|H@yKa9yak~?QBH9x8{;-kz+(w4tAnk++BVB#$oG;
z0CkW~arv<QpsusEv?R9+KI)pwOm*=sv1lXuL+G(E5c%<UOz=mV01uCzLWd~uTt_s3
z(wBbzjI>%EEiI()wa<rcC#v}+Jr$0V4L`_%;DE87;WAu+5eF47Uq(qwbUAF_+~t2!
zhpF5$F*yr+ee7I+M7F3wVP^|L7X*YbrIwZTf?gF8Y%fU+Y7SQFZ@E8p6U<Zr`Xe`Z
zsNG+}J#UYS1V1>%4F+aDP||`($pGIq^twWvglt8S`SJfawJ?SuBqWQwP5d!RKgPs#
z+sJ68bia6RLBVs&CZhXEvrz%|Ro?FJb`Zg#rIh~2M*{U##>we8E)zySBe&?e041Q$
zL1~a=_zPJtkWc)$^MLsNWxORzizho#fRQkQG)A51uFs=EdaNn+$S|rmobw>2U_p@E
zyd|nv2xCaOsKMF*{VmG<QkT*G{^q$C<V2wNo!H`Z9EBn#X`q~ee*Y93{_j)K0iuTm
z&b}oup$Qb#YbQ=Y8FrCW6xpgCnIDGw_U*qBPp*Lz>X^q7(ziQH_j))MBP3G5X$y$2
zzkP}B?|-3cOAH#HJK3H+=VS=i>VnU<dL`0dJ1#VDo}2kaprQJ8|1#Kin7Hw(<BG5W
z_nU2h$l#1i_9Aobl;YE0x74Sw@;vHDZSK4AW$U^28~(IQrAoGhJNB&-q&XM<ioedW
zz_^m^8-aaIL=;J&p5y2LQvinF|L@H5qt7xezs317`f_U&@2LDTBtkoAu`oBFe4w0=
zP~IgW)mT-&>B3(v6kAsjHS%cxz7Xe;)rcdMLEo+UycIHzedaEvT>sGJO(JMpM&6;2
z?RZQx%zl1pFWx5EYumU0p<b)6oSu9F%Fjj4%+6n!toT`p+G241O)81psgV)7GWv(+
zB*qu?<=&6oO<?qowIAkPJ$$YTH0C#F9TZQ>B6*O&9tU4w_in>e8WtAm=4uM+>cbNg
zwKsSm8V1aPB_z`0s#LhJC#`1NZ<_WXRm;;~%x1$b@vn@li^oR9NSd8kE*^X_o-`(I
zlXJ{{&9XP`yq~<`zB48hl-agJE}xX1sBBVguC)}*7f`HtiSxE@+DVWU<eLsGEXiwm
zkNTV*Ngp$+9hFWT<Yw9UKueX%Kjs-(nl2zRk(F<vRC=~Hwavn;cc@{X)v>X=QpeA7
z{tQg(3HzBn)%&(Gj;lxSV3AXaLCapICuDsMjNQg&f&OlXol|bOUC$HkHqy!+d|8^U
zB)7TT8fshiHR(O8PRicd(*?iccKQWseF(F3tZ3$6B-hQ!PnQ+?vi`i<wyDlsQ-8pp
zU32sEy_e+lp*KZ;-ImW8_{g+f-(25xJ0j=ZdJH<~6U+>b%gQ~>$v4w2NeC(IC+`}3
zS>xZNtXwlCyeDLQw$&^#c3G=|##Zm+7r&cSIwyG^CGeW@m)C2O<~1K%er$rLQ@_NS
zWnUk8G3PN=%T9*OP}jjbj+IY;`{S}0chFDwI0ls-sNFD`U41xl48HQEr5E5d25Nd^
z;|#L%e(Ltr)^c%hTs<CnC2+yip2dzbq6|*T_})Z1KO9Xm&VL4}3*aeGYTVtoLGq2J
zZ?~Oxp>>)5*30|yY+K|iPgd5ZT|e#Dmi$JN$(>9)rMuxtY%oni+?~MM>$WY|<jc$&
zZk!M4%5c5<+3#W6p*>osq8L<WF8!=&&-YmMwfb$eOVe$`%DX3P=a4ABWmW5>+|q3C
zU6&dfmB~?^LN-I2Hhr$L4-=QZHGIGJOr~P~y5m5Z*CmZTmn166=xB1}Ynq!TWJxSE
z?R`^Irxxdz_j<i4+ae^UOW`y;1<J>e@vXKN8zK2`JdJ9ybzFXa0fuTOX&<UI4hc3H
z8T0X-lBgIs{k?{QKTE)0?qZyMinnY@QErRZfa&G!tB;0*>%WxrwC`<ZbaxMT`^8sP
zk?UjB)N;m)=i4{-I?ni0jcQ&65yplRK29%3@9EJ8y%f<8-jemextL0#;upVLM7NN|
z4c!#&64A(aM%kB~_dSYT?KGU&&d%>>yY?z^aelV=-p1m&q|aQ1rwiN^b*;X(hMLyR
zdC}Z%9kQ6aTNX1}?&{dx^2vVWbcWo7{P|+;--k{gu7yAzoi#wk*n|YA5+JZ;oOrtt
zlbR}r_Ni0hav<uQ=avUK4n42b!@f)|0iqzfoqWe}&f73lXcy8@S6&GxyY)7z5vhGF
z>LGMVO$O0vXKuF@KFB%JZ^IG0CShxBB00s(LN7a@GxI@nO)B<ofT)|wF>aR9UoWGn
zE)4`QII>snr;BF4Y^;;9VrYC4T>3UTb?T<5+x+n}Co)!*mSy!#%NTrS-BwKZXv?1W
zOU<<!|J^gGPjyIT;E=LTQGkPaQicVC3ayv(EomWsMPoISdpo`*35+P2)ooGkSJL`s
zxtp!0ILXw8IFIgKY-4rPy5IX*Zh{BF8;S;2U3(3oq^oL5@5j?{-8DaLy!_0jKF)u9
z!j+5hI2WVco1)00t4%{0TS|8fv$0jU3b<WMQkXuoCpS{R-(UPP8_6!~Yl{9&w@$iF
z3SE7v;<h|Y6uQwa{mgQ==t{a}m0c>mES~&Sq>mMk<EynmYezTRF(P8pIl#b>H)0q_
zM@<bAwuQ-_O@jNV7=#Sym@zE?IsqvY%=Tbl{Xd#rct4=m_0vGT<Rcjc)a`%-j(XJ;
zje(I7VZ;TYKLNg7GSCi{OMRNIINEpECIeK0T0vm|y(A7)G^`+~AXkH6q5#!pnA{}J
z`OB9{7SD1=sK6DV3qmgtf{=)S8s@a?S}x8`@THI$P_x|Q>5@cunUmn*B_x!CRNg%Z
z&kz$UZrLkt{`3Cp*EC^rcq#2HBb5wUV|7fT{%bp(sIDUt*;1Al5>C%`@?<dIon4PU
zy+>#;Jl}HUSaQ4zb}=wSK!yvL>pF@U$nI!pEaV@~YCL|waJ8wXzlZspU2}1R^gR!9
z#^alu9oI?%zRj$JB}YiSiuX%wnH=Si{Z0Rzl|SvFBoj8*-oTTrl?M;0>>V?9o{1wZ
z313N@^ynZ?KGo`SN2szgv*vsJ*+I9ofZ5$`&7)%Z3_^@K?-k`#zh2(#ix1E96=po1
zb6;Dj<0uRJZPVoLUq7zyZCTp+tv~=|N9MlULUGYYrAQKz6Pp@L?qG>YkW6n_e~hk+
zvP-3NSv_y+a-olsDkE@STau<rx}qtX-RpfrXum<e>D{db`4bHppNZ+{mnSNG_RNW;
z%3V?~Zi!zyyrc8lY|ncY{{ew!anrYzB~O$c8d{f^RM^<7=T%?DC9z&Jb7HSlQ*}8S
z)*W%rRkvRIH!KG<HQ|D{1}qk-fu3+pSd0S43)z{-i1GY%1Edv0Ac;?(J_XQ-20I*D
z7Z@FddVzB|jhP*kfB*}j5C-UlOD@X}U`)Hnv8A&UZfQ^mBmfu0%50XR;?hDYS8Ho4
zi~H$6?$6NoB8|4HsY&VO_%2e?Gj1Da{VI`bJq)ksuio^lAcBGV4Vx1$_{Shos8H~l
zq@)KKIXyi>qqISHgzXHXTaKdWZ1aHU+x8thV3ExG`Wuc6=y-*8zipwn!74;REM)vp
zKPlAAw39xZ9FiAbZ?32~2@x#}L+HClzkL_5>96nwi4#OA24QPYvRA>ur!fE(OS&vC
zPxU?gmywkjv9;8=4EyUtw9Gq<;@&Aq?)h%4QTyv<Z{uP{NwMulP$k9Jkcx_WSFsJX
zFIlHPX$BhdnHb%AD@~GTW5g_w-Q0XiZPqY#FpGf}MbX^a;L7L|-S~xx6Qy<)0!(p*
z!^Vr7cQl%xVlwR;Zsc;|wku<(bTFS)H7TRy3Y*Qm*Zf|u*Ler^C5`C4Q(7d>YxKno
ze6<vEC%Ywdt-SO4`sc~vpj-ThYJRhDw^pUn+%?NIZ`r#;`%_Ezbu}4v-MGcN@(9EF
zgPKKGpKKQ2ONe*xx%qK#%Q>~j+S+Q0Iv4H)w#hQzPh6N#nT>ql*wrnv$J*6xX0!Nh
z!P^D{H^i^Qj1krMJk)r=wbHZ;2&MqFpb|fOhS^3#OUns&K%t!YVqpRaN9Kn@#d?+G
zsHi180l37(-1#%;l5g78dDyp7k047eE3;@qREZf|+*R<BFJI2J9C!vhT?8qCzY5)1
z*I*+0TeLbdB<fgc(1bucHEb;$CI{OqwAyblU)$U}H$5GB3|1Q<0Og^Wi8s>vKkyV@
z1llu9psDnpaKMi$ad>Db=T7yZM0GKdNLjR^Xv?9~#tDTV;AqxXR!r{JmZRG~86U(7
z`rOXnDKC<pv*ozf>W9sOBVqq=0d~-OZ8NjoRWM~)<L$&s6VoCvpOD-*xp4f=^D9Y-
zsmA^0I~JP)eItw5lSrSM^f2f+wih+=RmZnVt|Tgzzvf=uP}SKI3dacrrwvC(+~!Hi
zA9CG0L)v#d*7?v*D}9RAHz2?;+eD_EyU=-M?cN3Ap`Qtx#jZ*MT`h&`+xeNYcuQB3
z_vNeUEJsEcGMf*rlirq{%XFd}PLi|boA0s~NxNV3>!q6d9juq}XI^R_wF)&T%%!qM
zcFT{tFkUI?snOw!b4xlXxwj!LdBuE1G4XlP0md(7-BWS5uW&_ah!b}Yj)WYT;(5=b
z%3v6kV_UwyC@^0ZBhc}X!AhL=Rtkj`yC0ciPkk=;sVh?|esYs_f+gI)B?*#W)2<ct
z<Nz_jBP8r97$Bel`*%)AwpmvP9(Tg;sOIh}yfwik4FxD4983soj*s_T^?mSQ%lt8M
zaa{=hFZA{GSOOD%n4AyoPxEuI0AVQ+Di>$f1CWheV#(~Now5qdX~`rw8~y*=RP7)I
z1=D3^4-W>X{pbZuGn{QDLa|7cm6da8sO{e8`DwC{=p>Q#hW{G59!f;cjzkYIEnT8u
z#5R5VMW0;l+VqWgvxU1`1Z=*#G{@$J<Ox$7^HS!d(GFz)ewXd>D)Cw2s6pS8E91YD
z)g1P#FRZ8Z)H3g<d21!A=UB0?b-d)Ptv02~+(gk1ZHqDUM>Kt$Mn-gklWxIPYypuC
zSNF8k(g#N;pKP^k)92(46S>i{uvDVd^O`Q{5<__7$m#D1MHIxYFLJ`|A4(dSMtRw$
z(q9O8GEQ4!F-ctRFjQS-yjfBtvfneYn_+YF$VGKMHA;W_i<G;sb@JHoq-&kOQ1!TD
zkh^+CkIhhjkTb}Dw`O!GJ73T6S%|;Is0XWdQ|D!N_Ve4Q$jJ35^nSeQVTh}99{T+4
zG%?d%|DisHy23h#lDg5tA#>-j#no>w%;e)1)x2jGZTZ9mUA7oEwS`R6w>UpCq<BPC
zVqsw5ChxMJ@rU&YSxe7sQ1UC+PulKeQBlqt)6;cP9*#LCcCt$jXJ{N~O|-2xmAEGt
z>5J1fsaErRJlxz)^~Cyt$+*16=)>7gC3Z7ZX-JN=&*}Bb_-M*-ozS5!tER=>IrIpo
zffIu>09=sMU~n8u)(hOH@qM6R(&mv|TWf3Ogbi8_vzZpy>z-+^hPh?4j;5B@VHiVz
za1T{GT#$k1V2jbtPz42Q0dh&8C~TaZ0emv!!wSR&#jLENEe`irPMw*8(>#7~#$i1Z
zs2kDIP>wfzTo9)Dz3q0QlY@f_>_1dguC!f8Mu~FwN>l+WaRHA^U2r?IIi2s|NsXD3
z!H)$6ZW|Lzg9Eb+lj57x8#UGYCxR2L)HRje>U1{*F3dKjTgCN1E`3F{uc>=5wOiX-
z)l4zxDG|d^P`IIRp845%#_^!8f_AqLE5(C0Ve}$JvojTT8>^8Q`ffK-P04B+lSih=
zK56H7bCFK3{3LjWjM4p(OB`3KZH;(x)VQt&Y419di-4C*=54|EBIEIy!y<b_+(!n6
z-!GP4X|(+6>#W8?XPDpC(ZuUgtyiNTBJXRg#&CF0!O=2%aKMRO(lAi7Ekekp#9Z?v
z7Z=JuLWT`uk3a|)TOG>)j(zdcC5%j<D5-_(35vt+?rsbnP!OOJP0!9=n49}nwc@tO
zgL3Z&N(c;Q0o8zpl+v|?&7R<mUs?*0a2Eh4%#@7NQW6vMK^OjGlGTFhQ+(w&6RVKX
zv6CkaU@(m0a&xt0Qxm$cD)uz$jL}d&^ZP4_1`PHv)(0mAqX<*PIZaHYB5P{D^k|0;
z198}mtMeZ}e#A@xm?jkAkkJ|yufzpN-QD9-P*GDOAX8_+ADi=_W1p3?T}a)6eoKpx
zTwYy0S=foC;T-n6bwRrsxi;0;XF{0v%aH_%9P2!T84ePG5aQcV<Yb4!6PJUKKLOiQ
zlJq;(NOZmtqd5HgH}!!7zJY<vUPob$%k$Si*71cI=uwyzU_gfR$>+t3X4AEVxbP5o
zvLq#q!axCoh>$(T%d4xPOJnG|pH9#OSPwAe2C9Cre&N>!Y4j7AcmI5}e-|T4_&t;D
z)GPb0F^m(dB`6c7p-5V@veHbyRR%YEC?xlqq@~Fcu7VBY7d(M0G{`86e&N+=_`YyR
z-MztoPuT8eYIuYG)zFXkhSJ0@hn33N-G5-wF(i73*G17RkJyk&^oeV8<fE1+NfSk8
z?g~CemA^+{%vuF)#uX|K)aNz18<YfGQOKEpa@$1W`)<Zlx-*UX(VI#gb*^{dR~+u|
ze_S>;v;kf?P&&)VEGH^o&$nI8>5<DETn`xO{^jE>5W!TOad7Rl%mmpB0oCF1*2TA?
z)o`S;w%)UEA1eOqAM`3w8}@sX5NV9=16%kbA9nPz@^S>Hz`IxO&1v2<XVfP=iQZ;S
zOkFX5dyj{7-&@h2W}CI&SFV_geIQ^~{C`Z6?$Zz~3}p7u@bx1L@s-Ff62^=6_Dk>-
zY%lD5F?qmD=*AwnG#EUEw<pY~4bSlLSz<~lsk#ULKkz3*j6uD+no;(hz1<0!Jxodh
z!~Ne+ZO>$ICO=H1aSZ*;_AJ-+`BwB|=O2Y^%&D=zZZ-k33LCN-y8CyG+MKMDLbp!b
zfXUTIUD(7AO-@es_BP^F155q#W3<tzwfzF&PknILB?pJR`jCSz6L~{$iz<Q^7G*Oi
zW4jnpq`>lc6eBk{YQjO-V6)#2gK86#F%0TnBsZRo9xP}&m2~YSrr}f^*Le`yf;t#!
zg;TIAXxsslI2d#)vIV%T%mG&~vK*)ayH^zEq@tn>4*dsegwoYiRWWyN1@W(;AssTY
z#;LgJ^kMeqSSzZPUef*hb)i#NOvwB*?_GscgZReMZ3I)nA`w?oV|6wWW9x#Ua3{b8
zuxdy<V>JGHbZTk}e$%|n%&~YvyDpnncsdAdSsZRE$Hv;xvAR4Ifeg*ow#s%{8c)?B
zuKNp*FiIzr@WlNF<AgADoX3wxqo0Hy3jc>*7@rYr+V6%t4EjnP@s&P;#8+(BV6kBm
zz@?dO0woswUeP9!OQ4}(L3xT$t*^?!$qkPv&UP7wv~Ykt*WA^GJIV#aIvg4Rnh#2h
z!KxbPN_cp<1PN|rgp%V9#1xx`U;jAXd`t`}BMMT;s!%O}!CxCL%D&#2J)KU|^hDUs
z_vOpC{70a%^P;mGZ$C&*PB4N6tn5Y2+Y8TUjKnc4r03Vaig26EHn>m2uM?(H3!u9A
z&<Ozqw`x={mXVcR$3K9FhwIw+n*Xl!ayk?mYPv25$;e*9e#oNtA~$y$+yzI*^!5@r
zjC5|VcLn%OBtg=Uep@O_V;woxn4VbU`O0RSLB}T$Cy)r-frSR`8o{#$mjukOLlR(=
z@nVJ|EZknfCh5@}-By0Y>FP?%3<@$VH-ZTOTZDjdpuZBxOoR-)$--Ih=g+axXk!~+
zPjg#Of;0$JL`-7_b}~5s1eNUCNpRQz=Usg^9=m0<^Kr3#G#hBT-kzTCGcug;oz;bj
zEF$o}AU78d{OrukgUI{{355I1H1-I)-}N`)FO8EVB<lOZ7Yg~yqWp%9(a;UUz%D|<
z)7{<u<HvK4B@W=)f{Blq<JzfJ<I@^p1w`%paqE&vkU&)j4U$=BZaN0qxZW)<#9y<)
zqcrjw>P<YJ@Z;gp-q9grC}m_c0%xrd@z(gXXTFRAhN@Nc0@b);jh4_~#5~3aRVNJG
zmo9UI+!*s2tVST2GTfSnI%J8z=k0cxzRV3Henw8hwFc7&Spp$JkZm-b>YbcSQ(u^!
zZ91GKShGZMbs&>S49B-kPd^T^=jdnw?mIZw&}*AmXA0YG$z*VoeJE3MU@Or$oHhtQ
zXmp_{ff*(87GUs>pLoTD=)IWiSgZOo=biwQP{I>-i_%f5?F2O&oLc-6fA6_cVCtv;
znCzb#$UiWq=OdYfy^|9n*7}ErP`Z#ZV&oX}8GRC3bY%TOJ#?r%HshL7SzTS)GS^%g
z(^ZR&HHYy5EL<9;BxsHBvCz|x{YXdE4TeA$a!WH4udsv)Y5bHcgQ*O5QA7ngI_68q
zfJtOwXQy_O5-t>E5__n5ZeS29;fYtmc|MvvIz0Ru-cg*mq<_l>8QM<->tf(W1_rqx
ztAg@`-O||kpbMj6>%GQgvRjbHpp^il2@yivfPc<9So#@YeM!Ec=5^ax0~ZpfCiZJW
zf-J}!OG{USd2Zr@V2vs!wcxY`e~h^-mixxuu!4FjpDSiPIB0PjwEXz7gxd^oM*6bC
zC<sF~@Q}gri82u*L?bu;7+V&)CMV`gyE_w-o8Q|vYM!v8%su0<8QdVv7GMPDGlGJ~
z)RbK{`A3mc4&+E=xBmO_u5O1gJHTL|L}M^0;R%0am^ZNpNQ1C~a~OWhk0lW5tb>gP
zb;Eyt=-&TP75MP&VuZnQ19J6#{`~p3E4P7hgW@u_T-w8j&mxKoj&VDW*q@^f6Zl)A
z6V@j+A#}X%?CcASW9QoF!=$=EQ*{Fq5f;F(as+4M4Cq=liOgm%d5d<Q`?UEuFik*w
z-CHD7YiP%i-fpN@WpO>fC#&aVwqXy)g~pB)V#j^oy<}ZP)400_5d9~rJzLIoc;c&g
z{=7gtWIK@`{)~ihkkSzheY`@p-#>JNd`<9UH1XU`^26sed;grxi$U^mVkG*whrrk%
zy0HVE8$?7r!~~lpqToM6Wuk9?y$tpLPPYEbA^yKS?4t&#6`iS+yB>GK*OY@K>hDua
zvTq5#nxa}wzqMaMQxk}W@$K7DiV6MR+wYeV#^BURk&)*~Zr-ceq$k=S_?JB<+a*cQ
z5iz%oZjv&juk#!oTsX~<gn=v-ZtfsBK<a-F*;I<oKMPYR9#t2YBC>aI1+(0_^&>f~
zTZmqi!4Zj=@bSJLOWAgV$S~$aBEn<k<WiH9PZ=I0>NL9gkeKIwW+V9tW@awff5P#w
zMhzx`rkI)odb@{_G<Non7*)!gGV4Ce_yuh4Q0MPxv@PMC6|$G;truSB&oi(RocED)
zPrz8mXE5JJET**aon3p+6)?*_^i$nh|1`5v0xR(9+T#5f{dh%<?L_zFX;b>!q=|%m
zRW;%Vi39hjY<)@Z_mgPP(UeTBkS#L9CoTjK>6QQe5S&5!9~B)dF{5qcCEZ7OPtTdX
zWO3-?XO{=tmI|*c=0rPQs%o4vv{xh~C9)Cz5j3>>TcQI3<@hE3Jan2}glNxC@1{n>
z9jr8o+m4FhJE6Xja_wZl_ZG=tVIQ20vNR^h?rT0LJPudqKd#|Me&3qpynmquQBKzC
zy`BJ(ZErdMTp6ytL`1i74eAYnITGwMZ=7|#v-7?jOjjS?C0zJEHCrNT!usJk^!JnD
zYkvOsog%v&TLj_k65m{wAHL&vWy-90c@X8$hwVE*ekP1q=T^pZdN7DWsQq<C#bX;z
z<b|=ZgGlCqbCw7&?r#cP-|rzT+#*08LbyYLJ>l9v-IQa8;=v89Yux8>-gzCh?FJ2D
zA$TBLN|_`b9Aiw<Wi<$lt?!y<q>KRL%jB!Kz9hUT>Qg;W#f0Sec>Bqs#Z!g@nr1~d
zXndU}^3ZqiTJ9wIs7Uxb)7~;FT}la<R}bRVB|NdE3mAVVVMIC~qm>>J2Z4|ElNpwO
z9<ay8<MBx^k$@0_QRx|sZ(vDWMNdn#+p;4%pl<KxTBxksDc$d?Rw=HAS{jArUmcjl
z>uNc|f3H25zGqaRqn>k0@Sc&6*Q}&#_ezCqyUlLBSX~Vsww4O7p*_-Vo9fx>3r;ct
z>kjL#9d_(#i5l<M*_BG#Hrv`XY3S>ZAhYcniAC=hQpPU?bE|77HxNKweVBr1H&cgN
zyFPu%Oxx(|5(X|s?X<~>QEGw8%?CrD!}5P*$JUtTyirgQil#hk)N)=yM{9QTgcMEp
z#si0&#V(!JIaWnC%VVTcgoDS=%xykx7Z^@(<$cQNVRw%$OQUdeE%J=<lbqrN5y{@h
z2Qqz)l4r>bx`wm!jJI;=qJe@s2IciQ^pzl}B0v{{nY>3^Z>aY#yDfgnq4JZAb6h%8
zG_S2C{V9q&?uAOyCH<8cRYA>Qwc)OgOI6#oJI9$tTk573O5?Vz%vs#i(XrkLi4D`d
z*pn(d-&8C!Z{u~7$tj!g`X9TrwF){I*4Ey@C)$n@J3m}L883nuj+#&hk+ykETW?tC
zQKu*;m5FZ*iSs@!if}d#R_^WU7)U>Oq1lMheW};YZGGfX(~0dZVPW_DNzeNf3jfHD
zQplSWu`1rIn>d`M@uo9^+dV$5NI^j{Bc~S^`^|Y);>pDtF^ibY-}w@Z;p#%~dU)g+
zzgU%umu#ksEsD2G>55Q9j0p|2y{Flt`AUrTAa9iniGt!a0sbjJ?Mpsqa)10bUU0nA
zRi1WOWTs`gDk;%a%zL(5O@FN7%%<kB2bGVB6DR-4PN)ER+Y7k3QysX6>+5#Tph~0Z
zTmM2=dbrDEk9*4aRFK1gsKRLO#nb*F1=BH1baL`k5+)AwKeAO`hi(M_8lLpGS*z-u
zcCyoP&3u#<K=v;B?Mm6SlRN|0%#@Y0?fT_}nvlemnriQj+(l<u743*mN9qds3qyUP
ze0hI&Na}{JRLML~O><%ETV#0trl4Ic_kBsMi&74i#9T@1=u~&%?<bBlR)a)5jfknv
zHEH{R1_h_t!f?~j;6b8He!l2{pj!WRhhOc%C67<B23az-PAsHN&`kcC^pDUkHmNGf
zUl=>Q_^s>fDUrnprW6r%0l`jtyf4&0`qK{;oK6|Lt?^CPxTM!=k2i|fIQIFvXx1{*
zwt3$a4t42EpHx<vH;XOLcM{R5WzG4J?KqQivxJ_jIec4dw&hBWcd8)62H*JCz4N2{
zC!PAzU8<GJ>1b?g6M7Z)Z<ndQSrz`+AwZ2w#b(xa$xzp|?&y%;>Z~Zk<Z6>$(8Q7M
z3stO-$#h+&I$ovRUYi_wHS=9QM6f3$tE4!4I*j3nxpn%o-g3Gcd9k|NX`P!fJRe4_
zO{3CeT?Uf$oku6e-wQ073AD_!A6dzXwIE!xrN_3g!sID{p%{l&?i46)1k=j_oRueD
z-6SuB?t`QuM(S>uvDBBHjyq1XQhqMTsdjIRjN3;Ud?)TU!{lgZiyR5Bbzx6{jLID~
zBU6P8ym|WNk+n`Ywu0r;Y?SZra#P8>u@G}o4ytT8PR;lwO<I_zTUche^v=ik^=NT$
z=9}vMP`LvWDYy00X^)=EUUOfqTwiWwALY6eaN=waI^SgpPh5qVNY%=vP43LakEUTJ
zB3B(pxDsk!JxsiikheMOb0D>AELlWdbZzldkQH0)rmB&1t3c16<+9s~U7mr>x!3Ea
z;KFyV30wZawfQLeSX1tFyAk`8<nOtQWSo)boaWJpG`F_y+_9sIo}`}_?5R9%@%ILN
z@EKe#Z>esX(AihhdSrFwbE-hxvl+I>WQijlN6y#kw-4(w>=@Cz%jq7Ur#jSLGogCQ
zDeHYc*7n`|k;;miS6o$g8Yh`{yV*Rxdq0Eh-I8KJ=#wJen<BaGT4~9xg)gWFY%JZ1
z{X%82)E`YOE*nh$!W|&)y|MgFgy~dAuG4xzeTVJD$t+e`9quDJY8hT$VK#;hHk$?c
z)D(|u@6BbYYpcg)6#CuUDe}ZSB+zNw#(XhVSc!h)!mH7Md8|0uRa#U^(pdW4jHz8N
z^ouSb2l?U)Z1XfY+0woj^38|d5t(GLkMQ{{oj$}+;vDg+Y2kq2&B-6>axEu0)%-jA
z+0F7-g>fUC{FY?GcbQf8q)=;1b!7T4$t&koTEq8Akg!JBE`IklAEl)JKL42^CL{>E
zfX=37epHg|rc)92M7!y+H!D86Z#qr(x}Cl3sBAI6ahkPHXt&Efojm23j6$9qMHOvb
zB^9%wdIb`Ng&~{L@!uUfmcJI0&i|Si6h8DjD)5Nsj{1EVMcu>9(o$-R3`^<pTnWaF
zAqJ+6_3799578If$0jd0mc}H{cyZHL{;<f7P2Bjp*XG7`wZ{SPJ}BQwHM2E|(OK{E
zi4CKYI3?KmqiEr7DV^P{E%n)2yRN1lsv)(6mUll*9B%5wkbSNx6%#KgTwVy@ki#$g
z)*nAfVjoEj`0l#&`PYNR<;xcWzIulAr>(y^_xqa9i1B>Sz3M>yA|^?PaV;yhvn$LI
z6qAGFJl5|vLs<CX7~)QbMZVc)lbZg^!<RR>Ikwocjwr79!db;`VOICthWPHRLH}R2
zbN9HHhYQvsDb_V9#8E1D|4|2Yver@Ux#T_VV659Y@aEa}sD-QJ>C*uTy1N;7e6e?0
zIwM+qtKu`S?l-jwhd$rQ9WNFFPZTmAaj?0((Kf?!ESsA;fcEUq!P_@>3wcenRo}sD
zQ!e@hiqB0}kpq_>dFWZHJ6Psq(i~nFP?#(5HStmJv};E=$>z6&=i{?<lLBJdTX@Cj
zlMj}x4SksV5GDJ>RpCgOiSW|==rQ--ZfT42Rr#JyMSHR#ystCMZA}WQ{v6EBY`1Pu
z`!lS(xcKe0%!So}xvYe=wX&4kmU4&0MeT>MnPy6TknIwiY)y)J+$wdJ>_^qo7NYyU
z<bQrPr0I(lL{FHVGDxTB(dpb+kvDUpVzE0K*xTZ6Hu3r}kCBGC=ENKdk;jMqJ}Y{3
zxi0KJ$JKaz2{<A+qRe(2xhfh~_ku>M7T862f+~2$d~ZAVdw+gd_{Oq?&@$8?nI0vu
z?f!qYBX8CI0TrDQP|Dykr$Dzesz}Ldd%gb7TQ{Uugxl^PQr=R(1NC4<A9_%<%ex*U
zr$&r}!vqK*r@`^RxTAjZ9lb|@y%8-DJJI?=<M25@Vv`KwhHi!3-C2P}4dZ)@wzW<7
zc@gQ&LKp>ip%s*Y49-)Zpi@FLhU4OdOOl-iyq{Ji0k&)Qc%ImXcW}(fr%M<C83ZQ^
zkzF5;p^QE!h}TCM4{!`x1nj6R^8XWOM9ACuc0z}Ou|5z1kg{|U4?)(OHxw=cEb-l?
z=fLq}<-*wRfp*IP_!<n;p$In}zw>Yq=GMr(oS=-87DA1*E1X_~dv`HHmVmnz-nk64
zw2rWCPPpbIo#SvrmfF(@njb)UN015)!ZF;C^m4UAZHYi!0mw4HxM*i>J=U7m0~*5o
zc;@mJqZ}(#w}fC2dwWPS#bzp)Abbk3*MaI1NEQ<FfH!J~$ki{c&DMcz9WwwGta{`%
zIC}141S~!{Hr82R|F(#!Pb6>q<nw73p9fxE&XcF^Dg#%AK`0<105Z6oMVL-JmQX+=
z;Ewdk_8hYa<r5fHMqYz-Ql<q?hG=>Su7saI6TmWpCrMph9bD^hcB&?|crZ0Dd;eau
z;&ImBs$UM=WEtVh$n8;}O(X<-qZ<WF8vR2)Dih2@B2HTzV_~@qTWbuw_K=bSMc6<y
z;!Xw#W*w<FfIeSK9dWp5R9;%zmy}k#3(C2ws*uwb?=Tbx92KL2nTweH6e0D4>=+-P
zVnLwf?2gA|z|2e$Y20Pk1Cjh$h+&v3r2yZ|ehlFuYXQ9rF_#Fq1OO`Ly0(N03FaxZ
zCtF#0dDAg1V`3^TFCPMYh=leP+r(KS0o;$U#jbmErs>Cz(|=URUw~^EssLI8YhV&?
z<>;1#Cfz~k7#JKxkK0gQ&H|4txMyLlJM}(gX>4kO4>)UCQ;3{k@iScgVy~3s4dcwR
z3VtKxKLND_TQC_sv&)z37v&5)@O9ulA>En~_X%(i3C3@PZ4f(Pk0}w}!Ba0Ufx|av
z?V_)6(^%<mCE^Imuj%?;?u1cOTSo^B^t%9SLwrqe%h5<FwjO>()(Z@?Q4qfN5PgYn
zu35pm2tp@7^q`Mt(b2%8KQ^s~RP!G$fNZFB_9ie)`8TH(H1_S@?KGa%`XZr4FTl18
zm>wYu##bZd2+{zaFu2C6Ce3e;mG_GWaXYohIDuj=z}Pmih$BV`7@g!qX5|*6_A_=9
zZ^(MVL02S5P#=>a@+z=b9dYx@TzhXyhrPXrR20mDFvc>swe5a?^MbQ;p+*X_)q%&#
z`OypboY!SB=8t`Lg>db>#w5py2)ML60JX$9K4h<xD1b4pnglTVHB6I>%Atr%K&)~J
zSAb0EYsEZ`6xZL8PjnoIPm~@Qagxe(s%++;jm1!(%{>?#3w4c0cZ_PXv=gfV1hk<6
z?E{vLo`sh8)<uARWH8_QpWrIhp+hUHtDuFs09M1O^{}vYygp^hQ`ptPng)iy*p^_Q
zElv6)8Za&A?nZdMXuxobOhT)`R@Nzn_W_NkH0@|32dvKNxXdP?F2Irl5AExua@>Ex
zWn*^4e3K-Jq+!p>$T03EmGH!-0AkuC_6-8oj@(_K%7E)#L1w|P=(^Lsn6uESmqq(Y
z^?a3Gxb=-j<=QnsYCmCNPz0|qfx(ym1JP~#Mdv*gJL&1`#&_RAJ!#;`)JIuX%3X}x
z01EkyCcmt${GNd%cfey)Q$OGv1`{{i$!<~fl8j$4<^Yl(YJxd5ejwi}fMAJLDHgtN
zNFgwiS3g8W1vjmj*jQ{ti1IN4*S$T0tJOQN@?xAIanf7^O|Y*5R9FVwSZxjF4ptC{
zV4(ulgoNqqm~zh+#6|uEcV&h{=FFpWa&mmb2vZ*{rGmUXm<M22gplkuo*9zCVPNC4
zUYhllUzL4l&M?UzA*M5?c95LMJ&nmyW~Oo#N7mgbkoS>ynaLq~&+zQ+V=!#trV-<R
zp!onZnHeiP!p{E*7W<A1V{p6|G5*d`^Wr9uX?WWGdmtFQGMpx^cmZbZ%C%rRd$zNx
zY6Mu;j$&_xg23q{>qe?zk6-aHG9b`6e*DPAp8a<!jPJg-y!`HGcTx-y2=}T+3W)W!
z7~Q^Ca@k2uM#gjNizn>yU@PH|dFzQ2Ui2cWPW8<IH$9-@CX8kqr}{w_?|}g|CN642
zUt?`Q_^M!b^FrKV?p|`&Ti?4#@2JOc4DJQk@bNix90m^7B!Z?m)>WWJf-I2tNHF%>
z*A`3?T0apJ8vgpe1F~`nEH^+u9G|V~MAZ}(KM-91{tdtzsh9wJ=@HD`1_!fml|943
z+0oIln-P#wa7YODds+&LzRAf5xB$@8i^A?4EvYvRzhqBwrZG*4G>gjvLu&7l|BeWs
z>Qh{)vLU1*;XuPk7(P>TABp#4SyBH;ctG5VNf4GlMlslAJHUIuJELwQCWnv^C{p?N
z?+d8~6XX(@h(MV;61qhw%g-zAR%2z9)$Q@`FT|sOWFhzyoW3)7LzwJb8zE!-0*?yl
zg776nvx$6m!~RdSVuy)4j29ba>#lw*#GnE{lvh(U#F#(bG(62xa|}~OR#rny&?E!<
zvfsOHZXnyCrj@^o7e$yLwrX55q*2LETsKe3+-R@GnMjoK3UGf|7^gct!~b*g`*LRw
zAl7q9l>c_{>i{(D{#k(fcNEWXd<PQ=*7n?Xl=s(y39^bmQ{VpuF#f;5nb(+4-#?^y
zlG5@C5z+gjnBfwh655U%d|4Wtb|f#QfaJhy!O(CR@ccy4qE24vmK*8>^L^@SM8Ke=
zk?;h=(#mejx!Zqry~^g=@0}YdObV5VIL;%s1>2vi>jsK?Ov(rL?Y!TX$=vgDgpYt-
zJ_rlz!VTw6CKJekQOQe@!$gOm`y#p#f@9*bySv`qyJoN%o48JNos9XD88ML4_otwj
zvd6}bt-xYoOdY9dgm<)q0IKRi?t(+@KFoy(8Z5%Yc1g0E5#v+6KL?@rI9M65RkWPw
zJOeu}Jgi=W@PYez;V_AtC<pm|H9|f90KgADXsGHS0=~}C1g;)D^!1F5L&L(xA+ki2
zn+72V;Jyj8KZHRRl#p;e&%3?lsQ5oGcKt6M!YGTt6CQ7h^MS9s!5Lt}M3%eu?Q@-L
zkfNib3*yv7#ZIL6)nMS>eLP{{7;KTC?txwDGKveBQF9Pp%aib0-|%Utzwy__w~SEf
z*q_HIt9bg)JJf=AFwCu?c*39vTLP}}IT^y_^ku~J=hd@y;tU554!}&3@LHw+yjEId
z<R|zPBHJPJFky`FyguX&!CvLr|I^yJht-(BYy2%z<j_#gMIjX(P)JE4hgF%Tnk7rr
zj8mmBMWj+ph7l@C)F2%tVQNKE${2^AV?tDfl#x{96cX*v8?*P!b?v>cy|2Cd2TN<M
z_waq6?{nYJ{XF+BYS4W?EGl|FyZNK!@|WU;c<sCBo>35r4a-`B#S-@axt8%iSepN+
zoUG3k9i<x8D48KN5$8@QD_U!bx9`dV3^;0Htb@`VGjID{2upC(Q@2s6(ie8wk8u&N
zWLv}X(48!;(H`Q`>Qw5uh`<OPE|NZ$B72=h)hy5Zwt@EV^kipc1$qziOmBbv9AyE~
zY|L{Qr2h=@r8GL`__<ZE@L<odaCvD@qOmT1z*1?vyo*pVZK3#+BEP~LyHVbVVc<7o
zXyDGx+;d^ac~XY!>K+eq5lRM9gfM+q#qUH%<4V|2UA-eNj@6m;z6uGagnBO(K&IsC
z#Y#?|?N~C)%SaMDdzj$6RVveIuS1Z;LB=1Qcbd;-!k|}{{Q-sIwwntNW`CaN>8Gq@
zJ(l0rYf!L5*QJfFNr~?qx!zP(4lbDJ5=aE2YD|+ck!4eO_(jbjLO&Ck*MayRuA^N#
z7bki4_!f6F<RULw#yHG=Cs*`5(YL*bav7dqJ3Jv_z+az8R*sY(4*X976=-d}nhq1*
zNyiz5k#kQ$F-qAh)mGHmBP%X&F^Hu@G0J$LpjO>hD$x#)jEvm5^Cnw6B3mZK5J*NW
z_Yi7qWnMQ@6zr%@YlllxaZCssR+19S9)(t^o*kb}&C~N>!8Zy~n%Ak&)XkKL<)Vx=
zhkAykW-#y6-rkbtN^|ihdcCK`xon{V=a0cQLapNrBt9D>47K0zpcAfJ8`Uf^KDN<Q
z-$D>!zd6;IZ`U4oHnQ$kZ*TVBnHDJTZf$XE-H}x$8q{1w6uq==P@`p7ndkoG)o$a$
zn$tq&*LzrskNN*^-S6S7StB-e?e`M1@%#DBsFc;a*wT2ERcTxAr5u=P(J{~Yhf!a-
z*)Quiq1WmibN5O2nfvP+8C@eqqbEsE@2QAY3PKhxtfBUPHM{<^4k%|_(1+5-sIp@<
z*W@*KOC)agBc})D?UwIJ2+%DIuiX5`(05*zl=gCIhRZ%KIq50snHWY5?<XH;Fv-};
zxY~n9k3yOyU;B1-@FuuKYLLq`jC6gQnhSUL-F#1R&YC5Ph6hfYQA7<_qjTK()wc)<
zf-o^eKy?4!z4MWSsCEbD$|kOEbYmB1DI<J8f8oLa=USp6u>1p#Qz^a(VZKXs5|^zs
zlfc*tP^^-d^QlYrhm?UvF+pSI6yqESx#&B78S5)UQ;YmZRM1fPmJGnTD-b~p5T6iR
zk@rKgT2fw~tGkaw!K-T)4Ez8hp;UsFV8~`CMHBr)v|b>;+dj}7h0f4n!))E7;=4y5
z8VS@R>m&rB4E%ug*N|9Jd2z}{dAa%c@oRADh|lkT)xz1`<@~@87EJ}Xx%~kUr}{}c
zH$d;!owF4es$c<hf35R*Ce2F?o!<LkLu6dU&&QjCM|D<JO_&t=sqk%;#fpc;SQ!mk
z_ipl%nwI#|@&PR^_ui?-%(-T?ciXt8)Ul@y*WIdODc;U<7=bE;A*5@sPkf7-;V~(1
zMJ9d&qXD|K96*4uWoYZ@B!S7Zq&*NXAU>Ed_vY+j6DQK$QYU)S$i1AoUi2NNHsrQR
zyO~-5K!LV<IT%zwL|dLn=gixT1>G7EL67hVef^UlZvJn$uO+QEJh_CJHpDE5@b0+j
zy*ZcWi{b$+2vorpauR88*^zlm2Mars(EEuNn8EL}9}P}u{kjCn&WPDZ*x68}ilUTS
zh@nWUmZ$iKVc3<NoSe}1bxFaPH@2&8F2K5u;rk!?z+2v{=%N+55{>>(AL(8=qM2|y
zZP~`=fDGRck88hA%9`kI4`V^^aq4|>P6pYvQ;vhqojWnts!GcL(4ChkXWV<~ojkWV
zv%M9Sx!u$9bG=dl&d4>`1%?b6f^`z1v5XKa&BPCLXgHBPN$$YR(;t64%OX2m7W%KT
zj<#7+<GIHVgZuGt1B>rX+cK)Hm&huqL^E`G-Wrk(?cZ5RDRG~*NvDI&kwJ>~U_)c!
zFzotB&i-2W`U~uK7j$h?rI|ED&kt%a%W!j#dbYT&7p2f?G9x6thkltDBvm<ZGVA)q
zi+Ocz9XloE*Zum(lP9>u`rOaYEhuoykuEu~UaQQixqW^0_F5h%o3owOHLIcF`<}gf
z9}j--*U-BvwC$sAbp2AvlI2h9{T~}Uo|o$ung$2dEp<C`Ii6pYDLdbP8TlOBg2I+(
znPS>$Y~1$YLE9$?IZ+Bo#?fV?4jOhI4Sq~bZ!rah;jPvdKV@3Juh}Vf$86r**UUR+
z<|EcnRYk=F6BEZ%e{x}gyEJZ>+Icmg^LzQ~mFB>K`Kz0ZVwIJY`t?efM$^s8m2xz5
z#1&?xvH;#Fc{sV0UWUSvsJ3kIIRZ~qx<OPPiE26eV0duRt2mwH9aY=M7#W<s(Ad;e
zgu5>iR#YPXuqUKOEnT|3J@({oLP@#$GIuw7(~4K;rm8%utIH^4z~Y0UejyHZ&%1?$
zENfM|w7V=N_owSd3ykKtm8}T!%rPx{@E{Z>j*}v@C>=Si7rXMUaXk}{N*F9>Z+|65
z-x-zRIGkwp@0{L0w&bvyO}z4rsK%Azswr%R-TJ+)n+ZD$hd#3w`CEJJxohpyA8rjr
z@uz2*M^nn9C~`9o&-Fi+fNA9Or>ai(eZnR?1Ei;^i0SSS<-T%@o7OJlCI)nimAt76
zY7+5UcDB>!+pd<oZ=7t&hbOnshfdGV3Fkp5?QX1F+BkpBBc-dCv0A?BnX22Bldab|
z8?x@EYD{!iKmUL_pZ5E{>(3KC>;jff7q2=J%cwnj0s+?q*|&TRG!D-tw~qcOrU&h4
zoQgX=zzFSgxEiz?G2&{%Xvam23PEXxRPjA)WnWOEx!39B&K<7K`Yc~6RnoJtups%y
z(Ty3~D9?_fNHsKckVyJl1RPFJ$KKC_W(KTl)reOwvQAXxd-?RIbB{Qp(xb--8sx~3
zpUl0qvJ=a~VfzgCsPi~+^`EfPlY;?murH1{T9D*Frs0~Yu0hC!eJmB&A*T$=;`i>~
zM}i7~T-m$-&9he*+$@iIQK%5{+qtR9M2n&L8(zYk-Ny$<+7Jj*TJ95k5|8SK%uC6+
zzOBgGt0~`XN!;o4Cl5br_K(<6#_hbiZz73L74!f~a+U?70y5=?AfgazFdK+*Rd?>Z
zT^{-&;q{(8V!1XG70#Vo#0KIZyE&&8^`igEm5eQr%dfKAF;@Vt;#OOTs%K(3O&#X`
zPf)m7&|Zd7!dk_AM2QDBX+49#BUaN4ZZ@vGbjbkJ=A2Q>lZ544+D^5VtsY-dwdV0Q
z+P`QuxzB@+()Z@pyLDZQQx3-Sr|QeJ4qe$Lp#};3MXw)S<?iC;*DB4Mx#U^Iv$PAJ
zfDD*r-UY+lzHO$XQw<ASI@>dGQ^LSg0X{A9`5MdW9z-j7|2@o#st0u4S8m)GWoha5
z>ddRZ!pn32okorovVX=Febe+Am9@w697L-WE35fyI}Q2?=IO@1PunXhUnIp|Su+Yf
z?$;7Yyt)74`UD$Q7UtQ;nnBB_sxsdbyHHh;WyhFcG$SI>7p$0D{k@`m%8BOL0V^u?
z4GgwKMjDS8!KKA^H0iaghOm1}MCX$3=zDfg4oc|jz5Ifz^=}WXx-LNAEC~N=8P<Oa
zU0m(jW)!{bj4~%*K`1#dVt(O@^#N&S?RJH6+S@w6n5A&6BkRN<_8H|2{^EB*u{c|V
zX(rI}+tiX^f-#+Q9f(jYtTQakP~gT>abA##C>je9!G|t#@5CPbs~Gnz;kBsk+Red)
zS&2xg7i>X^=t=FNsGo(mNvwsM(EIbh$w;4yj?aJlq=)E-zPtwf`>#KWqiGREIreCc
ztOvCpn|NHGKdmUc!<X0K1HK%XlWdN=yYcG5!pQFJ2MR*_a#a8ANB#RLJ`8IAc(0!k
zP=W+VH5^1qmk5wK5Lpu34j}62+!IIM9|Bex(v%B_-;k_WvW!AX!`)w}$d>JpiksB(
zqK^UJejDp^M&Vdrq*|Wz3fpW(uNfB?w=@pGhOgbU90ftX9$`D&27;N7z#I)5=E$mK
z$^DQ*V&VP{Dyp{YS7D3Lj!hM@h0CtEIFVd96-;tUJ*HH)$EHI`BTvi3cMpFgO2O{@
z{I2Q7CBA;_m@zr1-T+0%L`9X565HFmJbO`fk@85hDY2yng6A0H!q?1oxk(Qg^`Ml!
zB9>IuCQHY7V7UKgVI<<ZjowxsqR8yzN?H~vOZBoT`13c_c==0!7AR_kpWj;Oz}oI=
zVYdGexV@$<w7R~m0k(cTlWW8kwhSq!&1T{XZ9o?_HHC=8cE~Ig0)UuuV`>~Lsb$Ve
zjjFQssb*3V8d4JpZ^U+3S-Mb3^%u;azmK#9m%U>uoR1-i5<2U$GSU*K46L+@yN(x5
z9&|ax86iUbM&;4dr)$_n()X=>w!f`4{oW4>$JFgN%>4&eEAa94Ma8v9JDf{F+J{vu
zq-9O_E@4XAS@M<foAd)gbkDT{YofVP$aU%6CiUppvExO}uLRZKhQ9M1JYj-N<%~1%
z_6$8DFijd=&e2!UNL5IrhbGS$VfYQ&V@~e$yXpuKJX;Tq7M-=J@_cM<g~}Q35U;MO
zY51{3Nsy1qm1$~d+$KZ8zf&T@z}}^j%YNwI=v7}{c|0pSyR>*QA)lIHDDsi_f^OK@
z;zA=~0ZX(?tRxpgl<k~-WZnVC*G&&5aljKM<dY<#neDPMNiKg)mj2;wQ(JX}G3_hE
zwWpF`<1&7NKGVA7YQZDmUcI7;7LZww35F37a9+D@4$PP_!xb0<5#QBke{AfVQaj^@
zs=~P>^+@Ze8X?{F?QIy=92PWBNYlxRd0<@BIvPnF$v5pn*R4MIP;r?iwe+jG$h;!-
z(uD;DkPK@Aw8BoVII5bcG-JdfsjDmFjEZ>++HA)3VfcA2<rzo5Ei#g<lL8@KXMJye
zEyyDI7Q-nr{q*?w{;5uZKo8y#N}5Os_SRt#dS%X%NYmVy{YbZX+p`Bnq3sfIxAa+i
z<tGY&4>TM6)U}`A!(xRe`viHXxA}r>R=4*f=VVV+`AS{g#mOmY-sz=xj5@fF9>{!v
ztEOJ+efro{iYC0iK^=ugJ?M`?rk+u1I$T@AXAsj78{mbRY*fas{8>hDlJyJTsf0Ne
zxdp@2{T*>-n?a^fsih#8M@uiI;nY!8HUEI)z=>;JobN)5dz?{R(5OuJE^Z2D8c6u3
zZ?wTP-O<%m@4^isua|hO%(zx#aG%tkYGbn@;6Su_>Oxe}6{}c!8`UU3dR0CaR&07W
zzmN3@zGF(N6Ie)JeGAi!93D~U+j?Dp7=^1FE^S~L>f|{&{yRJC3nuLs;pfQb7avo|
z(i*qS4bTqpo4SJr5Y|4!*si4n0BWdACcp3aHO2}U$G&e0Z407;wRn5qV$H1M$Bz?q
zfY}y|ds?yLn2X-W))O-uSa8E>c#~Q2D)lR>r1<M5eVjZ+SZy%kWCzdm)2%P<w0~zF
zhN*aDqs-FPZ5VPH^5R^d_&Ab28<mEhg2{R6PQ+y8u6+~#rO#B^-iES;-WFmWmzlY9
z7a0ugIgC8z&R*$jAVk>8^dp%qt38#ZK5Zx?xEDEi4UcyE(djXY*2Yx|a+bIysZO|B
zMUm`AwcDR!*TkZX$r(QgCR*Zph?F~N5!Y>0fR_$4nIe5To{3u}BPjuO*1mN4^4va}
zVF8<1iCNQSft5Mg-YvQY>RsmOD6IHU&9$%R+Mi{DgUUBjX_|f=aPe|{=@I5B7=%-E
zTsCi|P~yjv*3g^7NO`b-Jk6773o#TmT*@gp<%~4*e0ae`upa)`p{5LdNeM2#=hbnA
zdn7H1sSCLQNgDkO!U7^bAA^36y1AC}NuK6`FKZGL2Rm0{&QbEoMlEA<!_;2F)-#1h
zVP!+IVy1IFh;`J%bF#Bjc2Fcc{i&rs?f5H#?$ULqswuL+15A^<QbYE-=Bgm?z+rk$
zER_VZJ#nk206US~I*-S}i6M!P2h5RsMmL{pNsXJ|(}w^5anQ^T9tK|y+lNX`1)UtU
z0%?kC{2f(N>cOwhyD<Cu5%mvKW9BdxEV-_wtgPH%sUd9rome);af(%Gt;OKMi4Y~H
zf{8Dkp6nwoKzQe#Fg7xx52Tk3z37J>dI-guH6*Zv3#pzuM|?w_fY(3tXyx6z2Q#Q&
zYybWEiBj-N{e_AYkG@X0qd_c$OGPFHBl356cv@hp#lq!7HF{yFrSO?!%kjdM#(RK7
z*ndAi`r_5-wo#TfcF~Gni^Z7bS(4b=8l38MlC0clUjA;ELN1Gy6*`onx6RE~#80}7
z47c>M4oY;&V7p`Xbdrlf(Z}XWF21*vSqbTBY3o?*)M)@PHYzkDQ7R){X9lA8@;S3-
zkK^blu3H%xcyre|!O;Ud3+7SMOHJr5`b}CFObOH4x|sAl^@ZJnfmXq5(1EaN^7XUq
z>`v7mIkn8|7onnqcvJcgDvy2uIV$#OF_j+4#xz@7if?bwxcrn!AMlg)%366en=yY6
z`kpS8QGOC(F@SZ?u3b-RYh#&d&l$tV^mTvB1a+WCjNc^`3VxEr!tdmzPVB&U<_GyQ
zC!HS~!1!j?4e^<V4A57uY@SrQD>il&`vH3dU1d9MRFqY_Oj06iO`kb+vWxO2NJ4m{
z_2#<56WXp!S<ieMAeLqf4>m&4)#$kB<W2nsn4K)mOioIoKI|~7vwRBa7LLoF{2Gxc
z>)=6?V|(!7<=kjrsX+NKHUj<rZ>%wAB>G8&HoWcYZoGqTX{VLJpR{v8q|^Ner}tiK
pJP9Dr*ZCo2y!Sd17q-4=>p+J^Ui!O^{WxS{rtPe$M{GPc{2RYsz|Q~x

literal 0
HcmV?d00001

diff --git a/docs/dev/pictures/mpt_tree.png b/docs/dev/pictures/mpt_tree.png
new file mode 100644
index 0000000000000000000000000000000000000000..eef76442e23f6ecbc77a082060f4e3257ed2b73e
GIT binary patch
literal 19753
zcmc({2RxR4-#30zR%XiHD-}hV*;`UZgv`<)GP60I%Bal9C}bu=&SY=OmK7p<6WM$J
zKZkx@*L`2lb>H{(-2dl(o}<@GoX2r~kK?;O<Nbbrj^`R`%B08WkD*W~QkBaJ*HI|k
z2^0!voe&p3(ObTU1OMThswyj>4v>EdWvMSwC{~n;f~>Yn?A(C6hPGMU!BQ%YuOeZt
zPmDrB`*S9Gnlm;R=4;pG0+(<vv|o6g@I5P{v+%vBEKjsHZ~Y8k^!sZUZ@*FLf9(=P
zRCRIUl)iXqwW?rp%c}s6G>Y&T9IEkeRY&E%Z0*^dk|fDJx9TeuwK2=L-InSa*U{>_
zyNPc3DSSDMbG7;w|7Ho1^|wB8-~C$>@~X70wrrI{r0~FnL97^&O6krB->w}D83|df
zK(5acNopDv&ZThtr$0+3_P*Y`ch9UPw#aj@n1cP(sr#eV&z*<R8?3@4DAcfx+f+nW
zR@Pi!LB)EnCCz!m>9q{^`69EmnXaZNK5`Ng#>`0=GeY@R^~v{{nTCb7Bi$yLIn$?s
zfq~>wo2-{E{g}G8Lb{cM?%Z@$n6VJRe@b8HN8cA%l~|jdSSy^-IkeJfa<JX~TEI+L
zSa{GWetLRZU3$;qS5LN-b&PtN-NX0U&9sabj0_eJ|9m;~I;M$-l$7)Yw_0Xa*8G%p
zLqh{*tI1@(bVbc1znQyJG{3XwJ_(snFsV>Jowt0@9r++Do%a<3EUW#GTGymA3E9%q
z)8jDvu0w(i93nP@tIj7-D6c3yLbk@nMyG{A$u`LXn;~Ok<9Y8>Mc9;-d!1>T>XK{P
zXmptgz3oET#{LL7X0a*WZ@uSXer9Ioox0$y44gnSm*Zn}%*QC?N;d}Gjf{+r4CG{F
z%<gRrZOFdt-)P{D7ZeuWZ#~#;ZS`Ewp)v8u&dYOr!SL~ZbM(%9iTb|lXCESQr(d+=
z_%f=V8zn>N&5@@%8C@26+xH^PB)$aDwk~RTQH-`F%Foa3)=BTTX9O*ECWlDrU%&pz
zygg~5;$Z(^ui_voENr=v2fMrYh1~mxS7&FZ?9QXM{M2|)x0T7}FHgy(oqoOQve=8l
zY(=R{ZQbQ(sC4n8xezyUMkQ=?bhN+Ex%%1hiv2Y#jLYs!2G)9@*m3szhXoj0P2^}#
zlz-|U5D>yF={ETlW~~L8^KU7tQRj_{?Z%X}v^rq*aBqG4*^z4Y^%a}Qa#qQFZ?U7L
znOW*Ck1}@WXOPI?Wi_?nXV0EJf8NmC93gUwlk+4EO_Ox@_wUEpqGMvXRH7wZmlrSx
z?kZtAAM~jh85vKU5U}V>Q)WSHhrL}W-<f}H7N>IM3cZxaW`EJ6jP&&FA-~7@bo$E!
z&O;43r4l6X)ZWa{x>JtPS$uKv>wDruaqZf*`H2Vy5$jB&5}oDY;_2I8{79L^v<Z*X
z(LLa&^&_F9q^3UQLkO#ijLga1T|=V{i`ko%KG<rl*qgIaRaK35n|a@D>~00$3z6EM
z_KMauHZFIX>&2FDH$D^|Ds|1t&CQJ$-=7qzxMVk4-JvdB=CNh(+VtsOlbD#8TD+8%
zApOenGPCFA2n^cMql;+5!k~{IKjv9>@7G~=>ufMPeaJ?Lhh=&H{$%HSt(BD(v*u`_
zgeX&qFAK2S4PH>NpFP`HMyw5!(ZU_)B1gD179!m!GMNht$;s((@Z7B{TvsMTr1z&C
zN_M?V2bAXv$AUk7`cxA@qaG`2CnHWqcTpkiEnmg%MJXvMc6QTmZ&l`nh8rVzSUeVG
zVVE91%%m_Ks|_;9e|YB1nXM_z{?vZOGmmaY3Q9`$*5!_O*BIJ@1I<pq5Uv%#mxV`y
zEnZd{78_gYx^iEAzchfc<B_|WnVEq>3`1W`bTmB!!$h|rEy;xo7mirOHQYVR%i9lQ
z@={&ulGCpq*add;{YBOeIiEg#yTyO^{(Z50A3wkE-QAC*Zt-7;OXLbPD<h(mlh_>g
z=2nk$xHEO>(WJ}f)KgLh;fFo^Y(DMgtBWaaTgy#+n3b5JQrJka@o;c(V68VbHO27X
z{w#B#8}$Y`2HM-RVW;{M(}1P%dx{(d1qDs&g<agZ8<||ExVVVef?1@QnV9CRpKeO9
z8(CUfzMP$cF`1j23*Np2tLbgoQlKmatIy_ED`vh{mlhu%|GaT&55cwN&gUn%CtKsC
zJ$E+;N}LJs@FvE`k(~kiGa7jall0Qk(!#>RvNB0gQBg6m-dp_j1QxrSODyQsP>Rpi
z1r^&f8EP9rAt8J`JTEb7SFe6;Y}C&-^&K0<CMB_#49t6SCo))BSz$|;uUx<W4K`(T
zboBV_37FLjZ8e@%E`GTDaU)V&pZYL61sI0uVA$MmE6!7vN03YJ+V&UP*{`s3aG1D^
z_*!;nt+}bS8V`N{kz)pf%6R<vZ9#g0ix<flMOkgISy}n|AKt%z4>oMU#&d<CeQNuW
zN|;)#=xyN`4h{}jl3Xfb&G!v*?q9od<%*u39y|@~|2Zdj>6i-%!tw%!Ln>@{B;?P5
zy=of@US6B+CRmMVI`#5>c6NKkwFTASZ?G0zU0s(^bE-jiRD-Piri86}IV;v+ZHc?B
zrgcn#)lbWAUStGoy1la@5HId*4YmgMW&tUW|DNY$et!Pv&!1ys8Mg-Sr*>`*XoGK%
zFw6O2567cNM*Skcoy(U;V3O<GR!-~QxFNY*&tc-Zl@h>I8^TgyGbFWz%O!Mutmpcj
zm<ytvqQZZ77&lY)M^<dZUcNlooszcc%WpQ#UPY(ZnEuGO>We?vHCyweLZK3r{0ve)
z`}_M>>`w6MVvVWfs%vVl!3JBMZujmJj@P(Dt@BS>wtlUfd*!gtwZj@?JsN+%Bw}>u
zIQXD%p}PNjKk>FoaQ4|S>}(07foA4JV{~eoCg6~-q?Rm@FEf=Z;_82P@r&e-6Y|=I
zphrV&`G59jF+?J$#(Vs<y8}n1UvM@IUGq}shg~ej*xGs6Gfk5!tLdo&GqK$Re==l$
z7t{ZB=6|>6|JC*UJ!0bGdjm%+EoocZD7iw+mXDP_fPIjmi;WYq{Qg$u<teq;&8?|;
z@qDaN$#;vq!AGr<I~xlXo_pJ1R+(vNXjoV(JhqnKy*st_Ksd&#EB(f)muDm-B+i|i
zTm9J~_Y9WdjSL+wZf<2o#pW0hY;m!^r@gG~<A%Hb5dH)O8I`%^1q6AyBlqtLF(Wcg
zDjWN$6!NX3<JzeX*cMzWVh+<93JMDH^4_Irh%p=;9T5W?6A8wuzrVkyN7Q}&*HdP<
z%Y)^&s-DmZ+}FNw!_nC}Dk8$D*g+-iEts;FH{u&JT^USFOyH!O>g%UxX3p~P5EBs<
z*^WHnQ~`sLsvaN7+3-^-eqHxVuCpL*tJ}M><ixrqi3Fx$+$nEPm7hO<f-$v~U<Bj!
z{e!{8T#T?)n20glfl$-P=$tg~nKQ@bI=i|Ws!EfRlBS5iBYxV#!eacXQ;8%m@2_7!
za-#T5$jHbBbIjCLRRhKv)I`?f*9T?Q%@@r1<JPXaE6YC}d%eags;RFZ9Us3iSiZEh
zB#9}vpYY#(Bq#S|R~{ZyLqo&VG-=lshGDrD!n1?~)~!VOd-qbRZq<MNDj3szKj(*O
z_HW-1bM+nUf2+QHE>6y?uP;svS9!}3rZV6lOHFY5P5i*KOSV^z)aAT=%gM*bCnVH0
zcRVaEuH1S+tWG}X$FKT@66b|Tk;bjE{CpixJ$?PNZsX2HwbL3#Mppc^<GAm%z~I}I
zt$l}3%St$AHmD%wv2$C1pp)S8@-i}hkCUr*Gv_zdH9Os<L?uc4rC3bw+-Z%ybf=*2
zV5j0hTtdQ-xlyu}KqYJ*f-=Pb>b%@sSb29^V!?ZT4J~Mm5wZE6c~eM8NU~cwCntx7
zSC2J{5uD{9=3uX-r3L)8{8O?$h~UCFA@t@G72TX{j)76FSeii-pk-B+zZ}=0Z7oh2
zga_f(n%zmgnl8?=9fz-!+-@$2Pe4G-#@I)&8VxhMwY8;{szypq&LU#nZx)Z9>=|6~
zNW)@HKHXKhdiCnVhYukZ^JtFZR5^F<9FJ}m<0bpMdU~%s_KG-FV9i7P0a3v1+qYFz
zR3OC5>zgxcje8^EYOkOGuJ>zwy{PT57pDp`;WLA>@!!6-PtzSfSus3We?a4)w69k8
z*5Z80f|#0jT3Q+vkIqRds+5!zA~x_wz7*Eot?t3@j+))#)0VxW^vnEYgoOO`L4jtH
zTHWopJm*zy%RX33E><1^mvQORB^J-k+eStMO?(xl5Wt0ng<ZH)OG|>!Ry|r1us5Jo
z$pPKvD_gyO>sCU$`9o{#b>~N3`=*{wXX}SZy)X)jie25^1V@h&veDDi-*1U^o$tSt
z^CLDszT$2}7(~hj=b~`ahY5N3$~Q+<`N{-MtDhAYi(y2LP18)8K|WR3dOyc%u=L0M
z9MWms#`cZ7qW0sL?d-A_SxYf{Yu)M+OFkk7L?p2snZNprw4_K`+<#rz(hVk`{Y74z
z<90!MBV~K(*MiU)Dua)=9#ec?S`wEGneroL@Sz~4=3O+I-JaN9n}raCO72zj<o5P9
z3ugDi*|S#&Vc(p6Z&lO%$ZZyDIU`BG{LS;$tzq$n(vE?FbC|H|_gbmr%%rPYLS3q5
z3kkaX(w2ecZnKWc!Hmb{6qJ;NMMP93mDDXQXBS7l_)@^fOOH+%%{X4X9JUI1geKwb
zY`t;r=_QXgEsT-Y&-TsrJ{$1#-cOz!BPQlj+3twn=k%e4h2iX6(4Xu)=vp^q#mIRU
zO;F~$b@R^AS=qRc`X6*M@*q)aiaaM-Ky&h>ppZ~Q#hO-!HCFfah4bgt2(z6RjM=J_
z6a#h##44|GC<UHAf8KLrz!|f@5+4xnw+a(Dk#W+Of{Kc2{~-%L@k$Q<mbk!sgH}R5
z7WErG8|4i~VQ(Q5?dj2DQ&3TPUaDxrp<uJ;c<qRC@|5X|RjrUXmr){2f#nPHVWw4z
zm7K`wi~=e4rw*>NolD+b7HiHW)(t-!SS=qu^ne78k$lZXYWjUe)`Ma5RYQ_6&zbh|
zhL?K-S+Ys6)gOIrjZVZ4Za?Gr+?1?5GBQxp&=$qqN+7w`Ekw!~1lvf5Fxzd-Vk@yf
z8QjTs!3}SvBMS*rui}N|32(pfoDuF9MsKesD~E_N!^muLYSO1#CY`TW-QT8TL*~#z
znm&vZ97lI&XRMf`#qxNA+@2);>9VyAomcUBRk!$I+0)c-sQdXK$1~>m@XXUkB<WB$
z#2sg}uU%`d59Q##7CpX@Ul|Yg^e!F6TTYn-qXkD}>95$AIBp#qEv(ZgR&wsY&@KHE
z`h$vg@Dg2u$e}q=pWdBR-}TwL$x!H7WBE=!{=APyZ(|xaw>Me0vTxk>Y;<}^ZNp3M
zg_4ExP!44sU0v}Rp7i-phSl#T-LK-iT5j=A&+m|-jTqMlW=k%dFAM8GlPd3M$cuj=
zE+TNtHNinB?k4#+-p0T-ZffrYkFTxPZANItcUkn&3`D&=+}_2(l&mFPZ)5|_@-(`|
zYj!2f)3D|g4NPveZ)7ztPMQ^j>gM`EA8Ji0!UMN{oEWFNHgeaiW$A*Q2JfU9Ih^%=
ziF4}$VPo~~uS?7RO12kKy!f)OU&WU_DNVwQCGmoD{&4QxI91o!UDRDT`2bEnD^0S7
zlYup?r%6|GoI`cB17G6UBG-Q2{pC1Ll{b19<z@=aR_*>G9;dqTZ~o*Mr&=3<v$ro0
z9)q*u<5Usw=Qdn?rE>R|)_4TYD+uy~nZ)riCIo8u34GMvtgqr7y-Jhl;f`9o_*Dz9
z;t9Op3RrKrK^Re0RR#7eSt-bEwOtuD7?{U6*U8s!-@YCB^0f7hctLvl70*cqo6=B-
zagQHAe&WQ-n3!1y6OmpCr(b$(K0h92VX@B1dzD^k=AJI=Kg@h7U>UAE%MYKKG%HL9
z-l`9fc<oyUfi8N-sqV|a8YVauV;QU_?^fQru4?>qejaj=lX9>;8;7hOr@o3G!JU=0
zF1DX&B!EnDGRCI1ww8=Z%mGrxA&-@7Dk=>x*yK4?wjmQUFff4pY_bM7@5e(a05t9?
zCBQ;xqgly06{_2>ee)({+!qA|5Rd*aUynC2F>!5e4f2DJA8q^ct%!(-wBB94<g%Dh
zVQ|cx&KW<EZ_@1Av1R8Yot&)03rpwEoKYdPgUkt#B4hO?aF;DD^V8EkklTIsC1zk?
z`10k8`}}NN01cm7jPM+oJcu@!%TFedQaa<0aKqMCM&Cn?j*T@nHjc-iIB^0}Pn}FX
zO#=fSA9HK#^JmX~>YJOGn5e0#f$aoS)!yEY@6E=~|FOG#o(=#SNTmVU&@?ewa5X`Z
z!ulcm+S)rcHEV|dhPzD4ZWN{`I503)$TIR@ccC5V0rM3I37Mi2y1TlHy73a?wJ%89
zn!Tvym;Qq1-8r^=U-AV_QCF9xa*X@nsQSopsgzv-#jv;I<KvJAf{VWvC-Gyb`7zCD
zOy?T1rS!<Jzx<7*g@5K?)gyWGnO}N`-c|9QC>II_71<GJ|I#F>SW2&I*mj(gW<zY)
zG|JSY4#BWNs8@1AUg&oEYvKOcg*5d%XKT;kppgwycer01$HKkHvT2XrxaGNie%XJ<
z?uv{J+((~Z+WokzBC#k}0t@UsBiMPqrAfzQDcgv^8i;*uHI_AQCsQMu#tD$s;FvUP
z4b>I&)xzzC-QF3n^+SG~>cdF5mmkvb9nbZnu8Q8!(hX>7?p6E%_s_tJkb)ij-j3OB
zYzULM4k2WvvokXej+qi8wU57X;xPx!&(Bv^E3hG6vA<^k`=!yQbpQNjctuDgd{1lA
zOhm(^o%gzgpkEEEIsQrx!;{?sud2xsy|XlFR8;O0TBeX|PPM#=f!G4J<Jj03!8W`9
zOsINxb%L$&O%hWH9=eqk850Ff$>lTNRWfMBvCB(s_|L_?6E1yiJtAk^E~Q3fjtY=%
z<D8t@=fF<mrXKAKhO;-mw(cnyw-c)orP07yVK~c*ohD2@s_hR?!o0F#6{@>hvv$S~
zw$$g(a+o~QLMj+Bg0HPvbgPd<!m(!-J&Oz;n47<_NfL-@4vv{FE-6tCq_vyt%?k^o
z45(q(?&83<8GsLOX@9|a=F+92ckd7&=_R+i(~e_!M{-qS!G7_(BnZuZo!k(Z4evO~
zLP5cg+4orLIJk%73ro59^R5TaIMo|_w=4BD0_6w$JNwp5i_S3mHm~B}m`c`LcIv&E
zz2OoV9L#*d6cQKt2M-=tSftatj}w)Fcl2c>wK<1RRI_T{HvOR@>-~~Bzw}16+l#@q
zD@%~S-@JKK?is)t7!gv6CpE0ov@4JJ#;NvZ=I5!=YR>^pJci~AmD7Y(Bn8n@joXXv
zv<$KCo}O3H(c8n`<mdHs&DVeZ`0(L_{fOPyR~LeUf*`6reePTYR!&znL?SiIxve|g
zR<N{?mNUFPx#}&_-7F*$rJ0r8zF}zC-`4igePbSvm^zU5!l*Bev0jBIT3=ruo=aCZ
zs?Dz9cw?0*#p?5|A7^HGjFYo=&-*~@0O%|XmbnAE!)J4WK1l8vK&|D;$s9sLHwNd|
zm;rhNP_4QI`;#i&odA7>NSQ-KWMi${#H7q^4YSvcaox9&nmImplS<oJ@KwC~1zHlh
zCsFlvokJgNl_9PMoEb*2L-S%n)D?C0*5>9nkR?<Do^<t<?PxVo-TG9VyLE5wgZnu}
zX=&5Fd6prP>v|BlLw5j3v+gfslm3vGw}xP%YHDP}#5sDrscLV+IDdlwcAtE024S)v
zIg6C@e1CfS*{uef(j_IpNg(Zn_}|((D<Ej^?VxiT&90{)tS7LCz7)&+fW6#o?R1C7
zy=Q?w2v;ea^7igHaYqLGA}-GQ;_EDvit{Sp010MiXNORFd=7kBdPc^}cmQ&8fBpJ3
zIXMaL0pKO+)i(L%br^4$tz^jRN=iyHGk*bG6vlZD;4y&y06dwSp4Ka{Hd0bj($&?4
zsknT(9$XfuiiM@6IC?wxcY1+8D9g9J)4us{gHc`M7fYFD^rG}%TW35EPAVROr}Qu_
zbe4M9^Ra5l7JP(3fptWIO>eHspv%v1Tx<%Cj(KA?L~JuNGw`^F(Wa!yN5}#RHMO)j
zq;vb`Ak~2k2Z3&FZ5QJt-C=Pssyh{DALOo*xwR}PkNq%<r;^JwF6%Ymt9SV>aE^&|
zprzH&hM1d|TGi9D+<m8U$Z2GA3jo#SR&Zs@<av2{va+)F?@b6VSahCty>sKn4GoPK
zyKRYo5YOmCN0_ZACoexcJA3Vv*6rIPfHhH4Qog(T+J13Zmd&RlNP|NqY<;ee+jIM>
zI(bB7<i)r|x<8q&dtFBmb4qF|)}WwesqLY#`0~#DK*>aqy(jj=hX|I)$Vh+YEu*Xp
zV%oa83?%qPUO%<n-FFOZ%7g%Zh-sd58?$<_z_jXv3GvgV_Ab3HZ6;yqy&mjGRwuAV
z<?;h=Td_GB0KxY;gM5#jxdH@G#BxKl(huosQBe`>M*vAJzh}Y*R`c-iFf|<oFgVU_
z=FFD%89qM1Q0z@jO?7m>`&03Zf4=kR(IZXG&;e^m&H2usx3;k%CnF0E4i=^*dHndX
zn#lGTZKYP6$JJQFYuS3dU|t}h3maQMwt?VCGt8}f>LRw+{&ab2YD)c$n2>~o2jtiB
z==IlkN;oQ1!?aCIkd*G#t5-ceJqS)1&8HFuQ>l|>c*%ae9$@#}T*0j;yfMxBz`lfs
zhr=h(A7C+h=hkz~TGiqtF0r$JHW$2q_b#KTtxOnaDg(OLgmh)B-FBfRp}gxPl4#R=
zdwcs*1kW9@AR4<V0NBc^XdFTA5yN4R7u$jEj_rfu(?rtDq$1SbgXj$-<*U#A{Q=Qc
z1QG>s5DNB-7q1hJtgk%}G_z_OY;PNJxi3lR^{FtMcD3>dd3AL)xONYqfB+N%w0;@V
zM1Wgs1L-&_>LFP|_n4x}X~q}uQI$g~)&q2qRo^f%0dvmkV-6mo;$h80VHg~~o1Zv^
zgw}Le3h-pk)$=UA!&dC~0w@>rP`GaaNTvuL-9fuLroDrR?xMXnvgj|35b+y(EGdr2
z+W9V#oYUMnd@2e#co>O;-4#4MJTwN@@8a%C>(ux-iJX8$kwBWR9(1j@0#mX0?P(!u
zk*|EA%~E><tzVE*#$5ESV1L~nU{N51l$DfpbaY^!iv{~N-xqj&6_yQTquKf&q^tml
z0vZn>5wKkd|KqhjN2LRVl+^y_7(|?HrrGuJ?e7aVbdjVF5G8j>`{rBx8YVcbJ`{&6
zS$=Nr!ylhgrq-W4d4fQ81?AS>eF4xV|IPQ>@^*M__{+z<Dnf0x(Q9402KxHr=Y(VC
zz)I6d&J(Pk*`W50^^1Ve;Rpd4AsaJ#Rg)!;y7Cq~7PT2u&J|h3n^ov+_M+n>yAL5D
zA@~F|B$2$-0qW7jw`}e9{JYI<gf!uiuEEna+EE1<n$iI|HEdYK?j!2DJdWNN5CN!Q
zOI2k%r|H9Ie=Rq6%o=1<ux4_*Il2oy@hYWl!}Z3Wdg~Y-KVm{cuc3#N;51H!I*=*X
z29OI51(NR(JV%U3*fUXX^2Rue<l|4SxFg3-0+lYlgBitbyf!xI;UJ?>MAezBXODUD
zkL#e&qizP+_Q5Xo-q}z~B=hV@Ri}|dKpu*HodfApEiXSN{o|M}?#ULCibzp2dDnI?
z1TPp@OiA>$*05r=0oZAyGzv2N?v2{KiJ|t^!^d?9-aclnA|0WWr`0Xq#S^|d)xwJP
zp>ky6suW@hHk;u=?f%RUkk!^f5d!jjU|&Y7pohZ>ob)0?cYv%96^aZx={aV4;n_#r
z1a7#bqNvLhx*`K%0czhaqlWeKF|YD^Xy(gL<Z~}A<nwlC<oaP9<nx4u!_OgMLwUAY
zBA-_ZK|9jZMaZpe4e*&f2_A<`&-Ilh9<^X}w2uJ~XK7)f_C_osEKE-CG4}n^Rav+j
zcEqD{SZgfpk)e?|m<ZtLzD5fLe8e@;8hic3SdSc6dHvvTS^x)&zqs06G!w8s>UubB
z>azRRDAb$n&9M+Zqhh#q8w()blG|Na&l^C{0#n$YtlZ>$vLG+-gMQvw0JF}XwHPdQ
z?ds}U79c)$?CL44yLazCeE18{+&A;Her)o76gsF?mTs&I>1;BsM_gbr(TP(Md#fEl
zyhpJ}0iOY&uT8~XKHzXoO*?R3Kp?fivc|>jcj=nEZk_~`5o~{B0n0{jcaShK8zB#^
z;MZ1q88n_(;lG~8ecvz$ABYSO2TJ||Ook_H35tk_2uO(p1UeoH127v<LrG7sZ(?F|
z@ihQO1y+5LFJAE9YYg`$Am1)YK{@!(TH(AoM!30y(S=yVhXNAQkl^6?H6&7i18hH&
zxD&5o;m7Rk3lb8gQ|0sTv$EnKl=vNfOM09^xxquXz2Ds2{PgMK))W{=VBG;r?EH%|
z4)FK?<>U^WlAWC$YzbRiTL*{Ss#}C4B){^o?!fNaFOAj!e%{&L?LJ6@idHtpahNHZ
zit7WL1;h9C>q)s^y?L{chXeODGBQF(M@K-;46G$&fJmYd5WoQ2xi*MlW3G>ep1#-F
zM8v_#DVSc!zaBRszEHZ}vT&c#TRkYb#SYWP2U-M>Ce+8%)P1J#xDsS`%q_7Tw^ABd
z<79+!2Wf-$O;kU%E1nk%Cl{Adk^RK-L{q%y_L)$;O2`3Fn^hbk66`)bCC)Yu4uXF^
ze7q~Wuc)XP#(DhDm#@Z2+%%>XgAj@0N&R2To}ZQ^n2XJoI26wd*%JHhk5n!X%H74W
zg{U6>vQ)XObQfp%B-|UbYD5_ZZLKOA;|z<SqkQfvP@~FT!0m%NxY+1I@nqDIJ@qK#
z@DHye@D=F+i^K09ZeVU2Rk@4o#3(j}7ZnVsiLi>tMmC+BK`ZH=spDLU2vrV2Gmwbb
zj;Z?4d;geI4Q$FYi|C*`MdR98ev?C+uV>*-H>hQ%NZ#7mgmz>_2B)sOjYkh|XE26w
zzP|bnf;Pxx2GgtAEy2TO@ZQgHO}If_R#t)7wO(<0#KhryKL(yl`Vl%xLmdWr02b?F
z#Xc`l!!uqlDP(AetQII|p4a0}Q$T+X)-Z?tS@kQ$l{vm$!O6+-2~{j-jFUikM4vLO
zD3}*XFL-%ZWmR!Dao`K=Bn~Q<oiggb4GdUi>oL3k%KrB4db}V_<uKex!~gMlqJ~(d
zNG~t1t(B<&oOdiJe;C|^lh*J6u}ajJ_DUh4l6t`7Rdx9B{5hhAZKX(9mkP?tCZ#S*
zyIU(#=Dc3A$XQn8teaw_pPyf5Cht~P>5vA>I{=<jw%?fYFkxbE0{sPE)JIgb%wN|F
z2@BWO)SNRaUIp6O|JgHJg~;9AU4Y$Jrdo42kESs}7a+jk)c&tBp<6118q(gL<w3pO
zxf^qXQZt%nW>bLgl<q_uCzd&Dq;RTSe0>#67tqIu*kz|k_rZgokRxr(56qrUp$$@E
ztKJyG47In1Mn|8uF_V~miNupr;1CwyL4NzexXcX*ke8>fMT^>vPQ_#9dq7K}pV8&k
zD!K7%sNw){aL_Qg7#bRSc<jRN0B&SF70@E!+h8RuE-oVR+cCd?je*mk*@*Nx49`6w
zocxn<SwI{LhqCfhiqB<htRR|FSR1?fB+7ijrMNwLb=BczgTvmoqe>W{TqlnoZ*Oa3
zwP6vm&^9u9vzz;%<J~<oGZ8q1g<IkzcM_j6hZXSYeY^z$8U*+Q0|TI{0!d65=Yx^Y
zzK^C_AQiMwR;~lu{^G@p#l^)SG?J5(J8xLXs&d`Hpbvs0E*1OY_S8M!kXQ-V>x6dQ
zM$SO>mF%$x509<~*13EqnPVcA44%T7L(zz`aH>G6IP~$h_t?nh(pZ7@z*(E2+y^g9
zmmsy0dp0v;u?39HbBd&_EH$!8z|{ZcEN6o(UDw&!`TF%Ricvts<0_&V4gaDHzbt)q
zqlksrr@6J&*=7igah$YCk-g&nB{nwM{lxry;nSy2U$~&@Df<5_&rz2W&Ej)?Utfl%
zYt={q#;2-`sY^2MFHWz6XKe-aNSBx)Yf|<cDswL=)ofXS9BWyAYj&FPze;n4nK~)4
zyhLl&hpAf-G0piv0Fi*5+&;Fi^KbHvr}5g^=$&;Sf|4>aEP>S+^4yvGLN47uO9Xrv
zENzUnwKeENK<*SRWC_OY1Pe?2t5>2ngQcl)ZdaskG&VKynUu#u1`-jGXIgWtXtAfi
z-%wloZb2XDQUU@3`uh4HeMnADCdHQrx~d~6ZWYgSe4U`qm1d02{}Zr4OJjAQd}t{f
zfZp%KTMtLi1e*<6_#=r&5WtdhgmvpUW%u3O+&n$^0p$VMvkn{-<foVN#g|JsRRB~~
zjpTg}M^I36LqjNbD~$6!a5NK*5gf|FB*erovC>hT4fk_C+{^*-3l}dhFuf0ceoJvG
z*#k}&Y%PeifQ&<&AsHi(`9Ev-wFbn~Tp{I?dj`G1meK=CAZRPt+uIv?&S0{kVmO_p
z^++$y`LtON7a(_-IHVxRsqv=*zXdx_?pb~PWj3F_Ztiu)jhUn@XASbw5>8|)@>odg
z=ryq9%5-f3X=sTY=C@kp5{ohbP^hW3JZ16J)79MoVA-bUW8&MlcL7USuA?{y!kZy0
zpTRSCRR|Y>!FRg$ihl&;V1O#y-OeNn)pa;~_H252xo3Bl5!gQ)D=WZN-g#UsUHzuo
z+}sQbm$Iy4Jp6d)1xj4)DY%KtaszkNIRht<4#mdC0{;$p1;lJSB}Sg33-lrWdHMMO
z!@SSSyW!ch;<COS5oT23X>?v7`jD%`9Bg1{<i@9_RA;aWWZ~eoju{(Le(T%GKtQP4
zWV`)c*R6vfkdO71qe}*?Sp@C}QkVkHD7H&uXi~OT3?K<18zW0a$D>t%FJuX`Z&l$Q
z<Yk$-`9}OZ9&m+Z!{@N|-C@zcoS%gRJz((7OwRp)hJuEy;z}529ROg;&Q4A<0@#nt
z<K>5()e`9WAWd5Bx6b)tjM;OnJ8?22F|jI}#9_QX6vRoO4jd}9`(m2?k@l!B_<&*|
zx7F!GMjL2r0N6{4i;X?E?y*&ac?NcHcR=uf6-ZHwJpB*fA<_hRV71>Eq;s8}oCn|4
zua%UQ-&WjRRsZ~(_8VRp$GNGk&G}%u$?@@iA?WxZr#<D<1FC_WH-AjGCqp;wFd~gM
zBv*0bMB&aLvH%*Ahlgi^4-3;L^e11`d}wS(uk(-KXYMBHudJURDlFJk!W!<TXJtu2
z;spW7?E38V++G&~i>|eUJmQlcFW6>r=Xt|ohxeQB#pUuO?Y*mRC6tebmUB^0(CEhc
zQL!n=$jE?4b6+Uqeo7_7rbqdtMbj`;(_|?;xtiUi=Ay@@Ef<ZhHI+{6^|gb`{Rsv8
z>Ggm&BY+JU?yk;G(S5T^8h>SZfTL|w>-tcbcr4ZU5S{Q5b0230;MjQS37CBrNw?0W
zHj6ywOZL^6=AslFU#i4OfqqE{YW!X9sa&>M03vcW+AX9u%cul~SQrKd%+_k@H=Qy`
zd-7S?K{kv7`Z97nn_f~`_rKWo5%)BKs$3hlHSx@Igc|HRix7hdHE8eq5jSt_Jliyd
zZq}-T@e-NxHO0p@RG*ItdM!{s8PqWR>03I=^qqNkAQB^^_gMHN=h3pn!fyfdSp|+e
zleiU+#@;ORXQplFxysp?`S`oIL{WeR&~|oA@92Bt_HD%FU3t<?ZJmS*yhO6nr?Xa5
zI=C)Sr92$b30}XVr`fIfWU@h34qLX~3!%b5VaDqvlDz5G2%f_LQ1Dsfv0VQWp9F%F
zy0Pq7bJE**^tE9Wf+2lRtbsr{<3nZ6;7laDayqO3n5&{VAy3<pNS}n;Cv^>3vF1l_
z<B3(l#et*#5cZy9&6JUbIn&WJv<oUta`T~@CWQgv^ykS6)$I)Wh|6TELf9*BH<1sd
zhLYZ6scg=pbBTra20#L`XUep~S0iC8$d~=k9@j~D1f5ZZ&JegNq6v9W&=83~4<PxP
zbf1s0-hqZ>>{8<Ed5!=B=mUui$$mMR4^`!3E;e&iO#~1CY52GCrl0@q&(&_M=UN6N
zLZJK%W|q`HukbIXg!rG2wGpezX$blA9O3vG$X&(^f*k<on8-nwEeh~1aDYw@4w(i8
z=Q%i%GcqzDZsg<~2U0AI6CC6lDRl48a_iiihm^_e?11}m8F$!3FOifC;<#03g9P)&
z-3@E7NpjDA8;|Xhb7y7HHP>{r47UJ(9|R)<fEwVwfI2V5*p!1Wq`P?c8K(+J>+XTR
z;N$Ht5Yml*s4y3f0d_{|9-b|jkr_q1dkOVC*6Ep<kW#&V{Td<ugbjEj+uGW;x7}Vg
zXzS?}f|>`Y?lW5N7$scVhR)&T26C~boz%@DIr-Weg^Rn-yfA)t6<i{COn1q1;>b~w
zoD6P~33daZ;Uwhb3q@FWkYkDh1`U?1uCC5~^SamldS{{=y1MaF=xq=*u7M!LGqG?K
ze}?A>1q+Lbj?Srrzd33D-d=q+1&9g%V|cP`-LVx6As^i3PHiAOeCrOb`4N~D4u2kN
zRxC*+XvhjM2cF68uU@}C<I@9k44P!CJbm!ah{BRt!knMBx38}oYr;Z9BjT~S7{nkl
z4-y|i!Q6#%>&?{;_2;}YCa~g+PG=R?B@_ts-{L1^>pbNBJdY9+%X?i7<Af12GD0tp
zt3>(?hbP_N2j>U2_aT66uo76Yt1N3&LeGPP-!<Z{eh#D1_8Il>gM}`C7iSyRy+u_7
zk2S1H@=&~K-vvrJK9Ko<%Y&aX70a-;;#h$OgmbWBS3w220!SYSI#%~?$jVl&v`WXn
zd?~Q`A*pbbD68PcV}rccO*S}B5&jW$SRnOIfB!yIoo@OEtRE1bG1Jijo(}=U&sU0|
zq-wYevN19H@n>BYOkYm{uz8a=60}Zl#GOGr?!bSLE39Fnc_E$G3r2Lh;h(w{rx!5_
zb~Qi}Izp;;G18|^)z~<WViW)ms|OE43qX$#^#=n>8CBI0JaN!V=1{yBc2N{=GX|!K
zg-I5M6-l^z4+OeDp*(CE-Rul&*rW7-9BGN*nNdV5a-@Ai@e(D{C_h*9ylkh~RnOBa
zdlyF!#%MX^EZgDngh#hC5Uh~`^)#b1Tw0XyZ4f!s4lmc2zxy~Yo71P9QHaW)C%twp
z|Lm|*OwlfNaScITA{NX&F<UU>rHl2LD6HxFDHXF_bm@RdTbwb_Pyh?a5$60b)YVPR
zxHCZ{LU!_GN=b?MA=?cCk+{A+$xpjqOctKF@1k@2r*g%eO3)Aq$vuPNv(J>Mb9-?=
zoBt>pX80J)@L)>G8tahe<dv7)#PW^5LKlFJqo0KA75oYPPDYCG&bEMVr%R^9ZGKu%
zUohUFo~Cdns#-Xm<-+8uxbuv+jR6*yNk8>C*i$3cPck-}!=jtVYp6_sv&0L<D~5%&
z>pSWXEU|-6J?>s%S6CY?_T5hQX}lUL7B=j3z-+z!-<ZtB^Qo$GuoU(!kLQMr`Y*t@
zrgTD~e|@Ie66-y8KoPcY#WqZ(7UcuA5%F8uDs2+}JmvDn?HsA0T&%3O_IJ0Q7@SS8
zhf0;ux{n=PiAZGj;a;1VKaZ56ar>FnP{pix5ZfVq<?uU5umIGlW5F0Q*8;Kuz&F$H
z>#*ga_aH?BN}q<$SOT+OT46v?cn2yTKs}k$H&?M)!#C(U^`=}^E|Z{2`E=GMFy`Hd
zSvdZdMfGpy(zXLQIH->3@9N3}d8nlO`l>!<QaLUQ*cHn^Z04WjTxP;eDRObqmaQ6z
zB@Qe$7e_p;=yRWsHnI-ykd-MJ4M}zV6Ml2Kn?0CL;9Yk15`a!HIMe}(X{pL_0J1*o
zbDN0J1)U}hEiGgMpm&%E+IGcsiN<yHO(Hw#Z-!t|0t?&WcPI<_YSDhljF?Uw+;uGj
zV!gz~+mNh-?u_<=X*Drl=|_;gLIneC$E>XL;7U7ffK~=X4dnEI(u1%N#054GV&4Xf
z>s^8UT2d1+v^Vbz`B@^AsOW!yk5_i_@*bBaX(9aNpDcR@?A!k0Q)yn~(#<}b3L*L+
z>D@)|#fdNtC<qBLrkm!Hmd1ejfs7e~a;fbTfo6nkrS21rNC5>@G5`d~BJT9nB5%K`
zVz-Gq-eWXExBQ&qp_+DZ>?h&*xR4jCtE&*LBjghZumPCmR*SWLh?y^%0x9i%;TQl1
zA#{R87E%MGB;X?k`M+RPmpk+g4B|m{1JuUHkNg2O_A{MO0|V71C1!E1ryv!Axq{67
zLwb5x{BA9S4JQbF6%-I+W^%H)r$-&6m?Qee#>_zM_FJ!{-^h64?S048R4IslZ8|yR
z%8^Sg=nco@=EDtI+-^?;EsI~utH(+^&U6B?VT^H>;Y-^-)Zsp%H+yOviywtkCg<i>
z+;F!Tim^CVo{}*Eh=b5M1tIi85Yei60u9{pDJLf;CI%)Rh|0Y-dGdxn(2w$iJA!-#
z2n?7(P-?1#<=T#XE_yTtNJ}30NvPrhGYpdnu`d`h@DndM-+%ak2${n;FAely=v@fx
zcmOfJFToSfZS}X%Vh0nuGe4^oqa4CK@Z-nNL7qaVjLxLr>S5%m4MM#G+@~O`VPGUj
z1V@guI<7k~?&Cp#eo)E*<0!r#iQo`fppGU)>W5bFAaC}i0H$YIzGQ%zn%W5{eZaH{
z2nZH_<fNvg)GXaiW!O<yU0~e?twnsna-&yp&UjGiMNvRZ##tD<N66CNTd=emR^a}P
zbgiwc+t~eINLNUGm%nHxD>X1cjS$d6<4?){W#sx8Tdeg_i7FSJWE>_lBh3vLCyvR=
zGjmMpB5vXTp_ceGrYwo0qDe^UDL^pZRjf4pZ!BzVFtZ;D{K%Lrz_{C#o|`N4o_@ZR
z=@FOf3Z-_z^bIm0k6O_LSFCgNzk6#-#=XZ@Hs#w4?bpzlI5;|5{rEHi`v$26bC+b}
z;+ojsSpbOu2&SzpEcA2kH-n@Yv`j#1Of|=BbZV(Lq+W4#-I{2M`kS(ejfNT4%YO`!
zI~2FG)S-Hzs{wxib{wWD<DKHvq@+=ZUe-!!Bq4q*gQ_yv)nF)rJ_&o-2m%G*PAAqa
z)7>RDqz5X6{)|mrd_1zm0i*+@4-M+H;JM)4^D5WT=)Ev5RbYZaEd9vde%!JgDE<cz
zZUX)ddd4rGKY#o7ZJhWMFp~hOT)%!DB;F7uN1ivbDCldAlN5(^?%6X!h^#_G?S?CH
zRKjAdS07*!*#pfcR^B$lrst1o4h;>3F$u%B|GjE`byaz@7D#5coC#Jx{lO;eoNSxR
zRuZQQb!q<0#f;U;s|$C0Hmn~E0*bc#>90zZfC}-1s2hhAC<+x)y7-w`?imyw^~^c7
znpgph0@f4BQ^6G(d2m(?0(OpCtmpGw3IOSl%k0@maVWk*Z~>LGWsB&i#>r(i@!yO?
z3_A=kYf8WU@Qm<6Z(dV?iEGb6#q6x~TMCaMHWbQucz}|48z5!W@cYV2nFZsTC&s{a
zp<HmdsN)Ym#tYZ;@Gr$hc{yvCE-@iR9fPvZYn%@+BITk6{|nz0f{T2Ri$pX{m+%fR
zQg~hiLM~{Dj*A*Qw&Pu@<UTaXx^dYC<PAyOwK>c0Hze)dV$s_{ax;=T*2(4Y?G5<$
zc|;CV2GDxt3GdyM=3XT<9tstoP(7*$90AJX34?FxGvrQKcpPfvPUUjXYYdP(ZBoFU
zSdqt(57#Swf?Q++4Klhy14BvGqnD7YrIeo|F&(rNOd0SL`5FoS6<&x$Q7C@e)7dV_
z*D6^Pt4D>AtG#_F10bM<i<qzQ&LdsrcR8J1_!PM)0h$D&7cTOr3}86CNcalx5kS;Y
zw?1l`(w#=mdCEM$Cv*64I9!o9hhxPOuD2b6JRC;D^r!UUMe@&)v<`Ye$`y&QUZ`Pp
zxX2s1NLtervO}aLrRPWz2^Z0EMfM$DgbCL(M2c>Q|NN3b2%jKb`TH*?!}TDig@&$c
zm=;kX4IP8=Is+W|zO}a!qG<O4_M@Mpto@rfp-c*phk3wl!#Xo5v}HSeI&I;EgQ&C?
z6#B^AJe|F&h_12B)i-Isez>%7PQRX|3>ci`L9}Tw$Tf-8--waXt{G8EJX}Vnk8?%F
zArJlcU&1>mo1hkNr0&!f@dklw(0bPQ@4r_nPMX{hgD)dXc~bnA|Bg4*5D8|Ph9bo`
z8t4D~k|e$NQyn5A=#~!!GL0wGl9EiJ+Tp~htB{y7a#72|_{%(of}Dlo*(^kv`TF8L
zh#1245biA3+4=czriWN&1nMK70?NO)zfl2j+W7eHY{mX8QY{D@&ENmn7SZ-=ED8P*
zSLpHv_RXKKQ6WPFoF+IhfaBKJ*Fox3hg}sg3DqrCaX;vNfK^7YAyj8lZmt7xfm5yV
zEKq!d)JgVaLC0E69<u<Ww_QSnN;pLwFagX8Le;f?93{RI7vJ!Ij<v`I0-l%+08^-J
zjR0i|6_pTR#t2~F0NM(uF9Lc%Sl9{btIrGLdiCygNbhw(um|PH%=Gj#gFI=To{_^`
zz2b4!tEVL;2ku@(FvzgCP%fgVpdctHSl_1{L=X8cw=`tI4}Sdk0Z~;@P!MQZJf{<%
zj?aO~0!ya^90j2K0K0+Yg;PZz3Kao4#e%8{Y9yiJ7s{8wV?!kI;>8O{uP=uI(dx9l
z`rt2{i*xIRQK9W^$XMKB;}OM6+hB#${2TKBnKB|&G~E5&m#zOB6+|+3Ad;CJ3{H=W
z_wJv$nEM`<3!?qon3sfPp^tBL^A>7rYKx#ssshYUE%IJ~m8m9a@p26WLIvO)bYIQ`
zj!_h&Kw2%=wzQ~~40vuWPlSh`tm6T)_fLiCz$`iNM{qbhAf@hifFy!h0_Iswq<DY^
z)kb-v70Tik3oQI=OjT4>-G8P;Nf7bKJ%ef>%u)>v#BmVjZ$X^~#NQ*v>X%hiiXis^
z=mNCYz?A{F1_FjyaOV)NLKH2z)~N+9Jd86UD$1nX;}WRPd3Y=Vn71Fv1~fk{t=_sI
zDk=&}-k>5D0x@M}Wd;&Ia6PFEl0S)2=Ff|#%tRtXhr@w__!HTu-{A+IFS(tTk&)NO
z_907~<-63>|5cBLNYR+oGyaDvj!?xZurOK!R_Gnky*-d(ZGaA<Ng4|BB#{DmiN#8&
zU&erX0m@(i`5vE`C<FN4)Ju{cm|X}nkfM=z!QQ&gH8R{b0g*|byw=uCf}fp7$R#L1
zbr0~z$WxZ@U0r3n%T2JlPXpcsxV;BGq%%N19EBGo6b|Y@oRl;(J9`8d*M|Z`t}yZv
z&hxQ99=5c$B4t*9d9*sRqfom6+x|Nc-9Raqm2jVzXA0wQxfN8?`x4YdfHF%zrA7(W
zCJfIoPPG9A#Q#ij<(Yy1_HTMC3e)x^#eHjf6be(fmOl^GvwsK80Xk>Wl?I^gWdoEp
z!SXzw(KWMhfABi?BP9*Z#!?-NG!#`sV!3}+zRU=dUa*g=!B^I-YiKhIS3*h$8mat;
zKfXP32l=9w*2`T3X`#9GZ2-rsVM9QYkMdg9Fj>0XN*T~@eo`(sKmTk+;izDygR^r8
zh-)E722Kf@pT1Z@EV)MG<@VF6JgI#2{eJ+mqfp`A+y1GHTtFmHvsHs^Kf=(k=!Tx%
zm8V-qP^p9JRJB=&sJg|9b*X}+1>Qd}<6@qtAHsNPv|_UVo7ZRmwuvp))lL)COiIC)
z{~GH;eN)p3xx)e)A5rGB%`#uW%{I!SYsA4H-J{m+C*~3Rx*(^%hnHaN7K2U0x&$S^
zOR5|_76Co$1*kvz5UvT=F<j!zoaX;~Coa;G6z`PFZ%OKm9hSdbzqzz_{0OR0S$9QX
zRyMlkA_YoDz(Lm}^nHfkq|%e$$Tu!(uWe-aDq7JyEfa+j^easg@`3xTzX0+3M_g1J
z=d!;O=zUQ70A>(=K8BL{QqQ9=qlbesXK+<qBLrvN3}_a^Z9G&0!8jEa2Q=aU)h;?n
zBc3mGwVxx6P%Zm!BaMJS3<0N6G7w7rdsrHUs35exk&DkQU%~9n=vJIPbLM7=(;P&x
zH0Sg=eatN_4e~5*fI?VXyAx!bpp%_2qds}^)zx?P_4R=Mc4g>_4|J0vH@2qZR9SXr
zz=vs}kSpw-{qG5s)S?C71NI5Pv@G;@`otQQ2%?GcCYN$qX%@M2=MLn-@M?)#oARx9
z!2Z?0U<>0!Z%ssj>=g3OmtXvKp;``rV350^#1xF}wEpFy(S7SPC{#M4qD)hfsT>+J
zI;6dUPzQXdEDox0;rPe525j_qO9FNj`|spQs7~MQMpSiO9hBxaNOQwmRPNpTpqHJ5
zD2v<wGv4<W7Cj&U??Hf&s09?#<>iAb<q#;cLq(Ab02u2FLpD&FFCgGc0aH{A(8LEF
zOBWXxC8gRbZvtSBLH-9^+}P+SfSBb-y0x?J>*u!)^YdFzgi28FXL*YoEWEKxNKNgB
zLT$^U6|W^FC%^v$3kWKrE`sRC3&_&Wr}eNV7!bzeCJNEOX!3xzM@AYUNbbU{Kpn=w
zGhP%*63}75R8a}82+abG<O0ER9BIT4smnqdIlJutjshBqhGGYLq!IUe9(o06#5_<o
zj1yCETZ4`SA0twA?Fc&c-_~IQ7(N0X>+!zg8Z(dj^jshcbt3`claRI&OSb(7U9R5?
zo#i>Kq2oiP5w1}MB{#wiQOo}8$WvP=8@J;jHw56;4S-uz8jY)>GV;_B?EipAqPz@7
zJnuuQ^YW3i^TxB|9Doq%T)%Fbt>?2pzW`(*j*Ma&b~?1<tg4JmCFpW|DIf+|b3THD
z+Jyc0#-9ErHL_b=4)!+o2E<UPeVkd@;_sHXPm77U0h|bK08l&NnB5Fm+W)ksk3Fjj
z6%#r-0EmFg9lCY|HM~&Iv)u(%oZAYKNcqG0+c>DxB(t(&{}dGb+y=25Kz=s;g-A*0
z5ZBxI<DcCqP^YQasNS3fEw#CM55y`@@Q9THX_r0|^JSV;NS!<P0mO0{8LB|$p)@FG
zc(!lo>lYtZG;G94V~ht)1?hb$hA;<c@cK}QP&zQn@ir&t5$v-;^fhb(q=5c_jaU4q
z0-EEd_;>#w)YhX=dCBEZDrODrjvvVs31kpyxt{|(mzbDXabckg_(qVvK)vczq1_mS
z-0*Ub^O(r2E(<^*`wDCpW@ff)_&kr((z+lbdj*gtgAxZ(-k&&8u{9Z!kdOe%aAjuK
zx5>$4a|J`f^g)1!0!h6DGX>fLsN;v1cJSo<@BsW0unTyh0EAZ?13d?|NNP3_<|Q@m
zAHcxDDJh8tLlyjVtS)4z*fFCN4e-KpEr4`HY+zlPFsg)_5U|szL7Q&nx2&u_P$a#3
zr{rl~&<CIhsEgbofE*qk2A~-LTG6;)4tEahlu%x#*~~||$5Yrh)+2aM2ghSUY<v*=
z;sxu0hJgXY$&=x)UY(X^6tV~}&4y&?^y$l<(;EL$>0M}(fSL#{N{|&Pn*Oe>t-ZQ?
zb6<^psly_G!u0=Cl)L?@1m%S!sK)vKeVt7@*w?VPP?Qhw;opp|oH4D%e^$oV_EQPN
zcm!Ve6skLX@9^~<AN21D(jx*N5Uj3$2q0ub%J3^IE1`Zy9K`c2;tTzGmQkg9Z=45<
zzyyOp-K~zvSppQe5VOlY1NLnI1l~FsP=+AE!7&DJBf$4gEGt9rZLfhI^|z>EtQ@@q
z1s-p#89Q5!pgg>Hylqvj`}qWbNQIYCNGw&Kkg^OXx5ND2%-{kXkUToUA(LPvay4Hn
z38FJEe^9%_t35!x`rrPE_&S-N<2GG5sLGJvF9_Q?7@?cjde`**F1#)brJ|^&kR^BP
G$^QrWss&&G

literal 0
HcmV?d00001

diff --git a/src/CMakeLists.txt b/src/CMakeLists.txt
index cc63136..e56d494 100644
--- a/src/CMakeLists.txt
+++ b/src/CMakeLists.txt
@@ -186,5 +186,11 @@ endif()
 
 add_subdirectory(examples)
 
+if (BUILD_TESTING)
+  # Multi Process Tests
+  add_subdirectory(mpt)
+endif()
+
+
 # Pull-in CPack and support for generating <Package>Config.cmake and packages.
 include(Packaging)
diff --git a/src/ddsrt/include/dds/ddsrt/log.h b/src/ddsrt/include/dds/ddsrt/log.h
index 4a08a46..360f9c6 100644
--- a/src/ddsrt/include/dds/ddsrt/log.h
+++ b/src/ddsrt/include/dds/ddsrt/log.h
@@ -107,7 +107,7 @@ typedef struct {
 /** Function signature that log and trace callbacks must adhere too. */
 typedef void(*dds_log_write_fn_t)(void *, const dds_log_data_t *);
 
-extern uint32_t *const dds_log_mask;
+DDS_EXPORT extern uint32_t *const dds_log_mask;
 
 /**
  * @brief Get currently enabled log and trace categories.
diff --git a/src/mpt/CMakeLists.txt b/src/mpt/CMakeLists.txt
new file mode 100644
index 0000000..4b759c7
--- /dev/null
+++ b/src/mpt/CMakeLists.txt
@@ -0,0 +1,22 @@
+#
+# Copyright(c) 2006 to 2018 ADLINK Technology Limited and others
+#
+# This program and the accompanying materials are made available under the
+# terms of the Eclipse Public License v. 2.0 which is available at
+# http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+# v. 1.0 which is available at
+# http://www.eclipse.org/org/documents/edl-v10.php.
+#
+# SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+#
+cmake_minimum_required(VERSION 3.7)
+
+option(MPT_ENABLE_SELFTEST "Enable multi-process test-framework self test" OFF)
+
+set(MPT_CMAKE "${CMAKE_CURRENT_SOURCE_DIR}/mpt/cmake/MPT.cmake")
+set(MPT_SOURCE_ROOT_DIR "${CMAKE_CURRENT_SOURCE_DIR}")
+set(MPT_BINARY_ROOT_DIR "${CMAKE_CURRENT_BINARY_DIR}")
+
+add_subdirectory(mpt)
+add_subdirectory(tests)
+
diff --git a/src/mpt/mpt/CMakeLists.txt b/src/mpt/mpt/CMakeLists.txt
new file mode 100644
index 0000000..a81fbe5
--- /dev/null
+++ b/src/mpt/mpt/CMakeLists.txt
@@ -0,0 +1,17 @@
+#
+# Copyright(c) 2006 to 2018 ADLINK Technology Limited and others
+#
+# This program and the accompanying materials are made available under the
+# terms of the Eclipse Public License v. 2.0 which is available at
+# http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+# v. 1.0 which is available at
+# http://www.eclipse.org/org/documents/edl-v10.php.
+#
+# SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+#
+
+
+configure_file(
+    "${CMAKE_CURRENT_SOURCE_DIR}/include/mpt/resource.h.in" "${CMAKE_CURRENT_BINARY_DIR}/include/mpt/resource.h" @ONLY)
+
+
diff --git a/src/mpt/mpt/cmake/MPT.cmake b/src/mpt/mpt/cmake/MPT.cmake
new file mode 100644
index 0000000..fd50b5b
--- /dev/null
+++ b/src/mpt/mpt/cmake/MPT.cmake
@@ -0,0 +1,184 @@
+#
+# Copyright(c) 2006 to 2018 ADLINK Technology Limited and others
+#
+# This program and the accompanying materials are made available under the
+# terms of the Eclipse Public License v. 2.0 which is available at
+# http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+# v. 1.0 which is available at
+# http://www.eclipse.org/org/documents/edl-v10.php.
+#
+# SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+#
+set(MPT_DIR "${CMAKE_CURRENT_LIST_DIR}/..")
+
+
+
+function(parse_mpt_fixtures INPUT TEST_DISABLED TEST_TIMEOUT TEST_XFAIL)
+  set(s "[ \t\r\n]")
+  if(INPUT MATCHES ".disabled${s}*=${s}*([tT][rR][uU][eE]|[0-9]+)")
+    set(${TEST_DISABLED} "TRUE" PARENT_SCOPE)
+  else()
+    set(${TEST_DISABLED} "FALSE" PARENT_SCOPE)
+  endif()
+
+  if(INPUT MATCHES ".timeout${s}*=${s}*([0-9]+)")
+    set(${TEST_TIMEOUT} "${CMAKE_MATCH_1}" PARENT_SCOPE)
+  else()
+    set(${TEST_TIMEOUT} "0" PARENT_SCOPE)
+  endif()
+
+  if(INPUT MATCHES ".xfail${s}*=${s}*([tT][rR][uU][eE]|[0-9]+)")
+    set(${TEST_XFAIL} "true" PARENT_SCOPE)
+  else()
+    set(${TEST_XFAIL} "false" PARENT_SCOPE)
+  endif()
+endfunction()
+
+
+
+function(process_mpt_source_file SOURCE_FILE SUITES TESTS PROCESSES)
+  unset(tests)
+  unset(processes)
+  set(x "\\*")
+  set(s "[ \t\r\n]")
+  set(s_or_x "[ \t\r\n\\*]")
+  set(w "[_a-zA-Z0-9]")
+  set(ident_expr "(${s}*${w}+${s}*)")
+  # Very basic type recognition, only things that contain word characters and
+  # pointers are handled. And since this script does not actually have to
+  # compile any code, type checking is left to the compiler. An error (or
+  # warning) will be thrown if something is off.
+  #
+  # The "type" regular expression below will match things like:
+  #  - <word> <word>
+  #  - <word> *<word>
+  #  - <word>* <word> *<word>
+  set(type_expr "(${s}*${w}+${x}*${s}+${s_or_x}*)+")
+  set(param_expr "${type_expr}${ident_expr}")
+  # Test fixture support (based on test fixtures as implemented in Criterion),
+  # to enable per-test (de)initializers, which is very different from
+  # per-suite (de)initializers, and timeouts.
+  #
+  # The following fixtures are supported:
+  #  - init
+  #  - fini
+  #  - disabled
+  #  - timeout
+  set(data_expr "(${s}*,${s}*\\.${w}+${s}*=[^,\\)]+)*")
+
+  file(READ "${SOURCE_FILE}" content)
+
+  # MPT_Test
+  set(test_expr "MPT_Test${s}*\\(${ident_expr},${ident_expr}${data_expr}\\)")
+  string(REGEX MATCHALL "${test_expr}" matches "${content}")
+  foreach(match ${matches})
+    string(REGEX REPLACE "${test_expr}" "\\1" suite "${match}")
+    string(REGEX REPLACE "${test_expr}" "\\2" test "${match}")
+    # Remove leading and trailing whitespace
+    string(STRIP "${suite}" suite)
+    string(STRIP "${test}" test)
+
+    # Extract fixtures that must be handled by CMake (.disabled and .timeout).
+    parse_mpt_fixtures("${match}" disabled timeout xfail)
+    list(APPEND tests "${suite}:${test}:${disabled}:${timeout}:${xfail}")
+    list(APPEND suites "${suite}")
+  endforeach()
+
+  # MPT_TestProcess
+  set(process_expr "MPT_TestProcess${s}*\\(${ident_expr},${ident_expr},${ident_expr}")
+  string(REGEX MATCHALL "${process_expr}" matches "${content}")
+  foreach(match ${matches})
+    string(REGEX REPLACE "${process_expr}" "\\1" suite "${match}")
+    string(REGEX REPLACE "${process_expr}" "\\2" test "${match}")
+    string(REGEX REPLACE "${process_expr}" "\\3" id "${match}")
+    # Remove leading and trailing whitespace
+    string(STRIP "${suite}" suite)
+    string(STRIP "${test}" test)
+    string(STRIP "${id}" id)
+
+    list(APPEND processes "${suite}:${test}:${id}")
+  endforeach()
+
+  set(${PROCESSES} ${processes} PARENT_SCOPE)
+  set(${TESTS} ${tests} PARENT_SCOPE)
+  set(${SUITES} ${suites} PARENT_SCOPE)
+endfunction()
+
+
+
+function(add_mpt_executable TARGET)
+  set(sources)
+  set(processes)
+
+  foreach(source ${ARGN})
+    if((EXISTS "${source}" OR EXISTS "${CMAKE_CURRENT_SOURCE_DIR}/${source}"))
+      unset(processes)
+      unset(tests)
+      unset(suites)
+
+      # Disable missing-field-initializers warnings as not having to specify
+      # every member, aka fixture, is intended behavior.
+      if(${CMAKE_C_COMPILER_ID} STREQUAL "Clang" OR
+         ${CMAKE_C_COMPILER_ID} STREQUAL "AppleClang" OR
+         ${CMAKE_C_COMPILER_ID} STREQUAL "GNU")
+        set_property(
+          SOURCE "${source}"
+          PROPERTY COMPILE_FLAGS -Wno-missing-field-initializers)
+      endif()
+
+      process_mpt_source_file("${source}" suites tests processes)
+
+      foreach(suite ${suites})
+        set(addsuites "${addsuites}\n  mpt_add_suite(mpt_suite_new(\"${suite}\"));")
+      endforeach()
+
+      foreach(testcase ${tests})
+        string(REPLACE ":" ";" testcase ${testcase})
+        list(GET testcase 0 suite)
+        list(GET testcase 1 test)
+        list(GET testcase 2 disabled)
+        list(GET testcase 3 timeout)
+        list(GET testcase 4 xfail)
+        set(addtests "${addtests}\n  mpt_add_test(\"${suite}\", mpt_test_new(\"${test}\", ${timeout}, ${xfail}));")
+
+        # Add this test to ctest.
+        set(ctest "${TARGET}_${suite}_${test}")
+        add_test(
+          NAME ${ctest}
+          COMMAND ${TARGET} -s ${suite} -t ${test})
+        set_property(TEST ${ctest} PROPERTY TIMEOUT ${timeout})
+        set_property(TEST ${ctest} PROPERTY DISABLED ${disabled})
+      endforeach()
+
+      foreach(process ${processes})
+        string(REPLACE ":" ";" process ${process})
+        list(GET process 0 suite)
+        list(GET process 1 test)
+        list(GET process 2 id)
+        set(addprocs "${addprocs}\n  mpt_add_process(\"${suite}\", \"${test}\", mpt_process_new(\"${id}\", MPT_TestProcessName(${suite}, ${test}, ${id})));")
+        set(procdecls "${procdecls}\nextern MPT_TestProcessDeclaration(${suite}, ${test}, ${id});")
+      endforeach()
+
+      list(APPEND sources "${source}")
+    endif()
+  endforeach()
+
+  configure_file(
+    "${MPT_DIR}/src/main.c.in" "${CMAKE_CURRENT_BINARY_DIR}/${TARGET}.c" @ONLY)
+
+  add_executable(
+    ${TARGET} "${CMAKE_CURRENT_BINARY_DIR}/${TARGET}.c" ${sources})
+
+  target_include_directories(${TARGET} PRIVATE "${MPT_DIR}/include" "${MPT_BINARY_ROOT_DIR}/mpt/include")
+  target_link_libraries(${TARGET} PRIVATE ddsc)
+
+  # We need the 'expand environment variables' feature that is present in the
+  # 'util' module. However, it is currently not possible to properly link to
+  # that module on Windows. In the near future, the utils will be migrated to
+  # ddsrt, after which we automatically have access to expand_envvars.
+  # But until then, use this very ugly (but quick) hack to solve our immediate
+  # build issues.
+  target_include_directories(${TARGET} PRIVATE "${CMAKE_SOURCE_DIR}/util/include")
+  target_sources(${TARGET} PRIVATE "${CMAKE_SOURCE_DIR}/util/src/ut_expand_envvars.c")
+endfunction()
+
diff --git a/src/mpt/mpt/include/mpt/mpt.h b/src/mpt/mpt/include/mpt/mpt.h
new file mode 100644
index 0000000..8d0522a
--- /dev/null
+++ b/src/mpt/mpt/include/mpt/mpt.h
@@ -0,0 +1,158 @@
+/*
+ * Copyright(c) 2006 to 2018 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+#ifndef MPT_H_INCLUDED
+#define MPT_H_INCLUDED
+
+#include <stdio.h>
+#include <stdbool.h>
+#include "mpt/resource.h"
+#include "mpt/private/mpt.h"
+#include "dds/ddsrt/environ.h"
+
+
+/* Environment name/value pair. */
+typedef struct mpt_env_ {
+    const char *name;
+    const char *value;
+} mpt_env_t;
+
+
+/* Process entry argument definitions. */
+#define MPT_Args(...) MPT_ProcessArgsSyntax, __VA_ARGS__
+#define MPT_NoArgs() MPT_ProcessArgsSyntax
+
+#define MPT_ArgValues(...) MPT_ProcessArgs, __VA_ARGS__
+#define MPT_NoArgValues() MPT_ProcessArgs
+
+
+/* Process entry definition. */
+#define MPT_ProcessEntry(process, args)\
+void MPT_ProcessEntryName(process)(args)
+
+
+/* IPC functions. */
+#define MPT_Send(str) mpt_ipc_send(MPT_ProcessArgs, str);
+#define MPT_Wait(str) mpt_ipc_wait(MPT_ProcessArgs, str);
+
+
+/*
+ * MPT_TestProcess generates a wrapper function that takes care of
+ * per-process initialization, environment settings,
+ * deinitialization and the actual process entry call.
+ */
+#define MPT_TestProcess(suite, test, name, process, args, ...)    \
+MPT_TestInitDeclaration(suite, test);                             \
+MPT_TestFiniDeclaration(suite, test);                             \
+MPT_TestProcessDeclaration(suite, test, name)                     \
+{                                                                 \
+  mpt_data_t data = MPT_Fixture(__VA_ARGS__);                     \
+                                                                  \
+  /* Always export the process name. */                           \
+  /* This can be used to generate unique log files fi. */         \
+  ddsrt_setenv("MPT_PROCESS_NAME",                                \
+               MPT_XSTR(MPT_TestProcessName(suite, test, name))); \
+                                                                  \
+  /* Initialize test related stuff first. */                      \
+  MPT_TestInitName(suite, test)();                                \
+                                                                  \
+  /* Pre-process initialization. */                               \
+  mpt_export_env(data.environment);                               \
+  if (data.init != NULL) {                                        \
+    data.init();                                                  \
+  }                                                               \
+                                                                  \
+  /* Execute the actual process entry function. */                \
+  MPT_ProcessEntryName(process)(args);                            \
+                                                                  \
+  /* Teardown process and test. */                                \
+  if (data.fini != NULL) {                                        \
+    data.fini();                                                  \
+  }                                                               \
+  MPT_TestFiniName(suite, test)();                                \
+}
+
+
+/*
+ * MPT_Test generates wrapper functions that take care of
+ * per-test initialization, environment settings and
+ * deinitialization.
+ * This is also used by CMake to determine the ctest timeout
+ * and disabled settings.
+ */
+#define MPT_Test(suite, test, ...)                                \
+MPT_TestInitDeclaration(suite, test)                              \
+{                                                                 \
+  mpt_data_t data = MPT_Fixture(__VA_ARGS__);                     \
+  mpt_export_env(data.environment);                               \
+  if (data.init != NULL) {                                        \
+    data.init();                                                  \
+  }                                                               \
+}                                                                 \
+MPT_TestFiniDeclaration(suite, test)                              \
+{                                                                 \
+  mpt_data_t data = MPT_Fixture(__VA_ARGS__);                     \
+  if (data.fini != NULL) {                                        \
+    data.fini();                                                  \
+  }                                                               \
+}
+
+
+/*
+ * Test asserts.
+ * Printing is supported eg MPT_ASSERT_EQ(a, b, "foo: %s", bar")
+ */
+#define MPT_ASSERT(cond, ...)   MPT__ASSERT__(cond, MPT_FATAL_NO, __VA_ARGS__)
+
+#define MPT_ASSERT_FAIL(...)    MPT_ASSERT(0, __VA_ARGS__)
+
+#define MPT_ASSERT_EQ(value, expected, ...)  MPT_ASSERT((value == expected), __VA_ARGS__)
+#define MPT_ASSERT_NEQ(value, expected, ...) MPT_ASSERT((value != expected), __VA_ARGS__)
+#define MPT_ASSERT_LEQ(value, expected, ...) MPT_ASSERT((value <= expected), __VA_ARGS__)
+#define MPT_ASSERT_GEQ(value, expected, ...) MPT_ASSERT((value >= expected), __VA_ARGS__)
+#define MPT_ASSERT_LT(value, expected, ...)  MPT_ASSERT((value  < expected), __VA_ARGS__)
+#define MPT_ASSERT_GT(value, expected, ...)  MPT_ASSERT((value  > expected), __VA_ARGS__)
+
+#define MPT_ASSERT_NULL(value, ...)     MPT_ASSERT((value == NULL), __VA_ARGS__)
+#define MPT_ASSERT_NOT_NULL(value, ...) MPT_ASSERT((value != NULL), __VA_ARGS__)
+
+#define MPT_ASSERT_STR_EQ(value, expected, ...)  MPT_ASSERT((MPT_STRCMP(value, expected, 1) == 0), __VA_ARGS__)
+#define MPT_ASSERT_STR_NEQ(value, expected, ...) MPT_ASSERT((MPT_STRCMP(value, expected, 0) != 0), __VA_ARGS__)
+#define MPT_ASSERT_STR_EMPTY(value, ...)         MPT_ASSERT((MPT_STRLEN(value, 1) == 0), __VA_ARGS__)
+#define MPT_ASSERT_STR_NOT_EMPTY(value, ...)     MPT_ASSERT((MPT_STRLEN(value, 0)  > 0), __VA_ARGS__)
+
+
+/* Fatal just means that control is returned to the parent function. */
+#define MPT_ASSERT_FATAL(cond, ...)   MPT__ASSERT__(cond, MPT_FATAL_YES, __VA_ARGS__)
+
+#define MPT_ASSERT_FATAL_FAIL(...)    MPT_ASSERT_FATAL(0, __VA_ARGS__)
+
+#define MPT_ASSERT_FATAL_EQ(value, expected, ...)  MPT_ASSERT_FATAL((value == expected), __VA_ARGS__)
+#define MPT_ASSERT_FATAL_NEQ(value, expected, ...) MPT_ASSERT_FATAL((value != expected), __VA_ARGS__)
+#define MPT_ASSERT_FATAL_LEQ(value, expected, ...) MPT_ASSERT_FATAL((value <= expected), __VA_ARGS__)
+#define MPT_ASSERT_FATAL_GEQ(value, expected, ...) MPT_ASSERT_FATAL((value >= expected), __VA_ARGS__)
+#define MPT_ASSERT_FATAL_LT(value, expected, ...)  MPT_ASSERT_FATAL((value  < expected), __VA_ARGS__)
+#define MPT_ASSERT_FATAL_GT(value, expected, ...)  MPT_ASSERT_FATAL((value  > expected), __VA_ARGS__)
+
+#define MPT_ASSERT_FATAL_NULL(value, ...)     MPT_ASSERT_FATAL((value == NULL), __VA_ARGS__)
+#define MPT_ASSERT_FATAL_NOT_NULL(value, ...) MPT_ASSERT_FATAL((value != NULL), __VA_ARGS__)
+
+#define MPT_ASSERT_FATAL_STR_EQ(value, expected, ...)  MPT_ASSERT_FATAL((MPT_STRCMP(value, expected, 1) == 0), __VA_ARGS__)
+#define MPT_ASSERT_FATAL_STR_NEQ(value, expected, ...) MPT_ASSERT_FATAL((MPT_STRCMP(value, expected, 0) != 0), __VA_ARGS__)
+#define MPT_ASSERT_FATAL_STR_EMPTY(value, ...)         MPT_ASSERT_FATAL((MPT_STRLEN(value, 1) == 0), __VA_ARGS__)
+#define MPT_ASSERT_FATAL_STR_NOT_EMPTY(value, ...)     MPT_ASSERT_FATAL((MPT_STRLEN(value, 0)  > 0), __VA_ARGS__)
+
+
+/* Helpful function to check for patterns in log callbacks. */
+int mpt_patmatch(const char *pat, const char *str);
+
+
+#endif /* MPT_H_INCLUDED */
diff --git a/src/mpt/mpt/include/mpt/private/mpt.h b/src/mpt/mpt/include/mpt/private/mpt.h
new file mode 100644
index 0000000..e167e1d
--- /dev/null
+++ b/src/mpt/mpt/include/mpt/private/mpt.h
@@ -0,0 +1,153 @@
+/*
+ * Copyright(c) 2006 to 2018 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+#ifndef MPT_PRIVATE_H_INCLUDED
+#define MPT_PRIVATE_H_INCLUDED
+
+#include <stdio.h>
+#include <string.h>
+
+
+/*
+ * Just some helpful macros.
+ */
+#define MPT_XSTR(s) MPT_STR(s)
+#define MPT_STR(s) #s
+
+#define MPT_STRCMP(value, expected, err) \
+  (((value != NULL) && (expected != NULL)) ? strcmp(value, expected) : err)
+
+#define MPT_STRLEN(value, err) \
+  ((value != NULL) ? strlen(value) : err)
+
+#define MPT_ProcessArgs     mpt__args__, mpt__retval__
+#define MPT_ProcessArgsSyntax \
+    const mpt_data_t *mpt__args__, mpt_retval_t *mpt__retval__
+
+
+
+/*
+ * Name and declaration macros.
+ */
+#define MPT_ProcessEntryName(process) \
+  MPT_ProcessEntry__ ## process
+
+#define MPT_TestInitName(suite, test) \
+    MPT_TestInit__##suite##_##test
+
+#define MPT_TestInitDeclaration(suite, test) \
+void MPT_TestInitName(suite, test)(void)
+
+#define MPT_TestFiniName(suite, test) \
+    MPT_TestFini__##suite##_##test
+
+#define MPT_TestFiniDeclaration(suite, test) \
+void MPT_TestFiniName(suite, test)(void)
+
+#define MPT_TestProcessName(suite, test, name) \
+    MPT_TestProcess__##suite##_##test##_##name
+
+#define MPT_TestProcessDeclaration(suite, test, name) \
+void MPT_TestProcessName(suite, test, name) (MPT_ProcessArgsSyntax)
+
+
+
+/*
+ * MPT Assert impl.
+ */
+typedef enum {
+  MPT_SUCCESS = 0,
+  MPT_FAILURE
+} mpt_retval_t;
+
+#define MPT_FATAL_YES 1
+#define MPT_FATAL_NO  0
+
+#ifdef _WIN32
+/* Microsoft Visual Studio does not expand __VA_ARGS__ correctly. */
+#define MPT__ASSERT__(...)     MPT__ASSERT____((__VA_ARGS__))
+#define MPT__ASSERT____(tuple) MPT__ASSERT___ tuple
+#else
+#define MPT__ASSERT__(...) MPT__ASSERT___(__VA_ARGS__)
+#endif /* _WIN32 */
+
+#define MPT__ASSERT___(cond, fatal, ...)                  \
+  do {                                                    \
+    (void)mpt__args__; /* Satisfy compiler. */            \
+    if (!(cond)) {                                        \
+      if (*mpt__retval__ == MPT_SUCCESS) {                \
+        *mpt__retval__ = MPT_FAILURE;                     \
+      }                                                   \
+      printf("MPT_FAIL(%s, %d):\n", __FILE__, __LINE__);  \
+      printf(__VA_ARGS__);                                \
+      printf("\n");                                       \
+      if (fatal == MPT_FATAL_YES) {                       \
+        return;                                           \
+      }                                                   \
+    }                                                     \
+  } while(0)
+
+
+
+/*
+ * MPT Fixture impl.
+ */
+struct mpt_env_;
+
+typedef void(*mpt_init_func_t)(void);
+typedef void(*mpt_fini_func_t)(void);
+
+typedef struct {
+  /* Test and process fixtures. */
+  mpt_init_func_t init;
+  mpt_fini_func_t fini;
+  struct mpt_env_ *environment;
+  /* Test fixtures. */
+  bool disabled;
+  int timeout;
+  bool xfail;
+  /* IPC information. */
+  int todo;
+} mpt_data_t;
+
+/* Microsoft Visual Studio does not like empty struct initializers, i.e.
+   no fixtures are specified. To work around that issue MPT_Fixture inserts a
+   NULL initializer as fall back. */
+#define MPT_Comma() ,
+#define MPT_Reduce(one, ...) one
+
+#ifdef _WIN32
+/* Microsoft Visual Studio does not expand __VA_ARGS__ correctly. */
+#define MPT_Fixture__(...) MPT_Fixture____((__VA_ARGS__))
+#define MPT_Fixture____(tuple) MPT_Fixture___ tuple
+#else
+#define MPT_Fixture__(...) MPT_Fixture___(__VA_ARGS__)
+#endif /* _WIN32 */
+
+#define MPT_Fixture___(throw, away, value, ...) value
+
+#define MPT_Fixture_(throwaway, ...) \
+  MPT_Fixture__(throwaway, ((mpt_data_t){ 0 }), ((mpt_data_t){ __VA_ARGS__ }))
+
+#define MPT_Fixture(...) \
+  MPT_Fixture_( MPT_Comma MPT_Reduce(__VA_ARGS__,) (), __VA_ARGS__ )
+
+
+
+/*
+ * MPT Support functions.
+ */
+void mpt_export_env(const struct mpt_env_ *env);
+void mpt_ipc_send(MPT_ProcessArgsSyntax, const char *str);
+void mpt_ipc_wait(MPT_ProcessArgsSyntax, const char *str);
+
+
+#endif /* MPT_PRIVATE_H_INCLUDED */
diff --git a/src/mpt/mpt/include/mpt/resource.h.in b/src/mpt/mpt/include/mpt/resource.h.in
new file mode 100644
index 0000000..13c5711
--- /dev/null
+++ b/src/mpt/mpt/include/mpt/resource.h.in
@@ -0,0 +1,6 @@
+#ifndef MPT_RESOURCE_H_INCLUDED
+#define MPT_RESOURCE_H_INCLUDED
+
+#define MPT_SOURCE_ROOT_DIR "@MPT_SOURCE_ROOT_DIR@"
+
+#endif /* MPT_RESOURCE_H_INCLUDED */
diff --git a/src/mpt/mpt/src/main.c.in b/src/mpt/mpt/src/main.c.in
new file mode 100644
index 0000000..31f0689
--- /dev/null
+++ b/src/mpt/mpt/src/main.c.in
@@ -0,0 +1,551 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <assert.h>
+#include "mpt/mpt.h"
+#include "dds/ddsrt/heap.h"
+#include "dds/ddsrt/process.h"
+#include "dds/ddsrt/environ.h"
+#include "dds/util/ut_expand_envvars.h"
+
+#ifndef _WIN32
+#include <sysexits.h>
+#else
+#define EX_USAGE (64)
+#define EX_SOFTWARE (70)
+#endif /* _WIN32 */
+
+
+
+/************************************************
+ * Support functions.
+ ************************************************/
+int
+mpt_patmatch(const char *pat, const char *str)
+{
+  while (*pat) {
+    if (*pat == '?') {
+      /* any character will do */
+      if (*str++ == 0) {
+        return 0;
+      }
+      pat++;
+    } else if (*pat == '*') {
+      /* collapse a sequence of wildcards, requiring as many
+         characters in str as there are ?s in the sequence */
+      while (*pat == '*' || *pat == '?') {
+        if (*pat == '?' && *str++ == 0) {
+          return 0;
+        }
+        pat++;
+      }
+      /* try matching on all positions where str matches pat */
+      while (*str) {
+        if (*str == *pat && mpt_patmatch(pat+1, str+1)) {
+          return 1;
+        }
+        str++;
+      }
+      return *pat == 0;
+    } else {
+      /* only an exact match */
+      if (*str++ != *pat++) {
+        return 0;
+      }
+    }
+  }
+
+  return *str == 0;
+}
+
+void
+mpt_export_env(const mpt_env_t *env)
+{
+  if (env) {
+    while ((env->name != NULL) && (env->value != NULL)) {
+      char *expanded = ut_expand_envvars(env->value);
+      ddsrt_setenv(env->name, expanded);
+      ddsrt_free(expanded);
+      env++;
+    }
+  }
+}
+
+void
+mpt_ipc_send(MPT_ProcessArgsSyntax, const char *str)
+{
+  (void)str;
+  (void)mpt__args__;
+  /* TODO: implement. */
+  MPT_ASSERT(0, "mpt_ipc_send not implemented");
+}
+
+void
+mpt_ipc_wait(MPT_ProcessArgsSyntax, const char *str)
+{
+  (void)str;
+  (void)mpt__args__;
+  /* TODO: implement. */
+  MPT_ASSERT(0, "mpt_ipc_wait not implemented");
+}
+
+
+
+/************************************************
+ * Processes.
+ ************************************************/
+@procdecls@
+
+typedef void(*mpt_func_proc_t)(
+  const mpt_data_t *mpt__args__, mpt_retval_t *mpt__retval__);
+
+typedef struct mpt_process_ {
+  const char* name;
+  ddsrt_pid_t pid;
+  mpt_func_proc_t process;
+  struct mpt_process_ *next;
+} mpt_process_t;
+
+static mpt_process_t*
+mpt_process_new(const char* name, mpt_func_proc_t process)
+{
+  mpt_process_t *proc;
+  proc = ddsrt_malloc(sizeof(mpt_process_t));
+  proc->pid = 0;
+  proc->name = name;
+  proc->process = process;
+  proc->next = NULL;
+  return proc;
+}
+
+static void
+mpt_process_freelist(mpt_process_t *proc)
+{
+  if (proc) {
+    mpt_process_freelist(proc->next);
+    if (proc->pid != 0) {
+      printf("Process %s kill(%d)\n", proc->name, (int)proc->pid);
+      ddsrt_proc_kill(proc->pid);
+    }
+    ddsrt_free(proc);
+  }
+}
+
+
+
+/************************************************
+ * Tests.
+ ************************************************/
+typedef struct mpt_test_ {
+  const char* name;
+  bool xfail;
+  dds_duration_t timeout;
+  mpt_process_t *procs;
+  struct mpt_test_ *next;
+} mpt_test_t;
+
+static mpt_test_t*
+mpt_test_new(const char* name, int secs, bool xf)
+{
+  mpt_test_t *test;
+  test = ddsrt_malloc(sizeof(mpt_test_t));
+  test->procs = NULL;
+  test->name = name;
+  test->xfail = xf;
+
+  /* This test will stop after a given timeout. However, when running in
+   * ctest, we'd like to use the ctest provided timeout functionality.
+   * So, make sure that the 'manual' timeout takes longer than the ctest
+   * timeout. */
+  if (secs == 0) {
+    test->timeout = DDS_SECS(1600);
+  } else {
+    test->timeout = DDS_SECS(secs * 2);
+  }
+
+  return test;
+}
+
+static void
+mpt_test_freelist(mpt_test_t *test)
+{
+  if (test) {
+    mpt_process_freelist(test->procs);
+    mpt_test_freelist(test->next);
+  }
+  ddsrt_free(test);
+}
+
+static void
+mpt_test_add_process(mpt_test_t *test, mpt_process_t *proc)
+{
+  /* Prepend */
+  proc->next = test->procs;
+  test->procs = proc;
+}
+
+
+
+/************************************************
+ * Suites.
+ ************************************************/
+typedef struct mpt_suite_ {
+  const char* name;
+  mpt_test_t *tests;
+  struct mpt_suite_ *next;
+} mpt_suite_t;
+
+static mpt_suite_t*
+mpt_suite_new(const char* name)
+{
+  mpt_suite_t *suite;
+  suite = ddsrt_malloc(sizeof(mpt_suite_t));
+  suite->tests = NULL;
+  suite->name = name;
+  return suite;
+}
+
+static void
+mpt_suite_freelist(mpt_suite_t *suite)
+{
+  if (suite) {
+    mpt_test_freelist(suite->tests);
+    mpt_suite_freelist(suite->next);
+  }
+  ddsrt_free(suite);
+}
+
+static void
+mpt_suite_add_test(mpt_suite_t *suite, mpt_test_t *test)
+{
+  /* Prepend */
+  test->next = suite->tests;
+  suite->tests = test;
+}
+
+static mpt_test_t*
+mpt_suite_find_test(
+  mpt_suite_t *suite, const char *tname)
+{
+  mpt_test_t *found = suite->tests;
+  while (found) {
+    if (mpt_patmatch(tname, found->name)) {
+      break;
+    }
+    found = found->next;
+  }
+  return found;
+}
+
+
+
+/************************************************
+ * Root.
+ ************************************************/
+mpt_suite_t *root = NULL;
+
+static void
+mpt_add_suite(mpt_suite_t *suite)
+{
+  /* Prepend */
+  suite->next = root;
+  root = suite;
+}
+
+static mpt_suite_t*
+mpt_find_suite(const char *sname)
+{
+  mpt_suite_t *found = root;
+  while (found) {
+    if (mpt_patmatch(sname, found->name)) {
+      break;
+    }
+    found = found->next;
+  }
+  return found;
+}
+
+static void
+mpt_add_test(const char *sname, mpt_test_t *test)
+{
+  mpt_suite_t *suite = mpt_find_suite(sname);
+  assert(suite);
+  mpt_suite_add_test(suite, test);
+}
+
+static void
+mpt_add_process(const char *sname, const char *tname, mpt_process_t *proc)
+{
+  mpt_suite_t *suite = mpt_find_suite(sname);
+  mpt_test_t *test = mpt_suite_find_test(suite, tname);
+  assert(suite);
+  assert(test);
+  mpt_test_add_process(test, proc);
+}
+
+static void
+mpt_free(void)
+{
+  mpt_suite_freelist(root);
+  root = NULL;
+}
+
+
+
+/************************************************
+ * Runner.
+ ************************************************/
+static int
+mpt_run_test(const char *exe, mpt_suite_t *suite, mpt_test_t *test)
+{
+  int result = EXIT_SUCCESS;
+  mpt_process_t *proc;
+  dds_retcode_t retcode;
+  char *argv[] = { NULL, NULL,   NULL, NULL,   NULL, NULL,   NULL, NULL };
+
+  argv[0] = "-s";
+  argv[1] = (char*)suite->name;
+  argv[2] = "-t";
+  argv[3] = (char*)test->name;
+
+  /* Start the processes. */
+  proc = test->procs;
+  while ((proc) && (result == EXIT_SUCCESS)) {
+    if (proc == test->procs) {
+      printf("\n\n");
+      printf("=====================================================\n");
+      printf("Suite: %s\n", suite->name);
+      printf("Test:  %s\n", test->name);
+      printf("=====================================================\n");
+    }
+    argv[4] = "-p";
+    argv[5] = (char*)proc->name;
+    retcode = ddsrt_proc_create(exe, argv, &proc->pid);
+    if (retcode != DDS_RETCODE_OK) {
+      printf("Start %s::%s::%s failed\n", suite->name, test->name, proc->name);
+      proc->pid = 0;
+      result = EXIT_FAILURE;
+    }
+    proc = proc->next;
+  }
+
+  /* Wait for the processes. */
+  retcode = DDS_RETCODE_OK;
+  while ((result == EXIT_SUCCESS) && (retcode == DDS_RETCODE_OK)) {
+    int32_t status;
+    ddsrt_pid_t pid;
+    /* A second/third/etc wait will restart the timeout.
+     * This means that the end timeout can take longer than the requested
+     * test timeout. However, that's good enough for our purpose. */
+    retcode = ddsrt_proc_waitpids(test->timeout, &pid, &status);
+    if (retcode == DDS_RETCODE_OK) {
+      proc = test->procs;
+      while (proc) {
+        if (proc->pid == pid) {
+          break;
+        }
+        proc = proc->next;
+      }
+      if (proc) {
+        proc->pid = 0;
+        if (status != 0) {
+          printf("Process %s::%s::%s failed (%d)\n", suite->name, test->name, proc->name, status);
+          result = EXIT_FAILURE;
+        }
+      } else {
+        printf("Wait for processes of %s::%s return unknown pid %d\n", suite->name, test->name, (int)pid);
+        result = EXIT_FAILURE;
+      }
+    } else if (retcode != DDS_RETCODE_NOT_FOUND) {
+      printf("Wait for processes of %s::%s failed (%d)\n", suite->name, test->name, (int)retcode);
+      result = EXIT_FAILURE;
+    }
+  }
+
+  /* Be sure to kill all remaining processes when needed. */
+  if (result != EXIT_SUCCESS) {
+    proc = test->procs;
+    while (proc) {
+      if (proc->pid != 0) {
+        printf("Process %s::%s::%s kill(%d)\n", suite->name, test->name, proc->name, (int)proc->pid);
+        ddsrt_proc_kill(proc->pid);
+        ddsrt_proc_waitpid(proc->pid, DDS_SECS(10), NULL);
+        proc->pid = 0;
+      }
+      proc = proc->next;
+    }
+  }
+
+  /* Revert result when we expect the test to have failed. */
+  if (test->xfail) {
+    result = ((result == EXIT_SUCCESS) ? EXIT_FAILURE : EXIT_SUCCESS);
+  }
+
+  return result;
+}
+
+static int
+mpt_run_tests(const char *exe, const char *spattern, const char *tpattern)
+{
+  int result = EXIT_SUCCESS;
+  mpt_suite_t *suite = root;
+  while (suite) {
+    if (mpt_patmatch(spattern, suite->name)) {
+      mpt_test_t *test = suite->tests;
+      while (test) {
+        if (mpt_patmatch(tpattern, test->name)) {
+          int run = mpt_run_test(exe, suite, test);
+          if (run != EXIT_SUCCESS) {
+            result = run;
+          }
+        }
+        test = test->next;
+      }
+    }
+    suite = suite->next;
+  }
+  return result;
+}
+
+static int
+mpt_run_proc(mpt_process_t *proc)
+{
+    mpt_retval_t retval = MPT_SUCCESS;
+    mpt_data_t   args;
+    proc->process(&args, &retval);
+    return (retval == MPT_SUCCESS) ? EXIT_SUCCESS : EXIT_FAILURE;
+}
+
+static int
+mpt_run_procs(const char *spattern, const char *tpattern, const char *ppattern)
+{
+  int result = EXIT_SUCCESS;
+  mpt_suite_t *suite = root;
+  while (suite) {
+    if (mpt_patmatch(spattern, suite->name)) {
+      mpt_test_t *test = suite->tests;
+      while (test) {
+        if (mpt_patmatch(tpattern, test->name)) {
+          mpt_process_t *proc = test->procs;
+          while (proc) {
+            if (mpt_patmatch(ppattern, proc->name)) {
+              int run = mpt_run_proc(proc);
+              if (run != EXIT_SUCCESS) {
+                result = run;
+              }
+            }
+            proc = proc->next;
+          }
+        }
+        test = test->next;
+      }
+    }
+    suite = suite->next;
+  }
+  return result;
+}
+
+
+
+/************************************************
+ * Main functionality.
+ ************************************************/
+static struct {
+  bool print_help;
+  const char *suite;
+  const char *test;
+  const char *process;
+} opts = {
+  false,
+  "*",
+  "*",
+  NULL
+};
+
+static int parse_options(int argc, char *argv[])
+{
+  int err = 0;
+
+  for (int i = 1; err == 0 && i < argc; i++) {
+    switch ((argv[i][0] == '-') ? argv[i][1] : 0) {
+      case 'h':
+        opts.print_help = true;
+        break;
+      case 's':
+        if ((i+1) < argc) {
+          opts.suite = argv[++i];
+          break;
+        }
+        /* FALLS THROUGH */
+      case 't':
+        if ((i+1) < argc) {
+          opts.test = argv[++i];
+          break;
+        }
+        /* FALLS THROUGH */
+      case 'p':
+        if ((i+1) < argc) {
+          opts.process = argv[++i];
+          break;
+        }
+        /* FALLS THROUGH */
+      default:
+        err = 1;
+        break;
+    }
+  }
+
+  return err;
+}
+
+static void usage(const char *name)
+{
+  fprintf(stderr, "Usage: %s OPTIONS\n", name);
+  fprintf(stderr, "Try '%s -h' for more information\n", name);
+}
+
+static void help(const char *name)
+{
+  printf("Usage: %s [OPTIONS]\n", name);
+  printf("\n");
+  printf("Possible options:\n");
+  printf("  -h           display this help and exit\n");
+  printf("  -s PATTERN   run only tests in suites matching pattern\n");
+  printf("  -t PATTERN   run only test matching pattern\n");
+  printf("  -p PROCESS   run only process matching pattern\n");
+  printf("\n");
+  printf("Exit codes:\n");
+  printf("  %-2d  Successful termination\n", EXIT_SUCCESS);
+  printf("  %-2d  One or more failing test cases\n", EXIT_FAILURE);
+  printf("  %-2d  Command line usage error\n", EX_USAGE);
+  printf("  %-2d  Internal software error\n", EX_SOFTWARE);
+}
+
+int main(int argc, char *argv[])
+{
+  int result = EXIT_SUCCESS;
+
+  if (parse_options(argc, argv) != 0) {
+    usage(argv[0]);
+    return EX_USAGE;
+  } else if (opts.print_help) {
+    help(argv[0]);
+    return result;
+  }
+
+  atexit(mpt_free);
+  @addsuites@
+  @addtests@
+  @addprocs@
+
+  if (opts.process == NULL) {
+    /* Run test(s). */
+    result = mpt_run_tests(argv[0], opts.suite, opts.test);
+  } else {
+    /* Run process(es). */
+    result = mpt_run_procs(opts.suite, opts.test, opts.process);
+  }
+
+  return result;
+}
+
diff --git a/src/mpt/tests/CMakeLists.txt b/src/mpt/tests/CMakeLists.txt
new file mode 100644
index 0000000..91a9183
--- /dev/null
+++ b/src/mpt/tests/CMakeLists.txt
@@ -0,0 +1,19 @@
+#
+# Copyright(c) 2006 to 2018 ADLINK Technology Limited and others
+#
+# This program and the accompanying materials are made available under the
+# terms of the Eclipse Public License v. 2.0 which is available at
+# http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+# v. 1.0 which is available at
+# http://www.eclipse.org/org/documents/edl-v10.php.
+#
+# SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+#
+cmake_minimum_required(VERSION 3.7)
+
+if(MPT_ENABLE_SELFTEST)
+  add_subdirectory(self)
+endif()
+
+add_subdirectory(basic)
+
diff --git a/src/mpt/tests/basic/CMakeLists.txt b/src/mpt/tests/basic/CMakeLists.txt
new file mode 100644
index 0000000..cb2efba
--- /dev/null
+++ b/src/mpt/tests/basic/CMakeLists.txt
@@ -0,0 +1,23 @@
+#
+# Copyright(c) 2006 to 2018 ADLINK Technology Limited and others
+#
+# This program and the accompanying materials are made available under the
+# terms of the Eclipse Public License v. 2.0 which is available at
+# http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+# v. 1.0 which is available at
+# http://www.eclipse.org/org/documents/edl-v10.php.
+#
+# SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+#
+include(${MPT_CMAKE})
+
+set(sources
+    "procs/hello.c"
+    "helloworld.c"
+    "multi.c")
+
+add_mpt_executable(mpt_basic ${sources})
+
+idlc_generate(mpt_basic_helloworlddata_lib "procs/helloworlddata.idl")
+target_link_libraries(mpt_basic PRIVATE mpt_basic_helloworlddata_lib)
+
diff --git a/src/mpt/tests/basic/etc/config_any.xml b/src/mpt/tests/basic/etc/config_any.xml
new file mode 100644
index 0000000..68e0e0a
--- /dev/null
+++ b/src/mpt/tests/basic/etc/config_any.xml
@@ -0,0 +1,30 @@
+<!--
+  Copyright(c) 2006 to 2018 ADLINK Technology Limited and others
+
+  This program and the accompanying materials are made available under the
+  terms of the Eclipse Public License v. 2.0 which is available at
+  http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+  v. 1.0 which is available at
+  http://www.eclipse.org/org/documents/edl-v10.php.
+
+  SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+-->
+<CycloneDDS>
+  <Domain>
+    <Id>any</Id>
+  </Domain>
+  <DDSI2E>
+    <General>
+      <NetworkInterfaceAddress>auto</NetworkInterfaceAddress>
+      <AllowMulticast>true</AllowMulticast>
+      <EnableMulticastLoopback>true</EnableMulticastLoopback>
+    </General>
+    <Compatibility>
+      <StandardsConformance>lax</StandardsConformance>
+    </Compatibility>
+    <!--Tracing>
+      <Verbosity>finest</Verbosity>
+      <OutputFile>ddsi_${MPT_PROCESS_NAME}.log</OutputFile>
+    </Tracing-->
+  </DDSI2E>
+</CycloneDDS>
diff --git a/src/mpt/tests/basic/etc/config_specific.xml b/src/mpt/tests/basic/etc/config_specific.xml
new file mode 100644
index 0000000..2ae3286
--- /dev/null
+++ b/src/mpt/tests/basic/etc/config_specific.xml
@@ -0,0 +1,30 @@
+<!--
+  Copyright(c) 2006 to 2018 ADLINK Technology Limited and others
+
+  This program and the accompanying materials are made available under the
+  terms of the Eclipse Public License v. 2.0 which is available at
+  http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+  v. 1.0 which is available at
+  http://www.eclipse.org/org/documents/edl-v10.php.
+
+  SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+-->
+<CycloneDDS>
+  <Domain>
+    <Id>${DOMAIN_ID}</Id>
+  </Domain>
+  <DDSI2E>
+    <General>
+      <NetworkInterfaceAddress>auto</NetworkInterfaceAddress>
+      <AllowMulticast>true</AllowMulticast>
+      <EnableMulticastLoopback>true</EnableMulticastLoopback>
+    </General>
+    <Compatibility>
+      <StandardsConformance>lax</StandardsConformance>
+    </Compatibility>
+    <!--Tracing>
+      <Verbosity>finest</Verbosity>
+      <OutputFile>ddsi_${MPT_PROCESS_NAME}.log</OutputFile>
+    </Tracing-->
+  </DDSI2E>
+</CycloneDDS>
diff --git a/src/mpt/tests/basic/helloworld.c b/src/mpt/tests/basic/helloworld.c
new file mode 100644
index 0000000..c959edb
--- /dev/null
+++ b/src/mpt/tests/basic/helloworld.c
@@ -0,0 +1,63 @@
+#include "dds/dds.h"
+#include "mpt/mpt.h"
+#include "mpt/resource.h" /* MPT_SOURCE_ROOT_DIR */
+#include "procs/hello.h" /* publisher and subscriber entry points. */
+
+
+/*
+ * Tests to check simple communication between a publisher and subscriber.
+ * The published text should be received by the subscriber.
+ */
+
+
+/* Environments */
+static mpt_env_t environment_any[] = {
+    { "ETC_DIR",        MPT_SOURCE_ROOT_DIR"/tests/basic/etc"   },
+    { "CYCLONEDDS_URI", "file://${ETC_DIR}/config_any.xml"      },
+    { NULL,             NULL                                    }
+};
+static mpt_env_t environment_42[] = {
+    { "ETC_DIR",        MPT_SOURCE_ROOT_DIR"/tests/basic/etc"   },
+    { "DOMAIN_ID",      "42"                                    },
+    { "CYCLONEDDS_URI", "file://${ETC_DIR}/config_specific.xml" },
+    { NULL,             NULL                                    }
+};
+
+
+
+/**********************************************************************
+ * No CYCLONEDDS_URI set.
+ **********************************************************************/
+#define TEST_ARGS MPT_ArgValues(DDS_DOMAIN_DEFAULT, "hello_def", 1, "No environment set")
+MPT_TestProcess(helloworld, default, pub, hello_publisher,  TEST_ARGS);
+MPT_TestProcess(helloworld, default, sub, hello_subscriber, TEST_ARGS);
+MPT_Test(helloworld, default, .init=hello_init, .fini=hello_fini);
+#undef TEST_ARGS
+
+
+
+/**********************************************************************
+ * Config domain is any. Test domain is default.
+ **********************************************************************/
+#define TEST_ARGS MPT_ArgValues(DDS_DOMAIN_DEFAULT, "hello_any", 1, "Some nice text over any domain")
+MPT_TestProcess(helloworld, domain_any, pub, hello_publisher,  TEST_ARGS);
+MPT_TestProcess(helloworld, domain_any, sub, hello_subscriber, TEST_ARGS);
+MPT_Test(helloworld, domain_any, .init=hello_init, .fini=hello_fini, .environment=environment_any);
+#undef TEST_ARGS
+
+
+
+/**********************************************************************
+ * Pub: Config domain is any. Test domain is 42.
+ * Sub: Config domain is 42 (through DOMAIN_ID env). Test domain is default.
+ **********************************************************************/
+#define TEST_PUB_ARGS MPT_ArgValues(42,                 "hello_42", 1, "Now domain 42 is used")
+#define TEST_SUB_ARGS MPT_ArgValues(DDS_DOMAIN_DEFAULT, "hello_42", 1, "Now domain 42 is used")
+MPT_TestProcess(helloworld, domain_42, pub, hello_publisher,  TEST_PUB_ARGS, .environment=environment_any);
+MPT_TestProcess(helloworld, domain_42, sub, hello_subscriber, TEST_SUB_ARGS, .environment=environment_42);
+MPT_Test(helloworld, domain_42, .init=hello_init, .fini=hello_fini);
+#undef TEST_SUB_ARGS
+#undef TEST_PUB_ARGS
+
+
+
diff --git a/src/mpt/tests/basic/multi.c b/src/mpt/tests/basic/multi.c
new file mode 100644
index 0000000..4ed5743
--- /dev/null
+++ b/src/mpt/tests/basic/multi.c
@@ -0,0 +1,50 @@
+#include "mpt/mpt.h"
+#include "procs/hello.h"
+
+
+/*
+ * Tests to check communication between multiple publisher(s) and subscriber(s).
+ */
+
+
+/*
+ * The publisher expects 2 publication matched.
+ * The subscribers expect 1 sample each.
+ */
+#define TEST_PUB_ARGS MPT_ArgValues(DDS_DOMAIN_DEFAULT, "multi_pubsubsub", 2, "pubsubsub")
+#define TEST_SUB_ARGS MPT_ArgValues(DDS_DOMAIN_DEFAULT, "multi_pubsubsub", 1, "pubsubsub")
+MPT_TestProcess(multi, pubsubsub, pub,  hello_publisher,  TEST_PUB_ARGS);
+MPT_TestProcess(multi, pubsubsub, sub1, hello_subscriber, TEST_SUB_ARGS);
+MPT_TestProcess(multi, pubsubsub, sub2, hello_subscriber, TEST_SUB_ARGS);
+MPT_Test(multi, pubsubsub, .init=hello_init, .fini=hello_fini);
+#undef TEST_SUB_ARGS
+#undef TEST_PUB_ARGS
+
+
+/*
+ * The publishers expect 1 publication matched each.
+ * The subscriber expects 2 samples.
+ */
+#define TEST_PUB_ARGS MPT_ArgValues(DDS_DOMAIN_DEFAULT, "multi_pubpubsub", 1, "pubpubsub")
+#define TEST_SUB_ARGS MPT_ArgValues(DDS_DOMAIN_DEFAULT, "multi_pubpubsub", 2, "pubpubsub")
+MPT_TestProcess(multi, pubpubsub, pub1, hello_publisher,  TEST_PUB_ARGS);
+MPT_TestProcess(multi, pubpubsub, pub2, hello_publisher,  TEST_PUB_ARGS);
+MPT_TestProcess(multi, pubpubsub, sub,  hello_subscriber, TEST_SUB_ARGS);
+MPT_Test(multi, pubpubsub, .init=hello_init, .fini=hello_fini);
+#undef TEST_SUB_ARGS
+#undef TEST_PUB_ARGS
+
+
+/*
+ * The publishers expect 2 publication matched each.
+ * The subscribers expect 2 samples each.
+ */
+#define TEST_PUB_ARGS MPT_ArgValues(DDS_DOMAIN_DEFAULT, "multi_pubpubsubsub", 2, "pubpubsubsub")
+#define TEST_SUB_ARGS MPT_ArgValues(DDS_DOMAIN_DEFAULT, "multi_pubpubsubsub", 2, "pubpubsubsub")
+MPT_TestProcess(multi, pubpubsubsub, pub1, hello_publisher,  TEST_PUB_ARGS);
+MPT_TestProcess(multi, pubpubsubsub, pub2, hello_publisher,  TEST_PUB_ARGS);
+MPT_TestProcess(multi, pubpubsubsub, sub1, hello_subscriber, TEST_SUB_ARGS);
+MPT_TestProcess(multi, pubpubsubsub, sub2, hello_subscriber, TEST_SUB_ARGS);
+MPT_Test(multi, pubpubsubsub, .init=hello_init, .fini=hello_fini);
+#undef TEST_SUB_ARGS
+#undef TEST_PUB_ARGS
diff --git a/src/mpt/tests/basic/procs/hello.c b/src/mpt/tests/basic/procs/hello.c
new file mode 100644
index 0000000..2c68a84
--- /dev/null
+++ b/src/mpt/tests/basic/procs/hello.c
@@ -0,0 +1,239 @@
+#include <stdio.h>
+#include <string.h>
+#include <assert.h>
+
+#include "mpt/mpt.h"
+
+#include "dds/dds.h"
+#include "helloworlddata.h"
+
+#include "dds/ddsrt/time.h"
+#include "dds/ddsrt/strtol.h"
+#include "dds/ddsrt/process.h"
+#include "dds/ddsrt/environ.h"
+#include "dds/ddsrt/cdtors.h"
+#include "dds/ddsrt/sync.h"
+
+
+/* An array of one message (aka sample in dds terms) will be used. */
+#define MAX_SAMPLES 1
+
+static int g_publication_matched_count = 0;
+static ddsrt_mutex_t g_mutex;
+static ddsrt_cond_t  g_cond;
+
+static void
+publication_matched_cb(
+        dds_entity_t writer,
+        const dds_publication_matched_status_t status,
+        void* arg)
+{
+  (void)arg;
+  (void)writer;
+  ddsrt_mutex_lock(&g_mutex);
+  g_publication_matched_count = (int)status.current_count;
+  ddsrt_cond_broadcast(&g_cond);
+  ddsrt_mutex_unlock(&g_mutex);
+}
+
+static void
+data_available_cb(
+        dds_entity_t reader,
+        void* arg)
+{
+  (void)arg;
+  (void)reader;
+  ddsrt_mutex_lock(&g_mutex);
+  ddsrt_cond_broadcast(&g_cond);
+  ddsrt_mutex_unlock(&g_mutex);
+}
+
+void
+hello_init(void)
+{
+  ddsrt_init();
+  ddsrt_mutex_init(&g_mutex);
+  ddsrt_cond_init(&g_cond);
+}
+
+void
+hello_fini(void)
+{
+  ddsrt_cond_destroy(&g_cond);
+  ddsrt_mutex_destroy(&g_mutex);
+  ddsrt_fini();
+}
+
+
+/*
+ * The HelloWorld publisher.
+ * It waits for a publication matched, and then writes a sample.
+ * It quits when the publication matched has been reset again.
+ */
+MPT_ProcessEntry(hello_publisher,
+                 MPT_Args(dds_domainid_t domainid,
+                          const char *topic_name,
+                          int sub_cnt,
+                          const char *text))
+{
+  HelloWorldData_Msg msg;
+  dds_listener_t *listener;
+  dds_entity_t participant;
+  dds_entity_t topic;
+  dds_entity_t writer;
+  dds_return_t rc;
+  dds_qos_t *qos;
+  int id = (int)ddsrt_getpid();
+
+  assert(topic_name);
+  assert(text);
+
+  printf("=== [Publisher(%d)] Start(%d) ...\n", id, domainid);
+
+  /*
+   * A reliable volatile sample, written after publication matched, can still
+   * be lost when the subscriber wasn't able to match its subscription yet.
+   * Use transient_local reliable to make sure the sample is received.
+   */
+  qos = dds_create_qos();
+  dds_qset_durability(qos, DDS_DURABILITY_TRANSIENT_LOCAL);
+  dds_qset_reliability(qos, DDS_RELIABILITY_RELIABLE, DDS_SECS(10));
+
+  /* Use listener to get number of publications matched. */
+  listener = dds_create_listener(NULL);
+  MPT_ASSERT_FATAL_NOT_NULL(listener, "Could not create listener");
+  dds_lset_publication_matched(listener, publication_matched_cb);
+
+  /* Create a Writer. */
+  participant = dds_create_participant (domainid, NULL, NULL);
+  MPT_ASSERT_FATAL_GT(participant, 0, "Could not create participant: %s\n", dds_strretcode(-participant));
+
+  topic = dds_create_topic (
+            participant, &HelloWorldData_Msg_desc, topic_name, qos, NULL);
+  MPT_ASSERT_FATAL_GT(topic, 0, "Could not create topic: %s\n", dds_strretcode(-topic));
+
+  writer = dds_create_writer (participant, topic, qos, listener);
+  MPT_ASSERT_FATAL_GT(writer, 0, "Could not create writer: %s\n", dds_strretcode(-writer));
+
+  /* Wait for expected nr of subscriber(s). */
+  ddsrt_mutex_lock(&g_mutex);
+  while (g_publication_matched_count != sub_cnt) {
+    ddsrt_cond_waitfor(&g_cond, &g_mutex, DDS_INFINITY);
+  }
+  ddsrt_mutex_unlock(&g_mutex);
+
+  /* Write sample. */
+  msg.userID = (int32_t)id;
+  msg.message = (char*)text;
+  printf("=== [Publisher(%d)] Send: { %d, %s }\n", id, msg.userID, msg.message);
+  rc = dds_write (writer, &msg);
+  MPT_ASSERT_EQ(rc, DDS_RETCODE_OK, "Could not write sample\n");
+
+  /* Wait for subscriber(s) to have finished. */
+  ddsrt_mutex_lock(&g_mutex);
+  while (g_publication_matched_count != 0) {
+    ddsrt_cond_waitfor(&g_cond, &g_mutex, DDS_INFINITY);
+  }
+  ddsrt_mutex_unlock(&g_mutex);
+
+  rc = dds_delete (participant);
+  MPT_ASSERT_EQ(rc, DDS_RETCODE_OK, "Teardown failed\n");
+
+  dds_delete_listener(listener);
+  dds_delete_qos(qos);
+
+  printf("=== [Publisher(%d)] Done\n", id);
+}
+
+
+/*
+ * The HelloWorld subscriber.
+ * It waits for sample(s) and checks the content.
+ */
+MPT_ProcessEntry(hello_subscriber,
+                 MPT_Args(dds_domainid_t domainid,
+                          const char *topic_name,
+                          int sample_cnt,
+                          const char *text))
+{
+  HelloWorldData_Msg *msg;
+  void *samples[MAX_SAMPLES];
+  dds_sample_info_t infos[MAX_SAMPLES];
+  dds_listener_t *listener;
+  dds_entity_t participant;
+  dds_entity_t topic;
+  dds_entity_t reader;
+  dds_return_t rc;
+  dds_qos_t *qos;
+  int recv_cnt;
+  int id = (int)ddsrt_getpid();
+
+  assert(topic_name);
+  assert(text);
+
+  printf("--- [Subscriber(%d)] Start(%d) ...\n", id, domainid);
+
+  /*
+   * A reliable volatile sample, written after publication matched, can still
+   * be lost when the subscriber wasn't able to match its subscription yet.
+   * Use transient_local reliable to make sure the sample is received.
+   */
+  qos = dds_create_qos();
+  dds_qset_durability(qos, DDS_DURABILITY_TRANSIENT_LOCAL);
+  dds_qset_reliability(qos, DDS_RELIABILITY_RELIABLE, DDS_SECS(10));
+
+  /* Use listener to get data available trigger. */
+  listener = dds_create_listener(NULL);
+  MPT_ASSERT_FATAL_NOT_NULL(listener, "Could not create listener");
+  dds_lset_data_available(listener, data_available_cb);
+
+  /* Create a Reader. */
+  participant = dds_create_participant (DDS_DOMAIN_DEFAULT, NULL, NULL);
+  MPT_ASSERT_FATAL_GT(participant, 0, "Could not create participant: %s\n", dds_strretcode(-participant));
+  topic = dds_create_topic (
+            participant, &HelloWorldData_Msg_desc, topic_name, qos, NULL);
+  MPT_ASSERT_FATAL_GT(topic, 0, "Could not create topic: %s\n", dds_strretcode(-topic));
+  reader = dds_create_reader (participant, topic, qos, listener);
+  MPT_ASSERT_FATAL_GT(reader, 0, "Could not create reader: %s\n", dds_strretcode(-reader));
+
+  printf("--- [Subscriber(%d)] Waiting for %d sample(s) ...\n", id, sample_cnt);
+
+  /* Initialize sample buffer, by pointing the void pointer within
+   * the buffer array to a valid sample memory location. */
+  samples[0] = HelloWorldData_Msg__alloc ();
+
+  /* Wait until expected nr of samples have been taken. */
+  ddsrt_mutex_lock(&g_mutex);
+  recv_cnt = 0;
+  while (recv_cnt < sample_cnt) {
+    /* Use a take with mask to work around the #146 issue. */
+    rc = dds_take_mask(reader, samples, infos, MAX_SAMPLES, MAX_SAMPLES, DDS_NEW_VIEW_STATE);
+    MPT_ASSERT_GEQ(rc, 0, "Could not read: %s\n", dds_strretcode(-rc));
+
+    /* Check if we read some data and it is valid. */
+    if ((rc > 0) && (infos[0].valid_data)) {
+      /* Print Message. */
+      msg = (HelloWorldData_Msg*)samples[0];
+      printf("--- [Subscriber(%d)] Received: { %d, %s }\n", id,
+                                    msg->userID, msg->message);
+      MPT_ASSERT_STR_EQ(msg->message, text,
+                        "Messages do not match: \"%s\" vs \"%s\"\n",
+                        msg->message, text);
+      recv_cnt++;
+    } else {
+      ddsrt_cond_waitfor(&g_cond, &g_mutex, DDS_INFINITY);
+    }
+  }
+  ddsrt_mutex_unlock(&g_mutex);
+
+  /* Free the data location. */
+  HelloWorldData_Msg_free (samples[0], DDS_FREE_ALL);
+
+  rc = dds_delete (participant);
+  MPT_ASSERT_EQ(rc, DDS_RETCODE_OK, "Teardown failed\n");
+
+  dds_delete_listener(listener);
+  dds_delete_qos(qos);
+
+  printf("--- [Subscriber(%d)] Done\n", id);
+}
diff --git a/src/mpt/tests/basic/procs/hello.h b/src/mpt/tests/basic/procs/hello.h
new file mode 100644
index 0000000..b1d1772
--- /dev/null
+++ b/src/mpt/tests/basic/procs/hello.h
@@ -0,0 +1,52 @@
+/*
+ * Copyright(c) 2006 to 2018 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+
+/** @file
+ *
+ * @brief DDS C Communication Status API
+ *
+ * This header file defines the public API of the Communication Status in the
+ * Eclipse Cyclone DDS C language binding.
+ */
+#ifndef MPT_BASIC_PROCS_HELLO_H
+#define MPT_BASIC_PROCS_HELLO_H
+
+#include <stdio.h>
+#include <string.h>
+
+#include "dds/dds.h"
+#include "mpt/mpt.h"
+
+#if defined (__cplusplus)
+extern "C" {
+#endif
+
+void hello_init(void);
+void hello_fini(void);
+
+MPT_ProcessEntry(hello_publisher,
+                 MPT_Args(dds_domainid_t domainid,
+                          const char *topic_name,
+                          int sub_cnt,
+                          const char *text));
+
+MPT_ProcessEntry(hello_subscriber,
+                 MPT_Args(dds_domainid_t domainid,
+                          const char *topic_name,
+                          int sample_cnt,
+                          const char *text));
+
+#if defined (__cplusplus)
+}
+#endif
+
+#endif /* MPT_BASIC_PROCS_HELLO_H */
diff --git a/src/mpt/tests/basic/procs/helloworlddata.idl b/src/mpt/tests/basic/procs/helloworlddata.idl
new file mode 100644
index 0000000..9561d75
--- /dev/null
+++ b/src/mpt/tests/basic/procs/helloworlddata.idl
@@ -0,0 +1,9 @@
+module HelloWorldData
+{
+  struct Msg
+  {
+    long userID;
+    string message;
+  };
+  #pragma keylist Msg userID
+};
diff --git a/src/mpt/tests/self/CMakeLists.txt b/src/mpt/tests/self/CMakeLists.txt
new file mode 100644
index 0000000..8203b5d
--- /dev/null
+++ b/src/mpt/tests/self/CMakeLists.txt
@@ -0,0 +1,25 @@
+#
+# Copyright(c) 2006 to 2018 ADLINK Technology Limited and others
+#
+# This program and the accompanying materials are made available under the
+# terms of the Eclipse Public License v. 2.0 which is available at
+# http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+# v. 1.0 which is available at
+# http://www.eclipse.org/org/documents/edl-v10.php.
+#
+# SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+#
+include(${MPT_CMAKE})
+
+message(STATUS "MPT selftest enabled: some test will fail deliberately")
+
+set(sources
+    "asserts.c"
+    "environments.c"
+    "fixtures.c"
+    "ipc.c"
+    "resources.c"
+    "usage.c")
+
+add_mpt_executable(mpt_self ${sources})
+
diff --git a/src/mpt/tests/self/asserts.c b/src/mpt/tests/self/asserts.c
new file mode 100644
index 0000000..72495a1
--- /dev/null
+++ b/src/mpt/tests/self/asserts.c
@@ -0,0 +1,711 @@
+#include <stdio.h>
+#include <assert.h>
+#include "mpt/mpt.h"
+#include "dds/ddsrt/time.h"
+
+static int dummy;
+
+
+
+/************************************************************
+ * Test MPT_ASSERT
+ ************************************************************/
+MPT_ProcessEntry(proc_MPT_ASSERT, MPT_Args(const char *exp, int cond))
+{
+  assert(exp);
+  MPT_ASSERT(cond, "MPT_ASSERT(%d), 1st, expect: %s", cond, exp);
+  MPT_ASSERT(cond, "MPT_ASSERT(%d), 2nd, expect: %s", cond, exp);
+}
+MPT_TestProcess(MPT_ASSERT, pass, id, proc_MPT_ASSERT, MPT_ArgValues("PASS", 1));
+MPT_TestProcess(MPT_ASSERT, fail, id, proc_MPT_ASSERT, MPT_ArgValues("FAIL", 0));
+MPT_Test(MPT_ASSERT, pass, .xfail=false);
+MPT_Test(MPT_ASSERT, fail, .xfail=true);
+
+
+
+/************************************************************
+ * Test MPT_ASSERT_FAIL
+ ************************************************************/
+MPT_ProcessEntry(proc_MPT_ASSERT_FAIL, MPT_NoArgs())
+{
+  MPT_ASSERT_FAIL("MPT_ASSERT_FAIL(), 1st, expect a fail, always");
+  MPT_ASSERT_FAIL("MPT_ASSERT_FAIL(), 2nd, expect a fail, always");
+}
+MPT_TestProcess(MPT_ASSERT_FAIL, call, id, proc_MPT_ASSERT_FAIL, MPT_NoArgValues());
+MPT_Test(MPT_ASSERT_FAIL, call, .xfail=true);
+
+
+
+/************************************************************
+ * Test MPT_ASSERT_EQ
+ ************************************************************/
+MPT_ProcessEntry(proc_MPT_ASSERT_EQ_int, MPT_Args(const char *exp, int val1, int val2))
+{
+  assert(exp);
+  MPT_ASSERT_EQ(val1, val2, "MPT_ASSERT_EQ(%d, %d), 1st expect: %s", val1, val2, exp);
+  MPT_ASSERT_EQ(val1, val2, "MPT_ASSERT_EQ(%d, %d), 2nd expect: %s", val1, val2, exp);
+}
+MPT_TestProcess(MPT_ASSERT_EQ_int, eq, id, proc_MPT_ASSERT_EQ_int, MPT_ArgValues("PASS", 1, 1));
+MPT_TestProcess(MPT_ASSERT_EQ_int, lt, id, proc_MPT_ASSERT_EQ_int, MPT_ArgValues("FAIL", 1, 2));
+MPT_TestProcess(MPT_ASSERT_EQ_int, gt, id, proc_MPT_ASSERT_EQ_int, MPT_ArgValues("FAIL", 3, 2));
+MPT_Test(MPT_ASSERT_EQ_int, eq, .xfail=false);
+MPT_Test(MPT_ASSERT_EQ_int, lt, .xfail=true);
+MPT_Test(MPT_ASSERT_EQ_int, gt, .xfail=true);
+
+
+MPT_ProcessEntry(proc_MPT_ASSERT_EQ_double, MPT_Args(const char *exp, double val1, double val2))
+{
+  assert(exp);
+  MPT_ASSERT_EQ(val1, val2, "MPT_ASSERT_EQ(%f, %f), 1st expect: %s", val1, val2, exp);
+  MPT_ASSERT_EQ(val1, val2, "MPT_ASSERT_EQ(%f, %f), 2nd expect: %s", val1, val2, exp);
+}
+MPT_TestProcess(MPT_ASSERT_EQ_double, eq, id, proc_MPT_ASSERT_EQ_double, MPT_ArgValues("PASS", 1.1, 1.1));
+MPT_TestProcess(MPT_ASSERT_EQ_double, lt, id, proc_MPT_ASSERT_EQ_double, MPT_ArgValues("FAIL", 1.1, 1.2));
+MPT_TestProcess(MPT_ASSERT_EQ_double, gt, id, proc_MPT_ASSERT_EQ_double, MPT_ArgValues("FAIL", 1.3, 1.2));
+MPT_Test(MPT_ASSERT_EQ_double, eq, .xfail=false);
+MPT_Test(MPT_ASSERT_EQ_double, lt, .xfail=true);
+MPT_Test(MPT_ASSERT_EQ_double, gt, .xfail=true);
+
+
+
+/************************************************************
+ * Test MPT_ASSERT_NEQ
+ ************************************************************/
+MPT_ProcessEntry(proc_MPT_ASSERT_NEQ_int, MPT_Args(const char *exp, int val1, int val2))
+{
+  assert(exp);
+  MPT_ASSERT_NEQ(val1, val2, "MPT_ASSERT_NEQ(%d, %d), 1st expect: %s", val1, val2, exp);
+  MPT_ASSERT_NEQ(val1, val2, "MPT_ASSERT_NEQ(%d, %d), 2nd expect: %s", val1, val2, exp);
+}
+MPT_TestProcess(MPT_ASSERT_NEQ_int, eq, id, proc_MPT_ASSERT_NEQ_int, MPT_ArgValues("FAIL", 1, 1));
+MPT_TestProcess(MPT_ASSERT_NEQ_int, lt, id, proc_MPT_ASSERT_NEQ_int, MPT_ArgValues("PASS", 1, 2));
+MPT_TestProcess(MPT_ASSERT_NEQ_int, gt, id, proc_MPT_ASSERT_NEQ_int, MPT_ArgValues("PASS", 3, 2));
+MPT_Test(MPT_ASSERT_NEQ_int, eq, .xfail=true);
+MPT_Test(MPT_ASSERT_NEQ_int, lt, .xfail=false);
+MPT_Test(MPT_ASSERT_NEQ_int, gt, .xfail=false);
+
+
+MPT_ProcessEntry(proc_MPT_ASSERT_NEQ_double, MPT_Args(const char *exp, double val1, double val2))
+{
+  assert(exp);
+  MPT_ASSERT_NEQ(val1, val2, "MPT_ASSERT_NEQ(%f, %f), 1st expect: %s", val1, val2, exp);
+  MPT_ASSERT_NEQ(val1, val2, "MPT_ASSERT_NEQ(%f, %f), 2nd expect: %s", val1, val2, exp);
+}
+MPT_TestProcess(MPT_ASSERT_NEQ_double, eq, id, proc_MPT_ASSERT_NEQ_double, MPT_ArgValues("FAIL", 1.1, 1.1));
+MPT_TestProcess(MPT_ASSERT_NEQ_double, lt, id, proc_MPT_ASSERT_NEQ_double, MPT_ArgValues("PASS", 1.1, 1.2));
+MPT_TestProcess(MPT_ASSERT_NEQ_double, gt, id, proc_MPT_ASSERT_NEQ_double, MPT_ArgValues("PASS", 1.3, 1.2));
+MPT_Test(MPT_ASSERT_NEQ_double, eq, .xfail=true);
+MPT_Test(MPT_ASSERT_NEQ_double, lt, .xfail=false);
+MPT_Test(MPT_ASSERT_NEQ_double, gt, .xfail=false);
+
+
+
+/************************************************************
+ * Test MPT_ASSERT_LEQ
+ ************************************************************/
+MPT_ProcessEntry(proc_MPT_ASSERT_LEQ_int, MPT_Args(const char *exp, int val1, int val2))
+{
+  assert(exp);
+  MPT_ASSERT_LEQ(val1, val2, "MPT_ASSERT_LEQ(%d, %d), 1st expect: %s", val1, val2, exp);
+  MPT_ASSERT_LEQ(val1, val2, "MPT_ASSERT_LEQ(%d, %d), 2nd expect: %s", val1, val2, exp);
+}
+MPT_TestProcess(MPT_ASSERT_LEQ_int, eq, id, proc_MPT_ASSERT_LEQ_int, MPT_ArgValues("PASS", 1, 1));
+MPT_TestProcess(MPT_ASSERT_LEQ_int, lt, id, proc_MPT_ASSERT_LEQ_int, MPT_ArgValues("PASS", 1, 2));
+MPT_TestProcess(MPT_ASSERT_LEQ_int, gt, id, proc_MPT_ASSERT_LEQ_int, MPT_ArgValues("FAIL", 3, 2));
+MPT_Test(MPT_ASSERT_LEQ_int, eq, .xfail=false);
+MPT_Test(MPT_ASSERT_LEQ_int, lt, .xfail=false);
+MPT_Test(MPT_ASSERT_LEQ_int, gt, .xfail=true);
+
+
+MPT_ProcessEntry(proc_MPT_ASSERT_LEQ_double, MPT_Args(const char *exp, double val1, double val2))
+{
+  assert(exp);
+  MPT_ASSERT_LEQ(val1, val2, "MPT_ASSERT_LEQ(%f, %f), 1st expect: %s", val1, val2, exp);
+  MPT_ASSERT_LEQ(val1, val2, "MPT_ASSERT_LEQ(%f, %f), 2nd expect: %s", val1, val2, exp);
+}
+MPT_TestProcess(MPT_ASSERT_LEQ_double, eq, id, proc_MPT_ASSERT_LEQ_double, MPT_ArgValues("PASS", 1.1, 1.1));
+MPT_TestProcess(MPT_ASSERT_LEQ_double, lt, id, proc_MPT_ASSERT_LEQ_double, MPT_ArgValues("PASS", 1.1, 1.2));
+MPT_TestProcess(MPT_ASSERT_LEQ_double, gt, id, proc_MPT_ASSERT_LEQ_double, MPT_ArgValues("FAIL", 1.3, 1.2));
+MPT_Test(MPT_ASSERT_LEQ_double, eq, .xfail=false);
+MPT_Test(MPT_ASSERT_LEQ_double, lt, .xfail=false);
+MPT_Test(MPT_ASSERT_LEQ_double, gt, .xfail=true);
+
+
+
+/************************************************************
+ * Test MPT_ASSERT_GEQ
+ ************************************************************/
+MPT_ProcessEntry(proc_MPT_ASSERT_GEQ_int, MPT_Args(const char *exp, int val1, int val2))
+{
+  assert(exp);
+  MPT_ASSERT_GEQ(val1, val2, "MPT_ASSERT_GEQ(%d, %d), 1st expect: %s", val1, val2, exp);
+  MPT_ASSERT_GEQ(val1, val2, "MPT_ASSERT_GEQ(%d, %d), 2nd expect: %s", val1, val2, exp);
+}
+MPT_TestProcess(MPT_ASSERT_GEQ_int, eq, id, proc_MPT_ASSERT_GEQ_int, MPT_ArgValues("PASS", 1, 1));
+MPT_TestProcess(MPT_ASSERT_GEQ_int, lt, id, proc_MPT_ASSERT_GEQ_int, MPT_ArgValues("FAIL", 1, 2));
+MPT_TestProcess(MPT_ASSERT_GEQ_int, gt, id, proc_MPT_ASSERT_GEQ_int, MPT_ArgValues("PASS", 3, 2));
+MPT_Test(MPT_ASSERT_GEQ_int, eq, .xfail=false);
+MPT_Test(MPT_ASSERT_GEQ_int, lt, .xfail=true);
+MPT_Test(MPT_ASSERT_GEQ_int, gt, .xfail=false);
+
+
+MPT_ProcessEntry(proc_MPT_ASSERT_GEQ_double, MPT_Args(const char *exp, double val1, double val2))
+{
+  assert(exp);
+  MPT_ASSERT_GEQ(val1, val2, "MPT_ASSERT_GEQ(%f, %f), 1st expect: %s", val1, val2, exp);
+  MPT_ASSERT_GEQ(val1, val2, "MPT_ASSERT_GEQ(%f, %f), 2nd expect: %s", val1, val2, exp);
+}
+MPT_TestProcess(MPT_ASSERT_GEQ_double, eq, id, proc_MPT_ASSERT_GEQ_double, MPT_ArgValues("PASS", 1.1, 1.1));
+MPT_TestProcess(MPT_ASSERT_GEQ_double, lt, id, proc_MPT_ASSERT_GEQ_double, MPT_ArgValues("FAIL", 1.1, 1.2));
+MPT_TestProcess(MPT_ASSERT_GEQ_double, gt, id, proc_MPT_ASSERT_GEQ_double, MPT_ArgValues("PASS", 1.3, 1.2));
+MPT_Test(MPT_ASSERT_GEQ_double, eq, .xfail=false);
+MPT_Test(MPT_ASSERT_GEQ_double, lt, .xfail=true);
+MPT_Test(MPT_ASSERT_GEQ_double, gt, .xfail=false);
+
+
+
+/************************************************************
+ * Test MPT_ASSERT_LT
+ ************************************************************/
+MPT_ProcessEntry(proc_MPT_ASSERT_LT_int, MPT_Args(const char *exp, int val1, int val2))
+{
+  assert(exp);
+  MPT_ASSERT_LT(val1, val2, "MPT_ASSERT_LT(%d, %d), 1st expect: %s", val1, val2, exp);
+  MPT_ASSERT_LT(val1, val2, "MPT_ASSERT_LT(%d, %d), 2nd expect: %s", val1, val2, exp);
+}
+MPT_TestProcess(MPT_ASSERT_LT_int, eq, id, proc_MPT_ASSERT_LT_int, MPT_ArgValues("FAIL", 1, 1));
+MPT_TestProcess(MPT_ASSERT_LT_int, lt, id, proc_MPT_ASSERT_LT_int, MPT_ArgValues("PASS", 1, 2));
+MPT_TestProcess(MPT_ASSERT_LT_int, gt, id, proc_MPT_ASSERT_LT_int, MPT_ArgValues("FAIL", 3, 2));
+MPT_Test(MPT_ASSERT_LT_int, eq, .xfail=true);
+MPT_Test(MPT_ASSERT_LT_int, lt, .xfail=false);
+MPT_Test(MPT_ASSERT_LT_int, gt, .xfail=true);
+
+
+MPT_ProcessEntry(proc_MPT_ASSERT_LT_double, MPT_Args(const char *exp, double val1, double val2))
+{
+  assert(exp);
+  MPT_ASSERT_LT(val1, val2, "MPT_ASSERT_LT(%f, %f), 1st expect: %s", val1, val2, exp);
+  MPT_ASSERT_LT(val1, val2, "MPT_ASSERT_LT(%f, %f), 2nd expect: %s", val1, val2, exp);
+}
+MPT_TestProcess(MPT_ASSERT_LT_double, eq, id, proc_MPT_ASSERT_LT_double, MPT_ArgValues("FAIL", 1.1, 1.1));
+MPT_TestProcess(MPT_ASSERT_LT_double, lt, id, proc_MPT_ASSERT_LT_double, MPT_ArgValues("PASS", 1.1, 1.2));
+MPT_TestProcess(MPT_ASSERT_LT_double, gt, id, proc_MPT_ASSERT_LT_double, MPT_ArgValues("FAIL", 1.3, 1.2));
+MPT_Test(MPT_ASSERT_LT_double, eq, .xfail=true);
+MPT_Test(MPT_ASSERT_LT_double, lt, .xfail=false);
+MPT_Test(MPT_ASSERT_LT_double, gt, .xfail=true);
+
+
+
+/************************************************************
+ * Test MPT_ASSERT_GT
+ ************************************************************/
+MPT_ProcessEntry(proc_MPT_ASSERT_GT_int, MPT_Args(const char *exp, int val1, int val2))
+{
+  assert(exp);
+  MPT_ASSERT_GT(val1, val2, "MPT_ASSERT_GT(%d, %d), 1st expect: %s", val1, val2, exp);
+  MPT_ASSERT_GT(val1, val2, "MPT_ASSERT_GT(%d, %d), 2nd expect: %s", val1, val2, exp);
+}
+MPT_TestProcess(MPT_ASSERT_GT_int, eq, id, proc_MPT_ASSERT_GT_int, MPT_ArgValues("FAIL", 1, 1));
+MPT_TestProcess(MPT_ASSERT_GT_int, lt, id, proc_MPT_ASSERT_GT_int, MPT_ArgValues("FAIL", 1, 2));
+MPT_TestProcess(MPT_ASSERT_GT_int, gt, id, proc_MPT_ASSERT_GT_int, MPT_ArgValues("PASS", 3, 2));
+MPT_Test(MPT_ASSERT_GT_int, eq, .xfail=true);
+MPT_Test(MPT_ASSERT_GT_int, lt, .xfail=true);
+MPT_Test(MPT_ASSERT_GT_int, gt, .xfail=false);
+
+
+MPT_ProcessEntry(proc_MPT_ASSERT_GT_double, MPT_Args(const char *exp, double val1, double val2))
+{
+  assert(exp);
+  MPT_ASSERT_GT(val1, val2, "MPT_ASSERT_GT(%f, %f), 1st expect: %s", val1, val2, exp);
+  MPT_ASSERT_GT(val1, val2, "MPT_ASSERT_GT(%f, %f), 2nd expect: %s", val1, val2, exp);
+}
+MPT_TestProcess(MPT_ASSERT_GT_double, eq, id, proc_MPT_ASSERT_GT_double, MPT_ArgValues("FAIL", 1.1, 1.1));
+MPT_TestProcess(MPT_ASSERT_GT_double, lt, id, proc_MPT_ASSERT_GT_double, MPT_ArgValues("FAIL", 1.1, 1.2));
+MPT_TestProcess(MPT_ASSERT_GT_double, gt, id, proc_MPT_ASSERT_GT_double, MPT_ArgValues("PASS", 1.3, 1.2));
+MPT_Test(MPT_ASSERT_GT_double, eq, .xfail=true);
+MPT_Test(MPT_ASSERT_GT_double, lt, .xfail=true);
+MPT_Test(MPT_ASSERT_GT_double, gt, .xfail=false);
+
+
+
+/************************************************************
+ * Test MPT_ASSERT_NULL
+ ************************************************************/
+MPT_ProcessEntry(proc_MPT_ASSERT_NULL, MPT_Args(const char *exp, const void* ptr))
+{
+  assert(exp);
+  MPT_ASSERT_NULL(ptr, "MPT_ASSERT_NULL(%p), expect: %s", ptr, exp);
+}
+MPT_TestProcess(MPT_ASSERT_NULL, addr, id, proc_MPT_ASSERT_NULL, MPT_ArgValues("FAIL", &dummy));
+MPT_TestProcess(MPT_ASSERT_NULL, null, id, proc_MPT_ASSERT_NULL, MPT_ArgValues("PASS", NULL));
+MPT_Test(MPT_ASSERT_NULL, addr, .xfail=true);
+MPT_Test(MPT_ASSERT_NULL, null, .xfail=false);
+
+
+
+/************************************************************
+ * Test MPT_ASSERT_NOT_NULL
+ ************************************************************/
+MPT_ProcessEntry(proc_MPT_ASSERT_NOT_NULL, MPT_Args(const char *exp, const void* ptr))
+{
+  assert(exp);
+  MPT_ASSERT_NOT_NULL(ptr, "MPT_ASSERT_NOT_NULL(%p), expect: %s", ptr, exp);
+}
+MPT_TestProcess(MPT_ASSERT_NOT_NULL, addr, id, proc_MPT_ASSERT_NOT_NULL, MPT_ArgValues("PASS", &dummy));
+MPT_TestProcess(MPT_ASSERT_NOT_NULL, null, id, proc_MPT_ASSERT_NOT_NULL, MPT_ArgValues("FAIL", NULL));
+MPT_Test(MPT_ASSERT_NOT_NULL, addr, .xfail=false);
+MPT_Test(MPT_ASSERT_NOT_NULL, null, .xfail=true);
+
+
+
+/************************************************************
+ * Test MPT_ASSERT_STR_EQ
+ ************************************************************/
+MPT_ProcessEntry(proc_MPT_ASSERT_STR_EQ, MPT_Args(const char *exp, const char* val1, const char* val2))
+{
+  assert(exp);
+  MPT_ASSERT_STR_EQ(val1, val2, "MPT_ASSERT_STR_EQ(%s, %s), expect: %s",
+                    val1 ? val1 : "<null>",
+                    val2 ? val2 : "<null>",
+                    exp);
+}
+MPT_TestProcess(MPT_ASSERT_STR_EQ,    eq, id, proc_MPT_ASSERT_STR_EQ, MPT_ArgValues("PASS", "foo", "foo"));
+MPT_TestProcess(MPT_ASSERT_STR_EQ,   neq, id, proc_MPT_ASSERT_STR_EQ, MPT_ArgValues("FAIL", "foo", "bar"));
+MPT_TestProcess(MPT_ASSERT_STR_EQ, null1, id, proc_MPT_ASSERT_STR_EQ, MPT_ArgValues("FAIL",  NULL, "foo"));
+MPT_TestProcess(MPT_ASSERT_STR_EQ, null2, id, proc_MPT_ASSERT_STR_EQ, MPT_ArgValues("FAIL", "foo",  NULL));
+MPT_Test(MPT_ASSERT_STR_EQ,    eq, .xfail=false);
+MPT_Test(MPT_ASSERT_STR_EQ,   neq, .xfail=true);
+MPT_Test(MPT_ASSERT_STR_EQ, null1, .xfail=true);
+MPT_Test(MPT_ASSERT_STR_EQ, null2, .xfail=true);
+
+
+
+/************************************************************
+ * Test MPT_ASSERT_STR_NEQ
+ ************************************************************/
+MPT_ProcessEntry(proc_MPT_ASSERT_STR_NEQ, MPT_Args(const char *exp, const char* val1, const char* val2))
+{
+  assert(exp);
+  MPT_ASSERT_STR_NEQ(val1, val2, "MPT_ASSERT_STR_NEQ(%s, %s), expect: %s",
+                     val1 ? val1 : "<null>",
+                     val2 ? val2 : "<null>",
+                     exp);
+}
+MPT_TestProcess(MPT_ASSERT_STR_NEQ,    eq, id, proc_MPT_ASSERT_STR_NEQ, MPT_ArgValues("FAIL", "foo", "foo"));
+MPT_TestProcess(MPT_ASSERT_STR_NEQ,   neq, id, proc_MPT_ASSERT_STR_NEQ, MPT_ArgValues("PASS", "foo", "bar"));
+MPT_TestProcess(MPT_ASSERT_STR_NEQ, null1, id, proc_MPT_ASSERT_STR_NEQ, MPT_ArgValues("FAIL",  NULL, "foo"));
+MPT_TestProcess(MPT_ASSERT_STR_NEQ, null2, id, proc_MPT_ASSERT_STR_NEQ, MPT_ArgValues("FAIL", "foo",  NULL));
+MPT_Test(MPT_ASSERT_STR_NEQ,    eq, .xfail=true);
+MPT_Test(MPT_ASSERT_STR_NEQ,   neq, .xfail=false);
+MPT_Test(MPT_ASSERT_STR_NEQ, null1, .xfail=true);
+MPT_Test(MPT_ASSERT_STR_NEQ, null2, .xfail=true);
+
+
+
+/************************************************************
+ * Test MPT_ASSERT_STR_EMPTY
+ ************************************************************/
+MPT_ProcessEntry(proc_MPT_ASSERT_STR_EMPTY, MPT_Args(const char *exp, const char* val))
+{
+  assert(exp);
+  MPT_ASSERT_STR_EMPTY(val, "MPT_ASSERT_STR_EMPTY(%s), expect: %s",
+                       val ? val : "<null>",
+                       exp);
+}
+MPT_TestProcess(MPT_ASSERT_STR_EMPTY, nempty, id, proc_MPT_ASSERT_STR_EMPTY, MPT_ArgValues("FAIL", "foo"));
+MPT_TestProcess(MPT_ASSERT_STR_EMPTY,  empty, id, proc_MPT_ASSERT_STR_EMPTY, MPT_ArgValues("PASS",    ""));
+MPT_TestProcess(MPT_ASSERT_STR_EMPTY,   null, id, proc_MPT_ASSERT_STR_EMPTY, MPT_ArgValues("FAIL",  NULL));
+MPT_Test(MPT_ASSERT_STR_EMPTY, nempty, .xfail=true);
+MPT_Test(MPT_ASSERT_STR_EMPTY,  empty, .xfail=false);
+MPT_Test(MPT_ASSERT_STR_EMPTY,   null, .xfail=true);
+
+
+
+/************************************************************
+ * Test MPT_ASSERT_STR_NOT_EMPTY
+ ************************************************************/
+MPT_ProcessEntry(proc_MPT_ASSERT_STR_NOT_EMPTY, MPT_Args(const char *exp, const char* val))
+{
+  assert(exp);
+  MPT_ASSERT_STR_NOT_EMPTY(val, "MPT_ASSERT_STR_NOT_EMPTY(%s), expect: %s",
+                           val ? val : "<null>",
+                           exp);
+}
+MPT_TestProcess(MPT_ASSERT_STR_NOT_EMPTY, nempty, id, proc_MPT_ASSERT_STR_NOT_EMPTY, MPT_ArgValues("PASS", "foo"));
+MPT_TestProcess(MPT_ASSERT_STR_NOT_EMPTY,  empty, id, proc_MPT_ASSERT_STR_NOT_EMPTY, MPT_ArgValues("FAIL",    ""));
+MPT_TestProcess(MPT_ASSERT_STR_NOT_EMPTY,   null, id, proc_MPT_ASSERT_STR_NOT_EMPTY, MPT_ArgValues("FAIL",  NULL));
+MPT_Test(MPT_ASSERT_STR_NOT_EMPTY, nempty, .xfail=false);
+MPT_Test(MPT_ASSERT_STR_NOT_EMPTY,  empty, .xfail=true);
+MPT_Test(MPT_ASSERT_STR_NOT_EMPTY,   null, .xfail=true);
+
+
+
+/*****************************************************************************/
+
+
+
+/************************************************************
+ * Test MPT_ASSERT_FATAL
+ ************************************************************/
+MPT_ProcessEntry(proc_MPT_ASSERT_FATAL, MPT_Args(const char *exp, int cond))
+{
+  assert(exp);
+  MPT_ASSERT_FATAL(cond, "MPT_ASSERT_FATAL(%d), expect: %s", cond, exp);
+  MPT_ASSERT(cond, "MPT_ASSERT(%d) after a fatal", cond);
+}
+
+MPT_TestProcess(MPT_ASSERT_FATAL, pass, id, proc_MPT_ASSERT_FATAL, MPT_ArgValues("PASS", 1));
+MPT_Test(MPT_ASSERT_FATAL, pass, .xfail=false);
+
+MPT_TestProcess(MPT_ASSERT_FATAL, fail, id, proc_MPT_ASSERT_FATAL, MPT_ArgValues("FAIL", 0));
+MPT_Test(MPT_ASSERT_FATAL, fail, .xfail=true);
+
+
+
+/************************************************************
+ * Test MPT_ASSERT_FATAL_FAIL
+ ************************************************************/
+MPT_ProcessEntry(proc_MPT_ASSERT_FATAL_FAIL, MPT_NoArgs())
+{
+  MPT_ASSERT_FATAL_FAIL("MPT_ASSERT_FATAL_FAIL(), expect a fail, always");
+  MPT_ASSERT_FAIL("MPT_ASSERT_FAIL() after a fatal");
+}
+
+MPT_TestProcess(MPT_ASSERT_FATAL_FAIL, fail, id, proc_MPT_ASSERT_FATAL_FAIL, MPT_NoArgValues());
+MPT_Test(MPT_ASSERT_FATAL_FAIL, fail, .xfail=true);
+
+
+
+/************************************************************
+ * Test MPT_ASSERT_FATAL_EQ
+ ************************************************************/
+MPT_ProcessEntry(proc_MPT_ASSERT_FATAL_EQ_int, MPT_Args(const char *exp, int val1, int val2))
+{
+  assert(exp);
+  MPT_ASSERT_FATAL_EQ(val1, val2, "MPT_ASSERT_FATAL_EQ(%d, %d), expect: %s", val1, val2, exp);
+  MPT_ASSERT_EQ(val1, val2, "MPT_ASSERT_EQ(%d, %d) after a fatal", val1, val2);
+}
+MPT_TestProcess(MPT_ASSERT_FATAL_EQ_int, eq, id, proc_MPT_ASSERT_FATAL_EQ_int, MPT_ArgValues("PASS", 1, 1));
+MPT_TestProcess(MPT_ASSERT_FATAL_EQ_int, lt, id, proc_MPT_ASSERT_FATAL_EQ_int, MPT_ArgValues("FAIL", 1, 2));
+MPT_TestProcess(MPT_ASSERT_FATAL_EQ_int, gt, id, proc_MPT_ASSERT_FATAL_EQ_int, MPT_ArgValues("FAIL", 3, 2));
+MPT_Test(MPT_ASSERT_FATAL_EQ_int, eq, .xfail=false);
+MPT_Test(MPT_ASSERT_FATAL_EQ_int, lt, .xfail=true);
+MPT_Test(MPT_ASSERT_FATAL_EQ_int, gt, .xfail=true);
+
+
+MPT_ProcessEntry(proc_MPT_ASSERT_FATAL_EQ_double, MPT_Args(const char *exp, double val1, double val2))
+{
+  assert(exp);
+  MPT_ASSERT_FATAL_EQ(val1, val2, "MPT_ASSERT_FATAL_EQ(%f, %f), expect: %s", val1, val2, exp);
+  MPT_ASSERT_EQ(val1, val2, "MPT_ASSERT_EQ(%f, %f) after a fatal", val1, val2);
+}
+MPT_TestProcess(MPT_ASSERT_FATAL_EQ_double, eq, id, proc_MPT_ASSERT_FATAL_EQ_double, MPT_ArgValues("PASS", 1.1, 1.1));
+MPT_TestProcess(MPT_ASSERT_FATAL_EQ_double, lt, id, proc_MPT_ASSERT_FATAL_EQ_double, MPT_ArgValues("FAIL", 1.1, 1.2));
+MPT_TestProcess(MPT_ASSERT_FATAL_EQ_double, gt, id, proc_MPT_ASSERT_FATAL_EQ_double, MPT_ArgValues("FAIL", 1.3, 1.2));
+MPT_Test(MPT_ASSERT_FATAL_EQ_double, eq, .xfail=false);
+MPT_Test(MPT_ASSERT_FATAL_EQ_double, lt, .xfail=true);
+MPT_Test(MPT_ASSERT_FATAL_EQ_double, gt, .xfail=true);
+
+
+
+/************************************************************
+ * Test MPT_ASSERT_FATAL_NEQ
+ ************************************************************/
+MPT_ProcessEntry(proc_MPT_ASSERT_FATAL_NEQ_int, MPT_Args(const char *exp, int val1, int val2))
+{
+  assert(exp);
+  MPT_ASSERT_FATAL_NEQ(val1, val2, "MPT_ASSERT_FATAL_NEQ(%d, %d), expect: %s", val1, val2, exp);
+  MPT_ASSERT_NEQ(val1, val2, "MPT_ASSERT_NEQ(%d, %d) after a fatal", val1, val2);
+}
+MPT_TestProcess(MPT_ASSERT_FATAL_NEQ_int, eq, id, proc_MPT_ASSERT_FATAL_NEQ_int, MPT_ArgValues("FAIL", 1, 1));
+MPT_TestProcess(MPT_ASSERT_FATAL_NEQ_int, lt, id, proc_MPT_ASSERT_FATAL_NEQ_int, MPT_ArgValues("PASS", 1, 2));
+MPT_TestProcess(MPT_ASSERT_FATAL_NEQ_int, gt, id, proc_MPT_ASSERT_FATAL_NEQ_int, MPT_ArgValues("PASS", 3, 2));
+MPT_Test(MPT_ASSERT_FATAL_NEQ_int, eq, .xfail=true);
+MPT_Test(MPT_ASSERT_FATAL_NEQ_int, lt, .xfail=false);
+MPT_Test(MPT_ASSERT_FATAL_NEQ_int, gt, .xfail=false);
+
+
+MPT_ProcessEntry(proc_MPT_ASSERT_FATAL_NEQ_double, MPT_Args(const char *exp, double val1, double val2))
+{
+  assert(exp);
+  MPT_ASSERT_FATAL_NEQ(val1, val2, "MPT_ASSERT_FATAL_NEQ(%f, %f), expect: %s", val1, val2, exp);
+  MPT_ASSERT_NEQ(val1, val2, "MPT_ASSERT_NEQ(%f, %f) after a fatal", val1, val2);
+}
+MPT_TestProcess(MPT_ASSERT_FATAL_NEQ_double, eq, id, proc_MPT_ASSERT_FATAL_NEQ_double, MPT_ArgValues("FAIL", 1.1, 1.1));
+MPT_TestProcess(MPT_ASSERT_FATAL_NEQ_double, lt, id, proc_MPT_ASSERT_FATAL_NEQ_double, MPT_ArgValues("PASS", 1.1, 1.2));
+MPT_TestProcess(MPT_ASSERT_FATAL_NEQ_double, gt, id, proc_MPT_ASSERT_FATAL_NEQ_double, MPT_ArgValues("PASS", 1.3, 1.2));
+MPT_Test(MPT_ASSERT_FATAL_NEQ_double, eq, .xfail=true);
+MPT_Test(MPT_ASSERT_FATAL_NEQ_double, lt, .xfail=false);
+MPT_Test(MPT_ASSERT_FATAL_NEQ_double, gt, .xfail=false);
+
+
+
+/************************************************************
+ * Test MPT_ASSERT_FATAL_LEQ
+ ************************************************************/
+MPT_ProcessEntry(proc_MPT_ASSERT_FATAL_LEQ_int, MPT_Args(const char *exp, int val1, int val2))
+{
+  assert(exp);
+  MPT_ASSERT_FATAL_LEQ(val1, val2, "MPT_ASSERT_FATAL_LEQ(%d, %d), expect: %s", val1, val2, exp);
+  MPT_ASSERT_LEQ(val1, val2, "MPT_ASSERT_LEQ(%d, %d) after a fatal", val1, val2);
+}
+MPT_TestProcess(MPT_ASSERT_FATAL_LEQ_int, eq, id, proc_MPT_ASSERT_FATAL_LEQ_int, MPT_ArgValues("PASS", 1, 1));
+MPT_TestProcess(MPT_ASSERT_FATAL_LEQ_int, lt, id, proc_MPT_ASSERT_FATAL_LEQ_int, MPT_ArgValues("PASS", 1, 2));
+MPT_TestProcess(MPT_ASSERT_FATAL_LEQ_int, gt, id, proc_MPT_ASSERT_FATAL_LEQ_int, MPT_ArgValues("FAIL", 3, 2));
+MPT_Test(MPT_ASSERT_FATAL_LEQ_int, eq, .xfail=false);
+MPT_Test(MPT_ASSERT_FATAL_LEQ_int, lt, .xfail=false);
+MPT_Test(MPT_ASSERT_FATAL_LEQ_int, gt, .xfail=true);
+
+
+MPT_ProcessEntry(proc_MPT_ASSERT_FATAL_LEQ_double, MPT_Args(const char *exp, double val1, double val2))
+{
+  assert(exp);
+  MPT_ASSERT_FATAL_LEQ(val1, val2, "MPT_ASSERT_FATAL_LEQ(%f, %f), expect: %s", val1, val2, exp);
+  MPT_ASSERT_LEQ(val1, val2, "MPT_ASSERT_LEQ(%f, %f) after a fatal", val1, val2);
+}
+MPT_TestProcess(MPT_ASSERT_FATAL_LEQ_double, eq, id, proc_MPT_ASSERT_FATAL_LEQ_double, MPT_ArgValues("PASS", 1.1, 1.1));
+MPT_TestProcess(MPT_ASSERT_FATAL_LEQ_double, lt, id, proc_MPT_ASSERT_FATAL_LEQ_double, MPT_ArgValues("PASS", 1.1, 1.2));
+MPT_TestProcess(MPT_ASSERT_FATAL_LEQ_double, gt, id, proc_MPT_ASSERT_FATAL_LEQ_double, MPT_ArgValues("FAIL", 1.3, 1.2));
+MPT_Test(MPT_ASSERT_FATAL_LEQ_double, eq, .xfail=false);
+MPT_Test(MPT_ASSERT_FATAL_LEQ_double, lt, .xfail=false);
+MPT_Test(MPT_ASSERT_FATAL_LEQ_double, gt, .xfail=true);
+
+
+
+/************************************************************
+ * Test MPT_ASSERT_FATAL_GEQ
+ ************************************************************/
+MPT_ProcessEntry(proc_MPT_ASSERT_FATAL_GEQ_int, MPT_Args(const char *exp, int val1, int val2))
+{
+  assert(exp);
+  MPT_ASSERT_FATAL_GEQ(val1, val2, "MPT_ASSERT_FATAL_GEQ(%d, %d), expect: %s", val1, val2, exp);
+  MPT_ASSERT_GEQ(val1, val2, "MPT_ASSERT_GEQ(%d, %d) after a fatal", val1, val2);
+}
+MPT_TestProcess(MPT_ASSERT_FATAL_GEQ_int, eq, id, proc_MPT_ASSERT_FATAL_GEQ_int, MPT_ArgValues("PASS", 1, 1));
+MPT_TestProcess(MPT_ASSERT_FATAL_GEQ_int, lt, id, proc_MPT_ASSERT_FATAL_GEQ_int, MPT_ArgValues("FAIL", 1, 2));
+MPT_TestProcess(MPT_ASSERT_FATAL_GEQ_int, gt, id, proc_MPT_ASSERT_FATAL_GEQ_int, MPT_ArgValues("PASS", 3, 2));
+MPT_Test(MPT_ASSERT_FATAL_GEQ_int, eq, .xfail=false);
+MPT_Test(MPT_ASSERT_FATAL_GEQ_int, lt, .xfail=true);
+MPT_Test(MPT_ASSERT_FATAL_GEQ_int, gt, .xfail=false);
+
+
+MPT_ProcessEntry(proc_MPT_ASSERT_FATAL_GEQ_double, MPT_Args(const char *exp, double val1, double val2))
+{
+  assert(exp);
+  MPT_ASSERT_FATAL_GEQ(val1, val2, "MPT_ASSERT_FATAL_GEQ(%f, %f), expect: %s", val1, val2, exp);
+  MPT_ASSERT_GEQ(val1, val2, "MPT_ASSERT_GEQ(%f, %f) after a fatal", val1, val2);
+}
+MPT_TestProcess(MPT_ASSERT_FATAL_GEQ_double, eq, id, proc_MPT_ASSERT_FATAL_GEQ_double, MPT_ArgValues("PASS", 1.1, 1.1));
+MPT_TestProcess(MPT_ASSERT_FATAL_GEQ_double, lt, id, proc_MPT_ASSERT_FATAL_GEQ_double, MPT_ArgValues("FAIL", 1.1, 1.2));
+MPT_TestProcess(MPT_ASSERT_FATAL_GEQ_double, gt, id, proc_MPT_ASSERT_FATAL_GEQ_double, MPT_ArgValues("PASS", 1.3, 1.2));
+MPT_Test(MPT_ASSERT_FATAL_GEQ_double, eq, .xfail=false);
+MPT_Test(MPT_ASSERT_FATAL_GEQ_double, lt, .xfail=true);
+MPT_Test(MPT_ASSERT_FATAL_GEQ_double, gt, .xfail=false);
+
+
+
+/************************************************************
+ * Test MPT_ASSERT_FATAL_LT
+ ************************************************************/
+MPT_ProcessEntry(proc_MPT_ASSERT_FATAL_LT_int, MPT_Args(const char *exp, int val1, int val2))
+{
+  assert(exp);
+  MPT_ASSERT_FATAL_LT(val1, val2, "MPT_ASSERT_FATAL_LT(%d, %d), expect: %s", val1, val2, exp);
+  MPT_ASSERT_LT(val1, val2, "MPT_ASSERT_LT(%d, %d) after a fatal", val1, val2);
+}
+MPT_TestProcess(MPT_ASSERT_FATAL_LT_int, eq, id, proc_MPT_ASSERT_FATAL_LT_int, MPT_ArgValues("FAIL", 1, 1));
+MPT_TestProcess(MPT_ASSERT_FATAL_LT_int, lt, id, proc_MPT_ASSERT_FATAL_LT_int, MPT_ArgValues("PASS", 1, 2));
+MPT_TestProcess(MPT_ASSERT_FATAL_LT_int, gt, id, proc_MPT_ASSERT_FATAL_LT_int, MPT_ArgValues("FAIL", 3, 2));
+MPT_Test(MPT_ASSERT_FATAL_LT_int, eq, .xfail=true);
+MPT_Test(MPT_ASSERT_FATAL_LT_int, lt, .xfail=false);
+MPT_Test(MPT_ASSERT_FATAL_LT_int, gt, .xfail=true);
+
+
+MPT_ProcessEntry(proc_MPT_ASSERT_FATAL_LT_double, MPT_Args(const char *exp, double val1, double val2))
+{
+  assert(exp);
+  MPT_ASSERT_FATAL_LT(val1, val2, "MPT_ASSERT_FATAL_LT(%f, %f), expect: %s", val1, val2, exp);
+  MPT_ASSERT_LT(val1, val2, "MPT_ASSERT_LT(%f, %f) after a fatal", val1, val2);
+}
+MPT_TestProcess(MPT_ASSERT_FATAL_LT_double, eq, id, proc_MPT_ASSERT_FATAL_LT_double, MPT_ArgValues("FAIL", 1.1, 1.1));
+MPT_TestProcess(MPT_ASSERT_FATAL_LT_double, lt, id, proc_MPT_ASSERT_FATAL_LT_double, MPT_ArgValues("PASS", 1.1, 1.2));
+MPT_TestProcess(MPT_ASSERT_FATAL_LT_double, gt, id, proc_MPT_ASSERT_FATAL_LT_double, MPT_ArgValues("FAIL", 1.3, 1.2));
+MPT_Test(MPT_ASSERT_FATAL_LT_double, eq, .xfail=true);
+MPT_Test(MPT_ASSERT_FATAL_LT_double, lt, .xfail=false);
+MPT_Test(MPT_ASSERT_FATAL_LT_double, gt, .xfail=true);
+
+
+
+/************************************************************
+ * Test MPT_ASSERT_FATAL_GT
+ ************************************************************/
+MPT_ProcessEntry(proc_MPT_ASSERT_FATAL_GT_int, MPT_Args(const char *exp, int val1, int val2))
+{
+  assert(exp);
+  MPT_ASSERT_FATAL_GT(val1, val2, "MPT_ASSERT_FATAL_GT(%d, %d), expect: %s", val1, val2, exp);
+  MPT_ASSERT_GT(val1, val2, "MPT_ASSERT_GT(%d, %d) after a fatal", val1, val2);
+}
+MPT_TestProcess(MPT_ASSERT_FATAL_GT_int, eq, id, proc_MPT_ASSERT_FATAL_GT_int, MPT_ArgValues("FAIL", 1, 1));
+MPT_TestProcess(MPT_ASSERT_FATAL_GT_int, lt, id, proc_MPT_ASSERT_FATAL_GT_int, MPT_ArgValues("FAIL", 1, 2));
+MPT_TestProcess(MPT_ASSERT_FATAL_GT_int, gt, id, proc_MPT_ASSERT_FATAL_GT_int, MPT_ArgValues("PASS", 3, 2));
+MPT_Test(MPT_ASSERT_FATAL_GT_int, eq, .xfail=true);
+MPT_Test(MPT_ASSERT_FATAL_GT_int, lt, .xfail=true);
+MPT_Test(MPT_ASSERT_FATAL_GT_int, gt, .xfail=false);
+
+
+MPT_ProcessEntry(proc_MPT_ASSERT_FATAL_GT_double, MPT_Args(const char *exp, double val1, double val2))
+{
+  assert(exp);
+  MPT_ASSERT_FATAL_GT(val1, val2, "MPT_ASSERT_FATAL_GT(%f, %f), expect: %s", val1, val2, exp);
+  MPT_ASSERT_GT(val1, val2, "MPT_ASSERT_GT(%f, %f) after a fatal", val1, val2);
+}
+MPT_TestProcess(MPT_ASSERT_FATAL_GT_double, eq, id, proc_MPT_ASSERT_FATAL_GT_double, MPT_ArgValues("FAIL", 1.1, 1.1));
+MPT_TestProcess(MPT_ASSERT_FATAL_GT_double, lt, id, proc_MPT_ASSERT_FATAL_GT_double, MPT_ArgValues("FAIL", 1.1, 1.2));
+MPT_TestProcess(MPT_ASSERT_FATAL_GT_double, gt, id, proc_MPT_ASSERT_FATAL_GT_double, MPT_ArgValues("PASS", 1.3, 1.2));
+MPT_Test(MPT_ASSERT_FATAL_GT_double, eq, .xfail=true);
+MPT_Test(MPT_ASSERT_FATAL_GT_double, lt, .xfail=true);
+MPT_Test(MPT_ASSERT_FATAL_GT_double, gt, .xfail=false);
+
+
+
+/************************************************************
+ * Test MPT_ASSERT_FATAL_NULL
+ ************************************************************/
+MPT_ProcessEntry(proc_MPT_ASSERT_FATAL_NULL, MPT_Args(const char *exp, const void* ptr))
+{
+  assert(exp);
+  MPT_ASSERT_FATAL_NULL(ptr, "MPT_ASSERT_FATAL_NULL(%p), expect: %s", ptr, exp);
+}
+MPT_TestProcess(MPT_ASSERT_FATAL_NULL, addr, id, proc_MPT_ASSERT_FATAL_NULL, MPT_ArgValues("FAIL", &dummy));
+MPT_TestProcess(MPT_ASSERT_FATAL_NULL, null, id, proc_MPT_ASSERT_FATAL_NULL, MPT_ArgValues("PASS", NULL));
+MPT_Test(MPT_ASSERT_FATAL_NULL, addr, .xfail=true);
+MPT_Test(MPT_ASSERT_FATAL_NULL, null, .xfail=false);
+
+
+
+/************************************************************
+ * Test MPT_ASSERT_FATAL_NOT_NULL
+ ************************************************************/
+MPT_ProcessEntry(proc_MPT_ASSERT_FATAL_NOT_NULL, MPT_Args(const char *exp, const void* ptr))
+{
+  assert(exp);
+  MPT_ASSERT_FATAL_NOT_NULL(ptr, "MPT_ASSERT_FATAL_NOT_NULL(%p), expect: %s", ptr, exp);
+}
+MPT_TestProcess(MPT_ASSERT_FATAL_NOT_NULL, addr, id, proc_MPT_ASSERT_FATAL_NOT_NULL, MPT_ArgValues("PASS", &dummy));
+MPT_TestProcess(MPT_ASSERT_FATAL_NOT_NULL, null, id, proc_MPT_ASSERT_FATAL_NOT_NULL, MPT_ArgValues("FAIL", NULL));
+MPT_Test(MPT_ASSERT_FATAL_NOT_NULL, addr, .xfail=false);
+MPT_Test(MPT_ASSERT_FATAL_NOT_NULL, null, .xfail=true);
+
+
+
+/************************************************************
+ * Test MPT_ASSERT_FATAL_STR_EQ
+ ************************************************************/
+MPT_ProcessEntry(proc_MPT_ASSERT_FATAL_STR_EQ, MPT_Args(const char *exp, const char* val1, const char* val2))
+{
+  assert(exp);
+  MPT_ASSERT_FATAL_STR_EQ(val1, val2, "MPT_ASSERT_FATAL_STR_EQ(%s, %s), expect: %s",
+                          val1 ? val1 : "<null>",
+                          val2 ? val2 : "<null>",
+                          exp);
+}
+MPT_TestProcess(MPT_ASSERT_FATAL_STR_EQ,    eq, id, proc_MPT_ASSERT_FATAL_STR_EQ, MPT_ArgValues("PASS", "foo", "foo"));
+MPT_TestProcess(MPT_ASSERT_FATAL_STR_EQ,   neq, id, proc_MPT_ASSERT_FATAL_STR_EQ, MPT_ArgValues("FAIL", "foo", "bar"));
+MPT_TestProcess(MPT_ASSERT_FATAL_STR_EQ, null1, id, proc_MPT_ASSERT_FATAL_STR_EQ, MPT_ArgValues("FAIL",  NULL, "foo"));
+MPT_TestProcess(MPT_ASSERT_FATAL_STR_EQ, null2, id, proc_MPT_ASSERT_FATAL_STR_EQ, MPT_ArgValues("FAIL", "foo",  NULL));
+MPT_Test(MPT_ASSERT_FATAL_STR_EQ,    eq, .xfail=false);
+MPT_Test(MPT_ASSERT_FATAL_STR_EQ,   neq, .xfail=true);
+MPT_Test(MPT_ASSERT_FATAL_STR_EQ, null1, .xfail=true);
+MPT_Test(MPT_ASSERT_FATAL_STR_EQ, null2, .xfail=true);
+
+
+
+/************************************************************
+ * Test MPT_ASSERT_FATAL_STR_NEQ
+ ************************************************************/
+MPT_ProcessEntry(proc_MPT_ASSERT_FATAL_STR_NEQ, MPT_Args(const char *exp, const char* val1, const char* val2))
+{
+  assert(exp);
+  MPT_ASSERT_FATAL_STR_NEQ(val1, val2, "MPT_ASSERT_FATAL_STR_NEQ(%s, %s), expect: %s",
+                           val1 ? val1 : "<null>",
+                           val2 ? val2 : "<null>",
+                           exp);
+}
+MPT_TestProcess(MPT_ASSERT_FATAL_STR_NEQ,    eq, id, proc_MPT_ASSERT_FATAL_STR_NEQ, MPT_ArgValues("FAIL", "foo", "foo"));
+MPT_TestProcess(MPT_ASSERT_FATAL_STR_NEQ,   neq, id, proc_MPT_ASSERT_FATAL_STR_NEQ, MPT_ArgValues("PASS", "foo", "bar"));
+MPT_TestProcess(MPT_ASSERT_FATAL_STR_NEQ, null1, id, proc_MPT_ASSERT_FATAL_STR_NEQ, MPT_ArgValues("FAIL",  NULL, "foo"));
+MPT_TestProcess(MPT_ASSERT_FATAL_STR_NEQ, null2, id, proc_MPT_ASSERT_FATAL_STR_NEQ, MPT_ArgValues("FAIL", "foo",  NULL));
+MPT_Test(MPT_ASSERT_FATAL_STR_NEQ,    eq, .xfail=true);
+MPT_Test(MPT_ASSERT_FATAL_STR_NEQ,   neq, .xfail=false);
+MPT_Test(MPT_ASSERT_FATAL_STR_NEQ, null1, .xfail=true);
+MPT_Test(MPT_ASSERT_FATAL_STR_NEQ, null2, .xfail=true);
+
+
+
+/************************************************************
+ * Test MPT_ASSERT_FATAL_STR_EMPTY
+ ************************************************************/
+MPT_ProcessEntry(proc_MPT_ASSERT_FATAL_STR_EMPTY, MPT_Args(const char *exp, const char* val))
+{
+  assert(exp);
+  MPT_ASSERT_FATAL_STR_EMPTY(val, "MPT_ASSERT_FATAL_STR_EMPTY(%s), expect: %s",
+                             val ? val : "<null>",
+                             exp);
+}
+MPT_TestProcess(MPT_ASSERT_FATAL_STR_EMPTY, nempty, id, proc_MPT_ASSERT_FATAL_STR_EMPTY, MPT_ArgValues("FAIL", "foo"));
+MPT_TestProcess(MPT_ASSERT_FATAL_STR_EMPTY,  empty, id, proc_MPT_ASSERT_FATAL_STR_EMPTY, MPT_ArgValues("PASS",    ""));
+MPT_TestProcess(MPT_ASSERT_FATAL_STR_EMPTY,   null, id, proc_MPT_ASSERT_FATAL_STR_EMPTY, MPT_ArgValues("FAIL",  NULL));
+MPT_Test(MPT_ASSERT_FATAL_STR_EMPTY, nempty, .xfail=true);
+MPT_Test(MPT_ASSERT_FATAL_STR_EMPTY,  empty, .xfail=false);
+MPT_Test(MPT_ASSERT_FATAL_STR_EMPTY,   null, .xfail=true);
+
+
+
+/************************************************************
+ * Test MPT_ASSERT_FATAL_STR_NOT_EMPTY
+ ************************************************************/
+MPT_ProcessEntry(proc_MPT_ASSERT_FATAL_STR_NOT_EMPTY, MPT_Args(const char *exp, const char* val))
+{
+  assert(exp);
+  MPT_ASSERT_FATAL_STR_NOT_EMPTY(val, "MPT_ASSERT_FATAL_STR_NOT_EMPTY(%s), expect: %s",
+                                 val ? val : "<null>",
+                                 exp);
+}
+MPT_TestProcess(MPT_ASSERT_FATAL_STR_NOT_EMPTY, nempty, id, proc_MPT_ASSERT_FATAL_STR_NOT_EMPTY, MPT_ArgValues("PASS", "foo"));
+MPT_TestProcess(MPT_ASSERT_FATAL_STR_NOT_EMPTY,  empty, id, proc_MPT_ASSERT_FATAL_STR_NOT_EMPTY, MPT_ArgValues("FAIL",    ""));
+MPT_TestProcess(MPT_ASSERT_FATAL_STR_NOT_EMPTY,   null, id, proc_MPT_ASSERT_FATAL_STR_NOT_EMPTY, MPT_ArgValues("FAIL",  NULL));
+MPT_Test(MPT_ASSERT_FATAL_STR_NOT_EMPTY, nempty, .xfail=false);
+MPT_Test(MPT_ASSERT_FATAL_STR_NOT_EMPTY,  empty, .xfail=true);
+MPT_Test(MPT_ASSERT_FATAL_STR_NOT_EMPTY,   null, .xfail=true);
+
+
+
+/*****************************************************************************/
+
+
+
+/************************************************************
+ * Test propagation,
+ * Check if failure/success is actually propagated to ctest.
+ ************************************************************/
+MPT_ProcessEntry(proc_propagation, MPT_Args(const char *exp, int cond, dds_duration_t delay))
+{
+  assert(exp);
+  if (delay > 0) {
+    dds_sleepfor(delay);
+  }
+  MPT_ASSERT(cond, "MPT_ASSERT(%d), expect: %s", cond, exp);
+}
+/* This should pass in the ctest results. */
+MPT_TestProcess(propagation, pass, id1, proc_propagation, MPT_ArgValues("PASS", 1, 0));
+MPT_TestProcess(propagation, pass, id2, proc_propagation, MPT_ArgValues("PASS", 1, 0));
+MPT_Test(propagation, pass);
+/* This should fail in the ctest results. */
+MPT_TestProcess(propagation, fail_1st, id1, proc_propagation, MPT_ArgValues("FAIL", 0, 0));
+MPT_TestProcess(propagation, fail_1st, id2, proc_propagation, MPT_ArgValues("PASS", 1, DDS_SECS(1)));
+MPT_Test(propagation, fail_1st);
+/* This should fail in the ctest results. */
+MPT_TestProcess(propagation, fail_2nd, id1, proc_propagation, MPT_ArgValues("PASS", 1, 0));
+MPT_TestProcess(propagation, fail_2nd, id2, proc_propagation, MPT_ArgValues("FAIL", 0, DDS_SECS(1)));
+MPT_Test(propagation, fail_2nd);
+
diff --git a/src/mpt/tests/self/environments.c b/src/mpt/tests/self/environments.c
new file mode 100644
index 0000000..9b6dc97
--- /dev/null
+++ b/src/mpt/tests/self/environments.c
@@ -0,0 +1,96 @@
+#include <stdio.h>
+#include <string.h>
+#include <assert.h>
+#include "mpt/mpt.h"
+#include "mpt/resource.h" /* MPT_SOURCE_ROOT_DIR */
+#include "dds/ddsrt/environ.h"
+
+
+
+/************************************************************
+ * Process
+ ************************************************************/
+MPT_ProcessEntry(proc_environments, MPT_Args(mpt_env_t *exp))
+{
+  assert(exp);
+  while ((exp->name != NULL) && (exp->value != NULL)) {
+    /* The environment variable value should match the expected value. */
+    char *ptr = NULL;
+    ddsrt_getenv(exp->name, &ptr);
+    if (ptr) {
+      MPT_ASSERT((strcmp(exp->value, ptr) == 0), "%s: found \"%s\", expected \"%s\"", exp->name, ptr, exp->value);
+    } else {
+      MPT_ASSERT(0, "Expected \"%s\" not found in environment", exp->name);
+    }
+    exp++;
+  }
+}
+
+
+
+/************************************************************
+ * Basic environment tests
+ ************************************************************/
+static mpt_env_t environ_basic[] = {
+    { "MY_ENV_VAR1",  "1"   },
+    { "MY_ENV_VAR2",  "2"   },
+    { NULL,           NULL  }
+};
+
+MPT_TestProcess(environment, proc, id, proc_environments, MPT_ArgValues(environ_basic), .environment=environ_basic);
+MPT_Test(environment, proc);
+
+MPT_TestProcess(environment, test, id, proc_environments, MPT_ArgValues(environ_basic));
+MPT_Test(environment, test, .environment=environ_basic);
+
+
+
+/************************************************************
+ * Expanding variables environment tests
+ ************************************************************/
+static mpt_env_t environ_expand[] = {
+    { "1",       "b"                  },
+    { "2",       "${1}l"              },
+    { "3",       "${2}aat"            },
+    { "4",       "bla${1}${2}a${3}"   },
+    { NULL,      NULL                 }
+};
+static mpt_env_t expect_expand[] = {
+    { "1",       "b"                  },
+    { "2",       "bl"                 },
+    { "3",       "blaat"              },
+    { "4",       "blabblablaat"       },
+    { NULL,      NULL                 }
+};
+
+MPT_TestProcess(environment, expand_proc, id, proc_environments, MPT_ArgValues(expect_expand), .environment=environ_expand);
+MPT_Test(environment, expand_proc);
+
+MPT_TestProcess(environment, expand_test, id, proc_environments, MPT_ArgValues(expect_expand));
+MPT_Test(environment, expand_test, .environment=environ_expand);
+
+
+
+/************************************************************
+ * Environment inheritance test
+ ************************************************************/
+static mpt_env_t environ_test[] = {
+    { "ETC_DIR",     MPT_SOURCE_ROOT_DIR"/tests/self/etc"                   },
+    { "OVERRULE",    "NO"                                                   },
+    { NULL,          NULL                                                   }
+};
+static mpt_env_t environ_proc[] = {
+    { "CYCLONE_URI", "file://${ETC_DIR}/ospl.xml"                           },
+    { "OVERRULE",    "YES"                                                  },
+    { "EXTRA",       "proc"                                                 },
+    { NULL,          NULL                                                   }
+};
+static mpt_env_t environ_test_proc[] = {
+    { "ETC_DIR",     MPT_SOURCE_ROOT_DIR"/tests/self/etc"                   },
+    { "CYCLONE_URI", "file://"MPT_SOURCE_ROOT_DIR"/tests/self/etc/ospl.xml" },
+    { "OVERRULE",    "YES"                                                  },
+    { "EXTRA",       "proc"                                                 },
+    { NULL,          NULL                                                   }
+};
+MPT_TestProcess(environment, inheritance, id, proc_environments, MPT_ArgValues(environ_test_proc), .environment=environ_proc);
+MPT_Test(environment, inheritance, .environment=environ_test);
diff --git a/src/mpt/tests/self/etc/file b/src/mpt/tests/self/etc/file
new file mode 100644
index 0000000..e69de29
diff --git a/src/mpt/tests/self/fixtures.c b/src/mpt/tests/self/fixtures.c
new file mode 100644
index 0000000..25b5782
--- /dev/null
+++ b/src/mpt/tests/self/fixtures.c
@@ -0,0 +1,72 @@
+#include <stdio.h>
+#include "mpt/mpt.h"
+#include "mpt/resource.h" /* MPT_SOURCE_ROOT_DIR */
+#include "dds/ddsrt/time.h"
+
+
+
+/************************************************************
+ * Support functions
+ ************************************************************/
+static int g_initcnt = 0;
+static void init_inc(void)
+{
+  g_initcnt++;
+};
+
+
+
+/************************************************************
+ * Processes
+ ************************************************************/
+MPT_ProcessEntry(proc_initcnt, MPT_Args(int init))
+{
+  MPT_ASSERT((g_initcnt == init), "init count: %d vs %d", g_initcnt, init);
+}
+
+MPT_ProcessEntry(proc_sleep, MPT_Args(dds_duration_t delay))
+{
+  MPT_ASSERT((delay > 0), "basically just to satisfy the compiler");
+  dds_sleepfor(delay);
+}
+
+
+
+/************************************************************
+ * Init fixture tests
+ ************************************************************/
+MPT_TestProcess(init, none, id, proc_initcnt, MPT_ArgValues(0));
+MPT_Test(init, none);
+
+MPT_TestProcess(init, null, id, proc_initcnt, MPT_ArgValues(0), .init=NULL);
+MPT_Test(init, null, .init=NULL);
+
+MPT_TestProcess(init, proc, id, proc_initcnt, MPT_ArgValues(1), .init=init_inc);
+MPT_Test(init, proc);
+
+MPT_TestProcess(init, test, id, proc_initcnt, MPT_ArgValues(1));
+MPT_Test(init, test, .init=init_inc);
+
+MPT_TestProcess(init, test_proc, id, proc_initcnt, MPT_ArgValues(2), .init=init_inc);
+MPT_Test(init, test_proc, .init=init_inc);
+
+
+
+/************************************************************
+ * Disable fixture tests
+ ************************************************************/
+MPT_TestProcess(disabled, _true, id, proc_initcnt, MPT_ArgValues(0));
+MPT_Test(disabled, _true, .disabled=true);
+
+MPT_TestProcess(disabled, _false, id, proc_initcnt, MPT_ArgValues(0));
+MPT_Test(disabled, _false, .disabled=false);
+
+
+
+/************************************************************
+ * Timeout fixture tests
+ ************************************************************/
+/* See if a child process is killed when the parent is killed.
+ * This can only really be done manually, unfortunately. */
+MPT_TestProcess(timeout, child_culling, id, proc_sleep, MPT_ArgValues(DDS_SECS(120)));
+MPT_Test(timeout, child_culling, .timeout=1);
diff --git a/src/mpt/tests/self/ipc.c b/src/mpt/tests/self/ipc.c
new file mode 100644
index 0000000..932c6e6
--- /dev/null
+++ b/src/mpt/tests/self/ipc.c
@@ -0,0 +1,29 @@
+#include <stdio.h>
+#include "mpt/mpt.h"
+
+
+
+/************************************************************
+ * Processes
+ ************************************************************/
+MPT_ProcessEntry(proc_ipc_send, MPT_NoArgs())
+{
+  /* This will fail and cause an internal MPT assert as long
+   * as IPC is not yet implemented. */
+  MPT_Send("todo: implement");
+}
+MPT_ProcessEntry(proc_ipc_wait, MPT_NoArgs())
+{
+  /* This will fail and cause an internal MPT assert as long
+   * as IPC is not yet implemented. */
+  MPT_Wait("todo: implement");
+}
+
+
+
+/************************************************************
+ * Tests
+ ************************************************************/
+MPT_TestProcess(ipc, TODO, id1, proc_ipc_send, MPT_NoArgValues());
+MPT_TestProcess(ipc, TODO, id2, proc_ipc_wait, MPT_NoArgValues());
+MPT_Test(ipc, TODO);
diff --git a/src/mpt/tests/self/resources.c b/src/mpt/tests/self/resources.c
new file mode 100644
index 0000000..9cba731
--- /dev/null
+++ b/src/mpt/tests/self/resources.c
@@ -0,0 +1,30 @@
+#include <stdio.h>
+#include <sys/stat.h>
+#include <sys/types.h>
+#include "mpt/mpt.h"
+#include "mpt/resource.h" /* MPT_SOURCE_ROOT_DIR */
+
+/************************************************************
+ * Processes
+ ************************************************************/
+MPT_ProcessEntry(proc_file, MPT_NoArgs())
+{
+  const char *test_file = MPT_SOURCE_ROOT_DIR"/tests/self/etc/file";
+#if _WIN32
+  struct _stat buffer;
+  int ret = _stat(test_file,&buffer);
+#else
+  struct stat buffer;
+  int ret = stat(test_file,&buffer);
+#endif
+  MPT_ASSERT((ret == 0), "%s", test_file);
+}
+
+
+
+/************************************************************
+ * Test if MPT_SOURCE_ROOT_DIR is a valid location.
+ ************************************************************/
+MPT_TestProcess(resources, root_dir, id, proc_file, MPT_NoArgValues());
+MPT_Test(resources, root_dir);
+
diff --git a/src/mpt/tests/self/usage.c b/src/mpt/tests/self/usage.c
new file mode 100644
index 0000000..1621810
--- /dev/null
+++ b/src/mpt/tests/self/usage.c
@@ -0,0 +1,186 @@
+#include <stdio.h>
+#include "mpt/mpt.h"
+#include "mpt/resource.h" /* MPT_SOURCE_ROOT_DIR */
+
+
+/******************************************************************************
+ * First, we need a process entry-point that can be used in tests.
+ *****************************************************************************/
+/*              |  name     | arguments   |    */
+MPT_ProcessEntry(proc_noargs, MPT_NoArgs())
+{
+    // Do stuff
+
+    // The test processes will use asserts to indicate success/failures.
+    MPT_ASSERT(1, "The problem is: %s", "existential crisis");
+
+    // No need to return anything, that's handled by the assert calls.
+}
+
+/******************************************************************************
+ * A process entry-point can have arguments.
+ *****************************************************************************/
+/*              |  name   | arguments                            |   */
+MPT_ProcessEntry(proc_args, MPT_Args(int domain, const char* text))
+{
+  int expected = 1;
+  MPT_ASSERT(expected == domain, "proc_args(%d, %s)", domain, text);
+}
+
+/******************************************************************************
+ * Process entry-points can communicate to be able to sync fi.
+ *****************************************************************************/
+MPT_ProcessEntry(proc_recv, MPT_NoArgs())
+{
+  /* This will wait until another process sends the same string. */
+  MPT_Wait("some state reached");
+}
+MPT_ProcessEntry(proc_send, MPT_NoArgs())
+{
+  /* If this fails, an internal MPT_ASSERT will be triggered.
+   * The same is true for MPT_Wait(). */
+  MPT_Send("some state reached");
+}
+
+
+
+/******************************************************************************
+ * Test: suitename_testA
+ ******************************************************************************
+ * A simple test that starts two processes. Because a test can use the same
+ * process entry-point to start multiple processes, each process has to have
+ * its own unique id within the test.
+ */
+/*             | process identification | entry-point | arguments        |   */
+MPT_TestProcess(suitename, testA, id1,    proc_noargs,  MPT_NoArgValues());
+MPT_TestProcess(suitename, testA, id2,    proc_noargs,  MPT_NoArgValues());
+MPT_Test(suitename, testA);
+
+
+
+
+/******************************************************************************
+ * Test: suitename_testB
+ ******************************************************************************
+ * Of course, different processes can be started as well.
+ * Argument values are provided per test process.
+ */
+MPT_TestProcess(suitename, testB, id1, proc_noargs, MPT_NoArgValues(    ));
+MPT_TestProcess(suitename, testB, id2, proc_args,   MPT_ArgValues(1, "2"));
+MPT_TestProcess(suitename, testB, id3, proc_args,   MPT_ArgValues(1, "3"));
+MPT_Test(suitename, testB);
+
+
+
+
+/******************************************************************************
+ * Test: suitename_testC
+ ******************************************************************************
+ * The processes can have different or equal 'system environments'.
+ */
+mpt_env_t environment_C1[] = {
+  { "CYCLONEDDS_URI", "file://config1.xml"     },
+  { "PERMISSIONS",    "file://permissions.p7s" },
+  { "GOVERNANCE",     "file://governance.p7s"  },
+  { NULL,             NULL                     }
+};
+mpt_env_t environment_C2[] = {
+  { "CYCLONEDDS_URI", "file://config2.xml"     },
+  { "PERMISSIONS",    "file://permissions.p7s" },
+  { "GOVERNANCE",     "file://governance.p7s"  },
+  { NULL,             NULL                     }
+};
+MPT_TestProcess(suitename, testC, id1, proc_noargs, MPT_NoArgValues(), .environment=environment_C1);
+MPT_TestProcess(suitename, testC, id2, proc_noargs, MPT_NoArgValues(), .environment=environment_C1);
+MPT_TestProcess(suitename, testC, id3, proc_noargs, MPT_NoArgValues(), .environment=environment_C2);
+MPT_Test(suitename, testC);
+
+
+
+
+/******************************************************************************
+ * Test: suitename_testD
+ ******************************************************************************
+ * The two environments in the previous example are partly the same.
+ * It's possible set the environment on test level. The environment variables
+ * related to the test are set before the ones related to a process. This
+ * means that a process can overrule variables.
+ *
+ * The following test is the same as the previous one.
+ */
+mpt_env_t environment_D1[] = {
+  { "CYCLONEDDS_URI", "file://config1.xml"     },
+  { "PERMISSIONS",    "file://permissions.p7s" },
+  { "GOVERNANCE",     "file://governance.p7s"  },
+  { NULL,             NULL                     }
+};
+mpt_env_t environment_D2[] = {
+  { "CYCLONEDDS_URI", "file://config2.xml"     },
+  { NULL,             NULL                     }
+};
+MPT_TestProcess(suitename, testD, id1, proc_noargs, MPT_NoArgValues());
+MPT_TestProcess(suitename, testD, id2, proc_noargs, MPT_NoArgValues());
+MPT_TestProcess(suitename, testD, id3, proc_noargs, MPT_NoArgValues(), .environment=environment_D2);
+MPT_Test(suitename, testD, .environment=environment_D1);
+
+
+
+
+/******************************************************************************
+ * Test: suitename_testE
+ ******************************************************************************
+ * Environment variables will be expanded.
+ * Also, the MPT_SOURCE_ROOT_DIR define contains a string to that particular
+ * directory.
+ * This can be combined to easily point to files.
+ */
+mpt_env_t environment_E[] = {
+  { "ETC_DIR",        MPT_SOURCE_ROOT_DIR"/tests/self/etc"  },
+  { "CYCLONEDDS_URI", "file://${ETC_DIR}/config.xml"        },
+  { NULL,             NULL                                  }
+};
+MPT_TestProcess(suitename, testE, id, proc_noargs, MPT_NoArgValues(), .environment=environment_E);
+MPT_Test(suitename, testE);
+
+
+
+
+/******************************************************************************
+ * Test: suitename_testF
+ ******************************************************************************
+ * The processes and tests can use init/fini fixtures.
+ * The test init is executed before the process init.
+ * The process fini is executed before the test fini.
+ */
+void proc_setup(void)    { /* do stuff */ }
+void proc_teardown(void) { /* do stuff */ }
+void test_setup(void)    { /* do stuff */ }
+void test_teardown(void) { /* do stuff */ }
+MPT_TestProcess(suitename, testF, id1, proc_noargs, MPT_NoArgValues(), .init=proc_setup);
+MPT_TestProcess(suitename, testF, id2, proc_noargs, MPT_NoArgValues(), .fini=proc_teardown);
+MPT_TestProcess(suitename, testF, id3, proc_noargs, MPT_NoArgValues(), .init=proc_setup, .fini=proc_teardown);
+MPT_Test(suitename, testF, .init=test_setup, .fini=test_teardown);
+
+
+
+
+/******************************************************************************
+ * Test: suitename_testG
+ ******************************************************************************
+ * The timeout and disable options are handled by test fixtures.
+ */
+MPT_TestProcess(suitename, testG, id1, proc_noargs,  MPT_NoArgValues());
+MPT_TestProcess(suitename, testG, id2, proc_noargs,  MPT_NoArgValues());
+MPT_Test(suitename, testG, .timeout=10, .disabled=true);
+
+
+
+
+/******************************************************************************
+ * Test: suitename_testH
+ ******************************************************************************
+ * See the process entries to notice the MPT Send/Wait IPC.
+ */
+MPT_TestProcess(suitename, testH, id1, proc_recv,  MPT_NoArgValues());
+MPT_TestProcess(suitename, testH, id2, proc_send,  MPT_NoArgValues());
+MPT_Test(suitename, testH);

From 077939939140091f62283ab9eeb02d019d443ab7 Mon Sep 17 00:00:00 2001
From: Martin Bremmer <martin.bremmer@adlinktech.com>
Date: Thu, 11 Apr 2019 14:10:08 +0200
Subject: [PATCH 044/238] Moved expand_envvars.

Signed-off-by: Martin Bremmer <martin.bremmer@adlinktech.com>
---
 src/core/ddsi/src/q_config.c          |   1 +
 src/ddsrt/include/dds/ddsrt/environ.h |  44 +++++++++++
 src/ddsrt/tests/environ.c             | 105 +++++++++++++++++++++++++-
 src/mpt/mpt/cmake/MPT.cmake           |   9 ---
 src/mpt/mpt/src/main.c.in             |   3 +-
 5 files changed, 150 insertions(+), 12 deletions(-)

diff --git a/src/core/ddsi/src/q_config.c b/src/core/ddsi/src/q_config.c
index 5a412e8..bf1781d 100644
--- a/src/core/ddsi/src/q_config.c
+++ b/src/core/ddsi/src/q_config.c
@@ -22,6 +22,7 @@
 #include "dds/ddsrt/string.h"
 #include "dds/ddsrt/strtod.h"
 #include "dds/ddsrt/misc.h"
+#include "dds/ddsrt/environ.h"
 #include "dds/ddsi/q_config.h"
 #include "dds/ddsi/q_log.h"
 #include "dds/ddsrt/avl.h"
diff --git a/src/ddsrt/include/dds/ddsrt/environ.h b/src/ddsrt/include/dds/ddsrt/environ.h
index 48953c2..67a8c29 100644
--- a/src/ddsrt/include/dds/ddsrt/environ.h
+++ b/src/ddsrt/include/dds/ddsrt/environ.h
@@ -96,6 +96,50 @@ ddsrt_unsetenv(
   const char *name)
 ddsrt_nonnull_all;
 
+/**
+ * @brief Expand environment variables within string.
+ *
+ * Expands ${X}, ${X:-Y}, ${X:+Y}, ${X:?Y} forms, but not $X.
+ *
+ * The result string should be freed with ddsrt_free().
+ *
+ * @param[in]  string  String to expand.
+ *
+ * @returns Allocated char*.
+ *
+ * @retval NULL
+ *             Expansion failed.
+ * @retval Pointer
+ *             Copy of the string argument with the environment
+ *             variables expanded.
+ */
+DDS_EXPORT char*
+ddsrt_expand_envvars(
+  const char *string);
+
+/**
+ * @brief Expand environment variables within string.
+ *
+ * Expands $X, ${X}, ${X:-Y}, ${X:+Y}, ${X:?Y} forms, $ and \
+ * can be escaped with \.
+ *
+ * The result string should be freed with ddsrt_free().
+ *
+ * @param[in]  string  String to expand.
+ *
+ * @returns Allocated char*.
+ *
+ * @retval NULL
+ *             Expansion failed.
+ * @retval Pointer
+ *             Copy of the string argument with the environment
+ *             variables expanded.
+ */
+DDS_EXPORT char*
+ddsrt_expand_envvars_sh(
+  const char *string);
+
+
 #if defined(__cplusplus)
 }
 #endif
diff --git a/src/ddsrt/tests/environ.c b/src/ddsrt/tests/environ.c
index 56f7468..b69acf4 100644
--- a/src/ddsrt/tests/environ.c
+++ b/src/ddsrt/tests/environ.c
@@ -14,6 +14,7 @@
 #include "CUnit/Theory.h"
 #include "dds/ddsrt/environ.h"
 #include "dds/ddsrt/misc.h"
+#include "dds/ddsrt/heap.h"
 
 CU_TheoryDataPoints(ddsrt_environ, bad_name) = {
   CU_DataPoints(const char *, "", "foo=")
@@ -91,8 +92,110 @@ CU_Test(ddsrt_environ, getenv)
     CU_ASSERT_STRING_EQUAL(ptr, "bar");
   }
 
-  /* Ensure environement is as it was. */
+  /* Ensure environment is as it was. */
   rc = ddsrt_unsetenv(name);
   CU_ASSERT_EQUAL(rc, DDS_RETCODE_OK);
 }
 
+CU_TheoryDataPoints(ddsrt_environ, expand) = {
+  CU_DataPoints(const char *,
+         "${X}",        "$X",          "X",       "${Y}",     "${Q}",      "${X",
+    "${X:-ALT}", "${Q:-ALT}", "${X:-${Y}}", "${Q:-${Y}}", "${X:-$Y}", "${Q:-$Y}", "${X:-}", "${Q:-}",
+    "${X:+SET}", "${Q:+SET}", "${X:+${Y}}", "${Q:+${Y}}", "${X:+$Y}", "${Q:+$Y}", "${X:+}", "${Q:+}",
+    "${X:?SET}", "${Q:?SET}", "${X:?${Y}}", "${Q:?${Y}}", "${X:?$Y}", "${Q:?$Y}", "${X:?}", "${Q:?}"),
+  CU_DataPoints(const char *,
+         "TEST",        "$X",          "X",        "FOO",         "",       NULL,
+         "TEST",       "ALT",       "TEST",        "FOO",     "TEST",       "$Y",   "TEST",       "",
+          "SET",          "",        "FOO",           "",       "$Y",         "",       "",       "",
+         "TEST",        NULL,       "TEST",         NULL,     "TEST",       NULL,   "TEST",     NULL)
+};
+CU_Theory((const char *var, const char *expect), ddsrt_environ, expand)
+{
+  dds_retcode_t rc;
+  static const char x_name[]  = "X";
+  static const char x_value[] = "TEST";
+  static const char y_name[]  = "Y";
+  static const char y_value[] = "FOO";
+  char *ptr;
+
+  /* Ensure that the vars are not used yet. */
+  rc = ddsrt_unsetenv(x_name);
+  CU_ASSERT_EQUAL_FATAL(rc, DDS_RETCODE_OK);
+  rc = ddsrt_unsetenv(y_name);
+  CU_ASSERT_EQUAL_FATAL(rc, DDS_RETCODE_OK);
+
+  /* Set the env vars to check expansion. */
+  rc = ddsrt_setenv(x_name, x_value);
+  CU_ASSERT_EQUAL_FATAL(rc, DDS_RETCODE_OK);
+  rc = ddsrt_setenv(y_name, y_value);
+  CU_ASSERT_EQUAL_FATAL(rc, DDS_RETCODE_OK);
+
+  /* Expand a string with available environment variables. */
+  ptr = ddsrt_expand_envvars(var);
+  if (ptr) {
+    /* printf("==== %10s: expand(%s), expect(%s))\n", var, ptr, expect); */
+    CU_ASSERT_STRING_EQUAL(ptr, expect);
+    ddsrt_free(ptr);
+  } else {
+    /* printf("==== %10s: expand(<null>), expect(<null>))\n", var ? var : "<null>"); */
+    CU_ASSERT_PTR_NULL(expect);
+  }
+
+  /* Ensure to reset the environment is as it was. */
+  rc = ddsrt_unsetenv(y_name);
+  CU_ASSERT_EQUAL(rc, DDS_RETCODE_OK);
+  rc = ddsrt_unsetenv(x_name);
+  CU_ASSERT_EQUAL(rc, DDS_RETCODE_OK);
+}
+
+
+CU_TheoryDataPoints(ddsrt_environ, expand_sh) = {
+  CU_DataPoints(const char *,
+         "${X}",        "$X",          "X",       "${Y}",     "${Q}",      "${X",
+    "${X:-ALT}", "${Q:-ALT}", "${X:-${Y}}", "${Q:-${Y}}", "${X:-$Y}", "${Q:-$Y}", "${X:-}", "${Q:-}",
+    "${X:+SET}", "${Q:+SET}", "${X:+${Y}}", "${Q:+${Y}}", "${X:+$Y}", "${Q:+$Y}", "${X:+}", "${Q:+}",
+    "${X:?SET}", "${Q:?SET}", "${X:?${Y}}", "${Q:?${Y}}", "${X:?$Y}", "${Q:?$Y}", "${X:?}", "${Q:?}"),
+  CU_DataPoints(const char *,
+         "TEST",      "TEST",          "X",        "FOO",         "",       NULL,
+         "TEST",       "ALT",       "TEST",        "FOO",     "TEST",      "FOO",   "TEST",       "",
+          "SET",          "",        "FOO",           "",      "FOO",         "",       "",       "",
+         "TEST",        NULL,       "TEST",         NULL,     "TEST",       NULL,   "TEST",     NULL)
+};
+CU_Theory((const char *var, const char *expect), ddsrt_environ, expand_sh)
+{
+  dds_retcode_t rc;
+  static const char x_name[]  = "X";
+  static const char x_value[] = "TEST";
+  static const char y_name[]  = "Y";
+  static const char y_value[] = "FOO";
+  char *ptr;
+
+  /* Ensure that the vars are not used yet. */
+  rc = ddsrt_unsetenv(x_name);
+  CU_ASSERT_EQUAL_FATAL(rc, DDS_RETCODE_OK);
+  rc = ddsrt_unsetenv(y_name);
+  CU_ASSERT_EQUAL_FATAL(rc, DDS_RETCODE_OK);
+
+  /* Set the env vars to check expansion. */
+  rc = ddsrt_setenv(x_name, x_value);
+  CU_ASSERT_EQUAL_FATAL(rc, DDS_RETCODE_OK);
+  rc = ddsrt_setenv(y_name, y_value);
+  CU_ASSERT_EQUAL_FATAL(rc, DDS_RETCODE_OK);
+
+  /* Expand a string with available environment variables. */
+  ptr = ddsrt_expand_envvars_sh(var);
+  if (ptr) {
+    /* printf("==== %10s: expand(%s), expect(%s))\n", var, ptr, expect); */
+    CU_ASSERT_STRING_EQUAL(ptr, expect);
+    ddsrt_free(ptr);
+  } else {
+    /* printf("==== %10s: expand(<null>), expect(<null>))\n", var ? var : "<null>"); */
+    CU_ASSERT_PTR_NULL(expect);
+  }
+
+  /* Ensure to reset the environment is as it was. */
+  rc = ddsrt_unsetenv(y_name);
+  CU_ASSERT_EQUAL(rc, DDS_RETCODE_OK);
+  rc = ddsrt_unsetenv(x_name);
+  CU_ASSERT_EQUAL(rc, DDS_RETCODE_OK);
+}
diff --git a/src/mpt/mpt/cmake/MPT.cmake b/src/mpt/mpt/cmake/MPT.cmake
index fd50b5b..a9fad3d 100644
--- a/src/mpt/mpt/cmake/MPT.cmake
+++ b/src/mpt/mpt/cmake/MPT.cmake
@@ -171,14 +171,5 @@ function(add_mpt_executable TARGET)
 
   target_include_directories(${TARGET} PRIVATE "${MPT_DIR}/include" "${MPT_BINARY_ROOT_DIR}/mpt/include")
   target_link_libraries(${TARGET} PRIVATE ddsc)
-
-  # We need the 'expand environment variables' feature that is present in the
-  # 'util' module. However, it is currently not possible to properly link to
-  # that module on Windows. In the near future, the utils will be migrated to
-  # ddsrt, after which we automatically have access to expand_envvars.
-  # But until then, use this very ugly (but quick) hack to solve our immediate
-  # build issues.
-  target_include_directories(${TARGET} PRIVATE "${CMAKE_SOURCE_DIR}/util/include")
-  target_sources(${TARGET} PRIVATE "${CMAKE_SOURCE_DIR}/util/src/ut_expand_envvars.c")
 endfunction()
 
diff --git a/src/mpt/mpt/src/main.c.in b/src/mpt/mpt/src/main.c.in
index 31f0689..fb5aaba 100644
--- a/src/mpt/mpt/src/main.c.in
+++ b/src/mpt/mpt/src/main.c.in
@@ -6,7 +6,6 @@
 #include "dds/ddsrt/heap.h"
 #include "dds/ddsrt/process.h"
 #include "dds/ddsrt/environ.h"
-#include "dds/util/ut_expand_envvars.h"
 
 #ifndef _WIN32
 #include <sysexits.h>
@@ -63,7 +62,7 @@ mpt_export_env(const mpt_env_t *env)
 {
   if (env) {
     while ((env->name != NULL) && (env->value != NULL)) {
-      char *expanded = ut_expand_envvars(env->value);
+      char *expanded = ddsrt_expand_envvars(env->value);
       ddsrt_setenv(env->name, expanded);
       ddsrt_free(expanded);
       env++;

From 955f933ae2a011a883a580618b592b9854932a88 Mon Sep 17 00:00:00 2001
From: Martin Bremmer <martin.bremmer@adlinktech.com>
Date: Thu, 11 Apr 2019 14:17:47 +0200
Subject: [PATCH 045/238] Fixed proc compile warning.

Signed-off-by: Martin Bremmer <martin.bremmer@adlinktech.com>
---
 src/ddsrt/src/process/posix/process.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/src/ddsrt/src/process/posix/process.c b/src/ddsrt/src/process/posix/process.c
index f6ed5db..d9c4c72 100644
--- a/src/ddsrt/src/process/posix/process.c
+++ b/src/ddsrt/src/process/posix/process.c
@@ -22,6 +22,7 @@
 #include "dds/ddsrt/process.h"
 #include "dds/ddsrt/string.h"
 #include "dds/ddsrt/heap.h"
+#include "dds/ddsrt/log.h"
 
 
 ddsrt_pid_t
@@ -196,7 +197,9 @@ ddsrt_proc_create(
 
     /* If executing this, something has gone wrong */
     exec_err = errno;
-    (void)write(exec_fds[1], &exec_err, sizeof(int));
+    if (write(exec_fds[1], &exec_err, sizeof(int)) < (ssize_t)sizeof(int)) {
+      DDS_ERROR("Could not write proc error pipe.\n");
+    }
     close(exec_fds[1]);
     close(exec_fds[0]);
     ddsrt_free(exec_argv);

From 289322a33d3efa2161775540dd9d63d4f804788b Mon Sep 17 00:00:00 2001
From: Martin Bremmer <martin.bremmer@adlinktech.com>
Date: Fri, 19 Apr 2019 14:42:31 +0200
Subject: [PATCH 046/238] Improved mpt default timeout.

Signed-off-by: Martin Bremmer <martin.bremmer@adlinktech.com>
---
 src/mpt/CMakeLists.txt                | 1 +
 src/mpt/mpt/cmake/MPT.cmake           | 4 +---
 src/mpt/mpt/include/mpt/mpt.h         | 1 -
 src/mpt/mpt/include/mpt/resource.h.in | 1 +
 src/mpt/mpt/src/main.c.in             | 5 ++---
 src/mpt/tests/self/fixtures.c         | 3 +++
 6 files changed, 8 insertions(+), 7 deletions(-)

diff --git a/src/mpt/CMakeLists.txt b/src/mpt/CMakeLists.txt
index 4b759c7..5c9ec7f 100644
--- a/src/mpt/CMakeLists.txt
+++ b/src/mpt/CMakeLists.txt
@@ -16,6 +16,7 @@ option(MPT_ENABLE_SELFTEST "Enable multi-process test-framework self test" OFF)
 set(MPT_CMAKE "${CMAKE_CURRENT_SOURCE_DIR}/mpt/cmake/MPT.cmake")
 set(MPT_SOURCE_ROOT_DIR "${CMAKE_CURRENT_SOURCE_DIR}")
 set(MPT_BINARY_ROOT_DIR "${CMAKE_CURRENT_BINARY_DIR}")
+set(MPT_DEFAULT_TIMEOUT "60")
 
 add_subdirectory(mpt)
 add_subdirectory(tests)
diff --git a/src/mpt/mpt/cmake/MPT.cmake b/src/mpt/mpt/cmake/MPT.cmake
index a9fad3d..fa57c2b 100644
--- a/src/mpt/mpt/cmake/MPT.cmake
+++ b/src/mpt/mpt/cmake/MPT.cmake
@@ -11,8 +11,6 @@
 #
 set(MPT_DIR "${CMAKE_CURRENT_LIST_DIR}/..")
 
-
-
 function(parse_mpt_fixtures INPUT TEST_DISABLED TEST_TIMEOUT TEST_XFAIL)
   set(s "[ \t\r\n]")
   if(INPUT MATCHES ".disabled${s}*=${s}*([tT][rR][uU][eE]|[0-9]+)")
@@ -24,7 +22,7 @@ function(parse_mpt_fixtures INPUT TEST_DISABLED TEST_TIMEOUT TEST_XFAIL)
   if(INPUT MATCHES ".timeout${s}*=${s}*([0-9]+)")
     set(${TEST_TIMEOUT} "${CMAKE_MATCH_1}" PARENT_SCOPE)
   else()
-    set(${TEST_TIMEOUT} "0" PARENT_SCOPE)
+    set(${TEST_TIMEOUT} "${MPT_DEFAULT_TIMEOUT}" PARENT_SCOPE)
   endif()
 
   if(INPUT MATCHES ".xfail${s}*=${s}*([tT][rR][uU][eE]|[0-9]+)")
diff --git a/src/mpt/mpt/include/mpt/mpt.h b/src/mpt/mpt/include/mpt/mpt.h
index 8d0522a..719c9d6 100644
--- a/src/mpt/mpt/include/mpt/mpt.h
+++ b/src/mpt/mpt/include/mpt/mpt.h
@@ -154,5 +154,4 @@ MPT_TestFiniDeclaration(suite, test)                              \
 /* Helpful function to check for patterns in log callbacks. */
 int mpt_patmatch(const char *pat, const char *str);
 
-
 #endif /* MPT_H_INCLUDED */
diff --git a/src/mpt/mpt/include/mpt/resource.h.in b/src/mpt/mpt/include/mpt/resource.h.in
index 13c5711..258e597 100644
--- a/src/mpt/mpt/include/mpt/resource.h.in
+++ b/src/mpt/mpt/include/mpt/resource.h.in
@@ -2,5 +2,6 @@
 #define MPT_RESOURCE_H_INCLUDED
 
 #define MPT_SOURCE_ROOT_DIR "@MPT_SOURCE_ROOT_DIR@"
+#define MPT_DEFAULT_TIMEOUT (@MPT_DEFAULT_TIMEOUT@) /* Seconds. */
 
 #endif /* MPT_RESOURCE_H_INCLUDED */
diff --git a/src/mpt/mpt/src/main.c.in b/src/mpt/mpt/src/main.c.in
index fb5aaba..14ca113 100644
--- a/src/mpt/mpt/src/main.c.in
+++ b/src/mpt/mpt/src/main.c.in
@@ -157,10 +157,9 @@ mpt_test_new(const char* name, int secs, bool xf)
    * So, make sure that the 'manual' timeout takes longer than the ctest
    * timeout. */
   if (secs == 0) {
-    test->timeout = DDS_SECS(1600);
-  } else {
-    test->timeout = DDS_SECS(secs * 2);
+    secs = MPT_DEFAULT_TIMEOUT;
   }
+  test->timeout = DDS_SECS(secs + 5);
 
   return test;
 }
diff --git a/src/mpt/tests/self/fixtures.c b/src/mpt/tests/self/fixtures.c
index 25b5782..a07bc6f 100644
--- a/src/mpt/tests/self/fixtures.c
+++ b/src/mpt/tests/self/fixtures.c
@@ -70,3 +70,6 @@ MPT_Test(disabled, _false, .disabled=false);
  * This can only really be done manually, unfortunately. */
 MPT_TestProcess(timeout, child_culling, id, proc_sleep, MPT_ArgValues(DDS_SECS(120)));
 MPT_Test(timeout, child_culling, .timeout=1);
+
+MPT_TestProcess(timeout, default_timeout, id, proc_sleep, MPT_ArgValues(DDS_SECS(120)));
+MPT_Test(timeout, default_timeout);

From 5a04db973ad1b4d6c8d5ff1fa8dbcd68d9665338 Mon Sep 17 00:00:00 2001
From: Martin Bremmer <martin.bremmer@adlinktech.com>
Date: Wed, 24 Apr 2019 15:13:30 +0200
Subject: [PATCH 047/238] Be sure to not trigger the SIGCHLD

Signed-off-by: Martin Bremmer <martin.bremmer@adlinktech.com>
---
 src/ddsrt/src/process/posix/process.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/src/ddsrt/src/process/posix/process.c b/src/ddsrt/src/process/posix/process.c
index d9c4c72..d42877f 100644
--- a/src/ddsrt/src/process/posix/process.c
+++ b/src/ddsrt/src/process/posix/process.c
@@ -181,6 +181,9 @@ ddsrt_proc_create(
     goto fail_fctl;
   }
 
+  /* Be sure to not trigger the SIGCHLD. */
+  signal(SIGCHLD, SIG_DFL);
+
   /* Create a new process. */
   spawn = fork();
   if (spawn == -1)

From 14a62ae3cb126caaf3f4f40a125d3a447b470a5d Mon Sep 17 00:00:00 2001
From: Martin Bremmer <martin.bremmer@adlinktech.com>
Date: Thu, 25 Apr 2019 13:29:11 +0200
Subject: [PATCH 048/238] Removed expand_envvars.h

Signed-off-by: Martin Bremmer <martin.bremmer@adlinktech.com>
---
 src/core/ddsi/src/q_config.c                 |  1 -
 src/ddsrt/CMakeLists.txt                     |  1 -
 src/ddsrt/include/dds/ddsrt/expand_envvars.h | 31 --------------------
 src/ddsrt/src/expand_envvars.c               |  1 -
 4 files changed, 34 deletions(-)
 delete mode 100644 src/ddsrt/include/dds/ddsrt/expand_envvars.h

diff --git a/src/core/ddsi/src/q_config.c b/src/core/ddsi/src/q_config.c
index bf1781d..f3ea0a7 100644
--- a/src/core/ddsi/src/q_config.c
+++ b/src/core/ddsi/src/q_config.c
@@ -33,7 +33,6 @@
 #include "dds/ddsi/q_error.h"
 
 #include "dds/ddsrt/xmlparser.h"
-#include "dds/ddsrt/expand_envvars.h"
 
 #include "dds/version.h"
 
diff --git a/src/ddsrt/CMakeLists.txt b/src/ddsrt/CMakeLists.txt
index 5b49248..cda6f18 100644
--- a/src/ddsrt/CMakeLists.txt
+++ b/src/ddsrt/CMakeLists.txt
@@ -79,7 +79,6 @@ list(APPEND sources
 
 list(APPEND headers
   "${source_path}/dds/ddsrt/avl.h"
-  "${source_path}/dds/ddsrt/expand_envvars.h"
   "${source_path}/dds/ddsrt/fibheap.h"
   "${source_path}/dds/ddsrt/hopscotch.h"
   "${source_path}/dds/ddsrt/thread_pool.h")
diff --git a/src/ddsrt/include/dds/ddsrt/expand_envvars.h b/src/ddsrt/include/dds/ddsrt/expand_envvars.h
deleted file mode 100644
index d7b66f4..0000000
--- a/src/ddsrt/include/dds/ddsrt/expand_envvars.h
+++ /dev/null
@@ -1,31 +0,0 @@
-/*
- * Copyright(c) 2006 to 2018 ADLINK Technology Limited and others
- *
- * This program and the accompanying materials are made available under the
- * terms of the Eclipse Public License v. 2.0 which is available at
- * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
- * v. 1.0 which is available at
- * http://www.eclipse.org/org/documents/edl-v10.php.
- *
- * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
- */
-#ifndef DDSRT_EXPAND_ENVVARS_H
-#define DDSRT_EXPAND_ENVVARS_H
-
-#include "dds/export.h"
-
-#if defined (__cplusplus)
-extern "C" {
-#endif
-
-    /* Expands ${X}, ${X:-Y}, ${X:+Y}, ${X:?Y} forms, but not $X */
-    DDS_EXPORT char *ddsrt_expand_envvars(const char *string);
-
-    /* Expands $X, ${X}, ${X:-Y}, ${X:+Y}, ${X:?Y} forms, $ and \ can be escaped with \ */
-    DDS_EXPORT char *ddsrt_expand_envvars_sh(const char *string);
-
-#if defined (__cplusplus)
-}
-#endif
-
-#endif
diff --git a/src/ddsrt/src/expand_envvars.c b/src/ddsrt/src/expand_envvars.c
index ded0d0a..dbaa33a 100644
--- a/src/ddsrt/src/expand_envvars.c
+++ b/src/ddsrt/src/expand_envvars.c
@@ -19,7 +19,6 @@
 #include "dds/ddsrt/heap.h"
 #include "dds/ddsrt/log.h"
 #include "dds/ddsrt/string.h"
-#include "dds/ddsrt/expand_envvars.h"
 
 typedef char * (*expand_fn)(const char *src0);
 

From 5f9aed1c8759138eb14036ad4cf71fe798ee164e Mon Sep 17 00:00:00 2001
From: Erik Boasson <eb@ilities.com>
Date: Thu, 25 Apr 2019 11:43:19 +0200
Subject: [PATCH 049/238] address a handful of compiler warnings in ddsperf

These are fortunately all false positives.

Signed-off-by: Erik Boasson <eb@ilities.com>
---
 src/tools/ddsperf/ddsperf.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/src/tools/ddsperf/ddsperf.c b/src/tools/ddsperf/ddsperf.c
index 51874a4..7052233 100644
--- a/src/tools/ddsperf/ddsperf.c
+++ b/src/tools/ddsperf/ddsperf.c
@@ -664,7 +664,7 @@ static dds_instance_handle_t get_pphandle_for_pubhandle (dds_instance_handle_t p
   dds_sample_info_t info;
   if ((n = dds_read_instance (rd_publications, &msg, &info, 1, 1, pubhandle)) < 0)
     error2 ("dds_read_instance(rd_publications, %"PRIx64") failed: %d\n", pubhandle, (int) n);
-  else if (n == 0 || !info.valid_data)
+  if (n == 0 || !info.valid_data)
   {
     printf ("get_pong_writer: publication handle %"PRIx64" not found\n", pubhandle);
     fflush (stdout);
@@ -772,7 +772,7 @@ static bool process_data (dds_entity_t rd, struct subthread_arg *arg)
   {
     if (iseq[i].valid_data)
     {
-      uint32_t seq, keyval, size;
+      uint32_t seq = 0, keyval = 0, size = 0;
       switch (topicsel)
       {
         case KS:   { KeyedSeq *d = (KeyedSeq *) mseq[i]; keyval = d->keyval; seq = d->seq; size = 12 + d->baggage._length; } break;
@@ -783,7 +783,7 @@ static bool process_data (dds_entity_t rd, struct subthread_arg *arg)
       (void) check_eseq (&eseq_admin, seq, keyval, size, iseq[i].publication_handle);
       if (iseq[i].source_timestamp & 1)
       {
-        dds_entity_t wr_pong = 0;
+        dds_entity_t wr_pong;
         if ((wr_pong = get_pong_writer (iseq[i].publication_handle)) != 0)
         {
           dds_return_t rc;

From ae323ab0ca0bac5182a24d7faee83a98babc7c31 Mon Sep 17 00:00:00 2001
From: Erik Boasson <eb@ilities.com>
Date: Mon, 29 Apr 2019 09:24:18 +0200
Subject: [PATCH 050/238] make internal header files more C++ friendly

Generally one doesn't need to include any internal header files in an
application, but the (unstable) interface for application-defined sample
representation and serialization does require including some.  It turns
out a keyword clash had to be resolved (typename => type_name) and that
a whole bunch of them were missing the #ifdef __cplusplus / extern "C"
bit.

It further turned out that one had to pull in nearly all of the type
definitions, including some typedefs that are illegal in C++, e.g.,

  typedef struct os_sockWaitset *os_sockWaitset;

C++ is right to forbid this, but Cyclone's header files were wrong to
force inclusion of so much irrelevant stuff.  This commit leaves these
typedefs in place, but eliminates a few header file inclusions to avoid
the problem.

Signed-off-by: Erik Boasson <eb@ilities.com>
---
 src/core/ddsc/src/dds__guardcond.h            |  8 +++
 src/core/ddsc/src/dds__readcond.h             |  8 +++
 src/core/ddsc/src/dds__serdata_builtintopic.h |  8 +++
 src/core/ddsc/src/dds_init.c                  |  1 +
 src/core/ddsc/src/dds_instance.c              |  2 +-
 src/core/ddsc/src/dds_read.c                  |  1 +
 src/core/ddsc/src/dds_reader.c                |  1 +
 src/core/ddsc/src/dds_serdata_builtintopic.c  |  2 +-
 src/core/ddsc/src/dds_sertopic_builtintopic.c |  9 +--
 src/core/ddsc/src/dds_topic.c                 | 12 ++--
 src/core/ddsc/src/dds_whc.c                   |  1 +
 src/core/ddsc/src/dds_writer.c                |  1 +
 src/core/ddsi/include/dds/ddsi/ddsi_ipaddr.h  | 10 ++-
 src/core/ddsi/include/dds/ddsi/ddsi_mcgroup.h |  8 +++
 src/core/ddsi/include/dds/ddsi/ddsi_raweth.h  |  8 +++
 .../ddsi/include/dds/ddsi/ddsi_rhc_plugin.h   |  8 +++
 src/core/ddsi/include/dds/ddsi/ddsi_serdata.h | 65 ++++++++++++++-----
 .../include/dds/ddsi/ddsi_serdata_default.h   |  8 +++
 .../ddsi/include/dds/ddsi/ddsi_sertopic.h     | 18 +++--
 src/core/ddsi/include/dds/ddsi/ddsi_ssl.h     |  8 +++
 src/core/ddsi/include/dds/ddsi/ddsi_tcp.h     | 16 +++++
 src/core/ddsi/include/dds/ddsi/ddsi_tran.h    | 17 ++++-
 src/core/ddsi/include/dds/ddsi/ddsi_udp.h     |  8 +++
 src/core/ddsi/include/dds/ddsi/q_bitset.h     |  8 +++
 src/core/ddsi/include/dds/ddsi/q_bswap.h      |  8 +--
 src/core/ddsi/include/dds/ddsi/q_debmon.h     | 10 ++-
 src/core/ddsi/include/dds/ddsi/q_entity.h     |  8 ++-
 src/core/ddsi/include/dds/ddsi/q_freelist.h   |  8 +++
 src/core/ddsi/include/dds/ddsi/q_init.h       |  8 +++
 .../include/dds/ddsi/q_inverse_uint32_set.h   |  8 +++
 src/core/ddsi/include/dds/ddsi/q_radmin.h     |  1 -
 src/core/ddsi/include/dds/ddsi/q_xmsg.h       |  1 +
 src/core/ddsi/src/ddsi_eth.h                  |  8 +++
 src/core/ddsi/src/ddsi_ipaddr.c               |  1 +
 src/core/ddsi/src/ddsi_mcgroup.c              |  1 +
 src/core/ddsi/src/ddsi_raweth.c               |  1 +
 src/core/ddsi/src/ddsi_serdata_default.c      |  1 +
 src/core/ddsi/src/ddsi_sertopic.c             |  4 +-
 src/core/ddsi/src/ddsi_tcp.c                  |  1 +
 src/core/ddsi/src/ddsi_tran.c                 |  1 +
 src/core/ddsi/src/ddsi_udp.c                  |  1 +
 src/core/ddsi/src/q_debmon.c                  |  2 +-
 src/core/ddsi/src/q_entity.c                  |  6 +-
 src/core/ddsi/src/q_plist.c                   |  1 +
 src/core/ddsi/src/q_receive.c                 |  4 +-
 src/core/ddsi/src/q_transmit.c                |  4 +-
 src/ddsrt/include/dds/ddsrt/atomics/arm.h     |  9 ++-
 src/ddsrt/include/dds/ddsrt/atomics/gcc.h     |  9 ++-
 src/ddsrt/include/dds/ddsrt/atomics/msvc.h    |  9 ++-
 src/ddsrt/include/dds/ddsrt/atomics/sun.h     |  7 ++
 src/ddsrt/include/dds/ddsrt/cdtors.h          |  8 +++
 src/ddsrt/include/dds/ddsrt/md5.h             |  7 +-
 src/ddsrt/include/dds/ddsrt/retcode.h         |  8 +++
 src/ddsrt/include/dds/ddsrt/rusage.h          |  8 +++
 src/ddsrt/include/dds/ddsrt/sockets.h         |  8 +++
 src/ddsrt/include/dds/ddsrt/strtod.h          |  8 +++
 56 files changed, 345 insertions(+), 60 deletions(-)

diff --git a/src/core/ddsc/src/dds__guardcond.h b/src/core/ddsc/src/dds__guardcond.h
index 7d57643..f317dc5 100644
--- a/src/core/ddsc/src/dds__guardcond.h
+++ b/src/core/ddsc/src/dds__guardcond.h
@@ -14,10 +14,18 @@
 
 #include "dds__entity.h"
 
+#if defined (__cplusplus)
+extern "C" {
+#endif
+
 dds_guardcond*
 dds_create_guardcond(
         dds_participant *pp);
 
 DEFINE_ENTITY_LOCK_UNLOCK(inline, dds_guardcond, DDS_KIND_COND_GUARD)
 
+#if defined (__cplusplus)
+}
+#endif
+
 #endif
diff --git a/src/core/ddsc/src/dds__readcond.h b/src/core/ddsc/src/dds__readcond.h
index aa0494e..f76137c 100644
--- a/src/core/ddsc/src/dds__readcond.h
+++ b/src/core/ddsc/src/dds__readcond.h
@@ -14,6 +14,10 @@
 
 #include "dds__entity.h"
 
+#if defined (__cplusplus)
+extern "C" {
+#endif
+
 dds_readcond *
 dds_create_readcond(
   dds_reader *rd,
@@ -21,4 +25,8 @@ dds_create_readcond(
   uint32_t mask,
   dds_querycondition_filter_fn filter);
 
+#if defined (__cplusplus)
+}
+#endif
+
 #endif
diff --git a/src/core/ddsc/src/dds__serdata_builtintopic.h b/src/core/ddsc/src/dds__serdata_builtintopic.h
index 6afe2d1..1c4d548 100644
--- a/src/core/ddsc/src/dds__serdata_builtintopic.h
+++ b/src/core/ddsc/src/dds__serdata_builtintopic.h
@@ -16,6 +16,10 @@
 #include "dds/ddsi/ddsi_serdata.h"
 #include "dds/ddsi/ddsi_sertopic.h"
 
+#if defined (__cplusplus)
+extern "C" {
+#endif
+
 struct ddsi_serdata_builtintopic {
   struct ddsi_serdata c;
   nn_guid_t key;
@@ -39,4 +43,8 @@ extern const struct ddsi_serdata_ops ddsi_serdata_ops_builtintopic;
 
 struct ddsi_sertopic *new_sertopic_builtintopic (enum ddsi_sertopic_builtintopic_type type, const char *name, const char *typename);
 
+#if defined (__cplusplus)
+}
+#endif
+
 #endif
diff --git a/src/core/ddsc/src/dds_init.c b/src/core/ddsc/src/dds_init.c
index d51bfb0..9e74180 100644
--- a/src/core/ddsc/src/dds_init.c
+++ b/src/core/ddsc/src/dds_init.c
@@ -30,6 +30,7 @@
 #include "dds/ddsi/q_entity.h"
 #include "dds/ddsi/q_config.h"
 #include "dds/ddsi/q_gc.h"
+#include "dds/ddsi/q_globals.h"
 #include "dds/version.h"
 
 #define DOMAIN_ID_MIN 0
diff --git a/src/core/ddsc/src/dds_instance.c b/src/core/ddsc/src/dds_instance.c
index 25156fe..903d7ee 100644
--- a/src/core/ddsc/src/dds_instance.c
+++ b/src/core/ddsc/src/dds_instance.c
@@ -22,7 +22,7 @@
 #include "dds/ddsi/ddsi_serdata.h"
 #include "dds/ddsi/q_entity.h"
 #include "dds/ddsi/q_thread.h"
-
+#include "dds/ddsi/q_globals.h"
 
 dds_return_t
 dds_writedispose(
diff --git a/src/core/ddsc/src/dds_read.c b/src/core/ddsc/src/dds_read.c
index 37e35ec..2791a44 100644
--- a/src/core/ddsc/src/dds_read.c
+++ b/src/core/ddsc/src/dds_read.c
@@ -19,6 +19,7 @@
 #include "dds/ddsi/q_thread.h"
 #include "dds/ddsi/q_ephash.h"
 #include "dds/ddsi/q_entity.h"
+#include "dds/ddsi/q_globals.h"
 #include "dds/ddsi/ddsi_sertopic.h"
 
 static dds_retcode_t dds_read_lock (dds_entity_t hdl, dds_reader **reader, dds_readcond **condition, bool only_reader)
diff --git a/src/core/ddsc/src/dds_reader.c b/src/core/ddsc/src/dds_reader.c
index 6ce57b9..be86ed3 100644
--- a/src/core/ddsc/src/dds_reader.c
+++ b/src/core/ddsc/src/dds_reader.c
@@ -23,6 +23,7 @@
 #include "dds__topic.h"
 #include "dds/ddsi/q_entity.h"
 #include "dds/ddsi/q_thread.h"
+#include "dds/ddsi/q_globals.h"
 #include "dds__builtin.h"
 #include "dds/ddsi/ddsi_sertopic.h"
 
diff --git a/src/core/ddsc/src/dds_serdata_builtintopic.c b/src/core/ddsc/src/dds_serdata_builtintopic.c
index 33da2ca..5cbd47b 100644
--- a/src/core/ddsc/src/dds_serdata_builtintopic.c
+++ b/src/core/ddsc/src/dds_serdata_builtintopic.c
@@ -91,7 +91,7 @@ static void set_topic_type_from_sertopic (struct ddsi_serdata_builtintopic *d, c
   }
   if (!(d->xqos.present & QP_TYPE_NAME))
   {
-    d->xqos.type_name = dds_string_dup (tp->typename);
+    d->xqos.type_name = dds_string_dup (tp->type_name);
     d->xqos.present |= QP_TYPE_NAME;
   }
 }
diff --git a/src/core/ddsc/src/dds_sertopic_builtintopic.c b/src/core/ddsc/src/dds_sertopic_builtintopic.c
index 05c9544..7773a13 100644
--- a/src/core/ddsc/src/dds_sertopic_builtintopic.c
+++ b/src/core/ddsc/src/dds_sertopic_builtintopic.c
@@ -21,6 +21,7 @@
 #include "dds/ddsi/q_config.h"
 #include "dds/ddsi/q_freelist.h"
 #include "dds/ddsi/ddsi_sertopic.h"
+#include "dds/ddsi/ddsi_iid.h"
 #include "dds__serdata_builtintopic.h"
 
 /* FIXME: sertopic /= ddstopic so a lot of stuff needs to be moved here from dds_topic.c and the free function needs to be implemented properly */
@@ -30,10 +31,10 @@ struct ddsi_sertopic *new_sertopic_builtintopic (enum ddsi_sertopic_builtintopic
   struct ddsi_sertopic_builtintopic *tp = ddsrt_malloc (sizeof (*tp));
   tp->c.iid = ddsi_iid_gen();
   tp->c.name = dds_string_dup (name);
-  tp->c.typename = dds_string_dup (typename);
-  const size_t name_typename_size = strlen (tp->c.name) + 1 + strlen (tp->c.typename) + 1;
-  tp->c.name_typename = dds_alloc (name_typename_size);
-  snprintf (tp->c.name_typename, name_typename_size, "%s/%s", tp->c.name, tp->c.typename);
+  tp->c.type_name = dds_string_dup (typename);
+  const size_t name_typename_size = strlen (tp->c.name) + 1 + strlen (tp->c.type_name) + 1;
+  tp->c.name_type_name = dds_alloc (name_typename_size);
+  snprintf (tp->c.name_type_name, name_typename_size, "%s/%s", tp->c.name, tp->c.type_name);
   tp->c.ops = &ddsi_sertopic_ops_builtintopic;
   tp->c.serdata_ops = &ddsi_serdata_ops_builtintopic;
   tp->c.serdata_basehash = ddsi_sertopic_compute_serdata_basehash (tp->c.serdata_ops);
diff --git a/src/core/ddsc/src/dds_topic.c b/src/core/ddsc/src/dds_topic.c
index f834f00..747976c 100644
--- a/src/core/ddsc/src/dds_topic.c
+++ b/src/core/ddsc/src/dds_topic.c
@@ -35,7 +35,7 @@ DECL_ENTITY_LOCK_UNLOCK(extern inline, dds_topic)
 const ddsrt_avl_treedef_t dds_topictree_def = DDSRT_AVL_TREEDEF_INITIALIZER_INDKEY
 (
   offsetof (struct ddsi_sertopic, avlnode),
-  offsetof (struct ddsi_sertopic, name_typename),
+  offsetof (struct ddsi_sertopic, name_type_name),
   (int (*) (const void *, const void *)) strcmp,
   0
 );
@@ -285,7 +285,7 @@ static bool dupdef_qos_ok(const dds_qos_t *qos, const struct ddsi_sertopic *st)
 
 static bool sertopic_equivalent (const struct ddsi_sertopic *a, const struct ddsi_sertopic *b)
 {
-  if (strcmp (a->name_typename, b->name_typename) != 0)
+  if (strcmp (a->name_type_name, b->name_type_name) != 0)
     return false;
   if (a->serdata_basehash != b->serdata_basehash)
     return false;
@@ -447,9 +447,9 @@ dds_create_topic(
     st->c.iid = ddsi_iid_gen ();
     st->c.status_cb = dds_topic_status_cb;
     st->c.status_cb_entity = NULL; /* set by dds_create_topic_arbitrary */
-    st->c.name_typename = key;
+    st->c.name_type_name = key;
     st->c.name = dds_string_dup (name);
-    st->c.typename = dds_string_dup (typename);
+    st->c.type_name = dds_string_dup (typename);
     st->c.ops = &ddsi_sertopic_ops_default;
     st->c.serdata_ops = desc->m_nkeys ? &ddsi_serdata_ops_cdr : &ddsi_serdata_ops_cdr_nokey;
     st->c.serdata_basehash = ddsi_sertopic_compute_serdata_basehash (st->c.serdata_ops);
@@ -471,7 +471,7 @@ dds_create_topic(
 
     /* Set Topic meta data (for SEDP publication) */
     plist.qos.topic_name = dds_string_dup (st->c.name);
-    plist.qos.type_name = dds_string_dup (st->c.typename);
+    plist.qos.type_name = dds_string_dup (st->c.type_name);
     plist.qos.present |= (QP_TOPIC_NAME | QP_TYPE_NAME);
     if (desc->m_meta) {
         plist.type_description = dds_string_dup (desc->m_meta);
@@ -643,7 +643,7 @@ dds_get_type_name(
         ret = DDS_ERRNO(rc);
         goto fail;
     }
-    (void)snprintf(name, size, "%s", t->m_stopic->typename);
+    (void)snprintf(name, size, "%s", t->m_stopic->type_name);
     dds_topic_unlock(t);
     ret = DDS_RETCODE_OK;
 fail:
diff --git a/src/core/ddsc/src/dds_whc.c b/src/core/ddsc/src/dds_whc.c
index 5408c69..b63ca62 100644
--- a/src/core/ddsc/src/dds_whc.c
+++ b/src/core/ddsc/src/dds_whc.c
@@ -27,6 +27,7 @@
 #include "dds/ddsi/q_time.h"
 #include "dds/ddsi/q_rtps.h"
 #include "dds/ddsi/q_freelist.h"
+#include "dds/ddsi/q_globals.h"
 
 #define USE_EHH 0
 
diff --git a/src/core/ddsc/src/dds_writer.c b/src/core/ddsc/src/dds_writer.c
index f98d70c..b36bfc9 100644
--- a/src/core/ddsc/src/dds_writer.c
+++ b/src/core/ddsc/src/dds_writer.c
@@ -14,6 +14,7 @@
 #include "dds/dds.h"
 #include "dds/version.h"
 #include "dds/ddsi/q_config.h"
+#include "dds/ddsi/q_globals.h"
 #include "dds/ddsi/q_entity.h"
 #include "dds/ddsi/q_thread.h"
 #include "dds/ddsi/q_xmsg.h"
diff --git a/src/core/ddsi/include/dds/ddsi/ddsi_ipaddr.h b/src/core/ddsi/include/dds/ddsi/ddsi_ipaddr.h
index 3bc6f2f..9c7f1d3 100644
--- a/src/core/ddsi/include/dds/ddsi/ddsi_ipaddr.h
+++ b/src/core/ddsi/include/dds/ddsi/ddsi_ipaddr.h
@@ -14,11 +14,19 @@
 
 #include "dds/ddsi/ddsi_tran.h"
 
-enum ddsi_nearby_address_result ddsi_ipaddr_is_nearby_address (ddsi_tran_factory_t tran, const nn_locator_t *loc, size_t ninterf, const struct nn_interface interf[]);
+#if defined (__cplusplus)
+extern "C" {
+#endif
+
+enum ddsi_nearby_address_result ddsi_ipaddr_is_nearby_address (ddsi_tran_factory_t tran, const nn_locator_t *loc, size_t ninterf, const struct nn_interface *interf);
 enum ddsi_locator_from_string_result ddsi_ipaddr_from_string (ddsi_tran_factory_t tran, nn_locator_t *loc, const char *str, int32_t kind);
 int ddsi_ipaddr_compare (const struct sockaddr *const sa1, const struct sockaddr *const sa2);
 char *ddsi_ipaddr_to_string (ddsi_tran_factory_t tran, char *dst, size_t sizeof_dst, const nn_locator_t *loc, int with_port);
 void ddsi_ipaddr_to_loc (nn_locator_t *dst, const struct sockaddr *src, int32_t kind);
 void ddsi_ipaddr_from_loc (struct sockaddr_storage *dst, const nn_locator_t *src);
 
+#if defined (__cplusplus)
+}
+#endif
+
 #endif
diff --git a/src/core/ddsi/include/dds/ddsi/ddsi_mcgroup.h b/src/core/ddsi/include/dds/ddsi/ddsi_mcgroup.h
index 018237a..f4dc36f 100644
--- a/src/core/ddsi/include/dds/ddsi/ddsi_mcgroup.h
+++ b/src/core/ddsi/include/dds/ddsi/ddsi_mcgroup.h
@@ -14,6 +14,10 @@
 
 #include "dds/ddsi/ddsi_tran.h"
 
+#if defined (__cplusplus)
+extern "C" {
+#endif
+
 struct nn_group_membership;
 
 struct nn_group_membership *new_group_membership (void);
@@ -23,4 +27,8 @@ int ddsi_leave_mc (ddsi_tran_conn_t conn, const nn_locator_t *srcip, const nn_lo
 void ddsi_transfer_group_membership (ddsi_tran_conn_t conn, ddsi_tran_conn_t newconn);
 int ddsi_rejoin_transferred_mcgroups (ddsi_tran_conn_t conn);
 
+#if defined (__cplusplus)
+}
+#endif
+
 #endif
diff --git a/src/core/ddsi/include/dds/ddsi/ddsi_raweth.h b/src/core/ddsi/include/dds/ddsi/ddsi_raweth.h
index e81472e..da60a24 100644
--- a/src/core/ddsi/include/dds/ddsi/ddsi_raweth.h
+++ b/src/core/ddsi/include/dds/ddsi/ddsi_raweth.h
@@ -12,6 +12,14 @@
 #ifndef DDSI_RAWETH_H
 #define DDSI_RAWETH_H
 
+#if defined (__cplusplus)
+extern "C" {
+#endif
+
 int ddsi_raweth_init (void);
 
+#if defined (__cplusplus)
+}
+#endif
+
 #endif
diff --git a/src/core/ddsi/include/dds/ddsi/ddsi_rhc_plugin.h b/src/core/ddsi/include/dds/ddsi/ddsi_rhc_plugin.h
index 57c8813..1d37ecf 100644
--- a/src/core/ddsi/include/dds/ddsi/ddsi_rhc_plugin.h
+++ b/src/core/ddsi/include/dds/ddsi/ddsi_rhc_plugin.h
@@ -12,6 +12,10 @@
 #ifndef DDSI_RHC_PLUGIN_H
 #define DDSI_RHC_PLUGIN_H
 
+#if defined (__cplusplus)
+extern "C" {
+#endif
+
 struct rhc;
 struct nn_xqos;
 struct ddsi_tkmap_instance;
@@ -42,4 +46,8 @@ struct ddsi_rhc_plugin
 
 DDS_EXPORT void make_proxy_writer_info(struct proxy_writer_info *pwr_info, const struct entity_common *e, const struct nn_xqos *xqos);
 
+#if defined (__cplusplus)
+}
+#endif
+
 #endif
diff --git a/src/core/ddsi/include/dds/ddsi/ddsi_serdata.h b/src/core/ddsi/include/dds/ddsi/ddsi_serdata.h
index 0bddb32..866910a 100644
--- a/src/core/ddsi/include/dds/ddsi/ddsi_serdata.h
+++ b/src/core/ddsi/include/dds/ddsi/ddsi_serdata.h
@@ -16,6 +16,10 @@
 #include "dds/ddsi/q_time.h"
 #include "dds/ddsi/ddsi_sertopic.h"
 
+#if defined (__cplusplus)
+extern "C" {
+#endif
+
 struct nn_rdata;
 struct nn_keyhash;
 
@@ -40,37 +44,62 @@ struct ddsi_serdata {
   nn_mtime_t twrite; /* write time, not source timestamp, set post-throttling */
 };
 
-/* Serialised size of sample: uint32_t because the protocol can't handle samples larger than 4GB anyway */
+/* Serialised size of sample inclusive of DDSI encoding header
+   - uint32_t because the protocol can't handle samples larger than 4GB anyway
+   - FIXME: get the encoding header out of the serialised data */
 typedef uint32_t (*ddsi_serdata_size_t) (const struct ddsi_serdata *d);
 
 /* Free a serdata (called by unref when refcount goes to 0) */
 typedef void (*ddsi_serdata_free_t) (struct ddsi_serdata *d);
 
-/* Construct a serdata from a fragchain received over the network */
+/* Construct a serdata from a fragchain received over the network
+   - "kind" is KEY or DATA depending on the type of payload
+   - "size" is the serialised size of the sample, inclusive of DDSI encoding header
+   - the first fragchain always contains the encoding header in its entirety
+   - fragchains may overlap, though I have never seen any DDS implementation
+     actually send such nasty fragments
+   - FIXME: get the encoding header out of the serialised data */
 typedef struct ddsi_serdata * (*ddsi_serdata_from_ser_t) (const struct ddsi_sertopic *topic, enum ddsi_serdata_kind kind, const struct nn_rdata *fragchain, size_t size);
 
 /* Construct a serdata from a keyhash (an SDK_KEY by definition) */
 typedef struct ddsi_serdata * (*ddsi_serdata_from_keyhash_t) (const struct ddsi_sertopic *topic, const struct nn_keyhash *keyhash);
 
-/* Construct a serdata from an application sample */
+/* Construct a serdata from an application sample
+   - "kind" is KEY or DATA depending on the operation invoked by the application;
+     e.g., write results in kind = DATA, dispose in kind = KEY.  The important bit
+     is to not assume anything of the contents of non-key fields if kind = KEY
+     unless additional application knowledge is available */
 typedef struct ddsi_serdata * (*ddsi_serdata_from_sample_t) (const struct ddsi_sertopic *topic, enum ddsi_serdata_kind kind, const void *sample);
 
-/* Construct a topic-less serdata with a keyvalue given a normal serdata (either key or data) - used for tkmap */
+/* Construct a topic-less serdata with just a keyvalue given a normal serdata (either key or data)
+   - used for mapping key values to instance ids in tkmap
+   - two reasons: size (keys are typically smaller than samples), and data in tkmap
+     is shared across topics
+   - whether a serdata is topicless or not is known from the context, and the topic
+     field may have any value for a topicless serdata (so in some cases, one can
+     simply do "return ddsi_serdata_ref(d);"
+ */
 typedef struct ddsi_serdata * (*ddsi_serdata_to_topicless_t) (const struct ddsi_serdata *d);
 
-/* Fill buffer with 'size' bytes of serialised data, starting from 'off'; 0 <= off < off+sz <=
-   alignup4(size(d)) */
+/* Fill buffer with 'size' bytes of serialised data, starting from 'off'
+   - 0 <= off < off+sz <= alignup4(size(d))
+   - bytes at offsets 0 .. 3 are DDSI encoding header, size(d) includes that header
+   - what to copy for bytes in [size(d), alignup4(size(d))) depends on the serdata
+     implementation, the protocol treats them as undefined
+   - FIXME: get the encoding header out of the serialised data */
 typedef void (*ddsi_serdata_to_ser_t) (const struct ddsi_serdata *d, size_t off, size_t sz, void *buf);
 
-/* Provide a pointer to 'size' bytes of serialised data, starting from 'off'; 0 <= off < off+sz <=
-   alignup4(size(d)); it must remain valid until the corresponding call to to_ser_unref.  Multiple
-   calls to to_ser_ref() may be issued in parallel, the separate ref/unref bit is there to at least
-   have the option of lazily creating the serialised representation and freeing it when no one needs
-   it, while the sample itself remains valid */
+/* Provide a pointer to 'size' bytes of serialised data, starting from 'off'
+   - see ddsi_serdata_to_ser_t above
+   - instead of copying, this gives a reference that must remain valid until the
+     corresponding call to to_ser_unref
+   - multiple calls to to_ser_ref() may be issued in parallel
+   - lazily creating the serialised representation is allowed (though I'm not sure
+     how that would work with knowing the serialised size beforehand ...) */
 typedef struct ddsi_serdata * (*ddsi_serdata_to_ser_ref_t) (const struct ddsi_serdata *d, size_t off, size_t sz, ddsrt_iovec_t *ref);
 
-/* Release a lock on serialised data, ref must be a pointer previously obtained by calling
-   to_ser_ref(d, off, sz) for some offset off. */
+/* Release a lock on serialised data
+   - ref was previousy filled by ddsi_serdata_to_ser_ref_t */
 typedef void (*ddsi_serdata_to_ser_unref_t) (struct ddsi_serdata *d, const ddsrt_iovec_t *ref);
 
 /* Turn serdata into an application sample (or just the key values if only key values are
@@ -83,11 +112,11 @@ typedef void (*ddsi_serdata_to_ser_unref_t) (struct ddsi_serdata *d, const ddsrt
    by the caller.) */
 typedef bool (*ddsi_serdata_to_sample_t) (const struct ddsi_serdata *d, void *sample, void **bufptr, void *buflim);
 
-/* Create a sample from a topicless serdata, as returned by serdata_to_topicless. This sample
-   obviously has just the key fields filled in, and is used for generating invalid samples. */
+/* Create a sample from a topicless serdata, as returned by serdata_to_topicless.  This sample
+   obviously has just the key fields filled in and is used for generating invalid samples. */
 typedef bool (*ddsi_serdata_topicless_to_sample_t) (const struct ddsi_sertopic *topic, const struct ddsi_serdata *d, void *sample, void **bufptr, void *buflim);
 
-/* Test key values of two serdatas for equality. The two will have the same ddsi_serdata_ops,
+/* Test key values of two serdatas for equality.  The two will have the same ddsi_serdata_ops,
    but are not necessarily of the same topic (one can decide to never consider them equal if they
    are of different topics, of course; but the nice thing about _not_ doing that is that all
    instances with a certain key value with have the same instance id, and that in turn makes
@@ -166,4 +195,8 @@ DDS_EXPORT inline bool ddsi_serdata_eqkey (const struct ddsi_serdata *a, const s
   return a->ops->eqkey (a, b);
 }
 
+#if defined (__cplusplus)
+}
+#endif
+
 #endif
diff --git a/src/core/ddsi/include/dds/ddsi/ddsi_serdata_default.h b/src/core/ddsi/include/dds/ddsi/ddsi_serdata_default.h
index 7775e1c..c61bb97 100644
--- a/src/core/ddsi/include/dds/ddsi/ddsi_serdata_default.h
+++ b/src/core/ddsi/include/dds/ddsi/ddsi_serdata_default.h
@@ -22,6 +22,10 @@
 #include "dds/dds.h"
 #include "dds__topic.h"
 
+#if defined (__cplusplus)
+extern "C" {
+#endif
+
 #if DDSRT_ENDIAN == DDSRT_LITTLE_ENDIAN
 #define CDR_BE 0x0000
 #define CDR_LE 0x0100
@@ -125,4 +129,8 @@ extern DDS_EXPORT const struct ddsi_serdata_ops ddsi_serdata_ops_rawcdr;
 struct serdatapool * ddsi_serdatapool_new (void);
 void ddsi_serdatapool_free (struct serdatapool * pool);
 
+#if defined (__cplusplus)
+}
+#endif
+
 #endif
diff --git a/src/core/ddsi/include/dds/ddsi/ddsi_sertopic.h b/src/core/ddsi/include/dds/ddsi/ddsi_sertopic.h
index edd0b02..172af62 100644
--- a/src/core/ddsi/include/dds/ddsi/ddsi_sertopic.h
+++ b/src/core/ddsi/include/dds/ddsi/ddsi_sertopic.h
@@ -16,6 +16,10 @@
 #include "dds/ddsrt/avl.h"
 #include "dds/ddsc/dds_public_alloc.h"
 
+#if defined (__cplusplus)
+extern "C" {
+#endif
+
 struct ddsi_serdata;
 struct ddsi_serdata_ops;
 
@@ -29,9 +33,9 @@ struct ddsi_sertopic {
   const struct ddsi_sertopic_ops *ops;
   const struct ddsi_serdata_ops *serdata_ops;
   uint32_t serdata_basehash;
-  char *name_typename;
+  char *name_type_name;
   char *name;
-  char *typename;
+  char *type_name;
   uint64_t iid;
   ddsrt_atomic_uint32_t refc; /* counts refs from entities, not from data */
 
@@ -39,12 +43,14 @@ struct ddsi_sertopic {
   struct dds_topic * status_cb_entity;
 };
 
+/* Called when the refcount dropped to zero */
 typedef void (*ddsi_sertopic_deinit_t) (struct ddsi_sertopic *tp);
 
-/* Release any memory allocated by ddsi_sertopic_to_sample */
+/* Zero out a sample, used for generating samples from just a key value and in cleaning up
+   after dds_return_loan */
 typedef void (*ddsi_sertopic_zero_samples_t) (const struct ddsi_sertopic *d, void *samples, size_t count);
 
-/* Release any memory allocated by ddsi_sertopic_to_sample */
+/* (Re)allocate an array of samples, used in growing loaned sample arrays in dds_read */
 typedef void (*ddsi_sertopic_realloc_samples_t) (void **ptrs, const struct ddsi_sertopic *d, void *old, size_t oldcount, size_t count);
 
 /* Release any memory allocated by ddsi_sertopic_to_sample (also undo sertopic_alloc_sample if "op" so requests) */
@@ -86,4 +92,8 @@ DDS_EXPORT inline void ddsi_sertopic_free_sample (const struct ddsi_sertopic *tp
   ddsi_sertopic_free_samples (tp, &sample, 1, op);
 }
 
+#if defined (__cplusplus)
+}
+#endif
+
 #endif
diff --git a/src/core/ddsi/include/dds/ddsi/ddsi_ssl.h b/src/core/ddsi/include/dds/ddsi/ddsi_ssl.h
index 493289e..edddd26 100644
--- a/src/core/ddsi/include/dds/ddsi/ddsi_ssl.h
+++ b/src/core/ddsi/include/dds/ddsi/ddsi_ssl.h
@@ -20,8 +20,16 @@
 #endif
 #include <openssl/ssl.h>
 
+#if defined (__cplusplus)
+extern "C" {
+#endif
+
 struct ddsi_ssl_plugins;
 void ddsi_ssl_config_plugin (struct ddsi_ssl_plugins *plugin);
 
+#if defined (__cplusplus)
+}
+#endif
+
 #endif
 #endif
diff --git a/src/core/ddsi/include/dds/ddsi/ddsi_tcp.h b/src/core/ddsi/include/dds/ddsi/ddsi_tcp.h
index bdf28d9..380dac3 100644
--- a/src/core/ddsi/include/dds/ddsi/ddsi_tcp.h
+++ b/src/core/ddsi/include/dds/ddsi/ddsi_tcp.h
@@ -18,6 +18,10 @@
 
 #include "dds/ddsi/ddsi_ssl.h"
 
+#if defined (__cplusplus)
+extern "C" {
+#endif
+
 struct ddsi_ssl_plugins
 {
   bool (*init) (void);
@@ -31,8 +35,20 @@ struct ddsi_ssl_plugins
   SSL * (*accept) (BIO *bio, ddsrt_socket_t *sock);
 };
 
+#if defined (__cplusplus)
+}
+#endif
+
+#endif
+
+#if defined (__cplusplus)
+extern "C" {
 #endif
 
 int ddsi_tcp_init (void);
 
+#if defined (__cplusplus)
+}
+#endif
+
 #endif
diff --git a/src/core/ddsi/include/dds/ddsi/ddsi_tran.h b/src/core/ddsi/include/dds/ddsi/ddsi_tran.h
index fa10474..11b48cb 100644
--- a/src/core/ddsi/include/dds/ddsi/ddsi_tran.h
+++ b/src/core/ddsi/include/dds/ddsi/ddsi_tran.h
@@ -14,9 +14,16 @@
 
 /* DDSI Transport module */
 
-#include "dds/ddsi/q_globals.h"
+#include "dds/ddsrt/ifaddrs.h"
+#include "dds/ddsrt/atomics.h"
 #include "dds/ddsi/q_protocol.h"
 
+#if defined (__cplusplus)
+extern "C" {
+#endif
+
+struct nn_interface;
+
 /* Types supporting handles */
 
 #define DDSI_TRAN_CONN 1
@@ -69,7 +76,7 @@ enum ddsi_nearby_address_result {
   DNAR_SAME
 };
 
-typedef enum ddsi_nearby_address_result (*ddsi_is_nearby_address_fn_t) (ddsi_tran_factory_t tran, const nn_locator_t *loc, size_t ninterf, const struct nn_interface interf[]);
+typedef enum ddsi_nearby_address_result (*ddsi_is_nearby_address_fn_t) (ddsi_tran_factory_t tran, const nn_locator_t *loc, size_t ninterf, const struct nn_interface *interf);
 
 enum ddsi_locator_from_string_result {
   AFSR_OK,      /* conversion succeeded */
@@ -239,7 +246,7 @@ void ddsi_conn_transfer_group_membership (ddsi_tran_conn_t conn, ddsi_tran_conn_
 int ddsi_conn_rejoin_transferred_mcgroups (ddsi_tran_conn_t conn);
 int ddsi_is_mcaddr (const nn_locator_t *loc);
 int ddsi_is_ssm_mcaddr (const nn_locator_t *loc);
-enum ddsi_nearby_address_result ddsi_is_nearby_address (const nn_locator_t *loc, size_t ninterf, const struct nn_interface interf[]);
+enum ddsi_nearby_address_result ddsi_is_nearby_address (const nn_locator_t *loc, size_t ninterf, const struct nn_interface *interf);
 
 enum ddsi_locator_from_string_result ddsi_locator_from_string (nn_locator_t *loc, const char *str);
 
@@ -271,4 +278,8 @@ inline ddsi_tran_conn_t ddsi_listener_accept (ddsi_tran_listener_t listener) {
 void ddsi_listener_unblock (ddsi_tran_listener_t listener);
 void ddsi_listener_free (ddsi_tran_listener_t listener);
 
+#if defined (__cplusplus)
+}
+#endif
+
 #endif
diff --git a/src/core/ddsi/include/dds/ddsi/ddsi_udp.h b/src/core/ddsi/include/dds/ddsi/ddsi_udp.h
index 4dece96..1305dab 100644
--- a/src/core/ddsi/include/dds/ddsi/ddsi_udp.h
+++ b/src/core/ddsi/include/dds/ddsi/ddsi_udp.h
@@ -12,6 +12,14 @@
 #ifndef _DDSI_UDP_H_
 #define _DDSI_UDP_H_
 
+#if defined (__cplusplus)
+extern "C" {
+#endif
+
 int ddsi_udp_init (void);
 
+#if defined (__cplusplus)
+}
+#endif
+
 #endif
diff --git a/src/core/ddsi/include/dds/ddsi/q_bitset.h b/src/core/ddsi/include/dds/ddsi/q_bitset.h
index ec81027..630d16a 100644
--- a/src/core/ddsi/include/dds/ddsi/q_bitset.h
+++ b/src/core/ddsi/include/dds/ddsi/q_bitset.h
@@ -18,6 +18,10 @@
 
 #include "dds/ddsi/q_unused.h"
 
+#if defined (__cplusplus)
+extern "C" {
+#endif
+
 inline int nn_bitset_isset (uint32_t numbits, const uint32_t *bits, uint32_t idx)
 {
   return idx < numbits && (bits[idx/32] & (UINT32_C(1) << (31 - (idx%32))));
@@ -52,4 +56,8 @@ inline void nn_bitset_one (uint32_t numbits, uint32_t *bits)
   }
 }
 
+#if defined (__cplusplus)
+}
+#endif
+
 #endif /* NN_BITSET_H */
diff --git a/src/core/ddsi/include/dds/ddsi/q_bswap.h b/src/core/ddsi/include/dds/ddsi/q_bswap.h
index 7478f87..6f8cbff 100644
--- a/src/core/ddsi/include/dds/ddsi/q_bswap.h
+++ b/src/core/ddsi/include/dds/ddsi/q_bswap.h
@@ -19,6 +19,10 @@
 #include "dds/ddsi/q_rtps.h" /* for nn_guid_t, nn_guid_prefix_t */
 #include "dds/ddsi/q_protocol.h" /* for nn_sequence_number_t */
 
+#if defined (__cplusplus)
+extern "C" {
+#endif
+
 inline uint16_t bswap2u (uint16_t x)
 {
   return (uint16_t) ((x >> 8) | (x << 8));
@@ -84,10 +88,6 @@ inline void bswapSN (nn_sequence_number_t *sn)
 #define fromBE8u(x) (x)
 #endif
 
-#if defined (__cplusplus)
-extern "C" {
-#endif
-
 nn_guid_prefix_t nn_hton_guid_prefix (nn_guid_prefix_t p);
 nn_guid_prefix_t nn_ntoh_guid_prefix (nn_guid_prefix_t p);
 nn_entityid_t nn_hton_entityid (nn_entityid_t e);
diff --git a/src/core/ddsi/include/dds/ddsi/q_debmon.h b/src/core/ddsi/include/dds/ddsi/q_debmon.h
index d6e4c1c..77348c2 100644
--- a/src/core/ddsi/include/dds/ddsi/q_debmon.h
+++ b/src/core/ddsi/include/dds/ddsi/q_debmon.h
@@ -12,6 +12,10 @@
 #ifndef Q_DEBMON_H
 #define Q_DEBMON_H
 
+#if defined (__cplusplus)
+extern "C" {
+#endif
+
 struct debug_monitor;
 typedef int (*debug_monitor_cpf_t) (ddsi_tran_conn_t conn, const char *fmt, ...);
 typedef int (*debug_monitor_plugin_t) (ddsi_tran_conn_t conn, debug_monitor_cpf_t cpf, void *arg);
@@ -20,4 +24,8 @@ struct debug_monitor *new_debug_monitor (int port);
 void add_debug_monitor_plugin (struct debug_monitor *dm, debug_monitor_plugin_t fn, void *arg);
 void free_debug_monitor (struct debug_monitor *dm);
 
-#endif /* defined(__ospli_osplo__q_debmon__) */
+#if defined (__cplusplus)
+}
+#endif
+
+#endif
diff --git a/src/core/ddsi/include/dds/ddsi/q_entity.h b/src/core/ddsi/include/dds/ddsi/q_entity.h
index f6f1f8e..f606786 100644
--- a/src/core/ddsi/include/dds/ddsi/q_entity.h
+++ b/src/core/ddsi/include/dds/ddsi/q_entity.h
@@ -14,6 +14,7 @@
 
 #include "dds/ddsrt/atomics.h"
 #include "dds/ddsrt/avl.h"
+#include "dds/ddsrt/sync.h"
 #include "dds/ddsi/q_rtps.h"
 #include "dds/ddsi/q_protocol.h"
 #include "dds/ddsi/q_lat_estim.h"
@@ -32,11 +33,14 @@ struct xevent;
 struct nn_reorder;
 struct nn_defrag;
 struct nn_dqueue;
+struct nn_rsample_info;
+struct nn_rdata;
 struct addrset;
 struct ddsi_sertopic;
 struct whc;
 struct nn_xqos;
 struct nn_plist;
+struct lease;
 
 struct proxy_group;
 struct proxy_endpoint_common;
@@ -159,7 +163,7 @@ struct participant
   unsigned bes; /* built-in endpoint set */
   unsigned prismtech_bes; /* prismtech-specific extension of built-in endpoints set */
   unsigned is_ddsi2_pp: 1; /* true for the "federation leader", the ddsi2 participant itself in OSPL; FIXME: probably should use this for broker mode as well ... */
-  nn_plist_t *plist; /* settings/QoS for this participant */
+  struct nn_plist *plist; /* settings/QoS for this participant */
   struct xevent *spdp_xevent; /* timed event for periodically publishing SPDP */
   struct xevent *pmd_update_xevent; /* timed event for periodically publishing ParticipantMessageData */
   nn_locator_t m_locator;
@@ -294,7 +298,7 @@ struct proxy_participant
   unsigned bes; /* built-in endpoint set */
   unsigned prismtech_bes; /* prismtech-specific extension of built-in endpoints set */
   nn_guid_t privileged_pp_guid; /* if this PP depends on another PP for its SEDP writing */
-  nn_plist_t *plist; /* settings/QoS for this participant */
+  struct nn_plist *plist; /* settings/QoS for this participant */
   ddsrt_atomic_voidp_t lease; /* lease object for this participant, for automatic leases */
   struct addrset *as_default; /* default address set to use for user data traffic */
   struct addrset *as_meta; /* default address set to use for discovery traffic */
diff --git a/src/core/ddsi/include/dds/ddsi/q_freelist.h b/src/core/ddsi/include/dds/ddsi/q_freelist.h
index 8e40ff7..8fcafa7 100644
--- a/src/core/ddsi/include/dds/ddsi/q_freelist.h
+++ b/src/core/ddsi/include/dds/ddsi/q_freelist.h
@@ -15,6 +15,10 @@
 #include "dds/ddsrt/atomics.h"
 #include "dds/ddsrt/sync.h"
 
+#if defined (__cplusplus)
+extern "C" {
+#endif
+
 #define FREELIST_SIMPLE 1
 #define FREELIST_ATOMIC_LIFO 2
 #define FREELIST_DOUBLE 3
@@ -74,4 +78,8 @@ bool nn_freelist_push (struct nn_freelist *fl, void *elem);
 void *nn_freelist_pushmany (struct nn_freelist *fl, void *first, void *last, uint32_t n);
 void *nn_freelist_pop (struct nn_freelist *fl);
 
+#if defined (__cplusplus)
+}
+#endif
+
 #endif /* NN_FREELIST_H */
diff --git a/src/core/ddsi/include/dds/ddsi/q_init.h b/src/core/ddsi/include/dds/ddsi/q_init.h
index c9794f0..a1f9cef 100644
--- a/src/core/ddsi/include/dds/ddsi/q_init.h
+++ b/src/core/ddsi/include/dds/ddsi/q_init.h
@@ -12,7 +12,15 @@
 #ifndef Q_INIT_H
 #define Q_INIT_H
 
+#if defined (__cplusplus)
+extern "C" {
+#endif
+
 int create_multicast_sockets(void);
 int joinleave_spdp_defmcip (int dojoin);
 
+#if defined (__cplusplus)
+}
+#endif
+
 #endif
diff --git a/src/core/ddsi/include/dds/ddsi/q_inverse_uint32_set.h b/src/core/ddsi/include/dds/ddsi/q_inverse_uint32_set.h
index d48cf96..cd93009 100644
--- a/src/core/ddsi/include/dds/ddsi/q_inverse_uint32_set.h
+++ b/src/core/ddsi/include/dds/ddsi/q_inverse_uint32_set.h
@@ -14,6 +14,10 @@
 
 #include "dds/ddsrt/avl.h"
 
+#if defined (__cplusplus)
+extern "C" {
+#endif
+
 struct inverse_uint32_set_node {
   ddsrt_avl_node_t avlnode;
   uint32_t min, max;
@@ -29,4 +33,8 @@ void inverse_uint32_set_fini(struct inverse_uint32_set *set);
 int inverse_uint32_set_alloc(uint32_t * const id, struct inverse_uint32_set *set);
 void inverse_uint32_set_free(struct inverse_uint32_set *set, uint32_t id);
 
+#if defined (__cplusplus)
+}
+#endif
+
 #endif
diff --git a/src/core/ddsi/include/dds/ddsi/q_radmin.h b/src/core/ddsi/include/dds/ddsi/q_radmin.h
index e61c029..95df0a7 100644
--- a/src/core/ddsi/include/dds/ddsi/q_radmin.h
+++ b/src/core/ddsi/include/dds/ddsi/q_radmin.h
@@ -14,7 +14,6 @@
 
 #include "dds/ddsrt/atomics.h"
 #include "dds/ddsrt/threads.h"
-#include "dds/ddsi/q_rtps.h"
 #include "dds/ddsi/ddsi_tran.h"
 
 #if defined (__cplusplus)
diff --git a/src/core/ddsi/include/dds/ddsi/q_xmsg.h b/src/core/ddsi/include/dds/ddsi/q_xmsg.h
index 9236c44..ef634a9 100644
--- a/src/core/ddsi/include/dds/ddsi/q_xmsg.h
+++ b/src/core/ddsi/include/dds/ddsi/q_xmsg.h
@@ -29,6 +29,7 @@ struct proxy_writer;
 
 struct nn_prismtech_participant_version_info;
 struct nn_prismtech_writer_info;
+struct nn_prismtech_eotinfo;
 struct nn_xmsgpool;
 struct nn_xmsg_data;
 struct nn_xmsg;
diff --git a/src/core/ddsi/src/ddsi_eth.h b/src/core/ddsi/src/ddsi_eth.h
index 60d17b7..472d3e7 100644
--- a/src/core/ddsi/src/ddsi_eth.h
+++ b/src/core/ddsi/src/ddsi_eth.h
@@ -14,6 +14,14 @@
 
 #include "dds/ddsi/ddsi_tran.h"
 
+#if defined (__cplusplus)
+extern "C" {
+#endif
+
 int ddsi_eth_enumerate_interfaces(ddsi_tran_factory_t fact, ddsrt_ifaddrs_t **ifs);
 
+#if defined (__cplusplus)
+}
+#endif
+
 #endif /* DDSI_ETH_H */
diff --git a/src/core/ddsi/src/ddsi_ipaddr.c b/src/core/ddsi/src/ddsi_ipaddr.c
index c124b89..88b00c5 100644
--- a/src/core/ddsi/src/ddsi_ipaddr.c
+++ b/src/core/ddsi/src/ddsi_ipaddr.c
@@ -18,6 +18,7 @@
 #include "dds/ddsi/ddsi_ipaddr.h"
 #include "dds/ddsi/q_nwif.h"
 #include "dds/ddsi/q_config.h"
+#include "dds/ddsi/q_globals.h"
 
 int ddsi_ipaddr_compare (const struct sockaddr *const sa1, const struct sockaddr *const sa2)
 {
diff --git a/src/core/ddsi/src/ddsi_mcgroup.c b/src/core/ddsi/src/ddsi_mcgroup.c
index 51ca755..4fc2eb1 100644
--- a/src/core/ddsi/src/ddsi_mcgroup.c
+++ b/src/core/ddsi/src/ddsi_mcgroup.c
@@ -20,6 +20,7 @@
 #include "dds/ddsi/ddsi_mcgroup.h"
 #include "dds/ddsi/q_config.h"
 #include "dds/ddsi/q_log.h"
+#include "dds/ddsi/q_globals.h"
 #include "dds/ddsrt/avl.h"
 
 struct nn_group_membership_node {
diff --git a/src/core/ddsi/src/ddsi_raweth.c b/src/core/ddsi/src/ddsi_raweth.c
index be789b9..98cb1d5 100644
--- a/src/core/ddsi/src/ddsi_raweth.c
+++ b/src/core/ddsi/src/ddsi_raweth.c
@@ -18,6 +18,7 @@
 #include "dds/ddsi/q_log.h"
 #include "dds/ddsi/q_error.h"
 #include "dds/ddsi/q_pcap.h"
+#include "dds/ddsi/q_globals.h"
 #include "dds/ddsrt/atomics.h"
 #include "dds/ddsrt/heap.h"
 #include "dds/ddsrt/log.h"
diff --git a/src/core/ddsi/src/ddsi_serdata_default.c b/src/core/ddsi/src/ddsi_serdata_default.c
index c7c2cf9..03e340e 100644
--- a/src/core/ddsi/src/ddsi_serdata_default.c
+++ b/src/core/ddsi/src/ddsi_serdata_default.c
@@ -24,6 +24,7 @@
 #include "dds/ddsi/ddsi_tkmap.h"
 #include "dds__stream.h"
 #include "dds/ddsi/q_radmin.h"
+#include "dds/ddsi/q_globals.h"
 #include "dds/ddsi/ddsi_serdata_default.h"
 
 #define MAX_POOL_SIZE 16384
diff --git a/src/core/ddsi/src/ddsi_sertopic.c b/src/core/ddsi/src/ddsi_sertopic.c
index c4971b2..a309289 100644
--- a/src/core/ddsi/src/ddsi_sertopic.c
+++ b/src/core/ddsi/src/ddsi_sertopic.c
@@ -37,9 +37,9 @@ void ddsi_sertopic_unref (struct ddsi_sertopic *sertopic)
     if (ddsrt_atomic_dec32_ov (&sertopic->refc) == 1)
     {
       ddsi_sertopic_deinit (sertopic);
-      ddsrt_free (sertopic->name_typename);
+      ddsrt_free (sertopic->name_type_name);
       ddsrt_free (sertopic->name);
-      ddsrt_free (sertopic->typename);
+      ddsrt_free (sertopic->type_name);
       ddsrt_free (sertopic);
     }
   }
diff --git a/src/core/ddsi/src/ddsi_tcp.c b/src/core/ddsi/src/ddsi_tcp.c
index 0adbd73..2a48e78 100644
--- a/src/core/ddsi/src/ddsi_tcp.c
+++ b/src/core/ddsi/src/ddsi_tcp.c
@@ -25,6 +25,7 @@
 #include "dds/ddsi/q_config.h"
 #include "dds/ddsi/q_log.h"
 #include "dds/ddsi/q_entity.h"
+#include "dds/ddsi/q_globals.h"
 
 #define INVALID_PORT (~0u)
 
diff --git a/src/core/ddsi/src/ddsi_tran.c b/src/core/ddsi/src/ddsi_tran.c
index 1d07228..c1ef648 100644
--- a/src/core/ddsi/src/ddsi_tran.c
+++ b/src/core/ddsi/src/ddsi_tran.c
@@ -19,6 +19,7 @@
 #include "dds/ddsi/ddsi_tran.h"
 #include "dds/ddsi/q_config.h"
 #include "dds/ddsi/q_log.h"
+#include "dds/ddsi/q_globals.h"
 
 static ddsi_tran_factory_t ddsi_tran_factories = NULL;
 
diff --git a/src/core/ddsi/src/ddsi_udp.c b/src/core/ddsi/src/ddsi_udp.c
index 0ab4489..628c7e0 100644
--- a/src/core/ddsi/src/ddsi_udp.c
+++ b/src/core/ddsi/src/ddsi_udp.c
@@ -25,6 +25,7 @@
 #include "dds/ddsi/q_config.h"
 #include "dds/ddsi/q_log.h"
 #include "dds/ddsi/q_pcap.h"
+#include "dds/ddsi/q_globals.h"
 
 extern void ddsi_factory_conn_init (ddsi_tran_factory_t factory, ddsi_tran_conn_t conn);
 
diff --git a/src/core/ddsi/src/q_debmon.c b/src/core/ddsi/src/q_debmon.c
index 2e5358a..35ed218 100644
--- a/src/core/ddsi/src/q_debmon.c
+++ b/src/core/ddsi/src/q_debmon.c
@@ -121,7 +121,7 @@ static int print_any_endpoint_common (ddsi_tran_conn_t conn, const char *label,
     if (xqos->partition.n > 1) cpf (conn, "}");
     x += cpf (conn, ".%s/%s",
               topic && topic->name ? topic->name : (xqos->present & QP_TOPIC_NAME) ? xqos->topic_name : "(null)",
-              topic && topic->typename ? topic->typename : (xqos->present & QP_TYPE_NAME) ? xqos->type_name : "(null)");
+              topic && topic->type_name ? topic->type_name : (xqos->present & QP_TYPE_NAME) ? xqos->type_name : "(null)");
   }
   cpf (conn, "\n");
   return x;
diff --git a/src/core/ddsi/src/q_entity.c b/src/core/ddsi/src/q_entity.c
index 25ef9ea..31437b0 100644
--- a/src/core/ddsi/src/q_entity.c
+++ b/src/core/ddsi/src/q_entity.c
@@ -2383,7 +2383,7 @@ static void new_reader_writer_common (const struct nn_guid *guid, const struct d
           PGUID (*guid),
           partition, partition_suffix,
           topic ? topic->name : "(null)",
-          topic ? topic->typename : "(null)");
+          topic ? topic->type_name : "(null)");
 }
 
 static void endpoint_common_init (struct entity_common *e, struct endpoint_common *c, enum entity_kind kind, const struct nn_guid *guid, const struct nn_guid *group_guid, struct participant *pp)
@@ -2415,7 +2415,7 @@ static int set_topic_type_name (nn_xqos_t *xqos, const struct ddsi_sertopic * to
   if (!(xqos->present & QP_TYPE_NAME) && topic)
   {
     xqos->present |= QP_TYPE_NAME;
-    xqos->type_name = ddsrt_strdup (topic->typename);
+    xqos->type_name = ddsrt_strdup (topic->type_name);
   }
   if (!(xqos->present & QP_TOPIC_NAME) && topic)
   {
@@ -2881,7 +2881,7 @@ struct local_orphan_writer *new_local_orphan_writer (nn_entityid_t entityid, str
   struct writer *wr;
   nn_mtime_t tnow = now_mt ();
 
-  DDS_LOG(DDS_LC_DISCOVERY, "new_local_orphan_writer(%s/%s)\n", topic->name, topic->typename);
+  DDS_LOG(DDS_LC_DISCOVERY, "new_local_orphan_writer(%s/%s)\n", topic->name, topic->type_name);
   lowr = ddsrt_malloc (sizeof (*lowr));
   wr = &lowr->wr;
 
diff --git a/src/core/ddsi/src/q_plist.c b/src/core/ddsi/src/q_plist.c
index d44cec1..c02a63d 100644
--- a/src/core/ddsi/src/q_plist.c
+++ b/src/core/ddsi/src/q_plist.c
@@ -28,6 +28,7 @@
 #include "dds/ddsi/q_xmsg.h"
 
 #include "dds/ddsi/q_config.h"
+#include "dds/ddsi/q_globals.h"
 #include "dds/ddsi/q_protocol.h" /* for NN_STATUSINFO_... */
 #include "dds/ddsi/q_radmin.h" /* for nn_plist_quickscan */
 #include "dds/ddsi/q_static_assert.h"
diff --git a/src/core/ddsi/src/q_receive.c b/src/core/ddsi/src/q_receive.c
index 520c334..4ae45ce 100644
--- a/src/core/ddsi/src/q_receive.c
+++ b/src/core/ddsi/src/q_receive.c
@@ -1885,7 +1885,7 @@ static struct ddsi_serdata *extract_sample_from_data
       "data(application, vendor %u.%u): %x:%x:%x:%x #%"PRId64": deserialization %s/%s failed (%s)\n",
       sampleinfo->rst->vendor.id[0], sampleinfo->rst->vendor.id[1],
       PGUID (guid), sampleinfo->seq,
-      topic->name, topic->typename,
+      topic->name, topic->type_name,
       failmsg ? failmsg : "for reasons unknown"
     );
   }
@@ -2388,7 +2388,7 @@ static void drop_oversize (struct receiver_state *rst, struct nn_rmsg *rmsg, con
     if (gap_was_valuable)
     {
       const char *tname = pwr->c.topic ? pwr->c.topic->name : "(null)";
-      const char *ttname = pwr->c.topic ? pwr->c.topic->typename : "(null)";
+      const char *ttname = pwr->c.topic ? pwr->c.topic->type_name : "(null)";
       DDS_WARNING ("dropping oversize (%u > %u) sample %"PRId64" from remote writer %x:%x:%x:%x %s/%s\n",
                    sampleinfo->size, config.max_sample_size, sampleinfo->seq,
                    PGUIDPREFIX (rst->src_guid_prefix), msg->writerId.u,
diff --git a/src/core/ddsi/src/q_transmit.c b/src/core/ddsi/src/q_transmit.c
index 4d67295..c83c008 100644
--- a/src/core/ddsi/src/q_transmit.c
+++ b/src/core/ddsi/src/q_transmit.c
@@ -868,7 +868,7 @@ static int insert_sample_in_whc (struct writer *wr, seqno_t seq, struct nn_plist
     char ppbuf[1024];
     int tmp;
     const char *tname = wr->topic ? wr->topic->name : "(null)";
-    const char *ttname = wr->topic ? wr->topic->typename : "(null)";
+    const char *ttname = wr->topic ? wr->topic->type_name : "(null)";
     ppbuf[0] = '\0';
     tmp = sizeof (ppbuf) - 1;
     DDS_TRACE("write_sample %x:%x:%x:%x #%"PRId64"", PGUID (wr->e.guid), seq);
@@ -1043,7 +1043,7 @@ static int write_sample_eot (struct thread_state1 * const ts1, struct nn_xpack *
     char ppbuf[1024];
     int tmp;
     const char *tname = wr->topic ? wr->topic->name : "(null)";
-    const char *ttname = wr->topic ? wr->topic->typename : "(null)";
+    const char *ttname = wr->topic ? wr->topic->type_name : "(null)";
     ppbuf[0] = '\0';
     tmp = sizeof (ppbuf) - 1;
     DDS_WARNING ("dropping oversize (%u > %u) sample from local writer %x:%x:%x:%x %s/%s:%s%s\n",
diff --git a/src/ddsrt/include/dds/ddsrt/atomics/arm.h b/src/ddsrt/include/dds/ddsrt/atomics/arm.h
index e0b0d1c..863e483 100644
--- a/src/ddsrt/include/dds/ddsrt/atomics/arm.h
+++ b/src/ddsrt/include/dds/ddsrt/atomics/arm.h
@@ -12,6 +12,10 @@
 #ifndef DDSRT_ATOMICS_ARM_H
 #define DDSRT_ATOMICS_ARM_H
 
+#if defined (__cplusplus)
+extern "C" {
+#endif
+
 #if !defined(__arm__)
 #define __arm__
 #endif
@@ -209,5 +213,8 @@ inline void ddsrt_atomic_fence_rel (void) {
     ddsrt_atomic_fence ();
 }
 
-#endif /* DDSRT_ATOMICS_ARM_H */
+#if defined (__cplusplus)
+}
+#endif
 
+#endif /* DDSRT_ATOMICS_ARM_H */
diff --git a/src/ddsrt/include/dds/ddsrt/atomics/gcc.h b/src/ddsrt/include/dds/ddsrt/atomics/gcc.h
index 0c62272..4da5f29 100644
--- a/src/ddsrt/include/dds/ddsrt/atomics/gcc.h
+++ b/src/ddsrt/include/dds/ddsrt/atomics/gcc.h
@@ -14,6 +14,10 @@
 
 #include "dds/ddsrt/misc.h"
 
+#if defined (__cplusplus)
+extern "C" {
+#endif
+
 #if ( DDSRT_HAVE_ATOMIC64 && __GCC_HAVE_SYNC_COMPARE_AND_SWAP_16) || \
     (!DDSRT_HAVE_ATOMIC64 && __GCC_HAVE_SYNC_COMPARE_AND_SWAP_8)
 # define DDSRT_HAVE_ATOMIC_LIFO 1
@@ -287,5 +291,8 @@ inline void ddsrt_atomic_fence_rel (void) {
   ddsrt_atomic_fence ();
 }
 
-#endif /* DDSRT_ATOMICS_GCC_H */
+#if defined (__cplusplus)
+}
+#endif
 
+#endif /* DDSRT_ATOMICS_GCC_H */
diff --git a/src/ddsrt/include/dds/ddsrt/atomics/msvc.h b/src/ddsrt/include/dds/ddsrt/atomics/msvc.h
index 01260aa..e4418e1 100644
--- a/src/ddsrt/include/dds/ddsrt/atomics/msvc.h
+++ b/src/ddsrt/include/dds/ddsrt/atomics/msvc.h
@@ -14,6 +14,10 @@
 
 #include "dds/ddsrt/misc.h"
 
+#if defined (__cplusplus)
+extern "C" {
+#endif
+
 /* x86 has supported 64-bit CAS for a long time, so Windows ought to
    provide all the interlocked operations for 64-bit operands on x86
    platforms, but it doesn't. */
@@ -295,5 +299,8 @@ inline void ddsrt_atomic_fence_rel (void) {
 
 #undef DDSRT_ATOMIC_PTROP
 
-#endif /* DDSRT_ATOMICS_MSVC_H */
+#if defined (__cplusplus)
+}
+#endif
 
+#endif /* DDSRT_ATOMICS_MSVC_H */
diff --git a/src/ddsrt/include/dds/ddsrt/atomics/sun.h b/src/ddsrt/include/dds/ddsrt/atomics/sun.h
index bd364d4..74a7469 100644
--- a/src/ddsrt/include/dds/ddsrt/atomics/sun.h
+++ b/src/ddsrt/include/dds/ddsrt/atomics/sun.h
@@ -11,6 +11,10 @@
  */
 #include <atomic.h>
 
+#if defined (__cplusplus)
+extern "C" {
+#endif
+
 #define DDSRT_ATOMIC64_SUPPORT 1
 
 /* LD, ST */
@@ -239,3 +243,6 @@ inline void ddsrt_atomic_fence_rel (void) {
   membar_exit ();
 }
 
+#if defined (__cplusplus)
+}
+#endif
diff --git a/src/ddsrt/include/dds/ddsrt/cdtors.h b/src/ddsrt/include/dds/ddsrt/cdtors.h
index 0b3e733..89e8cdb 100644
--- a/src/ddsrt/include/dds/ddsrt/cdtors.h
+++ b/src/ddsrt/include/dds/ddsrt/cdtors.h
@@ -15,10 +15,18 @@
 #include "dds/export.h"
 #include "dds/ddsrt/sync.h"
 
+#if defined (__cplusplus)
+extern "C" {
+#endif
+
 DDS_EXPORT void ddsrt_init(void);
 
 DDS_EXPORT void ddsrt_fini(void);
 
 DDS_EXPORT ddsrt_mutex_t *ddsrt_get_singleton_mutex(void);
 
+#if defined (__cplusplus)
+}
+#endif
+
 #endif /* DDSRT_CDTORS_H */
diff --git a/src/ddsrt/include/dds/ddsrt/md5.h b/src/ddsrt/include/dds/ddsrt/md5.h
index 4777d04..5d0f167 100644
--- a/src/ddsrt/include/dds/ddsrt/md5.h
+++ b/src/ddsrt/include/dds/ddsrt/md5.h
@@ -63,6 +63,7 @@
 #define DDSRT_MD5_H
 
 #include <stddef.h>
+#include "dds/export.h"
 
 /*
  * This package supports both compile-time and run-time determination of CPU
@@ -90,13 +91,13 @@ extern "C"
 #endif
 
 /* Initialize the algorithm. */
-void ddsrt_md5_init(ddsrt_md5_state_t *pms);
+DDS_EXPORT void ddsrt_md5_init(ddsrt_md5_state_t *pms);
 
 /* Append a string to the message. */
-void ddsrt_md5_append(ddsrt_md5_state_t *pms, const ddsrt_md5_byte_t *data, unsigned nbytes);
+DDS_EXPORT void ddsrt_md5_append(ddsrt_md5_state_t *pms, const ddsrt_md5_byte_t *data, unsigned nbytes);
 
 /* Finish the message and return the digest. */
-void ddsrt_md5_finish(ddsrt_md5_state_t *pms, ddsrt_md5_byte_t digest[16]);
+DDS_EXPORT void ddsrt_md5_finish(ddsrt_md5_state_t *pms, ddsrt_md5_byte_t digest[16]);
 
 #ifdef __cplusplus
 }  /* end extern "C" */
diff --git a/src/ddsrt/include/dds/ddsrt/retcode.h b/src/ddsrt/include/dds/ddsrt/retcode.h
index 8651e22..f57626d 100644
--- a/src/ddsrt/include/dds/ddsrt/retcode.h
+++ b/src/ddsrt/include/dds/ddsrt/retcode.h
@@ -5,6 +5,10 @@
 
 #include "dds/export.h"
 
+#if defined (__cplusplus)
+extern "C" {
+#endif
+
 typedef int32_t dds_retcode_t;
 
 /*
@@ -86,4 +90,8 @@ typedef int32_t dds_retcode_t;
  */
 DDS_EXPORT const char *dds_strretcode(dds_retcode_t ret);
 
+#if defined (__cplusplus)
+}
+#endif
+
 #endif /* DDS_RETCODE_H */
diff --git a/src/ddsrt/include/dds/ddsrt/rusage.h b/src/ddsrt/include/dds/ddsrt/rusage.h
index 2147876..040ce2e 100644
--- a/src/ddsrt/include/dds/ddsrt/rusage.h
+++ b/src/ddsrt/include/dds/ddsrt/rusage.h
@@ -17,6 +17,10 @@
 #include "dds/ddsrt/time.h"
 #include "dds/ddsrt/retcode.h"
 
+#if defined (__cplusplus)
+extern "C" {
+#endif
+
 typedef struct {
   dds_time_t utime; /* User CPU time used. */
   dds_time_t stime; /* System CPU time used. */
@@ -47,4 +51,8 @@ typedef struct {
  */
 DDS_EXPORT dds_retcode_t ddsrt_getrusage(int who, ddsrt_rusage_t *usage);
 
+#if defined (__cplusplus)
+}
+#endif
+
 #endif /* DDSRT_RUSAGE_H */
diff --git a/src/ddsrt/include/dds/ddsrt/sockets.h b/src/ddsrt/include/dds/ddsrt/sockets.h
index 645af42..ec5efa3 100644
--- a/src/ddsrt/include/dds/ddsrt/sockets.h
+++ b/src/ddsrt/include/dds/ddsrt/sockets.h
@@ -14,6 +14,10 @@
 #include "dds/ddsrt/sockets/posix.h"
 #endif
 
+#if defined (__cplusplus)
+extern "C" {
+#endif
+
 #define INET_ADDRSTRLEN_EXTENDED (INET_ADDRSTRLEN + 6) /* ":12345" */
 
 #if DDSRT_HAVE_IPV6
@@ -261,4 +265,8 @@ ddsrt_gethostbyname(
   ddsrt_hostent_t **hentp);
 #endif
 
+#if defined (__cplusplus)
+}
+#endif
+
 #endif /* DDSRT_SOCKETS_H */
diff --git a/src/ddsrt/include/dds/ddsrt/strtod.h b/src/ddsrt/include/dds/ddsrt/strtod.h
index 739ee94..f8bb511 100644
--- a/src/ddsrt/include/dds/ddsrt/strtod.h
+++ b/src/ddsrt/include/dds/ddsrt/strtod.h
@@ -22,6 +22,10 @@
 #include "dds/export.h"
 #include "dds/ddsrt/retcode.h"
 
+#if defined (__cplusplus)
+extern "C" {
+#endif
+
 /**
  * @brief Convert a string to a double precision floating point number.
  *
@@ -72,4 +76,8 @@ ddsrt_dtostr(double src, char *str, size_t size);
 DDS_EXPORT int
 ddsrt_ftostr(float src, char *str, size_t size);
 
+#if defined (__cplusplus)
+}
+#endif
+
 #endif /* DDSRT_STRTOD_H */

From 02aaadbd20a1b29113e9fc597238e8219cd5a946 Mon Sep 17 00:00:00 2001
From: YuSheng <hello@cwyark.me>
Date: Tue, 30 Apr 2019 01:09:40 +0800
Subject: [PATCH 051/238] add RPATH for compiled tools to find the libddsc.so
 (#153)

* add RPATH for compiled tools to find the libddsc.so

Signed-off-by: YuSheng <hello@cwyark.me>
---
 src/CMakeLists.txt              | 5 +++++
 src/tools/pubsub/CMakeLists.txt | 1 +
 2 files changed, 6 insertions(+)

diff --git a/src/CMakeLists.txt b/src/CMakeLists.txt
index e56d494..d1539dd 100644
--- a/src/CMakeLists.txt
+++ b/src/CMakeLists.txt
@@ -154,6 +154,11 @@ endif()
 
 include(GNUInstallDirs)
 include(AnalyzeBuild)
+if(APPLE)
+  set(CMAKE_INSTALL_RPATH "@loader_path/../${CMAKE_INSTALL_LIBDIR}")
+else()
+  set(CMAKE_INSTALL_RPATH "$ORIGIN/../${CMAKE_INSTALL_LIBDIR}")
+endif()
 # Include Coverage before CTest so that COVERAGE_COMMAND can be modified
 # in the Coverage module should that ever be necessary.
 include(Coverage)
diff --git a/src/tools/pubsub/CMakeLists.txt b/src/tools/pubsub/CMakeLists.txt
index f7244c7..62a9494 100644
--- a/src/tools/pubsub/CMakeLists.txt
+++ b/src/tools/pubsub/CMakeLists.txt
@@ -11,6 +11,7 @@
 #
 add_executable(pubsub pubsub.c common.c testtype.c porting.c)
 target_link_libraries(pubsub ddsc)
+
 if(WIN32)
   target_compile_definitions(pubsub PRIVATE _CRT_SECURE_NO_WARNINGS)
 endif()

From dc7b64396b3714258aae884eb733bcf3f5dcfebb Mon Sep 17 00:00:00 2001
From: Jeroen Koekkoek <jeroen@koekkoek.nl>
Date: Mon, 29 Apr 2019 15:57:14 +0200
Subject: [PATCH 052/238] Fix warnings related to fixed type integers

Signed-off-by: Jeroen Koekkoek <jeroen@koekkoek.nl>
---
 src/core/ddsc/src/dds_init.c            |   6 +-
 src/core/ddsc/src/dds_qos.c             |   2 +-
 src/core/ddsc/src/dds_rhc.c             |  26 ++--
 src/core/ddsc/src/dds_write.c           |   4 +-
 src/core/ddsi/include/dds/ddsi/q_rtps.h |   1 +
 src/core/ddsi/src/ddsi_tcp.c            |  18 +--
 src/core/ddsi/src/ddsi_threadmon.c      |   2 +-
 src/core/ddsi/src/ddsi_udp.c            |  14 +--
 src/core/ddsi/src/q_ddsi_discovery.c    |  72 +++++------
 src/core/ddsi/src/q_entity.c            | 154 ++++++++++++------------
 src/core/ddsi/src/q_init.c              |  16 +--
 src/core/ddsi/src/q_lease.c             |  16 +--
 src/core/ddsi/src/q_nwif.c              |   6 +-
 src/core/ddsi/src/q_plist.c             |  44 +++----
 src/core/ddsi/src/q_radmin.c            |  32 ++---
 src/core/ddsi/src/q_receive.c           | 120 +++++++++---------
 src/core/ddsi/src/q_sockwaitset.c       |   2 +-
 src/core/ddsi/src/q_thread.c            |   2 +-
 src/core/ddsi/src/q_transmit.c          |  20 +--
 src/core/ddsi/src/q_xevent.c            |  38 +++---
 src/core/ddsi/src/q_xmsg.c              |  16 +--
 src/tools/ddsperf/ddsperf.c             |   4 +-
 22 files changed, 308 insertions(+), 307 deletions(-)

diff --git a/src/core/ddsc/src/dds_init.c b/src/core/ddsc/src/dds_init.c
index 9e74180..9db9187 100644
--- a/src/core/ddsc/src/dds_init.c
+++ b/src/core/ddsc/src/dds_init.c
@@ -96,7 +96,7 @@ dds_init(dds_domainid_t domain)
   {
     if (domain < 0 || domain > 230)
     {
-      DDS_ERROR("requested domain id %d is out of range\n", domain);
+      DDS_ERROR("requested domain id %"PRId32" is out of range\n", domain);
       ret = DDS_ERRNO(DDS_RETCODE_ERROR);
       goto fail_config_domainid;
     }
@@ -106,7 +106,7 @@ dds_init(dds_domainid_t domain)
     }
     else if (domain != config.domainId.value)
     {
-      DDS_ERROR("requested domain id %d is inconsistent with configured value %d\n", domain, config.domainId.value);
+      DDS_ERROR("requested domain id %"PRId32" is inconsistent with configured value %"PRId32"\n", domain, config.domainId.value);
       ret = DDS_ERRNO(DDS_RETCODE_ERROR);
       goto fail_config_domainid;
     }
@@ -298,7 +298,7 @@ dds__check_domain(
     if (domain != dds_global.m_default_domain)
     {
       DDS_ERROR("Inconsistent domain configuration detected: domain on "
-                "configuration: %d, domain %d\n", dds_global.m_default_domain, domain);
+                "configuration: %"PRId32", domain %"PRId32"\n", dds_global.m_default_domain, domain);
       ret = DDS_ERRNO(DDS_RETCODE_ERROR);
     }
   }
diff --git a/src/core/ddsc/src/dds_qos.c b/src/core/ddsc/src/dds_qos.c
index d95add8..b53d046 100644
--- a/src/core/ddsc/src/dds_qos.c
+++ b/src/core/ddsc/src/dds_qos.c
@@ -537,7 +537,7 @@ void dds_qset_partition
         return ;
     }
     if(n && !ps) {
-        DDS_ERROR("Argument ps is NULL, but n (%u) > 0", n);
+        DDS_ERROR("Argument ps is NULL, but n (%"PRIu32") > 0", n);
         return ;
     }
 
diff --git a/src/core/ddsc/src/dds_rhc.c b/src/core/ddsc/src/dds_rhc.c
index 74133c0..79a134a 100644
--- a/src/core/ddsc/src/dds_rhc.c
+++ b/src/core/ddsc/src/dds_rhc.c
@@ -1757,7 +1757,7 @@ static int dds_rhc_read_w_qminv (struct rhc *rhc, bool lock, void **values, dds_
     ddsrt_mutex_lock (&rhc->lock);
   }
 
-  TRACE ("read_w_qminv(%p,%p,%p,%u,%x,%p) - inst %u nonempty %u disp %u nowr %u new %u samples %u+%u read %u+%u\n",
+  TRACE ("read_w_qminv(%p,%p,%p,%"PRIu32",%x,%p) - inst %"PRIu32" nonempty %"PRIu32" disp %"PRIu32" nowr %"PRIu32" new %"PRIu32" samples %"PRIu32"+%"PRIu32" read %"PRIu32"+%"PRIu32"\n",
     (void *) rhc, (void *) values, (void *) info_seq, max_samples, qminv, (void *) cond,
     rhc->n_instances, rhc->n_nonempty_instances, rhc->n_not_alive_disposed,
     rhc->n_not_alive_no_writers, rhc->n_new, rhc->n_vsamples, rhc->n_invsamples,
@@ -1858,7 +1858,7 @@ static int dds_rhc_read_w_qminv (struct rhc *rhc, bool lock, void **values, dds_
     }
     while (inst != end && n < max_samples);
   }
-  TRACE ("read: returning %u\n", n);
+  TRACE ("read: returning %"PRIu32"\n", n);
   assert (rhc_check_counts_locked (rhc, true, false));
   ddsrt_mutex_unlock (&rhc->lock);
 
@@ -1880,7 +1880,7 @@ static int dds_rhc_take_w_qminv (struct rhc *rhc, bool lock, void **values, dds_
     ddsrt_mutex_lock (&rhc->lock);
   }
 
-  TRACE ("take_w_qminv(%p,%p,%p,%u,%x) - inst %u nonempty %u disp %u nowr %u new %u samples %u+%u read %u+%u\n",
+  TRACE ("take_w_qminv(%p,%p,%p,%"PRIu32",%x) - inst %"PRIu32" nonempty %"PRIu32" disp %"PRIu32" nowr %"PRIu32" new %"PRIu32" samples %"PRIu32"+%"PRIu32" read %"PRIu32"+%"PRIu32"\n",
     (void*) rhc, (void*) values, (void*) info_seq, max_samples, qminv,
     rhc->n_instances, rhc->n_nonempty_instances, rhc->n_not_alive_disposed,
     rhc->n_not_alive_no_writers, rhc->n_new, rhc->n_vsamples,
@@ -2020,7 +2020,7 @@ static int dds_rhc_take_w_qminv (struct rhc *rhc, bool lock, void **values, dds_
       inst = inst1;
     }
   }
-  TRACE ("take: returning %u\n", n);
+  TRACE ("take: returning %"PRIu32"\n", n);
   assert (rhc_check_counts_locked (rhc, true, false));
   ddsrt_mutex_unlock (&rhc->lock);
 
@@ -2043,7 +2043,7 @@ static int dds_rhc_takecdr_w_qminv (struct rhc *rhc, bool lock, struct ddsi_serd
     ddsrt_mutex_lock (&rhc->lock);
   }
 
-  TRACE ("take_w_qminv(%p,%p,%p,%u,%x) - inst %u nonempty %u disp %u nowr %u new %u samples %u+%u read %u+%u\n",
+  TRACE ("take_w_qminv(%p,%p,%p,%"PRIu32",%x) - inst %"PRIu32" nonempty %"PRIu32" disp %"PRIu32" nowr %"PRIu32" new %"PRIu32" samples %"PRIu32"+%"PRIu32" read %"PRIu32"+%"PRIu32"\n",
           (void*) rhc, (void*) values, (void*) info_seq, max_samples, qminv,
           rhc->n_instances, rhc->n_nonempty_instances, rhc->n_not_alive_disposed,
           rhc->n_not_alive_no_writers, rhc->n_new, rhc->n_vsamples,
@@ -2172,7 +2172,7 @@ static int dds_rhc_takecdr_w_qminv (struct rhc *rhc, bool lock, struct ddsi_serd
       inst = inst1;
     }
   }
-  TRACE ("take: returning %u\n", n);
+  TRACE ("take: returning %"PRIu32"\n", n);
   assert (rhc_check_counts_locked (rhc, true, false));
   ddsrt_mutex_unlock (&rhc->lock);
 
@@ -2205,7 +2205,7 @@ static uint32_t rhc_get_cond_trigger (struct rhc_instance * const inst, const dd
       m = m && !inst_is_empty (inst);
       break;
     default:
-      DDS_FATAL("update_readconditions: sample_states invalid: %x\n", c->m_sample_states);
+      DDS_FATAL("update_readconditions: sample_states invalid: %"PRIx32"\n", c->m_sample_states);
   }
   return m ? 1 : 0;
 }
@@ -2221,7 +2221,7 @@ static bool cond_is_sample_state_dependent (const struct dds_readcond *cond)
     case 0:
       return false;
     default:
-      DDS_FATAL("update_readconditions: sample_states invalid: %x\n", cond->m_sample_states);
+      DDS_FATAL("update_readconditions: sample_states invalid: %"PRIx32"\n", cond->m_sample_states);
       return false;
   }
 }
@@ -2322,7 +2322,7 @@ bool dds_rhc_add_readcondition (dds_readcond *cond)
   if (cond->m_entity.m_trigger)
     dds_entity_status_signal (&cond->m_entity);
 
-  TRACE ("add_readcondition(%p, %x, %x, %x) => %p qminv %x ; rhc %u conds\n",
+  TRACE ("add_readcondition(%p, %"PRIx32", %"PRIx32", %"PRIx32") => %p qminv %"PRIx32" ; rhc %"PRIu32" conds\n",
     (void *) rhc, cond->m_sample_states, cond->m_view_states,
     cond->m_instance_states, (void *) cond, cond->m_qminv, rhc->nconds);
 
@@ -2362,10 +2362,10 @@ static bool update_conditions_locked (struct rhc *rhc, bool called_from_insert,
   dds_readcond *iter;
   bool m_pre, m_post;
 
-  TRACE ("update_conditions_locked(%p %p) - inst %u nonempty %u disp %u nowr %u new %u samples %u read %u\n",
+  TRACE ("update_conditions_locked(%p %p) - inst %"PRIu32" nonempty %"PRIu32" disp %"PRIu32" nowr %"PRIu32" new %"PRIu32" samples %"PRIu32" read %"PRIu32"\n",
          (void *) rhc, (void *) inst, rhc->n_instances, rhc->n_nonempty_instances, rhc->n_not_alive_disposed,
          rhc->n_not_alive_no_writers, rhc->n_new, rhc->n_vsamples, rhc->n_vread);
-  TRACE ("  read -[%d,%d]+[%d,%d] qcmask -[%x,%x]+[%x,%x]\n",
+  TRACE ("  read -[%d,%d]+[%d,%d] qcmask -[%"PRIx32",%"PRIx32"]+[%"PRIx32",%"PRIx32"]\n",
          trig_qc->dec_invsample_read, trig_qc->dec_sample_read, trig_qc->inc_invsample_read, trig_qc->inc_sample_read,
          trig_qc->dec_conds_invsample, trig_qc->dec_conds_sample, trig_qc->inc_conds_invsample, trig_qc->inc_conds_sample);
 
@@ -2404,7 +2404,7 @@ static bool update_conditions_locked (struct rhc *rhc, bool called_from_insert,
         m_post = m_post && (post->c.has_read + post->c.has_not_read);
         break;
       default:
-        DDS_FATAL ("update_readconditions: sample_states invalid: %x\n", iter->m_sample_states);
+        DDS_FATAL ("update_readconditions: sample_states invalid: %"PRIx32"\n", iter->m_sample_states);
     }
 
     TRACE ("  cond %p %08"PRIx32": ", (void *) iter, iter->m_query.m_qcmask);
@@ -2464,7 +2464,7 @@ static bool update_conditions_locked (struct rhc *rhc, bool called_from_insert,
           mdelta += (trig_qc->inc_conds_sample & qcmask) != 0;
           break;
         default:
-          DDS_FATAL ("update_readconditions: sample_states invalid: %x\n", iter->m_sample_states);
+          DDS_FATAL ("update_readconditions: sample_states invalid: %"PRIx32"\n", iter->m_sample_states);
       }
 
       if (m_pre == m_post)
diff --git a/src/core/ddsc/src/dds_write.c b/src/core/ddsc/src/dds_write.c
index 98a590b..032141a 100644
--- a/src/core/ddsc/src/dds_write.c
+++ b/src/core/ddsc/src/dds_write.c
@@ -106,7 +106,7 @@ static dds_return_t deliver_locally (struct writer *wr, struct ddsi_serdata *pay
       unsigned i;
       make_proxy_writer_info (&pwr_info, &wr->e, wr->xqos);
       for (i = 0; rdary[i]; i++) {
-        DDS_TRACE ("reader %x:%x:%x:%x\n", PGUID (rdary[i]->e.guid));
+        DDS_TRACE ("reader "PGUIDFMT"\n", PGUID (rdary[i]->e.guid));
         if ((ret = try_store (rdary[i]->rhc, &pwr_info, payload, tk, &max_block_ms)) != DDS_RETCODE_OK)
           break;
       }
@@ -135,7 +135,7 @@ static dds_return_t deliver_locally (struct writer *wr, struct ddsi_serdata *pay
       struct reader *rd;
       if ((rd = ephash_lookup_reader_guid (&m->rd_guid)) != NULL)
       {
-        DDS_TRACE("reader-via-guid %x:%x:%x:%x\n", PGUID (rd->e.guid));
+        DDS_TRACE("reader-via-guid "PGUIDFMT"\n", PGUID (rd->e.guid));
         /* Copied the return value ignore from DDSI deliver_user_data() function. */
         if ((ret = try_store (rd->rhc, &pwr_info, payload, tk, &max_block_ms)) != DDS_RETCODE_OK)
           break;
diff --git a/src/core/ddsi/include/dds/ddsi/q_rtps.h b/src/core/ddsi/include/dds/ddsi/q_rtps.h
index 731fbd9..57e3d0a 100644
--- a/src/core/ddsi/include/dds/ddsi/q_rtps.h
+++ b/src/core/ddsi/include/dds/ddsi/q_rtps.h
@@ -37,6 +37,7 @@ typedef int64_t seqno_t;
 
 #define PGUIDPREFIX(gp) (gp).u[0], (gp).u[1], (gp).u[2]
 #define PGUID(g) PGUIDPREFIX ((g).prefix), (g).entityid.u
+#define PGUIDFMT "%"PRIx32":%"PRIx32":%"PRIx32":%"PRIx32
 
 /* predefined entity ids; here viewed as an unsigned int, on the
    network as four bytes corresponding to the integer in network byte
diff --git a/src/core/ddsi/src/ddsi_tcp.c b/src/core/ddsi/src/ddsi_tcp.c
index 2a48e78..8d7ec2b 100644
--- a/src/core/ddsi/src/ddsi_tcp.c
+++ b/src/core/ddsi/src/ddsi_tcp.c
@@ -154,7 +154,7 @@ static unsigned short get_socket_port (ddsrt_socket_t socket)
 
   ret = ddsrt_getsockname(socket, (struct sockaddr *)&addr, &addrlen);
   if (ret != DDS_RETCODE_OK) {
-    DDS_ERROR("ddsi_tcp_get_socket_port: ddsrt_getsockname retcode %d\n", ret);
+    DDS_ERROR("ddsi_tcp_get_socket_port: ddsrt_getsockname retcode %"PRId32"\n", ret);
     return 0;
   }
   return ddsrt_sockaddr_get_port((struct sockaddr *)&addr);
@@ -435,7 +435,7 @@ static ssize_t ddsi_tcp_conn_read (ddsi_tran_conn_t conn, unsigned char * buf, s
         }
         else
         {
-          DDS_LOG(DDS_LC_TCP, "%s read: sock %"PRIdSOCK" error %d\n", ddsi_name, tcp->m_sock, rc);
+          DDS_LOG(DDS_LC_TCP, "%s read: sock %"PRIdSOCK" error %"PRId32"\n", ddsi_name, tcp->m_sock, rc);
           break;
         }
       }
@@ -500,7 +500,7 @@ static ssize_t ddsi_tcp_block_write
         }
         else
         {
-          DDS_LOG(DDS_LC_TCP, "%s write: sock %"PRIdSOCK" error %d\n", ddsi_name, conn->m_sock, rc);
+          DDS_LOG(DDS_LC_TCP, "%s write: sock %"PRIdSOCK" error %"PRId32"\n", ddsi_name, conn->m_sock, rc);
           break;
         }
       }
@@ -638,7 +638,7 @@ static ssize_t ddsi_tcp_conn_write (ddsi_tran_conn_t base, const nn_locator_t *d
             break;
           default:
             if (! conn->m_base.m_closed && (conn->m_sock != DDSRT_INVALID_SOCKET))
-              DDS_WARNING("%s write failed on socket %"PRIdSOCK" with errno %d\n", ddsi_name, conn->m_sock, rc);
+              DDS_WARNING("%s write failed on socket %"PRIdSOCK" with errno %"PRId32"\n", ddsi_name, conn->m_sock, rc);
             break;
         }
       }
@@ -775,11 +775,11 @@ static ddsi_tran_conn_t ddsi_tcp_accept (ddsi_tran_listener_t listener)
   {
     (void)ddsrt_getsockname (tl->m_sock, (struct sockaddr *) &addr, &addrlen);
     sockaddr_to_string_with_port(buff, sizeof(buff), (struct sockaddr *)&addr);
-    DDS_LOG((rc == DDS_RETCODE_OK) ? DDS_LC_ERROR : DDS_LC_FATAL, "%s accept failed on socket %"PRIdSOCK" at %s retcode %d\n", ddsi_name, tl->m_sock, buff, rc);
+    DDS_LOG((rc == DDS_RETCODE_OK) ? DDS_LC_ERROR : DDS_LC_FATAL, "%s accept failed on socket %"PRIdSOCK" at %s retcode %"PRId32"\n", ddsi_name, tl->m_sock, buff, rc);
   }
   else if (getpeername (sock, (struct sockaddr *) &addr, &addrlen) == -1)
   {
-    DDS_WARNING("%s accepted new socket %"PRIdSOCK" on socket %"PRIdSOCK" but no peer address, errno %d\n", ddsi_name, sock, tl->m_sock, rc);
+    DDS_WARNING("%s accepted new socket %"PRIdSOCK" on socket %"PRIdSOCK" but no peer address, errno %"PRId32"\n", ddsi_name, sock, tl->m_sock, rc);
     ddsrt_close (sock);
   }
   else
@@ -886,7 +886,7 @@ static ddsi_tran_listener_t ddsi_tcp_create_listener (int port, ddsi_tran_qos_t
 
     ret = ddsrt_getsockname(sock, (struct sockaddr *)&addr, &addrlen);
     if (ret != DDS_RETCODE_OK) {
-        DDS_ERROR("ddsi_tcp_create_listener: ddsrt_getsockname returned %d\n", ret);
+        DDS_ERROR("ddsi_tcp_create_listener: ddsrt_getsockname returned %"PRId32"\n", ret);
         ddsi_tcp_sock_free(sock, NULL);
         ddsrt_free(tl);
         return NULL;
@@ -958,7 +958,7 @@ static void ddsi_tcp_unblock_listener (ddsi_tran_listener_t listener)
 
     ret = ddsrt_getsockname(tl->m_sock, (struct sockaddr *)&addr, &addrlen);
     if (ret != DDS_RETCODE_OK) {
-      DDS_WARNING("%s failed to get listener address error %d\n", ddsi_name, ret);
+      DDS_WARNING("%s failed to get listener address error %"PRId32"\n", ddsi_name, ret);
     } else {
       switch (addr.ss_family) {
         case AF_INET:
@@ -988,7 +988,7 @@ static void ddsi_tcp_unblock_listener (ddsi_tran_listener_t listener)
       {
         char buff[DDSI_LOCSTRLEN];
         sockaddr_to_string_with_port(buff, sizeof(buff), (struct sockaddr *)&addr);
-        DDS_WARNING("%s failed to connect to own listener (%s) error %d\n", ddsi_name, buff, ret);
+        DDS_WARNING("%s failed to connect to own listener (%s) error %"PRId32"\n", ddsi_name, buff, ret);
       }
     }
     ddsi_tcp_sock_free (sock, NULL);
diff --git a/src/core/ddsi/src/ddsi_threadmon.c b/src/core/ddsi/src/ddsi_threadmon.c
index 755848c..f257261 100644
--- a/src/core/ddsi/src/ddsi_threadmon.c
+++ b/src/core/ddsi/src/ddsi_threadmon.c
@@ -88,7 +88,7 @@ static uint32_t threadmon_thread (struct ddsi_threadmon *sl)
           vtime_t vt = thread_states.ts[i].vtime;
           bool alive = vtime_asleep_p (vt) || vtime_asleep_p (sl->av_ary[i].vt) || vtime_gt (vt, sl->av_ary[i].vt);
           n_alive += (unsigned) alive;
-          DDS_TRACE(" %u(%s):%c:%x->%x", i, thread_states.ts[i].name, alive ? 'a' : 'd', sl->av_ary[i].vt, vt);
+          DDS_TRACE(" %u(%s):%c:%"PRIx32"->%"PRIx32, i, thread_states.ts[i].name, alive ? 'a' : 'd', sl->av_ary[i].vt, vt);
           sl->av_ary[i].vt = vt;
           if (sl->av_ary[i].alive != alive)
           {
diff --git a/src/core/ddsi/src/ddsi_udp.c b/src/core/ddsi/src/ddsi_udp.c
index 628c7e0..53135f1 100644
--- a/src/core/ddsi/src/ddsi_udp.c
+++ b/src/core/ddsi/src/ddsi_udp.c
@@ -103,7 +103,7 @@ static ssize_t ddsi_udp_conn_read (ddsi_tran_conn_t conn, unsigned char * buf, s
   else if (rc != DDS_RETCODE_BAD_PARAMETER &&
            rc != DDS_RETCODE_NO_CONNECTION)
   {
-    DDS_ERROR("UDP recvmsg sock %d: ret %d retcode %d\n", (int) ((ddsi_udp_conn_t) conn)->m_sock, (int) ret, rc);
+    DDS_ERROR("UDP recvmsg sock %d: ret %d retcode %"PRId32"\n", (int) ((ddsi_udp_conn_t) conn)->m_sock, (int) ret, rc);
     ret = -1;
   }
   return ret;
@@ -168,7 +168,7 @@ static ssize_t ddsi_udp_conn_write (ddsi_tran_conn_t conn, const nn_locator_t *d
            rc != DDS_RETCODE_NOT_ALLOWED &&
            rc != DDS_RETCODE_NO_CONNECTION)
   {
-    DDS_ERROR("ddsi_udp_conn_write failed with retcode %d\n", rc);
+    DDS_ERROR("ddsi_udp_conn_write failed with retcode %"PRId32"\n", rc);
   }
   return (rc == DDS_RETCODE_OK ? ret : -1);
 }
@@ -220,7 +220,7 @@ static unsigned short get_socket_port (ddsrt_socket_t socket)
   ret = ddsrt_getsockname (socket, (struct sockaddr *)&addr, &addrlen);
   if (ret != DDS_RETCODE_OK)
   {
-    DDS_ERROR("ddsi_udp_get_socket_port: getsockname returned %d\n", ret);
+    DDS_ERROR("ddsi_udp_get_socket_port: getsockname returned %"PRId32"\n", ret);
     return 0;
   }
 
@@ -273,7 +273,7 @@ static ddsi_tran_conn_t ddsi_udp_create_conn
 
     DDS_TRACE
     (
-      "ddsi_udp_create_conn %s socket %"PRIdSOCK" port %u\n",
+      "ddsi_udp_create_conn %s socket %"PRIdSOCK" port %"PRIu32"\n",
       mcast ? "multicast" : "unicast",
       uc->m_sock,
       uc->m_base.m_base.m_port
@@ -284,7 +284,7 @@ static ddsi_tran_conn_t ddsi_udp_create_conn
       dds_retcode_t rc;
       rc = ddsrt_setsockopt(sock, IPPROTO_IP, IP_TOS, (char *)&uc->m_diffserv, sizeof(uc->m_diffserv));
       if (rc != DDS_RETCODE_OK)
-        DDS_ERROR("ddsi_udp_create_conn: set diffserv retcode %d\n", rc);
+        DDS_ERROR("ddsi_udp_create_conn: set diffserv retcode %"PRId32"\n", rc);
     }
 #endif
   }
@@ -294,7 +294,7 @@ static ddsi_tran_conn_t ddsi_udp_create_conn
     {
       DDS_ERROR
       (
-        "UDP make_socket failed for %s port %u\n",
+        "UDP make_socket failed for %s port %"PRIu32"\n",
         mcast ? "multicast" : "unicast",
         port
       );
@@ -395,7 +395,7 @@ static void ddsi_udp_release_conn (ddsi_tran_conn_t conn)
   ddsi_udp_conn_t uc = (ddsi_udp_conn_t) conn;
   DDS_TRACE
   (
-    "ddsi_udp_release_conn %s socket %"PRIdSOCK" port %u\n",
+    "ddsi_udp_release_conn %s socket %"PRIdSOCK" port %"PRIu32"\n",
     conn->m_base.m_multicast ? "multicast" : "unicast",
     uc->m_sock,
     uc->m_base.m_base.m_port
diff --git a/src/core/ddsi/src/q_ddsi_discovery.c b/src/core/ddsi/src/q_ddsi_discovery.c
index 12ab0bc..98e89f7 100644
--- a/src/core/ddsi/src/q_ddsi_discovery.c
+++ b/src/core/ddsi/src/q_ddsi_discovery.c
@@ -198,11 +198,11 @@ int spdp_write (struct participant *pp)
       return 0;
   }
 
-  DDS_TRACE("spdp_write(%x:%x:%x:%x)\n", PGUID (pp->e.guid));
+  DDS_TRACE("spdp_write("PGUIDFMT")\n", PGUID (pp->e.guid));
 
   if ((wr = get_builtin_writer (pp, NN_ENTITYID_SPDP_BUILTIN_PARTICIPANT_WRITER)) == NULL)
   {
-    DDS_TRACE("spdp_write(%x:%x:%x:%x) - builtin participant writer not found\n", PGUID (pp->e.guid));
+    DDS_TRACE("spdp_write("PGUIDFMT") - builtin participant writer not found\n", PGUID (pp->e.guid));
     return 0;
   }
 
@@ -307,7 +307,7 @@ int spdp_write (struct participant *pp)
     size = strlen(node) + strlen(DDS_VERSION) + strlen(DDS_HOST_NAME) + strlen(DDS_TARGET_NAME) + 4; /* + ///'\0' */
     ps.prismtech_participant_version_info.internals = ddsrt_malloc(size);
     (void) snprintf(ps.prismtech_participant_version_info.internals, size, "%s/%s/%s/%s", node, DDS_VERSION, DDS_HOST_NAME, DDS_TARGET_NAME);
-    DDS_TRACE("spdp_write(%x:%x:%x:%x) - internals: %s\n", PGUID (pp->e.guid), ps.prismtech_participant_version_info.internals);
+    DDS_TRACE("spdp_write("PGUIDFMT") - internals: %s\n", PGUID (pp->e.guid), ps.prismtech_participant_version_info.internals);
   }
 
   /* Participant QoS's insofar as they are set, different from the default, and mapped to the SPDP data, rather than to the PrismTech-specific CMParticipant endpoint.  Currently, that means just USER_DATA. */
@@ -335,7 +335,7 @@ int spdp_dispose_unregister (struct participant *pp)
 
   if ((wr = get_builtin_writer (pp, NN_ENTITYID_SPDP_BUILTIN_PARTICIPANT_WRITER)) == NULL)
   {
-    DDS_TRACE("spdp_dispose_unregister(%x:%x:%x:%x) - builtin participant writer not found\n", PGUID (pp->e.guid));
+    DDS_TRACE("spdp_dispose_unregister("PGUIDFMT") - builtin participant writer not found\n", PGUID (pp->e.guid));
     return 0;
   }
 
@@ -416,7 +416,7 @@ static int handle_SPDP_dead (const struct receiver_state *rst, nn_wctime_t times
   if (datap->present & PP_PARTICIPANT_GUID)
   {
     guid = datap->participant_guid;
-    DDS_LOG(DDS_LC_DISCOVERY, " %x:%x:%x:%x", PGUID (guid));
+    DDS_LOG(DDS_LC_DISCOVERY, " %"PRIx32":%"PRIx32":%"PRIx32":%"PRIx32, PGUID (guid));
     assert (guid.entityid.u == NN_ENTITYID_PARTICIPANT);
     if (delete_proxy_participant_by_guid (&guid, timestamp, 0) < 0)
     {
@@ -481,7 +481,7 @@ static void make_participants_dependent_on_ddsi2 (const nn_guid_t *ddsi2guid, nn
   {
     if (vendor_is_eclipse_or_opensplice (pp->vendor) && pp->e.guid.prefix.u[0] == ddsi2guid->prefix.u[0] && !pp->is_ddsi2_pp)
     {
-      DDS_TRACE("proxy participant %x:%x:%x:%x depends on ddsi2 %x:%x:%x:%x", PGUID (pp->e.guid), PGUID (*ddsi2guid));
+      DDS_TRACE("proxy participant "PGUIDFMT" depends on ddsi2 "PGUIDFMT, PGUID (pp->e.guid), PGUID (*ddsi2guid));
       ddsrt_mutex_lock (&pp->e.lock);
       pp->privileged_pp_guid = *ddsi2guid;
       ddsrt_mutex_unlock (&pp->e.lock);
@@ -501,7 +501,7 @@ static void make_participants_dependent_on_ddsi2 (const nn_guid_t *ddsi2guid, nn
 
   if (pp != NULL)
   {
-    DDS_TRACE("make_participants_dependent_on_ddsi2: ddsi2 %x:%x:%x:%x is no more, delete %x:%x:%x:%x\n", PGUID (*ddsi2guid), PGUID (pp->e.guid));
+    DDS_TRACE("make_participants_dependent_on_ddsi2: ddsi2 "PGUIDFMT" is no more, delete "PGUIDFMT"\n", PGUID (*ddsi2guid), PGUID (pp->e.guid));
     delete_proxy_participant_by_guid (&pp->e.guid, timestamp, 1);
   }
 }
@@ -569,7 +569,7 @@ static int handle_SPDP_alive (const struct receiver_state *rst, nn_wctime_t time
 
   if (is_deleted_participant_guid (&datap->participant_guid, DPG_REMOTE))
   {
-    DDS_LOG(DDS_LC_TRACE, "SPDP ST0 %x:%x:%x:%x (recently deleted)", PGUID (datap->participant_guid));
+    DDS_LOG(DDS_LC_TRACE, "SPDP ST0 "PGUIDFMT" (recently deleted)", PGUID (datap->participant_guid));
     return 1;
   }
 
@@ -579,7 +579,7 @@ static int handle_SPDP_alive (const struct receiver_state *rst, nn_wctime_t time
       islocal = 1;
     if (islocal)
     {
-      DDS_LOG(DDS_LC_TRACE, "SPDP ST0 %x:%x:%x:%x (local %d)", islocal, PGUID (datap->participant_guid));
+      DDS_LOG(DDS_LC_TRACE, "SPDP ST0 "PGUIDFMT" (local %d)", PGUID (datap->participant_guid), islocal);
       return 0;
     }
   }
@@ -590,7 +590,7 @@ static int handle_SPDP_alive (const struct receiver_state *rst, nn_wctime_t time
        are even skipping the automatic lease renewal.  Therefore do it
        regardless of
        config.arrival_of_data_asserts_pp_and_ep_liveliness. */
-    DDS_LOG(DDS_LC_TRACE, "SPDP ST0 %x:%x:%x:%x (known)", PGUID (datap->participant_guid));
+    DDS_LOG(DDS_LC_TRACE, "SPDP ST0 "PGUIDFMT" (known)", PGUID (datap->participant_guid));
     lease_renew (ddsrt_atomic_ldvoidp (&proxypp->lease), now_et ());
     ddsrt_mutex_lock (&proxypp->e.lock);
     if (proxypp->implicitly_created)
@@ -603,7 +603,7 @@ static int handle_SPDP_alive (const struct receiver_state *rst, nn_wctime_t time
     return 0;
   }
 
-  DDS_LOG(DDS_LC_DISCOVERY, "SPDP ST0 %x:%x:%x:%x bes %x ptbes %x NEW", PGUID (datap->participant_guid), builtin_endpoint_set, prismtech_builtin_endpoint_set);
+  DDS_LOG(DDS_LC_DISCOVERY, "SPDP ST0 "PGUIDFMT" bes %x ptbes %x NEW", PGUID (datap->participant_guid), builtin_endpoint_set, prismtech_builtin_endpoint_set);
 
   if (datap->present & PP_PARTICIPANT_LEASE_DURATION)
   {
@@ -643,7 +643,7 @@ static int handle_SPDP_alive (const struct receiver_state *rst, nn_wctime_t time
   if ((builtin_endpoint_set & bes_sedp_announcer_mask) != bes_sedp_announcer_mask &&
       memcmp (&privileged_pp_guid, &datap->participant_guid, sizeof (nn_guid_t)) != 0)
   {
-    DDS_LOG(DDS_LC_DISCOVERY, " (depends on %x:%x:%x:%x)", PGUID (privileged_pp_guid));
+    DDS_LOG(DDS_LC_DISCOVERY, " (depends on "PGUIDFMT")", PGUID (privileged_pp_guid));
     /* never expire lease for this proxy: it won't actually expire
        until the "privileged" one expires anyway */
     lease_duration = nn_to_ddsi_duration (T_NEVER);
@@ -659,7 +659,7 @@ static int handle_SPDP_alive (const struct receiver_state *rst, nn_wctime_t time
     {
       privileged_pp_guid.prefix = ddsi2->e.guid.prefix;
       lease_duration = nn_to_ddsi_duration (T_NEVER);
-      DDS_LOG(DDS_LC_DISCOVERY, " (depends on %x:%x:%x:%x)", PGUID (privileged_pp_guid));
+      DDS_LOG(DDS_LC_DISCOVERY, " (depends on "PGUIDFMT")", PGUID (privileged_pp_guid));
     }
   }
   else
@@ -772,7 +772,7 @@ static int handle_SPDP_alive (const struct receiver_state *rst, nn_wctime_t time
        of DDSI2. */
     if (ephash_lookup_proxy_participant_guid (&privileged_pp_guid) == NULL)
     {
-      DDS_LOG(DDS_LC_DISCOVERY, "make_participants_dependent_on_ddsi2: ddsi2 %x:%x:%x:%x is no more, delete %x:%x:%x:%x\n", PGUID (privileged_pp_guid), PGUID (datap->participant_guid));
+      DDS_LOG(DDS_LC_DISCOVERY, "make_participants_dependent_on_ddsi2: ddsi2 "PGUIDFMT" is no more, delete "PGUIDFMT"\n", PGUID (privileged_pp_guid), PGUID (datap->participant_guid));
       delete_proxy_participant_by_guid (&datap->participant_guid, timestamp, 1);
     }
   }
@@ -943,7 +943,7 @@ static int sedp_write_endpoint
   nn_xmsg_addpar_sentinel (mpayload);
   nn_plist_fini (&ps);
 
-  DDS_LOG(DDS_LC_DISCOVERY, "sedp: write for %x:%x:%x:%x via %x:%x:%x:%x\n", PGUID (*epguid), PGUID (wr->e.guid));
+  DDS_LOG(DDS_LC_DISCOVERY, "sedp: write for "PGUIDFMT" via "PGUIDFMT"\n", PGUID (*epguid), PGUID (wr->e.guid));
   ret = write_mpayload (wr, alive, PID_ENDPOINT_GUID, mpayload);
   nn_xmsg_free (mpayload);
   return ret;
@@ -953,7 +953,7 @@ static struct writer *get_sedp_writer (const struct participant *pp, unsigned en
 {
   struct writer *sedp_wr = get_builtin_writer (pp, entityid);
   if (sedp_wr == NULL)
-    DDS_FATAL("sedp_write_writer: no SEDP builtin writer %x for %x:%x:%x:%x\n", entityid, PGUID (pp->e.guid));
+    DDS_FATAL("sedp_write_writer: no SEDP builtin writer %x for "PGUIDFMT"\n", entityid, PGUID (pp->e.guid));
   return sedp_wr;
 }
 
@@ -1036,14 +1036,14 @@ static struct proxy_participant *implicitly_create_proxypp (const nn_guid_t *ppg
   {
     nn_vendorid_t actual_vendorid;
     /* Some endpoint that we discovered through the DS, but then it must have at least some locators */
-    DDS_TRACE(" from-DS %x:%x:%x:%x", PGUID (privguid));
+    DDS_TRACE(" from-DS %"PRIx32":%"PRIx32":%"PRIx32":%"PRIx32, PGUID (privguid));
     /* avoid "no address" case, so we never create the proxy participant for nothing (FIXME: rework some of this) */
     if (!(datap->present & (PP_UNICAST_LOCATOR | PP_MULTICAST_LOCATOR)))
     {
       DDS_TRACE(" data locator absent\n");
       goto err;
     }
-    DDS_TRACE(" new-proxypp %x:%x:%x:%x\n", PGUID (*ppguid));
+    DDS_TRACE(" new-proxypp "PGUIDFMT"\n", PGUID (*ppguid));
     /* We need to handle any source of entities, but we really want to try to keep the GIDs (and
        certainly the systemId component) unchanged for OSPL.  The new proxy participant will take
        the GID from the GUID if it is from a "modern" OSPL that advertises it includes all GIDs in
@@ -1076,7 +1076,7 @@ static struct proxy_participant *implicitly_create_proxypp (const nn_guid_t *ppg
     } else {
       struct addrset *as_default, *as_meta;
       nn_plist_t tmp_plist;
-      DDS_TRACE(" from-ddsi2 %x:%x:%x:%x", PGUID (privguid));
+      DDS_TRACE(" from-ddsi2 "PGUIDFMT, PGUID (privguid));
       nn_plist_init_empty (&pp_plist);
 
       ddsrt_mutex_lock (&privpp->e.lock);
@@ -1118,7 +1118,7 @@ static void handle_SEDP_alive (const struct receiver_state *rst, nn_plist_t *dat
 
   if (!(datap->present & PP_ENDPOINT_GUID))
     E (" no guid?\n", err);
-  DDS_LOG(DDS_LC_DISCOVERY, " %x:%x:%x:%x", PGUID (datap->endpoint_guid));
+  DDS_LOG(DDS_LC_DISCOVERY, " "PGUIDFMT, PGUID (datap->endpoint_guid));
 
   ppguid.prefix = datap->endpoint_guid.prefix;
   ppguid.entityid.u = NN_ENTITYID_PARTICIPANT;
@@ -1141,7 +1141,7 @@ static void handle_SEDP_alive (const struct receiver_state *rst, nn_plist_t *dat
     if ((pp = implicitly_create_proxypp (&ppguid, datap, src_guid_prefix, vendorid, timestamp)) == NULL)
       E ("?\n", err);
     /* Repeat regular SEDP trace for convenience */
-    DDS_LOG(DDS_LC_DISCOVERY, "SEDP ST0 %x:%x:%x:%x (cont)", PGUID (datap->endpoint_guid));
+    DDS_LOG(DDS_LC_DISCOVERY, "SEDP ST0 "PGUIDFMT" (cont)", PGUID (datap->endpoint_guid));
   }
 
   xqos = &datap->qos;
@@ -1200,7 +1200,7 @@ static void handle_SEDP_alive (const struct receiver_state *rst, nn_plist_t *dat
     if (vendor_is_cloud (vendorid) && pp->implicitly_created && memcmp(&pp->privileged_pp_guid.prefix, src_guid_prefix, sizeof(pp->privileged_pp_guid.prefix)) != 0)
     {
       nn_etime_t never = { T_NEVER };
-      DDS_LOG(DDS_LC_DISCOVERY, " %x:%x:%x:%x attach-to-DS %x:%x:%x:%x", PGUID(pp->e.guid), PGUIDPREFIX(*src_guid_prefix), pp->privileged_pp_guid.entityid.u);
+      DDS_LOG(DDS_LC_DISCOVERY, " "PGUIDFMT" attach-to-DS "PGUIDFMT, PGUID(pp->e.guid), PGUIDPREFIX(*src_guid_prefix), pp->privileged_pp_guid.entityid.u);
       ddsrt_mutex_lock (&pp->e.lock);
       pp->privileged_pp_guid.prefix = *src_guid_prefix;
       lease_set_expiry(ddsrt_atomic_ldvoidp(&pp->lease), never);
@@ -1253,7 +1253,7 @@ static void handle_SEDP_alive (const struct receiver_state *rst, nn_plist_t *dat
 
   if ((datap->endpoint_guid.entityid.u & NN_ENTITYID_SOURCE_MASK) == NN_ENTITYID_SOURCE_VENDOR && !vendor_is_eclipse_or_prismtech (vendorid))
   {
-    DDS_LOG(DDS_LC_DISCOVERY, "ignoring vendor-specific endpoint %x:%x:%x:%x\n", PGUID (datap->endpoint_guid));
+    DDS_LOG(DDS_LC_DISCOVERY, "ignoring vendor-specific endpoint "PGUIDFMT"\n", PGUID (datap->endpoint_guid));
   }
   else
   {
@@ -1310,7 +1310,7 @@ static void handle_SEDP_dead (nn_plist_t *datap, nn_wctime_t timestamp)
     DDS_LOG(DDS_LC_DISCOVERY, " no guid?\n");
     return;
   }
-  DDS_LOG(DDS_LC_DISCOVERY, " %x:%x:%x:%x", PGUID (datap->endpoint_guid));
+  DDS_LOG(DDS_LC_DISCOVERY, " "PGUIDFMT, PGUID (datap->endpoint_guid));
   if (is_writer_entityid (datap->endpoint_guid.entityid))
   {
     res = delete_proxy_writer (&datap->endpoint_guid, timestamp, 0);
@@ -1394,7 +1394,7 @@ int sedp_write_topic (struct participant *pp, const struct nn_plist *datap)
   nn_plist_addtomsg (mpayload, datap, ~(uint64_t)0, delta);
   nn_xmsg_addpar_sentinel (mpayload);
 
-  DDS_TRACE("sedp: write topic %s via %x:%x:%x:%x\n", datap->qos.topic_name, PGUID (sedp_wr->e.guid));
+  DDS_TRACE("sedp: write topic %s via "PGUIDFMT"\n", datap->qos.topic_name, PGUID (sedp_wr->e.guid));
   ret = write_mpayload (sedp_wr, 1, PID_TOPIC_NAME, mpayload);
   nn_xmsg_free (mpayload);
   return ret;
@@ -1441,7 +1441,7 @@ int sedp_write_cm_participant (struct participant *pp, int alive)
   }
   nn_xmsg_addpar_sentinel (mpayload);
 
-  DDS_TRACE("sedp: write CMParticipant ST%x for %x:%x:%x:%x via %x:%x:%x:%x\n",
+  DDS_TRACE("sedp: write CMParticipant ST%x for "PGUIDFMT" via "PGUIDFMT"\n",
           alive ? 0 : NN_STATUSINFO_DISPOSE | NN_STATUSINFO_UNREGISTER, PGUID (pp->e.guid), PGUID (sedp_wr->e.guid));
   ret = write_mpayload (sedp_wr, alive, PID_PARTICIPANT_GUID, mpayload);
   nn_xmsg_free (mpayload);
@@ -1514,7 +1514,7 @@ int sedp_write_cm_publisher (const struct nn_plist *datap, int alive)
 
   if ((pp = group_guid_to_participant (&datap->group_guid)) == NULL)
   {
-      DDS_TRACE("sedp: write CMPublisher alive:%d for %x:%x:%x:%x dropped: no participant\n",
+      DDS_TRACE("sedp: write CMPublisher alive:%d for "PGUIDFMT" dropped: no participant\n",
               alive, PGUID (datap->group_guid));
       return 0;
   }
@@ -1550,7 +1550,7 @@ int sedp_write_cm_subscriber (const struct nn_plist *datap, int alive)
 
   if ((pp = group_guid_to_participant (&datap->group_guid)) == NULL)
   {
-      DDS_LOG(DDS_LC_DISCOVERY, "sedp: write CMSubscriber alive:%d for %x:%x:%x:%x dropped: no participant\n",
+      DDS_LOG(DDS_LC_DISCOVERY, "sedp: write CMSubscriber alive:%d for "PGUIDFMT" dropped: no participant\n",
               alive, PGUID (datap->group_guid));
       return 0;
   }
@@ -1583,7 +1583,7 @@ static void handle_SEDP_GROUP_alive (nn_plist_t *datap /* note: potentially modi
 
   if (!(datap->present & PP_GROUP_GUID))
     E (" no guid?\n", err);
-  DDS_LOG(DDS_LC_DISCOVERY, " %x:%x:%x:%x", PGUID (datap->group_guid));
+  DDS_LOG(DDS_LC_DISCOVERY, " %"PRIx32"%"PRIx32"%"PRIx32"%"PRIx32, PGUID (datap->group_guid));
 
   ppguid.prefix = datap->group_guid.prefix;
   ppguid.entityid.u = NN_ENTITYID_PARTICIPANT;
@@ -1608,7 +1608,7 @@ static void handle_SEDP_GROUP_dead (nn_plist_t *datap, nn_wctime_t timestamp)
     DDS_LOG(DDS_LC_DISCOVERY, " no guid?\n");
     return;
   }
-  DDS_LOG(DDS_LC_DISCOVERY, " %x:%x:%x:%x\n", PGUID (datap->group_guid));
+  DDS_LOG(DDS_LC_DISCOVERY, " "PGUIDFMT"\n", PGUID (datap->group_guid));
   delete_proxy_group (&datap->group_guid, timestamp, 0);
 }
 
@@ -1757,7 +1757,7 @@ int builtins_dqueue_handler (const struct nn_rsample_info *sampleinfo, const str
     if ((plist_ret = nn_plist_init_frommsg (&qos, NULL, PP_STATUSINFO | PP_KEYHASH, 0, &src)) < 0)
     {
       if (plist_ret != Q_ERR_INCOMPATIBLE)
-        DDS_WARNING("data(builtin, vendor %u.%u): %x:%x:%x:%x #%"PRId64": invalid inline qos\n",
+        DDS_WARNING("data(builtin, vendor %u.%u): "PGUIDFMT" #%"PRId64": invalid inline qos\n",
                     src.vendorid.id[0], src.vendorid.id[1], PGUID (srcguid), sampleinfo->seq);
       goto done_upd_deliv;
     }
@@ -1781,7 +1781,7 @@ int builtins_dqueue_handler (const struct nn_rsample_info *sampleinfo, const str
   {
     if (datasz == 0 || !(data_smhdr_flags & DATA_FLAG_DATAFLAG))
     {
-      DDS_WARNING("data(builtin, vendor %u.%u): %x:%x:%x:%x #%"PRId64": "
+      DDS_WARNING("data(builtin, vendor %u.%u): "PGUIDFMT" #%"PRId64": "
                    "built-in data but no payload\n",
                    sampleinfo->rst->vendor.id[0], sampleinfo->rst->vendor.id[1],
                    PGUID (srcguid), sampleinfo->seq);
@@ -1795,7 +1795,7 @@ int builtins_dqueue_handler (const struct nn_rsample_info *sampleinfo, const str
        hasn't been checked fully yet. */
     if (!(data_smhdr_flags & DATA_FLAG_KEYFLAG))
     {
-      DDS_WARNING("data(builtin, vendor %u.%u): %x:%x:%x:%x #%"PRId64": "
+      DDS_WARNING("data(builtin, vendor %u.%u): "PGUIDFMT" #%"PRId64": "
                    "dispose/unregister of built-in data but payload not just key\n",
                    sampleinfo->rst->vendor.id[0], sampleinfo->rst->vendor.id[1],
                    PGUID (srcguid), sampleinfo->seq);
@@ -1837,7 +1837,7 @@ int builtins_dqueue_handler (const struct nn_rsample_info *sampleinfo, const str
           pid = PID_ENDPOINT_GUID;
           break;
         default:
-          DDS_LOG(DDS_LC_DISCOVERY, "data(builtin, vendor %u.%u): %x:%x:%x:%x #%"PRId64": mapping keyhash to ENDPOINT_GUID",
+          DDS_LOG(DDS_LC_DISCOVERY, "data(builtin, vendor %u.%u): "PGUIDFMT" #%"PRId64": mapping keyhash to ENDPOINT_GUID",
                   sampleinfo->rst->vendor.id[0], sampleinfo->rst->vendor.id[1],
                   PGUID (srcguid), sampleinfo->seq);
           pid = PID_ENDPOINT_GUID;
@@ -1854,7 +1854,7 @@ int builtins_dqueue_handler (const struct nn_rsample_info *sampleinfo, const str
   }
   else
   {
-    DDS_WARNING("data(builtin, vendor %u.%u): %x:%x:%x:%x #%"PRId64": "
+    DDS_WARNING("data(builtin, vendor %u.%u): "PGUIDFMT" #%"PRId64": "
                  "dispose/unregister with no content\n",
                  sampleinfo->rst->vendor.id[0], sampleinfo->rst->vendor.id[1],
                  PGUID (srcguid), sampleinfo->seq);
@@ -1882,7 +1882,7 @@ int builtins_dqueue_handler (const struct nn_rsample_info *sampleinfo, const str
       handle_SEDP_GROUP (sampleinfo->rst, timestamp, statusinfo, datap, datasz);
       break;
     default:
-      DDS_LOG (DDS_LC_DISCOVERY, "data(builtin, vendor %u.%u): %x:%x:%x:%x #%"PRId64": not handled\n",
+      DDS_LOG (DDS_LC_DISCOVERY, "data(builtin, vendor %u.%u): "PGUIDFMT" #%"PRId64": not handled\n",
                sampleinfo->rst->vendor.id[0], sampleinfo->rst->vendor.id[1],
                PGUID (srcguid), sampleinfo->seq);
       break;
diff --git a/src/core/ddsi/src/q_entity.c b/src/core/ddsi/src/q_entity.c
index 31437b0..beba3f8 100644
--- a/src/core/ddsi/src/q_entity.c
+++ b/src/core/ddsi/src/q_entity.c
@@ -338,7 +338,7 @@ int is_deleted_participant_guid (const struct nn_guid *guid, unsigned for_what)
 static void remove_deleted_participant_guid (const struct nn_guid *guid, unsigned for_what)
 {
   struct deleted_participant *n;
-  DDS_LOG(DDS_LC_DISCOVERY, "remove_deleted_participant_guid(%x:%x:%x:%x for_what=%x)\n", PGUID (*guid), for_what);
+  DDS_LOG(DDS_LC_DISCOVERY, "remove_deleted_participant_guid("PGUIDFMT" for_what=%x)\n", PGUID (*guid), for_what);
   ddsrt_mutex_lock (&deleted_participants_lock);
   if ((n = ddsrt_avl_lookup (&deleted_participants_treedef, &deleted_participants, guid)) != NULL)
   {
@@ -380,7 +380,7 @@ int pp_allocate_entityid(nn_entityid_t *id, unsigned kind, struct participant *p
   }
   else
   {
-    DDS_ERROR("pp_allocate_entityid(%x:%x:%x:%x): all ids in use\n", PGUID(pp->e.guid));
+    DDS_ERROR("pp_allocate_entityid("PGUIDFMT"): all ids in use\n", PGUID(pp->e.guid));
     ret = Q_ERR_OUT_OF_IDS;
   }
   ddsrt_mutex_unlock (&pp->e.lock);
@@ -431,12 +431,12 @@ int new_participant_guid (const nn_guid_t *ppguid, unsigned flags, const nn_plis
     else
     {
       ddsrt_mutex_unlock (&gv.participant_set_lock);
-      DDS_ERROR("new_participant(%x:%x:%x:%x, %x) failed: max participants reached\n", PGUID (*ppguid), flags);
+      DDS_ERROR("new_participant("PGUIDFMT", %x) failed: max participants reached\n", PGUID (*ppguid), flags);
       return Q_ERR_OUT_OF_IDS;
     }
   }
 
-  DDS_LOG(DDS_LC_DISCOVERY, "new_participant(%x:%x:%x:%x, %x)\n", PGUID (*ppguid), flags);
+  DDS_LOG(DDS_LC_DISCOVERY, "new_participant("PGUIDFMT", %x)\n", PGUID (*ppguid), flags);
 
   pp = ddsrt_malloc (sizeof (*pp));
 
@@ -454,7 +454,7 @@ int new_participant_guid (const nn_guid_t *ppguid, unsigned flags, const nn_plis
 
   if (dds_get_log_mask() & DDS_LC_DISCOVERY)
   {
-    DDS_LOG(DDS_LC_DISCOVERY, "PARTICIPANT %x:%x:%x:%x QOS={", PGUID (pp->e.guid));
+    DDS_LOG(DDS_LC_DISCOVERY, "PARTICIPANT "PGUIDFMT" QOS={", PGUID (pp->e.guid));
     nn_log_xqos(DDS_LC_DISCOVERY, &pp->plist->qos);
     DDS_LOG(DDS_LC_DISCOVERY, "}\n");
   }
@@ -692,7 +692,7 @@ static struct participant *ref_participant (struct participant *pp, const struct
     stguid = *guid_of_refing_entity;
   else
     memset (&stguid, 0, sizeof (stguid));
-  DDS_LOG(DDS_LC_DISCOVERY, "ref_participant(%x:%x:%x:%x @ %p <- %x:%x:%x:%x @ %p) user %d builtin %d\n",
+  DDS_LOG(DDS_LC_DISCOVERY, "ref_participant("PGUIDFMT" @ %p <- "PGUIDFMT" @ %p) user %"PRId32" builtin %"PRId32"\n",
           PGUID (pp->e.guid), (void*)pp, PGUID (stguid), (void*)guid_of_refing_entity, pp->user_refc, pp->builtin_refc);
   ddsrt_mutex_unlock (&pp->refc_lock);
   return pp;
@@ -733,7 +733,7 @@ static void unref_participant (struct participant *pp, const struct nn_guid *gui
     stguid = *guid_of_refing_entity;
   else
     memset (&stguid, 0, sizeof (stguid));
-  DDS_LOG(DDS_LC_DISCOVERY, "unref_participant(%x:%x:%x:%x @ %p <- %x:%x:%x:%x @ %p) user %d builtin %d\n",
+  DDS_LOG(DDS_LC_DISCOVERY, "unref_participant("PGUIDFMT" @ %p <- "PGUIDFMT" @ %p) user %"PRId32" builtin %"PRId32"\n",
           PGUID (pp->e.guid), (void*)pp, PGUID (stguid), (void*)guid_of_refing_entity, pp->user_refc, pp->builtin_refc);
 
   if (pp->user_refc == 0 && (pp->bes != 0 || pp->prismtech_bes != 0) && !pp->builtins_deleted)
@@ -845,7 +845,7 @@ static void unref_participant (struct participant *pp, const struct nn_guid *gui
 static void gc_delete_participant (struct gcreq *gcreq)
 {
   struct participant *pp = gcreq->arg;
-  DDS_LOG(DDS_LC_DISCOVERY, "gc_delete_participant(%p, %x:%x:%x:%x)\n", (void *) gcreq, PGUID (pp->e.guid));
+  DDS_LOG(DDS_LC_DISCOVERY, "gc_delete_participant(%p, "PGUIDFMT")\n", (void *) gcreq, PGUID (pp->e.guid));
   gcreq_free (gcreq);
   unref_participant (pp, NULL);
 }
@@ -1235,7 +1235,7 @@ static void rebuild_writer_addrset (struct writer *wr)
   wr->as = newas;
   unref_addrset (oldas);
 
-  DDS_LOG(DDS_LC_DISCOVERY, "rebuild_writer_addrset(%x:%x:%x:%x):", PGUID (wr->e.guid));
+  DDS_LOG(DDS_LC_DISCOVERY, "rebuild_writer_addrset("PGUIDFMT"):", PGUID (wr->e.guid));
   nn_log_addrset(DDS_LC_DISCOVERY, "", wr->as);
   DDS_LOG(DDS_LC_DISCOVERY, "\n");
 }
@@ -1461,14 +1461,14 @@ static void update_reader_init_acknack_count (const struct nn_guid *rd_guid, nn_
 
   /* Update the initial acknack sequence number for the reader.  See
      also reader_add_connection(). */
-  DDS_LOG(DDS_LC_DISCOVERY, "update_reader_init_acknack_count (%x:%x:%x:%x, %d): ", PGUID (*rd_guid), count);
+  DDS_LOG(DDS_LC_DISCOVERY, "update_reader_init_acknack_count ("PGUIDFMT", %"PRId32"): ", PGUID (*rd_guid), count);
   if ((rd = ephash_lookup_reader_guid (rd_guid)) != NULL)
   {
     ddsrt_mutex_lock (&rd->e.lock);
-    DDS_LOG(DDS_LC_DISCOVERY, "%d -> ", rd->init_acknack_count);
+    DDS_LOG(DDS_LC_DISCOVERY, "%"PRId32" -> ", rd->init_acknack_count);
     if (count > rd->init_acknack_count)
       rd->init_acknack_count = count;
-    DDS_LOG(DDS_LC_DISCOVERY, "%d\n", count);
+    DDS_LOG(DDS_LC_DISCOVERY, "%"PRId32"\n", count);
     ddsrt_mutex_unlock (&rd->e.lock);
   }
   else
@@ -1538,7 +1538,7 @@ static void writer_add_connection (struct writer *wr, struct proxy_reader *prd)
   ddsrt_mutex_lock (&prd->e.lock);
   if (prd->deleting)
   {
-    DDS_LOG(DDS_LC_DISCOVERY, "  writer_add_connection(wr %x:%x:%x:%x prd %x:%x:%x:%x) - prd is being deleted\n",
+    DDS_LOG(DDS_LC_DISCOVERY, "  writer_add_connection(wr "PGUIDFMT" prd "PGUIDFMT") - prd is being deleted\n",
             PGUID (wr->e.guid), PGUID (prd->e.guid));
     pretend_everything_acked = 1;
   }
@@ -1566,14 +1566,14 @@ static void writer_add_connection (struct writer *wr, struct proxy_reader *prd)
     m->seq = wr->seq;
   if (ddsrt_avl_lookup_ipath (&wr_readers_treedef, &wr->readers, &prd->e.guid, &path))
   {
-    DDS_LOG(DDS_LC_DISCOVERY, "  writer_add_connection(wr %x:%x:%x:%x prd %x:%x:%x:%x) - already connected\n", PGUID (wr->e.guid), PGUID (prd->e.guid));
+    DDS_LOG(DDS_LC_DISCOVERY, "  writer_add_connection(wr "PGUIDFMT" prd "PGUIDFMT") - already connected\n", PGUID (wr->e.guid), PGUID (prd->e.guid));
     ddsrt_mutex_unlock (&wr->e.lock);
     nn_lat_estim_fini (&m->hb_to_ack_latency);
     ddsrt_free (m);
   }
   else
   {
-    DDS_LOG(DDS_LC_DISCOVERY, "  writer_add_connection(wr %x:%x:%x:%x prd %x:%x:%x:%x) - ack seq %"PRId64"\n", PGUID (wr->e.guid), PGUID (prd->e.guid), m->seq);
+    DDS_LOG(DDS_LC_DISCOVERY, "  writer_add_connection(wr "PGUIDFMT" prd "PGUIDFMT") - ack seq %"PRId64"\n", PGUID (wr->e.guid), PGUID (prd->e.guid), m->seq);
     ddsrt_avl_insert_ipath (&wr_readers_treedef, &wr->readers, m, &path);
     rebuild_writer_addrset (wr);
     wr->num_reliable_readers += m->is_reliable;
@@ -1623,13 +1623,13 @@ static void writer_add_local_connection (struct writer *wr, struct reader *rd)
   ddsrt_mutex_lock (&wr->e.lock);
   if (ddsrt_avl_lookup_ipath (&wr_local_readers_treedef, &wr->local_readers, &rd->e.guid, &path))
   {
-    DDS_LOG(DDS_LC_DISCOVERY, "  writer_add_local_connection(wr %x:%x:%x:%x rd %x:%x:%x:%x) - already connected\n", PGUID (wr->e.guid), PGUID (rd->e.guid));
+    DDS_LOG(DDS_LC_DISCOVERY, "  writer_add_local_connection(wr "PGUIDFMT" rd "PGUIDFMT") - already connected\n", PGUID (wr->e.guid), PGUID (rd->e.guid));
     ddsrt_mutex_unlock (&wr->e.lock);
     ddsrt_free (m);
     return;
   }
 
-  DDS_LOG(DDS_LC_DISCOVERY, "  writer_add_local_connection(wr %x:%x:%x:%x rd %x:%x:%x:%x)", PGUID (wr->e.guid), PGUID (rd->e.guid));
+  DDS_LOG(DDS_LC_DISCOVERY, "  writer_add_local_connection(wr "PGUIDFMT" rd "PGUIDFMT")", PGUID (wr->e.guid), PGUID (rd->e.guid));
   m->rd_guid = rd->e.guid;
   ddsrt_avl_insert_ipath (&wr_local_readers_treedef, &wr->local_readers, m, &path);
   local_reader_ary_insert (&wr->rdary, rd);
@@ -1684,19 +1684,19 @@ static void reader_add_connection (struct reader *rd, struct proxy_writer *pwr,
      writer will always see monotonically increasing sequence numbers
      from one particular reader.  This is then used for the
      pwr_rd_match initialization */
-  DDS_LOG(DDS_LC_DISCOVERY, "  reader %x:%x:%x:%x init_acknack_count = %d\n", PGUID (rd->e.guid), rd->init_acknack_count);
+  DDS_LOG(DDS_LC_DISCOVERY, "  reader "PGUIDFMT" init_acknack_count = %"PRId32"\n", PGUID (rd->e.guid), rd->init_acknack_count);
   *init_count = rd->init_acknack_count;
 
   if (ddsrt_avl_lookup_ipath (&rd_writers_treedef, &rd->writers, &pwr->e.guid, &path))
   {
-    DDS_LOG(DDS_LC_DISCOVERY, "  reader_add_connection(pwr %x:%x:%x:%x rd %x:%x:%x:%x) - already connected\n",
+    DDS_LOG(DDS_LC_DISCOVERY, "  reader_add_connection(pwr "PGUIDFMT" rd "PGUIDFMT") - already connected\n",
             PGUID (pwr->e.guid), PGUID (rd->e.guid));
     ddsrt_mutex_unlock (&rd->e.lock);
     ddsrt_free (m);
   }
   else
   {
-    DDS_LOG(DDS_LC_DISCOVERY, "  reader_add_connection(pwr %x:%x:%x:%x rd %x:%x:%x:%x)\n",
+    DDS_LOG(DDS_LC_DISCOVERY, "  reader_add_connection(pwr "PGUIDFMT" rd "PGUIDFMT")\n",
             PGUID (pwr->e.guid), PGUID (rd->e.guid));
     ddsrt_avl_insert_ipath (&rd_writers_treedef, &rd->writers, m, &path);
     ddsrt_mutex_unlock (&rd->e.lock);
@@ -1744,13 +1744,13 @@ static void reader_add_local_connection (struct reader *rd, struct writer *wr)
 
   if (ddsrt_avl_lookup_ipath (&rd_local_writers_treedef, &rd->local_writers, &wr->e.guid, &path))
   {
-    DDS_LOG(DDS_LC_DISCOVERY, "  reader_add_local_connection(wr %x:%x:%x:%x rd %x:%x:%x:%x) - already connected\n", PGUID (wr->e.guid), PGUID (rd->e.guid));
+    DDS_LOG(DDS_LC_DISCOVERY, "  reader_add_local_connection(wr "PGUIDFMT" rd "PGUIDFMT") - already connected\n", PGUID (wr->e.guid), PGUID (rd->e.guid));
     ddsrt_mutex_unlock (&rd->e.lock);
     ddsrt_free (m);
   }
   else
   {
-    DDS_LOG(DDS_LC_DISCOVERY, "  reader_add_local_connection(wr %x:%x:%x:%x rd %x:%x:%x:%x)\n", PGUID (wr->e.guid), PGUID (rd->e.guid));
+    DDS_LOG(DDS_LC_DISCOVERY, "  reader_add_local_connection(wr "PGUIDFMT" rd "PGUIDFMT")\n", PGUID (wr->e.guid), PGUID (rd->e.guid));
     ddsrt_avl_insert_ipath (&rd_local_writers_treedef, &rd->local_writers, m, &path);
     ddsrt_mutex_unlock (&rd->e.lock);
 
@@ -1787,7 +1787,7 @@ static void proxy_writer_add_connection (struct proxy_writer *pwr, struct reader
     pwr->ddsi2direct_cbarg = rd->ddsi2direct_cbarg;
   }
 
-  DDS_LOG(DDS_LC_DISCOVERY, "  proxy_writer_add_connection(pwr %x:%x:%x:%x rd %x:%x:%x:%x)",
+  DDS_LOG(DDS_LC_DISCOVERY, "  proxy_writer_add_connection(pwr "PGUIDFMT" rd "PGUIDFMT")",
           PGUID (pwr->e.guid), PGUID (rd->e.guid));
   m->rd_guid = rd->e.guid;
   m->tcreate = now_mt ();
@@ -1880,7 +1880,7 @@ static void proxy_writer_add_connection (struct proxy_writer *pwr, struct reader
 
 already_matched:
   assert (is_builtin_entityid (pwr->e.guid.entityid, pwr->c.vendor) ? (pwr->c.topic == NULL) : (pwr->c.topic != NULL));
-  DDS_LOG(DDS_LC_DISCOVERY, "  proxy_writer_add_connection(pwr %x:%x:%x:%x rd %x:%x:%x:%x) - already connected\n",
+  DDS_LOG(DDS_LC_DISCOVERY, "  proxy_writer_add_connection(pwr "PGUIDFMT" rd "PGUIDFMT") - already connected\n",
           PGUID (pwr->e.guid), PGUID (rd->e.guid));
   ddsrt_mutex_unlock (&pwr->e.lock);
   ddsrt_free (m);
@@ -1898,14 +1898,14 @@ static void proxy_reader_add_connection (struct proxy_reader *prd, struct writer
     prd->c.topic = ddsi_sertopic_ref (wr->topic);
   if (ddsrt_avl_lookup_ipath (&prd_writers_treedef, &prd->writers, &wr->e.guid, &path))
   {
-    DDS_LOG(DDS_LC_DISCOVERY, "  proxy_reader_add_connection(wr %x:%x:%x:%x prd %x:%x:%x:%x) - already connected\n",
+    DDS_LOG(DDS_LC_DISCOVERY, "  proxy_reader_add_connection(wr "PGUIDFMT" prd "PGUIDFMT") - already connected\n",
             PGUID (wr->e.guid), PGUID (prd->e.guid));
     ddsrt_mutex_unlock (&prd->e.lock);
     ddsrt_free (m);
   }
   else
   {
-    DDS_LOG(DDS_LC_DISCOVERY, "  proxy_reader_add_connection(wr %x:%x:%x:%x prd %x:%x:%x:%x)\n",
+    DDS_LOG(DDS_LC_DISCOVERY, "  proxy_reader_add_connection(wr "PGUIDFMT" prd "PGUIDFMT")\n",
             PGUID (wr->e.guid), PGUID (prd->e.guid));
     ddsrt_avl_insert_ipath (&prd_writers_treedef, &prd->writers, m, &path);
     ddsrt_mutex_unlock (&prd->e.lock);
@@ -2259,7 +2259,7 @@ static void generic_do_match (struct entity_common *e, nn_mtime_t tnow)
   enum entity_kind mkind = generic_do_match_mkind(e->kind);
   if (!is_builtin_entityid (e->guid.entityid, NN_VENDORID_ECLIPSE))
   {
-    DDS_LOG(DDS_LC_DISCOVERY, "match_%s_with_%ss(%s %x:%x:%x:%x) scanning all %ss\n",
+    DDS_LOG(DDS_LC_DISCOVERY, "match_%s_with_%ss(%s "PGUIDFMT") scanning all %ss\n",
             generic_do_match_kindstr_us (e->kind), generic_do_match_kindstr_us (mkind),
             generic_do_match_kindabbrev (e->kind), PGUID (e->guid),
             generic_do_match_kindstr(mkind));
@@ -2280,7 +2280,7 @@ static void generic_do_match (struct entity_common *e, nn_mtime_t tnow)
     /* Built-ins have fixed QoS */
     nn_entityid_t tgt_ent = builtin_entityid_match (e->guid.entityid);
     enum entity_kind pkind = generic_do_match_isproxy (e) ? EK_PARTICIPANT : EK_PROXY_PARTICIPANT;
-    DDS_LOG(DDS_LC_DISCOVERY, "match_%s_with_%ss(%s %x:%x:%x:%x) scanning %sparticipants tgt=%x\n",
+    DDS_LOG(DDS_LC_DISCOVERY, "match_%s_with_%ss(%s "PGUIDFMT") scanning %sparticipants tgt=%"PRIx32"\n",
             generic_do_match_kindstr_us (e->kind), generic_do_match_kindstr_us (mkind),
             generic_do_match_kindabbrev (e->kind), PGUID (e->guid),
             generic_do_match_isproxy (e) ? "" : "proxy ",
@@ -2311,7 +2311,7 @@ static void generic_do_local_match (struct entity_common *e, nn_mtime_t tnow)
     /* never a need for local matches on discovery endpoints */
     return;
   mkind = generic_do_local_match_mkind(e->kind);
-  DDS_LOG(DDS_LC_DISCOVERY, "match_%s_with_%ss(%s %x:%x:%x:%x) scanning all %ss\n",
+  DDS_LOG(DDS_LC_DISCOVERY, "match_%s_with_%ss(%s "PGUIDFMT") scanning all %ss\n",
           generic_do_match_kindstr_us (e->kind), generic_do_match_kindstr_us (mkind),
           generic_do_match_kindabbrev (e->kind), PGUID (e->guid),
           generic_do_match_kindstr(mkind));
@@ -2378,7 +2378,7 @@ static void new_reader_writer_common (const struct nn_guid *guid, const struct d
     if (xqos->partition.n > 1)
       partition_suffix = "+";
   }
-  DDS_LOG(DDS_LC_DISCOVERY, "new_%s(guid %x:%x:%x:%x, %s%s.%s/%s)\n",
+  DDS_LOG(DDS_LC_DISCOVERY, "new_%s(guid "PGUIDFMT", %s%s.%s/%s)\n",
           is_writer_entityid (guid->entityid) ? "writer" : "reader",
           PGUID (*guid),
           partition, partition_suffix,
@@ -2607,7 +2607,7 @@ unsigned remove_acked_messages (struct writer *wr, struct whc_state *whcst, stru
     writer_clear_retransmitting (wr);
   if (wr->state == WRST_LINGERING && whcst->unacked_bytes == 0)
   {
-    DDS_LOG(DDS_LC_DISCOVERY, "remove_acked_messages: deleting lingering writer %x:%x:%x:%x\n", PGUID (wr->e.guid));
+    DDS_LOG(DDS_LC_DISCOVERY, "remove_acked_messages: deleting lingering writer "PGUIDFMT"\n", PGUID (wr->e.guid));
     delete_writer_nolinger_locked (wr);
   }
   return n;
@@ -2646,7 +2646,7 @@ static void new_writer_guid_common_init (struct writer *wr, const struct ddsi_se
   assert (wr->xqos->aliased == 0);
   set_topic_type_name (wr->xqos, topic);
 
-  DDS_LOG(DDS_LC_DISCOVERY, "WRITER %x:%x:%x:%x QOS={", PGUID (wr->e.guid));
+  DDS_LOG(DDS_LC_DISCOVERY, "WRITER "PGUIDFMT" QOS={", PGUID (wr->e.guid));
   nn_log_xqos (DDS_LC_DISCOVERY, wr->xqos);
   DDS_LOG(DDS_LC_DISCOVERY, "}\n");
 
@@ -2738,7 +2738,7 @@ static void new_writer_guid_common_init (struct writer *wr, const struct ddsi_se
       wr->supports_ssm = 1;
       wr->ssm_as = new_addrset ();
       add_to_addrset (wr->ssm_as, &loc);
-      DDS_LOG(DDS_LC_DISCOVERY, "writer %x:%x:%x:%x: ssm=%d", PGUID (wr->e.guid), wr->supports_ssm);
+      DDS_LOG(DDS_LC_DISCOVERY, "writer "PGUIDFMT": ssm=%d", PGUID (wr->e.guid), wr->supports_ssm);
       nn_log_addrset (DDS_LC_DISCOVERY, "", wr->ssm_as);
       DDS_LOG(DDS_LC_DISCOVERY, "\n");
     }
@@ -2751,7 +2751,7 @@ static void new_writer_guid_common_init (struct writer *wr, const struct ddsi_se
   if (!is_builtin_entityid (wr->e.guid.entityid, ownvendorid))
   {
     struct config_channel_listelem *channel = find_channel (wr->xqos->transport_priority);
-    DDS_LOG(DDS_LC_DISCOVERY, "writer %x:%x:%x:%x: transport priority %d => channel '%s' priority %d\n",
+    DDS_LOG(DDS_LC_DISCOVERY, "writer "PGUIDFMT": transport priority %d => channel '%s' priority %d\n",
             PGUID (wr->e.guid), wr->xqos->transport_priority.value, channel->name, channel->priority);
     wr->evq = channel->evq ? channel->evq : gv.xevents;
   }
@@ -2779,7 +2779,7 @@ static void new_writer_guid_common_init (struct writer *wr, const struct ddsi_se
   if (wr->xqos->liveliness.kind != NN_AUTOMATIC_LIVELINESS_QOS ||
       nn_from_ddsi_duration (wr->xqos->liveliness.lease_duration) != T_NEVER)
   {
-    DDS_LOG(DDS_LC_DISCOVERY, "writer %x:%x:%x:%x: incorrectly treating it as of automatic liveliness kind with lease duration = inf (%d, %"PRId64")\n", PGUID (wr->e.guid), (int) wr->xqos->liveliness.kind, nn_from_ddsi_duration (wr->xqos->liveliness.lease_duration));
+    DDS_LOG(DDS_LC_DISCOVERY, "writer "PGUIDFMT": incorrectly treating it as of automatic liveliness kind with lease duration = inf (%d, %"PRId64")\n", PGUID (wr->e.guid), (int) wr->xqos->liveliness.kind, nn_from_ddsi_duration (wr->xqos->liveliness.lease_duration));
   }
   wr->lease_duration = T_NEVER; /* FIXME */
 
@@ -2862,7 +2862,7 @@ dds_retcode_t new_writer (struct writer **wr_out, struct nn_guid *wrguid, const
 
   if ((pp = ephash_lookup_participant_guid (ppguid)) == NULL)
   {
-    DDS_LOG(DDS_LC_DISCOVERY, "new_writer - participant %x:%x:%x:%x not found\n", PGUID (*ppguid));
+    DDS_LOG(DDS_LC_DISCOVERY, "new_writer - participant "PGUIDFMT" not found\n", PGUID (*ppguid));
     return DDS_RETCODE_NOT_FOUND;
   }
   /* participant can't be freed while we're mucking around cos we are
@@ -2900,7 +2900,7 @@ struct local_orphan_writer *new_local_orphan_writer (nn_entityid_t entityid, str
 static void gc_delete_writer (struct gcreq *gcreq)
 {
   struct writer *wr = gcreq->arg;
-  DDS_LOG(DDS_LC_DISCOVERY, "gc_delete_writer(%p, %x:%x:%x:%x)\n", (void *) gcreq, PGUID (wr->e.guid));
+  DDS_LOG(DDS_LC_DISCOVERY, "gc_delete_writer(%p, "PGUIDFMT")\n", (void *) gcreq, PGUID (wr->e.guid));
   gcreq_free (gcreq);
 
   /* We now allow GC while blocked on a full WHC, but we still don't allow deleting a writer while blocked on it. The writer's state must be DELETING by the time we get here, and that means the transmit path is no longer blocked. It doesn't imply that the write thread is no longer in throttle_writer(), just that if it is, it will soon return from there. Therefore, block until it isn't throttling anymore. We can safely lock the writer, as we're on the separate GC thread. */
@@ -2959,7 +2959,7 @@ static void gc_delete_writer (struct gcreq *gcreq)
 static void gc_delete_writer_throttlewait (struct gcreq *gcreq)
 {
   struct writer *wr = gcreq->arg;
-  DDS_LOG(DDS_LC_DISCOVERY, "gc_delete_writer_throttlewait(%p, %x:%x:%x:%x)\n", (void *) gcreq, PGUID (wr->e.guid));
+  DDS_LOG(DDS_LC_DISCOVERY, "gc_delete_writer_throttlewait(%p, "PGUIDFMT")\n", (void *) gcreq, PGUID (wr->e.guid));
   /* We now allow GC while blocked on a full WHC, but we still don't allow deleting a writer while blocked on it. The writer's state must be DELETING by the time we get here, and that means the transmit path is no longer blocked. It doesn't imply that the write thread is no longer in throttle_writer(), just that if it is, it will soon return from there. Therefore, block until it isn't throttling anymore. We can safely lock the writer, as we're on the separate GC thread. */
   assert (wr->state == WRST_DELETING);
   ddsrt_mutex_lock (&wr->e.lock);
@@ -2972,7 +2972,7 @@ static void gc_delete_writer_throttlewait (struct gcreq *gcreq)
 static void writer_set_state (struct writer *wr, enum writer_state newstate)
 {
   ASSERT_MUTEX_HELD (&wr->e.lock);
-  DDS_LOG(DDS_LC_DISCOVERY, "writer_set_state(%x:%x:%x:%x) state transition %d -> %d\n", PGUID (wr->e.guid), wr->state, newstate);
+  DDS_LOG(DDS_LC_DISCOVERY, "writer_set_state("PGUIDFMT") state transition %d -> %d\n", PGUID (wr->e.guid), wr->state, newstate);
   assert (newstate > wr->state);
   if (wr->state == WRST_OPERATIONAL)
   {
@@ -2989,7 +2989,7 @@ static void writer_set_state (struct writer *wr, enum writer_state newstate)
 
 int delete_writer_nolinger_locked (struct writer *wr)
 {
-  DDS_LOG(DDS_LC_DISCOVERY, "delete_writer_nolinger(guid %x:%x:%x:%x) ...\n", PGUID (wr->e.guid));
+  DDS_LOG(DDS_LC_DISCOVERY, "delete_writer_nolinger(guid "PGUIDFMT") ...\n", PGUID (wr->e.guid));
   ASSERT_MUTEX_HELD (&wr->e.lock);
   ddsi_plugin.builtintopic_write (&wr->e, now(), false);
   local_reader_ary_setinvalid (&wr->rdary);
@@ -3011,10 +3011,10 @@ int delete_writer_nolinger (const struct nn_guid *guid)
   assert (is_writer_entityid (guid->entityid));
   if ((wr = ephash_lookup_writer_guid (guid)) == NULL)
   {
-    DDS_LOG(DDS_LC_DISCOVERY, "delete_writer_nolinger(guid %x:%x:%x:%x) - unknown guid\n", PGUID (*guid));
+    DDS_LOG(DDS_LC_DISCOVERY, "delete_writer_nolinger(guid "PGUIDFMT") - unknown guid\n", PGUID (*guid));
     return Q_ERR_UNKNOWN_ENTITY;
   }
-  DDS_LOG(DDS_LC_DISCOVERY, "delete_writer_nolinger(guid %x:%x:%x:%x) ...\n", PGUID (*guid));
+  DDS_LOG(DDS_LC_DISCOVERY, "delete_writer_nolinger(guid "PGUIDFMT") ...\n", PGUID (*guid));
   ddsrt_mutex_lock (&wr->e.lock);
   delete_writer_nolinger_locked (wr);
   ddsrt_mutex_unlock (&wr->e.lock);
@@ -3034,10 +3034,10 @@ int delete_writer (const struct nn_guid *guid)
   struct whc_state whcst;
   if ((wr = ephash_lookup_writer_guid (guid)) == NULL)
   {
-    DDS_LOG(DDS_LC_DISCOVERY, "delete_writer(guid %x:%x:%x:%x) - unknown guid\n", PGUID (*guid));
+    DDS_LOG(DDS_LC_DISCOVERY, "delete_writer(guid "PGUIDFMT") - unknown guid\n", PGUID (*guid));
     return Q_ERR_UNKNOWN_ENTITY;
   }
-  DDS_LOG(DDS_LC_DISCOVERY, "delete_writer(guid %x:%x:%x:%x) ...\n", PGUID (*guid));
+  DDS_LOG(DDS_LC_DISCOVERY, "delete_writer(guid "PGUIDFMT") ...\n", PGUID (*guid));
   ddsrt_mutex_lock (&wr->e.lock);
 
   /* If no unack'ed data, don't waste time or resources (expected to
@@ -3047,7 +3047,7 @@ int delete_writer (const struct nn_guid *guid)
   whc_get_state(wr->whc, &whcst);
   if (whcst.unacked_bytes == 0)
   {
-    DDS_LOG(DDS_LC_DISCOVERY, "delete_writer(guid %x:%x:%x:%x) - no unack'ed samples\n", PGUID (*guid));
+    DDS_LOG(DDS_LC_DISCOVERY, "delete_writer(guid "PGUIDFMT") - no unack'ed samples\n", PGUID (*guid));
     delete_writer_nolinger_locked (wr);
     ddsrt_mutex_unlock (&wr->e.lock);
   }
@@ -3059,7 +3059,7 @@ int delete_writer (const struct nn_guid *guid)
     ddsrt_mutex_unlock (&wr->e.lock);
     tsched = add_duration_to_mtime (now_mt (), config.writer_linger_duration);
     mtime_to_sec_usec (&tsec, &tusec, tsched);
-    DDS_LOG(DDS_LC_DISCOVERY, "delete_writer(guid %x:%x:%x:%x) - unack'ed samples, will delete when ack'd or at t = %"PRId32".%06"PRId32"\n",
+    DDS_LOG(DDS_LC_DISCOVERY, "delete_writer(guid "PGUIDFMT") - unack'ed samples, will delete when ack'd or at t = %"PRId32".%06"PRId32"\n",
             PGUID (*guid), tsec, tusec);
     qxev_delete_writer (tsched, &wr->e.guid);
   }
@@ -3078,7 +3078,7 @@ void writer_exit_startup_mode (struct writer *wr)
     cnt += remove_acked_messages (wr, &whcst, &deferred_free_list);
     cnt += whc_downgrade_to_volatile (wr->whc, &whcst);
     writer_clear_retransmitting (wr);
-    DDS_LOG(DDS_LC_DISCOVERY, "  %x:%x:%x:%x: dropped %u samples\n", PGUID(wr->e.guid), cnt);
+    DDS_LOG(DDS_LC_DISCOVERY, "  "PGUIDFMT": dropped %u samples\n", PGUID(wr->e.guid), cnt);
   }
   ddsrt_mutex_unlock (&wr->e.lock);
   whc_free_deferred_free_list (wr->whc, deferred_free_list);
@@ -3237,7 +3237,7 @@ static dds_retcode_t new_reader_guid
 
   if (dds_get_log_mask() & DDS_LC_DISCOVERY)
   {
-    DDS_LOG(DDS_LC_DISCOVERY, "READER %x:%x:%x:%x QOS={", PGUID (rd->e.guid));
+    DDS_LOG(DDS_LC_DISCOVERY, "READER "PGUIDFMT" QOS={", PGUID (rd->e.guid));
     nn_log_xqos (DDS_LC_DISCOVERY, rd->xqos);
     DDS_LOG(DDS_LC_DISCOVERY, "}\n");
   }
@@ -3268,7 +3268,7 @@ static dds_retcode_t new_reader_guid
   if (rd->xqos->liveliness.kind != NN_AUTOMATIC_LIVELINESS_QOS ||
       nn_from_ddsi_duration (rd->xqos->liveliness.lease_duration) != T_NEVER)
   {
-    DDS_LOG(DDS_LC_DISCOVERY, "reader %x:%x:%x:%x: incorrectly treating it as of automatic liveliness kind with lease duration = inf (%d, %"PRId64")\n", PGUID (rd->e.guid), (int) rd->xqos->liveliness.kind, nn_from_ddsi_duration (rd->xqos->liveliness.lease_duration));
+    DDS_LOG(DDS_LC_DISCOVERY, "reader "PGUIDFMT": incorrectly treating it as of automatic liveliness kind with lease duration = inf (%d, %"PRId64")\n", PGUID (rd->e.guid), (int) rd->xqos->liveliness.kind, nn_from_ddsi_duration (rd->xqos->liveliness.lease_duration));
   }
 
 #ifdef DDSI_INCLUDE_NETWORK_PARTITIONS
@@ -3302,7 +3302,7 @@ static dds_retcode_t new_reader_guid
       addrset_forall (rd->as, join_mcast_helper, gv.data_conn_mc);
       if (dds_get_log_mask() & DDS_LC_DISCOVERY)
       {
-        DDS_LOG(DDS_LC_DISCOVERY, "READER %x:%x:%x:%x locators={", PGUID (rd->e.guid));
+        DDS_LOG(DDS_LC_DISCOVERY, "READER "PGUIDFMT" locators={", PGUID (rd->e.guid));
         nn_log_addrset(DDS_LC_DISCOVERY, "", rd->as);
         DDS_LOG(DDS_LC_DISCOVERY, "}\n");
       }
@@ -3320,7 +3320,7 @@ static dds_retcode_t new_reader_guid
   }
 #ifdef DDSI_INCLUDE_SSM
   if (rd->favours_ssm)
-    DDS_LOG(DDS_LC_DISCOVERY, "READER %x:%x:%x:%x ssm=%d\n", PGUID (rd->e.guid), rd->favours_ssm);
+    DDS_LOG(DDS_LC_DISCOVERY, "READER "PGUIDFMT" ssm=%d\n", PGUID (rd->e.guid), rd->favours_ssm);
 #endif
 #endif
 
@@ -3355,7 +3355,7 @@ dds_retcode_t new_reader
 
   if ((pp = ephash_lookup_participant_guid (ppguid)) == NULL)
   {
-    DDS_LOG(DDS_LC_DISCOVERY, "new_reader - participant %x:%x:%x:%x not found\n", PGUID (*ppguid));
+    DDS_LOG(DDS_LC_DISCOVERY, "new_reader - participant "PGUIDFMT" not found\n", PGUID (*ppguid));
     return DDS_RETCODE_NOT_FOUND;
   }
   rdguid->prefix = pp->e.guid.prefix;
@@ -3368,7 +3368,7 @@ static void gc_delete_reader (struct gcreq *gcreq)
 {
   /* see gc_delete_writer for comments */
   struct reader *rd = gcreq->arg;
-  DDS_LOG(DDS_LC_DISCOVERY, "gc_delete_reader(%p, %x:%x:%x:%x)\n", (void *) gcreq, PGUID (rd->e.guid));
+  DDS_LOG(DDS_LC_DISCOVERY, "gc_delete_reader(%p, "PGUIDFMT")\n", (void *) gcreq, PGUID (rd->e.guid));
   gcreq_free (gcreq);
 
   while (!ddsrt_avl_is_empty (&rd->writers))
@@ -3417,10 +3417,10 @@ int delete_reader (const struct nn_guid *guid)
   assert (!is_writer_entityid (guid->entityid));
   if ((rd = ephash_lookup_reader_guid (guid)) == NULL)
   {
-    DDS_LOG(DDS_LC_DISCOVERY, "delete_reader_guid(guid %x:%x:%x:%x) - unknown guid\n", PGUID (*guid));
+    DDS_LOG(DDS_LC_DISCOVERY, "delete_reader_guid(guid "PGUIDFMT") - unknown guid\n", PGUID (*guid));
     return Q_ERR_UNKNOWN_ENTITY;
   }
-  DDS_LOG(DDS_LC_DISCOVERY, "delete_reader_guid(guid %x:%x:%x:%x) ...\n", PGUID (*guid));
+  DDS_LOG(DDS_LC_DISCOVERY, "delete_reader_guid(guid "PGUIDFMT") ...\n", PGUID (*guid));
   ddsi_plugin.builtintopic_write (&rd->e, now(), false);
   ephash_remove_reader_guid (rd);
   gcreq_reader (rd);
@@ -3754,7 +3754,7 @@ static void unref_proxy_participant (struct proxy_participant *proxypp, struct p
   {
     assert (proxypp->endpoints == NULL);
     ddsrt_mutex_unlock (&proxypp->e.lock);
-    DDS_LOG(DDS_LC_DISCOVERY, "unref_proxy_participant(%x:%x:%x:%x): refc=0, freeing\n", PGUID (proxypp->e.guid));
+    DDS_LOG(DDS_LC_DISCOVERY, "unref_proxy_participant("PGUIDFMT"): refc=0, freeing\n", PGUID (proxypp->e.guid));
 
 
     unref_addrset (proxypp->as_default);
@@ -3771,7 +3771,7 @@ static void unref_proxy_participant (struct proxy_participant *proxypp, struct p
   {
     assert (refc == 1);
     ddsrt_mutex_unlock (&proxypp->e.lock);
-    DDS_LOG(DDS_LC_DISCOVERY, "unref_proxy_participant(%x:%x:%x:%x): refc=%u, no endpoints, implicitly created, deleting\n", PGUID (proxypp->e.guid), (unsigned) refc);
+    DDS_LOG(DDS_LC_DISCOVERY, "unref_proxy_participant("PGUIDFMT"): refc=%u, no endpoints, implicitly created, deleting\n", PGUID (proxypp->e.guid), (unsigned) refc);
     delete_proxy_participant_by_guid(&proxypp->e.guid, tnow, 1);
     /* Deletion is still (and has to be) asynchronous. A parallel endpoint creation may or may not
        succeed, and if it succeeds it will be deleted along with the proxy participant. So "your
@@ -3780,14 +3780,14 @@ static void unref_proxy_participant (struct proxy_participant *proxypp, struct p
   else
   {
     ddsrt_mutex_unlock (&proxypp->e.lock);
-    DDS_LOG(DDS_LC_DISCOVERY, "unref_proxy_participant(%x:%x:%x:%x): refc=%u\n", PGUID (proxypp->e.guid), (unsigned) refc);
+    DDS_LOG(DDS_LC_DISCOVERY, "unref_proxy_participant("PGUIDFMT"): refc=%u\n", PGUID (proxypp->e.guid), (unsigned) refc);
   }
 }
 
 static void gc_delete_proxy_participant (struct gcreq *gcreq)
 {
   struct proxy_participant *proxypp = gcreq->arg;
-  DDS_LOG(DDS_LC_DISCOVERY, "gc_delete_proxy_participant(%p, %x:%x:%x:%x)\n", (void *) gcreq, PGUID (proxypp->e.guid));
+  DDS_LOG(DDS_LC_DISCOVERY, "gc_delete_proxy_participant(%p, "PGUIDFMT")\n", (void *) gcreq, PGUID (proxypp->e.guid));
   gcreq_free (gcreq);
   unref_proxy_participant (proxypp, NULL);
 }
@@ -3820,7 +3820,7 @@ static void delete_or_detach_dependent_pp (struct proxy_participant *p, struct p
   {
     nn_etime_t texp = add_duration_to_etime (now_et(), config.ds_grace_period);
     /* Clear dependency (but don't touch entity id, which must be 0x1c1) and set the lease ticking */
-    DDS_LOG(DDS_LC_DISCOVERY, "%x:%x:%x:%x detach-from-DS %x:%x:%x:%x\n", PGUID(p->e.guid), PGUID(proxypp->e.guid));
+    DDS_LOG(DDS_LC_DISCOVERY, PGUIDFMT" detach-from-DS "PGUIDFMT"\n", PGUID(p->e.guid), PGUID(proxypp->e.guid));
     memset (&p->privileged_pp_guid.prefix, 0, sizeof (p->privileged_pp_guid.prefix));
     lease_set_expiry (ddsrt_atomic_ldvoidp (&p->lease), texp);
     ddsrt_mutex_unlock (&p->e.lock);
@@ -3833,7 +3833,7 @@ static void delete_ppt (struct proxy_participant * proxypp, nn_wctime_t timestam
   int ret;
 
   /* if any proxy participants depend on this participant, delete them */
-  DDS_LOG(DDS_LC_DISCOVERY, "delete_ppt(%x:%x:%x:%x) - deleting dependent proxy participants\n", PGUID (proxypp->e.guid));
+  DDS_LOG(DDS_LC_DISCOVERY, "delete_ppt("PGUIDFMT") - deleting dependent proxy participants\n", PGUID (proxypp->e.guid));
   {
     struct ephash_enum_proxy_participant est;
     struct proxy_participant *p;
@@ -3850,11 +3850,11 @@ static void delete_ppt (struct proxy_participant * proxypp, nn_wctime_t timestam
   if (isimplicit)
     proxypp->lease_expired = 1;
 
-  DDS_LOG(DDS_LC_DISCOVERY, "delete_ppt(%x:%x:%x:%x) - deleting groups\n", PGUID (proxypp->e.guid));
+  DDS_LOG(DDS_LC_DISCOVERY, "delete_ppt("PGUIDFMT") - deleting groups\n", PGUID (proxypp->e.guid));
   while (!ddsrt_avl_is_empty (&proxypp->groups))
     delete_proxy_group_locked (ddsrt_avl_root (&proxypp_groups_treedef, &proxypp->groups), timestamp, isimplicit);
 
-  DDS_LOG(DDS_LC_DISCOVERY, "delete_ppt(%x:%x:%x:%x) - deleting endpoints\n", PGUID (proxypp->e.guid));
+  DDS_LOG(DDS_LC_DISCOVERY, "delete_ppt("PGUIDFMT") - deleting endpoints\n", PGUID (proxypp->e.guid));
   c = proxypp->endpoints;
   while (c)
   {
@@ -3915,7 +3915,7 @@ int delete_proxy_participant_by_guid (const struct nn_guid * guid, nn_wctime_t t
 {
   struct proxy_participant * ppt;
 
-  DDS_LOG(DDS_LC_DISCOVERY, "delete_proxy_participant_by_guid(%x:%x:%x:%x) ", PGUID (*guid));
+  DDS_LOG(DDS_LC_DISCOVERY, "delete_proxy_participant_by_guid("PGUIDFMT") ", PGUID (*guid));
   ddsrt_mutex_lock (&gv.lock);
   ppt = ephash_lookup_proxy_participant_guid (guid);
   if (ppt == NULL)
@@ -3959,7 +3959,7 @@ int new_proxy_group (const struct nn_guid *guid, const char *name, const struct
   ppguid.entityid.u = NN_ENTITYID_PARTICIPANT;
   if ((proxypp = ephash_lookup_proxy_participant_guid (&ppguid)) == NULL)
   {
-    DDS_LOG(DDS_LC_DISCOVERY, "new_proxy_group(%x:%x:%x:%x) - unknown participant\n", PGUID (*guid));
+    DDS_LOG(DDS_LC_DISCOVERY, "new_proxy_group("PGUIDFMT") - unknown participant\n", PGUID (*guid));
     return 0;
   }
   else
@@ -3976,7 +3976,7 @@ int new_proxy_group (const struct nn_guid *guid, const char *name, const struct
         is_sub = 1;
         break;
       default:
-        DDS_WARNING("new_proxy_group: unrecognised entityid: %x\n", guid->entityid.u);
+        DDS_WARNING("new_proxy_group: unrecognised entityid: %"PRIx32"\n", guid->entityid.u);
         return Q_ERR_INVALID_DATA;
     }
     ddsrt_mutex_lock (&proxypp->e.lock);
@@ -3991,7 +3991,7 @@ int new_proxy_group (const struct nn_guid *guid, const char *name, const struct
     else
     {
       /* Always have a guid, may not have a gid */
-      DDS_LOG(DDS_LC_DISCOVERY, "new_proxy_group(%x:%x:%x:%x): new\n", PGUID (*guid));
+      DDS_LOG(DDS_LC_DISCOVERY, "new_proxy_group("PGUIDFMT"): new\n", PGUID (*guid));
       pgroup = ddsrt_malloc (sizeof (*pgroup));
       pgroup->guid = *guid;
       pgroup->proxypp = proxypp;
@@ -4002,7 +4002,7 @@ int new_proxy_group (const struct nn_guid *guid, const char *name, const struct
     if (name)
     {
       assert (xqos != NULL);
-      DDS_LOG(DDS_LC_DISCOVERY, "new_proxy_group(%x:%x:%x:%x): setting name (%s) and qos\n", PGUID (*guid), name);
+      DDS_LOG(DDS_LC_DISCOVERY, "new_proxy_group("PGUIDFMT"): setting name (%s) and qos\n", PGUID (*guid), name);
       pgroup->name = ddsrt_strdup (name);
       pgroup->xqos = nn_xqos_dup (xqos);
       nn_xqos_mergein_missing (pgroup->xqos, is_sub ? &gv.default_xqos_sub : &gv.default_xqos_pub);
@@ -4020,7 +4020,7 @@ static void delete_proxy_group_locked (struct proxy_group *pgroup, nn_wctime_t t
   (void)timestamp;
   (void)isimplicit;
   assert ((pgroup->xqos != NULL) == (pgroup->name != NULL));
-  DDS_LOG(DDS_LC_DISCOVERY, "delete_proxy_group_locked %x:%x:%x:%x\n", PGUID (pgroup->guid));
+  DDS_LOG(DDS_LC_DISCOVERY, "delete_proxy_group_locked "PGUIDFMT"\n", PGUID (pgroup->guid));
   ddsrt_avl_delete (&proxypp_groups_treedef, &proxypp->groups, pgroup);
   /* Publish corresponding built-in topic only if it is not a place
      holder: in that case we haven't announced its presence and
@@ -4105,7 +4105,7 @@ int new_proxy_writer (const struct nn_guid *ppguid, const struct nn_guid *guid,
 
   if ((proxypp = ephash_lookup_proxy_participant_guid (ppguid)) == NULL)
   {
-    DDS_WARNING("new_proxy_writer(%x:%x:%x:%x): proxy participant unknown\n", PGUID (*guid));
+    DDS_WARNING("new_proxy_writer("PGUIDFMT"): proxy participant unknown\n", PGUID (*guid));
     return Q_ERR_UNKNOWN_ENTITY;
   }
 
@@ -4277,7 +4277,7 @@ void update_proxy_reader (struct proxy_reader * prd, struct addrset * as)
 static void gc_delete_proxy_writer (struct gcreq *gcreq)
 {
   struct proxy_writer *pwr = gcreq->arg;
-  DDS_LOG(DDS_LC_DISCOVERY, "gc_delete_proxy_writer(%p, %x:%x:%x:%x)\n", (void *) gcreq, PGUID (pwr->e.guid));
+  DDS_LOG(DDS_LC_DISCOVERY, "gc_delete_proxy_writer(%p, "PGUIDFMT")\n", (void *) gcreq, PGUID (pwr->e.guid));
   gcreq_free (gcreq);
 
   while (!ddsrt_avl_is_empty (&pwr->readers))
@@ -4299,7 +4299,7 @@ int delete_proxy_writer (const struct nn_guid *guid, nn_wctime_t timestamp, int
 {
   struct proxy_writer *pwr;
   (void)isimplicit;
-  DDS_LOG(DDS_LC_DISCOVERY, "delete_proxy_writer (%x:%x:%x:%x) ", PGUID (*guid));
+  DDS_LOG(DDS_LC_DISCOVERY, "delete_proxy_writer ("PGUIDFMT") ", PGUID (*guid));
   ddsrt_mutex_lock (&gv.lock);
   if ((pwr = ephash_lookup_proxy_writer_guid (guid)) == NULL)
   {
@@ -4337,7 +4337,7 @@ int new_proxy_reader (const struct nn_guid *ppguid, const struct nn_guid *guid,
 
   if ((proxypp = ephash_lookup_proxy_participant_guid (ppguid)) == NULL)
   {
-    DDS_WARNING("new_proxy_reader(%x:%x:%x:%x): proxy participant unknown\n", PGUID (*guid));
+    DDS_WARNING("new_proxy_reader("PGUIDFMT"): proxy participant unknown\n", PGUID (*guid));
     return Q_ERR_UNKNOWN_ENTITY;
   }
 
@@ -4416,7 +4416,7 @@ static void proxy_reader_set_delete_and_ack_all_messages (struct proxy_reader *p
 static void gc_delete_proxy_reader (struct gcreq *gcreq)
 {
   struct proxy_reader *prd = gcreq->arg;
-  DDS_LOG(DDS_LC_DISCOVERY, "gc_delete_proxy_reader(%p, %x:%x:%x:%x)\n", (void *) gcreq, PGUID (prd->e.guid));
+  DDS_LOG(DDS_LC_DISCOVERY, "gc_delete_proxy_reader(%p, "PGUIDFMT")\n", (void *) gcreq, PGUID (prd->e.guid));
   gcreq_free (gcreq);
 
   while (!ddsrt_avl_is_empty (&prd->writers))
@@ -4435,7 +4435,7 @@ int delete_proxy_reader (const struct nn_guid *guid, nn_wctime_t timestamp, int
 {
   struct proxy_reader *prd;
   (void)isimplicit;
-  DDS_LOG(DDS_LC_DISCOVERY, "delete_proxy_reader (%x:%x:%x:%x) ", PGUID (*guid));
+  DDS_LOG(DDS_LC_DISCOVERY, "delete_proxy_reader ("PGUIDFMT") ", PGUID (*guid));
   ddsrt_mutex_lock (&gv.lock);
   if ((prd = ephash_lookup_proxy_reader_guid (guid)) == NULL)
   {
@@ -4496,7 +4496,7 @@ static void gc_delete_proxy_writer_dqueue_bubble_cb (struct gcreq *gcreq)
 {
   /* delete proxy_writer, phase 3 */
   struct proxy_writer *pwr = gcreq->arg;
-  DDS_LOG(DDS_LC_DISCOVERY, "gc_delete_proxy_writer_dqueue_bubble(%p, %x:%x:%x:%x)\n", (void *) gcreq, PGUID (pwr->e.guid));
+  DDS_LOG(DDS_LC_DISCOVERY, "gc_delete_proxy_writer_dqueue_bubble(%p, "PGUIDFMT")\n", (void *) gcreq, PGUID (pwr->e.guid));
   gcreq_requeue (gcreq, gc_delete_proxy_writer);
 }
 
@@ -4505,7 +4505,7 @@ static void gc_delete_proxy_writer_dqueue (struct gcreq *gcreq)
   /* delete proxy_writer, phase 2 */
   struct proxy_writer *pwr = gcreq->arg;
   struct nn_dqueue *dqueue = pwr->dqueue;
-  DDS_LOG(DDS_LC_DISCOVERY, "gc_delete_proxy_writer_dqueue(%p, %x:%x:%x:%x)\n", (void *) gcreq, PGUID (pwr->e.guid));
+  DDS_LOG(DDS_LC_DISCOVERY, "gc_delete_proxy_writer_dqueue(%p, "PGUIDFMT")\n", (void *) gcreq, PGUID (pwr->e.guid));
   nn_dqueue_enqueue_callback (dqueue, (void (*) (void *)) gc_delete_proxy_writer_dqueue_bubble_cb, gcreq);
 }
 
diff --git a/src/core/ddsi/src/q_init.c b/src/core/ddsi/src/q_init.c
index ee25e6c..c6e4a8f 100644
--- a/src/core/ddsi/src/q_init.c
+++ b/src/core/ddsi/src/q_init.c
@@ -647,7 +647,7 @@ int joinleave_spdp_defmcip (int dojoin)
   unref_addrset (as);
   if (arg.errcount)
   {
-    DDS_ERROR("rtps_init: failed to join multicast groups for domain %d participant %d\n", config.domainId.value, config.participantIndex);
+    DDS_ERROR("rtps_init: failed to join multicast groups for domain %"PRId32" participant %d\n", config.domainId.value, config.participantIndex);
     return -1;
   }
   return 0;
@@ -679,7 +679,7 @@ int create_multicast_sockets(void)
 
   gv.disc_conn_mc = disc;
   gv.data_conn_mc = data;
-  DDS_TRACE("Multicast Ports: discovery %d data %d \n",
+  DDS_TRACE("Multicast Ports: discovery %"PRIu32" data %"PRIu32" \n",
           ddsi_conn_port (gv.disc_conn_mc), ddsi_conn_port (gv.data_conn_mc));
   return 1;
 
@@ -1060,7 +1060,7 @@ int rtps_init (void)
     {
       if (make_uc_sockets (&port_disc_uc, &port_data_uc, config.participantIndex) < 0)
       {
-        DDS_ERROR("rtps_init: failed to create unicast sockets for domain %d participant %d\n", config.domainId.value, config.participantIndex);
+        DDS_ERROR("rtps_init: failed to create unicast sockets for domain %"PRId32" participant %d\n", config.domainId.value, config.participantIndex);
         goto err_unicast_sockets;
       }
     }
@@ -1078,13 +1078,13 @@ int rtps_init (void)
           continue;
         else /* Oops! */
         {
-          DDS_ERROR("rtps_init: failed to create unicast sockets for domain %d participant %d\n", config.domainId.value, ppid);
+          DDS_ERROR("rtps_init: failed to create unicast sockets for domain %"PRId32" participant %d\n", config.domainId.value, ppid);
           goto err_unicast_sockets;
         }
       }
       if (ppid > config.maxAutoParticipantIndex)
       {
-        DDS_ERROR("rtps_init: failed to find a free participant index for domain %d\n", config.domainId.value);
+        DDS_ERROR("rtps_init: failed to find a free participant index for domain %"PRId32"\n", config.domainId.value);
         goto err_unicast_sockets;
       }
       config.participantIndex = ppid;
@@ -1093,9 +1093,9 @@ int rtps_init (void)
     {
       assert(0);
     }
-    DDS_LOG(DDS_LC_CONFIG, "rtps_init: uc ports: disc %u data %u\n", port_disc_uc, port_data_uc);
+    DDS_LOG(DDS_LC_CONFIG, "rtps_init: uc ports: disc %"PRIu32" data %"PRIu32"\n", port_disc_uc, port_data_uc);
   }
-  DDS_LOG(DDS_LC_CONFIG, "rtps_init: domainid %d participantid %d\n", config.domainId.value, config.participantIndex);
+  DDS_LOG(DDS_LC_CONFIG, "rtps_init: domainid %"PRId32" participantid %d\n", config.domainId.value, config.participantIndex);
 
   if (config.pcap_file && *config.pcap_file)
   {
@@ -1115,7 +1115,7 @@ int rtps_init (void)
   if (gv.m_factory->m_connless)
   {
     if (!(config.many_sockets_mode == MSM_NO_UNICAST && config.allowMulticast))
-      DDS_TRACE("Unicast Ports: discovery %d data %d\n", ddsi_conn_port (gv.disc_conn_uc), ddsi_conn_port (gv.data_conn_uc));
+      DDS_TRACE("Unicast Ports: discovery %"PRIu32" data %"PRIu32"\n", ddsi_conn_port (gv.disc_conn_uc), ddsi_conn_port (gv.data_conn_uc));
 
     if (config.allowMulticast)
     {
diff --git a/src/core/ddsi/src/q_lease.c b/src/core/ddsi/src/q_lease.c
index 22dc1f4..4ec8892 100644
--- a/src/core/ddsi/src/q_lease.c
+++ b/src/core/ddsi/src/q_lease.c
@@ -108,7 +108,7 @@ struct lease *lease_new (nn_etime_t texpire, int64_t tdur, struct entity_common
   struct lease *l;
   if ((l = ddsrt_malloc (sizeof (*l))) == NULL)
     return NULL;
-  DDS_TRACE("lease_new(tdur %"PRId64" guid %x:%x:%x:%x) @ %p\n", tdur, PGUID (e->guid), (void *) l);
+  DDS_TRACE("lease_new(tdur %"PRId64" guid "PGUIDFMT") @ %p\n", tdur, PGUID (e->guid), (void *) l);
   l->tdur = tdur;
   l->tend = texpire;
   l->tsched.v = TSCHED_NOT_ON_HEAP;
@@ -118,7 +118,7 @@ struct lease *lease_new (nn_etime_t texpire, int64_t tdur, struct entity_common
 
 void lease_register (struct lease *l)
 {
-  DDS_TRACE("lease_register(l %p guid %x:%x:%x:%x)\n", (void *) l, PGUID (l->entity->guid));
+  DDS_TRACE("lease_register(l %p guid "PGUIDFMT")\n", (void *) l, PGUID (l->entity->guid));
   ddsrt_mutex_lock (&gv.leaseheap_lock);
   lock_lease (l);
   assert (l->tsched.v == TSCHED_NOT_ON_HEAP);
@@ -136,7 +136,7 @@ void lease_register (struct lease *l)
 
 void lease_free (struct lease *l)
 {
-  DDS_TRACE("lease_free(l %p guid %x:%x:%x:%x)\n", (void *) l, PGUID (l->entity->guid));
+  DDS_TRACE("lease_free(l %p guid "PGUIDFMT")\n", (void *) l, PGUID (l->entity->guid));
   ddsrt_mutex_lock (&gv.leaseheap_lock);
   if (l->tsched.v != TSCHED_NOT_ON_HEAP)
     ddsrt_fibheap_delete (&lease_fhdef, &gv.leaseheap, l);
@@ -167,9 +167,9 @@ void lease_renew (struct lease *l, nn_etime_t tnowE)
     int32_t tsec, tusec;
     DDS_TRACE(" L(");
     if (l->entity->guid.entityid.u == NN_ENTITYID_PARTICIPANT)
-      DDS_TRACE(":%x", l->entity->guid.entityid.u);
+      DDS_TRACE(":%"PRIx32, l->entity->guid.entityid.u);
     else
-      DDS_TRACE("%x:%x:%x:%x", PGUID (l->entity->guid));
+      DDS_TRACE(""PGUIDFMT"", PGUID (l->entity->guid));
     etime_to_sec_usec (&tsec, &tusec, tend_new);
     DDS_TRACE(" %"PRId32".%06"PRId32")", tsec, tusec);
   }
@@ -233,7 +233,7 @@ int64_t check_and_handle_lease_expiration (nn_etime_t tnowE)
       continue;
     }
 
-    DDS_LOG(DDS_LC_DISCOVERY, "lease expired: l %p guid %x:%x:%x:%x tend %"PRId64" < now %"PRId64"\n", (void *) l, PGUID (g), l->tend.v, tnowE.v);
+    DDS_LOG(DDS_LC_DISCOVERY, "lease expired: l %p guid "PGUIDFMT" tend %"PRId64" < now %"PRId64"\n", (void *) l, PGUID (g), l->tend.v, tnowE.v);
 
     /* If the proxy participant is relying on another participant for
        writing its discovery data (on the privileged participant,
@@ -266,7 +266,7 @@ int64_t check_and_handle_lease_expiration (nn_etime_t tnowE)
       if ((proxypp = ephash_lookup_proxy_participant_guid (&g)) != NULL &&
           ephash_lookup_proxy_participant_guid (&proxypp->privileged_pp_guid) != NULL)
       {
-        DDS_LOG(DDS_LC_DISCOVERY, "but postponing because privileged pp %x:%x:%x:%x is still live\n",
+        DDS_LOG(DDS_LC_DISCOVERY, "but postponing because privileged pp "PGUIDFMT" is still live\n",
                 PGUID (proxypp->privileged_pp_guid));
         l->tsched = l->tend = add_duration_to_etime (tnowE, 200 * T_MILLISECOND);
         unlock_lease (l);
@@ -350,7 +350,7 @@ void handle_PMD (UNUSED_ARG (const struct receiver_state *rst), nn_wctime_t time
         nn_guid_prefix_t p = nn_ntoh_guid_prefix (pmd->participantGuidPrefix);
         unsigned kind = ntohl (pmd->kind);
         unsigned length = bswap ? bswap4u (pmd->length) : pmd->length;
-        DDS_TRACE(" pp %x:%x:%x kind %u data %u", p.u[0], p.u[1], p.u[2], kind, length);
+        DDS_TRACE(" pp %"PRIx32":%"PRIx32":%"PRIx32" kind %u data %u", p.u[0], p.u[1], p.u[2], kind, length);
         if (len - sizeof (struct CDRHeader) - offsetof (ParticipantMessageData_t, value) < length)
           debug_print_rawdata (" SHORT2", pmd->value, len - sizeof (struct CDRHeader) - offsetof (ParticipantMessageData_t, value));
         else
diff --git a/src/core/ddsi/src/q_nwif.c b/src/core/ddsi/src/q_nwif.c
index 6e8cbef..3f5ac27 100644
--- a/src/core/ddsi/src/q_nwif.c
+++ b/src/core/ddsi/src/q_nwif.c
@@ -123,13 +123,13 @@ static int set_rcvbuf (ddsrt_socket_t socket)
     {
       /* NN_ERROR does more than just DDS_ERROR(), hence the duplication */
       if (config.socket_min_rcvbuf_size.isdefault)
-        DDS_LOG(DDS_LC_CONFIG, "failed to increase socket receive buffer size to %u bytes, continuing with %u bytes\n", socket_min_rcvbuf_size, ReceiveBufferSize);
+        DDS_LOG(DDS_LC_CONFIG, "failed to increase socket receive buffer size to %"PRIu32" bytes, continuing with %"PRIu32" bytes\n", socket_min_rcvbuf_size, ReceiveBufferSize);
       else
-        DDS_ERROR("failed to increase socket receive buffer size to %u bytes, continuing with %u bytes\n", socket_min_rcvbuf_size, ReceiveBufferSize);
+        DDS_ERROR("failed to increase socket receive buffer size to %"PRIu32" bytes, continuing with %"PRIu32" bytes\n", socket_min_rcvbuf_size, ReceiveBufferSize);
     }
     else
     {
-      DDS_LOG(DDS_LC_CONFIG, "socket receive buffer size set to %u bytes\n", ReceiveBufferSize);
+      DDS_LOG(DDS_LC_CONFIG, "socket receive buffer size set to %"PRIu32" bytes\n", ReceiveBufferSize);
     }
   }
   return 0;
diff --git a/src/core/ddsi/src/q_plist.c b/src/core/ddsi/src/q_plist.c
index c02a63d..a83f9f9 100644
--- a/src/core/ddsi/src/q_plist.c
+++ b/src/core/ddsi/src/q_plist.c
@@ -257,7 +257,7 @@ static int alias_stringseq (nn_stringseq_t *strseq, const struct dd *dd)
   seq += sizeof (uint32_t);
   if (strseq->n >= UINT_MAX / sizeof(*strs))
   {
-    DDS_TRACE("plist/alias_stringseq: length %u out of range\n", strseq->n);
+    DDS_TRACE("plist/alias_stringseq: length %"PRIu32" out of range\n", strseq->n);
     return Q_ERR_INVALID;
   }
   else if (strseq->n == 0)
@@ -1185,7 +1185,7 @@ static int valid_participant_guid (const nn_guid_t *g, UNUSED_ARG (const struct
       return 0;
     else
     {
-      DDS_TRACE("plist/valid_participant_guid: prefix is 0 but entityid is not (%u)\n", g->entityid.u);
+      DDS_TRACE("plist/valid_participant_guid: prefix is 0 but entityid is not (%"PRIu32")\n", g->entityid.u);
       return Q_ERR_INVALID;
     }
   }
@@ -1195,7 +1195,7 @@ static int valid_participant_guid (const nn_guid_t *g, UNUSED_ARG (const struct
   }
   else
   {
-    DDS_TRACE("plist/valid_participant_guid: entityid not a participant entityid (%u)\n", g->entityid.u);
+    DDS_TRACE("plist/valid_participant_guid: entityid not a participant entityid (%"PRIu32")\n", g->entityid.u);
     return Q_ERR_INVALID;
   }
 }
@@ -1209,7 +1209,7 @@ static int valid_group_guid (const nn_guid_t *g, UNUSED_ARG (const struct dd *dd
       return 0;
     else
     {
-      DDS_TRACE("plist/valid_group_guid: prefix is 0 but entityid is not (%u)\n", g->entityid.u);
+      DDS_TRACE("plist/valid_group_guid: prefix is 0 but entityid is not (%"PRIu32")\n", g->entityid.u);
       return Q_ERR_INVALID;
     }
   }
@@ -1234,7 +1234,7 @@ static int valid_endpoint_guid (const nn_guid_t *g, const struct dd *dd)
       return 0;
     else
     {
-      DDS_TRACE("plist/valid_endpoint_guid: prefix is 0 but entityid is not (%x)\n", g->entityid.u);
+      DDS_TRACE("plist/valid_endpoint_guid: prefix is 0 but entityid is not (%"PRIx32")\n", g->entityid.u);
       return Q_ERR_INVALID;
     }
   }
@@ -1253,7 +1253,7 @@ static int valid_endpoint_guid (const nn_guid_t *g, const struct dd *dd)
             return 0;
           else
           {
-            DDS_TRACE("plist/valid_endpoint_guid[src=USER,proto=%u.%u]: invalid kind (%x)\n",
+            DDS_TRACE("plist/valid_endpoint_guid[src=USER,proto=%u.%u]: invalid kind (%"PRIx32")\n",
                     dd->protocol_version.major, dd->protocol_version.minor,
                     g->entityid.u & NN_ENTITYID_KIND_MASK);
             return Q_ERR_INVALID;
@@ -1278,7 +1278,7 @@ static int valid_endpoint_guid (const nn_guid_t *g, const struct dd *dd)
             return 0;
           else
           {
-            DDS_TRACE("plist/valid_endpoint_guid[src=BUILTIN,proto=%u.%u]: invalid entityid (%x)\n",
+            DDS_TRACE("plist/valid_endpoint_guid[src=BUILTIN,proto=%u.%u]: invalid entityid (%"PRIx32")\n",
                     dd->protocol_version.major, dd->protocol_version.minor, g->entityid.u);
             return Q_ERR_INVALID;
           }
@@ -1302,14 +1302,14 @@ static int valid_endpoint_guid (const nn_guid_t *g, const struct dd *dd)
               return 0;
             else
             {
-              DDS_TRACE("plist/valid_endpoint_guid[src=VENDOR,proto=%u.%u]: unexpected entityid (%x)\n",
+              DDS_TRACE("plist/valid_endpoint_guid[src=VENDOR,proto=%u.%u]: unexpected entityid (%"PRIx32")\n",
                       dd->protocol_version.major, dd->protocol_version.minor, g->entityid.u);
               return 0;
             }
         }
       }
     default:
-      DDS_TRACE("plist/valid_endpoint_guid: invalid source (%x)\n", g->entityid.u);
+      DDS_TRACE("plist/valid_endpoint_guid: invalid source (%"PRIx32")\n", g->entityid.u);
       return Q_ERR_INVALID;
   }
 }
@@ -1329,7 +1329,7 @@ static int do_guid (nn_guid_t *dst, uint64_t *present, uint64_t fl, int (*valid)
        that has long since changed (even if I don't know exactly when) */
     if (fl == PP_PARTICIPANT_GUID && vendor_is_twinoaks (dd->vendorid) && dst->entityid.u == 0 && ! NN_STRICT_P)
     {
-      DDS_LOG(DDS_LC_DISCOVERY, "plist(vendor %u.%u): rewriting invalid participant guid %x:%x:%x:%x\n",
+      DDS_LOG(DDS_LC_DISCOVERY, "plist(vendor %u.%u): rewriting invalid participant guid "PGUIDFMT,
               dd->vendorid.id[0], dd->vendorid.id[1], PGUID (*dst));
       dst->entityid.u = NN_ENTITYID_PARTICIPANT;
     }
@@ -2122,9 +2122,9 @@ static int init_one_parameter
         dest->aliased |= PP_PRISMTECH_EOTINFO;
         if (dds_get_log_mask() & DDS_LC_PLIST)
         {
-          DDS_LOG(DDS_LC_PLIST, "eotinfo: txn %u {", q->transactionId);
+          DDS_LOG(DDS_LC_PLIST, "eotinfo: txn %"PRIu32" {", q->transactionId);
           for (i = 0; i < q->n; i++)
-            DDS_LOG(DDS_LC_PLIST, " %x:%u", q->tids[i].writer_entityid.u, q->tids[i].transactionId);
+            DDS_LOG(DDS_LC_PLIST, " %"PRIx32":%"PRIu32, q->tids[i].writer_entityid.u, q->tids[i].transactionId);
           DDS_LOG(DDS_LC_PLIST, " }\n");
         }
         return 0;
@@ -3421,12 +3421,12 @@ void nn_log_xqos (uint32_t cat, const nn_xqos_t *xqos)
       DDS_LOG(cat, "}");
     });
   DO (GROUP_DATA, {
-    LOGB1 ("group_data=%u<", xqos->group_data.length);
+    LOGB1 ("group_data=%"PRIu32"<", xqos->group_data.length);
     log_octetseq (cat, xqos->group_data.length, xqos->group_data.value);
     DDS_LOG(cat, ">");
   });
   DO (TOPIC_DATA, {
-    LOGB1 ("topic_data=%u<", xqos->topic_data.length);
+    LOGB1 ("topic_data=%"PRIu32"<", xqos->topic_data.length);
     log_octetseq (cat, xqos->topic_data.length, xqos->topic_data.value);
     DDS_LOG(cat, ">");
   });
@@ -3434,25 +3434,25 @@ void nn_log_xqos (uint32_t cat, const nn_xqos_t *xqos)
   DO (DURABILITY_SERVICE, {
       LOGB0 ("durability_service=");
       DDS_LOG(cat, FMT_DUR, PRINTARG_DUR (xqos->durability_service.service_cleanup_delay));
-      DDS_LOG(cat, ":{%d:%d}", xqos->durability_service.history.kind, xqos->durability_service.history.depth);
-      DDS_LOG(cat, ":{%d:%d:%d}", xqos->durability_service.resource_limits.max_samples, xqos->durability_service.resource_limits.max_instances, xqos->durability_service.resource_limits.max_samples_per_instance);
+      DDS_LOG(cat, ":{%u:%"PRId32"}", xqos->durability_service.history.kind, xqos->durability_service.history.depth);
+      DDS_LOG(cat, ":{%"PRId32":%"PRId32":%"PRId32"}", xqos->durability_service.resource_limits.max_samples, xqos->durability_service.resource_limits.max_instances, xqos->durability_service.resource_limits.max_samples_per_instance);
     });
   DO (DEADLINE, { LOGB1 ("deadline="FMT_DUR, PRINTARG_DUR (xqos->deadline.deadline)); });
   DO (LATENCY_BUDGET, { LOGB1 ("latency_budget="FMT_DUR, PRINTARG_DUR (xqos->latency_budget.duration)); });
   DO (LIVELINESS, { LOGB2 ("liveliness=%d:"FMT_DUR, xqos->liveliness.kind, PRINTARG_DUR (xqos->liveliness.lease_duration)); });
   DO (RELIABILITY, { LOGB2 ("reliability=%d:"FMT_DUR, xqos->reliability.kind, PRINTARG_DUR (xqos->reliability.max_blocking_time)); });
   DO (DESTINATION_ORDER, { LOGB1 ("destination_order=%d", xqos->destination_order.kind); });
-  DO (HISTORY, { LOGB2 ("history=%d:%d", xqos->history.kind, xqos->history.depth); });
-  DO (RESOURCE_LIMITS, { LOGB3 ("resource_limits=%d:%d:%d", xqos->resource_limits.max_samples, xqos->resource_limits.max_instances, xqos->resource_limits.max_samples_per_instance); });
-  DO (TRANSPORT_PRIORITY, { LOGB1 ("transport_priority=%d", xqos->transport_priority.value); });
+  DO (HISTORY, { LOGB2 ("history=%d:%"PRId32, xqos->history.kind, xqos->history.depth); });
+  DO (RESOURCE_LIMITS, { LOGB3 ("resource_limits=%"PRId32":%"PRId32":%"PRId32, xqos->resource_limits.max_samples, xqos->resource_limits.max_instances, xqos->resource_limits.max_samples_per_instance); });
+  DO (TRANSPORT_PRIORITY, { LOGB1 ("transport_priority=%"PRId32, xqos->transport_priority.value); });
   DO (LIFESPAN, { LOGB1 ("lifespan="FMT_DUR, PRINTARG_DUR (xqos->lifespan.duration)); });
   DO (USER_DATA, {
-    LOGB1 ("user_data=%u<", xqos->user_data.length);
+    LOGB1 ("user_data=%"PRIu32"<", xqos->user_data.length);
     log_octetseq (cat, xqos->user_data.length, xqos->user_data.value);
     DDS_LOG(cat, ">");
   });
   DO (OWNERSHIP, { LOGB1 ("ownership=%d", xqos->ownership.kind); });
-  DO (OWNERSHIP_STRENGTH, { LOGB1 ("ownership_strength=%d", xqos->ownership_strength.value); });
+  DO (OWNERSHIP_STRENGTH, { LOGB1 ("ownership_strength=%"PRId32, xqos->ownership_strength.value); });
   DO (TIME_BASED_FILTER, { LOGB1 ("time_based_filter="FMT_DUR, PRINTARG_DUR (xqos->time_based_filter.minimum_separation)); });
   DO (PRISMTECH_READER_DATA_LIFECYCLE, { LOGB5 ("reader_data_lifecycle="FMT_DUR":"FMT_DUR":%u:%u:%d", PRINTARG_DUR (xqos->reader_data_lifecycle.autopurge_nowriter_samples_delay), PRINTARG_DUR (xqos->reader_data_lifecycle.autopurge_disposed_samples_delay), xqos->reader_data_lifecycle.autopurge_dispose_all, xqos->reader_data_lifecycle.enable_invalid_samples, (int) xqos->reader_data_lifecycle.invalid_sample_visibility); });
   DO (PRISMTECH_WRITER_DATA_LIFECYCLE, {
@@ -3473,7 +3473,7 @@ void nn_log_xqos (uint32_t cat, const nn_xqos_t *xqos)
   DO (PRISMTECH_ENTITY_FACTORY, { LOGB1 ("entity_factory=%u", xqos->entity_factory.autoenable_created_entities); });
   DO (PRISMTECH_SYNCHRONOUS_ENDPOINT, { LOGB1 ("synchronous_endpoint=%u", xqos->synchronous_endpoint.value); });
   DO (RTI_TYPECODE, {
-    LOGB1 ("rti_typecode=%u<", xqos->rti_typecode.length);
+    LOGB1 ("rti_typecode=%"PRIu32"<", xqos->rti_typecode.length);
     log_octetseq (cat, xqos->rti_typecode.length, xqos->rti_typecode.value);
     DDS_LOG(cat, ">");
   });
diff --git a/src/core/ddsi/src/q_radmin.c b/src/core/ddsi/src/q_radmin.c
index 4a739fd..a45d4e0 100644
--- a/src/core/ddsi/src/q_radmin.c
+++ b/src/core/ddsi/src/q_radmin.c
@@ -484,7 +484,7 @@ static void *nn_rbuf_alloc (struct nn_rbufpool *rbufpool)
   /* Note: only one thread calls nn_rmsg_new on a pool */
   uint32_t asize = max_rmsg_size_w_hdr (rbufpool->max_rmsg_size);
   struct nn_rbuf *rb;
-  DDS_LOG(DDS_LC_RADMIN, "rmsg_rbuf_alloc(%p, %u)\n", (void *) rbufpool, asize);
+  DDS_LOG(DDS_LC_RADMIN, "rmsg_rbuf_alloc(%p, %"PRIu32")\n", (void *) rbufpool, asize);
   ASSERT_RBUFPOOL_OWNER (rbufpool);
   rb = rbufpool->current;
   assert (rb != NULL);
@@ -501,7 +501,7 @@ static void *nn_rbuf_alloc (struct nn_rbufpool *rbufpool)
     assert ((uint32_t) (rb->u.raw + rb->size - rb->freeptr) >= asize);
   }
 
-  DDS_LOG(DDS_LC_RADMIN, "rmsg_rbuf_alloc(%p, %u) = %p\n", (void *) rbufpool, asize, (void *) rb->freeptr);
+  DDS_LOG(DDS_LC_RADMIN, "rmsg_rbuf_alloc(%p, %"PRIu32") = %p\n", (void *) rbufpool, asize, (void *) rb->freeptr);
 #if USE_VALGRIND
   VALGRIND_MEMPOOL_ALLOC (rbufpool, rb->freeptr, asize);
 #endif
@@ -540,7 +540,7 @@ struct nn_rmsg *nn_rmsg_new (struct nn_rbufpool *rbufpool)
 void nn_rmsg_setsize (struct nn_rmsg *rmsg, uint32_t size)
 {
   uint32_t size8 = align8uint32 (size);
-  DDS_LOG(DDS_LC_RADMIN, "rmsg_setsize(%p, %u => %u)\n", (void *) rmsg, size, size8);
+  DDS_LOG(DDS_LC_RADMIN, "rmsg_setsize(%p, %"PRIu32" => %"PRIu32")\n", (void *) rmsg, size, size8);
   ASSERT_RBUFPOOL_OWNER (rmsg->chunk.rbuf->rbufpool);
   ASSERT_RMSG_UNCOMMITTED (rmsg);
   assert (ddsrt_atomic_ld32 (&rmsg->refcount) == RMSG_REFCOUNT_UNCOMMITTED_BIAS);
@@ -601,7 +601,7 @@ void nn_rmsg_commit (struct nn_rmsg *rmsg)
      happens to be such that any asynchronous activities have
      completed before we got to commit. */
   struct nn_rmsg_chunk *chunk = rmsg->lastchunk;
-  DDS_LOG(DDS_LC_RADMIN, "rmsg_commit(%p) refcount 0x%x last-chunk-size %u\n",
+  DDS_LOG(DDS_LC_RADMIN, "rmsg_commit(%p) refcount 0x%"PRIx32" last-chunk-size %"PRIu32"\n",
                  (void *) rmsg, rmsg->refcount.v, chunk->size);
   ASSERT_RBUFPOOL_OWNER (chunk->rbuf->rbufpool);
   ASSERT_RMSG_UNCOMMITTED (rmsg);
@@ -665,7 +665,7 @@ void *nn_rmsg_alloc (struct nn_rmsg *rmsg, uint32_t size)
   struct nn_rbuf *rbuf = chunk->rbuf;
   uint32_t size8 = align8uint32 (size);
   void *ptr;
-  DDS_LOG(DDS_LC_RADMIN, "rmsg_alloc(%p, %u => %u)\n", (void *) rmsg, size, size8);
+  DDS_LOG(DDS_LC_RADMIN, "rmsg_alloc(%p, %"PRIu32" => %"PRIu32")\n", (void *) rmsg, size, size8);
   ASSERT_RBUFPOOL_OWNER (rbuf->rbufpool);
   ASSERT_RMSG_UNCOMMITTED (rmsg);
   assert ((chunk->size % 8) == 0);
@@ -675,12 +675,12 @@ void *nn_rmsg_alloc (struct nn_rmsg *rmsg, uint32_t size)
   {
     struct nn_rbufpool *rbufpool = rbuf->rbufpool;
     struct nn_rmsg_chunk *newchunk;
-    DDS_LOG(DDS_LC_RADMIN, "rmsg_alloc(%p, %u) limit hit - new chunk\n", (void *) rmsg, size);
+    DDS_LOG(DDS_LC_RADMIN, "rmsg_alloc(%p, %"PRIu32") limit hit - new chunk\n", (void *) rmsg, size);
     commit_rmsg_chunk (chunk);
     newchunk = nn_rbuf_alloc (rbufpool);
     if (newchunk == NULL)
     {
-      DDS_WARNING ("nn_rmsg_alloc: can't allocate more memory (%u bytes) ... giving up\n", size);
+      DDS_WARNING ("nn_rmsg_alloc: can't allocate more memory (%"PRIu32" bytes) ... giving up\n", size);
       return NULL;
     }
     init_rmsg_chunk (newchunk, rbufpool->current);
@@ -690,7 +690,7 @@ void *nn_rmsg_alloc (struct nn_rmsg *rmsg, uint32_t size)
 
   ptr = chunk->u.payload + chunk->size;
   chunk->size += size8;
-  DDS_LOG(DDS_LC_RADMIN, "rmsg_alloc(%p, %u) = %p\n", (void *) rmsg, size, ptr);
+  DDS_LOG(DDS_LC_RADMIN, "rmsg_alloc(%p, %"PRIu32") = %p\n", (void *) rmsg, size, ptr);
 #if USE_VALGRIND
   if (chunk == &rmsg->chunk) {
     VALGRIND_MEMPOOL_CHANGE (rbuf->rbufpool, rmsg, rmsg, offsetof (struct nn_rmsg, chunk.u.payload) + chunk->size);
@@ -717,7 +717,7 @@ struct nn_rdata *nn_rdata_new (struct nn_rmsg *rmsg, uint32_t start, uint32_t en
 #ifndef NDEBUG
   ddsrt_atomic_st32 (&d->refcount_bias_added, 0);
 #endif
-  DDS_LOG(DDS_LC_RADMIN, "rdata_new(%p, bytes [%u,%u), submsg @ %u, payload @ %u) = %p\n", (void *) rmsg, start, endp1, NN_RDATA_SUBMSG_OFF (d), NN_RDATA_PAYLOAD_OFF (d), (void *) d);
+  DDS_LOG(DDS_LC_RADMIN, "rdata_new(%p, bytes [%"PRIu32",%"PRIu32"), submsg @ %u, payload @ %u) = %p\n", (void *) rmsg, start, endp1, NN_RDATA_SUBMSG_OFF (d), NN_RDATA_PAYLOAD_OFF (d), (void *) d);
   return d;
 }
 
@@ -931,7 +931,7 @@ static int defrag_try_merge_with_succ (struct nn_rsample_defrag *sample, struct
 {
   struct nn_defrag_iv *succ;
 
-  DDS_LOG(DDS_LC_RADMIN, "  defrag_try_merge_with_succ(%p [%u..%u)):\n",
+  DDS_LOG(DDS_LC_RADMIN, "  defrag_try_merge_with_succ(%p [%"PRIu32"..%"PRIu32")):\n",
                  (void *) node, node->min, node->maxp1);
   if (node == sample->lastfrag)
   {
@@ -942,7 +942,7 @@ static int defrag_try_merge_with_succ (struct nn_rsample_defrag *sample, struct
 
   succ = ddsrt_avl_find_succ (&rsample_defrag_fragtree_treedef, &sample->fragtree, node);
   assert (succ != NULL);
-  DDS_LOG(DDS_LC_RADMIN, "  succ is %p [%u..%u)\n", (void *) succ, succ->min, succ->maxp1);
+  DDS_LOG(DDS_LC_RADMIN, "  succ is %p [%"PRIu32"..%"PRIu32")\n", (void *) succ, succ->min, succ->maxp1);
   if (succ->min > node->maxp1)
   {
     DDS_LOG(DDS_LC_RADMIN, "  gap between node and succ\n");
@@ -1147,7 +1147,7 @@ static struct nn_rsample *defrag_add_fragment (struct nn_rsample *sample, struct
   /* relatively expensive test: lastfrag, tree must be consistent */
   assert (dfsample->lastfrag == ddsrt_avl_find_max (&rsample_defrag_fragtree_treedef, &dfsample->fragtree));
 
-  DDS_LOG(DDS_LC_RADMIN, "  lastfrag %p [%u..%u)\n",
+  DDS_LOG(DDS_LC_RADMIN, "  lastfrag %p [%"PRIu32"..%"PRIu32")\n",
                  (void *) dfsample->lastfrag,
                  dfsample->lastfrag->min, dfsample->lastfrag->maxp1);
 
@@ -1164,7 +1164,7 @@ static struct nn_rsample *defrag_add_fragment (struct nn_rsample *sample, struct
     /* Slow path: find preceding fragment by tree search */
     predeq = ddsrt_avl_lookup_pred_eq (&rsample_defrag_fragtree_treedef, &dfsample->fragtree, &min);
     assert (predeq);
-    DDS_LOG(DDS_LC_RADMIN, "  slow path: predeq = lookup %u => %p [%u..%u)\n",
+    DDS_LOG(DDS_LC_RADMIN, "  slow path: predeq = lookup %"PRIu32" => %p [%"PRIu32"..%"PRIu32")\n",
                    min, (void *) predeq, predeq->min, predeq->maxp1);
   }
 
@@ -1213,7 +1213,7 @@ static struct nn_rsample *defrag_add_fragment (struct nn_rsample *sample, struct
        fragment in the chain adds value); but doesn't overlap with
        predeq so the tree structure doesn't change even though the key
        does change */
-    DDS_LOG(DDS_LC_RADMIN, "  extending succ %p [%u..%u) at head\n",
+    DDS_LOG(DDS_LC_RADMIN, "  extending succ %p [%"PRIu32"..%"PRIu32") at head\n",
                    (void *) succ, succ->min, succ->maxp1);
     nn_rdata_addbias (rdata);
     rdata->nextfrag = succ->first;
@@ -1336,7 +1336,7 @@ struct nn_rsample *nn_defrag_rsample (struct nn_defrag *defrag, struct nn_rdata
      consistent. Max_sample must be consistent with tree */
   assert (defrag->max_sample == ddsrt_avl_find_max (&defrag_sampletree_treedef, &defrag->sampletree));
   max_seq = defrag->max_sample ? defrag->max_sample->u.defrag.seq : 0;
-  DDS_LOG(DDS_LC_RADMIN, "defrag_rsample(%p, %p [%u..%u) msg %p, %p seq %"PRId64" size %u) max_seq %p %"PRId64":\n",
+  DDS_LOG(DDS_LC_RADMIN, "defrag_rsample(%p, %p [%"PRIu32"..%"PRIu32") msg %p, %p seq %"PRId64" size %"PRIu32") max_seq %p %"PRId64":\n",
           (void *) defrag, (void *) rdata, rdata->min, rdata->maxp1, (void *) rdata->rmsg,
           (void *) sampleinfo, sampleinfo->seq, sampleinfo->size,
           (void *) defrag->max_sample, max_seq);
@@ -2230,7 +2230,7 @@ nn_reorder_result_t nn_reorder_gap (struct nn_rsample_chain *sc, struct nn_reord
   }
   else if (coalesced->u.reorder.min <= reorder->next_seq)
   {
-    DDS_LOG(DDS_LC_RADMIN, "  coalesced = [%"PRId64",%"PRId64") @ %p containing %d samples\n",
+    DDS_LOG(DDS_LC_RADMIN, "  coalesced = [%"PRId64",%"PRId64") @ %p containing %"PRId32" samples\n",
             coalesced->u.reorder.min, coalesced->u.reorder.maxp1,
             (void *) coalesced, coalesced->u.reorder.n_samples);
     ddsrt_avl_delete (&reorder_sampleivtree_treedef, &reorder->sampleivtree, coalesced);
diff --git a/src/core/ddsi/src/q_receive.c b/src/core/ddsi/src/q_receive.c
index 4ae45ce..5aae883 100644
--- a/src/core/ddsi/src/q_receive.c
+++ b/src/core/ddsi/src/q_receive.c
@@ -93,7 +93,7 @@ static void maybe_set_reader_in_sync (struct proxy_writer *pwr, struct pwr_rd_ma
     case PRMSS_OUT_OF_SYNC:
       if (nn_reorder_next_seq (wn->u.not_in_sync.reorder) - 1 >= wn->u.not_in_sync.end_of_out_of_sync_seq)
       {
-        DDS_TRACE(" msr_in_sync(%x:%x:%x:%x out-of-sync to tlcatchup)", PGUID (wn->rd_guid));
+        DDS_TRACE(" msr_in_sync("PGUIDFMT" out-of-sync to tlcatchup)", PGUID (wn->rd_guid));
         wn->in_sync = PRMSS_TLCATCHUP;
         maybe_set_reader_in_sync (pwr, wn, last_deliv_seq);
       }
@@ -627,14 +627,14 @@ static void force_heartbeat_to_peer (struct writer *wr, const struct whc_state *
     }
     add_Gap (m, wr, prd, seq, seq+1, 1, &bits);
     add_Heartbeat (m, wr, whcst, hbansreq, prd->e.guid.entityid, 1);
-    DDS_TRACE("force_heartbeat_to_peer: %x:%x:%x:%x -> %x:%x:%x:%x - whc empty, queueing gap #%"PRId64" + heartbeat for transmit\n",
+    DDS_TRACE("force_heartbeat_to_peer: "PGUIDFMT" -> "PGUIDFMT" - whc empty, queueing gap #%"PRId64" + heartbeat for transmit\n",
             PGUID (wr->e.guid), PGUID (prd->e.guid), seq);
   }
   else
   {
     /* Send a Heartbeat just to this peer */
     add_Heartbeat (m, wr, whcst, hbansreq, prd->e.guid.entityid, 0);
-    DDS_TRACE("force_heartbeat_to_peer: %x:%x:%x:%x -> %x:%x:%x:%x - queue for transmit\n",
+    DDS_TRACE("force_heartbeat_to_peer: "PGUIDFMT" -> "PGUIDFMT" - queue for transmit\n",
             PGUID (wr->e.guid), PGUID (prd->e.guid));
   }
   qxev_msg (wr->evq, m);
@@ -729,7 +729,7 @@ static int handle_AckNack (struct receiver_state *rst, nn_etime_t tnow, const Ac
   src.entityid = msg->readerId;
   dst.prefix = rst->dst_guid_prefix;
   dst.entityid = msg->writerId;
-  DDS_TRACE("ACKNACK(%s#%d:%"PRId64"/%u:", msg->smhdr.flags & ACKNACK_FLAG_FINAL ? "F" : "",
+  DDS_TRACE("ACKNACK(%s#%"PRId32":%"PRId64"/%"PRIu32":", msg->smhdr.flags & ACKNACK_FLAG_FINAL ? "F" : "",
           *countp, fromSN (msg->readerSNState.bitmap_base), msg->readerSNState.numbits);
   for (i = 0; i < msg->readerSNState.numbits; i++)
     DDS_TRACE("%c", nn_bitset_isset (msg->readerSNState.numbits, msg->readerSNState.bits, i) ? '1' : '0');
@@ -737,13 +737,13 @@ static int handle_AckNack (struct receiver_state *rst, nn_etime_t tnow, const Ac
 
   if (!rst->forme)
   {
-    DDS_TRACE(" %x:%x:%x:%x -> %x:%x:%x:%x not-for-me)", PGUID (src), PGUID (dst));
+    DDS_TRACE(" "PGUIDFMT" -> "PGUIDFMT" not-for-me)", PGUID (src), PGUID (dst));
     return 1;
   }
 
   if ((wr = ephash_lookup_writer_guid (&dst)) == NULL)
   {
-    DDS_TRACE(" %x:%x:%x:%x -> %x:%x:%x:%x?)", PGUID (src), PGUID (dst));
+    DDS_TRACE(" "PGUIDFMT" -> "PGUIDFMT"?)", PGUID (src), PGUID (dst));
     return 1;
   }
   /* Always look up the proxy reader -- even though we don't need for
@@ -752,7 +752,7 @@ static int handle_AckNack (struct receiver_state *rst, nn_etime_t tnow, const Ac
      only retrieve it when needed. */
   if ((prd = ephash_lookup_proxy_reader_guid (&src)) == NULL)
   {
-    DDS_TRACE(" %x:%x:%x:%x? -> %x:%x:%x:%x)", PGUID (src), PGUID (dst));
+    DDS_TRACE(" "PGUIDFMT"? -> "PGUIDFMT")", PGUID (src), PGUID (dst));
     return 1;
   }
 
@@ -762,14 +762,14 @@ static int handle_AckNack (struct receiver_state *rst, nn_etime_t tnow, const Ac
 
   if (!wr->reliable) /* note: reliability can't be changed */
   {
-    DDS_TRACE(" %x:%x:%x:%x -> %x:%x:%x:%x not a reliable writer!)", PGUID (src), PGUID (dst));
+    DDS_TRACE(" "PGUIDFMT" -> "PGUIDFMT" not a reliable writer!)", PGUID (src), PGUID (dst));
     return 1;
   }
 
   ddsrt_mutex_lock (&wr->e.lock);
   if ((rn = ddsrt_avl_lookup (&wr_readers_treedef, &wr->readers, &src)) == NULL)
   {
-    DDS_TRACE(" %x:%x:%x:%x -> %x:%x:%x:%x not a connection)", PGUID (src), PGUID (dst));
+    DDS_TRACE(" "PGUIDFMT" -> "PGUIDFMT" not a connection)", PGUID (src), PGUID (dst));
     goto out;
   }
 
@@ -789,10 +789,10 @@ static int handle_AckNack (struct receiver_state *rst, nn_etime_t tnow, const Ac
 
   if (!accept_ack_or_hb_w_timeout (*countp, &rn->next_acknack, tnow, &rn->t_acknack_accepted, is_preemptive_ack))
   {
-    DDS_TRACE(" [%x:%x:%x:%x -> %x:%x:%x:%x])", PGUID (src), PGUID (dst));
+    DDS_TRACE(" ["PGUIDFMT" -> "PGUIDFMT"])", PGUID (src), PGUID (dst));
     goto out;
   }
-  DDS_TRACE(" %x:%x:%x:%x -> %x:%x:%x:%x", PGUID (src), PGUID (dst));
+  DDS_TRACE(" "PGUIDFMT" -> "PGUIDFMT"", PGUID (src), PGUID (dst));
 
   /* Update latency estimates if we have a timestamp -- won't actually
      work so well if the timestamp can be a left over from some other
@@ -851,7 +851,7 @@ static int handle_AckNack (struct receiver_state *rst, nn_etime_t tnow, const Ac
       rn->seq = wr->seq;
     }
     ddsrt_avl_augment_update (&wr_readers_treedef, rn);
-    DDS_LOG(DDS_LC_THROTTLE, "writer %x:%x:%x:%x considering reader %x:%x:%x:%x responsive again\n", PGUID (wr->e.guid), PGUID (rn->prd_guid));
+    DDS_LOG(DDS_LC_THROTTLE, "writer "PGUIDFMT" considering reader "PGUIDFMT" responsive again\n", PGUID (wr->e.guid), PGUID (rn->prd_guid));
   }
 
   /* Second, the NACK bits (literally, that is). To do so, attempt to
@@ -1143,7 +1143,7 @@ static void handle_Heartbeat_helper (struct pwr_rd_match * const wn, struct hand
   /* Not supposed to respond to repeats and old heartbeats. */
   if (!accept_ack_or_hb_w_timeout (msg->count, &wn->next_heartbeat, arg->tnow, &wn->t_heartbeat_accepted, 0))
   {
-    DDS_TRACE(" (%x:%x:%x:%x)", PGUID (wn->rd_guid));
+    DDS_TRACE(" ("PGUIDFMT")", PGUID (wn->rd_guid));
     return;
   }
 
@@ -1154,7 +1154,7 @@ static void handle_Heartbeat_helper (struct pwr_rd_match * const wn, struct hand
     refseq = nn_reorder_next_seq (pwr->reorder) - 1;
   else
     refseq = nn_reorder_next_seq (wn->u.not_in_sync.reorder) - 1;
-    DDS_TRACE(" %x:%x:%x:%x@%"PRId64"%s", PGUID (wn->rd_guid), refseq, (wn->in_sync == PRMSS_SYNC) ? "(sync)" : (wn->in_sync == PRMSS_TLCATCHUP) ? "(tlcatchup)" : "");
+    DDS_TRACE(" "PGUIDFMT"@%"PRId64"%s", PGUID (wn->rd_guid), refseq, (wn->in_sync == PRMSS_SYNC) ? "(sync)" : (wn->in_sync == PRMSS_TLCATCHUP) ? "(tlcatchup)" : "");
 
   /* Reschedule AckNack transmit if deemed appropriate; unreliable
      readers have acknack_xevent == NULL and can't do this.
@@ -1214,17 +1214,17 @@ static int handle_Heartbeat (struct receiver_state *rst, nn_etime_t tnow, struct
   dst.prefix = rst->dst_guid_prefix;
   dst.entityid = msg->readerId;
 
-  DDS_TRACE("HEARTBEAT(%s#%d:%"PRId64"..%"PRId64" ", msg->smhdr.flags & HEARTBEAT_FLAG_FINAL ? "F" : "", msg->count, firstseq, lastseq);
+  DDS_TRACE("HEARTBEAT(%s#%"PRId32":%"PRId64"..%"PRId64" ", msg->smhdr.flags & HEARTBEAT_FLAG_FINAL ? "F" : "", msg->count, firstseq, lastseq);
 
   if (!rst->forme)
   {
-    DDS_TRACE("%x:%x:%x:%x -> %x:%x:%x:%x not-for-me)", PGUID (src), PGUID (dst));
+    DDS_TRACE(""PGUIDFMT" -> "PGUIDFMT" not-for-me)", PGUID (src), PGUID (dst));
     return 1;
   }
 
   if ((pwr = ephash_lookup_proxy_writer_guid (&src)) == NULL)
   {
-    DDS_TRACE("%x:%x:%x:%x? -> %x:%x:%x:%x)", PGUID (src), PGUID (dst));
+    DDS_TRACE(""PGUIDFMT"? -> "PGUIDFMT")", PGUID (src), PGUID (dst));
     return 1;
   }
 
@@ -1232,7 +1232,7 @@ static int handle_Heartbeat (struct receiver_state *rst, nn_etime_t tnow, struct
   if (pwr->assert_pp_lease)
     lease_renew (ddsrt_atomic_ldvoidp (&pwr->c.proxypp->lease), tnow);
 
-  DDS_TRACE("%x:%x:%x:%x -> %x:%x:%x:%x:", PGUID (src), PGUID (dst));
+  DDS_TRACE(""PGUIDFMT" -> "PGUIDFMT":", PGUID (src), PGUID (dst));
 
   ddsrt_mutex_lock (&pwr->e.lock);
 
@@ -1311,7 +1311,7 @@ static int handle_Heartbeat (struct receiver_state *rst, nn_etime_t tnow, struct
         if (wn->u.not_in_sync.end_of_tl_seq == MAX_SEQ_NUMBER)
         {
           wn->u.not_in_sync.end_of_out_of_sync_seq = wn->u.not_in_sync.end_of_tl_seq = fromSN (msg->lastSN);
-          DDS_TRACE(" end-of-tl-seq(rd %x:%x:%x:%x #%"PRId64")", PGUID(wn->rd_guid), wn->u.not_in_sync.end_of_tl_seq);
+          DDS_TRACE(" end-of-tl-seq(rd "PGUIDFMT" #%"PRId64")", PGUID(wn->rd_guid), wn->u.not_in_sync.end_of_tl_seq);
         }
         maybe_set_reader_in_sync (pwr, wn, last_deliv_seq);
       }
@@ -1343,16 +1343,16 @@ static int handle_HeartbeatFrag (struct receiver_state *rst, UNUSED_ARG(nn_etime
   dst.prefix = rst->dst_guid_prefix;
   dst.entityid = msg->readerId;
 
-  DDS_TRACE("HEARTBEATFRAG(#%d:%"PRId64"/[1,%u]", msg->count, seq, fragnum+1);
+  DDS_TRACE("HEARTBEATFRAG(#%"PRId32":%"PRId64"/[1,%u]", msg->count, seq, fragnum+1);
   if (!rst->forme)
   {
-    DDS_TRACE(" %x:%x:%x:%x -> %x:%x:%x:%x not-for-me)", PGUID (src), PGUID (dst));
+    DDS_TRACE(" "PGUIDFMT" -> "PGUIDFMT" not-for-me)", PGUID (src), PGUID (dst));
     return 1;
   }
 
   if ((pwr = ephash_lookup_proxy_writer_guid (&src)) == NULL)
   {
-    DDS_TRACE(" %x:%x:%x:%x? -> %x:%x:%x:%x)", PGUID (src), PGUID (dst));
+    DDS_TRACE(" "PGUIDFMT"? -> "PGUIDFMT")", PGUID (src), PGUID (dst));
     return 1;
   }
 
@@ -1360,7 +1360,7 @@ static int handle_HeartbeatFrag (struct receiver_state *rst, UNUSED_ARG(nn_etime
   if (pwr->assert_pp_lease)
     lease_renew (ddsrt_atomic_ldvoidp (&pwr->c.proxypp->lease), tnow);
 
-  DDS_TRACE(" %x:%x:%x:%x -> %x:%x:%x:%x", PGUID (src), PGUID (dst));
+  DDS_TRACE(" "PGUIDFMT" -> "PGUIDFMT"", PGUID (src), PGUID (dst));
   ddsrt_mutex_lock (&pwr->e.lock);
 
   if (seq > pwr->last_seq)
@@ -1459,19 +1459,19 @@ static int handle_NackFrag (struct receiver_state *rst, nn_etime_t tnow, const N
   dst.prefix = rst->dst_guid_prefix;
   dst.entityid = msg->writerId;
 
-  DDS_TRACE("NACKFRAG(#%d:%"PRId64"/%u/%u:", *countp, seq, msg->fragmentNumberState.bitmap_base, msg->fragmentNumberState.numbits);
+  DDS_TRACE("NACKFRAG(#%"PRId32":%"PRId64"/%u/%"PRIu32":", *countp, seq, msg->fragmentNumberState.bitmap_base, msg->fragmentNumberState.numbits);
   for (i = 0; i < msg->fragmentNumberState.numbits; i++)
     DDS_TRACE("%c", nn_bitset_isset (msg->fragmentNumberState.numbits, msg->fragmentNumberState.bits, i) ? '1' : '0');
 
   if (!rst->forme)
   {
-    DDS_TRACE(" %x:%x:%x:%x -> %x:%x:%x:%x not-for-me)", PGUID (src), PGUID (dst));
+    DDS_TRACE(" "PGUIDFMT" -> "PGUIDFMT" not-for-me)", PGUID (src), PGUID (dst));
     return 1;
   }
 
   if ((wr = ephash_lookup_writer_guid (&dst)) == NULL)
   {
-    DDS_TRACE(" %x:%x:%x:%x -> %x:%x:%x:%x?)", PGUID (src), PGUID (dst));
+    DDS_TRACE(" "PGUIDFMT" -> "PGUIDFMT"?)", PGUID (src), PGUID (dst));
     return 1;
   }
   /* Always look up the proxy reader -- even though we don't need for
@@ -1480,7 +1480,7 @@ static int handle_NackFrag (struct receiver_state *rst, nn_etime_t tnow, const N
      only retrieve it when needed. */
   if ((prd = ephash_lookup_proxy_reader_guid (&src)) == NULL)
   {
-    DDS_TRACE(" %x:%x:%x:%x? -> %x:%x:%x:%x)", PGUID (src), PGUID (dst));
+    DDS_TRACE(" "PGUIDFMT"? -> "PGUIDFMT")", PGUID (src), PGUID (dst));
     return 1;
   }
 
@@ -1490,25 +1490,25 @@ static int handle_NackFrag (struct receiver_state *rst, nn_etime_t tnow, const N
 
   if (!wr->reliable) /* note: reliability can't be changed */
   {
-    DDS_TRACE(" %x:%x:%x:%x -> %x:%x:%x:%x not a reliable writer)", PGUID (src), PGUID (dst));
+    DDS_TRACE(" "PGUIDFMT" -> "PGUIDFMT" not a reliable writer)", PGUID (src), PGUID (dst));
     return 1;
   }
 
   ddsrt_mutex_lock (&wr->e.lock);
   if ((rn = ddsrt_avl_lookup (&wr_readers_treedef, &wr->readers, &src)) == NULL)
   {
-    DDS_TRACE(" %x:%x:%x:%x -> %x:%x:%x:%x not a connection", PGUID (src), PGUID (dst));
+    DDS_TRACE(" "PGUIDFMT" -> "PGUIDFMT" not a connection", PGUID (src), PGUID (dst));
     goto out;
   }
 
   /* Ignore old NackFrags (see also handle_AckNack) */
   if (*countp < rn->next_nackfrag)
   {
-    DDS_TRACE(" [%x:%x:%x:%x -> %x:%x:%x:%x]", PGUID (src), PGUID (dst));
+    DDS_TRACE(" ["PGUIDFMT" -> "PGUIDFMT"]", PGUID (src), PGUID (dst));
     goto out;
   }
   rn->next_nackfrag = *countp + 1;
-  DDS_TRACE(" %x:%x:%x:%x -> %x:%x:%x:%x", PGUID (src), PGUID (dst));
+  DDS_TRACE(" "PGUIDFMT" -> "PGUIDFMT"", PGUID (src), PGUID (dst));
 
   /* Resend the requested fragments if we still have the sample, send
      a Gap if we don't have them anymore. */
@@ -1569,7 +1569,7 @@ static int handle_NackFrag (struct receiver_state *rst, nn_etime_t tnow, const N
 static int handle_InfoDST (struct receiver_state *rst, const InfoDST_t *msg, const nn_guid_prefix_t *dst_prefix)
 {
   rst->dst_guid_prefix = nn_ntoh_guid_prefix (msg->guid_prefix);
-  DDS_TRACE("INFODST(%x:%x:%x)", PGUIDPREFIX (rst->dst_guid_prefix));
+  DDS_TRACE("INFODST(%"PRIx32":%"PRIx32":%"PRIx32")", PGUIDPREFIX (rst->dst_guid_prefix));
   if (rst->dst_guid_prefix.u[0] == 0 && rst->dst_guid_prefix.u[1] == 0 && rst->dst_guid_prefix.u[2] == 0)
   {
     if (dst_prefix)
@@ -1591,7 +1591,7 @@ static int handle_InfoSRC (struct receiver_state *rst, const InfoSRC_t *msg)
   rst->src_guid_prefix = nn_ntoh_guid_prefix (msg->guid_prefix);
   rst->protocol_version = msg->version;
   rst->vendor = msg->vendorid;
-  DDS_TRACE("INFOSRC(%x:%x:%x vendor %u.%u)",
+  DDS_TRACE("INFOSRC(%"PRIx32":%"PRIx32":%"PRIx32" vendor %u.%u)",
           PGUIDPREFIX (rst->src_guid_prefix), rst->vendor.id[0], rst->vendor.id[1]);
   return 1;
 }
@@ -1710,7 +1710,7 @@ static int handle_Gap (struct receiver_state *rst, nn_etime_t tnow, struct nn_rm
   dst.entityid = msg->readerId;
   gapstart = fromSN (msg->gapStart);
   listbase = fromSN (msg->gapList.bitmap_base);
-  DDS_TRACE("GAP(%"PRId64"..%"PRId64"/%u ", gapstart, listbase, msg->gapList.numbits);
+  DDS_TRACE("GAP(%"PRId64"..%"PRId64"/%"PRIu32" ", gapstart, listbase, msg->gapList.numbits);
 
   /* There is no _good_ reason for a writer to start the bitmap with a
      1 bit, but check for it just in case, to reduce the number of
@@ -1722,13 +1722,13 @@ static int handle_Gap (struct receiver_state *rst, nn_etime_t tnow, struct nn_rm
 
   if (!rst->forme)
   {
-    DDS_TRACE("%x:%x:%x:%x -> %x:%x:%x:%x not-for-me)", PGUID (src), PGUID (dst));
+    DDS_TRACE(""PGUIDFMT" -> "PGUIDFMT" not-for-me)", PGUID (src), PGUID (dst));
     return 1;
   }
 
   if ((pwr = ephash_lookup_proxy_writer_guid (&src)) == NULL)
   {
-    DDS_TRACE("%x:%x:%x:%x? -> %x:%x:%x:%x)", PGUID (src), PGUID (dst));
+    DDS_TRACE(""PGUIDFMT"? -> "PGUIDFMT")", PGUID (src), PGUID (dst));
     return 1;
   }
 
@@ -1739,11 +1739,11 @@ static int handle_Gap (struct receiver_state *rst, nn_etime_t tnow, struct nn_rm
   ddsrt_mutex_lock (&pwr->e.lock);
   if ((wn = ddsrt_avl_lookup (&pwr_readers_treedef, &pwr->readers, &dst)) == NULL)
   {
-    DDS_TRACE("%x:%x:%x:%x -> %x:%x:%x:%x not a connection)", PGUID (src), PGUID (dst));
+    DDS_TRACE(PGUIDFMT" -> "PGUIDFMT" not a connection)", PGUID (src), PGUID (dst));
     ddsrt_mutex_unlock (&pwr->e.lock);
     return 1;
   }
-  DDS_TRACE("%x:%x:%x:%x -> %x:%x:%x:%x", PGUID (src), PGUID (dst));
+  DDS_TRACE(PGUIDFMT" -> "PGUIDFMT, PGUID (src), PGUID (dst));
 
   if (!pwr->have_seen_heartbeat && pwr->n_reliable_readers > 0)
   {
@@ -1831,8 +1831,8 @@ static struct ddsi_serdata *extract_sample_from_data
     {
       const struct proxy_writer *pwr = sampleinfo->pwr;
       nn_guid_t guid = pwr ? pwr->e.guid : null_guid; /* can't be null _yet_, but that might change some day */
-      DDS_TRACE("data(application, vendor %u.%u): %x:%x:%x:%x #%"PRId64
-              ": write without proper payload (data_smhdr_flags 0x%x size %u)\n",
+      DDS_TRACE("data(application, vendor %u.%u): "PGUIDFMT" #%"PRId64
+              ": write without proper payload (data_smhdr_flags 0x%x size %"PRIu32")\n",
               sampleinfo->rst->vendor.id[0], sampleinfo->rst->vendor.id[1],
               PGUID (guid), sampleinfo->seq,
               data_smhdr_flags, sampleinfo->size);
@@ -1882,7 +1882,7 @@ static struct ddsi_serdata *extract_sample_from_data
     nn_guid_t guid = pwr ? pwr->e.guid : null_guid; /* can't be null _yet_, but that might change some day */
     DDS_WARNING
     (
-      "data(application, vendor %u.%u): %x:%x:%x:%x #%"PRId64": deserialization %s/%s failed (%s)\n",
+      "data(application, vendor %u.%u): "PGUIDFMT" #%"PRId64": deserialization %s/%s failed (%s)\n",
       sampleinfo->rst->vendor.id[0], sampleinfo->rst->vendor.id[1],
       PGUID (guid), sampleinfo->seq,
       topic->name, topic->type_name,
@@ -1988,7 +1988,7 @@ static int deliver_user_data (const struct nn_rsample_info *sampleinfo, const st
     if ((plist_ret = nn_plist_init_frommsg (&qos, NULL, PP_STATUSINFO | PP_KEYHASH | PP_COHERENT_SET | PP_PRISMTECH_EOTINFO, 0, &src)) < 0)
     {
       if (plist_ret != Q_ERR_INCOMPATIBLE)
-        DDS_WARNING ("data(application, vendor %u.%u): %x:%x:%x:%x #%"PRId64": invalid inline qos\n",
+        DDS_WARNING ("data(application, vendor %u.%u): "PGUIDFMT" #%"PRId64": invalid inline qos\n",
                      src.vendorid.id[0], src.vendorid.id[1], PGUID (pwr->e.guid), sampleinfo->seq);
       return 0;
     }
@@ -2047,7 +2047,7 @@ retry:
           unsigned i;
           for (i = 0; rdary[i]; i++)
           {
-            DDS_TRACE("reader %x:%x:%x:%x\n", PGUID (rdary[i]->e.guid));
+            DDS_TRACE("reader "PGUIDFMT"\n", PGUID (rdary[i]->e.guid));
             if (! (ddsi_plugin.rhc_plugin.rhc_store_fn) (rdary[i]->rhc, &pwr_info, payload, tk))
             {
               if (pwr_locked) ddsrt_mutex_unlock (&pwr->e.lock);
@@ -2078,7 +2078,7 @@ retry:
             struct reader *rd;
             if ((rd = ephash_lookup_reader_guid (&m->rd_guid)) != NULL)
             {
-              DDS_TRACE("reader-via-guid %x:%x:%x:%x\n", PGUID (rd->e.guid));
+              DDS_TRACE("reader-via-guid "PGUIDFMT"\n", PGUID (rd->e.guid));
               (void) (ddsi_plugin.rhc_plugin.rhc_store_fn) (rd->rhc, &pwr_info, payload, tk);
             }
           }
@@ -2090,7 +2090,7 @@ retry:
       else
       {
         struct reader *rd = ephash_lookup_reader_guid (rdguid);;
-        DDS_TRACE(" %"PRId64"=>%x:%x:%x:%x%s\n", sampleinfo->seq, PGUID (*rdguid), rd ? "" : "?");
+        DDS_TRACE(" %"PRId64"=>"PGUIDFMT"%s\n", sampleinfo->seq, PGUID (*rdguid), rd ? "" : "?");
         while (rd && ! (ddsi_plugin.rhc_plugin.rhc_store_fn) (rd->rhc, &pwr_info, payload, tk) && ephash_lookup_proxy_writer_guid (&pwr->e.guid))
         {
           if (pwr_locked) ddsrt_mutex_unlock (&pwr->e.lock);
@@ -2166,7 +2166,7 @@ static void handle_regular (struct receiver_state *rst, nn_etime_t tnow, struct
     nn_guid_t src;
     src.prefix = rst->src_guid_prefix;
     src.entityid = msg->writerId;
-    DDS_TRACE(" %x:%x:%x:%x? -> %x:%x:%x:%x", PGUID (src), PGUID (dst));
+    DDS_TRACE(" "PGUIDFMT"? -> "PGUIDFMT, PGUID (src), PGUID (dst));
     return;
   }
 
@@ -2195,14 +2195,14 @@ static void handle_regular (struct receiver_state *rst, nn_etime_t tnow, struct
   if (!pwr->have_seen_heartbeat && pwr->n_reliable_readers > 0)
   {
     ddsrt_mutex_unlock (&pwr->e.lock);
-    DDS_TRACE(" %x:%x:%x:%x -> %x:%x:%x:%x: no heartbeat seen yet", PGUID (pwr->e.guid), PGUID (dst));
+    DDS_TRACE(" "PGUIDFMT" -> "PGUIDFMT": no heartbeat seen yet", PGUID (pwr->e.guid), PGUID (dst));
     return;
   }
 
   if (ddsrt_avl_is_empty (&pwr->readers) || pwr->local_matching_inprogress)
   {
     ddsrt_mutex_unlock (&pwr->e.lock);
-    DDS_TRACE(" %x:%x:%x:%x -> %x:%x:%x:%x: no readers", PGUID (pwr->e.guid), PGUID (dst));
+    DDS_TRACE(" "PGUIDFMT" -> "PGUIDFMT": no readers", PGUID (pwr->e.guid), PGUID (dst));
     return;
   }
 
@@ -2359,7 +2359,7 @@ static void drop_oversize (struct receiver_state *rst, struct nn_rmsg *rmsg, con
        cause periodic warnings. */
     if (msg->writerId.u == NN_ENTITYID_SPDP_BUILTIN_PARTICIPANT_WRITER)
     {
-      DDS_WARNING ("dropping oversize (%u > %u) SPDP sample %"PRId64" from remote writer %x:%x:%x:%x\n",
+      DDS_WARNING ("dropping oversize (%"PRIu32" > %"PRIu32") SPDP sample %"PRId64" from remote writer "PGUIDFMT"\n",
                    sampleinfo->size, config.max_sample_size, sampleinfo->seq,
                    PGUIDPREFIX (rst->src_guid_prefix), msg->writerId.u);
     }
@@ -2389,7 +2389,7 @@ static void drop_oversize (struct receiver_state *rst, struct nn_rmsg *rmsg, con
     {
       const char *tname = pwr->c.topic ? pwr->c.topic->name : "(null)";
       const char *ttname = pwr->c.topic ? pwr->c.topic->type_name : "(null)";
-      DDS_WARNING ("dropping oversize (%u > %u) sample %"PRId64" from remote writer %x:%x:%x:%x %s/%s\n",
+      DDS_WARNING ("dropping oversize (%"PRIu32" > %"PRIu32") sample %"PRId64" from remote writer "PGUIDFMT" %s/%s\n",
                    sampleinfo->size, config.max_sample_size, sampleinfo->seq,
                    PGUIDPREFIX (rst->src_guid_prefix), msg->writerId.u,
                    tname, ttname);
@@ -2399,7 +2399,7 @@ static void drop_oversize (struct receiver_state *rst, struct nn_rmsg *rmsg, con
 
 static int handle_Data (struct receiver_state *rst, nn_etime_t tnow, struct nn_rmsg *rmsg, const Data_t *msg, size_t size, struct nn_rsample_info *sampleinfo, unsigned char *datap, struct nn_dqueue **deferred_wakeup)
 {
-  DDS_TRACE("DATA(%x:%x:%x:%x -> %x:%x:%x:%x #%"PRId64"",
+  DDS_TRACE("DATA("PGUIDFMT" -> "PGUIDFMT" #%"PRId64,
           PGUIDPREFIX (rst->src_guid_prefix), msg->x.writerId.u,
           PGUIDPREFIX (rst->dst_guid_prefix), msg->x.readerId.u,
           fromSN (msg->x.writerSN));
@@ -2443,7 +2443,7 @@ static int handle_Data (struct receiver_state *rst, nn_etime_t tnow, struct nn_r
 
 static int handle_DataFrag (struct receiver_state *rst, nn_etime_t tnow, struct nn_rmsg *rmsg, const DataFrag_t *msg, size_t size, struct nn_rsample_info *sampleinfo, unsigned char *datap, struct nn_dqueue **deferred_wakeup)
 {
-  DDS_TRACE("DATAFRAG(%x:%x:%x:%x -> %x:%x:%x:%x #%"PRId64"/[%u..%u]",
+  DDS_TRACE("DATAFRAG("PGUIDFMT" -> "PGUIDFMT" #%"PRId64"/[%u..%u]",
           PGUIDPREFIX (rst->src_guid_prefix), msg->x.writerId.u,
           PGUIDPREFIX (rst->dst_guid_prefix), msg->x.readerId.u,
           fromSN (msg->x.writerSN),
@@ -2463,7 +2463,7 @@ static int handle_DataFrag (struct receiver_state *rst, nn_etime_t tnow, struct
     uint32_t begin, endp1;
     if (msg->x.writerId.u == NN_ENTITYID_SPDP_BUILTIN_PARTICIPANT_WRITER)
     {
-      DDS_WARNING ("DATAFRAG(%x:%x:%x:%x #%"PRId64" -> %x:%x:%x:%x) - fragmented builtin data not yet supported\n",
+      DDS_WARNING ("DATAFRAG("PGUIDFMT" #%"PRId64" -> "PGUIDFMT") - fragmented builtin data not yet supported\n",
                    PGUIDPREFIX (rst->src_guid_prefix), msg->x.writerId.u, fromSN (msg->x.writerSN),
                    PGUIDPREFIX (rst->dst_guid_prefix), msg->x.readerId.u);
       return 1;
@@ -2496,7 +2496,7 @@ static int handle_DataFrag (struct receiver_state *rst, nn_etime_t tnow, struct
          here */
       endp1 = msg->sampleSize;
     }
-    DDS_TRACE("/[%u..%u) of %u", begin, endp1, msg->sampleSize);
+    DDS_TRACE("/[%"PRIu32"..%"PRIu32") of %"PRIu32, begin, endp1, msg->sampleSize);
 
     rdata = nn_rdata_new (rmsg, begin, endp1, submsg_offset, payload_offset);
 
@@ -2910,7 +2910,7 @@ static int handle_submsg_sequence
 #endif /* DDSI_INCLUDE_ENCRYPTION */
               break;
             default:
-              DDS_TRACE("(unknown id %u?)\n", sm->pt_infocontainer.id);
+              DDS_TRACE("(unknown id %"PRIu32"?)\n", sm->pt_infocontainer.id);
           }
         }
         break;
@@ -2919,7 +2919,7 @@ static int handle_submsg_sequence
 #if 0
         state = "parse:msg_len";
 #endif
-        DDS_TRACE("MSG_LEN(%u)", ((MsgLen_t*) sm)->length);
+        DDS_TRACE("MSG_LEN(%"PRIu32")", ((MsgLen_t*) sm)->length);
         break;
       }
       case SMID_PT_ENTITY_ID:
@@ -3086,7 +3086,7 @@ static bool do_packet
     else if (hdr->version.major != RTPS_MAJOR || (hdr->version.major == RTPS_MAJOR && hdr->version.minor < RTPS_MINOR_MINIMUM))
     {
       if ((hdr->version.major == RTPS_MAJOR && hdr->version.minor < RTPS_MINOR_MINIMUM))
-        DDS_TRACE("HDR(%x:%x:%x vendor %d.%d) len %lu\n, version mismatch: %d.%d\n",
+        DDS_TRACE("HDR(%"PRIx32":%"PRIx32":%"PRIx32" vendor %d.%d) len %lu\n, version mismatch: %d.%d\n",
                   PGUIDPREFIX (hdr->guid_prefix), hdr->vendorid.id[0], hdr->vendorid.id[1], (unsigned long) sz, hdr->version.major, hdr->version.minor);
       if (NN_PEDANTIC_P)
         malformed_packet_received_nosubmsg (buff, sz, "header", hdr->vendorid);
@@ -3099,7 +3099,7 @@ static bool do_packet
       {
         char addrstr[DDSI_LOCSTRLEN];
         ddsi_locator_to_string(addrstr, sizeof(addrstr), &srcloc);
-        DDS_TRACE("HDR(%x:%x:%x vendor %d.%d) len %lu from %s\n",
+        DDS_TRACE("HDR(%"PRIx32":%"PRIx32":%"PRIx32" vendor %d.%d) len %lu from %s\n",
                   PGUIDPREFIX (hdr->guid_prefix), hdr->vendorid.id[0], hdr->vendorid.id[1], (unsigned long) sz, addrstr);
       }
 
@@ -3173,7 +3173,7 @@ static void rebuild_local_participant_set (struct thread_state1 * const ts1, str
   struct ephash_enum_participant est;
   struct participant *pp;
   unsigned nps_alloc;
-  DDS_TRACE("pp set gen changed: local %u global %"PRIu32"\n", lps->gen, ddsrt_atomic_ld32(&gv.participant_set_generation));
+  DDS_TRACE("pp set gen changed: local %"PRIu32" global %"PRIu32"\n", lps->gen, ddsrt_atomic_ld32(&gv.participant_set_generation));
   thread_state_awake (ts1);
  restart:
   lps->gen = ddsrt_atomic_ld32 (&gv.participant_set_generation);
@@ -3201,7 +3201,7 @@ static void rebuild_local_participant_set (struct thread_state1 * const ts1, str
     {
       lps->ps[lps->nps].m_conn = pp->m_conn;
       lps->ps[lps->nps].guid_prefix = pp->e.guid.prefix;
-      DDS_TRACE("  pp %x:%x:%x:%x handle %"PRIdSOCK"\n", PGUID (pp->e.guid), ddsi_conn_handle (pp->m_conn));
+      DDS_TRACE("  pp "PGUIDFMT" handle %"PRIdSOCK"\n", PGUID (pp->e.guid), ddsi_conn_handle (pp->m_conn));
       lps->nps++;
     }
   }
diff --git a/src/core/ddsi/src/q_sockwaitset.c b/src/core/ddsi/src/q_sockwaitset.c
index 7d811e7..f8a761f 100644
--- a/src/core/ddsi/src/q_sockwaitset.c
+++ b/src/core/ddsi/src/q_sockwaitset.c
@@ -873,7 +873,7 @@ os_sockWaitsetCtx os_sockWaitsetWait (os_sockWaitset ws)
     dds_retcode_t rc = ddsrt_select (fdmax, rdset, NULL, NULL, DDS_INFINITY, &n);
     if (rc != DDS_RETCODE_OK && rc != DDS_RETCODE_INTERRUPTED && rc != DDS_RETCODE_TRY_AGAIN)
     {
-      DDS_WARNING("os_sockWaitsetWait: select failed, retcode = %d", rc);
+      DDS_WARNING("os_sockWaitsetWait: select failed, retcode = %"PRId32, rc);
       break;
     }
   }
diff --git a/src/core/ddsi/src/q_thread.c b/src/core/ddsi/src/q_thread.c
index 9ca93fc..e8ed142 100644
--- a/src/core/ddsi/src/q_thread.c
+++ b/src/core/ddsi/src/q_thread.c
@@ -275,7 +275,7 @@ dds_retcode_t create_thread (struct thread_state1 **ts1, const char *name, uint3
     if (!tprops->stack_size.isdefault)
       tattr.stackSize = tprops->stack_size.value;
   }
-  DDS_TRACE("create_thread: %s: class %d priority %d stack %u\n", name, (int) tattr.schedClass, tattr.schedPriority, tattr.stackSize);
+  DDS_TRACE("create_thread: %s: class %d priority %"PRId32" stack %"PRIu32"\n", name, (int) tattr.schedClass, tattr.schedPriority, tattr.stackSize);
 
   if (ddsrt_thread_create (&tid, name, &tattr, &create_thread_wrapper, ctxt) != DDS_RETCODE_OK)
   {
diff --git a/src/core/ddsi/src/q_transmit.c b/src/core/ddsi/src/q_transmit.c
index c83c008..7401d3b 100644
--- a/src/core/ddsi/src/q_transmit.c
+++ b/src/core/ddsi/src/q_transmit.c
@@ -185,11 +185,11 @@ struct nn_xmsg *writer_hbcontrol_create_heartbeat (struct writer *wr, const stru
     }
   }
 
-  DDS_TRACE("writer_hbcontrol: wr %x:%x:%x:%x ", PGUID (wr->e.guid));
+  DDS_TRACE("writer_hbcontrol: wr "PGUIDFMT" ", PGUID (wr->e.guid));
   if (prd_guid == NULL)
     DDS_TRACE("multicasting ");
   else
-    DDS_TRACE("unicasting to prd %x:%x:%x:%x ", PGUID (*prd_guid));
+    DDS_TRACE("unicasting to prd "PGUIDFMT" ", PGUID (*prd_guid));
   DDS_TRACE("(rel-prd %d seq-eq-max %d seq %"PRId64" maxseq %"PRId64")\n",
           wr->num_reliable_readers,
           ddsrt_avl_is_empty (&wr->readers) ? -1 : root_rdmatch (wr)->num_reliable_readers_where_seq_equals_max,
@@ -209,7 +209,7 @@ struct nn_xmsg *writer_hbcontrol_create_heartbeat (struct writer *wr, const stru
     struct proxy_reader *prd;
     if ((prd = ephash_lookup_proxy_reader_guid (prd_guid)) == NULL)
     {
-      DDS_TRACE("writer_hbcontrol: wr %x:%x:%x:%x unknown prd %x:%x:%x:%x\n", PGUID (wr->e.guid), PGUID (*prd_guid));
+      DDS_TRACE("writer_hbcontrol: wr "PGUIDFMT" unknown prd "PGUIDFMT"\n", PGUID (wr->e.guid), PGUID (*prd_guid));
       nn_xmsg_free (msg);
       return NULL;
     }
@@ -308,7 +308,7 @@ struct nn_xmsg *writer_hbcontrol_piggyback (struct writer *wr, const struct whc_
 
   if (msg)
   {
-    DDS_TRACE("heartbeat(wr %x:%x:%x:%x%s) piggybacked, resched in %g s (min-ack %"PRId64"%s, avail-seq %"PRId64", xmit %"PRId64")\n",
+    DDS_TRACE("heartbeat(wr "PGUIDFMT"%s) piggybacked, resched in %g s (min-ack %"PRId64"%s, avail-seq %"PRId64", xmit %"PRId64")\n",
             PGUID (wr->e.guid),
             *hbansreq ? "" : " final",
             (hbc->tsched.v == T_NEVER) ? POS_INFINITY_DOUBLE : (double) (hbc->tsched.v - tnow.v) / 1e9,
@@ -635,7 +635,7 @@ int create_fragment_message (struct writer *wr, seqno_t seq, const struct nn_pli
   nn_xmsg_serdata (*pmsg, serdata, fragstart, fraglen);
   nn_xmsg_submsg_setnext (*pmsg, sm_marker);
 #if 0
-  DDS_TRACE("queue data%s %x:%x:%x:%x #%lld/%u[%u..%u)\n",
+  DDS_TRACE("queue data%s "PGUIDFMT" #%lld/%u[%u..%u)\n",
           fragging ? "frag" : "", PGUID (wr->e.guid),
           seq, fragnum+1, fragstart, fragstart + fraglen);
 #endif
@@ -871,10 +871,10 @@ static int insert_sample_in_whc (struct writer *wr, seqno_t seq, struct nn_plist
     const char *ttname = wr->topic ? wr->topic->type_name : "(null)";
     ppbuf[0] = '\0';
     tmp = sizeof (ppbuf) - 1;
-    DDS_TRACE("write_sample %x:%x:%x:%x #%"PRId64"", PGUID (wr->e.guid), seq);
+    DDS_TRACE("write_sample "PGUIDFMT" #%"PRId64, PGUID (wr->e.guid), seq);
     if (plist != 0 && (plist->present & PP_COHERENT_SET))
       DDS_TRACE(" C#%"PRId64"", fromSN (plist->coherent_set_seqno));
-    DDS_TRACE(": ST%u %s/%s:%s%s\n", serdata->statusinfo, tname, ttname, ppbuf, tmp < (int) sizeof (ppbuf) ? "" : " (trunc)");
+    DDS_TRACE(": ST%"PRIu32" %s/%s:%s%s\n", serdata->statusinfo, tname, ttname, ppbuf, tmp < (int) sizeof (ppbuf) ? "" : " (trunc)");
   }
 
   assert (wr->reliable || have_reliable_subs (wr) == 0);
@@ -960,7 +960,7 @@ static dds_retcode_t throttle_writer (struct thread_state1 * const ts1, struct n
     assert (!is_builtin_entityid(wr->e.guid.entityid, NN_VENDORID_ECLIPSE));
   }
 
-  DDS_LOG(DDS_LC_THROTTLE, "writer %x:%x:%x:%x waiting for whc to shrink below low-water mark (whc %"PRIuSIZE" low=%u high=%u)\n", PGUID (wr->e.guid), whcst.unacked_bytes, wr->whc_low, wr->whc_high);
+  DDS_LOG(DDS_LC_THROTTLE, "writer "PGUIDFMT" waiting for whc to shrink below low-water mark (whc %"PRIuSIZE" low=%"PRIu32" high=%"PRIu32")\n", PGUID (wr->e.guid), whcst.unacked_bytes, wr->whc_low, wr->whc_high);
   wr->throttling++;
   wr->throttle_count++;
 
@@ -1007,7 +1007,7 @@ static dds_retcode_t throttle_writer (struct thread_state1 * const ts1, struct n
     ddsrt_cond_broadcast (&wr->throttle_cond);
   }
 
-  DDS_LOG(DDS_LC_THROTTLE, "writer %x:%x:%x:%x done waiting for whc to shrink below low-water mark (whc %"PRIuSIZE" low=%u high=%u)\n", PGUID (wr->e.guid), whcst.unacked_bytes, wr->whc_low, wr->whc_high);
+  DDS_LOG(DDS_LC_THROTTLE, "writer "PGUIDFMT" done waiting for whc to shrink below low-water mark (whc %"PRIuSIZE" low=%"PRIu32" high=%"PRIu32")\n", PGUID (wr->e.guid), whcst.unacked_bytes, wr->whc_low, wr->whc_high);
   return result;
 }
 
@@ -1046,7 +1046,7 @@ static int write_sample_eot (struct thread_state1 * const ts1, struct nn_xpack *
     const char *ttname = wr->topic ? wr->topic->type_name : "(null)";
     ppbuf[0] = '\0';
     tmp = sizeof (ppbuf) - 1;
-    DDS_WARNING ("dropping oversize (%u > %u) sample from local writer %x:%x:%x:%x %s/%s:%s%s\n",
+    DDS_WARNING ("dropping oversize (%"PRIu32" > %"PRIu32") sample from local writer "PGUIDFMT" %s/%s:%s%s\n",
                  ddsi_serdata_size (serdata), config.max_sample_size,
                  PGUID (wr->e.guid), tname, ttname, ppbuf,
                  tmp < (int) sizeof (ppbuf) ? "" : " (trunc)");
diff --git a/src/core/ddsi/src/q_xevent.c b/src/core/ddsi/src/q_xevent.c
index bbeb9c2..e4b107b 100644
--- a/src/core/ddsi/src/q_xevent.c
+++ b/src/core/ddsi/src/q_xevent.c
@@ -196,7 +196,7 @@ static void trace_msg (const char *func, const struct nn_xmsg *m)
     seqno_t wrseq;
     nn_fragment_number_t wrfragid;
     nn_xmsg_guid_seq_fragid (m, &wrguid, &wrseq, &wrfragid);
-    DDS_TRACE(" %s(%x:%x:%x:%x/%"PRId64"/%u)", func, PGUID (wrguid), wrseq, wrfragid);
+    DDS_TRACE(" %s("PGUIDFMT"/%"PRId64"/%u)", func, PGUID (wrguid), wrseq, wrfragid);
   }
 }
 #else
@@ -604,7 +604,7 @@ static void handle_xevk_heartbeat (struct nn_xpack *xp, struct xevent *ev, nn_mt
 
   if ((wr = ephash_lookup_writer_guid (&ev->u.heartbeat.wr_guid)) == NULL)
   {
-    DDS_TRACE("heartbeat(wr %x:%x:%x:%x) writer gone\n",
+    DDS_TRACE("heartbeat(wr "PGUIDFMT") writer gone\n",
             PGUID (ev->u.heartbeat.wr_guid));
     return;
   }
@@ -631,7 +631,7 @@ static void handle_xevk_heartbeat (struct nn_xpack *xp, struct xevent *ev, nn_mt
     t_next.v = tnow.v + writer_hbcontrol_intv (wr, &whcst, tnow);
   }
 
-  DDS_TRACE("heartbeat(wr %x:%x:%x:%x%s) %s, resched in %g s (min-ack %"PRId64"%s, avail-seq %"PRId64", xmit %"PRId64")\n",
+  DDS_TRACE("heartbeat(wr "PGUIDFMT"%s) %s, resched in %g s (min-ack %"PRId64"%s, avail-seq %"PRId64", xmit %"PRId64")\n",
           PGUID (wr->e.guid),
           hbansreq ? "" : " final",
           msg ? "sent" : "suppressed",
@@ -826,7 +826,7 @@ static void add_AckNack (struct nn_xmsg *msg, struct proxy_writer *pwr, struct p
     nn_xmsg_shrink (msg, sm_marker, ACKNACK_SIZE (an->readerSNState.numbits));
     nn_xmsg_submsg_setnext (msg, sm_marker);
 
-    DDS_TRACE("acknack %x:%x:%x:%x -> %x:%x:%x:%x: #%d:%"PRId64"/%u:",
+    DDS_TRACE("acknack "PGUIDFMT" -> "PGUIDFMT": #%"PRId32":%"PRId64"/%"PRIu32":",
             PGUID (rwn->rd_guid), PGUID (pwr->e.guid), rwn->count,
             base, an->readerSNState.numbits);
     for (ui = 0; ui != an->readerSNState.numbits; ui++)
@@ -857,7 +857,7 @@ static void add_AckNack (struct nn_xmsg *msg, struct proxy_writer *pwr, struct p
       *countp = ++pwr->nackfragcount;
       nn_xmsg_submsg_setnext (msg, sm_marker);
 
-      DDS_TRACE(" + nackfrag #%d:%"PRId64"/%u/%u:", *countp, fromSN (nf->writerSN), nf->fragmentNumberState.bitmap_base, nf->fragmentNumberState.numbits);
+      DDS_TRACE(" + nackfrag #%"PRId32":%"PRId64"/%u/%"PRIu32":", *countp, fromSN (nf->writerSN), nf->fragmentNumberState.bitmap_base, nf->fragmentNumberState.numbits);
       for (ui = 0; ui != nf->fragmentNumberState.numbits; ui++)
         DDS_TRACE("%c", nn_bitset_isset (nf->fragmentNumberState.numbits, nf->fragmentNumberState.bits, ui) ? '1' : '0');
     }
@@ -922,12 +922,12 @@ static void handle_xevk_acknack (UNUSED_ARG (struct nn_xpack *xp), struct xevent
          eventually. */
       resched_xevent_if_earlier (ev, add_duration_to_mtime (tnow, config.auto_resched_nack_delay));
     }
-    DDS_TRACE("send acknack(rd %x:%x:%x:%x -> pwr %x:%x:%x:%x)\n",
+    DDS_TRACE("send acknack(rd "PGUIDFMT" -> pwr "PGUIDFMT")\n",
             PGUID (ev->u.acknack.rd_guid), PGUID (ev->u.acknack.pwr_guid));
   }
   else
   {
-    DDS_TRACE("skip acknack(rd %x:%x:%x:%x -> pwr %x:%x:%x:%x): no address\n",
+    DDS_TRACE("skip acknack(rd "PGUIDFMT" -> pwr "PGUIDFMT"): no address\n",
             PGUID (ev->u.acknack.rd_guid), PGUID (ev->u.acknack.pwr_guid));
     msg = NULL;
   }
@@ -1009,7 +1009,7 @@ static void handle_xevk_spdp (UNUSED_ARG (struct nn_xpack *xp), struct xevent *e
 
   if ((pp = ephash_lookup_participant_guid (&ev->u.spdp.pp_guid)) == NULL)
   {
-    DDS_TRACE("handle_xevk_spdp %x:%x:%x:%x - unknown guid\n",
+    DDS_TRACE("handle_xevk_spdp "PGUIDFMT" - unknown guid\n",
             PGUID (ev->u.spdp.pp_guid));
     if (ev->u.spdp.directed)
       delete_xevent (ev);
@@ -1018,7 +1018,7 @@ static void handle_xevk_spdp (UNUSED_ARG (struct nn_xpack *xp), struct xevent *e
 
   if ((spdp_wr = get_builtin_writer (pp, NN_ENTITYID_SPDP_BUILTIN_PARTICIPANT_WRITER)) == NULL)
   {
-    DDS_TRACE("handle_xevk_spdp %x:%x:%x:%x - spdp writer of participant not found\n",
+    DDS_TRACE("handle_xevk_spdp "PGUIDFMT" - spdp writer of participant not found\n",
             PGUID (ev->u.spdp.pp_guid));
     if (ev->u.spdp.directed)
       delete_xevent (ev);
@@ -1040,7 +1040,7 @@ static void handle_xevk_spdp (UNUSED_ARG (struct nn_xpack *xp), struct xevent *e
     prd = ephash_lookup_proxy_reader_guid (&guid);
     do_write = (prd != NULL);
     if (!do_write)
-      DDS_TRACE("xmit spdp: no proxy reader %x:%x:%x:%x\n", PGUID (guid));
+      DDS_TRACE("xmit spdp: no proxy reader "PGUIDFMT"\n", PGUID (guid));
   }
 
   if (do_write && !resend_spdp_sample_by_guid_key (spdp_wr, &ev->u.spdp.pp_guid, prd))
@@ -1065,7 +1065,7 @@ static void handle_xevk_spdp (UNUSED_ARG (struct nn_xpack *xp), struct xevent *e
     }
     else
     {
-      DDS_TRACE("xmit spdp: suppressing early spdp response from %x:%x:%x:%x to %x:%x:%x:%x\n",
+      DDS_TRACE("xmit spdp: suppressing early spdp response from "PGUIDFMT" to %"PRIx32":%"PRIx32":%"PRIx32":%x\n",
                 PGUID (pp->e.guid), PGUIDPREFIX (ev->u.spdp.dest_proxypp_guid_prefix), NN_ENTITYID_PARTICIPANT);
     }
 #endif
@@ -1080,7 +1080,7 @@ static void handle_xevk_spdp (UNUSED_ARG (struct nn_xpack *xp), struct xevent *e
     else
     {
       nn_mtime_t tnext = add_duration_to_mtime (tnow, T_SECOND);
-      DDS_TRACE("xmit spdp %x:%x:%x:%x to %x:%x:%x:%x (resched %gs)\n",
+      DDS_TRACE("xmit spdp "PGUIDFMT" to %"PRIx32":%"PRIx32":%"PRIx32":%x (resched %gs)\n",
                 PGUID (pp->e.guid),
                 PGUIDPREFIX (ev->u.spdp.dest_proxypp_guid_prefix), NN_ENTITYID_SPDP_BUILTIN_PARTICIPANT_READER,
                 (double)(tnext.v - tnow.v) / 1e9);
@@ -1107,7 +1107,7 @@ static void handle_xevk_spdp (UNUSED_ARG (struct nn_xpack *xp), struct xevent *e
       intv = config.spdp_interval;
 
     tnext = add_duration_to_mtime (tnow, intv);
-    DDS_TRACE("xmit spdp %x:%x:%x:%x to %x:%x:%x:%x (resched %gs)\n",
+    DDS_TRACE("xmit spdp "PGUIDFMT" to %"PRIx32":%"PRIx32":%"PRIx32":%x (resched %gs)\n",
             PGUID (pp->e.guid),
             PGUIDPREFIX (ev->u.spdp.dest_proxypp_guid_prefix), NN_ENTITYID_SPDP_BUILTIN_PARTICIPANT_READER,
             (double)(tnext.v - tnow.v) / 1e9);
@@ -1128,7 +1128,7 @@ static void write_pmd_message (struct thread_state1 * const ts1, struct nn_xpack
 
   if ((wr = get_builtin_writer (pp, NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_MESSAGE_WRITER)) == NULL)
   {
-    DDS_TRACE("write_pmd_message(%x:%x:%x:%x) - builtin pmd writer not found\n", PGUID (pp->e.guid));
+    DDS_TRACE("write_pmd_message("PGUIDFMT") - builtin pmd writer not found\n", PGUID (pp->e.guid));
     return;
   }
 
@@ -1178,7 +1178,7 @@ static void handle_xevk_pmd_update (struct thread_state1 * const ts1, struct nn_
   if (intv == T_NEVER)
   {
     tnext.v = T_NEVER;
-    DDS_TRACE("resched pmd(%x:%x:%x:%x): never\n", PGUID (pp->e.guid));
+    DDS_TRACE("resched pmd("PGUIDFMT"): never\n", PGUID (pp->e.guid));
   }
   else
   {
@@ -1188,7 +1188,7 @@ static void handle_xevk_pmd_update (struct thread_state1 * const ts1, struct nn_
       tnext.v = tnow.v + intv - 2 * T_SECOND;
     else
       tnext.v = tnow.v + 4 * intv / 5;
-    DDS_TRACE("resched pmd(%x:%x:%x:%x): %gs\n", PGUID (pp->e.guid), (double)(tnext.v - tnow.v) / 1e9);
+    DDS_TRACE("resched pmd("PGUIDFMT"): %gs\n", PGUID (pp->e.guid), (double)(tnext.v - tnow.v) / 1e9);
   }
 
   resched_xevent_if_earlier (ev, tnext);
@@ -1213,7 +1213,7 @@ static void handle_xevk_end_startup_mode (UNUSED_ARG (struct nn_xpack *xp), stru
 static void handle_xevk_delete_writer (UNUSED_ARG (struct nn_xpack *xp), struct xevent *ev, UNUSED_ARG (nn_mtime_t tnow))
 {
   /* don't worry if the writer is already gone by the time we get here. */
-  DDS_TRACE("handle_xevk_delete_writer: %x:%x:%x:%x\n", PGUID (ev->u.delete_writer.guid));
+  DDS_TRACE("handle_xevk_delete_writer: "PGUIDFMT"\n", PGUID (ev->u.delete_writer.guid));
   delete_writer_nolinger (&ev->u.delete_writer.guid);
   delete_xevent (ev);
 }
@@ -1439,7 +1439,7 @@ void qxev_prd_entityid (struct proxy_reader * prd, nn_guid_prefix_t * id)
     msg = nn_xmsg_new (gv.xmsgpool, id, sizeof (EntityId_t), NN_XMSG_KIND_CONTROL);
     if (nn_xmsg_setdstPRD (msg, prd) == 0)
     {
-      DDS_TRACE("  qxev_prd_entityid (%x:%x:%x)\n", PGUIDPREFIX (*id));
+      DDS_TRACE("  qxev_prd_entityid (%"PRIx32":%"PRIx32":%"PRIx32")\n", PGUIDPREFIX (*id));
       nn_xmsg_add_entityid (msg);
       ddsrt_mutex_lock (&gv.xevents->lock);
       ev = qxev_common_nt (gv.xevents, XEVK_ENTITYID);
@@ -1466,7 +1466,7 @@ void qxev_pwr_entityid (struct proxy_writer * pwr, nn_guid_prefix_t * id)
     msg = nn_xmsg_new (gv.xmsgpool, id, sizeof (EntityId_t), NN_XMSG_KIND_CONTROL);
     if (nn_xmsg_setdstPWR (msg, pwr) == 0)
     {
-      DDS_TRACE("  qxev_pwr_entityid (%x:%x:%x)\n", PGUIDPREFIX (*id));
+      DDS_TRACE("  qxev_pwr_entityid (%"PRIx32":%"PRIx32":%"PRIx32")\n", PGUIDPREFIX (*id));
       nn_xmsg_add_entityid (msg);
       ddsrt_mutex_lock (&pwr->evq->lock);
       ev = qxev_common_nt (pwr->evq, XEVK_ENTITYID);
diff --git a/src/core/ddsi/src/q_xmsg.c b/src/core/ddsi/src/q_xmsg.c
index 6e3a6ef..3e8e0fa 100644
--- a/src/core/ddsi/src/q_xmsg.c
+++ b/src/core/ddsi/src/q_xmsg.c
@@ -590,7 +590,7 @@ int nn_xmsg_setdstPRD (struct nn_xmsg *m, const struct proxy_reader *prd)
   }
   else
   {
-    DDS_WARNING("nn_xmsg_setdstPRD: no address for %x:%x:%x:%x", PGUID (prd->e.guid));
+    DDS_WARNING("nn_xmsg_setdstPRD: no address for "PGUIDFMT"", PGUID (prd->e.guid));
     return Q_ERR_NO_ADDRESS;
   }
 }
@@ -603,7 +603,7 @@ int nn_xmsg_setdstPWR (struct nn_xmsg *m, const struct proxy_writer *pwr)
     nn_xmsg_setdst1 (m, &pwr->e.guid.prefix, &loc);
     return 0;
   }
-  DDS_WARNING("nn_xmsg_setdstPRD: no address for %x:%x:%x:%x", PGUID (pwr->e.guid));
+  DDS_WARNING("nn_xmsg_setdstPRD: no address for "PGUIDFMT, PGUID (pwr->e.guid));
   return Q_ERR_NO_ADDRESS;
 }
 
@@ -659,7 +659,7 @@ int nn_xmsg_merge_rexmit_destinations_wrlock_held (struct nn_xmsg *m, const stru
   assert (m->kindspecific.data.readerId_off != 0);
   assert (madd->kindspecific.data.readerId_off != 0);
 
-  DDS_TRACE(" (%x:%x:%x:%x#%"PRId64"/%u:",
+  DDS_TRACE(" ("PGUIDFMT"#%"PRId64"/%u:",
             PGUID (m->kindspecific.data.wrguid), m->kindspecific.data.wrseq, m->kindspecific.data.wrfragid + 1);
 
   switch (m->dstmode)
@@ -1359,7 +1359,7 @@ static void nn_xpack_send_real (struct nn_xpack * xp)
   if (dds_get_log_mask() & DDS_LC_TRACE)
   {
     int i;
-    DDS_TRACE("nn_xpack_send %u:", xp->msg_len.length);
+    DDS_TRACE("nn_xpack_send %"PRIu32":", xp->msg_len.length);
     for (i = 0; i < (int) xp->niov; i++)
     {
       DDS_TRACE(" %p:%lu", (void *) xp->iov[i].iov_base, (unsigned long) xp->iov[i].iov_len);
@@ -1412,7 +1412,7 @@ static void nn_xpack_send_real (struct nn_xpack * xp)
   DDS_TRACE(" ]\n");
   if (calls)
   {
-    DDS_LOG(DDS_LC_TRAFFIC, "traffic-xmit (%lu) %u\n", (unsigned long) calls, xp->msg_len.length);
+    DDS_LOG(DDS_LC_TRAFFIC, "traffic-xmit (%lu) %"PRIu32"\n", (unsigned long) calls, xp->msg_len.length);
   }
   nn_xmsg_chain_release (&xp->included_msgs);
   nn_xpack_reinit (xp);
@@ -1641,7 +1641,7 @@ int nn_xpack_addmsg (struct nn_xpack *xp, struct nn_xmsg *m, const uint32_t flag
      But do make sure we can't run out of iovecs. */
   assert (niov + NN_XMSG_MAX_SUBMESSAGE_IOVECS <= NN_XMSG_MAX_MESSAGE_IOVECS);
 
-  DDS_TRACE("xpack_addmsg %p %p %u(", (void *) xp, (void *) m, flags);
+  DDS_TRACE("xpack_addmsg %p %p %"PRIu32"(", (void *) xp, (void *) m, flags);
   switch (m->kind)
   {
     case NN_XMSG_KIND_CONTROL:
@@ -1649,7 +1649,7 @@ int nn_xpack_addmsg (struct nn_xpack *xp, struct nn_xmsg *m, const uint32_t flag
       break;
     case NN_XMSG_KIND_DATA:
     case NN_XMSG_KIND_DATA_REXMIT:
-      DDS_TRACE("%s(%x:%x:%x:%x:#%"PRId64"/%u)",
+      DDS_TRACE("%s("PGUIDFMT":#%"PRId64"/%u)",
               (m->kind == NN_XMSG_KIND_DATA) ? "data" : "rexmit",
               PGUID (m->kindspecific.data.wrguid),
               m->kindspecific.data.wrseq,
@@ -1784,7 +1784,7 @@ int nn_xpack_addmsg (struct nn_xpack *xp, struct nn_xmsg *m, const uint32_t flag
 
   if (xpo_niov > 0 && sz > config.max_msg_size)
   {
-    DDS_TRACE(" => now niov %d sz %"PRIuSIZE" > max_msg_size %u, nn_xpack_send niov %d sz %u now\n", (int) niov, sz, config.max_msg_size, (int) xpo_niov, xpo_sz);
+    DDS_TRACE(" => now niov %d sz %"PRIuSIZE" > max_msg_size %"PRIu32", nn_xpack_send niov %d sz %"PRIu32" now\n", (int) niov, sz, config.max_msg_size, (int) xpo_niov, xpo_sz);
     xp->msg_len.length = xpo_sz;
     xp->niov = xpo_niov;
     nn_xpack_send (xp, false);
diff --git a/src/tools/ddsperf/ddsperf.c b/src/tools/ddsperf/ddsperf.c
index 7052233..ca6dc3d 100644
--- a/src/tools/ddsperf/ddsperf.c
+++ b/src/tools/ddsperf/ddsperf.c
@@ -624,7 +624,7 @@ static int check_eseq (struct eseq_admin *ea, uint32_t seq, uint32_t keyval, uin
   uint32_t *eseq;
   if (keyval >= ea->nkeys)
   {
-    printf ("received key %u >= nkeys %u\n", keyval, ea->nkeys);
+    printf ("received key %"PRIu32" >= nkeys %u\n", keyval, ea->nkeys);
     exit (3);
   }
   ddsrt_mutex_lock (&ea->lock);
@@ -1315,7 +1315,7 @@ static void print_stats (dds_time_t tstart, dds_time_t tnow, dds_time_t tprev)
                 prefix, x->pubhandle, (double) x->min / 1e3,
                 (double) x->sum / (double) x->cnt / 1e3, (double) x->max / 1e3, x->cnt);
       else
-        printf ("%s  %s:%d min %.3fus mean %.3fus max %.3fus cnt %"PRIu32"\n",
+        printf ("%s  %s:%"PRIu32" min %.3fus mean %.3fus max %.3fus cnt %"PRIu32"\n",
                 prefix, pp->hostname, pp->pid, (double) x->min / 1e3,
                 (double) x->sum / (double) x->cnt / 1e3, (double) x->max / 1e3, x->cnt);
       ddsrt_mutex_unlock (&disc_lock);

From 23fe452967df61a8bf253ed69c6bb8e89824c233 Mon Sep 17 00:00:00 2001
From: Erik Boasson <eb@ilities.com>
Date: Thu, 2 May 2019 11:14:07 +0800
Subject: [PATCH 053/238] out-of-bounds write nn_bitset_one w multiple of 32

nn_bitset_one sets the specified number of bits by first memset'ing the
words, then clearing bits set in a final partial word.  It mishandled
the case where the number of bits is a multiple of 32, clearing the
entire word following the last one it was to touch.

Signed-off-by: Erik Boasson <eb@ilities.com>
---
 src/core/ddsi/include/dds/ddsi/q_bitset.h | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src/core/ddsi/include/dds/ddsi/q_bitset.h b/src/core/ddsi/include/dds/ddsi/q_bitset.h
index 630d16a..a359f82 100644
--- a/src/core/ddsi/include/dds/ddsi/q_bitset.h
+++ b/src/core/ddsi/include/dds/ddsi/q_bitset.h
@@ -49,6 +49,7 @@ inline void nn_bitset_one (uint32_t numbits, uint32_t *bits)
   memset (bits, 0xff, 4 * ((numbits + 31) / 32));
 
   /* clear bits "accidentally" set */
+  if ((numbits % 32) != 0)
   {
     const uint32_t k = numbits / 32;
     const uint32_t n = numbits % 32;

From f0844986155038dd20272725eb38867acf991ad5 Mon Sep 17 00:00:00 2001
From: Erik Boasson <eb@ilities.com>
Date: Thu, 2 May 2019 11:19:41 +0800
Subject: [PATCH 054/238] ddsperf: fix calculation of data rate in Mb/s

Multiplying time-in-ns since previous output line by 1e9 instead of
dividing it by 1e9 resulted in bit rate showing up as 0Mb/s.

Signed-off-by: Erik Boasson <eb@ilities.com>
---
 src/tools/ddsperf/ddsperf.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/tools/ddsperf/ddsperf.c b/src/tools/ddsperf/ddsperf.c
index ca6dc3d..8dd8656 100644
--- a/src/tools/ddsperf/ddsperf.c
+++ b/src/tools/ddsperf/ddsperf.c
@@ -1298,7 +1298,7 @@ static void print_stats (dds_time_t tstart, dds_time_t tnow, dds_time_t tprev)
     if (nrecv > 0)
     {
       printf ("%s ntot %"PRIu64" delta: %"PRIu64" lost %"PRIu64" rate %.2f Mb/s\n",
-              prefix, tot_nrecv, nrecv, nlost, (double) nrecv_bytes * 8 / 1e6 / (1e9 * (double) (tnow - tprev)));
+              prefix, tot_nrecv, nrecv, nlost, (double) nrecv_bytes * 8 * 1e3 / (double) (tnow - tprev));
     }
   }
 

From c16babcd736afecbb369e17950bc74d306a92132 Mon Sep 17 00:00:00 2001
From: Erik Boasson <eb@ilities.com>
Date: Thu, 2 May 2019 11:23:35 +0800
Subject: [PATCH 055/238] limit WHC, serdata, xmsg freelist memory use (#168)

High sample rates require rather high rates of allocating and freeing
WHC nodes, serialised samples (serdata), and RTPS message fragments
(xmsg).  A bunch of dedicated parallel allocators help take some
pressure off the regular malloc/free calls.  However, these used to
gobble up memory like crazy, in part because of rather generous limits,
and in part because there was no restriction on the size of the samples
that would be cached, and it could end up caching large numbers of
multi-MB samples.  It should be noted that there is no benefit to
caching large samples anyway, because the sample rate will be that much
lower.

This commit reduces the maximum number of entries for all three cases,
it furthermore limits the maximum size of a serdata or xmsg that can be
cached, and finally instead of instantiating a separate allocator for
WHC nodes per WHC, it now shares one across all WHCs.  Total memory use
should now be limited to a couple of MB.

The caching can be disabled by setting ``FREELIST_TYPE`` to
``FREELIST_NONE`` in ``q_freelist.h``.

Signed-off-by: Erik Boasson <eb@ilities.com>
---
 src/core/ddsc/src/dds_whc.c                 | 38 +++++++++++++++------
 src/core/ddsi/include/dds/ddsi/q_freelist.h | 10 ++++--
 src/core/ddsi/src/ddsi_serdata_default.c    |  9 +++--
 src/core/ddsi/src/q_freelist.c              | 32 ++++++++++++++++-
 src/core/ddsi/src/q_transmit.c              | 10 ++++--
 src/core/ddsi/src/q_xmsg.c                  | 10 ++++--
 6 files changed, 89 insertions(+), 20 deletions(-)

diff --git a/src/core/ddsc/src/dds_whc.c b/src/core/ddsc/src/dds_whc.c
index b63ca62..2992990 100644
--- a/src/core/ddsc/src/dds_whc.c
+++ b/src/core/ddsc/src/dds_whc.c
@@ -88,7 +88,6 @@ struct whc_impl {
   seqno_t max_drop_seq; /* samples in whc with seq <= max_drop_seq => transient-local */
   struct whc_intvnode *open_intv; /* interval where next sample will go (usually) */
   struct whc_node *maxseq_node; /* NULL if empty; if not in open_intv, open_intv is empty */
-  struct nn_freelist freelist; /* struct whc_node *; linked via whc_node::next_seq */
 #if USE_EHH
   struct ddsrt_ehh *seq_hash;
 #else
@@ -124,7 +123,7 @@ static struct whc_node *whc_findseq (const struct whc_impl *whc, seqno_t seq);
 static void insert_whcn_in_hash (struct whc_impl *whc, struct whc_node *whcn);
 static void whc_delete_one (struct whc_impl *whc, struct whc_node *whcn);
 static int compare_seq (const void *va, const void *vb);
-static void free_deferred_free_list (struct whc_impl *whc, struct whc_node *deferred_free_list);
+static void free_deferred_free_list (struct whc_node *deferred_free_list);
 static void get_state_locked(const struct whc_impl *whc, struct whc_state *st);
 
 static unsigned whc_default_remove_acked_messages_full (struct whc_impl *whc, seqno_t max_drop_seq, struct whc_node **deferred_free_list);
@@ -159,6 +158,17 @@ static const struct whc_ops whc_ops = {
   .free = whc_default_free
 };
 
+/* Number of instantiated WHCs and a global freelist for WHC nodes that gets
+   initialized lazily and cleaned up automatically when the last WHC is freed.
+   Protected by dds_global.m_mutex.
+
+   sizeof (whc_node) on 64-bit machines ~ 100 bytes, so this is ~1MB
+   8k entries seems to be roughly the amount needed for minimum samples,
+   maximum message size and a short round-trip time */
+#define MAX_FREELIST_SIZE 8192
+static uint32_t whc_count;
+static struct nn_freelist whc_node_freelist;
+
 #if USE_EHH
 static uint32_t whc_seq_entry_hash (const void *vn)
 {
@@ -379,8 +389,10 @@ struct whc *whc_new (int is_transient_local, unsigned hdepth, unsigned tldepth)
   whc->open_intv = intv;
   whc->maxseq_node = NULL;
 
-  /* hack */
-  nn_freelist_init (&whc->freelist, UINT32_MAX, offsetof (struct whc_node, next_seq));
+  ddsrt_mutex_lock (&dds_global.m_mutex);
+  if (whc_count++ == 0)
+    nn_freelist_init (&whc_node_freelist, MAX_FREELIST_SIZE, offsetof (struct whc_node, next_seq));
+  ddsrt_mutex_unlock (&dds_global.m_mutex);
 
   check_whc (whc);
   return (struct whc *)whc;
@@ -425,7 +437,11 @@ DDSRT_WARNING_MSVC_ON(6001);
   }
 
   ddsrt_avl_free (&whc_seq_treedef, &whc->seq, ddsrt_free);
-  nn_freelist_fini (&whc->freelist, ddsrt_free);
+
+  ddsrt_mutex_lock (&dds_global.m_mutex);
+  if (--whc_count == 0)
+    nn_freelist_fini (&whc_node_freelist, ddsrt_free);
+  ddsrt_mutex_unlock (&dds_global.m_mutex);
 
 #if USE_EHH
   ddsrt_ehh_free (whc->seq_hash);
@@ -753,11 +769,11 @@ static void whc_delete_one (struct whc_impl *whc, struct whc_node *whcn)
   if (whcn_tmp->next_seq)
     whcn_tmp->next_seq->prev_seq = whcn_tmp->prev_seq;
   whcn_tmp->next_seq = NULL;
-  free_deferred_free_list (whc, whcn_tmp);
+  free_deferred_free_list (whcn_tmp);
   whc->seq_size--;
 }
 
-static void free_deferred_free_list (struct whc_impl *whc, struct whc_node *deferred_free_list)
+static void free_deferred_free_list (struct whc_node *deferred_free_list)
 {
   if (deferred_free_list)
   {
@@ -769,7 +785,7 @@ static void free_deferred_free_list (struct whc_impl *whc, struct whc_node *defe
       if (!cur->borrowed)
         free_whc_node_contents (cur);
     }
-    cur = nn_freelist_pushmany (&whc->freelist, deferred_free_list, last, n);
+    cur = nn_freelist_pushmany (&whc_node_freelist, deferred_free_list, last, n);
     while (cur)
     {
       struct whc_node *tmp = cur;
@@ -781,8 +797,8 @@ static void free_deferred_free_list (struct whc_impl *whc, struct whc_node *defe
 
 static void whc_default_free_deferred_free_list (struct whc *whc_generic, struct whc_node *deferred_free_list)
 {
-  struct whc_impl * const whc = (struct whc_impl *)whc_generic;
-  free_deferred_free_list(whc, deferred_free_list);
+  (void) whc_generic;
+  free_deferred_free_list (deferred_free_list);
 }
 
 static unsigned whc_default_remove_acked_messages_noidx (struct whc_impl *whc, seqno_t max_drop_seq, struct whc_node **deferred_free_list)
@@ -1028,7 +1044,7 @@ static struct whc_node *whc_default_insert_seq (struct whc_impl *whc, seqno_t ma
 {
   struct whc_node *newn = NULL;
 
-  if ((newn = nn_freelist_pop (&whc->freelist)) == NULL)
+  if ((newn = nn_freelist_pop (&whc_node_freelist)) == NULL)
     newn = ddsrt_malloc (sizeof (*newn));
   newn->seq = seq;
   newn->plist = plist;
diff --git a/src/core/ddsi/include/dds/ddsi/q_freelist.h b/src/core/ddsi/include/dds/ddsi/q_freelist.h
index 8fcafa7..75b4fc0 100644
--- a/src/core/ddsi/include/dds/ddsi/q_freelist.h
+++ b/src/core/ddsi/include/dds/ddsi/q_freelist.h
@@ -19,7 +19,7 @@
 extern "C" {
 #endif
 
-#define FREELIST_SIMPLE 1
+#define FREELIST_NONE 1
 #define FREELIST_ATOMIC_LIFO 2
 #define FREELIST_DOUBLE 3
 
@@ -33,7 +33,13 @@ extern "C" {
 #endif
 #endif
 
-#if FREELIST_TYPE == FREELIST_ATOMIC_LIFO
+#if FREELIST_TYPE == FREELIST_NONE
+
+struct nn_freelist {
+  char dummy;
+};
+
+#elif FREELIST_TYPE == FREELIST_ATOMIC_LIFO
 
 struct nn_freelist {
   ddsrt_atomic_lifo_t x;
diff --git a/src/core/ddsi/src/ddsi_serdata_default.c b/src/core/ddsi/src/ddsi_serdata_default.c
index 03e340e..167cc8b 100644
--- a/src/core/ddsi/src/ddsi_serdata_default.c
+++ b/src/core/ddsi/src/ddsi_serdata_default.c
@@ -27,7 +27,12 @@
 #include "dds/ddsi/q_globals.h"
 #include "dds/ddsi/ddsi_serdata_default.h"
 
-#define MAX_POOL_SIZE 16384
+/* 8k entries in the freelist seems to be roughly the amount needed to send
+   minimum-size (well, 4 bytes) samples as fast as possible over loopback
+   while using large messages -- actually, it stands to reason that this would
+   be the same as the WHC node pool size */
+#define MAX_POOL_SIZE 8192
+#define MAX_SIZE_FOR_POOL 256
 #define CLEAR_PADDING 0
 
 #ifndef NDEBUG
@@ -205,7 +210,7 @@ static void serdata_default_free(struct ddsi_serdata *dcmn)
 {
   struct ddsi_serdata_default *d = (struct ddsi_serdata_default *)dcmn;
   assert(ddsrt_atomic_ld32(&d->c.refc) == 0);
-  if (!nn_freelist_push (&gv.serpool->freelist, d))
+  if (d->size > MAX_SIZE_FOR_POOL || !nn_freelist_push (&gv.serpool->freelist, d))
     dds_free (d);
 }
 
diff --git a/src/core/ddsi/src/q_freelist.c b/src/core/ddsi/src/q_freelist.c
index 78e2a77..fd7aef7 100644
--- a/src/core/ddsi/src/q_freelist.c
+++ b/src/core/ddsi/src/q_freelist.c
@@ -18,7 +18,37 @@
 #include "dds/ddsrt/threads.h"
 #include "dds/ddsi/q_freelist.h"
 
-#if FREELIST_TYPE == FREELIST_ATOMIC_LIFO
+#if FREELIST_TYPE == FREELIST_NONE
+
+void nn_freelist_init (struct nn_freelist *fl, uint32_t max, off_t linkoff)
+{
+  (void) fl; (void) max; (void) linkoff;
+}
+
+void nn_freelist_fini (struct nn_freelist *fl, void (*free) (void *elem))
+{
+  (void) fl; (void) free;
+}
+
+bool nn_freelist_push (struct nn_freelist *fl, void *elem)
+{
+  (void) fl; (void) elem;
+  return false;
+}
+
+void *nn_freelist_pushmany (struct nn_freelist *fl, void *first, void *last, uint32_t n)
+{
+  (void) fl; (void) first; (void) last; (void) n;
+  return first;
+}
+
+void *nn_freelist_pop (struct nn_freelist *fl)
+{
+  (void) fl;
+  return NULL;
+}
+
+#elif FREELIST_TYPE == FREELIST_ATOMIC_LIFO
 
 void nn_freelist_init (struct nn_freelist *fl, uint32_t max, off_t linkoff)
 {
diff --git a/src/core/ddsi/src/q_transmit.c b/src/core/ddsi/src/q_transmit.c
index 7401d3b..3a208ba 100644
--- a/src/core/ddsi/src/q_transmit.c
+++ b/src/core/ddsi/src/q_transmit.c
@@ -400,7 +400,9 @@ void add_Heartbeat (struct nn_xmsg *msg, struct writer *wr, const struct whc_sta
 static int create_fragment_message_simple (struct writer *wr, seqno_t seq, struct ddsi_serdata *serdata, struct nn_xmsg **pmsg)
 {
 #define TEST_KEYHASH 0
-  const size_t expected_inline_qos_size = 4+8+20+4 + 32;
+  /* actual expected_inline_qos_size is typically 0, but always claiming 32 bytes won't make
+     a difference, so no point in being precise */
+  const size_t expected_inline_qos_size = /* statusinfo */ 8 + /* keyhash */ 20 + /* sentinel */ 4;
   struct nn_xmsg_marker sm_marker;
   unsigned char contentflag = 0;
   Data_t *data;
@@ -423,6 +425,7 @@ static int create_fragment_message_simple (struct writer *wr, seqno_t seq, struc
 
   ASSERT_MUTEX_HELD (&wr->e.lock);
 
+  /* INFO_TS: 12 bytes, Data_t: 24 bytes, expected inline QoS: 32 => should be single chunk */
   if ((*pmsg = nn_xmsg_new (gv.xmsgpool, &wr->e.guid.prefix, sizeof (InfoTimestamp_t) + sizeof (Data_t) + expected_inline_qos_size, NN_XMSG_KIND_DATA)) == NULL)
     return Q_ERR_OUT_OF_MEMORY;
 
@@ -484,7 +487,9 @@ int create_fragment_message (struct writer *wr, seqno_t seq, const struct nn_pli
      Expected inline QoS size: header(4) + statusinfo(8) + keyhash(20)
      + sentinel(4). Plus some spare cos I can't be bothered. */
   const int set_smhdr_flags_asif_data = config.buggy_datafrag_flags_mode;
-  const size_t expected_inline_qos_size = 4+8+20+4 + 32;
+  /* actual expected_inline_qos_size is typically 0, but always claiming 32 bytes won't make
+     a difference, so no point in being precise */
+  const size_t expected_inline_qos_size = /* statusinfo */ 8 + /* keyhash */ 20 + /* sentinel */ 4;
   struct nn_xmsg_marker sm_marker;
   void *sm;
   Data_DataFrag_common_t *ddcmn;
@@ -508,6 +513,7 @@ int create_fragment_message (struct writer *wr, seqno_t seq, const struct nn_pli
 
   fragging = (config.fragment_size < size);
 
+  /* INFO_TS: 12 bytes, DataFrag_t: 36 bytes, expected inline QoS: 32 => should be single chunk */
   if ((*pmsg = nn_xmsg_new (gv.xmsgpool, &wr->e.guid.prefix, sizeof (InfoTimestamp_t) + sizeof (DataFrag_t) + expected_inline_qos_size, xmsg_kind)) == NULL)
     return Q_ERR_OUT_OF_MEMORY;
 
diff --git a/src/core/ddsi/src/q_xmsg.c b/src/core/ddsi/src/q_xmsg.c
index 3e8e0fa..3c0eae0 100644
--- a/src/core/ddsi/src/q_xmsg.c
+++ b/src/core/ddsi/src/q_xmsg.c
@@ -241,13 +241,18 @@ static size_t align4u (size_t x)
 
    Great expectations, but so far still wanting. */
 
+/* We need about as many as will fit in a message; an otherwise unadorned data message is ~ 40 bytes
+   for a really small sample, no key hash, no status info, and message sizes are (typically) < 64kB
+   so we can expect not to need more than ~ 1600 xmsg at a time.  Powers-of-two are nicer :) */
+#define MAX_FREELIST_SIZE 2048
+
 static void nn_xmsg_realfree (struct nn_xmsg *m);
 
 struct nn_xmsgpool *nn_xmsgpool_new (void)
 {
   struct nn_xmsgpool *pool;
   pool = ddsrt_malloc (sizeof (*pool));
-  nn_freelist_init (&pool->freelist, UINT32_MAX, offsetof (struct nn_xmsg, link.older));
+  nn_freelist_init (&pool->freelist, MAX_FREELIST_SIZE, offsetof (struct nn_xmsg, link.older));
   return pool;
 }
 
@@ -352,7 +357,8 @@ void nn_xmsg_free (struct nn_xmsg *m)
     unref_addrset (m->dstaddr.all.as);
     unref_addrset (m->dstaddr.all.as_group);
   }
-  if (!nn_freelist_push (&pool->freelist, m))
+  /* Only cache the smallest xmsgs; data messages store the payload by reference and are small */
+  if (m->maxsz > NN_XMSG_CHUNK_SIZE || !nn_freelist_push (&pool->freelist, m))
   {
     nn_xmsg_realfree (m);
   }

From c0e9f8a12212f9199610afe39e0ffcf1673f6488 Mon Sep 17 00:00:00 2001
From: Erik Boasson <eb@ilities.com>
Date: Thu, 2 May 2019 15:22:28 +0800
Subject: [PATCH 056/238] ddsperf latnecy should include median, 90% and 99%

Signed-off-by: Erik Boasson <eb@ilities.com>
---
 src/tools/ddsperf/ddsperf.c | 67 ++++++++++++++++++++++++++++++-------
 1 file changed, 55 insertions(+), 12 deletions(-)

diff --git a/src/tools/ddsperf/ddsperf.c b/src/tools/ddsperf/ddsperf.c
index 8dd8656..f93cc61 100644
--- a/src/tools/ddsperf/ddsperf.c
+++ b/src/tools/ddsperf/ddsperf.c
@@ -39,6 +39,8 @@
 #define UDATA_MAGIC "DDSPerf:"
 #define UDATA_MAGIC_SIZE (sizeof (UDATA_MAGIC) - 1)
 
+#define PINGPONG_RAWSIZE 20000
+
 enum topicsel {
   KS,   /* KeyedSeq type: seq#, key, sequence-of-octet */
   K32,  /* Keyed32  type: seq#, key, array-of-24-octet (sizeof = 32) */
@@ -158,6 +160,7 @@ struct eseq_stat {
   uint64_t nrecv;
   uint64_t nlost;
   uint64_t nrecv_bytes;
+  uint32_t last_size;
 
   /* stats printer state */
   uint64_t nrecv_ref;
@@ -190,6 +193,7 @@ struct subthread_arg_pongstat {
   uint64_t min, max;
   uint64_t sum;
   uint32_t cnt;
+  uint64_t *raw;
 };
 
 /* Pong statistics is stored in n array of npongstat entries
@@ -636,6 +640,7 @@ static int check_eseq (struct eseq_admin *ea, uint32_t seq, uint32_t keyval, uin
       ea->stats[i].nrecv++;
       ea->stats[i].nrecv_bytes += size;
       ea->stats[i].nlost += seq - e;
+      ea->stats[i].last_size = size;
       ddsrt_mutex_unlock (&ea->lock);
       return seq == e;
     }
@@ -650,6 +655,7 @@ static int check_eseq (struct eseq_admin *ea, uint32_t seq, uint32_t keyval, uin
   memset (&ea->stats[ea->nph], 0, sizeof (ea->stats[ea->nph]));
   ea->stats[ea->nph].nrecv = 1;
   ea->stats[ea->nph].nrecv_bytes = size;
+  ea->stats[ea->nph].last_size = size;
   ea->nph++;
   ddsrt_mutex_unlock (&ea->lock);
   return 1;
@@ -694,6 +700,8 @@ static bool update_roundtrip (dds_instance_handle_t pubhandle, uint64_t tdelta,
       if (tdelta < x->min) x->min = tdelta;
       if (tdelta > x->max) x->max = tdelta;
       x->sum += tdelta;
+      if (x->cnt < PINGPONG_RAWSIZE)
+        x->raw[x->cnt] = tdelta;
       x->cnt++;
       ddsrt_mutex_unlock (&pongstat_lock);
       return allseen;
@@ -704,6 +712,8 @@ static bool update_roundtrip (dds_instance_handle_t pubhandle, uint64_t tdelta,
   x->pphandle = get_pphandle_for_pubhandle (pubhandle);
   x->min = x->max = x->sum = tdelta;
   x->cnt = 1;
+  x->raw = malloc (PINGPONG_RAWSIZE * sizeof (*x->raw));
+  x->raw[0] = tdelta;
   npongstat++;
   ddsrt_mutex_unlock (&pongstat_lock);
   return allseen;
@@ -1264,6 +1274,13 @@ static void set_data_available_listener (dds_entity_t rd, const char *rd_name, d
   dds_delete_listener (listener);
 }
 
+static int cmp_uint64 (const void *va, const void *vb)
+{
+  const uint64_t *a = va;
+  const uint64_t *b = vb;
+  return (*a == *b) ? 0 : (*a < *b) ? -1 : 1;
+}
+
 static void print_stats (dds_time_t tstart, dds_time_t tnow, dds_time_t tprev)
 {
   char prefix[128];
@@ -1281,6 +1298,7 @@ static void print_stats (dds_time_t tstart, dds_time_t tnow, dds_time_t tprev)
   {
     struct eseq_admin * const ea = &eseq_admin;
     uint64_t tot_nrecv = 0, nrecv = 0, nrecv_bytes = 0, nlost = 0;
+    uint32_t last_size = 0;
     ddsrt_mutex_lock (&ea->lock);
     for (uint32_t i = 0; i < ea->nph; i++)
     {
@@ -1289,6 +1307,7 @@ static void print_stats (dds_time_t tstart, dds_time_t tnow, dds_time_t tprev)
       nrecv += x->nrecv - x->nrecv_ref;
       nlost += x->nlost - x->nlost_ref;
       nrecv_bytes += x->nrecv_bytes - x->nrecv_bytes_ref;
+      last_size = x->last_size;
       x->nrecv_ref = x->nrecv;
       x->nlost_ref = x->nlost;
       x->nrecv_bytes_ref = x->nrecv_bytes;
@@ -1297,33 +1316,53 @@ static void print_stats (dds_time_t tstart, dds_time_t tnow, dds_time_t tprev)
 
     if (nrecv > 0)
     {
-      printf ("%s ntot %"PRIu64" delta: %"PRIu64" lost %"PRIu64" rate %.2f Mb/s\n",
-              prefix, tot_nrecv, nrecv, nlost, (double) nrecv_bytes * 8 * 1e3 / (double) (tnow - tprev));
+      printf ("%s size %"PRIu32" ntot %"PRIu64" delta: %"PRIu64" lost %"PRIu64" rate %.2f Mb/s\n",
+              prefix, last_size, tot_nrecv, nrecv, nlost, (double) nrecv_bytes * 8 * 1e3 / (double) (tnow - tprev));
     }
   }
 
+  uint64_t *newraw = malloc (PINGPONG_RAWSIZE * sizeof (*newraw));
   ddsrt_mutex_lock (&pongstat_lock);
   for (uint32_t i = 0; i < npongstat; i++)
   {
     struct subthread_arg_pongstat * const x = &pongstat[i];
-    if (x->cnt > 0)
+    struct subthread_arg_pongstat y = *x;
+    x->raw = newraw;
+    x->min = UINT64_MAX;
+    x->max = x->sum = x->cnt = 0;
+    /* pongstat entries get added at the end, npongstat only grows: so can safely
+       unlock the stats in between nodes for calculating percentiles */
+    ddsrt_mutex_unlock (&pongstat_lock);
+
+    if (y.cnt > 0)
     {
+      const uint32_t rawcnt = (y.cnt > PINGPONG_RAWSIZE) ? PINGPONG_RAWSIZE : y.cnt;
+      char ppinfo[128];
       struct ppant *pp;
       ddsrt_mutex_lock (&disc_lock);
-      if ((pp = ddsrt_avl_lookup (&ppants_td, &ppants, &x->pphandle)) == NULL)
-        printf ("%s  %"PRIx64" min %.3fus mean %.3fus max %.3fus cnt %"PRIu32"\n",
-                prefix, x->pubhandle, (double) x->min / 1e3,
-                (double) x->sum / (double) x->cnt / 1e3, (double) x->max / 1e3, x->cnt);
+      if ((pp = ddsrt_avl_lookup (&ppants_td, &ppants, &y.pphandle)) == NULL)
+        snprintf (ppinfo, sizeof (ppinfo), "%"PRIx64, y.pubhandle);
       else
-        printf ("%s  %s:%"PRIu32" min %.3fus mean %.3fus max %.3fus cnt %"PRIu32"\n",
-                prefix, pp->hostname, pp->pid, (double) x->min / 1e3,
-                (double) x->sum / (double) x->cnt / 1e3, (double) x->max / 1e3, x->cnt);
+        snprintf (ppinfo, sizeof (ppinfo), "%s:%"PRIu32, pp->hostname, pp->pid);
       ddsrt_mutex_unlock (&disc_lock);
-      x->min = UINT64_MAX;
-      x->max = x->sum = x->cnt = 0;
+
+      qsort (y.raw, rawcnt, sizeof (*y.raw), cmp_uint64);
+      printf ("%s  %s mean %.3fus min %.3fus 50%% %.3fus 90%% %.3fus 99%% %.3fus max %.3fus cnt %"PRIu32"\n",
+              prefix, ppinfo,
+              (double) y.sum / (double) y.cnt / 1e3,
+              (double) y.min / 1e3,
+              (double) y.raw[rawcnt - (rawcnt + 1) / 2] / 1e3,
+              (double) y.raw[rawcnt - (rawcnt + 9) / 10] / 1e3,
+              (double) y.raw[rawcnt - (rawcnt + 99) / 100] / 1e3,
+              (double) y.max / 1e3,
+              y.cnt);
     }
+    newraw = y.raw;
+
+    ddsrt_mutex_lock (&pongstat_lock);
   }
   ddsrt_mutex_unlock (&pongstat_lock);
+  free (newraw);
   fflush (stdout);
 }
 
@@ -1644,6 +1683,10 @@ int main (int argc, char *argv[])
     error3 ("-n%u invalid: topic OU has no key\n", nkeyvals);
   if (topicsel != KS && baggagesize != 0)
     error3 ("-z%u invalid: only topic KS has a sequence\n", baggagesize);
+  if (baggagesize != 0 && baggagesize < 12)
+    error3 ("-z%u invalid: too small to allow for overhead\n", baggagesize);
+  else if (baggagesize > 0)
+    baggagesize -= 12;
 
   ddsrt_avl_init (&ppants_td, &ppants);
   ddsrt_fibheap_init (&ppants_to_match_fhd, &ppants_to_match);

From 780a494d2c09f78e75ffcd05abdfd6bfc8b9d6a9 Mon Sep 17 00:00:00 2001
From: Erik Boasson <eb@ilities.com>
Date: Thu, 2 May 2019 16:26:28 +0800
Subject: [PATCH 057/238] make ddsperf polling/waitset mode selectable again

Signed-off-by: Erik Boasson <eb@ilities.com>
---
 src/tools/ddsperf/ddsperf.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/tools/ddsperf/ddsperf.c b/src/tools/ddsperf/ddsperf.c
index f93cc61..cef4870 100644
--- a/src/tools/ddsperf/ddsperf.c
+++ b/src/tools/ddsperf/ddsperf.c
@@ -1493,7 +1493,7 @@ static int string_int_map_lookup (const struct string_int_map_elem *elems, const
   for (size_t i = 0; elems[i].name; i++)
   {
     if (strcmp (elems[i].name, str) == 0)
-      return elems[match].value;
+      return elems[i].value;
     else if (len >= 3 && strlen (elems[i].name) >= 3 && strncmp (elems[i].name, str, len) == 0)
     {
       if (match == SIZE_MAX)

From baadb2b690607f9b3a606720d65e518a07e6fceb Mon Sep 17 00:00:00 2001
From: Erik Boasson <eb@ilities.com>
Date: Sat, 4 May 2019 13:20:30 +0800
Subject: [PATCH 058/238] remove legacy configuration settings

These settings all constitute settings from the long history of the DDSI
stack predating Eclipse Cyclone DDS and can reasonably be presumed never
to have been used in Cyclone.  Their removal is therefore not expected
to break backwards compatibility (which would be anyway be limited to
Cyclone complaining about undefined settings at startup):

* Tracing/Timestamps[@absolute]: has always been ignored

* Tracing/Timestamps: has always been ignored

* General/EnableLoopback: ignored for quite some time, before that
  changing it from the default resulted in crashes.

* General/StartupModeDuration: it did what it advertised (retain data in
  the history caches of volatile writers as-if they were transient-local
  with a durability history setting of keep-last 1 for the first few
  seconds after startup of the DDSI stack) but had no purpose other than
  complicating things as the volatile readers ignored the data anyway.

* General/StartupModeCoversTransient: see previous -- and besides,
  transient data is not supported yet in Cyclone.

* Compatibility/RespondToRtiInitZeroAckWithInvalidHeartbeat: arguably a
  good setting given that DDSI < 2.3 explicitly requires that all
  HEARTBEAT messages sent by a writer advertise the existence of at least
  1 sample, but this has been fixed in DDSI 2.3.  As this requirement was
  never respected by most DDSI implementations, there is no point in
  retaining the setting, while it does remove a rather tricky problem
  immediately after writer startup involving the conjuring up of a
  sample that was annihilated immediately before it could have been
  observed.

  That conjuring up (as it turns out) can cause a malformed message to go
  out (one that is harmless in itself).  Fixing the generation of that
  malformed message while the entire point of the trick is moot in DDSI
  2.3 is a bit silly.

  Note that full DDSI 2.3 compliance needs a bit more work, so not
  bumping the DDSI protocol version number yet.

* Compatibility/AckNackNumbitsEmptySet: changing it from 0 breaks
  compatibility with (at least) RTI Connext, and its reason for
  existence disappers with a fix in DDSI 2.3.

* Internal/AggressiveKeepLastWhc: changing the setting from the default
  made no sense whatsoever in Cyclone -- it would only add flow-control
  and potentially block a keep-last writer where the spec forbids that.

* Internal/LegacyFragmentation: a left-over from almost a decade ago when
  it was discovered that the specification was inconsistent in the use
  of the message header flags for fragmented data, and this stack for a
  while used the non-common interpretation.  There is no reasonable way of
  making the two modes compatible, and this setting merely existed to
  deal with the compatibility issue with some ancient OpenSplice DDS
  version.

* Durability/Encoding: historical junk.

* WatchDog and Lease: never had any function in Cyclone.

Signed-off-by: Erik Boasson <eb@ilities.com>
---
 src/core/ddsc/src/dds_writer.c             |   29 +-
 src/core/ddsi/include/dds/ddsi/q_config.h  |   24 +-
 src/core/ddsi/include/dds/ddsi/q_entity.h  |    3 -
 src/core/ddsi/include/dds/ddsi/q_globals.h |    7 -
 src/core/ddsi/include/dds/ddsi/q_misc.h    |    2 +-
 src/core/ddsi/include/dds/ddsi/q_xevent.h  |    1 -
 src/core/ddsi/src/q_config.c               | 3656 ++++++++++----------
 src/core/ddsi/src/q_ddsi_discovery.c       |    2 +-
 src/core/ddsi/src/q_entity.c               |   48 +-
 src/core/ddsi/src/q_init.c                 |   13 -
 src/core/ddsi/src/q_receive.c              |   55 +-
 src/core/ddsi/src/q_transmit.c             |   28 +-
 src/core/ddsi/src/q_xevent.c               |   43 -
 13 files changed, 1771 insertions(+), 2140 deletions(-)

diff --git a/src/core/ddsc/src/dds_writer.c b/src/core/ddsc/src/dds_writer.c
index b36bfc9..f144e35 100644
--- a/src/core/ddsc/src/dds_writer.c
+++ b/src/core/ddsc/src/dds_writer.c
@@ -313,38 +313,13 @@ dds_writer_qos_set(
 
 static struct whc *make_whc(const dds_qos_t *qos)
 {
-  bool startup_mode;
   bool handle_as_transient_local;
   unsigned hdepth, tldepth;
-  /* Startup mode causes the writer to treat data in its WHC as if
-   transient-local, for the first few seconds after startup of the
-   DDSI service. It is done for volatile reliable writers only
-   (which automatically excludes all builtin writers) or for all
-   writers except volatile best-effort & transient-local ones.
-
-   Which one to use depends on whether merge policies are in effect
-   in durability. If yes, then durability will take care of all
-   transient & persistent data; if no, DDSI discovery usually takes
-   too long and this'll save you.
-
-   Note: may still be cleared, if it turns out we are not maintaining
-   an index at all (e.g., volatile KEEP_ALL) */
-  if (config.startup_mode_full) {
-    startup_mode = gv.startup_mode &&
-      (qos->durability.kind >= NN_TRANSIENT_DURABILITY_QOS ||
-       (qos->durability.kind == NN_VOLATILE_DURABILITY_QOS &&
-        qos->reliability.kind != NN_BEST_EFFORT_RELIABILITY_QOS));
-  } else {
-    startup_mode = gv.startup_mode &&
-      (qos->durability.kind == NN_VOLATILE_DURABILITY_QOS &&
-       qos->reliability.kind != NN_BEST_EFFORT_RELIABILITY_QOS);
-  }
-
   /* Construct WHC -- if aggressive_keep_last1 is set, the WHC will
     drop all samples for which a later update is available.  This
     forces it to maintain a tlidx.  */
   handle_as_transient_local = (qos->durability.kind == NN_TRANSIENT_LOCAL_DURABILITY_QOS);
-  if (!config.aggressive_keep_last_whc || qos->history.kind == NN_KEEP_ALL_HISTORY_QOS)
+  if (qos->history.kind == NN_KEEP_ALL_HISTORY_QOS)
     hdepth = 0;
   else
     hdepth = (unsigned)qos->history.depth;
@@ -353,8 +328,6 @@ static struct whc *make_whc(const dds_qos_t *qos)
       tldepth = 0;
     else
       tldepth = (unsigned)qos->durability_service.history.depth;
-  } else if (startup_mode) {
-    tldepth = (hdepth == 0) ? 1 : hdepth;
   } else {
     tldepth = 0;
   }
diff --git a/src/core/ddsi/include/dds/ddsi/q_config.h b/src/core/ddsi/include/dds/ddsi/q_config.h
index c313682..50ceb51 100644
--- a/src/core/ddsi/include/dds/ddsi/q_config.h
+++ b/src/core/ddsi/include/dds/ddsi/q_config.h
@@ -237,7 +237,6 @@ struct config
   FILE *tracingOutputFile;
   char *tracingOutputFileName;
   int tracingTimestamps;
-  int tracingRelativeTimestamps;
   int tracingAppendToFile;
   unsigned allowMulticast;
   enum transport_selector transport_selector;
@@ -254,7 +253,6 @@ struct config
   char *assumeMulticastCapable;
   int64_t spdp_interval;
   int64_t spdp_response_delay_max;
-  int64_t startup_mode_duration;
   int64_t lease_duration;
   int64_t const_hb_intv_sched;
   int64_t const_hb_intv_sched_min;
@@ -263,8 +261,6 @@ struct config
   enum retransmit_merging retransmit_merging;
   int64_t retransmit_merging_period;
   int squash_participants;
-  int startup_mode_full;
-  int forward_all_messages;
   int liveliness_monitoring;
   int noprogress_log_stacktraces;
   int64_t liveliness_monitoring_interval;
@@ -278,10 +274,6 @@ struct config
 
   unsigned delivery_queue_maxsamples;
 
-  int enableLoopback;
-  enum durability_cdr durability_cdr;
-
-  int buggy_datafrag_flags_mode;
   int do_topic_discovery;
 
   uint32_t max_msg_size;
@@ -298,9 +290,7 @@ struct config
   int tcp_use_peeraddr_for_unicast;
 
 #ifdef DDSI_INCLUDE_SSL
-
   /* SSL support for TCP */
-
   int ssl_enable;
   int ssl_verify;
   int ssl_verify_client;
@@ -310,17 +300,13 @@ struct config
   char * ssl_key_pass;
   char * ssl_ciphers;
   struct ssl_min_version ssl_min_version;
-
 #endif
 
   /* Thread pool configuration */
-
   int tp_enable;
   uint32_t tp_threads;
   uint32_t tp_max_threads;
 
-  int advertise_builtin_topic_writers;
-
 #ifdef DDSI_INCLUDE_NETWORK_CHANNELS
   struct config_channel_listelem *channels;
   struct config_channel_listelem *max_channel; /* channel with highest prio; always computed */
@@ -343,7 +329,6 @@ struct config
   uint32_t rmsg_chunk_size;          /**<< size of a chunk in the receive buffer */
   uint32_t rbuf_size;                /* << size of a single receiver buffer */
   enum besmode besmode;
-  int aggressive_keep_last_whc;
   int conservative_builtin_reader_startup;
   int meas_hb_to_ack_latency;
   int suppress_spdp_multicast;
@@ -389,8 +374,6 @@ struct config
   int explicitly_publish_qos_set_to_default;
   enum many_sockets_mode many_sockets_mode;
   int arrival_of_data_asserts_pp_and_ep_liveliness;
-  int acknack_numbits_emptyset;
-  int respond_to_rti_init_zero_ack_with_invalid_heartbeat;
   int assume_rti_has_pmd_endpoints;
 
   int port_dg;
@@ -406,14 +389,9 @@ struct config
   int initial_deaf;
   int initial_mute;
   int64_t initial_deaf_mute_reset;
+
   int use_multicast_if_mreqn;
   struct prune_deleted_ppant prune_deleted_ppant;
-
-  /* not used by ddsi2, only validated; user layer directly accesses
-     the configuration tree */
-  ddsrt_sched_t watchdog_sched_class;
-  int32_t watchdog_sched_priority;
-  q__schedPrioClass watchdog_sched_priority_class;
 };
 
 struct ddsi_plugin
diff --git a/src/core/ddsi/include/dds/ddsi/q_entity.h b/src/core/ddsi/include/dds/ddsi/q_entity.h
index f606786..4c0c4bd 100644
--- a/src/core/ddsi/include/dds/ddsi/q_entity.h
+++ b/src/core/ddsi/include/dds/ddsi/q_entity.h
@@ -233,8 +233,6 @@ struct writer
   enum writer_state state;
   unsigned reliable: 1; /* iff 1, writer is reliable <=> heartbeat_xevent != NULL */
   unsigned handle_as_transient_local: 1; /* controls whether data is retained in WHC */
-  unsigned aggressive_keep_last: 1; /* controls whether KEEP_LAST will overwrite samples that haven't been ACK'd yet */
-  unsigned startup_mode: 1; /* causes data to be treated as T-L for a while */
   unsigned include_keyhash: 1; /* iff 1, this writer includes a keyhash; keyless topics => include_keyhash = 0 */
   unsigned retransmitting: 1; /* iff 1, this writer is currently retransmitting */
 #ifdef DDSI_INCLUDE_SSM
@@ -570,7 +568,6 @@ void update_proxy_writer (struct proxy_writer * pwr, struct addrset *as);
 int new_proxy_group (const struct nn_guid *guid, const char *name, const struct nn_xqos *xqos, nn_wctime_t timestamp);
 void delete_proxy_group (const struct nn_guid *guid, nn_wctime_t timestamp, int isimplicit);
 
-void writer_exit_startup_mode (struct writer *wr);
 uint64_t writer_instance_id (const struct nn_guid *guid);
 
 /* Call this to empty all address sets of all writers to stop all outgoing traffic, or to
diff --git a/src/core/ddsi/include/dds/ddsi/q_globals.h b/src/core/ddsi/include/dds/ddsi/q_globals.h
index 517b699..857bd4c 100644
--- a/src/core/ddsi/include/dds/ddsi/q_globals.h
+++ b/src/core/ddsi/include/dds/ddsi/q_globals.h
@@ -223,13 +223,6 @@ struct q_globals {
   /* Flag cleared when stopping (receive threads). FIXME. */
   int rtps_keepgoing;
 
-  /* Startup mode causes data to be treated as transient-local with
-     depth 1 (i.e., stored in the WHCs and regurgitated on request) to
-     cover the start-up delay of the discovery protocols. Because all
-     discovery data is shared, this is strictly a start-up issue of the
-     service. */
-  int startup_mode;
-
   /* Start time of the DDSI2 service, for logging relative time stamps,
      should I ever so desire. */
   nn_wctime_t tstart;
diff --git a/src/core/ddsi/include/dds/ddsi/q_misc.h b/src/core/ddsi/include/dds/ddsi/q_misc.h
index dcc4224..f410ebb 100644
--- a/src/core/ddsi/include/dds/ddsi/q_misc.h
+++ b/src/core/ddsi/include/dds/ddsi/q_misc.h
@@ -29,7 +29,7 @@ inline nn_sequence_number_t toSN (seqno_t n) {
   return x;
 }
 
-unsigned char normalize_data_datafrag_flags (const SubmessageHeader_t *smhdr, int datafrag_as_data);
+unsigned char normalize_data_datafrag_flags (const SubmessageHeader_t *smhdr);
 
 #ifdef DDSI_INCLUDE_NETWORK_PARTITIONS
 int WildcardOverlap(char * p1, char * p2);
diff --git a/src/core/ddsi/include/dds/ddsi/q_xevent.h b/src/core/ddsi/include/dds/ddsi/q_xevent.h
index 3ab7242..ef356f4 100644
--- a/src/core/ddsi/include/dds/ddsi/q_xevent.h
+++ b/src/core/ddsi/include/dds/ddsi/q_xevent.h
@@ -61,7 +61,6 @@ DDS_EXPORT struct xevent *qxev_heartbeat (struct xeventq *evq, nn_mtime_t tsched
 DDS_EXPORT struct xevent *qxev_acknack (struct xeventq *evq, nn_mtime_t tsched, const nn_guid_t *pwr_guid, const nn_guid_t *rd_guid);
 DDS_EXPORT struct xevent *qxev_spdp (nn_mtime_t tsched, const nn_guid_t *pp_guid, const nn_guid_t *proxypp_guid);
 DDS_EXPORT struct xevent *qxev_pmd_update (nn_mtime_t tsched, const nn_guid_t *pp_guid);
-DDS_EXPORT struct xevent *qxev_end_startup_mode (nn_mtime_t tsched);
 DDS_EXPORT struct xevent *qxev_delete_writer (nn_mtime_t tsched, const nn_guid_t *guid);
 
 /* cb will be called with now = T_NEVER if the event is still enqueued when when xeventq_free starts cleaning up */
diff --git a/src/core/ddsi/src/q_config.c b/src/core/ddsi/src/q_config.c
index f3ea0a7..6c22b64 100644
--- a/src/core/ddsi/src/q_config.c
+++ b/src/core/ddsi/src/q_config.c
@@ -53,57 +53,57 @@ struct q_security_plugins q_security_plugin = { NULL, NULL, NULL, NULL, NULL, NU
 #endif
 
 struct unit {
-    const char *name;
-    int64_t multiplier;
+  const char *name;
+  int64_t multiplier;
 };
 
 struct cfgelem {
-    const char *name;
-    const struct cfgelem *children;
-    const struct cfgelem *attributes;
-    int multiplicity;
-    const char *defvalue; /* NULL -> no default */
-    int relative_offset;
-    int elem_offset;
-    init_fun_t init;
-    update_fun_t update;
-    free_fun_t free;
-    print_fun_t print;
-    const char *description;
+  const char *name;
+  const struct cfgelem *children;
+  const struct cfgelem *attributes;
+  int multiplicity;
+  const char *defvalue; /* NULL -> no default */
+  int relative_offset;
+  int elem_offset;
+  init_fun_t init;
+  update_fun_t update;
+  free_fun_t free;
+  print_fun_t print;
+  const char *description;
 };
 
 struct cfgst_nodekey {
-    const struct cfgelem *e;
+  const struct cfgelem *e;
 };
 
 struct cfgst_node {
-    ddsrt_avl_node_t avlnode;
-    struct cfgst_nodekey key;
-    int count;
-    int failed;
-    int is_default;
+  ddsrt_avl_node_t avlnode;
+  struct cfgst_nodekey key;
+  int count;
+  int failed;
+  int is_default;
 };
 
 struct cfgst {
-    ddsrt_avl_tree_t found;
-    struct config *cfg;
-    /* error flag set so that we can continue parsing for some errors and still fail properly */
-    int error;
+  ddsrt_avl_tree_t found;
+  struct config *cfg;
+  /* error flag set so that we can continue parsing for some errors and still fail properly */
+  int error;
 
-    /* path_depth, isattr and path together control the formatting of
-    error messages by cfg_error() */
-    int path_depth;
-    int isattr[MAX_PATH_DEPTH];
-    const struct cfgelem *path[MAX_PATH_DEPTH];
-    void *parent[MAX_PATH_DEPTH];
+  /* path_depth, isattr and path together control the formatting of
+     error messages by cfg_error() */
+  int path_depth;
+  int isattr[MAX_PATH_DEPTH];
+  const struct cfgelem *path[MAX_PATH_DEPTH];
+  void *parent[MAX_PATH_DEPTH];
 };
 
 /* "trace" is special: it enables (nearly) everything */
 static const char *logcat_names[] = {
-    "fatal", "error", "warning", "info", "config", "discovery", "data", "radmin", "timing", "traffic", "topic", "tcp", "plist", "whc", "throttle", "rhc", "trace", NULL
+  "fatal", "error", "warning", "info", "config", "discovery", "data", "radmin", "timing", "traffic", "topic", "tcp", "plist", "whc", "throttle", "rhc", "trace", NULL
 };
 static const uint32_t logcat_codes[] = {
-    DDS_LC_FATAL, DDS_LC_ERROR, DDS_LC_WARNING, DDS_LC_INFO, DDS_LC_CONFIG, DDS_LC_DISCOVERY, DDS_LC_DATA, DDS_LC_RADMIN, DDS_LC_TIMING, DDS_LC_TRAFFIC, DDS_LC_TOPIC, DDS_LC_TCP, DDS_LC_PLIST, DDS_LC_WHC, DDS_LC_THROTTLE, DDS_LC_RHC, DDS_LC_ALL
+  DDS_LC_FATAL, DDS_LC_ERROR, DDS_LC_WARNING, DDS_LC_INFO, DDS_LC_CONFIG, DDS_LC_DISCOVERY, DDS_LC_DATA, DDS_LC_RADMIN, DDS_LC_TIMING, DDS_LC_TRAFFIC, DDS_LC_TOPIC, DDS_LC_TCP, DDS_LC_PLIST, DDS_LC_WHC, DDS_LC_THROTTLE, DDS_LC_RHC, DDS_LC_ALL
 };
 
 /* "trace" is special: it enables (nearly) everything */
@@ -115,12 +115,12 @@ static const uint32_t xcheck_codes[] = {
 };
 
 /* We want the tracing/verbosity settings to be fixed while parsing
-the configuration, so we update this variable instead. */
+   the configuration, so we update this variable instead. */
 static uint32_t enabled_logcats;
 
 static int cfgst_node_cmp(const void *va, const void *vb);
 static const ddsrt_avl_treedef_t cfgst_found_treedef =
-DDSRT_AVL_TREEDEF_INITIALIZER(offsetof(struct cfgst_node, avlnode), offsetof(struct cfgst_node, key), cfgst_node_cmp, 0);
+  DDSRT_AVL_TREEDEF_INITIALIZER(offsetof(struct cfgst_node, avlnode), offsetof(struct cfgst_node, key), cfgst_node_cmp, 0);
 
 #define DU(fname) static int uf_##fname (struct cfgst *cfgst, void *parent, struct cfgelem const * const cfgelem, int first, const char *value)
 #define PF(fname) static void pf_##fname (struct cfgst *cfgst, void *parent, struct cfgelem const * const cfgelem, int is_default)
@@ -135,7 +135,6 @@ DU(boolean_default);
 #if 0
 PF(boolean_default);
 #endif
-DUPF(negated_boolean);
 DUPF(string);
 DU(tracingOutputFileName);
 DU(verbosity);
@@ -143,8 +142,8 @@ DUPF(logcat);
 DUPF(xcheck);
 DUPF(int);
 DUPF(uint);
-DUPF(int32);
 #if 0
+DUPF(int32);
 DUPF(uint32);
 #endif
 DU(natint);
@@ -162,7 +161,6 @@ PF(duration);
 DUPF(standards_conformance);
 DUPF(besmode);
 DUPF(retransmit_merging);
-DUPF(sched_prio_class);
 DUPF(sched_class);
 DUPF(maybe_memsize);
 DUPF(maybe_int32);
@@ -173,7 +171,6 @@ DUPF(cipher);
 DUPF(bandwidth);
 #endif
 DUPF(domainId);
-DUPF(durability_cdr);
 DUPF(transport_selector);
 DUPF(many_sockets_mode);
 DU(deaf_mute);
@@ -221,17 +218,16 @@ DI(if_thread_properties);
 #define DEPRECATED_ATTR(name) "|" name, NULL, NULL
 /* MOVED: whereto must be a path relative to DDSI2Service, may not be used in/for lists and only for elements, may not be chained */
 #define MOVED(name, whereto) ">" name, NULL, NULL, 0, whereto, 0, 0, 0, 0, 0, 0, NULL
-static const struct cfgelem timestamp_cfgattrs[] = {
-    { ATTR("absolute"), 1, "false", ABSOFF(tracingRelativeTimestamps), 0, uf_negated_boolean, 0, pf_negated_boolean,
-    "<p>This option has no effect</p>" },
-    END_MARKER
-};
-
+#if 0
+#define BLURB(text) text
+#else
+#define BLURB(text) NULL
+#endif
 static const struct cfgelem general_cfgelems[] = {
-    { LEAF("NetworkInterfaceAddress"), 1, "auto", ABSOFF(networkAddressString), 0, uf_networkAddress, ff_free, pf_networkAddress,
-    "<p>This element specifies the preferred network interface for use by DDSI2E. The preferred network interface determines the IP address that DDSI2E advertises in the discovery protocol (but see also General/ExternalNetworkAddress), and is also the only interface over which multicasts are transmitted. The interface can be identified by its IP address, network interface name or network portion of the address. If the value \"auto\" is entered here, DDSI2E will select what it considers the most suitable interface.</p>" },
-    { LEAF("MulticastRecvNetworkInterfaceAddresses"), 1, "preferred", ABSOFF(networkRecvAddressStrings), 0, uf_networkAddresses, ff_networkAddresses, pf_networkAddresses,
-    "<p>This element specifies on which network interfaces DDSI2E listens to multicasts. The following options are available:</p>\n\
+  { LEAF("NetworkInterfaceAddress"), 1, "auto", ABSOFF(networkAddressString), 0, uf_networkAddress, ff_free, pf_networkAddress,
+    BLURB("<p>This element specifies the preferred network interface for use by DDSI2E. The preferred network interface determines the IP address that DDSI2E advertises in the discovery protocol (but see also General/ExternalNetworkAddress), and is also the only interface over which multicasts are transmitted. The interface can be identified by its IP address, network interface name or network portion of the address. If the value \"auto\" is entered here, DDSI2E will select what it considers the most suitable interface.</p>") },
+  { LEAF("MulticastRecvNetworkInterfaceAddresses"), 1, "preferred", ABSOFF(networkRecvAddressStrings), 0, uf_networkAddresses, ff_networkAddresses, pf_networkAddresses,
+    BLURB("<p>This element specifies on which network interfaces DDSI2E listens to multicasts. The following options are available:</p>\n\
 <ul>\n\
 <li><i>all</i>: listen for multicasts on all multicast-capable interfaces; or</li>\n\
 <li><i>any</i>: listen for multicasts on the operating system default interface; or</li>\n\
@@ -239,177 +235,169 @@ static const struct cfgelem general_cfgelems[] = {
 <li><i>none</i>: does not listen for multicasts on any interface; or</li>\n\
 <li>a comma-separated list of network addresses: configures DDSI2E to listen for multicasts on all of the listed addresses.</li>\n\
 </ul>\n\
-<p>If DDSI2E is in IPv6 mode and the address of the preferred network interface is a link-local address, \"all\" is treated as a synonym for \"preferred\" and a comma-separated list is treated as \"preferred\" if it contains the preferred interface and as \"none\" if not.</p>" },
-{ LEAF("ExternalNetworkAddress"), 1, "auto", ABSOFF(externalAddressString), 0, uf_networkAddress, ff_free, pf_networkAddress,
-"<p>This element allows explicitly overruling the network address DDSI2E advertises in the discovery protocol, which by default is the address of the preferred network interface (General/NetworkInterfaceAddress), to allow DDSI2E to communicate across a Network Address Translation (NAT) device.</p>" },
-{ LEAF("ExternalNetworkMask"), 1, "0.0.0.0", ABSOFF(externalMaskString), 0, uf_string, ff_free, pf_string,
-"<p>This element specifies the network mask of the external network address. This element is relevant only when an external network address (General/ExternalNetworkAddress) is explicitly configured. In this case locators received via the discovery protocol that are within the same external subnet (as defined by this mask) will be translated to an internal address by replacing the network portion of the external address with the corresponding portion of the preferred network interface address. This option is IPv4-only.</p>" },
-{ LEAF("AllowMulticast"), 1, "true", ABSOFF(allowMulticast), 0, uf_allow_multicast, 0, pf_allow_multicast,
-"<p>This element controls whether DDSI2E uses multicasts for data traffic.</p>\n\
+<p>If DDSI2E is in IPv6 mode and the address of the preferred network interface is a link-local address, \"all\" is treated as a synonym for \"preferred\" and a comma-separated list is treated as \"preferred\" if it contains the preferred interface and as \"none\" if not.</p>") },
+  { LEAF("ExternalNetworkAddress"), 1, "auto", ABSOFF(externalAddressString), 0, uf_networkAddress, ff_free, pf_networkAddress,
+    BLURB("<p>This element allows explicitly overruling the network address DDSI2E advertises in the discovery protocol, which by default is the address of the preferred network interface (General/NetworkInterfaceAddress), to allow DDSI2E to communicate across a Network Address Translation (NAT) device.</p>") },
+  { LEAF("ExternalNetworkMask"), 1, "0.0.0.0", ABSOFF(externalMaskString), 0, uf_string, ff_free, pf_string,
+    BLURB("<p>This element specifies the network mask of the external network address. This element is relevant only when an external network address (General/ExternalNetworkAddress) is explicitly configured. In this case locators received via the discovery protocol that are within the same external subnet (as defined by this mask) will be translated to an internal address by replacing the network portion of the external address with the corresponding portion of the preferred network interface address. This option is IPv4-only.</p>") },
+  { LEAF("AllowMulticast"), 1, "true", ABSOFF(allowMulticast), 0, uf_allow_multicast, 0, pf_allow_multicast,
+    BLURB("<p>This element controls whether DDSI2E uses multicasts for data traffic.</p>\n\
 <p>It is a comma-separated list of some of the following keywords: \"spdp\", \"asm\", \"ssm\", or either of \"false\" or \"true\".</p>\n\
 <ul>\n\
 <li><i>spdp</i>: enables the use of ASM (any-source multicast) for participant discovery, joining the multicast group on the discovery socket, transmitting SPDP messages to this group, but never advertising nor using any multicast address in any discovery message, thus forcing unicast communications for all endpoint discovery and user data.</li>\n\
 <li><i>asm</i>: enables the use of ASM for all traffic (including SPDP)</li>\n\
 <li><i>ssm</i>: enables the use of SSM (source-specific multicast) for all non-SPDP traffic (if supported)</li>\n\
 </ul>\n\
-<p>When set to \"false\" all multicasting is disabled. The default, \"true\" enables full use of multicasts. Listening for multicasts can be controlled by General/MulticastRecvNetworkInterfaceAddresses.</p>" },
-{ LEAF("MulticastTimeToLive"), 1, "32", ABSOFF(multicast_ttl), 0, uf_natint_255, 0, pf_int,
-"<p>This element specifies the time-to-live setting for outgoing multicast packets.</p>" },
-{ LEAF("DontRoute"), 1, "false", ABSOFF(dontRoute), 0, uf_boolean, 0, pf_boolean,
-"<p>This element allows setting the SO_DONTROUTE option for outgoing packets, to bypass the local routing tables. This is generally useful only when the routing tables cannot be trusted, which is highly unusual.</p>" },
-{ LEAF ("UseIPv6"), 1, "default", ABSOFF (compat_use_ipv6), 0, uf_boolean_default, 0, pf_nop,
-"<p>Deprecated (use Transport instead)</p>" },
-{ LEAF ("Transport"), 1, "default", ABSOFF (transport_selector), 0, uf_transport_selector, 0, pf_transport_selector,
-"<p>This element allows selecting the transport to be used (udp, udp6, tcp, tcp6, raweth)</p>" },
-{ LEAF("EnableMulticastLoopback"), 1, "true", ABSOFF(enableMulticastLoopback), 0, uf_boolean, 0, pf_boolean,
-"<p>This element specifies whether DDSI2E allows IP multicast packets to be visible to all DDSI participants in the same node, including itself. It must be \"true\" for intra-node multicast communications, but if a node runs only a single DDSI2E service and does not host any other DDSI-capable programs, it should be set to \"false\" for improved performance.</p>" },
-{ DEPRECATED_LEAF("EnableLoopback"), 1, "false", ABSOFF(enableLoopback), 0, uf_boolean, 0, pf_boolean,
-"<p>This element specifies whether DDSI packets are visible to all DDSI participants in the same process. It must be \"true\" for intra-process communications, i.e. a reader and writer communicating in the same address space. If enabled and using multicast then EnableMulticastLoopback must also be enabled.</p>" },
-{ LEAF("StartupModeDuration"), 1, "2 s", ABSOFF(startup_mode_duration), 0, uf_duration_ms_1hr, 0, pf_duration,
-"<p>This element specifies how long the DDSI2E remains in its \"startup\" mode. While in \"startup\" mode all volatile reliable data published on the local node is retained as-if it were transient-local data, allowing existing readers on remote nodes to obtain the data even though discovering them takes some time. Best-effort data by definition need not arrive, and transient and persistent data are covered by the durability service.</p>\n\
-<p>Once the system is stable, DDSI2E keeps track of the existence of remote readers whether or not matching writers exist locally, avoiding this discovery delay and ensuring this is merely a node startup issue.</p>\n\
-<p>Setting General/StartupModeDuration to 0s will disable it.</p>" },
-{ LEAF("StartupModeCoversTransient"), 1, "true", ABSOFF(startup_mode_full), 0, uf_boolean, 0, pf_boolean,
-"<p>This element configures whether startup-mode should also cover transient and persistent data, for configurations where the durability service does not take care of it. Configurations without defined merge policies best leave this enabled.</p>" },
-{ LEAF("MaxMessageSize"), 1, "4096 B", ABSOFF(max_msg_size), 0, uf_memsize, 0, pf_memsize,
-"<p>This element specifies the maximum size of the UDP payload that DDSI2E will generate. DDSI2E will try to maintain this limit within the bounds of the DDSI specification, which means that in some cases (especially for very low values of MaxMessageSize) larger payloads may sporadically be observed (currently up to 1192 B).</p>\n\
-<p>On some networks it may be necessary to set this item to keep the packetsize below the MTU to prevent IP fragmentation. In those cases, it is generally advisable to also consider reducing Internal/FragmentSize.</p>" },
-{ LEAF("FragmentSize"), 1, "1280 B", ABSOFF(fragment_size), 0, uf_memsize, 0, pf_memsize,
-"<p>This element specifies the size of DDSI sample fragments generated by DDSI2E. Samples larger than FragmentSize are fragmented into fragments of FragmentSize bytes each, except the last one, which may be smaller. The DDSI spec mandates a minimum fragment size of 1025 bytes, but DDSI2E will do whatever size is requested, accepting fragments of which the size is at least the minimum of 1025 and FragmentSize.</p>" },
-END_MARKER
+<p>When set to \"false\" all multicasting is disabled. The default, \"true\" enables full use of multicasts. Listening for multicasts can be controlled by General/MulticastRecvNetworkInterfaceAddresses.</p>") },
+  { LEAF("MulticastTimeToLive"), 1, "32", ABSOFF(multicast_ttl), 0, uf_natint_255, 0, pf_int,
+    BLURB("<p>This element specifies the time-to-live setting for outgoing multicast packets.</p>") },
+  { LEAF("DontRoute"), 1, "false", ABSOFF(dontRoute), 0, uf_boolean, 0, pf_boolean,
+    BLURB("<p>This element allows setting the SO_DONTROUTE option for outgoing packets, to bypass the local routing tables. This is generally useful only when the routing tables cannot be trusted, which is highly unusual.</p>") },
+  { LEAF ("UseIPv6"), 1, "default", ABSOFF (compat_use_ipv6), 0, uf_boolean_default, 0, pf_nop,
+    BLURB("<p>Deprecated (use Transport instead)</p>") },
+  { LEAF ("Transport"), 1, "default", ABSOFF (transport_selector), 0, uf_transport_selector, 0, pf_transport_selector,
+    BLURB("<p>This element allows selecting the transport to be used (udp, udp6, tcp, tcp6, raweth)</p>") },
+  { LEAF("EnableMulticastLoopback"), 1, "true", ABSOFF(enableMulticastLoopback), 0, uf_boolean, 0, pf_boolean,
+    BLURB("<p>This element specifies whether DDSI2E allows IP multicast packets to be visible to all DDSI participants in the same node, including itself. It must be \"true\" for intra-node multicast communications, but if a node runs only a single DDSI2E service and does not host any other DDSI-capable programs, it should be set to \"false\" for improved performance.</p>") },
+  { LEAF("MaxMessageSize"), 1, "4096 B", ABSOFF(max_msg_size), 0, uf_memsize, 0, pf_memsize,
+    BLURB("<p>This element specifies the maximum size of the UDP payload that DDSI2E will generate. DDSI2E will try to maintain this limit within the bounds of the DDSI specification, which means that in some cases (especially for very low values of MaxMessageSize) larger payloads may sporadically be observed (currently up to 1192 B).</p>\n\
+<p>On some networks it may be necessary to set this item to keep the packetsize below the MTU to prevent IP fragmentation. In those cases, it is generally advisable to also consider reducing Internal/FragmentSize.</p>") },
+  { LEAF("FragmentSize"), 1, "1280 B", ABSOFF(fragment_size), 0, uf_memsize, 0, pf_memsize,
+    BLURB("<p>This element specifies the size of DDSI sample fragments generated by DDSI2E. Samples larger than FragmentSize are fragmented into fragments of FragmentSize bytes each, except the last one, which may be smaller. The DDSI spec mandates a minimum fragment size of 1025 bytes, but DDSI2E will do whatever size is requested, accepting fragments of which the size is at least the minimum of 1025 and FragmentSize.</p>") },
+  END_MARKER
 };
 
 #ifdef DDSI_INCLUDE_ENCRYPTION
 static const struct cfgelem securityprofile_cfgattrs[] = {
-    { ATTR("Name"), 1, NULL, RELOFF(config_securityprofile_listelem, name), 0, uf_string, ff_free, pf_string,
-    "<p>This attribute specifies the name of this DDSI2E security profile. Two security profiles cannot have the same name.</p>" },
-    { ATTR("Cipher"), 1, "null", RELOFF(config_securityprofile_listelem, cipher), 0, uf_cipher, 0, pf_cipher,
-    "<p>This attribute specifies the cipher to be used for encrypting traffic over network partitions secured by this security profile. The possible ciphers are:</p>\n\
+  { ATTR("Name"), 1, NULL, RELOFF(config_securityprofile_listelem, name), 0, uf_string, ff_free, pf_string,
+    BLURB("<p>This attribute specifies the name of this DDSI2E security profile. Two security profiles cannot have the same name.</p>") },
+  { ATTR("Cipher"), 1, "null", RELOFF(config_securityprofile_listelem, cipher), 0, uf_cipher, 0, pf_cipher,
+    BLURB("<p>This attribute specifies the cipher to be used for encrypting traffic over network partitions secured by this security profile. The possible ciphers are:</p>\n\
 <ul><li><i>aes128</i>: AES with a 128-bit key;</li>\n\
 <li><i>aes192</i>: AES with a 192-bit key;</li>\n\
 <li><i>aes256</i>: AES with a 256-bit key;</li>\n\
 <li><i>blowfish</i>: the Blowfish cipher with a 128 bit key;</li>\n\
 <li><i>null</i>: no encryption;</li></ul>\n\
-<p>SHA1 is used on conjunction with all ciphers except \"null\" to ensure data integrity.</p>" },
-{ ATTR("CipherKey"), 1, "", RELOFF(config_securityprofile_listelem, key), 0, uf_string, ff_free, pf_key,
-"<p>The CipherKey attribute is used to define the secret key required by the cipher selected using the Cipher attribute. The value can be a URI referencing an external file containing the secret key, or the secret key can be defined in-place as a string value.</p>\n\
+<p>SHA1 is used on conjunction with all ciphers except \"null\" to ensure data integrity.</p>") },
+  { ATTR("CipherKey"), 1, "", RELOFF(config_securityprofile_listelem, key), 0, uf_string, ff_free, pf_key,
+    BLURB("<p>The CipherKey attribute is used to define the secret key required by the cipher selected using the Cipher attribute. The value can be a URI referencing an external file containing the secret key, or the secret key can be defined in-place as a string value.</p>\n\
 <p>The key must be specified as a hexadecimal string with each character representing 4 bits of the key. E.g., 1ABC represents the 16-bit key 0001 1010 1011 1100. The key should not follow a well-known pattern and must exactly match the key length of the selected cipher.</p>\n\
 <p>A malformed key will cause the security profile to be marked as invalid, and disable all network partitions secured by the (invalid) security profile to prevent information leaks.</p>\n\
-<p>As all DDS applications require read access to the XML configuration file, for security reasons it is recommended to store the secret key in an external file in the file system, referenced by its URI. The file should be protected against read and write access from other users on the host.</p>" },
-END_MARKER
+<p>As all DDS applications require read access to the XML configuration file, for security reasons it is recommended to store the secret key in an external file in the file system, referenced by its URI. The file should be protected against read and write access from other users on the host.</p>") },
+  END_MARKER
 };
 
 static const struct cfgelem security_cfgelems[] = {
-    { LEAF_W_ATTRS("SecurityProfile", securityprofile_cfgattrs), 0, 0, ABSOFF(securityProfiles), if_security_profile, 0, 0, 0,
-    "<p>This element defines a DDSI2E security profile.</p>" },
-    END_MARKER
+  { LEAF_W_ATTRS("SecurityProfile", securityprofile_cfgattrs), 0, 0, ABSOFF(securityProfiles), if_security_profile, 0, 0, 0,
+    BLURB("<p>This element defines a DDSI2E security profile.</p>") },
+  END_MARKER
 };
 #endif /* DDSI_INCLUDE_ENCRYPTION */
 
 #ifdef DDSI_INCLUDE_NETWORK_PARTITIONS
 static const struct cfgelem networkpartition_cfgattrs[] = {
-    { ATTR("Name"), 1, NULL, RELOFF(config_networkpartition_listelem, name), 0, uf_string, ff_free, pf_string,
-    "<p>This attribute specifies the name of this DDSI2E network partition. Two network partitions cannot have the same name.</p>" },
-    { ATTR("Address"), 1, NULL, RELOFF(config_networkpartition_listelem, address_string), 0, uf_string, ff_free, pf_string,
-    "<p>This attribute specifies the multicast addresses associated with the network partition as a comma-separated list. Readers matching this network partition (cf. Partitioning/PartitionMappings) will listen for multicasts on all of these addresses and advertise them in the discovery protocol. The writers will select the most suitable address from the addresses advertised by the readers.</p>" },
-    { ATTR("Connected"), 1, "true", RELOFF(config_networkpartition_listelem, connected), 0, uf_boolean, 0, pf_boolean,
-    "<p>This attribute is a placeholder.</p>" },
+  { ATTR("Name"), 1, NULL, RELOFF(config_networkpartition_listelem, name), 0, uf_string, ff_free, pf_string,
+    BLURB("<p>This attribute specifies the name of this DDSI2E network partition. Two network partitions cannot have the same name.</p>") },
+  { ATTR("Address"), 1, NULL, RELOFF(config_networkpartition_listelem, address_string), 0, uf_string, ff_free, pf_string,
+    BLURB("<p>This attribute specifies the multicast addresses associated with the network partition as a comma-separated list. Readers matching this network partition (cf. Partitioning/PartitionMappings) will listen for multicasts on all of these addresses and advertise them in the discovery protocol. The writers will select the most suitable address from the addresses advertised by the readers.</p>") },
+  { ATTR("Connected"), 1, "true", RELOFF(config_networkpartition_listelem, connected), 0, uf_boolean, 0, pf_boolean,
+    BLURB("<p>This attribute is a placeholder.</p>") },
 #ifdef DDSI_INCLUDE_ENCRYPTION
-    { ATTR("SecurityProfile"), 1, "null", RELOFF(config_networkpartition_listelem, profileName), 0, uf_string, ff_free, pf_string,
-    "<p>This attribute selects the DDSI2E security profile for encrypting the traffic mapped to this DDSI2E network partition. The default \"null\" means the network partition is unsecured; any other name refers to a security profile defined using the Security/SecurityProfile elements.</p>" },
+  { ATTR("SecurityProfile"), 1, "null", RELOFF(config_networkpartition_listelem, profileName), 0, uf_string, ff_free, pf_string,
+    BLURB("<p>This attribute selects the DDSI2E security profile for encrypting the traffic mapped to this DDSI2E network partition. The default \"null\" means the network partition is unsecured; any other name refers to a security profile defined using the Security/SecurityProfile elements.</p>") },
 #endif /* DDSI_INCLUDE_ENCRYPTION */
-    END_MARKER
+  END_MARKER
 };
 
 static const struct cfgelem networkpartitions_cfgelems[] = {
-    { LEAF_W_ATTRS("NetworkPartition", networkpartition_cfgattrs), 0, 0, ABSOFF(networkPartitions), if_network_partition, 0, 0, 0,
-    "<p>This element defines a DDSI2E network partition.</p>" },
-    END_MARKER
+  { LEAF_W_ATTRS("NetworkPartition", networkpartition_cfgattrs), 0, 0, ABSOFF(networkPartitions), if_network_partition, 0, 0, 0,
+    BLURB("<p>This element defines a DDSI2E network partition.</p>") },
+  END_MARKER
 };
 
 static const struct cfgelem ignoredpartitions_cfgattrs[] = {
-    { ATTR("DCPSPartitionTopic"), 1, NULL, RELOFF(config_ignoredpartition_listelem, DCPSPartitionTopic), 0, uf_string, ff_free, pf_string,
-    "<p>This attribute specifies a partition and a topic expression, separated by a single '.', that are used to determine if a given partition and topic will be ignored or not. The expressions may use the usual wildcards '*' and '?'. DDSI2E will consider an wildcard DCPS partition to match an expression iff there exists a string that satisfies both expressions.</p>" },
-    END_MARKER
+  { ATTR("DCPSPartitionTopic"), 1, NULL, RELOFF(config_ignoredpartition_listelem, DCPSPartitionTopic), 0, uf_string, ff_free, pf_string,
+    BLURB("<p>This attribute specifies a partition and a topic expression, separated by a single '.', that are used to determine if a given partition and topic will be ignored or not. The expressions may use the usual wildcards '*' and '?'. DDSI2E will consider an wildcard DCPS partition to match an expression iff there exists a string that satisfies both expressions.</p>") },
+  END_MARKER
 };
 
 static const struct cfgelem ignoredpartitions_cfgelems[] = {
-    { LEAF_W_ATTRS("IgnoredPartition", ignoredpartitions_cfgattrs), 0, 0, ABSOFF(ignoredPartitions), if_ignored_partition, 0, 0, 0,
-    "<p>This element can be used to prevent certain combinations of DCPS partition and topic from being transmitted over the network. DDSI2E will complete ignore readers and writers for which all DCPS partitions as well as their topic is ignored, not even creating DDSI readers and writers to mirror the DCPS ones.</p>" },
-    END_MARKER
+  { LEAF_W_ATTRS("IgnoredPartition", ignoredpartitions_cfgattrs), 0, 0, ABSOFF(ignoredPartitions), if_ignored_partition, 0, 0, 0,
+    BLURB("<p>This element can be used to prevent certain combinations of DCPS partition and topic from being transmitted over the network. DDSI2E will complete ignore readers and writers for which all DCPS partitions as well as their topic is ignored, not even creating DDSI readers and writers to mirror the DCPS ones.</p>") },
+  END_MARKER
 };
 
 static const struct cfgelem partitionmappings_cfgattrs[] = {
-    { ATTR("NetworkPartition"), 1, NULL, RELOFF(config_partitionmapping_listelem, networkPartition), 0, uf_string, ff_free, pf_string,
-    "<p>This attribute specifies which DDSI2E network partition is to be used for DCPS partition/topic combinations matching the DCPSPartitionTopic attribute within this PartitionMapping element.</p>" },
-    { ATTR("DCPSPartitionTopic"), 1, NULL, RELOFF(config_partitionmapping_listelem, DCPSPartitionTopic), 0, uf_string, ff_free, pf_string,
-    "<p>This attribute specifies a partition and a topic expression, separated by a single '.', that are used to determine if a given partition and topic maps to the DDSI2E network partition named by the NetworkPartition attribute in this PartitionMapping element. The expressions may use the usual wildcards '*' and '?'. DDSI2E will consider a wildcard DCPS partition to match an expression if there exists a string that satisfies both expressions.</p>" },
-    END_MARKER
+  { ATTR("NetworkPartition"), 1, NULL, RELOFF(config_partitionmapping_listelem, networkPartition), 0, uf_string, ff_free, pf_string,
+    BLURB("<p>This attribute specifies which DDSI2E network partition is to be used for DCPS partition/topic combinations matching the DCPSPartitionTopic attribute within this PartitionMapping element.</p>") },
+  { ATTR("DCPSPartitionTopic"), 1, NULL, RELOFF(config_partitionmapping_listelem, DCPSPartitionTopic), 0, uf_string, ff_free, pf_string,
+    BLURB("<p>This attribute specifies a partition and a topic expression, separated by a single '.', that are used to determine if a given partition and topic maps to the DDSI2E network partition named by the NetworkPartition attribute in this PartitionMapping element. The expressions may use the usual wildcards '*' and '?'. DDSI2E will consider a wildcard DCPS partition to match an expression if there exists a string that satisfies both expressions.</p>") },
+  END_MARKER
 };
 
 static const struct cfgelem partitionmappings_cfgelems[] = {
-    { LEAF_W_ATTRS("PartitionMapping", partitionmappings_cfgattrs), 0, 0, ABSOFF(partitionMappings), if_partition_mapping, 0, 0, 0,
-    "<p>This element defines a mapping from a DCPS partition/topic combination to a DDSI2E network partition. This allows partitioning data flows by using special multicast addresses for part of the data and possibly also encrypting the data flow.</p>" },
-    END_MARKER
+  { LEAF_W_ATTRS("PartitionMapping", partitionmappings_cfgattrs), 0, 0, ABSOFF(partitionMappings), if_partition_mapping, 0, 0, 0,
+    BLURB("<p>This element defines a mapping from a DCPS partition/topic combination to a DDSI2E network partition. This allows partitioning data flows by using special multicast addresses for part of the data and possibly also encrypting the data flow.</p>") },
+  END_MARKER
 };
 
 static const struct cfgelem partitioning_cfgelems[] = {
-    { GROUP("NetworkPartitions", networkpartitions_cfgelems),
-    "<p>The NetworkPartitions element specifies the DDSI2E network partitions.</p>" },
-    { GROUP("IgnoredPartitions", ignoredpartitions_cfgelems),
-    "<p>The IgnoredPartitions element specifies DCPS partition/topic combinations that are not distributed over the network.</p>" },
-    { GROUP("PartitionMappings", partitionmappings_cfgelems),
-    "<p>The PartitionMappings element specifies the mapping from DCPS partition/topic combinations to DDSI2E network partitions.</p>" },
-    END_MARKER
+  { GROUP("NetworkPartitions", networkpartitions_cfgelems),
+    BLURB("<p>The NetworkPartitions element specifies the DDSI2E network partitions.</p>") },
+  { GROUP("IgnoredPartitions", ignoredpartitions_cfgelems),
+    BLURB("<p>The IgnoredPartitions element specifies DCPS partition/topic combinations that are not distributed over the network.</p>") },
+  { GROUP("PartitionMappings", partitionmappings_cfgelems),
+    BLURB("<p>The PartitionMappings element specifies the mapping from DCPS partition/topic combinations to DDSI2E network partitions.</p>") },
+  END_MARKER
 };
 #endif /* DDSI_INCLUDE_NETWORK_PARTITIONS */
 
 #ifdef DDSI_INCLUDE_NETWORK_CHANNELS
 static const struct cfgelem channel_cfgelems[] = {
 #ifdef DDSI_INCLUDE_BANDWIDTH_LIMITING
-    { LEAF("DataBandwidthLimit"), 1, "inf", RELOFF(config_channel_listelem, data_bandwidth_limit), 0, uf_bandwidth, 0, pf_bandwidth,
-    "<p>This element specifies the maximum transmit rate of new samples and directly related data, for this channel. Bandwidth limiting uses a leaky bucket scheme. The default value \"inf\" means DDSI2E imposes no limitation, the underlying operating system and hardware will likely limit the maimum transmit rate.</p>" },
-    { LEAF("AuxiliaryBandwidthLimit"), 1, "inf", RELOFF(config_channel_listelem, auxiliary_bandwidth_limit), 0, uf_bandwidth, 0, pf_bandwidth,
-    "<p>This element specifies the maximum transmit rate of auxiliary traffic on this channel (e.g. retransmits, heartbeats, etc). Bandwidth limiting uses a leaky bucket scheme. The default value \"inf\" means DDSI2E imposes no limitation, the underlying operating system and hardware will likely limit the maimum transmit rate.</p>" },
+  { LEAF("DataBandwidthLimit"), 1, "inf", RELOFF(config_channel_listelem, data_bandwidth_limit), 0, uf_bandwidth, 0, pf_bandwidth,
+    BLURB("<p>This element specifies the maximum transmit rate of new samples and directly related data, for this channel. Bandwidth limiting uses a leaky bucket scheme. The default value \"inf\" means DDSI2E imposes no limitation, the underlying operating system and hardware will likely limit the maimum transmit rate.</p>") },
+  { LEAF("AuxiliaryBandwidthLimit"), 1, "inf", RELOFF(config_channel_listelem, auxiliary_bandwidth_limit), 0, uf_bandwidth, 0, pf_bandwidth,
+    BLURB("<p>This element specifies the maximum transmit rate of auxiliary traffic on this channel (e.g. retransmits, heartbeats, etc). Bandwidth limiting uses a leaky bucket scheme. The default value \"inf\" means DDSI2E imposes no limitation, the underlying operating system and hardware will likely limit the maimum transmit rate.</p>") },
 #endif
-    { LEAF("DiffServField"), 1, "0", RELOFF(config_channel_listelem, diffserv_field), 0, uf_natint, 0, pf_int,
-    "<p>This element describes the DiffServ setting the channel will apply to the networking messages. This parameter determines the value of the diffserv field of the IP version 4 packets sent on this channel which allows QoS setting to be applied to the network traffic send on this channel.<br/>\n\
+  { LEAF("DiffServField"), 1, "0", RELOFF(config_channel_listelem, diffserv_field), 0, uf_natint, 0, pf_int,
+    BLURB("<p>This element describes the DiffServ setting the channel will apply to the networking messages. This parameter determines the value of the diffserv field of the IP version 4 packets sent on this channel which allows QoS setting to be applied to the network traffic send on this channel.<br/>\n\
 Windows platform support for setting the diffserv field is dependent on the OS version.<br/>\n\
 For Windows versions XP SP2 and 2003 to use the diffserv field the following parameter should be added to the register:<br/><br>\n\
 HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\TcpIp\\Parameters\\DisableUserTOSSetting<br/><br/>\n\
 The type of this parameter is a DWORD and its value should be set to 0 to allow setting of the diffserv field.<br/><br/>\n\
 For Windows version 7 or higher a new API (qWAVE) has been introduced. For these platforms the specified diffserv value is mapped to one of the support traffic types.\n\
 The mapping is as follows: 1-8 background traffic; 9-40 excellent traffic; 41-55 audio/video traffic; 56 voice traffic; 57-63 control traffic.\n\
-When an application is run without Administrative priveleges then only the diffserv value of 0, 8, 40 or 56 is allowed.</p>" },
-END_MARKER
+When an application is run without Administrative priveleges then only the diffserv value of 0, 8, 40 or 56 is allowed.</p>") },
+  END_MARKER
 };
 
 static const struct cfgelem channel_cfgattrs[] = {
-    { ATTR("Name"), 1, NULL, RELOFF(config_channel_listelem, name), 0, uf_string, ff_free, pf_string,
-    "<p>This attribute specifies name of this channel. The name should uniquely identify the channel.</p>" },
-    { ATTR("TransportPriority"), 1, "0", RELOFF(config_channel_listelem, priority), 0, uf_natint, 0, pf_int,
-    "<p>This attribute sets the transport priority threshold for the channel. Each DCPS data writer has a \"transport_priority\" QoS and this QoS is used to select a channel for use by this writer. The selected channel is the one with the largest threshold not greater than the writer's transport priority, and if no such channel exists, the channel with the lowest threshold.</p>" },
-    END_MARKER
+  { ATTR("Name"), 1, NULL, RELOFF(config_channel_listelem, name), 0, uf_string, ff_free, pf_string,
+    BLURB("<p>This attribute specifies name of this channel. The name should uniquely identify the channel.</p>") },
+  { ATTR("TransportPriority"), 1, "0", RELOFF(config_channel_listelem, priority), 0, uf_natint, 0, pf_int,
+    BLURB("<p>This attribute sets the transport priority threshold for the channel. Each DCPS data writer has a \"transport_priority\" QoS and this QoS is used to select a channel for use by this writer. The selected channel is the one with the largest threshold not greater than the writer's transport priority, and if no such channel exists, the channel with the lowest threshold.</p>") },
+  END_MARKER
 };
 
 static const struct cfgelem channels_cfgelems[] = {
-    { MGROUP("Channel", channel_cfgelems, channel_cfgattrs), 42, 0, ABSOFF(channels), if_channel, 0, 0, 0,
-    "<p>This element defines a channel.</p>" },
-    END_MARKER
+  { MGROUP("Channel", channel_cfgelems, channel_cfgattrs), 42, 0, ABSOFF(channels), if_channel, 0, 0, 0,
+    BLURB("<p>This element defines a channel.</p>") },
+  END_MARKER
 };
 #endif /* DDSI_INCLUDE_NETWORK_CHANNELS */
 
 static const struct cfgelem thread_properties_sched_cfgelems[] = {
-    { LEAF("Class"), 1, "default", RELOFF(config_thread_properties_listelem, sched_class), 0, uf_sched_class, 0, pf_sched_class,
-    "<p>This element specifies the thread scheduling class (<i>realtime</i>, <i>timeshare</i> or <i>default</i>). The user may need special privileges from the underlying operating system to be able to assign some of the privileged scheduling classes.</p>" },
-    { LEAF("Priority"), 1, "default", RELOFF(config_thread_properties_listelem, sched_priority), 0, uf_maybe_int32, 0, pf_maybe_int32,
-    "<p>This element specifies the thread priority (decimal integer or <i>default</i>). Only priorities that are supported by the underlying operating system can be assigned to this element. The user may need special privileges from the underlying operating system to be able to assign some of the privileged priorities.</p>" },
-    END_MARKER
+  { LEAF("Class"), 1, "default", RELOFF(config_thread_properties_listelem, sched_class), 0, uf_sched_class, 0, pf_sched_class,
+    BLURB("<p>This element specifies the thread scheduling class (<i>realtime</i>, <i>timeshare</i> or <i>default</i>). The user may need special privileges from the underlying operating system to be able to assign some of the privileged scheduling classes.</p>") },
+  { LEAF("Priority"), 1, "default", RELOFF(config_thread_properties_listelem, sched_priority), 0, uf_maybe_int32, 0, pf_maybe_int32,
+    BLURB("<p>This element specifies the thread priority (decimal integer or <i>default</i>). Only priorities that are supported by the underlying operating system can be assigned to this element. The user may need special privileges from the underlying operating system to be able to assign some of the privileged priorities.</p>") },
+  END_MARKER
 };
 
 static const struct cfgelem thread_properties_cfgattrs[] = {
-    { ATTR("Name"), 1, NULL, RELOFF(config_thread_properties_listelem, name), 0, uf_string, ff_free, pf_string,
-    "<p>The Name of the thread for which properties are being set. The following threads exist:</p>\n\
+  { ATTR("Name"), 1, NULL, RELOFF(config_thread_properties_listelem, name), 0, uf_string, ff_free, pf_string,
+    BLURB("<p>The Name of the thread for which properties are being set. The following threads exist:</p>\n\
 <ul><li><i>gc</i>: garbage collector thread involved in deleting entities;</li>\n\
 <li><i>recv</i>: receive thread, taking data from the network and running the protocol state machine;</li>\n\
 <li><i>dq.builtins</i>: delivery thread for DDSI-builtin data, primarily for discovery;</li>\n\
@@ -417,370 +405,352 @@ static const struct cfgelem thread_properties_cfgattrs[] = {
 <li><i>tev</i>: general timed-event handling, retransmits and discovery;</li>\n\
 <li><i>xmit.CHAN</i>: transmit thread for channel CHAN;</li>\n\
 <li><i>dq.CHAN</i>: delivery thread for channel CHAN;</li>\n\
-<li><i>tev.CHAN</i>: timed-even thread for channel CHAN.</li></ul>" },
-END_MARKER
+<li><i>tev.CHAN</i>: timed-even thread for channel CHAN.</li></ul>") },
+  END_MARKER
 };
 
 static const struct cfgelem thread_properties_cfgelems[] = {
-    { GROUP("Scheduling", thread_properties_sched_cfgelems),
-    "<p>This element configures the scheduling properties of the thread.</p>" },
-    { LEAF("StackSize"), 1, "default", RELOFF(config_thread_properties_listelem, stack_size), 0, uf_maybe_memsize, 0, pf_maybe_memsize,
-    "<p>This element configures the stack size for this thread. The default value <i>default</i> leaves the stack size at the operating system default.</p>" },
-    END_MARKER
+  { GROUP("Scheduling", thread_properties_sched_cfgelems),
+    BLURB("<p>This element configures the scheduling properties of the thread.</p>") },
+  { LEAF("StackSize"), 1, "default", RELOFF(config_thread_properties_listelem, stack_size), 0, uf_maybe_memsize, 0, pf_maybe_memsize,
+    BLURB("<p>This element configures the stack size for this thread. The default value <i>default</i> leaves the stack size at the operating system default.</p>") },
+  END_MARKER
 };
 
 static const struct cfgelem threads_cfgelems[] = {
-    { MGROUP("Thread", thread_properties_cfgelems, thread_properties_cfgattrs), 1000, 0, ABSOFF(thread_properties), if_thread_properties, 0, 0, 0,
-    "<p>This element is used to set thread properties.</p>" },
-    END_MARKER
+  { MGROUP("Thread", thread_properties_cfgelems, thread_properties_cfgattrs), 1000, 0, ABSOFF(thread_properties), if_thread_properties, 0, 0, 0,
+    BLURB("<p>This element is used to set thread properties.</p>") },
+  END_MARKER
 };
 
 static const struct cfgelem compatibility_cfgelems[] = {
-    { LEAF("StandardsConformance"), 1, "lax", ABSOFF(standards_conformance), 0, uf_standards_conformance, 0, pf_standards_conformance,
-    "<p>This element sets the level of standards conformance of this instance of the DDSI2E Service. Stricter conformance typically means less interoperability with other implementations. Currently three modes are defined:</p>\n\
+  { LEAF("StandardsConformance"), 1, "lax", ABSOFF(standards_conformance), 0, uf_standards_conformance, 0, pf_standards_conformance,
+    BLURB("<p>This element sets the level of standards conformance of this instance of the DDSI2E Service. Stricter conformance typically means less interoperability with other implementations. Currently three modes are defined:</p>\n\
 <ul><li><i>pedantic</i>: very strictly conform to the specification, ultimately for compliancy testing, but currently of little value because it adheres even to what will most likely turn out to be editing errors in the DDSI standard. Arguably, as long as no errata have been published it is the current text that is in effect, and that is what pedantic currently does.</li>\n\
 <li><i>strict</i>: a slightly less strict view of the standard than does pedantic: it follows the established behaviour where the standard is obviously in error.</li>\n\
 <li><i>lax</i>: attempt to provide the smoothest possible interoperability, anticipating future revisions of elements in the standard in areas that other implementations do not adhere to, even though there is no good reason not to.</li></ul>\n\
-<p>The default setting is \"lax\".</p>" },
-{ LEAF("ExplicitlyPublishQosSetToDefault"), 1, "false", ABSOFF(explicitly_publish_qos_set_to_default), 0, uf_boolean, 0, pf_boolean,
-"<p>This element specifies whether QoS settings set to default values are explicitly published in the discovery protocol. Implementations are to use the default value for QoS settings not published, which allows a significant reduction of the amount of data that needs to be exchanged for the discovery protocol, but this requires all implementations to adhere to the default values specified by the specifications.</p>\n\
-<p>When interoperability is required with an implementation that does not follow the specifications in this regard, setting this option to true will help.</p>" },
-{ LEAF ("ManySocketsMode"), 1, "single", ABSOFF (many_sockets_mode), 0, uf_many_sockets_mode, 0, pf_many_sockets_mode,
-"<p>This option specifies whether a network socket will be created for each domain participant on a host. The specification seems to assume that each participant has a unique address, and setting this option will ensure this to be the case. This is not the defeault.</p>\n\
-<p>Disabling it slightly improves performance and reduces network traffic somewhat. It also causes the set of port numbers needed by DDSI2E to become predictable, which may be useful for firewall and NAT configuration.</p>" },
-{ LEAF("ArrivalOfDataAssertsPpAndEpLiveliness"), 1, "true", ABSOFF(arrival_of_data_asserts_pp_and_ep_liveliness), 0, uf_boolean, 0, pf_boolean,
-"<p>When set to true, arrival of a message from a peer asserts liveliness of that peer. When set to false, only SPDP and explicit lease renewals have this effect.</p>" },
-{ LEAF("AckNackNumbitsEmptySet"), 1, "0", ABSOFF(acknack_numbits_emptyset), 0, uf_natint, 0, pf_int,
-"<p>This element governs the representation of an acknowledgement message that does not also negatively-acknowledge some samples. If set to 0, the generated acknowledgements have an invalid form and will be reject by the strict and pedantic conformance modes, but several other implementation require this setting for smooth interoperation.</p>\n\
-<p>If set to 1, all acknowledgements sent by DDSI2E adhere the form of acknowledgement messages allowed by the standard, but this causes problems when interoperating with these other implementations. The strict and pedantic standards conformance modes always overrule an AckNackNumbitsEmptySet=0 to prevent the transmitting of invalid messages.</p>" },
-{ LEAF("RespondToRtiInitZeroAckWithInvalidHeartbeat"), 1, "false", ABSOFF(respond_to_rti_init_zero_ack_with_invalid_heartbeat), 0, uf_boolean, 0, pf_boolean,
-"<p>This element allows a closer mimicking of the behaviour of some other DDSI implementations, albeit at the cost of generating even more invalid messages. Setting it to true ensures a Heartbeat can be sent at any time when a remote node requests one, setting it to false delays it until a valid one can be sent.</p>\n\
-<p>The latter is fully compliant with the specification, and no adverse effects have been observed. It is the default.</p>" },
-{ LEAF("AssumeRtiHasPmdEndpoints"), 1, "false", ABSOFF(assume_rti_has_pmd_endpoints), 0, uf_boolean, 0, pf_boolean,
-"<p>This option assumes ParticipantMessageData endpoints required by the liveliness protocol are present in RTI participants even when not properly advertised by the participant discovery protocol.</p>" },
-END_MARKER
+<p>The default setting is \"lax\".</p>") },
+  { LEAF("ExplicitlyPublishQosSetToDefault"), 1, "false", ABSOFF(explicitly_publish_qos_set_to_default), 0, uf_boolean, 0, pf_boolean,
+    BLURB("<p>This element specifies whether QoS settings set to default values are explicitly published in the discovery protocol. Implementations are to use the default value for QoS settings not published, which allows a significant reduction of the amount of data that needs to be exchanged for the discovery protocol, but this requires all implementations to adhere to the default values specified by the specifications.</p>\n\
+<p>When interoperability is required with an implementation that does not follow the specifications in this regard, setting this option to true will help.</p>") },
+  { LEAF ("ManySocketsMode"), 1, "single", ABSOFF (many_sockets_mode), 0, uf_many_sockets_mode, 0, pf_many_sockets_mode,
+    BLURB("<p>This option specifies whether a network socket will be created for each domain participant on a host. The specification seems to assume that each participant has a unique address, and setting this option will ensure this to be the case. This is not the defeault.</p>\n\
+<p>Disabling it slightly improves performance and reduces network traffic somewhat. It also causes the set of port numbers needed by DDSI2E to become predictable, which may be useful for firewall and NAT configuration.</p>") },
+  { LEAF("ArrivalOfDataAssertsPpAndEpLiveliness"), 1, "true", ABSOFF(arrival_of_data_asserts_pp_and_ep_liveliness), 0, uf_boolean, 0, pf_boolean,
+    BLURB("<p>When set to true, arrival of a message from a peer asserts liveliness of that peer. When set to false, only SPDP and explicit lease renewals have this effect.</p>") },
+  { LEAF("AssumeRtiHasPmdEndpoints"), 1, "false", ABSOFF(assume_rti_has_pmd_endpoints), 0, uf_boolean, 0, pf_boolean,
+    BLURB("<p>This option assumes ParticipantMessageData endpoints required by the liveliness protocol are present in RTI participants even when not properly advertised by the participant discovery protocol.</p>") },
+  END_MARKER
 };
 
 static const struct cfgelem unsupp_test_cfgelems[] = {
-    { LEAF("XmitLossiness"), 1, "0", ABSOFF(xmit_lossiness), 0, uf_int, 0, pf_int,
-    "<p>This element controls the fraction of outgoing packets to drop, specified as samples per thousand.</p>" },
-    END_MARKER
+  { LEAF("XmitLossiness"), 1, "0", ABSOFF(xmit_lossiness), 0, uf_int, 0, pf_int,
+    BLURB("<p>This element controls the fraction of outgoing packets to drop, specified as samples per thousand.</p>") },
+  END_MARKER
 };
 
 static const struct cfgelem unsupp_watermarks_cfgelems[] = {
-    { LEAF("WhcLow"), 1, "1 kB", ABSOFF(whc_lowwater_mark), 0, uf_memsize, 0, pf_memsize,
-    "<p>This element sets the low-water mark for the DDSI2E WHCs, expressed in bytes. A suspended writer resumes transmitting when its DDSI2E WHC shrinks to this size.</p>" },
-    { LEAF("WhcHigh"), 1, "100 kB", ABSOFF(whc_highwater_mark), 0, uf_memsize, 0, pf_memsize,
-    "<p>This element sets the maximum allowed high-water mark for the DDSI2E WHCs, expressed in bytes. A writer is suspended when the WHC reaches this size.</p>" },
-    { LEAF("WhcHighInit"), 1, "30 kB", ABSOFF(whc_init_highwater_mark), 0, uf_maybe_memsize, 0, pf_maybe_memsize,
-    "<p>This element sets the initial level of the high-water mark for the DDSI2E WHCs, expressed in bytes.</p>" },
-    { LEAF("WhcAdaptive|WhcAdaptative"), 1, "true", ABSOFF(whc_adaptive), 0, uf_boolean, 0, pf_boolean,
-    "<p>This element controls whether DDSI2E will adapt the high-water mark to current traffic conditions, based on retransmit requests and transmit pressure.</p>" },
-    END_MARKER
+  { LEAF("WhcLow"), 1, "1 kB", ABSOFF(whc_lowwater_mark), 0, uf_memsize, 0, pf_memsize,
+    BLURB("<p>This element sets the low-water mark for the DDSI2E WHCs, expressed in bytes. A suspended writer resumes transmitting when its DDSI2E WHC shrinks to this size.</p>") },
+  { LEAF("WhcHigh"), 1, "100 kB", ABSOFF(whc_highwater_mark), 0, uf_memsize, 0, pf_memsize,
+    BLURB("<p>This element sets the maximum allowed high-water mark for the DDSI2E WHCs, expressed in bytes. A writer is suspended when the WHC reaches this size.</p>") },
+  { LEAF("WhcHighInit"), 1, "30 kB", ABSOFF(whc_init_highwater_mark), 0, uf_maybe_memsize, 0, pf_maybe_memsize,
+    BLURB("<p>This element sets the initial level of the high-water mark for the DDSI2E WHCs, expressed in bytes.</p>") },
+  { LEAF("WhcAdaptive|WhcAdaptative"), 1, "true", ABSOFF(whc_adaptive), 0, uf_boolean, 0, pf_boolean,
+    BLURB("<p>This element controls whether DDSI2E will adapt the high-water mark to current traffic conditions, based on retransmit requests and transmit pressure.</p>") },
+  END_MARKER
 };
 
 static const struct cfgelem control_topic_cfgattrs[] = {
-    { DEPRECATED_ATTR("Enable"), 1, "false", ABSOFF(enable_control_topic), 0, uf_boolean, 0, pf_boolean,
-      "<p>This element controls whether DDSI2E should create a topic to control DDSI2E's behaviour dynamically.<p>"
-    },
-    { DEPRECATED_ATTR("InitialReset"), 1, "inf", ABSOFF(initial_deaf_mute_reset), 0, uf_duration_inf, 0, pf_duration,
-      "<p>This element controls after how much time an initial deaf/mute state will automatically reset.<p>"
-    },
-    END_MARKER
+  { DEPRECATED_ATTR("Enable"), 1, "false", ABSOFF(enable_control_topic), 0, uf_boolean, 0, pf_boolean,
+    BLURB("<p>This element controls whether DDSI2E should create a topic to control DDSI2E's behaviour dynamically.<p>") },
+  { DEPRECATED_ATTR("InitialReset"), 1, "inf", ABSOFF(initial_deaf_mute_reset), 0, uf_duration_inf, 0, pf_duration,
+    BLURB("<p>This element controls after how much time an initial deaf/mute state will automatically reset.<p>") },
+  END_MARKER
 };
 
 static const struct cfgelem control_topic_cfgelems[] = {
-    { DEPRECATED_LEAF ("Deaf"), 1, "false", ABSOFF (initial_deaf), 0, uf_deaf_mute, 0, pf_boolean,
-    "<p>This element controls whether DDSI2E defaults to deaf mode or to normal mode. This controls both the initial behaviour and what behaviour it auto-reverts to.</p>" },
-    { DEPRECATED_LEAF ("Mute"), 1, "false", ABSOFF (initial_mute), 0, uf_deaf_mute, 0, pf_boolean,
-    "<p>This element controls whether DDSI2E defaults to mute mode or to normal mode. This controls both the initial behaviour and what behaviour it auto-reverts to.</p>" },
-    END_MARKER
+  { DEPRECATED_LEAF ("Deaf"), 1, "false", ABSOFF (initial_deaf), 0, uf_deaf_mute, 0, pf_boolean,
+    BLURB("<p>This element controls whether DDSI2E defaults to deaf mode or to normal mode. This controls both the initial behaviour and what behaviour it auto-reverts to.</p>") },
+  { DEPRECATED_LEAF ("Mute"), 1, "false", ABSOFF (initial_mute), 0, uf_deaf_mute, 0, pf_boolean,
+    BLURB("<p>This element controls whether DDSI2E defaults to mute mode or to normal mode. This controls both the initial behaviour and what behaviour it auto-reverts to.</p>") },
+  END_MARKER
 };
 
 static const struct cfgelem rediscovery_blacklist_duration_attrs[] = {
-    { ATTR("enforce"), 1, "false", ABSOFF(prune_deleted_ppant.enforce_delay), 0, uf_boolean, 0, pf_boolean,
-    "<p>This attribute controls whether the configured time during which recently deleted participants will not be rediscovered (i.e., \"black listed\") is enforced and following complete removal of the participant in DDSI2E, or whether it can be rediscovered earlier provided all traces of that participant have been removed already.</p>" },
-    END_MARKER
+  { ATTR("enforce"), 1, "false", ABSOFF(prune_deleted_ppant.enforce_delay), 0, uf_boolean, 0, pf_boolean,
+    BLURB("<p>This attribute controls whether the configured time during which recently deleted participants will not be rediscovered (i.e., \"black listed\") is enforced and following complete removal of the participant in DDSI2E, or whether it can be rediscovered earlier provided all traces of that participant have been removed already.</p>") },
+  END_MARKER
 };
 
 static const struct cfgelem heartbeat_interval_attrs[] = {
-    { ATTR ("min"), 1, "5 ms", ABSOFF (const_hb_intv_min), 0, uf_duration_inf, 0, pf_duration,
-    "<p>This attribute sets the minimum interval that must have passed since the most recent heartbeat from a writer, before another asynchronous (not directly related to writing) will be sent.</p>" },
-    { ATTR ("minsched"), 1, "20 ms", ABSOFF (const_hb_intv_sched_min), 0, uf_duration_inf, 0, pf_duration,
-    "<p>This attribute sets the minimum interval for periodic heartbeats. Other events may still cause heartbeats to go out.</p>" },
-    { ATTR ("max"), 1, "8 s", ABSOFF (const_hb_intv_sched_max), 0, uf_duration_inf, 0, pf_duration,
-    "<p>This attribute sets the maximum interval for periodic heartbeats.</p>" },
-    END_MARKER
+  { ATTR ("min"), 1, "5 ms", ABSOFF (const_hb_intv_min), 0, uf_duration_inf, 0, pf_duration,
+    BLURB("<p>This attribute sets the minimum interval that must have passed since the most recent heartbeat from a writer, before another asynchronous (not directly related to writing) will be sent.</p>") },
+  { ATTR ("minsched"), 1, "20 ms", ABSOFF (const_hb_intv_sched_min), 0, uf_duration_inf, 0, pf_duration,
+    BLURB("<p>This attribute sets the minimum interval for periodic heartbeats. Other events may still cause heartbeats to go out.</p>") },
+  { ATTR ("max"), 1, "8 s", ABSOFF (const_hb_intv_sched_max), 0, uf_duration_inf, 0, pf_duration,
+    BLURB("<p>This attribute sets the maximum interval for periodic heartbeats.</p>") },
+  END_MARKER
 };
 
 static const struct cfgelem liveliness_monitoring_attrs[] = {
   { ATTR("StackTraces"), 1, "true", ABSOFF(noprogress_log_stacktraces), 0, uf_boolean, 0, pf_boolean,
-    "<p>This element controls whether or not to write stack traces to the DDSI2 trace when a thread fails to make progress (on select platforms only).</p>" },
+    BLURB("<p>This element controls whether or not to write stack traces to the DDSI2 trace when a thread fails to make progress (on select platforms only).</p>") },
   { ATTR("Interval"), 1, "1s", ABSOFF(liveliness_monitoring_interval), 0, uf_duration_100ms_1hr, 0, pf_duration,
-    "<p>This element controls the interval at which to check whether threads have been making progress.</p>" },
+    BLURB("<p>This element controls the interval at which to check whether threads have been making progress.</p>") },
   END_MARKER
 };
 
 static const struct cfgelem multiple_recv_threads_attrs[] = {
   { ATTR("maxretries"), 1, "4294967295", ABSOFF(recv_thread_stop_maxretries), 0, uf_uint, 0, pf_uint,
-    "<p>Receive threads dedicated to a single socket can only be triggered for termination by sending a packet. Reception of any packet will do, so termination failure due to packet loss is exceedingly unlikely, but to eliminate all risks, it will retry as many times as specified by this attribute before aborting.</p>" },
+    BLURB("<p>Receive threads dedicated to a single socket can only be triggered for termination by sending a packet. Reception of any packet will do, so termination failure due to packet loss is exceedingly unlikely, but to eliminate all risks, it will retry as many times as specified by this attribute before aborting.</p>") },
   END_MARKER
 };
 
 static const struct cfgelem unsupp_cfgelems[] = {
-    { MOVED("MaxMessageSize", "General/MaxMessageSize") },
-    { MOVED("FragmentSize", "General/FragmentSize") },
-    { LEAF("DeliveryQueueMaxSamples"), 1, "256", ABSOFF(delivery_queue_maxsamples), 0, uf_uint, 0, pf_uint,
-    "<p>This element controls the Maximum size of a delivery queue, expressed in samples. Once a delivery queue is full, incoming samples destined for that queue are dropped until space becomes available again.</p>" },
-    { LEAF("PrimaryReorderMaxSamples"), 1, "64", ABSOFF(primary_reorder_maxsamples), 0, uf_uint, 0, pf_uint,
-    "<p>This element sets the maximum size in samples of a primary re-order administration. Each proxy writer has one primary re-order administration to buffer the packet flow in case some packets arrive out of order. Old samples are forwarded to secondary re-order administrations associated with readers in need of historical data.</p>" },
-    { LEAF("SecondaryReorderMaxSamples"), 1, "16", ABSOFF(secondary_reorder_maxsamples), 0, uf_uint, 0, pf_uint,
-    "<p>This element sets the maximum size in samples of a secondary re-order administration. The secondary re-order administration is per reader in need of historical data.</p>" },
-    { LEAF("DefragUnreliableMaxSamples"), 1, "4", ABSOFF(defrag_unreliable_maxsamples), 0, uf_uint, 0, pf_uint,
-    "<p>This element sets the maximum number of samples that can be defragmented simultaneously for a best-effort writers.</p>" },
-    { LEAF("DefragReliableMaxSamples"), 1, "16", ABSOFF(defrag_reliable_maxsamples), 0, uf_uint, 0, pf_uint,
-    "<p>This element sets the maximum number of samples that can be defragmented simultaneously for a reliable writer. This has to be large enough to handle retransmissions of historical data in addition to new samples.</p>" },
-    { LEAF("BuiltinEndpointSet"), 1, "writers", ABSOFF(besmode), 0, uf_besmode, 0, pf_besmode,
-    "<p>This element controls which participants will have which built-in endpoints for the discovery and liveliness protocols. Valid values are:</p>\n\
+  { MOVED("MaxMessageSize", "General/MaxMessageSize") },
+  { MOVED("FragmentSize", "General/FragmentSize") },
+  { LEAF("DeliveryQueueMaxSamples"), 1, "256", ABSOFF(delivery_queue_maxsamples), 0, uf_uint, 0, pf_uint,
+    BLURB("<p>This element controls the Maximum size of a delivery queue, expressed in samples. Once a delivery queue is full, incoming samples destined for that queue are dropped until space becomes available again.</p>") },
+  { LEAF("PrimaryReorderMaxSamples"), 1, "64", ABSOFF(primary_reorder_maxsamples), 0, uf_uint, 0, pf_uint,
+    BLURB("<p>This element sets the maximum size in samples of a primary re-order administration. Each proxy writer has one primary re-order administration to buffer the packet flow in case some packets arrive out of order. Old samples are forwarded to secondary re-order administrations associated with readers in need of historical data.</p>") },
+  { LEAF("SecondaryReorderMaxSamples"), 1, "16", ABSOFF(secondary_reorder_maxsamples), 0, uf_uint, 0, pf_uint,
+    BLURB("<p>This element sets the maximum size in samples of a secondary re-order administration. The secondary re-order administration is per reader in need of historical data.</p>") },
+  { LEAF("DefragUnreliableMaxSamples"), 1, "4", ABSOFF(defrag_unreliable_maxsamples), 0, uf_uint, 0, pf_uint,
+    BLURB("<p>This element sets the maximum number of samples that can be defragmented simultaneously for a best-effort writers.</p>") },
+  { LEAF("DefragReliableMaxSamples"), 1, "16", ABSOFF(defrag_reliable_maxsamples), 0, uf_uint, 0, pf_uint,
+    BLURB("<p>This element sets the maximum number of samples that can be defragmented simultaneously for a reliable writer. This has to be large enough to handle retransmissions of historical data in addition to new samples.</p>") },
+  { LEAF("BuiltinEndpointSet"), 1, "writers", ABSOFF(besmode), 0, uf_besmode, 0, pf_besmode,
+    BLURB("<p>This element controls which participants will have which built-in endpoints for the discovery and liveliness protocols. Valid values are:</p>\n\
 <ul><li><i>full</i>: all participants have all endpoints;</li>\n\
 <li><i>writers</i>: all participants have the writers, but just one has the readers;</li>\n\
 <li><i>minimal</i>: only one participant has built-in endpoints.</li></ul>\n\
-<p>The default is <i>writers</i>, as this is thought to be compliant and reasonably efficient. <i>Minimal</i> may or may not be compliant but is most efficient, and <i>full</i> is inefficient but certain to be compliant. See also Internal/ConservativeBuiltinReaderStartup.</p>" },
-{ LEAF("AggressiveKeepLastWhc|AggressiveKeepLast1Whc"), 1, "true", ABSOFF(aggressive_keep_last_whc), 0, uf_boolean, 0, pf_boolean,
-"<p>This element controls whether to drop a reliable sample from a DDSI2E WHC before all readers have acknowledged it as soon as a later sample becomes available. It only affects DCPS data writers with a history QoS setting of KEEP_LAST with depth 1. The default setting, <i>false</i>, mimics the behaviour of the OpenSplice RT networking and is necessary to make the behaviour of wait_for_acknowledgements() consistent across the networking services.</p>" },
-{ LEAF("ConservativeBuiltinReaderStartup"), 1, "false", ABSOFF(conservative_builtin_reader_startup), 0, uf_boolean, 0, pf_boolean,
-"<p>This element forces all DDSI2E built-in discovery-related readers to request all historical data, instead of just one for each \"topic\". There is no indication that any of the current DDSI implementations requires changing of this setting, but it is conceivable that an implementation might track which participants have been informed of the existence of endpoints and which have not been, refusing communication with those that have \"can't\" know.</p>\n\
-<p>Should it be necessary to hide DDSI2E's shared discovery behaviour, set this to <i>true</i> and Internal/BuiltinEndpointSet to <i>full</i>.</p>" },
-{ LEAF("MeasureHbToAckLatency"), 1, "false", ABSOFF(meas_hb_to_ack_latency), 0, uf_boolean, 0, pf_boolean,
-"<p>This element enables heartbeat-to-ack latency among DDSI2E services by prepending timestamps to Heartbeat and AckNack messages and calculating round trip times. This is non-standard behaviour. The measured latencies are quite noisy and are currently not used anywhere.</p>" },
-{ LEAF("SuppressSPDPMulticast"), 1, "false", ABSOFF(suppress_spdp_multicast), 0, uf_boolean, 0, pf_boolean,
-"<p>The element controls whether the mandatory multicasting of the participant discovery packets occurs. Completely disabling multicasting requires this element be set to <i>true</i>, and generally requires explicitly listing peers to ping for unicast discovery.</p>\n\
-<p>See also General/AllowMulticast.</p>" },
-{ LEAF("UnicastResponseToSPDPMessages"), 1, "true", ABSOFF(unicast_response_to_spdp_messages), 0, uf_boolean, 0, pf_boolean,
-"<p>This element controls whether the response to a newly discovered participant is sent as a unicasted SPDP packet, instead of rescheduling the periodic multicasted one. There is no known benefit to setting this to <i>false</i>.</p>" },
-{ LEAF("SynchronousDeliveryPriorityThreshold"), 1, "0", ABSOFF(synchronous_delivery_priority_threshold), 0, uf_int, 0, pf_int,
-"<p>This element controls whether samples sent by a writer with QoS settings latency_budget <= SynchronousDeliveryLatencyBound and transport_priority greater than or equal to this element's value will be delivered synchronously from the \"recv\" thread, all others will be delivered asynchronously through delivery queues. This reduces latency at the expense of aggregate bandwidth.</p>" },
-{ LEAF("SynchronousDeliveryLatencyBound"), 1, "inf", ABSOFF(synchronous_delivery_latency_bound), 0, uf_duration_inf, 0, pf_duration,
-"<p>This element controls whether samples sent by a writer with QoS settings transport_priority >= SynchronousDeliveryPriorityThreshold and a latency_budget at most this element's value will be delivered synchronously from the \"recv\" thread, all others will be delivered asynchronously through delivery queues. This reduces latency at the expense of aggregate bandwidth.</p>" },
-{ LEAF("MaxParticipants"), 1, "0", ABSOFF(max_participants), 0, uf_natint, 0, pf_int,
-"<p>This elements configures the maximum number of DCPS domain participants this DDSI2E instance is willing to service. 0 is unlimited.</p>" },
-{ LEAF("AccelerateRexmitBlockSize"), 1, "0", ABSOFF(accelerate_rexmit_block_size), 0, uf_uint, 0, pf_uint,
-"<p>Proxy readers that are assumed to sill be retrieving historical data get this many samples retransmitted when they NACK something, even if some of these samples have sequence numbers outside the set covered by the NACK.</p>" },
-{ LEAF("RetransmitMerging"), 1, "adaptive", ABSOFF(retransmit_merging), 0, uf_retransmit_merging, 0, pf_retransmit_merging,
-"<p>This elements controls the addressing and timing of retransmits. Possible values are:</p>\n\
+<p>The default is <i>writers</i>, as this is thought to be compliant and reasonably efficient. <i>Minimal</i> may or may not be compliant but is most efficient, and <i>full</i> is inefficient but certain to be compliant. See also Internal/ConservativeBuiltinReaderStartup.</p>") },
+  { LEAF("ConservativeBuiltinReaderStartup"), 1, "false", ABSOFF(conservative_builtin_reader_startup), 0, uf_boolean, 0, pf_boolean,
+    BLURB("<p>This element forces all DDSI2E built-in discovery-related readers to request all historical data, instead of just one for each \"topic\". There is no indication that any of the current DDSI implementations requires changing of this setting, but it is conceivable that an implementation might track which participants have been informed of the existence of endpoints and which have not been, refusing communication with those that have \"can't\" know.</p>\n\
+<p>Should it be necessary to hide DDSI2E's shared discovery behaviour, set this to <i>true</i> and Internal/BuiltinEndpointSet to <i>full</i>.</p>") },
+  { LEAF("MeasureHbToAckLatency"), 1, "false", ABSOFF(meas_hb_to_ack_latency), 0, uf_boolean, 0, pf_boolean,
+    BLURB("<p>This element enables heartbeat-to-ack latency among DDSI2E services by prepending timestamps to Heartbeat and AckNack messages and calculating round trip times. This is non-standard behaviour. The measured latencies are quite noisy and are currently not used anywhere.</p>") },
+  { LEAF("SuppressSPDPMulticast"), 1, "false", ABSOFF(suppress_spdp_multicast), 0, uf_boolean, 0, pf_boolean,
+    BLURB("<p>The element controls whether the mandatory multicasting of the participant discovery packets occurs. Completely disabling multicasting requires this element be set to <i>true</i>, and generally requires explicitly listing peers to ping for unicast discovery.</p>\n\
+<p>See also General/AllowMulticast.</p>") },
+  { LEAF("UnicastResponseToSPDPMessages"), 1, "true", ABSOFF(unicast_response_to_spdp_messages), 0, uf_boolean, 0, pf_boolean,
+    BLURB("<p>This element controls whether the response to a newly discovered participant is sent as a unicasted SPDP packet, instead of rescheduling the periodic multicasted one. There is no known benefit to setting this to <i>false</i>.</p>") },
+  { LEAF("SynchronousDeliveryPriorityThreshold"), 1, "0", ABSOFF(synchronous_delivery_priority_threshold), 0, uf_int, 0, pf_int,
+    BLURB("<p>This element controls whether samples sent by a writer with QoS settings latency_budget <= SynchronousDeliveryLatencyBound and transport_priority greater than or equal to this element's value will be delivered synchronously from the \"recv\" thread, all others will be delivered asynchronously through delivery queues. This reduces latency at the expense of aggregate bandwidth.</p>") },
+  { LEAF("SynchronousDeliveryLatencyBound"), 1, "inf", ABSOFF(synchronous_delivery_latency_bound), 0, uf_duration_inf, 0, pf_duration,
+    BLURB("<p>This element controls whether samples sent by a writer with QoS settings transport_priority >= SynchronousDeliveryPriorityThreshold and a latency_budget at most this element's value will be delivered synchronously from the \"recv\" thread, all others will be delivered asynchronously through delivery queues. This reduces latency at the expense of aggregate bandwidth.</p>") },
+  { LEAF("MaxParticipants"), 1, "0", ABSOFF(max_participants), 0, uf_natint, 0, pf_int,
+    BLURB("<p>This elements configures the maximum number of DCPS domain participants this DDSI2E instance is willing to service. 0 is unlimited.</p>") },
+  { LEAF("AccelerateRexmitBlockSize"), 1, "0", ABSOFF(accelerate_rexmit_block_size), 0, uf_uint, 0, pf_uint,
+    BLURB("<p>Proxy readers that are assumed to sill be retrieving historical data get this many samples retransmitted when they NACK something, even if some of these samples have sequence numbers outside the set covered by the NACK.</p>") },
+  { LEAF("RetransmitMerging"), 1, "adaptive", ABSOFF(retransmit_merging), 0, uf_retransmit_merging, 0, pf_retransmit_merging,
+    BLURB("<p>This elements controls the addressing and timing of retransmits. Possible values are:</p>\n\
 <ul><li><i>never</i>: retransmit only to the NACK-ing reader;</li>\n  \
 <li><i>adaptive</i>: attempt to combine retransmits needed for reliability, but send historical (transient-local) data to the requesting reader only;</li>\n\
 <li><i>always</i>: do not distinguish between different causes, always try to merge.</li></ul>\n\
-<p>The default is <i>adaptive</i>. See also Internal/RetransmitMergingPeriod.</p>" },
-{ LEAF("RetransmitMergingPeriod"), 1, "5 ms", ABSOFF(retransmit_merging_period), 0, uf_duration_us_1s, 0, pf_duration,
-"<p>This setting determines the size of the time window in which a NACK of some sample is ignored because a retransmit of that sample has been multicasted too recently. This setting has no effect on unicasted retransmits.</p>\n\
-<p>See also Internal/RetransmitMerging.</p>" },
-{ LEAF_W_ATTRS("HeartbeatInterval", heartbeat_interval_attrs), 1, "100 ms", ABSOFF(const_hb_intv_sched), 0, uf_duration_inf, 0, pf_duration,
-  "<p>This elemnents allows configuring the base interval for sending writer heartbeats and the bounds within it can vary.</p>" },
-{ LEAF("MaxQueuedRexmitBytes"), 1, "50 kB", ABSOFF(max_queued_rexmit_bytes), 0, uf_memsize, 0, pf_memsize,
-"<p>This setting limits the maximum number of bytes queued for retransmission. The default value of 0 is unlimited unless an AuxiliaryBandwidthLimit has been set, in which case it becomes NackDelay * AuxiliaryBandwidthLimit. It must be large enough to contain the largest sample that may need to be retransmitted.</p>" },
-{ LEAF("MaxQueuedRexmitMessages"), 1, "200", ABSOFF(max_queued_rexmit_msgs), 0, uf_uint, 0, pf_uint,
-"<p>This settings limits the maximum number of samples queued for retransmission.</p>" },
-{ LEAF("LeaseDuration"), 1, "10 s", ABSOFF(lease_duration), 0, uf_duration_ms_1hr, 0, pf_duration,
-"<p>This setting controls the default participant lease duration. <p>" },
-{ LEAF("WriterLingerDuration"), 1, "1 s", ABSOFF(writer_linger_duration), 0, uf_duration_ms_1hr, 0, pf_duration,
-"<p>This setting controls the maximum duration for which actual deletion of a reliable writer with unacknowledged data in its history will be postponed to provide proper reliable transmission.<p>" },
-{ LEAF("MinimumSocketReceiveBufferSize"), 1, "default", ABSOFF(socket_min_rcvbuf_size), 0, uf_maybe_memsize, 0, pf_maybe_memsize,
-"<p>This setting controls the minimum size of socket receive buffers. The operating system provides some size receive buffer upon creation of the socket, this option can be used to increase the size of the buffer beyond that initially provided by the operating system. If the buffer size cannot be increased to the specified size, an error is reported.</p>\n\
-<p>The default setting is the word \"default\", which means DDSI2E will attempt to increase the buffer size to 1MB, but will silently accept a smaller buffer should that attempt fail.</p>" },
-{ LEAF("MinimumSocketSendBufferSize"), 1, "64 KiB", ABSOFF(socket_min_sndbuf_size), 0, uf_memsize, 0, pf_memsize,
-"<p>This setting controls the minimum size of socket send buffers. This setting can only increase the size of the send buffer, if the operating system by default creates a larger buffer, it is left unchanged.</p>" },
-{ LEAF("NackDelay"), 1, "10 ms", ABSOFF(nack_delay), 0, uf_duration_ms_1hr, 0, pf_duration,
-"<p>This setting controls the delay between receipt of a HEARTBEAT indicating missing samples and a NACK (ignored when the HEARTBEAT requires an answer). However, no NACK is sent if a NACK had been scheduled already for a response earlier than the delay requests: then that NACK will incorporate the latest information.</p>" },
-{ LEAF("AutoReschedNackDelay"), 1, "1 s", ABSOFF(auto_resched_nack_delay), 0, uf_duration_inf, 0, pf_duration,
-"<p>This setting controls the interval with which a reader will continue NACK'ing missing samples in the absence of a response from the writer, as a protection mechanism against writers incorrectly stopping the sending of HEARTBEAT messages.</p>" },
-{ LEAF("PreEmptiveAckDelay"), 1, "10 ms", ABSOFF(preemptive_ack_delay), 0, uf_duration_ms_1hr, 0, pf_duration,
-"<p>This setting controls the delay between the discovering a remote writer and sending a pre-emptive AckNack to discover the range of data available.</p>" },
-{ LEAF("ScheduleTimeRounding"), 1, "0 ms", ABSOFF(schedule_time_rounding), 0, uf_duration_ms_1hr, 0, pf_duration,
-"<p>This setting allows the timing of scheduled events to be rounded up so that more events can be handled in a single cycle of the event queue. The default is 0 and causes no rounding at all, i.e. are scheduled exactly, whereas a value of 10ms would mean that events are rounded up to the nearest 10 milliseconds.</p>" },
+<p>The default is <i>adaptive</i>. See also Internal/RetransmitMergingPeriod.</p>") },
+  { LEAF("RetransmitMergingPeriod"), 1, "5 ms", ABSOFF(retransmit_merging_period), 0, uf_duration_us_1s, 0, pf_duration,
+    BLURB("<p>This setting determines the size of the time window in which a NACK of some sample is ignored because a retransmit of that sample has been multicasted too recently. This setting has no effect on unicasted retransmits.</p>\n\
+<p>See also Internal/RetransmitMerging.</p>") },
+  { LEAF_W_ATTRS("HeartbeatInterval", heartbeat_interval_attrs), 1, "100 ms", ABSOFF(const_hb_intv_sched), 0, uf_duration_inf, 0, pf_duration,
+    BLURB("<p>This elemnents allows configuring the base interval for sending writer heartbeats and the bounds within it can vary.</p>") },
+  { LEAF("MaxQueuedRexmitBytes"), 1, "50 kB", ABSOFF(max_queued_rexmit_bytes), 0, uf_memsize, 0, pf_memsize,
+    BLURB("<p>This setting limits the maximum number of bytes queued for retransmission. The default value of 0 is unlimited unless an AuxiliaryBandwidthLimit has been set, in which case it becomes NackDelay * AuxiliaryBandwidthLimit. It must be large enough to contain the largest sample that may need to be retransmitted.</p>") },
+  { LEAF("MaxQueuedRexmitMessages"), 1, "200", ABSOFF(max_queued_rexmit_msgs), 0, uf_uint, 0, pf_uint,
+    BLURB("<p>This settings limits the maximum number of samples queued for retransmission.</p>") },
+  { LEAF("LeaseDuration"), 1, "10 s", ABSOFF(lease_duration), 0, uf_duration_ms_1hr, 0, pf_duration,
+    BLURB("<p>This setting controls the default participant lease duration. <p>") },
+  { LEAF("WriterLingerDuration"), 1, "1 s", ABSOFF(writer_linger_duration), 0, uf_duration_ms_1hr, 0, pf_duration,
+    BLURB("<p>This setting controls the maximum duration for which actual deletion of a reliable writer with unacknowledged data in its history will be postponed to provide proper reliable transmission.<p>") },
+  { LEAF("MinimumSocketReceiveBufferSize"), 1, "default", ABSOFF(socket_min_rcvbuf_size), 0, uf_maybe_memsize, 0, pf_maybe_memsize,
+    BLURB("<p>This setting controls the minimum size of socket receive buffers. The operating system provides some size receive buffer upon creation of the socket, this option can be used to increase the size of the buffer beyond that initially provided by the operating system. If the buffer size cannot be increased to the specified size, an error is reported.</p>\n\
+<p>The default setting is the word \"default\", which means DDSI2E will attempt to increase the buffer size to 1MB, but will silently accept a smaller buffer should that attempt fail.</p>") },
+  { LEAF("MinimumSocketSendBufferSize"), 1, "64 KiB", ABSOFF(socket_min_sndbuf_size), 0, uf_memsize, 0, pf_memsize,
+    BLURB("<p>This setting controls the minimum size of socket send buffers. This setting can only increase the size of the send buffer, if the operating system by default creates a larger buffer, it is left unchanged.</p>") },
+  { LEAF("NackDelay"), 1, "10 ms", ABSOFF(nack_delay), 0, uf_duration_ms_1hr, 0, pf_duration,
+    BLURB("<p>This setting controls the delay between receipt of a HEARTBEAT indicating missing samples and a NACK (ignored when the HEARTBEAT requires an answer). However, no NACK is sent if a NACK had been scheduled already for a response earlier than the delay requests: then that NACK will incorporate the latest information.</p>") },
+  { LEAF("AutoReschedNackDelay"), 1, "1 s", ABSOFF(auto_resched_nack_delay), 0, uf_duration_inf, 0, pf_duration,
+    BLURB("<p>This setting controls the interval with which a reader will continue NACK'ing missing samples in the absence of a response from the writer, as a protection mechanism against writers incorrectly stopping the sending of HEARTBEAT messages.</p>") },
+  { LEAF("PreEmptiveAckDelay"), 1, "10 ms", ABSOFF(preemptive_ack_delay), 0, uf_duration_ms_1hr, 0, pf_duration,
+    BLURB("<p>This setting controls the delay between the discovering a remote writer and sending a pre-emptive AckNack to discover the range of data available.</p>") },
+  { LEAF("ScheduleTimeRounding"), 1, "0 ms", ABSOFF(schedule_time_rounding), 0, uf_duration_ms_1hr, 0, pf_duration,
+    BLURB("<p>This setting allows the timing of scheduled events to be rounded up so that more events can be handled in a single cycle of the event queue. The default is 0 and causes no rounding at all, i.e. are scheduled exactly, whereas a value of 10ms would mean that events are rounded up to the nearest 10 milliseconds.</p>") },
 #ifdef DDSI_INCLUDE_BANDWIDTH_LIMITING
-{ LEAF("AuxiliaryBandwidthLimit"), 1, "inf", ABSOFF(auxiliary_bandwidth_limit), 0, uf_bandwidth, 0, pf_bandwidth,
-"<p>This element specifies the maximum transmit rate of auxiliary traffic not bound to a specific channel, such as discovery traffic, as well as auxiliary traffic related to a certain channel if that channel has elected to share this global AuxiliaryBandwidthLimit. Bandwidth limiting uses a leaky bucket scheme. The default value \"inf\" means DDSI2E imposes no limitation, the underlying operating system and hardware will likely limit the maimum transmit rate.</p>" },
+  { LEAF("AuxiliaryBandwidthLimit"), 1, "inf", ABSOFF(auxiliary_bandwidth_limit), 0, uf_bandwidth, 0, pf_bandwidth,
+    BLURB("<p>This element specifies the maximum transmit rate of auxiliary traffic not bound to a specific channel, such as discovery traffic, as well as auxiliary traffic related to a certain channel if that channel has elected to share this global AuxiliaryBandwidthLimit. Bandwidth limiting uses a leaky bucket scheme. The default value \"inf\" means DDSI2E imposes no limitation, the underlying operating system and hardware will likely limit the maimum transmit rate.</p>") },
 #endif
-{ LEAF("DDSI2DirectMaxThreads"), 1, "1", ABSOFF(ddsi2direct_max_threads), 0, uf_uint, 0, pf_uint,
-"<p>This element sets the maximum number of extra threads for an experimental, undocumented and unsupported direct mode.</p>" },
-{ LEAF("SquashParticipants"), 1, "false", ABSOFF(squash_participants), 0, uf_boolean, 0, pf_boolean,
-"<p>This element controls whether DDSI2E advertises all the domain participants it serves in DDSI (when set to <i>false</i>), or rather only one domain participant (the one corresponding to the DDSI2E process; when set to <i>true</i>). In the latter case DDSI2E becomes the virtual owner of all readers and writers of all domain participants, dramatically reducing discovery traffic (a similar effect can be obtained by setting Internal/BuiltinEndpointSet to \"minimal\" but with less loss of information).</p>" },
-{ LEAF("LegacyFragmentation"), 1, "false", ABSOFF(buggy_datafrag_flags_mode), 0, uf_boolean, 0, pf_boolean,
-"<p>This option enables a backwards-compatible, non-compliant setting and interpretation of the control flags in fragmented data messages. To be enabled <i>only</i> when requiring interoperability between compliant and non-compliant versions of DDSI2E for large messages.</p>" },
-{ LEAF("SPDPResponseMaxDelay"), 1, "0 ms", ABSOFF(spdp_response_delay_max), 0, uf_duration_ms_1s, 0, pf_duration,
-"<p>Maximum pseudo-random delay in milliseconds between discovering a remote participant and responding to it.</p>" },
-{ LEAF("LateAckMode"), 1, "false", ABSOFF(late_ack_mode), 0, uf_boolean, 0, pf_boolean,
-"<p>Ack a sample only when it has been delivered, instead of when committed to delivering it.</p>" },
-{ LEAF("ForwardAllMessages"), 1, "false", ABSOFF(forward_all_messages), 0, uf_boolean, 0, pf_boolean,
-"<p>Forward all messages from a writer, rather than trying to forward each sample only once. The default of trying to forward each sample only once filters out duplicates for writers in multiple partitions under nearly all circumstances, but may still publish the odd duplicate. Note: the current implementation also can lose in contrived test cases, that publish more than 2**32 samples using a single data writer in conjunction with carefully controlled management of the writer history via cooperating local readers.</p>" },
-{ LEAF("RetryOnRejectBestEffort"), 1, "false", ABSOFF(retry_on_reject_besteffort), 0, uf_boolean, 0, pf_boolean,
-"<p>Whether or not to locally retry pushing a received best-effort sample into the reader caches when resource limits are reached.</p>" },
-{ LEAF("GenerateKeyhash"), 1, "false", ABSOFF(generate_keyhash), 0, uf_boolean, 0, pf_boolean,
-"<p>When true, include keyhashes in outgoing data for topics with keys.</p>" },
-{ LEAF("MaxSampleSize"), 1, "2147483647 B", ABSOFF(max_sample_size), 0, uf_memsize, 0, pf_memsize,
-"<p>This setting controls the maximum (CDR) serialised size of samples that DDSI2E will forward in either direction. Samples larger than this are discarded with a warning.</p>" },
-{ LEAF("WriteBatch"), 1, "false", ABSOFF(whc_batch), 0, uf_boolean, 0, pf_boolean,
-"<p>This element enables the batching of write operations. By default each write operation writes through the write cache and out onto the transport. Enabling write batching causes multiple small write operations to be aggregated within the write cache into a single larger write. This gives greater throughput at the expense of latency. Currently there is no mechanism for the write cache to automatically flush itself, so that if write batching is enabled, the application may havee to use the dds_write_flush function to ensure thta all samples are written.</p>" },
-{ LEAF_W_ATTRS("LivelinessMonitoring", liveliness_monitoring_attrs), 1, "false", ABSOFF(liveliness_monitoring), 0, uf_boolean, 0, pf_boolean,
-"<p>This element controls whether or not implementation should internally monitor its own liveliness. If liveliness monitoring is enabled, stack traces can be dumped automatically when some thread appears to have stopped making progress.</p>" },
-{ LEAF("MonitorPort"), 1, "-1", ABSOFF(monitor_port), 0, uf_int, 0, pf_int,
-"<p>This element allows configuring a service that dumps a text description of part the internal state to TCP clients. By default (-1), this is disabled; specifying 0 means a kernel-allocated port is used; a positive number is used as the TCP port number.</p>" },
-{ LEAF("AssumeMulticastCapable"), 1, "", ABSOFF(assumeMulticastCapable), 0, uf_string, ff_free, pf_string,
-"<p>This element controls which network interfaces are assumed to be capable of multicasting even when the interface flags returned by the operating system state it is not (this provides a workaround for some platforms). It is a comma-separated lists of patterns (with ? and * wildcards) against which the interface names are matched.</p>" },
-{ LEAF("PrioritizeRetransmit"), 1, "true", ABSOFF(prioritize_retransmit), 0, uf_boolean, 0, pf_boolean,
-"<p>This element controls whether retransmits are prioritized over new data, speeding up recovery.</p>" },
-{ LEAF("UseMulticastIfMreqn"), 1, "0", ABSOFF(use_multicast_if_mreqn), 0, uf_int, 0, pf_int,
-"<p>Do not use.</p>" },
-{ LEAF("SendAsync"), 1, "false", ABSOFF(xpack_send_async), 0, uf_boolean, 0, pf_boolean,
-"<p>This element controls whether the actual sending of packets occurs on the same thread that prepares them, or is done asynchronously by another thread.</p>" },
-{ LEAF_W_ATTRS("RediscoveryBlacklistDuration", rediscovery_blacklist_duration_attrs), 1, "10s", ABSOFF(prune_deleted_ppant.delay), 0, uf_duration_inf, 0, pf_duration,
-"<p>This element controls for how long a remote participant that was previously deleted will remain on a blacklist to prevent rediscovery, giving the software on a node time to perform any cleanup actions it needs to do. To some extent this delay is required internally by DDSI2E, but in the default configuration with the 'enforce' attribute set to false, DDSI2E will reallow rediscovery as soon as it has cleared its internal administration. Setting it to too small a value may result in the entry being pruned from the blacklist before DDSI2E is ready, it is therefore recommended to set it to at least several seconds.</p>" },
+  { LEAF("DDSI2DirectMaxThreads"), 1, "1", ABSOFF(ddsi2direct_max_threads), 0, uf_uint, 0, pf_uint,
+    BLURB("<p>This element sets the maximum number of extra threads for an experimental, undocumented and unsupported direct mode.</p>") },
+  { LEAF("SquashParticipants"), 1, "false", ABSOFF(squash_participants), 0, uf_boolean, 0, pf_boolean,
+    BLURB("<p>This element controls whether DDSI2E advertises all the domain participants it serves in DDSI (when set to <i>false</i>), or rather only one domain participant (the one corresponding to the DDSI2E process; when set to <i>true</i>). In the latter case DDSI2E becomes the virtual owner of all readers and writers of all domain participants, dramatically reducing discovery traffic (a similar effect can be obtained by setting Internal/BuiltinEndpointSet to \"minimal\" but with less loss of information).</p>") },
+  { LEAF("SPDPResponseMaxDelay"), 1, "0 ms", ABSOFF(spdp_response_delay_max), 0, uf_duration_ms_1s, 0, pf_duration,
+    BLURB("<p>Maximum pseudo-random delay in milliseconds between discovering a remote participant and responding to it.</p>") },
+  { LEAF("LateAckMode"), 1, "false", ABSOFF(late_ack_mode), 0, uf_boolean, 0, pf_boolean,
+    BLURB("<p>Ack a sample only when it has been delivered, instead of when committed to delivering it.</p>") },
+  { LEAF("RetryOnRejectBestEffort"), 1, "false", ABSOFF(retry_on_reject_besteffort), 0, uf_boolean, 0, pf_boolean,
+    BLURB("<p>Whether or not to locally retry pushing a received best-effort sample into the reader caches when resource limits are reached.</p>") },
+  { LEAF("GenerateKeyhash"), 1, "false", ABSOFF(generate_keyhash), 0, uf_boolean, 0, pf_boolean,
+    BLURB("<p>When true, include keyhashes in outgoing data for topics with keys.</p>") },
+  { LEAF("MaxSampleSize"), 1, "2147483647 B", ABSOFF(max_sample_size), 0, uf_memsize, 0, pf_memsize,
+    BLURB("<p>This setting controls the maximum (CDR) serialised size of samples that DDSI2E will forward in either direction. Samples larger than this are discarded with a warning.</p>") },
+  { LEAF("WriteBatch"), 1, "false", ABSOFF(whc_batch), 0, uf_boolean, 0, pf_boolean,
+    BLURB("<p>This element enables the batching of write operations. By default each write operation writes through the write cache and out onto the transport. Enabling write batching causes multiple small write operations to be aggregated within the write cache into a single larger write. This gives greater throughput at the expense of latency. Currently there is no mechanism for the write cache to automatically flush itself, so that if write batching is enabled, the application may havee to use the dds_write_flush function to ensure thta all samples are written.</p>") },
+  { LEAF_W_ATTRS("LivelinessMonitoring", liveliness_monitoring_attrs), 1, "false", ABSOFF(liveliness_monitoring), 0, uf_boolean, 0, pf_boolean,
+    BLURB("<p>This element controls whether or not implementation should internally monitor its own liveliness. If liveliness monitoring is enabled, stack traces can be dumped automatically when some thread appears to have stopped making progress.</p>") },
+  { LEAF("MonitorPort"), 1, "-1", ABSOFF(monitor_port), 0, uf_int, 0, pf_int,
+    BLURB("<p>This element allows configuring a service that dumps a text description of part the internal state to TCP clients. By default (-1), this is disabled; specifying 0 means a kernel-allocated port is used; a positive number is used as the TCP port number.</p>") },
+  { LEAF("AssumeMulticastCapable"), 1, "", ABSOFF(assumeMulticastCapable), 0, uf_string, ff_free, pf_string,
+    BLURB("<p>This element controls which network interfaces are assumed to be capable of multicasting even when the interface flags returned by the operating system state it is not (this provides a workaround for some platforms). It is a comma-separated lists of patterns (with ? and * wildcards) against which the interface names are matched.</p>") },
+  { LEAF("PrioritizeRetransmit"), 1, "true", ABSOFF(prioritize_retransmit), 0, uf_boolean, 0, pf_boolean,
+    BLURB("<p>This element controls whether retransmits are prioritized over new data, speeding up recovery.</p>") },
+  { LEAF("UseMulticastIfMreqn"), 1, "0", ABSOFF(use_multicast_if_mreqn), 0, uf_int, 0, pf_int,
+    BLURB("<p>Do not use.</p>") },
+  { LEAF("SendAsync"), 1, "false", ABSOFF(xpack_send_async), 0, uf_boolean, 0, pf_boolean,
+    BLURB("<p>This element controls whether the actual sending of packets occurs on the same thread that prepares them, or is done asynchronously by another thread.</p>") },
+  { LEAF_W_ATTRS("RediscoveryBlacklistDuration", rediscovery_blacklist_duration_attrs), 1, "10s", ABSOFF(prune_deleted_ppant.delay), 0, uf_duration_inf, 0, pf_duration,
+    BLURB("<p>This element controls for how long a remote participant that was previously deleted will remain on a blacklist to prevent rediscovery, giving the software on a node time to perform any cleanup actions it needs to do. To some extent this delay is required internally by DDSI2E, but in the default configuration with the 'enforce' attribute set to false, DDSI2E will reallow rediscovery as soon as it has cleared its internal administration. Setting it to too small a value may result in the entry being pruned from the blacklist before DDSI2E is ready, it is therefore recommended to set it to at least several seconds.</p>") },
   { LEAF_W_ATTRS("MultipleReceiveThreads", multiple_recv_threads_attrs), 1, "true", ABSOFF(multiple_recv_threads), 0, uf_boolean, 0, pf_boolean,
-         "<p>This element controls whether all traffic is handled by a single receive thread or whether multiple receive threads may be used to improve latency. Currently multiple receive threads are only used for connectionless transport (e.g., UDP) and ManySocketsMode not set to single (the default).</p>" },
-{ MGROUP("ControlTopic", control_topic_cfgelems, control_topic_cfgattrs), 1, 0, 0, 0, 0, 0, 0, 0,
-"<p>The ControlTopic element allows configured whether DDSI2E provides a special control interface via a predefined topic or not.<p>" },
-{ GROUP("Test", unsupp_test_cfgelems),
-"<p>Testing options.</p>" },
-{ GROUP("Watermarks", unsupp_watermarks_cfgelems),
-"<p>Watermarks for flow-control.</p>" },
-{ LEAF("EnableExpensiveChecks"), 1, "", ABSOFF(enabled_xchecks), 0, uf_xcheck, 0, pf_xcheck,
-      "<p>This element enables expensive checks in builds with assertions enabled and is ignored otherwise. Recognised categories are:</p>\n\
+    BLURB("<p>This element controls whether all traffic is handled by a single receive thread or whether multiple receive threads may be used to improve latency. Currently multiple receive threads are only used for connectionless transport (e.g., UDP) and ManySocketsMode not set to single (the default).</p>") },
+  { MGROUP("ControlTopic", control_topic_cfgelems, control_topic_cfgattrs), 1, 0, 0, 0, 0, 0, 0, 0,
+    BLURB("<p>The ControlTopic element allows configured whether DDSI2E provides a special control interface via a predefined topic or not.<p>") },
+  { GROUP("Test", unsupp_test_cfgelems),
+    BLURB("<p>Testing options.</p>") },
+  { GROUP("Watermarks", unsupp_watermarks_cfgelems),
+    BLURB("<p>Watermarks for flow-control.</p>") },
+  { LEAF("EnableExpensiveChecks"), 1, "", ABSOFF(enabled_xchecks), 0, uf_xcheck, 0, pf_xcheck,
+    BLURB("<p>This element enables expensive checks in builds with assertions enabled and is ignored otherwise. Recognised categories are:</p>\n\
       <ul><li><i>whc</i>: writer history cache checking</li>\n\
       <li><i>rhc</i>: reader history cache checking</li>\n\
-      <p>In addition, there is the keyword <i>all</i> that enables all checks.</p>" },
-
-END_MARKER
+      <p>In addition, there is the keyword <i>all</i> that enables all checks.</p>") },
+  END_MARKER
 };
 
-static const struct cfgelem sizing_cfgelems[] =
-{
-    { LEAF("ReceiveBufferSize"), 1, "1 MiB", ABSOFF(rbuf_size), 0, uf_memsize, 0, pf_memsize,
-    "<p>This element sets the size of a single receive buffer. Many receive buffers may be needed. The minimum workable size a little bit larger than Sizing/ReceiveBufferChunkSize, and the value used is taken as the configured value and the actual minimum workable size.</p>" },
-    { LEAF("ReceiveBufferChunkSize"), 1, "128 KiB", ABSOFF(rmsg_chunk_size), 0, uf_memsize, 0, pf_memsize,
-    "<p>This element specifies the size of one allocation unit in the receive buffer. Must be greater than the maximum packet size by a modest amount (too large packets are dropped). Each allocation is shrunk immediately after processing a message, or freed straightaway.</p>" },
-    END_MARKER
+static const struct cfgelem sizing_cfgelems[] = {
+  { LEAF("ReceiveBufferSize"), 1, "1 MiB", ABSOFF(rbuf_size), 0, uf_memsize, 0, pf_memsize,
+    BLURB("<p>This element sets the size of a single receive buffer. Many receive buffers may be needed. The minimum workable size a little bit larger than Sizing/ReceiveBufferChunkSize, and the value used is taken as the configured value and the actual minimum workable size.</p>") },
+  { LEAF("ReceiveBufferChunkSize"), 1, "128 KiB", ABSOFF(rmsg_chunk_size), 0, uf_memsize, 0, pf_memsize,
+    BLURB("<p>This element specifies the size of one allocation unit in the receive buffer. Must be greater than the maximum packet size by a modest amount (too large packets are dropped). Each allocation is shrunk immediately after processing a message, or freed straightaway.</p>") },
+  END_MARKER
 };
 
 static const struct cfgelem discovery_ports_cfgelems[] = {
-    { LEAF("Base"), 1, "7400", ABSOFF(port_base), 0, uf_port, 0, pf_int,
-    "<p>This element specifies the base port number (refer to the DDSI 2.1 specification, section 9.6.1, constant PB).</p>" },
-    { LEAF("DomainGain"), 1, "250", ABSOFF(port_dg), 0, uf_int, 0, pf_int,
-    "<p>This element specifies the domain gain, relating domain ids to sets of port numbers (refer to the DDSI 2.1 specification, section 9.6.1, constant DG).</p>" },
-    { LEAF("ParticipantGain"), 1, "2", ABSOFF(port_pg), 0, uf_int, 0, pf_int,
-    "<p>This element specifies the participant gain, relating p0, articipant index to sets of port numbers (refer to the DDSI 2.1 specification, section 9.6.1, constant PG).</p>" },
-    { LEAF("MulticastMetaOffset"), 1, "0", ABSOFF(port_d0), 0, uf_int, 0, pf_int,
-    "<p>This element specifies the port number for multicast meta traffic (refer to the DDSI 2.1 specification, section 9.6.1, constant d0).</p>" },
-    { LEAF("UnicastMetaOffset"), 1, "10", ABSOFF(port_d1), 0, uf_int, 0, pf_int,
-    "<p>This element specifies the port number for unicast meta traffic (refer to the DDSI 2.1 specification, section 9.6.1, constant d1).</p>" },
-    { LEAF("MulticastDataOffset"), 1, "1", ABSOFF(port_d2), 0, uf_int, 0, pf_int,
-    "<p>This element specifies the port number for multicast meta traffic (refer to the DDSI 2.1 specification, section 9.6.1, constant d2).</p>" },
-    { LEAF("UnicastDataOffset"), 1, "11", ABSOFF(port_d3), 0, uf_int, 0, pf_int,
-    "<p>This element specifies the port number for unicast meta traffic (refer to the DDSI 2.1 specification, section 9.6.1, constant d3).</p>" },
-    END_MARKER
+  { LEAF("Base"), 1, "7400", ABSOFF(port_base), 0, uf_port, 0, pf_int,
+    BLURB("<p>This element specifies the base port number (refer to the DDSI 2.1 specification, section 9.6.1, constant PB).</p>") },
+  { LEAF("DomainGain"), 1, "250", ABSOFF(port_dg), 0, uf_int, 0, pf_int,
+    BLURB("<p>This element specifies the domain gain, relating domain ids to sets of port numbers (refer to the DDSI 2.1 specification, section 9.6.1, constant DG).</p>") },
+  { LEAF("ParticipantGain"), 1, "2", ABSOFF(port_pg), 0, uf_int, 0, pf_int,
+    BLURB("<p>This element specifies the participant gain, relating p0, articipant index to sets of port numbers (refer to the DDSI 2.1 specification, section 9.6.1, constant PG).</p>") },
+  { LEAF("MulticastMetaOffset"), 1, "0", ABSOFF(port_d0), 0, uf_int, 0, pf_int,
+    BLURB("<p>This element specifies the port number for multicast meta traffic (refer to the DDSI 2.1 specification, section 9.6.1, constant d0).</p>") },
+  { LEAF("UnicastMetaOffset"), 1, "10", ABSOFF(port_d1), 0, uf_int, 0, pf_int,
+    BLURB("<p>This element specifies the port number for unicast meta traffic (refer to the DDSI 2.1 specification, section 9.6.1, constant d1).</p>") },
+  { LEAF("MulticastDataOffset"), 1, "1", ABSOFF(port_d2), 0, uf_int, 0, pf_int,
+    BLURB("<p>This element specifies the port number for multicast meta traffic (refer to the DDSI 2.1 specification, section 9.6.1, constant d2).</p>") },
+  { LEAF("UnicastDataOffset"), 1, "11", ABSOFF(port_d3), 0, uf_int, 0, pf_int,
+    BLURB("<p>This element specifies the port number for unicast meta traffic (refer to the DDSI 2.1 specification, section 9.6.1, constant d3).</p>") },
+  END_MARKER
 };
 
 static const struct cfgelem tcp_cfgelems[] = {
-    { LEAF ("Enable"), 1, "default", ABSOFF (compat_tcp_enable), 0, uf_boolean_default, 0, pf_nop,
-    "<p>This element enables the optional TCP transport - deprecated, use General/Transport instead.</p>" },
-    { LEAF("NoDelay"), 1, "true", ABSOFF(tcp_nodelay), 0, uf_boolean, 0, pf_boolean,
-    "<p>This element enables the TCP_NODELAY socket option, preventing multiple DDSI messages being sent in the same TCP request. Setting this option typically optimises latency over throughput.</p>" },
-    { LEAF("Port"), 1, "-1", ABSOFF(tcp_port), 0, uf_dyn_port, 0, pf_int,
-    "<p>This element specifies the TCP port number on which DDSI2E accepts connections. If the port is set it is used in entity locators, published with DDSI discovery. Dynamically allocated if zero. Disabled if -1 or not configured. If disabled other DDSI services will not be able to establish connections with the service, the service can only communicate by establishing connections to other services.</p>" },
-    { LEAF("ReadTimeout"), 1, "2 s", ABSOFF(tcp_read_timeout), 0, uf_duration_ms_1hr, 0, pf_duration,
-    "<p>This element specifies the timeout for blocking TCP read operations. If this timeout expires then the connection is closed.</p>" },
-    { LEAF("WriteTimeout"), 1, "2 s", ABSOFF(tcp_write_timeout), 0, uf_duration_ms_1hr, 0, pf_duration,
-    "<p>This element specifies the timeout for blocking TCP write operations. If this timeout expires then the connection is closed.</p>" },
-    { LEAF ("AlwaysUsePeeraddrForUnicast"), 1, "false", ABSOFF (tcp_use_peeraddr_for_unicast), 0, uf_boolean, 0, pf_boolean,
-    "<p>Setting this to true means the unicast addresses in SPDP packets will be ignored and the peer address from the TCP connection will be used instead. This may help work around incorrectly advertised addresses when using TCP.</p>" },
-    END_MARKER
+  { LEAF ("Enable"), 1, "default", ABSOFF (compat_tcp_enable), 0, uf_boolean_default, 0, pf_nop,
+    BLURB("<p>This element enables the optional TCP transport - deprecated, use General/Transport instead.</p>") },
+  { LEAF("NoDelay"), 1, "true", ABSOFF(tcp_nodelay), 0, uf_boolean, 0, pf_boolean,
+    BLURB("<p>This element enables the TCP_NODELAY socket option, preventing multiple DDSI messages being sent in the same TCP request. Setting this option typically optimises latency over throughput.</p>") },
+  { LEAF("Port"), 1, "-1", ABSOFF(tcp_port), 0, uf_dyn_port, 0, pf_int,
+    BLURB("<p>This element specifies the TCP port number on which DDSI2E accepts connections. If the port is set it is used in entity locators, published with DDSI discovery. Dynamically allocated if zero. Disabled if -1 or not configured. If disabled other DDSI services will not be able to establish connections with the service, the service can only communicate by establishing connections to other services.</p>") },
+  { LEAF("ReadTimeout"), 1, "2 s", ABSOFF(tcp_read_timeout), 0, uf_duration_ms_1hr, 0, pf_duration,
+    BLURB("<p>This element specifies the timeout for blocking TCP read operations. If this timeout expires then the connection is closed.</p>") },
+  { LEAF("WriteTimeout"), 1, "2 s", ABSOFF(tcp_write_timeout), 0, uf_duration_ms_1hr, 0, pf_duration,
+    BLURB("<p>This element specifies the timeout for blocking TCP write operations. If this timeout expires then the connection is closed.</p>") },
+  { LEAF ("AlwaysUsePeeraddrForUnicast"), 1, "false", ABSOFF (tcp_use_peeraddr_for_unicast), 0, uf_boolean, 0, pf_boolean,
+    BLURB("<p>Setting this to true means the unicast addresses in SPDP packets will be ignored and the peer address from the TCP connection will be used instead. This may help work around incorrectly advertised addresses when using TCP.</p>") },
+  END_MARKER
 };
 
 #ifdef DDSI_INCLUDE_SSL
 static const struct cfgelem ssl_cfgelems[] = {
-    { LEAF("Enable"), 1, "false", ABSOFF(ssl_enable), 0, uf_boolean, 0, pf_boolean,
-    "<p>This enables SSL/TLS for TCP.</p>" },
-    { LEAF("CertificateVerification"), 1, "true", ABSOFF(ssl_verify), 0, uf_boolean, 0, pf_boolean,
-    "<p>If disabled this allows SSL connections to occur even if an X509 certificate fails verification.</p>" },
-    { LEAF("VerifyClient"), 1, "true", ABSOFF(ssl_verify_client), 0, uf_boolean, 0, pf_boolean,
-    "<p>This enables an SSL server checking the X509 certificate of a connecting client.</p>" },
-    { LEAF("SelfSignedCertificates"), 1, "false", ABSOFF(ssl_self_signed), 0, uf_boolean, 0, pf_boolean,
-    "<p>This enables the use of self signed X509 certificates.</p>" },
-    { LEAF("KeystoreFile"), 1, "keystore", ABSOFF(ssl_keystore), 0, uf_string, ff_free, pf_string,
-    "<p>The SSL/TLS key and certificate store file name. The keystore must be in PEM format.</p>" },
-    { LEAF("KeyPassphrase"), 1, "secret", ABSOFF(ssl_key_pass), 0, uf_string, ff_free, pf_string,
-    "<p>The SSL/TLS key pass phrase for encrypted keys.</p>" },
-    { LEAF("Ciphers"), 1, "ALL:!ADH:!LOW:!EXP:!MD5:@STRENGTH", ABSOFF(ssl_ciphers), 0, uf_string, ff_free, pf_string,
-    "<p>The set of ciphers used by SSL/TLS</p>" },
-    { LEAF("EntropyFile"), 1, "", ABSOFF(ssl_rand_file), 0, uf_string, ff_free, pf_string,
-    "<p>The SSL/TLS random entropy file name.</p>" },
-    { LEAF("MinimumTLSVersion"), 1, "1.3", ABSOFF(ssl_min_version), 0, uf_min_tls_version, 0, pf_min_tls_version,
-    "<p>The minimum TLS version that may be negotiated, valid values are 1.2 and 1.3.</p>" },
-    END_MARKER
+  { LEAF("Enable"), 1, "false", ABSOFF(ssl_enable), 0, uf_boolean, 0, pf_boolean,
+    BLURB("<p>This enables SSL/TLS for TCP.</p>") },
+  { LEAF("CertificateVerification"), 1, "true", ABSOFF(ssl_verify), 0, uf_boolean, 0, pf_boolean,
+    BLURB("<p>If disabled this allows SSL connections to occur even if an X509 certificate fails verification.</p>") },
+  { LEAF("VerifyClient"), 1, "true", ABSOFF(ssl_verify_client), 0, uf_boolean, 0, pf_boolean,
+    BLURB("<p>This enables an SSL server checking the X509 certificate of a connecting client.</p>") },
+  { LEAF("SelfSignedCertificates"), 1, "false", ABSOFF(ssl_self_signed), 0, uf_boolean, 0, pf_boolean,
+    BLURB("<p>This enables the use of self signed X509 certificates.</p>") },
+  { LEAF("KeystoreFile"), 1, "keystore", ABSOFF(ssl_keystore), 0, uf_string, ff_free, pf_string,
+    BLURB("<p>The SSL/TLS key and certificate store file name. The keystore must be in PEM format.</p>") },
+  { LEAF("KeyPassphrase"), 1, "secret", ABSOFF(ssl_key_pass), 0, uf_string, ff_free, pf_string,
+    BLURB("<p>The SSL/TLS key pass phrase for encrypted keys.</p>") },
+  { LEAF("Ciphers"), 1, "ALL:!ADH:!LOW:!EXP:!MD5:@STRENGTH", ABSOFF(ssl_ciphers), 0, uf_string, ff_free, pf_string,
+    BLURB("<p>The set of ciphers used by SSL/TLS</p>") },
+  { LEAF("EntropyFile"), 1, "", ABSOFF(ssl_rand_file), 0, uf_string, ff_free, pf_string,
+    BLURB("<p>The SSL/TLS random entropy file name.</p>") },
+  { LEAF("MinimumTLSVersion"), 1, "1.3", ABSOFF(ssl_min_version), 0, uf_min_tls_version, 0, pf_min_tls_version,
+    BLURB("<p>The minimum TLS version that may be negotiated, valid values are 1.2 and 1.3.</p>") },
+  END_MARKER
 };
 #endif
 
 static const struct cfgelem tp_cfgelems[] = {
-    { LEAF("Enable"), 1, "false", ABSOFF(tp_enable), 0, uf_boolean, 0, pf_boolean,
-    "<p>This element enables the optional thread pool.</p>" },
-    { LEAF("Threads"), 1, "4", ABSOFF(tp_threads), 0, uf_natint, 0, pf_int,
-    "<p>This elements configures the initial number of threads in the thread pool.</p>" },
-    { LEAF("ThreadMax"), 1, "8", ABSOFF(tp_max_threads), 0, uf_natint, 0, pf_int,
-    "<p>This elements configures the maximum number of threads in the thread pool.</p>" },
-    END_MARKER
+  { LEAF("Enable"), 1, "false", ABSOFF(tp_enable), 0, uf_boolean, 0, pf_boolean,
+    BLURB("<p>This element enables the optional thread pool.</p>") },
+  { LEAF("Threads"), 1, "4", ABSOFF(tp_threads), 0, uf_natint, 0, pf_int,
+    BLURB("<p>This elements configures the initial number of threads in the thread pool.</p>") },
+  { LEAF("ThreadMax"), 1, "8", ABSOFF(tp_max_threads), 0, uf_natint, 0, pf_int,
+    BLURB("<p>This elements configures the maximum number of threads in the thread pool.</p>") },
+  END_MARKER
 };
 
 static const struct cfgelem discovery_peer_cfgattrs[] = {
-    { ATTR("Address"), 1, NULL, RELOFF(config_peer_listelem, peer), 0, uf_ipv4, ff_free, pf_string,
-    "<p>This element specifies an IP address to which discovery packets must be sent, in addition to the default multicast address (see also General/AllowMulticast). Both a hostnames and a numerical IP address is accepted; the hostname or IP address may be suffixed with :PORT to explicitly set the port to which it must be sent. Multiple Peers may be specified.</p>" },
-    END_MARKER
+  { ATTR("Address"), 1, NULL, RELOFF(config_peer_listelem, peer), 0, uf_ipv4, ff_free, pf_string,
+    BLURB("<p>This element specifies an IP address to which discovery packets must be sent, in addition to the default multicast address (see also General/AllowMulticast). Both a hostnames and a numerical IP address is accepted; the hostname or IP address may be suffixed with :PORT to explicitly set the port to which it must be sent. Multiple Peers may be specified.</p>") },
+  END_MARKER
 };
 
 static const struct cfgelem discovery_peers_group_cfgelems[] = {
-    { MGROUP("Peer", NULL, discovery_peer_cfgattrs), 0, NULL, ABSOFF(peers_group), if_peer, 0, 0, 0,
-    "<p>This element statically configures an addresses for discovery.</p>" },
-    END_MARKER
+  { MGROUP("Peer", NULL, discovery_peer_cfgattrs), 0, NULL, ABSOFF(peers_group), if_peer, 0, 0, 0,
+    BLURB("<p>This element statically configures an addresses for discovery.</p>") },
+  END_MARKER
 };
 
 static const struct cfgelem discovery_peers_cfgelems[] = {
-    { MGROUP("Peer", NULL, discovery_peer_cfgattrs), 0, NULL, ABSOFF(peers), if_peer, 0, 0, 0,
-    "<p>This element statically configures an addresses for discovery.</p>" },
-    { GROUP("Group", discovery_peers_group_cfgelems),
-    "<p>This element statically configures a fault tolerant group of addresses for discovery. Each member of the group is tried in sequence until one succeeds.</p>" },
-    END_MARKER
+  { MGROUP("Peer", NULL, discovery_peer_cfgattrs), 0, NULL, ABSOFF(peers), if_peer, 0, 0, 0,
+    BLURB("<p>This element statically configures an addresses for discovery.</p>") },
+  { GROUP("Group", discovery_peers_group_cfgelems),
+    BLURB("<p>This element statically configures a fault tolerant group of addresses for discovery. Each member of the group is tried in sequence until one succeeds.</p>") },
+  END_MARKER
 };
 
 static const struct cfgelem discovery_cfgelems[] = {
-    { LEAF("AdvertiseBuiltinTopicWriters"), 1, "true", ABSOFF(advertise_builtin_topic_writers), 0, uf_boolean, 0, pf_boolean,
-    "<p>This element controls whether or not DDSI2E advertises writers for the built-in topics from its discovery for backwards compatibility with older OpenSplice versions.</p>" },
-    { LEAF("DSGracePeriod"), 1, "30 s", ABSOFF(ds_grace_period), 0, uf_duration_inf, 0, pf_duration,
-    "<p>This setting controls for how long endpoints discovered via a Cloud discovery service will survive after the discovery service disappeared, allowing reconnect without loss of data when the discovery service restarts (or another instance takes over).</p>" },
-    { GROUP("Peers", discovery_peers_cfgelems),
-    "<p>This element statically configures addresses for discovery.</p>" },
-    { LEAF("ParticipantIndex"), 1, "none", ABSOFF(participantIndex), 0, uf_participantIndex, 0, pf_participantIndex,
-    "<p>This element specifies the DDSI participant index used by this instance of the DDSI2E service for discovery purposes. Only one such participant id is used, independent of the number of actual DomainParticipants on the node. It is either:</p>\n\
+  { LEAF("DSGracePeriod"), 1, "30 s", ABSOFF(ds_grace_period), 0, uf_duration_inf, 0, pf_duration,
+    BLURB("<p>This setting controls for how long endpoints discovered via a Cloud discovery service will survive after the discovery service disappeared, allowing reconnect without loss of data when the discovery service restarts (or another instance takes over).</p>") },
+  { GROUP("Peers", discovery_peers_cfgelems),
+    BLURB("<p>This element statically configures addresses for discovery.</p>") },
+  { LEAF("ParticipantIndex"), 1, "none", ABSOFF(participantIndex), 0, uf_participantIndex, 0, pf_participantIndex,
+    BLURB("<p>This element specifies the DDSI participant index used by this instance of the DDSI2E service for discovery purposes. Only one such participant id is used, independent of the number of actual DomainParticipants on the node. It is either:</p>\n\
 <ul><li><i>auto</i>: which will attempt to automatically determine an available participant index (see also Discovery/MaxAutoParticipantIndex), or</li>\n \
 <li>a non-negative integer less than 120, or</li>\n\
 <li><i>none</i>:, which causes it to use arbitrary port numbers for unicast sockets which entirely removes the constraints on the participant index but makes unicast discovery impossible.</li></ul>\n\
-<p>The default is <i>auto</i>. The participant index is part of the port number calculation and if predictable port numbers are needed and fixing the participant index has no adverse effects, it is recommended that the second be option be used.</p>" },
-{ LEAF("MaxAutoParticipantIndex"), 1, "9", ABSOFF(maxAutoParticipantIndex), 0, uf_natint, 0, pf_int,
-"<p>This element specifies the maximum DDSI participant index selected by this instance of the DDSI2E service if the Discovery/ParticipantIndex is \"auto\".</p>" },
-{ LEAF("SPDPMulticastAddress"), 1, "239.255.0.1", ABSOFF(spdpMulticastAddressString), 0, uf_ipv4, ff_free, pf_string,
-"<p>This element specifies the multicast address that is used as the destination for the participant discovery packets. In IPv4 mode the default is the (standardised) 239.255.0.1, in IPv6 mode it becomes ff02::ffff:239.255.0.1, which is a non-standardised link-local multicast address.</p>" },
-{ LEAF("SPDPInterval"), 1, "30 s", ABSOFF(spdp_interval), 0, uf_duration_ms_1hr, 0, pf_duration,
-"<p>This element specifies the interval between spontaneous transmissions of participant discovery packets.</p>" },
-{ LEAF("DefaultMulticastAddress"), 1, "auto", ABSOFF(defaultMulticastAddressString), 0, uf_networkAddress, 0, pf_networkAddress,
-"<p>This element specifies the default multicast address for all traffic other than participant discovery packets. It defaults to Discovery/SPDPMulticastAddress.</p>" },
-{ LEAF("EnableTopicDiscovery"), 1, "true", ABSOFF(do_topic_discovery), 0, uf_boolean, 0, pf_boolean,
-"<p>Do not use.</p>" },
-{ GROUP("Ports", discovery_ports_cfgelems),
-"<p>The Ports element allows specifying various parameters related to the port numbers used for discovery. These all have default values specified by the DDSI 2.1 specification and rarely need to be changed.</p>" },
-END_MARKER
+<p>The default is <i>auto</i>. The participant index is part of the port number calculation and if predictable port numbers are needed and fixing the participant index has no adverse effects, it is recommended that the second be option be used.</p>") },
+  { LEAF("MaxAutoParticipantIndex"), 1, "9", ABSOFF(maxAutoParticipantIndex), 0, uf_natint, 0, pf_int,
+    BLURB("<p>This element specifies the maximum DDSI participant index selected by this instance of the DDSI2E service if the Discovery/ParticipantIndex is \"auto\".</p>") },
+  { LEAF("SPDPMulticastAddress"), 1, "239.255.0.1", ABSOFF(spdpMulticastAddressString), 0, uf_ipv4, ff_free, pf_string,
+    BLURB("<p>This element specifies the multicast address that is used as the destination for the participant discovery packets. In IPv4 mode the default is the (standardised) 239.255.0.1, in IPv6 mode it becomes ff02::ffff:239.255.0.1, which is a non-standardised link-local multicast address.</p>") },
+  { LEAF("SPDPInterval"), 1, "30 s", ABSOFF(spdp_interval), 0, uf_duration_ms_1hr, 0, pf_duration,
+    BLURB("<p>This element specifies the interval between spontaneous transmissions of participant discovery packets.</p>") },
+  { LEAF("DefaultMulticastAddress"), 1, "auto", ABSOFF(defaultMulticastAddressString), 0, uf_networkAddress, 0, pf_networkAddress,
+    BLURB("<p>This element specifies the default multicast address for all traffic other than participant discovery packets. It defaults to Discovery/SPDPMulticastAddress.</p>") },
+  { LEAF("EnableTopicDiscovery"), 1, "true", ABSOFF(do_topic_discovery), 0, uf_boolean, 0, pf_boolean,
+    BLURB("<p>Do not use.</p>") },
+  { GROUP("Ports", discovery_ports_cfgelems),
+    BLURB("<p>The Ports element allows specifying various parameters related to the port numbers used for discovery. These all have default values specified by the DDSI 2.1 specification and rarely need to be changed.</p>") },
+  END_MARKER
 };
 
 static const struct cfgelem tracing_cfgelems[] = {
-    { LEAF("EnableCategory"), 1, "", 0, 0, 0, uf_logcat, 0, pf_logcat,
-    "<p>This element enables individual logging categories. These are enabled in addition to those enabled by Tracing/Verbosity. Recognised categories are:</p>\n\
+  { LEAF("EnableCategory"), 1, "", 0, 0, 0, uf_logcat, 0, pf_logcat,
+    BLURB("<p>This element enables individual logging categories. These are enabled in addition to those enabled by Tracing/Verbosity. Recognised categories are:</p>\n\
 <ul><li><i>fatal</i>: all fatal errors, errors causing immediate termination</li>\n\
 <li><i>error</i>: failures probably impacting correctness but not necessarily causing immediate termination</li>\n\
 <li><i>warning</i>: abnormal situations that will likely not impact correctness</li>\n\
@@ -796,9 +766,9 @@ static const struct cfgelem tracing_cfgelems[] = {
 <li><i>topic</i>: tracing of topic definitions</li>\n\
 <li>>i>plist</i>: tracing of discovery parameter list interpretation</li> </ul>\n\
 <p>In addition, there is the keyword <i>trace</i> that enables all but <i>radmin</i>, <i>topic</i>, <i>plist</i> and <i>whc</i></p>.\n\
-<p>The categorisation of tracing output is incomplete and hence most of the verbosity levels and categories are not of much use in the current release. This is an ongoing process and here we describe the target situation rather than the current situation. Currently, the most useful is <i>trace</i>.</p>" },
-{ LEAF("Verbosity"), 1, "none", 0, 0, 0, uf_verbosity, 0, pf_nop,
-"<p>This element enables standard groups of categories, based on a desired verbosity level. This is in addition to the categories enabled by the Tracing/EnableCategory setting. Recognised verbosity levels and the categories they map to are:</p>\n\
+<p>The categorisation of tracing output is incomplete and hence most of the verbosity levels and categories are not of much use in the current release. This is an ongoing process and here we describe the target situation rather than the current situation. Currently, the most useful is <i>trace</i>.</p>") },
+  { LEAF("Verbosity"), 1, "none", 0, 0, 0, uf_verbosity, 0, pf_nop,
+    BLURB("<p>This element enables standard groups of categories, based on a desired verbosity level. This is in addition to the categories enabled by the Tracing/EnableCategory setting. Recognised verbosity levels and the categories they map to are:</p>\n\
 <ul><li><i>none</i>: no DDSI2E log</li>\n\
 <li><i>severe</i>: error and fatal</li>\n\
 <li><i>warning</i>: <i>severe</i> + warning</li>\n\
@@ -808,112 +778,74 @@ static const struct cfgelem tracing_cfgelems[] = {
 <li><i>finer</i>: <i>fine</i> + traffic and timing</li>\n\
 <li><i>finest</i>: <i>finer</i> + trace</li></ul>\n\
 <p>While <i>none</i> prevents any message from being written to a DDSI2 log file.</p>\n\
-<p>The categorisation of tracing output is incomplete and hence most of the verbosity levels and categories are not of much use in the current release. This is an ongoing process and here we describe the target situation rather than the current situation. Currently, the most useful verbosity levels are <i>config</i>, <i>fine</i> and <i>finest</i>.</p>" },
-{ LEAF("OutputFile"), 1, DDS_PROJECT_NAME_NOSPACE_SMALL".log", ABSOFF(tracingOutputFileName), 0, uf_tracingOutputFileName, ff_free, pf_string,
-"<p>This option specifies where the logging is printed to. Note that <i>stdout</i> and <i>stderr</i> are treated as special values, representing \"standard out\" and \"standard error\" respectively. No file is created unless logging categories are enabled using the Tracing/Verbosity or Tracing/EnabledCategory settings.</p>" },
-{ LEAF_W_ATTRS("Timestamps", timestamp_cfgattrs), 1, "true", ABSOFF(tracingTimestamps), 0, uf_boolean, 0, pf_boolean,
-"<p>This option has no effect.</p>" },
-{ LEAF("AppendToFile"), 1, "false", ABSOFF(tracingAppendToFile), 0, uf_boolean, 0, pf_boolean,
-"<p>This option specifies whether the output is to be appended to an existing log file. The default is to create a new log file each time, which is generally the best option if a detailed log is generated.</p>" },
-{ LEAF("PacketCaptureFile"), 1, "", ABSOFF(pcap_file), 0, uf_string, ff_free, pf_string,
-"<p>This option specifies the file to which received and sent packets will be logged in the \"pcap\" format suitable for analysis using common networking tools, such as WireShark. IP and UDP headers are ficitious, in particular the destination address of received packets. The TTL may be used to distinguish between sent and received packets: it is 255 for sent packets and 128 for received ones. Currently IPv4 only.</p>" },
-END_MARKER
-};
-
-static const struct cfgelem sched_prio_cfgattrs[] = {
-    { ATTR("priority_kind"), 1, "relative", ABSOFF(watchdog_sched_priority_class), 0, uf_sched_prio_class, 0, pf_sched_prio_class,
-    "<p>This attribute specifies whether the specified Priority is a relative or absolute priority.</p>" },
-    END_MARKER
-};
-
-static const struct cfgelem sched_cfgelems[] = {
-    { LEAF("Class"), 1, "default", ABSOFF(watchdog_sched_class), 0, uf_sched_class, 0, pf_sched_class,
-    "<p>This element specifies the thread scheduling class that will be used by the watchdog thread. The user may need the appropriate privileges from the underlying operating system to be able to assign some of the privileged scheduling classes.</p>" },
-    { LEAF_W_ATTRS("Priority", sched_prio_cfgattrs), 1, "0", ABSOFF(watchdog_sched_priority), 0, uf_int32, 0, pf_int32,
-    "<p>This element specifies the thread priority. Only priorities that are supported by the underlying operating system can be assigned to this element. The user may need special privileges from the underlying operating system to be able to assign some of the privileged priorities.</p>" },
-    END_MARKER
-};
-
-static const struct cfgelem watchdog_cfgelems[] = {
-    { GROUP("Scheduling", sched_cfgelems),
-    "<p>This element specifies the type of OS scheduling class will be used by the thread that announces its liveliness periodically.</p>" },
-    END_MARKER
+<p>The categorisation of tracing output is incomplete and hence most of the verbosity levels and categories are not of much use in the current release. This is an ongoing process and here we describe the target situation rather than the current situation. Currently, the most useful verbosity levels are <i>config</i>, <i>fine</i> and <i>finest</i>.</p>") },
+  { LEAF("OutputFile"), 1, DDS_PROJECT_NAME_NOSPACE_SMALL".log", ABSOFF(tracingOutputFileName), 0, uf_tracingOutputFileName, ff_free, pf_string,
+    BLURB("<p>This option specifies where the logging is printed to. Note that <i>stdout</i> and <i>stderr</i> are treated as special values, representing \"standard out\" and \"standard error\" respectively. No file is created unless logging categories are enabled using the Tracing/Verbosity or Tracing/EnabledCategory settings.</p>") },
+  { LEAF("AppendToFile"), 1, "false", ABSOFF(tracingAppendToFile), 0, uf_boolean, 0, pf_boolean,
+    BLURB("<p>This option specifies whether the output is to be appended to an existing log file. The default is to create a new log file each time, which is generally the best option if a detailed log is generated.</p>") },
+  { LEAF("PacketCaptureFile"), 1, "", ABSOFF(pcap_file), 0, uf_string, ff_free, pf_string,
+    BLURB("<p>This option specifies the file to which received and sent packets will be logged in the \"pcap\" format suitable for analysis using common networking tools, such as WireShark. IP and UDP headers are ficitious, in particular the destination address of received packets. The TTL may be used to distinguish between sent and received packets: it is 255 for sent packets and 128 for received ones. Currently IPv4 only.</p>") },
+  END_MARKER
 };
 
 static const struct cfgelem ddsi2_cfgelems[] = {
-    { GROUP("General", general_cfgelems),
-    "<p>The General element specifies overall DDSI2E service settings.</p>" },
+  { GROUP("General", general_cfgelems),
+    BLURB("<p>The General element specifies overall DDSI2E service settings.</p>") },
 #ifdef DDSI_INCLUDE_ENCRYPTION
-    { GROUP("Security", security_cfgelems),
-    "<p>The Security element specifies DDSI2E security profiles that can be used to encrypt traffic mapped to DDSI2E network partitions.</p>" },
+  { GROUP("Security", security_cfgelems),
+    BLURB("<p>The Security element specifies DDSI2E security profiles that can be used to encrypt traffic mapped to DDSI2E network partitions.</p>") },
 #endif
 #ifdef DDSI_INCLUDE_NETWORK_PARTITIONS
-    { GROUP("Partitioning", partitioning_cfgelems),
-    "<p>The Partitioning element specifies DDSI2E network partitions and how DCPS partition/topic combinations are mapped onto the network partitions.</p>" },
+  { GROUP("Partitioning", partitioning_cfgelems),
+    BLURB("<p>The Partitioning element specifies DDSI2E network partitions and how DCPS partition/topic combinations are mapped onto the network partitions.</p>") },
 #endif
 #ifdef DDSI_INCLUDE_NETWORK_CHANNELS
-    { GROUP("Channels", channels_cfgelems),
-    "<p>This element is used to group a set of channels. The channels are independent data paths through DDSI2E and by using separate threads and setting their priorities appropriately, chanenls can be used to map transport priorities to operating system scheduler priorities, ensuring system-wide end-to-end priority preservation.</p>" },
+  { GROUP("Channels", channels_cfgelems),
+    BLURB("<p>This element is used to group a set of channels. The channels are independent data paths through DDSI2E and by using separate threads and setting their priorities appropriately, chanenls can be used to map transport priorities to operating system scheduler priorities, ensuring system-wide end-to-end priority preservation.</p>") },
 #endif
-    { GROUP("Threads", threads_cfgelems),
-    "<p>This element is used to set thread properties.</p>" },
-    { GROUP("Sizing", sizing_cfgelems),
-    "<p>The Sizing element specifies a variety of configuration settings dealing with expected system sizes, buffer sizes, &c.</p>" },
-    { GROUP("Compatibility", compatibility_cfgelems),
-    "<p>The Compatibility elements allows specifying various settings related to compatability with standards and with other DDSI implementations.</p>" },
-    { GROUP("Discovery", discovery_cfgelems),
-    "<p>The Discovery element allows specifying various parameters related to the discovery of peers.</p>" },
-    { GROUP("Tracing", tracing_cfgelems),
-    "<p>The Tracing element controls the amount and type of information that is written into the tracing log by the DDSI service. This is useful to track the DDSI service during application development.</p>" },
-    { GROUP("Internal|Unsupported", unsupp_cfgelems),
-    "<p>The Internal elements deal with a variety of settings that evolving and that are not necessarily fully supported. For the vast majority of the Internal settings, the functionality per-se is supported, but the right to change the way the options control the functionality is reserved. This includes renaming or moving options.</p>" },
-    { GROUP("Watchdog", watchdog_cfgelems),
-    "<p>This element specifies the type of OS scheduling class will be used by the thread that announces its liveliness periodically.</p>" },
-    { GROUP("TCP", tcp_cfgelems),
-    "<p>The TCP element allows specifying various parameters related to running DDSI over TCP.</p>" },
-    { GROUP("ThreadPool", tp_cfgelems),
-    "<p>The ThreadPool element allows specifying various parameters related to using a thread pool to send DDSI messages to multiple unicast addresses (TCP or UDP).</p>" },
+  { GROUP("Threads", threads_cfgelems),
+    BLURB("<p>This element is used to set thread properties.</p>") },
+  { GROUP("Sizing", sizing_cfgelems),
+    BLURB("<p>The Sizing element specifies a variety of configuration settings dealing with expected system sizes, buffer sizes, &c.</p>") },
+  { GROUP("Compatibility", compatibility_cfgelems),
+    BLURB("<p>The Compatibility elements allows specifying various settings related to compatability with standards and with other DDSI implementations.</p>") },
+  { GROUP("Discovery", discovery_cfgelems),
+    BLURB("<p>The Discovery element allows specifying various parameters related to the discovery of peers.</p>") },
+  { GROUP("Tracing", tracing_cfgelems),
+    BLURB("<p>The Tracing element controls the amount and type of information that is written into the tracing log by the DDSI service. This is useful to track the DDSI service during application development.</p>") },
+  { GROUP("Internal|Unsupported", unsupp_cfgelems),
+    BLURB("<p>The Internal elements deal with a variety of settings that evolving and that are not necessarily fully supported. For the vast majority of the Internal settings, the functionality per-se is supported, but the right to change the way the options control the functionality is reserved. This includes renaming or moving options.</p>") },
+  { GROUP("TCP", tcp_cfgelems),
+    BLURB("<p>The TCP element allows specifying various parameters related to running DDSI over TCP.</p>") },
+  { GROUP("ThreadPool", tp_cfgelems),
+    BLURB("<p>The ThreadPool element allows specifying various parameters related to using a thread pool to send DDSI messages to multiple unicast addresses (TCP or UDP).</p>") },
 #ifdef DDSI_INCLUDE_SSL
-    { GROUP("SSL", ssl_cfgelems),
-    "<p>The SSL element allows specifying various parameters related to using SSL/TLS for DDSI over TCP.</p>" },
+  { GROUP("SSL", ssl_cfgelems),
+    BLURB("<p>The SSL element allows specifying various parameters related to using SSL/TLS for DDSI over TCP.</p>") },
 #endif
-    END_MARKER
-};
-
-static const struct cfgelem deprecated_lease_cfgelems[] = {
-  WILDCARD,
   END_MARKER
 };
 
 static const struct cfgelem domain_cfgelems[] = {
-    { LEAF("Id"), 1, "any", ABSOFF(domainId), 0, uf_domainId, 0, pf_domainId, NULL },
-    { GROUP("|Lease", deprecated_lease_cfgelems), NULL },
-    END_MARKER
-};
-
-static const struct cfgelem durability_cfgelems[] = {
-    { LEAF("Encoding"), 1, "CDR_CLIENT", ABSOFF(durability_cdr), 0, uf_durability_cdr, 0, pf_durability_cdr, NULL },
-    END_MARKER
+  { LEAF("Id"), 1, "any", ABSOFF(domainId), 0, uf_domainId, 0, pf_domainId, NULL },
+  END_MARKER
 };
 
 static const struct cfgelem root_cfgelems[] = {
-    { "Domain", domain_cfgelems, NULL, NODATA, NULL },
-    { "DDSI2E|DDSI2", ddsi2_cfgelems, NULL, NODATA,
-    "<p>DDSI2 settings ...</p>" },
-    { "Durability", durability_cfgelems, NULL, NODATA, NULL },
-    { GROUP("|Lease", deprecated_lease_cfgelems), NULL },
-    END_MARKER
+  { "Domain", domain_cfgelems, NULL, NODATA, NULL },
+  { "DDSI2E|DDSI2", ddsi2_cfgelems, NULL, NODATA,
+    BLURB("<p>DDSI2 settings ...</p>") },
+  END_MARKER
 };
 
-static const struct cfgelem cyclonedds_root_cfgelems[] =
-{
-    { DDS_PROJECT_NAME_NOSPACE, root_cfgelems, NULL, NODATA, NULL },
-    END_MARKER
+static const struct cfgelem cyclonedds_root_cfgelems[] = {
+  { DDS_PROJECT_NAME_NOSPACE, root_cfgelems, NULL, NODATA, NULL },
+  END_MARKER
 };
 
-static const struct cfgelem root_cfgelem =
-{ "root", cyclonedds_root_cfgelems, NULL, NODATA, NULL };
-
+static const struct cfgelem root_cfgelem = {
+  "root", cyclonedds_root_cfgelems, NULL, NODATA, NULL
+};
 
 #undef ATTR
 #undef GROUP
@@ -930,401 +862,390 @@ struct config config;
 struct ddsi_plugin ddsi_plugin;
 
 static const struct unit unittab_duration[] = {
-    { "ns", 1 },
-    { "us", 1000 },
-    { "ms", T_MILLISECOND },
-    { "s", T_SECOND },
-    { "min", 60 * T_SECOND },
-    { "hr", 3600 * T_SECOND },
-    { "day", 24 * 3600 * T_SECOND },
-    { NULL, 0 }
+  { "ns", 1 },
+  { "us", 1000 },
+  { "ms", T_MILLISECOND },
+  { "s", T_SECOND },
+  { "min", 60 * T_SECOND },
+  { "hr", 3600 * T_SECOND },
+  { "day", 24 * 3600 * T_SECOND },
+  { NULL, 0 }
 };
 
 /* note: order affects whether printed as KiB or kB, for consistency
-with bandwidths and pedanticness, favour KiB. */
+   with bandwidths and pedanticness, favour KiB. */
 static const struct unit unittab_memsize[] = {
-    { "B", 1 },
-    { "KiB", 1024 },
-    { "kB", 1024 },
-    { "MiB", 1048576 },
-    { "MB", 1048576 },
-    { "GiB", 1073741824 },
-    { "GB", 1073741824 },
-    { NULL, 0 }
+  { "B", 1 },
+  { "KiB", 1024 },
+  { "kB", 1024 },
+  { "MiB", 1048576 },
+  { "MB", 1048576 },
+  { "GiB", 1073741824 },
+  { "GB", 1073741824 },
+  { NULL, 0 }
 };
 
 #ifdef DDSI_INCLUDE_BANDWIDTH_LIMITING
 static const struct unit unittab_bandwidth_bps[] = {
-    { "b/s", 1 },{ "bps", 1 },
-    { "Kib/s", 1024 },{ "Kibps", 1024 },
-    { "kb/s", 1000 },{ "kbps", 1000 },
-    { "Mib/s", 1048576 },{ "Mibps", 1000 },
-    { "Mb/s", 1000000 },{ "Mbps", 1000000 },
-    { "Gib/s", 1073741824 },{ "Gibps", 1073741824 },
-    { "Gb/s", 1000000000 },{ "Gbps", 1000000000 },
-    { "B/s", 8 },{ "Bps", 8 },
-    { "KiB/s", 8 * 1024 },{ "KiBps", 8 * 1024 },
-    { "kB/s", 8 * 1000 },{ "kBps", 8 * 1000 },
-    { "MiB/s", 8 * 1048576 },{ "MiBps", 8 * 1048576 },
-    { "MB/s", 8 * 1000000 },{ "MBps", 8 * 1000000 },
-    { "GiB/s", 8 * (int64_t) 1073741824 },{ "GiBps", 8 * (int64_t) 1073741824 },
-    { "GB/s", 8 * (int64_t) 1000000000 },{ "GBps", 8 * (int64_t) 1000000000 },
-    { NULL, 0 }
+  { "b/s", 1 },{ "bps", 1 },
+  { "Kib/s", 1024 },{ "Kibps", 1024 },
+  { "kb/s", 1000 },{ "kbps", 1000 },
+  { "Mib/s", 1048576 },{ "Mibps", 1000 },
+  { "Mb/s", 1000000 },{ "Mbps", 1000000 },
+  { "Gib/s", 1073741824 },{ "Gibps", 1073741824 },
+  { "Gb/s", 1000000000 },{ "Gbps", 1000000000 },
+  { "B/s", 8 },{ "Bps", 8 },
+  { "KiB/s", 8 * 1024 },{ "KiBps", 8 * 1024 },
+  { "kB/s", 8 * 1000 },{ "kBps", 8 * 1000 },
+  { "MiB/s", 8 * 1048576 },{ "MiBps", 8 * 1048576 },
+  { "MB/s", 8 * 1000000 },{ "MBps", 8 * 1000000 },
+  { "GiB/s", 8 * (int64_t) 1073741824 },{ "GiBps", 8 * (int64_t) 1073741824 },
+  { "GB/s", 8 * (int64_t) 1000000000 },{ "GBps", 8 * (int64_t) 1000000000 },
+  { NULL, 0 }
 };
 
 static const struct unit unittab_bandwidth_Bps[] = {
-    { "B/s", 1 },{ "Bps", 1 },
-    { "KiB/s", 1024 },{ "KiBps", 1024 },
-    { "kB/s", 1000 },{ "kBps", 1000 },
-    { "MiB/s", 1048576 },{ "MiBps", 1048576 },
-    { "MB/s", 1000000 },{ "MBps", 1000000 },
-    { "GiB/s", 1073741824 },{ "GiBps", 1073741824 },
-    { "GB/s", 1000000000 },{ "GBps", 1000000000 },
-    { NULL, 0 }
+  { "B/s", 1 },{ "Bps", 1 },
+  { "KiB/s", 1024 },{ "KiBps", 1024 },
+  { "kB/s", 1000 },{ "kBps", 1000 },
+  { "MiB/s", 1048576 },{ "MiBps", 1048576 },
+  { "MB/s", 1000000 },{ "MBps", 1000000 },
+  { "GiB/s", 1073741824 },{ "GiBps", 1073741824 },
+  { "GB/s", 1000000000 },{ "GBps", 1000000000 },
+  { NULL, 0 }
 };
 #endif
 
 static void cfgst_push(struct cfgst *cfgst, int isattr, const struct cfgelem *elem, void *parent)
 {
-    assert(cfgst->path_depth < MAX_PATH_DEPTH);
-    assert(isattr == 0 || isattr == 1);
-    cfgst->isattr[cfgst->path_depth] = isattr;
-    cfgst->path[cfgst->path_depth] = elem;
-    cfgst->parent[cfgst->path_depth] = parent;
-    cfgst->path_depth++;
+  assert(cfgst->path_depth < MAX_PATH_DEPTH);
+  assert(isattr == 0 || isattr == 1);
+  cfgst->isattr[cfgst->path_depth] = isattr;
+  cfgst->path[cfgst->path_depth] = elem;
+  cfgst->parent[cfgst->path_depth] = parent;
+  cfgst->path_depth++;
 }
 
 static void cfgst_pop(struct cfgst *cfgst)
 {
-    assert(cfgst->path_depth > 0);
-    cfgst->path_depth--;
+  assert(cfgst->path_depth > 0);
+  cfgst->path_depth--;
 }
 
 static const struct cfgelem *cfgst_tos(const struct cfgst *cfgst)
 {
-    assert(cfgst->path_depth > 0);
-    return cfgst->path[cfgst->path_depth - 1];
+  assert(cfgst->path_depth > 0);
+  return cfgst->path[cfgst->path_depth - 1];
 }
 
 static void *cfgst_parent(const struct cfgst *cfgst)
 {
-    assert(cfgst->path_depth > 0);
-    return cfgst->parent[cfgst->path_depth - 1];
+  assert(cfgst->path_depth > 0);
+  return cfgst->parent[cfgst->path_depth - 1];
 }
 
 struct cfg_note_buf {
-    size_t bufpos;
-    size_t bufsize;
-    char *buf;
+  size_t bufpos;
+  size_t bufsize;
+  char *buf;
 };
 
 static size_t cfg_note_vsnprintf(struct cfg_note_buf *bb, const char *fmt, va_list ap)
 {
-    int x;
-    x = vsnprintf(bb->buf + bb->bufpos, bb->bufsize - bb->bufpos, fmt, ap);
-    if ( x >= 0 && (size_t) x >= bb->bufsize - bb->bufpos ) {
-        size_t nbufsize = ((bb->bufsize + (size_t) x + 1) + 1023) & (size_t) (-1024);
-        char *nbuf = ddsrt_realloc(bb->buf, nbufsize);
-        bb->buf = nbuf;
-        bb->bufsize = nbufsize;
-        return nbufsize;
-    }
-    if ( x < 0 )
-        DDS_FATAL("cfg_note_vsnprintf: vsnprintf failed\n");
-    else
-        bb->bufpos += (size_t) x;
-    return 0;
+  int x;
+  x = vsnprintf(bb->buf + bb->bufpos, bb->bufsize - bb->bufpos, fmt, ap);
+  if ( x >= 0 && (size_t) x >= bb->bufsize - bb->bufpos ) {
+    size_t nbufsize = ((bb->bufsize + (size_t) x + 1) + 1023) & (size_t) (-1024);
+    char *nbuf = ddsrt_realloc(bb->buf, nbufsize);
+    bb->buf = nbuf;
+    bb->bufsize = nbufsize;
+    return nbufsize;
+  }
+  if ( x < 0 )
+    DDS_FATAL("cfg_note_vsnprintf: vsnprintf failed\n");
+  else
+    bb->bufpos += (size_t) x;
+  return 0;
 }
 
 static void cfg_note_snprintf(struct cfg_note_buf *bb, const char *fmt, ...)
 {
-    /* The reason the 2nd call to os_vsnprintf is here and not inside
-    cfg_note_vsnprintf is because I somehow doubt that all platforms
-    implement va_copy() */
-    va_list ap;
-    size_t r;
+  /* The reason the 2nd call to os_vsnprintf is here and not inside
+     cfg_note_vsnprintf is because I somehow doubt that all platforms
+     implement va_copy() */
+  va_list ap;
+  size_t r;
+  va_start(ap, fmt);
+  r = cfg_note_vsnprintf(bb, fmt, ap);
+  va_end(ap);
+  if ( r > 0 ) {
+    int s;
     va_start(ap, fmt);
-    r = cfg_note_vsnprintf(bb, fmt, ap);
+    s = vsnprintf(bb->buf + bb->bufpos, bb->bufsize - bb->bufpos, fmt, ap);
+    if ( s < 0 || (size_t) s >= bb->bufsize - bb->bufpos )
+      DDS_FATAL("cfg_note_snprintf: vsnprintf failed\n");
     va_end(ap);
-    if ( r > 0 ) {
-        int s;
-        va_start(ap, fmt);
-        s = vsnprintf(bb->buf + bb->bufpos, bb->bufsize - bb->bufpos, fmt, ap);
-        if ( s < 0 || (size_t) s >= bb->bufsize - bb->bufpos )
-            DDS_FATAL("cfg_note_snprintf: vsnprintf failed\n");
-        va_end(ap);
-        bb->bufpos += (size_t) s;
-    }
+    bb->bufpos += (size_t) s;
+  }
 }
 
 static size_t cfg_note(struct cfgst *cfgst, uint32_t cat, size_t bsz, const char *fmt, va_list ap)
 {
-    /* Have to snprintf our way to a single string so we can OS_REPORT
-    as well as nn_log.  Otherwise configuration errors will be lost
-    completely on platforms where stderr doesn't actually work for
-    outputting error messages (this includes Windows because of the
-    way "ospl start" does its thing). */
-    struct cfg_note_buf bb;
-    int i, sidx;
-    size_t r;
+  /* Have to snprintf our way to a single string so we can OS_REPORT
+     as well as nn_log.  Otherwise configuration errors will be lost
+     completely on platforms where stderr doesn't actually work for
+     outputting error messages (this includes Windows because of the
+     way "ospl start" does its thing). */
+  struct cfg_note_buf bb;
+  int i, sidx;
+  size_t r;
 
-    if (cat & DDS_LC_ERROR) {
-        cfgst->error = 1;
-    }
-
-    bb.bufpos = 0;
-    bb.bufsize = (bsz == 0) ? 1024 : bsz;
-    if ( (bb.buf = ddsrt_malloc(bb.bufsize)) == NULL )
-        DDS_FATAL("cfg_note: out of memory\n");
-
-    cfg_note_snprintf(&bb, "config: ");
-
-    /* Path to element/attribute causing the error. Have to stop once an
-    attribute is reached: a NULL marker may have been pushed onto the
-    stack afterward in the default handling. */
-    sidx = 0;
-    while ( sidx < cfgst->path_depth && cfgst->path[sidx]->name == NULL )
-        sidx++;
-    for ( i = sidx; i < cfgst->path_depth && (i == sidx || !cfgst->isattr[i - 1]); i++ ) {
-        if ( cfgst->path[i] == NULL ) {
-            assert(i > sidx);
-            cfg_note_snprintf(&bb, "/#text");
-        } else if ( cfgst->isattr[i] ) {
-            cfg_note_snprintf(&bb, "[@%s]", cfgst->path[i]->name);
-        } else {
-            const char *p = strchr(cfgst->path[i]->name, '|');
-            int n = p ? (int) (p - cfgst->path[i]->name) : (int) strlen(cfgst->path[i]->name);
-            cfg_note_snprintf(&bb, "%s%*.*s", (i == sidx) ? "" : "/", n, n, cfgst->path[i]->name);
-        }
-    }
-
-    cfg_note_snprintf(&bb, ": ");
-    if ( (r = cfg_note_vsnprintf(&bb, fmt, ap)) > 0 ) {
-        /* Can't reset ap ... and va_copy isn't widely available - so
-        instead abort and hope the caller tries again with a larger
-        initial buffer */
-        ddsrt_free(bb.buf);
-        return r;
-    }
-
-    switch ( cat ) {
-        case DDS_LC_CONFIG:
-            DDS_LOG(cat, "%s\n", bb.buf);
-            break;
-        case DDS_LC_WARNING:
-            DDS_WARNING("%s\n", bb.buf);
-            break;
-        case DDS_LC_ERROR:
-            DDS_ERROR("%s\n", bb.buf);
-            break;
-        default:
-            DDS_FATAL("cfg_note unhandled category %u for message %s\n", (unsigned) cat, bb.buf);
-            break;
+  if (cat & DDS_LC_ERROR) {
+    cfgst->error = 1;
+  }
+
+  bb.bufpos = 0;
+  bb.bufsize = (bsz == 0) ? 1024 : bsz;
+  if ( (bb.buf = ddsrt_malloc(bb.bufsize)) == NULL )
+    DDS_FATAL("cfg_note: out of memory\n");
+
+  cfg_note_snprintf(&bb, "config: ");
+
+  /* Path to element/attribute causing the error. Have to stop once an
+     attribute is reached: a NULL marker may have been pushed onto the
+     stack afterward in the default handling. */
+  sidx = 0;
+  while ( sidx < cfgst->path_depth && cfgst->path[sidx]->name == NULL )
+    sidx++;
+  for ( i = sidx; i < cfgst->path_depth && (i == sidx || !cfgst->isattr[i - 1]); i++ ) {
+    if ( cfgst->path[i] == NULL ) {
+      assert(i > sidx);
+      cfg_note_snprintf(&bb, "/#text");
+    } else if ( cfgst->isattr[i] ) {
+      cfg_note_snprintf(&bb, "[@%s]", cfgst->path[i]->name);
+    } else {
+      const char *p = strchr(cfgst->path[i]->name, '|');
+      int n = p ? (int) (p - cfgst->path[i]->name) : (int) strlen(cfgst->path[i]->name);
+      cfg_note_snprintf(&bb, "%s%*.*s", (i == sidx) ? "" : "/", n, n, cfgst->path[i]->name);
     }
+  }
 
+  cfg_note_snprintf(&bb, ": ");
+  if ( (r = cfg_note_vsnprintf(&bb, fmt, ap)) > 0 ) {
+    /* Can't reset ap ... and va_copy isn't widely available - so
+       instead abort and hope the caller tries again with a larger
+       initial buffer */
     ddsrt_free(bb.buf);
-    return 0;
+    return r;
+  }
+
+  switch ( cat ) {
+    case DDS_LC_CONFIG:
+      DDS_LOG(cat, "%s\n", bb.buf);
+      break;
+    case DDS_LC_WARNING:
+      DDS_WARNING("%s\n", bb.buf);
+      break;
+    case DDS_LC_ERROR:
+      DDS_ERROR("%s\n", bb.buf);
+      break;
+    default:
+      DDS_FATAL("cfg_note unhandled category %u for message %s\n", (unsigned) cat, bb.buf);
+      break;
+  }
+
+  ddsrt_free(bb.buf);
+  return 0;
 }
 
 #if WARN_DEPRECATED_ALIAS || WARN_DEPRECATED_UNIT
 static void cfg_warning(struct cfgst *cfgst, const char *fmt, ...)
 {
-    va_list ap;
-    size_t bsz = 0;
-    do {
-        va_start(ap, fmt);
-        bsz = cfg_note(cfgst, DDS_LC_WARNING, bsz, fmt, ap);
-        va_end(ap);
-    } while ( bsz > 0 );
+  va_list ap;
+  size_t bsz = 0;
+  do {
+    va_start(ap, fmt);
+    bsz = cfg_note(cfgst, DDS_LC_WARNING, bsz, fmt, ap);
+    va_end(ap);
+  } while ( bsz > 0 );
 }
 #endif
 
 static int cfg_error(struct cfgst *cfgst, const char *fmt, ...)
 {
-    va_list ap;
-    size_t bsz = 0;
-    do {
-        va_start(ap, fmt);
-        bsz = cfg_note(cfgst, DDS_LC_ERROR, bsz, fmt, ap);
-        va_end(ap);
-    } while ( bsz > 0 );
-    return 0;
+  va_list ap;
+  size_t bsz = 0;
+  do {
+    va_start(ap, fmt);
+    bsz = cfg_note(cfgst, DDS_LC_ERROR, bsz, fmt, ap);
+    va_end(ap);
+  } while ( bsz > 0 );
+  return 0;
 }
 
 static int cfg_log(struct cfgst *cfgst, const char *fmt, ...)
 {
-    va_list ap;
-    size_t bsz = 0;
-    do {
-        va_start(ap, fmt);
-        bsz = cfg_note(cfgst, DDS_LC_CONFIG, bsz, fmt, ap);
-        va_end(ap);
-    } while ( bsz > 0 );
-    return 0;
+  va_list ap;
+  size_t bsz = 0;
+  do {
+    va_start(ap, fmt);
+    bsz = cfg_note(cfgst, DDS_LC_CONFIG, bsz, fmt, ap);
+    va_end(ap);
+  } while ( bsz > 0 );
+  return 0;
 }
 
 static int list_index(const char *list[], const char *elem)
 {
-    int i;
-    for ( i = 0; list[i] != NULL; i++ ) {
-        if ( ddsrt_strcasecmp(list[i], elem) == 0 )
-            return i;
-    }
-    return -1;
+  int i;
+  for ( i = 0; list[i] != NULL; i++ ) {
+    if ( ddsrt_strcasecmp(list[i], elem) == 0 )
+      return i;
+  }
+  return -1;
 }
 
 static int64_t lookup_multiplier(struct cfgst *cfgst, const struct unit *unittab, const char *value, int unit_pos, int value_is_zero, int64_t def_mult, int err_on_unrecognised)
 {
-    assert(0 <= unit_pos && (size_t) unit_pos <= strlen(value));
-    while ( value[unit_pos] == ' ' )
-        unit_pos++;
-    if ( value[unit_pos] == 0 ) {
-        if ( value_is_zero ) {
-            /* No matter what unit, 0 remains just that.  For convenience,
-            always allow 0 to be specified without a unit */
-            return 1;
-        } else if ( def_mult == 0 && err_on_unrecognised ) {
-            cfg_error(cfgst, "%s: unit is required", value);
-            return 0;
-        } else {
-#if WARN_DEPRECATED_UNIT
-            cfg_warning(cfgst, "%s: use of default unit is deprecated", value);
-#endif
-            return def_mult;
-        }
+  assert(0 <= unit_pos && (size_t) unit_pos <= strlen(value));
+  while ( value[unit_pos] == ' ' )
+    unit_pos++;
+  if ( value[unit_pos] == 0 ) {
+    if ( value_is_zero ) {
+      /* No matter what unit, 0 remains just that.  For convenience,
+         always allow 0 to be specified without a unit */
+      return 1;
+    } else if ( def_mult == 0 && err_on_unrecognised ) {
+      cfg_error(cfgst, "%s: unit is required", value);
+      return 0;
     } else {
-        int i;
-        for ( i = 0; unittab[i].name != NULL; i++ ) {
-            if ( strcmp(unittab[i].name, value + unit_pos) == 0 )
-                return unittab[i].multiplier;
-        }
-        if ( err_on_unrecognised )
-            cfg_error(cfgst, "%s: unrecognised unit", value + unit_pos);
-        return 0;
+#if WARN_DEPRECATED_UNIT
+      cfg_warning(cfgst, "%s: use of default unit is deprecated", value);
+#endif
+      return def_mult;
     }
+  } else {
+    int i;
+    for ( i = 0; unittab[i].name != NULL; i++ ) {
+      if ( strcmp(unittab[i].name, value + unit_pos) == 0 )
+        return unittab[i].multiplier;
+    }
+    if ( err_on_unrecognised )
+      cfg_error(cfgst, "%s: unrecognised unit", value + unit_pos);
+    return 0;
+  }
 }
 
 static void *cfg_address(UNUSED_ARG(struct cfgst *cfgst), void *parent, struct cfgelem const * const cfgelem)
 {
-    assert(cfgelem->multiplicity == 1);
-    return (char *) parent + cfgelem->elem_offset;
+  assert(cfgelem->multiplicity == 1);
+  return (char *) parent + cfgelem->elem_offset;
 }
 
 static void *cfg_deref_address(UNUSED_ARG(struct cfgst *cfgst), void *parent, struct cfgelem const * const cfgelem)
 {
-    assert(cfgelem->multiplicity != 1);
-    return *((void **) ((char *) parent + cfgelem->elem_offset));
+  assert(cfgelem->multiplicity != 1);
+  return *((void **) ((char *) parent + cfgelem->elem_offset));
 }
 
 static void *if_common(UNUSED_ARG(struct cfgst *cfgst), void *parent, struct cfgelem const * const cfgelem, unsigned size)
 {
-    struct config_listelem **current = (struct config_listelem **) ((char *) parent + cfgelem->elem_offset);
-    struct config_listelem *new = ddsrt_malloc(size);
-    new->next = *current;
-    *current = new;
-    return new;
+  struct config_listelem **current = (struct config_listelem **) ((char *) parent + cfgelem->elem_offset);
+  struct config_listelem *new = ddsrt_malloc(size);
+  new->next = *current;
+  *current = new;
+  return new;
 }
 
 static int if_thread_properties(struct cfgst *cfgst, void *parent, struct cfgelem const * const cfgelem)
 {
-    struct config_thread_properties_listelem *new = if_common(cfgst, parent, cfgelem, sizeof(*new));
-    if ( new == NULL )
-        return -1;
-    new->name = NULL;
-    return 0;
+  struct config_thread_properties_listelem *new = if_common(cfgst, parent, cfgelem, sizeof(*new));
+  if ( new == NULL )
+    return -1;
+  new->name = NULL;
+  return 0;
 }
 
 #ifdef DDSI_INCLUDE_NETWORK_CHANNELS
 static int if_channel(struct cfgst *cfgst, void *parent, struct cfgelem const * const cfgelem)
 {
-    struct config_channel_listelem *new = if_common(cfgst, parent, cfgelem, sizeof(*new));
-    if ( new == NULL )
-        return -1;
-    new->name = NULL;
-    new->channel_reader_ts = NULL;
-    new->dqueue = NULL;
-    new->queueId = 0;
-    new->evq = NULL;
-    new->transmit_conn = NULL;
-    return 0;
+  struct config_channel_listelem *new = if_common(cfgst, parent, cfgelem, sizeof(*new));
+  if ( new == NULL )
+    return -1;
+  new->name = NULL;
+  new->channel_reader_ts = NULL;
+  new->dqueue = NULL;
+  new->queueId = 0;
+  new->evq = NULL;
+  new->transmit_conn = NULL;
+  return 0;
 }
 #endif /* DDSI_INCLUDE_NETWORK_CHANNELS */
 
 #ifdef DDSI_INCLUDE_ENCRYPTION
 static int if_security_profile(struct cfgst *cfgst, void *parent, struct cfgelem const * const cfgelem)
 {
-    if ( if_common(cfgst, parent, cfgelem, sizeof(struct config_securityprofile_listelem)) == NULL )
-        return -1;
-    return 0;
+  if ( if_common(cfgst, parent, cfgelem, sizeof(struct config_securityprofile_listelem)) == NULL )
+    return -1;
+  return 0;
 }
 #endif /* DDSI_INCLUDE_ENCRYPTION */
 
 #ifdef DDSI_INCLUDE_NETWORK_PARTITIONS
 static int if_network_partition(struct cfgst *cfgst, void *parent, struct cfgelem const * const cfgelem)
 {
-    struct config_networkpartition_listelem *new = if_common(cfgst, parent, cfgelem, sizeof(*new));
-    if ( new == NULL )
-        return -1;
-    new->address_string = NULL;
+  struct config_networkpartition_listelem *new = if_common(cfgst, parent, cfgelem, sizeof(*new));
+  if ( new == NULL )
+    return -1;
+  new->address_string = NULL;
 #ifdef DDSI_INCLUDE_ENCRYPTION
-    new->profileName = NULL;
-    new->securityProfile = NULL;
+  new->profileName = NULL;
+  new->securityProfile = NULL;
 #endif /* DDSI_INCLUDE_ENCRYPTION */
-    return 0;
+  return 0;
 }
 
 static int if_ignored_partition(struct cfgst *cfgst, void *parent, struct cfgelem const * const cfgelem)
 {
-    if ( if_common(cfgst, parent, cfgelem, sizeof(struct config_ignoredpartition_listelem)) == NULL )
-        return -1;
-    return 0;
+  if ( if_common(cfgst, parent, cfgelem, sizeof(struct config_ignoredpartition_listelem)) == NULL )
+    return -1;
+  return 0;
 }
 
 static int if_partition_mapping(struct cfgst *cfgst, void *parent, struct cfgelem const * const cfgelem)
 {
-    if ( if_common(cfgst, parent, cfgelem, sizeof(struct config_partitionmapping_listelem)) == NULL )
-        return -1;
-    return 0;
+  if ( if_common(cfgst, parent, cfgelem, sizeof(struct config_partitionmapping_listelem)) == NULL )
+    return -1;
+  return 0;
 }
 #endif /* DDSI_INCLUDE_NETWORK_PARTITIONS */
 
 static int if_peer(struct cfgst *cfgst, void *parent, struct cfgelem const * const cfgelem)
 {
-    struct config_peer_listelem *new = if_common(cfgst, parent, cfgelem, sizeof(struct config_peer_listelem));
-    if ( new == NULL )
-        return -1;
-    new->peer = NULL;
-    return 0;
+  struct config_peer_listelem *new = if_common(cfgst, parent, cfgelem, sizeof(struct config_peer_listelem));
+  if ( new == NULL )
+    return -1;
+  new->peer = NULL;
+  return 0;
 }
 
 static void ff_free(struct cfgst *cfgst, void *parent, struct cfgelem const * const cfgelem)
 {
-    void **elem = cfg_address(cfgst, parent, cfgelem);
-    ddsrt_free(*elem);
+  void **elem = cfg_address(cfgst, parent, cfgelem);
+  ddsrt_free(*elem);
 }
 
 static int uf_boolean(struct cfgst *cfgst, void *parent, struct cfgelem const * const cfgelem, UNUSED_ARG(int first), const char *value)
 {
-    static const char *vs[] = { "false", "true", NULL };
-    int *elem = cfg_address(cfgst, parent, cfgelem);
-    int idx = list_index(vs, value);
-    if ( idx < 0 )
-        return cfg_error(cfgst, "'%s': undefined value", value);
-    else {
-        *elem = idx;
-        return 1;
-    }
-}
-
-static int uf_negated_boolean(struct cfgst *cfgst, void *parent, struct cfgelem const * const cfgelem, int first, const char *value)
-{
-    if ( !uf_boolean(cfgst, parent, cfgelem, first, value) )
-        return 0;
-    else {
-        int *elem = cfg_address(cfgst, parent, cfgelem);
-        *elem = !*elem;
-        return 1;
-    }
+  static const char *vs[] = { "false", "true", NULL };
+  int *elem = cfg_address(cfgst, parent, cfgelem);
+  int idx = list_index(vs, value);
+  if ( idx < 0 )
+    return cfg_error(cfgst, "'%s': undefined value", value);
+  else {
+    *elem = idx;
+    return 1;
+  }
 }
 
 static int uf_boolean_default (struct cfgst *cfgst, void *parent, struct cfgelem const * const cfgelem, UNUSED_ARG (int first), const char *value)
@@ -1359,78 +1280,78 @@ static void pf_boolean_default (struct cfgst *cfgst, void *parent, struct cfgele
 
 static int do_uint32_bitset(struct cfgst *cfgst, uint32_t *cats, const char **names, const uint32_t *codes, const char *value)
 {
-    char *copy = ddsrt_strdup(value), *cursor = copy, *tok;
-    while ( (tok = ddsrt_strsep(&cursor, ",")) != NULL ) {
-        int idx = list_index(names, tok);
-        if ( idx < 0 ) {
-            int ret = cfg_error(cfgst, "'%s' in '%s' undefined", tok, value);
-            ddsrt_free(copy);
-            return ret;
-        }
-        *cats |= codes[idx];
+  char *copy = ddsrt_strdup(value), *cursor = copy, *tok;
+  while ( (tok = ddsrt_strsep(&cursor, ",")) != NULL ) {
+    int idx = list_index(names, tok);
+    if ( idx < 0 ) {
+      int ret = cfg_error(cfgst, "'%s' in '%s' undefined", tok, value);
+      ddsrt_free(copy);
+      return ret;
     }
-    ddsrt_free(copy);
-    return 1;
+    *cats |= codes[idx];
+  }
+  ddsrt_free(copy);
+  return 1;
 }
 
 static int uf_logcat(struct cfgst *cfgst, UNUSED_ARG(void *parent), UNUSED_ARG(struct cfgelem const * const cfgelem), UNUSED_ARG(int first), const char *value)
 {
-    return do_uint32_bitset (cfgst, &enabled_logcats, logcat_names, logcat_codes, value);
+  return do_uint32_bitset (cfgst, &enabled_logcats, logcat_names, logcat_codes, value);
 }
 
 static int uf_xcheck(struct cfgst *cfgst, void *parent, struct cfgelem const * const cfgelem, UNUSED_ARG(int first), const char *value)
 {
-    uint32_t *elem = cfg_address(cfgst, parent, cfgelem);
-    return do_uint32_bitset (cfgst, elem, xcheck_names, xcheck_codes, value);
+  uint32_t *elem = cfg_address(cfgst, parent, cfgelem);
+  return do_uint32_bitset (cfgst, elem, xcheck_names, xcheck_codes, value);
 }
 
 static int uf_verbosity(struct cfgst *cfgst, UNUSED_ARG(void *parent), UNUSED_ARG(struct cfgelem const * const cfgelem), UNUSED_ARG(int first), const char *value)
 {
-    static const char *vs[] = {
-        "finest", "finer", "fine", "config", "info", "warning", "severe", "none", NULL
-    };
-    static const uint32_t lc[] = {
-        DDS_LC_ALL, DDS_LC_TRAFFIC | DDS_LC_TIMING, DDS_LC_DISCOVERY | DDS_LC_THROTTLE, DDS_LC_CONFIG, DDS_LC_INFO, DDS_LC_WARNING, DDS_LC_ERROR | DDS_LC_FATAL, 0, 0
-    };
-    int idx = list_index(vs, value);
-    assert(sizeof(vs) / sizeof(*vs) == sizeof(lc) / sizeof(*lc));
-    if ( idx < 0 )
-        return cfg_error(cfgst, "'%s': undefined value", value);
-    else {
-        int i;
-        for ( i = (int) (sizeof(vs) / sizeof(*vs)) - 1; i >= idx; i-- )
-            enabled_logcats |= lc[i];
-        return 1;
-    }
+  static const char *vs[] = {
+    "finest", "finer", "fine", "config", "info", "warning", "severe", "none", NULL
+  };
+  static const uint32_t lc[] = {
+    DDS_LC_ALL, DDS_LC_TRAFFIC | DDS_LC_TIMING, DDS_LC_DISCOVERY | DDS_LC_THROTTLE, DDS_LC_CONFIG, DDS_LC_INFO, DDS_LC_WARNING, DDS_LC_ERROR | DDS_LC_FATAL, 0, 0
+  };
+  int idx = list_index(vs, value);
+  assert(sizeof(vs) / sizeof(*vs) == sizeof(lc) / sizeof(*lc));
+  if ( idx < 0 )
+    return cfg_error(cfgst, "'%s': undefined value", value);
+  else {
+    int i;
+    for ( i = (int) (sizeof(vs) / sizeof(*vs)) - 1; i >= idx; i-- )
+      enabled_logcats |= lc[i];
+    return 1;
+  }
 }
 
 static int uf_besmode(struct cfgst *cfgst, UNUSED_ARG(void *parent), UNUSED_ARG(struct cfgelem const * const cfgelem), UNUSED_ARG(int first), const char *value)
 {
-    static const char *vs[] = {
-        "full", "writers", "minimal", NULL
-    };
-    static const enum besmode ms[] = {
-        BESMODE_FULL, BESMODE_WRITERS, BESMODE_MINIMAL, 0,
-    };
-    int idx = list_index(vs, value);
-    enum besmode *elem = cfg_address(cfgst, parent, cfgelem);
-    assert(sizeof(vs) / sizeof(*vs) == sizeof(ms) / sizeof(*ms));
-    if ( idx < 0 )
-        return cfg_error(cfgst, "'%s': undefined value", value);
-    *elem = ms[idx];
-    return 1;
+  static const char *vs[] = {
+    "full", "writers", "minimal", NULL
+  };
+  static const enum besmode ms[] = {
+    BESMODE_FULL, BESMODE_WRITERS, BESMODE_MINIMAL, 0,
+  };
+  int idx = list_index(vs, value);
+  enum besmode *elem = cfg_address(cfgst, parent, cfgelem);
+  assert(sizeof(vs) / sizeof(*vs) == sizeof(ms) / sizeof(*ms));
+  if ( idx < 0 )
+    return cfg_error(cfgst, "'%s': undefined value", value);
+  *elem = ms[idx];
+  return 1;
 }
 
 static void pf_besmode(struct cfgst *cfgst, void *parent, struct cfgelem const * const cfgelem, int is_default)
 {
-    enum besmode *p = cfg_address(cfgst, parent, cfgelem);
-    const char *str = "INVALID";
-    switch ( *p ) {
-        case BESMODE_FULL: str = "full"; break;
-        case BESMODE_WRITERS: str = "writers"; break;
-        case BESMODE_MINIMAL: str = "minimal"; break;
-    }
-    cfg_log(cfgst, "%s%s", str, is_default ? " [def]" : "");
+  enum besmode *p = cfg_address(cfgst, parent, cfgelem);
+  const char *str = "INVALID";
+  switch ( *p ) {
+    case BESMODE_FULL: str = "full"; break;
+    case BESMODE_WRITERS: str = "writers"; break;
+    case BESMODE_MINIMAL: str = "minimal"; break;
+  }
+  cfg_log(cfgst, "%s%s", str, is_default ? " [def]" : "");
 }
 
 #ifdef DDSI_INCLUDE_SSL
@@ -1458,436 +1379,371 @@ static void pf_min_tls_version(struct cfgst *cfgst, void *parent, struct cfgelem
 }
 #endif
 
-static int uf_durability_cdr(struct cfgst *cfgst, UNUSED_ARG(void *parent), UNUSED_ARG(struct cfgelem const * const cfgelem), UNUSED_ARG(int first), const char *value)
-{
-    static const char *vs[] = { "cdr_le", "cdr_be", "cdr_server", "cdr_client", NULL };
-    static const enum durability_cdr ms[] = { DUR_CDR_LE, DUR_CDR_BE, DUR_CDR_SERVER, DUR_CDR_CLIENT, 0 };
-    int idx = list_index(vs, value);
-    enum durability_cdr * elem = cfg_address(cfgst, parent, cfgelem);
-    if ( idx < 0 ) {
-        return cfg_error(cfgst, "'%s': undefined value", value);
-    }
-    *elem = ms[idx];
-    return 1;
-}
-
-static void pf_durability_cdr(struct cfgst *cfgst, void *parent, struct cfgelem const * const cfgelem, int is_default)
-{
-    enum durability_cdr *p = cfg_address(cfgst, parent, cfgelem);
-    const char *str = "INVALID";
-    switch ( *p ) {
-        case DUR_CDR_LE: str = "cdr_le"; break;
-        case DUR_CDR_BE: str = "cdr_be"; break;
-        case DUR_CDR_SERVER: str = "cdr_server"; break;
-        case DUR_CDR_CLIENT: str = "cdr_client"; break;
-    }
-    cfg_log(cfgst, "%s%s", str, is_default ? " [def]" : "");
-}
-
-
 static int uf_retransmit_merging(struct cfgst *cfgst, UNUSED_ARG(void *parent), UNUSED_ARG(struct cfgelem const * const cfgelem), UNUSED_ARG(int first), const char *value)
 {
-    static const char *vs[] = {
-        "never", "adaptive", "always", NULL
-    };
-    static const enum retransmit_merging ms[] = {
-        REXMIT_MERGE_NEVER, REXMIT_MERGE_ADAPTIVE, REXMIT_MERGE_ALWAYS, 0,
-    };
-    int idx = list_index(vs, value);
-    enum retransmit_merging *elem = cfg_address(cfgst, parent, cfgelem);
-    assert(sizeof(vs) / sizeof(*vs) == sizeof(ms) / sizeof(*ms));
-    if ( idx < 0 )
-        return cfg_error(cfgst, "'%s': undefined value", value);
-    *elem = ms[idx];
-    return 1;
+  static const char *vs[] = {
+    "never", "adaptive", "always", NULL
+  };
+  static const enum retransmit_merging ms[] = {
+    REXMIT_MERGE_NEVER, REXMIT_MERGE_ADAPTIVE, REXMIT_MERGE_ALWAYS, 0,
+  };
+  int idx = list_index(vs, value);
+  enum retransmit_merging *elem = cfg_address(cfgst, parent, cfgelem);
+  assert(sizeof(vs) / sizeof(*vs) == sizeof(ms) / sizeof(*ms));
+  if ( idx < 0 )
+    return cfg_error(cfgst, "'%s': undefined value", value);
+  *elem = ms[idx];
+  return 1;
 }
 
 static void pf_retransmit_merging(struct cfgst *cfgst, void *parent, struct cfgelem const * const cfgelem, int is_default)
 {
-    enum retransmit_merging *p = cfg_address(cfgst, parent, cfgelem);
-    const char *str = "INVALID";
-    switch ( *p ) {
-        case REXMIT_MERGE_NEVER: str = "never"; break;
-        case REXMIT_MERGE_ADAPTIVE: str = "adaptive"; break;
-        case REXMIT_MERGE_ALWAYS: str = "always"; break;
-    }
-    cfg_log(cfgst, "%s%s", str, is_default ? " [def]" : "");
+  enum retransmit_merging *p = cfg_address(cfgst, parent, cfgelem);
+  const char *str = "INVALID";
+  switch ( *p ) {
+    case REXMIT_MERGE_NEVER: str = "never"; break;
+    case REXMIT_MERGE_ADAPTIVE: str = "adaptive"; break;
+    case REXMIT_MERGE_ALWAYS: str = "always"; break;
+  }
+  cfg_log(cfgst, "%s%s", str, is_default ? " [def]" : "");
 }
 
 static int uf_string(struct cfgst *cfgst, void *parent, struct cfgelem const * const cfgelem, UNUSED_ARG(int first), const char *value)
 {
-    char **elem = cfg_address(cfgst, parent, cfgelem);
-    *elem = ddsrt_strdup(value);
-    return 1;
+  char **elem = cfg_address(cfgst, parent, cfgelem);
+  *elem = ddsrt_strdup(value);
+  return 1;
 }
 
 DDSRT_WARNING_MSVC_OFF(4996);
 static int uf_natint64_unit(struct cfgst *cfgst, int64_t *elem, const char *value, const struct unit *unittab, int64_t def_mult, int64_t min, int64_t max)
 {
-    int pos;
-    double v_dbl;
-    int64_t v_int;
-    int64_t mult;
-    /* try convert as integer + optional unit; if that fails, try
-    floating point + optional unit (round, not truncate, to integer) */
-    if ( *value == 0 ) {
-        *elem = 0; /* some static analyzers don't "get it" */
-        return cfg_error(cfgst, "%s: empty string is not a valid value", value);
-    } else if ( sscanf(value, "%lld%n", (long long int *) &v_int, &pos) == 1 && (mult = lookup_multiplier(cfgst, unittab, value, pos, v_int == 0, def_mult, 0)) != 0 ) {
-        assert(mult > 0);
-        if ( v_int < 0 || v_int > max / mult || mult * v_int < min)
-            return cfg_error(cfgst, "%s: value out of range", value);
-        *elem = mult * v_int;
-        return 1;
-    } else if ( sscanf(value, "%lf%n", &v_dbl, &pos) == 1 && (mult = lookup_multiplier(cfgst, unittab, value, pos, v_dbl == 0, def_mult, 1)) != 0 ) {
-        double dmult = (double) mult;
-        assert(dmult > 0);
-        if ( (int64_t) (v_dbl * dmult + 0.5) < min || (int64_t) (v_dbl * dmult + 0.5) > max )
-            return cfg_error(cfgst, "%s: value out of range", value);
-        *elem = (int64_t) (v_dbl * dmult + 0.5);
-        return 1;
-    } else {
-        *elem = 0; /* some static analyzers don't "get it" */
-        return cfg_error(cfgst, "%s: invalid value", value);
-    }
+  int pos;
+  double v_dbl;
+  int64_t v_int;
+  int64_t mult;
+  /* try convert as integer + optional unit; if that fails, try
+     floating point + optional unit (round, not truncate, to integer) */
+  if ( *value == 0 ) {
+    *elem = 0; /* some static analyzers don't "get it" */
+    return cfg_error(cfgst, "%s: empty string is not a valid value", value);
+  } else if ( sscanf(value, "%lld%n", (long long int *) &v_int, &pos) == 1 && (mult = lookup_multiplier(cfgst, unittab, value, pos, v_int == 0, def_mult, 0)) != 0 ) {
+    assert(mult > 0);
+    if ( v_int < 0 || v_int > max / mult || mult * v_int < min)
+      return cfg_error(cfgst, "%s: value out of range", value);
+    *elem = mult * v_int;
+    return 1;
+  } else if ( sscanf(value, "%lf%n", &v_dbl, &pos) == 1 && (mult = lookup_multiplier(cfgst, unittab, value, pos, v_dbl == 0, def_mult, 1)) != 0 ) {
+    double dmult = (double) mult;
+    assert(dmult > 0);
+    if ( (int64_t) (v_dbl * dmult + 0.5) < min || (int64_t) (v_dbl * dmult + 0.5) > max )
+      return cfg_error(cfgst, "%s: value out of range", value);
+    *elem = (int64_t) (v_dbl * dmult + 0.5);
+    return 1;
+  } else {
+    *elem = 0; /* some static analyzers don't "get it" */
+    return cfg_error(cfgst, "%s: invalid value", value);
+  }
 }
 DDSRT_WARNING_MSVC_ON(4996);
 
 #ifdef DDSI_INCLUDE_BANDWIDTH_LIMITING
 static int uf_bandwidth(struct cfgst *cfgst, void *parent, struct cfgelem const * const cfgelem, UNUSED_ARG(int first), const char *value)
 {
-    int64_t bandwidth_bps = 0;
-    if ( strncmp(value, "inf", 3) == 0 ) {
-        /* special case: inf needs no unit */
-        int *elem = cfg_address(cfgst, parent, cfgelem);
-        if ( strspn(value + 3, " ") != strlen(value + 3) &&
-            lookup_multiplier(cfgst, unittab_bandwidth_bps, value, 3, 1, 8, 1) == 0 )
-            return 0;
-        *elem = 0;
-        return 1;
-    } else if ( !uf_natint64_unit(cfgst, &bandwidth_bps, value, unittab_bandwidth_bps, 8, INT64_MAX) ) {
-        return 0;
-    } else if ( bandwidth_bps / 8 > INT_MAX ) {
-        return cfg_error(cfgst, "%s: value out of range", value);
-    } else {
-        uint32_t *elem = cfg_address(cfgst, parent, cfgelem);
-        *elem = (uint32_t) (bandwidth_bps / 8);
-        return 1;
-    }
+  int64_t bandwidth_bps = 0;
+  if ( strncmp(value, "inf", 3) == 0 ) {
+    /* special case: inf needs no unit */
+    int *elem = cfg_address(cfgst, parent, cfgelem);
+    if ( strspn(value + 3, " ") != strlen(value + 3) &&
+         lookup_multiplier(cfgst, unittab_bandwidth_bps, value, 3, 1, 8, 1) == 0 )
+      return 0;
+    *elem = 0;
+    return 1;
+  } else if ( !uf_natint64_unit(cfgst, &bandwidth_bps, value, unittab_bandwidth_bps, 8, INT64_MAX) ) {
+    return 0;
+  } else if ( bandwidth_bps / 8 > INT_MAX ) {
+    return cfg_error(cfgst, "%s: value out of range", value);
+  } else {
+    uint32_t *elem = cfg_address(cfgst, parent, cfgelem);
+    *elem = (uint32_t) (bandwidth_bps / 8);
+    return 1;
+  }
 }
 #endif
 
 static int uf_memsize(struct cfgst *cfgst, void *parent, struct cfgelem const * const cfgelem, UNUSED_ARG(int first), const char *value)
 {
-    int64_t size = 0;
-    if ( !uf_natint64_unit(cfgst, &size, value, unittab_memsize, 1, 0, INT32_MAX) )
-        return 0;
-    else {
-        uint32_t *elem = cfg_address(cfgst, parent, cfgelem);
-        *elem = (uint32_t) size;
-        return 1;
-    }
+  int64_t size = 0;
+  if ( !uf_natint64_unit(cfgst, &size, value, unittab_memsize, 1, 0, INT32_MAX) )
+    return 0;
+  else {
+    uint32_t *elem = cfg_address(cfgst, parent, cfgelem);
+    *elem = (uint32_t) size;
+    return 1;
+  }
 }
 
 #ifdef DDSI_INCLUDE_ENCRYPTION
 static int uf_cipher(struct cfgst *cfgst, void *parent, struct cfgelem const * const cfgelem, UNUSED_ARG(int first), const char *value)
 {
-    if ( q_security_plugin.cipher_type_from_string ) {
-        q_cipherType *elem = cfg_address(cfgst, parent, cfgelem);
-        if ( (q_security_plugin.cipher_type_from_string) (value, elem) ) {
-            return 1;
-        } else {
-            return cfg_error(cfgst, "%s: undefined value", value);
-        }
+  if ( q_security_plugin.cipher_type_from_string ) {
+    q_cipherType *elem = cfg_address(cfgst, parent, cfgelem);
+    if ( (q_security_plugin.cipher_type_from_string) (value, elem) ) {
+      return 1;
+    } else {
+      return cfg_error(cfgst, "%s: undefined value", value);
     }
-    return 1;
+  }
+  return 1;
 }
 #endif /* DDSI_INCLUDE_ENCRYPTION */
 
 
 static int uf_tracingOutputFileName(struct cfgst *cfgst, UNUSED_ARG(void *parent), UNUSED_ARG(struct cfgelem const * const cfgelem), UNUSED_ARG(int first), const char *value)
 {
-    struct config *cfg = cfgst->cfg;
-    {
-        cfg->tracingOutputFileName = ddsrt_strdup(value);
-    }
-    return 1;
+  struct config *cfg = cfgst->cfg;
+  {
+    cfg->tracingOutputFileName = ddsrt_strdup(value);
+  }
+  return 1;
 }
 
 static int uf_ipv4(struct cfgst *cfgst, void *parent, struct cfgelem const * const cfgelem, int first, const char *value)
 {
-    /* Not actually doing any checking yet */
-    return uf_string(cfgst, parent, cfgelem, first, value);
+  /* Not actually doing any checking yet */
+  return uf_string(cfgst, parent, cfgelem, first, value);
 }
 
 static int uf_networkAddress(struct cfgst *cfgst, void *parent, struct cfgelem const * const cfgelem, int first, const char *value)
 {
-    if ( ddsrt_strcasecmp(value, "auto") != 0 )
-        return uf_ipv4(cfgst, parent, cfgelem, first, value);
-    else {
-        char **elem = cfg_address(cfgst, parent, cfgelem);
-        *elem = NULL;
-        return 1;
-    }
+  if ( ddsrt_strcasecmp(value, "auto") != 0 )
+    return uf_ipv4(cfgst, parent, cfgelem, first, value);
+  else {
+    char **elem = cfg_address(cfgst, parent, cfgelem);
+    *elem = NULL;
+    return 1;
+  }
 }
 
 static void ff_networkAddresses(struct cfgst *cfgst, void *parent, struct cfgelem const * const cfgelem)
 {
-    char ***elem = cfg_address(cfgst, parent, cfgelem);
-    int i;
-    for ( i = 0; (*elem)[i]; i++ )
-        ddsrt_free((*elem)[i]);
-    ddsrt_free(*elem);
+  char ***elem = cfg_address(cfgst, parent, cfgelem);
+  int i;
+  for ( i = 0; (*elem)[i]; i++ )
+    ddsrt_free((*elem)[i]);
+  ddsrt_free(*elem);
 }
 
 static int uf_networkAddresses_simple(struct cfgst *cfgst, void *parent, struct cfgelem const * const cfgelem, UNUSED_ARG(int first), const char *value)
 {
-    char ***elem = cfg_address(cfgst, parent, cfgelem);
-    if ( (*elem = ddsrt_malloc(2 * sizeof(char *))) == NULL )
-        return cfg_error(cfgst, "out of memory");
-    if ( ((*elem)[0] = ddsrt_strdup(value)) == NULL ) {
-        ddsrt_free(*elem);
-        *elem = NULL;
-        return cfg_error(cfgst, "out of memory");
-    }
-    (*elem)[1] = NULL;
-    return 1;
+  char ***elem = cfg_address(cfgst, parent, cfgelem);
+  if ( (*elem = ddsrt_malloc(2 * sizeof(char *))) == NULL )
+    return cfg_error(cfgst, "out of memory");
+  if ( ((*elem)[0] = ddsrt_strdup(value)) == NULL ) {
+    ddsrt_free(*elem);
+    *elem = NULL;
+    return cfg_error(cfgst, "out of memory");
+  }
+  (*elem)[1] = NULL;
+  return 1;
 }
 
 static int uf_networkAddresses(struct cfgst *cfgst, void *parent, struct cfgelem const * const cfgelem, int first, const char *value)
 {
-    /* Check for keywords first */
+  /* Check for keywords first */
+  {
+    static const char *keywords[] = { "all", "any", "none" };
+    int i;
+    for ( i = 0; i < (int) (sizeof(keywords) / sizeof(*keywords)); i++ ) {
+      if ( ddsrt_strcasecmp(value, keywords[i]) == 0 )
+        return uf_networkAddresses_simple(cfgst, parent, cfgelem, first, keywords[i]);
+    }
+  }
+
+  /* If not keyword, then comma-separated list of addresses */
+  {
+    char ***elem = cfg_address(cfgst, parent, cfgelem);
+    char *copy;
+    unsigned count;
+
+    /* First count how many addresses we have - but do it stupidly by
+       counting commas and adding one (so two commas in a row are both
+       counted) */
     {
-        static const char *keywords[] = { "all", "any", "none" };
-        int i;
-        for ( i = 0; i < (int) (sizeof(keywords) / sizeof(*keywords)); i++ ) {
-            if ( ddsrt_strcasecmp(value, keywords[i]) == 0 )
-                return uf_networkAddresses_simple(cfgst, parent, cfgelem, first, keywords[i]);
-        }
+      const char *scan = value;
+      count = 1;
+      while ( *scan )
+        count += (*scan++ == ',');
     }
 
-    /* If not keyword, then comma-separated list of addresses */
+    copy = ddsrt_strdup(value);
+
+    /* Allocate an array of address strings (which may be oversized a
+       bit because of the counting of the commas) */
+    *elem = ddsrt_malloc((count + 1) * sizeof(char *));
+
     {
-        char ***elem = cfg_address(cfgst, parent, cfgelem);
-        char *copy;
-        unsigned count;
-
-        /* First count how many addresses we have - but do it stupidly by
-        counting commas and adding one (so two commas in a row are both
-        counted) */
-        {
-            const char *scan = value;
-            count = 1;
-            while ( *scan )
-                count += (*scan++ == ',');
-        }
-
-        copy = ddsrt_strdup(value);
-
-        /* Allocate an array of address strings (which may be oversized a
-        bit because of the counting of the commas) */
-        *elem = ddsrt_malloc((count + 1) * sizeof(char *));
-
-        {
-            char *cursor = copy, *tok;
-            unsigned idx = 0;
-            while ( (tok = ddsrt_strsep(&cursor, ",")) != NULL ) {
-                assert(idx < count);
-                (*elem)[idx] = ddsrt_strdup(tok);
-                idx++;
-            }
-            (*elem)[idx] = NULL;
-        }
-        ddsrt_free(copy);
+      char *cursor = copy, *tok;
+      unsigned idx = 0;
+      while ( (tok = ddsrt_strsep(&cursor, ",")) != NULL ) {
+        assert(idx < count);
+        (*elem)[idx] = ddsrt_strdup(tok);
+        idx++;
+      }
+      (*elem)[idx] = NULL;
     }
-    return 1;
+    ddsrt_free(copy);
+  }
+  return 1;
 }
 
 static int uf_allow_multicast(struct cfgst *cfgst, void *parent, struct cfgelem const * const cfgelem, UNUSED_ARG(int first), const char *value)
 {
 #ifdef DDSI_INCLUDE_SSM
-    static const char *vs[] = { "false", "spdp", "asm", "ssm", "true", NULL };
-    static const unsigned bs[] = { AMC_FALSE, AMC_SPDP, AMC_ASM, AMC_SSM, AMC_TRUE };
+  static const char *vs[] = { "false", "spdp", "asm", "ssm", "true", NULL };
+  static const unsigned bs[] = { AMC_FALSE, AMC_SPDP, AMC_ASM, AMC_SSM, AMC_TRUE };
 #else
-    static const char *vs[] = { "false", "spdp", "asm", "true", NULL };
-    static const unsigned bs[] = { AMC_FALSE, AMC_SPDP, AMC_ASM, AMC_TRUE };
+  static const char *vs[] = { "false", "spdp", "asm", "true", NULL };
+  static const unsigned bs[] = { AMC_FALSE, AMC_SPDP, AMC_ASM, AMC_TRUE };
 #endif
-    char *copy = ddsrt_strdup(value), *cursor = copy, *tok;
-    unsigned *elem = cfg_address(cfgst, parent, cfgelem);
-    if ( copy == NULL )
-        return cfg_error(cfgst, "out of memory");
-    *elem = 0;
-    while ( (tok = ddsrt_strsep(&cursor, ",")) != NULL ) {
-        int idx = list_index(vs, tok);
-        if ( idx < 0 ) {
-            int ret = cfg_error(cfgst, "'%s' in '%s' undefined", tok, value);
-            ddsrt_free(copy);
-            return ret;
-        }
-        *elem |= bs[idx];
+  char *copy = ddsrt_strdup(value), *cursor = copy, *tok;
+  unsigned *elem = cfg_address(cfgst, parent, cfgelem);
+  if ( copy == NULL )
+    return cfg_error(cfgst, "out of memory");
+  *elem = 0;
+  while ( (tok = ddsrt_strsep(&cursor, ",")) != NULL ) {
+    int idx = list_index(vs, tok);
+    if ( idx < 0 ) {
+      int ret = cfg_error(cfgst, "'%s' in '%s' undefined", tok, value);
+      ddsrt_free(copy);
+      return ret;
     }
-    ddsrt_free(copy);
-    return 1;
+    *elem |= bs[idx];
+  }
+  ddsrt_free(copy);
+  return 1;
 }
 
 static void pf_allow_multicast(struct cfgst *cfgst, void *parent, struct cfgelem const * const cfgelem, int is_default)
 {
-    unsigned *p = cfg_address(cfgst, parent, cfgelem);
-    const char *str = "INVALID";
-    switch ( *p ) {
-        case AMC_FALSE: str = "false"; break;
-        case AMC_SPDP: str = "spdp"; break;
-        case AMC_ASM: str = "asm"; break;
+  unsigned *p = cfg_address(cfgst, parent, cfgelem);
+  const char *str = "INVALID";
+  switch ( *p ) {
+    case AMC_FALSE: str = "false"; break;
+    case AMC_SPDP: str = "spdp"; break;
+    case AMC_ASM: str = "asm"; break;
 #ifdef DDSI_INCLUDE_SSM
-        case AMC_SSM: str = "ssm"; break;
-        case (AMC_SPDP | AMC_ASM): str = "spdp,asm"; break;
-        case (AMC_SPDP | AMC_SSM): str = "spdp,ssm"; break;
+    case AMC_SSM: str = "ssm"; break;
+    case (AMC_SPDP | AMC_ASM): str = "spdp,asm"; break;
+    case (AMC_SPDP | AMC_SSM): str = "spdp,ssm"; break;
 #endif
-        case AMC_TRUE: str = "true"; break;
-    }
-    cfg_log(cfgst, "%s%s", str, is_default ? " [def]" : "");
-}
-
-static int uf_sched_prio_class(struct cfgst *cfgst, void *parent, struct cfgelem const * const cfgelem, UNUSED_ARG(int first), const char *value)
-{
-    int ret;
-    q__schedPrioClass *prio;
-
-    assert(value != NULL);
-
-    prio = cfg_address(cfgst, parent, cfgelem);
-
-    if ( ddsrt_strcasecmp(value, "relative") == 0 ) {
-        *prio = Q__SCHED_PRIO_RELATIVE;
-        ret = 1;
-    } else if ( ddsrt_strcasecmp(value, "absolute") == 0 ) {
-        *prio = Q__SCHED_PRIO_ABSOLUTE;
-        ret = 1;
-    } else {
-        ret = cfg_error(cfgst, "'%s': undefined value", value);
-    }
-
-    return ret;
-}
-
-static void pf_sched_prio_class(struct cfgst *cfgst, void *parent, struct cfgelem const * const cfgelem, int is_default)
-{
-    char *str;
-    q__schedPrioClass *prio = cfg_address(cfgst, parent, cfgelem);
-
-    if ( *prio == Q__SCHED_PRIO_RELATIVE ) {
-        str = "relative";
-    } else if ( *prio == Q__SCHED_PRIO_ABSOLUTE ) {
-        str = "absolute";
-    } else {
-        str = "INVALID";
-    }
-
-    cfg_log(cfgst, "%s%s", str, is_default ? " [def]" : "");
+    case AMC_TRUE: str = "true"; break;
+  }
+  cfg_log(cfgst, "%s%s", str, is_default ? " [def]" : "");
 }
 
 static int uf_sched_class(struct cfgst *cfgst, void *parent, struct cfgelem const * const cfgelem, UNUSED_ARG(int first), const char *value)
 {
-    static const char *vs[] = { "realtime", "timeshare", "default" };
-    static const ddsrt_sched_t ms[] = { DDSRT_SCHED_REALTIME, DDSRT_SCHED_TIMESHARE, DDSRT_SCHED_DEFAULT };
-    int idx = list_index(vs, value);
-    ddsrt_sched_t *elem = cfg_address(cfgst, parent, cfgelem);
-    assert(sizeof(vs) / sizeof(*vs) == sizeof(ms) / sizeof(*ms));
-    if ( idx < 0 )
-        return cfg_error(cfgst, "'%s': undefined value", value);
-    *elem = ms[idx];
-    return 1;
+  static const char *vs[] = { "realtime", "timeshare", "default" };
+  static const ddsrt_sched_t ms[] = { DDSRT_SCHED_REALTIME, DDSRT_SCHED_TIMESHARE, DDSRT_SCHED_DEFAULT };
+  int idx = list_index(vs, value);
+  ddsrt_sched_t *elem = cfg_address(cfgst, parent, cfgelem);
+  assert(sizeof(vs) / sizeof(*vs) == sizeof(ms) / sizeof(*ms));
+  if ( idx < 0 )
+    return cfg_error(cfgst, "'%s': undefined value", value);
+  *elem = ms[idx];
+  return 1;
 }
 
 static void pf_sched_class(struct cfgst *cfgst, void *parent, struct cfgelem const * const cfgelem, int is_default)
 {
-    ddsrt_sched_t *p = cfg_address(cfgst, parent, cfgelem);
-    const char *str = "INVALID";
-    switch ( *p ) {
-        case DDSRT_SCHED_DEFAULT: str = "default"; break;
-        case DDSRT_SCHED_TIMESHARE: str = "timeshare"; break;
-        case DDSRT_SCHED_REALTIME: str = "realtime"; break;
-    }
-    cfg_log(cfgst, "%s%s", str, is_default ? " [def]" : "");
+  ddsrt_sched_t *p = cfg_address(cfgst, parent, cfgelem);
+  const char *str = "INVALID";
+  switch ( *p ) {
+    case DDSRT_SCHED_DEFAULT: str = "default"; break;
+    case DDSRT_SCHED_TIMESHARE: str = "timeshare"; break;
+    case DDSRT_SCHED_REALTIME: str = "realtime"; break;
+  }
+  cfg_log(cfgst, "%s%s", str, is_default ? " [def]" : "");
 }
 
 DDSRT_WARNING_MSVC_OFF(4996);
 static int uf_maybe_int32(struct cfgst *cfgst, void *parent, struct cfgelem const * const cfgelem, UNUSED_ARG(int first), const char *value)
 {
-    struct config_maybe_int32 *elem = cfg_address(cfgst, parent, cfgelem);
-    int pos;
-    if ( ddsrt_strcasecmp(value, "default") == 0 ) {
-        elem->isdefault = 1;
-        elem->value = 0;
-        return 1;
-    } else if ( sscanf(value, "%"PRId32"%n", &elem->value, &pos) == 1 && value[pos] == 0 ) {
-        elem->isdefault = 0;
-        return 1;
-    } else {
-        return cfg_error(cfgst, "'%s': neither 'default' nor a decimal integer\n", value);
-    }
+  struct config_maybe_int32 *elem = cfg_address(cfgst, parent, cfgelem);
+  int pos;
+  if ( ddsrt_strcasecmp(value, "default") == 0 ) {
+    elem->isdefault = 1;
+    elem->value = 0;
+    return 1;
+  } else if ( sscanf(value, "%"PRId32"%n", &elem->value, &pos) == 1 && value[pos] == 0 ) {
+    elem->isdefault = 0;
+    return 1;
+  } else {
+    return cfg_error(cfgst, "'%s': neither 'default' nor a decimal integer\n", value);
+  }
 }
 DDSRT_WARNING_MSVC_ON(4996);
 
 static int uf_maybe_memsize(struct cfgst *cfgst, void *parent, struct cfgelem const * const cfgelem, UNUSED_ARG(int first), const char *value)
 {
-    struct config_maybe_uint32 *elem = cfg_address(cfgst, parent, cfgelem);
-    int64_t size = 0;
-    if ( ddsrt_strcasecmp(value, "default") == 0 ) {
-        elem->isdefault = 1;
-        elem->value = 0;
-        return 1;
-    } else if ( !uf_natint64_unit(cfgst, &size, value, unittab_memsize, 1, 0, INT32_MAX) ) {
-        return 0;
-    } else {
-        elem->isdefault = 0;
-        elem->value = (uint32_t) size;
-        return 1;
-    }
+  struct config_maybe_uint32 *elem = cfg_address(cfgst, parent, cfgelem);
+  int64_t size = 0;
+  if ( ddsrt_strcasecmp(value, "default") == 0 ) {
+    elem->isdefault = 1;
+    elem->value = 0;
+    return 1;
+  } else if ( !uf_natint64_unit(cfgst, &size, value, unittab_memsize, 1, 0, INT32_MAX) ) {
+    return 0;
+  } else {
+    elem->isdefault = 0;
+    elem->value = (uint32_t) size;
+    return 1;
+  }
 }
 
 static int uf_int(struct cfgst *cfgst, void *parent, struct cfgelem const * const cfgelem, UNUSED_ARG(int first), const char *value)
 {
-    int *elem = cfg_address(cfgst, parent, cfgelem);
-    char *endptr;
-    long v = strtol(value, &endptr, 10);
-    if ( *value == 0 || *endptr != 0 )
-        return cfg_error(cfgst, "%s: not a decimal integer", value);
-    if ( v != (int) v )
-        return cfg_error(cfgst, "%s: value out of range", value);
-    *elem = (int) v;
-    return 1;
+  int *elem = cfg_address(cfgst, parent, cfgelem);
+  char *endptr;
+  long v = strtol(value, &endptr, 10);
+  if ( *value == 0 || *endptr != 0 )
+    return cfg_error(cfgst, "%s: not a decimal integer", value);
+  if ( v != (int) v )
+    return cfg_error(cfgst, "%s: value out of range", value);
+  *elem = (int) v;
+  return 1;
 }
 
 static int uf_duration_gen(struct cfgst *cfgst, void *parent, struct cfgelem const * const cfgelem, const char *value, int64_t def_mult, int64_t min_ns, int64_t max_ns)
 {
-    return uf_natint64_unit(cfgst, cfg_address(cfgst, parent, cfgelem), value, unittab_duration, def_mult, min_ns, max_ns);
+  return uf_natint64_unit(cfgst, cfg_address(cfgst, parent, cfgelem), value, unittab_duration, def_mult, min_ns, max_ns);
 }
 
 static int uf_duration_inf(struct cfgst *cfgst, void *parent, struct cfgelem const * const cfgelem, UNUSED_ARG(int first), const char *value)
 {
-    if ( ddsrt_strcasecmp(value, "inf") == 0 ) {
-        int64_t *elem = cfg_address(cfgst, parent, cfgelem);
-        *elem = T_NEVER;
-        return 1;
-    } else {
-        return uf_duration_gen(cfgst, parent, cfgelem, value, 0, 0, T_NEVER - 1);
-    }
+  if ( ddsrt_strcasecmp(value, "inf") == 0 ) {
+    int64_t *elem = cfg_address(cfgst, parent, cfgelem);
+    *elem = T_NEVER;
+    return 1;
+  } else {
+    return uf_duration_gen(cfgst, parent, cfgelem, value, 0, 0, T_NEVER - 1);
+  }
 }
 
 static int uf_duration_ms_1hr(struct cfgst *cfgst, void *parent, struct cfgelem const * const cfgelem, UNUSED_ARG(int first), const char *value)
 {
-    return uf_duration_gen(cfgst, parent, cfgelem, value, T_MILLISECOND, 0, 3600 * T_SECOND);
+  return uf_duration_gen(cfgst, parent, cfgelem, value, T_MILLISECOND, 0, 3600 * T_SECOND);
 }
 
 static int uf_duration_ms_1s(struct cfgst *cfgst, void *parent, struct cfgelem const * const cfgelem, UNUSED_ARG(int first), const char *value)
 {
-    return uf_duration_gen(cfgst, parent, cfgelem, value, T_MILLISECOND, 0, T_SECOND);
+  return uf_duration_gen(cfgst, parent, cfgelem, value, T_MILLISECOND, 0, T_SECOND);
 }
 
 static int uf_duration_us_1s(struct cfgst *cfgst, void *parent, struct cfgelem const * const cfgelem, UNUSED_ARG(int first), const char *value)
 {
-    return uf_duration_gen(cfgst, parent, cfgelem, value, 1000, 0, T_SECOND);
+  return uf_duration_gen(cfgst, parent, cfgelem, value, 1000, 0, T_SECOND);
 }
 
 static int uf_duration_100ms_1hr(struct cfgst *cfgst, void *parent, struct cfgelem const * const cfgelem, UNUSED_ARG(int first), const char *value)
@@ -1895,56 +1751,58 @@ static int uf_duration_100ms_1hr(struct cfgst *cfgst, void *parent, struct cfgel
   return uf_duration_gen(cfgst, parent, cfgelem, value, 0, 100 * T_MILLISECOND, 3600 * T_SECOND);
 }
 
+#if 0
 static int uf_int32(struct cfgst *cfgst, void *parent, struct cfgelem const * const cfgelem, UNUSED_ARG(int first), const char *value)
 {
-    int32_t *elem = cfg_address(cfgst, parent, cfgelem);
-    char *endptr;
-    long v = strtol(value, &endptr, 10);
-    if ( *value == 0 || *endptr != 0 )
-        return cfg_error(cfgst, "%s: not a decimal integer", value);
-    if ( v != (int32_t) v )
-        return cfg_error(cfgst, "%s: value out of range", value);
-    *elem = (int32_t) v;
-    return 1;
+  int32_t *elem = cfg_address(cfgst, parent, cfgelem);
+  char *endptr;
+  long v = strtol(value, &endptr, 10);
+  if ( *value == 0 || *endptr != 0 )
+    return cfg_error(cfgst, "%s: not a decimal integer", value);
+  if ( v != (int32_t) v )
+    return cfg_error(cfgst, "%s: value out of range", value);
+  *elem = (int32_t) v;
+  return 1;
 }
+#endif
 
 #if 0
 static int uf_uint32(struct cfgst *cfgst, void *parent, struct cfgelem const * const cfgelem, UNUSED_ARG(int first), const char *value)
 {
-    uint32_t *elem = cfg_address(cfgst, parent, cfgelem);
-    char *endptr;
-    unsigned long v = strtoul(value, &endptr, 10);
-    if ( *value == 0 || *endptr != 0 )
-        return cfg_error(cfgst, "%s: not a decimal integer", value);
-    if ( v != (uint32_t) v )
-        return cfg_error(cfgst, "%s: value out of range", value);
-    *elem = (uint32_t) v;
-    return 1;
+  uint32_t *elem = cfg_address(cfgst, parent, cfgelem);
+  char *endptr;
+  unsigned long v = strtoul(value, &endptr, 10);
+  if ( *value == 0 || *endptr != 0 )
+    return cfg_error(cfgst, "%s: not a decimal integer", value);
+  if ( v != (uint32_t) v )
+    return cfg_error(cfgst, "%s: value out of range", value);
+  *elem = (uint32_t) v;
+  return 1;
 }
 #endif
 
 static int uf_uint(struct cfgst *cfgst, void *parent, struct cfgelem const * const cfgelem, UNUSED_ARG(int first), const char *value)
 {
-    unsigned *elem = cfg_address(cfgst, parent, cfgelem);
-    char *endptr;
-    unsigned long v = strtoul(value, &endptr, 10);
-    if ( *value == 0 || *endptr != 0 )
-        return cfg_error(cfgst, "%s: not a decimal integer", value);
-    if ( v != (unsigned) v )
-        return cfg_error(cfgst, "%s: value out of range", value);
-    *elem = (unsigned) v;
-    return 1;
+  unsigned *elem = cfg_address(cfgst, parent, cfgelem);
+  char *endptr;
+  unsigned long v = strtoul(value, &endptr, 10);
+  if ( *value == 0 || *endptr != 0 )
+    return cfg_error(cfgst, "%s: not a decimal integer", value);
+  if ( v != (unsigned) v )
+    return cfg_error(cfgst, "%s: value out of range", value);
+  *elem = (unsigned) v;
+  return 1;
 }
 
 static int uf_int_min_max(struct cfgst *cfgst, void *parent, struct cfgelem const * const cfgelem, int first, const char *value, int min, int max)
 {
-    int *elem = cfg_address(cfgst, parent, cfgelem);
-    if ( !uf_int(cfgst, parent, cfgelem, first, value) )
-        return 0;
-    else if ( *elem < min || *elem > max )
-        return cfg_error(cfgst, "%s: out of range", value);
-    else
-        return 1;
+  int *elem = cfg_address(cfgst, parent, cfgelem);
+  if ( !uf_int(cfgst, parent, cfgelem, first, value) )
+    return 0;
+  else if ( *elem < min || *elem > max )
+    return cfg_error(cfgst, "%s: out of range", value);
+  else
+    return 1;
 }
 
 DDSRT_WARNING_MSVC_OFF(4996);
@@ -1967,36 +1825,36 @@ DDSRT_WARNING_MSVC_ON(4996);
 
 static int uf_participantIndex(struct cfgst *cfgst, void *parent, struct cfgelem const * const cfgelem, int first, const char *value)
 {
-    int *elem = cfg_address(cfgst, parent, cfgelem);
-    if ( ddsrt_strcasecmp(value, "auto") == 0 ) {
-        *elem = PARTICIPANT_INDEX_AUTO;
-        return 1;
-    } else if ( ddsrt_strcasecmp(value, "none") == 0 ) {
-        *elem = PARTICIPANT_INDEX_NONE;
-        return 1;
-    } else {
-        return uf_int_min_max(cfgst, parent, cfgelem, first, value, 0, 120);
-    }
+  int *elem = cfg_address(cfgst, parent, cfgelem);
+  if ( ddsrt_strcasecmp(value, "auto") == 0 ) {
+    *elem = PARTICIPANT_INDEX_AUTO;
+    return 1;
+  } else if ( ddsrt_strcasecmp(value, "none") == 0 ) {
+    *elem = PARTICIPANT_INDEX_NONE;
+    return 1;
+  } else {
+    return uf_int_min_max(cfgst, parent, cfgelem, first, value, 0, 120);
+  }
 }
 
 static int uf_port(struct cfgst *cfgst, void *parent, struct cfgelem const * const cfgelem, int first, const char *value)
 {
-    return uf_int_min_max(cfgst, parent, cfgelem, first, value, 1, 65535);
+  return uf_int_min_max(cfgst, parent, cfgelem, first, value, 1, 65535);
 }
 
 static int uf_dyn_port(struct cfgst *cfgst, void *parent, struct cfgelem const * const cfgelem, int first, const char *value)
 {
-    return uf_int_min_max(cfgst, parent, cfgelem, first, value, -1, 65535);
+  return uf_int_min_max(cfgst, parent, cfgelem, first, value, -1, 65535);
 }
 
 static int uf_natint(struct cfgst *cfgst, void *parent, struct cfgelem const * const cfgelem, int first, const char *value)
 {
-    return uf_int_min_max(cfgst, parent, cfgelem, first, value, 0, INT32_MAX);
+  return uf_int_min_max(cfgst, parent, cfgelem, first, value, 0, INT32_MAX);
 }
 
 static int uf_natint_255(struct cfgst *cfgst, void *parent, struct cfgelem const * const cfgelem, int first, const char *value)
 {
-    return uf_int_min_max(cfgst, parent, cfgelem, first, value, 0, 255);
+  return uf_int_min_max(cfgst, parent, cfgelem, first, value, 0, 255);
 }
 
 static int uf_transport_selector (struct cfgst *cfgst, void *parent, struct cfgelem const * const cfgelem, UNUSED_ARG (int first), const char *value)
@@ -2065,76 +1923,76 @@ static int uf_deaf_mute (struct cfgst *cfgst, void *parent, struct cfgelem const
 
 static int do_update(struct cfgst *cfgst, update_fun_t upd, void *parent, struct cfgelem const * const cfgelem, const char *value, int is_default)
 {
-    struct cfgst_node *n;
-    struct cfgst_nodekey key;
-    ddsrt_avl_ipath_t np;
-    int ok;
-    key.e = cfgelem;
-    if ( (n = ddsrt_avl_lookup_ipath(&cfgst_found_treedef, &cfgst->found, &key, &np)) == NULL ) {
-        if ( (n = ddsrt_malloc(sizeof(*n))) == NULL )
-            return cfg_error(cfgst, "out of memory");
+  struct cfgst_node *n;
+  struct cfgst_nodekey key;
+  ddsrt_avl_ipath_t np;
+  int ok;
+  key.e = cfgelem;
+  if ( (n = ddsrt_avl_lookup_ipath(&cfgst_found_treedef, &cfgst->found, &key, &np)) == NULL ) {
+    if ( (n = ddsrt_malloc(sizeof(*n))) == NULL )
+      return cfg_error(cfgst, "out of memory");
 
-        n->key = key;
-        n->count = 0;
-        n->failed = 0;
-        n->is_default = is_default;
-        ddsrt_avl_insert_ipath(&cfgst_found_treedef, &cfgst->found, n, &np);
-    }
-    if ( cfgelem->multiplicity == 0 || n->count < cfgelem->multiplicity )
-        ok = upd(cfgst, parent, cfgelem, (n->count == n->failed), value);
-    else
-        ok = cfg_error(cfgst, "only %d instance(s) allowed", cfgelem->multiplicity);
-    n->count++;
-    if ( !ok ) {
-        n->failed++;
-    }
-    return ok;
+    n->key = key;
+    n->count = 0;
+    n->failed = 0;
+    n->is_default = is_default;
+    ddsrt_avl_insert_ipath(&cfgst_found_treedef, &cfgst->found, n, &np);
+  }
+  if ( cfgelem->multiplicity == 0 || n->count < cfgelem->multiplicity )
+    ok = upd(cfgst, parent, cfgelem, (n->count == n->failed), value);
+  else
+    ok = cfg_error(cfgst, "only %d instance(s) allowed", cfgelem->multiplicity);
+  n->count++;
+  if ( !ok ) {
+    n->failed++;
+  }
+  return ok;
 }
 
 static int set_default(struct cfgst *cfgst, void *parent, struct cfgelem const * const cfgelem)
 {
-    if ( cfgelem->defvalue == NULL )
-        return cfg_error(cfgst, "element missing in configuration");
-    return do_update(cfgst, cfgelem->update, parent, cfgelem, cfgelem->defvalue, 1);
+  if ( cfgelem->defvalue == NULL )
+    return cfg_error(cfgst, "element missing in configuration");
+  return do_update(cfgst, cfgelem->update, parent, cfgelem, cfgelem->defvalue, 1);
 }
 
 static int set_defaults(struct cfgst *cfgst, void *parent, int isattr, struct cfgelem const * const cfgelem, int clear_found)
 {
-    const struct cfgelem *ce;
-    int ok = 1;
-    for ( ce = cfgelem; ce && ce->name; ce++ ) {
-        struct cfgst_node *n;
-        struct cfgst_nodekey key;
-        key.e = ce;
-        cfgst_push(cfgst, isattr, ce, parent);
-        if ( ce->multiplicity == 1 ) {
-            if ( ddsrt_avl_lookup(&cfgst_found_treedef, &cfgst->found, &key) == NULL ) {
-                if ( ce->update ) {
-                    int ok1;
-                    cfgst_push(cfgst, 0, NULL, NULL);
-                    ok1 = set_default(cfgst, parent, ce);
-                    cfgst_pop(cfgst);
-                    ok = ok && ok1;
-                }
-            }
-            if ( (n = ddsrt_avl_lookup(&cfgst_found_treedef, &cfgst->found, &key)) != NULL ) {
-                if ( clear_found ) {
-                    ddsrt_avl_delete(&cfgst_found_treedef, &cfgst->found, n);
-                    ddsrt_free(n);
-                }
-            }
-            if ( ce->children ) {
-                int ok1 = set_defaults(cfgst, parent, 0, ce->children, clear_found);
-                ok = ok && ok1;
-            }
-            if ( ce->attributes ) {
-                int ok1 = set_defaults(cfgst, parent, 1, ce->attributes, clear_found);
-                ok = ok && ok1;
-            }
+  const struct cfgelem *ce;
+  int ok = 1;
+  for ( ce = cfgelem; ce && ce->name; ce++ ) {
+    struct cfgst_node *n;
+    struct cfgst_nodekey key;
+    key.e = ce;
+    cfgst_push(cfgst, isattr, ce, parent);
+    if ( ce->multiplicity == 1 ) {
+      if ( ddsrt_avl_lookup(&cfgst_found_treedef, &cfgst->found, &key) == NULL ) {
+        if ( ce->update ) {
+          int ok1;
+          cfgst_push(cfgst, 0, NULL, NULL);
+          ok1 = set_default(cfgst, parent, ce);
+          cfgst_pop(cfgst);
+          ok = ok && ok1;
         }
-        cfgst_pop(cfgst);
+      }
+      if ( (n = ddsrt_avl_lookup(&cfgst_found_treedef, &cfgst->found, &key)) != NULL ) {
+        if ( clear_found ) {
+          ddsrt_avl_delete(&cfgst_found_treedef, &cfgst->found, n);
+          ddsrt_free(n);
+        }
+      }
+      if ( ce->children ) {
+        int ok1 = set_defaults(cfgst, parent, 0, ce->children, clear_found);
+        ok = ok && ok1;
+      }
+      if ( ce->attributes ) {
+        int ok1 = set_defaults(cfgst, parent, 1, ce->attributes, clear_found);
+        ok = ok && ok1;
+      }
     }
-    return ok;
+    cfgst_pop(cfgst);
+  }
+  return ok;
 }
 
 static void pf_nop(UNUSED_ARG(struct cfgst *cfgst), UNUSED_ARG(void *parent), UNUSED_ARG(struct cfgelem const * const cfgelem), UNUSED_ARG(int is_default))
@@ -2143,127 +2001,129 @@ static void pf_nop(UNUSED_ARG(struct cfgst *cfgst), UNUSED_ARG(void *parent), UN
 
 static void pf_string(struct cfgst *cfgst, void *parent, struct cfgelem const * const cfgelem, int is_default)
 {
-    char **p = cfg_address(cfgst, parent, cfgelem);
-    cfg_log(cfgst, "%s%s", *p ? *p : "(null)", is_default ? " [def]" : "");
+  char **p = cfg_address(cfgst, parent, cfgelem);
+  cfg_log(cfgst, "%s%s", *p ? *p : "(null)", is_default ? " [def]" : "");
 }
 
 static void pf_int64_unit(struct cfgst *cfgst, int64_t value, int is_default, const struct unit *unittab, const char *zero_unit)
 {
-    if ( value == 0 ) {
-        /* 0s is a bit of a special case: we don't want to print 0hr (or
-        whatever unit will have the greatest multiplier), so hard-code
-        as 0s */
-        cfg_log(cfgst, "0 %s%s", zero_unit, is_default ? " [def]" : "");
-    } else {
-        int64_t m = 0;
-        const char *unit = NULL;
-        int i;
-        for ( i = 0; unittab[i].name != NULL; i++ ) {
-            if ( unittab[i].multiplier > m && (value % unittab[i].multiplier) == 0 ) {
-                m = unittab[i].multiplier;
-                unit = unittab[i].name;
-            }
-        }
-        assert(m > 0);
-        assert(unit != NULL);
-        cfg_log(cfgst, "%lld %s%s", value / m, unit, is_default ? " [def]" : "");
+  if ( value == 0 ) {
+    /* 0s is a bit of a special case: we don't want to print 0hr (or
+       whatever unit will have the greatest multiplier), so hard-code
+       as 0s */
+    cfg_log(cfgst, "0 %s%s", zero_unit, is_default ? " [def]" : "");
+  } else {
+    int64_t m = 0;
+    const char *unit = NULL;
+    int i;
+    for ( i = 0; unittab[i].name != NULL; i++ ) {
+      if ( unittab[i].multiplier > m && (value % unittab[i].multiplier) == 0 ) {
+        m = unittab[i].multiplier;
+        unit = unittab[i].name;
+      }
     }
+    assert(m > 0);
+    assert(unit != NULL);
+    cfg_log(cfgst, "%lld %s%s", value / m, unit, is_default ? " [def]" : "");
+  }
 }
 
 #ifdef DDSI_INCLUDE_ENCRYPTION
 static void pf_key(struct cfgst *cfgst, UNUSED_ARG(void *parent), UNUSED_ARG(struct cfgelem const * const cfgelem), UNUSED_ARG(int is_default))
 {
-    cfg_log(cfgst, "<hidden, see configfile>");
+  cfg_log(cfgst, "<hidden, see configfile>");
 }
 
 static void pf_cipher(struct cfgst *cfgst, void *parent, struct cfgelem const * const cfgelem, int is_default)
 {
-    q_cipherType *p = cfg_address(cfgst, parent, cfgelem);
-    if ( q_security_plugin.cipher_type ) {
-        cfg_log(cfgst, "%s%s", (q_security_plugin.cipher_type) (*p), is_default ? " [def]" : "");
-    }
+  q_cipherType *p = cfg_address(cfgst, parent, cfgelem);
+  if ( q_security_plugin.cipher_type ) {
+    cfg_log(cfgst, "%s%s", (q_security_plugin.cipher_type) (*p), is_default ? " [def]" : "");
+  }
 }
 #endif /* DDSI_INCLUDE_ENCRYPTION */
 
 static void pf_networkAddress(struct cfgst *cfgst, void *parent, struct cfgelem const * const cfgelem, int is_default)
 {
-    char **p = cfg_address(cfgst, parent, cfgelem);
-    cfg_log(cfgst, "%s%s", *p ? *p : "auto", is_default ? " [def]" : "");
+  char **p = cfg_address(cfgst, parent, cfgelem);
+  cfg_log(cfgst, "%s%s", *p ? *p : "auto", is_default ? " [def]" : "");
 }
 
 static void pf_participantIndex(struct cfgst *cfgst, void *parent, struct cfgelem const * const cfgelem, int is_default)
 {
-    int *p = cfg_address(cfgst, parent, cfgelem);
-    switch ( *p ) {
-        case PARTICIPANT_INDEX_NONE:
-            cfg_log(cfgst, "none%s", is_default ? " [def]" : "");
-            break;
-        case PARTICIPANT_INDEX_AUTO:
-            cfg_log(cfgst, "auto%s", is_default ? " [def]" : "");
-            break;
-        default:
-            cfg_log(cfgst, "%d%s", *p, is_default ? " [def]" : "");
-            break;
-    }
+  int *p = cfg_address(cfgst, parent, cfgelem);
+  switch ( *p ) {
+    case PARTICIPANT_INDEX_NONE:
+      cfg_log(cfgst, "none%s", is_default ? " [def]" : "");
+      break;
+    case PARTICIPANT_INDEX_AUTO:
+      cfg_log(cfgst, "auto%s", is_default ? " [def]" : "");
+      break;
+    default:
+      cfg_log(cfgst, "%d%s", *p, is_default ? " [def]" : "");
+      break;
+  }
 }
 
 static void pf_networkAddresses(struct cfgst *cfgst, void *parent, struct cfgelem const * const cfgelem, int is_default)
 {
-    int i;
-    char ***p = cfg_address(cfgst, parent, cfgelem);
-    for ( i = 0; (*p)[i] != NULL; i++ )
-        cfg_log(cfgst, "%s%s", (*p)[i], is_default ? " [def]" : "");
+  int i;
+  char ***p = cfg_address(cfgst, parent, cfgelem);
+  for ( i = 0; (*p)[i] != NULL; i++ )
+    cfg_log(cfgst, "%s%s", (*p)[i], is_default ? " [def]" : "");
 }
 
 static void pf_int(struct cfgst *cfgst, void *parent, struct cfgelem const * const cfgelem, int is_default)
 {
-    int *p = cfg_address(cfgst, parent, cfgelem);
-    cfg_log(cfgst, "%d%s", *p, is_default ? " [def]" : "");
+  int *p = cfg_address(cfgst, parent, cfgelem);
+  cfg_log(cfgst, "%d%s", *p, is_default ? " [def]" : "");
 }
 
 static void pf_uint(struct cfgst *cfgst, void *parent, struct cfgelem const * const cfgelem, int is_default)
 {
-    unsigned *p = cfg_address(cfgst, parent, cfgelem);
-    cfg_log(cfgst, "%u%s", *p, is_default ? " [def]" : "");
+  unsigned *p = cfg_address(cfgst, parent, cfgelem);
+  cfg_log(cfgst, "%u%s", *p, is_default ? " [def]" : "");
 }
 
 static void pf_duration(struct cfgst *cfgst, void *parent, struct cfgelem const * const cfgelem, int is_default)
 {
-    const int64_t *elem = cfg_address(cfgst, parent, cfgelem);
-    if ( *elem == T_NEVER )
-        cfg_log(cfgst, "inf%s", is_default ? " [def]" : "");
-    else
-        pf_int64_unit(cfgst, *elem, is_default, unittab_duration, "s");
+  const int64_t *elem = cfg_address(cfgst, parent, cfgelem);
+  if ( *elem == T_NEVER )
+    cfg_log(cfgst, "inf%s", is_default ? " [def]" : "");
+  else
+    pf_int64_unit(cfgst, *elem, is_default, unittab_duration, "s");
 }
 
 #ifdef DDSI_INCLUDE_BANDWIDTH_LIMITING
 static void pf_bandwidth(struct cfgst *cfgst, void *parent, struct cfgelem const * const cfgelem, int is_default)
 {
-    const uint32_t *elem = cfg_address(cfgst, parent, cfgelem);
-    if ( *elem == 0 )
-        cfg_log(cfgst, "inf%s", is_default ? " [def]" : "");
-    else
-        pf_int64_unit(cfgst, *elem, is_default, unittab_bandwidth_Bps, "B/s");
+  const uint32_t *elem = cfg_address(cfgst, parent, cfgelem);
+  if ( *elem == 0 )
+    cfg_log(cfgst, "inf%s", is_default ? " [def]" : "");
+  else
+    pf_int64_unit(cfgst, *elem, is_default, unittab_bandwidth_Bps, "B/s");
 }
 #endif
 
 static void pf_memsize(struct cfgst *cfgst, void *parent, struct cfgelem const * const cfgelem, int is_default)
 {
-    const int *elem = cfg_address(cfgst, parent, cfgelem);
-    pf_int64_unit(cfgst, *elem, is_default, unittab_memsize, "B");
+  const int *elem = cfg_address(cfgst, parent, cfgelem);
+  pf_int64_unit(cfgst, *elem, is_default, unittab_memsize, "B");
 }
 
+#if 0
 static void pf_int32(struct cfgst *cfgst, void *parent, struct cfgelem const * const cfgelem, int is_default)
 {
-    int32_t *p = cfg_address(cfgst, parent, cfgelem);
-    cfg_log(cfgst, "%d%s", *p, is_default ? " [def]" : "");
+  int32_t *p = cfg_address(cfgst, parent, cfgelem);
+  cfg_log(cfgst, "%d%s", *p, is_default ? " [def]" : "");
 }
+#endif
 
 #if 0
 static void pf_uint32(struct cfgst *cfgst, void *parent, struct cfgelem const * const cfgelem, int is_default)
 {
-    uint32_t *p = cfg_address(cfgst, parent, cfgelem);
-    cfg_log(cfgst, "%u%s", *p, is_default ? " [def]" : "");
+  uint32_t *p = cfg_address(cfgst, parent, cfgelem);
+  cfg_log(cfgst, "%u%s", *p, is_default ? " [def]" : "");
 }
 #endif
 
@@ -2278,11 +2138,11 @@ static void pf_maybe_int32(struct cfgst *cfgst, void *parent, struct cfgelem con
 
 static void pf_maybe_memsize(struct cfgst *cfgst, void *parent, struct cfgelem const * const cfgelem, int is_default)
 {
-    struct config_maybe_uint32 *p = cfg_address(cfgst, parent, cfgelem);
-    if ( p->isdefault )
-        cfg_log(cfgst, "default%s", is_default ? " [def]" : "");
-    else
-        pf_int64_unit(cfgst, p->value, is_default, unittab_memsize, "B");
+  struct config_maybe_uint32 *p = cfg_address(cfgst, parent, cfgelem);
+  if ( p->isdefault )
+    cfg_log(cfgst, "default%s", is_default ? " [def]" : "");
+  else
+    pf_int64_unit(cfgst, p->value, is_default, unittab_memsize, "B");
 }
 
 static void pf_domainId(struct cfgst *cfgst, void *parent, struct cfgelem const * const cfgelem, int is_default)
@@ -2296,584 +2156,578 @@ static void pf_domainId(struct cfgst *cfgst, void *parent, struct cfgelem const
 
 static void pf_boolean(struct cfgst *cfgst, void *parent, struct cfgelem const * const cfgelem, int is_default)
 {
-    int *p = cfg_address(cfgst, parent, cfgelem);
-    cfg_log(cfgst, "%s%s", *p ? "true" : "false", is_default ? " [def]" : "");
-}
-
-static void pf_negated_boolean(struct cfgst *cfgst, void *parent, struct cfgelem const * const cfgelem, int is_default)
-{
-    int *p = cfg_address(cfgst, parent, cfgelem);
-    cfg_log(cfgst, "%s%s", *p ? "false" : "true", is_default ? " [def]" : "");
+  int *p = cfg_address(cfgst, parent, cfgelem);
+  cfg_log(cfgst, "%s%s", *p ? "true" : "false", is_default ? " [def]" : "");
 }
 
 static int uf_standards_conformance(struct cfgst *cfgst, void *parent, struct cfgelem const * const cfgelem, UNUSED_ARG(int first), const char *value)
 {
-    static const char *vs[] = {
-        "pedantic", "strict", "lax", NULL
-    };
-    static const uint32_t lc[] = {
-        NN_SC_PEDANTIC, NN_SC_STRICT, NN_SC_LAX, 0
-    };
-    enum nn_standards_conformance *elem = cfg_address(cfgst, parent, cfgelem);
-    int idx = list_index(vs, value);
-    assert(sizeof(vs) / sizeof(*vs) == sizeof(lc) / sizeof(*lc));
-    if ( idx < 0 )
-        return cfg_error(cfgst, "'%s': undefined value", value);
-    else {
-        *elem = lc[idx];
-        return 1;
-    }
+  static const char *vs[] = {
+    "pedantic", "strict", "lax", NULL
+  };
+  static const uint32_t lc[] = {
+    NN_SC_PEDANTIC, NN_SC_STRICT, NN_SC_LAX, 0
+  };
+  enum nn_standards_conformance *elem = cfg_address(cfgst, parent, cfgelem);
+  int idx = list_index(vs, value);
+  assert(sizeof(vs) / sizeof(*vs) == sizeof(lc) / sizeof(*lc));
+  if ( idx < 0 )
+    return cfg_error(cfgst, "'%s': undefined value", value);
+  else {
+    *elem = lc[idx];
+    return 1;
+  }
 }
 
 static void pf_standards_conformance(struct cfgst *cfgst, void *parent, struct cfgelem const * const cfgelem, int is_default)
 {
-    enum nn_standards_conformance *p = cfg_address(cfgst, parent, cfgelem);
-    const char *str = "INVALID";
-    switch ( *p ) {
-        case NN_SC_PEDANTIC: str = "pedantic"; break;
-        case NN_SC_STRICT: str = "strict"; break;
-        case NN_SC_LAX: str = "lax"; break;
-    }
-    cfg_log(cfgst, "%s%s", str, is_default ? " [def]" : "");
+  enum nn_standards_conformance *p = cfg_address(cfgst, parent, cfgelem);
+  const char *str = "INVALID";
+  switch ( *p ) {
+    case NN_SC_PEDANTIC: str = "pedantic"; break;
+    case NN_SC_STRICT: str = "strict"; break;
+    case NN_SC_LAX: str = "lax"; break;
+  }
+  cfg_log(cfgst, "%s%s", str, is_default ? " [def]" : "");
 }
 
 static unsigned uint32_popcnt (uint32_t x)
 {
-    unsigned n = 0;
-    while (x != 0)
-    {
-        n += ((x & 1u) != 0);
-        x >>= 1;
-    }
-    return n;
+  unsigned n = 0;
+  while (x != 0)
+  {
+    n += ((x & 1u) != 0);
+    x >>= 1;
+  }
+  return n;
 }
 
 static void do_print_uint32_bitset (struct cfgst *cfgst, uint32_t mask, size_t ncodes, const char **names, const uint32_t *codes, const char *suffix)
 {
-    char res[256] = "", *resp = res;
-    const char *prefix = "";
+  char res[256] = "", *resp = res;
+  const char *prefix = "";
 #ifndef NDEBUG
-    {
-        size_t max = 0;
-        for (size_t i = 0; i < ncodes; i++ )
-            max += 1 + strlen(names[i]);
-        max += 11; /* ,0x%x */
-        max += 1; /* \0 */
-        assert(max <= sizeof(res));
-    }
+  {
+    size_t max = 0;
+    for (size_t i = 0; i < ncodes; i++ )
+      max += 1 + strlen(names[i]);
+    max += 11; /* ,0x%x */
+    max += 1; /* \0 */
+    assert(max <= sizeof(res));
+  }
 #endif
-    while (mask) {
-        size_t i_best = 0;
-        unsigned pc_best = 0;
-        for (size_t i = 0; i < ncodes; i++) {
-            uint32_t m = mask & codes[i];
-            if (m == codes[i]) {
-                unsigned pc = uint32_popcnt (m);
-                if (pc > pc_best) {
-                    i_best = i;
-                    pc_best = pc;
-                }
-            }
-        }
-        if (pc_best != 0) {
-            resp += snprintf(resp, 256, "%s%s", prefix, names[i_best]);
-            mask &= ~codes[i_best];
-            prefix = ",";
-        } else {
-            resp += snprintf (resp, 256, "%s0x%x", prefix, (unsigned) mask);
-            mask = 0;
+  while (mask) {
+    size_t i_best = 0;
+    unsigned pc_best = 0;
+    for (size_t i = 0; i < ncodes; i++) {
+      uint32_t m = mask & codes[i];
+      if (m == codes[i]) {
+        unsigned pc = uint32_popcnt (m);
+        if (pc > pc_best) {
+          i_best = i;
+          pc_best = pc;
         }
+      }
     }
-    assert (resp <= res + sizeof(res));
-    cfg_log (cfgst, "%s%s", res, suffix);
+    if (pc_best != 0) {
+      resp += snprintf(resp, 256, "%s%s", prefix, names[i_best]);
+      mask &= ~codes[i_best];
+      prefix = ",";
+    } else {
+      resp += snprintf (resp, 256, "%s0x%x", prefix, (unsigned) mask);
+      mask = 0;
+    }
+  }
+  assert (resp <= res + sizeof(res));
+  cfg_log (cfgst, "%s%s", res, suffix);
 }
 
 static void pf_logcat(struct cfgst *cfgst, UNUSED_ARG(void *parent), UNUSED_ARG(struct cfgelem const * const cfgelem), UNUSED_ARG(int is_default))
 {
-    /* can't do default indicator: user may have specified Verbosity, in
-       which case EnableCategory is at default, but for these two
-       settings, I don't mind. */
-    do_print_uint32_bitset (cfgst, config.enabled_logcats, sizeof(logcat_codes) / sizeof(*logcat_codes), logcat_names, logcat_codes, "");
+  /* can't do default indicator: user may have specified Verbosity, in
+     which case EnableCategory is at default, but for these two
+     settings, I don't mind. */
+  do_print_uint32_bitset (cfgst, config.enabled_logcats, sizeof(logcat_codes) / sizeof(*logcat_codes), logcat_names, logcat_codes, "");
 }
 
 static void pf_xcheck(struct cfgst *cfgst, void *parent, struct cfgelem const * const cfgelem, int is_default)
 {
-    const uint32_t *p = cfg_address(cfgst, parent, cfgelem);
+  const uint32_t *p = cfg_address(cfgst, parent, cfgelem);
 #ifndef NDEBUG
-    const char *suffix = is_default ? " [def]" : "";
+  const char *suffix = is_default ? " [def]" : "";
 #else
-    const char *suffix = " [ignored]";
-    (void)is_default;
+  const char *suffix = " [ignored]";
+  (void)is_default;
 #endif
-    do_print_uint32_bitset (cfgst, *p, sizeof(xcheck_codes) / sizeof(*xcheck_codes), xcheck_names, xcheck_codes, suffix);
+  do_print_uint32_bitset (cfgst, *p, sizeof(xcheck_codes) / sizeof(*xcheck_codes), xcheck_names, xcheck_codes, suffix);
 }
 
 static void print_configitems(struct cfgst *cfgst, void *parent, int isattr, struct cfgelem const * const cfgelem, int unchecked)
 {
-    const struct cfgelem *ce;
-    for ( ce = cfgelem; ce && ce->name; ce++ ) {
-        struct cfgst_nodekey key;
-        struct cfgst_node *n;
-        if ( ce->name[0] == '>' || ce->name[0] == '|') /* moved or deprecated, so don't care */
-            continue;
-        key.e = ce;
-        cfgst_push(cfgst, isattr, ce, parent);
-        if ( ce->multiplicity == 1 ) {
-            if ( (n = ddsrt_avl_lookup(&cfgst_found_treedef, &cfgst->found, &key)) != NULL ) {
-                cfgst_push(cfgst, 0, NULL, NULL);
-                ce->print(cfgst, parent, ce, n->is_default);
-                cfgst_pop(cfgst);
-            } else {
-                if ( unchecked && ce->print ) {
-                    cfgst_push(cfgst, 0, NULL, NULL);
-                    ce->print(cfgst, parent, ce, 0);
-                    cfgst_pop(cfgst);
-                }
-            }
+  const struct cfgelem *ce;
+  for ( ce = cfgelem; ce && ce->name; ce++ ) {
+    struct cfgst_nodekey key;
+    struct cfgst_node *n;
+    if ( ce->name[0] == '>' || ce->name[0] == '|') /* moved or deprecated, so don't care */
+      continue;
+    key.e = ce;
+    cfgst_push(cfgst, isattr, ce, parent);
+    if ( ce->multiplicity == 1 ) {
+      if ( (n = ddsrt_avl_lookup(&cfgst_found_treedef, &cfgst->found, &key)) != NULL ) {
+        cfgst_push(cfgst, 0, NULL, NULL);
+        ce->print(cfgst, parent, ce, n->is_default);
+        cfgst_pop(cfgst);
+      } else {
+        if ( unchecked && ce->print ) {
+          cfgst_push(cfgst, 0, NULL, NULL);
+          ce->print(cfgst, parent, ce, 0);
+          cfgst_pop(cfgst);
+        }
+      }
 
-            if ( ce->children )
-                print_configitems(cfgst, parent, 0, ce->children, unchecked);
-            if ( ce->attributes )
-                print_configitems(cfgst, parent, 1, ce->attributes, unchecked);
-        } else {
-            struct config_listelem *p = cfg_deref_address(cfgst, parent, ce);
-            while ( p ) {
-                cfgst_push(cfgst, 0, NULL, NULL);
-                if ( ce->print ) {
-                    ce->print(cfgst, p, ce, 0);
-                }
-                cfgst_pop(cfgst);
-                if ( ce->attributes )
-                    print_configitems(cfgst, p, 1, ce->attributes, 1);
-                if ( ce->children )
-                    print_configitems(cfgst, p, 0, ce->children, 1);
-                p = p->next;
-            }
+      if ( ce->children )
+        print_configitems(cfgst, parent, 0, ce->children, unchecked);
+      if ( ce->attributes )
+        print_configitems(cfgst, parent, 1, ce->attributes, unchecked);
+    } else {
+      struct config_listelem *p = cfg_deref_address(cfgst, parent, ce);
+      while ( p ) {
+        cfgst_push(cfgst, 0, NULL, NULL);
+        if ( ce->print ) {
+          ce->print(cfgst, p, ce, 0);
         }
         cfgst_pop(cfgst);
+        if ( ce->attributes )
+          print_configitems(cfgst, p, 1, ce->attributes, 1);
+        if ( ce->children )
+          print_configitems(cfgst, p, 0, ce->children, 1);
+        p = p->next;
+      }
     }
+    cfgst_pop(cfgst);
+  }
 }
 
 
 static void free_all_elements(struct cfgst *cfgst, void *parent, struct cfgelem const * const cfgelem)
 {
-    const struct cfgelem *ce;
+  const struct cfgelem *ce;
 
-    for ( ce = cfgelem; ce && ce->name; ce++ ) {
-        if ( ce->name[0] == '>' ) /* moved, so don't care */
-            continue;
+  for ( ce = cfgelem; ce && ce->name; ce++ ) {
+    if ( ce->name[0] == '>' ) /* moved, so don't care */
+      continue;
 
-        if ( ce->free )
-            ce->free(cfgst, parent, ce);
+    if ( ce->free )
+      ce->free(cfgst, parent, ce);
 
-        if ( ce->multiplicity == 1 ) {
-            if ( ce->children )
-                free_all_elements(cfgst, parent, ce->children);
-            if ( ce->attributes )
-                free_all_elements(cfgst, parent, ce->attributes);
-        } else {
-            struct config_listelem *p = cfg_deref_address(cfgst, parent, ce);
-            struct config_listelem *r;
-            while ( p ) {
-                if ( ce->attributes )
-                    free_all_elements(cfgst, p, ce->attributes);
-                if ( ce->children )
-                    free_all_elements(cfgst, p, ce->children);
-                r = p;
-                p = p->next;
-                ddsrt_free(r);
-            }
-        }
+    if ( ce->multiplicity == 1 ) {
+      if ( ce->children )
+        free_all_elements(cfgst, parent, ce->children);
+      if ( ce->attributes )
+        free_all_elements(cfgst, parent, ce->attributes);
+    } else {
+      struct config_listelem *p = cfg_deref_address(cfgst, parent, ce);
+      struct config_listelem *r;
+      while ( p ) {
+        if ( ce->attributes )
+          free_all_elements(cfgst, p, ce->attributes);
+        if ( ce->children )
+          free_all_elements(cfgst, p, ce->children);
+        r = p;
+        p = p->next;
+        ddsrt_free(r);
+      }
     }
+  }
 }
 
 static void free_configured_elements(struct cfgst *cfgst, void *parent, struct cfgelem const * const cfgelem)
 {
-    const struct cfgelem *ce;
-    for ( ce = cfgelem; ce && ce->name; ce++ ) {
-        struct cfgst_nodekey key;
-        struct cfgst_node *n;
-        if ( ce->name[0] == '>' ) /* moved, so don't care */
-            continue;
-        key.e = ce;
-        if ( (n = ddsrt_avl_lookup(&cfgst_found_treedef, &cfgst->found, &key)) != NULL ) {
-            if ( ce->free && n->count > n->failed )
-                ce->free(cfgst, parent, ce);
-        }
-
-        if ( ce->multiplicity == 1 ) {
-            if ( ce->children )
-                free_configured_elements(cfgst, parent, ce->children);
-            if ( ce->attributes )
-                free_configured_elements(cfgst, parent, ce->attributes);
-        } else {
-            struct config_listelem *p = cfg_deref_address(cfgst, parent, ce);
-            struct config_listelem *r;
-            while ( p ) {
-                if ( ce->attributes )
-                    free_all_elements(cfgst, p, ce->attributes);
-                if ( ce->children )
-                    free_all_elements(cfgst, p, ce->children);
-                r = p;
-                p = p->next;
-                ddsrt_free(r);
-            }
-        }
+  const struct cfgelem *ce;
+  for ( ce = cfgelem; ce && ce->name; ce++ ) {
+    struct cfgst_nodekey key;
+    struct cfgst_node *n;
+    if ( ce->name[0] == '>' ) /* moved, so don't care */
+      continue;
+    key.e = ce;
+    if ( (n = ddsrt_avl_lookup(&cfgst_found_treedef, &cfgst->found, &key)) != NULL ) {
+      if ( ce->free && n->count > n->failed )
+        ce->free(cfgst, parent, ce);
     }
+
+    if ( ce->multiplicity == 1 ) {
+      if ( ce->children )
+        free_configured_elements(cfgst, parent, ce->children);
+      if ( ce->attributes )
+        free_configured_elements(cfgst, parent, ce->attributes);
+    } else {
+      struct config_listelem *p = cfg_deref_address(cfgst, parent, ce);
+      struct config_listelem *r;
+      while ( p ) {
+        if ( ce->attributes )
+          free_all_elements(cfgst, p, ce->attributes);
+        if ( ce->children )
+          free_all_elements(cfgst, p, ce->children);
+        r = p;
+        p = p->next;
+        ddsrt_free(r);
+      }
+    }
+  }
 }
 
 static int matching_name_index(const char *name_w_aliases, const char *name)
 {
-    const char *ns = name_w_aliases, *p = strchr(ns, '|');
-    int idx = 0;
-    while ( p ) {
-        if ( ddsrt_strncasecmp(ns, name, (size_t) (p - ns)) == 0 && name[p - ns] == 0 ) {
-            /* ns upto the pipe symbol is a prefix of name, and name is terminated at that point */
-            return idx;
-        }
-        /* If primary name followed by '||' instead of '|', aliases are non-warning */
-        ns = p + 1 + (idx == 0 && p[1] == '|');
-        p = strchr(ns, '|');
-        idx++;
+  const char *ns = name_w_aliases, *p = strchr(ns, '|');
+  int idx = 0;
+  while ( p ) {
+    if ( ddsrt_strncasecmp(ns, name, (size_t) (p - ns)) == 0 && name[p - ns] == 0 ) {
+      /* ns upto the pipe symbol is a prefix of name, and name is terminated at that point */
+      return idx;
     }
-    return (ddsrt_strcasecmp(ns, name) == 0) ? idx : -1;
+    /* If primary name followed by '||' instead of '|', aliases are non-warning */
+    ns = p + 1 + (idx == 0 && p[1] == '|');
+    p = strchr(ns, '|');
+    idx++;
+  }
+  return (ddsrt_strcasecmp(ns, name) == 0) ? idx : -1;
 }
 
 static const struct cfgelem *lookup_redirect(const char *target)
 {
-    const struct cfgelem *cfgelem = ddsi2_cfgelems;
-    char *target_copy = ddsrt_strdup(target), *p1;
-    const char *p = target_copy;
-    while ( p ) {
-        p1 = strchr(p, '/');
-        if ( p1 ) *p1++ = 0;
-        for ( ; cfgelem->name; cfgelem++ ) {
-            /* not supporting multiple redirects */
-            assert(cfgelem->name[0] != '>');
-            if ( matching_name_index(cfgelem->name, p) >= 0 )
-                break;
-        }
-        if ( p1 ) {
-            cfgelem = cfgelem->children;
-        }
-        p = p1;
+  const struct cfgelem *cfgelem = ddsi2_cfgelems;
+  char *target_copy = ddsrt_strdup(target), *p1;
+  const char *p = target_copy;
+  while ( p ) {
+    p1 = strchr(p, '/');
+    if ( p1 ) *p1++ = 0;
+    for ( ; cfgelem->name; cfgelem++ ) {
+      /* not supporting multiple redirects */
+      assert(cfgelem->name[0] != '>');
+      if ( matching_name_index(cfgelem->name, p) >= 0 )
+        break;
     }
-    ddsrt_free(target_copy);
-    return cfgelem;
+    if ( p1 ) {
+      cfgelem = cfgelem->children;
+    }
+    p = p1;
+  }
+  ddsrt_free(target_copy);
+  return cfgelem;
 }
 
 static int proc_elem_open(void *varg, UNUSED_ARG(uintptr_t parentinfo), UNUSED_ARG(uintptr_t *eleminfo), const char *name)
 {
-    struct cfgst * const cfgst = varg;
-    const struct cfgelem *cfgelem = cfgst_tos(cfgst);
-    const struct cfgelem *cfg_subelem;
-    int moved = 0;
-    if ( cfgelem == NULL ) {
-        /* Ignoring, but do track the structure so we can know when to stop ignoring */
-        cfgst_push(cfgst, 0, NULL, NULL);
-        return 1;
-    }
-    for ( cfg_subelem = cfgelem->children; cfg_subelem && cfg_subelem->name && strcmp(cfg_subelem->name, "*") != 0; cfg_subelem++ ) {
-        const char *csename = cfg_subelem->name;
-        int idx;
-        moved = (csename[0] == '>');
-        if ( moved )
-            csename++;
-        idx = matching_name_index(csename, name);
+  struct cfgst * const cfgst = varg;
+  const struct cfgelem *cfgelem = cfgst_tos(cfgst);
+  const struct cfgelem *cfg_subelem;
+  int moved = 0;
+  if ( cfgelem == NULL ) {
+    /* Ignoring, but do track the structure so we can know when to stop ignoring */
+    cfgst_push(cfgst, 0, NULL, NULL);
+    return 1;
+  }
+  for ( cfg_subelem = cfgelem->children; cfg_subelem && cfg_subelem->name && strcmp(cfg_subelem->name, "*") != 0; cfg_subelem++ ) {
+    const char *csename = cfg_subelem->name;
+    int idx;
+    moved = (csename[0] == '>');
+    if ( moved )
+      csename++;
+    idx = matching_name_index(csename, name);
 #if WARN_DEPRECATED_ALIAS
-        if ( idx > 0 ) {
-            if (csename[0] == '|') {
-                cfg_warning(cfgst, "'%s': deprecated setting", name);
-            } else {
-                int n = (int) (strchr(csename, '|') - csename);
-                if ( csename[n + 1] != '|' ) {
-                    cfg_warning(cfgst, "'%s': deprecated alias for '%*.*s'", name, n, n, csename);
-                }
-            }
-        }
-#endif
-        if ( idx >= 0 ) {
-            break;
+    if ( idx > 0 ) {
+      if (csename[0] == '|') {
+        cfg_warning(cfgst, "'%s': deprecated setting", name);
+      } else {
+        int n = (int) (strchr(csename, '|') - csename);
+        if ( csename[n + 1] != '|' ) {
+          cfg_warning(cfgst, "'%s': deprecated alias for '%*.*s'", name, n, n, csename);
         }
+      }
     }
-    if ( cfg_subelem == NULL || cfg_subelem->name == NULL ) {
-        cfgst_push(cfgst, 0, NULL, NULL);
-        return cfg_error(cfgst, "%s: unknown element", name);
-    } else if ( strcmp(cfg_subelem->name, "*") == 0 ) {
-        /* Push a marker that we are to ignore this part of the DOM tree */
-        cfgst_push(cfgst, 0, NULL, NULL);
-        return 1;
-    } else {
-        void *parent, *dynparent;
+#endif
+    if ( idx >= 0 ) {
+      break;
+    }
+  }
+  if ( cfg_subelem == NULL || cfg_subelem->name == NULL ) {
+    cfgst_push(cfgst, 0, NULL, NULL);
+    return cfg_error(cfgst, "%s: unknown element", name);
+  } else if ( strcmp(cfg_subelem->name, "*") == 0 ) {
+    /* Push a marker that we are to ignore this part of the DOM tree */
+    cfgst_push(cfgst, 0, NULL, NULL);
+    return 1;
+  } else {
+    void *parent, *dynparent;
 
-        if ( moved ) {
+    if ( moved ) {
 #if WARN_DEPRECATED_ALIAS
-            cfg_warning(cfgst, "'%s': deprecated alias for '%s'", name, cfg_subelem->defvalue);
+      cfg_warning(cfgst, "'%s': deprecated alias for '%s'", name, cfg_subelem->defvalue);
 #endif
-            cfg_subelem = lookup_redirect(cfg_subelem->defvalue);
-        }
-
-        parent = cfgst_parent(cfgst);
-        assert(cfgelem->init || cfgelem->multiplicity == 1); /*multi-items must have an init-func */
-        if ( cfg_subelem->init ) {
-            if ( cfg_subelem->init(cfgst, parent, cfg_subelem) < 0 )
-                return 0;
-        }
-
-        if ( cfg_subelem->multiplicity != 1 )
-            dynparent = cfg_deref_address(cfgst, parent, cfg_subelem);
-        else
-            dynparent = parent;
-
-        cfgst_push(cfgst, 0, cfg_subelem, dynparent);
-        return 1;
+      cfg_subelem = lookup_redirect(cfg_subelem->defvalue);
     }
+
+    parent = cfgst_parent(cfgst);
+    assert(cfgelem->init || cfgelem->multiplicity == 1); /*multi-items must have an init-func */
+    if ( cfg_subelem->init ) {
+      if ( cfg_subelem->init(cfgst, parent, cfg_subelem) < 0 )
+        return 0;
+    }
+
+    if ( cfg_subelem->multiplicity != 1 )
+      dynparent = cfg_deref_address(cfgst, parent, cfg_subelem);
+    else
+      dynparent = parent;
+
+    cfgst_push(cfgst, 0, cfg_subelem, dynparent);
+    return 1;
+  }
 }
 
 static int proc_attr(void *varg, UNUSED_ARG(uintptr_t eleminfo), const char *name, const char *value)
 {
-    /* All attributes are processed immediately after opening the element */
-    struct cfgst * const cfgst = varg;
-    const struct cfgelem *cfgelem = cfgst_tos(cfgst);
-    const struct cfgelem *cfg_attr;
-    if ( cfgelem == NULL )
-        return 1;
-    for ( cfg_attr = cfgelem->attributes; cfg_attr && cfg_attr->name; cfg_attr++ ) {
-        if ( ddsrt_strcasecmp(cfg_attr->name, name) == 0 )
-            break;
-    }
-    if ( cfg_attr == NULL || cfg_attr->name == NULL )
-        return cfg_error(cfgst, "%s: unknown attribute", name);
-    else {
-        void *parent = cfgst_parent(cfgst);
-        char *xvalue = ddsrt_expand_envvars(value);
-        int ok;
-        cfgst_push(cfgst, 1, cfg_attr, parent);
-        ok = do_update(cfgst, cfg_attr->update, parent, cfg_attr, xvalue, 0);
-        cfgst_pop(cfgst);
-        ddsrt_free(xvalue);
-        return ok;
-    }
+  /* All attributes are processed immediately after opening the element */
+  struct cfgst * const cfgst = varg;
+  const struct cfgelem *cfgelem = cfgst_tos(cfgst);
+  const struct cfgelem *cfg_attr;
+  if ( cfgelem == NULL )
+    return 1;
+  for ( cfg_attr = cfgelem->attributes; cfg_attr && cfg_attr->name; cfg_attr++ ) {
+    if ( ddsrt_strcasecmp(cfg_attr->name, name) == 0 )
+      break;
+  }
+  if ( cfg_attr == NULL || cfg_attr->name == NULL )
+    return cfg_error(cfgst, "%s: unknown attribute", name);
+  else {
+    void *parent = cfgst_parent(cfgst);
+    char *xvalue = ddsrt_expand_envvars(value);
+    int ok;
+    cfgst_push(cfgst, 1, cfg_attr, parent);
+    ok = do_update(cfgst, cfg_attr->update, parent, cfg_attr, xvalue, 0);
+    cfgst_pop(cfgst);
+    ddsrt_free(xvalue);
+    return ok;
+  }
 }
 
 static int proc_elem_data(void *varg, UNUSED_ARG(uintptr_t eleminfo), const char *value)
 {
-    struct cfgst * const cfgst = varg;
-    const struct cfgelem *cfgelem = cfgst_tos(cfgst);
-    if ( cfgelem == NULL )
-        return 1;
-    if ( cfgelem->update == 0 )
-        return cfg_error(cfgst, "%s: no data expected", value);
-    else {
-        void *parent = cfgst_parent(cfgst);
-        char *xvalue = ddsrt_expand_envvars(value);
-        int ok;
-        cfgst_push(cfgst, 0, NULL, parent);
-        ok = do_update(cfgst, cfgelem->update, parent, cfgelem, xvalue, 0);
-        cfgst_pop(cfgst);
-        ddsrt_free(xvalue);
-        return ok;
-    }
+  struct cfgst * const cfgst = varg;
+  const struct cfgelem *cfgelem = cfgst_tos(cfgst);
+  if ( cfgelem == NULL )
+    return 1;
+  if ( cfgelem->update == 0 )
+    return cfg_error(cfgst, "%s: no data expected", value);
+  else {
+    void *parent = cfgst_parent(cfgst);
+    char *xvalue = ddsrt_expand_envvars(value);
+    int ok;
+    cfgst_push(cfgst, 0, NULL, parent);
+    ok = do_update(cfgst, cfgelem->update, parent, cfgelem, xvalue, 0);
+    cfgst_pop(cfgst);
+    ddsrt_free(xvalue);
+    return ok;
+  }
 }
 
 static int proc_elem_close(void *varg, UNUSED_ARG(uintptr_t eleminfo))
 {
-    struct cfgst * const cfgst = varg;
-    const struct cfgelem * cfgelem = cfgst_tos(cfgst);
-    int ok = 1;
-    if ( cfgelem && cfgelem->multiplicity != 1 ) {
-        void *parent = cfgst_parent(cfgst);
-        int ok1;
-        ok1 = set_defaults(cfgst, parent, 1, cfgelem->attributes, 1);
-        ok = ok && ok1;
-        ok1 = set_defaults(cfgst, parent, 0, cfgelem->children, 1);
-        ok = ok && ok1;
-    }
-    cfgst_pop(cfgst);
-    return ok;
+  struct cfgst * const cfgst = varg;
+  const struct cfgelem * cfgelem = cfgst_tos(cfgst);
+  int ok = 1;
+  if ( cfgelem && cfgelem->multiplicity != 1 ) {
+    void *parent = cfgst_parent(cfgst);
+    int ok1;
+    ok1 = set_defaults(cfgst, parent, 1, cfgelem->attributes, 1);
+    ok = ok && ok1;
+    ok1 = set_defaults(cfgst, parent, 0, cfgelem->children, 1);
+    ok = ok && ok1;
+  }
+  cfgst_pop(cfgst);
+  return ok;
 }
 
 static void proc_error(void *varg, const char *msg, int line)
 {
-    struct cfgst * const cfgst = varg;
-    cfg_error(cfgst, "parser error %s at line %d", msg, line);
+  struct cfgst * const cfgst = varg;
+  cfg_error(cfgst, "parser error %s at line %d", msg, line);
 }
 
 
 static int cfgst_node_cmp(const void *va, const void *vb)
 {
-    return memcmp(va, vb, sizeof(struct cfgst_nodekey));
+  return memcmp(va, vb, sizeof(struct cfgst_nodekey));
 }
 
 #ifdef DDSI_INCLUDE_NETWORK_CHANNELS
 static int set_default_channel(struct config *cfg)
 {
-    if ( cfg->channels == NULL ) {
-        /* create one default channel if none configured */
-        struct config_channel_listelem *c;
-        if ( (c = ddsrt_malloc(sizeof(*c))) == NULL )
-            return ERR_OUT_OF_MEMORY;
-        c->next = NULL;
-        c->name = ddsrt_strdup("user");
-        c->priority = 0;
-        c->resolution = 1 * T_MILLISECOND;
+  if ( cfg->channels == NULL ) {
+    /* create one default channel if none configured */
+    struct config_channel_listelem *c;
+    if ( (c = ddsrt_malloc(sizeof(*c))) == NULL )
+      return ERR_OUT_OF_MEMORY;
+    c->next = NULL;
+    c->name = ddsrt_strdup("user");
+    c->priority = 0;
+    c->resolution = 1 * T_MILLISECOND;
 #ifdef DDSI_INCLUDE_BANDWIDTH_LIMITING
-        c->data_bandwidth_limit = 0;
-        c->auxiliary_bandwidth_limit = 0;
+    c->data_bandwidth_limit = 0;
+    c->auxiliary_bandwidth_limit = 0;
 #endif
-        c->diffserv_field = 0;
-        c->channel_reader_ts = NULL;
-        c->queueId = 0;
-        c->dqueue = NULL;
-        c->evq = NULL;
-        c->transmit_conn = NULL;
-        cfg->channels = c;
-    }
-    return 0;
+    c->diffserv_field = 0;
+    c->channel_reader_ts = NULL;
+    c->queueId = 0;
+    c->dqueue = NULL;
+    c->evq = NULL;
+    c->transmit_conn = NULL;
+    cfg->channels = c;
+  }
+  return 0;
 }
 
 static int sort_channels_cmp(const void *va, const void *vb)
 {
-    const struct config_channel_listelem * const *a = va;
-    const struct config_channel_listelem * const *b = vb;
-    return ((*a)->priority == (*b)->priority) ? 0 : ((*a)->priority < (*b)->priority) ? -1 : 1;
+  const struct config_channel_listelem * const *a = va;
+  const struct config_channel_listelem * const *b = vb;
+  return ((*a)->priority == (*b)->priority) ? 0 : ((*a)->priority < (*b)->priority) ? -1 : 1;
 }
 
 static int sort_channels_check_nodups(struct config *cfg)
 {
-    /* Selecting a channel is much easier & more elegant if the channels
-    are sorted on descending priority.  While we do retain the list
-    structure, sorting is much easier in an array, and hence we
-    convert back and forth. */
-    struct config_channel_listelem **ary, *c;
-    unsigned i, n;
-    int result;
+  /* Selecting a channel is much easier & more elegant if the channels
+     are sorted on descending priority.  While we do retain the list
+     structure, sorting is much easier in an array, and hence we
+     convert back and forth. */
+  struct config_channel_listelem **ary, *c;
+  unsigned i, n;
+  int result;
 
-    n = 0;
-    for ( c = cfg->channels; c; c = c->next )
-        n++;
-    assert(n > 0);
+  n = 0;
+  for ( c = cfg->channels; c; c = c->next )
+    n++;
+  assert(n > 0);
 
-    ary = ddsrt_malloc(n * sizeof(*ary));
+  ary = ddsrt_malloc(n * sizeof(*ary));
 
-    i = 0;
-    for ( c = cfg->channels; c; c = c->next )
-        ary[i++] = c;
-    qsort(ary, n, sizeof(*ary), sort_channels_cmp);
+  i = 0;
+  for ( c = cfg->channels; c; c = c->next )
+    ary[i++] = c;
+  qsort(ary, n, sizeof(*ary), sort_channels_cmp);
 
-    result = 0;
-    for ( i = 0; i < n - 1; i++ ) {
-        if ( ary[i]->priority == ary[i + 1]->priority ) {
-            DDS_ERROR("config: duplicate channel definition for priority %u: channels %s and %s\n",
-                     ary[i]->priority, ary[i]->name, ary[i + 1]->name);
-            result = ERR_ENTITY_EXISTS;
-        }
+  result = 0;
+  for ( i = 0; i < n - 1; i++ ) {
+    if ( ary[i]->priority == ary[i + 1]->priority ) {
+      DDS_ERROR("config: duplicate channel definition for priority %u: channels %s and %s\n",
+                ary[i]->priority, ary[i]->name, ary[i + 1]->name);
+      result = ERR_ENTITY_EXISTS;
     }
+  }
 
-    if ( result == 0 ) {
-        cfg->channels = ary[0];
-        for ( i = 0; i < n - 1; i++ )
-            ary[i]->next = ary[i + 1];
-        ary[i]->next = NULL;
-        cfg->max_channel = ary[i];
-    }
+  if ( result == 0 ) {
+    cfg->channels = ary[0];
+    for ( i = 0; i < n - 1; i++ )
+      ary[i]->next = ary[i + 1];
+    ary[i]->next = NULL;
+    cfg->max_channel = ary[i];
+  }
 
-    ddsrt_free(ary);
-    return result;
+  ddsrt_free(ary);
+  return result;
 }
 #endif /* DDSI_INCLUDE_NETWORK_CHANNELS */
 
 struct cfgst * config_init (const char *configfile)
 {
-    int ok = 1;
-    struct cfgst *cfgst;
+  int ok = 1;
+  struct cfgst *cfgst;
 
-    memset(&config, 0, sizeof(config));
+  memset(&config, 0, sizeof(config));
 
-    config.tracingOutputFile = stderr;
-    config.enabled_logcats = DDS_LC_ERROR | DDS_LC_WARNING;
+  config.tracingOutputFile = stderr;
+  config.enabled_logcats = DDS_LC_ERROR | DDS_LC_WARNING;
 
-    /* eventually, we domainId.value will be the real domain id selected, even if it was configured
-       to the default of "any" and has "isdefault" set; initializing it to the default-default
-       value of 0 means "any" in the config & DDS_DOMAIN_DEFAULT in create participant automatically
-       ends up on the right value */
-    config.domainId.value = 0;
+  /* eventually, we domainId.value will be the real domain id selected, even if it was configured
+     to the default of "any" and has "isdefault" set; initializing it to the default-default
+     value of 0 means "any" in the config & DDS_DOMAIN_DEFAULT in create participant automatically
+     ends up on the right value */
+  config.domainId.value = 0;
 
-    cfgst = ddsrt_malloc(sizeof(*cfgst));
-    memset(cfgst, 0, sizeof(*cfgst));
+  cfgst = ddsrt_malloc(sizeof(*cfgst));
+  memset(cfgst, 0, sizeof(*cfgst));
 
-    ddsrt_avl_init(&cfgst_found_treedef, &cfgst->found);
-    cfgst->cfg = &config;
-    cfgst->error = 0;
+  ddsrt_avl_init(&cfgst_found_treedef, &cfgst->found);
+  cfgst->cfg = &config;
+  cfgst->error = 0;
 
-    /* configfile == NULL will get you the default configuration */
-    if (configfile) {
-        char *copy = ddsrt_strdup(configfile), *cursor = copy;
-        struct ddsrt_xmlp_callbacks cb;
+  /* configfile == NULL will get you the default configuration */
+  if (configfile) {
+    char *copy = ddsrt_strdup(configfile), *cursor = copy;
+    struct ddsrt_xmlp_callbacks cb;
 
-        cb.attr = proc_attr;
-        cb.elem_close = proc_elem_close;
-        cb.elem_data = proc_elem_data;
-        cb.elem_open = proc_elem_open;
-        cb.error = proc_error;
+    cb.attr = proc_attr;
+    cb.elem_close = proc_elem_close;
+    cb.elem_data = proc_elem_data;
+    cb.elem_open = proc_elem_open;
+    cb.error = proc_error;
 
-        while (ok && cursor && cursor[0]) {
-            struct ddsrt_xmlp_state *qx;
-            FILE *fp;
-            char *tok;
-            tok = cursor;
-            if (tok[0] == '<') {
-                /* Read XML directly from input string */
-                qx = ddsrt_xmlp_new_string (tok, cfgst, &cb);
-                ddsrt_xmlp_set_requireEOF (qx, 0);
-                fp = NULL;
-            } else {
-                char *comma;
-                if ((comma = strchr (cursor, ',')) == NULL) {
-                    cursor = NULL;
-                } else {
-                    *comma = 0;
-                    cursor = comma + 1;
-                }
-                DDSRT_WARNING_MSVC_OFF(4996);
-                if ((fp = fopen(tok, "r")) == NULL) {
-                    if (strncmp(tok, "file://", 7) != 0 || (fp = fopen(tok + 7, "r")) == NULL) {
-                        DDS_ERROR("can't open configuration file %s\n", tok);
-                        ddsrt_free(copy);
-                        ddsrt_free(cfgst);
-                        return NULL;
-                    }
-                }
-                DDSRT_WARNING_MSVC_ON(4996);
-                qx = ddsrt_xmlp_new_file(fp, cfgst, &cb);
-            }
-            cfgst_push(cfgst, 0, &root_cfgelem, &config);
-
-            ok = (ddsrt_xmlp_parse(qx) >= 0) && !cfgst->error;
-            /* Pop until stack empty: error handling is rather brutal */
-            assert(!ok || cfgst->path_depth == 1);
-            while (cfgst->path_depth > 0) {
-                cfgst_pop(cfgst);
-            }
-            if (fp) {
-                fclose(fp);
-            } else if (ok) {
-                cursor = tok + ddsrt_xmlp_get_bufpos (qx);
-            }
-            ddsrt_xmlp_free(qx);
-            while (cursor && cursor[0] == ',') {
-                cursor++;
-            }
+    while (ok && cursor && cursor[0]) {
+      struct ddsrt_xmlp_state *qx;
+      FILE *fp;
+      char *tok;
+      tok = cursor;
+      if (tok[0] == '<') {
+        /* Read XML directly from input string */
+        qx = ddsrt_xmlp_new_string (tok, cfgst, &cb);
+        ddsrt_xmlp_set_requireEOF (qx, 0);
+        fp = NULL;
+      } else {
+        char *comma;
+        if ((comma = strchr (cursor, ',')) == NULL) {
+          cursor = NULL;
+        } else {
+          *comma = 0;
+          cursor = comma + 1;
         }
-        ddsrt_free(copy);
-    }
+        DDSRT_WARNING_MSVC_OFF(4996);
+        if ((fp = fopen(tok, "r")) == NULL) {
+          if (strncmp(tok, "file://", 7) != 0 || (fp = fopen(tok + 7, "r")) == NULL) {
+            DDS_ERROR("can't open configuration file %s\n", tok);
+            ddsrt_free(copy);
+            ddsrt_free(cfgst);
+            return NULL;
+          }
+        }
+        DDSRT_WARNING_MSVC_ON(4996);
+        qx = ddsrt_xmlp_new_file(fp, cfgst, &cb);
+      }
+      cfgst_push(cfgst, 0, &root_cfgelem, &config);
 
-    /* Set defaults for everything not set that we have a default value
-       for, signal errors for things unset but without a default. */
-    {
-        int ok1 = set_defaults(cfgst, cfgst->cfg, 0, root_cfgelems, 0);
-        ok = ok && ok1;
+      ok = (ddsrt_xmlp_parse(qx) >= 0) && !cfgst->error;
+      /* Pop until stack empty: error handling is rather brutal */
+      assert(!ok || cfgst->path_depth == 1);
+      while (cfgst->path_depth > 0) {
+        cfgst_pop(cfgst);
+      }
+      if (fp) {
+        fclose(fp);
+      } else if (ok) {
+        cursor = tok + ddsrt_xmlp_get_bufpos (qx);
+      }
+      ddsrt_xmlp_free(qx);
+      while (cursor && cursor[0] == ',') {
+        cursor++;
+      }
     }
+    ddsrt_free(copy);
+  }
+
+  /* Set defaults for everything not set that we have a default value
+     for, signal errors for things unset but without a default. */
+  {
+    int ok1 = set_defaults(cfgst, cfgst->cfg, 0, root_cfgelems, 0);
+    ok = ok && ok1;
+  }
 
 
   /* Compatibility settings of IPv6, TCP -- a bit too complicated for
@@ -2887,7 +2741,7 @@ struct cfgst * config_init (const char *configfile)
           cfgst->cfg->transport_selector = (config.compat_use_ipv6 == BOOLDEF_TRUE) ? TRANS_TCP6 : TRANS_TCP;
         else
           cfgst->cfg->transport_selector = (config.compat_use_ipv6 == BOOLDEF_TRUE) ? TRANS_UDP6 : TRANS_UDP;
-        break;
+            break;
       case TRANS_TCP:
         ok1 = !(cfgst->cfg->compat_tcp_enable == BOOLDEF_FALSE || cfgst->cfg->compat_use_ipv6 == BOOLDEF_TRUE);
         break;
@@ -2912,200 +2766,200 @@ struct cfgst * config_init (const char *configfile)
   }
 
 #ifdef DDSI_INCLUDE_NETWORK_CHANNELS
-    /* Default channel gets set outside set_defaults -- a bit too
-    complicated for the poor framework */
+  /* Default channel gets set outside set_defaults -- a bit too
+     complicated for the poor framework */
 
-    if ( set_default_channel(cfgst->cfg) < 0 ) {
-        ok = 0;
-    }
-    if ( cfgst->cfg->channels && sort_channels_check_nodups(cfgst->cfg) < 0 ) {
-        ok = 0;
-    }
+  if ( set_default_channel(cfgst->cfg) < 0 ) {
+    ok = 0;
+  }
+  if ( cfgst->cfg->channels && sort_channels_check_nodups(cfgst->cfg) < 0 ) {
+    ok = 0;
+  }
 #endif
 
 #ifdef DDSI_INCLUDE_ENCRYPTION
-    /* Check security profiles */
-    {
-        struct config_securityprofile_listelem *s = config.securityProfiles;
-        while ( s ) {
-            switch ( s->cipher ) {
-                case Q_CIPHER_UNDEFINED:
-                case Q_CIPHER_NULL:
-                    /* nop */
-                    if ( s->key && strlen(s->key) > 0 ) {
-                        DDS_INFO("config: DDSI2Service/Security/SecurityProfile[@cipherkey]: %s: cipher key not required\n", s->key);
-                    }
-                    break;
+  /* Check security profiles */
+  {
+    struct config_securityprofile_listelem *s = config.securityProfiles;
+    while ( s ) {
+      switch ( s->cipher ) {
+        case Q_CIPHER_UNDEFINED:
+        case Q_CIPHER_NULL:
+          /* nop */
+          if ( s->key && strlen(s->key) > 0 ) {
+            DDS_INFO("config: DDSI2Service/Security/SecurityProfile[@cipherkey]: %s: cipher key not required\n", s->key);
+          }
+          break;
 
-                default:
-                    /* read the cipherkey if present */
-                    if ( !s->key || strlen(s->key) == 0 ) {
-                        DDS_ERROR("config: DDSI2Service/Security/SecurityProfile[@cipherkey]: cipher key missing\n");
-                        ok = 0;
-                    } else if ( q_security_plugin.valid_uri && !(q_security_plugin.valid_uri) (s->cipher, s->key) ) {
-                        DDS_ERROR("config: DDSI2Service/Security/SecurityProfile[@cipherkey]: %s : incorrect key\n", s->key);
-                        ok = 0;
-                    }
-            }
-            s = s->next;
-        }
+        default:
+          /* read the cipherkey if present */
+          if ( !s->key || strlen(s->key) == 0 ) {
+            DDS_ERROR("config: DDSI2Service/Security/SecurityProfile[@cipherkey]: cipher key missing\n");
+            ok = 0;
+          } else if ( q_security_plugin.valid_uri && !(q_security_plugin.valid_uri) (s->cipher, s->key) ) {
+            DDS_ERROR("config: DDSI2Service/Security/SecurityProfile[@cipherkey]: %s : incorrect key\n", s->key);
+            ok = 0;
+          }
+      }
+      s = s->next;
     }
+  }
 #endif /* DDSI_INCLUDE_ENCRYPTION */
 
 #ifdef DDSI_INCLUDE_NETWORK_PARTITIONS
-    /* Assign network partition ids */
+  /* Assign network partition ids */
 #ifdef DDSI_INCLUDE_ENCRYPTION
-    /* also create links from the network partitions to the
-    securityProfiles and signal errors if profiles do not exist */
+  /* also create links from the network partitions to the
+     securityProfiles and signal errors if profiles do not exist */
 #endif /* DDSI_INCLUDE_ENCRYPTION */
-    {
-        struct config_networkpartition_listelem *p = config.networkPartitions;
-        config.nof_networkPartitions = 0;
-        while ( p ) {
+  {
+    struct config_networkpartition_listelem *p = config.networkPartitions;
+    config.nof_networkPartitions = 0;
+    while ( p ) {
 #ifdef DDSI_INCLUDE_ENCRYPTION
-            if ( ddsrt_strcasecmp(p->profileName, "null") == 0 )
-                p->securityProfile = NULL;
-            else {
-                struct config_securityprofile_listelem *s = config.securityProfiles;
-                while ( s && ddsrt_strcasecmp(p->profileName, s->name) != 0 )
-                    s = s->next;
-                if ( s )
-                    p->securityProfile = s;
-                else {
-                    DDS_ERROR("config: DDSI2Service/Partitioning/NetworkPartitions/NetworkPartition[@securityprofile]: %s: unknown securityprofile\n", p->profileName);
-                    ok = 0;
-                }
-            }
-#endif /* DDSI_INCLUDE_ENCRYPTION */
-            config.nof_networkPartitions++;
-            /* also use crc32 just like native nw and ordinary ddsi2e, only
-            for interoperability because it is asking for trouble &
-            forces us to include a crc32 routine when we have md5
-            available anyway */
-            p->partitionId = config.nof_networkPartitions; /* starting at 1 */
-            p->partitionHash = crc32_calc(p->name, strlen(p->name));
-            p = p->next;
+      if ( ddsrt_strcasecmp(p->profileName, "null") == 0 )
+        p->securityProfile = NULL;
+      else {
+        struct config_securityprofile_listelem *s = config.securityProfiles;
+        while ( s && ddsrt_strcasecmp(p->profileName, s->name) != 0 )
+          s = s->next;
+        if ( s )
+          p->securityProfile = s;
+        else {
+          DDS_ERROR("config: DDSI2Service/Partitioning/NetworkPartitions/NetworkPartition[@securityprofile]: %s: unknown securityprofile\n", p->profileName);
+          ok = 0;
         }
+      }
+#endif /* DDSI_INCLUDE_ENCRYPTION */
+      config.nof_networkPartitions++;
+      /* also use crc32 just like native nw and ordinary ddsi2e, only
+         for interoperability because it is asking for trouble &
+         forces us to include a crc32 routine when we have md5
+         available anyway */
+      p->partitionId = config.nof_networkPartitions; /* starting at 1 */
+      p->partitionHash = crc32_calc(p->name, strlen(p->name));
+      p = p->next;
     }
+  }
 
-    /* Create links from the partitionmappings to the network partitions
-    and signal errors if partitions do not exist */
-    {
-        struct config_partitionmapping_listelem * m = config.partitionMappings;
-        while ( m ) {
-            struct config_networkpartition_listelem * p = config.networkPartitions;
-            while ( p && ddsrt_strcasecmp(m->networkPartition, p->name) != 0 ) {
-                p = p->next;
-            }
-            if ( p ) {
-                m->partition = p;
-            } else {
-                DDS_ERROR("config: DDSI2Service/Partitioning/PartitionMappings/PartitionMapping[@networkpartition]: %s: unknown partition\n", m->networkPartition);
-                ok = 0;
-            }
-            m = m->next;
-        }
+  /* Create links from the partitionmappings to the network partitions
+     and signal errors if partitions do not exist */
+  {
+    struct config_partitionmapping_listelem * m = config.partitionMappings;
+    while ( m ) {
+      struct config_networkpartition_listelem * p = config.networkPartitions;
+      while ( p && ddsrt_strcasecmp(m->networkPartition, p->name) != 0 ) {
+        p = p->next;
+      }
+      if ( p ) {
+        m->partition = p;
+      } else {
+        DDS_ERROR("config: DDSI2Service/Partitioning/PartitionMappings/PartitionMapping[@networkpartition]: %s: unknown partition\n", m->networkPartition);
+        ok = 0;
+      }
+      m = m->next;
     }
+  }
 #endif /* DDSI_INCLUDE_NETWORK_PARTITIONS */
 
-    /* Now switch to configured tracing settings */
-    config.enabled_logcats = enabled_logcats;
+  /* Now switch to configured tracing settings */
+  config.enabled_logcats = enabled_logcats;
 
-    if ( !ok ) {
-        free_configured_elements(cfgst, cfgst->cfg, root_cfgelems);
-    }
+  if ( !ok ) {
+    free_configured_elements(cfgst, cfgst->cfg, root_cfgelems);
+  }
 
-    if ( ok ) {
-        config.valid = 1;
-        return cfgst;
-    } else {
-        ddsrt_avl_free(&cfgst_found_treedef, &cfgst->found, ddsrt_free);
-        ddsrt_free(cfgst);
-        return NULL;
-    }
+  if ( ok ) {
+    config.valid = 1;
+    return cfgst;
+  } else {
+    ddsrt_avl_free(&cfgst_found_treedef, &cfgst->found, ddsrt_free);
+    ddsrt_free(cfgst);
+    return NULL;
+  }
 }
 
 void config_print_cfgst(struct cfgst *cfgst)
 {
-    if ( cfgst == NULL )
-        return;
-    print_configitems(cfgst, cfgst->cfg, 0, root_cfgelems, 0);
+  if ( cfgst == NULL )
+    return;
+  print_configitems(cfgst, cfgst->cfg, 0, root_cfgelems, 0);
 }
 
 void config_fini(struct cfgst *cfgst)
 {
-    assert(cfgst);
-    assert(cfgst->cfg == &config);
-    assert(config.valid);
+  assert(cfgst);
+  assert(cfgst->cfg == &config);
+  assert(config.valid);
 
-    free_all_elements(cfgst, cfgst->cfg, root_cfgelems);
-    dds_set_log_file(stderr);
-    dds_set_trace_file(stderr);
-    if (config.tracingOutputFile && config.tracingOutputFile != stdout && config.tracingOutputFile != stderr) {
-        fclose(config.tracingOutputFile);
-    }
-    memset(&config, 0, sizeof(config));
-    config.valid = 0;
+  free_all_elements(cfgst, cfgst->cfg, root_cfgelems);
+  dds_set_log_file(stderr);
+  dds_set_trace_file(stderr);
+  if (config.tracingOutputFile && config.tracingOutputFile != stdout && config.tracingOutputFile != stderr) {
+    fclose(config.tracingOutputFile);
+  }
+  memset(&config, 0, sizeof(config));
+  config.valid = 0;
 
-    ddsrt_avl_free(&cfgst_found_treedef, &cfgst->found, ddsrt_free);
-    ddsrt_free(cfgst);
+  ddsrt_avl_free(&cfgst_found_treedef, &cfgst->found, ddsrt_free);
+  ddsrt_free(cfgst);
 }
 
 #ifdef DDSI_INCLUDE_NETWORK_PARTITIONS
 static char *get_partition_search_pattern(const char *partition, const char *topic)
 {
-    size_t sz = strlen(partition) + strlen(topic) + 2;
-    char *pt = ddsrt_malloc(sz);
-    snprintf(pt, sz, "%s.%s", partition, topic);
-    return pt;
+  size_t sz = strlen(partition) + strlen(topic) + 2;
+  char *pt = ddsrt_malloc(sz);
+  snprintf(pt, sz, "%s.%s", partition, topic);
+  return pt;
 }
 
 struct config_partitionmapping_listelem *find_partitionmapping(const char *partition, const char *topic)
 {
-    char *pt = get_partition_search_pattern(partition, topic);
-    struct config_partitionmapping_listelem *pm;
-    for ( pm = config.partitionMappings; pm; pm = pm->next )
-        if ( WildcardOverlap(pt, pm->DCPSPartitionTopic) )
-            break;
-    ddsrt_free(pt);
-    return pm;
+  char *pt = get_partition_search_pattern(partition, topic);
+  struct config_partitionmapping_listelem *pm;
+  for ( pm = config.partitionMappings; pm; pm = pm->next )
+    if ( WildcardOverlap(pt, pm->DCPSPartitionTopic) )
+      break;
+  ddsrt_free(pt);
+  return pm;
 }
 
 struct config_networkpartition_listelem *find_networkpartition_by_id(uint32_t id)
 {
-    struct config_networkpartition_listelem *np;
-    for ( np = config.networkPartitions; np; np = np->next )
-        if ( np->partitionId == id )
-            return np;
-    return 0;
+  struct config_networkpartition_listelem *np;
+  for ( np = config.networkPartitions; np; np = np->next )
+    if ( np->partitionId == id )
+      return np;
+  return 0;
 }
 
 int is_ignored_partition(const char *partition, const char *topic)
 {
-    char *pt = get_partition_search_pattern(partition, topic);
-    struct config_ignoredpartition_listelem *ip;
-    for ( ip = config.ignoredPartitions; ip; ip = ip->next )
-        if ( WildcardOverlap(pt, ip->DCPSPartitionTopic) )
-            break;
-    ddsrt_free(pt);
-    return ip != NULL;
+  char *pt = get_partition_search_pattern(partition, topic);
+  struct config_ignoredpartition_listelem *ip;
+  for ( ip = config.ignoredPartitions; ip; ip = ip->next )
+    if ( WildcardOverlap(pt, ip->DCPSPartitionTopic) )
+      break;
+  ddsrt_free(pt);
+  return ip != NULL;
 }
 #endif /* DDSI_INCLUDE_NETWORK_PARTITIONS */
 
 #ifdef DDSI_INCLUDE_NETWORK_CHANNELS
 struct config_channel_listelem *find_channel(nn_transport_priority_qospolicy_t transport_priority)
 {
-    struct config_channel_listelem *c;
-    /* Channel selection is to use the channel with the lowest priority
-    not less than transport_priority, or else the one with the
-    highest priority. */
-    assert(config.channels != NULL);
-    assert(config.max_channel != NULL);
-    for ( c = config.channels; c; c = c->next ) {
-        assert(c->next == NULL || c->next->priority > c->priority);
-        if ( transport_priority.value <= c->priority )
-            return c;
-    }
-    return config.max_channel;
+  struct config_channel_listelem *c;
+  /* Channel selection is to use the channel with the lowest priority
+     not less than transport_priority, or else the one with the
+     highest priority. */
+  assert(config.channels != NULL);
+  assert(config.max_channel != NULL);
+  for ( c = config.channels; c; c = c->next ) {
+    assert(c->next == NULL || c->next->priority > c->priority);
+    if ( transport_priority.value <= c->priority )
+      return c;
+  }
+  return config.max_channel;
 }
 #endif /* DDSI_INCLUDE_NETWORK_CHANNELS */
diff --git a/src/core/ddsi/src/q_ddsi_discovery.c b/src/core/ddsi/src/q_ddsi_discovery.c
index 98e89f7..a6e32cd 100644
--- a/src/core/ddsi/src/q_ddsi_discovery.c
+++ b/src/core/ddsi/src/q_ddsi_discovery.c
@@ -1719,7 +1719,7 @@ int builtins_dqueue_handler (const struct nn_rsample_info *sampleinfo, const str
      from the submsg to always conform to that of the "Data"
      submessage regardless of the input. */
   msg = (Data_DataFrag_common_t *) NN_RMSG_PAYLOADOFF (fragchain->rmsg, NN_RDATA_SUBMSG_OFF (fragchain));
-  data_smhdr_flags = normalize_data_datafrag_flags (&msg->smhdr, config.buggy_datafrag_flags_mode);
+  data_smhdr_flags = normalize_data_datafrag_flags (&msg->smhdr);
   srcguid.prefix = sampleinfo->rst->src_guid_prefix;
   srcguid.entityid = msg->writerId;
 
diff --git a/src/core/ddsi/src/q_entity.c b/src/core/ddsi/src/q_entity.c
index beba3f8..53c0bc6 100644
--- a/src/core/ddsi/src/q_entity.c
+++ b/src/core/ddsi/src/q_entity.c
@@ -2657,39 +2657,11 @@ static void new_writer_guid_common_init (struct writer *wr, const struct ddsi_se
   {
     assert (wr->xqos->history.kind == NN_KEEP_LAST_HISTORY_QOS);
     assert (wr->xqos->durability.kind == NN_TRANSIENT_LOCAL_DURABILITY_QOS);
-    wr->aggressive_keep_last = 1;
-  }
-  else
-  {
-    wr->aggressive_keep_last = (config.aggressive_keep_last_whc && wr->xqos->history.kind == NN_KEEP_LAST_HISTORY_QOS);
   }
   wr->handle_as_transient_local = (wr->xqos->durability.kind == NN_TRANSIENT_LOCAL_DURABILITY_QOS);
   wr->include_keyhash =
     config.generate_keyhash &&
     ((wr->e.guid.entityid.u & NN_ENTITYID_KIND_MASK) == NN_ENTITYID_KIND_WRITER_WITH_KEY);
-  /* Startup mode causes the writer to treat data in its WHC as if
-     transient-local, for the first few seconds after startup of the
-     DDSI service. It is done for volatile reliable writers only
-     (which automatically excludes all builtin writers) or for all
-     writers except volatile best-effort & transient-local ones.
-
-     Which one to use depends on whether merge policies are in effect
-     in durability. If yes, then durability will take care of all
-     transient & persistent data; if no, DDSI discovery usually takes
-     too long and this'll save you.
-
-     Note: may still be cleared, if it turns out we are not maintaining
-     an index at all (e.g., volatile KEEP_ALL) */
-  if (config.startup_mode_full) {
-    wr->startup_mode = gv.startup_mode &&
-      (wr->xqos->durability.kind >= NN_TRANSIENT_DURABILITY_QOS ||
-       (wr->xqos->durability.kind == NN_VOLATILE_DURABILITY_QOS &&
-        wr->xqos->reliability.kind != NN_BEST_EFFORT_RELIABILITY_QOS));
-  } else {
-    wr->startup_mode = gv.startup_mode &&
-      (wr->xqos->durability.kind == NN_VOLATILE_DURABILITY_QOS &&
-       wr->xqos->reliability.kind != NN_BEST_EFFORT_RELIABILITY_QOS);
-  }
   wr->topic = ddsi_sertopic_ref (topic);
   wr->as = new_addrset ();
   wr->as_group = NULL;
@@ -2784,7 +2756,7 @@ static void new_writer_guid_common_init (struct writer *wr, const struct ddsi_se
   wr->lease_duration = T_NEVER; /* FIXME */
 
   wr->whc = whc;
-  if (wr->xqos->history.kind == NN_KEEP_LAST_HISTORY_QOS && wr->aggressive_keep_last)
+  if (wr->xqos->history.kind == NN_KEEP_LAST_HISTORY_QOS)
   {
     /* hdepth > 0 => "aggressive keep last", and in that case: why
        bother blocking for a slow receiver when the entire point of
@@ -3066,24 +3038,6 @@ int delete_writer (const struct nn_guid *guid)
   return 0;
 }
 
-void writer_exit_startup_mode (struct writer *wr)
-{
-  struct whc_node *deferred_free_list = NULL;
-  ddsrt_mutex_lock (&wr->e.lock);
-  if (wr->startup_mode)
-  {
-    unsigned cnt = 0;
-    struct whc_state whcst;
-    wr->startup_mode = 0;
-    cnt += remove_acked_messages (wr, &whcst, &deferred_free_list);
-    cnt += whc_downgrade_to_volatile (wr->whc, &whcst);
-    writer_clear_retransmitting (wr);
-    DDS_LOG(DDS_LC_DISCOVERY, "  "PGUIDFMT": dropped %u samples\n", PGUID(wr->e.guid), cnt);
-  }
-  ddsrt_mutex_unlock (&wr->e.lock);
-  whc_free_deferred_free_list (wr->whc, deferred_free_list);
-}
-
 uint64_t writer_instance_id (const struct nn_guid *guid)
 {
     struct entity_common *e;
diff --git a/src/core/ddsi/src/q_init.c b/src/core/ddsi/src/q_init.c
index c6e4a8f..add93b5 100644
--- a/src/core/ddsi/src/q_init.c
+++ b/src/core/ddsi/src/q_init.c
@@ -501,12 +501,6 @@ int rtps_config_prep (struct cfgst *cfgst)
     if (config.max_participants == 0)
       config.max_participants = 100;
   }
-  if (NN_STRICT_P)
-  {
-    /* Should not be sending invalid messages when strict */
-    config.respond_to_rti_init_zero_ack_with_invalid_heartbeat = 0;
-    config.acknack_numbits_emptyset = 1;
-  }
   if (config.max_queued_rexmit_bytes == 0)
   {
 #ifdef DDSI_INCLUDE_BANDWIDTH_LIMITING
@@ -1002,9 +996,6 @@ int rtps_init (void)
   }
 #endif
 
-  gv.startup_mode = (config.startup_mode_duration > 0) ? 1 : 0;
-  DDS_LOG(DDS_LC_CONFIG, "startup-mode: %s\n", gv.startup_mode ? "enabled" : "disabled");
-
   (ddsi_plugin.init_fn) ();
 
   gv.xmsgpool = nn_xmsgpool_new ();
@@ -1401,10 +1392,6 @@ int rtps_start (void)
   {
     create_thread (&gv.listen_ts, "listen", (uint32_t (*) (void *)) listen_thread, gv.listener);
   }
-  if (gv.startup_mode)
-  {
-    qxev_end_startup_mode (add_duration_to_mtime (now_mt (), config.startup_mode_duration));
-  }
   if (config.monitor_port >= 0)
   {
     gv.debmon = new_debug_monitor (config.monitor_port);
diff --git a/src/core/ddsi/src/q_receive.c b/src/core/ddsi/src/q_receive.c
index 5aae883..a706067 100644
--- a/src/core/ddsi/src/q_receive.c
+++ b/src/core/ddsi/src/q_receive.c
@@ -438,7 +438,6 @@ static int valid_Data (const struct receiver_state *rst, struct nn_rmsg *rmsg, D
 static int valid_DataFrag (const struct receiver_state *rst, struct nn_rmsg *rmsg, DataFrag_t *msg, size_t size, int byteswap, struct nn_rsample_info *sampleinfo, unsigned char **payloadp)
 {
   /* on success: sampleinfo->{rst,statusinfo,pt_wr_info_zoff,bswap,complex_qos} all set */
-  const int interpret_smhdr_flags_asif_data = config.buggy_datafrag_flags_mode;
   uint32_t payloadsz;
   nn_guid_t pwr_guid;
   unsigned char *ptr;
@@ -446,14 +445,6 @@ static int valid_DataFrag (const struct receiver_state *rst, struct nn_rmsg *rms
   if (size < sizeof (*msg))
     return 0; /* too small even for fixed fields */
 
-  if (interpret_smhdr_flags_asif_data)
-  {
-    /* D=1 && K=1 is invalid in this version of the protocol */
-    if ((msg->x.smhdr.flags & (DATA_FLAG_DATAFLAG | DATA_FLAG_KEYFLAG)) ==
-        (DATA_FLAG_DATAFLAG | DATA_FLAG_KEYFLAG))
-      return 0;
-  }
-
   if (byteswap)
   {
     msg->x.extraFlags = bswap2u (msg->x.extraFlags);
@@ -497,13 +488,6 @@ static int valid_DataFrag (const struct receiver_state *rst, struct nn_rmsg *rms
   if (sampleinfo->seq <= 0 && sampleinfo->seq != NN_SEQUENCE_NUMBER_UNKNOWN)
     return 0;
 
-  if (interpret_smhdr_flags_asif_data)
-  {
-    if ((msg->x.smhdr.flags & (DATA_FLAG_DATAFLAG | DATA_FLAG_KEYFLAG)) == 0)
-      /* may not fragment if not needed => surely _some_ payload must be present! */
-      return 0;
-  }
-
   /* QoS and/or payload, so octetsToInlineQos must be within the msg;
      since the serialized data and serialized parameter lists have a 4
      byte header, that one, too must fit */
@@ -607,36 +591,10 @@ static void force_heartbeat_to_peer (struct writer *wr, const struct whc_state *
     return;
   }
 
-  if (WHCST_ISEMPTY(whcst) && !config.respond_to_rti_init_zero_ack_with_invalid_heartbeat)
-  {
-    /* If WHC is empty, we send a Gap combined with a Heartbeat.  The
-       Gap reuses the latest sequence number (or consumes a new one if
-       the writer hasn't sent anything yet), therefore for the reader
-       it is as-if a Data submessage had once been sent with that
-       sequence number and it now receives an unsollicited response to
-       a NACK ... */
-    uint32_t bits = 0;
-    seqno_t seq;
-    if (wr->seq > 0)
-      seq = wr->seq;
-    else
-    {
-      /* never sent anything, pretend we did */
-      seq = wr->seq = 1;
-      UPDATE_SEQ_XMIT_LOCKED(wr, 1);
-    }
-    add_Gap (m, wr, prd, seq, seq+1, 1, &bits);
-    add_Heartbeat (m, wr, whcst, hbansreq, prd->e.guid.entityid, 1);
-    DDS_TRACE("force_heartbeat_to_peer: "PGUIDFMT" -> "PGUIDFMT" - whc empty, queueing gap #%"PRId64" + heartbeat for transmit\n",
-            PGUID (wr->e.guid), PGUID (prd->e.guid), seq);
-  }
-  else
-  {
-    /* Send a Heartbeat just to this peer */
-    add_Heartbeat (m, wr, whcst, hbansreq, prd->e.guid.entityid, 0);
-    DDS_TRACE("force_heartbeat_to_peer: "PGUIDFMT" -> "PGUIDFMT" - queue for transmit\n",
+  /* Send a Heartbeat just to this peer */
+  add_Heartbeat (m, wr, whcst, hbansreq, prd->e.guid.entityid, 0);
+  DDS_TRACE("force_heartbeat_to_peer: "PGUIDFMT" -> "PGUIDFMT" - queue for transmit\n",
             PGUID (wr->e.guid), PGUID (prd->e.guid));
-  }
   qxev_msg (wr->evq, m);
 }
 
@@ -1892,16 +1850,13 @@ static struct ddsi_serdata *extract_sample_from_data
   return sample;
 }
 
-unsigned char normalize_data_datafrag_flags (const SubmessageHeader_t *smhdr, int datafrag_as_data)
+unsigned char normalize_data_datafrag_flags (const SubmessageHeader_t *smhdr)
 {
   switch ((SubmessageKind_t) smhdr->submessageId)
   {
     case SMID_DATA:
       return smhdr->flags;
     case SMID_DATA_FRAG:
-      if (datafrag_as_data)
-        return smhdr->flags;
-      else
       {
         unsigned char common = smhdr->flags & DATA_FLAG_INLINE_QOS;
         Q_STATIC_ASSERT_CODE (DATA_FLAG_INLINE_QOS == DATAFRAG_FLAG_INLINE_QOS);
@@ -1955,7 +1910,7 @@ static int deliver_user_data (const struct nn_rsample_info *sampleinfo, const st
      DataFrag header, so for the fixed-position things that we're
      interested in here, both can be treated as Data submessages. */
   msg = (Data_DataFrag_common_t *) NN_RMSG_PAYLOADOFF (fragchain->rmsg, NN_RDATA_SUBMSG_OFF (fragchain));
-  data_smhdr_flags = normalize_data_datafrag_flags (&msg->smhdr, config.buggy_datafrag_flags_mode);
+  data_smhdr_flags = normalize_data_datafrag_flags (&msg->smhdr);
 
   /* Extract QoS's to the extent necessary.  The expected case has all
      we need predecoded into a few bits in the sample info.
diff --git a/src/core/ddsi/src/q_transmit.c b/src/core/ddsi/src/q_transmit.c
index 3a208ba..cc086a6 100644
--- a/src/core/ddsi/src/q_transmit.c
+++ b/src/core/ddsi/src/q_transmit.c
@@ -352,13 +352,8 @@ void add_Heartbeat (struct nn_xmsg *msg, struct writer *wr, const struct whc_sta
        We're not really allowed to generate heartbeats when the WHC is
        empty, but it appears RTI sort-of needs them ...  Now we use
        GAPs, and allocate a sequence number specially for that. */
-    assert (config.respond_to_rti_init_zero_ack_with_invalid_heartbeat || wr->seq >= 1);
     max = wr->seq;
-    min = max;
-    if (config.respond_to_rti_init_zero_ack_with_invalid_heartbeat)
-    {
-      min += 1;
-    }
+    min = max + 1;
   }
   else
   {
@@ -378,14 +373,9 @@ void add_Heartbeat (struct nn_xmsg *msg, struct writer *wr, const struct whc_sta
       if (seq_xmit >= min) {
         /* Advertise some but not all data */
         max = seq_xmit;
-      } else if (config.respond_to_rti_init_zero_ack_with_invalid_heartbeat) {
+      } else {
         /* if we can generate an empty heartbeat => do so. */
         max = min - 1;
-      } else {
-        /* claim the existence of a sample we possibly haven't set
-           yet, at worst this causes a retransmission (but the
-           NackDelay usually takes care of that). */
-        max = min;
       }
     }
   }
@@ -484,10 +474,7 @@ int create_fragment_message (struct writer *wr, seqno_t seq, const struct nn_pli
      Note: fragnum is 0-based here, 1-based in DDSI. But 0-based is
      much easier ...
 
-     Expected inline QoS size: header(4) + statusinfo(8) + keyhash(20)
-     + sentinel(4). Plus some spare cos I can't be bothered. */
-  const int set_smhdr_flags_asif_data = config.buggy_datafrag_flags_mode;
-  /* actual expected_inline_qos_size is typically 0, but always claiming 32 bytes won't make
+     actual expected_inline_qos_size is typically 0, but always claiming 32 bytes won't make
      a difference, so no point in being precise */
   const size_t expected_inline_qos_size = /* statusinfo */ 8 + /* keyhash */ 20 + /* sentinel */ 4;
   struct nn_xmsg_marker sm_marker;
@@ -569,10 +556,7 @@ int create_fragment_message (struct writer *wr, seqno_t seq, const struct nn_pli
   }
   else
   {
-    const unsigned char contentflag =
-      set_smhdr_flags_asif_data
-      ? (serdata->kind == SDK_KEY ? DATA_FLAG_KEYFLAG : DATA_FLAG_DATAFLAG)
-      : (serdata->kind == SDK_KEY ? DATAFRAG_FLAG_KEYFLAG : 0);
+    const unsigned char contentflag = (serdata->kind == SDK_KEY ? DATAFRAG_FLAG_KEYFLAG : 0);
     DataFrag_t *frag = sm;
     /* empty means size = 0, which means it never needs fragmenting */
     assert (serdata->kind != SDK_EMPTY);
@@ -887,7 +871,7 @@ static int insert_sample_in_whc (struct writer *wr, seqno_t seq, struct nn_plist
 
   if (wr->reliable && have_reliable_subs (wr))
     do_insert = 1;
-  else if (wr->handle_as_transient_local || wr->startup_mode)
+  else if (wr->handle_as_transient_local)
     do_insert = 1;
   else
     do_insert = 0;
@@ -1041,7 +1025,7 @@ static int write_sample_eot (struct thread_state1 * const ts1, struct nn_xpack *
   nn_mtime_t tnow;
 
   /* If GC not allowed, we must be sure to never block when writing.  That is only the case for (true, aggressive) KEEP_LAST writers, and also only if there is no limit to how much unacknowledged data the WHC may contain. */
-  assert(gc_allowed || (wr->xqos->history.kind == NN_KEEP_LAST_HISTORY_QOS && wr->aggressive_keep_last && wr->whc_low == INT32_MAX));
+  assert(gc_allowed || (wr->xqos->history.kind == NN_KEEP_LAST_HISTORY_QOS && wr->whc_low == INT32_MAX));
   (void)gc_allowed;
 
   if (ddsi_serdata_size (serdata) > config.max_sample_size)
diff --git a/src/core/ddsi/src/q_xevent.c b/src/core/ddsi/src/q_xevent.c
index e4b107b..dc959c0 100644
--- a/src/core/ddsi/src/q_xevent.c
+++ b/src/core/ddsi/src/q_xevent.c
@@ -63,7 +63,6 @@ enum xeventkind
   XEVK_ACKNACK,
   XEVK_SPDP,
   XEVK_PMD_UPDATE,
-  XEVK_END_STARTUP_MODE,
   XEVK_DELETE_WRITER,
   XEVK_CALLBACK
 };
@@ -93,10 +92,6 @@ struct xevent
 #if 0
     struct {
     } info;
-#endif
-#if 0
-    struct {
-    } end_startup_mode;
 #endif
     struct {
       nn_guid_t guid;
@@ -312,7 +307,6 @@ static void free_xevent (struct xeventq *evq, struct xevent *ev)
       case XEVK_ACKNACK:
       case XEVK_SPDP:
       case XEVK_PMD_UPDATE:
-      case XEVK_END_STARTUP_MODE:
       case XEVK_DELETE_WRITER:
       case XEVK_CALLBACK:
         break;
@@ -805,15 +799,6 @@ static void add_AckNack (struct nn_xmsg *msg, struct proxy_writer *pwr, struct p
     an->smhdr.flags |= ACKNACK_FLAG_FINAL;
   }
 
-  /* If we refuse to send invalid AckNacks, grow a length-0 bitmap and
-     zero-fill it. Cleared bits are meaningless (DDSI 2.1, table 8.33,
-     although RTI seems to think otherwise). */
-  if (numbits == 0 && config.acknack_numbits_emptyset > 0)
-  {
-    an->readerSNState.numbits = (unsigned) config.acknack_numbits_emptyset;
-    nn_bitset_zero (an->readerSNState.numbits, an->readerSNState.bits);
-  }
-
   {
     /* Count field is at a variable offset ... silly DDSI spec. */
     nn_count_t *countp =
@@ -1195,21 +1180,6 @@ static void handle_xevk_pmd_update (struct thread_state1 * const ts1, struct nn_
   ddsrt_mutex_unlock (&pp->e.lock);
 }
 
-static void handle_xevk_end_startup_mode (UNUSED_ARG (struct nn_xpack *xp), struct xevent *ev, UNUSED_ARG (nn_mtime_t tnow))
-{
-  struct ephash_enum_writer est;
-  struct writer *wr;
-  assert (gv.startup_mode);
-  DDS_LOG(DDS_LC_DISCOVERY, "end startup mode\n");
-  gv.startup_mode = 0;
-  /* FIXME: MEMBAR needed for startup mode (or use a lock) */
-  ephash_enum_writer_init (&est);
-  while ((wr = ephash_enum_writer_next (&est)) != NULL)
-    writer_exit_startup_mode (wr);
-  ephash_enum_writer_fini (&est);
-  delete_xevent (ev);
-}
-
 static void handle_xevk_delete_writer (UNUSED_ARG (struct nn_xpack *xp), struct xevent *ev, UNUSED_ARG (nn_mtime_t tnow))
 {
   /* don't worry if the writer is already gone by the time we get here. */
@@ -1234,9 +1204,6 @@ static void handle_individual_xevent (struct thread_state1 * const ts1, struct x
     case XEVK_PMD_UPDATE:
       handle_xevk_pmd_update (ts1, xp, xev, tnow);
       break;
-    case XEVK_END_STARTUP_MODE:
-      handle_xevk_end_startup_mode (xp, xev, tnow);
-      break;
     case XEVK_DELETE_WRITER:
       handle_xevk_delete_writer (xp, xev, tnow);
       break;
@@ -1582,16 +1549,6 @@ struct xevent *qxev_pmd_update (nn_mtime_t tsched, const nn_guid_t *pp_guid)
   return ev;
 }
 
-struct xevent *qxev_end_startup_mode (nn_mtime_t tsched)
-{
-  struct xevent *ev;
-  ddsrt_mutex_lock (&gv.xevents->lock);
-  ev = qxev_common (gv.xevents, tsched, XEVK_END_STARTUP_MODE);
-  qxev_insert (ev);
-  ddsrt_mutex_unlock (&gv.xevents->lock);
-  return ev;
-}
-
 struct xevent *qxev_delete_writer (nn_mtime_t tsched, const nn_guid_t *guid)
 {
   struct xevent *ev;

From 941259554ada2778a52cfa2892ab2f684993e31f Mon Sep 17 00:00:00 2001
From: Erik Boasson <eb@ilities.com>
Date: Sat, 4 May 2019 13:50:02 +0800
Subject: [PATCH 059/238] remove Internal/SuppressSPDPMulticast setting

The Internal/SuppressSPDPMulticast setting was one of several ways to
prevent the sending of participant discovery multicast messages while
still allowing multicast to be used for data communications.  That
functionality has long since been subsumed by the AllowMulticast setting
(AllowMulticast = spdp,amc & Internal/SuppressSPDPMulticast is
equivalent to AllowMulticast = amc).

Signed-off-by: Erik Boasson <eb@ilities.com>
---
 src/core/ddsi/include/dds/ddsi/q_config.h |  1 -
 src/core/ddsi/src/q_config.c              |  5 +----
 src/core/ddsi/src/q_ddsi_discovery.c      |  2 +-
 src/core/ddsi/src/q_init.c                | 17 +++--------------
 4 files changed, 5 insertions(+), 20 deletions(-)

diff --git a/src/core/ddsi/include/dds/ddsi/q_config.h b/src/core/ddsi/include/dds/ddsi/q_config.h
index 50ceb51..08f3d6e 100644
--- a/src/core/ddsi/include/dds/ddsi/q_config.h
+++ b/src/core/ddsi/include/dds/ddsi/q_config.h
@@ -331,7 +331,6 @@ struct config
   enum besmode besmode;
   int conservative_builtin_reader_startup;
   int meas_hb_to_ack_latency;
-  int suppress_spdp_multicast;
   int unicast_response_to_spdp_messages;
   int synchronous_delivery_priority_threshold;
   int64_t synchronous_delivery_latency_bound;
diff --git a/src/core/ddsi/src/q_config.c b/src/core/ddsi/src/q_config.c
index 6c22b64..39ae17b 100644
--- a/src/core/ddsi/src/q_config.c
+++ b/src/core/ddsi/src/q_config.c
@@ -245,7 +245,7 @@ static const struct cfgelem general_cfgelems[] = {
 <p>It is a comma-separated list of some of the following keywords: \"spdp\", \"asm\", \"ssm\", or either of \"false\" or \"true\".</p>\n\
 <ul>\n\
 <li><i>spdp</i>: enables the use of ASM (any-source multicast) for participant discovery, joining the multicast group on the discovery socket, transmitting SPDP messages to this group, but never advertising nor using any multicast address in any discovery message, thus forcing unicast communications for all endpoint discovery and user data.</li>\n\
-<li><i>asm</i>: enables the use of ASM for all traffic (including SPDP)</li>\n\
+<li><i>asm</i>: enables the use of ASM for all traffic, including receiving SPDP but not transmitting SPDP messages via multicast</li>\n\
 <li><i>ssm</i>: enables the use of SSM (source-specific multicast) for all non-SPDP traffic (if supported)</li>\n\
 </ul>\n\
 <p>When set to \"false\" all multicasting is disabled. The default, \"true\" enables full use of multicasts. Listening for multicasts can be controlled by General/MulticastRecvNetworkInterfaceAddresses.</p>") },
@@ -531,9 +531,6 @@ static const struct cfgelem unsupp_cfgelems[] = {
 <p>Should it be necessary to hide DDSI2E's shared discovery behaviour, set this to <i>true</i> and Internal/BuiltinEndpointSet to <i>full</i>.</p>") },
   { LEAF("MeasureHbToAckLatency"), 1, "false", ABSOFF(meas_hb_to_ack_latency), 0, uf_boolean, 0, pf_boolean,
     BLURB("<p>This element enables heartbeat-to-ack latency among DDSI2E services by prepending timestamps to Heartbeat and AckNack messages and calculating round trip times. This is non-standard behaviour. The measured latencies are quite noisy and are currently not used anywhere.</p>") },
-  { LEAF("SuppressSPDPMulticast"), 1, "false", ABSOFF(suppress_spdp_multicast), 0, uf_boolean, 0, pf_boolean,
-    BLURB("<p>The element controls whether the mandatory multicasting of the participant discovery packets occurs. Completely disabling multicasting requires this element be set to <i>true</i>, and generally requires explicitly listing peers to ping for unicast discovery.</p>\n\
-<p>See also General/AllowMulticast.</p>") },
   { LEAF("UnicastResponseToSPDPMessages"), 1, "true", ABSOFF(unicast_response_to_spdp_messages), 0, uf_boolean, 0, pf_boolean,
     BLURB("<p>This element controls whether the response to a newly discovered participant is sent as a unicasted SPDP packet, instead of rescheduling the periodic multicasted one. There is no known benefit to setting this to <i>false</i>.</p>") },
   { LEAF("SynchronousDeliveryPriorityThreshold"), 1, "0", ABSOFF(synchronous_delivery_priority_threshold), 0, uf_int, 0, pf_int,
diff --git a/src/core/ddsi/src/q_ddsi_discovery.c b/src/core/ddsi/src/q_ddsi_discovery.c
index a6e32cd..8a75416 100644
--- a/src/core/ddsi/src/q_ddsi_discovery.c
+++ b/src/core/ddsi/src/q_ddsi_discovery.c
@@ -160,7 +160,7 @@ static int get_locator (nn_locator_t *loc, const nn_locators_t *locs, int uc_sam
 
 static void maybe_add_pp_as_meta_to_as_disc (const struct addrset *as_meta)
 {
-  if (addrset_empty_mc (as_meta))
+  if (addrset_empty_mc (as_meta) || !(config.allowMulticast & AMC_SPDP))
   {
     nn_locator_t loc;
     if (addrset_any_uc (as_meta, &loc))
diff --git a/src/core/ddsi/src/q_init.c b/src/core/ddsi/src/q_init.c
index add93b5..2c4601d 100644
--- a/src/core/ddsi/src/q_init.c
+++ b/src/core/ddsi/src/q_init.c
@@ -313,11 +313,6 @@ static int set_spdp_address (void)
     return -1;
   }
 #endif
-  if (!(config.allowMulticast & AMC_SPDP) || config.suppress_spdp_multicast)
-  {
-    /* Explicitly disabling SPDP multicasting is always possible */
-    set_unspec_locator (&gv.loc_spdp_mc);
-  }
   return 0;
 }
 
@@ -331,11 +326,6 @@ static int set_default_mc_address (void)
     return rc;
   else if (rc == 0)
     gv.loc_default_mc = gv.loc_spdp_mc;
-  if (!(config.allowMulticast & ~AMC_SPDP))
-  {
-    /* no multicasting beyond SPDP */
-    set_unspec_locator (&gv.loc_default_mc);
-  }
   gv.loc_meta_mc = gv.loc_default_mc;
   return 0;
 }
@@ -791,7 +781,7 @@ static int setup_and_start_recv_threads (void)
   gv.recv_threads[0].arg.mode = RTM_MANY;
   if (gv.m_factory->m_connless && config.many_sockets_mode != MSM_NO_UNICAST && config.multiple_recv_threads)
   {
-    if (ddsi_is_mcaddr (&gv.loc_default_mc) && !ddsi_is_ssm_mcaddr (&gv.loc_default_mc))
+    if (ddsi_is_mcaddr (&gv.loc_default_mc) && !ddsi_is_ssm_mcaddr (&gv.loc_default_mc) && (config.allowMulticast & AMC_ASM))
     {
       /* Multicast enabled, but it isn't an SSM address => handle data multicasts on a separate thread (the trouble with SSM addresses is that we only join matching writers, which our own sockets typically would not be) */
       gv.recv_threads[gv.n_recv_threads].name = "recvMC";
@@ -911,7 +901,6 @@ int rtps_init (void)
       config.publish_uc_locators = (config.tcp_port != -1);
       config.enable_uc_locators = 1;
       /* TCP affects what features are supported/required */
-      config.suppress_spdp_multicast = 1;
       config.many_sockets_mode = MSM_SINGLE_UNICAST;
       config.allowMulticast = AMC_FALSE;
       if (ddsi_tcp_init () < 0)
@@ -940,7 +929,6 @@ int rtps_init (void)
     if (!gv.interfaces[gv.selected_interface].mc_capable)
     {
       DDS_WARNING("selected interface is not multicast-capable: disabling multicast\n");
-      config.suppress_spdp_multicast = 1;
       config.allowMulticast = AMC_FALSE;
       /* ensure discovery can work: firstly, that the process will be reachable on a "well-known" port
          number, and secondly, that the local interface's IP address gets added to the discovery
@@ -1234,7 +1222,8 @@ int rtps_init (void)
   );
 
   gv.as_disc = new_addrset ();
-  add_to_addrset (gv.as_disc, &gv.loc_spdp_mc);
+  if (config.allowMulticast & AMC_SPDP)
+    add_to_addrset (gv.as_disc, &gv.loc_spdp_mc);
   /* If multicast was enabled but not available, always add the local interface to the discovery address set.
      Conversion via string and add_peer_addresses has the benefit that the port number expansion happens
      automatically. */

From af626a91dd5385ae3f96ed18fc0e3064da277aa9 Mon Sep 17 00:00:00 2001
From: Erik Boasson <eb@ilities.com>
Date: Sat, 4 May 2019 14:42:05 +0800
Subject: [PATCH 060/238] Move CycloneDDS/DDSI2E/* to CycloneDDS/* in config

The entirely historical "DDSI2E" element within the CycloneDDS
configuration element is herewith eliminated.  All settings contained in
that element (such as General, Discovery, Tracing) are now subelements
of the CycloneDDS top-level element.  Old configurations continue to
work but will print a deprecation warning:

  //CycloneDDS/DDSI2E: settings moved to //CycloneDDS

Any warnings/errors related for an element //CycloneDDS/DDSI2E/x will be
reported as errors for the new location, that is, for //CycloneDDS/x.
As the "settings moved" warning always precedes any other such warning,
confusion will hopefully be avoided.

Signed-off-by: Erik Boasson <eb@ilities.com>
---
 src/core/ddsc/tests/config_simple_udp.xml   | 36 ++++++-------
 src/core/ddsi/src/q_config.c                | 57 ++++++++++++---------
 src/mpt/tests/basic/etc/config_any.xml      | 26 +++++-----
 src/mpt/tests/basic/etc/config_specific.xml | 26 +++++-----
 4 files changed, 74 insertions(+), 71 deletions(-)

diff --git a/src/core/ddsc/tests/config_simple_udp.xml b/src/core/ddsc/tests/config_simple_udp.xml
index f96c737..52eb377 100644
--- a/src/core/ddsc/tests/config_simple_udp.xml
+++ b/src/core/ddsc/tests/config_simple_udp.xml
@@ -16,23 +16,21 @@
   <Domain>
     <Id>3</Id>
   </Domain>
-  <DDSI2E>
-    <General>
-      <NetworkInterfaceAddress>127.0.0.1</NetworkInterfaceAddress>
-      <AllowMulticast>true</AllowMulticast>
-      <EnableMulticastLoopback>true</EnableMulticastLoopback>
-    </General>
-    <Compatibility>
-      <StandardsConformance>lax</StandardsConformance>
-    </Compatibility>
-    <Tracing>
-      <Verbosity>warning</Verbosity>
-      <OutputFile>&#118;&#x6F;rtexdds-<![CDATA[trace]]>.${NON_EXISTENT_ENV_VARIABLE:-l}${CYCLONEDDS_URI:+o}g </OutputFile>
-    </Tracing>
-    <Internal>
-      <MaxParticipants>${MAX_PARTICIPANTS}</MaxParticipants>
-      <HeartbeatInterval max="10 s"> 100 ms </HeartbeatInterval>
-      <RediscoveryBlacklistDuration></RediscoveryBlacklistDuration>
-    </Internal>
-  </DDSI2E>
+  <General>
+    <NetworkInterfaceAddress>127.0.0.1</NetworkInterfaceAddress>
+    <AllowMulticast>true</AllowMulticast>
+    <EnableMulticastLoopback>true</EnableMulticastLoopback>
+  </General>
+  <Compatibility>
+    <StandardsConformance>lax</StandardsConformance>
+  </Compatibility>
+  <Tracing>
+    <Verbosity>warning</Verbosity>
+    <OutputFile>&#118;&#x6F;rtexdds-<![CDATA[trace]]>.${NON_EXISTENT_ENV_VARIABLE:-l}${CYCLONEDDS_URI:+o}g </OutputFile>
+  </Tracing>
+  <Internal>
+    <MaxParticipants>${MAX_PARTICIPANTS}</MaxParticipants>
+    <HeartbeatInterval max="10 s"> 100 ms </HeartbeatInterval>
+    <RediscoveryBlacklistDuration></RediscoveryBlacklistDuration>
+  </Internal>
 </CycloneDDS>
diff --git a/src/core/ddsi/src/q_config.c b/src/core/ddsi/src/q_config.c
index 39ae17b..d9c37db 100644
--- a/src/core/ddsi/src/q_config.c
+++ b/src/core/ddsi/src/q_config.c
@@ -508,8 +508,8 @@ static const struct cfgelem multiple_recv_threads_attrs[] = {
 };
 
 static const struct cfgelem unsupp_cfgelems[] = {
-  { MOVED("MaxMessageSize", "General/MaxMessageSize") },
-  { MOVED("FragmentSize", "General/FragmentSize") },
+  { MOVED("MaxMessageSize", "CycloneDDS/General/MaxMessageSize") },
+  { MOVED("FragmentSize", "CycloneDDS/General/FragmentSize") },
   { LEAF("DeliveryQueueMaxSamples"), 1, "256", ABSOFF(delivery_queue_maxsamples), 0, uf_uint, 0, pf_uint,
     BLURB("<p>This element controls the Maximum size of a delivery queue, expressed in samples. Once a delivery queue is full, incoming samples destined for that queue are dropped until space becomes available again.</p>") },
   { LEAF("PrimaryReorderMaxSamples"), 1, "64", ABSOFF(primary_reorder_maxsamples), 0, uf_uint, 0, pf_uint,
@@ -785,7 +785,14 @@ static const struct cfgelem tracing_cfgelems[] = {
   END_MARKER
 };
 
-static const struct cfgelem ddsi2_cfgelems[] = {
+static const struct cfgelem domain_cfgelems[] = {
+  { LEAF("Id"), 1, "any", ABSOFF(domainId), 0, uf_domainId, 0, pf_domainId, NULL },
+  END_MARKER
+};
+
+static const struct cfgelem root_cfgelems[] = {
+  { GROUP("Domain", domain_cfgelems),
+    BLURB("<p>The General element specifying Domain related settings.</p>") },
   { GROUP("General", general_cfgelems),
     BLURB("<p>The General element specifies overall DDSI2E service settings.</p>") },
 #ifdef DDSI_INCLUDE_ENCRYPTION
@@ -820,18 +827,7 @@ static const struct cfgelem ddsi2_cfgelems[] = {
   { GROUP("SSL", ssl_cfgelems),
     BLURB("<p>The SSL element allows specifying various parameters related to using SSL/TLS for DDSI over TCP.</p>") },
 #endif
-  END_MARKER
-};
-
-static const struct cfgelem domain_cfgelems[] = {
-  { LEAF("Id"), 1, "any", ABSOFF(domainId), 0, uf_domainId, 0, pf_domainId, NULL },
-  END_MARKER
-};
-
-static const struct cfgelem root_cfgelems[] = {
-  { "Domain", domain_cfgelems, NULL, NODATA, NULL },
-  { "DDSI2E|DDSI2", ddsi2_cfgelems, NULL, NODATA,
-    BLURB("<p>DDSI2 settings ...</p>") },
+  { MOVED("DDSI2E|DDSI2", "CycloneDDS") },
   END_MARKER
 };
 
@@ -841,7 +837,7 @@ static const struct cfgelem cyclonedds_root_cfgelems[] = {
 };
 
 static const struct cfgelem root_cfgelem = {
-  "root", cyclonedds_root_cfgelems, NULL, NODATA, NULL
+  "/", cyclonedds_root_cfgelems, NULL, NODATA, NULL
 };
 
 #undef ATTR
@@ -1014,17 +1010,27 @@ static size_t cfg_note(struct cfgst *cfgst, uint32_t cat, size_t bsz, const char
   sidx = 0;
   while ( sidx < cfgst->path_depth && cfgst->path[sidx]->name == NULL )
     sidx++;
+  const struct cfgelem *prev_path = NULL;
   for ( i = sidx; i < cfgst->path_depth && (i == sidx || !cfgst->isattr[i - 1]); i++ ) {
     if ( cfgst->path[i] == NULL ) {
       assert(i > sidx);
       cfg_note_snprintf(&bb, "/#text");
     } else if ( cfgst->isattr[i] ) {
       cfg_note_snprintf(&bb, "[@%s]", cfgst->path[i]->name);
+    } else if (cfgst->path[i] == prev_path) {
+      /* skip printing this level: it means a group contained an element indicating that
+         it was moved to the first group (i.e., stripping a level) -- this is currently
+         only used for stripping out the DDSI2E level, and the sole purpose of this
+         special case is making any warnings from elements contained within it look
+         reasonable by always printing the new location */
     } else {
-      const char *p = strchr(cfgst->path[i]->name, '|');
-      int n = p ? (int) (p - cfgst->path[i]->name) : (int) strlen(cfgst->path[i]->name);
-      cfg_note_snprintf(&bb, "%s%*.*s", (i == sidx) ? "" : "/", n, n, cfgst->path[i]->name);
+      /* first character is '>' means it was moved, so print what follows instead */
+      const char *name = cfgst->path[i]->name + ((cfgst->path[i]->name[0] == '>') ? 1 : 0);
+      const char *p = strchr(name, '|');
+      int n = p ? (int) (p - name) : (int) strlen(name);
+      cfg_note_snprintf(&bb, "%s%*.*s", (i == sidx) ? "" : "/", n, n, name);
     }
+    prev_path = cfgst->path[i];
   }
 
   cfg_note_snprintf(&bb, ": ");
@@ -1938,7 +1944,7 @@ static int do_update(struct cfgst *cfgst, update_fun_t upd, void *parent, struct
   if ( cfgelem->multiplicity == 0 || n->count < cfgelem->multiplicity )
     ok = upd(cfgst, parent, cfgelem, (n->count == n->failed), value);
   else
-    ok = cfg_error(cfgst, "only %d instance(s) allowed", cfgelem->multiplicity);
+    ok = cfg_error(cfgst, "only %d instance%s allowed", cfgelem->multiplicity, (cfgelem->multiplicity == 1) ? "" : "s");
   n->count++;
   if ( !ok ) {
     n->failed++;
@@ -2392,7 +2398,7 @@ static int matching_name_index(const char *name_w_aliases, const char *name)
 
 static const struct cfgelem *lookup_redirect(const char *target)
 {
-  const struct cfgelem *cfgelem = ddsi2_cfgelems;
+  const struct cfgelem *cfgelem = cyclonedds_root_cfgelems;
   char *target_copy = ddsrt_strdup(target), *p1;
   const char *p = target_copy;
   while ( p ) {
@@ -2458,10 +2464,13 @@ static int proc_elem_open(void *varg, UNUSED_ARG(uintptr_t parentinfo), UNUSED_A
     void *parent, *dynparent;
 
     if ( moved ) {
-#if WARN_DEPRECATED_ALIAS
-      cfg_warning(cfgst, "'%s': deprecated alias for '%s'", name, cfg_subelem->defvalue);
-#endif
+      struct cfgelem const * const cfg_subelem_orig = cfg_subelem;
       cfg_subelem = lookup_redirect(cfg_subelem->defvalue);
+#if WARN_DEPRECATED_ALIAS
+      cfgst_push(cfgst, 0, cfg_subelem_orig, NULL);
+      cfg_warning(cfgst, "setting%s moved to //%s", cfg_subelem->children ? "s" : "", cfg_subelem_orig->defvalue);
+      cfgst_pop(cfgst);
+#endif
     }
 
     parent = cfgst_parent(cfgst);
diff --git a/src/mpt/tests/basic/etc/config_any.xml b/src/mpt/tests/basic/etc/config_any.xml
index 68e0e0a..71b410f 100644
--- a/src/mpt/tests/basic/etc/config_any.xml
+++ b/src/mpt/tests/basic/etc/config_any.xml
@@ -13,18 +13,16 @@
   <Domain>
     <Id>any</Id>
   </Domain>
-  <DDSI2E>
-    <General>
-      <NetworkInterfaceAddress>auto</NetworkInterfaceAddress>
-      <AllowMulticast>true</AllowMulticast>
-      <EnableMulticastLoopback>true</EnableMulticastLoopback>
-    </General>
-    <Compatibility>
-      <StandardsConformance>lax</StandardsConformance>
-    </Compatibility>
-    <!--Tracing>
-      <Verbosity>finest</Verbosity>
-      <OutputFile>ddsi_${MPT_PROCESS_NAME}.log</OutputFile>
-    </Tracing-->
-  </DDSI2E>
+  <General>
+    <NetworkInterfaceAddress>auto</NetworkInterfaceAddress>
+    <AllowMulticast>true</AllowMulticast>
+    <EnableMulticastLoopback>true</EnableMulticastLoopback>
+  </General>
+  <Compatibility>
+    <StandardsConformance>lax</StandardsConformance>
+  </Compatibility>
+  <!--Tracing>
+    <Verbosity>finest</Verbosity>
+    <OutputFile>ddsi_${MPT_PROCESS_NAME}.log</OutputFile>
+  </Tracing-->
 </CycloneDDS>
diff --git a/src/mpt/tests/basic/etc/config_specific.xml b/src/mpt/tests/basic/etc/config_specific.xml
index 2ae3286..c6ccf33 100644
--- a/src/mpt/tests/basic/etc/config_specific.xml
+++ b/src/mpt/tests/basic/etc/config_specific.xml
@@ -13,18 +13,16 @@
   <Domain>
     <Id>${DOMAIN_ID}</Id>
   </Domain>
-  <DDSI2E>
-    <General>
-      <NetworkInterfaceAddress>auto</NetworkInterfaceAddress>
-      <AllowMulticast>true</AllowMulticast>
-      <EnableMulticastLoopback>true</EnableMulticastLoopback>
-    </General>
-    <Compatibility>
-      <StandardsConformance>lax</StandardsConformance>
-    </Compatibility>
-    <!--Tracing>
-      <Verbosity>finest</Verbosity>
-      <OutputFile>ddsi_${MPT_PROCESS_NAME}.log</OutputFile>
-    </Tracing-->
-  </DDSI2E>
+  <General>
+   <NetworkInterfaceAddress>auto</NetworkInterfaceAddress>
+    <AllowMulticast>true</AllowMulticast>
+    <EnableMulticastLoopback>true</EnableMulticastLoopback>
+  </General>
+  <Compatibility>
+    <StandardsConformance>lax</StandardsConformance>
+  </Compatibility>
+  <!--Tracing>
+    <Verbosity>finest</Verbosity>
+    <OutputFile>ddsi_${MPT_PROCESS_NAME}.log</OutputFile>
+  </Tracing-->
 </CycloneDDS>

From f601beb907395ee09c94241295f890c854ce2c0e Mon Sep 17 00:00:00 2001
From: Erik Boasson <eb@ilities.com>
Date: Sat, 4 May 2019 15:21:52 +0800
Subject: [PATCH 061/238] don't modify input string in XML parser

The XML parser has two modes: it can parse a file or parse a
caller-owned string.  In the former case, it owns its buffer and shifts
the contents to make room for more data read in from the file.  This
shifting may not happen when parsing a string.

Signed-off-by: Erik Boasson <eb@ilities.com>
---
 src/ddsrt/src/xmlparser.c | 30 +++++++++++++++---------------
 1 file changed, 15 insertions(+), 15 deletions(-)

diff --git a/src/ddsrt/src/xmlparser.c b/src/ddsrt/src/xmlparser.c
index 7a7e0cb..e22bf09 100644
--- a/src/ddsrt/src/xmlparser.c
+++ b/src/ddsrt/src/xmlparser.c
@@ -179,22 +179,22 @@ static int make_chars_available (struct ddsrt_xmlp_state *st, size_t nmin)
         return 1;
     }
     /* ensure buffer space is available */
-    if (pos + nmin > st->cbufmax) {
-        memmove (st->cbuf, st->cbuf + pos, st->cbufn - pos);
-        st->cbufn -= pos;
-        st->cbufp -= pos;
-        if (st->cbufmark != NOMARKER) {
-            st->cbufmark -= pos;
-        }
-    }
-    /* buffer is owned by caller if fp = NULL, and by us if fp != NULL */
-    if (st->cbufp + st->cbufmax < nmin && st->fp != NULL) {
-        st->cbufmax = st->cbufp + nmin;
-        st->cbuf = ddsrt_realloc (st->cbuf, st->cbufmax);
-    }
-    /* try to refill buffer if a backing file is present; eof (or end-of-string) is
-       reached when this doesn't add any bytes to the buffer */
     if (st->fp != NULL) {
+        if (pos + nmin > st->cbufmax) {
+            memmove (st->cbuf, st->cbuf + pos, st->cbufn - pos);
+            st->cbufn -= pos;
+            st->cbufp -= pos;
+            if (st->cbufmark != NOMARKER) {
+                st->cbufmark -= pos;
+            }
+        }
+        /* buffer is owned by caller if fp = NULL, and by us if fp != NULL */
+        if (st->cbufp + st->cbufmax < nmin) {
+            st->cbufmax = st->cbufp + nmin;
+            st->cbuf = ddsrt_realloc (st->cbuf, st->cbufmax);
+        }
+        /* try to refill buffer if a backing file is present; eof (or end-of-string) is
+         reached when this doesn't add any bytes to the buffer */
         n = fread (st->cbuf + st->cbufn, 1, st->cbufmax - st->cbufn, st->fp);
         st->cbufn += n;
     }

From 326ab9357259f60bc185a3882cac0a1b5f313d8d Mon Sep 17 00:00:00 2001
From: Erik Boasson <eb@ilities.com>
Date: Sat, 4 May 2019 15:26:53 +0800
Subject: [PATCH 062/238] Allow closing config elems with </> if from envvar

The Cyclone DDS configuration is in principle an XML document, but it is
possible to write configuration fragments directly in the CYCLONEDDS_URI
environment variable.  In that case, it is quite annoying to have to
enter the full closing tags all the time, and so it now allows closing
elements with a simple </> when not reading them from a file.

While it would be trivial to also allow this when reading the
configuration from a file, it seems that promulgating invalid XML would
be bad form ... and besides, in that case editors can help keep
everything in order.

Signed-off-by: Erik Boasson <eb@ilities.com>
---
 src/core/ddsi/src/q_config.c            |  2 +-
 src/ddsrt/include/dds/ddsrt/xmlparser.h |  5 ++++-
 src/ddsrt/src/xmlparser.c               | 26 +++++++++++++++----------
 3 files changed, 21 insertions(+), 12 deletions(-)

diff --git a/src/core/ddsi/src/q_config.c b/src/core/ddsi/src/q_config.c
index d9c37db..d12bc21 100644
--- a/src/core/ddsi/src/q_config.c
+++ b/src/core/ddsi/src/q_config.c
@@ -2685,7 +2685,7 @@ struct cfgst * config_init (const char *configfile)
       if (tok[0] == '<') {
         /* Read XML directly from input string */
         qx = ddsrt_xmlp_new_string (tok, cfgst, &cb);
-        ddsrt_xmlp_set_requireEOF (qx, 0);
+        ddsrt_xmlp_set_options (qx, DDSRT_XMLP_ANONYMOUS_CLOSE_TAG);
         fp = NULL;
       } else {
         char *comma;
diff --git a/src/ddsrt/include/dds/ddsrt/xmlparser.h b/src/ddsrt/include/dds/ddsrt/xmlparser.h
index 120be63..e33815b 100644
--- a/src/ddsrt/include/dds/ddsrt/xmlparser.h
+++ b/src/ddsrt/include/dds/ddsrt/xmlparser.h
@@ -36,9 +36,12 @@ extern "C" {
 
     struct ddsrt_xmlp_state;
 
+#define DDSRT_XMLP_REQUIRE_EOF         1u /* set by default; if not set, junk may follow top-level closing tag */
+#define DDSRT_XMLP_ANONYMOUS_CLOSE_TAG 2u /* clear by default; if set allow closing an element with </> instead of </name> */
+
     DDS_EXPORT struct ddsrt_xmlp_state *ddsrt_xmlp_new_file (FILE *fp, void *varg, const struct ddsrt_xmlp_callbacks *cb);
     DDS_EXPORT struct ddsrt_xmlp_state *ddsrt_xmlp_new_string (const char *string, void *varg, const struct ddsrt_xmlp_callbacks *cb);
-    DDS_EXPORT void ddsrt_xmlp_set_requireEOF (struct ddsrt_xmlp_state *st, int require_eof);
+    DDS_EXPORT void ddsrt_xmlp_set_options (struct ddsrt_xmlp_state *st, unsigned options);
     DDS_EXPORT size_t ddsrt_xmlp_get_bufpos (const struct ddsrt_xmlp_state *st);
     DDS_EXPORT void ddsrt_xmlp_free (struct ddsrt_xmlp_state *st);
     DDS_EXPORT int ddsrt_xmlp_parse (struct ddsrt_xmlp_state *st);
diff --git a/src/ddsrt/src/xmlparser.c b/src/ddsrt/src/xmlparser.c
index e22bf09..ded4337 100644
--- a/src/ddsrt/src/xmlparser.c
+++ b/src/ddsrt/src/xmlparser.c
@@ -49,7 +49,7 @@ struct ddsrt_xmlp_state {
     size_t tpescp; /* still escape sequences in tpescp .. tpp */
     int nest; /* current nesting level */
     void *varg; /* user argument to callback functions */
-    int require_eof; /* if false, junk may follow top-level closing tag */
+    unsigned options;
     struct ddsrt_xmlp_callbacks cb; /* user-supplied callbacks (or stubs) */
 };
 
@@ -108,7 +108,7 @@ static void ddsrt_xmlp_new_common (struct ddsrt_xmlp_state *st)
     st->peekpayload = NULL;
     st->nest = 0;
     st->error = 0;
-    st->require_eof = 1;
+    st->options = DDSRT_XMLP_REQUIRE_EOF;
 }
 
 static void ddsrt_xmlp_new_setCB (struct ddsrt_xmlp_state *st, void *varg, const struct ddsrt_xmlp_callbacks *cb)
@@ -148,9 +148,9 @@ struct ddsrt_xmlp_state *ddsrt_xmlp_new_string (const char *string, void *varg,
     return st;
 }
 
-void ddsrt_xmlp_set_requireEOF (struct ddsrt_xmlp_state *st, int require_eof)
+void ddsrt_xmlp_set_options (struct ddsrt_xmlp_state *st, unsigned options)
 {
-    st->require_eof = require_eof;
+    st->options = options;
 }
 
 size_t ddsrt_xmlp_get_bufpos (const struct ddsrt_xmlp_state *st)
@@ -451,11 +451,14 @@ static int next_token_tag_withoutclose (struct ddsrt_xmlp_state *st, char **payl
             next_char (st);
         }
         /* we only do tag names that are identifiers */
-        if (!qq_isidentfirst (peek_char (st))) {
+        if (peek_char (st) == '>' && (st->options & DDSRT_XMLP_ANONYMOUS_CLOSE_TAG)) {
+            return TOK_SHORTHAND_CLOSE_TAG;
+        } else if (!qq_isidentfirst (peek_char (st))) {
             return TOK_ERROR;
+        } else {
+            next_token_ident (st, payload);
+            return tok;
         }
-        next_token_ident (st, payload);
-        return tok;
     }
 }
 
@@ -560,6 +563,9 @@ static int next_token (struct ddsrt_xmlp_state *st, char **payload)
             }
         }
         if (tok == TOK_ERROR) {
+            char msg[512];
+            (void) snprintf (msg, sizeof (msg), "invalid token encountered");
+            st->cb.error (st->varg, msg, st->line);
             st->error = 1;
         }
         return tok;
@@ -674,10 +680,10 @@ static int parse_element (struct ddsrt_xmlp_state *st, uintptr_t parentinfo)
                 }
             }
             st->nest--;
-            if (next_token (st, &ename) != TOK_CLOSE_TAG || next_char (st) != '>') {
+            if (((tok = next_token (st, &ename)) != TOK_CLOSE_TAG && tok != TOK_SHORTHAND_CLOSE_TAG) || next_char (st) != '>') {
                 PE_LOCAL_ERROR ("expecting closing tag", name);
             }
-            if (strcmp (name, ename) != 0) {
+            if (tok != TOK_SHORTHAND_CLOSE_TAG && strcmp (name, ename) != 0) {
                 PE_LOCAL_ERROR ("open/close tag mismatch", ename);
             }
             ret = st->cb.elem_close (st->varg, eleminfo);
@@ -709,7 +715,7 @@ int ddsrt_xmlp_parse (struct ddsrt_xmlp_state *st)
         return 0;
     } else {
         int ret = parse_element (st, 0);
-        if (ret < 0|| !st->require_eof || next_token (st, NULL) == TOK_EOF ) {
+        if (ret < 0|| !(st->options & DDSRT_XMLP_REQUIRE_EOF) || next_token (st, NULL) == TOK_EOF ) {
             return ret;
         } else {
             return -1;

From 5fa8fca877acd7d64da809828776180706023cd4 Mon Sep 17 00:00:00 2001
From: Erik Boasson <eb@ilities.com>
Date: Sun, 5 May 2019 10:05:16 +0800
Subject: [PATCH 063/238] fix assert on appl thread existing after dds_fini

The thread state management used by the GC and the liveliness monitoring
lazily creates entries for application threads that call (certain)
Cyclone API functions.  It arranges for the entry allocated to such a
thread to be cleared once the thread terminates.

This means that if such a thread still exists once the last participant
is deleted (and Cyclone deinitializes), the corresponding thread entry
still exists as well.  The assertion that all (known) threads must have
stopped on shutting down Cyclone is therefore incorrect.

This commit introduces a special state for thread entries that were
created lazily.  It does monitor that they do not stay in the "awake"
state for too long, but otherwise doesn't care much about them.

Signed-off-by: Erik Boasson <eb@ilities.com>
---
 src/core/ddsi/include/dds/ddsi/q_thread.h |  7 +--
 src/core/ddsi/src/ddsi_threadmon.c        |  8 +--
 src/core/ddsi/src/q_thread.c              | 73 ++++++++---------------
 3 files changed, 33 insertions(+), 55 deletions(-)

diff --git a/src/core/ddsi/include/dds/ddsi/q_thread.h b/src/core/ddsi/include/dds/ddsi/q_thread.h
index 71c9e5e..4d572d2 100644
--- a/src/core/ddsi/include/dds/ddsi/q_thread.h
+++ b/src/core/ddsi/include/dds/ddsi/q_thread.h
@@ -49,8 +49,9 @@ typedef int32_t svtime_t; /* signed version */
 #define Q_THREAD_SCHEDPRIO_DEFAULT 0
 
 enum thread_state {
-  THREAD_STATE_ZERO,
-  THREAD_STATE_ALIVE
+  THREAD_STATE_ZERO, /* known to be dead */
+  THREAD_STATE_LAZILY_CREATED, /* lazily created in response because an application used it. Reclaimed if the thread terminates, but not considered an error if all of Cyclone is shutdown while this thread hasn't terminated yet */
+  THREAD_STATE_ALIVE /* known to be alive - for Cyclone internal threads */
 };
 
 struct logbuf;
@@ -101,8 +102,6 @@ DDS_EXPORT dds_retcode_t create_thread (struct thread_state1 **ts, const char *n
 DDS_EXPORT struct thread_state1 *lookup_thread_state_real (void);
 DDS_EXPORT int join_thread (struct thread_state1 *ts1);
 DDS_EXPORT void log_stack_traces (void);
-DDS_EXPORT struct thread_state1 *get_thread_state (ddsrt_thread_t id);
-DDS_EXPORT struct thread_state1 * init_thread_state (const char *tname);
 DDS_EXPORT void reset_thread_state (struct thread_state1 *ts1);
 DDS_EXPORT int thread_exists (const char *name);
 
diff --git a/src/core/ddsi/src/ddsi_threadmon.c b/src/core/ddsi/src/ddsi_threadmon.c
index f257261..6098d71 100644
--- a/src/core/ddsi/src/ddsi_threadmon.c
+++ b/src/core/ddsi/src/ddsi_threadmon.c
@@ -62,7 +62,7 @@ static uint32_t threadmon_thread (struct ddsi_threadmon *sl)
     if (ddsrt_cond_waitfor (&sl->cond, &sl->lock, config.liveliness_monitoring_interval))
       continue;
 
-    unsigned n_alive = 0;
+    unsigned n_alive = 0, n_unused = 0;
     nn_mtime_t tnow = now_mt ();
 
     LOG_THREAD_CPUTIME (next_thread_cputime);
@@ -81,8 +81,8 @@ static uint32_t threadmon_thread (struct ddsi_threadmon *sl)
       tlast = tnow;
       for (i = 0; i < thread_states.nthreads; i++)
       {
-        if (thread_states.ts[i].state != THREAD_STATE_ALIVE)
-          n_alive++;
+        if (thread_states.ts[i].state == THREAD_STATE_ZERO)
+          n_unused++;
         else
         {
           vtime_t vt = thread_states.ts[i].vtime;
@@ -105,7 +105,7 @@ static uint32_t threadmon_thread (struct ddsi_threadmon *sl)
       }
     }
 
-    if (n_alive == thread_states.nthreads)
+    if (n_alive + n_unused == thread_states.nthreads)
     {
       DDS_TRACE(": [%u] OK\n", n_alive);
       was_alive = true;
diff --git a/src/core/ddsi/src/q_thread.c b/src/core/ddsi/src/q_thread.c
index e8ed142..6cf4a47 100644
--- a/src/core/ddsi/src/q_thread.c
+++ b/src/core/ddsi/src/q_thread.c
@@ -45,6 +45,8 @@ extern inline void thread_state_asleep (struct thread_state1 *ts1);
 extern inline void thread_state_awake (struct thread_state1 *ts1);
 extern inline void thread_state_awake_to_awake_no_nest (struct thread_state1 *ts1);
 
+static struct thread_state1 *init_thread_state (const char *tname, enum thread_state state);
+
 void *ddsrt_malloc_aligned_cacheline (size_t size)
 {
   /* This wastes some space, but we use it only once and it isn't a
@@ -115,16 +117,6 @@ void thread_states_fini (void)
   thread_states.ts = NULL;
 }
 
-static void cleanup_thread_state (void *data)
-{
-  struct thread_state1 *ts = get_thread_state(ddsrt_thread_self());
-  (void)data;
-  assert(ts->state == THREAD_STATE_ALIVE);
-  assert(vtime_asleep_p(ts->vtime));
-  reset_thread_state(ts);
-  ddsrt_fini();
-}
-
 static struct thread_state1 *find_thread_state (ddsrt_thread_t tid)
 {
   if (thread_states.ts) {
@@ -138,6 +130,19 @@ static struct thread_state1 *find_thread_state (ddsrt_thread_t tid)
   return NULL;
 }
 
+static void cleanup_thread_state (void *data)
+{
+  struct thread_state1 *ts = find_thread_state(ddsrt_thread_self());
+  (void)data;
+  if (ts)
+  {
+    assert(ts->state == THREAD_STATE_LAZILY_CREATED);
+    assert(vtime_asleep_p(ts->vtime));
+    reset_thread_state(ts);
+  }
+  ddsrt_fini();
+}
+
 static struct thread_state1 *lazy_create_thread_state (ddsrt_thread_t self)
 {
   /* This situation only arises for threads that were not created using
@@ -147,7 +152,7 @@ static struct thread_state1 *lazy_create_thread_state (ddsrt_thread_t self)
   char name[128];
   ddsrt_thread_getname (name, sizeof (name));
   ddsrt_mutex_lock (&thread_states.lock);
-  if ((ts1 = init_thread_state (name)) != NULL) {
+  if ((ts1 = init_thread_state (name, THREAD_STATE_LAZILY_CREATED)) != NULL) {
     ddsrt_init ();
     ts1->extTid = self;
     ts1->tid = self;
@@ -191,18 +196,11 @@ static uint32_t create_thread_wrapper (void *ptr)
 
 static int find_free_slot (const char *name)
 {
-  unsigned i;
-  int cand;
-  for (i = 0, cand = -1; i < thread_states.nthreads; i++)
-  {
-    if (thread_states.ts[i].state != THREAD_STATE_ALIVE)
-      cand = (int) i;
+  for (unsigned i = 0; i < thread_states.nthreads; i++)
     if (thread_states.ts[i].state == THREAD_STATE_ZERO)
-      break;
-  }
-  if (cand == -1)
-    DDS_FATAL("create_thread: %s: no free slot\n", name ? name : "(anon)");
-  return cand;
+      return (int) i;
+  DDS_FATAL("create_thread: %s: no free slot\n", name ? name : "(anon)");
+  return -1;
 }
 
 void upgrade_main_thread (void)
@@ -215,7 +213,7 @@ void upgrade_main_thread (void)
   ts1 = &thread_states.ts[cand];
   if (ts1->state == THREAD_STATE_ZERO)
     assert (vtime_asleep_p (ts1->vtime));
-  ts1->state = THREAD_STATE_ALIVE;
+  ts1->state = THREAD_STATE_LAZILY_CREATED;
   ts1->tid = ddsrt_thread_self ();
   ts1->name = main_thread_name;
   ddsrt_mutex_unlock (&thread_states.lock);
@@ -231,7 +229,7 @@ const struct config_thread_properties_listelem *lookup_thread_properties (const
   return e;
 }
 
-struct thread_state1 *init_thread_state (const char *tname)
+static struct thread_state1 *init_thread_state (const char *tname, enum thread_state state)
 {
   int cand;
   struct thread_state1 *ts;
@@ -240,12 +238,9 @@ struct thread_state1 *init_thread_state (const char *tname)
     return NULL;
 
   ts = &thread_states.ts[cand];
-  if (ts->state == THREAD_STATE_ZERO)
-  {
-    assert (vtime_asleep_p (ts->vtime));
-  }
+  assert (vtime_asleep_p (ts->vtime));
   ts->name = ddsrt_strdup (tname);
-  ts->state = THREAD_STATE_ALIVE;
+  ts->state = state;
 
   return ts;
 }
@@ -259,7 +254,7 @@ dds_retcode_t create_thread (struct thread_state1 **ts1, const char *name, uint3
   ctxt = ddsrt_malloc (sizeof (*ctxt));
   ddsrt_mutex_lock (&thread_states.lock);
 
-  *ts1 = init_thread_state (name);
+  *ts1 = init_thread_state (name, THREAD_STATE_ALIVE);
   if (*ts1 == NULL)
     goto fatal;
 
@@ -336,28 +331,12 @@ void downgrade_main_thread (void)
   thread_states_init_static ();
 }
 
-struct thread_state1 *get_thread_state (ddsrt_thread_t id)
-{
-  unsigned i;
-  struct thread_state1 *ts = NULL;
-
-  for (i = 0; i < thread_states.nthreads; i++)
-  {
-    if (ddsrt_thread_equal (thread_states.ts[i].extTid, id))
-    {
-      ts = &thread_states.ts[i];
-      break;
-    }
-  }
-  return ts;
-}
-
 void log_stack_traces (void)
 {
   unsigned i;
   for (i = 0; i < thread_states.nthreads; i++)
   {
-    if (thread_states.ts[i].state == THREAD_STATE_ALIVE)
+    if (thread_states.ts[i].state != THREAD_STATE_ZERO)
     {
       log_stacktrace (thread_states.ts[i].name, thread_states.ts[i].tid);
     }

From 0a7e5ff8eb18d6f6a0f183a69c82c09baabce086 Mon Sep 17 00:00:00 2001
From: Erik Boasson <eb@ilities.com>
Date: Sun, 5 May 2019 11:22:14 +0800
Subject: [PATCH 064/238] remove name arg from dds_create_topic_arbitrary

The name parameter and the name in the sertopic parameter had to match
because it used the one as a key in a lookup checking whether the topic
exists already, and the other as key for the nodes in that index.  As
the name is (currently) included in the sertopic, it shouldn't be passed
in separately as well.

Signed-off-by: Erik Boasson <eb@ilities.com>
---
 src/core/ddsc/include/dds/dds.h |  4 +---
 src/core/ddsc/src/dds_builtin.c |  2 +-
 src/core/ddsc/src/dds_topic.c   | 29 +++++++++++++----------------
 3 files changed, 15 insertions(+), 20 deletions(-)

diff --git a/src/core/ddsc/include/dds/dds.h b/src/core/ddsc/include/dds/dds.h
index d701117..07b1545 100644
--- a/src/core/ddsc/include/dds/dds.h
+++ b/src/core/ddsc/include/dds/dds.h
@@ -967,8 +967,7 @@ dds_create_topic(
  * matching is done on a combination of topic name and type name.
  *
  * @param[in]  participant  Participant on which to create the topic.
- * @param[in]  sertopic     Internal description of the topic type.
- * @param[in]  name         Name of the topic.
+ * @param[in]  sertopic     Internal description of the topic type (includes name).
  * @param[in]  qos          QoS to set on the new topic (can be NULL).
  * @param[in]  listener     Any listener functions associated with the new topic (can be NULL).
  * @param[in]  sedp_plist   Topic description to be published as part of discovery (if NULL, not published).
@@ -987,7 +986,6 @@ DDS_EXPORT dds_entity_t
 dds_create_topic_arbitrary (
   dds_entity_t participant,
   struct ddsi_sertopic *sertopic,
-  const char *name,
   const dds_qos_t *qos,
   const dds_listener_t *listener,
   const struct nn_plist *sedp_plist);
diff --git a/src/core/ddsc/src/dds_builtin.c b/src/core/ddsc/src/dds_builtin.c
index 3f50c60..fff187a 100644
--- a/src/core/ddsc/src/dds_builtin.c
+++ b/src/core/ddsc/src/dds_builtin.c
@@ -97,7 +97,7 @@ dds_entity_t dds__get_builtin_topic (dds_entity_t e, dds_entity_t topic)
   }
 
   dds_qos_t *qos = dds__create_builtin_qos ();
-  tp = dds_create_topic_arbitrary (pp, sertopic, sertopic->name, qos, NULL, NULL);
+  tp = dds_create_topic_arbitrary (pp, sertopic, qos, NULL, NULL);
   dds_delete_qos (qos);
   return tp;
 }
diff --git a/src/core/ddsc/src/dds_topic.c b/src/core/ddsc/src/dds_topic.c
index 747976c..c0cb41d 100644
--- a/src/core/ddsc/src/dds_topic.c
+++ b/src/core/ddsc/src/dds_topic.c
@@ -191,6 +191,11 @@ dds_find_topic(
             ddsrt_mutex_lock (&dds_global.m_mutex);
             st = dds_topic_lookup_locked (p->m_domain, name);
             if (st) {
+                /* FIXME: calling addref is wrong because the Cyclone library has no
+                   knowledge of the reference and hence simply deleting the participant
+                   won't make the ref count drop to 0.  On the other hand, the DDS spec
+                   says find_topic (and a second call to create_topic) return a new
+                   proxy that must separately be deleted.  */
                 dds_entity_add_ref (&st->status_cb_entity->m_entity);
                 tp = st->status_cb_entity->m_entity.m_hdllink.hdl;
             } else {
@@ -300,7 +305,6 @@ DDS_EXPORT dds_entity_t
 dds_create_topic_arbitrary (
         dds_entity_t participant,
         struct ddsi_sertopic *sertopic,
-        const char *name,
         const dds_qos_t *qos,
         const dds_listener_t *listener,
         const nn_plist_t *sedp_plist)
@@ -319,18 +323,6 @@ dds_create_topic_arbitrary (
         goto bad_param_err;
     }
 
-    if (name == NULL) {
-        DDS_ERROR("Topic name is NULL\n");
-        hdl = DDS_ERRNO(DDS_RETCODE_BAD_PARAMETER);
-        goto bad_param_err;
-    }
-
-    if (!is_valid_name(name)) {
-        DDS_ERROR("Topic name contains characters that are not allowed\n");
-        hdl = DDS_ERRNO(DDS_RETCODE_BAD_PARAMETER);
-        goto bad_param_err;
-    }
-
     rc = dds_entity_lock(participant, DDS_KIND_PARTICIPANT, &par);
     if (rc != DDS_RETCODE_OK) {
         hdl = DDS_ERRNO(rc);
@@ -349,8 +341,8 @@ dds_create_topic_arbitrary (
 
     /* Check if topic already exists with same name */
     ddsrt_mutex_lock (&dds_global.m_mutex);
-    if ((stgeneric = dds_topic_lookup_locked (par->m_domain, name)) != NULL) {
-        if (!sertopic_equivalent (stgeneric,sertopic)) {
+    if ((stgeneric = dds_topic_lookup_locked (par->m_domain, sertopic->name)) != NULL) {
+        if (!sertopic_equivalent (stgeneric, sertopic)) {
             /* FIXME: should copy the type, perhaps? but then the pointers will no longer be the same */
             DDS_ERROR("Create topic with mismatching type\n");
             hdl = DDS_ERRNO(DDS_RETCODE_PRECONDITION_NOT_MET);
@@ -359,6 +351,11 @@ dds_create_topic_arbitrary (
             DDS_ERROR("Create topic with mismatching qos\n");
             hdl = DDS_ERRNO(DDS_RETCODE_INCONSISTENT_POLICY);
         } else {
+            /* FIXME: calling addref is wrong because the Cyclone library has no
+               knowledge of the reference and hence simply deleting the participant
+               won't make the ref count drop to 0.  On the other hand, the DDS spec
+               says find_topic (and a second call to create_topic) return a new
+               proxy that must separately be deleted.  */
             dds_entity_add_ref (&stgeneric->status_cb_entity->m_entity);
             hdl = stgeneric->status_cb_entity->m_entity.m_hdllink.hdl;
         }
@@ -487,7 +484,7 @@ dds_create_topic(
         }
     }
 
-    hdl = dds_create_topic_arbitrary(participant, &st->c, name, qos, listener, &plist);
+    hdl = dds_create_topic_arbitrary(participant, &st->c, qos, listener, &plist);
     ddsi_sertopic_unref (&st->c);
     nn_plist_fini (&plist);
 

From 68c21c06e30953b426c2139291b0122e4391412f Mon Sep 17 00:00:00 2001
From: Erik Boasson <eb@ilities.com>
Date: Sun, 5 May 2019 11:25:18 +0800
Subject: [PATCH 065/238] change sertopic "deinit" to "free"

The primary reason is that this allows the implementator of the sertopic
to freely select an allocation strategy, instead of being forced to
allocate the sertopic itself and the names it contains in the common
header with ddsrt_malloc.  The secondary reason is that it brings it in
line with the serdata.

Signed-off-by: Erik Boasson <eb@ilities.com>
---
 src/core/ddsc/src/dds_sertopic_builtintopic.c  |  9 ++++++---
 src/core/ddsi/include/dds/ddsi/ddsi_sertopic.h |  8 ++++----
 src/core/ddsi/src/ddsi_sertopic.c              |  8 ++------
 src/core/ddsi/src/ddsi_sertopic_default.c      | 10 +++++++---
 4 files changed, 19 insertions(+), 16 deletions(-)

diff --git a/src/core/ddsc/src/dds_sertopic_builtintopic.c b/src/core/ddsc/src/dds_sertopic_builtintopic.c
index 7773a13..b38deba 100644
--- a/src/core/ddsc/src/dds_sertopic_builtintopic.c
+++ b/src/core/ddsc/src/dds_sertopic_builtintopic.c
@@ -45,9 +45,12 @@ struct ddsi_sertopic *new_sertopic_builtintopic (enum ddsi_sertopic_builtintopic
   return &tp->c;
 }
 
-static void sertopic_builtin_deinit (struct ddsi_sertopic *tp)
+static void sertopic_builtin_free (struct ddsi_sertopic *tp)
 {
-  (void)tp;
+  ddsrt_free (tp->name_type_name);
+  ddsrt_free (tp->name);
+  ddsrt_free (tp->type_name);
+  ddsrt_free (tp);
 }
 
 static void free_pp (void *vsample)
@@ -141,7 +144,7 @@ static void sertopic_builtin_free_samples (const struct ddsi_sertopic *sertopic_
 }
 
 const struct ddsi_sertopic_ops ddsi_sertopic_ops_builtintopic = {
-  .deinit = sertopic_builtin_deinit,
+  .free = sertopic_builtin_free,
   .zero_samples = sertopic_builtin_zero_samples,
   .realloc_samples = sertopic_builtin_realloc_samples,
   .free_samples = sertopic_builtin_free_samples
diff --git a/src/core/ddsi/include/dds/ddsi/ddsi_sertopic.h b/src/core/ddsi/include/dds/ddsi/ddsi_sertopic.h
index 172af62..3f7ae75 100644
--- a/src/core/ddsi/include/dds/ddsi/ddsi_sertopic.h
+++ b/src/core/ddsi/include/dds/ddsi/ddsi_sertopic.h
@@ -44,7 +44,7 @@ struct ddsi_sertopic {
 };
 
 /* Called when the refcount dropped to zero */
-typedef void (*ddsi_sertopic_deinit_t) (struct ddsi_sertopic *tp);
+typedef void (*ddsi_sertopic_free_t) (struct ddsi_sertopic *tp);
 
 /* Zero out a sample, used for generating samples from just a key value and in cleaning up
    after dds_return_loan */
@@ -57,7 +57,7 @@ typedef void (*ddsi_sertopic_realloc_samples_t) (void **ptrs, const struct ddsi_
 typedef void (*ddsi_sertopic_free_samples_t) (const struct ddsi_sertopic *d, void **ptrs, size_t count, dds_free_op_t op);
 
 struct ddsi_sertopic_ops {
-  ddsi_sertopic_deinit_t deinit;
+  ddsi_sertopic_free_t free;
   ddsi_sertopic_zero_samples_t zero_samples;
   ddsi_sertopic_realloc_samples_t realloc_samples;
   ddsi_sertopic_free_samples_t free_samples;
@@ -67,8 +67,8 @@ DDS_EXPORT struct ddsi_sertopic *ddsi_sertopic_ref (const struct ddsi_sertopic *
 DDS_EXPORT void ddsi_sertopic_unref (struct ddsi_sertopic *tp);
 DDS_EXPORT uint32_t ddsi_sertopic_compute_serdata_basehash (const struct ddsi_serdata_ops *ops);
 
-DDS_EXPORT inline void ddsi_sertopic_deinit (struct ddsi_sertopic *tp) {
-  tp->ops->deinit (tp);
+DDS_EXPORT inline void ddsi_sertopic_free (struct ddsi_sertopic *tp) {
+  tp->ops->free (tp);
 }
 DDS_EXPORT inline void ddsi_sertopic_zero_samples (const struct ddsi_sertopic *tp, void *samples, size_t count) {
   tp->ops->zero_samples (tp, samples, count);
diff --git a/src/core/ddsi/src/ddsi_sertopic.c b/src/core/ddsi/src/ddsi_sertopic.c
index a309289..3ce5ef1 100644
--- a/src/core/ddsi/src/ddsi_sertopic.c
+++ b/src/core/ddsi/src/ddsi_sertopic.c
@@ -36,11 +36,7 @@ void ddsi_sertopic_unref (struct ddsi_sertopic *sertopic)
   {
     if (ddsrt_atomic_dec32_ov (&sertopic->refc) == 1)
     {
-      ddsi_sertopic_deinit (sertopic);
-      ddsrt_free (sertopic->name_type_name);
-      ddsrt_free (sertopic->name);
-      ddsrt_free (sertopic->type_name);
-      ddsrt_free (sertopic);
+      ddsi_sertopic_free (sertopic);
     }
   }
 }
@@ -58,7 +54,7 @@ uint32_t ddsi_sertopic_compute_serdata_basehash (const struct ddsi_serdata_ops *
   return res;
 }
 
-extern inline void ddsi_sertopic_deinit (struct ddsi_sertopic *tp);
+extern inline void ddsi_sertopic_free (struct ddsi_sertopic *tp);
 extern inline void ddsi_sertopic_zero_samples (const struct ddsi_sertopic *tp, void *samples, size_t count);
 extern inline void ddsi_sertopic_realloc_samples (void **ptrs, const struct ddsi_sertopic *tp, void *old, size_t oldcount, size_t count);
 extern inline void ddsi_sertopic_free_samples (const struct ddsi_sertopic *tp, void **ptrs, size_t count, dds_free_op_t op);
diff --git a/src/core/ddsi/src/ddsi_sertopic_default.c b/src/core/ddsi/src/ddsi_sertopic_default.c
index 3fff736..81a40c7 100644
--- a/src/core/ddsi/src/ddsi_sertopic_default.c
+++ b/src/core/ddsi/src/ddsi_sertopic_default.c
@@ -15,6 +15,7 @@
 #include <string.h>
 
 #include "dds/ddsrt/md5.h"
+#include "dds/ddsrt/heap.h"
 #include "dds/ddsi/q_bswap.h"
 #include "dds/ddsi/q_config.h"
 #include "dds/ddsi/q_freelist.h"
@@ -23,9 +24,12 @@
 
 /* FIXME: sertopic /= ddstopic so a lot of stuff needs to be moved here from dds_topic.c and the free function needs to be implemented properly */
 
-static void sertopic_default_deinit (struct ddsi_sertopic *tp)
+static void sertopic_default_free (struct ddsi_sertopic *tp)
 {
-  (void)tp;
+  ddsrt_free (tp->name_type_name);
+  ddsrt_free (tp->name);
+  ddsrt_free (tp->type_name);
+  ddsrt_free (tp);
 }
 
 static void sertopic_default_zero_samples (const struct ddsi_sertopic *sertopic_common, void *sample, size_t count)
@@ -76,7 +80,7 @@ static void sertopic_default_free_samples (const struct ddsi_sertopic *sertopic_
 }
 
 const struct ddsi_sertopic_ops ddsi_sertopic_ops_default = {
-  .deinit = sertopic_default_deinit,
+  .free = sertopic_default_free,
   .zero_samples = sertopic_default_zero_samples,
   .realloc_samples = sertopic_default_realloc_samples,
   .free_samples = sertopic_default_free_samples

From 98cf8e2ae5a82591e1b066b6fd73d79c172f9622 Mon Sep 17 00:00:00 2001
From: Kurtulus Oksuztepe <kurtulus.oksuztepe@adlinktech.com>
Date: Thu, 23 May 2019 16:57:55 +0200
Subject: [PATCH 066/238] Security API has been added for OMG DDS Security
 Specification compliance. This API consists of only header files which are
 grabbed from spec IDL. The dynamically loaded plugins should implement API
 functions.

Built-in plugins will be added to the repository later. Third party plugins will also be able to be integrated.

Signed-off-by: Kurtulus Oksuztepe <kurtulus.oksuztepe@adlinktech.com>
---
 docs/dev/modules.md                           |  91 ++++
 .../dds_security_access_control_plugin.png    | Bin 0 -> 565056 bytes
 .../dds_security_authentication_plugin.png    | Bin 0 -> 442005 bytes
 .../pictures/dds_security_crypto_plugin.png   | Bin 0 -> 514112 bytes
 .../dds_security_plugin_components.png        | Bin 0 -> 241869 bytes
 docs/dev/todo_list.md                         |  32 ++
 src/CMakeLists.txt                            |   1 +
 src/core/CMakeLists.txt                       |   6 +-
 src/ddsrt/include/dds/ddsrt/string.h          |   3 +
 src/ddsrt/src/string.c                        |   1 +
 src/security/api/CMakeLists.txt               |  25 +
 .../include/dds/security/dds_security_api.h   |  48 ++
 .../dds_security_api_access_control.h         | 375 ++++++++++++++
 .../dds_security_api_authentication.h         | 238 +++++++++
 .../security/dds_security_api_cryptography.h  | 337 ++++++++++++
 .../dds/security/dds_security_api_defs.h      | 189 +++++++
 .../dds/security/dds_security_api_err.h       | 121 +++++
 .../dds/security/dds_security_api_types.h     | 489 ++++++++++++++++++
 18 files changed, 1954 insertions(+), 2 deletions(-)
 create mode 100644 docs/dev/pictures/dds_security_access_control_plugin.png
 create mode 100644 docs/dev/pictures/dds_security_authentication_plugin.png
 create mode 100644 docs/dev/pictures/dds_security_crypto_plugin.png
 create mode 100644 docs/dev/pictures/dds_security_plugin_components.png
 create mode 100644 docs/dev/todo_list.md
 create mode 100644 src/security/api/CMakeLists.txt
 create mode 100644 src/security/api/include/dds/security/dds_security_api.h
 create mode 100644 src/security/api/include/dds/security/dds_security_api_access_control.h
 create mode 100644 src/security/api/include/dds/security/dds_security_api_authentication.h
 create mode 100644 src/security/api/include/dds/security/dds_security_api_cryptography.h
 create mode 100644 src/security/api/include/dds/security/dds_security_api_defs.h
 create mode 100644 src/security/api/include/dds/security/dds_security_api_err.h
 create mode 100644 src/security/api/include/dds/security/dds_security_api_types.h

diff --git a/docs/dev/modules.md b/docs/dev/modules.md
index 435516c..1bcfe6d 100644
--- a/docs/dev/modules.md
+++ b/docs/dev/modules.md
@@ -195,3 +195,94 @@ automatic if the target supports it. Finalization is primarily used to release
 thread-specific memory and call routines registered by
 `ddsrt_thread_cleanup_push`.
 
+
+## DDS Security 
+
+### Specification
+
+DDS Security is an [OMG specification](https://www.omg.org/spec/DDS-SECURITY/1.1/PDF) which adds several “DDS Security Support” 
+compliance points to the DDS Specification.
+The specification defines the Security Model and Service Plugin Interface (SPI) 
+architecture for compliant DDS implementations. The DDS Security Model is enforced 
+by the invocation of these SPIs by the DDS implementation.
+Security Model for DDS defines the security principals (users of the system), 
+the objects that are being secured, and the operations on the objects that are 
+to be restricted.
+
+SPIs are defined that when combined together provide Information Assurance to
+DDS systems:
+* Authentication Service Plugin. Provides the means to verify the identity of the 
+application and/or user that invokes operations on DDS. Includes facilities to 
+perform mutual authentication between participants and establish a shared secret.
+* AccessControl Service Plugin. Provides the means to enforce policy decisions on 
+what DDS related operations an authenticated user can perform. For example, which 
+domains it can join, which Topics it can publish or subscribe to, etc.
+* Cryptographic Service Plugin. Implements (or interfaces with libraries that 
+implement) all cryptographic operations including encryption, decryption,
+* Logging Service Plugin. Supports auditing of all DDS security-relevant events
+* Data Tagging Service Plugin. Provides a way to add tags to data samples.
+
+<img src="pictures/dds_security_plugin_components.png" alt="DDS Security Plugin Components">
+
+
+### Cyclone DDS Security 
+
+Cyclone DDS Security implementation is composed of the following components/modifications:
+
+* DDS Security plugin API
+* DDS Security built-in plugins that implement the API
+* DDS Security Core Library that is used by the plugins and DDSI.
+* Changes in the DDSI that moderate the specified security model.
+
+The dependency diagram:
+
+
+     DDSI  ---->     DDS Security API (headers only)  <----- DDS Security Plugins
+     |                    ^                                    |
+     |                    |                                    |
+     |                    |                                    |
+      ------->     DDS Security Core  <------------------------
+     |                    |                                    |
+     |                    |                                    |
+     |                    |                                    |
+     |                    v                                    |
+      ------->          DDS_RT        <------------------------
+   
+All security specific contents are under src/security.
+
+##### DDS Security API
+
+The DDS Security plugin API consists of just a few header files. There are separate 
+header files for each plugin: dds_security_api_authentication.h dds_security_api_cryptography.h 
+and dds_security_api_access_control.c
+
+The API functions and types are prepared from the IDL by adding DDS_Security_ namespace 
+prefix to functions and data types. Instead of extending DDS builtin topic data types, 
+separate DDS_Security_ data type is defined for the current type and the new secure data type.
+
+##### Built-in Plugins
+
+Cyclone DDS Security comes with three mandatory plugins: authentication, cryptography and access control.
+
+###### Authentication Plugin
+
+This plugin implements authentication using a trusted Certificate Authority (CA). It performs
+mutual authentication between discovered participants using the RSA or ECDSA Digital Signature 
+Algorithms and establishes a shared secret using Diffie-Hellman (DH) or Elliptic Curve Diffie-Hellman 
+(ECDH) Key Agreement Methods.
+
+<img src="pictures/dds_security_authentication_plugin.png" alt="DDS Security Plugin Components">
+
+###### Cryptography Plugin
+
+This plugin provides authenticated encryption using Advanced Encryption Standard (AES) in 
+Galois Counter Mode (AES-GCM). It supports two AES key sizes: 128 bits and 256 bits. It may 
+also provide additional reader-specific message authentication codes (MACs) using Galois MAC (AES-GMAC).
+
+<img src="pictures/dds_security_crypto_plugin.png" alt="DDS Security Plugin Components">
+
+
+###### Access Control Plugin
+
+<img src="pictures/dds_security_access_control_plugin.png" alt="DDS Security Plugin Components">
+
diff --git a/docs/dev/pictures/dds_security_access_control_plugin.png b/docs/dev/pictures/dds_security_access_control_plugin.png
new file mode 100644
index 0000000000000000000000000000000000000000..13b28d9a1a0655d50c03b602e85a094ef670d03d
GIT binary patch
literal 565056
zcmV)=K!m@EP)<h;3K|Lk000e1NJLTq00UtF00U|W1^@s7bIfyU00001b5ch_0Itp)
z=>Px#1ZP1_K>z@;j|==^1poj532;bRa{vGr5dZ)e5dq33^FIIp|D{PpK~#8N?0p4%
zR7tu$FtR%9``+$*|5+K?S$jLi7&AB_?(Rwg0fGeg;1Jv)Kp+s@37UksySsbRNk=-`
z=|2Cjsyj_5BoG{C^8J1%SNittPM>?~J5{%C)i4ajYZpVLy@t^bX%a}g+V7)71W9`n
zB&|Y7S_J5Bu0?la6}lVBA+9flxULA|ntXIs=i(Q?`nCKVvPeyh>4lV(Xe1{`At@;W
ziHYGzNC-n*TnJ)ggAo%Ggy`r%L`4N4GV(6M!|xz0>^4F}Z(`W6-d{5{H5HkenZ1ya
zk%6?dH2zvjN(y~WGJQ@GeNG~MP6B;S9DPnKeNGI0PBeW^6n#!4A|fK>XMKI*nUeO)
zU;RdY4p}^mw1}u+PFhTKz+;n^m6gTGQ3fMQnWXsm_+CUQlN25vPUjAzbB7`%Bm|}9
zRq`{x9`Q)hhW+*<K$wCN!+uIX-UuvL{Tqrdu7%l*l^FKUCyz~9D&b#$`4S&acELL1
zZ*Xdz6_Vp_;MjIoq-Vs!^YrB>A}uvFjn1EnU;dvCRHyF4SHJxbD-FIu;yqs^1suhQ
z5hJkQFZhQ+8pQ1~rL{F;#PHwAl-5)YG*vy7(w?Sx98%f?@qCKMzuT|C&*{hipP!CE
z%Dw$ak2#CVf^b~(U4^%QHX1(~Wd;4e{|;w2JK=`cEJR1$eFSM~SgHLv-XTSe82)n@
zyUgXsz5gFII^TaIB{>PH8R^(_DHx~kMi614q_*ME`|6+g2^}}=!!ek$_V5sCkE^t_
zB>$&YT7G`6e3^sX++1X4q#-*iL!q>^lteneOlgS;aa?JMiKNK*SVV@0eP2ie5>v7s
zihCiE{qAQ_jz^I;R6IUe^h?^KLMRl<*B%{7sW}7Upa1-Kzx(@xa%5*`W8vau55e*W
zu;?N9L6FAc4}bWBeC^4jqoYH<_H5$qx8KIaix=fv-`{v*(w;1&kV>WUbwD5xV9Amt
z@~x*2UteFGIdew7_5F<(LYkr7W_&!!82_1UjA_$sk$Yn+-{02O#+T0`8XFtsYY&F<
zh4QcvcSb$}5rl9;7{nc+gb;Lf1QG5L0to>Gf5KgKwcjD!Cfp+2Kxexj;X2_O;VL@Y
zt`II0E)gyg&J)g|qwOp@TF($p6HXC)@#dR9l7B;4ykMpE4yLqc5fX_+z9x${;z-gh
zMuG_V>-%GHV!8(3pI+b0mjgxrL@DFZq;1^3o|9G)y%v&Azh^?)TW|eX{tadEQb~K3
zN_!U3KT*mUm^7(082|ZXB1TTM#o6Vfk$Kt%=(>Uxb5-cf!KiFL_k2ieu9OZMO%;T4
zLYWker7{Rh2*pw~6cGxgs4tM9KA(^$fq)@bg1Q_+wgk0VgiHx)G6?B1RHqSAC8$av
zBuh}4L`amNB0-LL3CiQTQ6AfkvKT^iH%g;qD2XIQbfY+&5Y{dKj~*}jCrTMFr+9oV
zN&D-cKSzT13DhRk<A}8miZ5SBSzsor;(_w0PHgh7#rXHW#>l^ag}A-DQTi050WtW}
z&JDwd4ac-ke?s+}Q?xHlURO+l&+@T25q}pme0^x&uTgx{4K`z#lMW|@LB(+@_Sw9T
z_VU9(cOdNx#*c=*jgh~68|M~(McY@<B=yIy=zQ+~`Zc;r)}gEG8g`soj_s#cVBMLW
z820ubA(mXm<autdFKN{&Af-vU(kc^y+9Z(DXn&kkp|sK{DNdYgL}e77nbOe3l%>3H
zNNGdG;~+`<;~(FZe?wWkFwz<d$t}L(q_Gf-yA|lW{W75(&z&^G(FTY=uo9v&pgOM;
z<wZb3dKdoqR~>BLpAN$>RbDC5UWXVe9v?d%Qc<Uu+H2AtTA4TezyIUQ=8V&PDT~2X
z{(IuNk@k;Yy^X{p8_-(Vf)-NQNavGCP3*v-6G@!3ielg+>jUJ#-a=(?C_c46`pT2`
zk9R*p?8$}X3VS!0|Ml+^@TcGZ2eu!42vN>OtX;DdM`ulhsOTPlJy|Ft<!eJ%IQ{2+
z%>VMAXwH<ik#-TrS<HmljKMeO4Jqv*!EF9uo4{UV^djxeH{N{ic;f}(Sp*}k@4dWN
zA)Y{Kvg00KY0_RwtIMYP7AZ}Tg+5A?%9SR4sM0E^j`qBjHhlPS`P!=$50DmhbiIP0
zoqkoYvY(1(0nkEl(VK*=)>c@(Vk0N5J|zhkBAU@&ML#r=$w<2$ErQk5Ww0<bMy}sU
zG-Xxc^Up@&nD<#uT2sCh`YPk7c$9L|RxR8B$EmAet)-7xudS$w&%>u*e1S82yooeA
zCK=EeKN{6kq1M)Sz}>)Z-1Qejca$BL&)x9Eq<!_}7rnbx41~@$LaV&nMGK)Bk~UdK
zC*B34wE+@QJ@1MkX{nQS$KaixYS7(SE$f;gtRz&(yJ(cjx@ibX2*tAQ8g+#b*B0<@
z8{(Qg-gSecDhFMa*;KiHTmG$O@x(c;lSu5Vw6<zGM+pX%)9P|$N_$y3ZTz^g{gc!e
zuL5arKjhX7BO}^-qk@=rB4*X{wOnZiwsT>mY6Rm+DwyYN&y}`v{XsO6!WPY1h)EN)
zp`xk@S5hJ)ZN=i%Shi?AT&FL_vN_A3;o=Q-U1zv%4#oJ17O>aXz)Wj%gzetQ39HKl
zmM&O_87@n)z-<Mr7G8m-@pP=*kxW0ZE-ch1!Nu4Rf@CokOr3$HvzB1#oHeM51vc-^
zcrK)&Ta5proOUiC9*0j|MPOPn+K9Y;yY>=U0(4ZSqAL9cGRqiYRX|$<?Mp#tOEvcG
z*^lE#uc9meE|nllaq3PO_U+h-{a$C#S(%KKl<a3mnlf7J$dcB}_P5hIBawYKrm|DV
zE-RGQOlT@+$^%*}0N=xx(MC%VZ8N1c7f8`U7GFq3V^couBem61PGjryR{1HECd{P@
zI4Mn#PR9_cDX-O0@mQ58MMWYYNC8(`bv)%WQd%7qna@*c5O;B<6$G5*N;?{wiJB%6
znUi<WRveA?qHr`eH)EH(6a6z(#B`GSNOf(ZDmYD@O+Q`}5_5_W7?+I|2QR_NX&PMS
zY(!E@JZ?p%akWVV&w#X+YWk7oq%ndzYKSN*_SiaIT#EfYMx-UL7|leEtcau~eRm-d
z<h5}hFCv8nM1b6gG}8WM8}2|r#iOR_3`Ox+ODe0)Ad=E4hY?vr#p7cu?LKMltB+6(
zpML1gC!t}r0G-XUW7fFZVxFZo+)Q;L$}7Xg6W2It?yC=D*~U}Qop%8<Of9i__EaiP
zM`N+A5z4{>&`P8Vi>R_0+X{!ddr3_KuC4+i%wf(R%vk6J?J?7bNPB$J28V}Qeo~aO
z5ozehh`j8|wT!fm`{al_0BJXxy2Qw@ZbEp0fbS>9;In->_OF@=Lx%;J@a>lvIeHSl
z_;w=fHO641su?!BJ7B_?Z!vPD3KBE(acG4DC+*A8D){oNZ=gBuTL|iE&`@84b<>UD
z;c5!KnJe+dH{W9Q4j)dMAZRDXs+;2LZ^uGH#EEP3k(!c><JayynzT?aG9Gebn9XNO
zTj;(R*@a|Aw6taWskoe=YKiQdm(WaQ_Waq4Iccp_OlnP<1Pi0paI!GK?SKqaQE@qM
zS2P{70=8r%@>nj*7Qw=KCqj37Q2uJbnFZ6)K!jFNjyvNgd}&G(ceF#oh>{SQV%ipq
z(J3Nzk<uisjkKQ~N9&}tj%HF9DXp`SC3`X;!Wwi6WjRFJR1GmHu%o^ToeiWmQks~Q
zhDJh5IXY^KDD4zODx{po)JLRs*B4XODIaa5tRAIxl%}JtEaT~wCT@@&*H>wswX%BJ
z>(Y$Xmo(N2sJyMf0L3HPWyPbkor*}M;&IZ~Un>=l3@^g+AG>e)jV!0ZZMr*LT<2qw
zhA}z7QrUhr4IEqPhWOKaabo!*xX)a`iL;&J4n2K4s7%y`v4#f1L-WyG*hK*RBU*9Q
zzaG|8_T&8OP4HVg9|dGU&iU2AY|36--Mj`_SFWKlJRUWyRpcd*#(H(Jb-x|+AnvR|
z;Nhj1VrYYf>J#bp4ve3yk3+NcNHuvxWF_jFML3^8)}7SX+|rD0QklK`5y}l|XeafB
zW)|T>a6GnNj)94h^^3`A9df(hN$O(upRM~{2t+5XH<8jgNNG%E*Utu`jf&EC<}_JJ
zKzU6$r!~-$DJ}W54;tAG(Y*VW>sp1<q=e_|9vd1OprfM$l}QtOkv1S+2P4w2<)<ZU
zb5vM<!hOqMLd3}|e<9g><>Ij@Fc1w?N4vao8WGjI?eRqwk4{cb=<Mv2Zvk(;^%h?;
zrFE3WqO3(`Mwrs}9P;MtrNN{YQk~D4tDLl!>>F67twqN)VeFVObZ86jsFGS!hv2*l
zPTI^VwwyF65!Tow#1|_182jZoWSm>}{7Gvp>rjxkV(U3>L^kZZ3LVE)=%k{Y?cX-n
z8Ez&Tm};a0QEn;jUJ2%;ow|^OrF-L`VK@h;md%36jN?eS7KN)Gvyet)>^_qZHN!>l
za5TmeTVqs&M?gr%<W<ONJrFh4_udwgvG_q){@1{Wuuvw4DQ(PmWBB^nQ%Ava!j=V7
zpfY|e9oT_M-%cV&*@*?aZWCe6Xd~i+eYW7MQQu+yn%&ScbRh?rOFtsz2FfcEQ3LGF
z%;2%@2sBNna^jd%>>~2YONppwNm{`E)e2&IEWfL>D_MRiv{beDel0z7WM4gi!h5$-
zbnh}JtcjqeV}_+($rv+69g*jJ(L#1Vi_C`WjFp@;JF@)F4z4_(HRJ$O%&g#SKZ6ri
zpVoxBbYSxMaY(&*7kL*>qaxrQHaJ<MCMq48E?z_$aA=-8Y7zk|*-#fR#-W2bn6czG
z^ha4eKw9y={jm7tLtM}Az`O5h;y1&FLy&Trzs5qDG=}B|Qb;$wm#jUyyXePnL32Ir
zBfH<DG*(=8Q*}T}?vXWHNh#TPwltu*wvyI`=w@nbktq$W^`trhnySkbN^7YuMq?$B
z^dgnU?zFR|veLT9m^?~pZIt(Vl-5cnMOkUQJu;J-ke63HDqH@@<0};Fm65&=Ego;5
z@p+(l1d+y+mXMkEVv5JuW1AEN=^EL<#lZ#EHZD+8(}Sq2n(r@-@Q0{IjFd~>3Z*&N
zJM-gIwauYpwhY!YykTuM4fZapv1WG^gk(qpc5g)f^;57lF~Q=kVbHerfSS=_RFE2(
z+BCE+V5@J8TLB^zlj`mUv}60xJfspi5qoxU(&|#WVQc9EeIrNgIbI11dr#<2R)evo
z`cso8kxKb`*pbCBo4E<)k!LCI9w+5>aRo{wQg|;k<i(@grYmsWbOx3NmZ(j*OyuOi
zP+b$@husyVZKT{Ce|jzb@QIMtrJ{{2bx3M143-{#eoE`H{9Q_xKjd~SUvi~U@y&|x
zpc}F1qN0>3j#+*YIn5rWb+DFxQd$7jRhZIP(b%K3I#OCg7AY*b5qHkTlG<oLktHDO
zFQB@bfb4&d(q_y&%t@mv5WPmnB?Hy5q`YWC3`l9xXJSMiz-wXoYwlZq21Y{9dXMF2
zP%a+N1l2uIJhGPmW?Blf>v|ax!|BIxal?8}nyr<i!iX5FsJ`&xvArY$C34Hpnys28
z@+Wzu-Pq)p3Ht@dU^HbZCYsH}T(1!1-`WXRV^zv`wU82NjL1bkVQ6j@!E(xWOdk6!
z;!Z50f4l&ylU1<qfEOoCRdq5dYinU+q>rpK%b`J)by4<p)I}aa+~L`f2#H7{O;S%J
zJ_%_JMa>FgHtfI2jmWNJ_vpvotg!s?r*@(~H3_YxsEgMUv0}GBw2c>X(zecag!h`|
zoHTY1Ej+x4l$eCjTZy<E-b%&i0tl&c%}Bd<IRWNVcVPS^Yu?@9)W&r<y~&fvqYC!R
zviyQd2<sc}?;AjAqS_J&s>&5gt1mBoY^8OR(%Q<?pKbB@Fnk{@e|%#4Yk|~ss!Axu
z1Ek&9wL(EmkL9<vut63XiOG{R`F>|g`i<$yTxlXA?rcy!Y;D{)X;tx&bi6HZ#wsC2
zWu(;O$n+@)Kd=S@a*(WJ4<l{S)*#$oKNm&mb=Z2W5SFGkm}+VQow05&jI`G^9$RS=
zs-CcAe@bIU<WWj%ETa0=E26a5H69=>_V|6vucc!Q2XiYJ8(TnAT?egI^?ZL=NGw%S
z6JTj(0Rt0DsA<|@*|xh}X*N_vFf}5pOV+%Zlx1XK0aHB_Of%L)@`bZVIklH}H>hTH
zv(j!v9Y2P;)CRKh)$~4d7#mr_*wB86w1>n)mDbr~`AJ=Ea?2kdn!%S%R5UWBiRl<I
z6{D<0B=%kgEy>dNI7d<%>)g}EY(J62Ek9cp$c%`HiqQK?qtB%ME%bUFS^go?295_v
zdlJikt{=-UD(>LLV|Gp_FCLAIOch2%kXkZSJU&G{Kw4d%KtasT<DuM$96lEV^SOIj
zk1)PJ>eyz5<-Ze{jrCrU(A1yJNjtZECQ3r?ptGbMf&Mu>r?Go!F(EnFGSvztL4j03
zE=A<s9K;3Y;EI3KD@7U`MQHEdy{{Dd#$y|i9(*4xe}54f7SgNU_8{)p+oT;zEhMe-
z77`KF+gex)iM-Cn>T6ApXc-x(RfN^kss>R{ySQbEf|wr5Z=h$uE&sUj>U_VBt~qk9
z9Yl3}La$bSBV%jc%0KEmH3XjUR<!aPnNQ=Su~z;%DjF?KZP8ZHjk<&kh^SiNYGKAn
z3-I<O;$(NO8?yoX1*b83j1A^l8xE1C6pyX6{wzN;B9Bs9d&T`${?}b;!-oA4=px6(
zZr?~s(I6CJ*iZiipXEl7ikLHNMonWAzWME&*rfdtqAz;VnVaFCQG`GLY#0)cOeHlG
zA|o~o|Nd;^(~}l^{C>wC4RuXe8yY}YOBebYn&_yNHE~rZ#&N@v>wi_DG;K{C7-$<{
z?D)yBn6eE~SFWNqF_S9UWNgSKR?6L@zTJGN>CJ-bWDS%PsVnTQP@mR-xI`%t2+S}w
zhq|gh)YUYJKysJKKyr)}p8HZ?OQlI(w9;6I9<~%KS^muUV!q@`leh9`L>F_lvC1{;
z<RhwrTxkTQoR$(&#Cv8nQ3bmpm#jT0O-N+cP!U?6A-kW(TKHLOe^V9_Ems<A)fcAY
zg^>2{yYJ#}fBWze_~1T1l;Z=2_aBb;-+KuDIw0P8=N<XClf?t1iK=@OHyF!*KKQ=n
zuZj)j#iLNEcswzG&O?oeAV+pTjgjVTutZ)wKKM{!ZDK1Yt>EGnl*D5wr?FsURA-ed
zi19j~z>UahzjW9vIYyRWR)-5YxLRTP!y?PE<wO!Rv|TxAn`heK#@?N%PRZqMj~Wwn
zc-v!5at_*vU`ARgsY^|NF-Cp$9TqyxLuy<zJiW6yX%?z($T{zeaNkR~d7}(#ccsEr
zR|9%>8(^v8f`XtL<X^ao&HHkoVYv;e<Mgo3!5C*3FF<v85y}S`v4{0(6n9Jb=yXzA
z57;*gMP)U7T{#$OwZ)mdn>Zt>vm^|LrcQi)!gpgJ7Um%B{CeIcf!zVHnz9Qe4Nb5$
zv4*Cm77^D3)$c}Q{}c<w%}^(YX^>RXRn}I8is1ba)Kw!SH4n>=-F`7fqzA8?<u4)|
zyY56FlJ9!s`nDOQf@1vU?_Z%hm#!eC7)WU>Wa~1e5&N{K`_)jI@A~-)VwmM;{T|gO
zt09x}(|2QKmfuxN6^$9aTlqCKEI4VEvEgLtEqN<{DJd;4tC=e;^3Zw+$|;W#Y0Y_3
z?D8!{<kg!f&8Wv#?|e-7W;ALTY4LeP9-yVEkF@Kd2-><DX~z#@mZ>^Qu3p2eRrgR%
z7wt^TDX5MU6M0lch!)_eZ!OmE%EdRjOE_t)AO4e!Ou$K#b}Pv0EDnO2x*A{ii73S6
zNqR7HS&7Wb23|aBnz<k)FAW#h*<<o#RZLc$jKW%Wt6zW{N%=C;>eJ}8$z-rp(B4{$
zGq<DR;I<wUCh5Kyr9Evce`}diD?fWkUP);!1+3li`B{EeL>@hQ6u<bzFHm1k)?6u!
zjg9&80i_Z7EUL>(<onndl~SJ5s@YX37AcfQ8-z}}l4VMRh}1@;aVOW^L{6=dD~)xf
zLz{q{W%aWmEmo;7zsk4?aJ4kWsL^Bi_C&Jt6IIkOR>d4!X1n5SNIm>+M5377;Fcq?
zFtA?%6B`e-RCL2YQxo<Z?qSj-HBzby^2lsBti1!v6}Qm9MmorrqMS&x(ba{!oej(;
zj(x7h<D-Hp^N)Z0;{&91mPRVpPcAW~<=~9S+-(>8Egm7rKwdEs^}H;9d2t&^&HS<5
zqICKKq<X2m{jr&p#)?P&=q{;@fgRga*oM3$0ehkcZB+m4q+^)UR_%;LE0N2((kbUO
z*1wb4e%8YOGD+)+2S_6$QeRcb*LB8@#;&Cc5s_Aay6Pf~`)(9!E9r}O5^+pvyi!f3
z%I5}*XYPWFwiZsVafJ2+HLSAIqu-By5J4tPTsA{fMHl<r%~2b594(2bA#JZjL~7=f
zk=EDpGt8dt@xVS-JYEiO;KgGJkuew}a&_HWp3{0-`3qT>@IFSQnBA5k(o`nvDoCrM
zdfLk(?LoYPmcJskKtar{&~j*7uZ5<e1K&>eJCBN-I<!(TolnL2#jpk{LdhTyX_Iwl
z!o$cEd*)aZX~3cDMTm(K;QHM%=s9hHp866To9Te7t7oGzt&EcvA1lJl%^^6j|15-Q
zHN3v&W@g1n%eWPfyznxlgf?)}RE^f+t1rGq=#GugowV}oI7qwiTYekIS$y5Z$Pu=7
z^T~{;V3WBS(2#}k<Hy6?(jJ9XEO#|y*R6DPceTKN{W<<*4%!+qdfa$eTP&3qkC|9~
z=qe)iPKUHA5f>I)QPrU0>6A8Dyl$3%urZL*Sjg7<R~k1VteAWmO7mJdTR}_*<+8Ek
z#=+QX4&P=SR_(0q&{{=#h+bn&SDn>lznxsM=0p}O%$zxCi#DEzsl#5-#luO{p5g^_
z-KB81vO*&xl;5H5#;QGWm|<azEVB5*%nrD%^h5N1Pbxk|xVCBm>N2QU%mj{}uX|yn
zvB=EIe`@697WKRTNsy75C;w)$c&O4OJ*K12I>SIpW46CXX>2srP9peqQrfeMwJR3N
z*PeYmKw7}Q`=(>d!J9Chx*l2vwtTxd_!>G&D$zz&9M1zcIB5ZXVQ{xL$4W<ItTHsg
zR(o4yUh(E_kLl;VQ4|`7?6eLvQDytU`C^!98N-t*+Z(1>qnw=MottIQpLGKDS?xTh
z1%-6LamF5u*K~w~+IO!lY2D3bxP1DEeCyf9LzOmX_Chq1QrMHAbKGPtCGEu(^4DqK
z%=!FLU2gfw%J&TZQXCQnx9RiIK<lh{R34H-kSpu=$dop7`fgGiZBsGWOKGW6K0<g^
z^8LR2uN!I4GaewVvGo3vpzU>1KKz8P=}f-eUEN4|PD)9Wh>{nNjrjszSL-Prn`xhj
zwi%caX<_@wO$w>Vyc^LDAr;Sa%}n^M8DWkT3szm@gk9L@je4qZ3y4JDYYnKT;<1*9
zV-I2sk=8pNAdOX!dq}f#oQuih)S#!K%C~1b&&C{QCtMDxhS!a9thTg3W%NDd<`YTG
zoDe}aj`J|b$qDmjE#Rb0x3k6Vd-c3{G&gsK+IN$%)zJ!$CdP1coPs->mUGhFXUxZ}
z>5E|FFdrwc*2BzxE5?ud0+r!OFO)RaUdfufUM2L6hZc`L5Gn4d-9P4OEx&+N*4K!z
zk?3B!5s}}L84v?K`qZm(t@PN_i?I9&KARQ9bWkz4_vm$n<?pI$!pap}(LriFdb=9O
zj^Bi_$~ah>ZN^kxeKe$Ja?%VYjl+4L+o&h^$Vl6=W-WwSHE1d5q~cM^@2Ab!6pZsn
z@4(pH71J$c9eV`vWt7)g#~!)}vVluyvZ3~^=?m@H^IDRojQa|sVpD0IVIZZk9>&T_
zV~;hx3YI^tq5&fLof@|I-6(tLu4JQm_ql!Z5Ync8KtCQ8S7W9g!-(O-F=E&-7<~CB
z<ev4Q|1AU~znz4?|MG3b9CJs>)lGD=8Vvi<AMnO6zQWqcf5wGPuDB2ygkd9og|Ywp
zHaZJ#qa-JSexP(nn~1z8B`sKKY^*b<{IH)Yxec`5QP;-Dd7Nfo2(PuvNF~Q`_3SO|
z-hUnk+@^BUDibnr&gU9-?7NIyvhQXN>!CMM8!H@5UJ7aaq4&p)hmZydYxQWO6SMVB
zS{D&oAZ3bU4aOa;MTFF*q%?>Gu+Sb02`Np&nz49)`YK4d;>ytdtd+*v7@69(c&x?g
zyRspcSQUV&jwy|q52my$p$(ig_P_-Lv;93vW33<c>{iT6RNCX*44vZW04E3gN5D=7
zdj?w>>}=$)mV?ZeErX>DHVhUrP`y?LGa0N*<uHMxr3?<1#&Q_pr$76d{M*Um0n(bv
z#Y&{fmTk0bt)(gefp61NMEhEpF(K0Ko)6-;Vs2ar<)pRHz7`^}$B1k)H<UGBQ7%in
zbb;SbyRmK_>d5{x((Vtl#7L8MR(&2ugblIu$ao!dnzH4uBPGpTeF+9C6X8Btk1E!(
zPCqM_uZOkE5?lxqLSJVt91Sfn#ljL=29B`QQR6p3Jr=Lzr0tw#k4<I<aCBXP+hMIR
zw%vv6TMy#KdUxbf9c=Bv6d2fU#fcSj5U^!Esv~3hP`J<2J+k?(2Mi)@?b>w;lAPyx
z)5Um=<l2pih7Rzar;FA+e|{+ImcSzJ)>VWR)IiH(DclT=Icd%5H-U;!bW`yuZWrS0
zy+kTj8?onl6x0ouanjaP>S1@VBhs>P(mx6wHik&?Sp<|vK6&x@Fen?57FuV;V+(CR
zNh?3I`hAPXS|XH@#+E&#v0>hy1!+A|TT54H-{?na`(~;`-+8la`yombwvgILX(PY*
z;>9X0-sk>9g-mHDk6eej?LI8fFj6#Oi3leSox<gaMi?8+hqH+dRP~)<W-%3Q#VuTE
zpN#y1lg8$m@!aBzdAnm_FhLJ#r}smY-^K4(pSV`XNz-)LkE+--goL-^`qdJQv)P6E
z)Gkh%ko6-;k|HYwu%34T2Ru(>#ey}cN_ckt9<8jb<ZBc}8td+@AWbSJ!`OL$ySsyY
z2oc7J>uLq$gLX<pvf{CeRF+dw18J*(L()<UDS-{rnSN#kDyr#6ZLE+R5h9P1Mua^p
zBhnw(sNrlmn94Ql4*n>mH4HGISq;_Io>%eMH^z+{2QxD>*%T#xl;%AD7*_5%M?{iy
zly*T&&z_EH!%}Bc*lUlbeC*FjYt5(XgSZ)^zaEMI`$83=DS0?@B?Oyi+u+)+CAhTQ
z7#Ww=(IHjH$Sc698^LJH4?#z96crz2`=7@0M;uwFAZX6Y-I%i22PRg#u~0`9TNcgW
z`*-X<j*Z)Wpl3Z7=1Z<(%tUL9Q#XQxjyBer=^^NdHz&<|?@5?x*uYw2A}4LOr9O_Y
zUI3p%x3P2UaWW+2)@JR1k>yHQ&peKKn<I!cI{$QMtexqKgPsTZATPo9I{5hf-%OhN
zTuAE`eMl24t#dqv5fSsE@da0|d%%Zx=L#eHzkVklou`e`0n23~*2+(6TYfZ+mUIk(
zDQ)wbooHqiZ7L$!!||Iuc9P;`{T`Xpc!M!*vw_W+dt|7mqL3-AhK<;h#=6tpZ{_DB
z^gQF7)^D)lk)nqrW<)f{PT)#2aq^)0nUIs_u4#hOdxwZLs;hy}L58D^&7<8xL=%xj
znwh07+J(i~cqJM}M#~VKRSJDIV{A4zde)?ME65U2J&i3{y^Ps^X8qYVTe1#7t54?e
zR((bm8@RJXxp-uqeQ2FoeO5fO`)m6zmT`3%Yv@r?Nv~x!@|OMjEGeQ6ALPa3?u~37
zHCa=ZjhY&NYKBd!!0^0^$6nEo5$T0j(en2Y#lVb+^O950nJ@wFs`?7czjO00Y}>LA
z>Q;;J@t3M-Ef%1SRJdl#d3c`4;G|hh*2L14d*I}@fs?jv<31QUdSIq!ILs!GM(oj@
zXv}QJmbLq^jZjaDW2AYm+KWjV4p1MXN~CFEiL(=yO`V1+QrU|lZTIfo3X;rc?!;;{
zO}_4IX3s6ZD3@9OP82t`!{b~GbZ2aVy{WCth?GTBF;swdBK2BA9&G0Bg{}2!ETBsD
zR&zZ_n<}u<#~;Fkvvgb~8IuasRF}bS^&yzd*vd(}5*EivYs?D8!Ak*8Z$x^)j0k(o
z>0w6XVV0kDR+U+PslteGGeX5<t<vZQ)#MzXw-M<T11RnDkt4||(z;w}khVRbG<Hmn
z(%9HpgHalUq&B(I{`K+K4=C;MrNBp%7N_)3AyeAE9jD0h@9kyz8C3Kgu=ZpYCQa0Z
z&Lkrg1_vPPvKPcv9k?A-!%15`V-~iP!g@%XK5YRXbegsD``)O7it}Ok&Ygj+Yxm>R
zFTSC?Rl`Z+j*^N;_FNi!YG&&iFD#noikgJRq2iI^v6aSpXtCv^EI*$dNJ(jIimpes
zJu)-WWBH$Fi^xOcbt8>MT6)ea4>L21e)lWmNh3Zs3JtYY1EYqa5)G7#>Z{5LWrPyc
zR~E}qQH1*P0zy6nWqA;kFyul|oI}VaWI<4riMqlJLOSXS(omP5LP$nkUJ@aZqc%4I
zwK?&GI2<_WCI5D^c!0FmAzWQu<!dh{UbT5apW@q45%H2{rhOTtEnBuszV-6sk)$0s
zaDXqvy%u5BY-=2_8G}399B5A))^6O0E-BTzUvRt%N;Cf7_vC8>L<_m80YX&tkh=_n
zh=-CE9v&`Vd$od*_Lsl>MZWd?<KO@Ow|q?&@BH>XnEmA=2y*VClMMkualL@50TdJe
z?+Zj6a6#yarSw`GK{orw=d*qI^4-teP~pEF&6(%;c4Zf^KePhs%YET{GnVgrR6LZl
zS8-x)7BgndkgvU%_~x5$<ZG`+^dfCX!(tqgdMI#Ex(fTH%duCw1iPh+uv0o8+obN;
zBAt!R5;ts=Ovif3RIHUaW3|K)t0eYVA+eF4t#?F3L}2NXCC>yO{q1jjxonVNPkBB~
z^f##3%Z#TcZRYu}uuf<U^R<7+(i{~|T2~iozE4~voEZS83BH7r1XhR~CwLQ%5?F6|
zW_S+~Sa#h{*h>Y#9>OldPQnhtHo{hdCt)*TBVhw!J;5O;h~7205O+pC0uh98LKs!)
zLeSL_Ob8;}BLorx2>ygS=xV=BxJ9^$&h{GwKf-mwRdlvpAzUV0B3vX~Ae=`>+gZXH
zbhMr(oFe$*gAe{D|8}x?dZkIHVH2id4V<tJj?auV2A?i5CytS}p2TvHmW;R`8fkC6
z{bTvJlf`o>9-o#pw$z&VDG?{Ya)Fc+xQ_DquP4rj?uj^f5`p_@->XEL=Jch|TfZ5<
z{?lLJ{L$|L3Hy)PjnO;kEZl%r=^aSA7;!I%w0-qX&yBRRWOfEB9(}~!isI3Wj^o9n
zRPxFy?Ly2&TE1kZ9qF706Z1cF(vEho#P9z8E<W33iXE5>odA2-uKO44il#gjX(Qfz
z6ThH(kh8^S*nD{z&s~el+wtDigYY4uSn<egfacj8{O#R0urcE-CvgkGDXRs47^}tW
zQ9mIpy0G-wk=7B3Vefr{=o@QLTYL(&nd~wOp&vX9XZ((!B6}YWA6$q-2Ns~IEd*`i
z5d7+|6VcVlib#Jt$6cH}vkRHQtKfBDHX2)RL)?B1ALwYIGJ6XydArduSFmi`EOd7e
zaqa9EA~HM9()-T>UB0NO_kD7uz3AfcRWKsbu1HwUaY4`-H)P+MgTj03AeBVH(!v54
zx0oX#<roa~#z9|qGz6_-aGB?hs`Nb&cd^{&PetJ!xXfOFfCHAen|2=NR$8zySA&zq
zcgPN!4_ni3U|_6C=NLmDdKpckOZ56Ubk<VA-+dmEj#Idq;x#zZhL0GIx9O@~b7mrp
z1Lx9J{1!&MF&tli@(xz|jmLKBJTe~hF#Me#!?Vp68!;Wj>G+?G`Wt>q%YjI{LAWvi
z*o<b3)C&Yw<)rJ36M2fj$m~nxVFDwv$Cz*;33~{;2s;Ve3EK!;2`<sm^mlNfP}+bP
zG9ny<QQF~d2`A`~q<2nZU`pFT`L9Q53`6em8Ii^m)kBo3>H?hX6jKpl58sA(EJ!HB
z2_l4%HfNDD4wKzKM(eu?W=BFX&T%uwOwxz8=SA$!yNMk+H=t!<fGwHVIBD!SUPRJz
zR%sVDh$Wc1YY8?;${&lglP6EX*Z1@*h3uSs`L~lrFVa|KW#>IL`il=ojl%5n=ljJh
zIot>{<ZzW^8euBIh2Tt>LU24MgS{Mf1Y3d)!AcGbIm`(^di!npxA=a<1EdYbs~<z8
zy@oMF+G`d=guQ0*0Aam*9JR`N8nMYrMQpC-I$4h*VWq4W5u1Rtwouk<sH*oJ+V|go
zAE~J^y^xX;g`}iNBql~6At4O$@u7%|3qfpb5MpBPAu1{Wk&*t0h`5XJ@Y@IryM@ru
zoANW>kIc->UdYJEKze#Q($doCb5iMZQs{G%=yMY3a}wxt;^}kZ=yPJ}b7JUoqWH6E
z>^9Ma2@~XJeLdot5>`}FAwSFG5ElAK!m@LV<Y$!yBSjgEpycG_UL+|K6ipRsWs<_e
z!sxuA2nh+npZ@&f?s`9qcqC!Tmprk5-);;W@xS=zkB4F8uit=|*G`-WPJL{`P6ggV
zU_w09X6?W~|NJjR-`;_gxSNQJ4aTl%ljuhcL`-zR6A>15&xe$j4yWDM@h|mx*z2N-
z#Cs<ZpOA<NfBp&LV`J#tQQv>UdK4yQ^QDLckT%zFh5h+gKYB(AdvuXFq_F$(!ivP-
zePfGZ!~Ou5PyU3sbE{F19gU34Xx<Wk_HH0we)9V_acHgzGGi}3k}$`OH;@=~0WlXg
z;A>+G{J+nP;h_E%uIyiqs7qThe8dPi=zWKu3?D(I!#|10C?YZrr*4PQXZ;VfKL2Ql
zu*X%{@_jx}tgxKSbXt<hNY6wz6@__uc}PpoKvHrF5)zY<nUzIFZ7l6$W`v4Nxx(V(
zqUrM!5E&Ko{U9tMITMK~Sr0`@dTzh_ySnc8ksm4&pHDnM*kFSFvxAAG)NDe|fJo0O
z=y!i#^zEj%aPhJMp`ocw%jFMX(EvzJd-6X0FC!kCu%G<oC-SwY4?R6S`PxtnHl9df
zPZE7q;^V_^tPI8D#tR{=t`qpD-43XlOqcI@6(e5h#^pee-^}a`eaH>XyM%|`(7c9$
zZfJJ4os-?vZ0)(J$@+Y-TfO(=g(>Vs#dkVO@xJa#+$oaXR1NZUz!HPc`1-@+852ej
zKO@3w>+X-w_1Y8GYt)>liYF&*#f9UDstCZCB_8<4NAIDvbO+FNnG=?N$^zY8jJRh^
z7#n4+@8h-uf<1mKe+0Kt{s?Z*<F{;(X!gvs^26?ZA9U~U5nSaFclvz<SNZW<`6IZc
zJ&)kZAHOY;KYkk$`Xo>6yt+l=YeyIx3uKO!9p>4)qBcQ*P3w>1>Xlklg(TsxpU;A+
zdn63r{}A)XkAl0M8~kqEmj73e6EebBi_5TKZzE=pInd4S6x_kN)DZmsKdSihw<Bmf
z8Wx8SVb!|X7(R?`M<M&dRCFT@W;&nIdw&kC|9JzVf-Mks-N3M){T?6u^bHvN^{0?F
zv93mUFzoGLqB(U5+AFuC;F>k<J5R)3!iVqv7a+NW5yRht`Ded-eF>{1g>jI|YLeLC
zWWc^9>-m6WOkp+gfTh(klt)NV7KNuGOc_g-&g`?Vx58GfbRji8T4C##oBgm9_P9mj
zlM$AnM9e_=0ThW>S4`oA2?>m_p9~-ViV_Bh#ccl1`)F)zdSKtnfO0%n!bJI%@LN5d
z4@A~Z#{|+3zUPVnZ~R0J>L30I?~R;`Gj~O=3}JmkBw~Y$y;?C;Bt9gR31jUv+Q0j=
zV!gk}IlY80{g3VkYuM>&-C;AK^~5&AF~|?UsCcb=ppy*{&y6rAtx;$wkn&k^=g(Wm
z-Pe!a7=d@+9L5LP95(FN{D~BX`b;Sj$UwYmgtfJ?8F6Lt+u!~V^#1q(rc=GoW63nW
z?`E-V(z?$LR`L69g?^i9s~xK~zQsI8O{|#393Ze{E9;;Rj2Q6?9C02G|Lsm#yLK^Q
z71kZP1Fw)0SnL?wcOFvMLxNpouUaU+5xaNv<{NK5SG@6pu-TJ6&+>FJoXpWHP1vIp
zraZmKi&j`A)w`+^qzZ*qP`&F1udp7%l!;-}hs4p3TvG{H+wFqh7!_!0Xz)?I+l#9?
zVeNFhqvK3I7d0bnov|6#F89QGGjp`$H}WC;7CAa2<>XGJX8^Z?MX)e5L?*2_=8924
zOOM5#m~L*shxDsWmtuy!0|GpkBQKN9C`jjYw#UkC$=G_R5Z@ZF$6PZbjQ>_wM%oh+
z)~hSTfVe*roMJN7{ziinu?bZLvMv;TM}%v<KO!8PK7@}5rx+EkST-^o>t-Pz8Lq23
zuh+<MU6on#Z!C*JD@+-TNH!#GFNHDdUPYw6CONEsg8JgsAgosKkcx9_wS+I(;LlfM
zT2My{VhXc#I)KS)c1S+&#f!xD;wpG7Ux%q~%W(WwB{Zx(aCi3xPM9DyhmW^dm<vp?
zn}->jgW;rOh!qQ#!di7QoD5Zvef1(@iG<~=uVIR@IWp6L;&i~q${kh<F2Y392+L+I
zgo~CM>?ePVXfH3sMvIYs=@tquUE|GC$#H;{-Qwp)SbAdzx<ysU47~um`RgFaiNyZh
z2XXY+O&mLR9Ra?3aq40u<>%icyQmD_C$15B0$ks{k&4r|(3pM?!$!P=JzJI|=E5HQ
zjEdOcLtAiuofCF#-GN;jS3f;reZi(GW=p0j+34L;oIQL21qI!FA5$1pR--(Joj7z6
z#fdozg*A}ETKGJjq)M{$bvaZop<<FLY`V*4H0F^iiP#>6Rg=2dD5q@xmj)^lE0d&r
z1aGFW3a&5-%7`eYFg9Q&%V*Dvu<{l{+*L%J+Xh=pQxryAfRn>)%=I{is+?d_Ukm20
zK7oeD2HcHI!?c+juxN)5pU@!c%r+F(uwG_0IC>)*9nIBnwY4Rc<w4q54s&x$m>cRn
zTf#(2^S`tx4GhgE=#ek`GaWO`EIDD@)?DCqF*d^zo1}*|Pi0Z@$BM+MW+o62F?Cc#
z_YD5b2}_kt$3IjgJ^^8;!x|8iEyl&LIyf%6#1$6iwGI}mZo|z=ANJZ4h^S^hK0eD~
zHzS(x#RMbFH!?*0i9ImWTY;$tnwVy&N<;#QF(TL-xp2acZQhErhkW7V<;MwIe;^f~
zeKQgMo0kp|_B2IezZk&Q^J4K~rb9kmF(atQbg(IlUzX{ZsOhXA=bNv;qP-HVm}ZGq
zaX01W&9o^-LQOM@Y8!DeFa?1JXCvd{I!+#&B7|5%3H_KAwRPxfZ^6!mPKY?^$q7q3
zwG5JGDwbMnp=-4oE2f%IPN+tgupE(zsqolw6lquYLQq$Zto%YqYBM3JV?|LORK|Rb
z`PN!kyLsKC2@{sfCNf~t6pQJ&cq+<v?g^qVAu9$|w2Wc7`VJPjFNHJN_4La}P(it=
ziBz`CD+S}!OmJ?C2U5?U!17%&2#jijt@C`C>6lUek`Y#&-iaGQB208Xg58dGaG$=2
za)b*S$l||9!j#e3MoOY3n*mTN?trAb8{OTVkaV=7tF;-@HX+&IMs(A%ufovQfOa9}
z4>n_ZyAa~m1|<3}<|-4D!aC|GiBsN^ux(OTCn>6<h7vjL>mr4<SLKn?NM&+`wO3@J
zy(|+Ql~1WKMj&7BqcAoueg_f!sETtvT|kU5hF8JXLuo{AboVzpcmGAAwDUe;AaYod
zxcg=zFA^tfSt*Ldh6XAkpLdbiRx7jh4B5rqs3#)gGCHvDS_xNODk*B5h8fI^%;0Qk
zjOubRpAC=|i5^E&VKVIi_RMp^I&(eDnLZP9XUxY8*LkpYbcc?y1DbL>IAM+XVi;S@
zfQpI^bjQzzjgb+iSzBZF)HyGVu#H;}E65?)KrHFTx4JGU3iN`J2313j1|lLMo6qme
z2)nU;4pm)d(3=||7Pq6mxrO#upt`Xcdv7Om!o=-0bRE#^9gV0b!pv>wLVL^@q@P*-
zVse<M>i+u8i-CN*i>aT;6Ol_~<KUOYXX6^xM_S8iKXZ;$L^31NMqsV=A~sPED;4sj
zxVYYf6V^f|q>+kS<`SFO#608}>t9fj_|ZonDTsPFUNh4%pskk|iL5B>Z8~V1io~_c
zxADn$mbiKHB5@|EhE1HxS~|u$dXb%H#UgEIk>PlbMPh#gzVrkmWZVRG1vykc^5xXg
z8pyc3m5Rt3PMGnOl{hd%ixk)mX>AfR8ibVF8Zeer!}1j)Y_g#(YU9qJtRe^7uEk;E
zgmK7<@rRMI{fi~+*u6S#>wN>OVLkUW+Q`=5+p_`|9(S<F(HO3VDnwGF%+?cO?rTqB
zf`$z&OdPPv*$j<Y6`U}?vmscs?J87^=V0=*V^}lY7V|Cjz-9$}9)#Vvc}M<V4IDj0
zDMQp)&zIfpP4aC4TAPHgkHY!|Yx(G7I-YlHeGg%rw8v0b-^jkWTD~SDY=Y(#1zBuv
zXtr!AO+s133Fw$Oqp6*Yh*XT_hwnjU{8&1MJulac(>s>o_@VW<8kC6Ek_2wuzZ&%&
ztY)vktaZC&O+s{aSH$0dL|A~@nB(|v)HtY58Vm28E1oT3)kPhAsj&6r?AC9&LsyKf
zNL;LK#HYhzgxOo$aKhTlM2Jr9!i*gen69sj-Ln_LKc3D*m1!qOSIpZP%?Y#AnS_Xa
zYv`W@#*g_HV@GRpTh9n%b+gDQV3m^{>@2KM$MP8wHpSMJcX4B6rA9PEXOulo%$bRr
z6kv*tD^%5uvEyiYzl5nx*@e$P_#gcCPowbv-W!j+E30w!%mJjGTB9IJ8GN#EX*X9;
zb7P~-;<FsqDMGWL3g^~3(=i?BBDHmj$RUbllgV*wPdTHdz7`$Lq%=}kV+H+it!$m@
zUiBq(QRhHdmW$38sjzPPj(lB7VI6ca@mBgrD6Eah8%SX-WIi6Iuv#|N6;szUc8SX9
zvGsE`trh$H56v62>9~957%vj3g2f4&IB}w)NEF2TKEEPS+13}7O3*+`OU~|s_nk^K
z(>ha_m7yM-?CkiG7m4HonZj;Iw7^);1bZ(O!Ohx@6KSMx1r0r0t}qKL2UN$V!_v$i
zCTd!kXU=9Wci{><bwdaZyX_b|YBU^ZpRI`_)XDPOTDf44PZ?~S_QF}qf_Ea#ivw=m
zXoj7h5f0Cvg_U-CPej=A)%Pcj<F=j@<}${B$P+_V#Q-;VxuP-SIvp)SR$VhLhox}B
zQcG$PR#1&qwz|-#|0D6t3fLK1K#+759i=gxux_ysdRjI(G1mh1F+S*~Vp7sokE&|+
zxbbsTn6j-8yB&)zQdzfv!0L=dNc7z}BqRvYM0t!6)J9NNSQ8b0td&0CN(?s{OkFpE
zTY0N}9a;GnDmm_+kAWbah^Kuusia(5GKKLLdny`NI4p*c&AUn4$_gusWv%w4&Uiev
z!urSe#MTeSbg=x@pXsPiDdnV<hlL?O{rR}W!4fuh+++ngCl0dlyk+x6vt>+>A9e*5
zz-Y=6bhp&OVct<x7G~hyfmw8=7IMPq1?1E;V2PdqDnkxJLtPc!<#Ywnl@*a!MnqMi
z=<aSbQ!&*p62N?w4<>y59d50&p&XLS3A?q<iGF+{jtINwIpygHJ9xW_+xnxo%3(JB
z7@xhC6^Vf-kC71~a;V4-P7q<T*&<GuHJOT=o93Z0Jr^Z8T{w0+8ZCKElx%^mK3ULH
zTSUfV0g5AXiLh{N_0EKj%{Hh^G{A|4ZV21E2@NR%%55@*J#WJLLtS+_q~f0K`wA1*
z*7j0ZT^W(a+7%x|VS+MJkz8S2Oi@f>g8K@q&We9J!Un`36xP>tJPTX@ED0+vDMNf>
z`fGu@ddffY=uH^qtJ3TiPD+ohPoNyLY^@(8%{{i>5SHdPTw%=Fnl8Qub2A%Gn1%6L
zH0C#<v$UO#u}4*GB&-dMP!*p*M#GxV8NHdz3L`A}W++!uEfL0UZcd%L4`arv!ryb*
z3nA=vjmJ`$go<sx-jBk%sCayx6!yBt1BA8L-Y2MpND-3KGV{bZeXkZ&EMtMTCd`dY
zVP;~?8+uE~`kNaVbA|cu*?@+e3i$6@1#=T~SkwN{Xc4SuAA^mSK3RTKEZ%k(mjgva
z7_iRH7TW4sFx4|8(tt`rU{E`zue>ot*Z}cJg(=(m#IOu>F>^#krLw}<wED64GI}Yj
zgY12e!dl35G?BGuE%dC>SC}W|3KNp8ZzQYFtbLEd8i`1@Z-}t|<DrB-uB|^lcea8s
z)>_X96S5+aa+JxGZ9_%kGl+*0w(EL1+4^qmzg7%G=Yv#S%4~h~<#P&Ke>bKHnsy$X
zu!B=Aan5rMlJCWl+JM~DT6p_aal+h<^l@<MY<lk<B9VS@+PCgN3UnvTd8G*3vv)6_
z6z)~Qo;_?HjQjCerbB@N6!v{E9ewL%58#1`yql;#_J~%GMtPmAZ;J<O?O-F~_1oHU
zzaCcqFk7FKA|sC3dX}paDZk8HaaqaM-*2rqH#FdcwU@W@w!~SxqTu1=fGsnY;Ce(W
zZ|%_2HNYHsYkl}W4>VBzV!5oIa+x3p5XgH?ZQdV^eN!Bef8`9qqv(Cw25>R8fCE(<
ze&~b=p0wiJpRH%Tf0@B}l)~D}$#C?eFlI1bH--It*f7K%c0*AU{o`oE%~SjE*048m
za^85VyjI|JWC@>w>*S2@aBTXww66xj=0^OU_Ms{UXr+8nau>N3bmcb^aZf{-vaPQm
z#Wm77^9m)n643y<NVvi@$%<=fYe7R*U0x*0TI)mO+u>+t2EB<I(APC5%dQR`EmKm9
z4(v<~IAIIcokHU2Gg#zkMz3pN(gYPwm>@%nRwDN9?p-Lp7mvz_Bxq^sLQhK<mKM&h
zoWhzbav!O%ilopNuP|j>pPfJ_XSTjx-daz^W=?!5@-tg`Ykenev(7oJ)t)Je^{MZW
zcgCqFGLnM}A)<Y(C}av_7g|jQsWVSz>ziq*P*@5TyJY*D$mUlumAxRs{`R*I2Z0Y{
z_)rNSy#Hvt|K3CJ*Z%R|Uk6XvleX5k6nFG05^It(`!yYI_ES-l*?*CkNrd$+5_iw>
z;Dl+YX(<R({nT(MhxK5~r4nxIcU;Vep4~2mtxvskQ(^1<B8AX%-ogp<ur|h}m9D%k
zF*7U~ni?};ZN%CVlaU=+hz3R)sm6NNeyEu(gQJNB4lZ!Tu~TU{f3uMjW=loj+12Y1
z=r6!`Iv#M)(!xR`T}+-#<R;1PhsED4#f+twG09*)^hR0Zvga0D*}50yWL5?uOe!G-
zcXgqgmbIdX_okY$?fiX$I%@gScE&+yYHGpCM4xg}CnpTjcHGOW!nO5wnEdT%I8D-m
zqp1}grwMctSwvVyVgyW9_`=A@62kbClup!OYh{VHma6AdB=(C(DC||V^`eRtth-Z)
z3n6*%KCoWC_rXvQrG#Gl<qBi*(iPT1`6@ZKnv<ez>t`%F->bEL@?^F9t@VqpLUpn_
zC(Ocl4VsI^Twykrb`T`S!`jf0x7JTqQRNB~P@bB(DFj**REaQIYrUqXKAlsY6IPp4
z%T+kTl+23iBnVQvIboAk)D(mTUr5C$eGhmzn4kdLKqSAGl*`U-X>5lp*E%_22M)5y
z7@sT{Da+0z+$XDp^-pX^C8^S34x7Z0N)#=1t}s<9n&)b2KwVW0r43D#tcCFNbfN!6
zl`t8Lj|XDbA%9Bd)sV8zI8C*%)YHUF8zUG@9QXVc_Oz|_ti_{^OvgY9>t#CnQCJmI
z*%K;^#l?$k-az2XFTdnV<;cyY`UOP~QOc+;FQKKp?>#AuMRjQr46J6-8k=grlatk>
zFtS{{j|keCI}`O%7@Mqt?{BMnHiWg4a(W0dn|&V3b_MWtFE>M~Ff(F0FwN2kIr&l;
zXlX!2MGF>sI`~%K35S->;e@H`O@;TRLaf*p08w5e8VjVDYCeq@iK5&VOqehUsw$IE
zOm1=4ku;dtZot^_+Ap;pcKrBpxVyW{NRjtZ><dpD+s8H?vo@dQgf(Yg=7gzCnxrTa
zHyCI=Lxqtw_wldhw!SF67T$Bs@4rUsYA4s&K^IFGK}5&0$}_8v6(rWuhmqPyVeOS<
z=ZRRRu)SyUIbp0%VmlotB1_K{#)?Gt$SiY<FO#sIV8rB?*C|M9E(jyFbU?$v5$jCN
z5PWPc?qy~XsT~kkla(bk>8efOgk=;Ipu4LXW^UUsLDd2qoD5+&Z5upY46tXuIVY?p
zKNXtR3&>2VVXLJvYO;e-5qF(_C`Q^VU^-@QjZ_qgK67U%nGPu@Z1K)GMUl8*_CZe8
zr(b=0pRi=SaKavnSJ~FvkfG32Gvn(%3oR(e&<PvGAg7CUr*m-jMh;5j5;0}PDHtuj
zie<CbbHdKwDCF&kcOyhtx-Slzs@Ax^dM3QxTo8Kvgq$$o<i$L!+?#}gsA67$7SO(e
zxDL!(eH*oL#b}`IkT9yRExC*hyAz@Nt-}i;Z0d&N_X%pN;!AtC!^ra6iqYdIKvmzG
zN*p6(T-%0DaSJpiPUM84tpVb$R#+RGVf45O(9yMmjmIfWnluqjnO8Ysk^X*2%rAoO
z`~zHJ<HwJKgN^yCqp<HoYkjZ%11OAjje9A!J|d))lfrDhwfiMZ7_ZK^kIb>=`Kr4~
zj7H`N2`rD9ue=G9*=Jy4V8RKDJ+U8S$Bsp4TstSs&1o9+XP$tmwlO?y?NAjS!t)n9
zMoY(p2$Qwe`<)8I89yP$S?t8YX;UzE^jO%MIgqV?u|;B0aXB)x@}C-qj~wrJ|C6A-
zy+i)(2B|P9RWX<oRqPu;Vcgm)DXfE=j)yCZwJW|#3VUYJNmui8hzAI(E+l6pC&rF)
zn2yClzV5Tm9hVO7!i}rJJclJ_cXB5=jVj1N`#fN{=nAa0CgQ@@l@JxSaKf%1@kVxZ
z9!{JH!mK5Su>X7s^d>uD>%19ow=~CwDN}fnn0_l9H+=8G`)Dw7)2T9UwFMfJw6NU9
z@U<lDM?d;86^CW=t!En#Q5cYxC+6$3+~)I!U}oQ03q4bq&&pL;yEEv%!pLN>Coq}9
zs;J1DJ$=4RX*~+dBYU6AZd%H~I^+0<wsXSjs93CJ-L}*2SDdR;q@*yyYpSrKq9Xa)
zvyF!qiS1NTW`ltBY_s)Nf$W|cD-v6)sTizkM;k5KYyFuHMs6FCS|fjCR!H@-o+5Gf
zj9m~CdD<#2MArQxv6>N=OeChhzJ##}=$=PBlrX!c*I+jL0ADW-y@C3aWYz+M1@22Q
z-NY6r=UbqyssrwG7Tq6yZ{r~}mq^e=#Fd1F@XE8t{z#M;(sEw{^wf0`d1yDHkL*Hd
zlo<1tT!7jrb<|PCxr|g69MT5$v6EpqSrfC&b!7L#ULav?#DHgkl9G~s_df}gV^F5!
z0rWK;R9ru)trxHd)5&x+P!aj6+WKB#w!VYedS>b6j~)%G;@r<;M}xHWok|baKR{TQ
z+zs~F`m5*s`L>mzJwzq7Y%mzuO<Rg`BI)XxAULXNpejBB=Y4J{2vap&1U)TnPMGhi
zMZC3MkXl3}0&boWgitJBe-<$p?(n85M%eMILhNy}NA9Ilyc5pZLpL$@yUApHt~?jQ
z*nP47qF<7f@e&9V)IVm$nHvq|eSH-sxAm+okv+iIqcAog*rOEoBFCC)@95;q!&d_F
zZ}p{oJ#_ahzU+y9Ns`0X#tIWmr{c}ukHWAwe}<(RAK}6pBOKhj4(G4YRR#%0yzwWv
zX@5etz5#1CZ^oO$-h#_Ne~thC(QsTpw;wClt;euoZ(!C3zk%0$ee7R76~_;3esaR<
zOJ!qCG0T2!*BXR+ALiSPw2P<x5OQ!m3hrJY<IxQf)w`I|E?>!pnf-o<%EkOyu;AEM
zSWfYP?nDzf=udhmVXs3=M-NDsL_{0V)q&yfPUZ^ZN@Fb@9i%i;n6#DMI-#YAsjQaN
zMn6&uQ&}Y>jWUIy>HcH0{0Ae8{Y(|MV(}WjY*qB@ko8Ms3UiyW4K4H?nhDA|jH#=E
zAf#gObt25k!F~|1lfm9r4jVYxF<2|$Xlo^hB^+%S*z?>3YjZiw?!(Gd4ih+9(nZc;
zOfZ6jh0)*%WB0$z?e-E;WX+Yjzx5P}Z0Mqv3fXNHHgGc|j19rpQzRN{E#reUv-KXr
z&aGL)3G+E{0rh0*StGF4ST{b*1DkMwb$5FngvH0l%hw(r{VA&#Ufmo9jGb%(^~pN0
zH`c=8S;oAs)lt{Md;SK-H)HjQEG*SFz+4k8cr4$5i|ZC3{@6y;L`U=cVTO|?LtkYQ
zJYCEX8QTV}N%PT^+r|l7xo88lP2DhIl0Gy?&xC`KE}TvD$%M!&&(BF={{H^*wf=*V
zvSIyd1wra&bNG@)!QK7zLo(u7W3L!z<4ZA7)sVjylV1bRb0M6twT6>X6?KwIP^tq-
zTX5i3JZwD9psQ7YdkHy|Ol#q2s>NC$a3eYuy4I_(aQjKv8JQw%$5e=)rbra^H5?2B
zn2v|pdUhl8VMSscsjF|1$cB@BUPYpllaqX{ck~dYjFBV1xW7Gs!c<0m#T7R4i!ZRz
z)bzzEjJ3$ihye~BI0YNWeK<PTjNftYQP>qy%jFBnSa&K1EA&n1M~bA%?kE`QuScSf
zCt4VBMA(vpi3o~rgZKVR2;a9FUb{~5?gFfsw6vSUy9hACTsH(^wwV^Zw)-M7LW+$C
zGWcN4hh|Je1d%b$)Dx>5Eil$#7W{V|Kp`7dJ6`%sa+sf=A784gtMerzh23FR5G3y|
zAQ86_*#0(DH8bNOf~2bz4Jns6VO`Dj1c9tbBrx-FH9m&~R*S<fmYgtj3W>CGNXdMd
z8JH4jWqh#9&Ke@>S(=U>Fw?=>69=O(K9cqzD$Z=!y_an|*bESvnVB#*H@{Dm96lRl
z{XFJ7=-}&-pAngLs3yXa3u-XmMi0kM@8g7h^4Zr^)KL*g71fPy)(G@kgOUIF8bJwJ
z*ye1_2^%?bBo^4~!h4My%ni+;Z9Wwy4%4~no|v$vik^{hsN(Fp8ajH@cn6$~Gfen?
zrZ7@DE{8Wj$7T_nwI}1$Jpoiq=EFi&6>Fy3p@NFPCUUDzdRDl$VF4%1!^sRAU2ISp
z5r*cRR@9NocAPAPq3JB>7|r5siG?XrB*k|j?$}Y(r8M(l(6?_ojX4VsVDxzX7vd88
z67~QFVLHTe)6vyT#i6`NWJAe5_lh%X?cl1SB{Lcax9-OEkOHnSKENgGctgZAlgfH3
z&dknxZ{G)>%Xy?Q%44LkO&&W@pU0kFk+stID2z2r@xF<KkjO67kirD%y-f!j1gtid
z_9@N1^1KP_S<2RB%k)rRzTa;8W=<HS0>t?)Lu&_XHtIr?h;=S)<_fd1TgM4w>r!@g
z(~oy0mfTcFJu)w?L03uG^C658Wp2Bd+k0m1d-hkdx*w6o2Doe@ve<x^?Dh{^?`i2^
zLp<~?5@&3Qz%id>G~}{}A&5A+=@6s|XemWScpRVofe}{y0*gfD=pkxAyvnwIjG7fR
zRE=P*uYn`8Ot|S_4@FcGQFHdi!hGr~G-l=SX+KzNy@B<7EIvqt5MlPl#>mO;#@+BH
z+6Fcq%fNVp8PJ?^1eO}=m_K6yiYRxnVPxHG?2vllCMWFh=~9@_IEk^Ub_m(C3+ZRi
zqCUBaNW=>xZ13Kk3W7Y$)Np(E9KK#~?-*LL?*MIOXz8X4t*sOH@~SaT)07i-Zn-Ji
z3xnw-EyyabMSfK+G+npB($XH)(dUpKc#0F&S`<k|Mid_(I5Hy_Q#YP~k^5elQEKo!
zbq5y~*m1&IDv7kmH64tM2lfxbbo90L%BDj=%LiLJWVW8oZuFu}hjR1~r3^N@+vg)c
zmu<@x#>PriR@f(GD9)|4P$&!?4Ubfqw5j3&g?;+z#|nk9drprejNSg15d&=XJn(?6
zZ_du)MdIxJanK$!8pg((v6GIQKYKZm2JGClA2n1wGQ!*)Oi-4P#0hK6?L=)cP)dsO
z3u?hG2U`w%eO1(FigDpqBhO*8tjthKq&cj(1(R_uaGJgeXEv;Xx0@>}<A;jGM=DGi
ztfw!VFKjRh6A`IB3S%Q`HxOwLZ%Z7yANE*;u}DkL>4kJEU;FNRUGSvQP+RqI)DWsG
z3FWA-DkGE-icw!ls3;;7qQ1NUg0g%<9t0(X;#@*Dfqwj=OhN`#Ytm6ykVZ&FU49Dc
z@{$QjghbTlGQ^`cCyr7HVIac#MpYFhu%W=RWy|DiFFzhiSkGL;ed95w9)7KZwSv4#
zb72nnP2PIztzHUiua3nB|JH-egfC#L@)-o3WQ63eeV>E<4*&SaKjd3a9(%4+#aSNR
z?8*F2a%S>4A4ds)kn!qVI)jXXRR1F5=p1cio?U^CvJm+mS&VZ$fWQAoAFgBmgPIs`
z+9O6OUDXW|z-~Y5LI6xtdmo(@K}1+NpShyBvlE+d7316YK8MafKj6naEFMbO=bwKr
zUwd^zEEe-d)E{c}BJ7aVqZbZHS74uX8TLpQW0!Oxc1Y)8t8@-LC9|+eG6NeVu2?5=
z!5YaFct{+uQeq1ak2UhM^^T=WmOL{oTe=j>*m98gKE+cJHnnOhKK%06u-*GH{`S>x
z@u}@!2PEvw0ARE9pCYiP)e{6C!Z89XP>vAT<K>442MGrVZ0zg3R4VQ!>>}(SY$t3b
zY$0qWY$9wVtS77^WMvPo7jA9!9f&(4AA$%%I3bJ>3UNmWx;lahL4-g;0KuPd7hUal
z2)7Bh2shB#?nk&zxJI~&&bBLr%Y=)B3xxB8bLeP0i;mVagwq6H!b$nJlf_djY`xS4
zYvIBb<^jSpAnZ6pw-_f0$Ech?Lhz!Z@Q_r3gW|5|Mp$bLk<c$uJ$N~U)i(&`-|z(%
ziT#nq&>vwd&+mn;*(kowEcH?OQq^`6e({U9v9kHqBMb<|w6PyS?Oz|E;Icg=byPk`
z1Icy-;@Hu7I2v>6#SrEN_ZLpsV2i}v<QRt(ri4!?{S)g#bg{E>IzC;lkM*4kp`!N(
ztnHkO)kK;nT(Oag!>1u^#E9WIO+_6e>`Nmfe5N)Y>ds~u_9r8(IO+=Hz;cXSaUEkl
zBk1B`1a@)qKGvLsf6h6JZ>G$Gt&18yv9!fj+W#yFYtGt+PYp;F$2X&!2+4}tflFRX
zs7euyBfgs;6^9`=+LIH;h-+%{!+(FQ0(X@^!t0m^j(N>RRpV_$WcuRFCOtal78cAJ
z1=p1`5R!HjIoBO%-({rc`XKbeT!dbn%ZK!PW7u#UKD-!*4!J{$3y)9O%PJCImg(pr
zthM|EU#8slfTZI#LQc<uR1yhG3pIi<&~*=9v;ISbg+fB)Wz+;<mi2h-JG%{f<{Gdx
z{uY)-qcQL3HgpqNKl@-Dsmc#V`lB)Pz&cdKuS6Fq>}ISFcF$G8t~rxnZ9aj{F&6p7
zJD_VY0phOngCGoR@X3_PFkARByriq~^G`mf-0@RPPnr(>Bl?)_^%*RZrr{sk4dE%B
ziS4AYVL$&3{V-GTHeDS~C;l}cVOIvgWx^!_8>8kt;T)ld$Q}}z2^omQ{RBoL8yR;u
zfekLSgRq^z6t{&iWICR)!p?SgKUEIfNp5l|hdl?vuF01S6ZJi)lorEqzdtN&G;yM%
zgA+C@ycFXX9LAhQF3>X5$GQeUWwbL6w$;Mi%@vj><6vN@j=gm31_C2YMSTvbsu~Va
zH5g^K6pqnVn5dx(o28bVw80X_!q@loD}__1&J0YLpkB!Txu-!kp}&}Y{(QffMR1cZ
zXAou*rW0HV(+E=uE(B*eoCuER&clIVPp~7{5^M<81S^6i!Gd5;Fe9+<^?iw6gbl^3
zA47z_W-&zAPz=R$jz@}Ys`C_Nq$c-|ltg4CCm=mJo)C-l#26V8qL3aRiS)P#8Dhhb
z9urCkL3(sBQlo+h_mCPHfYb;Ef24-rCfq`5*iFO*TtQTn?4I91@#&|Z;y?fS_^I&m
z$Ik}rT#vf9%3fzvMZby|isu`H$YhfKd+9L@INW339(t^I9vg(NlK0MIPe;jm=PC8f
ztH~#@UU_WV&TRbhSHD3~Nrn77^p5x6e;=u-F%LybN;Dw~$;nYjN{S>zATg0490>_w
z9P#m?h>Hv1h>Z;<1R*Ad;U1!+14-xs9FdX!gu94{xQp=cJA~T^3uCy2(9oM4?4Ck)
zZjt;OJ{Vb9S@gY9ABvQe6prNNWct2I9EpjE90>^t9P9z$xVSiu*w|Q(n3x!j=;&x(
zI59*<Msh?%L~w+Mhtu~B;|L86<p>E0;rP>^|AOXbk^Gwu#j}p57MX>a3GAHb4O(RB
zsTnU!WS;ZgaXKIr=IUeMeaj!8k5$K?$2;Kt|N0aD=ijOr{^Q@`gog<hPW&7ELT@AL
z=1#h3Ly?>siV-7zj<{HV9A4}8!bO&zo{nS^SV~eNEfW#X1(%4(=r|;>Wo$g+6A}?~
z>j-_{I7E_wxX5B+5gZypB8x^0iSKblR$4yP8TEO^Q;Tfa@BRsNwE}g?v~0qAx@(~K
z-y?X7zu$Tj{A&1{i1%HMqD$)_A(8F4nt<Q`>=zI<vuQ1!ugFr<Xqg<1JMrvdjX-8v
zG_o^e=z@<!N_re!sFc}~qIf2YkCSDx^z<m6$<oqTMhKwnaPNhS?C6nW2un=EJj>BY
zOi9JeL${zc{Q&->>5kF=`%mnfris<2W06STKQinB7udU_ZIKWgf?xjeKZuD6#{T^W
zheY;@#P`lF{>fqqU;fYA!{~zTZ5NXh1CShf8fmFiUnDTQ7<g<U2`q#}@+BA919tJA
z7xuf2LDVx88MAsxsp*RC9`uNe*+pjk9<Yn?R4_cmE{24JJ=87+1Oy`BUeJ)pUT}Qx
zMD}<475LF#Rq-}m^luLTIY!XZ<>UWFa@1KwUtEX8$g{}F2uB>%$$s?qn+Q6wR3@^Y
zjD_W@1Ng}|)+Cq_aQo^#Xnpi+c)Drg&|DP+p7FrF3!aFMVnTZwk)^?D^DX3NXW{c-
z4#&!sD-d^i3o_EuVYd7%hW+>({+-$RG7>^CoSio(6Mz5HuMm4>2a@j`qQW8(-<og6
z?Sv$Jtg#Rq7P#SWlV@Yth<}qX;}CRi6G9?yAt{-xWlS6<x*WinplCYhA2IC1F?jc1
zT9`X$&XCAnP&`s()22G3q%g046y%~LKL^Em*@R3&28wgjQJj;C;_MU@WhE1mP?VX7
zqKpI-rN^TvEf$3&hQicn6jG)sOpZh$WtqanFhVFH1o?4+@H*-<)bQ~F8$O0a_WWWH
zne5rbfBn~gadAAW`0TTf@x>RP4TzB=89wcW&p&7QghRG1TW9#}v%dJ4Kk45;{)10G
zxevA-9vSygk>%v%^eZf7yeyHu|G|etB72VULPS<qS0`V4bz<ALZCJWgHYD(i3^v8e
zVA0tn#wQ<tjNkwM_x-;9EHM<%FJ6eq%FFLR;TsqjC|`Sd@hqNbeqPbq+KSFj+1TJL
z^z`)PYeVt6#tXBH&pRT@*g(A`XeyLHwB3QR4qK6Wd^TpzbmRMzg|cz?dO{!&@FlZb
zuUdF{u?Km8rluyoe9`gy-~9sf=UF`^ER|p(hq)YP{lK&jOq5`JAMVO9lEaW=9*4mI
z&{u+9AL#Z29XYi7K<fd_pQrUuxAwge+4ni5UDepX{{*6rt%v^ny_n)+goTEqvF&0a
zB95-ZUq=~Z`0!znO1m)Po&QJgXu(-u_Mq33M!ft1k*7h=!zDcrnDjhkB74xJ_roR(
z_vBy?p7cC?qVxa?2YU#m=RuU7hfx@A64*m2JrAbzJe<<=fQs@%Dm@RXFkF&@J+z|y
z;EL?w6~zNAiicQw9%NxSMPLuK$R28W>#ZN7w(kBgRLb##6<JRvdsTupZoE42aztjX
zs)C4;+xXA;?_j=p3x5BHzvJ_9*7)f6KgGxoeuwEM|3-$d6_RheqrT-bKqBbsyh|0`
zGuXV|29VsMg2<c%^_qz6$3OZBKL6ya=Z}xS!e@iUf0Xg%!1zBIK7APeJ$QWbuZQ5D
za{S}b_?Y4EkAaWw<2S$jy_}gB5id8BWeM5-06<LjcL_lngl<}Af)aO9W}_@7mS-|Z
z*khJA`SP{OWP=&X^oh_j?5TX{Qw}!#seB039`K=1dxk^p84^`#;9<q!!}8%#IoKe?
zJ;;@T50|PmWU6A=RQb@Uis4h`L#XzE&yXOWC85`ls`6n~6+^4ahgW4N3@pOF{fUa9
zRu#jo%7<KKs7R2aGERd07zxUv*=tfvF`t77|5hw<KP?-EwPz?+LRml|iseJHKJBoq
zj~Dkv2E@<>^d^2k$(Y{@luBdK-5tYUlZvAttvpU5h=zprNhEQ2la77s*PqH>mqgNj
zT1q3~6?qG0UWXtNllVwrZ@&2}dOaM{?oci=X*UV4E133$KnhyYd)|EW4Onj8Ot0UC
zq>I_cJM@{%Lf(INS<>x~H-GY5eEi4X&}+1>lLRNdhF^ZFMj7rLo##5?CW+LK&i4*}
z#Quk_YxG$pJQ7-0{eGb161|s+?*c7JbnTb;|Js<b6su3|pmQ?uogthhai4+FKYvF1
znDB-~_QFI~ol3u1h7_S2m*S7V*G2KoI9Po7HHjnx@BPaGE?<2F<B^lFWb#;Ko;ZcF
zI6&oNHF#=I;A0$@#Q<!QrLq($jNF28^g=uS{;RL>>E!Jg_vg`w-M#&#icEqyzCL{T
z2pE0v4#s}-KJxtBG0lD=AY{W2+~MyznG}SEj#z%|pGY9T{q;|AZ1K0W9gb0Y+AuwI
z5O4kT&-jy?8J+7Fcx%`j_|LmPf%b<#!$1D(9b}(#rt<`$9g$eGeIvinKh`nBl(Fw(
z*oe1~b$2GrC%gx=p2hq*x)65VpyTgi_}jn1fB*Om%6ylw)BhMucWk8n0Z1%61>cB+
z*l=nKnk6^rGk=a>4j+#1{_#uPST`0%>Yqa*Jb<9s-Eg!2lEiij^A{STimd2`?9-Tg
zXcIhqcVPH`y-V+90(}dAe&<Ip`S&|GH~%wq4vFl=iHw0~upSJM$$AD5=U{_~_Y5T7
zgFcyz4=nzYGue}4sNth0hD0_bvInBDun>+@ralx?r@6t_&Z*zm9>lcoHJqGXk&>SK
z{S;YqUIk3X=)!OHbR-;JkIv#ov{sN6FC#}mpBIwQjq4#DICxWpUFU1?hrc@FzyGX-
zzy0pd@Cz2<-(N3){+E++`cBi3$etiXqM-*p2NOe?Y$%gGaSVxUaPiuStgWaKZ~XWp
zF0jVpPA;&<B3hET8VkF)$Qlc}Ak3%t<#+RC<lc3dJ8cnW??^^{ZWroEWP)rGYL1jw
zt_9g$s3ma;GCN6}KtckBL^g=%D>C+5GW_muDyRwD1H=FK5!M=gNwy*%6+vtu%-(UM
z_<k=O>wS@MoA4EOAGnS6#$UqeuYW+{MGrJ(T|`qR8;}!Nr#%*jT}ShEX-f$zN(%To
zi)0~P8}fA)(M9d}e}DKBEJlvR9t#yL9{C>b?Q%hL)&=<yYz9p>m!>Q{Jw5UNbk<?v
z$!Fi~?==${u;OSgy$0;OR3mF<Es*lw4z={!J0pfePz=2P&Kub6oeAUbzQTCj<q#4V
zZ@%#+1o^-RzkCx(B#QUUcH!+e--5~Kf5ne!$);Xq&u%r+`-epK=;#qtf8n`@jZFJs
zxG!TP%qm4!17^&a!4Z&EFW>p_h`GcDOdTMkBE|V$r5Lh{Lw518qeoy56WUPRk0Fr_
ziR_7@M_@xk$~`(BDYEdx>v{`?&{8dhs7i`}$XfV#`O2n^763weE%eeA*x2nteO4*5
zvfAOSrG>T{DX!hgR*0;<xEjqQu;cqqa*^FUb^*;Kt|NPCyPUNQ(z)a!OG&IH3rOo(
zb;!#U<BG38E*<uR@3};H?YoGE+*T5q6o>a+K-|>;)MN@sU{W01b%q2dMcAq9RQHnL
z<n9xwiiqLXQIOHh1=g4=MpGUz#mEp9F%>9C>c%B6fA}7{jti$VaB%xIR3{5jl`6%d
z?N<?U{1(dTxT<6+4s1Dt>J%w%9K3=m64~KRC$PcEhKp?F)<m4zaT--5wD`MaD2bIK
z!!HT$=El$+WygDcTt1oqQbfkaf3&u?erh;5Il<D>vftPGht1Q&<`o6~e-Dc%&SdeI
zeQ60SU%3O3DQ#%31?p-0<}oiEJs6B@Ui%Pn))zIY8R#Sd?mQYq!lcSFp|!M`XR$Sl
zJkU%cJHBBnMD*VE>%37yb*mN<T2mPbw-h*YGZR8uHl&v!F1`&1w;jf{o!%%T!8GN!
zLYUKp1`^Klg&T3>fETLMtGLLPF4(}uCnTXI#I|GYg4L*visi@Fr#GOEMAneqjaqpo
zD~rfOa%=|<u0MohTMi-XItezV88wMDs7V8s&D(_2oA#qTGM|fViTg&%a#B<$Ns$yO
z!O}Ua>3jKbk)1nJip8_n;`p&F#D$8nX8moXUyXt9<|Ej)&<E92=i9d<;-!de{J62b
z$7y*gw1Ll(&Bl6>kM|-28}o&s`9ApU**)XH$j5@=U^8jUXVaFC4I={^A4Wb#Ob^%$
z+Z=4n82Pv{9BjsI`K;TDnYVjp-<FRj(*r&ech79x@-b#O3T0!>u$j5#vvc1ccSb(;
zOb@EqjNLu6cFSh&e(UWYp;qv`?~_q>Yml$|T}n~x7v?LS>oM$NX>!FA*~N1gvU=IY
zo3|?lw2MU{nJ7w^D(vF5BUf-_*ZGIq#mg58df7#Pzq$eKVs;E26W@i30qkNfy<Q$I
zd2K}oNhiRC)>~vCk%14eBoi1LGVoC%Lp$vogvcNgJRmY@lYEdSC6R&lp{erq5Lvj_
zn)@PAf{p7Ibk#J`7YAbLVrF)+hO$u&*+_HSJ=k)o1T)msvDMlNMw&*D3h8}HcCo#L
zeo*>O6-AU;=(h`qYlX?u>o^xwk3G{YVPWP1J#BMzR)`fM6Qt(w*1tOX9C0;}lGKi>
z5+ExR*zA)HeT}8ipK$`BQVA9s>7XvH4hwcfVzy@lBKNI>lZhe9!^22?-AKI|j)H8U
z=;k%lWs%TGWK)bSxP5HM?1G3gUMh*AE(?f=kYb@{6m-V8!hyb{kdAlKRYO^1B{u9y
zgYBYgNIZG~j+&atyLgdA*Nxb7HxUy-zehp`*+fkUlbcX<`5LMyi`CJ-syHB-P!$i9
zBm<`pC%jf7L$??vc8(~lZo<xKI(Yx*BXD$qI?rsru@$g876CgS`T-!Ny4xQKKSyKA
z83gZh#}^;|4vooY=p1DAJB1`x_SjLIVwA2CZ@htzemaaq*NEnfi(G&$tPaspk74ip
z8E+2z8TQzGhBtovzxde*dE-l27+IejI%gf)M70?9<NwCbXn#lkEzJJ#H)zkhh1TSg
zxV2h`AK%eYjS<6#p{0(5_u6E#!Qe46*-*pBt1U7a25%SH+~&{HE~2Yhk;z_byGR8B
zMveLwmafP92nG;R;dAC*HKg?WWm9&!anT<(D{kUeVmr2Oy^1+Dri$ZT)O1jr7!PgR
z1JKoW#p&IfaeDJ1B>J60dr>8o>Jhkl#-C>>E;6cvl~RVXS#lMrlr=OoZ7|7b3*5|Y
zFw@K$^9=M+mz)U;{gu#H)kJk<2rg|sgp?b%s6Y!sJDsPkg6eiuziXm;*+N@8G~`IR
z$iDdcYkW5HD`cMcMhj)phWu`{P}cIfT95i%;QX<>m}s^YfkAE1QPG0tx5fzcT=u;Y
z*&qM-N7&oiJSSM+hfQBt4FF5nTPwpt0lU7iG9LhDy<yn{(+6SE1Cu^5?hW%E7{PWx
z7{b;}hM)fIXD=s{Et<ECqn+#^-}i`2mUZhI7R_CT1&en;K(=}?nQZ&o{SVD#m-pU=
zFjpq9p-lGpnGF5xyN^L+GPeDYI+=8UOeSS@FQrVzjvGwFhh&hMth<5M`(`pK-6i$3
z{-W(-r1vJpx-z0~1fs1DNV;<mEwmkU?lxMfu9+W`hE~detyEX5B@wY>Mb%P7L{%a@
zrjm~7Mp{Y}M700fr36HuJ&QUL*x3_zdf7$4(>JlqD+LA7*{Cj(Kv&ZljYZwK7g&nB
z_o|R}uNYN{MM%0Gj>61t*v#IA>f}mPkhpH2i$QT@JRJ`RvRb&fnzBU@(YF4qQz(zG
zLMe$!Kq3tHuf;A0I}(=^XATE(k@+6H&bQ+(grWBPDl%~wGz@1xAR<Ux5JdIXicSd~
zO?7Rt1QMwP)5hv!%Zd%~-?y6fi)F`3#B_Wo;;Wk>XlsYVti!OGwE`1WOrUQ!AAtwl
zka*eyiD&3NQ~}Sqx*44<bYY0e{&X~=tiBN?^+J>ggea`5r)pjc&Rx5Kv(dS@n^BDN
znmR~GXzMRV!GDLVLSzXi7LyPg&{YzO$k1S_htb8|T#XL8@ahD$sIDOavWv5YY-Mu=
zOg)aneaU+0syjh{@gaCx7-6oJDWr9I(3mh$A+mx}vOncvm};sAX+sHOcDr&5+1^4{
ztsw`UB&bdj*&+{5j5k`0Lze?#tE>I|>SV_^uSGjq##Z`2vI@l5wRjoYC}YK3JP-O^
zAR^>b_F?zX+DLReyhE_lHx(`AEjWKY6T-{_1o>z1ru$;Db+e`~A%V%7?%8t7!lm%_
zE5SNi?p?bReg}3V{kA`10%Iww(RVB$F;YgWq0dN6>cEx-i%}RFkK`n>tE+a=Zxuor
z5U9_n<02DgcVO;}MWEjUIsWm;N)n?!s~yLEGjP@O0A)2`&U6pHbYE}~`6My{At*@n
z{S?_V!Qks;k7`|f+&bA0rU}2LN_JEFf!AmsyJ7vn{(kHt+c!|dM^v;>VHb<zYx=c|
zeH%XV(z<%t#Rl3J7Eq?Ji#Y*FIPZPCU%TjcJf1Iq2zF5{EWu<AOEk6j77nF0j&5-q
zZ=z@WmYZlI?dn$4CR{{)_FYWTQo}M!6|D6Qf{DH(Oq{l0&1%Xn&E)YrWg;8<?HKHx
zXNsflx`;Wo5_OpYl=vt!iRnV5W18ATNGT{sLU{>&4DIV^f>6|q!pbV_yOWI0CMK*p
z7+EgBr9&I2<jq5;kOb4&gvN#{q!yK<zM&46gA-xqxB|MiE8wE41+DSl(r22yULp(k
zTHRYH43wROby9@J*75pQESo@^IEjv{M`(H{0&XRuJ|#kNyoH(`noAmC>2U{!CTr1A
z-V8l00|?WS(VSC+;t)S{QRWkp=(x}*o3+trEI*uz(6}~esOiJPXbm)VRv_`%2CO$T
z$Mv-{(N0;k^xh4A^O}99rUJk}x{L3>cee}&&X-{7hI^Fp=zo$oeE6-MPfIEGo~<AO
z0%}?-;1?*u8f$atj-O3%rtc)iR3j}2(`!*hwzD>a-N43cC9;~D8r->ahcCOjx*(BA
zcyEtEXEJdIMvorNK^3e1kLi=inDvys=R4?F&K}BS@_4Qd9}l3POg7Yn|LjD@M8pKe
zLV4ujii!#xK75$3D~l{FEJjH%y&)FM>Rk-1e`00GVMx2XAf|QxI$z2})=e2t(%nWv
zCNYxOy1Qv9X`%III!^}|S$8*`OVUhPt`TB-9}`%&xD`RU74$lZjRdy9I{>)>hq=ha
zbQ~9%eA(DULZphmghVDK!7+4GokY??%h$aLf6VAHuys4xM=$`@FX7`~$?D0x2|wg+
zEbLd`!L?WsR<Ave#g3MW<7a5-pfV;5T2_0ZuR9Z0y>{Zb$2Mf%y^4<FO4KAoBj`p9
z1U*goB(O@VgH}?8($-r9i$#~P&dv&!rj9Vx)<y1(%UG~49-`uQv{2S#BJ*268)L_g
zMH8#9QJqf1ZXeFvs>d_~eW*@51`~B#_#Hil^BZ=NWsE>Ycof>`y~1oN^<NW_-MD!N
zJ9g~g96jl{k;)=tH;Q}K@9&e@#W7>XDD0x+*V+&jgd+Rq9*mhViC(U!Y&8xbOUXp0
zZ)yX(IqR^;Sp(9>LQI&b!EZE&7uRDf%Y<Db`T5!ql3yd+NA_^^n9;bGQ-S4YqqxXE
z{c;p0P1c08O^DIo(eboz{5U$6#3dw=8EdK_FfkW~lg7YIeIoSqt&n_T;SW2LO?PqQ
z7;F=M`t@^|?(BwXvsU-YWZqYb9>`?PB^@|_DQ75?Jwfyp)}SEnB;m+JcOSj&;*&Id
zNO^av-gc2U>p#pcwzG`(pk0)(_195k(Z{zc)|HVQ6vLbFvqIx|6MoFi2;K-%l9Z2D
z+RvKs>qtcG*u~mLydfm`UOpGtt!vR}q2;|>Stz=9xtCqMb1@9jsa=S<5k=d8%Q7F-
zq}8C5L{pF@MpkkYvVzhOaybHx#S)x7mxTO?Y~JxVDW;AKjtMO6dLoKQF!$~hlDMR}
zd$RxyOn4-)Yo|hCqODJrcnRWz8<2E887WaBF0k74E)ty-kr$&;Ljv<V5e!#jLwZdL
zzl&KYizvetpHMEa%g1S%D5dkIpfVY#C1k_{WeHLe8QHWf;Dq~3T9+d5Vj+o)-g6`h
z)wEqn>wbrWxVVCRqfrqfLELR23c~3(9E8ZGs!hg?!Z!TkAG$cR(G4r_RAAoTi%|LZ
z2XLCd2i`MOP<(X_ZmuyyP+$OmPg}QazBid@#LzT!<Mk+I;qXjGc5mqn7qXu+%c$?X
z99<>BC=EGE*{F-(gcWpjkp(1@NoaGu!!dO=d*YbQ4$}mYum)|-jc{D-#WR{rWMm!b
zSR?B>2rsNgP+lb>kIjd*u?>vP-O*B8j=c_=B(8ec8CyZq$Q(^orPw#coIZnW6SIXR
zFeXS!aX2y06y_^WqO&*@rus&7!I7nm_d!ec4Jx>EAtvFSI^&Dr)Lc|mSHfWF;ny#d
z?OVAJZRA+ms_DYY7h}EKEZ&44e8L;_8}laoyg~^H5IDSeJ=ndoc`J{zKAW&}oP)ZQ
z4BWV$Ko?geZ|G<uK{1g{wVQ^tOfej6oUv+?KbE_?VyF8&9ACYOi;g`N&71lu!!=R1
zb97#U8wdBJB3Fw2r?V-eQGJcpH!WMog*S7N7vDE+>N>C<9&FeFdutcOoIH(&%r<P@
z5s33^wsH~GvS#}<5d>MX_2gJOzqK>+?nI$9I1A^`CZX_VFn_HkMG9NXsi-DlIohqF
zEJwC8i3*!&pqTbCVL94N!;z!us7~m{vgPMcM#8hVnvbeD%5)?uH>)Wqr=_ihGv=?n
zhSO*3u+(w$bIoL5elfC_sGbf_pUH+AJ{|$qgwOE6YkivVll>EA>;2fpx}53<8a~Pk
zBnrD&l-4>x!-s5HMRsr?yI7mqgsP;<$F_@^ab11vB7M$a>|$&a^5a+*li9_PGm*IN
z6Wy;}ObBd!sZIFZO%+hpvPDZrZ{hGvMi8-^#!{I*bQxoSup^6+b7LpO715Y$VU2rU
zlqGk$Qr(sc&P>W40xH4i`1Y1YREjzwqB@kOkqeg2U8TrmTTb4^@)Hr5zU4I3P3J;q
zk_Idct+3qQ3Q?yvQ>OGnUf^Na7+S!?(F!qVwjlf379{!Y>y^o(gKxui;ZB&SsAAVF
z6NK)Wjhw(^sEavH^^#(8ScT{y!3rz#kyl!VHG5CNY1{c%S7hOb`ftK-q)Zi`EbP^U
zpPJf)@QhAGhGdZ?x~Djv*+o}fBXkJp;tTVmeSnd!A%q#Jz3gIJl^7z*YBA|#y~qkW
zZw<q;!znm;DIcbq+Q_(e6-~*>5K{JRp^V0!H_IkVmdC7OP%h@}icyHnLeCKuQIROP
zaUONF9d{)de)n47Xl#K)7s_#d=}d@7$n#8e&`Q@wL6TS@vU4{Z;dwY4Hd?w6(f?*c
z74C-gPE=C1x)I2pK?Bz9Nyp_|RFOZIiMCw&{9qC81d369H%uWiXDxH8lL0xD;i_qS
z&8|$;Bm(0sJhA6^C3YRJLB`E|jMAQuh@IQv;b4OD(0r7>0FgZs;tot!QQ;VD6Mlc0
zEZBPqKZmOIY_zwx4P~;PcvcM`51^k+Hq?awaxxi1QbMYdVD5u8*()!5Ad$$n`8_wb
zkLqr^4vW!BS&NH}MAz0rmQcckC!eriOyU!_(YZ)q9aJhRi;NvZB9pc^kud3fOk^F6
zkaDrr(QCA%*So9ZAZeBhtX(J*SsMwnRlr47bZZ*~McKF*N&inv4W#UK5}AZbbBVB=
z3r#|G5($a1GyeuHD-<G&J3I$1=~qz|e_0_isjv{UXS(3p8vExjGS-AYX~H--yPxhO
z7@(Rm*x}n$YP3*E%|>{N%!1SU09=S{#KL91SUt^Far`oERUDaRkEF09egm57t(1nS
zu1epDbpTlGm4wStZ8&-+7A9K83Xz#>sG}hz6`9x0Q8p6LdvhVB<J-$AlM!Dc%4iXx
zg=ooZLMMHvyd0`}mrCGuu@qjHN})A*A@rvE!o=k$iI3hx8H)+5JUj}jlhsf|8R$-M
z8;sTUv2aTywokEwwU$0+niwPeQYZ>;`jenqP@f_|b3VN{6W=S5vFKS>?2~q3vbq*>
zn>wI2Nd?`sE!*Es?m(TEVoaJm8G2LJ;do3LEVL&;*KPqa{PsiFVk&0t4~CJU3tSfN
z#%d>Hn41_NV9#`Npk#l#YEj-G6B)~RHU=6bs%DhX#c8UeiQ_k7V4&>)hgloQn(l{|
zjyYnEy3+-ji`K?sE<81rNpu0!WAbDbc-ok8krm$9EYD<>sI9Akk(N3xg(O0a>crEQ
z?Lw5#8t52V;<|?=y2@hELdTh}^p=ZkHl%f#^uJCbak0vN8M>M%(@_??=Q-uo&tx`M
zb{rjpY{Hj;?3pFKkFa9?%0Xqa<~$MaJ~dD#Ysi=4sOQC@Oh)nRU;V0=sGbgwwu?WM
zhL6!>#yz>nVtscj)|HVHoxz*xi{dhQ6MkxN3U9)%NH3Q);R}Fz5)(T%BP<7%B~&kp
zDo0~+3!(y2kQSWEMHUyB!k62QhM_t`Ho#6#CTpUsR2&;gA_GEir=dJ10~I;l2)&U&
zBBBf<7g_YZ9Qur6L|?gxTG|frOXc=4!Y>)&@nS675re$s4lc5FM|04aR>lPubS;Go
zEc9|b&r<c22~%%npe|jCvN!?CNMPYt@{tfE{N9LcC|-O#aVGPeH=PTKHQ}e`iLund
z9;})E=E2>lC1)U_*K!NG`LTOuFNKJ**_5dpP@k1UHk7O=**n(MKh@R-q6)y?)EfRr
zy~y%)-4|Iw6M_Qc&|KJtHQO(twG0T0>wt~z0%Vamyw4=#$blfNa9@hc>o!7|FGeZZ
zI%6|?G!~HnbEU{6@wm=Ek8A$*Tx6E4cfxc}KCFO=sUsJet$``u7GwjS(`TcK-m}oj
z8Jp%U!yNmqi10c%B(kA+;&?i{$eQX0+TUN({zL3yWkFZJ4IlMX-@0!X>AMZ0;Uh0J
z|AB^&g5<Vdb}@{yU3q_YF|Ff!Z5M~)#m6H>Hc%6O6IsIajOJcV_<7l_h|UxvIkp((
zQ8yLGvnKo{I)=QlLy($8c2dg6R%{Vc9hL-Vv*s?&1=k~mvQS}Sr9xz;MsBEx3c|(Z
zQz_d?(OKG#`m|g=BzH+My`M558-pc1t`TRi7r{VH3#+_Rv3IH?Otj3<Q4XY?-jC|I
zR4%ZYn?mFw1FGq>3N9aq$z*FZX0_qsVmCU5vTJ4?gc+S^W1o>KMPXb!7H^HlscQ{<
zAe|wR4aMWeb8Yx|01wGz_ZvQXXR@It{2`IO?(tBOu_k;?)k&DS<U$|80Of=OH!C2P
zH{oX{m&0Xa5PXB{;5PplJZC#9j$fud89wuzkQ<-%Kofo!VWoE(u0*%N=VBU6wM-Qv
zJ4_kL)xZEPS!E~*xx>4#iOV}#D=RvvE|?yh%>}mJJ3}Ti%1(MZ2C$rc6qZ`LsESEJ
z=pGNWv#wa_WoXK2L0VWjlISb6k!W|HEX0<hna~(NcSvMI@!aCMW->zqBaRLd2j4fS
zOa>V0)B6ale_~H2D~k&6H<Lv~3x+b;bBxfSz<!$U9|wbJ<{zMWpEvExoA+CKn)mxO
z?GMzfKbR){Ud{QB)0D5&gwLDtv+$eW{8s*pJs6J^S;E;vigjfaCl~S7#EP^MzMUIe
zz#BVia|DVe{00&edrj60AIL}&aDgR774im?wAktgdf_LB=JH<nxpWNMp0())8gg4u
zT}T%#38y5p9mVnGNDIv;u}KgRP>PC_Y6vNd<)^gD#74)Zg%%+rwh3|fO1QXU{c|D6
z6d@<R1&M(<sE*G-{Oueru(VX*(0R(1$=zIJ$FB%c9vn&nlOpC;5f@j~O?E7(P6(vj
zEkHF1tR%9Ighu~Qa1-)lzn>zD3=8Q;IFExLhRE2>Xu-3-8NJHYhCNfqd)_DKiZR>F
zgxkvt+c%=3T-Jo2Qz&b~-|8|4t<_>!yKd&a@HKSIP#zJEW5;fxG(4b}$P6^~keDup
zmWDQFuec6pV|^^OvBZ{H^SDjqJ@5(5WKo;Q25K8P<M{ej$fNgcJes1&WQ%6ZMx4(+
z)TLGO8`X9*wxF&6n6o(uRtCDLP0EKLhyGVW1;Kq&7(&82xyYF1beg$^)&X5@2e1hz
zG}QI@wtz%7!^#p>w6r(U#{$P0ShzkA8)nZQ5?Q}!!#-Cv3>)?q7F>wqPf<&|J9(Ea
zJ`A*kb-C)IMGJoYKYziS?~dg{V^38xfpxP-W#l50(vo$-8u#fZ(0T9Y=oUATxN7-B
zo+IA+CGS4O&ehJw86h#MeEKo|^s`}n<SJQLt1>=$V0SyMx7Biib&G0VU6FAN)P&EV
z)P!G@P%2yR$1VyBnjUEQs42SN3%@F-b5IQ*4TQnkMfQAIk6p|PEmPRVlH?A)?6HgS
zl(A~klzQOz*u|u_AB<gmR+;RLH-3%m8{6@}fBYYW?sdh#KKv7%okWH%y!+Sp(MnnF
ztr5fVf1@05Z^v}}_LqO*g81++{|j_B;k}RkgOd@(sBLV-TW`F9-6mgv_30bu?v3Al
zJ%@|UXyavkr7|DyjnqS6Rx#e8<No{YH}GHYyo2`KJNRboXnIc##=CCE2k+76H&@{O
z_x_5ctlXC?vM?_X#kvCWCj5fj*85HP?Lb*UCt|a^k&{}D!jQ{~<C$G_)G<c8fa+F3
zmv}a_($|L|BcpdO{K`(W&@wt*ik$RDIB${l!ryc>8W!5RFxInyk&Yex!@w4MD>UXc
zqcr#y>I-GJ0=nsYRgj3vX}d>cv$saTSk)2RY^`Cbu7k?RNV1CQ$UJwH1SiE(+Fu=?
zjiQ@Zxxh9b&gKGR*03QH2-~&_Dq71SNUp(DLtWHoQXvqPjEe9?G_j!zD5GVCiLmo%
zF#>}m_|9zekjQ#r$SywDhK~o(PbPb?;X~H4IMjqcB(fib$XHh>Lv3{|^tjeXFhCL2
zkM`au2U%z2QvIkXTL@RmJV)<V!Fl#!>{&2Xar|=a$vCxWD#|j7(9ov|zk}*^YfohI
zCj67va$u%ot`M1po&{ynO-R3d9Ia*K-RX1NibQCqbFy*s+lpKHO>KK^HF(dM0%3Xv
z%0us=D6t-GR4?qRfLvriB7N+IYen?`SYh6la2Tklz|q74W>ojf3MxiB{Xbbz4Vb<@
z2pjgND@10Y>IO@-u}D3B0AAA^Q5)BQQp(&(@xU1C9k80^3(LtG&>Cxo!|v`lbUX)^
zng%d5UPrc)K0g&)U<H@_U~X)U@&w@84H4AF*};8n80H#jLvNHdrfZuc@nSd<y?s#=
z-HGb(A_!CHy-|2&M7Hl{nv!_rAhAfhI#6C#s@PXoN5o3H(A+{qQ~j%=lwKo&RaH?%
zUBccY6Ir{Uoa$K3Xy;<7qPH}|+`x=%2~{EL*`qFvsG<tKwSg&JEJ6rt=@=4RV*`;+
z7bg=L6CvvfVQy?i_OceuwUzv_n5vQj2;xt2krkyUaFLZ~Qk{@Q)<&X`Fu{EvGMT!X
z21n;(HsPzQ()$R?P54ie$<i;LfEt}gMbn~JCfhc5Cc=Xo2h3!wM+keLnyMNf=i^B-
zS#`1$TUQ==p_%M&U)rHf3jAGrCEs>CpM`gR{Tuw@|GkUk%iHkoZ-0X9OCDHh`8j^`
zo8Rzb7F?hb=ppf_Ox9HqOF|N1vbKq0-vW;_Xs^q|k{u_}SQ3dtzNhGzb{J1t&6iwc
zl-<16%%GA`gy`ZL-0|Lw%#sR3`fNZ~Z8qj_I7r&5hndTA#Q1Kai#!{1*6yW!by&Ll
z1eMNIf{K{P>Y<^ohTCEBXv_)6cJGUj))&BO;d(TrT;$@NG)Wy2%4{mCnz#^>j5eyT
zY&{qF>WD1qV&55EWT?!l25Z8v%c0VPwo6j0cq2$dQL~~6Ur1tNua%|MK|q<JAfp*g
zr5(siszg~z6&G0ntuvu{UCcy7zK9Q0+LOteNOYC)(Ihg;GO<+<q?hwv_F2*8B&K$S
z$a3OqQJUI}%)kKDk;pQl=vZ22MN}y4Vop>g?^acjCPsNuJ?b*rkseac1(qIC#>JHu
zT*m8Z1@V+g6n0Te;u0h6UKtlzazGiJ3=H^GwwdA0B!&hg`B!prCEcZEB9L;AN?^)j
z>?!C<T5^$5=4&SL&NnwA5z>2u+eu^+#NVt%MOZG%NM!MTrCekwH!4s@%lyzzlt#Qd
znXF$>*6DY@0y4WO=@_hCq~!y4k<iC3wlv5x8MBIIxoM~>E9~DcHonGnviWvKp#PgU
zd?e;{VT!I6T4>#8-7*xFNVv#)n(#N+PDN`~7xay1kx<e}oU*=)tQS6ez>f7n)S94<
z)0@{KAz7plnINkIm#ze$F;{?D%l4B6lp-jm9U5A8$jp#phgUeZZMqCMr>SH|7eYwF
zW7FY|SJ6aMkwi8+m0V=b20B=_D+Y(pmtyTS2ZUeu$M}hwBr+*9$4@|ArWBJVOhipW
zC1$uEyf3nZBGe`cXj}Hs=7b58;J<qpf{&fV;XS7jzHbNWQo8woI^*eosG;@A2GdbP
znXHmBS|-^;CN?HAl}W1Dxhn#tp_Q06=O|@4V4{XSiL8)BCc&if6Zy=W<Ht|JvNd7w
zyWRmU>rDfStgfyOzP`SEJv=;IHXx~#QrQzmCVOO|PbiCQ{_!X!@yO6w5(bF75PIv3
zVwi#xJ2oKcj3>RDP1-IdbfL3b_Ptt#LWRf-t>-|LcNYsa46wz@fDUb^L(6ENzwCWo
zO+aTO+J%K^%MYY|9keZ^lhomQQocfDGxy)5V;fQKzk@_oLjoi_L?YX8E)4CI30m7l
zbiL(cBV{=oJuR4#{mi|z`qdX%Uo@4G2k&QpFDTi?nqo;WyC_uHMVY`j`q;&~g8O!{
zAib?$yI7Sfls&*H7g!c$wd}a&UUspk;iKjU-0+c@m<Ur-Q!Z2%AAa~DE?v6B*I5`F
z8zVP2cc|gxMTjiSYxRTo!m4Bq7S`^UKu!muk`5SK%~ibaJ=X&5^(2H_Cm^N5s6)_!
zR?1qedsRMVnsujha50QNqp%6u)?09P*Ity6CCtf}Vu`*nj22&ohmk2CAKz79RUrV*
zKrz3vJo>D15}&!gAuN_%L+r_I=wQ#T<u#Gj1S(2E^*G?9`*elK%;`90H%o6_Ad!(x
zOYP?4ExK)vKyeP)P_l59$*q{}aTzmBb@}iES?7*_??u)(A|lw-vkyj($Zj244s`=d
zK0JZ4h*&0T$)Zd`*{Wxsy@xNRtB=JxQ!}`et7t4rM<*Q-mKe^@*)FCGC+(!96^d4}
zeLO?4U}J-@o6jULHocOBvRP7D9U59Ykyua#O=DL$d0xY;jVIwX&jQvuT8Q*s0=sn=
zVd}aTfd>}A+Q0-+M;FTkM*@Q&6V8ryC@e3-(*2j<ZlDESH8Va6)>cbn<XziD*EePG
zN~&A3DT>-E(9v9tsPwE?FOv-lN||inhL3?W+2b~RaH}Y{i~VJ?p(gxC$6zxV8v|tG
z#EF<VVM3qR2A9d$F;RJyFxQ^M&#~@G45_gvn|+Tn8LMMi8|uJg)9v13q3pp1(y?B6
z6+6$RVur2}Ol;;WUiVpGhR)Jz2-6cuEN$p$qLQnP>L!%QZbmi3>vjdtWIp~iIKE~M
zI?7sjCOdqs7`p1l7_YqubF}rLt7VRaJ4rH;QHIJd0M6Vk2O8<~v)gg%PCcqAdoA7<
zhXbcGVXJ3?$)k1PGtU91=D5P!%>~(4&!D}e8^W|wC6Up0q0?li13Iq9;IS(Z`B%@O
zBBce5X|)j1XR)bmg&Dwd2YWQok_k*j%MzyAS||;m(wkndr}H#s1E;PwlT8KuZq`Ca
zbtX3L%YwOz2DHB%3%@l>zBeK}8jz_Zo*s~Jx;ju_SEJZx?{*lSt<7kvXZ0_#fn6d<
zx;vn%Zw+ya5N(1A)YnvTk=0a|a*@@L4e2Cdu!fW#yC|wE;v#FSEkb8qDWt9SuwLm6
zsk~K@&Bn<xp~aHJkhYM(NPKJ}isqafTu?okjMd}Z_FRFazL<|xB_)VzOL-<^BCE|$
z=K`zAP2wUG6{n*6McT!IFloYAE<)vfqsNWIIKtW0(|he#;0ZEW!l~W-oTJsvpE{H6
zn`+O`rD3&WP?>DYyhEt&nKEf8laV7-7MBd2Wl`MPjh?8b*ypz71e_dZgU#mIPKdm?
z4_87nVQTA&-Of{RdbtCYV7WYdefymXEt~P(=m}Um%L=K56$-mJRciuevu1R6HDkjZ
z8`KH}n5{n%30Du{q+bMG?CF@dW-sO%OhWQCFZf&yMO$ecF5f(j&f+k+$g()+Wu+y!
z<FyVUF^OnM^T*0<hq0fo2Z^wZH<U?9fT{-eXkj;j>x&SRp84WLmU``MZ=uLhog+kL
zK?g(?oxHwfU_L|fnxLQw<$0}qy(~+1uJUXl%8T2$!0Pgw_<%V~Wc39tTxhj9Y#(J9
z)^Cx7W@_x9u#0Rs?y9_QRHikOzbBF9%lb3+h^!{P3Bm#?bfz7GiPn6SBsWv0>%tam
zD-^O}2Qp=Y=+x)7qcUBLg1CAvu!7in2vVzvZxS5sX95$_u_CJ9na`&>TpAn5R7(4$
zC{F0cfvHotz;ePHxxli*>bbzmqMK3qJr&tI@4N#siQ&o73ULR6NCwJYGBiWX#>a1K
zA~ZtW${>VT#LyrESwtBGq&bE<LM_Bi3^g*4MN~k@P$fe{C80uwdN%f=Z2ZM80Yj+_
zbtQ5Xql>bo429^bVJMKHI$w@FbaLbpa?nX4>m-43lxJZ52G6I+WMmB$>q;<J84s8B
zfjF~$EpCU`V)p`P#cST~me4Stht{f2XqwJJt58DgQs`Q2g0K#lZKaC_s$;U||CNsV
zya|8&sBd8FxCI-1vtV!SfMcuXDnwQk84p9JRdCW)M=e>o<7-wRF0NG}vI*aQ11rnb
zm}jJht+TA*Xzqk%Q>J3~R99$QFD7wGVCwA2Ckfo@odwN_qxqzOlfD~;f}7VU+fl)q
zT1`TeiHuG26B*h9zdcl9p3X&aXbz^%^}^BFvw2^|??z8TO$snp)f$<}Kpm~0xFq;q
zitJSjH@8{%{L}xFZ@nJz%o;x80^$_wO@)G9uW^uA*<&$}YZotX+yWtMJshavgEAPO
zKbpiQ$fx(yaaFXfY!@TW#wjdgPs2yx;R|#OWlp(WoH=C<<}C8+Wfx@)A5s)5_r(8!
z*~M2W_&vb3N~(L6;j6E{lJ9-><B=kZ_UUKpBoa(hy#!YCuVB}eVjNq&4MtXT6t5?q
z+K$u99MM_d4M}-5y6VYtQReDky+8yKob|6%hzw1DmcuS&-@J->`uY%N6+zF%8?G9<
zFf}m2erJ1RU-l-E0aI;eC`2|#M<2~uC1@>b=i}!yG}AGx2|t@eWHIkNHd5BoRxyIP
z)*|RmFhfmzHj0y4kbK&kD!ah3In&XQP2Y_~W;E{-nn<X1v8fP}FmtKCETn9=a!)F9
zsa|&GY6CnMd1B{@O4w^oAZR1^!r38_y}+m|O@pMXRt9k$Iy&S{|F3vFvrIN9^klKe
z$YdNWiw%^?SfdBSAR0cDGucoR{_7igdF<J$*C!q-GWMkNsBgc6<@7%N7b%l<2mz~k
zm*M2L1bW|%?{zbJk)AoaN-NMvwlT;rnDuz!orH74lW;kr5v`QHl5?fFw9Fb+F~R7l
zXhl;-F6Pf!f^5n#Ep%*;$QG<Wi+wJZSm?eC)sZ3msc6=5m<g;Vtpay0++z-cEGoT^
zvKiHH`SWDggPLJ)XvLo=b1*T)LTf8nX->w1S&I<5XAKHd=)$GCSn=)ayh{}mm&R9L
zVAMBXp+3D8f(&5a>2lsgukLb~4+&@Mv=G`8#^btA8W!6cVXmbCYNInzH6*eZ8s96C
zJq*{*-9l@hMv*ILZgVKlP1Xy8%w!Gujkx4{8y9?T_nXPi)BcMmZljv&UQd(B%A*QV
zPPT9;lRYXVPXX3{v8NBCtREv4x%3hP**%8tb~)PU5QbJ6x<qoc&|8}2U|on9sN`m7
zXM=Y#G*EqwfsKhl^%B;3miJUAux!CmLnSc-)m<2Ps~*3Isg$megWZQ^pc0#bO+vv@
zLc(C6`UtDL)H6_N&LAkj`~?f>|LQ*;DYCGGEANX$3A+|A!|uaz$n^I|X^8|ACu=KS
zYps^xPCyFSESvLYvzxI|xEfLgk44MTLjRM$?{UOjyo_3UUs+5N0z#|NSS&&$or?)^
z#oE)T&o0N}rAHJZTR3weg!!#FcOjE9nFPBJ1uN{LFs}nEH(tQ@rS3TA>52U0IxJqW
zn*<45*s=xnRJUR?aeAH3g@(Qp^6n)fIi?i_!RZJNYNYoA3${fgF1m}0?C|+&G$iNo
zmc)5(n@L<!%yL~qVx-@c_IWN|&080PkDW()WG8m+kAUBm>hGt>!~@MuHb`_T_4r^t
z@gL~zLE!xsAJun}_4XKSj}O+{<0bU?sDH*cqr)!+VE%!4)Mu5TkqU?Wh*)&gNjX@7
zk)6}R3yT{!G9avyA~dEB=Z^c~USur<l)=gqbGYD=?}Q*fEQXJbUzsD|1<B=eacIaB
z@_T7)<X{nHw=+kt^68RdBkR#f1<I}4`Dmv7&15SZG6l#>Y2vMnmHAS#g3TlxF=aI=
z;;-C;fHK(Sqt_7NUxhm-ZbFb+j}j70O=2BVNCfnoVf%@EWXH?ymH8gJ4!?_R7y{tb
zp+KI&eD+=EEsbm%+gr!)@a2`m*Kyb9F8nT)AmHS^S3+dx4|pNEv=yKH<@YG-lHh-T
zIRbwqG)klx`N99-Xjn0Z4Ihq6TjyYc^&-Tc@xrAzD!~VeCls0YJbTz!Swhs&*-K=O
zRu&J4EcVj&ULxyiZ-TR(1tm7x_Xv?$+qythkfIQow6zAeqcb3(b@mLIw28z<0<*TX
zgSDAuFOhY#xyxQ<ktw5vGFQ)fTTLfKBp%jW&$g?R3l*;oWET_t{6U3}!Y;0vzXGdP
z9q*^%11O=a^FwX;aCe{oRFASeQ9Pl@T;6*FZOuYH0eoDw2><ihRM;I1#hb&1Vc5_A
ziPbvq<E`Pt(2#Hn*Eg6T_uLvl$~py;7^Ola<d#rj@KX%`#Xqre&J<X@{}XgqC!qZL
zW=JIL$pN~+IvX(TXa5gx4f_dFecfTU;UfO3YKx;gR-z--7t)qIIu~77t<@Oz_U|xk
z*qeww;DXtI|2<lgd{BDX10`2i^K(ha_H~q}A-k9a_o77>>AmT`NR$Aw$sdo>g1D*$
zO_>>r{T+2}yfbqL`yI$u>#G{TLR}Z#HSH+$KhLdkYaV@3%6PT(|F_ezY!;ZCo93aF
z#K%Nt;dlhCH4=!j3;4b)vU;s_ZdcDR<Wkl->tBx}o`<mNcphf!X~Npb2xXxG-+Phu
z&166R@sH(e&oPGV;`0~TGsOUzY^VwU$wbySMvNFCUweizB(mo#GM06|`eqc&rh4}g
z4Aq|q%U5l|*fDyrbvgiZ+r2n4#|#VA)o^^C8M-TK70;n{)OFC82jc1C-ne=*3}&6d
z{u`B;cQ6V1+S9Sh&>YStHn7vx;LZIJ!G*9ebB3Pw6toxAAo0W&K3iv1bSR3l#0rsF
z=&ypd!79`zrC^J-ISPt^^~*QGZuK2p3u=Mh<OP_$H5@{+nXGYxiR|{~Mfmc|FIfLn
zlotSolda$v*pAgUrqCTf8~S6lv1Z{iWcWoP=*(SIMJAv=8>sK;DEtbGtZ(euvq!%6
z6!8d=+0Q!M@BSX_ovQYHMMmqaHL;h-Xq^wVqa-pz?YRn(S!#ZV&%gWz-TjE{*zL#{
zE3&7>#pCDTbNDQRqAO*Bdj^?|Z6Diz7T)_$4=R(f;k*5B75yMG*`wl%FTRkkJx271
zOw309eNb@D^SrT__}DUChi|jdsk*2hraF2ucDtM6sJk9260bs(dzVhu%+JS~^h;|S
za3!T2og_NvrJE3Na1pw?ns6n)2-l*splQAoCNsCdR6|!GvNeWk$h~t2RZ+*$RThOV
zVJX-|?qWi2Q8A7MCSmtkf9Ooz1u+RPE586<w`1XbH5lqf%g|Xzf+CUGTbj~(G1^;e
zAgn1tSV|Ty21UVi`Zk>OkAj+|J6!ZMpsMbSWp-)^-r_=anly-?m&n2nt?DHl8Gzt3
zrxAbE4~?{~u4#iq2SN~X!W-vyp2V>|2eDz({p{CTBgVnCo4Lr2ZQRZ$RF4Ts#LeJR
z)RaqbFSHsb_xeIu(15%CC0Mg$J&x=>ho)jN&Rj@FUO)g=EZ@!rwqdomB9m1n6d*T4
zjA$x-(r$&KoQWv841v2mcwffj$74_s7>eafwjk-;c_busLXaiJmKB@$teWg*v`l1D
zOi;I`_cq{$UnQoS=;6-(<Jh`<BmK5gMBGS2X|fa!#tV_?y`TPveOzFNW=unEDv+B3
z>|3)7)k#3~>DwrbmB4!51ysei;oO-bT1v3W<1~uzreMk3^)F3iedExfL-Muzp`oE6
zUz5j>U3__&Oh_mQkL8v!;>uOjXBHqkC>Q}g*O7SrCPZZ|XseZSi0eCX?$8M?vRlW_
z@`jQ0%yxvv)Z^mGP~1D|2S4B2XekpRIJgpCyN~1YsQ^B5)xDrf6i38UhLfPN7&yG|
z0&lu!kH0kKHKLeoUv^p-U7VSGto!EtR^$i8qLHlQ<;$5U2}|L<@Y%hxgxEIJQ5M^`
z-4}Q7)}Vp}SD!6Ih|g6BvpNwM(T1ysuc9n81HQXXaFJ!lNpRFV3DYgy5w(9Ot{%F?
zMHY1`5c@a#@E#xM_nt>hk`$RY5>ZW}JLj8Aq6KbUsYX>y6QcYZP!g1n3OZK>iSShr
z*+9WsFxA!7WgBvl`S|$Y<jG?Xh=^q}7ya=_%rE2H=w>&ZyW!w|9Q(Gc!vyo$u(6$o
zODUD8YHmlTxC?9ajSzHpKfd~W0&JZ<Q5%0oA+px|KrXa)%9@ZeE7$;=^%sy=Rfn&?
z`Vu3*R>SHGQ9xHSt|#W>8`}59*OPHRIvcy~sG1@dS^7B-oH%j-Rn=AKXsv~_nGxdi
ziV(JY8XrhUcg$D#;>)l2jpu0&7Lb;Ob0M+`7G6oam=>DX@BRnS$1cW&mBH&ws=_Wt
zCW;2Mi)_26(W57mJ<2ZDW;T(4<j<02iXhDC<RVkHi}9iL57@;!SId>`q7-YFZbQIr
z!2@=Yy;e=adR^?|6U87i+5PD5{TgL47LUqgq#6QQQnvj=%VZHpHuM$>2T)f<)`%|N
zV+YRhh7S|VP1tI$iv=1+@Sbaq_Tq|O4Iiw@KD9u~oAqbykHe*KA#7IOgw?X^(6QKx
z7_y&df&_5e5ed&JHn3O~054Y)tTr}7eQGuuvnwD}5?LpGhbe1rBIEikm}qOGHZfNr
zGF2@PL>*j%(A^#=xN#2UVIdG^2+*9<ipD%CA5FNPguClx0d|}y!r=>5xU`q*c$DqT
zRK7wD3Cv*H5k9af6H*#k#p;MS%(F0{^K>Ks@;RR2D#&uOp$XV{idV1Hp(T&(7QJuf
zwj?-dX?(v#M%hg&mGl-6!FJ{$oZUJfYxZ5`+dPxeaoI7qU^#U$bPSx(SsJMj+3X3L
z7_DK2LjV1+T<VLDM}C9WTz@$4x`l7P97%Po7TD^mpe*Yi?6+OTsINxyhdPZ_zk|Kw
zMyi_3<RUY(w54;l@J5fXzxa#~NucrFHxSlW<4SA>b}w<k?$fuBapNE~Oq{U6SQlS@
zqw;Es?3toZCL3zPe~m;o0O$Y$2~Z+N7iBH>G&J8&+pO<mH)}AF(rYBJuJ%^UQ#GLd
zl(py>mc`gQ&tzf|ou-3ZMLx=Kn^4wIvAd0DGX6Rnhq0@Xi;UStHbeo-V(d8HqS!(8
zIm%>ov4PLs#kv%U=vda{yp^&ae@gll6B(;-efibbFmXQ8TP*ZHuqONsTf8t~yne4H
z{6*@j@R?@{Nd=Yc^5Z+oYWcHdm8{=oVJ+65&L-p|A*~$~=|^9<BLr^Fn{Ymiek}Su
z*}$h|rNFLjUeM5-56iWI3XvJAsY61??B0A3yUv$_em4XJ*K(27=SxwOT!}*$N^t0M
zCFX38f&RiP(3$ED6Ln40C!}G!oek<z%h8zCf|}TL>{x#Y`ILcTgKA)<<xT>m|DV7_
zRuPeikzag{stn5LR1IJQxUM;ni3`i-@aM^<8faqY+WjcGmyW3G=@2B5J>^aP_`%u5
z0io3JK`JEO(Y`)*(Lc9ZQ77BKX~PrQ#Vsp$!^p^TK)d*_k3YjV->MBtWGglw?Ip5*
z|L0@uTjYpsM=vNuCMZgUs4N)=FZ#dSOm=+lVeHv{2-kxvW&55ulaZ*l9KvqTLki2N
zoXL_d`(fASL)g3H`cq{xHbU^t6Y)ctOgZEtLpNm~`3S+vn0Gh?x?g^QP1d@IKfhVA
z-*nPsq+H$!uUY!M)M_gVrQ}mgC+tLXM>{H7+EL!nj18CLaWAhLd+ugH)4&|oI%W!y
zom*y#hU@^e7Y0%3OqqkMVF%Ue3M#7MpIU?);VH0~y%!rUM8Mp59xN^GF<nm;1%Zcg
z$9q4jBacHO7uiZ5e_khJ-MGZO`M;PFW(_5a5+vjlA~-%7&KpkfCVU;IP3S7{hq#dh
zNFwt*bqB^%R=`Nhgl9CdQYJfiDd6cv#s)X-Syx8%)$2&Ra}P~bQfTT-f$#AcM4dl}
z>xVAk>``Cr-E+Rz@!Pg~^GtSb&k^2n*vfScilS1Go85)ezVT?TlECj~4j1C??Waj(
z>}Kj6v{I(p@41)6#%>#&SJ=g{vsWOX<+jb<TxeU?98j{0Qfyhf4|SPB96cF_?K=Yy
zO2?<fcVOSCbd-~*_8*Bupw~sX8tOwpb+Lm7Lr7#&Y~OMXmd<<sKYM2ZU&XQgajH-I
ztpBHd-q&aCtCyBSaY91e-AEu15`rbTI|NN2!QDcDkN`;t#NFN9-Tlh%e`c<bK!TNG
zz321!Wp`)iZm#Ti&pETRGdQ<wA@;97$02hvqr8yvFE+Z^!A%~hBiMZQo<lu(tPOk9
zQ65o&^vGV+rV4Rre+0sg_+i_c^9oPKG{BQ7n(znMgFPA5p>Q|nb|?>bZ=XFwCtNl%
z18%_2<2+)$FQTiW9bI+o9vO-1?$~|=jRe__&3ke3ObU+g+=nas599Xni#T~Wf`^FS
ze%a`#>O**V8Gkr)ulr53S1`!jc=LS&fybNf$=d~=I?qAew)r53Y}-0F$ygr*9=id(
z*Uca0xdbeo^t-lRK{bJwN|1$zRii#1bOL81ffD1olzKj;?H;!vf)a4ucp6qScH_*_
zMcB9YEQjpUzBAaidLQ>>2RFHM$b9#nMMDN~-KPdMF||mE?n7yKF;aso5KfTQBz2QF
zQ$VJGY#7LxdG0xmgm5|$pQOSDC{(Htse<n)UZ&ep-O5HBQ_vm7Qh31?ct<fZ1xV#D
z)r~ufzAn`@iK6_Z^1Y+TtAiEcGeB1)3coDXC5ghk2k4?ip%*hH^2(&`OoY%f<bqV^
zGZD;mZh*+k4$_%S+-5qRiNjkiBacl4_q0s`*>?xo!&prXxhRD_l-b+cOV?gJ%gHT3
zZeHPiHDbhwA<MrnV&74JKWkCF*S-~G9UUFgHHAIMUS!A~WDGEw6n3vY*0&-Ov9TNO
z^<=F%zW8vw1H6{0(pE3t{_BVM*Iz!wuFWnein@%FyaX!m2gDuNy?Zxe>IHB*nt-SL
z7~(TA1!Uh}d#rC|;M2JueDHyEO<_Zsjg1Xo${;H&Eac0V&4vSP>(;GYKlstlvEN}b
zjQ;vB_-`|zJ>BT7jt08QB^Al?8UzTgVv{UM%x>RJD1ZDle*V+9uzUK~aGLNTF1gyE
zF77z(mE8yjWG~ryH5KDm`(WP5G)V#3|Nj03u5B|zU5Fb*brERKxk9D2d>@O$YNQdK
zdsr3R!)vkhWDG|C=NtS@b0yZSI3U^iE$y){J#W7GCf2T9E8SAq{fwP}FS93OHfq!;
z>Dtitw@*x^Yj;f4QH~L>{!F?hv)%`K#oCw$pZpIx#?!Q6-^Ga6M__r<%we@GaR!zp
z+hR%5bSzG?hD(waoRcg`7Fa}Dm}EvW#rz}_%u6zcQ<4$pCK{3q;Fzcf2hyBGUCd6@
z!K_4Wk{0X|H8C?$oohy-8f+7%!7^NlPt*FM+mC<zV<aXfO1EA<yXO%Zg~@GL$aXg`
z#X<4fVRb;f2A<+o@DQ)We(?(I6EB0icq!b(OR!hG7<<Id*eza!o#KVqA)XIc@jPr7
zIboY<F1CssU~+IA)c1_R!ulE5D6+#wu^l#uXJDPk25Uvru|{N#)gnu*5?PSPT#x>K
z)=T@r=0iIFh&m_LSrVIpndvm?6zQZ?CrB(vIVROn(h;c+lMa#C(^*XHI_oKw2WdZP
zA4S+q?j$$TUa9twc1yL3w3D<$Dp%5W(l)8KlD0^-nY2l&jU@ByY_`iMYwY3{9Uc8p
zTC!xxkmcV84L3`v%$^x!TQC={n1kQXngA#7PoZV=Tf8&sANa=>6*$FC!)IT<jb#Os
z9vQMrq@h5%pI!#YriX;^X5=SnT^->N^hJLQMM)JYRfJS@+}<#*{@zfjLZk{N-InT>
zR6$bRBn6_shbcfRf2nSeuA`6ZnpA#L`I4?m)a@hH6{#+hE=lDr)kUei(A#}Ms`KdW
zVmc?)S<)G)PUDR?e~8vr_Q=k?_Us@N&B11oJvNDEaZk2EG!yGZ-`<mbSCCB@Hwv>e
znxUaQ64qv8sjQXMgQE?xJoevA5iJ966D8qhJ2&9H*$1IViSz-Hi0^+(Z7FnZw4ib>
zO##_MKqlyuKql<JjcqRGd@1Y?f=CbqVGH}!Zj!5|?LG-;0)kA`?@u5-JII=vTO?oH
zU8aDHr0`@z+p~adnaKp4i@k(DzV|8KpQMZT-X8;{|GbCk|N0}c&zl3C=OJ!50x>~W
z+!P4(2jDHbh>81raKOU>A|XLnzmI@=2_QQnT!u;d|AqOScj4qY8vC1U;Z|=Aw;l)l
zNpBo}`oa5HTr(eI&so5+)(OhjtSLmC4}&;c7)D#cENce7I;w}c^tw$fAA3fS{qC(d
z@xhYwINel;KaA1EIkA{L&#yRWBS!p)1I9cN1MU|;dkwofgc$LQ$s9@s8{5a~n6I$J
zjxO3q+v7H@#Zgf=M!fzP>_|FE5cYHU7<4<NuVL`9<u^K`u(GKSufFz2y!yuvv8^T>
z?`Sz;$%SPY@ye&q8Duf!Nn-iBNDy<^zG(6^gUeVQk$|l~q9<cstS^}AJvdwx^vXiU
zJK>_B?*=U;koEUUAnWfX(3l<qGC?m}zer2(XA9Z4^<;1U?f1`tClm1{1BNYSUhI@m
z$UWH!S~7r+(~^0zV<G`xG9401yx2k7C-Y>UA~8G!LcU}`?GuqFBWRf?+uJXIn^43(
z*&eFHy%?44WBW)uX?-V^@1k`EqAP`&&zmP}&)EqJGZjD_hY^4O7$bi654cQzn=Tf=
zN6B?39A7d9$%ifJmC+;ujv(vpiKP9%#v1i^@cM|?A*?-)BlA8aj}wjXQ?no<z;r!5
zQPCNN(6XC&``^m=r@9jo%lvWG%>btsf5tCH5YjIzx&^V|He#y$@#}x;;-3yK@R<Hj
zG^VVi{a2BD*$kOJ)_C>RR}fxu6&F)3;OkY(@W<(M5Oqu&`F_(0L_Y+T(XTD`!!Ez0
zNT~DW$N%Zyl=17=U&Vaam3U*sE3kLg!mp`3>-ubb{n4+{S+!I0KKjq#XTSQ<6NC)w
z@qzw_{NM-0>u^N09*0Or`#0baZ6CyHf^8MPwi(Gm+s{D5QtTHl#ild^0&NkUTrM24
z9ijysvK{^N>11)lr$+DMGt+-zt6&a??8~Ft*d&;V4PslY6Hmu_femT;BSYp(^)5Z4
zyrsHG@{;NT={)JIRA)%1NvEVbNjf3bando;QK^oQ4oh{2bdYpFDo>IJX}?taNbXX(
zk@k{yOSOx%bAWb`T&3Dh+9uUj(u}C6XBI9B1#wh6VTgT0hl@bm{XN-ZG<*p9SlP2}
z_;_r{mN%{8o@-~O8GiWpKVa?I2^=u9$VK?kzdyojME`5A{{a8~>}~v6`F}83{SjXO
z-P>5@J05OuAwXZDEA>KbCjHA*o31h=;M_C^+q*4z>*8BKdIc_>v+((0Exhulzv82*
zzs6SwRPX~juFcW^C~`8=^Aj#UsvbQjdy!igzjqBEUIW$#O5I{5jx`p+aP>YI&#=Np
zbigA$2$t?%FtX5sjlBsbPa2KWbmGb&vpISWE7Qucza$REyUt?4+WD}*9t~x?738^r
z1y{VVySfmI(<?A()(*<2+~63VjnQ9!1NH5fup#m)ERNoQzNt1Qna{=Eu6j(dT7((F
z<*->i17A;_$03`dJQus^cr0Wb{nb}IY@DXAf=xm(oXY#*<n4}`VL4cy5Qu3j_Q7(k
z4Zc<}_|71!uDn4&3<b}_>iYxPJMaAI(II>5r$56~=h4GTi8RIeYtksL$<AM4lJl3O
zk(kK!1=o1z&q<$Q9M`8@W1T<2H(Vdn`bV_<kZTNSwDSj2y^pU+qZa-bg+--L%#)q&
zrBINTvOJ85ZL{U6-d-vf<796S_he@U0-Pb)2Nv>e1|0KZNBaBt@*ti3+>6mk?n(KS
zM^7I-`UKpoF>mJH(*t*wqtQCg%jo#-lxs0CcL~JMSbG9GPFt{pUdJHY(cMEHzL$Hk
zZM4oj*)~BRwp0DBl;641avNKx_qdgo8~ggmlZn4G$Q1TuY*@%%WXsPl;wRkqO+|Du
zQrPonFC}COQ`qxl3dj_uu<y_mfGJF2-=Qf0Q<%cOL%T0v>(;G9R(c94^<JeVOO%?3
z%+v&ACdZTFkeL)qia};#6fzS?@sY@kiy(!OLXjC8iu9OZq(|RIdekja5GfGpkpW1L
zxPkQW8~ERU|0R6~L))=q$ME5YAAKu*^wE>k+_`h5?`(Jz3Wd+5p8CAg-!r=}V1NG8
zpN1aRi%CALmvksEHiVaa*e*6?mvopeHar&}noBw)S99f^;kO#t&|A{sw(1Hc!)w*#
z0c{n?$uE(<i+e3AD*@^0al<MtEtV@aHHH+8loX~YBqv8ADTyfpiHYG{2?=4OP{hZF
zA}%h36pYwdrrU^#xkU;>baW7+qHdA`5gEx8fQSfxgoiWTpt`s2d!l~)@yE!{&c3g*
zva+}`Gc&m|GBUW*)6?m*q;aLDrgEjEq;MrCC(~z1;$jbgG9@G=aK*>R(`Sj}ij9rs
ziiwHgl0EapbnV(T>AO_ecVW*hU}>58(syyMWoABqfMw<sN#EVQ#=4*}Q0}Mi5~9e+
zNUn&82(Iw(aD;`0ak2gBSuf`pBhQ0<?*WTrfW?O(BI@?{7O;$L1z_KmeJjAwQw<X%
z0|<J%9ttpVd(G1WEIk2f5ofX2ejHwX<)=uGzla~b^$F54;xOjD|AU>zm$)4th0769
zc;%H>@Rj9yIP5(SjSt_&H~;+$mh3$arxm*ppBVhq0ZU8IKztm*5|@Bv0xB{(mID?Y
z6^X>SXgOf!ThGzOfgp>ILu5F?5)p>D*cbvYRsq;^V&4w1t`c;0G~!2pSI4Wb{(^ui
z!tq19A*S+Wn|C5OyAt-RwjsB&8b5#MLo87J54P+48>oo~S}VR&z^?9f#K+SdvCm-&
zg+NKjPP~k)%m@xx26?rh#Aw*>I)^La5tuk@3&zjbgdH{$a3UxKfhoyIP6|c9@#Xkv
zr0!D%Y@ycIu-kqa(<gm|%&bhL-f%}oS_m@InO9CjI_YYB8e$2=>ASDMYUgFV`?oPz
zb2fy2gIDp3Pc?Ae(*=JYZKVM0Ik0aH7#p68g@~{JX)+3~Y=lVEi?o7l2!%b+-*cTG
zCnzBY|8?-dIhXPDnp*tqhi^Tl5HS|}9O-@KCG#+GV2GGR;bD3zg^Cm+W@gjzXk8W}
zCM8Fa2MH!`z{13*8zM6Al@j3xn<@Xr@7^1a#B2Ko0mkGf1?)Gky$V}`EG6+K63J_Q
z^0&7UMqcl@FMSU3WD3BZy*;rU41Khu5D`6XKs!MqY~vv!o5_%ch+yF%<zR{DHzG2t
zK+(u?mt^qBa<J^2JVg%n64*=C$l<-+oG&x7li?Q=e-B`q4r}RT{|gqGs>=a;TWt>F
zLp&+hq5NeCz($Pt7?Wmfd}4s55-<#ofp9V14cJhP98oc`4+JbUH1s}zg)0Di%JxzL
zc6pZ#f=@0%c~LBG#)YDyIv+7v$xyQ2h7oU#!Mm0#FyaRv&<Xzr=^gy($FK5}pDFnA
ze%wB?5b2452ug~_@{@kpdo>8Jy!jQT*>A<a)E()yAAf7W4%tmaVPP?>clqM&pS+H!
z)J%N%g$7Q}nT%In8G*Nd`YQ5svyhdW%X6x<^fdg4mX|{lFye!0SYxM)e|(~X-|+WM
z<sPf?#*cqZA@5BBD~gx>=a0X}1XIZaup>tN0D)fn@VUAMqWwIO5EqSCUwMVzw*s)I
zVJ{tEF;{mWIqEWQ#z!M5Ednv=NmzO88b<u^L;QZ)Y!29Kbb<w+U4^aZuj5a;PUOK3
z!DZavv1Qg24p>TZ1f2GI!P(<9Ui|?BYzzKxq%KDM^7AJGSaDGi)z86#)$6f*+abKC
zx&X%<m608H1^Ib7NH55x&zOZdw&pl`D*>Aq&&T^3OYz31nt1g+C7fGrjK9$_FYla<
ztgLkW=P$n`&lp6WFPZ+=Yk2FgqiOjL|G#@|lri#$Baje(ivxDW)ebH$F1QsQp#bbD
z*h>YNOb?TTG4H?{I-Yh8mX(_?UoR*u;>*H30xBn$-gCyF5V4@3fQN`Vxp_#Y5HTk!
z1Ie^6Jv9Yc+1W@)N<}<{iWwPc^d2N(B0FAc8j~d4j7><S_Zvl?D;5!v(L6+C;ie))
zd^&btz!of6fU@F3Qo+3{V#-HZVJ=Dwa!A=I&Cf(>UIr;0rMamn$w@&8<wGSDrj=$T
zqJ+RG$%sdBdMt_wfMNomI5i5zDUm29uTh*FhT^19eEI1|NJ-C?zKeV9`_RZSR1T(S
z<aqJyzJM`fbBQIV<$P<glWeH+;gpn`Eqw>~ngTEdU@wY25U?j@>?C_q_Vb_r9AA9#
z>9G3zbD2IFq|ZM4Sgx<W`eM-br=Q-fkMPMS!|6kO{P7*VLgD89Jnma>y)`6M1NE!`
zW3NfiQjF{IUD;CsY~jL%ygO1*P>{6b+goFE3!T(?k0o|O{on^b7;@j^D(gNTjM<JI
zJF$4_ibvM+m1|&bF`d>|K9rU`qHf*_r}sbn#X(`;&YlWj>gwuz`HNrtf-j%7F)#4i
zYp+SSo}P90^rGjX)dvH8L;UJjZ-Y(JJ#?KXBZYl;_Ckh;-_{shM~)mpOUuyX+C6Jy
z&w-shc@oyv);t_m*o$l5`B{JB1RE#!4q)t|!e?!);f6gR`TFaxOG};~`^P{2AzhPL
zM+cjQSYa=!JvFz&=7RptZNO8-!#!cl8V8vD>Q}!)O-&77e_rk4#f#E4g}tcu{KReF
z!pg%BVWj>R_^#2XtuFM}grT{&A2yCo1kyi|=eq^tr?Ww-!CTFkF~FWzlTEa4XlTfn
zPt#b-rHivUoEMpW3z^;}6RC_zM#IQ(fDG=EzC;TLN>3_XxfXHh3?c2iq%}aA!$?Ca
z^#M{FQml*HaQ4&y`>u1aNY906NxukdGh6i4#L`J>i{JkJbErF?ftH#hYWt)WrRM3$
z2Dg6xj5X;$OJl#&(BsZOiXL~2df7PjLyb{S;$zgy#;G4TM*VQ()Uz?_zs)%Hva#xi
z8mIowSoQrqXHZd9EByus+e-u3quPr!no?$?h%ec#j*7so7;AG9uf8g21!ZOQY4FN_
zwJ`Qyze7Sr7p^1?{bN6jDFAysz=rGE_teh%r;>v`f<12`qK5~Y{Aeia!#dq@wCv<t
zC4t+J>%EGv10tjqmLk3d5J*edWh3+AI*hSlQ~o`=Jx_p%gh3GY4F;^NH4sUur?B(F
zUfNawCb#F!V?0lQjT$vdy7uhtSpg;xgrn@{LImwn#oC3cK>K-Y^;`n6Fa)!lEnsP;
zhTy_$NUjgW-^Yx{*K=K<zi|W9Kl%WlPnm!*de)e#q=Cv#Hever5U}ShM09g=lde5m
zyL5?7zV!UqGXt#o6vln{8E)-Tfmjp<bg>Dhf;eCh-$rG}Z7e=}2q^^E_(jVxZvJBA
z`P!niJpeZf{BYED7Oric2E(<h38v>9ux;D6;j@pwe4-jNYTS_JpMLZR`f#8|4z2&)
z(I>;{gGbZH@83uNmFhqD*GEkMzE_|AZ`6?GT>rWwS<B*gZO=MH4BW0nK(Xz?IhcSX
z>Z2uviDJ=hpkJ1Uu}K5j`U?~yP8>T0?bYHZuPQOxm@4n6wL+?LsmjD?VJf|&<`Suj
zr79AmsYoPIp+t=ZQsqmPCqjcvxf0dqNR@p@by-qnN>rOMK<N_Iq)C-3QFY1yB}-J5
zBvqnBm5D-BCP)=8L<LivRIw73GsQ?1Ekqep)Br^aQOXn{#Hk$te5mX1+McHz?4@nw
zPyqI*fQeyeIv+JD;`;)&-u?h8qub<wt+7~y8OHNb87D?%jOZS~&YW+O19rmo1~M}9
zq`%O2XLkd}wqJk!RoW8`k#qudu`q_bNId1$@p%2uAJ8(6w&U=pS4ZHD*Iy$K6wAvP
zTp~d<f)D87^s4c+9ZvNk0iiz~FA_pQ1c4JmWo#KtbweQP55{}H{xzn(|1-Qs#}g1>
zVi5z6JeYvsV;)SvLPv?v#^xcVbqXUHV50sTcw@vX5cT@u=fC?L@BI9iRPP#voNR*N
zYiJkWAb75jC%i((xr(<x)TU!I*u3f3mmuu*hVw_iK|}9l{@EE|BEdxh={y~qfa~$X
ziKHX+dIp*Tu%`l81Jwx)Y({-5prW%7TMv}so!^gv{`}j>Ndc6sE@P_J99XVM#Ls^F
zDSq~u1MDbdwqBWxOurNqUGPS2R1vD;fVw2W$!;}{c=eFC1OD)rQJ7}y|I7e;jkZ}C
z5JgHwpC}P3yAI-dK?Ifm0wezVAuWG}#pB<`yFZeQaRN~cnkp{idTuago;rzrbKb|9
z)e~^SWhB8xP>2KQSYZ$%9`8<bKu^;ZEWU6I?@pMBH~BasKSfXNalHB}y9E&dL4Oo3
zrurhRA`sgTY{#$vsf$0p^*Yu2krc3-q)^n7_bchViPXAla6GaLZ~k^9M!fNJK7NS|
zuohtee)5qvuH{|8kA5=|KmSx8qnA1pls~{Lul#^6BG<6wi{Ic~iy2t=&F=}Yi%7WX
zM6W%E9j6u(#9kQr<zFD^R(P<d2H01B{seVtVnoK$???<J(z)22Mcd&5G|_P~2$}|h
zuOb<^ctZfQug9T*%1UUPg@;rB{WZ30OhlfS590T_qK>>@W3m8Mbi8VU?BKc1X9n0S
zue`>W3@|ZLpk-qOrEUB0^Y=gFV7>Ck_o>cruxR4j_~R?D@Va91V6zt(<3zka*7|zE
ze}@JRub6<|niH6BJDvbz9xM!#O|;;b?GGJWeVFcZ!+RP|e7uym$O|r1dyl^t*2rOQ
zuZ#Bn+xY9JBVoE@8+o=@@w-=FqyPI;DPXs-a?^6WPW5l^oJz;PiQm8Z3f21se)8I@
z_yxOH*eL;Qf`Jk|Zym<pzx)b6{=ac}^{0Qto3H*7|D9&cA$#X1KY;W9eu>e4djsA}
zK1OZg0!-KWfG!MYvCu^u<!u*nGUXWTJ=ZG$ds=`oHD-Y4V2$atq!6*5mMlE1BZvm(
zV9d+C_sOh5IaqB1ffg;IbuqjgtzbTB0)>baG7iYWo)uujY5!^)^h!g<d-dQPOeCbR
zPbdiypF|EO?Dt1zCCjxGIoL}H*mvE?@w@?ce<>O{WTpU20oWj8U9X0Q=27%L1FZL~
z0x$(&4{wVWxxi+|tow?2x}nO4*6f#Bp^<S&%^3Q(c_{$P%z+%R1s2-}0oIgNizC-t
z6o5UV2?WCXiieUzlz(3}oW0P1&Ds=!)>0sg0MlIPg<t*00U!U*9v^*ShAXS)VD*@P
zp~~+J@-7~Mfc|eskpP_)K&0DRbmz6AIUgvz>a76mF^mDGum{@<4cNTB$#TGaqk8a<
zzggqIe>K5xe*QjA&ojfa(VwE|(lH#iRzZ<}D7uS<XfEu-^^J4UoKedGE53GF0oY@h
z0<ed(mm)+|<X}(V6o5UPDF9Od_E<I)V0UtnVIEBqi{a{io-OV%+2c$DA8X3*0W#|8
z&wWf*+i$a(bWLJIJs#B|0`^Bq9!8b^H+Yy$<ZCj!_f_A{UO2$seB;mPDhJgQp|u25
z2DFtj$f&HC!9}kr>gRy5aF7A^+Hc;+|Gn`l>T`jnd;viwL{nZLItzs8EEJ+Kw;v5T
zVl)zb|NhAc1z-<hcLP=(agdiaNw-6)`uUPQ2&(3K8@K8A|HJ?N2mc*qi9h}3->3=M
z#rHGoEf3{Oc5=7YRH2}oZ=#fV_0DO>djE24*y7I1DyZy(Nz0H>*@xf#?r-?h-#<h8
znFR>kVZ-+`6L(dis+>-Y0oFyTqc^kkQVxtqevbdn@W6_1KEjddDzN(UAK1Qq3o38!
zq>F^)>G3CJFBD*{6~KZ;Tk)~kA^g+&7&<H25B(N82sqZ?%u!DnDJS<rRdW{F^E>gU
ze@`U%D9<AJ8tL5pDb?x7??U>~t!OVIIO%o0Wk3V1zxuX0QjToHe-wZ{l-(~xT(*9L
z+!Gi$u7LKgVEppGlkmzLf5*SRFvFkU{TL+yTctJVH>e21h7BueO-ReNh;5XV+pgUQ
zuk1Gb{<ojtLzShxOhaoHj>XmB8$$=Y`pVn*=f9PaaMS^z`|S9BX5E!hST*08uOGdY
zfvrbwbI=)JfB9@0zA<&fAAj<H`1Ego!Rfim$oJa_7dvfKgdfDlRrC4lo|L^%fVpaa
z%)Qw7cYcTk`f4zBJcWdFr}6HGswfQ($2<R?g0k>f`te^w3wb7X5;PZzVW&C;UyL<F
zd1xHodgoKbd2Zx@)ex}1810Nk0`Qcx3%;7{i1&W@h61pMF!tR(%2VoBkGV?M?wEsv
z16O-9T?HS~?iVo1j@NwG07uW#UbqlZk%K*ZV{pl&u=|?=Fa=<bYy$y%-o{#a-fT#~
zSbwzFUwi$9*K044*f4F+BVbSCDeD*66dp|B!5-Pz1y}}{!tQTR1hCFppo28jzCn@#
z)=`aN0c)?oBLUXJ)&~IAB!g@Sz#4Kf2(TvFZp^`b0jtXp4+5-K0T?%h_j)*cAYesh
z_kwfDD*{~=9Ry4dLLw@#NLd%zA&~@`7!h$5=&BLpsOM>PQk{#JQgP#i7rGdLQou~s
z_@k|~71^0R=%DR@Tg7O~sYY5_7xZ-u<$%?t7vr$|1rFCCx3heC`{ZR5$L63lzZs21
z!0nJaWZsTPeSsLqJ#HW&ww+Gq5|k4_-bZiX%H=EqiQZ>mH7?(3hxJT%oWE4S0aKfK
z1Z~AYGo81dJI_&>7*{;Kk$W>4wTX48$pFG{H6ihGII0M=L+-bc6w!nH;5?KPOlS6l
z!1sI+>JmE<9MFQ2bf6}_9JK`AnWG8Fx*89UtrrL|5f1DNM`If8PZZ<q&a<eB6Fn2a
zmMmEUb93`=Ee6<7<wMKj+soql)wOHarQhzoc3;346eZ+Q?gp$aGZoW~?6KF`4zta*
zIAE97&&FmW6LdF<(OW0P3|mJu){$px1vahOf&&M`2LZO}d;zMWgP@|OL!J!$9+vKe
zDT4qj4e_IOpe!XBYgcSWb{2U*s#{kMTn%f5+Prgcc8kN-1#_|Ya11^fISL0ZmE(3a
z0kvxxjMa^han1wzH*Q1CXaSlFf$JNc<sNL3vN_f+^FV39HLPB|8F>UqGxKVso1wk1
zrT4kzU^Z6Fn1e&dlkxe;(KzMPjEE@U+@g8V{ALzHcCJIh89!(nEk#)-dC0^n`0m<`
zxz^JWzIzMm$h)N-J47Chj!S?wqyVcHZia_P;<NE!VgbbcJx@U05ce^4Nz}{KDOCqV
zJxuKqb+<{?Dp6O9RLu}|%G3l=2UDX|4G^|7)l1Y?CsnOPtu<0rL)aoyl|;>zQdL0E
z#8fU(W0_Q?5;c@aRSZGBOhppa6-rfr{#vGdiE8qs%9W@(2jcqSr{I0e5D}=R6Fn<1
z09jFqxUl^Y;xC;?2LW~YW+4w5w{1Pe?=x-Rc@@VuyP})+b=3f!q=Of;$aB;qC7nDN
z)je=J2L6W+BG&5yJa!%7VPYFWR2q66D_8E~o@?de^=K)Pl-HL6@kw3Sb1V_(eM=B|
z!5b9>&#GlRa4WPKCE@8PqtMS|>k$;+3P*ExD~_K?f=^HzY-YP-=aFO%*e>@-c@DO0
z!3H#t2WuoTPnHzhk0YnDaMiaOfu1K(LGZ0~c1LJ%2QqIYpfnlSwfr1XF5EzMY&}k#
z$U|AG7}W{QD88M8*nk40UI;`DdAjNZF;=YhLT$1bRSEQemu*5dd9`N(n5cgUSRO|T
zz+`|4Yx9sX%skgmBnNv~^)~{2qz5%}^bmC21Y#?BuLtE|kJ8A|m_IlNWBT4Tawq_M
z@c;`x<B!asV7}f-d05AQeJzxa$<`mG6_GC=qLE`DU@e7$L4Y;ocHg%Zu_mSN4qz01
z9&@{htoWW`0jo>x8w^-d>#%^Oct>%#E}qL960p>ZvGCb<^@RltqCP;_HzZ)_?|Njw
z&_mmg0T>ILI9zO72H7xx3FVMICxCU;3s6=ixC4k(a}3N-5q1sBtPP;2qQY}9uT|4g
zn-Gb)vux2zuUofr1HFM3>~Oz@dCuz*mcklEB!G>bYJk-?CNS1E#R@GoSZZissr?Le
zR&-;{(p9KSNrQJlC0v$lLP}<z9I#1hhEOqGiKENs!P?LOn@x4G!ND9(7RFe;$ORq6
zy=W;09b*IZ^lUME@e!VPvGB5y%57~HBRH}fvmDpp>^@I|OpF2oi33L=WgDHpK5Lw@
z)4>+zntE_FP{q-ei?MLJB~~q1hNiSmG*X_mYS9Mh=-Ffb`s1jhylUB^^{A$D8`~9#
zA|M<c*JJM@XVfGMV7lNuEUA3`-gL_OjG<=bj+tsI(3+xx*=outydICmvlpP^1q00T
zk96t?+ELNnhkbi?5>(wNDawHE7r#Yzv@e0x3Af$*3BE?E--hy}o3!2r&%Le$VH+-7
zPe4?1HrUvPKN&Fs9eDwC4BEeQE5rm?)RjXJcQxVIi2xjRbH$MZr_fMSgqEBDI_?&T
z+G=pYKN7$D#Ejr<!0T`Q7b9N(DGs^sL3TF9^L^E*$_atEtr}(JB{=Beji3B^0{tfb
z9K80tNIn<#GxuPHL$o6HH1uQoq6^ToJ%E56bLEX3rxshGuf7)ziQ(vLp`@PjuFh80
zyBP=yuNu_Ip*Q~mnlcNpO4|TgK8Mg<+<>B+-aP+e`CTuCiL7gOR7|rRFsI!y@N}|;
zhUx-z6t!Zru?YcTkJ`j!w3P|bRnm(l@?I?kLR3?pratZqG^7<$84wyL;IO%!E$00Y
z|M$t494x=!F7Ck?U_At3U8Wf0^|zoYxdx6VI=Hoc1!@wDC^w^UHNA^B)7Pc-qMnX5
z<;#yymsn4p4e-9v&4*+=e4(BX-S)}npK}jpy3m`vA24->2lk(;f#%m%Fm^nP)6Vla
zU>j|W(Zt3~Bro<N0cQ2**D=%9mezam*AKtK?ZQ@U56r_Zn~!l~sT!`VGvM9}0{TJG
z2C=vYfB0xNe)7kEW6h-`{Px4?_|+TiUfSF6bUQ@nR1Wc4%v&cn`lO+<iB2G4JAVJ)
zdHC&*UdM=6enUSFCBCSKSkMChH2N;Yb-e!XzP7`Uey@TNKm09zIpR&KM_;I@7TsNS
zc<c9;2%_`sr++ZT+n>+l^<RJe4LE3z!Vmub#j^)&II%FWlL15^^b!bN4H6K0sEjT9
zsEpNNITzdCSu4c3<5zI@*d_E*9oBN#Sxv92r}Zkzx5}Bs94r<hcF}&8hqVzjXAWP%
z=|kRF>X||wN)jTr6F~f)87-R#n1MN1CtVa6OpSSB9wK&>KprACQ&}t9N6@tu^xp{)
z2jyTCf@aY%*nKlv)}%@Ag-LU;W`eDbAgWFg^YE~l>c~RG+9dj)e4k`o#Clq?)<Xs#
zYuI4h6|qz|0jQM@JjzD%ebGY1qt4UGBT4cwt2xVXAUGQV=@k^dl_LDoUWh1UG%>QI
z{p?EFg7m;c<e@rXZfb+&u0B|>@*w8fS|aq+c7B4`I?UrC;&fv@h&vl`X6rm2HeNfl
z7DwjJg00mYh#T|hV%-48rJnfBYa?)O`3#<e9aw0Kql;~DZT~VjS<?S($c4D42FX5d
z>}13&V_n!g?84gFrpUQ@6ulHa)+SuVm4LA47qG{Y)Pp@t4kpXLo@67(-8mT3(11y$
zXymw$o^2xs+GTmz3*N{vu)$)WSaZ9&fg?I-$+l%n=Fz5%SCwz`eeC;?zJ`@Euvk++
zTdp~gO@K+fmkcoG&Dx|bh^$$j!NtnD*lSohg>oFkV)7p3y(ExHyjW9#m;+{{wwOFs
zKT<EABe=+`Fv!x%v1I;gghllbXskJ20vB7_=uG2))l-Pb;9{PO!Bv;RJeUHod!=Ya
z{MLX?95WJMj~c~$X2@V++G?(j_WWW@Ry9J@q1CX}(8l$17m?=W4iSaUTGRB<CJh<s
zLIe745fMcv2ZiK*7jNQha1(lJ`>^qJ4mO-C!txzna8y^91GZjY6a5t(s7^>hX=*k4
zOIpxJVP!vslN}UJHWFyp!|Ksa&~?-LF~3?083kChHwNntXTVTRA10bBU~6K7hJ5<B
z1f&G8N{sq?6v_y$^EaBY&_D-MO?D#x$~nw7(!oY+6I?lV12yqQ$cv`q(`!5Edy9w~
z93sBRfB+Oh>%LiATf*AX;yaT09a#*N*)TGNwfWsLk;`hJ%#4ST(Y-R2$#AetWHPu*
z`uECMCOudVDP4(-ba|b}_F!$&<v?Zmoxt8@4$w7SfW*@~;J?EedzU+*y|4^khYvta
zNgJAzw59cdbvw@^I=+~DuY*VZP(&Wd>x>^3c*H};eh0>m(}9xq964YcjdieN;cR64
zo`&c8l@OG*@?7iM?Q(RGw_CFQ6s|=!bHMhvT|o(bw$pT6n+-Q{@Nzi})eWFKMGNbv
zTk-s?CN@Xz!OkA?#iE_j7_T-1%DT%iM@tC?lc!*op%#)(9>T$m8&Mo^6Nff!<8U=(
z0+BBfU<wcRoP~&wtMuy^v1HK-EMDb)r~Cmq*pdY+xUOvXc&HqVhmf>AYz{^q==Kp`
z30#UCOkxiSm{2HySaiQ`RSyT4m}xk`Xr1r72QaoA44CKvfQedbA!g+=z}jiwqX5RX
zo2kwafC(FmpABFG^Q?y{9}2LxZ{5f-G+<5nk`_c+BS#aRn=BVo044!UGQ`Zi0Hp<<
zfz!H!m@!rdS6pXMl}?PAs)dN-D`}nLeX#%#_EOz$OxCqU-i^Juxo<AM7^h6Tx-fF&
zD5}G5Hg}?_w;P|SnB&^nT_~uk$H}b=aVt3whNd={;j#l$C<Q6>+eSb(<D1FqXv_?T
zs?`GMPW=XAVH>`lFqK30#pv;9X>F1NcK*O-6ql9b<d#J^>~)hux)~TfW(=bCIZ|?7
zf$>TPurRZR1%-Ip(-%VAT#7G8j{_yxm^^kAgk|B-UvUUufAJ;um}+sr3NNpRh+vD$
z%*8@VfyztsabUGQg2SVsGj$GH(r#e(!Zid_CcYj$5uKSA>GfZId%%i^xDVD*C&tZ?
z66l#bBR0O4_udGOD5HIVk9Q>0rs^WrH%MMT)H?uORb9ArJ`_G@{m@Qeg?iuQ^=B?S
zg!-%sG?a_vfVI<leqs^91$dqGM`cnrveLTYbNV{ki~2ZV%>>siuSg_^<s;#uFDmlH
zI7j&t1J3`HKYVVt!`AT#uKAa9z>HSiKu-z5Mu43;be+R>^_U-T%qY$Ua&M)hHcO1k
zxH@FS_2T-;5L~;I_YwmpvAY3NrSSUP_8D@(_S&lxP;AH;VAJCDIK6YNv~D-X>)4>+
z`W^(h&7nHA=*S5`Ts*s1)yn~^ZSO=isiw6Z#@1_)Opu9sTA^d+h=@ZAkm0=nncf?5
zbN5W{!Dec!Bk{Tino_(G>^2*{EwvC;Cvp!q5U}$4dg$xx!^n0X^wc$>uV;aSGffcY
z=73Xk^~iHo!OX-GX2wR8uxBIZ%2uSr-lp|T2%9R=#arDfDE(N1#(MH-Qoz^=x#3I@
zYe9plwl<1Oi{UZdhy$jo<%}NkT#@dJkP;Sv?o2O;*y9{^d5;fROGQ8Oi|_5pVK`0`
z<bk1Qwh&2lby87QhVz1DxVp)f@7GZpi|Q%~n4R_XbvMxWUr~#`sx~;!TMD1x8Yroo
zU>@aQYfoll=A6Y?yl}M~Fk_>cXv?icYjG!RtY`BE4%T|8Z!{g(!`o1vQ3C&ndTcQ^
zL4n^HwC2>(5AB6TbC;kbpZ+iF6kH7Wu3I4YV1`RB6C72@KF@k^h>)Jtiw0WSZ3yOo
zIm}rKmj#<JhkoR#lP1GLO&fU^Pkrw~L<mXZKJ<5Y5)2gX_4lHmJQ3f=B<O)aAmHNO
zjJy^P1zBiFA)~N|>Qac<+u26z?dWZ9hLFO*zK&*o9}I#H^tUxaNMWG3hw8LbNJt@K
zA8QrsX`z#aLP&y5NFicR3jsxN^)yrHM@s?aY=W*v6xFettyD%Ji75>1YoNrO;A7z+
z3m1E7ySJeX#(FxEFtVi*g4U`*A!1K$5dl+(-dYL+S%^sCU{4K&gA^W$>kA=fLya}j
zNz_dBDsv&^p(G0(iy)-B%yWHbAtHlj!!BRA?l^<|TQ|^6+ne|K^U!e7lC9XXdKXfz
zoaNh0?#oxAud<Cl`?YL=GdgKGZ_Xm@aF4)d=fx-rk3wF)kitd!p33Ppl|V#zDS0|z
z>z*5+?*~4&>M+-F1$=MSBIr~q!cT_6dy6~D!XnW^;bRtsbdIx^aPQViUMw)Y3pV!d
z*mN+S1Lo|wgf0SmdGkE0#~@oh&zU?LP)=nLr@c^~4xC)K6+XL<VAqPBC=QJH-sWHr
z*2Cpsibjqh>`63oFbD;7(GoOCJQ>#zIoQBPjy`$~^HxvdMl-utrnu2OggpQ-J^S@T
zmfx#K2khh_?|T3{dEmkzz=TzCa=_42h0&u&qrOoF*B!tvud#Uf0lRf0dC2mBE8#<y
z4+U6ZX6KNN9IZv2g8*Y*>Op|jB$vtollA0CifSDMnD_BOWG43B0~mW2tp0lhSYTiP
zZU$bz3mOSvDn<*ie&uey4M9IzdV6sruNkXP2g7cgFX}qF(Oi>4SHo61U@L_EEttK_
z2Rl74bHG^V)AGg^G<0?&FufS3gHm8L-woFGyJ0+IIXqp=anMm8-kWB?YNjhpY!~D3
z5=(5c(ZZQcvpHNcz;60_<8(+GR1D|CL}e;;rcA>j7gKnzFhNDwA@nz7(-oY+Xsf1(
zwF$Y!B`B<TK>+J%5TLyJ-W;qn+#jZzs?gHV!qf><k$UL}?95HjRnY_|TPxnkp>MTH
zUf*>3Jk%A}V*b({Sm5LW7Bbt}JL6`2Cp7eDLQls8`m=Y+0ZTaT4r@b8`rcYF-(f!T
z1AK9dK$-98j1mfs?PfT@Kz{~S?Fys!U<hSRC+u~yf|;QK3U1thy`>c@!-BDLlP?Et
z=4yYGu$~*F!aM<vEVM`FC2vgE*F{ry7v{~Hi`IO~fwRPLnB{`3Bq7YL=fm?%DU?(U
zFxhb9O9vQRLd04F?*%M8G6lQs)g<*G<YRB_4KBjjxFVR(-^25-_?WA->?4@SLy0J-
zEv<#hWCJ;1tWH^LCwlvOkx*CzZJX7woV63v^cTWs>l|z})<k*4DOlKUg^I2d{I)y7
z*-#tFmtCdaOahpow*^|d(_y~E9cwH#p{Z($@T1E)V995fL(o}{p4@8?c2%RRn?k1c
zYGf3ZzBnFisNVD|b=1&ZO+SX&LL{Eq35{t+6xWFnb7C_(>%`C?z}6f|;dNPqO&5iU
z=?VGht*0M^E_$WKB6LwG=(sNq>rUn3R7eYQ=_(}y%v{eD&2%!w99~BWtR!sgsqE)B
zmaj#0qL!9<g+SEx6nI`PfvKu0badAt^MWUAb#>8K1yn|ape3i7dofe36;cl-Mjq>^
z8ykz6dfI3s&zE*;AC&`?^P-KuBi5rnIl3FQRHilmJhmOofu)+p3kTTg)2I347(G2b
z=<o065b!Y!A2J8Kx@!);`Q{r;v~V7B|4<>~qG=QPYn*mn<E@B_9PC?!i0tX)e%4E#
zHRwpU*^=d5{iLe&LR|B{jcdMf=#yMnc!<b)*|X4)y_V%%tc8*Frf2uV{4U()Y9r7X
zOe{QPU7=Wr*g>H8(0WHHZ5Od{lJ%k&@tz&5Zesxp9cfA7VJFpLz2zBP*(~&9{S>7k
zBI{Y-Lgy(958J7ng@^3%6<H3(JQ)iQ8EmaouPKxMU#_%2;tS@%cuODIj2ScF>+8#x
z4-43X_2@a60x+pPiAIhg^?*i>fjO8g|B~fkkJ`xbee6vy8%E99*%?Jebk&d=dj?8w
zGQcRj6ASJQ5rqT|B~=jfo5_+g5gj+9jmlU^$jU?n?f}4euMYxDM6Y3DfLYHyH~=<+
zthXJOv)y^qyjTiaWAb?kXapF$N7dC(jYGFHDCB9OD3d`(z;!j?{8B>+ToeK_xCA{-
z94=93<BJd2aJ}g}YQ#{}caZOA+ma<PdE7L<yi-@Q&c;Jzo{WLj&b$^aCB5kf19ofA
z5)PJZOb&L#xrMwGdj^aRe8T{XOB2YuNwJ&Dc6ReIO~r=8#e38fSZpezw!BX6z1Xv1
z3@+ZA<0Sx$g?pDTU*_v=ZEbvcw*>|UB0oQ0x+OI!V2)1nFwe<B4v|bO2h*H525l5t
zvTeytW)V^vx{%Y+kC{`A@zn%1h{P0fG8n;t?8cS!TJ-bz!33D5Z2?=S1Nd^xIE)|r
z6{hIVBB+`%eU2ONQ8D40uV6ZJBkE#~%RLwaZ2nwFL}ZoVa&igM&n<`9vXc;0L~y{)
zE;hutapU;|gnPEFqyN>yA4be7lid4yApujSFM8a#argA5-)XIhmh2o%o@Rh>&lRxK
z(nGlK4P;*Oq_|4Vd($^cA5md9q}fx=ArTa3bpT-jakvoHLb;U)o6h87<N0E&ar47`
zEloLKA#O{t)xv;2fDo;8Qn80Ho7izGDNLl0G%==<doPQXerT2gHg4=VOfp=HIl9{D
zF6=<=rDNz~;bU<RTIgba`*Iw1o+{#Vi8*cwh0D$un5byIP=LiJr10OTxtUJL$F&E9
zh?+B2W09o+W-i^uw<UlH@yX}vShZ#zBJ=BDq@jZC=Yr*cX^j7dj@w7MULUllO+iv=
zJ#?mgg_G+XFw=QEibGF9%iIC_N~3UQ!(7<T-;C^Qp4hZ~6*>!UNde2?=URAXF}66E
z!+Fy&1XB*KZ#@rZoOS5DD#nC~lOgUX$D~OrXeTen68x;v7Z@<6R_St}(k>swk@YT;
z-t=d7!e^5cj%-|tw)`UapF0EfsX9=bq9?5n>^yh_p)rNrlbyX7j(qY!0lwi_=$Qb+
z1qU#8k`a_NX50bHeJL_79>QtYjcCfqL%`)={`50@QrY9^EhMLRk{1(U&EX8x@xF*+
zcwGp?5(_;9?OF%V70#49RpI(sA9NRV@gV~a9J!5%*gjl37Y?(PzSw)Z2qvmJFBD)|
z*+c(`k7N&-gZ0x@v9q-aogEa?Ny~(NclLL+Hlnko5xw0M1}bu}r=NqRTset3c5`9B
zXzQKw2jpOLX3pheo=TQ~HRV(enS<TDRjtUu9>ZjS3@4sX4N=bXHNn8Lr`X8BaxNKQ
z-L%d$1Ylym{t^K;Fwc6J@+aHK!SrZ=J>A~)(&Z3<RX!!avU{Z~155@8%d3EUy_xxf
zt%$t12bY4=<Yg1bjlucEYNR!GVXlP+dWF4E);6c_I2tQ<9>Z*tSrofhz|N7~`^?1B
z?T6rCYRAji<0=fUQ%lUDqGgNHki)QDa~@+xPoU`HHs&9=36;s?sa^}#I+~)nAQX=7
zH()t!68Z_aMHXtXw%H6#T~iL2p@{{D6O@Z7Po&V4au63Q4Kz1Y<7#{s(tP&g%+*_{
zO}Y--h3gQoZ5AddX*|Dxl?-tojEzAb6;s7~)2F3S7*QwYz3N#wc*{S9-)K&~6)mYx
zu(dS;nPCZh$bkBs8s0DxcO!<^_YQB81J+*AhfJTNyvhF7wQQvM`lFt}x<O%OeO8Se
zvIzfd#0F*Kpvz1?`9r|vB>J&CaN|;n1g-+|px0uN;2TFjm>5M7c?kE3L-e%*)TOnc
zAh{87VT}l)u(Cc&jI3Y^HKl;X1~(z-d?sRo8qko|gVd-t`1_S0#484M>0)F?w4gFY
zOwiCWnYM3apf(klZ#oYVZo3iT701Ck>g0gt3?M(5^3Ss|s3y?zZx*9GUW~7G*YOd4
zV*=X<I5DoAOh;L84ZIJAJ~UtraYyN|WNxnf@O?l<0761S_%`!G1(Z5b3W`hqLHO<8
zr{d@W1I#}XCx=F6vTd1IBS$ZtV3U>fr1j`P1k^bKEV-c*$pPmv_Un<fuN%|nAC}z5
z5I4fe$PT*Ji(z0*c~x^g@!J7M^I38acF4()j?;n45Kokc9O95vv`|tG3Pl?$&`sfH
zM@Kt_p;Sh%?Ih3B-B8PKG+SA3l6x>iQ%ibF9q4P$hlo7b=F2gZ2G+qq-<$)s=Smn|
z;EQ3YsfN(w%W!R-1%GN*_&fquQ`nA-oOTH)17tW(gM*`Mwm{OGUTF&NUEw>RH+>z!
z!|OA^D2HYDy9|tG!#AdtJ{+K;X^aJwgAD}CWT`K5eU6|c<Tk9$Ezy=+f%bACEX-^`
z5dbp0PM|a;3kI5|m}_i?ki9E#+|d#<r`w|?yHxJM*!Udm-q>s#dn|T2jr26YLRTBc
zsxCOTdIgrPzl?73dNZx<vF~^$?@ccQZ06dVl(f%7(6;3W^6<n=2RHI`fU3F?mhXtA
zt79`X$Iiy)eVG)#0=9Gv2fH;`yE_&2sX{(fwhXZRh&H6ekrzx9W4zu5q$L1b>?}B7
zqb6y=*3to4m!n{1Y>AS~{-}xvs$%g_fR%Jfn&iFw{7}LG6V=1d&xcCHe3?k!`Svqm
z_`qlhCeJtsrD?Wc^OD~U)ZOZ6Yo%i`*C*!9{tQ+IOm9y&1eAmIwbPF$>_dAic@ePy
zBI)3xB2q^)?GyD86cjEB`q13Pn(%u`Jvcm18=Y+}5Kzd+;A*X{<RM~5V;$P-DkLFd
ztE5*#M|}-?>dJVS*iT_zTP>-kgag)2@U&JH^YE~(s*s0>{R9S8KyMS}7G1RvvvDd~
z=<?E5iJs~L@?HehixeWVUKoovoWr^ehmjL-g+7xA%eQ;;(9q6d1y(w5MBLd!yjh-=
zwb2Fb;JRh}b(w+wC@T@c#&RY$><mF@Vw=1deM><-QiE=i=g5Qa<wWvm<bCLU&vo(O
z;~d_)T>&qj9IRWi9edYoLt|zYZ}^xwa|vCfsySfnK}!Z$D|xm(3ztwBNv}J680LCb
zSik5f(yxWV>q<FR?Tx~snX~xxMQn@?HrNf5>w#n}pW}(xW5-b%nuERj<6t-M6s#!Z
zS-B$&0pxX-&vHjzU<zWxy5PNS7eNoqFj|U?GiR{dWf=$T#tu(Rrz?0h<znmRI-@#?
zyt3zM<i?2M;Cu$vF>P?&8I6*l5}Z1ojItYvs3dPzN&6oLu*WvVjppYcu!j-rO)sR2
zoRF@h^73JFFy1SKJlvz@U<A`$IT(Yqo76?n4a~vVvtbWv<mezMnZ8X9#>PHmaPi#h
zIc?;45MZWGn+I*nn(15n?tNWLPal$M+a4dVZaP8u^Iro1qa}K1djMeeb9Tr9voTP`
zgsG}S0(K)Y`{e>GIwWVv@`#&BgUcvq<I5ocE6VR5)W}hnQ7#AUev?1MQm)rr+&>7g
zyBj$&61z~4E|52J+z&8Wh*+Iadk<iFku47eSW#Su95A+h?PN46C_KCyu(HsaXAW3&
zbQEHu!|#EH<zUkc=VI}~O?+DhSWBM(H3Za|L<-HiI*?e^hGyDMsA+?m^$LvEw1c_P
zOq|^80Btp0>|V75ogM5dOW`BIb=+A8g%M{^a{CZnd~+$PDWSL0PIX$)*i?(#S!HlN
z?T@8LZ=<ul2@MTZ2uLf!(QA>=v)PUo78Vj<h6ehGzIB<dqz$O4EJjvYInD$|!EVDD
zo`YG~uEbgk0~o8T<Kl+t@ZW5W^2oE#Cty7d^ut#R2g5?Dhz^FHnkuxlbTMU;8Z!OP
z!otu9U6rkvZfeLIIdn{%CG}Z|NFGX4-x5Ay4bY;i&$8X&u(Y&8NMh%p9Bl7=D_ENv
zBg5x3%yhMI%w+*8O9Yr<WrxnZGITJHN6_g{Qi7Sb0jyLfqobe^wpKQ1OfSSNdsjJN
zrsj4yaIp;6LOY>nFdh3gZp3smGc@N5DLkD);V9)#^d62bb%LIzi5#%f8$PIth=YxV
ztt7{?n1%858TUBZK}~5IoQ#yAt2`C;DV?w~Fve~7y)e?!Lv>UxK_x~e<yke!VuFwI
z{|q6_)U4pSU^bNL7;(qX!$4IHMVI{uWD&g|3Lz=)vNp3r4&`1Jde*pbvF)h<2G-q)
z@}+@rF)_fBQ*yCqj;f@d9I$>k8yoQTe#*@Pa_Z%Pos2ERL~Uy*Y1km?@(v`##UcE#
z3q)cuI=Z?!U`H2fqOUF$rMEmFtVyE0tP4H8JrId{(B0jM3(<Lq$Si@~lH*j?g|4nP
zoDR=IazPn%EVoL#NwG!_3kb=>_4PIKWl&lHiYlsLFk=e`Ow(>7&aSqDhUq#ScF}*n
z8#$PU>P^2?Qx)CSee&M)YN{qg5fF831MfYrF;xefPi0E#Gr(A<V1i6XcOE=$RFUV)
zKvRVf4*TK;0cL2q2dQUw!%#yLtywv|k)t%&mpmPLvMONPqLtXZW-|;l&E$<7zUv&&
zOaG%Wqe$+-Sa&Mcf!D*U6gR>;(OMwJ$S*#l{Xlg{AbBnzox-`Y#70b;aR_bMop%89
zzlN&Fc>bg_8xp%Hx*AHho)~Ym8Mn4B$2?PAR7IsA%6%(&H9%|JbhKxSk#hVX_gY82
z8o38!fU)_&PAznVlG#pFh9tmpiWcgqPU)3vDE9G}%y^kVITyio;$kPt2)0G5Bc2Li
z50anz0w_(HLf_BwA@@IA4%Wes!F1e7{oW8!k%J8{_M|fFHP3P_wk_*TFQPKmqrNt$
z3Sj~92)iu-jg3#wLPQ1}8}x?dX6#XvP68+7dOR2FA<xH~rzPtp&%;DgZ#At`h{*aP
zvR?Jw^cr?En%@hf@UVy089eDhskr46hme3W-uS`5Vv|9zF*-8OA3!H9S%}z0IT;HN
zJ88+LEn-v1240NAO;RnvSDPu##V9;vgOBogoT-eBN8e2A3?3F9wz72!51TS1Wlfo4
z)Q}gG<zTFtzM8Ga)3GR2WZ@wnn?8<>PcK9xLC(U%Mk=d`C(tNFtf76+17Hu9qLJe}
z1?;gjOe4p@9PHaPa@?JR-F>6^VRA5e{xu*6d%PRX&v_%qJv}odf}oE=G!{DcN|%yy
zp-3p-=Dqgm^=v7o5RU;S=~3UoK@$q;7z7w=qGy0H=on!3`)<nt6AGxTw^ec@x`(#=
z2uK1<*hkw0n6Qrxh|>TuLFnq2f{q3Ph;6smK}2Fr@iM?-(z6hAmU2e6uZ`-lIm4O>
zGzzB}U~G&;2AH^|5?+z%94--sMS_M>#HXZT@s6XgT75(g*oxT>C@#rEX&G&Q*MJSz
zo1RHkZ_beA6UV9ySw0+KwMo$r4Vb0DdMsPGP7c_PlbOQ;)>hchm&YzuqMkgF46te1
z=FnEvya%v`T=G!NgMAMGv$UEHYb#4RKr&V2q(f``*Z5|lIlvw*k(N);u_G6qiXQS5
zJJ(Tuo#o4Js?h<Ny6L#x5Oh#nE~FfRV99D|htEk*L=@MfzOx$^v)tj}9w-M)RfmpG
zF?iI`Mex~ZLFMgq914dhmq@Ovg|d<o<{b(`dPNOfec~~FlNY}FW)f5;kAao?1T@zZ
zNK(KiQC$s9efX|1g{Q3^#N_>0cp)MWR$5(xsY+9@=Q4%fl@&N2nuJ*!P9Qcrp97X#
zRD#Ba3Yh6@%K@VkkiaVX?g7)9M)9-K)O&i<@13E8W=divP1QrN`w}?l8X)ObFtV>6
zp*JVsz3FQP+-R<+&l?$$O*z|kSZ@fVnA{YLb&R2<W`g?U1T?3`qR{_5lEQNM1P=@_
zHX#IkhuC~N7lq`p)HOCh+vPG$bT`7xa5_vi)RE<Lo=<{4PIEcDRytwR;&n*%K8=j?
z9uUxLds&k`0m>d%u{D?_f9P`DL?w(FGX>#p>(E7EV`D-l4;u>^V5G?FIj~vnkLVa+
z>R8I5Z1%yyQ1j*TV8h5vV=DBuROtO*f~uB<ynM2z9yCqnAm`>m=ouNKBg=<i>c@p-
zir0nRm_jExdg;p~z*H#bV#B*lQBuL_*b-E?w!_GFFD8%tQVy89wiYz>rz7IvT!=fX
zF;$tpz6#R_26Q)L(iA21koU^3uESSfj)B?w^EkC;HcV_5VWo``jI5o|)h>A+ETcry
zqyEwgLx>x)p+e^@8nS4qL|&_k&fzKOZ>>UAO(nh@H5uInfe`W#kpWf=4dp2aic6)7
zw=Nt^^`s%<Qvi&qh2>4sb(xaRyWzr)HS$J|3#(`0!mjmn(a1xDpD!OWKt;(&QeWDN
zxMZ^zocBax)46=;>n_F$Edy+_F~CL#b4v81(Uenw=zu76vfN7w*umrBh)wCkX|H%p
zR9}Q;2U4J;Y{3CLzGM!z&9&fweKAfQYASj#Q&EGh+GJ#$-G{akmSYL{fTYdj#f)`V
zqcnqZAOdW&`)yp@y$h9*vABKaD!uP+gkL4l>Egvan5)|@c$_W8Ue8E;HP#Zgt8T!_
zME83E*xhQVt(2&~_O5-y<zOsK96kqYs3;~Cp|Og>w7YXK@?K9a2P+>o2WzM(kmq2v
zd8tF^U<6Sg8#D2F&A}4A4#L9B3g)v{-zk5H9PH47`LHmx!u&P<@?P~1%E1<H3%YL(
zcI0F#nyE|{B7U!PFtWj*JgyXt95TS#OHvh$9EwJcJC>N7sn8QtUO_q1GxMe2?qGW$
zV5O|-d>|ww)|);hxsms#&&z7(W7VgpHPb#IHY|_dXwHpFm)9>!%t1kXHt(01pWBT#
z%IQk-`_NG>LQZ-cqAs393qcljD{By7F#*XqeX|awi6y*D%XSx93%gL1)sO7dZsa7j
zq9Umr*}<7;AjsD34MKHlJpm_1Tu>zn0&k$Lpp#DgDhXt1<$OS#Wp0V6Ollz5C_l>)
zAUCm(&kx4NsgDe-;Bei(oPs)9CST8d=>SvM)3f^mR-93bgycFoC^8w{)tg><%0!r&
zSipDl48C7y>Nqs8`(3O)%fXreb5jdAF4~1H7YbpZyM*Up`Ucz4Q_+U%_%H<Ra)zm~
zIhrVEW-#&bJ7~!O)7R92vW7DZ7I<Oz{FzYtW;}ehu14665bQZ$O7(y$%C8Szu7II|
z1^q93XiZ%LV|7D5g;AZfFCqghJGvH2w}jCJ0yyqC8?(2BqBbFm17@Q$1tx~{9tb=$
zL#vl_elUeSReP)uv5P#G!?HtIvce5n*UqD}wh!}GpWq(K#CjeU%vpx8BfBN_8DI^-
zo@Gw#i2@wEUXCS;_QPYr3O=x?tH&+0ms2uLKpB|M805ihO-*q<qM4Q^aGAdru8wv%
zyk;>j?c7EoBly_-Y>4bO@=DdToI!Aeo;Zb!<Q^=X?TLir`_Wb`MDA5D31I2<9H7b^
z;MTFz$R^KK8C!&7XS1+*(NZ+#0v5BkQRoQR&3BVD?Gs>$F$%yG_IUQ4<zSrzm54oB
z)G{E%e25&ZyH3)xzK>vh5;+*_Hl@hH6!xs_TLG3DQ!-?EQbg{M<--BS%7$y?D9P=U
z16H2V`A~q>v*mzBj;1^T3RC*zfaM0~BiuKANWc=pniYU4?1|ZZ0qbd`6QSnb-t^V+
zQBa?z3LPCoOjgoCUf^Zu(|UJxI}CNSc_W9mzO<JIc_J%QW9aD`!9Thg1~Z(oV(W3J
z87;vr&+SlC(ZoC}0}3B|VPt56wgG_Y=^Nt=<zTuxMp*71gYgrUvB1Ox)3oehs-cX?
z8=)}J(MM}x4-EB;c(`b!Z-Po%>g$^#Jyig6V_VEv;fJd5a4fa6=YZ|9nNF_}qK0xT
zO>Gk-CG<mmswP&tM#64g5KgaI3LPyAB%V48&1q`L^*RLuZC%tV08`i_+5<h<P`&A$
z)l|_{-7mk<tg2>4i4YKec#X6-y*74TD3H`=IanjW=5;GbX&Q8+Sx099x{GUgBS+k^
zO<)~}+sKPCz}Uc~U9^7YW<8=~o1i+?5e5q{V$S9OY%tP;sh%Fpb#&2B$4@=$POqW&
znN>m_45+C9#8jS_)CK>rPV7BXgx2g9xd&r_G4FLFyqEXfm}Y+h8L48-)YIgEO|tYr
zN3H-C%BrY~PDb9vGi;(n%Hb#%Qvjy0N3h2Z5rqT;>k%*OP0zO3lI2}OQbS=A62r5Q
z7+uWEWxeUyz@ZEzw#`DsZUR!4gR!wX@+0#RADo5cn0h{TeP=n<rPr`WQdl=CHaQ;~
zZ-e!yXCYz_!NfvD{uDEXhP-Dzg^68Mhv#6leqqBZtgu_oX1U>jwG^^0RJ2Zz@p0)X
zL}YU~vk<X`fUC`*Ff@lP=~%pH{fjv^y~3WoeP@jvLu!~DY+xgY;zqLqu$Rdm2-y94
z(@z_&H~lw{*qc5jZV150qp*8ocL6qM?KL@InLgfFy5^!Buq`H<(4$<i<*r5!2G^`j
zAqv10_SEgZfEnp%LPJC6p5F8x_WEc@ip3-)ZQR_w2=fh$kR1_)ylW>ZUh9RXiXO^k
zJwPb5tD{gaA)yQgmb+lS$`?~68Df!+F|<_;Q5743mb6$D-}FXqLOGwVNCsFJg_>+k
zdV>WQFn?zlEVNCaPwU#shPbwEH4a~`LTgSno2QKfwsX2Mv^2E&AUA9P9EWY;2n_Fp
zCe?S^9syIw130<d5gX<$My}r#<ai%PFAFWR#R|X__MO-RJ=jpa>0?iB$2E_w@<xu6
zORRDIfGe7_GLdroHt$WZJk?xMp8#Qv9P9SnfYY|ygBm$jTj*fdq8X@3h(beVHd4dW
z_=F8Iz+z+TaQtF2c3voehUs!>nr`HPEiuu>3NsBjyT_w8F%hYu1st$#mKI37orhvN
z550Y|aPE37W-K}e4f7owFy*nzn5nJ>3zcb@r>};b3rEnLuK?_R=HcOief#z)bRQKL
z(-nOf`_6K(xU+81)zO2F<)S;~50QiIv!4lFZ9U9fe36HTvJmlVXwyA8SaW7ME?g~B
z<Y3>C`T6+`(Tn~O#e3XKd)+@wZ+i+`2KTgQkFh+cm;G=(?5l?8T|Y$6`i22L>j(C#
zf0!Qi)wvMY58acVnWB+H0obs1?AWoPp?MU24*+A&gJtIwO24(i_CUbOWVzG;v3p&)
zS#7*GeQ7~A?_Hmt)4}(p$5-$h%_T{NlKRpRu`I2Wk4@iP+|H*W%8x5X2f;RIZ2Bq@
za;_fb+iB4?C=QE5BY~9^nooeV$|1|7eFaGkxUklV!<HOcPEhqAkuN2H)uhy;DW@9^
z`K%vd3+nR3Frl!NfmfK)&+m=Z=7^DU>Npxx%1{<l#R02|h~-W92hLZbJg$NFMXXKf
zK@|aJrKUl^iIE!8LU4%@eJ!8h5+LDPo&vDpqyX$*lL3|)Uxe@|0znFvOeWIa^g5=}
zvFRs|=VK)LZJx>Z>r5Swrn)<g9Cya1pM|T@E%X5aeFF<PA50oNHoc1vaxNc4U1A!H
z^>ig;)6+gPV=K^ihTJRXQI$~ueGL=&ux%&iSwTxf2d#IHO;2HQ44vFgt`V4PVS&*T
zG+?c7hAESr(L^47*Qr8S>1ji2(tPr2l=tOI?t`&05fg3}Vc)4D6lMX-tW0p;uLW_G
zV=};u$B%)QnhqMtvzh2ypgFabPySGo4h3LCNdefs_Mi~4t5yiBxx3-CXgkt<PLL<+
zg01sD?%A{qZ7^&4d<430lGJB_5nLM_rh`5^BF>#aMph5hrm17mh5!V_w#WgiOUp;Z
zWiM1l#o)+ce{_@!QIHQ9O<#@bGT^db0S=r>z&yLfSU+zu>QeIf4Q4GJD>P(O3<9i`
zyij7I02>b`W0tWImf0^rz&<xLq}5~njzAo{SdPW^j<~pH8CuBGh3?rT0W3Nbnrhmp
zCeL+d(<Wpk^dstwFZ{39VzG?_pK--z&UVzL_F>L^cQmJUNB~Py05-IG@xlB5!UrF`
z50Oa70TYQBaGm(#vxyK9Y~sESY*70z{`-$V1O4ri(WnS82BMhY5(*_y3IznEs0E!p
z-6(7Ak^t7%f_H!U1N8Ma;g_%d0RQ>rj|f^eI#m-o2-eDaf|1}7wG(hX^>}^6PdRiV
z>4XrXHiGVX1MFecCF@O3l9vyYgE5cBdU1T)9E|nwU_Ck5`1FsGgRxP56*<_w_M|)*
zM08~(>k)}C;?2L~%eklU;g3gP#E4&G#1H?9nv7TiM}YtS?T-+OdytWlj5$Zc;Cwa)
zDREI4@yc)EX8Jz<@RL{RL}^BQPY()eo3PhE9oLgfu>7Dm-g?g%KOFG`{Qifp!~XBT
zq<_|c)~+^GG&JCqpMHkvJ1)`x`w2$8_6xl6%W?Shw?DxbfBF%^A|jt(!17XRhAhuX
zEFWAZyN@;mU{%FJxd&rv%xk^_7<s3M0W2?C>b)Mak)tB5_a4aVGy71^fRe(M6<Ugf
zK+4mG04zJITLIX^iUUURJp_2?kAK0{)C&Az^klsM%`Ck3+FNj)rHWtw>RnVs93ucm
zaBudzKmHZneeL+m+rNd{LU)Y&$FHF}`F-+GuSo#w?8H0oeu1xl|07ffyU`WA7CSWm
zgHQkbGuVFmXUzH2kLfB~kCv`>Odj<Wjs(WzjaS~p8*ls=@BQp`Odt6V{ByJg>_)$f
zKfUw&X9rksBb|&j<QWFSLaIwm#8hPs=<1nZl8P~kLj9qsWq|IQE@(`f#v3^_wQMBy
zS%^s9NmW%HA&Kp<)YgRS@l<H5Ya=eBXHX7ydd++|*x91s)(uQkQh}SD6`$%zT~&jR
z0IW8Z-T2l*5doy5p^al#OJSj*1|4++1RvZBEo}>IF*AVAtwsr8>7~$8SA&734qEcX
z{HA#Vo%rJ>sKQiT9lMX`!qL(k332^cx;q|O=Z?cv)t&=3*UShlbd08K`oHx53kj@g
z^#5-JwqoPHOf0pT4x^c_2;T1j<;kiDc3lfqB_%$RuL7_E8X^bFFROk6IamX#Dk!gd
z(Q~k&debkMri!i_q5MYkG<9>J0|-5^LeiUFNfY~hN+tCfU=#vUSPUIq2OPawi@elo
z6y>zR!F}-9^hUM^k$G`HtaP-{n3>NTIVvJ<qOO=AucwO=yAaZGDslw;CbW|2K6nQ=
z!@<ZHni{LwuzJ{LW_rhirI+ysE?e?}%2FVo0AF_?4SUZN<Fs!*vcfC*1nH~XlW@_$
z6?Mslau3D;V=abBi4<;Th%tM82p`gI+5|@q*p`EZs7vgG##j>+UActNof}ZkJluex
zvlW1mh5$^_$ng*%BI`-d=KmV5H+^$y2eK1Ok)2Y_%X_Il3lTe5>mr4Q?6oZKVxB20
zt`u3Zr34wPLqO0{He?$go1UPRg@~+IJqr<gXxYQMRS`g}F3-UTB9@1xhZQ3&v;<|D
z!a*S-YY<_B&$2P<*<&pYvK)-g+wJy?;AFQE?esk{z!;QlOb!+zw$eHa5!q}jEJSQ%
zz3WpcZ%bv5uYk`B_A)kdoH%g;|NQ5BPe>G&4b*$X=pRh)eoOrw|9tmx^|wdU-zCeZ
z-pDbehH2y&n1d;9G(SIpDLmLy@L>1tO|NS|Wcj1^rmss)8Wyl)0kv|#Y?fXg1~AE}
zQb&F6+-QCfU=4JxwvrfJJLfGJ5->J}Q3IPXWdLCQTedtDU>kQQq9%nxQz>9$Cr-mO
z6{C9qt4aW><HZWVzK?*}P(EX1Y>v*mdea|rGDb~oC?-wT!1e9(;B0JylDK#j_@AX5
zsSBDa`Y0d}czp`xswpf?%czHuwHu6<dSTLdJ<QiOhOVkUojgHkNsmM6Z6B0pHp+X`
zvw54@^hW1`>XDWUsB3M4p^GmTY`ulW+B%qRyA{Uz=CGOVj#>&U8DPh6G-2QAG+1lu
zLurhL9I!oBhRF6hf}+HFw4~<qG3)E7KI^g3S}4Y<=~h^1YJ#kr$;kCSjdnVZWq`3K
zo+~N$I_KMtv}7?(FJ6S0gC1y3?LcjG20H0`ZK3__0nM0;e#nbxL~|yEj0BsBx(fj$
z0ZdiH1e3>W<Hm;7Xl7vEN<<5Vnw81)zbMa34{FBZ4RHv$4Sc1u3R?7C*(gnZZUE!)
z^+0f>>gn!AXJZw_!d_`vH_A(jDd#QZ+iYe^Hj7JNa}7-Ot>l2!6&Inpx(0m&LsexJ
zN(=KK>}*7RV;!mrv-zwlt!23ochsZ4p$1j?8MNL=7vXGJSZqLL0o5nKOw23*aVNdM
zddkg{IbikqDG<|fFUMp+)L6o2ToIG%%M0m3n~bt-Hp9wu;=!89<H*)!ia5Lh!N>Q?
z8#xZmH$%wD{b)*0L0(KOG?jIsq+%_pFKtD1Jrssn>--1xre9*Li32Mg=?Wf6c}yzu
z6AIA9axdn=2!e>nat>JF?NUrsTLd)|S6DAThf$w>g^rRgbdv{U^N7jDMO^J3301Q-
zn5JwAE#;+hz;;@iqbwu@Sz(!I&uvF`ShfT(`cBd!Dq*E*0C#&U1bTWR$Lqu(55@p%
zB4Ez?wIcXN8ODzti^EQ{aB=%K)W)RoIm6igDE~?%2WKGtW&s+hj7`3$X1E!p1Q!F$
z<9Hr!xOpP$tT$pWgrYvK0jUASs3*Xx$%~yinG3fg6}WJ|1Yb;^j|Hp3;ix|KkpN>e
zN-`@dqz@+OMsax^3fVeYv2^L5S&p98da#-zk)-}`HW09^q?^c0rITE`Ez`-^3aBY7
zp|G}vZ$nI1MRY=S+B9stngS~`bJ%acj;fAs80uNd0b8VDOmCnbm0^bvbIgUjS35d;
z`{=dp^ja0HJ`)aMe+PXIf(Na<Y~`_A5cIXe+<b%FgP9l^(t8W1lPsU|{~E0Kj-=$d
z1}3^oIABUDDo|I`Ku+LcXey1vb`w4Hl|?*1fIY5aPP#%xc^Z@r9qyDrL=Lvo#tbS`
zr@?&w*>9bLDbsP77)Y`Zk(Db=)w*vEHd|MPziy*@@?+;<+qd81UhHY+VEbk&(O-5#
zl2wPJH_s2h`qi&cE+nrw>Py5oiIGVR{NLNZ!e9TT3Uue<qj$fN)E~kgCPciPT#bzj
ztx?|8!M7o%t0{RbZ8a4FsE^OIvT)TA_<5|uLPr-lU@p^i;kdyARWWCI*<=-M9ws_$
z^MStRG_c9h*UmPCkiy2<o4jDi%DS83>S6_#g?nLUx|9PpZ@NCFPE{o@RSO-}$;4+Z
z<{4@6kTD=J3$fmN5t5jOuv43H`OID%oNI@^@|YJNup#vjfGHX|9v`s$8aBrk@LPfk
z4e@-P0VY}g4PKco`1RZW!=~w~Xzm9xOPcw<;p|azFu95Q2JgEo2a{GJi4-{)ll;l#
z0b(QgmgaXu&wLT8OZs_l`m(|vzOOL7f!}DZ%91qCGu7tRqb9eG_oA;V71Ha)s4o-o
z29(Oeeq;vvaJcf4YX<?ApHRt%&aTU8MjM5JI`)UqRw6(RfmD{=hw|(m)MmA!EUAXW
zwc}Va8nZjmOnFs)Tr29OfHmgPd&p=ap!x|gx{62Cp)9?hpp(oUR?fmff~}k&$_kT=
zO)mqiJh>k^v6NR3SaqoaRHg}#Pup3+Rj47r$`kugn?j!}v70w)6ok~HHc1Qzvt{s@
zw-6aOt2kiGt&F6(8ITcBiAsX2IJA-WiQ%#?3RSTp6h?^%JTX!OTTm3zf&|~n=f07H
z^{N=ET&B9p3R*sVBS%jQL39^jJ<WB4022@>cL1wFWq$gA887bu)?AqJd;=C2k_!Ku
z>G!lGnvPTFkZGIFm-eRr21-gQxVB{$?I#eFC!$Sye~jf|trRsVD=EX&b}hCJ9GhN$
z3wkQr`LJ!b_Aa4gD5F{0$T4ti`q@@Cn5wyik4=AO(@KmR^$on%uR!4C8`w&@4TDcM
zHa&YE$}0NMoa!R?VAh6aXvu0qZDIzRayp=`Z-Wy)b#S+_hTW!MD$l~{)h=*#^@Y+D
zWvt#4EeCAN!EDT26Ts&ObDcdMd-lbkfpRQ1cD?7BDujoL@eSpMM=mt*`)O0@^;)`X
zaPWK`9k)r|$g#rO5VyV3$m_9ILlF$-o<SwSwm@H#12$&tM0)KsWcwvTM@1Pi``jsf
z0xF|La=<)24@-Zcr(**F6A8*FXA{Y{WjYd74t*^(Tu)&j^&sDWFVI6j2>PI*q6<}Z
zb4>br6rGGoP*c~D14abFKy50Y%GO+WDl}A8a3iq@V=2eoI@<zsmh7ePVjtzPGck_J
zwmVp2w(|}ooZEug3mni>8p#1;Hz!3s&2V)0g`J@m=5ITOoBNkRUB?t#4D}#tF2J;D
zst~uaiTEgl?yRA3Qw5zZmCuI<8%kX@eK44@0d|fXkb3D5+ACUNGG`m_#W6+Q7?vh>
z@ZG*bQlB+)P~N+Ih7lU80Jkf}u(REaZPRDdcT<7I>(3BK?R>I`iOQOTJeU?G&zFK5
zp{YCtHr5NU)I<wg=Fo|~d=Z*UL181o%Ni@__pGL+)|9EZw9^%l5iOW*yhRRJb50lb
z91JJVl8dHXAtp~z$F{vbh>z+*{;haycMnC9cL1DMUxb0G5+6c92AKQt0xaATf|axE
z5Paku*6#>~)lwf!m^c+%_opE;Oa$#&2XMpf5JCc5vE0HOMTu;T`-6zsyAuw&Y8<fb
zPO~w2q7teIE)&(Ms7?@Lhm#Z1!UR~qEdg0q60mAR5TZ_8!G6~ZNH}=n9>DJQVE+F8
ze3_Y<iKZqBqX>Y<wf6RQh^37rG8+gOItzGiCEJ#XHFBV@2@_46C1nK6nx(towrLfA
zn%zimI=nYdhoh1<KjuKd(BFXzi52v|dm#|^K~>urGk0EtXDFSl-E~mbGUF|PHrp=4
zJt&96VQjhxtr?f)9*hG<;h}+!1tRlG;l0cRy0dpfP#VSo^I2t1@4FT4Y2N6pXYZ9>
z(^`Rq95xBxa|+nQNY<NP{HSBo)92@7(-W-UHV5mb?~{%3F;ou5yv_Y`FxD{AF73(j
zcsUpy?<qHO47AeHQY=`ofUi%UJQ;uf^Ph3_=uy6XKl|-(e=7&=VM0U@9L(yg%1~Qb
zhPHOr@<-)DNjbOvejXxHA?hkhP+MM%wyrk5OBN#1!FY&BFNT=HM~W3GJfxGSkL{!X
zMY$QeB)J$UgcPy~(|L$UCycP2=U`$sLneicENtXmhI*TMh{y)vWFaE!VJ{02#q4pF
z7a6c2B?YXttY;8lb@|N?Y~*O6oJ|fG<!!?OR-M)&2dptqNcmGOnkWam8?e&2#+R;<
z<6*6n@}@(F4&lc?{xRQv=bd+;t*tF@(r3m%J9+ZtJwQFO6gQghH5p*6H+^~a5WVSB
z5@BmMkG!}DlcuPkAn+nQuge}$0URu?5TDfp2XkXA-5CHS6)UJ}sAG!OER6qVA}V8U
zqP?UZN|Pz}o;nqKm)N4Syhk$eb#VjbB2)PNttpcx@xFx&FqN;rLRWDMl~D+nUWi1m
z6PRVBk4^3o_)^^(nkFs?-?xdNBhQmn&H-!7>p)wv2u4dT!^zYbGn`N0md8G*sF`5T
zbW1en_F~Fp6+Ugz<cX7c|3d>cH56q?ZZyBFfDLCX#AKfD_rL!=2h732VE`<$8_9!p
zHlcEe@?P}wXjS+`0b`v`#diV5P7oF%4g~B%RHhuT4?iDG=bzfWfHhU1i^9)m3K(n1
zD5CskAY4py)XnI?4aoL6OdpOuH-&UP6w*od1C6w9V6p<YvuR&>FAPm~L6hR^>)RX%
zjuceI26J!bcj6>@mwJ5m*+}?rpNCfR;vE(3<jE+kBhQ|4GYNTg(lfwr?OqB`J2Sqo
zJ*Nb-G&GQqN&hRi2Wn1dvDMTRbB#^NdjaJHnGCSTd@)R?8Q{Es6Rxgt!c_fjXiBf(
zfL&WVpU-$%6P<$6<Q~)()BmFP>~*8{dk0ue4gJ`6nLI=k^ikey32W;`cY!3y!8~pk
zAS+kW$iW|JAd>(_(H%vbi|Dt?zP1N*_xNIsr3U6(*kGCEba-5kfs?i_##2r_U*8xj
zjE&`hO`bFrY2F*LMso_n_s^vhjE*a!6RS0k&bLambrP7OZj{u~m6-N*)|VrX&Pj?L
z;TxYtCmwk=0&M&=9T;n=qN^Z~qR&Q(UL~QUHya|501J*ygszS`wx0`vk(L^Cl_ntV
z<dUZY*l_Y#v>aJCy!pDA0AtIZ>Ryy&){~mhz%DFQ#(LVbfo=p8O0(YcEWe`9L~zlP
z!b4Frh1l%E#J)EQ4~4YeN<hm(L;=+=N~uR-ay@O+$xq=S?@do2u<(%8ZKh=pgO0xE
zw&G5-=G1biWcR^X9>$vD**F}HxnkZ--%9IjCKeVVcF>ZAh^&`=y);B@%)Hac@qO}O
zciW&Gthe>f`T#M&&IQIp!)7_(CU=8|+EOWC6z$YjV}_MJ{M=kH&1fOir)ba#LFY+x
zC)6!h@cx-PCUZC#h4svHNdTKVejK*V(Z>o69TWxaMOlI`<zA%_c9v5fSAbsfc*)s0
z$Sh%9tZGqNl8c(gMr7q@bHJJ?CuD$GZ#s#Z^qUaZrl7tk3F7WL6y;|iC9jwRHfOy%
zR1N22<FPCFeB?NoYU!fn>c(da*kkJ<8aWg<nx9j^9w1GniI_wo{qCDNgZDjTh^VJL
zk=L0tk&Z*Mv2(sBM11LTFsA$Urk9B|*xU&b?;|N-RdJz%01Mo;<go!`LucO$m>A{s
zc`L{($pEt(FgE?Q&70+bRYpV(30MPpx(E+XIbiiE4VXA#B2oyDy8(05SNYxpHmsgt
z4))RkHh1PMOt-PWr#JoX=|(6Gxq+s%ID(-YtW{M+;hkhZ;2+xp3m0#=o=L(yZGB8q
zGKbFODezurgT|x?o`aQ!_(0SkMr4`*2bRr3?zPiAL==>_@MQ}Nr<-U=&@s4Nt&Na(
z-5Zm~>W~|^N8*+9SZZ#BEWeAWiVQ<-P8Xljh)r*lK_NK1Va)&wrjvM@@-jYjwhS;Y
z=ebyKWkm0#4AoJw(6ictb5|;$uV#kv#v5U+t%?Qa)&v?IhjKC*U^6W3ks2q$lI=0D
zR#(O3$u<bxyAzAdbP?&klb~rqeQXI@={2kaa8()*6#Q}k#$)Y);7BFt?LlvQqr5jg
z@9fL(ml0I7-PPHN`WpISg#D~do&&~u&4ZRA*6iL-+XM<LZ>TPp1J+zqj_%fGx*(U*
z@te?8S%%)a3<wCWy3zvvn#S^c^wy@MueBC+6e2RX8cMQpIW~)a|8fqO{k|LY11567
zYKt;CTn$C(w3IY*^wyBaZKnU*P)O-Y85#@I=|Z3P^gLJ-c^NNh466VD|MW>jK~&kg
zOukzdz<19kbmZotI<FqRlwY-0$yytM-N$3G>QE}CnXHDIvi^{b9A#0VsK_ZtaCjBI
z{9+_(;-gWToC`r&6MaBBLCGtYX0@P@@+AhC&)NmJb;u1m>T6)BHWlYKyWrHa+3<2*
zi@KytdTlN5UEfk5Mh1bAn$*bw^S@P#F_UKx0_^mBJDgwcgou-82+mkUd+dPKf+J9x
zHkVJpH^*29E3M4PqtXA)6i5N9M{YzTbY>rehSfGGP1J`0CE}Z=n{vR?&zwbWP%a8C
zT|%mF4DS}jx=aNI30?xgdJ!9X1<?_)((OB9IhfMq$*63Rb@nB|L_&IXKT0}<XivR@
z2@@uusfWtMthanWdg*v}?m-w&q2S~x)1a+98R<DWFt@Uo17>33g5J__tklrL8ZB)q
zqh!CY9PK&R`0>h{C_!g8TRTeVJiNinO6%z4Ypdaa$vl{`%ML_dJ&c0O>$wMOtj?zk
zcR7|E_9wt<Fmd7pOi?$$(N#|Pa@0h+c<Vj;9IPlN7G_S{2bJaddtv<e@fbB;pHDk9
zaGzX{k%O^gGO-)R-zo>Ab5nM#Mh4mga<Dq`g8r@^iX7}NpzhX%#40SCZG`+9Nh1jF
zO)mv(i=_^g^<vEEu@Vm^1+1s97mJPr!|%X4glCt*V~rzjCuZZD3CeQ7^o?!ddejG-
z%`7SZXv9=?3y8a$kXB9?%+cRKL>^3I>IA+osi;y?MjmY1#BsQmkd3(>*EwJl3B0Kk
znTRNC96fdthf8(RHxwFGaSyg{`3w{n6=I&AD%ROqV79p>%CEaVTfiP$j{(?&a<GR6
zOwq{k$o42XnA{%FoBlyL7{!+)24nZjpMx<~lIIu%35newYmtV8<+-i2>_tn(fXUJ;
z`+45hQQ60P+Se5KVT*||+A0LRnZBy956$HiI_0*bx>&&Pf0bvq5nKY4XEYONeP}Ea
z$^k3OXrUz=O^RMefR&`R-2sfkz>?HfH0Ly-p`aUexpa(_W`d0B7xbZtV5`iea3!e~
z2GizIIen%KA#bv;NEgEGR1ut3_@OAVhXbbPas>cLLASnbnJuUz!1AJ-Ibem+O#~Q_
zN1<m;64j&ix>N#(04t27FgB*=r39?6uMa)l9S{&8kFDM=sX8e&qhoQkL(t9CCJ}ip
ziCQ4&WNIcgLD0d}C=o#=S6e-)P9n;`<Z7vrsu}`H!UfG$5;avyRe}D-a)}zsq$)*!
zJyVH9b;VK@5ln?r6`+qRUm}7_qFnS5V2d5?kd;lj%n){8z;646!~06)JuQjmTGm8w
z3zE;fW8AoLXrfSf;Em>H%AfQM9kFMz3%>Y93;KrJu*<?6yDZINr=-E}gBcmy!@$rA
zJ*7?j=CX;NE}Ank$*W23m+^VRq=2bu=tEz10{yS?h}yqma4TYQ7fki_(OKNfd)2oQ
zi0s~0TM0nl9ki5}VgH3vn5gT+Sk(pNz8r;d<0l|s*Cwprc9jp?=DXHK?!l&6ZNjw^
zJ}A6$mctcK5Y*Aqa>aEH*tqfIFky;1POaI5uSbo>bTxI#yDq+zfXR$qou3!|;upUd
zviw<!!IhasC(;o1SRrC>T{mVfSjTS=kNSEN_h_5W=SuejM>nrT3+=O1nT&<TR+v7+
z1L-~|ad7r*bXE63*>C}DY@MN}YlJyV4^xPhf)(pM(UO_V0qdgUIeR3^0aKdr4O&aO
zplq}dtpv>&iq&O+)g)!ZdAU1*CC0U|PVB!}$|rtcfF0Pl3T*18bu-Q2IDIyD&$mKl
zOde)9?M3$WP*}{`j<A@1%rIXHeV0odunBa*7&p;?*6FiRTwj+ihWey2e3q4b0&L%6
zXM_Z`W09dQ#q9Q&qi>8tpQ|r5V9%3P<R_xHcR)wt=iD9(Fa{JGPkvAtc`ep$O4hSu
zNZpl#_0uti%fVPL4c4n(KpH9s>m`txzHJW1JeVQ}doe66EsgT73jF-%KbMv~|Mr9$
zIV4_3wp~`zKVY9kTUTy>j7AO$^T?y+W%dr+$Psuo8`0j094`0OTX25;j=KP(x>CsQ
z047H2rRy9p23J#d9~@>bKuxx^lkWh)e73kL0DDgCkMI1B1J+(gSH%~^?h9CTej75f
z+wXxT`uH|%o@;~NiYA0nsMT6nj-2dnzK=C(obZmt%*CFVz0MaS$EjiRBokQcS>V>5
z<yc{*BZtdeQxC@4wzzdY8nu*jZFcuXa&k3+Mqp8hdH7fme-Ly3i7*7mb;DwrpB%7t
zyRX7wX9QHu*FtNW9dsv-g@dsfc3B(a=!R9Oj0mQ>Kx0}7(i6II^+Gga<NI;-d<0Ic
zSWKW%j+fWV0c*+bL2-O5mhXwj*s*$;Fi{8Vtn}b)tO*Z0Tht_!!vE||eoySinFu~!
z{f2G6xE0!`0PJa6UmXXGDIg#~TKIh113g&r5WVTw>+7L4D+A@hSJB@rMrSjHbM<%X
z<&q~VEE7UqdnU9UPvE$-EvD;R!bx2V%{c{fz-kJ6ac=bt^fl0HSO?u&5iZ`yMo%4i
z90IJXiap2&#8Mt~a`Ak05_l3X2KGE2rkd}E&fIe_)>;We4Pz`YHG`{}Av*F~Q5%<t
z&N2~y4IeU_JmS@WdfqAfv#-XJ_X4UZKa&B*CVDVZF~QQEvDiOnIy5I)q9QDg0~U8^
zCt7KLb#N#;3&p6&r3*khaN=^K0<foKPEJk`(McxLs4qX0?s>lLu|mZCj+U5hX~x%C
zLkC-yM}=elTxU4WUC+x{p2o_J)&}q;-=^@84Iwb!(V2^NYhs|WRz(&bvcX1Kh}cF@
z$Qn49SU#q&s*b9-6wI6Bj5)Jc@G<En-i($kWGrO)7^#5PNi0NUP4X;E<m+^9vha{S
z`^9?JSA;~!Lqw*AEP{>aVA7uSq&iw>V&Neh|B!`;b!p_;rQsnP^hN>L)3x{Bdr!Ld
zV%QVP!5&hNoP$ZExY4WtOlJT1$3LWNFNQr3u-1Wq3{aQUbM-dTI%!~t*i9jy)%u&<
zld&7lTKcnjc~2efBeDBxZRE8&X_-%XkioKR1R1@aK<gp^Ib>3}x)_KA9s^AFOqdL?
z76u)`rK`3Kj`{{@rR}VMWTc;QM?2MH4IC24=zp=}k!NFoHM4LupS)**P!3o#)wz5;
z2s73M5?u5;@@NdMMq1`wJk0@X%3`yr(D5=QUW`p|qyX&c+Dir4<gs63^yshAbysit
zg=z*6RMwz4$Qv#TmZOdGq24+vU=#wf&cBwMZX-Lp72izJhk?ml-13iy$I?0Qb=`nf
zYqr3_Y6S`@m+}g0g6RrBXqwN%3|%GYt7ynQSk|S(D9aPVWzlj>nd*eCXA2SF9V!Pb
zH?<9ury5fZwh9YO%wVahj-w7Uk$!GJA8o3Q4IMz?U@QHf4hlOLJ1v9p(yLgz%@>!K
z&f^~JYEZizu+d+CjgyyZpf>XeszO3xq@<6woPOkcpFyFY9~R76j_MpB@=_u~BM3lR
zU$-Ys0oYTtm(GI?^*mT{un)|&H3+I60&EEztOvdkb@Kg&R!*3{DF~V-_W0~e73ir?
zg}t^Kri>lU0qkMkj({wu-0ECtBb3H#!E)LZsB1bwOG8HvSgzkWEShbPX<F7ec%=k-
z${H}Wcb5ZZU@;e8j8lXDlu6iPVFVLxO&p$WjkL4-vCwWd+6o0&=(vOfwsKc6j4bCP
zCawoIGhMKL*=hnzj3NpP8E6c!g$_$#GGjls%rJuT1T}<txWi0C6}eug$ZH9(i1s&=
z7hCAC6juWKQJV>@*`4}Q1IEVbc%H;^u%XJIrS4~sm4kKGiV+?&cz))(%o6yV55VQ~
zA%n^X=^=BlOQ-2LX9Cb54HF0EU`_e$xO6H27f<+q>l~~mwNa6S-N)X1^G*88PN2sX
z>s8OhI`B$6@pARiZl+#|ggvBgi3D9zby8KP4vG5OB@)tlZyTvq5-PFg<ep}Ux|^hG
z1m!Ixy7IFDWBAw=bVX;qA=u!ZOzcX}RZXD|6Xh&StYa(}>#N6F+nC4`G&8Xrh15jh
z5f{4;RE)$RANou~+jrK;(Jc!ZNuAPs?LmOCk)*y&BL^EYn~4F|M#~ne_b`ndtmCg7
zF!D-Gv^^AHe6FzX5nz)iO&r`a{*g7HC;bC^)3-{*pJsm8Cz@GL`Umu;Z)TG9r2p=E
z)92(qMrU89q2_4rsukg8NDd#~dcmR%baF)ET4cR^zx(o4u-OoVjKCnIXLVzek}5hX
zyRl{84TKyygzFIva9Og21Lo|sm;<()Le29bjkvID2U@87>a}D(VlM-%CZ!NJgKM#R
zA%%Mcn&+yGw7dh@h9#>BJiyRmG1T;C!pl1eJKQ5-qG^nyCz9Z^Z9f__8*p`-D{|At
znCGyZ!!^%-33fQlLQ763;!mFBfK^4rq9GgDakKy-$GlKVKxO-<AR(dyR%#lkC*WLN
z{ZX9?%(q{T+T>2Gc3g~V1z<zy`vX{R-eWwj!sc48ArC79M<zoZ8#-_^5>M~IrL))3
zN*-9=o1T_z;=Jhu*yJ%2pfp(r1}2U;u-G21>sH{5iv@1D&V~2s>*T5Xux#lTG*JBx
zg6w=~D=weA0lzD8Samd0?!mGG!=P(ugG(o_BQCy`-#li$<|STC4CCo8*nTpHk4?W|
zS2PyxiG`N^37BimMq@?=c37CBF};HFrzVsH_~88EYbYVmR40wb)LBQ!s}ab#lKWr`
zFgB{M?V2DI5oj)y+g-TUil}{CIADh3RdLqyI;x`zvC4S|np0a*%jRfKhXSyBqyX%(
zLd2%>ek4X^@bwEP{rNI7u?4*iVy>90fw&!3jd1S(B>9D)I64Wfg*B+iYeCkn2=ZLO
zg|mS?<h|k*g=+FjKBxSUoz;UB|4=>zTU2Z_Iw_oFYAt9*YH}BRPWqySLd1v*H_<^M
zWjhnS_UvIlTn{XV&rx3l5V#>Bb@1~kz>Ra^h>vQcun{Ou@1<~2jQms~P9N~&9_-A4
zt2n>P1x*?C$nlTkfYl^5;Os#^-Xx!YE0a%rUY*d4$_(Jfv0J=Xy{}geYSRG!ONFRU
z?IjP(n(f8U1z@7?Vu(c@_`%Qqf=}Oh59Q=)|L?t#RMvu5U;P2%_SxfdZVz62?KMe#
zG0TaDw#Nkwf<9Q7nQ{#TjOAK=eZBVpwkIG-4p@6}23?>FF?Y%C2LdK;&V!iptKJUw
z;H3mGdlP*QSV34AT{xpSVB$tLQ)UT7?d;jGJAlPUvw6avL%^8Wc!z_^Xq(*|lieR1
zQV+<%?!M8?dUP-im4mT~A6Rb=2HfK|a>#Np)|x2K!Cv4-j-tRl_*{QI)*64zx4-)N
z|M0;tKj-Tg*BYR;NBZQkkgjY}n>gMQg>9?>;$C}v!1|$XWClx%d6@R&*RV)`6dL1B
zV&D3OXe*1r_I>+M(@796*@T_fQlR4&fVckkUyOL=w-_<vM^O6Hk8$C~ZGy55d-v@o
zUfc1p>I^s^4aR%3J@KOvZ{Up)Z=$&(m4FPz$)g^;aU(pZ0={V_sBLM)&)-$Sh}VCL
zA5z`=GP)Xe7s7GbTAaO|jvMLuc=P{^@E0W$jCl30_{V5_`oDk0>u>zw`2lR85)zx`
z>u$S)uxGP}e7kudh{FJu9~LVItg}*xWiG4HG@zkF23XXI<M(akcwE3<lvczkQ`iia
zPtU#$U@;ZV=x%R@`cGd$OX_*}tkr}_)JcFv@}}*hvBl^SitwAS=0MLq5bta6A{btw
z6a5!>WyA<H<%dwNL04C@hPHMDW>;g@Ja_zEeG^_MXhw{9n|2U5Ag?BF!<5MrP;+|^
zju4Qq{`l|s?Wm;~@#g<gy|*MCM+vZ=?q*D0dJN~IbMVvO8R4@<`!LSsFzjvY(AQLr
zKm26G(*>-ttQWb3eRlwn%ER6g4n{igJa!G&Vq4&_>WF-wvAG+}bS&U(q6Z5VCHP&-
z!oDMZxD?)isX8;DX0;0@8a6Odvx1?@MBLcBjv%8PtfrUu*yyhAM?+yR94UuW8LNVE
z<8|RNe>xUg=-|>yJGACEQZD9$&I%E{PfB`#EM0RHK~WtqJzz2qW^8QCm*2I0n;eYX
zB#AtuNI=_?FcJM-=r6fN<vlz^WZNu61QTm|7f^oIL-`oxU~HR(h-`Kh79z44Ral6~
zrjZ5ZXXs(Gt4MM%^i<+Eqb%qoqEL~-MBW@v`@|GBvPJ<}4#sja79R54q@@Dl7Aj}q
zB87-T3K@ls&mcq`YHa$ZG69k<9YtTO7)P(<W7pM6`921ig`O4VX#xc8TZQg6F?w3W
zICwD|J~6G()w6@$mSDu4KMfsiBOG<I;a;qYJ~#7V46trGj-j?8=Ix4v&pJows+*!Y
zvw#DZ<8u@}<OLg3)6hrXWoa?JKYEXceJZ~<fH7k;pJZiaNw>ZmQ#5is1;B<AySK&e
z-LZ9cKX292^(4tK0+Rb)w3Oy$vio2i1O_W(jU4S19<nKAS?<=7nK38_Yp4B^@Q|RB
zhKOva09ju|SqmcT4#oN+4hj>$Cx8vK+}vF0+LN_E{NWF<oo@XEWOc8snJfp$LLw`f
z%!iQ~Y%FCm9V`o(Ozy~>$#{T_?v)vn;axI-jp-dt=hDARdYDd;nhmXgr#aX|YnU8t
zxJHh<bFhJp9N)(r?0$_LSFT)vrKP2G>&ckHgFOWg);16jsk-V&<av7P#ptE*Z{WD}
zY@fX6hE%Lq2Om;^;Nq=}6ashEvU2vE7(qp#F^|?ob@}u}<iXkqvJNU^fbm&W2ryPA
z1B@N3gO$;KHgsEY0oCEXH^{ruvW@C6xH2+nN&DCgD{N+!{rkM3JxP<p)siRXa5dAC
z^+jyVqR^A-Ft{4nG_nL&L#Cux{qqjkKx2ce-aQ@c<Cp@l?-;OgqdvvRkzd@?oBoiK
zHe!x##>TbVA?&2ww4s{=RL8<S%0sIOBJ&MF^7>kOtB`fs1J>$l*t%{rN^V`|VPPNT
zs{I5X8;70^)pq-44s@m}^XZOy=@@LPBCGX5xE<dIZM8L+wfGpzXC;8qvZq48X0*Zj
zW7%+`(7{Me1sj)dK*qWK=&T@6bDKD1CR!_{9!!jpUw(nHn$Fm2Wy(jN$~x;w-VUJe
zlTT~3e(6@M+>?Z|)DBFra>pvS6j-aNy-<M3?03KWopkN-Y!F~#)>ttR9@dc2PCx$O
zvOyB`qEA4t`wjuyzkcOCfF0bpVh~_-<))KN0vOx>#mJF3aPj6nfVHKZeY$`#4b_`|
zzr8j(N^7uw#VY<hSbBi~8&_}OfVC4~we*=xH{6uhpZbkDl&4xD`Metz*qEaz$P0~W
zspw*TFsUvZW}MB7wr0g<=qhW$T;G_Fi#X3^6Ed><5t-BnjcKc4VC{mrE3b0En5PSk
zYQfT_1Z+NeF#3FFw{6B86C<RZc0*f<h&&vHj|7<Y${Q#nxENqd7H@{Bh6*afV&Gyo
z6HPf?ShIK~+L)IkuQhw_I;0U4PV+b88;!Nt?3oQS6_pnfFqysb$}5lM(PV%L>as9-
ziW(}~$r}v-hy%tt?vjaxeY|Y4iV<S{{iviLvDNJe&aQ#u?m!qWIfPMTbznZt5Hn3I
zQ4w_x%ciNKC@zq{-crvTIX<q4JH7-Rc|j1?#1f!vyn9J2BAc%{CZ_`HE<|F{A%D!<
zc@gGHs`PuCVZNye>Ju-aC}1bV6;YUH#^wt!K||7IWL%(gv><p8V4K&jfb*tf(3z}(
z*yGC)uwe#-6*1^Yy8uyD0>l(z^>xsRNmu>Y^jsXd90aw6d%qjN9$Vz~P9DC%b=5mn
zQuYLLFt0=BaNOepqN17~DhG=RZTw#3U=L#!78cUAhqHkm?E1AJ`MOLTFi|)9$xHPK
zguKk%-4njM=cBW~4+#XAPjnvEo{qzzup$^+t;3?JI<Qurf<!M@oO9cQ9RL03@9n}Q
zt=ZTxQyUqVH={D{5(L$8=<lefW8MKQI3*vRL8-W&Rs_o>?$Dm1g_+v=n5V6btZVM5
zjy!~}l1Mn{>S3XtGIDS1M@isr)F$~10<6Ee3=564V5+PFpDp%?cAJNWR6lg2UVxw~
z9{uFKM4ct*Zz#m|s1y{J7D3r@$8!eQP<jG@Jxn798!r3qMh-UqVN<^3iDm{Cn;893
z0b}EF3<Rt`o$@r+P3i>!OlE8}=7;fU51oSv`tbSZUvLc$86Q0dYsm@4cr|l*h!}rz
z89x8w3w)+z1OdAz_Odl{4Aq-H<oGFsC%0qc=7Y$*c@<d&9lZIyiR5?06RAPr(noD1
z^$&T5AR@jAtQY>lGtsC{N`~vsGuXUpJ5FxdDVdv@Jo46+o6wk9hUmC9KKc3X4X$V>
z*pfmsQA<$WJboID0{~k^`BK5H5O|!<z?xONIbbW7ZRgV$?Onfv4}KF9l!J;aF(#>5
z;@~zvH01Qa^I$liqge)6>cuOFiR{KEmyM{;0;=ddPD|*;*^`+_xo{1u7Vn{YtV4hp
zDTzP@Evr+2%3Q#E@qE-0bo=*)qAD3!<-8AdNv#B%5StcmKsABpvCfT_VqCwNkF1FP
zXAYRm7A#mGU6a^_3m2qo5>qsCe8+&X#)c}&k7S_8bih#`Uh8ad?7$gxw}{A<-f85J
z<zSYZZprIgIGjVt?MqNs)5KBFvnaWB361G#gL1HLdabeYc*OenL(ggjeGnmsOJ|Wc
zqLcfeqp=RIE=%BXCW8Z3oshsGOFg{@VeTt&*zF8?ss`@Ca_BrfO4}E_a}f~M2`wcT
zXv{jo$EM%EWG>dupEC%smOLTlgw=eG=Iuv{FvrRY6DC^Y;I4DHwS5JeGWt;yoy5JD
z+MHuj4@RGtzSF?18=*1A4)x^SjylXDut4iws88v|fo*4S^J*QYYS_SW^-a1E)I#%X
ztLFwVnf>TTKjITTFdGQjK)?<kIx_&A!RqfJXr${xHqk@BWHLS$`Z16gT%iZ&bGZ81
zHUZY(NiY#y{Vep$uaN^LB(dHc0s;&Ko{(V6y}E_N)lXnC!1`M1(42mm1J>Uvfvdl@
z4!zxt5J&;5X>P^!Ep{BReij-MV7>KalwVczhbj9ROaz#ysTATS31}h;9iJ*-!ztnF
zHCh6P4qxWWl&o$XKN^5$w!e<N3oU(bmr;%==3>1&O33ptpuDc8qb{QWErs>GiJmpj
zw@`i7B!A5P1lsfKk(kuQ;W~flEN_}G%n`!tcr2p5uki*Uwy%|r=eg@7oqWl>S>Ds_
z9QR-ccAeo38eRv^qnSKdW=bE<9SBG0DIZ)U&s7;$g#7qwM4Y1cOCckBxUwM!hzW1U
zQP<-XCQ=wk9xpMb57#djBg-$6LO~&wgDwg{9;uQK-A4a&`)Neo>fl4VT|AY;J=p%O
zmr;}0!$ZWQn~zbrD1`f_6F71>8DRk(IJG_CxdTjQ9UUEfDT7P~n6SABN-Daj?--(y
zLnOc)C-Q{SGDl_Bjf<|#=*OHHEawwKR29hqJGEG!V3TyCnmcC}#Gv)w_CbK1j4H(W
zrN+=Suz``;da!2Vf@|9mPOoPnXh(4n_h7AAR}p<=k)*8TCPCJ~0h4(!cMngjah#6b
zX1Wly)uY^hD|xO;)bOi$H4i&2HXMh?mgShNF&8V2UWbjL*7E__!-|d7!PF(~@$n>b
zFgAlq2kX^A>kre&A<MyrYUF65^R=16yawjU9wP_idVv}_hO^tZZ{yWhU&Y9gBe8Mg
zM(o<P3!i@aDU_#9830qieEm)t0VeFnCm(-8ONrN-r=$a&8OzCQ<U?mVfhX>Rw$&yA
zjMjyn_<YP{%G28L%|tD9^mJq7XP*uNY{hOj+)B!ap2;jUWd^~@aSb|4BIr2n`1s4w
zJY4+fqt79tt72b&8<l;{z1pWEClO#xD6M9pVl_rGfb5;Y2HX5{^i+u3s`1fhU$PUC
zd$37kz9er~i7{V(25oH<EIaHA8zb%K5ir&zYN+xdG!QTf4ZEs(=<`betIsIBFJK8#
z4G-POAp@*9Lx`NDZVuPUiv`$qAZ`#~?B?^`jT~(DOFzn$WPqhz3dH)Qu0ysW?p@{e
zQUErbJxUHX(C(Bok4NA=Fb9)0_mg^MdD!<L2WzY9M`7u`6FD4o(no4yK927{gyQHh
z6qmNjbFlTB55j!*8tl1REU!Od<V0vrP(#q}W!S#h0mVU=aBSZp)E2i9bil!VCsCgm
zj>e2k9CAO#JUEVcP)=0|%$&a&=WjN`)PA!ZFk=-%sOUK0xW_qA2#r-6k5CvX=76zL
zd-v}-gDeX5TzC6n>ADk`sy7=BTf*?w1XWC#po8gp8mNkl#FhQ-eDd@odrqM(yBCLc
z9)yXlCtW$)5q{i{0~WMx6>8Gyd!R7TcJ3~?9?8Kslk_oJeIYczvBT*V&RAh*gXEK^
zuxI5u)I?@s|Mp|3O%{Kz0Fz0`p^|MsTq6hHmU=K*BZs($*6#yYKY=Btoa0`=2&@+c
zFs7k;)3Zj7$fN7&15n`5BBD3kM@gf2*hUU5-Bo;e0cBMK)F*_a_|_%#R<)y#)Lq$u
zZt{S|F_8pVmgEWM68ZuuRL-Q_h>cCZ{7@>E9ZHu2)><mWMhh);)4s|g@}T4qLnB%^
zVC^OS5D=Ib0~$GG0g=6Y0=~K1!ZE>Q2ZDF5!(2msl-|6Cx}<Cr`Fiml9V|@j$``_V
z)ipGe7h^Y_Wq`54Zgw0iK{e%OQ#4lL$c0+0u`uL->3pM$=9CuL>#ESQ2DMR{sAUZx
ztd;R)0Zh;fHBDQ2o+XncMC`*SA5n-%by(TFiBn;vqlS^6e=4~ZAnJwt?K~-DJy>X?
zi|*cTtXnw;>m1B+JTL*De>DpAss1puSxC@S<Lhx6ysRND00!3cD7-6!-t0x>;OGSF
zY#;#He9*11G%`lIuO}?$EJIge1SV;jq9NfFL0CuO;8ze4U|)avIr<2~#d8c%UPVAX
zZ-5OYSuc8)U-4}MM7Ayy8~f08(;hB8Lsv<I26-knP!0<ZS(wNgI9Pbd`X{pIx*9Vw
zB)wWFL}aatJY1v@k>y>?(`{S7hpUBvU^y6T%4gvrn{4m+E)Q&7y9Y<TviUY^z+mGc
zGO>GJY`Z0&Kw`NV!NmF+vLy=-o2i_Ihpazh(TzZCvU8?=l0JyMaf8-*4#uXC<zXUt
zh{&GfW8q;PZC52xenwuaDv{|W3lRw(b*&jg119Lf<zt@c=g)ohV8P^xI37!31T!H4
zx6Oy@NIe*D;OK+Z{38f2Za`5>J5D(3!9w2xdS;X_QJ!~bjwX4sHdq^&LC<&|mG$7T
zg9#n0iQtlWFa{XQ<F2kYh2i3(=r4<ajvm$NtwM9cX;eoXq;>Lwbh0JIMI$u55Ir5W
zSbg&5ivieU>j^Y+a6M!W_Mk=%8DIl*u=_P~+?|7QDRMAgx1T~mCW)~z5m_$Qjrsc8
z5D{Fg$-bWhM&%R|f=Ns{7aRMKK;&hjZXO;|+(-aXC`lnB1Qb3}sK_6@91tR+pWyCk
zgqXrd$-|d)MVBsFh=`tM9wPE_5?du9B3cKJ$?;qOHdJ54PS#_dyfy0$-`gxkckP{h
ztT#O$*Kt67cGKB+vpoll^|bFQDB*CiPQ(m28DQ*Yv(NFXxam5dgT)5FVb6fI(Y`ya
zh!ViqxbzG#?x6+%#(LA&C#Rw#w}~L5`m8PsBk8p=z*y7#%#9(mPIVbv%$w2D?N~15
zS`_L^0kfO83-e6%I9&Ct`JUiv;Ipqto<e8S%QCpQM<cjcXjns@?EBcrF|-~o2m9XM
zX#VD_kMYG9pWV}&{;-oa;!bRX+pdH3;prmNIG{H@T`;O>X}11OZ+g3};qb86N5D~E
z+&bk+@p3s@3TluMl?`E|5cvWA=*cU9ii$R78JgqP?!|DQX@Y$_522M#D%LZe0mh~`
zN{p<A#$+SxUb_Z!wYAWkSs@4P!jY@Ex@QX-Qqs|p*Mg?>GW4(}eFBWl5w`1eF-j?V
zao7@yIa|VD?XVRN+Uignt;P4V$5reMEaiZGHu5uk^2Ij@+`OEJk9ASWXrz!aDVd<o
z0`_b;2yMsHNFz`tjhP9J*~hWOQs?CaOmuHE{ev|aFkN-ydjP9XI)4W++Gd{VQ2`UN
zoTZCSJi4+E1sGlZ@Y&~IASFBhfq;n{iy#~TSWiI!(((%_ryB`@9I$-YFWG^S|NHQ}
z@n9bII%qGhz@9DJ(bptKPLU99+xHA=<S-l1n|_9tGK{rUu+&@^`cuXbV3jCOOv2Ws
zE_{so)hBacvcwPCT9%kWv2?`2wWtigiEXsMF(XGFBC;OzJGbt~dIw9`>T4qN${9FY
znaTm1L&>%3SW1{va`_P3#mVJpFYM=lEnTt)#RSEy`P<=0fQ{3d4dro@Fhz3~)F!LL
zMAZbXxqyN0dZfe&IAAsoTd>Mu4(bvsv3=QEG?5qExo#gC$@4Xk7qgnR5#GLynB}+~
zBfmC)=^}3|G|_tL024IiK}ksq)py@$7E=gE#sb2|UNI7@+a={f%E!cFT+6OUP-;0A
zo{Yw(^O5*M*%;%-PQX>y*>KTQMM>x>x)^%X`4CJ;=#qqt=#+c0Q@2uJyU81x^Y=k#
z_9i&$slZ_Bcw}GOgWG!-K-`>#zLIcyO&bpnS&k;?X~ChuWO@soXl^73Ibg}?Z>fN(
z<8I8@asrl1++aRc1v(Q)Bj)%LoLy>-zM?R+rFl!P#4K5FErqyV0$4}dIRdK?4RytG
z57t+egsu#)XP1MqFwvbn9Fx5KF>|n+htI;z^&pNMPZ%Nx6JzhTgIuy<vmZAHyLv8_
zcb8J+U=kbX!7g0zm9NVrtcru6uNgf;3X5C1;hR;*%OMt^zM}`%Xq!C`Hs?SHoIP&f
zO9E`-L?xVFV~gd+8psVi!U5|nWJ9zOV3d0agyh+zfL#tx$Nb&bvGZCIv}dftY#mkT
zDNjP&xlQojYKPv61oV}LQ9egrj1Pv>h?0s*90*K8e_I1i-6qhafXPBcukaL@FWL!H
zWmV`*8Hd0<^KfLIAzHKi(VlvNLX&)m$b)HVYRWwr8w|6b-T!GQka#g^i1<tayIVXj
zdqlw4d|_-U^I(tM$dS*UY9=wj=-gz_gFQ?m2kS015HOa1)eZ@mBnSJxH*(12IAIip
zVxPlygAB&OAtDP8waw<<HwUW-JIs&q{^!bQ@1Qz&g@{_(`uBv0kDG%TY3bb)BC`C8
zer$@uC`{yl-9&0G0X0MpHuA%dzCB<=-3N<0e+e<Eop5tIhrH06$SdsPp(N{zc<bC5
zWQQm4Mi5#3=G-#)ZF8bB5e|3;!ry%_>M5VvwZ#J+RYJILKa9h>4sf7?PM$*xftGta
z26K!p&|W6M?OT=bKXL_$iCr8p)=clV!;9*~qn4nmORYdrj!+I*NmMRU61t(MG7a`R
znz(($2e+@rqcS1_JJxxkDZ8KGB4`La*Bt@yaXZb!zJLQ4c*96Ng@5!t(vs>>&ecKd
z%PoyjpDw_qbNK|F82j9Ap*kuJH3Zj|)%!VI2RD22ruxL|X{ew)?fVAUy}B1LMI#59
z46t6xrz!@3B9o*yy)E{*dZ4>S{J`Gy+q{c#eY+FlPkUhTqNQlhD?(RACmbD?NXGQ2
z2lj6Fz`3h=7&}Q9TDHd!Pbc#nBMVHLHVeDA9l!<yBe@4-Pb+`)`IlI?-h*Cu97{bC
z`8_ciV0shBVVaT(7MYphgwrhSv@}QY^-Gl3g`uAEtf~S5@8DZX=PPUU*t5w4p1XqJ
zJj)*YR<GvXYw?a)i3ekVQJo!gY%$it9Svz6uu@ecFGrs@CLI-l!Ejx(AL%h-XzJNv
z_u*1xB~cE#=%NBJ1z?XCB1T;}&zs(N>^ec)AQ-x^ckf01JQ!=VXd=MQ-yn$UB+d4n
z<&DS=3Pfi~9nur4`OW5P0^-1tV9Ch86e=Ft<;kZn+Pi5Fj_<!gCtW&xj$TG*B@lSC
z41ou|cym2#rf0*o?c90<Md68(u{3fUQ9vGv-F#+K7G3i=fzT5^bOPs~A-x8{hY7Ce
zEYu{GV8?n-?!8<$Q&}!8H+jKt-zh!@{Z+S9Xrb?kg@g?<4@TO)b{|q=dUy-s74LEa
zkMc|R5LCz4@bGZ+N;mRgVp_W6!r5XJ()#gZ84AD@fPJ?)81sNk^0LQl<dEfH3^pbP
z(NH-U8-TRElswsEHgXJ?gDDz09#;y$h6L>Gx8Fu$L=F<dv!ATOqzWCN5UGOiD4yx|
z9mU;}DoCoE*@(TFB~hS6F){^6<v&0-B#OQ+)wMf{@{`I}qR6ZFD#AyqD-wlY9-vDS
zg?USLQKHa`nRn!si4a<bT#)L#M8Qnwq&ho<&Sc^?R~CPqL;=`K0vNN-&My9g4yT;l
zq9Mx_8d@t>tRAxbQIwxgvGG&1ciwpi&Gj|kPL!B8*HueI$+<+8luj^JNL5BEm8e>#
z5=u3giY2NnlBy7m6-)&Zl`-W@L`k(oxl-kzv4km`l!b<3rc8;7GNejJLm^X|L<Ol*
zrI3>4s?TRik|>W-6Rrfx=@Ve0tNv&+Tt1Bb<~P5Qt|{zcY~Q|p(zO@My1Tpi)%kuZ
zE-8oo9ETzIeILZ&%FdyreF#$k_LS^J1?*vL#E21G3cJ@H`&(JRe!X-}VGm>92f$XY
zTq!M4n9Lp<u>Stxryi9XA9`=__<Lg(o|mqDzwBiNOa_-s3L9+SIz$u-*+gp+yO`C)
zmsKKQ^SM~QzH9ex*q=zIdIG#VYB?q?zl`_B8)KQJ63|%$t+5)s-pg(;D_}}WN^-c^
z@NWtmY~LEN3^vNA)YOeuqqawkPnE6U<dw?HW-nQf^rn6+ShEGc`S)!6?!Rgn_ul{E
zi+4Z3`BgSpbwN_^Wj93*HoU$2vA%Te!M5n^o%2m*D*ygKx<)2wldcT5w7MSnq}K9v
zOScHT`<^Xdmzju-Kk*&dV|^>{z4snp$_A@c*zi_bTFRF)z~;?kkHNoO#^74GaG`YT
zj&;>!;WvLB$sR;O69qaI(yXGq7x--I7U*vF#fTsN74Ls(hJXCzr?|H5&e-|Fjyw1K
z>gaW)JwOe;Zq=0>e4?`%@4l;vx8EHHm+>D#>!Z(b)@35PD<dg)sgS<vj%Bup5Z?kE
zj%&oYMaMA1BMQHG?U&eP{0+u_^lx+)u(9joA!taDzGCP};UC8y3$U|i&+;6M-TYM8
z{q5a%-{ngN*pryE>v^>Hb~fzV(6(idB<Jq!??ajNdVD^k8UIywh0VTDy!vA)VE_6A
z6~TKX707yPV+UQpb2@?A?mny}z%-X$z`sA#!|(p5iOsrWIAAB{P9-<g2y_p;SJ=<b
z(;LN|2&wJIp5Q7Rh^gg({rZRR!hQNQ%=z>^+;FubxT4Wr93=gpeGmwq3}lb(*V#?T
z#Kc7Dmckxn46xT;dri8fFlO)n<(KeHu90p@OcriN*AIV!pU-3?2M=$b{pL-646W^w
zsga(gJvLz9Cg%RW+33-u;pyr5#IB0Zn~6k{L2eXwuMJ5_PfrgPhFM{G(##>XENKRu
zqinDw$p(v)tl>g(PO>6dU=e9yk~zr?3zAGQKgk&LNKQ$Hn44%o(uZTB9vl*NF(*+6
zvq`fOwMd$<OVq&3M0JuHY!g*slQ`|A068Ke0)PJVpQT$bpEWf}T8|ZWuMK(j9`HPX
zgW|Qr>VS9+JjJWwAzp?3;uY8@UJiHhGPsGCV6S*F_K01uTkMQo;)U2LUVt6q`EV6G
zVY_H9wuv0ERpfvzB71BW&Bi9tENm3b#0Jp}tQXm0oyZ1jMb=m?vcf8nCG2xFQO)M0
zeMnorY}s?CmCKjo(@#E;Z?Aa5TDxYA^wU2ZQvf!+JsZHpj!@q-25P%U%K<YyH*HwJ
zSbwjFvA_K3Phctaqv{;#tW;-6r%9)zI!QY5|LmOwd>qHw#$|_-rb&Zs+N4d}q-oOR
zOVT7}mMvxmTWFF|W@csvnVD@FWm#a0nVFg4#B}g{@64T~(@9R`knMC|{~qt|%<Sym
zYG?lY&dkm#bewdIbX1`uq{E~`3b~OEDs+IfpR|ujMm`v6k3zdiyGT0~+Ckb*+NRJ}
z(iVj_lQxkyDzt&LUZHiQwWKwq0Dm_5%g<{;K|u%(4*o%%J$tUl@c$LD@tO~_$40Pu
zw+C>7{ayE;m{u_!!!KFDJk$!G+kK3AEsl8gqqp!^*P)M8!2bQ&XFV36AJT83fVmxH
zXYljcnl)=6ZVmp43Q{PL6rhkl#4SvITx~56NcR=;RmevnZ<3cn_vC8!ROl|rL!mng
z-9{_dEz(VeZYXpetxZhsq-zRYRp^RBmr0ity2#bibV07h^Q3bMomJ=zm$a4LK|R}J
zD`0Pb@;0_e9IyeCVV~)Q8TAvfvDF$IF$pW-gjH~ahPSCuz(|jyfUR4%jtWChh2~N8
zzfr*2n$I9DJxg)ry4qtaU|TVj6Ko5nb@*UwWX@FJCjRJ0#9y+2v1NM!J1&*-<tMJ^
za6~2}QGpXnuyF50Ubv35iFpA#)Yire*g=Y81&nny3k6IlU{72l$Kx(wOuIu5^8&`!
z8JRwteGZ?_Is>&nebDEbXYuY!1K_&ahOSQwzSAFq9g&B4x_|xk1>O?M)_2sz2?eZI
z1<V&xG28ZrMDhSqi8t-1C}dQ)&iI|iSA#6EaM5H)TB)G5P$6Ry3fR+Gz!<?CF9dZI
zusx)IyPm}#UhWIi8K(Gp;Q_q$>IlqSVSx<+$MBbdqxqvFD_94rQ}EKCKEbZi1Xv!v
zDipBqDPXeJ+i)EDB^q+rh>j3Q5kSi@(gQRj80QmiLVML3%szPl-wq#(FTNgxWrm-_
zcJP-NyI>OZKYI@~Nh>jUgccPjp@2PA1x)b4evBTGU~PVA%G$~c*ueu+=`0=q())bb
z248sP-9f)Oi!kfN0sQrkpWr`V4unj459uNgy!_((_|yLlz-pTzIOubd3e<0?fc<B+
zIkep;Ka~aSa$DOY7qAmzF<<tkfE|=b;YL0gD_{rcSV95&o&u(LJZvgELCgPfAMC5;
z7F57iU|zuje7eaBI@c#-*daS;?$pN4mZ=yu>P^hPFcfQ|wXwb49^Z}l0P{RXz+(EJ
zup)XiHaCvN>>GpdvD4tkR=_TiR$p4o3)r9Dei^4^GU(fl!P2xU*e<lgyyy~4-LnK=
zI<LmTf=E37&we;w6VD6cRF6<NY;uLp;ahm^nP;H(;y=-c9to$oO^4dcBhYX7XPBE;
zgO?2#(4*pOynwy)``^Rm=z4r)vjBg6P7PBFTcP&aKlmf3j<Xilw*hay^(-%BUoT&a
z?G*kb6)>qdloZk}yj_yE&h^f;T??30OiPslCLwYu7cf@1ByDW_hYOgP`(Hm?z{D*i
zw%&^ZCT_V*dC3czY5{9&X6wH~0UL9AGS%2CvAT8%KG`5IU<-3*<M(gAh<$Af(C^zf
zu{z2S+b|n%_x}Qa`QQ~S57UCl#P>PD{ygMASQ;@Jf7Ac(V=G|e?T4Z-6^@yywVY7r
zi8fX@vT>e>^ZKU)Fk-?4Dp+y6;GBUBufNb2M@s^6l5Xf#30e4hnLEt%zs9Q+zv$pZ
zOrN8HMTaJFnk}sbUZU{!0>&N{U!(2q<!L;>RX$r_WIYI9nws;t-K1eh6Y+nhrqFQn
z!2iwjc;X25_aS3(X_YQeOe~lALqdh9Koo>S2bbaM?X$R_au)#^p2#TjrQiG(-S~l2
zp!|>>winX2Kpb&fh!_7k7*ScbQQhc|w%VJ>EAzq$x4G~>v4DQVA{<+$jmUcoX}|lJ
zeEa|k68A$Y@r9(-1F@M`@Zj`(v{YR{ZO$P|zku?(hSxtCj6%_EoIgGb3x>W6+npPs
z|KW?+JaZ7z)A!T;JPX%C-0)Wi7o-+m#9_A?NDEksf4%k$B$Dg6@n9$YzN<KVcs~8E
zOL*bUKjOQO-a?i5D$bvriq_Uk2)ycw=BD%XyZYh`{jGo1N5n_<!4};cicN}U`p5Z*
zcvdXq%QN)oc2+9k>laBENQ`Q1n=RR6B70msN;fk1!6>cr<KsbkWIRM+>=r*DmGVc#
z_D9D(w7r`O>@I~^94kz_NbK=&dz-A|5pk<ThHX+Ye?;6&>rYw%d-dJFWAVPNkQT9r
z<-4Q^1eAEwG93RI?Fz?JC(++=72SkHbShxYP5$IVu@UXzI2q-ER#_-s{KsIdxPA_Q
zAcB8kz5rJ@jKN#atHJ!O=O9Yih>DPf$PC{?1=1HEXgE<mYIye9SD^O$_b8tL*uVD@
z>d8+l^qfvax{D3&NAc$oj(G0HKf>k6E?xlGKI?|RiR5bzDE4!u0&oKZm(0TlRKQ&S
z{W`_JfHSWDf%e~D#=qWumbUw#DStcPj}@@2fbm#%c?T7+Yk203w_vnt0p5MKFQ%-Y
z$I~3~+y7)2Frks->GZ)|SII|rNUE+vCJDvZi4%}e8US+>ZG1Or9o+n{Vc7vU*jQ_0
zoV6w`H6fEeAcf*VswXT>hQWT;bgaC56ggFXsL4Nts7wz`95)8LCTgL+;4oxjANXh9
zp?ycw&F+h^oAc1h2-fJ1V>kDqt-&49$)`{myO9^L8{y|L$6+|Cq89@#SBQLfAZegS
zxtbGb65m2#z*=6wR$SOZ+62$&lgNu&jl>6YAj;lGzw`zsub)oGy#^z*(X{_1A|^c|
zO0J={^$JXl`eW?$iP%4PG^*<^z}jjkZg1BAc?#I@kDtQ;oBv?9bPbM(*YdC<(p6Mj
zug2lF)i~6)if*O_bR#V#2YwkZV0+sZ@d7q_w*@Wd@Itn;jh13px>;sWEj<G!Ge3vg
zv(Lgl)*c%rF0fhsSGrLq@&dNDZ9FevD`gIkUcmnIA6y|CJ*rqk$0da>k}i<WD|D8`
z2*-4qbc%FRp%bLzq+<#lB^^=dFo|_EyD4;##2Pu6_LKIJ_A0c8w41a`p&g{{3T;zp
zt3q2yn-$tb+DO_!I^@QR`p;*N(#QeC^ceoIMh-}rANGCyV2|F>3{d)~t&wB+zn&)_
zr4QBCYhicF6dz1B#fJ;6VLRgk>`b?&@TF99FQi(00p1z)Z*tZbq0jGMrh+yf?-;1#
z?<<X=Z}JB`PgtF>?{f_J?)T6=pv4KM_PbXJw|%j>WgP4_e27=S`#;R_8UWK%Bd`qP
zDOYEFuxi936U?2KkE&~=s|sBqT_&*x5T^D=My8%<*G{>1(lN>@la5jDVWeY}Qzji7
z>A^>Pkl15n$D<@^heE93gVnoCTS;3;n@GQ<R>U7uz@Exh#GxPb<x8gDJ*!4H#TtCD
z)CSg5-ouU*OS*xU@B-#WkBIEqbT2Dleblh5W**+q9)<sE{Slu}8iBs_{OY{pQ&_F}
z9M8P-Ixk>-pL+%KAB@5)AHD(W<?mxvi4oRQ!D9KWh7%UZobZ=rk6yr3AOCtI;SsUB
z2?b2(Xzpgeb^&9J9Y3jnLDr>!?GTGOp;QalW|>qdU_t?VvI>~4nR%B&#Ka!?h7B18
z^^pVlBOiMdG~MHcVg38@c-9oZBPSK6i+6Ptu;Vqc82sG;UciR;@6QXF^D+l$Xb;EY
z{Y$X!>IMuPY(#nV=R{+LY|wx~n7(Hz7A58JLN=)10KT-HYQqbbhTcf*YR%`5eyjkt
zKL#>sjUwMO%mbDOuVYI~71YPg#8Te_yl}C6*>doJ0oXuk9k$NL(k9t2RKV6#Vd$yQ
zJc@(@_M0tWMq|fy_)YC%1?(ynqO&b6I46}td&yZ`mQ`?qP4msgikk;9LT@pSx3+Z_
zu<9sYxDG>#BedTU+K>53%dQ=RzKsReURsUAk^)XNMmJW#>=w_&o~k^IFc^met(lx)
zQ(~)mA#({Y!@`@VFj`-a)5|rZkrRv+E|#y&G&7hU@W<x-2N*NRg8Ny^{OI94`8w7&
zw@|^7Ve<Vz%&8%AQJmpUpI@YaF=LY&ojG$(&<}`x_~BvqXpaSqna12f57ijb=(z(G
z8UXdV{V|H`JB;kmw-_<^8w{WOU#?+uzgFlg3?&Vj`z7iBX#M|a`32YDxu0Xu-2ae1
z!$4XNq~-5ke)VU6L_E{d%$FBr^1iQA&CMN;i0uXIEIqC<9j}STVY;z-A!}~pg@}>r
zP-`=eh}&>TBBsYfS(it|y_6qYXX1ovYVLSM+$EvMLOMPRZ*R<Ke?;6&=~zMIkBKDS
zfFYqrLpl#eu5}d89ue0xwPLMU#vc(^w@QAo0w&l`w}%!mW~^kgPqREurIK=UyH6(B
zld)IaT`yk5%uAOZNi#^(6>49fs?ap0^(iD5B~2zxQqn}y1SO3pIWt|n1Scgqk{py|
zPqI_eIMP^!Y!$Lm$XZEOBukRX$y3P6&Qn|k!JZ`h-U9ZtT2BS_e?fvhdG?zuV1fzu
zq?k~^1QYBRG@*bACfF}%LID#@Fu?>9?5Q;YVuA@Km|%iEwf2)CmYtoAd-v|a%ggIG
zt$X*pAQFB5*Qo>(OfbO&`*rOnLF^BI_yb?c+L|9ttxcpxxmp@X^^i6*)sbo;ZDOi{
zv{58iLp7;NuKG$+1tfJ$<#N@QkxC({VJaaNLn2}-f~2~TOI%ez%9pD$kCY2>1yc?w
z8{%@NEQrf870N(cX}Vk`X{1!3A`5T5{Wky2k814uyY}|B1pTBRt*op>B_$v;vt9AX
z$Y@s_S9&^AELU0@Q%r|aQ=>bSk`kq)NF*n>D;!Bl?F!>cOk@h>N=OJ%QZVA<+ZBYk
zxON31Hnv>>Trn|B{#?<~Onx2Ow{Hv7)zuYO?9ojkk?^nd_hHj63+lDlN9=^JDGK(q
z+E0Sm2k*a6|4VxY)%WRXg;;F?UVHrw#3iPqxTI2k5qfFt!{~{L5md>C{b<F-g(@k8
zpwO;hf<n83xT2$(0=c51m;yQ!8R_4lhzLI=JwSMPyY3?_tX;lbp`lDZTp=OeO7cQ*
zaJ%jyD5zbY2n=l3U9NxtCJ!!uf2KPf3Jvw<Z@0%KWuURCS#jlhZ*1R`loYyF@jpp%
zadBM~8ynl9n3$L@ijI!%P*hY@7qM4=+7%HI(M93m;T;MK3+tlL(9jNrgoJdF@;A!Z
zKzC&Y1_pMBePLBu{{H?Q^7HfSBDU{`fB!pLTiX;@QZT`u9upw;BO#WPS0uj(y)*%0
zy@yz0N)}Sna}-yu_a;E>$3yIczy1vg$(hJ6EKyud!329c><NKbg8;E!=wT3xPYCB>
z$;lBMU<_s~J~=5A`;MQX3N?`S59Mj&VuKJxfJ=xA<`BDo^EmuM{gD`R4?`wwLUe>T
z4qv#!ffk_vS!9$yEqxJApo@w27a;Z!h{eSQ!ga%WL_Z8-v^=nIBEl$bL_{b~U-d+k
z|8=Z7aYuldV1oTfd#n&cV-D0_eGjKk9mVR&dU*452cWeE4Weq)R}{+u)>4DIasp8c
zfsG(mUq(QxEk=D+8KeX-StEs&=Aey1jUd)Wuxb&NptdLzho|(zx-$<@ou3AAwH#u#
z1+@N@LoEEx9;`Th6aV~N8%YVF*gt&~+(W{VoED9bKT=0h#8v#uW+_sWgYeOqiHJ)G
z!^eO55GhGv*km;j_oBiO<-G^f_FTf*wYIqCAAtC%yBIlXBVr?NWBB-Wh^7kpKc9_6
zLaZ+aTP?upmF5_tJ__oiN8#0%-bNHb?$82LxIegsVb=4NK=#{%SW<EV25QZ~W(PwA
z#U)|F=ua@n$N{tMbujDT9Yo&Vi@$$58oQ6~hsLCRNT9#fi?9C~%hs;NTW@`c@pG2q
zn?JvUsJM76GwO#hS{~gv9YbuUBkI99*loRvaPO0tw(k}q32-0%#{lko=D^N%F&4Qx
zz+wGqM27ogknSAJvD83tM5F*Q!30y-<A<19AH49w3wY=Kfhef111e(C_b;OWaUJe#
zvW3=`n*^^KY%}`=r#u6p_RM<}CqnwgmH5<dD}JZe7skd081d!bpt<%Ua;~n$r<3<V
zN}kxcdBd^wN+_C>uH%g_Cn8{*HCCVVd+H$;pA-cPO=ARJT#Zvc0XQ&A0|UMugy93f
z!1Ci)5g&dT>eIF%DKP+l8#$gs?4$QSCLjf4mGQT@7a5FDk8PN^^(@Y;vcgpkF)zIG
zr+>mb=ne)uuHjx-bf`Pj`n-nNs0WA+yMfo=`U})Y4Z={{g@}su!Ejv{?44zbKmyut
z*%J%Bxfi=`h2Ya~%;=gX!fE8k@Q+JDDm@f@rMC#tw|2wjz#Z~#?<*h{iciMO<oot}
z^PhaVXTliV2#>>Z;{gaIk1pEx6r6Y8qU9ObZ@Wq!SU5I1szbNmmx!czlW*Tga4elq
zYy`n<6T-qHU^VC)1l~D-g@<kn5ED!=g*|47<>ICHzoIM}JDL+w5r<bl(gxaUDNQ~0
zEt`nGefwhj@w-5M2GpK=4-+;2gAa#W0?kzrC3@kF=lWuV`83L}0=d^W;A>Ym4zZeq
zn|St_XHZgBiu+q_@TdQdhphUy*PQ5ec^^U|LwGZy&?olGHYdiC7iBl>?}$xGrZ|ET
zZ%SlMi}F6P7~1Ab+Gfp&EMDHE7)94N0+AHg-Y3S^<^5uvO^Fc^;dCA3O^NOOWkPeJ
zV1hl|p0a@*)pWd;NA43tLj}-U3CUB|Czg;HiIk+sj%^07<dkT{t3d2w13O}4<;#SG
zP&vRj&{QB68GzX600qSSXrDl;JRb#OK9uKu9v4R8!oUt;V25CW{hIcaLF|8PV8_+%
zPWZ%O8Hd@Ct+Oy;$tHaCW?$S2p~~<6d1z{mhWmpDRJn#?>tt(OyLSybnq%M@8i=u)
zU*MI${u?K6UxAhFba)(DM3sCWXlswblnwi-VhzBlbyKix!32C@HjBVWFbp~dwHJpV
zHp&mPZH=IzsSm%P`-lqng08L|4sV<RlgX|KkMKo!=v|oVjKqlxJIFik2e(<Hq3yB(
zAq27$I~PEGj5+)Wa*rQk32>XBj=s-4i|3wuj;Fa9CXY*|v?<9+@^lGFNKQ&ZYHBJ$
zKM9Em@jS1D_&6kz*Ofrq$w>)#>7|$G@0du}JPt{eJ}$NsWbp|JbRA<kz(U-2<M;i|
z=mCKM6hZ60U`E>vhS5=Sn8nh1L_{Rz5z_&&Xa+=zXX{as_vk$TP5F@L78%OVnGFgF
zBQK2sF*HODG3K=ehlC=6Jh^s=g@#d@2)6&b2)?-wYX2CFuwa5(U=Us35CLL>{pL)7
z*b@)2<v1{N1RU3$LPAnBK6&SPxZgZPl~f<z%=+TXuVBB2KPLX)pRx4VEyRXgAP{|l
zfYXcdq19aZ_6z?(dZIt=^Bj^A!=d$$H*m%K68ip47yhT0-~)@fRGCL2Df|?N*zKbX
zcyC~=*=W2tz!ve5p0wQ;G32pL@Ar4i-ggmypo-N$#t-5CXQ1}%cM6DY!dk=s<1f(m
z?b`>xd*ycs4flEM5IZz!43A^#`^@hVo}7+>e|Zj9f)fyWZ7V+3orehbEqHUNGtvlR
z$EIsSXVM{LM&F{}_9b$%Gtrm!jn7Esd8DN!qHmw)FnR7eL?)&ZjN)PV?b{fvWr-VJ
z0Z5LIMaZ=sc<yThBnDiB+8h0lL@+!$#|Y|^4&p<~<4#lp+_z1}SGr4JG2o9FFvb*D
z?)V};I#L0#J_Oxo@$9qD()tUCh>E6%i!kilynwdfM@(!qKbN4WSnPDx#K<Xb82-*P
zIO$DZcj#@3`x8NIKh!=Nio1vA<D;QdIjo*hdj<gnKmlTc{Z>qX*b@w~z`G~0<J@I>
z!jFKLyBl_&ynvk>mLQlav*b8mEL}1m{`92IniS9NT!U-g_Yo86h2^U@Bc8mojjQM5
z_Wj#fwsI2zC=j>L@5Z`)M+j(sypoKLrzd*vv)Fj#1U=RJAtLw&mMq^&6{H_lE}9MR
zARjDVv>efqv|LOTefR^M*|8F5Zrq|u^#N8dcE!C1?pU;B18$$)hJ7c`k!RqId)E$N
z-uy-6RkQ=_@j~pN^HA8VxJ+JEXV~ri^YQK{{qWB}yo3WDVF<gj34ha=iKK)?9GRjH
zv&H9;9Cj6b`hJV_v=k0z1~IlwO^d@T1Tj5*eZ2L%*ANhw1gC-TW57sF4EgFK%-DPx
zp;xz|&lkG<m|y?xb&S-|!S9}b9Rab4_%r3<5fy_gTPET&t@)TV>_dDvd^Co9{ShXu
zIZGayCmrWs9iA9FW)K0X&r9!M)PQdZpsymDyf_vf92SA?4z#c1E?nH|idR4Q3`2*1
zLviGZ-Pnsh9}YxR*aN)r>`NFk{9F9B-#7#XcJ;;thza&I+fRbn8*jY9mpy{&`}CAT
zOjebR*Z%P9K}=N-8`$xvFFUjNs7PU8$HOG_i3ujy(_=pgV$2c}60mLi4lG){{E5(#
zWvlS+yMM&ur7L@k@1iA-Cf^4HiTE^9D)I`76<45l_9Q{9%fJo+V%;P_OfbQo9{b4<
zQ?}-o*2gZ_S+jU$cI)<?9^-$qnp+jW_R-AJ(h{DY*Ez_3tP&E!m81-~u5jxFTrih1
z+~k0h!%YsjPPj!yb;2z&vMby=0e7FP9c*&R!6w(k;noQ_PcCJ+F|l~o&ljJRAwW!k
zm|%kS%6?XeJ#MS4tb~=76|c<x@|V9TLZ3WKO3Oh?dhTP<RrlL?_0?CAnvvII{Nq$o
zYBu+BnX+>V6j!VFcHqDPj2=B2K0ZG1_V)hK>i!v?dmZxh^z5R$ckez_9v&VYx^w4F
z7u~*nyF<5b-Rh#7H*a?6#*G_Ybp87E4!OI#chR+L*E)3d>eVi~a^*^gE?>UfA-4U=
zC!gSe+fjbq1&9guwApV8VlTh^vSJO8$z=HBAOEP>60F_WU;qaB+S*!0$Zyl4<5GTc
z#U`X7Bs>Ox|HnW1HGL2e)?>P-MNzTIXloN@vKQ>>vfm8EX3w6D{QP{r?&9LYm+Xm`
zJxL2Dw}1cp->9mp!h7$%hv%PvUJ)wTqZoTQ+Oua5ANrn|nTbz7{S<50uEqKD=M^ag
z6HKsQ(|!{WtEi}eo}Qj!OWrrqZtTOItm64!H`Xt6;=~EX7En@Bg2js$E4BptK5J}j
z#K#|h3`a*tMTq<XY3kIesH>}kg@uJ8R4~B=`?c*i)tuOF$`BJwZqGdP3|}(fw|ij*
z1_ls`M0{PaA7`(>{<>mKFu??S946HEPnaD(a1FJoekgARt}fC=K?@6Q#CsN-09h;4
zzxn`u`uqX@xz#Wl@Ne|(`v%-2<?pQRJmHDVV0TDW9M6wF`l#dc^K9@-`}=*&SRa{S
zy|alEC*t_=<BBcdwbx!#to`;)EEc1<xR`tJf&~5CV)vFrB2nCJk7mC~h|QQWL$UUB
z*{S(fs3?oW<O2bG`^E}Wl<<D`W_)C~gNI3Li?MS46z**{@encvwAxC;vEfb{1`INj
z2lQa75EJZ&jSaj1&wu`-*pl0#MT<~hU$5BuZJWGhBL<STkjJcGB?YM{P(=Z9wKDm4
zk+{`QNe@(XUq!x3@==kulDt%O58@VOc`E6yiaeBbhpVkaw^ejYNjFt=qf^b-RphRs
zYf8GRqAN<etfEUDYUR49qzh<mQr3ADom0{o6`iL2&tS-q;qsgA5lm=K6il%1u{Ym*
zQ?d5w*4Y;;U$$?m_R+HK_K;H()w}HXB=qOX%Tpv(%)yUYK}rf#QGkjVtVk_P1S=)A
zwLDPLeHHnt$VW-uD)Lg&Jr#LUMX#*8O7c(<!Ky<9DpG5QZmH;|l5VKzdZ(J)Rdh{7
zSCw={MVFOCpz0!ml|n6C7nF1!Ese@Lr=qh;I-{b~^t;dCx#wQwGa`v<>f|?HFHC^g
z|Cq5pG4>Hs!G2!T8K8yu)ANwXoiiz3>o=Z<N8UYybf0b56Cpxf%t;uJp9xo2SA6!~
zTRi@#djJYDlQ38NGh|7Dv(t2W__67u;W~R3rJaQr|0sVt-E5}?X+sK@T}$TMzm^FQ
z6Cn0$L#(`leRivNCe-%-V<t2wKHQks!v<<pSNFaEwOeiSHN@2bW2~3)?Zw((W8$=F
z_~Qp3p}=Pg?qsu>UYhX6@88F?X;bjosM$Q--{1L|Z$J0UGl-zW-d<(_=M6{EQW}o8
z{!blK##>>=9)C(%58EYIuxaWzzTdBD|BDclisf;v*^mKCBEC;>@P@Qi0kAe-s<iLX
zJ;Ty@QQSR9STkZ9r4f7cZ85=1BKCoVfF^CbiXk%>P}p6_qy)Jp)@&#T8gD)%fJxgt
z2oAStd589=rI_Mc*}4F+?=!&@`yVp_Vm%x4j`r{0uh<ey+5Xoc7JkwW(S=tr+;J8`
z%Ln(i>Y%uZ_LcbIKcD^^Xt{)MXDp#>;)QQU*+C|`kAHvi58C#@#brZL+USd>f}NOm
z#tq5m#v!KM6KK1J;j<Rf(jCKG=hL~}gW*>n)02}s?6<6k_bx5|`64#Z>bd7$MH@WP
zoVx{E?jFOJ-wq+5wR>d(#8mB(YkM|=gpE{slEn&LPvL?D^`zm$hyQH%^^YB4^(5Q>
zo+ox6A$L{-&F+ZGy#udp+St5U8-1RA4>>j7K;3x^U9^&}NhicU{p9ZiBp+N@Is`@a
zK4>i1f%#_-bwErixr=Z9&=--#SL6^Q4-B$9_`{q3q)OF;;yp3V;6EH<?%`)3X}g6p
zp8FAVe--7g?2QQ!Q?*`0j1|y-fBYH5BA~JCDNw0g4azF%LB&A5vWj|8A>FsiD(FG^
zK&`U!dQdJ<qpBPgWdkBrWvM6=s8&@*cU7gUD6P9HQ&p7GT@}eaD5<N;6MIlXSCz&0
zpt!CojqO1(T~)#qt)i$-6}Kx=MG>7UYFBs<3X`j_T_HUvSgwM01<6$$3h0b5=QE@H
zR_uSVIk8hdkV^d_5&FawdWs>&`Uyr39gVtT+0&sSxoVYF*n<jWs8Lpa56Y84q^#T?
zlp{m6va)+nmJC%{(yq!>QHB(is!CT;niLhPO6{)l6cr_RS6PyZ61%H3p$ElxRY_bA
zitVc6m>v|}RYg%fD6*>xBPA$|P*HfN3fdK>qR>v|w=1Lv1<RG!uAm+iC|7Q~0y=eK
z%N^XheHZZw^i=R0upfe0Yime{WRlR1Fx7Mq)5FrXwRPqzm4;E+4?v6!wf_N#wf+c*
zwM$AK7lW5nOiR``*6PFi!F~>iwJP<CJrrVWSbb|J$fV@0F?dOMQ=<yR$ctp~V#Dcw
z2x5{}RggUdV(mlfIm9lZh1PowF&-yC?9n7Z?5TrTMNBz99<c)T<RM0#I*swmA_!tK
zlt#CaXC)?YN)EBo7zQp1Qvj`?17czdr?3baL8}cF<k_)pldrx-8Rb(LD&+uUX-lId
z_)K#fsws_#yv8ry_!Lz!A{aP(kY^=DJ_8klS%{cJs~}WHVXb_b7bNEKMU;*KEI&kw
zynt2;qirRKB_z@h`3>0jK@13^csAOV+;K{yruGUg!)eK8g^A_+wn`%rvfUKJH|#}Q
z#bx~YB{ht4G^4ne=;EJ++WYJsJWr^-{uk(e`6oR8&L?P+MdNRM)zAj|<B(pUd}`Yw
zaBIH<Z*qJ2A77w>Aa`_rKTMvghu1$JjOY5O@wmgw)nR$)AOZCO^!xu6ebk=8t*Gm~
z*-lOE_mm&|vbh>8H9m&gvwuc;lOK{j7eS5oReSC|WL9}2`GPaPb+N~rl;?08dxRb`
z=lgu{wIyDru!Ou@1hv~(yLkpAZ9WLTIF;`|YV0^VE<sIn4qv|iBGg{_3o<M3qAp_-
zUU^@i&cO$7Jfj9t+ikq~+#m5b+9x*qB-CDf6X}<1`7xe<{!dW*{pW!A4nmI_LubWu
zWZiSY(8WvedpfpAd=D!Iy}{G6-^-SNc67n3FFlVDAH9e}o;#uT%&YV}Z{c-{n_&AT
z{myrgR_P9xzrBp>DHqUOycKG%jeyqQf5-RV?0x`Fy8ohU)fX514ibc~V%da#yq|7>
zo;CsV8Ww!}4kkE`gj?Vd92olr#(niCtUbSz?t?QJ{pH(qE^2UGH;4AUh*d5F_`ct1
zjiHB&%dq<Lb(~E&0h_OWk0mG8qE&!cFC;+hse@QqoD7vzXL;;8hIjw+UzDW)pTF9d
z7gVMZwr8--L<9L$UotpVB>=|%9f0y!Am`e3>^>*Lg(<cO2>}AOu7Z~@<rz^1<H=sU
z3G)9w&_?-#ILzIWhS1#`VPUfrGo6-V_qI@!M*^qETOc7ENIrfNCoVUlBm(%`f2Sh*
z!WAstUqap)ut`@PIh5Cze^y6H7%*S`JEXHF%D@8XP4GlMLG6DNVhlFXR7umtM-YXz
zL#z*nSny7BXl-}H*gy9{csWaRpW<GVL+o!~&^AF#?N79f#Qf3k;B4%D4zU){ADQJV
z3x$mI7M;t5`)4raU(exAnlDZ+8HzQxE>T4ph+Px^jbp*Lac21l*c>^8?T-J#4zH_p
zp8nhelSAwelpllG^N=7I6_G3O{x^2e_~1D#J-!{s=6#KY7mp+L@+AD*$d#Yxi|jY>
zeSQbDo+ntn1F0;K;sOb-eIb+Hrnr}|eEB%6T<HLhxGVVTbu}bb%3peJYa)ncZo!)$
z830mW{P}m!aES5Wk9$DvX@cF`w0@WJW9Q|G=+owyb#N(Oc=KzZ<s2QeFIDi*ke<ae
zul<$wIZUwsmOyujz{~RSplkCi>gZh1a0+VAv#?wEJzcL_f^AdYM!fu?4rYJ)Izj9_
znv1sLrFTZ6F>@7O`^p4C2et5p#&9fIY=PA)ZBXBG4NWEc;o>lqz@`TO{7YEy-?wox
z^bj5AMf~9#1Gt%dfHefM;;<Qb<>SwhpTCD-Nq@uEi)b#}iz&2kU)t9@`y8ykc^iW)
zO!)PeiJ4a>K<tMlK<uf5SiWx(zWC$sIj~&jUn7r8h6mes@$GT5&Y>)tJgobPc#*c%
zO}21P%l@l>;GGXf!t}pGQA2S1@Dp2<Q}}@QN0Rpi#GN{eKF<x{>lY_k;OLcl-WR6v
z$w2bP(9wigLJ<4s7tSaSmmzTbUOMKpSif)+j$dxz{b{2<e4Bvgh_}9-igMo=xNJ-%
zh{^EhezSQW*&4lJ$Oy&%oF~Rae)B`a0J_*9>dWZqKo$m{v#vOGpTN?59ev+m9vFpp
zr0rZn%$6}7`N<VTVf4pf@oYZ{ZBw3X$(j%)Vg^TwC)h#Cni$!u2^7yH4&cp+0L8(F
ze$$Kcv;;D7%Y6bQgA(m83!r@;P+n|b*7WE@%fOB$z~UazlFh0^X~e9l(F+oS6W=E2
z@#aK=7fZ_|<xPusc^tsf`O>yW$C5Q8vU8Fz*;hC2p|#bW?(=8SD837+^d4jcz4ksa
z7B6XKOHVrfE%{PL@FEDdHzzWvv1UZJWCKV5*4K88&W**<w)6%qZ&I48w7dmbD=lR#
zPqr>^QiP19rF1gZ9C-;cT9=TQ1ze{z^xz=A1}OoHH7f#iEZG%WULzo#C$O`1%2Rro
zw$D-ARY;o8(!<0BI_C>Y@Dd>Qa0w85>LAASOZADBQ9W8pb=HsR6U(Q%t(@vjCf>~0
z%RaIH6^Q+M`hh;NF6y~YjOoYri3tNcn1q2Hzn%n$2@q3)7?%QIj|wpkEma8+dkhjF
zCP1va2@n$?CO}Mp*!P;7n;Y!L=^!cL91`NsJ|Q}zqSGomC088NNfn*=9vxTFF(n;U
z(Gevb?ygv69a55;iViC209Sm6_N!>0lJ=@-Pp4vbKZ16tXs42PsAzkK;<{-Y;-Zzc
zRYhBrw7HAoV>e^az<=Vzsq_4c=>o)<o-&A4XVW!)2*j!~@PiPm&Y-;6x&Sc&V!xn8
z$E6@9KJ`Z{Ei<2ccEMpWJ;n<X#O^WiBTO0~K<qI>tU6l)5vh{km2l%8^3r9<x_2KD
z{+XCHWd+J;JNteB-g*0Lc;ByvD5C+3To&WLZxw+{h8x?Cz~{tiOf}Jkp6ybUWdR`<
zZeW(nauh4TRTf>0S(6tdEkR6R1H9ahWA3u^sGz(V#41>tWC_XzhzSt;m5f2Gp`k&s
zC7578%>;-&4v3N0W%t#;kbmzK-0s$JPwdvJDM(5IA`dLb&EOV31IRx=bU;G^@Wp2n
z(3o0=KYwL_DbBMob;3g2^{K(4L0_XV2gtf|413%wP!W}d7oU9_IvVD9^VKn^j*5ZV
z0&fnpx?I5Ni%&3R{2aJA&c@uCdr_TAzdtb-F58mv**k+EBFG64BMA`uMNNR1U_Yk`
z5PKXDQ>acc6&3TuVz1ml9(h-pp5BOwZR7c^U3?kUnKJkuJBmx!i&2-;irG%C@bD~0
zC3#ZU*Y80I#TWQT!Z)CvPf4|8%4{4w9Eq(<cA}c{t4*rHWCvFy5k#0L=IwR_)26xc
zCQ9asiPC9F@Dw~TB?%DwMNNR1U_Yk`5POUe<6`|_%Icv{tV@5`L;A#&`@)1iF@*$(
zJ(2cvKup}mKY89OYZHqVYd@zcK4dDBLfXT3OC>+$n2+!wR2dy#u_9k8OxoV3^pNxG
zVo$(_SAU8L5c`E8CL&L3$BIojc{S^og&5VBS$?Tl;<^s^J&XAukKRD6B)XE8vWG&f
zJVl1BbJigvRwh79fY{Gsy@43}w%gzPIq@a455LgIr*Ei1-EkG)Hu=lH_;RJem*BW)
z%z(y5_JXkt4x|1L&%HMkpTEUkrUw4`Uu(Yn>)$`d$p5^HcmAslMb+QMn)7_%xM%}E
zzx}?+JS_6&0Y077SEC*I_PDP;h58q7@-%8MzmL|;E4Ywc%i|U}Xj6D!cqdn4$>{z(
zZ2$OSSUu4MYJLBX;zsscWLW5^2R231+})l$&By;3fbZUa37-wK;b?r0@_zQMkvy)e
z$*^pq5r6rA=GI$~i4ypEd^3F;U%vL)EX*JNe=zFzM>sedqKqy~UGgQ&+PI#_Uk=Wp
zJnHaI`#n6j1^xa_|F`nEm;W&lvgT5J`Np$&`?F!FZliM**I?k^Ux(UTpQ5m#rz`ek
zm;kX~7-DzVO~Ax$u^9B`i+B*(in{Cu{I2iIaB*<L%l|auv)fM@{S^!>rs5BM`yeGr
zh7(iG@a-5oeEQn+2#Rb${DlMfe2_Kl^hTq<{VCLCHsZxTf5dd>ndsZ+eL6=f2(Leb
zI5xXHd0=cN{F+SQ!h#9-S3gsX{_-Qt*&d0|{j2ca`~5I+tRvmHe?^-6Ra*AN{7rZ9
zs#+fy=}*A@ATdV1|0=9)rsI`9FCZaahEHBmLsS$5hzSt;S&UVhz465UHF%O@4ftZH
z{3D`GS-0U9THOJ$)u!Ldfz+H0-7P*yI5{7g?E9l+{r~)beEI1BJHGtz<8Syf*K;#G
z@|yX&vNh-XVz*xjU*BOjg2VBj?|%iqs5tl@n23-n!0}(7@c86&OOQ%Gp*H0TE~nHX
z=guaaOQ_*-ZEa$#&>70t4^GrX`;q?hxdoaF{V~#FIucW}@ShLmzv17X>F{Ob@fnB{
z$#8RnJ*s<PMsslphMBt1zM1&%KR@PS7GHnOm)k8y@$;S6|8u_d-Z@bYv7`$)lPEv0
zMZ><N|C{mIgadqg+0ZY+{Mr3>8hoE`{_{BxSGK~`P}mu3V}$EjMaYw90>pknh=~$X
z@$BpW#mq@_G0SB(J&nDD%-g5%=FnAWq+@SgxDlfKR`gYS7PWNFu~)9*-hB~1c;Q(T
z6;VOCbq7~(<fAfEOa%<^J${0o3O__Wd2~&*f2v;!-h5FFAu;qss`+1-FSv@@>^AIl
zvc#ri33&gxK1d=DOca-iJ}(bI%;Amr$a)XzvVfPUBB`c4)zqGYxKO@bN#HAwN`u-n
z15uYQ!`1n=uwLSae+v*3AoeqvhX<R#Pz{cba?hr>_HlnF#oG6qC?g1IHB#=u4IxkN
z;U+_CYik#^<lo0y4=NNtqq$8Qg%-v7qnhgZJ>89dznlpW`voD!zC*?aZnS%44eVQF
zJf5B?2~wi$&Su0$imRva_U6QTDob^=-QJwY@@b&3_U1%3Fr%KlIQD*6d!JZkI)$<0
z(Xzcyj1BgvWpJW(Hn5{sF`%Q4yfwD0q<Xf7($`YD&gMkAF0@Z2Yi6WvHu$4V8DIj$
z1c?0zYX?}n9u;JQ3D%Pd5c>ro)=k2|4gq5SqoxY5b~!oq&chN+u!mW%Atn-upgv3k
zP33J*hsxw?R90yZDrrN5vWk09Q5))&RoH_H+EAygyq;C7s$3Q2w4p{-*(%CvBM(bO
zncY>Lp`!Hes!CH)YIjwp^q}Ofsz~ZViCtBm(1YT;sw}Pt#dcLGQ;dqDJ5|!IC>2F^
zs<>V3yJV^gm#e5<VLd2BuEKT&ck1*uPu#xaDL_nNDJdyE0<2vN7A#Pt6il#3w@32C
z)Q4+8EW*>FYPs5!Rn>zkfmUTz^q_K}MOmdis03(MR&ft1k~brEQK5<ofJRm2t0)g>
zP!(%#R1s^Q?4s=MV*O)Xl-XUZ39_5gyQ+pYOR6fht3)Y1D7mYulX_5MS5+}3s3^Wu
zmF<dCQEaCw+7;7-qU9=YmtqF{E{c?k&5X|#(W!I0d<0KS#ZH|%)g!<R3=9-01QYDX
znb4dlG$#tpi9&PYuVSho696XI&tX3qV)f*8sD}M0Q9iTB7@>~5p-ao1QAVCidt6hc
z6gJ~_ps_?{AJYAUM^HuHk!rXq#F}$UVY%!M>K+kdwd5U{7@DDx&gYkaSWQYXTz7;#
z6k;V2k=S=B@6jPf_2<q78xeKp1PW4R-5^$zF2<n$evR+?eT(n<55*<-{2vFg$aJhd
zkn~W9<$K)4iEEXQ1~Kw});iiEhrB7aT@s#$rCXv<+)IcRl4ms2+?ab`di}?tBvK|o
z><O_mXU=ed85$ZYLIe}+r`eB&SbeDsXAhsnhFRmW@4$JuyC<Pu86w?8H}K-AsI36P
zPi;dEZENc}@MgYKOC6D&56sat;SjsBdNPMt;E}bs?q7xs?;9|2IDod|YM4(u!kY^n
zMjD`@3fMMoEb1wbz0;jgP{f*ZLa_8mOpg$=Ug3e}(l)4TIiiukx5~~0nc2YMsbdim
z*95P<D{woo5Jt|sc@yGf4FlBB`I;G9^a!!s2X|pKVH+9>o1mlPjMl;yjGMfNjsa|$
zXon*DP2+S%BZ=y=Ew)BDf2RmR2iIfrs_UqZOU0Be{sgfS%-tP^>ZE*3TI-F5oMx<9
zv<%zMWKdi=cJDulgIDrVosbVBr=6(Jmcnw37Ah%k(@_Hv6WxZ(E2hIYSc=JJhN#X3
z?(92?ZBwSAG7AJRVBgfqe7!P7KIv~e#Pr4=LRG35RVhs{)|-gBlsY)fI*s~FV7`qN
zpHSF(^dMv=5)>?SaNV;S*VfFzf(^dN_Y23$J#i?D%)kb>WR!#^V!^fuRK?d~)$G}D
zyI6|S&|DnbdJw1Gt56)A46EtKQI*gF-4Qx`o<^N-2O=>{O6O;f&@jMRmwp$W@41bK
zux^qg_HREAw=L&zX!Cxo+L?%{#`-9X1wsz(!Kuq41nk<3X^U^5G`I-EY__2^Fa!28
z&!If53d07D;t(?!XwSdkyvS-SvcrM+OLws4Kt?CXe&Z1P+u#0%#CW<8GBF@+dqUJI
zm!w@ST_t8}R#B5&ZS898uGR(>)px3esZK?;ay2Wfrc+H!RM~V9RW?kG?V?IZRSi^$
zbrDq}?W$*@%B73S<f{7~)l#L>MfB89lGU`UxVuC}Dk|($HB*6#^5v>hR$f<C=Bg-%
zOIp#c?CvVhQc-57%9zrDiVRE~XNk*~FDvfc-rG<1#8SOIQCvXRStYzDHPGM7Qd=L(
zj>Mt0L<E!Z2O+5vW1h7-BFURjg_!@LmGBIzq9^eX7~AbfX_zmzUCAX#)MLbep{S(4
z?N%F0)KyEd)Y<^CDa|O03dig{p{Rct#7bJBY2=EgGBNhdutQp=47<nMAU?GXsdwG6
zao;(tK9Pc^q9$kz8iEo!kB39d1Cv%<MPorL3=AisC9f8vO&6lBK#c8^?T}AEu{JRS
z8*0DK(h8*np7dL%;r>8Gps0bK>v_~FAXb@NiF<bo(N-dbk;Vu_gx1qFl48uaU*PD~
z0#wFlW8AD$sLK&!yq-QPC@(8L3)Is2C!E_455Fe3AGwa290?LH9*4##Z4@gYwr$b`
zR4^})H8CndOxO8f=bVY8iue-fjN61Nid$rBfntK$SY0Dj6L6+j8Iy-c4<LuO!t;I$
z%45qge#PAmh!uqu;NG1IG>~_xH((SZ16$BU-e12jKgZeY)hG^#!NkSaQJE-)g{B_Q
z(_qL%$_Kc=Z51B)%W!em4T6{ie!I57M9Wyo6U)b%U2zyS)ERZjV(gzY3EK{3!+*yH
zczTObMjqTCvvnv9NXPhjS5Ohz2z6zMk!LqqM;)>LVkBPm#M+%n|1%I9F?<*Yhpesn
z2~v|>t?g>;surdO71eV|o7+{_T}`zrs_9fClSoC?ay2Ncs#En$l`5*>lGL@Uyt``4
zR8-oj8m1Bz70V@3R#8_Gbh@g5OI+2i{O+pEQ&DcGDwuLqlr2}eva-60pwm?uTy3T8
zO7E_cG!><Gs+cK-OH!JK=bnE7aS3UVN_#&;$ZxVwtfis_gTDL{-}U=WuJ69WgV?67
z&4}&#f#yUm0#{{162AQATlAy+n7;b*J0$tt#i@H`KdCvfOMh4o&52yfO^Lm1POQuz
zPjluPBwRX;v;+pTPJk(^qc5yokJ_B5(8HP&mDTI!L{%x85rsanM>hdt0>qv+h$SRt
zpuCd2++Lb6u%nj{>+r&qJh3i%!XU=fWl)CzF#%#vj0A{vl>o8F3bEYKD3lQlRKt5x
zQ<+4*ULr$dsk~o}HS0B&v9QiQu?E%*+_8@sts)u5+VA26I~q!*@_lGu7Qe;X5{)7$
ztpknaVv1wy6xR)6ly9+=_LHAOV~Lpe;W3ES7qc)a8cL)bYz@U?)G7d0S481Ow5@0|
zH8*oc3*{%u1L_OKs4I~63^7tI0k1Y+jGA1!egrX5HYkj?DUJb5lq=!Qe>ME$n3R^b
zt204)iTNj37{J&(hzwk8yCz!<5qVf53KwOGQI$@|p=}1Ssx-<!llDueZ30+zhJ;{8
z`K3z~5Tj$JQ9Pv;QP|WaSNXnECT&GUG98QdX@?kVf*fyV&4<OaKB}2!Mxc9*;@Gwr
z6-hD<u8JfHNsRJD3Ca>=d|4VV<6&&cz*P|szGUgk;we0i@`<DLv|bV`Lm7#|i?7E~
ze2k2Pt29<ZVU!>3D~A^yGls=Waedi*gam=Zt1PMoHnYy7nAS_8<dTDo@`<3lBgM2W
z<q#{Pu;K_YZm(K~m<V99t|m&t!NFBT`xLYN1c?2jf<z3v51#87p*Vfr3EtQBeGqG-
z8}d$c0glbr!q}q$1gx$QgSde5dWU{(lM=vs3o#LH?%fJ;TRjSbF5-h{`{0G&{~aL-
z*#xVf1~HUHL+$0i&}mh`(`^e{o2v*`T_GlGs>FLQt6}u~<B$@(q_rj3wRRm<RwX#S
zc^OqQluiLLDlAZY?k)Ozmf~f)c8yd~J`7?~Q9iaT*#)Tpu}<qYu!H_aYnH6UbUO>o
zTeup#4+he8m&ZL!IX;)+9ovEpPR^je9dg6sv0>3F=nUzPge+ONKCxZnZ9w-8K}-tk
zadL=--Sxt<h08JU+Yt~|09(h}qD}-Djvj&m{rh3Sz=1Fxe*}#x5MzB}X0xxNDYFpY
z^c#SFly=a-Z*eEI5zCCs`GAv@8%J<Ix)seiRWMt86LA-IA&4s08UohM)l-m5OKZys
z{Jk*Uq5aUGA8!!Gt@i8&vC8-~tT~ZJ@B*$ab3tLA6vMy$j_)&Y&;YDCo`j877AVRA
z+*i0DgX+7os90<{lS!bH!boco8gp7;H1!mL4j89C42u?QM^bnth7K8pb?Z)|B&8ZN
zwgjR$EF4=;XK{FCT|0?e{w;7eH$g2OyEr%)yUu1K@#=Z#nz`VJTQH7In~YpK9`nTV
zyuEPlR#g{Ij6rOI(MW!--}UQ{nTs!>CaDSE(sh%ce?ROwU4UtpMkpn?d2e2V&`_W>
zDhCU<g`+Z=^>?{I6yFF(x{j5JGUyK*j79VJAR(v%gZpb?!`d?_i7dqGUGXRhOUJ@3
zktiXU<=wi2qgQI-q@%<8w6d<b<Isf)1nu7sV~d$MdL$Be*DS^K>8r75<|-_9T>-nf
zmk35pIJ)5=T<slTKK&H3uin7HvlRq2x;F;ep(0X*nJfHI7%Ib+#q$x{4zWmJ={Q3S
z9M~WI2MoYBLnqSplnD^~g~TEDeqSuzwi^d_Zh%^!XV4&(VX3_{*vCW0{9X<Id388C
zUk6`XZbWN!1$H=niL>FwII&O{_Q!)DiaL*%KenW&$^`U%j!lGHLJ<2CEo<=%Rqo!&
zh1fi{Kb-g9#~CVHB{hv$rT<T?yAg|;*z-_(<*x)S5&BTt7FjLr`z9c3z^x5zVr(_^
zA7h4?^n9SD25+kML0Nqr)Zcj?Srs+dY5gS@AHR>FJrgiwk{cS5uHa9f&fo(<-hJs=
z)HfERui7&xtSo`FBnE1){*}(F9M7t~Ld!Z@z65cL2y?!B7e0yk*lzkUE`(%a#@FxS
zN@yBn1%Y_!J#B(lI@Df#m#$X@-hD<5_o+US77-L#7(wg}I?t2d5xBbC6a#0tVcI|5
zfLCG$nltX;ckkJtDeg4h{AMN^BG2G=pW8s1_W*rg?nn7%$bsKhiW#<6RKF7R{#PN^
zF6K3T|ENSIk+-#fk{-h8X}+F7u)x6#-wqgxDbDt|7u^C^bpsBuODiXEh&2}0!c21n
z%%`j(Pi!Yz%UWPIdN76z(}JD879Vusy>~futT&@NDFI^$4nwsp<-_y4L97Jk%WhK`
z0cqEI^#AS~I8EQi2W%|XH%1lxj-+b`;T7J9rtESUFT75_iz>KD4g|e{*mNj_dt=L;
z%`yK#6!QK2F_bDk4MQhXQh0ZWrDOb@_2~Cqf9yCG#l5hYD;Eiz-@(vo2KVIFnwz79
zmRFZeL^4(Ur4dosa3X~uCV`&Dd=4?a$tTF`0#;3#!29<mPTvk^6Mb4AfUUc4VcMnu
z^4Nf5OBdnW@4myd1(cq=IR|3{?$s3r_+jUnY-IZc)8B6p`VY~D|Mh#g;Zsi#li}Qg
zS*S=CW1#*T^2j<N=4fQbUq<e1PL#p#@DU88>t<rTh<j)*7W$~5rPsy<2nr<6D>4gn
zHU@KuX%CvnA!bL{v4T9f1@>e4`Mb>74;wu#dWh(cy$5b$<&HQ|S;zTRYw_K8-@?gd
z56Tk&JB=}X&_~9V%Wykij`&L+7%{j%29Gqv!MU@#cw&|_&ms2AHGD(+o0?C7y2S?M
z5d8L>Eani??PtqJC|+K>3EzC%A8V)1;GWn7tx?<)D+#TEiTX(N8>)f(o-KkW_6v$b
z>@R9a5Ye`xIgxo#ebk<ZSlouMUsZ!|RxOUs)54~^sXTs<OMe^*DeQn)slOZk)PE}4
z+N!8R{sZk_)&*iwc_N%!Xauv(_wafjf>4VXQwF|=Rac`q#NPSbfzG25Z#<`l%2o!k
z*Z4QbK6~vMSWH=jy&LC3t?!Ev6WCs5ON!I~+wT#ZUx8Ix|G@Se5h!_Z0PhW&i?&P;
zyztH-I+tR+K*wefQ|m*JXsMEWVjN->cwX&gIz|mzGVY<z+i${j!xdBn9K=5iRzX(F
zD!V)aTwgSoMdI1FM?un@1+{12gjiCIKhU*lVx!`iC#HbdALv+~(P{A8IUe6l+KVOq
z|AMVof~g!V#2X*jqB-djUi)$~>VgmB1Fg9bS4ZKM*S?^NJPmudyFntUgUS29gKt8b
z0I?@lMN%b*N##rBzOZ)vY<*%<C5X{_7Hcx3_4fWSCLSj3s>jqPR+TCv&r8B#)Zv9G
zJTX;u>kng6>JMWQ`osi?^<D(8U!YG6sKj&6Jr9|z`4O5EmHWe(ez`s|v{c|Vf{)hN
zRrHjt+^i_{i9NLt>*yovrJBkgAw5A$*%SLdh_M%-f9`=DER2DRc~w0@jP-y0ScrAZ
zTu)-@nR<p8okxb4(zCv@t`KWi7l0`sR+T~?jsP(MV!xPv8HjcEg*{52*sljMVPMA-
z2(bowxCnAviR=R257{NIC)MXw!A@@^w8zfpeO=}@Q!&YSB<yBxr@W}b%`Ak`ut6|(
zTnrKA*H9+I>S@jxG*S=g*%Ih#n4q;r3THz@looY8UQI?mOhycWt;+_q7M8(z;V$$W
zWr2c_KnxxDEnJr#=FOg!DY-BkISeDl*dm`mv(ii#{lEDZdHKMp4J+{9{zGx@W=6-r
zjt+=X{3>%RY+g7G!*s`^lt9JOY@9U}-}W1XlkS;l$g0NJ+1oJayYDb)@F18jxQXdj
zV^L4nr#iJ9mSaZ1)NU#0eucI13e-`aHb&N%W;_OCCvV}Pt4u70mBvU69&U!z#5NQJ
z`eMb}eRPiB;qaw&B%D7;dG~|crF`68w+Q)J;C*IRcH5D3{s7M2D(?hYTs~GFj3>_x
zs7<ZG%*}zcF2l|RbJ1_$5L~&IOW=|r;?fNa`R*IcTzrzJoos20Dq2<~)WcqT4Ac$B
zBRyJ%@+4sQ!Ugnu`(wwUXo4MJJi-|^nj>N9xDFMGG67;w7{osL*T*<~*bRr>4m?5H
zFW15E(>@jLmFvLwX#XA+?fwDnl55{Xw3lh8igs`v`abR1uA*(7+TD}3_Mk0YwM$i-
ze^@&=sc2)TcJ!nTJ!pMbZCBMgF1Ky%TH6b)>D1Ov9iq4wUwZl1g&3P{BjUtH6cWtX
z<hjams$zX$_9JvTyjb5@bEOQXwsX*221K6OhVV>4)7Ty@<>aNX^rYKcrXnFzzJGJ2
z1P1D(aeePfcttgI$(uD7YigUKh4N-29$WKEV6*BTT1)C-=5&ZWEeUyIRFRWbjkm(?
zBX<$u8;B{pLs6HOgOw+fk#g$<Ji_WwO`cO-q5Q>WRfsLOumwFxp{Ya)6SIxT^Yy^^
z8S4<}lLSLOV~F!=U^MS4d11g*OM(|2ZyGHd>GzuG>Y<KcRz;v{Ag|EMXt@Gn6H&*$
zE0&mz#RuZBZJGl%?YfRouPE5A^guy?4-Q?;Cr=Ns)VJgl0$b@X<f9gC46XRf&K2pv
zT01+?LsS<}j6rP8kre*zux8p%S8Ex3w=6_>1e>`7*yCi6+@xwa(zRkQJ(mQBWBZ95
z4l&lB=47f55qWbZ2@;f(M^@k$4r_YA@VOR;u{vW|A2IZYP33)FUYnO7Fi3#dlLj%t
z6B9f!!4p&1&(fU8ysKg<U)Glp90)Evyhy%epyTVbY#%JbAXif)<x@Ger*9%?HI|9d
zRG|=SW@LG?efdBWDW#S7iLrqvHHBinWX*?-l#eK%4eO`hlq(-PUz0DPFnL^6u7nTv
zsHOecP<yT-HXL7q6{Z#t@%?EZ)`XZx>*OI;w=c;%tIU%3jnz_EMJ8)9R5T|NghZKA
zRMN7VpjD9}q2mG;2DWI-q4Op1vF1ePRh6f;acGsXPo7Y^3Pm$wd8%06oR}^{S*iqO
z;jy^lB|<fMZ~M>Zpge_OL*eZZWBp*IY`8nAjJ&2wHiu%e{3Dm8iDLdSOxA?RKBifk
zK*wU+y!nvQv!+DyyebkU1Ti*zo`tia^|VdUDyJoDMl6nH!|55MC|ns}0>lJ}JyZh3
zx=Mi9(*v<zQv|Ty_KE#G13Tn>VI6Ak2UAv7XP;Pyl>5V&l>5TkrGQw6lm~RQOW6Zc
zg4n|bcC@RfJ~34ZePTW6DTkOu@@Qb=a~!fc45ea>`&OHBmg3U-aj0n%%j4O6hmw|#
zb>)4#hshzv^5YQWKx6YCD#F>a9bWC>3W$Ni7{ug2t3&MhRVb-%MC9ouD5{aqkJte*
zHWy-x0%im;HW#9d!exA0grqBLkzZYd{J`_55Xm7XBdDQC0W*Ran;%ie*DE24y9&?b
zJO#)qDZH`^ykrd(xU<m_)iqU008>DWp03%tj4j*YMd9*oImDzCCZ#loCs?DksRBti
z_MoPc_9ci(No@W@_8!^JEn6U~DWtGYsI`NOflVq>K#jm9rKOYsk3o#m&9=3mr+i9J
z5R+ErK|=77aHw@cEaU1bOr0?ki|4t*SX&1zRTNJElTaL+`>+FGv@WfXgN(g&sy%!H
zq#S7JkZ`zlLQKrV+JTlz+o`lo>rVv4$OGyY)(f#FK#Os6xrfzLysFrHY5LmcX#9a@
z%MSGtV)c3TIN_f4ND!+{Ex@uP@!cTCJhOxA&ZCyL9|d9=H&4SSq=`JWX1JY7{C<eh
z{jz`QR)n8Ah7wv=g;;HBBl`F6kAZ^*Vz|CDG6*<73^8E0vlFuU3(Z{tCO}L9t=|a5
zn$kV_`+kE54@Uof-y*HHJ8+amB*4M5zErQ5W6LySG)jT-LyakCDXwi9k6MD*?d>io
zX_n7*r#;4+U{;2Mz8OfleH^ZfjzC-xfS`PWM@PN{DuUq%BS#RWkalYaB1`Mwxpyj3
zMRZJ5!G5Y6S_;CERMCK%@_Y=@wWaW87}?Dss5QWQ|8$hrH6ZEoT2#|H#9Um9pggJ^
zAi~&*dr%#H8Cy?Wf{*8IOwiPUjP_MGV0pA5=&&mas%nsaV*|<>n~+F(<WZ%WdTTT8
zXHbPEtHSo3XR&+NK7vaD{EjY#55cP;={g={mLUE1HXOTn1wI}(p{GgLqB#>z8!i!)
z8?bA<K14l0Eau!|c*SSawW)!*`9w&IqY;#x15th|G_?(B-%4m|>QQ_hj!m+mr3ikz
zr=p^w454l_k(66V6<-#%xZT89YdZo_DXew1ASU3-3WKobtTzh%PeD{wf{M&g7#PlH
z%_z_uyP7~;iOtp~{N?C5V=XD~3Yh9>qdb?*W<cjuM-WwlSQcHEfrAEN;J`uXKf;PP
zJ?)=lhMKBkun!gLYdNCCV>9lC#<AuvxSH!i(vSmVjVT0*Y*=WT!`uBV?ws0)J(s=d
zVPPkls&Y^scNe3lZbDPyB`iO5mGUaUI9+-m;xKy*5M#}O*U#O?u7y)@^0WuMJTp6*
z03W71TW8~@UoirYZNU+r3XC2;0_mA;*fP-wIr+fe8P0q*`|Jmv*l;!lrQ!aVzQqHT
z32`u;ehT`UrU*K<6X)+0@Z)#p4IG|si=gNlT-!7Y_d~KURKo>zWfIt%Q$eHq^3MLX
z2u*0io{3gS&k`fu+Z{Wv<wBH_i515a=>90ev~@SoR3L?uu?_te*3763F<|>dYeXkB
z<HDvzSVjAkMuuU<zEITWHA7c>67MUsHeJcRI}2T7R1(;(t#d_W0x;En1^b)9Oh*s&
zK!hdsQ?b+047cbyq~AQlAy%DKgxNcSAWEx()55d-Wn~vLE6{@#j7JVeCY$_r>LlJY
z$@;-|PM*l_8I-1UHX+ugHbBQ=4K5zNgF|cA<Lu26R3(%`+iDdmlbc~aT8sCc*=cGZ
zEmn+kE9c<Sof_<NwC51Z^Lc<BM-otxR1agr8K_OJhpzJ;{_d9r6&f~Ui0zmG@bwYl
z(h67H^lB6!_7p*^UE*f)a#X^45+qg7G@AmCn-}oyf4@X=n-tE2jVNa+u5Nbb5UWe~
zg~iNua6h>NljtFid0o}9?l>Gwo<V5@<{S(lb|~k|ys%a*Ggim-+qdBAXpAU=n8z*`
zR5r0=mcn8BA(V!k#o}EjaDLAUd@<0JjwylV$dT~4a}5(rG*LnjOSrND2i?68dtnud
zYwGB<s$ofGja9b8Mq9z-#zkma&mu52!pLSSd1f^TaFatU^~M(LyL21L<dHFmNy_4(
z>o5nm&hEj4<tJdFtp|_Wm!UtTKdy#lpeFG;7VS8Rwz6obn@obol@qX>w1&LGYS`#%
zz~kCkD&M0X0<mQn=du9Tk8Hr=gSSu{=Z>kXcjC&ywfOwIG4#`_VQMm#fKrN+(=Bkv
zD-iy>r*MchW%*+4ltpkqxCS%#-hi#uI1Vv8BXw-wdl<_nnjk$d55aD;vG3Rks*}fK
zq#gmKG7*Lg*d*(P*knZzqkR@z8o)0i3J!Y4xOL?W=Gz+~@YWSHRgkBqfLP|WH8_0y
zByL?eg-x!u2v1B#vG0CNTD$>gw#~z$eODkU496%FM|hmu16|9RKy4<B#<)O6`)`?Q
zi~~oHV3ms*5>r#)zSIdPP94X3`d#YQO9^5ZaqyZCq?K71r?30?Al9xVkLxI+N>(+z
zyMXgcoDf45X?bJ_79LH2neFV3fgNFKGR!j8<$$S(jmAQ^DC9l3iLDot(Nfj`)3GaI
zsA)zna6Pogt|wq9<xP;<G|miJxng8^-^5Y(2-vLjL{qs8I%7;ADitH_{C@bxv_M<O
zlpb~@xPN#nX6_G1U0OC49!o-Hd^{YMTtE}0on>hY^6a}pjNrO#oCUJ!{30$L$BJVK
zc(8i`B9kSkNh`qM5k_dG-(qRB1Z_pF&^B2QNr?nor<miGe=QpG+hAihj`#Z+>gpqp
zK(yY<n!oIvp@3LTN-3sp3#N0)g2jxZe9EfDV{K7E*Ov|IU|(L|>Ewtq1~IB1w@(_+
zK`CNG?v)^Bxr7QyrWmyu%`niLf$I2N*v~nOItrU%Y={zqn8j#Al%|UjbnGCGTrTc_
z7@Glq{r*Tk%e{r+1iE>>vHesYYEzn_J!~*aGC@yIhWv}mX_rpn{4J3Hv8NDXzor<}
z?zpYQg8B10wAJmpyqWMf*e6z*;DLE_XJLUtv*s*8ZqR8Im$GKWpQleuO6hlRUI$ri
z5rjUmUfPq?Cl+vI6$X*J+pd8+_Wb)_UDEZkIq_kAV&SK@b~(m?F&1blBF~xuO}QDd
zUG05g?Rtdf#7F59t0s^wnZ6#0m(L(Iv3ql(vbyw#eQ$H3l7!|&0b(lZsgLWYN#6JM
zix2E*?j^*!fUIYT$sPi+_HB8X0%TphFu5nzA%d8cFMk@ugn=EMCJgL&2*kQb(HGXC
z#|Sa5c5o?6fS3TW9;_#bK_-Er#Z2BGr5xU)2w)L0NqoIkln;+vH&Ij1Af%E`+Kk}4
zw-6W-uYg`F3X;O%^B|ZG$F>{cb>}9EDnzv2gt~%6-0|>&L_+64;A*7G?9R>GXliLj
zd3p@)-0_5jfle7>ZT0XA3`30XEo2oC3<zfFAwI~9^+#S=H8LXa<GxQIPg|BA2vh6X
zsHA#J+E9YK?pIJ*Nf07<v3U-|Jlv6xmVwI50GL?LL|FxasIC}yuU$fUMLCBU`@p5|
z&C4ju2*!?E(Nu|NA}S@b17c_{g2UWnfTW(TWjSmo?SzaV)>e{&+gC23rb-SpSzQsl
zu3tcQRu;jk440Q!qpF(npt!tfA9&HdB4smp5WK`CNw{<6918Mt2zJE?xaWZ+pKFMU
zj)GKxSdaFTAyyETgmQv`YWTy%hQl|NOZmVKQ`^~eL1~-KV$b6tA2Q!Q6FsSs)|+V`
zHn4-e?92vsuspi=zp-$(uVTGah89Z4rX^$H>}6^>xai(2rDKxVc4KB9R-8`fFk@3y
zvDxj}`&>Ok41BnKLwXUG9E#)csx6Sua?ggy*Oy3PZnP2&l#caV)#p=QdE`A2z-sg9
zc)9Y~>T7c7_pzBg6cA%!^?71GM<Rz<CMc~K*|*Q*UQi<kS51}#HQDVTBOqo_KD7Vs
z&FfK`4TPUKh>T=5Okcuhq?bcXhFfdqA~CiV#fhz0Vr7nkbos=;Y<7D#i$^=WDhP7b
zX>3+{%A4w5gAp@PN$X{a>;-W#pXt6GVC=({Rml>RF@Pn=_)E@}Y#2YAxn6+SlMOKf
zMoUW*w2fWR$~+ro5cME75W>`DHP7Sh=6M*>uRqr8zep9gvUk>kq&xedZ!s1V9c{4Z
zem0ITF+pt`J8lc*(F_B}C43)dp{JH(+Uz-)J7+c)E?fesM2wvar}D|A_g(PB(ix8E
z-)|t!-wp2qF*Zr>xXJ6mzS3Nmb{B5`*>Ia-h?X`nW~dv|IWp)q!N_<V9i;}2Q+7jE
z5DZ<L379+E74zrKMS7VC!}ToaXVoe4tb)VDZJ?V1+ScRc>E_NxYDopm#!aEhqY9G3
zP!2IwPmDp#ZpMDJR2ES^l>(c|Yfu(+1m20+98jt5>yVWl58L&Z<la|d2-aT;Qb4Q<
zhb9<fHXU!S>ohD}wuV(&SZ1#e2YY+y4I7EZrfOK2(Qly&E%E$PBxL0Z5bMEy{J;)^
z%KRC#;B09Gmnn0xVY|=w&thK!Ojg&Hf32Ink43=HwQxZj-3!s@wj+@$ef?2GFm%We
z3>!WiW>e0<XZLKxWzw-&`ur9c>1d(<P#yk~wQ}C<T(mWe(aIj4C~bXq5zJ>_MQdpj
zhJH5?LnzPT!-imwdmec)6}YhfFkBriu;O@P$IH$co|oykBQSXI5DfTlKNKp1i~v?c
z@Ut{`Knp>!HZ=!J53|vU68K*6!s>-9F<4_PpWWWtbQK?+m=l(Ty=!;EQe!xL!&<T4
z(hS7}y30!@@``21kfHc?h!z1)iqPx+ShsjB`VAb7Ci*=l_6G@4Qlwoy4DZl3I2x*B
z_)xkwLx*Fe$$AtAJixZo8K_Pw!OX2e+!JFH4BP0r@=vXFdSWtoY?zP9ljdUj<higi
zodmk4U~6EAdIDt)LDNuu7J~PzLU1U1XAC&xG9HB##~@ZqupHg5pZxmKInUk{fRgB1
zT-<jG3&uOcaoJ522SsA@;dDNmhrOO2suCeU>^Ib$2x%*}9+E?=D8>`6Go~Xti*9uC
zwv<($9fX-PW+FZ|94BtYQ2I6mT{?()D>u<uhzS}ZESNnLcS2Gqt`!-9moa0;LR2>r
z3|pI#?0bRspMi`L5&SQ?(fV9ekjDptu3Qb2PXkOG=VA9ER|Hdq!64*)WIftiC|=x%
z>qj<W*_yq4oq1`O_AW<wW(k_h5;14m6okcRLdHC?RuOhBnvH!I@A4t|SN1JOXj%c4
zUzW}VA+c$ESUs96uyO7TB*aJIc6cgU@*;55i##F)#AJ;nST<`q=D1GB!o{o5RLh3k
zSD-q<2Q#KjLtb$)hnb`@9gAkU&;w}<WV9V}ES*(UTWz<6ixexa!L7IkcXxM!LvSr#
zyg0$VxVx6%P~4%oTX8F1TuOWL{o`EaE*T@)JA1ur&Sy>syi=Kj3r)jq?hW9VU3ahp
zG4jv*K$Zr(ITFOYjmYY1E~kx#EOqSM#~p#2n_Jj&)m(fH&yr#ZD_+S-pUqcP=yZ@X
zAP$Izf`ml4@Z6UG(ayoio{ubsn8%f)d6a&Auaq?^W187iC5E)1J?`~S$u4dY`8%?H
zBDZu=%p)wG<O4?a$>_;?ioOm~tTjcz2>QR&SCqIg3p?&G^>{DaSG28B-sNRtwHnd6
zH2v7W+W}#l0p=m87{eHYdwF7&XZ?6A(U2iVp^-RW;f67`uU&~``Huh-<v0@OAvmEe
zbAXypn#Hq>5jqJM*@LCC>yZncUQTv#S^~_?4DT4o20xEt++`A;9VcXmK^kLmiiGH<
znua@xpiVZTAv8MmL%)x^0q1beewL;IOLs*cETX&kS8UZEm?0u!o;yWysk!t~-*PVB
z?!384Qpnfp0{eSY5N6bDQokn#U`Q)uepbgWkt_no5*>$pE|M87$H6(IKh0&Z9{Vp>
z^K=r^CSGiZPZq^HBx$1=OuDpBv()_Pg&y489-#>fl4*#t=7S+tm_SlhHkieob7(d0
zw5qD=`u29PKMWaYKmXCr!QqDb)-33mPVCRM^q<Smy@O3NVzDsFn&Rz*`k+FhmLd6-
zMm!5M^*-}*7d(|*N_m1;f~TJnjw!7n&4R4+?PZ8!p%2qnJhKu1&7zAVPO(E=<pj_F
z9OeqIX0nr&Rnx9;H|nf-jSd7C=kldl^Npv^h0n)*WoT57n`+cdS&ZB}P{XQSz|&6F
zG6Q{w%`-sQCP<xis8p*{yt=x<d4uonVuR?vS}YM!Q39yW=npFa&l7A@-$MdZ)2z3H
z5b}eN_YtE~Bc>{sOs2AvAF7={qTFMzRBcJt)~q9Y^AvK4Q#P7P)G~7z{RQ7jQ!N{3
zht4a7rl1X3c|}}z29j@muBZJ-^Yt<Q9trHbn{Q`f0b6FBwxL6hVy1h(ZB=$iiCyS?
zyF<aY^q_liFh};)3g{-nuKA&_!oLKwNPJy3c*&=tpRnQHjO|$c-0vscP!c(hik*4}
zOSZDJV>C84zTWh>;h_9-GtK~Nw2G!_wM|v{*wET~RQEyDfFBZV)WKijC=}1}eW2_+
zs35a`LCa8yb88Y%U(ap9<3fD6Cde2bNIU8KgrbrI#7iY-HRrb{PWkpJtgeaHM#XKY
zyeTBDoCK-7)in=D9J_fr7nFyMkj?3^Xs43HhhXSOk9fv+o>hy?kiq1Gy#t5v0l8fu
zb3a_22JCV*3}C}6)msKbQw42ivQa<Opx%8aaq~Y@QOOh{&o&%UxDyHoX3HtC*Nrs(
zCd^blcD6W_8Lb&zJKP6)ji9ftg9gM)P*k5S1Wxf*;D8T7OT|t7*lo*2Ot)goW~gP_
zwc#!0NO`><n%QjUT2X|{VPtWf{VZ`w{Lza;u9;m(_PRqeq5QzaGF-iO9`tM=aE#=~
zZs8}00e6Lz_Dll1J%MK=M*qhbBS#F<2tOoAIB+5|_?}K;r=MV~c%u94$EavcPa#t3
zWV5+Q5Zx6icUvB&K8v%8=>a{ZPqH>r%^a--uQmA>_1GzJuk)5?+#;8}OMV(`K(0!*
z$c_+HLJ^tpU9m~;(~~BjZu(r((m<xIM=^knVU#8#D;c;-#cKEk6C<r&s2io#u%xI;
zm_pXKkAy`U{hS~B&NYhVJD+7AwwG~l2FxxKKMamL{YNhMOT9Fw2dBPOZkE$sl08fX
zEJWzk1HlPH+W%8W7D~M%upEJP%@{i#(ler<V&;=J^#Cti6LBY8HGugrSQjkk)CiTp
z>{r4B5^w5HO7Lxe?f-O)`xiP{U8*E-_N&kQTm-*t?o(kq0!xPZ^)>MNj#<{(5P^rD
z@)$t~Elj(R*PXL`N>su%wTPyOWE!axP~;MymdS_zJ_39nX$cTAM@cZ7z@~a&k*ck&
zMTa?XcY<Gzaz5>xo&D&pptL+ZJVeCTA6_1;V^EKaS0ht>1TLMJ4ESq}_F>+Pm3mgQ
z9VkxnkVNu@+RBrJuF8nTBAc`!%VX=Wg@1gkL*Z~PwNwD=ZRhWyWZtRk<c3H}Px|ys
zU@wsJM@=^oTjLyGQz?hPX`>5RwXG9NNgdBjdo@?#mDLSDWw``1qH23@l{hmQDy7aT
zVQcdj?<<hZ>g2{vj3^1H{v2FT-E_~P?5+EVQ-?^u0QCr2Cc%H9>_-R%gk`9V<5^-G
zxe5hGNh<xCVki+j<iqqC)&|i9d~VmE%fX5r->BNFk#H^+#`GO!p`ss1FXOYbE8nJb
zmNB-Y%I3PXxOhgs<938f6a=qmA#igGt-NRr<(Y&Zh`^`7oK*-wAUVU$0X=^D9NRO(
zf+Vz`cwg?sYZAOYzrgw+=ZzRopJvTpB%~f^lw*>lK)|=rTc(7DaIY!Q>xDxx#OF1h
zbN|EsgwY1dkl9L*Hen0pC?}mwX1=YJn`k1|eb#cy=OR4wHi`U4zFpt6x-F296GFhK
z_({gso8_@fM-({Y?2(-J0YsX0s~EbbUp)0I_bf#Vdgz4YYmPWzoth-8O!|SLdG=~?
zrP+$o`Ebin70gF?nYc#*AnmYo=q*r3+x!(hPOYbc?L<TH;=2?28G{v_Rii+*u-t=l
z9t80xwV~!y13E^%38dMyxI>n#qkk!S6U6M1Xkf2|?|nqYoXQE6tx+2|mIF)@no4V$
zV|(XKOA%Z+mN>#|GLz0qHo(BKCMl=2oAjqYw;V}dA8sFGMPuF$j%08V-kagJXQr3S
z?t~=jNBxm1@o5+74nPFYx3EF#QoemYqDA&Dyb@hkr@rzZtE~)A9t@yB28P6AEK*Um
z^3yeXVTx|$f;hJ66P4B}MwbbuqFKqeZO*iW#Bzj__k0BWKdH>6Dd04#+OLX4JDJMD
zD+>>;rabm4Du5^S=hDWIBgRfLF)mc2b#@`Y0-pGErJT0pj&xx*RJl=bq0=WdtLG*-
zy2&t0kB`M=+5B`9pj&G;N#)>G?fG1VFW<Af=ykAFRux8Wa&0I~Q@2C2X#`KIJxDYR
zB+g<2Nt8b_mU*IkAFjodTVPn@HtR4B*+BKrjbzQMIKCE&=uhV05$`B9kvwVmF9(bv
znWb6rTuV~W5l`XEJ=^dVW}7d`SPUO5HP3*zWkz?4|B%Ff+#F<9axC4J7@csU-<boB
zh1IAi3^$f2GAg<3Y!N!Dv8vf0s6x)0Sj(6&0;(Avif{T2ntnaP_xSU{<|qAZnO=QV
zt3xJLMup1bYAqfHJ!@<`Tv8@=RLYjIY&_ZK$=Hf*Szo<U&0(_bfgEgu^?`PwG@M)z
z9?iydd{qTca~zEXLo)w}SX~OMY><kyelX1avqtq$8mC6a<JzYlxjMrEzm#~1=a^AU
zsbUb*)1b!mG6-8Mpuw0hFp~G35@JIES3^lGem*El=Rfu5Ww8A}1t`7j1X=qlZeKf~
zRA(tx47dan=8M!-WP5>-`&Q~khNOm`=KKL&S)Klv3x+Y4<X$5BFUil;_DuD3KRz%F
z#%fUblm4O!#fjBMAIzw*Jab|~1{7#(!f`zF=(t0mYp2f*em!hvpP~R8F39>Ba1<BU
zTD3oPY|hQ|@x%0ASs$Ft<XMm>avrFIe?PIqcGq!;?CYPq(#ao70ewE1TtkfL&ejbL
zhLY;DPA35jW1t=+l0jhL=|`2E^Emr6HFx#6e&vaxazr3ud9Z=O7>+Tj>N#wOG;B%?
zc0%&!6YeH6zcDyJ)PV6N8m}GHBO;~H=~zm8LVxZ-sOSt>onjH~)~!-E;f!v`opLkW
z-~9ej3bq4P3}<Ne3IjR2;HjC7`|v=L<&PX3XGGhb{%MrbX{>U*13ql6g2Eyy!Q0qp
z@3PSK9}1*e_P)btGmx$n8~wN6a%+!LDv__FKc7F3z>*5mBQy2~THKx1Ny7JBuo0%&
zG81<P<;+iJEmm6@5M^-?TPcG<_NC~jdZe0U?15d_sk}uEFhkmoYmWi`uaFGb6zDkp
zRQPe{o%gwEq~`RfoAm+@ER>LPmsp;k-@qaqIp}fVgGNDf!l!?`9k$nhe!MY?6Wg3(
z^%+rONC6LjunH6bo@=`eEG7!=C$0yQiUxr`V;bnBLV#c5Jh6fP1pq_N5iqmiFqkL0
zx-(8MTnAnhK|ZLK^&3JvKszR&w**peCv#et=ZZB0<9$Oa^r*Yi?n9y*?EmqeWUBAK
zLU8LXzkL#N55%Hs>coL&ESIRwM@j}9`Ss1NQY7z6qO`YCB464T_WeUCj;%@damI6(
zQ8Fct0+A<7^GO6@glHI|eeaM@I^K_@g){KPL1=gh;5=N7q-~ni+}MN{_E<Jsf!DSq
zm5F?!KItTF-HHjhq9C$LkFAs%9~iOhapj^^{*}%7a}uzd#=iN8Mz(A^aDky#=~Bty
zW8G(Uj)VzBlC_2yoW}J*a7uTj8}{Ab&4N%6wDm)M*_6T(_5vhmTGxq7LU<kd2>NE7
z*sBNC_xyZt-@*YZ#;v5uL5~feTj_K!309lEg-dk>uUEz1Lx~03o4m<z8*hWNtpMyo
zh|%w$`Kkoq+N<$Ln|GLO1<^lNLa`4D{)Jt|{@mz(M|5d3;P{UuH$Wo-rgq0G*AA1&
z2Obc-i#k$~arfg+5&a3h$9+qx#8v@$ynl~F-H;my_d-$*X+Mdy<mdX{15!N<D9UGw
zTCIz3a=mmR+;cJOKhXU=muZCf=0>WK{q=*_;In|pPb8?~J^mL8|N3L<(MJ;YSADNA
zK+gT3@dn^M@qMNP7m~$qT(W%osIgU{k6S%4bwrIP_T1#RkCBCZC5T5&2}L5^aE6BT
z*cmZUbE9`8jb}x5-%&7R`+PD2IVphn<G;N!ZFmXq@BFV^41!N8<qn?xz*kj1Y4jO=
zY57MosDc28=6ABF@g`Iw*+iqH_B)ai@9XOf5dTTw%y)-zdNff^(4_2iU5hln6$4!}
z`L3dx=Cej~NHOGuig=(nvBnwwYXeBu<KRhXtF*ThOBd$l$kO+gRq=kpQFg0hNKggy
z5PfY|6mxYVZ!dXp!#f<kcy39urQ`&^PDY61NbA~<hOu$X4k+8|o>Lg4&o8_{ILw5>
zJt^oOH!imoo9qUtV@X~8%fdW-<l}*yj^&d%Ua46}%v;60CUz#4bk0;|oO54oO9+{%
z^&Bs#U68D!|NbD*OX_@e(!Sl38HHaR5nTHVQA2Q4EyK;V*AV?G5E+_z;lYpMy`WCB
zz<@lsn5Us=kCa_2g?b^rwn$hdS=SD=Ag|wc8R`Fp=ejK&esbH^;N%GJUhgZp5Wv)U
zm0{7>pvZ`p{-%QMIH2+4B2(l<SfQO%H}MN;{Q-~*Ub5)Qdvn4;cA~88da^Q7K_@Jd
zep&qE;0om*1bL3_q36R^lyc;MrMJpS>vE6X<NDZ3%Z26TNUHJZ*gCTMvKI03ggs9>
zVV_u}t4!{B53KL7>zVa-b6}E7|A0G5Xej)SlZ(RnIoaBnO{sWKABp~zXy0B{Yde|t
zJRDTzo3w!IF5w@M8OzhI^oIQJs68uKmJ>psSsNEeOvJzVRW3*dv7LQ!==YOXt?ee0
zW%!9g`|5iD$7gvV5NO<a5y8eiLfw(pMSU~0$*(dLb6X_p1NIW&TR~LjqwF6x`QS>=
zNG`bbiqmI0>%!ij2|Pmab44DMZ&FX;8BkQFj23*qDz*i%t=}4{??`}5vqdugCM;*&
zfSXCp0j^Au;(6UACuJebIJ2+%9gs~s7eqB77Q|G>W_Ej1vY(rwdQ?nxePMkHQIFyu
zp|Y`Xh@mRjK)LBbbygK}QRXervV&zpBWSCR7M6Aam@Y}7PRE+YYfXR}wM}W+RaBUH
zMZAdD2_3%6WdIxp_Xg{HvI9|#ossZF1|j?lN8dE$#iT3KvC#cEVE5Ys4vf_l<qQ7J
z&t90+g|>8k39mNQCavX1TD=Euc=7?S7@RLyXWA6T<{AU5@lqR}H1Hb(>n+;+=?#D6
zSnRh)&VV_pYD0P!_;|z+!7kcP$+>fp*>_|hHBV_1C9ZOp_NcE)z*;9`b8|aM{;&Ad
z6_39S&MA?Ad^ht7qsi0ip|l?75^=%#^{AySTH$%ZapM~Z&!2~nDB@&CF1XuqXM@ZC
z(8rM!W8VDHB+Nn~4Yk#lW4enUz5UDQfnc<VXIyTy=B_^Z`Ix4(TnXC^%#vU{E+yRq
zu&lGag`@KDj_|r20t}r`sf-~YE(?NaM2fQtHP9=D`89U-<H;GcGzwsQa;X{w@RI%A
zwJR@bovapF_8uaeG$~IizdfH4sVoz2>E=V<?;mvJO{**jDg@w{!HOn#_;0GQI8p@P
zXF5>eTkwOvuSly8Lewj)g$CYDH3ztw6TvYe5@*cpHv1DWpS%#G=f$123jqW!<#@^c
zJ6i}YKNTTodqh+wd<rZ3r4_2mR$hPoD>(Cv1m3e&298s3C}BD?rVBBY4OUdV4)-~c
zkhPgh#vPK$JOvV%?hQHkkkR04#-+;z&P?Ew(XAx|AL@uZU;<$ny@O^2``+E5;VLGj
z^h)j}YTJHh*EObly`TAOGCY2AlNHbGSE|SYRIq4{!VnTkLw$`+GcZHe0v((ux77l{
z&?rQH*6SEu>Y=RpBkP6k{j;uZDzcl9{KvlmJr%dC&7xm5kDfgI4{ECJZ<R1CB;4$0
zi1ue%6r_7dXU_-rR0eOmi9OY8!DigLsd$~;&(3P+>y#t^g(+hDtDp(BQk2LgoX#rj
zM~lNI8@`jlX^k4?e2<4nuXh*FyJ(ySZ&kp`VJ<q^!|j@&pMx4Jsxp0&9e9yZl}xbU
zx#VT2dI3(F&vF8#v)p*l_0&*t#b$^i2k+O@#1upvDhOQR27K-&fsI{~X>vc(-qB~w
zGA#SQ3d%7&D0K%A8`c-VL%o@N%}qpr)}n&gmUw?AUi<!ovd`)$;K1ajnJEm*vWW=b
z2`wKm`6(Q@IuI<51U6>Q2P}NUfV#lWDJ2&cSJ4LRQzeI3y$mBF-_n{{d)Vt)B$Kug
zc=)(byvlzCsH>=0Gn4PN5|&0r-UeoY_qCr{AB*6yG(e`qj~z`v-Y-qn*_BPS)<fZ(
ziv#fW(r8z&#0;~U%#iArg~Fen3mdgc-+|~tDSb+cQvy93Q6wL`HMNx+v_e3pDpcuj
zI^j)4|JYjW7?mWw6zRbyA|G`HQSN@rd04UyEj@ECbIWS!v9HcPx{7lg931_&xI%ZA
zji!d6MAJa<`*dai(Zp*9NcuE?LKqqwn-0Q+QJmH^d&VYa!t(}&wsHYSUwR!qisQ*m
za*$qxdHU8Tv!^OXqn4sxHl;LOFp&Xa#%kgG17U-V^@xWtM>0s9_OeLums>I>5oG3#
z*;3)Y+Y;_zvbTKrG?`b8JiIW8tMBIAKR;mmLqyTR!@mtGt@<=jzhq`Jf3#yy#X3I`
zi|r23!zA49nL1Lp8a(+v37%;s_-(8-6&+CEK2c)44hLNRGHNsMO*=St%6!IV!uAZy
zQSAVH<(RIJ<afa-wSR~pyn6i>NyCJ!FKq)PBv+KdsB8M%PJ%`k@Fa?0sETRA4NsJV
zp2=}rTFC$twI;N31p5AXv&+auh7T$a*|g4-d111z7X<5P(Efr0r|A<O;t)gy5_zDi
zIWy`?)Ci>}s6XqK<FG37Hc#19*uJym5L=mrGHV}%2{CIOZV)t^jM&t}c#oesc!EPG
zZ7`p%mY9*~VV=^cdXk$@`a+|SL8u}8FUFj_N(J*UVUW;7&K>|}ku&f!Oj+O6RZ6nl
zy|}J6AN*@Cj#QTdGH)GZ*3mLupm&i}#LweCT)>3x0n9_|-*dq`Bwgymt4<L!TDX3w
zxQ#Cop|vK*W{C!e36%zjo}H?m3u>|=8wli)4ikhc5nLAspe79CaA7vkC>5x?IZ=&$
zLIux%6<S=>k>0Swb#P>+a=8fCR6hl*QacV79cpueud&Ysykhw+yh}Cx)&zIPq#%ZC
zKgJ2Vw$C<G6!Evvy}V3RaycpR7*q$Mk*i>zjV2NTNikgf_;cvjbwE%(Z9LgYLkFPD
ze&jJr<#kh?eI#uEtPtqVX!Gs!U{-t+XUf#Q?=^hdHXe-TiLwFxo@sATF9mF<$nL%&
zbg8qB`csCwkJHjf44Z;N0yITO8V&ZSLq||BRLHL4V40TYGxr+j4Rcb`qKArGfHUDH
ze#<bG>LNiWo-&W(+w5QyeR$}Ptr+$Q$aIkkCiJB~9}tz9&gP)psG*$}GQNLKg-18&
zH}(FRad?2U_B$Cmt);f$CQ7K@SMSPb*n+Q8xd&Cc#w~N_93=yFdTg8{cxFzwp}BPg
zq^<hIP<kr{o#*l`$b`c3xLvg)KnRl7F-_b~ah?{o;&4Bfx1akB&MOk;kVFrz|JJ4i
z06ixeSZtu%Beqa}4N9c=xsoEF9G=a>^v>U{XGjrRUbnbjt|l@qIXOB-(GRmmy{R1O
zxEqQZ%SgSLiYUI!%ucG6S9rCb-wsqGBdV4d6`6-Gw2z^y!<aQ{A7OcNs>5{+*#R+y
zw9<dpoKf}(e2HCPQNv~I37~Vr!Pg-|${4zLEz}d-Xu>O(GXMGwyTqNRhg2DF9tZ!n
zIL>Bj$9L<0uqbtmkz=m72n0WVW|LIn+EGgnE03g?t8v`fpeFI$KN_%qdvnRpgw!Xu
z?D8zm@iJk2=nql$9qSB4{rra{>1rQARaw8?EKc&}khYy@b;2wXwhm9|`mXP~B`tHE
z((kw+<;R8OB!@ZrHU2n>bR#?nAxbiE(avuEUfidrkaWmh)Ma-skEGgl0Qzhv6oS>T
zupmz!q8WICa=z*ppKoXl^Q)zPNucZJ#&aRX?3eOKq(B_wTo^&rZB|#bqgg&z44x@3
zYd=#CrUqFfu1MSVNyL@!ClZSyY3ut?@9nTZZ84bR%%XLNLI0_^{m%@XQZGd2%;2h;
z?}bY+$2Lp+1%(dBbDBB})JaFEH>jc^iM4;|nM++>lk9&%7zG+h&jE;O;hoaTTVD5F
zCE;QY{hS;q@`?hgeL}C_!nZ6d5k#}!-s>}-G(AfE1M@Rd=uR3Lb)Vtu9@LGYccL*M
z`y<lNPt}MBY0gKIH|c2@0&zt#i+Xe~cXfxhBh(EeL`<}a%eCmvy{8hVE8g#}co)}q
zyiZS~uWQ7-7nHnKDh`z%&1wt4W6P;@85{a&>u>BY@ddJs1ZfNf<|ll4Z~@#5e(Ias
z!Zh7IICSHv!vo9PkkCG5lOBB%kUBO{#}Zgc(g3MlR~I4Y<up(p$JK)2(fe7)_c@oz
zZazNY_j@(sdFORXrbh(;{w@Ww04*O#CYq3#J|}_?gF-($!`Wy)Z@c|r*0nm&O__Ev
zgS=&kR*B?=$1zi^tlbL62@IixIv%SJ`!FDPdhaJE<&WoJZ^Ynn{`4iQ-}<nZPvq}*
z|755?Y1m56<p=(z)*fNr`31B9_8Jfsh$D~ct3<pRiaE(m?Ax*z83^R)qy30kG^$@x
zT?@%4)oPf(fKeJzYl9+C`K)2nv~0LM;Hkz6r-V0k;Ww_>z@Q{7xkQaoJ2pK0B%(zS
z^9YDmG>(EB>9|{&(<WT(_60gLfigU?MfnrKgBPP6MslQ~o2X)}%Tp#tvylbYTe1PQ
z0@0VhN9?Rez6S_8;ImFSaR%k_HwLor?}bfJhyZskx8ij=sx5yO`=UhS?Y|ts=vP%|
z^WHyvurnuT;kJYoT`Z@~DvF&QiL_-V(%6}NU=jX@*3IKvF15^{v@a!-3LCjt=dM8R
zV{GLfH^M<Lve}dkbZ&CCxN@aGtA|d^t67;HqNSumnJM4QDk|3JGFyB^AB@K&kLqsQ
z?+f7~`sZfppAsp`qAys!_Agn}>&{!cu6HNROauLE*$N6=ZUz>*t{fi(NZ~VtSe-KZ
z1AhorCIV0qQklp!eo}cK3r%km7BN!A)mxycTb326Ze^hFtH$|?J!pFm`aMY)x9cM4
ze?SnD#{dySHLX=M9g1dbJ2=o{MkZkFAj7O6$;lj0-tyl#t4v-8WR7;JNO6UMfrK%h
zaiBAh2@yzqS!)!{8aj*ec1Zqai4LC5Mi6)c1YFQx?QN}3spbG}4j4}WDiUx@{`UN#
zsBt8K5|?0<FTlq7cFW`6G&k+R244w1MHhiy)4n&Y!NYtuA{;EVmSh6D(PiFpV<p#8
z|2*5-?_UcdK<cM1y_2jD-M{cGXG<t6u}QDzrE2QX3PlA2!2^8>3;=MV^is!xZ<78}
zQS<sGm35Lf55q&bdM#%MNrz&oOh*itp>Rm~CgsTD7FKyJ4BM&YR12>?VYZSTPbXiX
zipp~M0!Vc?1A!4@Qt3=!J4l_E!OYJ4=;1aR(bDQzB~+_k?*b6h@S$w87Rdv<ZUxbQ
z1MdA+P)i7TVyPNrN&oBh{c3yoCAMR|lmq7Q7p(u>QVb)q_SH(UUw9#k<G0n!?7?aI
zm3X+?>F<_>A-o5pG<SbZ!jrX9@u+K_eW~cHrsch;`;Vxx@yZZk$2ZKf8EM5of#J`7
zk`sG=!I{k>1kc2Z*hIs$V+(n?@^D}~-$jFSmM>Wb=fYi_T5P^5d0UxM;y7T|e73V&
zRIQ&>a-*epqLQ`JO8J@0upl!la%@X8f1A_bEUrEfC8!*+7#)?;`=17+%E#i|apvc{
z2NsFiSQvtAcZLLXW1;k(v4LJqUHdQVv^&IL<mTlSm06%=sf1>-7@1o-&WOvf==qt&
zRa88|(aLN4$)DH}7wIy~NvmPAj;s&%FO#`!RbkT^M?~b|<>rzBb49$b?$GQK^HfJ2
zMt=VEuyDLW#0WHUuXf*Qyb_DZNUCswXFx^<WUIf=G5h^;B<Sky9SUvblZjWoUKb|7
zT(-2ZwGT)5jOXef#UghGDDINmO=hAR2^MgeWZYt{{#F*X9%=YQ=^1e=fK1kT`JT-g
zL15hg+_J$|*n)B@jlN^0ZXchEQcV+{Z;b5E;19~lEYi}6PNMbL<ynSP^VXZ?Ymjhs
zX0O%Hjfe|w`?*B8Pfl)b@e5H=n^#Z0F}x`i;ZC)D=V|koofWo@1na0J3$6#M%0a|9
zGak@uMpZ1ip*xj)^J*)!J|Fc>4DVd%YVft^<qXs}XF+zyW)sZJzqt;~2}&iOR8`f~
zHwY)KIX6EZtM6dCiyNihxi+>sI@Vfe1qjuC4U55d^P$&ja>wragcK8dgOdLYum!{E
zB-@sw1L3z|VPU(inSa&N*RFqxP;~g>|1$~(_4OZ)O`c8pgLR^bc+Hmu@K#l}Cy?zj
zH>QWc$as^6f!QzvP=-DRLm;`p)Y|y5lvUFzC8!5`J<|IRZDs(We=_>*xs#@GrROBB
zdHjM-tt(W*+?b6}AZyU)Tq+GGtr{1v;ddn#&r%C^x<))I()y}5V=&eYqxxiIbUnQd
zhxkb1v0ZUIwe-D)2~w_MFRrDh3O2Fs1_s!vZ&W5KdR6cf?uhDkzxbS14om;C;6h=2
zRpK?oP>0?MJebhb^(!$@;I{ZPFTL=L3^`n#ND(&S%X((p9@*(UbHkoF&nefbIrk$V
zu6bmqFB*i|G`|WD0-Ox=x!{~!#SSTtx;b6h$7!s{xtg<GI-3lLN1l)`#ys!mKF3bM
z%$=?V`|rO^eZawAUxtGY1i#B|Hy!EMB}ff5v2D~;G~f7cN5R8Wi;c4gX|&q8?B53f
zwGfCnY_&u<^;S@p@J$Jg5R7O81v;GexINP7CK^7?1;iCAooty*@R#E*5K)Hho+PhA
z`9rZbVS1^R9~kz9cAHLvxAoqA_l=^a%QRUtPsD|ymqZz9O@nVFVl=f>DN@}1Cj8sQ
za-4fG=J&AA1Czoo)H*BcoeLY>L2B!fFQudc<ZACh%ScVA=i1!PoaDWbuTubfq3G#0
zVm51oN<3@uGPQUpi0Qoi;`j|5t<Oi*2Bq+`VYj2bV!7RN*;HbUyb2*^tg0%hRpNBH
zF)aj=E<9|dssqd5foupYLaH}M6UERYB|vDxq*PED%A>c6R24*3Ul)rAo=Vt^B??0a
z7RK^=iTN>IS86)|UR?b_Fnw>2CcGdsaT52Y6>YHL-Vae%$-ve4bFxHgxSQiD5%kxK
zPI-x@4q8=n!fEu!+U5lrH$h)lrF=jb$i|o8&`5f;L?ATl)!j%(=j;9=y7D4qwJ^~=
zlbCct+Z#=VXns3f1X@{gt7)wH&N8*5nM1ewzN3<HV)%mBn~|MKM*39M_&Szey#`yj
zeATi$Ry2>+*TsbDYkaMvV{%HKs@pTbkuNJuX$fzCPZeU&OAb*y@srOlR*F|8ms>Ft
zRMV~fG~pfI6F~S1?xd{goB@Bc<{>Qmr8}lvFQX`j=i-tbSIYYQmu<<3@D)d()tfIA
z?+_39GlXhctidugff$X8DX~;Z3{c7}hIBSPr>a98mNgzA)^UX^?ZE?i$K7;qN0rG7
z<1fL#Rq>-<cL&~>eXcTNlNyu`hV+Z6I$A&Uty9}L12I)~FmoCmPa-=Lh8!z^)Apz?
zCTPJuM?8xk%PpZstXFtVT&Cl%eNJp-b1I|!vkis*s=Ik*U%{7`oQt-L12$`HnBSh7
zzPlB?YaW;*apcPl8GVjjb!8<+wSC+(HK+ZT7F%=#&tuinZ_WiL(2bML&hS(LT9xM-
zH8LnksIO>b7@_jMbb+~Lw4c=+!++<ptO{?1^zInv!>d5~q(|<#+XLDn5hgzWz?G4K
zslhpLpvoL-?owPP$@DSwPclNf^EQO_?E&X-cSuG>LiM=QKQ5CpkR}TmM%>{G-a)tJ
zJZR?R@`=wrYoVVc<p7??aUf_|7aB@(aFN9E8S<Yc8fAM_8^H9mR9xR;c^PiH%A6EU
zi(oKwPHA-TV0i+#1YLQT^JhFfQ(duQ@>IvzgT*bI)MVth1t`91w37ozPw6d-DyFm*
zM4Top>koE85|T45>2MFala4{-K65tSnu0u^5sIUlj53ZB8K1VH5aB1&G=7G8HGGD>
zsc5GlIbzaekpA@G+N>W>lm0stCnpoB<7KK(S_iK&sLi!prIswxalG;qop-SWze8vP
zre#{ye%n#c)MYc{!<YV=x2(lIq;mYEc2Kf*8gp=V@2Mhd2FPZaO(Vr<d)`k<{br}<
z6t#+@Z`}Q>e=t)%N^ae3E)5b1#$?a0z#UqT!E>`qSo$=I=l>DMX#$n=eHL55M@vZu
zjH@5j({=K^{oxoT9Ew#k7TzqBgfov!c5-S;yiq1W?gWRD7P3=mdiI2`O4aYQ@!dS*
zCRCR7m;3%AA?E7g+s0}t`yMhZUDFTkl`?O2ja`=g8A3~&+s^8}Q+bqEGZrkE>tX-)
z-T)E!6`53TyRwvCC?Nv+-dC)Jk$S9=`oYOA(A!BchO3gM1kEIkPEJyZ1zFeE9Rp2!
zcq|&HNJv?1f|H>fUe>-AwIM!uV}QE+*bi<k*)t%<b_&9~rd1k|aZ6Od4JOgZ*O6b5
z53TlO3Mq}`rzMnIxL3g)^mrA*$L^b;O>rG>A{mC#yyWF!vnV^rIVcFuE35(8Dy??M
zxzgx(Xn5O6mUOlokA@u3lrf7v%r~O7tPu5Yc7IzdO6a-1=c3IS4=ZyH)kP}%k>Dh2
z<0|ND3NDS}{cSUZ4sU|$2*#%>XB17GkxKxmrJtp4Fg$1@dwXj7e*s0||8MW7i^vXZ
zu}VQv`fr9*K&+x%U|6mbk5e4RJ6on4xf2Zplhf>Y{leN01T+5!C@w$VMSCgCVU@F5
ztH&wBUTY~&@&2R1{bse{p&y9YcVPH`NE0pTp7X!(vCCKM?bH!BL9vt(?}>VbwZAB9
zW4xEIR&TEH){R=4{_TxA^Q+YpjYN$;?M{9v&saa!Yvlz!$C|&_>R8X4d>#3(Z3-JF
zJ@{$pt^xskF52{4Tdyd(t0;d@cetzB?d$%Wf~lAK@1J*;R9{UZUM-dq5ux)Z3dRp~
zGs^G5#l}nt6c`aF$y7+W*`j#E2hqA^D}96C@BFFtvf$2*{c!o)&KVLhe@YUXp<`e;
z!#sZd{noTf+GE<Ua1f|X-}8Q+@0ZMXz=(V>q=ob~)Kg1|a1U4OJ*uBn`bc`p*SdB`
ze_L@1FdbL;^T^I!XGgmS2PV*>O#G>5^$p>N>$xF({U@`y+YsJafFL|I4jl+w6Y&Rr
zXQ-G768BB+prvVbKR+yH6=ju8Fxpd`a+S3UNfbkS=%+wLHxX_p%!W0ofY5enJNR#m
za5E?=v9?cQa&sr5`Uw=r<0k7Og@lB)Bny@zj^mk{HO8C-F32kQ5My!_gq(%wDm?T=
z(_Y$FswfPkTzuBd)PUE%HLxr7ID?0Zn1`g}6w^#VC)VJPyC;$leF<_BWvPU@2wwId
zq|=PiQ<>yZT<T^Q3nIFnm<1e8ioX_$20bV);_+bcu+Al6sd#5bMURlQ9~-@E8{dB(
z<<h=_HNQm*2xU06*LTHqow#R`s>|U?dMyU;Dxk28iuga9V<I)#x8hMLRm)p|jTnaZ
zZh)4D1W!NXhC5Wx+(wPUxrD?Kj@cBjCW2p1pp|s4B#9(pPdo0c4W-*MvzaRDvQ7hL
zSI%dy`+9JDE-w}@hGuE<$FPoN%P|zTs0Rg>MJ<xLPp^Z=rZ|K~#58=T$Itk&|1|{S
z)wVsPib6AM7?RWppbkEt;YMvXXhe-d*AJ{%#j{qO311aqvLtKi(;_;nIBvwGKatys
z8igUtkZX1qPNbntQks6h&rMI%H2BNdFq+%=lpRz3;9`fZX5Q>=UqUu>U+zN{M>^Hu
zBRgNN>OO+-^lNm|r5lCtG(%C=Uitcrd0-w)XnmP>x}VZ8VwK$4RTVha4UtY|)ihN4
z9W4l`;>D|bp5n}NgFDpJ1bNXQ)Y0LB5{V;>m({ZkrCeG+7=AFc0Gr1ubp~0k&4NPr
zlbPHh=`wP=J1sN^e%m9}Zx)Ecs5XKsyJ3pxyhO#>JKX&fkr<J%F|9qJrNryzXkI94
zl^aqgmWHTFm_t~N<40(ebnHb$ip6kURdaq9Z^twUFwuu_(Os{#;P7|l9AKA-@F%oM
zf<PZcQ5O5$wq#`}e?|&pojg{wN(9cLJfPB@VC66utOecTA|j3dCnfw>CA5@3AqL&i
z-Y6`o+n{!?A%;CBs+Bt_7jnl+*V7b&*MLD}p3Ns9w6!UrnPV9p7rg+oKrjvb>bY;l
zZrdmRo64T^;0!6Lg3K7$JJPRynuZx<#8H4LDMTY>Xbq!?P<Aai*v**o->>>QwV@sf
zvUjJh25{;OP|}OV26hBY%ksqr8kIGlu|A~VJUv_>@x_XkJ#QJDE2<KtsduD3rbDfj
zVWt-R6;Nn`!8z%Vj{&OzFzb^%2Pq>40?0Q_oc;Zxn=4d+Z{ux{8cA%khm{LZah2`{
zSvp$y9s4n$yQ~3Yq&`Da`phY3%GE3f1GBzUgy~TES7TY_RLN~I%#shBUD5>c)^P{x
zLY?^(tkz}l=l`OETh^LCl?Rk#^3{muw3I})s<WFZH6Sjl8NlO2K-UC?sO2cinh^G+
zm6OOo=-T9XVo@{*L^=KWywa`GaZ>?is=iG{cLZ)_ne7v?SWO((+{+b;Psr>WySnKr
z$4Z=5v&``oA_}@pxVzT2utGM}hnm&INC2sc-6v}}T5^ocEF;Uyn=_NwDjiv>tg51j
z7v=}dJV3`93@OVQvxO!KeJ4;vd{29i!@0;EToi&cSzZvf{Z|%Jtn|GIe@v;e(DE0!
zy;E$6CcRvG!aup5LI!c9tXznbizhrJ1UPasBdZEV*UOvQDIu9sIWCHR*Sa|df6p5X
z{T;xAcVhUV+M;{2WZ(L@0WYUe{q^h@Nuk+4P4iS07U|l0lm?!hSUGrO%~{dh-^>*;
zy=c3SG!3?ce0IcjQp%>>leQ)@s$T(`f9(YtUlE&;Fy!6f%q`8wY?nUskRi~%bR)ft
zXtb@yoGv2C_%VRDj}QRGE+Okf=uRSeikt|o8;R1W7mj>>jOd=LVse~jCkaCzkX@fm
zd6j6v4Odd^k9`g)vaSYKHHa_?@<F8`EFz0HBl@R9D5E*o2t~0@XFej=6so+d%Y#)Z
z{e)R?zKb=wru+LSke3z<61rYgeybSzuTMQ!DsWm92LrcH7`2%P;rFk2N#4KEr?)C)
zt+~uOt+<#`>|i0Z|J^3@L9nsY^yAe9>w|7|^z8C{L~ASDJPOi9(`r<~`j9Pj=Arw&
zDhBz<34k_dk5t*vqNqZib8Z;A;S1oFN}K_U&n&*Pp76!9I&wI@g_T;4kEcZu-c>bX
zKwKoOjd}F)6k*yB`kn3X5b_V6=z`Z$YLvkV_0;4uWW&z~baWM#JFujjq(|GL5(H8B
z$xej+KSmZ4*p~UAgN~9}`pikg26Tq2uQWei`FL9H%$=-|ye<^&s1sFecO=5)mIfpO
z(a}9s3%LUTTutvh5CX-*<Si6Xc;uUcL=j|U+KO4}2~I6NQTA*ATvEvQX*Ol4<en|@
zoP(RW{^0SIdT?AhMMM^rXmlXG4Zn-HorJ0!>G_e#UX%C1^VT5wKby(MHhKHeN%B55
z1{O>kQK3)L`-%tSaL|l;iP%;z9`s}xjVcv~VBj03==@O_^dLID&%T4f*RF4PNx4vZ
zba}z!KwF1ATR5!Xdr=5#dEIZ>^@vn~3)5lha$fVU|Kej{_ebo8_8Nm;vO&b+NvPUz
zy7%<;9Q*RnI4r-W%uedO*z_*?P@afZu&Yqo9@vrx!wM&oMIXeV)t<!e``MbAtlO8T
z(aC8q{~w+X`?u0|P9y*)3dM?^k)APi$-gN;?)?Z~Meazz_s!}v*d=e7jP(qVrGtiV
zlFCm+1#9Pb;)uWwM)6^l2Uus)|2p%6JYZ-Xp=;q|(<(nczvcK46wrJ9E_>DA(9#5I
zGa<nG(=Q&j!7$T^syedC>^#RVSZT-~P;)Ux&}Jb@!wp~UOE@AS{;CexhCS1!*l!!`
zTWO{C&Y%w22u=+3vUC@NVksTBD%f#%D#@9KSo+G`WC8^J$i6z|g#F8th|2t?J58(V
zt$ah3b4ReVA&YQZU!N7MZ-5jQhDEI$zAGJRejbic`J;N!$%r(rpy`7X=2R$^cy8AY
zf{C-Xj68oKb=!Mwy{+9s=7fpxmLf54N{pgyv{j+22uL4+haZ;KJRE}~@*>NTs?{x>
z3z=;qT4$@1);29W-jfQ&Au54uGtX!)oxEmp|NMlj)x8#gSXDwxhlP3n7HH}5E($b3
zE^g;YymRnuB?c<tsYjds`jzvuVRXtzs;M_FHS%^$HfPIlq(!v<Y7;We)$`syLZAlc
zC2Gz`O{=k}O8*7JXf!?-8JuG{C&4D3w6TB#`lX$b5k&=yl3Tlf%MMKFOHr0r^Gpy0
z`?D1OFc9onF)dWCP!=OXN0W$!ROL7JV;Z*BxW$MuIIpqjIe}&SV1B!3a@!WCRJ8C_
zh-D6ebOEg)(B$aX5#hp^_y(RvX*{^9<Y4>iUflOsF8hAw<i3`DLdq~0@*`)C7hJsW
z)a<;$2*bT~zM(}SQNlL!(UyK-BnoDY$ag<58iaSQ#hKnbiVT!^;sZqIJ(iZ)0y+EP
z@h}t&VG0`^G#Ln^c&4Jv@-oSifvq*iGn?k{fLQK0S7yQR@QbZgYMD)Tl=T$CvFWcR
z$?m%-o81o2jIv?L^_5n5@c)H+|MxW|zjaPUBjywj!Iv_uc+9Yf>TPA{W*J0Gz&~@o
z<erFFmGgPuxh)+m(g=1!1{3bTK(DinaU6bpw5xN<NPA!@{Bt<UsK_p5=tMxNWR|)e
z*EOk^uW#r{{MhGSjOKewgWyQgU(cyMkVCMhLZ(<G2)nkjYyCck6I_ds#FW`FTQsfw
zSW@s^JZPo?)*`k%drsrLA2X*gsz>(?q7XPXNoc1M(vQKzY1S%6#XpFKW?kZiHEJfY
z?<eK_;=#IK>+3lD@GH~veCJO>(Y=a6(R&ESm}IRPrV<KIEmQK;VluA63S+D6TrDFl
zL`O3lyr^L;tHh#3OA6COq)iReKJmq@<wpN^IEcYHOdYgsOT-{7`dCiV;RbH78E${2
zV<ZxR{c9weYgOUTh`q9MEof;-t9$aMCrVp0GhgV)M#ogfCCMCK!1QZ48S4pHyL_{W
zuhK+BrHp}K9<!b<pT3vH_r}g@Ds4sLya`)aV;4#F?RxsUZU+;y(oyw<g_4$LaSZOk
z#HFHJ<%A!E%TgDAP&aF?-i}UI^R29QOs!0|_#+b_toN1V@oHOt)1<qt!rff{n@rM6
z2a-1mhwvj6EXMp6TiE*?5Q^|eN37|_QTaKQow>lvw{)gM<ba#~4<37UftzpIOxvHn
z3L}d9R5tNbZMN<|GCu~zW^NkPn?&Yq4T7FLST72|iiddb+P(~4MqNN9<GOA60w2n^
zU|!r`^g@$6(l6hKQy*Kr22>WAM`1B3&mmjaC{@p<5NjV}InR`K(jkZ2b=NmO(P&Y$
zp_8ko&4}sruEqffz7_6ASZLSyj>iLE^|-b+Y<TmePcWH=9Y<nx%ol91+UrCkswuMZ
zW2JE|tnAP%5%4C>+_N7nwzeOo<1oexjs@PQ|IVWvg+(`PzyhXV8TzOYx(ch}8~tZ|
z<!E%&BI5Q&YibHaD;nO`YVJ#FG?7k1|C#W;&Gof*LPO*!P1>C|Dm)K19t{nYTr(iv
z-=g=|!XAJq7otLDYC^pxEUM*wB(ksDyG^SVKBgmI_jiBVKtC0{d-~gBy(&9;E!aWn
z(S}^i)C*5Sf15-`2FDh=B=Eft$Mmm3`xggs%xxyAgezX-hi|7yz=z}oXr~_p<40t7
zkI=y0u)ud88j%3*-#e4k=N;Md1bT=zE;qr9P4F+%Imx)$A23uuKw^y=oH+6<UGO~7
z^^5a^Ho|`!SqQlU{!kv6S1*CY8usU_v#z_%AjO4LwQIlP4+?!if-cftQkapaYSK~~
zP%;NJAE<hZ3g`0Bu6FXOz&J@$Mt<bg_@ICf6D0w34ZwfPiTlP~R0gCdzLNuy8c@-e
z<HXj*yUlQa(7qd?q7y+V!LXsaloXPS^DOqP<#0x;)?P)Y3hw>|j~|&%#i0lD85Rd~
zI&Bh#a?YUVf;tfY!qtsEq7JN9A>;UpVwc2c6bnI72jzvSMub1C(>7~N-^?#n^isRp
zjEneePK2x^bFT*RkVgb*!rWQ7;Hxt8(g(24$YS9?Y=m&1BMHY7g|tyg7)9{ExPH-}
z*xHPz#iZ`H{`;zME(>f)sT`7le)P-vYL|Sm-Khx_6G|WL#wG@{OMnXBJ&+i>lxOwm
z`gK+=IA^&^C{2)JiRCGUV&A+Oln)3L1iB{ATTAGvkvw27+Vq=DE-&gk^g1fXH0obR
zf|IL6e>EUbF=5)bs(_bjWfo)Xe8iK}Y$-hk>C?O)nayn2EmiM9K8$e0ZR)#zt}F#r
zrXEj#S<#5SSw?}4Z?cw#aICcqw^iRJF`P8jDONpMjQ%z@T}=-wFbKRSH;!k?x3(+2
z%?J7t%S5kbHnG&^z!r}-pKJyyzM*Zl;r8!>b%u^Dj+UvywJ1U~xp-{aBm*mvRvG2}
zwH<j<kL}9r-)Vlu2ihhKu5gnGtIerO-Phzr!xg;WR@+9^MTENFjOD5_NXg{qx&H%c
zN-!pvR7vpq`sljpa(as<LI#E1wz@;>LlAAU=__G)&_P)nbumv)u5+^FN~~n95OJnW
zada&JRcTNe>Z#1RnK3QniSGN&Egm4y2fqa6Z7|zOm<O3pgYeRl9$|6#<82J6U~6JG
zNMZt2gvViqUe!C5_h7abNNilGweX}6T;wtmez^=aJ3ZPwU(CNMY{yE80MNT3FQ@4)
z=H^B02ESmCtP&ulWM7zyzD%hpeuu7xL)NhccZiV{xSBCa7xhxykv-6Z44ywVHYB2Y
zkhzbJ$lLhfp&g5vB{(Vnp}#@7)0B_l296wYmH5HZ!bZxMsrkmv6M2?Gxc~rnc70CF
z$z6V{IR;}Pb+`+w_~^L2?3L1Ll)q#a3u@}t3POcih?V(X_vcS}3tuY{OfUZ1U?ssa
z5vTFOnh_lwz7%siN=MGXb-g|a`<!8Y+P86{4rmkJ!P<@=5dZs!@UNg9Ss7DVGskuF
zM#ahQ&&R)UZU6pal<pC#JngBfn6?mg$VMo{V}`X?VLpCV8_fCi59jLbdD{-$Q1fFr
z>Qi^@<5nQvhlkB_Cp4yBeTmWmz5U)@D+%_Xm1Bc|xBK3PXB))fs<}aL*8HoQ$j{<0
z;v(`J@l(8&vE9K$Vx(AZ^;o8FQEXq)-?-IY7^vUYh3+)Z!g~K4ir!t6L}K+WhTT${
zMJ(%^N%=o(c1gU(k~scuTX`9P@t}YH4resH8e+pgtPZ-ry)Oi2P;y@f<FUOKZa3!v
z#CObmuDU<}jwt$IRV;PxsyF%yD--4q`bXl925SlO^@C++`&cODgNR@iOH9hU(OxIE
zksu=26%d>WZwSLd*HS+KiA_smdNo-?YMDMba0JCQ3@-e>I4D8P;tTj4L*njeu-*oz
zD7I+&#B#A9V=W9<{Ng7fo&LqJ3I#VBKx_5|DVcyq<l6%c7(BT9`Hbujc;40fQeje%
zTqQpT1$CD?jU#OJU(;s_S4|W9fBe?kZC0slS2mBmS3PUz^lM*L!ExRC5`I^@PKCkU
zmhw6cC86fX@4w>{ByGWpksr5gjvl{EXAzTO8-ZiSb7zi^yB{|_X1cjCkNpdd1s^+l
zi~b5V82v^tj$<FB+zKMVsH<!KM%-(KefFzg|EfD?z_4-50q^>9yXE?&rZ+@E=G82S
z_}|mPRcYeWvyp$!Z=@(E;lI}-HFnOQhWGyYBNug)c~;#&u{jP>J-{x?Z`Bc%LP#Y+
zyqM7pbw#bWG?KO9^-+cE+HsoSx)3xCuuc6x)6W-Q?lrzrFY2XZH^6!=h7rsH?~F19
zp0OK(im@HXK1pyRj5NH+S5=q_e2jgQpmoL?2Xkz3{Jbm;bVBQf2{-vj>tD~0Q`{ID
zo%4tD@0mh~{Oz)>k&{DfY7+9ayWSW-7lS<O4XNF~b<*;67a-J@7((iqsgd>dB{7x@
zCib+?41#3!w&i+(NYDiL&Ji>R`D?Ipev33bw3TbU{7nn;o3FXscpKX@Y_xxvYo)F6
zxYsVv`qIu~CWAn!(Hngrwm$iE-H!4{))+;u4UnB_Xq9hc=G}5;N>~^Xi$FWcuXeuE
zj6-c>Td>Rp%D{69>w`gGh_&OK;k#9it*~;|PM1?<G>+CUSw(y)m-tj-oJ2}!M|P9=
zz35HJFD^;7+`JlJ0w@tcI%wWx<1!c_u`UX8LpzzwB;oo9_fzg{Ty{&Pv%pfMP|FrF
zu=wiDU~KgL^;ycu(2#ZTcih25){&?9jA7ltJnRS08{JE#^NXD`Y)?^FCMgMA98NnU
zT%wZYMRIZ$H-^yZsrBfO^)h$RAU}J>W1BUyu?ajyFjxnb5YO^bVYysH6!VMk8(msM
zl+*XBPoZCVC?YA2=1c#MYgw*M%bF}^Ku!@af``f!$fXsQ@x3rTXU&<ZPLzzJCrM<G
zF=BK^H=|E%TvSeT$VVwIt?Olv<g8vneE0RI1?9rYk_tw;sJAv#!Nn<PUu!$=hFBjk
z(Qaqe{!!-Xc8~qI>K9REaU*=a^-op}Ya6M};+*9TF3N{%&UmHTd!qk%fcm5|G8wK^
z$uvEBzQ%k~aTVyZ9fl=5vjXl#zMJoie9_X`>_tob?$xDg=tPaC5FJvq+8adNS}^7J
zaj4VrrO5V|q$>{f^Q4Oyl$N6t8x`(xw{r`QRK5H<bM+;)3bBHsR6c#DYva92Zm~iV
zq7FXqtn#r=4llvWI@0XQT-5JYVa8YvX$J)wwaYbxr9+~V7kD=|<3Fy=(dG1hC%2PX
z0tlUkFS9H21DG>p=e&!Os6VEGo4CpxgESQijqq@Ff;Ncs@JU&y%qT(jMZS>hj<CGe
zWdWah?3U;(0oQtzwVr%|FEz<j^4tFAz-7|Ykf6j$_37b!?GDEKUbx;uJ}ALgop-j0
zo79AWu*~idw4?t6_CN{0E3ibu$}nH<iPl^ZW+`nzBYRa#S_2ks3&lbWWwa0^o9H}>
zGnSz)CY3|1Ix+)u6m_7ju8;ZCCL<vpNW77Ypi_ZZZ)OOOOAWZce>?7l5{%P;2|7-w
zNg}w(A@+kS@`)W!855IF>>&LBAtn`j#mUoVv2RFC#(ZTB{<@V6vL0l!*vI7bBQNL@
zln6p<%Ie4~7SIhsH&h9bx>_1I>Q^AnVox^`%T$$7KWt*h3P~3Gnxq)aSJi^LvI_3S
zx1p0PDN|Kd=xFO<rBeV-tyu(ZEj_3yDPf`WeH7pG#ijd=4_jh%lX7AEYW~`iHMWZo
zlP-YQdK+j_Kk5Wia{>}eKQ(^xToh;4V9p#>=xXX=!nm1eCBUmH>Y}rZy=KM}^Hp@A
zHeUmUWC2B-aDj$~9yIBi=IQQ52f^D&O%2+brqEPWM>`#J%Vj%M)%BoE-$hL!uv15C
z@Lgg<Ay$eddm=c*RHqwrE6iD62j$du-(qw6oCX9NMXWs-Pi?C)X_^Wu$pSM_q3={v
z8*6rlVU>Xnn&`ON#B8iPn24r~Cal{Z$03$^!2=0N0$6IUB&$j^2(hKw3eeLufDTDn
z-HyLs%zwW#eJ*_{&QV5T3Q&4CmcJc9RY@7Q{F})VONQg2bkwB-HrndY)-Zso$#$~9
zfc3_@yf3ABbKvBbkC45aaW{l4MY7<=XzY+f><3yH#Jta+LrzB8_o&oiN_n94<Y7wU
z%1(QPQe~AWR*F;!GKxobvaHyI42hDMVr3M=l{Kj7$0+K75}6{0DFRsuQiTsyeAqDE
z=gN#@3LUE0;R+EehADWM?jbW;R(EA|XPAPxGNMKj{XIm=D&T=4nEa7NZC-o*jh{wL
ztS+}2$&tAa6k9TM$~_ZvaZ22YPmGDtG9xMviQ&0O3==Cmz2gDUq_HrmWMg4ceakU1
zR-X`*g}A#ph`W=6*gM%M&ghf46-g2oqO87dOsp|`042%YC@0{^V`36$$szVoky~PN
zOYBEsiG36O5VP2~lLa;iucv_+ZL{g}BSDPC%AOTsEdC{hR}+hYNgy^vQgF%Y86n1I
zISz+defGmM6Q2aJChGTz5KAK~?m0rNHii027L5$C1iHzgewk_#@YE2ip?>8Md$uBn
zm>gn13Wz;Z7W<lh?6O~k<y+73xTlt}JzQ2U!tP^1+>+|3>c(m_Gpycyk-yEEW$Exe
z>;hwpRcN67(k%8)%We1@k_Y>)0S?-4!Ql-yh|BE4zEw-HV7V(==$NMLJe=@Nf{~61
z@{4-0-rN*td^30s#g>8wSeqDQ_n})ni@m*>4(81_MKi7YA3p|tqeaNi?i&$ejXAY2
z)78U`tG96OP91M^diOTy>RTc=qZjuMZNs$b^AMlXkF3B@?rJ=BF&)j>RXBCElxOZZ
zc`}mcN{l$=fwil*V$Y%l*t>EwYUul1Z*7b@3I?bt0q%NuLRZfc>4{w&ax3jUV5(z^
z+9Jq63^=`hJ5Ft1hpT~&xU_FC4D^;GFLeO*xgvy~z5qR=4cND0BkJh5&2}638=Z?o
z(_o;c3%8SZFk|X8SgpT;#;jf}GdIVY4W~KS@^9RRkGmh1Zn^mYY6LE}Z?)xK0vWJz
z(Fz=0u@cKxouK_9)FiiKsfj7pu0I8pSu>$)up13j@3w9ObhIpy5#5LCn0y>QbQk)n
zdboM3hC{3@tOTZXJszIfs7V2?yB>v(#v&w#^%2kjmnGJyOJnZOW^CG@2EQ%akQhxs
zlR&J{_Zlu-Yv-0&&7CM5J6DS;0^6yLTcNGL8rcM#iZ~I1J+44g%@83s8fibEI^GD?
z@zhUrCzcu*Vf7jxf}My!N5^j14lOlP#07PuGNJ;zclyInMHk-ZOXU#zh7jwoPQ;DW
zni2OsokoTj270k!)h0kdb>9GDDPe&?FYSK<#L~n3fgalT2#AS#8nAi8afmvGLX5TF
zU~3K|1AXWlo1(O$?5QBunsFT=DKzlQA@<E6#wNNXOS9P1Ic4_^7Xy<1lqY4e*GF1(
zHWI_Lk)2eJYr7W=%VIwT&MU2unm;h4Z`p|*7K$23j-funvXCBM{)8;{P9tZr-|qnb
zz-+{aW+6GE5G*0EEW|pf4}GoeXs7ksq&N<-!aKL2q-upzZoZg5&lY{<J<ztlg!a-N
z8pP+qW$$UMP*+7M0VMXc8&YpyMSgNF?%YYkt%z<IX=?I#n8y+;R1vsp5|eP^N(Ca1
zZoy^03`7TJBK}?hou9skx$C$kHPjLV_L~@?oW93%c2)@R&q0)bCgScEq9oudZiIC3
zhnd&YA4?teZ=tP^RvKf=qDo++uaB8?v|(p#OppY$XJ{bKKMRq!vgkXgL(Zks@C|5t
z$P#NHc<IlvMKkqlqNIYROd#*_d0e>BjQX^0xUO7{snh3RrHL7G(}8qvKPady!m<6=
zFhOA>YGcx{{h&BbX0D_}f0+FkueX-~D4v~oW7BF}zLbNoE18J8o{#!e5hm)gi5|>q
z1FRJF9#~{D5c3VBo0kj%U33L(9mBEFR1;Oyp22FVsv_c!9Kfx>0S>53YgQsv0<n66
z<n+nr2)~?#P@gQs-mXX1r69~!Fvp=?S21?FEovi6V81CGl`(+L{5gF2Lxxy?dnHPH
zgp#f2TSkIdTU|LS3Zh_l<TfgbOCTDM1<u3jD~rIH*b4Ml#bVvD>vVH-1G~@Dmnzc+
zq6SQup^A*`eC%Fmf~<l(Ty$EAjJi(TKd}Ng!V(dG>jZY+%7maX6I!-TNDaM&ujU%E
z>4!rhMxa}#JPUiz-h`j)YTQb%q8q1EFj?=4qReQ_(_cwrPbj7<ThgKR(5A7Xw7L!l
zY)p}wK{rjV>kwO9jjS8a*ms(KYtFW~8kY?{H7%4>R^jk+QzWM)<Jy4@h{`KRWw-|%
zkNM!X$98C%If2bm%SlazPzo`EpuV0SeP<ac&xwP{!YzDeqm}Y(B*aHyosj~HtEzEz
zt0m6e2!ijv6>tlPLu2AOT#2C{d2<2umu^8(Y7}&|je)LuSZgZM4Q~{VuF^+QMKxSa
zRI%-lCjySG!AbwvVF3GyL+qJFuqjT=M_O_d&xny4TgtQ2*XLHFu0qIXA?8G8BR#D}
z65|4z^6QWgnGgCsAvrRSPnT~hs3mJj$fw>*l^c~u{S#p59Hq(mNRF=Lz-le+M1F2J
zKYwae8MnZ4sXyjkWMEAp*cIjUa<?MOVxJhCfhK}hQ(hxtLvztt#b#3q(N*(6o!m7E
zB!pz5p{NTbx&1sBVmuw2o7O>ALmt6EguL)vl;#Rh5?_S4kYXB~D^N}FVQ$3yj4tsq
zshuyALvqnf%fg5v)N|LOi0=H;QJXJ9LuLyi0<+LU0OYZ;J7mcf&@~hbABc|44k<t#
z2O68IUV}*gTs~=|F0&Jb2~CK*SB#a0rhNK*(w%(%j<M#P0fgU7M{YtN!K59L0Tmoh
zNkQ323Tx!k<SXOrP>|Hmr}4At_FQx<n|>dEs~B|zwYXb39Bh?w^~hs=Wf81zW+3KH
z4I0z?asOH#hgIa2G-O0{Aogkw!Kf3dVV!*1ecTP&W^O>%#xD&y1emHM0#r-`LjAH)
zOIBG`B3V!_&d4L!RNha6_q8@;2Na<=o?W9DV&zdy2)Ue&P~UVU1U93J>MG)dD7aUS
z5Z@xQ;2?G>#&qDGPdciZ%Q2R$VV`_nUl|X?T+Tq;?PjrCF%}5FkcNbSRz!Pep(3iA
z0N+CA5hC_d7Tp90zZHnJ=iS2ff;P;VXUDe{Km0R7V`A{hZ+{0tQ#}6mg)x%zO7O)r
zW2DlcIOmJWyxr74{uOcY30OV*zo-`hzPqh(AuJ6onK!V8AdwsufEi|oc-wiibWw19
zA9CBj9^@WniLnQ5ov+e=*s%JMB!$=jSu5RrY+CyOrfFIcxOxZMFo>Diy3;-ZX3x`s
zKqy2<VFUuR8=yZ`mFnr{GRq(4+peK8`7+MM6hSEH!89fP5h1pE?p(C@_F;hj^EaN0
zLfQS3xL;UHH!+uSivFgB!d}>^s$f9aM>m&-5Q_RRUqKZD>a(XL3cj)VIJZ(4wJmJ~
z%`EJ=7zHzJ){bsi6;&YU??f-P^NFOJp~Fj2P))#U&VjnYPCgx8*xT~J5@QfEG^Xn%
z>yPSB*y^IEw-KszvnT9rMrp7coi7(QTB_(Ji%(FM2>o>)Xp%szGcN#ZkKZ8cun}IH
zRzTEU4rTpqbo0=Rn@;8kNzI3|z9zb8@MYiiMz6qO0Fy)Phbscj*NKTe6c1yPvBJ1y
zV`5T`5EFYyMFdBJ%@E1N!?+~zupyGh!laV5z@(DI!JalICY5YVjB8jtY|wo;Tm&px
zJvJsL(esLl{S+p4_^dHOe^)M6og)}f`So9C(jY28_=z>Bu84xeRqDGl4^x+%=Jh_C
z7t&BZfPbsHKqM04faMfK5yf)+wjfs^#Es25h^p=5Z8h~*@jj0((Li5+Db^9BzfSo!
zVq!G<Vu`sCOiYZ$GB(0#y0IIntyr?IL?+poSQnD6?dN?+W$LgMt7gro@2XegMtr<G
zQ63YML+p`aR@dtFhn^{mz1@;^BWJN6NnZnEZDnL3B(**h#OhKqa67!|A&9YkS1+aW
z2brH9Vsz)cWh<(SnZ?zOu(0~C1+nJrHaMM3K`mLNXRlO#yAVq%$BA=APk@++teg9&
zrLpq4K#Z*Hh<h!#<XiVJ#K>AZvUWWTbxfhJWrBM*>z@i@m62uGe;}PKG%>*B6FZ(<
z<P$sO5PRVvR+v_WTL(5GHnAF|IqgICjilJKd*OWIF5EXP!L7s&%$qqK*Keo5Mr|gl
zDuF9ISHk~Z4sM@3fHQZh(UP47jV1dK>3abScHG7MIT|Rse;Zqmg*}wTev|q<oW2~5
z=nHP}yd001Ykt^pBnFM?shFX<5b+_Am@!)m!69i-m`f%*LDbPi1K0i2u-n!c_Yyh~
z<#!G)o>6GdD~8R+Ge`+dg|^WqbXH&}#L9r}rdkLLNQb??IxgO=N7?;Atlf7Lu>oOF
zU*L)A_-v?Jx}dIj0Q2TpA|W&jdUOZKV7zdx51$38HqV$R1hz4=!$QruIPa5yqYEuj
zRSLviyMnC;gVB^z4J&&$B;L({mW~6u2&yy3Pr<!gnP@0rndhYt6XE8rH8^oP7W?d$
zz+qnmY7;YX@O&}qlJl@+(<Mas2ElgSZp@fxib($i%u`s3mIA<V_DlrdN{97)1!NLv
z7Hg;?Dli+i`j*(e)EdDz^5E&X9znsK4?`@m0J~3Qqduhp<0dOp+jPvFI0r2>e(TN9
zM(nLD7;EanLPH%%_nWc7NCSa>S#V#w9JlZGBJ99U=vwSX@R_U7SauN&shyarv=9-O
z!!b=`2a>$JaL6qN!KZIv`L+<$B~)SO(OeF$s?Zd;`!pijFAY@*5|?5ku-;S`>G!IU
zdZ!YGs@4Q^V3(OT&UvN4d9fM1eVdT$8wkUtClToG2W8WvsEsVZs;yC|if0eZ8zY=7
zolS<O$czT|Sn1>1*-V_-v;k)?w<GqL8&q^R;+|I^=9nBp1#>CNA@)Fh9cXTCf4F`G
z3A>um*hX+++advkLcv3AL}Z;w*V%*(wq)&uRL@?_S(KYcb-nQ2YDC*2F~EehkGUit
z1u+5bW8&F6=vsvYzyT7$jQ7v8ceK*}Dwyy02MAsw20N-pw+z7gso!qe*INNor>kTg
zH$lYf+i6`2F<SPup*`z5Zl)AMz_z<2KqGjunNcQNjw3bZK7u^A;{5$I0#+@b1S0Gv
zD9V6L*wqM;1aiA|G||&VeGtT0oscX8Da1srRn)c)B3ftQ64D?kVrrvpImBe(L5ja{
z7$r0i53he%z|lpTsH_yAtEe1%F6Io&Vh@<iQ$};W5Z$FU*mEWgIX6$kJG_Bsv0u67
zFjVGhp}(pM1}iV1Q?_sE#EwSbkeMcmN(Jbz@5lNrerSHg#Ev%ljx?0@cp9v#xEO5o
zNGI^z$EEN#WMB7$=j{r*HX*jyZ$VepP>8X3n68R0fmDbTZ#RNi1KbztqQ0Jf-^EP?
ziRI#n9d?(|kd%ZS=St8|eOW5Z<`X+wv&yl=!WO;M#z1!gYU%rXcw$E)PF|})QGhQF
zoXbOJnGic2Hu1MgtIl2f@Wc)pFV`CCpqebY%E&k@cb0)zW+y7h>gq2C=8gFjYn;Q;
zUM$2SEnRdJ3NTw^6I#jQi}yT+Oa9Hs4zHtY1MazO!`Mk0+`6lb%D_3_%Ev&g9+sQ@
zX&<mmpN`1}GD4eK>NcDrsLoZ=L3h3gGp5<2w@`!-*Bv-~rW~RBw&MPMvM$pEn54fK
z)!`{vxr=Tj$ST~hU=3Us86%Obqoz~=mae==ut~!{_aY9lnwS#oBB0fgwfDdh6GN<-
zuCb0RyW2Z9BPs&WnW}~w+Aa-Bg2T2b+}N@KfkC~fPZU6TssZYv3pvDU;`=dKc@^r&
z;)^>);13aD`gn76WQY)T<OsIx%SOzR!?<$27gaI9IF)r|89ofL8#n!N@ZeGW>Q}##
z`~?B=@$vY}U;cuB{_~&MxN#$bgM(35M}Gh>Xn6=?1AXw`ZHc+FXJP8}nV2?RpISWt
z&`6TT#Cpo3pkciZ8ToVv2jP%55Orbm*(fAjI)N>#oX}eki0t+r%+gxG+v;kX)3P7F
zJIv815MjOA94xT1faL;9C>uG_uAva4(VcEWmH>iIbmsZvD&35)nKusuf<7EHSLaIz
zd!eFE*WX`(1$1-TTO1BW9V3{VnnHWtBs6w(VvdRd?QcVObv8O%iecg8hu)G1C}<l}
zI}_+AOhR2-8}tnA34)Dih&zqjsRXfMmKcNBxCztfdz+2fGiD;ItP<tHM{qy8gzvw+
z&Iq0Dl~A|XLxTswtSk(B{2~V-cE{NYmgZ)#Ff+sW8A|MR@+itmg1?U!rc9d)mK|M7
zMUw{UN|fB(iTE6XjT~a%L{9?V!~2J41WELDhncYjOr=`lh+YDSY@4TdC(`di#-+&e
zB}(0hZG0VYU$FwFMsyyD?6=%R8+Rwt??vib<ZeXzo}?~C?n0#PXL2W!WMg4uX-VCQ
zO#}d0cVh01YcMvnfQdwgCd>JR4Q7!^-HJovVWfs^5h^1h;BuyruMc%6N^&PkT!{6V
zv_0rf6ld#b%Ib%{jwy@{EMTl}0V7?qSi<`_%pT=VWcd+?$Hdso!za5F#d#DTb|;Du
zPB6($5@7K%FI4mRm<+^7;+U8aY(mG-m>6w8!ksuo+?^;K=1!#TZ`qyL-rkOzH*a#l
z{rcCx##?W_1qTNQ$zFo<`t|ty^Un#62a%AFfY#PlZiz?>TbJGbx<w?S8$K;9{Qmd9
zM}B@j-yW$v+MU=-d;3SIe^`B`;qZ(pM<1EXDw=vU5Sw6!*F9q2&~}2lMEIrB;Lufq
zt(VEPMjw>)m(g+n>dHoZJKS>(7Orzad;T3LscFMhM;)<6^%8&$gP4*MED1;|>c$+t
z_A}?xch`;H>SQRYXv0KT9cM!_soPr2nm7xU^j$AhSAe;>DRj&>^Sp*BKF-iHGJ&$P
z8V366F?-@nl+ob3L_-ng^f|Om*7KQ$QSO^zU~GcrE0^GAashfP;;{Ehgbc*8F>$sU
zEKH4IVXO<c8+3O>cjj6ObUsr<n6BQ>t+I>T7QvL-C@LzWyR9DE)s;EKgbf*(J4X=~
zCb~G}9gG3GlbfTY4s%0YjQwglS%D2upRdjaI^_CpMqIWWVlRfC8e%d4;}9D`GFBLu
z6kM{B!fOb`hUu9hCXp0gG7uYTg^?uSlGSjC4UdNng_uMVaLH=W`jVB@5|ijr5R=s)
zxMcN6h{<RO#0XgOj2%xb{r&yO%*;enQ<J0yH25jv;>C-|&CNx3cQ>EpAzK~=D^^B=
z+P4xD8|Xz^QXEneB}#}xd40>sZMkIQVNAnfVzf+8h($_#j6~5Wt*J*wdOGcw$He3i
zBQ+Jbp=DUz<HR!1ch!=GE6G$pn5CZ9yBbAg=G)R2@vt@4RnMm2vn(GE>ezI9>9K5^
z?PFOzdZ-^Zg};YQ8mVEK^9fc2vF74dlo$4Mc(I&{EPFnK7+deA_LZrnXd*~4aCK0d
z?i!&4VsryY$9Gi=c`S=Vi`CIKv(|<~EZAiwN=t+sTnvDn72@^A^g@{J3MP0_|K&n{
zTt^x0;{c=2K-(;PJ)26;;MG>#hjmWDXihE0`P;PwFuGnkRtmAUybh=?IfT#~Nw|LO
z2=<=I<?w3E2cL2;3o@3`o;}aS9#B4DZj4eIUm3(2bLiR$j8cfP{p_Wfjby1YfHkvo
z(edo1nR1B9=m!q5Z&ErsIuI8ZhoeW2N@~Q#$HxbLetx)i?Hd06_rK%qx8Fu&Sm+2~
zc?Pi<mn6>hR1!&Cjf1hXCqQh7zWa$CECc=1K#XO(e=NkPj>WVdhFCRS4}r3iEV2$d
z<|!d2YG;}2f8r2hS?uS}o{s5Lr(nj6S+KOf@Wd?k%awG|*FtxR)%7r3aTNuD-q1H)
z1Pe23%o{ryt#sX5hIV533^^X~a?nLBgCDigG1`u@kSowN5g)5KelpryL{L><M<4@K
z=4+#$Za{<f+n}hFu01OQPCkXGiVcBZL^Cb#!*G!kQj!}`;(rE9H@YJyy&d-tu0~l2
z5KPN#27)SJt)@1*D%zlKcbU5$cWCLNkszx(ZzeALMDsQbV6qUq=eib!biAjn2`cFP
zESa#OnkL$FilJ`lfW<rRA@lMH7}52cn_6S)#OdfP>w<!{7k~ZAK0`xP5hPa_81h%U
zFesh2TZAe$Yf;7$Ys>4zSM=Fu&X|cAQ>Gy}vJ)jiH*xxA9qk9MZeE650@YkqM*<UF
zTShq?_QeszOgO|s_HTxX$r6~GEX3r=GtrXUi}>J5TyejJSyN|_<p>xkDx;m+7G60I
zpWCf+i2cYRmY0`@&6_vlqmMqqJMX-M_uqdX2M!!SVq)S$mfNE&F?1Hd-gD>!%a2lj
zO&acG(I2*;7v4v<W1;<8^!5#hS}*;d`@?jR1I}+XL%&djbB>ODI(~0sF&0{x!RtC*
zM{gq>ms;VN&t2}0ERMMjGZQOhl~DgZHE{8c;t;Ef^Fv8<2hxJhz|?Xn${Pqa10C44
z`zY+K&9VOywIhJlBwj&L9YIP4Vxqn_Y}x9Bqw5yq)Rj=MjO6Z{w&3)h<;bk4#pT0W
zV6%K9y4sp?|M*(WQcyv8T|H`(>H3Y#keHdz;Wf}y1c$}uICJG5BHh<x<~(KoP;+}p
z46Ka};eS6K!nPV3{By9>!Wa=D7jPvu3;h-G*y9s22r;_bgthAx2-$j9IdnIA^7SnG
zY$m1_$jQ&+;OeeO#&RnoobkB@Awh1RffijO!I0JiPHw|OYkM@;h=G>Pz851S+>cJ6
zzRIv;?J9U~UWy&ACm^Kn`$uPqJxdn*@~At|&@qFyiZaYL+#pM+AIh`m!pdv`%+{Y{
z?|Orl;w)UeS2gTd8pKx_!NSNIMp_z(Nbg2>-2hZ2#~QEkq%Xf0YFf_xH7E*-nmk5!
zbJqeC(7@lAmITN1IjD@ehs)tjJj;fPwka%3&9Q3DW@zhM!otu9R=O%=K@mVp+c8f;
z4HhOQSg|_*y~PbsUU`+QGGL>M8XD<uVxfvE0dxV>)r>&Dks%OEI)4y`3mj?iucB+w
zhMArocDbjZDLo&C+wY<!rvh3wZcv`7080}~*lhGg7kjXE$yu_>fSuafd~(N~y_-->
z0Ao|{tqrUQg0)zGIC_XBHg1M0LCBh}-xQk<#G<7@1YHFsSQuMD&1@HsrCr*-4#vjT
zP@1ENk}P1qu|9`bQ+69>&tz@Qux@u48Z#O&Ypy2D4a_iZ>?BkZ#B}MHX0pz*y-&gW
zc8eThKXQmYOBo4b;!=%Gm(ux~?7opCo!9|EAN(&I#MB9svDG7J2mt#lqH!v^oYs5!
z<c)qI-AwA}Qttxv&>zgYMY@=wq=By#jp&5Ed<J8As2idynrX8Wac9?}s;vt}K?hOP
zP>H4cZXxr^Zuka=At5FLDG9L<3cH}8zZB?eM?<0yQmZOqv)hj>siBq_dsmmC$r?UG
zv8N;qF1OOLL0KJwfi7%RR^zi0MP$k8XzEa3<uKcM32m9zvGbH4;v<5Q6muWlG)Sqa
zm=JWtGZ#gjr7(8908vd63^yG?eE3}?Muwt^EGc9CO>{S1gN{6Z4zb~u7=zg2BmVS#
z(V*X34P7I96#6+LrKp4hDtO-lG*sn5b<GI~XrK~Q#$oNLKncWZaKTOwp&>zt3%!k`
z$Y6--(lK}XEF5&*3ms(zvQVpGpsGQGMF~o-??6;~_Ky!@&msnxh&%B}9n8ovvKsSh
z5EhhxaEa~*rJ^W4^O@Y1-&IVkI<*X;w-UHQ*wR1k;l#gE6^WiXCRQ3#gp%lD{^Ck`
zOiU~}#C{m%dBnunwD9UC8u$nLP+gdYxVS_XoEw~^!o;S+W1tnW@rh_GN{5iz7N;b0
zHzb2rVoW3oD`{{M^&>YvO1$3RMHXQ#Vk07Xz0{?c6&Fv|6q{DxL4$l5Vj?3UWcd{d
zUa3jRVz;8OAG#`f#K;ahSGPo6Tq0p7H1rmsI57;(P0WSZf`Ygx2-&oIf?Q)k5|U!+
zGxX4QM-vL;L(#%qHyu@oxqla(ZB5(~V-QS@yod6#GM<8}C@vUH^#rA!TEyQEKvOM&
zs<nnbLj#h-g3!}Yh}vqhlp2a?kk1{2n2<h0Y-j-DLIMav(F8oPbtS0DMs#o>Pe98o
zF&Y$+9C{ly<pj6JGL*ywqmR25%h8%2LlC<|gFHcw?TZdVVpJ5W6GPBL+iBr<AZREi
z13Lyyl?1AvGQ^%nEb;G1_0OykAjY=oxAaJevE$mF5n_XqvBbEZ31W0!<|-TkVq8*q
zF%?idf)<ObjSMlm7M7}NB#7lu{YVfaON%A(eHMtZ_lwoDcZ`h)G5VZzz9#Bl`ex^+
zfml8DBZt_FQ@)jn9VBK+4bcc~9_abU#Q5`Il9(8?s>EXJB<51=CadfzV`B1&9WMaH
zB91>p7W>+MY+bwrS8gX^=fOyx=P>b_FU%|*kYCt`(y)7&I&&^Aht>@{7Px(27b5-q
zV6%K5&p6LwY{@sT!_2}CxdpxGuItBc=NquLT7?Z8opJN%KDc^BBKJ-Jme@L>h1%Dp
zq#!i0gZFvbX&aW>>_Bs+04}Rm!fx#eL|-_`A2epMuREtt!)oCwl;#hhv!o514hCVF
z)k66B7jsLiJT?_pMpn4yU&gm(A=X;j52xiTu*2mRx+;Zm+;SO<&27<G*bZCE1vudu
zi<V+Gfuk3z7A=9FZyZ)0j3Y3SrFzZ>=Ik@2^--TfY_L0tZA+Kq@bO5r7j#2;<_s)Z
z?g{_B2T;YVvjP#W9X<?mQyb(Y_o6Yq9Lt;|9)ehNZZFR!Z@u(5T5|>1=dcD28%}Y6
zRYt~Q^O0oKCsktA)|&`$I{{0xbtoXn)TcLL&*2c*m|EfLRq=CTNvDq^If;G~1U|zB
zCr}%ghl3uOsFgsBJu|k_DH?SIv)1fBSZ?&^**e0{-GHg_QY3|Uae!4sS7M2QC62qN
z^8G6eHBghzvU-ScahEg97wkk)B6}gGh>pDt69a1m-L5Afim=vVFZSB4#kQ@t_-j<;
z5c}@S^MF`?O$q`tYe(EC6@)EtK6INbqXBGOzmqJhKAHUwLkwi8t=UZN$bvh!X(NB;
z>scW7ye4*tIvWud7AKyx@fe6PODr@r8p6jwtg9#t5gGXsfIWbis3{+dtSqr;fdy7=
zKOhF(lORUAv~?YNTC3y`6Fy@WdtEgPKJlWzx*0|eSCDjmKhF9_<Gz0^BJL!ijm5+s
zF|otL&IHY5m9rR}y4E6O`yGMjrO3f!JL~(PqwmUHmMUs`JSKK~&r%e!m{@uWc3jLG
zoY>Jp7TJZp`!HeBBsian!QpLNFlo{>Sn8<oi5(Z$n4(-VA!E0mKH4kVp}F=tS!IBu
zrVbj&nk$S*hT(h#%vCl+Bej!4j2)vqUl|>=WY3ND()Fv)cSLVl59X?_NAR^6+`S%$
z^yCg0YMY^hj%mxS;}8o!vJq#`$KcMD7=+$P=GpUA=dI&$uA5tJkdZ+HhmAEV33i^g
z)~KLmX?Qed&en#@Zcivqw?u13#fT8AC*Yj5Tf*P^tUq4^Z8W~JY#kaimZK&r9&>b8
zK~ZfZd{-~QrHgS0^ohZ}t10x|)xmn}U9!@EC3@;SW@oIVie}obCEy%cxB!*Zx2z?`
zAhvdYGCJrS9Xb6_*L1@DeVf5NJJl(`>E$-aOY4B?`WyTKWClUUgPB-qL=dCTxZA=Q
zH+<r7o4$*?mr_xe(1@ASX2EIGG3d>i&a>sKOfW}n62Z-NH-hdC$RYMUl#w9T)l!G%
zie#)faSx5PPkzP9U>5tD1gzM90ntGhu=Cu*S?qZNV4(n78tlPl5f&M+2c7#7esT>u
z20Ec{v=S*Pu`pIOp?V?asImB1A9m~N@OEcbYhmT?6S#hS6ZQqrkF2u{hW5LV5*G$F
z8gnpE4YkGFkPs07%SHCE-F^bGcQ0by;Q&co>_JRSVd?~2x)lTmLj^RqchZ<J2VTB6
zkRN##OC66Q)aM`;Y&nD4%)8LB+k-9|{0y`gAtgQxR%-eX^t8a;K_8cI2f#*sCh}A6
zLCa<rItf6ATGn(;p|Dodg`lemd#%(FcrOUH`txxkE{ot%h>UC+@FfsqF)@o>=g?4`
ziQIdqal)UzyM`Q0oo9@=;H#KESC_k0?X>3N&K-ZO)SHWfva-R69bI_=Sm$&Mi6M0J
zyxf`k%fW2DrAQ3DjX87F>DWr>&KwU<@5|UopSPg&M+UKHRdrq~(nC{_o0Nk!CsTP{
zTTwmk-Hhh|W7`!;xk$<A<S)#Wm8ZQPDsrn48Ck)n=<_~{8|m0Mer#ur05PE@JS%==
za4L_vl_g{oV3?KEMgvMGnhKjxT+m0y0=W?>2nk3=A3-lUC;_2?*{Dp;M?)ENA=03n
zQHgtGF?Lhi_R>B&Zyk3frrk+FGc7xcyKv`f6bf@h=wey!$>Qo{qIEX?J|!R#(UG<M
zbuAJ81w4l$%g7OWJqj6#ZD1MeTL^M-x8hKm)q{kXX6{a`ORGh|l{l~mrJ1`i>?X@Z
zFGOKj7OHZYo34}2n@&I2Ow{GmHi0OVt|K9$0g*QoX@56jBN_=d^f~Bwsd!9{zJoyD
zR5a1pntUq>_k+s$)cKm!W+X<o^6d3@yi;i)FGYY)0{i<weMT=L?={dLqzF;hlL%(?
zy#|Njc5oMgtQRYHgrYXN1+gK`gAl7t?Zxd2(eNh)UZL-lpu^mWm2r)@Nnom@F@#xS
z4YUk88-WZ0M|H9Y(N~hV6~^8hmU|}`x6Y^1anzQ!qb?`nj$aXyuBW4dj=g&}jk^{L
z?iM1KKqH6PcV8Z5iJ`LuJ1*0I+OYbOB!!rOtQ&!lJ%84NsTz;SVowm$*0i8D{RERb
znAxnwk>GsvRmQ^Z*gXhELIfP&fdP?d5MoYxYywC>jUSrm>FcF|EC<$y@1P;s7l#7V
zc>L?sR!0c?ThZCxPHhLEIzv&MwF8})r9#K|k!2<evH3c5TsKOB-4Iz&E1B5Qfm^#Q
zP{w96_BTOU-Hbj;DNJ|zK~$Rv^Botcz7yeIJJH$M4vqOLbW9r>Qm!F2KMO{V-n^ZO
z<7o){S`l@6H#$06prfu$+s!ES-;ZkqF=nBO+Q~|jf!M-BH^>Ski>{{*nrfEl$-IUG
ze)p-a9=lD{(cM)8RV6FlrY`ynJcHr~A(r57hsg9?`fSzMxp51cqfX#vLJmY^NodTP
zNqx#Ec045JLS&#BY2O2}HbceSha<Orgd{OA*_hanSl9?Lv9B|+gJtbt&yls#Qk=nq
zSzwYF*l-m+DkdhQC&k2=WMg3u#l*yF%wut}p^}Y-4T*`#>M3Jlbv%p5qhewbNn&A7
z8xv!a$HZQo^1NbVQrPkMmq>tBwu@o2bct9?7Q;K1?&xTrw9VjgeEoqdk@q8shk@1i
zb`pTZu`%&d>`s(*DT>!6?nGLO<6$f=*2a(7XulXs7cUx=S9m(+tCKa@+bYhHND^`P
zqS&3t>O|bF_`szojft^sSyv*Dm$i%IVf_7K5?3OxlW`|<HzQvcyAp+bDTWvm+h)`1
znPg*P!WNb{@qs&$yBOJeW7*)6tBGyXQsPb&G?osExf2D<t;k)8Z21$n#GWi5_D&q=
z#$kkgPp>k%V`-v3yd8I<l`Jh;h%p#$+UUx2C_X#HfcU@|w6iJoLqJB7xDyBUO&~^A
zlm8X^477~&A*)OZvH}qfZrDMVm54r@GpcF-qaenh6@D?6zXNR0r8pwQM7Vpx2dRFy
zs2}$3F)_HLVyUJUncH9?Y3Yiis3wbygG>Uiks&6+)tv`Wl>T5+ha6%*zH<8XX~afF
z3_|7m(F2HyC7IMAf!9!dw=prX<P$rd7GlD>e7y1ITi-3jDsx+K=g1bMWwfHYNc`f-
z$0_pEZn${d!Jg$-FkN#Uy%mknUE+l3peU&5twdW<CFX0GA}?onU+g(C16Z#(0>8t1
z;N+c;?(#Y)nK>dnAOh2s7eLh9hshJ?;O?y`tkTp#*!>c?7#pIc0m!=UiPcWta9g(o
zSEE~@qq~SF9@bTw4(B5`vD?-ZvFW`?zHkWpPXr;r>l9YHC88-K6H{jE;_i(wOqprS
zU7xC|ddNs=9|ket><VjKzZQcXi!I=H$Qh^3N8;*{LpXA|7;Skqn60w{foCs3Z-ozc
zCCWl9!}k=nAH0P?uX9+mCk$l~DNr=phP?O^sLiuRUV0z2rccJj3z4wZH$qzpaKJ(z
z%hr3~%&zS?e6a|XbVq!|r<D2z^prHwlv)ne*_Oym=*FJKmbiU60S8tuM^tP-b}cZ%
zt;?}kL*I|r`ZcJ?C3s~6PS#dv%IU+sfT}@=wPg1~)y5MAG0jN79gg(};?bDZiz!ny
z5#&SP{WLWKrTC2ir@bPv)=(YyLVDn~&<c4OKrMX+OPiy(=MxHT{oVAP3NTI45<%WE
zP@JhqkOVB|O~fwe+i*0~L11u?9AYm}sjaPrwzf7;crate>>r<Ieslf(qkmxL%sC_O
zd$Gkn({mDi*GG??L{4rIva$=lTT3kVtP6^tW_BW3K-;x7(bgnHYi1e@S6)MT=nc4D
zDMo*@5bm4zfNpT0X=sOjNqp>q2x2RAkXI}qqIbe@$th&|9YsVwAZin0=9KvuXcIt3
z--TOo`;83I)hdFEi4ljGyNw=7%Z2DEYlhR=H0bIr<`7e7*(mDCYDr1NKHoAdoT~y+
z7g=aoIZ$438qEZ;Enb;qu>soZ+WcW`JzXpGRXuEpRc5rIzY!=54#a0;rl7WhW#jM0
zj-$~izIzSFua%>_N{B71_Y#C;Eizz*iW+;Ygw9)rSq6vES=<XXoAc-(i%(BwJvwQr
ztE`LmV!*-BkV9<0u^zIr1Zbxl3B47UP!pGo9qw7^EEPa`mIf{9SjAO*sWM#)?R2i1
zxEx%$U5DbtR`gT=89rw)dhArt%@bK<z!|%xsG@PVIp;z0Uj{J^2Ved+XO`(+cdkAf
z60)$;IT9^YcXWw4^66OB>BhWGd1xFq9ZJJ-3B(fI58&*T2DH+?-79yYIwTzXy(-a>
zFM_$^G*l2g&6SkUkOma^UB;=)4RVORpryUNlLns_xnxvYT8>$C1IiLQx3sj6*ha3Q
z>g(&5{Gy(&e24Btz-_rXmM*o&0wV)t7SaGLspl~-NjtV)7I7a-7Tdu_qJ@jMz|&qE
zwFHmhZKaZKi}z8TL{e8Gt81s@xl56j45~^>>g+8AyiV#)WYg>0%Ee3ON@VNIoyaD8
zaF-%2tKt)|c%dDZN@Q)lmW~}76JwJ$m>#$jX`56<uvu)q97`p#wpxuQb_~Icxf|Jp
z3>F7tu0-jQP3&l58SSOZJmy|xu0&QRaVZicSR70$sY{XNJ!Gy#@%n?f7+Ys*q;b|}
z@d1>FMBq+X4+j@}{!0omvDmg)gK@ERsvi~;t4$YgOV=N`5~)7zLFRh4EfsSi@~rmU
zok+{!0Fy&ZUS8nxt6%;C?5;dJISiXNZIaZ=%kwNhu$b6$6a$wu7A6&ofen{zJd8;i
z2b0xcOiZF-Rv4FTJd8;;7A6%z>VX9&(MU0|;gU}1kV+Z{lNE>7P(7GlFOf_vOscOt
zu|o<kS%^I(nRpn}kXV>hGVw5`hX5vrn7q88<>QY(MsIT|1nm`EE0!-paWUP=%FA;t
z-xy*Uw|r4SR><)Bk;E*e`ocD}R@1;&%%-}F&{;izs{D5Td{=u-AJp}hqP0r+(6N!8
zPKeKF;}%p)c{gf`x+PQX1*j_%pgO+|9d*+7bUZ<epRb@D_2q&QA=XLls&d-UOzZ5J
z%A8iTRERUzGfS*4uN`&8bZi;5%kSd=tIg@)(5lMqL|tw>8reh3w4LnjhC7i>sLAd?
zGi@_yRc3ZR3^Do**Ha&58SNZ=EqP5)S?obT>xH)R8UoS)$}>7qncjwa2CM>LkD&po
ziu&o89`PiPoL*FC4{&&urL+_L=vV~@)KMMFl~|VCO4lLa;9^!;Nm47SGX-eMsKMcL
zMQAA)fc=&LG*J7J<laGmwPg1|YxQ+>kyY51(FlXpS5Z$8YoKEb;#vuMVoQuIOK7_y
zML+-pj#*nGpG~7DaIxw21u^uUOQzM=r_r&|t*D}X3|d9BuQI*^#qqslfyp5zFF(%W
z?d^?V|I32_V?uWg-u?B1m!!(e^C@2&Vr-gx(A5yQZM22=<@*Q^DSd1rVD_-Hk*XPb
z8_Bw^Y2gn$r+6R1<jIpUY0^YYoiYba4Uc-*nILh|6<IX6u2<6FZ*XoW=;^5&LR3|Y
zrAOj<n;6fn$fh>tS|&Un<{SkL^iZEH!v_PNEWnt1ai_Hov~^72bM6+#j-P~ybRCnY
zPC-Ci7Zep$(anyj0t97ELmzggdL30wf*=jx3(UY$p5<QiLS%9uIx2-cW|wyH7&2(E
z9}cm$l5W^rFNLADCRD6F&{fg{b=&iN#-pC<M*b|B)_g5=lmPaUEcQ;uCTOJkHiD??
zybY*{429d}GU}6#nXk=bW_n6%&{;Hqsb7u5q=^$TY4Q|oK9Yo6&Re0ZqKDlsx3O4X
zn;^(u!6L%-Ee^=bVzDqWz@!jUFx`RcXG3t!<1*~F1)#w194`5bv)9KQ+l|Ed0ZcPE
zh<e&?%;<pGrU1A}Aa-r@3i|(?MCYG`DKnJ#b7mK|?SZMTImUf80oA#HnW8cp348^9
zmvH(@qa0%L@}n#4<)+i7On|VXatOpY$a?GW>tDYsX(=zyqkMCB;$R%=$?C1`g3gR7
zuvoSk);sQ@lR$Ldc?-T8I}NuZ>bT`}z`+tbymKEqwjnDAUrka)U$X!k7U*NfTq6{h
z2+&hn4TH6(FlpQbTn;MXuv}uih-d8RC~twmtZC4;-oZg83o&My-Su$8_;F*ge$O>z
z-SNldabvKR2K#mfxzaWm&zS*DOGmN{fpfbzVajYX9I;u-A!ce|iY}^mw^_^~)|gd_
z@#E)k=rv{LV%dS%p#YOWtU56rQ^$P;hjj;_Z?KI&482@!7W^Z-;Ivc^Zhqx3)v-W3
zL2Rx00uC`(tA#k~xDHANtI$wLmS}+pn=EvpW#xn=rVDxA#eKGh*zc8#%IGZ2oi-kp
zwytO<t1R>8T}+=a7KYZlQE>YjBI5?YUhQIOybdiH)zDmh1@$rzn=*-D&LB8d15x1}
z1U!P%fg|*PGy!M4b9fxAG%O1W)5pWw?l>Jw-+`?ShgcoyzzRD|m@osOcgd2>0G4T~
zV$y6wY_eQ{9D>&(4Y~=SW&V{bIDf544l#N8(Uo!I#^L3cUmnz`QKRtEOAoex_OqWM
zFfdTkT3)_s`A%bE3{t{2V4&&o;Oii`v3634NF%iqi~3{M*6@0Qlx$3_m(D3@d7yqe
zhQsVR$HdsPWPS8G8MN5Mjy?k3ps4=)j)^f#j7{c{$HXL(Lrh-2<?`W&AEKau{_y1G
zTPZ)di5(p*o;5<ftm@19N30)m>@bLN$y#DkQD2Q^LIN0BIBfY1A@)rsb~G0ZaEP(z
z$Ydc_o7u(TRiD#?dV<sAAjW1gJ`Q4o%3`swKGd-{IFA6a(u8)DFeP@0v(-Nh#8P^B
zN+>zR<PejW2SpCCZ?}9Si1jvz5a+oI<+R>Y|DgU+YRt;S^zq}cz-BFUmt978od_!|
z^f7kARO~(#gM9xB7&l=84&5ky=-B#<49uJ`9u`a1VZp9@=%Qnno9J`XedX3GD8A=M
z$BxH-ze1$l@WIr{6ES6uChBX1&@*-A@v9SSSMe$J>6cGp#}X4*8LDId(Nnk((u7MJ
zEihr+Xe82r?Y3$;#*Q72Woysy<Fu9MLw(9Pq~{Q<WFXd*Q-=97reV@lMWiQHLw(*1
zOqs5X$b>EeAF$TKgg)B@9J`qF5X4$b1X!f6Mb|$8Yn<;P&HE@OP8<s_??{ZHbE~bq
z0uzn-(4IC4_F8(VET-$ecnlltR%6`wi8yzy3=Qd}SmYE=pab-k=b|;InjfoVa|Y%2
z<1l^dWXw}CLNR@&>X;nNo;nqiXR08{KM(=;2~GsC%NtjqE`I=%RCn^%v@n1*)7Yz~
zx&v+b^xYF&)fLxsx8aTb&X_cAEY$Q?^6h-~pgEmm<{T~LCX0}F`8+P%Xr?|ySZ8j`
z|1TZ)g!1Y2w_IE?Wx`m@Q8YzWCSa?pfTh}M_-f)TBt^*~CNDqUB8S+wTfPy**t@@?
z-M68bteDOx#l~pA^?W1rH39wAO?+ZU)|KOkE(Fhp-%n8LtY;HD>>r-kLB}ptHAD{`
zJ5bXG^X+$084-ZZ2XCRgpaUxNG|)qRXzSbZ{<V}ek(OAEqL8cb2&zF>X%+k~-9%=w
z0Bd($!1<tBTv%g*3Ia`a+<jaMYeG+D2MjjcL_<mv_W7|_6wtXCm@BD2bse6jYPcoF
zEV;_mava~`gipVi#?q;wk3K_d2~ZMz6UVMraCp_^bUy^K?CWQ-=ja`jWp+SAQJKAz
z6?&?h&{_o8=^LW0Q>+}-0095=Nkl<Z95B|><T0^ROBaYCcHs!_$Mw<ifVs8~+OjLK
ze19~Dn7OtFTB*${BSZd>w2p!SgjGN{tvBY<d8tiNL;+kkZ^eH;AIIP9%q+6<yFu{r
zC-BHvVjN;B+tHjWc0JnYtD!Z!1KI@EI<mr8)_a#Th0vUCie>_2YqkJWO%5U7R}8VN
z3m&);Lf;P^+e|=f%n)Fv;zA_ct;7BO+i>IV0PGDl$ik%WKQay54yN;L_Hu~H%a5_h
zA@=Q-@6Me_AoASogqB(wI3w=hWIz?K?`{ysy`=dP8K`<{1*j|P8X^|^>TjWa1PPWI
zgSG7^Xb76c_0nS*L>LSi7+G8XFmsg%U9`@i!>01{C5xkRmm;;N!Jfs#*v!ceTJks>
ztut^jcOuJl-%=_-b#51`^GIx&(?xZ34%){uj4*Jq&(KQ%=B`D876TEBg|(K@;G5lr
zs;n+lW_5Bgkg*K;-E;%cMc2UGiEQ!`%gVuC;lkk4N!!ew$gDc%PGs<6pkmoJq%K9a
z-9`J^L=f&yq?>{+zAoZ399e&2cOq@mdMAm!G}C(3c{CS@uw>~WvcPB`^)2g8Y^Uu`
ziRvW}IkSlyte(9`OzcJ^faTLQ(OAvghYU&$>>+1bZy-ypo$Bk!3S+KBmdU=2j$@NO
z>Zwgrwm6f0buxXHbXu1~?1d}rnWy*OeHSmi^paeU(JQaKf|m!k*(8q_Ol)Gxcc5w0
zra>fPZ!&nc@`H<sJvR}!o+>6LJE?<dcsz_rYJm;2#D?fO#KgE{Vqt@lPUw(IHWnt8
zBn~F4$Hv4Y8nnP<EV1EwC?3W%QcP^P<S{YHU(b)T%$hla?)DyJmH+Pbxa7aX697Lh
z`7ddt<iCRnfMt{aJ}CjPZ1UeHB><L9{`;f^z|~@nlmNJy=~2mlUz`NMEQ|dsuf7VQ
zP$>C@Jze?65bLaC6Do$*eO<BX@oU%Y9`QLbsrss$p}#5Mp>wih*RS5eEhAp{4Ix$?
z7lL!a4c{BY>NARP_Id?c^4hTdSo|QsI*R(BywHpK1Jq{CN1HU0{Rj|a?;hKHFzSgA
zYay%B>39lGuHB9%mJE0p#Hu3V@cEdp_~Quk=9`iwDYe8N4KbFBQFrD{G?C>chuDv^
z%$zY@4ly~zWb}Mq#gdy>h{mR7$*=6m<!eKXO@rUGY8@6CYQfH71NI-e&tF6--T#nk
zfTIfyP*w%x-M$2)HP_LSnT-A38R)GOVzG)g=r;y!;}sA-G-Vz*zSsyQ6+l7IRhT=4
zqAe#A&OZ6n5STMxmwpg{j=^$>=(8`-HU&C?OurMj9oGr(b%qE{?L%!;5Y7jdqqAB7
zZB-KpYujM8=>|ltz_NL&Xl(=xm9^1D%WF<6;d{RcH+HT<Ms_dSiW;C}egw@KIZ#~W
z0ReY0K7bgDovA45K}hEhzZwQZt)&D%A(F40hhIo5jw~=lW;R{Z)zk32Q8@%+3`lkc
z#vI;-w=cu%W;I$evfy>Q30=i)Sa~=ZP3fhWVR8VV??QF)X?~2xj7cah020r;;p*KE
z>^Ct&c_DMpmBZFK936#SShg<~%~^G@-4=irg5XvY1JsuSO4AmikFNQyPcZaN4}(1`
zR!;z1z^<FV)<zkttST}AdZrFoX}bXiD(WaAFr{BOg+pEi=*k^{!c09hr&L3Cu?M>7
z{42GTQAT~4Dk<}~Fgu!?pooA~8kUQt+e1;}9{?}ECUnxZ&z`&#O{uLIH{Tv@bY4rf
zIjBpA9AYm(kwZ)lu@@R*Qk5m7qk$}%;q@cw^5!K7PijVpyDN+dVr^L&(6By0)=ei=
zW^19h1yIzoLe~f|yuQO0fswTc_c{iPJ)y|G=>@Ml<)}<b#^`a1d}7CZO*8a0iJ+ul
zLRMHWHkqm8%$+)%UuBF+0$^3leOPR`K=5dWf`U1LA_=R>QmM-=$AmExP)nd)uC9Xo
zydJo%vfvQA=dunb3AB|7Y0$MjOO{18HhN?X0T>gDe>rVDin`){c&%TE*)tT7mC=ps
zE}Ib$*@?^Rm*93tEn+WtVc*4qArNCRFZEd(Xe{c5(?UbIoXbN^Vlwue&LS(R9;RFU
z(U4vOd)F9liAf=*HFF~3V%u?ki#@`k`*36PQuqfqBGAnh4*MbrUQICEa1BjajhL>o
z0#%v4FrPmk4MhZ&^{2>M>W7P^0j4W$LSwc#8L+YPaynNpYKB;1u{d_27-dP_$hZ{>
z+nu2(x_t{P2#gicrI@9#1TE>Un4_@{RVm%jpED2idmMzAvy~pM-KawH<=a@jHy%N|
z*5ihM3(~HH;L8d6XeNl6uDOQVRA7aX25RIGdvp<r2IB^7DH4fYFXDB+DlW7k<ZntA
zum5%CT1a<4tGnh=MGi4J#C{YIdlqE}-@$}&W1wcS0rY=1VjHI1+ZXWV*s&NZ(Pv|o
zxOFsA+ehjfx)X<JxI2-cvr|`j@cNkMTeze3Y21kfA7?}LA;-=&I*OKI?!@mhCf1bK
z2dBfaIJ{>6i0(vrOl$;w2N3J2ii2}t89x17i*KJ?JPi$eO^90|IT-)S@A=l8Km893
z4fSDYq>r(BC+Pny5}n;m2oJb~zt36A+x$ym1O3~MKYTnD`uh4%oAw_>)G?U#VXD!7
zxSA`Y=NV(_-!;TA&=2dszJ{%bPr}nftlr*U^tKW_guUpbrAR<+31|ZZpMGlp=BQEV
zqBh-aE$B3zRajeHxUF%QK#CQI0xj<DTHM`(I}~?^;82RYySuv;cZw8>ySwiE`|NX(
zJh_Oh%(<Sm=KQ`f-f>|o?ypD_j{n>-Gp`c&m+@*XGYaHD#>_(+6ia>U+LTw)h6{^k
z59^B0acp;c+q|QGJpOdaV%wzAtNSqr+pc@4XLo2z2EN69<sMCEnNbNoH|HFvOz2gW
zokaQ$S3AX<>{XuKa#2N-+W2eh>mAK;MX_^d<Ww_?3kOy%MCA=vP#q?7yN|e~`GFtI
z^-(JR;R|8f@W(!MH<s+MF&`JXAF`?CHWb5kalm1<^9dY#1+3yI`3r^THlSp=klf=Q
zWFN!aa<YPx@(Rk4{v2rT2yuGPt|=iHJAaD_eFAXI`@y8tmW2#U1fkq9gs(i5IRHTe
zmCTIV0Rk8x6;!!lY{L8tXpk5?n$Zt%LN~&o{R<*F8=c|x^37dT)jN#KzP^OG1Rgrr
z^U?n!3kH2in%kp=$guMr%OTOt6>)e%EpU5x8lbunYFV?GT9OxaWcZ46;bS(u_Ilm*
zA>rdHqy~|+%j@gEKJCnQ3eMTV=E)-wrU1I%==WZNR+7a=oPNK-9Z|5+v3wjbkr#EN
zR#^#pd^Ch|TRuB@NT|od^9Hma^V^vvJpMsM3CKnLo3U>))<*Vu*Izy-7tc~=pmft0
z!JkIok_1Eay~yq{WuKh4nb;xPE22A%(fS1=t0b#+IWR2WwAEfOM7ic2zBF#2l*<o-
zXq10Ft4hK8wHe_52Kt2Z*%FEx3cF6p%>+}>z$^0{C;jS1*<pr<;L|1*SS162_hHRH
zzg@DE^H`oWm5=#6#Ua0_0i&kty~kyWxAX40g1I;&5t+0bRra95Ql39}Gfo$M-<$Mq
z)!~q@Y^!%W!hmpY$aN!B?EzJ1Dfd1W)vu(1_@49)7y9VwkPf9^w`X4Di9^cA*dHnH
z<@U0~KQ6R7nbpAWi7K}OzvunW_~X!r54Z|ZfSe-t?T|c~*acPn)|<dU=qIm@geCon
zgl<fHNv?I?T{10nPT}mYWRwG0cueB?wHb7Q0<ra>6$Z~-omEA?yPd+C@Zof5C;vUn
zXPXM5+-COFlo{gBXC{D?!h7_gE`Co)v%<tm2s->er3KVs!P|ZUSG)Ejt4FLd&%+1+
z+PEEYFmg>lmpN?FT0+xbL$#!GY|@+|GZfAV-x?tshSJR0lwC>=$c2BjYm^k+h-M3@
z3(v4|_CDfvIxbsM`Ml!njUb{S^^%VAteisQfo}>a-#P+rFk6GS;vN5YvE)MvXm~p4
z@HlJAL8ooY!#uv|3LIQjXe`w4|A^5S)m(xvs{4rgm@<rZ-}DF;JDvQ<h&>|h3I0=j
zQkuiaZuWP8rpJRIhZa9Cr?RC&0bz#E4H3S(<1+1D1f$Nd>m9)h9=2AQAXq4-SwgIz
z<8^wiW+$cR4c{I3gY4K=<hDqFpESQ~-ZMxNh#q2=dXuxcb7%Mtlu&myjZp_J3Hb$2
zAEf^K=z5WAZ|3d1dM4#wz<2rU@c;|5LR~sk81&9bRq~~3d8EzI$-D1k0wib-Z$#v0
zBfOq%EMw)Qgk$<W(PC^W1pQg)+1U)sDC>DRq>LiJA7=V{0Puz!N%+uh&rXZsgs8s_
zPP$6XzbZ|`zR0SVtCI&;@^bmUj+&kz-LfagMwQ&@OOzlJ)iGMS0m($3S2pdc)t8+x
zEyTdVhg0=a!zRFa_A<bc?;@h%lf#)VD!RTiksw}#CmZ!vMa}S5Mcs~3{VNRbkNVn=
z-vep92;`C<Qp4%RuiDi+bQ5_NwNMAuh5bV-NW}CcoX*=u{$5f1%3c?&_CqZ<7Q^i9
zRkOdaLs@o)P0*UsnEmKkQK4MT>|pR}^<^>T8%>k79_uDYOML4g+P~EDa)C~Pn(h1-
z?aIG?s5n?6+(5PIs@iqB5v-J1RP?<V%aXJ6dXiGco)9{0utfGsEb`9q)d?Y=G3W80
zkVsV$Elc~DD?<fg_`u2Us!<jNHPJ|6FHJH$g9eV^m|ca5iHY6dfus4799_NR7kVZ+
zxym@G@0^QK0H6t!B;HvfL?q^LYW16|c`y~8z4KgI2D3HR$<P<tRaUAIM^nu1+GAp|
z>7YjasQP%YktL@f62aq-3I1TTT-*<E+KJX2C&20bQ}^dL9(rO7^05Q_{i9P+O=%AH
z5`{r}2Es-ae|q%Am=z5S7UC=_pX08cH4&fpA-t6fl7T8VI|ea9%36MYs01rte%&{0
zF+QZ<ge=Pw#AlFt6o(r-;#RA4gA-F_g5q$i?=F<!$Ez&SRiqf9HfRxo$K&xNLaTBQ
zvbS_}y}`z)<J1vq_2TKq=Ywv!Sah_p4b8?LR#fXZw^23SgDU22f90UZ!6N5&?UKQ$
zBPAaUgXnxI$5x}X|7&In4MLv%;8^OQlg+Ztw&THOTli%gKy|96`Qbq=6b8<uoHlH;
zDrQEA6cSR}fd<tV)zn~OU|_s*5L--T1`3nKpFaIdRup`~r&*8PeypS1%!&Pde927g
zr6pC!`-o5Mkvl*+hBJaW_Ir<Ib$ZXu@yi)uaTlhGQEMhCgJ!V+=C}lHiSepH{XN^6
zSCE_FO!vRlK3CfswKcOwyVPdE_y#R|wU7M_hptwDclznwbfHB^s#?s@TU@A?nDU2n
zpq6u;2M-Ylz0G$Tq0Z;N`3U+azTN=&aPh3B#ch7%;E%6@41?t=FA#JF205onS#@zo
zIjQ6Sqr8N+3~KE^uc-1VNd_3zQT_47MCGnmBGhP)Yz1h9Q+ZkAvl-J?LsC&6551yE
zAE-p<j`PY-`ketJhWSCfI;-Ex`@dUZ)4Spr_4E>%3@eKKaGMr;d*HkkwK@k)5b=H9
z#|UqGsbgUybf$?OpvM8KVMj;8_}2dRBiOfO9Nb0^XWk#5<@Of9LIL&!wY@pPd^5_=
zAELe^yFQhUCcJ@nVIX$0`*4dUc!S5Sz6~jE$7-hy=;U)}w(8eZTBw!uC5Yc@Lp`xQ
zz5J76xV?S$qY>A&&+^?inwSfneAZ5kEZOIsj9LyKwuVq0a!thmjzCUuSVZ<Dm??zS
zuaro<hvj6n%m}J9F~LFURJ6z%RtFeHNs}^u7}MkM3p7T#E%1|Y&B>Y6l|q@(z6j}~
z<6&?hiuKiQ>`+g*KQLH94|c+mpI;2p^9q=OhVq$F-VbX$>l&#9#<!3w)SecFj^(L(
zS~F3MHpT9GXZW{U|AKt8;B>j<hgzKH+qP~ZHe5l!q|(^P@S;23XFtL4fhj&XcBgZ3
zp22RO!LXF~cfZ5q<L$SHO(`v{l?M_{Z$<#{K2GmLjlvQ6@DYy)B&zZ82>`5rrV*AC
zhduia05+-L`1*Xzi$>qS9a_-To3^u%tSRe!%O;}ixG=^_wQZac4rtx84Q`hdUV*vg
zz=k4(XKv;Wdk?ceY<R?L;xQ{3CvTP!0iG=^%^P4gsS7Jw;mEoD^|r)D4o=N(Bg`4n
z`Z0~@KL4CsX+FABIKePhoisF7E#92VB7nX&eGo(izocR~2841@nU@6GK{lcL028K3
zw41J&AsrMSZ19Jb(BZd<A^srT@z$EWdfY6y;q0FprB&@gyKGZnnR79zB#606cUD2T
zT(+uzmRLcFeFf5zPysh#!QCx1=XSILWpHVp*g%tM5|E7~@=G*3mNOIXxIRT*ktGVb
zZ;gP9ubsp;{k=OyM=2Az+CjC5jRr^ZS=25r0c`re*FDQ*CkDta_U&WV!cy*guW=6T
z%8_;A5OVFrJp#%xn5Pp*x$d+J)GOkws`e?8d`V$TEwzDU!^J+CES2i+Zle}uL_v~F
zs2vBGM5IiZ1s0(B@mQfP_XU#+0+KlsK6MHeV7k*6v-<)T`Pxeaue!R%Rp|F+wlpqE
zGygEI3enDNY^B=_6{RAB)OvYMB`8ami?S^j1u-@&f9F{#hahNspD|OfIJWbVjEMVu
zBnRuHN<qq0gWQe#TpY5(%T~}$_$lS@NCcW(>6piYP8e(4zz~sQxIbNi`2d@uvEv!1
z>_`q4?$4Sn8k06TcMyH|_px))BeeHCAG({-@*sK$EbR#Os}ONqZwE3|Q3^-*y6wz}
zn67sqX~vBMTsiWoxZtdi`?ybCGyDbuSL)3O)6=bIH4|e!8}@s5%)dYvBOtoj^)Chh
zKFir4+uwn^-C(>Qvc&y;sXtjv4v*R70h%=a0h(?)T*DC%f(S*<&#f%<+I<m+d2Lqc
z&YXIWkV3HIS&-5Rjw2C|rV!{k7V>wHyzV?5|Fq+ZJoJ+n@>v?o@|=6|4*c2U_9fl3
zl)dX~>tG==h$(ZKBwQ+Jr;me`Q%XVC<Xt*>HAAxEdl+UhmHOM;%n*B6&EVric3*j%
z>}ix{mTBRjmE7GQ+9g_4k-Q4v*Xn9y7~f{O)nYNyp?#jEFF1cDIXvvR{-gpiWx3O+
z=yE0|nRQv5i#JdH#atRT`hH+`E}k9O9rT<+{|64RFKS!D>FYwmc~uZxHSd@0n%$iC
z5-)#hL~u=TxxzWV(pS8}rU}AqGEqAEnORa+OL_-i`0BT?_mEeo6oA1Q7%Dun>Z;nI
za2(eL{9~i0r57#mX`}x+w?`<sD7y_y8}|iw-{6aq>s%eWsqx0j9{6*)BL798PkpbJ
z#)~9@I|ZydVw0J5fomCIf=EK3^s$QVRLP0)NPUW_Im(}#pFU$-gRv${1n!jewzqI?
z$$C2V?Jn&G)&sdi1{<tMko<yfRj_naRu=L5>w!=~QRurPq+tRWM0ob>O5dmG9_&@Z
zN5^~Ht~Cm!xuE3PqBoCz!yay4<1RE^Q~!b>?7R<Gnzmw6TntaV9Jk$J53aHwLDuyR
z;))`@7nyV<c#b^p7s&J*U1-TZ()jxj$#dMe0dIz*s@Lv_D~LBmNzoMlZVogm6F^K%
za#4;4z-9eO%q?ue&yJNfuJ_<^bI?ZE3{g3ygaX55y;kdL`lF*b@C*!X00j>^w@!Sa
z1&B?v&;zwlIjv9T&E||23}K1&r4~lA!~DHieoj@1h;V4@!<F_5;9A<+4T$Pn)7gd`
z6WQtUo<LtTWFy7O3`^7DutVlp5+G`bntXgRdr%g>YAdhD>x})kM8J`Y0-6LBeP;Z8
z?&y5;dj{DO>jK0B9Zf77Z0kUI&oG;J#feF4qwu3bP75cFqXgziOP%u(>l2-EWl?B$
zv@8+G^&zg$sfLa*`^Uf@+qq>GL+BbWTPg!&nr$YW*jSMt9&`!{f1!URNVRFegcZ^N
z`<8%aKu*ls5a%Szf1Hj&$m_Ae|5hbmAWApCc!0Os6K_qchsx9Nxwr_PX#f0^m%j-#
zW2QjNs@t*R7Y{O+&m9f7#lC;c*p*Oq$~Gk0%O<5<y=ho43`+>RP1jN6^L#fBZRkZc
zJYk`mfFgmW8@H~M$G<sN&-0n`2sJyW$v6|w`$w@&j9Oj(q8dx{ykacA+<q%ONXe_=
z1s-%x<z}B_49rI|3&+b~b_MY%&(><WMH|gVpI@tG7I6w}oUOB(r17<S=}Moi6qW~G
zFL)!xl2_C;B-rx;mG!hGF0F;7q_L;!N9etDS_$i#$Pl<-#wgD0`(sc^Ab3Oy1hy6s
zvCOvp&h-!-WarrK8Qp)k_HRAC-LsF_c(%@k=3DdN^}rhdCnbna6PB!y@7U(R7m<M_
z`E4h=hKA9DWP~RUXju&$8CuDDNSYssPe_trrj(6dHAB$vHQOYFYhb<oHB7-r6Qv7!
zE4t$L-p1Fl9%3Ad?PSh$6_VuItph8{iAp@0HLBr=YNZ6*n38uZL3}_4r_$5m0@7J`
zqPA;}*&Q%as~=6bu4Iz932Et!E!C1i_zhd^9CB^0xB6nI?}4u0rvbXAalu;7-B50X
zzHJi4ENd9@wyYxnFtj(iD}rI<H&kZxJ_bYY1R7Wp7}om6O0|RBNcyUhP%T$APWw%(
zp>_r?<rlyp)B}|{zJNKqr2i9qa%DSs_0uenTq9)x<;?7_8VxKH&tP_YEkT^E&c~WV
zPt4ZV7EL=Tm#tA*If;IEOaw82)h1S30~@{JcbLp))R%h`5Rn&s(*hC;3j)h+UD?6}
z`r!I^kbs@sX&{6OBlW*0n<OJd@Nl|FGo_ogWt10=o{{Oa9xUKZ1)C5q4x5t2o6lyI
zi`<3KGoy3Mfs|L=9<Tk(+{7!5>&kU27kinS8vcd4S-}bc<*@kQtF?e0dX<Q-7dHKa
zL^M7ygH;*%wqxLGkGhm>=CpxRf<a$Z)r&Wo6fAkwWz!ff>~4UuuiXwP3qao4zuw${
z!C`O<9xwq-5SIxUqUUpx-KPuf(|(@SM|FHTWjG|H-?bM7Qc1ke{FqB(bL`R!DZHs(
z@uC0xwr8iL<SwedD?rqt9MfHI|M--G5vV04&1G&=xpV$~k>@7i-w6UuoJ%7$)xWJj
zwk}xQF=}_S`s9V(r=D^XA|{NiY=KR~!=(j&G6UON9<1nTDGH#_8-ZI~cax<~be9LX
zQhFY-1E||int7r2yz&cZkFuNvaeU-kexw+w8PP~A_x-X|vhF0P83F_G!86_kutEJV
zwc=9f<R!5K<29e77Uhq$u<GsCgVsV(Le4isvceN*(pLkHaP2K+Z2I?u%ZT*Qt?aaR
zh{DZ}WSOY|H?{g9F(;XIu9GCCCsk%+2(^-i1O!*YQ!xPg4cs7pLm}>V>e&xZp?$e|
zQB`ZiXpP5f@xFFi2$c_y{C-zjuk&x9fX49Gg6H3Svn!2EI76Ba1Ecq7t4Ob^G+O!8
z%D0K(D?2heI;-IMXI~$m+}vEUKc98FzYT(+xZNY@qi9-*Nvj}60eOuvsz$fjdp6<9
z0(K0~MYt>n<~p$jjfnj)UgXX~FMJRrt42@x9Ur_%{*%7&9Rp^A8LU2{-<N%+TWhf<
zIrybm^zjqG<h)Nc98*OXd1e<th!VGb=&_I>!Pfb1ERedQ{K*HM?jA7#XCbUjX6ZJE
zGAQ<+{Vit%vwJqONG0Yo8;#J-VC+$%+N|1q978cLB>$2}*P5KY8%yG!d)>Cyx~k%-
zkrPXcFU^b&PXMz!&58rJyv7F9ltc5d8WkNzorJZ_==8~mfID96W~KOCZ3J=CRT&am
znS_)CsoF1%D>;&20NvSuZ4o4K;yk>slIQy!Pf&cSz1qldpXr`e{jgV?e`i#sSW#P;
zsnwlH!f$%hpAwCdQUtTJcHcYP(D@Y1D0a44;6hyUlb$uQx=^x0-%>3cq3qzu5b7}M
z&&?-6HJV2wUO=<Vo<EP@!A-l!%u;IvlZ}eT?Y!lzFHVC?DF4`NnPxTM-?CXOilK4K
zrzC#JVNxh&^-AZ^t~>t?DE<0uOYoLz?GsP76ebbt-UhFcqY@?0I0jc8NDknubHR#4
zR#2CI<8E0cF~$<L<yw{$|4sv%Ht0|Hb@~c%SG-h-ltz@5K+nU;e>)2X%xAI!)0E#@
z+q~(j;amnxhw0TyR18m+K~Kp>pA6dq3oLAu62+BB9caT>RB>@-GgwRz1m7P`cK3fC
zF?^%!J0%C--CYv=D!09!2dqTX<F?e--fZz;xT<sf+wmodyuq8l4<?8Lp!M1>xvba;
z1u#UpCaBEEo*%=du3Q9gq2D6VDdcv1g*#8U-T8DUGHFSbFL0_f|5u*NA34>+G@Q-8
z!?-zciqbZ0j$e#-+UlA3WX=t9<IuWyXMzB~d{RtH<V*~3LW|VrLdB3N<V@r&zdXl6
zoXTf~qR^f*Y|Q6N#CsGdvFfa>wu#g-so{9lD!inO5sg<fv^Q_hY$(k&-W8*i%}I!N
z=w)$K)6dZ|3GsLQTHWh+{AaC~@1^Q(K{B5%Adifv&<2_s{Bw9_FYY%g(Kwg;EmW)c
zf%=oWT3*hUt8oF&=XC3tgdI$DXGD*4-EfIDg?S@=@R+K)<LnMuafQ}TbuCnVSK@Z7
z8u8pHf%Wyc0nZ|w?S`9~Bs?Uxj+j=DIb<)4aPqHFy}L(|+y_pn$u4qifu|!Fbr)i%
z`sOz!zM->*tnR<GY!oEKrhD%KWv@?KfoY~2V3o1qfz+@L>@<>p3Z`sWNz}f)9$AKd
zPdxWI<KE`(+W>*#tgjX1SG6J#o;L%0@9oDss$p!N4e0q==<*Al4VX|lUj#yf&E8U|
zjF=j@>ovDs|I7@z&r4pXu3#23KWz8*LK$Mj<@sLrA+|d0AXFQ4@gg-O(6eyzDa$*P
zpZP}qi3kSrc^!6w=p1wI_+1__`7Ol&x|}8?aH3e+eDGSnv?!YH8MO;ta8)F7stx(h
z_Y?!u$l*&&#U~`aZ$J=OqP0d;8K`Z6_7g?taI`D10olb}cF6RZ9*G%BJxijo2k|Ko
z(aHY{7$*#L^Ypbn+1{3GHWVN*Gt*G)+$<(B07D^y_)M2ydq3g(X?;ETXPCLE;YRGC
zXge&P+rZk+7dZ59%o}I2DQjVCQkZ#E57e*oGV$Ifc>T`5k8a$1M|Qa3IGk3tT;n=u
zmTk(Mz!9TAARRDmu=)aruz2v6ur_|?8^yn#4VXO+4i`Ov#zXU5wn@Znci`a)FOhy}
z3}-zY&mgZ&UJ-vzH)B0QhVwttY_KeytEG^$fAZX9HIEWjL=%mJW7L$M6b}7HJcQGd
z;ztG`%%`ZM;uPNm4nn|e5I-p1VCt94pO88gUJY~Z-oe4nU<9zXuC6bW$N6&Arsm(G
zrr}U$n==xtV%Xx&ml#ju+_)_C*>0&i|BGyqtZU@JNj0;pAtVy0#F25!3~fW0dj2JP
zPGL7+ME7q$YGptm+h@Us*1~h~Zh2u)4Je@<yU$>=KlyCWakUBfa(}wL+F^tEW*6GK
z=f>M~LF7Vny^=ZzF&7*+yadW7T%3?Sy3BSPSTniOs1SP}k!NsD>qXLs^+B`^q#0fi
z)=METr-bfcEV&1IcxtUWzkK%Iyvekmv<Zm9dca_j!j%R^*W+C<LbfhbaXe*sQ20fB
zV&kh5&D_?g;Xwb%XBl#9><*lv8uJABmAFqJPx1#P`K95@XDoG&fT?uo##t|jEvl+<
zl0^T|o+u#i50=Z7+s_H&#yEzxa_ulL-Y{ZaIsg+Xfj4l*>5YF}02bfdqphkwrvsj6
zhBj19>Om!`ih0E`5n{v@Kd`tw&V6Ipd+XGv^UYRR9f8&m(UASN*f2%}SL<fIrq^HZ
zRqKVo)ZY9fxydgexDsNVuh{rWihv(sR_*Zh^x#ZKmZXx+g9ERw?C!1c%l8<lx?)kR
zH<3G4Lg;WvxMxN}GG{=4#@|-oo?r+dWcgsmUF~}gUkz#lo>v}uM@}rB;(6)#XMC92
z^g+4P2imPm>%tvtwlceB4{KjBPCJX+dF;!L&WN5}*6kU;ca4M9Tj&Ke7`c!RZ%%Tq
z#O@lOtwC0s-NL%Edy4vA1f?vQx9<TODU8DEKZN|9odudS(@bL^XjN;K-V+-nYmj4v
zQWm>#ZT`)dDDKwsvToME)fougMJW0jvJ&**jQIpi{GMGW2E)uU7-spMKl+FUBGm@+
z@yB_AGOFP9FtdlvHg9PZPPvT>BD{1A+zrBNx}Q}}4G8&i1j3O_q6%J(5B>r9G$vIg
z2sb=xQ?)4V9+DS(Jw`@ZSi~w+i9*cC{VwA!gf*=Mh%~E$16TEId9$WWKz|=HW^@-Z
z3glZJ=i-f)w3VP^l9pT5hpAoFMnVVp8nI#s2v#n1`^_`@-3xGJWCLA3gz0q~i4sR*
z@|Xx$%8SNpDtIVKPZWytIa*L`;!60@nA@T2)A@*(mMXA(DB(<oV~eIg;D=+Mu<O`o
zDkf%gPpAODlnmjT{sHKsWJbz|FqATRNw|V^vHU#f=8$nEAaVtvN?;O}v7>+?IJr`C
z<s4axPeg9=AM0l%1J7;}BqY*+q*w(1!!}x06vQc<e8z8tj3uZEKF>%Hg&pPl2R<9}
z;uCBtj}wfoT{9(LHNukaMSg506X(2B_r5(002+eG=zD3NAwIPt`s4iBO%hc}*tPh#
zj0?jSU?H;|z!L5j)Rh)8G{9J`7YkEv0Wh&MpL4(5OJ(v1+M~*VolRX0Kf};9sxCq%
zeu*lL`8~J<OHf*5QuXVTl9ViDlmBu36^wq1zTsC0r;mi9@b6>-+r+--Um|}h->mtZ
zOZ{vJzs4~Ax4*HvW^jz=$Ug#<-vZD^3jvgLQ4im8ebG!CF+0)EOk~~Ag7JxKO7ao0
z+Ic#~O(9IX2uyPtR-`%3JFC)i*o1iD?@%VLKGgXO*d`5wA(Jy~tCH^hrU|ZWwGq(6
z&vR<({Z^P<9>ngU)n^9h*CtRv*V#H^Oko7xur@S;-p|{LJ2HB>;i>Uk!^ck{7!g{e
zw&en_siiTMT-GC%?2r;@l9V<G&3xcQaw#~1_%v`I9ryXs_Vi20a8qvLJ7(n~^^S}j
zUuSdmaLSIw&Tg@U7>ye@zb7cXd7oGA{hE!t9pQ3CYc6!>@wDLsH1yl9c70ojyDnJU
z<vCG`lBFO)EPAMF+h=-vd|Gfw@<6vVDn*nY=%%~jQS5cGMz#K94OA90yF+aZ)Fw(W
z6<`K0&bx9H9e{$pX;)=mn0+TKM)O5<a6t@krIaTc+YQq~1LbF$|NM8M^w%u3T2451
z#-7U+83%78OmgiTV}%a+;XrUCaSRogo3kdhPLp0l9cn?>wMeh-oiI9V<A=|~d9<7;
zQob_b!nVyvZb4_3-0g5TM>p{911w?PaRuj^TVBlodF`xJ=4a>HXc9)Z=ErEVeOL0F
zN)||F@!|H(tYPn&94D@2&F;5S>qE@36B$^H^b_(JVTw?#(i4qnYNQyFH-cMvq9@qd
zyKj>-X#(iLgCk0sz)I%&t@~A`oda%HUQG1hWPBwbE_gO-ACUk(1ze(d-#ZfD;*b7?
zek|v^Ol7>J(8(87?m>D;TcPjQKfnnc#&D0&8yb*0dgS1?<=3ikeEcb)H2V**3FvTy
z{+W-7wnXR)t=KBWzm1}mUoplU<|&iT?X^p`!E6`eEX-M7b0K0TCDhrX1qvw11qFbh
zOvXtnGY7WaDR?E|lh1FYv=5~{Xw+w~@%v?vi2D7wGfMMwrcCnfMD1Sk3JW6(!u1?o
zE~vQ;Vn?d<%}Z@AsN)y=n3$1qc~8$^1(Y;YhU<bWH_UBY0mwZJ)Q4vAM5STH{}eD-
zZhsb0!?Fm3etQJnTF&9EoDd_psLyS7Qo1gOoUdna`!S)n(^|U_RIw{1i}>~#uv29Y
zG(FNcni+(j4cl>_*5hg1m={!3V6`wBO6Z#tDO9tF{xIgryi=Q<G}0lCLN5u1XoDGq
z8dLGdFZ&E)X>l@?M~@NK)FSRCL7-d0f}V;RAkbu_PL4>$RoU=AlcP4@O2<&)v60e?
z0p#Av4j4@Tk^RoY;wg7pViUn)iB>}>jRwNKCuuwl-bTYA;&*}K{mcva2>~UBX@e3i
zYUhpX%3&0$8U}~;UuwVWqPyxZ6xZOLV_3H)YJNZ&u>y4Y{7I7S)?>{OtiM{>OG(!f
zibiP>m48;Xu-@MKYp0~$86_x%XN!Zgg_i)o$$(mGeqv9*xGb!#it0tXlWW`w=e@+(
zAE;YatEw?r^itN^?n<uV@CR8}4E@&vM}7r2T05?rqn-sSG23w>0u^RU6u?z5AT_xj
z2IJhlzt6XW#ikp+$*OM({@C&F30jQy{OpoW+^-wmI@>BrBDn=8p#s1iwk#SkPO7xY
zCFK2&m9n^~vt-{%*E@iT!?BXzb;#XjALhi8CH%FyIX%Y6ISYN(045IlBxUa>5fIJp
z6JYRgI*iHeRtqex#@YLC=w66n(6p*nM1X2AOvkuTBw+Rm8(epmK+bt74(8b9A2t8r
z1}~b|a}zKWZT-Xv*A&9DdAS87W?3^Kq(B5;=AIA><uM)07QaGU4*su;NhID8Bs<R+
zl0vv_F+W!zbOj+5@;kTd^<yr7R}J~Zn$#)luaQBL?-+H6wTI<E^3`A}C|nxY<c){g
z0LmzrIxT;}sm+@3;5uqa#ni9>Fz>oRJ;u(kZ{Sv=SLsQE)phSxkxPk$?90<Jv%0zV
zX;Q6Q1czi?PHc2%clb+5bBdeYV2NSu03#o&8nE_QWuC>MUn@GNGAJLLoU?SIFXiJ6
zEy<;e&$jC7k428jNq5I+*M8tHJ*;*cFUPr>fB;0TG~0medMxT#5<~_Z-)BW!<GF(z
zlUG}l+g~jricX)073YN|HAp|R)z`X&QVvh+M8~o|S0j)kz!5nO9ZtVT4OJ+R3o#=B
zyPwg#a5HB0WR}z=34Rqvj}R?Nlom7(kZTa(MwJ13Ah{u{U#H+F)QWc+K4M2OoPDF8
zw%H1Yl8pQ68B)0yp=3}M@{5p|Rg{B6`#+T)*NFQHjz`u6&%xa9U!!PUpzT!m)*P-B
znr;miqd#8Y85*6uds~j;{_BrDTi<B&ndfL_)Cr*e9ISijJ=?+)#n(Xuz+dG;sw*G$
z$m~=bU}y{rAv)z#2O|WfWd-6&#%04fY|6k8Il7$b@Qxg4^$g@F?lY@qPLtYJM>7uD
zKA$!uO(>;)5w%N4!U&rPed56&Qk2kFL0yPm2F+=H48g3;mlknCm|V5LG5tV@!JG4P
zr@3$RvloyCT;16P03<4{C&$Zo6_||xq8HQ{*fE~wqo%ekyps~GM1rtm$pVl|4F+R9
z(FQ~A8soO8@~L2#A5b9H!rvwW?)jNeL+hUPFC<IBsVkELvPzmvZm<~fl2f3X2RTeW
zcid!9fhM(KPnQKjd0ACgH^QquRRNhG0jCu9OtvP3RQf|H0}vc)6GtIX_c>kW_;qs5
zAa<?J{mH!0kRRG1WrIG3fPHb&b8a(~SMo65Z00@bD<d?~LZc^W`>#$rNx8$s=+JPY
z6{QYnBI(fk7R_Z}A^7J%tlL@63L7TG#-v}5l~PNwBC@z3dd6lYbpo!MB62QvxQ?!R
z<&0Dqu1(fPbFN-{!!Mub$1Mp$@B96}GTrV1*wk1gb)mEP8c-@QzJPinuzsT;$EPi7
zwZ8~1Lc(mP0KdZ5`^s!$e5g(MBD9U^zg=2sVwO&1LYSXJPPOf}MhV%B>1O&7*x<I8
zB_})+n!X?HPfnQz%>W*_(sVSVv~FG*So`f?4g%W76ziK8V6Y|2pw1zFu=eq5EADYm
zLaa2OJ4VHFj@0#rPHFVKu&Om-w5I+)HatxNt9Ua+i0aSC3=#-?Fu4CsKp)q;_;0Z&
zk=sUGBj{NS<Ql~2LCOb?|MKh<Z5oK~a-E_gSseK=V)!8Hq=K~0&ls5}!8{(<2|pd>
zZd_=GK!L~TVJNkgHUOT=g-(W|K0fI+Yk_V3!IWI%u3nhi+KlYm^am_AJ)H37tvtUH
z)ZI=rkx>*thjj!%57s)CS5zwu-F|f9b--+@niN&hp;%vM$}6GAs-9Yq(kDh-(`Hiq
z^7lT-!3eIeEIZag^svapQRrkuKgPEy4XhYDAhIl=q&6d_AkE{$lpP)~KS%b}ljMh_
z(pT+5IO=4~*_~V<j99;NiU)isRZ%cN%$1dBIy^v8?a(2hx}54cav&k?QzWpYW|kWV
z2Jb+?vfOM$ZHq#?9qRy-V#}cQi#v$tHSS{IkE|wHe#hx~zhfay$kxnXyVL^X$kSBa
zuivH)n4|a)!rmo=a6~Fg$N(=s=d+}iXq?`E^M#I4Y?~H}L`n|H!LFuo#@RuFycO5X
z@h9Osn&-Yf0B?;tWa7Cy0~l4IK+$KE6ayWL211Bd-&S@t*{p-qi@q-yYQ<n9E;bzz
z^rD4;u|(sbD`8~f#Cq?6;7uRAl*X4}R-D4<oo1P{lJx!K0S<3p(3F6G<)>m#2~}|U
zO4j$cTG#q~4@qyGgDcim^SX-UIq1e;wN^KU+kQcb@nVrfBP+k&aAC-F-ITH*Z$HR)
zb+dKO3lJaqRBLtnW!0PwN86_|E4c~|A0pvTCUK^zM|+%5v8IB8I0a-0hV;N_;`F+R
zKzH(b+ndHI5_|Ks!!*={CgVgd9ZMpkkp?tkG*G9IbO-CRF=FUlE-OFudta6d5iuPs
zi@8~yn;v~h{ujoj?*X9RifMoo9z{lPpNay<+|M@5Kb-EA#dCKS36>p@nvaA}R|3>1
zJ;%OerN!1yM&J;{(0UrKN)nVBAaDX-D$}qs-fscN(o4UP8Mx<muazqpQ;Qg_i3JM~
zJwg*tyFU#0S<j+CA{3TL6HCe6^ob^=EYBfebuP|+>`JN7!(p$E_4c7pSam(+D(I|H
zzLpkcxbD)Yl#pR(ja_A6We$F_tQ+ZDX%XQ+Bcis9Nd_JXSAln*w1{LZU&;EVFyTu0
z15Lub6nehf7BT%1qM-U0$F8jCawJT+gI`W`^be~TyNjG+%QGPesGn2Qo%1^0SaE6T
z`Zi*^^q--o3_AyRG&|l7F=|>cBoQ*KdM$$jp`lxQFlZYV9IwH23PgedHhr^)Un2vG
z_KD<DOJbhAf>NR(=$zsfQw9a1Rm>Xa?%Qy~nEgW3R-%MRy-oS=-^gqt>FY+tqLlRw
zQC02e+NtXYe;3p)u>lau8=S5$1&M@O@%~!8&Lr#y-@tjX?}-hZL&2e&aW^jDcS*dr
z5@fMjMzDZ+43R`NAr<ddpja<$$b~gqBlfOj{ovql3C-amJWSAL84?I{WKc5x|7^oJ
zut}BOEvc#E^^jyH1QQVEZE0$1W!T_A>X$1>!%xQulZ;ahb7&w{GCBf1k)Qg$KiT0F
z0*Da%EnryxoiUGlk1@TSpcKLJZdZ9-zVISe{?dqP@)y`_KR1Cmdn9hlk9NZs*(?6k
zp9B_;zCBSwSX7XuBEzrYANL7f*omOuLO0&$VvNfN-k_jz1p5f%T*766*nXkN^Vm`B
zlgjUVKsK)vXF!hT*hVZKQ+(*+a#+~uOY1JFqU)KMi&G4S%pBz*zx&ZtGCfQCc+?o}
z{^jS=sa~uUSj!8e^HGgbt7D39y{K5oX|Mmx%om6B9s-uFVB|F^Tec}woZDns{%oRt
zYm>OVDZXjIm)3-xA{B!Ai2ojhZP%jNe={oh2p^LBZI3tdH;EP~|Jf&GxabF+>}TK!
zeXOJ;qqacf-(<W9v1&$_Hg!Ogx`?4Z9@YUy0#52M1IxXzOYJhbho@m4bPw9bP{Q}g
zQ7C6N$xNZ>%ylB(YN+3mv9H9SdVooCYQRzk+xfp4KZ{1SsLgM<&gV!v){#ms;q=S-
zndE?z$@f4lkfPAg`|NQg&^WGuD+gC-?%iVXju;gp*5)4MmC0~gZ`pbhj;5!e;~=&-
z^A&;s?bk^(kAX-+PAF8j4|JiLv+|^Rm`4C1KDX*i766d^dY9mRVkwbK!|{bg1-R-s
zN_k)mPJnOH^JervKf7U)GP#&-?L*8YMXf9SWa}iKqy+*&Qn(;@F+OU^h0o>TtgAxg
z)YK8-S34wlK$FkW;ph+`353kbIBd=&2ndY7yZXh#a@#DkZLAm@;hO^FOD(!@WML_@
z6#g_a5H>Wp5-<t^O|#YoBlKQyQ4epq+J3Ou>e&Wuc*pLXhVIe`o}Sv5h`1{Wl%n*&
zUwEq@T4<jxCJT%AAgfjYO{-%whXgaa3!E$N99e47<i}XFYK5-z-o1~#nGO9Z#Tgcs
zPsfNrQ^oC;mT=|y=SCk%*e)q*MkVf8tInuK{_*Fwhu)y+ETjwsX4iUJcZt;#!h$A^
zkbZAyZm%jLXa$VX+`3Y}8aS_55tovLm?FN{S>3;}$n(Eu^bu1nwQj;Ice)h&h3bI{
zUcbQ#p8-8zR1rYx%6Z(onhNexRhKRgVdH6NE<kQ{wV2W#zX`SG9VNB&vhPNN00=o_
zx!-3V{dV4O^69rF9kd1k;mzso!5MBrax&tit0PS(q8YTNBi%1DT!NUVeMUG3VY_C|
z_8V_zn?SzLKbTYDRxCmpXpdSvowA5oRm4jbX~X+a3_lrk1l+Xf%x0<t(^)udpT<yQ
z)TFnfdFYkxF!lZlP3_7<&}$(LAHOePZW8>x31i1^!}yyuV1|;>k<Sp`-P;Ck{Ydzz
z>r*KMPgMFLyRA@aY}f)L{vVG#2C0xU+~Kc9Cb(tg*lK|gK~ZMcT<rWU0cPfel)5GF
z#PVO^BuMGl`>9Xy6hCv}Dg=@t7_j1~neXGa?Fg2>3sR_KLc)}?8=BWL!K8NE-E51#
zlNzwxx)|<!f(WA8hrMS<>R0G=ep(4a?fg;AwgO2h>XUxrI7Om;W6oj2;c%(U&qsL9
zK-@a%#K55W`8XKMac(u*wHF#?EN?kUH?nf&JiA5_l$;E_L#9s^!fR{u9c}d_2(MA^
zSI~xMaD@f8d!UprS<L)YhibS>nKhXE-5}85k?~yV`IYH-#5eA(RT{8XEe}<EA&zS#
zw}|`)DaKM#F$oGKvDjqR-0--BH2uZ}VgpE(2iO$Zp~Az@Tv#Cu%ABwF=E<5_PL&Vr
zUa2Z6z7V^(jvWKH8>^^fP~d#9r98=%eAX0U>b@Q_3PvWs8kBxb&&{YdUW$gdoFol+
zKTRV7LFS!8NK-hVF6iRST21mmbono$g!>MFcqwA4(_SuJfK+Na=?7RnbY$yx(QCmB
z4J~kmRg9S30ut2&yJBS(1XIqIQxVYr%Ws{pk(7pMsn>ZAw2opaDWXKdo{}Y11qZqt
zt4ghIPk%lh(eY*Y1?)7JV=cJwf_h0w-Rdp-;jzjnX^yQOEnNixA`>hQR6%?u-8cU~
z1kacBnCwK#>R9t9&E`<OGv)WO<_c`tr7Z5jm`C}Ihyjj?tQGB*Xn)`5qpdsN_f3Ct
zh~0NR!p;mv?tQw4#HX9-9X6*o3}Q7g{uvP}&GChVGoMfSu{Y*X%RL|I&$2yaGeA6L
zZ-v<bl)g@d1n+HjL8=mBrvzlff7#g0wq0<Ah*6?Q%eyVW=q>%Nk=Yh<wyE9f;21KV
zK@#M;rl<!pvcqi1$J+nzW7G_@v$NcO{lp`&S&vSm^3|k?x3}m<HXS~LzMG+)3OQoN
z$~>$M*Z#K<i@7I7_fdsbcN&CL$RZ-Al@jN^`7+sp$?~V)Aot-Edn?QRuZSm)ZyV)#
zifnZalg&vex69!c_@!I6?!ocx)9+@xwcMgASapuOgM9zjog5|2Wg@4|o1`#3A!hw9
zw?tTanwG7O;FV>Do|laar2%t;(Wp-TgL;oE5E0K0@p>wzO?6|gl8udx&F|ruq<s)K
zdTX|n|BtTJ&+i&nG&m6Z_MVhF#2~~H)zR@n2Fb|5^Yl!=PJApv3Z0g8^YnCrkZPF>
zcs#Fn#h?;p40iXV_q?ByUawPn#9dvROiyO_ruKC4OQ*%{Fh#yEM75a+_D=tOL1Ta`
z^8ZjJc8KvpjxmeyxG73uRv1HxR;N(L`!)O?^A2So;iy2lo)W#|kCtX9eA)!-5wV(H
z%`^3a*>Mhw#-5v7l;bcy9%TqQw5#8aj$^<3`b6d+zi+mCoh5P_j42pjiS9~se|PuK
z!T*KOFoof-&8_lUYAAg8z~lYY(}xJ6p~<^Dx!|)}V$H{nkh#w{hCC_U0rNNHPrs74
z3VQ0{a*0!$R|!uU%21~Iwk78%u#LBgbUkY3B?M&0shOC362wl2=#r9>C}HTSs3hh@
zA^&}Lk1u%T>E-|n2WMz`)AwOR1l;v{J?`_3>H6ALMpHAzR9+8~uI5nlim?}NppYXd
z0B1DK+HvDxvNBoT3aM|yeKdr}E3FK+xPDw?8RCv?N_GTPp>Jh6@Yhs)N9jvIHNNEW
z40A9v9rGz`_0AU4n~}&w^<x)bqn-b^>jUtGxpMW&?uzini~DB}!rH`*2;r{VM5fwH
z(>lwFs7`0!U0m!N8-s_D_7G#9iR@BP_-bwHNf8K@BkPlfa~gHL?ZQpUJ>Dg2T;gUF
zl+2JSX6=E6^6WG^gxr$<<MBSb=(kqq84}~UF2<dNF2o2GkU2*|)V>v0JE8M;Khd9Q
z_>PkCdxiDE+FuKWD>HvtauwQ+e`oD5H&vVgzWOmk(vGX%pJ0DZ|53@7$T4Q(efH;W
zaOhEW-=6lnXB$gzZEb5Kr=%2voR-(ur=ju|q(Xk3rYFYW7!rZ!Gz-45@ds7&>Fl=|
z{44goL}ZPh99!dMCr|YyrzCD0WuHT|dP#hL-FT<j`><GW&GDZqQ%6w9z5C}}?+Nv=
z?v7&$y=OAfiDGP-&(36g(Wvj@65Ck+ytK5WWqts)G)a?Ved()gzcflo{bm!5u_<W*
z9j>K+>lCsOsc3nVqsTmy5Y&`1v~@Jv5!6t2ru24;+U>jQhM}{fsIdZON(LHr$Qqrb
z4L+bVNu4cTJ{2A*W#50Z$8*g;uBOXBL7dUViQG}<u$=A=0oI*nsU_9&Qgc$g7c?d@
zb)eMjD4D`i`#-a6p3}F+4j8NBTY`rJ<531Z=tHxIMBjN*)@t^Z_!@^%n7Y_e_D}eq
zScF2ZvqYoOsV7`Vvw;<*rM)ycJ`{f_Awzd3>*K?ZLBc<}Y(~C+cnIFzHSK0(Vv>A%
zG`R|Rb{!uvVQ{o<;`m87s4;w0#rO0Rr^Pi2OM4v*d)~LMLL1u&li~Wp@-T1Z^I@OT
z;L~PO!e-cv8$#Kj{2JT%uc+wjXH?vkeEA>#jW%(JhRNcFqFF1o{eo)}qczoiF}t4^
zhO!6ue(`Iq*?zh(HOobg!lM^9D8RQT@xH${d&S{$sq>S_TJh!xTt2Hej9kKs&S|eS
zqStCg+oLLL&6pMDfYq|K8-IYLU%^$~5r7$uYjUhY71fYy+*iHf?deh|tBNxm8cdSs
zT-lpaC_8hLmMfdJ<yuSL*~H5H3BUUi>{+>V!!MN{K1b+)D)l-&oMz0(Amh^c8~Zt!
zfq{WIM9bKi{PgUM%6o55;_F1{R~z+l$aPWP)BGp%gS@Humv6^5-yl6KA^(>H?sGTL
z;2Y()V?=s4Ul?fj=JD|dy}$k+zVwFOnH^;xw<SW-){w9HHlfPqey%r`+&MZvpJWlV
zGFu?^PwhMaNHJ1Vw3E-EXP-Y=D9=6Ige4_G*cuC7N?iKKysSfnUG<OmtInjWaARa6
zcC{Ye7R8TVKSu9U;2)<m90nSO;D-1yT<=!ftuK1Nn{-=48u2??ag9qH$(J$mIIN(X
zowbb#Q>dCz7+Q%!_rI{&lH1{?|CFnZ7{`yQSKB&z8o0vx_=V~n5+rS4&^foT07pzL
zO)m|(T74U56FF^Nb86+RA;wZtEFh&D#62kOopmCdej1`*JW!8KlwdKLrD&ZeeHa@a
zc2K7=b$P}5k$9LI9sBzb9E~CCa)`zIwEz~o?f0mJ<cn#ersNd%SweXp7GFjAzx4$)
z8l6ps0)6bWU$e1NmL1}2rj6>7v8=1CL7d~3iP4<DErX+%WE-2SF$(_r?9lLGQStF*
zY<~T3CS;$EM9^gGO5{lk;%sJk1JO|HAo<j8sJKqxvmmN>OIGML3DjDXUKCx4<dwgQ
z!a(MDtU+-&wgdvA7i4pM6qe-9`ks#`0q(akp$}vs9WQ^x_OAt~th`JG&e(OAEo!zu
z>eWijcB!x$6pKJW&mxeqW7#?t@3#UVD=4m5c8|Ki1iQ{SE^7Fll9iXfKn$Ds*DN%_
ze}6Rpjdhi#po{fKvSnO!rfH+DWQS>^swCf+RRvZ|^u6l)>qy#XaiNKR5*v@VJ59%j
zDe}Q#4}Pwpp-fS^+tHV7dUt{>qGBLOf{mDzx@F|Q;l!B7A|NKAel{@0p{fXG<-Npj
z`!R&}8#1V2RyEO?q+fqpO`Gg~DcFdctu|ieDLot|9%v+<#Zs~Jj&8<KmMeq+(?<-+
zxwtg1>Aat>6B`HB<le=XaQdRj?mOx}^7cf3etU1zg|4_z?60)@=$#<+VqZ!94?u&h
zDDHVgRZ4RxGJQ3zwPX`$$J|RgIg%g&0dWz5rtv^Du{paMZ<tM|>uo@N;(z#uQST%;
z9C8V)k@(bZRfPt{wd4@f9aF)KF-n5+CG$q&?1phWWdYgk!zitiB=o>8Q^A^^Z*V(R
zLB@cKnB+2PX~t1{bT!624#5+8Vofw7=6sRJo!bjqB9~W3VLP`Ro~esp>eTFkKwM7O
zJ%Wr3-It!m5;`Fs@EN7io7?Xc_TG3L$vK@T^6-TN!jeRsW+c+r8+X$@?E%Yi!@ByB
z&#Je74_?&m%Ym)*ml^(Vq|Mlu(V0Ra`f+LN*om{>0c##R*JKl6ViRrc?{xrYJY-{+
zT_g-7$P$eFzx58_g%gq|VHi@pk2_X#HYPy=^p0hLEJ+XXmGR8aF@ws}I5#yipB=iV
z*NuqYSyiEPrisw20<bF|Rw503`LSNS51swq38+64?zkJ4Uz+^&KH$PPu>{8ny$QW)
zI`Cka>JLf%=Ebk#M2!?ogX1UndwYMux5<sbOldc<XytpaG67E~6@!%RQ85;&#F#n}
zOxSUqS0I~TAIMq@Q_R*Vpb1hRxBPYp6q8#~ylW)FH(L7v;ZgoKVVg?Rs31;4bf<g)
z%=tJeCsaAlbNue<2}f3p8&3JhWfX_<lRhD0#{LQ#SRm%e^}D_^s1^QR=wfnvDSd+z
z_LK-pGVU#2*VaOU__3-R7@Le}l<bb%GLiiJylwdL^d0mRQOjN&uWON`kQuIzHB#5v
zsftl|pyww8pp)T-$=kx9n6Jrg7{oy(wrjH(raPs7TNS-}vY5Y`D&=B6oA;mNawgUI
zcsH~)WXJHw=YqZRi()=bGR!X|hw4Yb<j&-YEloUreU!CYzB)PpLe0uYbLgQ#i&S3T
z!-#8agsrXeEbK#~T}cXTkc0!K-CUMi3%bQn*dQzk$msk4I|(p>rKwzL>NzKpMvn_2
zfV`31!C2#$RJw#kY5mAb26q~nW`asBL)#4E=}J0{k)@(@@uk?aln!9e+chMbUVY*7
zBX;LIhb|&TeIu`|Uaim}_8BBduwi;O^t;dN#aICIC+Cl`Io*x$JsN*WA<_6VlW1?V
zci|GQ;VL~$tZ@97J%oQzV_pGd_#eiA6HIa0Rq97-FHz4ZN}1OxCyo~s^urc1A|$e}
z>&4B>Eb`OXv9vk)T|xm+kQuan5)nE5Itbu{;ThCQP&|!SJbffj&iP42{YmoD6^UR_
zukMH!y?5i`k<*##-YrTW?7K1H`c*%21MDmC(~K+1zs|0XPg#8H_{==OYfFac@V?{(
zs{@<7T{ifcfme!*SPTGrC;NinwRb+4@cRL#4hVC_3rmoAHuSWjY!T&ezc`#Ah*(*p
z7cl@=&oCCo%w5wbvae?buV3@T{l!#RH*`qwrj~gYrrI$;KY$jU@t(-sT(ijvN(V!%
zCQU2ZP6RfZK|`_>WS36O9y^^M7-~eV15-d}y+Wxa3Z*L^jFMsSF(0yWzZ2E!ZDQDA
zgfv>noCp(bH!d2zI0kuOA`$?D@q*L3tFR5cp3FL5ufM)}zT+B9Lk%aZfTcx-j|n>6
zHU%O*@qTc3u5hl=H1)4=!mf0~VRo`EXUCqEOkdH~SU{Pa8Tjwv)Y5wpnc7N&E>{hS
zqvDdY;m4aj0u~brA)skS+l(*p_-lU^Au&C&5fIreGUH}aHz8PHX2%31Mg^aS|6eYE
z5H+|DE3)AOX<0?=P>OektP$S-V>gbS+m3?A5ln1XAF_QX;bPH+n=}0cM3<{EN<Tu>
z(mL&Br~|G9Y`#BG67{2e_940~`L<)}SU*CVMBQt8CuBMEqnBy(2}f}874R|pO8BYz
zNNoQ30}GsN%w&5-vsYvE?^e+kR@<yl=;LKtYx`btrRD9GY=2%qU|EoT_zW7_cUou!
zr~D;{OVWv(2<0K@PmD|DT3%ooBUWP#DG*Jwk8+2?&*BGE3p`9G%dthPoSmW9kt?@&
zF`AAc+lVieL<$@CUp^?zKtMH?)a6(tn^+~wa)_#jq8V!V&Lfi_Vn#j5Ymm|Jt-AAE
zo?&i;KI1HyUp1OWZ(|aV)7C;5Lr1_5xTsqNj0xoegZ{vYC=XfJ7&uVRXP7!e>1Xe!
zBIR1N7{bPOHwohY9u0%gGfn|Hp2T2P(dXBm%n2bbSYFt)z&$j%tEmCfqn8!2m*to0
zfkRjpEniOo!CJ=y;a_65Us}P7**ig+2A*jaicfEbk_Baa2>sSfo!2eXV{>5Qt5lKy
z;pr=&+GxJFgS)%CI~14Tw8aZ86b(*sifeG!LXqOo;u4&q!J&B3;ts{#Az%9b{^!d%
zIcLxA>}E1MGxyGOpLy=}Ak<<^Q9oPya#Dsq&Pk*1`SbJj+6>*2s31K3UBbq3B5U${
zg{8#c3|ai}we}Z6&cAMO3SK@RdE||Aq!vD=O{9<es`jLTt^8nARc#Gktt@r@on&^k
z-*53JSI`71x^j@d!Y|g=dq0wEcd1Z)y_Gj%+uqaHru`@Nex)Y}eT7o9{AOF6+iP`D
z*f(B9m<9b@c0C#e3AS=#B)MYxx&6a97-*Qqt!!$vCYA64PhCC@{mLef{k-R67@QPz
zTNIQrle5qj9C{e#LKN&M)Sw3=8>x55_ZcHpk#vC2`%rjs@VexMzz$v_PeSI+{mOA=
zW*^8_5Ne7MELnE>o{-<#G@@H_wV*VW%%K+#&%J_hmjv5W;Ix24%M(!>O(Vi{iO|)W
zUX^n9CkT>^;=I~C={uIjf~bPVO6FiQ+ybWP_gS@n*<$R!Z*4@L&5^~{_Gysh@vI~a
z>&OJ1e09jKQ0-9#KOxRlQ=Kj5dAMNkc<=lGLJuab+h53N4l3xJyUuAzy?r)nz}{FI
zj*O!p?(udde#(KX2s)PoLVIl@dVpf|8G+}?ydPa@ysvkfK^q$h>8rkZNGFbqgBKGu
zZiYd8A|``rSh#mXF4EM?q~;g7uW?IhZgIC(V0N-L^}>NAC+O*^Lf$$)jmYLjEscX$
z1!EZP3QMCg5B*DBLBS<tG7n3V`r6Zx0r&Ig<NDGL<2ZwdFi{jvPlLOWFI&qj!w+JL
zswpV-0^K|~t)4M={<9|Su%&cJX$w{bUsXT&!@~$qEt|XpFz|88+dF3wIo=h9^;OuC
zh^S9F;LP-ZA<2nS=DQW*hjDMb0+OjarhwB=!W)pxN3vF*#!xc3(QNv(BeNJ&|1*{c
z3Fj%;*pj>2E0Z5<Jbr;GpR&)b5q0s8{V4tl-xgfGaG|reCw}arK*?J;6l)6<3A`RA
z&Ng`AkjbtL&Rwi0zy4jraMY2YUGs$6fmCp}pU%hhLj?P@Lj;o~M|<*RC5wN#5odUH
z_ioyoXhyMeVC|~|J>hb9WLIGL_%-XCQ*-2NcRFF$th2}HMO!}4{t1}W*J?gwAlQfa
z?b50F(Gnk16DNA{X;*YcIl!IxxYrq09sG;lu>HPdYTu~?Q#54Z#J)r;uK@v^Z5MM?
zVV%*LE2EQ$r`+)(gRqTiyjSz-%@XjD?x7N4L1xGJj@ei-qK0F@Q9rhvU$XtC4O~<)
zi#BC)K;9Kh?>S9f)A87~&${2PwC1P-ycRm}IM`zy=Yf$KIpy}W<E_fO|D-c=m+2F6
z)-zfWCQ;Qql3SRffVjHJTby|6pBRlX+)!TEs_!VIHu`SyrOceM9=fe_o>0#!E51<N
zRo)}Ewu#X1&KT+clqmcGLQ`wzMnfH+_Aw29Eawvd=kTEV26E#+cCvaVu{6<%z`5J#
zUs~}q;c8oO){yJYCx)ADOAE?A+8K<B@Az#hNJ};Q&MYW-FmvJ)J>?C(S7-BAtlfW(
zg#6(mmtI8vR=ckU6)(H-qq<d#0)wYZM7L(j;=kv-8d@y~=qd;}Unsm%@g6`mKZ1{R
z-M<0LxBNYPGMU^F3;u2rCBT*K_W0c5dhh!VO<PG+H`t9x50^Zh?2#x?!S*jr!?xH)
zN8(<gxR20_gfm9#=Ny59+2+65hxy{ie0RTwXsvFK&NF`?A=B8L8`g>avGKd!(VP5D
z7omO$i;Ioc16`h)c1!o5x$ecCy#V1P!Iw@;5}bX@=*(D#x$H&~n9vk?Pp~Za{XxK!
z|BSsY4f?>$TBov0SMd1FAv&-uLKB<J4E6+EH@{#ZUN#8g)2mT7ZlQUxYzm{NZ|eJw
z?{~QZp4@ATU+cOiEdR82X!)})ngJE|f)bfAZVFCVIH1xOy2fkC_9v(<naMwHAo$aL
zn56B4(Q}gGeJ^~Y9BA6=>WvaoZE+<%J*FH>_Y&zu{|y6T`h4#Z_TDHWYql%D(~;-%
zNsZjwKjN)##NMo3=Iz6F5ovl&{QV=GXkQ{_=;|i}`SF)xJmwoffy$xwnj^&wP|7!n
zAsJM1BdHJgp-1QVOFCw_vG^l32m(~x=UG_C(?SIS)~Gx-AfNCZ{HUt8Iz2u97I24=
z`Jcz!J93#2je+6{$$lZAqhGtbhA9Lx#k$5X-vsBfu#yHV#L9F_bX_L8v&FDb;rXp=
z5FfThM}J-Y_%;-l6~+1U?Gn68O{do22{`o5;F%8Wjvt>Ltwr3L(uG&$7}oYUQm?`;
zklIyP@2fwkh~;L*+`e4H&ggpi%xo`ZUS6F$-#voYx}67~DDpVKLG!CHAm#dpX}k=S
z9nsCPysqd8-M?thm$xp+hXtkQX#Ry4UQfHtz}^^6G>29Zl+)47gx-*yyV<Oo^)*hq
z_3K+$7?Qr6mu=Bm!9nERET2h)S-CLr_3Gf-S6Iy2%Z81<QC*Uu#rO*A%q<^;Ox3J?
z%i`%~1h{z%_91GG9^hZN=_2>~Km&%2aA{%AutGB7*$_?o*<wz&5)JY!(70PZK7%=7
zv8ElDg1ahq0TuX<JA8q`>83tP)pS8757k!}Bl?ZsPHcDJDiZlN!Q^cpzQEPH_=gz=
z7<L!BQcl{vrg9pXR^*%qCHdk*RM$QnX*5IYh|wG_bA$1yaa_M}i}qT<@CK&1HojFv
znm+BhwKA>Ao;^^|G^eFGPpw>AXESm+Dty6M_3<H|Ypm*a?Y0)1=jplf0Ye|T-q+sG
zy?WBHVx4<Xhr;y77`&_c!oW}1b1Wj%{B7%i3I$jX8}ES&NhS2gS4d6g1u3xJUF4%B
z9{sL7{v(C)p$I8k#dIGR_(dqr>jedDB7*{c85_}GwTt$^m_FyKs)004V3(hyKuFS-
zyV{j45wL2&>l210!#n~M@b6ESn-#diD_rz%hpN9%3WI_T!{oPPS$pYfEdAgd#lrW)
z6U&k8K2pk{g<8X(lIO(77EX$Ii`D|QMaUv^yX<qWdW_Sqb(71sSwD&JzRY^2_AN(O
zBSV;wWyzveq9e<4e-hnJH*ux8c@=Vfv~?&P4BhKXd-rG+Dj;C9kVFcX`{gyLYmbJ@
zD1Jc_^4b*9*Ito#_}W6`Wscy*<`hhEEc8`DO&Kl~$?*RxS|VHvSH|fFFWi5TJ=0n#
z+Ga|2H*PZV%;}D;Qe`MElTJrc#pM5R%N#Wv5{D4SqY{$g9<b-3iA%@P_nqEC6_u~)
zmDs*0x?oc(q8hd^!YH2#Zb%#t8iVqo1ErMdZ;?pys(PEA4DKd}0W&!+Zp6?1^hFXJ
zeG3m)Q#$#Lb|ei)Y4Tf&L-f#vOLGN!<s~(26RH#15XX-&dgzT-2X~+6^bIeo!P*;D
zRQ@KoG}V0azm;C}zsLiA-*~g7`BPYQhL|fOYdj3IjjI*yHlFzgd;Th#vPDi+357{a
zNy#j$i!5!GBgkga>Zt0lcLUn%LKek8=8gx}II`RnubhC3qm-eNIyUu0Bgnq#2DI%j
zRLSju0)+g~hsayn4c--aT;ZbSM}NhQTz#cZ<xpfHVzeCl^)C;^)COVC1oV~ZW2@CQ
zwTu02%{u7M-)0<pObHDCMy=(Ik;feI!GvC?@_t&Us(78o{*6F{gj->=;&`D1%rLRV
zX^ej3baW@<jK&M*$W>3UUS;)B<hMm)+$N;^=3238gq!h^+Tzl*`KsGLV{$#~ja&&b
z&h=5f8l>j+gYn(p-=y%nF6%*Jsu&MD@TSvf*XP^BuaF&LeDez`pe2iK`DD`$c%bP3
zQEsl&!Q2Gu(x2YFxiVchh&Z^MIYjfdDb@21p>S0fakV)r5Yz0boUpFZ$>;nIc6^I2
zR}qY@WeSySVB0ksqbJWhM~dRH#F?M<S(Xjw0*m}=hjc|Af(EK<(?t!|86SY(>q8A#
zioW(Xm|Nype@;q%wy+dc8=)(*608e|bBOr#m&xN~^j-Vy>QW1te_mqI8fBk`Pj=5k
zUpN!u!KW*W@C?@>Zfc3oN0Rk@<F_}`x}smm`>ZESf>j%gY-^An?d2dQR*31Xw4LDS
zDpEDR{>x{BgZf$)F>=n!UHln<F%yYXz^779vngMqg$I-#-ztji@-{RCc-ojUPU{6q
z>L7}TS7KT@!QIrA*ys_#KP7P8qe0ES2x$Fw^Iu(B0?4=~js_iAP@H&<TiQt^zYSjy
z>dMYbXB&PJVl!}!Qiqe6qA&z><|z+D75Gi{ur4c`LB_AqcWv#>JL~D1f9;NCN56M}
z7P6Vx&DYk;8{rX}mkQDMNBWSn9M(S{3i3MV$IfmtBMDBBbC`{eUyk|Qk~iA?1Fr02
zOvhE)Mbhmh5KxU$qmv<t<f$uaXeNR-{WheadXPk4Y>CMKEkt0OJTgNFmH$%=p|fN_
zHSW#tYt2mO;GJ%{jJtjt{aIA<n(0B$1B-MBVR>~oA90_h>ihRNT_1jK`v(4s)M8J4
z>d7^N=hplEdu1g)bq4!;@$lEQ-000OpK&33IJLkom`wHW&tln~IB&Mh-gy=3zVl)v
zs)zE*18A~#Cf!`te;Yf+2JGA~BpC_szfEl=0uKq)c7#vC@;d5+5;qSP#pXI^n^)6o
zPFCez=kd`AmoZN88JXqeUA(;5THxxB|2}M76J94PE0*<Pgti=$<M-$MLi5(1o^CKV
z>+z1zm2g-0V5Z9<ViWS|dVf}txhp}ZwayV(1`3fHL}iIcP7TsEK~79VP3`jcH;Ej~
zWu@ICvTHWY7#jm0USc;BP)j!S-Tj9K4EcGw|Ak16zx$gNVjuFq17trl^`Hz;2nK5g
zh_CWrdH6Y^qwrS<|2r4bk;Dr4@0=Qh>^E}Izj7fMH}c;A|H{EHn7n?}0T9LZyL|o}
zlG7o51nV}>n;0D2t1Xr$_}{bsE)pTBaegg)U-6;EIS^0Vj3LUQDFmN_Q|~psp5kl3
zuxT+p@Jr1Xe|&<W?f57F-%lxm4Zid|v|$>8PBkZHy`M(-8%0S%J?%M`7oSr{5X^Eh
z|D-q&>~>o!)G233rjY1~{oP(2^FFL<-p+eDk5?c5QCu9c7Wf!HbCOwR+_tA9?R%vt
zFCX&cApNs87TeQ|rPPOz_ZPBX@^LhRC+sCaY{5XmK<_!DJftD5jPUn2Ox`yh;$>>Z
z<?r5MFn?9+|IYZDGXs->gD;7TZnI7*^R3$(ar|_CtCTu=Uh7|BE$j-_?opW2mYlD@
za-kGHS!P~*c^!?vBgm4psh!?S%%<bXtteibA>@I`$;r8Gvwj}eE%Ryy?aiBH&C0$$
zbe3?P$Qmv3%`FnlotRh)%#E0ME6m-PXfw<&T=-K{m?-p|ZyA8qL$6s)tE13aTa%Kw
zq?X%E%*;&QUVNV@OG1;EC;q&LiEI6N3lr1)^UlS!N8jUVSLC;El=l>V{!2}cR0d5B
z9Qy)&*4e;-Z(|x9@Ryw{EdU+Q112T`x>y0%>>U|^ijjoi+EvCD-@5`xi*6w4H=Ehn
zS#l8vbdQ_BneIoKT5<r@wz{m=P;5|s5}TeDehQi%h(1M9PZp4pWmJ83t2cxa7>FtE
zcK;wK?s|X6FFrT2v{YbXVsi7gF0`aXzUhp<<^wAgua_6AJ+G)JD;KYx9@o)gBY~%<
z=SBUE_XmCbD5sTHf>aCiPHphp<mBY*7&tNa``Ou<Z+LjP@H<;u+YWhoc}fm3u@)0K
zIk|XZa&mn*IXy`E;`X*CJulCc>HgtiE_P+}Lt1mQS4Vq$JLT~7biGNX1H2JnGvT42
z5NR$Vz)c3g?G{s3%eLW(`_%*|7ngwhJ_rGn2v``;p>ny~=TKAxzEmmRaNn$Vhq~ud
zD(t+uVhkDT?JY`PURgQZ+1;IcU0q#${n^#EI|Ky_pPZO+bdY@k%LWmO95j6G4>%gC
z)p>f7IjN_xv9X~Ra|s&Pnbz{9eqI8IfM5Le|41;1aVrOkpb#DP^CN%|q1%Lj;>j)&
zP%wk`Mg70G6M+GEL_-?QgI=-+{q%u900s5uJDUSU&5(Ei{0{gKWL$7V<Y$Ff`gbp2
zpa_`>319gWwuu=5e6{Y<9zYm~+?Y?#Np^%l`eq0~O1T?KkJ>;lN-gCYAz_5aO}&g;
zu+iD#a{_omx8*j_LV!R4WCv;(5vjYUY)F{^{`WyB7R@(O$YJ49#2^MalZ?h)@*D-A
z{z@kz3`)PRmZiKmZwi3V1=7LNl0j1sjXBC0f}arQX_{R^{+MDxdf3Tciw(Ve1jJ(3
z4ScjG<2Ef0&CqxDKU4Q=hZ%4^eHTequrqpeKI>(3Hv64F?t*t7zV&04Tv7q6%Aj#z
zbvp9gv*LqRUT4JORUa&nCU{7TtHI$9A{|VIHg*Oa3_LD6WLqPIEaM*qVkqd*_QwbK
z+Nxi7K34HP4Y>)em?75y{3?OI$r96GF{nI;^eg0Kf(>e;&KJ3}n+wI)`s|VE&CPgE
z9Ub`i+@a}tiDbsq$k5*D$aF6+8(Ijqxm?2)Q~veyjo}^P5MrqmQhHWa2{x!x#^v@b
z1o-S&JJI)x-~0ZZF(047!>b@QcvHYU{X79gv*tSx(^}g@?F<u%(A!cZoRJ#Y_XNSE
z<>(|z_s9*Ob;+y?>so@?wW7X-U`L@_Tm39U{)vdo|HcRRZM_aX4_gKS^jAHhc6xe9
z`IA_K?K$nQdLpe{Rfzc+qt;jLmso5F<P1;>mwC4K+g-2A5@jrGKihEr78QLJdW_*{
z<Z{!K$_rC)(Z$D|(AxsIwYHN!*zgcg97i~}j(*=dQ@X|LlvixP>pYT5kV5j}rdXv2
zo_YCVma|T_jgY1DAm+1%(6);g?A*e(>ibAkT5&y?A4tRRm&oA(xv`zs#Ik3*4J}G1
z@+gHF1sVUTBTsl)C4c2cRfw2<me&l!qiS{-kUV{kI~!tuy6SGzw{9nJ^Yc;!$T`)2
z5XGhyCsG}_R!)~;svXuxlO{V+BKPU;N)Qe1O2-O(>4NnZRNNNatavpff^45wb34(%
z%Zv5Idf5R}FG~pvO#xhium>`4qITSUji8)1BxT+ul`~=h+$N3Y@<3k&_I%1?)=k?f
ze17EXm99e6c??Y8Wg=Uz&f)WbJ{SD-=J6=+l7~gn%*8*@(7mjZl{E48SLETKyzQOb
zoSks>Es>F-$j6x>-54R|foOq|xKFd$f;v#RR8$+h|ElCOl06`GLLFfXWRxI+<j(y`
zSMnyi>rfpC5N*M$W0ziPl!{j`&UNxPN{S>nJjn%2U5=K4A!1a^dMCcQmy1=_dnG^L
z40J|@^ds}aK&QSzC@7Mf%?zz~2PJY1&TRgFTsb!j;o>!ak$^WwqiYl^64=oDMjbOd
zi_1h5eZ?d!U)y8FuDm5CK~BVE1l;`+uWY{$dZOyRjx{d+kK)GIiV+HJU^ZL`PD)!Z
z3qN-5ZK6DEKOijPeyie?l_>-;=hR~m0>+;SybG3U!^bYP;`gziE79AC`hhnSc!&#b
zbF+Q3%1iaM+Uh}NRCmr?!-Ibus53}FqrO}iOZ?xw6Nk|B_R_1t=dab%-VRLGYY9cx
zD735t7;YiuW3(wKqY7Xqku|2Q0*6*@Nq|C?$Q{!+0)Evm{s`CXI*f6(c=b22gXJqv
zuT83nvHCUF@3L`N&^LK(*rvK=>TZF0EM8FED7<~u7<g@5dgf@J(bQ!fD)CmGA6aHl
zD>jNI0!tER@Q4<{zYsh@8o)n1iqo_DULR2*r>*0AfWx~*6>3o4lgu}y(XjRiflED$
zXk|ZKejre9^zc%^U1K?{CJ*Za&S_9}$K!fQA}}(g28-7z1Iv&OEzY2YLS_}y`}q<+
zU(yE4<;=RejZiP&U^4`XZ|ZnRE2=0Fl%hgI6Rz88I^`@C^_hai?<0GrFVNj_KMnzI
zo>P?pRCmvKPifx~LEUmDcV%n(*mL5@U{Rqbkx$ZVu>Kt7?Tv@-`Fm2<Z`n$8twEQ!
zmjwShujRxtQX6%yrflKyH^JNqz-}MHhv+8cAMM{Lqo$9hb}y$Eq&k@zL{@){SB0(5
zV1C41DkuoZO(-VB+U5S?86yt0E2jjoR`JM2+@rc5{2^2L`|IPoyG<aH1twEs><<CF
zqY5XT<P7|XD3_bjej@EDZYY$ffZ(Np*_ku!AZ&<{poq~Q%81WY_|YYpi?IwhRvtV5
zb27mydT|qpc2w|88S33|A$|ac!G^8~^H4mRD?6gNKe{>2*~1<}+=@K*wO4SFDLXE$
zuo5xC(Y)*8vZR5>6|0Z-#@$Y2o*2}9)^Es(LF1GQY2n#o5@<e*aMN2OBnFkxT#*G_
z44QSg-r3&SVLu*=;_{oW0k}`jX+~F`*S8KMi4M~)0@O@h(K}^iTD-3SPf|24gR42c
zs{h#@i=fQ7qaZFbajmea`lpX}YdyjRL1?Zs-|vgIY@D~25}33<7)N_BEm@o=tVoe>
zL>Tikzwcl88RcVI1LdG6E#>X=s_FcNz{)cb?%73mma~g_(et@Qlq@TSC2~F%k6($H
z5$R7b(H^>1j~Jwcw6B2K6YD(klOevw4lzL#cTNo&+O#<Cw(7?#2CTAlB?itAv4t;@
z6Vtx30HV-zZp7pt!iw|{7Z)<}#D#EMIg?8Rwc{GLC`YxUN<>1!s?v**S5)VKHoX~8
z0QXVW<1g}-C(5TLX(hvvGIYdrMojH@UzB`4X7IPuz1(iG=fB#bLxTV*(O3aT!&fQ*
zEL>bUhg5D#Z3O;sVhboOsd7ycKQ7$uexdX$2KX%pkLm{beN2?ZjU%)=^X=~0|1*02
zYpK92Fe>4~nH9Ql$A>4=#Fe2in#1=VVPH`kz#Vmf=8_~#2MV0Q^+O$4eDDIOkq>ca
zfF@!)v;dEyIF<=9xSP$=3Pm9Y)9p@<efGdaMcun1z-~BEg$-1+53je&E_lTYLuOnL
za<oozphg8CRlGJS2=GQBY(aN<Hnk5Xn$w^*8AHfOOcX-xm_<~nth}%FC3wnJ2@-}f
z0g{sm)YG)*dI6-PgDxnay`?chCdec(Hsp+wHY%wOE5PLiJ-Uy#G%3``ID38b0GCY#
ztpx)>bVTQX2sHr&g`+K4ltxH6nJz@(NvO+W`<P{=O+c^0?Fr;)KPX1=D38x}2a{a#
z&x5F*XeNqqX5Z(v1N`EPw?sUwk2@dmP2Kl{H+mzWz$kjM%{YQ@Dd%z{r0D2)vgD0I
zN1>!*j$6oR^%h!muK)v&n$SF1PxooW?6v@`&>6JNZ$DVj=6@h@30TMQz5+UhZ_QzY
z94+BH40_qG0~cH`q}ub4f|Lfs&)m*`tMV17XU*NUKXNN7LFNk-&-7{_HXkdg4HM(y
zHj{(lbXoMoD0*kn5Il418htZ>WW6Wn1I4iXelHUvft(e|nfcBF*N2c$#J@fC*lSGz
zBwj0)x#Vrf<dl>>8zlIzcQC@_QU}n4iJ;{B`dJPUxO8+t?!zaBCZn_t6#uRS%2#Q0
z3_<rpLHjCXg2;T%bRjv-WV1FC!|h@%QXTC+eh(co{lAU9&R5W?Tzh)HDvZPe_W%B6
z0H{I0sTcsiaRgEVvhhf4v9K_Ut|ru%nkCE1oMqgRiI3fv7j{pAzmRJSc6Dz^!dMjx
z<{zuf4rqhCN;P!lnOPei`EWC|_c|46>NWL2J1wTQ4}~m86Ey=9y>Vw?M}xCxcK3mC
ziUHO`f;{3FQQM_~K^(3U&jCDzbcSCe#5^YVh%&dgn~j>jgs-K~84$D(`19!T;DImR
zZiI}LJqzkq`+FlmTs)fE_-iEtM#&OqCRPU0*a-JM1-^kAv8bU^@(V>%<;c93NF|k1
zt;`SmYcHw|cN1(Gk_~)7zP+jrSN|P$_ut~^e1<wtr@*7|q#Cn5C8`h|dSBRua3bZA
zj4oAy*~Z-&kjEtpK)P=g>nsx(`>Qi%tb`ln_nRChYD>N9yh3Q|P8~d%1h{f!t5~v{
z^uK$2P$;oCbdUn)^;+M)6UG)2i_oDW)26DL+-z)WIoysGI%LgX8~STIUB?o5ER;1d
zDNsI9Gcztp{&a~p3D3C#d^)wtZg2_h|C!?*E^`=}*A$u}>0=9DbUa3803dtRAZ-kX
zdx=8x5PXmafX*`$@!HE^2G2cUYjE{-9OS#8DV(<j*a8O-sZ>dyi_Bi*VU?mSB={il
zJHmvK+l>4CfQj8RxTov9#{FF?JMtFt1nS3lY<NeN9aw>|&44RvK}=_YxJq;o7dmLG
zDNg~yceo7fsWKLt3LN!4c$LF{o(`Ks8U>EhR+UP78dWVmq1h=v-fu%EC_y#91vmiG
zmM65x$&nAcWJSYEF?}j9h6w>d1iJP`!s>$BsCYc4#43^=qAvowuvMrWmg(|RGjX2g
zVw}#v)|3Ja-A4)OJfK;Qzr!)K#rER2)aYcLx?$yt5B0|OFx<vXHyf-c__3n~D6I_!
zhybL~`E=Su(nYp%=xmbF$OgKYL?zgG3<HAR8{#r#w9D)U|8<99S1mO#B-Y~Ob=qfi
zYlltR)c$nCSpoXdwECTH_7qdx*)7{$Ec@?gH-}U_e{7%egi9Qey5G0Zf=V3Q&$`kL
zq04`WikJ34&`s%o?_u!Ydssn=#Tn!~ZRqjgV%v{9?vaKdsiJ|FAGXA-#0ZZ|D%1Ty
zH~>lWooK%OU(0{iRB`#)sEs9vi{|paYy3hp?fgy2v-%i5anKDY_C^)iekN_P1>^A;
zwj-H3W3{$AV}f9jfb@FX>$TJM9nW;XPnbbIDQGt<hgG1rOVX?M@x8a)+h@KvwEA|Q
z5`;uV_yn}L&X=Lym*9?Cvu6o%Dym){G0f9x@$-CKDGA=xpfib{Epvgo<3lm)ozSc{
z(#^v%!$Sm83YySq!}%i9J?HZa*tLSUExA;cv)RM<<R?ittmrg^Q6_9)mjZ2V3Q(Rg
z<XmDWGjA>A7Hk@}o<x7bB6%O#ef@%?mRCA_xaf=Kis$h7o-J_XJn035ZR$g~*8Usu
zFwrPndu<}WSrZkKXI)t&NNcMOaBBgR*95*oUClMo7ue784a%v#?nApWoHT62jEF$h
zZ+wh{Lr*UPa0@67cZtJ*A`bk@<UB=1{<TiWoOj+C7K0np$hopcz<Ml6+-zA(v9EZp
z1FarQQ0q(}7{ucswY>2OjAGw()Yl(+2v0vBu}-g-Q7Nz)Op|4E9foQ=i-z*kqJ9|j
z4z;Bh2qhU5rRp9SLlK$BH5;jBY6)<XbXr*4eE69o<}pG2A~QF$Q4^lmC3JL}3mtHb
zbg`>o;5K%s^=)Km_op64a)Gvzw6?h1^0w!u*noHpJ41$A_8%ICO5yJM02g_=0KPN0
zAYp$&|Ec-?h;LA%!#yF|!r84!55YyQ(@{p`1gm3D^m~g*rCa=jg9K<Z%_GPKR=uzA
zS8hAF@lMmwHi0~19{os;K->1wKs69+>hFL|`^}W-{@OJec19-(Zi)KYTn&~Obd??=
z_S?q!&n^-+oeVKN?*dCZ5@Ny1xwM1GS81fBW(WEJy}_wx*s5ZBVCdO7tRs@ceq!S(
z;?teRNElKjOXC*FQ6k@JAcft5!dbs0pV{!Z<lXK{nwZ%}0@8@`X2p&4S+{DH>u@WA
z349#*O{oJG+%O@<S0#hNQ>{~XH+O4Z0UMfDFFadNc$cJmZDFGO?j0fCj8>{PvO6;~
z^W;5_lA1rFj~;_N0YSerNrZ|blZ0U0I+6Tjtb&6Bw*2-~l*79<eMB>FefC88xR@Aa
z`b1gmZ3G5w?c}=Se2`*T_!%fRYUp*RB?1kBZUjmYzb#5c*f|KN>12;Cj2;YZ9YW8y
zDD>U_ih`z<OZSZX9N>e@h{bOvN9}-`xV}!$IbuC>OJ5_Aq#{uFT9H(3Q^gTejymKy
z<tQ4#+R6%rOeOOFkTN0yDCxwv2Xmx2g}961OF~pZpb;Kck<GiXNg!vO34u(_<W|@e
zmnu0L+`GqXW<$-;<y1PHt0GX;3oUzdo>-z-EcTtX@AHqo!KA{S7)B*VmIRIv;)GQF
zV*c-aVZTU1w)a7qg&~$PmY9lfEdlQs5tFDl5-kxU)H+{dUM5FNfHT{Z6={HE9(QlL
zX<rwP%S21uey11xY4r2Uo85HH^&jb`%8KrrSUCJ<tO+XrdCMK-H+=w|g-jtE$md3k
z4^%aNy9P?%1U)3&uduU5!Ls(>YF7O47&%2Ky3GXs0a>naw@M9SV-KbTjlTO`?^AMF
zNkU1Gm<N6#NhwjQKpUIZQuB{_N)eqv4id%#wZSDOHj3Ep#Yy3*K;S+otrZvpni1V^
zt~);?qZ6&jNE<V%Ysh9-H=6gJrty*aW=h48fQ;-{5mufqb`Z|H2tx~qFmx>T&<tdu
z9fb)&LFLS6MKVNMHfl-jW)024b`We44vOzE`GMdR-#rHqHRQE|)WS0*s`UIC&<14u
zL!|A~o~;0Ww4<x5v~+=Y40v3;9306dGIXBT2k+q;#xS|PahhEH90`uYTcGY>g4!{i
zR<o1wH#M7s$qj8gy_z*J*ywp+wliS*p$qm%ryNHe4;i{+LnIF!fbS~$hWvZ$U=0<*
zp;HW9jpj9n!{Ij}e}I^vuIC%74^;-?!uE3@I3Rd2vo})r855r-{X&g6FSWa48Zs2d
zdYRWK&$M~q{9H$0Feog7G_*64zOfF{{OoOBi^ULrbaX^HJU7>5A|fJ!_qDOngQ>RE
zIQ(R-YwdMfTH19T1Y*nV=630unVBj4yTkAHz~lC0MY+{&Poo1K4On^I?6guo-x=_D
z5SsF@UWNbabqbGOU}Iz7(XqfYd+5bRY2+tJ+&HHvg4uz5WW2`qg0OonY)s799h-ym
z<AquasZ!hia$#_&8szh=L8Zu_pm|epC>m;QL)Sa5yt=u`T9pCj^Gja14@frlA^@<^
z8!6GuOLIn;F3|*^I5ElC8+HXsqv^vdw#@-k8~HW7XR<u~LClBeP{d((?<z$TsDSR1
zr2f@Uo0uev85jzOG0hi%sGy^pg1WD1X)?{t1bJU;6K=*t*R~%@vh=y-JUqs9l1nv4
z^Ym&jhj~*o_UI@n=Pdt_DG4_=UI?+lk<x@`3&72)-|0C^+u%gIfOTakftoc52?@D?
zIda}ccKnJ3-V2JKe?@tD&+Qs`g6a0+;^OSErfc)Kc`a=Z6Fxw}CC^O0-aAW?M-&Uy
z#%*`4E>yMM`XE&e4cr83@t#Pk2In=CTqb?DI2@u(elx_|EBj%?va+%bIVK00{^O<Q
z5!HWTk$;Z?6#GAFQGkv_7~9^F9?3cDo>6|Y;m*$Usl@(pG&YK9p&(2?)A@9v+DZIx
zl@|D@0ys+1lu51;MkTL@_po2{FC7Ech*Oi3>xVICSFvP#n9T%PW~ZHxaB;7njB9od
z9v&WdcUy@&hVYQh!kQzjB~q~*K1@9y`QiHnYJ@c7RuC=diJX{T#FrXA5rM;F{$a%q
zM|5cX3JMBGf9h2_ug$Z14ByetJVLI4g8%;Y2XZ8Gp$(DEt&i{>GPkY7HwP6pzvki5
z9f*w?Of0Blh?OHwS-FZh5^v4I@UA@%L32&0h^YM2Uq2r<G_7U<-zcwC>GZ$i4h-Z2
zbs^l^EXkYSJ;Z8?AQu;(v1uf9J7>v3>Ac39(-;^xwibJF(zox({SbD#SiD1x*-1!A
zKl7O+<(CxH)d}9$9G|Pf4Tr_Ms{>)A-K-L(JjoA)Pv2|5?NJ*{qG5|GEOp{dBzfaj
z-U5%&9UUFHbIPKhX~o-(ZV}wfI@}08qlaKxOnsi6#Rd!Nz?(ERbujBAY|WNCDb%O-
z*QHS1di-Ec&AC$J1Q3R(N}3p6(A{8DS_aPN;QUtk{Y_#)G&mn4aq@1!;6;V9gju3S
zeJIF&)WYtH&US{*cH82$&KoA$f{n2mezk84B)t(h>9Eaj&hSR6_1U1Nq1iFyOM3Hm
z3cSHF`gaX!`*khy)2o>b8=8+Zk$#}jBd5I3#hSc=trm}qRMf085%l}cJy+54*SQz@
zWr%7JpvZ23|MjfiYfa7clA%hS5{-*Sa8vD4@#D>boYCHM+|Cb1O%|Whp$@r5C(h5|
zrO8IA+m(!LEaK%ua!UVVETzgHn>g#Vzcj{Fwj8vaR1CdSBIOiJFZ(vErgWR?uBYUs
z>u&g_S=YVZq;XbM*PW*E{jb*I?-iV_mCQO1qk8=2cc){4+=UP@HPmFAKH*gx(-0|=
z1u4zm(lI<Yax5ud_oQi;JdR`H(H#mYk3m>B4S3MudQHIbgwY*#A({HyEBDxqRxX?n
zJMVUI0(Nt{#upX<j3}$9xE%I@@umz_o8(ei)L-U_H%3TU)!1-rlK8L>8!I{Clry{*
z{(|Lk@$2)4FDWt9U$^ra{Yd_B45vwWTm2~=GI)bruFR;FZ1<D<y=4KT8%gG{Zoj*x
zlGj&v6{Y6)?yCR0KKx!G$*$7Av`lyIJ&UpSlod<nJHPZ=_hArnq%v@>k{@o@h>jQr
zOk&L~Et%JRjZ)@J)$4v-_*&Qxh3dww?d7CarAX`FoQnR7%DiX<-J?V>u)k7%IrM9Q
zM`Y6fTuySl5FMYC#U^csGuEcI8-BuhXoOMonBEh9dQbRtbq{Ets$&sM@jo-D_;6Qy
z=n}PWpY)ciVD8+WmfHLvH;$?Ttq7&cZzpEMH9)d!MN;3M2E6;%dk6U|Ux>5s4~Ix_
z3f%0%E$ERmJO&GPh;aplJbQegb_}*J@VRT8VC;1K>55JGN7__=Vyf-sZabFF`(Yw4
z5GO!ddjD{|_bxzVDBeZk$LlbVDVhJpp&%!N+-<*&?Z@!MC7dwYuf}54d?#%05jOqR
zR?VZu4-~{FUwHrh9(>%b*<yp*yiU`cF^cWv@dxRaqKVkH?Z-q*LPwH}GGeAGoX?K8
zgna2WUovVnm<J|+I2(t+XZ{2}lHEXmj=AHu=<FwX|0PfCA2WrIg*wz9q~|k+F*)L-
z_EsquTYg$|elCBJ34?<N<WOpSdz(1_-1%2fW=21_(i-}kDxUI->Vnoe+;JPSf)9Nc
zC_%!n;UM1_ycO_7ZyuiILQ#jCX(w3Yrd6{0dHd317&v1Gy=Z1?ZNITzIfrkyInR1i
z#0sbIn;-bc9sI%FP-;YPZKd4W<L=Io>Dq`-WPOJrunKDt`Z5yqX+>r*<j0~dY^O#l
zXm7muKCGEA!w7HF@!9ys86~4-oZ_8;s+(dJHORd4ST-sDTEcJ9v*5;(HlsA*$C8}9
zDlXqI8`ZMZ+1lQh=qu@Wl;3A$f-9Qpy0I$C+BFB?YE{&I_td9cDi%cMam^7NLJlfh
z1mc2vgmQr*2q1MTDz*D@$<v``WSxaB0uaf$pDWjIOeD1ULZS7LIamM|s{P((7T)4-
zr7%hNNdM4}SjFpozvNyQ_>vG%om(aHF0?vPx0YV_4Dh&}ck#997~A;IRRig3yQ6Mk
zkyT{P8)w_5r8sO3dCR!w9NoMDc%F-y<`eBs3y=UAYrChgFh;Jvk390ATolxaY*pH9
z03`AcynZ8TJiT*OhH%?b_6-0*i_gK^`6z;H4*^p_GX}3z6A8p#HDh5aIW1c}7+DB@
z_edyBSPUy#wbmEeRt-twGV;Vz;Y8BE^F4BHQ?fcfD=Q|gDY`$jalbJ-S7*EERJsv+
z)kuRjzwxOdby4AqAG-aiG4$oHacMRZ-l|zwciPphxc#Zq>poBNwL?)$37%jd=3qsD
zehMqH>(fYF4wV_Tekh0a9}r(T@sZqPGlClP=l%;bV{LLv#A$#~NU{)|YKIp*hJ&$-
zwf^lS%8JrdUNJXQ5b7yrQdHM;=e<CT3nA!wg}Ttqaa@Ws?;9ky8DuJX+gB6HrX}vz
ze!1Z+W%@1<qbXUm6bI`nR}9H-_eS=|LIji<P|4xP9aOvIc4QSbQNLi>$sJWxCM6f5
z>+$mB!_3Aent99oP@>Lv?c5%YUMp>6ezLV2e(jEGbQaj$>3#YmEu(z^@U9jM;fPBd
zsyu__P{Iife9k@)48lP?a3FB3Mds-`2u~3T+yhulMTs1uLSLnh`J08eL#n)Uq#${-
z5oey8E26T9Tp5o#d%RLeex<@xpd-BcF;&OOpB7&34r|vx-;1`E|D7wdN%6re%~7Mt
zjR^G1XqCzhbTsG!MhE&x*iBqr5*@ISJm2ljY824XR;_^#I4h<VR~4?|{_b-LT))tQ
zh#jVL1ScUeq%d{&QPg-@Ykzm3<otM5pt$)~)vp!AkQk5Rs@3}a18MM(6c=eYI>u~`
zwJPb18Iz_(Fdeo@-8v3w3xl<e@-P#=94KXOn2{iyy>ItpJ;Gd@7auXRUZEfvU&Lq2
zaxL~Y469+?YAtJ`UrA+ZAOEVe<FLQ~U`O;8;ce>I<*+Y7=2k2s1<3iY-=A~FAYr~I
zsbGA_Aui=?t-Z)B)Fu9-@1sV*iRoNvR19GyUd*R1PGTiq&UYxzXC+?9=MG2I-CoOA
z3xCqxUdqP~Z-2i%o9`YjW%aA@=~l*D??vx&bE%64L~V}Dr?l@MYB?2&<I5k{DF=u7
zZEzts$4heW<Y_$8uKKl#)qY@Fy()0ed`tY+UcO9_gp2D328*ip_sZ|Asq9K-h2P~c
z)Y(l!5Uu)!3-mEA-jfs++G1SjlKd!qjq&+C$&|jh+6E`4eWgRO7D@Q452QLSM3{D3
ztU4efOj~#=Epmz%^`RQMznJ&sLnU&bFnub9D&)#AeaeT5<Tx;Yj->7&`9IG#v-9$P
zh3&L2z$a>k|JkO0X5uCeaI-^Z$|S)`aF2oq=7PqWC!%JE+U*cV2l#x;D61~3OJq}O
z^I)X2yPSe+5$H>Ml@}q`DxaAzX`(|61|tlk7};hB8<@>M?A8D>gcUD-v^0GRs{OP7
zb>qFtj#$G2_Z1isRA}&_DHEVGDyw-`UUdD<4gsX82}j$-f_AhzE~#$Jx+`&_SOCuy
zLH!?5dZwyl=6;<0Oo_lI2~t|S?0y>d%}_C@b_)ftDeYSsBL5UY0_DCtGO8oXT>TA1
z*7ui>d8*m#Z&X1T-5b?!aG0g!>zIiE!mvhff@TK-GiopSJ+5SuVgkIy%VrY!`aM!v
zufr8LRYw5WFFWcP{Vn+Z>{a7g=@w^PSbsuDc?{1z4Yk|Iq`6Bw+4u$zVt3#o*<}fR
zR7t+;9rK;}j(iQDroSa*)8tX@Xy-_v3VCId-(r0*64QJva8Ksi@zIhL^o~}l<n|k9
z2_-YMsnJco*fUOuYO4ptCgv&o{FZqUx5~Tq(EY{0N-F;DV-qhLInNLC5ZcI0oE$8)
z5aRCGrXL<nR}{y#rXsq7w5kySaRIdRNp|(f29h`0(jQb%`8g70+wm%Jkf!Rau)>J(
zC(*43uO)hfdoeWz2hEG>IS|GOzZkeZJbmD&enb(G%#NIRVIb!piCWBe(;I_&B;Kg!
zGr2?`j_zM(cIzKoe4o?KLgtO$r={UT%EC6;Y;DucbzDQ{)I6J53HaqN;pH`X8Bf~q
zEW`ZUklKWhfJ@UPliFl+G0R=b;gK_`3ytUHk%Ycgc`sL%4Nyrz2)Hpv;3nrkStD7^
zB_s|<=mKBiG>+v4zey(1ip>U<!PybA#bBPgvIIe>;12%C6`A(E1R_o2o25UzQyKLP
zQ2-V@WJrB%Lz3(xH#!0%U#9s=@~g_DHM%kc+1BQLgrM36_mhI?mc6fAc$sLsZ~msH
zDO<h711_aSaa9xR?x_@9!RpT3lJ1mEhG^y|xlFHHy2u04>tD;z;WE(Uw_VMYG6m9L
zq4^_rY!z$4c04lre_9ykY1Z03A~t;g%%wpi=d&;3FQt>!oOS#?*3|kC!6RY+<$9@|
zNmM2vDt|{gXP?abbSF(;yi@uV<i|6&r3$4gxW$=jwNh=M;t!GV)I?mE;BR%o*lo?>
zx9ws6Wsgv$ZjVvSn=x~UC4*}}^EsgWFu|)V{`yj1Yup}v#C84A(xTCcnmittXfMBd
z97#maeLdYbkKQtN!x*SMG6xIS6znb>M}TX_U)-=(exIQCQ0&4ppf6rV_#szuevi&$
zl(T|>MT#vqlJ_WU)5j*Z?H5ajw=_7P*PifrZtXrQ^3*=tLqOM|cGfC`60kSrlVr5J
z7oA9z!WTN)FlmFkv^U6~`$Qu0Col4}yI^0$l6f`XbC5ev6JH{l^z>P6&>~pCv{_bv
z*(9*qpy>%fAvfS%q@?;J;zHlOkIVV{W<3S=`@H>%(xHcU2;qid)#ubu0+>GKkx%K^
zg~#F4yS3>ah+WfpDgK$uDW5R_uhTm+q3W6of-dm}Q1sjmqbdI_s^dqO|4jkzOwy?W
z7GhEOzuc2rjAnw9f5j%Noc+T6T6n6N12O+=-SB7-iWYE0E=qp6TivTk2Y!<$_ZIBp
zm#hvkkS?YBEgyW6*Bm<6_m%wCLPdgCR<8rkdSWROOO+KmVI1SotT<}46W&et{Q9v*
zDMFKH4)+kxOLRS*uZ?K}FXP!B%@P?gdbgTiJR>YaQp0x5L!ua$I;JTPS3X*k;bF90
zT?<*p_mU=#q7AVt@Q&gOh6zk2NPRtr{uJG?S@~_5s6*2bAkDHKJ5<l9@PmJ;+xO~-
z>RrQzm-r@yTF<+5eb)!fSBuYNyT}k}g|6NM)%jAlPEE&v$Ztb5*T;gIqY@E5;@cf>
zp4J`BWdG8X(cl?06|fk4Kr`q5EO7CeM9P&a#ioCvK$o1}Ia6mTRl6gBpX~|gr6qTQ
zCXC?aY47DSUF2)5pb^Nlm5m>!o<t{>#v4hT&|mPY>{msOw60D9y>cZS@UoX*5y1R9
zgue#h2!!ME3mu{4T-s={)yc=|b)sP=7AYBu5JgG`JFvzmX^>y|*!Kwpg=efsy4Jh+
zz0u<qa}E0?X8!j~vvzGu!ru$0Cp#cgo3sHDn3x&*Eo|)0$O7{_O5|B!iCJk?eSScv
z{2(au=kscWS2a(<sAD8et{#D#Ce}(ZZ^4ZN=+%p=0|Q<hLgff?nsuZGU!$zSIYq-=
zgEZR0w&_b~lDVpF`?yRAj!Dr37vUeM&mn-j%^#i2L!#jHt{_UC)%(rKFN7O{v@0L7
zS|`=oRR<!+5h;EscK=5<{`E&umzihm>Z+rd+@e{69Pe)jUv38gHv^K$OKGKFmRUg<
zv<pQnfTMmy@>pJGXZEEUbRu7m{zZi;^fniSD#ON2J+CUmuCP%E<yE#zbP!9L5>Kl#
z==_G?lF&iIe~In~fw}*h69p#wX=L8smvrX-3z>i<4adkFVC=}QaK@D%m>7RS#_5qM
zZ9+KsBzp{<39^G6Jy|`WK^t(lb=#YK$QArGnn4N!&cK^NKxs%c>U#Sma`CEX!n7yz
z&}!(M9eRs|d%@oKgGPekuPFw9IGQqBrfg4cGzTEfwkkdlbrk8cpKC_$ZCSnD`6|8a
zQD|&^U~sY^^i^m7oL_S=ryG3t*e>AF8}$;Z-xds-fD%@wt#2jR4UKdvYFRk<Sp)oH
zB`hBh`*0gx%B12w>=PQEf-a=!%RE$!tFj28trl~;p~#4Q?!~xLyyxr&{%0g#KA&jk
zpazi;1|g0o^zyGXLPSq6R)lN>x^5pA%)D~aF=PZ#ncPJ;Cui0sy%xzcGSmi(aW3gK
zR-@BfaS@1}tx3gQg8EY>@-w9PaUn{^kf)Q65~fYp0Jk*}K)vT_kwsJgp*yvG1Q@lA
zSk)o>jHk=${$19b?Q}Vd#{Ej)(W-MV&lusOH7ufvmrNY`YPY8F(sBwNWaoxGR8-eD
zlxV=j03$YdN;H<$2laUI5kR^5?;1&mlJs3PomLj#=(jmx@~(cj$QPW))ljNAT^r2m
zx+$KJU#0SCJ9(Tr@47WnXkAEcS}Xc&eRncTDrVV4!@33RalM`17GLd;?@gK7E5SQk
zyfqFo_guPWAy<Dy$Qs2%2iT_}2f;}Xs*QD#!_nB=$@A~Yc?Oz+6Onrf!jPN%Q+9(G
z<AG+a?XT!n@xensnmnnpLmxdYyuFF8q=?Sd6RU>2;zPPu^%2!+XZEs~Qg}z(o&<x}
zd!=f`)N<QUBsFXp`SOX4*^IZF2}!!C%H{&~JAlatX$4qvg7c<vo~HqE?jZ+zrlke^
zvN1t$q3%6*UX8Kb7<4cClUyXv>>+tdxziCoRQe^=2R?sP5lS~Nx`G6q<lV8n;ITy?
za*s@#sq(SNNz+&4HO-%ts!%p7ybLXdFFx%*?SRFhGvGj)Tl1A#oo6nGRt3FFWJnrM
zm#li9r@z=I8D<Zh$G3I!y@q+PkTQk95<ycPKiUR=1yp_m@XuLQG51IIu647?866m6
z3aMIOB<xf8kiRH3-6Ik9geh~-wc-+d70YzI;r*E9lw?VxP%#he`~6q?jL^q#H1;uR
z5d^pdN>eH{#3$PdkgeSw#V%K3*-p2zcntAO#z>7rxv6G$atFXNci3*Pzym|qhh<1!
zJrj<m!3o{WoR_F}pZwb9@b<-YX|^6;;^+p(`^N5R3j7|i19%O&f8U||E!Qy21`>4c
zFVj$1iHMb~MAJWG(8LNaChZ}Lxk9WYxZ%VVyuOz|UFLUj+AeEC)HD%g3}Jv`85<U~
zg$sc^i=t<r7wn_sCR6BZXZDxrw3Uapk;IirEh4&rE6xy19!Tk0+oVBZxW(eJfcv7B
zzwA8+%dN}scgcr1TJ(;e(vyDY{tqS^`8$t5{OtMZ`+%>Dtx6-!pFTz0oHli1JF5HN
z?^f`ONX8vz`4$aE1x{wo6B*k~AY<MX?kufoebhnRvEMGkY{sYKK>+a)L+gg^7Yl_$
zy=3y93xoA{&%<IS58E^+cdKrqm|t6>AV^RKOx1Z9wur~#+w2aE@R_=yjx>dLdpuH#
zwZ;&*9nvP4@NVaROo#cQ*f^8w7@D^~Yw&FojJ~VtsNDs<D`HoC9MheD6UPlCka#(L
z-*EU7uo6faPHoEZG_kz?m{}u$PCFj7+k8B%gUo9`5z;I~)24?JNaKoF2J5i_5k>>)
zlTqy0nZLgKmil9A7G+<R$wlCeoiWHkD*d9j)^}Z{h0<Yg`UfK_Jtx!6?)9J6*NSX}
zbx^!aDTZ>L1{F5Cm(*Pb(_e-7e<b{FSXA9Y6-O7%t^VrU8Cm(5d+C2c69GR8<l<sb
zZS63QFxA9Fqqq*GCE&-F<@RMtiKXo#xW*&#{OKGLj&zU}A~Lkute>18LKPhOo$ZYu
znbFQKQh`RbFpA2px=@#(#9W6knvgVSpe;?sxdlZNHFTsw9&0@O+rq;!Mtf~`C4Bp7
zDQ!Ga*tE`8vC~*Z_2RoeaiOj`&ZjZyw?(alAM$?1aMT>|R@Gl{Kg%e-_ZpI{UtjVN
z=1%--B}dzA`-odrFXd*ZN*a$2u~lxeOpZO8mAi!^i7{6mNiUw#JWz}7lk3ykCoa|`
zqj<>rrljeyAB)(b;Qi-&%Ok{bq@cWqAWUpuvoqrVk=^wVF$`d4yf$?(Bxo-fvY6=3
z82k#S<30b7Dh&-Eua_IoJoz~J?hwzfP2wXynjA;3-fwi!kxv@;YXxqq$s+|5s_V#)
z2#oEQYo@jS2?8&tgRaQz7j>oFSnHr>Tr2G;_owZEXR1&!T2<uy(NZCP6JacCCsF$M
z7uB>?Dv?v7uW98cX4vCQipjG)_`N#b98T<sL7w(k^!+A-@-3A3ZP9<|;TEO8`7iJp
zIW;mf%J0i-M!m4c1n<1G&<x^&%U|!Hu~(K`(C<$_Gd>e<Zp9&uF!1jthbE0d`+N2=
z3^1RUdiP;6&+h?#J+2@y6ErM%^j{DX1E7PLVFX{SMx2{|hC_#_g#WNnx&I-SaI!@t
zd?(7k^>A+Zzq0TZaS4y0AYq9H=D*`B1Q9O{Ffy_VI$-PHeQ>wb)SSn#DWqhOBP`O`
zC&B&Wn_|w^nf%FE&ek(DiJC&Uw-ObFLYxvS`V7Ac-R57jeRY>t8vNPQl2Eo^8k11E
z4^it@i=<URd+#p$=J9<)jY$EXEuVa7YNN`Vw)YLHZzRpktizhu0?CpE-XKC-{;yK$
zf9@~I_`OycM>CtxH2?k!gvF9p@q4}GIakP4^2q%^rv56dt*&hYMT5J$JH_4Ip|}$~
zKyfMVPH`))#a#oXNU`7)*W&JO1qu|{dB64Vb*-};B=Z`X!=KwYn;)peqN<iZefcti
z3fS}S0}O8>JaB~)NWg*++@##PbfNerxYEH;_z4*^{z-?lN&vaB`#}T>DCSNO(KB%~
z$iBt@SE3HU1Pq%+J;_fKFqQMv0OH%4qin1G76Vvg(ssAcQ|z9+4bmB8{-1|w$Kunb
z{Eg*zSg`AQIwZr6XHYvtd-hRbBODL0pX7xBO(TPbe!)|P8)$`RFNu3D6O^}@^q#Ox
zT`kA+3YKW8dJ$rrM3A6i-U#w{76?Q({X$6B6qR?g77F3V9nWg$3o(DfKjIuNW~#wu
zB_i1yJV3_hiNRTKxDrpI=rqy9SD`fWW&T4*IxtcX{{*eIVmAG=tNyP$L*f%jc%uLh
z6@e;Hlq?_mw+I0$hzW{zv>Wpz0WM|5`C?!yq&jJ9k?TUjE80Y{YG=FvIwnM9i4KIf
zrqHb>_Vy!SLd~FZ;N6;-E(5`K{bxR!DVQGrHl)+$m9p;})FlT$<oC8I5KYX5;g+0H
zaROe^53f*UJCnX^$rhfZKX}4NDyLjrCaN9j%=QlGrVmR0@140ohvW+@l-s}yfYzVL
zhh6>*EKzyO5%k4x$mjyj>#w4U^8vQbJXmHpq0=e%*T_ho{HwA7JusOQhM1++ikdn3
z$!|Ihse*`sH!gx^wtLHO$Lm(aQIE%=0WP=+&---vi~zq`DN|LJo?|{36&ucxIltPS
zQ~h7_l|H9o^mnX6-i^?*ICL!hf0{!42pLY6Ps-wb*iinA4*nc10Gs`|<K>E87jZX5
zz$HQ%zMD-O__pV%`{AH?YoGNVQ2Pse=Pt>=O1*aIi@9WUM;@}E{&c@rtw~u&yNv7_
z?C0JkgbtJ+%YwG(|44vhf#4e%Qbf;uM&JKX5klzXTQ;|c&N&3gGA~%yaDgV^Qcq^J
zX9Tl+A!(PyV05xGCbpvMuY=vR;dCkfhDPCt<?Cx;w@?FlbW&sylUZEi^N26LW&RId
z!f77qFDgQptAw}5gJ+#smi4j1KV-d1SeebSIHu&AZ9!Vw<Fp7}|IMR-G3X2i_d-=@
z;&h>Ize=&mJ~E&-Y5lRl(~7y*mZL(|ih;Jt>i^%m|C@SkE9P)q%!9bqfv?GGEI2wR
zy_@v7DCTjea)H$jv^Qy2dUF%g!>Y6y8G7|PA5tSrCC~q+U${Lyc0pw@|E(<Wp|8%r
zO+xt*DE-Va(*MdFImHCZT40oy-y?+W0u9OxMg>RH?<m31`_;cK)(XAy`<9ZOC5N(j
zbkbQz_>bhCL{{J~B-*JCg8uQiL<iP0>(m$%MrAyv*_GqxvM$H7SP!qR1{8El;n_Xj
zVg;^%YF-*3+t%li={%07-zBD@%N;Wuo1_pXBjTE7Zd@fQI8}~&>a%FfWL^Vp)~Y=w
z1Qi;G;hCXGB>@j&<|tln+CcFeqyBG&JV&WF1eB`tZaUG?j+b?H-U~M&8>?lO%Et@h
zWNWDd?xOo5HOH7`%)hC0jkOe*-&sqy&>6Mah1HAxwy4*m)pqiRa2EbN*;WC9?3A2a
zASku2X8MZ@z3-H~0fDi}!NjnaQXl1smyQ%$oMv&`g62X`l@iQs2G>BVR|a1$3-9;5
zSb1Tu`&ij$g8yoZ96~{-vCUDF#H}dDJqi}lpmBM#2DTwAXY<ct@4>4$4Euu&n_IBm
z8O?h?FLN+Ef9(DJ8MGQvpd;^(EfM@3Ve?;=cwF`6KIZ#@wcynGudJLBr>aR_sd%5x
zl8q|0F7?O9;GylSwO!*MhW|`l3RiKw#6F<OdR~II&MCWG$QjI5ex&#Mt?x4htnq?^
zCx8!(w`$E+A(YS=Jr57$0eb~<2Hx2lpYyVQg-PJZR@OePQgah;QPvq``dGnNGXT)f
zr)ONexkU%c!*}iu8l|FxBHjK}l9|Vsz~e+4x~0N9pC}4hG*ccXQ%Z-pQWXio1ftgT
zw;QFV!_|EaE{|+#*;*FaSN!PaJqw%=$BkcS;(p!HS>vV+C%oXzT}`auNzs-wl}zRo
zX_SNMQv+n1K!@~lE*zN3EEOjFWU`nQ$I~0dN!!71lT*?mH3Cl)3oJdp;&>VcwIJ9Z
zFO<+a8lMa0UH+7opxe2DOdYBhW!iW6(tNcSEf{cDUQ?~3IIWf&CXCd5?Bke-+Jsz<
zQtbQVNK6VJ>E3$DH|6t+fMMb1PcLV0n^}Q|1=|VWbw1Ut9T{W(zr8TeVjFu9ld>fM
z(F0X<RWq?m<r3(-l}KuR>rP<%1T<e@!?)+0&r8z0X7wOKx9ul<0g(VGk>87caTaJh
zU13@?`1i*{%Y@WYY_#vnmclsT_d&+{o{H|5zGHPU@5ysBEbz|r`Hy%08NQY>#*$f&
zF?Xms5KSi_SVe;VdQ)_Zn!hbQE7%O$TRQMSgbV06Uees(i+K#rO?1EQZ>Y<OPlBr`
z4O$a)oi2x$FP^o#StZIAv=I_f6Nwos<LOfOB2@nt$NAE@?bYM|N?^x1Gm=+tL=zF*
zX6rR<wd_lQ?)*-mU#KoM_L}#%?8PB{7%$NBBsm6Rh-(n`{=+U({(EN05ZTr&_gt15
zMZfD$+?S`2&!D>ubo93i(SLIxA})0%aT-0Rv4&_q)Q3}QU30By6^`gKk2gqAqmc0b
z?QJ>ykA#+}UgvI$&0d9RDk*Z`B)|7;d6iEIR8fLX5e@vF&tZ5%gO-9|%$0e`o5Do=
z5Fjivs&4&-`lG>tmH)lnuZ7jlE*YBhJqa^ttlR;w7K4n|r3Xh=$RO_QwypTAzZD}+
zJ<$DVKJ(%U7b;<$BNv9$aJlXv6yyhn@CL>m-@X5#m|B07GHVwmG)I@8d#!i<8esg{
zJ9{FFg7IQkMKAB~8J3X!Wl|Rt*@Os*RLDLJFsQIWS1W<L7FkAV<XErSIQAa!QYC60
zo@9Tn5O7{Fi_u(ZCF~xWVbQ)xvA|$xRqIGOt<`E}jD9opLM3&=aqeLa9m}+kxw^)^
zjmAarkS|iSq8Z~gE<4)XNt+^wg^~Coe;rF@nm#p4e!G~jcfj%HM8gXF8-(VwrBZeN
z;d4tL>*x2F$xgPX_Qulqk?V(+ibe%QKXr?W=o!O3{J7<dLE@a~LvS$3v+B>peqzvG
z86_9@<e``Q9*psx^|9yx`canZ;6FNUuwgf}viDQVRO(`p(DmMGlWa82F>EH!00Fws
zyo@`YFE=Gq4C1(&5p}<)^(mBg%!r?<g@^^uh<*q_e0UglZt}Y``u70!9(ifMM6O$h
zMm=nWP~<tMrC4_2B^VR*5xFI7sL;P$_6GgcUW|HMC%kJ(<gR$}Q7WMn-QIVfF#myb
zr|>9M+sKFwDdC1X#&W)#oNdui*OH3&l8?4sJaP<n5u8<BwkdIp4=gxOr5i;&t_DY|
z<q7V6=k&jIr|W$VPs(cDvX8Jfp#5ssLGn<|6WaYib`f#D*!YvKT$hl(#A&Z5ZSnOq
zB8&UoiOUb<W+!M#bD+C-x1~^Gl8d57hi3NhVG<*7<sw6n+h@qXD&&y>HO8c=O+d!u
zjpdkqp&uEJmqjZ=BbZbH8J=Rkv+MP$_k8@U_2t~SXXCETe19h34SJ&1fhE54t!Q}%
z@E(y_tjN%zzh00{tPn&^8~u<I`;l@%7H;(++@eOD(n?iKGlhf3jzX$r#m|#Gn7qUU
zG=Cbzr24glCqhK`-P7~++4Q_uCv;a1hXvQc&1RCPYt4m{WzQW&;EIl>4pTUc`FJLX
zO=gM;;uF+boG&HPc^BP&4xEI^{79L5UsHZ8I8S~=qyY)Hx&d1QjQ7I+*?|tRKJWIw
zqNXz_&6FI}#{6Xe-z~uQbN4;rJB7qlS$$7sCiPG4o*QJ*o_AU-F{Ku9K%v;mWOIco
zTa7G~W7K^rhl~DpV(WKlZoPQSvj+}*y-{T$tR~;Oi~DNp2p!Y75SBUR*$Oq|aI8<$
z1OLQkD(<nEP%-7#mW+23AA@DlVIn5`xl7I(|0r(Y8Ydx?rayOC%Rb*-)Q`|2>uc8$
zONPJCzAroT6b=m>t=o64G$R=GJmZj?jHghs%BOcQY=%^0T-^08dvGHT?c0+iQ4XEi
zvrEMD)I4hEWeGv*^f?qh*9R!Iy30Ajo*L4bR*`hxRSouoVgEeuptS^^1etW^#aB7n
z-q<5SZ)DITT#K-<@XZ$8JTxnIzdE^<uQy<{A@#FZzg&3^@TVs;Ii1Hov)Wp{m9ejI
zWUGny@QQfAen&{g;?4}e#?$j&&PAknV$$aew?lR)RpftfAa0rWH=A%*yPYVW*fTi4
zNI!)m<ejKGds}-*YNU1VW9;_4@=c5!VT?3a4gE}p_D@>WCN=`5%C{y7T<)mJQ<{Lc
za^zCmHh7ZuWdXEZrc$fz*=Trf0bWHj`k-Kkv<y~8<`Qf)yYBQ`KYB}gG<gNM|L0IB
zW7UR90I>2W=Y%rqa(ST8BnC)L3Cg?$oSQo&B_$<p5B(7`gDREzq07(zoe38%5(PJX
z0U*^l5_Tvb=p$6V`+v8{8fM8C?ZxwzW>-(BHv+Ds03`UmTl|#eR5Rl-oXMa<Inq5>
zvsIM<)tbLpHD@d%WA@A3nPx@ZLWN#UT{`0+A|ESjH44M;VxS%hOI)LDO3kh={y3sQ
zEmK7kYIcbp{vz;6HH9V4u1>7tni2nZkx9i2BmNu|zTRfUUnp{lgw?~Jfx_4S^!Asa
z@O7Zx{>Fds^{25?0VpA+HCghl{i824eKttLVe;+1#d(d;d9_74?{|0s(htHv>!;Ar
zUk2ZD6sRD-y4pT%+me*q@=I4bRC?AU{+nHH0k&k9NKT$-ky&^73+ksDJ*HligI~I(
zb@`0x7`m*iwJ6rGdShdDGAGT*gZ}0G#kxf@dJ6^usbaKEDXF^Y$m!KA#ZAgNyL$Lb
zz;o+t2DWA`L+-?(67u-cJWbt*xNO=yO{kq^PJf;zFai}HRZmMP;+6naUrRIM79Ukt
zODe)0|2C^Sdlg>{jC4_+W#)hj;^)6*7J&8wimERnqZk}sK^V$3q~ND%Pv8@bF9wx_
zNdYVL@7nyoo!6FKL&WH79{y?=kOV-~{WQMXIBMTj=<esQ<8N1h3K^?@{QyV2Sb8uI
zOPq&wlMK*L4}~(YolFJrx>+F0En1Ofu()|SZy#YYiNc`xvkUQoBn+fEqD=YBS2a{i
zSb0wcdi70Y4zTF|&e`{d`Z5ow)eW0WtD$8kJxh8nWi<Hmk(C2)0^cumuYg~vsNCV(
zSUyX>00ylPzxt6jBC)i~+T0D(FTF4zFF=3)B4I;N8``X8_?|r5WEqru4>g#C$<ZcP
z2r!+#R;rE!z>5BH$aKWAZp}vHt2RP5KB4FmwDd4_JXem#IK39$l^vBMl#2#lcZGmP
ziT82g^I(CPeU4v-(cjij-2j<ah4IxYm(=la=v*Y?D2By6G5km%`=p&^Pcax6B984S
z`D&;pWz;PA$r_VOptlgpCo_b4cGUhtTKM6;6rdhbc3z}eHnZhH687t$fq(^tap!?U
zC}5W{j=7hX8IddrsffoImMj_`vwUt}CSN!h4-@IPN2uPul7+_w2ZxEbj2`8-y*GwY
zd>c*H?XA^()j7d_newL>U6^Iei&%0H+w@TZyK3Xll2kuy_=fyZzI+LPj3@Xy9@xAK
ze%|~}P;wl4(dY<5z~>4H02gB0+6SlYpf$uy0cIv^>{79p+QW9g$*k6D7dgVfu6ehc
zE`oEXdAHYVhBCZt^2Y4GUkuT3lXtD+=9%;h+jBHJ%WJkpTotgDn7RE+wZz^;<j777
z0x;9N6Bz5=B(b}`%yZpVJ4YE2X)le`-vW%a;qwBv2Q57IwVsA_ysDrUS^v1@6k#!s
zKI7VrlBK~-1dgzL8jR3j*4rkDaVARjBg?FG*^RO%ejJ<Y#@)HfPf!`Dx3Kya!5h#>
zoe^r|cS^WUf%>a6wST7$PC9AIg3DC(yc^wijT}~kTm7Qv3n0sVUE(5cU32Wi_QrBZ
zVv;0I2aWdNY9!6FFx-gGx|9Pr9fa6!?$!4TE|Up)G$Qk%+ds6Pj5iXF?KW5_>9Re+
zE*ur^+ld<ykh~-IrEUJ}$L%rNuirMT<D}xTorF_jLgTYsbuhuiwRYqyZfGARQbPzJ
zB_$<A&`az3@w|rQ!Dqv4i6H;9Ck>9@n;z5;9q{6<EkClvXBR9r(4oRjE)$U;3^+xO
z{--^I6!R-?{`%Z5(&H<)!<js>D?lpy^meWX<>1P}v1kBijrJ#i6=inj4L{3=p=}E^
zO=I+lS>jOo@EMfu93}NiOu-onvgt3{D}mYMxAJQG5}8h2Xxtg5687XZc2rn!*%!fh
zCLW`5W_ChRoFZ|nbv$+x%jjBW6#fr${Tcjd(m`0LGXKE0p;U1}d5A!gK4<r~scWq2
zu)Sh-uE&O<`g&GuLS~s@Io!jBj(A+j&k2PZFG}NzREbYwB26z>8z~APLt$(95S6=!
zC%nJTWB2oXn&~J)g@Qv>X1U}IOIYL)t;2km#m)r+xY9IU$UXL`d#^AtyuFdk<Laes
z4d@$+r$w~%s3HM@nuNwlX&>sqmRX#=i9lTQ@B`7HQAb%iDCo(?5Y>&X17Eop?KYhP
zDC;HGf=~5)1RXnj%a)WAR2<JEM46)_Ch*DGtFnuDQG~WIfo8v^tUDSDTjH8K)MC(G
zVYmBSqd#NhhHI~G<)|rg+bqc7<4Sq)Mbl1bpjOh2fbTtN1E;_B1(vRj(g86jdI?D$
z%$9xmFgt>uguF&!=!P2^k<EsFZ7gw_2C?z1mlXAG#4D0K%+KtmM8En!DyDOS11^2P
z_`^i)4O52$+^3cSqSN$CaBPzdgi*$(Cq8hhRO(#l>2Iun%-r0#hu&Aj2OA5e(*nAb
zM+SX;HLKVfJ>A73kw_M@+Ey9)1B@CA7Dt(KsUOW%5jy$=UQCI)3q{J2sARPzQt}HV
z%(_!@2AfzhriSlf$~o@3a^Fxs8kJ~f#_`aw>+2~%cZ)f_bVU2&W^J<CP-c1gUnZ%6
zk^k*79}8-5Nz=#iqf-Y#w-d%=Asv%Y4GnR?!(jhH^u%(!!!u^O#bWxhPnoD2Y+OV>
z=+HE5?l1kHGhyU-B9fvbuwIpVqBA`B^qj3{vcR<C+<ZhF%*5(}PAq`qFY<F{%|gZ6
zz3H$>P}^CpN$NANK>bD(JJ|zu+L!<WnCDsiBtct|Kj{6Sj3lU%cKn7BGtc_QI0n6;
zsa4=u@{^cn%RSicLOlH+41}?Y{m{(FTA9#OP}m~YD8z|pB?-f^)#4@CBmHlHMV>wG
zSQ=09_o<}bD@V<Dzd*$2QpEWb*;g_sX9(|GH<!(*6go)<Hl@!5m!}j~LQV&!O0>GX
zaK=?d^}vTsYrOZQ{O=Sfhk~vv4GCLO=fajKSZU_pb;&41z58RuZNaB@^u5l&bn4*+
z1jS#qIuNKCT)ZhGu-j7fH;Hp(jvo&yicoG4KiG|+ynZ<f4#^n>^yqf04s+X0SKKKW
zBPpmu);K<};WI%T%La=FN8A}n>^?$BhjiaJgEGG3I*fnX-D!FH&lDbvAXXQ=zppp?
zL4!@Qgw%*vW8nS#BT#hddhILS2jUVY-2?)UqY~LlN-puM$dlE>QHJcpufLPO$(R`<
zDEv8z7v}Yvt-TW3pY2ghT$JbVvn2G~!QRJ6$f-(R2i$`5Y03OR4T_jjineH~f7&d&
zXU*vS-$enf!LR=KM@KSHcc%Pm)Hx$-Jpp~S$hfgHhHCw)x~3XsJ>9t?<%(TKUHFfY
z&Crq8B_;oKkDJ9TN3=6WyUeGr9-*AwoTo`>8pz7}z3F&NUln3s=gFZ}EMw2292pZj
z4`jv|vsKpD!ZjUbWo>G5&%xEjpVrGN)y$8x)XJ)_$wsv1mY0<~`-x^#RH5)jIB&CB
z_%jkHuPNf%e}fglMhZV@Y&Hlk&aGnnN^ULyck*Oe_7YHfHiHDCuR@vq?CPvb6blXv
zN7P2<;6=g=Z#RK|<PA83v1wVtSY-Z1+`G?piYm{Q%@<{U&UX@qW5@1I+PB(?JjBgR
zEat=M2a+f5{EO{yCzo9zfvduYD67jB{uoII{EHl_cDjo8E0)%`U<He}(IKBF9|ozB
z_Et!{*xEBgj7tL+NQ<=G{G-)9bTSAVl<wm3KuJ+cd}Fi3we**z#%|;O8uQ<#7wzK$
zRFEG=e0ynGUk_@ZM{~0g1UVQRVS#tSY|Cp$#f+xm(r^pN*-1QDY$8<8qJhYoB?{0L
zA4n@Lh0~RysJSZaf#0=0ma>BrRqlBH6=WZa=N@`;j*<@Jls^>#pu;*Jw(!6oirWc#
zhDUG9F6L8DSj*Ed-rHX3`WJ3NhfPEuzBP0P4B#W}f#+haJoOK?{`p~G1!{od87Rxo
z$E~>3HOnsdIIjqDF;E=IOyUs#^->y?OkS&l1qNU-{~1YANKZyS4Dhy$PDRT6bP;{>
zbLlG{b^n9~o^ReeVyN>n80KIIK@G5Pr~&|5p#ZD^^98jC@1b1oQpjwREs_+2H$pWN
zDV8s8if<EjxzyhSCJ{}#@nUq=)Js|Dh-_M`tHyBl{_x*+HJ4W@F%RbIiDFw=#k0YJ
z<lQBHH*CTi6zZN!9`(ccyRUiEYa<onQ6k`tseHuuDAFGrdKfApy($!id#=BBuAM&u
zJ8xlJ#%5ILY=D8;b*l;Jr=Q2t;+nh<7=_v^EvHdL(-j5>hJSp`swIM{qQ%Qzwqm)Y
z5Dpg=sAjU79%8yWEiPUDaYgu;8`qx-+R09yE5pq;OWbV~UHN{(<7cA1Y~CK)MSuGx
zsZfENUBz;|DR_vHTyifuJVvap{Qk`5V|(*O-8l)#qWE{~4@uu1b|T_+OyPD8O(Xk#
znOiU0lPs0Liv|!lqWjSBQUYtr$G1=jo&0kp;W|4U1>MsN!k#wTqg#~9k7aQ?5qyKs
zD9<<SBWc6+Y8-{m^T$$%zDCBwyFEN-P>8zB-QWNo3#A0u8(qZX$(5&3i|%Z|D7G95
z)Db;Yc&~|Eomr8x#*NgH31W?|D3}fFQS(RrUlj|0=^aS_#2iy(&tAOO%lWpaiamhN
z?No++dP3fOx|m$dE>6NDa572tn_=HX>)ibAK7N8%Y4SN!`;<0v5OhKr!jUO!{YdN*
zm8?hVvNcs2^cS+xgnQD1`(@*PSozzxnA_AhN9Z-<KZvjdhK-tuoMwSaaOq7y^i>>o
zLXcDOsKInbz9Gp$gxn^P7CVn5a&$N}Bel(1sDbFGwlR;_Ff1Og>M;-I`G%PWY2-3f
zU{5TQ9LK@&z(|bD!~<p|fuGK}fvG|<ZF<ipT$&1s*}Zn0RG=<?iA=u`6jMn400T;7
zfYu?hQ(11WA$(d`kTY(;@Ss>5%k6Tz-M4Q09O;ySGhuk*&Y)3<9{$>&|9<s<=;v?X
ze>b6O<tGy2`9k>YQ(iFAA9C0_N@$@N3XB-w0{;7gnQv%DB~jl7YqA&x%7pVSDTcbb
z=be1gT&v8vp+O*U2kyi~0|vxkk4vwx_^Jj-qa7S0=xA{w1!=dNw<!eY|7n8Bq=H*E
zwjH?87rM;@09(xor^vg)JfdB8hY><3xo+qIcRe=A6PhQo0LI7*6i4MO2|`G7xLmvU
zSaR}{<@RmIVS;W5tT8Xl@NoQw5J>|568W+rA+)@<rdNuuU_P%J`ipwF|2PjeJ3VsJ
zKvEb|rmR9J!CC*$5x{8eHTLOxcf10i;KwFsOaj6cZl`BRgc<JNV;CZ#CuHP|fI?t4
zMmhj1xcJW-DE9u0=mZ&f*+3AYapMHucxH#C?m^tAFv8ogi8^+|{JvYm7q%_GccUj&
z@*)vhU9BMf1_42;;pl&w(q{+4xQ51m0=A*|6`-F0+GWwJO|ujxw?Pg$=pfxZg`vdx
zncX_>uRt`BvjO-59R&#(HNXyhjuiqc&!60t#ru8%=>S;O2uk@PA5vJVk%0C*<ys<W
zt4#FS8T220jXpMip_f5HOVhA?LI*YHh<utUdB8L5$p#=9#c9fcSXDuA?I=p{-*<g$
z6j?ymB^R_cI>ekM&aS@P#{@&aTE8V<Dk8G)O-^iUV2>sf3i?{XgV7bS^1F<s?6v7d
zU!c~WANFzEZ%eA!V(X8-;0ZBHO3LU9a+=7crdFXxP{YK_6OV~;G1td`9hV}4HEQ-!
zMw1oqa+j?(#l>2O#wV73q@n#ZpBl!RH?|M|Jt&6DrC(v+RYNsAUI8s-TjK&An+dL3
zjGd&b8TO+tWBe%#AoD=uzPg(^?UC-+7*<}=kcVCQ%bdh<z+_oD6q&4}eSbbFGirGy
zu#em~e8qu`8h5t)h*Gm3c*Ot{Vf1xk2k1l~`|i|b8UQZl*I846#{;W={i((Mm+Y2L
z;um?h@9+@%gUD>rZ4Ywq#K;yQO4~*e>Hco;FhGTOYj8v|wgy$GD~|3Q8(S9q5euTW
z^wmG~V^!Vd%;%;7Ms$g_4_1HweP6g70AwcdVd<3Z&;A5(<%k2gU~$m|m$I9P_@5Sj
zvCdId9AlIJ%#*o>t-vUZt@+E8kXN0I!Kx41(O1!B6h!}20Qxj$y9yN3hC5Reusp}c
zpvUc!amoME+NVIwksn#BF3%<U1F4jeUEZY!UT0XfzrxFy+srWoJrus!KNN==>aLbN
zgl5pcvWaGNr*Byw2J?`sP{hKIARA?G5pg4;n$wBPs_!%y8ipsV>x|_LvD~=N=J!Vq
z>~{bM+>lQg|0L1N;U^Xi6cHf(+`rKAf}#z5eX5$gq-#XqZOANk22-w)>*NgsVfa3<
z4I|RwO_+L+WqdR|E|s7>`&}p{d7r{%_5+91>PR+VMI?c=3iDZf=lN&(D76y9DsVP<
z$@1y^gv+QIzBWO?Y7C46lnfC=Ws)3QN8hU?lkqv!&F@MHr!A!Zqe~V4L*Z;Tqz;El
zQo#Bzah-7o$-qbs=(Mh$DUJp*1Y;Dh-gmz)JjheT1arQyArnpj!>^uD?U6(yNlma<
zacY^k=|Jq{CRJ>JkBIp#4r7f&)_EJd&ZGxNRzY=ScZe}t$d@ZsHf&F&lKLApLEsZA
zA?HR6gASui$dpN)z;eQDgkqoTAp9r1eM@#zF86SOpq`awe|lJy%qikB?$`(G@SU{Q
zn;R>uDAhru)sfK^V=lirn|-{A=3ivIrX9#1r6F}Yxxnv%ynKibv}x4BpFmV>xowDh
zi!XH95Zuo@VOn@zO?Ja3s=3}}l%SIZpA(H-c&ni23-rP$-Bm)s1HL@K@o5G9G7Q1Q
zEJ6_Rbk?6==AvQm`Youc&IX%xplP7Z?QFurcS}-(;$Jk_6>acl0EsENh_Qy6Gmz?h
z<3v&6D_UDSdhaMYy|8Iz?+>B;wKg(g`F*_<gG|Ct5wZb3bi9&O+N(W5?o=$OyKZ*x
zTJG@UO;yu^#C(eY?#H(6G#WJIbiM4kw;-o7G!JG!>yMN^ZpZ1&KZZgxlYe#zk*|KI
z$PwPhNXfGCb|+F+M$=3?jjkn}is=qPx#5Npa=&C;cPW(m<iPj`@%2lARp##Yr85&7
zeLK$a6i&Llo;>mEohVoS0v_VgIyJkBbhL(9R9}=c@$98l!f$~JGy$@9B*g8RhSKYw
z0kG0dvG8DK;vf5B4d<H)fA|D^g-{if%(p4?CQmMy#u6X~@Vk?u$(ni9x-N8Gu*gyH
z9QGecC#KKKZa*L=!T*4YRp!L=!AT<5!K6B1n<2zcI?-FmK$e;bBt|S#C8WHF?xo#!
zLGP<NX8kjE*{j$*t#5O_<UlobnuLb{Y+{%*XV$Nys~YS>D?!m<T}N_#D%VD;(fmD^
zBueps634cN<GBvJxm>8HXE~mh(g--{2KeWA7GvY5k7BfhhgMcfQbvIIQ+^U0lHDC3
z@%5+9U%=C5gxBAI&YJ4(CY5BG`5nxOZbxkYd!dWQXr~ZU5jPDr0ubv6#?jTI<>pSh
zwJoUI5ySshWCJR}lGH6fuy~7Gt5U+VnCORNs_an@nBjU(2%Ya^zy9F6zFsyBLm03H
zE2}UyaB|1d-t8r9!@(7HupvYa<jD~e1xdf-FqJao5x2iz%QK-N51m?Z?|W&DY#Iw>
z?H<30TUZ7n-xNn?S9;(f+#1L3MNi3dXXx}qX7B7rCYk;$A`9w)iTFU9`y7i_OH^Vo
zed)RRbLX+4REr#2qaX(fwX}RD->Lsdl<)U~90x_))yf{&t9F37+mIX-oW)_W?CWeI
zau7Q&;=vU%tB}2=Hu7^;=d0{JI$srKA=G76fe5j>^>W!q7|9Tx)@zlcWRLWBso?Jh
zu{hwC5xN!`oYh7mP%XDuI3WNeu_WGPWDEB^<3pyhMmkV=>*J4*V>W~l&vRZNL2wfG
zM;OH)?}LCZD2L<M@j{{mQPA%Kagn_OzZ~f1!Hfv@>D>7{JCI#Ii%D@rC8HMi!P|@;
zi(wIy-Hbx}%DFu2tB-z`#+l>{G(X6GKfL(v-7MU|2<J~g(3et76d{osyx*oMVNcD{
zf5ETxuo|!#K^eq3;gM&_*!!vWFBCP#5y4b#Uv`)k+o?=rroKP)O}QfL=RZ``nFL-d
zJF+~ICJ0_uzGl)qUHW_GG-Fs>v|W2o%S#bB9tAm6!aEza$z-&nI#9LAXuEMM2Wjjq
z#ge%OHIRxVZ^gv@Lub=`$5q_e-EIv=Cp`BGeeWU3?ihe&LX{hTe3_Lv5i)m1N=GUl
z%A=?*W$ypua@8*?Ow?KF*+)5oJZQo_DB7D)HlWhyK1l^0&-4S$UvEu6<K*Mc#7%uP
zO`$Rhln52cGf8-VlZ=^|9Dx`ZQOAo7N>H`RXv(l;K0J{>%Hp}Xn3<pR+{reKFgR_5
zz@>(VFhjDJCkPzoz1=^{3wPVY=&u><LRb#DVQlYhJZ6e?<2Ym!D2Yc+(u^_c7neFd
zcsoXLq}mJH&QQNKkNw<dVq3GBgt2j7CMpk8Uk(w?pfWG}{$b3+E`$Yo{K`?O{%`I`
z_X?W*K6k->gd})(xP@X6gTE*eUM}WLj3=E6X7t81vvkAr8kopOy;1<5<FG$_qb%ju
zKE-pqPMB)0enDz=|3@v+Xld<0LRkOf%ULn|byDgaH(XMdsa8RLWVvIVW`QywuNTYn
zCbAr!OMo?c;7u(NFkBGdl%+r1>1$c@z@Up=<&;dNFrwZq1W7>2jQmGf4i7g>S~4LC
z&-yFP0+1&SuxcY6Uulxp9{~N6nwaZ^(hX*<GE=h3VYzN0Q-<kxez@^f7~Y-NhYI3y
z3NykCpD#D%Ir07Hv0Q8csL-csNdb)bW$;!~LLW~`69JiIj0!YC1>0oa*%o%wm0>@B
zSh0$DQcS_L>Nv7#uQ)5Lwmru@DgAI8D2OMy2Uu|yu$2VaKI>a1`I{%?c6HCP4}Mzu
zG$G)&bMRniPn+7sga|f))rZLItkZ{n`&|$zWWK5>MZl;k0wsAkC6lWH{mCNxq{7wE
zEs<rQpj*i@`=DUY$Ui?1@Y^+k$e7VW3epX<ANs%+a5JZpr|D361Wm7L%uf>|1E_J5
z6LWQmmw>$f4_pYMR6rZ=<FS9&7A#7n-{1Sacgvz-P|Y3XmO&$yF*Q#wIRfR#by5Z8
zIR?_eaRQdim8p~*sh280LwmP3?9XXo^t6<Vr=IN9mM6emOs%iSv1L(nD7DIn0;Q=q
z<e&ODK%iDqe*<H`4Vwr(6=uR~!wxo^;uVLnWGJK);<pFy)I)~8bisSJW*axo{uPFe
z87hj4c7<JbPcZTg%g(`g#n~E%5kR0L(lRo{91eNp+0_o5*+nCPF#ekXfY;;lpIePv
z9U^g5ri%Iga%?&bNNvEbsjol#z$L^+R@GLBt1b$c{|)*o(K}>-jT>tAO~i8l?+S5Q
zYpBUJur6a-LDKqw029A<K(spTGHOFXM5!ogYj0P}^K_16{^)FsI?Euw$8?P@v#U(}
z*;8KLj|^+&S7;3^xPITSsRO%~XPn#ZTFUdJ6tj26LAPQiV-l07r*|`m&^`3ROoUP%
zzQL1|6a939;FQjmCabG1b(FZpaVau-uCYKoqpPt&$dw}-OI06X`Sjxe7|N?#P?(UB
zCZ)hyv~9!d^gKya$vpXEJT=(Am`M)G_3-uxWj}A6g0boKfl6uaF+|8gCzo%;>usVx
zA1M;>L?6?LmJlMMriTv^(*Cj!{sW`iVV*`yz$wrQWrKDo;0I)P$U*ZzljTsPUGAOO
zJx^9iRP@aTyQ-hz*+qW0I~+H7d^yQ|LZ;!Yr37JK3b~0UH?l&(){-->w61R);x9X!
zudw*O3KlosA(-G|Jbl+t5{$*K(376Ua{KR{FG++*&?`GHVyf*z=M^%!Q7^{E$zT3q
zJFCb;xnMNzkzQ=8=&E9a!eUqNy2CbXA5*0x02$XOR2U7^3+A+^Y>CnzOI$ANKcQw{
zg4xmZ;nU|hr^lNCfJ1d+j1UcGM0?eJz+JB^j^Km}3L67)?IzWpP2))V$Ct03TSR0@
zP?8`d<34Y;-tohPkt-la0v8Gb>%>8&twu*M<cqFrq9k~#m$X~&xJEs7uv|EIke+ZQ
zlV75y%7fGI&WSNysOyHpup%Sku60lX&fngK@0yBc#%G!D(iV`9{|cjEPH&ez1P{Z0
z0SHq*z%6&?KD(|7A^I;Uq)gkl*gfH>lZ(bkn}@`>{Sl4lX7D98{lc_}NcB%35kjCs
zIc=~I%pV-mOTaV6%Kh)fz=ARt<}5L7*5#Iw1ab+_2b(?JP@Vl_J{Kuk_4&ZGYxdUq
znfT!E#XTVt6YG8$xs5_Daq~I);e$O|+ZXcunbTN`-^DQup@}BGW(d&z;qY-l(;zKY
z(708`*`7G4hx54I{hH((9U@oaqtV<A!QSJ0tBlJ>6n*qpoTK%D9e-!ZRPA}1kF5%|
zoQn{V+7NySrGb-Ere$|)42SP%d^P(g`(|S=v2Pq-d`ZGTQe+gPp{?)=JPAZ3!sgd;
zj9cNvvL&-y<#)T?|1)i1EgR1gf103*JC+qtPq>gJjASBP8Y;ndw3B4>jgVHwi5wjX
znr&j1IbPvzE=t4=$GxinektiKr{gHBcpdfH!}OEdTksPlSm>dRiRg<>q+;EL($Od2
zMF{;yyI5P<Dw`+PEX@ea8Ck=H=*eBr1?bR@tBS0dGc4NB2`v7w0lsV~?Bm4zdHw!`
zWO$7T73?<i9g1^r)2}T<*4hXK0(@xFy0|1}8=;j!6>JvJcTXmmgjjJrtBbJ`tQ^G;
z#+)Srz<rv4He%yL>~wegUnNA=(&XuiUMpoiY|mf)tj;supP;<^L1`~yc)tY;>_yu?
zvKBL`lV)nn8jUlyQMzPE1#+S7_vP=_0)26QAVZjziw}p^z-@&ns>LitdK;}Aa>-|t
z7FD{>Y-`D&p;9dS_w>w@H2^1ckbbmA$+q>3djr~=QYv7%5hP?yg{pzr2q$yo*9fu&
zjiVJQnqvd5uFNA%iJY073Cl{9H=i1f#0Ub^bMJVjqJIxeu*L>}L|)FD?B?X?k7kb=
z>LEM)DsF!=(OTJZlTgDCF~5<FGO@@SworItnUqP6s!rq!;2<0jj3WOSST~$^8=8w0
ziLs=_-}MRNteD~|+hZ!-AS_~GN7i9Xi2VFXjNba`>*0{)aJt*568hlkfZ(=|1Dear
zu%;Od$HhW~$0wc;On%2x-%mt@)Eky`66YFbCieJ;6Gm{%@ltHXn2dtR-zyzUIVO>e
z@G54K#SwWKljUpLm@x~zLR*B;mL87>7?}uBY>-^v3U~<<sUpD3LX`VEA<jge`c5Mo
z5r|6DzvQIBBozt9QWTmj`syT!R&5u@yI~@vKT|i01u@cWIps}1M&Ux)AmZlQ4-kBd
zyP8x*nztu65N-yO9BewdQKH<8Loji-N!*N|^{?VZr7@a6s{i{uaD0c%CyZkWn<3^Z
zYlsd~#vKkzf%1Kav=iR7kFiRyJ94=(6Xq`2PZA^7s=kLza6R|hk^?zprrBi24K}4^
z^!JqHEXbj?D5P?9aJ2L}CmeA#4rCwVZw6EGmF0f~l^5eb_yC2OU8`}q^hXm|w&+uW
zR9k~GSZM!q(nHcmBKZxROn^EkYBf0k*2;r<05F!^@?1Wv2CzrDng+{8$)qdAsy?PS
znyCh;qgGES@fEO1=zdh;PPw83D3}>ar$gPd09+maHQQeV;8=Hr1?pENpQeG-cpQ9|
za>>+`oDsU*)N0qV1xj868O&)~C#4Lwt-~%Vn*RA2%xfiMc&&JF5e82q(tr1C-2iYH
zQpRI{ipX7>Bpt9Vho*-5o#!k=GX@F*ngXp|n{rN`KsK=Y-1i2m1X{Dp-pnZFvn1{I
zX{<=ZKk`(sX=3CJfi#(6AHwEPjLr@9;h_GrcE*@sTFOXd3D+F)choLl^v&}p9GG8k
z+rgjkknhnsuZ6Kz+8YpKW^MDTlJv%xEHZjf6cWrwMuNFroBAf6oNWAsTb9rNoIep7
zb6%qkrEY{lk5i3?T2Vv+62pjW9=@}wSV}fD*Z&h-@GHVXNTK56EiA5Z84AC_*AJf?
z3x)TR2dOQCp1DN4PQuUhQDOuoBRncON_CD3T<=+TIkUSuLeNBfE}~d%X32G#DP4}Y
z%JKA_IwLI29nU*(li`uj>XvP{kS*&j7sc~tI#jTh{q`-gF45~2Nh8l(7?#_8MSlJv
zfhqjTgIUKK&|0LDHMJZ(N3dvbe=PHo=j4i6?nXi^3`QEB<U)LvpacNrl}R%jgrX$A
ziR}K(z%Iz#Kg9UqVp=5ZCVbrXg)Yhi>~@JSF<j@EmBbVmM|aGKyB;d~;$7@<<kIdT
zNfB&|Mg5f;H(&|B^TAxEQeAxK*le`V%W6wKIFK=*PWZawkpk-*vlW+90;V+n@kTe=
zx9?3%8d;!*9k0uvrvmX9;PX`HL%~>tFg{?7%TMfc8iM_Ko@7`N5`AZsR4G!>;gj)G
zUOHN-gN0BKsz3U|mt;i()UJWzHqPuK`pC)Hv_HZkR@2gg`?KDuD#TF_r%5yeP!hjP
zqmE*e<4dr}RS?L<lpgBR3AYUOlyTdifytNf`zJiloiA~tC{j~GhavKYO(9xWB0D)F
zoiFi>BqDRvkn*r}wlLu7TNw8sa6B{6qA1@<b_UW}y+^(ntcI&uoh^D*v+s;+<^SDN
z(UNhtZx-3gC!0ssqFABRA_4Y!?8O2#Jtmbpwp|`Ce*Ylibso;w@p#9jS8)V-UhVvv
z4qMskBwKTDXyOT)AA}34aFX^*mqc$fk9=YeV9TpQ`Dqt!)R+@k*khoEbKw%<wWcuu
z>P1UN*LCR>V<fIker~!+UhZ^|^ybWqK@YEeKe-SJT0taibK)*J@?H2u2wCp{*lQtV
zmq>&v;=5$?QfjY`g!kow+byu}Y6XkCe`SiX>V=kDHE$v;9L(R4O~}yrxxFlz%Y2j(
zW_xIi=*U8j&eD)253A#lfaz?sEfEt-6>E}9mmje>Q9xS2^?W3|lz}|S-UHS=_z@Q2
zf1i-*Xy$0gv9`^p;OoW+%OcGLhuMoG-Wasf=Wc~o2MPB#=F4C&PP#optk<-IS)2Iy
zaEzxugm-5cuE4E{STX&4JXSxAGOV5W>)R-O%4;XN&x|;1`HRuV#JH0<Wye$E7uo``
z65vnrA%GQia&UhL$?YtkqLpJ#h92fD=7t$xPPhN<n1;MJM-d<z&idQaLh36yw;KcM
zC><1C`3LxqN;{J)fbiW$HKecX-c>CmyFxsy!ZPzWRqWJ;EZ?0)uD}xtG!%gU2eVpW
zOGTAKKONs&vOLismIL`x!pPh*qFSmwWBvP|*QF3DNcK{MJLo#$b^ow=%^gF^Ub!5n
z2N<$mm{mJQkcQ-qT7ZK~xhWyF0mymCa+~kQXUMVK^ww*DHyx=z0<%=!%TPJ8ZMc&;
zkfQmuce<~Us4uxKKyBO&2xFRpPT;@#B*)hh(Xt!I?V=0#(Eh+HjG3MH+;JgFIM{pk
zn0C9Ua}z5IRx0dZnocjuE*gRp)rHB-N8N*aBWDp1O~lC>t{9vfJg6<W<`R#c|IHv&
zCQ0DuG+`h||Ja2O82A1$G|cPvkAygnYW8s=7!!Ofng!a^8Trhat4gjgk`;}!M>z0{
z4f~9-HcY--o#C2CgY99H--IR<!31j9tI52}ezn_dN`eIZ=*gIQb)7O9Q3cO+7^Vl_
zgN9~cepYnF=ki<?!5^7%8ziu3eNa2kEsr&M?gozzc65&v2~kJEv8@eZF@CU2nLOl5
zfbUgn_nlxOm%N019DfAwc;dpGbCHWVRyPE4eFt#uK-1Ld*JYg8b_jQQp=R)A5skUO
z)0Y!SOA#G*r})vTYSpA}UwN;;!qsh2!z~ajlxR??t(X48k+m(&&Ho;>is$yw#b9HP
zF5R5W?rokV+yAN}6d2t_THacFH%QFqNq%YC9T6sr0ggYN{fuI*g+t7vj^#6DI_TT|
zohcr@5B*zEyZbrQs?YHlOsoAH)3VU;-qh3qu=fS^p&p3N+g8HpLSs`D^4`=Ql#^s`
zg+c`<V3H`2T#XR*a2|u^T`p852n~kF_O)Xdm!gjE{~hmHmoD(>T4}w*F6s^LkmkBy
zItR)73YG7}>CW)4yKD<j4C@^?V#&{}98|)In7uyxZRnMrS!xIb0aq*>co3P!g1(Aw
z@0Mh?Ix*rwm`qFC$bbgDcK2aJ<|4RdA#3`Ef+on~JRxx<H~!Op7{&bW{yy2mnL<89
z4l{lw?`ueQhp}7mlEj3u7m~ch&ddhcL}41n885&<-PrQHi2I-S-XP7uCufY~r23=O
z9j{wWafpJd(SM9(ATI-;t_dng$JUBL*B>IGl|ayA_7i0j`3kLvMGxMg7_s%{_C>d@
z01mZRZSVkD*1yK@Y|U|X58_Ytq&M|~Odaz4+~Szz4*LiyRWv_Z`vMdZ{n%RSKraj$
zwX}FlpLj>+o4;f_naLtH#5w)uVAg4^Q&k(ey>MYtwy|HZLG>$MP`AK6nDv$pCytD@
z^uwneUBkU;0<qaeK!ZZ1#}IC4F~9f2kEx_nM~Q(&FMo_CSMFI`8%iO?$`cam1P6D0
zfza&EMnAb(;-cMxHnk~|75MTkMv?fg3|sS0Q?dqa;thO3v$(5-G#^r{F^B33#6sx=
z!%uk|RdBqN0G6{+(8f{v5px`>2qfz211ZYKVTG5a4(c>lylq@5++~LDwPJE;b`gF5
z2kb`w9}<cj`btnkUqy0SKd2nRZ^HV=pr5Ygw6EDcRGcNDr`ip408dY6x*9EU5z!*!
zLy#Xd=eA>n|2Ujpihag_RoF<BET)UoR~L*<%sjLLM;W|`ffJ(|ckLIME_+On8a+!S
ze?-TZ-K|*P3}d1Uz#9&$Rst*+W>q2LHaVHHH3V_>8a|&v!#QfVRk)2M7$If+>FV3K
zi<(b109B)*IZ7BXs`5)3AT4u@Mqk~J1+aGo`+^5Z!<Qfh?ON7M>!!oHK_S#TgwWT>
zXFPx-{S*7(2nEt_@=$)*B|JbK^tcL@$Tmg8pqKnantM}P7`T(}cj{)`AQ?F?vFpU|
zCZZ@2^COXnX)o@&P3<1kZq<#Ej=wzsSj|gAPgnM(Kr&FHYRW)-<&85eF*^YO&KWO~
z%lAQF$|x*YM^KYAqc)_;8fB3N(&P+Hnp9JH+f@lCBD=1W2x9+X9yj@-#++QFFe5_{
zriNk(G9&FnTlk$XJzv#>ZrO#7l!I>K^eu6O#MT#kt{Dktc#gh>o!J>cw3g`(#sM!2
zpb#_xn;r$u?3%77)Rb0K*ik^*EOa!k8IfCx$gd5=UGzh$Iq<cJp-n_)V~|YLCfY>k
zSBkD&UNE3hA>7U?LZhiqj{5k3G{W-YfZjf!Rata~$Q}3~!B2dUzOD|pYw#&HeFTsR
z*xHLiR?CD-2pyiwfMJ|Uq=WqWE#E<JbhO6F0ikST7u$p!RU&f{j@}r+CR9oyLYAct
zk*FDwh{(VuN?Rco=$(s7Umc*C89*o$Ult++p{|j4n_+1G@Lk=6fK5$F7q)bzbfz?m
zlvd|XD{Uuk9&?r)6yceCCy*L6In$_OTelhz)~n(8>~Dlie|0V<b>Q%I&pK|<^1!=R
zb3cHx6{o{9{ReSn>zC6EtC=qT8S(|RpT-(m?hML!LELpASa#~>QKYbD$JTgq``GQs
zBCkZ}3Ja5o$FtpNm(jMMWmP=Y-^cOgWa_TV3!fq_|At;>cR0aG*O8|P3hZ5{Y#guG
zW5Jfr<9OJzHU@m4CXuzp`G;)cNAsI_xg6~`MZ2<d`gZ#-+PCM@fT_1C%-$h7|F!}T
zIk!4IMDL4m2FJ(Qk@7p^+&E^a7|rw5!meKU0RYj=iSE(y<gx}*9e)-^(KOOa6;!}F
zjis@&o$*PJryuVY>hi(3XhizybrHwrU==rO#*!B)cf@+EY~MMxDP8^OC-fzy65kJt
z43k{Ca>^8RMkxhWR_vN*@T}bXR-ss!1MwO5WtnmThBv?|Qj3bhk^Ml_6gAZ}&JSlu
zQ!Hv5w%fOTw#w{-QF^NT19j6Yuz-jNy-iqOw?_i}EMeNPZuVBa{)m-9;q{ppVud5C
zicO<cAKZT$jS50As`-VX1FW{i9#_)W=*aX+Lo_j`&3i_z{vXQVyXD~&Ef$>w`0O|w
za+V(0pezQT>I!~E6hhnWj}$gKernZ_HPV-cVR4?-CTN@q@vohJ5|(5exCC*!HL=gM
zA#dfVU|k={FU@T<(9r}89R{hHN*FfY4WR{kKS{y@wd4>dOyioY3l*(mxI<?jgWbLf
zgcun5JnyXsEfXL(UEk6H^vO+QI>ue7%>m1jq@b_LT#lcp-Y&%+TtxWQtY8y)fVz4S
zz|Q!pjG51z?D!FXG>Y^IK&d?FIo%OgjgWWROGN9Pb&;S|T#L!Mp;023XEb!-QPS0V
znc`_-pdwiF&?w=gHwLcm2$^nk$~t0&DJ9O$W(y~V6>Z1I8f`+B2gl(j;?4?B=zY$}
zgJE>>o%d`r?(54`aXCC88BwtkOaBCo)wZ1v73QIB(@j2FiHlRHp3rNt&dTNd(tI<i
ztc~+79voIdPZDMudW65DmOn<g3x%vv0$B-9yk<H<a^J?UyHs6^f@jY$&gfzAiEFb!
zbo~hjc^k$^(?J>yP8yOSNrXKX4Dje}p|u^|UI1x3BO75}eC=eRoUY$VGHC^#Zpa;L
zN+iwJIO_|4H2aFIzbenNtk?Hht8*S@&ZvP7=g~hsP}=}-RRGZKn1jNFMzzB3){wlF
zs{ASr<QhEWNxyHqvrzMKl%?b~3sKf~kAZp(E?_b+WzQ2IsnKwL=ToVOXzcATE1g@&
zGj_KBpW|3)Mj>P@Ycdx*h9oNbq|}yXKb-sDE?%*KFN>steHXuE5<nP|I^nbTcPQSK
zt26Fb5I^!|tdRF93kz;I*s+*V*&~g+(I8~imK1eEeTT=CT#Prg36x;*{Xy_92vmp1
z*{`Off^Vbr$>I-9d5d!dZilTNaiQ9pK2uR(t7#5hczHEKNog$#NPpRb0aGuB01S@v
z2Yh<EG1OhkZ9DjUlw|jTQ%+%#c2*QwurZ*BO%bu~pU~<E0~-B@7-SiOY+eO8%p{a9
z@s~V(S8wILMhSaV&<ag#yWcpO@nPZ-fK??6a+}I<UWfY>&xA!{zqc$bcv(Eu8MXcF
z=LjX6z}Bq`Z^xxMq)buE*|++1?Hr`Wo)K+WKrJ52KQ01!f{8DU<+OxhSzjSemmh9O
zgn0g?VPE8hy&T>E1-^k4dxaZyUQ(3IGG8#rDE|}#mRB<Fo+hZBRG0PAhDM8cCRjbX
zEF)fg_WU4-cdfhRbZ!R;c<v~!L$e6k-G4-ofYRy2OB#ldrFvvPcuxJ_vkQc698cKS
z$H1=nog<@A))Dp;8BM5>-7X*@)=+O>?XR`oY;Kv>W<*Wc<H|j-`;H!(BRLx~r@vrb
z1E^!cK*KWDLNdnCY9LBllaop(LcanD4&rB8ZV?#gd&KG3X8{g_2nA9m;A#he!jNZ9
z+T@4_zZDRsGD@q;u>J0sxZ|_2L?YT$6LQBVRZ1X2GzL<387!$s>&*dnE4{|Jbs^;(
zYc03$SAqW@03Si%zQL~ubrnSrSCk;)+6Dxr7ZERu(QD>L4wJz%2xQb22Uu+(x=va{
zpQni5b}S3OgV{^gz~9RY<GKx}^5vMLP7taqAn$Jrhf{4Sd*)Su_47v4zNzi%JWMq{
z+9bf#=F+|>y)NQ5&bdTk&D4=NZF&Q7u9vXmk_(b8cEdG_g)m2B)xJ9o0IP_@C>{E&
z#Too|W0B`s4zRk2J2>wY3Q<uePOO+npEU=gG)BP6+7kEo8Nfd|9Vb^#L^XM0C<uW5
z=F32;6L#KogQO@ON$xkXbj}nk*mzRuonUegY!+Q`uvckNo9iYF0g~;o;k+Gvzlq3o
zJ_d8YFpQYHg22XRNeIB=RVNY10G5&f=R-P(Pm85~I)=*A_nse#VMFO+!s-?-Z=8;_
ztR&3stqEyi0&-nW;_9;kSWb8>%&%KRZHx}?Tqfu|;`Uy3o(TPiE<t&2E!27pL%Qun
zEM9jF<w+SBF#jN3ITT>=h8sKraq;+x{8cOSG}MuiD#D71LkL86ICwJ}<3`Wt5r>W1
z&Mu}O;RZTsrRdRrKKAKO!hNp-WV%`66m|OSg_N4(R-u;4P0=~SU&k_Kz+gU**<|K8
zlx0h>XYp*L(DxDNWQBc~;~oH5d2%ksE<A|R#C-JY)`x$;^M?#W9(iu|2iL-pI$Dnt
zyAT*7My9hBc3vdNCX}Jacw-cKyTUz0OkU?rm>dg3X;d7}+zUbPkxR(~6Jy9oJ(SZv
zw$Go4!Xycf=`BDEc{+(sPS|iH6mjM^Fl*IqlqM8m<z9b&3$Zl55GxM^Ave0Vkq35e
z^#WWYaNay`g=u58dDP-w0<MckDZDS8!|J^ONV9ds;<aYT3CzX-wK*t{FXjMa5sGt1
z&qNOOPd58@!^W)|$91$2>|2XC3u_pkh(Y{)8)(kliJahK^c=Q;zfwg2*oy-&CP{4-
zBr0i5N>mH;txIs}t_5}&Ovj)ZyEwp3*~<VnQ0EwdM+}{D>M*yW-<$d%6xGzxp2g4_
zHj<W7ESofx{uisXP5Up3faW|C+&Z@(>VwI{Ab|B<NF6o-%yju|@^d7ZtUesp))vql
z*bSzxaj1^7#Ozgjap}NTs4XPVOIiu_0aKAtOn?8gws3$s@6|<8X$>xHn2iJHu3-Pl
znedLyM#R<i^#JQJV*>}0df!P%%ge_gt+o8N<NjsiaP8J@%o{csQSN84{=ivW*>8-F
zT}Scq^Xc=2$0lR<{NXrz^%~aA8-w`lJaTN#L4WIEoY-Q7=_bdU1X#D;{c-)~O-vXz
zgq+c0EEqBv*5<b`Nuw9`Ty-aa?Se}r16Vx9%`rk1c?A=f@1`r!To_LriaWQjW1NN>
z3VbiXj(cEc7%)l;R=3Y#=xjRvid3j;Oo8>ii|Ey{1A>w>2y7GT0j9T!0G8>FnR;80
zL!WK!?!&OUd=!f}9)PE-JH$!=8!&1btZ!a|_4U&jG)9|_DGg%>421P<Q~E9jqK?X(
z)E<lT<Y}#(IvgQ!aqvI2ihE#^6gLbQJ{{IqPhj}0l|W$_hK!vJ>nq35xl;$ElgBrw
z*9bYlPT<Nj^T0C2Jk)&fjNK?n7ok)MC{3v(#2wqtgm6!Xy|;^bV2W{I1BVzP)%pTv
zEm{FXy;WFYunu{75_FrkmBXfrfK}vci~bs8Fn`@$+Hd2wQ*AEdlyweY7nP!ZAoH1(
z3!uMz6%2J(VfD)G1V<_6lE*cB#sUoO-@DO3=7BvlV5Gka20E*7@Qf>YSB(LdW_Jsg
zKDGQ7;-)#{c%-7^(H$5)eir6Vorv?c#qd702O$KEl7vEN^d5*gvzDTp+9LiwvE{4p
zV3Y19Y&YBhvuzvc_m;=s$XrT&oD5*Vjs+8WnElXRgJDR=v0Qr<b{(`qyxBEevoAxT
zuOCcKMe|#S#YxmjEIEZD^5~QS#yqgBXc2NE>TqGLAtEBA=rLk3f4ee+*~l52ae2)=
zq*5Qm<~iKIa00ba#sO9mUyVWP<FS0{N|G@y+(<>3xeW#lnTYu_=3|kG6A~<~aN<@z
zd1FAo;d4<$Z3qB+u>kfsf<y#SWm)}_1zm`1WO;Sfm9jDfC|-t8RbQ`G9>`J4wrd~~
zQGF$`bRL``u0tJfw-R+#EKsA8yopjsSOABlnu<`TBdtL#rLjB~kink2)m9Yq=tCBi
zA)>U}@**C*A!6yYWMxGxa<ICB*I}NLnB`R#qqeL-7RXUqh`O>u@}%;~iK9-5AXdlT
zdP_@|&jG~RB?$3A4r-&8=hOa*vSnph5C@A)q_R@-_-cx?Ato<QMC&pY(sAaa`{b28
zx{$riS<Hhq^65gHIuq*LYG^4g%s?HFLd@oY7tFJ&DWvpb>S)UIP?JZ$C4w2tt1HTY
zDDo~2Sp`rZMjb~P3*?}VgF2_GTq;+ZLH%k9YI6y6^60~wJOUK0*OC`iM`gu%NvO)9
zEB2yPx{#-Ga)7ZY#OkbgatcUUar{{r3*bO8mCIz?)Lw1^4*;pniiMbYZ@Ka09K_0=
zXXQ|t`~*~HPzO_xz=JrXxv{eCJh}+Uj74=uB#%I>&5A-zX7sbWg~$M~W&izVJqN4K
zslu=s+vx&Ggk_UQA<6n&J-`MGHbiw|3}&pjNME7|E43!k4*{6mUlZl|B3SKS4KMrq
z*ncC1I_TL12~nfAt1_}M&FDNtRCmVEaoD3fg%4zoxONnWu0^3PSA?;eI>>XmgVWZ9
zsL8Ix;Lfsv%qBBO(GNlb{ZVR2N}!HEzz>^G20t*BRC#<F=B&O!Uz7-%J^S(rfV+=b
zNnfBCC-moVfO(zVh2R7+ZmeI1m{c+H!xGSuJVG`G%yQ2@Y&{o?i0fydzvd1qld>KF
z*!KBjQIR3R8gknsLu--kABGh>JP>#9Dy|a1N)rm8yV03@U?p++Fxcgb;zZE{04quo
z5ky6>Ij|j0)N!vJKN2w!A|yGuLwlVAV(;F;j?>{NiLSwj{*&pmm2iNuz>mTGM<SB|
z=zHNDZrN91bgz-9qR--Z;xHDhkpb-3%{&2M{}O=x6=JtKmKzvi<q9J%L;d9_tg7WO
z{Ig;7^{Nk_S4bX0{|908Ph%XIlmN9$Uk57<^<^^9#eI)3tlM`^=9$SO5F4u@gkGl1
z#!?ESS4foP3TvM*0@ve((br2D2ln{NkBo=TQbWYV)gr^g84>XkKCWxSx+~n%N+S<L
zSKAQrado_Wb#4vTE?bV<b}1+c4}qCuHh=E6X6p?O9|le?y0FOz2&B3zkWL`DbL;@h
zs6CeFas49nbhja&%CPOT+qc4a(^;6EI)OY&OY`)C@g8#yq`hlaW6wcrJ}{ZhI?qKH
zHcaffR+5J|^j00gox_LubFvgyH|Q)`fk5XVT)CTyvV;=oEZ)FwUt^Pw0rnrU$Klm`
z_%o@}#3H065Db$l5FSZ@q3x6Bg27(9vT4I5N|z$tBM?TLuJJc6A6T;n+qU1MdbA&B
zPq=thflbW2P|J`&283KbgJ`;_xv<fME^HLfz@)H0dk*?bS3rM>5zH-;`1DfjIocs(
z6KvmO&j%;7Sv5Q_--fpKR`S-!Gm9$2!GqpBsG~5V5{63*arRO;e=BoVKst06EQhsO
z1a|MTMXE~(ENx4{Ci`8p<|Hp8089Yb<4FOoe;&XZZXGHl9|OiD3}lw;1qIk&A@+={
zYnLwQ$s?(HqDQwbxZ_p+VA<wGA*Rcu8b;3m)V-_HKDu|sC5MvwNW@0bhYGRCLuIk3
zLsca{7=`$Nlp_$Eh(gTr@PVUGCG?FhaxgWDLR6L_@=#e1i9&27@`{BhM41GDk(v`~
z|JZu504A+pR{@w(+T#FB!q)|W{VM^+Bq~B9RW=ns@+SbsR7;@bB2SNr-3ELf0LD~8
z;9{zWmjEyUU`^P=0oHsdMcmqi<dP?yapPfn`T)!JzmJ?sD)$J0<px?IyNv2Q1YlCC
zZ!&j0P)+3<0jv;qd-VAQZujopvG2k?NLl(L0LFqXW*8p^lm;{l0Q;8#tXcY#0IL@P
zi>V%7&jG-MnK+t|0I&z_VE`)*z6P(9q6gBOQfXQwDyn5OaRj*7!QDR$Qu$O;$|}o_
zgY|t&lvm5sL}hTaG)GP`frq@ff}~*B+PXn1As9+(;BIGuNcQd_0vH>M=IMAJ0U^<p
zR{>XRGepGFxl;jHQM?}t^3q^sX$OgjKv!Leu$XvQTi6nCa$#k52RZqLJPdxX?sVL;
zcIWkCJ?!A@?oI0iDgsv}b(U7<=8(|#0sR@cVd+euDn*=!Eu36Es6N4p09Kk52wNu)
zteHKAj-?cScDMO6E(O3Ww=9JSwRCPO;ka7|1=O~*q5uJoX7KXxA)v{;vg}Y7I%X?s
zldgyfU{h8e<N%YFro-y?HKe5_b8xXhkRZo<u(r0Qylj-kc_Skw8uxEqM{N;-O#s*f
z_RIj57ZHy%>gb!wYf2^YnFtOkZ8EP(H4|V(@r5X%^=1Q%(tPi`%hFT;R+1t@Izj5M
z02q5)v*nEdew*-*02b#QkF3CS{z?>8fU*4B=WTH7ye-VG2gqjUXa>L%oTCvRA{GGl
zPXm~!7T!))xO;Lv4qv$oN2h>>yoX5PfrVUIgTRauI@jj#OU!RnMp7IJy#r<hl?sef
zpFn$-V5+(X$||d{V1ycqGu*L!-z}7<`(yNq^H@7)Ix4Da5bbaZ7D1UXUq2sdrIm=Z
zGsTQC!%$gM4Ttl4P*_Rr*8{8q;n&t<(dM(L$_~TuB?ky9ndmZP9%^e!pf+$kYRFq!
zJwp@O<yElXt%uC=QUscAgl}91sxpExbKN<hG8x0>uSacZGI|VJ2={{qNG~a-&$k)g
zG0CXT2!)pMDWEtUT1E#^n-hh;-3M|Htd>DW$pf?6rVX?E_h4sn7c-~Lq%tMAuzD&y
z!r~C?a2l(QTOh~j1U8<rKt+l#)W+yjnKT)|2!vW==MWI{VYYo4;<Iycd&3+=C#Rq|
z>@L=yvO}8ne#~C6549OV=&iK^;L}P808_R<1+a=7DP1kd-kz+S{xGrd_i8qKe6}o%
z-ZPSIi=mhzinXW6=XGewwpoCOVjwds%ia~H+^%w6mS34Crfo5wfxaR~f-2fBlS7Lg
zYgI0lqdW#U<LM(&n<wD_lg&O)>kk1~37geETa1k?jGoQJkxK1nvH{T&0vO<XY8N6>
zWHZv2rbtkcF5*EN?0sKlRKGk`%x9=COOvI`pvB6HP)6ky0AnHY<!KUVjMU*l9K1}j
z2t~AH04qrpqd0*@8rH&St22KK^Af`=D2k=yr1}bg6(xu<b-@vWP&JZ0LNI@o1qujU
zY<7;~I1wMzECUxEORR_h$7Z9K!sGZpIQxh=z!>NXqvbFoc=57PBIHv!1}`@7IX6<w
z2SEz}d;UGJy2?`I`d)-fTrO%V2@XnmO-TVTNl6l>PaK6l1d8O`(ne*dH^-zA>X<)o
z9tNrn0i;Ff&&G(cc@4>IHqS?Vk?b}k3$^dpdjyOOmc!7%0GDk1QIi#bDWiv=-<a8m
z_O-<5Ap<aamJSD*GQff_nINr<d4n}rIC?0xpN09mZa`Y#gS|KXxEEC$Yla)Xsc_!6
z90dgI<<ke#zVu<ZTn}s49Yv1wA<9qUo){630A`3h+RuuatehSU^;x+?$aOgi|6~F+
zgW^m!Q2D`Ih|B}aFU>=BQ8ujh86v)*5aYT{COG8-RfXt3X%+VAj)kOJ_AG7fjA0zQ
z9AFhO7&3AS?Qa=L7Y+e2$Pci<prNC%c)?68+j0?U_xHdhk~*2P9CRPALtdKzFjaeE
zfR$%UASw|-W9EL;7BC<*28ya!wBfAbL!qy`9AoG0N0QZf%$>aqdJE^l@SroQ2_jl!
zCc;412vg>5;ZcT{)-J}9B?cHoe>6n_w%B()2?v+WfunCxqqeK4?r8PFFj%$>b4>1F
z$Kr9AKU*8_K4};^ejb)D)q&9gXAZszBgSF5t|10#YSVA20K?S!W5+Q^1YSFVMT-qF
zf9ga8M$|q4FgEUO_<+ICTdIo@!-jDHUS6vM9c@EQ8KHqh0@%C>qcC^TE>tAtV))p(
z&|kC+Ggn+iRZ<rEX-tB)-eH_HSOQ&bBTN`R8My>D_p=AFaG@dQP8tgv?<y2UXG2Y6
zGPGySNB_~wd3gQ&@#CPs)Cl7yE$35CP43+fi|6aZ^5`BUFwcv0ZJj;}63Vf8yEPB9
zR{%_F@hOzC*SAC!VwN63E>4Qc8tTwnY=FVT7x8%$?`|>1oH+&<H)IHc14Z=!D~zbX
zh>_Eww`e(L5+K>@RA!DGMRn=?sZZqtpXboAXwA~aL=83g5&#5%J^!~5%M;xYqXMCa
zNdd5|a4%Gf#nc(6Ve0nVeC7>BnMA7{@Jy|QxH<>@n72Y6*ci2me7x7)ZHo~Vco#=4
zgJ`=1qbIM&?4jx?t*J$RxEU_HB_P(v1!C5AVE|^V+)wLtff{@jm)sK?0W9q5TAaF1
z?Nn!D)XdEUgAB|gfI(D@!IKRj64&AK#`%cLFNf1!J>=DiaAVVaxW{BbRF;Z~`iBSt
z5tz5>0+lVtjN#+qeZ&Yk1h6|>7Q!`>I`Q%pjMv!<<oZE>|4oQ$@-VFT01hxQd3ve<
zt0u2gMCnntcEBMz6MGhqLRMZL$`f2LpCA->YddbZhtd91prJm8+DVrIj5@eJYLg%$
zkoulqhtRZKEL0l+v7`d=_YYzT9U}vnQw05n1b{u%o)};$F4oXnW{AG(<FIV8KC%>E
z)58=Sg4IWSIOs~!s*qrD3J$>{KC6b>*mcNrzlT13`k_~^-ssk)GxCdouESUJ*)qxr
z9(mq27&B@V4zh4{m9}#|?%}|#R1TG*)M{*BG66-@?(L2G=-00=diU;wE*;gWEeU*W
zJ+Wo&4s`9-hquiJGPBV9G2ObNPw(F7L**HCR0lHWx!d5nYZZT&nDOM{+yl!9OvTAv
zhoCi54Yw#yF_5{Cyd}qL_pxcU3Azl|LrrQ9=C8bi%CuT^>(LXv=`;50(-Zq|W|9|^
z3)6$AuvBXTHk^vW{T;?grQd7`sh{RD6#Mw1d#}Fyy!7hP1(9)pR*&I)4#n+r#`3un
zS@?YDwexVMj$HW`Vi9?C>VwBZcaZ^f<}byOi{VJKv&R88jw?zE|1*c-5iG@^i7Qb|
zZIs7XV&;--@H)Pq1I(2G*{5HBzVEIbdLf5AHs5>x*tBXF`gHG(%t(TEztJ3miB=9c
zd@WZ1*b5QF(R`(O-9TPB^LnbVd&4TM*nE^)785imO(97g4s2S5%||Zd@{v8%3D@xm
zC}SOMIEK(UAh3ixn8Ltd6Ne0_liq5qhqE^vs6KgRb;a1aMjsmwU8IgZ3nqHYaO8re
zEU&hbRKb@arY7+6cZ0qO0fx<BPry8W&yC<#Mjd4|T^MR3AU2(QVv>S5=;^b$4y$nY
z;AR+YIY4ccljl`}+;Ds7>gb`Uq=?GJLRWVK9YY1o4sC(qrhNoPSx`s1pE(RR9mLI}
z+aawj!}0aHv`?zT0ak#JJ11a3$EvTh6lN~Ikg{i7RRuV)eHC^eHszj}q@n;`*AGE=
z<t9FuT3Vit1LyDZXI#?!7%bOb1PfR49$6qqb~tpGE`p7_8@3$1gaW^t2v1DoWsP?n
z;}i4>0BdZ2>J}pF_y<ni*>KD64^)wogvC2-QIP`#ICvu7vf+))Y#?)qpAAk~<??;R
zd4-{d0Muu|63_(@^1|W}=W-wWZl++i26;b}rrb80<zvgaFy6M8l`D42-^gsW)etds
zY^+V+`yt5pw8DYg$-M0)LzQOYpzTRL$I=xJl`W7Wz^Cv553DG_6NhhSkS7MLm^eZ<
zkXciYzuYqN`bnIzDdGSNO9U*otw2De1T|EqOaFPONz1{qwe;E3#27kj7k%Lb<@h2b
z5)el97{g&z;^PIw-F|R6xD`QB5|pM$F@OM89uy4Yqmig$<IX&yQ9$i$^&H1<Ssu_P
zFGvospi3v=OORmm9xC5LoVMr$zqQC-fT`7I9147cu<lqi<pVamO%NCg@<tb<n7~*Z
zo`JbW_u(lAnD?o}u=S>MO#AS;8Hil3aA<G$;hxx*iGz?9!2mV}xwIW`X^SJ*1%N$m
zfSo;i7T2y_LwI;NQc_Zoo12T8ni|yA)ycdVi3C!qlxyS0jei<ossedYUAlCqi^ASq
zz39R(IP=lBA{*<`QHWylfV%hWRllFE-Fn0CnhC<PniqxmSBB9yNck3`Lh|r=g&IX5
zJ{W~4ZWKN*L?J#?fHBn-J{n$3<<yy<G+B<G^rJM~dK(F5C*U3~16c0?dK@C_=4+v6
zubwd3bDzT~)Zz;I_2_}oQ&$k+tgzEG7S$=Km}+#j(R5Pm&CT0%=J2{(Pk3SLqA?s`
z)p=q}9jSp{JqO^5T?Q(%tDw=p5Bd$(#3&6luvuZQZPUj%y_3lDc86Nuo)|P_9J1NK
zWfg$2w>fWEFdaSn4~O>DQT+MZfn_sjpS>|hOA7~Xq$9=279F~bM^RWL_fUpvPQie_
zQ#imD8(X6!32;1dh|dN-a-spB0QmOqwfwlJ&zOT{8|+Y?LeSA1ioqimLY)DO`oP`V
z3+OZSz|xf$P)gvM)O93^sjbMHrtl9VSkd==P-h{^5{of)(J2B}g9p~FOD9=J(@!0T
zFGlj)emk`1Q+qwJbj3yf94zeCJq+yG8yX{LAu|eaKe`)E-s~9}0c!jx`p)`c*Qqf6
zyled60q8Su2qtR|L0lLxtJeq)usBO=9K4nz0PHCPEG;b!o}Qk#efu_!9zBZT!-u0!
zpFZf+sT2K;w#Nq_e1MiMTjJ%HUq<WJt&x|V(F8#LoF1@0oYB51DZ`8DL4dJzx}21Y
zJU%A&&aoN+U;@Az>`w#iu|(dGs2ChR3}^}nv9Vli$<kQ9@_WDPXq(;Y;{hGabD=y3
zb2nJta+K+&J>ug<4Rxsw^RN_Ah|H_!kd+5<FkrH|5386Lm(I%2-vqVGf;d?F%(G(A
ziRRbrVR7A2CR&e-sG~Aemhu_ASma>|fsSpnnK~*duZZAMO~=WCIN1D$ERB_AK^#0k
zQHnxR744Hf%i=*B<WW@-92wjys2v`}L3!-i7u#k*8*C24N?KP$B(gjfVaR6YSgdn~
zJfv!@+Uw1OGuTY^3J;8h&a+wRxhP!`eaO5ow#@=M6w!w)5TuxXH!N6#<ttvTl1J;M
zwEtXr1R}d#SVGDt(B%?5SsfOIm_slt2$u=~`<redGEb|pkbc;5tFEr*AltKN5BBce
zi`QR&9dqW)Ma5t2f&DdV2EZCg7Dmt1+;Lz6zyyFbvcCjif06Q&t4URIRih-ciT8@h
z0rsThz;ffOk(*FOOPLB%sIw+dj7vFuULh83s4UeGdM1KbbHnJHI}WTcrVhDLH9R<@
z{`r>@z=UyNN_xQo#)2Zeyu2`S<VX%Eb#--lj?5}5D$urVTdY~LhHw8B&%jDjLQr1a
z{DIHqS<UhIo*ZD(sv=ZYJsMzayjCRx*Fylt#)|pbJ5xE@Rt6YBE!xK(4pwHcx4eg{
z5(cbC1583!&_4dbkTjZ!UI3T?uqV}@1X#V~w-D>$^_&5$Udr$i0QN!yj6J_%9u|A9
zrEFh+{WZ>=J13jXUCCJ4)vH(Ii!Z+5&%qS-Fo4w-BqG0*z@U=el-R3R6zi;Qu|(7;
zpG(9BC)e@gnmj}s5^1gMc^rQxr<lc~hSEf|T}SIG025OgQMD|<g9EG*624sv)KyZu
ztPL619Cv7=l(oyCMP<aIs(OGi_=&_+x2g;-dvs7t^*O+5D<I|p9CCOO2*r|W%o;q4
zT-Op=o&sRh&X%PUP+gjbDuT(hVVYEi>Jh-itZaP{M?Qz2h;0+V*e#N2#>XHnCumU~
zOP9^eA%mBMfXZg3=fEP!v59>}RRl#oBZmO67Y<-73}5+HVRKZO({y^1Y9_!~ndSnF
zm2VEf*fyJ-w<&-XlP6b{OrUxQz}Pb|HZH7`$}|^XELcMTSc6_vfNkBnm3vj}8P-Q1
zeS{7jIy3@OQ^tZhTC`{Z2L}gvN`o~8FxFmq*md}1P$y16QO;{hVb@HMR8ot=Ff+_v
zv<&m6jX`L3S)(%SEzKjR%!Hnv9tQOr0*A0P4DO(Yg-dlXLR}LzQZej~tb{J*j~zM`
zRSa150INp8`4yO~H5WSbr(?glKiEq$2MwPHeWM*Po~B9d>SEyF$q-8`F;#O2w2cm-
zBFPog<}AXpg)?#6Cyw9C*PwmrESQdCmVVG0IRr}#_MtMx9aCp7r1Y7%;T}b9YAV!*
zj>WPiv!OY79*;geWTHb*BhV=UOe7|NiYl;T`gm%)1c~-1F?sd^%o;xo9#JU}=LSK2
z!~|&5F|RvoRSz)sik2g~bS`w4VS?r);%@;`oz7s+qQzJ^V?6G8#URmqJ4R2K2E9eo
zp}YGkf6a;juxA7?HhxPr?T@5*^-A2mqj00nP_eC=uex2}WsdEaV)!#I)iMex(q&5$
zhnH+!8C>kSmtwhb-UL+T$ew}8W}sJsmlD9(`@beEJB~6+<A6$)JqN2_PiEWT0L%39
zhO=KyJ-ApNTe4`w6}o$o>*Ea<|0)iwA|;TOri#$Jzb3R7=wZQ(X)v|St%p{j@{Ak=
zt%5k(W&oqV-IE4Wkw)LS3|=f<+6Z7QO#!fc`5T$}QUKU90T_cwQc@BO3=B|IR3uLY
z3JMD3YmYYO?XWrch7B7gPkGQ(0Y)whcCXW?j$$%qE!4(}wP&cI1`stR#W=7ux6_!o
zzz}vWL6CxZQ4M8kv)r-IJec+<g4PHfTGnCAPy^au4J3J<xag4#)AjRUuzm+Z;^>^P
z5O^hk1zuQ%q%zryFz1b$NM2Y5CT+e#f0SX^blHmlQjY5I8!!vWg2OI76w>)Ko--T+
z`u9WMe*Mv9ur5NW4c`=kP<1)V3iA0t=KQ)^te-dH|Ji#B__&h%-Zz`vyxe>DhBuqs
z%_c9&CcDYoeJ{C7Gh>p)%*-s=mStvUW@eC?CEG%anVFfP)vOkG_wW6yS}n3XW6yea
zW_G(ipPvp@)j6lTRp0Zk^Z!@Da3bHYj8>p5VmrDNLv*Skxaw&}&zRALNB}#$!kGhT
z^~!MgF5N;Fq8wg&_H<nmDksAtukE<9-V>wa15i`>wa#XA%Uu%yYsIhUEri~pMKD-2
z4-c~IF-#44^!<z27UqR5XCl%3@(3~-*h_LDK6P0G)?n!X_B8;Ec@8diJIF`Mn7)5b
zk+qd_?<RMReVNpbhL_iIFXB0E8z8q>#-a22$|=lWpohq~CSIm9zX0Y7=3&q2I7sr?
zNE{7l%Sgof<8d=w_gUGfizhIDzCP0P#W=Y(7zcvg@FYWqV{1b&-^c|em4h5uFD{<s
z18|<XlaJx{4tz?DfX~J|kT>?h)qF9$LJzRnyJrCmh(ECl^XAP%T>cm`A3mfy=Hcx1
zOg^p3c6us3vvvt=-8O)JH|R)uji`)a4zxS_cVgZG3*;3l(D>>RvdbCtfB?tk7;f!@
z|LS{?PC!i7HU{67w`rU1i$LlWdWt(&L|?ju`STXw=Dl(bvX1O3*yt@l;F|Mf$pJSu
z2XcT3>DakVYw_7)8>FO3IJjaiU*R5%dru~E2aF}AUf3Gs13Tvp+<Q<5uvwab*H;0s
zM~@!iXFvNHzW2TFAv`?%gMc+V+1c66aN?LNy{ijRRCEXF&F?oBq84Ckm5NU+S(W<=
zZU>)IgFTgJv@0D~63DvY09!@NG1wb~QvOj4Hbx_=q>FcRVr&4(H+SMuZtGhBtLPi#
z<$dgfIKY;kd_mSy6IPyyrfmhflg=Ztwx0t`Om*!Dav+ehq((tWHJYLhA)%TYqR~NQ
z$7LY(6dQ?S40}Sg`Nol7RDs%O`%&IaAQ~TptD&X~aq2zTlm&({vNCC3^NWKh?vf(Z
z+={N1@{abyFysK9?hb)KA>-Crkh#Saz=k?tzxE8lTLE={9i;U6hg%wAT+t7R^RfKE
zU9`M9g0xy{I1~bW=DJn~u&)DP^)Iht;UYaOShxuDK3jnHFM!x!rvRQ?9z#6<oZ7M#
zZE-hoJ(d*$7J2T+U~MrrpNK?Sd_LBC*kh2+WwOAV%xfV1#${Az#9`0zdsulmj>m6J
zuX~`r92?GL@w)b`IDlg-T+vRym*Sg8arZ?Q)tL+1MQ#}B65vr>5Bi!F@HR8#UWa=E
zouQ_4EwivkN^CxoUq)lqfyB2av}9h3E~~C%tg{yZo1f7a3dEh*ihP2^Cg;Tv5cGzc
zyRhbPIyw`h@H~A8J!x;S|2F$lfmLfR;N0o}J~x=C8F;vR6@+A&anHkP7TEmHKBcEO
zJzD+}`P9IR3d^wecrFXz$Bp%YXdz%38Ts<KFc#Cb?qty<z$zX^;QWm=B)-Un`(j(j
zniRNjvlgAD3WV7h5#R`%3k>=B8(+V`wJ5O;U|$iy8XDUOSWnU0OJDv(%E`%@So`gy
zcL9t{Kx)8e?t7Oi9_{1+6IRB+*w6rah8C#olFZ06+L?-raaF{UacuH3!u6y|IO==C
z%4jj%g0}JfDL40#MY0Iyb{<fS&g?=gzOxNm)~~=qeG?S6G8f@C1RZ<Eukq2LwOB}P
zjNgj=96Bv;=wZ%~;5g6-8zTcOG%`a~7lEAMxWe5Qix%kPNoF<LlCEH$ejtaSHeW>>
z{lkw*5$tFQGkYI+8T;}&!<`HXe6mS^9av@uJv}|{)#($ul^`c35U0V+SRW>4w&)}a
zj~X-{O0q!D2rqLgc^9JV#&dK&A>LeKp)m{L<U?>85+e7`0p3o!`})FX>t(bMY*T79
z0Q-d_S*$vM{q_OI+}5E0%=}Js0DRF<QnHF%?7m#c^RclBHDe)81TvefLudS5JWTE*
zxC}znK8C?QB|dT4&8@qEUTVnm;t;a)E{v>JXx!?j)!mu&5Eou{^7SF15{KvsN>26O
z-n0abtwZQ-qB>hgplEJ~m2(i{qq4BtQGY6snev(}3POJ~L8pOvHjd5Nh3L$>5R0>M
z_+B&bI;@MlML%98HaOWqLBB_NrxGsVm(Z2;k^nZ0!rN!@ICY43AF|OzwtHA|YmT|n
z#~j^;W`dCxURn#xf6aY*qNNABZUW{aFSN!!$DMc??=nm~e+Y#&Dp>g+goLauSz|v!
z)<xmw1i)S$-h%w%A+(n%&{Hu2QI!zp*4~J^myX?@rl8*w{1!TLxBU87k+`k{*jECu
zAOG8b;Gh2KpRsY%W{gr}{dJ{x0qjFWrWZB(6YD%Fk^CkBsY!1%N{okOaD?({JQbNm
zL{uOPES%?N;}&Y_qC70gT9J~(%4?L8l#G&y&8QWz&q+x@(>QVP`j`hIL5|EBZiR6-
zdUlNJXO0_GDXouAI&pwt$hT=-HB8$Wp>=AU=o)Bc(uspPhCoS;mwJ#}UQiBCSzsgv
zHI|<;^LJWWFGP&f(>DQ7>%@T(x`uHX_d;Z1)5vQ)4{3dzj*->HojByw&`>^2aOy-|
z+<Bvi$}q={>G0A4?6>+3Owcm&*1oyKEEsD8d%THGg9$BLqNhgU&?kV6^$*h%m=ls-
zr@`9Hi^p;u4t2tlr|DQ?V}Zt;c;1Cr{o)#~zG|OQ_po3bMwXsPew7FV<8T~Z;l_U}
z(()qMcy2}FlStStJx>rVMDV67cy%WN|L5nQaDeR&vPEWQ8y@Ukj$;>J<Ld5pc%0Zj
zC%_guEJr6<P3DWtkr0^<D?=0ZJH!@OL+n2uiIZ!Bk&sIOnXteH+T^gXqJ58|vDjr7
zqK|GuS1Sl;z=1#y$O)>c32i*!SPL*m?;VJFl#17Pp2K#@Stwe^p>Jr9_@^l_($kFE
zaV*FQ5fN$F?Cp${{86&N0yw}##f>nw4oBSmSeUx+g0!>|E+NP8^5zr#^5;KC9|6pF
zfrAcUUopU#1=iHu@uj^GKUVq}0DD_QP{>43NT;M^gYM4CHz<?7wU0?f5K>5mJU)$S
zP(tMiDoO&=`?%5T;=ptOo1T7SfPIMAY|1@N3Jxu4$0(#-n*Dvv!+gnxrs`$KDIeQr
zgE|XnTTWJ(tZN*?b|nvJ?x%)+q+dCqaXy1GtFyOhfG>ru?0py2O=6?P_cYQ!6qRG6
zX^2~f=zL=YixEgV*l}t+>9~yQ=x<bz^+lEqforH|oTS81H`6%eysK}BfUSgr>glRc
z@bj`@=8aCKP_&POzH{!4C~6v`>sDzjFS58gs|NXmm;=os9J*c&d7Ba|cfW?TX&hbE
zWGPLv!a6JD=%^S#M<rbo!IC*`uw{Gsz~r{Lk<MQ>z%44~h1gR$2*HH+p`>mcZKVpb
z(CD)xYpsv!X)hZ=fAuJOs#WMHR&ZyIzDhPgt5OHBuLxjYMI6|NrtRCeLoS{<^~pCw
z+U`TGrol@Guqklq0QQCHw+gV2A!ao#30j7*&=p+Ef|ntsWa#a@69D@%abV2aS{g{_
z2%&S3mIa3)CVODcI55^Fcx~q{4!Fq}Fs2C)#2IP=l5a$zEHWNq)|EI7T$9qpf$0GD
z5tCXu(_`?1HCNo%=ZM9Au_g1goPBIc-yDFw70CP!fT{WRy8)(RU5#@AjO`mHE0d&R
z6I{M8zy>L=4q#uHzI6b5Z~X=Uo1uv=#7TI~0@$Rc!|R;@W7Zi#N-G_}bO8I3i3K~q
zPvSwwvjBo|g4%mJakQk}Mvq)mhi3Hox$`m6*%07lM@uCRY(B%^J@NfiZZZ#FpMn>E
zzcw3S(;%jqm3d(59oP(jO#|69c(Kvw*+?5&fU!Bfm>9J9x)xw<Z*V`WVFF$ZW-}qC
zffm85H4zc1HIwjSvo22u7|WA$ZY|p7;<o@cQt=oLo`DDtTLM=bGst9Ab^=@~Zk0^|
zOvTn|iGe=Y{+A7V`Og8SV#g#i0jAm3z)Q)**L47UXZl?Qn7os9XA-172ViWh!{1+k
zslRamo810A2G}Q`E}vNY{4^V23?Sm72<}GzKAwoxk%!SL8>I%l5B~O+unSy^5eC5N
z`BY=Lv415@z1JYb+k?)kLWt`|0@x@@<07zN!6ICV%0_=x3d|PH$GHc|lw}0h_N~NX
z16x$K_F=3&6)y_g2wo$&zIiE1o*l-Gv)i%jb_(ttUW3K@)+lf8!B|H+p5!!BaRqK~
zU4l{N)JPmmY@pHQ2QI?KU;(a2XLDx_Kex4TFwuit-VR?U3wVWY!U$dW8kfcRbiN+t
z8N{Pw>##`A0!7s=8u$6E=U6y@0dB`;W22is<y%DeDo5(Qqgb$TG2+sTIk>74>Hg*$
z;Lf4d=pcYKy*h$d#m$od8!mr>=LJn<o%KT9mWb<#6;yvO&TI<6LQ_Z7wYKrmIEtdK
z(&w}QH=e|TjZW_RnKK8NTGEUqZdP#i4#R+`8){h>&Tb0C!bJwiDXgFdxdr~Kx5CwQ
z5q6!7Ah2mcrUTfF^e%vXk@w-d)EIpmIn-dzb!;vP^Ad3OapRol8*FRF-i!G&kG%)L
zSS*>hVGv)w3t()z6g#h76EiRqsI&m1W#*$tl!pZ{zdyj_6*V|`r-27IU%42~N9_12
z09JhWIx?y8pAN9Tl0LkQmApT|s({O@{n1U!&jVOr`4FyNuSD-h0hk(BcAiDX^+#wc
z#ajUDD^<W`(LyX<tPd-jFw_&6-Undu$MzsUZTxEoSWR9bSrP*D4Y3h6)L8Fhg1`J{
z1IUzW7|i#@zyJAPKs?ZmAAkSPVClC7DrRV@mDuQOia+`8Un0L*gofzD_`^T^BizX8
zL04rw{^C#m1nZ7J<@NW}mr|{2)VI?=E2ZfGV;+SeF2>Mbyod+(S~~CiLWpVNz{Ze!
zeI3%OI>_=<Vt9zGp=o(!Wseb4Dd6XGFt(<@s)>N+ao8^O#Nf~f#zsUiHCoE^yt#Y?
znGg0Ow~cuU0=_n^j1pb}bUhe>_o}m~xW5%~RYHiet|H=95{mM3;BI3@$H(Am&*~n6
zlh<yt%qFa`Nq}|2DChvM@9CZp3=k-7e{DqDzzPR*`a2E`x4~)CWuQ9+PYXLB%)Wsu
zPvcOOlTO!SMnxr9=(dUSj^g2|t$-i{4|7|f>PpAfvv*OLorW#Gwor`=;kN!P<r~7a
zH6G|9fU#~#W<gC_U{x<Lf1w`q_4V<qPfWN=e#ZH=sOadU^GM;m*p?dAN`&sY#XTGo
zPp&{if4>G`g94mb?ueYUHz-VvhTV$85am8ZTfYE<^iTO~r*O*ChDC0x>9!=exXuwH
zvThx~=1Ow`j86m^dTvHg@#jg_Do0#oI>ZDN?nYm(KwMN7WD`S5iJOIpkIJCq8n6xa
zsgN3(hNi|*2y<8<b3KN-hmoAzGy_(HZH?G=CP%ZcZGg^^hMrccgU&P1t44Ng21-h#
z99p7AA>v-7p`%&FuiNP}&$$8C0o10IAuqcZrjDC9!20V&h<%oZwt6LGZNpgZVu{SO
zRvvVm{W=TD@wIe*HBw%ba-a$5pPGS7+B%NR_zE<a_8~Q{8kHr3XwR#MrN;&|R*e(H
zl!$$lhMLkrKH_}As{)k87owqZd?vW6#3;)bBIZQ}gf%j}en9s@AYuR$)hQA4AQf#z
z{V2{Kqz1ebtpp?%%$)Zs4~Z}9kaFoVb{>x-n5n5@ZpO<8`RJqL{naDLO6<j}`*{R4
z^$dtrys75UYD#NDeZCk`ce2sLtg>=7N@FYV`cW||Uc|v?)irdKs?nL-hp32DG!RsJ
z%G8K?Sb~D6LL|lXXkbSBvY+N4@pU(P31Gb?<9KyD6_pu79AF*ErMUM}N>Bv+!*8Rv
zK!Jo8-O~Ujr~Ofo&~a(SC_IDja!af|LxAVk)6tYibr8I|3RHM~GaWf`B6JeKVh(LZ
zUMd5a3N<kecyTL__NzIx+EV-R{Aw!7Q%4D0Dnv&VqTpExVjs7mgB|}!02>#TWB==V
z%=^@ZZ|7cJid+FB)F^!SN8%s;{)c@3qW}0Ml9E%9@bV`7&S#)K^Dcx0pAkhr{^36~
z5cuUM)MybXezMpXDJdzqdmspJI+)A(0Ib*E#}+#)j8oNbSzwe#s-AAsfPer1|MW>j
zK~$okhq<*A>ZTo=OWHtY+MwU~ZFsoY;X-WLj64mmkD#8p!P7M^_i?9sCjh1#!8pNq
z-<B1yFfoDYa%$`uFjY!CTptJtEipchjX@4nW*pCUFGFv2Bob=`D2dpLn!X{Vomz#O
z9wAvDeHfAp304Z^-PnQd=2XO0cE8ny$O0tSoqNr@5i1|<MvYJbhlK%jZG&)L;7vDA
zdB$Xz?@RD&jl=!yM&w=Ih?3TB$OY{f6jNg`*Z_~6S9weq8)-w`9FK^!S_m_*;!$Q5
z<bADB^mma3R*&r$W5~MdN5R#t+yc{rODkr9y)LJxVCGgo(#~gtKEKulV?$K;KtDFo
z1BJTr70$gX<lTquu_uvM+o=KAun@~lOflHg3|U7#6um9P-0ScT+k})iZ}2G##2#vc
z%c?{4&(MX-8`&6+I)KfYW&=!6)rypuEEqej$D5a#5P!kAhHP#webZp{x65EK&lc_R
z5eV6QlPrOH7%x4K(QYw9w%mfWa}*(tZWyHpnPrwHXslCUrGp7tauaaoNj+R`{Mqkn
zM%`L~jR?lD*fapbb_D_~jUgt$o(gk8R<Q_|R(T`8S_J2%XCZ1Ef{VU6kN<iXz*^&<
zVb_%`)F#B?Q|GN1=^lVX;0ZngzPkbasOY>q{Tv}^8O7lcM^u*&qUiB;TzpN9;r?wP
zOCC43FGD^-q~zXZq(6U%fGtnZUs8^Jx9cHp9Dzg7Q4YEQdw=vcjN-}OEyyQ}W~YZC
z;!}FjHyvIiQC<<O-1ic6<Zz?1eYK<5=;a1sGqBdt3e_bF><)IrsVChij<|vhvR(>q
zUBJ@>0m@#+<I08mxcH<4y*Z`Wax$GPG6`(SiW#VvV7{>r+De9Iz>8U67gl(43oPr(
zdHAoog{F)u*mxgDS7IjiTqr|RN+pgQeul8Uspuy_I|X0lo{lyP9U!V@@pTK36xWY)
zEB%p4*37fr>u~>Z3tk-9ftyicxZ5v9d*LXqY*~v!g3IL<%g|ZIEH5?AgodD-fY+Ek
zIs;(No`>-ARyrOWIg1Ms?dT<Fn%ZqZbA}i;2A1e7A^2ICAwNluOB+_=Nu*>FV2$*k
zvHwIa0a*xphqVwE$YJGjh{_JaP2UEc#q>~Sv>4AHcjDH@6?pkt@zDVGWV1VZ#kB}M
zm&&)#dwhz%iE(+yl`8z~KaBbMPyg8(QmK?A!{Ep$8WK)pp?Me*k~8q5zp>$Ye*UX4
z0)zm+UVVe|Ng$ICU~HVtodpEyFF;@3RlKN`%=r$CHTYxf9n`G-b4hD~72Q98yRYKu
z;p`d?KBb$SmIuS#u=ZVxjMw*}Z^B@tf|r$MNGW&c0AyulV1tJ%Rs`7NO==o~%uVTk
zvlPyuyO0%oAGRS!=mQ}5N^9}|{YsBuGr|E@-KT&`TnST;aAc*ugtgZ;{w|FD<No4T
z3+Xfy-G{R*u!V*;$jD5Bl{tG*7=rx*YUs&Qi$A*-=kG=0=Ke4|NUMUXBMBQ%MnEmC
zf{|kgvQnd9;k1^nWdLE;ru1O&2KHt~Q1+%{{ZX=zM!K=cz=5tM9=2v|v<?~kjm(jr
z8VheLBW{7on+nj?-8}`cil;bo;|bCeqVe?XX55M^!ca{N+`{)D<=JI8tv*GcUmr~L
z%#oE618YP24UCH5@+kpK(MN5^UTivc8PPZQ<H)^4l-%Bh%MYI6;qi6&g>f(kn6nOG
zUz}zGOx8XOAz4(W-iOfJH~`ti{&z`QmVpD;OSzRaMsVU57&Vg2?cLCP1KQ(m!_9XY
zLW7rK*^<=|(39z>o(Fg!Gd-+8oEMM9Ce~QKKN^Zzb!!18&Wpw6m_EL*`SmTN&{Mkp
zuf55VqwA)6M*7rP;b9M7uRs{<E#$Fga{`Rub8G8Tu=lB~3(=S?upzSK)_6L?$14D)
zdJE`2fW3iE+%l_*e+^4pcLaENVAsWR47Bv&L9z^+cfG>Kov*PucrzMb-o>-jA;>GL
zIl$P69FC!<FxWl-BNIo21}?*rz;N7)?!|UjbFjI^W_KZq@(Qr+YBjo&l3?Q!jF12-
z6TFfdOTaGhFeLSAbfu=^*u&0Afc2Mk!`0dv3(Z`S6`6n=FC}<&WE=eb!w}-X3`>L8
zLtH0C!170vbAZhSu*}P6kdiabEjk;I?T}UtBf!ZK3l^FqA*vMNhw{)*WtKbHz{@QV
zhMyVJ(==dU9RN`!SsT|cAue4BhXpq1rS0xg`c6vvU|`~cVEW!e{KN6=l?2NS9nnqS
z8w1$$z3WhyPwNx#(gMso^e*btrKnA6A`9#SHFmcU6+6JY50g(HLP@p)E^g=0O_o<*
zjsV^p6D9ygPySoO;O`xVARqed0=A)(&a=VYi7bl%n9Mgo6P?f6+5^3`EWY~~_nwJA
z8o*exaNUWNiyP22q@;E~7mM9D;rWdtFxveBKl^t>p69IReC)sS2*;K?A+kn{q?3U-
zbvF{nR=eZ7f9J;Y{Nx9pp<O(Rg+KZ}9=&`8mrwp*^pBB6nSC4CeWNh-At+Fq3t%6j
z@j*6PJ3&f0jv=WKa+#ca7)}>+2w`Ij4k#2Dl!~a_2ow^{P*qTmLM|3?tBW#WfUl3!
zZsx!-067~Div=w+$Bi+ngSMIT#`pm9+?#OZAW+DKtjleXU^Rg8F#+sWU!Z?zHXtz@
z<(`RoKGHQ0cOv-6V<_0rIOA+&dMQ~<JsJlN0^P8vi|&IOAm+ruj`g%dsbG^13L)#I
zfBcC-ec8wyvTpkRCbs20tx%H1!~&0{J@n5xB;igRY@~WgS1VMKE;6zN7!!41M8e$W
zC#*1OC$Xi8Yp}luY97E$jgh1sQdU1fiaBwxQ8}a?4Rl@o+;KzR(a4udX%9wvo2dP2
zg<8@{ZE!aRI_fag-+{r7T8xW3Afvh&v<AEDCg7z5*js6?E<_fbyyf6?J{IBh{c~xk
zR{`swlNggIvC-cR%`rD81DOp>*JG%m3c=eSW1Nof4)$X~?Qqev$DmM&r1N``{U#cx
z9=GA*8gEoJDQDC@X@T`gxP`^)I34bTR{EW6a<xETj}ncsk8tVyCER=?#aQ1MEI;|=
z-2iI`%I{yq!=!#Fng#g8aWe#|FUh(RVx(srHlO~Q18fgHQH}{!F!|Jje!z5{R}N$Q
z`BLumaWK>mdDKv!ToH`hF+$WnkHE9EnE<m1KF$W-hMu82#BE9x+`W#3+|kbk*!HV6
zkX3iVG4M1Ltx8;2vjja&fUBu1#I*hT#2%b{JY|8^r`4dXR*9h|87z$*aO1TMwJ)Aw
z_qjsI8^#f2A41Fb16We_*d)Mua=THUJC5NdHB8McvHDOxsvbWkKn_4sH3I!l4Kx6=
z@}C4)Z0aa3g?XZwK-iX$kL_f^8Jh*rxs*seOMpxt!<k@jbntgyYMfsZj1IEE1SJIK
zX#n$E{(|-qoQmmtv|Wb2%m(<aeFkAE{kB}}(M(p9ow*ZPQ%YpsxQA1>+9xfr{96$?
za<Kw^h2!va3PWR5GLBs9M1P?Y<_i~V0A@v&(pLnqx6>G;GELW>Og6xmEGgttjA{%j
zp5!tKh))=x{Vb`;Vi_LQj8rd^&_Bx@iH|?{o4V1@66*>J4hliovZY+hLV{2)VDOnc
z|J<7LLeyxQ_u(`T#3@a=(KE0F1%+c|gaAnEAwj`dwlq{Dx|Z^`cAS2g#Jm2qUWmFl
zFde|&>BR9N>Mp5(zuyv+Rw~e*7Kbuwlo<rqufNVMt%kHz1o(%dk`25|`3JiOu*N?a
z5m7Z{!4=?1d?$bJwr0m&%@9+}<CNf|Xz#|2$JN}r>ntiqfL{pmOX#Vsi-A*xT`R+I
z^kOnU*O~2`v0~F1JUD$E?4fRV*b!b2ABmn|GAVk1dv)$4_MA+>mK`^F(DL~mTd{n@
zNjy4p65W)iIW-O8yC0yJKJ)<J5G2GE;rPW2u)%s8<8%13Gb0}&f>Co~B2x242tIAN
z^Qx0OdfeE(6Ok!Wh-*X$rE9)+zmz+5T;H*sk5|YB?iG<$HL0RHTz}pU=ETvIUW@?m
zV5Fr8`8zOq-5{3uh9ctJb=-@SqdF=U#ii`s*f<WZT7@Oc_j3o4WpthNn?m~Sd+_sF
zi`r7Ew_1uLN7FdK1eNUF-Gm5S&yOAD@4Sj1M<Fk7oWDQYx;+9SI(BL29{2}rL~8}G
zD`Y9EN`MpV)??MG)403uAUev)YF&E*{S|7IJ&8eP<|x?A&BxcS$A+zs&{syEPj(MN
zd_oWrQH7oo6&hbBBPL-8-E_=5-~@!ZJ=n4@9o-WE>n#~XnD0_<K`mXf2hI8PofoK3
z@+1|$?qSGF9@4x6%aJ0?e<{wN&qr6j3K>^#p)7rzzxRqceG9(+>rs=XqHTio#;sTu
zdKi!PA4hej8k<%gBI`|!%IE2bjh27K0Q>3^n<GpY$gBgH4q%i%2Eaas*eD%(3m3uA
zz>v#8ZxNz$2Hws~@cJSzL~R_Hs2~%1dis-f>Mhcr7-fU3u{Mn+JrJ3uyU%N-^*+=}
z>v=d`O?0mJbfcFw_R)RnO<t2e-Df?0uiP5bdLB+lSP$%58UO=*130>_q<Zir-00QF
zzIG9d_31O6&;p|XK7#!W55zgV5I?3HeK$dH!_q@2z5g7=xnz0G@<P<bfxUnFYKD^f
z7-H7b?+?J33q8{Z0Zgg`*!!e!9l)5_btokhqV=J<x-dTgU{cmyE(FHNx?>tAO?D@K
zO#ow4qYTk?u`WifMB47eSpee@qwjo>+Dj?H?90Z1^-~=K1i$I}Is%!QW!A$TIW*fk
zfPK02F#uNm;vibtbSiTk(`vLQ8@E$x>5M~gT62;9f#%Mq6}9HDU3ZD{G`)3H+g<lO
zn&9s4Qrw}q6n6>~ic4^J*9LbfPH}g44^DA+C=_>>BJIud-tX_<WUVCYd~(j2J$q($
z0_|8(2Y4oU)d?A7YlF+JSPGN*3!by37`Y;>B@ebf5N~TUY`Oy`)6PgDkAf8){l39}
zRADN1${4_T7)}ZLt)v8#ivh~Z>P-dsaReYint%8s@~Ie;Lg<Ubmffd-^=mGm&hG;9
z&_WEE(`HR$zjY=X=fLobS`qKZf$Wd6>V_F{NtG{cfRY@{SV1?<l@>`+R%yAs(m-8(
z_;5Kn>Y{LF1|Cf2$_U^jXwAk*)sQ%qHl|vHgH&`0p0Uo6>MS;2hU%=2L-MmD_EHs4
zU)zGB(GA7t@A`l;UYh3YU*rrGu#)HpSs6nfl!a|^=JffNF|`!K;G{`@A_jogK?!tF
zBT4={KG%`+&N@#yvU5nz*D=M<)b-fsNJh57a+aoK`(LOlP1!+L2c!P~)U4pSlaoGv
zriWusZH6U|LLTetjO&`i{76_(79su-Sg*kETSB(CG;>2$mG<}~sgoQMizh@$X%u~n
zE6$B$Btf6w4aey~)f8Rbx}FV}vVVXr&&!GX)ryw(FaF50r*Je1s@e~{uy}&tC=8HW
zSps_f-*r!S^}$ao4ILjGaPlj^a2+)SvBQrme&BiPLxk)XS8H4NzZ*is;a^KfR&F2G
z0Jyvu{+y7Z2iFul3@pf^H5>jyF9)#Rm)Dh6iLs7EK|R&~l?7G@KW9%@@EgOU4|K<p
zO378+(gKy^y36_SdTk}1$N+XTc)!0&6Bs2o?uGrp7VJd={b3&3Vv!(>!F>&YUwvjA
zzvH<+yrecr@DF+G9<MOFO60?+ew$-A=f5u$dk}Laf#<nZR<Ra@JG*vkCX0AVGJ|8L
zTYg3mU&{%@#a!SLnT02O;sqtcxPsNiD3$mM#{^*5j;KqzkvT9pWMq?x0(_pFKc()h
z=)<m9jB@Ec;Sid|oS3k|>TAQ(6jT$lt*PFWHakGme%gjP9_(j1&V%x5h!=^%FX}$Y
zSgCT<I^9az+KArf<qdrwB~H}tg~Ww^Vf4GLfBmh5rlhxPOQ~E>49@8l3=RG)Kzu4;
z^hBa<hFWksH5l(U!(@!Qc@6`CNnnf1p<*ENCg%9<cy9)muxn!!IT`o&`Qm8obNt}R
zgT(PMVg9E*1itJ*X)L9%?-K~1VpQJ|io_>A>Y;Tk+Cdt02ws4EZ#^(9b?N>eZd{yI
zo=N>R1;$p~ptwF0fsa$MNX_$-KdyT#Kh>Bib&kf7>?bQI_Kc?Bo!7|fxEs2EzrsOf
zwxk_va-ED5OD2(Ptzr8l{@OCiYjG?Q)tWgN&X<@e=zxZ58Nb6NnwXg<HFlbBmjhl=
zqg;~k;8sJQedKiD8AVS!$_bkMAk&6Yq?z|qnu=$FXSHVkGsUEaOL`rftnXJcQ1s`@
zCaK|F-q{M`s9dSI!I;_-LwF{K2}UR5cYzr*QhyXzA$HqhZU@DwaxyqJg_xuml_qXd
zBQ)<@Eqtwv4k^h8Pc1YzRAn7G4}PYOCd8~=-A(ZW8$(o%R<;5WJ@2TqwN?bZ$wIRY
zXdShv^>MPFuKH_X-gvaUo;R{x3f7m7(4vhwwE|!Ucs!Ch_4weLrd=y>)sxt5-(+Xr
zzNuCcfjv!C-a>E)Nr&ymC-O6y<inkgd1*pX1ke%291Vm%cOpPI7rU;BOmVdqwHhjc
z!JbxD=M7_2JPi}f?!dzkKMez!ABPPH+W|nUyUvq#0)rg5R*LnN{#}_fANLwKS%T*`
zVc7ZxYznMRS#)bj8PZ~!xT@D91=M;Mbv6U?8WYo#kk2=eSP>_ny+7Jh8-kfKQ-An`
zLgXj1aB!kpXgD0L{ed3L>W)4DwXuzE2VE-r8)_ZPi?eHoa2hMJgtarLR_&UiuJpCL
z8#uRsPH{YXM|Q>3`ZWBIVwV-{0h&1QrWiAL_vUAYhjrFD9-TSi{FMjlhsivceOlus
z9?NzMgnbJRJ~0SFLM=KYwh8^UowX>AbkZ%QrUJ)(WV{Xc3qlo&(BN;fh{X%y&xwKm
z@5Q%i@k2kR5-hKeg<=PMwb)3i)vlqgk=6XnZ3{Cvr=9W!(JZ@L5y6WS@;TUJ-I3FT
z;6w<ZdfN*Fx`ncpRd%n=VpNrRT|kaim>MC)F|e<j(AJiHl0u0xvfDq6`$aDJ0<WlH
zQ#Ox!S!WQZh_->O+dUgAx^5Vi6Q+G%N*HzU7jP4gB#h*4*Bji-Kl6Vi&ws)Ph87W%
z1_XSg?M7PSCa#5gyey#rVvlx7cy%_N97Q97v)Ax>2gjfX=0xEq4o(nB?qmF0d**^~
zEYdbQr>+KnEL%4A@d2h(`UMdUz;{Dkw^K~xb&2Q_YhY3wQ$Jps`ro$9i$vJK;5GuW
z#op=x<#?H@f@m8i`C|CPf%)(ApFGYtC?i3J3=L<pqPH}TCf~o~C%MTv+f9(beIaJB
z<Cwid$|8^3y&#W0FU+KMk<XGfQM3s5hXFb5OdH<lI=5$ww@%H#_6HW!yBdV~ARJ!b
zA%}G|!1|sB1tWUx?2{l_DWMiypcjbJL7P}X*DkKon^~3utA4Z)VJt)r0=MT$Fj0$A
zX=yK<Fyvdmskcwq!1O8>9Xzw9NL*-y98y5(BPSnUnB15IQcNev>In85=BLoB*a*fh
z4AjXjtQ}k!p7g0>4(+|U+NtYnv;tpIYd<s$K1ZZ`3>ir0>oFT}xdTo@4Fl%G&dE0d
zCc<gzPiFoI5J$1(f&|vyM#S&!cLt%;)f6u|0s}Ksq@<4@3L?aWF*Q)(X004A8k4C6
z;Oo2fF?V+fP&g3zi|Nsdc#0@J`HZgbkV5}O%N;A74KduCUtHnC(4LhX|3GhWVuO54
zT45+`lzUnJ+ffXkk>48%E)MoBCWi{uu;5B>yV2`S7++CO_>beY{tyW*aO|Pj<)`i;
zJ?KjQ!E*ylTB3jsM92C%;km-tG-WZ2^T>%Vs-*gqfxJP-O~ZjiB%};6jfi|%by&`p
zdZ2JI{fbS-cs94PA96?_xY`?u^Xs;7cX6PMK1LdapE4+VxMxx}66JE|Is}iI2kh(=
zobx4oSc|$@G&1s{;2!)Vbc4xb5n*dENEo@<I6QS*?4CFhbl4f5E{tbiN30m#!;^J5
z*$;SZY)2nAX`Jr7YdAeN)BLm<k?!+VjakUVM*0Dbx8LU{kWp@^y|<sV$F%_3Sh5EI
zgg-W8`@gVYwf;jeI!BiNv{lwvhSkUUfkh3<M7)-)0qj0UODBFq;vL|-e!`F>)Kyq0
z;MRwIz+d%d&kFfGOC`BbRVB|zVune~>AD{Fw>o{6pF5=BJJ;d27vxaW9gP?j|3?d(
z4JzNJy`9tF(L5aM+m(LvFjZs2H*)qFO!<#%bj4qRt$p+?QQ~x0L^8%_MA64K$NL3t
z8BdwpN3lb|?$s`W0Cz{egjJYENJiM#6wPQ{#F>Q$wtb`Mb@9XLc}HoZu7n3*t^nQ~
zz(j)mwsL8;?EwvAyL|ZO`m1~2lMByhJ~^s8A~F4Xq>=CuIEH|1|Mi#)M_Kcr9&$vj
zhYv76hbK*GGmZuCgjnqdxWs*WlpkE~$3#DV_b9gNB6A(5on{#>@XO)kz3&&t-J%Ve
zUbgylYAid@?*?0Fq=~DXHaIziHX>X4{3%aJQn@c@4baq5@Xd6cvit~u3~UfQL}wQv
zpxV3D^$tImlGMaa`g|$DD^b{F4TxGKB3o}pl%39^nyMLXg#BZl37ohmAJc<FJ9&}D
zXBGFs%GBl<Oq_Nyw+{Z(mmM*!2-$XkO?Wq@h%({}JhpN%S?I(fE#fh`IGzFSIbH?*
zp5)pzI!i!kY!pIPvt!Lszo8*m$&2=R+RdUBR!gjaUR<ZmJbGxjLV3vV+vjhNg`#d)
zPBil_ph1aa-Ehf_HT0(z7wFF*t;wECO8CVD)x7A<U#f+S%NC@Y9ladrwB9fVSsvoC
znBBv3ttPI8kRQ<qLXH8C)f<vNa(`0T|EQ;9lQqJa!u#d%fziwIZbamczlE}?p0CTk
zBG>XZj5!p4>%PGrGWZ1EDbeSe-0qKKadx<pg$t_=GgS+J&q||ppQ7kYSqu5&Y5Ma!
zQuXzNgoE(=T|6d;-)<+O;)Vo&Z#K>OTo}LKY)ogbY5W%^tr<$nh=CkHH2d)(S*8pN
zo2v3eVh)i><{ndg89MRH7)>KHT4(%-GB(#J?rua)ANwr;M*a4M1kM#(=u53e*Mbmo
z{ah(tWB%Jo!5ZajJgz-Hj994V?<pxHv<-2{TsJK4*OFPOdj4o;J0x(=Dq(9*n)^F!
zk3g3j-SU-yd>oO(!l(CAaY`~lFIc%{$56ewpdKq4@5H;a7$|!~wE(n_|ENt!6Z4b%
zUZC)#Hmmg;J9_g+syAzz8U0M%=y2^7OE_*NS2O23bkY9VtIDF{s8cPof?br@Stnhc
zh48~>>tGEY-bF3@(o13}9n7a=9KW@q=*@4o9VazbFtY3rME7Y_Jcg*mMP0zR?uWkD
zu2zf~f1=>y7{SMRAyV#fFo1qawZAtDpDf<4n(&4Wb`>jVBe0h?bcz|OYzF1g!6||M
z#aFez%7&x&+cn&I6Py}#laHM@?|%f^lW74N@{8?AY)Pc;;$EOA?Lj@^Ci@hGtA{|`
zsRE;{xDn!BlSB8uioFx7dQy=FtmYRbJ<5F;47yb$hLDWz9DmEEl3vjhjnB5?dj2!>
z57)t6S>k9S%5Jfn(2oH^HfN0ba%t*v69x8Scub9>xj7Z}e>tgBS911l4<Nqf#wQC!
zXjP(~u!GEpbdZ6R=mC}>@&VxTkF}^F7VR76FtIz5{BsXc-?7t14?|&OPOpvpHoypL
zy<Ng<$6a{6Dcp2!`i;Guz<6WkMh{7leahAG$L#Jc34q4#+9N*W^beQ}UfodcP7W?Z
z4QTIW4zZPHw*{^T4y3{36*>09O`mWA*qRG^enqQa8)(OixxY6twV$-8?jt(bGAEw;
z{<QVuQu5!y*6|t=xxL!&la-{6Rk&a8UV`<#Opf=R0`*Rekc^Z<j&Q;S0Pk$sGFwQ{
zckDE$u8`7lrLpo^fPK(kX1+JVWxuXOc+1F#*E~rH5TmziTwqFgy^E0qAgcd+R|}D?
zJ@}uNkl3HxSYS0U>$ByJmqmm&!r<&ImKckwYkRX*DP(aKsWj~}@ew1L*HrxMv7X8<
z!oy|bZQcR{te#^y=v>bk5x3_`wCXhE{Dd{BtBWeELwqK+2rshQ7M;6Tw=1S=ciy?R
zDcbNTkI<I;TlLbaXgL4)(Wm)~u-5xIeeQKZab^9hCAn@YIQ6fjh>AMZ;UYFGA7^Nb
z6j8)Hf!v@VaAezu&80b_qJ!rx7CM!N_KvO_)uk(sLDwbR`EgAVd>vX8#uNlXAA-9X
z;kV)Bp^q6{q*$^r7iB2!&u)!VX1!*HrpK8BiAl2drkkcSuYUkC!eju58CN2t81*mZ
z*4ebE)yMs28N_Nm^vmAfyYymBNF|*-4b~0R)zw=KvmzO=tlq|ah&r<{c4D!b%PkwT
z{G7q5W<)PP6(5_L!U}?jTPdb?3<F;MPZTo5m$hr9#a9ibDYt_r?;Ds<&pm|17I^lx
zvNAhpxi#cwlk33AVZ5=i%FdUH=$)ubt2-yiQUPY6wcT;KG?1amC@*TQKKY<IQ`*jN
zh$&X(>XaI2qLnlA^Y}5b2Grx1L3^jx81=lRo=}QmUf(87`#0g)9w1f<&AuIn9!k!G
zURM(}u6AYX{$q<MKUfks2od>@ap#66eyOfVzgVDHNi%UVnnW>M<~c(#kEi&<R3aZU
zvBJnl$fm-)O)juUW=?IBBS1u^s|zLIt7Qp}hG7abQALI6ZSbfCg)o`s{uunMyL;wB
zn8U7gN|~PN#w4baTl3J^n%9ae;Zq!?gG=HX9|UttgUsT|?C~%z$G9ARlJkwN6X*L+
z#^v@fEC{)vY2;M1Btl8}wHz7rLGL>e#HjB+By+y}60uXKB15NzLK%1ArlvplAl3n3
zP%FfjIJ^P_fxHGcBKDD|O8IPv+Dwb^zbX$~BHn|m@!{O+kGyvhf5rI+YUuc&&typm
zQ;iAL4A^&ytlBqb=OXqgKE%fJVtUcY$~eK~Zojc`n==RtBdb|!o(e*jp_5NZ7%*N$
zkW=&+;xA);r9}u6@dFSK;1Vc=wt1$aLOgJzPe?LC;bdz_MMEf?Doe8kj)m54kX45Q
z8+)4_?*p3I^WXFsFj}W~mgVxH-w(q)A%aExYzcu%7ZdUm5bG6G+^Ih+AVRs`(vk!q
zRK)m*QPU$E`l#0++suBNeUdsRv-3j3|MF9yz7@M!D{4+putdQw7V_XR6cj}=GN<!F
za-ldB%esaOX4(8LU2DPMm=v`H>oeFcoPLLwY1vRfX-bf0QB`9h6!ABjiZ_+*!_6L)
z3mGR8H#^+PcDyIkX&MIeQnNuU+vj*xATcLTf*9v#D{$>22wcTPLsY!B(fw-xQfWJx
z-J!>H01@d2?Txr+eZXo)eHiBBhI*PHs<|;5Ctrbui7V^vm*0t5WC<oWtdUUBBdKlO
z4}&~(PC7%k%dGVBs>;wWvys{S>c=)U(6U?^+#t}Bw)vsFT-o7N3Gc{KyaFnxE{7(Y
zX+hCOpCedB5w+&z1qSRApa7n_lw5=oPJyEUK6;x7Z!m<@?w@eUe5}x?6Q6Rjybe(n
z|7*~}@#Nl~eX}>6W+irS&6hYS8IR^}u~1p!r72lY29S%+O=A(6Dead|PXr!17Jlhh
zIr<$LPTJ=N2i`mJ4`8OXvAaFZC&mqmp$dFQwMuJ0K1le!f4*^=u_%y}ZmEDw!+LpC
z=ba?urUQa^zK#@$3((LYA6KtbMXjf1=Bb5PIw>);3_E|@_|Q#6l`1u$0IoogQEQw#
zL^iLqp>+kR0W`{-BRA|6mg@POOT#@)pP7V4YPew<f9Tr6ainISTAsm*!ZDyjH0_U>
z1ef@MoT({Paz}cFPO4AyDjO*Ykl}uYc|a@)ACY%WXki_^5}Weewq{tIV=0lP$0Rha
z-?nJl<WCZy`j;OJ?8UG%(iXx!Pt5rf9*ET_#sd*52mGx5S7JVU^l%>fC{gYIJ_Cw=
zA+xQyP#p21g66dj(h+q;=~r~gbUrB*hpn-CN0Fu`eq^Mk<2s6Y0up6yHs%$>uCfNi
z0842S8JQ`l>og<)87C?N=_9@|yT4Cj#GSOW<C)=N${O36rStO;F+?YQS-u$`T0B3$
z-0cb1(gl|X=ls1yLO}`bD6ynbrNo7OMuZ#K_=%DWteR7#sya1Ws6sNautfic$*}pk
zYA^`Pc8n|B&n^HPiv*ymE&L&+6*wsB?CLJ1mQNV$`3q*m;+X^14GsZ8{MT4Gm<inR
zT`Y~P8=2sVmmCB;?6rG(5CQ1yT^glunHlmK;d2-5_xAK=dV7B}v9S;9mk^}!LZIbb
zr8IJUjGQ#xj_kQ^b}PPn0bTq>>cr4m#*qL9x{HaPcf7%@EO(gs%ZD~h8whmyQbR_`
z6Ov-MmVW@P_&J_CH)vZJN#$x~Rg`PEft=~Qi|zBR%HU*{oa0Vm6LVWc<348toeT6&
z-;6VU2$>pCL)MlsbWYEZIpmaz)0TtLb!?AzVyTQd?ECJs`(ikY{ZQ`jf_@ebw?q4l
zt-bo<?$W=b4vz7$CZUkzxGR2o17QXKwIY{*B7(qBO%xTRBCZN_6#W)$Rq;nt6&7fJ
zc7*^5e?2<x^}}3}%as%24R?czrv}c`1&Guqy0DIf{-%jxfzHYG+rL5<sd_2lLE<Ju
zGI$G5bE)6sL(g}K0cKZCwO6as7AI|Y{Q!-<r8x&{+DNXMUfeS;spXHM??<TA+3=j6
zn|9kG&pwC)GlP^$tunTqM126zgZg)Yr)Fcs`d`@KhVNXD)##<az_12A?^vyeZ-hdi
z*hD(@Y~qNfh_(U$0~z-+V{v5*4$38|`Gt3_K#9k%#k}fL1zIL?l)OW5`G+sA(gwnq
zXJM#R8nA(UrOn^);_4C#TfY&h%#Eti5=rjH#W7x5rtM<EiNcVfJ{=xV+9M5se@wjz
zq6k-cY$h>r$d88cL^OzVBwi}ThXo>*&uLS+Zr~uv%DGsgr+!WP$~yr=%GjH56n3%M
zxY0E9J^g(#oa9CwSiO=>mr+l6OSkGJj9&N18kTt5;4^Wql2&jsOr7x~YjAN0?oRAI
z^fY}JcOrFj&&3Z+ZoIwuTaF+Lk3malV16L>=-;2;0JId*AkltCCc$J@VaqU^of7zr
zH7iskHP+@qIN{H@I`|Hp`mO08%{V$gM>l?-#h!tVV;Td4E6FFieAfWZ+h4(xcW0pK
zX$#Y6)xQa1hH{9?AwMOPJZLvlbltWhMX(gF&qCVnzHnYO5(7xBC1=BV)KIgiXSzbN
zqK2J-u?|&4V;O<kfDtkVf)4V1Bmae`8K%Zo*W6FxK?T@2Jbts+w<NhD@nJzhbc)P)
zn}28oe>0=SO(rI;|D3o_(SmHx0!C{~rLxP2ql$z%P)QR;rv;8c`aBpp?U(^wapj7U
zMM7~{H`TGihW1ZSLt6o7*zGSgipKMQ*aBvy`r!G-NB8z#O{}dWCJm53gk@%^#=Twg
zbYN+<K<37<&K^ans$v6X;L2@qj*fO#!-$U0NNLzKhJec%N$9wpZS@yz9k?UVa3_1@
zYw-78F#=MA0)8Iky7>qsM@Un$+_9Upw95(7bTtM&3tD@N9i36OC<af2ntPLtCJEE8
zs3QLlFLE<yK4|GJE56nDp5kLKc8Rzj&<Um^dMD_|PEbERHAjS;PPe9FX#}K+2|vT7
z>w*7}yt*);we}7S#l0iUWoW|in9-h#TnB?oWsNJ4l(HR;E1m&)u+_Uub_Rj$AFL~|
zz5e2$5$Mx!SK<c1Rlf|m>JViOFubw$V+eGK0Mc78LsO-Y^c2^;%3xRdTmH|&Xe@#f
z;p>k^nC?@kG0^>vP`~<)B@N$p(+mdWLj#Z$fL9dRM&Ur#f^ZUq77~^*+d&=SU`(-{
zv|kTjjgILs;BVFWWd$Iop&EcH-)2%>HhY2-la!;hz2|5qa1?UJ;_cwH2UHnwDK3lt
zZiX|<Dn^G?fmqLYO@+9c%tn3u4+bncX8Qq*ZmJJP0Nn+6sehHs2&153Q9}FbB@{0<
zz6&@bPMqT+w!c`;7d*wf6}BcFJg%j;OVI`8X4x?Lkb+pU#o0a>X2C2SKz(HMa;qWZ
zlZ2eQvdb8hIe|am4?BZu!%iuR>{1(Vu=ICZF9m|Cfq_{k5+MLS9cRjw?G!g~9497^
z?|Q4AWZqgwi?v0vdlK)OUgFe*P#snNL?;r+{GqX<;3dZS+!AhD#!|HxHmeaLWb#{u
zfJ#)MO(suTB4CdUU{-Hh7=GdfgmT|)Amt(Bc6myKmyzTA84W*sc61M9s7jh5Ko=5}
zS~W}Ig_~~7#V-OXSOKEVX{@*MG%!xr4kK_N&R$_0qKf91?jau~6fx6MAWn-7Hi~k1
zJKx=R5<^7zwn}nnul3!C>2zD#8(ok|j=k!~1F_9%sLlo)yQxs+*XDu^wH4>c$b%w7
z1IthRj4ka(tO782Z%P=*A<F}lGQ=%ozOI-I6s^#XAX?}}TuAh(p@r&-VqgE#2F<Zh
zO5|!c8a`ab)O5@-GCpIRKm<wWRQ!;(c_3yX2MfM%ot9~~Slv#^sEd6C=_~o}Ey5>r
z4cbrhVlXQu=~QeLgGJs<Kr1-UJV6t1zJOCNF2YGJj_M`C`?tNN?<!dHfB6}ntXa7l
zyM>Z*ZfGp9Lg2bj2z2WI()<mzw3UVk87p&Y^ba}GQTF$~tZ5ifDcN;o;=i0cF;$$0
zj3((@`_=$;RArI*D59l4E2H!It=>j4ugoq~#<I4ShirV8k9)fTuuzP#PFM8Lhy1}E
zl!sbqJW9QQXy@;Xex1Eu=38OV3nAOUz~o#yF3lH>C4k&Sa(N(=VNqv#oMWsvsKriu
zU}y*}q48L*f+RdWjBE0^?Lcy3nHs;FZAuVQoXXKKyNZ0#Ag4aniB-{n>0TdP(SUqu
zwYbOm?!*Ze-NuRLW$`z$H3<thVv_B;1xfdr2_rHPonoUQ*XF&P?*aVU`}0`qu|MQ&
zpxs%>{koK7^@+S*syfb9cINE_$17d4BwWBz5_3CV6-02GtqS0T${u+4d=p%*d5oyY
z6s%l7&hwED1t2PQ^5c?q5UW~9KbK7SV)R6A0g=|dVEOrcZ`h?<%5k*lM>tCxPY&XU
zD*a%U+%#-?rm(UoA|B)@Cyyl;+l(bH2pv?tskxB^tA!+AeX)Ja(PK|K$u@ubenE2f
zDH7&G=!9%8;yC0iwvVmvn93}ZimDk!D;G7g)mtoQHRD<h*w;U-N?}0oOZ!HUF8okI
z=HG|2^-yU&uP&iEwwuwp`xEUsnn)H7A3cq{;Sa7zAP8f@7M$F7pQI?M0xTE6-08*m
zf~#&Nkw>IBjDK_@br%7*;+DxC$B|tj!Y&uqRRo1ipHXD;aPrzOcePRqwc*u`$lmx3
zgBrGk&}M?^P|ddk`3OT=hVM<RigHem%Tt5jF|^ijvyr@s2_I?l#M1kh3G9V(!&XDG
z)Kqprm<(lFev+~)*!JgBzBu_u9k}GFG|gI(vl^dX2q4lOHtjfDs%Pdt)i*G&=$$|G
zcTZcarO($wV^KiKO~h?Ou5~$Z4c0IqDaP&qf&>jbXt|$n7$rr`P6kR}e!Yw0C@KEq
zSw+oO6_)BimAk1NIx3=KcxOM*A?!b%2}=f=d90HX*8S3UT+x&>-Ty1Vf^cWQsJ5*W
zD<BS*Q#KFLt);Jf1oQpD6)seCCs`-@uBzcunT|jo&Sk}m4>2Qd<#V&NoEtb*v^#-x
zW?emb3Ce$J`HlTXsc-E+(NOnxKPL+E#FBeEpH+Bb%STMKh=97g=wZ(XKXR*+o(-72
z&AZFoN~b9VI$}T_A{{8MuCtjQ=usZ`=5h-9qncmboNswA#Xh+x%XlQ%WDAVFnacSP
zQhrZ6G9$=HNu|qx7T@Jq7G?*j%_^!L&C}hO{jz`a>F#uj(_sIsoiOezN(E|>yr5F<
zn6SU&LRsYp$^EqTPzD<HXepJF#2q?aP|u*d%AWf)G6RNKVT5mD9S;MBB^Otn6oOoA
z(%8$qkju3T;V9i^P)HQ{Ad!QTO@Os8zbSvju06jmA8egvPJFV*aCnUA8Q~ZVY1vyf
zs`}Ybzw8yLK@wWxTIO)gNa5RMBXp|&_>05W-*p@mFhJ@81A3X3u&%8NPI|n7=pOD!
zET<=l5~Kb^IV(emVr^nVtwvVS<=Cy?_kuv}t0v7$Q(T$*WTu9#hX~VS3T)w-LA-jV
zj*~=DX3F^x8d}x;5`zA;Nh9CYeu{6xLn8!cEk*dJjlW&q0%6A~@<uP7|06EteiIRt
zo79h?5i<>6*EfX5R#$ca(}D^P33NIgBpj7d?j4qI+w0Y6c@|S9>PI(F5^|6B&euW3
z_?Uh0oGyX%Xyj?s{9>f^?82Ozq8PYY7Gnxy5xZr5;+{)*5EQ4J;keOMbK;&uf{bom
z7?v(h^FGB<m@X9oF_R#}ExgDFzbo3?bC>MMaygB2C3}%K5-#({e=9R8hj2Q063;%$
zu*?+O(g?iwXdoHvbakCtN#+Zy4JhUy?x1<M;QCS&y<>e0>0(UR`9UqzNVHqa$H)fE
zy)=qhNMCRX7?sWLSm0g@W2{awZTL>gVP~@QGo)xrr6-X>7w$|ZZ|6@IH8~{E3iv2U
zvvdD6JNU(^Otx7}7K@13lKs|gKW{OV^u3r~1gnL{TV)0GiFecA5SAmZv}2Y>#jD_m
zrpitpM#75cML6RJ6;&LL2tr9Aa*Q%;4bzl+5#^~v|7tPn`%%}Nsx6F>#ylkEjNI{_
zk_3_7sczXDH&7g^GwQ{&eY}k6w}S!g4G`Qf;Y-a+V7-6^I9&p;8>)iqzEuGq3rrKO
zEAX5%6xPR3P8P-MTl6Xgx65RCgvI7$1mvCV${esorN@NA=Qg;ff2De0eUuAR6mu0_
z0L=(=X32f@P$SktM2)umOqOFF*HBWgj)CpAeoQ8(J&5G>Tg^Sbu)|=iM&vSTRV4KB
z2X$b4D>u;hM<y(yXomZOV5x#6!D>_)xiu?+gaoGIIeA924H5dVWMlrwtgb3Ls3K9=
zl{2QYpq!GGv!l&uubbM5LMp)I6Q-=?A06krl84@7I}#ZsCQ@canH8l`#h1A+-12ds
zB#I@V$wK~LCMbgKIr^hie08%J3f)*5O!e^)C(`oK{a4Fh{C}dcR5O)fdI-WSS}q(Z
z{K+7sA-#-p@Y1#m&Vc6?w{!gT14XXGVp)SPba~$8vYonCt57HeopKmqjgB!bVb=50
z%dt)XFd%+y0Qo3R{o{VZBsd)^2Uj%(XsDTq@=N!A4j_W`YLXElu7;L&&CSdn!P=u3
z{9*;$6r-A3{{KE%1b$U$&FcNf#mCQkSA|-aujvk_S!@XPyItqgZYUmG&$aViPy$0v
z!qD`Vx>i&dSI^aMn1GVXsRE`nd(9Cw@M!HP>@nThDO7lsD(V;4+lYaO7e93(J5%D3
z_f3`Gm)?+!=tLi-J|>;LfRV!r1MI&w5410J2WUJjnQYeu#y3WH{&E2Kw29$Bbe?w4
z*@uXCpkC>$S`K7RjG7au?fi)X#QOeV{Ev5Y%K-cM>IpsR>S)5L)t?^!diypv>8fl0
zA?P+cX{Kxc#?gnTV}|;o!E68KhmxZ))yhozk%8+Ue;-c48K!><f<0_cYp&S^fbl!Z
zPk*t`$+OjTx5{COpsOYXJ^_p@93L~@qE4vm7*r&G{w4oalh@fhReSlHFkl(ai_&K?
z@;?t{)NQi!$=d78-?x6i8QkwWv6Z2K9tMaxIRxS8!2cy>4N#>zF6)FUh6K7@23G$f
z$8;$oQP4J4qwr^k_@Y*+8PJTpr*ApIRuc&HY?4}95^!?0N-s`4R$vQ2J+lMdB<JmF
zQ2Of%3!;M){h`~hw7O7>A*VOUv`?kfSKfm4^7?(=2|9E$rQcFJuuj~vG@ja=jzCKG
z3@U}`GR<h6@JZwmX17b7^F%Jj{e$?b$tce%={F$|D)>YEupn1`-?D86uqM8OMPj=@
zrdS(M=$DdL)RzMm-(gm*6L<P5tQaGm*us>UX;3Ce2vpYDh?opTktg2KE4lvYEa_1Z
zd#XYGsTZjQKSa~g5$uuPTtrocs}v{tr#S7FfR5WVM%{?@$R|Ghm6om~EJ4pW(<mf%
z$X5taElEd#Q$u1iU;L9qj6@A*1@OVb)x5VtPNf&Ea2@zeyjJv48x6Ui^~wW#{O({g
zsEDl&-C?+g@n<T{q7z{r>iJ=*2NurxywQsF4j-_7>yq8y{jI<g#E^M1;H$R9yx+?z
zq0kyDY<vF|+kWB4cM?NH6Lem8L42Kn#?V0}@n5R9cQnn|iA3$I^<M<P(~U)+6q+&H
zwhPZ`GRpmKa=q6q_W-;iz$&M^pLlTv*npAGI@J@k5X@HC##ETY%uWAwePmS|fXpJ2
zdx*|vU4=eABf-`7L_QXN$p|wZu}(ny+q|{GC<88H@G3Gkv5LO^0!&*a`ZAaU=20ct
zG1)`+`KJtO6t@&TS~_-2g#5JQdHG?!x_^Zng{8CCj+Id1BG$EzNQxm_$a=~?E#oPv
zWe7~CD?>tfnB_sC;*5vP%#!y^(XO8Fg}vAko6cOw`Cra%0IHx9rB3b2m1ah)@_eqv
zE&W9OnzfKzL>6JE;9@68rPK}ChpPrjv2!-#$DeiVh14SpHwb69(aenn<6fg&?=4FA
zEX;+fH@ymaDp4oey2Fc2@Tf=Ft?MX8w#6w^2o-J)e=CS6q|iKUnp6vuB}{iKW(O|*
zWaBb1;&POUQBP*c2G)yG#LFkJOUb%p8*K93tflY^=~IbzV6O1jjci$Ck5hbt{0M1a
zj8h0{`Q;*CZiK+8ej#8W(pJ!+79E#+d0dI$*|AngRYX~*N-?mf1MgaE7<@E;SMINY
zq@S0JrQ9~;4p;#G_heW;8<RlkNkJjo7trqxOg8+0WUYm+4{S3-Kt6r$ngk^XTfMSx
zw3XvkI032P?0I(2?!hiPWgXQ$^5XNN*(Wa-t0MDAw>{*KhdOSoH#LsZ6o{Teh#|Z(
zoGqRQ9^QU`iZV!UzCIo%yMW*q!A%17aiiQfw!eHAo2Wb+bJ?BHLQ`s`NXOnXdzrd7
z19nb!WA56<JMj77IjN4uxl)pc2RpH(;zSDag^cnxG5PsF31kpcSHZNm(UJwEw6)b^
zEW4|0U*;lh-xGygn5}vh5oE384lI9#w$=xI$6`?alilp!XNGfuv3Jt4I`4c5kBR#i
zrbsCqdj)*?Fe{*Qx672{I?EZ_NmaG*fJ%BRF<)P~Kblc}R)noz?-pC!zc;D+27uG7
zYq>Itv^#mFLgnOq<HGROmlXGbhb#X&GM$LG><advvl?7oC#R^r*Y$<V2ZPoA-ou}t
z_v|=cfkWE#zXv>!B{hvwm8%bq1h9lI)Ii%3&__UL_!7O~v>DcJI~wwIDoJ+weK0q7
zd9+yZT#o=;nvul=lNoV3j@5dFKQg39rrVGLKRD>}oi;p7(cI`${5k)ez<V)y+2EG?
zFQL1wHFGMrIy|i)IW9#H5#es~9JoF&cy6y!>EDYXLa`4_yLL7|VfL`42{OJEhYw4V
zHZoQeD18eNz6ow)t-p-*ChOCP*{yY9{X2wCD>~?G=t9a|fD)0`NmE4D-W4D?)Wgim
z%NMFwDCs7N_O>j#<6>gvRWn+ngPlvc8c$w!J9heW_%e$JNFd8eeEB8W!YXQ;zB8@a
zKHG0o40}kKz}W~p{?qXe0GCkf_o7rIbCxActOxb@MvBPi^P61WavFI-BH@BQiKv&A
zo7KPq6c+|hYCc^Imnkf?nn5bI@<Tv!$`fS!3Xihq?{>V3bx9*?bsDJKFf3yavEj-R
z6;a1@x%_{3PZE0o+ezE$&|F#;qLmfqKAzHS+C9$j;&WsEp@qrOA4Yn7mpNyb8*!5c
z`g)&y!%z^Rwt>GIoQ(~}rEHs7v2hq3sgtQQ$w&N)oObWJV13IAco}CG&(Vn#KCz<P
zs200+eC_*ddS()Uj6VPLHhWRG_{$cldoSoCU#ts5d~8>G!;`xZf?l!C;c2*N*<L;s
ziya?C$Jy<+W&%mq13_-^@!AWdpgl9V#6;BKMY(730_a3#-q~-$Op3->zlvw^T4->U
zgUkCOqoy`qL+#=Nt9QDDMX3FIyvcJ+4^O~fC`Q<2f4eVE<rQjlO`_eLg4M^Az6Bg?
z3b&~%=7X-LVbYC4GsYRRMZoMrhldTsNh49zB}kx^wrV=mXjb|c5t=;SYwY7Ne4NS|
zTtC%e+-9UuUPz7T>n?shan4swzCP?x$K@L@5bsTgvxl>crnxYtPOZ-$glUXRZ|v`}
zQe`pfx7SRKZlkl>H6y1U>2v>Ue|8ot^$p+a!>^8FHN7auO@VAohAm8N!?k^)+wPJc
zZn-v(5%oJwY)vtg+=M89LWMWvlV{EYxGrCsy0NUhDQzFrw~m(>sQ~;-ai)W{<rO|q
z!S{va%squsq~4WOjk{6g2k6#ONbmiAqL0W)?@7KeT;0}o8}I?lWoOq-Nt8u@sQdf?
z8yj^>iyEtv#SLrp9~dcB>b&<${Qo87AHg;sdr)uKyaOBnS@i#JABrkLCFRoSJ;!w7
zlTcjpQ*X$+n*7JzYW52b)SQm#PXw{<VeOD`^Cy55Pwim^egH$8gz8C5FOuLT3$Fs|
zE`8`*-7j_{i8qyK#B~#id5d>OJls5~44P+vQrHaklX-sbcUgcL?N7o3&#BcXAClv*
zX42*R2koQ*_#ZbG5}xeh?Z&O+c^J?fsCY=30;M_q;4neu2}>%kYc56%hAcsLiMJT{
zm7LNZO&2EX%P{s}hbLyip?%G5)fsZyX7e4A!uRv%E&%<Rnn}A{*ld)zC34HxXm+}N
z&9tdVf2T7X`OdFo2DhI0cqw_Xv8^R=0<8%SO@jR&k~xds9o$9T4Ny64VsN5cC0IA^
zaZC|-(jp#hs7FLFbt!Ce@DSO*iho%Lzt+LQee8_)or;}Qp6?6{wfBy%jCCxQ+Z@=9
zw8Y>%lwh<`bA?tloa?nkFI5twK_Oy%{+^alU9FsQ{$g;<0sac}9RF@Nb>ZzhoTv%D
z!~a_z?d;x<5F+~&Zo0{LRTJfpP`RhV9Afp2b7)o-DGZ-%zTgYJ7OOt2ww&;JUuFVz
z5Xr=*;m+l0(2fV8V6zd$F9bpcuMAy8sV`U&xR_baPAj$|fjn*>;`^5obOc`qd5;+%
z!{NV>UpilJNpivsR1<*0oB)%`7cS=SB&%6j)Gh9CAzQT0oGqbQ$t(k&z2NF*fbSjQ
z?sJQ2v4J20zm=E3T312Yg#*V>&?A>lhK@7lCplV5v6Ar;-ih5q$rW4MQ8^MWegm|l
zl2K^82ZO<C+{!K{!sQ+7z;a-l7cTIO-K?li_!HEVBN0r1<#kB4nIj4^vy6Yy%je}H
zCg7WPelm={u9-{ZWx=*SleQ44H=klNvMeYN+$1x&23^tL^VJuWfyK)>$D-{T&dmFZ
z=|%vpuB!Craf*=>`VGELLj6``j+SZn<n8^!=ggt*(;NEB{Xc((Tn@q;@@haML-6~z
zNAPRi&sPt)@3mQW?e?TM9P97a(Xri{R`|h$TU7<UOnMXf|4A93d)e6LWgcJ``wdN-
z5R;XgvnYH!b=1HnVX7o3oY`I=`DablV>HIcp5E~GLM}8^AnnnXxrxl+;ylK(R;!N4
zKaI#Ch?ONY+i?e%H*zkA9FYTR5(?aY)Y=MhP=SWz0S9ZQbnNYi&+0jKB7<cK5G@DD
zIT|@G<bb@_QWxZ_{xqbzto50#7I1kQyS4uAm=08TZ$7^D1wv%iYz^-QKdZ$pdB-V@
zWZ8KyU764Le#OC7vsPhaa%_dwg^5KY(Lfc3k4fz2z4AkIQ)k${JP1i|WcH%^Fw|@h
zDh?(VHmJ$NcWQDgdO6#%>HHLCsR^(YAJ9#kl4-Ma$wH<~S+|~1(A5)8cp8r^?vMVV
zyu;PcpuPR1fgMoU`k4f)YXMnH-99d}o7FQW0V5YUfrf$m_DA4ibK>YLBRNeHw-7{%
z#NkyVev}o+-DXk}!6Inu1ci(S{7}Ewr3G0I&)LA}d!7usjiq5|MIekf7#%RyzrH)o
zLKIi@L3K2gFnF01?EfE7m@i4l2`pllw%jH1CiAU>&eS{9s}{-~U@HqB@cr1`$w!;0
zoBfXBrD6U?7SPh8*+zmItL+AkBK4h1!;YhUI@`6hA7tpvHfrNb^eJya)}JO!`U%IV
zSDdK6)&ZNz^WE!#v#}DY(MOadqX!%o0W;n$jUu9}2bMb<p!lG2bS2TCav%2J3$Zt-
z*o$nr_jUGHu{4=(+{pn6_`wUHpFKJIMG#z&M)6$JfoK!R_qgQ<j!Z+mY&I#*%Gc-*
zE(ww$2r_?&EnvSDo0dUom|6-#6r0E@=|*j!z6Day<K9<nKfZmAMAo^hfs!$us&45D
z;2h*URM0!zES^|?T_mJu%o5p_^4H+rkOW3Osondm1i<a~(@!A%80$#s9d9zAt4|cI
zM)L@eQ^eXqsxs#yAfBd!xmDGdOB?`=rL7WYM%_2)0(<|zGarh*&W8#<DA_zhL)bd8
zFhk)X>+1v(XY55M2Xy9|)&M@^Z}_q@;u%eB_SFvc{`zoNl9RCluq<w*I&0zL*_0uJ
zUUmiLHPU03+G@&Ge)TmJP*ImjV%{L3mKL8g+V&u@Yf~`~mi7Jo^S(N*uzaGv*N3>i
zz1!x-@VGGERx;K7tL4XMJ=2*rd-GpHsHhrtm80mA!HfEakvX>B8oI)W9PJ#QM`qLr
zy1I!=mYBkBJVW@gw0pM-8QxbC^TV|D_02&cJ*WnQby7dl!wmV)o`svxbEnPO)*+wH
zKkhg8@IzAd6XN;!1On^udweW7`I~}`pFLUEu;7V<m?6_7%bLc|%VpiDH|drIA`rpT
zSps)#kPbB2ZI5{@x~k!i{B$h)kk1`@IqPfeh0C2fi*$=E+<MZIonxE@DdkQ6;Sr+e
z;J^Su+H&A=$&6iH1k;ryo|e3ch5d9*Uko<-F~><rMFFyX4Y^4p1R$#E*_+9asI#2P
z6R89(KoB_%=S%AN-bVnhSX}bu=H}!NvqHK;_CFu(&d8~(8$2!o>FEwA3%WN2L(-~I
z8$0un!%n{9R!UpNkQC`v+5aX(W1h4z3k6JcV<94$PBMkW1qeu<ZAOLMG9qW|sY(Z8
zbRrxManZwt+vqRz1;6cADjd*hOAciVl;^4oP4A552(9wfDE$;7p|Vp{b|x<A9D*Zn
zC9^K;WJ-u^U2{1M8)Id(3{uE&lcRNe&Ua`;S_@qE7|RyWG1A=|;`92Qe^%&L|NSHr
zcNB}<O37xBsx@~!q&^>J<~JRP)}`K6LyO2yTRx8scd5>!h!D#g&%Gv@A}aO1W7dT$
z)ygQ+v~jt4JK~&t4X{+<@jEfGg@K{reKJalui@P6YSPk&=JY@8QmjNN{H_Ij<Qf8K
zX>SIt+nm~I_vWO79ts@qc{Yz2KG>1Uc?6CYSIVP-l56kvu%*kO43%@<$|*}ctQ`kV
zQHfeLajF@P!NO2Juc4l`%1Y>Kw-(e0oAkd^{@2)j4eYAl87=VK(DDA4G<YiU|8Vqs
zd|4ejXcGM!^Y)pj^q(U#?o&f3AWB~7eS*)3jqkyPn6qx5kps+bj9BUI9l>))3#CKi
zRXE(tuf2d|HF6=aiv0f`@~@M7QrK7@)amUfvC40O6eo*B|BKLSDs<*7d_>)wqJIbi
znDx)vol6zu9}oiV^QGcd5R<81X}~Rj@1sxRknN}`7@{hx_m?cjPCsZoP}LeBnfDR2
zE$Jp8+&<7hj{r|M&H<NEkFk1ME_YDye-~Ka-3dPo(cP{7zVA-Y=5eN?X_1MIP0XY}
zHi?mul({AeYfZNLSDs07=El73h}2Y3ZdW*wzWPdFu9g-Q`U8F&Ov#f4C(+moVhitO
zN4IKa_Yxtau8><RE0wve?&vC$Kbdc~eI%NRzmk4V+bI9+jm}bLf#u%N2sw)>16iB|
z6(#}Yqum;uw<XCsGcXkl`JcEqeSYKblS2XTMv#7&wxm-7@+p!Uu`0#j`~bmClp&lX
zC~U!&OrJdb`ogP%40crvshr%*D8lRUB0N=}NC-*ChyQb7!}lfh_V8>;CFKu}vQMhO
z>H@?w3~1U~Tz@<@>lPV0*Fi#$KXKY&t-LC}n{$h~R)75E({sm%OXr4-!C+Wr1OE7n
z3CW#{KJpx1TQM7px00%Q?zWKyLKQ6R^G(=RQ~h$vf!0mxoeGct;|lasp#Y7<?5cly
z8Hh?qIygRXi3*z;(fPsI$OD(?0}HhP+=WY<^P?^<G$z-Va>&^X-_t-|GQftA&rjGS
zW7?tzg3m1U_jZ*+({gC<dUyqC+c(b-`*R)i;3Td+a{|JeT^oCmqic>nOij#6C+b=B
zVbK7C4&OeDC{jYa^>ICoS>*KJU=941;9H20TDkX{#5lNa!t`JSbp8~zmZQq3Cpf<-
zjOr7t>ik0D!!p3bKY)@F=*-N10z>ctto47A!>|?_S?GZ2g>dbCZt$4awSk_fZG|#K
z7bJ4mrCF<|r<lY|lgG3Ic>Az|LF%8i)>Gh@V`O5cKvsKz<l&e<V`LXjzg><k$z_Fu
zmM{q3^kUDoOf#mn{r}NB4$JcbXlJ)piK45EwNlEK`q!VZis{hX-<l&}=Uj4Oi>L0d
zxqgMS%2A!%1B-Ft+yS)ze_>Li0OepN(J7?B9sh_i3OG*Jlhdrsu9j$W6XN8?MkFT-
z5t0$1(Xh1nTO$wYE#*x1QieAC2rntmLk=8mg?K%S^+&_~c2hPP0#5zctU8V2hZk0E
zTsj(|4rR&e6Q_)q!I2~{&`Z7v%MC<pi$pT{{(f)EA%7y&OzU#&1N}4!;mW&>IX&KI
z0tg;CPW4)PXeS{*RwnO2O;vGnm)d7eXI`{^fUaqD8b$SHa%=<|$US$oOS>RrdZrUI
zqEqww$I&>Do(7y_yf@KBYUNIy1mAihjqKH9<#;DcA^hFvFO};AZ-Y@=TUdUXdTe3~
zNBc@aaXwiVyOtRyFm|b9dK2w{_<~WvLB;|~#4G9lxmH`5ksa_WAVxfrJfqvh7u)-d
zTzru5|7wLc=66}c$Vud)R^^Xozq*Djjre$P#bqSOS;rc!qdK_EKE%(73Eoe_s!60Y
z@OwfcBUyP>?TX7*%$mB`DtY$)>uTLzk&O=S_x`V|1p*mVTSd`S4*uH4!D);=M9@J%
zASD4^brIrM!0XskOf!t5@imJp)dW}5YIMg}4a7N2d{^WAhzK#i)(fO)#DKrA30C|5
z72Qo#f4k;H(20VguX3otB9O6KOH~i_dtR}fLo_Bh!(1mUcl4*lWup4)2y4Ex9c85L
zuyr+A4zQjsD=&XX1)bY?h{kzP3T@GSV8Dh}5l69Mbu1zMiH}!8)|7nNd%dXIv=WtT
z@6^U#<R0fFA=m6Ap6KJ~5a@1Bx>z)J;M@DA+JBN)F~#xm@qs^gM;`Mh{PSB~UIkw&
z=mWoA<pr8C#A9N^Dtrw@#e*6wn~2`YNszP%pIj&G%dOD9!n^wy#w4N>e@*`tYt$%i
z?f`4;L~?L7ZaX1EgwMpqyl7o-g;(Pd(v1d-EgX^3Lwok6s6vOwvoJrcI?=N;K3@H!
zHcLBhMEBRA@lA}&tuZn|>4z_i=@Z`K9uAJEOM=tC)X|?9Pu5F^=$q|Xt)-lB4Zpn#
zj5p~$N8UsGMQ2uy$F;|@emNuGi;9X7X=*g&;_ymz4HGqT-v9VSDpP{HEwDCb@bdc<
zgVQP-6#gs1)qZRbe9hdzBnCzZI?LN4swd5lbOF|cIr&iJY;1Xi?5w-eST`nHk;^dh
z1>3S}RUmSkpeqOo_l9~Vlce2eM6Xjug^R;!GV(A<cdU&6ZOg}P8)&HeYJ&sIhxdR)
z6nNv1RiCmdFU5Cd(S^k+I&AADL5%?Ng+;LvqtaGg+puD}s<h10+#1VB;TGE;74ajw
zwzK6q6@h7|RE}A->r5@&OUfF&>E$w2mAaMLrO`~hGbP-SKeh`-=5?8Oarij#XTD&!
z7%zM+S2v`VF22{syxzJB^!lCt@b~``SbwhRZuHOfM@{rEV>G}+$&|o+LYfu#t3l+3
zT5)|+M1l2%Kk}Y@p2t*bQ_cleH1Y}?K`oA?R7G@%%l0Z>MGOE#F;7I7^ebE}hEB{f
z59-hVizPr)YvSFN{Zz3=5veT1Ar1ZKn7$Z)dnvouhJRSSUMZ$7mn*Y#R-{#qwjtU1
zf^J8bS3$k@QK9VP*oRCyE=`mgX&zpx?2<sn13hF*#bth_9ukF2U&{(o#h>mTDhiW}
zf-2+&do(rcR*I{9Dm5CXR<@ZXma(YK&{gV%uF?+4nMGw@36!5y)~=D=QsyNpdnox!
zK}1fz^wz%36L1E2+<uV<m_Z|^y0Cr)ufRdJU5oySfVpf6cn$w!b{^RjzFi|$|52L;
zru|BT>H-X5bi5P!qoY}<2ym^pd7ww^e^3CLSx`~@KYczah^{2Hyu5Pd4YExOrGV@L
z@9@GF%m3GmLRoO3ZS?r;Bq!qso%+L^<8v+w7_oG~@Y;r?U%?Rhwc%rV29JhJA?WBD
z;Cz#Nqy{8^<=dGYBv?nt-ByVRef&lTs7j>bQs;vOo%gH)|Fvk2E`oZ|^lG96tr?G{
zZ4aTQT{GCb%j^5_kQyHQnt;Sq`fnUy-eHT~$CyB9Z#g3Qf4{W~I6_7r%(v-(1ugVy
z)l)22?o0|YNCQ3}5IOL>lp*JqnI*Q8QsohuD$bQjT6mKCu2;-W&%tqHJ~FEt6}!C5
zE>}HBn!h4+>gIT0c|oW13>_P^{6V*_rJMs-#Z7<z8u1qczt6F3M&!?}0~kn7mt$Q{
z29DaJ$KY0&z=~ctn_VfSagH+yDPyx$l-`W4`spa`W5ltf3i|(uI?JFo8n9g_Sa2`y
zUfdmuLvdQ%8l2+p?k>gM-2#Q;G&sc_3KT8w#r@0sopa{Q<S&yjyPG`w?0sLClH<Mv
z-XeyR(?_O23suIB8jyPaT<DJ@jV5yh$mO4S)sXmRz3}3{!p#fTxq>!4`ZKAk5w}NQ
zOB^{Dn5NbFL;3{V5d`?E=SZg&3#j2U+wv!KG$WgoaX^M!FHeF2-C?1yPGZ#aU;a_}
z+D0cv_3I*Dqp*Mw!kiDRPQMYOkR5zObflD55u@|4mEm=RqABGLuD~VBPuV_~Uv-u*
zpO=N_3FDlCZnP^kvX*7;sO2c_1-ewBzazWJjJpR>&3`&b=u~A(*JJ=P2#pfI@e=zW
z>+?D4PiNChIoN^hYhX{U(*N5r0-hG(l;@dbR7_}<*F1}9T7k3Cu%^7Lv%tKkwEaig
zYl4mvF?P6sEk^Z}WW*Y+C9aj4AhmmEUM;uY;oiv3nFd#GX$KFqXEyXo$zr6-uXuiT
zYg7R&N#1?&Jzr3|2iYrGz6Pfx<CwodTQFXu{65FR2V+)Rr}nSd5*{h7nzSxwtM&e4
z4{|SK1P}J^kN7!(u5w#VO09^}9SpqVvbuZdkvfMOXT~tycTIB*4uhNL3Fr*PgGn!O
zMVH&7kKoVFje|eINiWP9D0n>s@>v=R-}7KSIV_d5Hc|dSfKb3Ky2v|fzH{5!UU|pV
zplwzW$#vFUx#^UH$qB>y5v;PyS||$b9k0@`w4mJjsQS&0kvlAosM-$pzvN)&@P%wg
zVmbe_Bu0>Rce?nH5R&1z`Qslu|0>buW1f`ZY8QIL=g67l+=Pl~REOvV*=`A&Ga|`K
zC9^yg0PFMs#$a?jQ(Rq8%^NVP8pURhK_S+$S36M0+%j?Jb<xSN{d0`fFsA8LJ1Va#
zKv`EDptjLpseBsLkS4Hz5|(X1%~6B_vw%u_{6MvmCU3M4<TcI{4m~A2h8?*7fBe?y
zr0g|#K)M#jJaqpX%-YRb4y+3^__%}XgvMGT1?#)Su?iH?zG9Bok%1le0rDV$>zkU(
z=%)aRk#V_S*!x2!jYVAic^?Z*{JFjY8Ga@9?;cR}G|=x6ROUtYHi$jQWVlpE#&0%y
z$}+*8U^P0uO2w&n|A%qIYqTep`D5<xHgl7V$giNi6`ZEzrPuv{c0f{DFTv=L)v~wO
zKlq!p-h+SHwF)<82(xR1sBe*6t<gJ><_BVfJZzZq`o@jyEz1WYLNoP17Ypz8K)k+=
zGjWu@b2tuT;pk}mvw+SD@%A7rW@-S4)Gu9TWnhT?a9VmaI?GNLurcl_x4j5XNfVkB
zJC>CH#O)xfgyU|_(}WB+j%#)mT*u`}&4P8H{0o}wn>W(t=E9AnoMaRMdtO!1fz<-w
z@sR)M!h`y&57k2t>AhZhPmw1zm6DR-d;|oB$FeKRiqD!jvpeoVspE1Kgfi!ghF68d
zpVS`uwzw9708~$V{%x}@D><Y)AFlzbh{DC)VWXCO)YhI19k5GG`~O{HanbJ75q4cS
z#zs-ne?AG;b;USWp++vT%YPo9APye4!;j~a$3u2t&RuQ8q(u-~4QD69sZn=2hjYOz
zcHa96N(k#H%%bAyKKqDPYXB&~@H|k`+PW=Q=Y<rN+Nn_CF~K&mLAHeKG&J7Wipi*$
zSK|Hx(3RjmQbz2Y3aEM{T!FAd1Qj2uj+q4!t<tQ;D<c`$7mn-zR1|S(Wvs5Wz~tkE
zvO1aJBJc=5)|X^lJX8e1HuPDKUfIX-O6TW=2YXO6J}{BSDu*J6F>A_;$(x=r0mq;7
z0ILBl5%A+s|0_CZCh4oykD4Nek)gch$dts+>Ez6?94`1u-v_vgvlfZ<(lE~hNxSCT
zX+RunLnw}YWgv0%$X{wq$YPj`s2W*V80*hN02=3Ic(ESh$8OyHe*bC7B<}C1A#JL%
zcYc(F1;~(J>jZ4Oir0Isy|!NwvP<{?$I2|S7mL<WD24k=welQkEzW=9O*&eASC=+>
zS%g5kIhf#$j_V0vCfV*FV(Bx=JL}s(OlVmA?!nn<0UlT}9AJScbnp(j=oJ}2dQvNA
zW<(pg7!?KPA%r6NsAuQIP`|I^37Y9C>f!GZr?H03utf=|yqa3LfNBjRV>yVA0F-DG
z$p={+CccPJC7W+stSG<e^-FPmoEF|1=-uvkhD*4j+JD|p1b?*%jq3_9mRnhy09}cB
zh{4ZpqpwBTlySJCzuMM+ljU`13q3s*9E9y%)ZISe=Jk_sy+8FsvXtG&PWKT6zpO`+
zrLSf@_On@|sh%$bsPlZw#@1BHT$;KZPFA9JSI=nao_RlPOj-mxp)5zaitrcZKtDe`
zB8n~=%ewk7*Rs|+pBuA!kgLIw>Q@UhQ{aYZvIK_(5L!n?OBvpBny0C>T{Ne`A05PC
ziz+7-R#c*RXfFzSu}6D?^7R|TM7+BYAt9)_9UBNJdWJnLs*;LhJS^!hXtmeB@N~0R
zw=d(F$htLEq3Y1&`i~M2pMZZvtS8SJU&{M}gWR!a&P!Oju`?(<r42>GF7i;YHEVDh
z-C@k}Db-hzsxBW~aA%hv*wzBewy88<j1euKwc&Q$Qc(Z*_Cb~AwN@oH6X}r87c7LZ
zJZVSzY5aotRgSQO_gb_(+wWN?PA-_MvBc<^>ArMfqVZU*b>HLfpLuK!J!-AN9Z#G=
z)A0sjvysxQ03w*^v`;PY@$>WM)GO$9FY+y>;N{xN&1grRISraQgu8RR)89-M8dLjy
zL?uA*sR_;|Btu_F>PcR(i&J;%{1|2xdjI-YBru5ap^i*{(|!7Z0mx8vYEm5wkl*~2
zh)Wb{{T38;J10CQuePOF1{cqPWp;SxtA1m?`O|+-%-L{+x{M@QQfwOJJcRgs_jY51
zaFQ67eXC=H5_(r8K*ZV>@uibIRDWH`VkD+S*uYGc%4zQ1bp_dQ;<z?W5K1$52x%x`
z9go-LGeWmKsU1Y1CpT0{c3%UBspaC+*ho`Jg=d-qtUHrUbU=1Owzd6tbl2`YY8h^V
ziHv7}Ot2X?0?&0}G0IMx;=bGO?OjKlOwgqK)jJu!DX(tEX**{<3!nV)Sonj{`C<5d
zkHhusP{8u4;N_uaCYe3?;d@mclHp<Z5}log-p~X3q*K9svE42%>O4}hk06N9oIo|2
zvmHJmc|bfl)~JML$mQFE)$>K<2j~ZOw@?zZXMKBR@j*)e{lw%?90Q2QZv)je-s-<d
zFYW@L{Gb1P@yC+?@>iOTwa@c)_yY}}7+%b}9B<>flT1*->&x9`==mF)wozR9QJGiI
z64u+3V_?wF$5%B@MW@cwe<+J$6%~+V0^y~f;O2Ygfamka`=_5zp7U#Z3EtvXjiZkn
zmw6u^3Y@MvBe!O2pb&(Dm*13ylC0sYZ&y~8hfMvH&z>RYZTN2jz4x7guVT-ezJUoJ
z9w-A720~<>8v>u-zaD}DV@KtWFTZ$nQqu*!{81C{ReL)<zs&fMD_;<-ewCMmNZc|`
z1QbZQAl!Jtd;WdbqxM#jd_Q*ng3<Gqu^|oA3$0$4dhWk_!~F2vd2Z4;hFLj?zz3U&
zMLx}h;&u|$?d2Z)g9k92mTtsF(dEvT^4;<Q<GhKRH1;A7SDH;}e+BvlC0Az|h)t_K
zmG{GXpeTm`eyhiFxZ3wFBH}1QYHuSYg5U?9+$rnbrE0nw<%J8}!0TA5HIITs6`a9k
zlLtz{?0JPvoD#v-up{DLur11uN8L@ew|fy?Z()Kmos2%-1B7a3)T;b9)jQUr-M3-`
zN{KH<)E!R<ZRa(KbsS1n6dv_&ge7IIm(s@=^McVD#EqyClKVkJOZVqKJ?8H`wnR1_
z7@Np)F7tjGKwIB7MLx)A=}`noO0b+^QymAfJYx<Oa$GVIcu^EFF4;Zz-VwM8E{Lr~
zJ)D7rps&50WOn8^^k_d5mv-&l&OU5=7wfE2{k3FfM_?UzUH;Ve{PYGb3B%WvD;T`n
ze=w^QgbTd?@J7;!nK!_sXDf_$l2iU)4fMYa@DdUP<-eOKN|@`S?7uss^Q@jKfUQ^K
zyMl<^UBIgKKRm<9S%96USi)ro)AOa3QaQl#<};a!U67AVLQDuQulS!ZN_J!5;)0+y
zVf6WP4Lox_N2u)d`&0t+t@Ze0w=o!*Y6w(lT_<DZ$#M30VA9_Y2d9fi{`4jY4LE9s
zC&E_+)^5FfeKP&v;2q9-?@MO%HStEEN!={~rYGwU?0vgRq1<77yKcR2Ulsp*<{A7}
zq<h^X6cTPM&j)xS{2ZdSfgbcS@l1tTJB_#@Z>j>ydlGR|1yZmJNHPIWy58W(qF6#%
zfG5sUxG}f|TQenu<_OoOmDH4kclD**2x8uZy^0{nU3w<Qo)UJ}@v`B!mR~cAoZS0d
z-b={(M-i5%a|f<Kx$23-zhj<2Wx49{^E{NskJj-4ys#&05i{!I&kMj>mwUFL8=Ztg
z;V(N-E^;u2p1<`7!Nu7?D?n~Z7keYBFN{Icd<O5p7p_*c$KD|dcGFs?vcVga*Yc=l
z*KQ!S#2W%*xKqEL4u9zTFzH!z%JocbR1<zF`uyPe#@LiS&}ROIR@<2mx{;s_xM&TG
zrF?n8+6=rP{xeBc8*nrAy#9KT_=b)`e@&i%dU^i#^mM;O`N|f8)lCKXbz#>k@VZ6$
zN*s8(v=OP!5L&v4`FfxDGZyjj_P*r9qh}n!1~k#`hf`4626{i-#$5Ay(A(|CD?;QK
zeACh+l*sr`d{Kc<la$5M%t%)f17Pyk1FWC$dRz;4KVOmJ-HGoV1D`9RCZdNaUnF3y
zt-V+M=h?3uk12_plmXW$ug4z_gaewQYP$pAc7ARKzRjs^nm@dMW@jvBFh%QmTKXU%
zf9U$WyYUJLe6k7*u3fQ2*Ob|6czry-*r9x(73abV)t^;`Jc_{+d1f=cn}h`?U{`t~
zs#X`7Yspk?_VOadxt1EmQfg5FjXjT!4=g+3+D3$<yzq;cHpzRN40W^uaXCpMoO)$S
zV(?$$G{0-2)q3PPrn#ki73WGtKDxQ3cZ4-%j^8(L=Cgl|Tf@Xq{5(xYa;po|Rdg?S
zO^^X)shQmX1`_99Zqb4I1QAqcUDbl+81f{?29vx9Oe+>{14?|S9j4$i!z3ZWld|sL
zgUp5OVaVrNvt4UFrQym1Co|B<;R;b3-3eJsP-!#bv0BE(>8lMaLD4shY3MT_zIcyc
zYLTcOz|4bT`XaQT>&ryk-gx5$2?XU2jR`?BX(Ka_EG0+L!QB>af#^{dHa$Hu8^I!;
zoYswxkMDmHfV<0VkgFW_HhY5x*RBvX<-h!rQHQ~-VGnlV;fSIc`A#Xx=`2;yQO6d!
zM4jtwzQy=bH_@k}o&_Vfd~>W}?845Pi)6r%JeI=}CY<`Of4{`VUT`g8UVs=e*i2R~
zdLjlQCq39tpgHL#xDqWLtpXm%9G#xtgG$o6o)UMLyl8FK4t{&5eX>dAM7|mLHVkYO
zru&0nM9mlSqA8YUF}IyUKSH9kH&FELcE)>9eN68JTTiPwk$FdzjHukU^uH><_@80H
zKV#=5c%aaD#qyA>xA%|e<y6<~jqgAGKy2$@Ss^j$EGRs@QK|jX4%FT&7j$k&r79V+
zq4ZcI7;F6#5z^BTb_D|4f5lLWOuG)l`!57?@jOki=JQ8z#}6j%@oKOSrqGPUAcOb#
z=V`__li03PTosO{w_+3K-PRY8Ac8>g*V*J8F0)Go)=6{~6n^X*upkA21zBt@`uA~2
z9nQno`@E6=cn~gVB$_yyfzUp?;%hT&y!<73h6`!**id41cMEGtBVRm?3Cmsi?mrgd
zMNY8TOJ+*1cHY}Jj!I3vwH#QJU&sSzWdLH{2@)gx$2mO>@A@Q>xl+IVxzZXqwD-KS
zSDL7`9>B@p+#7ysVB%mNm+{`EX)hJo$!WVFZ-162iC_`jYjxG=0rQlft%a3U@r_UT
zQ`a4Y89*6y4Rken&=5p6?R1%dNh%X?ZQkdyTc@O6d7`izl_!TEuC4d$*Pl*$RsfQN
zoMaP+zBF|ok`#jA_#fIdx)+^p*JRVz@uArp_|TzQ%pckb3QELsUk;fJ?aA8-t){Dy
z;Yh)?j;M^bB1A+TB{lf4(NTI%00Vp;2VZi!{cNYt4gP9$$hfxOk{y&GhfvqRiK#3L
zc|WSi7!<_-ElXp^JZVLOL}YeCnwkdt2IV*fTBJa|QvVeRc^6Gjt9UVEAD>}tJ3bl0
zIMYlD26Usl3*wAAa<Q$wZD5M*6?Hi%*PFqXOF0Qg)4hm?1@je1E%;Eo%cg4sEU$b&
z&?~~XrpOZLgp|b>v}2X-mu~Sj1=$`0HFfXD)>+H2ZWs9Sf1y;u5a1s-weiOsd4kMh
zGlan``!?4bE_8weXEZg^5yKq4$deH|GW~A!$aDUpy$80nsI+47BMQ5`uC2WjloG_B
z3^nLXs$U0o#?&^!ZGdh!3V{*{ChMPFm4HsiMcSJ+$+kA{{<Kln=Q4351DOjwoZh<9
zLjofBWmQie2nv_d*{oF-AEsU?veKfglxCHLq#~L_USN=H0nB9W*b+_(D$LJk{2MQ!
zmW+IgIDx#HrMO54SsW*}W3V#Fp-;l@LNF(H{BgCJo=0Fz25#rmg*i-|n!>{y5f#yf
zZ~|Sh{-IW>hD=FvfSSwF%$~x1*4;BbPszSj2JZt(gmp4W`}58wCVr!7*Mp{WIHV=*
z@Ej--p^S3*=7YfWgqjgt&7GUA38o2Z7G)5`(fn}{5U2DX4|lm17D4GI@uJuRz$~n=
zqo!qc`imE{fZykzqnEqA9MyLw9#pK^LwWi1)@E5%_ZqG#O?XcJ2Mc*i^xi5|)d-K;
z8c(@DDS#UGfuha@GBCYof*N2v+q>7a&>vZaIC|Ne8l%{QUVHV>-+}6C?B#f7UDo}s
z@<D;@-!_?@a9Z4Jy0aZ*X=fh{Fw@TO%qJ%q`}Obr$k5_<dIU(0S2CA!`m%cn@4=Xv
zMAEd?G+M(&%|R9EVA_qbb@}bY!pIkRNE7o(k49n`o`{B|I>{lNaLhmw->vE4kPf!(
z79Tt~TSG90hMktd6@OM3D7Dxl;X2Mj*6}H<p7~wZevS)g-4CaIfI;(e%2DZYm3kpt
zL$W6|H`c(7d3a+-ZJiV&@W<f#i+xZs;*TdATF-UxrMZX0YO<FNmdh3F|9x7sM+TQI
zI~OIuvmVdBr_<=KN7Rif5<@x^{;T<e{j(&&I-6n7=lEOGrY`i{2f^4MleW}M8noYf
z;K`vq?f(lj=~)1nefn0$>$_n%>qhO<w=e;3Y{EE$?~Xz|PsJU?HvJ`B1839G48>EJ
zqWO&b98<Z&1u&_425G(yX8Mp`o1;I%9Mkv=UPEWGgJo7o)hsW$kGl;w_x3PF&L_y&
zTe#Fr&Y>OO?PiwPgQK(9){Mj;)?0q!GHDYWx%($lWOf;SeQN~yXC}HQ5MVz!Zf5q1
z6B;bgP_}_lZ;v8%e<m;ZlL5P){S4C5G%&Q&UK!wlF*O_c(8)%~!((judv91BTaYb&
z;%g2o_e*$X(RmfkKb(^j!$t-_9*;kj;ay*&{$=(q%wQNynJ4eAgci0WyTaMkq)<ny
zZq;3R<@Ev<BZJb^sNUNKM@O@*<*pUpRf$izvQ7hYZs`gy*4dU<J9=YS*(LQvwDVZ^
z00tIzApsrvu47X7ClfE|uj0NMZg=dapDSSGACu%pF(XR<j9XQ&=jsBHsO3!k{=r_v
zn%jYY>;rsfs%`<E%boUHMp40NwO)j#{&q;?<ELBZ_KBsXCe4g#{qy5E?AOG8{8JGH
zOMMQAAef$@M!gu;MCa!UT3FOBDla~<{dCAW(_f;!t2{UdQ{NcfVy3C;Y^5q@qFTPE
zTo}~fozTR2d7DzltY%1iK^&c}OnUE{&aJM+X>|B`)Jid@T(f>uwC<B7vuDS*iq!s8
zUZv>D@x`MFR{HTzqB^pRhB4Bzdv1d^slE82iu!jhO)sbLC(;9Cth(rg@JPO%ziLT;
zd@<l4P0O!S({sD_lYhuUq_6Pz`}nlV?5kn4EL=oz-CX7Exf$oGu2+XQoJrJ0nhZk)
zNrvc+6OtmuwoiX|{}>z6v#hPTYoqyb8yiLiEqfed;<yqwmz=N7m#j7zCF2|UL|P_l
zHxSPy%uqoe`{&zqz#eC>C>G-t<dmVK0<#0FIt4?3KJP+?teAUTn56JF0rnQ2X0;S&
z$+~J66{q#M)T6Wdyo&acAAJNo8B8Y0q?#af%_j|IPZd6yc*6iaXXRRBSRyA#0Lt26
zGr>h{k5+x~IMQc2Ny-XytuQ(C?+zPT`=`YG9XG+`*>Y2p3Bj(BSKYO^7Mbgq;famc
z(}L+b_u6`48Cy)t=thmRmi$ONPB2QaBCKw?NUzzDbjwqL!BzL&;)~GkjF7XR86Ny{
zV&Jpc>`#B`>xM72flm@IEOUuHz(>O8d-*SsuMaf~Kb4~v-?pdTu5&OTiPU>Vx~UqW
z+vEE2*4;H)4<5#FON1RWc+gC`32yxIg(Mq3#k#Ghc0ReyM}~o5cYF`pI~9z7nYcFA
z-QnkfjsiaAD0dGZxj1@%S8JAtcjNI9i}`iDgSEc?+aaXXqiHOK-`AZ>Jr5nh1BN=W
zTA<l=j>u3;h5vv))_|P%<k0^>*jcd1Agt;|03QFA9dqY{rLis)8RwJHg8=>8d@c>-
zpDxQL1+(4b0!ogHn$Qi$FSlW|W(*_wx<|I4#yd4iI8K761^Lx42%M7bk0rp`8td)6
zWms=Z-u+smTlpLfk|4?_?5YL(^#{+wQd|&6F=%G%=86A#$>aWhvTFQ>;qcx!P8L)U
zt&NqSqhI}hL=^v3%O$7RvlD+H!!f{bZ&hu4alDX^+NRYwZ#mRhKL8o}7ZyT-2n4HT
zG|kb*9py$nJ&wSZm=i;J)|co((PO@l8|7ahVBEw_S}xyXI{;5J!Nhx+{5k+XsOl1Y
zZsN9gv;FThy%n&ig`COyh@Nh#%}IMIp8jSGVCf(a?wtB>(e-~nFCT0p`$Cfef4(a>
zrJ45)j*t)wKVx(TM(ZdxyZX9X@H#WxmLhj~%+%K5RZ^%hdZl!<igU6Z5w)L&y>BD8
zjjf|)@^sinysz2ZvNJm2)pma_?`uqLm?wsvvo;!9lvr;Zorxw7ao)h=EvN4tv=R$5
zs%1^`dm_o>AWBQ?PfEp?aO|N_HDrmX{TQWA=t<U-83u#}|6sNW<6NPL=`_a1`S~39
z+L}U43b*w<Mzi}$vUIuFEfNo0czd(uPG+(*AnA-eb|=Ic&2ttzW2q>VmHlfC>XU~t
zv?U7RzF{Siwt|QHef7ZhLoDP@hCzl8m(}%V;0%uoTL7-T)p2{UrDoZ;9*i_X=Wa?S
z{z#%)PfEpl99)qCnl$<q5tV>av#WcymoS{z<h1EV-N6%c$!a_VIu~p4X6b?#*tyQe
zCd&R@T=s3!`J6cS^d&i;nRXLsQj=)XQX`^2#%Op1W1qhxjvdeC;$<}7`FG>iw&F{5
z8XpHJm)lN57X1CRwKgd>EdY_w-(xz$W!{opYI!>#J^R}@6^K`VwvsqK{n@-IxOC{W
zTYl@b6{XJntGgxI=J9rT|1eV^mtNe%%d%H(W>8sQbRjk}vs@$ZHJp!b>ox+^j$C?X
zcyzWSHjkqY-rd>#!o_8H@VoZ`O_ICiFUaB?WsSfeTB2$VzkMJ@PZIXDrb3$&RzgDX
zNK~4$*TN7#bodvZfoGS5{11}hkk-w;^^}Vnv8X-e7EJI@AheKVI9SEjT1a^Rl4B7j
zC_NdGG_|;cH3)CO95L1UJ=ox*U<dqEfi6;TbFEJRff)CU0f5w2IV2-eq)YUV(`Fw$
zq^KCiI=4%WuM@91?D`MqbEotjxR`r^PeHM+Yi`{e>d@I!=<8T1kMsmlvP;FU{dX<p
z`^=W>r3*h26fPdgxn>xdNBDV0i=&r-(h7a9{e(c+Ik9ipSD=`imO{RPzAx|(pLod7
zbq8oQd#ibmq)>h4GUuQ^Wpi=S!kT)duIWpZ@o0gMhsYUS4A<hP$Zi4VndEDHs{($!
zkAM$ot`zFs0|Ob#?``hw;HI_NBrUE#=LW9d5I}`L7d!LC1StF49K4LCCC+Yj{uT81
zwh>+Hf!ozQO%bapqJnO0bfR3VBYu>{&^}R=dCJjYqG1vhbHSEB<1e~>Fw(RnpmCC>
zn-Ad%v-h50YtXXHzb=C}=3lpFEwc3{kAG<;IS|L(wv5x<u@}Suv%-FE{RK4L*lrWH
ztl7U&?JT;lsi}iQ>(~xjqeiXNAbx7X9pC1hUdoVF8ot2XFdj@J+cioJ{X<vo*n8Th
ztI=+}yRnT6{lE}miE|#bkxI6Fdsw-)EfN9lv$UIN`iW{t2%vLh7VDodVs6*u3@(#`
zjhw`Rzt06gDm^c}OF!QB7*0b4tmj}JBn+o=`h7{zzZK-&>aaQVJwRc!6dC0wJXWW~
zytzV>|30y*oLkZ65FfsI3gSlso!yds1!aoxN;n=?PJ_>8K1ml5oh3ZI9q3}RW)O(}
zFEP>-)dJ{T1}cK?a#0<Tbu>rl+nzuQEOE~UT~C3HO|*Teq>OIr`Pe>8xCE7#)~h7u
z4AqUlSKuB#N|<Rfc;wg50PXmpL&HuloBY_amS=&HNCPj~?z^1AIV4=13RKx?^6RU?
zCLgirJ_!w>AfK|;saFjhEMqr10_;^Vh=|L(5ZIaIrx$b+XVPUv-&+Tgf~8Fr229=N
zmn8W3kr$%K{;=5}*juim_TZx;sAG*CZ0&PR_KeVhKXS33%Gmm|O*H^BvFqH^5I(#|
zkX3W~_mvrx{Vm_Yz_#Yzn+Q6O3e>k@(Qq>Ztyq})P}L76*`b1I)21$~<MJ!hP|@+%
z`%}7nLbNC&I*+`B_;rZjGh>eItC)-VGfBP!fomUJi*M^QR)#6A7YK?PT2PoV8`$IA
zv}Z!CfoaDy;1-GL#h}|5QFIh{Ku#DEWnV1V{46lSW7bL-gUJ<U?F#pYQC54l0^U)g
zan;z+B>grgUomss+TNkTFV`uetD*P@GpxIB3>*D^*KH&IDe|}}l=E)+WwDc!V5IBC
zjvdJsweixLH>NV7cwG28`KEbvJ+AYomEm%%pN%@mzyNaSMNoX_D8WXak$mH3881-k
zM&3KLzNQk8yefxZrcGO*skXSS90dHGk?5k($Ub1fkWWNo%RVv$_k?LQ+^)isESEmo
zO}=$NtHky?PVI%{F!+*_xb^dvf|Ants+X>I!-=p{`>eNTVf8RFClLm*^R6+3=dAW^
zuM#2U#_+-1Vp6D-QuX7jcA--ccLjLAvpea3@AVZ((7}%TuUt~_;Y8Nhj=pKTTH`Y>
zy3#SHLe{FUH))?oxiVZ__mxk;D{34esp)>cfo@<mLfIXylXx*vRs&12bh;8&ulAHM
zg6Zg!YEXAV|AV~$0j<J;0iuKqjLnmZPU?y$_+(ENBrBm_wU?4YvF!S8cqyDFhvcyg
zDM9qUol6*z@!V}^5$Q|nuFcQ~b3B`s-wm>hv5KW)4RRXa$T$u~Sh4`R{l~n9zH1G^
zOKw3zZ2bVE@0mw`PETX%Pbj<`73q|eqSM=GPJYg!lRj}?|E)oGpmlN<PMAdrvM?4-
zv|Wl#{#OZisAfAOwS;T#7)zeRvGrWO;Pv7|L|O|2AcJ@ZQ^8MFM~<S<Pc(Q8i{b%3
zuoE01gTM~OO;%nWt(5zr*~~FEUXti+0%=t%Mb<8MrGvx{1r^%n<Hx*l&y;V6(Fg14
zV|%27{}hQ>+c1UYOldO<Aj3cQ=&@$=h=nyh-hx(XD@xHxpY1NXDzDgrss`zG%}?U0
zkKlBPIzN-sLY}U9{^F-?FT2POSnTio)Be!){#-(7&z`KC5UZsYX-kB?sEQw}zP@I}
zG__x53TYwDd)nZyRQi(<Swd7%AcQ2$UM#je+ptYA65h;3kT|oXgNAStDR!Eg(ThJ#
ziaHAgQq#aQqiv8tIJ{Vx%^DmWqj2va7~J$%9)h}})cRWrE5f*v{bTqq8kP?8<o}$s
zU4ldrakX}(e?+1pe+?4V1%#)`*B2$MDD?w;l9EzkscKS9f(pqu9v&M(6dU27uLHT9
zF;^W{C%zdGh&Du|PsLSDc#Driu&kxfe_2Zku50_gY31R(IQ!q%qPpjH(ZwOEC%5hr
zvT|ez8;&x2H}GEh)Y%%X9&`yN!ML&4CmIGb(e#?>6ld!&UK9HChghW%6y9Aev&N5{
ziD+p2%~GCo$cw^6v_f_7ux{(5-4eFh(3Fjr5E7H-DwQV&tqMBKU^NuWNzxhJc~lsi
zgC>P!3WNX&`GoVMBeN*?Z0oth0(tE^YS=(bw2k6p_|8bDGs%AbokVWNSY&cGCd3I3
z%_oMW&qDxBW|)8LaEsh4iE0lp##R864&Y;Q1&?O1=3Eb8=6-3xCw|yzYj;L59&X;8
zeRQf_7MXyHRqG!lMXXe;3QZZt4Ri3p)bOT6uT3u$E+O|oAmU$%$k)1nIe4_if_81|
zOK4h1gDr=gE`+0uo2ps!Jd3#-QTEURqYXo#%0cckH-Gya|A^tsS@!jw<7(^Y&_2qd
zIXL`|8qpQ1&X=L)Htr2hbKc@b{XVSmXbESkAM_iskhKSXu(1xp=OOD!ylHM8ytb@r
z=hiAODSRAo-IoH2Z)>&XNHB8DZ-xqgS_RvE#~hro=j3rNVZ6Y})UTC0tkHgC6_-`M
z9&y9~+qBr2{vsqI$1ZBm3z$yr5bmTtbr@tK$8&EfHW)yvSSaNRM~+vSP}k^fltc-5
z{OmarfsCyA#np^9V)!?-#c}D)Vs;hqxv;pF?ARX#Tg&1APqBjB*B}Kz3m!CFhGVg{
zCF{9}@=*J}jts`)N0O}6q<&cw&NR^P`v$hy*;L%u-okuIe0=gU+v-9LlcZ<$!<vrd
z47)6E6Jq0RfnXCJZmIIsLdX7$Q5Ct0OkR~&BXJf`BuEkv424~+xWikk$;imjqSiZ>
zYyk6?awl!~k&$N`pKNIKbmkSR<O>~?`r=dd@i$f^A6R)G>`trlwe32w`#~EMolR*5
zU|6<LzS?+me8)@kuNBSBtA^-U^-#O}BoQU<zh0j^MBO6BOIF;Pm0umlk|=sEY_PAN
zcx01@-*CbO#J}Kdv6_r4F~!Sk8!AWx><N_B=?^Hqkook?ME=Bo?erz-3Yda%SxC;b
zXgJD33>=FejjzA)^-<|&{vKuf-g`#<w@mvYI72Uh-(1t#Mo4U-ipn;vu*x9{Btp3F
zVX9oZT{6jo;el0B|EXR`z94&2L;NydDW3UJ5@Mky3wk8-6P8o|%rGbD%o~%Op*dD3
zx;H{yc}TmA{LuM*yVRxHHEI(P{cc)_VL-0L3X^PGpE||`p;F=NX3%lNk+g>tTdz#S
zW3>j{0#nlluW8We{y;`aivwBvyhKcnmfJb}TD0^UCjzzWW@Yls+yeH1iW$=wf%AF)
z`oDlj!$&H6V9fUDAxPEYNXwezK*9>cpF(rW?c>pqdM@=}OtM)yDwgc}pXR9|uJh)%
zg*1&6?p5@Hey#8P5mFwvH6V8ed{yxZiS;|1ET!D!=6|9`K}okwaNTZQ8MS}oG8rI+
zR$L1cvhLjOe^I9mr7oE8OPF<b#*;6zF?eLPHS4jfI7Vk=7p=Vw*=(+crsbBBarI(v
zMNz6<VM`{hF>)c{tJ2C55=os#61J~m3h{P9g<+E_7r(qTf}5Hp-3Y6vb*iOCs(qVP
zu>{tSnG$icH0((dW#Duf^|Z34n3MiB!+lh%p4LD(>za{%_*{@$#Qu4LT(IL`a94%a
zh*DBf%8#7S2$hPI3tn{PV@dag-$sLf!rQ76Y)*vQ@K*fN_$C<k%-CW*_NgfC2O4tu
zmv>MybTJJ|f7A!DP$C<paOX{6m$$;=^KWIM=Yzl<V>_hnsfON{0a3aSLb2pnO4JR3
zhz0&QBU38SpIN7aQO%?u9-_$~&CMX0j#1mQpX@F<Wv7Uyb^akVkXmp$t#LaKVX3)#
zQYY-J-7d^SzO(myecGRfE%c}7${%VKDNm#<W9^tX5TFCh^eZV-I{_Yen#}KR?Uxnk
z)Q0GNs7yIAn`in3)9$!DLcS#|$&vTZ^(C|d8Q6zr;jt<cob9ljXb$50oO?Ko`Z>Ge
zPAX5BA`Ct^KFM(hA7Y%D&%7xu@);(ulyUb9HU*#A*P^M`sLtLZ*Pj@mxRq~O>WhU5
z2{^rK0Z(-{?~$73hh!nwtCFjsZ5`{e2H+!V6rg=M;%#vyMl}wK{SuA&oeE6T8XTv;
zBCocPfTXJKUT!*8rjsfkmtvAYM1gAy;AfR-YXr(!yr`qbIKMj36yG9B_aU*R3v3fU
zx_v=_@I9TwQp8-a*8nTMnY3AEj-FE%G3kz0{q|`W<w5vJ*^Ov!d2c#<CQ(-3TI!@c
zHy5{@JV<X3FFz_J`z(Bf_s^4hP5IQF)Zf{mz^{C(@X2%zaI7lIV7aA!3)2WC4xjbI
zaNTzW(gi8+`&wlr28M*@JLc4`q;ltBPQpXusCcfAoZS2cq7^u#t4Y9w!kg7Nc$T&|
z+?MO<<aA!q1%E*l&iI~FXYe~Uk77frzT)W`zo&0YRtI^R<Y8qGFx_a+^VHiD$AwPd
zjZW#$p(*=Y4e9!@%Mi88nlG<}uP2~!DPX|sm3kAq%>B=vnqN=d=XlTm4pHJiW%e=>
zRdytHmPz%z6dek9Y*QUuEoF0JLK3zS9?5gStA`-BZu14}D;%gX#R|fEpuCEYyEhhW
z#W_7qTjXaZh<k>HmO<avVI}q$A<xDBH6*8ui~GAVZMj_nyNm|T?Uw)qGc%r4fjf2b
zP~E-e^sF}Z*$?SIQ-l^NX_O*<{GR?WSw2Lhfl2+k5|Ej#U({5VBjVD$C#OL^q%cwg
zINo;V<Dxm%4i*r=gboa#?qZyp&qq@+`NGpmyVCs;i*U$7sIuZOF8A!CO$P9<U{A5}
zqq%<e5nPSt3dzx*NsNN80h=C&uNw<f?y^L6Ae+(RnZKKPV46bpeKh_(*98HNt+C?Z
z_k@yIbx=Bsb&bbk|8S<%_CdmhFhkx>TrnXjTNJ`U-H0)c)i7vMraNEfe{6u4bYMA}
zdA{^dX&A59L)24r*rg;~y$Z!Tk)Qg9B(ThdOf{gQ=&s<c*Y)A0fKpntKI|LG<Yozn
z^TZdkaHiq1`?(LTdoX)*0X3Oj;FTl0X8xI2TK+}2Ie8VG)ABzu+qych9*&fN&p{LP
z-tOpreqCF~$Njs9qys<!oplbE5|BT8{u#xE#SNEt2klR0G+$co2Qs5Cf5R(XOO}8q
z$NwiNZVN<;>RkTNh*~GbPfhD&T1WbNMtMU`44*p@{~*2>w0UzJ*dLe)!j^;4VlH<A
z?^y)dSK+1o<@0y$6<u><9KxFUu-+sHmWSpz9s)E#HDBV{dk18azR>u;1B5DGB{=wG
zvlPe`U~yV{tI*#zCCXSx5G<g3!D98vu*gWm;@=D=7;n4Y%=M#YZoEjt>Q5Mv=PSsU
z;~T2?J_v!k6&{p+vJHPdiKOdm%;%F+Mg0f}`lXM*>?=yXEyssiP<kop^MMHL4*er0
zf*b(tEsRHy@v{IN*Ayago6|m4S0G*Hp@F;UrK1uF0_lRPoUbGhil^4gd=?ymwTv|&
ziphWrmz(~7?yU!zkFmh?n&@+zlCBN>Ab-+X9Uug2ju74s7LR35(t{!4F;IfiM9xCv
z0U!Kf^r7iG8UK%r1ru5AGy9q|9$&FMv!}@@OHSDXa_zBhtEOch!t>^>_pRZwK)zbm
zmH1PYI_rEf>**Tv88>DSc~?w5f!<{3g7&(!L~>D`2N8UpStZNqFce|B6d|so*jR;}
zy#IpFMOx>DlVeGDIeJoVR|J*{NGYoNlt4d}FPfycUM{6#%&2cWd?4uL?9a)pIN;Y^
zrx}#p7XXJptvlVnMejhe5ENUus7@teb;@M(?`cL$_UTw2$MhsF9d&QHNX|$bRF?=t
zj+}9GNm>AI24h+Q47J2^775r^eWLgCOs9kJWQJ10+F3Kf2`=<DJU%FJQuFUHVN=ah
zb!9LIei6-Q=>E28=);d)G>v5H!X2CIRP;jDmJBr?AyTliy*K<CoUQo{!H7magAAqp
zUFuA?<#iE_N=Wty!pTp~7<M>qt5<*`Zs&pcJQ?_170rB^TM4yiDtv8Dp{C04v5R%i
z=7K@-z}wWiZ_r>%spmT03Gw-4{nGc_mE#uArS+To55B{<YlSs&GIA)?bkq_wv`N^g
z3Q{=u8ZtO2MPayw0Mx%!E|Wt0xgEjfhYWKsZ|l_#>Y>wVZdcuNH==L**Hxdj_T8#C
zypOvawM>**^iu&fv5K-X<JbrfG-REI3Y;V|vPT#A(2h?zkUK^CM66@w>b`t5&4^wW
z>5#4w%;tS2GNH_V`2cgYquC)8Ff`xdcp8>k(?iOmEdn7XOEJrzCjwbzW7Z(rycW||
z(g2n?{6d;)c#F$^n;?Icpc}X5@$5Gf8fzTo(ob;n2b^+rFB^i;%(=k<5I|XcIW+nX
zP}^B=qa75j&pf03Ic6~%SN0VItVQfg_u+%4uHKbr0r0q(QavRCcRtP&^0XSiD;zJT
z4ki;;ic2ogMvgDjwoV8@j;*swA|=Nt5yRqI5kqi|Okw&}J2ce7@7MTC+Hwqs&;ZWW
zNae`Oxc}H2{zNB7f)hTIHA%1E8V$868xqjZpK7UP7TZpYR2l!rHe+)y)I8UXGdMPf
z!_>cFQ`MZ1&izK$<S3$RsY<uW6cnNVWK!Qku~253>(MNuuZTgBzZ~1#Hv>Dt>K*z>
za^@8LA5hT<9sUN7@9Ebh<!L6+62NZ534Vu@FDfWH$n@Q$v{7cp4h#nf9vOwit!7M1
zzUZ%ql6qxvN9CW8iNZ*u7Pfa(A4=dR$K!kC;8^U<Qvb#{4gSWwY^b@sPZcSiMM`#i
zA<JERR?nr+{||A+>6ZSRhDDS-J2w4-4{Dg6<&yF2A0amq^?q2KRAl+9?N(pBjN!&k
z*g-0eW_U!u#|HesBVwQVD!Ch@RsW490xkt;=kJ61@>zT0T9gz~HklOGf76BsIPLux
zm)+uS9L!v=V8#ly?UR0n)DMB-SK^0JZQfW<m|sFy2NB#X=gnTU9ZP>QLua)_?vKXw
zV+pn%QcRaQ=A?{(7vMzNv-OGIqIlaRr9v))<ES`@%?UTpPVX?I!0#(Pk!594)noF9
zm`R~a_&LCjT`w}!;#F+-Q+5gjj}o>r;tsib1wW~Rc;G^j$N0@P&O2Q=Mp}6M(vb>)
z_U$uYLP3J0sRWJPkB1`KGI$oYNty>eF5a8EX%&lfTh@X8RmA15rHRjUyLMzYK`I~T
z7jCuJYe^_2mF(&5-!)`;7Wt*?37L;tfycjw?#F*7en7~}{?RXXV0LNgf>Jw$1l$P)
z)bvNt2#u^G5s6^#RWX*hx&+NQ|M(!(%v9nUhdsjdwwE98R}ic;30E*&i9rwLl(888
zXkPYbwKaNl#yNzbK|~6m35Px&lamDgo-edewA26M2#~Yrx^*ag^C5XpY<nG7B??R|
zq$j20RIG}_1s4i)d&B`Edi>gakR&Hzr6(nXH4QUdF!x7+sucJ*penmfi7f+XHLyHL
z&e0w8?~`I-=N5L;cI*ty(eC}EG`Hnk5rhRyh=pOwQfE;pK;_^6QLPw*Bn*}Sk3LAc
zKgO|*q=fdenPDKU-`PfbGt=|4Lo+!-ju^B}f)Hst$uXOdl5}>*e(-P9ze%!<wi8WN
zf)K+;LtV1vSG2EDf-ek754XV1ufgM21Ya-suNC$k_M}BIz!Hmju}lmS5Q)7B{XNl5
z!Tu@2bW(eWvMY{W`ly5@^Qz7aqLM4=QPdLjavBZ&2l|em1pJyI$M*D@!G+iXs&fEE
z!g^gcUy}D$@!)jDl&qQ~aYC+|>}<>22-By=u2dT}WoT$rfDeY@N|OmHc--uA_cyI>
zqbbJPR9LV6QZ`tA$(SwVbdpfetUUx?p|Nt;r^A>F-R&CU@rQp+#F?nW%~;IHpS1$B
zCuM!96X3DFf_&P{F;W>a_nWM_Vo6$O4nWF!S18Irszd2{@hcEZ-*Jcm4{cmeYDsR%
zrrCrtOxC4KxE)mX05yGy$NqLRM75Bn84<4J_VAEFTq_~9jexGL??ULypEqxDtU_i}
zEggjp{_#{md!|QSd?q?PgVr7;z8`Ut>g=HLkYceWkzUkpi{3hrZN}pC*XI-;%07z`
zMe)?-ejr9F60D-+K0b*;x}>)qD_b){gBYhHQW(nGA~=<z5JT*b27bHv`Nr|X;ZH*D
zn$(f*27-Q7&+GfrR@jL#{gn}|Cy!u?FE*33`$d0GhC5h+Qh>E22UQxc;wv`o3OIC5
zC}c^n>+Z}PYe1dchj{BQvCp}NK7rg*8f*-rnQWg9l!Z?dqiusY^0?jHn0!B{(JBaA
zrh}F;`TC%XcnHp&e<oG?bSVEP1H?lLI>@4wg#J3c{xUaAa+T-i4achAhRl*XWl}0c
zUZc(0&)m;fd0ISaT8gDDH&#?p7fE>NJzeNB_9MTKDUHYQtHf@c`b0S+2`=~#s#vYz
zcM8kLbOcqdHP&>EibVlLNR2Q5^uFwp+;IH~=kBJBVw>7eZ=<7OZOLir)2L&x^6AlR
z%OCWQ-te3u2Dz=IM&BtGa~!s&ZB%@M7RGMwpDG>fC6(qamIdv~Z5IZz40>VOxN_{!
zsd6JvacfxY=GNE_#veDN>*u?BsVu-5VP%^d0yby{Jg-O7o;(f43|bN$rxe`}!kZ6A
z^dHNzh}ta`x7hovehwbb6Vq+o;UB6}-9ELoE;)ZO3LcNwNOa~XhBt#F&ei7F=d!vL
zc57W=iCi?r6ZiZ5IVsV~xevyVS-i(y3s^`<o<upA5GXt4R5p61K2PrVP2~He1PJuB
zit5;1uCBqD-e(vY4Z2xp6s<oVosn*Pw-(OWEau0KQ>+J<)p}?TMeY`W$DobMM*h^k
z+xFCi5q*wo&h8L2*GQy5YO&lQwT}U{Hb`C!PxheNO(zt8kRml|LFoFcoZF+5xXJUB
zlrJWyy@B9{aYDtKTv%rqQ6wxxF!e^Zo|rSEc3QBuJ!y4z&mGiK1*oO3$q15Pw8<iR
zRMPHy%EETmQ44)NK4{2<O2xOh;UU!WJLkdaI<s#UT1D~Obn<iK1y9v9u56R|9OgDI
z`KkAY6l6F`5q^id><V^GqS~zwvh&{+p+Y^rFz<e!K|>vGw9F%A4()UP-I@=k>%UF2
zoi-K>)~dOaR;QAFJng(d!&L#Ew69`zC8T~U;{y`zkBzjuqM2y8T&o+M(vQtZ0u0RB
z9+ZH$cY$|U3LhszqNCr>&dsI0QEhtud?J5+J%6JhAtAZAyOa0!en=#-;Q>a>P_Qm6
z4$jiYnn>iG_j@(frw&`fG7f*0$vP+8F6rn{OU%rLR9FN;=AVYE28h^wjitgfkL<)k
zMy=$N<=!$HAFaDs3n>Nuyjv~smGkTv)NOR2J+ZTcz|4yA+sUl}Z3-EG$uU6d0e=I3
z*<=lJ{W=ap8j@Wnk+K075*p=|#DU0D-Qhnu$f^t}<}E*D!ww|2e`Our78Ugkb0qRH
zx!`jYDAFFeOM1CAc=Wf1kgtKYqfmUgx>_pQL4v;<z?N{jeFQFtKTHA8*|>p^^yniR
z2VHx>?`<SRT0szLs^*-HQF-ddaajR&<60))m^R?#Xq05a$04%Y9@Gcrr6Hb7==5{6
z!(j-aR4Su|P9@j1UC_YWa~UH~RwRH6(XJNlil!>HU||jdJ!|@zt?BuBSuZIxl9B?d
zPAMP+W3NKU{M(EFuhCga<t9^)#Pw{s+L_tDXj`s>DYb#R3=DJXc<>G;C3>}lE2JG|
z|9tPN@StgFX1ZL2WrJ{V%}2z>>euRIN8r0~*l0cYwSY|g_&Juvs<6x=tcwO^;F>b3
zEdcjva;Uhq3GvvydF$jh$v~0^IHawI+2sUh%ev;YycV8;Lc=1jWXnfk)E$xW3zxT|
z)a=kk$89%VGLm)pvrZ_ud!HW|C%hKt=9X+RucIDw#4Pmag64Gi5xyY)b^6fjYyije
z3a<C$ozH=qX>~>HL@oQm$8J}0@9)a=gW6`QH&^|$y990S%i-{G6V_7zZL(x!BYW}_
zQCwu-2@C{U+Y=|W%{jgsb+IWU5ir<1mgML<{9Vbiqm`t<I|in5)wQ?r_m7itNx7{4
z$HcJU<NH{9Z0zN(R!40B>vv30JwZ`t5ZJB>38{uvJ>vs{v^`rhe*C33qe@+ZSz;A@
zM^%3O%X>^n6dDE7Sb7Pq4nmE^*w&^?q=88Ll<{0%6GNBd-{Me-G_O<CQ54)f&Eb__
z84fZ{&LcI?7|_|3L)Fie9p;jC{OjQ{=%b9B;^OW&O77aU)WwMg#un5Mx^f$rhps5r
zw44+??tcMhW7WC8_s~P%<*0uX4PG4Q60GH>Q@R9T+O34h*^GJ21z<u-Yjl!tefWd?
zAF#JaMvxVil$_7k#n3UjFX7NpQKkI-#Udgj+sB^n5L-t^6arrF%6>;+SJCLzvLdNi
z2v>Sqqk`?$WqfKTv<3zDz;WA{a0xc;TbQEWH|TYtW`a(OpsA}Bjemcc6cMFi1LA`p
z)gPH}EtJN+4T*XpO&UlItw8NH`Z8PcL4p!@GH?ZD87{gF<Vjz!0HmP^@cs5j6p@or
zIs{1#FX<LV<LV!J@z^qF0W#d<<QZiXH5I1Gla0S|gevAoHG%4a0y%GiKk=V)essi8
z4`cz%2#826O)<&xoQ+4U4;Ylj5`=3UI?@R;+kL1H!q^@`KKHd0zVU9FfJNjvF`a`{
zgpWrD%U3+Mb!pbMbx>U`qJ*`CEkG=*c|SXOrehcE`e`WnO(w1xi9l~xsbf(vLDJAM
z1vdZcfM}~E63(wr%^v8aPaKfo;WLrTchLG`0kfWmI(Z2AgbNfmYXHz-h%JNZb_D{r
zGY?_@UGWd^;qY?8bQa=`ORvSv2^J!~s9h$G<kSi^E~U)Xn|@nk)Tnr%+BXLWwyAH8
za2>`A9(oJXhfwG#lJ3_PUqPs)M`2NO9@rn_GqsMRC1bp}C)3m$h3(3TJU+i`a_$+}
z7xQZ+?KW&r3!dO@xDd@<V;&?ENcGtXugt`{j3+F1!QjNTb=_aLQuw(W%N;U!;&9C!
z&d`lj(S`l{gxap=TB7s?%e5q<`%>bWpc|WqhsXKu%&2Ki`66fI87c5eAP^Srw|fX6
zZDKX<@r#Z?>c}G1igqZ!R*~eOrG*cC9)?l&be1>}e|P2wH}dj0!t#Sc+4V)U++KF;
z00R+&+Ap0Hp*wRsJ<Atc0ml=X#t~?%zqpHB2_7k>oCScj?6{KNZlL!mrdywk=C9*T
zGai`N7i~J>5q=cGzLzhz(fL<J`XV+DGir&XM4dlmWzr6o*;{t8cV2!=#G*OsbI>Kf
zlngZC)P~u0TtadFkseNF*3!+r8#A#o!Svj)9x(cYHrBsH#g1C!!l3DZ;c|S?A=d%6
zgW%r&;MeU;WrfTH7_KWVu3*Eb<AT|TAm3XUYGzPbbh7Y3z8VC6DCIf)Ca0+Iyq=#T
z7j=N477>tj^N`P2G!J~|!dK`n&Wz8PzfDWR>CtuUpkbPTb0f>Hx&;<Dr)3ecx|s|d
z<3hl4Ma{_q;Hihc;uyTtH()%~F};fqP4xjm*C|1AfrL%C!<zFS@Qf9Msyb%W+9zv{
zSm5m<Mz%@lE~=}4rUMmG8uWm2G}a%Ho4zc>_e25&p>i|_KcTWec`T#-mz=?WP9BIT
z<uv<_*@E7~;x6mf*`zPNKz`{BT&Or5Og>&(R@OT<hK7Wcq79@<R=BA7@)Cok@d}g2
z;u#tmViOWph(0cSvaw-)JxF{#$fNQlgo?|tUb0EXR$Kzze(;qjRVDC;XKerVCOTm_
zb{34+=ti-z)%^M^p%Gw7znnD}-VDlPi$AdWx@qI+AcLp}MkHtLamWoSciIL^POZTw
z3wd**#ppT0PGR!UzUWZBm{iGzG*vPLQ4i(GZtOuf<^QU+<I5-iKK~C*Zy6BP`+f1w
z4Bg$`N_PrMBi$WCBMhBV4&9}6cgN6;Ln9##Lzi@^ASr(D{Qmdew=?JEbN1QK-fMl9
zCaqnFb-pmuUM7W<sC`%(;wQ7z7(3P&;~~;*Dxl<>Jt}%SB6~bqt#TSQaaSYbUxCEq
z_#|F!<{&d4ukRO9qSjMiZJg-^Ft#{)x$jn>BM6LkDB+~KbaKHsmOCi$ZF;%<5`O?B
zSB4m@r;CpyiqK8`-2z_7>$$u0?H?Ru1ff26hz0}%FtV|s$(0Zu92_hbk8pSTo48+t
z*2I9Y9BP*HVn#8VsE^o($A?}7qid6)Dzpf37d{S>DAhxIM;llf^*#`tm#lv{$&wDE
z5*>k&AU%BM^73={h;Nx2;KEBD`Wj9>#kPY9k8Ce%1=V*KKbHZ<Y(`8c$LDkf1i0X)
zI6>Mu%Tbfl_?So);!wQj(vb@C2*sg59Be$!E-n;|jVY7qrQ^T8Y<wNHdRex5odO~v
zB6{fk`YaXv`x}S2{}rvjjCHY|hLG%?E8ybbHWb=F|ATP9d<pOzfk7GMx2#{2jrLD|
z1eE@G@he>HBa0kWk!)eV8}8Q#+_PYglp5#AGu+mmi^ml^`no!Zn(BtEbJ1v?05WAj
zatyh>NcH4<kKX+Ghbi0AyGtDz*R^RH`7J?}6JKjhiV<3Ky8{1t&kB^7a*MGrF%@V5
zD&-VSd4~fsw0E_|`P^5f`ufZT&@StHDuUxAW7k3&(suX`Qhe^>AoOi<OE4^<VS0K!
zRl5)b_Uaori@Q?Vz0ef1Z2YQ&2EL_xrbi@3!a%H16gK_a&ar3ky=5&AJNfu8yJt0(
z_X@{gF8+HXEbC4oOlexM4_$pfr#i4cW&Nt`H?CzkcDN^6KY{a?VRbwh0}ot=y}h&Z
z<`^<KI5<h`F_k2d6B!fZ4HXDzW}0fk<6l!=ImWU7tT<+I`DqtmJN_0K&D*qt$1g#n
znvVvCI0WVBs}R4k9g;x>^Q7ME{bLY>XScJGOo726IWnXmsNjDVpZ!p-^2FrKg2=cH
zo1jp)tF!$fn7I~3onfB5%C5kwF_bO0ZjE(r@eJShee<*rj^T;3ZN!b@zv((A0bP?-
zTsqXx6v`dL-<+kt7j%a=^rpxM#i0kIl)`kaFla2UT1u?4`HaU4-u>00FF&6f%+*l#
z_;62ta&iK9m^Gku?HzPnR{7lzlGbqLHnR`2TzACTl5iJ}7$eqTJ;b*y?xBmGGW@x=
z_Qea`0D#VFE|q|mK*1#FjXSH^Ew84A5$#g&ZNV0>$O@js6dhB+3dRnR>~KyZlf=^8
z?w#3%xP6}`%8<)sZ10?Z#8*IVb?c!CCFhHZS;od(yVX^NZf&{G4vuH)b)WZ86{H)H
z(2YButS*ZvyatvwA@weXjp3CYGMdjn<jj}L0LB%xSliok)<qG&41J7Rd)^y=0KfYf
zsG><DtKoz>-QX{0=KcDPE+zUM9_%e9w0VSE)WN>lgtw)&)mroG%+9~N&S0hI*|-1E
zhK7bdjPixbvN-}%{|*-;*@<_$Rf;1ye;(8YwB!>OwN8^;$yepD2aiPl4uTRbl`W-W
ze_0a&&(r`)8<f}blyv$5OyAM@MWy;@nB}1j-|MmYCH-tu1a7PUTUcHhb6EAB1RwEX
zPzHK6kG_Nn(q9mef<^Z3iz^zC=(Q}HxM*@yNAGg&wDLyUER^$yHl0GV={aTB2D5TB
z3^QfO8YHFQ*k+#4lc2_@>TN483gStcK%%SVx<DRn5Ik(7A->++gYWS>R_+9gf>gl$
z>jh;1MyDsH^Sb4(+f&d=BUn=&w%GhbC>Y`LVebQ&x?E1eN7#pmIDa-j0=(~qF>KfH
zAtwkNYw{r}N!){t#>hXXB<s8M(h63V-Y=&lys)Gxd(xvj+sMf}Q}A@1=Viw^rE|s*
zWR(S1n_(p@Ctgjqz(Z&;Dx(nJ3Qbl|o*)k?)^@FLzPI6Z>n5Ja{bu8GHn@UfotnO~
zo9#~4*@d8u(~KFKQ#Q<~Mf2Nn<r-AVnsPeubgO7s5w<OCM^YjkAVF9H6k9s_--|K2
z8m!Pf3$jt_i{M@Qj%XL$bk<)zS-wBC7xTAdr>Ep8r+{ZGKugh4!(1v82VXPm+dj2c
zS5SlBnn0r>Bj;ucME%hp|1^C{!lM!On5z3)^p8<!p<X`r;J~BPfduQT3;Ls&&32S!
zRq}#g`al0egpF$yN7GHsS)vz-{7*zD9#G)aqwj&3(oG5MMRu6NynPM2xU`t#qEh<k
zMF_dfpIe*-FQ@2X6nOsr9r6#CXK4dPkV@7q7&C^zvg$xuyl;y<>#DERTV+1|C*YgT
zKUi~f3?v*X#vZm2R<~L453lQKKKDn=?R0>#nUpP5!(!PgnWJgQx^*Ukw+{MGiyTvJ
zy29mRgi~4rBI8$JdB6L2@6zM`=RVlBFy<pu=ZU!#Q<@Jvb#krOs=`a|jZ6^X#vNVR
zzgTXrW&l>ocbn^ZH4jmKl)RGRps#d4P;l+Ap^q0r6>p^mwU^?K={qRtPQv>-@j3k0
zh7LaS{aKsVb&=of7lL^r(5xwZ1*JcFNSw|BMOQv!1WjoKkdw<lYoua1drXd!^I{}h
z*LPA4U2tF~;3Ju@Y}C%Rp^^YwYBoxzoT3AHzuHG+wlU^*Q|^Pu_Ms~|VO*F2b@FY6
z_5rb|)E(;CP%svl#C_Qw(CUS=?~8+Er>nn&?=h2e2$&c}?;iB(YzzX(lk)cHD6cYQ
zSAPk1_W4oKr~?x%&QS|`St}@|H1OsXe19JZTHC8+=ANTGZG9_N-legVPtZv6Kq9vQ
ziBNV|=fSH*EK2Zjq6l-}&yd(dvnE?;C`m2A?D!(7Bs0{wSBB+58<~LhUE1w{+}KtL
zAK!9n)aD=rV6j2jU!@6J)IjG4&AqeW$j6ViEiMNsU+cdDibnE0Tb8B_s-c0WK_n~9
zSf37^;;}~;ABeaYJ0c_3tqpV1W+WmDw_?0RNmT$+HZ6&85iFP|rAg5^rNuL0#&ta)
zA2%_z0D&g!z(%{dfBK9$-jF2?ZuL<&%P_%%6(OlAW}!Yl!YT64slp^kdPPKg1D)a7
zhvE5o{E{4By>W*x&Wx>p&JOLmfpi8@+1kGAlnfCmb!<=Lr%l_01XWyvw-F74qZE&*
zDRQ(y*<(!={2au*tHY-mxDGD<Lt9>C=p5B4XS~p|WACRX`@N66FNh$V-J<!(g7fLQ
z9ggyy7Z-EPN!gjY#jY>!KGhDGZ^m+$y!Byf9GHv>&P7{E>6yE^wbHD-!395_(Y3uE
zGbN8fd+j53QF%#89BiJp$U3rUdl&rQSfPfKi+facH(}<LKffVe@)v@G)3WnHRU9$Y
zqRLQ0d6j_yio^EyRPCxp#}0ypA&!8DT<)29eD1>5LK&!APu*3KL)eytou=4tQIEFH
z=rwWzONV2xkVO1H)-XZhMhdIqyHTn>6)yI79k$EFJ>7&9UeIR8*XQa5)m9CPdyB2H
zTs2Xv_-gdbj5B!f?qYqPu^qT<k&(~G%WQXr>#CIcmLhC;Hv5wdz><|*-|efPh>7`~
zv9LQ6;${!`6JNbh=V<hDosJf{yni68VXpWuYnkO9TrgK64{Xg(XvMha=0IXL80la{
zcTkG1F6rUh>MTR1Z*mcDmt4|<)gaOm@Q#M1eL$<ZO*E0@bt7I~4G%`WSWD#cnE?WF
z064%)HlB4LWAf;KbB@iWhVjJGC`SQ24Zo3OgXcEC*wISrl2rHcKzQmsPj%vk8Z6Pk
zYFW-K0{)4ixE(%KM}QD%67s;X5Et^_msGv&0e*jkMYGqfw^Uh#i6Z+frZWKN@S~6t
zLNN_^;4z9!B;rd((z8y;t+JmXzy%xZ2W$8GVcHHsL2bWP#>XvYU~BKSkyvO|dT^e7
z>QREN*(DXwr%_gu4|#3q$wZ!f3J{x~rh^6MV6C4<-(@DCY<-Y`r~U)v5hyJdiI9pF
z;z+=c&dq9ocO)2y@ybpf7*XLTKbnN)(%Zrk*=6JkJqXRuxIXHtr9Cxqpn2Okryz6b
zqaKyt@u|n&C@Gv@Abh0w*|@ful4g}h*~7Zm=0TfxnA$I5>PV5bPHi|>(k~G_^Mrya
z-jhQpres*j^ZR5>P)vwy`Hx0*;8j?k;o0tlT<i8pcy<CWWgg{^IbAg4<*C-{s}iYQ
zA}qhAMHVpW!NZm~$P$>mlYAI9Mk2D;MPd~f<Hp@(f{o!S{lk%!i9>{5F>3Tx*C)!F
z_JUwc9T`p~IFVFhO6=Yqj20~?ZsL8iqK*=KJUzWEiEJhwliTVJd{5XLGtCU__1aT6
zax>;C_^GygY(pZS@xy2jU6tp5yXc9rWWJgvRDhRJRj7eY#IW@bHbq8`*SSw6rhVea
z>MK8F-t_vCWAw{mg10fhamMsDq2YXr2Rv)P&o%YDGh_}liw1Xo&jpk@x#Yh%VDiR$
z-CE!RX6(0|xJh0uClwxrLL_gq8T5Sj!QPz7TtG>M6~<5a%Htn5E>Vrhv1QGA1b%2z
za_fh?u6?w-4UDW8AQzvR#6y1j&R+KsoZi2?Y~E8i@)(TfC8Li`S3X3f?(rWck<gyw
z^ypZ<DsBMy-u6U5hq)E8GVEtZ#t;(K(n!x*G+WL+lS_<=gZ$D8Bb}`#Ey|=TpNXxm
z<hCBicq_@(Nrh<R)mlnuIE{<rB#5QCj|s%A_jLgo7$}jda(-H=cRDf%DvEiPBH_tD
zj!QmO@l&q+I%@r-Y6r)A7hL>#A(SEEo|&@c#S%mpLB4VPQx`=YkKaDm7c-4<MceX$
zt?}CZb`11oZ*w4m5VM!i>!TDWsyyeRQflZme_>Sy6WdSb{HB3sxLv<}7d>gpcA;VY
zvRTY>-WDV2lB}66N!TR%FSKP9f*xocQ}^vLz1+iL!Ca@zx548*aBTWMXZc&Hgz=j8
zYF6lB2kh9=W+~cY%xj};Nfx#@oI{??(b2Q>&ffrAw9CBWtrjqOE3V>h)VQV_WI>mN
z&|0yIF-}yDsh{86O7@s_4WLYmUtg+19Mh?O+Gm!rPlw4+++<3zoMh8cOPOl_I(w76
z8JL{BAYQ-m5$pGNT*O6pWb)^L=_0iv5@3B(^92tSi-v37!U|vO81IA_YxlAb{S+-K
zwjYT?lxr18eJ1@*?;p@B>EiE+@Phv7v>n#fSkfmY`BASkzlnV_ihfe!oxd?auk5B!
z4HRWNTk2KKOQkKC;@LBqO3n6GG4v7Dwecd0|1Rr03h?rl+&O<GsDav;<96%*A)4mJ
zjQ3U@wb8$OzV+`248j_H?8O#2-=3M`r3R_Qkv8i8TZRNtQ`jmFGIGX`k?tbz)A_I2
z`YOvKSA{*HH7dx#m4^Ldg<ly*4N%l2mk!Lp6mIV8DdUReK%#5sSYBel59a_GlCh7?
z8|Np`{{nE*tWP+fDtjvvG_CIFM_)|i+U$yNh4?aYu~=9)B(+xL2<lj<`G*8czQ&@v
zR`9NaN_q0fW*k-)cMPCGd>!7qNIYRla(jHN-Y27HGr9?;GO-hE`9Vr8H&Z7x;R=yA
zbii-l&>}aII-3Z$o$WyQXs_8x<HaIRw8hRl8o|XD(p@eUSx+4zi-@5d+rD1xocD34
zwwzpUN)D>%_r|2@_6yJ7e!y&?)E~HHt!0U77j&!5DQbnR^xmqk(4bI;)whdNtzpfV
ztHh#Ce~ge}c+XKQSgK=UDJyn{t(+XzLu<#%rrnGBwNO%@JZmm<>wPCP7cZ`>hHp0E
z!t+Uu?9sV)tdxs({+FbZF>@c0)rDpyyQ+~z!_k}r0&MV3`v3}5<BJ!jr|J#>*&`2D
zpl2i7-{RYLplE_ZR2Xt6yr0afPQ5;LN_*{vsq^QZ-P4n0?0)IHdVg{CDq6<WC~!?B
zd)wNdRN>6CVzw2UM;=v*$NTPiZ;e34fnglaT!(u(eJ8II4_#caYRv(ByJ&z5`u-az
zkLSNK5gfR2-)a^R5_=ZH0I+TR$$-sIem)9Vu^Oip!qgW6u$TJnpux5|59ju9p?~H-
z%HV^&WZsq*tIKe~jeGl-Wb`_T9j-Ab+l_>6@fAeip>wAj07{YxLA_;&J?YaCaBO7d
zJlCfzt2Jc6Kt&*39E%V6&@F(5NOR{uNoNgwW#?ZH_2V+8LVz*z)lTl#1IyS}U?SRU
zcb|R?td0NhfnzJ@k{`N1Gm1Xqs$(^p09JPR6C;#a_~#f0?;@;E3V{4aoSzT@Sj)p^
zNMRP;;6OwZDR7z-U@P=3?^6dRsP?%8P=}qYptDVgpPv{8W{0ankz>iZg{AN#T^`8V
zOX}pr4i3L;AP@KEm-!NOL<)O|8Q|F?L<;b%v=3hb<drZm!n2i&#-fEbKgf!F@&jgI
zHN!T7NwxT_-f4+>=Ti<c9XE7&NJo!5UYfXL3gKjRB8mS}F`h>bxOY<GjO_hpX{!R*
z_m`UD*JPtdZ3->dt|JdSLj`7Gm>(^GW>c;w&UtWa=eNw=1+&_pLRUYAHe5y-AiwJH
zo9e)&3WuB34<=jUp={VFsQfwwgh3F|;b$Fk0tkLzF#0#Gzu>Po!Y9wit-b*a($TI#
z((}qqRVcWx64b(zDo8k0$5RjQG3S8<o|igoHrJcsGY(?HM2QGt9kix!>w_O*t;r6w
z;8Ig8^9DMPUxtDvy6-gK0rrQ8!LHpDcm`gPfdx^GgOd9C_y^%elAR-xzc+Tlm$6^6
ztVqhC2S-yo=#<MzU7<ipr01H^DSg~-Xk`fazF7{Re?##p_%S0dhM-Kc3IpFTxhsS(
z1<WyC#-dDgcA4NR^=95=j8-0iL!)(@ikA5!glHL+n_y$hM_mRDcC%6$KgyR7Cbhxy
zD9B}jMoinX6@74Ah7^<_BrRuo18iG|iG+U$LYHlC;(YL7M@yoR4g~Ih%48?3UA{*u
zo`~;My?&btG$ziYvt_@|-c#34`!l|E)yIQfzYej0HXj>iY0*|*W*M8<g|Th_inOz#
zwRNRZX&|blEusU<i+HNklu9j^IH2}bGHl$V!v3v85}N^s_khF<8td^LAb*Ymv@U3i
ziJ>^y07|q}>c%j<GUJErZ)JhL|BxQ#k6Hr3S1~t^;7>55V~!x~z=4B%ULd^x54let
zhK)R(9D)`fwR{Q4YZXsV1Pi%j_Yq4feJw@iNS|IR%?s#WN*gffbRqQ4l9J^GHeR;9
z)8gB0abxMJc2l!t*W7%qbn>1e@;KQV#t1Y^i6OLyYPGonpNb%&##6v=`*7on^`4I|
zCm5*uRpj7pRSFo@C648>&G1$4=8Z>ACYG58nLQu<5Jwx1CGU|6H+5KBEpG2Dd)d*l
z^c%Hwa9;@Sqe<xpz!zbkLCCQ*GbY#p9HqcV@G$y*j+iX6YQDja=RM5QktEtVuldD?
z+s;RZBx!W>WqWdh_%frcIzD;i5vs%*P%xI{I79h?euTO=f$}mNdb3A~i^Q+nTk+q&
z5#I8NZA8J84gpA@#v>=+pFbaV+4JF~x<#$s#ZWR47Pap{+0kL6Q$OJ$41z66u+SO9
zwv0r^^E8IP%p<5}_7jt|@<zJsepavLv<%t$3VnW;3=jNuc)B=$z@DuoN3cD&!#X{O
z9G)z)A>AlUVeV!BoPG4?95vr<U*@Eg(@^{pE~l^w?@JEjQCLf&1#hAD`<`#jeU?tF
zuFE1S;E!jap<}ECO-9IhKI(9JF}xYtQ+p&NVKt)e{u#xIoYP({)&po5<lz~Mn`t(t
z|D=Q^#ft+p2+uE_k6kJ>xP)ZlIi4@)$1C%h#WfP~ZM(GIUDzH*Gm`uK6tuC%7<pN$
zNyL-WeL$VPG3`DSkx{rL=^A+nA@misg%~4|^;KRFD>>inR&*t{6BqYzg^|rK7;}p&
zP^NDi02&q-$Nb`@t%Yhz=X7j-R^oSa>k7}zn0YlfnXlkS2hPASD3tlMBD5Yq#KK2|
z`y_jJ6qJaj(Vj|hw|f`L<>TA_^KaN4^{ubAnGISW<vRua6dsQ$S}BDYGERV=XIT;9
z@S-PAOuqW2W{B=<h0CODZBU|YdGA2@lVlHz5tdzMg6W)vStJwFU?M<tenVYsR*_KD
zaPF5<qMzYsS)G)tGZ2U#cvS`Bf1*FZkC6<b;hVJk&a+q|r1ui_?Pmgom-~o|6a)@>
zZWq2xBQ8i9Q4u}&p*R~3PSZsOO17d(&5n6+)&4joE7wu3ZXa<l-AYBy6qF6OW01<-
zA6Y{VFRCYvo00K9)FJ$HL)6IF!kwTLfG9ReR&VetPgpxn(0A5;vWe+r>DxC6Q8>c8
zhgOn2`1K;ZsK<rEznJ9T=g~It(JK;#9i28?VB*gxK|I($Gh@$@GlUhFGa>Iu-J|K_
zMIY)t<!n62Ex%4GS=JI_8A+$gXKH*p5MMzAEj(5rdfrA7FbP5h?jNLS5@FXr$;{Wk
zV$3hC4d8%Fdt@QoWRX2{MqL#11V@@hA@`D>y?`+lNYvuEq1_R|kkhd22)Y9^d#ptS
zsv|evylgR{L#FNVXz)_B^6rs$2?%`1EPj!o`vyY~NZAS>xg9`wag{ipzEDhBJNXgH
zwe&<*L?G<E35+0#b8;{nF52rAD*|gxWZIyXo7jq}xt!fQ_EP%eVn%yP|NE;ErDu{Z
zzu%JPO_{{-s{?~J)B;8LS-TYSBo`tbQZ(T(Gr;|f!^!#iSaCWxg8}6Xp?8`8c3a_k
zs_oYbA}?=m*wiNNfmg;TzX3qhlp$(&UlUhsl%=#j?+kBf^AE4!72R-Mq_D!<0nmTx
z&MNVwfMGD+3&kl8)#Xs%=#$Df^@wdb*OmvRy-&eh#Ck%6J}-=)>w1Vhrs>~*IPGfr
zB-G(%8d0C`bI~a{Izb6^#|FPt<Nb+DtH5a~Wf=Z3=UV&~Ga(6*nqh|O&BIe(#bJFQ
zNEaKeAl|)<O7*DtD$ox-W!Q$0ApmcCkjlr~0x!Z>b7_nv`=U46`#Vi)VP4AT<KtZh
z;<(6Sm#(KbWQ0G4=K|k;j&Qg6#Vm9NMXgp(C=Jcttpvdaj+}2r4d5S9GD?ykzY(du
z2`0iVk~a)UGY#LHRH2mWVdA-^H(Y0^(iB9d)y)(Hz#-CJiwC>iGaxz(S4_zd38^st
zNQ<46@z;tc>OTj6<Ka&v|BfhJW@_2i=Wb>Yf@haoc$Kq@gr){Pd)#CCtX?V_X>j-)
z%_tIVozS+6Dg*~geWtf4(QL>2Lv&A=J@;s6;Se^nXc=?VBV*iP9>)|u|2l|eq_Ttg
zvRTY6x-IypIxPfoGj~Vg)I`3w2jmdH>W%N<BuZX)-4*hL1@On%_q^h|8s=GTi2X)4
zdPs#7A}1H)w*ec_@Qe>GB7k@1kOhznU0CujzqSl4Ykqe$*%MSNtR86zB15U`(u!g#
z)2U9|Y7^DBi6N+q4o<UHxB?~$jbl$Ls%Huh%X&W(t`z@r12($;uwQZk*xe|j{!tsX
zkz!j{c49W0wD6&2*Sv_t)>h0}cB3Ud_VX``K%tFEcuXydV!l2N)-J^<(?2ZVcx@zP
zrz5pGD@KTLX$l;PHc4G<&&v-S&Wk~g00;`F;FEU7N<vu&do`O1orsWJa3VlUs}Oqs
z1wUPyVC*|d+N*@gn89dULVM0=!d^@-uJ+rstfiQQ?|u_Asn*?v0?rEx;!2nF1D1`*
zogr&K9zWK?;sVTN(bUeqqNJiu>kzRKNHXyz49Q=IjRi=%y}_=sAmf6NLj{@?%J8mI
zNij;b#X&BYk4Wv!4?*c*oQP3(fL|d>JqiAC5$Ir8ykj|gb@jz2tR<Noe-l&IAW|%o
zhI;R0R0?^;!>n7aA3Zdiov0<&LZQU5Ya~UAKkw^>7{R2&FAl=8HJHloqsUxe;r_9P
zuK1dFN3Q5NRgJSw#}es}42m`)Koxbu%=ZC|HzNo@2Van$TYD=8Cq09*d=nHyP|ErB
zKD?5E$!~uJC}hW`#3Cd^j6v7HuW5fw<A#K(;Hxbpw@Yd6?O6-q3M3?-1xVJjo@k;A
z8ZBx(FiY;}Iyrwh5T!yHPI~Rp);touj4mF^5kDRlb)0&5hrxicA`{=ZE>k{6Ms(@=
zNE;PVezBVKYMSKt10VWG7YsK%DREZ#ZH>+#Bli|c8hN48QQJPX@m4-U{l_t8*Rc&r
z$b@t{pBrImk8|WKc2T~ZM}_U9XLoQOiNQ3TRJm(eERKe<@93)$4U|~C_sTSXL{4Ax
z{Cy<H$<)Ntkhhnht9lXaA+etA8JUrvn7Tm2@!?f{^$rps5R#@}IHSHZ=FpTC#sgj3
z;g8MEI%RaBP0A5DK_=%CF-qR#5xxjAaHr--c-}6@644pP|9+6W+GVQzyOi}|;yp!4
zr)Kh4qG_9<fMW_4>-Z89{Ja?p5zb6vW+_Q{i*i2gE>CKrcB$C^YMM$xR)IHid5OGz
z*0I7!)mYJY*jrmqJh?DlRzX@r-iXb6vp6pmPV4hUaV38(G7zLa-ReVXuQCWKxEcEW
zaMN%#1hiv~t9}EU`3ta$llX}sl0h?=T!etKep68bs~Nc&(o%#b;#K8C@DIrZVh9-@
z-?P8WKh2N!6NjC31uDGZk|QW+6*5x2ZqAZ&g;|ea{wJJXj&~E{$9-W<eI|%bbYDw`
z7svBTi{WtGrYNH<Lc*^acvn!h7DG7h`C-R!@;_)dVHNT_No3;2eTdP;(k}bAa+4ci
zJDi@93<*16*Q;fUNvNS8W4B99!rCKC2i3%*iDL2h3Z)>cepr$k9zPQe3#R^phWG0y
zsZ%YD55*@En$KVU$k+T{Hi@M0N9G>5PMExzt&d2Aw}ob))D>ge(Vvb@@>DU>IC9Ap
zDVi&C(9?EAt7{&&t;G1GO1qrHyL<Ugp9+V#ShE_9B3Yy~_pwYq39d1|f#5M(&n`!=
zd*1mmJ_%m$y;qg6W05xQcqfpNo-a9&BOlvB)FayRy|%DOR?`;a!Z*{_CU&yjap-h}
zg;d%{*_6$qwT<K`H=4Es8`=*3b~bZ6&@=yqB=&Ev66Lgo8pG?C*)MK;yY1S(j5p=w
zsD)h5owD-sB=hfGTQjXoXXz>v$ib%z71%r`xJ6m^9+Hpy2j&-!0Zf|SMMe5`a#kYv
zi4p<a7HuA9rddwhW5XvhZgKsGVG|0exu;PNnFAv@o~pImF<*3%jHf@Vn9TuudFKnp
zeE|Dup!_n5&S{i5Qa)5e@KX+=#aAVDDf6(|q##BkqmLZBkjknWoQcDVECaJh#<O|{
zz7nAzm^jWz4{fV8g3yu_6L!7U{d@E<fER~Y6tR@>+<hX0m5OSvnxT~`zSuAFs02XB
zD&KhEvvhVgWmMY_wxRfwSqbBmbH1Ag!u`fN{Y<3pdO3HUVNAiDN3`A?yVrs~{jJJ>
zIX?Bp0}cn|{=yD1w%_(g5obq=zF2QK0d-h1G0-aiW|djga7!Xa&ap@3I6JmK^X`1O
z)HoD-Jyzn3mx_*lgyfA|D57YyhBpTM>uqGnJ!3>a=8fNQsp8YCCU+&H@7~<TtqGIu
zHXCCG#;#Yfdq5^T6wsR+pTXKBDNn?7TJk-7%RFzp7mN)CR?(7$%o5|756GuFe7W}{
z9iG(2S&`C`V`oPOtoeO`e$^hw^iA@8rv=>PLzP=u4By^&a?<_kd-9hqoMa0L2OZg0
zTsq$FiGOiqD3*G}FZCiLM_?z=ed+=nFi%BGkLUi$jyKNvpnEi9cvtX*4;UNa;blLo
zL*!avYmHFtJ|zRkmgLDPT6@?>V~D>pL7VsF4Umdubc9g`=LK>n>r30=>OJIl>}qaS
zU?IM%f8O`{zcG}w8E})arF{=g{}4)AM;SJs!d>73&aWiL(jlBQ3Gbh4V$n~Jb9+u9
z%=sN|VXcdXjSXh`+7w>YRCv;MSORs*d-Y5lj2eMVlWT^fBs#p8z?*ma7j=QmoB)y2
zxaxo{MYF(}-w1DB-lO!vk!S#x61V#Th~?YU>y*RR5HhjA9F^vR-*WlC)%CmPg&dRK
ziv`~0N;$piCnRfH^XsA5Z!;19#|XT$IFkY)(%A?9pa2omj$mhK8d5l-wD>>y3&_M&
zXc2Nq8i>LlmHtx~h@c5U6AMI_3H$^R_tC9)m3bkF$pV2F%Rx<IbGb{bed)SG=SdF!
zWkycF*H+6(0SCI{Vf}AIC;%j#w`DC}kQG}7&W<y0XB(Di$tO>);#<6t^f_lOwRaAu
z4@My4Pi3TNXu~^_@b%v`bF#(6={P!uqB3ZW|60g5u_58rl>`(`4w@KixKJ$BKpk`8
zJ4<AW3LXo02L?gW(hP`S!g6OIj;CW|&k1R<f!z^+vSIqzDPKJQnq(p8X<N77(RjWJ
zg-ii#bN7^*QmMf^=x{$s$6q(#7$}*b;N#=qaL{M`vp2QqbBp}N2o8kLQY@oW;qGwc
z=xiek=a*6S>3X#S@WCs|+9yUs8H_J}Q}c?xQfDzAw+aKXWSuArmVFUHywUP?Uk%1O
zb!&HYx5uaAHrVH8cb5gj3mqo;Y#(<4U)sLSsXt5epyGrZDMw+3_(u55$P<#lIU`<v
z3U>q<LjSBL6*qSk5pc9rXj3OVbp=VIP@sTuE^+ktDnPJ*N>tR?f%6(a&l=F^dtBx1
z<4E7jP!JZaX{{{rqb}PnRi+QCnlC2tJP*&MugV+d+Njoyz2O{(8^|R3fpmU1)Wxb+
z&St{dxM`GJ-TqtB*R^1asGd1hCb$feyk=(vrBTclHxN60zsy7D|8(!_)3DpRv4gOV
zSP|5gnM>!93%SDV!E(X{TcF<6`bb*6o-<n^z<G{2VR!P)n$Y>Ol5hk%+r%=S_J#?_
zN1ojRL9|=iKa%F2Q%g82vKXrhRnNxL5jI(A)`OHB#)%~F27=~4u60+jhLl;e$Hk+Q
zQs<@z^kC|{vj(!f*4x4TV`DB@Q+Ud(t&s&duvw2^>j*;r+p0RUBq2{nd97#gO!G&u
zy+#Gt*j)I&T|EnCqNw4{3U<yfK~MD6stxVwIdf0}Ht96xQq_*V3Oi4#C1r*t5yMdp
zBpx1TKWYA#b99Xke&LZnX}pg4S1IJwbQNQq^B*rBj@{gXkh0f^ixamwt~G)0lCmG;
zn>Q3G-|3W)ddDGNy3rZvZD+m+64ds0v?n%EWmxs)5E7<mzT+CUn~J;nwwosHqdevx
zL_~iTD3y{PsJtqL+Cxv<myX|ozlNP;uM(??l;+^HjiWKMyW@sP#2L3tgT9q`&IwA6
zWP#^J`4x5b$<?z?Z`P#m8m!_ED6EEDQlu>_)Cj#_-tcZ~7#iDg{`}mb3R{^(i5v8U
zA+8hfj(St6GZHk$@)$p$H9|zf{yXq7=2?_eix@)jBnDrs<qZ5YWsP(g^oo)(34}{H
zaz#cP?9RtU{KT7(cQs~Abd^peDa5?rAVcK`lJi+c#b%w}ZYMIjp>mTq9=7`H$Dr@&
zECJ|0cI~YU)83Mc4ci>!vC3!-IpYwhOiIB9PbF<YL$Gs%w>Sg#ai+1A2}kngD|t7M
z=%I6MG_bwNOZCjvxTO$|j{#t?iePs-<5d8I$KY}d-pO=rMBy(Pg*UiS9lw}jxiG}x
zsBG}pE@qJ!NBey@es+~9On>vG+#Xn&e(say|8{+6p}^c`gkT!tBUi)om)91@89~;q
zL3TbqzIxMk?Dh4)w;HFx(x+!syL|usZgP;mJIMMcR_S}Lp<}5dU;E;Q^r1Q_Fas4G
zUo1zW%S-R2>BILw`@9L*nxT_uyly)To0jxGw*B^*t-J!^%|wm2cfU<FaS<%}*(|VP
zwvjnX(n!|iH7!CeeadI|PhZ@4m_a8{z5qnq^Er7>lL_B~9cn;v0I$%ONf%#NBUhT%
z!-s9xi$9E#1k`-Drx2RMBVz7rf;*J)kk95NH1dM4O+hA7b6Ew631Kr%aUo%I(`g@m
z+E6<cK<9}y2E^@tFLD@{4{k3KJ2{^gXF_k+R4E2zD9vu_zRF_pvB8ZQy%SRiAk(fe
zyFqi|h0t9rinc}3`$1p3FN%6}e^FCxPE6ID(*fs0ZYiX<`cr9M2XDM4fm4d->42bQ
z<uscgZ+nuKKoUcIw4<LZ;?L(71X*2NP$hFs`NjO@LVbAeEP3|jWBNr7U>;p@g&&4v
zy-;bll6S{HU~+W3Zig$i3<%>v9``fl7MyS70}l7XRa@#M6M#jRM<<PxKag{I%JI*S
zw{)$uwl(CNeX8?m8(7LX%Gs3ELwnk9&al9iz=FQUD^)Jc4|T`^JlD5FuXLR%Jsp#(
z6<kHd@f*je>6YxvE>riB-BEoDdH+X-?12?RW*ltG&Oc)qGg0D*b?nut_t}KsVE)5i
zw>oAHc2s!xll)7Y(NMx38iE@|)2NGvo@tN}>?^cchN_Tm2TQQAxE(Ask6n#D5QUTC
zQU%JPg5w9-TPt9}_A~`n+`cOQ{LBQuA<aDqPbW8ivl-$gz?*J8zV1u;p}O>ictX*O
zmVZ&Pml&*z4`W4xTfS9RNJj4V;;6^x6!||d9$UBn!0F0Q8ppKoN3?Sh5-}R_366nd
zaDC_JRld{Zpu>PqL+0Ndz<p}T2bohRG5CSV<ee>M<?k;p6Lsm{Q0X{2ZJ@E3`b9sJ
zYvx|#xq}a3SH6!SxcGhabkOP^gCZa(0EcQ+@W=Dk*oy}fYm%V3heS+at&Y!};~RCu
zyno>mh!A!?>#${&Js*DReuG8e7&q*@bC2O9-zWOm@%acubFhdc*Xt$~%*7dh?cGld
zK<j=~5h_|-Lp>8Tcp#>qDS9TM!MFK*?Zm7!;(9Z?k=ZTEFX&TSM6}?nmv!XWD6J|k
z4(s+Ver~aBrTj_3CRo6q_o7~1$5>y`g{r+$jhkNkU#Sdth$}MJ(a)WOkyZNlVECx1
zho~8bfbZRYk6*pW9CS2uF}PZ5VJ;pGr!640)p@Ig_cgZ#GM-C{A!WGsB;V@?`m^=m
zkYd-~LBfHIN$i{B<UkMt+=*Mc<Y4dxlcT@&<IB)bu(LmqzMoUs<*(WZ1tGlUz;ld?
z@aE{8u~%E}5c&l_52o!X%}a-f5bVM7=rnHv7`sXKS#{VHTS66Y$gQEp<=Fh931bz~
zn#Nro0&<rA%zJ|tp)y~Kv16%!5T=V-SB!zgdmpWfbw<-7khyzs@pHQvG*cIk(M!UX
zcn<BX)I`49PC0$^m`86s9R{-a<6p!eV`<H;CUz)Rvv(2S?FsFyrHF@GJ-ZAI&M}`H
z;sEna+*J%?XW>~R0H=81bbtVd{FH_1BQ)Y9yNr&UcVXzfO9o-wRh9x+q@;@Ky7kO&
zHBT08IbjFh{k^bua&mfS`-_=Y@*nDu7x~gA#>R3We}{NDez-oxw_~{Mv{egjoaf64
z4~cEU4aq;;dZuPtWGx!DzNeEZHzqHP9mP35c!-mN`3FMBPJ{#A8XALLR^0Va)C)p&
zPn-Tbx3X4Wzz+#Qu}_u^`Eu%lg!YOou}5y#CLs>{Xfii=ZzQlxWKwQ)!x(YwWcE)I
zFEx3wUAMxFJVg+&S@+uS<?QFb8dPb5zZP`d1}-FpLf@7DRM3Y!w^$xbCXnNoz2{T#
z<f7Aym+<__b0ec4|B-pYorr_BbNFLIf?TqcCtvkmgE&8t2~{n9ETkyo7osKN>_XR>
z!wo~<`&uC?hWY)e%&f!y?uP05iuS+)Nt*jNW}A=dwU)8CcEM^kZnt{Btn5aAt*Tzj
zGi`7POw|cKka=NZ_tGVMr#7#NZ5x9HeSU>h=p(ZM0>SF;NT<a4w>9x<+)J%M#^0;y
zVy7RG0ilwQhTr=M))H?vNjy7_t(>7Xiz&irZ$cAc#{^+%ynjcF{xi&})7-Ip`i{Ih
z<n#To>GPlP%%7al7gk?c3%FJ;%tMB)z}dG>suUQhnd{E$M#7p)76r)g1QH+%A)&gQ
zKXZwJ@de&?x;}Ud4u_K9FS?+M-UJjDapEoohGzQgTAUXeWac%o<rm%F`MO00(<h{$
zUvFDh9k*@&SBQILRMhK~>P4}P0X=9)RUiXAyK7ky`lJG_!DrAsMFEP61Xt6_1*`2y
zAVIu%{37tBQ<tjdW`TP1N|f%l0u)@^t%uqF9%nO@mrwIl-@byznPF&)m@x{OK)&fH
zE=E)Du)Wt13D*l8Ac4L&E$_NA0|@-ltFcB4j{Rv1T+x|})D$&0o{yNEjC&3JlhrwN
zZ!h%Z^1ORkAS4ngP6J1^4|&By|A`O&RI5ZtwVD7e9z!~Xn3OLHq&)l(Nv?NNL=?+^
zWC7=|zwBS+DER#EZj~*m!N$SC(YAWz9U$-xLkbqKXMWXOqq$@LWD2kio4z`Zc#Fxc
zzVIEZZB=D{<JI9acWQU9Ca!e?b80v11kL=~i~F)Im)Lo3m;8uB$aQ6My%Mfx)sUGE
zf-$Vzm9zkFSnrqZ8}_7Pw##Dt2Gi*nZsZn|vHr_K3MBh2#(4vSg4qmzdqu!MwhtA_
zjdIfmU8u{%Y<=u=CQ{fs!>=NfF1pg+joEacJQ-fg5ghuiBzi;ttR%_3gXdzwLOGG-
z^Cnzpbb5L}IoC(R&u)RtY+B*;;fbm1PP}ycFyd9e!Ba4*Db90^#@(h`bmkBct&3A>
zPUp4q*(F!3M%645+#&xF4-Ms{&bp3+BwIB`r|9iF04lHe^-%&iIw-KXjM{02LJK9k
zD38RSlZw^CyF)GrjmFS!aK=WMJdqQs1UToVmvtq#kf#Fnnxm>=yq&Z?{#?e}%HXQ%
z)J&F>*E*6eHc=Ge`y-_|iqYW9wpMCc$p6j;NA82L8H<G;z_yleYNSLyCWCG1G*88f
z3Jh6EC>#S)8s{q-UBWTY1YOQ^nPpgssS`-UrbCtenZ(6W2CD8^WURuC3f+E&roTZe
zeUHU;R@@#)b9Sa|U0V}X4P&J|cP`5V1b$ybmBQZ%-}xxEiQ^L0_J%@iXyY{4*0|Iq
z{J|(~PFUg>`N;ZWsmF!tE6Ydou;YpiaZd@#d0?1_#DCQC79_^Cu8Cb)I>s$`lvZgU
zy`=e(T4%z;a_iBaEtSOCumok=K-D#BtBzMJC-tJ6qeez|TaGb><Y&7EfU!)q`Bky8
zbE6tWmwL)OtbDKaNTZU9F8?Jm|CbgWk|$CZS1o2CVSMFlL!06b8fxljOgz=0-)t@d
z??Uz~(Oe{)YUK+D-ztSaj}r_XTcSUmNQ%0CjqY-6=5LX~d9TPJDsG`TQkI4A{mYh5
zpiH=HN0`xm@X(-Y_f=g-{6jUMp3@(I_YuWIq*KA4j4=2J@P;>f@66IM;90DUs~5j#
zEQo0T8Ps#00xquo-);fEXYCrXTSX<_>dWQTGDZ~o53_M6cKG0?Q2f4_%9rTZt;8DR
z519~-I*Uh8*8eJ$7SHn1(r)qj9kPcUa_aQ@r{eomxnP8zU0hG!B>%a%)s3LklC}6a
zBy7535hX`)Df2tU4J_an^JjEq+ElP3GNq<&RY)o>tpmNwV)n;MZu<I7+}YTvYb9mH
zLH)Gc4GCrAbOZsgUiylvFJj~2=bm_h8kwc~ONIz)&7sGpANup<3i9J*!_EAG<^swn
zL7D~1>t+*ON$4bRBek#Et^Xul-ta;ThKSgQ*cz!|s$i{Zl@?6qA_BY+)yOp?#~qUR
z<=Pf8_P5)qGK7A01@p(|y&S#C8-pg$?tL!z^nx=Q+*z{uSfA5G+lw`*NKr<1)MgJU
zw*>7mNJIZBi=|nz9>eG6jHk2YjeC696znXVd6y$A4mC-~kF0mviDi5cMpF1w4W099
zO$I#tNRxNpPc^w%D`xz4iP8#UV`p%RjAT`+UDrGwpVpOvFV+MxiW@{I0_K&9Qs3m2
zzfBTSlyLIAWURWQM<sdF)4aTn#U5P;8<htB+56S?uZ;#WuXahcf*M*4tkitl-R3bU
zm-v2t8<d^+yJOv~xFSjt+xJOnVU=3WZaZKsd9~ZOEcb05IuhFYpELHDqF`5Uqc*A_
zpCvLXoGRK(@+WJ38irt%(E#1V^lrJ!Sy)`54y9XnbhC^^JiV2o-8QDCRD-fv6>gb@
z4RR?tuC2(6k=@oo8^p`{Yxns4YJ8^!9!L`taIxmpOIq~zpOwy<c$h#5t{Vq~ZFM8M
zl;)^Sdc6|EJxQ1U1n`p1uAB6j1Wqgge^Vr?fs(zQ8?s5GvmhF4(Ma)2yzvutUp8w-
zJL(yCqW_fVkTca863spC_fBQ?OUN}Rw#y+cSj%L3l@;#X3qA|Lkw?`dZ`*voyI$K)
zjKah1^hixVj>~vmLeMhxBlw(QOSw2>PtZbM>knm5Evf8O&&}JI^KM9s!)eHpD(q4l
z_o+5xB`Y3{y_yMbFs1#EnNZ6Xz1cN~$;3wRHuLsp@!?-(|6kmys6>YnXH7?3Z-k(K
z(osyOAah!-9jqCQtftrpQA(6db*+cK)b)2to=^+C6Yc-CIW2M02Tu&2o>x=9Ju%Xd
z^szmvbV{;c(5PGCfYlj5eC+Qj2tWNteZ*sq&9T@X|L$m=ynfyyGAU2%6-rK?fcy4B
zCn#slCc7|C!{fj}h|{(d2Ht*?e;;=^yZc={Z|J^SC{grs9MI0x@Cv?FttlgW?Q*tz
z{M{;cVgx@*J_Z|JKJx-IZN<G2StV47_MDp}#lcgbf2V!Q;qvzCA6`%9BWB2!Qh|?D
zCSP`fS=ejwU?#NEP22#qb`L0>c-BZ&Y|p?JHvK>b_{-y!Ma8!p2T*;{yZt>U#bfg%
z9E>}rDkMCy3pKd0m+VDxIa|t+?2N@~?;|scF^}fkYGh*y8~%eN49$#w$%;3~sk2=a
z__Pg*e25{o8#(!2SJ5-oP4exJe6N6e81KHxoYx;z{I&T<awlf?5{ebW@rQa!jkL7b
zs^rJEsDa-S$YEeu6+W2AL_2|;2Od@iJgH%YlVMwT>(bPT(JNu#cvSvgHNUsHvO!@T
zi+d2_kGa%(6oN%R5IgZ&BBQazm{`R#qQ`8QEbiya#H^415+><<>-trmfC5=wZ}`8u
z#_Q|ryJz(Ei9|;4zj6eu<m{h&=naki2j8cj|Gz<n7M7sh^<2b^uHalF<FkHBHqW5(
zN|}?b4`A@wNTnZ=+EdOU_?h#z4k9Cn&;u(w2UCb(#y<t8vO0XM$2+8#$X#a1r1JgB
z@-mLeNl?fmsFA9S?Eps3WUW9Z!D<0z{LEQUX1AjaiBx5FM#Nym%*5VN8=aY!vMu!Y
zEMz0eV#A!wYds-o_Do^|@snXgv*&w4wm<WRt_;dj9@rsjm1*kS7N<s#K!Lp_6;c03
zuEmdCnmFeR`n^nf-?npL!|fY8;520A<6Y1GvNtIqtMOb*ESj{|klJgYth!374RN|o
z;Q~(DjLa-3XD5Jp@=>ViwY$Q4(XGsd!*Bw3vB~MgyoLI+;)S^PdU3<TbLwGDf%wuX
z0aHy;P)N|J6bj{{M-wyu$D>4QArS#&4p}63-P)u;(p~=nB?e_!98NZ&21Vz{KqbwK
z@awH(lQ|LpDvoz}i_f$M^Ng~t$e+!SlirOulrk6A;y5h7GjaZkC4gR)y981(epzu%
z3f`%y1SXaX28&m?1HlY57<XGBNHp>h<U2R;ryL#8nH8!Hu=TWtG=E!5)~N0L;IZ<z
z^DLAR-s6HU(TBcHmS7xeg<MF*B1L56{-QE?U|0LH;0;s32YTrIbB#8-@Tb>s1Sqe}
ziH|ym3|ufe>@-ccdsf~@fMzV8tp9&q?gu4Zl#2~DD;n@t5{vs`zuI(~ZMkx?>|kD>
zbqO<L?*C_jj6_-><E5vlPcsh2=*@6n6}&OtvbHzl5eQY`H0pDx6G@p9xZ_R?b0r27
zANr;KMmGu47vm95*&W^QfG}0K*v@^{?U(%wve_M+j?njKha+zI43kIwn~!aDIfX=M
zFn})5u(afU95Bk#3ZQ)$lzww%p`^o8(A$Tue7#y$mAqbG<-Pc83E_7u2DmYF8)lSx
z`|0243Ng!xK)~{xgmbl<2@3v`K2i#-kMgo~mFH;PrgeEgcfKC0^5Zax<zKXzDJSAa
zaCBq<8#?c}?@i?&Z2RlCHEq37(~o3&TyqH07r`lo#d`;Vcop?qwhW>7A3`kn6-|yN
z1hDwYe{9OTautTnKdQp-dr#V_!DqL6nn-Y1&?y&6Vwfy%ru@zs@farersuvItG(=a
z?*+em3H`-NLo}3e>2oG#0UHi%XoC6$mEfS;o8P~1+ibRvRsa4kKFzd6F^VG>l3}>s
z<#FQ7J3>q+-$qQiI$PG`?c0^`;@9e%{q__6X48PuV3}IAt8FpSo}V4ZSA4VaGGmvk
z#E&;g;8r^nrKp1kn{9J$ehJWf4U)`r-l*h%)agbV#e7`!cV>6*HlA=X)>z?`eQtE?
z!?OplYx=@MsY$Di9`i#abY=!B+An4yFJ<W`3CA>+1<sj^Gvuzj%xjEO%oHW?k!KGN
z2T~m^9?zwH!BE36I)SX?kM}n*vO{@HKE#PUsWk@<TRIbn!yK?MEZiON?*g-ihjkfn
zs@=H4&SR6%EM}Q$r5R=mB)?0#SH3(VLVl3duk^lCfS=b<MID6kqjpJ^b{U_}4FdhJ
zD%$Lm>2v%WS-t?6xT&Due%l*Ymn2p3Nnr+f(ZV)IW}E*DVD<kyXZ~RvXh@d>x>Upg
zgPoGbm_a6Kq({+p{O*G`=3NHp)=GG|>i)KSpr;G-s}eITf&aDbRoTe-=N+=eGxnX}
znYMxf63BUnD7=qKqZmuE3vxcM7!BTdiuh-}?fr<7f+A#6nt&2Sa8O*wWnNu|Y^785
zE66Hp2P-A>Z|e4awIG)AnZ&8|naNM}f}2u%@p(jac426YVccQ=a{cs;-lq{3MpoR2
z5t)yB{#By?O}`accW#eMTFKJjg_+wy!LNF`c5doX_4zrb(`)tLFiqCpT;Z_zZXoJ<
z$1#6uUSgTd=q8WlGRT%bK36T1Y0npr9aY}gx{s={7k~KMH07yXv+;b8t<da!dRu8R
zIDi_CIA7KB)*-iwt!p$RB;`}wj&OO!$n~MP4SoE2xmZjJqj%Qf-8yU3Vwg5Q3>hBT
zMu4gN*;A^XV0=203y_(SA}=;2puGScmO&c5l956v6h!L_|H?T}c<Pz+DJ7FYDSnxq
ztK<dtzK|Dx9V97DXi$BWCJmkudM>%e&CLj(yLSO6Y^y#6o4d}dc-YV<(X?r3lTgP$
zm%I?B9{zzQFMnwt1&kRwi!KSmWhC!IkNaWk6iH8!)cTHhOn*aJaaXRZ^1>w%bgH|C
z2)~B*6aAjWy8pF?qyJYB2L$1WL~2MT_GMC`o;=j5widLB>w5U7(XBIF1-IU~1us?i
z0Hv)Yn0z8%a!Q?cAy?NtWE+0|bkROsjEN}kNAEUiAaocXTKt+T>H3M4G^tER65trT
zKWE7`*wfAR_+(@0mW7#~m3kIJZi%63)8|M_bGJE680JC@zQ=c!eG7DbRz(SwCYkO{
z<8B<NXEn!m4n;xEmb2MULO5hnA|K<~Jih8eJ=Ym3T<p$c8%n&@K5Xo~lBdXHK-#q-
zU7k4uSYC@#I#hp2#pF;Y`mdvcK}B8V*yC3Q-cY(f4a^>R>Oghd88_S|5|!2)k1J0a
z3}c4NdwU8GXk5a%M=TNp@mIjIV$M-Da|>W%3&BjAai=_`Nfc503LW0weGP4}+WYD7
znv4vmJ{#{BQ6f6_*`8MgsioPf)@az86J^;+&D-#U7`XXS5v`}3h=~U+c&W0ogk_9c
zc7>Zp6Sb7D0KOHJQ$0f!{oPsl)^T-so&^P22|51n-dp(pzCak+x_xCuX<~WNnD|Fr
zMmGP^8%^g470pIvdmIbb)84@y`iVH5$LDj1K|;O5?!Yt?%gj2XLEn3sY${^PlYETn
zB$)dwkkW}~Xib@n&_Q8n<OmS>ZAh?rGmP$TCHrO+d)x4nBK?&T7XQ*h^6+*yY9kTl
zb<Z%+p?@hIh5N@e5b~A^n)#qYnd>&_XND8W`lpmn2v|6qyA7g@*f5nw>FS|{=Zc6T
zKD1!--UhBYbK%2E;mWYKounk6e)|m6CMrOyn7J(Z2JnQZ5aZg&0+sG9q~&eQV2|d>
z|HIK)#zob2QG8|?y1RxJkdP4Rl8}%_K#&?5>FyW?q*J7%8x-l57+M+x>F(~%cb@m_
z{mpzj=bp3g-fR6=MWw8#D%Zjh@;VW2M014=8~=!+89}cySf&sMmp4*xo0uF&w(1)S
zH+Cmwjv3YyF1oMlwrQc4i(Z-iDrCLeZ5ibMXfhg$!ei8c%0lMg=M_Kf<hbic=iK0@
zu0sDEth*O8=rrR4_}xH*=tX+&l%cyXc6Q2YyH$OC8@(-a8vJlVzoQ{D%jk5zdppg%
zdR@686YgxZ4Rxrap0b^06!pgu4hX2MoW=GfCLS`D62zJ{56V<n2e^*$XrUa)XPCcE
z`*e&{LfGBfw2ptwEPVd2G0FVdA#5}egoBNwY;}C?Q{s)XfzO#IXXIrt9x16yhC7g6
z)~mjKzd3uW$4SXCm}OB_T}C57zGiOd5k2hxhYVqU$lgLgibu8(6s)IEYk{rtn!8&A
z#C9%iZqYltPxfwMmg4i@h+q}Mo)%KkA4xx`WIrAvSsdn@Gg_Jl!qYDeiG5X(6byCF
zRAJ>qkB@kHt#B=g@Ol@ve{`Fhvw6vOZL$KKe=Liv?uTLm;`c75H1y4Tcq(K(GVH^4
zKNY;N{KA$YxYG;Ej2pm<Pd!JgX`YE38X6Do$*kJVOGTaPyDFs-Fi3Ttrj8+X(E_99
zmB50cCC=Hfm3zZ53*GS8TEhaWN07i5y(XYdSjCWm^fs%lvh=nE9@UVujIsr(Q8?J!
zMn)DXRdOENR=D>E3nuqv2;EWCVwI}c1a~MQDGA1}`T2WB1D{;$mhz3C&Qb=ZCGVXh
z0T1^34egJwkk<R8_A-36Wl97^*{8Gjr)P>d*-~axuU~vlf$*v^5<a~7RQi&H3~%Vu
zmC`%JUGEygI{j&n-v~`sjg6t6@^K(nmP?!5r;wbHyj3;umWul!|FkoX4XbJ#*E~jJ
z`<Gj8c9G(>H>u!V!<$`^3iczp3dX|gRb&aeGdpJT*B1D?%Z4EXoPveWDvU*8Le`o(
zXQ!tf=ZNBq$VK77Hdd7qYroK5OKU9#%85TXxF3jrP-$BGX$G@@)pY&wwPpO}1T1nV
z_Pe5-ee{?|h={s2Zj{#KwVaHy+qJlgo2PgQdoxNl$?xCUEX|3Qrb~_nldC@>-FrWn
zdXB%3NZUE`{ywvKTQI{%NE(r92K%uSn^qbZ5pe%w&pv~pS=4gRB=5I{GvCuWGNt}5
zR)Wjl6L4RCsRB}Vzlm2QH8@5|{qapE{KH)qK%g+~{|>lHd}XC%&LBU#8{a8{jr>Ha
zjB>(V9K}ZSE@c$H7c9LcKa6ub6eF}I(bKfFTOD7R>}e##+nPc(;k!hhKTGyw?$Si8
zN>GRywd>k7jOTIcTw<<Oe^@m8eAk}5kdrRzrL;jbLNzZZ{uv6&)ESr=D)UeL(-W7`
z#&YM;Hq9_PUa*VEqJ>||7tlcvEZd@fDZ0_qcDKqCdjTr2D*pa9HCPqHJJfEHuCT<t
zpC5(-XS%lJ3m&;qDfB)e9S%~=)<2_B(~)Pt=JFD|2p#sfCv_Na!^4`OE8`E~)x>+H
z6fS17Py{cBZW{-3xjukqJbbZ9$Wz9jLpf{lm64@+Vo>*T$lSzwypEW_J}+0bS8Kgv
z29~*wwv`7F5w_g&hCeQh*LKb&m$#tyQ3BAL6=>)oB6|o@Q~T}u(Hj-9;T7-~^%uBq
zfE?&Wu=wl%BecuP79Sxme9(kd>FtbqN$ZXyb7`oTK@|E4vzDt6&QwXd^Q~8%!pCB6
zfdGU}C!;f4&IhDl+xkCCVx=Q0l-Z)Bq)g*!0O^t<L(KR<si;*0SH7~pm9ZqdYBrLa
z$rRl=L__<{;<R+gb0jvfVNX-T+he(%Skt(PqB7ew(|XP5aNxQEpgw@~d|`4Ba@`g7
zOp^R;g(q6PzA#@U^cu(4lSWqMABLVq{t2!^S5{^*&jNoWG1vVnodMowQH9qFBEDqz
zaZ9r8E{%eRyJlWqXeLovsOYIVwUoY|2lAFW+#PscZd)P`qnR>Nv)#zBZ%n%Y^76H@
zQ&9+fH!j<>VgH?*KxHF$4%aV$Z~gDwSi~tA;?EpAW}r&nbw1C>$fY$O3eG9`ajSXR
z^mO+whlZEW5mlB^W5~S`{+J^DPb|Fd;1p7)+|i$3VE;ZY#!*W&?fgn!?@v1?_=jiG
z8bqd=fiET5aXgn`CbUo46Z}2xo%{ScPAuJda7iAzyyG|Gv5m$$E9$Uq;I;2g;iDpK
zc26%aTMrKIGDIsfUj!PWG9D}k5U6EoIsJ^@4ZT<N%D~I_dHbq0+g9zjPzyU#b(L+D
z=-GrE$=JYQU(jKg)0HL&-!#Deh<)ui4Eo$g4StOjH8Lq6y8^(gd^BAp8&13f*Dg(e
zV&v^8J?%>`Fgc6Pmx3;fi;z`A5%-5hMWD)NmYKcp`2u@i+jGYhCNkEr=Me#I)7O}u
zgc5q@FSqyO5EJF_Utu1#lI8L7V(d-|Uz1y{SPCVC4Nwg=^y-dMNa(krP=Ev|=cN|j
zO-YfsKRNq1{$3_zgl88tlb~~1<%vG>bBUK1;ky!GxAF9qKtWsc4$u-Aw05TX@wb5a
zb_c>wm~M7dFSTL+&?LKSx*4JclnDLy$+B9H;I*G|_Al&t7UuBH!fXMVgHENG**@<{
zp?P_l8EtCY%uduJe5+h{qPPO4ArcdVs+JUm4X#55#QYbnXxVdJuPXQA>Fp#)qQ}Xg
zO>N?#d%i1`+oX3TLzw5Jemmp7_bfPnPqDA2tY0{JY-pLJ`{KNIFqF0vxGxJi5qAgu
z149J9%@C2t#fL~Kl$8HK-72ZUx%X@`X|Lh%@RH3fhD+!#UYcuwDk_ZOfvFU<mU1sS
zz~70_O@6adToP76pq&|(2d4@vBaBB|EIT=_X}{|G=>11AKaQ-qpHZ|xq6sLOi;iDY
z#}?Q8XR^bW_`irQjtV-|gc^)^z5mm^nE<Q><4eE8{<@ky))fY<IINVCtSfAqB<fIO
zJUw%M@%2NxI^9;(HzaKn{rzhv?xOVR)^}tSj{+w*2LY*bhr!dOW{o*G=CRyVtk$(s
zt_*s#N92{JSq$i@vu$A%yU8+L=IBP_O<9t$(mF+eU3^E=9uahdix&7V`QU_ASE{7R
zRlX?4s3VqW_0gjhAMDXb#uG+*v^w+K#`1}6+wjuPsEA+jewTk3`~<8RhNjCxvW;JW
z=;Y{coW<tWyPR2aBJdgBf6@*mL^}2>2&Fx9(PAND`1!YkH_fIaca{*htXOJ#8*pqY
z*Lv~-Ha;ri2RxfW#1%&zqC3c=&dmrzb%kXvlmKQ(SzV7-YNWd`r0^L}FC4&(M#;Hx
zoD(&oh9|QR%$2(NVLosYlvJJ?9M)t0mZ0fxsFuTqH_UENHR-?pfT&@Y$$bRh#xA!7
zI&b}eNT|v-FO+l4yKWZv<{djg=Zup;ex$8?U4PZfgB2~t+$7VzGBk5t0~rfW4m3e&
zG;JUo2Dcww_{`9$eLy)#S9KA-CVgN@q(TY=A4`yyPJ^W`rh#Q_?xNLl22MUnEa#sT
zgJdJ?WHS<cC>tb^@z<T?g2B`pbVpHR(N7IX;!)gN-%O5fds7N7J(x*ztOfQo@tB-*
z?<`JA)?^-AFFv>CeZun&$mj+3__wqOwXL!(0H3=*B8=JovQ}M#H(ZDgzh!``yM9xI
zpgwkOb{A#FgAr$~n$gZ3Th>aEX3M_{Y1@x-8ycS#g6G%ok4?pT0&q&0_L&7rsav(B
zcXlf}J+8NRN)LkSpU7|;;-np0IXY|zes1kMzbyro9n6X&0kDz17a+g0w6z-nLm7<H
zA#Zszx9RA1)XKdvdb@=HYD4BsT}wZ}*CJ<Ys-qVr7vokn3Ye9b)<|uOyOnE*Y;7JV
zCzkJsMGg-Sm`%~&deE^G?(G`?4hjYQ^t*&q?dDs*f@A@Cu-(2z=M*|&%;VyY>tU8L
z{VWp+1WVj!5@x=Er;j9uM-$Qy9%FiB59Azc@`k+pvkyC(d$eYw2u1bh8ZzmI7V?Sg
zKt!jwWT1_*ND!z3=gx-&5{0j9C~ucHIEe7^wA)5nT5%T>gYs%K%g)`u{(seWfL9te
z*>BYh1&vU9SK&1@fe!r2$&>pzP6aO-PPVQ8I#7b>zL?g2<V}AlDB$!9LXhudho5yT
z;}8g;fA>8d;wCx7HGRP%Xco^|mLt#bK&iVBh0)!s!@wa%7Hs&syZfI@7@o(7Q#*mV
z`K4)&N^D0xFIWOY%DaiAqBHWAuRIpc9uoGEaaWJs^Mt~VvSZ?&!MY@EWwc(?sP}Jj
zw3<yEsytuS^w6jG*op|^XLAJ%w_!>PFBi$!FnJzyJPmuvtea5jw^Ne<R}vE&o$z1X
z87G`rs}=9#sfpyX6Ctl=`NJ_vrPLJ3v&0AG<<ub^s<CI&O*@QAmHfp(3sj<;<*4-<
zH=e$jsUfNsudiVbV<bo2<A#$ltiV~ZaN$+OH=S_yMnQ&}Iif#U{#P$?|K9O}R9}P5
zg}oi-`%!YTZ!Or@x-g)I7B1ZjQJw4aCK!#Bv7wChYp;VE3}TBLq!UuuH}4OcKEeav
zNW=FSI1Bejt>tyj2m;ZjGC2@T$2@Q1FMG0r_!H|M|A>PAeFk;QMZ}-J0NSIvxNU{+
zihHVrP1ErpHeM5&4!&!2{~L82W<1-IQea%QDH6&KGBLG^T;>uD>Po*rz%3dK{6+>*
zjonu_pGLPiZk__4Zbwg}o_WINh}S2c&y7z8m!D`}e`j_x#}R~|C2Sl&j+4z@19@-+
zI$b7u*$x|N6&!<NTT!5f!fMVB4lj7_HUWuo5hhLJ(e-~DkeIsPKL&mTB>>Ia&w>h@
z*v{DZ=%2qM*=TebOQESmdjx1mblperEYfr>{o%r1H`SqVB;ib`ap(EpH1PH<>%ahe
zF@PoCOij#_{!If>)l!%fHy1v!F{m<P3KWesYs-(2P_V;HTvydWeiVy=-%Yhn*qFuh
z-aUL6N*7eiZE|%=<1E9kIxC9EIdfk?$|qoHyI)?~+jVVc2THidxJo?Z40C!Mqadx;
zd-KK9ndg)?`~8d`KAA21LsB6X756#6zrCegdhA7V*=f+_kaf3ZX)8qKbedpUIa4t7
zL@)~P^x<p=dY2i}`KknK{V?LD6DmG5Jbc>o{D3X+BW|pbk!0J->=FKq()=u4RDmtR
z0yvI2uj)4?9um}Bk$h|dIV5Z!GC+2N3*|AEpT{m*0d_eQlJ_-DUQWkcNB2uoP-#4=
z&jd1>Y`ri1DX2Bz$`YW@#`siSvCy`Bayd-e>Qe@VchWXi>cDbd%onYT-$r4qy|@*F
z5GT!KLB^uHNy71f6Au+3V<qWv8mosz)=)2}XO^c4?ts`%yz1Tp#%N;m(3#*1DP$?!
z#i#%_N96?&wS<DramR1_-epqk?H8oGim(vAWjx49U!8wh?%1;*%yF~Ly=xO<2kZDr
z{dENG52lOU^KxMK@zasuAM1mh-(Cz`4+mD(1RiUX&CBcN)_79k^b^Z+o74%ndt_%n
z_E+tHW2gqOxiJ|ksUOf=^MA-zfH8RCdQ58G+xuN%N93d-rr!&mfeFz>K&fSM1GPHR
za~k-1$g6&$d+NgU9B;%!S$k;Bbd%+>ZKhK1@)bz=bO_t8Bral9s{*Tn8%RMda!{Pk
zb!8BxXJnUI!RF=94PfGplbLJdz(W@4ly|BCmcECcDKBR?rcY@75{$M7jxpS4Ox35n
zI9jdUF_U-~<mfBT{OO<J%$D*oD~^)9(lYwwrmE>M9HD~c*$4slwdNCJ(w>(pv5fUa
zcZ|6jA<Ur;k<s|d%hZUc#pSNKzaX9Dbb^e3U~hfKfK#i$AX~xK+l*itH~XlkgSZus
zQxUSKqd;iY`Kz*rlxG+>nPW&_vi6Pqx><bGU@6LTMWgSzSir5-vuyTUj!WmF^8>EE
z;Gs}7fBU@>#5V(fdh;2}a4>j>(>Egfxj(yOVT9Ch(f@)sYK+L0^4WC+?Lg2tJh)-4
zpNeF){o!uA(RUhK^8Pk^+)6CGz3@s-4qg4uNp$KEOE#yK>uJ?ErDOh>xqkOqyu5G{
zVL!aBTN}VVME>L%@=e`}@lWUIbGpD{jn>+B;2o++m-xx=I{DK4l5WYT@lmJodx@c~
zXUDR6e+ak7uioWnNg9Lp?YKv|=kO02Jty_X@a3lo$bv*WdEiC1B+6a&Nlm-a(62_^
z=NpcVB#YILZib$;sB7JOfuR$*i8tHrH=ZT-_C1%w=at)&s0W`e9i6V#x<inH`@}X2
zSZiS%U`ClW_Lv6x1393f2I|@yo=?{!%>8@3v;|<e9GN#yS?<|p!KG|Z_t~Re&_^W$
zB?qg*lZL=M<J*>yzzTb{d*Yk<=choZO+7I1LB3s9qXLrD!CL8;PaXQZ=2Y_eGlO!>
zh4X_2W)e-;r(#hI@%3(2<Ga+0R^Wl8f5)#1Ur)#U%JOtTvTSAzn_&XZ`7^d2>zWaK
zTypG)XU=rgG<QO!>?W{X%7)L~=nN=wC67^U2%4Us^}8AO8xNGR)}AIoJbkZ6aU)ju
z@}$-|@Pjo5bF8{>&~*8`v5GIn?I3>NtQ|iQk9<k#a$7Q%Hftgrn&R%_enQGde`c*u
zN7?U`rw_A8dE%IvKBzGx251jM`j6<v8m5D6p<HzEh57@!l_ag0H*uGhqIAJh&6Kx&
z+71|tzlq2hmEyeuh@YOWzk?6l-Ta?{XU@FI4|`TS^tR`bn|>L-hLK}5995SAuQwhu
zXBxJ$omsvE<j7_O+O_Ulz&D~EPi+Pd2aYLDu(ZeXb{TIg!GNx%<4Rb&V~xAq*ki+U
zkoJAnN)Mq&dA5|273y3%h9+_tl=}UA&?<rz<@E!~Snrvw4M8H?cMpTV%rXvW$P_y7
z4|hmLqn;om(eKkU?N@qQd_Xi3vA{3E_pxg$OH2xi<jUD7r!;_l$1Fq-b=AV0CQ3Bm
z5}Ah?_|X0w-F_4G47Uo3w9=I9`EQ9Trc89_;&Oq6p)X8P5l{O*&5V>=k3FMfFDO~|
z_u_aM5*beONXZgVEpNEnJL*D2{;+&HJvV+pd4FUVly&ZZv~z~~laC%LunmA4chInw
zEnLQ<*u^>0W;Jql9V=g%>T-4)t*b!~2{G~W1G^?P;o8Q823!j$&3q>{lKP-DKa!N|
zPdWPR$ZJ5@))8D0M`hNPwT%T6AKe@s)dJSvnnLv4{cjFOpGlrKt)64cwc&veiP@`1
zzxGdBS5Xh2ueVPW%Y)E>%0lctq*30D@#<fA&?>|FCk1~3hKx`+JQs40<rR+iw_)Lc
ztDkB+k6#NP=>h~$d1ku-PY>j7ko-S>UZ7mPp7>hrad$Vy%Ol!{O)>21JF29UJ4{ft
z_f_V3<d#hEkK5y~wPq0U;rs!HPRxrpF=NS18-rDYez-vj0{M6+3;wKodiO7M;<g*A
zJbHO&mSTfbK6ou@`3{s8`K0$^$eHcfW~xg^2Uw}(?-cqB1<4GZ&10a&tb6U$XOH@)
z`ArZTYLyq8xKSY(M`=SU;~YwSVDsfyJJ54o%>cE>mm#?8V&Q4Pvi8p)Lw=@(T(cba
zj3b8%si9CTOegqWg5ZixPIDd8j(N>rzLI|`Zxv4V${?ZPSO5NFs!$@3ea)H4*wpDs
zwny2CYm`c&hyIGdFUF61aZLe_l0!iwBoCPLM2I&}Thk?EF}W;fWC6EP#w&Y@^45nf
z!Ab4+ag8oZDD5|!j`12wI`iE;BZSb@{HWufZa>(IJOWkhqt}nE2LU=>j_6Yd{vip;
zZVvqdxN$3$tqcK|NT4-eUvQ+NPuOqhLw{f&_w!cvco$Sefo$&3tYz_)!xA*{tmrN~
z&-RwtuYxY@c4^zI$$}EEZD<`Z|M_OLF+rKe>*pF|bFmd;t_Je#o5Zp4iuWclP`6)f
zzEMVgdq3(Xu3bOO%hAf__?UssJ3{hqllx@oA6WE3QwV{V_CPIW7U}F-L*|hsHd3)Z
zH6iQcdpKkNhWz=o{gJw!@|pU*zNpi(1!}<Q$8%nF+R*kQ7uV<pn99t2)>_|n;A6^j
zc&HqFQtcmzxPcgBPTmB%8zBMzYyR~6&Ez<C;&AcFSqGDy_&pIdl6<nEM>3Ue$GQ?#
z_4(4Jn^kbAvPcV{^F3%jA(Nu)7wj>J8l%M@WlJBg)1!|$JY=1R*In8g343+G?!^$;
zZ%Yk3pGK*&h{3b@{wETvMTTq~TddKGtRa|sJS7p9wC}+v)(n{{4{+O-A~@Iyo4*t@
z59^Z>5-unK>l&`V1cU28=$DO8pcO2)!(034R`!ApPkcT_b)Yf4xwI$PpoSI7q4O+o
ztpliY?i#M`JMzOcglZOndhg8s_;}H<a*KDNjJlpQ>H{@A1ju&M=y#r6hm7lkeMynw
zJ9%^r2uleRQI7+P$f&3!U&*Hne`K(gfV7oPT2K}z_3g_bd$>LNXHhw*i7KUx9|oZv
zM>cFk@`0#7CQ@&ewUr>P3ytL)9!-~<U4{|9io-oavES<klB{quEh}}fu&9LG?NFxC
z?iUR9LCeIz^)Cu!vl#zURDBr!8Xof`S?IGJerPkuJCQZF*g(M&^uZxIaG>one%y-F
zm?=X(?Wo5wGBBOOWN#t%ZVNxEWi|vCtNuyK3b&)s;4+=}XtSsp<Pam&FA*EGT8h+4
z_GZwOkaa67ju@zyo|+!Y6iVIBZK?RueHGZL3Nd`Q>2*YhbI3n`dLYFUa_n47u}1};
zYGIz)^TW91J~n%T-`<!Wk=GiAc-%Q$e=1wwcT%Y+#;R0ah}i2^R}$R%ykpW=p19*c
zh8X4`rimCu%9zZ3vB%{Of2BKqF}XARhH4~lz_wyu32@!LS!g=XvGt@yX~JxT%!G6#
z>l~abYv3`125Gq2rmi)s5P2hXz2ZJ`YDeg1*<EC{6VB(TwzqCtLlyzMd#ws>K9Dc&
zD;(%zZmw_X3`J39=#w%f9n04i&bL<)w^|B&1wxf(+yYb;q3azfJEJ4;zI?Q!nX1nn
zKGhq@d0Z(lnwgrK`r%yinePSBR_D{Y>M}mUGIC_JJV<F5iQP}4;K`B;ym5y5^(SHS
zhE0<+78OvT^cF+|KXlqQPdY;#|4TWTefYv*U*R`n5N=+ji0Z=l8^?CbAC3(qr6BJo
z4A{mqUa~}5W#JA+Mbp02(6xHrwvtV+X`U@^z1VdLZ*x_vm6=7*lF^X3u?L?Fpk_rT
z1L*-`h;{J8Pu(}kkykbThO>k}F`i8vXIt^9|Mj=dTk`@&u4sC@nrB`;)AwGbx=@-$
zI}9y66FE+Y5Nv0Jx$vE+IfbcC$*}O75Y!b7Wjb!x89Qb=9ScC>-<XlV%+$P{q3=2L
z2_ef-_RXK-$9?0IwGl2UlISz1_xunjHPU*~4~i~KNFaPze!dShF*SupU|K3Z2u;Lc
zLa|Cw(vT-Ckf#XWIm+s*hYGa)(8o{0incTH_sK!0v)|pV)d_y-My7x5C|lX=JroTm
zD5cLMKL~{ryKUSMoF*kiRe{*f=9bdY;MVy(B!w!qcAGTO(t1Ct#H$SDH?->l>X3P%
zIKNw`up#Ym`$AUxQ7<oj&O#=9sl(o{(`a8M?54i`C3VGL^wr(6RCi=#Rs}cB_S7P|
zu^(PotC8Qo&7eDp)QZW_CmZ?N50qP~f$L)qes{BsA-(k)Y0h>t0l|_ewu5Xzc>fHo
zwmY)p{&lmg)r?B^ATO{=ho9u#!onwB>VrVbQWK;RSB(OiSlZG8X=`g6Xr(j$e<ME|
zj6~bp@s3Hsv6fk1s<i4HU8kgU9wIOy!d_qZPXh31XUbllv(QG12EE)r`y!uoskgL&
z6#eRKwMbpwBy)0Nwp!+BdLiFL&#m};em2OhHnG#ZOL!S~a)n5Uf`x7wId=u%U%~dO
zIb^1QoH1Q9@=y(F@g_hr*IpBxrE(WCp-bwh-HPEw@BOt!A{I@%ivEMttC2zZJ|Lm)
zy?v5XX^;0x&CSh~4RyD`{<|*oF7r!TJ$7^PbWREB^u~j-rNWq+K^K9vc6~C-<AmL?
z&%_g<+zI_|_8Ert2K&qT?pSFY=JFNK%aTvobOMMa4)_Q-Q%1Wc`JRBVR$?+H>sRbB
zg1?(y1e1#thUC5><^PqA5NK0V)6KAB016Ea&BfJ~^b_vT#~XVVkIV)Kul3~7YfcYb
z17x`C+`*aUnNM6fyPLm&VaG4qAI%TU&E4)3`-aUWdDxC_?gHLz`X7-m;$WhPpp2E(
zG;<N3ao)s)yK|AM^Q{5&EHyWg&rO;^?Tf=-+h0BB0ULmOmP-x52OE}_|CC?{NZ+wJ
z6$BE3v?4s+RXkG_78VXH&>3msGyDi6cwPx5SY{UZ+3J=2P*GR`=Apd%ZgGsJI|25w
z3MQYB2Sn2xBZXhY1X?kH5JX8!jtiufkD(|;M}8OMqZMVHD6#1=K=<P=1v=9E``$kc
z@IfU%KY!q(-Ci+W@;ju#0O<(EMCKj#Ef4sn%<%m%$z8i7uqVZ%f4gw|XuYcevpb`l
zia(>^;N#5k{~;<n?<pK}(wrGtEf$y4ljU6{VwVk!LRC?V%(RLhsIf8`x{n7c8!QKB
z_+g@_gzULG%7Rk9?Y+i)Po<%ks~eFvtT1Ysmz|L$GqCreRd5smz?`=lZ7u>T$1eOP
z*U*x$!2E>choY6;N?UT=&9Z$@FmB7cS@SQUN2}r^CKvBNi_rnuZ=)+cbMtlgcxZbC
zCyg56S?nS@9N8dUI-qmU+@aUTIix`?yF)Qs6GOPA!~j=HOBkJzSie8*SL1>qi~Nt#
zcQ4FiILa!q1W?lrP@!((T57sT0i%&Z1?pxbQu^Pf2P-XlzHEOYrxo)$2|hK@`fngc
z$B%dc2I{p#n#ss{-=Cz>!XD~FMea>3+wrsg+Nl1Gb61_5tC^U(#-r2J%+79e&O{>~
z^&1Bt)KkFw*SBURRYX_wcx%{(N@Z1ZsKZU!ot^!*WZ^*Wg@*OUdk4SQYQ)}!G7IUa
zb3iNP5rrpK-o7<hR%TR9>l3xzIjN5BFtwjkH$W&w9=Cq&`bJ%KEdJZ}`a=y1eEMaX
z4tH1adGeaOi}=*eXOkr&lmfB9=#P|43%6$NNt6=zb`s^{oEy$&*}LhcNh8ub74svk
z*D<Z$nM>1FJgyfTSz(C)vk}O7TWYYHq<&O~0Hr_$Uw5%9{|en44rZ(OAPxR_*7t}@
z(WA8k9sTB~+s2*5o>t23onK!PmKd$6?WG)FomcvWXAq(BA#BsdU*P)dIvxj0SjMmc
zEvpU%fUy$!a+Fi^hSGFW>?a4Ghtkg3>@q4&Hnj(&^QtbQMolVv2@k<#wdpAd3IJlF
zMh`tZgw;7&S6>CuBDi9ETdYZN%Vq)v%#H9#0G3Uccjht6`IV9)7mEf~MM6u9S8s=v
z?j3*>_JNj<S^bFt!FG025BTJn+338_jX;*|ie-ErvXTenwW2{eYX`^|6L$Y<@MzC|
za_0i;zb`#fBZX>L_?=L8n5=f9x*dFY)86&^`=t6dz^#7KJkdtxgB8jML^6&K-O%aK
zf{%!+ITslP>g6TsnPvs3aq^AKEus?2jLpOMqzIkNjk^L^WlYy-qgvMDhd?}~crVG<
zC!YrR(Rp;UaFw>rgxn9r%0BMr6_e}Uf1&kXg+*17^;%1AkLVSAL&>*$|AT`vKAC)V
z;G8Tx$_3gskB+NtwiE3e>u+V8_sawXFCYl9jLmzof|ge@VJ<afWf#-vx#=g)iZfBy
zXDp0X-yIhdN=9Tf?a~*I%yhdqddUd*k}Vlx3LkyTvC`rvjF#>TwXCC~u3va(<p&lx
zX8gH(;+;xq?Nrfo+w4J6Q2kkOgrSC{v3Ze5e1R%4f9x5rI%)@UvDl6T&*}<YyMjiL
z^VMPn1v=?KZ*n_B;{;SWfZtXaIVRJXQQMa?$!dy05oo(4(XL>H6KwN-v8&uaODJHB
zIP~0|zCffy?R^5ZCcL$XL*oOE5T~IO8RHm9CW5>YDQlTWnK4JkeRMB0xoYU?l@8q=
zO^5;oB;E&hQhL|efD>37q+g_`Zq9^7_(<qx_`IK|<3@}bhQMYzuR%C)kXYn^MyIU+
ztS*12!(<X;XGR&Ojkazq$-rbXLatjsLS@FN9X^c5L;276`Q8HRxge>C9MoT8R%f{h
z7(x@Nej?00aNQ$K{4Y@DP+wb%c%hiSRW+T`TKLihF&M=Y&W~uDAneE?g8mcoVM6a(
z)cg-p{CmjPE|UgY5qm7hVc16?HR4r@;`3LUF#ff&C*4KhUgCN4{+8n!uPImWonQFt
z#ch)6e#Qg=L6dB&GZMrO%a^zGh+)^1+@>WI@xseSm$Mf*I64fBwm6DLtO@!|=;`?5
zwkeb|$F?0*9~J(bMYgTPGQtNiGP$olQ<O#Hs7ohDvm>hgE9kQkmnW4>pGxA)x?&vm
zFL`GsqqL{UtNbrrzO|gND*U}Sq5b;Gjf=eo;Ut=E$v(dSrWyl^+&#$T(z^o&qUwGd
zO>eZ`S3Je@1Rp2~fde+<pK!)}XT1fY@R_H+d|8n)m%LEHmzGVQd0U4ur8*j)3)Y2C
zQ<8ie|M>2*$BtnLi%q9&DX67U0PKAr9RRHKF6C`5rTc{&7j#|YfP7g|V8h9&=Y5`O
zOQ<}b^$7CVXPfmW&X=b!*z>YY!d0H%@J1F(q^w@<FzadMPYjGJ#^2nqs2VrnE83Dp
ze%irT@oo^KtDeQF+|;CRQKgYV(O(NGtLl?5dKuvzQk*b*VcZYzV>X8W06E3X<_dYQ
zfeJKHCkNKD$J$s!L(vn?F37~h{CQM)%0|7u5ckDND|oizK)Yx*g#tESuoJ<@W|!66
z-!;0fQe>gAN=p=gc$pC!YgDo?EZ17@O=>;er6gveey7kOrq40_)ueBXgd$<&RbtOQ
zUkqnz-35`J*^7DH4$SMsoqdME=%Am!u~--J^UBJB6<o*grgg4p;+whB1?TJa9b)#k
z0)KTv*25O#4?T(8;i_8lOY&y-)UX(B@Vd$C#nPJ8yn3YaaAX6<5z`pA&N^Zm-VqBB
zn2DDW9J<%g`2-T))Z^k=10-Gxbj029FQZFcGy{pjjnx>&5J@)zc(TYJ9~<ZWB^fax
ze*)eJw)f$WW5A-x8~qxqAuhB^m7|~s;hA6JWKQBvRAfJO;L&vEi{ioJVYIp8yUYSJ
zM`8O%GT=&9a3y=A;ous8Pkg11!L8F|xD0?TUWZSH$0by|2z=uG^)Neq#yp2qrghjP
zic>IDQV#QO0_IIhdVtAW{vbUFG-k$CAOWBgt`sy(kVInkYtz9CB7vur{;P6+FV^fH
zzhm5lLl4RnU$2n+^D{UuSRPtCi!F0OyG3!d1&9)p*CCba9e1KsZOjb%w^wJ)6m@`$
zFbAjmI?cET!^VLs!74({o^%Hb#$)&;#9Q-6Qqs5kndMTB5nPWsswQ=}pA|5YU3Kg>
z0ZNT7L}|<}FYYsBa1AA?rTyGy(x3w13R^|2FuX$4qTfR}eLFQ0dp_Xgds^2)TMppa
zPA=cr`0EhZo`hr@x~OMn=&cLN1~I*+<IAj|%j7Gwh+cM|<G!knTP`UF93P)vp|)f2
z*6<_P`xbV{D1(aV%v&j}N3;pTK3iKuh4oICwK->%VJ4=K0Kt)!ji+Bu5>6!B+!8E^
zXyxE>w;1}nA-s!0^OxQSp?{Y!n+JbLc@MhXC`M+}SHhmkh+D(`-0&EB+#14pDQtz*
zjRd#2ieDAx3&>G~WjuLej|mIK#wT8#s4++7Fi^E&@>7(@z>TGaH_l9SsqAwk{n_vq
zRr0>ec=?=T9I;N&EHx51R~)SvfgVeFupZylgOxBZq8ldKaLQTkN{DeghdZOWv)IZb
zIyQ5Z|5yQV@))fhXWqGouG-aRlz)I<x^De_qA<|eHH9j`uWG}Dwo`E23fCP>`Fp9?
zogUw@chr-|+G0TR{l~`jlss?UBnB<Ov357z-^TAFy8c-yg3W;$Q)NY>77WRh_C<rl
z>y4XOZ?JaH6V&DVw}dmQ5z;1g_S~v;uECE!X5qf`<5WnTk5SRd?+=D5ADU5YU~Q)Y
zB98ce9%(t5D}R6jW1&Cwhj{4i@<(~l(78~hGHwat5_gW=D=D#~cNb7DZ=@&UB__BG
zW~$+;%Qx%5nZ9sbVD&3%7c&|E{P#D!+t>oNeQ&$ZW;4Pgt0Sk&aMCfe?B#VcuP`s_
zs?)ZXU#4<a%CQgboo_oIf>r9(1TBYvA;Qj;CNlLFAD~sQd{tRiX~VTbjrjVar8aRO
zcC<abXzxV?q^FhI$&XHW5oHWpwNjgMr8vezU$5kMKc$_ArVjA+;Y^WHYeEXHQ0vUF
z{zd2hw){3KC#k&Iw2sChZ_frwD>Vd>o=cd^e6gE}ckBn5szNS&SM@Dbcoi<E<Dkc-
zV58~&O@_NaM2YJ2NXs{oO>h+boJ=x3@;@U~cE++N$h<%}mJi*eW#B8<HK==O*<b9c
zlmQ;>vSNePKONV**Z-6(LTX3nR*b?A^bAT3kYHd;C}&+=-KyHthT6*RZhs2at-ypG
z8HLhWD8>uHnp^bEiP+X(iZH^)UfGkGW7sIt>-sJ7>hmT&b+1L7|IJ1Xw^P?Sk95@T
z=$|Rxb-;c|x+Cb3FieBc3&PyVYsYWY@v3%%!*}c@ZLXw+#E4|S+>dFag$v*4Vqkz5
zA<3U#)v!U<(|*?MwS!<D14(~Cwx0-+ZiFslJ5B^~mkhNyr&QQ;x&s1(Ijb_}!_>Kx
zrIotCK|uV|$!7*4zB8nWIrIGQx!s@7l2fj%b77d!^WmHO4BPtbr^(4G98Z(3HjcMS
zjDC4h8Ye5r^wZY3;yAz4hX}f)(jZFF5tdVn{ir$?1P3R6Ph9Nk8I7@+zZd!_T_UN7
zZp<TjR$|X&Y-HaM$k!JmK@SSty^yCNlAcNiP7em1h(qBC0Rj&*@bfG1?02UO->lv+
zeBTLw!teUO0I3BigKu;gPgY-vHF*+`kB@`rwK%^wkQ{~KnYASgCzbYn3Jac8oLt{M
z-TRGm4FEh}D9TD{sq7p(+<XQdq-zGM@X;=LN6LF<JBv5cgzts8x&2ILg88>lKXPii
z=VyQWd+zid*(Uq(ZM1dHmEHNc_k-9;?*5BgqrjfQfDg`4?W#hzSRV{bi4R?2?0|Hn
z(DYW3O`M=u5wl#eba6*fk_e{4vUSig)nE!7U)J%NCRj_Yq<STe;<(xV3V9p8o@7PO
zE7zA5%;v8YqgL?DbR3AVO-#`KCzou&oxDQ<%~pH!SP@la-LK;i^h)=06fgUBZErlo
zISpX2Q{5k@KBHMJIgx<l@((EgcV*6vpUp?C^;;^1SEa1M8nD~;XE58pOt-|8=+QP^
z8GFV4>bg9iN2gD}N-Gfpd-*M;N#*wvEi$uzU-BV`IjKu`nH2e=Ry7vjpa>v{LQgo~
z6vC??+8c{U(jpX>&d~JMm5~c<2`yv8OTRMgPAwqq6*1RCPE1N#iT*x0WGuBr-u=|d
z@Xv@oE%Hh|mWZo*vMig>d*?YVu3Ks!ZQ_i6mA31QZP(I}=CDwVG9*|Iiw<JJzz(ju
z?&P~DTIwRqCa3s399ADh6I6*Rf<{KMZ;Q;VCfy-sd&Sdi+g|TZT74EZmavN6K+T}g
z)Rx|s$nIu=zIv^MF$Cr@LzYA)k8c42Dwpq_RQ9L=GvAPKE3_H9Hwa6m<=S^ws;seb
z>aMCFxzvd;KajIYkQW(5?G<sTb)cr5bv3;JSdF%QZTpoPmW<qIrZpMU{>VLf7Y$r#
zTFK6_nU{z7Ol$|t%k|r=Z^aa*S?y&4-th&Z35=yi^_hQB8FL?$E3h8%jRCaF$B*-q
zObFB76N>dWM|nRHRQ2oqiS$83;@NUk#ZIc|@+zA19A%~7p`G5{qP!^FO4Oc^w<oT|
zR6Qg7GG+`*Y^ylE$>Q!sFO}$c^?HTbzW<DhkU?OFR<l~El#i6)Bm~3Xi(00Z#_kXN
zxz(3~@cJc0uz+T=_tl$*dd()T5Xr^}DQCe@s@JQ>zUW;;vohVG(cf1CuLXPth#B^F
z-`dJih=?u&>{?o3`f72<%hGNn{=EaMJtGSWH{vgB9dj}zQ4%qKtOjn2gdD~oTc8vo
zEc^BwgTG#&F3D+m;Yj@ezSiK&JMw0_a_7_p9ciTbgoK4^Jc?*Bi}k91T%@Byq!x<k
zKTVH)1W_2uQ$Nxo3sjL2)7Cb8Sk)J9NgQaTP-T`)^&d-A3PTyvB_PkOC_v6$XC)sn
zWhiZ*fc!PEjxA>$ZtBN_XvW$=4hp|?!*kN!Z5<vy#`Gj0KS<NrqHEWU1D@F=o-@3M
zM>>w5FR!g>AlY?g(ry9BPSbKMd7hs+U<sK!-(Q@)x|Z+sCrlQcCx~QtD6~IMt9doz
zO;}|Iz{3x;Aiqg*oBk4?`a4`;`8Sd0iQw5?{TGr@U;w=RiT%?57VPfE#Cv~QQBncm
zQPcx+p$W7TLx*{T#PAM&qfw-vc&7bhyO?HUxKf4nCu}}rsMHSoI-&GW-j0HG1Cs#h
z^%7E}`hY|x))n483NK55a;hHIVC(qK(_5JP_;6ugtm~f(|Bz5q)NU;x3nwMQ>iLQr
zDP7stZJES)2adf)QH~wd;n2uNNA7Ra$e5U(ioi$Pwr|+_Q=5aD8XANmB0HnEu^0A$
z=m_QV-S34%)c*H?b%K1cXbox{qngHXvu`4DMJ7Z*m60>FS*JXa_*-;bo-LfJ?u#Mx
zU+64{5NUN?Le<85s1{FT)KM`3?eb72bA9@+FZ2C<e{lU`@hpWsV^@x9{1o(?PekfL
zv{uKftLG2{NoTbF*-pJV^s}sXSqmfH*z5q9l)yb2u&T8Z(ziI0o9huR8oAJX0`eR&
z?*64Ds6j%DW!!F14gTSLP{6%&9TYU@(Oq;&xBz?6UM!?~>woyVrExW?CM8QsT|E^3
z)frByPMQKY3oFk_%IUIP7V>2V$8mXg99y7zwh<&_@7_>$vwE;2xyn5C&l__p3ylfg
zR;!H%G!Z|;)bcAngFY^f(64x-%Gwp-{Ww3Edv$}V-8r)gLf18v7KlA)4-o+=IsSrJ
zi3OkB47lIik)KkEWhhUtoa`1`hYw0q2EBVbrK1WZiG>KoeS*seCJ}gu2LET5$*#Hm
z1QDY}1gD$%XRmMc-|tw~IG87!op<P7B;l?t%tA@p-^1oR_O0`-C~wM*uzD7W$xjaS
zXwX0Td*K)rM{C@}njW<;Hau4EhE3g6fyy|(DNY!eZjaz46%YKKREW057onDU;-1}g
zhyhKLjF9^Z1Vr~SpO3Dw-n$h91=nocn+W;bkbQUUXJ>+Gza#1Lzh-;!?rOXZlEq55
zwwdJH=*FBhmw;5mehrakc*D=%WN~G&`(Ic8SvCB>APOOWLBPGhIx>jjJ_|7QJq^ys
zDwf;iN37bMEpzQl-wR6HE}QFW(W!D?B*Tf?c<Jj+&XA^AU?2`xwYfihyCqUK<B~>|
zY!(|N-unXl`?7f<!pi6V?M%OTBZ+#@xDIgYs5xr9p6lQ$8mPbVcX%KK*>^e2;C?Hp
zF;n9~`2Nq=2(boo@>17t-?r8#yM72dLvKF|ofiPBkDM2r=A%CD=2JKjto5kS9m#S3
zc^~@I3Pgh*U8}<r#yE6uKrRhhHvFisMYuAwMSb>;WBt+C1=}7AYOW$K+(z@ciKzr1
zyW6{6Zs^$nUlUmAo{1`Je)&)C%i3HNUbjysJpoV3yj@v+dw9@S8_4BAFG135ljW=I
zRkLyOPu4$CKzO1|4O+3`=jaSM4-fJU3GWH410Ja)xJ7v1#~VT$kpOW28c=l5&SfE!
zbp@)XgHdNI`5{5lrAcWn_MIzx)ut29RE3AE{3ot*u^$}(DTj&Iu18Ic&|R#tWBio*
z)SUY8`t-xGcPD$CU%Tc%^NH-bb1VJ>>6`3?uiuY${d3@BG{(>4YbCQB!RJ*6&b%^?
zttUdL_Yu%&ao-Iv-=JNp0?RITv2VopVU<pxpC5(uxYYpq(>zAgpC&M9v^+O8?MW;E
z8d<a$5#NxKcIJqnXm6eov|3N8gMAb`@MZ!~40+J4)8#b)L!H^mZ{8)mdxPw5qorn)
zaRgTQx@BCozee1t8^#x(C?H)An7e@qrGEm^5gRBf7!e~mPe|kIhTFkf>AKLiGtM@b
zadG|2XB5DcK1u9f5fBoC>4@l%#-&HaDXTbpxK?9k4jryap*W=N`id)hx-w<9(EdoW
zO9@JPyQK(IL^9IiZa2<^c%r)0mZ<+MsNCW>>~A^9$}fC4V6{DX8U~29P=`3car6tl
zE$LnH+*|li($X$HZc9YzuCKhm#Y~jXBg<QCr}H(^5Q|vGhasSr`f@iX?{e@J!8kuR
z&ywJ)_@>ufl)ZORx$PbtKBWgQ5HsIR^y`wHZYrDb!Z3W!V+?LQPTzAZw9~?VPiND!
z<WX)zl)V6a)Y1kuw;(LK+m#(*kt0&ry&y=coq^M!F7x*+tD$HV4ygC%#Qm7TBO0_5
zZfQMa94XFK%ws%3^w(!x6i62E#G~hdD2?H0-0bBnp%K}~B&gFZu!`K=$78rU!!$VY
zi=IybIgRe4CM9-_4IwG5D&nH`C`n)*-x&T$WPq(ypJ#4v{0hH4hDP+TZ{C=(Vz$&S
z2F|b={qd8%EOV^WAje&&#<%VFP=`&WWb&lZJy?uyH3(`RA--URUf~+&eBL5?^!0LD
zk0;vwQ&g2%l&ApbxIA&D<Lp4pPEoaY+(Z8v`Op9Fkin@bvcM~=z|fMCk_L!`W$?^z
zfWVv)?0qwJW}0L=(mzJW2%+l`s^eExPq+W$Wa{^=8dG|J-iqL&7vudp=ScKFYK>2Z
z;5V}&;Hbk97Z|T&Z<Q1;Y4N@}Aiw1_7Z_c|Ace+(R!PWP$A_cuPyIv2DIHjei76F%
z6wr6uhCz&@?nW*qkuwt;;Y&|Prg8r`Ca|bxVVzAcxTL18iN~Z$Fw~38o0v$ZshJii
zG{Zu~ToZ-}4Ph988=Wmb<4&z1Ha|k3`8ewDVO6RhmsctL<v6!WfO7MyD5hK8;}N_j
zQF#!c^3<|wj!myF-9KhnU9T5Ib^MC-$=9ekp1+HKP?9K-qOn&L7EY#6CRmI{G2{N{
z0(&NW-6utShH6FUZ1K@&di3c2G$D$&%5U7q7KB2*vJ=CR0Pl=#DXlkgO!u+q@UI~+
zqwwID35dAw5loY2_*{47QtFzWqkMnoA~w@wW#;%pUxjisqF&|lIbV<@F^QFvc4eCB
z3aQZvd!xh)MBK6uB+TaTa0~^nufDy*#f7F#eR2pY9qHDPMx35CqBsu<bz*qvfx`r4
z!d*iC-s8p`OWWJMxH25>>-_hdzOXs=Ztf);m0a?&{Q}OB^p-gHg6}MBZu)cqw9j4I
zNp-KZ^OGjH^oSj=<IB$sE5H!xKhkw980jAZ*Igl_#DBWv*)eM5`Yq_tFm;_bu^H%|
zP8|&-_Ij6Nyw2-Lb9=6r`JGW;oh>(XeJ$>2jiGEz0Qop~c2y9-<Ylm2k4aOztjHt!
zyFapwS9q@flO}5F;s_M}k3#RvP*-t#XVAWjYF}w*fVu;1k<^-%!zOsiWpX2W^%PT3
zj0r>K6ZD;$v1wn`%jUL#9d6IJ{<31Rh8*%rHq>N(xk!`8w1S}HQulwBLWq#l+q8TI
zJ_Z451cd_Hdt=5TX{2OqMZl0LT%<0hF9@^x(RuAVcR8J>oIw)wldzr|mm5wr;mM7J
zPT68t?zTf6){|N`GB(~NTn@-;MobVfM&gaBEv|`*V3BhgvY|X0zi!v~NDc2Wxs#;n
zDV)DvS+61<eNFu*uM{4%i+5ur4l>Lfb_7OCITepHHqy3(J>|_v>aKEFHpGS+Xk<Ux
zK-_e6S5Fs}bRAqlYt3$)hE<prF*J?72&y>HgOhm_+b3Ti4Qgjnu0HOy%Hj7U+9amK
ze@PWae<Ff|1-y2i3FI5T=Sk7OU0qKUa#^J^pc!5Xc=e65%0mn{ml~@I3vsY`qov+u
z|D{r7M<w&4pa+%BI`Gjd#_bIQi<6w8M`&M?ty7JD%nf{x4OS)jGa>>7{@`D^<R;ir
zf#Ms3^j~$&I~7T2C<88L3L*~C)jGRAi!+`L2F?NQDHKKJ2*^GRn)JaF=$5@;-;{yI
z7T%RAk-r7u!Ujf*_;24`Vo2xxptnDi(X?SL$jq-b?jI~_!P=gpOaCmRjpV20mEpx@
z6|uv!XJZr%S&zIVrCHrC4ydx0WAo}a!ZE%2EAknbsa3$qL1et9>vKHntZywx0D)-9
zG!Ims<>;sH1dJsydo$+=2@+<tRh^*8AAKEA9lTM`X7y67)`G*>{4DPxXWZU=NYDGk
z=HM$X?eaZ*rF%rmCYjg`!#w8g!UTaB_MdgB-s@x5Q>Z!F<io`rQ%J()zrL&>!qmUP
zd4$B%F;;3Wm<BF;EBnspUnS=-TEuGupB+Fxwi_irnZa|fDT5TFsXum(WoSn35p98`
zp{HjuV-uRP3w~dW?(BlIwa=kj64hBV=jDo+186J$ydiXhzG;!75*m@v?FZTx92*d}
zSDWuE5H6<0$ra8<m+#Pc*Ro)YFJ!A#S(aF;mY;!oG#?!!-etz_I+&*dUk$WZ1enr(
z1E0@&YE(RHB~y9(!3(J=7FfSa1K0#h7+1G6W6FAR-!Sl2r*QK2xK?b5Q3m#EU%aNC
z=5ERH(Mry_y7S<1mv#Pg78uiPM@efCwK3ZEBY!X<{Y@F#jC@g1QA33xsVQ>fmgP-X
zJUBli(H_5j(ABbd1+N9^ee@kcX+8fca_d}ZMvVO4PAy+Byi4OrA1&zE(!~+kfB~DL
z1G-9Q+I>YY-fS^6XoEDCh)LYypecnkhO_Y?=sGAh`+^liF=&-N<4S3rtCu#+(B!in
zjQE;(H}sZ3B&>fg5w}Zv!p8&li=Q#d3O0%RJ26h3+>eaSU79v$fhFn8Mey43MJ1l}
z=mY(~-5zq+ZFZKI+4ra;=mjP}+tBp<hT!?Xcg6#R_R>E1CT?y)N61~B@1z*(xsBCQ
z)G~8wT?RnwI;2Q?(093Hj7Cplpl5~Y^sMh>RZ{2XkXdy}$%IX8*Jiu{r$N=bao~GV
z=z$**O%)E*y~KZ0*nOnwd~3YWEr)L(^~&B8_LSH3^0Pw+rmOg#P=Dl4tiDoKMdWuW
z_1<t~Cu_EU=;*fJ$faZU$h(`}$CCVGuOAB^Poy)p{Ds&^xw|Wf&~<Ll7y>GMezi~Q
z;LrsWAQ3pN6WAK>kO+TvqwvJ?3$`Wl(^>Kh)(?BeTj?heFl})Hq=2k=VOw$xiR2k@
z_K9Qtdvuo@Vf1qy5dew!CE2@hFiViPcU~D9ibg?6d1@ATR~$INa8=GA``Mev=%YVU
zmXrucOxW!Gn^Q?Nh_6{(29mH0qVbO(s@Tp*q)eiMZ`JR&_*GAH6-<684&l{3l)x2S
z_M-I~0<xq?&o5-|#h8|`<6I}&n3UQh_WS47s+L8GRK`={KP_W7*<pk#S)$Ke@qda(
z_C79BRyVp{Oty#wm-W(4hIujORwp9Zzx>>F!Q(MJmodMMs8X0t9vNKGhac?eKpG5V
zF{kPa$O!x2IZg5xucPRe*{iIuVqirkXpCccMv-3Vh12g3A%ZwMAW)YGC>7#Dkgo7U
zLXyZN_D3dvkeR5CXjVbPe9Te7yjQYDOw9MtZgZe{D|4l!ANFAdDVeU?oZ&)DuBZgu
z{Gp3u(uij2@TA~+HW))qeq)l~6;{<)5ix*dR<`lG|5YJfEGdapQRDwLgb#)e&6%E4
zxM&3SmX*c1=RYHJ24hhe9lo>@(!GCR0m$vKIJuK@{HM5yW3r#C#SA<b4D1RcnAQ3C
zkvujwHatB1t)e1kZC%|dk`K)-R&?Ome!o}-xKEwkF&jDB08kU_m^591{K`$j1qgkU
zFN-qDSke2C)iZVbC_$3`=qvGOV*Q&*%`DdI73~0O$HBmM(z(!`1uze;?-h<6#;|aQ
z?oI#k>PA2k;&sT6Y5bB*waV)dbUU>KcR6pX`gAF)R$_?G+$a_gd7{OPl?|-!%G@wU
zNu9V1K;e4RxM36gKc?O)E{^8;9uDsA9z3`Pm*5V;7tP}E;O_43Zoxy4ED~H67Fb*p
zg1ZJ?+yd`@fB&0zZuVk6+tX81-F^Dh>8j1pW_*~xzQoqDRVG4XESU^|5G7elI{Y{X
z@=G-RH?zx-Smf}mK=T0l&*!};9G}3xPdwQss{4yAMx3b8H|885)j--c*Y)AInGK^b
zC3kNN5#{hU=`5WxE-q)b)+|zA_=QKiW`^kQ%Si7Rh8%$$Pv9#Y;rKorJ^YikZ~xm`
zxA+)~QyM9kXUXBz63z0|>A!<Q(fjFug$lt77BP(q=e_27`OYwJCPOH--nD_5+n{j7
z-#tN7kzOJ$dvT7o0@!NAqahOCH%BV$lFIPGSYP+&dQnZN`Hsz*@N}7#3l3T8C*>Ab
zi0!a-flDflBiWYU5Q@F#sR<|07)=2o(6@&Nv3iokBQ?UW*9u`bD*&~6>mx?qd(-l;
z;H81C3QTP5p=ymnUjHj=LHk)aU4Df@))~>0d(8hm2*9rh6Hz<*im9k&NT!GyKpjj&
zV_mHT9!)kyQZ?@$4ESNUP~QR+3h`=ZL)EfIl#5U;NAggYy`!(?BxCR=WzbNwr=hev
z>+(Zo=pG)OFLWsOM5_mWtC6$!JWYAB+@3XWO=^40T1T8@In0!EQ7Q=^9WlE9EX%^M
z)XIQGP_KlmP>wnwf!rOeyuhg~_mr0-onuFT6?;8t!^V#<Ghyu{MaI>o!#Zav#{%RG
zE@@zm&Ecq;Yw>8_Ng6U?vfkUUFR-B>KO7Ul_g{|H(@c*ZJ<w%F$KcA8>cFMofMyEY
z7um5SAl_NJ>}}x&|6tGkr(41Z%&$Ej?LvAulMbW4t5;WnC#3peW;|U_bP&n}bm05b
zc@ofq$RbzyN8$C9W6?xvuUz3;(ut-v2|FYZcLz7H@s=8)dnXX(K0|F|yxtgW9p{51
zb9HRLMiQ|5nULqMNX@kZq3wro#6}8IYmw<6HFUt$7*HOS4BnA&R8K2*nx%eOh28%S
zj+CSHa_u5+qcF$5VQUDK5q?GoVDPx0jSS<SDwH`X6Q{eWTz9(liX@j{<eK)Blq&v^
z7j?L?6bH340Z)H_AiX>EXSCRV-1jh4jnGEE6FOWIj~2|D585i)pfpwCV7TYdW}nGv
zLY=+xUg~lxhB~e9@H2zFujlt|jLK1oen=RzKDPzYu$YRrGYfJ?t*d%lZ&qBvjn31B
z-f1Q;XRKL196)BVlO3FSr?$72^<gM6-k5;@N7Li`?eeqDv<x80cz0eozlmMaSNE}&
zo#BAcejVjOg$d=+=Ehkc?u8E74v$7vw>KREt%J|Zz|(c}dtEFC<<&A6{et&pnmp(N
zj569cgsdKcMuzE+WPcZsZFcg@T|htLhWJr@FfWWRJR^~;kQI{ASJ7E$HAZn9AAQBo
zWPD1o+>2aL-Hew}3e5K5)w;^-AHktu0{ZSU4I_?htVp=Wh<fnM{|+!^8JY3<B!&SH
z<5Ejx<2=?(@TJiIKqf#4;#Cs&dyv>4%%<g_FJmvax!S{7+<Nq3%1+LK9j_9!Cgljg
zx)?E+0tw#wXqHYsaRbNCz^}<++3)+KKL}aB;$bbx5$4rUL>~$N#!sEcREv*i2T%sr
zxImf~?#L%|G-Hd`5$f~ANQFm_o%Bl4bqfVVT3uw^<qj}T?jn2BJ5RojE&V(}7V|wu
zadfova{gmDj3tP0?>xb0JAw&t+C-)~B$v?O`Sd2E3z~4DGvm_S{^3F~SB9jnQQYLW
zqr7y66}3z0Pu19M@k%ZkNY$D<IViKKK6xaR(jQ^7AJ;ewaEZcc85tDkrxOm=vU>eb
zVCgRvFusxJs&P{hnu26u_mj$5JQbR0lFH|7FWo^Mujs>ufTWXh27RJQnKfz)>qD}u
zU$;fOJ}cne3?=CNQ}Q+NJ{=@1INY%x*on@D1u$46!7lD15KlhivyUNY^ouQ@;q^ui
z9H|KWp?!HbG1A&tTvo9k<?K0fnQMB!AwsA7TX@iZN|jusYDdN%JEw3Mh7B2`iFq%6
zj4<MLk;)jW<8Hl5Nlr-(UVLoXBFn?eol*ljfyl6wQp38V`E<tgn_lsqNoSb1IlwN@
zyxgB7!jemE<;#b4c3eLNcS<OPe!edO@p&kwPD465R$FWlgq(dMM)I~rPKpgVffU-y
z<orIO)YwIQUI{|{JK^cUF@qyOx|kdCcRBdY-?Vr*0hUoDnTp$c%Sz>8y=X8oWOd`O
z0U<_A><451$%u+_i#EToP)_4}>b@Ofk;m(cA{yisrpU4YT3>8X>XnH>9=mi{0Ap)G
zpNy|J<or}^w%utkM6wZNr_-*;50hzM^{MXOH#4uaI-o?Zs|@4hm!8EllAKIN_=$tq
zsPJGuK=FfAwsv~Y6{L_t3P$m%Ee2nY8peZ}xla>9W*uS4PQo#5D5s_ZXrh8%rfPER
z?fSvI&F3(a0SS~)gCAq2V1p#;2-a5TgFO~b?;+il+}G-}JOKv@)ENOesoD$7v+K3w
z28so;)bn?%zm=|i<FY-z4C!BZ9?ki3`jFEMCJ?MY*txD(e-ukKOC3V;Svq-)D<bby
zTrn_0%h5QWvgnpNnEI@A(&y=4*t9Kh`!K<UhHa#bh^~Gtk|i7<R3cr1mA9~B^z}Nf
z4Z(||I(%)^ubw~k5K*Y%TG=BEe1)+4AZ8}kCU>&P<-c-K^qW@1u^CBDX(s$<CtZ?V
z>cR1qIyh+3i-1h-T%F!LA`FMN9M|!m8R%Ejz<*Pj9qx-{sDTR|s|n&DGP{U`+0YwI
ziT8W~X?kHQx@QCf$dmVMFZGkNZ8XJrH^HsW3lzem(T^guRWn`aXUBfrN{Ez9^Y`}a
z9JDgC-d*(Y@r}QawM3*`nqN~;Cu0X|Rh|<uGDglnT{ag55JFLFuD5WCmbs+v*3?-p
zwsNIsbkNDELJh!I_L9bpe&@pqNs_FL9l*KIubij!*229Yo*OYTUh~GZs73(T!@f{3
zHU1Bm>*-bh&~PFKts~f!!BQ}_jl{MawcVq(IVb}oKO+pDTL+SGHnL>n8o8f|O3$Us
zZOMPP#*sSy0a^WtH}W9;p~*LV&ds`xK#(b&aXTX&{p!#P6PBUvPobgK>86cxla_5U
z)9=DDq(;n3``v}Uxeq@dDKNheKRRX-rB(AVMC~Y%)uO`#hrY@G^4FJGDhmFhwLa?F
zc86|<<Gh}^{cKA9ZdbE}r8*sA+xg#bOAVu!l1b}QUi15i3xQsHh$EEz0u~+sfkH`+
zeZ(A%!JmQuOe;4s=J`~cu0J6k+>j#Iv$_V}-2{l`oWPlur}v9RNEw0tM|>KISWEL~
z=5Vh}&B4lJ!2r<GXc-|`wc{>habFBGl^I>LjP}WuW`caNhs;V_W;cSP+lf4v4u&Rj
z(etp+jXBa~8T3Cv=c`ZjxPg#gw*%&?%caOky+<CZHQH6kPJf<^lvOi!=+AtY1kLtF
zDl;6hm8NajMCS-h!8x~dv9Ws4yK^DZRENC6tVqbY1CxP*pZaQoh#&ftaoYe*bXf8H
zYE&H))BSR5MwmvPOGG`B*nu@gwKrWfnzkWdXd+!G#sORLEjm`N1+ZUb)cPNL%qIAT
zqz1py4aoO=2btrdG8*$jsOYEjMbi0NMilE*u%WtnJdDl)WK1VTGnFEFC#enINc_wO
zWRiVkQ`+`VXZIkn)GG)oT2UlR<4l%1WEZ`gKAN>-IzP+~*%)3pD*orjGmev}k!pFe
z)?`1|ET9=>E^81a5X5cc4l@x6AP+UK;slOjLo+nQXTPfm0BB$p6(I@qy)5Nwg`^!N
zr;)TYCYF~EooUKge4%dQ8`rpOG-gbxH85O}9U?7;?8LOl5xuvMP_aZt0Dq69ajU(|
z^LXT41V&HMM5i+0SEnM+wV3KDV>#b5(>4DrtW=uoG(X`Mc`%`=yWo?Ub7s-%PXRYE
zEml!|Qp#Pla--Gr%LLT}$t4r#A~kP$HS%-o{J49*#((zQKrJ4$ufB(iN5USIC24L=
z33hWs0}^#^Z}IP*dbIN@`-sm9eu6E{#F+_*P}Hl!`0^^)#I;Bw;MJ#f4PSa@YZY{p
z3M+<-=g&TA2|A0CJ_=uy8$u5NRTnXAvW7Z5Y(QvRLs;$If30Vth{9tC`!>WDUUW~|
zH?+~qyD_`;7)wWYndwSz_fb}8v#pyRgpK|$q&vH<43m_Lc+P>?NRIuYb@#;Fz&a>4
z_%BS3*KJKTEmFxCz*O8b#cOe(cthJ6lOo)Z71lI_M<<SSQ_>h~x{}fyww~A*hG4e(
z)wx}!gZ%AX#j~$cjXA_U`PJ~0v|{Qnvlm0#FhQzG6_Mx?*HC5m(Z+X*r_`d@ZAqxd
zT)sd(*{P=Wz^7npgMtx@|C+)ywh#|`LU1|ZDJu?3tlW}ASnnOA>sV4{?-4vfPM7kp
zoKxOV_9wd2!3MD3O*x%+|D2k8DYfy91zxMeI-+FkG^EN?O625ASYSMO+}$%h5JnI0
z_Li#^d}OLUlkR;rF1Lw27dZ+@JeY7(*23dD?w<c84K0l{yN#DC^=aU>9;DnbEOWz3
zuUc_*0JR?7xvhjE-H(QIQA?sbi`@=l-m=AEY7_F}!JRqx0|&6u{4?DOLW6O;!s=qf
zY#)@NlS7BFVjlerT&XP8Ota`B^&vxfpP^DO1!HM`${6rp0A~Ai!KZ~;__6UE^7(Ew
znrLE(-G6iMv98rq7D&t;&_>K{JIC*+dF)!82>)>ng4&QCZoZc2Iw+@bzhRP6WPV<|
z8W;c-cI-MwYjm-I1cf1SQtRLBg}Nr!WFV~Q(!F%^-62afekk`r4NWqu=sC75<iBe;
zf)}6j+J5H?J(9ba*lpi2e&@Va9?hl(gfxpAw>d@UG#Hl|C6;(4Enm)>gspbgw?CUs
zo=U!ZBwGUp7HIky-;d@vj51j4A?B3EFZVtVuKWsH3imfDO3&Pj=JYTl8=NkmQpS1D
zO4=fP!F1?LXEJinAUtC3!iGtndWC$d58R<oYH2fJUbt#Abt)2;KWryh_EMo>`QS84
zsMMUv{mC_!4ZC&k=$seI=K;*M@3oY%QK4?-Ud44}9LW$_657j;6D%Fcw<4TBdh7!z
z?r2bGsalvNanUU5_DNxsr-eV{jq?ozs81O6$2b+)&^Oa-mDc#D>bS@T*1?awYKV%N
zsQVeQNT@FXP%Uw(SkaiR>G+khCMZRq8)1vKL`N=FGYa;uLM$?tMk$>BkzYMHVG+0U
z>0^Wv+;bs3b0H2=YKx<l4pP<^NQ`{r)t)k=vexZ*%R#7Wv%rf7c%aQ{jHVu%g2u*-
zli%`f63KX)P(sl5Z(3bfM6rwSSo~aoDsIxiV&Er4=m(VwR;7{gCS=^44jE9J#W80-
zW6V@VGbbZo0kiXL6AOq5&wr7=aQf@MgP?lFaiHLyQJglv6c^@FH=aIj(tqy6m0ge%
zetlxUCL|(C{ua)`n?#G*l@4;Xv*~g#xdY|Nd8xSc-Wd9McP^I}WEllFGP@pZwnI+0
zYd+ETW<<puyAX+#ky5bpf~iFHF4dfaSVMknW5r_Tl0<oMmDTrZ0qZ}KO*{{j<;B7~
zI^5zcE9so2><LulO^Y!xr;moX*1|oY3274dK%re(QZ7~tD;I37M$2rr_@fGS`SZ0;
z<yqI00=x&{HLGvsegzt<eW@y~>&1>N45hbKdAafW6#?7f{WuceaDg)eLCLv0wk|oQ
zU`&3#js@!#vUoFu;C{VYGq>N7ZMQCKJz273n+x9};s-Ek$SA8Vb~`o%iBalB%wxlP
zg_QL$TU0+V09gB~o~)S=ICzr#$O#({e<E2~KBlgOYxfS96id>l@6L+&S{j<OB$o`O
zBWJF&?4^Cf$d4QT(EdgUbhsJ+AYVr;fuxN=?`=*I4bOJ&162PCxVQ>3c0yypBv<I1
z0W(EcTG<@bGSShllD&^DGWpA9RX_hLyy@USfd5bqJ8LNFLE@lzIKamLo!N6rRDP{c
zb$x3Eom9NitC^s)cn-S{`xgUnb2%SyR3tC|*dnS+h{jtgrmb)gWq#d_Ug$45JSswG
z+M|S+L7RkuwWuBKfoB$oTNZ3@v4+T4Fbzqmm9wz7j4}_7ofU%cg`EFaP#VL%jy5o9
zjW#m<n^}8oxF8+L!m>P;q5?G?DKKtN;Mpx#@{kaja}MYFk4t22ICmR&L6R;38NCLU
z(nY!eu+>@g;P{-;y*pM)@(DcYhZcZWq7hpZJ=dW086`IypYRV#ov`J<q9$~W&V;&}
zNsu)}$Z0+=j8sxNk519*I0eZRyqL-o%Z>?9=`lpS<L^O5*nJ^Fu==nr#d%PLoP=C4
z$u;E51sul7Ly<=yLaAS4O397YQ<9oq34o=QrBxd#fvI!Cv`35Z1Gz_5;z(fp5)Wr%
z5_{{|Ln)E;rmdJ*v=zLiG1xiIc@!9tas+w+)jED{MySGc8mk)!b+Uen%-N(wv6SP>
zUDQuBE2!eL)%Eqad8?B#ds?m2_xJLRiOf!;tMPpI%rlC}&SZouE>g~K1dfxFMLO|F
znQ7vg_jRLRojLgN{YB5e?=8pm%y}Z5#WK6>tyS$CU2)2L*!0+?)-WY-#z#v2@l#!8
za<^)4^dp2;bW6ZXcV;H$egH~rRE9Ol$H%fCyy?=ygscS36~VMsDsS0gP0bfN;AVRo
zA!{2|th~J{l%$_;0Tc*UI9Urs%rDV7-%;x0KI}of_Dy1ENO%`#3vsgXQBEV1{?G$$
zWMoKBPo1`pfKYgWdYSWuD@r~AnX#CE(-0;GCLx7X3s)-~r9k7-B?rf7N8d&U!EH)k
zD<1U<9?dely-~JlSv}PXveoeH%T0XV{SoL)taPTTVba3q*C4FRMU$x(e7XgRZK3zw
z!O$E@gL+8yve?XopS7zcchGytw|z}N^@UXX;6*?_PtEP3Cgo(y`+UFsbo=H*BlRqR
zC=0wsV4i7*J)Pk6{5Bo@{6T*jH9H=*2{0L|KJ?8zU<mml=JG{NlZ`+(j`XA>cVJ}M
zvp!bO9G~}Y?JqrtNeUd-n2M_3EQw?nZ+a4k($@TtA{1@q@=v|xAL<BXOpao^U7{B$
z9Zwf_GKeD$Y#WZLZ%;`g2K#N0_nEN(ugs73XTaom_QtQ&NzB<!vWv{XWiesvw6E)i
zg#2wmim3>oU!GA_Z6v6gzoEg4!2Bo<#`GvH`yO>`rrD6?Yc9%uuR)@bz>Cpnj+{Hl
zI2*=NuZVH3<ORc=<;?7o04NYX!JPg}6s8CMz&$IaK~g%tE88Kpboiea!>KYrc_fob
zOiAWVy4E25Bu^@<uP3j~2CASlAGu+$R)y7dbsn!$X0QG`F5@=Yx;p`PzbRAGva@C%
zpq0VJaHb<00OZACd|MEuEnrw-QfT}6%Q<+s^7QW7WgQAWr{N80#ARt%hh*}o|KXPP
zTpX)9=acC5$7xt;gXHa}bWqWTn-`mu>0YFFs5J&2?P*A`L7Zcy$bJfj;+?h$4aa<(
z;I&$0C+{$gjh&`!bzC519mI4`$oc3xhdt4D4z(ie%4S5hFx}L=jL*p;1jQP9@KuLu
zwVtiusf-bFmhu<WOmr2iRqTiTi^;a%=s`KXXU>hwlkHi0T0N}0{^ukBllK82(}Ysl
z*KfoNIU8GTVFx==2xIG_-h-PvTOQOnd1!rypQdc>7kg;#x;KX)zp&MRiwtE72_+xL
z7pdXRb?H0a6t>dj&k6H_OiXUbd2tL?tmol%C3<}Ayw0VF4K2^D8r-olvaxAV3*8eJ
zFGTFQn~53V1cGg8?I?@3b?tTHQ!1+r^59+PeA7>GheKhyX1O=VB|qxDeX2_^3q7+=
zj2dgNMHf$UV(#tL{>`$n+$xyvUb%<iuB*aqHRnjm8rMY;NpT_8;xXyiexZqs0TByM
zCC}{ilJQ2^AonGOH3{?QvI2YDuT6+~+30LP-Ch1hNxBamRSBFr1KU4PBV<ax&z%_0
z@Y^2Hr|j2h3?t!lw~}M$nE3j5p$g{iFpB7%ue6Hwv7fJ`aB&mXH`dGY_YfwNJTRWi
z#lES;oEl%k%_%ss@INIDN*3B#MAFB}=dn1y(@nG4xB42xmC%fEhQdC7<gkfKnVB}@
zq9yH@gi%)v+cRK6gm@Crc@RJX@AiyR3ae8iqV7Bg(|gHIXeH`zEDn6AN)E&ygxWcc
z6M-HqRKIe!u9}M7L^6|W*f4m-yowVK@`imz`!k~nG8e(>o4AE`T8bk2=XFZn+b+%Z
zNZlTP-!D=GY;AmGD=$(9X+TSU2!C6DC!wh_yh9Trp$!=Z;$3uBWFaMXM{mU;%0E|s
z{bI5xNdoHFM1GxD-}T@1AKA%)Nj|KWEUR&%AP7jg#o7t~hfSNPWY}ER_bVGK?_elg
zB6}lfo5{l)oDq&>QEi1LVCI;l>-(uP^P|_)%<ee~8+Qk7lq-7oN9BlZDs0w!PV0<M
zY~rBDUa<;&$Gd_&Qh*J<sw~Su*c?@wT*`T)E3y#a%V5$5#81cy*V*#{na1=w4Qol`
zhnu>IJvyU?$t2Aj+MiJeQ9!^>^S$>{gK-j(xt2w>6t$u9QS+dS)e1{!Wjx}Yxk4x6
z-F)v{KkhggsGOt5{r%|y7D^Ixk@}HX{7}k4E&=ayBvXg(KUf>`spb}f>6AJ&@}0OJ
z3;PD>B?EE9ytiDq9Zze{Rp$2U<yI^WCM@t4h@j>n4257DSIdHzObQL}oMTgV1wZ>O
zWA(27l>H$?bScuC6vv0qO_WMZ=3MzjGpzlX;bpy*Cm5Q$S&U?roF1sfCr=+Q+mx4u
z<cKCz{Lxx7H!aO*K3DBf6a%;JA-Y7wbkSi;OhbBVl;b>p*9Hy?1s|vWRxCR@r@eiO
zfz=hI`_dEWk{vVhU9lJ>olY-Y3#(J9OoaPK#_SA@iL7B?Mper(T)7+q+XKm`hlwr6
zM*c0yTxZ~|?sx$ZXqiXc5#VOMVW5)e48k~>D%bw>%=vZKVz4<t?@Nf|4?qtw;>eR`
z4@pT9jpO2+%I^r@!fYkb<WL}j)RKMXkb>F<kEH{e&*~<grvZR*@eQ}y=LouRPIgN*
z6C2|RrO%{ZJAffwh7FB6$C`q5*6|>}4>4$GAKGAYuuBhITQ1LC#5OZ}U^OL?zj%|j
z*+?cw)kXTE9Z!Qb+dZ3IMUy{_@aFG2*{g*ILN^&cPGoO;;;`CsxTJOM3tQMpTXaXs
z1MzOn>U+kL6zM&}gA;{{FQsFns^!i#qrBFq|Ct^l`jCw&X$>Cx(SFI9(mC4=BM4U7
zYIS5sEGpU#;zX+!P}-&xZMykdm)9x!i5PUxIZgzE#w)pr?b~di-DM3`;G3fr108;n
z>1<fIO7U~YLMGQJqodj9FIA{rhy4ZyClOGB{7KjTRe&Z2(c^_jfAYfE$HRNm>0Ma;
zx7>y_DxpOKw~lPQADg1}1_QSI)cf<%^C%17AC^hv?;bTmg8YKoxh%CVpe2m7t!GLi
zE=`o4f9x|Z*}6fTuTqT=JESJ4DIS??`l^3Ma%Ok2n@=k9xs45^I0ntkfl7;C+lzxb
z9frZX_(#q>rAPP)9$&~KpG8?urb^2I75n&v-G^{El}Hn;;`lPWslIRAV6tG)o`@62
zA_}&W7-z7{2`2j!nKG!iiSECA%=>YDY~3I}45tQ@H<LATP0S%KjicRdc7?*FP0TOP
zlS;|S+x=mQLb=6-Ui=lCkciQuz9P0}naP6*nEC@5B5x-??_#>s`@0(;y44X$o1;a8
z%h<i{*5=C)`3d(#hC#C!BTOD26!H(uuKbTe?wf2GCN~$p@pEqp0k6uFLSAE0*gAA(
zUZ~O1=aBwF6O6nhP}O{`H-PMPH3E4t%E=!AI4!$i+-^s@MY6vFSI?Fz&k_nZxbw=J
zXif|p^#!f_!f;3}Ou-{RHYQM<PEHBfsrWZ>V1q-CCLoJ3Rdv%|Dt|H_;9l$R+0Ewo
zB1;o);OZeZ)V!UXlScC#0>(rNY>mv(W%v^M`^cilIS+$|%5km8Z<Mk|Ha~255WG)G
z2Eq-7GNiLV#RqrGeVM^TLQUE^X(ZoJiw;BhGffLUWnST3`JTLANIlzo@0aKD2O34v
z?f<y_?-`;8r4B~rI&>b&LgD24Ku%=q9KQG+z8aU4ku`pVJZ*iQKmqU+q8An;ED1L9
zkntK$*<hmiAV(@r#>|mAPa203i!$-9i`_;vRr4v{UO-SLE%pTgfM*7;T$1Xk-$T{@
zf89j$<3}Y^;1QB{#W*HS&fNk@_v_n;q-_h7b9_4F6ts|kl^G^+e<e}DpBFGuS2_8<
z9?Dy%;U7<u$2Jr;@HV^Bna1VNk8WVLkRDqM|8igQya|B`fNmaSZ_d_`P))ezLcx}6
zHD}3xCGlfg8(h3l+GCL?{Z`zf!^{R+lgp6;H_Pk8`1m|L+oF!!m;qG|@2H-wyrQ3q
zVkVgsS$`ffa(z)W3?Bp7dgici=&7%_6}G*SuRl#!IOk|?`FT8Y-aVLanW<=ykF3bs
zd_DWR{NiVed!iC*lPBQ!A#e`Uv~4EF@s~5a8YP$=%l9)^f>dUkYz{@_v5BuXhKG6Z
z^E?QD;dy#1{ykQ#H@GTLw8Jfl{R#bPv+B{E%y2P$+kw*9hi>Z6x{xO?W|bDmOJ2!Z
z(jRkTn9=Rgg@vC;O9rxqkExqtvA0I!Wxq_mX2luIN|C4BkC88kr+HGtSV+D3SDPmN
zm6s|$uziPH!wyw+kTsrq3Fiy>*?qWrM!XS3xrmn4qU0cC#Tk_vZ~mUcnvop?Kp$^N
zFUoWB+Y6>_DO&4HwU?>8#$U~IzTTfmbw~sHeJ*$&U}X8%*z;-nM}}2_0)%*S#TsRK
zA&|F77&E%lm#;z2M1p1eM$kBn!2^S~%QG$bjYS97S?LPLXX3L8*u%x*zY7dK44vWJ
zeDvEYMR*Vs9>^lV$sB~F6T8u7Bu(VqN}(^+fxp~p$>rn?bop4O#A^tk4VOeW$zutX
zdTTTDsJ$@~k{BrBtNKUUv5A5QbwJHQW(R|Sd~wdQ3hM%97tp`?H>JMNHayB^mr?*C
znmB3>cz{UEew0wmgCw4^-i&lY%GxFUR&0iwAJG1}ep^6o2RJjebOt$fjAl0F+Iv$o
zh!N$^@fv7@P?M{z0ad8gTd(YCFMjUwpE#6s=qWQ8j8gHmtVW+I<T;5>NKKZV?Gx6M
z;Rsnvx`H_6bG8Nq@Q&Z6<rCLsCsniiRii(K*aovS)5DuOKiy`|S(1?}$c2m;!6~R9
zGodL$QPRn^(c<N+W2(*xOP+pCAB(+az!jRwG!Uo62oWvtJX^tL`Ao57NM<@Axy7X%
zPD-`@5b<YWAZk!QnBJ)^iOadt3^J0l7wREn+{G!`H;NO~vL98CL%a)#Vn-W6miKsM
z3i{EM<)x7D;@LsugItW3G#tZK$oJo>xv6wR?82DG{YbgjV~`&ecX-oJnp3Cx?LB!0
zCKV_(k|B2q)j`tNj|sEBIo$dzTJJm0RT#Xm;?df-16-uC>BA}K@M@I=2?7m6IOfzs
z+0NAxRgsf&TKWjCcknD+XKj>!1X}olnMn|R&?b`Bj-Z9f9MD_*AW14Ur3~_n56MnS
z*&=G*Gcz)|O?B^8d>~EVsM6Bn@;K>Gme=2@e`%)h$*Fb&wSlJs@0&clT)#8%6ZAR~
zHQH_Rkb?5e3Y#EH#BHQ3ZmmBno!6k;4L{-FpQ5z^?{l!}6KVN&L>Z`EFg&>y!Nt6L
zvNTr1UOJ<#I7O%ephZ)!(;c6V)wbPOBRY8eVm(G%Koq#^euFUirJttF7IjHwb+jiG
zOIHlL!rNs)&Xv}K?z4@TH0EmYwB=Y{?M+4BYf{+Mg>cM43nn|k^`E6r3~{-#;4F(7
zu#^ZwpqX`zX+&o_7iZF$h;7VWLXu(?d<C*uI4TXdq2*5}eD5BBS|#{o8THGb+2hB-
zp!^@y15_VsT{Fi@KKf4f{^C&!is%Gv`IMbDi@T2)M!t@D$8&b{OI`6W!p9cg|NT|9
zYL)|k{t$)OD6Z;%zwoAPM!osYl{Sa7<Gf6n2G~fsnGtjq|HmffeH!SMHy!hPn0#se
z#6A!K`=_m^7xm4Gg}f!04r9<peZ@X?aL^R{R4idU%Lj<3yVf*6n4BX$nD$EK;4fx-
zLI>xcDM*v4<BDpu+^wP1(MYSf8qk(KRc@;#r{E`<5v#w7;>4u;K-2!$)|3n+U3#F;
zVTPY{tPKs|89~>cDz(XH2cMV^?vC|a1WpD?3iCe&D-~#lJr*iHFrW#!SMfRgHN&R;
zL?SIZFdb=Ie(8X#PMW-pTMqyi2{C+RtN?&98;gcpZ%IE)b|*Fkqh8l3w6}zRD6jh$
zPlGo9a$`qLesN?7m!XIumCTlSBM0G$v)n;%SB2eR^(3uD)9z^1WyfKI&no019t3aZ
zPswKLn+se{Maruz!u04%Y`vX+pAcF6-Dpl~k_TBhd_6v^&VZG{ONqQ@ZR!dh{}FO`
z9B(UsR*&~1P`H;z2>iIw92Sq0Kk*)O37S6y!wi!jT3N$xV*Ar{7{=Pa|L~xRSYPi%
z&m5kqf~5v5Mj|7b^{079<rt{Uq`-t~BtoH_Q@nUBs)_i)Vw#KY*=aJZ*quN{nC|_U
z4OKa}S=i47`uX;n7mB5dRd-M;XfL^X*;C+tUFpd0$}OOuNbBZ92T^iIov(ugSs-VU
ziuLtF2lZmME@icYm_=$nL9++o$IY@x_e^-qq`%})ex#3^<hfdTR&<2C;ptUERCGLv
zgEej_>c~@Mi{M8l8T$0GUc8y$wlvA|M^Ry*gJpb;VWj)*qVp^E={AaVfn7vT5jN=N
z$q_-xVFh2y;~X+S-nmBs@S%(_^_3mTkc0#Ap|iN(n%~=95#Va>jtYXcnTJfk`p}u@
z!6kZPSZC)){lC5s0w8#yW02r4nWrfZ_{(Xli7U4>rgsbt4*p6>To#2qb`&-$AAKeT
z#kMOCaqs3O)0(E1#0W+fIR;3W;?hRn3@9vJtTFdjeZ%J+`^Rws6#)G~3hrk=d=v1a
z;@5{yGe5M!_9ntdra`fYBLUxeXxZb*9Q%in)i>@EqyCD*cS`1u{D>nZ?tFS!<Y%nf
zG7&F6I}_;Sj__f!6ie|#4qOt;#7M1C*uH1voiw6hT=tIXzpC-M*JVC8RXh4|0laHv
za2vy2iUd+qkKoh)NZ%AE`xcgA=v=dnC!hljc*TO|k;F4D8}td$2id0tgUOU9S8>K4
z>kOP1R-DAZ%4GeXzhnVdU3TI$2M-dY;Ye6KZxrW<=Bo&8q698m@T}rau6ofI{G_-!
zM^WF{>bU7KWZvJ?Hf3?w{&}kJUqC-RY9sD1cc6o)NG<exAE)d~Y*^E&{8_N!Mt+zL
zv)y2jA!evcbxj~{J|@gEnC<SbaG@PpimP~>G!KUsnAY?|#PpqR#~UJo6+^pAl_c)@
zY(;QdTs8qHDUDdrVI!&L_dT^3n(!|13>dE2su%cjs~PE*i>yTq!sFR!4IArD$;jDR
z=I0><L76`7jhAF9zA+%|GK_R3vB$Kjq+n?|EKgL<Ed<RzJhK1^3wWl2mVJO8mHB^E
z+_F|8)5G}E6b!E>Yt#LD>%&yOQR_!AnO}UPA&+EMy2*P_hO+<o-LL45n02NKEbl6O
zC6EBDu|v23clQjy{?=NRS)Hbk-|KcvjBjv(U#&3wf=;AfUK+u_PVsR|<DlG(98n5(
zbsHgF*e)sETO@voHFGUP39Ih4yo*0&=c8-<yu`7r(C!AL{@CxWXIhp<(@+=p_@~~u
zvq}=2>?%Qh(f&j-0xNf;0);D0!L*f?5Wp(os|;R;-~LAWpg9zgjXr%=+AaA20anus
zw06VC%iA)W8gNKe<DC_s%oNN*Ih9crN^0dKz|WI8*FZ#DId94|OxGA3k-vDD4tDdw
z-e0gmN%Cg&o}EMx%Au8@hd>6=ckNswH!TdYsalY8i9Fp;-7v9R&9<BZahJV9)XyX+
zU!PN~eyH(ZcrzY-6+cfSx2fK<*gThyq7_S^XCz|~jp_aVhC73)jy`cXm`&=B7h}SO
zA0S0lCeGy^9>pT?kxs4s>HWSQ?_k808ZxH{iiwZ;E(TSq<veJJw*Xl+ro(DrcD*eT
zIk`;<(MR9`_eR*{{rDRj8OUE!(F4Is(v6yLS)r6GZN{#58cK^5eQxW>gp$6baA=jQ
zKz=IdyybsIdk%*j)4NkxOB0ut2prp`Sb$}w6ye{vr_Pv5b*)H5$n}7Zak$Qo?z0wk
zI|Kq(awpP8+Jg0F4wyGaixL-+NRhk{1Z-|NyTZya&p{tGV-5#4tr=YwqQ_g{BvnO!
z7i}7&Ox=dAe`&5~?ERMHOzwu%R$~idI84iJ7)q15c&;!|>@~UW5rL_ru+g2`Lw}v5
zeR?YekhUQ2{xCQtfM#*%UV7hb5&D<*>RZmDds0Om5k)l~ZDa&C1*+ykIA`KddMaeG
zcF=#nKCktnbj*n<#=7j}++&<d1yd<7IYFLgAPa@}vsS0ZK7~D5eoamzDm17SX(_vV
z)4c#*TlVHL6mtoG<hJu;xAi9M5}8hA_f;&ennY&Jq@hIbf0cDosP~Q9`{%)^1=EJ<
zxn4+x)ZE*!DcQ*{-iWC@8%lr561Cl^$VKEM#X%IstMm-z_yp6qZX)?8hqo<{-2)!n
z65vUN*t9_Xh-EcXc&r(Nh1(0vD5hEQsOv6Ha<mahcy*kIM|nQ{LU5g?Fr8R6!$ZxN
zXh++8XU>d!ia0X0fdFxC14wzJS~662c+69&wFfea^U?k5PL>ghx4j^6OqV-pq!l2}
zg+sPfxXL3zK^Z-lp6iJJS1t{d>&J(B;Y6$D-$z0~ep;4;GRHr2d#K@6a!=dF#AZeC
z@2@FG%&QHSvPZD${Q@%o_ypHhV!l1@3~%A&w|A7i@5MJ$oQ}>9|2T>5ydC`N0@vi(
zp>UFz)HA|GSYs!667BTY1#FCdfB)$c(j0)V77}^O4edCML5PgcUTiL-lPdxKVw6@}
z%HB?ZHe}-zHj&z&lw`_T5l*d54zV~G%^x|FXkeF(*p!UVRvSGwc|zZ%=k29?6&v=Q
zJ7`&%W!|=MPS-o|1D=F<=c>Gu;QZ7-?i{CU237+GbC1#5VzJ19UNOs~N|GZnKYn%Z
zdW(81q<bsFrmuEn{wBO0nw&U&tw@;zuI-Xf*d;MP6AdjpUC?Pqz6_!kGOf&5O`5r9
z$$vod%%R(zR>KFe_1d|$=XmlF2`Gc^vIs!bgxt3Z+)N3td6i`otKRwc;_pR`6VfDO
zXMb36Bo#N&n8i%)AH&o?dDUd3%?lyJ*xiAD{JVk!9&jd&_haNt1k)&|T$sm!y+Fha
z$!W+ubL6H}(sDZ<YcLjE9fX|pmk(cYwV|wkn6i!3d^B!U_TsLXH}uXJPH$5hsc7+q
zWYC<a3kVc`L^Wi9gP1?`n0X(7bZub-r;mT8C1p4Vs(uCOqq|z$w$mti9VfP$M5BAm
zLt(Sf%lR*fzg88{o7UmkP(?eAJgFCiXabH)L;%lC0wX7GEH4O+PsJnh9>C*6Gk;<I
z&OZXP4K`HVz>^wm8H*g^;MLTsP-_BeVXm;dMl3kh=91wz6k{pY@O<M!KXOBn5>c1i
z^mzj7vHgm#C(v<?#qg)a8op^SAdU#NumesG&!afv%w)Pr%JfUMjD@cc?=+OmpaZ78
zDSRkthIYjjE(JGY&exybf2_sl<L(A}pVForHx3&0tFK*N4-=k&b#RlspTs*LpZDf`
zTfaEs<ebDZ2){BIP%3T1r7AZH&zEt?PIp%oaAlL?;dETmhfiU}D0d}O1EP#iA;BI5
zzI*7loZfQNRjhgZGZ>w0cyobAI@Z;svYvnK*O=&=`8^b-_Zd!CJCKnAHMe*m*0@ej
zvqnsMI+eKuAPt|~Q4NwEgIQ+vqIRl3GeuCsDbLY3|0o2>5k~PxjHeXS#OL^Ez(-s1
z#-S_`-c^)L_rLO}je$_Br+F*%R-u^Hd<j$OP>cp~Y(w<Ch7Z6C?Kng@U_s*n{utct
z*4p-vh_|C^9vSxOsuuBl6$%Z>@janW^73to*<Z49iO(B?inwu>NF#~wdSdzCW7><Q
zh;z*#p&4nh_1Fd2<aHE#Z=jW?VV`;?ZYO7JiJiw}LmVEuJ9nkdSS5uh47!ohJehG~
zRt`GwOJg8Pndxp<oGzJRO->8q+kCvUZ8BY!VlN<ZY#cNEQ0{lNH@(ff>o&j?wfOrj
zn!I6GoNB+Pd9mqH>*TB-Qc<f-6KfihJ@mQ}$XBws*uHtYS$34Jv!|b+ZbwH7+&=X+
zPedutTfjpo4fzRGx@WXZ3MU)VQ$ckch6;rC5WU3VNcrT8R`zyW6%wJP$9A)Hz8&pK
ze(4^~+4*mA<hNd>ZJ!rZjI^vA1Wn_EIP{6(fpv@?Msr~-CHWW<2F9GW{$XNRf*sJe
zV*YFYZ)~ZO{J4$XxCi^Y(^CwC%x5(zin!UW3_IX)`h9IZb7+jM)xp%}(qxGZb1{1K
zodIh}?`WpT;6hpZ9I=W;eR}`}?h!TEY;l^C)=j`WqAFeZU+Uh;`C@Z;vckI*%Cj2p
z#4T$A87Na^&6JF3Y8ssGPx*h-Bs)T2v2{#|VhbrVTN@m5j_4}z&<(Gp>#`^JalSEN
z!6>o>@M|}k0b*rLw>d`=?pS2iWN;9=Wz&o^mA&Y^=FWeiA*X!gw|WLX&tx>|9z=+3
zZFTRTJd=xA!c`{*`9^*K!o{@KJz9t(E)-YX<yn5!likF;5xz1C+;!w0o;-z$GhH#3
zy;GjwaQ9}0kYNF6h$AZ@eB12(H01P{<VwV#_W1wThM?<4QeQnk15D~V1x5Yw(U1?W
z0UO4kh8uF`5*N9ixI8SI14xnnsloUsd~V_RKL=G)l$AxK{N);lUn(O1z}o-zkiFf5
z88oq_E44lDR|n>xuo(CIzGccUJHwpqX7G`IyhwY%fy6IsTaPee!lN0RH3MHSXSWK&
zx<k73-AEHZHCM7UL<6Of`GGIx+m;)~As*}ZgEZ<l$k=5SJ+ulNP3@9E<a5kFo`F8X
z9+W$lK~F72vG%_>NOD9>EN1WsYck{i=DZ*9`fd^fwYsbp&Q@rSCvWdgJ>y>NmX15H
zemm+N%IQyRqRI?xE35Vmp`2c2Qzd+v4&~|cI*u4*Wx`~S-gkz}S3_062Qztb4^ex<
ztUy_&8dF7C%fHew>*m@YzsT=xy6yjU{#IK%cbPN3@0#gX{`Ko8SmNWwa5NU#Y`MRu
zwRA^peNy*DidT5+{93ne%xckOcan)shjz?~$Go09PQGter}3ck2njQ{C+!+xhh72I
zxGCqh7~@ZDvhg&X!Jm8lOz!7jNR&CJvXPm0)H){PIOI6bzYxZ;$+fETbMu$0W>Ol(
zpo@}`Z!2R<B!Abhn^V}l73KkQGU>2|k_^^mlzxHRzgDl>qcd()IvPd19q`Tg6)xA>
zIhZQUlL{7#!J!JbfV@dEDyEFkg$fQ`ZZqn0hX#Yr5__~J3nbADf2=ckdLEylFG=IX
z%j=kq#nF$P;KJ4dp50;d`liagFF$}Jf9`0EG0}o`Z79;;xKH1B;C7kV3?M^MPkPgf
zJ6!C>xC?sO1e-cWW0E|)x&C{?VV{T#!XDim`PU3zoygy6@n;(F1WwP+9^W)Sv1GF4
z#L+80{{QZ<8`J|-!EH{<<p72l@_neu+fTJBoqFS+s(j2b<UfSv5uPv0>z@hn&GN{3
z65d{an7t4L=?$<;@k!NxIO#){Cu12&+$nxp!NS5KvHC%}Z<d~2++aHGVQDv<M@}aP
zO3+HeV;%SWf@m2B>+w6W8=a6s$|R}WeX`mDTi{92xX(uYXa^7B)HW7^ESLRmz8u6j
z>pp*#jn;C1zg5t)hTz{x3L#z4OMi)-4d9PArhj_7m6WPoM>lLve0MB|Y&taz+qHWL
zuzV4gt-q0~&lC4;d=dVRn3Me>hI}Tm{mRj<oLSxofn!D==ad)UJ<x#un4pkdzF`{c
z@g-CIHr>mTqiE+kjp#h=u@DCcPq#fH{W_X^A|A+i7(%&-^Fr0`uo4oWCAH~eU`S3$
z1sPgGE`1ZqnlX_AiC0p{fN*;tHNy{=a*u0-yZ`WVq<(N3kDso08)~a!^XWlN9)IGI
z^S*;;W)AA954$~@lT*kQPn~rvpg8b#NR@4L&9@i(9mSKbnvk~BMIdu;9p?pzs??c6
zO}ISaIm5>%!E67`n4X6Q&^(^bojkrKqhnW^-*#4>42en+P$%&mdYJvcCqv>ClPR+a
zxkqxpgwz7q|L;>i{;a8~vDzQc{@<gseG9iz`e|I!L~cvD$a3==LZLo1G`|{k@yJqL
z6~Sg~%kAnxFf*&8BPZyES?=drhL;CjDk-xvO9iIPu(RSnWUKcjiqpfH-~Kofwz&er
z9;^E*qdN0CHgF1BMy}5iVVmgto@z;WjDv%Ns_|sI=j+`GRc{Qm3RdCHm6kh??h_06
z176xMT~@M(iwR9+Ly^2r5?rC!IznspZ5$)!)Q*4t!pi=2&13Lh2efZPuDdebw^7*8
zHL0YF_VU~B9Ld;8Z4kPH9{Jl`*2kg4_`9W1S7#2SgPqLs%lno+rP{SRRhBSHe(N~P
z^Tge8HZFO)ap*#3P+E>VRaX~oTC);SswHStDuJiP3w8k6^NfW>#qif68+3K~rTNo@
z=eEF(G$qdGBFfRo@B<~2+sYDq7`l`V2>A1f1D$ZTX|u*_TDVbm|C+UZ(Ir;dXUGed
zq<qqB%-g6VD&25)e^;jDvkj=cOrW7)(4q<Zy^-lvFPL8%9#?qEosImgsbrZNO}pbF
zS$S;Q>U@diQyK^4kR<w3(PQ7wGMcLlJ2D{ddwu0WW@0Me7Ve*inL$IKjBcwoF}kcN
zu&a=#g*3l6R4?bd(fj8kp&*{|elXI(v={aLrQsR8az<c$sM2&y*JVQYSndLL#}cJQ
zzhP0(lVn^w3osH5kGn7VgZvNk-q!_5pG25#q@;9%S$CVIDy<EQx;pX$udJM0<lBY$
z{@c%0J+iv$d+5$o7q927+~Dgzd1naEXE!|Wz=n6Ux#)m~^DDcfK)d@9Bud=p7WylD
zd!cqbq0*j+RjF!pjoj^H6hlFp8Sd{`myd?M%j`2ziWl6YH5Q8V?)J3ZaU85|7JFU6
zl_B>q1w)*zV{flQI|XJBm`1kiqnO5TcE*oNm|rTEFFSS7wbmV$h`iCXE{4lq!Bdrf
z=}SH-@h0@Y`ksi?#bRHXrP~khvJ-*Je&j7=)gkJpOb=h`*n&3bG?cEkw_?m5KxV_L
ze)6(Et<xl^#Ag9C0@yPMS}xlc2sfe^D3-M+D1G%1vgAj%y)Re)G>+!e+pyQLH&7<h
z0+*`hh?bqiCP{LST6*wci^!aej1><;<@lES3?u!?Le4AirAzf$ui!izT=8{t-q1w|
zANrW|`H;CeZN9_(odeNerVovYjKw+I)jJCBdMRHOTo_&{5LT5CM}jo|xiATGo<CXq
zgQ*Q8-Z9OgkXld#X;&0{FWd^ce*BRqV28_xXP_kO4qLKCZdRfs{<xwkXB)?bIKQ``
z8{o4CVF_h7tvY3Av46Di+l{$$NYIq_+G-cyM>GgC*u{B#nX)p@&_c4kPj{_w8l~No
zX<+~I_3i8Sx65EUsf&9S$fMg9-IbNAZUqG$w*h)y>4qTp7UzngE3$Qr6eAEqHFj@!
z8{5BE>Ul14>ZKLN`AjG#To*gj_edq|Db0^yMX$$QPqUQGVK}rJYx#20;dzJ~S`~{w
zjwoa?h-_`ke$EpQ+feHEIlJ5n|J>VWDxrKgat6JEE%i=-eC+TsuNGiRrTU-Dotnae
zzqD{+Vq)^`%v_`^EJTL9VQFDux;ZWQIq7%+)xnc;^N(Wt7)x=|q2-u8?~YZ@0o~FB
zWT`GOp#?7nABo^{)h_O41sMyekQcr4@`7*rP^9noFI+i;h17Y_#dwkY06LWXT$ozv
zZ?B&u`kX+nk>hJ`WCY!d-x<iS%O=~gIoROja@oC&xG3W@^C0u}0HpWn<Fjvv25=R)
z3b^3vF(M3wd}`<b()3}pJGmP2@pycjQf$hzQcM)>_iyFd4>6051Aoq*)_s*jjX&W|
zVgyLF6S$8@OX<=x8KsjulMYSvo%q$k@grk%ou$Fp&Dm=1y%c8*`J2#pz1nhe4ldx&
z|9<Nv#lz@_X3OLriwi<2wYziPpIQ>yy7FeujP~QSr<q*Mp|RyPlqEa9#tz(QGNfBT
zULG%RCBn>_mPb4HQcqH?KlD&VhB@|};d(8yw^cCQ2-$;oKE0!xiIYy|z}ru;PKJd@
z1^F=|Ubh)-gBnCjU5r~8aVed`luRj0ZMXNW!}Pl_p^p!!)7AVAToK_dc%|L}xd>z+
z)^;n<_+;`72UWqf9b}CQ-=J`Bj0(o;1QI_Yo!^lJHVad;IPP7iu1rWzkd*%G@a92L
zYd5}fAe}pJoAr@MT@Sdj($Kn!Dv5k)ao{S#F-awt!c{K&X)n}v)XiSK8Qi0fV8wda
zY%}2(&A1^&yz7n9eMU^o)XzYSJPCmyq2bZ)?OFzr4{*D^Y0PU>?#jydR))722^5!d
za0SfhO={CLCO*SFhF>IPoA!Q}&(&~|SiNz=Pc*5~q0x_+kn)la=Jq=*unbf44L#gz
z*J#p65r-^s)@dZ+alkPtgKcsGOcl0>;&gK~*ONiuN|yi=i)8i$)yw<1G*#l}Y_pHV
zl9Y$V!@k4D5p%M#qQGHaLzABQe9gy@QBdnl&2zrq7bVt`k!&WBU+_1Y_a-PLlEOR_
zZ8V!kt}TNA1IX&weCEvN|HHe5soYq`mcchp^{D~+wiYx^QpPkKFV$8Wd+PP^1>wJo
zjsaCbn_q&K-y_%nWkCO5)|MF&@qm&1uqy3cQ8kfWP@Vv3A_MdTd2)1-_UvcSdk-c)
z#B1WoWa>sBIUlj7h#arDhZ~!%0xkopY_Y(*zuHK%UYe4e=0jq*q`PKHQw1M8;dNe*
z$aLXv|N8pu3I}PHJ*GVwVNK%$1O=c>=YMEU;aqkCPUw!yES8M*B2+*&lbNQp2FAs~
zq83!!=HJx1%j}lS>LMJ#Nh4gwW&V^hC$=VJ)S}_pT<)DC6*Ae}3Iv*C#FREKDLy>o
zqRu7yV#qRgvBqQsixSOhrGThOm4Jvz<wCr}(qw*u#*ok`9cm)%95Owf^2UQp2S;#>
zBeBHER1>T8@$@4TBOF+HNczj)QT{5t2%|W0RKqUz;adv!)&E`!fip;g?aq)V?-P0R
z2ye$fS8u~3I8>@ro0kaSl<Qw(nF((%PzvYOHvOdkH5CotxTt^|O?wCYiwD{q-S;t1
z=_LGim)I=o5UH5!vq3t8I^ofT2m8QkupR~xb5b_19`I{aA7Mb!v&V?Z>ZjZoY#Njm
zReQE3Ih57xSv|`_LK6}vw%93ECmoP>JdSF;VR>!}t^wzl#)pg0AlUVcG{?vg{_g(H
zE+MFhjofLTB63RHDosU+@-DoszBSCbM+(ug<V64uYZSa)=iiuIHhSW<_xb>8)$Ica
z%m7{W@L<fP!hGbr4^1W*b|~FhZaNVkmx-5Z!7><u%%@o(ePBh@Pr~{?q8$0uYRsI(
zc^nqiQMH6DnDEZ)41UHyLU~d>Vk@hQN<nmHZp~UMi^2^~`O){B^4j<2emu{NjDp7a
z@R5L!Fyi8<rKRlqKEs=Hd4<(@u<+jXPK75h01$OR(-(yx_%-=auX8d|b6bM4R1HxG
zZ8zsNLPM}mj=wPRk59gsAePGHdoqx-0+Ve9g<#REBFgDVG8Mq<C{4A=p9oHE!h<n|
zQgCHl=!~n9TIGeS*kh$iCP>+ecu<yxfU^1er~7&R|3}zchQ-ls>!N|+?k*uf<IuQE
za0u>B;~w1I-9m7O;MTaiOOOBw?(PKl)A`ogci*$_zUTbtr>m-G&8lgmhrI8Ytz!=?
zL!S_z*cOs8Y<1x>_d!)5>V%BRVA}V-aArZ@SQ&y3oq?aES%=JkYJGVqkJK<ng7B+s
z2LkYr#zi6SozTknxKVTD_BUZcHyaJ#vfiIIKSr^i>~0t0fHPwKiZ*@9L3^7OhHv2-
zs(!=2tKRlL{%SC>)3LzwvwS0Npqjl{Jzp=FkAW-Yt|8@M#qORf4>Js(@4pk)=!cVo
zm|cj<JqGas`kijrzpKaFMZCxhRf>=jWcroVFrMQO=*9A|pv*2<DAsFG_La3_><N9o
zT`&iyV&$0elniL&2&wPM5h^fjDu=1k(n9EZ3bc+LC}-3Hyc%JJvMtHI>XDRYJe33a
z#(#L3i$?iN2LjnnG>r}EkaAA?zei?!luXuOk!J@Sns6Q2Tn8~DF4(?=X)$RdFinU}
zIj)PrBVVZ2x0M>~I%Bo85;Rsa)2k)ik*L)E`K|T^uH5xCIK&nXuKahej&hGUl<Gwr
z?8%XhU(O?6p-$si0!~;0Z7Ei2b096~O#*6GYZ|`RG1BAD_c@!}Tw=&W?G#VKdq2&V
z)}_S@6?TQ<8FG=&cRvLV$dk_VbM+OEFsFHHlAb>PF7Ui6Q^^RmV%-M693nI<3ulSj
z!1-0H{{y{;$WiFqCQR6qZhFw=rHr(K=ffn05F6BNPm8Cp5hWf3z%MxJGWT4ECG>Pd
zT*;6Xe%cIQ*u75Wq;qs%r>SbWMjkpPq$>79LpV{XOl(_8wX~$Z$#7Pw;(UDp`jT+r
z3dXjX5q;dmz5)*%M6&QXmj%R^D3s<&^<8TK;#LtB{p(<d;Qx#CTE6ql8jz6hvIBQH
zy!0)nJ3Ju|UnId|@g(YG-jN{@Xnh|gCoc5Og5pbf+Q6j%6n2=c5O&Qf7F`xH@+M=F
zBUC0wjj$V@Op60AE-n@pvmP27ottdYf`nPOO=DVWW1*|t&xTGl4Mva~hu!DhmWUa?
zCXOFN=?<))Ojx2Jyn!Dfe_ca={aG-OY`sf?k<f4x>uvAa|D1zH@(E5-i}PE%(5tQx
z)VuF-PXP+z^KYDahoW;&FH+YFAoOjp@4fdNRRiHKWM`9~`MX{3yRXS(Zn0@L>TBKx
z>b}`>SVLHC0Qo*m*Vm0Nwx?aLmOQ46M{_TUldyzD9M(~{s>OK<$Cr95ZD?fZN#ho^
zJ4@J*z7dIl){yK$>iEEfGa%O(AQNTD8>xYrSwkQz4#gn(xBFgkA#vU;vH?&}pw`?|
zMZAyTp?(7^?-Xq1n)K(h5y?2K{_I~=vAsSEC(Gr}PbPD=l3(r{&^VX{2Nk3*O_p(2
z^6ilC#DDYFD=SxFEil{(y>(&w`wb0D@Z50tH<Rdgix!PdPr|p>K3R6&P%XJ0OlJRe
zI&lkWKqcWk{&e%PEXAmWw$A`uww<Hg-4}99VSj}Vip0e(6;)gs)~4S^WcWdsfam#f
zz!;(WXH(tR8%*zg93~TJ8hoHkAW-1FOc#7)0xgII>F+|=?m&ZR=A!eqn`AEMi<sV}
zqRiBwe)-k_RPvcNt)4W5#u~$1`=nF%(FYvM+_|B;W!ORJy?Y*5c~`-QHnB&p07TSd
zKST1{2H)e7J23qYhgXZ<Ml)Tb@%xq@LPLSz$b9!pZ*EsVU1c2bZ({Q302ykb3nbT1
zJ2LvxMXv-4-^uW9UU0j)j)VF>8d9~$4TjCX%=q799C**x9LzAs=r$5?mI^tbFNUYM
z3JvF(eU@(NU@c<s*6&8ApJr<ui%lSHgSKGF>FeDkO_UF!N%AUCzG6-=J(cXNq2HP!
z6HGMpfO|;yc6{iS$>KE;8D>DzTEu{r!vRhnV*uTdXJ{`7$Q5p+cbYMDiRyGCTJJp*
zF!A&AgEJkWmQUJ9b6<JkCgW?ij_u1glXSZK!2$F)+sn0T6rlA+t+CLuPr>JT8bts<
z`_*?k4{Ta1v68W4I}1d28_=8{1<zHjcHAU8vnI{Uz4x*ouBo@!!Q7bSp#ivA!)M8z
ziAk-<pR-R|0&Z;XseK=T8>4=5++1Q~o1<VvezX<#;5hu3C^Fu{k|82`>=>4cXN7)@
zO0qxjrabYZay{P-BI=0aIPSL%df2jBJ+NqbB3e_56V}+n<s%rpepevx>oe4P?+c*l
zv?U_zb~pWSJU-F8U;nU)30tZ5*TYJ%?~0g~&_U5N#*S&c3_>Kd<((3xT3~aFPWWMR
zd_{#O+9Eje%R-FHkO039Q=1nKn=z%K_ZQ|@o&m-IZesG_fKk&|%jE{ajvM%on}OU^
zSi&gx$BH6*pR+_$(-{(dEZHX4dEiIou|oq+`*7^U9>aVt?6Td|CgB;v=EN|cqhJ|F
zd=RPyF6r@rWdq2hua<DDj`Eg*hI3W(1hjne!yAz7lSr@+C61!rAAUOB8qc-Kb132f
zcmFkhnOH!80km8TOxgwzhQb(_j|DQO{?PQ^yL-!|H8f)71$g1myCAfBs0wd9ZOB>c
zaVjuz@It)B){)@hfaOy?4lB2u<R?J|N^01FzP-7#YYku`zedIfM`ja`k)~~1R&uX}
z#q^l*$U_fd@nPu!HY?8hDH!;o-xIeRP4c-`W-by{vxa~0Y#~Orl>@qiESA=+umH+E
z-?lq3fef_bC~^?73t`|uu-BYI#Z+k0Q?oQ^8)%jOg@%?Z<SJ$4Oi31`cmg+6n8so$
zuCypqGZ&1gQ!0ZKKX*en2_M%4%KFT;!{lPLehyjjp+TH_iW?vqQi%y)+`1jKRtO>N
zI4Gux0^lfseI6cQge@6U{yBLDkHhZny}Hsdgd6f1+N}kQ5nfcs%?xTcRXHj4MLg|+
z@V!pTPNHFAAPh7yVj0YA%{t@Dx`LNQ>F@Ng6C`X95hvjz2Mrh|mXO#tYWafo9jhrO
zGBsfO^|Od{zQwoiGvmr%-VY@przM1H5mCHXo)Gmh=<tQ2OswlQUyx~XfMTCAh>2_;
zGTKRNqcY8`U9o{y7dZye>4(y}z0~dvVU>sc0{!ZR((*H-zy}7O@DkYkMt{Tt7)OJF
zMr8QFs!Z(KDiEF9cljY&ooWVZiX<zL+dWRkS)3;#drN>_CodjxZe7lS%m~$$unrVI
z3Z3w6#wq?bhCDL#PzoI~L8hk001Smm-(Z-nj&{$2&!-*|=jzLoil}7znOC7eH*-j;
zoKGX)B;?W|M1YBL1O+(^7Bkigx#f8}7yz?vuuynX6s+y|=4t8T?{D$CO1yCRtVB&m
zb0m@+rhR6TVsQ9CE;W#x!=*|L^44JSqWs4&T2T4GuHD5gY$XRIh0}NFCe&F?&OobT
zxX1H!3C$%NrFxss3wTwZVl$G<M3;j0NRO3Z8xj4vABa*G0?L+`3Y}~0Yw2uYhvc3R
z8D{r3D)Ot00QzC)*6JllR-AsvD+%=3xR$?<@zaDdViZyeExj=P9xKq~YTsEK`oh1*
zs^{~6M)1v8uO4<+gR<IaKJyn_ZDIX|PwTaHKLRtsJb>swu@)<fOYab9e6?q*w4ZCS
zS0>J^hnHA#i73yVU7M_U-hmyxG(UIo)RMgLIl0=|fRE@|8QJ=+B3Ax)eTxHXE_aZ<
zNx-F%&}!G~zLpzP?zxH70&m(LZtra`^|Q*p^K;E7mNXpc+S48`j@c$Dd7YYB4U5Vq
z{gGznk`lafpWp9L{oly(419y;OHS^eH9otxl=>P-pteC4V5+;sTOr*bbkpfKLcg3H
zgyUyM4%<i4xpLpYP?@_t(yq*!x6vtIF!ePp{fx)5Jb!D%56;}kwPNoUS~u=L8=_n;
zxKD2y{U;0jdL!k&SCp^TkGKFyVThn8Y8gqy3&o>U&Y+3uM$pih_h~Y;QbzoWkC4_t
zn=sZ96OdhE$AFw}4P|228?_wR2?v!#+xQ-Wc8Ws6K_m?d*iB^tNx<6XwENs=z*Jrw
zVlD}1vOt(NK3u-{MG#El=qDVZhj@gv_ZkHc#WMG&;p7KnnIsFbG6dvZLF=L<yhk*C
z$ccz)sEEJ!uEZ|Xe<)t4<^oD}8kzM!)fCH`GjWkvg%=%8cvcNSS4r+HY8ZDZP?o<-
zDVQnngD?VcP^F&Z0EI_|yWb>T20Pvf%b$rRPlz%KFA!x$aa;_qoc%RT%w-Mb+PRPo
z8|=iB;l0ThhN(fFI=+ZvSV^Ha@C9$ZR10wY8_Q(64nZldIUJ#S=^;Y8xFq?9MSBdj
z4@0Ux61lGNYS4E3>IX+8(aCMI)3#k`l}@=J&3qVmB>TKRe19Y7F(xMywzCoX3iXXR
zS&!F2y~W=RqyVDH_^)}l^4^x@i*e^(HqMD^sudICWo5p@5;b3SBp#{;JI0ls3JCEB
zA2Lj4hFI(Lpq9NR-mS-idyn)Pl>L9gSy~8(@sg6;EIeC<D&E^kaW=AmSQ0^VEs|-@
zmzaAQWrb%y-#4(_wsr?-j4Au@j=-R)71u3U=uHb1O%+Iq%>*X1fK;@p_}(rF?Lm`T
z-Lp6<Rxpp8FVJME(mZOFg(%;ld<0YK47{{ySMVC82BZF*vY}De4h@vU%F&|^26PJt
zzr|j0y!b%1lea+`q7uSe)kYw0?M9DN=(K#ks%O?MG+KSj7i~Ou06YS#-p*lAeimL6
zTF+dNR7;)pFbQ=x1jtbBPd{Xi9dNip`QvFw8}EHDgp!$|8z46fD}j}p+u4FWq#L|*
zLz`z%7gxY!Vvy=VLXPY0v4r~m5R{fo1FF85I|-F-=v?-cqDX4JxHL$@%Re|ohKU)l
zd0RpwuxllSeS?Ln4+ezEKN6>K7aJG6VU^QrY(5#Sg6kdF{T^$}zrJ4%XoZ*RtF~ll
z@^F#5IhxNmY{4T|bQ%1%foKUXAZJ9@EHvsTQY)(r(Viih`=U<F;FKb|{|AHPHxbNi
zpV@um%-u@hD6HIjI1Yp6RYk3DyyR^hYk8~oT4%rT#>sts&?azOl`51H*MC)LwX#J@
z>!!7Qk?hwFZ;2qGXQYBEWV3eN6rFvNX+Tq<)=d<$$y6?!_WP+8!*;pVOjz<IEt>pj
zu5aHzelMu-)E&X!)mr{oBY?AN_I{au!NagGbe!#!=!A+*?Sry$K@)MhQpG)XL%j9o
z{^(=}%CTcGld5XPj}nH2G+?ut+YRHX2_JsFJhSfQY*uh-H5KUnis~*RX~+kVTq(fb
zFoxW(DwbaOW@i@SOT7#cdMmN~lv{Muke-I;7LBY$`6!2HOL*#B6;4+EGD9XW87JDl
zSbvxWRbK8p1}o<Sck2UXqrZ=>=OxX26p3%Y@Fap4E#$8`T=w}jg1;zw$J<Yh;;CmQ
zaX=m`iprnT1Gaq&+z%%}ZDD57p3)BP<jD3u#yH82E!88?!*3YC!^g*p7r{aZBGK9+
z6x5r#4oo`b6Y!W=(fIIF<;3wmixTct9Tke(N*FEEk$s3HT)>us;hHiZNgVv-#zV?k
zeEPWUxFmG)2OPF@>3G6x6Rvb;cYz}GPWw#RM{3x9(=<XueSRa^3p)P%Ong^1`7rY$
zv~mQSxoI5JJ9`Bk8w|~|62Tgl-H(TZ=Q(q`0-hZV=weaKTI+^hR2v%fqsE&2B5|E8
z25vNfUEHR;Pro%X?MC58x17CmB2ql#-OLN;HC1#gTv|Up<W>sp`du%5tt+;FddK5t
z%U|Puvg)!Sdra+V|7oEpxIqvVE1ms5CdKSKf8UpN$q}TuZJiOc`=XN~6PMuNRqGJa
ze6QpEM+E7`;0{I_9eW`snY=WR;O6WVhO-qnVj07v-D#vwV^?3BiN=V$R<NO8W#}0;
zo)gq~i!BWCachf%4L3fxgAsl~>&K^^(Cmh);DzR5Qb`?Ksass%6TX)8raLHP0&h5T
zDfO;oQ+CEbzppGn0QbGThx=PC)7fDDTGkBxvaj0k(NfXVK0D+Dex^u>%R1K?Pc&hq
z>EfEF72uaGm~u5D(RL85;s$UC2}N%@Xuy^(a!$n-fjnr4@^zr;c~EU;LdrffU#-?s
zggpB4spbTij%Ye%vIxmUhy!_Ns#}N)YWWjd`NL4XLy2RXTmL@p9O#t?ex6=qI4C=%
zROt|(Sx=wn4HEsny+35&v~AUmAVl^mxY99ser_b<TK9@F8)Bb!TH~6iT?wmsWFCH%
zO1+S&+Dkj`AXaDapUib!T#d_P5aU!U)k^g9Nd|9iiB0ISV#r(AN!Ik*P5<D+$areb
zJNvGW)LY&oQEog~o_3BYF+1NHz}odv$0m8c5~)Mg!T%><iXK8L`&n0g?VnfSv;=Q*
zs;oLkW*)mc$uQ&ahe)n=cKB^cZgcDQM@cRyCK^72t2!7;15Izl^^aMa4Ij2YkvBa|
zC118pE7iq1sB#fc?a_q5-%mrLsvKf#Qh@A^H3GX%&3P6Xi_e?cd<$72tVfb}F9zMc
z%+DOAo@YuGD`@V|8U=3Wjvg-K>2E1@m}B80R9!`zXL;K|l2we)wpp9SGbv4)f$hK{
zG4Wm}aT5+AF2dH-A9=Sj&eA_^^KR8uadvWh@ssB;yq-wb4K{Y!wSL~w*zz`z>q<UH
zB`a{X>~vxoa+61#M4;X~UGQuOWusf?QeH)(ca^w)`5ZJ85_X6se9tfU-B}q`zRgui
zsg9qw<H}M)6*ZD@ANc2-1tV)Oaz{+{@($>_LuD_O{3sX@-q0!BK4Wny@n%TBY2E8N
zS7JvJ=g_+?z`cZTLvk8?>q1uYxkEY0k0$gY?6pN0MCwEEl-e{jwA~JN6&F14JPm9B
zk^5Ts|LmHY9{fhc+fZ*Q-Y*E*cQVag<+3yJePMn|CZW#{I2HY}xLKPv(B2nzC#&$X
z3HO9G?oXk6r&iwH`5HI6kN#xhW{uX695j;ZL^(a>k=Yj?-Utx2(62MA<Gl3YdmTSv
zpRBLp>&x_*Hk>VJQ%VEx7;e2|!g58z3bnXfDbIFEx1hO}OgZQ1eWO+i`jIXl17J_|
z8{e~kxGa|#7M`;}av5M0KVhM#<@6N+^cqBdTW4NjNWA!twpX1-yeu|rn?-F63?D2`
zX2-k}jnZ#mX6XMySeH+kY_yyHfpww9R~ggLz==V5EEGaVGB~gsO|P{grXL=Nip-5w
zgJa0R!{Sb3uP?Bxcbbsb{>cWAP2rg803(<qF&3$$&9K($hNWC5u`zwSxY53)$h1(Q
z+6^+*quN9y6Nn6MGLjzdVZ%VRB8DWtSl#2u^G*AiK<#)i>%)qCISBph^>;Y|tKU0-
zJW&8~`m5TE<TpGp!lxd-jf={mX-D@$CaDeXM<zPtg;Wk7aWUc9K!Wahf-gHgT%@KD
zF2&_H+JbE`$r?hY{sAL1DEWL!nh!{3!hIwPKpmV;;lzQ~AWeYX@;mT)7EsP^FAqm3
z@bvRBY-P=qg*h2lXgC*fdCG^zB7@7PW10#gCvmUdzREQv>(!*<Ae311(T8id%*eM0
zR1fwGbPee+6rbiBsSDSkgt%eu)tN!vDh~qb+>i{G_&`IK4^Zt4H$mf3Za`!Q3aE0?
zt4`%`m=>p^sAr}HLyi;KVebTF0&F?}D1hcQZ&NH19&+E?8id4>!oZ6tQ1J4$fRc0E
zZoHR+1tpe3N8fM|5T5usT3D=TEIC0G&82^?xKuj#JUZ7;>{b;E%p?djp5>Y=zhENL
zd?AwYmdd-j58W}=pYEP_xBOj2S7nGOaqZbOX*>D5>UEoC#1y)zNw8a_QmI5pY2XVh
zBzbB)Oia-Xu@NHbAcvRwUmG2oss|>z7e-n{yJO*s7HXGqpw8+V1(J|UE^EyE1Di4y
z1_}PQC*)Es>B4esYG<g&jk3q3fEiRh;ctS^CvKZxLICt?rvcGY^E1Xr#^u+7_x5F#
z0lREa?8*pfk_;$@;CBjf#GBIM`j=bKO@|+{TlIR53N|tj%U@TKLqh{guVf<Mw~HI^
z0Gp}tbooU(?U)uGTeghKS<7EmV0p*TD$S*qn)Q0NoP+MG`m_2Rt{;l%AE(lhEHYs`
zR3?kqy45NIXe2Px)+?Cf40u96)b}3LTcRT6l8J{-y}kQ0y6K}59~U|h5tlCjb*z&O
zQ#l<@l8J3SR~bp>oRWW0EYx+v@ebB=_^_Qf(7IubvW#Jlo=YTgAljchR6>Xz_QaoK
z1-})&Y`A!<nIdVUW*L%$p-SY{?mhjLV1f-|WA~D%%0>v%`kTyKF8h7?BR=i7mfkfZ
zT&kb-Y3onKBr&T}(7#Acm|R)Ao#p3_rb$!L;wAPSk(FK4ll06P+9DEYBxPhsPES&2
z+DgE-({~HFXSD7hjU`}?2Kl1}BkmS8(t<D+u$ENo;U6g8_)s*A+(*P=$=E>YDF&Io
z1f0-M7B>z9-(f`nh&|7df}6O`IM_7I0djb-?k_Sx-a6!)gJ!h=pj_5;Jc$~Q`7AI#
zjIQK&PoFDGpF7jWIE<c{Lhq~x92z`nc;yD;k4)*~&<~H-UK5KgSYbAB+fKzaFOuCN
zBl!|qh0UQ^BJb31KP?n;qB(Oh7AfL{WT_!fa4o=CH6a5gf98!XkS~{scBc4}aZ|dm
z`doX^@567Snpl#HIa0o$L`LC9?$J$<t|7WvxQUK=6{OyOJV=0p0MtTGXbhfP7amrf
zYeB1`Jcsdvoj&%A>C@PX)Hw-wq$PH!`J24o2Y(7lqLldF7f|!2DJ{KXZaX?eyF!f%
zm~Nd_@<ZPWO*%}I1d_JLB%CxtQ{v0@XCSU#wp`%Y?Nb4!ThyG0W-ZgU>X8cf;-RQ$
z4xWU=<el3<xy{so7;;IoI57(|mIcqn%~xC#6w;q)sXw*6IvC`Mr(K8_a)2RJ>!^<5
zdwqT5M9R$dpq42N!dhbRyjs$0jTHE^JxoewWzhT|vX;jSj5EXe5?9^+En4rC{h$Ef
zStF+*oH|j9m|TuDm?UbC4s>XMb~vH8r18*~K3_f(Qx>eIKd`nHZyuGc9nYcA=8|&j
zf(i7A$u*21uh4qnP%Hk>iTU;S%PzI_2^Ksc(;`XC+G;TU*TsSWx_^M*X4?|bx8(wI
zjYFx)J2eA`?I2cD36`bXipKZvTa(9<D=u{-b|HI#exDK+jx~r&5PdtJJxE>-9R0q3
ze^tBJFO@J7Rio;eem@Lt{^o)?CsY;bhMl=}2Qb`7Z9REW(3KhC*wktXj<0vJUCFoP
z|FIsG9hw17RU!<EO!u9ExD&XHLVXoW!x{HZyKJMlu&4zcwWNRdmOGHzpAR0e*0WyM
zMj@wZV@76(=ZqLp>7!vEsu19_DeLwPjw`jngoSdTVbzz+&KPfz-xp8P+}9fVa^y~j
z&=aE`;C-d+*E;~A`F6?r=(RgQ6zCo3roxEGbkPA*c1s_=CfwRfD|@w`zwyc<srbG|
z@I{q_IN}<AICM^|bPKJcQsj&5i7Hq#QcxD0!vk}_oQ`<AX9h(>O_B_<H!<g-HL8I*
zjui{&OxNy_3~a>Gkkz6$%J0!bWT%$<2Gjtlp@qp3&`xWLDkADrFVyJ>KVQrs61<N9
z7=Q3BJMGE{aKsezAiVT?gNf<I;!_$ahP}jsJ@LFehdF5ns3BVQesF=IZ~7vyxss`T
zRZnlpdcplH&_W|`zkg>;>}nrSl&U%Ns6JzAN|`fyB^AGZ;d&#Rmfb*<B<UA_rchtI
z(#GU>HvjI1NOM@}ju-4z9!S6L8)`1*KWGvAR#0*3`n>ra?H4FVong-U0o%{|f^g`e
z+@#1EdCpodb?g<U(Y`C(YLmoA<>@mA;Vpal%VL0dOcue6A4nbrHCJZR7O$&RkI)~z
zDthYmJ~Cx$7rN<YOhm2pk`oftn*iGd*)P2Yuyj=h4f3*sFQirHEbmEQi8SD?4S#KI
z-4w%2tgdDY6YN=?eLT-XvX6|yrQg`AYKT|pF^JW~2TsC&08vANu56J0h$&|HdQ+oS
z2;exk56iLl_gSnWG(RN_ow7<NeIQJkw2CHm7?7lY<IR$pBl0N;tMXh1TfUGVlyah~
z0_G*oJDpjbCB#aVi&hm&&?iPcwf82r4uAVASVuOxr}PHhtbAIY9oFfxXFnU`u<XG5
zMP?N%oQe`amvU)VtXO>IdaP&}Q`Efo#{vWa2szK%TUPVN3^)ia-BiRO;#*wY5HL_*
z9Yk1MnUFWt@WXv6jW@J#>)qOBy10r#yGGnGYX&_MV?&}8ju4zDkL0#}aG@;N2MDDJ
z%gC?10mfp~RSqaxWjEOUwG;hCihlj8&&=t_pD!}yZKT?3Ofr7_DuDvQ%5l@AxaVJG
zp~jVPK-y8zX6@g%R#oUITqFj8N<mCde<)o+H4qPGLBQy?As@I{4e`*SWN<HiFmB*Z
z^|7bR0lD~$L^gRGjTzdlL5~^KSo&u%?y+$m%<Im8SN%eo?NSV}9HvMXq?>yF9J0wR
zO`}-LzlJ5-l2*0jRrp9b|2B`i8HCmd9gtCMBPxbvA7OooXbjga-0bsH3mlmhU9^*6
zCo(+Y{>I%kKeVL+U2OD%?`OC`?4=dZP3#}UOIV3qgrt=`N1p5c9KEhmsV{+Q6Fpb^
z(fnO;Sp49}JG@f<#ur^|;3c7!)r>MV4<yLaO#V-7ksJdYTB=r$sV@4*D(pSSOqoBa
zL3Qqp3$w;Ny(S|b7(%k&xbmyg#>^!95;`>YcmOux1H`^y3T9cDRCyb!JvDrs6M8|Z
zH^%Gz=#S}F`6k@e*^Td75@pTwDz!XIv0p?e2t9A3F;ued8+pS!4mP$&=1BXUimW9;
zZz9TEuJHb$&41!pBsu08&p1<v6Ubu=Kum?paI5)|%B{PYEbfQ~*(`))F}GVY>@hoC
zD{~q>*G~gV{dn$UZANJ5mmkU&#{A5n%F2JoN}2x&e0V;aK-DMN6^_YPXm!Ax$P8p1
zme5i;f*l{~nAGyEE*Zu5CTzix^hI`RU$A5CiyS@aJ4r{OGc~gYK2?vW48-5`^!_}k
zvec0-v}nd*%9Gy8%O^}x9;^$=T9Wm|f{#q6OHnOS`6_AOvlNslUCZJ13p<=5l4x86
zk|FkSXGn{v6K{b@98&W0(R6`h&Ol%~hd<nusOk71qxj#TqBs6utsza|H8h};9+LQ8
zGt!*_#MUBhX0O+ybxt~k4fHPSD2e+6Ga*U;0Qm#>lslExR0GM$4`iYbLhK!aWFADJ
z!h(cjk^YV%0Fu2_hy$t+X+D&`-C|D|o}#wEHYk)$t|eqM@I*Xj`iAj$XfiI)j6xL;
z$W_e<3W^vVrcSdv*B*;R+!}=7hYrKY0<DZ90}wwBg~_#WwQ2wPj>HU#@*IO6N@B63
zjlgFZ9~c)n2XK7+3GVT*afA-53pkB%>Fo&}XZ4zwy(VKrdBh6!Q07gs%x45KJ_JP*
zpn9WZkBmE98jBTZ^(^oxGlDoKAyMtz4}Tc~e;`NivB9gUQ%3TC3iqQD1M)KwQ?zV*
z#53P9&KpGC>cfk^N#dcIikrwt6S34otW_*=!eW-3xXJfYy=?5{@J?S@hZf-5XR(3C
z71$}n)uK<#FZr%Fz3k9K1neMa^UAEawIgC&W;wW<<ofB>bq9hKf6=~M1WJv}0<qLY
zt=+s(G`n_VyJt=mL%MU{uD42D0^Vx;V$zGj4yLOaXZp`;P#mkMpl^ynH#<UbXlH>r
z*r~nOy{^{>zhGZdEKNcQ+x6x8sK<vFJh!J^H%t!%=tB-q9b)QTCHHSh!P9pi@oS3E
z_!`!krx7~BE{~4%CK#!-3H*7`j^k~6+hU%vprZLg<_}>7yp_(&@l*6hi<~Rpnc&My
z{`T9hrQ^?qWSADyI9O=Ho>LrlqBs_G1K<O*OSBKT^Ju&#^`-i#C_ga_q*1HR)Y`Bx
zb|=2iF0j2eFbS((<u|UJO*f{w%}3DM9mD;QRO)B=d-)R%_$?y<S7<f-a(juAl~n?A
zUJ$_An*rIlkI(%`+(j~6`LiccJ6I1ltU7GLqv{=6B0PBKJGx6SG;7N+M%P*oosFmL
za~`$%bb}s>jT0ZEU6<7QD9^W4*}mO?UK^4P3~w0Z)y{m0W3*GwH2&H;Xs&W87G^!~
zKh>Z=fm#P7^ZoRS!j^DwN}<B(dMnu1Sq*{yVQbh2&yW>Ve}Ngs=(q#@%XNXHE8EKC
z$tm1y;~e3KEh0z!QC|X#?RJi<R_a$c`0}0oDx%<1tMrvJrkTusSli8FIv2E&Ro!^y
zdLut>lESS17KB>@)<BX>7(uDZK$%1s^UwzZf%O6&RKFe+zI99579cZ-Rca=(YkM;L
z(ECj2Ye~P2<<t<@W84CtV7OxFW<N4PEq4}+uE==P*U#86kUiXIwD2%OcKs}-y=RSV
zV|c>s*yx(px+BR78}p_57VW|a-R(?<;sXJw!c<V1oHlrSQ^bM3-ki1eQ%!dPRkF5p
z{d@ahMDOUudlIg1Mla4<B?CGqt1kk-Xlow{Z*l6&Q5cf7l!Ye8$H6DOjOxat&RTk5
z5>rM-gdAgL%PFj-nl(Z-QW8*4@q9o45B!%Wlm7XS%v@vRYDOO7<U^hTDOZ3rVdkDL
zA1BR|PJ;&9iW{c|gX`WQ21T%liS#AYK;o)o&+aJowLU09=w<lRlsdd5I`W3xaUH&P
zxf6);QBiHhz$YZX0?oK_4Ml4|$>Aqo9F@jIAgTeQyKa+qGtlTk)P<N8tzYA0@5)P2
zcQjme7<Id#aDP7{_U=zKY|M{khg%G|c=Ax~eP-i%BkyZsP8hM`xE)cBFBcJ8%MpT7
z3Lz3+FvU*>`+alHJ5)mJRQt?BH99e0g2VIQNNl>uu&acU_Ai`@zEFI9ult7Kl$c}+
z0_!6T#gqMj4M$YVo!QRwU3`C)RDXZke?#K}epQYPxFKT4^SWMa%*7LFR|?{^s06wM
zv!)CW6z*?OyC{5pKPxa~PZ5_6JPXDK;@zEF^t{|7o-DhIi0>F~@1926{I=f|J=%qE
zj85!w;}V)5yj)*1A+gEIUKdz{!;WkV5Y|cRXijzwbU&pR&`<8{bjH<%R5W+~iOOqo
z1z_)y<quy)?7mk$@=#6=SH(57*WW}?y&EKkp2Rvd0^eT!WE2(4(1w<SDsPW|oz|8p
zjLpCRGI_imsO&sTYc)l>u1DTXz>6iD{cUuW-cQgnmZC?DxbTq%t8Vx}&=-~K;U2UB
z-Xy4lXce8s)sW<O3;9S;%ViiqQf5#lx|K=SvUa7AakNmsB<PUWp0Q~)t}FP_DRCxV
zIL=7-1Z<m%DXHtxd*Wsp84#N$U0waI6TmWPZBKqp&PMoR!Mr&&JV7zoQ^cR|&Vb3M
zSR@PWM!>E&1xiolHn(Q#-$K@&Zaat!JZ1!2=JJLeWe2b#%~TC5F<#w@rW%+)5Fx`8
z8_-R2o|KZh<O8<RKhiLLus@UhG9IdRPU~=GZHv>RgrNSApooQUgK>a(DrGpMYKveb
zDe)aw$2)_tEfjA@2)LB@%w^!t-#@mig0J9wOtS>N<h>XEY*(5A!?L57(-OU9Fj<kM
zzMQ)PgNyEB9gaRP(>KdFW+XoR*%(XNs~s1E#qT)TJh3y5yX$86(dhgRmOk@_rSlj5
zK+bycqd|rm{T@6Ba#SVFAm#m6QIfo<#Mt`fFz-=J+I2V67i^?$X0`NlI@+(@@G&q>
z=)CX%jrJUY&GBqY{k@;JiO9=_YHC5^L5YHr#w>^x2`v=lvYSduBPH1%3NJtA^z^1I
z3PR!`<8gbnA*jnfSb{`LI6GI%0d8MEwoT_h*p3t<+Bk8fgsKRANq@shQOVF$Q~DYz
zJ#1$1A(_TWY0%n$st}pNNqYxoksS!o0x0G<DKGnsA$egDx~NVXIirnpF@~_(DPjO2
z0U0<oja<+uu`L-f(dhS`N~*y~65G=LvFQXe@}uc454?|=in$WH1q3v1(-!7IjoESf
z(Orh}kA92wEb=<xk-x)fK@g@@^>#9hT!gOsPYmMJ52AV<F3HjO^<AkodYV3BZ$dwR
z{+yQA@6-aVaR@vq1t$2G(!W>U|3*5*VrUR_rogynK9Zd#5LifsoY)&8n`cY((ryhu
zq_^Brf0^dLpqLXXef7<r0;%H^l63i`>-oq=4*;>g{=%F|-lTi9z8ka^{CxF|(c9=B
zA1SFg{7ty-_rzqryljHVTg#2=><u0Ljh5e@B0nE`_W}7^njsnl!ORrSD?6dl%Sb&(
z7``*1){8=2oZ8O;3)%ND3M&a$jy^n6R!*tcgL;S#w2k_R9?%uY+D-6Z57p`!@ZiV9
z#}60uzQuf!c<nzaeseT6MRC7|Xixt_{*sIA><Re|-9$b&d#-*lKw*82hOiLfao7^$
zp;`Z8bRoz<$hQ~@tI!BU#YFjg9D~jV0k1$VL4FTLQSSNY=YjhV5c=tV7X7FEKLwe>
zEc^ad@NZ@R9IY8g0RC0u|D{+5K0pqT^oc%MR91|O`HxZGtG`N_kKX@t*WU`2NY5ui
z1pS@~baZq|A>dO8GcoM(#$PNL4mIM@KK`)=iFA8;gFDcxM$R|+`4Q{+&rc2|iB7`{
ze!G&hcwrHFc~tpKuEE3ElJ#^7lj1Hg7z3S5K*Y<7kByB@T-*SGUsG#UO-+qzP42%N
zpw)qm?RK>%uU4*x$X+ZDYl=0fw~5+l4_$_3>klm<i=(0(2u=ORiZigpi7JLhc4r0v
zLzb#^FCD4J3mX$&G&-f6K)qikQXB;Dl!LI6nv|*>=Hk>G<6Y$Gq8Z7-+Zw|!y8=gs
zwDL8nzol#dl~+6FxM;KkKojlZ17AjAU^>z@e6iWTel&QJM574wy0-iRL(KX3o|Laa
ztVF>+H;yzHoxl2L!;5BvJ<IeS=XAzw^=f9GdTWE-6McgZ-BN=mCezq7){l&rSR&5y
zLW52(1ax%GENy#XDl9}}V`Gqo1w1=Dds=2@bVP?+R#uk7W*@BIHiX0XcOEq3pAUr8
z%D(Nlxnh!&%BZUR5ma0UDvl^3?j$F?X+=uy)WA3;dmtQQ2a@o5#@JHVeeh*W(C#aQ
zmtEPHb|NG!@=UAV$jKrJY)AUJV~V_znB>}y(ya7tv_(4up8H!1^S;n_29~DsHwp&{
z1-|V%tW=)RI|BUA&fMy~uxRX#$ElP3nuh+tnay7c^8zMLiP6k&iMYSS;4x)<q^HNA
zqnn9{NB5=~7z|AjL!jYmV(iUIORIxP{>Z2E0gQ8UHHPRBHX<F?jr5FxnICnPb#YO5
zkB5y{9HU4lDhAt;OA#{BYAt|CQW@o(m6unSwF?86vMWai4Gp7^+P7}lBL-V?c;#*K
z;Dq{RFX`)79E*izWb?L#u0{D6N~yRW2v4I#A=}F$OTe>EPa%s(nRz&#oCV+A{my@&
z)?|2W_h6<FLW|ndV6LvN-tFsp`@`dNe<8dDVZ7{aZ9&r2Ls%Y+sV`4=-E8n^Bms?$
zoH~uxp^8EeA?Jqw9sz8~2%Ii8BD?xOBGx9JFxOl5y^aG;qB9yXFi0ZP?vW$pr6tyq
zd>&*j;6Adjpm)FA62qY!L=OxgP*H_ca7f#~pNET~$N<ilvVmfn?fage1rD@2^GceN
zi79lwrB-Ced$v1hqS#M=z<EEa*PF{9936e+<V>C{xp!C4)6;7m7#d1Jeq!9kBqh~n
zR#sNt#UdosX2!(C-0jP;PLa~m(rOI}3rqPdEiK&&0}r42SxHH$6$TD2<+F&0NbCL6
zQ)+Z>u3>AIuzwEu`Oaw4%y${=m3DVUM?e%s7y(3R1H?Ft3J|>+0F2C+9}Bis98QNw
z|29YTpUc>QiJwbkk#w3ExD3Mn>n?6pH8m{jHDzUVDk>@mJ}P!GYk=~J)ByS`>bx-@
z#8Ngx=>Pdt>6Zsx;s0D>BBb_ZGDncu)&CW?Wb*L?-7fuEk+4!$qH)CESL}$ykWaJh
z6UV-VQ?lzJC_q$=rGG!<;V(zP@6V#waXYj;2@!N0M!Wg{UA>4l_TDD|BgF$-fpL=K
zaooMyKay};KJ;%zfDABqfHkC!Y(UJ9r#rxjHoL}9NUdi9BDTC1@Be=r{-cHeLz6B9
zAOh=Fe^8t5Z{Pl9R?mb){(U+7caV8-$tR};{E7t);;lh{JrO2{sx{&`pO@E?)5Acs
zRFnvIGjW^{e#ff(8WD9p_^BdRtHeHdIznVXGOMqk*KWqS8m-TY9P^*IBveahfl}Z5
zERy_y6%iFB$++xiixT_hjE(o>4p)CHL_$(Y+ek+lz*gWxsqz2ndb8M6w*MF)NPT}L
zya)FsW+s>>K^E!ZDL_^g!D@3Gy)Q(@DyQ-rA-4R&lU-k5LK;cnz`asi4~iHTsfiEc
zk9hRJ=61@HJ2DZaJowv%qyCWrxSYUOA3}DM+L<+;j&Y)DGBO^=9wI<-3eU+_h_93$
zW^W83VFOT@dqG!sE2f)!vTd<%dKx2KKp|<dAX-#s4^#;&)}DQV_(y_++tS6+?e?A9
z>2i1g&_828T6NOvV7*-E^^BhoFU}i7#QbQ$2>wKPFAjn23x!ZP$j&Nm)^BYkffXAM
zb2HLpvKTDvkQTG-nQ{KUMztN1_5s!FQIf}N52vrR64bYId_OY$fX&5am<(kCnL^2Q
zUd#U;e39Bi<Jl-jBW>+%b=wJJV@z`VcU6l?K>uX}@uA_F)=?A!1{!XoDI&JPhCUyO
zX%|};;6$pz-~z5WLZO|M_|M0E^gRFVZr0g*+7~zz%w2aJXQ`N;$LtbIa?BN%&~Ra!
zz8qGQ!SNi<e-@00_I6Rsf2^T@|DmtR`(yzsO9QGGYK*mWh3^LyAgp`k+JY=3jw+2J
zGL5DC0wvMi(U8#*$R_LTAfF84S}bgUw<wr`+e8)+lR%fwx@gi$sA|^to#WfyPo+@A
zBq6F6OcODz!QnfHn@UW+=QR|*@Swx`X|IWIW{?+4V@-+xoK&g)3ZSM5-wa6M)49uy
ztvBW2ut57Xb-0W{fUSVPL;=>FA;vBLC9<A=><H+=-&b5P_Bb}YxJ%<iP>c}wxmT9^
za>pc8_8U8;dKeRT6E;b^b2@K|<duq%nF6H?zA5ijGk2qTGO70IUIxbVyl<dbcw?5u
ze^`LYhD~iBY-mH&^^%WxtvB_7myY1cU9PXDN@}yz|DArrBPCl8>XC0|;nnqz3*<{N
zxqCWBf(4{ib1RCh7z5i%ZWoJNvDC<83>?CUkpqz|H?6p0rl-Eqq?liH*w>aTB(vNZ
z{qb^YN_qSfDe-+Z{x<<Pk?avs0_eH@Z3im_lw7AygLLh?ma|^8CyHJlK2Ah4D@kDA
ze#!v1c<^aHgZ;aapDDKv1o&dJC#5h*NaIb}?yle(#g8Ky@>(r<tko)lYL1$RW&2-D
z<93cEvl=ABHL_X#2c2B1uVDR-I0y>cT?Znl-6G_qMWA1b-Q<o#@q#%)4UWvO_pcB*
zr-HXF*e!J5kw)&|g1=nt0Y@HgV)%9T)%2G!hSYw=Udx#!zZG%cHa5oDc2NG0ZplF;
zT%}qSGmiA?;E^6mf|U+l^Gs3+A5oN*7`y_j3Ra#C;y7tGlTA!z1itMEp;%p$(0Rmx
zgxX~rFcvBC%SgM+TdNT|<BVH?J&>>tgU#YP({a%({DsCB6K^M2Ut!YW4k_=UNFK5r
zisb%ds{U`{!$xbi8*{Gf0a=Q9e-u4N!VO2V`H{$a-MuIBn=KnQV%p4|J%=qTewc3Y
zb~OF`v~Lq3nV@e_koPE0X*&!Pkxwv0u`EyyHv%slhe~<I2S}ynb5>JY``qwr5Tu(d
zrrnl`n)#h^k%f0qQW))>$N-#Fe2hAsp#7?~V^iKD9FaLNbG&ftqzIn}Cw|8t=gY({
zr8S!I<2Bd?SU38MtXDH#xE4jZ<ZD1B3zr3*`&k7DcRyj>JXvl0JY5z+Bg`KDy;&lN
zYdG76EFWKZu}Lb;1{wJ#T2_#eX%BRsa1}9;n{Gq^n3CXi-=3g#5^5Cx;~_K`PUL7W
zc={mRyfdXwI1WYA7U*k;dBG1x^q+r0=123SpdLfr*8MHkEdhv-j}TEYem7x}%4H<<
z#8oge<u7)%K}a>twT0bLYvSVlylO?(QLu9umv13AeH)$2I(6`lFnXE|!1&G)lPpcK
zxZ;V#PJAHb!ezi1d*~--AvDHmcPg_vvC#w<%>c~VP~NX9aL@fa{gww2e<vv)gKc;Y
zt3?tfU5@Q@Tbr3WSU#7N7&AQYgMt)6%qt1CX}=ijd4lccvyi)9dCU9L^@SauZ!u}y
z`ro4fCt_?yj);*6SKv=m8l<(SVBxr<sZWJ?lnzw1ag(#+R1#ido%`pdt4>4;Qu;l~
z<Eak3oFth;E)w;hjxh;xg9y++KWiN8UK^f7?AZKvpyot~Zfh1@Z`Fv9`<4klP14!C
z>W1G=FeHHxB!foSn=IA0Kcna$$LvI>IzBi-GahhX+O#k7NbRvu05CG88l+}fGcjZ(
zSwGU_$@EH1*C<m?)ba+;eG?adIuSb$LuLIj5{sfiWo#^J#N+-!Cw>W~JHql&{@&>H
zp!%S~DE2^FapGhRrwV>5I6WD+vXarr$_n}>km=H7_>cz^V=}id^nq+B&8-UP8O;tI
zubZb@f40z)B#4Su<gCqM^e>HMWV?{d$R?a4SZ6Tm{`%^uR5|!kSgouyEGk*3e>xWa
zLQ4lmAYyQbS@=`c-Z>b(OJaEZv1D@i#(C(zHHyfOu!WE?6zi4OVH~^PzZ|J?DHy|(
z6?0jtF)zC8D6QB%D5ajQ)nT3M>z?`m&(&<pabY;ifpNt$Bg4o+p91}lVcsgEhG*Ra
z(%A3nP7Xip;Qfl(T)iuMU!I3WjL=T$v8A}L3!K(_`zQmOo)8=-KVNhs;R0Qb{iKoW
zE<Q}7F<F=9Z|2Fj<R-%ra)ThspDwL1Y;-ibl=V+fO9j#hifDNZTsgS!sx%XvAGW^|
z#8I&saeemQtS8S99bY6JEpw?QaK_UGxDA}ITJ&?L2z_p;SP7YVoZ>d}H#&ZuEs|R>
zB;D_0R~ZeNe<r*d<w&;Z+e5XCLp$Qf5L-9Y)5gX-i<V|HHfZNAxU}yslqmE%06MZm
z;~vHiS8-mrR`I1(nM8w2MIN919Gdk4i(~mjo_ZX`CGRO#>{$Trc7d$Kl^8C+kbHGr
zdWhih#U&nTV^S^qgmAF&6yX?If8s~OHHtO2nj;7v2Pnkqi1g2qM#>;Q(`l-F$2Y&W
z4Lkc>dEleCVHF-}I(ciC9l%0_9%h4)d<E_~zd14qJhkF$9u*mUFgBvY#*3=jUM@7s
zrM`$vIOjk3PQB!(P9FV3aU`BbC`e9=eD28vIxc*eqP7yz<S;_WdnQ`$Hwv~VpRqRf
zP>zp8mT*kId?qMk66$0TNY>q)9;Uikiy&kd&%FK?Ba@kRAi#@mZ*TA6>De3pYS?9J
z9uyShNo4F{3ZrnY7mp|J)q7paZJQeZ!Gs4fydww`kKX^||D@0Tx3aLK*!LQwQzZ-{
z_Q2%Tc29IY=W-%5{mDA>CrHXie<gl!U{W~$k7DPB_aRhzo?ad;e#tf961fNpZg`YY
zFzA{!z3{nWn)Dh1jhP!htB0C422`q$+6s|<J~qQfPduu_U7z-n-%H<&ITL?YtitMg
zda!pn{E4a0=O%K#<_okw_`ul6i<Z7aQJsWX@p+e+sX_8J2|mHR1S;Nsv#0z^!`l+j
z1+{4E>nEWTq}v~-fr>(J*k~40Ao*s#QWbw-AG1EZ(-%4vh|a%;S0tAP?ItjjFN6?{
zQV{)HDFn`Q#skQ0l!EMC_^Cw3!R=@N2-=Ss^Lsg-w%lSTBhwtw7Q!W<GfWBr4@Fp0
zE(UpkFFzh=#aJF@7|dm!f8oyEACkBYa(*UJ9E>VN)_!Va2Rb$ZCTE3AwAxw8X(mp%
zaroNfKMJuDoVgtXt%qc@5U-^;j?;o;(%xij<PLvBk%pCTmrhv`Fy=;iW^f_U6jGn3
zZ3`3>PMPH9z&+mPgi;Qk_WSGz(!u2hbxwYCv7W*Cq3bfJVyEf>`|zj9IG@7c;)*x!
z>NQ7g4SC;6;KM*Bv%+`=3)D<V8JmPXvDvmdUP@eA7G$f_<-Pp<5m$t~E63rTUILCO
zgnS5n72qt`ewTZHUC~A$WWhNx@dNC4i{bO&tZM5b5PtvNR6H9f6>R9=??a4Ejs2@G
z2GJ&5cq|Rf)#&Fv6!P-uZH4_yd@<yqJ<q>0ciMbHg@@!ybmHOV;ANP65D?RN6%`TH
z=ZUY+QK^k-oy!?^E2JncA@PBYK1OJp<N4xH^MKus@ERo+Y_}`N@!UivSzRxs#FHF}
z5Oi}SbFg5KI0=_M{5bj^XxSwcL`jKR;DH3l__ymy%Vz~pxt^=^R8Da_uvXYVBDT1O
zx!5)lB7bmAN&m8dEwmCMxYJ4ZkpZ@Cd$~X*lm%#1g{eT|IMn87r&RU_T?=#qCD0jG
zMXB?Zq9TOl?F3prI-AG38&|*U4TkdwEx=++eo2x;<K`YU+4?n*Q_{_$-XMA?w{){!
z(gefp0q>L{S{U&ul6mBHPKnLP^Uh(-l!#ulG-?x>b8{CzVmSSpkWCaE5|^ysqh2|W
z(IkXuI(bG*2%HJ&WKv59@|t-|eJi2Nm^u&3)rkw1q9tV1d3|2PB;4};YoXpMap{|3
z@-0Qgeoi2_*JC6spweqekQ;}X4)zlV5AYds+#mXJ!$scSg@j1W+H(ZPpdZ@?M<7Xo
zL_Yk8FSyE*PqIQp5m9m=D7gPa8v>iOh=4@FPJJChfb@3tihxFa)xSsg>$30>m~|IG
zpfGDH0v%jtD`Ov#m}qoybs0GIAi`(3$Tit7OpCJ_HOa-ZX@qb~le9%10(_KDaT&pk
zJ4mC2dB{x_hAp%UneAG{X7&sx$&dKH9UGN*6D)R+R)A6M@%aBy^8T8P|1Dy&05Mkx
zp6Tw1$$qI5KMMb}m->H=l_G3T^khMWt<)4RTEn!0^GCY9?v*!PYYpqDWPIc?ozB^N
z*NR{3X{lPO{))Lg^_6Z^QEKmWeB?));&{D>6iKBjngJIJDQ`3LR&VU*k*T6x&%0ex
zXMv7zQMS+8zf}`_&%-(j(In0ze(LGuI3l7~11Q38nS9gY3Z9pFYV9}(yUPh0w?B{~
zCF6Tb`OuVdfl%i4=V+*;D3Tj78MqAp8qN#w=6z~d;V^vg%~mnP-<kL^lM<9xJ{LGm
zMVMiF39CuS#79i^c}p_F=SO>~<7BenemlagMH%a)NGYnkR4ImhBq1iZl35qbe_7!F
z)(Xx6LdMvV9c6bRGXjf+#|!nITyWRq;hnu@4Zb?Jkboq>+XcUtd3n0kmmej!4z0KL
zvVl|waQ&4w1Kb?<k2iwF2Jf$@V-4+ZcUxakhr25p{&V~vmf`<?`hT<?A%>iM8ZdCn
zJ!G`K*k2V;33DlEWZxfBdm8pg5>`~i>eiYo(lPcDLdmy-lXVjF@YF3@xY+UAs4obU
ze4M#Oiyt>5?z#_?#w1O9p@)4WHwFH}JxoICaib#_KbLtbq&AL2bgI2?ObwrlnHizP
zb0vh;8P5yJo5|J4*c|>`<kp~u+o;cy?*Qgj$Fg^10ovkaif+xmICM2!A5+c@vS$7O
z7z15*4dB#wUlIT1nt+(X?}z@Yi&M7ni~0gOJ+X(1)iZ&+j(@!#dH)&)`cI1<GY$Wq
zmqH8w<tB=vDiQDh;Q{DY`oiOjz4f(lcihrnMrNkPfdUVod643|6z|Ai8*06QC^(5?
zQ(6IGm(+=hTIyr^FB#b=5g$ET{Zb?VBh01C$|#JtHD0dBwi*{JD~e<7r)yHlkJDxh
zUBxf29B#N<R>GH<!?li*!Y=3Rgx*t+6r8*S#mG;WCYhFQFsaPqGj}4xc-YeTWz=wt
z8Mn#bu%Nnqi7#-M*G2{r;*j<_@$1&m`+ZMm&TTkL)sIoa*@aAxcJ>%Eny~Tl#fOQ+
z@%#J`G}(+MP6oez`bNy@-!=^pBakrD3MUx^Ok{Sqq!WtV_8ow)_*oC0kd&UjGubNS
zhOO4Extt`kg1XRxM(;y`*mzr!7&@thz0z!{MiW^OXVfQX6%~`s22+BrD&_Z_-^y;@
zL-sBYdT#-pnD(vIcr{h(pZVSK^()p!iz{2XW=))djqM?c!t-wcBOe!8{u$o=)$q}M
z`IQz4GKj^L`NdT3zgI-y^t1yXWJ}OGZ{NAnMWRRejsuU6EtgR-D51OM`PaU`2S!}o
zIy#q*xs7^VNcO?S_LNJC?-{urr7mRn8}3gT<}82V|1ZYgGAyp8SsM-(7~Fz8gS!Nm
z;1E2)-Ccvb4ek)!-2()N;2zxFgEP1VeJA_b`#JA<&ikF~n_n}1tyybzb#?V!)pu9%
zD?X5O^2CknLSklrf_i`NW9+Pf{*K<M7ghoy6~o1hX6Y&k7NO_peM3kII7L@(!BgMl
zoo4TUP(YYrI3yU#&QO*hy-uH?*SQyb`Skaa?aTW4YC9w~4#I<N<%;1hgY^&kV&FP0
zi;XG{zIy9u$<E1oEh<jphPT-zVAjIk>QeE?s#|$tPVjpiS33o~xl+U=%QuOM`;I+U
z<i1tUaPo=2EAHU6?vBFrh1JD^H$t{GSiRD5qMCDk@NT{2OMTX$SL%~@9wV&oi)WPZ
z(g?dp<<QLb-m=c=MkT+WRl1lNcepM@Y6x1HsvO6?-y7VRtdzidQVX50eu8^onv|5r
z#;*&j)8J|afbTf!t!D6vSL%B<P>ynq;NH*L@*=`}d!rL>L9M~TTv+ZZD%FiwTP%Ht
zTXwb$@O-TZLsVTZV>Nt1K>O1FFa<vEJbHgILK;0;Dxy1EsZ1D@e6%f)R%;%;C}q*Z
zJkaB-fTp5U5mS4ddFX{yg!GJ_$!`*H+UW;qC>J*9XSUaomdU?j1YE?6IIQg>$jVxu
z2!BCk<78nAXiSRp*I;kEokw*jK=PWvVpbVI9rO`HcRxaBtRixtCnE~jUp2J01hfeb
zqT^(QX|S(8W`PY1O_AJk(EAeEB4cBN?k?IFYmMQv3bGM<aUzFUg^9k@hqSctR@%7k
zMET*_Q&My5vxP-RO8W0Ro^Wy(I87n*-!=E>PiabFGsT_@!-(n1pVT-9>RSNQ$l3Lk
z>zUKY(H7cS+1LVFiYOI+!#eH^L}`Xi&@E0i5*@nX;QR_+OE$Y+Ti#m4cQqzY$fyY$
zV!h9H32iT9i;9jm-2VlAmaD{WzlDh9iW<4%3*QjoCt{sLLtOELroXh5HI?~L?6o=q
zuem3pQLOW7(je1u4W7eT43A*i-fAD}9u}5Te99wqKRk$Y13Of~v-j+TO(XRa@2%j>
z86yywI==G3ZuUt)v1`2tAw-hjaqo$)^57N;yzj-x$rG`OHE*Gj;d_VD+I0#d?HK~q
z-gr+C1vR8$WVH=Axbi~zv8zM<6MJF#D~1nQ-55SCgKQ-)i!^w?5lYXfvYCx2=txKB
zMW*6`NEgI{SQxffxON<SuHHyK>7l$6dPb@^fF7P7KyD0SxKIaAoNE^NI$WUj@7`mj
z&eWsY?sMC?3XSRS5#f5`8E2@KARSWI@X6z<cr6rAgYOnD7%(tM!xzzUqb#+8l3!6i
zyXou5U5B1llGH~lvJU?u`@{n39y8#wQvDX@I^%+oh>cLdyQZuO)@E!F4Dk=jI7dmV
zu`)qkX|NBy1+SpnPIZiJ+_y#$(ECyQVL}WqZhSVgb9^hD?4E*nZ0C>x8^@wAyMXBP
zVb2Srnxc*TV^x@P>$tNau{7?!RBhp!J?9xbW1SGP+f~bb^89b>O@ho=>Y#V7BpAMJ
ztk)$!>9awH6awS8drobW&hMN_*wCo=T3I>fdZGg4E!Rs@OWUw84E3BZ=+apqc?Az4
z$67rVmfmQ?^YeAu<kgws_`WtG())-EbiapHPY|mybe3JdRZq=t$YB1_o-0^|CBM+a
zNzBa`%R>HC3T3rW3W}I}?L!>tML55dlokcLG7*GXnUr?g@?vvI32wQ3K#R7Xe2sp#
zFSZL-ob)(RGJoZNf30B|IvYt>qb;1S=%!&7K06E4U^F({MH-!VBEQ0nG3IY7upgPn
zYaN9)3?B|d5(>bm>I~G1X0GAI4?8ztN&S`zQmbk;ZV!UrPDnuaoP`zk$qP}`LJrRG
z!%o<yG-$WM^SS+K@!k<d!SitkRL8vRtB<1EdHSI<+~EFXIl|MKDCt!lmxGgdQ=-_0
z65q?Wl4EQbl-1vS+mNSL^<GZb2OZM^)vTf<*K|Zd!_MQYn<go-1a;-JV!Z-YzZaEk
zHjl5`4OY7TI~et43ifjz&bPPXvGI|$uZ6hYg06;(_ScUp6_E{GgBVzZ!Mf?6EnA_5
zs@4dO$8L94hka5fU)0mpQFa=1(TVrMgJE8`S5Df7{N>`|E1O39CSHv<?qVm>Ss%Vp
zc%vGL@7N!_&Z9F}WSFnI8GDwrDm|W{LDIx26f>XWUr~|$%khYE!}<gMAlOPT-dtXT
z=+-hu6t1=AsBs8g2G=NF+!PwsrkmxpqDy{}PM<r<UK#71usvD^RtW~?0bqmU(J;RW
z?rk#ac`R~&aPv+-wN1f{%yP)8Nwl3Db!B=F2&_4%f39oaLoYtvUrUcwT(F+i2ubsw
z(MrZE1nYR=%li3D4%ej9Xmxh0R5Oo&Z(>FS+efOyOD`_w-ctSKRv@N9Fg2|_I8BQm
zBLh1;S8PQoW4>b9ce;*RZV<pW1r-Kx>dkMwu^>rft?1>kZGv^7PYkf(#x1eT3Ud$!
zW!6bfR5K(S_dFSNTD|e9&M`a}u+6-39c<wU-L$BEm%(k@b!t3#uzi`?<L&c{+Q!aa
zCGV_C;d$?1wgrpN^(4&hS<<jB3CSlmyg4o%@il1KLUf>2v|mvPJTswGwOn%l6<NIK
zqe-h)R8QHEia0Sx*TNiqUU!!%LSf{2AxM1LmnakGma^cAcfgJ(3=~-=jmjU9x8b9(
zZwmj=8N6j=g@}4Qu{-e86s{H4=?r!Ik(!Zr7y2n?$-v@q<3dK_!Efg2V~$F1Y;>DZ
z^p=SDz_fXIc$Z##zlBZ{4!v4w*NDpVHBvnR4>9Vu{W4S;@vsB{KLK_uf*aOsnV!*4
zqg2C)$l$g^Z*Q67CZa}w6tSBF)~!qAZyrKoG08CBPRXnL%VHSyUSSG?N0j8;B^Ldp
zlO`<`&SMS?wa1Bz)6-qWo{mth{*Xn3V?<I?mP~#()b;iK-1jNZ>x+r3*5XpIU9MNq
z^%hEm8!sAY(HSqnq*f|LyTZn07s?&>=5{@^=L^?N2ms@<gaFp8CA1_9Lc#sTuB%kG
zbk$G2uLKI+wYf^Lb<TYb_BI6bsq+kvz)A+93ApX9VwtDs#3Xw4yjO6^bte_pgACP6
z=d;~8ruz)nlPVs>_YD7QBed<`2$vOW&x$8nfAfjURB$`dI6jjos(r<Lb7EOPS9G`h
z{@eP-!CE!E)ij)KRWYR_J0qfu2=nB@##{Y`as^zEx%0yk{d~s>d<P_C5ej1KFO~eW
zuTRO1+PKF=inMZzBFOd{Nqf(LI;<CI1egBG@y`5D{fMOx#)JoFwS&#nIWw2S2HvCa
zGBV`n&g+3(!p~^$=v4;pbj`OJ@qd8Auu?ZN)@*68W*zzPOUND=$<No@apsnSmzAQY
zsYeG<+pTIMn{O8n4<n7$AZK^o-VdRx_N8n*Md4(%7RUr0m0oww*YNI!_Z>KCuzkaS
zRS1b!PRw9cXSBGW9D5`{in^twUMD@}vYz~Ys$Qy7#%|^N%(0Ai8Zhu`{AdZVj-9E|
zUCpvDm>^<;ov8(dCbDUB|B1xos8*;*s6N<rKG)*o9G{6xH>bvwX2z5jtHFHc)Qxv$
zg9DiUqyon0AqodMf{!;7tNDAzX#n_#+zvhN<VVj+xCLs<6sLhtGK*Joi_Ou@rg9oy
z5bf@m1W{4-Z}$noYb>7x_{p(<(`}1zf9*YZzDp@RmtfGyLY2}<Ma!%jGweJA8Xamd
zPwn#@*AO%amHBUYGJ@Qk5xI4#6nl)~uy=x~)_e=DF1<#{IdC(+1}<(Urmj>$rH!4{
zj-E1lyW01%I1}k}=Y(=7o60W|xWi?K))lcaX04*f$H{GYP>i4G#M)P=btw|hInuKd
zI8J33O=BdjfQDx<7z~H__=%cy0$CVJw_-^cHf1;TqjHcWpEM(rUqMCGgCEmsBtLUg
zHb()D*;Wum$OqZV-s5-BcNztQ0omn;K0^puM^CZy6<4E)tX{DOux;A8nqWocwnL5P
z`+l<bY}gM@4+XAS!nt`(Xd>Mr6RCe9TL04AjDIv2O<FFdd#)n9*;!<Y4xWaH4%g`S
zlgc`|B#>E8p=(!#p3+%aaTnsCIQ;%1z&!N?VkdS27WHjT7vTX1l77_irZsvTQrNPn
ztqc0t=<q0d{BS47yr|bR`oifqs6ljAp6wz_I>Zl<DPk`R7vXVSM5X4(DOkEwRjP7T
zKM`;vsr|7aZq^*=zE3K1aT46<i#Se6F-__ygRwd*ahZ+re2~wWTHHI#`j(vHN#Jai
zGM@Q1pTZmCBkp9Sy5xMgv@=ki!BaXa-&jE!p_u)0oL8ed%+O}#1fW|ftPx6L!+&8i
zDJmv_K_D`+t>Iz+)miyWCgfN^w`<xw7A4nbWGrQo4W2R}hcwh}R4Np;y=M596O#of
zY}^wuLQT`NFb8!+>6s@pQ;f&%@-D`Gig$P=l8SOW3Ja2NGHOZ|1p_lf{Pp;cy^T3w
z7A-+ttDWBlVlo$!(QP9qqn*T{u9<E7b7#fYzt9a5A1vm<NPcS)6Ce(XT(aUTMoqP>
zQC!Di;)13@(=gIHgH)Vu2BbHg1to>FVc=niy{gY^N)h3^kuDxris$UfPc}OmJCpDc
z<2(u;w3V3FIwJ6cqsRqU@@5K)&Jm(0>L&P3!X&%!)ekCDL(J+Gj$@2-j~(zt>eqOd
zzr{wvg)~@)3Sl+%^0TLR+AQ^2@_RPeMgowcH%T!fhYVO255I}#;6z{CZ9qttT|hiA
zU&whWEhso-#=eVi`SW9eZ5vw+?@zuwL)(6hj9Mk0!%?Y~MsSUiAIoz#g+tF0Hr87g
z@kFyMR`W<I)aAom`;11s+GSYs`u1Km!pUNJ!YDoa5QAk`cXzT(t}&@LE-<Ut6*DX-
zlw5%GO{k3v>vwG=PCFq4?L(r~Z$hB?<4`ba3A(c<n&d6mpR3o*Xv6XWTr(~N?Oiir
zgY?$fF1Yi>F2<2S+u>IfX<*PIQl%;(>p#r9b$JL~ZSU7FP|oqZ1Q8(lFUm^mwrzS1
zuJXg0!OtIScc5Al1hJt?cMsxFeX=wbGlwDAVJ{hMId#pxJCF|#^$A$1QA*rY<tB#q
zuP<M{#296lvN4jBPf=<a%RMEqX;&!o*-gE~RYKCLF3~+jRV0>3Fp><5O9VdNMQNlb
zoF3*#s8)ylMZ)=a!0r!??&e6<`*z7ZwMqy}LgIJaaKsy#ZbBew?(>j`7Ia!2=H(l9
zvo9nJ7YJlQ)HLd-X&iC94CL@+PSiAQu<YhkCSOcU#!X^LzlMyaWg_#MjQ%QQXr>88
zPS0%nGL)LMhgxVdUbxgGE4Eh&%J?#rDZ^n;>qz{G-TcdeXrjoT+($?|0}%k9Q)Xay
zI*vEdDgM?21@|!Uu{xx)Kx$$=OtBRNp;P4pcEVV!)&3BCAQprE^L3;0{}pNbuQ0<u
z)R%vPM1M13Xsv&I{f|FDZu1utr!Cygs7FJ<=K-65fS~kw&8<}H4~x;%)?}T%Qg@s|
z`G!~tCCBfU&T6(aW+I!{Om$aP=?1J^MQ@F#hjQavfhGuJ`~u6!MXt(e*bj+Fye~(_
zgScJga#Jh+84>(n-}CR-)&Dz$xSj_1{4V9&`hY|riUgjU!;KkV@kC}Yy@^Vb-AoU-
zEsg$XyMCcwhvw6@Y#MEAm`_|<!M%Ow%RlDT>^}tZzyJJS#dY@+1TmtkG9w>;_E$*f
zM`p)n$*S9T&#wdCVXslYYMpW4!-s736dlu#bXEiPn}6o`zr)6+f0?nTUYwcpygAC#
z?_B?by7BfmQdya*qMzLM4}Rq6e~tJfyZ=9wu|IUHukZDK{s$rJ-_f8xFVmhrTH;tz
z;hqWM*HM-s*uC+r3P>4(asynf6S(rVR+oYG_88}_ZJ8?#dry1ZM*X>(JFTpO$YKcB
z@cvPlR9HBGqlm{(uWJY2+h=44+uK{kF<}R+n~c@(?m_4D13Nn#`gFqKbhY*iPeh%$
z>XsVnw@eQ6pI-{GNl2hWN4AvkQFpqaq%15(B_S0L*gTG$vlT|%wILv9F!XhPY;;r{
zs~Gxk<@|q)#aDTC&40qk5T!Z)Y}f${i^XL=PV}U5Xa3LPS%faX=tXpNbo4YlelT@;
z2X;Q11qeT1W9jJXzN6}+WzpDYxxKxeoL!CSA5k;v?xC90sJ|{SzRmn?v08|~+<10A
z<qKa8{TP#6rGfI8)pkh1S*D@|UST)n<>j?lX=FNE&q@pZ^~(fEP2KSs6BF~NM3N<z
zlIb!e#?1w#S}gzJzkUXM50S_J?@fQM$gMQ|Ecy3Ui>-EccJ~*9q*LuuEOs3l+Is)=
zWa&>&2+YSbw+4=9%RXy#`U;YAv$1tYykk)6^z|t$DPi~+agjeXJ}hCA|0EOgg|Ok3
zPX_m!Vetcz@9Avm1zezLK_tHnhR6HGmfnuGlT4|Ix}!1p$M%J?&!Huh>ZV!iD#j{a
zQV5TJ(dRMVAA3E=s`T3V&UnK8%-+@fK0{N@4l2KdF8|pHtNMapDPK#!_#N@x?18`|
zhF0s_AK(Iq@yLIXrgz35c745fXlzUZLI7p6Tjde5wYH9g)R)*9il=;H{+;9Z5{}Pd
zc5Z6)!&@5oNnqS7LMk@rX@8i7mIB6);Jx+yFY2h;``42!ICpGy+>m(DfKP==ncJtQ
zr@(G#*t>0PrqlklHQgW(5ZJc{`3P$MesMB)Gt{J>#?d+u-uGDN;&9p@Ctg~6{9-;{
zsTULojbZN*&@)_Y9iq$s>I#w=ASdIwOcdwYU>C__{H;X9XiHS<`YbtH`I`fvA)(XZ
ziG(o~{^J<I+jkKh`t$Xm%i#4K9XE%z^8th|ia-v!UnQ4bRL4WYW$uGaps4e6hu@j8
zJ98E4I{WEsq7)!>@A#yoU<jBsTC6c#?R4h=7#AQj9tNRrSV?1~#KG#nqPzcodqLg(
z8^<6#SilF`@!>?m`DhgmlBHjAj$T!{SPuV`Pq)($3p%L4ec|1`IRYS3RKYI$sTJ$b
z^U=3uL1c#dnzVLe-q#25-l!u4bOF-9hXYOQ<Xo|4Cgrf6?Yj-X{cIYOiJY4F;G?+;
zF<Dt8NUb7K1%;R&U(rRMIJ!I9C@6YrtrwV2wJO!CN!;3sIy!{zGOZ`F1vm5y^dHjr
zArJbiw*;bbHPy6>wqcOm_YZ}XJ$hDSeKs2%K9{^7baaTcn(W4+(*fk5FL;E6PLxG%
zXX_GXX4EOW)mC%m2#AQ=eKwFh=9dYg2p6WJ^hp%L!lWS~Av&Vuw?wo4P%zCv48}!i
za904##f+k`V?iB<+304+#NrM8zn+f%iuOm?*m9+*py1%(;r*dNsvQGN*Xsl2-$W1z
z$YOt|Ld-*$4+pQda1<+K(dS$_{#mUUr=Vqnm_g_{9E-w4wc4ec6y&bab5+{75c0CP
z(RS#5#A28bVUcOmP`02~a>n3`<6$VN@8)+_#D8_W?^PB7^EL@~B(T(zFrNZ3krn3z
zF5{$8oQs_rgigq9_iLRA7Y~m%=gM*v!og+IZp4PX%XS?oJDcR;=6FzW<^7jm(x+>m
zgC)LvVdoaj$j%;@7xuUWc~x(Wq_DJD{v%yKfJjeAf`KNQn3&k^XHqF;Olq9S7B{0>
zZ9mZcD=JrOzoex7`VYDs7;J28hb*Jp7;@K0JR~lyKaAu`z4r7B9MP~&f|JL=jSbS;
zT0fyAUavtstR@(E)S>-9$^sd~zE?#^XHdi;_XeReE^=_4aEad<+3!k!{J8ynyw=?Q
zt3+1x2ZSan#0#n*89zfAu0`9rlijWp&v%%P|GLM;D_$VT2c}zcn1YfrICTE?B3GeM
zL-f_u?_-Ob#PC3Z|1Sqp9*<xOMK%~raroBWDdF^&gkTj4$uD1p85tQ3Ou^xOquy#L
z<RX%yc$F=`Nu)>V{eSrge&03n7*zTAip#*l2wZgH@@^u>p*Ca$tzZV<e~M2}N0gVB
zpRLry^7Zw-Z24|bP=`gM@C(zi#zg$DsQ^){KW_#ghgFm=T5|tkD^$<5CS~S{cRQLD
z*04|&KiCovTkWPOvcjf~ar2_e2PqV6LZ&q;2*)LxX%H$iwqh{M3)43sPWf|#fN)QK
z5W;6;E8CE^X*UDi_lW}s;I~ir(hhjMsRX9Qb>uy2Q8oCCh+;ZXBw8mJERb^oxH~LY
z**nfJE<_%0!Hy8S^E(qw`7205Ts-%4i2@HKr@D6xWWu!@6li(fo@{+5r#E*}MdiwA
zuTzljyVwA59Sz&DWbvsY%~dRXNGhLGQvI+gt5n2Vj)d@pazIe7MSMf}6j-I*M8SNT
z<MEtGX1MX8CMNpGs|R!+sEi)4A>};KM_D|C>>2Pax@|il=*xCuJ{4n%{KqQ;R~IbL
zdYfQR7pvT(2^3b#XOhbK1JKVoKan<6Ft4ML^T8}!JABN5Cem(-Q_0SGRQx30J*srg
zKv<06d8l2Sx8`sGEdWb2Y~o!dmYsn?S9_w}!DQYlxYoNH6Rmc?3nWhTnq@$lVLT88
zG52$uM}05kL*Wj|udlBdgA@+5(2qtn46rLkHFVI&6b99aw1^|3HMDP&n@d<nBf9GG
z7OQT84Rv58B|da^1{-N0zm+&|#Jd)j_&Le&c8$XQGb~^Kc`Lf!I~bn{+@FyYlgZ?C
zQRWio*DRNy#^10BfuZgW_V0eCuw2CoKm(;0xzWAP09e~2A)NhKku(ZD9>=tOE318z
z-A;yh$<HsY;*ZA+%I&=>ivtlnBIAnAgRAQ|Q|?=uOVS!<(3!+K=oyrW=JPT)o;6Sn
zBVQ#B`E(uD=rgrrF$_IXdP66=+mx1U13t-6pH}BUMK|2VsiTJyYwgtD@;%1CTy;+e
z)j>R!@mexNQSWera6QlKgKoi{-K{P1oDtHK#-q|w+TUN%UxOXo-1dEQ?DRHdJ}aQ_
zt~})!>%yu@7-%Bn<RlETvb^QM#*VPWNW~6vB*%N#+eX342n~bZ5`58!a2@%f8o^nZ
z;+1k8J4gZJ2XlyePC~D{CNfLJhc<+4+}=7-cP(T^_u(CP9oSeC6WoDb3U?*gyGZ{B
zZE@dmpNG-a!SbX6<vdZ-LUR*`=O&hSe<n3KaPPiJ6x7!Y{1vg3(-IaLk+KmpBpSuK
zGB`=F3Il!{J&0ngsG+wO{o9LlSh9yUp(oSv=nmgv;T!R?3rSd&`gOd{2c+*i=i5(e
z*A^S7#H~?10d3UM9>V!=e-%+ta7l0_#3dzzKsNJlAj@ZKpx^{#ooD>YtP437vl=(?
z%o2=UdrIB>G8*w1`i}fQD4hGzr`6YmUmk!7Ip&6V|4SAs2XYRA!XOY-)<yGogEt*I
zQ0{GxKihquY?}S&9>gza#=8;9wCdlWPqJ3Gj<!O(HXXwHaynV4|ER_vBLPC!*RE04
zQCDA>$X*PV4e5RE-5DHq(5Nxtreo`_scj5tw`TovAQjIvAs-zW>cz@l_i5A496r{c
z=Tx7ipLf{7sV2Cg0jp<+LrCUJ?~!aYN&wTGxvh2VW}%Jruh*kAqSKhHbe~Dz9%_x|
z-{b`!xN>BhvG(BkwFbKd-&p?s&P6LKI`S?fK00vZ<)u1=%&`1?I0ahh_oprz2x3P_
zB{QV|cY{76EFiI)#sFF9;?v$r3M;%hTC*2iSN|FsAe`<yOZ&uMCYfA172WUs;uXOO
zu^}ods=l+dE&}<BtF%N-O9y`M9<hXt8o@WaO!z8d#dzkF9N>icfoe6z-f4TNe+_Fh
zzMg2was%sg6dVQ9M85A_IbQ1#`wvS^qfB8}tLXl|xs)wj;?Vnh+SJvh(9<l*?G9OJ
zb^Xj<Cg-OXl*YC9V&W!13Nf8pa~s@xqIS~odI5eW#F9N^k(9JhbfSzf0XB4F$9K<<
zr91iASlin>7{mvl-pJWWzX3qs7q`cV&EF^JA+gJEHm->dNc18Aow_3B2c3^gSU|aV
ze@O*0*nP72@1P(JaQ`&?k_{j;WWR@GlYs~g0aH!q&*}z&M50e~=$K9j7j8k(do?NS
zeoI4rMZuJ82HhxyRBa#XTxe`O3Nr=SP#~4BCHD`d;(HQvXjeB8mK*Wmp3#@ypE}xO
z9jR7^?Ab2o+iJssC#$3s89VM{2wM^&rY~-<t?Dh;5p}(8#jCT|rt<CH&sqr(+Ue{)
zd9UiS;k2jdkvHVih7BwOz~{zU10P))CE8-LrmQ!i4}N>!2aI3&g^OejZb}%S{;;c-
zC|K|8VYun^(1w_c|E>ay+{}hX@c^IdRHet4R!}%%R4J-)xtL7PfxV1SQi`H1a6l!5
zX&;OAZO;Ea1Mo$9B9I_ZB0yS3M#RE`c6w%J*9nB4Z}PW(3_;EiDz@}7U+s<UNUC;P
z{E{*#nK!ZVI0*g`*Q7+siNOut+1NPRzjf!Z;v|mY?kKw~<l=R2b>fm7<%5&zO+1*i
zgVde<xtxlBj+vG56i9_T7SEvQpNI?ghcljY)JSQUWx*{exs|*-#I+PQO`!XT)J+|&
zP^u<{#JoyKe(7lb8_!wa9iQT~amf3}a$fK<6DPzhliLR&*rC048Qe6Se@v87)2l}*
zz9S62!kHR!@bJ$Q!|CGO?tD~9`=4TBFqFJb^MZdQbYeAKw+}0B1^)Ka>nX&fgoRYY
zEgjZ6m&rd2bn9bS)tN#w=CYH>o=wf@=yU{{kuC>$hm(s3g5E(xtV-{{CYWSg&9-P9
zE5tmZh5pf`Bm))=yTuyv<$BAYni|&MtA5neJ4W&2?QnvmwNq?E34cuFSAsyoNA+C6
zh6?K(-e&8g-sn&L{HwiDht>wT1;B^|8=eln*xGjfDPQOQgf;c8l-z6lIFs&^d4+56
zbV%}D?@=#z-s=-)u?16zUG53hG%wruB5w=JGO8Zz2(9MNtW|M+oh4R6-BJ{Ah}Cvr
zBV~gM1_iKRk}`TM?$hH=V%#ICUtQS$kc}{-;kGxW_}f(x=}ah~$HTd6doV4vFy?0s
z-HZ_C#A4CALr>&mHPVLk#_st@skl@_*xDiN=~0@+HV1@c(ih^#5;w^@=CxYKthdx-
zy5Y3ch7?#PkHkIahV2e}{mMkTb7&3LbN#Efos^8bC?}*Z5glMZ$;5ddN98;A?@lt!
zzySpJ2BM%@n(oL3vGPdxmB)gQ!Cz?A58*kdQ=@W!rMTDFA=KZV21;8+RL1S3@;Z~9
zE(sRLmfKt-8`<h;3u0g0y#x@|V)%5}Z_ShLOtwJgo8>f7<f{gJ4uY*TqV&&8=Xi8)
zlv5})a?ExS=gIf?l0qd;-881&mqq@HkbqVKi%5_AW+DsRUkx4D2$<C3<lUb>tSl{&
zQ&UR{Ng<Gb#DS~|7v_OfOOw;nqQ5V9^C~JBau`79!4Mtzk7+4PWe8^$r$qDeD{wv4
z_ki|0#kfd?y*bg0*N6QTBC-}Xp@I<hB<-z`EUq!*>d$PU;JGr38F^ynVY3hO#+4*<
z2se-8l8kqD9I_fYN>X=*P8bR+2@&$~;5ytYtJ%Km=TP#kpQ&5Jje4|mm1va(i(V~6
zWHEdJQ%qW$rKh@fEfc-G7VADdI#|fk<r<Kbycr8{y-g>@omH0WvY8okfS`Fh(GC?Z
zXxt|&D9`9gkor$;yXE64xofqY;2~(NzSQRs1>5EA(JQR;%VtEyyOA2N7HC0VOVFCV
z-E>Dny^P-G(a(TMjV6r4vZh*JZ?wubPeh7gZ3N8X2r|R|;6Kn4VFDsB^`Lf|N}Hwc
zJrEE|%f9HO4>>@(KRtG~I=p@d1ff$w?2yXVKZ1vh1V)XYbPw74fNnOFdP07rt&7-N
znF2xT)5TbwaJW8?fy><^i##DDWlf+B+yHv`XdJkO&{nIVi%u4^?y2P7Rt^h!xdWHt
zw14ExK=PPYRs%=9gASEYIG<0m{jK{C<2OeYV;@wCZTOckN^+-OaBVytl8#tkReBKh
zHcv(s@P61KT`tL{BYmYhAr`m!C7T~~JmO`1e<>e!u@;(V+qM<3^SONDO)GrpW(lOI
z-kvK`_X{`1rWY}kFE<9k7qp8DmbjD>sZUmK94}QFNvAN5Pcy|@S8%Qm7V#IV&R~oL
zAtH+Uw}}3DS)$%$tQ;I-N%X3d)%wDAzf>S=vK-_pM2OM;ODDIBq9XjC#V`lrq!}@c
z8{T0J$ORbxAV2vwKA=$*j37<T8%P&55hJ!lT5fO>p?@*H%`VrlkmncLir0CC_NxnV
z$h}Wyv8&3fqY@OZ2ic)ku;BAXl>1ROll6$XFPy;Y6NZSajPCa?^6jih+8Mp^ORX_&
z9DyhWyST!v$LN_ZlFQrZ0pn+^nmV2+V_C0!iBNJ@fQJP19nJ+aKda>?`j5*gN&odv
z$fVqW(+hj)dlh?`Uw;PmuQvx^7DGe2qV$f%6oSsW{p5NUVMcJ0aqf3wg==h<K2>Ve
zif*#hc-~k!pDYGE;vNb4csk8^@4~{qsH!1)S1{_f!aD7ZcSAPaE|_1NG&;QTA(cWA
ziHV6#%*{vqG(q>v5NoXZ7xIHh42#871@?sWD=U7nvu_m?W^tf5^(UY@1=lCD2sfI6
zTrFV~*dly#u4|#dK>ZIuHX62gsw4DW0y3@>j2@$n$yUy+S5$n!1P0Cnbc+q|*vQ1J
zi1Z{3usEJ}m+(vBfS{z(y;B0+lC$qPq4?W1DV+pna0>bN#B55Qd%*YaD9y^u$u(l1
za$`Z8+UHkZ{!wy*Kq;XQ?)6*^J7VRY$}if#fWi_QlVV!xvGdPyQ9*0@w8NeO4jaek
zcWuFa&brIyjoFOkq2i+7;b9&gQIg&R**=pzV**c%VF3)x9btcx1f+Tu8%$-Ip1UGT
z=s0j0!EnI6u;Y^=<XTc0y`cJ%hQ09L`;wKjdVdUSiW=%Urzg*5rx4&k94vrs9zkG1
zY{J~6htz=6`RMQTRy4A=43@`?>=y_6r~@t3tprwI4Fgo81lCXu9r=7PR#y!@d9p-2
zb8kLu>eWt3geF^RGI}DW!4qAFU$9%w_Gj3RGxp6VzPH*bq@o@VY^xnU8Be&9Vbyf7
zfX~5-9oT<?R0ye8qU*&G@L3`mC7x=prj464XrDz~IvwD~pKrz07ptrwQypO?DQ+q>
z9&=B3iGA~f)?7?wH^|>7B92)3Z|wdDxkOGd8<v%o9ZVN-grJeYS@OkUP`<m*6!(+k
zBUPpXUcy*<i+_zfM=QjU)BpgI;y>Y$Qvo$3ztj{u1b+OG8&#N(KnwN4jv3io4SWAF
zPKii}s!KcYe*2t0n<vB^a88@95#j}KU`WRcu?9HOWm<$d0UYTwX=!Sa2QfFh6btEZ
z`wa#aLG+DOU3;H<RBM@`)N&wZZ?~k6_YF<chGcI@XV=7r;)^V0-vTDY3+egC3;D|}
z(GLgtApV6V{^gs5Cqs<Eza5qThB3D5WbwR8RQJcTSe-W!q^Ds4k0)^^08BM#h$4^(
z9e$FKXud}WMk!&im_p#cSi+4ukZ}OD*+&jdo`Ad8n%L+5{w*a1MTjglMPDcB|9F-E
zFAwP-eE44aJLEx75b%SR<6M?cq2v9OLd7@$7j}nExg;wd7Qe|XG1|#!sI2g*uPp)t
zOs0&<vWz1ymGq&90&IFr!>S{MK5^TtaH-dkUpmf{jw_RJvjiN~iqL38n@{Kj8rnN=
z^enL8W$V2lphPFU9wA)V4{XG<md%pbP2d!m*1ffO!C+#up0ipE#S@`uEci0dDlD9|
z$K9Q5y+9Vv_hIz&Mve%ht3T%!6i#V_=#@yX0k#clSzk<3B{ZNa@z4uXY~{U*r9BLC
zI^R1M#?oH;??n*S5MB^OD~C)gx)8Tl-5gkXkY!1eCD$;k737O;X9t%Do0^T43qi`n
zpW>lNst7(F*Y_)fA9aYI*a!ZMB*euKf--KRB<LDE;X!6PBU88eI5>(orMK_saRzj@
zS$Q*-J|`BtW!3z0gpA3)PS;-g8`3G|4yZzWv|4jzbx!LI5^mz05A?pW`{yXom9d-P
zwvi#6_TW-jOzQlbZQ>>)2ld7rl$!HVkucyxy&SbZoQHi}#urk_YPT-PS`NvvW|V;M
z)w|}t?}>(qQL%3fV8~^ku6*SA@f|+B!7lu2-tEx)s0)1S>};imd)0U<8X_IKe78?k
zNp=P|ZOptmwzh^a;*N?@4e^L!qw*+pTbAR@^n2q0Sr)Iyxtdp!8ctUTeVFC^XZYfD
zDK%c6)=S^bh#mCyiI}{KDGdBXdcGWHQsoR--QZZvx8v%$ulv{gCt(4j^ntK1d_c`W
zP|_R7R1H;ZRZ+%Z7J7-q#5p4m-cMA=n=ivk=eCWc?&Or(31OPNPANWke*;TYB@tF|
z^J)o*bc9>ATkAewm(9K6LaSBykZDYyFp(89T;Ys<h@2KyHk1;`lkjoJhhM3|Sz@+&
zgGio$Q_MJDrgyLO)yc;h?+3A3u@SIU`odsWhx4QsBL?SFT4ub>Gch2t21-;v)%eN(
zkjIY(Q0qF~No5!y@_Hg$7`z$VNonXWcw(<0dH89U&F7fp9^RsN;}w5Z4(&tT&V-6R
z(}~ykbm&U&W*2KZbF9SRgqY~cu*`IDJ6Qfc<P&_0e_u&gi0`XjPxx3QXR!xRi-P~?
zS31SyGgp#NSf4Wz5Kg$b)1H!X0C}5HEcJk>%LmL6CQbeuLz8^@5$Z&Tgq&&cE#0iL
zYvF@{w@bY2O58`H_$^;_`Jc(6U`LM4UlQOOpSSvV6^p`kFm6NxHp`&`;V>?xOSeq%
zUAAX$L(Stz5G^_i{Tn5KAi@0Kv85X(2>J^d4qyC0L;l(t6;u8zce>n)<Yc0_B6cYb
zucyo!zdN^%eu>N4$PioDHZSW0xA!uMQ^nPMHwBt)dt<?-<`lZz_EIUuHkv9t`jEPE
zEudpQ<D@w*JJhy7(=5;ojTY_1v0$+%2hg!^=k#`;vM05}n)9LJ^HSFfF%__<)sLp_
zJq}K?P0R+wK2t3&t%(XW=u@zZscnm8X3r%rzX%rFZ$Po|aTU|dDTTzyy4|F)y0k?5
z`?tA!x!|Pxs=qBdb_vDE5)LydFu|PS=L<zUNX-e&x{~M92TB_SXW}b8N-ux8LEm*l
zah>1aJn<#PUwS+1yL9<<jeG9M2T!x_H8h%c$;rZUgRgTk(KD99x8?C5jnE856KX9j
zH!tbmtI4;(9Up%S9W&tNc-GB)KX5e3cjw?DW4;{weNv+i)fLs;z}5qEe7woh>k{L;
zfUe2R3!iolD3a7=8|fewsN1_O(xBX6=w=aZ6EMA@+CQGM(EJOMY@YbRZar8TOrLAh
z;M!d7g{W{FdcJZnK&!e3U)lTvH#-k4j>Hc>=GGjY=n+r(W#7Qs36<?4cGIYl(Cy4F
zzzg<K;GpYtR71sZVP(2Xde|F5ab>5*tt0Td61RSXMLF&nwtKw9;Mf5w+!CnM0yIjC
z-8}P-`j#>>H0p`S-ClH{)rw8uK=79MxGpT*OKyJ??t6k=_skxG?IV!FVrAQ#+Lrx-
z-oUS9BeZkHaZ!snFlz?Ck4iX?y*?9&yp&SgA|=S@x{>#B7xBLAPKifcIFGB-|2T-Q
zR3{I!-20W7sXFL6RzZxy6!R9ee1`|X*f%tGiQ{?09V<JO??W3mqT#!4ynIT0-$t6Z
z`)Ju2LrHxh1ZH5O0f=n_<j!<ZimV#DbW@J&+ohxt_yB|>!kb%e_`JMwiz@xHkR=HA
zBeV=;ZKV1D@wT@TnN?Llk+H9tp!fqIPpGkDNsN+yWvDyf-o-Z{1&}p-R<cf(<zmy7
zjKY#HpmFzU6gh*syg;Ptt;Mu4yF&JzD6EVeGC%`aM!DG(_VjEuv;&18-wv#&(Xoa9
z>=225hPtTx!+(pise4t93p44%vEWK8es77ce@+m#<6gD~n;F;mnnT~qVY<bXuK+d5
zOyBm68A1t{#No<^0tqLT`)@?PrOOx@Xf50GXV$D{TrRHCdih{YLSPM#FHyk&5vbh*
znd|x}T)D0R<0CY#gwcRxyHTce*m|mg(u~leA05u{yl?7!Bcbowez?YRC{L)4j&27g
z*1oW4Zq-+iLWIVMhD~N}uxT6ElK;DhFAGtP$C1kH?-p`N>#V@CMtHU8w3yz7?YLiz
zJ?*Blteyi*_jP<>T_tC%mIoho1nfQ>TjtqSg&b7X!ar1hN4I3c0G<$rO;8yo&fA9+
z%n%=uZG;?Njo~eo6MRgu4l}OKaoYV#h3p_Uw6bB*K8@G#8||0ufl&zY$%MR=={%dD
zV|=k~o|gmT&uQn*cgI`XSFqJAV<H(^yJgt~i_T!ExQ92!e5xX41H>16T?zAST^DS&
zO06eu7VkYVooz^ZWZWoQ)fpwS+PZ6^o5W)F$rXBhNeTd1+L~UrqcJ;fH#oGat&G$s
zd{N#!lr$&od$)F>7Zvl}V>!RNoN*si@;%GZ{8bC#Y)3HNT#@q|zlvOSC+3;Ep{<jk
zVUS+owH3cF`R(F(e(_G68gFy`Tiz;Lwj&s^%3LugI_p5W0J+>vEi~ZDxcTTMrZGu&
zr{wm?A%dfX{h^sXNygB{rlVKS#s+n5<1tTwxSBq?b!##4>fA{%$h7y^$+S_RMJ(%V
zfv2sRn=g9azvEdD_EE2^Jg=c;SL%lJ6Y>1HS0i?GDRI&fSMPj9=+=%06hCLWa$1Cj
z<0-`@yWY<HcRNm9fYTjVO1h8mSD*f1M8J)5GT&oTg}T&^>srmlq!ymWnn=gjm=+L7
z(<Tsh(Dp#7O5o^*II<~*+wjhtcUk2Lm5FnoGC@|k8VxKMbl{yFw6_<1PN~^m=R!u~
zj^#S_{tbu8TjJgWNz)4_S$S9!0w^Qn!Zz@SAkt2;<Ke4#t=!0chKF3DtdiuQfvqay
z@ZtsAgfg#t`2zBf&*vNp+Mfr7ujokZ4`c@;ZLJx4dULkHFNXDK?`p3vHNy-LumuLT
z0G+wc{W$Ii*QqfR)~mW}@!tZLc}(4Lr|XeYr}Ei<&K*PR=9tg=>H;Sl3YMOwzE(^@
z-HowOcI_iKS~iN7LHy0NHA)0|chn7ar>R^~%cseDnDGt)MD=}H>6n)AF)exJa&OfW
z?pBEvPnbsztNXO9NCKvsi)rS2kF36Us;q;>l<s>NFS7BrfCk%&0+rrz_Z>xW;t?75
z9<aFSmE@f@T98))S0K~8;TzqRq?MS!vOAQ%N7DYxZ>q`>%WgYh8Fww45Xm-D<rWcP
z4YuEjLj5DeFcyTu25Sv42qo65PcJ&xwi~cWZnhFy-3(-*G8#<upK-lnSRk&ID(l%O
zlr+bLk>uk;>JMK!E;OSBU3rC`)Xd$!tiIxls!98K>_vAyQ1u#4l(hte*(-lO1V**J
zW4pdZE1vL@VC<|(Z1jRkj@>i-FesVY;31fBb-+&{!))lHwH4DZVw1B9YfAqTmXvZ!
zq26brfCs?3C;BfxKy_<d4B`jeE3U^#2V(7~qXc1@v({Vk*V|14u=cZhGWKi3icRHa
zw@-R%T3<huj<xzXDS8`R(IdDnqiP7%vpmSRMItD6{oa;I2;JiG6DGlj`tXhP+-60s
zbgU&nX%O3ncpkS`{f7uAK$G)^(s)dlwL?O^k{2TkXn$m-ClpN}+|ae%jv97Xw1F@7
z8QGQ}2bZ)Yf%c;ebih7gazSrcFT!o^nKnz8$%fj~v@2?q{9$^5abBA-KO_Mtv^E3T
z$r3|-=_f!^`K;vgGK#ck*mCq_r6Yg6y)eqcX@7zPbn#<Tp36$VySez_Y_^H~0;X8{
zU0)*-#;j(3Bc=lGMBW_Bk^5!w8<|^~McyyyT4;+f@El}W%h@&<F>tyWJNu0pn;)LR
z7Gh{}M*@i2vG9&A1AM=B#-W*1p7SVgvr)tuWo#QmvEkoK=65cm+)wdgs6n>7z!!H^
zHuNrqvIS;AAqUG1?^<0g!<nBSjgAk45M&D?)#PyB0NxzKUdb$42m$y#;65E`jFoF6
z77<!>3HIZl*Lsd#xU;!@l~wH@5T%MTDOV9B@~)DfQL!JlwjmhiOOkio7{m5h51pzP
z#s6CI!olYn-_#^4#i-GV;~H>Q+Dl8Agk|0tw3VdK)@*HD4_?Gv<Kvc`yDXAn^!hNd
z0Xk~z$pXW)G@i^D66^3$!`b*nJDAZC%3FmIa<%HTJhp{QI@68*7+;UQK^-*Xkg15Z
zPOg?Qs%)NO@fZ4v%vKSk*z+*y496(sfC}d<uw)xerw7lrx&Ntj%@x{vW)$6~6^28q
zULtXRY_eS&X}01;u<CO#FxutG6jLpBc}mTR_>(ln5`RyobUwqRhmv+(qWBQeS>s)a
z3%&8poON6T3i_razQXBUJWHcLtu`7)x0~UsEB_uc^<iG?!fL)xLPrnj=jAD9e3i1_
zSOi@6X{F)i??yJ;zN?-ORy@Xmh(z1yi<BHw-v)kK7x_887`f>6)56bC6w?wEl_0(N
zJ-a@uT;p~7ZPnnX4Z=y>dBIAR6q!Xj25J?1Lk|nQj*?^Bm)b=188&#A?K?RO@vNtB
z?zj)ob_?&7YrWr9{^<TDCFU-a8VuR`i$1GR6T8Aenfz`F11b6_wX8<R`6(x0hzLeH
z;hRx+mldsk1^lRt61iu@XQTs9M)h~_axz@f+0T08l4GAX3`e(_hT;xHGpk`t*7^tN
z<W+!jLYR%9Brh150Msw}iXSRec~#2aW3Jb#*X9w+EV9sJ&IbT1=arg^j>z~eSR|j7
z5LMeOC_Y{i4A7V^Xcm>LPWs3A^@hAxuK39N_4ymJWYv=7{@wfh%6Vh){bgG1VovqO
z<%zi|*HHw4_xz!mKT^KO*Vx%$x3QgSWDh32Cst~Z@ylEk!tPYDM+%BNZsrWgdL&pJ
zj0Opo9B-4H<S=)ol62;JtPEVIS%nb@L-w&h-Z&0l5;Q#1<=b!@*xd1*HEB1Py{{({
z!n@nZ`k*Ex!%PS`9v3Ppk_O2Ztln+pf$KHH#=IGESs{o`2>#!$pOk9zz0x1o?=z<4
zRsP8*gPT!Op+<_|-U+0nJ-jIDkaXh`3maRaS5dB261~YY7x&?$HucX2zgKaSS)dK8
zv7m8xkb#RJ1G|a!)Rq+z08n!k9HIbJs7JHG9zE{%ajuv_Ge4!F2#_HLgiU3mT*C;V
z*ssgPoo0qHi9H$|^rVDQFGV=v?hKc=9L%~2>k#|nQOu8`%(Nl*jgQ1j=W<E#!;rTY
z<IQ`s#^@mR*1aE@^g4%XPPhiPMqGH`K-VAE;GoVnjZ!Foq*OKmPPHnZB#RxD46INa
zJ%&NywMu8SwX@A@2C5&Y6u4yUvT{&CH56U##)StR1x<NeTi$=}oOn1O;j}G}8LYm<
zkR9oTr0BQC2;K#jB`#z*KAQVlun;t*g*UyW=$m%Uk9uNluvQ%1IE=!xBGsn3Pb1;u
z0)sXbL!C@P@io=LLW9zHZ9cZc!$@&);@%IHxB%=}kOW?pRMB+Nq{Gpt!m!m+F}skF
z3QtE{Wnss(Uwv=9XkJ9~)ktZg^hANT{<M2<>s#k?+2<nh0LGYVxbS-4F?d=)(FR#<
zX6|GuH3Oy}^Va2-?XqE9d{tLQZbu0AN(R1wvl{OhftdQsw^XHbd8j67B<_S=>n%l)
z;LTU6QM`RM)`0TZ<6C?3<i+g(ogNcPLoQYULDbzc6k}K7;^$&xYWA+IhM>txd2XEs
zYPN#sO+pC8Es$w$pMtYDeZDrNzn|_t9@eU>)#qBU3Fdw2_(Q#b>bB^JON~9d%acrL
zqfpxzI8n4`SxzU?Bp9@IuhAoSTQk-E^B#PJ64t-RDwr1#p<*9>`t11JPshWr8}K{w
z22YH5Z`xGaXgsUHb9B?$5wn9u7voAHn_R>>NaYftjoL-LdMj}Y?*?b6J@kFMpXlKw
zlf%j_U6vw4LfGe2!9upyvN17@M!GM(3ZhlKGSbg_tVrCOz_FWgXO$vwQ`YxQMVZvG
zi}*~?7{71&ZBWrR_Xo)?!_xO<{-n#CqCS{?9oAgriXZd$-QENpCrgZF6R_Sjza^a*
zIj4B?8Q;1NWTyRG&PWY@f$>OdIzNufQTk@)rZLb#1vNF$5}c)c)K<=8@!~(;K>j4l
zXlPX`vY)SZHsuiID`7hu+Bq)Dnd>y=eo0ZdyGnsyF0-Ibsl(nTvHv-zqirGo>aOVA
zc+D^qv<rJSxM)?RRCERG3qy{#X?i<0k|OySJVKU`KIP#a!_Oa*uif;m`OpDrI*<n8
zRsae<^lAvB&X3GJ=xGurb+w-T<AQB0ZpU>ReRJTLu1t@wO+YA#8;0?Bgt3YQJZ0^+
zDqR2u$@USltL`um*&PsD^0|3eP_3$PA_A&UhK8+LU3GcGv)RUnc*rXZy}F>Ljz4%5
z8dFfKglwD4tnpjK^n2~?JQ{$_GTj3c@UU_nyGhrce9VQob%8$8OpLml`;ffP1G4kx
zjru=>kxjs;VKo8Qir8F*S8*afGlU>`X7{^E0JrN2P{bmH&KenA0vfB_ItoLc!1#Jq
zcGB-xU<ysO0j$qmbgB=Q(5*AL#dK@BGTdU`1IljAIdJ_ZMPs^}#S=yFjT;R>&t5Mo
zN6Tva)E4(Z-#0+@b4l)PY!aK%7(dV*N@SVuU_%Y7Nk48f9wdR!YituLwCF(b1^|?j
zLzTa^mrN}F?64bw_G9cy`dYe?=u?fpE$dJ9(x`68$%|N6nvlIgZIGeiMn`Jva9~@1
z91A}M;nt<cHMSrja&J*+Sy+LP#Sa&Od6dJ5#-q?f4W6B?fJnTJCVq&QiP*+0MVWmR
z;du;uvu8Wywd#1V>Nrr~gUi~etoya9D5j+PD()9vY=h5(@isdah{L0hOOseIOshd^
zr#sR{{If9sPmzd)&T8>T1wsQ;YKg)pd^QLl;Pk#NoL4}PxkN~e|H<*rj2ysi)1pjx
zTv6BZ#p`r6_e)G%gbn(UJ5gu!VIYpYw$aw@7%TUBtW3~~;i0?-e)-0R5$WEwZA39K
z{Py>5)z#lg(V)43fCZM)pi5+iVpoy<S}Rthy28sd2lIZ`Wd(g54i5+#l8PZwU;)ct
zg@{f}AbW`Hvo%`FMlF7SXX$Y(fH{C^KH0IG)^)UQk0-WbH&=ywyCwkFTM;=`;bd*&
zHITrdA-2EDS>D9(Exof)K}dTcfp3OuD5@jWIP#&uCGsJ))*3fk-{f%}I-}ui(vwjn
z4CM<Z$=2Qr-N8&fb9%jH<nCi*uka}`+4pTsCxKTV<f<7Ib3KkS*2GwlYG1zK<N0|Z
zPV4)!P~V-BovIb5qbKbT6zmeIVBe?mDSRd^&cRi1XYbRRg52>6(ayY$6kh}P)0){s
zjCD-7wHu|Xm541{@Lgn4y&_Z1(GZ47B3?L0_U2ColzQvAH!vlPBI4Opm)j(pyGg-#
zb8YV$%6K18h(jnB(8zccQkH*Wdj2SQ<|=yWlV4rsM<v#pm6&N1bU2vD0PYb?vH6Au
zdN<m?MflDS8gpu$x)ULG1`86Y>t#u4;Z!NIQ!$e%BesGlk3(l_D?&w_%zH+Ucp6d9
zAP3Oq$+Cc>78~wXV&+8LX8Ru?OiH%FZdISD7B}uyC$n%~WU^s*kQY34uGsOzK@k@c
zRM~?w5ei0r8-mM7l4w73?-sT!#iw(GeH>?rl5v>x>0OMf3U`k>)XS?IGKC)?7c1~o
zo)e2eeS0KuqgSI~>Mc{oOQ5`)BDwGdeM}X87+3v-anqB+#*Q@`C}uyR{V|Ttw^s&F
zcGS`8`Hl1G6qGvH1fr0q6OtPWOf_4xr~*7i;it|5e5fShgJ!t#iLZ$HKh%e0T4UNC
zXD16>1h0vBiQG1bdWPj;CXFYt?}0P#Q>sz)6J1g{bLrB#En^uZ)yc<O;j*mjSo2+M
zIW4CUknXA_qy==v;7(e;@1vWp1&xg)r3&TKWd&(jOqWr*X0AkqeJz<)(=>{iIpKJ3
zgSQSB|J77~K(9*SV6}`pdr_yPQMkKprogh5<J*BQ*`X0Y<g{1U4WAQ!dcWS*x>C3W
zXJ7)y$bFw$<BL1)cX8)vv$c@+ar#k`H91Jqf7{x_Uwk0;?w@{$meZOx>C;eI@F@N<
zcPI}6f)bvaB%_DVNDpH<K{eN*{i_MI(y1S0$c8b2m9P*llYsYhQAC8p#fAP4Vz!vV
z&^6S9J7yxB2_J(Ofj8O7K&)&aI`bzFQB*oiL4SifJgrk0{&s9DQuM*(L=(2u*?zvl
z-qT=iMtuqLOb}J}eB>9C74mqF*nlMt{boE<^6rK=G1X$5rtyP<ia0iyFoaonpe5Pn
zOG7of8Xt_1H`?(6NEBmk|A)1=3Tvxv*F}pI*I>adxNC7QB)AoKD9{$S;x3`MI}~^K
zmLkEmxEF14THIx&-#`Dk*IaAvYtMsyHV(#>WQ@G>yth3=5xZGZ>EEK|(IQQQvw)E;
z8aIA>c+tiW82EN>(G0&nH{k2+*Dc@_Q{Vb7@xzOjWyppN9{S;{NVL`z8^xylmgy@o
z_h7R-W;BVNCgVzez4r<<fpRR<s>pF92yR$gcvi`1hR05x-!S_RI>mXc?&uHr6U_9j
zVZYyTi$$N~o2y(JL~TAY0$OU5-gVio>$S*<bjG@6SFab1>?8!D1FkLy*AwcvQ1!p{
z0lXC$Kd;5D=WAztvYjmBB%3b}%4|L`o1T!2PnUI3pd0LZT9+0kFJK*6!h4foqrgt+
z1t%pHlM8ai>8+y|K71{-TjEV`-DQXKmh6TFe;LagUOLvoOj3=Y_ln+ck{f9&3bL^^
zh>%D-GVn=#_3?>LY~+*kvlC5-QZr5B`lP8PmZK(%Pu0rw^2IVQfiJhs5<N9E$`4Ys
zrYj4wV{_whm+;r=i^_Cm7(}-em>tA_{^hISk`#5o|Gft?<)PDe7Q@A)yTdZ;B9`8H
zIJPq%h^Qo$Hh7sTtQCBp{kdPV0tTYSOPOutqiOUp1!8)tIeezN-tzI6tsu%O{O)VC
zfq<fJ;%O5?RfuRsw_2%9OG8;`NRy^f5vW{NBfIj}I&J?#vj3?()Qe<LPK`CexTA6Y
z9;5FxW6JniJOnPI`L~Wk?$9)Wo0KkrmQs`tmj2V2XZa1`zm+!l@N<Ipe^uK2H;;t|
zkS~L#@ji!!`XQndQ=7`bga`}X5dJ+~JYH`drq%@@{afJokK*q>2{3^BS1ti3|Nlel
z_aD+ose(%`MPOkY-28|2A2(<tE5~ya{aY>omnp!@i)7?Pc4?SmAe@WsWiqZPLnDFH
zrTDCH{Q`}-%ip(t{|ByV`L8mc|5pL#zw}{sj@bV{e&)_fO5Gba1^D1Qga6zzsYC{_
z9y%VV%JZg3iHHae0mXC6yzWTG2PxzHMa`eTft8eG8?DFl%Y~8Km)LthBNbVEeYUiV
z>MlX6it0JgYEy=~jYWmNm0-s@r{iWrnUOL3bHs|VO~=ie8w~T*MGk*$rjG0=Df57T
z*Z<iN+3}O~uGSf8?K4X4r;WEf9n8qb7M>GP&~1Huv6KW|pxUPmXM8c%;0Ox9spZXW
zw%j(O0Jr-xyQe2AY+Ngz8{y@Do(=y^3nHV_Ys3FOY1q%dXx7zwbZ{^tg_tKE+&t0)
zcguuUykW~XXr}H&WYzGg$oDwT6S^7oJ*>0jP_H)Ve@0?ObMk$DU8d^3@X#)DFkc;a
zPErFKeU*+pmIr?u2&DgC-}g)a_wJx!Marw&9(BnZS%}ETQ1$-c)Gyb3>v@Mv3lht1
zJ?c`64h-z>iguK0^Sw}FG^GZOk+78SpE<UECxHV*AN~cyJq3prPj-MynT65^X<~n}
z7KZ``M*6+1=mylrxXiEsRRth+mKWd?#fWdYsO;{Dct3S$*to!prDfnWR`@sr>G{H^
zcb_DYCW{}{cGAWnH3oH8d_Y*;kPsF%k0z(NWcSh>xqpy($J>|4$jI8KCF@xyLwbbJ
zzB9*`@8tj64=D)kZ|m>v6+}M;>DrmFj*rHEeyeTc-3HW8u&`1WwX$FoMO7v7D0nk!
zy1Bt6&uFj3XksS`8v69v9af%8!wdmZR^p*gw+Sl76EMgZgdup(zK>C{vD>sG4MXDs
zh_DVW$CD~v0`{e~TPs3ugAP(@=zsQ}T?2NMF11AYg3HIX8Hd$a!Rf63+uR}8GK_&F
zF**aT;EEqQHZ~;*-G8h}>$vcuQ=n{y3qF*Y<zSk<LEK2j>=^+lR3Ks1SDY48Ft(HP
zmkou1X`;lR&HrGZSj;2@Zr@TeUu%hD{T9Wm&Js}gmKPx3oM&h@?2lQb;T3mJGSy^2
zl+30}D!D)!8>Lp5K$#rv%C=khW+v5EuN8spX&R$?rF{G6u@vYfQbv&T;%qJU!AH{A
zCu5P%5-H_c+f2T?C1MqGH!ls?-0?}0V=KER<iGCNpJH;<>XvdI%-hE-WnJQtzW@l+
zOspYQqFhObc*nf+LYl4qfhNvG85+SvDcfpGkzO3BGj8B=x$s;pu<Vuxb&Z21$Q+j5
zkw`sv<FlJQQfNHgdVcXE_sDjVN1S5=r(^xcG+^v&C4<lKzxwkJaIJE+^glCwBcbl1
z&UcS;Ih0DarF)45@Rc#98)`~T!zm+?Dfb-E`0?d3)(;%V_E2HtwJ>V(7}$qHL@TX4
zu8<wlKgQw2F}pp>m_r5czMg-bs{di3=Y=TTqc6ncBgCpx9g+%?QVDn$TM}bf;1#mW
ztX0o9(WxwN;t6QE-Vgj;I6)(X2F67Q&Rdt;&hy@09hI}1c8hiutGe(tt2~VM8LZvD
znUDp}wBWEV<RWO<7!0x@DtQaY#@*t^6Dn%%DBSPqzF7F!>C}iZ5LEx|M0PIRR+?^6
zZY{jTJz(JDFO-c04IItKy&Gh(nU^=U_vJmdwcvi+R||=7Wf648#C$nw0DN)235&ud
zg3E~FxrP7EZ1hvLzv5fCV`%~YzWzNEF_P+#vL<bg9NI(_%y#<{fZu*1Sd{x6wR4)F
ze{I5iV;IeVKKhz*7>BK}Yg?D!k(XL<1TgQ9UIl@<gz!3>9lU7D_C(Ks1cGqz`jK8X
zVN0%f%H6|_3@ulOpL%AfX+9k&W9p>VfqqW6Pp$Fe#u$9q+&ov8^CF@Nxyvd+o&RiJ
zOgq_vN8igvq2%+53H@t?r$OG2f^-U+*YWzyVq=f>?&`P~c~8K1=uMBzG?JOkD#)gz
zR(<hC^(**q0Uj^>P##bSDz#UQoAG3sast!7>cLm`|9s|ZxDDX{d}dEjbOJGs9B|KU
zs)O$Y3pu+sueakiZ9~na&q2ZW+XtRZoW%#Yqa^}!<>Zm8_hkAYBy`^)BLd~p8ukgq
z9&&)`=}awtpsP@QNAJApOxO^z?d%y#_I~c^r3zWI)QmO9RMnCb#aB`}douuWRE+p?
z!Jp)>e;C;Jmfp;k&ytol6U3{yqa4^;>doAhEqo?LH~rA$Fi&<FP!aTp4HqUJVpoKU
zaEjBpDE38?Ot8qFpRvrYk(SNOj9w;FL1;dX`V&esc|JbJhxsxhvX2xYGq}C+BMu5!
z%z<l9vU)cwu5zf*6RSgOJJH|KAQ47takdh;7U@4~gy7I&T6jUM3=I%LhWn4uXglZe
zKu3llAf@;^fI2kPPj0fbDCxzo!AW=aJXHn=V9Jf`v3e+cNRBfuB|)tbM4>z&=M2)*
zHc3binS0YM4=dPrl`1ICP7nDpKjh%(n@5>Y#F{ozJmvj~9Xbr}-_&1V|5oE0d%FTo
zbs81(BQp;wIm2k7i*VC7!c<>b79LcB4lx6!xKy570Km2EGu>a`0b>OG_i)p8&cS^s
z@U`#8KsNs0^+C63a-AByre7n_;s38S2f<bzjx-D|5QWwXz$=jX|Eut)1q1W{_m6+t
zzj+U0pCKogSLuf2yts}2PB5kO>a(Cdftc1$zRoRpUz@NiOxZqbBBz-QT9kAF3j{0~
z-uC?hdeYt0G1x%m)!BXk=X8PiiRL=so!1#@9zDp*snrvcpq05FtFO&a`uiew`<ZZs
zxvLG+Ky^o;)h%0P1H83G<+`@mH8^qnMoGG>YprEcz)iXZ?qz%a>$do31xv?hGEt3A
zr;l3h9lsx7U>A;`P=X#knvv!Me(T8mrZmsfhXH)`G;vwF0(sy}KMA#nO^`*A#{Kp!
z+`;k5t(*=Fln(BP&-lMHe__j2NiTirjj}-<ZV>4i>DiD<jI5KV7)IYqC?;-Tts^t<
zS%3UU8vQtaCbofjul>hctUDDbhOC_LKm_l!Z(lenJ+FRwjwTBRF984NVbtd`ZD@Zx
z8ZO4`L?bJZmp)ioQ8p+vE0mv$Qo6^y$sT_iKvz!L2?bAt%ANVM^@lgnkmL8zf`^Hw
z{QK1@{h^-<ManovXj8!PS;V*jlBTQ#(4y!E+_yzuP;^XL7ac0iZTdEk4&fH8F1HM1
z@oTe+EHY)f#O(NJqXd_4no!IJJkldv(|`&-!#*5@FysuDVesh4u427Qc|AT_oKopo
z1{&@~Sb!NjWx#EaI&w98$zvpz`EDOc{?xD=mSi%^kg^Qeme8e-u1F45E8|69>95Z9
zxT-!|Ba>J7_H+IbmQtVwObH2;FjRZp<d8D;TaUs-8cn;jE74^oRLhl?{zRp4v?w)c
zmnss$xZ@c7D6SqZegwL5w9`#<sM`0}@_?MdZf+1G6Fp1JL`W5})s2|+ch(%|aayVj
z=Y*5<O9dnAplPpyPB~?ujD?n@ktH52j~H^osj_c*9^r0?F~ObX$!g;XMx<<K$LG*k
z1q)BSg)6A1$N=l$8#-co0mf{@-_$)dK9SRcq0I08bKoF;=`29FcNIOQe;jI{US5{H
zriJc|nuI=7Lx9aoT$r_2_Oh+=?ro16>V+Ok%KF!Y2)P!ZB<Sg<G+y}m7}>|!wcF5@
z9Vmv}m2)cN9XN8|qsVLyY0AA0VY3C>S1mbUXJ<o*--%1ZBxu0t6n|^>(3{e2S8zHr
z6Lvm=|H=7z$Wz#y?Ys(REv3~=kVd3Y>Ef@e_Ydmj7<bA>5w8R%oOr!3s-HL}U2or7
z)vvw#QW08gw*E60SpS6J9`!4MGW1q<S?Vzz{}qcWZr{O_@uYz(rgFB?hM6a>D@xPr
z+fN*I>rx(%5#&^|D-y1o$wMl1D~ITrZ_1(Jk4)P;Y)WlHS>}b-B--!!NT}XXe=Nd`
z>Hxb&zteg-mxbHEX?W-4T;KbPgFvG+gzO^NYMWu-<ojf?7aP08En&@X2PaqVo=kM{
zNw+iqC9sP0i`15T^tmq|Hd1qm<~D<EP)YL52TvzkuH`LSfEoVFz(rqB?rn*yyG%B;
z@f@|#;r^YctsN?f57NVY7enU7Iy638?nsLoDjYFx^)?|Qs}i-)H)T1!bBEt9+t}>x
zr_h&X+vwN2_HSk4sY8slyz`Iy*3Az#FkZbP=@4qf5Fo!ElyzJZ?8S<OpTtup-~Gf8
z<M9ZM8YgF`m?Xp=_${SO6;De3sj-rO(tDOn&l{Px5d>gV?C!~UoRqN_h(22KFh0G5
zi9D>9y>e(To%G+K8@m;jZ*houS!zlfSd-s|Mp8w+L?BC&9iC;%57EQ&z_AUbHo%1~
z*)TetV!+M|qbA=?OZ1I$rDLs=?CGBR%pUS!>bj3@99cxtyP_0&tt>gITJMS=DePWK
zub6VllpL{J)cHv<mDT!4FXRwL;yWx>tdSsDQ-w6DA)nEP-`)!B3A#z-8nn42zJ0vI
znEis=o%;0xNiD%DfZRUI4Hm?-<5cSEczcE=e?8YNFyrLVj>qs%{rmTHnUp|`AZG~7
z5BLVh_-FlBm+A?L_6BwQnk5notmsmeWm3tKgFY@eSR8Cn*-lj<&Du}|=e`r0mg$Kk
zUNNasVs`kw9BOiGSok(7U+?QS&#E{^8BQX1D&m^xOULgy{d>QS%VSOSI<5pMjL+f~
zSIi(nnuspu*V^Pt5x7!OCDl_U$IN!3MW|dl;VnH4IE-KVxAsp9fpaz3x+Uv%#cgh*
z1Uw))J1-Hx9<Kdmv|@kT2=P}B@uZOTU-eQBPMo=aRzlt!a`o;RQzSxs6FVBs{LeY9
zFOT8*`UZt*10rIcgxzx~0OYo{ui-fM_gdu9r#pQRti4%$`!AK2-yw#5@kjc3>k)Tz
zmFl}i{1tN!pK@I%wtr1+17|(3VzcK5MiBfagGI>V)=TJf<oMLriNEfSNuw_7jMfy^
zyHmS|=e#y*z{?wKoxF?Cv|Y92%YKP|kNi(f4c|M`@k~V|;D=qto`vy@&h_kkKMUbZ
zw~SCG>xOr68$i{9quMH&Yx5Pn+qJUAV+%)~qBl0#f=sd_9=8Ml>oJutM*1PCvi`E6
znmJHj>2>d%I)yy{Rc37l_R(Xi%%+2&51hjdq=e=u3R5L_czY2f9)&A|3FPL{JjW=T
znK>ProGwldJ!V*XzA;~oRauF84%Q^F4yRv=dtcCe*+{EMQ7`$yE>x<CkU&k`WEc5T
zfup@y|3+*zcE^vnTg{(r+AnXEL0Pa0`1u=2v*KlFOWp`KJqh|^bqTw<a9fin`>elD
z6$sc=dxttzb1alD&xfAB-fQMsMKwci?0q4p_TDCf@$%%y^<~{=Ikm2Y-1Up)7HZT+
z=38-pLe*BC?ZKLv&0JOj&K%kEN%v)qqU14i7QKKWGIIXA0=^XowPlAH6u4WKSZD1z
znF!(<qO(x5co*(3*ADK7RGX(a{fc?;hV~7Z9P^m>R$kxRxOt<Cs6K3mgnEg~e`gFi
z6_dL4m=HRm8J=Ez2!ERBJ-rQ6O1CpX;hdm+dD*<Y>T!;=_E{_GpiHL`=U}!xX1V#p
z3|xt9zFo4%v-yH<pBvK9>+Ce)H2YMHPbOdoozIasUmtIUs%UkphcQF`y;}h9vmU$q
zEws8AnRR^#O*EO*vKjmPNgwx7Td6!uu%$TBm5b^*y&u%cQZk=0d;-2m?Pv0f)FD)p
zwZNvowSeQ2V4mxW$)(i$J?D8eEI}i3jF#(d2)5HkNY@Y<0LNN^)}@Q>tRtqcURPY_
zpS5E{xs~#uOB=BS0;G;L@vM?cvz?MxXy=?#p8|-DE?3Pg@WS=(VpXnV2O4Ox;W8#u
zBTtG?H!lDvyFk5tp`Hm|B9_g-g^+VwqfRXExNni_225cwu`CYK$-TUc;fG!Ftz^G6
z3dd!D8mKA$S$LKXvG_5pn_n}xPf|rDCKhn=`H!`VW0f{Hq~C4@DO6g!oXc17?JPfd
z9<#r96|U-#Cb%&CP-ic|I&&6FMuIQj^{1VkzEBt7QRZIY5>vme$()wM!$pHVSc1EG
z6)>)$cJpCffm|Af@%lfH9BPBRos>MYH;4mci|7Hj8!>bgwYA-9DyUoeu5^7CcjAC3
zvyXn12A4)?*KP;jY=p|edYqg!z)!?lIJCxnBT)(a&%{UubD?(-ts1$8QNN3db@H_1
zt+j>ydpD8_ZTm>cwP_Omm$jkIN3o-^)W`?l74=L)N#&brkj5Xs45hVlyc$6y_;T6Z
zVuPSfhgvG&Q}Aua>&_4(QVy}6IYZ<@T)pDdYLV~R5-?vOK%CQL{l;bU(TqIv!YJ@F
zBG1Pt^Dm!5f4w#|H;O9J^PNJWa|q}kI-BbWJ>@$Y8zn&<#2qjyPN@69hEm|M-hZMD
z7><o&#(w2b9+k`YohIoZZc-e&oO0hAj}xZNy6KRA?q828`KD5d_h<hc3{<5eDgb23
zsHq73CLx5HQ$i`LgYMWKB`6X3CB=J7;L(J&<*?QV&Anm)20N^2kSVW8Uv0;1IS3zh
zBvR>#WRV5KE@(=&haq}@aMHoN#kNaKfSr4+ZzJ=tGbQR+-HHgoaJQp4zWIwnwGR?{
z)#36Xtu(6sROgoL+%>0M>ZZ?U-$ISk#Ssram<+XK5kO!6FwB2WtOOIX#C|}baxe__
zLT&1CKp9twQBb#K|L9YE<Vm<OaAsaM??_*^!qAt8_7{Z#H$44eh(_15qH?Is{`5yF
zMLvVKxSd)*cA8(s*VG4SviNDk!%}i&`hj!w4=qEm|7<XWk@(V7!|tF<@QgF~!wbcf
z^6;3C^lkiqR`>MMk%cubdS(4BysVJkYf-N2mW5{ueAwR2d!O&{Xl=Xxg&u|TYsiq9
zi|Dgm`g%uf`HwG!{?(bxrX^U-rC6EQYiK^Nc&5R*TgEUa*FoZor(z!enmhXDq~-g^
z@9AF-hziOiN$qb?az3OgTwY<COXplG8$^hs4mjK@os39*cID*V1Mb_W#@t|MJ)`ir
zu_x+fdUvrOWvJe3RM6?HqlFBP)32V|@@!KSKqT}(`95;6X(a4m=U!)u61VEuYGk<R
z`L4w&!Np34j;m)HqE+q5w~^Y8Kfiw5Gc6$;5qKb)&o+a!9}63ck5De`@O|&S9hPk(
z0#&L1<HTWrZ#mCaKX-R6|At_E+=OTBeE$KsE`~iFur}?BQh(1g4l$@)F8lEY+s0Ic
z#*n8waWm)*lEUT*<`Nnfrn3V8tJY5Tt4Q;d=Om$6t5Z){%1r%Prjb#4IT+yVvrE@h
zZA^~6jNLOKDOl(eCDC?7lT>9}c?cAB-@fmoSn90hcKZnuJG+T5r(ZrG8*t0R#`Fj<
zMyGoPBeY!p2x}qda)$crzF)A%sOCt+&n{@{WTsqZ@|U#{G>~x-e*0)H*5(hiyc-XU
zb!2Q7B{Y<e8E7%2j%{bAC)_28k^2#z<FqP<a;q_rE^HyOhQb!}6Ut}q{Y-=M@jZCO
z9%Vd+WFxQpCl8Sg@%QclHk<|*P`z#{j>39-#OcE-v0H&hlcr(p0*?8gybOzA;K2<R
zpSR$)yxVfL3G^`TkHwFoQ$4RS<fB=+3{x1exxX&*k;Xii>ni^|wE09SjYVEHnn0)G
zQsz<6@<gN#w9i%qb@B^q_cL@^u@|=BtdaN<6{E#yHZ1Kotw200>E!|R3n-7uWvfY=
zpZ?QvuN3`f0d8ffl6BG%Q+@x=te<D*8er|}gUYXyt<c~ruM;m(a*-Zb`Next<Q*Q_
zESw`&pr+@2?CtzagB1SpNvbQ{?a?h8>Z3E!*6PlaO6`5!xn{*>tV}hFp(4T&!gL*n
z`SOIvCot@B#pU?V=XzwW>JSMET?o!9mZOEL<kA^ROvF~VI6)CJE(AlP;9rQv;j=Mp
zQM9Fl%2=+jp?K2#iqfiNTGs^N$5n?cO&U1b|KlbSxpaR+{KPG$Z>K&-y~NJ-!G9Hv
zbB79K9I~g-&d=YPNgD=YlX({YGWU!>XP`WAY-8f&U5Gi(DEV3Ywx;cjkyIFAQ%}}Z
z{g=O89OZ8H=7T(SQr0tgRCMd8(e|et@y1-u+}`SY8bON5kV-GKRks-Kd_NWK8!yBQ
z2+E9@Y`x!uS<_+ji&s?by}hi2^1C<%s<$qCJWpbXdmn|xk<q5TViDX~6A5*swykp}
zi)BAH*`HyKXfPEh&*3ck(Bti|B`gYcP!8K5J$#Wxofwd4>+r{CP34I5Z>)9I+;jS6
zmH<d4RGBeMD@3GZx@`Ww;gI%%GAz`-bqmBE6w21G7QNsTARE*0cFO<41lVyJahmdB
zPiI#_+de-`mr)p=#ia{G*ZQ|7?w^^c4V9x)&K63zr_xq$v{n%k5gAePU90=n2JCXn
z#cutcUd+wb2Oom&Qc+iwQ#Hn-ZhMO_DVHyMYgTanh)xEuo>@3K4GT5due7KSICe$d
zsJmi)n5PgmeL150Kt@kOLVTq#_>O52oAX&2Jmd6k#%*o8#B8x)8_Kd2SP0Km0$hzt
zCtg0oor|>XC%%VRNoi|nmqf!OYz|tW>EQE?w;MP~B%CKMBPD`~8^~{aFLN-XO&5D7
z*l{3sR6f?xO5M_fG!)<qXh=$|c#3mKtE=F2IhGGCpVC;5{QC66jCt)L7QH=F+fwn&
zlT2z8ePC*m)Z0+#hUFek;qDc;_a=^MD`KX?+qOQ6ChQ9ODN!O1uH)0+8RBD?A$Y$>
zm!;2%hJ_zM;6isz-v%&BPP>b|NGBSd^ri{&xP#I~inwJev7XfZK0<HlRh@u}99^Uq
zt9`^A{ytvJN3|n!bBYL0o!p%;gYcg8ou$kon%tPWsg{sx8MB-8WeZ>!O_Y-ZrRb;|
zXZs+0d0Ly5Up6UwBcx0{b?QYFX!bEv!DWz_U0#^6JA0mQE>a5A+&GC9>9WL%B@IIZ
zuuH&^JvhRbh)RwyGdXz!?k22T0T>(qYW)W%mwAYS=YF-KK<1ynhNeIrc}3}ZK$Sv-
zq<B%mO!Qk!+{3ImDRxj_v_JoaZ({6Ai-orWQ<Lx3HmA41!TGeZ{7(YbQ_lZ`AJTyJ
zPER0dtgNuV&{OCqPZs+Bga{IQkgMwOx!;81^T5ISt#vq5_jeopKOB?)CrZgh<oi94
zXb?_sJ@n_||C7<i%=te8_d4Z%{`!^TiL6W{NO#51$oNnC7$I?<F)TVdT0I|jU3O+k
zba6C~`Qt0v!?xSgx!e7;+g*fL*Kuw@oGR}Ze-*cfFMF`Pla#5a!~Dizk9B7IE{YsQ
zsWgvoa35YOvuUT8pyN{bMm+d00>Zo~`E+%-5U1PlDa2U!%a<=_ng4n{?Kek&)P#hf
zT=B13gPlxv(MM(lAJ|TWz0P?Cd^<R4YbDGsK6>5;eGEG-2(=~YJ(rBwbj^Z!=^*Bg
za5H~mV%W8J7UM*SQ|#_d%r~XLg=hLXcOkE`k^M+?X+>UTp>4(79nag;+3e_i%du^Z
z-q!QIQgZYX;8Klj^q8C$5XP2wCX+InSK#vlM^raQYI{J%+{~6eIuyN!d}(QEZ?2N0
z)|N=VSTW^uX(>~!^gmQn9`>e3pJU8k9KM4BJ2L!wYxC=)I#G%t?k%2!0w~!5-j}G2
zQX_V*6s?sW<5ZYlK!C{a{^}PI=bJ^e^q`<1UzNZ4XwU%oQ2ZYNv7K&KZ{OzIe9!IJ
zDwYBw`~ype|IdaMQ$ZO%k09dJ)v=)$<X_*(g^a#UFG7t^<qX9bk(I9^%;4u*lf=*W
z&j9OkR0fVPyey%a6~!+19rZ$JuqaES&NcP?RuOMS#9&T3MJMMqNZ<D=%d{hzcIu8D
zK%5w2w%{p;LQKeM;S1|WjhvTcGk=NZ8v7b*^Lr4UhXJYtqhk)e{%lV{*KsZhH|>M#
zB+^0|ZXpmnO}wq#IB=R(s3+m1SYibLtVf6cD|-S1qy5E;=L?9Ov^FAF6f+%JE=7VI
zdrmK+f$GAYBn#Xxg0SO^<~DTy0kD((l4}MzR45XUDet-%?pAJp@nn5^!arJMd2`xe
zTk3m5I@tT2^?DSN?#I~?W3l-mWpEs`Q86ORpCZ@}p2Gqs#uQItpy>2w|Ii?W&lRCO
z?GPN**OPgGw5?$f?TAV;UDVUFxkP*tv$Vr%#C{br%UL35h{<KEr<sX9btmG+yw_Ic
zsQqVXG$=E+cp_Ors6#w4;i^+YUtfpGu#1L>TezK|aW_XAZ!U*p-GkAdOV@-kZaJB<
zRESYZT9Y?cHS1Hg4P`=>^l{3<{glY8e2e6t*5Sx`REb3H_i7G$6gaihu;?Fm;6lF<
zbu?Z6W|rJ5$snlB3XBObkP>M*$}m)7U(6P%;|*G2@_5+On|kIeq{&iyR;%ahO@<f<
zo$_bT%SOW0jbsFq7ijbH6-iGM7RNMGcVJjqUVo~MLZf}duO{&@+o`iEa0Pw#$mDY)
zT^ZJ+WYU54CG(RiI&A_*{$ug4DrJ$m{P?=$Zm}Cf)Sf|xq#_kg6X_<2xxC>6%)+xK
zP9_U}xS!f4R4HEiT<e{G0W~DhnLAhvyd}hv)N=sFExwGzGGNl@v`}tJMAUz@TWR8I
zQqkdz2~9A3GHJ1;)QRO_(nRVW)_ot3CU2u^cJ7ZPH*+`qTSKVDgS<vEN{&^9>1O(A
zTB7JqNfN&f8Bo>q0^fvs>C@EA_15tRT)hsDi1t`icGH#3#ZO`CS#6jtAbyAosnSV_
zpypT2NWx|Rg2eRtyG7osXRG&(!5{;so~+dRckk822)Mc4OAec3B!EXH!Fo7i>nOb|
zf~fV{s*DD+9$Xbk%VXfr?(pouDwE7X=}S0aX-P(LA&YNjD&_7MUnf*SpRk-R2l58v
zSAtCH9qc4+{XSO2wPeVFG;bH<K+3F@A<IM1!iLD$Q=v9n9P3)|NcEQEYk>T*E3~@?
z!dG|LhG|h|7foP4m~s`e+y^bSA7GBui{`V>OC6m4qD)1gm$m=Lmf_T5Xrx}G2+Dgp
zU{F207$6LUG+~#De&p%=BPKQnQK(9~_!jtDSaYS^_*9Plk@9r|19&muRgor3p9Rl#
zE_+ZML{U-Z`u7iEg!|uL|Fp3~{{~|qBNKu_fZNu?w77uRuyk$i+k_&e4W~mq`R}5U
zXa|c?iRDRZ1+d{sQ&3VLea~+W#<;8)AI4#jgmOz6(l5K1*9Qd75J}>f^}}reW|%3Y
zaXf_z=Cdc8z-kH9(%)a`Vn(bZ{MpUDPU*zfcyN;fx}rQ8^_pTX0@bsZ>W~W+V!MYD
zEI$j|km`)*#I#3o(xi`Ymq)cUc3Wqb=GVk(&?{K%L8m6~+_~6S&uKqJ_wL7>PqnI<
zUi^_nZcH<k1y&Qt9@-i6V;&R^Oo|ldOPFAG9d|@X9W=QjGNsi5lz@?Mz63B&JauAO
zD#Z1d;nVZD%<3uUHj{c2L$afJ=&Hu+{pSgzO9W%dBoGVbKbU_PW&=&~#5A@J#=bmX
z`!iUFU&!tCTM)Qxosd2y{G0?xmEIzLe}+NuHMTpE=mU@Y19EhceJrpzEQG{9UP?1X
z5!80SeN$0939JlHnB^2`j!bX;DP))Jnjn3aYG)Hkx;<!iw@NfgCQg=#scZ2Bc2~~2
z71iM~MvU3)<+fc!wv)U;ZpC>FD&L;vvD>4;%4;L8jY*1E^=so_2Oi}V#=c>yN|2w~
zr+r!X#U0(1QKiW8^};}z2C!NXb+9&lbIQCTB(`TLfj^)RSf*wiCwgsSzCQ^Ox&~zv
z^l2xuNQ(ParArW5+8WRQ)}R+SIsDTK*@Co`MXyIiOi~B}`F5*AQ@^0d<B)&qksY*L
zF}IXMR?h-s#c*cBv|~<zN`pQi`w#5Kc_dUXVRs|WV@BTi5+KH5<xge49nJLijyw*B
zCA8yg#0tbJuvOzP(96QZTs0VuW6)i}DB6xyq{tzB^w>3gBS{@k5B{-$m_UUbnjvC#
zSc{o2;f;07NBLZzRBtv;BqRz2cLoM7aPe5)*p6kiV!bb%<@vays646OTXefp=debx
zTx$;Gwcz!j_KL(bY>{?70%B3}1IcDSc26=VAx9zi4O4$mi0)m(%mu~IntV6fqmabl
zh;eS%R=bR&>>?zoG2A?uR{=_f*GPW}SHPkUfi!w-49}s?b}qG*=Y(2`Fe+D2{Fdko
zh9q%&FWSQUuNcht9oTbiC}_fvr+y#2j6M)V!6aty>8n2gN`x*8`vN?2Jf!&v#7o`8
zeq5vS&+*&dAD#1}yx-Q@=#hOzVIoHDs(VP6X~hfSw2ih}5IUO5h5&X(&@1NV4AaG(
zF(^qyJbL%|_>3r(=2s)KI0*Q<kNW(h$#_v*Z8&=Scr44YW%pbKFbBW;(0uA+iv>+S
z&C8Cx(JFLTFz-tr))TTpY8p@*$Y*;15FaxKjXo~u@xP9$$(nMDp8Z@Si2Y&T;G~&W
zpAd8;Nu=Dl_RS|^XFRLWx83EY-5Q%z0GV(WL^fL+Cm-WaOIDyWp1CU4*<gy;QXP<+
zhx~*iNhI$c^j)<%uI#i{BPFC6ZtGTDh2FvgZG~v>r%&UQfCL4BuUgCaUZ2TO&Th)0
zSax^Q0;O}p%|jH-PQxQ;B)udPFLZ|(PS0jLgISVVdj-^^gKw~mOd1JAIfZH1GDP$x
z5}X>)q~d*;qp1$J_s3WC@`cIZ3`w9P8Ug9E8tCYjdX(E|g<chQw#Db{eo0X!WH-d|
zoem$Lfn;N;X8p6kJ$vvHn!X$71EufA5yeYtOoa~56S4&yhrz{8`ugoEj%nL(tBal#
zdE%HW-xulVQ(|)((M#e;Bhd{o>ulF##&W*lMeT3}-%UQHH*HC5?Jd3?{#6MAq^b_m
z^3h;@-H97Kv(y>Nw{J+Or^uwf`;E_!G9D6ZjKlk*ireo3`KW6%#!e@^kAs7sk`sjr
z?P5eKFo&Ars9@v6?`V>1cc;fm6Wa^wSnLSp1UY-f#^-YYv2{sQxgWpt3=KkilPVeH
zjj9uKi*i<&c$#0l;#Qj<in|2U*g!$M8@n|}cW`?YkNuGuR(3tA!)(TcQ$s%%Af?*I
zC_&ZTDxz;=gP((ar6%eIETW@rbF!iU6n2s@NiU{N8pj-l{ZcvS_U|PCaqpkS^yl|$
zo!;yF6!F}iNA^a(%>+uAqfcZ9Akjb4$lWH1dEJ};Slmn(aus!0<quEM2U$Sccsn{y
zSIYL=9>jtPdN*2^)v0+gan~4WvkufStd8TQe0EuFpS&?TL0r<cc~VODybgP%T3P!Y
z1paEZ1$lQafNe1=pKy!8>|tO*JIXHC9!yV?P@_|m5V_B6C0l>dr3aG*1ZgnDEgzQ_
zZtF5<Ag=X^<zA*DcfNxkS%Q>dYZO1iXhUYXT?Y`yG`Q^r{TP`nXQZ|I)X6RFvg_>n
zxNU7GdVRm(?2hR{Z(aTSL-UdHg|D%E_iiE%4lD*1H5LQdf)5yi8ZHMuy(6eU_$=PK
z4w)59%PQq|n`Z407*}9TVvn<;$a;mZbWKK=dI0^1(Ptg=4n!=GjW!^RY<Uk7h|Xxk
z+5Jx14Q3+Drvhc|%ukXDQ)EWrY)!mz)%zAB%YLj@5J}1yV;K6CD=9(o@avCGXabqi
z>6tyJCV0eRb??U8dgI|NEWP=s1gs1j=T(iF(X*GQePSG8BB|iCwfoMC0kt15w3KMz
zMzar0aRY4`hEDs@w9%#tw9$RcqkPzdX%n*Rogv)8onIHP7f{3V9UTQ8oR=vRVoB?K
zcF>u6!Rc#!gWnp}>OSt%U62Z5r&0AeH`qEK;0>tiA&Ao_3IS@6b)}w%1TS(rs8t1}
zhR)M~ugrO<x+WNV3Ll;Fx9!a$Oy}gcyHn!TK+)BIT%OSxuc?EF4Z1AWE?%Y!*wgNe
zXU9$Xp_rXA8ixu6k`obtj=J#S*{V`u7(`~~@7c3xM+lgcS8)kX614blqmL|x?vUT*
zvS#!rWocmTKm23{vmumI4{=5(!-g$DB(l>?VBR+n_T1=D3+OJBv9u97^ij&dypK?Y
zmHrE`Ktd+FK+y^v8Yt8*1iOW3;^|=JQ-j%~;|m~W$Rx6p3ec@L=<Emxc>P2Xl9Kfp
z4?-9gWg+o+&}h6@ZhsbWGBYz*B|ZFxZ%7;!ivBPkoEVz?h|1@~p@)ieQ#;Jvf92K~
z>CPEvtFs#9+sj^y)Q|cebhpP09_u;uBQNW1Ci33tf#Qs9iJa`DwH7Sw#W;P&`RL%u
z10YTdQev~QoXh_Rwk(i6OG;z!|7y9y^WnFCXk7v?*Q=@piVy*XweAHDD(C#!b{yOu
zYj^Ai4|QsYwmhx5=)|%!Al0fGDdv>Vd5}Me7;)N7<TI&q#~B_qV`2>6$gj#GK<aO`
zoMqtyJ(a`+C0L(>%9v_=VyO5)TW90x2q)${)sl2EYebyYvu%(ted0kZq3ie5FcB|{
ztW>hpKYloBgF<qsKWX{c0X~dseOt%h@s$R*Yaxr|%EyvOamtAhy(JNlIW7L8usx$k
z?nl`~wHJcQ6fr+qhXwaUSU-D2+6FZ23(4JUqGsKhvRuul=L^3?{qxebRlz!3Zo9i_
z|Hi%)VG9i9EuRQ{b<J%tMAyNu^b5qo$Ba!PI2JUptN_(Y;m%Yo8RwZA&p$@iL+w2(
zmx!%0jHT@@-7bHN;1c4p`ECd4QB<woy$1`6j2|eAqCDt+46b?l{3?$7J<vURy_kkC
zd4gpaV%-Mh`dHK5_nK)#DbJbFd`6(j={pVOzO-f$GEy!sS3%wY#$MLcElvAqQHvEa
zargHzYLsht=Zn^U;AAP6Hx5PQG08W{)Vd8ZvAf4t>;~t+{HAYPpy-&;ckJzvdWl`^
zbXuyc!zARSmhSTUdKOpR!$QwOa96W`Ls^V6tCrX~-ez{394mR*IZERk(^i8AKy$H-
zJgII!sqU_g53s~fkXt#(<9qfVn7%{XA8}Cn9k$uNeR}x26{?X?=gCT~1nYPBrhGLN
z5s^=Q;n+Fg0LYW>O@%FHUX2T2PKY>oI&b37E9XIjkWlm27hijxu!bdZmwqVadB26x
z!84}Nz%-0G3~8_tncy;pW?(wfhc0h`0fPSBfW3^Lnm%RN+7lOjCU>eglqJ@n*T3CV
z%Qzw@^qsu6QFAJn7eyQy<zwbx{Mah&dgliIq6LIg6x0q1t3Jy}4r;lUFdB~Rjw9rc
zN&LtwQTPvMMDo~q(Uxf;`@m6<T?Zp22|fPD6|;^gcw1({{PkocCq{Hk?~0gHg0zj(
zN@dmQ0$cKg0V+LlFTkH;sGTH*<Bw49=P*xux!tIi9%R0hWzu&UVP=)SzjgZK;QIMG
zN0G&@SsY4Up#Hnzz@itLiReMFq1zYebEQ@!DpVnA70I{SWuW#7D?;2z?Wv;Eq-vUG
z<Rag|&`)_kVZ&A@kQClLj1(c+l+Z2O1lCL;|7pU$)WCGyc;!<9V}2GaiF(Z)%X|Ps
zB|rlaMoS03h1(xM6iO^RgbFUXLFdf$M9I@*Ij>hI>MIARBR*(I(Y@h^>!|yfPyBF`
zczEX8-%r^kvptJHl;P%N%IA%8xkYVt<)+hTiOgF7;=5ci>9|0krA_=rQFpZE>kLfU
z1NC2tH+8!O59?yx+5!T~^O+GZU5U*Z(fgtKNK-a_WO`mv@g%>a=6d<-wmawv0atDd
zbjmAkc}aB?f_DUXp@mAjGM3rIJ7Xq+FO?R|=CVoCC3dlbA&ln*iOwH)6{AVT5gK>d
zyC0TZxy_ICu#UuEC|z~RBeD_X#h@CJSWK$BS26TNeZG20CN@BEIR$+6j(F$0ap1co
zejcA&^tOAF<P(oRy(3dWe65zl;2*K+kYkn8lkS?=T0GXPZexWlW7!4hm#0yuQe2-5
zC*;p$lrQT&4?LA;vqNrOcg!0GkjD&t2!fu<J-yA42BNbA^_%j}ZN~fML_9*guLnEE
z<M8_B$B&e`gG9C!azh`{(PsvupDcMk_GpgfKC<mholeo5{_vZ}fPnapNSkawkXL1h
zAQVFMcE$_>m$XXEV6z;aA5x?f!S`=%B3ZTvw&O&DT+pLnCMqiID<$xBtOwKefzMB_
z`SzJ~X?5D!#(b28x<AsC^suft(gOubkJ}RJ_@6;W_kO~&1FAh$`j|Y9aKXA({Y|T%
z9-ku$KjYYj{I8vf?2zGY8}r_IzjOgBR?fu021D#6KBF47-<Dr8QTR(I`aAT`^UDQ^
zwTP)B3SAMd#WHKJWNl+}p`wm6Yf9;ZA&q-Hce;BSzi398P)c<<yMY4Bj>}K0q~|<u
z9|)`H@co_bBzJ1tFai#&8h2~cu^5&`EN{nNx1F)#zmte;YcdxWq<AGuK|o7|?gQC%
zo$WYBD-gjLjUURDJfENH4?cabPW~!nxgL*?Q5hBrug4rx1|v1QD;LrQ6|qTj8Ad>3
z1Mt}SO3Pb~K{)XgaLbJnYl`AW5Ek0M**(US-YTocX?{d424?5<a;7&wjZFacH}Yhz
zd=x}fSfH~Hn9F?BlXwe=9HtPV!sJ%?Ajqh!7kW(YVKJM2+jdTuL2j;iLD+i)BUPp-
zjAcpM)mjn;N*Yj}r<#U*755pys{87JVClorO}>o_u=ce>9Z)qw(!zXSm?G&ho`LQj
zv!DKYB~#p9f-yELoboHR+2LwNdc9HBZbqGx-AsD)G1DrZ`R@=8zEZR3JGbR0nXyc<
z90|$Z$;vnsob2nu?NRu`6j8sOD*OBc72T)Vk<wdv6;lC#E7<VX=aQ^x(Y;6*x3Po^
zmiUsKC$i+)6k`iCb~?`yeJnu`XIe@-AGy4t_hJT<gvY<nRykdW+_i+Go3Qyby>SP}
zC}RxHrsQETn#-c#%2=~Lg5iOPSRjMoP?o<^`E<Zvari%%Kqhll&fJp=oX`l}7rc!P
zzt%hRxSrh6@2BewPe5XcgAT(4TK7eE$zdbh^?<4M_ElSo@xrd9bE}a{DB3TP^u1rj
zL-JJ^W$cw&ax;Hgi<{uRy~!g-ibeVq-}1imvHNQ0l{z9eFQ}6W(X_^LFF?}5J0cD-
zyKcKi{>FqNoy!7_j(1rxqgODJ!4W<pmhEqOJq#*rit~*WKGP#L$W=oel<$KRG9a;|
z8>s%brZ_ue#?V#4MVCbKt5@Vxis+*XLd}Eg!o&y@&eTp8lVW!Pp{6)8?JM}Do1Gef
zj}Nb#`~?ZVr~?FEYvNqJx@>f@ea0*k_quq-5+pm9;6Xhm7`JSt9NDS21pk5z5ia2`
zK}p$?CK4^{`pEg?(2Y3r!LS}=&Mf33KY2Nw@RIYg8nO3U6ZdbM{FZe%MN{R7=f-2Q
zHH`P0VqFB~7<KIYsVcKlv{c7>=JUNZk%}9lp=Vygc2rrZqi@KL)!<>q=S$!>iIS9Y
zfkugC;)~vk$QP7hgtc<nkA8fr3D5>PYIYvfq#os~YX!tB1fAFzJ7<XCC)%K*FmdVu
z`7z$TXCoObE(7_xx1`!?yu*}fkMSVpm;+V%TTLrDt3pFk{y2u=c!urIuCS|^l+BWN
z)QD&mN(qz+@aN<$nemlp<*<ajT70lFcx8-}#F@%XAA?S<)VVp3=m5ssmOsvKu(M*%
zF>7UTIVXw~{yDm}B<4kjlln8nK7yfVV<!QbVcOe{iasN?QKJ?a&_cLXI0nUH5=m1=
zgdFI}%X!?J@eb>-CcR~)R+x#rcm^3vFzjr|@0A%V4vSd4Gr?GyP>2+^`n7nKVcXC5
zuE@g)UC34>a{Oa_huTOF)cU;Kh?g=;ZrOo9OAW>VZ>8V}H<bmT063&!$$!P&%IJU9
zr~h0Y(WASbpD4%x+&@dYKI}3ab;;<kyB8P*n_KQ-k<%|+>#=$6VttsQk&B3WOK+u!
zsKd+(xI)i1O9^xmzWAu<L@cKK!|ZgPC>2Gq?p=5;o6%7s-k&_g!Bz>htCZ4a-RR_U
z@FEj4a+Of<Ti;~3IWf$Q==Eo;wTlak<e!!5>9)gRmEiP1B3a%@NSQmZBd1~idGo|$
zf=QTGdc#32xtHEFubbXDkA|eC0B?;zKHifk{3Q2Z-VDD^IM?xAs^Gs&$A8UCbO2*F
z61q-)D?RH50jC7GNun~8CxaEMcm+QyR1U7$w@^>5hHb#}-u`=ITOOPYx#x?wg@+0w
z|24WP{&ise>k{q_^a=D)BT?e3O;77zt4;ZA@Y|AiyLk0$_tV(9J$w0Jo+4N#@sa}q
z^l6Fu(J;hj<Qs46#|9W^Nm8}nO5uD1XF5{3=OxgmgC$lIZ`8m*pJ$-YI>}f2gyJ?X
zoxbF-sBiaC%R>$s+Kgc_Ft1@p2s;K5JTdaSBK%Ih#NCJ$JfdV}7##UcZ>t{*;UDka
zO|G+T5vR*k=vWjT-qJtA7E}rDA6!qVvqcq=JTkUW?l@YyA1<@!kJJ64{ny8EbO=wx
ze)@0Mv&H9#(6{}MUe31#bvDs5zI84eKs(V7xUVf@(<0{0rgCkJEMntK5yxM+B!alb
z8t{`!DP?I?Nb)T5<|CE*b7IJyPZB9L2~u(y*f0{S9Hn8?1!b-u>_1(yz1oa%$7z5J
zcor)WC1%!|!WQ`qye1{uUe3&m%MtqMe1f|>Y4yFh%n^=+3qjc?;<#OT4Zm_x@3#Ou
zqq+E>25zx^oR9VSHO04`9JWo20suWf)`r;3u-XHiNeN;&xNVe8FODRUdn00g0_CHr
z%7gZ!;(B1LX+G$@@C;JzBBhi>IOJRFL+tR>NjU1UPd|;ciWvt_zJP=Cv77K3O#&z9
zT87<6Q0aBIL|*9BsS{V=RqC8Nc`K3N{OtU7p@o}W&bgE2v5~TYJBf7cMFxvpAG{^P
z6pu6U=3Hz{dYKn8XHyKGu^~K$=7s3QE&V*g!&WiY-yvjb3indWobkm|;D<uvrAT{t
z=?X1qS%)ID`$qm6^!mX-C08yMu!6q_ii!;#8&7u2W*q1MH$@pXz27Pd+>}NDD>3%u
zzw<}1WR8UQl6V7a(9bEyD^4IBeu>rO$KxKp71DwC`%h$9Jk8Iy#WI;nhyK_A`G#b|
ztw?T3wIZejIiCH3hUqF~LXd*Awgq|=y)gRg<UCB6uTeZ9x$5J5+%Kh(<#@8N4p1U<
zA_w{$$1t?S{{!-?aW3=C*+Hk*>8+U4TaY%}$5pVSoTo62L~`i1BRHKur$sh6X^_nn
zBl#bnrNj<gVWPK%IjZ!P+vz}>^R>8=RFCfO@7*Tz6y`M%)uIzU{c6euvhIMTe4e%r
z$5)(PIE7KVij-q`V&Y!Fs9mnUj&?SuvrKfEU`#MZMyTII!_KM@k8(|3A2o?`yxduz
ziQu>#`|8w7n~zn4NBW~qcQq^~6iboq=ilkToaXxVFHZ!#BmBtcEq+(s>NQ=_tO3J<
zB(8_h)nLc6S=`<mX3?56umR)mcs-H&2puu&=6}w9rHk6&w@~|FkhEge7_UksS`o3D
z+kM@HQx``sVt?=tZ1?)qZ!FkPHjc{`sJ(Fby%ZDHxMRL_NAGznh+GabVAnF&@no-g
z=tL!PSc3gL^{Xo2{qXFGOr3{#Q1xYlyE$MjxVi13o6;Gi$osDFDs;Eo<etHU-85L=
zRmbd4LYmX{(AI=yQ8kC4N=_iHY=mXvyr$6{&Q41TRU&poX<YrzLUB6Z2Zq?(nUFLa
ziD`Y!PZpqPhJEl=Y<Cz(meXb~(pt7;On)PZS?_#So$H94h_P&TV3?+Gp4FbINZc<>
zVzaA<@ixzKGFk+SimYY4Z0L$8?)K_y%T?hfa#v#e-cAnDy7NiC#e;P7>k$UMwx4(x
z<6HY}{o7MPNP66^JT26oFR8DMRDVy0oS*(4d1)tM1x=Sq6bDo%ONo5+-Vv(v$F?5V
zgEo^-^mH>LKyo7|zqt^N+Hm!)wpTjsWs@T25Wvq8)I!cPNkyuHWT^mV`EF6v?8PrH
z8%t;I4ku)EB{9$us{8@CrBW2D4Vb01dYk)^mg%BN6TkkDn8Bkg4@VPSK=;Jmm&FJk
z9Hz4F?A-?(y5`o2!E$L*cA1@oy6J(=5K+Bps3(PS2i8}vTN-gG<Q%Ptdb2r>o5b0=
zs!w@}=|uiHyp+04No`g@bfZL^3ML@8NE=aRBTn~HB&Cnw7D0>xYMkZig%`XL4=U%n
zn=B9=kDN!T4!1Yb{@&>+Q<&3n5gNvZyM32%zWC)BMY);M$@WrlETfSiE;k~HyLhvI
zYDSOW9%0_W3(Y5ry|3{)ynR>d{)F~O)INmyBcn*DA?FblxyA0*uXJHQ{P{<J@)G%S
z&<h?<?+Xy|n8ly06{+1HI8TE0Z5_XHjk+k6&zOFJ*kgZkPEHc+w*DEgtG?Ciyg;Lp
zEQn3uBezeY`<X+2Rl6L__UhQl^`2@hrv>j&@JHa%3Ra@%vQ1(Qu+&Izb#_4heJ^`8
z!(zuJRh7!j=SCk)MztT9hE(WZ8=YCKYkc}3dfAP@Tt^CLmt(=PEWtPl`Yh*PpV$zO
zAbVw$`CoMO8sAepm^Kf*{$g!oJLSA|g(iry4{~ZiraUShHxZc-YOxl#p0@cj1R+>m
zuP10M$qQyn;uc3`*P@P*<V5LAt7ArG@xA=!?C^*)mL-B4rAyIU=tGOvm_(Nd_pa5|
z!Z%(vD(LI@5+RG<T))&S>|Q?@!40tsOb7GwDHw0nD`w;LoMcEW%As<sSxGD`j~w_>
zw5ed4gdNxObtNFB4Z7$&$N><U{`rm}!?QsP`>j$l3`sW;m&NZDr9RYJCCg%)@2)$t
zyvhhhGqO34-zd_j%|yUmL0(|HYRVfszaOSmD~3=Z+k&0ghsfw<C*ESe%%nO=c-G$#
z{MPkX-<I$Dk2oC9G!{pX<^Tv4h%Ql<m94l1T8{HhV%%o5nAAz)8=7QlWhC~i>~i*F
ztv1q<)(XgA34g_GRX=5|!5r(98%q;e1B(ACdt;gmyopW=ZWEV<1Nn#xBLNo+gq*;<
zUI;VM_khrvA%T0CAv%Tavt^Rn@f$Enl30aOVip|%8>4@dQReH*dXJ=|Y1|hr<G<sq
zDepFOjqxaJwQr1!!!myb^c5tPG+fm+v^Uu^>?ckNw%flQ{fVQW-}coPG?K;{^=Bki
zdM<U_jIvLJRa-EpCFf`CF@fRMeV#%ui%85B4@R6|jBMDM09=0=cu>Hr9S3?9`9wX~
ztdXs-qI}l(6ec@a<^IY@pp+WoOmT!WF2x`ceh}qIleWx|k5dO?%gt1s9zxe6tX6Z^
zKvhhnOXCEHphq%fF%`#FG3((rl0QQ$a&+l~Vw;mw==T$Og^S$#XEl;bG>uu$`a{(c
zA%lUbO1xlp2;laY62d=W11ji+hsgQzT=l-2bnMw(Kt9F_%gH+DbiR)~JL3kSIj9$S
zy>exX2}Q7BrDUl;i;NFnwuJ!@v@?QYZiy~T*MP1#WPoH>+CrVvK0=%3F8;nInBe@>
z?wR)@&j%QE@zrE?H1izZG1k?Na)3(+@z4LF>n(%YYQt}D+%>qnyE_yoxJz+@7I$}d
z*Wy;76oONnpvAqowzw59)|2Od&dht}%)B2mlga*&Wai%czOU<A>$j*`1agL_X0gTW
zGzKa~h;U>sxZ;#6)fZTuL|oCIIZL@<PCEm|tk&XCSH0(PN$$27)TRgW{XLsr%E?|_
z6wC}!d}i{azuBqb;uc2BWfa;I37r>95vX8)j_8w0W69+*L#+t5xk44|@?cd^e}*@s
zXQ+2pU~0FT$jEf_QBx2HYDR>@d1*M0DSeZ;zRskT;spc>EOWc;@%SOkiQXCS{dr=4
z_92PJOFg00sCtMUvD&dxV;6J4e14bd$)w0hB8|Lg4P_^goGc{1vWUz+VBCE?SlJvm
zE3e}8e$5%2OMXUyI_U=qRa$Kiewk{>{XL?VWJZ5yJT&BqugZT^APjyafGTUGfJ+14
zbdW92Av)LeJQhZHnWiR9wx_yIVppT6zPo3!c_Nk~l)cFxS~Uc%f){sd-cWR6XNTW9
zfaA$Z1M~TKJhn3-erZWz>ka*`hylrFVMj6XcU2?npJJmU11uj_j^e5=l#f^YL^^Q~
zYzrf#COL^SV!wpe4-IGgeoqHu0F+wzUdkkc1f~iZOdf{MOPyBx{UYT-$d+r8bo2|7
zV5fN8_CavK@3=RWFQ922Hu^>HywltWPqr^0$UgdY*^Wg{FHbW4$;~>VS5Z;e7p5X}
zMIrWLVZx7-jYE^48)WO)hCd(|1T*cu4sml<R1EH65=(fqIo0S)FYjezZ3t0z_IgW%
zn7$B~(Q5#2=6P}yBn^*5_`f(u#8<^ldgTFwpq)P^fFJ?W)f3IQAg-kTpX-*C*pV&d
zJOML2F^%qUo5a>`A4<G0PW0hP@|`Mz5DFa&>D$p7uAxL<5hY)gfz#U4xx!Gycdysm
z6Fxh452k0#l8D5|A>h(U;P5<^qXPEu6NAC-k$MSchTSb+Y;6h!xZ}&&ARU>(&zZ3Z
zXVFb1!-Oxy>!J1Xq0>^kaxcZwKi$i9NT;qg$Flk=!1pzDxo}dM*L-)8e^l6<NTlFH
z3;%o|r?`>>bOwITu~=%AvH(esMXYG}sEqY~`^w`pA!ztf1-IHY{4eMkG&5>|;#1|R
z?(M(Xmr@3@+aJx;6*c$o><wUHRFi-uT0vUxF#L>=*XuD<#PON?(>U`~UK8;x@c8IQ
zzQ&IKfg;9O&rS*5W*ZEb&lMyi8yiQdBwttb=#Sw1s+1#~ZDVKzwVmh=mv@<<AHKfJ
zPepDuySc0G-y<!=Yre3p-h4{!Bhd6OivL_`-)f^~q{Lh$SIY%p@mgmfrg{*2(NP}c
z)Q<NQ7WA0`87UHJ`mS(BcfU>$pMvTdwiq66`2{`H!EZwY6<hY?f|05;yXIvO4l@mT
zzSG_Wx6NO4Ycnqfqr&k5eVS$5f|^K4m+DiLvqR;oZfrE$mEl#lJ>YA<(}R}EzTa)Y
zWTcyy@`Uhz`dO2(B5Qjv&@*52Oo7+M`_yM;qq^>aNF<naSSf#2C-QB~jIanP*DiLx
z;x|{#^8xl#**^ADt-21o)EmIa-^m|AJ^7Q$neJ%y#@+7-FY$kE*anJ^;hEfE-@v8%
zCkizK=|&?loD9_>G%a4$nFi?>B&mvhY^hR@sw*JE*YcwEPn`-2*xWz#>n0_<{+8j_
zwNb_zdGgOyOM7Rrn4(DuT*Rs%QM&cC!Aj+Dsodu%{Jml;KLZC}yLU#m>rL#AjSjh=
zG-164zopAd-Jli=g1P6u?DV5#eB)Q*lXY_)b82<c#3NwSmx-QOp07Ki7jL_Pn(CB!
z^GKeszB1k^ycOtO4`F8?cfKd7<K+(W#D!3!^QK+i69?C2L9j7%sfDwv($r-OrV({3
z-(199$aq^oZgwB3vRL%c4-_yJ7g@74gLmN&5JW+H1M5qdq@5OcNnv9fTD{_8l2zBH
zf6?sMy||y--bt!hy&yVv&ws|NQ)FDkF|h1CYzT{k)XH<Peu|xG=Fe;_9dO}1e-iqX
z%@SR_h(*hiEoyIMCM@1c^25j>ix&9RuolpP{kuPtsu3-F&iTT>bK5-ehTe@rAzA*>
zRzR~!*;Sm6A5zeiT)T<A+NdaH0bsP`(~552sy*^cB3YsE4y_4;;`gOvo6s!|RHOpp
zR}2lmk}JP0kv$jJXX2)A!cf#Kvqfv`we4QmL;){O7e%Tazn}Zo+{xOR1UjRC2{fMn
zY80&dO%oQH!=%t_+YA0z$9cb@w7Wo?Zs8Aq@X}g+cCV=0Fg2rNv*bLFoojCFPUjO5
z#q&O^0O760n_U=+93J|8sg(rfmo(iK4VtOGY9&1Oqj?XvL`F0PZ}XoA<0uuSjpgwK
zOH7HQbrQ)bek8Rx!N<g)5+e$HC>i<NlIrF&rhP}zTPw%qIFp<_vPZ%Pgi0xalWX1W
z9vM|jz|CZl+ZpP-cym>x?ZQp;`!YK2+n?WrLw=!Mn)F9k(T&O6+f4r_jmS(<>>QM+
z(a4K9=-{w)-N#UoWrC0hj$XQz%^1>N7z62(dh7iUi#rNiZJuH+#)1Ssy-2JQYZbW`
zSx6i9c}5pCNkJmz#!<1yX5w|4{?s65)S8}?2wdeF@OT}g5sTQ;eLkH=1rEnAFY;uI
z_MX3rY>UTjXSNT_s|^3Z3mntePa@`e<Q)5@M}(`qIIpmt$K%XnwsGjma^>7eIaE1+
z>vopUSASP%(V%ktePDf#BE=_O$+Cl&cTF46sKGFW{h7&e|5t?tr>VG#N(rv~##S#z
zW=@f;VJXV&L&M-P>PA_`8HOi?Vjk}{IQTIv){~J}7An$z#;9K}n?=>P?TlM7PXQ)s
zKypQA*fB#2Gtu=^G>32jSPy`sJ2##r^|$bNP{&~Ug!O+yH>XNgjvAO^r1s8MPoir3
zB$@tj*-}Y=h6X9O@cAvp)n-2$1q|{y8d<39YGTMx$dz@4vZFk>BBeQ-#P)G<c!UXe
za~#lpk=C2GX8uBm^p$Ij>{i@b_&aD`SItTCYJ@}O#_r6>>Jmn+Fc=4ds@ZHVS!iCc
zKb1m}$8AN7gh3wvL&w(YJPp^d=bZs!U-SqV9iCV~^HiJ~QM)kY)O!v5yPwVN_$unp
z`%uUmvxaU*Ea5xcZKv+_zK<hY6#M|#r=P_z`N#)fK}b2Wain`l!ghc{=M1H>AQ!ib
zD7D@W)sbXgZ)n*yU;_KJi7B>H+!s3r3#^&qPZPY+MhTPMSG|@9o9fL(58HooT5Jyd
z<_0r=s7r`yf(}1_k_(ITL3dtbZigjJ403*ayf(qTcX**5(Ln68L)Ed}aCmO(C}@LN
zIO+E(ANU_Tkl2}PbRBatRvpsUQe2qj-odosY8N--n50*dNH)88eCrS&{ppi%2$S*y
zI|=U7tB69~>|om%s!71J@E3B!O`d`I<ue|iC(S!5ez=df9abCVBYA=c+?yuH&*g8H
z4!0!vt>&ri4Fgl&^y95+lPU(>-b*M+MLlRQ?ZspH6{%p*p>WdsJ#EiL_#9CqP|j{2
zvSkRZ_A+tReJ_8QuNTH6j0vAt-1hzr<Dhjg!iVDAh@V5xM^%f{!NN?`khs39>g17n
zZ|v*KGQPVj5t)At@EDif15agCJ*u}j4s1%RKcSI;1gSERLxJbwvmiE|E>$D`3qj0h
zmpk|wIUsFy1*<fcxA+A{@xkk5bd7oXL^c&_#fKG3;8=1p$bM^L^);f8{(}{x6<l^$
zCc4<->x$p5lDC%P;RB(!3)!uU(V`cuss`7nFTaErl!fm=TCPeTurZ*df!%j*?mRNz
z$z3M)O^2xa_$9&l?A~?AzKh)UYPrk-*FfX0JJVjFe9mi?a`^ZBgF_#^1e&CNfS+54
zP=HW_!r5z-=^feRdhX!^%9~@h%)L*`Zh9UfFJ0xT2}Fawq>a((gR(T~wllf>+0wx1
z*`0Kz?GKk({4WDP_eD4<R+HR=Hx9nA5&)x=%M{KAJ3;DF_zQ-c#@unnuFHtQ!}3Vf
zjGH8})$IzkSEBpr5^vy`lQMGw(U5P|5Q&(E`B&XvV}Bv<)988mVzgXB@cG-bJUt;K
zOU~V-G#;ob9sLRG^o10y4{m@5zd@XJbpfYNXO(Uho95a~;;RS-x`NWB)MU58i1kPW
z!}9{Au_t79k-sS$spLPqk9FI`3zFC3@>;#D*UV(_0NE}rSTqcL6tw+E#F`awr}xGv
zWWGXj(ckx<U1c4NcR=qy4APqCJCxX<s6{;16$<!n&C_9Pq}`{aVtU^;cSv5}07LwB
zAed4reH_!=jZ(y@URLS%{uWrhg23RC`A35)#5V0Z8!~RrMI-ci!iI@<@dWF6K|sIi
zUOP&D4dk6zqFFbu*>jtrVpvL9-TF+KeKsBC8$|1|c?B{=6vf{9NnL#E*4-7+-GJ06
z7M(|pJ&Yi>_cs7Di%Snxg^SeVU%+4MZ=@3oZQGU3L{m@B=-WN>vO)ZTk7^hKB^m?7
z|4qE!9$gi!D@=Kc%fL+-ioC$#qae<tU@WU|_dK6PL2pQPds#lrzAqp%6Go^f6jk6G
z1=uY?F-ZeM_0lZr@Y?M7TOYy9Qa-0T#89G`t5Fs-Ze3V5qip|y)~RHBWV1=OROBB3
zqNJU%bq<yZMp!A~-p@f6>)LyLHlJ^Cl&Tl|H2y=~#RN`$svyFq8=8d|_d^}co81mH
z{*>)^vqClhjtUM9L0(j>v)qwzy)-qQfYZ;4nqK`jo2+Rw7Qg59kK7xw48ADDg%iia
zu|A7?LubllH<f2b{a_}yT9N_Q{aB2P6JC+XU&docrTWbZ_mVK)fXNqhhr(eJg8L)c
zPXWp=EU1ZA;gU(mp_S<}hw+&%glSt7`?JCfhg<B<-RT7Y#i|df^%7t9eq<m)-KZ8o
zkY%cez&lGtb&begZAvGRiIMr<Wk6YhBZhgFlEArhJp&66MJo50=H^BR<<OGB(752|
z8CP;9OSX=)U_n$BY{H?-ZRdKkU^v$udFo*Xl8_wr)o%i@kumCn;dn^bUX^D9EV#A?
zvsSM)G{--EaRiH-r2#;Lj~1|AsaFHnxGiqK`-tFb3ok0h^3;mnv%BwcfIB~GeH!GI
z44HH3hhG;M>Wu>_ueRlB=6FaXU7f*})ksKpRB`d>DUfXXFqJ83!03u^mp^Id(JL&n
z;xl_!CFG|d1y8hc-oDSUT;)QmRlbLh9HZX$Iu}pylN<Z`4a&nI>b1cANVGt|)l^my
zxD}UX+KkciYl`rHf9YmCb}--b$@xv5_-qU^%SuAos0#MWAVo?kh^0HK-*ZSu2|W|G
zrxHa;4u6~LfDU|%Z+{h|s?f*t^|}G*kToFbEf3f2s!?xrrtHNv>Obd$pZI7N1-N7&
z8EN~)kwnn;-9^j>_hMpXqdzZs35nIoYWnd`BNd~%6v7L{MbYFRMp=&5DvvLqnzI`g
zxkAp51YvJx#+i7#g>5OvEL@`rki!}H<F?IFld3YF?#ubEOGcb;?xhu>sVkmc;Xg0>
zsqlxPaMKMY?tnNX!7HKg7E8FowhOTHI=!ly2fUfSwp^_^88qnozeqfS*)clHep*#p
zDZc~@NV>-FH00Dk$4)HgMu)&%q7eld@unUlqbyb-xKZf|fIhn7_VYZC-PxgA2dL0+
zF8;8CMGkUf>E|S=ym)sU*+p;Zzxge>Jjqb5`DheS17b>Gm4mQaY==mEjEzz$NHtva
zv^Q?RFTh@prJg-Hev)O;J>|w~q<BmJT#~fm__8Rv41W1L2GIXH6y(QXz3^vTA!Awo
zRnGgB--RLr$dB<ewbJ{O#Ukc&gfwq4G$AA_V!dl)y!s8)@u7Kx0t7{>i2g9X{UMf~
zPZD_st;}`vNtgN@xq19B>9&si+|PJj%==(FO6`^4%t`~Z7oHl>QRT=@D@0f}IlO^1
zW_N*vQ4xh+)_xL0;D9QvuhReo`bC}@6~%;QqowCQ4B)C+e$+G*Dw`>~achyiNcUFy
z3}$Ln{zc&ca8)~l+X1#)jTdnnTc|?eL^-efh@0@PKDlnX8X}Oeo^c$tJXBEbwWeI7
z_eJn@xgl9pu2-~8vrR@M>u(dPI@toYMj?UiW1TucFo!<LJLuKjIv^Drz?cIxyobiJ
zg`99?aGzFIX~ou}pppsxBX3^qx3*)Vp1h!mS>UN#u@s@LxVSdv%K(=kf0!)_xvm|`
zJ^KeZAk7*{y|)46s9A~J1!jOL9f6RVP`?lwQ-dlVr$6d>r;^cold*omM{q8t;)ozT
zv0qhk8NNEP0s>(n8khU0=@*8A?Lu|hViWunsCXKpK1)r|IUO`IwvS)+hSnt5(t#p8
z%l_19($(F%BvWpOd9|-CGQW&1NPOWqkp@xyY7+-PFSY*IsgtaGXd|+Ze&0|65GC?5
z_=5+lwpEfTQPpq1ir!$Gd(k(h-yF+ZL3YoYB-~m*CSIiwCETaDb(2!C`aKSX?L*dA
zs`~n&G<^B{1v^m*cFdX4lufa|ecGzc8h?E+=)~8g^PZf1U--M#tdWiT8W984V6$*Y
z*lE&4WNI6-cU`8n)hNJiuCGNkwaljvJl7KWJzgsKugZ2mScHxixp<V)%~M&rE~v=w
zirH`hTTKq<2Ob+<F*X&O#_F0Da-jqsA&nT4LwK!Q$Pq%O(2Sd>>d}K(QI7i$5v4jS
z6IshT5Vm40KBqf!ASXKqb$p7%w~7M<1I2a5Zs!zhX1auRd^M<5$#1;+pg@%>YFcO1
z;>FunP7HbIS2kUt)1vikR<FjCw6|8Udjs^;3Bs=Ud3o*r<5xS4%4#~ghOCCLwxU>i
zwGOaUras8hnLI@}!%d&@hY&?d*MHtw`n|G?g+FL*=rP%5)a5m*pVEk>^}RUN%F}U_
ze#6r%RbMdvwI2BUjW5Y;bx5~_KAoN}_BmnCr;NMI|H@1lvQ3+Rnl-SIw{B4sAy=0w
zfj0^Wsr>tU{`+;*o@byTNfcd7uwwIXdUas&33$;nwnYs|XgcmzDSR5;*H6@XazgX3
zT&nfzap%BwK1I?F0!>7S3h!Hs+r=a1s?U1y239u#&-@HL+0k3dnCoKtDN}f3JT{cK
z34K<y>(VFLC?r9ZQ73)_8#JjZ1A|PKyvKf8Z-cfp-2PU`@XpwN>xUk+BhXRZRRO9P
zh0tn#6;1J$hvFGRKH`EmK<P&L%#+J(CZ?jDja*e{uz1btR)&Ml@_8v2K`+VA7gzkg
z*HRvWBMUcDyq3U}pHO}F<FuCUj%s~KPK>zhylVW;_~eljCMNa#&jT(+s7?mKBb=~9
zAY@JVL7XTzDRP3bD}L|K3ehw6@u~#&zRO>b72XAe7qxoerWW0V-J`ZgS1`45=D3zf
zoc&fQ&QL528ZntCRV}#L5&LJ7J1YGNi4<WVYk92rVjn?Op%w2UwgG!;dzd<+l6@w>
z0bL^Wc&n|deZg*l9$lJo&ks6y4^fS(-~V&jglwYb35^$(#>aIc#XJZ!qgVO6=~W3&
z!Bw|$(MGhr=^k~^&5qE6Sq35+b(Y%XCCEuFwA8pY+Q;JjixiKgg0}wvAq(hmE_)oO
zl02jZ@UJUou<JpE1dmV*-~Jvw`x+(RryS}0k5CAX@~!ZnXJIi~CEk4}*K)<=1ZIQp
zgk6tRVXzV}Wj2{z%sSO9oFBoC9PkD|u_{hjg-aF9&!LgVw<ZfthGtKg0{v`>0UV;1
zYfUemPcMe721tAj#&b7tH)RONg(fi{mmN#}yJwCUE9g!QY9mrARt6aui%t_DByB0J
z>fTPhD(1w6QJ9MP+B+4d-QmZ4_S{HbuBjy<^-&LW`U4V-1Pcga>=!!-Hk0pRIYoh1
zZvQBcSGq`87ktL3f)G*B(hhH6B<ixHvvXQ@X>!4GiJm6;2_Su1&d+^{+Z3`}6TdaT
zg`lgN`N2Ukm)vFT?G2n{Z`w)ZIUMGw6if}#Iw)`BN7ak&_rve`@S450re4P@m=vFv
zWTOi>nr_2IhUs<2Rb&f?f|E`bV7y5M6&ocb=G!ePUJbvprOdgOWo7@s7`@+7*h3ce
z5%}CXv|9!}I@;oY%;HGYFQ5-x0{U}*rJ~5KTOBBF4CJz$$&;#~oXGkb$!B{9qO0Bk
zv@F`29R%t&Y+;<zFASop4%1%m`(j=`jA|2f?S?aCbHqX3c91H(^3k3yx^T10M8De&
z*!O#6q}h7_Feh`RPo66*E)L>1*c8ghvz@p5gdQXWA~t?6*XZ@Je-dy`BnjP&n5?+3
zksI@zf{-Z#4ioe$K5KS=-P<+x?LykOXmMrj`{I$jeka{8{l;CYh`dy*Ptx!88Ag_=
ztJni%;s0!~RR3W??<*=2CVAMN>{z*J;-?x-5SqAE4Ia^1Sn|QgIg!Q~EK`Bwjtz2G
ztQnbJR)M)XXT>}F9TX}3chp5e69peu?`v(ivQQ_=(^pLrwT)KA60@!O3R(1}IxTE;
ztZiw1Z3KE?9UP+)6fzCRI_IllMR}L%G&UXr5ADBjW9Zn7f54#ZC&{@K*&JV1G{QlT
zv{oKGf+i=UCY;9xrIFiYBA9P?5x*g0>_2E^)7(W@Hof9+p3Ash|IA+voz#Kqhh=(n
zQF8tOq5N`PKAIa`=7WRtI96smX?6@oBlZ_d_y2j@=M+~r?ke&MLxBwtA3`^9yQ!9X
zi$OftY)9vAo04wk%5-7;D9%h@j}rA5g{vM-*TeL`0o4ELbl7NUGpOa`By$?Etvx@~
z@#~Ieczj@eF{UN!4Un47_%zN(=b=eKMVp%TlWvB_K*w64^8Q3T80Go13TQS%GmV;M
z8IwLes>%3(6*Pj2w-&^?DoO?LR5Ielbun&jh<dku8Bo)CF+7xQFcVaBo=9gp+kJ@K
z3IM)LPgqxJ<F45L73Y+tou0HiYu=!?>5!2rlwNMO;l;K3A!KND8Sc|w=o~q$GLhlz
zHV*Ji!_<6pYE7rm_++kr6FW@Kj*FZf9oP1GYn^2Si3IhnXp}<{))CoRwpdjbY5J&L
z1ssLXPDVSeDEV#n5V)8|MU-S{?pXL)EG+6PT29gOm&J6Y#MO(E^A%Or&$Z*l#1#n3
zbk)wvs~$!XDUXXr%{NX`4o5Zltw|SjFJiIle<a1MTI-YY<oM`F_kS^e%&kmQYr%r1
zI1IgWmIiC+&>vE3(>jQ7R0JzZzLmV8ivnrUYPN39;{Z9~93?5ZWEU!+c##^qENN$3
z>?@+VSJm~{U#WPWN{fbpHR8rxP;)CK>K~^6BYJ^4scRs?eUcH=I)`t^20*B}n3euq
z;;x7`_H7y&k3DDadZ@;L24QkH8=B+3P=y9u36+KT{U^+V;yIz<Iur(I{`CKWMExJV
zm&c#!9wzq4_WT$>Y;@w&Q-~0C26_C-n>NeoZ-*19Xt}T4zX1CDyr?>dkwGj#L-!t{
zMu-L615d^jf_1FO;N3kQaX}t6L;UbruiKw8dQ0V#6R8;MI%eqF3WkE%8PNVWVgW6f
zQ5Ckt?T>W%y*H3}u=q_o0P7s@37QXTLDB<tuxtEpDOJ7w{{tBRE0YG6f{$MjqO(MU
zq9qvqg9(FES>^*F`2V+xEEv@glH$fEalYwEa=COe9skzjJe5=d+WnNuarUsA9)kb)
zx^|>0eDj?l$%YW4)g!9bi2Yk)<44E>MDCj3Bc>Ke?wmXGSpy}-<r!YcTs}C!(F%-_
z@7Cl4cR5Q5dg*e!ez2o+Q2rmHeW(Vc5=sUS`wLIz7m(2T81LRp07D<Bu)Ezv<mL$+
z+(1vYuqcS(f0*Hx{PT>$dXOKs(cNJ+-}Bp$Ka}JRnj1Q0ltS@B30X;y;EU0K3b>%b
z;NiXK?DISbW9{doCmYgA<<97U(MXg3!ovT*yYv4?MfWcl6}0xgX)ZB58mxf}EV9m7
z3UAyrk2sx3A)u4wMzq`p#-aU?)i1<9r!WX_Y_z(m#{`$9*ne_k<<L+F>O3AoPmfp4
zNuyIpGTgCtd0U-><K&5H*0fpl`s9a2+lz;DnH!TuoU=`+)Vv(|%&bNpiUX4q&(D-1
z`t==%a;u_93e2zymR$AW1IfqTgEq3;5^dO~l5lA_xw9P=mEA-k!P;p!oO=%}0_^B}
zOEH=y{Pc<o;_JTA_U_&aI*Kt5bXlU8dwoVGWY)EpBXOP{W7TVTP4^ibR*{~am1L@;
zytL>z@-Gzo=}E^h>8elAzyK(lr70>N=XbvH89^G%Z|bGw^~0j+Y&8QwGe&_r){K0o
zF(4vdX-9lbQ23-g1?<a8`-+yfTN01+k<tZ}$e>dVdL*!udpUA%&OR<lmCIm=4r($c
zSd^(fI4zE_u+z7b6yl1uW@iDzxa*o{1ktn4bCH!b)Osar9&OPfN~?PnJtd?O%0$rT
za_2;+G3>>8sVS6#;37;G(m(t*f&v*W;zPcpxT{JhQ5Er}@*{}S(@t^3u2con!Kz@5
z$NU%p<(2ngA?4`K#HOGwlQ>&OFW<Hg4zLoP40`n)2bCCiQ!2VX%{_du%8ZAJ#TP}U
z{qDyCPv50zF?(0L8aibDpw4@mdbnW6ygi71#;7(*Wgzab!HWy+TE`346#2wocT}9s
z6<MdnZw9WF2bTp@nDXtp;$err=*p!VHq}R;SIq$1iwy;x0V~B`BmY)ku#Y=4`1^^L
z>}_XL6uvTjvwb9Yc(gC6On(6KRTK$r>3LD3T=hO~<80%`P=7!Um<x1;jX<K725bjn
z<7@|BrGrsZ|An~o!7^q5361n5wib&Xm-^F4gkF37U0;cDcZ7g2lY>NdO=(CAHahm4
zq_W0qaLf6yOt9HFUBY%V-YUn;q+f&&?756eTiI1%Oe6J{M$1Vsw1T@-80U3AJQ^dK
zy4up30fL;BF}j8sqPYREIrKo9^VA~?oa)M&FafwQwH*WPH_4Ggp?_KW{nBu;bLJ~I
z8ulk-!}XN!S$TNJT=vQFm)(sCr8*{G_i2w`S-#=;h3Fv^XSDXPM9h@nOCMF|^wGo3
zHpYw89pVK+FIAL(#QC`@6er^K&XTOOvRNGyDkEFM|H6P7V#=RpeTmoC@P1K1Xs{zx
zLv+?tqTOMw=3IA{X(;^rq<`l<l?Vb2K{<A$1v`|;ohDakwn!$Qt^-NAHLOa5Vfg?H
zL8(t5vKl{kg1VPGxBX{id|Sc;TQK?qizwX%bfui?*w--+t_#35ZsXJaGZlY0V;&S1
zCY9wcHKjBjjvd#`6N@=e(<Yek_=@ZMM$Vp8_=h$yYvZTz)@DS7;QE}mNOV*bueEq6
zf(`?spWLBU4K0Nzg5^)E?m2@jSfOCND0AQ#HyJw~Kd_E(YtfM0SYaZXdc4+XZ#2^h
z|BE#pWQ6#pnrTi`C~Pw1Fio#{U}S@3e6scntRn-~`Ud1`Nd@0puOe%|L<CG_Yvwzr
z0RK`oFF#Ci8&=&UWj35!&fEgmBsB9uXB%ghw}xU!rA9+JJhm3AN25<c{sbm`f!#_2
zX>j;2!glae+(MFaPhS8U5~Eq%B;}a+XO4}iMzweu;_!i>Sr~PrW6+f(1-URuWc?Da
zT#*DCrazuIkYvA}S6#660340w6zodNQ3d!5MC>HoMNvBpOhS4}G!@^(XpT(k;ZZjQ
z%Gqj@c$kktRtAV+zwDH^dSSF+s$KK8jGok}Pu(x}u5_gI7&DcXI>ogJX=|mWrQVte
zu2$fN^`xTL1bAQ`J}YX<;|$r(d^`YI)VCskQrPZ%<0cbvuSN0YhidU{mhj}*@4nIg
z-juF!yc!!irv1fau)Fo`>s;>7(d9fW&eZn^lhq%W;Tb9D4V!9;`ay*1!k?wh&R`NG
z8!USosAe^y2S0$MDEn&^ZWZCCN6pB+y%c`6aAG~JPOTz@|FpN{5oh1}!|I6z(hF7!
zG)~M(O(dTJ#&Cn8%w`l7m+7VF5JXuO(jV_o>oK-)Z!M#Ys;d0p<GlDIGSa2WD^$`+
zKBu5CsW3bG)3L-3bW+%>C`T4`0i0ehsaYB@P_c_4TCxO$k{WZv<TSa0PLbS5PBz$A
z15@LeLRUw0SF)IZE6K>O>4+(2jSwY1HeZZf(`ic!yl|mLwzRiu{6`4Z2fYyzR3n7q
zER8>J8*@+YLKy5re|`aJw2Mav^^6fmU#LoJ3t(<k_&`>344f=c=_p`&Aev>Ucx-X;
zcFu3n+R6-N*4hx$H`jj;JMVv_iTUuPwl@=dvH<v%+57YEq0FBV7Q_1SMSu*<9OMJ^
zBY(fEJgs^R<i}VUPM+)zzop99O+>gI9;J#z+VWW<<%EoXHK)@ogZ(G0N#IE`u^y|b
z7P&u|L~PG|5#19(i;s^Vr5%ycEc$@l3qcvt5I>43vSpfEY8sr@b;l84;qK(qD?pR=
zmS<*VwR$weloNl7TPrcl8PDOs()`X^Fxr_ZJRDAmZa2x4zgN^2j$3%o8!hk0TU{G;
zh#|^4g~!`%T~^v@q=?AO$|9?_h2gvN=yp-y;xcwoVd>W78(q`}uX^7GPFx_b6y<5T
zZ~3+*yl;_oFk2uD5}&3jmJa?&Iib^fk)Wx+5cc>-_>Qmt<Gu>P2u=NG>Y*tlMOXbu
z5?ZV3y|sGl_2?mPUh(8nmuE?EcyS?lRN%|N;0j4Qq2QcW_7J5W`mpsZsLhV_CwzVB
z(LYkUEGE7Qo{c#aE>E(;WX5A!;=-@4Q9{8|vN)p{SeQ0ULmw28zZBz8<7T<50BYGK
zmo3v9G}eaLz}&)Jh?di?6)1+{Y0{B9Yn+0gM|Z)WPaERX$O!Vv#QiYe{DSs{O`J?E
z98X~Q;7!lhddXbU*LJnKpV6Bw7(fY%S11<wgE-n}-MQR91r$|B$qAWLC%$x8l#wN5
zd_1KS-O0H|$_Y4(Q~x}Ou_g6+67P#~jNAHl3Uvz#XlnCK@ESl6Sr}3X=8ZbqBd+Y{
zkpF0cx`5&ZxKtdRoFE{gT5@N+U7SIZp5%nnGkzbeDfE#n4(J~IaYhh8%ILnLPS)_H
zxie@DAWvvl*^C>)%Gh~biQY4j!+`?giyZo1<;J5uNNMCh_(sE(*4)f`r>0(3X~Mm@
z^4T<8CnVer>=TomFA-jY=JTWOAV`<$5am7LYA39rkjq0^pL_d*jgTv~>@in;+F$gq
zJ83d`n%XFtGI>w#r%Nm~%xvx|xK(2%3xoB{A!<{k`x@~^GOsMo9~E9RR)Ze}cpT%T
z7;Llud>LkE3sI9{i{D>gU4jV38L8lZdQ-6?1oW2+Fp|QA=<#i|v2v2~|EtU+7%l-|
zdNITsDgGK}X9!W_huOj>OH#(i{MgTEE8>xk3GQbU6vo3Pt9Qo3JP*<4?*#p8{-@VO
zf`e++f>xM!uUrP*uSkyfp2qsg(?ujW6Z_!!Qa6svVL6Nym{_(S<DcE^;eMK8TH?Nv
z%gUa4X*7VE0&yPIDTjXl{C2Dwf`E4h&+Js{=0l|^!CGP-0o^kv?779w&EXscD57>a
zN2Z2Fw{Fi2Pszq^J?-31{3UK-<3=B`%V-><JIh(>RkcYn9qpg4;r0}-%4q3u15Oz`
zAF8P)--3ldeZlUQZ6c=aEX*~u1GEJ<RN%gMJ)?AffDf|#o|&xH>37Y&O>b}z(TG@|
z^2Pnb*lPsAc3fD_N=Rkatf#jj!+kE{e&>!n{!b1|ekQ`xb=$a!GGyF9Lbb*UF)`f3
z=I%YuuR-V#tPQd~KQFcwKmKEm$=Her-V}*C8kkC-)Ni1&Kn#u4lEL0%h3lG7DdQYw
zEK7;EIBvnP<bQl#zUVi3SHz<>Tx7zEm7tsu<L^HsnkMg<NySd8%j`y3v$MT_6H8Z0
zQsNfYKcG=hQ6FQDwo})`79;o`Sp}SQ;g%+RSS5e+vE2x88{R~iiQTpY=QePdzWjKm
z+{6%xQoQQc{PPQmU7ot0L6S6vbiMPn`SU==I`DKtDJ(ih!pv436ah1-sfe8mIzh6W
zCGS#yL;UNey$Roq=a9D^!Hu^Wy74HF^3~5HGZO3pS4bjwt7n47<jH1|N;b;g7K#q3
zGj<<X!8$4rWDbhlN6X<?j^P%>vyF&*NzS`48uN<%;92CT^xY3(J%CA5)?zXJnzVpb
zADRWA@mK3_5dv#;_BAiB+y`qB>1F6*Mv__ng)o5vSH1Cb(9wKo?C7zq?l8;%$d}h(
z|IUx6a9>z=IbvyyXBZ%*Xe<HC&erWua3bWgxBG+s4lt}I)rCRg>|04N*B!Hkr|WVu
z)IGQPB@8dMroV%F3O!$bQX6Fh|9_5ss%Vz`v0fUhk8%Hi3lf%<wHg_nR7nmulNpz&
zFDB4WHW;?>9@NID!Yr{OQq2+j<mA9D+^unS*zVWuOW{-7!E+sSX~45#_TEO(%!=J(
zAN(qQ=Ito(>8cnvzevi&3IW!xT>w+s`!%DJfL@b<4^@&WZCcve<g{uN?;$Gv=;x2_
zSN1skHa66aE^%P=tNCp;__Yak!vf)5eG?`^#_(({$$fRiq0KYG^{$mpqtCOas#b5@
zLfnys$ARFZiR{SaD|zc|RSO3TxSukGdxZIPd3t2{!akHWHKT2^+nPFA(e;I}GBd-a
z4L13a68d8gtq6VvXVUr#gr|%yon9<xV?idn?)<n1x|E@Ah`+h6hBS?^kR&_irE!|(
z1X7~J3@oa?$pwEwQ2BD;S0bV0odsh7ph<!m9EJ;tE!jWBm0}I#n%YvQ6LCbD3g<h@
z`yQLxgKS_?Qw?cbT>33cY1WTy$7W}ee1g#LiuE|OWf@4X1!KA8q_NI>b7>kIUWlO@
zWDe@A#X~NVaR04`-9er{9Wd?nM+@f`qoM2LYPSI)qt}*XC1%9;A2kVG$OfO4mYif(
zH|!0MjrT@-g|3B`1}G8X$;IE0lD*mTY+okrlYSPZCx0LVjcc2+24D$$Ka<QL_zi4x
zAqDGhTWG;<@)us8!)Mb(f!l}uIt{yMIRmj;?t))I$PEa>A8b1)8zfv0CT6;EQHlDQ
zy;`+<QCkiD5q&uaN6v5qM8m2Lu)!K@>D2ZZix^9iP^`yCY)_XQZ8I}7Y7wIvQvZYJ
zZ{n@X-`oSc7@03MjfjeiBoSp1MaCz-4stw6dbBV`zYn6^G0z@m$rRqLVlVgdYA!WH
zMbfqQbsv8(Xk-b}%*|6;3Y{SaLJSM48SoXxAU}t3UYL`c%a~kt8f7#j2Jtt@R$3Dl
z#!@Z6eH}DKrbzs-85e|MZmbxE`^pnL|2vgxL4q)0b6*1|$MYVezEHiQ(h$wEJVPcA
zA2N*15*3_^(prhbNE^Y<5)~gut%7DrOFIs|x+J>aNQ31R^^DJn`br-i%+gyUSwv*&
z!u(t`Ev(lc81trn>E?U?tm-mz>4q+xSjZ}g9Bq6O{mia0Qxo%{P(ZE@{wp%mgQ<NM
zXi^v%cD!1yKa^K%7J>+9OBs(wAF)W}fUVc?i+)R4!Xm2c&fBaBe(BYqt^lKsVJ7W*
z(niAfl0;x3nQhcldjO(b6QbQiAW<tgYyO1o)5=!4FkX3rnC?n9B%`1|O6RvsEq4)~
z=ePXJwIY|O7y@e7tbxS?>HE#M6mXH`<tw=PxL7lDNbxN(%+LA!Yw9H<?6k@lbf{BH
zI$~l!)4Xrd;8Od>V1gUs0uV~zHRjgk?sskb4NZV87W8E#0W-?w2tYwCjUyBfVdofU
zl0%$?eXyUZvE>vBay-eJg@TY^e_{+DGYCnj-AD#Mfp3@wpKp{$*+O7q#(h*|)lT|}
z=`8O2g=p7N=l?ya;zRlr5k6|8;NeQ=;6vo((x9a%F0M6@2Kq<}RsBc|FKF9GOWDZ)
z&RB5CL<w`2&g&eeK2Kba0Bh{FsqOQbVGN_(tuRVU+2baow~k7-7>Tym=Wyg#cJ^1t
z2dLAQ-s^dz-JuRh5_Om-4KlxQVwr#5r%t3kbzDa>Hpk)X8-&e^Td#3K3Pms_=MTyB
z4_K(?0yjF4g#}BO!#pqmVYu9ZYD<}Nr79-SUzzaV66xRmGYbm=w?||*eKZkqBd^u-
z>RmB7Vc?0~UsXZrEeeayCV1u)xoBjA`zFPYQgO?6K*2oD2IuNSO18vBAu@{trBvay
zw5&eSrp1Tl*7OlTm@m<KgU~#0xOoJm?+c|39zY01ovFB_{mx+FeiX>@rmECO&xN`5
zpRvjQgb!~x?M>VX6F-UEFZYb6)O09YGGLN`2t9K5Y|^Wu(P}HdD|)~PK@+}_NYVn0
zbndSK{MAgyFL${#PDT5(`u#&cKx10->$2`0k*ik#$O>ckoK8-}O|x=c3HABWhgH#R
zA;W8YWO38Ii$jdYH+lm_zo*#U=~(_L+_Z10iLk4)5n!x(jn<0$Ar3i&B1Hppu@zzN
zOa!y?3<T4C+PMsRmMGx;7VY?RuuPs@Jg4Go20d&pJ+A$mj&z>fF@Q*V<q88r4+MC{
ztNh<DjL!e+7kZv+KsG)k>c1Otwb3^SJF4l{^TJ3tU|*Cp*7o=%W7tnh<!jc@b>18Y
zO$h<Pq}o4P>>OIc(LBc=Nyj56C1u6OovJ@JdLp6jb9H_gxx%v5C(ddLVopuA*>7RF
zX2#zBg`l64+cdbGiT!>@Ty1A7H(^rQ*<xr+7{X-fkHwdHU}#2Lv!2w!K*)##pI#f!
z!~TcF0+re+d)G3+37-w49i=O$T5<3*EwNF-$hj~kL{SmpkAdVMG4qbVJHG8G5|0RP
zoDpUCBr6pT+$tI@T<Wt`^gmPxAu1Xpi&HX;W3p7rt72@atuMwjJe{Fg{?J%1uBNYO
z;(WftR4S%LkRQye$S0v?5FP~De>y`DT%_yu>cd7~)a8tJMxk+v9<U7X!ug7xX-IrA
z^2>sY&=#eEkVT>`*f|8BVHQhv`4s20>*cshE8x?=8;tOjaaCeH!mkL_J>lxAnD>@8
z;gFhM3`mV;S5ky$=37x7B~@9M7D?9ZC`9<prNZKiRd`3$z2R=M2h6D8Vk00=_1@dU
zs`PVnY3EW3$F-Hi(HOVTX1x1^r-KUuiNU5Nfe(7m3D7ABK8gePgDM6fOmoW?d7XQH
zLt2kfv)~N@MCPeWwGET({*h;X5pG)(8`+Oc2E~~2qT0vXGP*SG=LV8ls7Qlo!QQ}{
zeUesa1Hg^P;v-{l0V)|}bc#Diah+#=Iqrv91RCM!Aj$n7;d?4%+br9Nn=5Ce&~j`Q
z1l)rnOkHGK!lH>CxNjj?t2r?zK?V}FxGlO5NXy1BmJ)eaj>GuNp5FEFne6Jmd^yas
zn5?NIM)t~4x!-xz#nncqP+)PRomHE?)QDXh%i4vsLbX=qh-|yhc$QVbw6GAv5DHg~
z57RsdTku0(p{Z!L7>8Y2f4PYZ+NJGJ&JhGma7uPlcNFg(UX-LU4QZ4%EYcVe8od)b
z6iWG)&D8E|MmH@sR{YWAMj~aob#LW@eZ^LyaoPp9!?On!NLBPK>ysDe+Dz>%KjSEb
z{v2Be&zUAS<tQh$g$%!1e1+L3j=~hQsB24r)a(Qr7NU{Dui!bgS?Zx#{<|x<JOF`%
z3B}<Efk&ZD&$-;IqLEG8dOwar;|+`C?-FU8!lq4d?eFT}QfQKpbkz8WKN-J~_sGeY
zwxL?G_t(zo1;C*8{o|x@>dF4g_j!;R7LQ25!QT{t_1o8eV#w;k@cgp~cZs>|eG4%)
zjMd%_nq_1g-*HWzoZWByFDW-buOO3BXyJ=EVvY^54>J`>zEqY}5F8o~Q^}~rQ2>N<
zx<jAm%>V7NZvkUM(!`h#c1#K=%#8Cz|8NRoT$H|6NblmqLWb$}8LIwb;bK}=-jR5<
z-nl>T8E56-S1=18T{51!eJ>nX+cSP=LD?`IvX<pF@xr$x^TGTc9X;;<2s87M6^tGl
z#bfn-WCh>vJB9QR!r<(vsQz=}u0uoeL6bn%5vh$>c<xvaZh%y7-~8k3DJu*&Qgmij
zDs|&kSQZkg65vS-bH2cj1nI`5hCIItEK<33GlJdydl#QPzV%$(y07#$;YQev4gIU`
zPI9en;Vpl7{Em_J@573EYIy9_ZkhQh?CdxGYgj4)Ez7wMiLmEAkvi<ib`tCDo0$4r
zk)#=}x!o4Zc{_<Rr^Cd@?^VQ~_sRq>+3~Hjb_0&tGx(a*@O<$OC(y3H7e?8@X$xK_
ziyk7e{o@<2^k7Tm#q|_HK@tpScB+EC85J+sSC^63N2=zeiBnORm4?W6+D{DaUxTJ@
zjvS~zrv5zYEwet4@5o0aX54iS@I<Q<RGgbc%0~#Aj3f}Y{DLacF{JckT<+nkBe#}z
z*v`Ei+!9h@yFgg>mC>(5>oR^R5?`5%vieY%Y1sq*%QKnFM09Q){^7PfgjT%cZx{x9
zJzo%mQp^>lEh#5F0q!qpc=f&N<u-mv)Sl!NK!dU`_0e$~^UO19!$Wv|bK0B8FBQK1
zs1PuBOez-^=*Yz=PXu}2*^2k(;A+4~gW@Gs(K4JGH*?z0YaFfML0U-}DDR-oYgY6a
zosoi>;fP9~gG!yrDQz4=RsW_=Eg(Q5Z`9~Mya3Z6eWYdb5$GnI^m<mzE#?M$fUrbe
zQ{<=~k=xFDj$J6HZ_Ar;NfrGpiC7q1lzP(q1>6jlS1=_q?Z>Sb?2Y`^2Y9Icyay@z
z!aNZ-)JAR0d>T+u9{nNerligvQ_;p7L4I2rsE(GPT}(5jOja%Vvxe(fG*w`Ck4EM7
z!+}%D5K&s@Gv!qyRaA2!+D!jA!}z(J@w4eF*(uHLCWY?uvSouH;Y+f&`}sQF1Rtu=
zJkhSTeR#Jk@4QiALTXjjE?(BRU{pwbu;zPH%&2@@-f?|}Zz$m<vY1uqs&`TfIGCpQ
z7}$s5EW+?q(v`A*_o&nvh_9f0bKQMSu7ZK}g66(vgv@$)>4*1^P(EJ64Kfc?hvdTS
zTzNF4Iwpv+L3}p+QG=56#c+`4iT`E+pqc*w@J$sSnmeKX^qCCW9weUXM5FL_F6{XO
zQ$=#6^`W24S5{BB#6O7uZYBCzxbw%PjPxS8!KFmyd(tQ(7u|TRSb0zQ4e?(Dt56S|
z(KDj~i!r!rhQgOBtH7G4gDJEFQNpoR-*A?v2kb`+Yl1L{f`zw?Tk*vPK!|2`YMo2H
z9({q&F(}LIPJAPBgj}%YRwWDjNH_n+a;Bh77t@_aVYfb?WADIq#nL$72Y};Ir+1al
zHnL@(g*kH_@?ea)z-M7Cn<j-`ak~#5S-4R&B8$4PP`Ne~e*5kFu$R_`l_K9UkF5@4
zi!or>hd!kHJ}zq4<f#B1b|hE;0Z~ms2>zPA>qu^!^C*^&j^BSLz#W$d85Pp7M)GTT
zTfGdfN^-4KHwUJ3uSmrxOgJ{AUUFbTm@$J(nB1%jK!HDmuK`Qx!T%5}2l%sx$OT*@
zh$cZf3w(<6Q`$6auEnR^W<pUtzijXLap{}wY+i)b#Ym`k0}u(1Um4@nw2S#9&a#kO
zyp;A3oQ%QC(*DiQi=JN9#%>|)fdnE#jnu!ad1IJ^_CZYQfmEZ3zj#y^ecPpymR$=L
zLXa%KWob-`Q$}~mY}~_TSS6<2)WOu=JuYWYa_cUSRoQ*h6|!B5C`}k%00%oyY15`&
zaAd+*J2jHDL<mnm)U<KSk|F5a8Se^c?AAq6kc*p_CzAYIjo{9~Zc98Bl6PP#U`{5E
zN*2`IsHtZmjJ;69TcaCY@SG`QndzLv8K>V+WJI#nMxn#C0A}DrprupDD}B^APEa=G
zuVn^*X6A9lPfH{<3l_KU8@l*}ze+o!kZcpJ9Qq7&k&HFW)g!koG=w^ZSBJJI5E6L1
zOD_WuL2P7(B(J<t(+vy0Ayf^W4uc2!tjLBKrQmkugILlid*TCIUJ2pj;~#yA1AMOF
z)=^niYXqwW4>!7f?wc<EWA$Fd#vyE;mM)PNMoul1Knz59MIMxHI9bF;4iuFt>Gp`9
zda4|Nr~0%Ng=_IS)RaE#0b|oL;l#X8TmvH(uASdCJ9`B%mhi75BSg#y7FFO>YLc;H
z!%cU6P`WQ7gE^15c_&qiXYu&SV`COcFq}g|Nniy&;}Pdo2e9)l9*O@lMGb4abx308
zC_CBmXTDm+6hZVK|M3Hrz7d9j0W)elAe8{FZPZ}Q()u8BU7Aua63KE>9DfrV3R*z9
z(^z<HGg`u{X(H*|2HF<*5n{T3DYXsEqE71L(xCmFf#>rPkd>^laF08a^bJ+*JJ+m5
zxhP3`S+SdEdt^ls0mjmAu*xVtRo!t_yI|~(Q(@uSb?V;qkP0@u@t!>>Ho*Eg<W1Mr
zR#h1|g7OoT*d(YGSuukoOlGcdQT)qxH1F@9UrM>I#i$@0eF6fs-)~IZ!s;h1lE$Rp
z*YUCO@bETgYYx`i=S<_e_d?u!J$6rBRKfo$k{BCCvo*Jv=8N25V`B8j>%VmI>CCiD
zcOHF;pPO`T8h$XES~T42BASBdvI>d_b{*2;k|q9IGPcS*a@0h^CD>`Dzg9iK7J%TW
z(#?Tl?BJ)eGmV?A_$Yu0(Kp(Rx81}Ri2RYRXlPm8{3UQc!wVU?*L3gH0y9truV(Th
zyda$G^u-=VU_LAmdD?>bJ&kjWTJLkT-hNLN51hK>7#x}0gDu^_I!1caUtP}ZMe`Uj
zX+cd*?eL~1o<h^NKX*3b3dn02vPfp-fJpF@j;5f`z+|TovvP3a>#q)G)sT4Pv7X)I
zP{6bkV?7-zr)_}nANI_zQpPErJj;ps3wCbY0t!L?9Lf!su_<RXcXwLmZY}0nE_IZ%
z!A`rl9<eTeDRrG?h+8xTmlF!l-qUtyWFP-N1S%Q<@$5=^zVL`+5<9qQ0lcxK8y?)+
zo5G5|OG-rg$R=O@-P_~5CNmo{(#OW$Il_r+S?g3!I^2#dD#kMVr8^f^eXoHIIkXR(
zrUnHEP}pe9Xeyd2NMWuRFrOPs|8}&Z=3QP&LJw(})65w&TkF--<vS#2OvQ`xVw8+%
z%9luqri_lR=C!uAjvF?;zBXlh+49gwMxIP?TbjoDbQiYKp@DVUr7!IDF7fPeJ+m7t
z)f};3vjJXMjM?Ar_0nM;%A>S0qB`QyNk?-Qpfd@Y2loGEu-+0umr&y~Nv<8iuX@vd
zIsEQ{?mj*bVD-33%icovrVumnH&dbJPFQpqool)e&ukF2Zac>@7Y@%j>acV!g-84z
zy!xdS3q%$wu5x~;y4@1+KzK;Iv_@E<oRC$*zN|yh9@3$;(VS4#7gE^DJ<wp<4YvD&
zaV}F_RuTpR3sViMw`&@di=OL*#iSt0a8+4_g~bd`YDg2q_Z0UyJ?U(FygW$j8=-SH
z?78s@4bR8k?SHYGapJl+zY7-5Czkbxeu-KN<#>#+9}OPfop^1^cdYLc-C*A<m-F<t
zk;FTmYvkN?_eWCp`}@+$4}W<RqYLzf1H19@-q@7B<Dh*VFd+UtkOWiRggIu4wJ$p;
zZd-fF7yMPJ-wVJgd4%KSf&@Z$6(+8gi3z!WY&450&tY0n$!S{Ui(ymGS?zUXdN^N)
z*GVO_ul_USrX_;aEuzyu?*3NZV1u-C;5w)9VUV4U*D;ZiwQIG12YzCSa%{k!e!CBW
zEOo=a?9OSH=<S_H+Ym*_)3;})V9ZNaine~)BA6c)grEbUIWJ|K8p1=RMr1t9Kiqio
zBR$1BfN$jaFfgn-=4*{lJzRWgB=56j7)m;DpovlN38fIFoY6QZ{ogfg{k>P2(p!gt
zI&MLiPp4ZWY2;KWvGl5dVxVw9FW`eAUX_EH^m}Bi8}HnZ<Rxqk96X3>Gh`u(hcI@1
zIbSP6c1C?p*Y<H$a-6MZVBrrfT0)MnV}dg(D!6o~EO`+&&(Xnc1^<!dl<wS`vFi+#
zx(eq3h+vpOAI%MI%2DmKk-LL1d)9>wS7S?CbCCcDR2lohxhPo!R|BYQbbjVacq^aa
z&tA<;Zs)^$mPIf)76aeda7L%2aD%KjZ(<AX-Mwydz<uf<_=u{$o|n0~R#~eHoGK8X
zt>?I306|&!J4$cCuz%gDdOxzFA~FJ^`G;G2W1qiOHaRjV6{52Oec|nOh-O)LDF2JA
zw~T753%`AFg1fs*kpzmhxVFU$MT!P@2vXdFyS2Ex6)o;Ti@Q6;X>qrk_kZuX=Zy1V
ze@QaN&RAJ%Wj)XQ&ACU?ODy#Pnt#O3A(|+#RbDVu)iY8$bpx48?RNt&V{YL|+_&LG
z8aod2nU$pY1b$gf9<i$$XjQO_nvjbOm@LkA;$a(@-^)#ZOxc18{sJ1z{pUey8s#d+
zZs{PBzhjMUFSSVQ%=_32+Y){tO$Mo-6DB*SHzzFx2+YsNuvDI>pWXFgw2$RUJr5vJ
z8qtR3H3*5{%(%S}2KQ$Nl>dcbkB<`Fjz>t67csCOE488F=qfT3g;x^!{G1Uu9`}OI
z>{rw8Nz-F<BTb5PpP@ENA$OFg7A!W&phHFn@zBAwPMWpy7RU5+5Yn;J2}0qo3=N@Z
zPZgSbN7Tvho$)Ckgt~557y1XVUNt=(w6&f;t8eEquI4?io9i|Z=C_)<C}8DA!CML>
z=znHsBr`5_j3^6kFGNyxJ@Q)pv4hgIbAPQ+hR_hxxvJt%-dgI1yo<?V%pt0*REFSN
znAk<F4s>z@+Kx>EWwbYDCZfAP5yKXh7Gc2hY&049IQq^X%L@1{os)6HWGPM$qZ+@+
z!~=i+=onJc5#_R4^*B&Ls=X)gr|C6OV1<rdK^S6>B)iJk>Gn(x(UOx7#dTQ#dkveq
z%{bo$ZVJlV;BpPN^eH&u@5dwnSof@nulHW4e{mBJ3@Hs6z#r2o5#OQSQ)yzj&LlG9
zex6)jQGH%v%S25=0Nb&SGT{Fe^VP|r$$hxe5J%QI{Gbq?hc+&%TJl7BHZ({$-$@4W
z@oKp|ZWkopzzNMB_tSKD1Al)ol9|i=H|H!RKI6N&&=r&tfs4DL+_&r_#3^S1>pqtC
zUe!H#L%Hc@h)U*fT8tO<)4G|KF!U<_lVGlNa0^d6WB#F~f_+9oD-Q8aWE<-r<=#n&
zUl`!lX0n`+7zsDH<f{IY?w^bSgjYyyRl&GhNv9rhJ$ua?yiXG%e&hXMH-AXgzgbX$
zoY$Iu))F5g(&&@c#^X}@fmhOejk-0FR(h<P;8gMcgic)8-}Q&=ROBApq|&LI;TO`;
z*;!+UQ!EKye-H1w-i;Nq2To_;d;BnKTD6M<<{QrY{6bHhkrO)m55BuGL#mF_s_L9q
z4Og36GypMfU)fHZ{ihvY9G)ddi}H8q7Ud7ZRCCdCoI!Km#kSaTbf2bF@X9~%@{_kp
z46@I;oBNPZko8)3D<j);4u%~a>`)*$l6eokmPS1O?!77~2=h5o(A192EBJ-`8?xl#
z^};^;huDd;Jfgl&c+kgIgq#UFZ1y~vk%MVVnW-mo-;;82<$N1P*RW=sBdQNuHwi{0
z4qQ&5k50?Y;hYHj5rIQntO8D}LeGF?I9N#sbaLWKz~$(j7y%rnQv>d=wybBMpTrTo
ziB1Cxw4W%yd1%-4alhyBb;3v<U{h1vgpIc1&0Xcw=i$=05wZIk1sA5`2_Kn-W_h8<
z>(wf$iA05k;cZVx89soxnO;_LGR2j;N$voDubz&TJP`Mv7bfS$$Hgk`p0e{&VEY)$
z%S72S1`~9;EItl`_QmGJ36Ep=9v#sxPog@SD3&ZNsRStXe&?$b4=Ztc`QY7a6tOGX
zLyy<Q%lF@|#{gE;(4_&~V4aoCp=S$+dF2|m=!bk;T6IKPCyCSmDNM^yk<@G1-~3=K
z53fb!_uu}q=CS}xx+suVI{4})8zLoD2y*zr8(C>cGM@aR9`Ct;QK~yxEmdxPbmt*?
zy>f4bs+cY>Af?Bl1$D{)Aj27BQ02L6hS3k`h-9BI2rVINheW}(Ub_Zjh^R=4+6(j^
zEoyBBhqNwExji|IDq@F-)t&^qr<`huBG7?Rd1mpkzMYwpyu4hL*Qg(vF8eoqW;(Vu
zJD*1Z7G<jtq|U0ll=y{juqYJT;)AyTTEpG{(_&^&db;!LrA8sLdrj_hk<dU9c#{;<
zOtXjiC2ei7pfqYTDdl`~nqYB>T6RrX3ig5EsllEgO99!HA(&<DEJ%IPbkx}!R%&=0
zMQ%L=Ye7~~TdJqJc(*5fdw?A3iA8LrV~OUg*b&}B88Q#rBTu0>wx|BMP|Z-0W|(_y
zgsg}dTsxt&ThMfbjJtd&W068A8oQQvd&7UHgR)cL#L9Injzf*?2zJJT$rE_@p^N8D
z0LPAMMI$b5g}@(8p<>>*JwqTsT+SM_x&^0dFoh_UOQV(JEi)lAWhpo%pEY(hTt;P7
zSLeZ?pFIdzKIr2}G2TWw?dj6aaV+byEtl$P1PccQldOrOkX3)UQqnN095r>T#Bg+^
z4Xu3;KS@>(EjY#aBQ!1JpSDdTDL~}9*n(Q{ZIdYYhbT@^vL!PbMX<Ukyqu}>NHuPP
z5|~`1PbGMf6#uiFnm|kQp>6WF>nw@RIGl`MLKYD)pzeI2MlRU-z7LGdCRnr@2H(<p
z>NL}KcX(@WnVN=HM7(9UKoD4py-jIn=+Ywyb7V7iGml+Y==UJr!r@*LTP!HVonTs+
z9HQ>ysqqDWKYaqE^JjN&d`9=SdLnlgKs&8M?S7s`R`Ne~?%NNex802sisR{)cA+Dl
z<8r!RLRV73*6@myL4Mtfesr4C8h}5*BhUIMv<<I{X?C1)(6MWf4`=q_b9GP8I*!~J
zHf#~Wg4}@O*0_Kh-TpG@fSOKf>6u=bt}_+`4Ll?B{T9e-`x(M9Nm@5+^vR~U`R)LR
zl~o?7L5d?p=Ke<zz)%UI)hd=3_B}=%_n<Vsbzt$JeHV9BtmQDVKxu7WLs_lj3E45D
zXdU>69=CP=!)b9@n5iYwFh5Dz!)uj5kU&+I{)EY)d6D4>X3JGmq|}c4T_G#KcEy4G
z!C-LIj7@xCEg-B&Fow>IzMwFu<`NJ1Vc{Mv2GIbj>y1_eIu{9sj9`BuW>DR66?}<L
zDuA?AQnt&)GF3MtRV1xlX%sdm*;}dj2KSDK>QfA(eQPEoiu)~vlvArxsgW5nZ`UsD
zkAU_)EV`YqJytfq{DG-SDCRH5<K2m{T@2C`^D0rJ{MMy1g@@NP^1I<W*NF-kzc3Ps
zTf-u`W66fhd-PhNpc7%T_uj+}_~d@nw<<INKSPAd_4I0Iuh2RvNj=iz>rug`sBv4?
za$Rjct(LE|7O=$&;YLlTkaZe4JQc|)PQonLE|-z}MKNB`m{4SqV?|I(B&&24iAgej
zR1cosy5PJ>P(mlkFCr95{~lczk&Kw3sG!hnn(fF#so`}z{#l?GD^E<7%i~b;fMC2Q
z6G~eHZhpCaj2`3Aa2Ayg%xQr-G%6{tqC98^uUswX341wmz$0BnO?LM~C4U6BDfJtb
z;Hq>6p01-l!dpBZyLo#WQ-hh*lY>EB-WhJoF~tI(cJUJ&jmP)o=GRO=)&2S3M7ea>
zW-fUdDpO>}VB<Tn;{MnTBDcvX=y6~|iutqUR$w=xd&wFM+FznMtj=XK4f`Hv`<*~+
zri}KAwj0)sR!nXd0ZU;96j=7?sK4V<`iq|>62wxDj$FSq??>$pl)ZcY>Y!@ryDC;%
zs<)%1NkCc73Y@JC-@CJ%ToCN*C5FPs`1f;^9)2URCKTpPmRs--8dhB~r705FBY4A`
zs9mergBo#vHJw|>X8YBN^#s#|u1ogAna0&Oo}Jy=0%1P}v_WK5#xf_ws17D!Q!qyL
znHe_!W`1p^aIo@>;xo0B4nCX)tlh{;!Zy|23-C<#yK|kG<c~$%(`Q@L=C)lW9G-XQ
z6=oabWgq7fQ!TE@IOul>>~*K=r?(^Eg|=^cZ3=iD_+|Wog*;%xQ24<XVe3KJLaWY_
zjlbf4EMz2pa59ZPh?cuz8I&^kjmw+JDuO;aI{Nf>j{8s+;p#*sFV6x8!xEZjLKz|7
z$Q-X%{K2i94hC^i_Q?LtcCd^K7Hw@JibL=27AG7dc29dS&t9&Tq;%AQ?}H`NUUxS2
z6ixd>%710N??po+ziyg3AnZ?KW6v}k(*x?~<_G^Sf|LY4uYLGgtBwL5_ef(8sj>e*
z|1$uOYZ1sC1RztIRimj(!fi)CGCZ<4URp~%a<ZKDxhp<@{~dhMj`q#{<IA*mF;Pgm
zq*dYsLd3)_FMiJw-{bfTCbkP;-2Y*`k_j5(k|Xq!!4H!tcm^wJOdrTZA-zLAN<OIN
z^DxTAhzXO>{kR%EqARod)Mk#6(6?=em9h82r?xyRcpQG^8T82WD|F~ecahkaZP8>K
z8!~A`%43omR1Y26wztV}lkK@x2KCZHCq@bL)vnTfH&V$!>Rq0(N$`|_49LQg`@;ym
zeLgDzo2dTQ-(5r_i08ksFiZM%vf1sOk)XRCb_8zZw`a!nN+{OHdZhRg5xU%~-#6bU
zbpr<}<HYMdL<8Mq)!#%YWisGSO=P4~_Pu*vn@;}m-)(IpDsUW)3rm8cPCu2#YQ|0)
z4_eL>$W^jCWbcb({bb@}qRnK$Bd7?60t2^j19eg*Gv)~vbjW@8m^1H}pLncA^1G?U
zg18`V3GWV9_qWH@TLs`mM7(JmJ8qQFywrmkLju1dZ}eqagcq1PP!@)fntC4d<>Bcg
zG3!&iHBCYYs2h$;G!IWdmr?B*E7~oT8g#j0<d-hib>`Licw~@wPp+nA)YkA9O$dgm
z&(}e#@Z9rk_kx}tRPnWFNg_Hh{n)Jy5i=lFo-TNy!<@iI=K{J`x)bFX@S!v59QO!y
z`zYS%=30ocl@&$r+#H@EPwb=?Xdq2Nfc%YWU^*0+vEXZ3AcK+?N%u#Yj35}tr^lkk
zx}{(9-&1Pl7eZUOy_-FHrM2m_)^DxVM8o-MLxEz6j85}P6RG{3kX5l}y2#-Nr{z<0
zI&C5H1In$*pGZph%v`Q`n~5bjh(!XTVo#fgN0?$?<W5!_u(Gu=Tl~HrQ1+1cW1VO;
zN%qBPMqgFuZ_m*jl$Z9*4$!Rsn{^*}0G_vpem%+%IoAb(0Hz}ZOQYI5ZS3$Wx@USE
zYyHu8bI%Kb^&KUkOS?DOtDqW4_IUjkEc<*c<K|M^2u)w5JyDw-?C8UAV68kK(;zQn
z@5!WREbu^EJH)7&n}U`#u=%V$Z<&EH<?hAqz&Xh4duPqQrlYS5lHd4Fl-d(C>qZet
zs#_^(i?y0ByaHT~L{~%tk_HBxu#{J!HI26uxuu74yZFIVw@Z!It9X!ZLvvH=cbBAD
zC?6Ui>Oie81>VCXh7K=IZ$Z$iUTfkXye7#P;1PnDx7g>RS@h8eR;}JRhx>TFJ^L7~
zfYRc{br4cnL>*_dp2*hvBLrFr5yi$EsMRYXH?0RJ(sRvHcxx(eZ5`pMlC{Pv#XgD{
z<3(_FJ7v(H4yTp?wPv7cF>LJyzQ$!0sP+|1L)>4@6e~bWLo%ba^rfZb-M^RcXk)7;
z)z!mRwmg0<Xk_TIIxWo;3jPD>jS#R=dUz0?pt7*gEH2IX{yV{y!7;s~Q&pe~YHkIs
zUVVd>7qhIE8PeiD=9N@M)4Vs^q)voNp@A_XYSd=>#<UCc@aHd%Fm6hh7+Ard;N;Q&
zu?xvSYb3A<qM!fNs>Cw~RQ-j67%9xxM2!YU0_t65s%H&lr|^}|g7#UH^*IhLDzVQ(
z&e96li}qF&YKin|oN~Lk5joY2Kn?ET=oJ5m0%s?n5f2k`_;Q}$1i$+F(djK#xVr-d
z)>*1Ld2Mbloto+w8sUW){Be5!tU-ChKHm@kUSY=6GfG5&byod7YhWphc-Z*4NZ3Vk
z#J?976}VnZ$0K;$m)sZ0<7ozL9#2Ma2!XuDL%(2}9=6=UuJjmFjS&VdhIN+BA4U;L
zL#n54Sw3}9q=cy6@|c99-3I+6oD~oI9q1PMMvEtdpx{YISZ{jh31VL#|6$7q)3n~W
zva5v;9p$l3FvgjyexGc2Fxjw9+_>wN<WsM%0yCsO(KU9L8#pTEsYY&#*QB3xVRi-!
zu&qmqdl|6)ZIfCYc#l2MI*&2H&I<);<&Y%%NlyCvJhWM3B<Nb0)$|V=<hyX;K8}>s
z2{Tc@9Y`;Ea5==N5-y;;N*NQaE9$ZnjC@paTjLvIcst#*efdt;Hw}c-NEbaOi4pBm
zb82U_j8wGrD|W~ywDzfZ$uj|{wZT%3_c)I2QUes+8Su&Ft`W~`Z^U+S{Y?JGaz>s1
zIqNWWFv=7x{OxD(`w6DW77ADV6pTsFt1ODW|As16JOhI$vfp%ss!8^_PI9|eSMOby
zIYDjOa1pSP8WQ+c;c(Hg#y(W!;E}jL%@k5PYK<gJ$^#si+6Sate9%iKN}IwFbdkpw
zQoRQ$&shEwwTutSBAYdjogSOo_-)Zj`u!9;g1>XB`yp6rlWlO6Ym6%^=WbN@Qs~3~
zW%G%bhSQ#swi^FwIcCrN(3)z+8tQZY=RE1uaJZ}!QX^plc$AqE4K(m~<Nv(l5`V*U
z>Qa05htu_2r4xi@x0Xd6fyvh*JNqMihH)|kV{|J*`z+dZ+5?Zi7544Y@7k}kbr5j!
zko`U#nObcg)#W5^_}**|eJSay#NtDEOl*`qW}D@hEdC-J0iXHWa3l?ro5@dI8t|By
znh-zUPCEN#w1BCLMBs-aiZo2jc$*Lz7_khks{TOS-dU(T`H(Isb^InVy_78?Fr^g!
zm5Ki&$ox8X@K9k|)@l;($9mI)UHpX^Cm)ysfqVRRF_Ko-+EAd{S2Wp*E)<xB0!U&x
zDukmk^K6CQ4pK?i-ZRdvoKPHwp~C)(!}G5i9sHD_G8&Da>4RpJ@jp~xIH2yop#hdL
zhtnV5qJoX!w>)r`jYve%Pn6BQ9z+9Y0%{7!)4Tq+83WFYNpzCID-r)tg&_C654y1X
zoT3JnQQWs%ruIa4QFgqk^qCZ6i;Kp|=nIFu{GANR|K4mb!*sdLthJd74UkCs`j-}U
z3hHEU!>2?nBI1iSzQsyLp;)vB!4?)4O8<@A{d%j8pr`LMoT1Ba7MtIb$v@-SxNjG9
z)G&S|f88S_N#0aqAG2N8UbgBs?lja6a8eh2Hz5*GEV_`^AhQ>qHeTCWRqry&^^{y-
zVe!_Cw1vzET>pwzth>R5ff)T4r@$w*{vd{gGb5<(?`Hqa5BthGVQh8|3C!Msx0uy;
zz03E6#X1Hddj~CdBbq$B4Yi_7*c-UuOhi1=Fm4QLF1gYyaUM1wlzPsA3*$pUQXPE=
zpx{?j(1&+_QB9B43e8wuUUDw@663G_P)EOQfc#Si^{2sM>*Q}ibAcD@I;r^l(>=Mi
z#Kw;k>^Su*Lz&`O2+<+8jDn*`qzu|1k^baIJ1Ci+pUm~PhEHRrl@`F1akD`M(ky1L
zx%Y0RtLG*LBhNN#*nGF<X>r3Xa*$fke;JGQBb<JQ|4z>zrO7QBb1v&y?w@!`ciRqy
zl(z4U7@?I$R4@zl(ri19Z1w=qM<kw)aGcE=P{3EJ<dBxje78&-IL`)e57*x5ZG23G
zlP>R269GmU{{z4cC8B`sJ~HupPxv^04Ca9l7{e9*RQ~;sc_FgnO)1Q9z71dp5$`I+
zUFo~9CD03H|Ck8p3mI$rZ^A*n^gE1TCHS)ZzovBteRK~pI?ZuvwLhvd6YqCie1H>z
zj1x1*n0q*%<liVKE8*Y*+w|Pf3w_G+fg*Y~D^3nci#Y5*bFNOCO2nc20Gmd{q*8Jn
z?)<g`lBcZE+*VamZ?hX|^^fQ;DTbyt5f>H%Li5FH<Zh&U?~dYE>d~DsIcqLO;s(@_
z;&8-m#Njr$1k#&-Yf&A1kw6!TP}nz0V@EF2TrS-8Z}Msh8(3++k&{Ah-Pi6cI(rue
zFijUUSQd9~{x3Z5o0FjQWRQxOik$L1e{<TgjOT{oNy3-l<UAVMq6N$V1;${4?{=d*
zJ2OFQGlD%m^b+Lk8rf~PJ>4LD>$xkFf?ql(z1;3%sUoet>q=OB&dGObUn82xf{b&^
zU@hb7nrcBmR@8}`a0!OS7+=A_Z~s<t(mL80D*l8{(^B3|xNXgaAOkfu0#6Jn*wy^o
zP;+FIZ-G*jf%t)Ivc7~cgRxx3H;VWFLPGP9^EF1)$Z2BNxFq0Rq>4=_4A(-gh6s{^
z1TL(CwGbs}FTh@qOVsCj=C_DY2<~u_C*A5McUNCezDxyH`vXqKa3Er3>C1w6e%_=$
zIJ*RdSqg6S?C`E}L`nN5{u%z08(J}OSm4$XaGJ3LyzhpbgiVOCy|-NFG(JLVGkoD{
zV3t=|j<aFfG{vukFY8&Syefjn1V6sudbY}+EK{y{Y`Tpr;6{@N_lM}gE;a=ag9*Cr
zmE6^hvV&u?->towm6!XXBTOs#)tYAaH}<z^lRR#!lqc%kpT$E4QDV-KHRsq0=2!+@
z{UBH0@ZhRCOi>>(<NT@*3+`m!-;P0U%}J9n4w!r4h;-wBw5vP7R0}I@XN#Aj;;y0p
zWh<Zih4ojoSb_qw%y?a1u!n?pX8qna-mITnrsq7D>pYjpzX?LA`D#=!wU1lO_Dh1K
zezf)0jnOj?ee_>YhV`LL>JK!igFi83o=Xbl>*&P>c9FHmBV~_+wz{%0pUnP?8htc3
zubuyEG#Xje2M+yi>=kbo3^=b=!-5O8d!6@CX5*m_@6P!3QAu;20d~qYeX%d1FieOT
z9f1tAp_}79{7&chxUwM`YFIUjM@{83^rpObdh2Z+2i=~qE+c$3LwO*OTsiXwBu}An
zX}1(AK1D6iR5L>eQ2qZ}bS3oB@_#p*ih6&mA-3I|6zwD9q~7w)Ouxn7sK>HF+p@}H
zxVw+l<%EC$w&Cv)P2-3TEb!$wj&~SyWsxsu+>P?uTWK};QK(Pu(jDvOSST~`@;R$f
zI^H(_v*(oY`$kEdc@tV!M{B4>sAi0K*z}Z}>rdX{gEZtuND9)_3%!Vofg4(}F<EKZ
zkBxGj-Zj-iBdR$6B+usYT;oRnncX7A56|sJK%oKj^+@7b{rf(6Udk9L5jI<IsHWaH
z@HZ8&w5;TIYnXBu6#k~uLapv%a3t9EZNs&3jEL<Xwof?H;y%9CqbT*)z4cPc)S`n*
zJT1@{A}ntMy~3txNw6mX@5wdS^Ne;cnPZ}#NB`So*uoDyosv$Z4CR8Zq>$S@YvZ`W
zck}4{LmkctvDrevo+Hpqbd+JS8vi%?MJ&l&c+40SX$$-_ChIGr6=hD(=i~R}oQGRl
zCOAcw$<+Hbe9O@3@2=Qqq3S+N<hYN#rgjlkY}KgRzRG!@ay@~IITx2jFYgd|sc25r
zZl%`Fh?A*I!DiCeWqB!Am^c@ubjk0gxAH0?D>zWV*rj{oP0?^mk#$06{7P+58{JY{
zl(+xylfcL?2%KLZOAlvKtv~hoxhb!Hswk=hAaIDSbQ}5%l11JO0)>}@?udAROa4*_
z_AYO`^)d%cyg63|1f2Mb5+5LvD6oU3y2-ddE-LYCL*n?Gar6>&D5!S~-AlxEN1@?w
z%&7_<C$-W;%OAXyetpjseikF7%?z&1#FXak=sy}Jen{kjNp5651ZK<F)r&PWU5|lI
z_=^3G3W0mFx|m=I2KZl*AwzVUEH51IdK?|k4WeMnwTv$GkWj#4IzHg2?&%;>*gX6f
zm$Z;HIp5kxQDpUchQQhwI5cWIFjGHx-~;&A#olXt+UoQz`iQSCvhfK?mKG42@`xzA
z{!u~klF>3CY<D8sZ}eJ)ksnS{ulhRC3lq}SJplRTkzc3H0_*ou1<yQ*Qz+eE??9Oy
zSs@Hw4!$i}C##rWFD@aVJNh3~!FsA#lMD4K69lw|23^qiyo&Ko&x}6L<Mj1Dw3oi3
zX5uYzlDrZgsF^aWVXV=F#$ynmyc@N?ybJB+i9f*5!4H7Z5%yFEQR43<_TBLyrA6Xq
z@jRe>zccz1`v@76?yHQ37pV$5de7PpJ<sY;ZX+*bfU6S+c5pw_7TsFN9Q=q1dvnJ(
zoyh4l-5<@bK0$AnzOCf0!gMOf1zUUGJS2_gPoT4MY8ayEv{LcJvo!TBWk2kOyo#8S
zUI<%dT4l=)^eO<(aRc`KpbF(KdcBmzOZ?R?NT8DHo%0#O_D)I+_X(^aj_h8gW9Gzv
z8$nGKyidLpj5oe-&{oQ_sl#i#G#C1)WzoXAd;96o@it@})={LWg%M2s2Ps3(Z!X;K
zL>{+f%?L3~bEH<f@ebvX0H&U9d;WbfL9SgbcUwbg+U(rfd)Nj_>J+`^4dK|W5q(W^
z%|1YK^w>@rCLCcOZZU!s8Bev$2tjCF95<lWwWq+HDfKwBw_?W<vTeuLnpSU)<_JHt
z;zY0o8UOVo`>8yegYs$gmaP6p$N88!`eY(EeLVuZkCnqfQH#WZ`W>z+n^AC9xRm-h
z@h&Q&o%+N1gC}v93Ji3M;BkW2v%7+7Ri(4{<OKq}X?LOU!t@*BAd%K#QtVZDsb3KO
zbBHI@WZLXjf?|&%Ws2f}-9Er^np_#zOyLE6v#_!wy54>$?=RNF&`-g0+-;uop-=Y9
z_HI$e*|)RaJQ)!CXhzZ1|MqR3+m8@Xn1O`z_g4q^)utdaU?ChWio);=uU86qFR^*o
zhl;o}v?WjQd!c`K0Tr8ZAw7Cdo3)M}TTQ}uJj6N8G24S<@~x+Ol()B6rWW5QiQMP_
zUo{~dNwjsTa!;OYL%KQrLxk{-qPhCY;^%fxN(8cXaRd@Y|JhjlGdsWp!O-Z0N*?Dw
zF4sBash(EpKZ`oW7eXn_bv8t^%C1^W?>TU9$I&Ep<%!&<54RNJ=QXsUznav;v1>x2
z>$nNa56wGO4!aP*0#jSSZ=%7;AIm2&L#71M;mB!4CurTLFy(NV{@?vk@9vW=7YLAH
z-3^fuqxSng#vQV{$v>h$l3L+|M&e7=UUpL8rNp#<!5XY?I#5AyR2bFG#!`9V3Iv*;
z2~YezHwk!aaE@(LF7Gj#X<j`M_?HUVpAc&YSx28*uBU;XAy{2((8j4x4zCmMf}L)j
z!S!`gVBmpkSK)SPn#*E1r)LO;krwmTST~(8^|$2+f&DdvMZKB&yuuqMJ{G)$zRI@9
z^1)mYyXC1YXL+Nydy;%2as{-3kN)1%x1BSul~)BbnTAK%c|5^gk4Ab!k}5lNxqG|Y
zm#YTuv5|EOl&pP&_42?eOs9$$S0n`j97~TP@-Nc(1qien>8_N1o^?xF%nh6xI3d@1
zP=pL?VO4D{oYl4?6?CAWnEnv9EyuduiL31<lT0nE#i^q@5a~m6tY@<F@FZ_j_EF~z
z0YW)hKW?&c!Z*ew8S)H{qcLUq8b^eu4&*I63k1(ErsESqLO3tu`r~~-so@DD&JSI4
z38=Cmi_$CSjOkWRiW6V1_L#d3R}dBm(WY{4h(AT93*Xlex@amWRWk^hNSOU)oKoq^
zDq44-uC46>QwGOk<EIi##>{H&#K&+vRsX14a&xup2&v8Fsp@y<+X!AH-`$dmf5T-h
zxvG<jCWb?#AImvV5AfG%Hjs3i;X}_#JXXpVynK9s3{T@X=J9r~>IY;i2-LdgR_{gs
z$t2ak5D2R4fy~y{4kArnZ-Ka?k>hnlKXu)@K{HUl4~ho_roZ_-a<4;6*)K<C8N9*X
zk2IHX|BmYCP*{B{CZkcK%iev8w*vl_9aN)w@ruYzP6JDN?5ESV6ootho(E-xe_x9!
z#ab-vQ-Cz1IgwT^Mc%=-_jLt>S!s(ZEdmmW=k@PPzgXycwy*F@VYXheh+3v9FB4h&
zXezOeLt$r`k28VSGVX_bDe+4N?dL1XN+p$oAM4tqNG96DdW(8@YTnv4;_?$Jm?Iq!
z@;2-sH6`Rd78}LFBHCFymE2GS#H&ijXm13jBm`#5IB?`L|I)|Y^8++&oYjQSpLm=1
z5HrEJxQ^N&qlBwo6nW<vaAif9hPuI~#u5%MU60NT2JbX$s*4ZTFV$^u4UymExs?1l
zBWasQ^VV+kb7tACIqs^w__v+N6mBl)Hc;B&y^b0}n^@Z>VFDE6sNlNuizvo*@Zb`)
z5`HO$#bD`cYe1yJ0vN1(%hNN#WpM2IN#Z;tt>$|@gPJ;jFco51HPvr1e24kuNg!r-
z*cHVY;H3B%9WpS5H1O|sN=<PgbC~W8oHFt@J@8h@OX>b8@dnFc_#L223(d<9s%kFS
z>51-wLqpxNGI~!-6aqvuU$ahgns({_OGZOZFHBjXC+{oGXE!$r;cvy`|Em~|dlPmX
zsB`sMELC72VpxTmZz^CA;~`7qF*H&FrVOSV?V!!eUf=ME)F8T~9vE(IrV<K_K*OMC
zMKjn=lqQcr_|H&rGw9-TnhgXZm<;l!-V>5h<t}uHV;ZCsKzGA+<n=BD4mfRlmqy3}
z1JO74EmVWPY4@ef#Cgj&i%|q~<NVmkZNSC0*Jn4N_gVd$SJX@<@$bt(zoyp*a2DE;
zZ}__gx+AZ>v&-ACoG_YSbE8hYEeQyYl)qDOB~?f8Y5magKTMd}d+pQttIJ9XhE;}v
z)zl{gg4*zqkbR6zE0On;)XB|9n1zZH-1q4<-{Nc?9xLoV_V)fpYs94mxHbfIMhN^M
zlRWg<GO<R=h^IP8H-79~eBu0!uXVdk{_E{8<NZxEe+h}Zwk0X;L8Q34<1+Ety?(#d
zo7v#!r4;xfFZn+8lvA>~f%a;Y+G!KPC0g~=$17WWytG7d^rmtwmxmQ8eYkw_RP{7`
zi{s4O8Q-c314qV|I#>K0(h!oDCuV|`QPZi!>r0vIYPK4hMmq;@H@I{YB|p4FkrV<6
zO2iZ|l;r-*$0XbMFpC!ru4N-*(E6$-R3jbGMdx#);fL1fk*23G`rD$@!^+DYabP(e
z-r^5Ipi}km_JT<&5NQ)tl&bF4%xcH3C_JCBcYLZzQA7%6$+-xq%NO@4Q$>FEDgD<e
zyjf4jn*LSTRfN>V&WOSvI^YmzT#<+7GWZO*x(!V#!~He-tlmwnsj*JABhc*GP06`j
z>>A^9=vPpilg=6|`T-?pER*|c`&x>K9Nn-7MKAWlwGKsPp8y^ayDde}NXGDub8u%X
z0gw0uy&-ErrWGuzKxJ}LFffO1Zej#gK7Dxcx!0kY+BaMTsbf9(5`M6glot~V3&z(X
za{+YC-O6%%3w~sXW`>tuEFm=;BTD4Rpm9XL9JKuj#=I>joZc(A$*EhZ=QVNH+b-0m
zm6guI*-QAc2F>NlZ~LO4=W@Fb%`!4e#8$8tS5|#z;G5-Gd0=iWhgTAvjLZUY!tLjT
za~|~Hj`bf!K0K<0=bz9j#Z~RBaaf+ziN}z7Ronf0PNyq)@_Z}IqqsXCaJ&>k@7g8c
zn#GgfVw-gt$6~mlTx*^vRyJ`UWdeQVV9E)IndVZ@u0Sq8vK%8gJfVQ@_E3ldAR&$S
zpuVmNsbQ*eCJqj9G77p#b-nlKFO$@SymTS0Q0i!EX{U!f7X1z<nwziAXQVFkK2N$t
zmWiDVFX9I874^NpM{3%*m~ib<WXR-TsiiJNfslT}H&=eejTBmRtjp&QoO(S-8P`Xa
zyV%=>Q5Zr*1Ic14v+mn<O*DUqXKOe1na49*1K%h}i*(tpWC<wb7H3Tp2}f(qZ<kh(
znB5+BvuzTq<TOXU+45T~I*1I0dU~D3ZT@OO^@%Gs4c?x(9p4Uo-ywMt%W%Weuxm~#
z9#3cpI*u*6(-DtbinZ>`evd66BA2=tO22(TvMTCLfR_Fa(5a(htQg?8iiajX0a98>
zM<hiqs`|4qIeRH*vBW9w!hcXy9Me5>{voe@W6&(2F5!-oF6~_TfDM6yYbY=#8Y57S
zuJ~{bWVjH;v`2Z?rOAZ^hUzxW-&TVw_9OeCEWf?``Yd2}0ON;J6~$Q#i`MM4n(COS
z(6Z3?>*f>rZw_g=+@jBzttt6YR7Vr|`8kYU&Pb!bADC-(gkJGWP1eUqeqrGU@uu!>
zH;ixR4f+Xtv`f;>)!vPh;KH1(<0TZ`l;8QIL~_!4TnVF}W}7p;Sd(t&s7pxj%K8nk
z&p}X8Z~t}c$RXOu(+X2MBPNub_D<-ah9dG#4I)%D6Y^YyUg_BmSn>1ws&-BEy<N0E
zcJ}LMEy5pwyG&nw7^3+J85jjMm{YkQ%m;6!7f(MyDTt=E$TP%rEx)Y3TeSPlg%i+K
zddM+u3`hmV*bnaAs{SP!J&B;L$QibX&1j;r8;Hx=!Rofu>j<uQ&VWNzTd_Yc7NsCd
z>)cv<jjmBT>6HB^ec`F0A(V(Y#vx<D6pN_&5TAOL@3)*i>EU49DnBZpE%!iSw#m^0
zG;K1QH~g^-CNz*YH18Dx`r#6Dcic4=R>_02Jjf$65GRmaRGnI|qQB3__FPw(A0`z9
zvIq_?GOgF4ews9n)|39YMWva;LJKJ>1>;hda@YF%7QY?!Cxgd}%9<r)naXo{K(7>Y
z5Kf4KG5V6_oIR_fB4MeJ7?C`4**q|=U|at~;2YbtVUvB40&1jQ>d{(${?B#0{L!2C
z27T`sZOQb|SdN<0{yuKQw3oV*UU-1}<0~=FPW#&I5_`wt6nnWhwa><x{1%N@kcduI
zB0G$qOwfiX9Cpv`vjz^1VEYt!gT5NBSo#4iTE&<;aNwWF3Ko`7h%!AMYNo|xQFiYu
zawilX-7)nc#{NMJd6GkK)u8QNd_cgY5{EY|=#{tu=09ywgbSKaY>>Xxs}&Ms8|Pc%
z&e0ime^SO`%Mq&G#~djCv{_Vv8&`iiHT5oTYd}l?yat-QtLrnW9GKk-;_1lEaIzpd
zT!7_P{tcXs6dC7DE_~<0?@_=Xj_DfQsw`ahNglYwA5!^9mfJdr!28+8X=;K{Yj8%`
za_q!&GUuLjz^436<OOYP?DDPT>EPwei`p!Xv~@2htKzh=Y|v5?o`lISZ`x;pm}ZJU
zP=l_ez<~EZ^j9c?X&M&-7k(fq-BcSF|0J`_yv_rA5~rc|l3QoU?Pgd4KMQq-?Az;$
zH6f;w2iF#byL5=Io;QV6J!AYKjWhja4X90tm4YmY%Zirm-)#L57e=MPA!{F@9PoG)
zrJSB2Fs=;E!j$(&2aQST90p+lr_bfI`jPg^96l!Gsm)v|cwyj~a=YB!z0l}ik(^PX
z3Ne%L*h!^MB)r9irJmL_{?R%3&Dry+DVlD(2U1%JV#`~f1PX^wx4K>JGxu6m3yzCd
z^#Bb9v$wxy-Zl)z8e9mw7GYl5^-F$ZJ#oF-^cTeW>*iuL!riM*h5YovZG_7ZrOTFf
zD$hY}(rF+`h@0FhRl(GTRn%2r%a1eaAKh?J5YTir;_oiKL!&Q7HPaJ#lO_fciLu8I
z1l2*R&^&s>l;WM)`-cH~*tslcbDF|1I=xF-{)WTw8oO0uJg><Ifmby|QZDC#(~$t{
zFIKqt0V<1_W1rtak$9@y(umGtX<6^HlAt`ssQgGeer`3YMs*uIZ@Qcji$T4{U~aix
z?Bls<=0vSMKUlLVFq5yDs<e0XTJXY!ZAuRm`^R=ax7;M?08b;8-9EUa3|AjUG^N!L
zP?c{eDnWo&MCXT`l)G?{BE7i(|LVHWm%%mgcGpvz|Ly4+@9S<?U(WMV&Q|ryQT3US
z|E18~#OuApj{kG@Yl#0{n1A=i>+^=`M7G$fp9(4}s+Fy+3>-jLh@<WA@V-6U>_ILp
zE@pi52CKin-^$ur3jQ7v5>jp{{i}CaO%AD;dxl~{LUQCu^skBUKa!z#UbsqQ7?K~I
zX}dJP-xdp|&^ZuEEiU}B&d(OFp1{dteM6E~xqi6)NnYLtvz)RGxb&P*r7hyY52dIx
z8j*cY{^$jHRwBC2QJRiYM1h9_UK8E46tW&Q!JEJvu21VYE>Bf`7JYX?KC@<|TfN6h
zX8TtG3Sc|c1rJj;=V{x?4H<f2u7IArWx+z<(%qYov05NfeakurvHy^iv>mH6)`L`+
zOv1B1it^Pzs&Z=udAoOs>tr*V#u3P^hp}KYKX!S8H7?7D1jHFN1OCq%lpuL)ZC2EI
zA_?m(eihh-1;0tXujqHyKhC?PKVqCF`|0#$mA_$JL>|1?D;HreMRws6JFCUuaO8`}
z*Nz_W(qi51!FI%#9KGeu<@-raXJ|ed)s85}eQCv0nNMa!hTh4ATWwCh<j9|pxf~6q
zT&Q_aX^P9+lo4F-8kLe#kzhq<pYU@+6T4$NX1>v8FOQQv*2%pA4G!7KM=yv6wl|4*
zyjD?mjQMDm{K#+5WJ?7V2y2Wn4S6L6x%2WRB&~%dkkVpGe9tX(BGlkgnV_U};XME6
z$x~jj*DU5x(C|FukrsGI*1|qY(PuovjJb`e_5~D`_K!u=mt78g17J-Jj2p*MB0K{|
zMQ8QLc)W^cJ>&rz==NKDHS9#_Tuw%r0F@p_0e4odv8R-iYr=64v(9Ekt|rY{J-CRh
z{imajveK?-b<^kveiX7cPYS<;DxJi;7O_dI?QzY|L&D=e$$XZ6gCojLQ)E7mr*JHv
zK%)_ze&GpZ8{a`OY!9W){B}MNqwVUb{_qi#ik%(WWB{1PA_J||1`pqvm@)q{jlWp_
znm8my{><WJJ66^ISgORSQEExy@mNPJfbw~i<Fa`YfWGoZa0(bU-4x>S$V^ifkwtFe
z-O;SeYY`muSA?mCmrfRK_i|4cH`2MJ1=v^}r7M3jYAg526=&IY9?1H3v1k02#9hOK
z)r4+8kKGiT={v7wO+og!P*wiBJS0fm^f^y4wE(J%)o+`=uzk0K@}=&f!H;HgBzatx
zXiRo=x@%}XFd$zxS$^V!@%K(ecxKNh{cU(+9un6_c)|qT3rIu+!`9aJX-}xD$Nxd~
z72|bF;t3u1&&ycXz0h4$*B#bVl>a%eaH(lxQWC0TCheX7B>qhpJ<?AjWLRhU*lu_Z
zGXk&r#{js`9feo@zetZl{6>S%fJb;_$p2`J)>a9U9Is%MZ+}+<JG{-slScp1#7}+e
zUfCAm;s+$f4<?iQL>#2(D6GC!pZGP#xm^sG(iiz)b)`{@^~YF$7wd_<XGaNsh>ZO$
zTDD+OpGDeU=z|jyrT2-<y3*eZRRWp6%B>PhEvl9q(5oMZ=X^{QkcAKceJ%1kV;)L9
zkyPW1dZOHA$T>OX`V!Df%Nc7-i#O#gyJT5{YpOrZVs5AO^(?4{2mP#8w4q60hMVHx
zAvkI%y8e;)1Ie^iKYxPF%~5@QeLZgf(PU<3p2fZ1#d+MF<pJkQg8KI_mp%h~K;q)K
z{{H??*G8`bFE@^_q>dY%yD-%p@#nBwYKZ-hBd$8;Gi_4a72b_O`P}PADDd6jUz*1`
zdOI|o?EV4XfSQ<oYlj@_6%7`O?o`<x+sNhKr)c#y;SI3Tm2U#K#&;BBB?&s1U@9Kp
zOYml!?0+h%M+6+I$$@WBEAR?Mf}vKoDxvx~BiWSD?75RZnrLOC-=bf(9~Nv<yo)+Q
z*w2j7%p4(ktcnJI<)uf5x{*5J{y7ow|K^tbC*A&c5hC-z=LPvk?ElIhU>>0Eg%~be
zJq`~I1%!m43T0fMzCL&DTl`#1lxge(a&zODnwr8EbLg-aKPf8aRaK3Td0AUoIgL>E
z$DIm});4kl6d6H&)4`t#p18iqw4LN8i*fE3tCPWcq~SEmk0fAfS3SY|J45m~hZ@Fi
zXOGrUUA=X1UV=n)HhK;pGQuAy2ZZ5L_;@&uRXalokK|ieHzvNk!63yL)7>fHhHW7B
z_z_9bJ$AP&ee`fKRv^)1!`ba?Gcup|E#{NO--N*YVg_8pXc%*x$cN%)c%Z{TV2HRZ
z>H&=XjM9T2#or~dTTzqoe;RGRa6$aPLt5d30~`u5WKc>3)QQ81Vd(!C-%=*EDEOav
z_J3Xx@MM?&s>J_)&b;c=+qvA>xVe#xjEroadssO-?%$YocwJ-m^z=|uXNkDTr<y#1
zfWYoUJzOo)H*A7}r2e<={$UcYml9!NVd$-`t-&B>x(#IT=w`p!uEvn<JEo>6G(w}x
zrE4141K%1`ZL^OAX~Cr;iieU<^xOTd`LbTX)#c#fdyv&(PA;cUi&ACPWI#2oyQ-0b
zA%r2@F#ng7)ET5Ppd5;p+0GPiu%X!1fTADm5gs~^DJo8c`<h$ek!7Ix+{Bm~VQO)B
zU%>u)hC;yb0uc7V<|T{-j*V9H?+?S{z8Zq!#xpIOJsv42ZK5EjW<Vrlrg(j6WPXdu
zpzYeR(Xv~f?JqVw)7gf(mu%`&{3=0>tnI$|5y+i>;leINMKNo}v6;1eQOmP!H8TqV
z>B$&KFo!(*=!a}wDeB7p;}JIeKl@RpDW?Uk4RJgSE?<@K<<A-g#lq8nSpx8G6x1d;
z3V+O++MDCX9NrpNS7Us^VY&-3l)<XEYJ4}bOXePOae3WS8`Y#fH_PJWr!?7*9ayR2
zR<JoI5R7uicrlKpxhvnRyG9^lj{+y~8S5>`3BoN!+*Y}k_VMQfGz^OYF+B9-tanTY
zy^I+jkNdNX-!vP3EcDA{HD)B=Q8lh)MQ)l1W#}HHOL3IT`&mLqg_T5Y_H$;VXo~bt
zS97RL;5tB9_U{PyAd;eD?g0IXc_~F@uY>7V0GPTv<}G8^!*f6!87`ej*vYgF*I2Zv
z48Uac_l1uAyMNhYvI{UQsljoEuKd`bwwQZ$Y_cv`(IuJs=fs$OOFY=d0v(<qi;0g}
z_yzrcDP8{`k5jV|l4?HC3FFF)Dh%VsiB0<r`FQSEwdhw_wj3u+;YZ-eAKENt=wCXX
zPT@0#%ja)%&CW?(0DR)a7hFR}3IYEq5irR$z*k^&`bZd<%nUFsJ`IZ;aoSrH_>;ox
zQoO<fTPS{)cCdWI#c--i$X6exe#?O6xY1-9IsNiBSiPfdL5=X5Txz`saE2Ku@q2;^
zu%+;ifyp-bBG-MU8WC(i+c_^+xZV-Nl;R8;vgl*(Stw?fN@@OI*Z&GiLHchc!GlsN
zB~SpSlf4!df+>Jc?^H5{dwM4QA01y~R&q#4NkiXgS8d*3?w6LA!zL&3Ny)68Uik5}
zUQSN9#<RtuUhn8$nS}HP0%AjakIyym<(UI^Uq0!JdE%o(4=DC5a8Oy`L67M4!b5Zl
zD&oBe=qf8SzHxAu9h(HWk~c;Dh8}@ZFwbfSgBx@Fie5sDOsoI}#VB>mM3FKjEON8f
z5s!MJW6$oc)-?Yu=C@Wvt1T_ds)EBc604K%y%7hD7F6-Ea^J;7khqWGN#YtqN=&$m
z2e4b(OBWVlc`8M99sQVl7Oi<QdTgIrQ9O8>Fe}es3gm|N&_4VZmEYtqk-!(-qmm-T
z)yug)hY==em!~%$I)2fWYvq;F(W`+6rG@h2M5HDT$={Xe6p^WWumB#BY57-zW`iNj
z+1H^42liKR6~2<kIAkHHncrdZwgny#Zq6mx6;xZy!!tmNbyO=D**sG<=_DEjD)+zt
ziQjy;3O2N1?*bJXo`on+x?M%%Z*omQy08DWqq~an82bdqm0gqo=j&ya4EYr${~iox
z%setM?F2w^x0J~1<A+4TS)G!EiRJ_9#aSnTE`2?l$N&uNZaBpvoJP^p^U8<DmNwT-
zQEnrkB4XPs{)EVCvDncb&~Iq*&4{YX(xm1??mRIOqP_C_c3#_p%h@+kGDH6Om|x7x
zRk1n_%5vlwqU}4Yqr@;Y+Ke@)9do2smtFBb(a{737U7BCOwrpG<HYq+Z~6WsS^HFJ
zxmOE{$CAJ?pl(TuycVGKBIK1+)}<hb`&{!&)=iIAdca($HCxK+Z%NNYrjxu9oQH@&
z_;2FbwZVJK%7dpQu+)gF&_WMc{SV!e61P<G<foPq7bdtFC0?Y!X;9qxi@-xCqQww2
ztyHKHR~CdLyZ>;vde1RVw^(vPp~Q_{4bHdCelH<)xUbNp=VXQ^W`V8+T!zQ-@rYZ5
zF7%W<v3-IU^M<*%OgTrOC9$wAl}M&U!$ciAu4o@lcjth)jJYVZb1@&Ko1dn|jtS%3
z#)*;<6fdcVM#ZPlr;@ZT;IJvtuhjF{mOO!IcOK(rdt9b06ksJaQ~=GGs9_AyAke*q
zP6t|QgY}T{mxB~{V;d$+OU-FbQJ69>Eg^Ty-^qi|y;9D%GU>3zs`JVq2~~(#1)`5-
zbj$bTcImxpD|{&%*dbU5b~pt;vB;T(O~#YZGxk8Mt;4%rsOH3u>CYsA+{wv3)4+Z@
zEB$U^MB<So#6|smlz-I10hg*PEk%hgnttOA{AVJ`;Zhdy1ui7LF_)V2b+UkrycZAm
zQL<P>Uf}3UPyB;(#M=!}NL%N44W3U3?Ot@6WHiOxrkk4B(f*Y7dj-!bfTR=AG@ub)
z3SijGAY`5XEb6p3BqE>4b)Ql?h9`l%lNx)*c=&oqONg|<jJRwz!iQ$Vu8gxrr2IW}
z+p$Lr3z214;=}#5=0tvz7eT>yhkQ>NfZm&f*AENX0XBtx1Y%!Y4yq0Eo`i&hs0e!$
zHBGu%;A|WdM&N&91DvXymtYCDht9)bNJmFUPUqWl>>M0hU9Y#V<GP$rBVA95%`GjE
z(@OvHpt16n=4L1J*Z-<q0x~i-(aYySA-E5F)sA*V*)iAtBxqP2v2(ICgVqL~)*jX<
zL%!Rlk{|d@MunP(<~sCYeQmKt5s}nEA$~>@Z;E#o9<tiwbFyI>{78XKn(BG;<!V<v
zI3||2d~m7T3pK`(w|nsf#p_-ZH^Z&KwW5IK>^pz=SfN*y@<_o?4?15O#KzG0rE{h~
zb5{i4?gixcmh8xX+@b<1d<fCrS6`BUHLkbOTpz%+$Vl3<$qiwXyZWq4(PytJ=ArKy
zHrL>07yYAK(U49^TvNjf4d_B_iSZPwV@0vZ@WPaVktMa~=`Z}a-cP(1ckCN-)}S@`
zGJ_YNmK}Wc2Sp{#`uETTXAiMIQcH?YuI*Ob0|Oc+bT`6|)xk7qxedhPI`5O^GT%OB
zq%>KEyHDhvkd_{PRd`$IzPjH&Dy=jg!|-ZDPrX)cnwi$QkCn`%qBRKnxF!XJr?8F?
zpz?#asz=I{UF~%Yng#Lb?-PY8eHlTb3a8gk-oRCR<@;%@6jke`(fMiOeMN_yFT!5l
zNBD>KfXAp)4lG*Bui5tmdaP<#wX@y#?j-sW{!kz#98BCSE)cKmh-2V5r{N>qj=y2R
zJ;XR48vmeRiD!^;kN90e0?X9g^FX(GQ&twmVM8?RneymNgeIoH$l8@n7S`8C>&a~g
zlng4r2h9#p!yM|7t&T{rC5!MIIsPa6>s)&As+&*>D^PU<sqR!(a&3>AatWb5YE}kM
z9K*U(0Xx`c=bxmE77_Y{Jd=nxNrJfGV#!fp<~wmOjcjSfFBn=XTON0BQ6r`%j7u2s
zE^AWAEs+1#nim?1AZZ*Uh<YZ(MB}x1I45^fwe8sVpzQbB7IzSpP+#YQT>v0nzO$Qu
z0tX{+x?gQD<T<BvW$?cVG@{G=Ks^%_l<rRRxSFnq2Ij(Bf%Bw;TJdh&)Xu{L!tPA8
zWwodHCI#pu$1YY5)ZHvbE<>CdTYvhsKPa(F>B({9zF&bSHTg1kjL1D4y9;k0B2)wn
z8o$v^mQOj`ik5hLwF;5oq~SPU@^I#%w!th8|4lnM4WuKfg*btxgZ1uA|NQwDxF8gF
zn-FGfMHP9FYFF4b1}m5e%eCB#!@Ji=EwQ{=ptlQ^EU9QFP4WGkYfchPRy{JQ=vEfh
zhUcbBf|SelA#$v{fPXNTry5$b@&lzBh47jiAn+xivYY@KE7sqZV%<!AfXUMF>|q29
zL*;DZy`<q%qB&#DiSs-fY00J##k&m7ZxyRrQ<jI#>^se9hveNdUH#%^+OlKM#2YaE
zK9*ja248kckK{bw?{*g92DaqN6MJ#K#P=8`7^$5IV8Qj<Nu92M9yG**hW!+#(REyO
zUeZZlrCX0%OulMaNkb_r1xC|^Ge(jHnWx;E2?Qa-Mi;*xRx1SOsU`AAG((RwdgOCe
zL#9a>Lb*J8f?j8INMp!feEIas<3ScjZ5<DNX?<6o#DXNq`~(de?!LObwMD6N3;b~i
zGGmxz4$NvTOW~a!h+dj;SaEt~V%^4IjLbhb(o$oT1PRpyuP4Z`zsmF#TVbmv(Ar|<
z<8Y&Ra;N_yj6O(j{^upekc+>zmC`ZQ_<z{?%c!=$sDBg23GVLh5Q@9CNby2(cZ$2a
zJG2ycD^>_DMS~U%9*P$&?k<zx{oMa&X4aY)d6%rk;w$Hzy+8Z9#Qgp3A#$lhHm!px
zB_;IFH6b_k=k;$lz0u#l6V;jaCdbFe^GpT4c!>8nsFPwrGly5wGIiq{vi%-kkB-+$
z@UCvNK}pE`%#wr480rvlVEl(yahm`RSEvj@fshs;(H@S6t&j`AH`sm6Jf;gU_rozS
zwuzZ&)vT@MD*g9DWcLcfc_lF|b@>|8Q7pQ8-4>O-@fq`SDO=xE{Fgs^3PF5-ZuSs<
z2>E2yQgNAe%AhEWktH062L4hIV_BHTj=hmM0>FCx5istyI7zBgoWk3r;<TN|an%3f
z-nA)dU@Gl5!OL2cv;9Gbi+HaBXjJ&|%+VMcwLY*zAHhuBIQ7&w`@k<cY+IGBHQG%u
zSnii<6y1@HrqWEZRTe>Ai!Ig9Df2k&${U#Ewdr-p>#v|-KLLqk89AmarAVy%hel|0
z6Vvg++njs}YE{{wp^S`=M>`E>9bTO$WoDDwvl*tpmaKRP<n*xx8!J%AkeHbJT11X<
z3=>Ha94{Z;+cP_QBVZ6jY-+ulMu7Ta$n-X`ES){!uC^oo12&1^ATYlfX6exa^6f{y
z0UhiNQA%P_eq!*SyD0v`;KPC$b@J3s3I`OYj7h5xHg~qIRFZH)moyU%Q74MOc;j+;
zPJ^;LVf9{R0z35%S?T)tZz+Fy1;s;`dp?R|x5gwp35&8YH_WG@xNv=-?97!80xI4a
z5m~4QnBU>NJ5LCVV}ji+j8UMIN3BSppa-AMM)V+5n{lXodzg-gmF$7;@q_64T%VX&
zDFMO2ifvwx!f~6xoCdm~h|~Mknm_J~6JXsc$q6$4T(r5i>krgek69bsHab1*d+*Y{
zz#4K9hy4>I5N$$(=WojcPL&yH%NY9le!}-dW|5aF$=7{qa{&HXv;65vZB5B<*G2{9
zlB}vx#nJBwiHJaQ@`$zti<TyOI7(hN7URUIe5SIW=SbTKP?kMxIRcX|ji^Zb_0_cy
zh8WK)d&UPmVzKYSCz6egB=o6#_)Pg48&kh6jr{akGx}w-@^lUp+uyhQ_0KGl+4z$~
z8?=aHsCAS*7gzIektg%he;k{PY6OS3j!S#j)8EGQ%1TAhT$IPt;||+^VZ#6g-fRG7
zNgv1uIDXyFNEks{?<LQM5pD=_yDcg%0_H5togGtrhHA2$9A!Wa)Z9JCe<{V)@!BV_
zY8hTDDO9>xX&xoBZs2un)O>S$V?Q9Yjj=2h)i_5(#U%~przR75=k7S>>$0PrBMt4g
zHh+Gs&UAe+XIc1}@<1Vm#PGCoP~k8M!-|&ROG9G-rlbZ@bUCyc*##kTAsgcUQF7eQ
z0FnI29<?HlEdiAq6}<0~F@9s;$o`l$x$UOZ^}lC8BATR76eED+8sV#~vD}WtN+htF
z^qkxZ%jGk|>DsknrAd&6I_|UMPt!y_C+EwKe+xh2XwoHqy0zaNO>&2Q`+}Sq&*vX`
zpmETq*$Jj{kTEP>vQL;6KO=}@{sELJFg!^jv0A&r7}dhk6Z5?lkGiK2p+1Uhi7xB$
z>;E1J>7kGRy9wh71HIh}y_v55dILyGzFsFkC_LxBt@LhTnpoM|Vr)o;7>wMJ@7?Fy
zIibz1EwHlI42u``C7%@j(JPm+$NA_!oBA~?G_ebPg1cdvV6QAkq$Yzg+}__U{fBL-
zW#|cwW$LI+=RK)Cm)sZGcR7y=ko&E7iQ3PaLgJAre)fvvV<Qm4TqXuz^P4S75gv>7
za{Of_H0@ya>fC?j(x|%8?=>IND-P{h6Y~bpsGl^`(qfzQ@KvTjWV~ZOab`&-=O^W4
zm39Y%q7iLOHaDq<?GtjkUeuo?yX2gmMQn)gDT~||@$~be-1v!pXc@nok&<LPC?!Hj
z_{v!p6ssT_c0rhe!jc;R&MMs@+M{T~)>k@9&B==9_J8vT_;VmmJPi5tHQMTn;l?Pb
z3}ej*lIX{GX}6Nt|3qL;ao|=4vHP$v>)EdUgr^Rz#1>aPyPf#E_2|ZCNAmGRtpYy1
z;!Gv|M=|ZTTh|P<HW?_GP|yaY3d>VMs!N7^H|=(d>r+*2-m$ET+H7B#2Z$3m+MmHR
zi$O@^L6A!MhEne7QVRkh+nl&kI(TRcy$UBGVx+<jN?*Ut@d_*Qc<w>{yb~`;<$d(o
z<HxE&gSV-Z$?pHMLW;w3D9Z+WW#!$`{T~5&l`bL-l<CR(XbwDTva>6?qbifqAt5;O
z)qH8$hM|7ztb3v#HB!@})6(c_r-8PU3|Wp-3I;aVzLpUP3X}hbPaX0MYq2JN`aOpM
z@##obBX17A?7vZd->bamxGX~>XkO1N+L-*EjlISPQ!|ri(>oAV^ec7$j`CEFeX6Lb
zA;3dGBF|SlDXPk=_EPZR?*#4ZFxG0alg%{6e0MiSOLwcUso?l-uk6L2+4b#-W!uUU
z)b@f-w7OohB6l&oFU5%amNY<lI8mO4DMtU{sg{L)WkZ~PU34Iy((b38t_<u|5jPYx
zdja7yhlbr+Kes?EKiy<$g%OJ777nA;&(#B?BkV@#zako=trPbKWsFw{r`=)q*qhUY
zBcw<ianU_s^Z#fj=;%9>sL?4%*?)(1=dn)>YKV<gZOH$-nU_jxzY;p%@xs{ex^J?M
z!>8rEv7k*1IxS9_;<>|On4LmUD|RD2{vpXSYC>rwbGXX@;lupkhf(fi_aQcp-bl^X
zU0IF<g{|;5IL{r_A2u4OGTY6Ys&w8bLn=cO_Qy3CWx~_b?NEuLe@*m0g5Q_>Ew%|>
zH!X7|f&$(f8p54fqz*7gQoNGDh!r`+S{Xnqvc;-E1K2|GM|h-3bJ3daQe<g{42xPP
zXEz>tysoX7`xK|pr?q|n4OigQ2^f$}IEUU(i|(;b8LePa(|CrpzNmT<a0>MLA$<Of
z+NDA^!nw;QcQJgxv~6z}TcrFQ$x3;}23%29N2Km7qu!6eGizJ9uFY-#Y$;Y3V<Kn4
zj8ls2S$OzmYe&ofe(q)9M-MeueOTtBNmf)hszhNVu1%!FO#bRuB@}Zfv@=)(gYEy%
z;eM101-(6*zEW6h|Fwr?g#GEX!Gw6csz2OEgn|n3Z7VIwFEUpzRyIyIUp3W@euX^4
z!;o_4ZmDJ#FUowL;kz!AaZ6@ZRI#0C;iWF13`PE!-<PbFqo?4ywO>*^h2Y?H&Eb|j
z8~*O((DEm|=Hw>p1jp#(OaleNoXQR6V&uX4xL$j#3+0@Q+B2Xg&kX@HcX+L;5)zP^
z&N1kJ2f2dgE&_xm`fqvSPKO>pzxU(D<Ssf`&=RI#-5#OwkzM12n_d?%k6zc!k4rJ%
zC5^Wr7k8G0j$|$sS5ZXAXAn)*FR3g6*NsymtNuzJLpulz1nGRg&nN50Pun!><tsQi
zxG_NxKZ=D6IwND<D-0Gj1R>86kpX90zze!mdRa(oj2^zhP>SJ#Hpu#mwI!`%t8=Rl
zf)XrysA5kOyxM`mT!*JPK{Y(vC(Mlu1z%`0qnbOW5POKP8EZ%K1t+I&{2~zZsTp`W
zN7SCbf|W_21uYekORoGH1IaW#(lSffENbiWpad+V6x>Kq*i+v-^ukXo)>TObLXdu&
zqCcn?m$Pi7Rim3DQ~~CF8AQx?8dOYhq~CD+1nCmV?hkmlLo*vhy=x3MKd&QXJU+1c
zQe*M(aUDZ17zn+L+-@}S9>uEG2t!JGkWp1zTsIvFr`ioH?y$*7#qt@UqzHTo)AO16
zND34<T|9)G3Ok$CZg9LmlBMO`c#K&@paI6R-tb{~LuX2UI3!05tkuS)M;%i`G@N4*
zzx?1nC6K^Kci~Mo@}P^L;jmeL#1<#q*7%)K+`|=#)a6MNXqmBCgR&A%Fx_36sW^u#
zK-HCRK|BsesJ>rK4q43SIJ9C2UfgdclrEflDw}V2!*n*3VhgpHPR?%>q`z>aI8C~J
zTi+mIK8+n9J<a0ppblkJ*3ygNkdf5*zVhKjE4+Ijxols>GM>)?r+F@Pe#t0h>>01I
zdKe($OQ6u5XWsZmCz=yh490I~H{8-uxnlt+e~c_GCMsZ7q*H;hV_}^pSy)$uP8upj
zLU8k@JtBnxAV7x&-%cE0)1j%Sd~Q#DtUYBOrudoi?<q;+;~p*y(%?*Cx*{0(`u}uR
zdj8#a%R$d{kO+~;F|%4H8`1h*RxYLEfUGJU1t#xvaewa$b&>VFh((k??g%42(YzlG
z(?CLw{mnxv6H{LbitY>j8(d{n$0^F<OqJ%ql5c5I*rqSd*ta!>F_Z!Su3@>Fi{OS6
z8{<c>VFsQ)w1N}~&#{4D6-f{^FuaPZxR7mB2q_GehrY=w?Bv^SpZ&OtUW&A%J+0xp
z(LtNycHpD9=0+moBRZg4i%U`YqQXA0W$j}LZ6XVdN%0MsC#F!?0aE)yvOANO0q1g;
zP+4m_q~}M5-AOI)&P&sjP80Eyt(7tDZ*X}1iN*OKgQ7(dBRh(HVQ!`E1H_LRp<aEf
zOs80n5=D;jR)78@eMGeqS}-hp0z^?)$)n-b<cKYELttx-Nwm)+TQ%GGSKkLjZE7B^
z{oFX6iy!@8-|2t*P1+CE|2I@zAt*?q@f}|Sm<5hDH5EYn3GIVxOV#vkBySw7%>Msw
z#=_nc3fSf$!WKGYOSX#hET;Hx3G!m^84=8Kac{F*WuUq+o?7lE6ZZuf4~hkndkujF
z`CAzge(o~9o)TdiZhH?a0&{CyvO47U=n<{-miJ(LtoSKyEbS4E;NyQbga0p!K?o>F
z<7@x64^J)6+)YT_m5+&qry8(^k!^h%k8iQz-KQ7@p}L~>h{@ZZ7G085y6S6k``2Kf
zj1NWs`7l(?EzKz<TA1vP4u*#5qh4eImakp@4)Ksbi*Z=R)`MpeAh(Y~@wd%C+P$`k
zhHdo=Ok;pLryqUb>+(e-<z!HC$tMUyQz1a{fLyfodtmo-FY+LuF&F_XXcNslmmXbH
zY^yP|Iu!&<vgpE&HZG#DO7OHQl76o`;2VtFKC>H(&xCDkiXXOEk716aY5JA%KZyfu
z+`0$WFiabS^$-7N?{TC~1!EZa*>TnlLN51-sX|UKxNxIeh$ei9XfJ2wnv*A7$1fR&
zo<uB^v4pbhA18sgK~8w%9&>tG*<kt*_@k2jUi#MBuOeJ~O`hZ9djBS)ezb^~Xk%;2
zvEjg6C}SmO^BJGRaq4RQ5U89x=;7&hTjXg6FaJ(Ynk7YfjAJb~4p?^*hkIb~O^ng*
ze(>50O^`~6(kEs{w+*bF)O>B4)63mAkGr(&8>~g+p5z<XPssDIdc77VW_A27v%=nz
z8%DC=6zu=C1c2oN)a=&D{veCKfxeQCbZ$^UJwSi6FItHDIuF!E8INdkRD^34m6F*a
zWEP*^$Gg@L%i7*$S_ka0L^r&5GBzy%hJ&ycO()OHe`l223TaRvZ4TuD>$OZU2;_`%
zh|md04{^aHPilURWEBq$@aHUOkq6HxQCGPHW|nqgG5-Y8X%P9s**`WlNC)xHs9!u)
zbz08Tq^AI48?MHYSUpOS=#(uh+d}}}*gs~ZlyB$&hQ%INmO*-ZN})h@p9XGX8=YIl
zzqO`QbKR;hjl%=dd#a=qD|F=<Ck?ovq~k703SMOYDrgbN$09`h))9aRtx3yxoCK8<
zSYB>UMz(GTlpgQIbZ!Z4eyN`KbZMrtMDUFHSb77LOVjtwP>JQAga>FSy425y;3@j&
zo;6T+SNd;8hOcSizr*!p$cw_J>*d@6`e_{ZFZE$Mgrd%mbjLp!(K-iV_cUzDetNO9
zF+<+&9?!~fJ=LA*V;}xS!n@GR{P0ZD60P)6=%K|EcK@+Q-qcytMvO6PJTk#h<2J9e
z86APJc`)eLK`#W3R$XPrJn5sQ7|`cL{wv<u)=p%z)vv?10xF6KJesg~b+HUoZyO)w
z3rUsg^@FlS>H?+;#1=)X5T5j#Fs%9ms{qZK3DCR<aD4r*?hRq8+v>zh{M1#PBk&s*
zSmZsxUphkqONP_hqe<*?9B`P*hYX=a_aK7($BAe3`FqQg!G50KIW-N&6bK<O`QpC-
z+S)c>JSyY_N|?bWarktCy)bfmwV@%o<ugLMANf7cY*CQ0t9O2pby|?A;lN)o!o4!W
z-0hJ=P2Td&gP)|1&Ju0n>p$GzE__oJ$UzylyW3{Z^&y@z3p?~Wi;*m>lZRtJM1eHg
zC8)alla=&^LMipK&{=V;bw8v0n2&|B<D-bnTyod>q2}HhP!-vnGu#>MLrVs;17f;!
zg6PlJR%_v51w_unU2^^g_yu`laK;Q$grH?k1h%*b4GQSHSX6i$4WYaKggYfg-(U*r
zJ<(KMJ{hAMz;5@{16I@Qr99ETkR#SM%|@Th9N-5{m#n`(y2+Y23ZkV#m!kR*ZvYpm
zFXg~WB;(*aUEwEfw_7Ixti2;w=qG~C)_&jotjKg|0Mw-xB`8IiG|SqH?8CK;Ez+7=
z>CvyTe#%}6#8YB#-z8vdh3-fZZ7CoVbme<TM}~D%-cGiOWc$Xa_)%HL<_jhLOTPK8
z8@935gbx&0B6qy$`^ZGx(aIgZk&UIUMIg?7T6RY7dP^3Gw|Rkjeh^A`%UTI@PEoG2
z^o%rN$Y^LSjYLrHX(gqcPW*zbaUm)fGWZhRVKaSS7;UFOu=Wee`$dtI9;w?-ycZiZ
zMjXrK%%FH6^ZQ8gz@BXL{5uP)la)@5=ml_)>~`Lk<|}?`_9b~{#4QZl%9@jnm-k&?
zMTn{2SQ+gWRc%{NR=hy|QO?AK;tu~(lPrV`#o$r+eUa&>4HO&aj?~bxi9b~8mK(Gj
zHxeb>k$n^McxXh&&zSP#ut=*CnaM~!Jrgf+oBD%{x(xLm_df3^t)n^RoYM!zACK3V
znD|hqLb8=`pfW`lyW=3e%-Az&KQ`7B1~qkbR1j`;C!mNF&|2O<tw;69je4=?#3?D>
zjl^R7Aq&}fgtbj381p9@Nila#BI1vFhTQ>&PM?=z=K93B8GX+qH47s`@LqOUD10-c
zQCLzKm$P`htj;IO^;Ie40Aq|*KV8Ke2FS6BLTEYmarnV&Y)H~IR6+Q-42No(kJL;u
zZO=b7@DF@|_jrH57-fSS&&8nuEC22Bz}62o%1xMS*x`R*3IAgYnt|&H$wn+Gbhmi+
z7`#>FO6288q*yiKm?|13g}lB}V{*M{LP25Q(fa*bU6fZN#g(URi4l}0zHa`IFwM2-
zl^e_5oxUvExS$-$WmO8Vh==DEClPkAQNGucARfw-a3QF1a6y%A#>De($>O7JB=ZRn
ztHeq#6pnQJr%%S%nxaD33JtDD)=|edyc|72Ep;WX7klEu^qGwi3Hkc;3M)k4l)696
zvnbD>?%h9W2m<8o*Txpz2PcIw=A->|GELA~AQoF!Cvw6zH4zY0EWHx(*4r3ON*jd2
zp?#GtEmBm|YoBEB`+R|>7t?F*WfW6BZSE$?(ZOerNe$zDQQNe)I#TO$KFZC8K=*pe
z$mA<)*wCR7I)QX19NfO(oK|olt%_^%36ABKqaQ<4<^5-X1Igg7+tU~;R-A~A%~UoS
z?G&WLzO^ke$|(Y<!<}C$Jdr1{f-zj`3mZRLQCKvbPi`imnNjL%6yX@Y4QsgKl%iIa
zv&P=t0m~PfTq}9ZZ{UWK#GR0AH?(s~eY`{Kga*Hpf!gG`?J1}r_@Xt3HAGu$ck#%}
zU*bmp6N})=m}c}KUhBIp(Uj6O*;dt_5<DmY#!vrM{Y18Xt(IFwHEizS;al(%ss8&I
zk?fM9#7eLHjYYun!I|C3Fv~&7G(j!3*L;uvSi)3_=Ce63l)TP-7h`)dK5su%IdxyS
zh5)gj9HEp8Krqknc1v}S+$*CX&@{FjS$e8)ak)k~%xVfVj^_N;lq{4Z{cgyYFwz5?
ziV_KD@zKKd;6vka{;~Pm@C~9Z*w+!0pPnI80N0Mf5sIh7y*u)X{i$6z5(^)x(L+V<
z+D{r_#_*j&QIsIwIC?}Q<5zs~<qa1c1?P|8(kqqYCgI4NOmuJzTd(<}n8wG5byWaI
z@l#deRFm+vPwW&<#uh>9e;ZTSdNU_W+ETnJsqGb{DbyWb5>u?vC=yX1vKJBmpvf7t
zyYXiGT$({~D()A4q+onb^LqA%7V|e3XyA$Qw!85nb&exS-Tr!y_D<R1f^z~}YHWGS
zdmf`JkSyw(NyUAP@#5%dahM?0RrfOFr9K4l=4IsKdYSLNL=SpX$bJ32)K6!#=&9-J
zCAwK-lDDT2O>lM$4Mear_My%wYxFmm{T{)>r04y0#5gE*191+bHv!PE<vS82<X_Vi
z=}8=W+Jbm?g{Lj3Gv0mx7#a>AYU7~uNz$^hrAhCwYBzJb-RN_E{kG1))r~n9i1x2X
z4inre;=pW|?W`2>qZmKE8Eb2^i^d#JNK+-^d4Wh!?xs9YXQsfH+P_W#BG@uGIS(^*
z9h;q7(r3YB0~vR*9_!C;fdw21QW{|ZREa5t(w1&M1a*`52Aaqv$%ZmhH|We{;(Vx+
zMr6lX{o}L>!pP!%*C<!|!#^BZrvg#ce6#xBWT=Oh`~J9+AvmhIG9*x!9Wk`i>?9IQ
zCmgJ@e<=Y2HW4(0-h1^?qPw72Y@FujiRG^S@^<^vWXoeksO|RrSwwd_sY*W2yJ={F
z&>!+M<u96y36y~x+O#aB2?ygszqFq@#7p}-*EYSDxRS4xirgZpI6lvai=>3*i2>7#
z0~(S{{!(BZOm^UGcQ20qE6QwwXiMnqYbe99*#;p6iFeutd@{GRNXWAI!cYM-Mqz%O
zPnH0CA6uNHriD#NB1ek<F77$(S7lMvqYMgt5UD1~J)s9!I3t1NX_vpF1Q0lgkC&2+
z{-Lahr;#(v?wC$nKFnOZ*0(v6gg&exr)(sNaT5c2zb7t~+dF$>j+e4_;$c$!nlt1x
zFM)+zvB8HMeG^aso=^ep?ivSUw_n^&8_)T1Ab?T=o4!5_&Z84~2~ow&jWNd=wfgQF
z*p}`VRGBwS2b-1cB&DE21I`J7lOox%N1^!d1w$#Oe_?p=QS3Bhnsr_-!vHvedxqb(
z>RU*}tZyx*>(-14PfB_Nsy4Lq2OzU+>KF0{WW*`T#XaZCX8;m054+Kmel;hbbpB5p
zR{?3H<``Fq`@EvVDCYdqxpsry5fwnpfY1*%qNeEPrfL5jGGKA6mnvD(E27~dYfFE`
z@)UKsg;V@T);xH;H;1CjB#U9;3PUlsqf{P#ks3cS+8_2|T0U32A8;4b&H>DOYQi4J
z{1XdzTd)$4^uQo0@9#Cr_q?>073<Rv9kSLuFM0<t<<%|;1WU8LgPWnjEYCBawTC3b
zO4GQle4b<18qq<n5(y=bA5=1bNE=Q9NK8G={Nhbs)$730Yq<Lb+GgRwOZY1ae(wMn
z3%v68E%>lW3iITuR<%{^tC+fY$|Y?54-)NB>k7tK?`*Bzk{@e&g>m|mbu`k~;;4RE
z7uo-fJ18^Ri;qD0SRQ-s9z86ne_VDQV7;(K{)m+HvxYLu+jeBYw~gp;4;hS99Fd^d
z8$>-^9S`lcB$>Z4a=SL8omU+Y0a*6*p^US;&8~c>7JO=Vx4y0JXFG@gLSDJLE|b>^
zDLv1J-fZIlFFF#q5%PMT11a6TLfHePXGHXoRqrYN!vy`+RJC;n=K9d4KMey%Zhi3%
zf)YC;`n1pxY$uS6x`uTqz1>H)23X80>=8^|Tt-j6mWN3LCT>*Rjx{Mz6ZLh~r2oax
zfD%lE1HS(}7xW1$h?w}eBPUE|4<qd^=%VelZpEsS?_dTeF12hI6*C{-q4sObh0UHQ
zd|~s*Qb7#RJjaihfmqp-9shd;t%Ts(p#P$CAdh~|Q(MKs2yN}6T;jPr92RyJM!6BF
z$r~DA3$OgsE(F_4PU@$nYc@$&x{&e<@Vj!`gr4FR9bRCOvOdtZeWB9&$v^rAjaWgA
zIEZ2y*S}2HosId~!j+z_WaD3adhdo4NPi_fS{srHr%pZ(bjT6AWtConA_^4<n73!w
z1zjO=i$SF~=4qZ(1<rFNY<%zir8S0a;p9v1AXYE@bsc2=r>^g!p+51sAxHGuA^eer
z^)$^{UNba4bJ9?<wn85Qq)#CWQw$GdL|I>|EODARKTe|)c-WF^ykzq<OZ*B(M2^X|
zqXQm(<dA7EMNHrQ_quk&;5}v!mN-DGj@Qk8(`fEV9yTH3YX61QuOgTBc#L|i)g-_3
z^CKp%V-jxO&3@ZfS3Sx6t~Jt2sdExRX2Ohuw17!d?2dzwd3kA=#4jJnnI2XKHlFWQ
zFf2S@&~N<uvj*7G9qy09iaEh*9Ad+pm$-)a;!NE&>x`s-2%hJoUQ4&J!|0Qgfikdf
ztRHdtqY;jfg3_43WWoeGIEz!$5LsM7l|#j!U^f;PnE;>T=#qFk1ni;GXj+@f@X&@Y
zSW!5Zn>JQ}Y>DgHjSdn~l+$+i8scvLbqXd{Wl4%?33)tN5u>j;{;NX$=12QmO`6m7
z8aN4pkkyd+FiC`-;PC3?bb~xkub7+?%H0k`G3(D}`@vKq_R8th2marXumrrID=~fY
z%1MtGsH3c8+oRc(%|vr9cZSl5v`2;5;EeOFEUe&pv9RKQYWKh20J&FWc^GE>yeWn{
zVizF?G$YVzpyCecXiwtXL&&k5QG(g|I&lcX+ga~3-xSX>%Ztb>&)ZT6aydgoB<gXI
zt=m6`_T?N|IeqxXUm*!^`=&2suO}g`3S3G0%QN@yD0?4f2)G<AoSYD1xI!YNRx<Ws
zvp;VSrkgx(2E>}*uS1EcIV{UT8Q+H<j)Spr-%edx(xCm2<fMz<cLdCYNw>V8uh653
zUs+)*{2+-<S&wd^3~B$|*fW0yNoK1JWhRS(>y$oGG#(GAakx)GR`SRpt11A?NtL4O
zCuN^#?uDT#OKdQ@hbm&%qaqKB8(=$wZpzHwd~5EQ8OyFzmI`!5^M==G5L`*lB)oZP
zAg`c9SSKDBmpFn4X*iejqv=Px!js=s5n}HDEseUw2cQ)Mz*U8ycsLX6v~PP>qEaH%
zS$d{TUUL;a>XTwph0pMh*=%P((n!&)jRVRA69Jc&O~niXzV0{lmoT7Njo&Q24q#S-
za@F-Akkkm<Xc!{iKi)_hsuT%=7r$PL=np%}%3`o9d;D3CxqZS`tqTd7_#}0WUr8}0
zT2%DS#1-kobF!oF+|!|oBirJESR4OWv(sf6Wzv|{VgB#kGx-P(;h@ax=RZ)r_aTo&
zl}B0Is`?}?5p^_CKT{Uz9>+wi7CmRZa^LTH`HUJw6?=HbUzYVS*;NO6VF)>g^m*!{
zPy)au7%Nrk4|+#s&jKxO?4l$N*Fl!~hro@5YnIIOb2+q@Ak4UZO7qPiY6gDiRlVZY
zX)pRc5P{0cl$kWZd^MQwl~FLO7pR0g%%#vg@RZW6%|b21HDnz;es3HrY6d^TfYZ<p
z41Yd?2LdtPZ^OZpCN%NK&3t9mgJiLb_7<Sjc*QpJM($VHaZb$owbnZo({!XyL9XEp
z6h?rbxe?4K6qe1%=#M{ddWxcOU~pp99MK-GulFVWxX{Zxl@E+0@cgN6?jLo!O!Q^{
zk`{(T3aL2=?doiW1x#+l61MQj#d!e~E`4jbFe7X9|1Y?YR;+CF-&}`HiNW79X_;sg
zZEy&g`P-MiSLCgjjaPv39!p#S14iMbXi({azQo2{(f~@%dEx}pONQ{bD~}-YogtRe
za|WC>B^<Qs<BQfTYIN~apRo8!J`Ip?oQ;3Iy6!$$R*s<c)LhvAKp2ceJ<uQ*V_s1Q
zxGHMPD)#;^ArTRDX~O!&pp@eKlLDS6kq&HUqToqfA#18k(*wT+oZ;*Hw?Bzwsa;>+
zqC^SKk{U=xxj!KLJKD|8`AK5gk<vrZ_;wQ$6BAKmQ4O)DgisG(Z;e(@ubh7ZZuGqz
zD*j)02m}~5>l0O3xnmA$Mf78{j{W6_ZEzWXZB{0#+1-l+W_?Q&D3gx{ubx(HisE5%
zX=az-rI=^V$fPg)v?vb2{@{Y4Y49#8?2vnhIdl7DQW>I?I+7OC5}w`FDwF3~(JEQF
zUF1}q9~0hgq^+x38bh9usgam93SebB+H_PQK^^Y4Kik^!qnNywB(1L;S_WAPA5$c*
zxWs_o^^Gtf^lPQ$LbC4>I>|fRZ_E*tuf=m+?4nbm1k@y*1~^;7*v=l!Njr=`aCCb-
z1RW{%y5e4v+W@c=rF}PfBax{_WYkFz$f;J9vcQg7IM}&!H&Qv_Y=WgDoQ%QNBJ`-{
zNF}$Ao#zt9u}X(OmUD=avi=S99l~Lw(kR&V@kY*>vM_kDW|_)U7*Fpl-4&M|rL2Da
zJaxf`*ms(agg{JX6eut%10AuwGb<)aL<k3w#cRFZ3wl~L;|4QR>&H<YI2)BZNZ-lG
z;8Cj9o(sE?2ZqmIviKCS{J`RQ15lPU${{8*Oq{{-d$VstCk-Y%C;mo%6G)`0FG+)o
z$*!mQhV-9@*%75J&~ejWJO~4fer6JLE2+RpTx$`%nSAr%w48ze98Hc5>j0GxW3#Lj
zNvzP&_pKTmizxxA$dd*SiP{GgHQj;Uk4d%GM#giQnkkW#oabHE%iVv~WLwl>NMY+N
zV3zo|x!X^v$RbLi!Sa|!jQ7LtXNe#<iRBl?-^TsIYsz7;1fyv7$U<f=69<jL*f!yg
z73Q{ArPTaFEiNH$ScK#}%e+vSTCxVzI({F`BkNu`a+@C{9Na-Hhh!Db6pL9#e8CUJ
z!baUFRRCxVI4*v{=n;fL(vwjTC81B-IM9yV2M+xBP{jpK1V4RcQYK%Aph9HB&z)21
zsAv$<3C)d#ItK0uj4{E?8I7Lk<54Zh434ah;0sE%UJ!u)N(|4c0`ZQ3iS&nOAq@Cr
z=_&d2g>i=v5Z_&uv_67+EO%EBBXs-w%l6KVcVapZtr$B=70vKW#$r-)<)^O1E|ehu
zy2$s0C7G8nT01(G073YQTB4?*LZ$N!&$hYZbn-zv8zw&Me`9O^9baWgB{*0l!J7IQ
zLhh)*oDd4BW1yTr4;D&C69sE$H_hA123bj<Bi0c=t|<#{Wk>*(j6%V-<(|Ov+p7*4
z8kM7bbTG!k3~U17CS+5^fTztWjSItwCDz~fkhEZLCIw@>-RT#}o0)qM20)OtmnHb{
z{-}3RflMNIdFGrRv-hE&f{GL8Bf;*Eu(u^_7f&u&BN*X)Q-F~{_!!;b2l8lpgJeo2
zuCkrK#1QzAHJRcc_(*4lSR)uC(#^n{PsOw#=~1L)0zw!<oWUP@yk!H{0d)SkIQ&TJ
zsl9W)opMa`b;51ePqc!V6$?J1EHDe&*!xgyATGI$%CzS`Fp5~e(G^-)gJ@B6z$Ama
zsIIYRMHowt0)q}hRcJmH7R0o)f;jz6DSN0BwjP+y|9H3!ub?~y-^2gXzi-hcHA9i8
zOtwrCX(vAn@1EElrT&am&>7Qd;-BVpiedRQ3?N4@jGPr4MT?T~gx6(rw1jV&PU#N}
zAvFM;XW0j!M9k$gwR;R=J>4FcxJ^n5M;S@`adZc=PF84QqxhWs)-7%wLC8M2mNk3`
zFUF3;wZZ(sK;pJviMkW~WLTLKu=T+}L?^3suf^}$Y9pefkt4qIpuCHJV6x6h#f$dg
z6wTj<6$1T&gX#2g&fJ8rteuG^iDj|(l;*ll<1Y0K7@2d^Gcg^cY}q!CWZAhp9ZnIu
z15ceXqT3yZmfL?3#geounlpVSj>*Hi*memC?TTlclJJjFqRuxwkh?5L)F|4|<AT4#
zZ*g(zLSyqu8BozAmV(@9wq1gcnm-*1Qlsh~o93*%E5$XdN!oa|Au&oZ{&3s^Z14Dh
zp22|6+R`hACBS9bRa2HpwV&rF7Re>h9rH5`-TRDi>ix-j9F^ED81jceeY*(+<WsZM
zJR~8PzR4WkZf;}RxqXhMxwEIcUNvs^Y}yq<g76XAb`q4=*AL8TV@W}RN-Ot6S9tLI
zE#LgrB5E4q?VzLjbPeGq%&R8v$oVh+XcBthd27ee1ph)D^Ur91<;1%ZANzJfQX2DA
za|N%l(t#*-{0GB>BxJQ67e$#%d60M>1P}P6Ce|-{@GJ-jz;#BxvP^-g%f9{33?V#^
z=1bL7q+8MZJ2AxgzcDPuRzcLpj*A%u%A7_PIW9!I5-SFXKGv#~o%$0pq`7_;FcyE1
zau&If+*8aG@HM<?&z&5Qvey%h64Bg9^cV(d%KFnFGYwuq%fN}iCT}*y805~EtE`X_
zZaN$p%eM^Ze9YuE$ip-y;-c))3a`EofN1cKB;>hGiL?xg@@e|J0djwGM1D_Z<L*AS
zn5K^(DF~ye3~?ihj($p0m<~I=CV{Nmhwh6IAiUXJKjl*};vVP^`>G;~t6*&f-}Aa(
ziO$Rcqh53Tk;ujeuH?xw4#@7iaffMOx!g!8PVrJ8_%R1e_P%9!BZgf@&;CVpkK$;{
z(ixB$0ZYZNB~NuKU4L%dOpQY@;wIFP(v&cKbOXo9=y3^^3K{8O>UtR?<ps(_%yKs`
zsadv{k?J5d#MJ3}sFmy=P_tFQ-&QGC`TG9_)D2<dClWEZzPX9_UcnW|Y?x<Ven|*H
z(UNfJ`n_$LTu|S1qq+j)hbByP5Myt@=+3MTu2UuWk{u)P)uWO!>RBYGkW?j)Gq!4{
ziKtQ69}SxGVIi4tY}>2_e^JkZ1GAgCSVRuo<#xPNz({~~;uJMRCUn|CKEwgNvtApU
zfB8T)fq`g;848+ei2kjFZsFh<_eQpSc<wI3iO4uvD5IgI;vFZ(*_4aI-#H{BDSyo9
z>O&CdGO{6!tAP0u1nCHys9`BCcOz{<`Z!KlD6@``WVt*m)oPTgfa^IqL!E3=5BVTH
zkPRY1<<Shn1J}vuuA}M?A;~x@(J$~ayu<9wh|x4^3}a(=h&~kmBpH6ZuiqYWOKya9
zQ)In~=^*EUWK@a7*S3*sjKUKXo{(y1)#aifCyBEbwQ#Nhksf`pNYs!#apNhfJPAGU
z`Icp6tx5Hf2H)}2L*dIhdo%{eChL!|b7dlJ+s^6gCEicJ!d}O$5z2UtR?Yy1cfy#T
zq^28|rN7*9zEIUKZ)O0ozkAc_jT4U4%{#_`a)<_TDYGAkioS(LV!UDY!9W&hHsE9N
zjiTI3Qao7-#QLyED?2;9_dVJ2<GF3XHQRXG3vp~um}LCo5R0(@J1p_Hy>=!iog^oz
z{B=j-qg$k5j-r`9G{sd+4jO6W1{3Z<g%^&32H}sJ+Cy#P#pH0u;9R~Q_GeIGf6`O8
z;ls{3054u~<6Guj@Ot6ri#P#hW(QtV-+O+_J8ffw%(V9H#=K~Ahw=ZjymlZxZWz82
z3dzD{7ADq!dD!|Htn|rYd<0^YNLYrB*B}=Y=VdKizq0q4##MqKLPqk&=~ealmZl|j
zl`RzLT|1j{JtZUdJkpClq4!ew<<|GJij>7xgXB_7u8G0@Qb_;Q8<F>sC>=~Y8}f8V
z9_vJ`62+CY*tfLla<Tt*88T9Ch2kQud*L9={wxut*%@;87G@1GzMcyDL$YY772AyN
ze~;JNGRs%ilVGAqKOzLnjwt3z_O(X2Akc*2C#7p<`{ESSp}Gl+AM-`gVD>jSs6)6s
z`z8`yT>lA5d7uakUcP+NFL6^cT5G+eha+i79wj?7yI2<C&g)<DZgAHN#%)LjaC6y@
zv;Vbe#~ssAa=cB@SJ;`l(4Y=M>|a-d%(f06S@_>KFa?hDRjP-myx=Dem=_m%#y-Xo
z1_J>KQycOQAwm*Tp5{L6<O#~Pb)Gy8OwqYIc-h3Z2jxSF&X9dBj95k#!(+;!{X}2K
z{M^5TiOwKbh$#xc%7iN_AEY1LmkrwBAG=VZxZ=b{<cXgq+rqVrm_h@yt;6u}Fj%>Y
zb(8+}!#C^q6})QU!V}~rw38?+%1jm_X&5A7JZ`)k@s5is+KzjP{Y&Iwsg=TV6cbw<
zV$+y5u3NGLlq%xHF(we0oGjmTqcK%@G@m4LX5XpAbqw`b-2Oiwi590MhAoV@<6Zj=
zR=iWih?{7n$9O_A2uf#3U=f(OnERhsx@>0qs}-Hfd&fPSq(3*xnY8ioyUV8O@FWt(
zS<6rK$D4TV`ebq|{J0NT$_J0GIR1M*qbz37NKky`RqE$!1^X*>9cCd7JP#s+%Q28Q
zc3I5UTVeOxYrOl)W6;b?LC|f-TYt|<>#r53{b%np5!-r!Ni`2ycQp$H4`M_`4MtLp
zxbRp-d_0X3`uIx4DaG_Wk13I0mos%Dy>#m=50Rz3GXnvGCj;?qvX1Hka+(p+?v>3!
z6S;$vwhy;I(AK#VXEK7tyMu|v>@D11!JqXCq!5!%$lDLUM@;4UvO3N6<+FSSU%?t*
z61N=Hf5#$>Fh2#EZY1kPD39fU+^2C{8QdkXe)BY_e?UV)ozfDk``diM?Wijt1O0`)
z^{The?=IT~c;t7xZzigp{0UgqHVfp%^&*;V51I#jc~mg>`^V0yqFVeDM8=`>v)?{N
z1s;4zP+HV63%AAAE!9euwufMObK)xI1BXt|3>0b$TaLpJZVAB=Jk+DFu_E5SaccLl
z;L-NP-u_Cq5U@xnif#yUU-&}V{f#qElj7&UuwPYpt(7#P-=<Odi5L5V3$f?1)IZVG
z{hf`|(pc`n8`p6eu}(n<w+%<i@kruNV%Ql|A~hT=irJGYou6V<N4296Ey-h<MH1Le
zODQV-5*xdN4B!}03X+4O>Tt>Gty}8)_kMQ!GeJP+r$t)l7_o980j(%YX{xvmF8Bp!
z{J|+pjJf37-p3%O7SQ5a*p;)s6t?-Y2(;!WyhEY8`B3~z!snjE@HDWu9YuaLQ_|!z
z;xGgv9v3ULR?=j-KoHwuj?H9^SWHFCG9?`}VpF?bA`e;S?pqvDScm9#g=*)RU6FxG
zKnjpQRq==lT;_fk>=SDFVbn=AH6E<VWcJcQOMds!>7|9t;dHkoAnOG7<UCOHg2-d7
zoxNG1K41(@G@2t|%egD2i1AoR2HLIl%N24vNgrA6_e;iaK&k6nC<sXbgO$R7jw6Qo
z?YEz>+|A*!DB_jJ{0LtLzuIHF-4!5t1Y1tijfY#TTh2+It1g#R_VYgJ#I#m#a$)qN
zAbA2&u9-K7Dv~)K9kjAJv#;C-58N2oUDSCBFkw<fce9?UZ!nE2Kz^Fqo)w{>q=zY5
z+6JF+=C0RjW0D#qThCUp=J@6_wksgo3sL1-#0CJcKWve>+_NSv@Q=(%!Bj`m!PLy&
z75-t3kTT+QFnJc%8^Pz?u~QsZq_pTgs8GQIk~7DdDlDJAwWr8Q)eJcZDE(O!k0FRw
zx$B9{H|l$Udg2rhwX~4gcGriV))sl8HMq%vKN>2W!aeg8^e3Nm3j2kRiK<!Sx}HfA
zCC*NWgbU#{|C}wc{rpbGjv8Le28TL_dMLx`kFfXkJMR3(K5nA$73CS$@scO|6ITgm
zOr`}y7{axL7xJe8t48-Vo*~nuB!e!oje-5Be+cG21WTewMLm9zLsGbXiK06;6%r45
zrA!ubv9L%FwgNB{7w_;?p2fh97}r-!C_prTVKooDW8A9@!A;h-ME$(NdPW=Q?*{}!
ze?q~gkMVEc%w#-G6-Q8HeU*y|1C>6)0T&VMf|Th21dP%3JU2{%Tpv$aj+K9_&hvby
z1P8M||ASE^<CqVS*t!-{SNe-sYV~F$B=3fnz8X>^la_fFZokLnS9P0xAQ`kBV19i6
zAdKa5Mv&;EAwF^;*d5gfwL@{)J#xsw<z%_#|ESnrK&TT?fufl3@ZK-;I^vKZF%iUz
z-JpqW^78j~T4P;*YWk!|xSthuw~!wC_qIu$XMJ{*!`%qgP+{k3PJ55FoW`+0M*Rh;
z^Kh{G<x@9S6GCDGfep7q&e)EJPF_e(ou9P|a7^Y7Mxz#Tj5m3B6;2_s@5iSvJo@Xc
z!uvcUP~UtJ#BKZ4#BVo2_xCVseVNyLwGr1Av&4v?#Ea^$J2%3+WEH(17ICYBs~sZu
z95EL0o&fQ}$!#2sVVHsw{i%b=RenT{;eQpXDEn!n;SAFYkBHzLiH(T}>^LY${>^26
z;VG2G+1+|4Us*T3h}WT7a(k5_6J0ISX;Vt+m{@x1gkNXWqYw&7DMpE|RqDEHM;tK5
z9_7mUAeE`5dSV4M0!5Av^Hg#tZ$HZa^9r2>X<{YQln3L?)tF_KhM&4o-W3jVd<wt7
zYB0z4hEez(MH-r{(7BMe?YN)g(U~D8>|dtgzW*{qZphuVOC4v@FpNFg`pk^b><s&X
z;2&P;rPVrfx7WH^KhOB>7yyFUki3Ym;SO&3R=Y_!=eoPFbbYvaGJgCI2f@k)yV{6L
z*BtIgL#wQav2xEYgb@y7#OtwP5n`Cj=6o4g?UQ=;E%GycCkyEwZRJ01(tZXG4m~`p
z3z3F`aQJ(puEg9sNwlS|cZ<qi?mgu-X7mlPfB4e$$=6Rf3tVOT&B=-<bfen~>^;-<
zj*fD(tO^_yQ$_qio+(2$HcpPAa*lZsZLGJN9X~B1C~Frf$r0nv=s?FzUNaj%MJxs=
z9MdB<vyvjNKlPYItAw{<e;imLGaQT-xj*xsVh|jjQE_D?CH$T94a;~I7QK~&PGj8O
z-a<RA`Q%X!=){G%;3?gM*uo2?V9%Md#md%Fvz1s0r&4HU*$!^2wmabIlRLnWT_o})
zAhu0baF3Yw`2yp;xZgvRu%x&+^7jQTq%V!*dg-J+Wj`6X@%oo=;%FUb)JctTwA;3C
z=7hzu;>!g!e}!ip{wviBR6H64mK!&U4nvq0@tdx{;zum`3=soJLX|THi*Ae;;+g@*
zjf{HlpOXQ7#M8lOCGHNxsZ`mq8XF{ltCSbn;+|=|n_~ilnyS~Rg@zA+r&cJwh0ii>
zBfS*u^_E8@a-g*NR4klAH-^n2$<`5t0Z{IZ3vH9h&~X98+(3x8&I`DR`(8`}fR!O=
z_~ffNb2byqk8%wxs4kRWzQ05^+zgbotB?9h#s1YL8ub@ToGN)3dYav2V(TabHUJuT
zaBr``rpRDY?uuam&}#Kbm7X+*oNRakNhVF$IeM(1s4=tb$@uTP5net?PIh%n(_;sR
zFIj!^#J)<0rg&gs95H*FqDL~^VZUM62n%U@uvFwE?zzgfmzfQn8ndrbEbW()He|~+
z)iRqI2X%}J6klcf-8Y1Gt2o*t1=`wPG6G}OEQ?LpWo%=L0nwntuFo{{e+&$;l@fk)
z4^wz;2o2yHU7S;_DG~f)igZ?)6pUF!?5U*u-v=cyi0&U(>^nxEMU}4zJW9XmR5-&q
zVb`|nJeSV#i#C$-ahBfV%SP$466So+d-pws#6)$A;C@Q+Lakg|O9qd!e`n4DgU6T^
ze?GZdbrT2Tk5&2bg+JWZRZ|9zvJdU>XHF8suvXO`N+zdbOAR|YNBQOMQZ93Yt3Z=A
ziR8(VwVCM*?5aG?oY3-KRfRL4%p89h@eiUl-O=&AUBB@nIE$}+L$<x`6530Yg>!$O
z@Zp$ACyE+bdF~>nV|gRd{QNjsaSS;l;l6Cd0B6vtzq9T9=(UvxZB}LrOsi%65J`UO
zKPe4FGQ1*4&z$}-=}K9?)nrOJy~{r|pfLw9ccgO5_(K=X;~J!8gk8>}n45_LL=e^_
z7leBU*RL(ne-fyL;O#(8pY@Yr>eGwGxkUu^l_S(LJ}E#W*dDOWzx|iLNn+H`EG%eP
zh*)(V!#eS9#_CcTZu?d(U0&8y0i*TwH8u(TgQG92iTKUHf}8<R*o|OPB0c2dSoeo(
za3a<F>69CdYzz)-B>jX#+;Xz=K!)SW>{Eis3*ze2V+Dxm&xCyuYfn`_61c=Gji)_@
zhpy#M3X}9LXijD$knre-RjBPfKBlk68hDv^O8w4S>`R6mH1jJm?D2+tWrAHy5qy;$
zjMrwXjklNunQ7UE4Pf?NFS~TJ(*?x?EXd3piPdBdFbOJM3PA$5*YZ~9)`!5%;Ve)M
zzKmf4yO%%!K}%XtVo)@&I%eAbH|#cnRXdGf_MQ%7fh+oh>I&}*f$|4+Ec3!plYSx6
z7cPuGy-yIPpVPR4DRrM_ya##U5}9Cs&7&M_4L`i-;E^n3>WbeU>SIz)z#W$CgtCzB
zej^-d-~kn)n+M)<r~JvhT2{}Z1i!X`ab%$Mm@{W47h0?ig|a#rs-R{3Ql$206HR#5
z;IW?Zx+1k>7RSySOdQ8#Is0*xT7wSsT*4OfZM?WsUcuxB!Xn~vJX%ho5y5|(TZYj<
zNgRP>t1}E}@E{T5oQLN!U_asy=v<w6&9;={>Ls?_9l)&9Pnw(i!T2L7_wf>bhrZq~
zvR~LabnM;uSMzGope1UShLas*yhyx*mWq41kRx-eHXO7i#PVtL+Abm%&RVnD2E-cO
zy1|Nke^<Y2_-)702(!d#6sxFT1Md~^9CYi!IjZr(zOUr7>;`D`!~aHl3C<Af`W3xm
zTtjXisf6vkQE8-z=msw+=UZJ$+;z<dum!R<FyA{!^(QhWD)lXe7Xk~vRYOFaqd8b^
zVIIOoCyl{uLwLI*7C;V#+zW+zr4wIh%QBv$$uIIJCop6#533CW736V*Qft(KB9`uD
zc7&H)FvFXu+dITI>801=O{D|rCNOca;~atHkfGH?`0MpL|1>k#a5+;FPaf~bjG!J^
zQ6#{Bp#&*Ap?+5if|iAQ_)wSjTvJUs)RSbkkt?j4pl`1gP{oaFucNTL5E*i=24RNr
zyo*)(&?mHEn3VM^v#6@i$q3_Qz}C#?6&IVbhwGgtPit~zQAt8py`F-RMM-eZpHUQP
zz`ae4MZ=PrknE>_SA+Wk@;PY)dx?mhV|ogf&6i7D*AK!e&<P9p);&N;#fsG53ooq$
zR_Ecdg_;KQ8g{ki_Tt8{0)g$dgAABTM^Bqk`iNEfpruJ;twHl(K#)n*sB<r3Pw-J3
zSG$34E@i7u*rF&rNgTUoQCic1=9zxoGBA`mVF1h5%}Xf#=5Fh+5&>(isp@t+H418N
znz4b5YwNsO3?;aX38S;@Gn=71fC1Nn1&l;3H3uAN8{Ds{w(KgZ_CaUk=PlbWpYZI}
z4P37kV#s)`#~c~?ZecswILD1w81$uj7#W!;>sJMj+hW&yBvC00Fceqe<q1&vYD}U2
zEd&CL!MyORzZ`vn7Wq??4Hf1KgkXV@?yHY}&@fU6OK~%WeuLvhD2F{S*Q+*1u|KYT
z`d`yVfvCAbJn?|&j!6dXz>-@H|7^Hnn0HGbcTsnMU^_*)^#cL5IaYXBYG=DGw8|Z!
z{;LA79>y|+iA(?g@j-(=Rv!q}U3hWMYh!OO*T`&%FP=pJ5w!fJ+-YL|4o1<Y6Rd(F
zc6(7GCkY6r81jF*ngl0xuA2Dfn#N3jBkrf)`eaF|JOsCB0+=5z-wXw#a~ckviYx*Q
zx^HzW?Wm(_bm4QPWRWb9^xpuHEqgQj?CdBjM9rJjkm$O=QP_qa7>EM~O2u4M`yT5W
zrtI?bn#dIjc(ZnSPm+h1?n0}-M2*p*l$JjPCy;_O?$HJa;|om6<0`RFqr1RAsznpk
zc{MaQ7ih?=K|Ltu_OCh`QXV*nT1cAnh1rXqS*Lt5uGlYjX4p3_-3@0T22mRuO|qZ}
z=A%EL#$U-4*thM$`6fJtLsL#-o391bJ)}<v;6JkwAk!QEOVRhZf_k_3r~=<NABvOf
zI<T&vbncN>npMslvw~@7QgnsXWj{Dc9Xp#02%w4?^}1mR?qi!hiOO}=oQ!xbVA!3l
z#t{h7&>vaS!A4daS#6IDg^pLNP!xI<31?hpM*;8@6o1VWMof*-ECH4THwKWl%K=ic
zt^(MyFmTQJZe*Qc>YyM``U;iC?x&`l6@1D#p?o{d$HQ~wpB3C15=egUk$ks3k>XkM
zA(LK0y+gr4mg19tdy<PElEk#XFSuUBQ#nIThXexryWI;moeAnB$4k7u8HUYqTB(0U
z6_~T9aB(MlmGJK(uU8OSRxshAF8^OtomEg<eYEy*g1fuB6?X|P1&TX?;$GY>xD|JI
zDQ?A`7I$|_ad#^x?>X~bd>4BrGubzpfA-o-e(QNub%~b+Lt5L&)pWG`pT~77MM#*Z
z)5bcX;?7Ax@3g66LS$YZ-W2HDULloC%n3iZKDX`v9ONQAdp%=_)fw-rwl&d1%4Ut}
zXUFqUm&kW{u}3MgIvra?ZYO&QhDsVEqMP~Yg4%)TRA85(b6GL*TT)rGcSK#rVj~cU
zvAspAdt|%UIBnM<=UpKtre=cw7mDoMoYDGXNFooMUw=)0;)+kI3}FeMSRL1lf(Nzi
z3hS)ma2xi2Y4Lb^n3XW2{jS@aUDk^T&yoHU7#WgXNwsv8CnM<&tNM0zvL?nz(IRI@
zpdycS@dVY<d(UpI_dKSu5UA5wprj9{-*|TkvCX2So*c!`_SlqWBf;JI!2O<h@n~I>
zOfMmm3UF}`A1<xtAySYs->li0uBKnYczK=tp0gSxk3pcDu`TiI*31ptD^h#3g3ZX)
zdgAw}|N3ct$Jd0{{^N?eT>LjJBzH9fIfIDrSa@;Se|1dlF5^6j?!t=2?k#%p1?|v(
z;OluiSj$x;b8ozTnfW{|pZQ)QU}H6j3Nl}akDt>A`?mMbZ6L(gaxt=!WA~I(1B%_q
zxEVjbBV)X%x7PQ>?PPqq`(m;pFe?8_deV4%-M59Mo$~Q=ul5HYHMnOvWHx5|q9zkM
zzM!%U#bv9f{aZi!<2(0vvRxE9QI>u^Zs3YD%3`)wPy~9Lsf{J9ZzsdAvExxFk~V8n
ziIjb`BWB0YhYN1!+vgx{KHOO;@si7?9h*Qjd;$lT+bQlpe-n_a-Oitf+wC4B*Tkki
z8l+9-aF%MYyHxDy1&XK12DSI$ww@#U9{*`<czTE5f$aqhwu3qi2rq;YDgQbUbX(mr
zM*9TcB4n-9ngLwxoWB13Y!(@(r-@E|{98lUq&_%qQFLgSzo;p^pgv8d-IIFa7`iB*
zfNEnBc4?{S*RufKMlzBS>&xb4U7ob#kgH+mSJ;SCki2hp)Gf2Gvv`+!P=8vp-^Nd(
zXc1eW_~N3DXu{tdA@Jr;l<`{~Q{aAD-dx1mBU61Zc?e_~3(#?n+JwS?^<+c0##|8q
z!_7C<@2=g$QSkVJFfp|{xOgtAcuNl#6NYNk^=0w9esGXM3dG)Sqw4{;@;7WszE1rS
z;!8h{A#ZocINw&JH>4huxfX{pv$(ZZU<<!(F)b;JEl$5_Ib0fCpF`nF%*XT<2S8Nf
z_Lkyw|5(ML$O;M})pjV^z&r|J<Si|mI@%&KEb~X+q6}wlc7%KoX`q<U`V#^%Qn#-g
zFzWmVOqI^L`McpME=d<KY2B}@^c)dk9JfaY`^;$J!v?cnO-Z7gJ%J&TsL-v^fS_Bs
z@Az+|e1{Go?|zhqSvG46jk_*tEuPS~D^F*hw$g@9*lon;3i_bECesjwmpvQl75)8o
z3)ZX(*6^ylkbrhFad<nOEbG*nCRR?|zv%;N-?^HGtX5#ai(QJt>bx{?(sLOaohzE6
zu!eFs3^}v2;YyTog2OEhGJ|K(v?8$~=f~rB?>}Q0`WNqD+4Z^10e0irK)o|Lua%Ad
z;p7MBj(g;v6!bHB{2U?mN9k%>>v6u4=VpN7R<)ivf@f#$PV^>?R%Z_tS<oKbT7@BW
zE5Jja8{vA1f%u`kPA%)y+4Hlc!U>OlQ{_do7<ls`{B+Z>1a4?=OpnB{@oMz+$g%nB
z<T%2AS?+JDv%@fo^?3R3GLX>?ewbPLU!<=*^BCN)5VM`+%)`-pcyPl{Pb%f&x<W!H
z8ldy?EcQuu+rWf4R+Fn{UCp-uxB;&i%HS{NAtcQht2^eq2BdR*vJ-MIg@d$TM5iS`
zhS=Pif+eH+43NV-e(NG7!-FDPc&`Mq15E!`h!J=G+mKr+^M`VwyDJu6kB=yOb-7b)
zS8M%>=^#v-VVeBB@GmM)=qrOX^~`+Y*amb<avovHqj~#JxF~h1yKFb2j`h}^3OgQp
zdZLsbbWlK<kH9&891(l=9+!CZ9H%g0mTsY=H7Xkgxu3_92!H&;#3<*QS>&<>58oN4
zPb@uk6Hxw9G~u2e-I}DpgRiGw?EM`uUQ_yjUU)T&cXYuEJjXQn_UC#x;K~ZTE|H(v
zAPbi>8`OH>kIDs(YgBj%=>PLd>yKb{ieoB;iJzmda84qvP|xNTH&s}bzs-NL{YDry
z8aY<vNBARjJ9D%Bh&<Hh!GTXXxjfVHk4SUKb#QjfI#y}F(w7((Q0L?Ru-prlRYc93
z__jTEU>QmSpKty07zqySJ)nLg)aY*y;bH2ht$%Xo`L@a-nGYTt(Pa^+l9f?u=!Vpv
zxKxuh_*ACLnn+B9Bvq{_zErPsX7u6?jM#4N=Dd9N>M29yCseKsX#Feu>}5cu8m=fs
zT2R?Y@(3(e*Go!p%sSK>5ipJ0(BoD>2Yt8!%)P7?KcFJUTib09g1AQzR;s>Ai~mKh
z=W7cc4dv<oSh(C~me2pFbpaa*LX~#&t7|G?xW4>brU#p+hcI7^v=q`&0oL1?c2C~j
zP;W9GR3Qy@D*I0^*rv{nKZ(#0ANpU6k$sRt%3l7?XlO!>iz0CL=F4G_o&ax@2p!dj
zbFB_SXbx5%9KG^35kt+z7*$n+%96w`!v9dcwZfyK8v?bj+f7T=JhBx&QQ9{qzoVQ-
zWL>l2YHNre5%Fp2MP(!2*PlvL>f5l&RaKdGD-lIFm=q+}9wPotJo3h?(l5Ujt0N+p
zi*=b5M0(2?e~UdDQ-S!D<vROlzjo&EHp%=-;&igECIfnXt21qJX|6)5Ww@(XoF*2e
zYs#=c4}Dd~$?3kvf7e8;xVSKUfGrC;O&Eu_n#4itb{46^STA6nP&bKSCI-pn!?O^Z
zYzcD8J+FxmNh;;imt#3(T<isG_7T16z-27NpBQ`TQG}L_2%a4B&|9NwTyBpjj012-
z#KI8X+cUQ(akS~Js_a0_yO4zA;uFQn>`*^S9Gnx5rm^0g`O#_S-oY!mkK+`m#0ER_
zU*62DSQz+>2{pjBPpg=1#qlhj*~hU_YdBaRfeq;>2{XIma%^nGg^X;)>rYT#;KHFo
zmq*KRxE9ZBq&@ZzaCdZ2^axScXCk~Ber?Q&+HG$rE;x!aCHoRHs7vzRevRezm8VmW
zobCtYNjT5sxF-2_UmV*it3>JK)8IYXm7{9V_A^68ncxK6ebco+^JlxN-IQ}-H;q+2
zu`|wBfvtnNOSn)s5QDL(LZ3MU0U@D2<v-DW=zFUIGnh&-N3~h81h^39{<#9yCw<I1
z@bKuYuVjAIa%hPAVC$V9>3Spd%P2)bWDqFlWE$lrVu?@XNt~h&5NuxZu4m8F74``x
zQK4fyNjo$>n91u~s8}yz*Q`XZtNmm>B`qO>ZTU5`%a{72U*6`mSyG!b2$_Nl31`F^
z=h_iPJ+NElYQ)5^S?Mk_n+3rJTX=8<cY=YrP)6`*D?blI^BM@5$wS&IkvuN$CCGz!
zh>UOqp3{oEGqyUD1T}}~_Mjv?nw-$?6USn_(P3#^yA*JrFZLF>5UR^`oIqc#qYvvC
zW>hKp)W+%`Asyx4iYwJTq#7DSd7;|%^zyAdEexj31CDI4IUR4ZSNuyd$Bpmrh3zsJ
zdBN^SWuIP==`jOe5n5Tu`jU@8ZdN>dW8`eRL~1z-=F&E{#uodrX~gJy-O`(KCr)k~
zR)FHu_*l!8i_M5zkEn{t!pGRY<_CAG2~VP(W?-4ALj#Wpx^G4N=&t`!x!5C)eUD3X
zXx0nU5JY6SylsDt3f5lzXVB3Ks2|4M-;g-g(;Cu+<I6g7U1UY+!I%CHX~*Rg1e|7a
z0xaj4-e6fw=871Q6!TXlZ!5@75Q!e>)&C6;F|RMUEZuw}B|QVVUc<TFt6-+}v(PrK
zGfC*$eL{b)ibr%his1;a$K6&^6WR?9fONdn1jR$z@~o}`-vf2}&OpeeCCy#DE{(9N
zH5g{&pB-}AI*<{CQO*_@29C2;xh7cTZwDh?g`?x-HfP%E$+&niJ3Yze;=P3TcFGAj
z)ip+nm0#?msA@Qbp-2`Vc4e>zw|Fdlqd|eXILIfyrWST6h~rH&WxrorzT-})y<BJU
z3)CoV-<lsn^nE^}i5`fEcmEvY%&0F6AaSDztjxcSzVV>CdG3S!pxp!CvROdEmOg3=
zGsCmyho)9ep|^LUn(G$P6Fx7&H0_mvr||bJuiw8Yi4()QiYPDz9z*Az3%fkkz@It%
za1O~&3@7;B|GDIOL)Qvn%BDhM`44Ic_7N4=W>k87d4qc=@|0mSIP?cR`mt^QpE-ZG
z2b=}W36<7^!Gj8N9yE-BktKw5)ojy<D(JWE`OrEJL`(gunbkmK=(^*6k<H*`&ndH0
zZMvKudH>dK@ZgI+XU|UXl5t2%l%z6GS-(dcz1t&c@Q)w7?3uX(SU|M1Pe1AOkw`9O
z<UAk}jvi9R?%dt?N`=a9^sF!)C()dO7W6gJt0oO0p>e$I<b2?y2Zb(<A__Q&k;9Z<
zdmbMcVpC-ZqHwnyE$DG&VE2(Vv#*Z{Zy+)9F62~SMH&Q_S9BMBYGop!`~xdW$>2Mi
zO9seIU5lJ5M5I-*JhYKoNPQuEO>LE2e<D1yuQBzu<yct6*tMXK`|ZUr$$vR0p$9KF
zWeo0)qhlwX8y&f?ZZNCn62qNMpp(?CId`<q{~6_h1i0m!5AHYs3WELrx5&ZXp{opB
zPUXxaY(nx3kAB+`R{Qib#v{vZdfwGJyyx`e*OD}du8k27A)9xXP;KHvkA^v6Czy<!
zn+GtJ^_WRjY#%VInz2*kT~2g!^tyH@ggJK7QSXT%r|FEEhtOb5N&N?JtEXxJDp+qK
z4yfC?jHSiHWGFC5myyH(IGI)mdWerx;}U|^Fb5uyKT4_Wch%p}Zf?ma00~=~@^u!P
zV~?md>7bJ9rR3Zfx~@Wd`dw&eJ-et!NDQ<uN5{`3L8<X=G~a}bEppCshI}vA)iyh@
zY&)lSq7U2!gf>RV4<-fn?}c-CacY#CW2yUI1UyXQ2PsP_ioC+JstAJBzFJMval=V#
z$om|@+&g3!n0X<mv(@f~hvGa`JC3-dmriAIyy7E0%bi4A?OnJtI&Gl-*t7y!90M4H
zAul)0h)D=>_7?<a)H)JMK=v!Z4P(jk%Qcf2K7M*$0WBL2{-_gmZw`GrhxJ_TPmI}0
z95@XgM-!K&8s7<{vl?&0f90{2#!7HcqH-A~JW_teSSJ)QR+5+BGZk<?hj4l<*<WO`
z)O7j#3RB170TEkf<@b?qj=Ui<jj~q@3MNOcW3mH^89d-?kD;CuBHWR#el%AUYx{RR
z7M;4#2Xd5+4mT`CUx)9BKpc4H{OPp&1Kj;z>|}-=Ch=p8A^i8rUb)f-YNA~?!}oNZ
zCSl<XqBqC<9__X;deeK(?+Z4J>Z{{{n=ql9<@E;Uh?**AS5K0tA>G9?H&MeH+tPn%
zF}~>CnuMg6e3jB=M|W5XYciqp0r;#)`%fxu5tkxeMmqKz`swsTVfz71J&rJ2>kOiJ
zNj!FTkQmx^Gb9&RU=Qv(N6Yq4aZo^keVDzDWfYC(e0PE#!RK5!_VbpU*~4m|(WcI4
zhocMxkIJ465G9QaWU1nv7W>iaKHX_g(u|$3F5IzwPm{I4pGK)Rw{Hz7N!s~WOVeu4
z6`sv<|6z<8B2tXyb}1-z(JN)BjI+jQloSKYbI-8{oFnZR#vC~uT$@*NQS`>hp;$t$
z)=#>kLjx71)^B>f`6)XCCh3n5D*_#C7V8-#gdlF(4q?StA~g}+1T<>-atA2uILEx5
z&`T!>?R$4v-i3uThMrKfb#h==lP>tg$!Ug;%|2N&-#=;;B<5leFV0d9Z(KOMttyLG
z+yqfG%p?3TDE^bv&GblgMj%@7=fQR64MEG;`@1tfF)t!*f{VV3A%!!w)tG`v^*al<
zzJCSK9+}-(&^q|m*aj%BTK*ZUWrdQElyu=L8{#q}IUwTHO2amU#3D)hC|J)GRoMVi
zj!Syd(%&y0iY&qto>28?H(<27a9u^Yws#8+UBH*?f4)iT3mUPJUc!<&P|sNrqPG0`
znLRMJ)<$Z8a}<<z8M6=m#56f!wNDySYz2)w><{^5KOtqG0c@uJrS#1V>G3D)1<s+l
z`sVz?<F1%8dg7DTQ|Dt7K>F{9{;ua|k_ad9;WLqRxo0n#s2g_TzdMcI2hnw-L-?59
z_tB;?%=k9(FT#?h3>$~v5RZBUDAFMi-&9^$yLa@ykR>6^^V^cuAn9!v_Nc5(dzT;|
zzSMmT8*Ox}=$AL#mQXZXHJ@<)DrH&_p7I=so20McH#!Mk=0RhH%9){i)=kqadJji)
z@>oGsF>Mf=qON4|>)c+W^}vuUhvo1dTin1$mTJt&4!0$BF_}`_H-Jt14-uOZh0<Rj
z*X;U}2&QOrPROJ+WKG7~Yn`SJd<{;b2j!FT-Tnz<`0AHGA}^3XQm^bX;LY*R#3GvH
zJSB*2>(lV@8UzUVZwQkF_1|30zVe?DmAxeO{CQYp6q}?c3v@~>Pp=$~QB$NR*C4vP
zMwg-kjc$glw;wGkZtDPjJ2u*N@XWd|)-g}8Aq*(`@2|?N!LLdrj$|{zV*!Y?hYxC*
z^A%pNq$7&V^=Qm^J?ptYZ3N1Sz_%Aj);1ZkCJs1$QzXFEE1{dDy~4^8#N~4LyV5+#
zoF+jJ>#RNCE+KuTn4Ux0PwXYputW6nhFtn%7n^g!iyT?^8-tu#^^x82hNDuCgr&BD
z;|%h<gl(YuGviBk#8v+~^m@u84JRk=3-Ma}ZAnfZ(fm<ug<Rhvw{EW=FZ<IUBo^0R
zcVTK+V+|?XyA=1Go%DpyC%&#8Vzn1qgSMh}&;l=?wxx8mV3*&NX0|`Y)i%<LwDtzY
zv1sotY@&kbVyPx}3lKhIr=Yb=7F`(eEG*mfvsA_RITD}4r?%U95LO3nq8nUdLk~Q$
z>WTNy{1_CP**FYF4vD??fnki<U#a!O<=|%E{A{5kElv+ukEuw3lpQ8gx{c+$xQ`}-
zqXRZnDi-#P3w#&gFb$EDG4GlVOvgYZMdHK6m&A{VX5%1E?t~nQAkJAuT_<(Anm9L8
zKXw3J*!~ft?J$mkM$PM(;tD6Uzt)?uVcTu-?*NW|6#rT=_x|-W!T_UgV!LIQot0E8
zI0ndY!oDB&7DsK{oh%Fv57uJSS=0>B(#@ZkB_?ey7GJ~AzfxKOW4D}eR1F(VZL$}B
zZvM3d4GULAgJ=@cnW8{m*J?1&MySb2Rx=Wi37QR7%XU?pX_fx+f(t!=8Ntb*hl#%$
zN=3Xc-AlRAeh)LOmwd#WE9v@0Z0gv~?7r$?#nu_+87{}aR0Gf|7Cjlh{5_c~YHE+^
zk7!)K`T?7+>OTGl=z<$8Xc>qEdQ^ljpZf88fn19>r!ijAW{PL6ac#%{8o*a&EU9SE
zuI!#->a~EFNfADq#viUJZc=g18Kk3@Y)V^ltp(G}i$Npc6GRz5#sD~_Y-b9@NAMqv
zi3}7Dt9`TKQD6OG_LPJM>fFIu`fSP@Hd2GcbEsTM%ZxSZzTmPZMt1gC1AZy*)FQ%f
zOH$7jj0-P85D}T4hSunc%$IU<BruG>467;>#ol|FP2vrokW&R!R3LMYy7AzUE-5+6
z(Ms4&TMyoMLz2xlNyrLOR%3bM;~%;Q7N)_CN{JPO=K+XBN|llHKs8qL?E9P5rL(pY
zRxk6}U~&Z)5+EiWxMD*2rbT)7N-X0KqNX0qrxN<Krz9gXc-vNaL}XbV*m(1S8bzu6
z)j};zy6;}=9h&}RRUc&Mf=zu)giUr`T9g+?EyNCeF1lIq**6OJ#U+=h{M+!(eON$s
z)C)Wo-0vl;s~4$n;vf@6$D)8r2sr@URfYKOe0iflGiMw87408q`XN8mQze0+GP4Tp
zs^cQKmuFSnVC;qv3#vabM=Ba<oZS#$=>r&WkX4-yz0Mp0&?BWb)`{=10e-E9j4!Hj
ze>bqD5v3`4{;(k{AvH2O)^`w14{lLk?o-NkJQ)(qB<Tc2{t|J+wEujM&G_I~dEH7?
z65b2+k!1*HqFClu^p?|?{jP*zejzsz^Tn+NTi~1UP`JR8xbh2g78V75+-Pva)Au#1
z943nuB0FMPePx)uCmCvLW<=i7P)48p_!R=YqvD%RBwJ&#m!QTQq(W5@a(gy)%nvp?
zF{=?4GxL--W+oI+&#b)HvNFyb@$b`^Jt(M;I|XS;P3efkf(A=%&StI+fsnh5Hm^5M
z?CF6fH9d*@o^c7~uS7!G6`OEC|9pK+0^GRz$OLOTdBR!>Y1<VRD%Gc^gbEfCY2yjR
zuJ~&D6&#ZD0&gAP02F5A2zVfw-=@Y~_}hl@^}UEnQ8gxsls_|-*Is*7K$q_W^l>Jv
z6p{a355__~4Z{mr$eS@0zf;QGtbm4|795PKANAFcIJw|zC?PH9$)T$W9#9@VMs6?S
zGqm-}(<o*tUF1g^wt)z)_7G#B!Dn9T_o6FSS_=1J|EDVfEWyl$0OmHfI`qVTB8YPy
z_Ecy?etn**zq}82Lc!}oe8i>tjSI3?;=h#&Zv>~UHY!0Ld`YoOweQ^Y0_ONcCk0(_
z0lDx-UL<cY!N%%5tF^GAN;9KYJx|JnshiJ<7vk~5G#t#rlt?mg&}S>&1(xKcE`oq=
zf_RB-&tHn<(&7ge6}#N#@7rn|(AowbG}N$P)Kf&61OhJ#e2ibZWc1B?oh_9G_|sNn
zSAzI|eI@~VG945*lFXA_ZwM0y=Ouc*FcPG~q59|3Ct^LI|08$$p31|TVv?>K|J_#|
z&_xjXbjVhrRQy8TC1*JY=s*d-`g?8A<+I9^!)wPueQ-}XB@F%B$p>l7>%fj&6i#FD
zQf&9Ps8~5x!o-jysFT8g;jGLTjlvdF!Qt97LB>y$CJU(*ZafUm@N7fyx|RezA6d#m
zY#2w={jhcK1*EZoW{=%ha|O}D>-wagD6`YYVu6i0V!>0|GM~{U5hQ#+n7bx%;~69U
zCs}d9VtUq>n}cxIdb0GIIRiL*D+O)`)9e_-%x%X<lhVxlLkvjbG*JAfO~hhD>ojnS
zp2gGKjl5mm0@33rh%x`ZlOH1$TU*IZ`O(K-@T=$PP9I*m$M?;TrdCXr2n~PEHgFAE
zYij|xCzQS3)gV>MSeTI%b#Lt&DRZoS8od^~VxtCT1NJJ!GgCPHF|UoCu7$dC3vPrz
zXCwU|I21?@cx8!{IORY9nJgxqM>f(z8z(_fo-dHbv(kS#10+aX79xd|q(rpp_M8#a
zSSGi8(Qnx!sQI!H^D7ohSzTYxf;GC0MA14*YX~0e=>5Astu)k9dNSO5E=j%LFmmR(
zVUOSNp5jsx-lvc%$VwUrP6*gS=Dby>wBLYQy*#rbZ*wqaQa^aa&WvRCLZCfbC9S`Q
zqnw7%N~su0#+xpBJB<H>+bdUudd-p10Zm;W&S*QenNFI?o!hYVVCQP2MYqSNG`6R9
zh=XNmFGGcTjX9WI4<Cz;&H{3Cpo2K*HpKPs8^dmWgJ1ku4MdK5Q%e3TK}WQ8&JY9u
zK?Q}}1W3Su{VVApf{S19v3k{7?SKEE`F9Ej0ax&`tbYe__D6<e^2-Kl2wk`KUjhk@
zQ2vcEUW$_pcy*G$LcbD(aZZhkb>P<?R*LQF(+4%s_9=bog@t@uv_qk+k1Nj42yNJS
z#~?|V&OLgK?eYm40;7OjHSx3i@+s{5{XV4pXx=BUarx!zx^W+~scOhwHMb2h-r4%J
z$^O2!8-8&TwLHLVC4?M>DmF>;4qk(kO$pFriw-hbr=e7ChELq)0FgAxcctnn4yITl
z1-*AlX6U}VW4^^A?e&%puVc}*GW?^#q?d;hGEOb(wUA72{`%h)v`p|altxu)4AWRw
z*%=EZ^B<6f+);9$Kd8rTph0_7q_buAl>G+&9l~ydW%@gbbl?vrJy}2#D4s}hFb(FT
zo-HuY0*h5af-wK~ggr9+9F1So9Xkj_+`{1mod1J8)<HNWZAy<bP-e|4XXkSI#Gd2*
zomNQvemaPAEa4h`=yh{wQZ6bZyHMy~7^S^q%FRrIN=1|4oAH5$38M9YI!dpSZ^Px9
zhL2LklsM)9=Th8@myZ3*ItS#)d9|ZjzAX|n+FS-VeYnQn#pE!5;8DhoXWLKph2C05
zs=PAxEhGR5MTL>-zr9cGruTlJeYg(O8~&t_>syWNnlV_Z>p>fbfHGMo{N|5XuCxcZ
z$e8y;eP4kqtdh&74p=WN8ar+m0_3A~g>^lI{s(oS+BX)6=+Cof1$m<^5Jx2kP9hoj
zA12fUVc`-&Ihhm&mzJf!-(MntlxUF*OmLu=#Nj~ymxKS8hyQoEBPc6EbX5Q29hi=i
zmIBcMuhAutKg>4(P7I|II!K)34If|*#P@$rXwW(Ud^xe9rUJd~QQ&2F<QF07D?Y*Y
zLzF{Ero56hf-9LqaG;;sYpHnfdqzV^9@;%Nk*-(WOs>4|ExeP=28jlFe>?Yl5L##*
zMEaf~7`&21DzfV(<rms^bRyJAb?un?;-P;g_ewVj)#GcHH0NF#Sf6;mZlEPl6>)^P
zy+Nlj#1<4(p|~0l{NZbqnQ6O1i<ce6lq4iMDfo6c;-j939k#w)yZ55P@zuX-l$2zX
zlF;XI0YkkKPm_O9d^2L>3JNZQuBhh@_CnBbm{&&}chOVr-v0SJRIG%fV>1d~Wuj&t
z+u7OK4oPNY4>TW)qy#T7IJ$(vIRH0it%z2{ts&xE#j0zJvD9(yJ&L>}LclD2<a5QP
zShztj$Bej$^fjtYBb9w#fn$*v8u=qRWnDXARG}wCxeAZUrIHYo{2NZ_cK^LX0lELZ
z+=Wpk9-JJ9My;X96i9-+4Ia3!!mHi>ChI4QRVK%T5xoB9#Sm=<vqNze@{$e6Kjo|M
zJ&4+9)IVWaoWzu^A6bGWX)4;Cc&yu!IP2s=eV9K?4T@D6S}q6oanpvM#DxgIu6Fp5
zzc8<Zynf;SQ+MLxU5G#X72!pi9iOQl!WU92=#zW$0)7m>Xb)J$_7w3~yQ<9EL;4Ho
zS&<*n1)>-E=j@oOJc=HPsT3WCGhYup)04~5nVCfvsB->lz#SmoGb*t5!op)KvfDL8
zgl0fsc3IXWkuxl^o>)`IbfExox%~1yM)YM7_WSh#Uadv`D!W-O#OAy{i$?SumT}@V
z`UX|mhCm^;dBwShM$A39Yi|{1;P`l5S(LR?8P^wG7`qccm)i3Xn*0Oap3HIA!Hl>Y
zvKFzwSlcg)E91Sd;Dvg#592&Ig6xt0S;9O920e#UZebj*1i_bDL<lQ6RFhnCc|!u_
z1=+Z7`(5lLiv+yLqyQMF0jxWk#b=Gs?*^`tn3EOOzmhUPWns+BTNP0K<$EB?g81cO
z-72**1R#OB{INE*7~{HQ{1wLpz8-*IvXDbg5lkz{e^1F3x}JR^{x2B*JEx4Dj&89m
zg=DC3%+^WoDluWbK*N6$HcT6&6gyg9%8!)OW8HcUASRe1;Mt7ki30jk($dmmH<OW*
z^b&|GqzIsR+HjKdT{opT+%)0`w#Qe3f!kK`Pp;))ZUab+9{SFw#v5s^${`Y8I|!Bf
zs2W;-;_Zg#NptVcwg#xdzqntVDu#>-scBe_0uZVFG}I)W=SClUVL_s)w@1IK2Z7n^
z?Y1tkeCf5xwY!a(EFt6v#laF4>GS^}_HZ##D!+%XzFo;m?M3d4D?vD0MF>(0nd{NQ
zu<9lK7gS0HA1ReNU$=}=KRWq$oX>^qImk!&;L$SlaTtx7LX!;yghucsjvpg$%#epc
z4>Mx+5hu{CPjaAIl%BM3wN}6o90}eTTTo^P_LR>^V;do|x!1mnB&Uz&hN$fMTR4tY
z$mm6mguPKGyw!!s;CHoQ+?zZ>DWh|^Z)<W#KBT{U(q=^eg3-sQ!N;=gWS{y#r{y7S
z)w_-9D|KDuayiCQ_7xNkmm39vZ_HUML6pNw-QU8uu<SJ5G*}MHx%97Ld=yWdk*9H2
zeR6DpL5t*!WUixqrm%)8kGn9U`QCVOmJX5iVqleZG_0gAzblXBnvgwJkIX;rF_kAK
z%wosZi_K%pS9z%L25^xFYk@AeNPpU9|2R4lDg+QTeEY%oCZ00mU*+D8T`PCr@LEHG
zu<G+inWSqn4s?>N{CNB#%mV8A#;^Z|YHQHC6V$>l6z;v~gnLkTA?12VPMb2D@H&C{
ziQH&lELA`9SJiHKq39|i^Lq2nM{Q88^-!5mBAzoIvh6FDj<UC<@YTzRg8f!WRD_Fn
zO1P|d1u-;1oT;e`1+dsWqt-t(x$|-0(w+RT_hLLf_&ih9MNNqyA!)qgIrNvWSzId1
z0#=eCb5(gSz$2n%mt6JTYCLAp9nj3z-=DpE$7NxCCQ+6^7yH>5sKwp?`;JpmS#+yC
zTk8CZxB33D@IH=vf%kF8$eScpfg-X8*)I|m=t$Mg(KM)u&=1jl;A8^Kmrq+5(Uf_Y
zR+i(<ce^u2UIzt7L+6#@Yb3IHc{^~VUGnrtBnefS6Ix8$*K4_87?){u{zR|h{`-Jb
zaWv;^Aa{Pm5|I!_wdAlJlcCIPo+Z&rhqkQT?D8TD7#a1QO~1e}e+RntMnbh@n>G@q
zUgzBrZN#)aA1qwZ({6m~zajIzqE8rc^1!@RK@upp4mzq))wIMIVcB<91R@6WL=+&=
z{9S9@^^zy?=yy84UFiUrDp5|Xpr*R}G4`Ne^P}%y(P7-(Hv`rYi1xx=^Gx%D*~tSL
zOCIIE@hT(t4P~8INuQ4L+<7jU7trFdxgTT{dx`b^>pzZ!JSqba4zUZqZqGr)uxqO@
zu4lQ+LRGtCn-284O&V@c4v*p=dVYsVD`7^19}@M_ZTYJx>PWit=%4c_sR6)fg2SHT
ztVBU{GkJmoNwe69Hktx+ZUQq%J-^~@t7dvC3%)lPS6tfWC99l^Ht|Dg5>()h09;7h
z<zr5spMOjzljFEE4?5Ys0eb*uWH=>VLhpp;_-GcmW<Ier=acbb@ThmIaOW4Qpqd(P
z%dfNgmmi7Q)Q8>9KPFMeuFvM&LnF4G%N}*IS7na`n=1X1vv}lHE>5TYV{>qMgCV60
zD=G1gYQ)VtIpg{LG!O6J-~l&y)>q;fk;HPwNSLi6;iiF362b%9FMJVas_k_|cwgwf
zL!9EA>4<*&#+=<Bo6oRe99{*#Q*`+z0sCH{qgoiVAa@X15OY%Gv#NIs<8`m8(GB-G
z)IFu=TeS4O^G`P?=q?DZ74#Hf1)r)XW3FIvA5~agZi`@)%A=jqS{^-@q9KT?XD?qI
zeNsa{${pdVCjK`f9GMserUKg53Q`YD=}H&;%o;0iHqwJ{_v%A-Q5ZCvznwo~Ep9A@
zQVyzTF5qQD8$m|I!WWNa@^O-_Fxf9jie#A46a!y91@vPg0trbrjtaT#I5Mf#GjT_?
zQ6cd8yWRa4LxxQ!mOLrB<C>kwpV^R2aq>ovT7TQMtEdY+<tdZ`nO=BN3mzBtEGavx
zbYZ3Cy<0Q0m6Lx%;hdH;vX5ar!ztl6Y!bQ#{XC0u4h3C5;B&&)WWC|k{x^|>q_<!S
zeIy*^`j~;Q-n0vM%8ARrbq9j!pBr!95N5@BdSgfRXz=Ve3SpbZ(_P+2$aHgNhT}Ke
zW(9>KP6&N#X2qfxI>f3pnqd(8t%w#s(4fq@!0x55QknG8@D4mohuj8dS3m0r4>4>9
zStG?r3ohl2QKycWO=B9NCw@3Mum8q6L~W@*Od%1ftV(RuC7oN6mM4Gz<wCS@u_nL}
zQafI82Ktu$4;3_UkGZuag3e~Hq<KHrvLe!LTAQbGld#zTJn;p9(jpM8v21=6J(iD~
zX<Mh%j&Y6_kvJ<Q!K15ya~-<U6~Ka?%NyFA3+uR=6Mlo>Ka`3MH<7S22&-W)<cE?Q
zYHyZ%l6^thE*$;N&^5y?<DRfMxIZA4(~~aY9v|Q-Ox@=FWDaP4B$qLRS1~OcS|@%T
zb3QNOL;pE~bZ_}&(&vNY+kA(8q};kQ>up5ZeoeS<p5hVPM)~E<naT0!q@Rj1>SZHN
zHzHZU?HFsMLOFKE$~lRWMHH%|_d*g|<>Zz^UsA&z;{s7s_UjQ1IHI1MMo2`t{_dA$
znQJI(y<;8kiIDXt`R}~zS+Lom`pyA)O3Na_Z>XTAjfXT+L(vMj!5Drlya&QvRT%i|
zZ4PR)*_DB6{@e;b3gmPahQbaT(X=1Bi2gVlL$rZIXMp_kr2iK6eD~31ENHyM?tp)i
zp}>f*`!;Hv-%yaPkF4JWHsxvZ)-S>mf3o;M6cXRPoo8l)Th?8bXG=Wt+Q=HW8`iu?
zc@{!_StU<Q;V-f;2au)@7Z|GQ@;}NuVN=!bHfKabZ`Qtv^m^k)>yKV%oTA+fbAR!2
zhAPTOpy`dIbZ<tgt0fuiTfibCyW9VqJUBa+E>K*NP`<#QRRGHCtKNV2&o~o}NJ{hh
z>XSD*%YwnlGb5|^U&SJ|;!HCqGSw%~n9o+u%PO@3U2GINSxE6M`js5aW*Y@Uhm2a;
z-k2~)=zkL#$_key{`DkNe9cuenojnCiPX+Y8UJ-_0GWk|cLTs{^fDR7*JT{D+$-d~
zL)tAUzgY97&HXSXlVBb)GWKhixxqf$gSEK^_1k>dMt5Y{XL%zLuge8aULifPTz3|J
z(5fWdM?^XO)o0KEN6M3|9XCw^VYKP~Lr8LC<S1ov>!B<56nW7FSAhfGjI)>aR3M)?
zit(DGhvU6R{noh7Dq(I;R%^{-p1dX|&>=F=WR>|V-alN_=hgJ|4o;nl<7(v`{m%UX
zb0-z$^RBNFvWu}54sJ90z(u&Y)EkWRoCH}`_^7GRKLqj@(Lq=P?lZNGh#8Fc5Ut_s
zGWHGOPKxyu^nv#PfdM}lXP<N-55g6i$9Xu}Q+=#}X(S<o1(5eU(w8r5NMAax`py6k
z<SlZhJ18P3UdXRFBP*^0WOQ&OG<Ui0_+W@6a^Pp;hYF|BvfS|cdf&+Mp2B*uW)$JO
zv+o)rzgf1erzb}g@OVi(ya=d*XTA2$Blh)~IXkXU-!_hmIYL_c(d{+(`gzMS!7p-s
z&wDl%EEM2s9T>%EhM9+5y4brotV|wyT@g}8LP_wTxBX@h3csP$_0TvXy)C51*hL~%
z>~MaKBxm>eddrPO!wb9vdPA}BGxtALkoi$a_l++hBOBa1KPr#~Q;VLSAY32KF)`ZZ
z1*hxKO1)D%uip{2GUrP9odCpH)Uh9+PWj%D@ivp4J-nkS+k97w+mVFI^9w5RD-`9!
zC$VVG7CHg>LAaXOcbd}SrXTDEe{iv`qI7zm{PYxbp&l-JqRe0tqnDYy-WbueWZ<OT
zO!&Y=G@NC*H>x-SSZZmg`-4D?qm!&%v^b<eL#ru<jMFNq#Xi(6V=RF4O&|LK*^KyZ
zLNqpvM98?8PSzg>%~85eO1SOv$JcfwKBw(CIrZFuOnw`{Y3bz>$+E%Bya<xcBO`du
zb98b5x#OfP(r=L^hvIaiGQ1^^9Tme^E=Y$b<Pv_rC=os7v3*~IDph>}_Ar!Kw^yAg
z;`7hGOJiEc%)Gubcj9)6tzhGDUPwirMmiu5r`t#yQ6HFll|2Q<5>a+b+h07TZN`Y5
zxo_J&jNk#fajycF2N726u!6R(nanx@aOs}<)j+%|7df+Byh=EO%o`iU;oUkEMU|d}
z^U0!Km*#P~1`pJg!Ss&{e3=Ky;MDpv3H!}@yiq4HS%VM8GC6%LmqXNrN8Mtdp#Bo{
zwg={2fXaegS$XA~@gH#K{N+d8iu(x8=8!!K<^yedfHXeU8RR$R0t0YVE{^qm=<KTm
zi6R!YK)YC>d017R1>~xv=w`)#EqLZ>=T$}&SJHljUnNYBE-U~<FSmB7gLj@0odEm{
z-}ilys)WkF>n(>KA4|HW(eE`jFl+zd9?Jfd1;r|{LX`y<2s?0*b<w|Tmq?iZ?_Xy9
zaBBUzLBsS7`-y%hr|3rP(`$M`kw5Zt9Gp0JC^dk)709jn$x3!6lMLqlT+!L<4Pg-Y
zo^i$u9BRQ)n-LCf)*quWMq2Msz{yi*BBVI(H(f+rIh*fq5LV^l5(}>kha=TkkAl^?
zD6B2j^4dl&HZ14?5==K9j|PoM1l5abSEL5jkJB@^ztJLb4`gyirE>O=pGu^CSTH&+
z2YcERkGu$jf0XqQ#1#a*@d>^7R-CI}eS44sS+Fgx0{hgXOzmi_^IWCmtPm|%=5`^9
z{W=4v>^mC8fTW)0_$Q(PkIbJ1<q>NtJ6gc}(%f~P9h~Rjj@kIxH6E`o**p(eLv6Dq
z)oseUNU!dP<lye{Ax#r*p>KJ6;5-C-|2<COt<au3IZn;B;Fz}1nYA?uXZ2u=o-{SJ
zPm<r%OY5;mFv|iT=+_9SSkcQpDt1AJ2=~?Se&n%j?06AIp?OK4csxxcK(L|=-tec{
zn6hd-E764m&ZKJEgSmZ#s2;qgH7~Fir1NFd@fef**<4CjyeewEtCB%O-|3(TOmxhv
zl1(9Pq+Y?dd8$~Q7$FoTEc`1}Q1EWM>osGmUG7k5#4g~$KYV57+g&}ATcw{k^A@^*
zW*TfVn{EB$Z-RfJ;p2NxL@($~`J%>1^E{tqzWvTIjr(4BVqPKaVQnah<<GZ<lP_tp
zE>vUGsa=oU9{mHhRxgIvZW(l$$#7KiX+KxhJT6ak>;&*qVb5pHC228@K1=wuH#oi#
z2KT7H?OQi?juZ>m=f|%tp6aL|$chGi3%+9|VTsU4wGybRC;8-k16_=9Y?=Ax@2{f6
z6*WDqDI1nu53g?1FqaxD^5d;#P=Qrk0?#V>zLk;&jXgxncsC~=%SRR4(LmDVQfTa1
zJPw@7<+Ifm54ZxEKEs6ake~l#5-6(2m`-{Db1B|57W(LzlPN5qljGQq3&|LEXQTMw
zo5>^iu|@vJp~1@{yzT&TZjfMVp?!>F`B4YQ?Kx1{M?*ebt-+e9-y?<j9t3>Pc+f94
z5yS573M%~Jz3)hg-!##b{NWAT(-~?C&@|SY-ZxB3%oC(SFyrmKKd^n#FsPZm4X;SF
zG0))9=={NSvl!Tmzgf&t4L8CQtI#)uY@uAIb7TO%rj8*-I(tt)Wv0=LTWBf*Pr}fI
z2)^ftGCkp)GT9G7fXs}1v4mp8cu5l*lDH@#5ujZdUrM+SDEF_R->)ppx4`SxUtd+_
zteF~sc9=(>X->k4cvRtvGPlZivs~az1kn$05@wX&F;ShruhjT?`rxBquAwDFqKlQk
z-JeIofGu`*JRCBN(E7|To#D1n<S>I<*Hgziw=RR8JYfkTep`=NIHUr2AqcfGkm%o}
zxd3(B-Ra!l4R_z5+MspKNxhAFT}uo?q0XM3zUzRV?B@IR3gGGTX#s$M3lVcy076Hj
z(8V`zi_@q9tFLHF?;QwPRv~IS%I2!~3thhpA2z_pQ~`k)kW@j)e#HluBbk2IWFtnH
zUSGiS1OFV(Ft>DJyN0<RW97HO&w&%ea$HE``v0{~R(d}_sbD@tMCmNj&l)F1XUv#_
zWrm7MI<Q31hP_B|67WOl6L0_O#m@iv>mbdTCx#~Hh$q_46pt1*fn)7&bbIvsZrCz+
zU!J{MF2IcTAVJ2Rq^=6fh^-mqK{_czfhp+#2*i(3RXM*qo9K_>k2)gFDnMdXf!a4N
zsOmQP6B8R}hiSiH(JQ07qJhif25RQQaM~&_3e1=eje@*ShD{6DF=j!kS7$b;Rar-)
zc~Ef-XkiL<iRv4aP;5ZmmC`{0w^<4YHaahIVsLsC5g{pEK{h$w4>5J`eFr)(9J1J%
z9W`1jyn?o3bRs9}<F+oDmBwZLH*zi~ZZ4q#tL~L_T?*T|t)2H*kyxa|0a?y<otTs(
z1~1}w^7mrYg#~TnN}RQcA}$lmxN&Pq#uWDlD&}fK0bjhAKSYXlN1cP{Nny7}?{^b^
z5fx9k(CvTWL&<p5GcJGz3dqJH52H<2@|rv|zI-wc)a`>`NzBMTn{I=2c=++C*l97j
z>b48(61E6DE?6OJDb+^B_p6a;zTo=NghT}#{awRMXUo{lh%VsQ4PVr|2CX6T-L7RX
z4Kd>|c*+;Hellnk8AVoX?r6^Oa8byNF@KiWPDaKIbpY1ihSbdFi>i3XzTZ@J^4fC5
z&#6yehr+1O5;?ki6DxicQ=B&-e3cXHk618N{wDYZlaGHxq1T-$(*GZEcdmn*33eYo
zWh@zATLC*=v=|E$96edae!Jw0Au3-n)hXSigFhw_e%N2jJhezt(OZx2uYVCZn=y*E
zFCk35Pvp~b6yZs^FD!M$BzK6$A)gyTkEC)vh7?Swx~}|t+3#J$K<?Ce@XLby5JT6X
zJipN+FOt>pi#Xk$_jin~p5p5hyTLbWf{}4^7b*3)zxtVXgHs5?J<uTfbTy@Ye(?pc
zUP$|M9`Qoi>?7-r*g!tGsI1D+EiD!*b~+O+onhC)nlgHPtO5;pJ0+%V8YVF-Pw9Op
z^^+c^cEa;6LP`7BG*}@*9KyT^qfVo?!!N=*?py+150g?a+M;^%$(+~fkoK!*kB%V-
z569x-TmoZ0q8F}C!kP~B%tuy}WtMe3ZmEQ-I!Rl;rm3xUUQfYY>^ZTVlqqJ2@q%f{
zRzwkigVA0jX!*JLuD|%^_3zC0JN&#nEJhy+1_8T=NZVn!$!{DdmAii?;qJZ|nS_nQ
z1CpJWL}r(Q*TeNW8=_>LrgLWEe+CQs`4A!IzbYIRT>1yv6heXc2dlWIKA3=*X(QEM
z9r$-Zxn&XZIJ9;tOv~T#iIwMC>OC`a0zpSSd{N@6<`M;(+VM)^%mS*M17dS)uE{Q5
zqhit}=;|Lqdy&2??e|c7pPuDR$u%^mbyc`wHYs*h^u=Y5pWoh7>oo~&tp`RrBVUxR
z6yM29Fdi*v{8teC2EHERzNr#RZu0<)7TN@fLo?%Tz=opm@N^nJz4(;MNK0a2`BW3j
zsgx7YrS7+cr9NW7l?><2v^xZZ6JlpS!_Zkin42_jw*c0`Zk7Ofm8y{WC?iO3>oAE6
z_rbR)9Ll~V@nw}KRHyA}BAB6ykWY$S!u8O2=->-UWp469LWj<-ntl_GXULd1Fav`1
zt5EFUR=|N=<!>NsGy~LiCbR$)DPPf+sEb~ghOh_Ys!-D=C+LBSp0vkHmtQ*oYMfC{
zWq;C&vZ$y9<`pZzeri1|ApUfa(P_J+`JGoYU{L^uoh)c9lfk+!ckoqMr@-Dc?yklL
z26A|ewY%;x4^?*kf++!jZ(`VByS*&WhMnHn_h2+_)c)x^fCt%wtOb!8#iKV}EEx}f
zw@P?J2X^gN9p+mJR|cAv@?MJ$)LXvhm)F0T4*tX^olZq5JGMz97DXQ9*X$mUP6I#n
zc08NZ%5HVttfCF!KnFJqsKWpq^bG*%xO{!GlUTXLSuq{ar7=uk-U(zk2-d3B_Al)H
zm_AtX{|7BrDjFWr&*fK9L_vS;F|u7-x`fq>+dtlR7Z&A%q#h7nU!ErC@|45zLL{_0
zGcw&8-_B_KOk5OUg#yE2z2h{VHcr}W5}=0=2fM7Eg$K>{?(damBxfpffKvSxRo~1X
zgy$mJg{Gb+jrnl%!gMD7CpKO^E2G{5$mQj~<kS@Zq{XH$`Ibe?O09U}nNdN|4A(_V
z7gAq$Vz-3F!~x7`8)he5L%<sSr1`$TgjG6>AlAVRQ`quGP_rx={nQKt!@}$e-S<^O
zx8GdJ{>h#9Uym70?S^kuCdhVK^#Nz(Kt;1VJabO}t??Tgs;Y1SWC9SgtI9t?CFFb0
zy`v;$XnD%HCEk(HU6p-3esi!==1qz*fXpc|eZ7|ck8{H*9u*04;GFPyFzI79yFNis
zG=G+~tnJ_M#<f`^LbizDWc^|M4=X3B8O9vESKGZ`p!jAZ0uI8@1uTzaV6xoM59lN`
zhM{T;dEY2h?kq6|w%-75pM8p3uUSSU-~iQw7HmMn`w7T%K$zW%MJx6Y9QBuv)u0EJ
zq>ZTW!Wc#$iIA|vM=9D_QU|YXz!sm1b@LU$<Jf@832T7ZMQaqWRC`Rgv-pX*O|%Z`
z;x9vk#k=jvHo}?kZe%-#Lr5>DSOlNucBpA5j&74Z+UNCA6sXm-WW;jU(R%lTPpl@L
z<S!9*`znh3!Eu1T9u&}OCFdM}(7k)0;l_{HUJe74Vsn11{0%k%C(HY^rNR9TkiBjv
z>9|f!IZ`iPt$|@k>y)~5xvFVK59(5QRr}3%iTJr&TYW1>s#;RD(d~b=v53>_vx!MT
z@3L~3xdZE1NR-4!uf`itfh64a+wI|yB^*=?LCOn%g7E52m&0}}){6s0i52JyGWYQG
z1DhI?ZkY8H<(;$axK{lW*nFz$e2KkK-<j2(v@!iCvZ_~*%|6&%D64%ZjVa}p=}e5z
zHgnHt#0sGF&;@UVXZI%svtZ^DWbsClqq!Q{>p)NWnRHl99iCMse(+KTBiw5^#?-#T
z5_{JpO~57{%I9J4-rY9&!JF3VGYaPeJh;?qf8`-gw>vE$Ql}2L`P%_A<0*MWj1DpJ
zioz#hkFw^{>Ft5Pzr<?vRK)k}@SJZ3fV6aI(K*68GwlKPGFNdV3)A<yt>5Ty-KPe|
zKWOy5?F90XVtnDv(L_aJu^i;i_L@w**#Pz3$OjH2N3Ja}(QBhF+aEY<$6~_P7wku}
zLBlfk2E8F$+buI27RbUV!bjCa1Gjn%2#P+tZfXQ_4*PVJHOPmL#5;HAB7$Hxd5G>z
zG?Y>rgl4G2`3G6;4Qb!JLt*ksO{<?wFjcYNy?P|U1Yudft7FpRzmnkOlHowFP@sUQ
zk*uZxPjJ`UAzm!|A>m-Qn1Sv6{5Gb4=9sd?$2i&(v^w2ADWn6mysGzCX}$RtMaE@E
z|K6Y$7q?k!^x2^6AqI2>i<C8f!E=pZEjE|8X>fhmd8BJM4;Bp)K0d+z0p>$FaD{>e
zFv3UJoJP24+FmH|TZ;+Wt7H#<&Ogyas%tWFz8+uaX6PBeR?zABb-5kni?Up|HNb0Q
z^fTD54c6wH7*h?pA~66<K~@|e)!_=c6?61zXql9w*1#Sd+C~zM>aLbGETAZNedd)p
z9LUk~UET(ev!WYe>Ibw(a^Z@n{Zn{(DQ_;G*SQs%d#@s3`13yOtj1}lRuz5C^-E!S
zWvD?RTE@<Ux*n==jI5w8nkL5N5B!4IU|E5P;XrORtQqGGO8<PiAGFBc_<IWW)<DiK
zD!z#Z)11)xhW0#oAStzpNlw~}6y{%d7mSoCxZ>pTT@l=murTQmuKpFon4rqK@LGtz
z)gHWEB(EX;a15Gz{XKANYSc!|K%qp4DHoHW#60pD%p&&#Gjk?kH{6D{eY4-YbJ@Ds
ztxIUc<^`#s$FVH$w7faRG76C8Gj`llf*<QNBdV?X{AN`h8IyE{Gg5FLwTCbLD3CYL
z))4ZmXBhBHV7o{i9chr%2u^#z|H~sokE%0$fW;t*U*N7&VucZ@+!Zq<B&M-mCE-G+
zu|n7+69!K354~>W_su)b0|)<4yFm6tK=VISKr*;45FgBz7|RVZA?TkM2Y?zOyPN-M
zM&(1FVFcI9L=`IOf5Cik$6|cf1iWVb%fjSa)<T=7dA;ua*Y=?Tq1c(ts-v1<F{es@
z<94^1@UBrYarr@{XNZ!ZemE&Yu_cy3D}N{K>R}0?5F;418l~?oLV^+fJbJ||d({GY
zJIFZStt&4C%D7W2NUacH12dWlpGFi0c%hdm%!>ZmQO}q$n(q^JVUIwy*S|Zff7(@2
zoP%&kCQ#|93R25Dw2wHl|GyBDnvOxt$G`0lVLp4^h%$(l|AcZf{XtS?)HF5Y>zDm)
z{NOdz{*^Y~mr}q~n(d!gYRuQx@UJmYDkc3CGksQADZjNpmSw*40XZKW?gN-Yno3We
zdjLZ{KiF6Qhp@K}isRk4y>SM2cPGJvyA19GcLoTqA-KCc0RjY1a1FuTgS$H+xVzuZ
zZ|{BTob%pWZ&eTcK^0UFJ>B1DJ!^dywHQvxHsZ{SE}UuY?2SEE#OT?5rDK$s!h2Lx
z1;EH+h-J<Z;j0cn2<kxQaC+;w;&VZ?fkzE{GGY~(Vv6tA1GyGU>75?3OU=uC#XnPH
zO`y#ZY=vFJKMnXlAyx{miF<0o%8O_YQz^0ntg06;%p2X>dTQh(c!OHW+-pnl0yaSM
z`9XEm@{c#>KOPwvz@!2ultTs{wc-C^T!EF9(Z{m*gO8UR%;<99_3BB7e?LUqgc`gu
zv!p3hu9tpR)tv4=7OaFb{CuZj!~g|sq5IW_E$y-|+{9;gzm_f)``p}0RlPfXr2&jn
zMPfQkj^IMS!N1lf^Jf~&Ib%^8s8pxXswBXf1H-(Q%6JF+nCgcea;-I*TjX`a>2%H`
zIi^p8#Q=a;qym6+Mq4-XeEEi1d9-h+=H)>eA;7wVu47bLL=_lba9pr-Rr4{%bEHc7
zdosX@VT;+OLRlk_!M&e?>i^$oHxL#XDMy^+1$i7Py3lL-out6p<QIIm*aT&S@|Lwi
zg8%s>Mny3qrw(uj-D66#U&%lx?q$sj(KqkH7vTA%$~(<Hbt5iG?<U+>lTQn8JsM~A
zVDDNU1{Si7MI!~7<eFt&Cf||Hfeddg+Ji38S@=RVkj66ZndkU^2GboHELuh`4ez$&
zF9|P+pC>(I=Dg~KuseW@8XcSkUi1T)MM$J?`|m}*B?J5-L7sjs<V8BD=Qb#_9t|07
zKV(IoQwfiuTqk^c=*ByrMaG|>e|l&EJuVGmgpRi)c@K+LvX({&=#I;w8zHQDLRcY@
zLu7yI6Y$Bnr?YJHKOn2HQiR_$IbEp{1)H*OyO<pP_DsK=JTwvB!J<^uU?_S-HSu9t
zb6~_z>#|-*5!&79kjbz}r1%n{U30x>T3m2<5(GoKUK$<FaU8_|3=cZoW(hGsusx5N
z?-sU!?Yl<V?JXt+bU+JKHC|HZQJ@IBG+*Eak2UMMb0CNa@(6Ln`}WNTM%5SE6wbD9
zw3_#Q&)T%|SqA}vXuRs3H^TPAegQzML9Y^x0pX(%1Vmqgw9s|0ZqqRPuOkl3dPwbB
zgSSID&2;JbY;uv*=V3N|7O4Y}EW2g1jC_m~iCddR)bxj?_Cqcq*b{x|>E0zVC+|fl
z`Zr|ruigQ7CjeE&!XJ_ds{ZT$cqNDU_+YpB1{XsA`#LCk*y9)A;HUGeeR(=75+fu@
zGO_wXk}i|_igvVc7$XgX+;zmSboXKBo@MJI+$IytV-%Zsc^<MD^<g330d;=BGYF%6
zDGhppR{)tnhTurcAl^8&D&S#FA;NE+S`0T>Q)QpQLnk||y9!9_^~oR22*VJpbA58T
zhdCO_<GLYICf+xBzA&z~SmjC2Iu|qQ!$ok}&ih`Bl2)y!h&D#`x(ME5vh5sWfE9)#
ze<vO@Y*!xE6o!tT(+*=c8hiIxKP@|E-|vDUv-ifK_hM(b#yOmP%os)L!zh<Hky1kR
zrL(*}lk(!)fF_P`d4B!Lgg|IfRW#;~1;);G+1YUED4*9GsLybecE1w3${!42%FziS
z&sAlByR>Rz#T6eTCp9m=-+^*BSatp2XIYKUB0~DQ+&AY;nbq)yYCfwFG_GtW|5d23
z&uN&%`V8+Tx;A>Mueq^6HF*h9cYIlE-y(mOrK%ZUL9E?T=%e~Uo=id2d0`y1_xBqK
zmBd=_g_*Rf0*5MHJT7VzbM491+++Z3tvoRLkq*zYQPcS&fbo<-)ipt3-9USaUl+0$
z8+!Vh)Xl(~n7L2g_j`T|LX4PQq@&9M)5%VoL2N@HX~Iuohcf4P7r;haYpigX7oUSo
zuwmxB>5oadEZ&9CWc(T{1}D<NU!jrxZsmGC+qL)u6-If%xm6+@csw#OHJ-B{%XKc9
zW=h)Hsd6R^WpZ}<`DvR4#iZ^DnN>1OW`~TOU$m&R4S#h0Vq%-@?-wln19!%ZeBE~<
z%&R6LrjGBH^H3B0uu7MOl8gp<aPrW33o}VfY<4hg;)&rvF)<)D&kXqx+f^nMx8Cr)
z(CQUxC3LOaHQWIr3sOT1s;uQ`y}k*n2}Ab#cCOzB5xgO754;NzsqX7rD}SH0@Gbb#
zA(R?q7EBzv3Tn4NIj+dG8rgSgQpfniGp?E<NCTzG3$3YZK+Q_QA7F2*WeT)wE!1gZ
z;Kw<tX-l5MUQ;~>3Z`fs_H<{p7wIo#Y}qhc=Y+lfz|S-M$2<$zD8Yo0{|u4z7#EcP
z9B1<&0Ew{uxp*l3aiPwQNNGgNbactM#&1=xJU{Y!{k0u6YyhU~1=BNBTHq8T(!`>!
z1gYNZE#FCcz@~^vZQ2&GH|FbaqP5+tyv?7YZZ;<}=1UP1(md&jk9YL-goZNk&y^T>
zMUbi};y44RkV6*tm8N}k-T^_tMv5biKhB}(c@gxr+Vj%6&@ZFQPIRG)s&uW0l9~(b
zR9XD36peG3WTC7e*fw6CUCtVqKy~dcI6`V7y}0p6T_dDKe|pxJA&xy>=UUo9?=HJL
z?}iB)?9Hy|VAw2at98#oiQ;u@c$17!;6pMVIF#&%{XB5=h>H@XlkbU$PxtG!x+I@J
z#FJJ>$8RyX=jC~lo?2lK-Fkj@%CCfXdz^KS39wB$IC)5qD?omf^6TDfrrm<BcbpFV
zd2Gn1E_h<#9{%GP?`WkI2Jsbn@*tD>4m(<VwKNB@OYD>u+ZtO$ihYR5F7`A(x4j=T
z@3cAeb4^&C5Kv8$TVa9xc^_}kCpqpg94+^|D_ZE!l&TNJka|mq2M4w<oIQ;z&R~R`
zn1QLF($V7?M+vH29)x|dB!*KPXJSzz=T|<pf$&FoB!2bu;{CwepUc&)CV|6nZ^1Js
z%oGGLrG$X4l6$LzM&R(lBw*>?+Pkm-bs4820d#vfIXk49mRyh}u6xg^r(l1vie?R!
z>dN;(6s=09TK54KL3cjGpTQ4qQU;%X5oi%63p+}D7#3+A%ECeQ`&9IOYoihtBuChd
z8JJuxoETtTTu7e!7z;Ta4+rnJRZu}~c`HE0^kL3LW%dujX;O1uQCD;V7W2;E?`aP}
zK?scg&S$=M>iluq6!h#vWx=?-7bST0-e^u&7y1BzEuI-&{JNTgxY)pLWTecE<<tml
zd&qhxjScrl+b4|O#?oILw(@8?cuvH2rKST#hJ<(JyI;<7S*(&k93yLnjHRDoek*oD
z4o6(rm2}|%{^l<<eMWojf#3*oRCWF@?MAB0jTqy}-`Pj5-!CT_+9R1(B&2f0uhHRS
z)6xDNr2cQ85dSfGLM0zh7!et<1Ux5L!5jX9Ncu8$uEpI755VD4O^EOo#pzSa+sc)3
zi-Du=q3H+{PbY+)D?OY;l(s59+p%wvCcEL5s&hQzpT@YjW#Oz*s{6}Sa132Mw*8=O
zxvO#;!|3NEGKp#}tlx`9XP0|eF*5c{al(I55w=chM^xK?4*D$i#ohu5lYX-th_ui9
zbrWg&uAr883bknDJ%rXLG%}NyttG8*mGhGwX>&}@B6xY#GdiRXG*)vb4%r@r4(q}a
z8pQQr#>#j*AjdHtfj!>mm|U~ZKEC5QY6`T;xE<mA^q#bbNYL9Nd~jVKX`3YlK3*77
z=uhOSnG(LWu;M#EU`MLH5X|7%!XbXDRGTK8GK=2bBM9BJKU&PT|E;DzJZ#FkFjdue
z6bIDgg@8anGckIt<=T1NNOgs7BqQm8j?B3{c~OGp?ncu2yBmk=!Ui``Md^uYVM$0l
zD+hzwkv6}j8I5;Lr&II{o;Al^+V9P`;o&Y3VPSwnZk7(^-snvD@*b$Te8noli`^hu
zrRFOhLum{}^GY40tImQr6*Tvk7@D;zB_EL6Wc46+$^F2qRj^_%j%mJ2gWGL6r-gVR
zg`lP4fJjaU=;nQ{-Z!&t+KMMJL2@Mj-0iyz6MuX7LD4Lx)P?Ptv*+95jThCzM#B`p
z1l}H7MhP!_-1M6uL>!mQFY&>wl&Py3|HIw9cL@MSi!KD;{ctu3=2@ZOHKpvh;0(da
zb^Yeoi{-0iaBbhob?utopq(Tw+pRV5E@;2uv_?S_Ww#vm>_LiKUcE*2LI}FQ6dCTz
zHDO-8#lu=~|DS1(91c1=u=(Y~X;!6J&)&N!z`HB?kMt)r82tBmvJDk|RwQ(M-v0H}
zFfRYhQ^S83_M7iWTdk*kd#=&92c7_fNL=m^cMUH#?_~#Ub^fJ#Y8*3_;3!6EnT@jL
zBk{Da%OGlN>{k-^jR{@Bm8MO_`&)_OPSO&o0zykDn*;HLQ4U5c!k#~+C=Nz7K|Fyu
zO$u+9T-L-qTj)=OO1gV7p_P`H2#;0!eg;UOs;^Z!$k>$zhDPC+uX4g!jvA<#*^s(1
zIRu}yM>mQ;S9drO3(nqdK<sGf8I>HJp~tL_I<FH-r9cX8mWX65oWGeRbcD-iU7hxo
zqc+OD^6h~)!?MP{g`C+g%lWZX_@<ai{BTb=MSC3NG_RQw|HEdv`f!k2vaP(&WEd*j
zKt#f<FgP0D-D&uQK5oyZ^LHynsqJpa51sYpIKCx;z&+cv+{PZvG*-dwjL&Gwq#|&i
zW2NC}4dEbS$_auR_10TY-vk?voe(W=PrIv_(#*;Z_-P4nLVhZ5@31g2+Hv;cr4bY}
z9|XOA1FLF@!gvc3tTdX23v*2xH`(DSjz~<3QTFcEHTv#jID(fu$@}1tj|$5FNHJc`
z+)%x9&B{#>X<7WTP*DM|{|cP-rLZ&R0E?+;RS2F|_j`S4f&MuVIty5(hmo3W%yiho
zHLGb4G*H&yG@^<qEwiGk@lIjq!mamERl6~SIjGt%tYXN4k3tmHW!K<JtqIr-E+{{_
zb|E~>5to?b$`C2s%s8eg{Dy|2kM==4y~jaw@2H^@jfB9UV=LzH%Es0UeJDz=ar0KL
z&PJ0Xsz|%U7rB|8)4e}-_-3K3RPxweylX(WYgb2K`VH&pWI+Cj+=AivcVl0}FYu+(
z*X5--XJ-d2yRW!S4yXli`meRyBLX+$>?hXDq+MG&AAY|nW;!0|DT?iW{!>UwI;+uF
z39Hrp%w(yQS8L6Z`r3>(|8xik8a``6nMGqbQ-<kYTdNN$&HLs<rzrowukv;F0Sfvc
zjG*)qzo1s=_c>O0(WmE4Rn{<szm5Z8P%l!uLZ9HIw&9qkvvTMX{l$H5V#KYw#^-Ur
z5oFOO^HIQNGqR*{$NxIfMg6H{rkc8tLH%vpK3YM0r1v@Zf#6YmCr*~|PkJt&QLKJ-
z+#pkIYbii1mz3s{JT@Op<QnSo{N5CgYN0`&L-1%vr8YxwGR@b<O1NVpw*8qSH6eTp
z0f`HN*m7c>k44@0X{pnia7OZ4@jZXC2J0??mgxNm-m2xmh)>RQB$7zqo}&m8kMi^H
z<2XC9;AwUP<n{sL-uWyU(gDB0em;yg<W$r?(;i|PjaN%pvQJ9aH*AD^xwb}fKre(I
z`$E_5pmgz*ltKiYq}@#Lp-zNl_;4$6pXY#V0WO<$Rzc42hrw+;Hf+I<CoJWGt5hy<
z9Y@#~H~6!gOLEO|$GAH?nk;X_(X5%_*^^Aj5+6p7i&~S2zl&T%r6*W)G0KE8#+}9{
zc+ASznfCQ_OKx$sK08MYnWJHMB8_Fj(~zd*R3hG?E(WQg^OTBz0C^S*DX$OQ_8|aV
zyWHj`#VCq=E<o%%#bBTLEY3dC#bn{rp>J0lTtS2E>dareVJrSWR&4(sKq)c&W6#)7
zA^v1FR543esCR29K^^XA1Q(acLB<<QDO!qH34^R=YNmI3b#aUe(P!6WH9O)pB0Xs#
z9<GOoy-d<_;%Xjy=jjiGPod;qa8y^;NX?*pxXX)mY%m^4#$5)e+fUXmG~tS<(cB8U
z9Z(x;@u7~GlBz@QG&y`CsT666qYu;yLw5^Wtw4)v{ERFaeF2KL5%2ZR;BQzWp^q|?
z0;;QQu$tRhn<BlEaDm7HI>huZV@{F$xA?yfTtJr1Q35g(+#r2EjGMOO2vJ&?3V#eB
zr1Vc@>_5>l;CmrJNdJxbKeVb}|J>4nyLv=-2VDru-8Aui8$MwN!`mF+pywWG>A%SE
z9C(NwUoagGAe1Fsw@}558#x<Zy)^)K-YL3^m0C4bh+Ao|fvnv8uVpy8Z8$8GXC8p8
zrw#typz!pdPg$Neb*mu9H{N&a|29OeWub$>ks}2j$SeXn&M&GM$pAWq|NX%u>t3+g
z45Im<d+T4nAnE5i;#*9VCH__k^*$@590243<dm4Sg&JMFh9IWCv5XHz&xU|NR6rH;
zRp?f0W@GK1#3ONzCS5lT$ruIrfiPx&z<gq67%Yh^*420QZe33CVCKmz+eT;N{VwS0
z=6hnYPr{S{ff`tj(3sd02A(>bk+u^CYr*urtRq2u$jfPdVAk&%CT4I)&^l7^HPRIX
zZ+Um1Kzv?G3EVM=O%~bwdxkWb;8=`nVDxdXAkN!#Hg`e<fzzS@oceoNQ6nsRi`!Pf
zF-hI@^)4sm-T$2S!r46&5dR)`^T@zkq;vyijd5Jvw})?&N%_u(ie~i`E2rn+t*vBC
zJcffnV<#IkVnr;RA)J(5zL9?i|9h9Ev!(U46L0E2N_bu%6Uj2OnN-#cA-vShnq)*$
zvXwKw3mQFQ3(+cva~r)!K9P3ifTCa=1A}ZznktNfnWFacd1}kiyjjB2qEAY~9)7RT
z<Zza`!JS|W(Kilt-w-*BRL)O)=>Y3;=cwRj(9iC?CFS1x$Ib6;oI(_>Ql5*1*YTTi
z{VmOSShqgs^c8q?=T#e@j#<e?StQ*BRg!Emw~it+8-f!vCRt{vItj#QtqxI3lc$|d
zQw2YJQ*b!%z;U}sd<ow9*?4M#G^-@f=eCA4$#yt7j=;8Lp_-8p<2@6nA1C5LZXCZx
zUmqju391A3m9EG!xRvwvc5EA`yg!Z$LQ^EGJAd3Y62cO+{qre!Hdq!VzKcblV5Rj>
zX!Y*rJ?d&=hc7(?5$vR#GXY6s90ovi_`ZlJ1{36lKS%S_F6v<Pt$x)r=y!@yR{#R6
zuCX&LjHdw(6V|aGMZ>CbezQc%Zb>w6<uYH-G8;TzpSlD&7LYeMpjRW!L0}Ukkl&6A
z7bz)b&Fq5eBI_Z5HF2?MIwNX=?1uOL7P!k1j#E#q0qQ|W8OQTj`6<@o$Q#`jaj2*$
z)Ks9RWo{P+WeiObgj%-}zlvGgeLZI{gu`RY=`n9$sf}Xv$BP^q^4SRS{T^5h*~XV*
zIdi}0+Mdw+RI?e!Mp=&N5RSf8?o0e&HL`dIPclbXROA2Y4<Wj7gg7Vk*XkfC&(igs
z?Z9neJ{@n$JvH=FBvUUdA2<+`We*X}AX5AQ3yGI#CBnw+utgm*lL;#1tJ6wVpc(op
z0G`noU?u|(6%aI<9m5Tfba{}?i*HDOK<<=+k~LHPstTfzVKXS;YWQlFn8_o3zi2fe
zM7-`FGF;(A+fgc&VhMFrv3fSq0p&_zIjJechSQEu8_tgX&xXK%-N81iuwM2t`|;uR
zYdJUm>>*pqxa*LvMpu;fS9ko0TZR*aj{i8>Cw9@&fDD6Um>f|p2m=qR|Jx^{uv-jg
zd0=8GA9Y;&*h&u69an)|{YgO*LmbDeAJeJ^BNLskAdbF5oyFcssFec$By#UKyU1@M
z<Oe&(AL)l`FP(rA=mW5gkej1s7+94``Y~Yt4-X$1XTS*ug@#3IC_qLO>W;!ZbbxJJ
zos)gxW9Ivmx@v(9HdGg`w0SGGe@3P;(VMwU<~~g7JtmZU=sBV;*q<q|;j$09$w8Br
z;f-~d!x}p*55ItD<7$tqW$?Ft5{h^2c-zHa2!k^-x0ysrIyEs+!2lNumnY00xlmM!
zj51GqHTB4`E*ySTgppUT35#Kx39ow0G}O%jZzgFOhdfp+SexW5J5Tt+;R=^=nNB@e
z;dPB0rbq9QH4*M?#F7keY+CcP?<9+hbZRPa^;rn@y+1<+!r9CiuC4ZI_q6*F11e+m
zO?cFhT<aL=fRKL3QI^EQj=Jh}Q|w2WLTi{Er$-lduJ|q|g3ptDVH->gx&B*J#Ma6@
z3a7iWo^&Hzb<QVV?*h4@WgU2K%HDSF6^h!F#5Bb@-x>0S(WKF+s$g=8Z?9`>zz)!~
zI1jRtx50fT<6q<}%}1HvcnjTHRMK`IFSO^o8og_+PFO_})^RVsNB$9vCEi6lt4>UW
z+*Yyd-2K1}EgCE1j8`6e+tV+MVhHDe!*XdQJJwBPZ)kAIgjH|ihkV=jpebnL&xQdD
zmsfyC*63gglQzKJT`vs?#CUB$ysFW64~q18Xi_DBQHPy2L9ZFP9tzTS#%Bt{5{v@3
zaN<<=fnmy_n(rehjD9{LiT{n5uC^AE;`NMErw}POoU)mQg|i~6+Z)Esp|*IKh}2L-
zaqAZREMJ95nVesVQCO1e?NMKm=_C9^!vd!&f$d6soM;Jhu<<<Zxbdx;{{Aytj&x}Q
z(@Y)PhSC&nSX2h2WgS#>ggyDoNp^>)O)lUC!M+h;CO_>#AMYA<dET*4tqi1rKh>x)
zN_nwFXSetfT@C={P^l)vn*a?P|JIxT`}9&&9)d)_Wo;UdMR|H|&-kUWAa-j3i6c`h
z?enfoUjnaA3Ucshh7&4d|6aG7Scas^MPc><UKaN$Cs>+DDaMmp1?Tn&lh<z9I!q|T
zgQp!mq_z~l+~JOD<Ap}3b-;8u3=$E?EN(ncYU)7Rz2qBLoR9Ro`+(5VH7if#c9&L6
zA3}qB9k-F5NbdIaTFUoQsJ|F(>ew&^3IaS+c(NCPuRET6#ifDZUBiuC7KiX%n!8mD
z@x5fpnW@624vpXCi|5v{DL*U}eovaamHhaF8Z$*WAYc&E9>{6qF~w%5RLEgP9@20R
zO{h0un$U07rF+R)^WzU(+T}v7Cy3QS{OlXgokxNYMbE1r+*-T6xTvF93bZkGq}K7f
zR!6gjb{dhIH?C2;#}QvCemI*l2-==tkBqqcJ%x~j1Jyst)aYcq;h|rIS;<!rH8rRI
zV%tIrqKC*FGQiHCaM4Tb2ejyDvP3?hk=P;<GL>xPdNO7ZhJEC$kx{|mC7(A<S(;3`
zLk=T;%V)ihw%!uIaf~mUUvmu-mldNY_S`A1Ma**pdcn5oAIh`(q|`|aM7;6kqcR#P
zmZM+tC9*WwgVry#AlHfuak64}dq>W1dGWt;eTR>4&1=)d(RP6A4j;O8L+ka`F5P9F
z#W4zV@OqW+X{|BZMqMk6L;8NMuby1(-bUV<!_694omZ*`r$-UmuE`}pFy{6P7o2WI
zH!?$o6Fd`#^)_5-8bb?}W~d8$Df}eA{1f{A?bqCzS=9ae{NqT&D__FmEb*(@XjQ(w
z;O|k;E5ar*;3Ap{S*O{aWlW?xgo{IydPf39L*z;0wP1Zy&><s(2OAjx?!>Am$>^GX
z12R$$3<CJu+j+w-v~9;=<3+}`6}sHjTJj-*aOa!e4+c%2;PpswA;(Fvtfggdsp0fz
z(P@r$0!*gb(}u<_S}<aj7!nf%-h{L30$n-(3f2Bwa~SL~rg<t^##$uxHk8Jf$ll41
zHrcTJ`ZZ%OqknkWGB4K`DUx59@c4`LYB=AK<{J92%#KwAM##%rv}}>wjwQ&Yk4MVo
zx5g;sFDBQUJI`|vX;BIc$1`25BG-w<&8_o@2T2n94v+^B-QV_134UG@QG%L^q>QFf
z<){YVgnL-M+3z~G7Pdev!aDZA7yLAmp!JSwhM{aU3Dd2QMgcI+Eec2OqBGQ}T@&W7
z^FWHdGw2IHH#*Nid5?wWCTjztg&SwN9&$Hx!Xsb;fdmYZF^+UXl(@5;Bc#-OxcW1~
z&)3G`hnBC-_mslf$&dL<_*#_^1J6IL3Wul0NFJ@WlQC5G<<^HiEWZmpGEo86xjo6Z
zqSe@QiuNo|5z|W<8jhsI2j4kVXCoQvi)y5GkPf>5qa1n8I$~_FLpRUJdA)VYbm3tH
zJ#^~ZHsf!mpdbA3#|42_wqK-FAV_1ScEMlt=@FJJ*mVR0+;6k0%~rigTdz<@u`%6*
zi=`I?_zmV!syH93llvJ@zzhf^MUz?C(FzX-e7_SY%Vl@&R(l0LZ%3#Q<(+@|j%0^K
z8h_Niq-5i9mQRq3mh55UPW-lcPF9{o%>Nkoq9-VqraYugf@F5tSSL&Y;Q$CO2WA~%
zq0T68s~;&GEtbR`zI+1+g;0=#qLOSih-+C#9Zmx}ap#spW%bri;5IIW)@aj6Fc$wd
zboSdx6w#Zz2kdU;W%|72wX*D5>rZJa1qIb;fqxkCYF_b0@HrGUySimjT2vkj7#*WT
z^pgjDE(isdXPurQCDqtkWS6K1f-{>N*^yeTMY%Zf_M_G6_k2c0ihecNbJ`s7Pa9%Z
zc3S;-x2Q9CN(E)b6db%2HR{_iYegz~51y!~#c?fEqkCl;dE<JVLFH^F*FzQ6&ZCI|
z)nHKUaT>5Q{*Qg`pD8~f+`r<iNMeEFja$3W)J!~vN>11CDg_l5{2r~UN#`CjWB-q8
zjN&qY$e({{7Q5I4x=@e+_mn$X*v3p<Yjbb*^$eUfAI2B4$xqBmoNsBet=$YV*}7UU
zf|?IeC~_Fh@lhd3l$HtfNK}3tvg7+bvhzayNU6kA(;E~iL30*vOC$ZVw7v6%HFMCd
zXfa(ag<7cUPZFZi`e6ygL~_q(U{x_}8!OW`lM(aWN}Q^o?!*ySHRFW|Is1<Y+3?QB
zdl}<R+!$M{1-r5y>p|jcf8@41(bM%Wqp*&iK}HUFcL`IhcBdrtgcjSRJ#f_5`}`m$
z46&<d`771+MO|00G<49a@8%9s(7eVP)aO2vp13?u%~<0P*69~0ap@&1{Uh<9Gmx07
z6A!VxAm%MQ`aQfEp{W@4>^Idm@|VV430K;geAXfu2=sX37v3-kOxnwVA8}F9Su06+
zl4+1^P;q&&jz`noW}Y^4ZLPN|eojb0uEvb^6yfKe)IyX9ktM!ClNdZh9Aej3pWUg}
zZr_~n-&0fap}2l<3EDOn!Qm0BGKBvLy7WR-VR(27@sqSSVlpiub7s?@P*>TRQ(sas
z^dQ1SR+)D)x5S_n-D1g>(JV+7E2;7_VyvQRAkH%w`wAr~nVK6a7C9ab=%4*FFhW<J
z(Ni!%l=9;n(-$vfaYt=2w~OjqoRCY|i%-33!&Y3=&oBAtLYIC~#e333mfgiMLmY+h
z9lfwcP#%%4r*WcBtvCsp{BJ)dFzd(^*1>tO5NQI~rkIvE@rcM`X+&^N@0aSA3tgY6
z;ecB*Q4f9@Dq(9?bL+$l_q4dJHh)~|0+NYyYa{c3ZJbz?E;DiScjN*hA>sP8YaRPo
zV+rS9*xd$Ko@)r4Me-WGleIH(64REV>lkW4s4pQ}Fy-G1RXjXSxj#<zm!R9Alw2r5
zlQ+@k(ppOY9??bqe+~8@sE(>=!_sgmNS-ckJ0Lqlc*a(JwH=VqZU@Oi3>5uW^UpPm
zL8YQg0$cg`<rIGEaNp5boF+88*@pde>-rf=KFo;Dg4?aAF-elD;~3T9<cxpD4N_Cy
zQ$0^t(D=z{Qva%pV0;rqu(q_2_=2T9x&n-G5t8+Bds#qbgi|k*nL_R%(?1Pv9Ok|%
zt?=i9NsmZ0a)E!F>FDvrf$Z3SgcNegzd%gdb6swuP{2kqNQfjpXN=M<>+`2fv+g=^
z+~8MAH8%afY%oB-2a4&d$<gWI?Hv+O6!9-m%>UN}^Iv<Nl>aGN>mU#DO)bAP2{MOH
zV+K$~R7ZmUKSrAW_B&qPF#DO_+k5hZuHwPmO1&M{HD~S-!xW5VAyor7ttzKjUzL&*
zPu!ycwoN!Yak5qh)Q34_kzYU_NfE$)i_c+*>)<@bA4sZsku>k00v%gYxz|0Ib7IGK
z>CzS+s6Ig`lVF!xsol}_5Oy2eWA-(v!aR0=s4tUW2FHl|F+aZ=g3OW+e}X*@Nst-B
zTb!EzyxFT?6~4PK%*{7{&t81a31qXnyoMjnFZ`go%??UP&u!9~fr#FJUbs$wnMAVh
zfd@Q)NTd`1y#9~)k$|Xnr%q)T1NBYd4H5>-`$=V-=foT&Nez5K1M=hayhH1^`oFEd
zj1HpEAKYe8{qP}IH_U%5_?qH2xfjOxO1MLj=birqXP0y<X9s6i=b|OcIVD1)<4sy{
z;Z2vt9e-WRfg!JOOlXs7m}LCD`0EP3vgnHPeiNC&xP&O9GGqKSs~ExT=={pSCXf6y
z{l{jZDdnn)nHQ}|U!LX~D3c(tje`oxs$*X58w`>o6A;Nsx{SB-J9LNT;3By;!f&mp
z`gTLvn|8&X8IqoQZ!r3v2}90Pd;L7fm*QRKu_wXLm}B8sK+EQzynZ5i&e$$#8ywgr
zYLA*k)aH4~s+8{?+0!G5dq3zASa}{el=VV5v3DtK(&;ub=$#jFwN=D4RX+Ha2KM}l
z21OOMs~Hyj6mE21BXtMclwfGYL78wG2eO+Ke}`?j&Ft*np$WU^l=AE^ez_S@%$k`D
zt#E%c%LY@^PFz~$mim%SUz~w8WU@_?w9yxr`DkOYe`+1XT$+aVi9MhuFeb@j;Z!TI
zM4fmCPhY`&o22_jvOa+?_C%i5za%g&8+omJ&|f{{qrAGfnVOt+FBE-is@hkW>QPK5
zXJR!G;QtCN^8e{M{I5&*%%vv>4#MT>nA2~5%JuHqQR3GEysHwb1gemaidHrSfj&*S
z4;f6wsG#%J7TMj3H|WRn(n6&fpoqWW>Icxha#-Fm<2~ndU=Kll3Cm@C($*W8RXE|~
zRZiK<7Bt_s;KqGY(Cedkqvtv9RSfHv;Y)&vm04jPn!Czr{=4|D#Xbyj^t3$L>qUgr
zd|pxU0QTDmge%RIjUgjg(s%w5DqO!(5t^hp?6~JPYg6CxlpO`e1|#}Bt<xN8a>ZP`
z^^DA+K+nW^&sR$5dsCc9&6%{u)9?4ev(GMpq`n4MxBC#RIk-E^%D_K7DmuTEvly)U
zI1fD0)-w@p>kj2^V0yMT5wu%`*Jwg`E7#A1<9`UEtCN3gYfx3?2%XG8fD>2*oBepJ
zSkZPKHoDDwO+E1dhZ@Vad9q4**DTum4YsA`^~hHP(=H}LyVo3sP+z#5LdMISG0v)3
z+`j|Q=b3Xt+$sI06HA|$Y4hoW%H4`Ds0`dv^I-rwq~jE8ES;NfpvP$xq1fuEtB>i{
zX}u42z*Pg{)Ej&NPoF`5*82ypPO%5B1A;0F)+BQht|3^~h~KDBrdY9O1AmC7wrdl?
zjzHUdX)360O_SMRs0|rpvN80$=lkZ4x)}+(H^?HDD+7A}E}Wyc%o?~7FPC-q^2Y5&
zp|$*vxek((oaFr}PT;gqKA_K{QjOdQ)!R+>;R#ZBtT%<Lw{X>HE+a?o(-6{99*wXC
zhqe=Id>Zfmvg9>C2CXMp-?MN;L=5VFD5NaU(Rdahm*IBrnn@C&aS(SZ5Nb)e?c~oT
zHAMBDEr_UV2uK<dUugt3!U+5qviU;n<r%OZ{bbogjmgO)Vl(H&<({D`jeMcT50w|b
zH6krBkmuE-=4k)=k1`(cSCal$o#lU1#zn~hGMtgO5jnXR=99-=*Uc5Qow_KhrMBpb
zi)X|{Q78=PIUy052=H<ZT{;0|Vmpf85XqzRFAea@SapgM+*Kjg#9yVbmG%~hsYv=5
zL9PSnKq=I8Z{sr<PNTk}Cxg4J#%30|T&D)6OzU#pw)#+my}3Axm({XbZva2XDoJF_
zr0-1n!w;N;_9Na20Q*iCdaP5UOjNn~GriD5_t+2@O!$bTKHX0@kBj<VcbhxMN!gb{
z3*}hnO`Tcakfu(X7oPaMl)2V><6%j^Zin!B9HI9_Gijer57{Svbj!dXAbdIhF1=ty
z)Y;8XMst<j>QWn)oeewW0WYINR8V705;#tWL#Wf1uwTx<`1p2ig0S51hrIcu^Nu_*
z&V%<Tx<ONBG_=j@{8#S3QEBKE(T`9Bl??guL*>zE^tk|euntL4l>}%t#!$L-3uzA{
zi$XHjOET_px`Y-|A;BM6=3I&4cI}$9!Wdgu{8p3M2c$74I?hlH?MiAqkvZl^bMx&Y
zeaI;w*U=9P61PhMb0g;Ic1xk1Y4$-mtdO74x#o?47(af}#W6q&{ky%LEODs(IONAK
zqrFUnP()t`;nTY<a_E$@XYTYP{&<=3gHV>Q`)kS*T0-$7*h4+^`$)tx2j9<UUQkow
zge7EF*;~<%d-5(ft-g;N`r~~bw~i`xo{LzkdfXu_w+ap>>~8$J8p_?6--1>)SNUxm
z+LwNz`%kH+PKy`(oORB?a*8u_trxN&*6|L8_m5#d*E>|VlD89<vQkjoJQc?0BNQaF
zD%2-E=_a-9IVtCzWEsn2RCMmrN3FU%|B6NiRa611hX1|W^D=WBk<7I?e%6B2_dHho
z4T<C5kumyZmI^L8?E&#{0<OgzhO_);z3?-EJEZJ(dx_(+fGR=T$~-xzF2p^?gYIix
z7K^aJMQD>scZ8D7$q0{W$~(lzyBXMJUb61xAZJDOdjlC4X#tog<9t32bYgk0vk03W
z9ebiNo3f28PNfr1cqNNWIh4Pa5YPMyG~Vl<PQ6s<!OxfJ1#Tl4BL(yvNL2B)6H;gM
z+84`N+!*RaJDY10Q$jImi!(Q@iPJ}UQ8qfqT7A~HiZSwHI+8<_79}iF<3iPb18S|K
zncbw&JGkGz*zHM#7~>|@B5-tD{xa{H59$R>@OMzGYqAoeu~L6A4%YjdbK5r6RXjJG
zJd<2elw}1I0(VeKaGIlU98DUv$g<U9yXyxbrIxwHn3kwF8_G_wUE5p|1e7r%;G<+_
zwlmh)4h|!8MeGzc^7r76#4Bw^d9($XfAqr6qO5d6s{MjeyN29W1ZolMF``56x)6Xi
z)A(OO)uEr+i|nq{eS_h)U<(uf@TUkhMaRN{-*|Fbc@ROvYJ!ElR^zeO$ban*32b<%
zB6?T0N;qya8yU7h&9=>-Cw4;8O`H>QYu;?4#mu;F+?2zDcPbPp%U{(APDrOZD-}3^
zY7!YFLK$lxCS!)4bzV&!VJ7c>^t9`9W@qAQ)bCt36{p*IP0G;dYoQYUQkZU}<LhXU
zfD85zpjRF{L~Yq+2NUotr|ZD!0-I~$qHjmWryZA9NG&Wacm7(HUo_5tMC8c5mY)@o
z{J~Ug@JCVhi!UDG$T;h`atq7e^0FC!XZM~v&{mAz3yIvu%r~!PxBETFdn>3ya5O=k
zpQRIG{DH;Cel+*#(B`Suhp66$yz4o^2UT^^$1QgJ2lofs?V-(8ora@Rof-$u7^PF{
zvQMbsrgPQR64>1Yn;5KWMfa=i7hRmaY_Eui?^T4bx&iFmt5Trt8X|kL-ZDg1_V<g5
z&v)>Lyw+Xa_x!}xFk{<u`UW6%7O54GAu_~EAT3oQ{kw>`PAODSD_t!=4J@w;S#OxJ
zw&~)9F~q48Ve=e~u<#1(!&6>~^D>86vvpeLH1rY+I6+fVksr<a7aE@knDsB2xNdc)
zY1`2Xva-cCyfOPN2S4U`h<k3ovs3%oFOzYH@tM1Gz6+T+a}Kgt`$2U=B&y|Q(W-3s
zN`pas;UpHJ@s9_=qeg?tVyQ92<Boof_SRGbDh4UUNEo*5k{YzFNgh_*+>5J2!3Bug
z!)L=8EbRQ-QFTXHF=`~(r>nhzmsD1pvkXD(4*F6fID|xk`NcsZ6yp?N*8$~~*b`jJ
z-QmyG=#6AtouzoglI?3AKR@k!v|IQdIgQ^w`0ERRb%bBA9%T-@Y{FS+c1F8)<mN(S
zquj8D7eKnXCncEAQE~Ejs3O;T?^!lyH<0*)+#`o8K)f`1JY?}$iyox#?ctu8DAwg3
zb4y6rq`3C$T8nYDLp1T2A(D(I($CK)x7x8ZU6-tN^_AZR(#(DYiHv16^gyF&W_^63
zyvlp}Lcvo^29BW(S#=NW*SeQq2>P#u)uv_m<|ZVI-v!}y`1OL~uIlx=W9!uakwlBx
zSXuAJG2hrPC$+|E>^xZSMPKTYcky9aw6f#X?s?ol`{jo7%KugFp~ElpWtXDj^-^W(
z^|Vayyx|q+b>MaPHTLx`{<ZV<rQ?+%A}R_y;3yv5Um)Z;54#835yyN%4@x+U5$Iz(
zGuwdN>0!(4_rFmV=qOxBM|5=l-5R~y*1N-I;F57Lg9|*up)eR6S3V~_9(z080-dY1
zZxnCkQhreW^20=}S+4-f=l3(V8ApR$C5_O`DIe`3f={NoclFsvs0ep+TU$RTjYr0^
z%d+Un;6`4?x~%%dkNZT%y0A-r6naE3vmB*~4feRC1Xc33ZMZEzqBO0wBCgBa@6i(C
z_(VBpHYwIfNycs0I|-v|wIctmkXJBPzhK&{m;+B_vO+U1t`p|$Byn|jNef69qyFNn
zj~QG>4sY_M<(a85A#*PNA~rINv`c0L>`0TWxA*RwjSVuW5@JuOiXaHQ-H!guE^dJM
z4N`6HEKIwGu)t;~SjdHKx=jks%Fa`PdXp#~H@@X1Y26q@C(`w{gtd7fp^lJ&a6MND
zcOVx~LE2IrCf{v!`v#SX4-F^GD$LvMndM?*GSgt&UGPW(IRh5#0cT-_a(a1SH4AL!
zr@XrU*Zc$<{_x=S6#sfI>U6Q7){OmHb@_zK&Z|`Q%9?>~ePf%EQb9D=%gfcSF+D~6
z7$zN9Qf2*HK}p``j)WN7S|Zgd|BgHM2SR(^%lOvoxe;}?qA$3BEAOGy3WlK~5q>h{
zFmvk{wMwUXB!j#0BxW?jM`Ik74cgvUvv$U8RbMbHm+oV!)qA>%7x>BF`<Yvj1SKk|
zd-qS=*Ha<;nfbpGLjHKuYTlyFM$J5P&-#?GCjM#mxB%nOXQ<YvT5R|~b-d*8Id6sR
zEnXpp`P+jYQ6i}#pbyKoPJN4xS`}!+s>U(t!PvRiN*q>^bZ90)y&Kntlee){PD$BR
zsIF6{gJzw2rcpqCh*8fpKYRF(B|7v90sTP-9Za#~J(7L^qfw;Zo%cCuI?#cVo>G{r
z@cpiJp5TlQ3>Zz&SOP1mWbNS3Gm}DqIRN<|&}89L6~IjR_e8)42M4#&@s#!&RDPw=
zoIywb<&JlzQC8h}I^9mGR=OiEkuD=MVeX8VE2QbX%KA(pR?cRF<bc3hBlV%Z5=-lp
zcjia&BE;I&Umt9^uDY8>Y@j;eKEpZ{!2HwK@VR`>vG_xz#RKi^ll?W1FF4k?)KVO6
zU9C-awN~TS)pgcShFgJa^-alvW3hZ;Tvf@1!cVqhi3!xc(f34_@kayxkH)VgdU{J7
zA|g~?PS4PP#g#=Mpfn#`J)YErmq>>KoD=ciR^&$W5@lLlsCve~gx$YQ^1gpNlK+Q9
z69_gj$%TS^v3~OjPz)B6f~w$w>rCPw-$)^-4#@m`<!{A!J@$X}&#m6W85*)xHByTP
z5;~KxM+{;9DxgD?SIAMYLVsIMK7Y)oF_Yi!DQp)Q^pDw;LFG9}fQQYt&{diz;uj#{
zP!AH@ZQ1+%sD+NXhIbNQz-J7|G#3h-qkx7yUmuw%UNtx=eL#x)`T@|8fPmCTOs!w~
zDEpfDJ}k1>^=~ckpMzNvah+V*vS67qpM6*W!Ke-jVwhtwp(((UN0b+L^6tqTlqq9*
z9&`3Kyt*pl-==u~P|9$2{J_63qkpL*a<b?UAQ;CH@HthpprOI|3hFU(lMM>;1CIR2
zKxeMaUzMzrQ2!N&8A_r!cw9xZ!vjhQtX}AwG4Ls#4{bGVjE!((&nUxK04?Vh`$WB|
zl`g&k=GLMgvdiPT;`yGA&(>n#mvNbynt`@D8tWVD&LLrS^K|eQxufOpcOKq3m@3tD
zNRXh*5B2PWTgTqm)qT4a3%@&LXAn4w&)3l+)g}xe0cR;9n-2q2F~fQFs=BSK)znLf
z`dqBkW#)Q(O#K^lg_{q$EE@HMjUg`Pv-Z`Tb0MD{Ip~Ym;6dA$hIXS)5xu)je98fA
zQ3MwXK{~K~iL{&1mo5S#y#3Mwcc+^N<dXN&8>8VyRH6-Z_my~D=uP>hQ3nN$@OxVo
zkv{aX!-ih;iUu+)^9*mjvBm(u6QvE?=dRseN#)FYM?lc*Vhk@9avNhtgZTJGUq(vi
zym1y1^m2GSgMO?-!@9E}r1{haWh9&;<8)=9w9j;BK=erU2&WED)+kb$S3lt^;xD}~
zIhKKx1*i6);_G2zjWXUTpBHx(ehaa<gt@*V+ou{lVBLLJ!isdKhr8pbFx(Z$GQ{_B
z4(TKgW5eqidZlW$&zgqJiu6;D3`~p>66WE9q&;In?IMHj8}ZLvA)iOo4NX747wtVa
z&>kJ;T_`9HX@QXK6?jKOX)(Voi@tE1Tqk>%TUHP;b>{0#EVp++TYQ-RNEVvwz4Z?H
z&j)Z?9jLyY{=c-ejsMF<1VkwV&j6TsEh}IAmlsd-2g9BlVP&h_$cGRpq1wwQeCPX~
z>tm0DBPg=aYwE+WrGc{zU5+qNvyJgXkI604ipzDk$j<fMBO6nm_aJ`NdjTXjLUXHb
zT_ZGOK^Mjf{n!t~+G4-Xa9e|1CKV`qm<-HTU5XVwB2oIobUJ_mu+0xK&iDfCe9Z-<
zkbqVdRtR@GaTa+0(uD9$*><h=yJmRGq)8caoHsbv63t=CLN0Acu-|}u)FRtLZZ%5U
zS5sAe-e`_78T;e6%-zS)4Ao}OAD?OuwD(9G0eIPJkaOJ0)<=&;gOGzTW2w|D9-FPH
zuR1eoehAHB7#tIit{Bwn{-oW~%N7Y__z|!+f;C%dJF0Vn7!8Nod3H`ji*OLsz|}s@
zvvwQwpRtD_Uh@tUoqd^;#pQ)wB+E`p#(zt(x(;^y!{>fI7Sj~(k1>Tse|dw;TbVC3
zTmuP5uUzvCriaNtX(c6{77D6vXbZ|iyLr@nIKr}9S<B1(V;bc0dq{dk$QfHJ)or2R
zCk2mI>Vo2S&3rFu%TM?1r2?DHl_fy}eLJIiRNHv~Z_a`cp-9~0F-;m}mc9LCL{_eI
zj-vJ2Ocp-gxM}z?2kMhB9e4HIeCMy|`5I$;lpVp4dEMloMNeI*e#+^z<Y-@k3_j<3
zs!Fo;;GL_N<C%_#!3FtNrzZGWC8ipmS^TU<>@bx+&OJ+Zn!Qp**`U>5Jqxv7`~Y7u
zutNUPc~}sI49?8n+M3;{gV=WNISODCY>ph`c46rCmASL?uEi?Zra=~~^dUY=Wcy!|
z_gEMQq`1Kg2Dbx!z7IO!=e6=`3}uXu6Y?f~PTZ<<u=Cq8COcY;PzD5DlTgr*6?>8+
zL4q*1Qr^ve{&IEEz=mJygp{3+*xj|xPDLC~G=dz1s&XILL2kQg+vQWN038Jha~?dA
zM(~gYbj{9|rJC)ODlNF|3FK!tsOti)@R}@NTs@rb-*MGHM;U7|7rl`5oQ&yfU}199
z&Gxp1MrI%g<+w#r#+a0_lp$fT8Fr72KJgpFOO5t8HD`tj3{A@g^e3cI++hECjIFj9
zMP@c`LS6o;yw&diMvrI&`C-#EAAS{9+i8D-%Ff^tWv+ZZ5{E!SHGv<@E-gj}bT`sM
z{|#{bd%cB-{t;yMSKN=G{cCgtr-uMDad<TaXg!$SD6%x>2AiILcoFF$<EKuCLxst~
zBQO-hBgi~YO5*I)tk-;2p&eRY39=0<<@@-|9cDFRAzJ|VVN%2|Vt7w{`w)t;__Xgw
z3S<NW`f_G0OJ=@iaZljwp1W@&S2Fz)F`w%_`O~Rr(0H57+3i(7#Qwukjo%wSAy$xU
z*PN0}f`$Og-RYKqym8-lqA_*p)S8%rCSt0#q0^uk29Mu8X3VWmnF`SU+L}lFXKAVN
zcOtY`KN5n_f~9U$8cW?L7GU-IjY$yev4OF3$Mc6%JlT8qKRZ3+k3<*9OXvNf2)}f}
zgbqhwU1hSQo~OJPGZF`(5=<Z8zot+gx3SH(VLZYkXDKpZh2N$<eU<%v^+!Lkjk+?D
zxYjVG(WCUX?+_Hi;e%R+W_(IDB_X3-pXRG6^pv!%p!0UMh#kyO$h(KK=JW1dqIVb4
zliHKfD*N0XyWSY`QN)dSOO#L_l#bL%1-GO1U|7SV1=A{=&KKbC2Chw-?Xjt}S-ZxH
zKtG*T@+u1v;?o@-Bw%oMKJ(eu5zGgdhR$*uAt_upBe!jn7t?hT7Pb4HHAayUBX0hd
zJZ;dYY+ViBaGu4Eidq7B2uEyQNG}{MAsc$VE_x)G3~rM!L8w8);gR(Stb89(%y^aW
zKav~u2*h&UC2$8LHItX_1@t(e>3ID{X0ju@cl9`WfC;@<w_@89n+$&&vR)H>p==1}
zB3OJ%_Qsmesv4sU$t>LtMnuF9G<uBSk;)gy(L8QFWK6q}tt})!HDr>PAA!QEOIUbu
zZ=`QZt;lt~NirS2De$l&9b#J5%>Ul{qTM8;y#?D!NqImG76)zs4TO)c+kNl_XfqSj
z@e)zCTaUmi(*~`7aAR#xqO@HsjfHdf+%vb0#rq-aR2LT2g=aq1>y<uCyLWh(5DF%?
zslKiNYxm2L0-iVSoOfOC%_stwRcD#A^}dFV88P5uv2$ZOv5M)4ikmA?LpR3}qvzaq
zJ}<{_crsz$I^J&<R#JaLq9#F_A{NE%Sq|<Ge$dHT32MDVzSGU_iHjXLd+4Ekh(d6_
zt;U~GLCDLVa%p<zXKAc6Mntrmo=}6S8wQ3xEIVJNf7LGN0Z+AC)c?oFOtcxh|IZvz
zz(*KI(_KGpuIb(^s$iw+;i1a{Q}s(Q-aTKP5}tOOi`cq4<dM9}DAsKZ6K-tUe2u`X
z7Vt)K$*?L7E#vg$7WzVQEGDPu!tt!|AXLcNtV_<5ZW$`oXg$7_xA_x_M>px#srxpE
zzIO3^LRB^B%b`B4uv>o|S$_l_=2mO%60<CEcX4H2w>e=cNjGP+oK>)iSN4(~{s|J<
zs+sHy+)STn*oBR-5KY8Z&2~j3jlIjvIuWXN%I1`j;Ss+ltV)54TGDDj=@Cr&p<~~h
zanem;0F)*@!9K|oXzBKS!TtePI3>FQ{hfwp8z_KUT*qynw7=BG#J)V<P^M~APLe0;
z-Jx2dCJa+>1>aT*z1=uzDXpqVVfb*nRM4--6PO$K?~$;(2AJfD@$o>GN=2@VT*+R?
z8#f?ZEeO0<7@qCanigi+aI{G}6;YYRWgv7Ck)DgGqbDpy@~te+6BTx}Ekc=yKye-;
zEtM^h{e~v>w=;b6z>1o9@^Q@{=MV#-kX1|A35m;QIim{m4Z9uhl<bXfMTO`*VMFY<
zgIHRt?e6r7a1c-S$@$P&$52%SM?}RA$9Q{bt-+D6SR<3SDO_D+vhceGQ=uP8*4n#R
zHI=ez&blx6-s66+-!Rj_?JMczFGr(E`A&BZi@tZ-SD+nCSe4U5qAkeiAQ(%Vk#(zG
zQ{uH2C3{Tiu|LAp1OM6338NCPUh;xxU=E{%eQvgQbU=ylo7;y+Z*lF-ZtPbRyUKRX
zXPP*Y;~;&jOp~P-lsmnIUU?mpPZ$96`Z*<=Ti!Kn`D^zLjh_`OiOj|qvjvwyg3sSp
zZuvh=SvInTlY6wdIxUre(5j40injdV)c8>)$of_Yg3Jl@i%F&$KVYf00XXPj4H?f7
zlp}gsUsB#MtOH{T*c6>MIF+x3`3VdYbh$h~d_uGncLx2J!)5}YtX@jP8Q8)nRWSef
z$r8|~j!$X;Ht3t?cLyf*Dg@!j(>s{-bo?Q|dPK2*WA;-|Bn7dLD4Y2?h^re%D2=@q
zVD^9C+g<$hoWe{A7(}T@r+s;V-V*%GtXC$W<c3>RB;dYAB&Zx%(ZX=Ofin9Q!j||)
z#=AJnXwy}hKEyR@i*DoalDjJv6}0_$Nu$A|bOX1SUzczD_K+f!ok|(NFv`*cFPOhR
zfNK97PDtx@yszD_=3DQ+-5)mV)4i@mZ_#tydws{ltNE>CzP?4oO5+U*<1@A*`3fdh
zq9mYXK8@t$Ic*F$8nRZr9i#3WfY#?_+^P#@B3FGWD?*nrd}LnRK||V?AraiPb%sI~
z7;swNr#j&`3hzRv13JUeEBGCAYr#0mRI@?0F<J;;$!r?Qp5&ZpsLDpEL1kTZcolt|
z5L8XPDv8`CP3Ume75pWLqZgch!(sQXXMvM{s~HT1kAnn|bZ0(p+t@jXR7bFx5I%@X
z3PLu>lPg^78b15v54t^^Hz{t!8rCZB=dZHE3Zau0_nu{yeA@fM4wIaC;I%-(6LL|B
z;^cDPMOIeEXOSBn+pGor{mM`@@$@l2g%#HwFUL+<YtGavozP^~5}1%!4fn47LRMUN
zeavECNi#pBk-AwEj}dYs2aHXxSp<L!uzAYVuvw}Npx5k1%nF_1pwrMz=Kl{<Zy6Ow
z7qy9^q4CBEF2UVh8;9WT4GHe<+DOoZ1W9mr(m26sEP>$e?(QC@-??+=n_u;(YE{*$
zQ+u7gAN%Fzg-4Uv^q02h24fl!8((?wW6^->2EJ=oh*dKWgYuFQ&<l%K7(<{=p^8;&
z_6RXcc+9LhJ<|3Z$BFz<vn?8z)gXWdTnw$j?KRB`j~!<XMggba_-w)h&R%mn?!w|7
z-d{btmL42@Us=sr`JVkf`(^C-@944m+4c2F;D`ujK}tO$(O)AVH$sY@Tnf632k<iu
z9qSuz1Ui|B?JUnx!t*Dov2s>+=y?F>Zuzw4YU8e4)KxNn)W1vo?5W)X8P?Z}H@3|F
zBLbRkP+e;}M^UZ=)JJwSW1wIZCZaiZ$Hx*Xv%LEfe_rr3^ye=jdD>`y`mkWPL>(d)
zn1gGoR#gYp<hG4QF#nBNzZn239@jXe0ByXAj#)u<(lf%f9u{Nv*GV845`|?!Spb2L
z6ecr5Jv>kaL&Yiq30%cyr^vw*#%oP+IL|$Q_1-M1rb!|@7oD(AJR*HBc-t1gY@{I?
z9hiprb%wk)oo4Z>9e0^Bczq*?z-JK0x_6PIg-9#LCr2ku4->6bXx4QVlL>yTqR6jq
zz<CoBp{24urTnq${1!6l@$s0?yYOfoJ3c$wur>rOVry|id0a2#46n&~9+2#I;nsH>
z!Sk-I&FX}gN;UwG%Il@-_AI<^2rSp{3jmQ`!9e-HTnKP-&cjOUaYrddWA!k1t^VOl
zK$K~YFVzK{_>#YbLou@E3re66ybmliYPG@XnMg206kTlqIXNwJMbE)ZC|g$gLXp43
z_fZnW@22-D4#WU*@NdUH@5VJvBdK0@i$`$y;sp_KpnJyb8X!18b}!X+|D}jS3buE2
zz5ex_Y|C^nlo_I>s4yKR-t}@%+vq$Y=zEO~<knWKJ~cv6&*}`TU_9K%(+p;S+-Mn@
zEeP}Oxk9#{FD$BMwRyZH->@VhCQPb%5z>#2yrJsE<>sAa@q&{?eIjq<rM!GDLt(bE
zq~2B0i<<Zz6jFt}UE@&Doh6rOj(K<J>xAun+f0n+n(WEZ!y|BjTgWu~4Rxh;%gs5q
zw+~rKZ#ojpM(Isw(W7+?bnVA|CzByr@fxA3;eN&~YAG@PIr(R0u5Oy*FVVG)NmCj-
z>4pa%vONKq;;KVwvpxEhHJM%U93QgME<J+U=4A!O#T7O+%KM(QRnwv4bq!R1+|_1!
z){0Lo(a70H6~W8q_TpS6e@BHNf|H$=Jzu{7HS+r7CHP|NuCU(x?0n;(*qd=*A5t>V
zXHJMd@PQ=2W{|A?{t{@?GVlLJY+yauMeNfUI#&a`nUm2WBr=CYmg-GudGM&>=B03!
zR3LiRhYos-c(JcVqrxb{Tl^`(KAW`ck7{fEtH57o?~pR?R`FSIqp&{*2v=DlwYTu4
z(^uxGu!6!k9@Q@-bcrJkY@+~XMAq*f*>lTzXmQ7WTHSA=rWUW_y@m8)@~Tp}f2+H~
z5e>m05!=lRRvCNnbGKC=_P&J5G<l#WiNzg|{*uT_KKv}Yv+g0R_PZDO8&kMmK6a9~
zz5OnMd33Jdv+bS!&&9zp=-NF+PCFT1G^JqsU&sL`+dD>FO;HE(y?i&HNgnKOC9AVo
zuLNC1lHxDMJw=<eQL>^<L0=YEl{cA9D{g(io>6)N&%J=c?!qRGhV5M5qdlJ8qGbt!
z>RemjBBzw5Jc7i=NHRT!XnoFU6EpFn8Z{}zcI}D-mdYv03zG&Y9E47q@xT2+<udv>
z!ifq|mit^B#@#>g-^%9&GB!fMvcgi=4N*TwWknT3G283{4Aq?ruc<h@v)OQj1BZ}Y
zgsild6!PfUC&gobTno<|=gN0~b>iP<+Sq)HX=rgP4>l8HWEt7EWAd<e*@*bcroB3=
zNs2hVPcwjKtaUDo(p0LkS(PX@c{NO9)j~!&;O8&C`!AvU=v7BXo5h>Tk6>ow$A!o9
zAB_;Km3m(qD@;n{B~2y?F@g;T=cM|yQNJJmaID+Qu7Evh2v#UQ(;Lizc-TU!d=<ku
z=v<!V2P@Mu`*bu;@*&&U^TrEX_A*2#^&czI-!_|p18;dTSToBH`CGE;L8h{-lV_{l
zM)7=p-;5xm%TI3g%`$x*x>&yYG>^}m&o>&9y~+PJJSoJ%7>>hVp|y3ry?^l?m=H~=
zvk3xd2iLs960=F-9Lo!NCu7@oEAGF(UUyj@x{-A~b4hit)kuaN3Z7<o=bboHsHMGH
zJg?VNZ(hy3f!6U3y7%hcPf-U&cfH;<LL2U+mE|Q*EucNA-D1q@pJ4v=)-A-Ta%VrE
z&g&%N*MGlD00uQlc=oToKG@!;C)zNxDam)EVj5;kBx4<3C+n2Dr0CwUQtYW`%PrSq
zsg3_b@s3tG3((16z+c@iy!@kA^*ZyK_q451tG$Mj9&rY4_(?=B;0g@wMYL5*ULTrS
zvU8{!_<$QuE|ZSn<s9Wld5RbqC*|xAJuY@PzF->pi4*-Bygnj=LzS$4#xnfTSU)^Q
zZ;m&Rn)b)IYfa38;k|Xslt(eEO9@cSVnnLYfct^zqKKKvr=ELug{zL5w*+mla^~jN
zsH&UC25HiFPx2p;%B1T~El&=sAemdRAXTqL#|QjMY0ZDlAT2=wd@YMugtw_hnY1l-
zd*}v(Y}EVs60tu`1EY*@<(M0jlxduXFgKl2{A8ZXid^=kN?6t(W9JJP@FEQZeUPnW
zJvG12L<EMrYNm1dKzRsSZB%O2NtNHgkBDHn7uSEa{-Pv|do~8hXy^3Ju<Grcz#b;h
zhB8NS&n`u@@GbZAT<%tV7d$a3!FWSlf4Kwl`jRWv8*1VX(Cg?`>I%_>zImCmaFGi_
zltB$}d(Dzey+W?y!HlpgKn{6~w}1U<`S!E?MX#UdM<JPhTf_P_G^98B%e{54&(_b^
zxi_Duq_ao=(CUi+O8OZ3iuwH6GV<qA=u6jCZT~$25_JcyA^AH&ioWhPK#;QY1NHD-
zVMBbLTLVQ?<|}&ci<9K$)lvDj3=%-`nIrW=BhzVIloyA;ROW2%6;<l-AxLgdi|Ioh
zI#{9dd;#|#neC=0`t2hi!C}2|XRT~CRMF3vL%}oh{4VqYIp|gh6E9Uu-fbFZ!Vqm0
zm9ls2L0GLO&oyHdyh6|Z;3_qcTf?hhMt$Pj4%wA@#tOZ41Z~ggD5_2;CS;<W*N=r@
zftvmDgLi71?%7zaqx^v<$uv^;DE|mfxFioFwUA^JeCdY!fuWBJ8eoqDmSVj8vtqG-
zgSr1mhnw5LkUSzYd*O4gQ2CP=)vWdlKweYgO=I45Q<UZ{KC<mKl!5($_n#2;VCVx$
z3#3@nNTRI$2om~uV0%B7d!}IK%hc$~m3l>g?2#C~t_g;|xl69pp3k*TmfFFa>9rlh
z2)Zq_SciR;72Qj1sq>`je-&_|(>Vz8$<G)Y#tlU&rVk-~dn!GK$@M&z`w!u@#3N}@
zCi^;^_nm)EL{t?0YT7reg0`e?_`<;e=qPmp>O#nYg3hD`x^;OsJaA973F!>+KUknF
zJru(=TR^5BUzlnRAzUyVUh`dBIztY{2!5GUI}1%hf42Z~_qME|WHvqCq=YY!{RQx-
zKar6^sI`|P`b<!LKJ~He@l2Q`C*G^85aw^@ktBM8f+zbUO?UsfU*mk?bsV-d8-PN_
zna_^`mT@hgGLHsT{`=B>`bx{6-2I`QngE0%86lr^NO~qea<v3)mW;XIbNWK>hSca<
zMZR;#wPEqP&G)=OGQfOx)HkJ5anDzg8GeQ)MKiI7TYmNWm6{-LUQV;q$L}l$bn!|s
zM@6K?(~&`H2?bvl`Xp(_xL0jRKvn{A!3ItL;x3hG*@2-?dr|{Gy`07;K>mJ|G+J|5
zfWk{wd}u7KQxx8i3G;{{7g<gK{J!5t$Np$u8}wO?=DuQeO?b=Rts`W|8CLy!k|G#g
zLwh_}+h}-YbFgKa%(_MaENx^dJq6nZZ$@-608CnU=vtr3Bq&k9ulJZiw_T}Uw1;}V
zjL`{~wxu)r@Jl?9601=R#pNnrDA^kT!mrP3z^^({Std_q|EPQJJ^m6x7;-cVx#3nK
z1{;etACVv;l0&_IVA9!FCil$#IqByI>()0?|5EXDh%V26c!=LM_FaZPp50$0hcFjC
z9M?<r1f@nQ4RZ_>A;AcNw<aXG$%SiC$K$Xw-IPmIlB>&2TcVwfAnN*Pybr;pzyZ)d
zKT_J0P;$T)ZDhOTd=(8NZi^o?jlD5x`0RfneLQ+s=aNGjpKk)uzzknupXGn8Gq9PL
z#&cNe#PbhN5ISiY2e@9gn!!rdmJL9pjZra(7)KGG7=l6-Un0*aVEcxCv9!TMQ8nLx
zAez_x&l+3XfmbwQ<T)&aub5yf)p^4$)v}i(uJgz)vxwi<tO-d;1^lP@{~k!BU~AO^
zid)^xldcr_?BK5Z*I7F8uVEh>$TduxHe#gi@xJ|y<QYxlM*hUW{+R<z53gdlA!^VD
zmsbI=qy)<b0c1vtXOf`X(ku5fO7G`3Pw3NdSN`ZD?!}I1u;J2T_rGKJvXNH{6jiCd
zu7ia_XE&5yd992m_?@MyL=x(1XcKNo*8A$ZdTpg%k($?Zwap@#e;q-(p8nuojAd47
z&dtP6<j5Mby<#@*ow;2gb{LL_qot8eujX1_eWJli#L1IjLmB?JtHC_tS|T&wWp7d#
ztPh}vR)!*_c0Hqqh#TNWy{9CF$DQ>$%cQ*MKX1l_M&!O;Yn;!$x?*B125>LvBzR`N
zQcFJ7zs7uKKl}@w6BhN&AnkkCv#{Ak7yFXA<7aA`=qq%)Zkzjp^0;TkBPbY_GhKO4
zE%k&KQs^9WYmTJK0(tq0pQ0-H2AqD;^~#1gp8L;LI7Ym8-%w1&n(~56>Iw0m%LSO<
z$G1Ru87Wj9c%wm9I=(m)ou49iY$~^RUH=*pj0G-i1S~X1*No(DIbAy@V5e=x{Xu#@
z9}Go{+4pj=AYb)6?HLQbN3N1wj|w@=YARLSY=1ysjtfvbIB1V0yBIg8l)B&0a37aQ
zTU=7IEDnQ8kpT#PzP)XW6!>Q=>rcTo8-&7DcJ<ry$9C~kNebs|RfDmfO|8v?ed(t$
zkh6$7Yh}+Qhxen^NF7}GUqh2Xt7TZ_e=1~D_0ZwBs_)()q+kAn?!8Uzt`Tj*ZD8di
zFmwjnpf?UB>}ge+w1e#tBhFpP0C%>tf68oPjM0BwKnKOJ%Nt;QA21hZSvd@dt0=kr
zuopf8>@o0lA!2XZ-)b>w`Vh<=QSrTC4S;Osze$j_;eF2AhPUg6H-~%>u1oj*=mrm9
zT}pZKGu};C<85x}1M2QbCVflItH&ut)s#3uBiD(amp>Q{I19V_rCkrM^Wr;hzbrSa
z^Mu(<V4bI=BEjC#{f7S?R!^KlsE}IH78?Y(Fp3^Y_XCRmW<xPD)!sO!M;4_owBHV^
zclvum2RNBPF?ro;9NFs@8=qfOJo;ku5OJfOvpGKBw_j(TQYwOv3bD)~e{>#YZXx_H
zkSnW6I3~umf}5qFeVRDu+WejwSgK9|yRg3Xdn^GE(6Q>cO;0HL$CRz&zk9Ukv-jjn
zA(B0n1O<|$vK=z%AK+#ALA@&lgz(gN70a@8VnZ*839NNvywpic@w^K*<q1cr#bUQg
z(g2}K=iIX1Za)wYx07!3IJnSr^cBJGhe+mKmD2rJz${6B#9u`3fioqrhlIDw$Y=Ro
z&6r=2DKjWe<vbM#oiwNht7C0RPe}rmkAJGbY1D7kl8x52eBM%qN-@T)_E?Qt;CnrD
znffbnCDyu3cLE|GK3TW;OX>X<qP>azO@)oNr1^y+OvgqMZnuY|fM%lkJWic99YVf`
zfYjsT^<gbC^ME!ZyEPV8XSysEicy+XlUJ9Y<CoMy*OYhio}c1<@}|OgFxIViUe`Y2
zs0me!#ys+LS1>?h_(j;>C0Xd<+T+x*U(O(so68A$NfhCv1`ha*|LKptT`)P?VEu0F
zuIJJm<j*Z{(P}5;tK#iufh(56LcMh`@n*Y|+i^ElR@ZU-qUgV5-$-sIr-D*+aTYQ9
zX`)ix;}ZTrcL8pU>=AKrZnmEi;(uG%bKrpbJM+hR@JL#GSyABjkx7yb30Lc~)*>W^
z7TmJA8+qO$-Y|{lg|`fi56C{T@%ug#_ibr|kUA{p&&)nu7+xf9B&|0MCMz&_h1y`n
zh4wLo_J<=A<iSjqa(Xs@7mrXp7(G<Tb@@6;Uf+dFY+Xh%pun$o7s{LC7?&UIB8~x&
z*Zja}3<%kVr6Pc*=Fqpif+(_gs{P2Q!r9VY>1ghWSceq)_Ef?+RpxlZe+Z$*o_C^h
zjRD_DRx0B5Uo2OLGahR08jOR)00u0t9Jx%>pWfmf63`rzv(NsWtzTV~ERrACYK`YA
z*oym1;Hi3CV2%V1zR`6xCz>HoU`uy_?FHbk5@BimA~cwaVG?q+$~+7prGhHjeZcuq
zu`f)<sF`V=pd`9yt_$au@ey{A6J$AXx6BmpZ8WVBY?lzz_x0lDH(!k#OUP_I0In}%
z_WGrl+YI6uk*dtmV|m6KiG0?L?D$g;5*<&QFP`Nyq20Bl?fV&J33cC`P&}Sf-w_t?
zZ1&AMLvPsdKpEV)Y7kfq*ShN7_?8Dsj(C+~rskU&9fiTIP~5w-$zJY5PI1$MbI}f5
zGeRa3m><tpfs6P#w&HVSz&G(f-S0(L^TODtc|Ytl(`^JWFPph+UGy@lXwc9jkj^N6
z)GOYm|4k2|8eKiV^-n4|*1{;|y)wo-*uXi_8{!r@j{AL%&##?RgO3-NyG?gqfSX+i
ze5dujnsD{2N#c~k5_sc#Vu9j8%jS0C(JG7IosAp<S2R=|NyG=-^>Iw#8{RbZrXusS
zi~EXz+uJX^$ph&e?V#l#2<`hpp<O282P8-_$;NN};Q1$bqEAE)9#)v{sk95Sy0cJN
zxk=7?d!a~fwc*z9<gqa7#+y1%(#=9vEe*F>Rz&`$-!ok<109uL&Y`7iD~WqvQksEp
zw^0Cr@xhh+8-6z{gpfwfU*6@3u^sqG27%Petruib)B3a>2&THORCAfiH;<cj*<462
zC56I~m)aC!H_WmA=v|e`7rR;lr!8pfb-^^J3Nv|}nVUpFM(S3ZI2u(%a9ra5UohwS
zv4`f^IS=2$ax4~Na-X-E4BZ4VrhDmHQZAB&8H`+G`TEBNGD#b3?1m&HRC5gE%HIJ6
zN7xE<@ik&Eug$6n6mIfv7@GctO7-G~oP(Y{%86wUB!*rYax)HSwZ;PhnUnk^H`G&V
zXR&n-S!QwGun$FHP}lZgBFIg%n)cv3@=o*4^Uh7QrCzbxfGd}l)(0)L2Vxh+?fhzg
zV$BCR?B*o8*$aeO2g6Ny90|k6uy!$_TK96^8VM(vmqO_(vtMsYNKOksg*g@!qX{J)
zSwFzDB@1v~?Ld5-CoACu@Qj*8m7lTZheaQYw^}-Js$MQp*u1R|t(`0i6Zoc$j=+N=
zdU|g2`8XrNoy_l5BP!|y+vzaQ_kSQacxkN57^lN21yzF#XfTDvXkf??ien?k=M)g`
znE9cuO-J;vRYoTXJVYu5ak$&PSm6k_I8`h>Y}as!hVn_PYQ>L~<=6Z3MQ4Ps^*na8
zejhLcksFunPDEQ)%b(xG3&bxO;cww4Vw-GGT40;w<nb|4&rU}_ES5&~|4<}r+xX>+
z>64WpErGZoywaR#&obZW!jUDb0@+AzH>{s>xv(0c_eu&>J#rgWLVn7k%8$H^Wv*gm
zd6Owr-pf&<3^h#aLj_M&5D9x+h=`UaY)oQgt#(oh8t}q(F+vLdthwU-E_#$LD>a1T
zT$0{mkvEU}N@GOm7s&nIPyzj@*#lv($%jKa>BdQen2Ybsx&)e7dN;JUu(#|c<tQ=T
z7(JQRpi65~$M5R_UIN+373r4Zd~{)>JuZFX2mPAfV#^5)wX$2nR9$eHT=4;2cjgHG
zKn}5gFn3$EW3BEA7Vg(TZl#-dzm}{X+Kah6G9q?WkW#CVDCQ;$p3bpF7x=8rMcA>u
z+{XX07z1otawY?{G|j3KGkp&y-qS4oYa%RReba((9usm{*z_@Vy=d``Q*%oqMnp<@
zisXIfSx-e`+HbY$=o3MXswwWl4yF~-JW&i6G->;M#+s<PNuKeSw6sX%!$9DVah5Ow
zlTJT7@YRti#q@GwciTxsseI2<0anlm1Zr*42)zlztT8)}Os}V|$>~CmH)EWyy<=U)
zFY_XtXjBb~I5|pn|9i^g0H|mMEK&!WLMBy$@8$RlOZ|YIgLjtMB@9&WZZJ--D^pgx
zbshN{lA;UaR?A21r)aArT!Dx-iqIFR6vlicSC6fZ!&@g`mwxjrxoNE@vK$+5ZY$ZS
zUpvv_lA`mU>y8K_Rs}#JeMSkCglg2V(}_cUQA(!YBya0Io9W%YRn!+W48F3}<gkqY
zyFuD|j|gT*sy+k441tN04}_m$CPuupUI($j5oNu6D%p8Fhrm$`3++GM@OiN$T?7Xz
zB)IZKst<p_WojW?6x5R$cBLuk5!hwO=lyMG=RwzfLE;xzUYjiTD2f{LBsdra_t+*R
zVKm>b)`qW$m>2qKDTU}TdParmi!$ZdqFktx=0bwC?ee-$4?%jCgwpZC`5V~?zKIFZ
zaA8Gj_T}9K?ZbPOYHO@_bfUX835w&U%~*~z%{@vcluLgjH0Pu*P}2F9#EQQI6;6%=
zvSZ&LzB%`wXGI_=-P-s@boZQJ*o^yU`hY#DBRch}nSMjSd;7r9Pngc+QusybNVv{r
zEh1?Wqe^cnJn|{2_c%kO(OD$P^eH-CVD7H>>{^mEM;SrFbzF5roWk9qb~lKMlP5gu
zxAZ>S&pxu56XBLSVYOsq>A)9{W6u}2+TD<*-5IP6|8s1+YEzt#H<a^TV}!&p$yStH
zt-%Z=*I4pAJ-JDbK7Acz{eYS5jiWa+GY(K_iR1P@A_-a=31@B>PS?^IppH@NYLiHv
zv<$q!Dsa3SOsI&PJ%Hm(ROZwc?QqzeI*4Z7@q;C04XZGj1`<Pm+r`#<!Qq6?)@#=R
z(DGq|2CS&hF9gE+SCL7KOp~wP_b~|Ob=6UFnlx{Q$s>{NhwP_B{Y;k5NDRkFvQP)1
zt#}?&Ns0Z=tVu<uDoVnzoYGm09#&X_4)T+Ee=BKr0&3KlMLiA`Yfdajy|ig`AD{D-
zv1>;c`sR$^rd9b0*A(C;e^vpTn>=EpvClW)qH8=&fIePo%2Ad4K0SN7oX2m%-p%<1
zbCdHiTaz8Psj2%k>fbb8QxI!n*lLe!MRlvrG5;4hn=^;C=PW9`bNi;6P?DgtD5Vi1
zazBF+FH}Dh4^J*?uj%U#7OOqGmf+X^)$EJ|oHhl$l}Vbvga@-rno8Iq5M(MccfMjN
zkPB@E=!zkdg=^HbaJYgZ^V=M#@pI$Hf8>avf~&p6y_0ifGf!!^UXofYx6p0baD{Vk
zx}!Yj+(!7&Q4hYNRIJ3ducH+A59d`hl0T{ab@v!EXE!Uy)aWAf(hSt$6q7a^#2V9P
zmS}4$ZQY{Kuqyv2zpedtWZ`*?0se#N{?FhCt{0|+vz+Ry2yPW|!F=yX;4c-<1wTg)
z#RLQJq`wrp?<N-=UH9#S-%}R~uHw!E_;NB>g6DT4-7HvY_9&;nGK(sL3l4Wn4sg!g
zK+gkXD$u6CuQ|jSOkcpqG3ls);XL(ArS}3=*LwNE>lmxV*l|~-rR$%gS=n88EsIPX
zw6uFfy0E+i;<@L?KLIj9^HsKy*QK8{4Q8WF<OCR772TH7mORJ~qUh_#WHR9lRt6{F
zMp|2~%o+yQ+U<XSEm_&0>P=>9U+$e7fEm~I3{EkuP1#uT9~%K64(s1IH;~Dalk-k@
z%pVSmEo5^DTFn6D#_X2B1+vQBzk?U#-z}(NhkbKp&o12jLi;^@6<8hb>AVQP_4LcB
zLLnbLN}qOu%UpFM9p$iRXz5xG6e40IW-qNqPT}aLO|uU6VEd|Ni!%}tt_#RNUl579
zaU$6ml9OTs5zPSq*%W|wrb%JLtSoRai7S$h*(r1ldVK1o+u2A99cg3_dgYv!@^I3j
zDp&^7J*FV!z$)sz>Mx`3M@V_kAfV6{q_X3daMp-#r@k{#fp?mMxFG)t(w;vEDa+Zl
z0jc=M$ZXt7VTRv<s%}LnSC|@FW^{D>Wb(%6-cH6{$X}GrNGn`=`>WwW!JDgd(NOD}
zaz2{Bq@Pf}PtmdyCpLDs#Uj|%%*aa1;+m=Ag-a92R=wwOJvA17*oLc@5C*^TyG{H=
zk<de7G3pmCZ$fVyU6%2u%AT79i{G{*q&A8HU-JO7V$EAcgG=^6A8jP?$@FN+oQQB)
z1L_>iAu9iqHo!6HOLX>O8(vU)SZvbI#?J`*g}@Rtu{G9fLY=m?PvhqAWOV{WMl(sl
z!{L^?nkzH7IWQ$7RHp2&TJp}$V@HGam8bL2A)sV)=7bJELN37*RA!J&IXQ4#`J*o5
z$6jp>%Edt#Gj5~BEWUzwbH@p6COF!#(3>n7U#u*VZn}hU{jWYHX>P0{^32m^1=}q9
zT4G?b;<)0+*^aWXr47oAE;$18e~mi8k`n8<(m!6$@Tus3y}5oSA&hrYn@2=M8UF>(
zL9Oc30za$8R@Il}SOg7y`1p(;Z+(Onsl9eVE=)+Lu#Rp&Q!m&m@wd*|F&#7EEJmhY
zdsBuSh;Qb>9or{J?u0sS&lug|38OJ?hD&4f0qij|=<qN0M~P}(T83dFwSjN1qV8)x
z;Igmc31cR1hDAf5zOwL<O;^ASCE!f&0Z%V>Mlf?oicluU@S~MGX{x(d@&t8^b<$ee
zesfso5b?X^%kcV_kA7$+1>rOid-(z#{>WV>cUs1@Ia~eQhBt={H35tT1rDZRc;+;}
z64e9dci7x~TCmp6u?_(mofd=flL=mG1^a*aOx;^hNahg416O*E9<*$0QG_HSFRu04
z#&OIkeqA4cS}X!%jStnXV1G>a&>Z%qpJ#x}fx40Ai+ch4&B-}&#NvSS!Y#M{MiZ8@
z{852)mTZCnOaURAJ^JnyWc8#upnLPT?$1MoO}7S3bfbI3qf4!@Ed_B8b0HcAR<aO8
zqy0R74%fAwGb`b`OSE!H6)v_W%@IxN9t|#gD45WQ$GzplUefw+BwgF~{=_3(O?^@I
zlLD_D=a!=_+&#}4w>GjEp`T>u;;h6%!F=OtbK%+U4M3XZ*8T9|RSiuL&7{t30x7O5
zZSr6$+V5ef?ky8M0D54&zKTWek0=v!yx*ggAg-G(2x@vc$IXFm^DvR{f*;L0Iy7t)
zT&J1M`_)CQ_N3UTBM}l|5j463u*j;UAEL#bAyTt@4>BFsv*{BnZgUpbR>80t;VwV@
zsSOG~RdXCkkPVye%{vTg@yODxkHR@^pW1wfCx*KFulk1`&-Vj_VZCwVe?9xkLcoYN
zMm%<3{9>ukd<ng$8gCW1R~#aEYpn5iG|YSF7%*Ht<xs?R)$OHHT$UB=+z@{Z_3bq6
zPSY>HkWq}bZd54JnM=7!r?_&vL=)#l?Iqwbr%H`L(pNq%w|q$=L;7M~QU7d@)9ze;
zB4~g|q!XpDGN&^hmEqXzzULCjy;fCihtKh=y2X<P!S`&Yu-een+@|~e@w_K$l+$<C
zqAiZMvhyr_hNem+VRhV+s8qAzN*dI7?M&*C+>5TmF7ibNG+EWlN~aMNW13GZDWAVe
zzQd9yr0^sJLMQH?TMSxMoEz&eWxR9~Ehkb&(FqW^3(<L85Zy$*(W!EhweD@S;eIbs
zi*wf{h&@R%Exyf08P)@%LVmOd0}Tpt=AGzb!^7w8-yqHQg?0qH5Us$2`dxpK=VNhj
z=#Mc+43C^yx=99LGl*?MX=iuMKhCiR{rCIgOJUs9OuP{4^kr>Lg&QFjn&V3O{|{g`
z`QLIB43?tLvTFt}&wEk^((}|2q!~GD4Fj%{uL8TH*;nDaK^KmHjcjAfrb7~VP5-c1
ztB5aaD(Fz*eVjS}RFRG+V_-YLXIE{OuoiTIx{G0cTyiAT^?>xWq7x-zHpTt{r4-&n
z8hTMVGM@kK#bc9vCF=a<iL*EQA`sHy#|EQr$d9p9bDO4RGvbP^SI)8R`~KqqTPw#V
zK=vC`1oLf#A&>wQ(^IN__y7bcB;Z{AO|-len(EtUPxtvTgYf7-JGpJ;|Dd2J&|*;<
zv?{?%`S&(;z8^<T@~64&AMXp2?VMT}Z5^)Z$?_{~34W>yg0||&9%JA1Te&7s$L`gQ
z6!7T3Do)>-7xKwdjwgSL;U8f=bQ+t6>WaJWS|0-AU+G`N7i~#i2ebDY{#LwwZ6ulH
zOR3n|+N4#hSGkos!@mgKM!g7~mSVhxDI9(&eO#C^yCbT|uHiJg2wk@&c)iQ+`?|kV
zaR~BO>VKtV`mcyNo#8|=9OEj#T#JzwudNUApVx|5Ys0}SL3rR@h*DQ3?V|)Hh~H>>
z_dD74S{i#893XuI>$4hu8>shTkW{B&O{y~e-Cqf7*JwV(<3Mz<HeLdr*TtgM^8zP9
zX&ATm?D7BL5bZ3xklN_J6fx=q0cMLh5iqazUv!<n=wJ294L$ZEYgHttsjsrQqdLRk
zSeheHP=^ofDEJ>Hd&~y+waq5D)%p`z^F0O4jE@1g)y9F*?ave;<Ugju7n`v3DncM5
zo=h4Xi6M8z_>V6R2iEwJ+dsf53~&E8LY)f@UZYJg+ZNi}rlUK4%gV+iHS&1vEw|&X
z!$f<nPhsA9Di>Or#lNP2V$_8RIC9L84z{5jihI+4ak;L_8d2qn1kUO#EW>kOz5ATX
zN8@MwtOBrR)3)dGun@pJ^7@0yO>DO0iUyues=zCXVWbgk#i}+XMl>MVsT?j-1p82n
z`cXpHNC0dlPygO?&~;dU`5_8XU(6+f#W9u_uEiaH!&%JzhG|~+$Os%rYaFsg1-OSo
zp4n@4l3j7YUQR~Azk@ZC51X%F0#U&4MWnqw7*1nI3fO-kqUZl&9?lc?M;M^%{-M2#
z;*guxyT*WGo`iVrK_~LqdliIosxX^>I#NVB-iZvTEEP<BM+_S~pqk9Z%HI(9*~RpU
z>HnFC0~+8k<^O?@5(t4MVNi{ExR)U|K2WbiMe+PZsGiH}Ik6uEUO+C4Jp{jxjTvlG
zHk;0*OBBs0JW09Nk8@44=L)9I<90V!7T-y)jtqCn^Ui{a<S_UEc%5r)sBD;v2=cr9
zt&Btb$?V>eEV9=4nv&MBjf{b1#eWtmKpCV-cMe=j+%U-PY)a{#gJqAE3O^-(y3Opn
z2<Al?==Db<6QS(?^2p2)gN~qJZ^D~vy~hfYlRSd~Pxzc_K}r9j-C1LjqWba%l0@N;
zeltBOQbo<QUcmcfU?S~?EO5?QMoGI8`kN1#G=0iM(cVGcYUX`j%%h3;wr`6M3a#xO
z=t%CJXjvB3n|f9U<a9HTy-`-oQ6(YB(04{y`OWYBHiQ7)@fnHKB;AoUd6=&c0<0J9
zZIiHtqmSV2&xt4vC;G=SGb=~Z#>^`N%^a04nl3`fKTx_Mmn>$!55nPDcDMPl?1&A*
zXD#dA(63S~8fY=8m)r`AT*WWE?jjVDsOGYgqo9l8Em>2hP+m858il=2i;I8!{c^+N
zH>wIhWOb{{6*NpocSeXBx(M{S--&za_*=~v2<qe{(XnRA-_#Odvp_Cv1M$o>Siee8
zU+xXks9{-oy)QnB=Lu6Lc68y$yX~OoroY%6t48(1wUi}u@Rf`t|8(iC^+eB+1kQ9v
z7+TW`Q5g*DPZIUR+f5VyLWAQ<Ye|4iDz=>`jMS87>i$Fj(J7eCtoysP^8LHAKrwZE
zWyu9}wEi!oP~#$Z5nZ(6^qZ7<xsOE4osr0lr@v`F+YO_tSf5#UUC6g9y#>X8PND(L
zsxTsh6OE+%vxUp-Pe6SgV6UAC|2)ym`sj=E0(!v;>fRSc`fHPHV0R_$*TWKCGCp~`
z?PnDGL=*!ZU|P?(pbWmU+!{-QOeGJ&Z*-iP$4%!J%B4icAvOfk9=H^K%Ta|Z_Kv9(
z(U9_Fj_-GIJ&6(V%y$I@mT;~lM<8rJkStXu7rR`y6AAXuuK5fXl4xnlABR2>o7J+`
z1b0WqgJ5fA#&FXHy(UArZ!ML)-Ijfkz-Dk1rKjlgX(ott?`>(jM~|w$PPhCT+9K@_
zMjS`vK>lY=TBiu9a!-~ZR+?jaZRvTTRY`Oh0H4%U&Wx_;Ner~G&s%XMPwHYlPQ(2<
zea|s=k2{S?UdDGs)M?E%F@BU&IPWLM$6%9f?U*J}9s~zg)_E5%LVf*ox1L9S!D{2E
z;5~u~^>MyQ!K68v)A5<*I2}QkmY`M2(pz$Z7NgCFC7B*_aHun;OV)hSOlG3n=qypv
z?jY2qUm**ZO~!VX9uc-oUs*n7f)ryGJ?}G5X>=C7-(oAq)NT15RlVG~dnhql*nbF*
zWaW(R1&pM2eeFK}7d@TJulo;-u;Pc<I)Mep->c)_!##M7ALsL&BfgfvduH3@>Izow
zW#>;{71euYPw}g8j$vd()^c5k1iRkYGrsiue-W#U3z1bF4O+4a#WPc({^??us)OSe
z+DVm7Y4a_nZv&If<^Fc4AVFOqIbs-;y&!1wT{lA@3B_VTyje-Jrb71wQ*G>j6<20L
z`aN!h`q`ig1ITcp1$OX_p~=os#(qZ-0{?9I!p%Fx>)(<Xu@W>kA|lDNs-3}58F(YL
z3KEmCQvbm0bL0}8GGIR6wjz(-Bdz5`dOhd3e*OouMah4ZQVMBD;KzB3S$zHgPhYN7
zWbZBRggU}+ms?e<h`drCQjL1_SpYO(HFYE5Pe_Yd2QmT2N9M{?$gl5w;_dY79~vm1
zI5ts9E><2I&%H%sMuz9C2Sd;x5R!tzI_e4awDH*mOmcEx)1ttQeL;}Z%3gT$14@4*
zfzqv4_aTEL)I0rc)mXs#Z8mFz9<MGQ^e-X&(Mx=n%99x!1>E;zv5!w8zWgwaW{bI#
zT^lD<Z=&)V6NMRqaM9G|3su4@-Nm~OqHm6--TSWTvNV>!%{f&1?B<b?d)nhFgA4ck
zZ<hobHawe=JK*ZHw+zt5eB8)v+x4JP>{}b+`35TyL3>h=qBlW9Q*Pf5xxF1bRc}1G
zIovM?BVH%n{mbN!vsGm0lPSOZs&q>{<~Xc@!&J7s;y_Yc4$jS?YA1f6+IvqEE@aE&
zX?h`cz+&ay#zdtS;=m9AmDSQ>zhQF^!V`{I&p`unle1y`dlS>oGTr0y!28WOv1vi4
z@Te%Z(J9xv*nDE*8e`m%M2Gn*2PDT#vEN`C|Fo!=MK9`;hKMO6A>o{c=-U9eD$76i
zF$k%8I_TJ<gN)6<5%%F#L^$VHtb{Rnt!_WzSc+m_4uQqo7R&{?YQauza2w+&GUnh{
zN!-=yN3Y!5p0Q)$27cV`U96uHK6p=F&6Z2%7Tfse4ft+)?}{v&2V|Cit!Y3N5ahz9
zRdUC~P4gT*ko&(|EBy)~PtQKxG82XSlxK(ordDH?e9<P<p>uL~PCC2XDH6+h`PNB&
zF(}{#>65QP83$$Hjz`IPL-XhnJU%DWMx3WHNoiCWHPu<>Q<0qBid0r%w|#L64zBTw
z3h+tER&3W?ygsY7D5RET2)rzI26<o6<~EcN67O}QF@7fF9gj@Kgrg<iGyl~p!*wFE
zbwhdHsI{l(Z&Jw5>t_-C=mK4&0g_bca#6&`VIk|M8oqA>L^0R=wQh~*r*ggopWnla
zQ?lC=BT$e>QsMk!r3b%ETr2SHDazyKdp)re)nTgqv%>Da48vT*($6tN8AEJ;nAr2!
zo7s^#WG373--j;*o=3z^X)b)FOE8dxG*!^LbmgZ{qNHA>0tZGpqRXs7?xwS(pUj4a
zVI=*v1Xw<A$K3NY5bFSokYHN1H+>55SfA4Qf{$U{>8aB=6^clvSRb=2fTh{!;09cE
zP&ZQ_pA)v$Vyi9p<m_PewzjB#g(?#G>o+t|R?Iud2!#6(ptT^|UWV-2&XNB!6sNI$
z-XWAcwfEwiJ`Th^PyxewKZw=3`8yG(g;xZd#Fc5bGt|Hrx#_!qL1P>8v7|W$m>{@X
z_LpV)6;jqn7<APJakcwkzm2q|%oF6l$QPM+Q_Na0xz8Y%-NS-FZ-<=Pf4~&D-8+vG
zg-JC%&k(GE+%p5mtMXnxxkT5$p_Lj;_Jwa*LCW2#`k_w10UTDcNsFGD2~-jaGxy04
znEKAkoM8!5A|&_sT?&{cq4OSm^k+<;E^mo!d;De;49!A&yNnPI=fklASw5)h^-EBf
zkx{_v+ueJ}X@3&j-ZqKBF)i9$(Mk@MiTRcQbYf29*oUiKD^B}=5mDD7xB+O96Dl7W
ze^K@ad9x9YUn#noXxw-_9B-Fw-GJ;Wn8EZty~_-&Ze2QwTCF}FOKe0SLuUqcXYE1d
zIl}QXDiD#paDD{@6_doW=h<IYY<DDAV{Ol>`VqZIXRxvPoFmDec`N8c>imtwOm4sm
zV(Vh*XC0ZR>rBdu>Zrz6PIk@?St+xxOf|OU$iX;gWw?Cr3<vffmgbX>n3_Rny5a%l
z2_-^fwSg;wa_@XG_V%Niv3GS=;z>pZ#a+<;v!}WDSS8E4@QZYD2>mI3pAt)X`T;Ef
zCcVe*0YG?UNyt8I_#hrL;eia1bRl2|n<~syQlR)htS|qm7jE^H(oGv-+OJb!q&!nP
z;g+q&1>MQLGk%*ekD)J;Aas%JHnM<Ss-6XtjOb;!N?*^@6DQjzMRRD~aC8aJyl~!U
zV~&2YCxJY?>7CpZBy*IDrCS$2`TlA3*a<G2>t1j~MXI`)yWW`XSrPUVMNIUva5Eb*
zS`aS!5SGbvBOADe(qhG9mfIgsGTFFs1lo%loyhVZcIy*-n|-~kcHt3m*jniKrFRyZ
zY}jLn4`_30Ky6Ek&W}bY{pmnhE2s#K9c^~|7ZtDzrkxRsSs&#oBYw}KJg&W%D5l&I
zq53GuYMTe8vTY(;&wF1-3d@m*sjZ=P>G#C|&ZcO+S;{sxY&FJy!ZF-xpK^W&AM97=
zeOY%RS6f-b7&IjeMhmDUv6OtJdN=sHD+U#F*YavZdYTxq*cYibXaxt-?;A^El@|5W
zh=!d@oG@BN@$)-mutMgv+m<?0E9SzG0(fG>u+g4GcB^f_Jz*>LPS44(0fnp;4eURO
zEd<As*#iN!wtvANHk0uKnrj>5kA5eIB6nd5xjl}*rQlhO_m1DQE?!0523j^0?chP|
zdmbFVXlk(SR0c@z*<LZ4;<(72wV^|DSK{RlaZtR!<#1Svd`nud$WGdsc<?k-p0mQs
zCOEh;gxVqQa+)R-lGKmOf0Xp9#hXhXAg)74g#B1UVsKA}>e!3P0(^|?`rQOG8LD`9
zsit+Op?jbCC;*nn?3_KTmvn!9PNV+dQMU&Os*Gh43m@}_ZPY%MmEH;fAs(xbOsK*I
zo#;5LdcSXO1{4}4V&9X>JMI=)c382Q|20w#&~Kp=`kH6>2DZ3wXt9O?8$i8++M%1>
zp{4|8p8k5cB8GGE2vsHzasv21MYNcr2(R>gN4^deSWU(rCIL^B==eRlVR8Jdu<TSu
zvuUy~D-<PT)|lxPr^w%1G`gb$TOfkhY%=?{`ylI%XLt5bx&UiU*gMJ<H=@z+`!Mm?
zkc4BAbI0xpC)m4=S4Z>puzX^q$s_yR;bX;xdLYGOMchN~>zgb6s$RrOM`lL`rHpFH
z=&C<HketOx=O<^&P&v$3NniRNxwoQh<v*<*AW_##-^E-})&6Fct!b&o@GHzDTUAx!
z*Up{fcY(jJr}|wCB|_UtqoX-*pB2~nc_6pG$!;#WlEk6^MABU6QC)LY$7gs3veg2V
z;Rrp?UvHZpT_fyWbr-1QhcN%Hf7tpJnKaxN0t%!hWl2A5SI4ziqg2(IYJDcsxuICH
zpdClQtVPV?kDeC~%f;iX;5acZ4<7XsstUh2P(?gsZzbJgH2hN_Qg$S*SGr_O`U5BX
zPG?V6F}LW4D6|846lW|iiHstWA$ln$r=<pp+|Ub#S-UfZ^IoiLJ;_1$#C}<S&$4#P
zbgP3-syy3&n5K=~1H1vV9{x)>SqiY>AfDseovNQW_Fqo9wavoELiv(&!e`G5e0N5(
z)ys~GM@N<DsYIvv?0aRlg>(j^IZXLzkIk^Knw>z`<cEK2eL+ZKZ(2VsGR=R?!_8&7
z_E=A%l+k&Z0%q~f7X0f^zqgt&KIZe4GnOewFvIfiZTt@K=84>mW4Pap7tx#)7#KO1
zyT14#qwA}v55OX}r)TVtW_FF}cC5O^ju@jJEFrqO$oz$wU(tn&=$mT=>2`|9j}x`i
z`$H?-W|BF2WEym_6IA9Zme5k<r2@(x8+9_}ABWW-r$PDnVECdxG2z6X1vVKwmx^Lu
zI8)V}_ncvdx|l(Y&b<C8HCbZT*;5A9yQ~x&?YU$#u%iYCr!^D0M2l$V{54|7A%kXX
zAzQeQNvMEsBaNFvYt?GRwajxd{RV|>NVElC6?Ygh0C(J7%}1Sv?Ski&NyrisQu-a7
zUhC0MB|bt<EKZK2C6VY_2gJK2j2gqwtEfUv-hXqQ-q|0bN0bp*QV_GqQ<<s}20e%u
zz!l){HdjSPgL4wP(sNRmlX8@&JBRvK%9`!A)+{<nVOg+Yl(Fc@ldpdMBUGZs#C|%g
z(a@eB4p|I<davN9PM3AFdm=lyq(Aa6UV=vl2a0mB9(1wk?GwugLN+cB#949s%H>fD
zzbLv5{O1u_X|$MxaV5t3n@vLvIWFw$=bVM)kQ^aKWHY{g5asX|D6bG4(N+%fa$0Uu
zo)%Ax;RG3KlPef2;Q4uB^5d?en8_wgTqI2SCwhw`GVIX%$&A4!L|Gv6`CpT&U!19M
z*nSQet;r@_HWqEYt*#0$PGe0_L$})hH3Y&~@{C)z+5sqDO|_63CT+Bu!>z=6YYPRT
z;sjB~O|c#RiO!3Q&>Jp-S)8LxA{f>N!5lODwrS8FaoW#?PxH1fK%VnScWgZz8kTFk
zoMNy1E*JbU@$9^sAdH_^Oi{Ga9vi9^EC2$oNmE7X850qib*E2_qNSf@vLCcWg^;H^
zYnB<8Z$e|M)DDkrK7hxJDgC16^3oUo9HlpQjrPmDZ@f$6ehWCt4~&e#x;$5i7Sspn
z(?^U_^b9o)%@<XDnlivZQ3a3m4$imQ6PQMjbIa}3<&GXmKcGyyO34KUWg`Uje+f6N
zwHGSD4;+^dyK$yDc93HeeVd?Etd)-hiNb?;<7YIUFS_)5X=wesZP#i~RPL*3R6Q5z
z$Y?slB_Iwy9X;!2*y0#pB8X#MJfpoySED<=c4619l@&FKp6mziu7BsM(ii~hyGy-o
z+ZSE|zyiu@-r+J;8G8ei|5)3V-p{rx6ZUs0oR1K`Yq5xkTa@gRA{#_#?8sbP{IZaU
za`vR8eh5M<*67$!wjZU<UY8|?t;(<T>lcHRl*kBiL%*Tcz6CN;Ci#hlgq?b~Mib6{
z6HxxlA6v=zX5NR6tkH-bz%79?!a?Qt^kbB(*uIz-^K3chp98ijrZdR<IM~i<Jf_s5
z5ICnqGn+Djp4_1@&VwW8FZeR>k)|q@hW*ut!Yi$8E5J~!^=dyz=f`LjkNB?(06N}?
z-4F$2>`RB{%#E~UxU-myK2y)3L?GW^6K~Qxf@pMD1u8%c{DL$y9clx&9SMr>%}o7|
z<Llay+Mm<=^K}I!st>VCW6404G;+jF?0IZ|-5~cWh2^T&?gF2^Wb|eEm&N*8Xa}MY
z{(&OeM2x?b77}Epvv0$>6%YW|#WRa(-U1jM9Krq^#5;}Hq~z%>@ws&=f4-o==-7Q^
zg4+ZtJ~{e12Kk_p&tR>Gun}r~*(d@mclzV~7&_XxZAq}$Rf@kHEUZ#Vh<_Z{H%Lq|
z@P&ecC2%JBqL-%bCvgK*0>4bCQR1OHG<RJOIOu_v{}c#@VnDoix@G;5lUfF+z9^Y)
zB~QbSG7xdvr1I*eqFeVu#xuHdMkDWqX0i^^8ui}z>B@2GmS;YNTM4^p^}62)C#c6V
zPk0`WFD0F01<-;~s<~Wb&GaxyYS3s{#bXKM02U;qWmVy3{1P+@l^efQu@&}^cz6ed
zjsX(fDtNwAsI>=PlExN2a-rlA<`bB2P;!65b>Hs^)D2u|S=m1ms_mG;h*M{vIDztW
zMaUO8VzoC3xY4AH3#k9>km;O#WQND_Zi3+~`*$Y46#x}Q=K{zuh4?e8;gZx0zL?hu
zj)`TFYjq>!x!-$UR4lKW^f|56QLX=2bbU0@KAX)Z-xPGwyiuqWg6-LJDh!{2+kS{H
zZ|%##Sy$1@$TI+`Hf*vd&O%!#rdb_OfpYBM=994W+`#ezrB;4OELM><_ALxg;3EYT
zyKmeQtz++uep-msIeTRP=P1Y;%t}Y$W8Jxn_#t)T=FlH=j^l9N-k+#r*`0z`pld)R
zvQhZtF3kM&{dCM%wEsiv`PV{|z|i7Siu2+tLY**7QRWOPs-&DQkG$>A;;Ky$9ZfRG
zEl3qTB)SmF2m4WQm0Js=f@#yCR@E%#B+2M^ZclB#=feKLBNC48bkDB7p~NNkKX<9n
zZl1BJ&5vZPDFonFGxGSZqV&Ga9q##~gzaO=>rUmq=tc)ObQXfD?ZQN7x20xOQAL;h
zlB7NRKlVcD%0Qc%f+QU(dnCxkc>ljv9JyZ$ARYVfZWO9%t^?pF?!&OyIckDv`ih!J
z(0m{u(EWyje+HfTBhB%(4M$e{HPVU`N1;b$O714Rw{AM;j~K2!_L3`bT-dxebS7(W
z>gJo!X6u4}(8B{#1=lCbG*Jx=>K>~Y$+VFNBnwVM$oqgnU`UrS)FXH(i@PaEuT*^S
zd-kJYyCqIqjZj#9n^4cHJ_<u4z}b0(GwcM%jNSO0L4uG3G-64ebRrl&WJAzbj6<NN
zL6a=H`(}7=eeMXC_F;quW9!s%Z$QtB!oq4}(|f*YkmAW}CeM4FHLkpO6qEBxo1igy
z)6&Kh&HFmxti;y9<WMz($_J$1Q-t7P_HzncR*p#CbqCyS3njTV8HlG%xb!CSrCXnN
z`TI0tddwfMfLvS|@<=hus9>mm_b2^o52SoW6Vw}z%0w3|KyZEDG`Q<c3>T6cyW3aN
zswE8qfCHF9R}}SCv0}nyr7~QfxOiN9@a>!%W&XbCd!<hWOP@h^h5B2RvNwsY_AEyu
z`p2h*q8A_E!zp>;I1Z}4Q-sIUvyrYrXaUT@fi7&al*jq`4H%wfC!V`pk%HcIrxIoT
zFRJQ>VtZ@Qpm;Hr@}E;F3LmK@!}NxUC;W3FXULnnzn@NtMi7}RRx!h<RrP#mFCC=~
zT?_%&bCj^cbZvlYpJ3|y7LT@%7%-IrS*U5h5){JY*AX8ayJdn6^_Vbq;9CJXHiCmC
z(Z@h^`CTE1yX=df?n~**Leo&|s}~LV_k_GS(_}!tQaES)(J7NM@9=dS@gXN><!{82
z#oqz~qbXU*-9*Y{!Z>rd(&TA8q!p3l%eRDF|EM_e_{dDsN3ailCAk5VOsC0X-ghlu
z)fx>F{*w_vva6k`Vre836!Yob(Qo9YPN1z6uq8#@9dzGc=HuVP?tLA1DJ#p7H)fq-
zvK6-a=!68H=_ZI=?JBXmn9j*EmpjE^zi`H*I8LMdKu=0(531D(rYHVe>iEl!qv_0D
z2DZW(!4S<UDj7jNi2PLR!joO<?^&xpgF?btoS!vhSJGM+*$eg0r-fO=odL*|KHk;2
zC541mrjHiyts_+}SwgO;M9T6*6kd*$b(uOM8!vp=zYp*E^LUHCck`Q*tg>iC&i{hq
zi2}AE=XXCozPbbYNTH$W&2A<vozX(H20Qk5g2mYmySL?}QVOj97f)vy7S$W=ZJMEn
z?nXjdYUq@dMjYt@2?3E#>7ly>kp^MtQ0W{>LApjdB&55+cmL0Muk&HPvAJgU?AiNy
z*1CW9O3{BVD8=f6@g)hvs`=6bT?mNK1osO>DTopplr`O8Kjcwak7*F_-5mkJ!7;Ic
zwvWbre!1P5!8hdhtGGZc_R)@LKQOOAjicU4J67+!o5XZ3m{lO@T+7y<xU-zRbu!~B
z_n0g7cuek2{`kYdYz|(!3`yAReei(2(UyJJwVDH?`<GUPh=2g4*l%6ZlV%V(h2H%+
zp2e29cK<_7qi!QySm>CuB7EbKA40Ap&j%}}3MPz~Q)E^^{ow{|IC=s8j_%;?U?T62
zYK3huB2f}cRc#Uyv2??aSV$!Qi@LPs6La##Eyea$Z?aa-Mg-&fWuhUSMQ_}gs50Y>
z2sGSDtx3sa5QyM>h`tZQ5KVuB^v~z?MyVK9xKRwYSfv&6@7^Lh*q*A3M#f}wp^Cm@
z>gPM+?G@Os*~$7Yf59aWO%jrEYanvlzO=dPq2Kx9EhcjnI-APqYXNxiW6*a=a(kZT
ziXe8tB>WVS1c~2S`jn^_-aQBlDGi!kVX3xaX$$^+5+V2J+Ej7y7)w(Mk-H%SPpS69
zQf;R~IWTj6wp>e|RL$vlOeW5s|M`(GPfL7Jxh!MdDIW=a&wHQx*EWRd5B7qB+7W2E
zo-#EAH(iHj{fAQsUM~snT7WA7pUj4^_<WoO(?`f`41+u`%{w23+&7SQ(c{z^Q7x2r
z-{$!6hnyj%HGlOD{^;-XvDIZRR){wI&N9M6r?sTDLY?((I~dI$hb7*eNpsw?omURQ
zL6|1<IL-NLf~GJ8tJiKM{mJAM#e8;|{=!0x%WF_^qMZo(MX9anNlC~kYc2omV6NQZ
z5B;dPC{6?WDyg2dLq)F~PfxW|L;tO9JNBzYMye`tWSW_O%2j7XT%ouQBodY^l`6xK
za^yrG?p25HiwLQE3vhPjk0{ptrl*fYb^Ve5+<FSQLYX5)arj@;kXa=o-@uY#aZ@9|
z1bLaZew^fFuBn2`K7@I_Xc$WrtC$oa-S?nJmr!zz`@>aiIv4Ib{7>!_4{dOVPK0J?
zwr8_m%nT7F=U4xS=P3Hz9J-e@soufv-bOpVEWKXfJ5N3NBEl`m&0Hp49~$y{o%W<7
zO2tj4H)WcfEeg*mW}?3SNp#eKa1{scVD}&|P3J3Rx#Xl*U?dy<xTX*%WV}E|*{C!*
zKQF+{M=%h7RJx-4-Ffat^Ky_TZ%JVwdOGTiRd&OdyP(eQQ=hP!;1}{!J(@BbHKuTi
zfn~xK=|8LISYnfb81&2e?&FHd{TD#5kVFG$gsR<?E>5IDa%m<x*7ga*^9m=w_xSU4
zrXfobC0ikhdpu=2d&4r<t+;EY(z%%=6!G+VKF8~}UCEtMrz7X_D2=g2xu=%Epy1d0
zEa7sd&j?_prT7nl+iSt>bc%CqYrekB=ROejaH*>>36(G!9PzcbK4IJdr8glqQH*>R
znDMe4jrGrCdYg%3HWI`!YFy^+Lu^>cP7Rw;!nhF=ZC`VTDg$1|MDzAE2l3D>*RYDH
ztWo!#tXh!IC~w10ziD*G!w_k^@7SS%N73PvdNk4i>G&P^>>I8<QUhx(o(yJ85htC%
zKVu|`aLX2teEL(amlALwY`c0-v%2;5B#O?{{(u)oSr0PohZMi22~+oLA&mWe8m*qX
zwFY5A&ZR$JGq5#Wk*+55Zqr2y7Ev<#6*q7Hfp5$v>GvA*hdqlF!}-SZJ_hh5M59$C
zOuEy(2FhSjj5=4bKQ7$wc!*|XM|h&*JreC=ZM0sAgwg{3Z-2!qdji&eF+HibS>VxR
zpq*X5Zx<;@TgCvqjrD6PGEBojy1-|Bc%za#3=>zSo{g)9{)!Z;o1zByqG&dONvzK9
zCA6cavo>wpB7}4Dy<01Mp@Rhe>M=GayA{HZQ?;JQjizKO3&S9voYs#jN0FX<kCwqC
zM0ao8`h1_nQ{NMOq<xK?nj)~UusA+<@4dABhx@O<jcGdYxzn;TFi%@`r4Mo;X{u*w
zj@6W_bt3W4Io?{FW87GoMcn5QNCafzKhH^^dJH<`G)qtaySa(CZ6kHvzapUcg4RnY
zLK}{?EembAcqYXauvV{(X}W)86CL&Nkl0u&&lQgr9mNu)1;p}bkQS>2Kpo2u!e-w4
zIAjkgYN5T;u~cw%5JF<K!`>EQlG8JPBb?O8eANZqj&%-^m&$TjFf22|*UI0U-Bd_;
zC0u$o=^sHvmjgc!=Er4sB5&oSn8H9;9a4HCjS5z-Af-ToUKM-B#|MeCx<TPYw-}3W
z+8~d`@b7eOZvAu2p|8xXT&$xvpPF_>KH2BjseEelplS}aI933r-&I}i!qR$PQ;469
zNX2LW`K)KzO!SlT+<F_9{BRLn;{WO??P_Y1pwdIlY9AFPVqYfiUTSv{4ApKdSsx$J
z7OHO!DRK7aA)F&Ec{g}^F%LQN!z@&sa~pt?>`L$J4Jo5Pe>lGfg|FQbp@Qc>&9C9k
z8Mf71XuOi4sCy7gtZ*3+FjSKnD#5)`XGD(e_ceT{b9L_$NVorP%IvsMrEfIG*l0nR
z{$%ZXi%3YyIiaAy^w<@G$L?jjLnk>QS!z?P^Li$(Et)t<&D5SgG>rko8z0(PN~cJi
zOCQXPwbH7QFR|+8EjY{bUU{0pza_!bCMRUrf6$Jbo&kQu&y3|iZ@m{eBh+yDWmM8D
z7GapS=7Upd{J#75*&&FCC0gDpL`-wRH9yI|nVj)c&v<Ta%#Nu4+vDKV@~^2M&Nz$(
z3?o~@339jhnms2$dtR5TZ;3mc%YQYXwDc@%W4~r10)ysUe^1izQjPUcS9-6PV<820
zoYu1f5rpuLkc?%=oRe2jWT_Tlr2%^B%uzI_Sm12!^MG_*KW23dOG7ZH?z4gmeNqPv
zG4gIKjqW|(eg&mt5d~{VYMERZJ$gf@Ce}-4Fa0s_B~Jx~6Mpj_4SY)=8lOoR@-u_b
zb)>=|hQ<mpC|XIAiWP?fx`kkQFr(n+=KVf*aa`WYeaGic-Inrvo=8M(Dpt2#DT&!M
zK^_I(3%l3?wTecJlXm{s53m~Yfn`eCQ5EE^1xA+sZTVW1$P)sqXW1sqFDgjToFna!
znJQmf5dRQBGD@8aiS@I!C|?^RM0@Ut9R5<aCCo35=%l@s(Z{*by1o&UF6ztbGpw$q
z;S=4VvT+u4j%ChrWdT4_A==SBY59-L&dpZo+Mz%2!%gLw+oPoH^`=W2cXVSfprq(3
zO6=fe>I#ZmZ+I$mhDr*4tffCLdT#b!Bc8wW-d%9He!`)FzA^GlcpF*=zN&v$ck-mM
z%8Z~XT}rgXtcTjtVNDUcqb^u&LBj3V$wCU&p~|y6=kIKKlzgwq_GX&ZRp#8Bjq81$
z*PkWme`@$!B$O=tLObL6O4%fM|5!-=V{&GnmxomOm9lq9&!|+hY`QLC(fQ9rDO3xN
z;>YMtK(nUt+{?>uqojdT0NzEKIYuQGCJ~LZqr9ILzNU@F+jA2MRYF0&*gAc*nkYJA
zYmC*%@u>4i5N`BM;UI=|C(0nqdhj`+$ZP2U-E_#-s;Cl!X%6&0cb9ITA|$%&D<&9p
zmrJ3uA{k$8#kVG%A+nhj9->!grr#p7pFBmVFPUSBVQQAR-^mBZD>?$__(V^|^#A)^
zI>zd~GokdiPe+n7qJf)#?6+0DkLd1Vf>w_E3q8Me-@|dYmYhT@-Sr%0*KWnX*xU4E
zWensUBk56-4V3Z!Hby_z1wGZ;O;>i^RfI7N_NF(B{Om1hChR%E0iHA^`CV0+DsD8=
zdwP(qWXhh|7XX}ASo<Wb>WCTMk+}#!L4Ms&bg@i=e}FlCKt)x56z5+2jHsjiKkN<1
z^=F!Oz1<}4@r6ZffA$j~nH?A@1ltqnCQWz;`gNdcsV_4<d)OE5?msahzHEs971-L>
ze*BAE?#HIqVeam_@BIfaT`+v{t<2`6>w%d8Sd|&CADEv@-Y*G0lI?kCAtNU9Wf2Mg
z?z%qqO27VK_PdbkI;!h|k~q(+^qK%t^%Xz(vX^<i?4LH~-)Z}eYR<o8j~BI%ly_Aw
zYwwoOB6p_>WVerw=i<Dq0(!6oF1hMYGrQo2<=p4bNXCtC&T(eT8GGB7@!s4)mEQs8
zfQQ3)E9B)vXkAhqze%`Q?b_e<c!KR*H~qw%F-v6eJq~*6pA6x)$UbYQ46}}_M2I$0
z3Pz}k$sIt8XOD~P7&V34y6QlZxrfeO&eQ(@<l<BHRX?b0YRa+=0iD@9J%j7iiD^0*
zU%ijYO{xN5TZkgV%rxVf#Y;;;KJNgcOR&4Z5Fv|Nt#+Ku`|BemW#ldFbfYr^zz`+C
zs&k3M>uVvWKsy)f^$HD=yC!pvD2+Dp`XzYauP<~1clAl7X8j*zrqOAEQ)KJY!3eSL
zW#!Bgv)lV6C7PMn;sU=&$dzeG*eUSbx{kmDPGR-7`wPk_4wEx3?4xM+P_4ZG@WoC;
z&~T~vi4O)pvCTFeGa5}CnpPhCq7Nn8Vf32ssl3OjG%(0?3zb|5t-87Ect|Y&E4>_K
z$+F+XivgsbVIom1Lz;FFw!ckHIyB*#ReyRijs8oKu>Vw;`|lc41<2Hag*l&J!l8vn
zR_}yv$V}h)?eGV?)3hN3<JyQ{F7^7JxEQ#03G@+sT&BI@akhK>lq&Ui^~Q?O%USGD
zU8}qG<!4vc5~I2oUpMea<xOdio@j7YXAY<1QSTN){wj@FgEsv8z0{{pd;o`kSKM~8
zM(=W56!^4gR7oZ<6N84?M{A3KrdGV~;EhGqjcoKu*ofIjp}yqKU~&+7q#)ViiA?R*
zuUDuRCHhbx#PRG4cpy=P290(U9+6Gkz2kxK#ws+%E%4*RI57K1;TtpM=ATDCkVn`L
z9@w1l(L7`7?(-|{{Rl}CWe&cai)Z;QjTNeR<3M_fR{dKNQfExPEZhziF?Yg)3#Xqf
z3Njh|@aTGjUX>OFIu+`DmU^tg@`R)t+OYb(yWbD;URR$>;9#~-uIx=k+I-4F2n((y
z2j_P~Mwyj3tH{1YS>GBc*Vq`@R*=3a$I5S7oG1bUnc+~OJlp{fBsAx}6x@v|HVsjo
zy#B>arahVCSACJEJ9@krW~Z<I*2f%U_=H>E(mN%BjGxIf$g>8T($l|bU1^X9Pms-O
z(Jh2%k8wObCn9j(#FfNJk!v$0jB4!f`i)gJ$D{MdP$8zLD5aBjkVtR?fq%WUKL!IW
zQ0Jfj<(B@jQx{VRr-~tV!_Qb`JA%~t`=7-1wJ*a$O&Ur>-|ybJ5+*WVs?PF~X7gw(
zb7ti8k6xjN*y^_kI=MQ2mP+^1>7KpEaQ-#AvH0^0(l7(obS(9~w$gL$WW^S;fVZS<
z!&2-<3DS_6zH4@gWglvvbU&|~x^AFQn{^pD@etJ4@*?mU05w1_{(3H^M^Za&or|zm
z2_)=lQcJI_e)DQT`>1-6yldb$VV5VU`gW%cK<*$-M>DP}Kab^ZPP(*79q@p`-x7|4
zqAbNiuwa~!Kta~3R}EHQ0T3Y8YA=m7p3z$!*(D73(xYV%#O*8rIMp<xNFhG`<TuT%
zZF&Fr6;K?~OFMyGwIOwYXXk&RJA~m_2y4-X#zlSa(_R8ZDe?EZMCyp)ku$MAy~$To
zk<FDgLVB->FP|bxf(aFUv=q9ujTYOmm-unr&MKH+h}U+%-{K4D=^^k<oed2&_AXHz
z)HjYxCNM^Q^JMMJktX@v^r=VwDYH4DNl8zmh7qUyz;D@w`VXV;>l|)y7yvu>x+ZC>
z2ooqytSvIb=9@jn6Oy8OU_>3CY+g}BVbp@e*QF0Sjzeym!)SxLEmmEJj`wyKiY0HF
z*8S>8yb(16)RsXp8Be8GeJ@xYEAT96uTMQ(jSTU&1YpgczVusTxk=ilqpK6cjxsHq
z=ogy=$Ng+iay+9|#d^S)3{73)4@73#S2q0yC%5#G0i$c9;dJ97k@NY4jGLQTV|lDy
zP@J>4{g)|H?`S_kf;~x$M{VCH^VT1%K9^B<p(@xnWQpf@c`0ZB>#(n^8^vKB_G{V`
z(ic|(AX;E}@C^HpRu5dR#yu;hfPK?utogPBw|}&PTQZ?p9sxo=k1~9)qnL_P-xRUP
zNB7oQm&}4DH=?ayg^m2LdffKF6co|pujb)#Z3(Ncl?rI0-n$bYQzEDAd-Vp+N_`9e
zX2Vo|=l4%+=%DPHvF(g&P%Yj(#yiX*<!jyyl4&8Fc~c*OXY2H=)iQ>Zprrt^(=f)N
z)W+$>aQNrnq*bt5&uI&D@_@ydT2_<|OAgp<+Q~5su(^P#Moi<CiN_|C6u9P|sUFWL
z9ykV@l5~CDf;Ks`c0w!Q<Yj@bvntGLf^urOp%z-ka*0p>B4tYqLb^r`NS_rSB0Vdq
zwnpw!YnDv*CI3d**K44@8<5*Gx&XU2?O%89#Oa>Dz;rJ|jeGEb<0rT$dy8EA6zH{f
zEG(K0u<vx2`zon1vEJ+-TT{I4X{vvvMoGXO)H6hcdQTOSBVmKk8jYA*lZB3uM^M*<
ztqDj=U8<tTcG4lQAwyR6`qVnh5n+{gjZFv5-H8~)kY4{Iiz?_bHZW5lqQy%l7SGoN
zG-~oSz;$ecu5tXrE-8z5Znqct3uk^f6R0mg&yuhQ#>}@w`G>VP^hwmo*O547j*<rr
z?!CNP&-M{;#A}>KJpLKJ)H9TbT>5)9ZqWhq*y0ZhttTKOm%_USwR4+ad}Z_f^x392
z6+25LSoqv0Pwj)*XS6VW$#7rS3r=rmy(0gv?q{}`(BE7v`RH-0RR;%<L#dqp*<u*t
z&A9a{Tk`N_2l_+x=ns}|gw6-N;)^)9bA!B9A!R0b?(f2+jZF6modei5ebuN$E~Lwc
zKE67i06b`1KY91w?eUnj%2J%fvhJ07pw>0^$HK&rI7S!INwI*x)ZsRs)znk(9S#jB
z_ody502~F&)#<})oGGGtp(d>iU=0A1GXG~<4?z@%N}exR4l$W%hacasv1DkVsp%Q}
z3zATiFh`x9-lW?J81uaEzlkg7_Iqw?hxYeXt&&YK`lv}WZ1{FF-Hu6=$Qew!s6NI<
zOJfLZOZqRh0nA!!rQRkndmB|&M*L6Izx%6?isav*0J<U@GFTNGX?Dc|IODmXf;X-p
zoytTSns0<`-?&ik?<-0qP3L?H;}OBwcp11JSEU62`VqH4%HZ1Z`Jt?3Gp;NW<w_Dd
zF&8D|t+8SV#wGU`>^rkAS7w}AbK->SOYZOu%%rsfP(jQ2<Dc)4Cu71RjLmc(L-Jhk
z;sZ@V8^p%1#B;nvVg9USz2Wb&j1;mM091|sy(KoxIp%3hM<Qh$qE{-38e$IrqD2Lh
z^Q!8)9?2YE*-kQP)y3^P(Ni2Uox`&49YNXBCmrhekLpX`4m*+V??&!yS0nsZqrQJ8
zB)zTrOsAf3_(dlypWm29stCTk_Ygsg`mTXFc<?|<Nfx!B=+?Z!9FI9qUw`0?frDsY
zTwsEBI8!riC*TiCDn8!?%a~ngs{9;|(t9;glz1e@AUYkoIU@?2aIi?y3i_-;2>bpL
z^7SpIw~1PD++^`r5{ot>tLA?gO3K!xq%=`Kl4)|}n;9LYytz4C4+MVn>nCJD_CK-y
z(#<W{@H;q&)_&S{0+&i5_Z*9t5L@Nz$(@<uBh-_QD{@hI=|#P6nPe4~CvS6~l;7YE
z-K|`W4rsON*z^4y*|FEi&Y8h9Z=|Z9!<;@#kDS>{98Yxp2ZdXD4Q^dHy5c{j=JR9@
z7it`O$pKeV^N=80c>!_?Nto!+bCai_-`Zo{cl*3bRDXYB(`+6bixc*1>s~y)T_AKW
zg%RLelg#|{62){_P8aoeKK0`h{30<TTGv+)!dS2Pd!JDFtPJ}miD@Hbh?Aiq2u@Ye
z#4dtKH6X4&N(w_X5Ofl6yS-V_N16Sk8V&fE&vls<QOqhruliYH9i&JWkjdyo7n#2=
z1uGeC$6(MGhp%*q$LnRs;_9Qm>EL<`kb<rfl%sVSkTquP(MuqYB(t9R%=OK9B3?r9
zl|dhINuLGDCVCc21y>~~>f8&qVHk$4DX(z#W_!Up%f&*C@gkE9#M|v=amDjZvu<9j
zv?KIq>;=S{F+69QSd{b^kzT-Oi!ZS42Cq8TG4TAD1$Dq*6%&_<L7t=!=NWNee{aF`
zM!%wx<n?lA3;U{53koA+dbU*;uHBt%XZ_bCaReGa0w+T41U^qvEE0!anwUeHRapO+
z@P(;|9=<Bn1v~qQ>4sF)MhdkaiSKRPj}-BM+P-;^8<F4^N6z;qKKEZXT1Qb4?R)w2
zL$O6LKNPk?F>97Tar;j2LJv?PHhaTn43ks683>(oQma`G>a|iEp-DqL4vVXT)wleI
z7Os5;U#daThh(QEW{thsBW<L2R#+YBWnG}=ZL8S+Tk7P&Wz78c5V^L7E&~oIsEwzS
zPZ%?k@53=$IkC%~w}MR@IY!O+Nx%RbiuYqs{s6SpF=4J;!NZ*@9`CgMeG|R~aepr{
z-r=%nxA7pzn+e-tsCdJUmqBq$6zy|Zoe64xl2Qu$jQUrag8;CFM{i_|QTR)bVHno5
zzpCeK;S#c%<>Kk~iDLGnagvCM=b?_gQs5}J(nyk`_7%pnDVp=YO^O#(s(s4#5mGf#
z--^Vl-Ra=p-^7CbwrJA7>8$R4fnqh+udn(|5<0z%2a`&~NB)tzp1)n2cwn8DKk8k8
z`^&gq^vz$GxVF3&{Ko$<|I%4+HeA<%M5=s|*dVqNlL}$Nax;Ng)i^O^*$-N0PtTYe
z*QzJWczM2|=iHUKFc&7263rAwS-0W@8n$Ysr7;4$W36Nf1}g<j<+{uTRWVZcguWEw
z!jqxMZyYLE*eq<EOh=9;LMIbmNF4p#TzG)snUMGZi`rW*obhzaXu!2b-q_$~Zl2-$
z@tpAHli>0BZzs`odv+;Nil00@zV|z{6{a9Zl?Q~ncK6?0$8prVL<F4T+ZEAdTp)bj
zBx;U?4a`6j9iZ`dXMgitne6x$0@qF?E-2o?K71mlXk+taa$T8}%$L5!_InmspGjxR
zGA`5Ygq!=R>SY=TuEJ5&5@%J}MSEnitc>`_ucF3P(2z13rRPnpX`tlRr$=ORH_EcE
zi0|)T9xgnu%eY3yu|lL=moLvG=NB>Rf>8wv6Gm_KE!@=kM%|_K0+BzS7?!H}BHjyV
z;7K>WB+72%Ck^^X+uDW@Q4->G<WU-0(gSLB5x7Zt#l>m-=7bJ}R_7gE*j}GVz@)C^
zS4?th+ByuEyzhECn$DHz4~sfg@eB^H*Ipa5&IpD!(1N#M6;Z`<Nq@~qq8S70&XNlq
z7p1;qw+X0_su*<U89N3Lv}#SA>@*67-6MXb&rR1Bje?|)t$;4fPb~Aw?71s9u2r0{
z@Lqj|D<s5ph6C(vp-a#8w?h&emj1q|GO{L+K`F3?o$XpYR!fV=tldgPnMQDa(J(u9
zkW>zI*%FG%YICTn{c=yCyUU}ax}NKrp7Do`S58m;Z2v}!&{Nc^$dKuS#uH3SV86Oi
z2e0>__HG(QJLg=LnSJkr8Nk3;wn1*zGyL<ce7zxnV8v>CSG%s|1n2&aY=|8}@9;&(
z_l{#|Be0-jhOqp|j&HVonXnz|v5_Xk?R2Q%InVNd21@j$VL``iN~qRVt|nLal#RzW
z5$ER4Pj4<NyTXbf@rf@!yTC-$d?7xI2=HCqi2kn0>6`pJiFAm!b|ef7*l5i<Z{E;#
z5Wcg$fz;{aCI%h#=>#`38c~}P-bkBHOLfj#kCbC5aJJ+`CML>um~rbob9O6f#LP_E
zRlfQqdp_wFOYO8A8U05G_QP(7Qj2e8D}+r-zMZAPlZKt-B}L>DGKUdj*axB=hP!}n
zy+Jz3>H5PmSEhMXc5Z0kUK8kJ9jsNg_Ce4ltwBI1|7<Y)&hLlc%ZO{O?Sj$|ps};R
zou5pqB+1@Q<L*`O^o@{97gl&s<h?p#y-{Sv7l~bUE{J2~QiAtq`=P8RmK>n3)z;tE
z$@4kyY#Nx6+_9IDQa#cb59XxgY0ZULX+x_d3+{QToW#3Fviy7K-{6?9*h*0WD;}Z3
zv!6~e7j@Y2lV2k=9q|lb$tA?=Lb>9j=)}LYck6UiAIBW2bfGyL*||x`5WDoO5g2Fz
zIL3xQjg>!5o<S_BCd(VQ9U4!G3Wc}DbhEYdI9)rcJ*I3VJp256@Uove`{D^|%KFr1
z-sRS12khSrWMx!R%zsOePSXlb_1XS=1_M25D-{e(#r${n$|`78=v&4dY%NR@`rI`~
zo6*mkXsnmi55d+kHZJfUy3VBtr58BVi;D4Lql4s4e>4s&jx>R|J|>I@F$JM+TnHs6
z1lMf0!))4K)WJq@_UCO94(4%=@!wO;8`Axwk(NNfwpm}n7d4eNKRkKXi>&ibV3NUf
zihzCoS>uiMgexUgX*>TgG_l>SZ~n9Or?n>(Z^#Saw>F#pt;;Ze<U9;HuENxsC0Mj)
z1ZVgE?A9k{37w0NVsDtI2?4qKMqAG;sW>k?!#|S(WY1v!^SYKm-WLb?#feCJFMZuQ
zw(sy<*8na){E_Yf+mqyBQC(`p+w6783)_5BJ%J_Xh;J06+2zDccBoV_(9r{6XeLXn
z$UJZr6%OgC4?uirJULcjN`>CA(Bq2p^jw-?=k8U!1<&S8#0)Q-*Y%20y-fdTK7E#~
z(&MPQLjP>XFFQFD^YcudZ6@Xi8O!yPgJ=GEoC@X|<l+KHSi_dLGrZ$^O9@$R?4Iwn
z3xpYc*R7MDJC>!K#(*z_A2%~yJ*AQ?A5T}{#P{-#8}jSNYrWiGMu&b?x3zt)d5iDv
z;W05i4F@Kg?y@AoK73#xCnwL!$)PAgJ=!z^5An!6If{;0H3xNW^of^QI|%Exo98Mj
za27rY9d-tP7Q?@-*-DaGJj{;aVdh?FAbSnRgjQ@*s8rvbg`$JCfXe<SJqt<l>BrFz
zISavrc+bzt2C#0m@>lC>$Szws!c2Y$Ld_)I(DIV-^{KX_zYM3Zk}1ox>6ioR-T5|f
znzG<aoL?~(D$=wzSN-Z0X&pS?8=ZUlQr?2o-X!|j8oOCr>qu5*h7Ou2SR*)y0ttG`
ziK9=p5&u#va|0-ueY-T244eTqtzbW4$DO_y57HGFb+N$Sl=Vh9lqO=}q)@tq&o~i*
zZ*rIpJvn+W-n;&dCPpt}ck~AltL?7Yw2%h~u9Qjbm=VsfF1j#Z=AJyak;oK=_uLXf
z==OTzm&a_1m9rc^L=?}{yLGdI-eHxuZ^a~iA~trGj4Hh}!7@Dv``J&^%8$_Yd@N?T
zvPs(X5<O=7N&aB;97iB)XRTR{Pj$yvZHTPSRGV^k`AS#_rM1mTBBATj6BZHao24eG
z)<ZTc5W-9%nKMGR<z+x374=){DC!u^^7cG}>q4yYU0D!}wqraBw6!~F^`#76%_XZh
z95;F?vAVQ0JZ{oPdYDp<)o<<)<j<JBXXGlkLmEj7HeH#xSd4o~f63C3C56}VzD$vZ
z#Lw9`h}`shLdtQh1=FJBVRhe`)5q~;cMNQ=>7PZ^!`Nvfr~{giPNqY&#=?ULK_iLE
z^?7A~eWIp<wG&E2tp&!0hy`K``^DcZ>wO=q!co#cnTFd1PU3M{gdc$IO_Hk)O>Z2U
z@aaZZ3~DprXSmQU%z2<t<P~_GIh3F@pkC)KZ|F;s3i1zyKjXxP6`*!Mo>ZCH$Id-r
zi}#9Oi`jl#1+BsGxcdw$zNa1`wwl`NXwIB{QgT%5*qyOqT2K;9G3TPfvKlMh_>{*c
z-wVUhQXV<rMb}JW!s!dE4)Ua@bDCMD(&r=;`8a3C1Apy2-S_sV^~mG~s@<K^o1rrV
ztqXJwS+HjR(n4dv-3Z;>UX7*`oHdieh6&cpD`{<TJVU%^i>RBbn66*%&!*+rTUZPH
zKt22PsBe>(6x4ATjye6w=$WgM&ICeFM@t8X_-So_=TxV<P9gD!mjpG86N3#zs?9r8
zkyb|v(Bo{bfy`u6zSOF1pxjxqzWr7(>=%hucr2bkz*6LjtuDjw??g_Sv@GeYRkmbf
zwbE9yg6sQqk>Gqi6yrQUVT$S3pA>?KDM=IgSSYRt_d8TnC2Or-#vEuY97j*Au21_2
zbRDqV9i&YO@N+UWpI4|@;@3*Lycu+BP_VDJZ{O(S28JxR^!s2SiV;!c_LyP)<-F{S
zrlRE=5Fi|GvoG)U9v^Aqfe&l+WAtXYP+EU5`S!}Q=O0I{Z4rsIe+#w+!2qp|vI7l@
zMa(0;<}XK{KSaSxHguj#0qFQ!A%+N>!xHu+dVkGRhvuO}Ja)L344vE-H~YV>MKiHl
zYe5Z7#EB>49PSFWnxD^2|I-BX`Rv0RBbkhhtNI5<q}^ua&_XTHAr+PA+U!2<fzqta
z4Yk@q{Df~`iZt|S*Mb&ZT_a~Jyio7GNW`#Izia#yV$E6zSS0VHIP&?;JlI5QH5YnT
zH{V52IqMQyZ76gviviQAt8;4;F|bT1D0an(9>IWZ(R;1Qh%wX?Q8!jvXU+uDf_MjD
zfkgWrqu|9Opsk@8n9He?*MTjc1X^tOr5td)6_Q;eCdYh9!*r~ITr#0h;p%o>Qr(xh
zD!pUFaQRqP`0WFeoMlNwrJ^+`KsBW6^+Nigo75E<D6U>Q@yRW9idynSo<t=4OdR^v
zB9lc99OQxyDXhhO^4-HX<EfIq5uxX7RoJM2+G0CHD6cs2xJ7NGhs$e(J<IT62(LM=
z$F`B^v7QnRzrX$LqE=YmmK=QWqFC}fp3hGEDR_`%D?)?ympZOg+u!-t$&*%i@3sL}
z%{)XgA<wP!vK&#|nmr}$nifS<yMPlAC3J1k9KkO2xnAdvFO`WH&naX^<`<GRK^uh#
zrh8@H93MCSx`}Q<x32&`hZ*oPasx}(uCW#iWP^Gdr#l#wA%;RY5tD3#e5HM@;!^1@
zKXDc0tZQxL^+NqH<B5Gi2d5BQl9`#f<C`#|x;8WJ$U0sNy@faN4gk>iVS<W4+%)JJ
zT!SA*nc>A<i%@>|jvNOE2dgf-MHv3&%NJH5Auuip6Ff1I*cixJkIDaIkpFixhK**$
z53N&Bm-etxNJC~@lfPftyty{g$`Zm#QGA2IC&q1D_jD*twg6EpXa{xbPT+z$n`4<(
zZsNFeWLwEU8}s*5Tk?f2yJ+=&$(Rfjzf`0(aC?pU<O&AciYV>mTx^g}Xs$9?bZb)G
zsl@;DysZ~0mI!tt!^RTNR<+}Huqh~dRNd_T3+CJ%U{u3MAt0ssqRd?D_hPJ`2<3N9
zk(0}~w!edBj~kF9e-uw2>NAddp4_iY)rA2t?NU~sWB4ol%PksDqa%f(8S(7dduumY
zOpy;Qb$SzUk8v%jP0ygV2CLGN(6jTr+#DJt2Z<sBZJ+NZ=FZ#qisQWgC-J24*ML=b
zE@1kS)N^aVYHs%>>YaDw{9CnyZxLx7i~@N+a5XE2R$Qs$tw?Mmv8z>W{+>uH#*ML{
zA>D1aI-JKcALO-?XzmoN=k_4%YBxhjPH|AjR&pV~_;hrwC{1?p!Dd`TC}T5#ZXqFO
z{Kr2S=a2QZ=#GdJRNJziGu~a_TC_8swEG4tqbdnHy;r)g&g%tfIO?!pfI!#t!fWEY
zbU3zuDR)h=(~Mx_hm+u<{FZ}=n%}nPV33*ERAk~iZWYXTVNU+urt%Y6cu~3ZZUP*i
zq^SI!fd_Jb8elO^_H$M<)-`<%{aQ_#qdt26P!z{&(BK=b$#_b>)6$m6^4gsF?&_fb
zXYT;C&4kvwQ^QksVf^?9`EB;CZ?|$J>Z{3n@*(T}I&}~EXK^?3<ri4c|BP0sBhB*#
zE2#Ak>mM7o^jN-R>;13>DhVD!&0bW|072H*&6wUBW-8~<)RA7>Q>DR4Q8T$<`%3!l
z?PvXOBev0SOu5wA!WdGHc_@#*N<0_%Tx~klF0PprzDqi<c(>l4!J{)E9JT7JjM{e9
zSTfXsG&AO?whGEwSh#+Q8m@mCx4_Rg#OF2&`1m12gBPbkxy@!hr~R8LC^AmqPuA&F
zXjo3l%x1KsbKSxFu1t+O_1M+<`IP78Xkv-Ah3@6fJ*>Fl;QlkYxrx`><9g5ELUJ~K
z&l~alwg;62dJnOtYr&98Bm2I}>&fAO%cVEziU2azsTav%j{Q9}_rv&hdM~kmp4U`a
zm5<73FO^{8`!b;(;3S;?T%o=7RbNTBNqqJ+EiV*#Yx!;EB@fUn>s#AobCdGtYIvRy
zwNdXu%!K5IEUrR;TDtTVOMM#A&(1m>nlH9$416xSPX1Efd{fAbI+MZ#nUX}s$f)%W
zpI?f{inf3zD{O;ENBK^M`NeK}_y*MZU|p>Hx~;D6S#a4m05({DrDP!xURZgs1o=YQ
z@oJ4wUq*U+_4GGs)U<Sw(2>@uIbWlUKF!z!*=0F#g%%Y0saoe|-TS1hj$0%q*GH7p
z=%ih+T$#ABz^zmKX&FzH)YX0#d(;r8y2D3b6^gja6&)SPEijeQ)-wpB1|ls~a~)s<
z2$6muci@{iF|i7xR>7~;<>@PD<N`A+vGSEH-nXJtUw!VG>M}vu6F|u`rm}bd9Et_M
z4B~w%{N=@C$t~huH8$UUs3(ro5IRL4Yd=g`wg$`Cj}Hg11)6<dw@n<)DTRWcE5Add
zQ1on>{lwzeZ7PJ?W>lt~lRQa)p!2N1FHw>^kN*u>6a#X76e%Y-&gXyhjXi_<wDg>8
zrenQ7r#}u7ys`!N3kcZ2mA~$x01UW58$Uan?(%4bgqN51`uckH=4=~LUQW9DW^4BM
zZ=QC7-?yA(F{Q6pgP5C6Pu=e?EdPB+tK-tiQE+pscYU#P?%TQSs)7+#NF_sfrF`$?
zj}T`0p>-v8!3v)UXl?-|9rhL0)fhtLj0F^@q{5YdIJ4+w<q+Mg?m$$ygJ{rfh`gXU
zCHRBCO?{aM=7+GJNK8EY^^cF{`7)ORG`*OV@IYB;Xd5~mUyybS?Rp?=;5Ci7dmGQ>
z>7qthf3^7T{Oo2;thaNBjOqaX-ASVRi43-Kx|%2|q)kAr!0t^FU1QzF76`n>p+J+H
zUoTg3XKGbFZy^(;#pp5t@@kF)TYV*<ldjgE)!4Q{P%U#c*<=Qast^vGTc5}jMT`tI
z{-|{+mBFMb#m)E{BS74;+;jW`DBI*)CvDk5{rd}j>X?gCj7uU=RwJ!}Kg#(O$3Nww
zT*!4cNw2*!*XP|BokgYM7V*QPCoJOi`~=!A>i#J~B6m>0&>kdIn=<h+Nl3kbyC~D6
zeGi?_g2e{Uh5!XNHw>#xQp&ngjvhb|YH}5wv-uYem_g7E-Wel`R=y%`v31@)T}w7(
zk!qdiHWzU;yoZ%E&~AsP3A64hJz(lOJas~DTVyxqjJnIT!4fa_yji~hLi1mB0ODP9
zUPEqNZ4^GXWKVPO#l0N!WN2Gd)RTm*tQC*3*2TJ)jY#DS<+$u`Z5G4myS%~r4?mxx
zZsmXuwJb;Hm&6cYj93cRe-frT`41<q14y-#I>~n=(!6CPZvqB@n@m%(g%BUK5WqX0
zpf@aQ;ag0JVq03WhVhn{u4);RB}Fq+qw8u@Tbp-S1rDKak3s@jJ{w*(e>kAbrcLKy
zBD2rvlU~QI`TK=ThBYYcX}|vwseU5Ie;C-Cz*l>4;Xg0sf{0BC0-&Z+NV`%#2G`4P
z(qws_g`ch7XP2qG#v8w&e7f$5MgJ+|xV|$6H)+0{Xn#$Q;c5ZcaqC^V5b}h=Ac0|t
z7bP3G4bQ&!N=CW9DNWQjiR8m5db@f-s_mimudp+C4^Ap$cd`0-ai<<IA6^zja{NbM
zzK0A*hXd1K+*#w%97{RI#VUc9p&{^IQzNQ>s}zVCPRX!0ypd%c<;45&(-FV3<Tg(M
zH7Fi5cmn<bhhwz|X(xQH7j|B1^&*IjjMOtW9zaGAL=>hq=v@KJ2n8)Ig0;1^RI?)q
z90^NH%N+S&i|F9HOMW^!y7842d2FwLDGHe>Dd<E*ME5&t@<_p;leqU-wkv(YgFgHg
zm@lUFW7YqC_BGdFbi34p2mndqX(lzl-kwW_eZZZ!T*>Ch&PZ)K#632R95Q6P2DkIN
zKe|w~|58+AM#mRim641ddR2~a*`qqrjUPX{5pcm-RAeVXFKOSX#y&nHR&hxvAtF>~
zw2i*>4lN$!Pj5Uocwocl9h41zg__R^pG)92YIOClcm)-SPmG#pp~~Rp^+tOp2}g1V
zIJ}cj{1(Olw=C`a@#OuROnv*@5Ur4=Wz9Z6^ZwpxHYvV&=Jklw^8GxM_V|m?j_;HL
z0oTQKr7=UB*G#aH`iZR%Dt-_HzfgqJhB%RR$s@nZifd@~cd?oqwW8MY+@W2{F+BQ`
z#5Hw^?62f&hcC8KTQW?YAGFHKNStZu-;FANE5qCuxGgM=VTrJE{U(Q-;wk4`UFCXV
zO!IW_rfX_xT@vQ3LGP%nz025)dc78FDZ2Yqgmldf^X8@3^r%3*_~u$;8^2P%9iGR}
zQecn!a=!){_oLFa@oOaD^CK3wU-SQs+w$ZKQs!B`4e@S)epJoHJF<K8cdnxY#D#8S
zLh7p=x#Z##YH$6W^sZUJHQr_A?|o<mMb3DbXOvIU%=>*kmoSB6YK7)k!eU%3>RKXL
z%JJWmyYx)#0?R;w)wllQJ<vEI`}hu?MDaIlA4k6){5EvGI91l~apJfOVB<JNpIM1N
zY{F~a+>8l}eF{t2iaEsj_C}?rf0%kkEF){jfKUzS4=Sx#0MwHph<&DWE~*#&Bo)`}
zRHfh|3Lm!Ok}E{}KSDO(a_0C?$oBuqv{XXRk#vAiivcw}f?4)`>Q97*=jTmI%F5Uw
z5SoF30gP|euX~xSwpRro*9EZ<TH2JRW^W{L3RgDoC0=uHcz?>yE<zx7iuEo70reQE
z>2T{;<$CWEnP0gQBxl=W`2zTN){ppR&0`*=cFZ;0mde)JEno6^Xp^EF0Q>xpZt-O5
z7$ROO5R;m`1GBWu=Qga%6G`qQw~&e+^fxo)W(oBX&ZYJ$voHQT!2fxAigm7#q_tr5
zGbYlqayM_DcJ?84Ab{_CryMQ>L*(Zi{}TdkCv@<bDDqC`RBkmaldp<dLhyQ~(?X|G
zfDxkxa}qvD2TqKU#=#nE*txktNd14<9&ivLQpzujMUkqOoU`OJo}~e)6<`HVd^R-P
zOJVyQ#`qsp22f+Ac4*YK%mcjyWf8-G;Vv89?6f3A=zq@R|95et-Ur+8E~P%vI<B;Q
zz?Z-KJyu%vKKS2NFbO3k<^KG4EgA#AgLyIZOFNhSAMo64SIL8e1B~$zcx%$TQ$Aaf
z!u>03BsA<|ub7^3YOtMa^eIO5d%))Ft1X<zCGli}Q2)-anay;UQ>}-5W)qV}>%SU2
z`hP0o2vFmHL#r@>I3O?>@PE6-)JPh4-<q`c=6~uZIW?E<W@c?42x`v;IGDhjWe>Tr
zEPItK@e9jYk65Ze_wb@fE9>aOizPl2w>kKPTQq4=fj{(xeAIBbU^#I1K7$85IyF<7
zkeludLvarI^BmOe9M;giAA*B#b2CtD=SI*!Hvsz<R$JpUa|{V2y|O%K5kZl7*Njc@
zg*GH9L21pCCeg2Re@C@=Y+Lt)-9YPH(YMC(!@oRLb#)JjcgOgw0~^i6YVQ<=ld5Na
z>kXXq-j^baq08F?o=aB%K=gmJlJ0uvQM7ntXQ{YG7Z(@mFJ4eYD!VMTzC>$!9!G_D
zwjOl9!K|y8o0pfzF?gOZ{05rl^85Gi@!8pd{Kvof>w^DI1>Fu8CDAc{r(WHm!MbEg
z9RjJrm!Wo}c%OOvj-O-z6q6=~1<=~SCv^q{g&Y9DlnNOC{)bZnJazTMSJS3Cddr8g
zn!66e=6%=nvDD@+yfyvd1=65XT_r_D`UWPBjUekMt)?hp?6H}mQDYaLb>$-P4t0|K
z&+j{qRDxlPr!|D3;)C^yGvLv@`X8fv?9g<}Oe4$@n;+UA;`_KZ5kGkpofWWLqB>Nb
z_h$(SzQ|78d&jBXOzj`Fo6wt9Cbm=Je{+p%GN6CXK}m9ySs*G)0DHVTmf^vz*B?tZ
z9S<+E7bN||n2=7Luv6?lk6#&a8HHUop71Q*;-}<3-@Add=uB=NrW7=KuYt<D<WJXF
zp%UfhJ!5*w@+=w)vFXtPO1^K5s2qpX^i#4Ua7nZPt=0^0H`VuQMR>!s%;HH*fk$=-
zb@{s;PKAx@&TQ89#Nc>{RM*Q|0<aq|S*Vek#UTqS1{aeG)70lJm&JgL>UaVO9?_wo
zc$mCuWFrpRE6-K%8=^OZ)KLz#My(y(VLd+@z{X{e&0znbtEoJG0fJx4D(ct?qEl~@
zvQ%M|dA)*_i6~~R_Sq2rzRF|yGwWfLo=`0H9qfau+#G51z5RxFu%BL>Y9t&caiR;R
zd=)!1&8Bjzg8VmY^TzHRZxlk)-MaIYM~w2Wk&z3nc*6#m?LO#a>9a5QCr&f0YIL1R
zh9E}qg_77NY>*mY;+Q+BIE7@c6kK0Ss=c#In0>*rc#9^Q7*QNE>6JcyQ7A>fJiVc)
zz~^G#65fnpn<l#!D#7c1{#HtJQ2)i11{P!55wP6wn~tZ#e=kU-oHZ!GPQ#qwPXeP@
zek~g5Ln1=DN{RljGDcndP=P?PhGG=hDF^yvlKo}6xQJHZ&TVU->rKy}dQrq$P3P80
zl6=`tS-z&xyvY=k743uI)N@S3wG#nuO~8+ztvi(q8xH*R?>aTs_PRqcG3p+A<?qAM
z%nclDc5c^5g1JK&f*;Sz<okP7E-NI2F?E8}=$OBZzUMb!T2ywkp*{$fejmr|h_*?a
zl$@iTD>Xrbu228$h>NA{n?Ax69cD0sCir>;2Sy>W{5pKT!64eVbG9i$Xr9{3sIU|+
zwcf$Ng=v`&g2_-jmk8(I8t5Ys<pWq=19HT$b{weK@{<+CHwA)h;rHrIVA7rN0Fu0d
zujRyPvgwD?p><L(JkwdY1Q-MjCWVJ=xmjLR$paS%SMu9Y{_cYiZUa%XUzgSiw~D)F
zYV3Vi#D`0~insyPIVneb4$Zb`g=Id<wx2Pd5kv{k%EeQx4C|S6(x{fL_iWea2er>i
zH*Wk&$TVW!QN?(gx>0W)$lHE2dzzzb#CfggQ`wjC@X7><3Y}sJ<0BNdZ^4mK@&MfT
z;`XI$&4;S{()nSXIvAf~HBt2Mqax-+zMb3~YZ^YVkxI`rtqw7^mItUb+XrI|ze4oh
zSyZn^c1oY|e4DF=4=fM=5MbzmDsus~-F|8<F<1TuJ?^G+7?$U&9X7reM)vfwlM4}=
z+NH#uOmk$=!?4N@zj63cxN5xq?O`e%+{}CMH#;Y^^#;_zjWBc6vQg!%nQvR$4?PeP
zYI_1jMj~=A1k<eQ{25;e%2P2opTBHkANWb;B(Yy2g(GaSfIUWTTIVohyco|z-Of8(
z%7L^xz=1Y*kj^qywo>C?Xy1YY7x{gwoyYilh;Ri}mMY0733R0G6lmgD56cI69GKfR
z(fWlzf7F)yS~Dt|_w%E4=8yOgVS_QbdXrKKgsm2`M>I&|-al+TTTALR74LdCSA85t
z1j9b{7(<pngp1<@SBS_zrMcaeCQU}gq*MegenUmv412E88goF~cMbAjWvS1I7rub}
zZY!kLz6T5H1lWa}9}#@4b;qyWhev_)lm`{okl^PS94!E_4>ZAXpQ?(3nn@G7_k2J#
zN8Q8obdmFeq-W7+nbq&G6PoLk$v?-N9p8=!`40`Icu8a3?umC#UJ&g_M(^U1)Z0Gb
zFnIXFciF<K!iZI-zQ69U<6>j>oRXarBSNBvtw%OE_VrdG_Ifsv!rqxg8!?&m-=>K-
zdg4gWsV>%s3i-!ncH)Z6TE#s-%#frOG`+=qu+yB-@_R}~25Sxy7WEEb$v6xh^?8W?
zE+5lRf3?1x#_CC0^*?4?!~e#ap^oM_v3Z#^e<+jv-eZ?ui%v+02oDcOGuywl#5Zw1
zFlqM{7I#?$0ev=jL<Fmd2)V56G;Q*4C1vG^b6}myZdI5Go&6f+Yrc5AgiKwPQC1OL
zzp`z(yNhv4Sw(xkkF{yoA#Ct^L&n)KyOuh|Te@!B;M?k^-aaCHH``HOdX%QHRh8#~
zCT4H571RyMn@sqcMmz}#q()+cighQz5k!UzWor#3R^rikni2x*4_Dv;V4x_zbxu&u
z5Lh48?10wZ-9UkC&T%WuLyzWWbjsPVU3GFVNh1EP>pFUp0amq5OfqQcmG#`|2*XUo
zyOoo~w#71GPi^3-Rwo;**^*>DibLTIf+K`o-SP^huJh*;4|Mdw35L>GwNdR<Q0f7m
z{OHL<5^wy!WueqP^Bgl=MUaoESXEo%S++mFh@B;UOpg;GKXt@G?VPs@h)!?K1y*0F
zH{;pK*n$`ki-7p0i8$3(A-(Jn%)JZnS!=S?CoCUl(&A?WWg&nTnOnY%tkb0?se`FL
zJ<ojp>)wvtx9z_5=vh@%gj}JkBY`qhLJ;-hhTB4guIy<4gEAEo!WjNpoh^}?!CjBe
zf_23!jyQ24%Bn6CO%DUMk)Fip7wxYercCnG9>0&~n<M<$fMkM7TKn}^EF|Q>_Z5GJ
z+FwY{l(#;OVzn8X&HpXX@~!b~y4PXR#aOs+o$*9k<283tT1#!i!vHi<=qoEZR#^5n
zKG~iz?0dpedy<$}&)yFmXOV<LYK&w`ciPI26>H5cjH9{r)H2j2Q)Rg`&##|v6;x^y
z!lbZZg7^dSq)3EK;38;HfCKO5hQ^OJ`hMYXeEN4(=Cq<fy9Z@urt?63n$gi~z*sid
z7kAu|8?h`-dN`jOl2<4_RQ{r|z{^$!o?Xh?ek4I~_&3Uw%k|$nYt_nj;?UC`;bh+l
zJ8fH7M;&Px-)oS~@Up@N$U+TkqdA3iwiXH(q^=HGdpv8-H;TTSTdJE<AmODR?J3%%
zcby)h-%dIV2`#ThgY}LSgTA7Om&lv+)E=0C&bOnfvh-r(yYO-mbh|)inM7KJJ5QNb
z)UN6YrkGdV%xo`SnY}}q4K0EZDI(9zuw0Mr^pOv_=vP_4SI5gF`<^;daa5ckWxG_?
zO&+^C{FR;#nuyU7TEM$NhOYs!;*k<ek?IHg!^4A2vX~H@m&LWsbjCPNb<qkV3R;-E
zsyaXTnFcE>jiD7)c!q|TdJZJKt&heZi6K6>&y<jH6Xs%Q?>*R^rKl3Aq?-2KJ8O$*
zsT-YpLJjd8iZ*tGazm@7OzK)*vO)j!DHH$AF^U7f4`5gzUQ&__)sY}E&GCX1p~&o9
zFPY}?Tu~mZW4L>K&dOQUlIPk28%u2(6p@y_>m#@)$NdFpazGM#A$=W&d6BEb{exC<
z{4IIa5_O1_H>)6Y0FmRv*xas0f0vs_u5i&AB~;U94O+9iEBpo{(8>P2QT2&&G;4mM
zjQs&;k(6p7x~9SHjoM((n>4an?me5i%W#N;JD7g9rWgJ5o3%xwMXl~e?d)dS1s=Y{
zU&_pJ?3ne|Q!Xl;mj#tHKr{uod$EP_VZ$FDojW=@kW!A$J?l5Nyv9`_H8lce=H@9m
zIq?Gnsx7^=^0s&1Bw>WyWHfZ;p;MvN5c-c#mhFGQ#zNfB0<)vtg-p&E0=#BcGgV2v
zU+Cq3Aw1-2R9v~vLi^NMMxyLh{dDnY%f|ZDW)GfFD9KK7yEh9PglVA`UayT4vpZA(
z<*@*U0bkE8J)Y5Wr_~P}wO*>*+S8Hh3xVUJC<1BR00=Z6K3X~g*~o`W_y}0_wh}=c
zym2nYx5i%@BV7j73CSRoeJ!xFiVKv-z3BeCYF8_QT5Q0FqE((2ruZiUWq8M^zo2_S
zXS2;{-s}@3cs_<>mCV8|iz0TET5y{kph~=)g}7AVK5S&_Eo(9s|5T({atoPkm=Qt+
z(ri1wbMx<FHEJ>~ZcbR|k^e`16*_F;kZu0lM?PcB_*n~B_3!gQ?gX!a$c*8F@-9p+
z{;}@SQz6lp>28zK=<NG)U3dJW4%{{g*#a*{Mqqn%(M3&3ZUa{AMi*Cl^v+gZzi6CZ
zRdn+l^Qe|@WKnL$zS|wroA{01=CtN;;HakM5Av>b+W3ELopn%Karfqt6oPAUr?|Vj
zYq26l1I68)A|bdGcP;M4wGiCh9g0&Ning2g-QC~pADfvwlbOuixsp5ge9w8F=Tra0
zB+O2lBW{I2KKZ6N!Ae(9tUhZ-OW~i>yT+I8nzQbDimkI;GfaF*)D?Bzi^*o`FvA~O
zqX#50G~_bMMOfeL;9UDk7VpJh-z*x+_POIKR+ZYSB;NSryQ1F@W~oU8>bYVu?gYs7
zav#x{t1w&z!l+_}zgon#N45nJ{Ee~&cmXUMC0E3!I|1<kKXiS>8Y1S8L+!b1f}~f8
zurL)DF+Rmxk+}OR9hcq(vIkv;217#>(v~cmswQQ0>$uD|H&x0iojaGI)211UNzbZ=
z;avjZwQ}vHOfd{7J<7^Z7PssEiWia7He#o{^^Tb*nY>+=-~kCFL>)o+)Zq)jz#_Sl
zV1n)Ate79F)sV3MPg~@?Uvp?ZKPl8c)=FC6n>*+%_wV9a)k}C1t=a3DpP}gS3g}t<
zFop+FuK$&ZpyejRmrw_vH4obq#XorO0m8<J>@Gs4zx|#O*^B$Z>}Td3t&xH)hc#lk
zV&zJhyXkRhU1ssGw0XszFlLPer!NcWS&;yiGZk}6M@_4b_HQjH{R*7E@ioR2@>IiH
z98cqXmSX!P7Wu-l#<@XPH01*C;C;Lo9Ej_8^6YtNxnI8anaEJCC`<UakuxIvJOzdr
z3^oEYq>y<#5<@piWilY}P9J#H!s<Q!H#N8rp=A9MU``W@YN1wuW{A=V2U!W_KSBBq
zhO6T}CdQgMh`$TTX*nC2xXE@13xn6r`1H@<-BGv(y4We(#d$%SYTf?9g4Savd{99U
zHb>xQz3aX%K<r}3$Cz+~7^*(|l!^#)aI97tm+{!)!GAydbpE{~Yxsn^1?$W!Pl5Vh
z9<hs67^i@{1B`mXAP6%_@q`(nV7AacI+6Qj!;0E7NibfCrbP6w9M`*^Dtrj-MMomd
z#F4*eKaPE>H!UY8syvLZ_WFvrkP<y($|CLhO75V^Gq9*1x^Wuhlm7uILISZ8!d@D|
z{=6uq(TFyDo;=Ik493~GOKpK#wxY0ZG|r4l8Zb$F51yxSf&_~`AqbyrpxG*kSt7O_
z*&%=W#M4!P8Q>knHg!@3I=iOApATG7`QyIYKfF>_3fYIbOO%((&Yf5{*H2yAzJ(of
zGnah<GHqSlaTnO*Ek}n$U)ZK`nk-jw3Iml{1p5A-+Ak1l<=t>~-LzxYz%<6U4n%R&
zNd*nE7*2hQMAap?2E4(@Ch5lqT`(<_91@gwhkU*;n6pE-5eA?5zX1COSoE%L@vKu<
z^h0QBa~vFvUv^4i`x)bTMVO<b994!2M{HEx*|)2105I8@A(l#Y!2qnH&{Xe{OQJfx
z(kF6-=@xCr#l@w5#ib&I2LQ9Ja&A^2CY0SlgCo}@ln=bASERB0jV(T4>mn(L1-8js
zqj`dwhzqS_>%V;C#xz{n8Jm>sVl9{Rmxt43IotIT?l$5?rN|no{mms53R#dmuHzio
zNA(-MMHr(!*SEx9Ei7v=k3b~xrM9XRc-~+q64^f7uu-}mdJsF(Sd@r9{cgV^=qyga
zVa&>!TW{7U&HA~E==P^RxIev!i(e>u&IZ|GVKa^}bpb?dq4%=svj>Xa^y(wRjVt_J
z!qIZkBpbxznFJiOY6W*kaCX-yX!h1Vv|I2A2RE!83D&j~3*=wNNMPw!R@QeV1vkt}
zt#J(aig{+t{{<MHJd1D&ss1ik28&B2PS4{q7h{H4dz+VOe=r_`M^B^M%~;c7)$hWO
z`7qq<GHcG7CxJZfy;@M)h<Gp?zfxYApm14^$n}Auc0?vlw%ZZF^$FO_KjgK}*)g$j
z@et5PK0mPWPG@LOF6o8<Myz`G=(fuLfl#j~G~T{yS1F}=ws|N1$c*86OU`20&3J$t
z+(75BrXl;3R-X+ERrzj>;BSv0Q>Fa@p*$J6!F?EBR($+Ju!DkU5t=UJ@1Zkpzv~BW
z69h(zq7*k@$|g*a!p7#L;4PpXvM6V7jBMkl>ImUPHUk&#wcz<6ta9x%0Ss7m7Y0}-
z_izX>ifIU*UWdv-U#Eq}Q(Wk%!-SbVi5y2{rn<2oO<QPP#Nq=Xl^H)>_{b3RHP%UH
z@9vme%I$Y4`q=*o1pKI?@I;x?FLDaids<*B;Cu(3?0Jh2Iec`q{qBxX)Bf(N!F_0z
zX9^e-fPRE1;yS^jR<F)=)sR|!x~Sr_w!WLv&Jz%(rTKB%vyWyNZh<?rDUvgXt5xQ4
z9|<)3#fyeJ8)AsO^A(CMzts9ISN7gOe;1l6d&(LKz{XvZzrXpDb?0H^T3_Zz?mGYP
zo!!}>hVX(gWMYKT=-w|>9)@*T*M7vjs1^6Q=}>@+?mI+*1+MlFX3t$E3ZtGeSILxD
zAzzd>1uy@z_t!%(MV9#T3p0|?xRm#|oM&XuUex^I(w(`xjDuD#wqAZJmgx(cVBj2*
zS4)uM_^G^80B`N{Pg$OO_h+9i!tP=S$uTJZ3XX81#^vzbQdXi8hvQV$6%oJ@6(oLz
zKK1Sm=^gN_sxUp|ObslXRuBgD(FfV96C-SHxUMabluen)?d{VSVu*6Y9?4&CFvIM&
zKTc^zqOb3u74sK9IZGUHhR(i}c@djK2FzzUi)y0&t07LPM?#=nImbvB&%wz^bNF9v
zv8TV%U7G*M+dWVzCu!}NJ0YsLGi;zwNzsOAVwIe+QOYL$q%;cTp82eVt%$v-JsZ~P
z)N_S3A%hm~IqzP7eV}r_Z3T(oK%P|r8Ck2(U}TUz5I|JD2wG^*yYMy;woq>;OJ#^s
zHHBlXr3&lCZ6kQBT5vUw_L?}7l1OHTEM3-cl~pe9$5KQ$n!F)Tt|C50U!%sn@zrg?
zLZG|zGgk8c>~cWIk%O7jMf`}!duie>8+ScdN?g%bmw6F14AGCO+zi#7ku}BMAebkh
zY|`jhKr33_&%5b1hXbj+buzMTCq!GJ<~RsN`X-F~g9%#S`#;v@%sH}~x1vUkKjRfX
zzRXCybRD}}YLSqghh5za7QhH6u>Yo7)c;1@w$>exYknvqR26dgbKEZ)>4fy~z`(J&
zynu{7l!rL%b4=+^l=EEz2WF$gIdj7v=lw&~T$%tCCqs>LwKH{Qa(FoHdtG8tRmC;K
z$xw^u-y6coHGp}-JVS>S*Y+()epe38OCmE)zmVl~Xbi>;cxQa)=eCLWUf!|PLYPaw
zG`qC&d=#xK@GI{Y#dj?ty;dL65IT&Sf`>pgWBE#VfAJ%>J^Jkz)KWvYX3!E(ZG7GX
ze_O7#>8a)dK*bQXhaF=#+#8igGW5d7ctl<dESko6VV7c2k3>nEdJ=(&KfMnf668nh
zfNtipz2|o`&&)uU7<WkJgZhW`mbs@QcR~Khi&vs^oy}+f(#c<=oKK4bLixiU%qT68
zGwd&R!H(8}Ga|ic(s*r}#^iMY;a}yqePw>WeESR!^%B}Hlpz9_U%a2VU*1)PNs974
zOomVn>0ipR9s$$Z+h!i+$Tic>X7g5TfS-&d_A<G)2=%+qWTL1sa>jv7P)Aj>FW%Ye
zlzlYaM%|P5g^qrB#juV;3Y7l&B*-^R0V}_twTyi7V|PJWBieMiDc|Tn6v|Use=8um
zo_a+6=oSGeuzr<FwH|!!G5~L)5Ie^sisQp4{s8V-Blw=eTkuB>yGhq}U)_$KzM_Bl
zK<zG#YNt&+mbJE^u8e}oWVoQzIx0F%KDum5*Axw+jOVH-M_lWD?7fsMf(W$(?mbBR
z9x*NOY9qU*#D@qECdUc+_(~vQED&FeUPY`)e*)v8qmo<LEz5$?Tby+vC3>Qpq-q`%
z1K3{a5oTW8;Kjn{+G03R1#AQ`_8SWZ9}%}DmQ&v0J6~9f9fYN0Z@q@=*EOKA3z!z<
zUcA)VyB5D-(*5Z#5dVWVVc4eeh&9K{mJz{0-~`drp+Hb4>7Ahg+==w|wvv5j(hE(F
z`;&A;evSAagjFz0!<TMab*0m{t16ur6E`v1A1mCvGH-V|BdA{e&~|rm(X#LFZjV4)
zb{HFeGvQKx62P<u;yi5YPbK<p-89N{)1-T<sWE)>BIbl4`tE-84)MbKwnJ1mG>9O-
zLw;srr|-ADU+B<4FiJBF>ipq8_>oIVj4DX=hY7azd}m!6RD?ze;lHCS*eDRj5nAzi
zd1gOVU?dNlEzfClria}kLP4{Fs9=v!c&A}Wu|3h6!fw~N`l+QZx$#1f2bnj|3Y1Ue
z6~*cN#U9)58o*y;1Zj`a?fsP^!k)K510zRCXXK{wv&&n~V!n&@+=aOy9OgBkMd7zx
zU;CuXkAKVT6dU<TSodwt5!n;6_jbKQE2wTn4*Ju`xD1eIoZA16vQ+muy4{`7d{aJ9
z@MTNk4|cN*w?OPs?tM4LFeE(2^?WQaw!!jSKgwDMYO<MUFLqTLYww1yN<nqcdlT0a
z>}yw5^a92?g36AUt5RJAkm!aBxS;fn53|-dEG)g4YmA@@WB~U<1U80=3E|JrSqpmt
zs1Mmq;&O-2zZuAr2Wy5_Uy$inmP5xxlrpT5#>W4xs$IJe@ZaBO2sn$Uu^M9S@5lRS
zD|3!&@NYm~kH=^9@7^7j=l6CZAw)g|Jg$-rK^9e*rV*<3TTu?DLTpaX3(k~XxE8{v
zx?bwni(}|w2+g-P24`0Mur-;4Je<}vh|Z8|22FQjCKaw*qJ>@h`Fz}N$<X<$`=m{1
zot{2tkhx2mybGg+r%PQ;p+Hfg#b7m&y=OYx>st0bH>pbyIk_y)C5OIQ);0tDQS^PL
zmLsrrBeT<<VOG)Gtv~+9ejLWNU}NNID!Q27(z;B^S`@K&Q7)oC$j_e0VBwkfb`Y2A
z1evdd@D%@!I_n57FHHI<HskbLGHTg2!#X<SY5vk}3ZQ$DXSS8sMbRFG4!A>wQ7AgA
zzWEPhbT$iUNcf5qu$ds`k~1WxJfs!Gnbmd!m|CZ#J)dx&#aMfj7PIRwd!3G%SoX^;
zI3dW{v#($?k7QwUOKR3B3N-%T16881!RF!vvONkOt3l13>M4GnXXxVDy5NhM3huvK
zSw?4q>n^UAA91kUk?Y(@sxvIu@YI2e)atB2$756f99@<<&zp}=)Ro?0vh;tlKT3gZ
zzdFj(BSEo+F=F%&$`KS}c<?YFnfQMQW&aNyu1DYud|fXE>147d<_0A>78T>8aD9tx
z$BWVzitfRa$@Mx-aVOUHZC5?<K1ozUQB+ry(mD?g1Gz9`8Mc1d!g;4afo>n#9Np8{
zh~5W6g2z6>TY@X@O1{g5Q#sF&84{rhOM;8PBzKEk{38zYlUk1XD8Q18zjHr{lu%at
z#|#|9>0d7OJtXVR@+<PPx5B~wyHk>t(vkF4crI@=jEtDwjqD+ZWJF?l9(f6Jv)F0k
z9HC=uZu%I@kTW{57*?#D45fI>q8@=FXvyfWqen=7#gk%1d>4eDTKNVU5TS{=brm$M
z07e25BHtEpXkG9jnp(c+ycSs&n7HX|zer0knUAt>5*5i?agaWaF}P0j?Glyx39@~?
z>0)oO8?{MVgL-m#sG*+N=JzVq2XNV32k?5;a?Rt?M+yrrAfaoMjB&gU=MVO0mio%$
z`zz#_W$X#IbZIhp8^wFedXdq11cifilKvwV?57>P*IG%jmTjP~U<>tkioYzq`>}<?
zly`=UWnhP$<EEjYZG<Uu2n&TW8dBL4T$a1WyEzPFqH<V!Kt>0BEr7-A$b{Bo!Sp)r
z>MOjXi0r<V_$utM={QXB5G{FTflaSS;W3H-|G&}L4}84WTybO5x2{~^s1TK&|44v-
z+7sTBsplJ|t#B{Vep^}N6EC^I`k+66REoG9kpy3tsa1_fU+lbJ6eR4SMhHs?8kJsA
zkeexS(fn7#{~tIo;^cy>?=l!N=6d&!A3_j>2NN2+2fKE}Cn1RfeId|2oIZp{*t~t5
zO-V^6KpJNaSm1XMl3vX?c_{$aT>An4eMq#g@t3Y^&m{tMjA7PfC1S5hmp5ID{GfOw
zTB$Fr^OMakb&M$rNc3wJ)^tDKwO~cm9$kz8Oq^hwC2JTYfoj@RP^id_teW?|K+ZO6
zyM?CjMLa3L3GHQD46G?~6Ol-f8R1R*HWK9<(`qYYQ+5Tj^e88b#4gk;0NZe5B%=_z
z%yCHb61Wj^mjX<lL+64Ff&MB7UmkWe&2abjv%rDvuq(w4+faeYk^iSK+g1R+T)>#g
zu*tf15;Q#)42slJDp08fw)Bj9LQ7$iiFe@9Xh{`#P(Exf_~`05WH_)jslX!D*GkO(
zShzwW5>m*IV{23nLo4O*(yCQ`Q0t7`8$hFX-;jI(R9-wu_U|xi#mEumra60IXpqYo
z#WxvM8lE4^@Nb^qqgpm;5If?fBuFsjC4`L~SYYpcW}*xvBy-}`7G68D*yjddTl6OB
zr@zxkmP~It?;~JOp5v)s)F#FknE6n2_r27$F9hl6NXT&BOhr+}@t}#7JsCOxC-2FJ
zU9A<sQSnn#mV^*74;}0(^md;UzjxA@@Bm{M58U4^MKdNuiZjf}fY6OL`S9@N@3k_p
z6;4)t<(>H!Kc4v8!!n0PIx2zXrBt!=8hIql341TfhAyB4c6C3iNOFJ09aTkbHr$Qr
zKN=LUpu=zu_OggQA=N7feYv7bgr?Nl_Da&wZFr0G=12vV$+jJvuw}gc=Ke2zG4o!j
z2`XJo(Z?dGYQ2k^s2;zT`<67`DHxle`u-$=9=BD=V|#qzh)s|yE(|?=Ul21!D|p6C
z&am@cxXna)ykO9m#H4$uwnVwUJ&RWG*@n%$jA9>~z{|>-d@!X>7OakGF_MkI>$N8Z
z3inXOUy}Nn8eio4%)U?jZNAH~cMy@F4M$huKx0)1!$rsiSD^pQ*XakGtz$S%)9ev4
zb{f{$HY7&m4&=4_K8t7rSn&CF_?rEJx`oBQZ?!WrKD;{^SCOkpvu7!Q{UccSc`Hdo
z2%{&<{e<Xt2t}6(Bd|p)fM;0K$Iy;$qQwr>YFw$|oeXHoa$7M#DJv0e-%rUK%RvI^
zAcYu>8&)O{+A=2KLj~2`F~cq0J6x%a(ZVRhSzt|USPNUzVVe?2inDZ|g&lb8vVUd^
zz&n?e(LYil8B!M)*M0amy=Bll{LT0zh+Yu1Hc9W?n0@ZBwZ3`oWY#-DGfoqeIh#ah
z_{9qLQE8!DPh$J=C5g^pVq${L>TyeGk*#ylX_aD3mEQB~t(x~I<65ozx0fw{%#bC9
z5KiU(r-Um$VwX5{?e-smW?!AL=^t^=b}#d>U?D`sp&#p};Xq_{WjMvk<a{h)^}?|p
z{AQ73<fjfFX1)J@zbhvD=N``afGq!1U&nz1H95V+g#yWl*dc3>tJhado3-BxbQo)^
zMk0t4*5O<x?1n_dKw34nmG;`+wS%f%E5~=uLhhgw(pY*EsNr^mLYbHJbT7f*zoanI
zoS)B1M&HC4&`kwdGo2_xE&fnrb|xfySr;s3U)Z5GLm@@Qc{(KIj5ndX98$7qUaj9J
zE?8YqWRVc8pcWdow*?6r$XkyIN8-P_Pfk0twa3K!^QOo_^j#t&Xk)b=&}e1bH*3k1
zR<jX7YRw_}(GUZTZFA?Wk-$D6O<F-4%j9qN?qvfyi*9XLX9>K{z22^``cJdL27YQ1
zT^=>pecLLtxCXYL*rXL?+WyYf#_bd=1f5da^SB~^^1)RNC}f*@C`aAo)rFSFA*mPq
zoHxQDs0g`ECVvgrz&zt*oX#P{0RhVvsjXOdpB8r7UYQ4p<-QuAJ@{ts?E9|O7q-;h
znI;S_4P}%##jEV90UQC8C&X8++#w~!5=$DLZ<{#<6;5F)pg4p_H2?_Rt=+p;+VoTE
z9DD!gf1m0XOyDg3Xfqc2zwdTtJH(Y-5%%d@_GUqFD&2+3OB|DQnul-8S6>^W7~<iz
z)po|+&~)f6(kk`@ps%?f_Jd}bs~-&Dk@4(p?Cs1KXFtG0*HrwlJFLlLW6vw51<c~M
zg$1)o`kh9Ze&ITJ;N1<9t$=+gr@})jXw%q@BP^Y2H8Lwu|8=_pY!D;Gy~z%<ZW|=0
zDeRZFrMX0Gyjml|ys;})U@P?Ae1nkR3r9#+3r7pqEa~ic{M~Dh+p>I!>kJ|F2&Z+S
z@S>t$Nzy)N%`CL^jV;2D(CLr0yOPV>RdP1o_S<cHy6^~uoCYWubsK)vc)*47lTFhI
zRtz_ku+RL^kEnl<6KtIzm4~qFA9jAbcv03r%LHAItuxXd+m1T)^0TN-=+1_>r(&h~
z*G0rsz*|i>_s2zg!PkFwUw7G<Cl@!|pBdRnm-8%X`UJz9FOHD67In;~XvOz$t-D+(
z<D8<b5f!CKt=w!*S6~6}+<-uoHD*ey-r*I5?D#LZ=bHb%{Mo-~;nUEZg;bq=t~UCC
zaJWDye7Jta>J?l7Ys>3}I%1Y;%>D>TAe4xp(C1V@R9T8B22)iFnZQHm<TXi6<7=kk
zJ@V7c2Iu1R+gGrL7O=*>hl;p!&jcc0L<D5KLzqOxj>XvxumpH$%k5sMZltg-i52Fa
z8fRWzkeUcT_dCvhW;JZW|LktnZ+F6mU!oyI1C|2U|4g{DrHT!NaCtCxKG@3MNh3my
zj0AsBHpt!43f*u!gCqzL->bMlUP(|6kF#A@*GUMRhG)kP&m)*FAv$Cm-egSgd3Ver
zrgM%2sc18bKJLDvT_uq>0wj|Wh>n(1{oXb5sbMGT&~4H#8HOc>y};64Bs(Hv;9_q<
zcvqposqYZs6qs0^G=`yDoC4~TkWo(=^WmH@S!#vR_~^}y)vM=K7dD();eBHav_6{J
z2^fMmV1b2zqJQdYjn3s(p^nYv2%EYM;_TCeu~_rZYM~{~5A~ZQih+tx-NBqaQ?5!-
zp?6p2Tn?Hh0lB#x?!q3Q_SXCq^c~xxcY`YD(H?08i+RzlySD9RQNXT75AZ|&9m2O4
zP}e2tjo30u+DuQ`UE$$RU{2v-h*119G3Y_su-dd6;Y^pkc>3VVm46Tc(OPth@s|{X
zR606z1;j%-VWu$Qp-v2T741{v>07GbDbM_*W=Ure@r^=sX%yXkM2hJ0%sgU(7T0U5
z8UP*I0~THGQ&s2OFqgSoLVf#ec}%sDOf9rfO>S_h&$S~2q=;T}tD@tEAn)z#{how<
z^s~*T0(cOTJoR@wk&xrXq{PIs^Vfb*P5=E>(rYkGQr3UU2}3k`IJGsrg*P7Z`z8DW
z<cBZ)O5n0ML|4tGZ&v0B9P&_oHbdQL-3SA3W#?}gz{G0_bYub>I5~W`s`!_q6CFWt
z^j3cr3q!oG-^OP$MNxRHM$<(QlPip@m6w-<qZ8G(IC-~Xjh;I}!MLwrHr`>|&`hbV
z{#C)~E3rHccM&iuKY^_4XLs&hM?p%%lqZy8-pSQfeT$+fAv=OA(`Lf5sc>q#nq;JH
z&3c_|6g~@q>UAG{y*hCz*I79DA?^&H{4^nZ3aJqSfeCN1ST_iF9(8fY{W70LS-4O@
ziv)E&vHMa0)?IDr&P019L3Z5aPB$MC+rrn$D3mK+-C<F9%!l2D6Qb{B9>7LVQSB1g
z-T4)uZG;}%<k4`VS_lVrv=pV4&oAjeE+>&**t(yYzZ-TZ+4-}KzWcY9FN4RH+iK=5
zhdcE-<IR5}1Ck(-5mu9qI-7-!#-eR+6niYmanL`+CyZ)WzxtVQ9FqZsCwP?b4@h`3
z+rVNP`Jn$P@bOxeb@c{-+p&#><<uuVxu{sO-TPqf)DMKV_(*Nr5|($)8qdbv=GE#q
zy|UXKZ+WMA?slcKY@}`CP^o4RvyjQVI#68XbViBUx8Q=G@HW)@jnqsBO0`}ZC7x9E
zN#TE4I%5fPbVn&OmoX<@TtmYJ1FDFP(Sv+-^n~->E*Mh};urvM_pVVcnJNVzujvD;
zqvM9%pS&^uv_4uus())+1`36}xUD%<i+qZW@3L}eoee)ri;!LwC0)$Y4<00dT&*RC
z>N3}H-{6p8#Jav(;e8O585+l``1%3hB9eQ)+jCt3XAMn~^?f8k22HM<*#Oxryjf{?
zj4$M9X0AQ2!Knwz8*SPQaHi0P+!;=z=;PsHn-cC*VB+W7XV+D0F4ptu!VguH3}O>z
z$K;XBW9illJ`Ytw?L=F*arM_4>{+&n`_6B;(5(427xM<RQnjRqe*7ScQnlhsZ7$zv
zOm!swA|{KJE&I60F6{7PQY^E@Bn%hsxxw$Yl`CEyDSyRJGCN!-{N~AVZVIr}0ABZ*
zk{gA_Gdy?F17Xy>rSXjKIMaY28gO7PbX}T=$VFcMSfLjGj681Fn@cnDpRUUtQe0;F
zpC4R<2S;~vl&K^Y<&juWZfgtGf5)_{+KZ6w_?U7BOGF$zxB_%&Er)k#_cE~}5mXVe
z1c#H)3rg-cjq{u8WaIM+>sCb87BzFkSeaMT_wCR(X$Dbt3&{$(g_9c2g`AiK@f;)>
zLk^=DMJbNdzTTD8AaauDrM6UQi5`dE;xeEJ+hoI;Ff8aaBre3y=!z%o?WRVsZ42#m
z-Zr4PC;}rQbasV3o0wMdtZsU!guG`aOXMA;dM=uMf@h>6JC*vEowK6t3Li3)-|<g8
z^t&>C(}wNNy~!Kg3ng3qepv1kkH;3O*~KA)XYo`&qt}LZO7WpKa3f1NmlvT??PBWr
zLel#`3?7e*g#ZW<-?XJ9iqQR&c&qtZd$VdfcPwh6u@*NH^*@K~WmM@)UA`(&evMtN
zgc+$WX_TvMHTX0l3hvV$Be#a<%L2d^x>XuF3W*B_@hd8wW`$MKZvyXy>D2`TX;I04
zqdTkV<m-Ciiw#!XUufjY{RAcJ>^5IeH5US?4IPhtek5+=H(HKVRTAFBbpAk2^Q)8&
zT9d~VbQL4}jT_39S5YKt_=Bc?d>FN{R2`BPA{L*!iKVB8252mi%=8>MkmuR)`a*LS
zsjRxd)8v^->yj)sv25CF#vo%v{yc{3;`oP~sB%{D%MCiwD!ZK70Nx$X298afmrk)T
zHE=y$AG8%a`sf2e>e9WCG}onw8?@b7NaCK7eT(Ge(T(bO%wB0(A=9Q;gWefr>GwQQ
zao-*zXBNcvRkiYBhWMw!0w<8fpMAJ>np9nO?$i`XSSn0Dm4EdiYe7P5u=vOBLtKH9
z#)R=Zol2A*KCA{{O#|-c52zT&SvB8noX;*aZ%3o!B}y|*`con2>yb`qo>`0HWi*CE
z6&W{r_elp7lgw59>LeqLt&1B(4&j-=PLbsh^!tgaZLB~?tB9o{sr&=52>_i}udb{i
zPrFsr!le9!0k*+M?wFnc0#Wy&zhe}X>p=GxF~-u4PvYp1YY$q$fM%h^K}#GB4-LFh
zRL!wH`9SXUszGBt*$*$k8yhXcz`cf;9rumv#4=7+$N0BTLeZeV!v$+n_!7~>B>rNr
zPai3JwGOK@YY4<e+Tq>fmZ<2g_3QOV952SEAxF}*)naLoty4@Uu-Z;_d*<|~n;*)R
z$Op@xxMF|&5+!pH=u<so8!3fv;<lc=i<dOirQf)_+x^Kvfoo!-bhH-Jd37fb*vk{x
z>+6Z*oLLRNqdASq(i9bKdgu2!NO6L45c{9}6_4gp)G)m3$ke%l|7YeLAf~qwE6&)j
zOb#Vo6y5BTuHgC&QU*@#&38D{&nH+(Hzm)1Qvbl{bv_?HcobFn;d3E?You{s&dq@=
zl+wraA4BUm_o*fV<rq)PDc@697dybU>UKyCdogeeiT~kSWH{|bDxdb0{ea=L-dH8U
z2X4QLB^9HbbY*hk;qJ{UZl60y0mPBh0b)CK=ij!2bwU%L1@ll~fIz%<o1&K=vZlx?
z-lDP#f8#QoyAZBNiyayWjU6z!JIT4=rxWu8BbTb>nZS;I!NSj*AfUbaNO(j$eA>C%
zd#dUSCGHJXwT4T(NkO2!N?o74g2>}<m2~#F@9r2~ttw1lC2MHf?`Q=?F%~rdXWR#r
z&Ha>Hh5|8vF7rJFO(GwZ+h#JC-(IAj+gYRMbL8uf%-)gKnd!{m`de(8+vxvR@Z!EF
zJd&~0RS<);S8_e%)kxZF9rysp&->_3Khnk^-o4Ij3#V?&-`6D6^}jVLji`~y_1&{*
zWID$;hD;*7x{9b=ih)y4Ssy9KzJ+ljZ^R!<BXTHx5Bln7hAg#$D;teXFTJv@=|c<V
zT0!UCpA&X}Jt$Vn5cVV~{g_WJn3^l>i7Wo7L0Cq6oDfY;%TgMs(!IxkewVF_4Ua75
zSuH^swN^@i&I1>Zj(w?=j>x<S#wNhTqg4pye1<nyfzZ~pwG0u9GZb-73}O4L)Xxu6
zFch6cRPm9IS9|VuzlhS%La(W4&^1AQfIQ*)6(5v9owy5hI&3Q^dSnnr+i@AzBpveX
z(sUXglgE3D{-SUfVSFXzew)cQ41bKkb78{Z@+*HGc}AMcyoj>^wrUZTKSg!uB4X$T
zm;TuAEZ-lW6?$oJz9>`l$(X(iif}5bEJf;Ha6<RQp;C-AWXOU|C-kp3$!BJ`hvERw
z*OC&paFa@UW-Yy#Tu*oXYnf5^9V9L*0XT@~c$jQJ6Kjk&x|i9xMYXr3ag0LmJE>#V
zrhzxs=MahtLaSObuPvM#GDp>60&B50Y#q6c&ajagGuiO1UUs{ft+{TSi*s4)Ik{sS
zwt-9=KcNJz9vSlTsGkr|L-m5v286zBW3$c!`h(?|S%}BE%VOAkR$yd77mZ9P<4?)+
zd*0CaBTU}r*205P*H8z4(TQSybS*<$PQCYmK$7HGSAnRpolH)o8k4+sd#Wofe!R2@
zo+=bZ6r&ZT9|gAB*R#l!{R{RSr`b03i<^o$B)}LUm?SGx)p8atfsM1pa<@K)I!8BO
z-r1WR_ajHd1$1zvvgq%w6!qZASjW3g-z-52l8+M4s6kNR+8ldz!M3-85lR~b+50%N
zjWlvcrmCQ(Bq1B+PG&g~vJ<wBotqJkqr~)~gqX4IE8uwzt)6eEfs?Z`K?te%U6$6-
zRQCcsiHmNy)1ZzR@<25G={8Z1M?cwJ04Oo9Y}#Fd=xEi%C{$*gP%50_bo35knY(E~
z8UsVn5f}ju4$Gg-YE#g^unB4BDK(q>PCPTy0?iw*uqnO^^_)J}VdYzf=1XLSlMBSW
zgVWN@(@9~F$;jtZHP$r`k0H1E_)NsJh~D6!z{z~vJ({?x=DQ%4Fvv`3Kao9ppdQhY
zCghd#5eyz9x49@IoWUi^x{#Vh1EPhc#dF1nFZBf1&yYK1>?@iHAb~P%^{cBw)%4H+
zz$#w~j7}kfHewdTczvC?`LnlzDskjwhWUiGSOd-$!x;PJON%31YnzEIrks2(ZN#Y_
z<of<~3VM}~XyZ7<${i?sbIzs_*_qT<nq5ru)}X?00rpLHg5K8F>P!=jA^o=V2SK1=
znKQ7CZ8r34OG}P9*_~nNyGnP?@S6<YK#GZ6ewtS$w4Yet8$qbp{7B|(?UsT+=FqZu
ztbzAAWw!B?5qSmQ=EPRINjkFZ0l+h}l|uIlfx7-tMP#1RM#4vf8NU00@I+;%1<jn&
z1<~_Tud2z6_=Jkdyz%(n?I~anaz2{IkkvIB6uM*W2r<y6x0vJY_~@rD=*ARd3@S(t
z=FWnXGjt@zJ)k<jK=M9bxs)Wp80ah)o1P{w68;*wddp<u#lX($6`D-h2PZ|up-`<d
zG2~~6H<7`gxyFaL_T1vq&=LZHyswowmRG>MFN`7)^%D100q%?07AxZR{-T}GFb-8v
zqP0<D>Vr4su$la}_0QlG>B^WixO#!QiD2#)Hydu9>9+pRg*mH&a^20)^~*Q9*xUrF
zUlV+7BqyM;h0zRdM<kEfKo_P&v+y~-c{q!z5_+;_g&uJIBUxM4vDx(nekDg72P(wn
z>pBvw@DJf85#YlC^WhDAK}PDGauC}~mY+?OG!xY(AAk5zkay$bDMTY?iYfePHunW&
z<wo+Rac$=CY~;Ao;V}Fb$=^4kfOqd7q==rjx^6~+u|hw;{S%T$>qQo+K-X`DG)Rq|
zAnu2|<hPa~bYP*H%SR}$TjhGI+YJ}0=1O<Pza0Js(Jwp~MkpPMg$MtZKu2@LDBP&f
zK7y`TiG|914mYTWEU<6r|0FqWEVID<Q<o)vUPCCAuq8x6Y7ri^dl30q+X0*GFD^9i
zd>xhTc{er^ms%Cpm&m_b;sJ%8c*SeQ{f?=w7p5}yn~-vP+9{i5!5$JHS=nAzq$EMz
zb3M3Hf1G{!Y-;@eFi1gjb95Y#`s*InF?iDQefu=MW9bxc&lKL)8pxHiY=YeSgHMde
ziv-P;wkGZ7tlz~{0OIRQ9Z0A;f9ob|$peBd!YPgdV|Uu#NS=|tdxn3=r<#DPRiFU6
zqDudfmRUrs@MI(UeK~*~GN-|jZGTCSMvHknv7mv~VgCci_keNfi31YXL%)D7hGVGz
zG3?3*K(QTnkjKuspcB@!u8YrijSG#UuIBVXW~~nVHZM7h{^8B|n8P34S%!@)ZqL#`
zGqmwA&bo+8)v}ltEgR#$;aQ)k&xCLV@XEO8%K4A~4z>b2q<-^3*Fl-e`rW!&U|mdV
z`~-5DpBbnqSB-sW!o}k=PfW)`RUyi*sF@t;>3|pZ(~Y#UIkhE7BXQg6?|N-$M9^Cn
zf?DnK_30T1^tDBlBE^T(;nneh>T67}In>B@J-RVQ+IxtX2v{`cR1uZ)h|iqly>|my
zmpD_Wz@urj@yk`%Lp-3E_^smgd8s#<FwjyWU=fyPTI3utkn}k;>vu-sKIE4)iJ*tp
zXB3RF4rZM8ehP@m`mB~InB}ax;3yD((}5yCoz9JT@p{Fk5VCkgYZIKxgbdR0QlNHX
zZv;0_Q}FUH0aZ|uvw#_&eMYG-X{(@SPudR6JOvF!$m)4Nqrt;i8YHA}3M7U#f<6&>
z#Ipvs))=P3;J}L_>#DLJBqENJW`{j^eNwYPwD_TR$10HdX<SB=Q)o&0J?`sQoTeF`
zx`lM2m$$uDW+fA$3)7AmQax!`ZOwEUY#%xjV&Xg8JHCj6u_~LQfQXaLf#3=U+k>;Q
z_W^OU&4fqgY5}aQQC}=bK0t)>7WXbgxiAs<{|@8)jfmvxC(Eg;&yPu1jYJBxHX|+Y
zIUiTO>Kk0bw*2P;y(YdP>S$BVlR8Zln2<6X^yOT*$0K`~@!sv4;8eg0V>~JOB+HzC
zI&n0N?i@R~--50|;mOnv6!j(yA(ScUxYB|@lEHQng8T(OTaLdk`Mt}%;@b#kZ#n1Z
zYV4C))a5A)si3e!GcERJ%}pkmC&GJqI4uegtn&(8RUa#hfjcW%9KdPPBr{1H-V^=B
zMt8$4pQmJ>+8D{0v+u*f`ayZ#)BQ=#NZ?dEsSAXe$F?V!QyVsBPX|2xF8CWipY4O&
zrm*sH0Ei>WNetSY?CtW~V}zx{?-bL?WL%ogQ1<(Fg_rWY(o-{M&Vf>&^|=u;B6+Sq
z=-oGK?_(0uNg|P9xW%dKm1Crm176l=V};}iZW_|Vo#&hO^fc^~3^+CDzeM`R*p;m9
zgaS6h2D^3InHS6h&5t|#Z75s~h&Cm!q(CpC)6d5Oz8kD7Xqx10@hNH6g(i_xqlWTi
zjqxKYZ$7>>%Z1@L1hG!Bcp>l8m41@qGACoWcQqvmGA|To-Vj;Cf9tIX>5Z~(*2mzb
z2ykT!mtev;Qu^&&*yNBBX1%5#3c_5y7Zy^9f(mu~-6Mlf<Bs}IHM-0cP$>p_6MOV1
z-AT1ahY}c)?C!0o>MNnA5fS%Vk8^=H(E8rimm5a=$y!(vidtfN6;|_jiNVH(hd{&W
zc{gkVBw9q|jWnr@g^w%PB>Nna?qjB$pPYqm3{jfE-PYtjK|!=SR@1|k-PSIbTaG!~
z2Uu(vq#KF_>Fn}AXsuKn)m|wX_%|ot;FLWF^?6P!JXwn|IWp*MlK^_)@}Z<qaC5P(
zXYyU6j%xkUo#jR+Y497%??TXS*ds0lX9_O9e!s)49bgN+=uE)H3#J1)C5B4cQ>Rt0
z$B1~J1kCWA-?fB>AL*v>&cZ3_CzX>yqh%f>?YCGngdcaI&5~dvVK{$sH6KcJ`HvjU
zKgBSrn(rI_E+E1O&uqghJ&+69PK9+(>oQ*wIFW4w0{K4qTy}?3APsIYZ*1(KJMPo9
z5x=458mo<TH>06hRhXTWh5@_DBgc_-rS&!eWfu&1HnV22L11Smw~(}2jCj+oP=ENc
z9qVEYjOE|u&XtlQx&k)D?DA&6@S5<b4v;Uym#TfQHtMmcVJNJFUS?Ju0cb<#HPK#)
z7Jw`L)v>VVGSpqKj_UDM{IN4b(z2B4f_@GQ4Py?Hg_`JbNn)=3!&Y?S1^NXJR?{=2
zW%tdvBVKHFK@xk%f$gsETBk2VbGH!MoO@I?<Ph1FxGpYT`^i4xol68#{6UxoWk=xX
z+>v3YDof-T-xD$WgYR2}_08G=%eAIMxwrnim364aCH@-5Du~od%n$lRn*WRltf2Di
zb~A=#aj8glDMRGx9H!DEsbTtdMQEh?Z#H(dGL(Jgbr%6E9P6<&*?QO>Zlu*P%+Xhg
zoH);6X)b2T6`YJS;+-i$>q*1oC$9k>9OxENPY^aeo(w7})TWM@2BR@S4CK5}mgibU
z{_TM88^kgVCF0~I@<vn~Ym~}C)xzpzSP9A486SQn<CogP&ly2D|2UYE+b+kz&v%sS
z{Cz4`akInm`{sIO1CQ>U9V-VbRf;B)GOdbVg=g<a`<B4wD&cNBB|2`{{Dt5*Q;t4+
z>1)+xFbR?&jl%?~tjq;qteDc5*rQw10`5V$JGdt5z9k4sLhQvI0Zf8uWOFeR9huRR
zJM(MSQ3>s6(a(M)ih@(glm+7T>rn@g0AI`(RE!2)mRUrsG)QpZtjg<1W!}2*opkEm
z1bKNI04(7t)0~6WKS3Nf7sXwcNP;GcR*^C!3AHFlLV}nfsc_n2L^OiCZ3qsdvF@>$
z9@;_1I#Vhtk^SAG{`WUN-~=U$G#rC|F><KGas~*KdK<+2vz0t-^SAVB7oqxTeS6rN
z`fykZY#t`Qb}Sl3le=$F8KgW<SLor9cPh@U`X+myRH-7R^K+LSe{%~{hDYGL&U|ov
z>nBC5j=ystcNQ)i9>}|5Qmrtu&}$5@4%P{~h6BmJ=@ymQIsI07pZ2>=M9=8>+WP)!
zZL&}3Vl*|BNJY;x;5<0R5g%aRl(@@~V-O|s0voL?FtdH>?PUc&O7{24UbpwmxqEuV
z$NR5PH!e^i$He(xnYn9dsVv(jt}aIQEs;D=6?}>SsVfWzyrpJxN@?wrAb#&7(0z~O
zgA|>PhoaKK7(XGrr|6#xXXqdqwvXP5Gcen*0BT%-8)p1>=8K%VY!vc0O}Vg^m+HM$
z>q;Bav<C*Zi*kZNS9<K2U72Y180U;C_TbC#=aZ}nL1gC%%0m0MxDx5lQ(v3H<4Kjv
zbGW4t?*bLKxM_wD&Z4jQ=u39!U=v|+&&Nv1m1P+J$dm=Bjn5%LhRANIg=93Q!<?%1
zNRrHbtc5SNq=yXsLel!`g1{8UF8ALJE}c7SDoY9VzdQLtGXg6O(aCy*u^;?!m<l`Z
zm|AL$qdryXn#bYR=r>b%YqKz21kZ`m6NIIcfxC;i9<^rldOs2!t()S+7?bLnAKV=1
zci()f(eFWkcWt*(?~aj)P%mtgvU{fq8?}%ia?s(vfk#gov&!=o(JfK6n&JfuSA>hm
z0^*W!VMnQTm6Q$y<qHRNQ=yw}8=1aSm^4DJjlu7sdVD%9bazGsiN-8zOT@Ad+5<kD
zvVx_u1O_!xjmBVcC!fMO`<#gmo)CJD^%-S|Jy42T(lLwU;y~DD&G>GC--ngqV@qJB
zWt^j76#&Y2`XtyDSwLGU>Jl{dno~Vm#ae+)>GN{!Cn>dNIJ104w~kOj#VHI2<GxJ6
z>0PowS{yT`WFW}=ks18+J?!~`iChFwK^z~5ei0?VYRSssIK=U&aB#f)?-{uLx591(
z=Ho*<NaSah?^XlDn9?~7S%?O9UY|tlp@MG9K0+2JZ?~K+M$rts$NOR$`}0i8G2CDB
zEi8ZHdY}9CKe`!M_{Nr8Iy(%(8`@W|{6i-fMKfIv5%I^|-K#;kLT`JG&6uIU4a<Tv
zOX*>!#_Vj(mv?(etf#CB`x7vGuim4+-3e~fKm|E)hG7`j4_#s<o8S$+lqkLmA(@Hx
z8{@f?5?D>OWpnnjtEI@K7Xh1mE(v4)cw8T;0E;bfMQjg0mR#`>l*Njx5c>i1=#y}d
z&CB-!&2n^CWauS{?lqsNoE#s9q!U!ii@VypE7IfpjJ)Y^QTW%0$ABFxjPfjB(=@*R
zTH3#B32XD|{5;ZFTn@jk7H9U8S05IYuM41_^Z_O#=*Hk4@426Yh2O@AGdQkf97q<w
z)po;iJWsu}eSS<PXJ(Nk%-`=eMmK<ZhO&AAja?W3TPo^Qd~ryx33v@_fygxZcR*jX
z#8kATyB8l#(}Vl{IT8U?O@Xl1BfCf6+R&fNcC0O}VTTAJM(CAz4{qIH&M}7U8(O{}
z^Oly_@~%D!M3<|6wrt=2fSPwBi!oFkrVE1S$NSTF3Nq70l=pw48fnQ8b(O`$xp%G5
z(!&u_-cqoSMeJXDKjTxY(ucC*KnJdTArlj-ug}XrhaPIOxu68V;Q)&_<BE^W2;2vI
zmLbZr!9yze47z^=yHVzbV&1;0eR!ZOr3!6KxBD8m0+4t?(58RD;tv7N$)gO>>yD#!
zW6q>ROFEc0eC2$HlcThFh177#i3`74Rhg|1u%!i9;Kc-f?Or&8`~4m#QjPTi1GY1s
z3g)c>w+i5h$@>?KY)OE5o!+P*Y)3;?ivKwb=73KCYpwS{5=Ulf1zQsF*ZF^v7Jm_b
z9lrlcPOXYc<Y0TdS`n9F(SvBoTW*<r5iNOR`{9@7EVxs_yU*-_S2eFTM$I4QtfWB}
zWc?XdYL%x{B;_I{H05l7;+Sgt=+l8(z1c!@r-|`gZW8{duFvddI78S%nEvCZ{@ui}
z*2ef_XEf5Eh=T3DY`oU$xUX)%MM-0XLkaRGPwjTTPIB~~#IY2XDf@oRLscu56Z99u
zn@mAAR6t+-fv|+RUjMaO#7ZqcmdPQ{dk9@Mlb0BYUqMrIIiB{RMc<u@!f}D1@b#2k
zw9Ad4Rz54#lOF?3!l+#(QT}&zG%74Il%YrqDLl|EX&{1=uc0@sTd!ejm5B0V765TL
zuI*oad^(ki^(gZiPT;jD0WnAKFQ#NJ_gaEi{!LkRr+heHHlcQXP$^>mq;>u1A^}gC
zYUr9Y16gNcJVA%awIJEy{0b^<t1Cah@dyrj5aT<J%oQ62PjdoH4ny=sp&TbnhYfF<
z*KgpRV)8#9DIlrOqQVmI*3x<e{pk?z(bWK^qG)=#iSc190R>#1xTTYGy>one-?G+J
zX5=-#1I?<r9?f@{FQCaPdONnYF%=72Cyj>|qggD9N~iLA2fzzQV`f-aDK!tJ-?Gi+
znCfuSEZ;!;>iP>_4wfU84OVE_Hy$s?b&T9q_hSn7h~joJ{`^V8YJM+#KJ&U7j2uzS
zy&cH=429`sGBG_evFupo&<`jfhLeqD_4$s``vS}W7mIyrIcllUuwV9?VvLx=2}1K_
zX2K`?qey~Y-9|QFKRNI}yubuW=S&&A?&3LOSXA5{a;Po<XF06B6LBFa%b_o-SyId0
znEOgbSg4`3y#sEDdw3NA5P{GimB_O$+z+zH`$0{XID(%m`g<?w?TCg_Bv(?KDLAh%
zWSd=bB_kK4W_-RbE87U?N}`aK71-a8-nTWJ!Lbrf41Q<QF0}j=W?`+RIchevBlq-P
zVx%{(M5S=_cSbFe|FRgceVI|v+-cHw7)8KZU&L6p5FJYNOPOZA-Z=`{YW6LI-<Uk6
z>mwCS^(WXd8#hmry1GwO>)Te$G>V4*rH`xkQxSB-ivY~9wErWj^+Rh2cr$o3Br+%2
zv}P-&6ZGx@F6NjJdoU@(Ub!EnGgJWvG~g%@Yf4($9>>=w$qXEAJ?-$S7#`6L!oI+7
z>)YuY^hs52Y<|f`;@PmTw^eSb>GOmihL^_&aq^th^(Q>PUveB=J&pOQJ~$`l>Zs?p
zIt<&+3a)mU#OLcSIWr(z{&+_J@tX1@aqKVNh&r?Pvy*jY!oSBq+q>)Ae=&1%jKJH(
zf4f20FKd!S)12?O#86T*x!W?t!;pTQW2Z|V7mwE8v;iLe4XgadpND}Id;OSM>eaX5
zs^aO2S`mqM-*UpA^qmSZSpJFFl=v+U$@S`PVz0+X(CkfFfVYFd^`!7FnRQ{GBKBt0
zZ0(BJ`v=wtqvWVazT%N_gYS2W@|koTyr}Y#HjOUIzYrCQyqX=lk)`UidUX_9x6H!{
zHe$Wqzm>B%$lu&sXc(KtCWFpXoHbmQx+JZ+_G~24#}FNJ1y#fTG%IKWwjpo#lPk{l
zai3oHVU5cw=YB3ii;PDjd@^JApWdlD`x|L$g5Ez7_+|w_Rxnc%7f>ZSq_C7<mqJ}q
z0RD(mOfUDT{fdXbcga2+kWK3oaDlFFGAU`j4<xx+(<Dd-n8v`^d3el%7EY6;j}Z5r
zru{;fkM9H!nLdK5oxz*%si7r9LkxxWyxuahB%HEu#pqook!(!5yk=#Y)T|roR6^l!
zMdq^gU`FblTOK~h*=bCh_bpD;g<fx9b+bTd-moPvwqP0<*}RXJ)(Gf~Tg{HC(Q#)e
zwesVcb<Q0!YeJ7~x=$4gR~rCyCFIz-ssQlnT~{l^-agz7OY(%DRcZ@+VlN!|T&%M>
z(9-|~sb)!R>{iBNC^6w@iBi)FAK&-QZA!B0=nXH8r#h6QA_AU*banOpnJ?dge>ZXs
zN=Jl^&@rAAi@uBj&2>BbMs88<fKWS&{9Y>vPW(Gq^AnnASU<xxR8o&wn3HpM1S;&t
zRRYk9r8pnn$8gToL;vD^19m?Hsh27CmPY3}vuolu2~}plnE<^lj904Lq9z{sdGX^5
zl2131G~*mG<Mo3WW$IlRjYAbJ31GCcd_tJwLWWN)Ow?joJ%8W2Pv2u3w%m69th^(U
z31^d~<3RFvKcT?3<2?%RjP-bwr|XH!;>_Twj4gD+9Qk1N+j4lLN)F6=gn##_^cFbT
zsBjfVQ5Ynhd2MjDW9<nGP(kx^NeX%#hGFoCtc*la*vJjZ1o6WYV-j5c%*g;QB#`=_
z(CTl^`92tIwl&`Zr;M3o+#fh$;z91vBD3Nu_;j{wD627(R0erS;dT!zbJ#!mkel_^
zf=bIc9)avseI=culqkCYdA5sYwk3jJq1?NFqjB%~nHd>nK$=2-ZzcYrNxbgDP%lr|
zbS0mZ_y6-FEWrJo*!+<M@84llOUvk%ZocWGmKAhG^o0u1k}xsAm4Vj*s{n#DMY|x*
zpa0h&joxjG+yJHC*e1ap=l;0tm1qL#%+PgY9CN9s&!*VV5<mfY7UdW?yeq2m0w$eG
zH8s4K8!ImM0_SF{<nkH%?lWO*0dB8QE#nAfh%lJDYZ`1+7(Z8tiPA3199WxdW6>tl
zMV9p$E9j!Ws-l}6w!z$s3cIsms$U?;QhM{)owfMp<reyf)lYEBj32$KHw?GIZ~Opb
z<h>boNm%8t`BzMCRiD?CaQs2^+f*!y3Z8ET?P8}be(E=PScmuCmseHw+=aUGlZ*7E
z3eF32R)cqx5UYSZuFn15p}eWhDfXk|&*%|<CB^8e0d{A!W8qvGwvumOj<CVDX8qx0
znZyCY>5oM8Nc1cI#af)cruS4p0xNc)(s6oLiXNa&Pu8<Ez)ow-<>k@UhvPFkT7P(k
zm?J9v^!#vCB9ezLdSQhR_9UIh^cW*XA3jG|tVjbUr9E5U{(!hwJ~b<g14o&CYQJ=j
z9$YM4SbhAB3E0ULLyZlMb=w90PZ%B!<+nK6@!y43L6J!QIvk-Tq=4b)ymZZR6|{=j
zUuX_lo_x3{z?C}v-P|+Ic|I9Qk1{j!9@;8k5A5XOJO3A1Ul|p3_^nF}F!a#fQqq#r
z-CfemfOMy%bTc55QqnC9(g+AMgi1?ycSxt`9nb&VbJtn-+py-#F!TQ2z4x=9a65s$
z-eM8@DZnSNZQ9AM;t$@46jt3>D48FE6}m@nO~>)s!{wvEoKgHDejkGlNJm<-u!o7h
zsK*ku2J;BDh%&OK^RN>XNyjNYWsK_%kdsk4D(hW|QDnb49U^uRrF3yp2##Pf6l#WT
zI;PM@Lx0{fMY~?bwG4A^3m$8>izYu<i;&pwQ)u4CEUDV1%~$&zJO#rnz=^dR-5iA2
z(LX|hEpVMObDPGg$+EPi7n=w=cWcuWWj(VQ-=r)^Zxc5+%_vrvZW|x_OvE7;J)LRf
z=1a0cY~N|%E7x!No981H)z{uhhvy2Bn}eUBsF#XYh-|DgvpXJqv6;#;Z+|02<t2xG
z*7zd)`lqfTF6ahGu(&uM)?tjoYxQ74>r3Li*eb>@pYv~=s*UOCd7F{_3OA}Sf0<dY
zgpE{&MG|~-ZW-$ldSre_B$t!bn&PP)@>Vgl@cDCIm0&E?VG2;sl@x@oMM$-tUOw)<
z%SYqmq318xLDRyTuxn4y=}LPN&#8aT?>-fnWgx{UfH!o8N9=3Llbs3pwh<hSxr(p~
zqo~TeV-l}6@C>jZ^TWsWO@`f{No{ZYab4eD>wo?L+cC}&*1@&nN@2M(28_9y#$X(>
z0is(d8PDq8l4D3*W1KCA5Z&%Sv?v6F%LM4ca?7CIa~c5Pm+n3qw%tcvNlXa7<dhwb
z?H*4%g>iiA19{{NuDWIR0_>yW8*-JE=(I$UELSn;7f}{Z?<pL|k(q(-F!AaB<>=}K
z=8g|A75+Knn8Y5z8+z=)ZkIk2CkH&9xTkOBeL-PvxG9}Wvct|~^%e=T-^yuBcEQPn
z(s#IcD}1FXmyEzmVcnsJ%Ppo6lQqiV*C6BDJ83*Wzs3+1e*O1L<*^bOaEgSYirQu(
zEU9D2emm7GUgh<%YfoD9w#bVj)T`%VRpX{8AE6YUw?P1HkMcf=>!XCC7m%-J!Ctsy
zcO*hofg9Tgo`8>EadZ?cDHrLK-xBS}Olng0nK?Moj0JxI_oNYy6_k39ul1Wz;D+2y
zek^th#v1_0uk1v%H-)|w5~A30mBsl{{qb{sL2Pj@lRs@>bbhil=?Z>$bqZ&_Q~)+a
zIxEY>=VC{59u>=Hq_7&dVW!gaNL?(Y?joi$7rlO^f#Rl7%{$k#*NCC%I%|D-!P7z}
zgnX62Uv~zalO}IMJ|0rd+n@C`sT#J5uV&BM`Xv`qUm-|9kF9jp0j~3D><_8sL1yVi
zKl=o7aUBJJ31Fx%gckK+572uMI+{21?+z4to_9qOqm|mn@<hIGZPu@YH4em1DFHM?
z<8kBVzpZ$qNeqNSrW^1eN8}1C-gNc(39`r)JYZrEy7dY+KaUbS=AbLf&-$H4@orTs
zM>Lpe*6m9~kq>0Pdm8`JP|NE@5hf4dHB>EgUhS#A<|tun2u>96o4QNOkAE#h(8d;P
zB5f^Vt6m%C-Nh(tLh_47qo$V)7k#AEVf(D_vE5G`$W_OKeeA#avQN&y=H+ZIWpA&S
zM16jWY;SRrr=VH**AO9Wf<GHoX>vK;S>!j+C>V|I%;!E+A~+HVjH2v6%fv%kNWi^k
z^IqvNvoPVvJbh2~I-d7hFcOI0sAcH!1wP6f&cx0asRSUkoRmG_H@I&1fhH<Z3k4Aa
zXk}hqyyD}JUE<D|6K29d|LWekLHo_JSb^AsMU+Kn<;f+<XldfG=QRz1ITwe0febz-
z4cLmf<NQVj;%KCORF{;!0*2Uj1UUB>^xRgRb4G#y?3swIW|9nb(%y_)n3oi5rr~%l
zQM1AF%^{?ZGLA7;wmx{2-|RUDeMACmD5c)3%UFHLZT*5ZVUmABbZBxS2u~=vC<Z0U
zVQk)UC`XSVWzI-z?g!?+xViDRX^mcUhBqCDHY+M#xyz@bPT)`-L@4|GW$bf(vTL6i
zU@oVY57o89$-5%=a_WlqX@Z(J6y<KbRI&yFD-_fYjS6<Fe1pM1p0O%8J}>zVOrF>K
z3|33S_Xa+~#ds#<4{{S@fu~g=KWa<8<E1mJ<R2DzkGV=;07r6h9wtp>ov3m-#s`1D
z?E_<)E4)@2=21FMs{MFTDP1n!OiqY91jU%Xfinqh6aEwy`PsK=T7|liJ1t(~TTzo1
z9!1B3dw|nnF_!(H#y`TeLNlxGb>ve;Yeit9>E%<cb#I7i=>T>r{^jS}ZIyGd`I&>h
zI$~^Q2M-5R?3pjO@DG9K+^DX_LDLSC*W5pnj%4S|eat=km$1HQ@2OsLQ1-9TnQyf1
zpdNA(n6uPX-nE!2;Go>-`<X^nsr_PTz^mb!DQ3++e1_cp1P_=ksH(7y8+%DrrI1$Y
z**8bw`*_k?*?*g>HK=aDZk;dwJS{fF?;KdcWh6c&Y@ZQ@AKLsnm3Ut_Hv<)d38j0M
zO0@%KVZc97s8T;wF?zm&p178y%`Z1390^HbGGzDZ`5mgMP_^v?&`~ee(BmZ0i01zQ
z{QTcXHZVFXi~RR?rA$myH->WH8XPQ`LO0JVYwGR&nL7)4re_GOk$eHx1UE8b$?mt<
zTwU3HOD?Pg`N5GFKOqn{Rny$L1c%(`n>LL|8)a#YSG~W;?rp#S{M7ykLn9n#KosM8
zIkGw4%WEz*VJN;t65InDAyDjo<n+Aoa=zsnbSmSNX{M3U7SF-=QX{@$1{av#mmL|9
zRmaAOAtCv+Z&erGP$HS#H|&GXi(#bO0bu2;V|t#3*S^Yu$%R(ExQ%ywaS_+H=lxto
z&#-<-JRg^XyjSmqeU*Y$q@QAB{@ekEZ?`g9^mo}KKjJ#39yx#|A2+l1vzN8;B+jn)
zkPXH{t1c)Ei{~3KMOId~+}GY2ZWq7B`hd;yAEYuJ>5>r5FAy(>_fZ%Y<!Wgu^?N+*
z39B<#LtxP|X|kRgFAa~vc|-K;J%z8o{|}oaIXvr?v+I29NAV=aBcyke7?Ov1kQB`?
zccDRO&5rh|q2?nD8;PBgDurLqM8iZ?QQI@rqWRyW1$_TsKaDA(C-m`b<yQ#JOU~5r
z)gZh##<(_=>C?Mg)^9Jvz_zwreqoH50wFO`Ku80bbVt)}P*L2}KUIX%&MgwHkw)}b
zfd)0W<0h2?yTpcuQ8;^|d;YdCCU3PE<Wj6F4Y}Tg+5k)Mc3jVF4KX3KVJ0TCRiwQp
z027Z`{^#iz)W29X6EftoO8^rkT^!bZe3a!bJi2Fe6?mQ7{Z7v?6mUu|JMQwCk`J>b
zxR2FbbTKUx^}~6U68`z8>a!tHJmjbQ%@a42%CHr@_DG+?uuOpWdCQJ79Ey#OA0I}V
z=n;CECl-8D$DR4_py45R;ZMT(!nh?{jlW0+)4s6z&4!?|86)YF_#W;W)=eXaCHHLG
zKf}9T@j^qW65T>gZ-&MA>My<Y1a91xQzzz)As^>7faw)fQ|vMP{?n3dfp?obQIP>o
zMa-Vxui$!uLrjh~jhS%&)k<MZs}L(Ol{LF}1COnXb{|(}q<{;dAa>r@MIU}_Nm<7*
zW%IA~GK~MkoE#0D6ib?d#_@}*z;18?z9&6c)58a?(+jtxELX^$B1!Dg$GIGfKF?$O
z{3tKww{FMeyq}gv?dSMNjLAEeI<_;jd4~+p^8AtuPX0+cXIq=VL>qEi6q~XnMz2N$
z2lOJpwCX1NLmKt$x5y21b2bZaRLcDWrEg;cUkX=z3Ry(bQ*igYD_V02?k*a%kLB#|
zvb539RL)Hf8gU6fUhA*wQ@XIJ+Uf>l^zK`jTQTs~d-stFlLU0|McpzJhw^@IjIGEb
zsb6uD<@&Yv9@!;N3sfLm^?^UVpNIN~xI0rjh-q8fVyjnPlJ4pjZXu%*MTdn@qlJMf
zx#jxNFoB^Fc%>$D^mjERAd~oi9|mh=Mtl9><FCIG`N!PRQs6|CL24#}e7B`$VwpeZ
zscG-uGi&f5Pv<o}8vxOt0I%tfYrBE+g|mOIXG3+8(ckHCjg@|;y4608Iq#y%d7;2y
zeq%joPslEYygGiG`aoEDPfXCIW~g!`4e(p(C5Udyw2=dpI9{bDc|N|*hl+^O2ESR&
zd%Z$a)VN}S;1?BI1<9#1BgiocTY(4tTNg!SruJ@*cp#3U5D)BL7KoFGIiVms^GYvn
zMWYVVbivK*evZheG7!)i$F4*NYI1n2uFV!?<51wL<m1$m9rljBmry?hg#?I>%<LhF
zPNuNy#iX2edtdz!yI$6Y(_E`(0E^h#MkKBOLu5y%$h_aNz+p}7J324IKUsr01ABgT
zjVHPQbz~Wv=HTgGT1=$&-1{bNGWKd9gHsT4(nF$`nm1{#hVCR|p3{J>#MQ@yc=bk!
ztTopZvM@H}xcf&t2vday%XQI@m^as_81gHMY?i=8ZO**fGUg4hoVDHa76%;Z!qOxK
zxtR72d+g=86(u?ZjT|KcvY5FAYn%^%Mt%H7Q%GVEr2Ns1RVpB8M?5QsuYcOffZyj7
z?XI3sHprPzZk1oYjh86@a;zv=1QEc>OD7G?G@SylkEB=TZg`up^xg4@<#NM&3WAFz
z-q5?!y@Ds44z=ROL^?f;ZDJm`wnjAV5z#KR<2=vEPK?0Pw$xO>k08p+Z3w&p-1v-m
z9U7N|0nu`wIkw4NuXu<kr{d)O;hJ`zNp{r?lD%HQ<Q+ZyEO-g-_#y_EopN4i;3kEn
zFg`RY;&_&o>;qg)x6y>_8$6%HHi?7vC_|{&jA_m#0~N!0MLPAU$gowmSb?c@ioyPL
ztxJx*j)DBnm-8PkYC-;iPzk(H51hF?AMAPWj!&iSZ9W)61v<std1F&84;ewri@`wS
z#plxwQ^gLQw3WcR+M)2IpIQB{ZN4@TlIu#ajZc%(8pkOKO$i?+EsOLW7DI>aNWU{C
z%canX{<=NyKmOn=W6vAD_jxKl<-IDMMAHVej1BNh0*8i9ShGMqO!RUT1{p%%CK-X9
zL*GB9uGe_P&*bsh#FP`Q>^V&cpCfjL?W&mWNSKn#{uP6FNGyc1pD~sXnGTU6uV5=J
z{d+ytv4M{?i~e~OOyK-$KFyKK#@D}(VH3-m=t9Vrl8f@sA?V*FN$uQJX+tgHT=;z~
z*8zthk6kAh=V%~X2FqbI)5HNBo~c4Ifgnhizy{)YZ+O&S!%clGEuI|<;Wci(7PC2(
zQSjXtRK!?|u0=w83|SSy8+9FbZu!EgIBfeq9&|CW1O6Gr+{vvsTZcFj`<)C5tP$7}
z9`-w!^buKwEb{4(0{T<oC#T92e&Vs-kz6;KB0m@7xVS8UBWM${p_6&pcv!aPv|m*~
z%Ik}k8PEaTE7-9tZ70Vcj+RR4`<JaeE3w}I2{2bZs*uKc{nvdb1{09Ii8dTv>lg7o
zS$aq-<}G-Q(nQlz<h!NDc${Ks?7&1^^Cy0dCBk!4mVGYHe*Kjg6ZMH{xnIphku!tS
zq^{PTbcFQeo3IA5WaCvN+k^(HxzTij1gUKx6&)yVzf`Se_?LB1uv;8&bhA=xWyC_G
zGvX`<LJ(xC6@4!yEZq63`q^j<T*b1X?&9v6T8PaUaxpr6E)$gyjGn=ML1QvRyi^!D
zmNr{axjg{?WdTQ6VT^EV=fpWSD8%pD;N$Y@AwHs9bW-`gDXm;HQWEzG`i)K3hJ7^V
zO}(6sCEZfJ;ki226-8Fx+)tdN@$F&8I-+1VP1wXa;{{Otp_(Ujr@LMCcEb0-Z(8qV
zOJgeFuQj{-KV0#PD7fA>l8dNdzj%*z@4?h$zmD8~J&1FyE*zJ?&?5@rU<2}EA>SyI
zs2qp8w({Osa;m5(OD`w;LB8&ac)u5)u#k+rVU8?MR(JJdY?sQ%z?S;*b0<zxVJ?ZQ
zr_j@yDwbM&ZH!rrMiduGF_{zL?koFl5c73ZK<mSA0rDIV72>{vvUi1FqJ`R>_rWK{
zhRs=?)@Pa!EbSoi-uVpxPBo7{`v?K>?F5v!N83)Mzr0UNfyRZfg5;ThDl#d)Du-7L
z(mJ$ZOGxzggzD5fNok^Qi$A{s+WpFTGHWG<W{F^ZB=beH{^N6E@pqvTI3hup8?91$
z{M`E9znENw_xi%ZDyFdoXWE1~Kt2>ETOppfX29u;zPTJl;Q#B^tnKGJ{b>H2GlWHq
z>`kJ9Innt7&#f9`KWqM;3;Rva##VvWpMdPuTF%NxqPsn3mq#_e`pY9u8J)2S#Qy9Z
z)ZK@?Mrb&U`VrG!WcbX|dQv)HcAY(|r8${-a;!dP!7u8zH}PEj{k=d~Bb%kdQU=BE
za`YQ3aKC|fh}u%2PMS28!1T*J_gi!QXIJF8TZW1x$}TjpQ3M`+Tp{kk&_#m87gWJd
zW%pM*m0jWdr)`UIq5@$NOayE7<eL}7irRBi-yR1u5ZPS;t&OE6xK0~H^DQB)`E_+g
z<u7Q`D>Y+}R)^jh5*Ah05o(oB^X<4EhQ>eGk@}^c%Br|9-C$<mYVgFAC(Ho+{ScH@
zj(t6>_WWjKXbE`mpyw{I@AJp3(X7%j)e+b?0OOLlO<$5by6h-q+hpOnhb9!g6OXP>
za#c1MU1{>Vhf+@G$a5h~;P<U0iRRg54^KJD;PZ0n>U~5vol8+iFYVi-G3F~{S{uX*
z&xy4x*?XXRl}GT8M^L*LHeOeKNntj*exTYOVPD9GSsAF^*Z4)VRZMj~1{#BZar&n3
zYYMmuJv{NSacYoULsUkNgzoaQ!s^`3{+S5(v{{lbTH3>W94yyfaowC%l*B*1NCOAb
zb@k%<Cw7iY11O8dKbv4<b!-M{$ef%pf{OOdYTEv`gg5R~YZY|p6IW)xi>vbPF9*q9
z+evI(Hwm6_OOZxk4RKwabRicOWSV_Iq5aDw;jDY5o@x=|>;fnJyBy_sG!@TR7Vf^+
z0f(<EXQq4Jzmwpfd!Yh;&G6&Y3L&Y51z1j(mA`iSw!4!lJF+S~(NZL>NewUH(GZy1
zWV{fp;)VZIEP7ds5qv@ccd~qzdl~F0PXK>*AJyJHOA(u8el7`l2d*N_tnRK-r<1iD
z1UXMtOI1U~jyIw)a0_4%1IAOU(3E-eaacbbrB(V?Ps@+9n*u$UhmN+(Ol4<Mijiyu
zCps~Uj`yGJ<i9G%*Mzh6KJ>n;-!qpgPVepxrC|yEu&gr<Qkka%9nUL{a<VAO9-9q~
zHIi8?LDe(CyABB#?ao#PXX=XiKyE-<-)*B?BYH*hOBZ)mShe%ug0ObZCwu5qr92Tm
zX+#tkx!lS;ja~wszQbtRtKw?6XtyDjG#&JTISH36xPkEmcGY-m|3<Bj(>wm~8ix&-
zzEMomUnIjYVGwHjSlm#LIqtUMSbT?`={LXQl*n0wY0`L)c8aC4HI2zo<t)JzpM8Hm
z^2+_iG1S#F*#TbV778%e(Q%DEL^E)e3Be+2Lo^0g3+`5TZpnF9j#SRqo(*W+Q|jX?
zG{EKOaLfrYH&#DUE`K2gGSC?0EVTFOTGEjh1{0A|LYMZ&`b>4O3e6F^I{ZJ)Wg;Ca
z{bjYLfO&)f+|btXH$=PD?aVK#$r394<=nDFMCgEWj<Ud;PZx2k%lBt%Oy()7Ao~)J
zWJ^>sKE~smCc3_14IozsLpX*Y6c+U$$<nRTIhVXzuCyUH@$msw$St)f2gM#aN7~wW
za%8R}TY4d_?2Vu0j>})YX^vL7&nM%;VzZvGGxVjU$ew_!hpG3A8lIdS=tcvj-@1Z`
zF%JjlgI|!xybOhF<|L$0q1jl;=d{JJ&VC<7uAc-EbsumWeOCgP@#6;*TK?!7G$F3f
zF#GhHp0%L{7hLndS|iNnRovP=zdZAYMbyN;tXENI;=X)%Nm)$=9!g{XrhY1CZcim5
zkteGZOq5cPEW2M0a`kM2hYa(?YtV*2YeA_!8QFkc@uTr6vuvx2-8=@#F9l(Ubbdh$
zJc|DS#+y;Xfq<ncbyz;wYwCkdWSiBq<)C<2u#w}p9oDD@`G1S%9FJ~n(W;(43i@~Z
zmsfrPxs>p4_sQ%09Xw$uxBd+S%L~f$?MDQsR*7(FhBravTAq;w{08@0YIgIxj+oam
z(qca1)N++*8!i>N`2O(UuAl;pE82E3_~QM06o^)ahk^~~Y~G=qQJ6pq0~CI8`3Cl5
z7DwD(;@w^TV!C0XQS1Z1*FqG{Ua8m7K3O}B%LX5VR_x^u)#-1HBkmC*1j$h_lo4|<
zm;8LrzcKfJFcCX|mHOS~$G>QT6<ToNNSMoB>c(M5>6Y&kTmWEEcIj(*ZnmCjz%MXO
z#&~+~6Z8Rz4OkbSl`G6slpKomuOujWJ12on-_2xMhhL}o&l44`*L`rPsCk&sj5_zX
zN>Tm?>;YJ){1A@3zm!~f<cx<w4|$nM1;V(-M4Va<C!q3!sInlFoETfNtp#SLkIxfT
zzyn47k8J@u^TuyT=3Rpo_f#g$CgVgRiL@_mlwnx~JhvJJJh+%I%XT~^7WYF)G6%Ga
zJ5D8OX6ICq;$bO(zUxF3en_(sUQu;3g_hm%v)m(&+E+86f?o=@oD#1pf^<W-@x8Bf
z7v6t<E0pCKyr1*)e1y>Yh)tN{wxrQjQFX~|F?IJvp;l?Iu5|LCjWm54{j21n^5~T6
ze2Q2JM~i_hEE=5Z-|rzz+Byi3cjTCY^(Z!z&SK00XCcN>9ev3~Rf>B5V>jhA070J-
z7W$U&5C>=hj9;t{k+!e=;fk6DwP_~3Ddo)`BQy8_aQHM3RW)4d4=dea{-b@(S@H{s
z=G0ifm7%`N1=FR`iA-Ii)r5WLIP?js{xi)WFKrw9vWgcFdz@a&me*j=4ZJ%9UX-O2
zzNDXF2?Mp5O2IX=!IQcsFI2C~g@hME`SL|Ipxz+YEYDmBla`+`!%RZ`)JrvYK?2_M
z!Jf-Nd3v`P^!6`4xWC&ZK|kEt_-luc%Y~x0P&KvvOrNT>OT{kK8Onmrxv2rAw2}J~
zGzV3~@5W5d-*Od_ktF+nOZGnV{$?y*Uwo9wIsFD8dt7DeoF7%de_Q+<`fwj3N1(1C
zJFDqb`<_$F`y-0psIU77Bi64+XH^<mJL0|XV`bGN$#RAhUQlp=?YsJGy>2H)KEZxH
z4ZE|B+(w`O#V@o0A+pJGb90e-c@>6aWMp?I9${RvvxqoCJyX+aA$k`uST?KlAHo7e
zLU|;}5xi}EGSlbm@*<-03&Tx*ik#{9chj9k?}ZxD*X!;VNL($N0ai(&jfQ&kt7j%%
zL~?q5@WM8Vvnw{Dkt;(rP(T3RjrFKJ`^*W{$qpn^K|xMLRZ>Ik1z8d2w%XS6+YEwc
zS1#$huKoo=@e(Bk2eUwS@7q%D<X@ZxmCoaoXkKIyA^E(f9;8tu<KAfjYPO@7q^{oA
z{WU9Z^fFZZ>{MB1o|QxL9`!rhdQ3{Hl%zf1SSB>hX)qRlwl-5RoXAmom`h+h^qA72
zM3st|EA^2Brn)OBds5b882x<tAV-qL{yrmoj*A-o)12xRiLyQlUm%hWPa=mD&D(&Y
zD5Za$J+A$=3WsfO+AL5ZCn*n>5Ge<E&)9o(m=}nx!Ak>V&4L8#UPN<dZhl52lz~gE
zs{eCE{1IU~=J_|Tm81M)rckP(c5VO95?c<>=B^8g#@XDN<1-_%EJMN&=D6_&61mwu
zd`RM3<eDHI`Pv*Ax<sRSV+mqtatc@wK%ISs4p)vTkN;ip6wQgj7YIe?6*2f*)58I@
zT|-j7_{vZ$6N#CU6~oJsAPll&wYlrW_(zdzqwYZi4TfLLL<!d$xL7gq7IdX-*Y$a&
zWUrZJ49QwbXg8dNBN-<98EbpO5$zUgZv}Wiwny$!p*Qe;eD>|33+b0uqY;AUfN#DW
zviLlw^;aF0ys-&oN+DDQx6d^0KOEON4EVe=#4iMM>{ok4^D+dI`pR679X^h+elbd1
zgHFnr{7_X#ve&%~3oznvo_7RtO01LaQr|O+*Hh4yckLag%TvzCe8tt<b6@{`Enl2J
zjtQAgiF~U_FPRd$hclUD78zBW!pPQ2LHt~UGraNj*}(4p)_8vOpOJ$c0T*)n(fpVX
zf)3yt3zE78;^^r+Y0h_?Q4Io|ve_krjLEnDjbw;>%u^tqn}Q3kBG4e?#o2p`|HvOO
zk-zK_`9G5On)97LQ{Bg+XB(UD`!5;fO<Bu8MbB0%^<J^y_i9iRy}2bi#b7UPFG7E*
zqkn#-hQDanq`yL1`LY2=N1mQpNQ_)90qW>MNrvYtL}9#fb2>9I+lEL>N=?hYwLgmI
z=6$8Vn0)tc$k3hn$HkGScLy$Qt7HHwL<%a|`)P1Ww`S>6TmY#-d~6L7TD=~%>m1|j
zznG4E&4YbDsqgZZSTmMZWYK5xUns6s2#MOB?W@JCKh{)2D3uxy0%#4evFB15>(a+w
zIT)9e_)=QF;7`xcEnwCsV#ti{zcb5_9PfLgX;jszkyn2$qK>;DHpKCxP#QtaF1Ro8
zOVLr0*LisU9oCNCV#*%TIS{+(L7L-zVK&vVBbRG`>0|Y`VOM4EeS_t%*-6xqv>S^6
z(BPa|(qfvoOv**Fa(}m^AvxY;;E$$e!ViSRUbjI)aD_`<CJ7l#$Vo;IQxmGrFUi4z
zUiSDTm$cnSW6<D%itY!)SS-WSf?C3J{w~^U0Qe-Mp7#@J<=lgUM+C06wYH*_x}bg(
z8st-Ds!}Z<3tL52xN@Y*oAl~mRozVE`wMD)moUv|GVbyQ0y{dOEWZ<uiUS^{=`H1A
z=$m>eg&-TO73=Eso!#H=l3(ePOw^|=6o<;PXt9yH4JM|nO|mQI>sg-pqa#G%J%*x^
zVMzoy!C~&u;OLC;Odyg^O4-#A-x<5p3^+#FBlhc|Sy{4!Drt$L+FBt|R}N*ma4A_K
zDI0u*On`QkqM3VFwr$&SLY)6)N-<m{vM!$VP^Xg+o{ZF#-5lRZ@AED5-pL<9j?!5{
zzduOH1OsqejG3fA9Ljpp%oiz-q3mQs-{BH^?gbJ5-0Z|qpt0?p$&gCS1vn2~R{~4+
zeouC*8@>pi6pn?#^Ii$OS|Xa0f5yj{OegbdaE|G4QvpyA7Ci*PuTo<V4?(q;HP~hR
z4EHATK1Fpe2u@_bJ=7Z(bS7<(E+<L#=%0FWSNsztxm+RE)?io62m#{zT1LaL75^``
z)Zh$464JwJHyV(3f!qz8ZKP>!49th8w)rMU7)C7CfYp#>7;-&%0i*pyy7vic&Y@>*
z%i!*2h9{h!8IZB8j(%snEYVE$T(F|g-!2|p((|PZ&%EGd{fj8=3>jj-{y=H=$%UVN
zzY}DYw3@}Vjqx!&t(>C7;7hq@X&HCmwSI?Oo@B9m7cF6-Xh~@eKGBfBZ0M|z*hx^d
zd+{=HUE^%jRK-#i_mPT<Fn%jKfr8Q!+T6!x$h#jrcpWIVK7`Ti{@715MmZ4!ok3@-
zPbk-9Plnm<lHwism-d~E;-M%{b{HlH$5Bh?E0Ng2YJ-CF&If&A!K7yMXtu~3k>|QM
z1^4?j-`HJ1E5=w{hOGWd>S45sr+(8Ql>JkrUH|C?dA`L4T2iK5RV{7N+XKXkWi9xm
zi!kA!z|fjHnza(r-NHJ<jyVb#JC0tEH^3Mi!%E9tNT~SPcisfX0S%sI`5Xc4UBsBT
z^#m8I^Gj4x8)rPY{Oc@GNsff$1Jw5pdW0${z}b~j$06vt3XHQx%ZXbWpNgDXv2}>e
zCJiUThijMlUm@_*)TTu<{wjh7n@ph92PSpp*kLunNO^gm4h1tI@zvNH`Rz+N-&X{i
z3)P|gQ|2-4$#2mHAkAg=@Zn`*7oFGoOR<x=8E8W>hZ8M}DGuXH*maAZvj~h+E_ti5
zXpBO5GUpU{$A`LFtpK2GC$@P4(Awhp24=7{%{1}oLD9G!ERNx!{pq1{bZID-LuoUU
zV1WuW*Z1CVu}j#A)1S~)Wz02?3q7?M!{08yCGo^(eDdd@_2q{B^-crBw!d%SPw<}&
zM6vraTwuK;Cyg|c#_|Nuc+UqHsHB0v>xxSZ5<o9KtRfq)l_hnafksXhSa+8A`!wg9
zNU(}3H&T#}Tuj*v8>g8=?V+1ElH4b-2U)bkYRi0w#g^fTye}xVw?idD-4x|IpJ9ma
z#D^6$=gFAYCr(E5HV$}n!=C~udE_jeX-ZNUVs|a*TxHT&P&UPYrQ)LHv*5T=DM@22
zCeaT?oVF<6U!g%t9TL#9xiB=60_EBub)BH#@$HhxKfE>j9%prJg1)1zjGPIJ1-g-T
z#z8sN8`0_6xVo9s&`S1HIk!&wn*vU<I-W#Oh2nqFRR2}z8qEK$&>0_K1pb&7t5G6o
z?^M`D6cG087l}a_B&VYvCmkrwm0fkha0ElKEK;1v?Ux4gg&A%>Q{)S`8FcH{pAIcM
zU2g1ml3Kaic@PcLXmlH|PYeK5f%fXZ3W9?jMnj||P-ijy#b_qaN|qx!Me@&lf&@rr
z&1K@JCyrn&AY_e-EP!(5e;O6=X_daQ<Wpvt`NX`5qsc8vlrHcrXX2OJzRL0d3BP$!
zN(`F_tj#MTDwA_pb7p9u3KI{sY$V-D81~noii1_vw2`U}?&IY=V{egEt+H4ib+!sZ
zQyb<-GoFV}-_q7B{GyoY;5|PVL$XN^;4dSohi8}^E2XP+LNG;V7WkXJ<0x*^mh=PO
zWd+>XEMy&Va4_$y2BF!a8ytVp<IJfI!{{YN+DDx{cb4zH!RHqi>hC%*;8%gJ+g=-+
zjLb!+q@{bxkWY1=GdB7Slhvj$3%F#Qez&W7>l#^01dX({!{ilFSQ{EPJGi_SM2d2q
z_-w`*B9O_b6T;2N7-ZaIO=xvUXg*%~Ud)ABme1_6mHNr>^YFG9GLd{9Mp#8(hz+r8
zG89&rTCHi765xK0^abe(0vu+!yvq?!CaA~CgX(Ce%g<J$HSf)V5iU&07vG;b!dl@q
zwlDW<Fn>1W$MkWNnJgNtwR6XO5&S-ocbX(K`ztIu7p^B%VYE4qBa?G@WV72`om1)z
z{q$w5cWDAJrr}W>306O&QFdnYtWJPNeaht-!<ti&zrDZ+L9*Ejv8PtTqxYn$w2$QM
z%tUK`E`hx67&W24LDW;|YQ`+B<}L_3jbs!%=t4fdqv}{(YAp6mA)g|=V{0PsBtZo`
z3h=gcz1y0&MrXf%Mz>KsJ`(xQ-4VkVtBx~#;`nux&}T(7);F3-lK_DRGTcL_mO6UM
zC^I?B$u#D(@|Jee$;l@WmjfJ)6^xvw36k3qY#S1d4O=^4o7;Gd`1y$GN|R>$xM2UT
zf@xKy<e?HU*y#U%0;YH3kLR90uJY6^`MnY!J`dzpDU%F3GV>Z4B^DXxEiG{dBHR=>
zpgn}<qc34rZz(>x$r@}Lh>gFBxn0GoYM_UMk3fe8g^+}5Isy#RlI+cl=)#De4hnjb
zXnbK#PM3U2*rM0q6!oChke-S9PAg&YZ?9*lbFTBh0;1m@rXHIQ6~9<PCHx#K@KaDT
z>W}}jOgpt;g$v}@3^QkRjCE}BJ+q>nZhnehf5AL}j#_n)0tzlm3WwE@p_+FK9N1b~
z#Me>WK(9gT<(A^8Sh!eqD|G1CbaO+iapgDi^V~8C^3?l;LImrJ=Cbn(nf3gaU!f^k
zL{}Lio4qz9j!VDf%>4PvnW{LPdezpHJS{1r#jW1wT$$iNMAwLshO(Q1yl{mkT}x#*
zSDHRYEp~0bH-jo+4<yrCuUN!ep@ne}-|RPx;Ncf0U-D%I9`AnC_OrRr&422OQ9s;T
zHS27Hv_YI+L$}(FCRou0?Lf0~ZYff&<OWwyXOig;pA#1K=i@bMB?Vks3AAHXnYa&@
z<#G;qRlNW3cUFz0)P-;hH1#eT-0xQe^914ohY7?YoCJMgCx$q=KjJ1V7vriFmcZcs
z)Jh@#Uq7<f8Lw+sH!nH3%8tksR67GOai^ynV}DRZ@ylr7)-lTN*RbWNsYb;0p^51(
z;Wouin2JQ#I8d3mJ0)BXO#ye6(`eFSzb)MZUL!H-a_`SHuwf;Ju-}(){611C7HCi}
zK}cJDZ?6q2{SZkRDL#qoWXqgf&Z_ZiI|GZFrs(VhazduR+8lLAg5j;1aOb}0+2rJk
z?wqF_*pbDonx1E&p#5twiJ>0_i%=&a5B7qIb6u3u(P`<k^owr{@_O5X0s9BwgVv!c
zb}{bvdDvT~^@~GlFm~BD<~~>$)e4TKLUwuyCeH3q{Gp49LWy{vKdm_qVR+?+d%VsX
zey-B3OO&=1H_Xw}NK#$B`DP4jI&*Z||3Z(9kfUG1hKFzn2A)p{Y7N6c`0ETzs`L4s
zlO!eg9<iVs5s{7sxX+rPFG&&q*|l&ABm0H4$USdNZMqDSov4B>7cmXQl3+R=jA|Nc
z{AR~Fw%P#7XYuJw=(lUqY0PcLqqS_ptFNaaqBe*>6J+;X_r?@IFe5}Ya0{Zod3;37
zERfWSSi+ks58B)9D739Kq7-xP4+plAD%VesW76MfRP)FN9+S9U-p1x_>ANoY(dm>J
zcm^HW=XV(-y4QGMNf^~1sn~epc_*n%j1ILRRJ$o6=BMfV`n+|X80ibe<4=Zcb#-9y
zJ!(N8PtS$7lG+DlS3g6jn{YitX1v>Zr6Q;6P!HK_eALNPTrE^~_y&JmR}wvTX?dQG
z5aces@P@fPxdW6$u?ccxKJY3Lp?t5cbp{ORkif=0Fm?_iSgpQ*sEv~R)z|V(Q)<7o
z;_P*I6Ea=sNj=LzCPhZAM?3W5*xEEA#<9k<d*;2wFj+AW`s`x>tw;{~qk)keO$&du
zE0#L*O)Ls5ow~KRBwmmNF_^pPm=z!S@5B}gRnOZqtM<iDz0e6~WDpBRnt;jPF2Uc?
zjVe{HzCwHnuXA_&#cJ)7aw*_a7-?K8d$D$o8;z2l3FYtEd_+^cFRfJ*j(dHc7grfA
zJ^=B_HM}(b(0D$oGP@q!SSpcK-<^Erup`!Xf-<&J6CE91)8a@Pqo>mdA-YE7E^#nX
z9ux)V1@mFjWIZ4jR&n#*tST%24ChZ87|S!qPJZ!A8T|C#Zd#g<`$jr(-w}J!`>1i?
zJ4swamRf<-p5FaJ%e>t9dW6Q#J_oh@d>Z=M*_YT5|3uAqY=n?c7^UCZ{TOO312LTw
z3{$L3w!6^cbXXZ>>_9v(5VX*aW5o`lzDFH!LV?6`ck7n2CkFL?NIJL(-LW{N$zuqd
ze)~df;Q>4}=D7`u7CKKhzTr?uFxW19Mg)LX66~K_A65kd53WKy%EZN9a`(laK)xma
zQV~QL401?`MyYm%;A#|fRh?w)6*@|G%iWGT$eczum#~(j4(<2QiKXlGDh2B2c1C;C
zUM(hQyc({?Th(EgpXd6IQud<*B^{koSeVTF^mHOxT5k1eho22^ueng+DfCh`SDhSs
z9<}}bioSk+*uSd2D&JAdQ;w@%GymQv$T@VjJzZYNkqRady5??t8zy$>^zN@3e)tt}
zGg%B4-1k9fq^xU~!+BOyv%oE0K~!UM3eI09`EgvSOH@m{!9@A>cT?GrPc_zuWS3WU
z0!MKk#8J4_rLmZE3-=~&)hSMb_ForunjCB&GG2OGzrhj)D9~jnzm3%d$&IqNq<kAD
zGXJarTXp`^zoT7%KSw62tEUb!Vaua4fF)NM0;H^QWgxEcETx!OPa^C6Q0iv8xh>=k
zmXA{fvhT1O3E@-^hs|jqv8wk-De?bcRgO+heHqmT=Y)UHa9vm1Q3)9onRev>HYI-w
zNqLRRUc_kC#fu*N5mQQ?>K5e+VUFpk;SY=n!CWz_f2@=6nBI!lwU7+OGZ(GvOILN?
zlM?6Kzi}b`O^w0%YJX{eRwIUE3OdJe_UU@Pz68yxL1NCj)TLo^rftg2uJc7>BwrY_
z62|wVpDw=V=|{6Uyo|9IVjT{GZ*TLgx1Mg-RE&+Yjz3)w#5C+_<}e-*cQax0FJs~X
zo2-9qb{7OREHLgM0`WPCKJI;ZVdo_C3TfJJ#FRW^tn{QEDl8k?_qc%cz-Yt_s7RH)
zBSXqLB4#TE^>jS7?k~LMR~cqi)=VvCb2@7e?la5_t4RM*B(7V+`9I9>BbOHAxsy`s
zI(A5%H3m|TPXt%>o+#%ag8#SV`f_&^QKrUF+LnX~WQn4rJARZfY%oOsF)i5mV7k(v
zHzx+Y`d)j9f7q+~OVK&ZNb15l82U`#Pp8ay=g_95OL=rlXt}zoVy=n^K}S+8*ReQc
z_?LR7+c59N%=7GMqf2U|)G6KCk{YXqtRHh#n?}N^)xYtdr`M=`P-i!`{Z3;jsU3xX
z@jM8MBVh7ZoUE&+Q(y;|y2OV?YXBxNGZglB{4Y2lz~pB4!3I7@3Gb;uhAyZp%q#wr
zm?PEK2aK9><@((y|1{^8iOBcF<>tlyM_>;6-+*S0paX%S(Jmx999`iF$MfQrIg$tY
zP3VU=2p|s<I}!X(E=WZ4K0w@bYiaGC_r(hzT{Gi|(^L8dn&V4kvFcV{xfT-Rc9jdg
zKdUTMI;y8peCsN{`B4-ncqU^&Z`!28&rbaZ>$iu`|EPoHjfBmHq&rQ4p$o#1bzdof
zwzx_7ABZ#TuO|d{tl^Kf;(8fBS+B3lQLNu@LP#aY<b4A$sAG;wg&Z6D5bLkED+u+&
zhz&!jfwow~FD*GVj}>kI>^sEr7gE(~*9~0e1fdmZOA_)?{7w?)M9S%f&k8^JVi#JZ
zDt*gj=kvYwmfS3*)>WBXP%l9ueRE5)l;-+%YL2oa*MKsqBPCn5UneCl%+b*Q#sFja
zB;rAX%=1VEIU5F25)XtR#pK7sk+6|ET2j(1M$rbKn;Ss*qYn}wOfCS;*^_QSG_iBB
z>7{>l8|H^uU-Cbw9fx<cIRQd(j0wIV)#qGEh_UxWMU|CyfSp@y+v0oTehNI>Gw3Xl
z^`TM+55iY)$;)C)vAY?0#CAl~hEGa^peF`LPV`Df+jjeT0qbgG{8H<-_h>6ni!gNs
zn^NXT2p&~Hqo9L3OW2L@=XCo{V}u6(0`}EA&-%Ef3KXPA`teyu8wA*W{nK{~Nw+l8
z2%Ku^v8Uc<8-gp%;Gm|OMPFcuu{09BTkT{L7nQ%?WDPlQ5&w}bE#WfHummHW%|NA0
zlGOl(I(&S+BCN1qQ!MG!#Tvseax4(Z+oMc;lgWufS$R@da#Tj}z)Q7+euISZ?!5vH
z_kKWpvq)4YU!wMM{Mx+|Y9AFGJotjYUmWB|-U6;HMeQPdhBK%<|G}H4&nNF4VL5vX
zDM1O7hiVS?)&s>d(lnFKz#`#LUNm!xDT!|+1G{LzQ)Q2%A^S|}B)}`>p{R)N(K30x
zk;`~~OGHFs)<X3h_<K>!^#B%wszuNh9g=8e<xz2zZ|y$86VSmR7bL#&MZSpnkSVME
zxOb`@wRu;KNk{$~)T>3*?;Wu?zvpS#HaN*OP^JA#o=VQiPM_rTWDOJFjWAl*+<d_k
z3;mVIBTiY*4;u3RSkZa4Cdp{8{9TJqZD;!l+fpju!r|vV6c`e2mb3(pvbEq01srR9
zz-yi>QH1lR_x#zQ*uG78g@}VeA@|rNMttLxgStwfkgk=MY5ovD_0KA|A4M8^|LY!N
zj&20DB2j-e)Sf}4j5S{o`1qNLo9`=-=M(XQ`SB&LHBPiZIDZ*l8zIX9T-$MxL6!`E
z8q3^?QAhT|6q3wCnk7XL0WBm*=CRy3-9&YuF?X!4fx{okbIrngVo@c(hEOVF?t1#)
zM8_quyJ|uqUw%ufKabOW;>P^L7L-#e&XDEb0}PtxFu^u7Ud?G=exD-&n=B->#ib~=
zV5gCwbUf<y+f(q>?>N3Z+Nds=Fn7eH$R0TJybjNdAiz6rWiG(nx*q=sj`<+HTjSij
zJc|`E=||~$+P7lqQq*9JDq2$+cf{PcAAerL!oirc?{SDwl5rU^5R7iwVs0027<^(U
z14_V92bE_%y{t6-yy9Xa1b+KRmt-*}MAV5%Ql<nc!@SOlBq<Q9aMDY^d=O~mxrz31
z^+Dgs$#8K^D~KQ^X=8UEprJvtUo*eKCP!(W=BlbSfP=-AqbC!r8*JfrQsi=+G7J$$
zQoqQ9!b8bxWQTeQ{Qcd}ZX{BCsgs)q`n=9qNzC~&UhmjOrIRI(=5J_Udw*{2N8_Pb
zPUJ?67Pu5udf<z8I-E`$lb{>iod$*H>UW9)k_U+1Kt2gG#8!-*d71%OMloPF9m!~D
zPOY!S1fq$qjPMwD&v^G;KJ<S7j(a*bjSK}Xa`}QWK7~1%W*YCdnp7kn%6o;k;<X<@
z%ImfWl$u$Xm}u;;aqHvItnL*j@#CIoiTG3?@jL4nK3iTt;r%k|&<3dvGuc?lgIN?2
z_zWvug|s6^$EbpG&Cce13CRKhV@l9@C++c)J$%E)utw(7A@w?ee5|<>oe8U-&^(%s
z<(Im1B150?=k!z=4LtWmj*~~gT7kUYSJ9;(sIJ^ZHzBU6V4}tgh-8T7C|Ld0nP^1^
zi^O(B)GC68B5K`cHwsqy<jBh5Qua8dZpT(2f#Z`G`i+G#=<NewIh25f$sI%-`N9sg
zTjU<)Bd4`*6E{1(=7yp0?dzM=#l!gFwmc4xBF=6q_7HMNPbbsy2?b(cksf!td831g
z*6xEVsu!So4h<}V%$l?3^(=Lmiu{wZNAs}t*0Azj9CNfVv2MBbSEapVh?~ZEbrk!t
zCJ)%Yg^rNHpF~qHbn2Pd-X6N8C70NgpJ?za$`NZ64V@qn{VI#jo;mHfKd0pI{(g*l
zf+R?bE`^T~EfMIa^7Ss2W@Jr*B1|~#|Ix$#zmkA-@N2{Kh=jSLeYl7#HrZ50SE6oS
zqCBt>!M~s@aFn(Gm7?{9Sx+VEO`(>)=A-c@Re2<m|7N=J+7Um3ZX8oCCry0YiA&7I
z{RrjaG(T=^n^S0CKki3YU=ETsYiMM|e-h>7x#rJ6tbUu2FKj@yGO%D$=aPWv%Zx;~
z6WJ9oTuPKG+(qU9;0NgxHTeUt16x!BL8&zCeBiY#%d=*o-m(QuvA1oQ=xz<-E~j-=
zihlmA#Pt0ei<1WP-F~9~JQgylv)akH`oP1C^*n9x$N?2SH4s8sz-HVPKFv8*Tu~7l
zINjReV^mb}f`UO?e;}5`mG@)za0~O37xk$%PXC`1EZ8i9%7<+{;%|MN{G(t4ePqXh
za~TQn%J7n#3BPrV1tNezi%4DK*ENFrRfy*Z`0zee)c`}qbd<<0?X?Fiv<M}O`+`-p
zrGG<r`z}4-gT)l6kd*lXCei*O_^2%YC6pYpbaUBGloOi>cb61v$M#{@iTTkkf^66b
zcWw4EiJRHkdo?vEj<mN+YGZ%cXvFWZR1G_;xb>|Epaf&URgt^^&04wNPXGYz%eVrX
z+umV$1_QQ(t?f@Zs27I@`i&+C+RDgUjIXwC_t5zhXPl2u=isS39#b+Ck9wRqHvuro
zy=6H%aB(v!=9I!(HpiE3gjkgR=BJ-JV$Y|VPmA2<<XqD?vjy^zr?2Uk+e=_AoDG*J
z;N<P|q_sr!Q*x88%f|KNj)(6C^CN{3FE6Ld#xL^&b@lWRBj3{@;IMaAjIw%;z&gWS
zaPbE|f7kA0bI~T<EP;5~3RlsAFHX6u{9D&R8&uufXGHY?K@|@nT?uUe?LG}FJjnR_
zjhdQ>7&dLR-gbU4k?ewQP<A;*TJA(@D_q)wDPGt|EH)&vlH969)oDrp$GU?PutAEd
zDiJR(s|I6i)tU51-QL0{`SpW7o(VzAm^;OXM_}+78eB|UPxYCrkUe<U!dXIwV)-WU
zFh}@A!LhwiS?~E@TR9nTTXmw)Cr)h-iCCW6R)m!~nV`J{%eEY!nc$*l?<9%{m%MJC
z(zzgTg!nmZWDuA_W7EfWarBRLsn3R7tG^(6jchiNsJ98g94QqjL$S6+wp`jsC<Jtq
zwUN%Pa?H*V=<iHo$n9SojoJKh+P6zzkKWSm{%l4VQCNGw&yurF_2JJCao0BjQJHIQ
zsz7++FYAatJg#L8h7us?F!4r@RAyM^tucG2`Ml|+X^zP~V-{vE(!)q9lhvf!BXQJ0
z5MXd^aVqP_a>LsiEhR_U-KI<Gk8L)^?YZR@g(4j4tHX+YTU_1)`qDtEjwIWFc4Oi`
zAR_&SuDBkHN{^z0u}|Q5nd_p*a*WN=vx6PqFj3+4yiE}w{$flU8kl3liN`$<zTISK
zvJs2JvovvevG2}>7zO||@9TU6oU0+D2Zqf?P~bH~RZXwA6df|2CW`GxDgVAuGPDbn
zF2dcys|vOtqrt3wnFS0{1Q{Eoj<OA&F|Y4e{8rh2OJESzwmZ#q0AbAqMw>NV0^vfi
z8`oCSWF(V8>|DQJ-AeyuqE+Hr##+R&%6KDU6ff+4_#^+Cr{HI7e`TQd!cQCP8I+$a
z7kcky;#-q_+xK~*{}%2Q-Da$xndtvanuY~P>Nt{RJ=X?6B+;{jkI?Y;^44uAQBlV0
z^yvL`O2J}EbYJ)=fZ-f5{J8l&mVyNE5W;7mGXd^Q+ky{lA^SNIF3do|DUrc@n7{8&
zFRlU)_3^0G2mya<4*6GsSSezQz26@(Yxb$fZCdOzA<(p4F3@hr5q1kkRYGbU!qxJ)
zTc61!{<!$uiEpOi*bAGulxC8V+lW?9bX=A^xk&sI-S;;oun|o{2Jf%p1&Ur{0l?Z&
zQY;Dsn*1+ZL|_N_6U18(Qt2_RrnO2E-lVXd0@qt!-jC=YVAoBPh@QazGtssjyZ!p`
zja6)p%6VZ$-;6E=R|;v-A2nL;X-(LzJhs^dFm}F@a^~p<nI>fJDyROV7Gz9Kj&APe
zcHF%fZ*@5CUlYteQ_Nq3;-xogsIuOd;%5T$<YX@CoKOw?jK1IBG*m1wLpdie!Svmc
z9Vi&Rk|<H7nJsT(Yr*-u4u7Nh`~whzgPbvHDV~*kiTU4<A9nr`|Kld@24YH9g8k!)
z;2>?rh~V4Eh7btxppveJq_|Tb6Q0+l{gYlxF3slVL3vJFbql0k<rGiO3dZhAl8Mz5
zDsc75H^6-P0jIl|x*sIs-clM0SPuh^boxs^L?m9kD;q+LI!d!?P4z~se-_Oxa@c>r
zy<?l5iYsKaYjZ=Z)y}tq#vtJ{?~#JmZ7^YJ9M^QzUG&07WX6SeS{NVV=7tY7HJkT*
zPG;$wy43U@Hm`}xprbc%O2fL}Py>I<r&2ZYLFwAC4~>q+B-dPzTI=|WQEcC=oW+H3
zT=BT6A&D4l%5D{Tfd>%y<NEDejr3WN895#-Zkfmu>_0^nE=u?3FJgtxyfhr|&^4Hf
zZS0^+7Mcbhgi#rm!It?SwNWhad<Ei;YTP0+^I8$kg{<{5uH^M?6h>RyHLMfHuZS-6
z3Tm-^ZY|?Aj>y6rS-B`ygM1n<d}o*BC?ga!f(Tl9z2Rsz!xle$ZY=yL&F)z^O3)g!
zwfm5%So>c(nr4b@_mgc!=fA&rq_fTWKBUdZzF{@K!|-^oe6~g$sZX6FxQ<Mua`h}N
zEuyb{6)-6%nEnt*zw2^{7#YFDt;(MnGN^j{+hS(x%tlZ%R|q$0ZdFBL0p;}AD#j_D
z9RZ$Xdd-$)+nw;d>t?V!9F|AZU9=OVO#nv&i(8W<NxnkpyGUQ>J#Vok8e8MeMl&Xg
z7>H8w6#a>)TWBh-fB+jZht@q@;s=%(aJ>SIIbW{@jTCwN(fKn&dy7v^ac0FAWD5%S
z77WAuge}|ax}J+!?@A7reuQ)s2=CT<uj&4+9*gUEB1gKf^y+K8v0&oJfc2$XbP@t|
z^d4K`x$BMZ!*@4MXLLoc5r|53fb@?n7Pda8Szpcay`WVKvI9+4soLc@?W9y@rh047
z-Q|3V@G3+cxV%<toOGbLXGZX>ck=SS$^rN+Q>hXRjgk_oE(~EXoVnUKd_#1g#)6hZ
z7Ngwz{^3{eb<l#h;ws{XcDRlw+O+p&)1I7GD3fINn!G#COeQq2f7hk}`f|pp^{lPF
z+zri#MX+kjR5gr5%W>Fs$V$S}<R0t0oC$Upk1wR{wEDlECrxVQ*f;@Z{_!gC50eK=
z<X>2N>DkF=6S|U`-{gjhrl-$6UrBA!vld(ZOl)=_idX%HRSb-MG<)~JO<Y_IQ5|VO
zOq|7o!nl+12#ZBz$cQqm_q*db>WcgR4_$u&+t&9+ZK7djW^Nc9W@@kvGlK&SQ^QOS
zGbar*Q-ck2nl#MJ%*=58`_G;4UTHLzY#kk2mgTe0hIg;^tlF`BOK&MOG_R8#BT=s2
zL2swB%f!?{*RoNi0wD=ZvfPk|F5ur+3Q|(Sp}MLW>N|t34<q%b*T6cz?Hp881&TIa
z57-{<|3rD72!(I_x!ahGr_MnDR)0%Nh<<3CPi(Oz`qJ~=OVul)VlMsMe9DP9F8TXy
zu3CttG+3a*SK`o@az!6zXuyO;qYV^BCPW|KxN<J&rl8qnG;j&|s$$sE0$O^H!nQGZ
z0?~;!s7`mZ1yMqHuGy_iQ(+jDpdj#6Rt7aDLlhdM@}?5;#?Su*?tm`Q`$XKQd%D|y
zBekE|Z8x65kcp0o?d-a&iGa;lLu9SFOM!+#@%2wAw!w3?`ip^DBrMqBQ-7w>h_>(-
zcdh=a2_eKt+%b8DmQB&@9k?Ke3VVb`SyW0dxf28;y*Gog&0w{YuT%Eu-hSelR@8?d
ztkDlsr={TxWjewqM88op&!2{U(FFVd8VqgIgLjdSmzBe^u2B_-<*38>SzGijh=?z?
zeC>t22d%t4nxkU>jNzxEFXzF5!?I@Xl0$3UXAhTLc{Zly?g<NSzmh=priJns0T%nO
znY<D(6QchbpVY28)rL=sM$||)7^er%D1Rb<4ANh+j#`Wfm<aAqcJ(~@@MilD0%ZO)
z3IV0Vcbd~w{%ntgx8g?q&9h*0m8%HPtPhW%ml5twFG{}Idn+IRsw;5tyS-e*6c3BA
z=t-AXJl9ybUQ!o5$1@Q}&41bge~_>t{x7H5x{%yZC}2q&PFx*-f0$F>r#cKW@kY5Z
z7W^Jb+-x%z&h?lf-TYw)CK}W~w291rCWVBihezp?uBth;L<f1NYtn5SQj4DG>BfZD
z)0|HNc0Iv#zLuptX8PS=-!$jnks=|291pjMli4v&^BV|hEcrQXAt!G>#W4A|>=+-e
z{b<JYveGw%5&;AhooX1T$OTMdgeu)XHOV;^?VwZB#WF>qr1`#3ZZm0qn0}JqgseG;
z*f&MaH=+C|{G=(XicY%aU0LYEHozV*aAcZ4v@LA`^O%IRMOg@pz^whh(L6@P2-Jxq
z=*!65EJk}xu3HzH_(yEQAtmAreDgv=p`VYL{$Y!M!YuPQ2MS6puELDosL#-c3mb$;
zI5%JMKF;b$VVkgArXViEE6LOi+zRXJi90)m>E${gtK&*d?I?tkaYp;ywnR5_1C!W2
zEiaD(iYUo5QAGRT;a;b|OQB6~37zB-f2fVa^P^^OS>vp&2FKA6QUJ=cZqB6K4bXU&
z*?LIYB`k3XVm=-??Z5gqGklE{RCe(vSLb?9n3s0Ef(`A4N9f162U-Z6`MslUcpj2=
zyv8_e5hHmi{X=K*mADI5yw)+r;E{c&8cSq=NQVHr#E2aG)1%zr-+UCFlii^xdj`AY
zY<+{M3$%aPP%thg=`#%YwZ>0{s&7=tFsI-<DNJO0H{*|@g<}L~sJfIWu7fV2M@O{7
zDt_7@x8*F9dNLo^JB0IO`H8vdnYQv?(^!3}D!lnRNM6qmh=qu|QG=+TCR;eAs7jfs
zGYkQU@K!(oeSAqA5f_Vd3t=KGzlWXQ`RBF0LkJcg!w14?RZrITSdJQPbx=oNK+cyY
z<;f$05Dy7@5LTYTUc>KkwnggZIwtdS;bN#^w5eTu%UDrmvemCk|NK)KmxgS!P9W~U
z=KQ=xUm{DD7X3&@7f*+<L@|QOo6alchbF7|l)rzaT?j3i4Jd+nWf8?0trNthMyZhI
z>!Jc7a+?3XygAfm3V9L^QPHlr=}td(g^+*=y1^K7(#95F0t{o)d|f&u{2$?$c;u*@
zRE+e!bq>!pF9d!c1}oQXsJgI?95q>qWq;U{v7)&Zd)!vxa`wX9TMyH0<TM0~^o;@Q
zcEiPN<agy~<Bnm?I>ll194rcQ;6|Ub%SO+|?qMp%FNqxz4ONhOxbwdkCr)@xi?Oy~
zr|6s)#cHK2$5vz+a{Zf(j)|a@gEPYZ4yRX(+Ye5<Gi2gN$W-P)@UGtLvH3cZN`^FQ
z3fK{L>Vy${FOxmTPo-gmO5=#|>y!OI`sx=iu_eHT16N;nWv$ezBTL7Rcl0}Or)tTJ
zGS@Hn>igz5O&IxXeZ-0~luZ7~7CX3rIIQ4Qdi~Mj7cGk6qL3?6l966nf)=N+IQ=yP
z<#BH3%v$bkmd!s3omQduj&SxW49pUEvu-B7IdV^xSUdjm<S?#L_9K*tIq)?1ll1fH
z(tl_S-&1k8il1?c=SJLz8}()Qs}d`7>DWMOI8q}`*1+e7CUkzWQM3{Xn!hMUD&pc}
zccA-69O|gFG=M`<X#ek>Q22D41>pUD^4h;TmGW(f^6351;X0W79h<9qk+MDr?qyDf
zz*Yu0_eFd16T9oPGgoXLNIG$;3nK4$Wi9c}5|f#CPFHwG^?SDv&JyrL7@GY+-TdsG
z%-{cwSU&j1)(YcTR1-;~zjPKW`f(-$MrdDdPkOPoVrE1`!U+b|T}eb;fiZeacm^Kw
z(IVlATkB8#lYVf8*`=6`lgR#W$LLr6{!d2C%YKLo>+7<eTVdqBr<pMDmpgi!AFLl7
z4!AXT%>(Y6&$M%EWrolaGtF+eU<n;27pg60f=u4Dl9)_z<JeV_W6q<@+g0b|RjvPY
zPp=&M)bctl#4^3Vo94Do4`lk}2YSaN_}$6R;y{BmiKzv};O$;C^$_x+<~N+Aw~74j
z?qE1itUV*6SpVl`(O$oMQfmondp5)H$IaZp&h|yq1vdWxa;5sOicYjV%aa2RpSz~|
z3am26)lE;!E!|(lCV0z9MPH`buKyW*koa>ffrb<-kb_kmNH6R-`X>EuM4I6+9MR<B
ze|oX|y-YmT9XUe83Mvf?UVh+I)(l~1VI8GN8-IMhe(Cz=*#+*URQx|7E1X69TDreY
z!rU*mbia~`TrEXVytIG3JBakv7=Y<V{(jMypHk%Ie+a=vboB1`$Irp(F#bDU-Jn7=
zPWtsY<EDLx=JqnRTwnC=TniABd#-U_c23d(Ox4TN=5>Q8b5HP@$;qu3O0rbH)oAS%
z+vk3e1*XjPcDIj`<t}g6y<LZlFX6ZAwkWc#zZ}SK+jN)P-l89(fZLVmyE7qRb97)0
zlPJ<~n%-8o|BJ9s+(mEq`=pR9zXxiyD~j2F^#I?JtEP~;+G>Q~A8ug%yky>>Dv~j?
zc~7x?v1*K-Um3kQc=ryxn}m#zDT@R?3)WQN^vD^43kj0(_xAw+w2sAD*rC(lsZBj7
z2U3Nq*3=slD-#aLX@|{4N!f2<F2~EpOtJ0O5`+6V6*m%q_fmf!NMQf@a^36hC1CiT
z>z6lt$W!n+xZ1E7aO#(1aMZ*2F1n*ch99yY2VT;*ixAqAf53_6o`mZYT{?veHW74d
zJ<6P8u<?`htmD2s?UT!6WYZ<g=i@)3GY`2`H<jf%35RV@2({Ww^jGBh+${<P_1Z$~
zPueCJz6JGdVuSv?gVT|rFSIQB{37?$I6)r-)t)HX<k%2CHXK3DMZq04jdD-7aT~o3
zA~)i8{-R&O`2`}If$!I)eXdkclD174a8I0gxso#boJSvQDfdaAeG#SmGxYr_+MJ)8
z^y{Df#YNw7;905pyuxxClH%9>WD{$*f^)m0{ND<ZM+LkweveBM6cLj~6je&lx78DV
z$`60u)Z>qOJ#Ujq&QN;$L{a?fVN(vr?)IZBekM#c+Iv8m_BSZ=`iZEhJA0Me{fgW5
z9OE7$^7JwJ3E$-nJ-xF0O<5&08_s`7aMPQ-G-naXSYU+={oTk9zdL<9_V)s7-WSZ~
z&&yYj!?0P*92pGBd?soFMMh`ieQzRC3E?ud<&aI)_mA1&6)v%7G}(A(D@4Di32(sl
zpKlCAPEi5-qyo(wez~#7T_|cB;~7^|Z^9eTy$+5?PL$b~k}vkiK4F0;$|R(ZRDPwf
zO}DR(Yxv^+O4*jtE5Sy-kE`h?9r&ce*+)v<AkmM#_9wPNSIhI`en%w%ywCkKkHgX=
zN5MbgktYMj8>nSIhoo=TL%J^0g3uD&eA}{s`)vP#K)x;|R0N%ZVE1xS)I~>s)pd^y
zb!WWP<IljIcj#srGgViFzN{ZAf?bH&`-kj&ve(jIWchX|#yBQ)-0-OFMy@{M{09WP
zGh(io8N1sdp^Fm$pZ$+l??%6<YE^<#!%63OFSmAaOUtUr=GIn&{EK$c@kon!9%g+l
zrI&u%`Rr!rnyNWsO(lZ{8M}uBFW=eRvbtguJD6Rx4rd8iu&Xts2*6W&PI%0|<g%!D
zyZLV4b=XgX@t-C4r!ugcrX6O=>@@|T-?F1M47lP8_=v!4*EuvDk+<^y?Vk^xQ~@{5
z=j{0r{rWvd@;Ja-=TOxxfq)0x1q1GzQPlx_#+2_2J~96{=>sfD0E1~rz#P{9F@r>q
zL7krt-7;G-6fm$M6x=Mt=KI{gjk4L;?jBw8qtcR9j_hnCz!h0v{ld;BgryVMl;hca
ztNpOoW7VUR%7}i|eyP^9Sw@n$kcu%!k5x;PmpdItZ8xapn41Qb&hXAQwZAq)BnGyk
z__3hy+q!1m*wXnKk3wHpzRnrMhJ*ASx18j$moLSwt?Lr$u$e86h!-@t|Hdb#9hCG0
zy+Q=y@=6=B!y=44o?d?;zS3?yH{l`;ms#lNCBY0sf!^cA_O*s&?T<=s@7hx_0~kK9
z&^{*Nqm&n>!I=^MMUYRIjwkG>Yclko3F7K97d_~f5W?&4APAuD=R35|<2$T}Zf|Pq
zQ3k>B!2Nw&@&&v$9zie!xUYT3*LI^#7|j!E&52<EWWFeQ9Oiz2R-f+?HqE7-h9s71
zkDt2l9}BbpeIfWJcpm$RP|=uXxK|1{&D6v&uC(p^>*jnUcri$H%c46o_H<-E8D3Q7
z&F6mW84}*-HQS-bcv%63hqm8mRCH(k@(t(nb(=;$SAcM~bb2!)6%Wtadxv2j_F4RC
zle|0la=cl_iBov8@23=ED56*>oIqKwpfW>n-KV2)tOy~<Jok|V9jI9Gwf#LfG2}FB
zxDsO_$U-j~7QuN<YKmKS|2}0G^d)ddbWBoqOnAxfD(-38e<i=H7?s-9$uZ}8(jzS3
zC3DlP%ug%e)WPpI^J%F4a%<7w?P~;R1HL>BkV$ctTf!<s>hN?)-v^ml4yAt{JzBzA
zBOQ+axEWV>G=ptz3LTSKem)A8{35<m>Q9Okc?h-IO8U-0zU8cZ);0^4Ta8=+5nk_^
z*Cv@0#kFDNKX-*8`+lAhtGHSeUXA%2Ij65Ig2KF?{JNuz-dFuihLYph?QUfH{JcA1
zk?Z_k748~m1uGfguhZOnydH4g_C@`}F8!18Uj)-He?lZKFh&Ey!KLZ){xme8K_tZO
zmx`!IPFx)0lwke`SPg{N>f}Lh2E&~taHmu=#k(AZ_0qoeZjk-Vzf@<7Y%gl(8N-hL
z(r#@z1eAfV62^&hGi0se$_YY<7V$?YbeCZ1tV!IhcRMB%`bQ$^Y|XLY?J!(eWPj|(
zYJSCC^4(f)o#MhlFLYUr+xT<~&O*G#v9U2AG?tn*bP?(GZ*ovt2STGEI&dy`UIIbi
z9+{=IlfLMY?lKBoQy2elm-)Zv|97C=10Vih1Emhd+2-bFck54XjDKmhec(&Omd<Wk
zQn&aG#b0mx(wg?{akF3W(hpwrV|nt*8TP&3Uy!OHgrfKZ(Z%lyEifK@iv+>llD8HV
zW%~V_fo6X+>WU-((8QLh+4wpY!IFMI?2q|F{D+6EMc>`Wo0`w=s%TH{!P2hkm7V_D
zNu*KNtHPV119yc09AM=a(xg>)FK^ea_tS-7R9$?Oqv|Jg*X{0O{qqm3l-1y^>e>m=
zdt~fq9t2RRu%z=2YLGzkqPX~Jg0~BqJ50gjjv0G=nR4p6pY0ko@^%B=KPdO}&Eo0!
zv0LK(3iWL^_Z~Ar3OY6cEqP-(_R;^&;7!~W(|-L=tla}=NY`&|{BXmKLLU0wBvbpR
zLHDj;9X!8QVj@t#oJ;xmW)DqJ&BeB%Nmsk}Rqf_ryXZ3~4{19{u(ai?&CKT)iWkT+
zpMA=+!>jIMn7*#hNf;pPTn!Hnd{vK9*ENeguR(11Uu_pRS%5MbbS1hU!`+CWXl`J<
zI#B@19K}@F?HjypTkpH{qa)~ImA*Ubm(#Ek@g`NB%C*2Z(~K~{b1nInclT^hxsAKB
ziUBA*1@38~eKTa_rqd&fC~nnIAbAnJ{-^*8;q`&d5S*VfygVm*xr6`7k4XHOGte0&
znE(3e2fBRsL8=iMr6^<UH($(nqHPjicZ2N<nlO&Z=JEU3eY~1A%Am@msG`2W5dr_L
zSCh`wm^eg%ZErH#H6NExLysQ;uCGcv57YZk{pg#$=$nf&CO}x}id^I3mCwOR#0qy3
z(U`yOi%y=wsD2OQmlBij^f7u;2(MM!a$xZYGp6@X=pUJO`0{hz<73mSWtqkm0^Hcc
z3(UPf^PcIvO6dQZ4JEu3McXQLF+DHnZSgFp;sS}zd>*LYfVdtb4(^_a3&h99FLzey
z?7nDgEgRC*y)y$M|B5i&Y|gRL^~j}<2|)X_rU}*XtRj{e6jfnj4M!uUwodK=Lmm9-
zm3DCk?MkK@nITuTqO+yrLB*#G$to`wjEE+z*`VNN+Ib~dO+!J<mpqa;_mLsqQSyzD
zcOR`RK5yI)o*(I)a-?n-?HDObR0P|`2&Wb2y|)2Oj_k9;XF3&t2E7Oy_nWD)Mf%)@
zqEbgE{pfcYR^$2_B9}FEYIY8ihY~-JME(GKYc2S4mUlw^Dj^J##VE>?770H$z|Zbz
zU8rWoFBo{ureDTL6$=xMD<!l;We>~W5$W9f<~-<rBBm}`O37Hk=NSHpmP&<F7sX9q
zV(uR#Ubdw8YZ5k^Wh5cZUvs$v1<iswmeUDA_Ai#|#fg&!7p4*hC~ji_l)Yz76el3Q
zu^eL_-apSY7V{NSQozrtoZQvPl5Ac0ZoHs57qP^&xMgnz`qRJ=+l<>x68`nu2B4Gq
zcv(TQmr4-6Y8f+JScElQ!pWsdlWNNi^GF!L9{r!l4AU6gGkX0WjN1^K3^P5mggI_!
z5m<SjLw5H#yJfh6l1I?Rv3&{I2ZQQT*ieo)jykFyoI3Oa<>3)2luh8o=13nK?zJeC
zf9Xm}Pl8)FGqWtpLlhtV3Z8vw8g$S`bf+e?@j0ie74i_Ph@vhObU@w}_vlv}JP=BT
z;<~8TVQtlsPZmvh(BmiyDS_WcTrs7tC*{v%kj$2Snx-prmNb`NUP3~es7d*Off}uQ
zq&+hi4&?bey%-zVEWovxoS%KdGd9G}cNy!&rIA+9l%Eq>7)VZxcx)2_+Tqqn%S$;C
znvu!lptnd4-bHmcZ7n7m*BG?S7XkKD9qpg0_LJDw1<#^1s^^veMyTe-35%Wnx0uO5
zhDwE4^+GH+t*#Qif!6G@5S}_}(x@hi?#`Xxl5?W00-9KW+tvmwh@YR7v0zQOw|tMW
zMHmvHnPbBh(xid_o<;<xwC;$YU;6FJX!`&n+u}y;$|cowSnrJp*U>W)(D-8-HS(LN
z@KKAOkE{~VN>)Z0{H!Qrwygo*p_{~sl(|w4@~Ug1hZMQG=trbvOmRb3hpMPG^BV-v
z6<oU7BPO*F|3PGa|2efN?YpM`)ijYAXoQFUCT%9oCtX%Gor=YUZ&46(0k2naT0T<z
zc57KR8p>M%YiZ3oA!e#W7Nf+(KKcp8#vr5TB(R?mVc$k>SzE#ZzLFsSeEgcy{CWT?
z%l`A6qR8+fV)MX$crL@+JY}@P4F0+xJgI9r=d!2s57UFH<-SM$hJ)UbSE33;S}&36
zKxDX#o3Brki$RO2-enaeV*dZ=g^zs8zQ=}~el-P;p`inGIz_fL(vrQCs^k-^CR6j$
zmjyFmPAvD(_N)3d@5G)01aKL#j{SH4@s*dKs8}Kntnhfql8Z=+p<(~s1&Nf56x)hT
zrsLEC9C2(Z@@3V=4hb_mPw!19r3Y)Jk?NjA)o*Ul_zS>A#dnkprq?l%@nMs3yR+>M
z9@PxY@A37ukTj1qsVjh6)tBFH{$Si8`?2#(JxV747Oyh{>+Vo02;x=A`ji#0nI66b
zY~-u=QtIEi_5WU1njVGoH<QDDCIemS!VTj>mKD3$KF9kyyZ(hvCjm)a=)k8isIjMA
z6f??cpgLQ~2UlDp4V0iGbPcWil&c@oM~-qE2-x^?2S4;#Hy3<bX^_9)NFMT~unegk
zQi4S-3(X3viud>YU}`kU6M?nKNFWTbyi5pG&)q-s*O*`oEP6wpym}Mo*`emV=AwYW
zTX|XX$uXSJ@NM;VL~qXhCgIK!C_fE>`dw|Sv;~9Arcb=v-BRv5D5eHah(|g<VMS2>
z@%O_w8u?P9ox5zJ#@SazP@UG7uLKO{CjV0-FC4-GvCk2AJHNEMUk-`B&x&pji+-^4
z*e(S`A`vN1d$Rj*_idtrIyJ%d&tFAa$ywZzQViGFL%w|KxsmgVx>NN!Az5B8D&&d3
zDs%q|6#N{?1b=EyV25ucqm29#UtR@8pW{lE(eOu^q)}PK3wy5d=$xdnPE>3EMmoPI
zRu!I|n5sQuFIq7+*d`xtEC;Ha#OX@T0OZsYmVhIAW&boH-=3oddVr)KG31;54~ipD
zOzz+R`e%i!=`Hpy^g*?)=qhJ$lg_%HVPY7B9n84R;Wa0$s2I(}l>8Q%+9Vga`MGUj
z2lDN8=q9;##h}$TD{@}f$d-+W?A_S!s^eh~#1oJIH`=KU{1M|CmWv#qLF!Ao0+-51
zt{Fl*_>%GvxIs$q>xeC_R_#QWZvbeTRL&&zAPAMN2_K=Am5m8$IDtCrPKXQLahuy~
zNuaMSVC71_3;Nig{1zP=*hLtNp$*u(Q`ZD0B`~C3Mu4ehD1uI<JmRyS<VcZa%uq>A
zSH<AD684X67tHayEHst&<z$h~$ps4)K!IC!l&yrX56)OA;qFhfUF2@yTZWS>c?rv%
zjH;U`8TlH7#QMFgh1#J@wnewssDRVjCLXe{L*RxvLTWI;koEcQNMMY^AfogdYwn=2
zkg5R{SI5?=p4jyn+LG;jAV#5U%Fr0;Q)Afi-Gqy5!#fD|hjiU-7bud$T5rc$o0t%|
z`%DEKinSQ7$d&F-Jn@zW+m6A_=NnoZ&i{o+FyaC+go06^rVCX%;QHWWUO_=ncsK$I
z3QBl`nUTr=HplPz#g{xr<R|}u3&>z8w2>**lxhj$8(7R6_@BgtArNf)2LlrRH*crY
ziTx|mM3W+1#&RL<U46rstKP9z(@;b}OlrH`bs=QZmvnU|4mDwa6*m2qm)XcR&XXvW
z&yg0%X*#0yw=<~=7qjEDc=pz0B~v%VzpAF~MoNfdD^yD@)gie~!ajnpzY=r%))S3w
z`~hS#G*qlRm~L#YK_3N8+V()0)nb{eI~{HTVs9t+SJkm!7SRTD{pEh&5SF?Ly@*Qq
z6pU%Lg?&*$!m{KgqT%8~B3-1`4fw|QB8+Sti0(?HLG`~Vn~laK;RhX(#Fw^L=Yz-_
z4BODr(W`^%7r&`bwU$(d_Eh}ZE`f#5CaHTdrV==TPaw_=ERCy}9*r-7>FaZ^2?`t$
z0IezY6;6REw=@H55q)?Tas+w~61pGsFE*hV&OXEkliWQI)R-Pvsh~<QWq;%ASzA2V
zh+1)xsC%Yo7V`YE(TbHGQ0i_{=UR_?V96$Krcd``Ei*I@a{Y~7-|_wI=UiCi2bO*-
zQP{A1?oNCylM9LuM)q7>Y!IVuiyi`YnlD0O+u&MT+&$Wlrz5tctvY6i6c~Lf5JLi#
z<A3>HH2g=Z$^TOay*E+Hi-6-AOy(;zp7z=NBaGg5@cCRLS-@tgT2e^_Q%qZMN0S5v
zE<S(&{NTf{OM0P7*6F)ZnBtI=CK~qzC1ODpK|EZTd<cr6i26?r<>8ZZQ_Aej1HM+v
z@jG*<`8CQxzY;~-c;xfA>%E9&rd3xMU`OhOtl^Zk<{}O%*n`1Am7MnqI`|bKFO3pZ
zg2M|i#E~n?YI9N$eW_T8XP}oR#QRD%^27zDW}$}83Ut?JQkbvQ;F*9+O?8l1a~(9x
zoOF3T+Gys=vieNms6OIJ<m>deXCzJZWeS;jh<iDBqJLrL6Pbvu6*PQJefWB8W{9pw
z_5|X6e}b=ceX(7WjVy5IlSa!}kEAk%0uV8VJYx&~lo6*aW2x^oj?m=aEc+Af(`DY9
zus2>iK{pi&$px(hK~@kKz5X37-r>u}l_)C_8s%7>>QPMMN9So1UnIT}P)=Eu@KqY-
zFeN$TYAcMMG5fBpXmt|Br$pp4g5m^_<i>X?VD3yAE%s8$u?rDS_J_ZJM4*v^E-P~3
zeh!ZRi{cLE?&Nb+qq@RMSZ<qQ_8BJp|6e%Y42*|naX=c&M6xe1kW$`2LBpEIXwFC_
z*kP*2X6_U2zEir>L3z?<?w-gsb}_F&z_8E_1y#O?Xa9seX^-35w_L>BTBXKN^LDjT
zMn$1kOKaC=?yADFhhF2ISe;HIjALH0>fsk}c#o=~-3?V)mNHCA;$lRPs!Fvfm801;
z|ENWIWhVmAsN{%WQchRMXI<ae;uJ<k&;pjfcW4M!#y(9pQ0W_)QMkvD^8c(nh{pGL
zRF=d^b#L)ooIF=}_R<UaTiX))tyv5`J51g^IA1tbCcOqlm(tB39;E*ZkgN<hO@v$|
z9(0r@vOrZ)xzWU+!xB%mB)z@|lUIr$3~&DP4+K@!3V@ngT1-ci8J;fOyOHtn@dpM5
z^4i<=*3=&OLt&Be5Ec$Ld>;*bf(LR7BqOlyHD;CkZm_|Cc!qF_)2N_2ts<1x<o|%u
zb-dva;Mf1^YgqrIl{_qFA`&AvH8t_Moe_N8q;+q>i#|d6y`LJHF4h?QotS`|WDajI
z&t<)mU-Ch9T}~kA5(vyajG(#y!dt)ex+ZBN>Qy_tWi#M6M2jV8<emLuSZHXyAbFxv
zlfdrUEp5OCCPEou>XoS%P~s7*XUKA;r{e3G6PGqGMzIVilr3n@i<YGFmVIM1G<=Bk
zSYC!X+4lw1s=a&EAK&3uc*j@=UM!X$Xk244iO;KoFUs)Zx_A~McJcpA@0}r%2;L3<
z`5<uu{>#Pu|FN@A9T59)peIAk&CGfh7xBAa*Do<hNm<&dLY1%vgn?Ct<%Y}XL#j*g
zv}{gF=~>`YJ2?O;hE;gl+90hj7l^OcWtBi2?g)lfzZ1w&0+48R#2cF~jE+ApLM3e5
z&F^jV-N?cg8<2mrGI&cNh*=8ZH1BSn-F@4*1qK-Legwq6`mb05&NqYs)h8XU6bb2z
zI^q*P_gng7gHoVKi(~k9c2MH>1Iy@3US^*s@%zfErLtR_PHCVn=kj<S_}y$#C0PTd
zD>=aK5eVHm5k|p-Ej(srwcxg2p%mP>+($%zfSc16^k2%XRKP>le})|_v8b1N2w6UN
zD9tt-%uGH|>Y55z@KyYO+EKSTf_El>k1re?a_8bUlc%ZQSH|`K^r`$$l$;CG=P|@_
zeIuUkl_lnh3zKv-y5p<rI**#qCxXA6Q4KaN_9ca*B;%kfdvei_R*3lwI19y$NUMmG
zw;^`5uD!gOWa&2}3?0~jSHckYDbQuItdgp>+`1s4;^$PMN$H=7bJiwW3cSC`_6z81
zp`~0ttmM&D$x5lYn=nyf?`0#uOWMk_GJc1LF~uJ}sVJ*?!BkiMGoo$}#&nfWGkB0>
zhmHQGd=P(v>RM8kk&zOdDV)9H6Cz|_P>7%VixN0>pV|jUBaL6!mWNx;UheS#K#yQQ
zrvH1M-)j$R(ytc(Yl*qB5KOovOr9+KtDn60h)6L^v7j;?lhvv!z)Jzk&EumY9DOrD
zH4yq`M@5n~(%GwcNO;sc;gJhJP6GS-4v5K!AhZ&>5|61BYaN6SIfd|BfYI}6Q|yrf
z7hPgDKAS2KBo59u$ZESo67o}ytkAb!?RObilauiJ9u}{OWC9~Gmpgb3>p_qhP6za)
zA32sG7GD6PH-=G{=Uab!ez|MH+tqdC`TpBG<kZf5ZZl#(+&n5GU*|74>}wQ=aLQag
zY%hns<Y6F5nE9{tHU&{Cye%_g=ZunTpNpE68Fsq2TsF!^T8+K9(Cv0i$Icp;EEG3i
zsF0Kpo#Tpv4|Zgd#*&pN1xg!p>X$*F9cz@+o;0aI`A4<7^!TiHs~(HY-mIYu4my<}
z2eK1-g^JA8d;tRROMh$2AURLe<n%4%od%R}5m<ZBybo{{0j=4NYK5b79imZ)(xOj`
zPnK6p(JK%abx=UFdi|g`)c8rA14~EANRK<Bv<kXap!r65bvEF4G;R<nGimfyo3mHn
z{3~jX@~?0`LRs&X*dd`d9ymjOF|`MZ8?wFK-WW;Ab$OYW2G%x3CxWgSK@4{$Y@JDg
zcwz}(;`s1k%9Jvic&r|IF!G)X^lm3c@cB_cKlu5a``L@`|0L1z`SH5c<tun|dpvBQ
z-$xJg{~{WW!H~Y1(pL^{Eu*2qAkkktL*`DxML?C4vNhvK#6F?O_sHGQB4DFDA0Q+*
zmH%ZC_U{o{#b_n=*8rb~uD0ppGmLtQYhhO&UjFN1-;_1#&QG`yE_X{Y8>@EwV_4E7
z`?KDd`5Zuta3sgF>fA;sYt}ta@cl0ct{W#QM9t$0V9hdzq;RFUgcbG#OG{6YPTP{-
z4d(YKn!hN2&`eWwuJ}_zHx76M38pr|@Oc)$bYUx2A>MUKdqbwkT;agne6%dyO)2b@
zRi*pZ<^?%`U2fuXXvxo@-a0`?ZjSzmQ`kP$jo(LtfL|Pl3ruWObYaGKo>)H77QmW(
zUi*-=Jb@OdVc&Ch-ytaGRl=aRHO;*ZWKcp0CfY{DS9HjqTJ~`I^0tlvvCAZW7Mes^
zs3>(ivLqGAt120Z!TmOx{hR&B0xJi6#QHCv%igC;0?iNIEfqED8jPQd6<S)=a}}zt
ztE-!rA;J8V!((GOf^Iu}Bw-oOePd%|5$AlyKfsTnN#BJfMG}j{ti6uIH^UWd-~F?U
zrW{yK?}O*FrURWhoW_L58{E^NMJMA!L;ZCqPn^}#>izlDl<}W3$Rr16bea%#jMdTq
zR#Q1$+lYDlPLETXzZfk~F8V*=)tZ;ehC38+@r2CV|48>DD{RC%*)dHQUeBtwNGhAK
zE2L)(IY&;bJN+6emZk46KvAXh>d(6!=C)<|Cvg$cjtj|0LlU$NGy#295S!6})!s?H
zfv`F9E&7ak({f5yop3<IsM>h!B<b)<YDk+)<zEJq+glJ&sYaA6<uSjiGz)6=d&kFu
z)!dnmaJ0ueoDwg)Kj6}y!y>%&l)kypW_DKZ>uyRk2Pl;W?2V7hT^rn{hf+Zn)hE>R
zl%Hl&3p!>vN2)GseYs~;JTCAf>7f;0N~-=>?`$;e8(5<Cm=x|2KbF*xcIAF&{y4&1
z&)`dCobG5%&RMEke{YE*Wx{z6r0;DWT7u0g1n7w|v&Zeb(P}@RQ{T8^4>}d=>o@3U
zeZij)wk=XS;lu3vRgCKD#9#IE(d_yG-)z`TB|&+zq42f75oKp0Ni)z<w%r2?np!K?
zU@TwzrSnLGhq%KQkn11u6S8q7T^(xwmA#)TU5@vLKDu)Mr6ff@b7$bb^qdPx@`O?z
z!uq#M;G!g=@o^$q-^X#w*_kaKvv$wt?dO~5ikJCpiNfy5e5Ec%eE0A<8&n^hw<Y5!
z4j-P(?W8JvV0EBk#c%8pmYU?QcwaAsS7k7@h=)1%mFT-wc{RbRC}aoii8EzYXQ~Kf
zMC!@R^kg?gU+8MZ5xqPGCr@n6kLNdMjFN}>gLrV5!c%xDO$U+2TIJ#1p_vT@PZ4%c
z@=(vIGo^g&qn3I6Ge`1?Dr73{a%otdQOCQEbl=M8An>16L33WlVc4SSQFBak^bbZ@
zJ`sfbkEkMws%-4r^J{(gFlnc=*Hie`&cWPTi(k9P+rf*iLcSU2?Lq$@qmJ#!Dc^?Y
zJ)X$s^KA0!4>>8AbN6YRs|2x>WRko#>!O^avahvShUWzXPDlrSTQ|deH)sx_evHTs
z{HKD@-r~egc3Y!b8&XG}ulJGK)j_SiKh!@!W=(BxV$Vft1JBkmys~q=9Tn#eQOUbe
z_<eMK#{Yb1{jVkqj-Q&eK$LCtl3TTy_oa%s=3RX?-x4#OIEm|d_TUZ2f{tLF?V`=E
zeUC-3cj>`R0~N#fgP_K(nP4(&V$O;dhE=rhG|h8usR>ht2^pnC(R4*#X5p-3@SjbZ
zlWR_Y|B~PHPn2ty!|%4$E%647iy=IADlf`4A<mVD#+7)$R1Q_viv!|vHTjbOIL_>O
z387CX79PAzS*@srG&gK7TQ++<9)gLiA#}I{n9!^p1@$Dnpbs^S1y%@r{~w|g3#Z>w
zA0BX;kU?#x&0BD&j7HOSMPUnBM9r_d4Nt~U>*nKUw{Cl<4yC5nmeC=rnpiWh-@1LE
zDj8<$oKyYWiPP@74@opHA~5Lj5Zc{94$Q%bQ5X50k}(CSw<lXXRng#yxbbwN&V-i*
zHr_=9o`o?<pY&<G`zIV(s<Q{yJRL=$Ut>CiaT3MZ^@2Iy<c7>wTTUs&7#tcdH4KBk
z;+UT-lN%B~GZ1!&$761F=F8j6y2Z@gxGKFmQra*ZJh55cYw`m%``RA1H2mLUvSO6k
zj2CpL1_xoCuQR+;kVf#G^&#Xa&YJk1NmUmuym_wrTS8k~pLVuSg2STzx;E=4-7Y(G
z5PH%o=c*1byE4@S8v913k$LGHY@_#x>X#L*BLnp1vHaBRp0Cx(?xEaJRqeNT@jZU&
zIPOUck0Z_9VU&c`b(<h$cDTB^B_<>U>T<nYI=xaMB<)I^&li>cn3`jaXD_23XPXnV
zU|P3cIRg2j+;a+X4aCn}QBX_d!ds#|aB>KxDiz(Zb5Zc@ePXZto!WZcg>K5yHIDhb
zSVf6OiA&+9INk^*nAreopwHWvug33@;{`|tARl)FHA2tG2?@d)oFLSE=L<=R6Mu)!
zU!w=e%~%c>`-c@pLw>8JkUvkmneU?HuL)cu2#>jQAN6yUr-2xOr&t&b|4!!?3fE3>
zL98GuME?LzvSw81E=qVqdXerz=-YGdu8@mLo@Xqr$j%q3U%n^n3l$tR%$<{3K2PE5
zOq8Lpkz7{G-CuHy`z;6uWHh+9@v$T2Bg<jAxAufLpdKwLnzs$_=Mp09qb<Rtvn!H_
z9XZ@ySsbfxINX}$Dla4<hpxk{7J?KruWU%&9>FM?p+`vO>i2auGuQ~v>_>_u8eq4r
zPJT0y`NxacBUvE=&Hs4q=DK$jEc@%<Z%g`#f_lCX{IE1*pm642ThH)Hz&VkJMmQ;?
zh`CyqQU6XfszOj5<u}fPV$3EDj;g*^WDo;|tr9l*J~0z(*kFO*I~hEixx~DZ+$Pnh
zLl%nhmtWbG<-_sG{LB!%b5~?tbL<L<O8ewQ4f$bpY)f4(0wyc(|CrZZl17c}1PXj6
zhbhKv-swU2h@hfP{=jV<Z$(j7Oah_;BXt}vVu#5=q3GlIs2`xZ^-9NE5lNkXKroAh
z<e5=$$~i}Y^ZpP+ZYD>Pj+s@!;R-P}#aQgU3^v$RVqaOK`ba0X6g(cq{%e2u{piO_
z@mkjjPmLYQ(2tL!#_^2;A-ok`fcHJ>_t8)SOR@r%Zjf-VGXg)BL<<iV4;)Yhn{q6k
zMe9Z+0N|ZzK5+QW0Q_|~>kcBJfRWk6O)*;!I9Sh{y7&(wD^kk+709mVm7HCz*)k^b
zL}!sc$9DjFGyJXpNB3tMx%|5a(WX*dWA)2Dr~a7Tk{@gE0;84II7SGY(UzU{Xe#ou
zF5w7LUsds>+KXr?05Z9xN}wReOeLAg)iPCpEB5MS>W9<K;k9(uB^tNgH8uvGyBE2l
zX5}|lf`S$#RkqxLm8lryIBUyVf`UrhfFc_U7%u(RyCOq~dM6he+i6^D^$#^~0Qax)
zL1gsn26oer1^ncwYE~=vnD}{J2XeQp@wo-se;te%KiG4p%Ivc-7Br^%ms39Ysymc?
zw?PSja__qlU%s}BFM1Ru8e)|So$e0|2&=zQ9{-fmPmmWhc*x3a8uCdFWmjrX-0W09
zXj)i_x@)ratO12<i$$`(NHm(YIGOHp$d7AbW(s}X{|7ijwO#rt6yjy2mbo<I{X~L}
z%(Or<Qeg1nw<DWQv_IPEjy_CCYb%uaT_bfb;k4jtkm-OQ=I4PlD(SMTZE{%9VITZl
z8tN?deMR(`NmCT%rj9-3J}GFq?$oS?tS=d+&gC0A&|eVaL2b2IF74?c)1lSxy$#OB
zKWY|V6uA$^dI)Hlw}rXj1}T{wK3jcG9E@e~EF#DF(-1z6_hpy;lcpN#`&VQa{BD!-
zQqqYFLyuRFU2BJk>_<4&O2NHWC{og993NL4C(8_U9!2}7r<bi`>$ngJh(jg&LvJ<w
zi=xqf2j&%{?OAAo_d@vT(F0{ti_|64<DEegPq!y8xs2vi?H3S+79$#Lu*-p{dGm;S
zD-5ei{-<rnS~fd-J#hD<&=w8Rq`8F-?O-U;f`xGB5kSAiGbKM4V%Ms@y3KHYb${Kn
zybyuwZ9ltF*i#dcHmqrC!6K5Fe7t)c`6q)^Psw2aX$8WTRG%iUrLiB9lgZt_OCjOT
zrY`MngR!%PnCAzrN40>WL}sHzUPU);203&VJN{>{+{xbYX-H{IgphM;!Xk}Tk>ayb
z+|CI_SA1#d($&EHbm;PFtlBa?S`;6PC?e3H`UW8XqbY+jwYg@7)x4k7TaHs7iYLkF
z3!08UF}I3E{o4;Xd&3+L&(?acOWcCXi{6C+7&>0w>&K!C+E9<sv%-%2h`<U-w5UlQ
z*Ao}{qKnf>VQdduit__9A!fTP48aN#d_h6HDnY4gzGUibR45d}EQ9Tk@^ajZ9J1Ec
z4AUJPN$oi~#TpmWl{u?)?d67pJ?g-2FAfJL?*)@dX!2SW?^`YM;x<jG{Yr~Gs#xJ$
z5_XQ3A-OY8&p+GyW=wuPM3KY;>?e$L`zNe;;|4N{ArQ+n7{o+j0A34L=>r5lq%l_{
z9Jj@3EO$h7c&!?#9|!<MM{YAmn^XPh=&?QhR-47jj0D8WxQ(Jt@aXy_ds#{692k-j
zL%N}g&nt)=y{FrXiAT5SeJ_Ji5>S3KPxxkV=IHD?DD$$>-%E6ucW;Kj$4ONu<xBMF
z4sXi9<6DgGvqn<S!$akG4m`2hGu+VpTe;ql!7~nluk{CRU;mF_I{Q03Q|u<<Vt@iV
zFt^?p5uB>4TBvETw%VCfO$S4}*IvGnt9t6^s?K%$wugD}r)~QLd+eh@MLnvJZLz#r
z*4bN}kdB9WaNQL)ACZ)(%v{)8QZ@j6!>_UxTeGjyIc&-2t{BdJeIJ)Zr!i-i*ZCM@
z>bU%L`?^cPRsc&eIEbizRc&M7ne=q|CoAFeg&!VheX~`P48}X$!z=FjXa9{}hhEp(
zy-WGqiXgBeCU{S#!_3*3qGp1OdCf5pl+1(rrv4{|-9cN}8@V=7ps^e@{zr-gMQ7*_
z9qvk5&i6F8TP&Neu}KVQO}fl~8aiUt{_#3KeHCCaDden;&t__I+Lh|Wdsizi|2DFH
z_j2#i-nx6jk=8kEq@p>ebbU(S%w_<}Y!I{;VdD2^O8cFz%~P}7uLoJddVHv<;_Zab
zzF1pl{9vn}1-0bNm1W}eA_$`|0ORtL%#hA_*-4cXPWlnCO3H|@fAkAJ#-?0w)l51{
zY%OBKZ=tIz1e4DUKE@){^IeDsOi%<2NZ0wawb_Q6_2Kr<TkF>zxjfd=z+o9QOnP1s
z{5bQh)^tgYKrb!%`KFA2HVX|_ht8w(g211-^#1R^_We#h33R`myoWJgqxTF>XU^-@
zBxOy>WfCc1?~Aq#XGy__6Rs|5a>)1X{{#J%5EYi2SAdj-idw^SJ~W4~4x#4yMogr7
zqjN4Chm1~qj8(e3bE5&OYL}>o&}o2bLc}Q95RMY?#_~ru5;EwxR!$Ugx;2=XHl4;n
zsw;c!nER`xCbBbi;N;dXur{D`1(wvl#*LP1Y!$+uU|@{d9?lnMGP~XO4Vt5^qIJ;l
zI>rCcXb$kYY0_hU6qWBdvr)eUAp*F~U9kKPgnA7P`S{1oPh*FRkmbwVhfZL4h#Lev
z>MkMtV(t0bS&bhz=!8UkgK+}|J?@)xU!HuLpR4zGVt$^?|IHB7`sM+Z8KmX3tAecX
zavc8a4&&hw5@>yTem?(o_cQJD#^|a0qxLf@AOIpVGLj48S#QY?tq;`2b?EW>Q*=#e
zAm6<{K?rW?k5{<FQLNDv8Im3ht%!5-iD}H&rQ7q~CpKZ3%%Hji@ruF;Apb7>+ClC1
z+PvNX&A|*O07<FsysQmv#)xo4-v;_e+t}{av0R5wrkLp?MW+rgd)>p1c$<*pFhv#L
z9RZKpTSO&cNSzw8Ey9v>E+sCU;c^n!u@>)^kT<otLH`|I2o?pv`KG#UAtgq!0F8BU
z*&BP`AXxWvI#n?|fu+56@ZYuHPX~M85c($2);h92A)jw`C_RJd=3dLFVJFfj1Fn*<
zVJd>WM6k|tQ-w?jwYaV=A>qI*l|KV8-Wvx!JaM&SPSd2o0`<jiF6BpJ3dzVW(=flE
z2QRXL!qb7C`&Z`y27;;s+dAwhbVNs#5&m<PS=-eJL9(D=X9TJ9^*QP6-iJzubaQJC
zT{;N~`SIwCoAz47HNTV`vg5cB3UI?NuA5j1y|?Hqz7%MhW`R5PXy!y%^bE5iKPnJ;
zpnCA<I+U&ws)Ji)@aV`qZa9e7XFbd-ji9`@c@`sm<n`FW`Wc?;2Duoi1;h8p@yxSr
z$*y>B+EBjKf0)@+V^K%fU|c@>`Jqx2aM%NVyu)}=<Mbo7$H*>e>9lNCx~>ft<AiCH
zpvFfkK8h2b{L42Tg=Eq7xWPsTnRCLfmdACi?qRK-bdma&(WC&>!=vNm+bKrh6+MZy
z5sWiCO$5-l_4%V2C3zVVECk{)@9^4A%n}|&sLTrwWCVsIm!>9Kk6j=bDY=a~^{3sH
z2Tw%MQj^+K!CLY=zgxZSPj-{>XME-N)Il`OD&Y@xl0oZGqWQUEBBBkF;lY`}((;hI
z9~(aCz#Rf`S!dX0)O`%VH8iI^aapC4o=(Jm9%qCcexBD{qpzqDE7VOr;`JWzO84k=
zGwcepLUiM;=0KIWFTSZVc1nI|yx)>|^Zn1peAKhTGB`gg5I7arIG+}dDhzr*dpHEI
zlH^?(F}_Fl%r4*r>x2>z5&9Mp!j;%|{`woN5LMUwnE-`KPq#cnan>mk8C}N3kF---
z6yy+nTzC}zozZycu<Wf<1VK(z1xhxzct*t+1JkKsh|)&h8dSM8&9XLzTJ%|Dgc?I@
zg*UqobUxFJ;Q4xwHkz!CGmx7UFyVk((DkjShDRjEH89hIhGHQxbvQM|=Fdapw{@n?
zI3I;nIG`vsYL%aK5;f(?j5f?bZlZ`lfhCrQLNYimk|w?wJpbQRZ<MmIu&}HC{rTSg
z$*WbPKaCgvVYA+4CQtzNyJl=P{nzW2P^tJ&e-p`*s3PdTxxXt{fPU*Or@EwtUs#D7
z8^FMEt}|YPVs~Z8Ni)GhRW+0_jiCgQ^Y`qxqQx_vol)}7YxlQ_ze!=ot|sb`a}=<X
zXeQT?Af4TYUA*@Sv<gFN;ei~Tkkz&Ixw}|P3_MHI(Q@9Mc(lsnO45$yZWxPNh2&;A
zFIXVU2s3vhaFP4DK$ibc3y<kGmb`S5Zm^BdX+bj}>4g?DQ>5vs73#(CMc1ZmEaGq|
z&|Lm=C3OmF-^^`xURfHb3KOQ~aTB)ro|CZv2`WvSS!4llt;xCWF^qi}Pn=6SO~If3
z!P@!WQ<HgD?z}>6%sD4H@G-a)C$23q#(&o3PSvQKEuqnDEyv69OsKA<9;2X@1!0^U
z1Yok!B=;^+uuxY+lfmh+eHgY`CTxSp1sU{w*wE#aS#bv2C3gx%kI1tb9;V7I^4MVT
z%%}}LOT~Ir^NZUIdm{*bP)P*W{Vw&ctH0k;NT{gvnGBVL9-lj;QLQeqb=A7DZRef!
zT~O9!iZ!svo~w^tc$4JVQ9Hu*zJ={W6INWf(Le$%>$YR&R7y)03pLef`3DOH?-rlW
z_^;y%ZJb37-}LW@Ms@P+KWQX+c;UuAT$WOQfTQJOLHtgvUyXlvet)RUBiW(2*Tk&v
z#}CW1<Kj-mZ01FfTXa>gNC-OkIoJ62BQcG+A!{(Tk}Y2(*0rXYdEGfGFxCm75{vI0
z6Q0weuOad%0|t10%zO1Vk#)Nbl@knAVr^Ea^>8?#np!Nq^<5UDjEnn*PW8gVmwRWc
zQA73G5!pz|c}FGrPUDaswER?CR3s0XUPhU8O1uvE)hz>_MYSJOp3$i@ZCV^-&$Hzw
z`tZ)9^Pv3wv%qgn`(G1ApJ(h!M>?5i+kACb&6TqD&y|g-@P#n;hs5Av#T7A%NoAl{
zoBa?;_bQWX%d`3IBED#L98@#%3r4@KC=4(SbM%W@7!>o3LJqt-St;2%oywPhfrWja
z?^1gh3<R%m8qe{;H`4+=NO+wj{4r>@a28Vr&T_&>zOI3VwuF{|sGR)!_!WY#jCz-l
z@?I;e9ts*@Dt#gjd5xWyka$1CJUT`XW6^N%_HGGDzC>xbrw4}a^7-u9i3P3UEuvgC
zPxW7fv0PQhVg1x1G%|OPvB}7rLTUL$d>5wW>0j>&TTbZMPDU(vAWom*xlTYe-}K-m
z1#<-K?AVf<4v7gYFLkz=uuybq3L>XPghF}JpJHO~nhu~?rxGpt;OlFuiMf4beX^A$
z7qYXBRx_DM??!Q#cEvQK#5@{xl>ro=?>Uj+L7NG{xul4DXmkjU4qoqvJp1-trGB{t
zI(2o3{yG6DBOfv}adBx3ORoQT$<wx|Oe(;+E_-yT5=t<YU_#Yu?kEeF32igKQ|@J_
zp@h1mZhC@<?eqD`bH&C@e#};<=~1BCZU=DRq=M~?_s_p^U!~$MO)SkTzw2!rmSGVI
zdtOt5I=Xl*1-@o_hE}XZdPw&-Ki*y+uaWOC3FJtApk}0m(zcCF#eJ@ITt<j+X6#yN
zgF@$Pu~<1M+|&l<do)0~P-I4nXCn$xZahsbd3*%c-sg4LA*1s?vd)#$9B6TsX*@Z%
zmWm4RFg>k0EZeScr0^`X)(NAhR&N17hR=oIVY%&Jw&xGA7BF$=ucy=6wZ@nC$_Pk_
zJq{24gML+)HN>lCG3shr6w^xh&3k;D`3h-8(hFG66O)kom1@$qr*}>E#SE_jW&drp
z%}VX#MVCqW(g!tp*wOY+i~j6rXcn7Q?(SJ}2N;yC38huO==hS&fdAFBh>a$$N8fpe
z<tw;4&J}+uxngB)_Pr-GcuqZqV@6d`X+e$W>7Og7Yp5F;GfVZJ0LS4g1CKs(N~TZg
zU3pJI#w151xD=A&swj`X2EHLC*TM5MV!8j?b8h~QiZ6^IHaB6b%QuSCme4x%BIGt&
zIeZs|R90}iH<;qqNeYllyThQxT6#&o!{DI}1m6tr&3ZmQLM;xPC7r%^@8#VC=TVer
zyfa57(s{IJuX&SjR`jx8zP)g9Uz>gz9!|*ClXvJ2%Ks)N#KB|o*y|TK;`EB7zcDZV
z5Eq?RdBRDQEP*`64oLO)VAht&JtJ087ND5QhjOB4FeWBcxMc;%l%}hC&QERBy&0Ww
zumi#bYQ(d3|0!}+#m2!MD7!A6<ezZ!5v5BoY58jIf9Joee7o_-%`0pPoC=P*LeU<s
z1W6+OocZSOnepdh;;fCB?L7Hr2->-$q4q`oqZanuvZPZexaerHXrRlpHl4lvJtBf@
zk*2<PCDe5|H|~Hu;p5c7)Xc;<mi6AIdFfnL4SiEaf<%Sd!&=ftdydXrF+8@cC@9Qw
zc)tF+hXg7Jr2<nf0ciqkbi^Q4*(#H{K{U4R{#DsS!bnsg3wvfP_V6g14gLXT?wT*f
zWKf<b#c$iq)^?0ruRSF5stzgAwyqWbAEMqesI9II7cLZvyE_zjDDF_)OK^90cc-|!
z(*gm4ySux)7k794^1R<UbAIlbOp-mb_r2D-ls5JR#}o9b5$<KntD5JN3uRDHYVd1z
zhVj=5^$AhZi@$n~@a!JT{mDkWR)yc{*b^k+GRR2|cAQM1m{7gIcOly1Rd(n*g^cgK
zH{-;~t;H{7N~}Po`(RG=MJ5MMT9&ZVFzmO#%4dx!Z21x^yui(g#4bH(WVALw+F!T?
zw1!6wtud%-%mDCoHE-%N1MAI+@|mh~s30=*iNAkxrOuz{!S}Ap@=1H<i0Y|bTHxz`
zDWZtKM++JGC~E(PuD@?>9cnrB-!z4@cyIWbE~Ad7FJmLt(pZ_M#df9`#<CFiHJPGG
znb`qoqe7{I@md(}6j-PTxdOFpHGWLa$Da0-c0VuA&xzM87_UWQ6TkE1W(D=frDv&m
zkgQy=A}NGAqhFj|nXmD3DYW_}n#_ruZY1`C>eH1&Q%Rt}Q|N22)!erczg)$q35s5O
zpapzeMsF6(elje>0x<T?3RNwMUHGMdAwQSn7g^pt_z54L6<xM(TUc6hzF6n^IQ)Fe
zdt38=wSQLpJQk{PJJ(7~O!RAT9ZilAg1-6yke(eb$eSx8-E*k2&!5Df+1uG*FFsS+
z{z5J4mPy+bU6y=7KvIee;&nXAqK^X6GZ%vNvaj6HFtIFRex@tHh1^H<>FetW`>vSm
zE9=vh(i9apD7?iRt)5s@<l$2i{H}8J#m&__76|bzM<F{C1s{bZGYN^5iY3V8=5T#{
zOW?LSlwMqWsiaBrKXB~zAr0vaBy81qu4hu%5%`Z}ZpRA!EO4;{NM=4BIFK!;D<9k!
zQ0CUyDfC~+yiPWYFRh6V_A60!+T)ZKC@lAgXDL0s35KwRa}Ao*&tlUS$cH4ylsHwv
zA0~i0>Tje|KPO;(_07$jvuJ^bmt^-QS^o9TPPO1KpygR$t8`Bo#^S2Os8I26KR@PZ
z+4Qo;n70r#-C>niOYH!}*1jkukS_?bZ~t0z0}&XZa3UK@C7kx6B(@-#LVHYE_07OZ
zZcU#}OnridD6tY)7+1QkfDfHZ6{OZycwU*>8qTZAgAv=15*1UbWN})8sjVt%BpWLq
zQVqB#A7jyVYOizBKuEuCK`n}HNR#b^uPGZP46aE<x0GFBsc>pHK1*NSqT}SH=tzvz
zc|wcFlJ=MWbV&x$M3A=&v_n{TZJ3yietgHW5k13^$)JlVakbgvcHzL1$^xF5VIdZR
z(b8h*W8AOR3OsK9V@A=3*+7Ypt?$PtwO%yx7lmqp^L$tM4Q2WGjo`0LRQOs?2$Iwz
zhw<UR)^$MeESkBiL#4V;X%t$)>t(3gO_tTooQE98cai2XY62RBW2^etfEf$uV~gks
zv)o`TKl;9sNepnld_A&NjYUe8$b2^avzV4a9Nd>8n=-EjbE(`jvP@@+n7t}*7z2Qv
z1kMtdoykNl)QL)U{2u<px2m0^fgd$7!l`=`i9UeIA@GlnSsc#43G;ttPQqW1dN}oR
z(&Iw+zGu2HOD$i|6A}G(DI#~aP#h%y(d9+k^*~NTzzBB3#k<_o-e?At@k-xNHaQMY
z5kCT(Xcd0W!pm9y;jn5Wlb=OkSd7R4a~L;Ez~O5ZQ{~yH3HPg%lGqW!XKixNQ%c>O
zdC{*N0wKp-MA{-E5K%bHi;J|cT%QM97N~bu|N8V1O=f0h-lF`knOQhFiz*d}ll7b5
z?}eA`X#*>|$Y5VRY^x&xe>mXU1*ezq`bILj!7sr72&j=+Xgv(dY7R~RIMhYj$+n=V
zzYk>SOlSSe-a;um?Pb4C;SE0Om1vGYw!6bR+R@{>j*nNp3$A!m#`K<E245dI6`ET-
zb}mi=a~jyR6~$&2zg%<08klkiAG1X}J}mz<Qo!K)d0=qf9A^YU3N0ewN<^4v9r%7D
zYfN@>t6^gmosmN=cyY0_ZfjDL2K|l7jk~R+p<vyyn%!)WLFhu917YutFd7b#^TE+v
zmxZmXZqWO|22=(U+sK)&4eh{It`%jq%-F4p`w<{)?oCJ}0FE&2AJ{~j`qNRkcPG2`
z^E!$^!-ow+-CciugC9<-niypawEW6IwLFI6Zf+ip#HiW1&%Tz%giSC@azK^7%uLST
zqHb+(t_Dwx?RM6xR~e(>p3>xC`Hs#|p6!_C)xyhbY<4jim=w3dIfbLG?apt~RhPqv
z?Kalzvy*&wyJsht=ar_~U7UAiEMz1whUrbs1EWxxPLRRsJ-`7!0J_BfBFEnp?ElpB
zMIDCcVu$g(*7${;e34jI_(Ht?V9CknSjT2>9n|UQ?9e|wpEZXvI@GPm719virACA?
zhEA<5$B<JWp18Op)(n+HsvkgkKI_++WfvV*M^gDvSuXUF%4Ht6ZM7Q^m6S|=d|pAM
z(fkjY5|V_j)zDamDXSxg^+&_fSqt~m?x{(fZns}8R4=b=m{f}+7W1(v^@5)CuElxC
zRuEeu5P6!3CByL^*8j<nH`YxL(3n=gl#8c~q*;5);bc#K^Q70pRLmxRa=>B^lK|&i
zsLvmIA8oK1j!~J9-MH82?ELD*FrHJ0sJKq3TOIFruj}=jpW`=Q*D(UAoB_3eNJ&yy
zHEU)M=CQZ;7Gp@~#a|v^VlcuR%a6ts=gZir3Zl?Z<TKvf*!4CG{IF_OW)Sny{>Wy|
za(Z+1rwzPf9AW=rugHz(4xO)|{c(5uJqj&qxFy;$;#y1OvCw#LPmlV^WnfYY$6WDh
z^|=MUE2PH+q!~(6RiAH<s>~ep8`Sv8p1rLL@9o(;w{u%WW1&nVG;^}`3nSL-#j5+4
zB6fH~>R`x>jwiT<XHj;zYFZ8o`0?jw7V~GeQRrU$Ss3Yd4<dDAWd_^zeJz(X>j5b3
zI1*2y8FB{-(&Y7?6xTAA98)saRL&J1;~!&@+YM7Ra+m}pBI&|9Kk2zRE7SZO5^ou{
zG%br`vg_{o$Q#%jAXP@vF1KwB<2pLloA#P3TA<B1Wt(6B<nUUGUgx}yXR^v)z&Hu;
zl$;JkXwI4KbY8))utEmxvQPy8WxZhM?CD;1iXpvy;L<^sai1sp?`6!PHC?!{1jI%f
zS%Bi*WqYQ;3g*D-e}18%ul*wNpQj;Jj_;PJocXgL%NP=f6<m+^BoU1$&fgA&);~Pt
z=hH;eYk?J~_fceW^4cn{N$k83a?--qkReD-vYH!!13u6cAk9tsm0mQxwxB|2F+Z$Y
zQP#k^_G1&AWiIBpY-`rmW~or0^P5%KEFHE!eAo1HFj79QB=z-KQVBvx8@`v98_Onm
zU>0FDf8=Wnc?hxIh`PSw!1_2khGS)P%tSQ{$F{payWx~7k7v$X&_E^vEE=EeWBaUd
zrJ^?VINV{%l7&h&#Yt6(`4B%0e`Bcc1FzvD7t`R(J1NjgrW*g;DrmOaS_5x<*L9He
zT>2k(xUpd0G@&yFR_G!o8=G^H-=ieM`xKyTHf(F)Ar4yy)*3Zyht&Es1h4u!vR?J9
z)V0@0(PpT}4G#|bM)L*KR+|{Z85?q>MJ=~Fo1xxK$3<VHF>ZDkm)7jhm60Fhm$|#O
zW6b(h_Hmz(-y_Og@fO5{5%zIT4uR`$TXWzC?nE%=tFF<IE9XAjuyT?81FC9IGLBkz
z&~Vhx$}eYJw5ds6t|x1ST5m1X?|rn#G<PLGhNO%EWiT{l|4vxYal34p?DMw73=iHU
zzgI8NXa$!8WpkJgx723DUQTk+fm1{EV{lWbmXvchBv%_meK`8!sO|ZV5_UoAC~W&{
zwCU+u7R>3Tf@;iq{`U)**fw!R73EpRQ3BVim=fA8%Q*4Ms82qx-^<M}sU){cj{YH?
znfXo0kvkSHaG28^j?8D1bUx?QKN35kkl(Jdc5>tlMGfm={Z;L_lud?I4K@`k9(e>>
z1bDBd8lyRcIziC5@;~oLXUnHyfJo&6Kul#(>q`Uu0`hx<|L6%<Tl2nXv-#N{O>Imo
zv_@%ldQg<BlI~wuE~LK@7SPDPaF(U?i6AdCw*{}~S&ZWsDNP#t>Y#VdoiBTLMyD1+
zVmB`vSnbD*M1!F0{G#A9(aD9)-|m|r%WgK<0L;F!LQ?vEk8PJ4t!$BlKRsH!k%|<`
zP!)>AN3GGgTkA~Ggqlf6)wc`uY?#@c&0enwL3#N1fH?$c+&ORVu5}WW7C$<uKPQ4b
zL`otWFy=T=@aq}>7y=4NrAAg3A?S;-);pF+!5S~0cWmUj?B=)TB(oaOms07IJB!mF
zMLd_3)SdyaWobsc?ZGC{I#wZaXIuknHKTplT`{ceMebc;)h4vsm4~lud&GAWDlOOy
zg(!0Mu3F>K;Oi8)wb(s4cI3pz+QbrXO@1EFysue`wRW*W%3YZwr9?F<@GjU}zTq_i
z=QXlO?9v$xMttWduH~H%dj|z>R!I`zWq!+VrU=qEJuAz)z|;!f*vhJu^S7giMhDm3
z@%dy9pFWhaKB8gpS1tCgDP8X8L*OR$3B}2s8|Qh8<WRNOqqKVK766hr587~6vQIaJ
zBzH`x*)CrK`s~-MD`fgCa~MmgmxWYk?Cs-Z$iY~j24mx!c>v4H+Q1f1NXimEymfNj
z_t#G-SmjG^*F6E_niQNkK>y0j&jrPARS~lg29U}-UmP_qE~DHw^A&9nKM_Mf?#(}{
zs`g1fxS^?W)cMzS*jsql3@y*cTZ*p>tUcf1Q8~X)8V@81Xy9t!u$Z#n{2}gjk^XP!
z5KHzB0=G#|_Na>5&I+XnSGKHb4nDp)?x9o}MBci|EU^6yux{49=#%f;qg4N;$tz}m
zdxaZ9G&hUL{@~>P4w=o5+(`g;T5-887SFAANqW|#S*|IP-f>FY0s$953u{eG_Ib_2
zAdiEQ!&WGg-tZfPIxkYBg&L(nCabXO)Twl2<V+Z1v8q#}u3lYU>C75`CLeimpEH4&
zcxono<;`&L=Z=#EZaH4zkBZc0YG%z-+aZ#!mrOkD5B?aE>F?N7xoga**kWQQ@n5!R
zLR@h;YWcdc(_9t7M<Hr#YX$nm(*m0iJ&4we8?@3NSyH|asYK2KEG!9~BhwukbwSk!
z<>-qo<GsepG!<HfVjM^g0qfy9v%6YSEl%-Oj5z3MYXvc@Kz)H>ce7j1EQ+NF-ndzz
z_u4Mf#_V=PkhT&Gb=vDTp;MX{t)e{j84VGY%_DqZH3<hSy{88T3>$T2$C<g9u27;r
zh@mn%yO0TV2*#~ouFvFgY^|&c=1=ec5@}3mDU6H3BJj%&n80Ejb`@BJa7nruny{pW
z{X?2JL6%x0eH?`A%sCmPY}nLrJOw{NTf3OnsEZ?@0b&hk-Ta@E4c`nsosjjqdY@su
zk##EzRfR2cgDC~+^?oI&3<C&c52XFO1bqp|j&H-I;vZx;cnfoMZy3fA=*hV{<EUyd
zm{86BwPzk#K;+8t2+hV45Cmn=Z3!XuCdz7<?hhaI;jIoYi^1~M^`qqdSK*-vOF#s7
ztNRr2gTq(pJWa4X$!8zs!qDJiBqdB2Q@|tgRE|$!(=M4GzL&!Og>*@M!nn0m@rHDY
zvtn@7@T=0yY}|?N4`?y_8_gq=p7n|dUQ(NM7;Vv~O*aBOCwbR{;SRv+OeUw)&79NC
zZYZrEeoS5hS=l2M0CPhU2-$wbe=zZb%tDvO6d(~1#KNW?t5=#L2xiy{qta^L2BWn9
zTiLs2ixw%@>Mb!o@4G(KKlZ!c(%$-n-o6$q<mBh)|MVu2TMEy>$9rA+e9<>HGP+4(
zd7wn)#Lxf0u8S7%OeIID)u$Kh5MDm*JB3~GF-Gj2r%|TIGsMx{+oyS))8wAeohT@=
zd4Yy>T~i9=heFi`tZeTL&77iecetVzvF-EJnQ%EitFFQ>TD0nE$)a;N*wVU5)TNu6
z^d-hn50?<yD)-zPKaFq6rUWqrvSC&Fm2jqF)!|&xv?L$h%06wn!!#J97Gay((M#{0
zJ?t+}WJY9k!0;(-082%(`+HbPPfN)@F5nKlmJMmnSs!6{PU<vx+rSdD(|E5Dwqo`K
zHthprrbnWw-&rmGj})C$onn~7Ur)`!hrVyev=K&qgzm_j%|k8sf$6xoyG<5hPni1v
z7_932ocv-*jb;Z%F6OhIp5bIwN#bdpl!4vd(}s+np%RVdYtEtNz3>p{$fG~wq*^bZ
z585s>%+5#dEj%qEayCy??9R1+7bFBWR^Nn*rqM9rd{Gjn_{BM^C%sz0#&A>9XHY~N
zDC>@zM*rv69ihJ@M(67RUy(wc$x@5Mx7W3!GMRsqfeYLt&n%7g#^-^zn5j}7ZG+nt
z!0_SI*DGh1!T#P9<0iXW`$mMahb;_P<pdmhkH#^QEb%o^dCIBpPXjReKi1lb+_z#)
zTao%<qh4TqvUFi))%(cSX9$5uxw99(%QdSe?>ovCD@%eumH9g*hB|C&>#s~j8W39}
z)hD<Cuf6q-JW!!%oSohH;>NaJUJ5IV?nn|Tg&BFrWVfVZ7f34CvnFgyWj|><Ffk}s
z34xGWz9s+DiYl0Huj9+IgKSIkYqB!Iq2c#;0}G?cUU`_2k&#6(N~h9aD>NK|6sG84
zsLZk$%I0{LJr*Nb)o;#ZE(ON=ZywB1#{UNOAWFA=)YFDz07=VZ3IbD`D?33V>5Udn
zy3A<Q?#9Kv!;?P-m*)xD5ENrK$0go}XUIo8-LVOR?KA8!<uqiN&o!kPT$|?9t~lB1
zdKB%-Pa$<3G(GR%UHUVy%LOrqxI=P~8wXhTW}#rqj0*B7nRcT6m_h`WYZ2*<^@D=n
zSh-SL@w5J&GzBk5=PCuDx2evcF*qh<oyxU{l!$+kw@q)8*$|ueHnFO|ro#R_>OOB`
zEI>`o9rU@iv}sR%MefZ<w(p<S`9i0DQYxZBTQ**<(Z0Jt6JiS7u|4mP<B}{Ucf(Y5
zG?D&d1|XTMK|?~&7IHfi6b+BVF}s20OnsLaJXmgH-k+Y-U0!{@GVtLwT7Z@2V%oMO
zJC+;Y<4-p-I_WMY=_^5Ro-QKK-I}}{$3{<iBks+;(4jT0B$uD9H^Hi78<rgXF(;uq
zUs42IutC-v|0Sz;L<mO!Q!^O-^8w~HZc*vP&d4J6Fn`wsPQ^rLvri~<eAiSit~+_1
z8M*|$3M>xp4buE3;e@QBOQhL#iNyhl4)3DnOu*e_$692iB1&kgy@a|5^=!oBeV0?M
z(Bgj};1izL9UchALrJKp8X0ul^M2CS>8>U@-lKN0W%ea4U6P$G1Tv<}X&1(XxQ-q^
zArx1CJXja4GJ(tZ!tTbX_j=mGn?`1tTDBI&ifdMfGVs7mtC30Q?-l_!PBov$906)O
zHEYzyr9Qkk&m|#(-b_lchWB>a?-5BzgL&^G3VF3oySdg8$hj~xKaER%EQxR`JgG+y
z)caFM%NfPPN#()pFVY~aChLVUw5Ox#`7wN7Q0&OYWt_UlmP`4(-(Ize0hA}OSu7&2
z>|PcO87_H5b+ff4-D*A~rxv%7_U%JC>*u+`{0&LIJBLQEKftnPM!b~kGM%b1NT-hi
zss0-vh^z?~8@o)~bbg$8w@64zay2NKV8}8snmgag333?K=_NZ0Wj{Z-%}O|*uj5bE
zcH93GPlV=H`4ZP!50QJm5tgKL8#)>r7*RhGJmHN&lU6(L(*M4h%FWn%ZO3b*>%<iY
zcGydt;YHTvcT!Uo<(~1SiUX~bjR@2iD^s0?f;AHd$CvS~>8a)X(?i{deItP+G8gN{
zp$Wp51DWoqsUH6zsk+?%4fb(@k)oz8lhe~vaymMANlD3%%g@)(#eh@gwW*lscft^m
zRN(u*62oHyx`xse*ViJsj8aB7Ya^rZlsPY_O#g|2%mpcZAxrf|gFV#YwIDCsJNpp9
z%(5~IdmMvjC<ZI*5Dv-+5|*!9w(7_DB<wa)#wo>&1a=frL@l2b>xQnwWOUx44Ycv1
z0x|8}xY58hKrOyXeK+=nZO+hHgORAX3}MOctd)O|JAeH8d%Hl(kwD0d=<EWLToWu+
z4d5NJtdZ=*m?^w#d$>X4S??~z*>A~8p&ixSOYDSZdLi>Md1Y>5#gS4%R{#BkhBMaL
zL-~*JFA-N9N1UY}=hn=dm?NIAJg^wJXG~t=)eG)V7tP{vkeXN`HJqW8u@7gRSk!9X
zG+x!g$Dye@;mKh|HjD|>)wK=>3fV8^i;5Wf^pCX83`i?}>YZn`RX=QmLhY<UcIs$I
ze0zfakk+#HcE3A;EPN@w<(RX%qt4Ugxol`V-SvmH-jz?9){}D;q^dR#hXUjj9%Njb
z2W%Q>GJpOO{B7AWnU=oS_AJWub~v{TS(eEsC6Bl>r*>qo+xIBp2UpLm>=^fy&P@S%
zOObQ#4uu94bHV>a$b$=ABJK`cNfn}0gF?peI%(#KTy_}4T0|wYLys$Gni+w@tjhhW
zu>VKx`au{qlu34k2~E;cYP+E-_wBW<U&tA|gzhibB}AP$e$Am-$X#3V%2uzGDq_|K
zLq^j+`i7H$YM4R*3q)`3c-s@tYVG5!?+qZIRw{~$eup=TFj~X&AR<|p`rRw>cbU7g
zQbCbID%*7Y$UEbXdnV)GKb4XHA}u)E6#6*#Sk4&%OCM$uP8a_S%_mc>?F+ZY?ol78
z?fl(fUu`M$d(56MU~%O)tG+wMRxK<re|~N^>loko&c=ee39a&UimfJuZ1W(|I5@64
zbZb~gCWrQ8S5;nDWwoXJl0<C8@Exmu2m)-xsD49F@GsXxNjeHH`2MOmFD6wLf15w^
zMNJpA8Dr%@FIpT@RubBRK8XKBDfO|+^RY|wj>B$IIg6H*oL{AKT?(?c=;7XL_EEDO
z6ndl;#v-_cbRHJu;802_E|eHv9UI6UrGNfL(UrKaE^#iss=#so3%UnaxsC8N?cGYN
zFjImXOrX`Wk#a6{UWbQUy%^-3%>_Bb8Z^LD&|1tde#PLcXqli0DMGvFk2yNTEAZkh
zEing)2~K?Hs?ffHkB56IX{GfR04%n36P~nCz77e+$)*5LN+fzQReT9)l_sOkE>qfb
z64hetT+0#~uS>$|Si<n16MU^O<$y{<o8UWp6L2bb_0iw7c(GGm^av4aQ3n@edqK%)
z-$DcS>LA6jNR9bf!ek0g{*J26;b%cbV(vA-A#%W8HH->!Kms96lZVvM?n!@hq0G6`
zq^QT;3@e_b_yBU}t7LCDqhi1m9OKCfStD4rKc-=T%=q#bpEc=53wZY5{hk<vEnA>h
zD=WXR?l+Gvl@|R_fF1t}jf&Q0wdFz4FR`*zX%ho|U@?AjcwK4Bu#PJMOkP0M?x*@x
z)oIpc9@<;Uqq;|HD^(zg4T`a@N47P(&7ttkI<ro0zl3y(mVE$OhT9q`2L1)tWbv>_
zR(#Pe!=FiX86A9ujR2^H-enPfvWRuy_ayPkykOU?kY3%37{rQ=6vvL$U_*x(73<Bi
zj|nn9N#xIqKP*KMAvKDr)>bJ!EKs#?6(e+m8CdX{xJ*7KJ|#KXqPvI_+PGC>P|%t}
zjxm<MGlhR(l_{PJYqUiz>q}oAyRXBK5V*T=0T3!t3Qv2xZ}#s^yH#GTP^w8n|J0(u
zBqnYA5RO5%t@)I?syzv6)F1e%oe>1|Z`XPbYC3)`iWHkhjTN*Ceo@?x$KR%Udp%q{
z@V>=<w9}@-JcV~lDZ+Ulyf|z}2umEHtsh+ES8ChDxZJ)Fg-B;WS{$aW{%d%r^R=pI
z{$P@LG4<ExrI)u|ab?uY1dQz8f23!u);X<-@Zda#`#6XFhC~~S<6qdOd3b_v|N5X*
zJeek(nHjsB?HIQrv6;t(UL>+Ci@m(+z$0OI@}5|!eO|SH0#Dt}nTx}63OxEiw#oS#
z&a6BsBQVuCH8fyMu%MfB(`|*<K#5Y?5p{OG>?vt&|8I9=+(}c~u!0-oU0#e3-XwEM
z>&MMaLwH03rRRL=!JLYcn7MQCdI8C<&@GJHdQ#T!fSIS{{(qfnp)jj^#Ge5?bvho&
z-|sQa&(3E^i@YjHIrzd}W(ln#>%?2wQ?X`eH0Y;tB*!_NcJ%W3N$1;iPSRc~e@;R*
z*BIsD!@ag2hg(sM5BrnfSBxekxs_hsL2CN`{tKm@<#+~KZ|7rsni)t1@>R~QsaC}Z
zBQ-6tWq(2`!e}G&%N5>Tt9907$~pz|dkka{*r*{(LL0W38FTp~G{_^(hs21c*DGbG
zW@l+T#-H9;>cHPa)2bXs-T*+%qw#LoQtxFY(cHg_L9CUzx7@xTh*K9^+Xt26VC_Fu
z<*)3BQ5w#caie`un3jc)t(D0IxesB*ve$XTyf}CteDc5rZ|I+4Rdx24p)7VMS}XF$
zi6Ee+q*N?>D+qhEcFl6m&=?$`;ftE-r(+y{Uxz;Z0z$pNB>(;qt>V(p>RZjZEGGY@
zA}={$5$AVFny<WP4kqP7Vw#4mpV3AMx<pFaFHt)mA}pTwM7=NOHYRd&P|GicQ1yab
zV(*GF5KCZSw{WoMw3r>DQxJ4LQz;Gbv<9q>#FUfq)vASA4M$r2;rIO|D?}XnQGBP^
zqM*^yEiLZDCl1$<JXo(p#iCLbYdMD@3Dl>Sqxe5qb6(wVIEuF_@Okv==4Q5tvJ@2l
zc(F0}og5n*dv<#I5A@@&%V=8KFQ-RG2H<MWx46%1q56dCt@jIeoo0tXaQ}0H|L5gr
z$2a4Oii+`Uo?C=XxKj-3j+B>7d@rw7Xa^VIGXU(vNicML^B(E!A|a^)uKVGMOGw~b
zR$W#PPXu9^_u>+MZ5U}Bl<ZB#l^^OJjbn?`liuWJvdNB$aAm1U*@2poy&F)KtGnC1
zDC7Pyo8;l(M4k#3r`ew$psRjIZiR1U<(JYIM;y~Zd|vHOqTZo~B^vptghQqB<(yUY
z7U90FK)TZL4G-B<0c@?C0;8baZrzktHx>QGDP+$OGrD%sE%8PuWVIK)v?J^vh^%9U
zk{+Zwv}c$1%woK+kiRFPOT)H}S_u&py={-JG2_B%o4g8yJ~%gf2t`NlEoJNNM*SW$
zLYIO1Bf(4C+@wotgX{>DFQ{IMAE#18u<=>C`oS9-olbqGbu^Bc^_wCMz8%pO@Mc5u
zZBC&1`bTEyfteS5zUCn>g7akxzdw<*gboe0nwQ~mZF1oc)unIfRdzkI!?EP*B#8-6
zsW6hF>AZ8HQB}^zv_2Bsa-xm;9%ACE933fO)hAc~yfKd=`Cj%w=k}eIJp&;Qx<3C)
zne{v<B^?h=XUq4e*O@cZ1?=EnTSmFyodag?s`Z{HzN~~6od9El@h?ueUb}MhqA?#m
zv34r93oJ|4((>Z$6&9GUW28IIQPAo5mNM;;Sv`nBizMG!$rAgA%wg-fdQE2pPqI!I
zs?v4zb_eBJLhS^+$$TGlDp`dPp)l<`71CZ7{lS!_ux%l0j50#@e(UY_jqY*M6VCdJ
zBb)?e0ZRT{y}r#BG5p|gZ`hh*?#T7w`dSxcfxX|9N)itRmiiHy9EzcrFU5bd8{g1K
z$$JPF`9+iMS<1ljE=t%}Vcz2J3bPd8>vyAxd}**EzzdcjNjMd3iEZV?lCA-Pq!FA+
z2nfdBUmtmVo>+Q%dfxt__-}W;H+>HJe@uO9YRAdRE2~&1y|?*4Ue<qp4t+k6JfD<R
zJ)wO56S|uESP|OI`@Hq9d{?by;d+&WeT`vX7FAS6l1Gw9gi8kb!k5ekbuhZ7%&Vj-
zX|ItAu=G}cDGHL)oh@SIq(tTK3++?<fqP_E)L5JSFgY_2Gc=}r84GfsJSiImflB{W
zbSNXcPitsOduz9GZYV*M;FT(x0*i_0rzB<lI7TVAd8XwRojEufToLbMVfIm9>5PoL
zzuxZ;%&V!!#tI{s?b6XmrY&EhBhwVLmZ!I#;J*y0`8z`|a4aC+MMLlYGN7&gRkrwG
zWn)s<7BP4OXyt=$-&>xZZuSyPP2N(*6se9O3+t=JwEz{i*2lYDL#P(AVQu_^aPfEM
zxlf_ItM5V?{M(~p&gcsCR7t~}-YB|pu|S|G+a{z-m$3JxUHI);zlg9M4Sj}dS&`q#
zt$njMH&b48Uh;>?IFN^TAoPp8wW*-$ZyxqV6)RuC*_A&;Bo?X8TFK(U*};LxJWU;d
zv{d*LgdZTf(ZBLhMMV-F62Xoo{H3vsrT{(1PE378b5ACDRZ~POORJ;u@xKzQ>sv3^
zQt5!I01;QeRvKeD%Y24b{IXw{WhL$%5?`HR>s{w(n7{nW$&#s<@6sQg-XvGvCigA-
zPB#l+>XgM#X|V*vIf3%#MWGMlci$oLTz?<Ca3+s+&IAyyCXXzlpWG^!j7!ffIua=D
z$3XA@YJ@qxEt!y=jcroHVOv*W@J*C+R%I1M5@$c8p3_je5;O>_2kAX<sAESE1u}x=
zVbWQ|y@K&R%!7+-v%YW4!jPI>xV`hqyfv&ZnyXrD<rP>Dny6HHZ40diPWrC~U5Ubr
z_Hc$){#j4j{sgF0u7J~kkxs`efQUe{3wU7@9sOk;7IUebw?@&S@PwZRR;CpW>eSHA
z!s+k+r_#K$t2wZ#p`KktPwE28U`AuLM9XOpJ2HW9p>iDiirXjZA=NYY{e!a#kYLze
zbU7WW_J8}R5l&>s=jZ23(u=Oo$InTI;EY~<NOXTD*jFA9?Qh@v^;NWx;3PJ?%1V-v
zk)8x#7PHb^{8-O6s$KgCh8afuoarU`eYA|Qinu?aCGGb1Dv!rg)wXym_Y$NaiG(!a
zoX`NTp^@Z-s89z7uD7?Oj;@YiVpOoe?V}#BlOo|OeNYQ1$ox)v6D9w9tgOKyLOywC
zl3z|W9DYpX6X+<MMC|80&^-awRl3`%_HG94(~q>gPLHvOzqO>ga`%%RAQXUz;pxKn
z0Wm}i$n$p$f7{Z4)C4mkt4Cfq>RgOH?tK_qr;<Wjn+<`c-g;z@-!@1&ziARBc5(7V
za1fL6N7@nTPCw^;=~cn(YYg&wV7xM$h)@9)=;*hCMSqc!K#a~o;D36+fWxIAmU}(5
zvtxl~s53GF`ImO6Q9b^_9z!@qeRr!s9>Fgxo|O$IO%84o08S$LS?th@;mZSXR%Yj|
zph5=!tq>1g(bv|&1)Ap*Wdu$0!@fX--|X1Kha*=Um8{b*(x#%SDpXkq_6L3zd>r=Z
zngaGXQ{=otA*@7Ks>Rsm*r<qW4UzU;AH)ROj&^5~`xeGwAP|YU{d_dj;2XVgdM$?g
z3rn5fWzTL}2Rm&1F(eD+|JCfioG-0@7%jrR)>%P@_!j;*BVPtGslf=J7i<=TF8C5s
zJL&!r(U4BecklXM&T;*tEVSgZ@_hRyld^ovIi}AV+sI_E?|j&76<)Tb+LZ`dLLz;|
ztLAxH`R4YuK^Q&Z(4Flz?DF|v7zkIpl9abBqqvO|z5WV)AHWRO;I~y~ot_@n861-1
z&mYzrHNG&Kea@`ez_|_0)27Fh`ls6P3@wPhI&yLKjBe%y<LrPc-Uz2Lxvh>42RbXp
zv)scaxtLkkMj^=w{A2ax3l+LctQmAAE!oi2r`VP@k;z3d2zAsPo|Tx8Q~}I^<u^-;
z8K<40W9CyBM<y{55qRI`iez4k46&=z-rAAvE;Zz@Vz1m$7c~XsKFXGC5Rm(QQdyZg
zt()HqlhrJ(bpeoM3Q-=YE2YqImXnj_r-b%y*@*kSFZ&v}nLBvZQPsoWRtu5g+j;4}
zjl_8LJv=+ts3;N3uP-+rlJW5P)|U;30XYa^Va+yD%d$5*un0trZHTa)FWfjAAZc`g
z_k@W*{GKkfi{x@5wo0Qg5m-t{v3Pr|<thd?#PmBvs>8_Z%rgG{Ym3c70TP)8n+SSM
z)~*oaPW~9!FlSV^KLn^VJYzaYXUJ<J@e4Y^y7O6^;qlgao!ZVSzt#s3fmwb_#Cokr
z6_ZwQmR_>;c(2@K6lI`n?A41a!Z~C*D|MU^+df}s&JQevFw)7K_8uLAubt0s@N>~b
z%f6uKmk=@RHirGZ8EXcox}HsE1OgnGx(|n5K3Kl4Q4;d5K7L+5LL6CVn;aa+7bB_^
zNH#hPN#&o&V~0@H`zlNmv-)&WlJYj_Q5BG2X-4K^@=vuF-rIAot(!g-4D2eu(h8Bq
z_{HwNKFKSU1bTTJSUukau749+0f<=K1$33k^lffCe~6l>JQlEa@>@ZX;orLj!}<Pg
zIO&!oaA4K2CVW}@QYmN$u6#?XLkPY`;+Ia11Ux~+$A~WTW_LU!rZSk0_(5wU0WJ%b
zU#lH8W#!828I^5{AJLu9(dhX*SQD)0l_viIWqFdz!ha`9My2Db_jP=wzG7`kzU;(u
zPRpTuv;5kCXQWNa@Np*1(3RIW7tRWs#H%{Q;b6TaxLyu6%s3j&)FQMa+vAidCm;a@
zM|_>+1q^}3aoBjX{qt!=-ug*+d{PyARS}csF}pgAc5Qth`()_^xMS{4L}^u6$_f16
zS*Te4H(S2^ColdlQ6L3uiIjl^6GjAc6yPaO+)MSpcl34q{E)P~3?edDrx#qftgMU>
zjbwK9K99Hh8Pm_2+qOfcy0iBQisH!AvzTbI<D)@0&(j<3@P|hz^IZ2!l~-`0U5Oaz
z-{g<^9l?jw8`8VyiRx(}pyyW%vJOiq+MLoTZ;8jE`qo_8E~A{3JjXM>zaJ~-xF*%g
zy<cLvvY%3(XB#op=)g$$c^FdS-)vd)C4d=acTZxK%r)Vb*v$aTY_n~c8QY_xbbooa
zA-hw1P&g|xky~zL4aWnIpnBIUF!H;M^pk*%|EGX<CH63q<jErMIFKXI!wz0qd1l|}
zbo*?Sr@6vYtnAKR(U$qKi3yuqSJ8<Ku}P*WMb**Z!>ExYu7IC4mFL@qj{icTxTMYK
zxLL+ICSj@$Q09-d)aq7_emA^1wHk@SV(+zNo&XpK;+qH2=3+t8KD!cT9EQBV?IvT=
zzb@Fg*7tH=!8*mTF`V1TP8t0LLX;^2Ey?W!fQ)B%?gr;P&ql)yw>?4QB+@TUR_RwA
z1T1Vi!p(Pi_@Gm)Zicuivo%6>pHzL)3wc&NCCb9C$%A<(e};FI;WWAKA57m+0y9-5
z0S(TqG>6=`50v~qji_jpjhKbLki9A^K*N9Kh?@!~k)=&%^habn(^Q?cu;1BhC8Mfw
z{hjzY{a$I3Z&X|cORHhhwU~BH*TWl;HC0V0av>!V{G#(k1s`$TYyB(PdfGNSgR2p&
z53VZenHk)Kqtcgk*M}<ZqiXVe!)>rY%!0ZI@@;RwLa}@GL^Qx&TD`3`r){SMwWY>#
z^q+FN+&&c&bxO}CjCMtnXZ+amGGchN%(4+(ubBSU1gV#b#T;!BM8rkS3>`8etEjeC
zGNxWI&-P{99Y0{ZkeEvnYEK)Kn0atota54^xS{m(Rm5MC9vY*lB*d~|4XYmP61@j8
zqvhs%7r#GS+pwh29z=PduZkxL8yEwi3HXT|^*yqTAm|zvHMAwDanzuG%vo~b&0g+L
z<r*6sj7=sz<Hx&6WtJ`-L#@G~+WV9RZivAuE1@6|hmN`rrF2lEOZlkD%+{gj+w+??
z{^cNeG@niv=<b+k)2L$&Iw1_~NH!eZ!meIiL9B}RUVYJRnBjpU81Hu;VT>#!&H=d1
z6u|N$#Vos4{)}=c!2mDs|L+w%pF%P8)#?rp4=&Seyv9HG?=_kL_sjz8RtAE7n|5&*
zd&f={UjIThetah@7i}$yY>K-?&C)FGSi3J4N#_pCNf8rj5qHVtkA9&z#}Q5UA}No!
zE928_-$QL6+R1i#XAc3@zTWDio|%TVWZ+?E%CR)m8V^(|?_tuLi_Ct&qe_^6WwdNc
zw<i*|DCIW*@1Kc##dx=^b-*h`KG?Sq)ii|%mt?KR1dwKU+}@LIV|@?|j}(jaQdH@*
z_g|eCgT^d~;_$X_=4;h(ekXNrd}8af=Nh4Hz${++m98dl=*0-sl%L0ZoSWlkZ`8O|
zLTden@7-KOCq;Tj1HAFX>}}<4TYfGW$mAlF-CNQrf8HD%Xok@fX2h<N=xn9bKOWOw
z_T3#RXh!~4iqG9SPC~Biood6~b03A`>9Q+$TV90jLtzM}sEsBr)}!nez!Is}U^e=L
z?am8UTjRVTvU2&+<8fy5jyPK6G7@WY{na}$i1f)!!xwysk{JJ}t?>xd)DeKTHu5Iz
zT<<^=C}BKP#I7<UW;aM#B^f2b;hDyb>Y({sIe3L?TW@&}-HqDF_}7tB4tC>sVr8A>
zXw*|?f2)}xW0}rQkPPqm#|LXYmh_QjJ2i>{DUk<O0?9`)DAMdr_VhtDw?&BB(*@WM
zyX#LF++It;Ct3~1lzr!FjBF3#g-_JBWFR7Y?nNs%<8ctkk5YK%=cQDdlznEYxKXDL
zpoI$ox%Q3fbsAN6ARV|lue7|<sZVw8UG$v$uuWuTO=TV>K6D7Q!&z_XniR$<NHU~`
zB}EMQ<aQp<_D-scclPY^dB<)rs9(-mUDes6hvaA<$N7eLS8%_89X3e;5*HK7KIW`x
z)K#y?QgY^v!WzT>#@$iXFo=R5xkIFNPm`QAjCT4v5yZ84;ELVYCcK!Mh?5ftROJV=
z=zeUfC1I#4{_VE0eSk&E=qMD7-s>)HXx7p)HZcfl5dBhl5IVm0a`P3|I`zjE@kSKz
z9y>9K(mu6&O!7<7ogc;cz#-~0q_!?yb5gxDgo=2-HGgrN!;Tq|>E9cFXJ=%cvW1_`
zWuUMafZ0yV+_D_pw)owbgjX)(i~8)P1S2kAm*g^5<<7L*!<_@y(4RGV+{lJiUJcVX
z%qSN|gVE6Z9x5USV^*`hWnv2^ouz3H?#gMaeSJjQP-l!+i0hLP9quiD7aVKt3@mW`
zq9Wht#m&*!=Th&zl^YrcPYT!bsT0OiVLmIJ_q|}1|8p*+`@N#WDx-b%hR<cAcECyy
zzcC;<Udp(L;#d|n*M;U-Kmrp57Co$9S|!6%6l|0kK|4<8IgNRc^)pA|5e(UO!!HQ-
zxT*eh^WMtRRL7doclVDo)C$ga67U(8n(XzkA&Alh{bp6%HP6q#@9x4GkvjYJ><LnS
zXCz07vcp?~O^(lNb5fcT-x`o&TvTupa<WSnJf&tq!=dEwx_6w(33;F(jqt7{vZ1KG
z=H+vo!!{bWgu8i6x>74#;$NJ6xMwBBd*?i7j6}=M=g>fo2K+xDVSL{mo5P~Pq=ala
z+nlpBU-Dg4DzJWGLrxh~&&QhDUe52e;0KXdJABKnxl(sKiy=c_#xDGG_A!brHw#@-
z0uYo9v$8e!!o(8x&4I{ueqV+NW2XdEMS4B1#oyitSRk7$;1*{Tx7-5)=Qb)4dRLDo
z+Jlp_sN?GT|0;F$qm&uY3f!5l4-Ram5Y*fR;2{VJeV^3ww*0mdVK1HbQu2p*HGjew
zjCgn>vZnx2(dE6?2_oV94RIu85K?Crq>OhcvpX9P{et-8`%{BhR6ijg!guzX3J1gi
znR!!x3Q6n;!m4J(Q~6{7BN6`cUgOrI@X%jW^dPGKr2^=H?KeUEt7Egn5uVbG^A!bu
zf8MA?RF#KS#{m)AsjR@!!>5;My@Lyy^s%;%2;!O*^=hXIxBFfwhI*%$7GTASQKh21
zK}`&V+6SK}ajN)D88<S+U2m`JSGbm7#K!0=t1bL;Tb%17Q(AdIQ?_<k2FFIWE%jDB
zcE;dDpO6usHU8$QogcUYAZ`?A7krEk(@tYOFVlpwZ<lj1;k38c>z!DRY#1_5ctv8o
z0X|gMgOlFcD8$S$Zja!|?6BW<h29c?)Jb?AFot&PG5EpNnF>thi2bv^IQAH2&=$P?
z8Q^|{q{b4CAsM~(zLoK8alQ+*PfqQuizD`h@c6GaDilLL?C97=LMg}CAB223;y0%*
zllB_npap*7p;7tH{G24RO<dW}PS^=5R{n^&QyeyMogB>9tqqf?qz@j{#a#V9P9gei
zQKp2{X<^apVa4cBS^`nATtOPH(*>Qb92p}q<b+3(n&C-&S$b`=@p_Z<T*>|r+1E;)
zfwAR8V4J=&^_O|trJW2@i1by4y^|c3M12Yehhv*gR!w0KxwLQctz<T0cH5$2Im=Na
zi0-kv(%)$rvS1{UjjXRYKFv#+oAlYOQL&wU=#?uD9Z&THRXxd*W%9D#w}(6Ht}#s>
zl!$=f9HauSQ9(FEoTYC!ub1*r-S$@xp2$-Qx!sG)nevizmY4ySWA^*~I*Mjmj5~wp
zi1`;CMvuK;iu{cG{*4V7qf#wZf@l%AHmNyUf4@X)J-n=qJ!em~jKTE_jBW1>rljM0
zI^IhoRAe9#A|V@X?#zXN+mv^C);HQPVCdbkp~w3M4`Dr5U4$U$A+n0fkz<+f3^!BL
z=JyekaP-99qVVbF!l+|HV}5EpUEDA8Rvdh6*yNL#-8>j_Cb;h|cXgA94ylH8o#2p?
zP}y9%Id0pmv@!>!Q){koxTBVVs2E;ZL-8T%LX*87Cf&@6&H<IW6Ql=*;5@0|y>@S>
zXOX%_!4;S}G~lG`4AADrwY%E~4QG-X!&xYX%{q;3jy-??Wz{mW%BUcYoU`-Qlj+{u
znJtqf`0e?E<Wq>@K>yD#6ho4)X-se?$7FI{?+hWdxadQT>|8Mnfzf-^Lo5wf+v|0>
zwRQc56Lf{z+eZaHc@@%RC#p}L-)Q_=VVtv8_@x>CR5m6?Pdkt2)kUU_Mvy#5xc0Kc
zvKiejSXi;;q8}Me6(OLxaF~wz4v4-5!>Dk~&&>bopEEvnbkO?=Xb6z^hlV+9tv)ls
z4Yq=kKl$|}my72{KWwiyXW<9gi&@=JSUYR;O*vYZ=ba|<B=fso?n?NI9Lz=0a9^n3
zs9sLbO`QI2(>;SH<^KHsQ1#3jA;D)w{~<O&IlK4%+&KgEbB8)jI%{=r#R0>d04G);
zvY<xZpoBKZ_Jg>5**WIs#OXTb29B=-8fLAfeIhNaUf5jz%#_d!xAxx?(I{P{w6_b?
zn5FWH!!ZX^#-l@><IZ%4l%r7=yEorgevQssbm0Dub;R!L&AJ+)Eu=?^GSm6RAMQIA
z>^Vjr2gc;gNS%DUivi0Q%rhT1r8ypWLtPHQXX4KnL1;rwcSk3uy{q$IwaP}ra_E%p
zd+VW|PmJr*jvd^g0u%KVdKjOh@qcX1X&Hw9^6%rV9cmaJb%sJhsN9!r1F`Jn>T>#$
zxUOf-K_R(1aU&=aXWppf8|yD*;5-P4%-iPnMU=~U0h9eb*laV|Ji<Zw?aQ}Y3JI@)
zIGL`PuoOIN#dWl+$$UZP(5O@X^plpz9lDl-Rlv%jVNcVX4Y$WNu_~nXOd6N*Qv<{h
z$-pS34t>CX_VE8rQbcgz<0W3NAHD11a4=tSYGS*>D)m{~Y3@U<LL`80M6n83=_B^F
z{(4u}^;ed<q@N6ut7$O4*!}#SQl^r)hy;e!UQ5j%r874RH@>o0S{%NV-yJu;xQtDl
zO$vO1orCJ;_oS*T4ao<O7M3rWp?&~S#`pEDW?br~;N<Z4+B-UU=hdV5R+ps+c_cL~
zi`ZXDx{`KIl)qPOA!~Lt4!HpFl^@K)0J?Lz$|N_$m~U4l09Q0ghJw&`%)pEr5vw`^
zni1^gcw;S6WGq&tmp_8V5$$5f1&D#h4T`Z%$q&D>brfx{|ET#Xn_<h^BCWXaq&4<p
zJ7JX4P7%Zt6yReii*QJM4PwWtAE}XXO0ojc;TBaCX0<=@TET}=Y>@5)h7!w(wN!|)
z(hHjNW(%!koL}mvtkCuw6a6C5%Z8;BUXoE}bU7$oXDg5=VzUqPA!?LG)ynDG;93-i
zTX3cmcd<aOCIeEh^RVe>_VmOg_xOw5#T_MaK~Gk-`9OKiuU52(BV{)JKb^{T>&TY;
z^-!Q^QcPqv^XKg{5nyOzD-u5+V`J0d>Q$*0lF(Ger6sz2QmqwUc<2F>#xhNJ9e0W*
zNTyD5Q6)6KTA9CO0|}L9FtTp?J>^TN`Tj-?X6rc(C@9$QA+3fly@p3vxs)?Cq>L|N
z&2H&xb@oa<D-=Fh4-r61oUpYH`)Skq&iriXPQquk9zP+!l&7?`-^)}yDbSpytp=c>
zEPS5Mtqzz`9#@t2+o4Q6&mNqqDKP4dzI+AUkSY~8lNai62kTE;*3K5{t<1vAxSB{d
z0&XD!VrZ2af2_-Sg(MRwag?T|6m}+BlWU%&+zQf2<_ITgrMEoU5?LBznMk-<OfSU?
z-hlTlGT@D&<m4C~ptp25j%2!sXt5}kxGLP5lDu5666Luw7W&_>%ftn0*CZ@GX&DQo
zXI9_LoNMUJ(?TMkl6+x%2`NW=ZsL<+>CUROFPR(qfP@jrN+L5??W69W*iw%g95s18
zxvq~K7RvuPrsJlmplZDqF7=dOs+uDIvToD0y`0H^B%Pf6D5WnwKFvx#{4eDr^jp8?
z#QyN;iiTD?tM!2#L;ta$AARyFCzgWVWB3M52xZ+kI73f9@AtoP%_sZLpN|gA31Qe^
zm^1@Ycaocr@821PliR?AHD_4vD3Ym3h)7Fwn&*oHJuo$4kQ=-C*;z=HIG-G_Y4Rlt
z(Gb#KmO+OHi;l~T!Z+{kP>LL75qjsJe>mqJ-{%Ph=a$!Xkp^K-0@HUz<^%0GMwK#7
zkZZTs{-rS6W0TiT%`yLmFJzXfp~tef17(rQX>oHBJ!|$4B0kB5Z$nBvZQBR`1}e27
zzkb~(yki;go#WwcgCh1GEFz075ibMk?f>)OYj*sI;b$mRizrr)>aZkPP3m-Xe>51n
zZ!)S1=@XoUbYaE?7#=UU^aoO*D^w0{INMO1nHQ6nCa^#oGG+S`%eqQqr#w5oW17X^
z>~ViMAu~yuu*|A;e+;;B+jlbg&hWQN)n-D1g?iOigN@#-DqYKQIXQe)&I5R}Mfj0P
z^V+gEpoQkus-pG+ap8*_Z`f1&qMd!T=+4~8l#Y)22?+BcrIyy_5$7B933;Swmt-_%
zhhtmQh$!$z*p7)ieQFOy!cWW$D{3xbl*ybga6$XdRVL${V|F2--1UdS`@pZ~|GTY}
z0oxJ&OK>84zL-r!7mrV)e{fUa=H>RM(AHLe*p%6w7!eH#(E-Z6!;)9u2Qq?dcJ4$}
z`W<5=#ou_~JYr4@hQnnr$VnCA;qAAwmB(|%Z+YCB(iNWHw8bQ|X|QN(C@E7+{Wh1E
zxpyq6eL1BY7m>>a@tN=A>jx4Q3)$#)n!)+GU^UZHCI*`(&kziOwIpF-_DF3*t@-nZ
zROVhM4{_lxIIkZ-cI2;sQ9$k|WBlhnDH9V-shCRg=R74+x1W|P9fhxg(BGj-=W{Q(
zj7L4Ew`pw%4G02Tubp%kh-IkbB{+=#KRXzFt4+1OGcIC**||Hgsf=4PI>%KUL`paz
z_rq*e0YN^F{0po4rTM|G**ZqQ_g8Q45Rd%qZFZ!Vi^`n-MsB=jeXYJ(k?SugNGDix
z<YkDub{)v9%dKM|4Ijc=h-RK%Pw>O>C-F~x@vgf#)28*d@nz9{F`!`hjas1jWZNw4
ztk`AN)wahdyK%PSMy+}BLs&CJc-eikT?v6YYUAL}+XG+2Vb3zMkOcL9HuW|6i!;5O
zUW}QCNx;9_U+Xp-&FI=izIM@F0l#Y~VJ?SQNqzq;g3tU&#;V<fc7xb51iaGC?U}S{
zx8cm?#0_i8lN&j*8r2Wz6<AeQjm~JW^d=gs>xm9<*2c~c>#;>$U9z+8Gh`2o<JX5W
zCb4&x^!5r2z00o9E2gea?OA_cT#%u740daRtvJxB!0tPPDt&pwH_Q;waX2x*R2e1#
z5#l{uDjkQp1L<^v=UUaw($>#|6nTw|DJu33sn{mAd2PwbJ^>8{_XBAwH1Y-|2B&JH
zk&iVOH+F=orfF^T0c?HQ_9h)eVH-|)Lby}wqGHly=)pNnpKa`%3Zz+*2}HG_T7SbY
z-prx0neZ33nK8dl&9n+pLSeM<tVR!3dAU9uTeGX8^W9M!U51dn?ol~KTEPfXYqxbi
zR3jBQ_QK0I0jl<69rfY=BkV1M;^@L|?O?&(-61#xcXtc!?(P<x;2zvbaCdhnI6((@
zNN^n-zRq*rQ|J3}st$jqika!@>Dj$|_kFK*E#M)*4$hZ0cOK27%v+sr2dFdsIHAOj
zmpkGZa`{Jr!RUKh3uFB)0njgK{()i0|F?uh9JDnKPRGcg1g|@`oCk`O24UG6)CF_7
z8XB5C>a(1l*}H&^#s>c|euSo9;Mec4w+ZIeZ3Iyod+e&rSsSAS=e``#YU6b!Pd2C)
zIFSrZ3`4+5qk880%6Q0^el#w;@QXt3fEUF2h4e1S;V!%3-i^pr6NR>vGo(tX=V{>g
zYYK{?zR|^a<7Z{cVoV`V8PH+*NwdQ>;lGrux<a*xVP#ZgxEtT?77HT;$*E*$FBlLp
z{*iN)gCJB~RAPKX{6UViisvPz=ciEk+C)^hN8*ZO{2Vv4J#Rp61AqZu{t1!rHNUEr
zA~mKn-OS1CTdNTqD&_oNElLM}#UeqTko<1s3Gh~_m&od@uGGt!_(MAbz@iay&BWk@
zsnzPMkUySV6O%S!EajS64tQDj-+^%Pim$VIr90-=AU=r{s1I&;YyG0m@)u@ED5$PR
z^C`x#f&Levm9%dT5wQeVS7(CzoRS#;zg<^Ax|DgXbWEtV1zI!ZDRF_?XAWMvomX`i
ztTnnpc4*t>WVE{oCqrzl&FHMF0ild8lZ#@@$Nu$cldx5{`U5Ai0*?YuB$+%M=7Pe~
zk-dfB!K;SmXPGg&FTGWWR&si4^0G+*c_+r-s=pytwi46q?)WTC!5^w9e55>E(bule
zc(vLma$op7r#U5J0XZu6!t*9#++8j80T@f9a<~95t8eMw(5Pie`X{{*5+5%7*PEV$
zF-WHVhak!a{wa|R48Q*kQ2E;`EDXpwnufDZ+PZ!dVzMJvRWS-DwMXFxGbn#qyFn~q
zkn8-*bTp~zg;YYg-D1o#JXIl#1@b_5b3n8-HPUKNvn&BU)RJ+rM_aH@t$0#ve$`mi
zf?0l0`!^jH_Hzp*_AUFC(?#a1PLv5nNAuLw8xtiLqpAptKK+RVi06}Mwb%oEC+dIx
zGM*dxDcWEMibcK{842DEhLUb5T()#B$Zm8j1O!(ri)EA*RwV4x&Ugc~Lo4K7;!q7S
zD<u^2w|=5ttzt<zb-N%9ni7{+TdV_m>#(AEc>NBlA9u^BCaR92v`#aE<Q!d^<4G5i
z{bYX=2HSlY^1~r%`qOXCRD=`m9sAAxA_EmCP025}xA=%%M{cxL;)w9?@?=$PUXi!b
zwQZhE5vxR-P#~62);ne$9cv_hPk|D$pV7(LENE{fCxeoi!atuF%i^aj<C57A50|tv
zbfXyAI9)7Ve(@Ui+9$hHb^wLrf2S@TVB>Sc7LG9~j}W$UT(pDW0jM?~ICcIppZ-S>
zP<>VlIlxhF6C>P;eB(p@m$p*+`Pq>$$$yS?kNo(z)Ixx*+JW4Ac~tUXk~9=6uv#KN
z#r#i&@WBW;rq3aDn;&I5JdrM_tv=z7zAo!j`EZCx>Bzyuv=ggaX(SQpi1=K65JcYf
zK3w`vlBp=C0B_Nt%p_1nR{XOp1hMjH?@vc&`tJh{b)+w;hDw^If=pRcDxC-A!{)`@
zg^*6}n)ivMT0m5QqK+=xm?=AdPf$*kCP7TrSghtjimCxu5lq*thE{G;z@Lh9YT@$4
zqB2N&d0(FfU-Ib*mM`odO^yxf!PiQzX4kTQ*^0XQoX8q`h+_9@SXWubw1{bE{!)fg
zm`sow^aK|2DugR+?NmKu<dpSkCDA78+i?Vo%2yuOK1h@1Mh2dQ&5}?TL6wD75$g}G
z2x@k}lCEtLSAThDD_i<;!i;&SBUqPpHD@mBYZC??oH9vtF&9b&Nq3hns&L83iowIP
zX!I_q8c{qSbTK^G(xI=ZNb3Gb+-)<(*i2EO4!S{4RD`Zp#a1uOA87lGG0-3zUG+ni
ztXT1k1zTF6JD!S;;oO34IJ3JcYK9BNm_E?W1h?G@Arf&a?PguBvEeZjD1KQw{sIWY
z8YJ~B4KlG+rAk2+lJT5J9?91aY(gKo?0K)Va*AjWj7l4p=CfApYLYPwlogd&cxz+E
zl>Zj7R)n_InYx;u{EBia6<z&7fp;j}78lbFrIptlS*RyA+34qr3F8fYjb+Vwh?00;
z5xUSiwGcO`qeQw=do7#bupCtVi6R$S$kUspm+Gi1jUGnT2hv?<!#w;5^Nu58pL=Qn
z!I={wgYHrlk$u?;9GNRtKx&nYW+>?sZi`!_FA(9ht@3$((KooDiN56l#%<rW-Ls3M
zBP0XYBBcZXx&WX@N$PF>i5NF8y#>^McQ|{`DBI1EU57v8-x;u1cW0abQtDz2UuS$Z
zC9%M~D~nujGb~RhBK*dLty9lc91)8PBO#RXHJnqm7%acZC#&`FK)qRVNYth(zK0jO
zSR$KOq?DA8a|sS$9@|k=FAvMx>Q8?$noE^j#C#=-XuTggpU{N({1|WD$0@UPLxDl5
zOBZEN1rA7Cs7`@|$Rco1u>?eGs*pPWJb;0MXka}#Q4kNHUkm*kk<2MXe3cB8tpWe5
z46R?B9i$&{GF^NafQHUOB$SE6fQy{iJDf(d<gGq9I1yM$m-lp~tWG)yn#Uy+u%6Ce
z>!AX34oAk;=yrpaRrAnhFub_ANd0B=q7gE5f5n|mxLj^Zn4Xj6V#lq6>fo&IiHC}~
zW(}8ztMd)2+9Ng68Z(aT5@CNnrXc*v(LEm^?d7(3eH%3|(!g-rV_Z@zMRVnf%Nxmu
zVxucHiEO(8VBD@dAmnmiU3^s3i$2ri`?lJS0#WTi1K1-RU(<v3xaE566!WD^@Hl)`
zNtWA_4zfS;x7|;}jiBM^)CeOr%~>UB7f#`iJjVR*a98jeb8m8ndFx{em|8X6XGOh5
zIf`#FZ5T@;Ufm)JhVX=fiY~f$ku-}-SwbY-GF$c^KIBu$N{Fi48x6lO{WKTs2wFiE
z-fq06h`LJMEgRmw_|w0cZ83KrnY=Z07bmLyd_logL((pt=y?Y1iPEp{lPIkt1=WuJ
zz3S4%Y_p_P*Zb*k(od65!K~xX^<0nz?Sn&6jrM362rr1vyAmldwla*#m!(K0Lsjv5
zuaq&nJ5*fyqHc069otuY3_X%Lie-O1o>QBrmXfbL{k#IO3F(fhQ?e)-$YUll?+$c4
z`U!4Cz}9BL;1ml1tpSMemM*y#AHE$l=g^E+4Xh!p%hSZ$11x37aJe@Oh@W+=FUY4L
zANt_kTTfn6Ui;e?YU4pc*JQnN+`g?-u9ypjkTzGA^nwS18VAE@i$31*8yE$c0R)nb
z;osYYlex>zCjlfYwT(Ot?p*ArTA29UGFm2>&s_o;-G5Ll!c?uA9kr#fvkesCSFfZ9
zQyFk0w?3~yY%Oxb<mf>!d~I*Ephgi|gY!3(6}1<vUv}JeI2s4<@y@ln*3=mGd3NxZ
zIvsu|)sWmTKAFt!j-98yVB6x2)H5+?+J~dE5h=yt4+w2N`#ewx3ynu0<7*)8vsy~V
z_<f}@2lVxl>5An#(kDrNy-<C+S}!j7-gC3-Zz&z&_+a5BS60~Qi<(5ZR?-tyUR<L=
zh7AxD^Zm66j>^ygdkFPoPfmM|<Y6TO$?4j+6%O&GbLB#2+-Mq6Z8KfkbS)s^<3w7F
zR4eJZC2jf0X~*nv<UHAjpiQG&)-t{x#!YL3nyxD=_L4%0C40twFjWG9ild~(ji=AB
zXD_X4?JDG<PA-pBh-NForb-}1-ao5J1=Xa3`n5EI^|d4ds0dUWL7NCd6467tF*8-4
znLWP&p&st9)w`JHK*EaH+(~FX+vStU84_HIdovug4LZ6oHAHo<7#!hwRdHuYD2dHp
zUC{;ZXxAt9%%yOG@HG#JjHIBYd?b@aB<^(8WNdNG0X>JahSMQ#bJ{L)7V0SQlk3<`
zdW(`a-C&$#Q~JTI(R(qPCL?Q#qR+1U=fc4u;b`pl-b8YjmahzRbaAMZ;$U2>l37|C
zSdW3_HX2AR2=O}@ckE%c6awj5BGQV9LTc{l(=sb_sW3IY4DwlOoA*t!s^+59u6@_&
zIfk}gFV04NE)1r4`v6xMNgan?NFZSr^RWJ$3mFmyaNw`$K|R=3kbAbEfD$H@!gO<I
zR`|niTN3=5v~Q;J!&sY@GMG+KM(2f0a#>M5^!s+@m*LeQocRzDbPg;gz=UCtYK5=M
zYpj!n#H#7_-|O<i(T_1qbx8kwtIp+joHpcHTe});-D-SsAOCcEfZHf_YTus2aHm-q
zONk}jYgt^HjpL|s;8NeRpG|jo+L2Nkg8UorJz7!}c8rO1e{A#YR49L7YJ-s1y)&dC
z{T?1}UAgB$@X<@j)b4C}4<r=KUhbyJ2N8cx5b7~u#YufNylDY~B`qydKh91cgtT*W
zF|Xdd>;4+0-MxK6*cSF{!DO}Z2EIOfxFWgSHux14SUru9DG<V7!nJqVz@(Lw;1S@N
z*dI<!3obvnj0uzkI7Oam^Xlrf09BnQms3qPk6Q71E^e#&M=`!}>0tRd0UL)*IAZ|x
zQPju!{wSa3(_!uZ_xMj(^6dctN3qDiEhccOl$WCh{mR^HooJqM;Eg+lcQ)P0`;-Oa
zp7nWL=fYm$GC@UGeK@`V;@r_7d>9&TBG4HTl|eX9;%;7-RV?|`31@rr*mmS)gRKd>
z`4u{}yQE&^iLEjWO0;Hj1Lr4%xy~QVsuG3ap~-+Irz+@4NpMRIbS;l^iHL-mD}Dsd
z)aZI&iVnM#i7j`;2CP_ns}uJUJI=M-hcAl43niZb7#|z{q??QB#0o}xzw8=q(6U5#
z1S_s5u`<=32MpcLL6M~T<<lG!<mpk}g*^n5PcG5T{qV*GMOad)p`s{Oq^(kgd0Z<)
zFn`jg0Ow>I8X?F#CJuQ5&d-`Gmub$XESl5gU2$nGLc|eux(@zzlX_k*nNP$chjZY1
z&oy1XZR?YP(?q*{>T#d%4FyU@rY+qaLK`mi_d`nykr%yQdryU)S@WyB+jbFJzx>Bl
z)j_`HM(*$v8xB_nq_Pft3$gwG^i=;bOrOqT$Q0sHJ(ko`jAVREKa8gL_};OrLhy!1
zMEowmML}gNz){W1k%HMuG!qvej76&aKtf9L&RY%_S@;{B_7E4O8aRAj2Vfd4tUd5j
zxRgG!Ju=#aYfz2spohyFZJQnqR}Uf7GjTO>l?7ml5Ne{MY7k=O_`{jd?-tO@6O)pt
zk8X*Begw&?S?~(x7CILnsHjn4gQ5(u(Otaj<cYG_J|y!YYe{a~|D7xbxrR%3(EJN}
zvW^qY&@6rP^a07?n>tzl`1U;yo~&ff=9wzLi1^saOhQsj{kgbDTvyxQg^?CeaHjd`
zc36&;Qjp1Ir%a*#kf+)%Ijw+;q9=NdT;)bFynf#?EYAn2-Qg41Ql72b66G$bQF3Vn
z#X|%qf4q9^$c8DQ2}*BZU!Sj%6j2Wn5P%<O+S^b>iVEkq#mD(Wpkm><Y}e04BMzzq
z714xk1Zy%1y5~l(V~u~t{4}Ff!gGj1es1YqB`BU=q}GDP7!Q|XV-W)-Ks8%Trsz*H
z2aY;Byr1P<U>sd7He^cGbxt53V_&ZjITME?w5>?&kjY&wM&cD(2V5^h)6SjyPRz+1
zroELZR{Sq@+TMvm_1p#Vl>%{?JCzd0bkBOwvos>0M9>M7-?ZzVP8I*xu;>@}tCbtL
zEnz^S;&d*6SWK~peD67Jw#2AqSTY9HyQ4;FTKIuWo7OXif~U)cjT{jwlV3P7^-WYi
z5JO4JhaikadHX6ChV~*{-XP{}n#?`~@cr)VS;6W1L^b@E1=CB*w6xChCF$!89DAVi
zp{q9MMx6L9cMRs`6MS$00}Rdn#0Hlb=v<@ik*K80C8Ix$eBi!jU^M_69>%rMp16RC
zI~k2o{1I~f!2!n(C)=NsSYIDAGVYxmB9HuIaUOA)Pn8?nAoV^4fR}1!sWr1c96DHb
zr9314&T@|S_nz7G?oNx5FYgv*K+{*Z@ya#WPe<xkdtfyFmiLWV&f<4R8>2xo7u<Uw
zcEPMAZwlWaLScNy+dJF%eq~a}ErvitQ-SJcqliV2`--bOUr09H|0I;>Qb-`~;+-S(
zOef^-#S9SL%p0wZJsP6|@U!nJs|;UwB$O>!W>C+}-v->U$`h|MeIQN3t9Vo2bkIsf
z%D4*S7q~4JQjpl!8E54F4vu!F0c`ld?KOPnoNg^yz4jChPKn<WxRYK6BZFGi?&*t-
z6Kd1*kS^B;>tGF3cn*vD-)rgJ>26Y`Ovj;h=nlFT*Ta<B_+KxnOhVBi_RkwcUDoeE
zAKZUD?EwhL%yeOo;V49%YQ>88_7gVSqr51S?`+}m(db#6aO~)xV&14iu?4!mecMr3
zB2p^&X&qTJN6wqj>cR@%Io^|k7!hJ-z8&2370%2Qcb~XQO0T_Q%NP$aa00L`0#=9i
zzLMFuYHAe(-GEbYpGFd2yeVd*<W^US(P;X33SC`p#iBlSC_+;;m-a|$TGC6D{|M*d
z>P*XsZOWMo)et-@0Psf1oYkHvLRPrk+OSt88?)pxD*;D0T1g4zSJy*LDB@x9B+tmD
zF7hn3Y+j=M;Hd$->$>2S#)yNDr-Q|79+2tBo!k<;sSF^(6_-;f!6`cIs`}=Ezyql0
zIjMx@k<|K$W#rZ%c`S3WvE+M7lPS~2V?`RoQ-w>zfczJ8I)1%rUwx(s9A?YK=})%Q
zQ-jShY^_Gprq^(SFs|oneC=J9=thAKGY7B^7i5!Wj|OsgfF70g6+FCVB?^M(A^7AS
z+H63EPJNvd087tz?H8<W{aBO4U3KL)u(^p2>&tJ?ILYb(x33btzAybz!XHa2r+;u2
ziNQ|q^sI`N&1HL(kWH63fMDdQC>F)E_AN3Z4%rh0tQsx|ZgITsLN3&jG$$%M&`zWa
z*R+je^vWSVt>a+p8?q$-O<(kq2*R_cJiNACaSEx9V^RV$L&Hps4C&^~Q?>KXD<3X;
zOnzn^m<dF2jQ0fTW<?=;DMb{+&z7}#s$A}3k+d9Y>#fQ9Ish!P!N5f}`fQj;sjoHw
z^Jvd&Iuz%ZxKU6|C2Puu<cm6&`;m<mcvzdx-?#V=%z|PbUa0=q_4Ze-`<)jhrpBhj
z9Wk{<Q@Oi(3LjaiAt)Z@ojB9ebj^%U6oN`io0f41)yx?E)6jES{Fxtpqm4dq*?){T
z6q?i2vt(Hn)!!FP<Iyv<q<*!wi)qeeQ*z@<(xr$G|6mZf#5Ad3xqEsLQCr!4n@mkJ
zlE%2^mb=uV5_CeBU^z<RRE?^!FE3s1aMT$Z>Fy%~Zkf}&jvh{%ce%VA7+w*5`lZQ_
z3&j164sc~G^A<Nr=MSuoM9ng~XfCoG?$#X&@zKu+*`4k`sd%0_oa*$v3dGqyebGX;
z;r84ywJ2X{Om{yl(X{8ei>$JO1@zKleoEg#7#Z^rCY_K~I)Q8oIZ(mn^)`{mubI)M
z&o0e(ls}uY!29wbe|};wmiB;sBA6;6x!s$+2kYgkg$bqU=6ZC)2`?2@a{qN5@q?IG
z&}2?@X+9}Q1!>hJ8(X9K$s?>gH@tSU=3LfO5NFSEgf3ybWop$`R%>{QzRxydN^`OP
z;NNHbHlL22^RlM}f<~SBN0U_~d&p(9XU!KGc7}K%??TBabu>`^&4)mKd6e}S9B*G#
z(>=77$zPEhT1G!0k#DhuEThVqj`Ad;G1Ue{x_Knx#&S@csjbg!_^97!l|?e<oW;?x
zXHXjL54iG-K+JDbY*`hELskq0{5LcKTYApB7sLYrgmf8y_7Bqzs(7(#6pPggMUHc;
zmUaow&$q%#o3S<Hd+Y^YLgrLm3Jx+Le=M#0ftm6tah+I|_xS!e{h|GP?hyhlMx_6(
z{q|GD(WqCw?Yo;pXmw{-tRTb$k1KTyO1l+!;ojM46hZTxFxRw{39P@_7Zta=oflcE
z_T$D)>S4jXZw_SLGKJbF=UCD?Gm7!m7L@@kFbC;Y22*0U{}4_lT*X*5{8xWwk-<dl
zwNksDJw?h!*=q`IMfsdn+Hri-ju{>)N{!$(deM+XTW58f*9+F`Jha~G>a!<NOo_^I
z<<k3cIZ%6eaWlnS{iE(sMoe*j4Mh^6Wt*?@juW{t+)wD8{aK{-^kj0(YJPW7-&?;B
zA_HORcVgbeIgDFfT0kf1ie&9RL!6xXMFUy&H1m07+Y?#B$E!j<Dt|RkI$zw$gY7%N
zV666dnn3_wEIlA`1}UsFGoXXJpU@0yaz!$KAG5AlST*GJSQo5AL~Z}Ar~6pvabe~<
z{MQka@Hn@Qi^=JeoqtyyM=QDUBU?d%Zu4+fU;veU#(L>a=tG;Fp|9o4#&q$7$*DnC
z;@#+OlL%3D7?gyO0Ml|7lsuO}QGs<RBpnNA5g*73m5s07c}RM+7tSq-`%*q!ES_+h
zOgIUJ9NN@J#4@1G#vRJAY_`JUZ)37IG5rl4%PMx3s%}1!U(C!C_vh$A2?KyRPgq><
z$)7l2Isy4{eE-PlnkKC9HV=o>$-js9K<TpE=e2*I?01jP;J<NT!gz-Y8Z5MG=8${(
z8eBPYO0rucY~G$gm}bev)5f&@u!3ZJ^U<fy2ia{|pjhsF7<mP9u)SMfzd2`^e{)V7
z&I$EmV9blMb_;Cx1E_foA2zJaOB04QHmAUr{L+1Lo(_3k@6{4j4F6!?A(z1Oj17cK
z5=t}pT<ShI-p}f}Vtg#uLS&C2n0t=wy~@$($;-%I*~RsXoh?PyH7wr6g|7nZ^@Z`r
zC297smnYFy=L3LMoj(Ur#q0a8-@sS<Kli`8E)GoH{r%P@=mQ@}>-(3G_K<~l<SrRi
zo6`y+f>~oWWobAp(V_|jzTS}0Hc-Is#AUIV+Elll2bznr|075O;3Yq>pmz6bkzKzZ
z<?}=>l_)%#@EsDsjWrJXGWalU5ELm)KR+H9RCk09<mk7TcI`hMAm*%gLl%<uP&&U0
zs%yul?Z-@J?DWO)_>leVQ|_y)jH(!*SnccxfP~f%K@Bb>%+3&UAZYP)t;LjHT3SMZ
z)sydeJ>=(FPbS1b&M`C&TaI5--HdFK?yD_KymNEN^c4_`N1b5bM&r^X$8wkHMUo4I
z&j4F&V!*i_f$>5u<aw8BVq|K8WJh|A*AIfb3)ARro!L6_gV|;opht}FTa2R}_~)q{
z9Bxi-A8LZ7t%>oAsL!}I!-XWU;zhN8%ZJ!o*1t=}r%A_++#PKWPmW~DtJpf!8HP^`
zTs3(enHKqxoZ>+-8vv5UWlf&lmP4csK~=40r?%v-H9Z$sRPx^T<o<?b#-`lyXog+C
zgxlFH7u5VrOa17y2(`d$DyJl_mSj&G7~!_+f;N>?`EGlAVxAk-V?MI{&LKy665o(h
zZErbIg^zl<ikU(a3dVCE39sHyp)(kf0{Z#{B5$*B!pFB7CeLAU;K?d4AC8v~Q*KV2
zy$qCfDtWv%rZ}YYhZh&KBkkKsp0YmS;x%OO!nk?Ft!kSv%of(n05C}?HxwZ>{^E7G
zD>T-6i?tp~fxxGnxdsfIv>aH7Ol3uBqKLX~Q5-+vdF@kO*<2=09X%c6v(M?JSJy!&
zj)``+1T}#i`}=C`ve9PRug7TN?CWsK$#2JHmUTM39@qkF$1#I14h!7ND!2h~v<$F$
zMZbLPaNF!sT^Tm(#-~G|?hEml1C)N`JmW()pv*B72Fvib2gH>IPADAREpRT+W(Hu+
z)FSb^DwE0E&+7Nh8w7)x`9!4E!h-Z+rc{nH&i;&6DnM);Dlk`HoAxIx<5|-!^I~wJ
z5Ae;`?C?%V`i)BPrbC)|?4og6x%jrj8us&-S2CHjy_J$H5Tau~kF()dCAV;4+XWSG
zvdsg1(VswHD|u`8VmGKbY#nZ>K8MlGjlTtc_D)9EfQzI2R|IAe!{=RCbhJP@`VXTS
z|3%;6B<@*hyczNh&NC>+20f_JW0x_MAIT(&L}X$wrR@eOCq<VXHSY5b^ff64HK3{s
zRQxkW+ECcTQ_-;^ZnTOv)>i7vyU7z7EM0N=d<ilXu_l@nii~}Lhevw7izrJMnmXCr
zsWGTpB@s1H;^yXdFnP_>-rv028JO(gz=?iSn~NyJ{r@Wh#@r>sBmRtc#YMHF&bSd!
zwPx9t@}C{a#f8KHOZ3&{=%5X+G8<ddA6lYHOwvbqW{qzc{sR&YHd@0!n~&t01X6&y
z3GXa6%nC<~=Nn^av7up1@eu+-r+VdREBUG|gY|``L+!x=q}_|xR!N{UU`f|?)nOkE
z_n`&wY$kGI38r>Ek+CC6yftKYiEkm&ptY~A3@(tN?MzhNn!)8*G-yki_t3)fxFqI_
zzp?x=*!f8f&7;iNKAKRff)_P<+CCDOo?)VKZH+_@{#=3Ng3Ni{aJO0?QYSlgZQ^Oc
zBs*12@q4p}a~p6t!{_TP&a=(mpGbP@^sXxSVSzP(vqI2t@6ymzoDHsmeZbFf0ei$R
z0LF$Vy-5D<$cv5TFRNr=H<$r?=z)Po>Nr0fI6|9o%OidMv>boBX?4C62YYRQ3iXpf
zDXdUA(xwy@Eh;jyyAvk=!Oy->EnD$8*61={VND1>In5)R6ek2?@mx_=$Q*~}klMt2
zK_#}x<QU`C6cuPHPwqx`*Dy~e#T}1(mCwAA#$@hM5RF6nCpq|D$F#g9XB4v$P@bHW
zCA7r#1jM+oR8v3FGaIcr-#An(bmnC(L$0&yd#6#oaso%jV0hgCNJ6|sAs8W>Tv-hs
zrGqh*S2U=y{J|K41}vq7BTd>a;Wxo)FW$789r8cK;}C8+S-+%;YN((LLOPt;a9=)*
zL{FF`NxdEmp_s&=&e5T96)6fb7H&^-tsgm%?T%{-96A1|YLNILbMHRn1@suX)zQbe
zxaB<!eQH+l%W!>>;fau(sm(7GpB7|Rr9Xh#LjC`RYWU0d=!wtKRu~CUb9$&+ZMwjl
zzdDF#BoPEB_at7tNheu_sv0%>X?Xw%2t9ZMQj3PnEp{|A<0?r<5hZ!_bXs$YMELXY
zK+ieoj=NDQLm++adQm3hRx<dB0qvjF&JF{J^#D52klO!(ZGca#wl^ZmFtcXVf6nK)
z=2Uq#t<24c$!6pJJT$lZ(U((Wc9j70+eN*;XGn`saKU$o$C?eQ*+l|*HwJrqCN}Oy
ztBotGTO<V5*ZmY3i2Co$yEW&1(+ha)@^<zP)pb~`t1ef_P>@2qS1$H7ben5VT@iJM
z_L>hFJAo40qJ7G7SQY|8p@pfsm6Hhkuufc62I1xH{M-xtCI|zL4yk5bllk1ZxO#R~
zOiXnixub*TF5ZiOGRtlkVf=_0n{_@_5L?dWJrd4*S!PCglOaVO<95kCR(k0C8)*Wa
zp=kAfQ+1D)=9!ym>8U>}H8A98N5d~*{}50?&Y&D7cNZAIw|lq9tPTHb@&-KAFLhVR
zOM=+?U5^RX%Yn}nTJ&%pbjPYf(sj1_tTXjDL5Jq3Z&Ec5PL@PXO#u2+1AR*JtWqFY
zkjP=`3MC_^HU@b~Gfi8YukK9jlYcHGvuXf9=HL&>VPoU!*Bx(eW*xNzyB0LW6dMBh
zK)AYZeI?o737pHl_~?!D`d0q<T4qg?3lwI6+t@+;ZRl?RSB>})6?Mnfk?KhNX?;X>
z)lBi%IYU#6jPI(vcTXT25OwdW5SJqRuD4oeK0#ODcrmi-!{*WsS+|Q9fMhaef5&Nd
z#|tqEKaW1jiDEJpm0tf0>sHf^UWWOH09}M3h9@pR7beYhs_ZvAJ0|8~6|aazbA=bD
zhKY31^a%7Ma-TtstVg%DZm08czuiaOMPE}$oxk_m<Y?yh_7#h3s!tPo#`KjUBrkwl
z=a@6+?RN^|Pd0*I<#ZA@S}n#`Q>}PDOyolBu+XkHbY%83`aRgjzA0qONg<`O!Mrr$
z86jqz2KCI>L~ag>tlw`O%p8Kp7%4-z^M5q=WRQ<>&m~SCP&ew-9e=pvgtSrBd>OOg
zfeBB{WI$Ub`vTma1H<<i<JZ$#1S>?DvMjFi-#M1hx&*33P9MHq>Hm}$z*zugl3Zj|
zrNi;@UzAfF+y7dL`Ll(-TB=fNVsZzQa58<d5$ix*J|)1gv?-<+&VI>Zymk}TH1tg4
z>54;2XjY80;HYe&dr<Y1hH{I&@WsWyGRS@6yu`;vSZz`~(6Sj>f+zg@TWY|59XHXC
z+fn(rvhQzUAJLu%dU+5DCIwYR19kF;F>MYBhjF0#3Db@j6Avm4zlAo2@oSpd*xfGY
zE4v<QXOUH=U}2YxNcuIUP+I;o#f~A@*~lxa#<0H79=Q^|zWxW1t}#kIFU4JoP#zw!
zi^Q20W$<yvf(-|21VYnqslX-TDj<a#JC6wn@Tyxd=#$ejMtLeGU2wUx^FA8tBZ`~T
z=Uv+PlrLRKS@DVhz1Zo0ypcqHw;R~IpN)mD0)t{AGKX9dMCrP@M*Hy)?T6}@(re_%
zuLQHejn)SUTXT77<9L;FBfkUhQqZhWAd-n()~gVm(YB2#$B+qKzTrykKd8q@h-)mI
zh(;Kod-Nr#{2O`Pmi3jIteAl{0!)&?x2Z8z*AgheDqVb<ZpL)n2+8n$U&X?vABG@i
zC@_-dZVbK)M(lnQuo}w|k9>3g6U2(0VYUcRM=fdQG}sBU3?-u$HovK;UZmOV9FIzO
z7rhaD0A2|$7a_NeE7(zvjYM8L_^pX1f0#Vjb`0hAa!_8WM6_POoCRa<PW<jBTYXWy
zbTuyPlyp&bn*9S%w&*vWVf!y&-v=TY?E%yxHxX?;SybNo11yXCxWi26(+kJ}gng3K
zHEBty3p_ty<?>Cv*h{4ru|whxpNUFZ{Yx5eSvRU?{)(usHd`2-skqSlXE?&|y}RnP
zUMhtEuZspEof$|ed72Ek-dg&SH79LoPFxHraZy621c=Kj6i>)0yD~CpeTIalma%TA
z@)x+zAgw72Z339!<j>P!CD?SnZxrU!LI7=Y8kv8IP5;phT**$;WscX@Xl54u<f5<X
z7JnuU_}QL7lLa(5Ap8?gQg%nwCUE%V*1a)*C1fc3#PqXO&p&`PFW_@%H=^vjY#am-
zKm#=59|%lbyNrn5qt}t-uHET!cf0Jf2yG91^5r$!dG-t-WqYL}ze4=@nT9Za(`a2$
zI}d)>B|jFP+v?*pp?5Vk(%?GCgl}4m|2X;Zp=ac77<g_WF-TKhR6vrhezy^ay{Z@=
zs!kTIB&-bgp<Fhmi1jZrHGUx)*TUsVEhZO&i3=9B#FxZ}@R20OU}j$MJ%R}WGr{%A
zF9pXRlG~zMSw=L$SK%gKPo$fAUlj)law^RX8ft5OWY$VW0tEbxPFT@9#hkB%q%<1$
zH43N3r3x3^3N`?U+vS^Eg5NoMwk^4}MWffLw^nY-Jcn*P&cj}A+)VN@p+%?iH7e&|
zVQxPu<5Ja!Q-iD#azLBCP$d<8knzM;&=#9ob7<eAOZ8~6h38$~a=Rd(_i>E!k$==!
zK~zh+y5gkl%usfoIuP5uyo<iTq*lbX_0%pO$hJF%O}4f1IztmQ6^B{P0H_iP2sm>F
zlw1vs87F_H&+UqV92b`lcD3r@;c$@Z&%Ld|^xJ$QH5HgO1}eo=gevmUf7f@c&{Q&R
ze;erowA>_Rrd<IPV}x5ihVVa0uf!FxW0%DgIBBw**W{1<U-bbe=HDRZGvY>7URsN!
zUUO|n8H6V2GK8Yq2086NfBLf2U~XlyJD}58CU1rV|B4?M^;G**ys2)9Ju-kb-bzlH
zUCju~$4OM@Ys;f!hi-iJP>h(04USg~1&YGz1G(jZ6ul7FrgHxaARbr!wA|fR^bni`
zQNx(=?fykiUDii2Nh&y<ujGJ<s6dkGRDdKtK*5%vAUXu3OJ*U*XVI!88K+ooZgeRZ
zZ&bTfLYEdH*+69s%R=dEGoJK$k>8@iu_H*~AYshnXEv0)XAcciSL_gOF;xV%i|?rA
zWNcU4TT$GI!e+l_H^LW+*WVN#j*}^T3L&i6RE46)Ybl&XsYdBs*N%aT?tH=X4lAy#
z-*he9kh;`=#C<GRb^~yO8Zn{?e$e{O^nKFdAS})@GIE5aks$fhtsgj{X@1Cm#X0D$
zQ{GPiX(u4o1M0rZ$R@pM&@BPTaL+P<AK~UXgzmni1Fa92?YUyvOHO70wS;+lB9h^#
z7*uNnKOn^k(Lr+p1vg)O{{d_#27-;@NRWqOE$*d+J0XHf`5FIzVrlwNn?7aW!N35y
z<;sv!%??EHO@j-oh}>FMRaHk<JRQ-I$(_zkD&+dr_4W0*K6UqENjQ8$PjiN`C9h<t
zk@(uH)ihk4QH11g+PtTQ-u9u*r8VF7+?eY00&F-W{B1~L6cy_{!Nc>vQTS`oLIfvS
z8=MC=hB0C7>?Y%oSvj<R<LEW37;Jdtk#P=W=l1g{OUEiO)~7x3@l8?oO`+Utq;tZl
zIcMIVa=GQ4);G6|u8vEMvki~?GF<7r-fCzxZq0lnE%6(@#V=t5c}DOBXW#PUI?q#Z
zmWyC=We{X;<9G+TyNo}dz<SqNu(2Z%UER3%PY!&eT)vU*4n!tpkacpPJ&@VbX|MB}
z5U0m7h7(yVEvj4ElCO-2TNoUlL^5*=WEQSniuY1S{_cH-rDR!>kty4&$HzVz$ed=$
zeA=zTMPN|h6=5aqIp$N3&CjLEU2kzRwxlMjdpmTV1cW?ko0(QVt>Canq=rhhCP=9)
zz!*d7IXuScYd1=aH!dDdtYzq#+T;H^ptYdV7mQ2KO)>d-m{94-TW@>hMh}y-@NDe?
zZ&P*W+W$*?>SuaDmPN=>(#<}i$fr+F07f4>W2`GMeFY_cPRms9X+>eG(sND1eC|WF
zj;mux&SSthsscCbaNrpy^Qr#CB%N9Y-_!@`1b=hOg~sKHC><O_Z~he%$KIS9*aTDK
z-I>=&B|d1hN{YhEOxy5QC)OI2X>C1i6MOTif;-etDnY5sgMSas{Z2g8pVu=O{F9b{
zCDef1pbZOkKODbJdrW>gP~z;H_JO?`Ls0q*+CGX(ZC^0BOUOaw&YudEYC`me|3Rfy
z=N0fF?eLgD_2!1D&RKhWkd~SV5ykwV2RgX#HyJU)p{t|ez?cJ+3nY1YI`ggx`efnd
zxyq+G2ouEh9FTWOEOWV$TYN|#x$RaF#{QqlkHMPFiEiRwQCUz<N5_95$s_8ur&Y1#
zS@aJm&V0fmtH3RzN0v9v%%-FPZfJ-tM=Z7Zs}FbfG=uvRfb2GZjx5v2*48G28vJ@Y
zGn0sKGoAy*Js$K3rnbT+5h#0P&x>pfZtXP4ikF#QX(`$e>$gfuGdE^gef1I9>H2Q2
z)dYB~g91S}+_q(EtR;XIR_^~G4E|pf5rg63CAl0k7u8s#2g4j?d2Hg@h3IXK)^ZHA
zzcsI{TSxLhR7Pot1FN229^a$DEYHA1q20sbS|%uFu!0H4{v<LvjyLdOJhXc`dV&9E
zuW|h$q}Wiu;foox!(2_z6Z15S=K$M20&)d1q`@op-6@=FpP3zKrWTXN=j%iTh+unY
zcds0>xZ=HtdFq=!@>L(TxjR)=XGg;B5XPLDe560o_#>tk2>Wva-IkKsNh;A-4d;ZY
z7|u$%UP!*MD@pTV>?`oO8#77gufrcJe(a0UP^|~@^dDZl_2AOdCS>VTzRLKzUgV6}
zkEk=+8#v?X-GWrMEsk3Q`z}UXS8ul}n&jpvV`NYgc2=+Kh&EdAZ%BKFO%4PXI?Ib$
zF3haZM66BoKk7TEzQ^z5@xG&+_83l!46^?8<u<-Nb3Z-Jt#8yk;IRe#(XXTUr|pJf
zP8NcC#P*rpyIhM0rh8TZPEn<yW8WPo8y~KZap&@PL}>S~Qq>Q1@8@&@4~|(PdHS%b
zY1O|}e%xl)mNe{-LI<ZJ07#S}w-b4XP~|x5W?XPGrh$}_Dy(9M)DVq`wpswoqf?BG
zKlQ60Lo6aJOQXLEn%e$z9oReVqtDsjFh&nIv#Bfl)dgz<SzKHkXtcUp66|BajgXJv
za*xTwyh821Qblm8K>N3HNwfr`IB{*NJT-eB=js&C$91y5d@urDkKPT&^MtxFAKThi
zNul27QvkvU4azT<t?lfTgNdUMk{U)7Q_o9eImG==!t^OfX}1!B)$LD5eNs%j_Isi2
z{a8KhTQU_vauy(YB4kVBzwPmu(s@_cF7T=Clndd)xMW#_Q&wm6ean9qBp@m~_AxXO
z+b(!A3m12wF0($tnAATqx-^@PD?rc$lfj51{FscJyvhlT9^whsraKw#nVRG<P|VTQ
z*NM}V?be;s1D%;n<RI^)bWfAbF6AsrBUpcLsr+3_LkC!^*d|M0(4RaLpR{EG&2PnN
zRv9A>9-*<Zeats~Os=$JlAYMUO>`NnPBexhKe&D-r;LUT2{Uhxm5=7E`ov@BF~7Kk
zvzOLz&ZR95>OiPSw-%aL-T{(lYniiM>mbS+dB<@t&GE-}bT$Y^ga0&~Z<+wQn-1Ro
zFS)%!GT^lU&{|~w$)nj@Su*26v~_4cu9Wizp0<eKH_I4K?pU<1&b(^to|FnyoAj|w
zmE-YWzRyb-46}AmiJPH$#;T67&w?g$J^I_ciGU(e_g!vI&IQ1E4mcRj!VXQ<Y-F0v
zgn`|YGLZw{bECL;scrvpm#{I?Q-xMaTe9cH7S~b1tzI1Du(D|A+l38DpsDZ@-x38a
zG5D-L=NF@+)@7TH{>-*f$8x9KvRlQVsN<|Roya75(v{|bYi!+$a*q6%sKXs^;&3)P
zf%KQ*E})`Gg(+G;eO|`mH`xYcte!s6r9nXEZ4*wG+#+N~HIeq8$jl4;iekZoiuKG!
zAFO%Vgj?B4(7B9q|JG*M#_~7^oNtF4^^)h>r^FU=4^pfTL}+j<%8o@+KS~?b$6cIF
z`$t%h8HzXg`s^Ci_lJb&dK<li3PN2eE(FZnf?$na^WW2JtJ5ik+Pq&~9b_`U6+|yc
zjk`rykI|dtCPU<94_c?%sb=?ReU?yh=UusC;&_1$ZH7bAknZVs$fC|pkW|Z9l{E-n
zpe2VPwL`>lO!zGYUS*dew?B)@K_z2!UU>!lGRyPC@6?4~mgv7!5f0e%GWvtKKAN2Q
zK)!5}Fs@%~9)JFo${CFJkXN7{Pxrxg#?HL9wG#!dvs_f$O`p$=$X?rpDm}pCRc@oB
zxF-&ucz>t`u_{(c@HFW<>$C5ekA@8BQF>Ku*y#Q0{$&%CpRKGX98~v|Vydab-*}^5
z!zEUN3EVWrhF0^d{9vjPAcz!K+)H^LdQ;Tqt)USWIb7^_z{{wjpiz1<5Y5P$DB*zc
zz?DC=_mh3hR)9QX)b{ukK?9?WFwh_!Ddh4Yxm+~#B(zQ)(sJDESi5Jb$8*t0)zQHZ
zcBPiD=`#jP&Zu8BA}#Y#GU=kY1p?MqXGA{|KRB1Ukh(M7t>4YXlV4P`0df`{qMi%o
ziFdo@7O0;6FRK7RtfHy|oE>b6A+;{Rpbz;EVKuYf!@(-u%CjL}Eeu6#L<M8wK!jX3
z<Z-8nJka!krP)A0unyuzhX!avnpxQ;gtcS(G8fI#Pq#s)$7YY#=kUT{o?v$=T@+Gt
zW|6_lBOx(4V_9DsHKn2nOY3VH5`U}H$C*)|HYD0Z^ZeSw6hFbD7*t2k^`NucKzDmY
zt{{87nwLK_O@^wVP+gn{>EBbS{do<&)Z(Zd$NRX_c6Ys^ee$#VPvtY1oSde=o@%}C
zd42D_-Hjh&3Lf`(LN+!E$Z+UQV}fDeOvzdbWIoYE<AFkg;AA2<Ha3_%PwZOD@W_6+
zZ*JVbXLs}SxQM>?9@|Y`_y_^LN8s<A*!RZ7(n<#vn?ElRj?uGT(rpmM`4$v43tNlM
zv4lfIlN*-TmzUN(TP;u9Wd9pt9(PlMLKd{CWA=M-fcRcE1=MYNby3vT;==pYgX5de
z5lItqZljXmwtyX}Sov%6gJuZ(grA9{eY7KvI_iXwF)Aa6;~Ig1j3G>Y0Oeq=U^Z*t
zfEXU%(#9OYUT#U>To>)3{nvQtr><QiYSY?YLcYw50z`(0KkLmb0-Eb0(3k^>UnWm2
zqtNH${Zd2gH%lV*61KV8geUpyVd)w+o6nm9?YvodBlZ|@=h!k4Q6J7kk80VYZi{#$
zuEGhn?AI<&?sqtc2#EPTF~5#8@_9-*!5Zmz<cSRwqOqXE$581!iG*}aT0kqr@*|3K
z=+u&ALoU@>@W;CI2YXR*)hAHY{c>T|ZM8?u9^=0Pw_}aImK6G*EdAj%W`1kO4sU;b
z?(@6_yTkjoI5EUd5!Gq&5?xK|AX%G)Kzx%Ls7S!hZ9M;DzJ#deA95AGAH2a0KDB0*
zx;u>pj~J9OYvOT@Ae%kklEbfspp6fn|K-EqM%h~muRGm~im~U}Z9j4TyM;-t&{4qe
zk77T*Ap~XMlCz(HEbZs<gfId=S30VJ{i;3dV=)NP$#2|$EU(S+m5Sy`Ujz?6)|F>B
zH;&=A|2CsO`D0tXBe6Z>i1GUvw1hb)QN5OQll2z9U`PE<PB+}wvsEYqUmmlQ9=I;6
zM@QP7UtJ>Z>}LvForZNqeC{00L5-v60v3W_yky=IjA(gJ<KivT)Rn>bYMHMkJ0D~V
z{CIYS@zyKYEkCZyk;XsVUP{KENslT8UR13+9^%vy?MGqKCRyjZpVD5Kg)0i<WzRmE
zdz{Q68cde=F!2rA^;2SuQdQvz;R!x5_T{?6Kf?tQBHntgPEyBG#mM8KGMgYJF)^DU
zd>%{3U^bz5hTp>gr(RWKfX&DrqY6&=qf`#vY4paeJp925%ovsCtMS!lm~M3(;KTzC
z$pEhJ(iEwgD$J?h%X4P#8Ca5whr42jUm0ecpXb!p(RaYbR^CsaRG4i6cx;kd%a(Z<
zRm109&=4U~i_?=(otbQ*){@(>B^5S!ie`;Wo1}#~ZZUx=8Lz>R4gAv0@zr7wYK5!3
zi77kd+n6nVrB%rax(+X6ZtB$6^w7I#5Bu;hOY*<K{gI`gSD?uO<~N>hz7QL1vh>o8
z#Ixz(3#eV;M^kJj`bz!Sa^urbqX#{(>mBgP-U7+nkIi4!d0wHpSL%8vzdTjTU!a3S
z$EkLr%$_as8PG?+w#XEOM)Cgf$9T4ng#OCH#U?EPPwFeBO|h6hwtSMk)8=!{R+IlV
zgs>vV{L5G8PllU-)KwO<(}*bwocpWj`<>(OE9zO7PgXMK10&;B&zef0{ucD(>&R(_
zgSf&c1}o{<qC0!yY&h`@zi-IGMV~W&_?vqad$2W;E=KX<p)-=E4ufBJAadn3anlm2
ztr|&_KGi?f8`geGjp7w*;LwDn7e0PF0>02|gTt=%mcq1lt=7=g@+Bb~3L<xpX#%V$
zoa~Q1H02z1rAg6)kvY%rrkHMM3gJRubn2TNViA6);E*Hnn+uv<kFfyX)H?sv$D&?=
zPiH2R!ob5cUdGd}$)BT}p7t=2vet`gEcG}x(%uxsa|{0j{#m5<RET*|mN)cFJ97xO
zf~8Z7G2|Fs7Gsp=5U%uEsP6OMZodW;KCdPs$rH(926ifK)Bi?RDResP$1$9AR+!9v
zdH8fz?6y!B_~-ElPO4Mfed4HJ=~Sn?YVDyGUcx!516Y2aIlD2!LjBQ`=&1kB&s8Qd
z>ly`7o#>U6&EO=}oR*ZmKL{X`Bfxix&fVdsyv-ClhqA-_(#WSXt9*`0$5Y0d^(_uH
zpu94rNJEhYd58`e?i_ThlLvmi$iSd6M1YvU33IoIQEh4vCpTFcpgNT=`=zB>rlc}6
z?&k_77OSD%*=cv~qJS`A$3i%f9FoU=%V7<HmPcYX(I0qA*~S<lTiL}ZAxrk7+rcP-
zOlM^_F~Zj$2w<hs32Y3FLKen4$RtvER87)p8~P#xvJywr7-Q5oO*DQ*#z<qzEMj2S
zAArMPWP9_3*E@3yk_VAu=nvpg>FEz(nJ2MO>kp^{A3=S}AWolJ;B~S2Nv(runzS>j
zDM6L0?#Lqy{WSIF!uUu91}xAp<9(l+xIkwjPA2><^t_VHL=7Vwo661z2A+_ThCybb
z2LXfYW40`tyv$P1FLvH4Ehc%;0@x_zZW4ax^$F6RB7x;9a{pRh;01x?7uqBBd0-~o
zNO$eFBe?D;vb*;NdwrS&{8D$RXEY|PGZ@YizVRaGXpZcwl+kxryPd`3#O`*7sE>Z6
zXvrK1lP*Nd!H(M-f|!3p&wj)XN4;tAefRK<m7~h+1Cs-jey<DR{kiZC2AB}`|27&%
zcwG14Zck1M)yq|9%XNtt-EDsm_#V9cuA6x>`pHzPtNA6*Nz|P*5X!ygO|v2ZQMZ>>
zqoOc8o|#^2RxHl8WA>-TZ@>4CnujdWo(Hy{R0^=h(^+6q6IR-MFY3vRPgCVV7laA}
zv2m-(>dx@b`h9qrz;F9MlV2J>+m))MWKW7Yr3tUw!J9udqgxkZOkd$B%b$pwgTR4#
zt6J!xB^Mr|>DrO(R+T^VrKAfB3#<;S3cB%FQ}?tt4`YZ=SHAR->GZ7^0$2fR-Y)@c
zCIiqZbZP|4wfZ3nG*DD@f#hSZGGfBCbapb^BG+l0@cCl9X`(N<kx(-0Ls73p7_CUA
z4dl8gQQ17C!{otGV|q(<E5n}?zqk3znR7{qNbS;0`?|<%?uS~5Yk#D2%)e10!r;M=
z(p&0!gr<vHEA5&l!Dy}Wx#OjBbTteJ#&wlh7ow%IlUZ*#TA`JZS^w;vg{(|QZZnZJ
znlFA$bA(PsW!w;13fCJ5|Kwr&(=ELwB<K|#V}yd48G@X=R(2%s-5rI5FTDF1WoPqs
zw2A0?<ts|W;A1MBKXH7I|1%;6msxma9b?*s)1Jm3ekxiu@w8DVLVnLvkyLt(FJ0a)
z*0!1<mKKWYOE1Ge_%s%mD4N3V3w+)_(f@V{fMR?Plp79|E`AR|*n*iNRg|PY2xK3B
zWuV6_md6tB7Yk#vIKFj<@V&eo%O^K^*N~yYNMSb6wVv$qy;u4^{tXtDq}LOPR7k(g
zkx9Ew<om$4(R^G|A&I@Qc{Blk@NW9H&o74cmm?J0rHU{FZ2IlpVulnP`mFT9ofqEF
zE^ozJ7MLs5Fpq7&2fXSwQ~zGz%=>Sn*1)uN#SKlEhDVIa5DD6&oq1Es6AX-+(5ewt
zuFbn_9W7Ir#iUiv#o1S|Cq#+3DZS2lJ2#?WV^eWye(LF`js<p2AmI1E?TyaFfk4_E
z*0W>=eJOQZLu;*0*zMkz+x>f6z==R2;C=ZZ`3<-vlL)g=P*BVk$tElB%coXoR8mk;
zNqo=#x1l$K7fuY#HfIxSYwOE*^DE%Jt?<ky0^Tn<kx^0TXAl!e7wCKa-$w7Fd&LI+
z+qM@lT>;NOJgA~-TWTkOZjNTK^=`I-*SzBblht$L&TFAO$m0cvDjEyehZp>R`<y^Z
zSOr@Z@cNV=wUoXsX!>v8TCcQZGSunA>g(AEIBlt3Mo)a98PsUHlFPf&BNXUGUq)F4
z0$%WDi~>cnB<PDuha|~wJ*ZUGFfMn;)Vfd-Eat^TlW-z%l}Xj!a3hsuzNHBEsZwkE
zz>^MMg^v5a-0~J+%!4fLkxe&+2asY)tocBs3F3p_DYjC(P%gIM)&v4?NXjwBXg#ow
zt3FY>z4}~kU)cc{6yW&k*XiIZDk=(NR@D~!+#C*E&;kd``$f2)_V8gTQP#y~(Hu|j
znM{Bjhrz&p*6tW*sAQazW_L*wFJ)fBDP6M7`2YdTk{>EJOmF-W-wDUNAB+JbKVTh7
zI&Ih<enjrYT3CzEhng7^(|WNzoolCk#D(=$@p*eF#`|X%H*VU`fO1{DR&VYagWllE
zqx=4!Dx4e*hT%Ldz3JSn^=6bD1b>1nQN<FeAU5;#;x#{7Uaq+3jCXxIvGO!CPv`n`
z+=X6$dM}n1ntYRMvO0siL&v6lxK7H|cux_Q4UC9hV4~XV-y0oiwp&hQG3rs?Ken4)
zTpWJBzrZdAM$os>)=^Swli=WBP@Ty)Q##5XDwCt>+;6qD7g{gUCzOz|1pVIoUnL@p
zB$l&~S^byAhxu?W*apjRvXBj9p(Uej1=iV+`8=4MpW^(sw^M<;U;(dylusH6#d2v9
zvIXkppUd=%=}*)0aISxuNAYyq@?~+`#+FQF{csT%Okv7_#l9oDqRKpo91IC|`0Y7h
zNiMvbZ&D}AxzC`VGfq#PqLXC!|FQKJKyfu)*kEu5cXxLNcXxN!L4t;mAOV6ixVyXi
z;0|GM2^L&~1`WZ3B|CY)e`{;Ewu-7d#l3ZBPWO@LJm++`T4p2ay8w2IpwUGQs$}BK
zVw2Qu;TtZ}%A@s?h&6^@yjtOZDxUhEtt2Lvt7XbsSiIs-OeSDaiqeRf{DwOk3`0r$
zEB1#4U^Wma5ktfovp<%|u6vN258fIGqPCw*3yF-3q+@(eQhW`gtsp{03ydE}XP+yv
z52ElRYb2Rr9+{9fBlva}@3QLz4P<muS-p_NFq}DacgiI9yzAND6ze)yFgL-fR}}!d
zT*{R-^~$gJkdrKpkxk9^RZz@l*;il>?dBf$VeqENt3cJ%&*kY1m#7}X9mYmL{RZT%
zR2`UjGIaY*uF9YFokj6FN(sG^%69L)sXbfnq?JQ^D^wb1OFyC8PD{NaH~n>$-w+fO
z{zIo?JO&fYioO$k_5I4jW;%<fFe-yYeUV8suWEHq3d;lyYS}9<KmCwC*gEXki-C!+
zxb$*OtETXq+&OlnoCU96PC4c3eu-V4v5Xb3pQ~(fSylB<`#V^p%mo{(vYMVZ&bXsg
zwX)`vjZ`zgd@tt6^Kl#sI&&b#*i`0aF-hHB5c0-*)8*&GtDrGzA&Mrefxx+M-{j2A
z6%(}#@kU3(TK+ncl92`Oe}m}#Ivu2!Z*sAkRNCzMD;yw97n_x&mL*x%GKXGn(Ze2k
zZ;A9RH;Mia@Fzd~3O%pi=EB~#^=zn0RjEnDwUG?9L(nG1*W-i~rU+1KE++p}Q$h1O
zB>OaR>87Hjt(sG_*RFgL$M=$^F4s`;q@ul(i1jbM@29^6758poAN3=fG2_1X{p8<E
zH%MdLeGL2TlPP_dG`u^QiZgsYzzOpOUH|j7(Tj`vB&4JPbQU!brOi5v9>e74X9Z`d
zQm_B3<ZGat{kYx2?YxLC>$5}6wWOQE@Rocbo51(Z^KLqs{`i-|Cepz_zU=95okLni
zC7x00lNvg?&661gB=Hgp`(<tXa%pV)ekEG3bKL}-Sy9(<JWAzBv4>@Zzd|}<ULk_(
zKL)|UOZnGK;t>WLM_HYZ4K{>k4^E^eO9ow*EK12tU<O=nDk+)HnAP$^xnlnjhhpO~
zS+)So+~xS)&Yub5I~|DWtc&y>7ALRI_<!c==8=qS9fMqVa4SLjU8EUSk459P!Va#K
zVvVhrpJ-=s$g<}n#4q?z1zbeFH_7WfOpn#F?0<7^>8&##dCr;wuDHb&d0a|KNVZ!k
zY#sXYp|G1BtooFVQ8R;F*Np`O>RMV_=oGj>@#I283kJ+bsAy<-5$6{D{wA<!3X45b
z+*x+<)KZqeaS3C&RY*1xEY3DJHwjq(g@&O0!>P<F%f2TE_|bJhCYOco!4p>Tf=@ue
zCUKh?#$XuYBW$0ShI*2Og~Pk~N)O`2WwuB>1y#A)en1AIRHjgg0)y)%2f8DF)7aGQ
zOp|;a*&M}^S+{KG=Xi#Td&{83dQ*VCYMQh!XTa^xErguMHelcnTTtv=spQ;Z+i(}~
zQGoSohDo2z2%b|ztms314Gi|7#-!DU_J8XbzvTH_lSF&_qUh;b5jlCNRw_TyTxD8I
zRkta$E0^Ohh25d07{0e;?YxfLR%<97U80~<Q9@;IXsJ8>!XY<)k`An?4o?|@6@cw2
zTQ6P1neNDJCzn6VCO|x5wKYoVrl0Q>EG{PXSN2%Uy5Qc{i570-GerA_n%s}h)#$^O
zA5)}NYXiK<9)`Aqwx?!cD;Y^#jK&VaCY5l?tVezcvNV3fqckOzt~FO7;MAo^clH`;
z5YuV>L%AuoC{tkGmDFgBn}uN!hi&CyS$4I0B8KMW<x=FDjmIK0rr)GWiIM+Vzf(%;
zWe;t!(HMtJ#G^E-f~r^0O<}gebi6zn9VtdXxNp`(USbpLbs>FjyP4jzCQV_B%66{a
zf*u1SZD$6$S63+E$!}J?65LQ_*}xx@$r(xZM6~+xr2fTcCr?)H0*$2mu|KI$VYBqz
zoL(*bz;}0=Bccl<lrE2jK=jOzrMRJ6U*)Us<2EEh)d*h~^dEEywM*Uf;tD>$0ida%
z4|G%Jo1MzV25d8`7MmYBAM-eImOM(mNJUG1v`O$fTP`++9TSGBrjL0Dl-JVIQb7AJ
zfNyqwJdF88eGiN2th$o%+$yW*Yb`o3Gzt0$_b<RdclzC(GUI!_L;-~9+}uKv1qCcs
z;A4npv@kEkS#;I=&FgnKAVGvXrf2dCOT<P};~k*nUp_*n%Z{-c9s9v$W`!!Nw3mS_
z+uj70)yk_+w4;uzgXr_E1b*Y>-2&bFr%I2ew6clP1OAliThH>w{sFu=ZMmkqx}Ci|
z`9AN_TiZ@)zjFwT6XJTi(Vh}HMfYh9{A9X@+^}mmTI=XHno&R9ofcE+41grkCXC)t
z=6ma=Qu%bdAlEFPMB%?be767Kb*N0>%$tOmo_Bac#ow@jmAe+oThcIC;?3E~!ocye
zz<W&Cka+jW7Hm(eOKqdQkL<pE9fiR`fc5UIq;>@`qUtMeX%S;;pJO{VBu{gX%yB9J
z-k2wjX=61OTSpb>?xEjr9r@B{g}?a8oSry)7zcyL32w}Qv~VPo?quI=v;PA&EiLv3
z*B^#;W~AW2yISc|O(ApC)ZEEjTezwQrK!uqDOLvcBLP#;gzsZi!z#+gJh<$eN1-f<
zo~5m4r6Ec0aj$=N=pERg(LM~NItDQ&ON@M8x{}gcLal^*ABkkS7Enn^dP6=ewHAM*
zaEjJZ3sEi=-|{r0`DIrHq4>B+%y>hnsPP(cQs@wd?4`|bWNG|6ufl_F<c|r0c9p!n
za3}Yd?S0~3g1j<;4L<&OL1o~k<Bg6+AP0}6rQ}qRGvqJT-=HBJ7$h9re;z$usty0F
zF;h7Edsko48?Qa+Z{WdrG6F0c(JuS<#OLAb!>RC~1pQh=Om0gS@_i|$f}fuv4TnNH
z2Sp9^_nuC9s^*7@I&ArJ8ltuC2O$--%i9bSILVOGenS>FVYK2&<PHu}my7thFY;U<
zZtQ8r`t?3{3DHt@r(+%d8f{{|<`hVeS&?3;WGL5LWn-4ZdCqmT=YoKIaCiYjHp@Kn
z7@q{Ka!y*X&q(K(5(7v;MR=z7YbWW&iwz2an<(mZye{>HY*@GAs;AJtA->5u!mZ0Z
zLx6Az4QK=tvah4qqm}W5>K%W}<Gdv?zF_&K!He?t7Tu6Ekh%1Ns8n&DY4tw1J@(lg
zx-9H19VRJBDq+5$Jbk=`gE>}bkPOKnX?co(JWbJ#bbX<nt64@e<JwZPGlyR_@#%HJ
zTU6^9`r{C@)}#V;UThg2K_vu~&IX-?13@D9e+>Cq&9T+ECNo=7AUS^YztrtXK%0GE
z9rZ_W%%~TB5POlnyLARld#C6tFi5V2SA_Gb7++*$eTw;N@J4)7gmT1_)16-LMwC;M
z=&Cv<P;KNm0X(j4E*3;EC81dCnj8bM8vP5ZA`7Ymhl9bWL)c^S<jfqo+1Z0%zDRc(
zx$Z*4S<E|ung!ylb+A+i1_*iU>g#pdT}?p3Y0h?xp!28E29REby3YURI-<Os(Rr!n
zZmWRvss4k<mau+xNn(Q{B}f`iN2?L5W{GDoh7V07st0STIi1H<N3m4!<WS_6Z%(l*
z#-P}0fOPsZ_TYCe<T;^Sdg=sJ09RdM!eowtwvpC9+m`O}1RQ*A3^R$81ydA{{V1sk
z<TlsFQtIu)C1hU-{p+hBSGY%bI6t$2*i-1A4{mzh-rf%*J7g=#aicswTT#j<6Ll2w
zqupkldbqKEw$rb6ORyd}pXZpF=}>Tc{nJUzZWV~zOAz5zBioTdbt>cr-vW2<s9np&
z<l0YPhds~=j~U}ws<GncxY)^aQOQ+fScRQQNQ^WAN+$C~FXbdFQEgkVYHY;r6BQ`3
zSR!zlo%{?t1B8^)WpT81==x@m!SxU#IM<dJU*!pi{bCopUL|3ZZVp{2`EI*|9Ik34
za|x*Zb;Zsk5Z&E{Fe=ch)23)q<A89yQXiedh(_yhWw`2{$jXP~5hR2WORO-`9f2zP
zjNCjtMlx@TUe2~0aubRk<=;#B)a7CwQsRKYT1?`$fEX4!GnvUc<6~B8-XscaKM#G2
z=_JKqZcyt5J*u6Y<-;69h$!*ATBx#AqW)@{1<Lw{!(X>b0y_wW+vG)0nAAXN0<8@Q
zeMV$0L(E)OmtRs%*VfBivZC%@@|yp&hdhkREQ;xnp&|Y59p%&Z!b9Bh*-As$dcNX!
zsM+>a@jvZqvTk8)21P3+QiWGkFnv6nWQ;O;ygvL#)+liOmyW-u=j6n!H|ro$R-Mc$
z*H?#1`u`4ox;wi;8M*#`g;478W5#i=2o4Xg-;lrmJ){6~8jrG9aXL2`M2ai)sig43
zdk(P=D9N6b(P*DT-dW1cZ92kJ`M+XX7Rt-&lgJiG5&s+`X5@dV{MyQL3np}q;e6op
zoB9*$L;NKBVvY)?5s!#P#rA!f#~Tg(nqge2NlCz>ElqO$4FZx2Sv4LRF#IpYCq@-K
zS1~gqzrVjfkrUxnBT?&UZhmr2p@j+Izhm72i-4Yx3En@kQRqPl<Q)YxmWP%Fm-xKk
z@J;*(DXVU8;^e=l6a2dJ;hSSfY_aLglkrN0(^RkY^a6qyf6e>jqu%FP{^?Ov#c;Fg
zV+iCz<odpA=Bq`FO%>D&Zu%>}SfwN9I1XI(82$~E{}+~H2H!e=&E|7>lBdjOjMEq%
zYyh2)<^2PZOvc!JJq|AeY5(|+m&YqThPc;<`vJSN<@)h_v5vW{Y{`IbN2-}1bXfd9
zXtJBY13}|qM2YR~@jTQkR)YYCf`X&${rWJ~_6*GQsR`AgrftrQ;zDtMCI7J@N+a0m
zK*57qr#O5z!>ZtGgGsp-(~-a6$tCs@=_dbiGhrc4Bk6MWv$c<mw6D+FSDBT)Xf-E?
zfue_PlO@e>?bUPm0n}1~V}qBl-&Zk67Jz_^5uA{KHU0G~62KN8qv^BB8s7+P*spBE
zzSeA3>Cl5@x&KoZovR^+^SNTV@qBin?#{LmHXqbF@UxZ;k)eMmdB(R|3L_3Rhl(${
zA*3f9gPw#Hpbw&YNJId26$e_TASk@L?sqzzv>EvjUwC{(c%;!v{NN94!b4K|P4I#6
znkUnQB=q0efufYu!Zkp&?UOiyEP5avB{zl<h~#Z0pZ*s<N)$M3j7P*ztF_ij4rbAu
z0r0A>h~|V4FFyNa$0Kv}$D2dqg52S-u^lQ_R#wO5x@;P2)zvaeSNQ*+)@oEt4Bk&h
zAprq{e|{52Ath2Xfz*h&amlbk=2KPtHzE2*Px#r<jD<ji*l*bh3McCL#w<XAe57Vp
zHucdLPbL5&AW5G!i<!P!msVTRhEdu^0kKTZM&UPlk}+-|JcA+H(WG+C0&TTw<Z#Td
zWM1VO0-t}kJP?)Z2z*pj>J~^7)=psmD1c`$Koc)xFg!`pFXuD1HWa;wchl|Ba!+5c
zu@1{V!GOkj)*)3?@+H~1;zUTDv-w-W!^4M1RGbTC-^JgVLOvr4=UrmvHuS^bA#_LK
zV!bWg1b5{6Lm-C#(Zqld9X<Vg=Lg&0Pfu*R|5?!U7<MKk7(4a9azry&0+!I$o^gnO
z{)6{GEiUu>S$U-6WF;1sQL2+jQ8B_Ok%Y~z;sPnDA1JB&+zeJ%d)l+v_>Zb-I2M1!
zO7GcIxv8%SS%PJjm!s$&53fFre5=$7M-hmXV95W+;`JNBXy;T$bwRxTw4es?F6xe_
zBH*_&3pTmsZzRA?l1S39$QO(I8;0}U(n_Bv4*8^fE6!DffwR+7*-Cr0IyL1lSgIRO
zkq}07K?k^8Iyydbh1Ddavli=oR2K!~RHWJ#>vU9h1><C-sTS*ORJ9iCCe+yGkn}bn
zew|ZR_9GplJzVZ*oj7S+c==zm@B<uK?C@u{<8fL<J`RHvxV_ER-b6lc;WjFEaZu9O
z4ba|i_ZBl!?a-&C^1M!p`(7iOnwlE-`ZOKGIN+Nf*L-2H+65bEn<U=k(^u^VRm%g`
zG<09IBLYe6Hj2}0`-lX=bIVn|A%$&vCMMANcH^#^OR1fNMVv~Br_AslH-PQXu=7$w
z{QO2c0G^47d4SzUcLWEYeRL%zJxiZwcsS;&&4!W50E4H=#=qX!o`{VR_JA>6XqGF_
zu>2YRM9Iz@M)YRuepDH{>8a2!9H=;hR){dEa*_J!en)-JNAhU?q6S_w`JRnLMc0Y1
zK6f4(rqk>1TW8fl1pq`tfeKWAtsuLtLy?KWhW4DW!UJHb#;G_*Gu;ZiCNm?035}Qw
zRpTq#fSZKKUsh46@X0;>L;p|Uo0@1?*eF){R?+Ew@uY>z%LNLm0s|yKt|TRK8r?i-
zKWX!e^r{i36HSIt=&N*i<E-WIDS^9w4y|p~aWU~~#WUa|cYk~O@l3H@#wNuc%fn)^
z4Gb#vWrnc1*;>I<Qvv9&4#8hVhsn$vCB-@-`i|yAoc`-JuKc;~L&y!hX4AhNqrFRS
z=k`4vZcWM}*^n7^zBNcj^#0^lAHNb)%i3SAH;2lPb68{Wz}ZFtNW#>zC}5x50jW2o
zjMMjvtOTXhhvjM+yZ`v{pkE}o$pb%uCsqPj6vDx<iH44iC1<$dth`wx+&gVVucen?
z`1_tKC`8S~{R-XuHwEkd3$bt}lEc84Y!2a9q|lb{i^Rg&NX!Sy&3itA6jKqUYwiq`
zYYr4M5prwpKys|8)X~*K%;#p%d%^RGh^;jUJGplZ9pUN~QoCFZ+h{vCL;$_rE|w#{
zEwp`K9m4+6`5?HZg^%;^>UX^RN;Q(**kqD}>M(ewCwCP)-BCnW#Ap*@{UuJc04csF
zFa>VZynE0Vp@4HbcsGM8?Y;2Zh%A{(Mc>=rW$G{^A?d^RC6HGTO|SBtITv|}4T6TJ
z$SNimHHwY%rgWU-HpL-Zx<aDatIEMSkIkom1Kru!2uY@_n89BWlyw!3C19t3IC`Dj
zLB{h;S@ka@Ht?h0@t7k2H>5ADc=z9T@x?38@Dtyo!&2CTuetat00&x?zNpqT^dQ<F
z17Es0grAXS{55&^Z;4SAYgj7#zf5olUm+zp3^sAQ^P?w>t4ziWt+}(1W4#>;@zj;H
z4H7(`is)N|DCNnI{&ZbU#}sP;DG9pHM!Z{t7^K;Sa9UaOrQi>*-XaOU9gN_H6r8q)
zNbX>g2s9(`e>@r;OPo)7`J$5334T4nV=DEc{#@#|l>#(g%4Kk55KxZLGr2#0YXq0B
z)DbDBIDUz4`;lmcIDR87WbpK7+9%<N#&1g7C6C%)`?+#*G8N)gE_RtpdjSD+opMf#
zIdgd4%wmH_outUP-VS1eKl6~7hA~P$*3T7d`7Y+IVtun#YqpOiohO<TVu?_k5}R+v
zyaYVM3>z4c70lBKp4i1>Qi2U5teE;!Th&;0lavc&LdOJC)hk`b)Zh;QJsKt})!_rR
z=&XMgR;C2l<xzss^#B$BU^1V$<NXf)dTE`-6a9KA>=o_++gT*?flAWJ<=T+l-66y#
z8$No!RQGsO1L~2QG?^c-5<n5pHxZWt@{IM+sv{dPX_|wkvlRb(OT2g@Q|&M?B4-mZ
zSqBSJn7|ef$~`2fIG)a+wrD54fP{J--7xk}TeFcvRNL2$B#!mddP$xet7rG3lB9St
zgX?({6N^bHUY(WMJTI(Cqn7rc5OB6HD|qdOY$KxC=edk=hmRe2?Rob-rgVdB)$01g
z!-#RPN{ia+4iT*AYqM7#0~?d!VYPI1_)$jn5SXaAsoab<*X3ZfEMeH?;2{&DlvoH@
z`BQ~WO=#452`k>fWX`20k5KvKXFF`+;_M#x+b+gWkl_Os1@I@e+A8H4{224{;;*8+
zw9&Wnd4y6pLtLLC)#4;Lu`41baMZCc5jN1bfQ%DZKN(DaRwMB2rHCNs1IMyZU3`-A
zx>VlnGPTe)onb|~NbtmOx2TA$N?6-cdqTf&NC49{76xIHdH8=O^N$)}g9cMhD0bPg
z>3bdI>x%L!S($a&EDOo>rsfKg?|O$S$>+PCE`UKzhFrl5l1{nV8~^faPcG0NEEM*@
zs$O#Hz52NSG{dJlMdeE;m=))L;>)Y|r?~_0mHxX-alsUM7cT=2cJCwLIlT}cRv#ab
z`JXBNCdF$Pg{@+g90lyP(fvd?QesBCT$w7d{=o~s<^4i`U=}GKcSjL>ueWTom%QY-
z-b`9UwgDQS*f8cu*XdFrITOGrpCXd$|0p`wk&W3XydJ5JHh|(V@9QX}|85xrGyj$6
z#EB$BPcH8+?a^{I*icU5yQe38j;9;_0jpV)@HGKP;^bGqFT09}hB~DEvs^`E<NZ*-
zi~D7Wq$ffMo=JBSXEKxZQ+B=MRyAQOruw}72(8bU+TnuY#%%uw)OYowa<$pCrg7Mz
zQ?ZWSlB{LyjJVq%SkG~QF2&K@BaGK(JpTkM_x&>vg?~ctm8&wr?c-HQ!$v0x*1*H_
zs0(FOr}*!}(ev+ln1Tr*XF@On%fR(v7;p|5vMZ}_d^=-96H{>A?J~wmOtURAPgoY}
zxkW0{5J)f82MF~lg+h&Y=*>Rj?&Di>#zyPS5~ADD_xOG_#`*8^ICVZPa4Aqqmi%~w
zzewJKv3+R^5vGN^*^yBERO?+OX&pVscjz^TQoa~7=zpoVYrOjCenkpa<*Y!P{bHJ^
zALmYqy0yy=e&LuUTQkebT9o4)!-VqnW-yC`Lkh5*wbqz8T5k9QGEvx0J)v2jvFDq5
zaC16;2CqaKBkEEf_4i}zO&wM7c!&LZ;bL-5?U)8<oH$Oas}2H<J}-VSS6O+J{Xz<2
zz%+**z~Y_UfBq%VALbpRqBGfG9vcUr+kh9addUK+W~TM+K(u|zvH5yPnWSR!=Y1-q
zHO)53-xzzPm=f2=n$Ql<w_q6Jg}QwfIoCOqR8FaMfGK2*c^)6jjV+x)$7J{a*e6)c
z*!!P7lVn2P!z!+%c0|C48h_Ra4l7mt5jDbgx7~V;s+u)qdTJ$G)9*NGLL^}#D!ib4
zSbx_KytlUYs26S_(6AVj0)Z%5p{da-KDQPcP@T}Uvz^0n$|mISkQ-aBwhYVE=iL{u
z?bvtqIQzyy2jJtV97me=(4Q}^X`D{*KZIDJzeWg?piYKC`mUl_1+1>WOA)_$`xMI_
zUb8IKp{rMFDm^^j%ujYAPu>>Ni~m{`TgC2byPf-MS_a(I5yAKnu8;Qjvstl4Gjbg9
zIT-(9<Eko;M<3<Kh8B+W!bAiUSMmffFq)n%yK8>uJx8}`t2}3AJ#;8FJL&@<mHvNj
z4`$I<u%V!3vaI=U272`;7_6mqpbRN|Nva1YyeFh76!!&)Y`dsX%gf=h&VA*W?Z`~p
z4IHWu#^br8!|aE`c&x8m8v%=RlHd;R_U{&}lEWhu(l#Z!{aEySci!@fsVt1=LmNpN
zKEz&cQd;qo%Be;oJIsDvj~EWm_cN$Z67*SJ>AT5_r`FOdtE`6i{bZVRaSn-{{iH3b
zVz>u4tW&_S&W&H2_`aQn!-ji_T@I?d=e@r*^))J9D!6r#K8fj4?)Mp{4{Re>I?3~J
z{`f<^apHH(>AIA<%I&&XbI(KiL@=xB1lz;h@PA1I3<+cmCZ+(F@tJx9dt<#b0zd(O
zFo`x-ktO&(#|7N#7(e_~G3G^%<CR&Hr1}*dRUtk>B3O@do#B@7r-$3-=SIgb@eb1N
zJLi(7F%U?2@BEbk#2CkO-xdW<rm0u;iOINdDZNgj@#+7JQkaQted!keavQ)UHLjHe
zA&iot&Ru3%A0<l=D)<&C3mhK8Lb@UUvilPq<0HSUOno~<)DK}>KhlYLxyUp<2WafB
zcx+*o_k{a8dav|aEry$Qi^oK?W!-+!K=aXGm@X4yCD94~7mo=4;YOI{WFwwCC>yUk
zl|^t40dEXZ#k-MqSKb!2G{GA6S|TMcJfg4x;4U{Af|a^>fCtm=aq-$OiggnEv$ijT
zW05SgPMbTR_!OkrlJq;8b4h|=GiD2rZY5K1LW@<2HH{l)#0qOf3Zcu;ngd+|#ochH
zTQ`f2C4N5TlkJTq^|`Sq&Jw#L^c`^z{%?XZTy|@FV|3dUE@V6AUsrdk)8tOU&VKKj
zj=sx+$0!D$J#2M40zD`Kdke2A<PPkKTb&k=$E+yc=wc%*^cnAOqA_WvCNZpq#qXPz
zHg$=#pFa$)>3KkAHsJ5b1csi}a+P6+VeJdrH00Ah^~}o39^eUk^9HXZFeXi4g{Z+W
z^#9w`Uz7oQ(Ca2q)Q1pU*MU&$30>fiQTu7XI~`+7Ou);f<<M=AB>>7;SVm8{-N9vh
zR0@=-BB?Elb|3I0n{jBM1?tpfLFh4C-dlWGrB?!;_(i#6XMQ{y4#%Z+2lR&o+f{4-
z<Q@P1_XW$mK^zJ{0;b?7v>K<3E4~;j=tC|%)<;wj5BqkK`wO<Jk9gFWEq<uAWo*~y
z0P$^aG!fI2w&rpZfl5~3g?PPKX!IvbI^|?8^--BdS1Ate&$I1%SaJvdB8$<#UeNzn
zWO*LMV@k~*jNP}@?oqTo59%d<u4oH!8-w$qqQ-DK1t>FAsz6`no4hR$^NXyMNjDNC
z%pYlpR+p4wWi+Fhb$SN8-qb9)CD_g;qWUs4!dsj6M8tsWBLeCtAy@a6wS4ciHg|Y&
z%Gt@j+p$FF#Vza!*_so-<EIqLzRrt?V{nyru@L41q*7JBOZe`uP0Y`K9_tW&PWzP^
z$J?9ZmaH{NjU<(84L1+%7{g*;5>-Pa<j3>*+;kOl0Tad8RG6F&V<htR;cS?{ugAAf
zS>u@~3Ti|OnaQ@e$-{nMuoeQb_B@l2a<U(k9AAijd#=buCgbDemz)#g{||dG{MXrc
zj|78i|C|}juWA0*#ke1;W{fN)2TdDSIMdU2kk=27PA5^t)l(3mFJb$*_C&!XWy8X#
zM#!XY!xBkXlOoAS7ls%-oA8_Uzl`DjGpuRlAJF-Ku<olhKutr05p@RcJ$jep@VgQD
zSVhRqgB%(lN8eBJ7{FI=f+r!-m&_)j<>cvqNmLs2jm+J=ACWh2WQ!94R%m0-^ZSrC
zIi(8a=W)L`FRM{C4u32BCuLYk0g5rIHK7Zg`Fa+IT>nI?uX^T`JB^o-^O2yr^DfIy
zhx*8na$dbrGNZtLz>OK_b&m3#S|&6~0ZutJuWX-YqHOfV|3`zn6*<@r=G!D<I*7-H
zAWnMczMYg0LfF#mH&mUJZG~lN58&wk(o6Aw?hw{Q96!j&fxrd&2*dd>TnED-17a|b
z!mDQV_Wum09Ug?56EyiexDa~vXHC?6peI%SfT6(3B-Bjn9#;5zbL7>=BWR7rlzT>_
z)i3Ml;1F3mdk?Sv)*TJ|6Sm^ba)mH;O%i0~W_|_26FLK7P0s??53Oc+0Y6$=cY`I?
zB@o;0;@ywhbfN9mM{feMdb;T}h%ihJoZ}#l5u|1(&YTj8KlVuQthm6X<ydG3jS&LG
z?fd(8td1^rp{cV3c%wfN)FhB6a^H9^)uXuxVKXEftE6Bp+%uRonL%s=t@xK&qhLvL
zX;Za`x1|X}^#M>f1)J`1=&iXVA^2Bkn6lph(Mkiig6jgD=zuB=s4*dD0)1g>qz<k4
z^0$=Ff6u(CNe++6D@2O{pp#+_gT4QTE(0zTDDpq}0wY#-DF46t!F?*jxyL~Z4cZWH
z;d61o(sfp6x<!|h6)SV}bPF9-CI6BMPBy=e>Cqv<5-D!t0<Rf!;bT(r=z_k3irrL<
zif9_-4*p~c?Qs%OO^d$i$x~5Y#B~p=or^OYrlTVNVVeIuTnMQ#TYmJRu90(9yqwTf
z%$(PS0%i%Ragr#O-uqQ3rwzP7;6Wcq=5}(MJ42JP!djA7o&z;id6UVOmdA?LMiqcQ
zjEI=L_?7vniQi7yI5-WE%O_yW%b;GMX@lGa{u++|Qa+P5x;$mC&I*!LRY?_rYKcZz
zUm7U53JYi}E(oSE!8Gapo>nsO{_kiT_e@cr3CiM`b;8fHMs(=N@@oQKI~i}CYV26u
zH!<tCJH%e1p3)Y%0FuCSUU+;4**}+zps8}a=>Q*MKB_*#;nTmc7fF7f_^>E+`6gf`
zJ&PS=uLg8J5nkjyi3s^&1@P5BjD7dRH&Bc$$5Yy4<rPZssLDE}2@SR5osRd1`;m*y
zlliA?we<luJ^#Nj=Wi1jP=@%eG7v7QrXmQY{=8*sd0H?_=mN7Io_X-XW=@hAf-%gf
zj#XG<`F|tz-#3hL_kApza9fqRHgD_LU;dn6;v0GRFsWA}&#EIvV8~7-9BNkuBY%Xk
zil_N!G6O13$G*1}u$vrlt#TKB<#V8CZD$+}#x64KF+$E_lRnhzqlxIv@SEbY1}tPt
z3b<Kz3!PHfjsq+y_#!tyWao2oj=febafBYoiK=#B1%HB>X!BMJ&;_2Oa6iIZMzPdR
zk&+c{PW^U)P-2xL>d_QPe8}sfGmDG!8zDfnH3V?V&l>WARCO-yt6k&f+iJ3yPeyF}
zJrM+fRD%~VTZ^{pgg^dZjnXw$(Dv1KNuf>QPvN%0h^)`WQY96DrV)I;eQ-jY(lh*}
zN)?>Yf@%GC7|WxI0@gyEAf*8HR^A?5sKUB-5s-gHHYm#IV5>{)ANDq_Ol$ngAZW(m
zWK2aEq5#@8E=Y>e&^77K;yGDoNVSnOr6Y<A2Z4MDqLUEGt8r@yAej22er&cA&%kNy
z&xwT9*LO8|?J{(O&BrXJTE29W)*|Um3D+!0uAJ#jOq@vQbWoneYea=H+ctT&I$QX5
zEGPH-76q;+taL%h=oii&o}a%!7-qcaqK7wf7Nv;l?OV9=u8iqzIj1eZ<Pcw~>%JVz
zgKB)1^<dPL%17~+RY~1)W6ekSp&{VIs}e`?D<CxE7hITY?)*cWa9l=#()Te$4&}J;
z_wocpa~}{Dl)ebPARJXrAV!<2+H)&Mg<z+j$Q@2s+UlvUZ=Sj6&~%Vpn{`@a1uSLK
z6C&i9>8&YPx1WX3_}Ac#`i;F<ZiQ{-w7Co4DdR8;%8bdT$PQ#-|MDkBp8cha#~Gbu
zg#&zYHE&l})D#t3Lg9{Z8CLq8{0nLR2a)vHsm$HS#Ha`<O6pX;a{sUKiGy{YaDS<!
zLZvuKTUZLs^f}(CO{FEOWJ=|$1&JyZBwy~T7S=oH=Fm8)K3=QDM3OH#2*UmX`uVmM
zpt0K?u*5#}|C`tcA_4IKPwM)Q@KA1rLFj*E#{>r~S@>TDO9vx;{sHTtRxoGjYd7_A
za81M=@No+f<HLNoA+_yq)oMuwW3|1=5~se8z%2<hc3>Ep0v|+t2{%HKQO6@g7Fu$y
zGoXN!bxEp-S$UF0?UWdStf1YUPKEsQ7&CLM6o(-nZlEV$ht}%DZU3?IVW+n3C{iFb
z1@QFtjk-7}bYY3T=r5-dn+H66RJgnB-{f?i{#06VM_<bl3Dax?*{P*h<w>S5cO`(D
z_W5v+I{deJ{POd7NZQqHOf_xQ$|vdC_3uOoXy$9F7gNFS82qr<BSR_4ZA>Q}@wn)|
z5>ayS&wGZH&!q~!#^AP+8-@f#A^5WlbPN+&L>S8CJ27Pu?hqp%<v4cDq>$0n8O6Z>
z=M}T^s%8pNrBjCXtPVy-q@|6^G$wz8Ar2W~w~nnC;RefW`y$X78wl<;1+-@Ok?CQ%
zg@T6mwAokR$Z_?L8cwzxjW{hf>LZHOw1$0c4|BJ?NVq;_AdIlxC0B#bB#P({AYX8(
zMdJI5nFX<By**8n|1;Ugv#${|NB*M;Bzk=`9*vxu30jZdC+V_AgB5S1yN8yoc?2Sa
zU>wU*qsSuKqGF;~B=Bw(_m*mj^l@@garWW?G1}~QRx!;QetE};WT8@&Avu~1U$VGE
z9S=}TTc1p?q(h=^8P$aHP@3!Yxyp$^wsh^eDehj#rIbBJ+r+o#wDjWKo}}dyB?g&6
znJr6XgBZ1~%yEFRr^A>&hK6~D&Gn%J$$%%~M<+)bD+~Nv;~oULPx+&p1b|KN&&9?v
zm}$He7(ECmJa)TwX%poUvhS2Y>nJHjxo7<<(5%j`pZ7AL8mnx#Sa1QbgZ@TaxRR^}
z^I^zQG$_nyM$!K3Ue&^ol~00+^{op=fo<fb2!GL<7d%C1BlO}YNPmSRw6{&PboTz0
z<UlB6avc348Frf1fsGLVT*7H_NXb&1HCZQ>Tsuc_f;Vl-o#}A^J=qQ8<-EN%dR4WN
zyxLA1NwY2K>2Zc)zv&k6*0%)Mvp-y~mn4-bdachVA6cHu<2a_G9;;g6f(JuTto@nb
za;Ad8=MI#s`#ZQ^z}N2qzgd+TGHEpo4m3n#qkxkS_o#SyQk?rcI1js3kOAx_^}yj9
zJ0{7~sNVj@hi~oKKA%ahqW{W5@w907wk$<w<doH)B=IuvwC*ss!aFWu_@$QdoS-bl
zx{Q&c^xeV2$WPMLG735URjyvFt&o+*hdGB2@VvWSHUkmhk=~t{mBw}&(YHZ<Is6x>
zlw*Mm0kL4lpK`;wnEK1e^71K&_I{ei&ZjcUDxG-vS;jn9>srqu!3-b~7rYW7`r9Qk
zuu}5$+((;f!`|Y<j@=DqZP?NsHW&u6V-DczIeG7dlCqa=9zYF<jWv%I;x_s&a3$!E
zup}f0-IJ;-zCDEB-94-RxuXTO*>03Rj%D<rRyq6#n2NHJfo7!Y$D3IPpAs>MQjZpy
zQNKIZfDDUglLMC2IsOQfV4kLhKZfYYZih3NOxe#sAa%j(ZhexekP&M+>`E5D)ltxB
zTL{F=B{aig3Vp1m!V)>`52?l><QdA8k{2Iobl|8iu|UM=#Xj_>3BR5kJ7~?vSv!72
zdW?-_qe4Ull{`n7s^$GBa7DkME7!gJYlJ<>doIClh7?~=NU^$mX*Z8Q`F<)wT(d}V
z!Drh3A-G&bH|#A*x0t>xqcgCFHG*~~S;R(DpPQfILyPzl!bP`%{IiAOuTfOzB#g?4
zuQ(XjHAwj~UwIg}$tuFwN@qCqIxCXF6aSp&Ko6M5*Oa994WmaD?Wf0_xiiNI<hO6D
zD$I~Xj`^w<1Gru(-vp8~qsPCR%6&qm8}b{-;%{OegzRs}7_UAoSI%mnzhd{|EH@SK
z+;^)PYhfN<q$=+z^Rg|;eieLIq~^G?02T$rwqG#G#2r~}$B`|mrIO6=B$)=LReyWa
zc2NP^yAU##yDL(oXF^Vp3GpYp9%v~cELtmLG@Z3XDIAxVfxvTfC{mdkt$~u~rpnkr
zwZ^lV>P+M7i{)}v7?}LtTS`GU*LN<sVQ^a}vxZ2<Q~}{@J>oi1lQq1K0o`*NCZcHx
zatQGi7liE|6e}UunIVrEO3<f?sfdLxb_}^ok5J*J;@A)^EZNFlGPKh*TSfEHq*0Te
z-tg<G4Y%NxK2Da~uXso7$~GobBcb50eV<6Y&J5^^-~Qlcj#*hyY74a8bwA0T!yhfk
zKJtbVKYlz2ZTLpi9mr6mMvX9;OFnWc7={(Vw6soAqTltRUFl-HGQ<sj#mIMn6+pB<
z|6whTdsH4SDt;@wg<-TAGWBN-D&nw1`;M)YO{a@1Ad-JkXX!1Hh0B}Fi&R!E%j0+{
z77o70y&>Gc{lBU3n9?oe&Jm>eS7zi^5;s{aOITD<2^8J#D72?cC{o*7Y8Nrbx9cK4
zT!d<WtBFL=(nM&UN>XW*Q5|1MdmgA#?#ZEjuP>Axmti8gt~fcY>6hOLuRLqh5-GxF
z$btFef;^lz{mec^?Y02tdZ8V!JyA_R^V=#<NwhoWv{6-3NxuTG;~Yj0bwN=xm$pR%
z>T_~=ex<!3ky*vcqSi=kI%oPq;E8`(uQ?b?;D$zPi3l~2RNd?ChD8bQjE<xrJMCfm
zyvt-IJQL_p`6Lf*?rHHG13!aCtHwdRNmZ=@S{usRK4yTWYku5eGS8sx<?Otmet%l}
z2-BKyWM^bQu<|U@TZx$gV*9%j7r)yHeI-#G39U$ef{w+KKk?VIZdnK^S2$ILDBI_;
zgybYhHi{Pd_yTV%DL&UE{j??t2TdyE^O$lgB0x;lixyzVN6c0pcbM7yG6sJBvKnCT
zYLej>cMX$$((W_F+ZF#w+zav@NKTI%S4RBj*rJ?fvbA{xrC4$durBy2*@U1^l#83Z
z6gja8_f&_qyXfz6pg#o{pC^*k5+~`sQ(`4GAyYOd$h*c>*Yd60O91lvldG8Ok}Dxn
zlNOUdpI3n;R^m8Y;sExoZ}3<@|GuGJ|4Gx})>QJ8E^l<{q(4yV(>qJ_cuZkP0VLp&
zmArR%TxVh|b>QGkPxpGmi^o~+qq1PU9{9Aefo*cmE8NbCeYdXRPXCcQUoGQ3bAHR#
zZ6NibEq3X)!q|N^EJ|FK-L+~?GFj2;X0`Ibl`aRnk|)f#GQTtc3Vi_q6ra1p6C9Xv
zdQkT<2;bR>D!qG7kkwz;d@?_PaRbfyleRy?HGavSu-1HR&z{^-y<3wxJ5Y8EK*Q%W
zja<ZB1vXV{H`phM<@eOz_N~f3w$BTiIht{S{yw@7muH3hVn3BIlIIX#qIDop&benL
z11Ua`s$^W&7tB=~Q5=#R$;Y=FXgAtgELNEycDE4V5jmmsjWWphMCk6jk%g8-76m+C
zvzSzh3s|!0?S~&!YC7@fIAe`zTxj>(=;%8eL@%%x)p_e2CtgO0q^M-IZs6Frq7|pe
zC=?6T%C<qP95+euOIPRQ9s@uj4Bq>Kf+30t6jkT0SXQbIsUC>d{1K0*#m3d4EIX~e
z+TJ5MBRX5floge66?a2(U)$j)@7%I!K?})?$E4xepF~S!Wt@M-14B_bKTjxr5&KHC
z#k?$gmM-x<UG&XG#ERm>4FV8l2qt=C)Q$->i{>4g7`DWd8&ShIO1V$e!v|p~yRzyc
zox~DP&7;0>trk95Q<rXGZ$VyZjyza@RPfG|Rh!Q5srXN<(Qe9_l_wdpsDQx-ti(B=
zDMp#133?dt)Gc`^y)^u67wcK-e0#|c`9Bs-fANLR$=_#bK3M#5Tqxx}=MJ}_2P`xn
zD|1A};771Di*lihBpUh=78yztBQz>lm+~Xs>_pmvdgZJBiaOyPQJ~72cy(8GkYQRq
z#keMo49-*|L@QGrum1*(rW&E5VMjj1?*mUaQ5B|^g0I$dQG5HSMm|=TR!#W)W>ABK
zBse|h##Ysu5s0+)SnoaaPj3sNBc1dZ`+gxSR#Hx?W5oIh$mPlu8oR3SEKn`|c8^n+
zISEuqg3vi$cv#{vhx~SM+_FS>4)>h@D=Ta`-*2dr!sAX69p|S*a^Vvd+>_gU3}BDD
zubs8!q6{-KMh^TCU8tPJeK95_iq=A368;Qb4Mf=9R_s|8aHKv2`Q4V&=(oVm;jnzl
za~63w0$($>+9i0~r4z6sfg|rJus8pHlV-8w9;_x`LsO^<_=YLWb?eLnXz{ilvp}pj
z+zwy4k*m^`ryS`<{1Ukgt3rK<l)C+lDPL$y>uEs;*cfHtpgz?Q9%ek}PPk+R#j_uT
zYMPn#rfye^E^F)&Sr+C+Ig2c5w`>7>HG2TPW|*m>;YAhoi3nP=x|mpleI_DLKQqQ&
zV$ZuYjcC<Y<8?G{bWJ5Fd`AzC5SM58Bi{m2#P7uC8fqgg`*Kh*)h>wWui!Ev)78np
zgy!EfK6fk%m|HAr{Z^7kU{^EFJuCKf^D-?&_Y%7uUc*U|%3}oB_8l<-K_h7Lic|`}
zH^NZ$a7YQ`_)}!H5jJO|8VE&Vq0aI`txL7w-cVzrun}-|lybK;<`!RPrypvLOS&|c
zS2vf@vf_#*rB08kB|)8Alv-n=O_Q8Jao|Pwf`I7&-N$cjMx0tYo*sGN4!}9dEbY^T
zY}}bHx;@%asp4DB0}gY<yLGSO?cC4D&i=TUvswfRtd%;SdSjSr{Raq+$UN)o&8QRP
z)=Rt}>7Y{nXlV-}XZHfi0i;n(_BVjga>cvJ^hVm{b5DiL8sDTII}M+PyP<EyVz`;^
z@RxFiyW=w4=03{tC#`ym%2H9^(-G#A${K?skUt(yBu;u^LSBBEI%`icYGia{oAq((
zRHF4Pg`U<XW9K|!HvKv#oAf~Y4I$`5pYLZE9O_y*Cq5$BEAT7z0;Gg|%)jDbBq>IT
zDB)OYOzxt^U?-4iptIlgup!OBsFD4_&Tal_;m0Ev>bo{Hbm(*f{imNcELKd^_1ux+
z%&_h-JN1a6&X)d;q%n6ey3L8$4VMoA+mA`W5bgfeaSFPp#}DbQ_JFID18fEoI4sPf
z!N6K&f{#ZW;0R3eB6E@ZKE2XQ(u>MKa@Tc!0s|+LomR$mCnAN0&=H=S@2cje^zVt6
z$S>8$7&C$Q8~VNWd>E%PI~}1S$#V3>&h5O=WU=!V4`T1cx4N=B^MoO{`D;pd+YttG
zUM%&({(?T%Hi>B0L92(_N;CcnJf3nmHgdhdIz6wnuZ8GcCl5{TUCqb)2T_^SD*n2k
z=<maY6hGC6s4Cnn_`-N3k(;94b}n(jnexj^w=Qs3JAS{=s0GJdv8IA22_GEmYAiW>
zcZnvWg!%`^c=*<SFR3oD%D492`6gUogCU;p&0)nyfn%{WlqJ)4Xu{bP(ryg;-Du}e
zfnpPm!e47Y7RKX0nlAC!-nlYVx}~aRp+BS4i28BlU^+qR)LRzI4)cyBmH@j=xk*pa
zu!XLfZ068@d{R6n2V{W$=rBcWvab!+vWs9W8Ln&A9{=Q21g~Z!P>ilZn~c0hSfR5+
zEh`Hl)ybFa9sT7yGxaH%B&})M+q8L6!x=h|u?_4EH!QPsrn8f#EEsA8*_6o(M=i}?
z-m2=uKFUugE;m_19%W%2e&r78(}O?h(Z6KDHkH7Sgx>XGK6M@!8Q*l15KH8d$*{H1
zPx3MyWpQH29N>HSzk8X%YuCU-V&6DoF|L4%u#9~v`x9EEup{#vVW17MvlTXvh29@L
zkWdQ)4BAxX=#AX;9p58Gz6wDy$f_rwM>8b);{MD8XtQW>IUcYgz3%?Z^5*6UxK3!J
zF0{=m<ZD$u3{m{~QYGlfRv{5b&~D#n?6Nn+;}(y7OJ-OSpiQbEFz=W~{I)lS2zH`d
z<R64uR&N%I_TVJuOigxAi(Yg%hPRV2FM75R<p8-Mjb!Ui*MZ0b2p0H*qfsof3Kh^L
zK<dI7V-YrsyxhkE4IF6(>*GWS*ya@j8os1I#r(C~^;s9m`b8|D74=?<$-4G)lV^~*
zZ|%237Fi~3O55;{+SR$liVYuR=5^PB*+B|i)`+Qv_P2ceoIdR8b#X~TpSTVdT`~5%
z$iI`N)7{2AZmoy%9;y|$-f{S_Gfcl#6cYVg4t^pYm(P!O0p5M*)i1hR4_ijnZ2_{P
zm3DAQzh;PD-xw7UIIn*V-Y<QSeGT7+v^uVKVkw@`Atg7OGRI+PjGQYuSc`VjUmuqG
z5jMmd7P#=x8<ya3Sr79v7gJ$o=IN9%4$gE5l{=Nb=4^!8J&u4&r1CG(7JcT&EfCi;
z_IVCKh{r#yI^Vl4Sbid4HvwpvYr*K>*!|C{##7GM$aQQYivrr^Uc`Apr0SSZm!$p)
z4p8K-tv;c1xEJIW&83PDun~53p_X*aKeqOXxhcpWpRJZAkEm(j_t~((OG{u9aN1;c
z7(lH8HSB36xOeDDu+V7O9sTG+P<l8TP)Uo$5R~@ARhoG+75~+I&1z8LoMMSUq&hjP
z(ORbXq1NXLLlnb931cJk7L~}eR%3&3B+cu*#y5Te3%b+`Uv4nCex`)uXGe0aBe!im
z%)p@g8p5uO29W(+zj-UPrJ4jux4mTva>FniN(ebf@adjH_N`8+S5#LVS1?+f%0(a~
z!~TNK<c;U;rfHpRi?H5+WB%|?<~;s{CD{yfMD#(1B^45Ncx=EXw1~z(c=cn9<uB5(
z__fSNvxs){Tcyp|p5Sq{RPDrjoxU3q`DCBTGDOY&lW>u&%XeXx7hc+((p<$?g^h7s
zN0cC=yKlmH)|!~_ouy~<<FTpllhfQrPH7qH$rynF)MD7r-#0p#0CGI)Ya{J|2#yOH
zs=R`*EwQ6LdxmJu+m9G*TFv^km|Xoj%BwA1z}k`!-KCy=5tY?5`h>ZXC#MJRvKtNi
zGK%uc2`-N2dd)El49lK1?jctBS3b(GDo5<CZE}d5mA$u0Liyq>=C$}#!}-$J9#&bp
zUF91OgR#GDl|K)VAdnNw1YQsc`+uU}9@qiDQZYe)*onSH+hcH*$_4gdJ{K%O?}Ju<
zC)xTyHVknxj`%9(u0QljT!3?0%^O-c>FkwgG}g2>D8D=!Y*huOy+1{qWX^=Vw3-+9
zP)b4yfTF}cV#JE+H?pOse0f1Fgi6dUL3@WGTkF315wKM~iPdsW_PYa#2{-%Vo{KYy
z6qq^t&c7|kE&aX}xpE!6w~pe&UZJ^uMF!`2$p+wE#z?s0#J>s;)X_)VVd>WyAcQHJ
zfPR49gGVmPL@&Y_SWB5XgqFT;I*H%^Zc}WCxr3ZRU00X6(d6(-@V6^uxeIim3n{A_
z*bINF&3-+FVBf!o?R8tf_8@`6VQz8!+(K@&>`ioU*3gZGjBytB4n_QzU_|~9WvfJ+
zX%<++=C81!QZ-w7QenRpA*Sees({2KIzbK{Sl1V9Bar;xFn=Bx^R)9<1hn0(^XtVi
ztoXAS==fEph>1?X_&34b4twCkZj^dEiOpFSiM{1aoNfb2O$%L31uOHRHZ)L@kDJd}
zPcfQTBYOs{Oekp0aKr23><_rVsgW0<r;`(izjKQ&rjQ-i=Bj+~WX&KA&0@8_Ovis;
zRibV*lTZb&w{1MpTV&7Rt7HY)l*@a?_&p{KV(2?45m-B+EjY-RJ#gd?Zr9Glj5DYy
z(=RwE>T}`4zQ5U?HeOqElD0^lKJ9vh@%%FOavOg+K_KN)Z=!=Rsg)&yRF%O<f#DqI
zsP$WfsU;_e_?RD*B?zi1EXa=0X08rRu>FB5*xJp)RBvMhWD;5VW!-}?`R!77i(A=P
zkKAaunO8+yGu0SEI~!oJW`(GdHHU9VM)i3W*kFc8-dqL7wCF8M0$NNO;e8WosXZrj
zmj5|6ty!m26D_cUwZCR5R-Ei2?97X2pIN>8nY6kw<4c{P<iV0oI>g_7{YwRJ_nYi<
zI!g+wh|oo00TNNThXhS&Ouxo&ek|J+^G^hV`Zo-QVtSMw2Vpn&cTxDMkd&?>!`ASZ
z!AarBMC_v?jYkR=oo@u6Y-Z^9LeX!l+?IMoX$zJMQO}j{wB;n8o1)Yul*T4HqY^)D
z&i7`Ksp_AFG6O2ztu@6`AbH24ZUk88h4B(STTQ;N40XnmfXerCjV_a#o!*U#g*qzJ
zqR^QsKv_AJlFhAKFJLPoOE?9Jt;Umd$6??W(o%fhf~k1EFXCt=ilVymTOYP7SXMA1
zY5JgFby=aB@j-kwkmj*UdZ!TxAn*3U068d@s&BtQNF?C(M4jlASOd-n)Zk_Dgm!Wy
zTPQ?y%6vd+ES6EjIhZ1xak7sdXos3>(1xF8yC7q8TF`ms1Iy0~3I_iSP8g}cq->07
z+Th3s&x0p;{(*am+XcY>9u$iTASdghZjPccb|#iiAk+A8wPi?=ZKu3(5OJp~^@No)
zJ^#mOeWi#$1@h{drxOCS$6MCs0<k7m6uV`cvlvzaGTaJc`g$sC9@+uMO|A^fuGhoQ
zS^2jTB_GSoK0N&9=eQ>i-VHdT=borB4RK!e%Y8k4Ps|Xf5ogb{MMzzsp|k;i%9168
zy%@9fr9#Z*Lr^`E>cW#@fKsw_ihtjOT%q6XgHbEqW``dw+Xr&420MDr#W~pOmTD(4
znqm)(6Q)fG9!xdI0s49}8tRSrKPQbp<p*w+lM~`qM6hv+*$mbEsVZqm5Dh@y3)ov$
z@3V&OB0?9`0WN=txcUKpP5O<`bTp1;u%@fPYMiZ;4rHupE|)ie=)*o5=-aCqbn~W~
zbf&Q&vGdj7RWP*pu-dC(7{KYlp024v%VJX<)IG$Xr-S=G3wS2@uT}k7Vy{PKHNa|-
zy*dHy>(jmoMKoHp{E>esxX&_LaOqmQPxjsU=jjL}%fYZMdhOz1<m=3;sCK5WAiG6m
z%+vIUZa+B+Oc4~57fbaMLv)cFBKZp@Opx3ERoPibwbiwKy2XQ*V8Mzzl;9AoxLbij
zp+JH|aVafUBm@i4LV@5`q%9H(1&X^Dcjp0$7xz*oeO{YyzHip7$v;_ZCug6mmE@fJ
z?DM;>dkHVa-d|A<)%;N;A9LQ7l%PVqB{BV8E;sGr8clUP>J{{vb{j}7Qyc!a_(t@+
zA~JSHuKK>f=7Zp6x#D}>Wi})y6ex#srK=d|vFb}ZJ75i&p^m13*)x7=zmPHAHFORx
z??!(tq1cPI&T5{yYPYCFm5Fx^n%>U|j5SRyw<O%|jf?AyOg+ZXWIt51eqwuG$YzND
zX2@owjV&r9%GaiHt#+Ee7w0pO=W&&OxX=vz=z}Du;mo@?DQ^{-9kUuW05#BO+<Bd`
zq8z2z{&QIM1h~VUYX_${U^iXm8*Ne1a9kIRE^@73xoonitFa?+PW~_)LK0-iP*Ja{
zyCwP};nwdZb|O@L&CmLyHxcE43GubgZrkG)*5ge9%o2tmyQc1_-v;|wz68|l&Y#<;
zk)2L-T5Y%6jQd?N^IU>QcZ2ejh#$^P6C_t(*O#)QG>+6h4raZ;V3vO6^eq;XZOnVe
zt=D7py0=b`-R1W^0Z0q(N^{aJP#*%=)L#?UA2y_nBZ;fr6}~x>j;V@mARPOU(t=ZT
zVB5kT`C!k6m6&KB(nqE7UM;=-L)2n{FD28#cg2DHonC_yi1_ksOj4+7@5gsUbN*k2
zoR%2i@@e5i$ul0`y&PR9$pUJLmBg;&-+!SykA`PiEU8@n6!oIznphjnR_N6j=-P2^
z`(Wo<?QTL3u{$pC_y#fcbmq8?V^E%uH-wpfd*HQEVB=UwM!|NS4RU@WRk+#^8{B1^
zQCVW8<2Z6rLK>tOcrK{ednM#pZVaNTt{y4Z(J|spCNs{UUu!pXrs{q9*Ut6QNPh-V
zy4a_DiyME(@#pwdnp6>K9UgG55r=43NtwcA{poD2Ajgcj!>?s56%B=qtabrMJ1CO=
zF|Q=I4swoJY<B+eTB_To(buD;=2<%*V^#gB49t`mC-LT(RqL^9YtB@}fOCYCA1(LK
zMv5Xxc~c&Rork*|ak}x{-nzHWdB(wSeMmD^&Ss*~vGFCws3AKo?*+i}J*PzH1QaHO
zbUdw&qJOF`i@p|FP&xiB|LYB~drB~A=!2*+`Hdg2J7rUA_9ewfg_A0F7s^1M<pn*c
zljgdt&8!B9K3_7jELF+_FhKddUHCsJ1g11@SPM``J*Ml6&fnBxt+CYDu~TWz2=N+=
zqZF4pP*sKO>HrZB`j_R&vJtx7-=R|7w0f+=%tGf6rgUAfN#X)MOq&UxaH{t2^T_iV
zs#<dk9%x=Si=4CQB^`tdECWOLGhEfaun~va4)mu1pV9Hfj&a010~!vG3hx%$*o}SG
zeyx3K>CZr<HdVMhs)%aNu=x6H(KIb}iy;tVo^RCNZ{IU~JmTL+%k7}1tz{z{>B3}0
zCQi?~D?pJVsF=c<!zd(R{HR77Qpj^m3$z;(sUGbAV54i}#6{^;8Xw~W)OhAxw7p{(
zZ&)wPG~gW*e>NU1HKUZV@p{JpC8_S%W<@4S>34|zQ}NFty8tDOJ|^X3IYyrcOLJAb
zDX`nnj#9Kt5fot4VTD=u)X1tN*5SW{(WAe2;9P0cL3GnXZ2<vWBD<c_JnIT{86j-r
zlxKa~>3Y2<>W*3H!JXC`DdpEQI3P930W}u3qr^=IJG;SnZt}6&m!-dC)$KaSX1^e9
z1>=%=QuRL=1Siju7dn;VBeN(Hb<DU5Ap{48R7oBm64xv3U`>JDouVvp$-`qGgZrd;
zWNobDMdwl`m4Y24n)+XkzwSjb8ffNod?@Zqwd=Q|oe$>QPa?6hJ<Go(5@B;IJZVR;
ze+fMH(cleuJS1mLGe(Iq5=Kj}kB3(J_$Rv+?<ZF=yXBws_7|Rt_6vTfOd-yobKzoC
z`oR*7iLduBGs933b{YjE`GMVU)P#GZ`x!IZuSVDPYOm~@4cc2dw?PTbS(-#=;O7{_
zzE(^?`|k*NWu&Cu{OFUdd;#bTB6wo9o{1kOtajObrm~1-y=fAShx9wc&fqc7Zf{%(
zku#hD6NrhLS}UAA?B~$tz}y{c#iVaA5i8B@e&Ro|wB`)>?PK^XL6Yvu%R{Waxz)I=
z&OV~~w<uMtcX9=PwJ1nY1wG|1{xCdPT*Vd~A86*U;SA2ct$NVl_r2@ZM9t|+YkcC3
zoNN=rhSBM>Jcw8m@A1d&Dpi$6IR)do&R!X@rbJ>4!XU-i1oB!1s>xBXX5b151<LCF
zM8z-O{5s@xmItt#59d&vOZ9JWb@jdyNAdoWf*oHbun&^E`b^|KeVRjeVmZ-!QiPW!
z@nd;EF6Om5kWRF-^p%M-^EcQxAG(D{XG)QllltQ&oRA98<3u4t)7r59bnhbkbic8V
z+yZg5S81eK)~?NI_z|e#6YeSGEBr*B4Ls9xubva)xa)jBp#*@^n6KV5rTQvBXVcqd
zFi`@d@T-IFg^4?kwXnDhS8l$3m#M*NeOy`YIGMBGK)6Hd8c%K#$)*oUqmz8Z{w!&Q
zNd%~r`c=_&oVP^bwV8jKP5-XYL@vy*PY=Es_Y=HV5&JS&b`?8OB(dr7wyAd01c~e3
z=Yo0zJJF08yaFb&Vmz`wT1N}C&?#hEc{m&!{KFAnv~omwf9VVs<n$n#8bI6K$~W~;
zX$$20oj1?yM$>U;>ETcXLkX;1SzFEkKf_gs;M{TYD`<j{N;To8106DU>l9#>SXQ~I
zGur-z&}Ys>nN8x8QWS}pCIUvPVS4v08TZ+X`Y-fiVF=j5NAZz@plv;H=jAKuy6`>}
z3Bxd`qt%SUI8Jobs}jK3IX_aY_=K~nt1i}6zxFe=cCBCA$avW(Isn&b_bG*}t~oRY
z4%a>p(44`Dsq!qo@>bJ{D;Er9jUJNaxB2D%_IrG1_2j@R|AMjP=5CB99CDX9w|sx`
z;Bi@nvWq#wbjiK&hs2XuIU*fw?DhU6{Gp+>Bi>ViRP>!lFg_+$|GzN|>%eosFW7hZ
zKf^P<81CaY+TIg`O94{Rdw;bgp?ALJrWAuerA_6k>gh~~Oe=KpUgZ{L6ZvwTwJWA^
zr69;uvxMn-7wgDnk~X1Sjo?RU7Ozhmh;28u(g>~v@miXq7mudusT$d<DoG!jYGB!k
zrRx}e3`Kb3L8$<iBe#|#ysBX)r81=z-=Ns`)?1F}46)C_#9xXby6unoYIK4@6-=sO
zo5Y4mPuK-Fph3RX`WLU?b%4Fz2qGI~2~WUOCst<)SD8}!)j<@4>K<*v+TEoA*sJIU
z343KE$7&j!_GUhxd$PjEge@_n4|UQCG%K8ZS7GUjyai_u_1M1pJx-oX_>rZ;(n1?a
zPn0SU_f9a9j!=BM;}Yb+J577b<z%opG3sLc21ofk%s!Ze()k(LS^=X*O(u9>!F}du
zO=~AQk6kAQ77fD9QGNkJ(L|WFDQ@|9k$UsEc9XEZf0T=06*ya=6bVyy73IXKRoxDI
zZ=Xw+x}FDG8Di(>+8G8v7D-~&=X(yc$M+wd^<}<KAC^|pkZVsxvOZcCJ?hj^LaGF#
z(Z`nZT1T{TYF*pn*_>wMaev4|$Xpu>NiHDPM;`{s&U%*Qxjn|e#&HSO0tDQg3;4X4
zR^0?ptbFkk?7mY#-l%4(fNn@6?b=Wkwm#I7!Po`LpsP6K1K6bmSUXvkmiQKrK^b%$
zM@-%J8*?7P%BZl_r#5|qja>z8m4K=ce;96$TF+De_{8*^ml%fJqWN!x21YyjUlLf+
zZ2t^m-DSaz$3x6U`?tPU3aajJN0K+(z!t>R_}_kKjrJ;VT@ZTVPQTvQ<@Upf%Zp&0
z_brV|KaFCUWtIlqzQaZ<;L2NOp|r%sk3Z=f4|^$azeTcCFrEwGt=8JnJi=3eQ1mAO
zvrQ!*Yj>4sxY%btcigs9$}eDr?J}To#x?2@1;a)`?<-I=QW`a0Bf%4dG%B&*WLLRt
z#s~Gn=F8+9murOysrz{*5*WSZ_WRNGk_@rJ8Ysc%E8tWeB`x5WT!|kxSjlVJSR#Ze
z*y@)Pgzd+J547i&l<NT1Ke!DciZx4s@bDSR0_TzqcYwI;ZFR%qs9OjpA$8x3dp0lC
z2-{5hc~S)2;%l*MWd5DU%gk>hJ_>rgZ|Xw)#vWI1VbX6jkEeI1K%#1ow4`FzRj&M1
za^Kb7Bd$H8WFJgocR3wGw1c(2W*!f7;^!GKOAsathI}H$^H~oUvbVxsFP2H4!t;1n
zxg=sfQ)Vyn*dX0}e)(zprAH_6rH8UqpkzKnWnL7q9K+E8>Hitg|G&atm+p~lDdn*|
zOzTQS<I|tl&9m3xq^>cnYNIhAA7|npE%dl-6hPds?OUD;(RB6?G1o!Nu=2lv;)m^+
z)$%?>o@wR|{O2S8lKBQ&)kRPEn+4^;<~gbj_3oHw)nN`hl!HNYG&=mB^Sa*0qaLop
zLtZ%$pOmR7=7*}rmX#=oNg3+Ru;ai<9#?foye;t1@R4<ln>FYFvzI(P{-Gb45>75g
z-3|MzNcEW}$_?r__<E8^$KSc25B^edIMw7ASQ2NOCDNaC;;1%6f}v_3a1v+}T`%UX
zRG|FKG<yqsx+HW<_A{Q>__-J--S{&`Jiaau<#69cjU5K?h_U%AZuhE5>In~8!i$+D
zN7xgP6k)RB^th~0M8C^aIkRgLS+`<Bnk>Twrc_=0AAwX1Jokqb`*&6yBljizCyM$9
z%zWP7`H!bBu{nY;b`32KL-4JmJW_H!q?OVH$VG(-SMQRWCyJ6MkzI758G}}i9UI@)
zAk%+p*M%uE3i+E@A>V*Qj|VQQw8gQj+~=(?%R^C&QpVhG6iP+98F#RIl1K^EvqCw(
zI2|@S#KIb`p~q`Sru-RL7cZtjnsz!tV%c<$4L`DoVV~GAtol^b;2mtmxAl~+Qf(@d
z6!J{8dMZ57m}C|21b0%CHq^HTt4Sd1cJ9feeO(gc0f(<8Q2l#|)l`JOjk26h5OW!s
zHe-b6rhmJ=nu(-kEteFX-nL63Dc386S%;emjpR~IF<ul!VO-mw!>y2`i38GK7)}Sa
zf#1|GSe-|Hck?D*a3j6Z!d~g)+}A%3BexXx*YR#e5m^X%SUDgQ=rl=at|-sE!NBak
zmmuFpwrh6@4gej2UY>~yx0p7=%5f{!tzVk8Z7;L)d*VFbb5KBm$o0Nx_;>)l^M{%7
zVla-I=dI8>9B};;j3H2iwv#YD8OXX(zovjs8|FIB&B(Nq=30&I!=nZ3bBD`oK&QDh
z_Pux*yL4AChQY&pk8S^``u>4n_+gBz{}sXbA8}(0YijWeA9yZu**!~+d+FV7R9vz-
z3>bj?r;7alp6?Grg28R**W8oQI)FS7g(Q8!#S*pcu3s|R_-$*@v=_0Zm-5?(LgW+}
z9`;GS>B9pe^U-N{daP|eUQTPw{-9%DQ9EGY8<`mwsqm|qY79o9@V4!u?=`Ws7k#rq
zf>7YD)8M;aaKiZ&2Y@J7#&TE?){5ic!=xrDl1U&zEbmECWmtGvEQ6Wrk{WQ5=k?s3
zNmYLN3Uz6TWo1VFH?Faau~Gh401T;x!or}XfAYD1R~g`c6&sk8?;rW~GH96<W*&8R
z;07~#%>1KK7bie8&$Rh2GVY^>X(}q_I}k9{-DPd@gm+&LA&_VUd+qyNMtr1RU?SJ{
zN}}@g6369zpPT>}2l)$NQpAP1?GqPuo$ejeIXSs^HK~L>%<876L8r8ip_ae7a4YAO
zZ_L!@%cJsw4Aba2oJ>`2EEH}mlx`Lu-`qL_k~AC}a7q(3D-q`{@6TIgBI0BFjg!%0
z)s4IYDyA*)cstz5gtDZ8RN{doAR1X?&Z5zsKO@P{)@RC*40Q_3L^r~x%038#1^|U2
z0)^h+xLE)LPIp?sHKClHFUtK>10_gG{@hyuZQX(wvHTXD@Qe3q#;qx1&D5Nou!kFD
zn!1HA5|CqdrrMiq+>b~@jUsc602Yzlai*QQ`|q)8P(ydW*4Zz|rAUxk-B_Q<v}o32
z`w4P|e~b#@7xtc9jyuTZ^h0-XkMbK&K9c_SY4o=FYbEu)>NLBVo-eAIkAONmL&!w)
zHFwVN8pW2l7j=<ZA>sU$VVYcJ^kGuqBUotl(%SV?P)1zWd&y5k0z@~gMGv2aytL@C
z9=mz(Lw-`ccBrF)pqU)yi|;R7Luu`faUh$D{rx#QJCcqEi`EYFy!&vFLi_91po^N0
zEt8M!FT;FBKTEi-X>7J;)g0vx+mJG5d_sQDyY(Nt=!u(Z82$EAFNt7x1IXD?+KE%g
zVMu#w;af1=o4oTw*Z1VZmv8XfIt=G;Et85a{ePg|zp{ZpB>O3M=)Pfq?>GN|uKxPW
zj{IQFC<dQ?67D&>e~aF7j{r<BTVo4UuzZ_UCxMObHv>7nz5NDN=)<SbndI;^E?t|Y
zj(L#O<b4aS@8LJICx=o24Dmk;pb!^vEY>Gz!xT7Av+kCZLkqL2c{Is8iIIk4G0sI~
z>)czBt);KBkZ(Ax0+OKe`PBT+X+rh&ZmnNLfz_aI@H0|KtgnzB_!Ww(Ue^+SMee>L
z>MaS;JB-}jJ~@Q=VZ~e8K!t6o8#@wlLNR}1JPPo6{q>ssmeT@Wna&M#WX#n=+LxF#
z3BSPAL~W2zi+ZPl^_O^Q<e8d#j<JXAo9tr-_@e0xpR{_clSI^Bm(5-^i{nxa5gz{n
zJgry|R@y>@42VOVjE;LqdjmTh;t;c2X&{*(;(DnvO64#>W{<93wbLTrkNAh6H+zzt
zZif+-8u&idv?Ljm(n7ZrEOUN()$~;a_kA9jR?L-VSvtB(<9jD<uu9x?T7MD@O7+WW
zJryYya$chJ*^(d*;*xBg@yE*4%WkV4=Yq=5-nVB9gl>xCWHr_h`a-cbgS@#Q)vowN
zwRRqPCkGhYMt8R=npjeKnjE^ctF`4eONjXK6jbL$vmu4GD|9>3Z_Uoxq(kjLTjYKb
zVL*dVEKP~*a|jcf2w*@W26NYzqlQSw!TZ=64>xQ!Dzhs;nm3I&?RhB}1u7o2T@A{k
zlK82nVl_=8S3QEM0Zi8qhgtfL;)%NsUsH^>2|aKFJjv@BTx(-N(bYy=P2hUuuYsDJ
z<g~TpMrOTJM^4rgD3S9kq#fcGqwX7SlK44cO%)<$Uw1<lxUvbuQl7O3GKZcN&4M3F
z(uI>{bxU6ViYz--h_noc`fYq=c5@rnZ6EApp#HtP>hpuRn_)iMEl9e<cFcY-|IB+#
zuGN3;9tf14AG^znguEtHqSjX9>xkcav$f5|iaGM%bYq0+Z~06fz49kkG2;yYAN&3_
zXVpC^=)pnsFSiPMSOIxrwep-g^A^kDx1O#;+ebkUVR~KLjw2Vz6cV+nRdw-yOI2(;
ze!I-1k_1%2^u+gu5EfQY2kN~`tobVFJk1PYv@MY?V@~|9D{ok5l)<ZGQDw&jj68w!
zZ*1A~NDNrR!-4mEGki7pnEkoLcO|ufpP(<l@7d?b+`k~YgWBaQZ^3}`=Pw?xyEKq#
zBexsK`8sr+^#jU%BVcRx6D2MYDFWvGPIggKu7j}J{g}Wv8Z4lR76}Byt0=}VIFfqw
z@%KN^){}wc8Y%c`nDm&!de5tbR_|Y@optuE38FcU0N3*`RR(JINAq8MpB_pvpN714
zKcZZ$fV~hgb(iE)fBLiuwhcUAh46pJYu#?AXA#_8oD0E0`qE;>9%Z1hp445Es#e(x
zjD9li4mSH*v?j7c)?>(0Z6Tb=`ECaJT=h+HDKRZp#ep){__^c!H|arFL~g|a;j6}1
z;e84eqrS)(xN8QkO-A$~GDT1@72aO2Cvj>KWC=p_ei*nJ<OS6-Ae{~pBV?*xepjHE
zKJWn$1!@B4dnn5W>)Tv%8L#Vbp<`M4uQKQFiByR@&X>_ZW=SKGhaq)Mq#dR$<lr34
zC43i;-pJ=9j#6>UVNjxa1<_KbLS!~Zy3vh4NY+9)@RJc1Aa1lJYa>i`c*#8HSKEHb
zx2l*ve9N{qHj7gxZI)kf20cAAL-vs=fxF*e4Z6%K$*#+qwjV0_pEb4Mb7CV}x1I7E
zWi*Gi>*0$tq-*E5u-aYj?su7zNu5Y(UxxEwLzvtGQPNf;POoKwUPAU(<$5WzYI~6N
zDMaF!ckuc&a{mfE80>YA6R%0=FIe?+H0A4}tjvUzCQg{9OyBx82PS@Za~lNy=@>;V
zVBBI;Hu6cw92NgOX4?os7DU69HIK-q=*dkAmmMs<$@Bee?>PPf!pVuYtWE$)7Rn=K
zFWSQUZO6pS&+(eB&q7sJ016ZDJ1D-vgYML|wL9xP*Yr#D$=CHw)Z!U-e7-v*n5=sI
zW}3N(gf6p@Zc68smxrG3$5r07!kojKAI#;q6v728t5LrnPdvEv6#lyb$9pt+0zdp<
zAV-qHbN>W->II5%!X(&a$FJ{b3gNz6;D^5_9PKt9Nmddw&Ruk`2QXC{^0M_MTHEXy
zBF_&yN^i&&Eldxl$3C0GMh6~>i}bX*I6g?xQs{YyH?3kb`f|mEU;QmqTFkLlgTvIz
ziDb^Nx_bg&XeRwoeThQ+P9`}C={fES73O{LvuC=k)WQ$hLKRw8y)00@kAOcwo*#Fd
z&cn7ZqV1@`s;YW3I;W2F_is(IyXZbr(wF@FEHBr3@1_}4w;w-}@uRsf8OK3XrroeI
zdq4b`pQMS{JV)g)Fhlt!Ix;C18<JotK%8pRL6OSYY2%cxJR{F%qcI`BWiv__w<E5&
z>4_;H)Kk$4YpX{J#_jwg4qddcx;$oBu}OQ~<O6LYj2+Z8J3<41%3&pkBN?X?x46(=
zXl49jUxE)1w6JOYT~!r&Zxk!eSwb=On=~$uS&Xt|J!#mx6YI+-v@RuUK*(Kr!0kx+
zG`Ox&Lt&(Wj~!-@mO5iqYJbRx*>QwV<Nc$f!{Yr}f6j!^O0v=73ZC>G33z3hggr-J
zErtKo*5pY$U1AjvidvxHMFz6mioLw_x!GMB9MD1D)5@XAyH1ol3<;4759yrVl4u87
zq+~1IV+U=>Qo5>Lwk0>Kg}xuoiMN@n>@w0bmz2|MTbSwDa<Yqe`#dx*rmZ<G#q*2Z
z6SN})+RqGINmm6@|8mkp`Az8feA$cnsWm+I6?ts<t$9otX~qP<-{1x%&5}3o$=(9n
zR56=|EoiJkCB{k1q@`^FF-M5+b0mIdg6gPKG0butcVc4V5prm|Y7-}5!$UIj4p>hu
zbY$H@mV8{u3-j~@#C)E<h{Xu>E`BbB+pFkor5i`w1<*K8)WOm^&$xsrwB$qA`Leco
z|2Xs>V--O|;p=>ii4{KT?NQA4fneMdc6KXX98L9B9Lz`vW|-j3{X}rPUI>nM+jBsl
z354Bh`z@SYF71$-nVjth!P_XF!^F2yg(6s0<1FNCGPvrUl&{p)JI6dj0wC<xouxkN
zodg(i6Gd1K1XlXE2#GM#52|B~IH+<cqLXgOJs>X;reXBSl$I-e_`}`Bs$M#3ZTZwc
zx{ZDC&9IC!N>_<l1C+#9lW?|5CNwoqyFV`$sUTwGle3;6l~>vBzfrRn)Jm#Xy$zvs
zBa<&$F0P?^!vD<=SYzWdQtw0o%+5wXtHF=88H1l?<TF`^D9N8%y;6OfUN*6E&O$Ew
zH4E{q)*Tj@ON5-Ox}|Hg&LoquR3`c>DLF(4L(Ss(gU&+sW8%=BdrEfI%Bg+quZHCb
zcApJ{1{$`m?1(*S!=}Ec=f4i{K22}JYi4>vxw{5->js(DyF6e=E-KZC{za~Or44^)
zpe5>VA5s&f*1EkXkE(XW^RFw_Isjxe&C@eR>U8WSXaWMT&F6#BW&tb~?SVrTN^0Yy
zs3Xfqu!lF;P#IzUw_r}0SZl@A#`aj{8T}a(dhZuA2hAZ;!)`Ftv}v{5B2a)hy<joK
z)1&?s%@9#fN4tBfK0c>T>|4TNE&LIOS5~6#bChLH0U2>zD@oif?)-=Q#;0^6*yj#b
zcIq=pY+yz(h^<16K-MADU|5LN1A^2s%fp>)LpLxY_F4dU>tJFAX{?t$f2<8PdO>9K
z(QHD{J8alI&%AwWZil0G(V9)zc^Z6iDIs1J;W(=~N-_Bb*G$x%M8tti($b$ZDgms;
z8YF0MDUXmVz|X~HjD+D|50%OhPhX0%kTq}(3JTy2Nz)YA2pWpIk721|_t-cd2ED30
z>#P>xgV~D!bt|ZVs`Iak13OXsL{NJ-<(?^GS3HOffoq3t^rE1+^tsrcECXz2E@Y^R
ze6aXc2V{hVu~f~v^F*1KjV^p)5B4MIu}b?=enpl*y`bE8jy-t-9)PdyI)0=78J(b|
z*PrG(U7trJ6v;phPj90xVZb6J#zCL2H{9Ht^ZA|^#-M)e5ll4WaCXqkrrE5={l1of
zA7XC3@kwl37OEL+2l#AI#fd1lyqyG|7xZfWG_40#o)K62eo`VgPEFGm5*Dnoe6;c6
z$AxyYxIy^B?h4^4?HV$ef-_LnYO`|dpn(vhZz^bj(MawEFuU}?W82m>qjyT9J~?Se
z8Nr;i(~S(uZ4QzR$N844viT4@0i4F44vfh;H}rF#Kh+&%(H_c6EQ0Xmdo_6>lo7{G
zU>pP74Sx)cPuqWni46&_+FB>e@#R}TQ)h$ElFz<qCn8Rl0d!O}b_F^SBfh6$?JoMk
zefw9V(*oMw1B>8`CtXkqj}lghimaB&TRE0ULX2S$tPqK{u@{BqlBWNNh{Bs2y8FIl
zD2BUr%m~WL(KrU-G!1)2-X4J4pBIg>EEsVNK9U4=^`~zBqqU7pbHFbTfMMMFd!xM6
zwWFj>23?4?MGMAv*}W?Pd)rqcb{dOI(Gg!%#9jP3_KMwBx^PS$!T1a<OH>ns=AbAo
zc6FczN86!UkS^*Q;{J=u^DdOIZ~}~l(t^5_DwO2S;NT9wX)^BL9!eLy?m_;6u)=3(
zWq21We?JoW{Rel4B2UKGcghK4)Sp`IZ3YJe$-}-tEva#0Rs_SWs0Y7eS&`2?P!npb
zg6dLhC&VLCDuwz}_#<{D+yK+Of4bWI?egx@O9sF0eft&#FDXf2i05XK?`9Sg&^Zda
z@?G0{$L6?zW)Yp3%*$rOpO~D${IYWH-OBD7jUp}>m{yq-``=JvoC_F@G}*&tzTen?
zx~vQnPkHwsjK09M7)UoSB5oP0vIQ$2UQ4)lP`)|(d#9M*IZV$n?R75W$(eE<3!jq;
zS|Yq8Gv%ZFU<dCqGfOYEHvgUx)34`G-<Cg<|6@D+gdB|S?$77`_t+X2Mhfw-m;Zj>
xWi)1O{y&>w#)AKJPy5d%81e0YpQaf1P#)+JqFLF9yLS)s&`{A;E?0zx{VxvF|4;w`

literal 0
HcmV?d00001

diff --git a/docs/dev/pictures/dds_security_authentication_plugin.png b/docs/dev/pictures/dds_security_authentication_plugin.png
new file mode 100644
index 0000000000000000000000000000000000000000..a2b3ea5445a42468c89fa09ced08378846776ced
GIT binary patch
literal 442005
zcmYJ4byyVd_xDjGq(K@1X$5JdySuw27m!9+x~03MTe?}KmK5n-QeuH6rI*H~;o<Z9
z{_*@V*UUXL*Id^fbI$vm^SWa+)fI5DD6vpbP;iwLWwlXIP#2$%1Wa@klowbo*QL)7
zUVPP7kVdJWc)S1Hcx5N0CWV61l!Se6iT2!n?WSn-6$OQi@W12581sb$3d&QNlB|@j
zk2xYA%~WrfYIwQ>DkN~V5V33urdUSc;i&2&`cR~ZakvPjq%|ACU@-O|Itk$qkso02
z$-_h8Rrl2<8sT(kNWt*r<V8XI;7P#Ru23Bcop=@j<S|5=>kc*63J`bk)m-14^mj)#
z!S)ZC^n5HWeJt5*B?4Q<5-u^C2#2QkstHn-%EVY{44TQriDADri5b5Yy?YeG+6+sk
zr3$$xm)Ni9iWalF$ZRp`!U6v-U!>z7;%_2sjm@+G`Ec{ckXeTNyqJ&MwXU=0n2+{s
zQs$##ljF7gFf)WT?P(ZYZker!3ZVC@?c;l-Na(%mflMx%AJ{=kC#MF!OuxO2H)<r>
zpR$AWd8Cj+<Z>=4bSzo5w@#i~xxenH`uK<jDjgr=xqbDQZjP!sv~F(~4Fg@si24IC
zSXfL1g~j`3E3TBT*4N$0GzwNiyC0lIg95OVXkhCb1G$YLuvGK+pqV(I3INz2O;JLL
zh)M0egRC#4UQZ<y@*eJ#qWJCPsT9`zbVH1Vg|&hp$ufsH2_$72te+2oxt8IxpKl#f
zE6)JILX8;Ti2`e|S^BVy_dq|Wvc-P>g6wo-0M-{ID5Y(`Sl5Q)8GGN+jBCaK`~_3B
zCb<GeNsXt2q`TKd&Pa~qXrrua{xRS*iALHXch4YaG>K~+W@iBWa(wUsDLOYrVwc6<
zTd&{9{wE9ACynS?>*;@Yev%|vX8Ho=+<@Lrss`O=vHW$!*((m&E5n2cH=u947Nz{6
z_X9^>-cht$N$yC{EyswtJG_D%CZXwVOk&g92Ec}2-#NE7TzDPSQ}wOgaiCMu^wm={
zYhM2(J6=X8Tzqgm)e%F>d17mAn2C_izioMGIO}63D6}GLcSQ1O7BM{#^ljz_wir`(
zy<5o1C16DB%wK86MrtWF^s=CrUmAbS%K>*w^=BK8KeY6*a=8W@IBjQtz&|*02Re0#
z>$RXak52SwKA$vHE<BS-D=az>2^<2yTP8FYuOA#i{`<ONv$iBayDF}JdgdN-!E55<
zE4pdp@3(|)gAMn=<uaMG<Ocr!Lc;4mJ&m`>m`Z+T78kjK_zpeDTt;;B4Xyge8S>Zw
zPKy2f@EHNF!$eM@QdNLpI3k$*O84P`$3LeW{ehEJ4$X<Z2*9D4rB-Sr8HBF)cVCi2
zZ%1fU5=fMsfnqcCf}%;%k1v@N?MEc)2TR?uC={j1aa&}ge_W%ODeji{2kY{QN&BCk
z^gAxjp~VJvnhQ(hSpRxUI09%Wbp*hXov<d1+tdt@xpgbkm%ux0{@p{%gVh+DW;F4V
zg_F?N=^4GUNfgfe-Hz5&q%y_s3{FGR_qPczdmfZu)No-0KbVkV<v&WMWh;|+wu#)v
zKTtYzCRW32dYv2Zk^EXYu#--zHQZU&{UK*3C-ILUZ<3D#E?VwKMA?=VBd?a_RGRc`
zqS@&W%;jzu-y28&E4eXb$%*<DVI#Zow)P_<1D01~Npk%A=ZjC4`ik<z)y1<bq$^IO
zUWb9V%5zW6L0WgS0)LjX9!6OTE&d(Mb(txyaSHM^&!p$24oN7Gl2{?@OxjkL+?otc
zIhw9Go&Ajb%v1}-sqtw<lM}naKFhsx!3otjf7&orR8$;ltilM9#c~N;xhbcU5>JZ5
z)#4@L1s5kaqURc(R6?}Qy>$t$2k#|K&IAr}tK8TLX#+1)TJ(NuS&uy4o%EK~#m0yS
z-YS~7(h&AMt~f2J_h02lsdR3KF{&OS-{8jWj{db-GOl9QvWAdu_9`TB-;JiR%*@wp
z6+H@8UlX0C^WXJ4UE``Ll^&gQkCf`i$p>%T`11DTm6kHl>U;gDs4%Ej9-_(){Ax~n
ze?QK(YTg-$eGs@xYbW#drad6w3hq6l4?E-QPR94{D7y%&x@nM@$-?xK$RO7EK3^PQ
zm{y`wq5k|zKd{;Y)|_ek1&f?&me%Kkg*_%YIm+#A->-<i`<uQl-;e?tE;~FfN7ABF
zRC`B|8n(p}pQH?`rU6E|YN$d?zTu}x#NM90!{I~p)fmFH#}aP;FSfCf>v;%E1MiSC
z`ZuK?LD)NKM$F~*Mr||+xtcEw$+&oA2O3Pi4g|Zdpe1!az9^&sO>ZS}oY2BfOuD{1
z@qnY9nC1C(ypD!yzG!GUOxGB2I@I{da)Y2yrc{C4nC$Mqs1VrPhl9D&<9`y7U9dU{
zYr7&o+3`t7sp5&XzLF}wN5a;`vJLN}kU^EHraQy;eAgJx!8e(zg@aN#{|t0Y4=*u<
zfz;~EN#EugN2i?5=MJIupP#T-y6o?eo$uy+t0rKZ=(9#K^}P8h2Q7K(uuaNYrI>o2
z{N#gn-C@Q~k91Gjl5rktW@^@Y6^t@ri?}$Rqs+Zu;#J6{&HDljqNAXYuc~14J%oA{
zaKzybHP3PhiL$Y=G1I%UEH_7LPl4cSxjrIclBd-9p-X7>gC`>G*Kb8jtc>?Uvegzd
zU%68Y;*yCOwXEKKkSuu>Ty@VFd&P94NW9CQk%`$<pzW(jyv31`i#c7d-JwXl{c(<$
zkUk%a$>XE!t681YaM=xwAI+Sy<g?Z@rPAMc#6JEm41QpG80a>`1oT>idY|e<as&z^
z4atgN3s3ZjUuaGu1c`f83+v~^*PDkNf?nLzbav_%C$P6Z#}Z+ZIR#%1KW3TDLK6M-
z^AIBy^dDgKrajr8!<>qgOi<N<h97J+j_Wbk;-&A)ousTI7QHo^v)k571ZcnG^dr2T
zkl^DX+u_9|8nLk`#9s^`zml!8_$$y_F-%BEXhwfd_9u_X#N&r%nb3wH>KH#<K=EwR
z_H}8&%Mw~)Iwk_myk;~ni6_FuM6^#ci0Z^Iwm{`ZObWV?-4y5RHYh!LZD*1Vz34m)
z<Ld2s<4zI&5>Sh2Y%mPwN+>O0-VYf5{aevwj<Y%fmOV)mlHYcu0^rxueD^C<SRyIp
z`#cX{LtV(LgI|tpd_#U0@V(Qjmqdj+w)Y(`hZ0RSogo~PuM_pC=OPg{JY3l$>ZR=8
z8B2s?Fzs|%Qm5k&exUfVJKlw*<^RPfrV1V)=sauV1IvwnpOG+yzV1h`GTucENu-z1
zK7oSLt8Fj=1}QKneB;saRK`r^XY;rC7nd`5raxAjL*x9iyo-fw5CRl#CPKYzAf*tT
z-y_v7ksV1u^~2RtaCw<bWE71sv^eeCS5!-_eTVSt@vrepkr{BJ#1{rf<{mXpVttry
z`QYUyqzd$BSUuw|z<5!m;dGki(J&9duN9_b9EItoGok;rp3Hb9yV9FLZp^XDNjr`g
z`EKNv@1_0C?<k<5pCAzfI(`UpYWlRIEB`Nk{GkX<lli**@bsw+Z?0J!at^=Hs-=xN
z=<fJUmJBMcd<(}if?j#Ns`iw?zS2=?NF}+hxSXl@j>P8bNP>_X52#ot**wRh7CxJH
zkDuy<O~l~uzGwe2fg$D(+YsXAhiRT|!s+e(ArO6)-8<0ND!b&9p){Eo&0?x24M4BE
zz;WQwD^jPQoIGdc1~feIlM>q}nA~i0;9D+>8J-rGSu7PG_#GReq1&|(l!2iN8V`U6
zEp4&wNqph{Jb_5&oUtB3RK9fqHe}yfJk+A>xA54=p@bSFmZ&YyuUvNjNvQA_eR>Bq
zx2TA?@&04(*ow@bUO~)F`TB!wBgb0cir~sXO;>Vae;_CSXY*|Ch!Hnm6gjy;gH-2s
zsM`CfAJ6_Rjwt?SU;d}#LfB2hi^asU%Ddjl(}xhC{Z-S;M`Lj;uY+K$Zn3A5f5&Hw
zFV$*ECuP}<dkXy8o&d-in~n|XrZbtg%`vlt;U<^dc%+?()?Y|ZmoKNl-CoX|A}$eG
zcE0R*;CldXcQw@-PN388U$KWnyp?y*xM0g$cGrU;_;KIVwd8b*YTMnPgxvl=Q!mlM
z`JX+vv@VV31JkB;^oFMi_PA_Fo2{^>T&J*b_Tdq^M;dcqJ;)pXIPu2gek>Ak!Q@#q
z=jF-BcIJ|L9gd-~1!xd|8|`_pq*syqE~Cf$B(d72-3H%SjeohXFXYWVGr+)S;yVSa
z&KFr1EfFC;Z1?``!5y+U6`d$eQrQiRB1@bX8E~I??;U?w!UaeYM!__LiIYyQxsCSh
z`chL(KNCAQ5NA6BM?PD5Qowy!No>vm6{r4((b2~%Z9I1)KW$t*ms{%ySnOJ1(W@sb
zP5>uq=`hb)L?sZwp!dohkH9G~I!VENEs`WEkWRUDESJA9jMG($&ugoeEs3d4oJQ7{
zDy!x3LpH9enMZbRJ_UIqV%_4|G@Pt@n<s3J<LVboLiIlh#zNd;U?1o@>=!g}W2E|;
za!2I=EH`9*Huos1n%dIL-9vCxOt5YEdTwS1?5^Pl!y<NcyD!a|O*>Orl&Uhtn{;`)
z$nrIln$N|6r;C$bMb#g)4>=>sqp7XtiGdi2y49<<Z(CG>!!=nv-#?T|TKkITLo!(I
z^x%R5IrA967L@{o>}`+IkAu|&yX*Y#t(ChT5{bvL=-1sa3G((O8fsxr$?^yJ{gvuC
zk1S|8>I;{qk)6R@RnG60v%DkrJ<`ejMtr6`?p!<$LN_j=?0G|@PW&yD0?82OnbAu|
zo)v^4xq#@m%74YHEZMB*x;zCGGz#CEW%3*tvtcnkR_$x}8)#I#!qW=P;6G3;(>f2J
zS1b<{Df$!3Ox~E}h>BAYP59sEzN-ZM!?JID${J2Wfb)SZjE)UTF?o8<7)U`${98&7
z(CEsBGK23zklmB{kJSF}TX)mRM_O;_ZerN$8?u;+mj^PuH*{|QF@grCXg`s=%OVkk
z4=HLScZ;imgxeT-SrXJrHa^v#Y39j~rD^I^ldg_QAsh^2@PuCdGS96t5_?;(Emhhv
z^^EFh9_T!5Yd9)9y{1(9JcXQ2I?MZI;rBNgqu@iXLfPNR#SjEPgBk&0R-9(<N7-A(
z{*69X^XO3sp1X=Hme%9SCkjhO0FcOQd(w<(#Gbn=$$1@+ROp4pa#BHeYD8&hHXOg|
zPKWiF_(9M^%-l+l;^>NzVjd4o&_{?+i^l3&EOr;*m<yNt@dtqkXtv-_;(_Yx&#kx7
z&zZVYch3H4+>tiaN*RK<NZ7J@GAH!k4@iv^?NbkDNomBfI<)y`)!3m#J+QgE6;twz
zx)p#1LW%>^xsrB{vOcAHpOoJI>%SL@Ba|`o^RW2w&1no4kLZVk-9Tww)=hB`n)wQr
zNDZ!%`@Gn@q^~Ilg<)*?UmG{<F?BJn23E4;xV<Ae09mV{xoqt)8V$NEcHCkrGRSvD
z{~C5$<~MLwKXB8r75P$|<9G#kvrM>L07%*ugxm0ISzDl9)Iq2-$?)68L+6Ey=sa7?
z2qLjgWaIZg%*qc}L%)x=d_DzD2@@LiywC;>Vg~<JmyhF?_GRpBaSXQ~e)mJulHd6+
z*KI8@Yt@dJD8Syfg#P&PG4M}5>V|>FMqdUFV(M)llwXUMBg;%VJs;GzT1vP6)I|^&
zb>I%#2A?G!EOW^_CU~y3lOM@vmt0BWt|qh<XKa4RramB4g}427;x`4|am&B=8v0wX
zHLc+A5sw@6aNhyT2Wt$6hno;8>{R2>Bqll=Z@~5kFpHsVP(qohL`Y$|V3_ws`~lei
zieOu^l57Ow$vDNQE}+Gc_27XCzmEC>1c+*8UH`hIds8vP?}>iveKe314G;MKx-8{_
z+Z$<WuR%GOIsIo|ibzkYJ}4rqXa(cVpWVK@dwzQz188fFKTuD)WB_$<VkZ3D@J%~m
z8N|M|E`RSB&15*>mATN%?G(!B(j#XDjd$n$&N$>kBu#A-TNDXv!cVW-=08fM(gw2B
z1#0TgNY~b(3W&@LDRY7Iw15IV3z?Dh)#XeIy*$>@vf7PyAH%wJk_Xf!f4CIrZCXkR
zDPm7b{V;etV{hD!flC3S+wZ!=^N1PH3Us#7bg=^{%mlQ4zVA@r*UFX3RgVea{kSNG
z@wx{V?V<K#B`?P9<fZzjW#_Sx#L|qxHSrj#e1t}>?Mv7;UNKbzJqW(Ca=JHNnt6G;
zA+rdB_0P|LU&DTQe7G~cI))Fx!QSq>6Vxj`fw>Yf>pRfgcK0px+PXUThg&aGFfifp
zV6LX!V>|XT&HP!sGZb`eogbajqt2;uGO%%Ar|nRG$oWpP7iBlRKre>owrYp9mMs0s
zbS+$_&AJ1I(4rrC0l+!J7)Ev6P#@HFi58HK0k&%7Ws9j>6V6xulO}TZ=FAn0zrqn{
z%eojSd|hA}U8YQxuAa`^(BJG1e^)}>tP}Xw_z|AhIv5%ho0hEJ{i{#udrO^J$n?@3
zfk6ZyH(TjA=9al1&z*-?rJBz=dlC2kvuz_}WjvGft68V#YcfvrZ*80pO@B*Nn|BS3
z$bOb~Gi>Y<B|6;>fYLB-`tg?-$E~*bB+~vKzMZ(L=57jrA`6<-c;s6X=a=Z4XB}vk
zi+_!Lr=C<V;}B&}7yX_J9l9ap<PncZmo#gQN7&>{RF$i7skdgfFQu^i+YByz4#uSh
zvf*@$jE}Rm!Mu-G*m>@*kZEqSJNnyM5Av*KRCdGlYjOfKET2RQ`1@mX)z}<JvLC7~
zygyr9X;Dc8-LpYg%PYeC@ey1*lkzKwr-#*~$g9&q*MXShWkHYw$I#;p0lz@)G{`rq
zjd$6ykXslkZep`eQSsIWy+g`<MO(<a>JTmozrA>Oc?c@97e0*5G^Cbw2_V(IbUmea
zUiD+~5vrgU$?jb30X_ed$WHD7cf|D@7i3tsl;%-I^wA+wO3Mh_UG|PYP416goCS{!
zro?X{*I)1GjUZ5Uy3X)=v%ch2nI_vgahyEqZnQd_vsEHc272|tp%GoShS*CI54yJ6
zrl5aXvT6I(<+|PA3WE|@DwwwdLrhvd8ke$_Tl!lsgG7OIE97O((EIb7=1L&^nxKqE
z?g&2XU+SD290#>q0{Mt8wLa`7V7Ig$Ev4ro_)cE++}DiE|5-BL!s5$@u|GMZffW`k
z70|Lvw{%1U&k2x7jdqw<P=0K%$z#m2jWF-sgfrDj_oRL-xYD3aqIMesU>ky(w7E~2
zhU;VIK20U4T;-H0?DUFiF!Km=^EHehu6KQ<KbgyqKpu~yXggq7SZmg+(MZj`TGUT*
z4~veXG+x2Ev9!VWFA|7}+iyP4Y4rv21YF#wXjaap<ccAZG~CY5y-X##NvY*2+(5%r
zE<xQerkXR$Ba;%j@g2F{B01BwNXCOyuYUq1-kGhKr5WoX{jx1ZtiA`)Qulw+)CIS{
z5VCvs7o+SyhECCx#zPiWTkb2^$}80)S97AmU~_d;nVHj8I_9>S{7G@D;*BT99bor<
z#FsBfo#mp;a$AKA!Kge4(1(1iDhTE@dghc3b1Hx!R=e+rd2^4{NgzQOfXo$vde8y}
zzKftF{8UuJ%m*%auvvDKOZ~6&I4k15(PE`{15$IgPbzTjkC-aZw0VvuatY=2fa;3x
zj?KN8E<#~7&P_;ZX+qd=JRdi3f+Pr76^HM37lsOenDk#IxPtTU&2yl?tUC0{#>QDB
zZ<SKtdkb(hgb^EaE34ae<m@_fpQnWc7z=q+E|Ybh9lY7*F@dhHsLVE(Hpgl(l>Yo~
zbWv)34i{YJ*aavk0yBE%oq$lXm~1iI5<hOxT&5`@<Pl%19JU1Rrc+1#lfdzgv+1<#
z>lAV&THf4LwD$r1WGHj(FTDLqYn&dWa7poPi=SJu%v2nB>mIb~(<_A00du)i<F>t_
z_S822_STq!M<(>9bXcnHN!EoQ{L>bTy<)jRA~hTZcc5mZ#DVuC?Wu{i7j1_o*B$O=
zUFVrL(?SCFoX@{_9_R#<vRqZ4?iO1>9{gQY!Z_!^(9OW9N|u?TuSl-FU5Cl46Mud;
z{`f8gL0knB(rOX?kT3*_@yLelJLTB}uGrY22%LlS?2Ucdo`(W8#gdmv6#47yLf~|Y
zeCgQ&;h1FQ*-g=q_hd~Ltz9vywNy!Xs=ubPO*Z@w&sE^pzik%?-lU_HrIg#$M(5^J
zWkwWtRuFDyLaq|*6aWL4MflAx!>0|DC}h(0*7x(qGz4vO9c28Hwg6G!$ae`431<fs
z*EXEm!jdq_gX$~JoOrGVX`JH{>F$ufOHSoKd57q7cJK@Q2z2Dt*1c6Ig?wp0;zxLZ
zP-$2ghCaOfsxKC~bvC<#Kmik&wto-Voxf^&G_18inyBmz)dZ$HAa$;Y^F-~#Q*_jP
z434&Q!`|F6We73k!k-X-Loa;RQzxJ<yuV(NsY?uw%3PhTBh*Go=$gOe{q_7u`mBfn
zEz~LAo+l)#nv`+8;7R(OGnu@e{AWw_`Ugn}1Tfr;f6^63$U8B8N<={{U#=sdT8#%d
zY#J8$Q}lk;DdDJKZ{{a<C(tD>$hy4$z|_9U<^JT1YPzO@XXh=ZEPD3s373rL(JHkA
z9pT<g2X6u5XUGwUicK?=gD2OFkjL?t+Ye0_@eWTSVekF;6tT!+HeBa6a%nG^m<#`%
zDzNi(ERd!})!?97qm)-o=f@R5&sRe3=NA>^XKQ^_U&}pbFETF)ZOPg4U@Pqb&a$sH
z{NG%<!l3mN&#Si+aCl~L0o<EuVp=o%(()@T=r3)6xw<a;JS1D%dA-<<!+7R$g4+1k
z)*t3Y|7{g0`p~3t5^3<K!MxDG_I;H|{H+SYLkijrff*qQ4L#$8xW@6{A-REnwHdS7
zhoJsd_NyfyZsYj~AoU^dXAwVlrHjPO@Rt+FHrF#G-}X`sLv1e>aS_r^t{1?MUPrZ5
zYmGMI4UM1@k2pxHksXe6UB_bAR5AoTk&5DinrYYN+dKYm`ssC4?J#5GID)gqj9h9t
zvrh~n=@33sKLVBS%k)j?+3a8?buaAa_+N7rK+<*}ICYDk6VFyLY5j)}do|&Th97ld
zQqjdHlaL1c(2NwbA~pcr#E-L3(3kQP(7579nACP)-Q9}y9Q$yDmoqHEsWrMrJgZ>-
z@t#dV!+Nsfov%$Q0zNL}CcavV6mS1R!6EU(oQ^9hw_A7Zr2@{MDqPhAcv_(=zwMqy
zo|q?g<N-s<dl7I8dRARo8I!Y~S-KKGxEmd8E00I<?9V0=GgR&Tp^I9az^QPvO3seV
zSeqmhJSAy<XAeTyeT(G>*bQIOhwRRikJTfv<ReAPwq*-lJ8gl6a!>>$V`U>bpNfM)
zBm%AxF`|wvy()Jpfa_K;CsPv=zA!U0Tdg-~<Dk{odk&Rb>?tJ3?(5`+Kwn2}cN6TI
zGD2chZLKmNY&6B~tk@*|1Y;n!-dr}jaTVNKN|0;alDwFF&I!2>$^V@=ZY-@Zq}vxq
z@x--#Rnpg)GFS*s=rX{v?k?ILVG`kK;}p@Be)1lv@5i*NE3}1@3s6#2ks*&(GW(zF
zFBkJ1u9cm~Ov4hg(HE0D$PanREX{_bYoUfApC~SxgsnOBZTBo~BROh$cKUd%N%d_Y
zzt26Xvnm{|jc#$W${hRo0x4BzK3V3~hnDRha48#vTP_iQRLaE(Z;3I?E03j<iB#-O
zU^Guw)6&#@w}-2%pAKkNC2?+5LjKW)x~%n-UM?$^WWlx*+S>)+iuz~@Gs`+?<&5&^
z3BrVkK*3MD!Pj?pOXRyEG`AdZwjn2@S~IZz5>biGf8RN&rfMJnVPj*TK?T+nhrhjN
zSLQV;r?lk<)722zV(|WJJ0U*RYr|V);_t7QwswN@Zyp`NA{TSoUM)8gQ(<RX$<SmM
zR7^t63q|m;*6#7qtNzOx)L{Q>q_-m#Sf+PG|8D1KX*7Y81yCDEc7~5y#K6kw$JQcr
znp!05oItR-u8OfKrJ2_=?lasogfo^ibVTE;cS?7P{!0FeU?s4kh~n~KAODR03}A+N
zMt%l;#&5=WhH~c14C{<?D%0ru(AJyPcW>XmC18tvuQy%7B^x76@BvHS$CBU|7Am3f
zUedbsXHm{eDa~TCm)K$(pV#qvUm9GKw)cV8DY~%o){RbykJ0el#@nJC9~lI9C4Som
zBguTdMj(Iz_giRD(IV<>7fz#(H->#X=Wp8J0IWG{hT`7dPmc>XuBuZHxWPx7GI5{9
zrKrOkZ1D&Sgir@uRR_P-nH8O$?HU$T$rS~@gg1WByl&<eSY~vkOjqFly^>zV*T5f{
zuPqynjx`mZ&6xGT0S(Hi?xG4d0VUC)MiOc@b~Y1Hq0+9SoS%(qJZ-K?p*9`Bm=MGy
zx>TUa>-IjU=~s|^LDCe=p?`|_F35jwcJb6@nB7|}Mc#9ip;iJet%Ld4Hb~xnCjgTB
z$FvVU;Mz8ARI=CdDCW{BK<McG!P6tYFl*~?EU?U?(gpbji32j`4PqH3GBP!v3Y&~W
z76gDQf6Bq$xCY5^@`#c1XX1_`G(BCBZ>Epp=ELRRsUi|WQBBrq!@J!)mt{S{77;EY
z?SuKGka~6ab>?Sfb-d@CFBX@{Mx42z%mC+?4@C=<{sGfLuZSz_icZ;)J~S0K5*JwA
zHyVZ3M-R|H^#j8s#6jETyrAs;{MM!7IUvS+>Yzw;++NAvAoj-4a$Y?ffybY*;;BT=
zMW_1>KIAUAdNprsJilFvC|&aLVw#X$%0w$#A$R%M4gV$pSuds$!+u#pog{f1vEn<2
zO^)z)*Kzghajs91QG0~lJ=1q;$cX^SuLG1H-Q)TN$3KzxTJp-99Bq9|f_Gw+8Z?BC
z4qE3Ob35`|{H>nTH1f{!-YA`~-;M<N?;o}gTJhpiz;n-u8Vi=Tnfwm`{tnoh%gAr|
z0&whI8Panbg;|L-T&nfL<Co!Zutl@qYpaXyrf=nP(f1ZMwjq_$N)!Bs9hl7HyYvLB
zhKjSOa>ug0Zv>X#$O`723O>ES@pfkXMQdGt^NZ3Fcy%mRwkA(>A}7ERckm|xbovjw
z+G8}z0?3qO27d+uWIo+lWQjn`e#PPFzqL(t<jVtcqjZxD6K9LNEg8EYf2VN>rjx#$
zW6&6J<GwvODYoRltvnePza1FEu>-WZuHroW<F}?txYEsoT(r(43k7t6QiTP&njx#U
z{G^iu6YD2C!3?aM#J{#&`zEd5WK%zDSK>J-Ily7gM^+vY)BBbz*fAPX@Qvrz14FLf
zx?Pzw1<Yw=WR;SzAJ;B51={+P0;cL%RW$3a{((Lhw=GpU6&lO0|3i-%=5EEh5RDL&
zC4kXkvUCo}PR6BBV|^CI>5dzo)*yJ5q&<pc+@gSSph*in%EPajb2!!#K;dOib50Tx
zz1mPf^`6Vhd1cI{j-xs;um1prwWpC={m6RRMu%XOYGqd8E+C12IiyaucApR%!H$x+
zb7#3z5Wa#CH~ZOm*025%XCnLt&d}vw;LJxFsf3p0bxj};^z*{~<Em(WZe8aQN`>D|
z9drd@*&QYQ^(m;f)S+h4(Llr38f0X%`}f^DuIv2Da=DJt<Hd3)+vu_Eg))ObbQTmK
zVp8BVju>N``u1KV76S0kpyYG8R}M6a?D0uB$Sj^5pTd{8fA;{C)|DmBX8(Oh8wR7*
z!~_IO(q%ooh_FCn5dU}M`O(CruaPf|U>6{rp7ufuNGWSnMPSP;lb#a&>+%(G`Cu{E
zC(?)y)9+OiWu>%VVG#{zCKH5(U0V?UMx&G9C%EB$TyNt@$8N1^Q*e4r1;#)d)AC)|
z%$1jSA{XiT`v6Vi&Y7G)j?U2xSqh>)(TmlRLi?4cKN`k(HcIoMj>{QykvUjp+q0_5
z9n5GHJ3nfRTYG;fY*M<VI2^p#=iQmH+nce2luu^8R!QLx9Quz9nZ9%Ei(l<M8Ec)<
z@ByEm`WRQQz^T`Fkgw|Nk#6q3ICi^HKFIh{QgwCw^*tY2jl$LN@BuSXUk?l<vQ4S&
z^tuU`MyxX?3g5MFVuI43zN<^*3Z6|(`z;>gv|phY4^uhvE7oU6b7|c?QW}IHPqEeu
zb(ZY9Vqge=9uRx64g?WOC31Qdy!;+&UmnYIx7uAZqv1#RX~{_*sSNqHGq%<w>?%5M
zMfzP75$!Ol!v;abgc=*7I#=2Y3^jkVBoDH~`7Twe4MhS4<BXKqPxnqu1${);OEq%(
z29M~L0xLp9>VfUvkm#oe&wu)Qi7*6oZuv=epqD^pcIW3kr2_JJb5`OufCrJ8R7nK-
zJeOdQ4r@3VV#{#4s%Zb}D^g$%f2Dx$FWS{gjbE^|k$n-kD75@56!T=EmvcI(_k2{|
z{8q(=MaP5-e6N)=t@>QEivhSQ{NrBkhg0MS-;vgMpU9^r5xYIapfX?HzIME#m8^IQ
zj7_9owgmRlZb<GtJ;3dzxQs)y&3eA|=X`nwKaL2$tVC1$@-|Wo?YYd*iY%hJO$|3j
z@!lNrOX9OH@%6JN)1`yf{vZM`gAgyl)R&JSdfd~=^u$FhhDQqAVKyZRYYucg*Z7Q0
zBf|-a(sL-%<{T(xQG{`iy0Wozn>Ccbad?4Kf1Jc<BLeGB83B3*z0%O|7wix%ad~>S
zxWLj?C~G&B>q=G3RDwYctT8zYcb1-^)#|m9m29a*&o7PcrEYhD`hAyg-8U++;!)Y%
zt5Oupa`N}QJq}9*xsC1VE&+Hw&Sw%Xz|v5)HCoUMWYJVAtBvD}PZyQhsKm)eH`!g1
zGA@+KX)hlUa=^8ZNX!?&J4WDF9prC4<X%WR*E=C%ME|0KcP(2KY<#-N)efOti1u%w
zv{44a&wXG;g)>#MKb(iSxqFgl_p1y0MYd<N`bM9kwD@$C(>6!!v5GFcE-B_tujpqx
zMb1%9sMpnPN$*dNZVfR+Nyhl5K0b~(4^7Q4d5e)xYCNVGeoCOztM4f*PRKxL35NCG
z$55^}2FK+KB3ySzGCDFcORT|N4gx(HBmRZe?h+CU%Afq7;e(SMT{=K+R+gmM!yw1l
z`R@p9vPP2@1k(|5wpG*!`Eq3(oYgoCS~9rEX#5Sg1kI2$C+TNNhoM<zoL&UTQtufD
z`C{!$N1^rK#jjdTYUYS9Zdd79W^LwXGZhVU6&?fUd#BR^65w<(W#8FyHMy&j*LVrF
zx*73U+;_d-3_k|d*=Q|w8B~e((_|qz80hGvma20qxj;|%7a9&Vo2Ba1qk6?8)DsgE
zGy2;KrSb{aTpvEf;MdSs=OL=GTF<-SSm{jE+DH2?&?o`ZO#(@;8WSJk8LLXcx^k^z
zK=9pB+sypkTZ$Pvf?bGuA9`ot^eYV_Y`0q_lua3j!_u4~e+?jloz3A8E?=Wx_oMFM
z4T%fT_V4_;{4B>(yYCf^>*tl9#BC?5au8>gk4t_yBY_>lb+yrniQikzsS&Fc`}_MD
z<ufJs6MsiIyp?_p)6V^3DGZ>e4hCO$@5<i}rivVc?!3$5LNpwedL}9g|40pV%J_nr
z<$T*-`g}A&HbWqbz>gMAIOG&BRKBCck)g(szQ86$x!6Vhy89CGeI8^7+T}rATI!3Z
zKt%3@lrwXAu@;p_{!&W&L3>HRdgs!$6lnq6C#1MJ?p*gKwaw~o^3usl$WN@TLQS@_
z!3@seP%O}hoFoq==DGLGEkp?)Y`hMSd<o;k@YfFb8Os9!*z9ta71K>aN9TjHoscLU
zS1AaP9gO`&wE+$}m*kS)xK9F%(`yTxO#j5C>p!;SI{{}z-e>^!P+t7c#=Zo+-Wfg}
zKENPrc3>scHS2nqb5HBUn#ccz^Q?+DI&>~Vx>RE1)QInqy4mhvy=Jl(jc?2n35{!g
zQX~5ztRZX{N2O}V)XZ#VCoCguX1buR<fUCwqssC_SY4QTI-^vZI%SV%*0Kt(d#Ws4
zn>u-~MD@<u-Lg>E-`PFr1T}AsVeS}1u<bBng6D|w=zZ}KzFVZH8#{Ow5{x4Rio2}G
zYDv|2^tB$9SWtP)HfMZP<%E6h{#&>&w>f#4Dz*?OHe2)e|8D4=cbJ=VN<1h$j!G~U
zKI$MwB_@ApJf?^}M2X!f++G&C!DfU17T)V@?n@M`rj~wjr4ECgOd#wRq-9g4H;ee*
zis#3lbW+S>p#)qV(*G8YDQ@2Tz>Jd{yCZY;wY2w12Gw1?FA3`(p*+C<HDKW_XnQo#
zqr_c7ix9?<F0GvE3<&BZhn)iy;C2FJFLKnDW6;K^uZ6@b0G=DO91U|}c7AlOWO2&;
zA_{tXw^E$X!i*h!Ccq>jAyJ5*pO+U4`~dd9eP)y*Es!ESCIB}*8j(tVKt&`m{f*F+
zSBv<)`bo&+^+t;+-P0DA5mYn$WKd<r9_ciZV+GX9G2y8ugz>2Z4qeVRCSji9!3jHL
zCA&qon)$&v<_ky3i2MntdgTk7aTlM@`6ZOuYJN%JvjYM>7vNq5HDA8C1Q$uKr%rgx
zj_m!aHM3P6e#y}uwW8ZUnYze)0#{dzaqJJ6J_t!OYwI5pUcU@_t6l?orF1)B`+Q>I
zVn8AC5lqw+wT5D#)w^VQxL*k^yTXyrXFunVtWLKB+{&r=i*k1fO8q8SVeq36?fkd@
z5g)=N=G(aah$ltlvi$5??&g2c$5hgjk%aOf$I5$(FqobVa6glYeSo9MVY*DoWSb*6
zwKvwQ?()1sZ)Uu3aa(Cz#k8P>FSz-C<r47Ko))B!a11n>XSh-(N^$6hHY>20no`xi
zt{sBXhS{T9yG8v<D>P%<A?nDWWEynRNDtz*4wVY@A6VdiDK<=X#<F=uWv_nnI_qsx
zI=Q-h#muD`|EP@%U1t*ShQ_mv=w-1A#4et;W}Jj!>^h#ZY+ap{VM=70wo63!o#(4#
zUZAUU{E;Hqb_cZfl8L_u?b1Gwu^O+rgO;5r;wP!*2N#|KZu~%Nx|9dTBlI#i?QdZm
zQ38@OYKL<+vt#}7>aU}#xtiZp8tN4C9fdQPaO%EcoB7iu{UZh~hSKl_^gQK3*p?-u
z$#m33G?mp!2*g{WWdr1>d-p5=o{>>6f%+edCKHnH_D6;O!#sA``EFWdK+Gu)R`G|c
zxUI)Rry{)(X@R!;jMp=OH@qSuA74v3@s4fN$$K7!RhXl>Ni-Af+xSs}ZE_(1c*l;g
zfsO17vIIK@v1XJy<DbJGX}EjhtHd8#ZvGW#cax1bQXx{eo1y0U{M1X{@*beNXTJsI
zsB&g8ja!P1ja{+7xjFAVN$t<vSlG<eE;{0ACC1|Gc<+FGk+lKllo(ib(+jw~`m9-L
zhK)-V_^pmhGJM{->2+MusTO-JOS6E5_&igRv@@k$Ziu`uFZY+3t0$;ac5_Md&FSg{
zH7C@1ESlrvd_o0?iZdBTvC&bs>%`jk7pi`S$Huel)8xwydh;+SEue0rAuL*H1wK1_
zh#JpUgtrf%Wl<V;{YgkVfYYk4{z)iYHvN-eBC`DzWaQHG)8)mGdLCBp&p&c+_Nzi)
z6U`2UQXC$o$iaQT!PT<JkGF@`-k~B^&SOW+7yVJbQ)B(`ZF#Ag(e0Un7MY|!JaF{g
zXH(yB3ku-tse+LdfK*sB;?sU^h4IEg*{X1OJ|TT~*xEp)54?nv?>U~!QwnXX3oc!M
zr#WqHZN+OnK)g1&TCPQpZ{`)3Jm5Y?B6?l+Z<GMQuyE?;7~pEg?2e%lNG#E5Q(j^9
z=Z5^rXRgjHm_CL~EW~B4Lm?x#+h4$cN9(3!3`(=`xhyN?s{#_k<8v)aEw+FJBChsT
zQQ?^1s$9~a#g}b&`0hSGUz6e?lCUQ|2pqqnY#bA=?1|4NZa_Bo37B5a-r_|HWan!%
z*zH7`uS9<25xMS%(t`?@BGxxZ1KT@a9Ahv6?%tY(t5%=lb7qGTf;duPeO+`i1RC<Z
z?$zBdFnGB8S6_7dX(*f?VT@D|Z+t1lxCrMaaX}70o&AyrE=2uDd*lQ>><?!~dyv@I
z#sT~XlyeP!Xpg98x;XZl7Ll9`+0OZ3iHzx$P}#BYbX7l(S6{V?K>cjV>sw0GZ|W8E
zdsD@zG_*6jv&#XOAKtz>FPgr<7dOw)f*}5$c5R}kj>68?!78xp7BBqkYoXnjHXxIN
zGut0<3BC1a(QO?rH<F-K%D+7E-E&JRRLIa*I5nP>AzBpxR!j>UaU!B(#$cpd0TVdz
z<>yDHUy9Q9AEPOjhp|s*whkC^y4{fetkOUIkuGU7?Dv9K0p~B^@UqDA)5tS!8JjKE
zwHrbvpH`r=a1i*9TtH-Ql1iA$nb6~j5>H}OMoL@!bL0`#8gK$1X8G7IOX3?=gUW0K
zms#1OT67=D&2`>Vl!uxAF2J5l**ST=Wwsja<%hLZTC6D`Iy^cNpX|A%lTbepzU{?x
zcbWf@vEzD!rdynwiz;`5g$~X}I_$#e4q`YK`__Qbxb}tD4@ea%d$4MkNb?&yf2=Ok
zkFe6Jcj+=^wF_lN=vH;U2OwKg(&8wxB<1C98P8pW6Na`>bz*mH<!tG6mNFDDcIkex
zgnEE62Zo$?0U)!|k9JYlHXfxqG8FlLm`eu&&y%Ii{E4Q=I?wLF`oC_K__x<_s$ebJ
zuSn=a9}6s9vN1hXrHFXpnUCunMwmWCNho)^Jb5!OMH~kiGIObq@*<y!s<S>0mzIl1
z+%TBO^9(A?Ys5ipwDl38Fwnm<p9Zv4``o*Ah*ES}bq;jAEOyCllYlX8<Aq&qk=i&^
zdmlBU$s|SXTic-^h0!DfSMY?B3$VOR;FeW`e&&LEZ46JCa&}t9fse>6|GDfzxFnD9
z%hh}XkfcAYaAH1iLkB&UY2kLAmwvC+22t0d<g?+v1W;Jmw>h+UG|r}lh>M|X-A4be
za|E`#8bt3JaC`*~)aQ{xzW-nD9ZCZ?=*SAa)!*f=H1W6j#_ZONKdHqgOx`?c&+5!7
zcY4O{w>;h8Xd)Wygq`93oYG&Qm8BEoA~#FlB~Iyvx#5x6n=4|Ws<UTD>Rjn06TVe9
z>m)~Kh_o0OC1`PNh~Byajd)u8=_=)0#WfT0dRH1s&bqP$M7%iin&k2t)%)1m8J~Ex
z>|P4SFT|Kd-B{V%zH@k=^`K46D<aV$xDhvRHi*K*&6ZdFndfe*b~HNWa7gULG@M0m
z`h}f-F{ktA+m)vByl&iQO2{i6<Md&NS_D5W=O`Q(9pv+A;zX65Nn{{uh+;##*^Zn#
zGfU0a|MK2COE8#r=nA2015}n2FK=j7Sm1cW<uZZiX}^H(d{<LE9DS43H2u7q8~atb
z!0FH4AAb(<`ayx1*DXsMUv*)Au&+QlOW2y`7B4r9xWP`aOLHlI7$tBxSJD+3@SYXP
z1PXNtjFQptN8hnm9cnz|O(uOCJ`y!Aca`JqHp+Ca!|m23<Y_lCY$0c6o|2@m8&;1D
zxICIJEc`kj_?u|Yp0lroLwRq>9|zz#(YH7XB2@5{Fa)6(qhoYT&sOAO12TEX7)3(&
zY|5GCV+oF_6>>H9SJokh+#Z!wlRtpp>_o%5(+D>+M@R9Hs*;WVqS<Wn(Nx{cT_}Wq
z{_!-!%v%LZ4CR4EUx{88GPySo6i)B_0TGw*=j%Z0@2qSv#A0M>{jma$-Vki2qpS@#
zMSCbkUX{u+rk#o7Tcd%-DW3he96&@+aDBQ|fpdRjAgU1r3a_hUrxEq(JBbN8SruF9
z_9uIW8~Try+bpfE2fQwJ)K=QvQRnC9+k+m2>&?KCH3kivV;OAZ5<y-66GTx+3PVVr
z-k0a351MIf-q5hu5T5*9&%sD620D-ymypEs>yWynC02JqJRk|H!)^9OoHzL0&_oU`
ze1@9)rIGIMGNL&MVrtp@8ZWbJ<l~C_i2Ut^=0}P3@IN7po&}w6V#EKO`9!^@5!xQ`
z+(h|%EpO30?aV`Cf1~l0F%qTKk?hwXwxDHChz5R-SDP|~G)DGb_FE&@n1(AkWMoD+
zr=!gU?l-zJgVPgm!^2_L`TOJsc)TLC&(a;uGlCA$&A1802R05&GUaKcQKO8e;=u^H
zTjLAA3R(@w%GrQ83bgX&m05&nR<4O)`}c<Yj-YVbOXHj&yy%e;b*lwn#=G1jd&>&k
z;Ww}|^VCvvr(I<)hFpsNlE1dn&1W<509FSi?(&@+U`-tSVz<idS=JVh?G5R$HBlwm
zDS&^#eYy}YL%&!cYf2Q7Xr|`o*yrq-0l>I5k&XL&jP_PDG6BT#*01_OL9YjX7aG3)
zj^(x@tAG&if6M<OySia!VDB_u0?dw<*I<E@Oc4xcp5r%iBKp}@liwc<#dJI-a&D5P
zPMPSv8~At8Rx$=D?^oPPExV^(f4>d-6Q{S;wt|&>dHMa%^M;6CH;S`AaQxh6tbNM}
z!=7^j?Lr|LSMPTc2N`#ws17c4D~R8HZ$*(PGhL}oMqfo+KPyUK$|$TRRGbdv(L0%W
zp>#*pNi*KK`EA(zo;@e!E$=&%Cr7``jrQT`ZiXZVw-Y{12!;rm1^wm$GQ4%bxqCEu
z1$b$uK(11uSi)DDU0q34@m5^Dp%UKeOohnh?_3Okd2R&-u2o9jwV6?QQvJ|zX<nW=
z@0UU}!!t+cv#s=HfoiN%Sxw%YE)^~hjw>Dk%3G;nh~gtum)7nF>pvA7!D~Okd`C3L
zE8wJD{<b*C{B!L>Vmbg8+YdSZ*YUFcbN78>r~3hJ7VK>DYixG@rKm>bkjg9G`JF$)
z1p}_aqB}AocM3j|fZ*9L#M1$|UJgsd7Xw)WT}<K*BBb8xwX(Ynj&HUF;vlOa>GO~d
z69L!LsAYId4^G5)26I>7=$93b0g{$47aG%oY(u0qc%hF?1TEKKp?cwMx@)A7=aCpK
z%ra;M>GjO^ijqa5u=aR_m0UXvRFG*Xs2GdSN#qoUllt5wTeP+;b5yY&4%uRLeMOaz
zQ&Y(|V5DDWY7Bt4O9DUfgZZ|ncl7(p;GE?tFolGQ^CO3B7*K<^9k%N<8=D>II3VoO
zGHj{R4&E8bW*2Hx<+`KJGV@rwK9w3EAT^E7_~TWf=>@IFOv&%+g9HV6;XAnsp0Y_7
zD4;~)vRrg^yR}gXEMMvpuYGp$ouav_7h3<@)r47GZ6@D(SWvbo=1nBvU)k@>IODIH
z1Bx07JsVR#`3ZyY#ck_nFyjNmf?|Bwnz0vYK&i7Tx?8?2+W!eH|0(fHmoC=l5+YNQ
zU1nLHVBZyDhirCaFYXYRiKL^2%1(axtkg_*rK#9-f<|06KUb{s-#073g$Ps1^k|D2
zylq*sAAuEb1;`ZDv4s?c>W0QODgSh>dRE}-*pw-zi!6sjFoqV56^%{6?w}4{Io9KG
zC(}rI@ni?PVns_I<hZOhv4u;r<A^b@@j2UUfqr|K|JMc-hn5BVpss%JR&karCFqhL
zj~Z7we)Wc79!aW)OkK8m4ak&O?UeLaV(N4+rfdj$77|fR6C4@&uHV^?R=@sr0i`f7
z<+a6}iyB8}Lld7VR{)0EVwDm?Qpx;fOe7EJ>vJjW;QVuzT7#vTV0Il(5KD7ag(6)w
z=-1a2DLp^H`)j$E5PJ~nWQx?dy2<ufrV`^=HVjdn{7QrSEzosHvW#1?bbq?uN)|k=
z`2`pz!hV9*k4W83I4KY!mAX_|>y_Ltb6MF@dJAOF`sSAN3;>h<<xLw!9A1^Wdln0K
zjl{F-MA66L*ox@U2l5hZWvZKbGwc4-py#D0;|HFt*xx<W5FWmXbO!<7vGcuQtp*bw
z<n%RQD)|@4F%NIfPbA0z965T!-<f=NK|bn8-Mc6SAx6kjs5gv9pfvN=TmiIYma6!2
zzf=1uQE%VPyxD_Q;acTA?*MsHdUi%frO$KT@Xv}5RQg$C!c2kE3(T=_LITD14v2O7
zuswez?Y@61RML*}5IM09z<Bj{)<;}DAGjkA0;#~x4!8U{f5FAl;?Z}G&i~3+pzHio
z1JH`^hqj!)m0j%)!N%Y?W0TIBM*I>7Ty|{LV|JdHu|vfD?prQ74Zi-j+!{9Hy}BY)
z4+_lGPyP;_%u?zgbT^Mw${8Zd?+TkG+v@Y(y&kmRBMr80+PxR*M-mieGV8_40RB?2
zQ;u7F^2moao@5&4UwPEWidZj@=CM0AZ3XQakO}$cZtp2KXt-VMvT*$tx}%RhKRGRy
zxqclr7lRP<N1hgcq*0^|pgjtDjT@X|T7DNeE*D@pN9VcqG>yn19)xiC?ndnO5d`_A
z+>ET|A<RI!DRRqjCz_htHk0fkjb%W)Jy+z34Xn+LxRcGbFD(JP1GYnjPoED7M&yM{
z<US-Qg@aGyUXfNOlxLtct_dbliG7Vg-K;V(pb)?h6lq=eHrI5z!vFWNM-fT3Rd`(b
z<r@r|E0Eb*ZAZ)t{wt=JH61{n5~G{r9hksGRCx!Oy{2hd&TMiC<)Arkk@aDOuDL|`
z#v#u@x>>MH#544?B+DZ#*YM(5R!bXOaG6dNZnU+mR0$R2)|GyW+C_+A<TZWi7j1vL
zhNjXjr+6AYJm_x}?e1BxWpi~fr?OOS{@nWv3*e}myL(D&HGgcj*}b^E)rt`)dF`WJ
zSvAke5dLA6$^?IzufZhz*Wg84ab@LLg#+7%Y0sjsv?QiN9yoSLgmlAn+*HLRim6Z_
z6)QZ-9faYj%?Jub!WGsb(<WKd4V>BoC_nqVQz(DyW3^gGXpgO%yLnCwXTve3-J|i;
z#zSWeWqw@SNW#ZRcY(B3gwI9=+`_t*Faq!&ChsrNeW%eWkf5=3!6c&R;UJpX=`#-n
zIS8d=Wi7sravD|v5(~m={WFu<%W~rZHW;6UCaTmcTnbY1)jRUwvQc9EVXk3>a}H97
zPDG9rKd(rr#~RDi*|9PSp&Wo$_$h6%UW@tQMe~U1_Y>YxLuR0iF$Yhc82&eSC4W99
zK$$_OBO1sIT=iiE7vp`1P_+fiWG~)qnzp<iN|(*GQ0gIS@~?7hf|r?V`zrsQ;M(@6
zAo;DvYVhuRjGqCA-MgJ^U3E#~G=}{uT|8~E7xYSmNzb$rZSXBOza3?db}kQYBllNs
zewzd9z#aPk&ydjQ+d>A%aKsF4A)&TIPPHRh5!)2JmMQhP7nc-<-^Hl``^H>q3*VGF
z(c@<;tQ<Op<7dkIxSV-#W|%GAmt^-UGR}PDNzu^Iw)HbP%#`yViz{odH*+UdJ{gtA
z@-6e_;!J*oJ3XP$%X3s~Nc$#jn&mj_7bTv7sJ2+@XvoO~Qz{bB(}eZ%U_Cv5ys^&4
zd@=!<a|us&pw9~tug_?*yS*F!8cj=g3EKdYmU-Go*6W@j5qYa4_8XPB>~3*Ky7}Eh
zYv*HW7bHr)L=(RTzT@CUJFG5I^>?hQv!RW>_54Pw;rC*+xD|&iQf}OQ1J8&Kd&&cx
zTkwce>C2zZQ1O41`Ha*o)C|;2)O6JJ)Qr^cj#!Qun)E{9x!z<BEDllRi}Fj#OVUfK
zOR`In#u~;7#wx}##&X6=&Gbg8&CSjG)MK>nn~J|<>CLs{-@lzM(Ugr1Bh<QnyActJ
z$&MqbSWFv+9Z0CVm(VAz@ru}|ueT4k2d)0}gIlC`Kd%p|;IGoY7sqHC>p4&495+ep
zd9G0i#M}Lfp10>VHI;n7kfsby6Xwb{E#koFc&)2Ki6*8X%7Zr7D7B8;%DPj+`P7Y{
zL5~r+(DUP`%Sg-hV<~d}BMcsYB6b~&3nDwKSYMrwO8KE04%rTbIax$JB-Z$z^7;KX
zz~7pcQR?5Mc7Ej80Y^FSI-ke>?sgWq!B(>5y;Vl>v0(=Coub}%oR%R`Vo-YReZ1EH
zW9zJ<+G@LKjazYdin|mj?zFfUXz}0{9D=(9r?^`wQZz_`;!bfd!L4|3Eqe0(H|JcO
ziwwp{2C&E8JMUg=%{iZ!3Jo-!l<h=N7_R>y{%cFmsX29rV1O9Ph}IjefH0{b_ATxb
zWwpsPeBU<-5NJt}NH^X0f`ERVCrb9%QH|QTJ7MY;BrNRT?9BS~y#>##nQ|1<tOF!8
z?jHKbqglTAPdQ&aXN6Yd5)IxLa!SfRc<`ykVDXNlvH$nF_OlVa&?_lgt!R=4k*#?+
zSU~-!{8V%Iw(qIQ{Hq$`)K;jqMpBVhJHdE9T`yiD+<N<is->kRvl(vRlN*2O$QM&f
z#X5gKGv^+{fcrsWdq^NB3wKx19j>K*r%hNKTz_H%GTlQvlr>W!R>QjMFRh744uQIF
z;)Lui<1HDaobQoyKtPk;H6JFwLzoP;+n7}29G=-Xb{x77e&#iC;)1xwz2j8g=a}lB
ziux-4B;{}BpG{=e$hQS6zhP;qx$r*&RlL?CNeCqN67if5ed@xV^LK2X`Ozs7C#PoG
zNy_@RPoG0BdnONN6&zo0I5lFk47<ZG(RbRm5^z%WP1JT=H2?YNq-OdP&4@l~Xr1QE
zmLC-n&x6buJw8kJE@QjuO8s>(WsaIiyf}EN9hv)ub{O0MuyI*$CXV^#%(r9}S>egb
z#E?S#aSyyDn<tIk?9%s7MmUSx3<bH0MDRUEu?5}e3h0Z~FLEA4usJZ0^7NaLh~Erx
zfvE5nr5AMp1N!P6G(wbfuj>y?Q>u#gacCnJ$Wlzn8!SA@aNx@p@ElgD%Ph~=o-$sW
z2zMJ4=d5*~^;n=y{h=OFr;#$IVI>TNNc3cCW@guj2BHZ2EacOqIbuOBpH!r3+rOl%
z@%EIxb#w-m3%$Dct5>)5FjV2s;S5{SaND{cBV_1I3bnSj&5qM{0?C9|o@?22-cyCI
z*k-;}p^o6=e{_$h6Z$2}sPxy!>XxM{+p3i_QBk75v1sjlP{5O_{Eed{vV^B$RIQVE
z*Q-_Ir)^E8pWF;cMvO#pzis4w8-xc3T^qnhz+IcOA|Xb9PO224RG}2|CAD;A&^Hk*
zOx<k7xPF4Ta|<gl;S#-7Q#=e@?7eArFgbF|+z=QIq{H88>YVru;`G7xz952UQ%!`s
z5|&r(92%XCZ9pGEJ2BC|Bk;3Dl?hL0w0oWDk8cVrNwvOp5@<AlhpgBAul<}w81u6O
zmC|}9Y&ekwy3Fvnok1H*8LRhQHBrQ4ONK_Dd-%z|ocJS34)I1<L*DyMZX_{F;buK?
z?beLj5a5$PX%G{TFg_3D5bZLwTjmNKyz{aCVTI@Tj3@T;tog&r8@N#WB~)mb^{37o
zLHf}|hDItuXXCQ2fXFU3@KLv1VYfn8Q0S}+>xYjYl9%K<UjHA<h#bZRExawqm+Jsu
z5JKg_xZGlNC1sTochYPpUhidNB}q!VH$SE|8++;Nnbnvsdsiy+3-P=lq|APskB56r
z*b6Tklnvl+6ZaT*ex*Zv>+)nB`cVs&P&R?=G!$(GhR^1HNbGRJh}-us#AW=0MSRRT
z#F2e}mEhKsl&n7OujC3?A7$mDKV0;F-)D<{vpt%G!-V=)dZ=*Vw3HadyAFX^MN^iW
z0+!UM2sGt6A?1Z@KNKUx;)5*z5lBE6IzS?-WbAsq4iuvSG$@y;+UzjP1p|<ncL41I
zsrF_Y4nZgY|0i`b&N3ca{ItW>kFl{VwIj7>ss11aA-1=Sv_rEO%ZO_N(C46eB(r41
z2r7LtXVC$(+oP8Ch6m+-;o9roeLU;pz46Z^exzwv{YSF`f90w?;oegHnR9{vebw%r
zL6<M;-R62R8-Rby8%0rYH%ZUL&hDdScU+dJ2aAM6L52|=U}Eg-43Ct9t2pN@kBYKr
zdzb#vFE-k$ftZX$MBhn<lrYW(N(7F2CXMxO@hqmYdbh$(TvWZ@B+&^hZO$;3<@(%z
zJw$`SvZ{ZbuC-%%YX%?ka!9T_LIn6#yFDw!Lf4+_{HSBwuyCgR#}`p*h4kf!hPDsy
z4Qg;+o-PEkEIHb$PhxBop5uBl@`cT4dTQ@9IbWzK@f_n`7hbV4E*SaljQziui#^cM
zMDzMRy|Kjm7++5tZ-9DqMh2Y+T?bqeLQTNqp+rAvXim<1mYVm%C9{g&89787N>|8p
zaeVjY{Oc;8H&LvB`%@Vk_%=5j#|r76@_k1rWwaG;^8qrVKMvE9Gl`95qz@X`;IhOD
zcRA4Z<JU%DOBh13b^8%UGnZvuBu|~#AAr90kSX&sj{bG$#K0#<;E?mi0k5aN8J@5v
ztH>`=zzI~}C%_XC{qaW&GUbaX!ks41?v9Wq?YG{-l1<MMq(luox5Yu+ss)k@`6L7K
z>3dGK+_ET|{o0;?Gv=_IDr1ixQdNOw!$%hCBf4WYK=+JYm=F<8xBdW`AgyI1VbUp`
zBG85*^j5l{o<!;p?K`^M)`~2h+ECDnPKQ_+ciOfbJ5Sm+67=b@`<RUv+BH?X6|*9M
zdowYSy0ya|-Yx=F1fBFon5v6F?{<4$E<T~+Hiz|TT8GsXX`wIENc9sT!YUE{dB;WY
zS3cQAYRvX%a1H9uI=m`RU*+R?>|a2B&kz3zFo~BELd@mM?D-Nh6Gc<c@6PXO{If!L
zq5ne_h>v@^|MIK0Zo|=R)6y9+?74_uO(|;nA|GsWO%<P#2{7uSjVja`JkrA9N-Rj?
zo>rVH4TKQHL2%yy?AEBL-q^_P_9#^o9QU4&$Z#pKKpN-oZBXX?QJb&4M0{GehqYNm
zDy7M3KXVaK>?MfC32iAF21`iN?F>8*Yu(#YhdvWY1fFgo_O72aCS8nuP!;^AhIY$)
zpP1p@*7-)Wg6p##Kc>I!UBp-dj;s4G%`0hmvt+hiKY`o&C~iK$C4dO?#=KRNW*oIC
z%My9^_WTJO>0QURY;yXCD&>61nDg>T5>z-(mZNG^bb5#5Q${6Shl#Ua5_smKb(Z9U
zfiH<<ngl500*h*GtdMl#CI*xP@K#HrL|+~ttpemY4=uZZ;|MAl%dJAK3Ozg%v>>oT
z><OgrBPv#5kQ#tDB>fTaP;*smzD|f`7Nh`}Ds@hL#x>!Z$i;~ZF(<b!yEhHxp3BYH
zo}83pH!bNQRdF+?GJ*~Tne`00W4E{9=db)xtcsywYv(ShE<^Ad{*_hyLPR-VhrEV?
z{1W8RBGkV}thes$BuaTD^fb|!FZWyr32iXp&Z#}EnHXzu4(u9mxBxz#9gE$|hx3~}
zunC@R;5+H#`8h)F`UrOlDJ_2YxLm}!lT~7KX_q%6l}Q@K|9A-Au8Q)i_*-_SS=ha$
zZAKkUJ-i}~eHfXZgeF@$Yzt-hcKMXZ@|yTMPBY@dH7BQzi6d1NnFPM;{f%yTe`AE2
zB|*_+)*e-vsQ10QC4Qh%4o7O@yB0c@I@PCkq34?>t+*Fc2iepa4^R03{cfQ>t4>>R
zy8|H<QFiP69M{kG@)BogvsYd<|4zuggziLzQ^VA>>za%NuNkQe#mznpbq`fXC@w1z
z2h&eCDAyvw{4*tG|KC-aQBYKtRZV!Qa8&R01z(p*<@c4uD8DZ$B~y(i-X*jWmUjYn
z;G3p3NvoG`L95})eZXF+6yHQXYSrop3QWz@boKZ|K*;<%olRILY)_nB;d(8@GTs*t
zDM&QFE}`h(UY1oiLRpI<z%iQAOK0fdeL1p|Bb7Oem&S@+Zu?zFV%pD4t))&3A}7J(
ziWN-B8?lQ-`|}G-a=U5L67J>MyF&T76%~FVFD*-2ji_`VmbRm3)og#XHY2a$Z^MBQ
zV+ov2oY&&+Z!BfhM+11?3AaUe1U<EskSd0t#}nbMhRUic)pA|aG%8?<R_x~h_H`Ha
zc5hsejSb7upPI2w+a&w?F5i}+*nh8W-DW=#jSLJ7mQx~fa&nsVe0w=kWB(*c3$c6o
zeT=!8AJ<)CFKux3x(l?-=56Vdetj`I>KOgJ8`kM7(Ed4zX?uJ79zK0e$CHkz5CYg*
zTPqvM=%idPHNEGmHS12)uQA+u`gb+Uz97)%eKrYJ&k@|}zk3I@%(m9U;p~=fg8x#t
z<~#peAe;(=$|=8Vx!Ds6cLSXn={iDAU@*9Uitclr>281b>q{;kJi<8+Uf>Q34=?3T
zJHG6Wjb`2t>j7Ct85*guXhHVF+2>z~;mDw!osHLfNn*+t*;oPpp=gZ4xoh6;r@X1-
zAHG;Yz8(K`AnGY)>bWYz5nm&})^m!;$;+2=(??Xa;rG;T`dt2vX}a0iE-W^3yYVG$
zFj>l%34J8^mo^;Itw6rH`En9qs9?cx6evbcAe;dg?)^dX|LQh;#QE#)1q8}9@;RIq
zR@u0?1|DvXOD*NnNYc?jR&r>wR|EHrhisIoFl<MK6(8kaJ&QNTAtxNFNjUPJYX46E
z=BA`DIO%<e*7`caLxmdjd@BHX9#fn;LFH#W-xXE~c&MZZ<QsVstUay*9LPDs<_qKH
zg@Bqo-1&u*ne5ygSg_dml$Aep?mm8gNMo6qnxv#5zeFMNVj2PhF>30FL`2Or$Xq5^
z<P<Z_Lxdrcs)<fPhsXajhmol?0TB6urTAQE`Mi0G%Fz#wkUaJv`R{tF4S;6_AH>8$
znuYi*(f9(zib_${a?$J@kSHmuz0u|u%-^o9a&mG^T!j3#V%m@0^m@g(m4@uj1(lJ&
zlyzBN?*1uasEsPRSMVYsSAO&4{$T1(?(*LL8nc~}+J8;pYawyS@=f>7+>-aI6JJ=1
zzq)A1djYWJ2+Qq3gj_WLw}00;_~^J0s_w-OEp2UC1%)Wj>g}*IdfTE5MP}Iy@Y3}8
zg3K6z2XC4`YYb5kO25heNlV0@P&&gzf4;SL^^g9nGRDQj{gcPYWO)uDjBmdmj8|%z
zPDFxtOGwN^->MqYSuCwrImiBPJU1!tA4&_n3Z*j)xLNoNHwX@|gwa$9Avj3CsyTg<
z$ZkQA@2&=`-Mmo4BpBrb9@SO9SKzU<-Vlg;(^CemQCcJvOE{K)ZJ3X;cqZotKL0{Q
zmo^_#%d>yxY<us_6JoNq16yi@GjgI}OIr(~QZM(GaGzk5R_tO(bZl%&bETp#I;3i4
z<9pj+Rgd!xMX`)LD3?cSVpa#KIr7&BYzGgI9JAaWmR5DlTjr>W#c!+$M1Qe?Xz+?_
zr!fh`87VJxA`1KTU*mZ|GY{5082<o81UWx2(*Wh4T3BAc`q!zf5LmVtgi^===}s`r
z=r>f4>f$0r@<flo+&m>ebm3j)oaw*IkY~xjjTvb{lnf)8t++{7+SQ!5W?1Tjy@Icd
zK?cXkp(srkI=Hu`AoXNPC#FO^eL1jcB{gi|qLVG0H$-mjb;ePO7xz|zCX0hZb}Luf
zt!9oc?WgTG%f+qx*!9mRi!O0JHib7hk1Ki@Pzo8prq&~3X6+ocWcS#wY<gv`qLDGl
z40T$fk<rOqbpTOGGRDJS2a#caiP_}7sUZ%gZ}PHsZ^z!Hr)s(l`i_kpM_Nd#{@#hS
zSXKRf68X(U_4jV%w>;H@><`IPSOkZ<a*2c=`6Sa*``<(gNG7LtelX{k%$Q@0k+b$=
z(~cwM{?2K*FaS1+eFNye1FX~-hIq7}0{)J#P#@XZz5|PmDi8D~x)YKiuN<eKTNK13
zZzAD(4t#ny^t?`7-n_1`19E(KGF2GYllT?4pDs=Wnp9^yBSDZ5CkhRIxgqQ57&B$(
z6hMJgsUShqaY1oij$cpFVO?1<1(b{RivHN!2c0@kp(89BBF>+pd5Mo0Z@Z|zVQio5
z&tm>Pm9WGk7c1B#-GNO6C=Uf8t#)$uwRY!hFNKywyWzv>Ok}!2uaw0tCiu!Bb)tC@
zPV$dffHwf59{B%41L<XKTZaY){$eqF63uDxQ1W`oLCgR2a_~C17(gjr`sclR1P;;i
zg&V2k>Br)?dJX;OS@7=C5L(&;*K<QFEB|Kb!7(^{{TT_A=6c;hb(tx%Z*EQ=<pLi7
zdS~lj7OEECuyd%)H?r#A9B3P_wX4q8Q0aS}aA;@p@Xr5g{E#oEJYT=_#_J$N?_|YN
zuN_4A(<v@V>fwO<w1^>uJH+H8;IpS7Lx}Z7alSrhhzS~WME1I+$og+@B3{u2AwZl?
zItIn?Gb&{FI<a?hjPto|67NRB7ZIk@^YVaB1M5guyQ;{0gBq199exF3{H`O;gL3f4
z7A5U5LB>IeUI*h+A=tjh_f??@xQ@AQ+9djOCUYJAzO~m(OP?~-j;_ZyoJZ{S1&jbf
z4d)IH{DsdehhW4u=!gyd>98OtD|<1f9myt%0uhB;m^P%NJia6Vg81bO0Oe9svX!am
z=?A5m+w6${qJy6BG1I=FK*sQd+Ov1tTZ?xeDUqNkUQS_|p=;lt<)qZ`;=_}8r$0Ul
z25WrMcP0L2i6CxB*Yf4`WA%-!)hA`s_D3LgbxDYzEgjQLYwwFIta&+#>R~5Yb_X8n
zc~=^WWKkgUHfHp`zD#oy;w<H!S3tj1_;PRd${oU;Kqc%flS^|+@J;T2hhK#P1l8Qg
zfyO^atHfmX*ifi`EgIGRcq&2k?HZrI`D=X@ljUc<gX81Ohwo{#x|fIS%!Me8H#mhT
zjIYEbw@g{vn%ce>f?2zDzA2-9(E3@kt0Oid7^~3aU~%dvv`^IBsw)MNKVa{BOz7Ud
zXR5QEE35JEDIeQ2yGZM3<}+xBSF2C-{z}2907CjYQARM0%DxHMXGYAvUM^~Mj18TT
z%0<kl!HcJyFAUGubVBoT=4#bp3_0g}2=LqBDmPLpIWa~92?g51m1-sCgQczNGyvxO
zFgA;O5#C|^R)3z7YejpKK(X7%#qqT(AXX(9*OT<;l2*y1lA%V!6&G`s=?<#`JXYP@
zNHN~|h`X~gFYkY|FJn8+56tQ_mGAdK66eMc`K5(kzkZ!>--Uf7LWx(rhz0np2Kl6-
z8r~|{`3ADM-%!=cls@ioKpgs9;|~5D)+rdwFVShg%g#88;(z42V1Y2o3H8Hcz|5O`
zzHxOsvG_}9hYd58pHC(r4A0sGj<4Fq)k-e7+AgYC5!q4IDadx3(G8$QF-l$x?kn}6
z?bS68MId%2ljKKC7g58ys1ho^N;DnUz<XQV$7;4XWdFLzBF7ff=%1Y-2O(TQF^c$l
zu}A!4t0d2dprriS8J8l_6uJ!=2I~VHvDEvEgLhHhY?jFAHAMJR4UK}9nt6?6KLjNt
z6-j0i5uyI?lf!A;UWKI1t#_2AuMd_<geUe1nYQ?(iO~`gpU+nx1XD0%N^qLVms(f}
z>6S0zodVcWdT2)x&z8KX^&JyrvpkRr9uXg>P-NS?`6rEI6f!4?m;nCT<yV4_s8GR|
z-#niY+QYuJg--C_;+X|1FZr>sfE~=4S^5c=vq-<i?q-EXYFB3M3lr{H=%t9gm{dJ&
z^wtt;XTaMT%z1v2a6^Pg>5pD0@Tcm<EA}nMVCa9hTbMVWP67C$`DSG7cX50NaLCRy
zXDs6a(lrInOf(({85#SkZ14=jq>`FgXU2pNuHSBFi#xAG^xPUyRtrYa&j?3{2M#W`
zU;sC$GPgEU5;0gcBP4ibqQ>N3L}BYswux(d0CAD>?b{kx+#5@?cSv>lGSzW(ye$;a
zPMcHaictT8>*u~p*ByOw^vA;`ai#BvaNd|ZB)@iDo}tra)`KJA&g>%=V$e}Mrv}YW
zk{;5YAn6_r><Mm%%=wDmXTG9tLVgUsLE1IQZ7UuvopB5{l5z966o>dyv)5hi+O+MH
z4o8yHOpQO@cY@6;Z;{@+Yd^?}zh+J#QX4w*mishHjG&aiTAc-jII9?yY9fkEX%Yh(
zc6PYuKKhf#>e<@%S*8l}udN`LR$7P*meU=}oVUuw`G@nLl1(Puh>wNMG&7w>-b}Ob
z&QEWq(L2~QmUH&_{dE%K`K)Z10d}dW<U98;=Du1Q`MZL^`du|*v3Ne2HvhLyM5@h=
zsE|@W&0Z-40ql3D5j5s0Rej{p1P4z1o-!!DC^A;z0&{CZ5&ut2zgmjH-dg!F?$~V2
z6V!@@W>mvk>PS?f=NaoYJ|ussJ-U0cTt2$SsT+mk$W90;B_EhJh;{>+(?d|J`~?p}
zd|cEU&vXC%L^J&jC_NhR-%T-%1SO%{MO_i}7M0SYgsVtXiY_w!6MT{BD@<(jFXSuc
z5s0Zl0~>~&5LDF)<a=VQgsvg|8Hs@TAEG%1@ezMQYwg4oV{CzNTAPJrsDzs(tKb~0
zuh$gKWZwDZjsC!oZ=kgYYS`3#yZQKEIu0_J+p}J*JS(fJBn~z7XND~dH(2;1fPA{a
zWZ#0q|Ex({5as3h>NEB?9SLqW>fq)lGK1?JWxug$$8*8ejaC%-a@rvna;V)(o1{e`
z9b;<9A4sbK3P|At+6!<U+vL?LTxs;y<mH*jU*mq$Wwh@QcBQoDm;3hjp4iLDavcVY
ziI=VkSc<XI*<K{#!=LhF093{$*?%oz*bI!te^?nOuZ@t-eb3nQaoXTmt`4;h0qLoN
znzaar<@%#gLKSx>m^k=>mK)m8^W(ifIbQ%N?^){8ph(v^$|%tu0o20tWE!c;TQc;-
z#-qvZ0-Z2`*?$-nvVjA&v9Xz+oek^k?DQOs!&h<BDWm?*OyYTmR*mQM7u-pzS(s=A
zx@YIZut%u@W>;}?-@8s);f%ju*Ia?3R1X1Pa-3|R34k6Md&p>GlNNL7O5f2V84`zX
z^w3Gips-%5oTKI6SjsXO>9drd%KNP@EjSVw@ipH%RB3{1PtCuhG69aTuPi8x<O6YM
z1HPGeJs^RnbBpqX=BSq`m!AZuy&fI{vNXmjdE3IS&*i#=CFjkMZiPzzP3Kf5`1sMZ
zTR2uOt1)R0C3>FsAF1Q{{ILZniu?2e7D#ZLm#w&g^SR-+!%6t#A-Vp=2)E)WxspR!
z>C@dW4^^I6?OQSQ@Hr-Hh>0~rR-}$GQWFB`q5>Y&*E8gHd%SfzOlt`5HQ|@?fh=LZ
z-Fd`QG?lY2`t--Bfhym>Qg-8rJPph{WH2@eXlcseCbI7&VofyYkI}ylQjxEBza_R}
zM%v5Ol>M<UL#{>{=26abL8PYO01RDRN@#VxMoB~07znF>hFtpK7f>69zX4CZO^~Wn
z^kzOtgsCpIBkXH@*~u_6Czvns^Bl@ces;CFP&4k>i!<@BmGjTWDL8HE`B7uEsc!96
zhqwdLb;9-{?OC-(=lk-Ep;4O!W*hB;eMmKZ{s|CuMB?vv{~-WaGQbkDK0<!1D_%S(
z^=YzXpQP>>Z}gpdNi7nyP<jW!qnwgsN?%jRV4e2(&WsB;Pmjo_7mF2<fpRF{#&iv{
zy(jX7mBkRZ0D|0OcbrvMMO;fT>=Lp``En%D-3s6UKrt%Iw!5N3RA}P~C25Tx_L!Ue
z*MsCZM)5k!e_b+J>a<ZrMoA34Ch=V=CGRS2Gbxcl77R7`#3hPJds8F0n8mX{Qg*fn
z<DhTibYyvc9APyddBM>!Py-Yz()1&2HP9dO+@VQoqEZ!Nw?HcQQr2R~$vL&5#_h7P
zp+=CAgyOO<WOpfsLv;QJ<j#sBw=>b&5!6f`o?;CH=9qo`@NG96N?~JA{fWLFII$j1
zx5r>TbL+-oZI9-N#?3l5pWQJrDVAyl)8#l^GO%m_=Bwr_^Y}|Ul+QUX8Cb#a$;bYr
zs7<PP9euI$BkjzHN#BY=5s@y5Z}4KM>AsM%sMXCGY82`n*RYByA(YGzbRHm-;z1VA
z-qb9c47EP;;q^<%%(6ZFV3>hJ)M2lbEv76M?^a?hQK7yhww}NpM~Qq}#qd@Nym2*t
z`&XeU7lO1b*<M`p#~_Hrv^MKS3b7@w;T_%H5S)-(9<Z7uIr)=1xzH?RpPt~o{!BfJ
z0>#B2z~`I@9pi6!t;AD2_!m@UEGSZgt-H4MR(8Qsofj=Q$%+DU)V$_HqeOszL7pov
zhp$NUuY0UrYNqu5Yz_EzC@Xgl_H698p}in*<`$!Ub&2!?z)Pa-5Xnu&ul|z?(JHM>
z8k(I8WbhLetKXDF!CIY;uPCrbP$fJqnSEz;o%7EH?W?ivncS*@Fy7ME3tLfj_vHut
zp=;_GJAX&wS;w>+-rg@Js4<$=?2)sNMxwuaaiAi5B`ufKOd`vl&=FdR_&#%ce%(8Z
zp&s2X^M8gIdSO`P7hI~fpIUI0;pHL>=Z_J*PDh0Y+O7o@JX-@eZ_H2%=ln&-yHJ*r
zmrB?znY7VJci`^xiaXjU>~4_(?LS^#qy6uRoYqIIw9D%c0|?P>X=1AP|6!EJi#z_L
zX|~tgr1^L(^g3HMj{p6B@8XQ#0)k7bNg3r?h<!~ig{M5JEuq>j8e1$5vU>-yy`#J}
z4d)&RPU0AYW+y9)v_7JcaW2H|b!rcx-JVH=B7b-EE?MWWEL;VVQ|KxPR1|7sb_}!p
zGPHp)I^tU1J?ub#?Lqwu>m%>a;8$#a#7Q8tEU$I8yjx!fveev&4QxiPV}iocW=A;&
zmu^8~+^l$@2I5n-9QaR$m^JQ?XkJ+Vy~og-r?IkEha@f;Efsey21)H?URgFqg35KU
zm|`~1nX7u9&Csa8pw7zoN^{;mGb*QXz(U0=ksv}b>_x>_siS}?ZyiB6=8znBBIm;x
z(mO%*+qS$4HMn=G{D=5GbG8tx=9T59$L&4ieIKROhX{IbhNHkNG0RSx>zxK)RN_(?
zv8K2c;k2{R?ZK=$12t}SXxReewLUB<hG-sNvuLbn^7^)T5;3b<40Q+0L4SUYhI?(y
zDXs>SN?d2n6vL89H!T+n;7dPxnJ#E2tyL7(xt%PT3=vD%NBzwJum<?&uYsBF5O8@`
zw43dVY19A0c(P@ZikDlP)xvwwK*rH>V(Kf_4QXawzP&tj;b6+m5t~3<kXin-)?sB-
zQx7(i){oBDYP^RVTKTVW?;PSOSrTbuh|ieRw9Sw**Y;3ET{mj+mu<Z5Q#aw47FqL@
zxQF!He8sfR)8Q}1`*IV_Af(u*>!*7WL6@a?&H|at!n>636p!lO1*MPD@^ActS(=C2
zo8l$so`QbyH`nh49FUvUWr$BDQmDzr1s{07%n@G*@`P}Iu!mo1X)kqNuQs&;DT7iC
z+u`Cdu@ZH(TlHMB&)$*{%pgpd(qfMVAhU(IrF~PE8d!%R0v#ejURhuU<C!>%kRq=v
zmLPcZNO2=Qp4OaO02KZ9`cJ?0bM|(DF6nDiQvwIA!vat8SP{8-5Sz7P-)O)1Fhkjk
zDahws*cigxO{0>m+@uI8lHdLI>JAT5d7jQxxxhvKdB0#dsN%+vY^j>I4HE%9vKtXN
zc+<$IfiHCewq^h*c?L1@Z^^7?+}EP07<=}p(}?|Ltzkk;ZENx@=~Ln8c=G!isXvI#
zz%L~?GgXSbFaHR(230Sx;kWK}(DTDp=Qiw1^R^YIX>4P@GrMfe?;>-2r;UbB>ek}Z
z<kN?}zPeGY^a;zj=*@DzU-`N5sJjaz&BLP@w?~7zoFv^(34HQIHLk$to!gcAxYOjd
z@wV+XBJ*nsNAe~67(s6=K&$>khO8*YBFZak7HsS|Z*LS+c<oXZ37Us--74<Ploh>~
zOx-x9tO2ZTU<M5YqiA=9$c$}+dem00=iL={>!H8fd!^{cKhkw$%Tdew9#)Zggm?<;
zKNXgfjx8$(v8Svs)yJPuU_Cy*8{`KiSGE!-xySbIGTy-rhk*klnScNHh2tQG36olT
z6s8nqB7yc#kz;!bpjBh4fO1sDD^AE?)r;|SY@fV!y=vmZ)f#C!1?jF~fmR?@yNj*U
zec^@)O0(>l>0pmk=OJ<5nJMS8fGHu&KHsopaATt0;cAD!x6AfDIHYU>1GHxVujuZH
zB1%I|I*2n<;bY6Xn9pGo8vm^JV;lX`Nsu);YEDd1l6c*>`R~_0Roj=2;+!i4`Cv=q
z%nvhT>i%F%*t4F#Unm*gR6Y6Gmh(HEhNI+P7gGW*@|K4^Yi(X<(sPUDOz`?UtJYOT
zkPfYMdQ)Z!RzpRA^e<=8A#B=^coBm1<DS*sa#x>btWcV8R-+6Vm+`j)(o^#86&R_c
z8w?epIGNvKt&jEgQ~ya$A=S|hmhO1hUwC4maUNZYS3p#S=9CnW(fgh^9gHR1(f#X~
z0J=%+PX)HHGMs8)w|#9m)M#IHeualszGP0u0eQ&(`P~O?s+j`cXv?J~QMACv%5z`&
zw6dMv9MmV>Syzs+xSldM-u*?oQ^Fq7ZT0OMf!pIm%S>hvx=vXhRA(<UrGD&FY-aOS
zJk4y%6!c@thOhp|^0Wra71+JkH)2;rAUy~FD2jODCMVjOqvxQz!jC!d#IotpbtY;-
z{RSHBdcP~pX)sHAjrtE&rfNurL+&XGY~7tWlg`?_)S=Kld@X2JA9}VCvPP8z7*W`F
z5AC!)Qpy<u4b)q1GIf)&mj4c)Aimhd)Omh$e@TZ0<u+`J7<A`69KAgaH);O2*&FVD
z{2!DPX6Rhj?tSK7kA5Ujuc~C-=5<V(nUH|92zOlmg6_m+!Qq^7o^U#6t>a>?n@Oi%
z`Y}9WVVucp#xq;0n%N3Xw^!Sr%nvUYt`W5UkPWE1K43-9??9MiT!)yxCo<TQed^i*
zHOq?FzWWJv*F0;R&PBAm2EE-I;U*sVj%XlL=sfDW?$~!0aG8g2)8G~Ph{+jke=92r
z5wO7e=YMywL}x)M)sO_Pv<UvIps=$P#2Lil@D}l}?=Z>Xi*tauc<g%W8X|MT$-j)S
znt6Z9?y37MUqw+UOu`)$9)-^_vY$w;lrP7ogW+1$KSi)Zm}s@ZW;N#mD{4me0OM}o
zk)16DQ)+Ni57*seo&WAf3BPJ>vyjS2)Gc!Yp<B)PuXj>LO{5MJBa6=o6Zi_&wQMUX
zvumtCZ?A1BO8k*D6hUO6lEA%pOnz1!cYto?A&{G!EZj->-7@6MlMR{Ae60zUs3=UV
zp6sG4<m5z^^D~9^Pw^=gB19AIQlI2XbM{H*HAc9&PC|u<h?phr&C@+(Bn7qfu^rFS
z=IE(Q!G?kFcmY>1^VYi_+_mB3V&`Ww*FZ3>M!p1?3UqgoEN4QlaS&B9{DZ&gS2%AF
zRU#49jqA;jQ(k-E8)>hZeh&4Iu=kXqsjP|H-+$r|zaB<|Qn}V8p;Qw>#9$2#;C>El
zJHhxc-7r(%j?^g1q;W!n%GwFEg9eHua~#XCU36)*TyEH1@}U*qo7gP7v$<2SlxcMA
zT3RsRifgF)O+No51{@s)iiroN<vV43oTHcrilPZh@8?=Ohh>}8Gvf)Z)DP7*+SI9*
z*aO*+#dFtL6HRmF3^J`R2i_iOK@Uq&nwGv6D;3@F7lhc{Nm&lJ%&p3OrGCqUB+mRD
zpW<nR{+iP4fve8yyOwy&Uj1<c#XNgjX*T(MuBJkdd7P*Pd+t~dEx*nCPIT8XAuyoq
z40g5c2Lwro|IK*6jRE_D$FZ|EK<xlZ5JDE4iGx=!^dXW~`6W$y5_x%fUo$gVY5WOZ
z-&+bmTqJ!W+S6*z)*HD;|0K~ZZQbVkr&OyiJ<#_~Hr(VJrTtX30vZ{uR8ByxL)U(F
zvqXW8BgUZt)Z!pydC$A8QI!*m&ki&NHBraqll1vLFi|C{JpmSa@n!_Do$oHYQN518
zRsEguy8wh*TJcfwh;`)odP5hi(7eG7kJ*RvR!Fo;AW~ZT!qp#f^P>={R!A_fLPd6u
zmXk;~(Bm%bLZs0fk9Uyf8LQr*39HYUb}(|MWphGPAvt92XCpt$?NJP-ie)loN@9s3
zu&DW-I&j}j1kS5NH&V97ReP^Mf0HfHJ+;&!DGQ-q#`_^VLOq?H%kv-q)C@`d-CMj{
zZ=xB;XdVSluYEwdHtRX;i9Ju+F8mnJ{hiH&>GDv}_*o^P?DWv16~msJ76J4*-FAEY
zCAZZvGn|<SZQ9$g-=(5RG+0>7^K*I__mHa>ry7+Axm3BvChSx-3%C{Ei)_RAhZ*w%
z#a|s|MYIb6c5%ynEF5AuTv$B!<9&j)#ng<Y-TNK3oaZyeEH%2{na?FvxTnCZ2qHy1
z`d|15;;;DBJ4*|zrC_+`oDOe37>bGO(!Qdv{5hpR`twY_;YouIN3^;<trM}aJ;fL;
z*2$HAB9icV${O<TJKa);iFzYqdF5JeRqXjZL1_!0gh(F81^>|)*RFP{_Pf*vp9G8^
z;PI`x@*2Lr;GE`tiCF>RX~kuT{_^Io-DnDx<7T#Nev0W%?7p2v9nTU$0P~ve>@41K
z^*S9jWx}MA3hkeYexU(t3wnnn!FDfoB=9cFyCBBRyo%X4z};<mlsZ}0k1~M@_w_ef
zopp<XMYd43ip@qYncJZ(23o?rjE$O<&C%K3*lOTCHMkD->UR84ti!m4AJVf&WZJ>i
z{qqlskWoS@0C`Lk<x)JOY}S2C_aU!sZ>soDVQC!GC<LC(+1GLr7XE;34ZG$euu;pM
zP(4Xdq&5fkp6YVI1(9cWo1padv3Qd|TeUIaZGfR~f#e(IMA(aFiaB*;v^qaHbLoPt
zk<rE3Dfni{<AQcbzj-un;NSL8P8fOqU76Z1{0q42AfP_j<Id^p6-OsRyWKwDn-hGL
zBo*OPtjB=u1q&-S+BhXE@2rs8S;7PbMptFp^(O#VY^cNg>RSLjZD8DjIBd%uNF;`n
z7e8DZIc?}hhDdgc0aukWvCgZQ;L9O%F)>+B?ZEwJZ_pZhsl%Kt<G`U*8{B1-dAMG~
z$fa<zD{QD#d|@vj2>I+y*yeet3zLK{n82!k{um9ccb(+wx@-5o;}P-XrOm_{E;h=X
ze5x&lJ>T+DzHu3C7~KJF$9^KM<zC=I%FQoZ{uQVQJ%Pw9o_79QKl^ky$7frL6WmR7
zm*OVpg3>noSTDKWKV*nMFT-XXWJHHKU+bU2Fe#0PJY=Btt6(HE0TV5e!lA^!E=UQN
zcy133Vq1^vcdg6N6DlRyW`2$#FaXVyt)n#|*nHhSWk-U#SC#<^#k{aUAW*=Rr?0MQ
z&n|s1&F1CTZd_O2-_{{UU%u#?4t3oy#h85#yqsp1a`xWhNMDS65_7s0#7C!WGwGDS
z3bBGeCQGjVnb%ou;19Gtp4)qCn#iGfVFa}>jSUk7cu$#z=1$NQ{FusfExHt^`gPrP
zN%6S7-uP68TRz!(E^kCz;M>}DCjm?}`FqE3*J{yUK1?`0bkul{{5Web5glR;084ug
z#B`DokPS36lMjOm<@v3Tt|3Uq9WZ$cqwzEP0>ZSo#$l#K^THx)YRxsdyep4_8k&MV
z48Y=Bh;?#mYTWesZ_26z@=>651iVcsy+_BqeWa~JdGr!C)S~7i8unskU}wU$Pjh1B
z6^lx*9Q|18bEjP<BB6+Lfk+@hHD=1nIf(A?Mb>}yt(DHw$yR=3a;orl+Y-|N%3$c)
z8<V+v30x|Tvc<oQ{A_q=U}S)Z^ZXkKdzF#2a_@(lPK?X3;XIPXddozP6!|v<G+)D&
zAB3U<d?>Qb|6LdS6Y-bs#DJNGm%Sa@LhS1ha2*h%9d%-rcN`H_GYuf5+MBjTv)O!j
z{$gji-WzKV7ofK|8u5=Z28%Ut$3s(eq_1h~zh>@(c~HLPrf@hL9n!D9M=LN5iQ3X@
zEffi{o8oFEbnPF`?hRV>V|qYZNqPWm{!NG1@VbT_UPF_a1@DFm9(spUndO)C%zn9{
z)O#ADS(}2`%b(_Cpz`P0Uvf_ZZJE7<juGq(nkB?76KF0ivU4PF7}r)P4CZYz-5Mm1
zvUMG<SYz@3!uFzJI$A;R$*hkhZoB3)@_7q}g;4Fpb0sk&V)8jB8{TuC7!29i*43Z5
zyfopba9QqaEftWa3<<O__Kwn`GL1p2Cp5&&DRT3BhYAq-8s4|h(2va@UUvbrl+VWa
z-;2v9<i|6N{h_!v{I7)NgfG8rgYeOAKfLw(*g|Le<>3U3ZeJLAJ57HcM2bW=YWgXG
zhm>=0xGpFHj^VhPlUH58icjC`Ovio~e68do9?1~RzxU^jscWZyIzPX)!00AF1nvZa
zaX@5M=IUL?`FunpHYw7(iS}uGLF&wZKklDDR%g>*Z?RTbePr$#dq;WK!u0{7$uopQ
z5hiHn9TeQC5x#G!0`B@9Gr42%_}AJjh?Rt5-ro~^5l_2Al1MG|s)ImF3ymOVW&MtZ
z+&^>{v0PN_+W00^IDP&&DFX2NO<4(VM1jNlull|v!9J@(wYatK=x><v+e@un*hP3w
z3KrorBD(iOE(Pswoktg4)GtOoSN9pNAXN+LSrijT+@H6G`wXo#AeX_2cd13i!HD$2
zb@Vet2NEDgKlSf~g<izh1)BLE$XCsXrkv3j^Y&PMqw5X*i3^NY7<v=BuIj%a!tma%
zD-YRtOK0;d=W~WNuZ?vmBlqS}<i@cR+574!Sl~*}ls53+iq4g0Raa{0R7J#d4-H@*
zWqp`6bROH{@g53-g??y3VbX$|FXTGxb;+UD>pJ)99{>XNCk_Velg-7dVH1hL-Go3&
zUOXsJTvR-^A*UKUGi(CamjvCYfor8Khy+TJHe-gC%amEafdRW~B7Uth5V(Jsqf?Dm
zN%$Q0+y=f>|8j%U|LCn)_2+dvG?V-&YCkT0J4*4%)c<j-`nPVi&@6A;v+L$k`frRY
zc_Hpa^9W35m@!(v-s6nRZ_n?MAG9%X^47c1omOrl`a^$aHC<Esf$XQc<pmKrkaO39
zvew#x5hKV<j|!H*YFWBzF1FgUMcUPfH1D$9Ap57+e?NOinu?EZlnnol%vy3}1N*hk
zrZGU~`hGYRd0lLs-Y8wf?1~SOR^kr!%^-_FZ4^uREQUnK$>;HEmY?E~Gl|Y&ZIVOR
z$7=Z~_-E+Yhr%WZk2U;4HNvpsonOTP)!<zxiSD0d!FM{5C)qa#{MM+2lNm(YA3Jh&
z@_J6^+VMWWwVs~MU{4XW>^_`qyhfP%HU(H2*&Trz^PWf`_XX-Ck1l_tFiI)i)#JAu
zQ~eG7E{xKyoXYZhd^|0YBq?lMSE~BcSulBXFD}7U?T%*Y4~!sC0$~JmAzUbs;J}8t
zo(<@fXX@&E@^n|RJAx%!FJ=QMpvCJWtsa0k=s6ol2h5PrTul!Z-ofneT7@QEl=h+K
zgIg>`cm~wr(oV=@;ZBeql!pgSW^12%xa!dOm|X&QZJ;y<M1Np-x)`RLeMi3zpWg|!
zZ^y!yhyu@lgaJ(Xl2YXFToJg`KKBil%NWMuv2zSAng-mY%0T^1y+`F*C(QqXCHK$F
z9Xbd;XJ~ATj}{O$&2c-Q6X`-}T|j;nKaT9|YMVLHZr8;rMBaIesE-ZJkK||>fk>{v
zI9r7y>#WI@Es~!URSQv&$g^uh|LLe&Jt$sTPAQ+>re&Lj)O5n=r=UVpm#)8ALdC+V
zt-v3y&@XBVB~b8MrftGq2)W|*`^I~)Ofz{cXFt$L+!9~uNIYE71Z5H<0%wB}jHLSd
z`{8E0b*6P?_Q^E-oPNFK4vQ2USW2l+0H64WkNx|i(TvOy#PG#w!?Vt(!wgp)>`L99
z6K=x4H=f<kTaEt>26rO}FU>hYmfPkJ>r&<>2TL`0abOy251Bf#W3nblu=M4q!JgA~
zl`Ce5s<WkS)ZmOi0_K!ip6^gkS3>}Wnk^++xS!7kuH8y4j<F<@Z9zJUI2=yGE@*<#
zzTKOF$IZ<h#QMnql1q+7AH(1KAFW2j(|vaRBw;H&>T(6S5x$+(`;L%wq6bD+Wu4gW
zqv8Od#BXMlensq3x6Miq#Hgv2kNB;Zox3xFPUjtsY(;kyD#RCalI?diLz=u^&0Pr^
z9AjUna3i(ZgND(4TF)@h;@2>9t(V~wM)3tNxjRhw@h{r5@XN{Fm*(G{MatEv27i$1
zh)M%&o+qGS=XqiLGN1Vf;B=(j_1|1tFsbbl{JsmH^6^84adoz3yeS$`!rRnYz9MQq
z@Zc5fGEQblVntUX2KW3)eG$5rw4~|WR4H7sKMLZ?uI{@_xtdc&g>W)c3fjGO3T(ZY
zRB_9A9@9fiOR103os6Ftm?X+PoVbl0i%H*vrDy~V&yZ2%DzgnTYjrz9ehN16*~~+A
z-Uq=@;^_ov3l|^rHl(XZlBCnyR#zNg;xny_4hy3Tv)w~gJJt~PumW)Z@R@Jvh%_H@
z5-eXOpY`CG<Z3Oo==PHRkp;0XmbdF4b*=!;hDt7f=2vV;vg11;*Tet9g|%K3Z|a3C
z5f^jf{~1>a>?QA6kYv*8yC3#(SmI{FLx!_l)tfmnyK0AG5T(T^(M4>oogCaoPi~&M
zYkMa3ELZ!UEJu!vvMLXX(yCrICoJq=ES8ufZ=DG38Av^T$Q90a1u6~<Y5P9JvXQ_>
z6Q3XNRE^{?-~-g)-akETEy~m|p1GVp5f3bu>?f=ppdQyqR#@=xi)@Hy#P$<h6WFU`
zfIK7HwO^22O!l5m7l$`7N8r1Vo^e9ooV4|dg!6;0m6jtaKAy1O+h$_<RRtu7wzSJ`
z#XayT6-N9pCz@$mB3r<N)pft*;3>wF_k!WM7#8}pZTK9O16`bt@9Wt(08g1nF1iKB
z7t&%y<u=l9lwpbq(iiQWobRu!Zs^@}?WTvaWDAbZv!UJ2UaKIq_ug$-3WVM_FSC{7
z=+wA^hWsdN8EeuV67uv_f5tZHaB%+M+HI1n+|@DoI-ZS$R3C4pFIUDy^dr91P=%kP
zn3*Y@&`@nQ(;->+jq;oCl{Xi|v)x~I2bs9_L{KESS_)90y#-^WNyxOD@C`6(!7q1!
z{ood*<`-|JmW!TO($mKk*R`wen0Dho-;a&GpK5oSH{Q?ctzNbxQPqyM9(u=kCXeNK
zuALzrN*q$xy5$e*Z3wjXc~NF6X9j3)#lG6F_jWt|4u3YX97z=<MdjV=PuA~*h|Q5>
zc^O)$PU^%5HHDNdM)r0kLh1RVqE_VCv<6!x)-YBsZ>E*YiEg9gi{Rwz=D&yXa~?cx
zoPm*;ZQbT3w+v4|ov?@<-iIg)_U22HUG40{a~QN;b_+D5r{R27Ufu!URx!Kh^+K!*
zcnoRs<IzT6H(MU)%zev9JsG?X!~<e66}rtouIs`Bkhmu$Yya-vPvk_|6QFpl3#wse
z$7<T=xHY4Ro$1M*u$TdyGsMbHfT3L(Cl@D#%z}1B2;tQ+aEkUd2w+B^|9~gPz5u6*
z|43B!g6~FI+5cT$hbHX^A?8Hia+!6(^vCU2km^s>%KYy%Y8C)-`&?b4Qg~{VYk}p5
zP>PV!Pt!`T?>}{Fk{#aLr|WW-!o#B~)@fhA?9ttJM}>zYZx19#lYC4wdiTxsLtLLy
zaWrA%TOHzYlK<sMWxvZrB+I=)R(io;zm|6`=3Ts!qeCI_OYOk_axg-owTbwO<eftG
zgk`)nwu@AVWa~pFv2)4c8fF{Hc*rh+MZGzBgW~+})^#FS%@2hv#p6Xjg@)&`FrqH_
z>-Fa@1B}x9;NQ>%QlJ}Ld3V$`06gx#fj5(?H)4?BTn}<mdteYh*#Gv*_<#o{9}@S^
zz1rAZEW#M~L0CW&ps6A9q5}kb2}*G`eGNA=YFkBf;9cjZ2o`oR+3B&Fa(AAuATTyD
zDgCrg4eQ@Sz6hM-iB`~^+2E0S#g(Ov4~36V7F(q0(Ov|FiH!o*rb|A07~T>jpptOY
zrFi3+pZ7_0n%_qZ^>2pAB(v&E_{Y};QNP)c^Ijdh>T}TauP#_j2!FP|GM(-WQbsUB
zc;prk`XOcmi-<rO7#{YhAHy;DJ(RsJm?PvA3%5#QmHM#LhnS!Ocm)dv%y}?{sCYEl
zsbJ5j76F%Y8+9oDWEYnP&kChs6M_rO+2Nhn=K;9B>SNH-kIE2MJm)B4Vsyy@cV~+>
zoLRfyLp$yg7YnaJGSs`vb~^7M_V*l+{w<BVM>@I9xWc0ae-DU&W*^=ZpNlSMC1y4I
zzH}faEJ^wq{tPP%4Mbb|xVvgVxrjF=8|dKD20<vdU(M^Wx$0t==yXL~@%SM4!itNQ
zx8GAGRwh^6J4JpzW=rjy(Mi$;#7m!17x@dv2s8!I2tLD6Y3=%SPLwW@6S9l<_e{e~
z1-}w*k6a;Oo*c|b1rvbVT6~Y@;P<P~#esup4=c77MBH~1=av<Eb&P_%W`hcpg%r${
zT97%DTT6#vW`~((w85!LFyFUbI;gb-LAM|<_Qpf;@~}MI-OP6b&lf`UsqV6y?vu_X
z4U#Y=R-usMnHlBVcPEsyOZQWfGycCttQatV9^>_t(RaVquu2+3)V!F2r@dArC^1n^
z^XCx))Xs=<fWwlP9}$R;UK0Vyypw2RMYQT~#@a&mBPvGHJ+$mriJL!rR#@HjWX{DO
zh(CS2qQ&n><dbTrUEy_#vK@LSLDD|kQMbk0HQMWZK8&9yErykJHWh&fvp1DTgym$_
zTR%*zT#UvZ8OA=wtzo*Kaj*{>#M4RB!ga8JMepst@&^PUZ(surZ1AuBJ}L~VygHE3
zVZ&ynt^&1Ww4$#+V`&@ETLDwP);kVO3eb<z!6iG>S`*We@J<P?$8<oh?=WfT1Og8Z
zES;>n!lb8HUw2I#8~C%TSL<E3E;cOGgZth7CN8ktzBE*F&GpG2^Y*~H9WrKt1fpJ#
z4Kh@4ZFh=40k;5-dnck}MR3YjwIT*LWMl^PfM2S@xxvD&t-Qnc=2u%c(*}){pZkpY
zniP3)n~z3K;C07}FTN19VDX8YX0>z^<(rn;zJ!Q!lxBekc6JZQ;;B*S>F5sRa@F~Z
z5tS>1PK=uodIlKmB{^79{D|;KqmT`_JD#Z{Z@Q%Pn58PwO>>P|R<!@v0&V+>yy&s1
zn<vkK?&s^nlL3x$oBsUkkr>&3TbWFaS~x;1#2EJ?!qOR<NvjE82%b*GsOq=>x>HW=
zT|KJ7*;vh^5r=}~dm%2E?ZeWa&~Bk6Q}@>&wNc4ChA17MoG{!8q=(kJ_YrV!N&lYj
zY%1{7YH3qMtN#v{CFJ{kja?lEgk<b3C_yHM7;rGBDW}PtTjIZlePN=H>X8~0Xx5>#
z{ty$sxnCdCAT$Oggcvlh|J^fAt8d3O&}Fdn2fV}(VT9vNDvDmj2TI7L)S&<14Q+{z
zilXuzIu+8$v;`*Jr#6wC#_Fl+Zf-VH7g(^ujHM0WX9RBWPyJs*zR?1&T$ieZiNp0x
zVSIlm?2Ux1QbH&81X{ggnOqy~v0>qnDTn+JigV^(n>k?#Xm9xl{3}a7&)-7<t>zBT
z#eom-MJi74fhAj{vk;o*4sK+BWi)l(_#N=CFD$kefJS;`|1W37)WD1dQK+D?{I+W&
z{h>+7gvC^WWR{5is6XREOzPI@Au?TeOM7@M{%#U~Z$YDtrFQ%GHV_r~g6ILihvEr(
z;~MuSpbZ<QY^3qc>~$;4V-gYB>$5qa8<%<;zF%3fON(=s#OHk5(?MY%-~7EA0rXQD
zZpgZd36Ke5F!bkU<U<mH2cLzSCaxs%XJt1up;oh=6smpmG~JLO6Mq?(4MW`fh!flC
zl73g9vTMISWntxeO4ZXfE+qe>U%AubEpg#%MuF^p-k<yY9&j3+SEG)6;fVr6ZAzPs
z*2rF?vm)=Q(5%)k3CL2<zPL698h*BbH}nH5|DEaeGGeowEGD?r{xbpYeooHFz%}E@
zMCmkz7jiTux{yeGx#%1k_?+keMvm!2xFhh-%;7Um`T>9P|KCR)C?I>Xp+!M!TU*s&
z^+R(zyDvw_4q+-$M<@$AnN^dOqpdy{7C$zAu>6qF2D0BWxCLp5rsKHLej*+CmHiz%
z+I^OJRD-cpE-hV7C5kPT9rIiK2OT7=xgBPeIL5(meD9-(6Z(kD*oavaQy8?q5^G?|
z%QAdo!y=SZ>Sc?z^-BzEeXH~K(h`{|_JZ}_);?W#=F7KP%fM9&7(s5ge*55<k_~*n
zlR=GoOi*;fujaT+i(Dv%(O}ef=KtaHFD!tB$El>|B|h{*(PV&5AE`ev`|$d?MhVaH
zL)#bb9Qm9Cy>A9z*mM35QD+&|MjNed+_e;UDYUq|OM&9WJ(S|^uEDjG;$Dhda0!;;
zP~3vMl>o&ZPTq6AwZ4B@lguP*CiBde`@S|N8z;3vTvPr3QuJpn=w}$zfbB{|WAYT-
zL~8FU`gDHXe6J6%(E97c_2I_Yd)j5`!>#dd$WZ#59!tv)J(e})cV`9)J(gC}XTHxa
z+-WaSebGyp1G+@Vi^h<?9lQ43(^I;6qPBLPrM~&JBOVizOd2;4F{xeun?FfoBO`j1
z=&qh$JCe&ZvQ8n8up`cVaf^;VE0>U*<MSP3lVqADB`+d;+V#zbM$3k%nv-jH$g^4a
z+SOvg*7hmevo6=r12h}ArE1lM?Ia+h^e@Vd?DM;r*r4miJT|_C+Gcj*?HQdsi1+PP
zD*O!YbfK=y@61bec7%@8WL0XaAck<znxRBy`4qT^K5w_C-E^sFmxOZU1C5%GguapN
zO|n1W!d-CB4iG%N*dH(9K9pzJ(2KkPJNR=yidDig-UjlvvA#o-dX^@+*LJbu@ZW*H
z?dp*tyVp@9xkeNOBl}LN2(OgN37OAL068ak$Vip3*GBf$p5;)S0*&u*)1|8Duq6QF
z2Qz=v!diDzePOId_Z=2>z<kJAZ~j`@qY41rzSNr)b>O@ndJdvNg3?kz9SSGLpzFZy
zuo46Goge|ty4j68(>gAS*K=$cKJ2lgFfGYco`LOyzZvyMK8H>&kPx}&9-}YBGEPZZ
znN)>{L8Gf7bu_WfSwwcr{Fwx+8-ce$iKr{C9prz!^Auh~g1`An1Clejses)N6sMfG
zQzsez!U47-6kcR1b<I&ZEZ~d|q`43~lof5b?PX^izvv!6amwRPR#<d3^f@t40NHUt
z@AG2cof$`1t`1!?9Sew_Gc>a|>V1afyJWe<Tz)!jB%uavI=l|m%USr!bq+)bNHb`)
zr3|39a@HF(iY@E=z6m05fM6LZSXIAku4059bN}}?N07^s;ElblrO0#o-nN}Wj|HmN
zX8}S-E?RWq^>s82p8%Z41E2inNnv4W%b|DW{LaIW8~2a|%>8JdVjpbZwv9p@=jfMG
z^uqaV2jS1k!TaY<tm7x#L4!J~v$-hfqfoW%<i5C_40|*vOrrbgfhFd`eadQ{dN*oK
zUPgw5V(LoEsfTWAc53C2!bp{0zMz8^@d)xSSxxq-W=~oVDG400O`4`g`|-m>m~T#=
z%{)4+b<Iz2mbaxfnW(cf-xc(jw76YzH#)n(oiB{#%!$9bb%R0jIAMA6y8`9KiFL$@
z$HP^sI$tm@V_S4*-uFYW`{ie<E?;=vL2R{7ggjur>)<=Q=p|TxQ|3q&Zv~#*PL*ON
zfa3n^-{-HrmoHX--Y+lF%mC*7$V>PUP_?zS`*9`pih8D;i4-nYuZ_5?TY);hhl#V*
zCrUJ2+gLeUGIF6{d4)UzTI%5?<RG1^2|h$ei-Rl#Z(O9D=e&2CQVLyX59xR<Y*sG#
zihrQ~c<SCZalPKxO?{`}7GHN87MLk**Be;bO@`a}3q5nrDZE{T2Y}bh9HZS5(F0gi
z<AULy8@CVd=LVmPRq7u%NdoWt==h(?1wXbvMgd;}j{mcoIU4b!Db{U7-7H+*g$MGG
zKj0&}B%><U6)LQFA5OK1P`zJC&UW}T_L@)}ANAY!M6@Zd9?^W}!ei)qzzZoL?q25U
zJOybkKwy9<0PgTc7yJW4C!vZ;s&qQv$+XC9D<^9CO+a1tB-i)ukh_8!{pZ14Pdzzy
zQQKDxK>(uQ7s+J}`y?-vi0^h%P2?Nlz?%I^Ed>DA4gi1AF_DY%1tA^`6oCe@ye2wb
ziHWK^kB1DsO>Kc{wqf)og55#m@|QfC#qSm@Ir-UFir0QvQ^DxV1}&TKo>2l4KjQm-
z{#d)=OZWCKfAsSbap3yQZ0mGFU|SFXQM{816Xs#7v@@AYE9ay`n_qvs-Wb`pw&r@_
z8}aNzI|C<wLA*VEL(KyyWwwf=d>;;#2%%V5J-<&^{YO`kpl3KRsc{{Pe5)t{Z)D+B
z99WXne3@fw#EW%-C2aW2x77HcDqPJVB5ETDo9*Dm08}DkZ7i@8vS|MC8h&Ma`iu@!
ztcmCv&wX<0{>=~L!H-w>VxQDa>RDe0ko4AWasD@+Y|we_f|Mh1YlKLYm~*~S4-_q~
znSzIuiHEm;e(y)P8IX#kb7_NR7;#_*1%QP}k#dTnjiRo4)L^H(@c>kBR}d-J05bBL
z5~nLm?{grP--ii2r+c)v%M%ClI+noXHp+1utM=bQ5_dPvV|>elr46}GmH`2?0iV$~
zcb{T1wohwyO2t;AcV@w^zV4Khw!@!1NDm%mKfG{4)>DOO{f~+5B5mHKAqDHugty>I
zW`x&->Y^Z1I)@?BP9*1OEcp}q)8wflOzzAkG+g~tP95xwc&<Jjx`L1QV6q)G9@ImD
zg6nZ|o>?y4J4w1GNfW!nULJbldKa#;$D(tNd;)K@IB-M-vof{|uI$wixHjv^9jao3
zIWQd`sC$BndsWU2&-v=#aH)R?qV2VQ<DHKwHaXgpm<P#c{oSJBa5K>;FcoI_LWOtp
z*p@gBk5@uXgF#i(6MPnRzDsX<gEb(hYt<HnQ1j=jfGmIyKeh5oF`5Fv<<0RHm;|?7
zP!_4*|L{xjAnX$&Shwyhe%U<eRZh#8*$?!pd8C#@%sdbry-<lq<_kbV55RUZ9|Lx!
z=uki(GCH<bNM8F|$GhQAvVF<t3Wh9r{1a*#1aVdiN$%p_2_Z#|e6@hIOq6TCY9sw7
zyMBF$E)9x{4WgX+ht5Aw)1To`JCoU>MOt)YP7Mmv+fQtATGnsIlze&OTRzQ4UUM{k
z;!(t8OC6lPXuhMdLXG6QbEv_HX+?c}q?OzcIDNNqt<AnVjoU0$tGE#&B1ye~hE)(0
zWkD1Y`ddh<SSH6iP-MRO^$Tgb?AE2!`Q>gtl&lPRf+CR9>YDsDYkcPX)amWv<76Mx
ztKnUfH%DL%G|C2+(wO}ZuTuH)p?qUojNL=GzcROe3P*3qU{*@2Y~7~GN($G!TrgVp
zc@pl$M1qNU>?;}nbT8MeL?YPxC7zwjre%TmA;;P(g*Pm)6em~<<6<UsRVUW{v(kvP
z_nQxd!(Tpal19_<;SI;U8$dWxot8Fw8><(iQ|e0hF5xW}Q?$~Lw|}DHuy|7oK%MXk
z>Z8c&D`ODSys4aT%cFUSm1@pCbu+0}lu=xdHJ(h*R)Kblal#V4QQ$!q4lIhX1Hc#7
zLF0e-^YRSz>(BEuelzzMFat^1-+#AeB)k!&4zDaApSGl4dc0efU;de$4#M7+sNFM^
zvC4A6{gRdMTL`Vqn@=LbdRYH$@a(^^KbSFds|oy$lGg1;2A$qgpO0rW*Yn6nN}FRu
zZoEn-t9uDU?GYQf=Rg8oAvFx3B}wFg9DDATGfcKRGux#)LcN&gLd|1roRu}8q!xCf
zK5qDzOMfJ&E@BJ2cqeeZLevw6vJndUe9)ChHb;!u@(|A18F3<}PZ-zu_(dP`24{m8
zepQOVbM?E9=E1Pmj4iqZvAQT+a#8MaW&+z1n|ClYR<-{?`oAVZM~mtW6s0MxCuQo|
zYlLyu4!n0ud^7G%0V%>SQehH<oh-CBS!>i?HmqM<x-p}ia)%q+Mp2!}V3evQcf9Xw
z$igis2Q30BX{s9%rVfcv&Ej$-C=#`zb^Sg_I=d-WYs^I0?VD6HfplBF%1&S+nOh~1
zsBRvGK_K+2-%TP=zRBxt@_>rP_qLDfkqWyQW_~!5B}nm(0#_Tw307a!a60)Yi1eG`
zl!Z^A4KI`KKyp*CcUqEeu+HfOUr=!PC$%NN7G&CmiN+Qu<1{QcyUHX$qh0aG<Qj57
zBY+JCm-WF-=agyKH{dn4?qqnE@A35AH7ls<OI=(2NP`dFO}<3H-3BKY7k;htDF{wy
z`1m(!T%xT$uBkMXBVGoGrfi%>+T-;=2v$HjacEMJ*Nn$NAq=BqAdpvSZ;8b~BZSZ~
zkjbL}V*mt%I1J%3^4u~1yYV})=o{cY6B!ofU)k{gd)bB&Ba8I&Tj=|_a6fuPEhXu1
zf3PtB+oXxh9I4H1KbQFhE(D<o@3@u>QkmzlS}wb5k_R(fE9Z4IeR=310{NV+Cu&GN
zzhy{?kz1?OWjmsx;}@rZ6r~90)y3N*x4_A0P1nww>gvjh(we@Jto-66HWQ|-US<lz
zTy#Hf7dV{<0*;@;k=B7dv8xi#_oJsr)CPZ_M)j<sQc?(KW@k$*d*QWrkxkmqI+UOc
zc0&dy<?X>lO1L9G(ty2I)6ULr>+!6I3x2>#hM#IVf_J;A8ow;hY(T2x4D9R)_)@>%
zT#47ao#epb1|_vb9?L;#MMXtXy&z!F(A}Lczx|w&=-zYu&B=<2@pqP<KwB-R_YbGw
zvtJy&lV|hMm6Z-mOiIq7T;@pd^`j@as|ocz8=H#pna1JYzYHHfD2t-aRqCoNKY)H3
zl@7t@4k{T7u<WuW?hGZX7|*l7nHZZ}TlCba@}8beO}arpx$C5t-)#5DkJkiL8TJnj
zURbEA;{2Vf=v$fR;pOAI2Z6rj3EVj|q~-lkl3S!iFKT`f{UL_eSKgfbkH{+uXXom@
zw<U1$zM&KNN28x5@nv`CJPY-y*-F9Qp4ECh`yDk=xI#1PV~$HV9D^BBUS6(b{05{^
zAjv^p6+GQ!r!6V&v5!Nm=N+-pBwJ7yym>ML&OhHO+*tle2c>`mGx~hS(YBY|hypk6
zj3r$bvJjp=xi<RA%+c>Em_aB8dhR-Bwl_jvIhK`~`{T<O$c@uc9X@k|svKY|ts2Yz
ztto#v=?k|S9RhehzapT$u7_#7rXVDZyxG||BPu^~K?un0FSxc#`=b*2dkFWQmxmnH
zcit_OSuI=1SoTMPJ?_mAZ3w&5eD3h%Bpj(%Uj6<(K}(-G={$ua{U|Be#H@!!lDENr
zV!ZY+Q_v~9>7BeGJlhJhu&|(adR|oOpB?A(b%4TQuj|XP=G~4MZZnLqb>)*_?EB95
zA;yxcPr`^j&vgRcC+k3V3Ud(|Lh2~aoy)KFL66>cRr`aj8=qSGB7K7}06on8Pcq?q
z@o~tMO5dFg7alKsaBN?sp03w=_|p^P7h0#(9nib)I&evF&mb9EhW;4)&qkX!H6Bm8
z$b(M(eRre*T_Mlc`u`m@ox}K7%_|Me1eje3gE=16y%%G}g*{#QKA1Of%(az~W4-B`
zYJ28px?9=7w+fQ%>U`wwdHBm_SM`NKl#`mgX}v58yi+&AM&O#hR?^6V_Ig7du1!YZ
zr!Z7vj`Qw-B07qh@qjqMgY^xZ{L$Yp5C2jHBO^G&h3EX)rU3Cj1jru^4-Wvju9UTP
zXvGJ>7bG%DWR;9hU%&QGM5E#0gbu_b1{t-Iav+g>)@}a(1dv*Je}5P|g||Kt;KnhO
zx->^5H4hKN)&ZHX{Bw>Z_0-Il73$E^Qh5rB-nj}BHg=AZp8a{P4}jN7N3<N_h3}zj
zps~+iQJ`C6Ts;x8CmL}RT9OjQ#KHHq*e*Ssr>pIZPR~Qbw?kTqr=9nfqz^!Clze*R
zZ+$(BHU+`RZXYoyLS7~Ef5lGU8SB~#IQ%)tGLD{ckHrvw-OBrEK&(X`Ev}JF&4$=4
z&WdY|#w(_f1~D-!wBqjhFy+oIXG*Q9ja;g_HNwooqVW*_Df!bFR780zaJXB(xOQ;(
z3XC85`keUwcI9sWpgV9KET-_&R~%nW_LF29c#?XmJU;!cW8r~DqU(?Zg~%4?-9G6%
zn5S}Ni9bs=Bj@Pq`Z|ve0k+oCdC%*!#&RXp*SyzS|2_>)dAW%u3wpSM-++p6WwG({
z8(9)0=sdSkt22j_?&LSC>%Ro_^z<`&<FTWoGZ$LZ0P~}|D_&?khBZ>a*B)ii$)XAZ
zSX^tpD_oaw{>Z*!B2P@kSb!0(`(}31b?)SV#<TqS7*WK-pB<>YgL3^@?&;jYT=n_F
zV{{ptu-GLc>GcY7=ThNer23CD6Mr6}ZSmj)&+AcmA=E`;_=}~smJaa+n5QC2SqjpV
z3~i_&snxN6>x%%JzkB=Xuiv&q65#>b;h%wFUY>zD+MYtY!C^ytlxMfb_}(bUm%|Sl
z0}Z8caU)mgD1sLz6y>_G=jCTY4f=5fUkbNE8t{Y<SV#i*%yhbK_hZ_r#C$(DS8;2m
z?M`p9T7g#cXQXXE=)^S^Ia21N?Oj%ke{yT-;xJFbF7X}5^mh1FnUv*dRk5Fvo2%+b
zK&4CYd!o^v=By!*%>_<G;WF)Df}cX$h3c#(U4e7;UNZwMsDf(`nj`rtEi3e*^>Zbs
z);!>BwOt#&%<5{fLeux#N?fqcXO@PoY;tQrKU9S>^5MPzeO~EIL|pjPGZg~vPB4l$
znjmtn-SiiB3b{hwDRL-|XZS-vcuH8!Kk}N^|F9~^0fLAVbT)w5ws2X~^2LgGh&eJZ
zMPcLH{~?Xi3Fbw1&t&xG&sjm_?5a49#W!%I+M~@~5^V6`^=gFxk4lw<VRZ^;?bTjk
zcKjWHl41+&%^H&{idDeviwP^B3?68_sqLZY{pq0ZNFjhLrL<vQwC?kMO0Vy>8FO8v
z@mwo4iTmZ+;cLRFTvmYSD;1jeT&N((agn6U`0D8&+~A<V-B@J_x}1a0>H1}<OItSv
zMNJ<oD&|jk$?y5pTk769;v#o$LygMry!4hZN~K;?nH;O&i4Jvzz{?n~bWaL$>vil3
zy8d9f=<<){4GUiXd00?NrBI#0;7jK6T2J*5<fX$8pX&Y+J=~u)!T*XAiBfyW(qq!B
zjVB54QU_RpLN^B^(cAo{TmE{=s2`{t=5ja>d)`=?W*n(v<^?y`=6#<X+3sMiBXSot
zlO5XioFmcS_1cZ(96NT!r1o#-r2a7*M%rQU`O*9kX;xC?B&g^zfOhkVM&u;@Fjp09
zwqRJA_pYfJ$0_3wXI3z_QtseV22MrcQc5P#uldRJ$uf?;2!rRd6&6<!H_zv<SR6$J
zJm0ObIBS0${3ONtu3d-`dx7;WwFd+9;vzM*4&(gd!mmi!MZ}L-zq%|}JdSP9RNa~D
z?f5P$O9pA&7x(npM$))Iy%;4H5s^=C>1VY?M3ml6T>XlGy~DEfH<3+d!uk&z19FmV
z@Tl}ID?{+sRYrL1LR(psGU#a0Rl@-2r=ft@$Q^ke)C@3FF?R^%LKVg0;lP{AuK-06
zE%eRzALq1r!m0Xg*S;dCk$My|Qim1mG!&S05vAZs(<Lg36B5f%pGTxOlG0z9Rljw#
z|F2t$4ItGY2<Q0CJ73@CDv4J=$(!;(byqXSP))f;YS>iEBsNGFRY=nSMP$r*iNiT_
z>?b(%@MZz*{R{RD-lF(PgDR`5fILnS81MUdAns6=>ARiXO~K$KM|g%dcie!|7kn&x
zmWCXVWAY^W(1g%}ASlBgYWe{%wC<PSYs9jU3<G{+BTXSkFrZFQ$QjH7wAzbsa%6@N
zgC+kJsjgaGkgxLO%NSBA-J&2(m=0$5okOL%ZQ$Y-lc2Z1ZI^_zU)>}W+MFBZJB;aX
z@<(LLidZbbtKS*~U0=NitYJNrtv_1U+5aCT2TM?!DRHc&?!K+*EtePNV}(*j9!I!;
zhWgBjgBBr_P{+N|3HEP@KXKHx@kYvWjKQNHbmY>O7}U=P+z7OsO5UJfy2sGPR=m5K
zq9Q~S(3g)Z+pX@Hm1)0we!NlgXZOQfx({VH5z_06p+OmT*#6VzRw8GT4Zm)ha0M2=
zx4@d;{)lt^r*p-%jnJp}U;Sw|cVfTL^^f7Am$Wu5?`0<y^f;hCUKii{+J53hn#hrD
z9s)>mVtbG6)fl&4Tt6Jw_3Zb-N6L{qJlqad20y<{t{e91rZihnt#L1!`qX%>Jvgp4
zQxYra$U17tK&1Omkx;P*PT^=yRZY#5H%F(Z&TW&o`5tEj0q5Z-6qgSHxmkQ}(PFn!
zlYWzba{Ze9ul?zDb?g0aBCL{WKss6}`nRWFypGYvYE8|R3=OL}P5b|@8dj_4nUz~A
z8h9Vl={??X&DBz~ue1<XsZnwQdtSoF_%sk55glVCkwF{!KLV`_x_lYlzgMbt@w(Z5
zoiq$atbXm9k^8Ud9gmz7nVgLO^z?M+3jol`%8j9IsbIr*hH+uRrhfoOyASib9G*R3
z%zsVg5WqMf8&wlV{1)TyNFaqN>W0s7um@U>i024EGsH=q0~gT|6;QB#7FEW1U#{2q
zj-h6<c=UFUfST?;I6VH2TZG{5<W?)t#P7Eo|5LN*gE};fDdgPU(V+1Ys!4ZF5{84K
z0d)ss=rdw(xBoTkJ}BLmepeO&i~>D^oVPiA>7{;LG|D5q-bDJ2EN|c@NYWMT0wfv)
z7FGxnSpIR;dOWb;=Rzk(32I)()vCMD@NM!&^EqMfd3$v%K|mql)n-iTge&_tD-Pl2
z5gE?LTm8h@KL(FCksM1=UXjf9^iD+4rjyTzb{SyZ=`jZ^cnoQ|9d^%yI%rpi;sv=P
z_;&o}_h*B`+(V&-)|WYqBl-~|YyQ1whKSo;SOh9>s2<lK@D%BF7hLr67EbIzgqqB(
z8VL@if8rcs#!R%KrE)|@MmFdi6sw9Lh=$*bH!Qd<n-eaiaHP=HDP;V7E^pAPR~-+j
z;djI4P9iVF+viW=S<S}^fS4i6%+mxC)CIvC9vXK)-x&7~H43$0oeR>3ssS>pX5wFN
zL<2<vG|q3iKQ`mih^t8-s9V}~kmDsC<9ifOD`CHtIRaNsIbIQM7f1qM=Dhe{@u5!q
zkiYlXgeT~M+UFtVrbXi0)ImiO)~MrWQH94DApa5TY6;q*Ru|~A`LBjSeni+dKpOiz
zc)JQ+jE_70bxl=ds}~m?DPxd}eNMsK7cX$6-jKyBk?nmEU6M2-i~d6ma%ZxO3<*cb
zg9Qo4D|%E@`Ns)7ao^l%3N^i-C&?SB#mMOgZ)}5w{`}R-Frh5}9G~}olzw`hg!}~w
zI#X^?|MRPA%q^k01oVRi%&SA^nfYBRFNPlT!khdzOxyGSJdK!BN@wNllyuKMADnn&
z40Xj52WK(7^>7d5DuY>OJLSXEbqBQV#1s1~w?E)~t&EC~<|=&2hFEi+>?xQ>5u6D`
zRJNhmb7oN)+lr?iB8SzKmJUYC24)h#3+ON9fL6zOirce|jHm60J54yhI2<KN2{rno
za<G$Z;4lG|u`BHL7we1p06ag`YE@rboO3CN2u{`N>bPbKQC|A5`u40FCh>Ae03+rI
z;5Z@V7;sJz8NmU|tAMnd$i(E~YAi=mj^BbadegEqNREW#L)O#cj&H`_jYB?8J311K
z|Ms6&ox!PQ%T8)GnFW>Fva-jQ0=%Zb&M;N8@<u64%U84WGN|>&G03rVQ6yU_>?m2*
z|M+Ugk7lia#uW6VS&_Y4_W=&NLIw4(f)dq_-$xjvNa}*f%gokgzV|4({Xi7_Mu?qt
zL^`VWCc|d-DO`t+?_)$j74yFa{x`;46E7rOHkXaIhi=0-<osM*SuHAZODE$Sdw-%M
zo7mBFB*j?pQ23k*(rq-)I`bINy-CtaqLACqrLi~))W@tpKMZo3*FS%eKFhA?v#<tG
zo?uF=<HUto_i!-+=Z6cugy;BA?sBE^-)^<zf1~)c!dUWP!@wBvg0}qer&N$L3IWmZ
zLeag>L=<_`S^^y*x>)>zg>>00FL~2AiurPg5$7~t?C8<uQVAC(l)Q;Epj;kD5OAOq
zDj<h8D&tg9{2}z2W=9)2hi7QMA(#hRg>`Ka)&Q|yV@xA13B~n<tzzaWzoY*;8jGi>
zhlD8KYpqE7Q-4E?$`Q>|GK~v*gj7(4E&>(diJXEJp)Nkhr;u}n_c)*=JmRIT&>#m~
z_sa}3E8#DH1@!*l`zHb>R^C!TF+gi5H=%LdtcI%)=N=g2WmF%*ul95%&be|%uI%o1
z{>w(juuLARB`rH8Mrfk9f8Vk@#rLC#)R)ziKI-#LW^{wU(Bc4mg@1d%)%vC8<9N2j
z6lTPL2@;lN7d5kqUiG2|^c7V*L!$z9Znm3yh-abbXN*;coA$#B9}J5o4z!yo2;-E(
zO3W&?YcN4<a|iOd?+y}*u$5(cI!PWk8SD#4AD^5Ky(JRiCLmE`y8dyMR*g>Mw?>Gr
z+*tr4&t<<<rhfym-WRIiT65e+_o1R3YcHKwb6s{I1RScyKsx$K2L@Fg&GV;|;-!eS
zXor*85~!fm{D}a&YG63jvp;gLDD?uN4JIHX+76oEu}vTcu(!g0*K<v&5{7ChI^wLZ
z6}OBC+21@g$j#xxXUICg9}|+(sT)W@v36iQ?-&zC_VtbJ?84HQ$1C~)06us7z?z8@
zl+}Gy^B4DGw>t_?zTE(zEb5o#_VzK=g4`m*v|@W674*?MSs}EU8a?1S76IpQDY6n4
zim%&94n0U$mx<8ELF$wztG~efT}!nMXgn$LA8-wArMm84rSAY4wIFQOE@e7Rk>ata
zlK{Ky3rV)WR_;`J`eOllhVJHiTl&9N)2kV6d=tBw>=G@uPIJ*xYsT&Hen9p39c`&K
zVK7ItKpbx=Fw(v;QZLmxm_QR<j}}E{$*mG>Rv{wD{c(f9QdwJ2+`oz{;H2qD>1QgE
z$MLh?2=~&K7LLFo%XiC3S|Kzv{~Zf%cm8Pjv-x>|<p7GRbDh2m{pbz!(+#xGluWle
z{4PfMd)V@QUEJg(4RA^Fd83*2g|<=$q&$$sfqX?7%E6x>`!2MGZ1?-a56VeNR=A}=
zdraMiBss&Z<N()G)iJlG4grQ^WKIGTubj!i6x7XA`JJay0IA$93CpAT&#cB#$3+C=
z^>Ez0st5ldDy0{zMew1GA_{DWb}W8!&dPjG$0A5t1c{~kXnxG1^sC|PtCB%MN1SSS
zjZ1Qv(k*^bsx-6UX=7BX4Gk}&hi`G-TbQ$4DdAyn7UQA_)V{H9YodbfU)yzzdmtTz
z@2yX=sSE|;X^=k=`u%9JBNW>I?_B5MjX`ln%^nlp<sL92MR~Sb_xVqK07?r+l}6+g
z9D`KsO$94NKW+2iq8LH+``6T<@afwfA_1Z!IVK>)8Gt<aah7|@Hyfv%%hRV>n9IzQ
zpCE6!Rc1_&BPA6@cq+NoS45P@SKDkgWJDrdFiofu4hBT3F&0#)?xPNlwY^=F$ALR|
zN0KLIMSF=tHlb8O>@>nk6ZPQawNS4e{x(aErQ>K$d;8%MB894jrY^m40*jz5@Hu^s
z=an|!E_c;!=0G$Y_F+{C^cZ3|I#*kF71Z>@>8P6KM|>QXC;&?Qa-dwcR%x3G78muQ
zq+V&}bQV9BIEg^G(MP)Z{rCXYAU|y=vjh>H;obBH$SDDNgy!1FV3<B=&x%Q=QM@}B
z(<Sk|s!1q-<EE6uWi{d~6#GX!d#?0iJ1(Th%n@H4GRxo8#<~iqL0)kG=XxAh&$Bwi
z;PqKjlcLR?Xw5Q?ytTONii8H9<8{(W3i+E6DZaE^@Jf>kS#eQ#{u)>=XqO>kqo)_L
z?vj@zz=-CaSyt27=cppa13m5TR2*CXE83a8-mF4u0#aA#tr^oiUB<1@X?c?8e&VD7
zx|3!z{{yr6gjpBlD`5|B0(=TQ<q;m)5WysFg>DXb*-4s%*6aiOF>ZI-J!0r!>lzpC
zArDbRse;P}Vr+{e(YK%W9Na+Qs)g{IU;gm%5rHpgf3|n7nX9JnaLiiJW^D~<D1adl
zBh`<<eO+$GQ3A^af$-5`QSPzVy56J-#nxKWJ1_foKNJU_@I<@mErff&x(ZI}j!P;q
zpUj_@*^=WQUwX~U&J#?rRN~bYEBkBOBL?B^aOF-;==_i1!Ip4xD#t;E`?H<_n#}X_
zziY+-8$qBpW@*Kx)<NqT&qTwA7E45bGojxGmr<GRt*E1ET+y_HSA+gY4?>o@S7bMQ
zK8_{X^XIrV#tL9Ib{@jLo)6J+X>2kfx<Lk0o@-vuk~M>kw+!J%w!|43@Q^fq5fRMn
z#_gnTNi}GK*D|mJDWB^~gVrAhVz1>`)-#3(9$4{-+}JjT003*rs{x4fMj=rh7N)GE
zVmBY%9nrkkVk-?;++g!>h6FuMm90{>>MRsg@%Y%$9v7Pn$e{HWydr{oe_)srg877L
z5SPn9p0mg|onO9PtcE2krmm!;ddn-NP(cY1Bdx;o2y;2nZw7QJ$52*AnaS;7>in2c
z_E$6U5D{-G5F0T}Al@4b5MlwB`wAx7G@juP^7kkg*i`wV?Tx)U%wc)pJ@om%T6-?!
zhb9ag@H@=h47h)%T5;ZBRyFp^J%FP9AaxOiMUaiwgN0mTP{MnF?ux%w@?_0a-%~u*
zp)=QcNmnML_vkRA`fnrXW;(4V4&pBNoerz>JHK%8GHOqEx?x{Ai(!fId{8P&m5ttq
zm-Qr@$zaw_V)Ut_IYLedEXje@)Rnl$c~!1Kj~~lz)e2J)K%N%{>>K+LU(KbMh^A7b
z6Qb9pLOejJA6k>%O))ys(r1O{mlnrnS+igU7TV1|{9~a*ulP&2*(;U!8jV3AnkSn0
zar{;0I~RAzIxo&#>)YO!VSvx^0<KC1r!I8tC>rfCwP$sJX5sy)CeDp+<A=buLtDD0
zkCTy0Klg@}G*?+`ovg>Xtm^g7t>X229g7UJYPOxrge(h7i*hXspiPJzKhQTj91sO3
zr-poYP&?6F7e#2F!Q}KTg1ARpp+|oV$s}$)d7vw$$8^g#f|ITD^XQg&NrDfFD?rGD
zN4+n^{nxZ8=9Sp2CT)b+SYn&DxsiA?w4NMFF9{FI`e-mPe;#d89&EaK)A~5oNDfjt
zzVeA#i28_-)JX!1u}cAepoTHH2<q$VgXdXMNYK}MOK?ZWe?5Y|9+$NfBP@EoUv;Nw
z#0%~c)>lmIl7y=BtG249o<A}ulio;e4Jd4)5kj*F&p~bpOn0Gdl#9LRhP>OR)c0yE
zq_ky_mtn!L;*DF!2@81>4#@R7kr}9u%jvjno?LG&ubBIG9*A?nyMt@%N<QLY1TjOk
z(^NB&J1q1um2;m#JNXg^y&6=O^0U3u?bsL>;!M8sfUWP0oe5zQ9-|DuP)g|17O2-l
z==G8X-s%t7<!@!iW;Sl))P)<Ltzn9-$cGz6oImW?kpuFlc`L)?0o6kJQtf*omozuI
zt}<;xu9q^R&IVXX&pZ%G|Eu?K!XCVNA+PiH`P+MW2Ey*wmjKC^c`@%S23z=CZQ=>b
zJ=IvkNUVdNPi|pNrs1N3?}_U9X(%&Iaqf=!^9LSn=$D03Rj}@k1@i|Ui2vn(iX7x4
z5Bd#g#3M9p9e_V>wri{32j6X>zkT~wsT2kDDn>XbTh-Qy0ty>R9hl^-GwY&obJM8_
zP*BYg#MQ_bPf_i{K!gd+bsKA8jhUDHIb^CV9s5BzWpP_>|C--xCJK_P0GxHCN3^g4
z_j*s4!Ya4wP+Kq>Z_$Rsg8uoBVuOMZ*;ZhmA?mId($E@8cff`bPyU8l>-o0=S&*R(
zPX1R_b5SU~`2y#@55Q^KegY3cgZlX1!Q_cH5WQ%(qg_9Pnu734MU7AiE(x!8;mP#M
z$<UOklj4Nxa@AZ3KO&aXfiKI_y24`UfaCQl?!0CUQ}8t-DAn&p!t&mt{7R@_!RY36
zJhcf|+GbSL^Q0&-!3N*$a9GX6Z4{V3O2<xBp@rk=uS$qV+Z>(<#$X&W{PMRjU%1oz
zT@R5HtTXR$zKd<<+0yOiP|YMHH!P(KJo9A5ZyqtS&r<Z0hhn5#OW5ZMZGjpe4z+*}
zk;k!p?q(J4azZ~l`IX#4@85iu#Iz`#E8$8WkB>?W91ksMzv6F6qD&yl5u6na4bW)V
zl&3pc@uJ3FkQ%^~Q_EcsqB{3fjhY0HhDo}ZhSK4GlE8q8RWU;xUs&1KwxS5C#Dp8q
zD5&znUL?R@PCOZze38shTC9D%9J3`bc}{yv$MvV%A2CpJ*Q5Ku&fiqF8WD`K*ePG&
zl_Y~USNejNscEHau1Es5nKG=FkLD*nu8yO{D&W-te+@t9XA}-_@<$6S40XUx8b-TS
zdI6r|j}wu8adAv7Rwr@n%wN;Ae&?}I-ZLDn-vOm1@G>@@`zOgk`)k?VOF%h3O_XY-
z(?IHJZQeM<I;jih$bTkjH~BC>{H@KqrHpUJ?rAQPK$y_P-ap`o4?1hgBx=Dve~NXh
zo%2m`r?AJymy6o{CGb~jP8~S27n0P}9G>IEJy_cSCs~<E;1F!44Q(K~Pl!@J9{k-p
zGQ&QF#^ZG(<k&r?ef3<(PLK~54W(;pnUo_C@leNj4m}cEuHHyaM|UycTRR$on6(Ij
zp!H|f{M&LKYlu)GCmbJ#owNxukxRkvofk)Z{QwP<b27Uo>Knn7N1?;Vzw_uXWj6#<
zR}v<ZFTWtpGr!0aSk!lWT3=Z?&D-Oi(UXJIMO_cc;C*K)6J2qAq%IgJrqGgA6=}g-
zV{?sUgfo?qoVVU@DbUCyU5y1BEszt}kbJCuY1W*)8f(I6#4dBdc<hKuW{h~MLlqXw
z*}|bmOsYR*C&|%Qxm7L2$E-(e^ITM4>HCohcZA<SS3Gr)kD=d`vEBj=GG=y`s#Z{-
zGIsC{s>WK;B<`{M6)8_@4_?RDfBc0qWixwWc$H-*(^SCE1&O`^_FB)op@|){#(oH^
z+=d6zZn}ZTD9A=pH$dIlcYsDSo$r|I!uy*jUcBS*`mlo1FCx^sq(=KT%44{uGHY;&
zJ3mpI99dNF^Sf8as_ma|QAD8^(-&6(UwHzQEX75d3CBB<4rX6<w11BlbKaTPd}<^7
z4y3O+-Wpy*csPlqpPNnLx~#;&OO)4C>bI%V9|#z$&mxQYoE9kf*sLJkqrO9a-1+TD
zS45C>tfu7qNPSk^rGs+Pcz>-iU+7Ymr^;mgz?Y29?@!9Ro2%_5A}u;4yU;%+J6-aD
z@4aAOl-(UF;wUFFneMMMvMupVErwY2l&*z8a26^tK40AS*e=#m7t~%J6udWY7R1^)
z{dbf^y<8kbc^=RdU@WQd^WV(GE%r^ov_rTl&J{X>aSQ7UE6A#9+Xbto8U<9M6|o9a
zmDGF8puOh?{vg{#m@l#pd^n&D>Aezsoid=Gcr3LTnnMJg$Ap%1lP(!L+R?9LIi|lh
z(0f=dxDJXceDjw2lb2mN%A?W0hOcrUB?TBguu)z}Bd!W>q(3hCAv0dNT%Dj>KcLy@
z1hN_?ukg<uUCp*<Yyb@T54e>Z>KfPVyv5_MGJ}8mYuH-(@5-a1UkJDC5hhX-1!LCI
zjgNh_j+yZ~E?goYQU^Qt^425#ed#h@^s=qc=^Vm6ipe7NQv23mm-%gbA!KmIU?5Vm
zmyqg8(O)58w(j(jQz?$U+I+BUJ81%^X@baHZ1t#`G>hgb2dWrEJEBHgacV=sis=Ki
z{#0kL)G4?ffPF6c^DQW>BGty?VeSnz?x!C_e+SMaEra|?XD~n4w1$~*mF%RO0>>q>
z@!TZmi}}G0eLEl#Df+MPkfV$`+*gjRn@Gz@$){B}2@z)+&%UlU^KU0Q+v#xSfG(IB
zPR;jLCV!pezygwdg%tD6RUqBqU{>Bf-us#wYO(R&7jiU$X`3Y?cKhc8$iZl^dti9D
zI$5gz65Z2+U9dY~(q_YZVxYki5v2(u*#vS%ZUZPow>iHbI%A&2pQH4<>M|*!Wkr6R
zUbt_{#elr%JRcXzO1;qS&M5DN>XPt3az)*qU+=;gB8dL<byRJgpL%spx+yNo+E#i>
zk1cSx9(Xe}HQO+-fxf9Dg;L4{9QeQgY+DeJurdHivTSYQ{Z;}9m>P*x=Z1R#eh`<4
z33{lmw_PJi8{#qxvBdy56s2$1AKU>|$>zz8Bz&3#a$l_*lW-p(cFCCND_p-2R?<(u
zuaF!E-!<LKuWz5o0`T+wF>h9E+%wdRf~L4vG0H4g?w<Ezn{dbL#SRq@9^OF7Q~Y9>
z+C)9GVv#*??|>||D6yxx#xYIcQLZplA`=`~D4U{hG?v^P?w#v&unS%bV;Cc9PW$z5
zQ~VU!SrtWG`KS;q&gFel;5et9g!>=hr$-v7ge8ANctic|N3;i9H7>N3kq`J?9kx5?
z6Z0{}L4Fqry?WHcc^%Oc{#SYnbl)0>=fk8m3e7c~<Ozqnm`~ZfVPv8rZ-FOh@|xq)
za8O>uw$xZX{;6b`T!8xaW`6v|<vQI^aPS@;-sw*#m?)%9rN=HQk3ug(l7i3IYZWN1
z3QyVfiC=ZxVZzBsuqD^<u?+>BW;mkGDssw~nLi(%e21NT1GLkOE!yQfRV+~VRACgY
zKQF#?p|mt1s?osMvtPR*>Uclx!bMXmcN+kWEJOX8jki8s2sr{BBjMwf`&>W{R$@nQ
z)10mywh_g^1H%dcI9_<p?Okt@7ZD}^yNG+8bx7T#Gt72FetkKQSW&9>o46UxamJrC
z68ij!n0E%g4ma^$#&+YfnJyHx$z@jB25kQFct3xw#Ft$EPEAp}cgxgAYUo4$1}k9g
zUW#ZThGoeEkijnU^t*=aKRZ)>Rod90gfFN{bcf*uEN-A#xr-DEBTXEi;Y)rzuc<~R
zJkM}*=51hTp3M`1`!z=N%DPGfAlU@ZyTP2`v)!SaBR0C&)Ca^7M25^;OP}wAg(zMO
zdm|d&b^CxvF(!g01`}gZayKgH?6cHljAU6nuWDmv7epxm8wM9L%X^>dXpHXUH~j$c
z9$juPuE#r9Ds6(7Ucz&f+watq=AmlexYqaB;Leuc?@=8KO^5IfrN4ki!bkdht@kYV
zP34j$<+wlT)1vP7!(J}Pfe#G33xvU6{?Tpz;cwbqaH^0*zNe>u`mFa0h~43JGAd>S
zSXuGlBJN|!lQ#SMrpMUn?w{8C1T1O6_Qv{q>fKoz6Y)0uk*3p_6w%>W^?`Ci|HB1!
zV>}q%!y~swE7!-rhg&~PX<AlQ<*s(Bo@yJuiptoQ|LJ{DM&=IRcj-z&($!UyC-{Tz
z(qCkbf6h^|hOQc-h079yZyFyRHllmFtfzQZR4}2A=lwl|z9;#qMFP-j`L3th>k%6C
zV3yuzJ<e_<iT<IRfvP7b`t73TFVweFHwev=V;GK>ZL6+f1uU)>Bf>bemC=SPT~lQa
zTy0Y0gWY3C!dATbKx##}W|NHJ0Lqrs4<DdW#64ObmnxV3xx^Zvk<*S~wi~RCe$|_B
z{?MtIO8+oBRU4!cVGs+kmMG6GcNnc%`Rsw_4n(>?`K4VpUPh!uiu6cT(3;U}#%GO?
z5S6?In9LNVEnU%|OYIfpZT_vacS<Ip2?TZ>`@i+aYY2UbFr1?5FoBm??lTDeUn#7o
zZ;;C?#o9cCu4s89TH`3mCO+afx5w0nBp5aY>AO$m|7GMZccHaS<{p$aHO0F*6j`kQ
z`^}tZ)tH6sLVvH+7u9m%NBa~_H>LG+Q$JwVrkr&)_Uk{oU%o?@`#<hAkHBvxz<&tI
zb(8?4GF=|{qIOqIw`I!_QXCq9f?SCd{SmHg4VheR0&CUmWQSY6qROAB5+~h<%f{$v
zK!JG3=~75I6|@VT?Eh{w^BwZA)ov@sRsXlIGo9(zud=DuiPMELml^wAOyPG<6q6JJ
zb}^+_<Z8xOI+>P=P%}8@7DkmLls$dM$-*DGLHhE$UU?>pFN+Fn@SW-rD3srhtOlQO
zmGYJQxD>u($XA@d^ah*ztAHZ)+<4$zcv+Ay8)!EC3vs$i+9BI3Mp?D<#)YPV89S0F
zBX7pwK+V<>A-R%1LQ97J4JB}VFjbBo-CGBc-zLU{2~E*>W&$8%{xDX7;Dv0<$%ztz
zc*8~3+0x|9a0CM|`jZ!m0*wfv(-S;xZliekXG0m7-nokO+Y+`tCYQUtNv?kg;o6Jl
zVoy+oJx6f$XI>7*bW40~he?lrn?o&R{9cS)v{kin?f%FF?vG^V8-G{b97T?pTb&(F
zvJU4Q-qRK=XrPK|_|e~=qvCu%>1`!Fx_WDzB(+<!y(ZQo6KFt3a(E?&w0Ar`**Vo>
zDHLw9%DUbfO><>S*^QFV4kgmhj}!}ADy_jfEAqU`y(HuH63autuotxu4nVFQYGHs)
zDBxZBs-Sxw3LE2i5)cp~p_qsb&@bqnCN#G0Y=UMJ_Gd?;_Q9sY$+KmrmqUWlx1S-9
zc>2uJHB1|t(84mO0?Fjq%Uh2rjT)h$ngC3U4mZ@JCg-*qqVIvBNlq*O0{TzzPKVl1
zSwOBK!c;z7a^W^`I$5VfhB}wY3X$gNDqcPOB6V8-!1B)2z+ynwjw`bo=(U#1Q%0Yv
zDWjP4ub^kqiVzni{6k%&yUKb>iJF;iOYBl2kSdf9uX+UYCwGadtUiO<&Q)DT4R;l6
zTtVOuY&%bRLj#F6NkcxesS6f~HfxUwGQqNMUg2p*^srF=I5;A!Z{V@{_#?09!J5KH
zP0<Fs5QD0_1PEi1*dsf;C%-V1;xF=E<+hQi3ip=_yLF53Qh%xUKC>i1H2|-0nG@q}
zFwJk;2hB5;OR*~YkyAvG4l<a)!FCEPXUKTWQhC`FR|HzYAF`Vp@7v%d>0ePPV{`gp
z)u8na>l*yv>fj7_P|0oFm}pDsDIugj()Yv{T-mmxX6xk)IeW%yY7FCT=VlW+TtV)j
zfVnSDZ|j{8WIw}K+qE-PXx?&jc>9Dj(j!tqYjSUro7X^8-@=n}oinu&{qR^c(5dr|
zBp<dBXIOQJ&e@(+Q#Xy?k-Y}EWKzI$9KVO1<lNiNmg4rz>-aplshay6!JsJKMqd$o
zu86%4kkFR_*V;`EQdMNIujm24&_1W-^g6F}5Jx#U5J2|_00E}pxE+>L`pEs(visEN
z*^xmmY_VD!4^W;)e%RLP+G@R}?fuIdvnyz)0xMr$_l}I!=2#(xXk)z|b-9DYKy04i
zwk3-c*aavrrGoN3_z+PU$1En@F8f-0j7Le88a6ylC^)QkJR#_j(suKoy(8>*nf3L)
zTt!|L*XRJeeolJc46ZiWSxURC<rVR+HAymMw=2%ld6n5&+A9`plkM>T+YYTk1x5Of
z`_=(^NW0!a;bjmqTR85@;HeCdbEV_g-iZRO_R96jA09NEm&&TVeFr(MXx)AXvf=EB
zQACM->v+TN?MPOm!9BTp*F*+OfHULKxg{vxqh(i4(7@wlM^PRWZlg;BdT8}^r{N{D
z?P`<2_fZt%2tND^i^kU<RM5$Zm;g5TjF0Ugc)OjnA*r-M#f7*4AdWq8)puGU`nEgF
zEmP2nq%&L|%5OpN@#Z-4J(x0+$4}JdXyH%_>jaz#B&=zCiZMU;PQTS2x*AFSrqb&@
zKNYEWJMkj~-Ey_xQ26pav5>yTfN-8$r@z!H0P8_R6akp>kxclKVXqq9ZY>Mo;-*Cl
zCNX-bnriKl)Zs5><mmk7!|UreplY%NYJ=7X+!`yhgqpn2)N*!37x#S1fVcAUuw;5m
z`nVTpku}2G%UUG;*?bgw6ZtaRPZ6zMyni=Zit%{;X8MIT)#C3^l-$6J{`l9*W>qpc
zO&uk4qI`r*aOZ7)0W_&1>Lb}kK;d1)7IJPGZHvD?v6}|#8_?semcq|PHX5Y=Rz_U7
z%hs^2=)R%^$kDC;#M-1-J=m8><k!CcJKk2n7Pa9EHn+JNweptVYEWbGWueR|)%Io>
z4P*LSmmw3mJfA=^l>!0pQ#~lmbP!@~%9yx*s8p!2r}3Q!q#a~gxa>gZ<A~b~Y3uNO
z!&%@T5m3u;HDio7=D`#5&Q}}bkUvBtIK!|vP0n5STo~-YO;g^NXXG+!Bre&3n6=eT
z1)E2?F>qS=gooF%b#>wkazpzphm|6KdEn?4o_|5$?zk!XJY05i5xqDqKn2q@digsl
z(&R|<rgNY*p&^MNxyCGvJ}5c{4EP=@VXUSyQ7@#nKnVZ0-_p3~62s?C_zt+Y$p!Um
z*rWROpW7`^e{KsQaUr&`ax`;yWqni5N_|Qkoy$ZQEo~il^JXJB`{UThhkiyz-e{d(
z4KxeH_CU&M`t2jz0+h=9_^K_)DQ0K%4B!k$9*u+!%7;4=cBF(cys6>EqseG%*hkn%
zc#=YwVL61_@LUw+rb2gjVVkSl8c%SVI$4D0J|-*9LG+hO1uwU+YA1N20>iD$jrG>+
zE7u;I?6&}#ZSljipXa{H_$6VrA{ajE(&Ay`>nPioOn9-~O=r8q)uJ>L&XVVUww?>?
zoujh0B`)K@v~ZQ@cF@4e9(4C7yuc{eJ|Zm>XArla@uz<83N6tFmMs7l+0%9uSHb?(
zW6DtB0ave`OYTTHiEEeNqO{~n^8A;g!)>cVf9I>B6_aVY(qS-IoRx#a*uXl=;MFDs
znUj)|lGDM#q4x3ijP!WDE5HQqIN0k5dK6rQ>#N$TtE=0b*E<cX;e)SSO?!g#j+dJq
zO#T}a`Ne81og?*0pk(L~Ij3^`<_gGRm`_6WXJcHq!6YRgW(tR|AOC4rSRwEk+|<yu
z|1bwD{o$wL{kyOLtL|rjX6>UWz@`oTUj|wNKY#Rn|Flvt2k3(oOGUZ8N4cW?3<w9L
z$ljUoGP={v3Sv>qj+)XO&3Gy1782r$y3qYDTZOUueQLekBU%N^#SkF_t&Y7{zt&`{
zBk-Pg@joatr&;H)$oRxa+LJ;Y{3e;qYYU4n8)!{R*ZI@eNKg{XMR+}J8m3Asw5#cS
zGFqAO-3p2gE3WA1^4`#0pFR9b)D7)%N0wLq@KnoZ+9+lqqLcI8iH?URvj>7!>L0Y*
zOEYDO@%wZm>h$+)45+)G%SVFI)jvTJ1Gwh{sFnKucV*km=!(?P@-@O@wSMSkQ2{S4
zb_*@)R=aPDQ9~Firj9OKJnJeh=0g+t<3Nn?+Zq^80h;(MFYdbS&FXKj4jfOqhIdy#
zGDcaR40^!RboAQ6txZ|WeyD^D$=)5lDVFO1Gcxj!vqICFB@zt=lic6gF6`{*Srlq9
zhc7GJiNiRBf%!K9y9wBt^L1R?hw)#yMrfV<BY}C_u;{=~)Po#B7rLT1y<y1r$*rJ&
zeLcT-R1jDC;)5Nn<d2fn@Jx&rl@K#pij|PO&x*#h$O<NnTl0|3*!w!LCKy1vX)EqS
zG_4C1)XgOH5_F-!pamXuM*phtuAX-(bgO}!1n4A(V`0ySE%<TU#XJjF@ceGZ_gEO*
zIo~zpncJ)uR<DQumM|d}WvRTq6=XF>hj$Yp)AvoI0Ma`VH~R5M2>nm$wQuC~-j0md
zGzO9#`0hu1H2x&A9#@3o>*DBsO_QhUSyNQ)6!fjNmr3OLA~p>3Lc~Y(z4eqM7=F9S
z-^7Hz$rZG}>aofmKI#gs0{MH`-CaVTovo<B#W(K#qP}h*!>YUK4|0S%|8TN&D5v-c
zfz-jbk~4N)0s4%Qm2FHH7Z)J7ae?1y`G>~Ae)@^#J7AaM%J8rf?==H_1l_ldNGFV&
zgds*LLEM*KG&Y-CpGQgT11#J>JG0d#xs#S>z1AQiSI6wGck&&0lnuvguw8;}+2hne
zr6Uv`@YO*6{uh_4uexq}^VYg<H&JSOs5X0!!w(W;F|6BM8y;7Mb~n5T%3ir$m`rK?
z?vCC^v4~^v!l(E<gVhi8RdJW}b#dAPd24Ly?E+xO0rP%EUDq2=(&OU<-2ua;_`kwV
z8C03NLrdS<d609Y9+X+$EEvLfYb3p_Cq)KT3WL-0cGW5na!M=PuAJzQpjL{Wp8Vc0
zC}e1*#VOu?zVdwI1g@j<GaNB!b*9F_!C}%qqlFcXQ*@)WG+z@_^x)2mfB|#$=Lg6)
z=xGU-J<3V{X&u5|W+1`35fKr+i;Ee^v?J>@^s#UYmyCwSSq<b=aN^CehLKE{A9b!+
zH#WZGY4PBO(V_994RjS8ODu+8WH?!5YtY5a5fTgN0VeI}%hp-ouC@o^`8XR|9F(kR
z3JEHf!6lW%YUbczDm@_-kX0`UxT$m4aDxa6bIP#_%Tv8?VTTU5EVH8-mo}mziKeXH
zt3j;m205@D*RMecH*7$WLwNgaJY)q<ZSR94+=*qYl?DJ(zA@DLr<-AGa#v19@uf~~
zvHS4hY7{~C`Ue21rtbft?5%^^>c6O8THM{O6f5qo#ag@+_u%fu-JKLEE(Hn{55)=Y
zF2#adu@bDf-}C(5dGFkR?=X-vL(b$x&NpZ8z1C+%hhE&6H@Fk>!2YbWdR)6gvJ7zx
z>=SZyn%(Z7>BR$XL#S3TnEa=<_MBcn7Kf>7gRX-(MGh>}hMf7$v|SC7I{M<Vtth85
z_3}9aw`dIWGc<{f9&zBLTsNt4+Cz6^H)!@vSm9ZLC@UzHzv@{<f;~B*3aZ@oI7CZd
zch4LRvFw}Jp+OVrR;R7jpnC5w=YN~AU{&YwSM-zjST;|&b)+kNKlQHyY>!@1!LcZ8
zKGi>F$4U&6%N7_*uUJXf^9sTRc4Meu6i=!mb5)usC|||^+fJpIex>i*_q6-+%tWG`
zRQ85q6me(c->#KEQ-g0}WN@neeQM}XbF^nmK+OK}8%Vq^#~wgmfK*!@-TwM-fgCPH
zu)<14JKKXYDwKO(f%n?I1qxLj{Ig?RxgD7Oh>ZHc+)m-FT;rt764Jo>9J1NuYpcvm
z==SX~G>^K<E<4momb>2m_85BOI;Lbq{eoMuE!|g|INhRHyiKLAlLTFIDhwH!k-nVe
z8|tKv{`%pK=rp*+N8~k}P9*DFmgGroc7(AZ4rrIo#rE&yQ0Ll*+p#P0cU|9%^Ch}E
z#y(MAL-#HA_Yn0U8`Ob@*dGS#qp57gM)l|CJip$qM(xj0E}WwFcDSB(JFOZ@eFIJG
zh&=L2IOQ7Js(ja+PxwwFJeaV7M~}Sn0>`2FWt6*`wMivxN9{HHZ1r35O^)>Giu)T*
zPJ!NQ&xg7_M<PE};Yfy@F(eT@rLlT%?>gw5k&}$;i{j)M$bqXrcBD^u^+HIbFmKQ&
z=ratmg(f(jli+hh_5=TqrjBHUnz}4bi+xw@K+;6_y0b5WMRbBfoXy+d){dalPO=|0
zs;-E-r^K!hjwlE7_<>hOjUx(z$5SK3){majBbPZRwb1i=B&buZot~c%l{^pl_EH<n
z5V40aG0)U(o_Krjgd?J`%i0*X0q$^5L{?~cprr+KjPLdRma!G5pH}jKk4u{xNd?C@
z$2r`<qddd}-$bVyL&yFOxHmj^^DrIEX_6{Bd$stT2qvw^N2}fB3)csux@;ve#8_s~
zN;qMQI!rO``$moJpMa(k-(4OyhJ;U0!9s)D?f>@0_ecg^k~Bmm_UvkU*9Dzhn#h}4
z`l3`&)Vq51^qWJjN?k$=y$Z}Bv*G4$hjY~8Hi>3P6$)i1!j^WS{Pz<a`u;Sd)KPEe
z?m0PWpo#T@c4Qzw$~x~!O#v!c;BsVmM{w_(+@)XGxCMKiNM1top)ruwc+7@iaKWC(
zkRZGmc^*HW$4O4=wOF=Lu4)}*pvbI^3jXXT=5}Wf4Dk1F49&t6T-?38-JghUlZ?QX
z%KO`oCz>$~fL{gB<P3=zoUptX8g`|hYxDX88cGenSzLM44|{@l6C5<0%3C1A{2v)O
zA8am2H(u^0YGG~mtfqULv8kUbv@qpInt<M=HrB)pd<x|<{3`Nk<}M)XHz1{E_k|XD
zR;GXC()ecW+T^?z=P>w;;DaCFexV$<s@?V&#xWUVp0Q}cHk3Y5&6u*c2#j^`n{;Q|
zumee0;<d*ZwcX`K1T*-X)0LQpbmn{(s(d{<kF6)5UBk6mKS}7n6;b6hrZ7MJ@*lR!
zKTG+uV6_WVkx6>mqr+@U`7FX;X^Okx)x`gdNJUNU+ZrBTe2c>e{QxO*L%E)11`ETg
z9Ltg^X!K2cO%row{Wjbo$3KlQ1fiOV*iPku>**9{_YdyRd#A{U#iY&9M1j9x1KEpO
zv*QuAmcUcVD(Ce#Khe)9h0wpC+z70;1rqM)()0=)!vvn$zL>Y1<99!Qy_W_8BX*Wn
zLO70KF0Y%k20meef~UVC`_Di)ABA3~uj#P6dcqwH%`9HXP@DB-%2&ID&3UQR(QFw@
zFoZq6Akv5jMUcp<@TeCHRGk_YE0tjU)aqb7Srd(<-=C5#FQvF|tX4c*0rly#8PsB&
zY_ujNqN>l_y0o-A(41%_O-QE30@L_S9Lb=YRl!_H8+Hlp-y(An#?_`a6D;60@}*if
zj~e^4NlOh+Y4za^%_JIa!%t63&KaBJ(x!4;_>|6t>S-^m%@gi!OAd5le*LE-XOmg4
z`*voywhZ%{&mIg8nW(03dFdzFL#>rQgkDp@qj4RlW71ayjj_F&8YaQVXX+Di5U4-O
zyu-qK-)tL?7bX%XsYIqHYqOCUwHDu9Brl`3NcV4)JCkcGWa8d@X%u$by-iDh#&rgg
zI!-PHzED^V-h_t+rsf(RMw`wQUpEW;cNdYtgM+nt<J>yR?St-~{=iDsd<P9`69*?s
z#9Pr)OLOSilH5h}(A~$Xx=6s-sVcW#ObIy&#DvjXtx}KyN6GDSjMJbX(o!|<J)sH)
z9~85T^`QXhjd%5+(%Q^N`jC!8A<$0lK+kn2Bx56hw-ziIicOZ3*Y6@Tf~7drJAjJj
z+#UN}IsRRLzy6BI^aBUG>#hmWc7eaeQ<~j&j@ExNXhu+%lBs1<;K?6sBk|%}lk@Sf
zu3t1MUsvNC&ouZFwjh(5J?*--T9Lt0weRWJO7SKPJU>*eiC8k1p6%ucp2jgl_s*zR
z*br=&{?f8Kuy$f5sv(7!8EtEy2gSRPhzTM>-=XVOOQGGc4|-&rh#VrIOo+30KFWXP
zgZO(}`#KZeM*UU<jecpcT_bl>Q%_c!b(o6$&j-W?NV7XX0tQQx(6tsfSq5L9?`E^X
zch%pkvjtKNt><@z6C7&es$g&V9aj<D-uFQKbYdh&IUu_bJ{qT--k$3>5Oo(lbgM?Q
z#~yqyY6ErUf^L+mwSR7Z-&3HjT);W`?UvEvIcjIFL!%OHbCN?=20Uyls|Ki7Lf^#u
z_|PWiH0>@H8}i#B>=bt3?cZjGcl`U334FSmWMYU9D-jLrLLx6FKr#l<hnldvS{8SE
zuX@Gb9%bguoasO(H{>aaF67BHRwy68U*$CnfR%_KK{lkxdF0#iRc6{#{_^-mT2kqG
zzL(_MfBT)U2=ngv=SfhS;fA*cnwNoI4HXQxX_AA`u^3qg4JV9h&b~ro#?a$SIfyp9
z0vL9LJXwVrTXU7*=+2aCySy$&Wnynl7zp&+yxh@>AgHqNyOuvoM6_M9LK?)PMyuY6
z-(7GL>PHee_dS>^Crr=B9+<egD6A?{x<FXd5IvAEf3<h5HORQ{D1L)1>ZKiZTzZEj
zc$N^78YUsvNT1uj^w1${woB)|x+08>+nlq#9hcS6VS>cZ{n?xBKFMIzML@NT>T$S#
zi+gdN6J_O}BY)4<*u`mb_T|kbwc;m4V=>SEp0PTZkQu@&+;`rG5jnVgXMef{zm)pI
z>F}!QET-#nN)fJYP?}0ht=(=EYE#}0o07Wf|DQi&uiG{ECtYx_EANSIZv3R$jzds&
z)RQR=rd(LC>4ljqaNh;7&_ZvZf0XaqlK7*q7DV`QGV{<Q<MJ7u`d*dS0h(3Njx7g+
zKlB_$M935$%MW+&6SI$4d_hn8yX#3aONGHVse`%)w%hBahX;kcL=_f-J@?s&Dd?6T
zM0u*HYGQ?%{hvV}hfAE?lRB<tUZ=<)NZlvFjW3e-_QSDA{ZC-`qW~nQu4c;h<+tW4
z^dRo3l+dj1udq2<kljrm;AlCsK@yDTFl;ivi_<PBS*Th;P<MI3)gr#Z-R-mSrlsS>
zdc3diyTCG%@Fe$EUzcl-=9(atLbvk&{G76Mh?x}NvweUKYX$I=SNWn>nHiD4o2a<f
zH-X$`FqPbAV$snVY;rA$Q^{48PF6K-kKhfNRZ-up;GmF1jtSJywrhk#1^-xuk4{%k
zF0m^r!f&u^Dy^_q_?qK-BwJqy)Mz><Dz|1h-@Cd^ZhbOc_NO67YM*V*X{QJ}*<^IH
z!CYr)aT6eWCHZ#sm)iT5HNIEyDLhA#!mZ?j#y13t&jbVK8WdCi7}u~fmUkglL<0He
zVl#59151^DS(X<LHM;!ybtf^t^w|j(e8l^U81C@xM}y(IE@4R5<?TCAS29s3$A3i(
z3()Mm#RSHtcjqSElW2)D*A7i_;QV?`UL1B2j+)<Nv7yv>{VrPP=cH!aA<0%@PNFg&
zaNx0sDCy{e4q9WStWco)dBUlq3V^Z?`$){6V0P{x?@uS88f_?Og;XZ^FrFluN94f&
zPRSST|F>=br!X}}Ab$YGa{G1ygmoeo7GzoTC?H{`wI;BgXfuRQ{526D6I}eEdENc!
z*I<3W4H)mJAYymFm;19aA)PwyOzbN%5i6m&m79|Gd-Ts}0Si8YN=|Q5;4bI>LrWvl
z7}x9PqL+xCy;ufPe`k#QZ>_ct`mnIf5<Q<!9@mVm{X1r~RcUo~COA;UMx-#$U)@bp
z*+n%DiXwS&wgZX9|56=dZYBnfnSE^+707XKoZg&;ehd~xN7A6cOEbmt+UGQ$sm!3r
zLkRJeZNvi|CumU=wEZQC^455tkjfm&(fj3sl6#Rdj%Wi&7qSG+0iVz{Rq}k@TDr)q
zA3#KXKWf}>>KthcY{Orllm<*khn!zjQ2*(7QXWh}Km23fr(BRf`u0C<=6SyA#8i}w
zw$rQA;#|*Ih85PyHVMBOR?glY39(%&F_sp*nSAt2VV^fAF8U$;-({*g$>Plnp1$tw
zPeLUPlt9e*o08sDcO0dkhbD^&rx)Vg(7J*Nv+!Go(UOKF;$zz%wzS;ccDME(BVWOJ
z_1K};s^-RQ#Nlhfyea5^I{9kNq`}Yax}RN^y>Z>o9M}>>U?coa$6uqd421qodiJ;M
zn;&ErAFO%5Bk1r*RvH7woacqx#}(U1)RcQnu~5{#9k;hcrFaJnC=zUA3;?;@za`ul
z$HM$6q~2G)9Er>{X_O(+UcX9;e?f>sdr04Vph_UO(Wic}zD~JDqxJS8Q%_k)tQ^9t
zLp)XHwEtPeP%sNLS!{<Q<X^;=AsH@#J_u!Ca`h<By{bu31TGq@{PJawe%bqQCf0KT
zrYxhWOPp04{olf>%H7s$%yo;GN*<02ZitmpWxrhnv(yyMRkW~ylCtDJ7D_XTRT#)P
zOnxAvZ4`q`Ewhu=0K~-qXU`&3MtHcu_|Mn~xD&ZY5ppULQ&?}5i`=i{Xmy;dZ({c4
z<UeU=uI+GiT2EALzpb#ZKbmAT9oGE_v^=bAc0{zkO@3`Ct*;O%P+u9}(zfRrN9H${
z9;<Up&#;;1{#Nn3okC3(MXWN44>F7H>Xl(YqFt_^lt1`}IaA+cqGAclF`cbmJR8sk
z9sB}aaK_mUR~)b)c?deizn^esn>f4LwW`W7zYdd3_g1dl3G~aJ9+5VpwlOBC4;t(M
z*JdD!ZJ(%)R>yyp85<ykZRsYR2TcMbD!!iyuktqKkNf~&0KQ{E9QQ<b#El|nltF~{
z2m0g#0`;TWfBbpuhklv6M~*(AqF2$`-iqw6#3BI|*tv+)O5Pw~?uz@L6d)Rq0(_o(
z;&u?X_~a)N4SHzUy0pLn&gWm%+w8TS&*HR96xr@aO(&8l$me#$Od#XDUPzxS+2f>h
zNQNdFFfLG7;gt1p=0rB^SVIVM5joO<9owPdOi)J3HAfGZ*ikOZd^r@v*AUe8dD*Ng
zMkc<p`*YA;T0GhQK52Jew7&K&y>R6I9$X$AsBH~8rILuaCnA!a@MCNA`u;>Mfnt26
zvw7Vn;`7W+W?0*A*8S-4(I)`69H}1a#J!L}88swEaz=_NOeh`b#~HCdl1ByC>XP|#
zv~<b{k*%sZQ)to)b6uJaqH^Tu5FlGp#^t=}!&gP1X&Ma~*nE!h#%0D&Xi~q6NBjY*
zv^xa#Pvi5eN9d<d#x&o^rg%`D=C_#QV&e#ku?QO?_x-#9y>3C+QbTSD<RZ<Uo$9^n
zR(l1nWl-{VT=+O(qygY>Q3P|kwqSgj2ViLf&>QdbC*9Z6b;d8eh65|jM<~&$VqfJ?
zpwBIsDp6qRlvyV^<Wh@yI@&KsQi?UKHA^)T`FT=uR^4$O*Ls3M45vYv9Y`TpDZjP-
zU%jp3A`O=S^@<A9=z%qbWWLvmd=0OzDndSbq8#8t|9)(X2V1cwKr)G?vgKKQtD+Y`
zUg6{?>$1S&lP{I<>4u*Qnu>K*^A{!*{5F_tF`fP-Q^K5q#wibslx+>VaklC1QNtdQ
z-MnCL(C{UPf2Y*N`|!y{^iLGc+Pym@m1?cdQO+eoJXQuP)ae6W4TX3JNbSRG5ue+M
zBQ$Rn7L=8MX4Ka-(exp?&9W|mx%@d`IdH%#H1*>~I5MhORPNpQ0QZ3%nfVohz^zg9
z5cO;S!HTliFjI|yG%Ej!o_7fgeBB4hZ3p7H9gfoH?nX!r&%-lh)eZ<9$@d5I7Br~2
zM;-gH?^E2}?|v`u{0TZ0847Cir@mB}-gs}$^~XPzYQ^0Jp)_la*xiwCofR-<C~D^(
zNrVGMn+j010UE$apV`|3Q2ijE{O*7sx}#g4z9OXFHpmXNui^Z}3egXzfEHIVz^cT<
z7m|^4I&^ac(!Sw%jb!{A`G{bM<5;<J!`LNACu!NPoistSBHnb0k-yfs!&TiZ(Oxjw
z-}>?U`3iH@twqid&YD7i9znos3}Bc$?;@yH@M~}9nzW`*3W8AH843~gjBSS44D8W$
z1I*wMQ&9!0b6>Pz$0@^udfU7mR8D+Y_X(wjaO;lvNq)zqi_kY@=uS(Yu=f^u^!>t&
zavBiSYMCVLvH98sAMAk}{&J<+uAR3FJA8i#>7<?PS$7vC*lM1nAK^<<=Yt5OT?tR8
z56OI0U=HyZq7t57_ol`>FpeSOsu(1kTh~!Tqr+QT5d<HLsxu?t*T5Tlx2PA9fSTt4
zIpUx0D#p24@&6GCTHMbq4M>kFEziirr@w4(>`j<{X#m^_L1_hK0d{ScJNj(ZS;N>E
zf2vnAZr}<~9OJK#fCakw#)S1tS?+shOI8<cK)Yy)g#6=NY?Obn_Je{RQ#zMX#5?yX
z8VT)k@#It4S?dbMZpo0eAt9fAjOaxd1*l2imftYd$e%%VBY9zWF=R6xoA@5*l~P87
zCi|Y#H}NH@D7CLXo`|Q0O&Ij+p4^l?!Bo2AT?7)(=#5LJ%s~&c&rSEF)dqre-|h5M
z8#CKxLN^G;DzE>n1I}m@VsA`Uh0ir;UATsr{dyO?*J2YzTQ~gdMTO0IeC-m4APfzv
z|K@oA33hAqS;_eA@p=0Q-Tu6PE9!NEL`|%Uv?1QzV|{v(UAwI8yf$c``jwKb+jMlX
zT=T=v-=ZU4Hn;70-k)84uc)wSMF5Vmd@G@f*ZLNy@^9_nj4yp*QE4Ri>n|&fAG2K$
zzBwCnFI~1%!8k6xW&~^9ZBFM}=|x#@`s$yUsNf$i!wUqps5P0@SWx`S*FSwZo}nB;
zy6Cf!F3sQ~pw3N}(e^}XvR?_d6U*C#Gxe@jSAMTr%@b=;06R}pSSo=YT!&6%nR6r&
zncgfc6{MfO?yy=QTQUys<|OLoM0UK+VH4mDaI-Tfm0Sk(qr5qxqkTDEG|;marNO4)
zmo6?m^3mrXwu^X|1WvKQJ)Fgs@V}IsavsIlA3H3eGF0FdX)+2@{d~AC`$*oQ&^}yU
z^7*TUvNrEf(@Gr<COa(#;AKa5Bq1j!FVUGIob^c7d>3|cHF4$v9UJR>I5D&&c|Fe-
z7;coU7N;ofu7p#-93d=;0dx7$jAUp_Op5p<62_6(D^sK$b3<^7>R7?b)+Vc(Oj2FA
znhr)}uHM<*a|5XO{*FO!#ymQ<iNcQEPKF&qux~ZB{rj932|$QF%~gN8)m*)LdzX~)
z;8~`uu%_!)VDgCPXqP}GLg4G`o5BKQ>?on;Y_eWW)|X|R@6%TE7-=HsB(+-Tlr0FG
z=Y&nalQxyd?h(4)x+x8;8~j4D+r<o=;}W)XyNhr6ZSQf%ry_cHMim=QctZAG#b;!h
zw~x@N6y;tg$dVWZhI)<Wxs5o!4#n1!m|{bDINw{cU8|A|*4Vgi)ts)7rR_|-8${9b
z?593_#<!if!ZSMb{vozc@>%xR%y)q77ror@-a=$mEhuESgaOAZ_n7fH_u2=WTJ#k{
zV$R%$2&p`yD(50QXy?bb->39#`gZ;iH`vz>ZY|7y8a#7j^G&K=C?OVqhf3O=en1Vt
zunP*np@^tTr4c@}K*GtR<@a~Msm@rvO|n;6H~vN5t<pz0R6t{AehqiSKq?ZPlZW$O
zh(nfL$S~1z*`$08m(W#&uG4)DS8AO<K9{0ppS2fFReL;NB;LEM-=NX+-BkWh#uGy$
zjO%p#?1tJ(w`&C?KeFRJX9>5ZV)G$uP}x^aK++KQK}^?uXo0E$DR5qQHlRCNjTZ}k
zl3iT)WyZe$w_;)RJ@<jbB}?b3!0c}Tpe_;0(GMLk)E<~!&HuNRRZY3|PdruD=lZ?4
zijCUP{Zc&s-2o1&SZ2ton1AwWo8~yq3?6r`FfFR{(C;?#OkoE;E)V(;H7>*cS{qZp
z6r2}?3U^b{5f=r!G6~HZ*5}7tKnf6EhPE%{91`z@5PU$NKbo#mn5s&~Jq0HUIPh-x
zl1d-F>bh#_?u@@css1NvqD@WGB9F5sPE0(iZc9s8^v5S{Bcx)t!AF$zwC(`1sr8A<
z%^RBfe05$P-@h0p$OVFC7&NCV3d}{W3<R(ooLj&Y_XZMtf5>cURTpn0)2<ef29!_J
zR16<~*mmX;3FZ@jCWq#*<GQ^UF>=52EEj2#`~7IZG^B<xyu0&xXpewmO44`8x=Vx3
zgqju^E|ekzVN7v@dm}zXB0;3MAj<I=#H=3&BS8Pvi&*O0Pv2Ow%k;YMa}+T~6&bs&
z$E-D;pV~n63W5uL<wSqsKegOYF=`Q@$`6N`!qVC_aOpQ8?uQH&gUW^0*bdbz4Km)1
zbR}VH^;7Jx;9vx=`3h}Di|u#1HMszL;d9TVGQcudb`giVFQa(q(1cgqTfz!NQC_~k
z&N5U2Z*7bC|2*Q9_TLS1Kf0dJkDKZ6m+?Qqx;&oy_U{lV?SoM<n<NI@B?Ms0LpulM
zVwt~Ac$(BG;sTW?ZjJ4g1&yVrk{uv+Q=VA7tBHCmY%M|C;{PmmT>t(cZnIY(`cp{p
z(e+}WWQC3wRAzRZKE}NYk9#7F+WdVU|B>!i>?d}=kEd0TjIiq;5-lxN9@P)=AXFTh
zmdHbr1y@*C3iL`k@le?NESAhMyUXVpBY{#dZ0{A{I9Rr1kw|V?yt~Ar`Rq>?8U;Yw
za=O7I1+NZz=zh-`1;P2V<Trt=I>Vy+Q6L=dh6qe671i0<X^BC`YZ+q+KT7&d4Xqk8
z22fKygC@&E&QHlranX3(_Y(KtmROUpKs(z@FfTE3T@{5l6GP~ooMvQgn+znlGji!*
z(j`78A=K#;vtg*dIf!&%xBI&;>bdy+YVjcbNO@??v~UpmQB>KFF~&XE<<c(@-;mCt
zNwizw{MKP^B%Z;#Wf`+klCxa4?z`V3Bie0~`yiWJpW+ZI+RJ9z9G={8iME$+(j?U`
z<pn||1rQVOlFf9}BA7O8Ha?-%f-+NT3q)JM4+sT2QDeVL*h>`Ux1>T5w;Bp$`5%Bj
zM7Pg1JPUY&iOrR9gu;%)C;QeM+X3P_5k_I5Hx^7R7DCmK&Jj#abd^|M^f@XNHjY%q
zqxxOF<B%(}!3Ul)R^gST2G&UvhVJMFHI(;b3;Wvc6+!jSb7ZTIxgB4@6E^d1*ZG_a
zxD<qAwOPDN;;%Wv(`{y}3fu%IDz@NtDoi?q!0k8a2+|inSI*PVx9y&+ynq!S9vNu&
ze*1ayvu*DFDw3xt$5_QSeD_rq#bmmf_L*F;!QhAA$K0`3BAg*lLE8YM=Y1lD!0nNh
z{?GFAt??|rcdX{%=zxy@+BRg5pINfG$_PZ7a!u%m(gpK*NNu(!Cjirm(nwwFkGn?x
zq4aM67R1h(LpzoVD%@pF;10h*5%lM}n(pZ%vWMYOW6_GfHimxL>9SywAM1#Z3Uobe
z|167&E$b(`J6ww<0zt*5h{#29Lw$M48cxpAE3h4(-<3O=aF*G6tIJuARX&`z+rO&E
z>Tac9l1xY%FH)EA*-HMzklo#KVa2xYr@aZgyT#t{K+)f3EyXko(s(K(o!E8WB1btL
zbge+H^dZavzSgnf<H+sI{IMAKz;g4fpG^krq;=*$+|!d&^)ytH82`K}E@QOh(qWh-
ztn>3)h=?W)WN{&fnk8{$#jnd?)@3!Yc)VI19KZYF3+omjJ>uJQtscvqXcV*{v13|r
zod~fS{8BSdJ`0I+U}fhmb*&!HRLPDYRyiEhn-stw`<>X5UaG#yt1iTl7)`z?%&tfq
zKVW158nr@5{SsIsZ&$2X4Ed^zi`nvpN6Lv|akGAnapU759cmMQdtkWaPau=*C&Xwv
zgG2o^#QU|se@*#oThkAwBrt`O<+F3f4=nUVVG~8)zi)=e>`E@yn(7LxPiJt=u$jP2
zbOMq=HVFeMj-@>Apd8CI?50{;ZR#;#y?XvsXFKzDBoj}jT|b~ask-Zt3$Uf7M9J>9
zFp=P|w!Lbz6=@XMyR|c~+HhqbpX>Xwzn-ZW63hz{0@$IvD1g^em6z$iY%k!VLLe<@
zZ{Dp>4v{^HI)>5r-gdP@l*BrL(;3Z(s4y0poPOs1W0yKAT-5XL8C_-Ae?b+485myi
z+6Jq2l`r=a*;7ZMck2~e#I%VlEcZV@X`mNBDaZuMV6zX;^yOl80K3u#-G<^CHrfwF
zvp+vxsQ>T4P0$i;3iOgDDhRT&vQk*S13B<1JaiF0Pk7zWNIll(JTB|vl0-5wLfEh1
z>RA6Vg(Ta75P4b*;PE5aVTSdp5P?dD?vi)@8s#9D@$4G|Q0+*z1`~{}o+$(U`nL+o
z4JKrQ7u}gNEa!4b)XT^y*HQ_MZk_W7$c2kP@|Q2|mjh!$F?Us<qC)4|$hL^fd&>t8
zBlk*e`u)$aJb;TG5EMc5u)MEjmIq}3!flZ})!*u(NUFaRz8-b0AWl^OR9hO<6<a3@
zKr%22BuL!VL)7>&NwPHSn7mn0SAN-wW($?~_cXC*5B8XFWQWbmYeM+@(1JO2hD68z
zfNI&ZhkKrN%Bcov4x(s-Sy2-c^B@c^R4RPfpq6Hq&>Gy?1P#43k?c_gHwbCTk-0`X
z*@+O!!}HSvcWWS};p^AyN;!%-mJP`bp$*Gx)JJy14QfS=yauwr(rg>$DnF7iHl#Gj
z6zvjlT;O(pjvcqMWSSv}B}r9b<V~KDi6t4f?UcLt=)ssxKjZlOOtb83X6C!Q1xXbE
z4vX1Db8|koanfjc>N0lK|3XLOA<<1AObNTw_gK1L%Q&E+xnCPVtPz8pL$MvY42^DD
zol~4QX;M!;R~gsNI~3aDRyuWE<Bxa`37p-H`>|^<e_XVj_~R@FOu8HIiiWdEmboqM
z6X{U%`By*WDr4$H$SuE7EHGx0zIV!^P}L2&TRMTITZD;ju$VdATfTNd@0^Dx2qvb1
z+~vqSbgu`S;K+~IZ#AhCMPR{L8uHlL>tDraUrv4xd1p&ZmyfCI1(aj@aenR@%*|>z
zb|26_=TW!<Wr<)bHC7bw|CEA6ZBifey$XJMl0d<#NbF>Te!n1>=nNj)@kCd#cy#(r
zs%__|pO2q?eMd~uR1C~)S)Y$w_{Yf+*Q61@9Q>02g3k{rPnLHL9;1R+wEK!yXAYh|
zM!Q^8cU!aNmu{{6O_O706n!tsIl~j1r1T}?i(ZlJk8lF&ueMTl1#<q3%d*QHGn}zr
zaUs+MP8qh8c9n9549hCZ3^NL`f?pSu8<HAyiUbJsQ*@LYl-^?gR{DL~HD9d$;>r_z
zNYzgw-`->%*Q;n2!-*kJq>J`8J`7)jte@C~EC$kxkRm06`GnWI8^8H~qtJ$TV?$(c
zZ%Nzwy1KE07&gN88FX)n#KVO$FxxS5xAZsV+#^s&I=VwIiJXzIeez!-#spq?4)ODM
zS9%yX(#LFj<wi_z|C?_YE{eMeh>alyWBpCA|C`qj(rkoY3++M#oG=#lxO%(|%pqlt
zwxQ?yQJ|k!{AtA-cW05Rbs{#BsD|Eqv}7J~*vg;xx68`2$-Wy9@(Dg;hR;6DJpC4C
z_onP#`c$El+Wnk}P%x^F6RfQpCNG%iZ5xKc-vR3+RmeYzjLb^4y>r*gl9^Nnz5Kl5
zLS1q7)Wlj_Kv~8Cd~G?uA$}PO4Qj|ZP5OJTD(cpYkg=U1mo&)NZklb86c<ed!y;Vd
zYnQHP4B8EZ<#1fWi*Xw^q!#`_P7s*F3YgqTjhNn9)A8qbSS0~~nE(AerL3dC5hEkr
zLG^C(pwpsVB#822G=kXAVd~Din*ZhvwYY+mHXv^x(~{EBs|c#2j&t4oEqJRhSZiKn
zQ(_#qsKn1Z!H)tnaO^PiC}X(Cxo9Ceyjnn+*3fQvt8{A-!;7luYs^O=+HR&ggB8_(
zu5|VQYK#3=o(}E9JB6hDhz~;JGtD-*E#e!P1#g3qNbd@jxdd>oe^3vB3QogMI>hMl
zOm3U(sm1FICwuaR3^AQAr}oy(f8OXusTcAEoFz1E{m19$a63XmO_)6%@2UA6^h$?1
zr{7F)3Zddjoscj6X7}N@&mH!oo(&$3mA~u$$&Xp^XeH<|Q;_O!;K$7|7M6J+T^*9x
zW6k;k#IQYi1in1okVyu#{E(w^L27zOVblBcRmQcJd_FmtIWN7Sr(mav4oFBZ>gmSm
zEASNCS*Y3KrwIdTys5a!#e7Qd`nNlj*Ady}KUE}hV!Kf-Am}IFqyB<5^yFcIk7elY
zs>@EXinIt$iV#XH0DDK#(riCl(f`*JCry&*<3kq13>j6mw%84=qk<0{N-vUhX$Tni
z-&nCtyc9O!;Mhp)&%5a?oPi5$+hf4>zkvMC_ZJYtg$JqrA9+woyCED*%)Y$|_#9%D
zUR{_}?<f&D`N)`xs_Oa8M({<K(_n9T937{;i5e8*`lR4~@}@J0TYKz<tcm7*4|Jp>
zTqAijsCFHFQ3$|~hNHm?M8|(rv|^e{qIKGSmn5YLLjCj%t;n?Vr0k&38SF@HTdi}@
z)#&Xt)OEW$!}B3+-FB?v8^5U@S|aoR-*W;51K_-M$>$g_n2QASI(<0Bs=T~B;I;x%
zUoSh6EpXQ|?Q`w^Ux<BhN>cSZm?0zZZJD?RT{8VoG--<S3jTrsXKf7jM~7<`y`E!0
z7=4|C4YqFmml^_~@z1`#i<r_xYWf=zH2_*XsMn=|_ZF$sz<<k-z<nw}i%zf)IF_Zu
z?XHh=5Jp-X5Lm}KDY4nb9YTNcdbb;A;(`kRp)fu1+-<&>+eUvazwUx{?X4=>OUU_i
zO^aA6Q1{#llB(8QcovIry^nHTH+=-NffA6~wJSO?<`z=<U}M}}v+CX^Z5;M>SKmH)
z+g5bpNB5o-ne}Z<JC0y?Cdfw+O5s0VdT47o6svacU;MLsJ`8BVH(Q-|c)aIheOh`g
zrb$~Ew102gv5g_>{ZdW_uc#I(dg&HynDmCJjn#XS<_dmjb?NLQ5qzo_Eoj!@b@6hi
zW1Tr$DL@VS4cd?pra(>1q0=CG|6oj-oWFv<+nV@-t)yLfZbo1xV!f;86D28UKWJ=X
z4J)U??s|{aGg^9-vW;$ni*#{#UBA%1xR#<u`3g<R^E-#QLhXIyOu%LURh=dFx3tRm
z)xt{`<#*rMP^DVVf4O`F({L33Iz@N=@NV7~r)0FT#Ui83S4a)F&$KH5d?>^zQ@jMe
zEd!?muNB(0_ijJfO3>7gcp}IGv~Qs;cy=MhrcwAP^k*AcFBSc#i&VIXP|en-KZqyG
zO5gm7cQ>SVY)c7IyDnaNpKOagahj<b2>MZb%I*vj57&hY!<KQk&3yfdudPH}n{_Jq
zBf>jUt7R*ettguYZ_jAg1+!~-KrF|LH)O$wyx#UD_e`0sCa7#DwWYt}Gi`6Eq^5tJ
zuGDcwTGx~2Z|<khzDoAVq9?8GJy`WHYH=ryuf6L#eIy{ep%~a_!O({+d5<-WrVD&|
zN`UO=B*!6DePI9v-&51ktR!Q($bDMstDi-mL;GS99GhMple6MSPeNxaVS)Jk-Kn2c
z;w=QR&UK6I-M8Av?-1iJ%UBT^r}#KtcupS_%UOdeKhuQv82%h5+=b$F4;=fQVQrvt
zh2;qJ&(k@HG~=k<seQUH6+BrlkUtaMHe~JcH6dM>zrMABsc1cyks58|0##lTNZm7G
zQ?^flMA$epERkgiW{jYs-;8okDTLP`5Bv53q?b1sDs!J~BX`Dn8#A%*%FTu$#%pnR
z=@sl>r8@d&{saK^o8OA~!<8<Xh1B-7|Ea#8s$&<$gt`}tz@CIm2j(=zczo9U66(NV
zlZv`<){i~ijm!YXZ2Tk<$%iiLq_w|t`{`!Mth`Sf=PqPE9VWLz*6w%gk18g1#!9R6
z5=ixRw|B^+p7-wN;ceX4^MppKcQ`Dt^O)Z77LcTKn>~Je0OuRlLwq_abj^51y<eW#
zZ+Dz*TR*P0Kwf36Qu}BJod5N8^^l02Hu7JVL0fP#iQ%p|Z27#rWBLbtd_>xt`p;R1
zxXY#k=t#oxS>4}*l1cY!jFGw;#2`~aQTtjPrmp6wG-9WbE`@9)HF<sNxt*>9Rf#0+
ztddSgy!jUD&6!cYB${V18|K|Lb&%U3o>A&lALl%V8ZvmD-0@J;$fbr06Apyh9yH&e
ztl@TXz&-=3*(sOg{9yg3+wQWnE<5p+Mh8-U{)SFJ2~XG1X7!~m34q)Rbb6k2+(;rL
z<yWgay^v8Nl{)bU{^L)Yn9>qB$`{;}92f&;jVl>f;J!o8;{RE)0BkF;A2192f!Cc5
z3^@=Ul;dzwn(oriOTq%*F}9F79>4EUM)r4>rm)WcReC6g<HG~Xdgjj`8!7?0oV6yg
zd;k}DoSw(^lv?Rp2l|3O3~m&<Fr!r7IQ1<H@Zo`76ZFkPsXsKm&D{i=_I#+&{ay~3
zpCz9Hmr0T)je4C+D2kB;xX(P6rip4PgxjaLahUX^^8t_HA3KWJn^U?48slhAR(iM7
z5wG!rW!xj&>OD}wiUU@#aF5svogj^V6!r(*KG{DZiJUrA@WY{`;@S$<1uE`Hk1eR_
z3BmRiV62#^*$8Q!#};ud5hZpf%&=?Wprb8TINJ0{;F$c)Kl^NipVnB~7jPl`GbtOK
zFKfN^#S0D91mn7MQ!F4r-cqp5`!E5qN7pr~G||aoy44sLj^4Zj;ldb^2CritAmL4!
z*|^%*bmBIe9km*QyGY~Kkg|X*65Ev@=qR-A-A%X5kCXL1Vvf_$43wtb2-5I1?`c~{
zHkG|u%pwn-fUm3zR*@iV)gzOeC&wNyB|@?5ZI7Gj&fPBC^&cWdco=Jeiy*%zNz@#X
zrjZHMRe;MhUUytgLL_$Gia6Mken58$lRr6Ft)O>~kl0QNbj~oTvzY4ed9@a;x|eip
zXp86~{MAAV;5lC`C}uWTQsfh(0lcDOl_BfzqiV{45wkCENglR)kqbT|$1XJEq&;0Q
zWAKI}Gxbe(Oz|(P;d`H^fLun9=lnbeN>`3rDr@6a!vB3&6gK+W-(!N8HrOK>VtcYD
z+IQ8Wd_&Qg7cQ}vU4RAC_4N$gt8jx+`9yBSE-XGWq-jUb_|SAEriHE*_u&QUQb0wl
zsO_X_tzL_vQQ8I^9PSrzz-Y42KMvn8w-iCP*ZCOe(<^p+$XZV^iacm#1J4(9!>E&O
zWSx&0QLlF%l<^Qu;RYg~aU4y>Luhli@O{7P4w;5HfhA`%ro~ZnV|*jr{Jk_<>67Hv
zNxPq8&egQt_I{~2K2pWD^5y`320_m1xcWm2Uvd}?ey9_JUD8BUyS<wEygLdPWrof`
z39!Ll83!g8iwW<bKf$j}um5L^l*K<}%?-d-^t5wDnt-O2boxYHmSKH`aJat&VIpu#
z`SR!v|0t>QJ(U*vkgyAL<F{=7_G=$fEWa%dWOl;v-?}ADIMZ8!qGKN8dT@TwjnxJI
zrs?Cnq#+%vL)?1RCF7QKtodiK=bEIIWFMyDE+QDKJ>r{Wd`9N{_Wbw<FtXqRhMTd#
zZ{ayyIZmC#vD6zmN2HMo#?Rq-q)rW|32gh{bvO=4iVYGz)2|5ZLI*e(4JLGcT=2>s
z0;B?VsRF(Zsp#wpi%*oQv|3n#;rZ_;My-0Rt+4DRD&I&>bf@E#a87nxf92zWEHw~0
z3Qi&{<cQ`}>?*p0)U!+aDi7A~b6g?hf2bTOeo^J@u2w2y+3O5;n~X*McK<!}I%i;x
zMYFI{=std?YRO|ubt4PmIvV`B$9d@|zJY+FmN-YHDs#q}S=Z9gw5*M!noX2Dz}s-?
zY@>-UxV1<}f*+d|lC_Lc5SHS+JxCQEr@*W=56NZ~?B6F14@4rTf@j&}n;$R+SBdkd
zhPU&GBXyKkeRxp|v}=n&bjng3(<d|gkjBA8EgX{HraWz|3Ep4Af}=MjuQsaMiLk&@
zZE&M!Lc_@*C#-|xRKwK%5uR8mc{j|EdS66JL_Ld1KQij|iT5V>l<41RvNOFWbH%R5
z=fJ3f@!gxBZc&kfH3+u*h73invs8lFq28qNfuCpm=j?Nf?DQeJ)CLhHH&xuhg@QOJ
z8~wk<gt+0~IYh3d-T%I2Z}&&dW?C#PTqZ2F@%m@qI#-vdHv7vzuf>9EMG71BSAd!O
zjo|(GYQ*yz3IS~UdB8u>G|riN<*V#I2mrQyDhQ^kPd~I648p{@{)%|rZfL&O-;Oca
zv(Up{X?P&H`g)97&1~WLNY6xiem!Z8$36*I4ZM$MP!+_|r@u&+u6D*x<~5=_^5I-p
zHGnajfS#9Xdo$HTckzVnMg=ixPS6@v4z}2|s0yYGX57V*u0X!$(KHPOlfUvrolx|8
zPZ&MPKVbe)Ae;1GOe#Tv<Id9JIxFXY+dxrA!&f=?GnDpd&X-NwU-{`Qsp3Ap;$M2j
zrw-96V!*F^t0jx$Xa}LK`mW0+sI%(Qf+rJTUx?>O7lF5ZfdklgBW_;<lyNk=&Tasw
zEEB`U4UFyawlT5(KmUrrlR=}C49CL)?)Lv<``s+$19)L*b*Y{~^TjiUfi*>=P!5@Q
zG~=DRLMwq)*VlK-MJjc1nY;{2WfMx@m~`G($g!C3@-Zr>$<fkl7wNU4^Tw5d(^%E2
zs`SVQ5VBNexYF<$HIM+t@6cIbBu2xj3u!bi?O<1SqALQM8&UeH{0E3Zk+$%-RgY(k
zWccA59ik(I^we}SsdObkPHbdt<X;!zfJ>rm8MkJ{WCVr8I53ltIG~caIt>Ll?qo+-
z8+p`4I^Zl?kEh#`2)a%5E7Xu1QMQz(mYPYFx>xrR#WGoNEHYGW@$UWVm#dlQPO*I*
zh^P`}MDl}}ELxIsxzOdbGo|><{ovq0+CoF<zLT9OXvl?Cekj5T`iBRf7PmA5JY<4A
zBpblqKV*>+wnHaDB1S}od4BG*X3>+>ce%X-d8ST66hk2)1Ir(_wGTDt=2DF`KVQiK
zp+x{woU)}wT;|i)eSdAx_Ydf;^lzkfoQ<BJKexKy-6>vG>2-E;y8k;j1KP`k?HyLT
z!@IkT-w-p(%Cywucei>hP1(J@OPSr>J^X<%h0VXLY+~a6Ol*dnq@<<M1MXhwf8W>T
zi?@bz8jEgjzF#=qfXZh@O$7a6m%9@=)nCHfRs6=N<6N4+`zft2?OA5Yj-Vv&+d$e|
z4S+GErD$%&F#0aEJ%i;r^7l4F95LHB7KI{PqSBAVj5_W=<nWD<6;-wfA`9PWRD7x<
zkg+662=gfq>yN`s(?IxVk@aZ$ZczQLDQ7=wQIBbG_bfAB?1+||PakN=T^1ey2jJW;
z%k&1U$s%4JS#HM!99zpQ21ZrXZ#8R<-x9`>m;t({n(88CBSX0h#_Z?`Bac?W*gaP#
zq6y9glo|G#tD-D|iSD+yrH6WB0*MZ)Gg`5w-6;;dIv%Rq1_M^(RvP@t4pzy@a)gku
zF}$(XK@Sc#ilN2^+bTH=(4<wj)nJJ_iAa9%jmei)Uf%LBy|+QtPnEr=*G?q|nefl9
zDnEuSqQiFTw0q9+Xn{8r_G8oMBX|G>c}ONe+~h`Ym=-nOTNvlJMfaSyrr3C1Ga8*)
za*E6IQH)|Lli8XmCNE?34X02uFbx3jPgz|>jLmCT3>i)3D_;H7<K*;mclWaX^=(F0
zSY+hytBm4eEkPq3oX`5CM~9lF4+FoNZQ7X2nAK0xr>Vt**eh3jE<frtx4_|<Re-sd
zZGOUBBESc6VPWysw|fXI{yl^-%Y`(|EZ92gc<&Hb*V|O|u0B0%5w{1ToZYWAdSdOW
z$OrdKYh~egOvY!ICp1}kM?~HvCg$wi3Cw6XWVyB-gy5c!WaEE^-e;Q`#t~6AF<QY+
z&0!vU9Q_{V%))<;c$|75QXG9=7iYy6A>cm;?Y?MH9AwvqM;C&QbqPX(A^Ba&4D~rN
z^S(PgmmpjfA4v=n%enD)OnT3_gLd223!%{hklZL`!f1=`&XddnHXh6wy#&z})IG&;
zp3P4}nPv$fSZ$V>p*gGli$R`{@5RoWY@~}AGqQG5;`sW3D5qGrpQVqu?4Sr=^#_n&
z`>ViaLhiL1p{RV_{R~=|n_hk`CZegaN`pq<G%Dh73vwR`mLWIXI}HR2Gkdv-n&53Z
zb$IUOJJSBqlN!`FuH}~A!4$~-mt*F~zu4P5u+&-Cy*9T%<S!@QSSAkEvs2BA^ASs;
ztf%v_?=^Z%ydkl=LJblkUvnaX;}nDwn*^ROx;w2ibY>^Xe)IFJqe-*UES0d|qs`2<
zj6l8-D}KsN|GD0TT`OEYOwQtsm6m32P9C^OUp7B*@GdY@6IrQo7B>^uEuDj`$$U1D
zw4=t%|DmlnF&!7}`<6$YK2*{>0=hzYdk5`ac@Z%h{+^}r;3M{%$33FC3{l8lotD&R
zTGYI+spJl46(ZrRFB7<{*z(m5>MPP0JH9*;IbKlOYL*%cZT;ouU~;l`j+C_8j@%c7
z*^zHn|L^@bwqm7ktUpF?I}%9<G$o_VhNRPoSjn#0E?X(D3351X-F$?tJhvUnlmi>j
zj&F7~PFDW?beT)cX>9e!y=)guN$`G~{c?eso?=Gn>=Na2@bK8w>&=Zuqq=nEV|#sv
z&WAbFOJ#BXAyKIz_p4b~l38sbysdr|S1)ZK37r~sv?hA;mT)6LcEe>CgY3|{8{8*#
zxn?-+s$V6T%{jj*l=igpi}%HuO{iRU<HqN{2K!8QVq>^v$lPl3jTZTOa)RM7L@M7*
zY_mO*=6W?a#w&5TCo!uwn()5)XQC#UrY}Ch(>DAs<jS=>b;o0R6@=I>PCe5#Ipum*
zbXA})TW)UA@*ujibvSS!VTCC!k;nbMgvWVhCAr6NYbYvwWYy^$-iCb7E{0*lEJh|+
z9r`f!4%6E=q$}t&be|KKr|{|J40eo9a%~^dr#rd1+*l9eF2@x#=|Fra6NCvB3pJV4
zhZ)pQYLP?mv7n9}on{WxlI&fFu?atfSJ%05ly?1IA-9svG|`B%dY1$~(qdrzs(arh
zHk!c|{cj^6+$~)<^brf|?RT;AFY*KKN<VKc5Pu{m(=SmsR_JU88zxHm7rtSm`G{M3
zIBL7_lPQ}FE@vaE54kf=i=Kr@PJmGeXlHJ5KTf?(CB@1)@(_ZP3W;_E)Tgcrz=hhE
z6kDR6?xUXm)!n)Z<)KGC1zr6zTj`s9CX3>dNT?qCD{N+=jItZ?io>A~bS?<nkV^bJ
zPx0Gb{p=RzNaolTVN;|22S|gC3fw%rCKD`E;W1yrm)!XILDRR-t1fbOm)KT(J%#s>
zG-@Je;FLOq;I2FUsM)u)!^KbiGP@4L%d&_s`lfq5$J_UMtt(IrCee|QPM^^|vegNK
zSshJa`Cse^H<3zf)CfZ-$3i8^n??jgUww|s+wvk)YSiuro6+H8kFxdf@gasA>JBWg
zG^ki(G*!&WX1LjKckUD%2>Vl3xft~#R<fO8U?r1XtA89<+RpNN%p<-n9ewvkfFd+H
z@w|4=-Ul-$4*}ujQc>=`*5&<!Sc_aty+aRVfB;xK9Dx<@_;xC%e+1H){et{qv8-1B
z&b0=KxApPA5p0PZQm!#ot})yHv9onY?}{GB;!N<t>un9qQsQix%O@|@!MvPFZ2zY~
zsa44)?3$o0yt>k}1i60yWzcC;VoV&dP&8?YyxHQO@vvGMT;y9*7Jj(DfAi*^#0TCB
zy>SO^bj@ai_i1nWW5<;KI~L@==LXr9LltiL&G$uqxOe+ug4Lg4>m3*WS$(2U(tA@m
zJ&_JDMn<xx|5m)<<@0Ck6?{56le6z``t@En0a4x3i_L<L>Rjg&R<*p2TrM`^J3E#z
zt&^RdGn}Zv0`DLH(gySFf^(^@at4w6(r1Qv;LTl!D)z8mRU0eC|9c2Kfs{?)G3<MZ
zj3G@So0eo>sditoqb7KFhw+X^iJGZT>q_6s8i@nPxa;3hPoK{V$4Yx0zTZTu@?mBx
z%T~hfYZy}_-4odJg<7@rP5B*hgb$0G<H!Cjfp&bXgj}VR3+6{Ce5>Agl-C`YhIKpB
zJdYas=nqu`QBRl8G|L%MW~ZYn8zfLc_P$>wdl29I5X!3#4=BWZ=l!ZkJ?37e&{laW
ztcCix#(ac;aJAlw>0ZKlI!N`e7Itw4b(lm}V{spKl}RgF4o=?p<5j}{z9ed=Al{|m
z9+&XOI?U4Pxf*aaKM~eL7oVdSRnX68wo~UXBTF@zghNT;AegB^z`H)LGuMG$GmdGm
zQR^0{$mSr5u`_IPpX6c#s-^v0hGojd{HU;Vk+c?82Bi-Aah@s&cDvbheD}nc0CVj}
z`?kU3w&LsKW4L3J{Sv}^z7NKcF5f;q^XQ8Cr}S-e&mwxG@?Bxj#h&d<k;t>tv($Y;
z*D!>3=U?6K&mt|H;Kw_$Z%<*&YF@&E&9rHMu_9CZ5UXfmSix8Pk$rb14HI2kf8_?9
zfJWyxAxCIVPTY-gRXQZtPxrs~u#3BI@bmcEDv5(x)J9uVsU4qzH3{pB7Og`)31}GR
zcWYcGB@}nvr8_{vK6u?e@^ihMFRMS`a^{W_lg4&)sBo>0#|eY=`BS7yAX9~QdC~wn
zANP&9_hVIMl4@qWB+??vS2LodzS9d7GmjLUAo6wMqmefX)sAsyoP&Dc!&{R>LlrQ0
zZ$*TeZKox|f*Hje%0eG+wvBn^YitL^ONv`c9g9&?I~eq>f(5KYpN#tl9s9*Z9qOL#
z+~$XI%>4K}Qmw+vJQ!r(#UW`V855E?7<_j~TE(FkgKPsWJe_&<Zn26*&~mc7AXvLs
ziT7VpUM1*~@ZRLDLgDAu<uBrUppgMD?u5*wME>WCTI|D?3F&GI&pLh=Q4%q`qIEgX
zDtg4lgHPlV;J@8({i%X9j+Lx5xqFHvt*zAi{)!{cQ7;o;Of?RsS(fW#Mm^P>uVb&=
ziM~ik1)gB3XN>(kuO{fM{DjZS%JHc&iM4$sxAD0m(tWq<{hbTj)+#-(3Gbyr!(^DI
z_vY3)8Mf_X%N4!w>hfgs)gok`Y^j<Pt2wvNBYUIj+WS+*Kh#`_V>i!uI@7(dW7!rz
z*miTA(qkP@y4lLciu^@Tw1n09Y(utmxsmT&k;fmf<ti=<pOkn!7WDd~@aMq}8*}Ez
zlJ>7swGuziryAfwKWAektS+f*Qq3rvD<d?lQGKl?m3D(0UUuzFkR7{RRfqpuXZ~UN
zb1iMYPzd%U;Tbn<fTR_q$&Fh$vpE-wefMA_!bn$9v3!o@W-e?+Dm5{@lI*>!%B%sj
zA0!JxkNKUr&x5%WslqGh{gRVEHGN<*JYSTu%k7XeC;8jx7$J(ConkgV7?xT+v%fAk
z63@K%?}RhU?B#6e6s97ZK9gnO**mSt`l+5~sJ`tA*<$!j8)%_0os3rGe2mZWn*U$_
zpk9Vem|wM_qRB}e+WfP#%8&(%og}Mn4ZRC2&CF%o_@fn*9wBeisdqCX%4J73Xnox)
z6Hk<|v9nTfgT-p+i^{W;UNWl~`&d4rXJhsO&jIdzzO{wNvaQxU{BwY~p1eH=xz`4c
z_F?M4kcGBw@RzkY%n3o9J@O_-?d)uU@>gT4X0~;1csj8_*c<Kn-T%YaTL8robz7ss
z-QC^Y9fG^NySuvt0>Rx0?!kuO5Zv8i@Zbc7;BIg7-FyFf_1>+Ynkt$eX1e=ypDk;z
zv)8uQJ-qDkeYsOR>&)ga!ypvH_CK}pW@LR5jemOLpa<U<kh_*>-8o(EeX5MPtz5$`
zRuv!S><t5^z2FF70~N6YZ?GK0w`2xInwbMPuw28-DY*RaWmwl}fy!Dvky8fi)IDED
z+B69Qq0*b>zfWiJ4%W}&$Lz>dE96@A{-wQo^Af(-h_n~W5fma7`txF&LAy<@BB|5A
zuDJ8W8zPK*z2DyxYM=J#liL<IahNx>_8|5koyKpo@G!f*!qe3*A4HX)m^Z{{0qM~8
zhUYk56-j%AhF92Nj^rD|g!s?(ggAC*nk!OodforQZv|bUy9mDgl>BE-b|Rqv6KFf(
zhMR*Y1I7Q@`3^!MVwy{Bt#%gqR<VYnJn0Ty17KPR6Ri>Sxw6r5_k0v5%p!zl+DRII
zt!RFuwn4A$cuf)%Gv{(-JXSuY1%^jvx0VV#@8nBt@a`%fY*MoquH?rZy%7}+C-)ZJ
zp8MKWFTy+1c~$yz*>^kvWA!%ye1Nvk^P(!smJRM!%FSGH$`Y>zqXc?Xsf72`PD9+a
z6@O5;jfQuY?ygV*$(S!4w=UQ>%~K8nO=2wdA|haJ?1gsH%<B&hWvfB-EKJ51pL7;)
z6$tD14yOQU3mo=(O^|FG%KM{s@2Jl+wz)hKJBFV28=xCpMdXe2Ohd%(c^>sf6_jSu
z73dbn(4@{0gWKSl(fe%ms%x-fGA?LgNLa9yws~6mmLwJ>&~Qd7$go#bjMoqlcCYCK
ztkn-Hm2(1uV0nCUEJR4~Y=Cj3w-Pt~cUOjQ3RNqoe6L)OZ1{fhhpSC%9C{J*ulUTK
z=cwhd-gfKJQb#kU-U_4QR&tYsX~=O&P=OIyFe3{MGs#i=|C0!1nE_p$fb#uS502-m
z3jjWml`xIcD6aw2#DrPcdE2-6H)&71N0y@w{Qd(UF~W}oq8sXcF|~4axDaD6wLC;S
z^Ag3w8@mwcTAG{e#ySQ<<ps)plW0+>n$Is$9Ie!+i?63%KMRvWi83S1FTLDtWMQkd
z?&w?yk6Ibko=u@#5YGl+7q2tyg9uOOM0wA2v3gNK11Lc#6{YHFu_x|9=oMY3MZYuz
zl$7)1wFxBc@)fLXH37hCxOB!hX}X|H`w!o!Zn0cOF`Uq{i)F|cPTEBu#$^B8>t5$C
zbOhV^5NglW5ZXb^X8gSz6W(Xz(;c!&rgMI67zu0#Yz%Aiqt@Lmj3EwNUlQ{OmOgYO
z$Z81EgPSaGMYK((inb~-xmi_8tdD>1goY0J?xgR()P;mF^MNuRI*To~P+tY_DhBkk
zgS3%Y^0dEbBox}e8`UP1?5pgEb&c0LzPPd<%tQb9G(Gfj$|x>o#~AQu<#T?29s8go
zwstl!!8R2+FLAtR{BADjj64L~hB~28%~f2Cu@Jg6;qFSYcSY}yN|f<2+^e26f@R5A
z{F?h1vCPW@6m0<VK>Ol((QTmQGZV_ZryhzHX@%1M{`~KYi}}+%v;TyJg2;KpU{&<1
zK{V*eB(dGf!XC5vorjxQv9yrg{n(?)*kH1Y3NmZzt-nc#+I0pz+%5~)vju^kV2UVm
zpei9(nrkDwA1^oTyTX2N@>TZk1tIrGDus-4b<&T{;BjPJ&%yfoikSTL<pi!Dk+>C|
zTB2DiPpC+xHs&Kf)#hxU3&pkPgJ<Px*}lUqHl081%uQI(TkoaXxDyPTWO3$R3@#NR
z;B&wGYAydAK*_TPE_zm2R_(ez2BzRLOKTSM-Jrb|Z6YcPSC?EV!~Ep0HrJ(#$d51Y
z&sBSVpZ(YdFhp3N5eiHVJa#DC|Dw#<S6C|j`2{b*oP8hdwR|TjKIdAV6I57%QnLS(
zxHH$g!~CN1BAMX+=MapZ>!P9sP_bzKGr~mRZDY$EHqjQ`^=y?$5#MaCH_GYf>L7ou
z_i{=`E#{<aZ=yw8*56TY#?v->S$t3#lT7ASbrjDDKak2z9o1Gu;WBrvfIO$>{wrQp
z_S({K3=Vpa**&uBt>TwjUaQX-BrA8L*GpHAPjEC!ikfCX=`@c0IkCrj8DnN8;)Gr%
zdhx>nH~FYHChH?m7ju$50oI8j{$SxT$*mcE0O|(<3f==`U^gunNU&zPe>-=jPM)T@
zhx%VQZ<=DRSPCdYpFN4_v8uj5o$l2-e~<XROH$>QqbmLmQJh+O{oMavKYK^m8mTDu
zs@DbiquE|j|9)~+8JrWa-O{cC+A4|mvc!I9WSSJ_wYZ_YOd{C;iFo0o-b}%Pc3_rR
zy?H1K1}SNxYtIubSc&3WYb)>V-5rgm=*Q#te+~_FcSjq=vNAa;$qr(pLPSDp^t-Zn
zy&5gFoBJJlvQo#@=@T5Pp%aoJ*xlOc_2*FsESmWP)wSy0<8<kd@^WI0<*4r2PH3LH
zsk{5#L9ZCtbyxz9F1*iH%*Rt{f($e@Z{pbhlGVI_ZAtOODLB~C2{-Ru2k3s@gpjw7
z67d1)(I+`a4C+NjSY2E&t_ZWPcz}*Ara?-I9YeEvO?lAM)CQ0%<I^sHzY4>~nST!~
zW^MD#;DAlnagQP}7LB$|IeL}!AXu^cTAo1Kf-R>JZn(S-@Y_mF?Z7*y3Y2UL3<3c>
z5~})YBS-egNz7U<99lscBQLO^%%dBDdt=^IwvO7cT&?@9E>}W%Z>~LZ=0Rg1dAixf
zB`A&?+;`6@Wafu%1L+T~>Vc+Hg^Zz#*IvJ?5-Wz!)R25g_ayMo7ueXutOAs-q~YdS
z@b^@+Q&Z_+ff1Wc%aQmLrQm}8;`bKP4<eXgzhJ|^f$_xEqtm%xevARE2gS&dw|n}@
zl)ohvNC}jCz@sE-^M5F&RQeWeB5*Ma8(b%Zn*3Xjl0d|F9q8-;t|1&wW>JZV<j*Q9
zDwZ;LLOefQBrPpzy}w}XO(N}9Wk!R$1pJ;WmP}<JXJb?4q(wzRK`Foqp6Pd3CpCG0
zrEOK!e{d$f!BXwIC&8Zi*u=&wq!xg*mNhYf@bJ75i$+9@1y~F#EY%ri?I;NbJw~HF
z`xmAHciziKe_BsI(uh#>Ore8C7r#bDS)9xjr!vfqI}h8s&J{YcH@Sd2tCD5b@*`Xw
z6_=JqP)J5yUR5aPU7tDV>+1&@M9<RI8+8oiT;AVjrbm~098SO^A*CrHT+u|C0TD~A
zJX7oHSPWX77;-T8ETIF_Sp)<Krt|nlx4L{g*5I#vu8s>sE$%^UsSLlt($ej2yO3Z=
zg^dAYPc!NFZ?h1S_1@6lvIFV%j*ctGRf(V{3jBLVSgxcW+BM*%Jder!2HY;2?G!nf
zvT?X9$$5E9;KOLAq@_iGPh|K0d?OX}Ne^K5WfMhSA}E&vGlt!K0D63BvOhJ3N;Xjr
z{0$4>2#7+oy50LMb3hS&et!P7vj)8Z)z;Q_XlO{TVyM5~kyIo=i<8Dh+9K%<Ufrjx
zlWe3+GbFV-35$V&;UDcd84TR+P+C}8(pXCTnl<xnTdCF8<fK7ep=RYN?EQE*Y?pb!
zoiA6!0|J3^6@9&uJ~szh*sumrYU%gH>qx3`NU8a1UEPnIee$I<{G`co5D84=<c3l-
z2#=KyoT6xJ>W`Y<C}dl0cjRP{Pmk}b_d(3d7x*@&@Vom_TN{$kuhHAR#%kmQx(z$H
zV>ctf>6O$}z9h@h#482t8Yct_DSPm!8A5X<(<<kJui4ME|E~cn!Oy5^(l$+X_1%4m
zUnT&e6a^jjO4UMCQ&ZFNr7Vo~{BeM$F?-+b_jdAe2yemZ{Zdpz@5Vk_)YH&5oIEEJ
zbjB63{^MeDl)(F~@)WP7S7%B#1(Z<8as!q}zn_z&N&<{M9gc4Kg}Z6v$YkyQAoQ|x
ztlT?8D1m~x4L4Pd>wx}xkt`o$19%E-Fh=W2K&M(T1a5vvqbU(o1r|Ifa7D%2n;sk<
zmNqYh1lPcZjtRgPMlw4$_j*PSTtLgG5+iVF9H7!MbpUO5=RK6r|EtP@quQ%+*fWpD
zqR#>4my6N(-}c?)plNFq8X)54+Dx>yeyBn8zLrlY<}SU%^?qE6FuO)t2JBQ+X>?G6
zEdkUq^wrMKAU`~<dJTjf-A7bHo2=?G__|*0aE%T!baBmhyv)5(vYHZ!We5DGwakVz
zGTWqOU8pOoI1Ur<hM@6L%*e-!y@uX*i9*p}YE23FD;J97H_~vCYZ{|(0U!OHCe3Ya
zSxRpYDSv!Xsgj<|bVhyTQoM3;d^d<;D_@7PQth;4gWj6@KCqW`zel8%QW2Bn|31MT
zntWNQPxL>UY&^d8*J`Mm0qb99TAb}e6HX2`v~ch4DNQa0sHoJBVVLqpPQJ?nt?*)Y
zS%fHLji~Wz!v_mY@%DNXs;cNs>{GkvRl!ttS+FZ92p2&TaM|P^Us}cSc8Cj{4cNJ=
zCh)OW*Go=}qf@2imUk-E(Y?5&NGb{1{N;tq_kGBhuxU&YWpG@x5+fxADer8Rrkv79
zI1qLGX^(+z^o8H^+2ksJtO4;}n6)d;1fD`+q*lMl4@P1xl<vN4<RyA`0^r(E0K0Pw
z>2*@X#K6!;7HX$Bf~DS_#z40C+=jskl+&TU-*K0CQ(5#AK-{0#3+(VCp0^WvCNDTQ
z`8tY_+H@ckm6nEek^Z3>@0hv&+feUorn8KK0-{=}0+!XHUh}k!U5*Ku;vq1{-ni%a
z@;-0kfmaJpk{g>BN>yMqaAV~jQ7gS8<2RyHQT0;u=xpPI3w1><5kzwTbInay{-~6n
zU71Myz}h%)8WZoA4Im^%3~mrCSNx0#F2uTk)|$Q*CQk-bPlghJrj3vF*uE%c^_b@5
z#aY|X;s$n6Eba}nSt%S_(qdsX;<8{m?hfD?06y0~-3;gQsn&LQ4(D>oGOuWoVQGuT
z@_1J0aoI%k1b6B!o&>QiFI8J8=TNR3j9bh<3|KocuMEYoSy@rzo&lo9=hSMi_J=KE
z2(ZrB!ehFz6&RtQ8i7QlIWkE{6ZjnAA1d2CqD+IL0<vi89nyA-UwY6<rR}upG2YOq
z#l&JfNdA12a=!=a|0Hl<dTeBM;3cIlpr0D<*#}{u;$A(1xsbveO`mu<E*juieD*+d
z#SvDgi!uA2a8$89)ko*$b)R4!t518)M7)lnccdcb^UwoAQ13ggexSZT?(&u0cqYT+
zp%xxmb1mgkB>Mg_j)n-;9!%rDXTdA+VYzw;bWjokd0>cz;~WIxy)#%$igDO}3gY^5
zzlDGfu7gkQuQl1e9t1vKn#+$@5={YSk%=mRUOUp@IiF&VclzgQC;pMAYv2W3RfpWa
zKAZ&8U9*%B)H!*bfS-@41sM>o)CU$9(`Ht^2HxW(*g>kZfHfwQ9bRxcA9hvEn-t30
zAM(3!-FUB1;r3)6s!~-k;0{wFT4T?X9R!S#L1*zJ87zqWEXk>5v%+o6FX;q~*&iu#
zt1tuia<>F*m+7e*OZ@T&WZi++*_d+De02h31^D^<%Y)77PJeFa+IU7c#hGVPk}FU#
znI|dUZ`{I)mE6<BB1#|SLk7_QN$aT|che@7Ax+&jVR3-NSmgEASY)dHf$3T~+kaMk
z<D+GCxL$egM~E)x-#;gY9h5eXC#m*n=CgTGxS>8}yTr)##soV-ni#6_ww8lCEh!4L
zq(WsxsHZ7Usp@g@cV<9udV)tSBMq0xLdJLaGYqSrn1eI9pGTaWzEWDo*ds-;K*wRx
zsr+gag6^&GyFI~Z{LBuvs<P3?vxPTUr&;%~O-T;G$;_hVww4qTYxw5}@<od^9)i}8
ztz3Hc^7z0MgnFMxsM#ZCi3)L7B{Bt@4l{}ot(tIQEKXlekYEdaf3cI$@MkEl=ID=(
z8$h!-$<Ry@bKtwyt5GS<Y`ye;bMayzwl%QHT&IRnLvKaI5;pTyABuqceHAU?vDsxA
z@wHu{CE(LJ9@jYoY?XdB#%924#5vTs9yleIAk5=+-eUtZIKVWB$Ly<lE)dNTV3`7o
zD?d&aYh0?se08ASC!tvD9nOgF`wSNdIhbdPSY|{%s!q3@^IB;*%D7I(GFOaj{P{Gy
zLIsxJS5%2;Nh*E_P^0VGpEttcNf|;1B`jbAs}xclZlyDlJ7^1DE9uHa?wi|eAA}kI
zQ9C{DVYJ}_PLnM4(B`DKvoYjwIKdPSzX!96L7Q1~B#M8rxQrjkQ6S=q2bTl3wXLc6
z>+vc8kFDRD#Tz?!uH9`h#|&7giNA<u3Gw2Ncs0TA`<IwQB01<VB_m^49B*&SVl<JY
zO09SR&)xW0dC&7d<%3nUU8T#Ei0;F<tz9OmH41!QbZl&DVf)KO^>PKAZG)SZ5h8-t
zVb12Ns;?V2V`26NR)UdA6@nhRwSN9<s~n(VB)hk3c;nB9Yy|g|k0@#~!?as=uQ*X6
zzM_J<&#+D3l5=_{0Jh2_4Oa2uY2cAED}pIkXt5Vn?#(c7LRDoX4@~8_?Pd9v@g@VV
zJ+(-KO%k|)HC+y-ggSeZhqrfz5(1c;;)><!0Ayie*o~g&hE9QiRUw#05pq3L0NK9?
z{m`w8+6k@tx&tKHoXqSGG_$4GenbiV&?4E%(i{NoTE$vzTRLh<9mZ;3`c6MLzw^Nx
z+QBwO@u<}}XfIXYio83o#~}w{yp98yUX7scLTjTCo8Rl_t*Vf0ib)Cf$(BQ;mR%<;
zZ{#?&IYISSK%^+uFXI>5^FOr7uDn6xmTD=jABM|}kM#;H*nrVrV}P?%4pDsPFmg_n
zkA4xFC=rsTGad1BMs4+m>jyQL5(!vQ0^Rjh*~4}3`J#2S$IKO>nfhKL)z2>qJA0!F
z+H<$FJAYiO#!xoG?j19D3GN>oPi}(+UJW`pdzd~%e*GJ$VOa%*SU0L%bi@de1=^uJ
zm_P_LA&Q^AVMte$+x&yHgCS-T1TB#;8Pf;gF>izvTks9^K83WJ!bd1~CH%ycIcTef
zNB=gLV!O_oTc>t$5n>fTl^s&Xndv@T>dxtuY0jn}T?6&9hsP;GQ|>Uv&2boI++puq
z;BD%%_z5S^p4_vRclrZ|z!TT(?}x+Zay$ZRE)e6+Zc^v;WiO(FTlN$uXpOzb1XYma
znd)o&f~+cD<A`P)7wCjw@91XW>TNhmWHI|<^2QwtLlGz8+M5tcv+{Sqx96()uZ-j)
zX>PyFjhiooKV7|L*sqDvPgWoYzOoZ$@i{%z-(A@z&_<VC@R(haKc2<EdLau53lsnN
z@#AE>yNg_$Od6C55xCM0j!_YhL#s8wQK(v*)0)O^kT{#-bN<`=%LVs)Nzln0#TYp2
z`aayV?MF3e(uzH^kDUBViqqL8yz4oNzQn0>%n9S~84-EbgtJVN_?IUQtLc2yGxxn(
zLCYg6AW=%n&k8p#&COM!1Y}NY-YNYd7g4TZ&o^~HaC@YuI3>R(zx!Kx08bfmKtCk4
z5<c9<Rl50XVbUXl<)xl0Gh(Ik*Zgh2ZSHrcAvb81g8l}}4HSadTY^2CtM4)UZlRax
zR!WuNuJ19k*->;6uoSjG+U1S7$I&06kdKdy%(!tM;E<#2Ca5=;N#je#(^B{y_(>DU
zHS^_U>bbCIZaeml+zfPT#I6&N-Ay%#q_JrGWEHW@pSeRf`J+b?qY^p=2kyqw%Wc3(
zKkrLebCpDyY+R3t^f;5UPKq`CUZjR1<1ggMn2Zv+VrzP-S}SQpR!MP6Y8V^_9Ww?*
zbSCwb*U4m43`~VISAuH>i6HxHR%3UQ^06kb;ed3ChXtH{ou~pP9qu$of`AI}ida_b
zu_tS3LA=;QttjF{915my8n?IBk&4!)Q3Yd6N;*lCb5#D36B8;Xs%%kL3OlRB;98^U
zys|9_3h3B?O}Ms78KVyNG*p~6{eZ*rxvFwT^Cb=NRFEJW07Q@-m715zTwWo`$myjY
z)ZTl8!+vn((>N8s#SF+vX$dBPm>?z?{J@l9S(fE-!s|Qhq-(9^kJ`}PM_1kOD~vi1
zTtjH}^?dXzGbV&AjK#+H#voP^9$K*;ZA@skK6IAi|3cJyRt<L<WOOSNMRG+B@eLKW
zH`6>Y;7M`D!BqD@6qr?-|K${eg$H3(l9v01h5pF-v0`Sqr?E<miLf=-zeD|aTOdhn
zh1smKG?voiaG<|3MR=JRTIhjvKJ$`<cBY$QA!#9;l1Zlmgv#makqAMR_l}e*Ccs7q
z%N+l?552mHdP;P=t+}BaFcRM=yD{jRxeP&Es#znr((*T>B{|jzGq{V#P~3QHT49$;
zEtci4C~-*}j;?s>=c}DxJ%OMs!0tbfXK~QckT8vaQgal5+-;sdmweefs)PJ0H240t
zjhDGkw_vN=mlO9V++0!OKUG6k`FI0%CxR3X@ZDgGlwr|ED9t>zB=GqfO!x}AVVK0F
zh&pN@s*NqxZNhMSM*s0{M8p$PADP>`Bps}bMBRZ`;-4lSO;?&gE~$E5H1&Fb5zpm$
zJQCRN2cKv<D^Y7mdb+Y8-b@wj`amifn8IbfD$UO$j+Asho^1bGux3Qup%bmrA~YBB
zNxU-A>=F~tZ$~lecnjMg>Zcp$QJ5wjN3ioJ>s3l(vbsda2R&Zp<6g0|z9i1e7e(5=
zcpU4Ubn|aUfuHhoP@`LBrEf;|(Iq$FyKKJITh>#&s$&G9{{6BxldZZAD8D%Uz^C{R
z>Xt<<119Ihk7a|a;aL);nLoa&E8fj>I!)M}qnQpB4mG7NnDPg46VJ~?g1cUMR@8bT
z(SU&Gariz7dC0)Ca2Cc)-2tG#?$~c>_>PMNQ@b1(rrP2K3-WWKOQ%(tTA|D^_z9P+
zhZA`mNKQY_Tj_O@IhB3<5)wp=4|+@mZ&~uF34Pq!m(@ae8|B}es{nl(GrL8f%hD(F
zba}Bg&*TSz;JvRx@24GD7*-3+d8SKULLtsVq_E0_{rQ>RJ55MTXq9f3rW~Jf&@SeW
zHDMc`ZDpZF`U5$f-u?2c;GZHf<EE8|hghA9gspghil&RdW-Pu<Q*l3bK`G;y)imPf
zHm}M!t;daC|0Qk%ms39yt7~R%{s0UePhQ?(p=?O@7D@Sh_f|Xa-0sHX-X^Cl&+x8h
z{Z_%`QgBgS5wjFL17)nH!p$cYi`5mi2dc`SJzNEu!Uxq2h1*kP*1B(>y%FS*4S)P}
z5sdSo4`23SBHlSp#J2%)t~Q!JR5bB%fs~f)1+m}1(VCAoal5C`lPH8%$BfdXJimUT
zB{pvmz}aOpAqb%O5N?%Xh5g|xTRM{9Ur8Kjw5U(<UcZ%#hL-dw>yqE-=;SZJb!Omg
zK(Td5KJvF%?2(0vmNrV*ox&@ZXP+dWo_o730}L8i0o$~+i|fn5)Hb-Rp(^l=#~^4j
z172&`Eoo%1J5=`=4Q9%vs4LQNoUU>>3CPDk4-&TWI~DkmvyJ1Cx_1N#t{scMKQ>Y_
z>bfHDq(hdqgNBFpMT1O2ev$>eswd3kWHdgW1e@sKKOpype6UPtH^d!sfyHVFu0)+y
zb;U_oI4Kahpm;(G&g=Oa_)B}N?~;Fs5^j&PncNSUEN;{r3u)CEWU!f5YtY!)*(Hxo
zkAgv|-J_$Z_ICd3it3<{-jKIPc5d$U25{pP@HT9AP6PUFiudCQgWn76;PhaUB0C6;
z;eRn%|Ey|ZiFs%u20A*q?Gg<Y8ynd!1_wM+67DS-Juj=e2lX~9xZs)bzsw36{Cgzu
z=TCvXp<@4Jo3{y+<Rvo+dCqb)qS^TVuOBiFFzOD_2Dg=mhK0Sp;SMZLMmG%sV+oA^
zV{o{n{cYlu1<~b@iVG37|8m)lO$qQIpWFm8l`Z&xRi<0y%+bokBxmIP<7L2`kxl}k
z_2x)VV2aCkvShZ7N`pTB-dsBbzzX`~D>q5|6hm#J9LmO$g$qqh&kkn#9D?~Wy<p$*
zC#t%dLG0M1%STy5!v|jG?d~7XFLkJ@*JThERfYJ|MY7TB+5q~WAd%mz2Kgz{BZPOC
zoVoXFVXydoKIh!Ef_So_NCfv}=gAl-?H8s9acLBrUnN}&`X0|AnoT1gizgb!Vj-{P
zdbxQeAP71eTG&$U1X}BMQO*W7kl=el2=kFuD6(dhyY2#a)4d4|-iyZ{C=%}L-pCxZ
zAc|teKh4z^5ORXf+07%l_Hc4|(jZGS6~MEqysxVKf1Xb8Ko>X614>IuE*DkBinVKW
z#>R@U>cA{@%Ky3tZ{9>c7)JLjqt<j7u)Ml5nAWWxQE$H?VVON;IIU+{g_Hn$PRttB
zM&}RDaz({Ee~j(Qnh<ih|9U(_XOe(>DKJW%7k;CNwBCUbcr2gSvzp^I)T)osn<y)F
z&R0{fru-%R<#80XYKjrj>O}Fmc_2lo+D^TWwxAuGe2oq%Ah?pMfb$ajL+N$PA0r6O
zb>N+eA$B@f{tNgzz|LL6Y)ONG+o4(kzeNk2r_ZgL0S6p4BmWtc7wuI1yHyvUM=Ezr
zuh(0yd_cEBidBPtRyv61EH$;;##jR}cK|#RD@us*28>`2mGR#L^v~>IBELlTa1Y|f
zNP+cbM%#8m;=qjykd#*?er5gFSO5P42Cy+;yQLxUF~}`z!T~2`vtY!thMMEFp&zj3
zeH;$0mg8qotk0Fgp@<^HhkAWfHwHd^tEFK~3Nb=gSD@%;6KE49u&)H$5pE}+W1kL>
z!@20zi{F>`-6;qZLwR5S`|0u;REZnw_f^<2ALuKv<9Lb%HjjTNGxCo*`DDP#PPUR&
zNWrT16=k3MayEGx{$766^_B?Xn(6CZxovdGVKxUH3`7W8u$eQ?*afMrH3BIDpyN-H
z)GW20sdptO#-7Oj{GlOD?Y6CIRGwtvp(HGe1mtv_S8Vv*@NsnUO)U^09qk=68vIOr
zEXyEgG3ifTYN}16Wa^kepQHpdLOGZm4s3F++<*7C^%KIo%$vm&=5)LG#gy9J<o;31
zRU!h$Q?k<k8A=^uFnX=mXc76Zv4!Y=&){c8UJ&*~?YEXXsO88ujNiFm1D1RGXEq3e
z0u>Yvua@FMpdhMWAAT$6fFdJ1Pwc!1*LDRS^Ct=dVv<RSrK1|Y>P@5)>1qt1iM@^u
zue3eDSb(c18q>UEh)~~svVU)|Y9>n;Ze$_9+(s~$b@(m*3?&!9o^vsRa8wz+sTKNd
zk4!l(hxLZU9;!yS^jMDCQ#?!1OBK!OV|JTl^>~blZuybEaxrqjUbudUr(|+0FT)bP
z`X!_4@do`sP-yYhLk_+Su`eG<?YUfl^Msfc91i?5f4l&nbA$K5hii-ANN^95N(}JR
zs(@Mg?twzoZfg%+9!e*X4u3G58Xj>1429$4G}wv~+dUS%yP7ra9-?D+?F*?vNDrxs
zD6fQ6%bEzPW@h3~CGyc@znt@+ozSk2g!OhTdAo#qRk;Kb!4+$@iTq^PzZdNxP_P1m
z>aRFhLZtF{h^P*7*qnPwtye$K-FbrBM=|E|+I{s<V8KuwAr84=o@PrrLLn@=G8Hoi
zl*92kE&laZZ<^TwgxaazbWwhJFL<nUsggR{Y*zPNuZ;DRvq}H^Tkd9(B1h!i+Ep=X
z3pwYX-?msXEj6d3qboJ(4zSy7Z*)U3h*kxIVE^2}+ack79Jst#ebC}q4LQWv<HEx9
z=gvV|!|&XHQhK$%oY8;FK!<a+R#9R1&ancMmWAnmnV0X5U^FIrmg4{7C4%J!@9)sQ
zbXBrFKdj0;T_3uiE-{P~fSWIhHu$xeH;ui<O5<c|44b$b=IYhtN|mH4ut+jk;4o--
zFep&c#A;W`Az0Is($g!um(%Oi21&;<NX~x-L)W){6>2HJyT3DNN&T5XV3Rg4XA){g
zZgkO7RM&AMK-8#JstDseXwU<#2S%9^TnFp_(RfOyaP==ApQyq1@2S<Q7M@7%`lVrY
z2+n&Zne=t)uNBHBkOJ}U%9;4u?ZJ=6F{w2nZ=jQSX%cThjRU+!Spk{8hzUyzU&e&2
zmM_X}z|QGC#&U~Sbx&QoSYiNUP2BRKNX?C`4xRrUy(A;aONo0LtwdTox~USp@?Jw~
z8H14>W|n%Go<!Os5`z<B)(<JocCCMZ1dq{PHLL;Fro9vnGXNr<9QWo=fr}>0X?6_v
zZaJRkQTmNO<_N1Q%$Z}@LhVX`ZoN1_f+NMM4s)`dXsg@wpiO;;Q677x9uY^LBb1Fi
zH`ZB)ja%J*?o12rV*832_&{dkJUNa$wC;6#;3YGCQZey>R7c2FM0^jHQNNgxc|M9|
zy=UI+k-4^htG>HR1(xpuo-!U<+oJ!MTMLdF%q<qm<k<!5BDyI#S0AcGC^_v}|MOa4
z#mH%v5|XxBC?omLPCHi46N?mi&lLHz*66Xaj{kYd6M_E+(-|GSe<kkU&Z4;Nu`+qb
zj<G6v$5`-ICis1$f3Kx7ZSW>F68HcM6X5TxN6_n+mQgk^k)l;L(2;_jmWDNE1|J+M
z+x?Fx%M97@+Y%djy076&>lFeauUW4xO~G?aG6qt7UNdyZ)%6Sdu|<+KoN+P+RaZg0
z1tL1OMwOolL#(g&P=)697`=e1#ZrSKuvkadeT26gdl0suP$bMyb@5P1kOec_Sr~^w
z9gIV$+$erlDuUNf$;mcrhqEvKJ<A~^Xp`;${9_ISY(BybuP6N$iq6u|2ha>hVqb70
z2wjU>D%&?Q0$e4NrQ+cGD162pnc7ZhHX}d1(ySFah@mDZwQ+sn%;$t@giv!@DN`G@
z8(I|LId~@l2@=E(@v%GIpDJ4hOP-u19uf)!pl%i%GV(go!hpRd@cS2{8r}Z+jxbf(
zE?SBO&9b?w97@nW#vbgj&9v5kJ5w+U&i>CMq8NU6R^)P~ZM0|lhadGOnCB@VZwxYh
zav=>#ExkFq(utam*Q)dlJ)oWkVcsZcBfEKbaF9M7Epod}ZlWi}6i+%%&9(Y#a=%of
zDEW3>uX1b~@<2RvOOKV!+V5z7^Ucb^fvYVn`(`tpYc{{9oeg-0D0J-(gc5AFOSG9b
zv{*MFI-sj4b-cl~+ioY3uou~>k)1E~Wa4(+z>;+xPVek(OnhJu&En#$#!M!_g%MH4
z;dZ`f8&Tf+qO?xeI=f+mUo71;a>5rxoBF5eJjqG2jrVr#gL@QtQE`kK3r)BUSID&z
zd^1#i@^%j*tX!5b&}!#u-o#FpHsIG!Pvwed<>Ki3w7Sjh)_);H#hXNH+3fYtpA-wg
z1`D;y)cA;84e^l47l=N#8PmOP7~sHg*q>}}eZ42aFJH$zH{=~eIS#7&ksvNe;K!KL
z6;LQYR&ws>(C}H1&!f*_+K4~!r)^H&;7H_@{z`j(q4?-4t%jX24>Qr}DN?e`{&-L0
z-1%zO`;m>B4p|&J=f2j568#zT?!^FVTTf*5Ss`UkyzsygMS!o<mwORp_F7Z2A4YSw
zj}>O1-ywD@B?N*${`74S!FL0oNV<Gvn));0JNzLPeV*I~6Me4-KQAXXgBM%t`NeX2
zVPHDf&D$O*d0kwht>59pi*ah$07U}qsUjHht7|oWr$oPtw2aT$hyGoc=(2_5cHDxn
z0r!dAjCa2bmw9Nldv|r5GO&-U?hc@win|+wweu~$vwK}4wgd{`kY5#(7&Ko*M@<a=
zaUE5(A$bGhIt%%V-(*^1$jY$c^AZ5GV!?6Uzr5wm985vc#c#Fa<TZ!orB3=h2xGu4
zN^&;d$09ZID`qow$`D+4NP{a{dxqc^C9N@|=5?I+(__aPZMPV-QQlWHCuhZa8;#1B
zUvp6>WG{L6OiuL5YPI%c9gA$e9!4Q|16HzId=E0jwdCROUtnf7X@u!sy7S*z(ipVC
zfx=;dI!L>MHPTB;&@FlL!8CT_aLGscY4?`D_^p4=jutn^S;|yU-gZ%NCQ#XZn*nbv
zruw9m7Xr?gWE5gy+nEkS5%zH*B&94WU%8McFqsguU0(Aj7)&-aiWZ;Br<ya~r=R)x
z=VGk%(1(Tl>z6C$DT8(lW9^rlH~$QCv8`T2TW3u>v74eTb7t#PE6#NDGshT|m+N2d
zfXx8Nmo_pwlELzt5ILlne)j#hF=V<yw}5c_Gp7`ljdfmQxDYQ;Q|Us{iZ8)}p3Lhb
zEv?hd?;LLjH%OW3p4je@&S>&|l>n>AE5psWrgL~ACT8H%_n%G#rL39oi5s|sxk`2`
z=*H9<_fwqbc0xo|UL;@bv26P-Cg4F`xnbM{gNa~KCIQ3mRV8X+{pYfjUse>UOACbM
zB8YrIns{F4MUmB5HWphT1ib+IuRp!blvck)m)=3S7WBskhsYsd_ZL})O2IYO%S*eh
zIev*~<4U%(jl*CnyaWk?CMcLii5YmEmP3ToR7-BIUm+X-{@*1tq9jh}A4UtN=>UQI
z9H4bK?7vn%wJ!@zXZIG@WBqn@yrhe8sGs?@iL=emZV6d!fsI<l`aFK0E{H42^tp!T
zUo!@|ci)WuLw&vlm-<%iFzFU`E*_9<Y?Y6c_a@(-ORA+qT_(~AOFSZ?thQzF**kGZ
zzS~F6e1kKGA-GH5N|^WZK=R7}U`wZai{TxGO_NU&zl+s2SF!0f;>Hy7vX_8$x!kb<
zUX*}Nh-){4Q1q>8nH^F5ukj}tEL(rZ^c%#njFB&TiiJY|^%|HVw=}Z$M;EZ#bK1i0
z{cMo=lbz2M)O#>_EGyzUjA-yNaP9^&X+x-P-kLg5V&-a;qR%m~sfDL&a~@W>>5itg
zWbP2tpb7BbUz%2PhgI3|?(u+_RN@;DD*7#*=4ZywjA!_JVEVJwoY$16>-*X<Tj2h|
zf^u|OFWtgD?_YkK3<qFOn~O%&_hBxO7w1_M5wF>YJ)4uE^2<!#kUf#=cXO9c!Yo%9
zihLzO8fqLv-wg_p_`5=qXezu{|CR3t1adF!q-!Yx03-K|-iTbDd{;h06e2iIX3o!}
zl9~KoTqaHn+|I&wkbLjh1}h%5tQIFXtOm7T;H-bdD!o)y!x)Wwl_~Fo3BkW(dGtE>
zu!G2i_75V_CmcK*gSM>87Ov+LP56CMl(Kmu)7DIY00bda;lb@?B8<^z!pf<ap&xhb
zTw-58*_whxPE;mie}}$6;O3c1Ks(>Ow%`|-b3wHT_`xeGwf60Z6y|wRT5lPu07M7J
zqe+EJEHkIL{@^IKYQVAvKfztP&5D2T&6wCpb8b2QG<D<})umY6F8}?=bhDG_2#I;u
zEGq%J4Y`(6KOwIz4Pbpm>N0@#Kpe5rB(Y6RdN+g?hYJ!{VyGaw?}MuF^jYM8qgBY|
z(FB913hW>}a9TR}FA-d%7Dd%2<Q*~C#&(I<Zj4Z?ek#QO)ywolr!IOeM<!i5NwTH>
z{At>@`{n)Xu+_n0;(G+FjB`=T515eC?f9txW?Zq0*w*83m$dGKBncdh7Pp~0)bIX^
zo4-snVzX%ErwvMUjR!Mhb2uCoY%Qi=ji!=w+$W8CL*%X6FU~5s?(bPbj15!O6*Ck@
zrl*7=m67=J$EzP<xnLBErn<_?D(e1U&^s7n&jx4Bi~lJmCV|oK-fDBE82}A9{nbd}
z=w%yZ)j=4{Ofv&|{7Z;a$A2jP!zunJ4gasm0ZeK%0vR-vTtAfH_qog>@-N7@H9yH#
zoDNn>Vfo5vK?a;;Q#RDbcYFnU-y#fF-Vn8>l9~2xmWuz{bT1?*fSvOJ=O2uNGcgk*
z(c>E_${XrdKmt~@Ip=5Vt7gj5%-HyjGV{vC`wF6ZS=`_wtvBtlSTp5y?uM`Cm7Onp
zJFO(eB_#vPx{ids_5Us|mCFeOl9g;A7OOwpoGJDHgB|>LxTEU|)WT-+%<{8O(qT}G
zN@9AS-PRAYb+-=wzOK`{<^1B@)#a?a4wgd1Mudr#iS7b35zsL=Bf9?mU_nw)$ZT$H
zZHXLw<OlBfrt+Cfe91ihe*7eMF_kam`xn_f#B)Z((>AOh`KvJU2)wg0vtZ8GAHQVh
zG*%-k4Ut{`>PNtI1*_+8e9h;ob=$QmvlBuFj?(E<MTHq>e89^vGP?Q1jAX9u7Ylj7
zz_o59{?YsS!Wu3TZdU7(fXO&{<12k}q5ON7AfaQh*-fkj7v@TTj>sZ$tcWr_z;t8^
zYrJZzdhne=(tU*E%X&k^Uv`JI8G);nkndMj*f2hsg<|QoxRf0Ar0#91gL5t<;hO_y
z6&11kkPg<-c-%HS{pC1VfPD+fzb@Hf8G%OVC#Pso3F`FYu$*L@Qibm}UMwXXTT&>b
z>L}2GeL6eD8D90sQ_Bo6>;*oM<&FN)@QlZnYb<>gVqZlikvZ0Vh-H!pp%ytd9@~BN
z4MdjGwcIXzsAp>PzcD!ey#ZZmde$|X)nNT{?fP6^NE55^huF1XpwqLOUIpS_g(SvV
zmUQ5wRcHyBwmAG#;h`5{Dc<*poo;$19ztYU*HcRgoSus<G&ohb->;od+3oXbwlRu*
znKdL;F!Fsa8PFg+OH2R_S{_syMAx%E=Mcgz#W&r(bYB`%)t*)YBmw{yBzw?b76-Y^
z;F+Tfn{!ir`wuBJ!%sfOGL*L?g*0PWQyxvlJQf0{<Bp^}YDC)0*SvqStdowPge<oq
z?%#RQef{C?ci8rh%}RJv>H0H-(;@Qi?v5xOAIC&M6DRCb>&M9Z^RnvFqj*q0$^jhd
zptfu14yq;=bcrGcTX~yfU$gNiB?5r$w)pRH6ulr}*g?3H(%9z}xl!Aj1YPy5DY(_f
zTRr55*g@6WL5?=WbWPLv=F!sdU#_U2?*=FM%!m4WEZZ%RfDAg)y$jVQHNS!lm?=T@
zr0Xhj<h&55LoJ;goj3@>v_~cr$(Nj>Y*K7s*Tx1NinN}WCK5oOy3c4BAH_@5TkAoc
z;!C0MrI6yt{y~c$^*q!}gtsNxBxVD=YWT<!7rixt4JN?a0nR}j6JSUK@iGilg#nf7
zMWMyOfttFA0I;$Ee737Q6=32aSguL;aYFQ?rs`rvAH978G7t-7w=uc2UmZ$rCYBZE
zrOL<epJKTEsolw=PoR)+jTh3+l3`A(#EluO4M#PnaYx&#ERH-j)n$8$y?*44&>8Ez
z^b^fgt%I2=-%Psq4!poS1G;2AXw8GCzbfTic7v$Oxkrqou)n}Mf~zR^OwV(UE9_^d
z(Gr|E@_Ne>>dPlsLmLVootXh(&}J?vEB-5x^9&8j3#G0}cZIQ96zN+Nf|i5+o7es4
zzEkvQ`wnVKbRyPcch{$*P60U!6RwTIQ+mj}w-xn`a7L~<!6;?+x>C{Q1rF@N-Q^`2
zmV8b52`W-p+sk^TG?u1IUmB9iOp;0(DV5`q2|1AAI*ykTE@DHm<@mtf5^c*Bel3le
z7%c*@E;a1U0#pgx+C8iH%eg8xM^QAgt_fKJ83@Ngly4FM_0mW{bWyYKx*p+%uQ;F6
znzvmTrP<<H)FB1eg>c)%`!K{L`MgiPGGJ4QnW;TJ$T}6#AAsZJoSRU5U-&!UwbK&q
z$YLlP?Gml2f9XBQ>*>VW%fvp`8!RVsTgX<eI%&>%O%)V6B6DPJDOf@B3QMMnAI{P&
ze5T~;^?aZxT3)?e7P>Fe@(!H%@`i}K;x+Pt@{~y`YK2wtdN!>Bkk9@~(gOOvJ?Owl
z)Nvnra{G5wPuA^1<kI=oH?N-z0obdK@ww0j`Go_+31<|rA?H5T*$qFZv7j#$^Ti+;
zz6vI0AXgrGDO^gNMee_TRsFx_t{4vhZ?#UM@M32`(e(|g5+Sv&uRwnCAegUqB%EaH
zGBg*;9bS>$B8ik&i)GaR8lb;*hZ5HaoJ7WYrQ72#b^|P!&fhHQff|UVH%uwr*aoZQ
zKL)x)da2rHBQx$^9#`pk92_A!L+=sc?sL(Ny`Il{8?oZp-NuAYJO>P*fvDMlT}Q9y
zpG1X8n=ZQ_m-Pmw0szwy1*MS}*PgHL0{i@ckEco%_G`k(yAGM=H<8*@sFyl*sK=l^
z8!FKO*}PjCvyW36xE5$97>sNhv$hQSDwr0i7V`gd?}-ORm9i~+f1-trjR4jf_VDi^
zb_c;NiLWw~Lg~K_8H&9Zqhn@;zD7h2t&NK5$puY?hZZk}e!#$qF?qd%Xij!WS&(9w
zf?i9f@mnvM;?4O~GlE}BJG_zef?p-^2agt0CM5R;M#T&y_NMm%Q9}}YPX69EuKd&m
z#F-JXwsQPfLjwya!%NIavqx=Fg=f{Z)-!Gfy^ZUn6!NMs0P>Aq+BW!HCuGBI)=4Yd
zQHx!B6V;F@K_BMzk%`lZPm;?R!a;Sw?R=U+jBFL_X0*vy+_33qAO>JftGd?se#W~G
z6>c-3qLX-G2^ML;DY(gM7X)WWH^^cHYrjGV0c=@{LI(a+6BTO32j~+yWwvSEi}J9Q
zc6x0x;$GV%SKKAoz`|EJjt%TC|N0(zQXR_todu59w8Ep+v>F|^@=n{5P9rpIZ%(dO
zlz8+Q-FE*d)-$Fl;3le?g0~h|U!CVtpponz$ykjN&dVN=Brc&6X@3p+s06w*k-2Qv
zhP~8#C2Abq5qq?WK?Y&ww#`WV<%&VZFiiPa@mPK4zStYqfma?;Qy?R2p$8LygMHgh
zZALeC;SkE4mOAr3CvOYd#|bpIvx7YBS77Jm{Bq}jw+1p3qbI)~&~f^eJ2M)3;hH_v
zG*sj1VaEA{+@I{y!{9&HqCZ;fYdLNA)d$)sJUiJ-Coc^~d9sceIGiFn*P23;U&qBI
zr7%MEZsz8dC}M#C$*gE(`OF|{LK<R2h1!YhX_i;D;bF!^n=io9B90Cb*T1b}3w^P;
z#j}qgaUKmJG<XhK;e2y2r-H`x^<zfA9Z%95!K1M_GU(&E7V&l|r*Cw9t5x|+pcK~+
zPa<=EyIPPrWgGJ8dd(9w6Ozmc6?JD!*m~Gww1T?Xg(u*kuRc~e>^VC)C^a*7iL%Nr
zaknYQnVV~%T=NBBrTU5S51RGCugQbRrmI8Z6XXp^G}t~ZMHc7<cl@~)?gV}_Ni>#W
zlFklK*IaUc?_H_R-599Aes~sSLhfkC-+khjw+)ACq8!86tUY(X$oN)femB)w2L_le
zS;!I${Sp7H912wkl>X!+AI2ur5EvcaZes;U-S07BpRQrZQPA-^NU6<mH+O2E81&qA
zx!wkG^AJ^>I+3K*_$5>?4cbZELyk!S^4^sU2-3`<prGIndF2PQ-iIz`m0Y{;aNn=9
zdVgPpeh5uXPe0vXUb<=N>RP@&Ug7(SL*A2N1MB*@H5X;4xvXQ-;0^<cY*6XizjZAs
z$ijj)F_G~(k)NRBe`f0`83cp}mgwpvQld4RG?Pf1=^n0HMn9_^pdb87s{fWajfe`O
z+DB=;kU@Mfd0@@^W)&W1m&t!OY!^+@u*$2riRg<^HC0nTTNA#<?x?gzvW9r()2GrA
zO7Ox)=a%$-62A*<vZGY-UtV~^`E2Yf8d`M8--y+HTj^#d<eD3Ow!M7&c`iQX4fe}l
z26+B%xL_1s547OP&9!JccAleU3D2?1(WU`}uU!==($M~S%YVw%v^k{-`+2tiFfOt1
z-6(k;nK!}3BgM(=SI8p5(r-{CeagYXjvQ}doeXm>9zA}sxm=#--DOw))lPCOd}<ID
z>=i|#v6l_Uny31!?wbhopWBB~%sI|qZ$;Lv*f`Cg9#7IEXRqU;eA{ve-5tX8uQcNF
z!JHoUT@Um5?C$O3WaI{6B)Cx4TMT2xfsQ}p&~WSACG;gko*k2Ro0^{T1rsiw<A0mJ
zU9UI6+Fp!T(1@I~!-8j_p>&uF8v^iF_D+cNK4xTOMCOSw8N76+KLXD3a3Z7K?}}3N
z<JI%m$NLLA7gw4vNK6<|sJX^kS!BbBz?4}VQ5-9{0N-wLXCP(fEz*uNiPvDi4DM3p
z$)@}39ZAhv1qv+6gcxxJXI*>;)ML)+jeYKard&*oq^n}}Uqt-$@ds?H@upkN*9Lg>
zT0hS@7<n=|B3)|bkP`LUXb?BKur+cxg@X>Y<B}E3lzloA9Z8q#_E!=6GDpCn6QYCo
z`DYe6NS_*NGbm|k>C4N@u$r2hUs5(iyiQ?-g=9P1Dfwcdq-?#foS7_!v}`Fk*qB*i
zZ=;z03$dqTgCR=LM}@FJL=9-KK#c72vZhwdNS?HRzBK&5Txz(1nvfb&YS`9~9V!5s
zNWj<TW^OQw54%{YI@)Z%cwlIinUXR;q8Nf(1J-yLR4WX=C-CqbPdn+OHdE{i*|jjY
zXuQU&Y`t)8OCerTVm43g?s{{C;#E|!Oe+y)0zAonh6jQ~KqYja^18phX+q@%do+b7
zzEPXCQJ2Jo<wpLFv(Ll-k8h9ZGb-p?hea&-1RBsgr8=Y2q)h&Rwu=kT)l&N4yIKEY
z0Ld$ldb)!NAPAeBm_WzHjWX`?F~2?-KiTYP0*O9xt%X5A0UVYYpVraxpq&ta!dlMt
zE|*i5KqnAC6*ESN%RGIBHE)t{fEna#_nrXq8h7PixK;ChQeA9J>Y;Ud`6+P)4=f4c
z!IaF+xztOY48x?)4{k#v6C;spjg;M~$pn~5z%dJG(J5&idgIz;izRGsswt}Yd)M@~
zjj*{eqix(XS&h%aufiqjGUPRK4PiSGZqzcmrQ99p2<|P!D<DFvDB8hMmZ;VJWR>!d
zDRrLc5d6sBVG^Pgh)_P#0XV;m2QbLA$IoKEbP9H1e0dl|$5WpkE!2F&QqR^xHf=yA
zjZJck`<(1bI(ur9Y_mTrFB$`X$u<(eq%GCNVH56YuYeNtH<F6=hYG3}`ALW{1SK5W
z#R&SN^&Kh5ILcp0<jD`bgnMWO`D)0+ZwDo!*N`@2{!XqTqJ9B;TSd0d2CEZ#k%LT7
zx+HAf(rpG_PTar?>et1bK;-h(tTS$-)88r!KYkgiqgM!K{#0s2C)j(TykpBhF0Kbd
z3%vqcju98qgBuKy>$GDF9R=C0P__+(=|d~~?=5x(F{Hooqdv`2rVow(94XB&O~Fxz
zNjkfAC0Uy?pT5tx=Rk?%fc|Y~_N7B)xzh0fKQg}Rh_}zjL<CjVRrl(`G7G(#Mf)4Z
z5<(xwG;~E!yD5^S2KzY`oR7H{7O4qJ`I&w=<u)#0L;`KT_;(m<v|Sk8Io63r?CYfs
zDk$g&mIoK+U)_NeLJ4c=Q>8-UuP?j<F9!UOTa3v}5MA0HYQ6MkT(fs02}CDrO>}4+
zO^v%dKRL{jdcjP{Eix(u;4CaCvSp<g8t`QfsjH~Qwy$aE?heJQW8jIQX$XPy%L7Mt
z0s47`lZ1f<3-a@Q#E&10=^5G_CoctZ)Y)a50*TYBTv89V6JDDM%6v$V9-=L6Zl>%%
z$-WPmIYb0shPSK+4ylM@ty3H0U}Jzzkz$Kn05K74U<oLvUPFZ!sL8wAWJxp<Z2=ng
z#?oN;6@mgjb~SkftSn-2RPiMlRhS6xsom4eaONZ=Jzv_G&_vHyGs*P19uQC692Jw>
zNF`wg1u0<tWK?WL-R*-v({zk>mKgs>oyr^6D9<tW8ehXkf2Z&mlmjZC+DzsmQL^M^
z2fr)vcPb+FH2frp9kj66pNLvoQAML>R0T0E^%b*Zta`1FQM(SrKnmMd3qUML5LsRO
z%feTr*T+nUqoB@(>ss2A6T!>1@rC;Hkr5^sXxGpBqp-^$oO*0XMJ>|AbK!*Qqg?#n
zzYsq-L-2uz^4@NOAsBF()5E^Gt*<RC4f&pKf5cfH%93UXz9h5v1&=}+dDKyV<`csJ
zDsfcuTCBEUUaL8B40*9Kt~r``&2I6}K)XYCU?Is$ni`{=saO{;?T|siAs-!2*Q@*T
z2)(ZZ?^B*{3nRKkVW;L+C1J${*REi3&l4Q3YBm3wjP4n8u$-NL>Auh))qrG7eq~39
zI^E|#XiFd(p_uA+Ec}MwbwGhgx;Z+QAr5WPNqY-0V|Swt<wp<8_gckygRN=4ZM+C0
z7^AYo!yMX5G#xF@IGeLg7Bmhe-`#{@7R#Lk3-I`p&TRj1`O*RnY7HPXqbs+fWEO^9
ztv4P#Yv@e`lU0Z|TAkB&4y}$(PR2w|c1nY9XOk`;ST6>j!$f6XrGAPQ(Pgnl`I6T_
z2^tL=l%XiHvcT96lq7H;XngZ0s&>yI!N1OqB2~*!gsC7II|$><a*s<tAe^$M&Z1Z)
z?|^L`3v>LG_5S7kd<iXp<=LdZhm!;p*HHI9s85JZ91~sj)s&K2g)ieb^IvPxo;u4z
zkzWWrERx7PJl{Ik<)pUxzfu^CfTLlWQu`o>xuA=Ulgb}S^pGifMEbt>{ZkXT6&1Mn
zCH9FD;kMrIRR0fMZynU;zjcpd#oaZOqNO-Ric4`X?x7TS3+`6DE$&vd6ao~t;O-U(
z?(R;3o9{XA@4Rz<_ujvr%w#f2W}fG>_g-u5wPJaxr7U*1CTDw2ehn@?(w3CP5ZczZ
z=i#&ZP<;SvRyy?Slzd*f?KN0*1(J0GxA<|7ezuh47h4TI{&e_&)8}K*+R-PJA?SI-
zqLZt*g+FrB9MdW7&OP&mC24fWEuo#Y2d5hyIubM1;!8d(2+jnGq&=4^kC>Gf#<>A3
z5|A_V#8*FJ^)Zo7XlYAv1#d60`J#N&9jfWPRci>z|4tD>3E!&7ilJ`*AjUyn;Rvbf
zcFykn`bLn;2`Uxy?7Xihd-ctEF&$uET4gy@Ox?Jhjx#aw^H3Qw=GhS~$@=g$?iH#n
z?k<D_J)tj;PKb+_J2c}$0$SCsw(T)NEm$oL<Q<^00bkYz<rGu4Yu4^m*?K$XM#WU}
zQA5$J^xlMt^k4K)l9#<TFFjX>>L+-;0Z&tp1Ht8Vk+s8f+Y=Lf;bp;MvZHN^D?-kG
zl_V$MBePG5km9N%s{@h<VzEcf6!E@qrmSw7T<X|4gvkvAiE10hAh)npqBn!&G{{xv
zgAk5eEh(3fgTv`%--I2oB0a8ToKH;AU~1Ca&QG8`xMxXS%wUB~VYD8&19sFYDiX8~
z%mK$O)@it>p*aykH@U+*E0?Ui?C^7RalBKRR(2*ODj2Zigd+>+^e%4_i!B@Z_Au`m
z#9CvM8&>OEePoT>*+fxE1&4v`7=TzmLLY2`pSDx835W@!dcHg$za;BxmQlIS-4D&1
zv{sL}qGF-qD0F1~_>}YFbp9duso)h#HZ-it*In+G)F1iSMflt4A1o@TL6M_enTvBf
zN%qZoWwx#5?>vT#vBtU<a|Q57g1vKxTT+kvW&uL<a&`o@)P4OvaFd>3R-A53*)r6F
zO4MRX-<wj@%l&Yv_;k7bnUVuVxN~}ku<utd14JL+dlb#mpx&mozrnQIEKYzn*AcOC
zfE*M<+*biRtgg0eiY^%Da%sYo!aEHzm7qs!cr615X2Q7-Z*0Xu%d!{n7eC-F+jT+E
zlV+?LjDox%p98?EsXBmJzH$ESnRxekpfgHuD=B^-c~uS=K<}UgSyQ<1iA%p*1wZ*s
zj&IVvSll#tz6=J^YI{otD&d=&<W15P`C;f;6=2R0^A=S~?<oiqf~b}(Uj2B=Ki0)O
zGX1`l_xv_!`OT}-2X2D2z&MB_{f_=SDFcnqd89J{X!JjA-~RzmIy00ICyxK=DBt9f
zGW>62888Ylv9$~mN-_^xf1@v{iTnH@pwdp>==A=Gv&Zc7D&UAp(!C=Vo*)3;fE_4K
zbK5+z8`$>rJK3Do6l|gGUG1#ixoYO{&X6tb4lAMghYY(|_}y<s6tUQ>#q3SOFg<Kk
z^*q@1bzU#fE(Rn+;#+pZP>^u2cxi=wGS%J}G`0!yznV9m5~dcm8npLLr}4|U)MrGy
zzC>!_uSG4w?oq?BhevQyaC56T0FA%vM{WwAoF9)P9o1|J5&uL8pZw5xk~T&(sJEf7
z<L4g<;ZU&YDtc$*EPOI@7=zftPzH#^n*bS*0gdqq6IuWy1z--<(#|q-M3H;8lS-<P
zkOLS(%h%T9n3k~%{V^dVkfS_?sjAy$WPkU86%q)s&dnZ%K@Ii6M61v0>dc<M_d0h&
z7AABS_of*{QL8s0HetuLV?uH>@e+0I%4Gc4&E9}uKgjS{2fakhlz<l&{f$54Q4910
z=|d8jVE`kPelXL=<>rWI<Ce9<$|sjG##|>iePPl{?wY2iM>||O`pn$Sl<b=dnbfNG
zuBh&QZp&I>+C)`Xk6_mX$Gxd-Vd~cOkca|I?2|<rW8qs_%HWpQ?}>|T{U<zvUis16
z!fq5Ky`Md+oxAD$R*E<=qcgy^8SFxV*X;FK*s>&@O-%H-5t|8JpXvmZnH{A!LSc9H
zc2*VQlo0XGK}+TqPiv}Xk9)$D>H2(@7yzZ8@noA?;1#9)pw*|AdOO}`zbD3{lH=EF
z;yHdyL~E^PB3Ve3cXu9HwOH+k=OmU+?Fhf0HPuxuwr#ZaL;?ic52mnSYO;B;LB;@D
z+|5Z?e#s1#{~sp0nAgU{JHe+9c<_jeV-5VRgz8_$8rj$AsLRa-x(QBehh$;j-x+&H
zc*!V=UD@Lnu>J!0%=uz$)##R39_r_XjP?GU_xuX1`ZO3knzZFk@GGI`Vmo>Uv-I%y
z*1}@%*4vRfUg>$KX5iM9@fE%V9x6sJSIt5^&*Dj)KhxMs)lS~nc|vHwi^&9_7KgrW
z<~yxg|JPrALxc5ui)~mV$GZ7JCv|dt`uQ(Gr(70A%p0ne{VBt})X)X7>WN~v=lTSW
zlO^`Gg;kT5dEjz$=-$e)lAfCA&@dD^yfOpB``uN;$6XBq)0lkLoq<A!b5*?j$r9m*
zU)a*$OhqHz%9Rkbe5O1;@rPCEet0-gk))Vq#~ABFfGx8WZ)a;p(6QxFC<r(e?A|_2
z`hKNREI=PR4$5}9W_ZBfOQ>=uEBGeCiI~ao4`MjT;OpZX0JI}7c+d}0`8-iKQQKAc
zhb4AZA+PXS=^azo1cZEtls>QAAw~!(6T!aTSbsbvkXPvBFQt7OUFLel`w=n_)v~&b
z$ElMky0IudHeYQ-O%1_qU+A9Mnk$e-R6R-30nB0VaMUQPry_wGT;t!7c7bHX<!Opv
zj&XtI@Tauhe>fmAJ4QVbfH(bi{zI0(r|_E3Yu_SlFx8ikPtCY=a%Agk%WqDM=gE?!
zrLAxh@JAZBB_x^F0)aHj5pf~M=(dUP&7W<a+w8c3tE(cfZqcE=+)-RP0ZD;@87iIS
z;?_Lk#i8M-b!G|QXU60YH3avK6e00FXZl;giMrX_9z-#>a+mYnbJ)`|Jcz8E6SRqQ
z&F7v~L{3?d2dw?2Zq>E`1m-p>?p`QmI7%(bV*QCx`3OwaHUh2ly4-iv9KcVc#3C$a
z_nvT27{o;#kF=QUJ?;Jc9Yx%M{2;wcOX-!aDAgju<N8=r<JzaVsXNN6sp3d{pGKDA
z`aX&SXCPVFPbmd$B2*tHuKDR6$$mv7M|OAYol89bo~)JFW8G*CVqL_z{L8(iOmEqn
zxk1veILNKHmE9C2gj+;f<74Dlx!;&Rfa5g!0O;sf2CPEzOkSiBTfm?UI$48-&WQI@
zwrsbpZco!@=4OZ<MbBw}?wC-i#=jv7Gmx>~JgWahIBK;9{zwPZ&|7zaz?MT;XiO}J
z^z`*4bA(`+B2xXAA5UOWTChSLibnMX?I#r-imPM(iz;32vquv_6m}0Bd$9v7rI_!f
z#URo8(Fm(7Y$y|)jBV;n-_1Vo#>=oZICBB@#V(62AtyL9j3?fh*7xHO*;lA5;#Vn;
zh7^}`Y@i2_>|3PqE>a6Eg3#kCkGW!VXph2^`@8O2)+&~jTIMB{q_HBadh(*{b*&h>
z1KNquKx^NN8i__$)=`V8poK{fBO*H}0#<wFzs%P;$S#KTb@;z+`O#$b-H0HI?wp8P
zTibq~i`Haeth#p5OGK|ZX(8J{tQ(hFw{ZCYZ!^1shv~pGCa*8S3MB%+gCd$q<4qM_
zbMfK{lM<!!ycS5D-;ed^-{>@1P;B%ilAh@!MCs;o%EVhW$@wISrz+%yFPp>Jc@dP&
z)QawoJ;nCL=}Qwqkt-f77EqvvdXM67-t*@YOo6gs1Ydq*LT9i(pAf_fl(XzKFhpaj
z$6EJx$Er6SVFIRhfu`t^2*FRdHD%g%jgg~L+tZO5zzthw<pwS}M8rCVW^{9GoP4Jb
zuiCBRft}A@U<Fm&F+gPcuT%Q-jR5LKjUmyajR8z$Fi&Xkq}In*d<8*(tG~FXU5q|o
z%^>Zq*8G2^F`zS??}&s$>ez&{MkU+L7p<4vf5`>_`THm-B**QM3jSIEK$T9EvIl#T
zD&v6XfV!_Oo0v4(9)hc}p@TDtECrXM?>&*;AYniWM$v@>0U1n*rKfKun7GigMG!5z
zi$vUv{=r>rF`z#bZmw>YAkV+cd0KG4KMx)!&Cv}69+89k6|5w5^!VTS{eZF1)jaGf
z3DM{EizrJ0E}hfm*vVj|6zah}k?DT1&2gT~xX^?s2s9twR?%ucy4cB7S0BVP@POFm
zU9el?7UK-xm5-)*_`Z!dYaqJ)3EzD^O8OeqqQHLPsVF6D4Xd`pfHHh2WdtfQElk5`
zaiQaEA4&s#fS#|BYLggORN;*e1Cp&|0oaldvF^2oIu`tr*WYR@^B*RKJ^hQgJv`}Q
z_{k9h@(kOnrzQR7XGfc2EKjg7S8ZGS>#XU(Yesa_%Qt2#&$3*JvuAhFO+9g3YR#1^
zv3z<nuec+exkQu#8Z;if4fWuS8MlQS%7BU+@Elu62N6^Njoqd9rK-O|o+@Hk=(xmj
z?bn8k;2DJu)`;%jif@zZQu2}<obc?M1IKiAWiT&Kh%zTEz>MWT@)2wy=KY_J8nb5U
zz=_#eYa1|mhxxU~P9k;1M^Qd-VX&s=@tH@%*q+owxt&#7oKgHyT76>4pYL!ykDJS?
z@xBYRE=oM%Q?E-LZ#;B@4_(Mv7xXIAqn-(YgJ<7Rj&u|tDMtxk#<A^hhGq&~foT!k
z>d5a!k<o{dsq@Y3gJ%zKfQ>h=z53suyBvHM8q#Y4k&&u`J9F&HL>^(@F#Fh?YSMRB
z%8|{@q|poHH_Jp&FFxZG7cp;!KiJ3B{!dI-H1>TR`RpKN)T8zxgR}-`dQ!DNebGb&
zez6ZTT^eb1U*6SME`NP~8ofh%uh?1z9KffkD0)t3xs_8V%od}uONpXPsalMppqI_B
z>UG6^`B40z*8vjPN#O6Trpi&*;Oi}5gmI5*(a6yz5v&DUFdgVM*^=?In?^rdzPtCn
zr!h`=^1P__9FnJY8R@I9mgaUE<hM8CLc4kASg445d;_kGj*p1Qpqs0LhJMQ=Gy4J$
zQ=D@Mjb3C)0_(3&vF1Irk@8o<UMam37OXh`Xo1S*m-kAslv6w1V?rZG74MZqalgNH
zrgC3Oop4^6ZE&kr9^0Gfgic43S|Z!FWU$u{nm*x*?bY!d2X5;7i}S-DaBW9!0L2H#
z96`UgZ8(1xyl${n{J(tiWm^)PgiznR;|y!s=J7~iW$K*tY*h1;H;8?Gtu!xZYKnRk
z#)LgZo1j>3NKTE%m}~}Z{EWqha}9p6<yTCkG~@C@=dV}_-`4Ci-&<;7iK^-=SeH!`
z@ujV?X^DRp!96M%@GHHUhxn8WD@&8yirAJq(vP6sbniv|x_h?7%D(%%wri=<^W)me
z*{k21dcm6%Ray(5T3-DsCOl)&`Jh`ht(59DQxd?o>mom2#$wpB(|S!p1X_z3S*eRZ
zP?jBDxW1#X=7I;gv#4Y#Knpo0>i>Lqr~Q=_BeGV1oL`L!=U25I0TF_W9`FA?ehajN
zIm6vM3oDcne(fhE*>YJ?h%iSrV$({6n2=>Z<{4RE;0z__dwdi-g;Iph+Vr*0p$~)x
z#pcSqGhY9ezc9s=PhY&D5#91QTZ05W{mwx?zzlBQVz>e{Wzt&JhZ9r^qIQax;@3ym
zvd~pEZLM33h<qQpRcdU+MKc~!Pfy0U#9-D)g~dKpe7@q+AKE2!Vntp?AOZ)TQ(NmV
zb`7}V-GXDf0KmT+Ev5Munij@O9@uhT@&xWaX_q#iD8Qb}W1aTKIAP4G1cJJo1fup@
z)8628GNB9buLAQt-dmwSd}r{4EXJ%=l*3VT^-u60Dm3u3Ex~Q68?8xXw*dwC_XE!M
zd?nK_Qd<;zew>45c+4$hUd^$`ObP47#6rNedwjdVG8cUR%uc7Ot6KP#RtX@YTyroc
z6|se_iD0M?x3u_)#EiX^r;Hf&=5f6hgz499p}%QC;4;CRjhk>NIe;D))P4_mmQ3gm
zQh|6H@S&=T)o|K)pO}REqa4+gQt$08c3&HC{RmCOC>~ZPp2u#$;dLI3@rKs90tM)u
z$C0Q(6*~Zsf-~WJ=4=V?H;91~)+e*6y{S^hc8r0uhf5Xbjr-c~u)-fvrNf^c7Ltm|
z$YO(H1SEx04w$D_N$N7mWCCxmB-VX<@oHuD%zh>_iYh0$0CUsLr%|Ez1fyS@oH6a<
zi#+zsm~&u}v&@&hlI;Is^z8?q<!_820ge{pQXe`){lh|nby%$M5GpESU-!4Fr<Bng
zC-<0AnFIgm@Jdoh*1U;4=7g1qWG>>T==;t%(j&IFL2r24jddDgA0PqgyCXyTfnT0}
zTqj%y&s$j7r}vl?v5qHQHzft=e}HwoFN~VANuN{VEfvFy6ffX0*xA-%&K`@g3KJOW
zud)$FObhS0=f8+wa8jVWj+sY3*f&}@bcp`^NL(`2&h|H3^%_1O9;;o4e-reL`^D0P
zu^`sKogFmF(?ww&^P@Bu8+`RHtV`d&U3I&LOYmJ_m{bVWFtyd83<ipHh<p98MOJ{i
zEW|Nlb<7)`zLa}_^cx_QA1_ki9Nd6UY4w@zDn!pV0U?bR25G4Ep!=9ZEB!doy?#`i
zanG$K5Fg(;^tlY@VKm0_TCxL2gkdZ%hpd;U+a~jGY8gukqD~4oM_8vDJrzkx=GNwH
zoL0in)@NFTLEOR`d4qUISye&U3gw$|X6s$>G0GQxme#0)3C>yb4(zc7GZh|r&Fmv}
zkn+PV-PybHw6<R~vM_1NGF-_<`u}>Q15AM8G3bjUM3y<#dmw^pbr0XDSzo5XeD+et
z^;iY+DpI1(`*UvlCgT1ISWKRwG#>KErVjD#pYU^AZf?QEyEHz@<`9Wzb2w%Ly{j|g
z!OMJ*dz4qON{Ep*_;}=&)r;aFQ;qkPi_=h1$S(PxiRaPm@fzuI{tdkTivfoj!n$Dc
z*fSx-!OJGcbiY~NDz(P_k5Z%uxcnwuy|Dn!IsKm&SO9F7W4=MmA0hfI@g9%4VYP2)
zF(LAj=i*QJgNzHs*RPe13&nS^@5FE+%6xKNl^)X}GAG#(ydf|<UyOa@XIJx+Q7J2q
znOD1nSz^^spnUr<8e(bY$nVG&S|_qU!kyWju2S*lFXpfs5`SjM9}f-}Qc|)M1r*Er
z>}0Gp%XL?}{n&80b9%<L)zZNBA6n<noorj+9v&n<STXw1(2Sq;^gYJu7v17{DLD()
zT)l9~4DS_Xc!YL$;OVC<mtV!#mW@W&^o_M=&Dc<TUq>K{GL7oFf);s&zP^UvA@xR)
z7@k@CP-HzKV17@avgy@C^f1q)5BBkJphceLYHPi-AWDBNpwWMhh>Cd;xP8JxJQO_I
zwR{ZEwbGLpNoZaDODaE{f>n6HJu!e-#O>}NeaSUo$sAn}2KF)plF3*~j&88LaMYt5
zG0Xp_IgEv%{tz{)ws~^2{#9yz*tZPz7c($>OzaI3?Qvy17!J;JGXx*$A(dYa<(W5N
zje1C!`%sQBA4!XLdZfhT7HDQpe9MWVYeN;wapzw^wc}(Y+($6<P$Bljf3}32EEv-2
zqb$_mbEdJikMVXba~MlYB4&T#1LhZw^bhE#H12@otn>J@=hXTX##yztXCzd732meI
zm$Iu0OYSjerfY0WrDtaF*WMJIPYmM?9n_Z=1TZfP1~okvsw;eJufOF{%aB%J*J`ho
zO&8feI*U^$$47v2U%x-n(3kRvrZlq<%t=^}LCj>#_7}G1p)70Tb?bvLhxrdBr0g!x
zCqZ-owBenUh3bm)Z`bGam5uHZl2NuufpR^ck8H_Ic7XPyyF%hZ!=xDQw42|Utf}_m
zWnRIRVpPYXM>E3x;G2(>iWq-?v9o`ZzSh&Zt9wdSm%XNPv&-Y1_?8z>3amXwU6d^a
z;vsP>Oi(n1GdDNUK+%WwOEhFXvT;o$#Oh|#rcr7o5B!R2%MqOPoG_&+j;*YIDsiD<
z`uhV#o)L_(UZ3zIdM{EWeOm3meFQWt+iB34#&+5!?ym<uXHz?Ez?@q0mFCCxR(_#f
zMUKlDdGXeW8gsj8;%DqpGMlu-_qKFtP-=t(pkAJTeRg<Lxe~d$u$kt`l8r13T;-u|
z(w{_yl6-%qPT@<QT#f$<WMPEsE|(=!wvn~*A0`{#yW_zwy`k>iyyT^QbT`m?=C2)d
z79GfOGsUataeA)r0kirP>ilWpLLoZRAPQCEv+XMD(TO=p`$c*rNrFF**bfS|J%>uc
zX8v&#65vXO(U6EK2ySf;1$dUPKR<emZ}^e}(f7kaX<$jhvNZA|rHL6w(#$nb(B7$q
z?c4{uAX6mNwlWa^;i|@VkWhRrEfhjz2j2gTG=p{sU&=1522-Ts3Jwv@2qEwf6I$im
zjlCspJTicYM-%#Oax8z_TkMmQimRkY4jB1;nN~B_#tt5|Q*H4l#M&L}(auG^fM7s*
zVaUG9kr2x>(GO0nB6z<;-GKCXQMydY`BgjA?={40{Qu^QNHmxO<w_*ndYH5b!2Sux
zVXqKdSep=^l8?QA7)t`NBd)Z+`~U5p#$g)vUqs4mbyRt56QRUE^}>>7rje$&UJd{g
zxR#mNNFigR#?e*fAU>k@Rov25rF+jnQohRydeoAaHH@40R1BB?bQ`~l?vFd%XTh$5
zlx<3unql~!oJ{cY^n>+1)ur*64lAw!$RHPI{s-8RrKtv70j%N0>OO+20I?*5>(Kr)
zbzLGpHZc;qrYLcXjEWs_J4yr^HSI^D%~wjyy3+(EN6%}PRy8_lJBltjiS{7N<&rk7
zTx_qH!kW9dEw)1phPJK^Qb?pW*r>7`i2A_rnu!(M5Y`oL(fdu%(DL<;nG0!oiUJ#h
zNsdAMqk#Y7fesg*)3DS^2szYHdZQ*GaA{jYlX}?ln!Ez50L%ID40mLaY?gzeJ>=BQ
zcAf1DFPO)x0j_h4PVlbff=}jdlg;p&*uBAa#U2JxU|)BJe<NOKV%WJI9YZBK>F(i$
zX)m`uDWOwsB|fH8t@0=82AvV|-StzDnM-~JBk`Ej3g)^?J4Yn1Z-Njr3vK*vtBc%(
zzSB}0ak!sJ<ZN;fI~+}SRfmg-m1{~Gaw(u4l7qqju6wxF8gOiK20oFx0%M|E_v7IV
zff@T7RI69&aJ|Gt!H*wfi}I*PxD06ZX$EU-#US|j3g@EXLgd7w$YVSl`xL?XmFYlb
zSM?Wsu=kscu4V+go2Ky+WPWuOlfTmlnc>ZbD;*~Y(2-#$WP2T12X_?v8%pv=i$NQU
zGL$V4#B#-NkSJIMQ2n<-`Rq?FBD830xfZ|iwaKj<LJJG-UtQFFol^s9=<k(!xZE%*
z$lx3N^1qe+pILbv?Z^mt(wHtXcu?&i&axmDZDxBjRtFv_#&PIqQ&~=_slTRur-|(r
zb2MJhIXx-c>MRltD!(u|`~xun5L)F<5<^C%H&CqR+G{fCUQ+n6{4bB;`cVI)_uAfi
zIl&ofv0cF`9>iVie+3xHgg{j4-BNq|_R9J?3Beh&-zBLUn|=7F%CZ>iRH$pIwXYrp
z!HBEKcFrq>6&6neKh3@-T1CVE5;pV?Ct?dvA*qm}ruSooV>p8SqE1&}aIb;E*8)@0
z8xD(gCsZp`%LjHPhmb)DD&py9HWU-dM;D1{*J|oH#)?V=>t@fP01FE?jgiVK{);^y
z9gS5en{Dm&pKpD|tQMQ|C=Mw&W0nGm!3Ly4R>Q3oG!^=HF#k<uqhh$bQcrPc2FKJw
z82cLtN8Yg^b2>e%9;(B?5r}_)i2tae4S5Cwpg9E4pw;h1dsD}DSG0l%#w}B)Gw;NY
ziiUcBjLBBsCi|NT@gdz{WvOSHVvuaUwPt{NpJs%>=xX!_%gv?D8uw5sd9fxm11Vmf
zK_0RgjxCm-lhcKEMh%1SYst);>oBqk57a65Fh}z@!DiFiTB*}2USUks)TEGMQRD<g
zl5t56TzmGONlq$W+G$;~S2FI+e`0@7-ie`if1)Cy_85~kcEwCO!gFzI;_t$m%Y4$%
zTtXM!#wfLT)Lccw;a-E_ingNHZ(40$6(NYtH)j_U=BoVuQNM4acd`GGV$E*)-P$%a
zrY|zd65e-2!)Yj~V(5|g)UuzQF<VwG_N669L}(m$<sDyv$Xn7mx6{Hb-&r>LCvwor
z2+1{ApK#&fJJSFil-YPCGW7PH#kb-Mxh9XZW}*mf5Gm9}j6|ElgB_yU>Wz6gR&-(E
zOHYIAd2^nSPMJXs#ooIv({}D4L5*C05cDbxLiR1ChNe5-a@)zhz9t|qd!KZh$QWX5
z%tfghj3Ti6j=YvTD^zHG$?~Y#q$^mocopAB@HAKn)*#*gnGX}%{ZWw!JDCp*?E5_8
zqKAY<qQaoQ9Mq-+<n<wq&%N4RSgxmJ8nCLZV&s!l^JmNbq(uPb&4okk{xAkC40s^v
zzYhk}648c8|MLk8+=l*oQAup*fe;fEe2*Zz$I{K&9@V;_xQAyLW3V$@{8Q56n;6J(
z0nd$(#7l0@mAn#=A1Cwc7PzkG23Ltjd-W$y)VM<`*?r9_l?7aoWadJLxyZQ_PVI^+
zL!*jq^;#S`K^4ZYrqlb&o<RQFkU3d4WDbYg!{6Z|J}l@$b(n?Jb7uV!9^}wVsw`Lb
zHOQQ^;HVY#FKn04(K!U%b){h@;6{jp-iKwxC#^U^@M%?M>|3mQV1M!Q#2ih+Bq}8f
z9cLrY3xWHLiZ}G}PT6k6q?w3{l>OtaQ%85G^F{eKfPZ)b!2J;|cz#@B-W9d37O(q#
z5`hfl?YMQ&3fMzrIs@@~rLXCXdB7`2C}QAiL_LHlIZ@Zqi3f99z~{_HkpfK5X&-vs
zqYZ5b(WBlTMTn+O4R!}mLq}TT#Tsa3`D3ar&I$K$wALXv3qp8>H2j}o7ut6>Fem3b
z5P_5L)@^9@u@*7Uvaujo3GV6AG7qu8`ebidjrjBj{pXeoFHmhc6(V}Hmq-PEl#N>I
zW=hCdw94VV+>89hN*4j~1+AmR=F|fW=k0sHA*KwJG<)hQcm7<+EVCDQ|DO5ts5SkF
zej`;aldyz}gOnjqZn~qko;BsTalC|$1o<Wajf%|x6w*=hPigpXz7?*U`&ave`1s*^
zQ>^OV?=vK~XdcJ7{kdE_TfEn#1ZnaiAu6)naCVaX#(c<LJM-MGnBRQ<_~SSKDRPju
zBAw;$j>tPhD;HRY>W(pdV2|EdKgDIB?Ium;vRpQa;;EzQPEq=2;=&5`WH4(rP>wdA
zJHFNvY}IB5@RbFLIFCLrpL;Y^5nsKk^cfO+rjsXztLou0L-^%?fkNdP+WK4)Xotd}
z<dYpDDDn-L62$SH46xxlQXWj{|Kk$@F8pwB?AGf!!@K#8=j+S~=3Kvv+P%#L@n`+3
zPBhvzr3c}^Z;y1b?D?tmhf`|<<QJ~xzp{BBR9}^7Ye*5)Xi^1Q0*Ct?U&*I3B;|d}
z%fvUDIuSjpXB|i2k*+1!PmB;jDnU4%3Bo1@Z*g<$@rt5>l{OCXPjuOk-9PcV(ktSh
zBu6I=P$pH|yTIT6hxsNiRbW*3*4;$04oKg6J4`gbCoq&aC-cvrom0jhS)X<PJ=Dph
zi{Uw%?`nhnc#C<|7&ar$24+^x`U>|{?_OShVouG>gqi!Ctw~ZfH8<CPkBL#DTJ8vZ
z;r<{j+%VbZdkdI`dy&Hi1_#UHPL`T3)2L}^V0&<vCI|P!x!?Wnmph~U%`TgL=FI_5
zK2&hY;_tXhleXwutMMVP2m0gtplmGicQ*Mu`W+E6kN3tRxH!KFzTUJ(d5}#Dez`2%
z<eE|^+tkh4-rPvm?<FrNz-DJ3=3jt0B>i|rW$d4(rWYL2Lrku+5GOh<+qD=Vnv0Y)
z`!->`hn(Jg&pLh6%!?!$alJ%f{lwp@lyX$gqm$k~hnJ+;r;vbR9&&5ee<|2ZBJ@zW
z=4Z_pzchY`54A_-HKs8ZWcx70+esus+a)hYr37lpkDjBbcsCVO-P1?RPc)w|h=ndz
zN2J<7oo~J$wAjjYlp_EzU?Reo>9?ZTtCdTa)K`GhWkcV$T|(nc2Rn@ujYGa)I^~H7
zVU!noUb49%&K<Rm%rKwDy4*yK*0?w8b9+r)2>qfvbG`_xkDxp8NuKIP5GDR8)-_1N
zn_pEJ>fzhwtuN!s)c3nRX5H2no!QwtR|Jz?#W<^pJnj?jsbw=pWT%!Pnt&5pLBlnN
z4-0}0G@U*s&!8`{C#W&#O%BDFgs;`EthFsw*W_CwMwHvn%~lahjc7Esw`buDK6=2_
zot)^}UzX-mgt|W)Q7^?t4P3(ksHJUr*4O|peB0tgug4*2Y>h#HHPkDBlFMj5sG~jk
zFcrzrU)tIZCo~f8krc$+>RH(pZb-*9J=4|a-+AHPlS$y&|H|iJ(Yb9W-t4lfkgc5{
z0{M79KbWzIkG^k`tl2;)t>Z6g-SmTv3I>!$9&x5a78tnD#9L|X*|Whoe15;1d+EC<
zeA*fczj+2vT|1o2Atv?q=`7BH6%0UeQ81@z`^d{pfjJQYg^WPv?jI{ukfc57U(o`y
zisG2pr`9O1$Ql+_^3mt!Q<cNq+(k_}&s(BjF(;~%fM}oEPvdghe1?9CrH^;`TNH`@
z9aQqEpy7DkyUpQqbA(7Etwi0vhuJ;o>-|~3vWi#M!FgNLy>Gc4U5QAO+}1Ad<+b!l
z9U84cNNxM9pS_``hs3Z;$Kf@N-(G~jPcvPs`N9We4KmO=*bNO*e2k}h@-e~5w-f4z
z!f|An(9XU)iG|DtDxhm24)uxO@mQ$%tis4P9Kb%-l$s~>LJ)!TfZG<fdApCN23iVp
zj!pB-^&R1z_4uyjZwax~Oi?8-5B-$lT)d`_^?6}Q+dVdV#wTp06*K0;?%m@eHdJGV
z!<Wy#wVvk!-OmE!o?PIwpz@wsv1!NYI>GEmh-&D`8U0`XJzk>7e6`b@y=$85U!I&J
zdZ!U09gk@>OL2h+KZV55kRwjFs>06aTT4d|{xC84_UBdYpoq2YqY`OfJ)aorQ~7sv
z7uS}ZiGe9I)tFq>GCSL|ZVc@U;)ov}<2pRT53YBvef{UL6s3y`!w@=#`>3x(`h$mp
zjE8HEY*uZX0duZEv}_>^EPBm7yK=L<8VbeISjKGQ%P*^ij(vlJmS-6GXyunJ;58uT
z%Ya<F6EWM4i5>FMnH#g0X}DPFKAXh%f_e6Th%dPC2X`g}4s{*KAU@hiZ+Lik$g8Mq
z3vAE+(w%NAV(xg^-mRUN{gRTE6)UjnM`Y@E{>ta}Bu+XKmyVyGbaZs|f|7IP;rcML
zOtWNYJ^;!9e8CK+dE!MfR5wrex=-wB-3=YK+8C~C@9Rp}1h0L3lY7B?_wWIGZ<0b(
zTlP(mh&1Z3)-7yr@t#U+pl!Rp;CL*4Z}l3!f~1NpaPlZ^w}d;R@z^A$N?tt{u4dt5
zH~-1~{s0R*vp%_%l`lzCe<Ju^@YM939Wx)+P2a&?IZOcRJrWtj;fwY-@wa+!={IeB
zMQ&uM8bbZ>r2n3j|6U;<(sv9MXAv;+a!UXrUm}G(V^y*@)LT-Li*|-aR9j^*#xdly
zGg<IdgB2^Vzu3H>472^AoVgxwBmF8l*=i2r2P8Xc%L)AnlXISI$w7uIkI)~?6ADFm
zC|~A``^=Uw?OzXbq7aSpP1YG&#b#GyG>s53{^p_jihe=7@VI^>{on>HX}Zr-tK!%z
z`4T@mZSOKt_ai79GtNw|Nno^V-<MP<?{Yqyd&o@q!iF}biN^1ku)XLK)_5%9qvx24
zC|rymQxY$o>eL<*(fd9u{QcRPr_E=YIaPpygI{=Aj2Z!S!A=))A9r|mJ#PxU%HpNI
zy1bhGE_FNgW~xnE?rc;bJHK3j(kvebIQ=amS2W_q|5vb-Q2%r2pGMs=sSTN#l=NoO
z+r{zU=?NS&#n)Rj6Y53HS1+9o%UVY6R{9&Gg8VsvF1U{J5+n+SmnpyCW#O^Udq?kB
z)U3l)O{v=PE=!$G7W=F6o6kRnp$RAe>R-c)?AxG+2JEBUDSpSLfzxbd<7W5ZloZmP
zk#uBnadB^)bQw9h!uEEP_M4-6|3^>&wxOY+_u%G@AwqpiWWOddY<aZq6?E+O3mD|$
z{~9rKAu;Gl<n#ItS2Gk11dz4XTGovHfc%^~whpN@|Gnr<?Ae+#_3H(r2f$K!EHqV&
z_vlG2DcGs&eq?~(`EcI{wjk^S*S0-<SHN%cVGSDBD&Es>Adu97gU0VB&+V9Y%slh>
z;Ts_YaAx>bUEcr9+a1h6@hTExVhG#-K2&AWay)0$%+zQ^>}kH*VewDYYAxJVJ0>Cm
z)#OGA0S4Qp12i^m=9dT?(Keblb!#oPxnPo#5;+g|#)Uqd+#3rzuM<{`Fq<ueRX57L
z26;5aaBHS+&eY40i(6qWEuEUD)RD~5G=Fq%mwQ}}Sl-fZJawhz{jGggCDttHvP^MU
z65oll7;wL4dnD#*h<a>D#^p9^w&c+qLj=?9?wTUCs#<}ohhv6Cmq0&#;t9clrk~C#
zVO~&WIQ#t(_>Uq`_Fu13f|hmuiwXa)IrMQM)_W&9|E{8fEue#R8XmLoG5FDZ7BB}e
z0o*;)nr^JriQe^jeGpk17zW*j?daxq-3L>Neiea8Emyg0oggo*@RDT2#1jb`=ilGn
zu5BqeG%j`ezDx)8Ba;~|i<2>3;!fV6fhq1t#)MZ&%#FH*b1B!wyq7%_*n=-d{2P5w
z#VR`Ps5n+jYFcjdo_hNmmHhAjIxVkDtuzmzo&ISeEfmP<q(QoA`{jGSnnPbbBug{A
zA1r}%lb~fHFGxseQJeEr0N0k5Ab`yF{9{cyvHWAYGO(NttnlPsB1}oZ!_yhS#cqWA
zeftLuRy#cSGR<q6<E_CCB%L4X*f_P<EQLa!Asl#0!3RA=T2<FE#tuO=^RZNs#_Gz4
z@HgUEI|Y2)?geV#n9d~RWN=y?po<#Gs7e#k@|p+jsr?0a_2wY>Wc8*e!q|l6TVU@$
zZ87od(Fj*d2XyK7e^yXNXB)S3-k5p|VPRl&!UK5j+wM67@3HWj5-9mFS5{WoP3j7s
zmH_pcEoia_YN7MLyVJlAVc1aP=SaGjd*SPQK5`Y9YR(@l$Kx#Y#MxazaOB@@<E8J&
zk8v-!JCODoPo`K)z#0TF_tGKgnThzwy7F8ihE_iuhy0haLeK**<>f)#=nZ_aVe$Ie
zqg8F2%yD(w%(;Y$`Rul%ef048DdyBUCeC}cDLUWs(&ZZR>8Rc7@b=iO)@84c5b~)T
zJ;B=0zjGS7O{j{}wp<!$|0RT*sLy=m{G*u4E+&;RIaP*)nkJUO(>wKaW9)0Xp^4eL
z6KB9#AyEa_!WcG_tStFwu7p6pLe^jCtgIQW>>dtE#ML}g4=y`gKY9GwJ&Z0`cXq)(
zf4Rsh(!0!hJ!V)&EI9sj7@1;i%BHCsqH@)*_7W|Y*D9KE=_NN*6*vxdm>cV=<IotF
zm;6HOr&67OLl}L1#p)XTT_-jmuDSWp$;QG`hOcB1qL3LCM3L^ttH0beVm7#)>xUZd
zCyTAdMZwbRt=@!LNa#=$r&H;}{9+pfdSubqEZ->Pr>-m)uDQv=2U&8FFT^j-auiQ=
zrFIA10~6$|l$#m~7RSNHIVO1iBqTyk2OZIT;%Z7b=Hz>an`^Ud%CnO}`N0_OeEV+&
z8sjCFvByQ<<(1ie-2H<1Bqsd<tW?OGSM*cWpC`DcSo8v8U|UjBeHPeH8%?Jex<)Y-
z^qJO)1&<otA#=M_nLTvnjQww2)s}Aq*T?B^r{Z}XbW?jK27naIx<MKQVcf<)UL2@z
z%YfJMz@(3s(l%hqRa1pg;`HhnW+V{a(>+VfNEd>G@K3ZJNg0*M`N^4_0T|2IfnFe^
zsF3NyBl!|7*=Z61G+4!4?lmJJ^-Q=%6FAG2=<PgbC#Xnmc$d!tG8R#PF7>g+;>{F0
zGSMj8H}WB#!Qji7VhKYSI%=~}T74gyH_8F@7g>I}>WivR#00--<eT!;13xr3{s_7R
zU^ZwKO;Oq%DE~BBqbK`_5Kh-S0Vq(lD4tN)?h0?2or#n!#hc1|!DE`x(CqBWJ|7@J
zhM&pcl%S{0peL3~vC5Cyz-2B?u-Y1L?cNQB*uy-t*J07iMa^4V(TU%WR$NPa7?(LO
zz5Tg<AsrpJh<`D^n9r10?ynKu#Gi}5#N+vnuUj;){-vtwxVI7+agYd@c-wjz_yU2?
zrvyHkj$5!y9ssa&)_MshOy)l9&+%B)4~9n#K|ZU~F1c9%>XY1WsF3*2fSYWBGJ__$
ztT*kihY1s$dk3^{_xn=A!@%|oa-^3Zc~ckx5++ld$KTN3|Krb*viRlr;Upv4(7jMd
zd=_)8(_22To^XFBD_t+{#~s{hv@vXpYc2qHISuRXLj{#n2wRAO+%YHf*KN|_MRDPA
z!u+e3Wt(djBe!u$kwZH#j!zrq8mXo@Ds}gNI}3Pvkmn5l4tAqfjsac;B2hd_p!<52
z7P_%wx`lS9NSv6>Z}E4YHuDx|+DceW1tc+(tp7bhRzHBz#?TzOBm@~}YlH?j*WM?U
zVy`^*>%Hc{X%uu4LE3<}EM9T(%;1+@AwW#lhhheLqSy^5I>ui&gRIf)UtjIXRtV;f
z&MPHSsegRL)~wAFl8D%RJF-ahmApf_=gx{=EKTLZq6D6FqJ}g;By(qGLzsR`Q#@Xo
zH#Ei&P~cx$Y05#^ZKpv>j9n;mdk0tcj-{?Ub47_b0x^vH-EDKdp|bq24`5LcNAPja
zHMC=s5Tw=sL0(;CM$Q!3FX;Kl!$RWi)9+Invshrr`%7@GhzPessK5{gbhTV1=r(6t
zuT>l)h7AXQD>()|LHXmP(<f(kL}4^bbG&@PVv6*Wm9*Br#6`QX$-K#}?ct!&_Nd=K
zd7}YAi)~YkX!R!(vn-YXLGRfQW4BxuhA4{rr)GKEj*DZh4#4;nj;Xz+xcAs_UgV-8
zbG>E-F*VE9FvwWq+Oo{1d$kZDpCkRNm&81G9)W%(;*~l#q3;|`<YPWP*x;Z)_;=w4
zidS16y95(BzZ)(sH2!Iv4B&+f1*DCH8ZUy-FVlC%=G7Bpt9c4MI~w*&caC3V0!pm{
zSW4=q&Jw{3eq?2XgYv2hMZVa}uLmn0{33dVLF*IAXm@9AfoC<vepc2_SKGs)&ljd!
zTVKwUudZU<XWkEXEe8n8u77dINJ2Xd!o3_}vWR-=41U`D=ukx34P&In5CEBXUyGQS
zNWTyu8HcX#W{-9__YSeT9jqNwj}Xm5jaH*SJAZ-1kC#T2xS<Rg0w|%sq{7ddX=Ar~
zD3P*{8u`3c(7o_Of+B5}h^!>yFXKMi@Y6)5^e$RK#>QAfQ{AuwUsW(N<mg04-iF{4
z8HTdf2ZD(Fj1w(jno0!324lh5J7mMWbqh5OcJE(4>Dnk_bV(0+@3p*%dHA@yyZHnC
z=Gnv19k-4uHtZ{9b2Zaz`f~!jP~J7UrijgayH*iiYWedhY1~i__WnlMf^Xh!D7}9m
zT3&*$==th3p2g~ov=ZR!lx+D(C-IW<Khc=$6FM}Bp{?t1^grDoGO}TRb={1E6=RBx
z*hJPN<Rp^rO(|u&0KIz8!H?Z+H9WDChCQLM*+H=u3PZ%xNEs1q6Y}o~--2xQ^+bxX
z@f>>#Sjq^*#wdWB&<bNyq4@qb>@TQRbgVxkUK=3e%~KN-<mvBtQcbQ3gt`?NV*g#n
zLf;r2z!-`+yaxW1d0+4iaD-V%wdN`uwWbO~a$7&uRt4q>>4ttMHyUS_A518?Y)KtW
zy_6cpU(=AX82#GeMVOj3`~kc<e%wcrAoS&a7cyP+69;@rZ+E_?$n_SbGF2L%Oe?|f
zo}B-3#=mT7nVUpr^6FFpz<=3Ff708v{fXEWeS(c4heq$KL<6S&*Q}vWOP^d`KBE(2
z6gRP9tD1m*niFSn%Ds8_hx9~us;nwu4fFxfB*L(Qa7#t;Ba(d{3k?)Ghk$pB_I3Ez
zh8;$yB&I}>1Hcj83J?yAOLnFYV%*iGo4utw*y`m*1PuJP-x@C3=XSn6lX|-R)`WaW
z4h1xN?4!3o-cY$>+OKV~zPr70?V4YH=uUsQyAyM`wub}+na3PYYPtdNqQo2h0S3#>
z`G&eU)NOvd;fRkX#s;9~$fgJBJU%xv+KzVLTmA^YXYr$U=gp=d|HPr+zJc-HFxAbO
zln-}(?nsWy_OEVF(V?TI>;+a+JU)v4isP**t=>AOaAzV9ow4=@#`^JE`MrdK1FTF9
zQ^k_8g8|89Bzu`U+6JAZf0lq2WAz(|Bp>>jvbo1wasbK(AMxm}ukhc5^}+UZ)7*8W
zpPcA@pnF{B%3>z$O#ciTNN&E>XrUq@o^M65S)`idwwy_)%{S-Z4-@J4_Yv@QYXCTq
zYK{O*qxM^(MEr@0*{KmSK8_r-I~JT6i6%lTH0A%oZe1QQdis)4uXH{!O@x-3(0j;P
z+w)sDkI#~#we$!|jpcqIf*x4lb2zr#KX^TTc4L=)HuWp8J8L=h4mldO9CP<~Szuzn
zXr5c^H<`)fDa+lGa4&4d=Py!gs|b9TmyNn<BkYl*68_7vtJ-ETsyeRK?1elu;WG#G
z#BpNBg@1EdY`_1mud`?^CTGVvqS)iG5|?QJcK^Ka+V#9i*RQ|_-r`Eph{wvSHOcD*
zG1IHe=xWozka0POZ9FW%$=IDhvXh7}^1P~J=S$l&W!3GV?qZ{YL`R^;O>>sT>iFF$
zur|EW|BxxZGCQ_mpR)CFkZkXASCzc&fjs^<xcgmO+`2sMmJJZ9YwC?r)pm|cJxAMj
zy^0JDbc1*P4Jb$b45+q}9a8XJEbf1)eP6@R)+hwSe|XIQo6datTtN@aU1%e|<fjg=
zO2BJfI@yf5eGbzQb{q(P!ace7C9+qWxDa1IIE>?bp23K~wZm}!HMu|Aes<;kl?aP{
zvTU9lDUV7-bX;>;mwRc2l%HPCtl~*|iMbSZbN^16`X;gAIKtR`=8P2)c79|MOWqK2
za~_oNC>l$1=7|l~!%d~aPCD&eoI|BAjpGJgt{*%jguXoS6dyPCh}x-DMLM?y;&E8b
z=TB$8bR(zwI)j=&KDLGA>(B%F{7__J3H`^yo-W?=%0BAqj0uYrH^yR}WFXl3$xcM1
zNhJ?3w<Y|oPxg7oN^zst4ny4}#;zkinDcmJ*z-iN>wLq~-Dfw~*`+C7SEwz_f1cXq
z@P-}Rr<NUjY9!h>zB=Pd&L&@I-@lQu1bfy-c=Tpc^`_izG=@aH+b@8n@z8jhU;ah{
z)QdGb6De-fxyvM@Eq9J2zD-CLPlZdPSYvRz=VJCt2g^Fcns)bead-KVK37sl43@%=
zN~aGgBU!IVhWSdz`lgYEksG-@*^n??3Bd~RQT6{N+5YcAwHKNwwV^uCDIupx!%CSV
z=>I6jd3)B1W})rBbbAv5dm1JeoWSNlQP@>_%>Vf_wszi8$|H#Bq{(~ZVysu4q9b1V
zTR0rb&oZ;hM;^`RUE5gaz=~;UGN13No|wyxAhNTP>URBb>$-em+)Zw*U0Tj!{xa#N
z#e^5R+Js7<O~+MlEM-y?Gt%9D8sdLwDQN>ny~$}A?DT)R2*92M;F4X`>&yRL$<73G
zPX*VnTQ9ZyCPa2;p9p<!jYo}8TMkK{D+cSeb}%xC{aL+*2JSO?_oe2Q6o=g#CIJ7G
zvGV7(hP3D=OnJZS{N7gRe~*A_L)AHWPU<MU5>%IiS<DWLilTf1+u!PEEi|F9*7JJF
z|LvQ_;+oe9O_?M&YExZ#tm^FE(M)U}E@r~<Bah3=E6MIb`6^gPddOLv-}DnO&CJo0
zqac0GRfC$KcmPx)>v)eR?;#Y=F2Eymld3=fO-#DhFhWXVX6^(YA?8sE)>xB%Hs&-R
zOMfr+EGjjPK8OM-9x)<M|Bx4taO&wLW>1Y<P>hh4R~WnXK2MCEN~l|>pbSYK)E0sP
zL-KOX$o@`QiK>+^)Ir(DAL&h=<2_$QmjgE~i;x)WD}y0FqWfH*Fy<Ct8CD2o4~QOz
z<e_m<)M8lt8E;C~tiCsTV_QQ7EU$<{4^fL>mA;zK8m}FI8|@66U&Z3fsN2cE3;RAP
zs5SYlN<|8xZ;Sv?25E#QeM`dLLPO0<jTXJw^BZT&38EhhCj|HY>+brWo9sXEDBR;E
zhWqWlvZBzYg5mh(c|wR661rrP<mG@K(G_i8jFD|<k?u}E?-}x2PdIEpx`b;bN%RV&
zgTs?}IH|4-ZgnBA-Q{=<Ok_5KqSVn@TC*T$?33$H)?mA@KGiyhs;DUr%kARGxxZ1z
z-@~m9pWh1$>MOAP*{kCMOyHT@zWkxPO9HXKAknH(7c669A|~>@yPWUy(x(E__AFxA
z`2B5+2Vkm>Q=;Of0NwqCNdZxk?8zlf%UuK7s-?p$(oRnlrNurT_tz7&6>vc<Nz>?r
z4)<D=Q=I!UPgnGZ9(L_I4aKMOA+NA=)~9<v*nMz7T5D%0a~k7{V0>IE4+Ajf|KCju
zE<gdkuvD`-qw3ty;r3p$hI{58+O+Ys5XkI%IA~=}LfR~ERNw#7?Kf@taoi0VTr>;%
zvS#IguD{`Nr4Fgr9-7x*PQi99=M<p^M<T4CUPt}rovpP%;?bPSCW7mJH`2E>k9Xb9
zE=F9-OZF@-H#J*A^dcJZajhuU?Z@11EPl_a3uY4~S6{;My!72l!IV*x<8sDx9sp|U
z?|F66xq$H2is(i2Z<bM3$y&Nd^<V#o!2G{?%m8jCL_@eWkCLk%7F=y3k79`db@(q|
zl@9X6Aa=yZ1jc^^PVc@#*brNO!<D1|ks|-w7!Y{LeH0VPaml>`r|%WKYrb6<y6Tf>
zg#TIa9hVYp<rgLb#W>~X2h}GJ9Dpw(J}tOF&-L~i({IX({PhJhjyb~ygb8hfT<>|P
zuq+>YOjp8-$fmYDAPJKn9WWok=l7JoHy9JMZ_m@fb0i+#GrB@(|Jc9<EZShp&>xR8
z`+rBytQ+i_g~L)F;^Er!(dwOZ@SgQ(MgHlBB$e}m5XCNhBjRV7>7Tf#n%lX<y=JT+
z%XMFV#<y5ax|5t}AWCPuYrmghin$s}F8d7ylQG^ISg`Qb+8g^8;|PNTD-WMnSK6|9
zX*X7RmgZ{}tsyryulTax)oCUwc%YBiKTYV-hxJIH+8S7`mR1(G*GpwQDEON{CQXJS
zqJiEdYrL?QnP{^<j`1ZcKuC4}Z7Rcx0afFNJG<cmO`Cg6L?0J|aqejJqdAt_WnY4k
zC+glkskTj-h3NSvqX|lR9^m8vElR3l9tD<McFTq55~!l(o4r#R8M{E8B)BCWI?eLT
z5?Vxp{WesCJOigW5u^NpxCfhwvTKrA*hWh3S6&wxP;R^0Ut9yW6ljJ6`*DKTd0$UA
z1D#1yjFqL01Kz%Ow_H2n6A(1M4QsD|6}k1hSEq5yv_GM)TL(`8CHqGjdaUt&PyebK
z8+ov^keDw5c$TZkoEwrV<vAj$HT^8@!JPjCfeH0UWOq{!B$ioe$oB__Op})4?|ugM
zlq4>Di+y(V>^mLv#j)2jUr407fnp~{uHD(gITLf$>(`tkT%9T}vPnev^SIM8tdEu+
zdV)+<p3G~6Nf`BI^PtUdZj6W-50waZxJTVeKr;a}H!HTjrF~v*(44{|T4ReDF17!!
zrrqpa7p!hl-#k`20->9d5AMUCGV=;P_a?xQj!NCh7b_z+@6j6FdT|yH+|+-3e91w1
z9=cQfiMrGEQHi8UD`nU3RX164p<p{jwH3eF?KL5sbu9ajl^$(<g4hE(Dk^H4kjH^q
z`CH9mk>bHbW^s)~CKX%y8;Ns~3@$S%syJHlXEZ)|bT<FzTsnW9I11h!?l^$xLsU(D
z{SF%rI;OOiau?^O**J{=k@iTTeaA7zX9ythbw*0?<>e6=_={euwUBF09qlc)<KW-~
zc^&3GO1~!7NcDOtvymEYS5P|=SPi&2>mK08&u4?JR9~<ygL2dghk9j<*nAFS<<ivN
z%Vt`C-Y#;7r^xz*I`8WUhMYD@3_8E5@^$;p=ePGF82YF~CCZ?gt7u-3$Lq*@n)?Rq
z@ID!TLk_^}Jy%q{uC6opk@y&<AuqDJ&0wFhDupQN)Ov%T)k=w7<;I+6Uq?9W?tp?P
zJiLke|M2zJac#ZZ)^BkwS{#B)acFTXP@ohq#VxoODDDoWcncKQ7MD=mDFH%piUoIf
z3laiv`rG@Q_uhN%K7S=2R*)64)-#_u$M}w7r?VdHs?cV?7pN#ACvtOEY_hbXJHUhx
z(d|^U3LYFN`ojKq$#k*o?a42KH+N2XPZK#9X1Gx1Hc^^TU<C^L&9hh!yaK0fJ9zQG
zia8iSw*JlQ{^E-HM))?=4(nfRS$+4^_^Aay<?<J~x{tA?Ye<LTo`1mreq)=KZ(1P|
zU5*KZBT*v43j=UqNhRtxf4AliTRgw3qv!xJP|2~%YEpu93rd^Io9<)H{}$THbVxaT
z*aiW|lP-szGbVo+9kWNO`OFH^**_Hjh(IQ>*T3~8BKf`Wtm1KM@IwWAy!np*Qg1g(
zxLYm*#PsCjoLGr-a8xO9|4Un`)v7L182P?cbxb141V9t7wxgZA<%dVHr1C?+N#Nh5
z_W!ry{>N<BMFZ^ON2*9(BJl)aAC&-qm4^SosJ#BlO8-t`{sWT=dHX<m4#BVrG+~Wm
zlIM>C>t?$SX6g{)<-VZ8&HN9<sRH^JL4WwdFE;9OlCg(1@D4wwrLb0#rZ1pnMRo*p
zgXX@q0K$d7(n7f-5bfQ(>S?UGsXxsGG>3E)7YyjwV72i(C|+);S<W?{CP?$ZYx9x+
zP%QkHa~4Mz6Kz_vC`kwLk~1-(moCq#(zqS1&o^YK1y8^2oaiTxzLPP0e?D~_sR4T|
zrCwa_pzwX)&n6~T>n1a}m);WEc}g(a`#Cjw&1;=SaD5WwHHUel@LtA?TXtH^Q@;x?
zJa%IP8NkQx-JkX+4)k<UN%K)NM^krM{!FKoz2%A(Hb$qUYRoIlyYi%_Tkt(e%2<s)
zK3YW?_Gjmiow<!Stfy8tcXCDwXcFH38^3BT0|K&8B*w<@szVzJyKNwnb-pw+PNIpG
zrIeI}RAHV6Cx3!oWk-w5@UBEyvZMJ}=oKf*OzA`ecY<u+|FGKV{!N+tK8=DpflIw5
zpoK%6?BJVIZwyy0lEQ)N7F#;9AR?fzL!mSlc`;^f1CO$p{-Wl3HLOG>`&WwD+7VTh
z4tv`25rh4M4a3M%-a`(uGifgH7+_;y!83F0+5^^Rul=y}oBWNfXbyxm@nfekNlwIV
zo24do+NUEUDXqdM2PE@dUB6!EGMZAZ#C_+Ab{((%1a1|LsXm%9(QnvB{YYvrA=}CU
zI2Cups33Qd_s~R(cK-l;c1XS`C*aKY361I4&wMMa>h!u|Ee~pyG<v4iU#^f<>vyD6
zJ{fmU3EbFc{?xu5K^E)9#Pbfebdc~Dj=_Yi7m*MDeI@;)*?NIW^9JVHw|&)y^KKv7
z>L%iqXRB;g6%z18|4+tM+N<1M>r#OyIc*;Odf$1?JVUvbpo3pXf*4fpS<-Tq?Uco1
zOO7;hJQN}AUCz|BXceWjZ`{QPLzj|r<4~m9&VpR8bmhgQK7qc!Fhh;8_+y}~Dmq4D
zo3U|J*E>|E2Aj`pDHh7a8!T|~E(LR+eP6I0uNtBN{WQa7Pn7!$Gm@UJ`Yy~%FOC^q
z<}T2@;th4>A+&z~p}K_6kxLqN#{IY;n*nK)M^ho}Kh<k%Or(mcX$^{1P$6Jo)gqn|
ztex#h@pQgD&}mA8uBtytB`vKeA}tWuU@Cuc0K5+jE-fu%k|Y;>VNcn)_x6$3%)5W~
z@&L4qrlXwdLHF%Kua*<(I=A1s0slgGM%(<oW+K<cjFnj!GDs$MKn|o)mnF@y6uJ`I
z?FDd4q{f}6;MzUS{8iUK=UuI#F0AlGc3RGeM!^GNV6b@`4)tWj^Zf|?Hs0Y4v9k0y
zPz<y}+!u4%(5W((qUEyJnD;ju@Kaw(aUZG^FQPnkc2Ai=d!?mHhnYDnN0rsDgFd5L
z_&-bje_h3S(Q4}_w6Q5N%3DDqz&436J_;pFISpr`R<8q0_@2Z~g{e-4wdO-74T0zm
z^UN8lU-0ZxYTXwCss^!W5`Aa<x@Jr@=?s1Y%g-jz1sWxd49HsOeBcdpsk`=qdA32b
zn=(C2656f5ydi^P+O@0P@Is1JcPB2)$=cQ+5lXJa2v=9r97|ljJDJgtj$d+QG3agO
z^{DuVlVt4lx~r$$+7bPK1nl6MXZ@7l>!_#a&`*as114vm^}Xi>kYJIx<V3u45nmSR
z;I~`~q|I;)2drqwYiT~g44g$<x!e!OVXopw0BPUie4v3C7Cw&qmKI^92*_WRJ$BT(
z4Pg$i(Da3NIEM*!?#*CyVD9%!*W9@QNv%p~%H;j$al))gxA9*TA3O+M4i_^@M2;p)
zI!)K8Hb*0Xvm}*bWTCa&ic?)R1=cUAFKHt`_u^i@%vG8V*^h=;u10*7tUqe^BA3JV
zpoJ=L@zc3KOMR%;oLNyc^)&)|Kf-7NCOfz~&5x*|Op)zo+ve;`tqF_>zx)O7aFB-{
z(dYDNx?CJ>PiqhOHcebcW1_sc2m`HdU5y)I8%r^zSHJk~Ob4Ea8arbw(1h9ySLNzq
z>g1TxMuOOIJ4;J0A5dC36l$W{eO&f}Y74pZ`-i5Bbc%V-yQ9Hp*<i;Po5^5vXX{DM
zA@euN6g7`iB>mM}en`f!f)4|C6?uN#uS@`2dxDeQ0zH=__sY6L6055>i?9t3eOr)f
zk55B7_OMRIRl1b}%7M8DcS}@;A#=i$D=4%fKaXLL`({dZbNrTXe)kU>{zLjdPPcd+
zZ<anJ8t5G*lJxkuFZeIv!9T0s|J5J-Tkr3Uc1Xb{R*D2RI<s6?_sOjzKf<qpNNb&n
z!8&r!^1pwx9)=TnPy*hl-+snq5IJ(Wy+EaLHSWS+L+@rs$+AwAh|B2(uXiE21pURp
zpJ0WQ!Pz_l=*Xw$JoTZGPi=k#5ElwB?868ycGsTTN_k*iU{Ao?K6ACfc7MFs>;8gO
zu@DnVv`WK3oagGJt{2IvQUr%K5!vEcD(*D;$=p2K%uJe?dnK4&l&)?Q77>4fkObU+
zu}L02A)TBydCm3X{F@iPGI+*Ah-%BjIE9=0;1y<OPF3kB1Rc54^=e*Xwp1zM-Sttz
zSJNN*=7nJ|egDk8vA#+ZIJB>$JGJ)?q)oSqoU>F~Kd3h059omrm`zw%LIdL!!G;}#
zepfo7jzCsEK3rI2fuT&mQW4?y$@%(@R>n$%y)b#Zn*5MG2N$p=NUDd3hYNpi@+m};
z3+Z<;ktIvPoHtL0F$64_Q6&Ufx3{y1qbg>;y}8RWb=CK$NPVwMxsF<)d@<4BNa#de
z5YvEXyMA!Ivbt&?j6Zo8og0`!B-?GyAicql`hYH&=FteOCu<Fy#4yD4@|b)Y>d<v^
zI?}Xaar=RuvZAa|@M}m8X10j{T1Tm=j3;UH?d&<X`_PFFzfGxdtJg{BQzbc{G@r0Z
zwab$^x+VYMM5!H8?0NK6*ylG<EscV$up4r&J<%T%%KVL)F@U932F6<44OP#*m1-{4
zLlMouQ}o)Uy5e^R6spEQaTLKYcc87GudLAznO4t}c-Do0TStT31zYo}-7;j7Hr~_-
zc@aNGbE^eDCc!=)BGUAecmrJ)?>31KN+M!`zu8*^dBxJO4Y&3}YAn@V`e9ss$SUHu
zqm5K+fkutXDZ_Uv`_bcZ>M2qa|DeRZisPaXB%)^HnPLs0d~qEXCgq6y?zEBS$qK2|
z-6c59vKIZr>g9V0)w-sg*(IMFhcN#ad?J6cLVl*(gn9hcPWDM5F^kky5i07b&LKzM
zK&+XZVL7drCRwX;y9dyMbl6zplSXx__~WVSFECehl6=bS6Q|{{T&cFglUJVEotcoK
zgt(^2E+mo=qVdZ5l}5m%5|zJ(HB)qVHjDumvpjrvJ}92?j^GU;#uqx1d>1j4@Y1S>
zw^5(YT+)zz0HdEPF;Xu;w~!Zuq2|>6K>BIBeFh05Rc@7lo&w5T)(@3G!e2y>ZEO}?
zh`O!fTaZ#OSjQYNhFd?=hHrQpmar`a@D#DC+?SQG(RCW9c_<Q6rVY-N@?bb&?yYT3
z#Qxl%my8xod)4rfbLJ%VYHzc^z1fWmQwaU=mm=vcM66fxu=U=-uAC>S<C~h`l)&1`
z3ZS|qQX7kJyhRHRA7yx1j-p`x!4*m!hl_eRs&)5?d0@tB8kqD;QkvC%JN!W3k2@+H
z*0WfPZMDqlyYL(kq%Yxu;zx`>=KFqizW|)>VEH+STAP2W`x9E*zy)=`6XA}jm%<El
zIzDK_-~fzem>&TMC>K1)FOtlW!A~ifTAQkt0*Oq7wC;U8j^yge?7(dtcI9Wn<{vJy
zIigT10rtjSaFjSJ(GG(GA*{4Z?zsp1OOoGL+7h0($>9u4?L@rvTb)yapm@Bzbo(;B
z5C~B6%9ZudCj}g5$Kvr$bEtlAv`KtLgi<Eif}1J7{bh&Xb<UE?t5N2f?CMEw|2SF^
znit#0-T91|_iL+2H`-gT_NYFr!oAP}Kvba8nO^sKQI?zSp55Y=^LDo|brV`6_58r+
zvgkiaYoeV8s0oLniQt7XMlljm5l7T^RGMU^SzuKe@w$GPu`4=viFo0wV;u_LJFrhd
zMQQX%NXNEMrc=(UzkR|}$$*dn(uLYPeR3oazyd19_d3BFf0%Z(C<HddnxDu&{zKR(
z)P%?YQ*By6wEaqwAQ|S;8uFci;d1zSsbgYq${C)(f+69x@qSVO<mu$>9ivDyRe=)B
zVrWki2a3Gy!*ihSzR)o)7yuUIFBXvDyT`l3Yq2!w{E1z^P7u~QwYAjdI@T2NL^m;z
zrfDs~7NG9DI7Zs?5e?x6DM{Z)%~eWd4)2&z7}66yQXobv@2N$10~*yt%*KF4T{%mw
zNyuPZHPI9rmPh9%pET0w@)}a<sbhq=gg1)aQLpc~+yUm`v<n`yLlP{QoKLnys5}Hv
z_!+jw=(e8)`B9<YX2Hc&wC~H&E-DSMb@?8uma^XNLNAEj&#mQz*gm*#sA^AgHSWk8
zD%khm=O)3<rG+l9>DL9|jT&RidiFCLFM3i|=pDWea6&UF>bSq+#N0nmK^id{aiT|~
z&ugq|0|~ih;z%&}E-{^qd}I9A$$oo^wtk?{t&;q78Br_@(v9#Mn5NNh@t}COUaD@)
z2%~@c`uT$TvPXLsy)NJKC!<l{dnspf0=`6^-tx#SBD&1UbAT`$d*Ddk7UZ|*)f**z
ze(F7S<><4kmnhd7EiLLrdxqXF2V1^6tAlomJS)4Fa)VT5M>oC*Tn9xZxSz>!kMb@k
z2NoQx1>`mAd14=0?4MMV8Lb{^K#J}}ypAA)TkJ`)xdM1Gwr%i@(_8%W^ei_^1aAbf
zWR1&GBAE&ylUO^BFS^qh*p`@>$*8l@T;|<x?a`7g9o@!(B4Mh5YgOvl8`rt6A2oU=
zG(e>lSIA(b5y)?XywcE>DER?@QP3K0J%I+r%ofcWU>uQKjVus?*8AXjIkiMfq6QH7
z4qbcayn6X74JmRp9}#V^r*H6l7K83cem9C!{cE%@3*@zAf^OWNxS;;yjdvpCO#Ar&
zj)UUjQ;kIr?r;CT%ONVegC@$&O+6&eKGtT8=IWx`$X4b!C=mBjWk;?EGrf{|r1Ww>
zXl^K+k2h~3MuGeOC0RF6o|5ULF<~{WBM)GYc13-Ef$0lt)uZVXl7He2uRS1-i8H|?
zp=%>&xvs>+nc-&P^_frfhaRzDdHO3W+ahx;{?!!V0(KESf09+!5xrD^J=}%y?;^)R
z78fbc)cPNOIT~ogn1I_LVHu|sJ!zV${K(|+86w4k@r;-HtJZZpA~ig-jJJcx<dWP~
z!-yD~>f1nBX&)=jNW094v<u2t)b8k#5B32^UIWR|ygWT#`XxZeq*m#Xx|Xv$H`Qg*
zgwNc-(k}wj#2HG)1Wt|4zkB<puz;|LEe`fXV|?fqRfFcqB&q!S>E`!Ss!3^6ANpS)
z=Z#GK-xMLTW5-My++Rb~{%!HQlJ9<Kb=14Rp42#7i>5CuER+kf{i^zNr5K6c!a=Si
z*{l&#jmUnOvTb>$7q)+T1Wjze#Rjo=1RPyfWr;j>N_R0FPAP0n_z~yBy7t%Heg-fV
zHcTBHQ`X2&+eJl8h&B<NuN%Fxjr7D{bdac<;r*&w;^Md7k(ZXa9o+-F{t_S|HVxH0
zmWfEr`{rX7`lbANJ3SjPDj7GMIa5=CkkE$Hq4|U)Jp7`hpk@nq>RsMU{CIegBdz2Z
zpeKSSK@(6KrmctSW;;frYH*amxes6aT`cO&g~|w!)jTeXEu`%}+4ZAs&x$Q;Z9PqJ
z>S2-MG43Lb?53Fo@&~a$&NNW|C83P_hX{XIi3fj(PKE}xg*+jQ6P^l-RiO=|&6zN>
zr7hnpV7T9Ou**<Y2=V70#)K)+W^Hi^qJ&>Tm<M<;Er&e>c7V^YVEjVv1Y1Aj-r5le
zhc_uP@m8BfSVvp5Tn7dWy5=T9R!uTYQKTxCIASWoYLrZA>|Ov52xudc!AH%Pm;H?2
zLPq9Y$F=%vFA9*%Mtn3i;de$M*P%S1Our|gqXpxD?}N75T=5CfXU#*jP}yib^TE#*
z*u@9Z#!H_PO?I%@Uqx33cO!fbv!tjGG}z7r&L_mtKt6S(i|V-%UzRbSA)!hkJXl__
z(R5!2PVA8&(nuuu*$n9gUdfb_0Zl*EyrBKt_@qw72#IOrrFOKU+9}0!I3K9nG+5U|
zM)K^xVPcpjLjz+SG+D*CAY&jBAGr<ISN6qR3EOzZa5|KZ6-{t}H8yd(=_H%u;Ly}+
z+_%{4tb}})+c8$1W<7nLqPy=DS9wBemjF|fXO5E}&*Jw4=k$deW|OpI?f7JN@d06s
z=<>(rB{s6&mo}!s&8+|n=C?^%iy>#_Xvu0j;LxM&M5zrmSH5N<YRtNrv{%em^qWso
zNV6qSVb@;KEzu_D<HT$#OIjJ)glbz8Z@yb@ewUP6VcfoFW;KVTtu?E#z8#?HY#s(k
zdxR&p{G^xQvpt_}EgU_H28T9wj|RKa70qB2=8lG5b;R@v{-oHYJ|oQJ2i9SsTgI1h
zs4;1npv<6xJTVQ6;*Mhvr>nkvvZ7Rz2rch@dnsfP@^&AOhOcSzoxHTH*N+^Ob;|*?
zl4zVfXS`a3p*<I<%qby3_|LAf<8J!ZA!F2hT$dLKL6%g~u31>R;|~9auk=`rRZ%$S
zIJ<qyYUA4Uu@)^mJpXAo#YYR}<6sH0I>&xCHCqT@E&CaE=Mi92YtWdzgPGb;9dI_}
z4L@7C3u8f7k`6h>W$#QNk=f<#d~OB{yCsmJWwT|fk=13%u=)%O=ngU^MyGxzX^y#}
zgwB-~&yylVq<U~}J*4*IkT4roVAeP)*cR#B@V@44r-sx*?oyoMoi&`}bB7t?Q;<Oi
z?s*#hL{K}AIGcnQ^HnHHc2nOSyT*G<Qy(5>?C82i{bC=|>8&-_^2s+tYV|T`^zhV3
zu=OeOD`D(hHAP-NsI<<u5TJWP-KmKGCt$&u_<TRC3~26-`s@Hr!bO+2G-Y2%Gtc)X
zOKKpgX*A8CU#wzG(tSpToZPnH`YooHp-mvy*XTYf{)1A2tn|pxB;PKfDRmWW$;kP9
zPgpV$Ba3PB`-tC2Pg7jul0nn6iCX-)DcgB7VyHsQNNKTUZD0mxX^^96cB2-;LA=^R
zzdZ#x8+%vIj2ArVSrU!K_-s@f@*DO%-UacU?EoulEW6`eM{Njyn5;gL2(#wBKKXxW
z440cxL&4F65F{^~z|73d_xI%7^euCe$!y#SJTZw(au7W9_;Nk=T6aM%6~JFc#H9z=
zwtmI746o#qp3WSa-5*@9J$v`W?8BS3guQR1wTm<9OI}FJy#U-d6k(J?3k@?Q8BLG)
zi>3h%O|$(QVB<S!0TBMSj-=BOr~I!`3dq0iGdU4a$n~;6p;96s_1hb^xf(FiNRzag
zpB7SuMAae5-~Uhh0UI#ZKu3p+oX3#G47pI4_2-g8U&*<W)5`<}ERepwGJvK<R?msU
zU$f(d*7fps<|Y$lMT(3ktt{HiYa_krT~0q!sYw>1kA~QuuMNHLUpRTiU7+fgaYX9v
zOYsP3tfalCyu#gBb&AW3+@~q6jLKn0Y2|!QZmHWcE~ZJxX$h<@Mktn3UCfO@+vd0r
zM+Uj{dyLb#UoMkFL#`XCL^ln8%O6j_*9Z~9E2&HJ<Z0k}m3j3oweFz5Go0s1X1q?F
zE6h(DEuwh5@#YPFo~Iu916%F5_`)cpean^C$Mq>i2WOc^$d4=C6fLUY>&$(wF!2@S
z-h<bZnPG;Buk}gs+q;2p?76kv?&SS8=5`92dYTeCEW(pic%lAB+2JaL4x6CjgJi|W
zT<*oHC-yL3b?L?&mWW?vfYe&5Kb*>cn>|Qyf(!)+;{pcTzV2)DJ{eSD`FglhXNxXO
z<Y!LdafP2RsgHAahY2!XTST3qCs7ffte1!>7K8=bpjnkn6>?VqkfFr#sItf!<7p8&
zF$gD(&N_ys#$&BpO4=TM^j5bpG(^lu1?v_Ur1LCqZ`gr~o;0De9c!VQ<pMz`GTeWz
zvUds8#BvU2<ruVk?Pe$x*Wh%MetN{J3-vEanl-U43%A-gv$o*wud(UIRR23=M8!W?
z;TS2n7iyZXRHYni`3>ocKA1mOb<+a6<b`5DzKVhfHTV_zQ7X7QP|DmI+K-(0Z1wp%
z`sm+mQ(h~*=MHVprz#!<i?-`QsTdQEW$*`JnGT643)WyO(LW8(-+qV~t92ILFpkTd
z65Nej2LJlKYC^jmKZmt02AY$04h=*@!+I`jU=aBoePPb_7V7qS!*_U*>JulbmwAW?
zz7pUEjJlxAMu`vyzcUdyuYqMy&;6v0y9}i@YBGs_<yA;kc*8L^a__0=N{ov$S}Ai7
zP1VEx8SuJrqo6?K8(4huNVwPqJFR1#6)DvEr?37W8d+UrK(6^>wXD-WDtrasBR-HI
zhd(c%NKOno$pw8f>nLo6{~bMh&YuCUzz8~b+9Xv5E|s?tF<@eX*+6X%*SQYt+fc%Z
zns2`n2T3T9&8k(DDmMvHV~WI=y>C&yJhe#iQ{EHP&4!ex7$f7nQ`mi%jIEy1Bb%^a
zCL8B>&mK~HUw2zP_#RK-b=$aCBu;56iCx$r6K(K=o@i^k-zW)rBIC9Ep}eV!c+wI}
z*t`WJ1OBd<q#{12+(*vZRlufmVJsLvnz+b(bWTYmHA)t&rPhL47*KSOo{lvVibjv-
zby};F-oBVTW^mkWiTA-jr9ixn{4UM0g?+f=D7vZkP7ZLLzJN^d@`Y}ElX-0*cqQ|L
z_(jwnQ`~5YC_hp8-G$bhSDkInIQ`XU8*rmig3uB()^pTC{#PSuU}O}b{YO%6OfIlU
zDS^TSt1HN;`|HBCVL2l=>Hv;<$V~UcX-o==kxvyDWC4TVARMUx`I{^gq>Q}#ynT!N
zvu;n>MDVw12(n5Ij<i@cZnDE6A2C`k7mH0!W;A^)OI^~{pa%0|UxF)fyr5n}Szy7N
zb7k&K6@=Y{;GqopXWYML^F6@^sy6cPL?pqg===24;A&M>NDo+`RGshFWdnf2dJAb{
zr}_VhpTPrRwE10eb_I{-a1CL8Q~jCO6C~0dWd4^Ok2ExWJh^it%=)YKL$`UpSDDj`
zv~d4Tf%^{=yZviSCk0C!M{#lS^9K6H?QNUeFIHa~8qDZGWTd^O5zsih!w$Pz=fC!$
z=#Y_>F<t$~G9&<Nr!e1!iKEW#8rg&$xu<i%v`Kq;O<9?NJ&eq$y!-LKzrP_5N$f*2
z;!*ZdLh2dR9=*zvLe%~V&_M<D#YK)v{G6XR3_9WA;`)lb?`I6>5<*)-GBO`tB%14e
zCud}=B{02~(^3bj<EZz5;S&KFtn~_FOHqB_j|NnoUuWx~BdwqDjM1$M=K|~N5ysz3
zrg|n>ag~E=IYz4c<#!mYNXB0$vg;Xqlx{!9V&-W9Fh+j^HmN)hGY(HCGFte;uczjG
zD~bi4mC9g`uXT?*|5T9WKoW-b8T(ufyOlnS=+RiZaX4gz?PH89o~(x|UCK1RmfCpb
z_aH@orFUHxn*Cq4cNYtnz^fY>Jzc&$;ll8FZDGmdsDku-{ah`q;4Tt$aSSGjm`3)L
zZt!!;J-4T{GkvuN{8V=Md@HD0z*(zr@*O8Etr;c1mc(R*)z$KCATh8{VLLfMtNx)U
zCeMsM?T%C5Om@lUYv7DMv(4u%aXj9mj5zE?Eq$6RPx!R^J)Tr9Wk17+4G{0U^sVn!
zVYY1Usxcrh(S9f!iE{`;t6fuNdP}mu>cyO}ss{N2&Wv}@a;!Lu(S%-C$M#qXc>Ojh
z9|AntrC!F1ZnMOHYnO%pXJi2Hcl5#)1B=2-t-P|Fzh;7ArRTqLeo63&5?0qs@wC@s
zj4KE<oaPI9LwufT)7%QY0%@b4gWs-wWX0ao`Z?zK83`2lAF|TBB9trxPfsCf#HDtC
zav(Q1i$-A%olFod(peiBpeFb`mkRm{+SkGVQgF>+ovoh@WO{V2YOrooL4ST`V;L_y
z)el5wn^7V<4=`L>TLz2SI+*e@-*c<nKeM4vv_}pNe;ie6Ak{5N3%|hfPeb){5{fEq
z2r0&BBLD`U>8{_})3`dG@h=kCtn}Du4noR0AObEC1eFxITXji1LfTuCmT5|nMYGpv
z{66Ch_|%ngooG)d-Wy`k{n(@Jsg#l5L<Wa>J_*Od@2(_^)=Emk+B&(jI0eopj@Egv
zJaDiLoYd3d%7jr|WX6&>?wT`F?C%e0DTj0j1#@FQf3A&?)qF=CQs%hm(|8LCP2>2n
z;eme`Q<@LsECY*UX5DfDQ!iat1E+DYnp_~)9n;Bgk8FLH`g^3bBo8Dmr@XRVIbY+T
zc<g55-CtGj50kW-I)|E25l5k%U(l;Q9<Oi^Za~Cej$#+o3XWy6eu?Lw+R~2X^qcwI
zJsMxGp!-_rehko8FH~Ln#-SUiw(m`S(H#19Qjw8^T2vH_S%5B%dGZAWgbuqgrsH*E
zB6kWu9E(`m6vI0qKc$E_BSn}+zEegw<@Op&;Nb(@vzx?%BNzosN5VvbrPb1*w120F
z|6?Bf@TvQQ3l;%wNK8yjK-IM0)qZ3k9QJ#b1<w4JYxaHflooY*V@u;*%Og+R97W$Z
z?UTId%wp*{{P==0mqfuZ6CFdqFHM};fT7huE1vfa_&_IfJZ&A{w40m_{b1I3wDSQU
zmDfXcy*rL}$f3;s;k!~oS~-Y7Xj(Y|?}w~JXZ61Nr_Iu1_#!ya)QlF*cM~B3(-WFH
zVYk^|?>qJ}6f*}3{0<Q(bQ{sK8Y`4hn3$AZ{Zxli2l*QZ1qGJa@*T;$C6$m+I!|+n
z`m6XG-#tPjlpW`b{3`ha%>MD8D~$dc60B%%2M>J|$6uO6^|u?BW*%-&rsx)@%Bm^H
zU+WpE;StL1cbjfy771Z1)?t^UzY_p*T~kAvbc%~#$$LwgnaT`P`eCy1k54lKE0{6{
zf3|-BE+4-kILzP3ay=wK$qMmx&E)a8R0DpHASnL`)SxbZj%0RAuw}~Ujjp`Wp!ZUt
z-CHZCa+^(D2U+4^3CEJ`Qq{<N$}!@<-2OP$f&nc<SBZb{c&gg$Ar!T`8y_%_iJrZP
zrsH`hF+Ll;wQ2d&ccADZzgRrt(Z7^)k1<~6+0-B3ku`vq)@$LE)G1%1eNORHJcrkA
zuca{w3WIIMv91`)DS`e;X#Uly1imwZKpIB}q?+yD@UzE&{{9LB>~?0$>(#I98ii$L
z%D7)uU~pyeiszV9T_>Mi{9$%F*EK{MrbYUQ5?wDN&zDh%^no_Sa|kG7@CE012Smhq
zwAN_s#77_TO<A1T&P<%(@ziiQy*XaPr*PLmhV7qOAu<)N28Q$s{2dzBK>DlyOUVBJ
zR@dAWp&Cs<cVwg_B|%odN!ri)X?$+CzMXYFA_)Eb{6xJDDGBqsE=DD8uDc$2R^)%m
zWFi<qSzJLh|5{aNpB%z+J!z1+AwkGO0I7cYyQKd6;eT6M6`n{;bdcvr1YgBI$x^et
z``z@|P3z)6Oh|e0b?}!pOYsT~<4@<8+YJK%_k{rh_t!$@3Uvr)qnAU$Rx~4*P4-1p
zJk$jY2jpU|Pj@m$t)~m^AHef=4zb)V#n|U{nn_}_EWCAI)boWg&Q_mscm&s|$E=5i
zsudIqsSj+SoMvco_Q}$-yX1SnIu%-ty^gE`Z1{KV)zsqe`8ID4W4di@tgLzoS(Lx9
zD0i_M=o>PM3*#iCALP+MPXbPD537wL=ydRc6h|O1@)2;OaAs^3PbRn_($OncSZ~x}
zqIfXFxxV&eR2VI&Kw+|F#$C;ELcF@n*s-O!-cD`H3PY`DpImLzkhRnTb@pxbnK4&$
ze}kRaER>w5g0d)oLVupgznaz9%Q)8P<!49YZ_csgx^YfAEl<ho?a*iM$qg(`W24+h
zwthNH(Ee%0M!P(irPo2GMR$F%ZK6kS1U58yVkgGQzkYx3^6nwj{N@x)NSv3>)@t(i
zd^Bp|y2@1W(}ywJzZ%_G6nNXo9Rsg4)fvw3^R5)zx)My7%N#(;uQ#um^{XlpHAaAR
z)GwgGdaykMrVh{oF0U4DE*_U5kPewwH3+}L?p&IelxSmA%H0po<2vp%_4L@y9EEUZ
zz9_TJjoBl;<(2@i2B}VMKYI5;D^u9|JG}PGGkAKg04+G}kuXq$(!#ufr&IeDYkL|W
z0x=5+Ynf&i7%7tJ%oHGU=c*KVbrh&NP}kqnzvlCJr9R$X8fnis=;N{u#DQAC@*eN8
zkg0~}LK(F+d&pu58BdVSh5~QGINbV?c2n^|gPWD3ZoD~k4xav|OJ!g2SHMG;`Koh_
zLf^KJ|0_N2il!bjtjq3oYMT2Cgg1x;rcYoLV0kIFJ)6*75AP7@ol9YmrcHB~iSnH1
z|N9FQgYV@#S?anFM=pgYJU@wAtp1*7tRPaO$^+zMB=k3kH^~w>WPJ+Lm*qEo|C}&p
z@?_lsi8^OOy$!=PcoU#Zdb9$ZBq1?_^1lO+H}w=M3BP;O&J4fEd*n7lmA>61jfjdG
zoV5}Tyz{u+n^fxjds50U3sq#KC?53PpE*8YkA6dFD9YmE;*DTku9SaIPmkPxy-E$W
z5gln7*8m|s`2<eF=D*g!(MZD9lJ`pA0|LG!#PZL76!2HCjMOxf4zH}xuLN8?eLUty
z^ENil4v78dbjBPlx|f&gvGX2^JT1O`YxC?c|8ncRFInRy#4R^ACT{+IAkG#Qb{M|0
zYF5k%HNDsf?I`F+AswyQXqXjWi`RIJDNEkSrGpA-k6%@YOdvK-ZPC1@eYl64Ap5Oa
zH!n;UZhzn}C!+b=U)i<K@3F>>Qinf02G(t@$c<P2(Y3<^0o*}&rqjot`*fIt5#8!)
zYJG8glLF3zDS0N7d9vYH1e+8A_t4tH1y;m)ri{z-$@T_@?O1N#)N^gt2D^E@*?QZl
za-E9TW*7HjNG-x+2WeEBM$h1Pdr;;D>+<d#8GN6@V!8Ig=eBD0Y&*|Po&wAAu-xF&
zkDZk9y*k1(<R>da83*sQNyPM*jDNtVre$A@6OTti>4zJhFb#J6d1;b18j6D19rVNT
z4Coh8)SC7?&WHPD8V`*CG_JQh=1K_T09cL4=?vUuU8AN8{Rh~KcHW%;sV<SgQUTbl
zZOxkY8J#@f@FA{Op!y<M<k}ChBACISyZ+Qd5uP54FP(;I6J!v3WcRm$GY=~1W(?t1
z67@@LA3qNdRc9m!{rG8Z1W!COyzbhF7g=E#^P={<^rLZUhhtuyX;9L<08~`4S^lYA
zZm(*R4j`ltI%Ov~6zUW9$w|1__OIEP?g|Ronnph@7ieD&h6jBTSq{Re3A&=vosKJP
zH0>Fx>B5!L;GzNz^;;-(Qkj}N2X!Z039=E78-?W9k98cdUKO2<C7Ok)l@Eh+_iv<3
zeK&O4Z;u^)HiGkj=0_Y<AkS8dyN=G?%LjP6i9@)8j_%EBxZWA&)zQ}Ma!-n!<8V#g
zFSC`S2n`|W!h?HGam1GMa9Q2MZOF(&=%~=kRY{&l67gAeTQUzt*^-65lrZ(iNt~91
zrbz(|I-T)kFY(HJ`6CZaS*&NhVdtMM=m$ybzm*vjOX1Ehskc3=*Orx-w{Ht;d~W9`
z;jA@ogW>#cyx(g+KmQ8Xa8})stX@&JLV1#j>GVp^Y{KACm`7R~P;SV{p$Iq!Sa%X_
zNe?D*(TN$`8_yY+85<<NGfbIFSuBhzW@#ZwUM@uc?$+o2<71!OkC%Oo94*fktL<1C
zI6iaLKL4qJqelG3&I(s4Ahw4HLN-V?MAkzFCL1POqMRx$?SIvRN;Jn5{Mz-_Ez<q=
zW2DecJxBd7qv~j5Mq^X#?Q^GzD0eQ9>zdqc*YcRH1}dy~O2LC(KdJ-WK)18bi#K}w
z^$LzY(Mxjo_QTq$kBn(1EI>lQo6};1Bl+4%O?!mE1k%<VAUGXNLqn4WJPuv<QLB-G
zNgKwQnt6qpKvfSbk<*XmG)lW0?;yg*2dLe#waaK$TmcvS?B}dBJZ^uaFPmBF^rS%E
z&X?S@@SKWj(_U{Zvh!BvY=Tn-KkM%Ka!z@y+H@VT62{oMXc?~NS;sHajT(L_z3%L3
z;GFPunqc?-9Xm%3b?AsE0dz`~&TwH0)aW3t7!RjBQJY|Q@yAVT#aArhlj%RyoV#ED
zD(_s|Y0mT@dlaXV7c$+TJ$^eRGLDFQdRNgIow(y*;Sj>gCiM~=S1-WR?Zv_5((b{+
z^N16Ry$L1{`m90WVD5?FXjgL{;iHKbpy_;FBE3{wYC|i1x5=6w0hK0(#vUlHThDt3
zB-5ezK8w;vU@VF30l87K=yv?WyYesOJh{v3L$?Ms&e%JuDQSQq6P>M~L}3Uj=3$pt
z&$u1eaK+DUMEw{dBQ)@9P#^Hl{S7MYgb<2{7ki3?1SkjBD-R407t}pEXCMQ0x4E-o
z?zg$MpbyW!gdiqS;EMNRag^q<`gi_Ae0CB_;MkV}z!R3!QP=wJ{T>K-wXO7c5o;#h
z$MG3T03+W*wm8bhB0Eq?Xu8bwll|-_TzB*r6i*kbXnGSBQJcOilzZ~xIu}EiY`BlW
za5+hoe1kX3-1HvbsU|tHx9QtxZ#tI^<%S@x1oh5E(#?FYR{Hh}0;39BOFZ8>t|G;r
z+<m9g46yuKY<QIbqaCfV?no~xp^9pJmg;G4Olp}IsLdf_u9noU!xP`%a?2{N)8;h<
z)KeU_C&|(&I*w`?uGAFKJ4*~as@XMvH%w`mI}BcPJSYJU@&u}Ws)txn$g37V)Rd=x
z`cXDR>86Z@_t}c^EH!mQ;699i{M*FGTRVJ-l2~hQNp*&%j^d}$+!Aq;HKD9qmY{YU
ze740uQ8`UyHh24AX&=$F_w$xFWKV~Al2QEKQl%8d9DusD!(dZm=jc5~Oi+7a0tUJ>
zIY}OwON2Q<QD0w-L>tuuNMZk5e*FTM2k53nM*63czpID(f>Wt`zZJK5n{ej@NZ3&t
zM#cJbycyjI16i~jp=2R`_4l*>nR{&fyU0>NwFJ)2gZn64-u=l)@nDNHQ|V^=JEB9V
zr2n(FTK=t@RJwJ?H82h*OJ8>xu+P6j4vd`;^mz`aUcuN<NK&N8!!icv(CF#W-`C0{
z2H|z9%kxX$&yd6<GOZz8$r9LZl)H726~*7<T)V!Z9UfyZogmBs#a7_iv3&I4;}^))
z@o4Y4kDe!0=q<5d@TG`T{!h#L`)^|&K1&@qv*X}3CYk<CUz>DFBX#)nT8DaY&vujz
zZ5b{Ei*(eL(0>>mjeD?yIcavyrRI^|OKT1`P;}F4_d>RvfWGTK7^-NU*9jLBo+3J}
z_;M!uC?MD^!`Z!4OamIU$78d3`KCKaw$bxI_d%q(pdeJj`&e=svSs!XgqMs~bPP`V
z8iWECF?((5j=3H<+ii6rkTN+V<v!)g%TDb3wAyE{Dwv^=iHd!erU&+g<|qSqi|{cL
z|2s3q+0B>|B3aF@!+(IB-awS0LJT!8=pM)GPV&|38}<984^q*M@RsECpe^e2<S;7v
zu1I&G(Dr4zoQFGB3!K%5<qCnVK^+Gv%ok6kA<35v4%1jCUJa|KUL97^)3VDRy&N0}
zL}0e6tI}(jb^DpD9t$I_`cBo^518F+8Qidby<l+1XU$$o+`jt)#M<m8o^?k|y-Pm&
zAwAN9K?2&-!!MSJ4srn2T}iJvtXV0rbY^}`t3f(2%3{*fHNjE`Wp(dsE5D$$QJvgt
ze4`KEGxtw#v%T2Tw(DKKQ=)|iBLYOPI}@j0uZPFjws<2Z*iA$O=FWr79`J-GPrhux
z_+8)bcq*xDgYW+swx1PH%Lq?4o_{<nFx!p{K8t7bN=45<0mvLjs&qg2R@T-MBN0FM
zIS)<Cet0z<Flu2ZXgB+|Ijk_$Wd2zQ%Gbt?L2;FA73Eh1bUXK`o`;`4E0Dd_QiZC1
zc*6>8Ta{^C_<f-+`*vQ|&bjMXXw}^|oFTg?|2cL|hXj%u9S8<ViKo2E{VZ!D&fFpv
zvoGE2UtX7d$AQA-DGg5j!r~wi+kS@KE7VH_Lee*LA|oCsozmxN^v(<I#ZV3oJNvfZ
z&>O<QZ6@4%BIOv+81x;&l_S-z36Jk@E)fT93^LRSC6yqyLq>~Cx!PamPk1T#2_-1i
zDU{4DE7_+~v9ykeaG)}Ve=mZ`8cNk*g6BP%dl1wtWheZsh7q|Hr;KUyZt_MqqObaG
zP8l&gb<T1e*+<}@4BL@;@_vv3-Ao!NJ~TZQDRknB=$-SL;SIl{=V4jC9pam)GHMdu
zUu<!wahaW+y{;8kH48>Gv_}m?jn59z_+2`mXA!N16H0fVZw<MfEK4CtV*)OB$n0ik
z55%44GYX0!$AQE72FK<=xbVtMg&yBB8=PtJ@W+cFSdtImr=}vn3x)AZbZ^$=uGR~A
za*~px$dR(2NjF7S&ys_4!mY})kawYsk-hhP$<g2oyI_MilDU%mn`y2-;<r7w=+_>-
z$m0U&a39|{l9>s)ss}je{<<Qc6U|G;VR1HwLC<10m8vYEWmAgcvJ&b5l0?UZ@8Ul}
zK9W3;Kj4UGB*DZ;9Slm=Kg-eX4yy21{-BZG5Y9It^$h0snaWQZ88EG7@dv`5L25F-
z3mlr&L@!NEMVxIwkmcfXNOd)D@QLBXcLAs8dx!R_|JpU+{{4yY5@c$7u@t7Qz(1zO
ze~ullAQ6#8#E(7=q|$d62mI~H{X>+cHD7p<bkv$;{oB0=#~Y)>h5*Esp6Rc1i&b2n
zx;xa$xpV8=pGb`HXb|7;V5-U^HivGu%22))1_AyT`gNW&m~fql#?z#3hLIUHCx4*s
zZ|2U?d9qg{Gjjrzix~QK(HM>K4Znk^>fu}+c#e<j!reAol`FK+OD;(kkTvGM36=L*
za6gwX6`GJ^Rs;L1tZ8#=3FX5kjQRRu0EvFf6Q?vH$e_VO@Oz+4l@ty%a=P;}cw4P~
zW>064V<0J2#I}h1$N84=R6e>dM{j>ETCIR2=?}7|iM=Ha&3KD>-Opj$s+-Jsfe(Lh
z%qk8nho8~hujEOX_nWv_O$aQ(7A#g9{Uy<JBk|vB8f^`*y1oFGF#U0%YaLsZt@@F4
zF4jB=VEywE5Gn!Ks~;v=_^jW2pNtQ+|J1K{;@LyNNe#-8q<!=`5emqEk?7#N!PAPx
z!W<esq@8KKs?K1|n3|9o*Q-QK3&k0!9Z;ktxpk3T&qRV${GX{Sy?qtnPKoGm>K3OG
zkgNyrJZU?BDUMjtd(TWe)E^KlB7I9>jxDFJ{e+Gk#~l6elhUvHXK@4DL@Z1x-8^Vs
zH_X9?gz`QD4HJ8THzK!h{t8e~;0i-;H&%9=dN9;|dP_bn7~&XzKd+J5kJ$R5hJK`U
zGsKkxYK-dkaAsRRX^aZLe;Rflu}dB1$a8h8<K*(>u5$t>vyIPk86j~a<KP%b<%=9r
z)g$N#COVcECiZyL2$lhP9fTDjg4vb0uS>cfve0~+`;~SZE>W;5%W83pds9AsI#I=q
z{<XMwKYzKf0S-mz?92*CRS-imzuul@e5-yyKz3W_66O8-iwkbr`V46+&x?-eEwNIa
z&!s}tU9#K<KBM@r72x>zck_lhzj(MeWXCtH!@Kx;-f}$(Y~LRhydSZ{I9hq*+=-r*
zbuDn)k7M{C5`B^_MY?y-Et-B*>AxXgqzxta#>rW}!6ZFij=bXJ3dnCyae3s*i6y2B
z#^ZVP3R%Lo9kaXrC<KTY_|o%gc4%XU$4BYMklw-CrVn008SBq0dV4w)iM-R9iz{{L
z;kSrP&fq)m8^Ta7`aV|PfDGrcgt<iZn&3W2q0ZxlUL{VPf}0o${72UWEP&;vQm(}1
zCC<X!z;ic<_fpsTq=MJ}rMNol>m=Kp7&^a4*~hBcmTx&)>(OM6CF?mNraiWX+GUaN
zjpxLkNzpZuBw3#E&5Pt`##_VJpBg6oI9dr@#KC+)>nhb7X`BB72p3oHmg#C>%*Qot
z9Bv!^g0_(NDqG8kB*)bM8v{-F6f$E(<|QHG0l_N^({>QT1&FZcPX?##3NT{Ab?sJ7
z;E``QTHgc)=RKhb-Tc_N7~@KtFt&0Mp`hozmVZGW^g)_?Ee<8CvFk24Z#D2P$Kwju
zcOeM<&M2VskYm3uX9#?@uhfCF{~+4jNZ6XGret^d&f~6>X5~1qGkpFg>u-%k0y3+I
zEgDAZEl>W6REig!9RGw^j^4YWcLN5`9ywo{1!7zzj0dallcK?@jV?}MB}Jg7?+O0U
zp#iWoWNjLUh7<dXipQCE>Tmrc-|P=BJ4Ah~yC1UA;CA=c9)8-eAkULW#MAQVCAa2w
zGANA;4><3kB5c}?k=E{_js^t2CKB)X^OUQw;|!2mMoah=rESQFzl|zRKJi^?AQk9a
zUS`znV?o4LO!CdAeM7%(3p25c?pF5`U!`>(@dr&YkW4p{ZyKd%%G_~>D{XWVuJ92^
z&yaYiHXj`4jZW_ON9Y#Bex0NzR?}~Urf9C?%X4>i!{x^#g9q0EpA{dY9t*ewgBzbL
z*!$ioz6bz%WUd;&A(TV+&U@qW0M8THbs&kB$f^(icw8gOvYZmjcSXVII)<JdTTmkU
zVaulr@^a3?o$0~3&w~8YyI>`}`YaE$-tD=m@TW^42N`GH;W&1{{{pcuQ(CDKcE<v%
zxw>S-J=~@}%;tacIBgc4efQpK#&&heLf+%9J3Ham!-&M19Ehv`IdRC!@!M|R5Ln5H
z#nhV00H-+s)-|9#D(kTM!Q<{4i0Z}bG50OP)DHt$u5d<soy=h+$wTI)F10;qnh4G!
z6YeGXlq8C-%~oDfgtyQ_XJPv5UkkK}OiAMbm-!-FmsE%P*8T8TL42KsKU2MV!8{%^
z4RCS|S`}yY5VxH!&75zioOFrP)B64q02-@qb&F-!D;>_@tOTO?$0A`HQ>nz-D6@h|
z8EN+Mp%BFREBSdqC|6tM>9+~I+X^%KKMw?Y>cDAKwfRTuC>vE>IA15oy}OKA*k=nY
zi@w!OPAHKexoh|3{9AB;SJlpB?E)&iCU1{%JDHC+k6%&59qWAD<^17;t4yd{@siyw
z+P_NpM-q!QI|XG+s2~n9Sp4(Gteoh*w^)=3X{_1@v1ZX(>Wp(jeku<H`@{LNKR=}u
z;ITF-)VoTHu>JAa-{%_f2(D-T1v-L@E&mV?hId_q4i&j;Hkzk00VbIOp49%vzQSMo
zL3u&=5;!O~_s)Kreml<X2w2ul?EY>V{@Dtg5*BerdOFvgSSuVTK4UF@ubP?AfNMCZ
zI0<T1&~DLnQ?s8KjQh=Fm@H5hpJuE2ejJ_Kal)tihw+ACeS{<TtVOi|E_D@yKet0k
zWZ0jhW^&i~^~^Erg+gCrW}}xPONz40{3QxA#&s>o*0V!0*{o`{IZtNthq>~Xc%t<K
z*^aHH!_CERPo0yinhxv67z>C$#i*tHT~@pa4$Wea8>la%xzp)Ntjb8wZvOZ0FK^8t
zb#sKM3o$_kg0p;#X$-|2Y2&P)A_p;Q-JBGpo?eoLt^n>d(C#Tv5D6j3r->+LviBw*
zTJ%XW7|7Z5p3$_C_x5auK@T0n(jUt>g!_3usi8C5X-hc2C(7bcANTw7=jZu~B#5Fi
zcL-9TqID|wJ}jW++~=phz{eISd|E-$oI5%pcc~E7s)2*vNiyeoIP6)kjkM+4jls3I
zTZ4*kW1(#`f~;D2VI(brN#lhcy+dS5JUAB2o2mlFPTUe06UM)dwTzWNIT2^sDHQWN
z=xA~@3_t53gCM&-vH9eE44TzXs_l4#0pf{aX0h4ts_)nTM!e(=1`$DdFNfL>&E&W(
zjkIRTdVhj3YPmluc%la?jLYzBl6Bm{^7SI_zrL!$zJ=vKK4%=e)DANt-dE)|P}fvS
zav{8fC7EgI#0Ll73rM-KA#6fBtPrSEg|tEuM-&APJ&mfYrR$vA<*S_Q7LzHs7MAN_
zZ*istx7=2TSkQt57&DbI5l+=|J#`Gi6Q5P7Xm136xNQ+fVQi5^S-&k#Lub`;RE;q<
zFvc-PijA#5y|5<o!w?u4VhL|o6&xrb`jBCjpSbx}?se=l^A+3xs?80Y<1piQF5N+w
zqDad%f>#wcX6VZD*Bl_1&KFY1;GCw68}oRlh8v^8=!Ue@{XkZn#{X=M<Np!AW>|Hl
zAlO0!+gT_eG?_?PDm!&KsHyN6*(ezt^sxcfZOM;})Gx;IP+{<NOOIdf#&j?1CPho>
zD9}#Pq4;~7u+IGWF_g-Tr=xva_r%{)R=80T*?iGnh<)PqL0+&2Z`~(LIg$}u{bC1q
zC=r$Bn+<5R6kiFL$@e>&i(%Rb^YD%m-A1V%HERa#yeG+!47KY$UyJ0L3hwjx&F+N3
z3pwLJT9UzlwVeH#!szeggB&dHZ@>~V&1BG#iBk>FZPH>7^uzB;jHjxdc-{`ofMi-|
z0mk)O+DAQJ_Ui7;ZgL>x<!uiSqyht~g>L<A)2KP`V^(jF%bIDw)N9R-)pPi1SpXFE
zaP_UN&$Bjn{b-r<F!w>BMU}Rgaiyvn59GUacx^NG)Je^nN1B|wv5GloC?Mo{HHxMd
z)u6e!=ZI?Q!JN60xzviZZJJaxozb$VH{Z<8)S8nsqiQtGE8BB6+9DchG}uqNqFT-l
zOxwZr0-FwOcE>uPO#v2o3%=0ZDg`1e@wd2)=b&oW!h$Pr^P9M1DB5Jw_TbNC(VK>r
zHwqUo6MO-;Q5kMfm@hAjX^PbKRU7K+D(&RslhH|`dP;dj*KENxOr^-fF)J+E^-wP%
zCr&6$kw^Luj<$}!kXweG<IGSs^eI*d9lsa|^c2+8yBslh7DArCpig<~W{G(apL{Lw
z+6YT{$K+P@Mfl}t>qpA@bXmtu)XEzB?TtZ83VjRD23qJ-1^y<XsF_PL=o?5%=pFIl
z%t#MWU|?J;X%8e_WcoYUYDhtU-r$vgk6$ha8%kSM2R6`_Ow^JCarE>1PsGqLu|Dqw
zXbwvzJ5jy+_B(on7+>#ac<6bpO`0(q{8Y(n+ZTVOg+83S`21|^5|zDlbS3m~o8{O9
zqTmGSkvRUym*oq^5q+tFCGyco%E_$67YZO>><1@|Nnv@y#gN<IyGLNcvtF-Va|r7Z
z*r~*yfrV*JOO)yDBC*cOzPZ`FZTyQ2bUO?}34knRxeP6#@s6c-NNm`*qr_%55&Zm%
zn9#08Fbtd{aRCy7mSI3mLx%*8rtBlg=zi^fEg?pci4eN&uIa@=xk6q>@WA;OXz=&S
z!i`FOue41lB-SlJ%tiGhF!nv;eY*7Q&#TI&hK6VpO|}}<C;mav4Ri6$5o~spBl#<;
z_)C{hC}=kFU%+0gyi2cY;Z0X+cN(+8r*=RAW9+z<F;Sx3U4F2ysQIZA-7TH69=En5
zH^Ai*p*XhI&clYMB1N#sYE)8a#^)>1;rGjK4+GWz1tvjG@3qXbeq1PNqgzsqbQiAs
zS1!92Oit>HO;c}z_ey{i--XRzl+M?Ek9FSUt~%V#wEf2kj!PA$ZEeIxC~Zd1&{5iG
zFb<Dr91j|*mrV4(e_`Wbc=LAW(cgBImo_0bCaCn{At=$-TX@v`+9x;A*4Bo{TQ$;J
zpDFb=e=A>2S!dmGc~P$B$Xn+fTe3ZF+jVZVau0o1i0361H%ue^_XdBiL5&8s(xmxC
zEg;m+x;?~pO?5wfxb5svpBy$XO8>ITC^11mV$^fIS(#?p&tD;hP@EcHZUL~g=kg(<
zER^N&)6RI7d&-diuR6S4&vDu5{VW)JMAc{d=T5q;$Lk;f7c%M|RK>TzD#Z4Gn0pJa
zHl8<bv@I>J!M(V<6sN`A-GjTk7I$~oQk>upC1`OcK!F0q0~B|->G$`(_uN0>o;hbv
zW;dJ6>^%F(=aE4P^GX3dI$0zxU4^NR@PhpOC=|mc8;?J^e41_Ep%(g%s-Mx~8lgC^
zF<daWi{pvkG;#g6aC%@NoYX1SC&FQ-JrHi8TD|b)l^5Lc+m9UgCcA0gB;e#d$zquB
z?gU3pd5z#Hx*?;`Alw+(D&aI_eM378B>9wbzDUSx7hkLK!hzn+7k}zk`1df#>}kfX
zNaRSP4*oLqQ%d8txGI_ToTpHs)#C59btkd!UvRmt9lqiQCJPM|^!T$g8%xeTY|YG`
z#`B<C&BBWBE;uZqpa_Yp<KJ9f9<(iID4)grmHf`@G1Hy+;YzSYVGJ}<pC2!P%On=`
zONdqbMhGfJ8cz*GC~Cm6c;N1teZ(Tts+0l8eR0c2@_(#tc1&bNn|&llU|pm6#9Q(j
zEG@gZ-Q#z&&ACr_BgZw7_`aOw_`?8kFGE<*#4gU!az(;}W>t|<cqco=ji>U%ZJMEc
zMa{db@2oquAl-<biSf6S#LHr(w1ylfl8E@Xe`VK!EEW)y!cECs+C|lRBfmJ$zgwEy
zD2CIeF1vEpzbxn@CJrK1Pq%c4UQkaCDWj15Ugnz)8m5&H^{IMeLC;gAmo?W05Mq|c
z5~;<b3ZrjCde@vk?(yro<$k@)p)S;_hK{W?9#v>nB0Ea=eVsmjK4>{_uae7qA9&q&
zXw4I#nF2B-%`_XUw1dsTMob@I+Xy-<$PU}RNfg2HoX}jb6Ff}?-^lpK3Hw==FgzRA
zsn$|t<ng_^eIH2;B-dNU_v<zXu5Hg8^+T>RG=r;8fr10*&)0g}Z!OjvLB#G{+SsjV
z<ZMsB8SEA+^-^D6EVF`4G151;bg%0M@T|4k@T!*W-&B|C1IY{h$@LNS2kUYA%uAaL
z-?9?iPKy%sxzP>(g!YsJTEg-S$Jvp_{ilTO(~H!>)GTHmH}saBcb7KzFFa;Ti{m=S
zK8f<0br(w$Ai|Pa-G{i%j@j(mH8SQ`E2IX3ajy!9`$HDB<LrS#SkxJ5Ul~Y!928Ur
z($!)qWwnRLZi&OZnZ{LssI$;LXMmMh2DFkz!UN`>i!fWGjA;XHfllY%Q7q?`D1N1v
zEYPA|8wM!u@{-w)m3>hSh`n<vddt;a5w!y3c)OeZ_qKf2L}9)LOC7a+Q*^*gyC(~G
zjV8+KNraiB^Dlg)T+K+Yx!DmhUtF+KLf^{+N(5EpcAuTJGxTWd><2}3kV~3dlAA>Q
zfHnrTn?(>HvJNW0y-9tu{n09ssEZ$A0TN`9Ij96XS%?Agvxpq@gvy!{dj|c`nqr;8
zo0?+EO}(RwR<yMrM4y76^5khXG^!sKh;GTN&EtWT4A;b`-Z^FU>|nRgcqzgj`81g^
zv;ESWxcHCdo5jR^iIY;8>c%e|FOoQ`&GsMG$%JPbHSO$UfEK`+r6ut$$90=*UfPXI
zc|Buwh+y7y(KjQj1JAP<-r>^OPEEJwL!s<Hq~WcT`laHxry5JBTm~T^rWwN3$=uR`
zuN+q}rnX@bE%&FPZYJM9Z`|+CpBHQ8wdO^KP$b8iw=0q0g7z5#ht3%*yG`V#4GG}T
zHQE86rI5Sd%~#K+C4+W_jr_IdjGIN|P;}wFcW0|&#3!BZl3i1zGcGR_tQU$Db=GzB
zcqd(+Qknh2>?|KMV!M<v1mK$kh<iM<wn!%>9XxCq^gK&W{I0~-;0@bB%hJAIoX%wf
zm2=}omYTG^7OPb;0?+uvK_j>Q)>cjvemn6ipI#+1TdeLyG7tnyePVf^o}2YC6p2im
z^}q94uk|44wb;dT)KhkV1lyp4;gjWESGMDsZT9nT)!*&-FkJxWQD-8?R^1Py@XB-V
zJ5w<xrK$@Iy+d2e1@hSw#{y}9)d<+Z#Lp}tR|w-(EBDDhyELL9nqg6eT)lD-g*js?
zXgDz)_`#5*@a5A6hOb%c+|8EtCu<6F-mA~;2%UPQ^0r^gVeGy2<ist`NCaE4dCd$8
zanvD}&c5{X;y&hlk9~7G6rvwF>#(C)U_+dElu+C3FZyn#am1As+EcT8-<)ay@k@#d
z_hKuyYeSzYlp%bZ4x{x?4&Ue9{nb|XMhRG<!TTD7t-GzW1SbHc`C{vpFBqk_XW`-V
z0nKC`aaKEqIbJ)Q8!_I^vm9G1t>+a=Iz+W&bykj9QHO6`bWVIp*1dj#0Z!!1=jTIn
zUcpadMUvl(g{Z6uTLXI%3|djnPQRW{eu4?eRBgg!A@!diSx72enXSue>+Kt1*1h0?
zYtYvOl<~SuA^s>MD<O`vEv2iTyBw>fai8(KSs}m7a0iE5j0e)z5fUe-ZI-=<aA)A{
z!8~%P7c}^A62W?2sxT2><R0`Pu2A|Mb<O|fa~#IAM>vaE7$TM^W1x5XT^|R9j-yqq
zLve$_3xcd=wSlna{CTp@<q>J27K=Pm>P@-Tl#cCjRQ`E11Rp<oD3Q#K-^qVB_}fha
z1Q$P4lC}Pu{ev*xis1R7AxE)}`Egi&RR0|Q+ipGoPo@o!rG%wh1yw~>t5weNJW|l#
zj!(v|41>hu@2EOJ%a0;MV^Q7(iuJd*l$9%H4({)mN!NXNduFzxHCPIwe9%w-sSfXq
z2QH!!hV`>e93?30(Ki)F`sb$5wb%kWCU&d--a9H~-SWQ6xbkXL$gx;5j8xcS8D5^<
zcap~!uJJ#`e#B|CWcEG{$-cQ^%rkbi8DHFreP?7wL^?9$PO^LS7dN^gORlgV%$8<#
zTtnnvKCtuW1>$c1eRU1^F#cw7K&ZkVs6kJ=wrXl=!d>3QXZki>|GqCw()=BM>kyOn
z#J5;D3VSR{iKx3)nYLTdZlrI8=&1N5nWrAFfZ3YOX=1wF#(-r>hH78X<XxU0q$*Co
zg{>88N1Xo?<5Z<Ds5ToID`f?{AM^ZpP&)isyHYJH;JRvizBcfE4nVt}Oj&W`2y9U?
zu5b9eu|55LU4h~F;tpr!Pkr^@u!HPxPJ<0VW0HlAB@30PVr+k-orjJWM|OQcNd{_{
zQ|;6US#BkIwOA&QunjeLIa>g2z3cW*BOVx!LM$w5Ix!JhKcS+6{#THRGz9s*aXc}S
zUSJJv=wvMBf7fHD0j(tG=SYZ1NVtf-*${}%p+3z&;-M6w>y?508}`5Ny(%LD|GNW5
zRbT#p_R(Jha(lWizEq=I{OudfooJKKrR8CbzhQUaGm+2bp60K%-;YTgW>N<2&R+!J
z#(+*viFqq-jE-zF!~$NY%%mrqT<-4fIEk^pN0LN?0=@nG<gIqrC^dm}w6qtW{K&7A
z81I8%!Hh_NbK61L!73~&tXiouiT5XRw0WK*i1M^AJrdTOE);<NW<MzvPL5!}TgDPX
z_h06e&ooaO66_mtcki}1MHs;ce_S^(>#_Ea6JTK~TT}UhS1Wz2kdC~44!kZ{x&S0R
z9Do8!<syG|-gEK%k<&z~1#oMK=R(lu$ID~MTgjWu8d?d<25^Crx$>Ld&hs5}XqqA~
zxzd`USplqgtSGH;X`Qu9y9fDde#Z^DP7zFT#-$KMe<N{Y-pX>p8%S%4;tFZPqy-GS
zzb6<tL}ZU+XY$2tZnUQ0PU{t|d@smWEpACqwpss0gzn;AB_I3V-``tF1D2)yUpJOz
zu0!U;-~R5mKXoC>_2v1Y8;6zve$^$2q%?IZ{75J+Z7TH0fH`9-+#el}CLa#_kc7Gr
zfeBUoGMi_nR2t(j>eWcK%hQ3`NC-o@P+;r+lFnwV$trQtc^h=Ax;1+KH>p7xyq*ut
z49g`R;Qdfnm&omnh>!0<_G3ji|1pnF+5FUnOw<xm_Ty)?i*~%Av%AJVuc1t}TdbKC
zom;Az9g`bXv~(iDvN|Z}mG|XUh=p>oCr{W9Pq@=d+|*uU6&srYD_Oz4U4j5mLU5KE
zjjBoY9tkV%w>dbJ`kiJN$2;ncWIu~1ny1lzPA4pK@Lxq*h%{I*yXX^udggP4Hs{*{
zK)pt{S+~OQYxtlWZeW}hKpE>%YgqgPk^teS!H4#(t=(64$6wxuP=DR`2neNW)s0uB
z_VFyy88*XvgB<`jP_$WaJZvq|qMP`Rv907Leh5st*X%0n)NCp2)+ptHb<_EDO#xc2
zw60pzO23(vN!U2h$N9_}xPv(&n!>npn)rY?R;pkbBsb<iS-`g=X<VYfurQ=OmpI@g
z;Z%bh`?iiND!&_cge>Y1Ny1xZK5@R)d0Ug|0^zxA8N%gy<H!VE;UTlfmeG9)5%MZG
z%ECm9>F6W>|I=-d62Py_PsAn9OZ?+j94I0Zz&cUpRxE&Vv@hmCrcicSB!I6q*O4?G
zY%#}AK${<$wh#2&PU3#-e_9E7UZ0vul##ogCy^fUvxPX5keHvkLQgDCsex7_?fGG~
zEIV4rWWt@5{jf?M6;mEU-bGV9Q_qi_+Wfbt9Cc+sh9g{b<K^4^wDV)rNGjce-5y&f
ze5PvkIrmfAeNtU`qlrIFU3kE9wu3?Ja`1f|YR`Cuf?nwBT^^cvr)`vB&qH9(;#3h6
z(A!@^Mi;AzY)Guo3=4)*0QhAVY`L;-aD4B5e$nF2n-YrDbsyCkGjd~x1=ixjNC6r9
z+*1nVEOtJN^uL_aDU&fG-|Az5Uxa|0ogR3TIXvJV1oXc*=c!W@%i)+e%GA)8(1;%!
zKhcy83T3ShFU1faUzwo%8JAn1_hCi$c7wDipyW(YE4GavQ?r@^4}H>z!0+V1%^s_f
zpuSSdm6Mfv6bfje3M7sVi2{m2(}21IQrjWB3DF4aLA11?w7>n%_Km9qnF6Y+Lz9oN
z*kQ5{ENcW|Yu;A$=|a$1Wn@eoOac=z!Ai#9J^a(nBnuQE3NVOAv>KF|gfq53Cl(P$
zc!xn0G?|C3MQy1FoTidZdoFz=yQYIE7$4rl*Ij>fXQk3oZn00Hzebzp5JV5{P}VEn
zJ$w;^7!!y=4wWGyy)Sbs_ZOI8Jn)NcpcZgkb30acxPvi$Kn=h%eRSXvqmF+CSwYu|
zE;oQ&0;9S$ZRe^vXjhvD+P%bOw}%M=8)+VlkEP}rRdwE94OaZ1An=w!5I1;8VGjd|
z<^!vzhDdVvto_YR)I9De1#aLlT8Dq2^fbJoJ{iO!=q)0Ndyc0cCrfaAbU%C|=oj!s
z>~wNUn0<j~w4p-}{TbZ~iaCvR)Xy>X{iQ--4{J~-DMWolK~h9NRUNi8?&X~joi}b*
z<gfU)la6mw$4`=aRBSYFi;7q)8hZt$PHW?71qCh}UDGd1_p=iSTtRQ;6dgw_I9!!!
z{?zLMLY)qZ&Cd<8(9@Y=!*yW=NSlIWUE)wx4Y?aw-G-XX#b4zOXV$9T9o3#njr_v7
z_K^FLk`QnoGsI3c^<IlYShWbKOR#zJ?!@yRNWz|$L0r7BxuR;}E{xh&7W(V@C}}Vp
zG~WVpdJXM$dkJ2r3lBgMq`d|AeX4T-ina$v$*<jPylv(&4vrLq{A=X<R`@rAJ&Ut9
ztL&^XG#v1w^~Qy_XBOF>J5@d=l7x57<7h=qMYJymi(hY#^G|+dydsYMVOGyhsKUz8
z7!8(9i=U=Z&1A~JaDz=q9umtzw9B|x!n~R{6-ro6QXOCCDb+3D&k#Xj9IMwng_u^W
zO_DygH#{n1HdYruy8=>)xh(Q3Wy>!N9(|GK2i&UY40*zWOGq^pBQaY`ocq#Y%EUlG
zyGREHzP4XG-=;F4wR(+8$g_1Qb;P~{Ewedv9*z&Px%b?7VzV)|0bj?8K?B?@+U!99
zm1^scAXI2yDC=2<K4Lh6R}OhIud!DXneF{Xx>7*({j<>`iR)+-(E5K%{P@ZWO+MJD
zd{eGwIazHQ`dHHJV#oXk&IMJx&eg)lqo&vK3u=%>SgWDDiC!KDZC+I@Swe&Xbcsy>
zJUa5#%JYN#%a9~TW?3>U$T|m4bGwiV`puo>^7Z-?sd73<5$`#EE3nEBGVf$l`m%JY
zgCmT{Z>wE?$@!iJ{^0K#HkvJdksD78M){nT4^`)9&ag%OfCb&<=r+16_itnZzfS0?
z27^GL6DR0ka@Q^U@&bvc#><~0c#Q)QoDYpQ6hYCh?H2L?ukJ+ASS_(3e?9grp10Si
z+Q~&uX5(Q??8IDYL3>kXd*Xekh1~gs)rkeL=QMm_bPakw;xSm|&8SxgxeD@$-XVMw
zm<VB!?a}KOqYl(e_t^oY|NXIrmyvi92W@s74*BNtd&~lGqY2gL#<e;#8bB@m>FuqI
z_&D!h4x-AxrO>Z47?m`imebzqs(YtOeR9SO9sKJRg{qO-g4s$b+62N^wbVXHG`Ok)
z+=z`;9k(#PsYTTrP2u`990__{E~mfrLK3j$J}FHkI_^}-ejD?W93IHdS@bo~V+@SO
zff0~YY7xMS9Q&O`#l{UkogPMa0jwK0VsGI{0j*VX{=fwj^XXE7-tZ&sJ$yyC0<X`Z
zJpl)h+@fSptO-*d@>Z5)26cGz(JZ7|<*Tn2B@|LM^<i~NaP8gt9;1=b4clZli8!sX
z#|~*u3kb_z%E7Z$;?8BLkLN8cqXuT|uc!%ayruT_ADoM>Uq_P>ZW+cs+dI&&6_#Cq
zXL+mWwAC2%fn-Ip1)|QmoHqEm&-Cj)fO-*QVUUPt5{P_dQ@jTdH0QSwQ9H@{v|@oy
zrWz68I)us0@A3iT3@YVNiVNxrLL72eaCumu$m8!IwqR<Bd@i*EwFoA<E?ztPOmi!&
z`r_QerrmFaEVzB{XuVrJF=PtQT%I7dp`h2kEej~$^{1b^)A^Xe>72r2P0kG`kvbs@
ziKg~w6ijdOph`-jw&z{2rLHAPp|+p#JExFXVgJT)2HYseIqgl2phE+K1L0=E-;`MU
zQ9!8!ErCsp=eX1-IL{z##fG>s9o(8<a(U5VEee((3U=LNb30!PaZ|liYVTunU&GJ3
z{7(4_^;*#>|63V=^hL4B;v<l)#D|ypFht@|XvRl3tK!IX<kV{15W07{in&v!wXH><
zG+(8)y~NF;7yT*&+#I;hPvvm#4?IYJM)5L~88(3As*Kpv)FXSj3nZFqqMm29K3A*w
z@CmMmuV0%3&$1TYRx25ozA|~uv|CFG740U%wsj*^1g@=1k^*?i@iY`6tr$urYV%tV
z5j}+0_3~@h8i@v}2X;;(Frhs!)~zgr_txo0jqC?#r#G^NTr>DN5{AHvj%6ZtNvKPx
z4?k{9qv2lI0qaBAeg`D?M)|1F!ZzO9bit3_;HA%F5`1;t8#N@Q08&JOzB{xa7fB>P
zUFEzT$jB3;wD^Va-Ce>`k4^o?Kqv4QIuiBC4)$@e*e-mt5$!KQ?))=pc_vXkZpQcy
zI;af9siDFJ*i6_*4wJ;&F!r2C#wUp=*y45$hoFQ7R^n1aUV~3aBnL`dmN!EIN6lnX
zrmb6qty+5*d|r<N8FBV#10EwLXU>UXhNrn<hF#ud25lY4f;>Rc=AI9scos<=CI}md
zCtIbLqiIc;N=AI4Oe0GrzT?3lKX2SNrJAoVcbXuQIRL)QMv2^$x_>mNLx_-Yred6W
zER5m!x<l+T`?C#KA-Ou0AgyDMc(faRLY!^llcDy<F&EL=O9YFdw17vWlEYukFW9Wd
zJ+JnIy&kE>n$74A<X=<ObBipe`9Eio*OGtL8{*npm3QjyYl7FkX!~aW3;UkSwm(v{
z5Cup_5yk>*`Mo=l$hqR<2aEiY5k2oxBM!`F>q?zX;-^UL+1sa0^b*U@paY}3kKRn@
zuS<&H7p6}#2VU&uXP81|+6cKj1VV1OPHC+{8;B%b9{HQ4y}s^*0%*LEI|HQz+-_!S
zOy{|D+GbN3;@$m(`x`a{H@1mWdri)_vmTlQO$eWyr}sF?R@7Qqi1GvAjVYm``f`Qz
z$>Z5P0_sRzsF>pOv&9D~vM5aT-XA%H2+-}~lPaHZB;0`76wwIpwr;rdNoRwX@A2=J
zhOpaxPv6%Wbbk$F4+3~nxpS<eg{j?;;bu|8nByn<iga90?d31kV=|nD?UA(!n60qp
z`H(=)Vn3<1tt<oKQOx+hQ5%c-3=$Qc>jTO2?kDzZIMLJrJatn%5DWYIJgA$;cq1nl
zQ|WUJQC|6dDN|4c;f8BhLwCz-lls(x#?s(anoRJr*q#vFt{6)WXB>X`i2^*u-Feok
z0lY}Pj+He!?U#I%AptIywkR*(HUl1`t=-Fm|L;g%+d#VH_KVe+H*9QBomV<Y`z?VJ
zUxpZjV!9!K%VIDY_VPw2pPj#SptaWN$7%<j(Q~1vg&E>vO`n<0?}btyn`|7Q&N{hR
z9?L<6J&>aQ?#E9Vt*=JPYuhJ(Yyl+t`e5WP*Gcm!j`-x4KBs-r$STBah5w(Haws?#
z3L28J>Wc=Y%A~Z&K?>(<<rfcXgr>9l>d0^O4RTAS`~HS9qsuIAi9wDKVQMQ1@cY?+
zTBc{<SJ1Ab;U=fEoT>MliZ{_E<gJwd@6YN%>Q0rsk8Yxrt5F_Txafp{R51bZpp#SZ
zz|JgPxWl-#NLMDcedGwnmbKSqb@=mFRvf59{iO}v$XdIfG@^bs`A2(>IbGNP{U=Oa
zW=bp+0$&9#syGb-gaY%Jp>%bLDtujdONQntFaAJ55rJ6s<@z6o4@wVt|0*Y85ii^C
zQ)Sx7J%Tiq&412EV<<n2-q6BpPKN|HdHvqfMtVfvyJbuC6{g+kpA0&99^Xz__n@$s
z3<HJ#pVsGBW)q<ZF5oDlCCX*n4=v;q?TsCZt#Mx6Lyy^;0Y}JtZ5>>_*@so>db%G!
zkK#0;wOb>OY%rM=5b6%Zyv$_XCcJ)z?XdbOpmmGOa%VOa1=OrJIP%DAtA)jXbo*mC
zh}UGJ(ZS$XtA?WkKSJ03H674P9&nSi%Fh8Yr9*mzKQ(;B*UI1m`R=f$JbDQEyMGw3
zE#G=5t$w;5?cg$4x|KbBY-JgaVOeWfC}JeK%98?H;-d!b)UETR9BJl>cH=d%SnUkw
zkBdP_D4?545aJ(unyxyDgklh!S7o5n8*!Tdh_9YtQy#Wt7_;3Hya%ZH2{h`F=eH})
zhh(kF3)0CE0ib{rcWVpQ80o27m$M%l))u1)vX^+pR+H~4790T3GcxgXRJ|;a`v($7
zXvv8@xc>!@_Gt0*l%=@y-q;uO*|D#=H*M#C7yQjfjZx?_(TkpOqz2$UW{ZHrIODb7
z05=}1BJwu&8@*&KV^%|;A-{u97o0C;(;Bk%<VzD4JE>L!ifhCWp+?+B{K{aoV-{6r
zWlJ=m@yLr$XmXbt@z{kGRg)I0LHAJEKmPVCh?M)M$WTZSFQs`Io=|L`oC*zwg?+~@
zWP<9h*_Dp0Be^@4msS<<%EB~M?YJ`<dyF;p=Ce5OgF8&+Ut~opye#&eFNllsyT8vE
zn(hV_(?RmE0&C*|B)WWWbUonv7Z>5<xom;QyT{I^;9bpaUWo17JD<+!@Y)kYRAy~V
zIPJn8fADr^Vg~))17Qr|%R-ed8jqc(c(MT_a80-~Ebw~l<0ko#Dxb2Hdv-%KN*7Mg
z>y4fE-_aLp&e^LEBV84mLUa*Md}GyvEPm<o6!yfC#0Q47`Z3d@9wVy%EGU@wLmw!~
znHB1gRSI~|Y|>du(`io@h8MJ}f+XnvzO#_5KfDKBeb&M=fSY`gY#h6M_KEr`M;BrJ
zW=4}k2EEz;g5Pj~eBq57n9f;Mfxj$Ncb4%BbHFFeP!fd(k{u3jakGWOb)wj!l&~SV
z00nOm#A^g?v11xT5O=afu<A_issd4Uj(PtuNa@KVyoV50EOu(d;Lv|!_+8{%Yau0s
zCa-02Wm!n=@bTqx%U~EB>5R3t@B~_x#J(9aYUU@gt`DRQIpx_P{65~#1O1D@ZS$D)
ztf<|<(3$-hEKzc%14vuma(ZDRgO_0OX^}t{p+F3ZpKczOKml>sQbhX9Xg4k%-Q4+i
zH%@0+@dvHO@1F4`ZYEOuGKhjKq0j4^;t=J0)(cgtdO@ME*fo|v-|T(nTcoX31n|pA
zIzsX5^Gw)5qO8K5-vOS7oz8B(k#5Hm$-0V=HJosVpVeRor77{*F&5Rlr7jCE1Zf$F
zoaXjOCh_NLPp|g54_{uT?q{Z5rBgt+8=WzcH~2~EtgKUlza$?;FN-gK<+oe8;g;q+
zp9g~?HKrqgm$$P+Lxyo@rHNG9Q~&trt1oyXgpl3_g6oFC8#%l46Ea$W=%58JoQN?Z
z*4FPHo~uh^{~BD;Y{FiTcQ)IFIP9bNL#@7_-l;sYFV<q<4&RL3SDbV~SMdEFN_Fwi
z?Nc3qX@pvMV}D9m599EgUHogRFAAUOdcaq3qJ(IS`vVpD<vIX%oO{L>MM}chL%O44
z?>0*vOcB6j&TH_!M(dyFHyR|H$>t6bF_YsaF6PGE8;gmJUB=1~{e$gFi_#p((*_C8
z@D(+z;&`}&HY|S>P3uFv_~8Zr%<+aq${qI~7Oi+Ih`eLVmnOx~1A;{HA={v0#jbY*
z?$bC;Y;EFO6r><<6I-K=_Q*Df<G@DcUA|LR$|zll%Fq$@F%qcz7fz^<lo@z$)w-wl
zQ?xHN(c*;kh$VBz$eh<lWvmIbPvSvMDOou(x}Sb_d@hZkwsX58)y7Lb+^&oY6z)s{
zfR(Cc<bmVyQ%8w9A#_uT>`o?Tt3mL8m^2YObV{30yw3k#shN+bA!T!!4;DU@Zb|5#
z^aP|9Uu%=Lr-G*Ic)~Mo-tY--O7}&C7pHS@Ij)-<I=_AdZVq)^H|L4C-SP|G3!k`h
z=YLN}f}S{Tfi&3wp8J2Ktauu$i1H21z{_HLH65xwVm1pLy6+!HGF4N?JU7k3BFf;Y
zuWrqKxg+?LD24{+)2aBA#4o|V!sTVw?w*fVdM`Nb3fY_`8UrHjUdkHLFzPS`Te@0r
z6unuBNCX?NugyN$0|pJ!=(WNIg^6Kk<d-(3jWlpM>e^9)NS_?rS_5Fh0fEYIOD|1V
znF2{+h!)_R9`k`gKNrk(9Nwm1GN8#-u$a!E8@EK9=-)y#b8P)*D$O8#sGv|VHbYTR
z4d1sd&WESwdI#P5`s`zzfi{}unT|&d|DNb^)V8I=tcQe4obRXYWdN_ml6u?Hh{{MM
z{kfNm0C^g4{=>rOQnf5B?o{n)eR3x-m%RtDK9(>VeBYAPrN(i!x<Ja`EH`tWKU_Vy
za?jpWhgiD5b9b*JuQs{fOH)roZhD7s62N)1%=Bg74sg^q`pr|MxyWxI45jPyh?dS+
z)!+d9_L=GfC~)T8IyBD5<4%pBRHa`H<ZK&W{(4n%NfDNh2SWn6$3aNiUeeyw9><-D
zR?}nyL-%hBL=;b#cA=)qm*@sd-Qn#!aI3=^ZEw7secyOxMs}z3`LVV}b_qL$?VYlE
z9e1LA`XtD=vKi4e60k5;`(b?jJB8P=t4piw>5}B5Yf`7jir{+aWonnVME0H8h<<y}
z8Dn0-uMxNnxhF<4(bi&4O(qxp8-A!w7tVU8qb$oH+t%Bj%+LXcU!^v)2XPc(&+<sQ
z77!-KV_?#{#zOro{_`l;7o8H{bTRJ9DoYj>4!c&2upUlZ&Y$LZTGHxL+7c*)jp@6Z
zO~)L_L0-1;84k!lI4zM+%orz_$ACXl8=e9W(|XW~`ary>1@V-@iQ+F$k~X=O-N>01
z%j5KZW?)!EL<mZ*FlUp-$ykL-CjnA;n4<f4Xpn0=gPa;3qiF1XCKhi4OW-?3LN9Py
zx(D#ZULYR>MZrjeG=eqterTbBaCdf|)*_;ZHe)evhM$t+mQXh&5Q;K)p7+HfRi#tU
zLx;pJ4xKJuc1gYA$;S(aWF@*VQL{l@)zjQfBd0<+`$nR9f$3{@auwtCqWgJs+7tq|
zXFtWsp?_S-gfFV>vog1Xj)sSRNSN?)16p$;szhvt<l)6M^PvGEFi5|w1+<vl<xwfK
z7OYNEU?5J>iRt7dkSh_Ci=vO3NBK|Mqg9~zVfW;)ImDA*QLWo7s{~HF2UIX1<Bole
zyN@mM+<@x*F#o+wp3V$k!3nkV9nFYu1fdcZ^?)!eU)JIp1#;Mu5Y$6xQ$}SgzBOHt
z=l4Cf{f6z#fLU!Ot)fddHb#39p_Gw$mCP0d&p7@yNBzn=pCjwRiN(FA9&lr7dNn3j
z(OZY%bkNM_OR!3M7+aaCXQI^2pLtzR3srPi%Gf*$)}*#t*FB*ZZ~dq`Epb8%b!j3j
z7VISH+|aUs_{3;YGt7qrEFj@>6-4V#D|P62t6q`?3ho9?R^i1v^qtN*apn0hzsE1N
zSYn5$Jv~KqYNdBc^w@8K`0_h4Q^R-FYD&FE$x`WuA+RW&kH|N+<KdG;`IDV1?><B}
z_^s@@Q&=V3P`QJsyU8Q?G2~rX!$5s3kj-Z<<lO5n%jqtq(@2)ENwI%`U9~KO{jSz_
zO{YKc&yXI+B6|l?iv@id64y4?i~uJJouy&D*rrpdng>nC^zMwX#^k;1nnnHSCa7YM
z#f9zIyJf(*>{9nPJ`2xrY)zKbOf|fXVnwWpm`r`T*Sgxlm4<wId`&HP1>MOJ=8alA
zCdKjnPzwmuzvlbSlwM2|-pkQ`D38e6=oI-+{ho9_CS!_xlqIpe_4&PHP%B(bI$wU~
zBKM?uPnc2UBr}GYvihvtli<iSGc*km*z`XHTtpfY_j>$;A#MGd=n}uvfULwe`$-?=
zaloxafc%30o@2dJM?XZ0xNEi}c^c*;xJCXCl7`tGh>y}p`YD5v0YTxQS7Y$Y-+we%
z|38c8|7#iivrB>m|7Y*~J8la9yV^$za}*dsa*Z$~U-oz!(6nU1mh0hHXmZ8V=?%uT
z_8^-j7CTN?e1^FD^Z5=EokDvWVB&@mLXZYSmc(q#2a~-?iCR`@LzZtd19F>f42^wS
zQ=tTe_}4?Jcj(bwWP+U<zhbVQrqr>f_@OsleYFHKuqna<sp;M>IwqW*3KCL?;pwP`
zed8L0tx=<mNJFgsHT>+38ral(&V;Ro&ueFXLj$(Ft!G*oPb|?yrdBPowAe5e3I}n#
z!>#%w>9h}oxfHPen@|GGb;1UXXL}H@h7>l#pw`#^chIsz?UM}tA}>>%%y)LlPZ&M>
zw4-wcUyf7L4${#w84`_q4m|ZWi03nxa;1*-FD4w#!0-QzX{4~eg9KVqBl(d!aP69-
zEI@VN4qaG&?jN>LDb@FhyCffYeAATib6gfr0fOzd5V2I~(GJp1R)PG@G=M}?`Mf&t
z3RN;gzkRHv&PkThsdjC8Ed-JJeP(j{New(3q=c56*_jyOcvzzU25&^%Lqdn1Al0o+
zCHFMco_2a(Sfazkva7L5tzRnn2O8oVp*<SC+2%c=3C5?ULpH)pIjsr+-Y&>$8eh)q
z4{fLcR*S%^<UAn|S2#W4P@(x$4RIdZGP#>Bx%>OM8(8m%OSitvOk}iz0G=;?=kl0C
zHig%YK_nT)k70Q314Kdq!&Uw~*_!jO)54Kz#0DK))$J2;`r{HEu<472lo`L^r)UL8
zIlV+-W$KB_!?D6Wy+<QxzdtM?grNre+vVqaluCQ0ZFXOt@;>W||A2y<PgG&gC`fBW
zv5p>JGHUcjb!zAtKdB-4p*&}0vSsGKn&2$fjd$5Ol#@eixa%EWKC!*3_i@yI%E6eJ
z-t${G830&*^>|X?o~&jZ&uHW8v7}m8C?<bBr~hn$z0qXv_)b7;I&AnAeK&jk$qMET
zF|q7boUQXXhzu}D0qyrerFL~WIDVwva3SX-fC6kOq<{Jo5G$<kM0e_9v1l9^h6nXd
ztXu-6P^%N3Uy=QuiN*i?%uU{NE7iRfGk^%vW53Az{t%O07l6o(1ZjgcL^g}vWMA}Z
z9OR)fgah9R*X!n8tdymY8^u=Us@zHz+eLaTe?Uid-5o7Uko_)ZpZhg3aLbjYE(2Gv
zr*8*C4j8gJiwm0BZr)@@)1S9hC3*~lKd|$-zsulnPS3CdJ{%ie>BS_{i9E`=<*+K^
ztC^{MccADMQs1yA*tXBpSZkn65SC@Y&WFp;&F!}~L^J<>1|V*zJI$GLucSm;3naLD
z#E}3Bv}sYB9Y+Pyt5IXuX1=9)SS*vr5ND1mGLt^$bsTuenZLFBY?jgvTcjJOk5Ktc
z)?)q4De^I17EJJqDR5IT=>0Q1s*)FY<BN|H(t|32t!TQHC(rA|o1RoN6ZQsF#`wh%
z)bCgo27+`CzY0Ht3&QN1PyZwlQonb5;P@#ky4S>RyJ1`*(ui;2kXp%%jpQewg+Msx
z&XIEE-h7xx?vSW@^Jf7`?*o&1#xT5sEZz-r%0MAu%gp9%oc83BLkfx_2AV2T*PB!~
zDFwug#$){E#EB0aQ@w0)OWNO1d&n&OEN2)>!;j{#d^`=K!)C`fe!nt8^V1}knF?@O
zZW79O1TaW*_kM$UIUeCOrQQ2U9`uQ|enx%aRR=M-5WNBmh;5<`ftLO`!cjvLMepUN
z2*;ZCYY4eaT#G*N4&{8VR&m+5T{V}|UC3HRAqH16!wD`mv0odL{$cwDa4o+GGUYc!
z1-Yrv2f-`EWXX*La@Gh(7C(l-kIEc33ppqd-cWOwq0|H_Q8hr?Fq%2%Jl&O;9h=LZ
zpW-#Q6tW0scT~J4kWF<jtR;bL(Pd{iwN^hn{gTsGtOy8Aho!q2=j#YKHEQJEecA&%
zF7wdY>bHb+sDDahDGvWqA7SzZr%Pw1MA<CLN93e9orO4H=bzTW^q)srNgAxApzw!o
z?Rb|f$ISR|Gqn*VYxbZ{G=W|?R=$FN8c}ky02O66#5tNBmm}^LQ2e=BAxeTBlLq^}
z1n0ZdXv8G%Oa(qt^8|9tVei}tKVu|v++x%-bFmE>?@B~VZ@KPwA?61N`B-;i@%u7Y
zK@pVU$iMF@n+{bVTBDygQ-Ai_Q?tl(J7l0ed><)NpYE<;2QfT2%nbYv>NJ^)l{J7c
zhvrKYuKPZGfd!vAN`iUMWV4MLLE0Z0$uC4@Fx5e$byUsB+S2vF53}brSXwDHi{U*f
zoP0Ni`IvkOVS?!E2pJORAA~hvmPC!-Ww&*E1O8d0gNrx}-+m*^+x+>KrFP~_LOTTx
zsjC?;$Nprp+WdHVDvLGDu*QV;Du^$1bAZfTgTTWQO(GLHTcu9h4Rv(}N!-h01iH@!
zvqJ@@VmL36x`#uM*4){V)=UveZ~0}x8<>)m%o=g536^GtA5%?b74-CxTK29+8tHmw
zJb~JJyx6%6sZJZMAFJ#M6u<=$A=FSLpt^~qu3N^_H}-Ka=9h`wx1^3$!(L9G!KXVW
zbpT#NYnIYW!Q&Kk#mv&fhAe+c{OgDGy~3s<rGYY$^CPg)UCdOI7MaoHB<FES^XU)#
zVfr*4IM-$7;E8N5pn%<1DR7<kXOwh><Kp>;@`K)LeyKhl8Ndw*YN)2WHibR%jTg))
zg9lrl?@bavD5ns9K*o`HdAbiWyr?un!DY<jetuhHKxv$lq%0P&d5`lmi35A7ZWA?f
z<n&MpVqa(|xF?<c_5=i({QCO&AfF)KXMgPrla~#1fZbTrkxz1soPi-^$J&s8fHmH=
z`MC-rt3it-81<Zl|218dn8J<|`GWD{7qtd2I72F(@8_3#Kan)DBD7fT=exh<sba%2
zn%f?-$OB2)H+Dm(%5+2*6V3<Na0{%dq&%N)w-O<Lz#An1&mJPemou3Bf00&Xi1cqc
zHW`8$mKkv4piBdMlv>ws4S8Wd8)xsamLS<lY7pqz4&luVfZi68KE|>TrnussAf|Iy
z5U*nyoTJ(J*Gz=Yl6Gk*{tvz}ETdh#R%Bo6&70RNS&1(iQz2Cpa%g!Yu0VXoq_+ck
z6C6NA9&-jGyd~wwbA-0$zG8sqK#1OqC=a6iJA^q;U5>*^=LI{>r1EiKgO}3-IzHH4
z)GW)XGJFD8w<`oAe6nCJ{ZlTUd*U^?Vkf>xvQO|5I8{9;xP}q>Gv<PRwUT1GQQE#X
zLg9MMbS##&IlxjOo=brND#M5m-V17jac4?<ep9oZ-*<l)^70Cw8-+jt6MetD?Co(g
zU;C0JCr!3rQtrsW8#wI9EPF?(1kBML2W>hC;`P}B?y2Zf!r2lqpe<YpZq`=;Tjx%B
zH-3s&t@T%+0^C@;PUtt;8NzBs&Vt|;h2GL*V8}k7buJGW0Kg<Zn)5f4Z`NPR*B&6s
z#g}fl5zt`uqRM&GM1#gY2z>99-5s*tB(nK-b%)5rvAxRT0{WO=<ggh1hn=YOmRI_F
zY-l?*UL=}iEC<i*qdOb3>GXgScX+UeB5E_?1Xov}yj?#ue(O~dlG`m^^sFE(pbc%;
z8}OI*yW(fZX-f3^0ctAsu6`Q2MJSnslxOXW#yT}ox!|p4^Za=5=0%0N3k)mLGZn_N
zG|bO<+KVgP<Rze|=9m}_+6y2w0b8qC+&^9KoFH2|)Fvu~SF3d_*oxXxc1}3NWnkx+
zdj7sEt20DdM<}|#vvfZ#H-!+5*?L`p<4_!Ck4HZOZr(Eo3cg=0JvI@^&$L-~pEZ?3
z(GfXDIcYdKptNDGVSro8Rv{)`IxepO7!x_6I?M~q3EQiWbt}$TDF$%ouBS|e6YkN>
zooA`Q4I8<Ou#-$G*qTT&=VRxPxz*AT#n(nh7mMHXgAxe8O6_T~)49+yn>`err|G%l
z{KN2rxPVRG=P|v|gt|Uv<wH@fM^_l46HwN!<V!)zt0llxh!2AZQ9Dp(Z=sQsWPG#j
zT1Ex;@#smNm@dHBK!{w~!P0d@AcXq3t`>ztACCpqnV@i?R^CHILKJFD69$?O1x**r
zroxMALHfl1Oy=TSjAuwjpc1zK2~5As4xfDA|L}&(W&9a77WMt6@JTx%Yr<&3`#eP8
ztF3B<3I$+}M{+BWNeog*2SvcBqqJLMe(ItN%a2ekkwE%0mLA(1r}QN1{rU6P=0E!h
zg@%wExbH9&dnyw#w^)E&4AN)H$H!L$tM1lKsy1I9UsStJt!T3ZHRFD<&*8P;elX49
zR{g$(KlkxNJaG`xHGe!&0NMTJe)#<;hqLcC3^vJ7?R2++F+ha!^78I}(nsYNCi7KT
zK#?|NGR}^PY^`1rQGZM5^CH2;;pK8)Hz+?pf3{Mc?&X&A;pSv~+_>92xM{y0@dZPu
z*&}4f%<F~t$KT7>2MHBKeU`n++{h-Y=?gZ2*!}6kOPiqA`aViI3@jp|n7-U9J$I((
z(I6Js)bTu<Y!(}wXE`N-O(vW5EficnK{w4`^UdJx^2&*D6&LA~`iV<`=#j#adHtPU
zm02Hd^6cRK96MqTb=Vrv=c#r2?1yng+?l&H`%R{)tfrZ*0{*O2xS}o*IM57V242*t
zel+7Bc7=?(G9Hiw$NNj|BT}X6ykD}-o5GUWdvAwY5i*4lIfW5NbMW*d%It%9H1H}D
zW2e4$Z}H0`y06f{J#P3U=OHWz^zuxtP$Yo<(Jn6J1B&ay&TjQ5**VOoAds80r2o@$
z&}$fIF(m$!*ZKG7I6^MkN&$nZW^pmGyQgU)s8g1&A0IDWlF59OA`-O?x@?Yk%3e}M
z^fjzwYWVJd-6DQihbK}(vBq>q6PpQJW{xC<8`fo3{wRw*4uExA6j%$sy!(g;tF$#(
z;thDyz+UkF2gO@w*d@Rl4z>d79~81~|2l7hgvu$jdsQ5C1=N$Ua}g%IR_wG0S34um
z{Z!H~g_^PuR#w*03?9M8eRK22;y+Wl#Qd(iDhB1UygX@Rb6g%r3skzI>4EG)Xuz(H
zjxW;E2)a#{lIxuw_YOig#OcC*o>|%16#A|9f6vd8my{BIC*5|xZTLNMIX6%2a&G^W
zT#rFv-(uqGxYk<Bok`LsR!&MrhVJ0t@ZyCSh`KwLF>;=|pHf$s9#%`n>c|#IP~!^&
zK^t`%Ol!9<jFIl|#=$ST14~PIJ$|=)n=Hb@!oRw_l=a@(Z**s8`gwbs{QcbzYHiKP
zh`LLM0T(RW+uJIYYBV;i7O-&QoY%-Z+*6w_pYD(mu6p<B{-8vPpx_X9kE7Cdp`IOR
zjv5}Dv5&mfXZ`|_+mN2pW3Na}G<@bVqP53~j`5h|r>gFY2lnG9LP}oV3~i6KwKaJf
zhJm@cltiWb-~DhK^OA%0Fee&Of8gLk=rdi?&SJH;|NXR)@XHe0S1Y1JLfZ5PG@^^0
z6X=71OMW4e^n>3*pFDZ&!2#q<%G>+B>;BYa6T7GVinN;Enf4zqL{B9uO3E^RtUf(N
zpj}ue=(}<uItmJkjS_A_L4o(}X+HO@8v?eBFAXJSN+HT{I+Hfe@_n`pMt^Ucecaon
zly>j)ZF;SmtY(S9X}p>veJ&mN-k{e&8>PW|Scu@iac=Ylu}ubKxy0UaG}taOPUP{Y
zlE1==U&?=@?B(t5?!IgAf4E{WFf>%{_4m=J)zj2t+_r)hcOnQpb@%Z22GD%E-3+QQ
z>gnXB+tx+{QpFQ+TVpx}GmIotNqhH6VTtl)8R+;03;A3`#g;pvN=r+dPh=%;&H-o3
zWU&>p*x$-$FmGK_1}2y!3R&_{(<$X8$!YXcPrW2QDN(gQ*HHu_@tB@(5Apfmfw;dT
z-)OLWV+Bz5DuYl#a_NjuMh3~0lHS)2Iyza+8iSdGyW^Sni9YV`%^D>D-tifu-Y4&B
z53EBvombnN*N=>ha*VPGoEBq$zj#YLJy3+zVnJhHr$t|7+^S6AuyI%obaJrIdrFn^
z1-gScQzsTG)j4eD$}k#{u?iDf?3OQL6~Fl%K&6c&9x#?HBl5+U3Zxhy{FeA8l>b6G
zUnb}^t8id9(@aL+8TEHA*=Pkf!SlkD!lXS3e<g(iAwnAYjI=!wRF~YX{U~9-o3eJv
z?}YZhaj^Q7qh4DI37OZh7aKQ4AuQ1_p&{$`lj8m5eLwuN2}^`J%95UtbOOm-UR0u_
zDYPwKfksS1FX9dtC%I1SGO(JYCW4BdUIsS&21vV0DR(-FZlif}`41<yGOZy-N{eRJ
z5}~BITjbeDn6DZ3Vn}o%X<gSA5H_BAKwn5>VdbApPk(jz>kVdpINo(Wn4z#i&*F6;
zVm0cfpL{0T+I`4*i653Xu9UYlpda?EN2={R`aSvR9man)0wqN#PH*5dwLS+otRHTJ
zFg;hitCplGd6mh>*a(QxTFUu99t?|#6qc^N>m7bp*H22`dz@IE+}HIM=qn1s{(Z@-
zq4^iBA@JGvC9s56S;7_uiQ}F_SGa8CB=q2qr62Cj&1{rtpxr)~7dAIkTCf;&5ti-C
z&}&B%j1U!!CCyW9pC!Rq#M@L*=MA!(Z%c5WMyPP7rq3^bMcahiFTKBNv35P*^9xSy
zkKbUNz3FPJitt95)El76d3sqQ(=Mziz;(9s5M}PI6%eV7(cGzTaH=aAp<I+y`ZJ!&
z4k;rV5!|~6DhO>M#Rje)xNaSXc#KpTbZ}l>Uw;E&QKpF_KB9zrRMYD<S8&r&vWQ=b
zv~+@Wty%HU4@dL(xq__2e4lJb8XPkiqi%%I*E^QW07XhurYe1pBzyjE%JnsNoV{v|
zQ9E4sB$SjKYkYn<wuBY?Y?=E1E)&XbVc&18BDT6LNx!dtEIu4fVQRA__GMXez-6<V
zWw0ZAzm4`{FQm+P|73#k*JOVO9FC$EjfhnldH3Nd#-!G1Wd|xzW(ev%vs<c3-qR>%
zfc~q3J3Xxoqm{~b&l93E%I}1g!oT;d;{Vb;Hb7h1EIpm#z2+bkdn{vHt)GZRh2Dj`
zWlA<be#vt1_&uI+RUK}Ys5yYrwJ8#@toq}psz5s}PjXhdHiax?)rax#vdVsts@EO7
z2r20U@}pC=?TV=}*-*P#J$sLrv_C}rVW<B=t4Vbn5-JQ!%E^PhH!&uSmWfq3=K<pC
z5XxR=9nHHl%FzA9m5=PI-VaipnR%EY$%a*8Oiq$Qf%x(4nQ-ixVQ7Q>zUKG^D^shk
zx|%p=k*yX@U#ewDNq*UdzsR5c-5#%wFVeJoSJ><4563yr>(Qn7rEH<)xdV=PUJ%dd
zqUUlN^=8!Q+Xg13gg-1kxQ`PO<oRuBf^zOZ5WLl4jaD%llVV#N5f-wFx>VwJ_je2S
z?ww(spP!cm7e*OV&W&TQNj&|6(JET;MjI?I&IxHPR=bP=#;ieWfNV~SZRG_3#kRf}
z;v;d0#aBv+GD!`VUs5>_H<)d<bIKs8lp2=)4!8X>7zOo;!19mF)=b2$%iFSqmWclL
zp&p}DNo)EV8b*`wyHVL?<mtE{5mJ)X1P9U?n$Orqjeh!+ET~LoK3xEJEl>@=DT4@-
z4*pfcOw4J{obb7G&uv2#PEU_erEA1fj|zS9g?=LF4+>7*yAFo=?zcS$n>txFJ>M8*
zXv!6`!C2?77)$vHEgt7LHyLvO5~X0!cCsT?&o#aXX9L^@^>C5D2UX?!inL>l3SYp`
zfcvW2pn$!^<vn91kv2p0WLK-%PB}}~OoIs7d+N=RtIOMwlmecH5&p1gZB|H3UoRgo
z=>YTc`IcmxL$k!OO{O<L*kBfHj$+SC)PIxjI*Cq9^|6PvX_Kebeg!OjXf|DiM?qOD
z_H?EciYaaxSSaIkacES@jOmQ;Ku4A=_tpP?u`nt<>Tl#R$1a#yWLfBy+}XK#C=>zX
z@4>A2dx_zl$;s=AigkQ9W_;6uidM)@$x#F~%9`cjo0<-jfi|DJzZ3>S{yzMep;e1|
zR14Sav`{&I%oq|}Cau9_s-K05gRgW7ii)bO%mLaGQ8GKQ=)lk{E-Q3e1(oZ?CsHac
zq8iFts&$K4j(UzC4}1ks_JM5tt?q-rVHxb8jo>Cfylv$k!l<^*ud@3Z;NB)jdiROU
z-(%lmt<{?VMv`wwSOiVMIiY-Bz6ddMu$|)#H4hD2WLzM84{s=LMw6w9@mY<B#~9#%
z&GI}N$1g}dzwvM*l_o9!`b>Jm<S{ZHGd)bk1bwhWb2KseIQgy6MEtSQF(rgtSuX<9
zljuXLym$MN^pjT%-5RR%9FtOx{MwyvmDl>I(a=_DRWR>%NJ0PXrxfKT@BJ58G`4UY
zsNzp`jvc<z?>=k{OyUdV+X95kM$obnUqFAdGL--(Z1;s9soI628(uJBeEz`W_a*`n
z>u0}XDoki*y&40af=q<ppKkOp<tIDE7Ro_p&or{f$M>tqX}>#^f|fNsKDZ4^AWW(4
zKzc4CFX1fCryX+S2bXMmY(xYTetBxwetqxVi}uA|0}(t|QGEMNK69qi!_J2FdFavW
z<;mz+{q_$$`{O?GoXgLs*qbWb<<)D{*>A3a_MYB}c8~k#W_)H=uE$IJyx)`fsREE<
z7k)IUcsiX5BVV#vV1Z)RRoI9%*z(>k`o$^xVv4o*VL){BoeF+xb`_FCpC$bT639i-
zVag;-GfGUj`lVmyp3Uh@E=&Y!Rno7i(a_PWGHLrj=(bk@0?An3*yA=?R%Y?555*BO
zmMf}rc-V5*Y*CwCnB%6>R%Y?3eyE-`k0Y-){nc(hoS?~J8Hapx%Ow>rXZc44cW;kz
zVnQP;r;30>EIc|I*=)xgaz~6xMTHv?!5D$2&f#v&2@fAd&P_iVI38GHJZQpA-bq$B
zvS$*TZ#!c=!a@bo??mt(1#uLx%XfEt#luFwY-C!~+UfIocA3@wmbi}H38s)pKeQ+R
z1%HMaxg<Py`r>vt_wD>Bz3SSzGbYUBAiFkX?M0UFN<$OHq-`9>tZnt&<|OZfkKG?;
zz3?9i_C@RH3c`QW*e*qy-pjK#N@EV2T}Qxmqb56!Y9_zTtF+s5fxms`#SJx$KNLm6
z2wHHIdi|+GeOKbrXW=Z$j{qx=y@HX8d9xqsop6zeu~ZZ%{2gW?0hPY@zhYFP@YK%W
zxY?>{;dA-H3yQ1H<hZ^7zSxcF%KqO^_huoMZDIuC5!77X>_I0g-QGDuyw~6FB@Jf3
z3n1~olYA|K`}hI-hKylA#C}17#y%!ooS4F`HIH7WodwlySGpCdo6KXUWj>vZMts`+
z|4{bUVNvb<yRd@N4bm`liFBuuf`mvnBO+Z=(h@^ANQZR8&|O0*9Rfp_gmi-p@h<k>
z=egeBb<VlYe*Rl9v(~J&zVWI1zCW7fGQ!{rMe)@pU#!F>l{8dE=m7-;<5}G1getqm
z35l0Nukhe_l2+K$;Wu4!xj=UTOHJ%92qfck1D)$o^@O#4sd}r|{g4F9g*-RWiv-+R
z#nN9k4USwY9Z|^s2XxXwN+q@-5&8N@8|)Y4{QbU}_(chInHqFbJ)>0G6$Yz3tuDLk
zi+gv=Ky)n;xCr6cJAlJifAjwNvujKusfrQ59X-vYzX~<SxDZn_o8mw)zlRx_ODwi1
zK5mSGt|J*ZPN`|$?l^v?V@r4rp}N$#bvIrV_S0T1VYkn6^!%(o4Ofb8=dvWt5OMLZ
zsoCMpPYb!sHEp1}m>+T+P(N47M%BmWcFEdt!YS9q%jE6^nav%$k2*Px+gI&mqv5wl
zH6AGSbB+<aMBJ~MEzJnfzd^r_etB$h`;v0qjpZh`!NT)y#rFa)C<8Hi!n#65?%dFK
z8eiiODxReS5W>ZPP(ZEDYAWk}qZ;kr8NE#!;=;jePbKAIW+v!X3|4@4da@$*dGC8>
zOg9|?J&QW~)#al-KAY48FlW|6xUU)_N?+dTSV!Vr^d_&#Nx@{vv!bDme94>u?<0xZ
zB_G8}G_QRHUw*S5+>NRx!Ya#>9ijckJOVd01vtBkeJU)ej@OvuoEPOTWg!LBuR!6J
zYZ05+$}Rzj5q+BI#kDqZdHU?cigt2&|Cr%5<5tYf=+*5W^To2O8S7fNNv?UQ+OUto
z)z#I}R(PdOl@y!8Jup&tf%}MyUDUwq;=mVcm!XY~LPKeSfY+2wwAZhLHFUh5BO6Zq
z`_oxlG~}Tkhlal_4#zd^4#LhC#!m$VRRxE#B#l!EX{Cf8s=%^da!R?J47+ypYrFpE
z`jp*wr=eFgI@aoU((G$3eU)!LV-FzWW=O4a@gb7Z@YRn@A(YJMo;eKrRk_Eo<R|RF
zP3ZfZh1jrz@r_9+1Z+A1xmDnocDk&n?Uq_u0dqhNHZ$w>RJ_@HxY9V5CrS*LB<o)2
z=jk^f`@WbwW+i{S_SQ4S32I&>ik3Ja8z$>ztx@#$m00oC^IX*|2?qxUAW-?<<w2uS
zs->Jt7(3lnZ6(mNTgihr98Gee)H9S0dCg?Pv>O_<J>~ic3y^A$>C1S%pftxj*8TyT
zy;zGtD?=n(b@!D49QS-@J#5v1Xf%alMoDg6&76veLxb|LzckRhT=y9~iZXcR)%DF`
ziD9#Z*(}Of@eIU#9y=_dFhZYk|LNC3TB|)BnKS_Ofz&is9HkOhYpNU(Yw<A(jh>(e
zc-6u>#=}g?sjr>r+8N-!-)l)NR<y(4_lAXrcODXzO^G9x4BN|gCa#|M;64-h8eOU3
zS8eXJ&A<J9Bk~w!Y(NKVm3M2!u@Y#!mDwW)<H%s;%~Z+^?QujNd)FdKQm@=%HCDNt
zQlAzkqFb}>_xnj8?qO8l`Rg-6=2e@viAHM`vWq-ci?5ZB%+?b8qRApKrnc9thIAHw
zR)qA^&)(V)YTUOx`!SCt8#d9q|6$;lJl4zH>N9<@xN7V8yY087FYM}y9+Q}|4gxgq
zF1m-XE+K>y{g?(5Uy=t7h3&oH*0y%JUk|kP)4tVz@0vAk@s%F*{)HvkAfP`W^5XUP
zGDWXVnFKbeiM-z@O&H_5d<;>_#24k$Qw}2u)xRy($7of#8I<V9qxfYucJ|+4q!qZF
z#6f4<_87qGA8iHjY+2@g=JOxlQOM2KstMj*GRNi$ad{A#&E`Un59u0tev)ofCwy~{
zdzjb6gGro)higQZDgdqg_lp9Rj4;hoEd{3zt(!5d`3a=RH(Js^x9>>j{A3u-;KJd8
zdA97wJ~D26wu+w$uv(-la?VoU!5b9dg>v6vcgV*e{Cd}=R_8UAZt8LX^0Gcwc?Bv;
z-Bq2sDWYZ3_=e#fgkGB!+c;H|#nw%2`Mq>9Yj>vqw;zL9EI2%do|e{6@EgGcryWEE
zh@3=_tsi}yvk}`C#6#ybcLZAtT7-W}sr#m$Pi8h-c07x9lT!Lk5pH^&D?8b402kEL
z>_R8}3Z36zDI>Tbl};$04tjH~LB+IJWzcD!swF!jWu`C@pw=E%p*UvRw`N(`xBYEV
zym&lC|5D(JK9`th>k8Qo`*qLe=I6;mW|(|b&qkDYkNAVYK%O@d>pPiLg5&aIUM$vB
zt>bP;`K)4k;G#xapjh}1gYvIJ`h5uS;9^Sw-Wgj1f%)mD=Z>zGspnlxmdxkfAE8=n
zrmXAKst(}Nyhv{H@*Z8`N(_?n9@&s94z;THvX+WH%`UrREpGOJm(mbeTKXJhln|MB
zDcW;y2v?Ug?WZ9ywOVYB`=IPqtDi(F1OYHCxDjVJ3kzq&H^FjGa2?qvnB*p+T}RS|
z@$tSLCpQ}lJrsVt%0NJ+ngnvic;!dy^I1}|r|R8P&*_tk{dr)2F(y1*?${bF5qvLM
z-=X_}a0$N}08$L}-tyaT=+@$C1F?Y?EOe@wVnBFQ8Hx<BY!4?gMBVb@mY)Lx1UBO5
zE|T?&TWI<|%F6KST1i%$-{(${av$8ZHlJ{)S#pt?BTz#FNV~|Pk6%epNx@5kJ_-m3
z02kxL7I0A8pR4mN1$5Pp|G?^d2Jc>Ee=R01S3RwboLZg*7rd!{r*|I@%Y>YY<d4@j
zb0|MY^W4<XC>Y%oxZ@49U3jWDd!i<+?5hDcb!=16wD>x%GEm(z;W>05#dFIBPBSqZ
zx7pTE2a*27*AvDZ=K<#X#UY`f-NMS06P*NgM+<cJ5p^Uvf7~Vz6*XVcfpINlVHFt+
zHoKpMU&9$V>lX&dO;my2!0(26b!+;U^~Os1U!>71r2X)Svibudwt{^u?@58r)-vp|
zoz03dK`jShg#)mHncov4WiCP_uG$u6NrA)DDX&xN*=;i2<2wPKpb3m4jeYMx32q4B
zfO2^1snZf6!_^Mz9%g0*zy-}1PBfL^bpU*)%jg5xDSNUO@1ha}xHB*yB?{yU6&<gR
zz?O=@S~aFHX5Wj@JhEEQX{8~H;vD9&iJK`quFZ;I$&dt9TbXrcC@?I$6BoTgOqbt~
z+zouCBI6-hoxlOj22T&a+}(uOr693^Rk@@#m2}nE?5Xt<$wmw&*ua9r+IYR6KG4%9
zZA`5T>|4?61FlyZGfDLaj{Je@Cg^Fr2IACPl0qS;fZfx(F7A64FA2uSAA!0VD91`^
zn26Eq&kAc^ubg87sm$S+dSpDgO4Ju*)oT#+!Rkm0J<LT+l1|WUHI4cOkJ#YFPwS!O
zLZu1=izLxWRM>@uHfl=E2l?YYUA0Ot(}xk`r0VMG>gb980z_)6+(4e4Qtb2FRKl*c
zaES75X*a}H9M=uuCcSlH<~}>ol`tL$wVpUDc1)leO^aIKyX~7G59&QJc}b#9aKgS<
zsu_qWI`j>@`fZR{z9sJyl~jx+5K#G!tZx!X<=H9D{Vnwp^HA4S+?Ie?ur&DksnevV
z*-Og7>J%uinOqgX3AEtRDj^Uo0KhSYy6Qu=Z!<n9eJcFKVKbK`BGz57hmb-PY+r4G
zTKC@i4nz$H(Gx0*;uemIrW<07Rq+VQmwKf@>rq2zK0J}z8jgDhr;mt@pXM#sBstyr
znQhC{)&GUZ4#4?~+SuCWvjW?Wmo?DQ3K!UszdqP*#xq%<=<E0NH1w&Ch6FRo#bo>N
z+dL)l&H)1C8Y^)8_%8<Va+>07{kaX%P|;HmfK<*A=57Zmd=2z&byUy{5}!x%p~vDX
zw_?3>$I{1sJpdK&Q?D1d#X6aEUa7U*eka76c)>&Wr=;50=*38&@?>IU39TFcHDxP?
z7v9&6E_GA-R#K}+Esq%ns@64Nclz?0wkk-6vh&<vV;dce^EZO|?B0AB>a(+5^o>y7
ziCSFGM<FSXKS3`kEQ1P~cvs#UYwe38B|@sL&^(2B#ykp}FMCgo+E&NvDBfeq1ie@j
zjNab1u-v)C@CGyt-(OD2c)4N~fO^UKtpI=E=lUSzc2#`O99b`>EX>q?Yx?_Z-GkI@
z2EbJmh=XE&81uhOZ~8o^PmxkX(sgI&aYgS&Oi)iP);uM@)atwXa)x7!GlmS)BbJ5{
z+)^WFZUsBg<`dPMw)5lu`uc#3=aKp^wqvi_r4JfI36D{OqgHti5_plXr)T_Tv)s8}
zx9ETR+6WWh+l?H|dFj^yZBtPGP#7L=imc2RC=Ns_>gonX+Qh=25_|kMvDJ8LfWmzv
z_g%3D(bq6d0OIbO`}TO?OSUseR2<E-H*CXVsZ|&dH+kX@lFC>7dZj+1S8I{oc%u#c
z!FGe1C@!pM*|Z{UHC4h$RimX~2Iw4gXG`BJc9?Xyd9_2g=&W{x3_x-u;S;TeDYRlt
zLo4$wDdg)*$)RYZ_Bbt731Iz^F5nD2#aZ4KH}AAOqGA1T{Z7w3Zt4h92z0y;O7ZGb
zzKy8Y0*e6^7anyju0W8``l}9~5R>j$m5ji7Zv<T;KT8@9zTowR^vab&<4h%|6ubu7
zpSo@(IWWL#9Ytjs*n-T8Fay4y{6*f|v+Lud;b`?bB3x<#(ixPPmnqQSuuFwYyU#yL
zTID1A;*AzpMS9RAZaq7@zf^zbRW~^NiOx-LA$;pCXqhS~l=~-1yrr{hl;-MUJEGrP
zp*1MLvCc``M99{hk8-rdt=Hw2Lqp|MY5Mmoc$wqRK($GS)hp%n`@_D&A63x~e9xj7
zoK)hwv--)Dal8Y4JK_S^RGvGotfwnR-h#l!Y<st8o^~rAtoBqg2tlSZ^6)<!l;$__
z7^3gCfM#&F(osKb-ayJhpPYAHp6N@#HgSdNYJQ&zmyPsALsy^cWW`DEl)c&f9+YOW
z+)6<%NL;?xAp<w=VQv9LN9C~6Pi`UmzkUU3iR|O8qPAWt+;|_WFlodK79WYE;3>CC
z_?z=|rM6z9amJ%h{OXneTtRo_4ht4Tps5n##gJ2jy2KwJCO9C_D$tKqv6FrtJKdqF
zzT4Vgk6y`(;OyppM)|J4|Bevu9nuhC%O-XmBN)A=DRzT~EAgvt=r-DclhJ4g?iJX=
zdaSXf!nUCD<GG7n{;zXGrqT#B42(FRai38j9jhGZeX*zOJbhTfUbT$=;BccT0{Tb<
zbrEr8Wd9ub7nu>szR0DqB9m1cv<T6YLlaFoqq9NTRXjV2rCK8-$TO~6<_v`T5`rHT
zJ~GZ9VxVVlAFfekmhfTtpCclf7r87}WKY!wS;F+>q<`{A!GGj2gUxBdSskCTRa6&z
z=f_7LPW9z{Jp@#&SVHyW6n^q3R)75G2m`n=qPmEGZim*2jCSwCL@pF0>e+d}c&N+I
z@c;$)eD$6fHvRJ9MBwXj{L=p%;nhXt0MGIFJz%R1-eAEl+(LR+pP@qS?krnBf8l#}
zLE*7jeMaX+&9HJV-T6DcLve{b?xH>vrWbCgW8IVlj|}hkKT3UaJI6$<uPwq9uCFkS
zrSLOdG*qZ+haq!W<%%8LK?qaPe|U&VMuv~HHrNTk4>DMhG3xUEbM(*Szxv4&mXkP+
zSEuAbQXef%skrqbJhGHybs0POEvxa<#`)sB;iP#cSlWkD4(lxW(AxATLlEUbhF2Zn
zU4_XKTZ=YCl~B{}v!$3kP`OdaQ%@<D?gCqM-D#Wa-#;(`>BeU`<+-C(2W;0rSpxJM
z2v(goXiLb_HO=M)LXYB}?7Il6DFeiHw^U}~(nRL91!C0J=I+3ZN2&z1TekJ-n-FOH
zUs&)<{~q?ha=(Xxe0UP;pns13o(wF&WKjFbL!OhUa0v6+y`q-gRq4}5?Mzchoi?q$
zsCw$EMAq;7bNFLcFlYJTlRd{1rZ9Eg-saq+plQdsb`(NwF=hqk_xCFoLQXGm?Dvt?
zN*49bO0SvgD`$i5P8U}^FIkt9wB&4Cg?y=-2|+8^Kdy)Wv{*>|VmWw`i4snAsDae*
zm_vyosC#RD1qzm!z6GKj7o>Vzi%?AMSG$jH2Q|K+n(f)YzNl$w$oD4cJC5|^@}7Er
zwR|ie>Y;uV#Bfk=jXGpb{c4e5_N}40Kr4gg12+qBQ|)4sAyEGR_bmS1p(ys4L%t&S
z-S3I*1-BPQ^EG=SkNXSKOegP5dORN^f}CNH=Z<KN_b8Bi0huq)SEO<T4F6!fY5u*k
zqsip)vPFsCX#e&ChD}s#iXzFp0(I0*ZyKp~eAyxMqNj24?y&V$#>IVS(m=Cj>0{M7
zSFQEx?FDzCYgg)^it@R&LzMVc?`WU<w4cGqW<!~Lh7Cu?M+KMxf&x|FFSYHj0EC~b
zO%yh&|Ir=ySauBYNP1)dB0GLt@J_;PK2%6}8c+F}`irDDaXf}E>>MW$n*SHry^V$&
z6KwtMVeSG8_6J~9|33PA#Q#}}K}BX0b<pCWRezA#z?rVX&rHDuwY-V9PlS*ndCaB9
zrDW9_P1F+D^{_}Pd)78v(cxa~>Du8P`7Sps&+Y%nQ+=MOKcu94+jxd|C6==s%-Rjz
zmk~-j`!d1L;-ty|JJJq##<1}DN+RM_WEk?X)xB#nhkMwJQlI->VE^!2A!8hW#5rjk
zf2k`f`TZ<PCc{V2{3XlDmX41xVt5L*X!ahfoG>`2H*)p4*#@$;<+`w~lih&M-Yq9e
zrp9!`N884wg0l3bTq|yIj^i`-y+9EBz2O4~;9pPsQP>6TI8KQ==GI8yin!S@C#Qtm
zj}F8d)sIH+)%Om}w1_3IAW6mFpR$*Y%|b)1Tk)=iQ0g$W3NOQ6jbk9=?>{c%*~6mB
zB{YC<MpAS|KKZ?i7fj&Ze1u|dKVsZ<6$vE7FDUd1t*LBpG}{He4kpdrNoA@*kBw6|
zFY9J+tzh?Hw36*1ChkddabHxI2u}K#56ewb_(RKNJ%^S_L)uU6_Z}g9ap>hCcSpJ5
zPfp1-P2{UD+CkwMW}?SRi=%zG`4swvyKKj=5z5J~KeSU3cMlo?|9T_MyJT}*mS0Wg
zZ{)l`p5AYJ#HmoQM}4uIR;kve@%ScN9EEeX?fpQBw<RcX(Iw`ED%C<erSd%Ud&}tQ
zvFlPo4!Z@k@E1!A7czWBOGy&AW{U!xW6s}cIV?v{>(8j0OjHr?Q!ZQW&Z|zhJvl70
z!W-0ld!7x%>2_Ct082{xJYJMDTHmNVl+Cpc-7A965zM2w^aO~0*~)k#CTSbcdN!N%
zLOcS+5T`qsVQFvF^~e<HoziM?Yj#v{Zg4^UrOR1#>Ct`~gbIY2h}thBTfE7dZhz31
z#W=V+r!FZW*{Tk*p&Ca~j}nJ8oVp}%-ZHaasFiTaz8`aPX46lsANNBbJ{wJ!y{G*(
zbSWri*?`VXyPZ4#Nb_2UCY>|Cx={xTHhOP5vAHVvK&$8=`ImO#x+8d)$4E2$D9_G-
zz>7-YMIDZI*FYZe8rHOkffX4?JfCWg%44&!N>GnU__>Ehu_RSHE`g^1N2x@!;h4Y|
z@e8<VJPu13Vtx%cm+c73KleM4%BQ&5()k?@00O>5KWQQ3O=coP`N#~WDE_r!Kg|e2
z46A<rG>)c4yhzf9D(gU}on|S<ciw!=|F-1`Lwk*EP3-(tb;G5=`-QuHFOM92g;3d6
z!IQ1S@65Rem9TUQKd<Ibt0*BK2t)mf<`R6a+ylR<F<W05EPaut#(y_E6AWlC;MM#5
zh?9a#KKXaf#-=%beL<Oej1-(rq5)JdV$+!*c-ie}GK@WkYQ3*)rdaetBp(`@S78wG
zq%q4gRQx%xB*WOPpD6?sa8100Z*A?YCm3T5{IcZu`sjYx#?KZfdm^1pkBEKLIEy;v
zM=wi!@wt@Ifukd#m1c1WPwxrs8zU+s;!mE!AC0}=sJFA$k58~Y)g6tV#_3#0vmd`Z
zWDAKMXy;p7Uw^<Yd>Br|c2p`-oVX<hR85TGwJLW?DJEMhfWX-z?Z4YX1EKK>mGl|j
zx<OQ79}S7udaF|4Rv_3Lqm1gFvEj?BGvaQh#vPJyV%g`%e`s2$#xh*|Rp~j9qB7Y7
ze8OAj7%0O6FGs$AEhNjrX{sZd<fsAdk^W+x2u!MSsCG#x_##qwO}o}hrUa~aHU%=9
z<f+cimttO54~0G&$q}hGk8=$YOokw@KPQZaXaEo<xI?er!cW$AzJSVhj%Bj>Jh;{>
zKgaCNv%MOY?A%k@;k44RX{`d?8eGdc4cT}mR?7t;7jpi0<4~|7Ip6Dy>vPSqs;!^p
zh{xgRt~bg`L))HL8fb_X>3`>%p@ErCt<fmZTs^-)pRDY4#D%aXM(qvxdZCUi4{oJx
zRCF5a?&<RolUeGfq-Lyg=J)Ovx^C?X?(^dO!AR727Suv7_*ES1(M|eDj?yao_v9wD
z3xmsF;nK#lYsxxwHY!;gr=M!AXK;YZ<0iuNXOUU}LC2~N)a3Df`NjEpFM#A4PyTfZ
zfSqyyOx4)b)W*D=tnBLdSbAu(>5Hqbp?WCnt93*ChvB1B?L~q=sem6%^zT-61fDBT
zM;LTcKQJ(mhJ!;T6~R?)J{q-|5E>K|l*4aU2PA8!B1kHYm=&at?z@)8zmDXVJYJg#
z#Jec`mj)S_O@J2Oy<DkQc^r>*{^wm1G*wPe*L`U6cBSptZ-7dj>c4c6fpGv>N4KVP
zwU#$awI88a`m8m?$GiXay-2M7{*4X<@Bp9{^K^4KUNJsEGr(<o>=l4YDGmBBpG;+5
z$Y~Sn?&ee#$iO}UDsHig>L`O{^9}Z#Kw0D~0MAkXmyR0{egIfn+s5W*Iw2t)U?kw;
zy8sqM(TUFI{68c5dWds00~T8fF2)c&5<Xh+OY{wbB8$^;n|^zYlj#A-+DD}pL7?ag
zKRc?SoQBN|%HASC+<rWc@{!J`?LU`EPF~DCPW&*)aJz(A3!=H<*BE>~(yoouZBfPR
z-&FQnrxgiiM5i$Ecog2Ov59VwJcT+xiUONq%)EGGcG7GG!^t_9Hl|USwrRWM18pa=
z0KXel282pD;12gw6!()~uQmq0=Ep?`$HvB5m|Rf&uh+^9JKv-F97{8!a}$i0>b4|6
z#f#IL>*DA7C)`wHMs93kAOu2@j;B~{%Z`2I(8Y~E%9$<?p(Kl?^<|}O0mv6BJyT7$
zT&8hq6EE=qkjc@{XF6bb{HXb`E_u?SOe~ae)qS1XisX9~dsFxtEYe}%J0Vw-=kxZ=
zkuQvB4DKEDS{1EdXbK-uN)n>^KDd(q2^j#%B{?+2ARRk97L};0Ox63|m9;gxuVHxE
zlmIH&zvrd}Q}kDp<j&b*#B(Ps$8FaqqdA86DdA1Q8nA<8MogRS2Br~a9LBKvmuP0+
z?JKDuKi+9)y37>8@ef~LWS<$?hR-mqA`5O}%Pwzlgyd{&nP2qI%D?=g&v#&qDHS1T
z>w7D<bH3bLW6_qwxFW?9?Xweo13|2eHw)|dj749dHXi5(Tc%~IYh{Eap=yB-?jB)T
z&tbRQy-nno{!ak+u%v<e1x*&JZjod#t1v_tFiAb&?j9zhuQfQH$nC;9%32lha^IS_
zUTSE1mSVO@$4VX_V586SQa=l`asqp1&If}}_woLSq5W~XgQ)Dcyy~zO+^*mEOJdmD
zJ;j1<dGJ+IOG-2`M~&m!e3R$X(_)XZ`fByEB}IT7cOmp>tBR#Wlgy_~Bt4H(mS@>+
z0_BC?<rg1{IrFp%(gqmup@Gi17u}~{C4LP__p*b<f(d5BZ~qR7`D9+u2W9}`^IMRl
zBoY)XQkvmVykmC&>%{tcsG|;O9B|9_Sma!OWpRq0%NX&iCh&G=&&N5<J$O0S?p^I8
zyQT0~jq;>H+vGG?#ftEj%6y{w(G)5R;SG`ZEW1WFV<^g~`)jjT-}^S8yEa@%HXwS_
zD2~t7_Kc~Q%L9j&^EWm4)|c(HDahtbm;Ek4w>2l}C+;CwfH>qWTADai8bDhCT7tl)
zb+-r^M$4)GVjju>7vk6}3>E<2{x;DgA<Zrib~9Ref0$?cIxC<ctM_H4ns<7AsO(XV
z!_f8;@dm{uAZqA%Lw(V9PAudj8ia{BSyO0yExGoXVYb{<F6TX@pz+fhx0PE;unF$9
zSAshy^-t{cRNQWB^MTsMFQ~z|xr(!F$!(hwNS3~3*(sbq;LD8EcNL)nK#JjizD3u8
zkdTnhM#uHfQ-Yq&i9n&4;IGLH1ksPJ(KE?Ek#H~qJ{;)V?AJF`#hQ(DR^>4M|1GN#
z2-WPmR<*Xa2D0ro@G8?_4K}Hs2B60CUm1Y{kmf+a?Dhvvqt+Mz>h(J9Kikp&Gb{1;
zq`ulV<pL^FiT~Ys9cj=8+xZ~nGyw%CAZ5M$*V&uPvT(<{mqgxoqt9HAo*xk}TGH-a
z)>dAYsm*I+q($Zt)A36Hxsy;l*EtMP78W#mxrmp5OtgCd4?dlb2Ef6_AUHjw*^5c?
zxmnW3zja5;-v^RX_-i*PMkAp@g4R!}FXz6{5bSHC&m%)cfBS#g>P*Jj;C{am&q?G;
zmp<Ckeb363Q$oCH=ko($3aD7gpo!WBJ|yVaG)riV+r5MwR=zyE=4e3c^<lD|L$D2!
z=diz8rO;w3Ah3sdxe;?6eYe)_wJJzPOP)cf4a;4ZnS>;WVnXUhv3bg;D0cldqSTFU
zizKwQ*o00+@(dNXmuLq#+-PgnDuKi3`eIHf2U*p@-Q8$U-p$TFbIR5%K((<8?%Ze=
zHK3MtR0tLe@84gq|Liaf>SAzZG8ag^qMz%ZGF3UEAFrv<7j(1r(^@TP^cH_KLXy?F
zuf~_;!d1TOJoi{zRZ=!abT>K!t))iwXxoP!$d0az)IDl_BfIc-mgz6QqZ%5FMdsgN
zzYLf-nVYM>$HmwX-eq$&mNN@IP{hL8xeKM;HEe?J3q;6IC7xad2)Ra0NiTNIuYPit
zB)Qm|^>plg&%pDG17gXmy>^JC%jLNBJh0K7-aH5kT5S-{_NN-$oq~7wEn0DwC&!E5
zTW1vdZNH}L03F&{Bw2fB;a`U^2B-V*M;NXLjhT-Zr3lgoMH-<jVla-mEg=u|`T1#L
z<fi=~U?=A%N(mE?CEa(r%^M#Z(0=-+L9(w%L>PQKYAs=+*um!e&1_jWd7<)o^?mW^
zAj%ADFp@7nq_>RmyG)kvWiJb@jmuA&7lGv%_V)Hbi7ey{V6{J3l~PR6l@YTz3y#n5
z_U_wZr`UWG)W8maVfZHwdaeMU$2;Xo$3&1RoB?VKdLpOzH%L19^F)k6nVoIV)SF^X
ze+>kr>+)nPokP5a4#NP*uI-_ICS<E{Uv)V&px;;Yn`UpaBs-A)cl(?vDmO2<nVa3_
zgcCft|1uNYLMa*C+H{)xdTC*703it4*c&c?Gsc!Z*Z^WhN9<=HYQ5bvA*gXb?+4Nz
zdscFT?<1MiZ7qynwi%>wStbF(Z6a1V58Gg-q+y8$tI_!jDH)HyJ-WMmh;sG(hXubk
zIvJ;~U-qw$S*A@G=*0c%0(RLjT3+5O*MdwU?RbeOK2csKDF<rB9*3MhPRC8}iSjl6
z<j4cor$(3IYBQ&rGt!0I9kqKUUKmH>D(v_!KRq?y@An)fCHiJd9TO;BLG7n?cY;=U
znE<&pQik6NT-18wUrlV8k`VOPSg$5WD#FXRggZwe)#qZmKn6{X@cfX?W}2#0yVB@;
z3NJGy6;=K_e7XrhrT$?}SF-OxleoW2^N5|(kaOGnkxF(}o00uItfTh3d>x{vtJd@h
zo3H#>&<b}h?E8#kk<4yV>B3{}ttgrHc8VszIvLuGsSS9Uz7>*}OL%TfrCWQ_8T#Z$
zNzY&`bc<38y@eQ%<Ey{K*8I3UbVby+tKGFdW#?t=JxKg2bV5^&-PkokS5>l}!K&@O
zyBhSvGolwp*m}bEYb4}8(dm{5o1$^2=W<gcD5X?JH)?6q&2_OII_@`yt!QiwhFBMS
zdwwnhIr(1|;mEH6;Q|bB;Y;P89l1~vP9vpd#us~wE!u4Ov~;(BZ{7C;u+0e{Y!Btv
zJ4?OI)>Xl-Py{^tj9l*2#_Q<v%&08Ftm3BF@N7UYp=Nqj>04Q9D!+&+c8`u=IbK}l
zf>gRo%X{oGo!uimOK}P1-9WK?vs!H9gFe0Z(t0yp*DpWm(ii(TPwh&ympm3AOW_}=
zl?IV?pEZ^)l)vEzDSdy@H!CswNnkjSdPQjxaDR(JuiXeQdO`{R+GQs^{}~Yu8{MC*
zG~9(@3y?SH3S(j47n}Ih4*T*$8Ej-5)4wW=N4_EaA6fjH2%v+(nmHhj{a=I@@k<cz
zRoGLb^Ng67&Mm;qr2OqN{i~$wL+L;s+~U#NQ!uO_E9z!<cCeTxdGZbbsBr^f_|s5b
zG=1a;Z}XvsFpc%k(ceDX|FGCf%>=HSWjbxH$fHFRd=@k^FV+fyJ`64LNz^ZehHpj!
zy#p_c@lus?m}o(?LMcy_{UxMc@*JnOBGB&G;G}Dyl}r33q^jao1isf7QpQ$E7zK?8
zzfqw|!i@ZpQpR^}&}u#pegsMJk(diC3tv^zzdtzeM`NM?d~j=$<1HEoh=6VV20t^8
zK_;Ug)Wyo!wIfvEFRkeRv+6#kjA4(kaAY+$gK+8Tm@g4v2v1&X!fog4H?#|o{9Yc_
z@R;pj0sVw}I0=g}5No~REPB6iYpu(fUq@<5#w2FR&vRz?;>yY6+D^o6N|M@|>G{4G
z_Q5Jo{as>lO=WR{Y?&UHnDqr6v9_@*1*h{#!MlV?Lfm-PsOtkK+N{a)J!g0nFDuCu
zFDuLv4h#ob7FrV3THRjcIvncB9WT{I^Z{RT#1&0(cEQzm-d!69V7x^4xk8FW&troU
zh+Ze$JgKvqmU{g<#95&I#eX#}fWf*B1IoPL?)AKF0-n_u(CVA8a+9P9KdAC|&4$b>
z*mSawcnl>Z`?;k5POnR5;(lh$pk*4?^Py}_38pwAGlHQMLmIu2?wD?tUX`9t+O6w9
zuE5^MGC~)Tz|}7mMP~k3iBZl(qW{UMP#>lBh(pw~2%$u-1X4M9f9?d{VADr6%!Z$B
zRrUVccvr=^OQtIFteP?QS89-r3d3J?Jb=Z=pltJ+LE%lADuV*yE`h>d%svL?GKGgP
zj1iRnum1pCJ;Fgk;A4V^Q`nVF0FEHz14qyiNkQ+u8bB1(Nqz}12lF1Nf<Axq21&aC
zG9go$5Q7zr$B#jINSWs0nv}><PtDPO%s=wAB6;;$$h!B&_HVEL-xk*Zf~$5>pfXvN
zzjMb^+PzT{fx+tMuB?#YXi9uMJob!~2VMOCV#xz>M!OW6DBz|zu`YP7JSt?S4haj3
z9T`cIZzgnYH0G0wUi|WUS*BH_f$)CGBkNO>B-A+p{iZE8$AD@Sp^9JdHj{kSr}Jcd
z9dD%+s!9Mftwe}>7p!hN;mIP@2wVg0*@uGJH+PG}MLIVLKH56Tv4sAqf$XCTEnEUY
zuk~)?+TFSi$KE66(S$V>TFbf3Bd}Qh46D;99p5vsD3w9*?G{qpli|#7b#P~lCHGga
z;GvCmW~_D#(W?k!8xe8|)p*c#*JrmafxZf_<Ps?I!urwGM?55P0`C0#4_A{2?@*|5
zh6GB$<8H3NabGlIjt;p&P2B6ZGQi%WG~~xY%f&s*I?TMbN_MCL*_R)rs<>V$2TH9E
z1(k$az`7H|m>ARmX(1nAGnRr|T~=#e)+j854!|;#EYg`^7w4EU!29agMi)Kn)rX5h
zSUKKAzNM4k(hWK8D*64Iz`+X*523;jIsiSrwd2J<*J3okXq0zPBfXaFM*)$|G(GiN
zE*b!e?8})^kBzs)$BHvp3Gy!A^L!l4wJ<*M;R7G?R=ttG>i9ZMyUMg5-@{HQo5dX^
z5x{=vpqDjVGdcp<N3Q(|f`Qai^n!*_UIE<sp5c1zRv)y0BrzodS0dZdJ3HM4@Sanf
z)>lX@UkcRJ_;b$wRd-0vI-bhmU}oMkDFnr|va!n$T-J}>MgWQ$D*ls~JfM%d&y&qf
zq7^%7KN;%xdM>ybD!s6j(>5;BPEF|i-O1Nka8}OW9I4P$Ww*xG-$LX|BlH8&$WqiQ
zQgq(sSJ~mr04jwn(W7f!=L~mc0)bocGeH@yKk<7h&|CYg{=G;$v;xbEOD+W`-N|PB
z%5D4XQI<EU;s}w>fV+=uTdF5?Kslime|^UDsL=K4WHsjC*88=BLW7aJ3g@A1DZ0P`
zGjL6zJ7io!+QM6sM8wXngxRgi1=-TKtKzXmZUfq#2Jz-K(xQC23|Dy}!=78cDp=^0
z&fmh2)+Vk}L@_5Z7Vt-Jy@3=JJ*<yq8~Y{zMDKFlLhj9C6X(+L+l-rO;nzImHqqy-
zg9pGbGSsXfn7JHVC}3ZCCNx5PD3GWYg}u@o?zw7#D$BUh66w!6suHbA|LF{rb*fNS
zUHF&&j%ghyi4glk#0rice@VCp6_&|D6F-S-pc`I<=g#TA%iMVnMO-gg>A1y087)c_
z0$0t)kyN~hgiX6V!brMcz0Fzen*s)Sa!a)RGmh1mL|WZ%|J|rqgE7D8{jvNEfs$zp
zf8~33x&=`zChwMUFHJs+MZyY(I8}7f2~P4C6j)ok+#l0$az?eN-jr{_UJ}#~R*73o
z<q4F`*h4Z3z1>mTrgTW?hl6wV>exv6+)>*E&8lxHa&>b>bdHSiqDFbTG=oW7h1y75
zDEME+tE{gy_9C@ZKperM2eo~frK`|IAwod~tuppCGofbkO8KI2!diqLT|^)!rfA3q
z3*jPBqu8-z=gJ|9a3@zsgK1{sQMueX&9~(rv2`k2yYpXQrWukZH`qc16Tme#o=e}e
zi}cFbHizrwE_IcF)n4txTDz+yT}M8}J-){7TUOxO?O~x)h;$$kCL7)COr4xy37Y??
zDi@jhHG8pu`CvJEbF^3BU=C&T)-xM}>N2*5V=V)aE1}4wOQ=U@#5dLhNB*AA>R!f%
z3J7LjmPEKxVIRfaxdP1}&vWI*+)E=8n{Q2g?~vp;s=GwZ2NK-MIwt~re!!Ug(p;?}
z1=ywFS)XNG$So<CwE?O!`E+MR4XqTs`mcgKeW)H90s-Xu`gv`p!@L;#a^2JDlKb`3
zqWh!<pt{eGWm~5j(E-&j+NC^A{Gt3$&$0Tw{C}j@5oh)5g)uW>&SOZsmpVSjLfm7B
z?$~1K&6EcNSnC|!NhXVhA_=c1uXh-4@d;Mtx{W@|fAaEiW{i>u%PHd{9#23Ij=_u8
zCkJm09}&TPTtA=-7-4Lt?7iI|LCc8{6yU-~PUByN;dm1Uv#^=Y8|#Z=zft`|8+T{y
zY9;A!o}%ii5AL5ecWCfcmK+M^GEWPCui4ZL%@s?}7Cd+~dXu{Z$yG+Y3dy!SRoOpI
zFiZ3a-4?fCH@hg=6Nf*4T;H-~x`Tr|cgY;6+^=eE&ez6#v^GRNG`p@sLiJ^^-HcQU
z_HlmKg)3-2V8+4wioAfzgEnT#w6KX<Wv++DA85^45-iAY%z~?0n>$LTLbhi)Sk<^n
zDt(we0PTiXxl;v<v?U#H=~3)l$_RZ`-kZXvWiVy3sXr)+LdJVJsLNE52}YGr?WtLB
zfo_jk`*e-TyOBy+P$b$S)QG80*r^YxJ7hC(m~NWjJ22|yV)|Bvbk5PN&OrY98?sqD
zRKeWcvRwung0I$MQWl^)RjIKe7fuiRPQ*3Ykik}j$v`72-|jGE-+PNXXjq~!4qA$<
zSD!3HChWZ_(d_V^go?qV4ad-Z^JeY)$J+7zD5FJ0jKMCrYtEBlUIqv}Aqs<boyW~2
zlob*(qxko<WAxPJF4vu_L7ZNhV_U7C$p{lAS75FSbvUIsrRZtZn>2-m+jb`)B%Sld
z0x0^jCkI!$5Ah+q7N9%0iaeP4<!&P^^<M+(3EH7Gh#5@!YkKtq8x|c2&gxBe6{!NH
zw4QXtVFxr&#-K#QM+sXHmPZj8vpXura^*&S1BO#-G1!KG<M^(h&vG(ZFI@cr7V_oZ
zDQLJP%#?D}WFV8o>t>g;Nt<%d8GF)AtiNZe`zSMS(|e0;r*1!dynqmFHhq~3vs<#G
zdH?!AsbccFb{*!kWf6^1-aK(Z2sO#!PRzKFmU)SUJ|FlCEj{^tNbl|?7}3|(L!B<P
zu0nPfob|>K?sLfj?%5GVGu<6;tuVsv8ArHI+D78(MQcL(C+=_Yl9(-wI*|L4qk2oo
z=sR@am-QT-6{U|$c8(ESTpy05Wv+t0d8e(y+wC~(@zb>T18~tDTP(GOxEy0Yn7htw
z!J-_z{aj5iSKG9!p#hd27TVq%x=f>Oroph?d`S-#vEf5^+}(m;6Mk^?^kGOtt&yT`
zDcW&ZuutJETB8$o&AlVztLjfCeKFLeb^`e7A1hvoFX9itm{R8Ujl%1KjpJzu@ob!s
z7e5+ozzjt^xUiI%Ol}gsTKp^!B&pw;ichZEbi@FArVBp_KUYC>)@-v+5|GC030zE*
z;58dLWI@c#<YVFy2vian?+(=1E~hn&H{UBh856;6sO(Bk(T7_0QjbJM3jPtv6wK`O
z7_b@GDeau_AY|h7{SLYPeCdG=W~S@xqFRiMhDm<)gfF>)OyRYYM}?OEn~|G@8Ikg%
z$)1rrIdXn0Yu5XE!(icL#Aw%CO^LMxG$cV*n`nF*w)H}3mY1**|I@}ucp|UWD^DwB
zB9^$MsA}3i<DzhpG?7UW>2bH6EUq)E8{Y~7W`F9;-l0X~X=r#?&wRNhFP8CVKh?u@
z5iHb7k8Z@Vle5)0X^Xu)3x;S!^{Kb|waGfS;OE7T$iDNs<3yfG%;!wtMQ+?ym&;cj
zICDDg(^)_=e%B7|BrM>5-*gPr_{82=W(8JYrsK2?Su@unaji8bbxy16Hl1-0yLRI}
zi>yBxy67O21~=`~E{TX_`=oV!hJpo%_gwl!1&z;se+#e_&GL?g(u;|Go1DY4&yqJ8
zS)u0Axkk%&#(zIn|7>L8$gd%s1gkljF8Ly##ioIzXxUd7NuhHGCa}GLQYn@!#!BzA
z7lz~E(fE;K*sQtlo1hmXxTElrJkNSy<8Drv2T~?HO5m=EDEYm96tR@HJm~Z6OQP-Y
z$~t)@{hN=ucJikhynB};nHCkiSVpR_Dj@adG1TrimV|FHU&bkxk?ZJl`|hXhqCDfC
zbs<<{3kh9V7v42;XR(w=Vz3W$blj(F-WKXTH1t)318o>bKbW#hZU?yGW_~M<LeHEF
zT0Q8><x25+`sx6@y=cp31efpJ_{ELIqZ`;~SlB%%fcCNN40=%Hs|XftmhR|hyAtXx
zWZUETsIP9%TJeA!Qz*@4vZA$-BB*;H4gzUyi0z-Er{q-Bo%*4i1xh0Jv!4=dqiGbP
zU(PH+xc#c_Fk3cR#_BmD$_7oG1M!K2+~iYO%elr&IhouqAx)kjqZdoIGTcfGjx~Pj
zI}I#hDHAKK_u61z@h{z>-VUFl*H7`=x#2c#MB#~tki%S2xceq{s2K5J;+^~;!K(MJ
z7>8uo$}UeawQd{rF0RP?`#4548nAq8Wd8wUDVHzpt%-<`$$7`Yjrd;FUU%PqgC!`T
zciA_vsfKv%*T$At7OP}*7?)%-jZQU+U#&!1v<FqhQ)0|2@5>kMxURTqKd#o6yrI=_
zG-Hp$OM61c4;zX@bxSC!4O{Tq#YDk7J*b5!-ETmW1uWsHBVsOT_B$b4{p0P(k7vZZ
zS}S$sR034qKPXb#3ePXfjgWU|^^dNfhK2`zHk%X?GmXr9{r#RpH?l#auOPb2Ab4?W
zd3Dt<z}XMKUq85`-J2v4^YSFfaMk|(ctt3Fn_y$!?V(X;P)(PY$k-3Eb?pUdXqsSR
zg}5ruR1q=rD^xL`Fv#;!8jTVhbFnrrRHwqx{@zngsLu)8)r5Jicr7T}#?(^O<nm_f
zh!G6HrhP6(O}NciGnYO6H$)eKHl~AVQOVNtAknoTs>#Ie@ap52*AiuEwvoZk;3~U5
zxz=2s>FuHAaop+J17eZ-y}JfU1&{umsUxRcOM=t2rd@oQ$x2S+?uuNA82w1p=C<Ie
zGk!FO{KJ^x=Q>LIU&`lg@V*1G#>}0&1r#4ubwf6GD<(ubbETP0ggsHkMwUB^-(;gX
z;B>b(nQNB!WQ{%TZ0!{~$>O}>`!H<sZkgMcOeKTl@&Tl23`ALq@Xc-ecSJ!;C3c3G
zEH!pNML>Gx)2~|8^3^^;1w!WoWemyJ*CMzjO9aEPtRa6GHjvyuWe?)mY7{4t1Q=s6
zDNy9-tcpSVxCWr8xekjM&cCpM-ahwPw0{oLxp2C%f=a=Gz7<bcDo1H_2lKWkddIe>
z83{KjPzeLTqym8#oZQZ1Tvu^I8^mj2F;Fv!+4473ape&U8P9uu;0GYiI$?&?XiTd-
z3N<@Ny50Ts5fc3)3Y%y&#ehT=tHSu9NT^IBrLh02TWm1b7)xkZJdVSIdeuX98xXF&
za}E-ptsp@cY64x*rBa(uVw+~+^hp(u&nEOQf-{PCf^9FpQ7BV@sm(^a?Ok9$S&H*N
zue~Le-03pj>cRCdeq%iJr=x-3{s$PlS4W%6CE>uD8K{rE1J?|tn$2S+rVJh_=>sTR
zhRs?6fznJIM%uyZMD&7B7XuVo`4hN6PwmG9r+{aBGnLJg2(-QfKm`wJ0K_EF=<h+!
z%2)OEkTJbYKHD+qxeYotkU~X6AQPFrpw|qrrhBMNx?caK&by5H?+`-(JQ+X+pFMj(
zTS-2d4l^h=fbgv)%ejAe^v+i2g8LVn<GJ_AcrTnU^p6u{ct$}MZj-<#Q3(JX37o88
zQQvN>t<Iy-)3A#OhV_~WZF;II@dd2$IRi5=0HEt%Rclf22O6k=ee1JhwQL`X@pk-e
zK`W}9n}lWh>vG&PR2y2q;v{5GIoD1z=JRUR)6D^&y_Va|2BJg2`qIsc?>9J-eyAm|
z`TTQ~K;Xymbb))LyyTT43@3l|<8<y*ulDNkl-=XSMjH~;%Xm+R9~?$%@G{ToF#Kkq
zwKUQTz1o+h)3(svcQHU1z!x~I7msUE9Q`G!#Ll2N=l_D(B#+aQ{~N0N|9=Ai1FGKS
z;ep&B?+CQ(^cmbN*uLjuA*UmP(f4Gd_VcS_OT0(t@6hM=7aaKxg;6f4-bq|ZGo=Um
z+(>FqAtrkR5W}cKUJKO0OwPSi{SzV*u|idcPb%iGXybYYm$t4~!;f5iAii!{ev%4&
zH@0G~Bcy(ogVDzlaC1xH-P7Bv1^3#+_hIt&T|(YRY&kk8D(_s|KLIina?0QiU&6>H
zrZ%X@q%g-JOO_DjvM0utiufw_Xfm|_Z2yrx!TX|l>pe-6@XO3qp?bs<y9MuHu6EGM
ziQk*grU)!lx6A-g`QQgCsf}CIvX?^W8IjBq117{Es(tvy=?$0?5QP+$!o^YDz8Mok
zc#68F1aPH(EblhtSnBWc9a%Y72UH})(Sqwi{loKqt@<Q{7h|rA@qtvoZg5cRGdgee
z{Yw1QL&mfng<5tQa1Mkpjd2A6Esz#Cmi<ICN(1IqS5^bKBy_^?>H{Az>x}<_iafvt
z03=`&G-b>m1g+|sEdm?In8m*=3wG{H^gUefnUl3xD50o?xy}jV=8{kcExwRHv!0K<
zBb|1;mT<lv?ct5K==H9`YLV_3ZViLqez(HPtVfO>F?>mp0rYpom%z7}YA3O=YhLSw
z{m{9q1Z)eb^8O;_Ix!_|F<yTAw(xXSc9cCMu-B8CCWL2KB17Z^3o#{)x_zD;K~jO=
zSZ~2#*9awt$eeB4L|M#@29vppO-CI@BQsM^N)U3Dx$sg7Z-h9dCA}K`jN4IU0`oz@
zNQPa4>EX`_UbrB-H&dUxj#7oY^c$U+3Kv-ODjA)C?5LKa3-({QKR@hjDFl0e*Ju0~
zcjBj8;NXgUVC*1AGhB-4dH$V)ln?$S2!)AstQ>P>Ih=-jvN>(jq%)7|v%_!vv)u+5
z=5)vWIW~Fi4n&kBqiV?ckrwFq2}QCjv1{@?Cf}|}7$V8A$~A}fPI&a%9(i%Tw)^Yp
zNTd4^p7XWN*we=jj=eI@JAzaKBzxcHi-cPjG#}LY&>!j<ih5N1K<bS!4gmB>N&<Wa
zQ?Pt{WN#z5fQx?{x6Me7i^{H#SM%KE9lZz_WwQw3pO*~mh}~D8KCb&jkJ$zQB<&nx
zwH7T+%0}YA?U~18+y=+vY>rGeu34T^hf!!NyK2+I<$#~Qyf1C>^Bc#qdHGzOT1^^%
z&hNH9w}YOUNHhlFhW-8q-&Qw#*Tr|5p@T3SUkW)Sz3-(x-Nt{u9X2k8czuj^w5EKg
z70HZFA!KC+d?Ia-K5l-EpZSzm4R^b2v?VTbw=!BQGHpfDgR>H|Weoa?YHHb_P{8Wa
zsIMg{<+sZ#8ijbOEIZqvBd|QkCN&b-El1;hfzqGp>!z#25l>4asS&91*_F_IHsAi%
z3dXHn&7VhX$S&ufFNOjUzrHish#g4#UcR>xS{()MtIdC0&W##$t3+Hs+}B&AUy0)_
zaUJ1eojv&_^2XBe4yUrp<(O@VpDOU0YB)|#MAVI$`0=QpX6|+8*Abu%*8gE`STgSM
z8|8AZRzEI7{&@OFIaZx3YO}CW^|}MoQ@GC*mXXQTHbF?w!Ryg^^$x@yq&T+&%ltit
znVU%(SL+*(m4@$pFXXE?lcW(UkHVDmW*2M#v-w%ARo?QBj7wLW#3%bDk{_A?9}9)$
z-f7@)^{p9l%lfl69$`DOg-lG*&I|Uwa%i^H9H$@GlxNi8LaZcy1bT}bg$p>?n`Uq1
zmc$Xv>pmjL)458<<UpIv_(Sg%{PH)d<jEgv3tau^*VkhBXPJw0JI9w`GS{OPA!nOe
zbfbp5?pkcu*LkB|)WTsV*CDm-DMsc`xWJRO>^4c>Zyb*7J^&&t!@a%1C#^xysgfR`
zci`f@^QPvX_;csuIP^3bFWX^;Jz-GD))tVHN_#H#8h&UfHkP;COauh-ZRD8I*R-h|
zf$+Db$7d=2#%=PYuIsCI2poxn*rF-g4V^Wcyc$h<PfT#>UsRs|;e*T1q0M8|O#fU*
zu+6t&)=%Csm6h~voks7`o6X)!f-5_pXs~}h!B5fCbFac%2k33&-XdGl#k3xLw-o4z
zHaAK$fAoRDcMt}sIjf$9pzPrE{#agJiJ}<%oO`a`DzacWHQP{-{z)8V&azyNbT>+J
z`(-iACmFi@O*Z-*t?>7ewvok5_0!Zki-6->{bM<ErI^GZ@v&B2_3iE2z7eO&Kewl9
z`}3c`HJFf!xy3&oOWHU&T86ftV~Sept)HWdQro7^FlP(Xr1wyoIN@N=scal3r9uz)
zbOKSZ=Z`RheYc|I39mf?Y#v0pur-c6qskL5p&kA0u#7iZxRIjv_i3HQI5{du`vwV$
zT=~2cxMnnerj@h9{Pqrlio)3#jYq&c7)L^WwoYGASGo9j>8u^F9}-eYp#G0Cr&_k$
zPT`m!A;!*Q^tsw^rZO9gD0)XFt`{t$$KIkjy6V?h<!9h6qDm|0X{o7g_A5=XAeY^q
z%b5~o)b!?I>L~>h{_FkXGFFjoSDCg%=_^F0p^5)wLrxPkDRLW$1YkN5Jy4e{|H3pV
zzXr+#cQ+;{io9TR&Pe}1VWy~?xhj5QMH3|^anOcNB=2FiF@zc9I8qHBqMM#g%>T!n
zMY0-s`b(bjP}>Y@3a=%t>Fj$bT5^wB8?pK~!86r%yBbJF6$XPfY@+^o^*i0=dyk1~
zn*_4>)^)iYpQ*j?dO0iw9stE`O=->=kh`^96dq@A8E7U6Cd&b*wT=zwJz`RgY-$DU
z;~XwoZMCUQ3~T5jWp1><>S1|}Lei#kmC$%hN9CXMi|;a(<rmJqVwQO|S*md3$Ab=T
zWlN!O(m8h%F1_Ey)P6q_tK>ga7k=T^9oVhux9h9=G$6qb9$f!@pVi8-oVl420yLgu
ze`ALDpgI>f6CPV{*2Ab=I&I3M!jbDe;mUnT;GTGMcJ;AL_%;a0@N-AF+^<0`FEVQ-
z;su_oD;Q`}znLFcY`$u<mr&mD(mNlB@>@_83o9QbPsJbS8`ckvH!#Pdgi%zs`I2FD
zv-ac3ZS2KnDXmpQ$#xc-b1b~Im;|{@qZc9yObHZu5(nW$=IjAD%)i-OcHjF)<#?ZL
zyvyaSS0>uu6>qD)G>sh5*#zB0FepzRTI%tMsQ-l>1l%#@pHlEZ1}mVj7R~p}H40-J
z&H*ZenbSKpomkAVbujETkxG;amFQEfpb>xLYTK$c!7OvwMk?nqgHnZa+ZpReI8j9p
zGi)N&dgaVG+nn)81w+IYYSn>`qqtbjV1LH;pc~#agi?W$Cxfzi&#!OA(B|390$x*e
zg;p)g7g&y<VB2x}*UiGvh+jho#+5J&4nRvsX(d;UPq6$FPV}5E_~ZnARSEt_ty-S&
z*GMXvoT~EYAo2co{_5$9K<rxk+pec$pNv5sSzs@U+d*XL_wYNM)cT;~LwXygK9U*x
zw?T`PB5nO$!F3*52CCSq_I!47ySv*A<BgGQyxIo$qAQJ_I35(08vIat{HWi{+`U`l
z<Cb9of=KZ-wkW#;jI@}d=n5lYudAo`rl0Lx6ItVYUh7#<K%>zuD8kVu6d<W(ic5bs
zzCHaF=>e!<*qHGDQTCQmadh3*DDLh~5-hm8Lx2$6-QC^Y9TMC%NYKU|y3yboXdHq=
z1HprT{XFkE<BsqAxcA)pvqyK0uG*uzYS)@;tvTnvgsuNK>f*oHz>Wz5@#64s3gRJO
zKp76WlO0VS{tAux?@WGZ@>%{&$0g;mmY5FIn_aVp<1-VgUi>*GE}glqXSyeVb;>x%
zXHZeCJoA+f|CP&8VW1Fcf?Eh`Pav9nCq<;sceg=MdvlCg7cRrdT_m-ZRJu>vk-u`4
zn8P(2VD)JlZsl__+5i^mr&F8vm&qlLei$c&KO>iP5@#zFf`0`p^wG=JR1e9qFb|6J
z(<q$ReiX06%pCZ-G&hirg3mJW&a&coOA##2n64GlMBPRYMO_4ZavJj||8zZTl>SeG
z<v$qkvxZp~)W?t=={m@}mlt!RJ5v=kj|)-~6kl8`&kqShG!dh7<;x7fh?-k51Ivta
z7iqxC$odRbM2;Qx_u((ii`^rT&UNK<4CV2UrMPRqG%|V<5bys5GU`&g$WCxuSc5%T
zT7Dfaung9#C2qdOb1psJR5s<)E@Maa;vM`{SQufKHP>2qHLeq7`&^AjU6p{^efmyr
zVYNk^dos8<BGKxtv^J1}Z0RRLfl;qtbO8$l^!z~*<;f=Wf5$%jFGwSkiyA<P+MSOz
z=7Z!uCq|swhw+#$YwYnrb*I=;=64qi|4J^o!rL7qir-7Gy=xU^usr-bn-tm@x~Ea_
zO|Y4$#r<#;rSco}i<A429;TO>w%fTDO?poOQMek$=0d+Z_!;Mbi!;fmv7Z-a4JbUH
z2*;0Ful5K2X3;!|Ix3kpLo*03NX7oWkQO5<5&=w&jluIz15~v!!z6J{oh`EybFomp
z{3a={hTaiKCiFC^pP+s*`2YWKtsRXc;Z-o0d7`=<h-V-#C%@5U>(6ZkCNEj~l0Q@@
z1=Sv@z^~T1)&31J=Bs%%mTstFOf!z)e7-(CKaRo;Xoc!(2v~t=9hcN8n0TND!euOa
zz0`N=ORWi?3K!KWK9yEOGX<$_{>+zA=}zpQ6`kqCsA*F5<7Q~|-g@eW`uY1pvkY(s
z)Jcg&=J`pkvy2~1ZRhh0bbxcxy^saKxuG%p?%$W=jO$D~%+8Z*uuf|T-t{udQ(YPM
zro(tHXdk1;8%q`S#Q|EF_Z5h)A}jos%^O8|wN8vqY%CR<T4e<_uu<6FezZWj@l7bp
zl2#{d>#q~8P|i=#)2QX}n1>Ts9c4<;KY-U`7<joM&F?0yXZe?z`tLjPe^8A7eF7BB
zYOc$Wl=U7qG2q|k21DTs8b2tfw#v4%ak`=n%SD|LV$B?Kj!%f8;ZVYClI6C-WliWQ
zKy-7n<dhR=-aB9$L?JwOr?x9m_KBYPymhe2OQ$tKEs|vT1K9mUmvZwl%}f2+wUIjB
zx)A~{WGcUgc$#9|Jh4eV3u~P^>w#;_1JK+mad=;pTG&p7r}eXaW+`KIQ^nJGo>(9r
z03xvBq}t{;+xca@%NDk^WK5;;@xdOu!o5i-xc??Me`j`6O$*7kDYO+mc=ut&9gpV}
zj!6CqyWC0<d{N|Ata0HL_*1RVB$eZIdKk%b$NX?!yA{S}tqE4!((Gw%)%;jY1!3W8
zxWWQgVj>$nXuEYXaM$fY?vI}WToZ&7^MsvmutM%Bb?V43nzu21s<_XHnxdV$8`Dok
z{#u&@IP+l{&g2HkhhqiHPS_Pl(0j^*VX1CbiWVBnteR?90^c#)SV4QTY=7qd!yT-n
z-Ei4~+9)M@W^(m?0h@5Uq75ES%e4G3z&(3Xj&bHT+Qejj_Ifwze^M5>KMpVqLRF*v
zaYoNtywQP054loZSD7?$Ir21^=r))68$Hk=7oh1_m5^c0WY#P;#h^VSH^sC++qA5^
zX(E`PJXeKP$KkQak=~$5semPv)<H8@>dvcKqYF<(dp+%>@77p<)(}IV<Y0C{FPCV)
zh83nc^1a(s0^2v$R2+xz?CrIGO|{!zaM4K+WohuK#BIT!BiD}#x9~m5MguvMc6}&c
zP~||%(u+?mTT9+z#3h+9_(Ctf&gP|~_$|*YF;B%@ejXLTca{>LF>dzfXRBe$Ns~3{
z<A50ET&)@Fr0|J~I>yM+=9yZFI<I1GK>By3d1#b$%Y;xs);e1D)L=T_i#e`S6NN~A
z@gedPnYjlcrP4u}*WkGAcVPr$#qgohSJA(*4vN!a%hTq+%-BW5eNZSFs46B!%K^gE
z9ig_5dAj!v$Gt*3y!ba7+vkM^RXSyGC+(0J13p|PyS4tIVyq<95`QDzx?UM8#;7xw
zH;NbGHmPBzTR>nQKHLwMSzb5|4F58z3~1m1BAF@VaFZ)jN;4*ztD$6CvQN~=f{OxJ
zK>@L#83R3iDc6hG-SGl4KD{Ea(PDJ_{5<&|k&dKAXk!CE5g&POOOZ2!=V?{K5~Wa?
zLnWK9f?mO+&<|WmDad9Q@n+g{>F1^-eXpH?O|c$^!k*Y2DUn`FI8^3B8?eyevTAfq
zkIU`1>9)L^;h+?OO`8DyN+LsW$xMNnz`cl(>Q_V2!jjYM0+HsT^*T<&k2DF`@)ACH
zs1rvUZ$|M!_s1`cYZ-Dv30R4;hp-C1(Pu%|9NGmp<&!)V8!^qeleBu!a%WI-Skl@q
zW*pBXGoDMYc}asfuAAo$&J7PrAFb-0@6@$|V&kbf&I}+A6L3J<HW;P__5&56Kkenu
zb(~Qopj67ua<7axyIhREqA1c0I`hBc5bwKR8~g5&OmIVJxG@?J{b`B4+xwX3RQkm?
zXP+84&gD!peZ{_xgX~6Jiy?e_n@T(vt(o_8!NHdB2ULG{o|aC9GMWri=}?8&xlt&i
zo%eGZ)uWC2)ii7!9Pp>+=3FVq(wE$>BQ`^2P|7fb*J*HA^GL3ko*9k2cD@W?md!M~
ze%4ucQ^#*Z=BRhD>2Z&j3^fqpON6M1w}fu(LWLD6Mw`zK$PX-r`-ly}1@`TO<UWtV
z9e!n6SsB&U9{)PZs)AVt1_z<CpXi32?ug9VwGvR7!Hz_3tMSO^hwCy^Q20l+QiR&N
zI=9Q;GGEk>V#1(_T>cq=9<N8_hMnT(L!u6=1Di_Hk<WYEWycR$wD^V%Z5t1|zXxwu
zEzVgSbQRmfhk2j}Cw_jgh+A;KE~LcyxePz8i>aMN7kmxlPp+bKmX>Yi7i&WCU5v->
z#3D|vH%TsKb79BFkKB75MIp1*KUxVvpwm1*j#U3wO}t>Y<Lr-JfmD$Uac_x<kuH+O
z5R?&&6GeBd@3q1ht1pLFAf*lfd*80!^>L>~2VmvqR|ucQ-(txs<2ptv4f<+E2+A_C
zEx$K4wW^ij@{+HDl!ewt-{D)>z9cmpgs2YL>^U^q)e~N}-8m_T`@n2TlX(DdnMyVd
z;8Ofn8qh=bJe3n-+W3YU$BXA*P+5-Sy@sWYVtwD0Q_CA!$G=Y-l1iNCBie(Mr;G&J
zI;X;5D3s-}`sG+mXtBYD@<IN-ehWYNMo>?yW9r22@4c*IDggdisyg7Q4Uj!~9<v~r
zXBsAa52exsBW@7YaRM4(M@X=M@x4rDr^kuvS{dC>Wlo3tC^!S!(B?h`v?mQ*0)ohw
zr+aA?l@ta20w;iW`g!}i$d@#&I2ACx=;jr-nH0sGJTZ3RC(z-h)}q6Yae&G+2e3yJ
ztB1*dD^<{Uk8CE&sJ)%gTr9&Zt(M9$Kbh3voM!c2w9A%Xdt)$oKdz!+5=W63>D3#X
z)BBh-_)T9PtV|0bJcJX&@$N3vc=&7uk=nkh&LNpC!QWiqf>w!kIlPAy5$3xZjT`31
zfw`}{Bv;>t?~;$=G*Uj`-d<5YwmC_;WBneeU$f$({x<otNJTO&7WQWum!x``zz6!a
z!KOBy9<S+vU9ZEuDeuRr{Rokj=6|2xw2OZ|I%vNe6sckDveZg>{xv-tAbf9}@-yqz
zwp<t&xq{qun93&7kIwvXGRL(f0R}pm%aL25oCwj(v@yZoIs9FT;*(KR<W+WP0Vj-+
zfCNPII5U;}9?GQc%5SzSwd5k7OJ}BwB9t4VdeDMjj)K9ye;C6z299-)wn>dX(^`Sk
zS=mXzq{7Mmb9ZsN+;(_|9|!w*Tm;&l4^=``1Y~`jqqP31Md0-}188Vy${Dqwl8czu
z*49wQ2^2FIPI6zIt+gjW2~T+?<Ea^0<yZm0(cg2{0Nr2$$~EspJgfUWc9)e{GikZ)
zM<<hDliUnST~pYJp!)cyxKeRnNFshUI#Sz9g%(F{4=%Be;wU_S8<v%uGdstKtpL3N
zrOd~;EUVp`5f#~YLC$>je=(W`pIu`A1Y_ez;JTL7dLML*K~3g0gKg(9YBx`T;ws-4
zjE<B=ugw(PS}~pq)|eB?ofGFQw1G4D0{zxvwK{2@y=9G|uhwOA%sZ}UaC|SPAnK;e
zttP+hzF*0As1$mZaccN)pefcGvkS6OZiuklTh!d_4!C3YebF)jANg<3-Ig(3w?*>z
z>AlA5T||RODWC#5+@3kTBM)}PeE0N;8_=DVfCMobF<<=<K=Po&ogr2yDF(c1ad*dH
z2+iBfm|io6<SGx%<<R^IM<D;pg6rL_y*re|;k(%rrRU(1){z!<_69^nl2+u%pDvjD
zire8i$M2`Beh3o`l|~Z6css0)wqZ#S1DNtflPC{c#E=x)byKXQl<90<2Y|z9&qNcl
zOu;zZ>wQ0%&|MP-OXKj5bal5kbJnuE=ZM~`Sa2-4(!trjnBJQvQUt+VELyTg7T`gH
zd7Xb;HG0r`0`AY{Nj=6=={QY+Fm_3Mt{xt{6T;q*pBDlD@u+0dEo%^)A~zd>AOf;E
z$mq2X%QIK0cf4?{XR>2Dn-3T`9j2MI9GuE;`{7gG){=00g$6*PR3)@mloOd2=ZcRk
z^13^jM!INzl~&@A*(@<YHXpV}#f-{;`Qw*YlquS<v|_70XCwK4Q1RDhYkD(YsUpPL
zsA-wt2EX4N3Y)9KP=6BELG4dOZFr1bo<BhP5tT?2`5MyF^C$l(^!yKoqX{u5C#S2I
z*D%!A1?mL>HJ;ht21Pu-dKnt#Yvyu&`0!yCU?#0ut%=%TvXIdOb+LeUvGTG6+y>xc
z_3LoTzZ8gLy~H-%YT%RrHt%T`6SzP+ZYXI@_96an?K6W~A{w|yGO16>1J){2S8mub
zDS1M;V@<DE1J*rWakPS?pcLACsU;~e^}GMD6^HZqUA}T!$g(Z2cY0h$Td;T-x7ezw
zdp`?u20#1u6+w4@p<|T(kD3Q9Yg(yLehHhM*XKz)dPh<(Ne3x&We2m6cXnRs|6dY4
z|B$Dk!7a4qIn<!t*=!_{^k}V}y(o)@kB`V@OMU4o19Yy^{IpoB_4gmUh5x;J$iJ|a
z-0-_%I);XZhH?4Sqf(`I`3v3U&9TNF)J+KL)NnBW1|`2iucVG{1b6w>1u8X=uJ!4d
z);b4l3iW8EmN0)c8@NL-@6j^q>iYz)?Iuj)4amF=SXF__2Tn+rvl-hlLR{IGdKGeY
zaCjY5M=CQuDSetf)Pbrql~&PhcFwic_V*!+F+uKUj=-N0x+K(=5}}>RpGKGI)YO(R
z{-0Kj+cyQUVu!J@v4Goegnzt!oHx2IPiz$w6zq~N$RT3hD@|5ukGdhs|4bL(Wckap
z2B2OGeN^#~wLc>>ggR8zy36;^hm8Al%c=8DpPKR%)zkogygOm!fTNVnF=WOEN3%4D
zb*{1ug41rB4OJ#J_GcL|u;A9C@lf3~7cH+hB&$NnE=YbAt*Ma5oSwKm6(F4-sH)~d
z6mBc}ufWpO`%5-168Ml+@4&ZX6jx<Ug0{Cb+r?@P{MI=ARtKr}1i?)a?M!d`fnbkO
z)Rz(J2=P2(DCdy&q(~mDl*=R8Y&~TP)zy_F4}eM`l$Mr$FF)q~N6e`_7;FNKM!vgX
zoEv#WHe0-#u^sFwy9_-LT`&6^IEx-~<GeuHcK@ut!vAMGQ#f2C(DiL(;rr5W#hV7F
zqTNj;olUxg48(pEU=6Vvpz|PH$9o3nh7XHRr@(g$0^>ssHVlEvg*JQjI*M+;$?{U3
z<3~N|9CHiByidJ*yGiDDboTvo?^>+0q@F(}G{BJAa6crL?(<?km?qYDmN<I|>Ihgt
z4Qml+b7J!8Km20lj8bYxr`D`CZ7l4&Gfn5y_ZrZkD*`}`e4#^zvcX>pUfk|W@q6S=
zo2s?~WCstz;h*#K=PZ7Uu{rWZ9xn)=cLdxr%2OMHT?zs(*F~|~TF&v;TsI3QmO<oo
zt6nh+y*__@uA)cNNZ9O_L?L5dI_qK=vCCAKhG4!t;%(r5aS94KEsn{$&>>3q69}cE
zNn-Wxj!@;%ELi!e^jhZ0Y`}Uqa;?y306)g|#$ka^%dEfi4Nd6m33%!J4sQLZbcm6J
zUqui&$eDX!C!P|d*4<4Qgna}y_KKb;Bk^Z<Sr<8u<ez4WdlHQs8YB<%4SYpCFARx*
z(ZS<JU3<I3tQCZmr8Z9m)e3B@NMV+E1%95_te}U`7fk*sG$NQ4GrD&fIT;K#oW1z`
zc%K5L1V-_TTptX0!xb6@#W}nQ?zGZmxS5HAW*HgYMmP0Bm%ka>1vEX`G_P3lk6AZ^
zHZZ3XMNO?axzp&-CsT8vo26`ylU`dks{%bIH#fK5{C!b%fI(NP0o7VgjzCWR;X`0|
z4Rm`Nzpv8>Iw3&z7NnfPoRRzaLXZyFr2vb54AzdB4M4rgA6I=p6Y%_wG76Utr8h5f
z-uGreAI>`@2p?#z%@S}pDZ%f5W9xUm<&qluVg~cX9^L=429qZv<d75)xu50!C%$cq
zXw^|aD=kyZ+2|hBhltgIm#Z=h08*}Qi3}1Is(Ibe<f3w828n#9W@+?aaqX<{Vj`*)
ziq0Fo2f6kMucCf08O^eIJwS)v1@ssg2Ujo*!#mi;r5E7_%TjI*XB6OWCtw7#PO+s3
zHo1=xC{C*xut}40g6PcBD21U1X5Ba9nCApJ*)Px&bJrU1V4vP?4Q*T>7Tfm`Yot5Q
zs!kED*oJ`wFbz9Tk~YvQOwTerH`R1aZBSx51KbW1h3Su3KQV*&AJ^$ww)`-C*o{H7
z3%nu?;sDgt<rJXrD%QH-85U)Y(-BKubVV*bo8gVrmu=}IVJF}QbBbxhkI_RpegaPk
z9X<SIwg=N`0%1kt9Z*cRi&JjcFX4vWgOv#mfbLApgoaCDcxpVIv#J5BCjEz~Vm*=!
z7+xiszfaaQrz6G`LAuffblU?`4iGVS?Dpxcp^mwOs#1p_LcqjekC{jiv9r;i5zini
zkwnNl+jeQY=TDAcFZj`A7GQosN!0|b@>Kiq$VR)H<BR`C=3`7W$oh7c>JnE>zY0~g
z`Fu&Wbp-igAjgy{esGF`>P%QKA*l}=$a;=<PqYIqA!jk#1KYITI{ewQDbnJa)4P@^
zx!}(L8G}VW{b!vD*qDv{uQEVOVEvbpi?u*RGQ4rO!!P5fKyChk11;f3w|y+IUe|}B
zVgt!P#^yhgMW4=hZ!)I<`EFPlnqmjfxFkX@qe%-sC4#cZf|g15u;j5qK_qt`Dcd7s
z0kcbP5{&y=V)Bvkm*$4T$4P`(BjAvlTnX%>A50e0SKI>qPUMP}-DOODa&UZU6pJCO
z0B-Idm6cybL`6$VO9yr;>gtl9TGIVm`RDyHH)(Hw8I`@938KzTXi&i}*pMk#Q2*=l
zJ#N<5yEC}%x*q(cRez58g|MznSd3fDO`%MIX4S*BJPG*~9IDN+pT53m<JBjsT3S(E
zT|)GeJwJ6i-9N-)^U+R+*8Q-V*o|(+0>WY9FU|@Q;nV*S($xA@EaEKi`{w{N)_vq!
z<6+>@>s@?KEL}}{fkmlH99C1l!BrZERk=9!*$TR&{jQ-CFI?pNb8$tvlLGu~0eMt(
zeq%{S(68WB46uw!58%=e&%~-G<1UHE@Neg}6NVL$z%M(AnPeFu=9^v^LOME@6<;J7
zy#h-_<^g@{Fm}M4B%|IQ#%B4klC1?$+ZY623#ph+%<YPX2r{OOjwp0i#r+u?!2c0w
zH?>Ne6Sbkeh}g@yTU;?x7$HQTL>@*FZh10=FR-UI7Dmw+f=e}<!V<t<Co|KS5nAYG
zgyd*#2ED)EpCq#@UkFFLS){9d?sqUjgpgJ9XVpGx#5CaB(*Fid;Vt3=7;;&6E^_kJ
z6-xLPC|L!a7UT2=bTBQJ+keed5r7@laI}ILc+?I*n4Yru%G~@Z`4bIRJYwmI8`*PD
z{52cV)FhY!Xj@zl?F+d}Tr95OK^h&ytB;+E+JM7e{Ay)HLXk*^Y;yIhcl}05RZ5!^
znJ-9)S+6*M^*tZ07|4|f)JW>bp10HJ#<+f=Q(E|{s+rGL96zp!lYUrDUL1PjwX`57
z=!G(l=a1vFkC1H0EGwUm0sb|H;I|Q{dbpLuq{)yp+&jycPJj1~p$CECZWCxpLpce?
zoe8U}vxw3cs{GKGCgi7}Dou%q3Z@mT+Cl`wN}7G1nUt0?=Yl%kgkJ<*1gzUBaPA)-
zzG+ddQM;p|qwiAU?oL%_|8~A<9Rn34;<Len6KtEhgBu`wO<v1s3Oa0*Y<b3Z_v5QZ
z4xv0|!{wY3CxAWm-6ouGo!#~glm6u&vbYopEq~Y3E`K*B^-$X5`kgzg5`DhAPsXqe
zHa?~zO-gw^rV$WSl5w}c+j9Q=9Hf1E;tXd$udw6xC@_-zh$nY(SXPO3<oq3-51#`y
zSa~(m1)&WIwl_j(qRw+B8J~4l;?O{uM_Pw`R%Wd@*$q9cN#I$G&q)3h-rJa;T8e+J
zy)+rwh>agsLmTl1p08ULyR}iEk%ZXiEOG<MrML}Ug&GO;MFGBx>5c+y#V!Tdb|pw5
z+*DhEqa@T3>zNKUnu%^91>9N!t(PJ7j-v_}FalqH<xhZWVVqV?tXyK(Kac`0@;j2F
zuk>w6FLtH(V=C9)C7hfVV@dLF_#pq%BPYjb?`3~b&;1qG2r!fdvYkiQr{WvWahtwZ
z2{`#77ES|yhueUL1^Ls9z9S<JGzVH=WY`>^exT(b|Ivt<U0HWS1U#4AE8zwEiC{FE
zb;b(zQ6RfyxSOhQnZ(oIDW)Zqh@J9)y7BexohiU9U-B~INAkj)-obnC?UZ-yEq@3I
zp}fVbV5W98#pYiL54<3EUBQX<I*|SNJ-~d~q4IF$(_t1q;EWWY5%86oB(xm4Ob~FG
zr+b6Ur+4AFgR5pr-dS4sZu0K5EUo0&yQp7WhkI24r$QM)Z><dhl8SNSd3-{X#S(zD
z9&2Igw_Ys~w?1$HT$+<bHL5HeZ&4R^Kv^2oVK+Um7WO?ah=82ha2mmaG3E)~ZYY$p
zz5t16k#D<U0w&rDD0IgyB?J8YF1OmS>AbwWcg}1K`$Npj5G5rg1p;21zW0Yo4Se{P
zo;qwcrK$Ju`buzd=&3y$Y51r{B+3^{(qWi%V`^rGiLN0{;r|s=F6e}Gt}myLkL@wT
z72UT!gREkz_seWhFBXzxkdu)vc`j&DmD+%f_G<W3({sI~(kOzqW>)-;;-W_9Z$P(h
z2xA8P(?QdZSTkV7BWCN=9x!=yk1&`5yiA<?J~#MN-b6R2l0wv~CA>zEC<F{3^N%KK
zaY3Z)#&pd#jq|tOz!xFbBM0W!+f>!Xcc(Z!d=)T={RGpN+{TIQJ+gs6%UvooSyyb+
zmgqzO2%D#gPYz3n39p-zGx+lsgBnkV8$4Kd+10{QRdqW5ury0o!;=Fux~aw9JRdE%
zzXF~K+fQYFro2mFjzJx=e%7z{WEG<g-X+2E8xN&y3t(#pkmfu6%HZ_57TsG1Ck+}m
zy}u07z%;eD#?+98PoxyZeL%>r(pcNZ<>^?^o9=C%UE+-@|AClJpFFsEI!poHRV13@
zwg$3=U)`itF*t}11o5}rvYOg+5(?S7Gy!0_t>{?5=Mm92vLwtufZ?m<^|diWz6YM#
z(KAYXVRb3JbH><eVeBP}+m=>5JV{?c`GY86zU%t2P|EF;;U^P!i7nmZ=pg~p{2KK&
zQxQLQvcmqziAm-v<zs9JCw_*RyqA9Ve6x<m@U>0D5s9nYF%Jo;{?%cN<BWnPt#=wB
zH7eaB7OPTS@sEpm_i#aSyrL!uEYsM@bTGl^Et=MEC-bUpvc@8+d&Ddb?Qw*fn&})~
z4lKxRU74izM?x6j-9%#f|GNF2zNx^xe6}ubtCxJ8xZ9zP*?LCWxH@y8u{tEUlaij_
zl0}s#Jvuo_4WYRx+{6Z7Fd`YYP0|_Ir(WRq{1pR1^I4`pllwoQHwJ`)0nM3xtX)+R
z^U78Ptj|Q%5x?jZXUx6YGbc{JTS(~<^&5ICZ+WeB4qR^XU0G-%*JRZXTf{HeG{kf~
zKWj6w`^Gfip&I{oEawC%<m+uYs^NO)V;(Zc>rG><I=;s@CXVoh{U!4h9wX4)LV84w
zy4Xwg8^J<5I_jfS#cp_vFO3s_^ZnjckQi$MX2D^T|Ng_3)7@qsC~x0w#ud&HzhFk{
z8y7N98yYdZU;_1YMOf>?ZAVpbTdfUqhLtv-NeGmuw0Pq2^JE4hOOrv|Ge~~y4@m>%
z4D;C(TNOF>XRHEyei05A8%cAx6nEuh2^f$>77Usvp%?zf^voB`YGl-JJzfmfj=r*o
zCjQRpl<(yqxMp01*nEU)6edUWML8+Jo%hqb!M>F}wUgsSp;JRw2wM1%Cy_zDAWv4m
z!fiTZ`OFrUhM0@y9XIPZbmN^2gdMU2g3)9TWNtmGX5a+MwpPp36}S)P$R1Hw0eIff
z4tuw}Lq|n?6aMNXJ*)9pX7!_tY@y{XF(vq~35s&vNX?b2F8hW;=JWkrD81ssGrrhk
z<s0x=;?ZLJ2l?8euA9Oev4zsyC+pjqA@0DpGPMQ2xLF6`%Z3*5AzNG_Uo0E~Dw#L$
z4_tM!nU}n@d=z<UI<&_w#p^xhEv@KV=TGG>gkYDNyK3d5phwO=iaV=@=wKlN&YQBj
zdW$G!!9V?kxcP{;1NvVn78~OHVkUm^m!qSIH-)O;o-7ap3WEyX$&c<A2QS+h8DdPj
z-zp#C4OO^dR<vW~&qsVWIREP?vG(hXuO#jSx7LYG@Vm@#tsNpSE#Yq3duf7`=hVAj
zYM+;U8-`htTdMXnI);WMS($(i3uNbR;tOXy?bT5`f5L#lO1;2yc1G7PMXz(A8@am?
z8HGQ<&UJ}+oq|2X2MUpU+?6d@&#y7kvqmp?TRKMLDRulh(j_8d@!bjW5Q>vHhP?@v
zXS^*X*Q?@9I=a!f2g)~y-IvfurU%y`1vJe=<Gnm5H)6naB}|^v<lKPA_ZuS>YFa=}
zww93UB${=R`F=kqZgxMFX<Gb`GkBSI7nD>C93k02>(a-Z)+tu!SwBU1)0bqRwRt8_
zKznVKv2F+r&^on$kctD@01EKrfk=uWul+~1NrMb`I{Sj5b0KdOt!Nf24NNp<EdzNj
zdC%tzB;4K@MR+3w`t$Ng-jvZVYbuvdZ%^VFZ+kx3fqK?{YcF@prj89E!EpU#T&4H<
z-@LmY+%jJeZTcmBUbvrEw2<5wgW4C6(IMEf2nP+AU`4q6;ZLTou3>e>VPCb=NvaUz
zVDc1jXW{9P>?J=G6VYPXcOpsXtCbcL@xUyG)0*BNQ)7awRDg+PJAYOkQ;2!Fh#Q-)
zHQjhRzP9QAd7^&iH`WqAL%d_lV|U$0)FVs}yl?m<Sa9|GE6uva31cO>!j0G|V%ynF
z2rQ9zc_k<8o1it*j6;Lc;K@Q*VD}#olJ9r^L9Lm{3kCTvc!2&d2-c`zcv|Re%%QVE
za-io_MaP40eTNGj5dV89hK25f?N)hn1y(H1&nmvnza7$>IeTNXIW>)@yt$CLpRUen
zz2Hr+g$JY<Z9+od{$5gVlj_jUoC3e>n*F^TO~WZT!i<P26yX<#5WHGtV=NM`eEWOd
z5EAXSaMu{eCi08F@zlGl^Lp(MUDo`T^y7BuhUP1p4ttcxVPjL)%paCUC!ibfX@Gap
z)dli;h-N-FGIX`2fN*e+<jr}T%DuLU3Qj_#6bN7p$IgJ_t<U}hk&)@iKJeaRs=2F*
zRxocK?W%?7q*V*#YS&1nHb~-<UdpTkG~`II-q^og0zR<y)nG5K0B_TL)UsGTILNEA
z_|Iw5FcMA@bzH?MBlQndD_|f44D!C)CW0RUE1C^b;Z9oq*vi!RQckidAFB{CBR!*4
z5R@r9;Cw2AvUW~&;!YOtsqq>TYX)-?;;M?Dn`qy?=&cn4*;HWMi+B`(+UZbehYie3
zO&3eQ2?nwqOBuPf|83-t_4|UoZVh8y2p;G@J{adC$*z+z5QP2MPE`J2)O*N*eRW4>
z`mK>^9Q<Swb)AFEx8_p*meqB#&~eWzp5m9#{Fsx~+C#<Jc&+!+<kfYoQI!Uq99okr
z>h;s4zFyZx;Jv=FK182&R!IsQJ5c4B7mM(s@!|sWaH;8X<K~m2b$uf;n7Sve&1u%h
z->6y6l<Bz72W4I5=<w~|`zPV&uV}Itvd>rm>*bZ9elgTMYQg6dc$)YCJ#vagrK+IG
z0E%9q_2%!^8$FX*tfwf1O$yV>Yo7BnBk8rtnr>_`!tD1?iUwz+(%-mD`7H^7KOea4
z1&e<uK`7Ld0=FzmcuP?XF=pe`5ERC3)*R7vjEH;}n`A~)_lhg-G^i#T4xnM}Y^L6y
zp!e5!D)Aq8_XYBgNfH>RrBcuUnSN;ttvQGM$lln6R4buLmA`TE^Ao^dMI7ClfL0Am
zSay6xxqd-9>Uyx#gkxMYf5!Ky(iiyPx#4*yY!*7~O%5a%Zt<#9j~+ymBYz#(a5)$t
zfXi`lUDvMg2(N<vML~3?&}YY`XcHYQlKEE{N%@$CF(Up9*IAHXrzgDan9DP>-TV}e
z0pleQ#nJjg0v=S44VJj8qZBw`Z_XrdN-!<sgdNAq0{}G(;JeFf@nf_*&5mq}2Eb;7
z_9(@h1_u_;-y2<ZJ&SzM*c^?bQp8_KnA`nbQLr6}@$>FlfnX$uN?VYh^hb5-jZuVZ
zjb(ePFDRiH+rm?r+X1@*VpLpkn==lL<J!oB49b$6@YL|`-l&F9U+Lz#G}mSRl!$=1
zxzCBzw}{g*ZKZ6i#N0|5m&YVVBL0TgLbW+4v#bwOBo=h&W~-WuaYi1HKM$Xs^7Xk*
zupHmr-6<u$LGVddStU_nGxqDaXNMm|PyZaxz8CPPD;)Ga2jh~6-=VL^I)d!+SqW5E
zB2VQwt>-^g<x&jD8hD(4n+gr|`$mI@>X~w1Cm{m*8rI3hhiA}0P{Mch{suB#9HzJJ
zZrYr^r@XpU_5Bp^u(-KK{9dF!ZSdiEpP58@=AxNh%T*lEMh$S_7Uo#870U&CjWOMW
z+mMQaUlHpmL_Wat=}kAbA3cO{M!vF*>^9kul5tINc>hJgc+ez`T6BZ@B#jaynL+7&
zj>by&&!`8rU7=`jJbCc-WqYx$3oIO#>0|>mxq^T)6mSeR&-FHwWAI=6dugx-Z&C4j
z6b&=6`On!B-OdGKEyq>D4Dm*Dsuv@*US^lymtj^NCks;Vkd@h6hMOycfYus)*7n$=
z9co3psVYwnK<mRJMY0Gt8u5`qAQ37!e6Kh&l$DOLH^`sCv^}$Tpeg5?!zC9U!^zsL
z@H9{pZ<1gFgDL#DZH&nFU2G<zQDlHFjUKz;=P6$q%hFS)oVc2APA_3WHrUEYOK!~m
zjcru!DDxYHNgQO{VesAb%?NIBb<fW>49h#kD!f8uFcy^jo@sQ(fBt+_erh&``AX=C
zAK-G3;LSw>(8*1ac6a7iD@GgPPAN&4KK|$sTDY&><ziZt@xES$r?|3$5TD0!Zs_E`
zKN0hAzT@`1;zx>Nlf7O`s~>$XMY0iTBVe6$?9g(CuT=(7lzG;VyjD?FW(p79n;X_(
z%o!fp8(30~5RWF7<kXyiDuN1jdZ6R*5>8RBuB2;6dh~wsolT#LUhR-}^_RKT|7cL0
zS^w+nw>Uk6@Yydj_PtTCXegSF!H=3w3a^38Qq*QOa<E<kU8as5nXAC?esD>&-Y<lM
zM~HS)?!7yD!BpqDjT!!T>EzncmsweReh$45HgLX^w+NUU*U9r`Dc{{Tk9FTw8{v+&
zd02#f;*gK%EJ=dg=>Bf0T-X0Y&Y<XxGe(iYX6_aW>l9-Z4M&W#hqP-C#(cGZvhDZN
zN?(fMM+>)`$xz}fWwV`E8_VPNLEjFvCTRLb<!4m<!~3SLANX#bG_pzQN^<04<|GGo
zog+Hu{_f@s^?tuflFr{BtefRuS4-Ze*&a=G{Jj26HS+H7_7~s3<Do&`aWsX@FnN05
z+i%|hTco4y$Z&aKohNn#MCY+Gt$`+ReDYZKs9^Qf`L)XXHoz7GkKOR@DOf=~)`0Tt
zp;`|!$4^yzIV|p*pkrc-+ofCcM?l_00Eh8f7`w>8cGr?|5qvjeKc0~ODhDrDL_z2K
zJMn4>1uy<YPwUHfwAk8;gO;OquHO0MtuMYEwg|l1hwAv!n)8BQZfdIBfHTois{=Hw
zb<w4YkHs_eCoQ%)?0Y-n6NO?!T?=Cf%Q_@w!tiIB*a0ptu7e_<%KN1hexvI;VoEyv
zf)Y&CvwjI$F;SdV(y(1m0j+_;N3~OR#&=l4zyJ8J2Q4LzGf2*I<YF*X$Bg;i3ANy?
z^O2F3#MV!3AD3Dt+Y9w`y~pL|`&%3r`Vl6tHD%br=AvD%SKFUkjdCaEOsDxTM`v>;
zY4twP`KR;Xr-Xfq*j~UnqBnnT^SBw;z0j8r;ee!9DqXSW+zn!-ovpamB$^i1%vkum
zRXl%JPQ7xkK;Q14Tj=O1^jGh%$WIT|kq0m`mo$ni&SL$?uh)3U#b&@9{?vdAmiEEH
z(Izu!LXX0B>iXS8H~b^hwQuL+4U;X|**@-cc2w`1GG+Bb=-&in4xc9rF^u5gZ<x@A
z1gz1qn_k7jXs^oopC2l*hVGI$csT~D)K)v%U3lxC+T2Zx3=S5l!DBZ*lz3R(tSTlk
ztrW8|W+mC}w}>W53UF<P?y3s^L=Br_z0`oBjp4xiMIR(@4?&RT1cG;s^Q8}{l2`?#
z(FEwO*5_PybT#Eh4`?XE4L8r7Rnvu=Qo~nMCORrJy8g56NAvBFa7ifFyodsfgy3Us
zb|@kceSAuFRb@vC3hN+O6{?D2h3W474mWO}TvaNv^d8*2ixi^Mn-y9hjsnPu>fO{N
z4`Vl&Ra;3Ovp@MrN76>y6FSWVE$4~PDB`R9*8i!0J~HfNd5f#Mg#gW~_ILD9pQebH
zdH4f>>Inv5R>5J_`RrsSA>$(Lc+u|j%b%7Q;HVG4Hj}eBzHuFdw&pgfkgVxVlhMMp
zXi_YVuacn_I3~6Zqg!6w9LqMmpuk79SE@W28FCbeJ>2ENSaL^;Ba%B9hd09498Z&S
z<1)T*Y(ZhP#7+zaz}WCngu?oI`qI{hfk<he$lK!!?nsWK3_~mX>k@C(*Qlw`vu-!~
zbD6t#Kr{75=x)<#Pf%g^l4)50UOV7c>mVL3V5`plRk=G}qIW<M9i*~)xwpv1vVuFX
zHb}AC14mW`pBi3v-e_ClU#4;a(zGG26~RfWNaRygBWFN!+|@E`La{CdVuhWqx{eL}
z6aL`=%4y5nRiMczS@99BLzZtAE_elpA+C&4<^~VJ9%j7Oxg>)_X0YbxMZ>a9SNcq=
zJKH@8F@#gMLdgjwm_3dP56q69Z7~avdEg^UP}qk0e56d9HU}U-I$N%N+nY8T`(bmd
zm7u=H*;Tc#CkRo0RS4`h9x_|Zi~-K0K%Mtw3otQCOOGDw>H_4q;_f4;XZkpHp`#r?
zS2VHdcGn(K#$OS`g8djHgfn<EyiK1pk&p5OKQK0C2p2#<o1uoiW~*S5C9DE`zM;3Y
zI^sOGytZm}KZb6=?dk>04QwkAHOzdQn&o$kSbkOdQ-K8wJ>Ml4DxXjnz<Xm_v|kTA
zD~gr;93%vP2e)fiRdG0|y`?WSj6wWkp?S>;E#z$?e}bxL6Z?8h*zf0TSFQSy;6>Rq
zs)yLA<a*~>tYYvm$Z#(Na}@l=cqV*@>w^A-aMR4gH0{f?%fQ^3$O)rKrd)_H1D1rG
z0`llgUt~$SBPgZ2#%4$6gHcha6Ql(<3E^|wk?g>R!R#WR<WN$ct`B`u#NB0ibKsuk
z;oN7aOzD*nb18R8iG4hakh3*+Q4GD+c97c{Qwxum>k-7G&)b{wm-vb=W<w=gFOv2h
z!x-EJ2>o7EAh=)qATm?&{tp*ClI&^cFs17OPygl;&9~<l-ev$bh47?Bd&9<WC16Mt
zD|h9f=bf9OQ9sO_<?-?-;sN(DRxu3YZ}X`97Sj1$It*x#_(-gdT-)7xpI!t<$$wBA
zbp7uxzlXoustb*+@o@uflofq2&yyJ+r@P0q@jtXP`W~#&mA&Wc%;Y>=ZlUA)`dzMJ
znzB2L42})nXDgkpv%}}_yYW+vemf&Y$H&a7pHi6q(V__zAe!2^fOroVx30{x2~?~V
zI;;eN#Q;_ZNi=8{;L6Uh6c3tRAh^e%{&Zz$RGJzPl^~xzO~({vX9)kxg=|@3tkM%R
z-I2;0Tb){TbnIn$yS~^#C(Za8D=SnfH9{Y*E&cn=-LWt-Bs@EiR&?gLGCW`TTa!B!
z+@qTE6ZA@{Tk_$Rx%+3}<S4klwuNp)RHy3?iPy;*)nhD$kEb!AOxFEWIt!#+!ULG3
z;Ruw!tHzsoX}Xk>bTi}qNF3IR0C`RQC$0+edQ66W5{1HV`cPITxaMLPcyI)w^3Ff-
z_P<arr!IF~nEuy)V0oziS15@4uK^RL^&R89UJ>m-k^Yt;v=prMfkOdE^}qQYDmdsr
zr}sEEK;+94X32bOGhgU}qE%WV78zaQr`}JdL_;U$r{>rQd<G2N$E;yfOG`viy!c@c
z(y)96Nj2E>o^P7O2^D+-fE@hykFdFjmOI~Ohe8WhA}U1m_PE>3btuoUBYE>oUg=Gn
zTcO$72PPAii-J(4`!uBx75B^A*0(RF&35Md?yC3oajbCm^$07g%P#3~Rdl9l|3;nV
z7xs@!P>2l+KB~U@Q)E8c|D_JWVS%&SHjwzj^B|)yOHk`q0(A&EDv-_UI>Kq^y0lyz
zpb&Z{n;T2l5l9FyU|ubGZ6rPUQIAauuAPpkQNFS>#+bFjeeJ+okDZMW{yGWsKvsL4
z57GZ<H^uN5wQ(ryiMf)7wqAh%+$!(JQLr0Dwi@i`h?*S0dlTU$txUcs#w$k%e+;AQ
zp=$%PmRUsm`EGlTNqD`C`pgH`JIJ4oKJXGXI*@IFxJ=Xa(!ZVs;n<W6#$FNw%wl<r
z7Q}0b6T1?4mgaC*#)BI%@HjgzT2<-}O{{!}fd)&okI7KjcHEs0MQyF@L4a5HCE=+-
zYoIqD_x8@GYmHMY&dvwUa2;dr{a-f`ZrmBnpX(|dJWFZYBM!Cpe)e?ceK9HFD8tNH
zx&8Rrg-k?QU>}(}H=$cCNmGZgn(%iKzXoOPYiX@D6<bDYnLux5fXiX!tXEVU;9=TN
z>EmYy(2J7>F3v_g5|csNLTFDqSzqt+Dngv4(E)=_NwQL9>R=aVKc?T9XVRoM*45G#
z7D+PT5LiD}BE-Eqr#qXxK2&Xd;p%1zPsiwmFl<fmou}*v%E!-DrFZJR5P`7H!fpLj
z!-Q0f$Ht@v8O#_b=6G&nHvydr{?h#Ii8k`8zVHrv0{Yg{!aKq5W2;jMbyCLa+@L0^
z=r0=IvX(#%XGZ|STLkD@M&3PWnd42v5M5{^ZVQj>nDlM@zyd#CFM!4C@OoGxJIXjy
zHwKcG@sSSbUL(Ya>zxoN0ANlvP|IB%mYk~HU(eF2`fg**F)xV(!LY95dw1<e*O~)V
z1hOeqhZWY7qwTJaRXfR&hGmE4>TNu*JAA#YEo@s!XNEHh#23wTwiK)TWc<wREWcc-
zBkl29ooDt|m$tQ{R{4l&s-o-IpHX6Z!JcXBXQdyfZgUUhr@iGTwO)DApRu*OoWsm`
z-Cyro;@|@cI$^m`N37z`TxWS?9v8ILn7e7a5Oalyeg;V1i{i}3tHZP+IHvyl3cfK?
zy1;<c`xn!I$eHW+N@M<M@xTCUOnL3>0SE&4YojtJV8yZo#gE7m3v{-D^%1kn-jdRE
zc_v2Ktb~-1EiVMDOd?(1-*oMOf@8U4$===`0;cL}-PRo(q7`zpi$ShA2X|9yy~r^v
z4_DKBGeruEP%`geGgNvzUA31{fNMM|)?@nhof6+{<XOuvaC0ysh9TDVomLM<RP_S|
zWUCK86NwC3XPl8X{oR9y>_au=n_(v)Fbt>cJmKcLOqIA$Fg#NupBNoaYUH!5CUDI7
ze%q>s0-UCnm4hhS>sK{1KJv+kq56=7<@V-l#sadFjA`=&Sojb;=zS+^*hd<ZLq-N}
z+a+1*655%qgTq?e7FFPM0%1Ao@1ZekNmJdju>YZNGnte!V#D!sXLgQRzJ}I9PR)0h
z%D^qAd`kt2v<lEJn*}s-ernJ`6t`KsD}PJ6qU)YLQ}u_z#?^xHpD`md-Ac0bzkDL=
zO=NI%BE63nMs+)w@f=~lhKI(0UD-0QeZ<88g{y7&0qs<g^9a1@xQm2glpg;0(@#9^
zHP1(i4lH_JFwBNF5?;@mSP(G!sHvz2enAL{ej5Gzl;Y>-Rimn!JkTHwI&7ZNWo+=#
zO5kZ;jg7@g&l$MaA9JzJ=Q>KFl)Z3>mK7bc;!d)PPyarzcsxvWljtyc9k?>c@9KN&
zuFKLha%e@J%j7WFwm-q)^@|3}A;s&u(Q+8p(WDK7Xo6aD*p}}^<5;X}w~WV%+TP9p
z#@iZ*epF+>JG;s7L8Ht6>j5bSAunaVd&sotPZ_hR|ExfQ(A5{Z0_8$8l}-p0tvfUv
z-p>e%xg1y)BZ;3#^%CN(knr09O1E>`O8cna*OD+*CDza}TedldQPZ3#O)aXhW~%5d
z{i#Oei_kVntNf@?+AY|P;oFk;ajAB@Ti>B7JB0u3-e0a~ZU?x?@wg^D{KaFYwenI6
z#!eBqJ97TWH{})nYiYD6Xek=0C&&?OJUkmU`bW&#CYD7gOK;nUPteU&=aYC?b-kc<
zLx21irtTCLh;I`hhgZy{6f0iWZ`GOI9$1zK(lxD!pz-mT)1HG}XzWteP?IApIP6>}
z)%Ko#-mC;?TfAKAHgyb#^-laEV9dD@DU7lxO{Rl5QEYRpkXAo7`;lmf8j(|R=SLBH
zk(CL51f1fjb1H8{7P+V_YpXYYqR|^fHmWr<+X<a$pP$p)M6@W+@pRf=$ua7{)trbK
z$uTZ8jyaWNeUV_T5^ErDdvsn54&TIp6Ase?v`rXW51e-KC(<+SAWEuXfO(InRNFTq
z>EZk}oP|C2iTKcc^a%|@k(Zy%>MA0O!EEEFk$szRi>brs?8x3;{=}M?8?%$O?p=3k
z{OCin_yBeaP~2KMMUU|*@%z7a-56keYp6s8aTXujaIWa$+`EJxt`e->bT2cPGZ<lV
zn<|xA+EdDoR&P$lN&4OGA6d^q?WsGpl3_;jYs&fuAC>T^@z_-mT0HBHNk2>f{%;82
zXx9AM+>4#c^tdw-6jLfg3*SbyiW-YiNRD}<_G!&o$lulxW)&sbDCtIiw28V9cqwN^
z0sf`(A`@2Ua5$a9zdr=>bNWLb7Q|dyXmWk@L4nrNyX3@=gT>H$S6%{RoTkULkuJY|
zX5{BrIXMg5IZez;DAvq3k5ydFf?W%P&&xQgK9w9Alu+d44K2&W`i-iNG4DZddmU?g
zTnH_-Tx)$opnZ3D087!8HyY+7FhHh-s>YG$fs37~1i}x;MGsn)Tt4}j1=3#}D6~q3
zv(6F298RZH6Y;b|Z~YNdh;Gm__-Pr>DSb55Nn9TZvJNB%`->GAY^S6+0V%D`Mi~Yz
zk40NF^oT5ax>JjD7p8>8GvZ_fdYy<p6Kz21PJGCB2_6BiG#zc&;PX>A=I>h278@l9
zvH>y8`x4R-W#oq^N2E3QW`^CNsE?7phZYItoW@vikkuRQD%}P-53C?$zq45?Nnpiw
zL#_L8{cZ`$)%bvXJ0nUmZfGxn8nE)UtLfD<IG9dv3E3w5gIF}|6NmB^^WnSRc5m45
zBCnq@Ls`XNs8$>ca`<|}^^d!MM8t1kwE%3C&K%39k;w6E6oQt9v_KYb^0q&6O+UbP
zhb1r5V<0&u@WUAxz_lSbGRhxQE(G)rI{##q@eE8mY6K0vJ2bCIAZ_Dr1bdM|v^Qx#
z-xNoN{;=PREl1apkTam}M2K6uA|m-wWrn(cT%9=jTVsyP)IlR)54hBL2H&=j%MTlX
z<t&=12bLqs^)Ou?772@gC15cE5R9jdfc!_(jL{8X+Tz0|2b@1E41B_5X36PCN&E2v
z?Y&B&mRtxFaw$sA<ZUy^xrJME>LEh*Zrei426vi|^*m(r_zNU&q`|J4c2J%i|9u!n
zDE!HzsL3^yipczv>sQ1@^MPbouSF&)GG78>A5enQ*(1y1yyZuB8z_doJZH}hp(5?j
z{MD0zB(ZE7C!<DbY(&?Jh9$R~gqz-A*O>%1?_KZQ5)QXvmf5Q!+;z_c#gPF7lVi<E
zFo?h2)z}Yv8b1SY1y)!T3yG(bvj~V8+JN@Rq?~(A{no1bFcI{wC6DWB`-p?^zSP+5
zG#B=1Xq_>e&w=!yL%{4N`!Y5YeyxodOzxJ98HaD_QlA^gxR7bumVnMPBIsedwaQU+
zI8`7<xjT|9i=qdfWH!>!A{<@E$L;X*zWCa4F`WSb6vaeA`xs`AKk97&6_6m^?xqbn
zTj-8Ss0mg;<qB{5WhuWN-tj7@%0uBnkQL{_OfItMTHSNcwL%5R?opj3w-*N~4cjcL
zgvol^F!^}Nqxih12tJ@LM+}+o6lRh~d$?LFWvDD)jg*^E%W)Hbh!_DkiZ|{5iqrks
zP5T>861qDgbb{R4r3_tG0$icC3KuL5eC<ej$E<;5x^4G}kgkjcgNg<=P*`oAOM7bT
zYy7JUQ*}h`XmqMG&(9gNiO*<<{Ayw@*sW!KpEI}mgCD$6GpwFuJVm>dd)K9VzD+kU
zTUupDt;y``y=W%4Srz{FbXu)vExxV_bb4Q4@TurQv+XP8g`}5QjYgr|zMhzYRc(Y2
z<{6s3^`EJ-<mh$ge5Ho!sq(IC+q`YYYn-fo&Klq9z|Z-VHfodAsBI99KUg-GKOLG-
z{SmhP!|S&_wF_?JVdTAL{h)=SVIh7^@7%Eu=lR-MZ)n!aHoohB#xdZoV01mKxRBeG
z7daYSJHY{v@f#i5)tPqyE*00u+Rv2^IDne@J-=sYL*oxhgjKY=F_8hgZjpV$v*t6l
zbZ!;b%%U%AW11<?B=<NB33+E(bZQ%cd4jEKf}JtGeq0%J65JVd^PN{t^|anpYu3pY
z4XU{kXJ0Y}3od(n#}l&l8(-8{ZHnm9NAoAX>>dRo+2ZAGYT?OkF}L<63&F;lU(~H!
z{?@Hl!B`9@kYI()qeX^Bm5f0;3+-r-b}bDznoPmm-|R)th{_4cWhKPt5wQ{>cFC+_
zRF9})XTL^WSBNDGV7^^le895F@vrniO_hG+9qS#+A*l3nV^rStR|2B#<MzBrBVay|
z2#eMPn6WZpIp%<$ES}gk|Bf472-hVf7%XyW^(784776*fti?LQRTBu5_amX_t5X^z
zi3dNAZvL=P40)cgwfu@W&Ell?nfVJWH1Q<=Zx(Uhhd1aev}T@c0tvcbt4A9N&jnn?
zo1f|?WCSrl5jn3ZG2qyG`yy>6z)3R6GAJQj|0^7T^m`t{zsPyk04@(RieJ_5KxE{8
zSc3I4^g0ZgPW^W|8O~l3ioa<8GyGHE-Xu7#rOzlNh1FLZnC<xZov{30Z1&%gk(jP&
z2*(GGkUSt!K+M!XC31INbl`a<v~<2`03Q%K^uIU*0%Y@k=>uL=OX>ghhom7u8t}sO
z;O=1l8}Ng2<^P#2^pFUP;h!Y`d$5J6LX-!dr~SKF=P7Ja0VYB}zS%r$-2Byv_4AW^
z=<z+gMlZwvmi7|8&;3vRJSP-l<MwkVh!+Mdk^1J5&dJc+0OM^TPb_sYJli%2g5)82
z%X~pKH{px>KV-dSP+QR&Hj2BuQ=H=NPLURG(PBXg6nA%uYk^W+D!2qKPH?wk!QF$q
z-`#UQzrXe{nK0Rtm9_SxZ+9jp+S!==?54K%wk#2}+~{<f6~WKc#8{C*PL5q6WHbSF
zHGWgw`kPC*_j4<NxcU9?Hi@I@eR}wL0jbn;sDY3TkH&-r$Br3alV7Qp#fxDrz!=Y%
zJ=({SFlm(#I$!WwIq)u~yGiVKtat`C3anH+|IPn6c_@`nQ0=cBuQ*pZF*h#2qgb~s
zpF1gASI_3o?}yIz4Y8mr<9;EWZp?&LWqR)AUNjBLqG|mHx=VVGTgix7+spF@^q6Wx
z=X(oS8ysmOxY_i1vx0a~tUXmMXiULd@_fpzd@Gu5Q)K%c)jo-aPkA*@zQ~~3n_;ZK
z<#BMZcF5~;tnFc0PJ7b(Wk@&6sLdE>cUM57XsSVA5GG|KPd~g1c`Em6qDaq<yYL|0
z==ob$(A>6Hx3Zns0c#%OLk2zAzyQ=zAx1#(2{TAri)Pq*BWVm_Cv!iaFC~E`6&Fs3
zUH*y<F3az0tv|t{HO;;w3R~mJ8B(G|*LuJaK68SgJo-#OXtXe}+WBWplGQ_i4_}ot
zv)RL0!MD>>hXMy*5*4bwTvk&eDCF$5)#C~yDCOV!_}^j+g6C1~gT6m=1ud-oU5yVk
z0!^|WvAaKW6Tn2{POpQ)EmW3yTt|?Wu0}Vf+R3u>jKrh0e)iL^jRlN|KZj~8W)?cl
zh~q9gpTl#w^K^+w>S^P#qM9Vez8Ve=*tbIKizko1Vqv%w;6ho=k1gW0f|1!QaLOUe
zrqz$HOcUK)SN0A}65>6oHh`4f41^Q7b3!JE#u}U7lBl#c!HBO%8oHyZ30;=OQBmzx
z*AI8Ys~MCwy23c5bjqUh1Ks8*O6`bLt*K-LWdY2BXnfc;G!G46Cp1y=H18?a67k>R
z^&%le6vEBkI6zBO1Ni3~i5R)=0#Pd>nDvQFJ=Ip0+9;myA;*j$%}NL{)dm8XvZf3q
z`XG>5Z1h2k)E=93vJIZUf<#j(gu||;PD4aPk$9%wI)cgHLVU|PtwiXV$!He&X9B=S
zgsuIOM4r(mMSPf9rrZ-vh**wWE@pIQM`-EUrI<Bg+X7b(+jqM9VY1FUcIk>^;|QWW
zJVf4ru$E(^k0^+W5PhCk$Rq;^w6S)7@Y3T=;W9dl=oL-gsqc_UD&pb>u-SA_hSRm{
zH}7-hl{tw$p><|2yn%SmeE8j<sTAF#yYbPfAn}q&6ZHo{Wtt+H^dJI$qM=BB*@hkO
zs0^jWHxE3DB{+UWw_{e_j3s29l%`@0d0MaqMu`I<kQNXsO+KRlm*w?XY(ZVf3az^3
zv)@4i!~QQt7q2+MUNWl9j-<<X)(W=hf;KbqSDTeTT?DKqxPH-!W4x`#qa!R&D0}-H
z^V&Oe62-kHO1BnYMY@rAlFr#AD3T4O(#bS9TyBjhT-myGQ%y?`J#@~Y(LR>wM1luI
zYaAu0#1N$oVKbyA!b{D(U|)Ah4D8Gb`3qqOFJ2gth$v`aufOHoV=Id&JyUgm|5V_&
zyH+j?FrMLkgrZ=6nw-wUvNw?=Yn2ZSuzLQ^>d3f;;EYUkic&Pi5`$ChPq>kRryAwm
zZ>#7<!9{Dc3B4jWuW-Xnlw7jUCox)2Mdap6He!9E;Qi*P+?IUhNXv^u&!)Tgems00
zWQ+KE@mAokqyz8Yu1>?dy&rbspZ5!bWjFv?bMv84U6IaUmI+@r^?P*T<$GvVW0+!-
zLXOu9QstM10Ws{R0I-#LftuQMxsQ11Mhe(_{KIszpz%39wMqN7x57A=`zi&j!*re&
zx}pcZH;0F(6tQuNgA_B@SqVbCm%MRc=Z*AB?OBoPzN*!vI2KnK?zWgbt9{B1bymf+
zg~y4zTEirS?zGaM-`JUuS{)Fa4lZ#1+Pqh9nUKqgd@v+kKmTcq1M^`{;km5U;JLgg
zAd@oZxTXyn`kB^rK=v~|!D~vgIa56UOMBNMWnm|K9ez#|wa6w7@(08z6A(Lj(>1D)
z?EN_g3uE6^XLDY-+Kv0)K@tP^j^uE)fAsTz4!r+(Nank^R7>O>Cj>b}t`WjZX4+)m
zw!h=UT#P|QF`HcupD$D{q#euf&77G08=6)~QdckFB3VpOy{osWDkCUeC3VfalpsZl
zuI8&Kr2R}%@HSk3qh{h))r8SxJn^*<&xG)o+y)Z+2Bp*Mc{1{|5)iOa&)EX?Kr1`>
z-NS3+9I(GQ9CgBBF_|P-Mdkfch8HXP8vy7l2p$q9tv8RzpzDZ8XeLM)l26HuCl4c6
zFKm4Hg)O|J7SYfk)ZxYHi(-c>rTEj|#{U)Az~--i4GDWLl6h!M1dJ-V{Tq8CUHc>y
zt=B!Efw6Ed!2s<ytxYf8+0X#UzBM&`SS342@k+ao#r*zW$-kKd(X;vnxxC{eBPGs>
zFyq*CSW%I1_swUP%8@_2yBF&x<yO$FtS*^xw1v!4s85+Tfd0sg42P3&duw&t5}GrC
z)56LFGBX=GCj6zckRmNlb*Fz<pWIa$6JmuYJS(8+fCBty+1r9ojg(7@Bn`s4H1FQ%
z*x~}A%P+OL#IBfz*xN{>V#z<F>5@0+eT+4=bR*ItNCe)(_>Vu~vYE4+RaD`4V5_Mb
zx`qWi0OWj0it|6IUiv8PN(MxmYaajRJ~jCN`F@?0ANQ$8B){E{$#0ASBh}R$88BPm
znM;{%7%?A4wE363RVlG$>Jn*d(C~=4!`5rgX#S|v9vg-uvzYz?uS%zR3%@^UvKXi4
zTOWAWR_iBP-hd7XluYx6h9HX^DF_r^SAgH|ka%|1T6>cyv803tdR)1amDskDs7P4O
zX)guMj#V6YyE*uUj7Ici4Yd@=lh`e7JLr1|P#9ktCf_ikBr+VL&=P#_CvX}Z=|p<^
z?XTY^`Ui)Gl-}FsFQ?){BZaowcmpPv*gfm7YgUA;ne|`N*nK3!lXCqOe^u7NHRD}l
zHxkjqVfs+jc=F%rP3!P+6~aHh4%IfU<9cyG!lIaKlKjBqGc@8T@ItlVL`|07?_%ml
zcSqn{o&>}Pat{P`DOM#G;|th3Jq}4a#D=VIG_=H;bzsu;&kXdX8HUhWj~Toa84@9Q
zzupieZCtp9tadgJj!!4$WgC3FZ=LAIh4pmg{f$Ty1)tZp0*F3ju;Oz6(pq7^KPLIO
zCo8W&NR9;i(O;bof-xi5`?W^VY*7m>PsyU%F`{>`6M#`kf#<@1qLkzQQ}!5|GKYWR
zUbSowr@b4)EsasE*-y2vsa%GenQh%tHQquIi4@@$q<PNPLb^idLoRV-QWz~>j{5<T
zM?dU<xKrC;(L-?Cu^J>-iKGF}o}JOs<LkH8gex2rG9g{!KPM|;(P84at>$+2OPKb8
zKR;7JN4F(K>dnOz)w4s{v%<ZgM^LdDif*NZzRC+N5zri|ivRH&Y8+VMBZ^2?vDu}*
zymz)}yiep$5pcYsSg>f$_N_O>M^8io*P$N_4AFLf@R;V;$3cP3lTbln0Un+pv}vXI
zFU?m7mS49AIOf!t`%c|g)jams&n^__#bNnUApXSDQ{xNgp0Wh-G+w1Y<hq#N=^w6f
z{4OjppQZfA-7n@=%=oLBMD)bSH(Z?&I}?M|O4Z7`h#Yj{w0I$iH=E8&XINKA_7+Fv
zt{~H13LJZ@crQ?W&TD4<ihf;jHOKIpnWiPxD<0ccisS57v@j;zPPr7RHfO4zf<^hS
zfy0{&41AJlD-IW)&Vfm>Q-5vdphz{6Ygv2{WpM$I0SXKw^dyYa4gB(6h;5UNXK@Mc
zXW#41u{M8gUY5E&K9PgZ=C|o@8$H<xeV!8w#5OSPB`=BC+8`$3hgi^P$$?Xxo<01{
zPPycE6#MrJZK${A<@oQWetSXx!IS?$wzvC7QxAYz$aD}ssu28BqSKr^-~c;}-0u|n
zf;_9vt6&p4BCB@R8nP&=^%m{Sie2vNwOD1s0o5awS<sqwhr=<`*n*<&>i~=o&H7me
zQf@pJd0nYo?VLAwPK<DvG#mDLK{Zc+g0r47bSCj?Wmhz`^#@*Y{?-<bqYIn*_J+wu
zn-4^hfq^DLdr~Dkc5Nj1d1IYlb(U{^%$y^!1ac!rqrk^~=E?!36pH%Zh)_45?a;u9
zDntk%+rie}*NJOJ@{531erPk#mDkC6$l^oGm)FMjrl)wjQ|-6YTy%+2=p$_=>vb>9
z-$jmwi`>x<;^|h(+MlY<39L=lL%qE7`WqiV;OxB%_2{``Ic=huXFsviNRo55NU{Qv
z!f^p;><3_B{=c}1d)<(y2J=~G7gY-X<4AhRur_`Y?m3oMhb|nC65aRv2JZ37^Ik-#
z4XSMyRmg*MPnlc6B(Ih=T=ioyqt0T2PjYx}Sy|~y+DNB=(7#fWj(RgAqdy!nTE0nk
z!t)F77FmB7>40kM6$1zPH|@fkr>j?x<8KIn>`R}I`VMD*u7^%CiYP=<6H%t3_!*FA
zk@ay?u_nTlaqLk}Cx+>~okdfJQ`}$7(FpQxIG^bNeEttp{!jZ1fPA0x0eN^fn3EQV
zR)lfvAL2x^lKlapQGNfbc8(FlRu%z_s_dftDEJ>?`2WSLjG&-zXd}Q5@*mv$51h`b
zn*Xy=|JU0MyqzBS3%DQxuOWE;PdWJ>2a(dI4CZGoS&TMfif&&TTTuf5DHyfTa1bR(
zxY}#gK5Oj}kao@7NY=|sl-F~FLJaVsFiD}T@d`Bi9V2EpsSin1Q2T-GitnQ`qd5~M
zh(a?;9_`rR`TK<*U@L+!LDJ<9>Ujq>r+Nrk$FDyeyDOSMI3alcmdpL;R0h=T|3jq~
z$As-HiKL6<Djn)od{+ZKvw=t@M521F|283hqy>j8DUtH-zIoI`%o@tgElfClgFq7E
zsR=BJ5G5~$6v&>~4Ou3#%?+YZ(zY9-N@Bk=n4gD#w+^|vkM;NXTnM&=XgfYlXMOAF
zj)k_?=!!KvTnm?IMD7f-0NN{Bxc&26j@#SnJzEIY_8BWPqyrO-8A`hmi=SsPV4asN
z719puT!ljgod4Dz*y`x;OT<0LH25hMC0jCwBdi7uT=rqX`F4x{n3oH_rQ<(}J*_T4
zn$7iwo4w>bnp7QoY1J-0WUA#5ocFZW8ASbUKYHHfDH53H-PvF6z{%|&ikU7c-f2bB
zA8+J9^~{U(?GQ?xVhPEJp6P!zS{Q>4*~#5R+S^d-2cP>FaxlIgX5isJ6dT`VBf;ko
zfo!jAU`@c%;p}LXvfWo^;P8>`8%(q2dZo#Wn-n-vJuOVAmxON52doTmCD({&*lf*&
zzq@y7&cx>pLyW%bL=37NPu!Kq0l)EFdCDk>dTL?$gT_zGs%h;YvsyH3Sgq8z+?h*u
z%O^f=*P)cKX5C}zT>pORNGIZR|5+jUiF#M(+7jIuNaa_*XnrSG99UAMew`$NgS#WY
z!8!3bgIWCmsUQ-JqNbfZ+W@KsKW%?NI<CS{j2m1JXCJV9M+GGw&ojSYa3)Vu2sWn7
z!LAV1LthFo*$A`!zp0S_YNV3?)kw4cX{7!%4H;ZiYDd-1*Q#V=qN6`^eVp7w+iEdM
z%G(kn#YwsrK6CA;d40Lsu=7`Um-i)LW}`G;&u*HiSqi?k1?4u;?2H-2?awMUQhXdF
zC7KtUp>X6F?}OV7_)$<PO^&(C6_H%SAu|lQ7T9HyGhD^zx8nNpErKA=Z$u0!>*#X*
zpdo!>4Z&F0mSHBqe4c2JV!^Cnkt%L3eYjx7=zZkdp=S5^yL8@OoH8!UzqNaz@y#?O
zn&PU{I(WXTh&w6P7Gq0H6Iz*HBoJ7$D6EQp#oTFIT@$g7EKm$Z{uysMV2CLn@(}Vp
zjkblz1vsoEd=_GEB+wu2d_152h}47c{<)<djH5WE{^NBS!IUn*;!vKaA!ZrO-^?}A
zCkOXRcK&Iij|$u(FTW8Zx0o&OO&7Ni6Ue!CfnY$as8Ovs`5nz_?Vu&4-SG=+YZBBA
z{FOgK4nEo!;>^v*^7i+lr&U@{DErj17<T@3WX3>yj>X3Iz8$~M_M|DcOgJQf?v<^Z
z=o8{Lm={$cGhCEB`cLg!Ybm|rM)N`14Y$U3zj=*tEZLvy^8tM1Ds{kjQ1EWto5pxt
zP6@Lb2~vvX+h<!NVd2{sNHYh%a^(tXM%9X(-T3HiM+-)W8Im^2^-s{yad_Usf%FRD
zgoQc2#I$o(J_slSJMDk$N0HwEE%Rubn(Sd$db8GyfyZ(BJDJ#}MQXA_iM|!jAbrk$
zL3_*);i(YW-p{B8+KRk5@p19N(4#Lg+kEbGcv!E4$_S}hf|sCsp%XnqjyfHexJsYj
zW4Tut0nG^?%Z+RCOApv5<z!539D;jQgf`w9VK>Lr7C3H%*84gAbWBo5t_4>V0>2xB
zN#aQ<eV1G0JgGi&cWX&Ch4fu&)<hRs!ustVbIM=If(yzwJgc)ws8T+@{?y04b#9pA
zFUKa1X8a)bGBWeKzhTPb`?6n81RHZzw`N_JGOk3Zry&(9$0)COMQ~P*BMWxH_zv2u
z;Z4lx+m?~BbXUcR313RLsmedrkd*1!N2Hx0)FtV(FOQJ*YNr`4UhWr5X3PmsbXnOB
z3_!MKIv;cDnsAmQ{htN>obrgjCQSI5XwpcM&$t`mL%9}qfM22I)tF?Os;;Xr1#nt@
zgmQq?KPuD9RT=fNw$0nTS}R(T?B=werPH^!j3PkrynkYc21wG@BW)G7D(>x7Zk-fW
z?E6)%pLEOSyUP*6=fV38Wp8?K;Uicx7%yFLDsgsR&qq@`yBkMtWA2M`7~m9z<Ce7R
zX=({U{)VF_$>e;`ewaf$27C%8n79gnY4oA@Lii)pV^TCZ{J#n|U^t7+Sefr~{FLx<
z(nQ~r?(itPVJjKlkha1V<Rr{1BbD>wyiD}w6Tz?Hg#z39WNwqmH+L=86hD*TTpe-{
z>5~^qaPk?OkQ7`1YMCYO6*Odlo}^w?H^`bgiIzAX`=Us0_?gi}$K&i<yQ;^`+Jzj6
zw}O_xvj06(U23%qCob6XgfP@g*j~HNWmA#o#}C&6@vg6k54ZG`miYGisr5~kopT=^
z7;q}Ox^HoCV982K+wvQ0lasl=k)54GMCu=w!CUSGsOzyQcFsM2a7KGQCZ=n<y0hS;
z5{JVQ+OVLz%a{06i)frW{L}4dy>*gW#bf(2#D+mxW7a2C!o!>4H}H!T9$|1<y+mGo
zb@Ic*pz@Yvc1naI2|qzKqh_MGq<kYXoIgPL|2O;%7%CYCIIY!$7+2C?Fq&=qPJz({
z;0c1biJV?ecN7@IpO|}i@$E5WSeq6Eu}EO+kF181C<Pf98(T{WY}LKac0XqGLqdqL
z9i$>ci{La=8hNiTul=6d%x}=VP+k3Xz{{r+<Kn_ijx=vV<J~iA-@Y`f^bHZpMebdE
z@V*pIB{>o_aTU$}sA-N7#2)-#>z!HQjc=rJ-dFThmYQDC72SVE7x#4m2W%V%6I{YS
zDM-rXV4z3BKK<_e@9XpyTWP=qf^7V~+or(HmeAC^wGc7kL>z%h&G3Nd5)>05=6Ng?
zB1x$W@f_r&X>e~&Be_17j7H3wg9JW*ES~4+nG9fAH~$sMh_VQOgpcaUa>;D7Ir01<
z-OeslYtuRwF$*;R(J1810^1n|acR^~Kc_p}`Kzc(;S|&DzI^4F0ByIUmF2FM24AS`
zOW8Z8E*#kK;76z%PAKA$teBC8FZI-P<EK{^d~pz0H=jHB1~%U6>?Ct>M(;}b1aaha
z3_VK?vl%Jr9{UOZ=q(LOfwpXuH%tL_3guYPWuDCZgr}C}YDgymL!a1BD?9*jxp#a1
zMS{(5CuAhx_$#-5g_M>5N(@WgeK&5FI%yQRe5phO&S}E`bQy;P0zAmF)~#aK$L{?`
zcE;J~9GmhR{|IoKG@lbbd(ss-M2`vPgsJXl>LRdtGlQqmfT9|T<faR=h|IXvGKW&O
z$VnovZG%Xo4{f17#ip;aVGyXFNwyz~J*ly%5MoTL7d1(dfQFXB`RDcj?>X|HGMLyH
z?qDTDV#V(I{@|{~EY0+rK|ICIh{7U_+STPF@%j712hrbxM3bU#iEUmL*FKTdlwQ1N
z(@dJ|`E%FwX?Z}cQpUs=F-X|t`(hN;LKWMwqPXlIH7$F~{9lO3`=f1Fq}KfGxeEq=
z$EtJ;-bj0vY(M6>`S=PRWZVclkp9-a63rpjnnyZlBodgq%UN1*q#u@MDL@F%&^9%}
zjHwYr`@+F!E&0x^#WDdjKROWovjN|`cB8Bb**NX};LSXqo2M$1=@*9YLtBLc7Y-=<
z5ipEK2egf(k+b#$$^z`-alh~p?`u&=mlge?1Vg24+Bnq+S)H4B61j0gvg&<EJg1Tx
zjzQXGs|vqq0rU4<I%7j;F}wVyIMVVFc3UUH@v>2y->rP9g&uS_<jaU5-@}<l3tP|2
z9k<$kJ%Dhmel>G6KVR?>0d4zosa6wD?Zq$;sbO!E(Ld}TJ{CVWw3irZb6vfjQOm3U
zOsyQxCU4^3veZ@R`+o6tRd((N%I%Of-N?(Lt72sv8MF7K+$l6V45;q7uDNLp(gm@&
zwQiH5q58Lzt=2jNF~>>4k~07Cd*HGMltCIMb+&QL0qf;!9mU9XT-u;eI(g}%8QN6X
zB;7_7Guv!Nk_wzh6<JSjPixoqf$(p@XFJ5iyhF@22byX=hAqTN)C7}`tf=SEk`DkO
z-MQdV0LvC{U4TXNQDfF5inmNQek6B))OOYEV1}PIPxgz5jp5kqoVHUN);T|AlOi9Q
z9eA$OVA%QbPKt<2nP@r`1#rP4!KB{)ix;#vT~@$nm83k6M{NiFq%V8aS%zy<5l0)L
z#R9*zhh`!xd}gvU9Y_g&YDPh5p^tBuzy28Zx<w-foEE%n`oC}UxrGQYwjwkDScd@o
za3~03w}tyf%=CY*<{<r&f&zHjfJ^+qo0iq}py%BnDer2}K+5|gr=W+5Xvr5anCDLT
ze2xhnYRZIAiv)xJpC;Zg!IXdQUBJYP23!Dj^1qh}I8Dst;AIwcD6Q`O>dTX<x3~A&
zU<!+A3s9wZzkjyb|3pMX^PEZ6NJLCQv7kXmM_2V)M5Hk<G&I!Y0|*3?zI%AMNy*DI
zmF8{7PEAbIkoNKO>nK!8q`8{vj>LT!93DOt^zrp|wF#o$4@36+@cEBTdwL8Zrj~p@
zk@$7HE!&}D-|$~2YADD1Ot{ZNk2(0JDr=>(f)@y+VS*oMu71@nekC#p-bxpfYK!X@
zE5a_RzN+fSBfT^M(v2&z^r`qZ<oSng%}E4b6K|v5YwxzxC5TMP{7dHw>fy4bn7W93
zXPJH_Sy(|jyN!M|5amD$I0pc9$8_^bvK;RBTS=rkime{ccMx5;D`^7o6Jp0A#3~<j
zN`*F5C2xwn7?MvMb|f=_f`rssSQT1D7Tkf+j@bFoa2jyBCM(TL#(wbp^iUPOjY}()
zo#^>kzyB0$jN{(gO$GDP@q0_1O66Jb#7Q*`bq8Ba)!}DdT{RT7m15sBQ2BsUov@+d
z5Frcd)Coym)Y?!PjU{ZSH!5ZfJCz-g%wk*^uwMdkbM^fh40>zr7O2c0oz`6X*a?$C
z)n7*Q`sPsVNkoq(Bvjt?cgO`evX6XocRpSF)JW?Z`PW8XDqNKaK-mDu4Hxu4;Zw<X
z@PeN~+RI+-uio<Zt?JD=^dUav+KTPUd`mR#TAfsAH=_NO1h>aXBIbkFP_czfKO^X+
z8~&l|w_Q44Z${uW;>7ec<BP|`F(W!O$PdIHPtK1rZrVpL{yh--5(9i4l>wf(nCeB*
zig<o0nJNd>)3a!HI7nt`%c@dAnQE)eZEl2@m!o*kbrFcS$6_q3Wwz$yZ3vUT=?n%C
zVCvNbKO`J=UPMYQ@>wRgQ>GscH&6TAvwFZrR!_Za0)mG*XS|aWmsU!n>a~)nrmomX
zXrlHqDGw_A8EIS;HX+yVv)uH}xrVQ^^N`z2#MK!joOZQ#*(^FSSFJcvD<<&Wa}C;+
z!BgWb`|%xRq+qRk-f|nJr0v{tzH42YSJ$T<`0{GrUgQ@FOXNs-Qw`ij9F+4K?8(Fe
z2{VE^D&g~z&y~8B62%yp39i<o2t;_^8l2U=wYNCPAjHqY32PJ~IkK6Yms&(0#&+NH
zgABRaq9pl`)&w5#a0|PFvncT~Ef5*@3`P{xeMxOuPr49<kxWI9>=68otvE?U=ONQB
zlo-VfJu;&ai{lmPxNZ-|BCU`Z#1=X(^aMjWOX^UnW)oMzcW8xJW50Qko$Ca`!xqs~
zKMlV!$(oGH;im#^gAo*vM*mt*LIe1SP@1g<e)5qDbA%*(WyqCs_;C)&MIO`C)$LxV
z{7nTNR=4_@yU?wB!RG6ogP7GhcX(??HgVJHz3hP?nI$)e-amL)+%}x=#6y{3`IcW(
zugC**II<5m@J2rznK421)EQ#WHWH;3>zg`-eJ%rn7XRoR)T>Agdu}IbD#<{M>uVe;
z6Y1Md+*9tCbMAA~rl3bg_=j%z>)1VS#v-d9)g=bcN3DK9qEq<0N9V;~#3ivBVs-ZM
zjWJ^GX*^9J(OGC!Ghlpq^)+)jJO;W;R$|o^0!+N5@c(f*V2PSA=Ay{=blbsJ6*d&d
zuvbY?)gmfHCS*r*?pApO%-gJ7fCdR7OV(5KWPlPrHtQ<DRI+avF*J)7yyob$u}T$G
zJaFB0SPJ4^Etw>}yKzR{V^k5^gV&`=R5Vn;<(N@R(vaaoyXh?EokE2dN^<r=^;|88
zFQkDj`VyfQ8oqjcLwqIETn(AVnL%3H$oJ#P3Hlmo=)wQ5eX8CGDne6HE-6TZGwk%9
zI~0!M9xpawNG{!xPe4xaTh%ys*ae@Hz))mAd$(lujY)|;xq4a=2q@F?H0%H2Lniu;
zoL!Gr_Px0{kcwAT?qlWDoBr!X<Y`Wbv;3Noy^UIYHgA`KQSFRZlV1u#dMC1O9{=>`
z-GrP2&rF>XaeYToK1~`)tatYL1EuxGWt&{xmLNpYLjcuNP<Fv>T-_#)GCDlAp-UM2
z1vIo{>LoJ{qC0V~`%MfP*~T-?b<2t8dZb^_yn`Y4Q8+5hPkkr*R1@JPpw5{ck<WV1
zSIpnAvO<7Nere+xW47mxeMK%g(By_;p%^$T&U9G2-d%m?O6Q80xAr*dU-zEUsVXy`
zUn*Y0Ii|UWZ^K;dD=i+<;XbLRJV<&CgfI>fo9-o+v$(u{hNvT7kGc137A^1nP#@=0
z;U_AT0czcVQ)^K6sQ}@@Va1GA(wC?^0=v7_=i=5=POfW?&;O1N*p6rc^9ehe{YeG@
zvte!L!%0YQmc>Hm#oNv#IN&`n`d5D?l#1DCd>qniGuN&AmL~df|78NpSS^l96oEnc
zry_3ub}&XAsgC@o1$czLSCGoRE=3mOxQu)Rmfd<05o1&rOOI-@EfrO5&39n4S(xh_
zIS+qr&oA^%@QIlyYQxtCOw_l1qsC;yR*W6TQC}Gf`0b>{hDr;hJy;UIFY8WWAEK*=
zeT0rG2s&$0#J??VPOl%KR^03#KBNe#-c)3W;CM5hgE@F!u`a*P!Dy$XfQrRDTHpt_
zQAzb1M|SlJyTa?#d;M_m{g(X3>v0~7DGT!K`3Kl;XL=2HGi|Y7FGGq}R!PODl6rkm
zegqK$%^&c0Fxn@X+*RWdsoT&YL|k0hm+)w0_ZjW{%8newhsIjLWOT?C@;A%vM7rC=
zq|d*EFp2}`(8X98S!XpfRM?9)m=J}4LK-A%nJQ(6zHc*JA`itBI)k6dgw5=os4e>R
z3v$KyZM(}gW#`P{wLb2fsQkz^yPkd3UK~|+uOFBEomSG3>R7=&UrG`e<pb9ZPBgdI
zxB`EDcsMiXMbjWBU^f*S$rHmabeAUF_mgt}6M?uW<5l4AGisYIN-b+Fmj6RGNAzC2
zgwgxNoezd;-w>LP>G9@^P$G>m4K6wo;LQ5(p0mmiZfS1TG%y&XE>h1CLpC%t#Ayym
zYfMfics_Y~PV5f2I+$toH>M`1Tzx+@G}KiUc*SmMIT3XHM-?dc03znv50^MQO-1cf
zKz&qx_xmX<L8Rg94cj;-m4<H|gYpe1Xv#LfO#^BKObhcxIw&2GV9{d_lk)w&2c^So
z3UcNQzQu&ut{&`)@l^e*K&XzgEI+PXGp`MEjdm_H*LSTeW*<6*3Cpmddo?T3hTEc(
zyH|MFKs39)UCW2yLt5uim>*KPn41z-&0vgD55_btWDx$7H5W8FgOORfpv;tXIq|aE
z1J<7===pn++nF7vF`>{wtVf~|67&ueOM7QZ60clN!mM^Eb{yS_zD$s>HJf|7T6Yys
zXQXRvxWBHRt_@P@caW$yhcPjtC~$88l{sC}5piLO#Xa<zXgkWaieMB41CkmR)G^ZJ
zhY&MO8mxWaVEaxowDda71XMI>Z5)U?J<Xw|qU$7Xd>E~VU~qVewYv!6t|6vQ{WD<{
zZ3yixcy|665Xrp*#2Tcf+VP88OVNMKXbKq(Fx1rpHG!A1Y$w_yQ@Tp;`M&*r(4iD3
z|77`je4b`V{#)gr$(|3P@|4EHz0&Z#FltW<c)xRG0X$WORWnnLi2lqBw7}UA659tY
zVN|LlL_;(+Hn^6wS8cPJxZD<|1x$y;%o<d4xKIxB1p<DLH_}C8WHZD!JUHQlk_6z4
z|2UHlI;=q*c5G~H8`68%*VjuKdtKp}=L|K|OOMa;xu)NMb#Xe#lDF0`{me_xz_8sE
z20RiIfbSka4FlnO)xyPMbSQnB5pv62#9~NJ08#ONA=Kl8!|B<CMzz_AF^zQV?;n)0
zYBTHp0_t_SX+w@M{k=H4ynwiU%*3_)Sc*S3hQ(?ZSAA}nExavoeT0hZwY)<jE!KpE
z)G@ygJ>-?Xao9JY2!)K^^aT2!?e|ZBO+zF?X%RmgsB$pJ)5MTdj>+y~w#ahANNT{l
zhGiCeNg80=Ie7s~VzY*?Y*KgrNI1s6eP+Fi1V9x=q{cqQu&4LWpEZb?o5pt@(0iy!
zKklTYKLTQl0#Z=Mx5r1A$)j1hWKcNBsU7YJN$wiwVMk2wSBgiA#Sqz--Z~&wzo6L9
z?YNpS9uXKi9<jf6uxu}&8TiQ`A#TTX3o>@q6i)t-SMW91+j-2=|9l^hV=)ki;y~Tz
zRXR<BumW3sh-mh<bRdTO4F0WuI)$So>#KYMiCRPOh$5+}x-(=aqi?CpYSt5ahdDtZ
zgd{KhKwx<Npd~s_F^`Vx&+~c2noO{hOxDapLg4e=FqX*Y_+HY@dOZA@FUbR}BMSs^
znOHT`DW%{M6WTnSJA|xj<R59}&L}IN7Z|D^l`&kMXgWg~J_kVBgV4*ywhJ~CNG|)Z
z`$;#a*V}zKmv9PCFX{x0wjq_F>sw(+_6zFeA+-s7ij>@)=0BsAnLtW;(ouwe-rb4A
zhSJ~PtJee79cIvGX{vAkP#Y(gXmN)M<hk_n<$3jGGym~!JSYL3kQuVHL?!IFw1;|r
zeeF3t+a8p4esOWuOKQ4C+5s@GT!Q-dry<mF;H0%b2%aEKGz4VO1L}a;QDRa)98gG#
zbnO>q0G(ZER#q;RQS^TG6m`6%VpwA_au!#C&=)c6H%!QCIBY`4*?_l?@h+Bq9mlk7
zcY+1ei%tK5Gj+}o)uEOTD_aic+P;wfD1ykcNSc67u+SxSh?$v0B0tAmt<g?xItV{@
z@JW|5sLF^VE4epkj!3c>edMvdSb~zmn#8qAPoy*DsP^Jcit?WMR)}Aju$9oMkwKz8
zR!lG_o%aRFR5+_`w^A=yP>&`@Nz<yIJc)SMLin%CF~0gD)`oqS!8X?U6_O3f_iWkB
z?HLT3jbFZ@B7P?$x`zZ3JsC`6YhzM=yXJ)XcS#Z@X`LTW(OAmTXT}+~coR=Q))Zza
zaC%405iB8Bol+dQpM}f*eK@y$T@|rr{Fa1gn6%JC=dUOB10!oKABUodo6P1X*2Ic%
zPVeyARufzoUEFULpG1Fs*!zgF{uWq9Gw$W)ugaM~u`2(3iB(0pH20jJ9TeQ%1+Gt4
z6YuYR@9^hOuepQnR30yjq_-2CvC1ug0c^+1E!#{hT-61S(vR!7tqG*uCIfB{e^GJm
z$A4;ih{xntA$h*K7PDKs4KTe|56cH?ucmlI8*hC4&DzKVfdj<^#9vP|y>|Ka!nuQL
zh;$2&eM&<CTf}7xVJY!?zsKdE1P2Z#T#{MGk*(b*HPv+SOx0DTwoAYW$((k2NBZG}
zhzp+=G~64}IY04`^Kf<<Ml!k?c@tLm1FbI<N%Q7idKXjSO=hGT0f@8E1Qe?b=(~)O
zwZ%v>vC#&ArV9tOlR1-2*#TbQ{{`+(zBjkDe9g#+o+{E9cC&oV%#6aKk-HUq0)wUQ
zw&$kzjz;VTUDxKhcw_7vqI$9#vkM?;{Gb=jmk+44*blLT*4Q%(9k(gZ@`Q+qAYB;g
ztwZ~ep*}FywBxp+kbt986eFLt_}4feoVyokak*&2pW>RRW}hv!@>bii^l0xphc_7m
zpSx)-cDgvxu3Mt#Db*)kq(wB0L*b+mgbY?%bUA`a5!>=echqY8laG|vPuLOvaC;#5
zx6;xDbGV^HUu@`y_3f3jRRHA}C=5e{KK&Dq|E0U1{xKx~uY4TTR#I4qA}T7Xtf8@c
zGDaRe|6mso5a1L29F1KY^mx`!wS;xP$_AG2uAWpRhc^qnwNGV|>z2b0JYoIUTGzGi
zMx$>ph#|CC#UR2+)N%LRVNOhLkt=*{o<0?bgo?60AV=*lF$qsIH?}b+{lq<D7=)%Y
zD{9s{<%yK6)3)r&h_lS}>OrEX|K*C^sKo_UR?7O6a#;|`Lb{yyiAqm&sqM5(gZTps
z1XcQOe0B4Z372YK1oJ27TxVkWk$901#Bxw;L^wA}Jn)$S{8I1+lm>8O{~maN+x`dY
z|3@|(zW$XKKz020@-O5IP)7jHT6~Kb2I1ksEp$SKnw`3uVyAp6GJD*oJ$uCwY6xAw
zNm#@DzRYJQ4wDMJE5S5aE4aPV2#h{G#Y0+=p1_33yVX@6Wzxb+qWug!<9+Os!@E93
zcvkX)N7!$Kvwwkr{LhA02P1oc{cB_LN>bC%nJQOlxBF_3`qp%H=EdM~_d6QeW!Rr8
zX;{Pyd6DCC&&f+ZE^SRK6X@le`AJysd4~s}Y;b{U=^TNNPtU`Db~6$4-@8J%5XQCF
z)ouT$V<XaWj+YH~QHG2n{BHek=h}NXcb$*8r9{^X|8b)0q>itc0%rTl7{=?B7L5}`
z*!i1F$5^?KS{OiS(0^j|o~Guymz`m#XZuBY=dVq%R7c1iPFC8KRa72GLa1Y+(4-#&
z%OxFQ8SxnpPV`?8A6Nqms?+7gM*68=%35&fEX`hyt%G_j5YA;lPE8vRx{&AWU}_>F
zC@vH}<eBWbXg&QhQUiZYW1EJmzlvo{$?^+FrH{T14=n*Mntzn^<6GiCiJV~<X_%*J
z9Iy`c(NB`6tuH^g@1d*j|Fe`w?(7e21hsjUgn*bme!Ag#7Vn6Axc%J-E(%mqx!sMz
zaJ+CJdjjR(O@S*1ZToZBKl>+K{GLbgCRp9IpVi2Kd~KRljyZ7?0_r_}6p=?UM@1uu
zV>i~CQ5>TRwvmF%HeA7X?|EtLS7O|4f0C6Cqt6!QsPfuw@nF&3F==}&C7nLbh{I=f
zE`0jI8&lHukAG}IgVib1x)1(Y6{;|(EhHVWpDEG$skjbIU@9&yPWrx=*RBSt^@7U&
z!R>m|VznY)e3f*b9{v<vBNZrfbUPRn5E|J@=db*@EB%BGlo~C!-Tn>4MZFHxBerke
z3R|0a6?c2~(gj574yghQ1S1jsYR}LR8gL&U5!WT|ac^&=OV+DbKR+r4Afq-^<w;+U
zOm|j|=t91WXWf}+jK1;Dt9)uZd7?BD%G<%QQAz{GKBG#3h0;-_^G+b*u=`&&M(3Qw
zlGj%7M>92Wv_}|j<r%_Ws7IJ48#$jmG;;&VjNMHGcG+UaiYz$D24!~Zg-ScZeu*e$
zi<S%?=&`bl6XvO?U%k)LH<rj1?KFTBx}dV|2Z~5Dd}3-R;dIq^9Jr*_ldPx{gp%Qo
zDw*?Tads6E_{96<lKGrmXo%y+K20c6YqFyXO7~TEmOF~(laFLr`<!G#k*s#Mm*pNf
zY@u1fqvc*Cqj3%w3i8S@DuC5TnD;bxq%F@-@^+(3a=pQ7$RP|?yV5ieGFF8Xym)Ut
z)tZ@Z-9)uCy8qf)pCk$eL8@g{Y{(+mie?Me9M9<JK?qJ9`xAf&4uOo;;*+VQRZz`d
zxmTc&ASvL$TC%JLLe$1NvV5YZp8lSRAv?J^_7?r+FC4dJ1ML1|#>e3F%I<}84BZdh
zuDC8c9#VMFqQdlzw^a362Nj9zq0N&d+FyT<0-xGRXs(5=qzHEw$;KcTYXZ>5zNtO{
zy$Xiit$+8u0Yut(HFiGyIZL*gBjh-wq3m@>Xaf^y`0@q^HrR1j;eU8UXy_B$HW#>f
z>40dc)s=K>ogj{XcS%l96M5wusidGV)Y=m!hu6t*1d;jjMG{D!jgIg?o~57xWvC&U
zAvr!VsNoR|tTI9s?7`)*s8gO$cepNjMA52rvJv@#zsDDNHwrdn26LSut7_aXC{1aN
zO8SAXQLAkH*3LSS0jmv#FA6gcFF3fNly_n8@!$(<u^naSNDr2x=b<RxiBmQPlOQLo
zg_}mDwXGGYw0X+R#u5dQ(__hRR{1V??%IckPbf0F0KUOURgV8#g<4EVOa#r06OQqs
z4%NyL`CFcPaAZLxQw^FX;-S-+%9n(2O5jya9gjDK?&tSUxaA>I+Zp8h7EdLlRGFO*
zbCAJl43bLmYUmi;FqJ*%M^$WmQ5(p{9$t``n6YMG6KQ8Y<<gSG)00j>;L0aU8_Q~a
zeP#RH^U(a}$}+CjggwmF40EJ@2J~*bPFvusV!j<`Nl0lXm#Qj9epzKqO5hCDEX(d<
z_m=~n>B*k(H57ahBCqw0oXR+oqOTa#?I+x4VRcYV8>hP(X#r1HWCD5jbb34LZg+8!
z+kxB10_o^VjjQI7^k`}%z%$0qZfqtq-Z?Ep`cP$guD?|_a6diAA6`;GCs1+yBO$oi
zHj`6ZN6<wa3_rJ%!H^8<21$==XRWq;tz_1vj@tkQ5P}c+%glc8p=T~|u`-gG8jE7y
zM@*|58<$I55(w_|f&3!sHa5;npl(9Mk=BOYUlweBRiWOrY*TGnTT@QC35At>Mb{qD
zJG-zou>u|R!AUWi$jV4a&QKU2U1kW8upS7%;X=GVQesj@d#%_LKJ2_mGO}x{*Y{2S
zgHG5p*GNI7d9V=zzqmEZlLG~1^~qaAlTHWLq6gC8QMiuT&d`J@uR?|KJuON2?B#ww
zGP1w5f&vi{$9xEac+GCFzww8Y*9ZK_6n$452(&@Ig*-2WNUqw8K3S{wr^dJYcf8)_
z3cUT9xA~{zPBd;#`i++YqZD~jMBdA_MXI&;hV=7A$63qE9cKiY)5i8$DVg-sJa?nQ
z<B9Yme6F_FPxeD8gPhgwm%poYDuvxaVJ~-itLwWj&y+oL1F&Oq^$&Zix~lV!Nhci|
z_lAh#BNvR?yHs0?st90YbihIQ8tArV9O))uL{ia8g|n9pfTX>}pIs#f{rT<%+M*2v
zWE$FtYKDl7O^xTM_Xrv08J*J~7m+Ql43-E!!K>E^s`>n?jVD17aXH{qr;$pe#-v(*
zs5xSnPigr6U2fPJG2m~W8<T9WCxcj-VL{1eFu&6H`gFAlShHGD@`+YbYz8ed!Fc`Z
z#6SYuWKzv$T(#3C>t`FulMFA&aHL)4s`dy0%Fz^u)9fYaAf7Gl3D1&f9Fdbim-v&$
z*IRN7N%u^K<HF%eOWnb?#QsYNyob~P2KSX{xN$Bq71T{TUQ-PiIpGZ-(61xnw*C6!
z;K9nVO+-%1IDN7hO|flQ@-hkzY<Jgd&DVzWPhHlB%>uy-l!X|({F3Ups->CtNr)<c
z{FeA~3x0<@`He9!H&f?KSB3x;^nWI1H%L6?JK3|vd~prD)Vq(~u$dBBre$!c)3yg&
zJdB$?X}d`<doyM)2VXp^`728tFTmRaB(@cp)rx;DaE&T~wiUqw8?zawvwxm!9?1m7
z$u3l=HrOtO5Y*8_T0cE`s&5m|ia=5e7T+WPt+2&#(8n3qurj#*Y=zl^8kl9(y-Qx3
zYzMOO3s#c0$j^Hh%s~%XVZ!vEX+_reV@ACiY?=@-`eM;CwsE_nqB)f}R&l`3ACGsR
zy&wZIvQ`H%y<+jr?ky2Va=$zE-nf$#c>x>1PX|Cez4*GDM|WK;cSWi6JJ8*PZ(Z!5
z7UAqP(gD2{2gx!{A{Bn2k1cxOM{Ri7%wxK09NXDLO{F=)VB<$da>Z*qXLnS)O=KIJ
zaz)YF#u7rU=W?p*M1lgfd~SM?$fJ)53|^Fj3x&HPt0-n)0UX2$k``|xYY(R;yRgRg
z!Fe*xxb@R^A861x774B_wZ4tr)M`HwfN4Nm1H^?Km*Na4f@I|=#|x*!S|8=IO{{RT
zVlN|Q29N)A^s(RDkG4mSkC1?-`r@JW0o2cP=BUyMV;pg=Qn6q}Onfcojy3VZ4nZ*L
zJA~`iXke6uJV?iQBr-4yt!L+>6;MCwE*W6?JC%XIl1%jNHtTp$Z%D;GF=V#hV^@BO
zlh}Bo&M4+MlY%VWLEcdgoo`d6m@AY~)*aEH#pSh5>$81nhd|;13y8Av4A@sHSyAjG
ziJzC`oH&a^Ll#}!)9PiqJq6DRRgyXvGW8RDLqU6;f~WBgU*Q)cWEAopURN<3`U+>p
z`f1*tid=i^ULy)ERw}dif3slWF?;mx`9(k#Mh_ktMDb<5D6s1IiYR`$_f8_peh1>n
z&he$P+Xu&<^Jg2?Uo}y3aQ0y|3IadnPT&T4)PA2YI3oZ<%{_r02<6vhG;`4oS;?>e
z{_LRK;eioJn|h&a>v@mj|8z2K-K!jAps2Yox78Wmc-5GKC=QHG2lmXok63N{s7bQh
z?|&4-V)=0P1=X2Z$C9vP4av!_;QdNWr9pF+buu63@%nL$yMMN5@OIhux4?_Hp%q>q
z7yq`HL4ti!L>aIqx!y4labuwzVzVk%QI2?~!etC6rQ>Zydac2xB|Cn5iS?n?@?;V{
zy-e*BB%#S0>lkC$j@bwrzv*@OCS;TYmS2Q4{l=Eicxv<w?QbOen{ajSGdUqFlRJ78
z9F?%7z-^=klgc&uRh?++^f$Vh^xzBmT+l2VHzNuuom4T>Af0yFTB}Q@;H*Ov+)WBT
z&)ke6?{+u=*y+~G8DyGk5r4{x4qYVy-z<LqQT!9XgS=fo7g3ew+;G}`xM6YO<7p`$
zK_9#SZTree1btCmlt%9mH;0@X%ah3`$u5l`yDvW@an|Rr1i>xSsP<MWbJEfgpRF0b
zs_brU?G)sv2I~79K&qr06m(L>XMHDWNBsa@V$}u2-!><1kFa2-rvj7kr2Xzy)u$|2
z11<~MI(#tOX+Xtwx-%<nqS@H*Z)<DBVGzj1PkHl-s3aENP{9C^Wz2UILT?Rg`r5t9
zR8=?K+y3EZeSck+q?IzW<XO9_mdA5GF7nS4&m0tvoBtC;NdICD8=~IzMvcL!eIv3S
z2qEFWAFViBPKbairtLqK{VAx}>=H+!g7TiA!2U)>@^~y_R#C$1gB&mnC8@KU_F_><
ztGXs!skK>#gN>D>1uO*0*9V6(_Sba1B|j<zkN!xTFDY9eA`V)T^gy`AtQw}zevK1N
z_{*t0J4C@y!ue@{Mt@8qY-F*>d7w61UT6;@Cc-JEc(a3uYOMB)@75|!MrQ`)M)GmZ
zraU$W$)1GMp$XmKf~D1Y_z6P*o8+unAtWag#dzwQa`e$2vZo+?Q1TeoQVRi`9=l{*
zR!!dbCpHl3iF0@9@-r)oicfn1$u+HCu!?vCWZ+65(Ve-qd+f?DDq~T8y}arRVSk&;
zVU)P`QNyX%yg7u6>7G-XhyiFkZq*&{a%0={m`ntflc{7wU^X#`{g2KUaom+OVi=r<
z0ZUz6XlVWVPxFm#E4bICLuhe(GROuqA2(-QwpHPT)ayI1Q$80n-eN#1Rc#{o89lN^
zw_{@;aJnbX1WJn~)hP}d-4|$;^tk$>(AoTNfldpcj1q`zGc$G%S)m>fI)P>c?-}w_
zecc4x1x#bucds`{I~rs)u0D`eobL4hP#@_<Y9Vgials$zxECCdk`38qX4P0mOLXf$
zO9^_SDKsjQR(!`Fc*T&75nWKh{J6E-(bJ@&=VIT6SvR-3*?%)GDC^_LK4N9R{&124
zn7tu^PP{Tj5(!G?MuP6{4imCRR)@OZnYK3Hf;iYPnl05qNFCXvpQECklEP`IU!mAb
zw$u)IXGU$kVPin$b~91&O%5Jdb9d~$IDBuc^Eo^UElT0-I=e~G2QB_wCB3sv^DBPL
zMHd}B0@{AMSdK}nrYUkadKD~<u9PIA6-Siy<VGr@ZI2MO`50V{EuVO%9B-2M5bAN;
zzcF9aW;=8GHxLN5l=|mA->TBkKbn92KA(`5%+-3DsPG2FocXR9A3w7{X9^gjp)N`D
z0K`9jhrL>sKX_vag7*?C8@KDch+;c-pG{qjX3Zm$z!}<|6^K<C`^HV^rTX)!E{f<2
zs-@e&cb3#woYgt67Do%Ro;Xm=68A)_3mlrJ3>-cR%F*@`jtqSzS{}KexM)86D@>F4
z#BW)kRJ*?tMxd3^yAg$`5kP2}yET0ma}z83PL;hzE=6;o(Bu=Ij0q9_r7RXk@*=(u
zcl7z*2|XkE?-F;MSUPpMV`Azut66tnme7+Ai|_YEjCV7<IJyF20eG~cVI5w?z}}wn
zYBj9L>t_?gB7YSbP{-n8&A;QGc91tfdI`e$%$rCcl2ld_Xnk0}L>_N2Y86q|*gcnm
zTFpuczEz6RAdoxmbCnEC?>6JSAUKgdtHnTCPLLJrOvDc3w`&or{<hm2E{vD&*H};O
z!Gix=JJ&&vxm9kDT2~Jq-ekvHS23p}-*D2KMn4t_pkaG1U$KZ_enwK-2~JaW7zmud
z5c`+%f6ffy%%vFO!++dDPA^!Vnh*X()yY<9F<pj*p76%cD^UWK^_@@1T2ZxjBQ-a{
zzBKFa$_85`#UU~Hy}<C|{(`8%0@}eUULa>5#ZsUzJwuikB!qQ{Yh1v$o=U4uZA}Q}
z^z7e+-|oHSg5U%Zz}1gSch<`^(8kDT?QC9fOZS)SwCovNg*+T039S~6!=13-+7Iw}
z-#rkN2RNHOAUyU?#1CDf-Yg<KT=yE^ZhmL>-nv0s2zo?J@OxxH$b$Rh^o#{W(6TvD
z1+xRRIZV{GkQHuW!)9c>p<`d|_Vm@<XTHhz!dPi*NF+}<XL9wT=;Wmi^<I+bJ{EJS
zhxgJu89V_U3nm*tlSG+b7ZDdPugq|7k?ZRipD<iz6pJRZU&e}oA@~gYfm;+pFt??+
zJy>l6a@&-IJ@TMrx596pibFx(L}y;~S%J<eiyW1XhQxe77h}pO3b7S{^-b}|_@3@t
z<Q)B0>XEZ}Vh(feiSn!SK8HcS!xNALLbB$48}i})(ir}FRRySu_I`t8ulPtB_=wq{
zz4!fgvcn%&jD38v+S$JLmdL{Xdh_mL*ZWzZ<|aFeMN2~Wu9nru#D*+aDoEBtNwbL+
z2L?VxlkmI7S~uhK=GUwhozv3Dqdzcs^_;cfD#e49MV)#!i5nQf-SJ4!aX;9x_QE_O
zS4_1)r+t#bqTyZq*94S8^C7GIKaq}t_4U?~%_wK`Iz)s!qeBQ>&=^-oFo*+8mayy<
ziubt3AsHDIp%+Yx+VJ3N=r7O{2O2APpfxZIL-3OwJ-|4<Dm;A8(l!2vbT+Xypd|je
z(Zd&8>VB7dje0F!`mf|sn}1&S!eN21Q|w&WT<4S5XEXk?x|Uq+n}(D2?QPU3>O<c{
zu@#O639F8KO8vGyKWPonvmb&GC5rXbFf?<;=yD_jN>qwV17*CHYWXHc-8RG$%VcOa
zndk%uwP$UWiqF+39BJ{>{9k#WCo^DRu5{oz*@5%}8p_3=&HdWl#vos5Az1Sp8A}LF
zsC2v#q$A)Z@AN6?h0yUnl7XHBj^X7*+Q(S>emv1-iks-`xZJ7Vf^g;~%j1+LwM0Bt
zUr%CC_pra1Y+f*h;wg4-p#k$P%g{qgsZikCyxp)aUitrzw6}nYBi_0_ad!wV0Rkkr
zyAvcq6GCtc4vo9J1xrG3hv3$@L*wq&xVyW<tK9p^ow;k~y>Di*7E)_<cTv?{^*`tA
z{o8l=k0*(Rr$*yrlsX*~Q40-m6o<ap`j6XU1<@ylL9O@!Z`oeIB`&shc5e~8-D9&m
zti=vJBWk<npf4!?{LF?+yotWVW<2}6vetNdjSb0VnY??JrShhtTu#`#$XKJI{QkP=
zq=OV03nW%quX`zb>ag;#76W#=kq)S&aw;fW+0)!u@x2|r-DP-*7)&?z7CY~{6&oze
zvM{?R1ygw}h3qr5ZT9+#EyCRN;k`5=U$5k%4Efsr2YCb;<#6_2EM4V55JvWY#dUmu
zyAF*b7Viq_lJY8FbA36J@_EcT@y7OK^;8vwU2s5o7B*zn`;iN})~9N>-%tw*McOz{
z)7EJECdziwctQv(^t;otO7=C-AKDm;w7=DG7Cl~SfltYLLE531#Xa^79e6=MMv`8&
z*rj+xj}ub{#NlT>WBM-)tuM+L1uKCUjj_gSNQPP0wwY^{h;=86T|xRjL5f5zICcjp
zad&J8K|yQxlzfl-*xSZiNJbd2o<Rq=qP7oxG`f$Uri0lGEjjjF!P=fk&l1$P>vb>K
zLbkW|=qb*mw=HPDw4r=uy6v@b@~6F2UO`mF4IK-;*fRRhSZz}}JuHV}FS{9r4M&_K
z<yBoVKE)lh1!*gXK{3zzRNx!kv##yJkGJp52w8O-5r)@ZFnblvfIhk6|FGrX`4K~@
zToY<20d`G{_6vI}9OL7k@_^Fya_uSXjn^L9)jNMI`~KEQf$WKjJ<Sy@y_aY;<K<zr
z-s3^E+V>JSp8Vzz@!G`q`dN@1z3o=ON8}5cQgn18hbN&6Rnvz|VcFRi9?jYqT-?1-
zeU&@(_AHIP{UD|o$-ar0j<f@Yf}t3Du}zL4pL^U8#w194J1m#!a90Hr_Nu#!2*t}U
z<|A=R=B@r%I~&88=dBoyCkPAp3gGF#khDF0LA{P;=rq}PDiLu)_3`(=J>+}AUMLfN
z|AWt}SB&=UIY$i-M#7BJ8sys7?&o=1%=CkjQEm&Kk7+Y;%qHa7;n+~vYZtRK<B^HE
zPQRUU=j?Wvf%Wv-!!ITO>s1x_=97?ajc@47gXF7PUf#s@&B$rw5nnz(k;I+a%%Vq^
zI~O9$?~V5q_?I=TZ66Gd)$EBZQTx=~(>VRG5o&bQ8mtS3einv^FJdpkQ<uJlt5QG+
zI8;J~{=>xhZ}1)<oaP_z_V@l2XT%}Cci4}svSRIkKv(E-bEP%r<ra#hj8anR3Vk5(
zJBp5#cRDTioe>|)8N4+svh6>6Xo0lKj3%_S`G~8$>=IFR@<CGcFUHbd2ZbW8x>k#r
zt*E6g@y70CU}N+;Y#176J(KA^)ZKQE`T*~!4P_KG?Cx-ryxUpjskIH~-~k`(+2%kT
zQa5C=?2Bui#?axBf!lT!&%cJACW?l^6_OQ!20W^#)zSKwQ%WCclREuN;E1OBwXAQl
zAe={c9-M$%%8v3LUm#bWt{nTWVjaGuET3VnsexYor2v?%^J1Nl@c}=z$(d-I)^}mF
zV_BZ?I#}0cYLDdmLS6a#&hNU1jw5Uo=$1HxuIeRJKg+aeQgigzESpPe3;gUv9ROk+
zlxq+66etfR%;k*s2nifn^D*l;9L|e6N~^<&ayshGccp3Za}RIBIsoLK{ESS7M@7RL
zvXy*aWbM|AUEy4`Kk!sX-duTn2hhXs|6>;TZzDmC4;WAdT;oDYO);|M<b93mJ9Zkk
zB)j@@mySc{oil!6@&!{;qb*8oA5d8Y;t-)t;Df395Y&rQnWodATom>u0MLm$9Y+~y
zXJ!|L<fx0_GV-S(E{3Lu2u3g0W6C?zEgI;pQ)lrzI-yTZ@ffVvVl7LwFRn3%4P-30
zqI_gb=J(y9hTBpygT=P(P|?M_u9`h{V1C?n;_`;OfKTd7Y7;BVm`B?BzzALQNjpzW
zsAsduScv%WQLBE(J5U+kNA3;-s(xM8f$)%fO5H=Tu!{7`*-A&OjS9ae&#||%J9^u0
z(IwjN2?hPK2K;!7dF<q}H>MStVGuo-fb}hMo<R8A8>P6y$Zo%pL72*IZLz&3kzWFJ
zL0Qi~AFkwO8&L3iAYUx1B8PX1)bD?;V)xu8KNQ&RT+_zO2x#Eau|NNchh6Xse;pI^
zm2-*43k(ZQd@T*wYVw=?rWTT|l>7%FUKZUTMD%M~o<1T*#v+Y|4Z)b{Gz#)Cl1ZI4
zGL6?v+VkNJ2THVk-q?%VwlX!spUJ8Qyq9hak)B{pb}Ci=Agp$o)vqV`TSP~E`k5Z2
z$oKtL#Z6lpKaZs$a;5_)CPn)5J>S7C_ymaVqn<K5S;)I^Z&Q6({p!M{x$8Mw(y=Je
zr1Be`<WGd3#wb}LhqEXgZLz?g2ly0`1Utdw?+<!&<h#rS7X1<YLrMEGH(tcAK>LJo
zj`|fy9I%FoYn3n@s1$%vIriV>@uV0~{m`I2od5#B6Rx)oPdD88Oz6M#Wj-pQ9W|`c
z9j?mNW5eAXZl55!?E^DLVR$m4V6xwzCL;Uk9Xf>_aw%onA9fFKYCZp4a4O9cdOH>%
z%i%(K!l^a9*po+7L=Q^>>lbaf%}l@D!TLf;$u1E2_tQPUjg*NKCcvaWsIT5{$W+HW
z8(hl0dQVqJz3@U0npu)S*F9O^Pdbe(%8%7EEX#doNgSkqE3WBFg4{M5Vj=e~PuSF6
z^)9#8rN9Kt@D{rooc2Z5sH+cGhqgC4JAI()ZtmiWXO&7bG$c~^tzz~C>VCy+%(s#4
z2lKqfT7@b<TPJy610XVd>Pl}n&uqifm{!SiHk-N)*D*eIEh6BLSaW~{8RfaOP_4q(
zj_1Mt0(rKed43|wb_KvD@y4Ky9+>a`_guR3Z<JOi#D?`CU}p=t-r0#P^=n#pTCtvR
zdhNF)32D0qXFCy55<!f~owAV8U~gi9buNs%LshT)IhDu?fdL|TLx@ib^_iZ*<dq|h
z7rSMjzJY)Vq0KEJWPU6WJKVD@F@#O*<+r|3-;UI3V}D97f_kN<zY?5>rw=aocDgk3
zlfH`@Rd7}b`QF7^=W6U!xBrpX+xRlf!&*)WQFu0Z-WsDxC;Z>IIIj#@U>1CusRj4_
zSQ|5nZuy}st-<k?yyi(G48*ZK3a6q?9k7>6Yo}jy-%K)8)uv=itvS7xfrXajuxA__
zqS!8|+&gJG#FnRD?RI@qaJKVrJ(uGzxfDmAZW!snkp__x=yv{0H)7FT0#-@D%$^5u
zW&Eoh1AwVhAk}8ho85p{o#urw!};QzY55AV%At>Y*>DQPVz?1Ep_5oB>6cXO#h5J9
z7*Nxv_~k?O(6?Yul|+>gm-`p!rzOmX@DO%R&W(#|{Zx%;c)clAa~LgoL6zj$eijg2
z@z#^yaQvf=MP7(b0A<x}G1q~Lz6=b#!Ki4`Q0Z>5P3@CkOM5rc^q1DaeRoVKKE`hB
ze*U?lyUAEuWt8?_ktKaWzOu^*xvttKz7Ew<a@0arO*3d}?+EGup!>l_BQ`zT2Z(Oc
z)*#m1_Yzvjmf4i;R|d@UyEB!6$DJMxFd%q>kC5$uk5Iz{i<P{A)rR9mCJc-Q_@D3X
z8Y-;tMV~L(h|5gB7yNe7fi|K^i9O-}zD)g*eDxhWm`Z!!&tB^QRi=El-B0Axv<A}Q
zt$6*B`v}Y7A&#vAG0*RE8kZqj*qwOg&bL)2iycdxwt~;+{TYV)^%&g<l{1wtk?g6X
z2L?Y!dX&Z5S2Flaw+)KI(L|r!PzcMKWC%I@Pa23)qu)5>SA7rD=Et8I@?ZKohh+pf
zr<h70Y;k4|R(dclOt1^4hxxZoeZ7C$#AhAoe^vGcu<lFjMeK~F@?%J~B?dXxO}Ot)
zY_GeNI9EXQMV}F>;#0E)#UW)K?~f<|5TxdY5Mjf)Cp%c%Pv`l#30_sP=JX7Z`<bsH
zDL5<+&UWY-W`2hg0GGyHzA?ZC0C#^A=>9W$?mv&)wPyruUF_?5i5Z#|hPUV5mTf8_
z0=~`@XZr!yvt0)L(Px!THYt+%{?q;YmNa8rr|4U5-oMLtd6u=27rp|75bLVS7A#vQ
z%-SFZcwW!ZBhxm2?GD6tS3ADSVEE)THi#CEr|*a$x5A-_V|gflxHFap1$mDH2YR~p
zMoHu<Fo8m)Tp!|y(%d~1saYji?t>_qB)(c!+Tj8w%bWCW->ae{H=TIH-ix#RUmR7>
z;9m$Jpmkag{gvcNSl*NTip-<NvR}}6>#F@q8=nj=q4?6B;1{QdoyQIfoV~By4ZgoR
zS}G0A|64}EKPV1BRrgoZ*{1y&hPUeU;lp1k5g;I<0VojvTW=JQQ~>+X^gp&#{r`Cw
znd%2G!jJN;JvUP(;-^``DA5VhtoU7dF#;)x7nw}o@3Lvw(HXsxq8+vm<Mh#v8qCHz
zwlj%ps0CZsj{Fq|Fg(NQi)1mN!*?tym0I0tJ<G44HSXf)(>ZUMK|PJSum$->-!e_F
zNcJtI6cs6o7>l4z+(9F~La<HrEf`AZY&q%IKn%iPOy%Dt?!O{Uo~}RqWhG9T8F$=#
zr~%}$g;iMQCd-RcdPtLH_oBcFp7WlXL&?2-`A*@f#v&Bz9`E{PpmvVjhF3PlUElSS
zK<$&7l~vsY&pcz0cVn&Bu$7f!nw~+OiZ_S_B-$dc7d@-IZ+b+n!DV|P5{voi!)$Rr
zC$k4>pzVhr$XKF9;`njy(l<0PDel=3uqle+TvK(g1qb|wg}d&^t?qxrHj#8<5}uF1
zG~JjM#ngm~<mX8OL9c+KRYUGe?RE{!;Y>EYg8oi-jF?yjYN6&Tj&1&q01lL~u@+{!
zKRTFv;XCaOTK_yfPHgvZ*^&$enzS4rfeK|!h5twbY!ksu)o6D5h+(GbEGXA;ztYnK
zR(EiwmX&6_0hH0+kW_2+wk`NLS0<eSkfwbDF7E%2B?4fvI`SVr2i$T`b+9f>?WG*^
z=!2}rS1Dhw)V_(ku(Jmh#^Zf$YU?5;Q&k`r!?K+3>H9<VkatKNnZb{0)H5ujYf6(k
zE4JyFg&t^Y@bpR(`q|Ukk+>kHvvrVKWuh{mwvjVVy(cG;cif8e^x-54^+m(f5Psa)
zTZvSRvM7(su*ez$#Np^*a#iy7s<yW7!C`H0pUb>0Oq5htBQffY>>UORPUXuOKE9!g
zOsR*VK+H{KKO%M(_An6gAn1vqh}oRL+AU%e$Jfoz&BhgU2^9c6z>~?H@yp!^;F{X>
zj_FNcs8T3KX0TJv_b3(6tfE3}*sOx%<54;BA`DA%x);pMD^i&~0!)1{e@_o*<z&A<
zN`V;#)7wzXrY(N|VXldB)|35FgT*UsX7kNkE0837732YSA=%&oElxA7zIp=F=MxM0
zpBUvMe@<Pi>`KxZikLNUnLN`v>?4DUP!uy!e+jT)z|Y*^$|}y1x#57_R=vrL-Y*=r
z35*RF6*CL?#Yib?A>+(zP*#d0@2wk2#)nijd!Ho(cfI=gztRs@M4xVZ#bn;UN9gG6
zY;$R0f^@%rR)Zl5ycPG0ka*OEWkovk|NEypY-+gf3E-t%!A<yaegxOl(hP6(@@VG8
z3qt6Ly2q0W^@;op_Zt|wcljNGvV-vgyp}FP?dH7DMQ<c=>_(AiE=Eop29eV+eoBoM
zDav;Z4U3XPrL*cP0GEgMwyHD3xipX9fP7YNRkC(h=^d(_7Je6PdW(xLBbk!{Yrwi-
zq2oBJ$h2m2di1;!vGT+w#0PA_%DRlTVeJldqFvnMRekWMh6o)Z8aNn`M~aWn-4}%p
zF;v9AnriF4o6=Rbm*<{+z`I^#q8TKuZ}TAh?C4)2)N998^kJ&QR6-HsYG_Pm=e{f>
zB-40+)~bsAk}{qmOj26{U50EZC@>wC5p{%eFn?p<$WFNNRe)zG-x^q*2eyfDf2MeR
zq-6Dv@ep)3f}XLdbNsukpb^A0B4n3TQ5xNQre6ZU_NehFmgrSdG7*-C=1dzmhgs7e
z)Zvl}7T5C(XC7vkM>)(di*>`1AgpOsrf;wvL5_<N3*z9L{Eu&@nB{evC}GPFviRF<
zsD){h`?8NEkVRe&cS+yt31dyxWFh!MwDgg?F>Z~Yig$&w!bgaJ>{gC{5l~u4|KC<&
z-w2nneQ%|hHNY?zJEJdJJhsctKFLC^$Lf|NsRB=%+uPS84$jWridAN#J~^ht$<xYQ
zW+Pr~!-*U@8F|VX&oUL9zW0+E1}4@KQ<sOfD;=ht&?D4k4STu-Y}z(!x6fE0E_l(%
zlpSaC;%H>*p&ODtfsRg2cLO}6Ll7)f+e-i((Rq9cx1cFYXx5zO_ZMPczVsU(d8ejb
zANBBh!ZeagGuXxB>mfyLS{Y?sUd%{ZWa#p!iS?Oh2sEK)s)wF<?&!U?fCMiS{z&o3
z6`T;jZ4LH%+nk$;GoqdGEv<#Za#wU2;qa^AO@{(m7oNe~n497^a#LIMRS0D+Cy9jY
z%(sJS$-`7jM5+@a6rWoR>Oat(D{`pmh;jR*yBaELVncrnvYMt@*$Or^*~7&=cf^mT
z1ks>)cm6cXa@%PpUKODxDPb&GE!w{JK}C6otKNo-ONKJ7t!n_s1f$Z}nkZzsw@0-Q
zSZt=hemphAfIAVB!g<G$_p0VhK!wyQtklY7<GR9#U7G>9Hj8?Hw~9VuKJ!FjB?IA5
z;=j?zZQ4a8C0z}UJ7ALotPj5MOTMd7+?8&`B}t5osN#S-?0~{W7r;&|_WRaptUDMC
zhGY$9^7f<rRGwIKJtj7_K9yvm5aU$D$A*hQ@yaF66C|nlS(wNN%;IdGuK;z3nD8jV
zF`quoYKOf-q8ucz5e;5A^SBz*{wE24t%D$IFpnKNfCp}(m|DgE(vdcTV6gL`*M3QX
z?XF{gE$We<BYGIGvz;X=oi_4TUs)F))qc7l?A$;8&a!L5(T+>ie{_<t8ldOTUFmRR
z;=HV)Ipv*5E4U$DvpRG+6H=-nK%)>=imm!Ol#!8Lygw0Pl-6bm)V*Sp{QjUhM-H7g
z4MSJ#y;yZh)f7QrV9gI?8E@$Lif>jXO?%nnTtLRWCbir@8{GjtLdllGGvJayWy43^
zg#+*1M#v)@@ZG%8L&*Qu(!$fBUrT$@t_T!7VY_|^8V7~#4j1@;(~r?Cq~8H_jDN-|
zo+MN{o_l6d@7d=3`Hj)+F-`X(vn&FrO@Xvw<&2aVH~!DHD_S}+3q;2qLj0lFp;gWI
zhnzYhJA;Gq-E^HBzo?41E^tY7drJ*7tPto0XFktF3b}qZhOm|dD2t!HPD8$@^?poz
zR%yBwttx>pb6-D;AQf)BS6L<;i!mY;W?hz+1O=9iR4OgD;Rl)$4wqzNi9QPmxAEqn
zsE^#m@+<_T==Cp-M{cdOIAJHveTmPc0Gkm$=IGmNM8KuI*1qS&ojvIj?jAInv^zQ!
zF@94wQByFCm{#v~g_<Vci&t3~sPesIXRqEPex7KlOQh}KV!{5zg@#Q(RufbI1<vNx
zY`17<baB!mY$@|Dk`nT47IhU8A8YF&Hb~GXt!&SJTU1zSMao<wcc^G&Z@crthv;}?
z`zqi3ja8aZ8t#{>03*BL0aN^`+v>6*)5V;V%&$JeLd-}B%1ct8b(mb~jqH5f`EU}H
z#3Vmy!P}(A<aw<wBif4UjHHg0rD4mk_-g}2_J5PP&Hs%T04*$O#=8sd{`D+lX=4-T
zi+_^PDq`T91NW=!*uSU|iJSZWPs=H(g!&ALn=Oz>#?fLy$$PQuQZ*eMef630rYRSU
zI`EP4X+DR$9|v(NeHq9ulZJUN-ZqR4ZZ_MeX*KA3Bw4s^GKZbWra90^4qeg*irN22
z=myq^04#Di*B8g&CNrtTiT9{D!}9s#Uybt$5>x?{q;zeg1umPLVy%4}o=rgX<fe$Q
z-G&BLFs80jzE(=XjQUGaM*xNj|H?r4N6^@PDC{*KJ>10tT$8$k0XFX&QGlA@%K{bv
zfC+$Z{BPhH;PC&idCuREGe@8&s~!$vhW$UnqyM9a`_J9SMu++yJ(%KFxDJA%4*l<#
z8|NUxpKufZl0uudz^0Rv2;zK<9m(O4M^?!87L?cj&KbD0i~|DoFvz1R@M}LZJTH@a
zg8XYAHiO9q0dZ$u{})V%sgn8Cm*_YXz4fQnzhZYZzp{~_zfNkf>EE(J`{N53KnW;<
zzfp5Y$F$@p_FmsfUjrmD=-CZEj=K+X_AkAwL9<Vj%+uVr)vVoKpMaL>yz9_#^k}CI
zOF`FERGoYC$$4)&)G>dx#a|cyf`Cb>t8d^tOp_=*g8ax%SfCaTe3=fQi#P?8Z87@*
zbyOrrb;0gY;>;7a>9B&&CWJ4GRRD9Le6tnUJ^v=)#?^tVN-xy8JV0KyAnE=L9DPQ3
zsA+EK<rhTrh<^))`xkUxi=Xaak7fEt3S-9U*EIa;Vs2O*u4U_uuDr>P5f!$RHg5N3
z*}=@Kc>y&1qy<J#+uG)ROx@iJ{a#vX(mKqPLF#t-l~ta$uP+}z2%~*$U)xYV+wE{a
z6khEw)g8COQ^BWNe*Y~5q@`}v&6K+0jN>Z#-Jm!Z;6A3@Utuip9d$<pnd+4lmQeI6
zA<<keN*~TS!$(aCSoHOG8jCoC<~^`kq%onMtZ=0OW|Z5OG_T%TM#2U&+U-prEMU!W
zOdsv`p@3#ml@Nng>XH51yZP%tuqFAW@6r6hxtWOhbrfCKn6f|8rlsSBS6h29w<l);
z-NKqYl`@;d_TLmg3~f&q<c?sbgj}t5xgSEkFdFuBfeBe_CYd%6F6BOgMPNGqwC%d_
z_-q8Nx}ax7ogs%F3)!7Zppst9gRQznzo;^-PWb0QYgWkAgbhAof3sZ?ADaApsL_V(
zL#;+WUvmffGRR}hbA!|DA2><Ar?a{qozwRQ!U!j1zN4UXX}#`eI%-gv$2AQ*e<Cp+
zYYftqzY@(>3M8N6*>i@rx$r6JMoQ??Ga-ZOcmU~*t|ht>NZ8LP6dq;&x9pFyJkA)U
zw9e}qPh7k&oohP8<gm(ZjO6pp*hFRdIUnI_>;J|GXn*{C&ps&x-^8Aa)*vwpUWK9)
z<bBOCgq*c^!6nouny-PxsV&juv&@<aa)Z-Q#Hxr=*#6+AHi50a!>&&XswA*dCOaiR
zySa&#zCL{=;lB7rIHt`1q+Ko1mGeXMh4>D-zbf(R?84sq_y%X!a$C^ZhBL50dSv}J
z<DzV-Ds(+u-9A}DNy%?=$nP8^tN!{Dpry{?OIYu9(35$;`SjocpRe-N@2X_@0GPB?
zbsZIkcN>lU^Lq`h#}PiEHwDj^88)EuG#v4-ZinHtA!~T>!(BNoGYV<{dBc~*&x*^4
zPwu{W>Xk8==t~2uhR|^p67rTlj7v_4NfSt7zMJyq!CL8)bpOZ^X+3-1u=JFv81FO`
zT*_}(?04;-JN2${OFL{a>}}+yl+Msa67Z-SQRk;lobWve0SmmauU<@cUjn<+VhDX>
z?aOmFAnwDF4p#$z`6?;eUO_ENGU*!PSe&A{U{M#d@mZV;ZDU`h5XLHRRm3qfuMAO9
zk)?o1xx*xbQIuH^_l}q}gy{#_N>~m$z0t}r=aez8)Q4e|Gvx!ELm!mrL0d<20Qem7
zTj3L*q>dBQ#FJ#^i9@v1L(e&4{gG-25QDe-u8=liKGAW9yE<~4X2XP*khGA7|GS_+
z{Oi)U|Jv96d)l`rfW|@Y;j4eL+=<#P0hap;z;Z_*?dA*&mlfoimWKD<7U2)U)yHVh
zml9q3Y!B^IKiwxv{(=AnsLAH9<p2&|S{$N)`@+~CIz?imd7|VgJ>?9k$5Ss^3<^f8
z-h3&s?nl})VeZ1S&7~9a<Z9@Na5N%syW^zJpI_7OkU%r-n!cuaJ1{UWmml6sd@(PM
zqTb*J-}oVa&xWfw|H2GZS%U;1?M6ID@)CBJY*b_yHK;Xn>yOTMV7|TgJYclJVLyel
zJI4YU7W&}D@BJD)S$@)fChJ@<Y86sDY)Pq~s@aRYtwEgvL$TM29Q&Kwu%!#0C0I>`
zl#g6$H;LU_@Jn2%(A5GD5v;OMp{Ss38PA03uIFW2jI-HikI=pgsbixj)Ojl4oQYS0
zMFJM?EOiwHtih9&+h6Z;q9Oq9Wl!n;ezm2Bf{_3G7_!|QMTF%*@!)<y_j|K1s%AN}
z9nm8lVLv<BH@PfnEue2rD*HTDVs!#@Qe40J14KvioFF&G6vqg`FO+e{);F&YA)Je7
z=C6P%=ikrQ17^5bQw)GFUAB<Z;o!Eo+DJ)kxS{(gTU$b>eHGC{YYG|38Eve7qfvgj
zD*uswSun(!@A-c0k9AzR!Joqb)1v&G<5vpwmgl<`d|#Dh?X-wI3RplN6bUE2z+-=e
zP>7|!?1&qjwCE2}j3zp!R6JSM6OV4(&^}{n^G+@OSP2jEG&4A<#kE@882_}0@hT7z
zVUD%(mv*1zR4n`hVZ6@JM(66m)zuFrchD>LrEpGz+09l-GViY@+}{EN>G6^ffz#%?
z5u^;STSc}}lj_!#Qh<4JHLdb~%$V@nBIBcuo@tDbp~=`-MxagO3f9-?_B25%pQfD-
zwxS#=@F0yO_}a;V4dAGr7$wN!x-yfYSo6N|5y(WWnY(=YOi^r&`AP1p<Ivm^)H#Qs
zW-9tTf6Xq@l?*c+l|92HI9)^~Lo0@(5gn*#P#|UU%<cRU6y`Z*<C1CNf|Y-Y3(7QQ
zJo+LJ#6NJdD@qj;LAA@{0b-ON%Zo|uuiwu;lMe!ExUZ3XZJAk-K-#)$SRY)T+Z!f1
z4y&k%iw(bLCJd9?!G<QRZ)DAw7a#XXI_i2|-`Rl{8XH{Q6}9PflRCBCIesg~ILPst
z$ab1GyktVI7epvJ&Xec-vDpo8cT_6$B*nk1rG?H^(hq?-v#c=vv$`?9s0h?H=jF}O
zlYqG<4XZBc^+|>tM}@ua?+99(x9baK1#T@j(l;VTLukH>cS*$_r}<M5#g4zXqa5mR
zsp9H2)5i)<Ze^*&tK{&wRk_83xf!k7I2z+jL)!|s{F0uorp4KVaYro5*7);omyte-
z9E~Evot?_skJM7t-HDr<KB{|+O)PXU8{bLMauUWMK^D;n%8>Co947w$l$Ac3B4mx0
z;oHld8&*fy2ATb)53c^as!20qx~>rBmVM{x7PtahFBX~LUTrPdOltyJ7U{&9V&*1P
z>Frn}*6)sRk66(=jzoaVk3Hvaem$s*3xyTRGlYUiPrDN`457QI8m%uChZ-(?ghCVE
zz7nG=ASARs;p^6UqYb>sKh0;P+b9^eTka_e(?4WxR6dw^VIOza1C-rce!4?}*vJ8H
zi01>L7YFDqeGy5=S9y{cqg|mkdjvAp1P24;$s5-teSqQh-#5d*u<U8gd>HqDciMLc
zuQZz_DN_QbrQAU&icQ~U_~5-{a}W6=^yrzGszUB~r#lZa9g}j)-qvQyp_9QeoTBYi
z@H&lEv^L(C(RFd3sEb)&nD8cXk?7{6j2KNeY7p?WGd;eFv(6KCX^Dy*{vkVN47SOw
ztuXYK<`}iBHRX*6m{Gc_@a9z*Eipy%y0-LVY3ZM5Q#kn6n^K@dp&5JR6!n#{m)QsC
zk4mc_WHv(aQsAfMdP$7$YBpiawiZ4NX+~;}4tbc3m=6i13Jg@ZcCj3iR_pdQcYG+p
z&_)Te<|@`URfE5oX~_N|$i(Bm1Wt5_Ecqs=C+GYYk{qr%4cY<|(!2PWVoM~t`&MmK
zHX{|~&k70Wgkop##n!O81<&q`+qX*zN2Svq@u{{1n7O^$;!)M3wZg6`6|4#EY+-E)
z70TquueM~Q1s0<JUSQb1g07_cRePGT&yC<>#Xf9S_eWr>Mr2&Xuj{RFULh&qz5)2(
z2mByyZZh>J`Efb0%{!2PX`FZ4HB@8xJ#LMfy_ULIg@um8)o^FLJeJuf+_1U(X}0q8
zU<yy9mgIn3A*w8Y@lkOA%MCf^OOyXWK9&6o+n;NCySZaOO&Qm7jlco5^7{`TMF(*J
zAvf`DAF(=YGm{XAjMjmt`)Bv}--{yOKpOToOz=ZEruQI^otzF(%b^UNV1ttGF+=~x
zEsxE@{8Lc%zxDh6<No{W|6_6!FcAU5nf{jdz`_07t^TLc_OHYEpQEM!`0?KpCLoL5
zmepGY2;D7_ln!4#yz&PM9c%cenm<^qRjjAYe6US|oG=Tv1U?#&5xB*j5!neCwzG0L
z7eyH^hxLU*5y<*G`GS%~SZkO+#S@;Z!rm+y=Rn<-_ZTMpJGYN~SWlIdePIss)l{o1
zpw|9uyCQpeK?%}zBjxEA$p(x+M;*WVuM<H>at@H6vC5x*j$J4LTMIfa=Vm|U!C3t@
zg#$~`l^Os__FoBteBtiqRd-WE_*$oUW{#zE9K1&d1y$4^_g><LF0@^+F38m{@odX~
zy1R3++0+g<*9PAMJi)G{8{P{z+tS@Zv&lXUO6?r23NPg8!F_`5L@qXG-dy=pEGiU`
zOKLZP*^!~%S__0V&olFyqud5|2Gj!LjVnnTsPNiG9jVnUP}=5MmfS&`aps$52&@^R
zO<i&nkw}g+Sy&8AN$Ulm^9sY&!~0uGrpz(!nyMtc$|>&g=s-}^%3-6h-+%!m&&vh#
zcwF&^sbhy`OX;O%tn_G{Xi{$-O*2^m^WcJ^O%SmFIH`_TDF0o8;w%l$PmQ#p57BXP
z669`P1|pC8wYZsk0-v-I(VKW<j{)Ayn;Swi6SXVyaefqVl5BHI8ESb3Y_j6bx7o7M
z!v(&v8EM1=oG};pi?7OY)B3X3@$E^iVnuE71MD%5uu!#kX^CqN#5_|Zea*hulrg0I
zV6wtvABfUHz?PelPiYYW#B)UkB%tf(AW%@e=Yjc!Z-EF#_vd?S<1`dFp@nj#w}G{L
z<9Y@Oy_5Du<(#nIkm%f#*!^<(5RC2L>WWvtyZg@vzIptWuE$S^sd$(faE(p3xcTMo
zaE>V~z{dcp+s*!aq{I>tLUb(IwbMn5+w&^wF?N^t)KB7kCM}S@Gko?-N7;LO#jf8q
zdS0Yo49A>HnwV2Ut@900RpZ#eM>;U{7ER)^?iiv}IsU!<p!AwP=RL1Bkt(py9jVv#
zoQlS%PzUV7d&okSF>l62NtW$sPH4rsKr3ISfW;e8vfKdtbVTxbd!iY`@kfDMP$G}5
zvabQWglD|rLEiLj>T!361p~HR$GI}IL$_T~#&FFDy&JfBZeJ_0j0?6lrMv^QFS8r<
z47cID)3Gx}*?2;2r{kHT+-=EJ*nx0FA)KvgpGY-TuxLh0Z?F)DL9V$O$yQMEs|>#q
z&bIUFOCAQ)0+D_8OZ$$#kAIT9a@Nn0;j0_Jnhmc=@@tYFE5WQp$h68>6we6ZZR-9Q
zZ&K*X=(4+?wEd;wV!;OmZkdZ*hMvT45p>sjFu9Dc0Xhy4)c1<%D?<DCmYZcyHVvHI
z8>|2V;M>VfM#I7eq?3@xa@#w7b|GykZ9&NP?x;zK>mg|1V`nm^VWVfe!sGBgw-r{0
zRKV<a*d_MLHY~xbl|b#3nM~){5c6d%%=|Js2Mq@I+pH!nrhBoep7$amKmx%5-FBY&
z`;*)(+n!J^MYI9wL8T?b#Tph;UW*X#{BJ+^GXn0TQnJogqHvTStjB7}+S6;X<vPdG
z@6E*@RwRdEj(^)_AcNYBn#P)SwLN0)e$V^6(}s?@N@l3liNTqBqC(FQcIPgWuE|k5
zhuY~Yop&F?XvXLsdULGvea6(RqC$p+#>|FRA=hH{xJ_)Ec5)0z+c}}_UT^B(uM$Ol
zkTZbq{|(10L~XFO6F=H}zwwTIW=&l;bGnw!`<gzH|AqkBDODQ}>A<;NACoLIp`WG;
z=Xabx#lg=|+!oLC)_tTNRUE}ZqeZ_OeA%46m8)^ErenzhVNmZEQKcsQq5HAMC{n|r
z?36I-Fmwap%bVEaoq?Iyi1bd6;#j2`S+(^f8cQ;tG;^-}mh%87)t-VrJTAhZQ%o^&
z>mjLETIbrq?sw4**K>k~WISH7y^@lw55v{-uaodBmt%>|3u1OqdANo!^Qs0Y_YUXx
z?V)arc$(G6?kVB*he^S=$g}K*bJDlt4-W!OlD@m5#-H#`mYp-3naS~;F@DJP){p9a
zloi?y@?Wk)DA|IvR(P<2qJz(36Bdf|)=r<u|9A?0gLG7#+M|WW<X~fjLN8iJjTW4O
zsB#CZS3`G=Eju&ZT&y}lhYjSTH@3fBT;JFkFl5T#0J*#m4454wv8`^q34w=wplVgV
z;Mu3QZ$9rU)Z1g=*M|6AjixUtA{&0;Bjew?T*u}2qJ6bC8*LEz%A4=Y=n^Kn{iZ1z
zCmdB)jz8j&HimLm5uVF0+c)zm8W%?$tZBW?rFt5+dC^Rlviw}k6uO>TkOvoj;gk27
z33;f#FG=u?w5c%t_a9@XjtBgKS&l`dt`8X{mZ4qSX4rEq_PE)obQRXqPq~NWW3niv
zPTto^tDeI)gd<DC>!=MeAsomq&Ay^k)pYYh*sgq<hUfDzK825(5Yw15^1{-XUJ1XK
zagoH9xeSQ%N?bADrAPVNq(`!#hCrhj>&j5bXjYm=^D?T9dgrSBKKVUcqbx+p&x4HX
z4UQeY2%Mq04~G439rYAq>YxE)a0X6T{^db1F=LEs01%zIacw<THw)w7yKCj#`_$xK
zO<^#vhyAl!RDO9dlx%HeNfMOt?fU`W#c5EyP?;v$pmoe|Kiwc?D?+1T8()5Xl+My8
zSp&lZ>AfUzg%5%Q0@&E)9@!Q#bYc14Ni!`J!Y7}eoYoCXW>NxmVYFeicRR=A89+WH
z3m4>hC#V~Nsm;5me<sHMfP$(|C#^VK)|3vH9aOfZT<=V*wko<p*_t8#6wVikaL{r=
z?mZstYd1y6$tfwQl{5yTy1?P{OxXQ!vU23N_(#Fql{84?yfTdpn>ysW+p3Q4dTHS8
z1|^VUw8gCBH27za=Dq$RTCq`uo0C0X$jE$vZVJ{w^A1uQNVJg)HVKkSP7ngCicJ$(
z>#D(ro=;&y+Y&YL4ij{b5p!N)HEf!AGbIz6u8Mnb7%WW~Z~nEMlDAAJJbVEKiqN(^
zFDPfYLIE2q^22yzPvfIws6h=^BDR);YbOo4z1-U1Q~6@Z)*E#0qDh>cy%u@+hl*nK
zNcv+*E#g3TT&mNq<!Z7=lz{%$PrH)uY-jHSp{>WSYfD9f-gvy=E;X*BO8oYBv3{W>
zhqiixIPBXgLHhCszg!O+Vy0GwtGQCU*d+4r-{)L_qsXD^AOO~Q6p06kZaRs&W^rQo
z=^`je=b%)bX@LP3dIiOcW}}w4&deDcSnx*kH~mh>)a`6|<aFi3bUxH=f_>U^bu_vX
z9@47@^gEMg)F+Gk!~UgNMuGepG;eUgo*1+S_%J)W&Qf9e9N_%xgAiGSx%^{8e6VND
z-iYA{o4;qS)Tk5UuY%}k(x)GC&RrfV=X&P;ReX+yOZw>P*l&57Ca;M`j0)0X@WB4G
z_`?-l$2hem{9(gPSgU=l;=(S2p@q@BGSP|AcU7~Q?#fmG>cPVU#o6RR4)T?c5CVMN
z`(1v#0mr6}8XX_65{2+oA%I-4`M5aADW)H2x!Ex(&7!{@KB|&Ki;*lK<FsTXhB0IB
ztq{IRer7icqXuCiwsC^XOOp^{If`+~2x9yN_ub^|`q3~YQe5EA*!f=_6Df5JtqZq(
z5zX@?B5xs#PK3xM?qSM&%*KFvQl!HkPG4kM*vN;oQs#N+;z(YZ$@FBZBGV$==5;)D
z2qY>m^oDX!EEO&c!lvZSDsuMTkyV7Dehje5A7Q8DCi?kIaw^!0pChZ>@dgPLaH@7t
zL2T<v@~JguJYNxcd6((&JDPzfV)n{gPvP@HNR2Z(c-?JC6}TMCO<8AQVb>9mYjWc{
z*4`NoXWE?7L32ZhAb+Hgb?n2Wz(z2Un7tPv-x5&kCqWcA$GeD8yw(EXSTDHo!UG(H
z#{3S87d-_Xw{X8SZ6vUn;bgd7YdId6B7V5LS&=fV`2|HrSI}VKK9dN()`j6#XoseK
zj>uXlnRbj0vuQiBz3Wx_clmYu>Sf6dn|jYXQ7tkhsolUYi_l6~{G&mbT36g?WikvR
zWfJfPN+a#%!-f2o|ILINjCRa`Dy|bB$xghcQT3K$7w-GI=;Pq-107s1Ap${`CO@Cn
z`ZjC$Cz(3xDGuDuD<1nf>ijOcvs148EQ@MliReQ9)+sDrvH;u-0)*k^uP99k{#*DV
zS!()1upn4a7Pd|~!l62+zstgRXL1FQs0cIK;Ld{K1+|%vKx!P_xPMKb1D8JE&>B(+
zk+n=@LjJltbRm9%b6%8*7m;apIUZJs1`i<h7KplMI%{^cda>cnpsTN~NyS&241NyC
zHmtHEaXE3_OlZ<1@r=RO=KXZ{^*z3V=3M82nSC$qP7>-vr7FVF4I@Ix_QjuJ(lnDG
z(Vp+_E*fnQWgxlFTCO+im~zIGS*XzFg<!tTa}i%OR=pA*tyU-6UvGy^-{*FY95dSb
z#goRxNDZoY4mgMepnm1Bc?MVf@u(A|?w`beVC_EhgucUu?e&&5<jJ`1<jdd_jBs)3
zE*w<mM|c|1g@~xn(e11*jA%$YA1<8?vKb~I@z(jG#j|LH3^y&_2@=hM#NBX82T3y#
z&5R<ZEtzYULT_<CPM3_6wCJtWkQE=6ZycUSecv(c^?Yxz2hs*DAB6nI`3TIaz?C8&
zf8@Q`wi#=bH%XgRTBHa7-m%yE$}7GBUQ^XZgEIze0Td`M=)ECPWsikAGZC&6ACy0#
zst`4yv=iAF_6JCX<?j*a+c77bMC61@TBQHt@OQZj;AyULOPvK`boInH({MD#MUUsU
zBKY+^^jDmq%#B^zQN8Y>Jw-e=ZjuJk4Ljj;R`6#*ercPeu#-tUxF_jB0`f|Zneve6
z3l_+{fP979wF7f{4F>Y{!|P@FnUASFtU@i{gb0V1{BX=P;j4&0E*$rk8MJnP<QFui
zi62-O{%m06EVaB_f<jHS$T8Z1B^w>|xiOxH-xK^ovpuRI!$85I!Rt=ecGKdy<{|8q
zg`ms;ckNh9(^Dh&kGmQC_yYVjSq;d1;+Z~>9qe0y%*G#4JSe;N-IFA0Laz(K6lv0v
zjL6`1v3@`P9`;?-D=xbcHJ1-MhBF^^j`4IG6XTlf<9K1UDzk+WHb3h&eoW*MjBR?K
zz-n5Eo`9Ag+S^|3>Wi_<CufMiVHn0xkg(gMHvf^OGox}USUxV-MkklW7Po97x6%27
z63R%RW*hA8itCRK`W|?k_8x3AgZM`KLWjaKoq>3*pyG3UDv0S2Mi<^C_HagoK>(Zl
zLN=941tK^&XgO6B#{l2!EnQWJHl0F$THH&{S(gCV<f=;6Hl980EjSkO+I;v12*vvB
zqJ`k*%4~8GREjqBOU+-al2JweE25RDT4sC++{`b{gz|~_U$q~Bjj)#eMdGFG{z-Jk
z@nB6UE?zc2-3d6Tq@=A9z_edU+=7_;-2ZYTp=WQSg2dky4z8V`f+N@h#jNB0J{R!p
z0a}&hW4SDTy1-|gI*X41_HZW&!tAFzP$bTx`Ko}fIDn_>A1`m&&j@Ux1Gd1_7z2;i
z0rm|M9Kqtp^5$~;(gs$jb~jfmy)Eoc&J1{ew*{aM{hD*E(zLpqfS9rj&260#!SZ_6
z)&N6g{KP>xUaD&8S0zcPLu~M%=OHT(lhVOSi?khBK>VM~W9dl<)^z2txa1Orn+N!o
zJT~$wz%A(SZUFx<qXdg4BCs0>HJhI^<AGg0bj5_`kLvk_CbYrSjv;5M1328ktNgDG
zhiZz>l!;t;S?4oz<=tO)rnfrnPrrWO-(vfQ3PsrLytv=Ub~Jrw0IyDn)v>%VH;U*o
z6RYD?x`O`h%j_UbN)3A*X%W0W98?UEcVXo@ZGqZ<b=TF7B|am}n-_c{WO%e@hma-|
zy}>sz0K;qNenwDzRDk8ogIVA@0|}zz`#BWf@)iug$3?pTI&2>g60eOq1qU@2D9|T{
zz7lJvVIup@q>g1ZQxf-Lf{*9nd-V~b<RBPgpYo{3iis~gO4S&-O2%h*<icH<qiSco
z@QHspMjA<eCT5*u2F%23-4-zw_Fkuvk&KkPosGaXE!O?JNZSda@JM>THI3b)#_QA(
z-EMy=rSCR|MaviSMdSSL46vat<bf%!jo&ix;f?GKkR^71Gf}~(mU`Yp+`HWG4Og!5
z<yJ8V%-aftr`l1GuLakBPvhvg^h+|bcy1nsdoL(K*j|&(CM0hBFhYtx;zx5GRrq7C
z0sp~&9NKn798Kl2wO}kV60C=h59D@f-`KUUp{|Qafz1v$5bjl495lobK}Cb6e_-LB
zepQ%Vd<sG!>=Re)=j(U}<5`yqnTs%#+kj!~diHk3@p@vtwrTTw^RWkG3REy5?>Vx1
zUh0-;QDkrMK(!pE#z5sLUKKPXL%UG52bV2nY>`ZNswveo`Rv!0aF;pvMQqjXl%V4Y
z?IX-X(UlXZ>DNH}Q0>7=Asdwn9d$j*C#7d-%Nl?4BIm0yCCq`I)~H^)>px<@0#Sgh
zl-w2!0*DgYNH@oQNxo7jwZIR|cOS1lFD1C7b(UQ*tezzGwm<ILygug7Tip!F;rG4&
ziE#=Cg#*C6=kn`5uvuecy8)x34;bz3m+-*3Rlc$W0H=7WwQ=J&4H#AaszVr!-`@GN
zala+i6~gwrcv3mk=SF0T5q&SCK)8K9-t#K-?HgpbV)A6CFdNT9{;g=)cEjDVJWQqZ
zo1WtaT6SmIAN$^h5Irtb?-16Y{2VqXt(x8q^VdS$#QQx}Yiq<oX%{kv^UEr&zTVD)
zMm^_McB0-0`z@wt$QD7mP}q$RDQjzX$V>Be>ky^OGr#AtSEmkW0fn`^N^B&Uw3FR-
zO$W$Prleu+7=J?EOBT<9>Q{1az~sTwo{zg-l1PVgz3A+et&}9`b(um=B+bVmkZ+l=
z#}ib~oc<z>L^6sia4`orV`Wj)$aXZ-lV<C@^~)$-UaAy_&GAYLgxTK3yx<jS285Ku
zG20&8Ka-6IJ(odGN(?%Sm6X<6RzMNo?lq1ur0q;%!?%=KY!itPV2zhHg^}n+@J`qs
z-fSl(u*nzqk>U|YYK#RIltQw*Y=xtsIK-Z5##XXO<@W{-bXyZKwl4xdqW;9*>`Aof
z^+WM$D^s@Vn%{ARsyBf}`~=kuWwRTigu>{T7s6_zhtWaesjX1kFx-o%Z(`~P-`l+E
zw2XR`Lb7TPgX0Dg)2cZMT}Xgu|E!Ezw}gfOmcMJm0{LJIQImZ7^hwxS%trya;K!I}
zK?0o1SCD8P7FlS86q5L;8-GtUc?`cho_9KMZA40z%bGo%JQ!=XFygjc{IQ5)2~TvE
z@A3{?u?P(s$iwsVqe<n@ky<;s{7`pc&p%aaMs}M@j3@Cmrr(s^khU)THN9*^A?t{P
zV^USLk)<{lPh7_{Q8CIRGDZh~%z82yYXR05HTNiMc!sVZUIGeK^XG>#i&?x<!OPAy
zqx5<k5pv|??bmTiNVQnAAvxHk${C$E+ul%(`Rt6ZOp#hXvG5B&lt|~D_lJ6)M7c*0
z6kkkNB&4{Xn_%-;o1|W|3K>4&!pv0{`lxq}Go`o)yJMo8veC-%^=7x={+>V|m+&R<
z6;zjzgA>Hk^FQqKs-7ermi=m!&=tDx^bQtuJ;jFKf>n)O>1{E!%a+=l7RrEKX4E_k
z|K?(FL)vbk5n-V`udw;e2;TLGRT6@cOXaWc>00z*IX6(Ac9iJjN{KI@kA>RJTj9Tv
z+k6YVVwp2>5X2pu$zCC`W`GqsJ9e(N8ApgR_l3es>=(zp$15c|Ned7e<TY6SV_`nu
z%$5B}48Hl+pKcf6giEeI+TLoV2?xz(_IuhUO`}7sKb!SbT7I0i5w{95IsZV+^9+yZ
z#Yje5{hS#aJPN+7CW1;K-1EHPZiyCucVxW`4K93*2+Kht=Rq8#qZ$5VOx0s6NaXGn
zUM)Ab#p0DnVtqfAbfNes(iW1W_Bg;B%@cNh6VhKo`}o-vP{e3>txosinL$Logrre{
z;1PY1pnjJG+`Wvjda_W%>eF~~s7LcjEhpGDhC7JNKQ!*Bmi@C1-e|tJ?<QF&#RUVt
z-BiVkk_!je+kZDjmcw+8=lwnX##)pru_Y6HtzN88A4bgkhjes1_jZ-kE8`fvIFVMa
zlW>d~6WE1>&!wDT3iZ*Bd)ii%8@T`g0M`vU7X1Y;qzlKZc;LD_dJ_|6v0Nt=iU%=G
zC_{Fcl_X6o0r%Q$Pwtp*g!Q`f8$C{ZGib7{>fq>Ac!Nk(h;V()gmCft-W$j3DAYNW
z=m}G(&W%_}z*toP$K@U;q|{F8R}~R=4`sH8-{z^X)1IZm4|TZO6t2i#Dp^YJ9_INv
z;dx))^Q504qF$+ZxO-_45^3{Hel2dUiR93#3VmQr_+Skybc5TdBp8%ZEVHWPhQ+2O
znkmw;1>t>eqC|GNElf)E4)E#wBX3q_@JmK@ECajDB5i@TRF2nrxgPfEfjC6fWe_bW
z=;PirX__?AYk?w_t4dDhrp=O`6KO8D5pG`bl$p}8)+&0eCArm`@5)+9ITnM|ec_|M
zFi}|M(~T^7N_CLtmdakM>w^L&WETQKlG3doO4#-i`VoUBa1ZC4j^uVffM{oPk$QY^
zRY2fap`ul_<s=qT2-2>oB5!=XggU0rFUaa*rMwtcS!5W)*uKKUgbW4#(4~F50DjU>
z)ZOI<+9Q1?r<vWrjSFNWY%3=j@kN6f64!Tz`3SO^st?!ZOL>?WjjmGqgN}XSgVG5e
zGICi@g0?~=WXj0dq4D(PvMmv~UMMb%{)!MS?l0(~u$%@r<2IxI6uvufg0&XGUylUa
zGgEj?ZLq{iVVi>ElY|X>b8^EmC-!WEUy?e_XB&A0cQFG*y(yP>4<V$?u|O^4+!$46
znP%auo#R=KD)(orFl%mC6oN*wCM|~n4+_1MW^NfF8$)HKyrc8;c0V)bww+G4U1?NA
z#z?A8d9Cn3^*cb6G;NQoHY8*Q=RI!y+&vlecJ|9mg(DGpb86p-A=}LCFI~L+Jsu<E
zY!UBT-lJ*5s_6uMJbkeq;?ljQ{i$5Cr<a;eDM1c2{zmu<mk<Yo6-^GzrgAi(89Vq0
z;Mba5*(|3DBnI~kd_S<vl!vZ1b3dwh1~mu4Ho;Sx_UAnST+K5Q)#?3>l=7mi#}#jt
zrbmW?ryZ)>jTkYNhZwC>g}Bn--zm2Xc3iw<Jb_k?sq2!GA3b;s+OjX+N;7VwY903L
zGwXgd!6-UJH2@_$XEFY<K$=+OpF8*JzOH7W@byZjlPn61g4Yutj7wAgp?*9QCv{Qc
zPnMB)r1^AMDWqLz{3PAX9H%HtboOad1J2a>!%`#Er^350%iDDF@GPk$nBP;uETlP?
zzo~iT+8@(;V0BdM`_8zq748VD;?8)j7s-*>Lb`u4-J@{4Q(UTqooVTLu8r>DAITX>
z^1eKWuh?W+%qjcdSUTrK=?1jJcfg$P==L-9tP#0iJxne@4^Bn0mLwy`5oT4R?J&ci
zdFZxi9rOK1Y=2OuBVF`A{KWhCqFk+q$D*z@SHkM@3v$44K`_GV9;>--YEt+m&zwYw
zfuZC<T`-MUj-^AjFnZla_mX1LY~at<=VCjgD-11$s0n`0LsK~aq|yY*D-O9T<d8Sx
zwQx{67Qd&%An%83YcBw|zPr*U_Wipa((mwHZZEFK=%LQ9u9{B^vd&#LwgaPgA8rf1
zUJ-oO+&l`br|4m&gVTO^3^sN4>5AF~iTc`2e>Sd+lUq8d$%bb~c>=Na{o_Mj3imKf
zays8cKp|8pQR-OH6uHuyp<3#ZLd1PAL01P<fyRYo>J}GY*EyM757xgP_gwwfoTXpF
z%aABlH7gOwc#G^rLJw&*uPeg?00*iQG?g6F$BZMabuw?-Rh{ct=?1AwC-6$-wP7t@
z#dm7uq7Iq-ds*}(3a330&!X*?Q+;(XJ1C!CzGy7CKriA><7r~Hc`xRRd6o2Fu-p(O
zY`A08Z|D5wao4d#a8Kf5P6JxUGNAU1lpwr^@w@OXa^c)vpMv|d589LKl|Re_W-{b)
z#&4L_cd*p!L#j4Vq2VX45P;RR{?=-6HO6XS)31nstHS>*l8j#gl^)*IFL|JjgmI}@
zF*A_gpQ~aJz2Bw1OZ_p{MEgIj_@1a?Qr_{YS5Fgq+`RF762?zN1k3-URQx}9c`*Wm
zgqa{z{2#yHu&Sd!HF@OwrIG#&zuon98*K=Jt;^9~+s@F>PUTUlN@+=~Q&4ABw}7kK
z+ypyy$-*Y#en_<PB_RRn7e=4H&i!AMy=7EeVb?8+OL2DsEflxn4y8bGY4K7*DGtRQ
zf)y)Jic8Q^q-by}5WKiUaQEO49B%r4-}&x6<Bs#=uz!+0lKsej)?9P0HO*CW(BZXd
zXhY!EjH{@}BB&-obog|_;Ge1)88y1@>fVo|X!TA^M>piarQ1^f#V^TFLi7}^oCuo4
zolm{L<_v2lV?|GVX@G2)TOFSszx>i&LW5bFu>MLe$FM_nsHUHK!h#@sk>6OJm76pS
zsD1sq-1d<GMzV*4H=@%Dry0?}aB>+o))E}s8W&(8;2JQFTmbK{lGqDt4!UmgbQ$>|
z$O;Z^#TQ<twkDjzZqIJ@GWI!-_%s*B{i<cAT7`vtu6XoEjD2bXI2Zw@`m%m}A7wi-
zJk)CTN@EQ(toJgcEx>gb-<zwc1~p~34>l(dq>wpw+mfIxMlg}aFz64fsF^Y@tgJ_Z
zON;Hq^{w)ROcfah=itvobj&iNXlG+lL2lxuyE0{@OUK8CFOk1IShZ^+;@=Y80Iilf
z!V&5HYmCk|3`eAmJ_nBTg+dTNuPLQBHmHo)o9pw&Ttl$Uev>dk!<w1h`!z<@ADTZM
zUlqqREWYGtn{>)IjpKNmI$9&IWf*<@xj-M8K))~@YvWgQ*4#cAH2z-mxQGVRGC^s9
zIg!B<3=PVBFZWwN+q*L7&E^}RAxa4~=Cz9Glsuhc$GMJHp+9MCwC}ujGt{AESkpkZ
z`=t^ByV<>nBql!mw15nB?z4T=p*fy|h$ZD#BK0X+;Ny1mZmuBXtsRecWdW~L2;TcP
zw$RI-0tJ_Tp1AGc2+_*ifPCLE>ROyuArCQ#poJU1n@!-o(VZ54PIIys>Y#UKxMqgc
z?&NRQ$6FHuuRpFo;BI6Z#tn*D?N~2FpJSB|%`ow`5jT4rtQ})ru2Q7O@M0y+?*&W%
zc3$U$F|i9df%f(^7QTEMQ@>ZRiWnxv%JPrI<%<IFZtp#SGJZq=4xU?t;st{=6~ogl
z8ABb`i<H$~V8E28fZgmPdX2%CQ27-C)?kgvkqAVt$E2^#)Ci83sjC=d<LE>1QeFgx
zqNl4iPAjN%kA;aqgVqyyN`It*wMy)V2!kw5|Ac5wUbRny(It=CuzlSh=>kRU(7`+v
z^z$m_VQG@C#E)fn*jTY2LcAq#wXr;1-|}t~0p8{uXr*bwpvoc^%WY$%9{Ueb5*m^l
zf2Ti(hye>KaZCI2y-g=6vlU50TmFy979s|iIyNEwYI%QFR@N3PGS#HahY5%G`Rp#~
z(Jj>q=glZm`ARf<s|QXc&vFd<{}K!!_&R3)1!@}e!GlOe=O!{g^!Li<gOqS3%_2b@
zdqAqN&>nHQ{@Y)d&(=TXF1xU6!E7I|fD${t>F7ltOa-tEmd<}Lm<2H&-Z3ZF_Xj56
z56{rj!y5F}yD(GV{2FV!&Y6!CPE9P9VsP}pIt6X~uH_50X56`JsLf&gw1NA1O+cHj
zDZU7%oO)%BsRe_k#6J)#RE{S#i+<4L7BnyYy?4TeZG`d2s4#Oz&Tx47)$FJBLq*Z9
z#~b!wzS|>VcZT-V_J+PAOPI3&D$R2C7(+u&plFq-=1&t2V3E{NxaKitBvJnh{=&S}
z5kp_I)!OMdjlTU8B7S3i-i`|MvJ&RZshY3{Nv}6Z+oPt1y1i$jmHrUyApG&E4I(Ua
zTOZnv=|rZ3#(6aGXzyv;9Eh#nd_b4&7YFLyV+t$GZChX+?QGS}n=J(Z`uY{>k0J9`
zffl_vl~1UJ=Y<%0eQWdDRMv;jV~^<`@bJD1&i~{9dmbBthLf_ghVvZl>^S*INPW+J
z_r4DEskP+v)SBk`YyY6qKvp81<*9UOm51#$h8fz}4!3$=;)2pY_;8=D;qf`MD=tYD
zq997~H8@cvBPKozhNj>9OwnvUHrMi9WFsu@EGi0O{msfC2ZlJWaA8Zg#*?_u<VD1A
zLN}owCk&{FaQ_ZK2_+lw>ib^Y6r98`X~h`Pp@8!qh?P<NW>{T3qrlS1>XV-tk@TG9
zEN8LTL0m_n#h98Y8iGRIWao8M8qoVM<H0B!)7gMajOmUhuyB-$gy2CpwL4J(@VfNw
zEqA74EavCIy;5SWpe6J19H<FCJZir=(sHHln;)!Ia-S(YI8)a{={>J|^9T!MC)Wf|
zu+8z4GYRhqUC3ZXQj&7oYDEq*x#V5Rgr5nb-%Bc?fzWsp4GVQ7?WqX_77AbO2LvZI
zpY#82k-)m3i-{sDR4@rd8i}p10feM~z7y^K7kP4-5bk@S!V-Sw@2ygh`l|VEsjVkA
zwA~u6)0l&H%S0)0F{UECoGiXCDav%ta!&G|<jGFhGMn3sTX43oI7;_Yi$sJx2|#Ev
ztuMwqd9JwMth9uSlz+a0v~n~NesE4`e~QhrhpaG%u{r2L>yJvm%Y|6j0!`rf$hQKx
z0NyX%l2>$N*9KP%9_~G!u`i9HM%&Go^ct@)0>27kh>KC~ADh~Z?!%aRCo(zSy3(6~
zEBPEiTVA(D^&_quN*zP{X|TZyl7o$%DuoHb-oIG8`Z*V1p$ARrpvP(R#xhoDn7~Ej
z56qQ8<U}ha9Fy62y;l}0rvrT<ic$W8PPgaK#X<%H#QZ!i6EnY~UkDCP^qP#qaJFAi
zf=iua#5t{mEvHHQw|i;i1XW;hVM6qb{yP)8!U{}HX>D!wSADyCd4L3DBrzY0!|D>|
zSb<#8H1r7$GX1ke8xb*Iw~SRMFckDDceX>ALwBCXZntUyI#1SWi1*#;Bu8Y|yF!dL
zAV{~P?;6mgChN~oLZa|#tXX7B?4Y|l{f*$tvSe?o4>Bn+bVPSAWYT0o8F0ZL(j%EY
z&gVK}uAJHkhoe3tNLmZPsLb4G_l043%P=av+Y@g%p%FA^MtFH!D2rvRU)i0oFor(#
z4z*gzra?chBi>|>ex@X7*f>gyw%ri1Sr++TJ)<Sjj8y9kuS2XRKCONGnPz!SNQ9OQ
zV@u<w!#p{VxWs0s3w=Q%?y|(<F-bT9V;FWt9wg1<n<&eIgb(FU-1V{!BUfjMZOx3x
z(+z{?-%$QCWvv0e_LnlA_`&wp#;L_NI453I^MkJG=d^#RLO=4`p($m=vBq_T6zmX>
z=4#r4J?IvifG>xXd6d}g#d_(oC^~kA#M8jBoqK|7Z$Dktg`V--(Xs|2>6_)1^Lxb@
zYAI5>tGiQXwT<8K-kDfx5gVxyv$)P*Rr>eou$H1xc_j9(zX*IvWBM<8p$9}2EbV(?
zgOpGpJtodbk!O050S2PQis|A^WhheyP{Z?0+UtQQq`KtNtn-Z5bZB%xVi?-)dHUSO
z{&J^$MDTfy&usCWL(XP>+Mlm08~W}WoQIL0Qg<hMxa)`wEU|2xD3+R7YToc@P1E(p
z%0KUTf@RV~7W#}6-61_J|0nVPBmqg+efMrWPXT+XL=TS$FfmvAW6XX68_gkPJ720>
zc8GWFYh=PhrCC45Hj;mE`{YfSFjw$Jbz;aRZ_ZnHpr6|oNpJ`T-^8MVhf?~;ask*|
zg98|loN85VHC|*KjRxzXg!1Zpdy54Yzde{KkI&BL<wI_9j{trs$O1{LutO+P&`qXU
zU67QBIuMiy1q~qMo_~NK6&Vhr!av~wWqCwks&aBc{zr494=rKYtpB$WHxe_Ay6=oI
zOjVeg$gr`z*F8q^BcXhHTb0ABqpSL@W%y)iNLiKVld-_S938TqB8diTS^wU+oP^1-
zFbeo`SQFP`Qt|J%Bw-OGvoeQc?eI%*23E!mWD6%}mVEZNuzAj{>W1Bl4;S7|JpX+g
z6SDP>ZerEO1Gcw7LHb^hwXTS+zklEU`|>j6Ob<4Y23GuToAh)eQ3{0V@dgr%sI!L{
zOY(dkG%0ESfjcyc?%CZ>kydLoQ+J?&a#yv0?jUym<Ej<(3`PRw7#tUK7k$V<2SZ!@
z7Ev<Yh84eUXi)PunvzZx1Z7cX#GIz=5C<HH%rN+{a2cS&$2LsHid8IxY;Q%I#CwON
zK72~kMGp7S+J~=hZdhwW(#Tikf1@0|AmjgS>OgIzWMn#R{yy%9^Lii8YBPjv(Ih1$
zk;vzVdL@Q~k*vd0s#+JuXHjgkTLp3)zR}N{-BugRmQ)zm1^vysiq=4VC!Wk!dZpaK
zpcZ?yN?8sTLJ%nZk4f4=EYsJOtMGO$w4)WDklZ^^;{oyaGHVpEa}|<B1}W!bCI0FJ
z)Foc&AEe}A3kLo^D-QL9_R|dRvM62^jcYn$biGOPf|$XNG>v|93@Yv+XDm!u4ZJ?9
zxahC2ku<y@Dj`)XNdQQiyB@p$_LHo7-sK09U2w-vqC&!rzoBz58Z7<7$F#D!vx}9)
zHc3q3=$e^#7x!rK+otW@LI)nw(kH1En-zv<0_P9dGm>KdTY`p|Q%pn_s$tQOHZlF>
zGb6O07h%T~9c|Jzjq{%6!?N8uZ^NkVdw&#+krG1#`F$U+#{Ol}E71Ga`Gfllpybl)
z71r;rZ_x!R#v5IFDRhD_up@%g2MC9%<ZSqd-$|zwlHEXlbu^$8Zzda{!OYpbfY-D$
z1<|bl;8GFY>kz1U)@n{Tm@RAVFq4(;TN2aojE{2$;_g)db}a!qqUYv?^KukWJ=Y4o
zL8@_;FapnEs`fdd%?t(iY6-I8nsYE9%ek8*ZA0pvOCK}E7b>aZ3ifV1V5+0|FHFcv
z_Dq>k7l6ImcJif<ib?>|I?CC_C4Lkaw-pUCry%fZY2?%V$d4UaZ-st`RdPXeM|Cq0
z#>f|vF}u<@3*}1amwTW?`!)5Rj!K%%6h#YR<8yJS$>rEDUpvF*Q}RF3Xya7@l4UEt
zgq{|69cQZw$;bVgqzDsy=)R-1i$jg{?XWaTK;3u4Kldnz%Cy+W$<gtCw1Al&g(~M^
zmrNOd%B&3c4zl@KjJP|SeDe?s?8+CL1LhYZ4ZZ0vsKyi&09r7L@E>xu`w|$|ahV;t
zM-pjOFCsPhU2_X&Qumueezyv*IWG`o`Ns5cWB_IrsJ>wE%@{1Gx1ftSv_~o`#6m80
zpLxbIe3j4FUxW7$b2Apl>CtI!To=ajQ`ZGwjW0L&GxiQIg&BsF+5xq~9#{9o0(Q}+
zjJ@8VB^QJ%=he;NWX}8H4k}&tgg7$O&*w|j_ZHjIxqN=0t)&AF0@_IYAK5RkxuI2u
zcjm?8B&myPXp-xlsMLfeA&Gu`xpB?Bowzd`c|N-{_Ae)PyMr!!5c73t5l+?}2kX+_
zP1dPs2+iFKaLn8!<tGF=UfQTsCz)r6HH)!_NO#pzsz5;lBf?buIW@ZAok!SV$var9
z14lCfMER4P0AvF_==9duu>FynklO?+(KaIfjU|;sQAg)K|Mz1tykY&rld%X*7JAdM
zdJQ&*Ie(hT+x<^FVM3_z>M|snhc^^;cD|0G7C<ut-LM`lw{r0%tI$3Qv9c<De12gz
ztA;9h;KCRf6p@!LGF8{ymD}<-7|Z%)jG{lu?!}0M9N3d#tS!LLeHTWOVKwtNmQP&h
zHz$y2W=f7T`80my)?u?>N^p^^u%;qKd}8j9C&gx^f}w1NL1BFZO%)b?&ta6V^=hnO
zhkSFwUEiPN1Mi2PZDH_ui4PqHKaP(?-cyL6KZX!^&36~3)7E}yY_SzazGx`Iup{Mm
z!+NrdN9WUNMfAwOTM}N+;JdMzjFSn;jzL`9z&x`g>J?<U*gh+Nm47!&OOsST$w<P2
z6WP+6u})Yp7z2A>T;~`|$S|KD5J6}&@s=U3cmy(dSLN<xlb+gb)F}hvODx*2L-$*g
zDKJ0~|DYaKhE@AhDeV?pOqE5y&G#6dr+Xfs<t)W1cZKM>!R<cFTO$6OAjrDaHL0AW
z4&#=-5|r!HtVXspHg$s?1->DUl|PPOz*)qwR9!q39W~#iT_Mfo#X=CKRXQuy8od13
z`cB~WXe66M(J)@s`G;3p(|gQXxnCg9Xxematg9JS<T2dmi}sA0BXhfXP$il9DG%rC
z6tU;29vOs>!fg;fdjX4@A9`Lc#M(@j&`2%ei9s%{KWy7dZg&c(8v>pOnWiMmAx}(1
za!N{ghOoWsTP`jZ7K~(0J<{^Nu*Q!!3D>1k<!ZDULWncZp?R{X*Agz=s`;XWxd85e
z1dR|9TNb)$ovAIY?RZ&?2OH3<WoCl$H~W5d?hSFM&KheUPeiYDS!r#qL#-525M$lR
zbj&yx>b?G<gve}kSK}7p{dkJ!i;L4pglx_}=fE$6`CgxMDSGFDbts{1^Lvm=W=auS
zJYyWhHk}|t#6IR=+2~&N4RbQp%ZaGhLu58~!<%t+>T#-lBc?<UYq*>Yi@mP{Wv%;5
zGVzY9=m0)ANCdt9unl63c9&)$F^rBt_w9^Ap*(PYw(W-K+R+qSXZ!$-oO1<w@xMU}
z=-Z1s8!vyrA%tIU_;vJ|VZqDEur_|WcD^(;z7)j3^px55k@366J$&~GDCHZ+jtl27
zQ5e8L@cRKmc*>RUJS}hDXEvv!jy@m^-F8VxabUI|gLlWA@Lq+ikE{5hvO3QL&T=b^
zBY9Eb7&ce+@{ccWeRn0fem&)Q&wJ64DbUMO;Ka4`8%i01gG~PhJMybx!FS!1`OQO7
zJk#~j>QE3ZtOz9Y1-em`VY@J!DHWE89?G3cEcG>_v4S#=l_M#Z+l}Y=`79-sE9gtL
zbyY{*3LsnGCwN<ujP-LiUTj~-dEJoX;Q0K$PvehrkKV(m`%7EU@8Q0c1oRVoc@?{|
z8>&e8*u<Ib*x?r(^nd{TS{R{e?9nrz*Q?CG9gSXgfL#y4H(t`xNb2wz2%`dnNI9my
zrT;+V^eWu9i1)oRkxhyHhB?cE40dzYH1MtEMmSMttz)n|TD;b8y{yWj(%)g{UN7>>
zdBL-jQ^;QV^bj^{M}}GKrRK|^`fyrJ$t_@CG3eywHAJADZ$TrXJ{vW_6a7NSR8t%K
z=aH%MohB^~)9P<D#NN$@^BY3A-ou4UTyC2B-J+2OS@^}=w4`THQx6T2CNFes<_IcZ
zvSJS$WmzFEu6ZcD5*FNjsRp~EAG1GY0I5iIOcF8deU5ktbl>|KEf?s!0(pHgPS>G@
z20O_Yb>MMcsKMz=8G=^P^|J;Ce4?8#**iNVfIaTUZC(AIvk<$p^Gcas&|$bTJ%cjV
z_;@cH+8j`iJw*_{<n>@-qFU=*%o7`=&B7!%uk69uop?%>Z#deOwZaBO+~;nw@9xsR
zHZvePG!cyebE&~b#_Af`u@THMrc_9w&VO&rZc^bE?g~|8^PTQE*~iGCA@vv<K`diq
z<1^ORPkODi5VLXdfvZ2bg-D_W?vkKOWA8IE028vu=`FmmV8=ZvEA#f7|DKTjDPtc<
z@YnDYpSgrm!J)V5`@rviK=lkQfYG941Z(1SPq<(~HC)U$HYJ_aQJ<(qov)5Gbs22>
zZ1mGs*?9UNZt!r;;IhytBYmgl+ixaO@1)^w<F7<U>#djSe^IVGEV}9gOkUQJTOSV&
zoELww+#&XV_q**q*0J+EAKITO<4j>2i!126-Oo&+g+}>;o@h*Uq&t>p`s?_JvS>=W
z2C4K0+9HqNgugAlUzLXP6eZFaak;FHV9|*+Pu@+`D`;4~%c|vZ+nZTueos}NsObUm
zTOL?yHk5`7fH^LV7bP;=usPLU6ss*YlkT#7Wp()-=Ix3TVCDMfr=^%<*HL-R<=?V<
z++<d4%6=w|NtO4ND4sO`*-#5)2c4IP4J&7U)27Yt9o3eDt2;YIjTlF(t3mtIrRM?z
zbV4>kb@sDou6a*|%bbvvOw_Bx6dPEhz~dKPxRpYKt9HrqHYN`?qNdqH+7j*j06x>B
z0hN>~SB@IJ@=8?Nts9FEQXkyn9WRJBBD79^$)379Q{W(8te1h_@<X;`(Emao2~eZC
zuH1Z#aJ5tG=_j;|Q0<Ud$+&<50-C2sk|zI~h|2*LZa}6s7at!FtFpkxCm;}q(iA^E
z-Z?#D@Tb(v-fWV6JlfmiSW(?=FC@Z%RlAP>mVUznpV?cXowuMm=<{k#4p>E{LGPVV
zz~WI8f@)(Ee~=jNf63<l3F-a|8vM6}tckps6%R;-6wDVcE`ET)V7Ufy%e$5r>qi<Q
zN7L8=zE_F>-|5L2g@@)q7i}(ZdA{A9R|j11&yxtqQG|hiw@$jXTpeiE>PxXyOQ5F!
zZ~u(^A!zVd8bD;??IGzuvOPn=|4=gjuhi}t@)zOS^%o%78DwVsm=;p`!Oi;s%FE8a
zsx4f77?M7+op!o<=`+8?Ozkp6EqEl`I<(%Q%}Uha9yZLcQGm@Qm3;Ha6jrn-s&^)*
zu7CE6lreYnagnS^gFM^0-3&LbeWl@RAIBoL1*;?tS5rf0ev=<ZQ&DHWDh%fZ#Zia!
zYjcI8wM8sTLqJ!O1E{hkp~bwo(|1v!(W7ZtbwP(pw(fyeLPFxq>~CqQI<Q7fh=S{V
z_r?$R&pm7H2W&l7qldias;8X8N1}tnx**)XANe^>GK<C4`PpmAJyuucYH6h2=^%E&
zgPez?t{g{CvkwIdIcvlxexq9A*EED^2?MUcIZb@;aHHt!SDC9<_;)3qQZ-sM2;K#k
zkE2yPlc48w`S>lehkXf4+2*rF3|w<tG@iVBHkPv9;m5LFnwHleRg^gvs(u~Q<0^(d
zqadcIy_pGaHSfZr<{pRc52YJsog)5lT7)O?Ky=sk4D(Ke!cwi(^}K1^Zpp(AC)l`r
zNF9>@2nGC1U~^t@j@zl<W-K~MxTs=vNS0CR&#y9E(=lWbcVxMGeMIt%Z<Vp)<i6JY
z*{GVJ!I`!pr_@)!icYIVw?^btNIL#V&=64T7kr1!>4Rd$zL>KRvhdZfx$}X%{;$Xy
zo6FPt(Xx*5aT2{!eI6GMB|}5QYg44(3n;kDk&W=6fdF10QlIAP2T?6<Q~3|p&dy#Y
z+LGan*xiK%P8B_d{m4m8#Ws5)zQ+98*3fpa8#7`@i-Qj;c5Q+{P9iKkGu0qgns3!p
zo`n6*Ns+pJUOX6McH7A%Uc!^^$B%rO;|iV6*S5&6KV~pM+MiC@Jdeb4|Lb0Rtdj<$
z8V40_jV?*OM?-UFHaNIfz+1Ajv(uicsivm9HITe=Fv`TueQyU^Accb3gB;T>d!<F~
zA)S_}e)?EokXFz`TZ!M*k(lpAvA^cqw{LfcRZ#Av(L4)jXo~|Pa*X{$zvU$DRLVX+
zNLy(S@Djj{=0dg4;{g1EZn-E3Fsc3F2yGq?E)t;;-~y407wq$KS?>MKPps|Fe|e)u
z`)R*2-_7T)L1hI_tGG=^hhKG2@z_~-rf`JA?Y^}g1@Lo~%DS`7C`R`?n#Xg5B5Ij<
zE?oC;c?Ko4SMtL4Y|&txmY+Yf<Z#ZMZ4FidJJ9~Y{vTuDWE6xS4xBx}U$&5J``2KQ
zBmcTd?c%R6+p1Qbt(yHb`8{9#ue|%lcAZldghHD8WR2MCSH4eOkiTtdv_Hct{X~0)
zE*`0y3m9b{YbcfaX!ARAlKDBZChAcTleb4L$D8kZNcW791LBC(9tNP-(<mL<1$|fc
zbu}CvE@UxnVBRhSf70&-){5Q}k|knW+!v%=*W3Y$5q$s*1Zo;%uFg*`^CqmoPx>Qr
zwY#^hy)3%(g%=NQ<(1~~%*dBZLPEkx7m@7WozD^;`{aS)HUA!KAp!YVSa5v7UBVmG
z7Z#s+dUmX6^X<S^kfA)w-vK&X4YX;Af;i1xZ4tJ+au?aRg5kY{-AOIw<7aR9xPxd4
z#k_)M^j-`N?Zwd&1a{;5W+gAsCF8DBV%Vd?b)VtmcUQJQa^@sP5oC{s<C2q-lKPtb
z_quQl&&cst`oYi{EG-$p->h{TR<u1D_yp*EiQmbsy5JF588UYx^Z-Ly0oQh94x!qN
zH9j+|)L(g-rV{0=|C5CC_jK1#%wyX6GO9<4O{5>JWOHpTI2av!U?*sy0m(JCc%F$f
zGc)HkAld3GZu3Mc@^lN&k|}JkydUv)XnjEvPaSCkH~&UunMo>ZFu0D?nx}WioZspf
zk#;R<4p>xfMpY^cC7acWhd0PnH-eC%6PdW&a)Vy21ja>1;@o7a@9pi~lX!R?FDIw|
zXGMNQuE;>Bl|D41rBN*v1O6!*1bZ?xsdwmzB4fLDM|zXn%~lK-u~zvlBI_{8A(Y7B
z$p5zmDWRb6x0eSIZaX8Vd$huKt25;${uvy|ip>>k9D;xr1@dROxDQC?9I2cRdZ4cw
zA3{Sz`;nCui(I3FYN!SV280Jl$M3&Lx*170XJSAwkyp+Og!4&v_ZxhgR~QjQfNe{p
z*ZJnj$k5Q{`D^5#lkq?4DH?24r&Pb(JO5QmVLD7<)2M;>KV$Z9n<F>+PO*F_mSLS8
zh1E!AluF{uJY)+*WW@FFb}b}P9x%flrpNQ7JmTvEto)nM+9m?D9<$&68i)b!NzXT9
zfbDIkY4MW5_JlOH$3}8z@e!OgLfp2tz|j$Eqzs_B2L&lgI5;@S|FYD4ru&~SF0Bq~
zJ$X$9!qj%Xa(t+IS-L4vxnEErtzF^o2-{Irxx0aWOqWhR?i+d&J&Oh}h*HR#Il%sC
zU8<O2nDIhw9;ppKa8|gb2XwtuPN_!rLX57C=y>Hpt-f;~rP?J)R;!2ZH;`_1UA<>!
zm;}^be+s#YCOJ&b<q5r9916ZpOGytyzE$;A%p~l2cv)CjE}Zt}ppS$B@H+E9wdhZN
z!ZQ9?W>z`EbaduXb#p!ae$vC0{e@?p;)Yq`bac<QfsV@`9Jn(EQ=M|R4qPn{7OY1*
zG`W9tNF?%rLp>C0)KL69I=IVv9Lfe#g2Ai@j%jhp>1SUx>iK>?^yd@?UD_E!c`aV)
zn@glvY9i}jEJ*b!Nlu~*J5xx7BRqSl-}9OgdJG#wZ9J^sKQ%uuvGaWXBd)9ZrwXJ$
z8>Qv`lpZE>BV;Oss%Arn3)45UFgJOF`(UmDG@;T~9i=nHKZK7PCP<=1yX^`G3PoHd
z+?!ul`(q9b0>Z+YEQ*iftG{Zf_~|g0n}}s5c&PySSR(f;Y@#a?K?+TA?P1INB4h1~
zp%WKCZg%=_H%-;3?~;P0x!m}<&#}0Iq``$d+v$|(k`^f2n?&6)>c;x~KL#E#fll+a
zxEp=n9}J|{Fr^*OK0j_$8Wa(})XFS&WmpTG-RO&1vuFv#@x4YGAH>o{xLAZ)GCt``
zJ+cPeoLSyH!4{@#f*-IcBffWi8tu4un&CIYQ=OYUJx|>_^|@4Kf7+umOj8H)WJYDw
z-Z$Lp>6n(&%=o%@Sx>jWo<8QB^aSMDUYY4M-4?MMtOXh>LFzpOUpHy(12xthiaj1^
zlS=}_RrNSmM|GBPS1Ap>tGGBpk5LX_t+sF;d6N`~Y-bq@UfJLD5Z_CgqC?KL#Ag8c
zolR{R8ULJ&$d~s7Ir=3*TA;h=W&3Bf?vD{#?PXt8lVy9o(1pcndHCx3*a!}Qii|Dv
znyVT#=m$fm7^5V`Z#?eLOjxJVa&gtDO#R>IJ(np(2(;<jKRa+R=Cj9WyQ`Oy$qTr9
z_dqq@t_4h#q?Kly>1H$Y578=p|EBM-7vqG4`tuE0Tge@IN#GOBO2fzRp<}b_$}$f(
zqq4x=`}u2s7FPI>`IylCvmE~$4w=$hffAd#)znT_;OJ=5QdhQbxv<P_naFk_QE#UD
zyQ$kYG)}!c3<}Pah?$#gND{iA&6M0!*+)X2hJBL1*qsi_3b*Ygky@qt-A)_x7D~o}
zG2+X_6f%|HDnUOE7gp?Rqw^j_f*u~cRyv$#xVf*+yY^RC8;+7Ky%lXE!avR5oEtKd
zhFA(!I!LlEq^uPbIOKmm(Ea%HbLp!;jY(7-K6wdLZwV88+7fo8yHZrMOE<+;vrPwT
z22Nsh>)E>|lcma&ia33~B_N}*kT{~psj1h<m-1$N#nrpA9r<ZHJ(rVCnMI;D^rGB_
z%IT|+FC6e<2>Oxh%KK~0F@mE7`B@i9?K9y;-vNUrhQ><g75qPCC$Ug9SF>&pR<n&Z
zIT^ky@uSiN^pQ1Hs8Q4CYISFki^|%&#=il&{cMeVKSsIy>316AIBwXl=7L_lx&w63
zJas+G(Z43vbOCJ2^ar3w9y`dX#ai(T3MM{{wo13|vYr;^3st?ernEY=`BoD6@SSmn
z)+X<ig4T%EB4C{RUNy=i4ZylFWMsHE!LSAT9UPlf?PsGWpC8p)#cYiwljmC~oq=l-
zm(6}<WLnmRfB)9<G8Wu<u}SQ}Tm1_|8odxbP`*btFc_gLt=huvqn6q&+v$LY$b5IG
zQ=x-iHjwpA52MI+i?dV4LTF`l?srlxfM|7+O8|2v(3H^QR_OK9y9bVVlas-<$*cQV
zr)lF3-qO$cf-Rl#*Gcu@40+4iGLeA7Ua|!_FI&m?d1o#<`2vUUO_J{NL{hYUKW_e3
zWMj?&8Z9%u&)u3Aam;JUB^l5w$0}Xaq5hMLRpRkLr{=2k+FDLe=;LCn?j6&kxK-hI
z=xS4)j%6(^>v5jpk5|NY8wa_!UKBcQXI>b4*64m0Be&Oo<Q<2s<0kxzl|4Ygb4{Vw
zUiXf}TBnC7p8ftz+n>R?63KPxEBK}<BHMT3$rG1piM2V?ZFyS{0ydTe{^jF1f`ZGW
z|AbiMati2Wp;H}!{n$x=%=+(CeJT^KlFq)c9_yZIvL3T<9jY$t511tXQS1jN|M{IH
z%IOoDFssI!;FFaw%ju)RvB2e1mter*W64peedfx_$7P9JzMMY46C73NjQiD+9P|c6
zE{tR!R-S$&CMvu;E^52ErNdykUUgZ^7hQ*Sz74Z@_F@whX>;TpmjA4)5kL{Xt`odT
z{DzZ02Iq+BC}J^qaSapoSp>!P;9-PzSO7`qVHd;D;V{GdRaUn)DztOyEreW9=h2A)
zi~zJ)@$7E9<?kUrAPfKn-^nykHIOw}KT4;cA9cJK)j4W$Hn=8SY;<yKaa~zQ^q>=_
zH$0%^TBEnfJjAB;@dZ}Ki%QWoG*Y(B+Qf=ibn$O=5KDAqcatG1YmX-ZgS_d2z`%bs
z)SDwpTA_Sn?#8lZqxGwMPR*ncgGt<=fPL}{lY$Xhzou_ypD4<$b7axqjnJ)Y-E?ur
z9LMsZ!Z{WmmGsK>YmeTSsW9};8X>a*pU@Bk_-;u>ds}mfRZ<@Kx0U;mqdpHg7Angu
zhCXDgZTGYyn2F|KL6RCikFdF=JbD<uH=ZlbYWl_rriMM>AQX4xCAD84^?8D_#rlYq
zd-WK#TD6je3UO8%F(j1@v34xI+{)K0PG|AU!ijr;x<B~gU7U!a`tLt|n}BhcsxX9V
zi$F<u9+YbxIMg^zxFz#IaxR#S=^%(-UlFy>1MYlfLA>2dqmz~M>17A_@QF`>cETT7
zZ$}%`WE*fwl6=`R$<W2<9y-Uvpl*$e%t)SsY15L;L*lUy+D(CGjn1e%u`%yME*y<e
z?z+(GDFS8&kU6R!WBlZlloN}0YzSo*MgdOqI|*dLz-`cBR7<hm6O~j{bYN+F19EDP
z-VqGz_hh`gVWakj;^d4U+ka{dLxWMOLMtxNpdXcSn_eY*tN>92{m`bZWi338)OV=^
zqK}*FpkrO(*Y}BW{38B#xIjKF+Wv!Ai-mC_`(}B)Z+T!vaqI0~xG;R((&(3~rE!CK
zgS4jji?1&OKQee?>=qc2jW;*JKg+omp`)v!_^I?7;v4DGncY8N-&Qz&cU_rcfyIS+
zbfRSIUV7Og)$Enp6%$1e4*J*?J5UT(qU6tjS-WD}ihjPRR1^e@IHYFi^Ie-3l~sx>
zaAzQB$)y!*U#K|bnO<Aqm(FbPVj?16s@AJG&t+lYI>41}XfS1^>pL}0{+{gmPW+*O
z<RJN>-}^o<EP^qQPQKzdmsJsg?C5^o!M^{3)MHslDKRALXcFM`#6(V^v*z~_8Pwy$
z0;j(=IHCCOT_Nh<Q$kXezxPI3SQ%y+RcFr0*gjXH-;2E&pEMucuCe|!aheU$NaiuS
z{LHOn#uy@8dwAdSGVMr)1R*57udT(c@iMnBHsXduuxubxev6ViV4iy08XKs$%)Pwp
zKq2p!9l;UKa1eDPkZ2h@@~Vgw>eu<wk=Dt%UMk>~Qs%2pvA%f2c<HchHsCHZI=2QG
zqvgVd+P4-P{_3T<&kRP4xD`%KelMi3o9AFc7`47Bksmy9lADi}Mj}ipl2q(ijWf~L
zZ0=H67S`x7BWAdGj60cl3;DVAO@IAVfq(Ul7q_NBA9UkF)z(+#=<Pg!0pE33K|7_6
zGH1;e<6QCq!XF@3*oc6>b$T~cv`5p{I+n9vo4Xat-ddw%eZGF1ze3_T#H<abKl~<6
zqabi+&WHc!6NZ}V6h5qm@$z*$S-22VD=95%!GuLW31#xKFeFX0E&~5tkr!6iq>h~X
z{V?tqC*kBS!e!4CZU#r&a5GLz?x#(=?3;29pw5{IR?NVC8Q~t<AA2P952loFUQxgv
zQ9ItgRsWfArG}hCHps*7RZ4m~>yw#(4JRJVX}%`_lAg0t9*xYg-p}8fpWn^)TtUq0
zO;V}Fw&qBoFY$m+l2FjS*mu=sK3t?`N*0-r{&%VVgG`SN|M1X*)W3fq<y1!h$~;yQ
zP>^`~{J(%w`Q|JxoB<QFk^lzxPyoq@ko*T3ne`mwK|=8Y$f1ZqPco?fzgv)3f*BiR
zr>rK(@yi^vURsdIYMF))10IZSocFzux$M<HL}fO7j138Jh8fe{<uo!=FY_OXCJZ3O
zPh0<m;q=dBQAM~CKZ-+U)pwv)mWLW;{MK<i`}SI^xl6%lQ%<*dAcwh7bPr`6!k7qx
zH-jC6kScAg{jdlJ2-7w1<HU5A=(LP-s|?bY3$aF|t@REs_GP6W)c2h{uaGi0cd2B9
z{sezUO?o81Ldih=GD=4d+>se<>`MU!d0mJEF%V_&ek=5$f#fjZq*z>zIgLE`wMO&O
z!I;t5$Ba{E8#Bsh;8nVF1xCDq_bsXs`rme3vchOK<qxoPuU1tWef=qK)s5Z?V_Q@=
zVQptg#YTj^0?Kl`cf5V)kydW3Sa<iLc8mz@5V79LLuWH$9Q8w8nVPmVzdWA#L$x%C
z=83~~7nRMgX-wu5MZS$S9L~>BM0Y@?hE3`CGcf%qb8b+AR~}t6IIg>@Yh%2>SacD0
zl^zy`ae`)j-GNkm2>+Wx6V|sYDQ2ROtLJ30;4k5azgel*N&AAOzj*s`4{@$TAJ=Q1
zL2y){b`1~L`T@dxCbfRt;ob$vmZ9qn5|BY|=tw5D|AGw)_Ib=!sJ8V0388m+N}ZTk
z!*j~OG`<~<#r>gAQ`rH@=(lm4di-3xbm!lV*DIT>t7e=;X<^wr9#=WzbosBVtG*XT
zXb5zCxP5XMv!kyxK)D+(Hm<X~zL?Z9x3-QbE@t=HtGToaW(Z?yn1=0BManZsz97eN
z^sU75*ze+!q!j3HI2km1z+H{w&+mB}^IHOSZ;EXs@&)EyJ}2I6c&21B`r=zqfZH*#
zp}6F`CRw|2nVgu5-lnDP;#o^3W=WLhy3&rCAG)F%29<O8kC<yGY^zVx0TRz`!9D1p
zjxqE;5<(;eb%YZb;_ck2lXPd4gBT<-VQVP(diWZO=pCJ2U`h)*+-o5h7FO<P|BH^-
zE8MrKmP%r{8Ll-D5X0agHjN#9qP)U^!|AFh*XvSCV-bdq2z6%ZM;>FshW|4cY>>HH
z%^e9tWynL-q(hsjEzsa;AhP}F4Q-p9Sg2Ej_puoM<uFUJ)tT%}&tqDbN4TSG4F1Tf
z+zhg<)g)Iayph07r^OW8|Her1USt=gLlQM-_SH7Ab$`0NZ?VxisfS38S32LqSAYK-
zH7-~a{7nQ85hMkvs9K4cn3#ZkS(0!+T1<ZexWi#2Gcz-9RaD|Db#xuFL@|-YD`xK<
zZDJN8h6JusunP`xevvQkyx`#gu~C$eW>^T+Z4rGP#(6{HTG#%RUHE(u0})r(JmH%J
zMW6k-qZHz7&hOwi(^39M?hPA&qXOJy$56sWeI9eL?yAJ}+9u~n3Zfh_GOW{nbj5C9
zl*M!y=lE`ZO)k?!021vFvGRUL|JHpYwF|w5?`QTJx37Vy|AU_&TD#<H*UB}?*bbZ!
zt^zxQGVmg~+5^&;6cE_e@>db%4q*KM8Qb)Rh|G}XQ*HO-8Jf~_J=BF&Ti`Jbp4*B8
zCl|En$-aLj?y&2&)*YncAFg2*6FtO>>fkr4vD-Kpt>7c9@nkm;WE%PH$-cK?F5`;&
zX)-&QhAS4ho-lA_p=K_lzfFlOEw1+x&0W}1-YqNtK3%I$GlK?m(syxjF>G>W)mlc9
z+^-kv9bGQ>^)|P*PPg#woVd-&A`S45zUGE7-A}uskmA-vVf0m&c*t?;{*XVW&xFUO
z{d|jtxJn8@N+6(&rdG#!jz6mc3TYiaAk8Hevt|-e7n~oekiBj={{-7z-ko24D{7WX
zG$mHDou6ow`LeBxHrg8NG@q^;+Y$M<E#w=ZE)~6n=lic~c2)<z4~zC8r&N4onGb90
zO*n@y%jIzj_MWEgA|Sd@LY61}O1uvNDW5i@EY1ek(O^&A{|*FB`P=&Y=HOwVLz6wj
zbZRW9#p&cm2Yum_JhF@0bcvS^N{eq-ls}lDW9J&Mm)wNW=y!MOv!$hdw4pk-0s<Fp
z?cv1;h&)e3H_5luAcU9KJ{-3Pj5L%wEn=^f8l8HS)7Sr0-EzGyp2$gK$WgX!CN3AI
zJ-=+TT|nouVemBbgEpHQ=G@_sb-wD6h8vKpjbvwMOYv|GuB-qkDJj#$-K=o=jH=(X
zg{#wvI6ynY@XQ??xYe>Zk!)sKd&$?sgIB?BBk|`rmn#v`0`id@F<&Qz?fp%%5o`H&
zY2Fu7KcjaWbdLRA7vRJ8a{`s0s+H^>cMW$;=KJ`n#wKv0vlz7lK-U$%Y*NpG*zeG0
zP2AFg7|^&5=Nna^gj_h#s8$P|<bd91E1yow59ncT_@JJ;OeVB)K(F1yh^*HVuU+xS
zD&9P>?v;lc=iOK6L0nGTJ=lzt=qt9mJKc%LL8)zL!(a5^u!`$it9M47BTeB0S-0be
zFO4ovG`vOP7F$?q7;+y-0~!9E&HA`V=TA{ohkowqS2eDPfeHRnaBKC<TG_|nCRC*c
z8CDC`J|e>tuly{npjHPE15cGq)C@N3S6r#I*;TG0NYd51(!sBOIIujqv3$u@$YyMn
zLn~7(eui7W+_>(2MPD{M8wVE`-U{fBr|ov1ix7XCSs@&FhdBH@I+|LE+1=f}y4jz2
zKess0=6(9ppCFx{p5FQP!ZuUdFC`Q_ZBX?|@sYOgh^I8<&>pg{zfSTt*GnT0gYktE
z>*H5#dLAcMMy)Mfu2bsQZqLO_A|0tZO(OfqhJ3hOkh0ki$R~-zL69IrGt}B8g%W|J
zLd){*7d8^L+Q^(S@^*!DBHXF6@r<&9M$s(pG50pMWX!)Nk%Dr5lP#DNq*{txE}no7
zcC3t8eB-M31pjmHtzbb|4Y|Omdes=8`|%qSXku6ewbiUn^y)F}t*~tRpDw?cb}*aY
zle*ioy?i;5(c^oz88vX31eok+WI2-nETm^-d^4)Ca*?aC_LlX%h)k{V8827E&phM)
zpD5|B3n`xPCPEI?La|x947MPWSI-<t|Cck)Vf#<k*8xd#B6FacRfC&?Rzs`&j|Y|Q
z<hI7i|NoDCnVX-NNiNh=`4@Zn{ELDfwNUQFNKZAkN^GhpNFr<=k^Ryv{czC0470g~
zy$)>;rD%R$IwaV2A6w0Gy`&KZ!L8-&Iibxto@%vH<k#f2IhgP|0k4zO9VP#dA(u+z
zYYR>#KoS$pbEIVY)~b@19Z4Sy`cgtHo_}9IFPR1&Qxv=UROSEBCdZwLwSS#&Ca@LW
z@`(oh(&Ej=cHP$XV=3SGn*f|YlQh39p&(sy`5(M=FaaEeH;;p;l7HB7y#658uZ+!*
zp7IPX2T_u*pP@s{|A@@Pjswo2yv`k8t)}^p28=S=iAMWcPA{#K&3*2kQ(ig-BfwtL
zRIsD4?`byrbcK>$V}Je=Mk44Mmd3@eFRtdVcL#gLUZ3L+l--l32WM#HFbSqLd^sgM
zeqDD{NYG~Yic#72R?G-ZI8>C&V&N?`1<IF&!EXpqVv%`h#{52BTMHm9D@a7QG^}Yh
zqA?i(wsQ580Rrth2j`+tOkM_OWMM$Aka_Frj*oK)dRW{SVvH$O6mYs@pROpnh)Hj~
zMI}DW0h;pCBe46AJ5BM;m7EoEYS8eE<si(jj2TG+9#kJ1B#1+{293nI$e^J50W<^|
zr-|J%M*Hjo!%72V_~$pLXXF{GDGi)j)^3VAe>vSdc2@3VUuOVr6)0l<z{Bw~G+BcL
zfp^jn#iqDY^D$~c>OJASt1_)RWnF2K>vC1$61HGD2Bo{xwEC$0E5aS<_o6F@M-5>#
zE{$<qc~U1_#y1PdDuLikWC<I(TJA%XVk8=DRx4J%X|yDN<t^ETkVA*;Ml4*ejCPUo
z(!p~~WbM6jE>b2c#4xx_26_fm*5Npa9yb0S(WQn8C&n1dCOe6~C)U~QFh5kTbPy7r
zX;nk3_ZfDj_B|51pVZ1FZGCFAi16+t{IozN?gos|Zj}jxPbcm>>!K_Gj%riz!s!Ac
zvgzufJpanZk*hj3L%wloc8h<EnbK?w)&7(}PQfFz%Py%@BBav7as{9V%KF|jgMI@@
zcHOcA#%`$kpDL)mFFnH@PVHNjtfJ3Y@*7klDLv`oGbGO$MP1G_)e~Y6!$_9liTGyb
zKP*2FX)9~L5Dh=iGpeDT8c}pf`<^yOM`5%w>zb3>t{}u`;_e_IQ*uIL_M}#KO8?j6
zT4GDPW<mdA-;nCE;qJsYVt6lBi*umfsp{-mgrD`TzlYyN4_hth=9@4OTuBS#Ha946
zq|#0g2;pigMsNhismea~%S*V~2g;aLe4q$%lzA*ON*)b-w6}(hi`f5$+h;h5zoy&T
zs~b4>^+%y>Nn5yv<IP=Ns2x)nDq2Q=S;%uO@4Zf%p(9UW`$t9{8&N>WkS$kj(-o>k
zp8`*}n2?6YN5TT9Q>Gcw3i-x47U32s64T|~2fuBFDDne;hZoZB7i;Iy%anXf%^y41
zcR;fV_z;JiTi)q1cZ1I?g4N}|e{wkRP!ha*tx$Z{R0cNMGS)DvK=v>>i$CY|j~fJI
zZA=EciN8%vuYGgb!9|jM7_`!s@{l5Pcg7`VMGV0O2kPD8oYMnN9%t8TvA>*N5$lsf
zgC9b}X=R?uqz3dV!lP}MaX6YI0PPh+2iL`CqGB}1Dwf&TG255T4cl8ek5j?gN0=+c
z()WhEW~XjKm6tqrF(!&Y55*lN*|W<M&^h|i=N9%L>9ZkTf5pDUj_suro<Br<oH=u?
zGLObhu|JMu?2-rMONjyuE+UT4C5CbSYBqubd1VSM3SM72jkj$e)z1Ger>+P$v^}QB
z?^+9o^xpt?b7x7drz2QNcb@os4a;IlLDJE>0@^nlXOQ9i3su~^4cQCt*Y%M7Z?f1<
z(Cp$G_A3jrp+BB9UE73jlC#ykjgMe^_Ch9sIbAKiaTNTV{MdJlW<APgwX1_Ij~@s!
zQa?cwA03jpu6VGIw_z>U`J>!~JEj<&wh^=WVZNqqnFZT**?u<70IlIx$ti^mX%H-9
z`?aOn*_KJX#^jba?M$%_VR@?9N$rQ6$G`ZOT0C^HoTRSToZvcJ9GQw4#!#&fec$Mf
zH7&VSYRF#+Vx~2IL1~*!j~q{}$W5L(-h~V%rckZY8Gm7n*OJp(8?*A5zOCbwaFmKN
zPvsr=(}yO#2c9nJ(WBt+9#68Kvb9~sXKE!Uyr!>wk*bBt5&tOWw*6dpt06xT;Ina2
z0A^=T8h(0L^`xc;C3LTnZ_3!e!0QhwSiYjJzeLl5Zez8Z@6Y*tJrWaoEPrOTa`syH
z0+jSrjay)WcB^G3=Qk~m2I2;s`;}{<Br92Lsar^pl#Z-aR?IjX)5;5v9q;Fl+H$nA
z-Ry@6Q-7LBsdN)KW#+l+QWiRlr;Ea)8`7R0N<jBZR<VB%FehrDbAPUV<OO4dJ*&Ks
zD`EQq+LOO7yH^&ACpJ7|^vpxLOkWsx=Pe&z+3mI+bF*3oE}kxgjwkw_T+zDjlfK4<
zP22cZ4LYiJefJMM+PnrfcEpXDwSbupW0_4sim@E_&X=2S{V&R~L~`o-l29=$&I?Yg
zp^v7XXQy6%5*#<xyr}cZ=nJ|}d_pEIq1%952~@v|17UBfrJo*y8|o=sv=dPyzYeT%
zMy|$c#*6;f8caEFIY+ODC0AuV{&fW!><-Qv)%v5fX`>-@Z@Gqp9`q8U{BQmcpr0sI
zvcg<)bZ;t$`7bY2)TIKj62JJlz4d}$P~eY-pAQbVKb*2EVQvAP%J5;_$y`BMYcZ}l
zQ=31mn5+(J_GV<0L+3NNU_W-%?ydx}Z;eNngqBhj46z&n9q`4!yCy&Ceh_&A1Z4MD
zDURhH3SVKJ49=F*zGp{u!1DS{lJN>McOThGr`>L@@z`pUO}I5?1<j7f$Io7*mp#zv
zg>3W*z=y=u3BMbl_}Pizbo*SVJvLU|t*wCGG1Ah-0Z*zns8tWDNtP*BOrtmtmD|su
z`ja%VA%D5}P5cr^bHK&HcfVgfTd1v6amIKC$X0l_kuDZ+OARVVkbP)CI`4H`iuv86
zfQsj$D)DY*rf3P|bh^dMqyU_JelAr{p+!Na<k8F?->@Clcvmt|Xtkh^4Cq%M3iiZ=
z%5G?|JwHv!5W>l^;D8d~1%;?FZLDVPQm0?G*ymY*8_`E4(&U$9yieC9^z~s8WAhg+
zEI{S)X3y|C?a|M?Xm}yJ4+9(eRxIn^{Kela)w~dc4DM<C^yo5QDiUv_t)h*`>4~2l
z1i~))+Tu)88CI_<g-hN;b02n2AY%X`+>z3_iacS<)b6M1r6^#?Rk6fM?%_aaV}K{Q
z%w01&J(=`4#11p2We-Y*NPWLj?<~UqO%PPL*U}`jyKpNQBkMy6!elfQti=UoS5snB
z+U9riNf^3y6WVK*cUG7b*@z=uAPcMy>fCQvW5Uf+6sW+$C%oLaaJ!t8u5ET@Z;Iuu
zoEwLFuD}(`N6~9(cwX}p88T)>svjn;P#%v4&!`Vl!vlPL-s?y93UkVB1j%~dG8TrO
zV{>1+z4-e`WcK(H-7{HBwll3I7`6*ZLMp0Lr&xi2pR!?aq6t__wvExj3u;E(_b3Z;
zgm7b0$c7W?hrm!%_vb=e&}Dh(eK@Ie+yfzX-CvC9slqeI{fW6h^YeJr{Q9Z;l^q=|
zBi6DS4Sflb?-e_jUqj0fM&i52Em631Y(J$~`LMoV!7DJ_3E{T@4%8NUPXBuWuO`)L
z@n5XKxXj{E&WuEJ8uFO%6}_)Vb=29AxdNq0unYvRRc>K6BrJ!mokdc-B9|I=ab+uP
zsfFdBKl{UWzIfhMi2KVIrKW+pYiWBdcnL#a>m*c$zlzKMo#1$Jebt{g!jO1C4Bwt#
z=~4#<qxtFXJ2hmoc=G@k)Bgef!(z7zE|Ef4+o2%w+lQvgR~22d=`RIE@uD~%X`E{(
zNzQTXzEI%x>5Cyj$MEBe-u1IB;d_>7bY$IL(jDADO!)=~i!%dmvKp`g{h0n*GX&;5
z0~oyNc}8K=OnU$AIWFvr&;#yBn1qFH;<3)CvjpKGwT9)Ei{Jyv^jhD_M$oz5qPRfR
zV;p$BxzGImrd{jgGE%s)c8Pv#-*!FY$uh0s2{!|*$@B*bXp=v<)=PUv!SxfZed}Df
z0LIiK?O+MaSz5#c1WwXZF&L~(o^A2(&l6xm8eD<0&^Vz0$w9i7Ltky<FTpjuCZ~cO
z52+jo9Cew$vI}3XUR?i{$a42v;dCJa*HO10R7Y02vCbZH0G)h)VK_)s)zh9*f%eDH
zl>yw!H*tflg3xT=1$EZ<E6BPZB-9Bx0H3VE4KM0G8vk?%oixH<bdJ?p__#z=Q*I5J
z+u<A%Sy{iTZwQwOI<4k`Q67dcw^W|1&D%?lbllgHX$|_hCYsw>$5s(_em>v)jXnEG
z(}pwRII<i8(d0z2_ZB(WeTgr<6+;7_?OZp<((0AO!{hfKv`d5k8QJkss9I#1*Rto<
z=ntQp2s2FPv&R=P50wu8c+!;_D#<_37teNFuBb@e>c!yeDAk8LOnR{yt0pif8m|>M
zS4DqL>Q==oO^P*B&tGlQ`~T4P)?rab-P@>imvpOihjfR4ij+u*#Lx&scjwR{NJy8I
z)X*h4z(|+E(9$(@N}fmG_xGLeT<2Whe`o&S0%m4C`+4@>Yp;Fpd)>>v87!<Z?yrkD
z#xw={<m?Gk&CQzC1`6d`SN5ibOBS}BV^Z6gx94~EQam@CT8|r#9-r|Lpx8hu-(H80
zJBWjAq(yZ9B=5l|My!~yc<kJ)NH?N$u&RzN4>_TQynKC)SUB5LUwN22a?-~!L_b^1
zw3i6oYGHy~a$a1UzSa;?z8TYW*Z10Ih*Nx;u4(u237@xf8LG$2?T`9Z`Y~6}yx(i#
z$J5oqcIPiYy=?Iq7!*hBZNw9Npj=g8_CF}F$&#{&`&BZ!*4qyeW1xs+Q_@1%ng<U}
z$VV1QJbP{k{o#ShEn3;5C_(b6;c-IO$Ol>h$9dKeS1Mh74Y+9n7Q#-JV2kOycZ@S-
zg7lY<ZOKQB;fnK=rUUm(&Cbp|6h_~}A`6I{!|6&kv}@L;m83Y$%%kdfjZnP4Y=mG8
zm6$E1>R=C9YwVoBHe9(to`;+$^F&yUqmcGfg2CkuM7yI%D*bZIho*h#$?7YE8B$lu
zguVu5QS_;Sp&pFFmDIIv?dy~e9{O%)#Hrh&U1OhhyZM$ea-6LNW_`Fle2sPMDV7_Y
zr93c}Ke_K0B-=NbKHfZ-k2i-?g35-(L+VMbcxfZ>2I7x~J7bPx`d2(Iq`k<+O@HNl
zgtoU(`l_qLeP*=jrXN_LGnGYa0g&SV#r<sjA-EDKsi43l8>_ndjk{sf%1SPE_)!Ho
zHHSsDvX|w#m@04i2g<gEN-zK);Qt)73Q8S*TW5i3Ie?G&_s4;bYASCqKvWx>X(cH>
zbELy(g*r0)IFSy~kh#Y<@z<eL4h+yxeYvw#dTr_cuG*O1#DAU&=P9LTk&8~o1FlY|
zUMRN-Tft$yBDPEeY7WlWp{J3-x1c+TyY4d>?@{kSyW-WQ&UyK_vp^k^h}DDggX#0&
zbJ$<{a;|T$mbt!)TG)AE(;7<xYce#YXAR)eI^**B2<fgsh7--njETh!1`7F222P);
zaC)ORv0OSGv@F2La!5ZK4=Sceq1UBIsk($wU%ol$#vS|3@D-{QR@O7cgbA=~i#Zl@
zeZTdvE@(I3a7c+4R43hll9JeDgmhgT-)Qa_FRYOt3`p~SXA97}p~#jjpIB}u{>yqJ
zVniH9qeD%K85<=Pen&*CYkDOw65XJoiIDnIsU0r0PZUOwxVfE$J*?$O14RWxdwy>*
za{q^%*9h?11iS7X<K2oYvK9<;zM-NjLLOjNd8x=f%HHap?|@+-Ll_mo$NBeCX*!06
zs1c1&{!q`iZ=-M1j!!sA5dcx|1sAHw-tw(udfYqK^z(t#VS^~H%m(7LTh4Jk%z%&E
zTxbtU`PKNhljD4NS7RX^f=5GPGU>uEKMxxuab?C?v8Kn_vZfQ{6o98)3<d2XS-o45
z-kXbA)^!^&|79=W>iyZVUI;u2K$9ehdWpH`a(<m1#)iwbTC-5|@^`$J7{kPZbL3k=
zT4yyu+SO$7kj(S7_&&u0Drn-6g;m^?1z`~lbA%?raQ8yug8Tvr_PeX6sOuLc8O%3Y
z_DTL_B36tL#os(lY`-{XLv5`*wg}ff)~wJfUtUDSER4QuTgN&h9KLMvZ_aK;v-xvK
z5O_Be42Z(EzGH<Jso>+{bvo?r?zYc#Q3Q1Q9iQm@)sj{KWYPe3n2jRNjgZ>I2P^YP
zRhcpik(}n*S*q2f+?2_OkDP(Jf)6ES-`xcHxKh&8HwVkUSCHLHB#G_Gu>R3`+p^9n
zI};R9GUiKwH2lhh$KlwUo?ORbtvQ-1o>+1%G&r54&0+GqM6-(bf^_cniTPZTcxq<R
z*^9xS!(eXbf#c*7ORKwPmO7c`VUqQTcX+O1p4=N&0|LqEmW25k%vjp?Nui}8n{p5)
zj!QumO?9gQLn{$x&N@C()lJjn#B@cDI8`h2sG$nZ>^A42q!unucAkeqEuO0@3_udX
zpZM`5bbt?cbn=KBFKaNZPSs>m7iZ#GI)Es9n&2Z=85)}-fQRJx@=@mB(RNqx@7(e6
zHE<BB_AiXm`iJu2+yNY0;OrE@@Jjz;c95`p9vsl;e<zsl{ti6_g@@E7Nf4vl(`jXR
z=VR!Miu7s_kc#ykze0T&pmI`@xoA4RjDla^J|nc%z2^o2!dl(C3(vUyvvftEAD4Jf
zo>nj_e_}Ly|9Vt=Jb)L9cUrUk>f56W+VRXs9-yCSFUVi4yy{kL4wLLYU-56A+=Cfn
zI#5H67?wg$6;&XMq<6$RWP}OZZIRs1oQCrE>0K#T{ycReY$GUf+WfE(FLVd}gfh=~
zS#UVz_9$hsckzf8cNxc1PCrpL#YD*_(L?}Rm+j1UAfMhv$axa%8-nH#ZWQ91%Ee<1
z_2@evk7*|9_mkg@EWg#tz(>efz)SItI4q_FLCb+IIC`+rRoqKzLmX*>k~ct5x=?s>
zdh~-2^TN_#b957r&YACCiZ_f7URj^%#77Ls+B=;Oc3CZceV5XyUXFT^AHpnjD4xj|
zNDZpn@m3*neZqz2t8(RS!_#^GwreREwbY$vq(skaskin_if}h->e{(E1p{gNS^0FP
zW#0OTR~<kyH{*Uvn)T-RQ?*<3UB_<+CoT;Df;htIL=&d{4DZvpGAO$O{CyU?0u<bN
zsK#+}-V3}Obdhgcf<c`xX}}2c1Y_GuCvNUfp5?YPuSjVxEBjiFE*9F14xiE_@Vf-D
z#%@)qfJtbN)}K<uP6pX2vx_*IL^ZVO6{=dRRm?Zhl$VZTYtFIqd(cazF9`#Ha4IZd
z47b#CqI*tysK)2gAdKXPV|G&*z)DMQ_4o4Ra#gfn7)vZdmISF;w&@b|je9?@aVeo!
zKA-7{mP{l0;>p-JZx1y~6PEDYdv)j-ni3)MB<Rsd5Iwqz&CWN|>y#Kl5T)1}a^D>~
z|1s{BIRU@@{xgKVN!Y1|11znpd_JG?yHhUO{O3niv&vXiLY;y0{AZa07>#Wd=CLh=
z+|`VQUjbIZndxpyP`m7z*fl-AW()HDfvgMuCL%6)_Ng@zzXi|U-X4F^-FTX@m7k{n
zRO3WuQsom7Ov}S>?wb8he&QEw;ij8z0T9Fz`Amrqqg(bGo^N<eBe5tj#&yAA!-Y0K
z?8hI$i*{j~5TiM>iz1nzjSD*D9`4N>K+6|!Vx1=Y5!Ajq`1(!98YYiFJ-&=fZrXeL
z4?!375{iLq{@hYFG2RJvHF5VZ8y)8fv*RMnSF~ukU-SKjE)n~ZhVn`GZhn_LlVKSC
zd|uomv^^rJFyuN>bLiEPBM9|%8~+X6;2%4UsA^}zI+u{pqT=^w7i!Hkm-nl}N7Tn}
zr0i=>O~ah97-ax;>GgEViwPGa{7&lLE$Y&=FtGxzl#gdrF%WTdJ5EL!b8J>w(6Xv%
zEM6>Smu|i&0dn+nn)V%X(hL1DaWrAOG80as&El`f%korZ;TR5!!q3t@*rfConWmA7
z-7>hKwyzPuxnUx@b2~5Q8DTz9T;MUZ@M))zdbNR1dns#RAImX+Mvesng{`37=^TO1
z-Qpga)VQm<Dvy2^fa!ycg3|sY28jaqQUN|06mm1ZEgPLW#2Yun8_~AffBr{*BLG7}
z!v7<YVKiS9X|rdgD6G459=MDp+B`LrTm5hOjU0&Q%6m5~Ju|+TFrKsS-J&3WY{-|u
z6SB<%eRSBL52oJNLK@A3ds0KvKBX{;d}27>4iOFtgdnnZ>Jaz3s&ixoJPG?!-2{7}
zVqJ)b+?8SQ&%37)1qpt1kR85wm5MU&C1a&e5CL(;&+gWMyB$)=<VE)-B|=|u&?5W^
z+MGd$v7W*GRK7U~Ha;4R{S;5Hxr3@1+C7|~ScwGf4541LwWl%T{s#`m5j#)p5ydqY
zIYhz@0{~89U&k*g5yOT&*2Z*s;=mKFlr|9IJqsmizY1bb{lIEY5}f!~f+q*F`1VBf
zLy23@LD3@a$nNxp!&2UJEI!&FU-dM2hW)-MxLattOs*;h8;CnVCU)!m+G@D^yKjx(
z0c@|11`M=O-_y%%XAp{VgoPQ#3BS`higAg37HR97g|18AZ7~9TsXdLUmhH)6tibTb
zM;@=*r9pM3N{pu8jfqg5g(QF^?`!w_9uxQUJ<#W-Onk&$J&Ed%y}5y)O@?*~P@OM=
z2q()nJbav90&PWUtRrIo?uzP7Y(xHYCt`3sxR|Cr2L~LO!BADMSS>Hs?ES<eV#!+x
zv>c(jV2Up^5$+>PIy~Es>!9QbEJ8B+?aa^^=-d<@7jL!7q3~ACAaI1O;hk+g3oRkk
z=>OnYt+cl}GG6<N^dNo{?~3I@cq<JiD2BE+?0Z5cHT*IyG?Ha+G2tL@nUIZ+_l@!%
z1y6oqag;myOfcHn#A{=X@?tfCRl}E2$(6W>p;2DAR|ys2f^?MnxWT5}o`qbcnroj-
zgY6_vIW9`u)G0s9lNd+q8ZdS$Gldq-7z;>aJ*_t-SlYuZFn}YSWwX291b>*OJ?-d^
zKs}h_7aK~O3E$!>nc94^Is(5K+~zLstVs(}nJ0hy`e5kkm@-3VhpCX2G;i-0YRoU`
zPuiF}So^SSr?&vYe{aZ&%~Y~K!^NFY=>5sOA6e~j=9c_aDV9WeLvVjHP$<a?)@CZR
z&!jr9jJXI>s|GYL&qV-PCiKHXONCdGxRvatB~!`Zvs$>9Az9TU4`wy2o5P@qiV^*@
zj3D~ARM@^l9nD`}m;Dis8x6rlM4HQB^SQyLJB@5ae}p8+>00%u%R*8s=kwlw-n5x0
z5dO)^9b}S!S{J<7`{-b>OLvAXNV1#hfmbRzi+yW3SP|jj_LGKC^pF3)A|7hh9<QX<
z*{>On^Z=JDf-D>Qd={*dmT&1CM8x9r^$C4BYN7a#gr^urZ{Ui)XAB)VBmIeA+ztgy
z#%wR~W80{MVce#d8H#(d@)1jQ{H~20+#%XxM@_xx=KjjTsDP@l?;gx<yh(gSLj<fb
zr(oA-9}to^(Zbb8tWR~6*4ldNP7P(dv6Lb}UaaN3Mwr7dw=RptZOk1Cni|NJ7h+a|
zavE&$D|XNoQ5$O#aWs}HR_3O<4&LG;k@{}C!f|PKc6ME?ZJ!(+e^x%H&^9x1@(_44
zc7422r@<3(jFbDgs}UiCh2|JGIO%34wAr@>vb?ponKRz9#QUx;=O0UlU}`lr?s#-j
zcUBx+DYD3rj=m|>+dX1QiaC!gDvJd4C|^eEU|tl4I923Mk}ht09vc8SV5E*~tg}oM
z=oTM@1*5&THE??Ex}g}4$!a23f})*+0@edV`MX-)h+a{&65B}gn+9Rhxej4A>Lot6
zivQUY#g65J<=M<k7u+8taErp|LqpS?v?}L&h&q-vwOwFeW#h#PtcdwLl_C;*OO<$7
z0-236^_U|M6>%4=q%|CcFKb2-0@6@+5fvGeFag)_--mPVpvL2{Rfdb@MV_k@mbPN^
z;YvCD%-4HA%g{*Mj4YR6RvZ1T8B*lW#l|FC9|u0%Qx@kUVyjdgPka#{7;ohCO2{*&
zKgPTg4fRT29GLwA>_aZxGEtz<fLO?M%{T83Vg9AbTf$1o(gnolDG}NEu=_*4E#+}d
zzlo98GpnG*WIv+2Y9&{YBj+2XnW#*gOt6s6Y-lwfN+!=?{)K49Ou0%Gp8FJzzCxh2
zS7=>@&Gxou-U%U9AX_ZjOio8(qAFY74x>A$-Y*w<;%y~1r#@Rob?N(ML`bMyo7QJ4
zm8<{kKy(6q#C8U9d{Sv+FP4br`zgH`6@e*{0q{i5Sc9aSG-$mn1VNI8rtRT2n$;+~
z53|HmdKE<*T47t*^&hA41GU6I^xrn!`^^dBD*AjI3Z{?N?@3kvtn8$V>M;}F3M@s8
z+1CktDBy-F%y&~$UB(WkVXk8+B6TLKO0jgNayK*B*XHoG0E$reW0qsW_6Uw3`bR2m
z(^Ro?sC7Rphn`yy`0&lX0RqxP{pX+5cVmJ_^0PfqNa4HrT6f{w;#SNK8)7F8Mh;~q
z{8nKyG(YXbs){$8Q=b|{;rTcFSb{pES@cy?8B)p&`)TtAN{WEY^PKkD7u-f6X$FyX
z-Wz(DJLeNx`ZwDomozO+TCJ8tR2Av(C9IwRv<hR}r=y$cv-Lk;e|NKU#`OQ#>Lv?r
z1iQ+MAW<FUeGgDNVo@?%93K+>==W5)ppo|;(09XwDWr|)_KmUWC?+kC<`YE;vdZ3#
zQ@U}Xv0>g!Ri0kz`gH1KK+zLfE0$?}WHklI5oe|XP5Foeu#NhFNY*Nz>8DJhMqMk5
zEN>DZO|<@-H^7axGA80XqX&MsVGE;&5O5|1vq~7^2DaK-TA%QzEvB(DrA4%LWRcK<
zM;TVoRFoU_E8&FzFP)VSD|$FR_zMi!oMuEDPf96Y18-)Y!w5NDwxFrJQFT~u$=eZX
zpDy^!2*$7x!^jh_?x{PdblGs*w#;{23ux-KX&a?PPu&j^1_<)L0Vn|yQQm}$Oap4K
zS?a5TbVXFhlBkn;2$B6?vn5;DTn>Z$b@NfDA45}CD*hrVgL!{}7Vd5XYQ*q|PvJF^
zL`Unx+$g?^yG-2boLyn3#w>Y;G>Bod-^rfZj;M&i06i>q9FDV|XnWNfzleqTv>u0Y
zo(1f6v)^PuhGHSnW5giP?&qC6Ak{ox0x+TdKMqFPMH?>C+UPN57sX>A$^UIrx6BCg
zC58q%9+m&CUc!U|J{fxSfqL$N2Kq6R5~b1Y(BRMg`4DR6`8kl^JN<BfDU7<>uG4ej
zuK(!f9AzFa{uX@*&Zh}fehVG<#Y5h)_o8Cy$yDPad=nF><K?T#5#aRr@K)40M?6Gh
z4%WD5LOK3Y{e9^lQm6<QK3amWix;pJvK<WGHxN-A>W`Z!SXrj>+E$KIw&p_xXR?V-
zn16nrOVO1&(A^!Z2)ZoW7Yn%iL3?BhNidRSzLclq*<hL>`q9p)QuS&n0`^*_w>|CV
z$t6RJCzqexiV>pvNFBMhbew!?JYRK`V>iFP6urpVj?vaE%Juzpjuqm`{$1;UU}3&x
z#?|q&pSyIUu@T#)0ZVl^g@f<Gh>PR*`p51Ww^1l)SWlm@zx#KaTqwSQS$I|p2|6uE
zZ!17)H;uoHrTHgkR!WM4fH4gMsZ*oAM7lkK7;Cc3vl`MD4;4qd=oXT-(Kpd#cGB&a
z8!4v#PF-5$ePKWWO`iowO{qH``#mMI7lY%#c+YBooo6*QDFLje;jQRk-O<!KZ$M@j
zBF5EpDiImryI|3!?iM`Tz)!e~69Ye`SgLRrvl9odYumngx<6a%%mp`lZIKF4HjG+Q
zOe<{!faJe<6loDkw9F#=#y8Y+svnn9QxaJ~rym7rIrbINM5YQ=5};nk&q9JZ-dq!r
z1z<^Al!|*G=R&)FI}zIbMNH)R2*4t5wpU8)k`EOA1hE#S$qsQP@C5rb9gI&O#yiBs
zyIk=?4~RyLF~>y&<=Pxzs&XHw5#SD!K!2M{{*YD!>oXAnWfgaV;iK5la~V||DjNAA
zO-6fQoBlE((>9Ed#^4J@a_ElhFqFG3GIXXQf)HzMG#2DGeSlfXAU!T`O%~w=@EM0=
z<l*YOXE~VLHiEf|1{$jLKGHr4+8U(cdxtJm)h^3;4F}SBuiP8<!OWrSFuZNVB5}qU
zeWT+nPUEbgT&Biu0&jgz_ztm~Zqx6*D#EsC^?E+AZ-czZcQE}){!+(tzNu_}+&e()
zxXf?8LLNGjW<+R`>BguWfeIadpmWn*^20@B6BL7hx~LTeg{DHyL=`TUY5iCl+gR?Q
z4BG|s<i(;)VilFQV|k&)ysb1ed7qE{2pug!W1f;B@pISphnVAlqK)Egcn2&#yWwhU
z=VuMQl?9ozrsu&phV8pf34c9hEPq)skZN?i|L|1iQJeKc7coX@`mE*gt)GMwke6%T
zP6kbQLd0Wx8{N4ls+`$>K5=!qEY_P0NZzVwMpo^@$kD34Tu!VExCA%gP`n^NsXb;o
zgSJ4uXe~i?&cnjL>IIx<jKM=c`trZCZ>!B0={uUdMn%Hz^2;YsK9t4Zm355k`(?20
zQJ;o$1WEtY&qZ@q`N?7vml3g}m+j?~2CBqIigWdw+rAL#M0fDEki{x?m{C7*$IUMm
z&8mj;rEOW5eS9GX$S%iXyh5LfJmp_<%S2n;+%<^3jD>GjymZTH3}r*|L@Ji3PyHDP
zJ$_^qJKKQA)MO9K!|DI>itdBY2n8(bv-h_~=egnFk;$g2@G>CWps`RaJbe3}5uCwC
zfK<=86EFkV4a*&9*JxNEQ{|_+#h42AOIm~uRs?F&_utG*;Zwq@6Q6bQ`<jown}M{`
zbHZ7}59T3H=RFJ3(q%R+#sem9p!U|v%01v3@oR}*Cs4WjK8wcetR^iqEX_Z%%PKlL
zN=eh{%aJ7V_jtrh)v@G<1VA#N^Pifn(GcmyP^^bXSa;DWGoY+AqLFD6B%FLj!A<?B
zO$g|(noUczO!;$7d6CpCS={z2`w6=n4%7>Wj-}>fOn##V`YCneQ0J!jzOF_ICagyB
z)Qwbh5y=Te5*>tNJ}uwqln^@NLxY&2AcSXKNzF>{eW$x01XiUPd$*Ix_tuY094|7C
zw?(W8`jO(nrZC|e{&W`PDV5WB1k8H?lJZ5aYv~J3SQQ@8@z-{0aZSB6l=-fgSRM(v
zAPyGOi&nuB?3nnGZmI_`Ay~4raJvbfg4Skt6U-7+xip`Y`?3_ZF=K+xhoyA#_C&=q
zzw;C&749qNI_phny;<e6DCX91w%%3jZq1k;H4*$C7gRU&JNuW9nY;qs=7h{>iGMw3
z-p_q^ntiM{p|e%~R87_>*GthGPP#KfTh*$c2+xB>7=-{(5g5^_#>WheTvk$Ee|!<7
zB^jWj;?OUiHl%aZ8XHFeS|CPcObIuEp6{w@0{$a!But&;Zk7sbWQ2*rlYL5Z+hSi0
z@r)N}`GQ%*kYm^{_Hw3bBpQf^5_rR_`V58_I!SElC5H}J+71<(-rMm<>^|SlkNS1i
z0Z<0d2c+vK7{Xg-Mhg{b?FmhEx){us2$<rtVC(c;;{~SAxnJu5uFt--DA;+6w;R0s
zsDA1TOoL&Q-WWCeBbUJbq>|grOji;eu(2VbpQ8os{u&w=o({%g0efi7|6B+&soG5I
zJ%#1jxuTUPF_?W*In(Ys_-Y={LCI$}S){sc3J5=Fz1N34b32@4fT<hx9+7M3w;u^r
zJMNB(k7u_Ll8(|VXEwH9-B|;bT|VwHZ}Tj~9#f7f8mVC6od)l)r4`&v(o^|f^ZU!H
znYtWCJ!<?b$3Q#Dg>s`alK1`T54<6N1@g;pO)6LBly}G0Q<<pkH3|37y7Mn7O&gUk
z*XK3Eiv;B`M%Tz{qKod<us2AqVMum4t!`hjnfX`7MoO|{i}wCy+Hz9Yt9t(+Hr*FR
zn(0Ilf~p8wGnlF3x&06J-#eKp0$icKt_G+S+KYQ->X^2)8XDf_wa@gu|D5jF3$-Ig
z2y|Bj^mA{Cxh7Ac0&FCW&eT$B)oMOr<kau_cNL#fc>93f4>Gw4LN~jt2E6;$u!mh;
z;e%2|%GTl^p>F5ByT}*%(&}4Atw^bOvn-9rSQiy)+EB5~N7)QmLlIFdLG97%>{e4U
zBOab5dY<~08=TkX)nD(jm2!O@5a#cho^zUW_?TJ{TQ&bV8Jhi`|K34xv-c~YZK*vQ
z5(#?adfEH<`XPxXYvkgzU&t{~f2+vM$Lq0thTH))yB$kB>YMX~-<E$7ZvgXt<4BI+
zGsE0%RHH5ITMpz}_-@L?UHEe#Z=~C3u%f8R0@K>E^JP<2oIKk^)>27P(!2-bNK<0b
zj+rV?XVLU>(tDp&?uJKc!*V>`bBLcoo(;D1#-yh?7F-5VvgIGrTo}O~ovmA?;((r>
zsg3W~VF#nhAdaLW83f-HARZ^AbOr+yA0A&{o{yqrrZ>pQ%3JYFvZ!9xETco;XXxrM
zsv@cZ-TNXRF`&qu6(2rWS9u;9Ho}{z3I)*pzu$zOtD}CXJ&^|EOgrKN5#xbrCk~*u
z^E=6e9DzTbv@8jFI3q=wS9<i}ud)h@4l7h!TU#spzPa`**P?d7d;p188fLTLcU81o
zrQb$0zXy+a363a(JwFDeVH`ew#8!94oz7xwSvRzr1e~U}0ObG%24P8ps*BBEfGx&w
zMR$7bY&&?Mq9)zKgXn``n`b3>NlwjSy6erq-*x+yaq#dG$o@6f=T!<0xVTKaq~NwB
zw_w+Ed1dIZGjOl!I`y_sa+T9@AmxE2?Pi+^Jl_!m12Q81ws_<04X}R3`N!T68A2c?
zvqV{o#E)t6gM?k*zOB8bWCipXn9roziJ|GhsoLw?8gh#J66M5OILp5`4BPpk>64R!
zpOTU|xo;D)GBQ{nlmMj|!10$F<Ng~1e}_Rl`akCdxGyx|xa2?YV*w{Azyk*KIEaAU
zvA@=s&lrGWl0c(?W=VhgH$8y~>iYz!c=-2~e<}B$QKg`882o=S_|NKJ!vv2}{$uW+
z&A(=aU!woV*guPZjm|tF`ET3)3VHl}8Hc|3Z_ECFFmw$^krWmt7j<0ftuco?-CjAH
zt~`95J$yjU)<s4~E6B?S-)>)BCTC{iiHeG*+yGCtBa_}Sjn72c&+q#!<-=HVVj>C~
z8ylUt%ZrU09K6nQD|ine5eE3OClA7Sca-F`v@tQ1e9^AXfZ@f(#XsJMZC~{W5lc%;
zS9h1o#}g_W<837*VEa^1<=r>W`Epg?BHU{B`Eq8yKpZ}<i`N4l-`Wf6?M=p2TV}We
zbL`(CS`kAz8!Y<fm(LnGH~Mhr=VgXsat@1z@l1N~UeASl2h29=UVNvlFX~wvR@2%`
z%hfD<%ffBaK?i|AP6{{nqp~fiX=w`$TU<(i?OMBK&Qssb>~ve~w`~Myyl;AQxiQUQ
zxnHud#bMWdl|IeAvb127yT-e%6YlF`CpDvN_e=G?T9GgN!k-oq!}+pg$)4Zo2YJwd
zbccuJwlpWn0|(qD|KjuJc`0~hi#xeP(PW0l$hgHeBm1SZ`0ddhQM1qaw_9v4ae;VY
zhXpD|9rg%JiNL%PHNBM1nZO}FpR7_D<s2Dx;{z)1S@Xj3!L^Y09$=}5E3d@0kUvTZ
zacPpg(Fswt2{BuYq<wH$T>{Rp&WA}|8HyYkhO_CW@NoC%x4&-mk{{NYgzV<<i5R3l
zJ+wmZ@g%&Co^)KT;=L<-OD*l=76IvF9!`HwUuUi1Yb|XzT_>fplK$MJPdn!%mU=Mf
zcCZl&$~iOC$Td!7lYx`I_L{3tJH8T>cHfQhTEO!jOs<vET^abS<2|hEJIQRBp!>0L
z>C;m*&1z%&fF(OKvyk<5i$4>`hr21L9-5lO4^Qk3nv{D!>vQHmNz4r`_>S~Myk{Te
z*&i;+{+!>lvjCY*ntCV6r32B9&gKw*5BaS5MQbjKC3`e0ujhCH<Ktkw_6i&OOP+mr
zpL!x)d5-}5OWytMl58@a!345VjbysA9+Dp#?E4WcfRdtdIP4Rn-dsM*U6}X_NNCF`
z1DE9XM>ys;r=T8;dcq{e9*=vsfR&FcJ&;<oO`a&D_PyCcHkq4U?KdsJNg}kLg1dLK
z0OK%AlzfD5!+U|2yz!kE+U3GyV-uk*j%uz9K$Zg97-sEKt>vYRGw=E#`DnLbr$~yR
z{I%D&9<G*><fG_<0S#~OiLY;SA}v{@g6FF=PrM-Z<P3T}s(A3!6DmaVk&S~LM1|w~
zi<Lwcu#Q+ka)h}v4$+$NS7=KQUQ0yk5$eHH7OBqhiexO;F>S9;J*l{vJ+(i`P6epy
zYOf3BmrcYIfUK5vm7W+5etu#=2_FtOdDoj!{~i&p#2HxrP^?4G#upGP<)8I^LEr>w
z4!bWiH*cME);hWRL{H0-kU-8EpD+nm8ZcM%FqFDMT(QBGjs>1d^1fyu;`4b!#z@o$
z4?}vfd%sDRp`eg*=l&5Nv1*=w<>hs)PZgH_9_`2#UVXfE7<kequE5v<B$Px9rf?~$
zsE`H(R2>~Vho{Zlc`oJTsE-{<L!_nN&DMl1E~?%fXnVM7U(ly`xLbDIy=iOaU-k*7
zZ_dshI#Gi#N@;G;viLm&d^8ChR98=`PTBFjWH#{+ukM;Se%~?df9deP<Lgnj<Tt;X
zFvn%x3yhQwch%V~ow;uLi|gOr!if3#0)qy={POac@86~VXq_DHq@Z3v@F=fv)QA+(
zWU3{`JM1V>KA<B-X`!cPs6oxdSBveDvH^D(OezWTKFSmr%YFe_-#^xrdmx)DrdlXc
zWpnP;F);_eg@j@wSVF_F5q-g{WtvYf&G3~XW(ocrE(MGje6_Y}ccLViZrF)943LW;
zQPa6sUdAYwP&dA%B0;&?h>y7x0;v|~RW^JRm!+sk)jwVK($XRcB){etw*AR||6p%z
zeZCZCXZ5SwpcWhP4Ag1Z<>4d-pXv12C!1@uA4rJW-qyF+TE8z3L{sXbKxqR$!}W&|
z9elmkjq1^fQhano7*Za=DD@pR@k`cVLYgQG3DksDDl*83j#(x)NZK)&Tx!S5_3|tt
zP>#w4yJ{>68!;xS{Gux$#eCI-0Ko;I@Pj|8v2p#;Ma?ucU!uD#2Ls(&ZSo8h6U2ks
zNCq8SyFPzzGgCz_%X+ZnT6lW!=$dvrp>!M0eoGnB__xuNAJD-pojE|#sUq90+b7l0
z!O<1?aONj$1Rp8Gi!NTm$BgP-7X@o^^1l|JKSGgT8Kc9JM@MeaGXXa|C~&Nfj{NwX
z_%Q{GZ1<Vs6^z|k^ad^Yui==WN(qppL`(OSq-KE3?}V^0vOij<7tE-@W&42M9B^a>
z)v>NQz6R{P@wz(1Ko(JjLP(_ZgqtY>W^OUu-F~zRYpGPT?(U9rWzLiZ%eLN!$8!;Y
zaB!)W#t2EJG|33yJ?lV~7Gv5u(d%y9T2MY6t3~kYJ|?mYL;`)76*zf{1s0J;58eEw
zXwP%eR<bNhkLNyH(-n^s!2PMgF0bP~+nZ53oV@}{Y(!pdZ_c(vBT1{#j%r|Vk@?Cp
z0m5`e>tQf2Q^8U9KM(XG1_Sv8A@={g4WRk2%5e#wfzt3FS4)CUCEYO!YnT&4T<>2Z
z$l`j2PkD|z9XsV`XhT7GxWs?Rh`-=jn3~~0Z~@_|A$|&vJPCwEwA@oXM2rC4b6!!n
zp0HiM;}NlbXvhl^E=KviDIcXi6yK*jbp?WU29045A}M<IO>=CbQM_5f6SIyu@k+^N
zi@Ya)JKSTyd~G8h&rX7(;&gV=)_|fsLAgOjMU4yX+9;0Gnfpi*;l`~$B>+-^hakQ3
z>|?%~%WtxrwKX>Xq+9-VL*MR?r6r9-{mFlQSG#8O73s+XK|XWMNTbJ_KC@NoyunZ^
zipR<@dC_^-=SDZo#8<FCTLb+vovp`=dJ$;!-$93sI1Ktb+JWin+4tWG*bC@dy>8^-
zhXh>OUezj*#=c@0L2E1!=Y~Y|Y4{Y*_sSk=k3`>k>Qote`yJmTY}W&&Nw-ygpou`D
z3p&Opu26rS&6!FN{j#F+hf>>4KVY7hl$-ixQA1Fl$9DdtAQ0|Q*htVfT7U2l&XCSD
z_ZohJOIs^f6BGhF+Z#C^NqA6Piy}DEoBwuor9FF{D|AP&=x|w_r$xsNglZ^l>ov!m
z@II>R{e&L<8;PrelS_UlhUlV-^YF<U&}Uh6Sfj8?c7Mw8F}!x!yl+tFc&0v{Di<^w
zdTu5Wkh*ym8h<Q$RjbGKW`sr^-a{NKJ53iTbdTFm;@OLUhkDE9&{yC!tOy@<4sKY&
zd)UaeDlP5LnnwecPugbB=8ezvX#<5T;+KbM3%r{gk2gfgE%pMn=>w~O^}Ugx*o+Fg
z%T2*XR6hkxiOAgZ9v!!q2)^UGu|#d8-S12g{l$^1hYmJKNFk4~#gY(p3rU09D?$Hu
z0GI@-3j8br0lokmsCcI1M2ymA@yV+Yh1MKIjv#O7sEQ4jyw=R4;vpg{wDCbN&bEtU
z47{b-_q;3^AL?nUi2AeoWNvfjTWM1V76yjLj6E~Ob@^IahOFF{u1W0tgJ^)wpXWc-
z&kKUO4$O!`-2)i6&#zIIcST{5PNc(c7$V;f6o1K{#Ol`$$O~E~Gk1;9{80=FzTcL;
zlT3bC7S)s;+oc**JPTnq5-K+#57c+-#>d?|<#?kX9dwsv{sJ9IDZz`N-vN`lX;p{w
zVR`f{pnAmqK=YVj=MDe|rK)wli0jT4;ISr?r2x;0yk{NXJ*EG4=@7@UgY21nIedB;
z(mG-*w{PJXE4zr=VCzTJ5GuXnDV4>DhvYr~vQKcl&)Atae{TFGol}xx(}J)U0gF3Q
z8!-WGTlMe>@i1#hoQif-8RIl;dUOw?0y|qzsM`4aEv?_gR{`Y>!nbsI&p;2C!1$L1
z_#PdZFwC?2eYSeWCWcG@tlw47^i>0Dg8VZt?w(C&G{A}CuFYoRXvs<)yJu6DZu&9L
z%9bB3Qi3C5xFBHbZ<k99u?_}k?mm3I?xNom(ZLX<F4i)_`ooO>*L=#vLzuI36T!!4
zJM&Je8w9Q<u>0sG?JhFFv7-jdd7J$1!-LkQeqj}z96WW=lk$tQoeEQn{kK)w!jK@-
z>CSwY4Zfqc_li^p;Hc#t3;8v$2`(D9CVt=g^O57VYLnF_l=E?`RTCR&<4uvzwE3_K
zWzD9U?lV-1stB`yQp|vxGR_P-!2<8+OUud9hdzUl;;S5mS7Ti$XXO;0P^B*3J%rcn
zTF4?mxkyi&{|yH`U<oPfS!OEg1$zdAa_6Bz>DxAj@c#I9%G|H!-6DZc&am#na^K9G
z`&_*I2B%}1nNj>T#<jAg9%t%TO20evho&;&Jm1_>?9L&=G(f?#-d30T*RKGTJq`jg
zxWZl(!MLfFVtwWmpopoq)8t54jx^pbcp&ItTq2x0K`0e<e^0;a(O0`Y-+CBd)g+P-
zNzRCh0VdW|;8T#Vk2uql9|TL_rBjq!v_+ENd(3zUuz$&vzT<Nu4_}S$zGE^Go~Eua
zoI0rKrNDyqko0<YM$cI&R~yu;gFxM|Ge~i7%k(5n9N}X_IX#w(GH=B8dw9C&$^OA+
zP|Qu5dHk=}hTnbB(k|vr=YHZq4I2q&vK+LW+R)&5lBS}TbgU!kq4p(XuoP6uw&x=u
zjhXYpSxdE4&nYX5_Z=r|=bL>k`BK%l;~BsCMai~Zz!q4_oeomb78tU+FZ!kg92boj
zoLgSaFZaf+m4gIapAs5%45En=%^)2v+n*z9dLFBa?!%1?5*A53om-;uu%<!B6*W|{
zrq94l`@JdiGd69j<0C!iXt?(W2ZYUIJ@r#+*KJO;L|H(r@%b^z4I>8f-MTe1lZJ~=
zQqLc14!;lM5{z%Vc)#u_kU&$ofjWQs|KnWDQE1mdq_YI>52ay_#XE0_tvst^4iU3&
zZRn*AMc-YosMwh7L?|gS)v&uh!sMw8b(Hyo-Z?tizko_1sNBP9%&7LkFDCq=Vwtlo
zMijjextHfNA`5!lp8+F`u$0sL`KO#SfM$+j?K8)db%LJc8{4ZkHFCeXMiOOK!v2tF
z9`I2zs~FpY*Ofk0Nxg#>Xp$p*+ZgtDyH^fhX^KzB0ay17B)j!D#A|_Lw2@{@Vq+?H
zC_zNx_*ruxHXNWKUa^t(dBWv@d-2`5Z8Kd~+B6V5tI=*yr>$S?H+tG`DO;*e-*&MU
zN{QWoh*sBg_N!Vahj{0<dxZuAS=hK8@dy!oH7j6S<m!Xp^tQ&?xnTad6nbjn^*Hq@
zsm$FmmW|0F3~(+5Yc_M0)1}8#mzt9EF`~4&dOr?8M7>bUh9jkzYpNuhXz$5IJ0Ozz
ze4U5ZID>ZOW740oLbGkrL8hM5R1>Jqc)K`Ee8E=THIzAh?h$?&r^at{%QP5xLNIs9
zfN?|L=5!k*%}OKuqR2MT?5bb;=)^6oErOKpQmt<+*DwAsV5U1(nAZ91hpC}-6YjO_
zEzyW_Ri8iZ!9kVh?;Q_%N$cG_vz9TfPDNSnrDo~~BKzKo4xS@e({f?Dx?^m%b<7=B
zllgvDz*XU#rzT@t66%Q&v}3_IhZ5Qv=<4^Ugrw1=Q$F~H;y}{4>$t&O^JdR+!Uy3;
zC+>_-c*%aYG>>uWV^SD?FJ-vq3FY`CncJgKh*?_X5R8Yc5{G~(x3~~OHCzGTmWkRN
zB)VYxnDO%&zxS#Gl+#Qp5VgKog!BujH{QiI$ErMTG_~k@3}RjBi#x?ofA2IF2~pe7
zVBPr@udPSL+f9l$HC#?HA+6jt<+#5FDNt@KSx_&yFu{!u#g`5?Q<q&Gc)#u$lts1@
z6BYM5XHaegKG8tL#-1YtX9ztN7*M2~{sveV<?sJzm}{eC3ZLh=tI+dYi@?XnO`*k_
zM%MyH(_~Z>%xAE?lsGMoCd}PTp|F)-OJ6csXp^JP+pSi-t337U>1R<xLt?Pp3>4(O
zKk4`jWfcYQKsMi5#rG+N^8X2-bmOlGUUmymys^yqk~NAN>c{L%!C4z;Dpn?vQ90F(
zd`9tgmcFg~3w>$uCfaUKR}mj10jT92^?yfz9^CrU2L#y@ae1C!`R;N`v*IHjC+wKP
zRqi$4h%KU2-c0v08gwe!tBAhwHdF65kf2cR64WQ!Wuoaq_<lmhyH7aH0keoUBX3|~
z^h;JhCYw1!bjw8ec&<LBd+Tjjr*b32`(+?Q1?5rjNcgykgLdq~3|$<&p*QkMzIK{!
z9ivP-PqLDC4msWjmXJwKzyL-u0Gy*WlKS}_!j2JUrNFr(LtWEKFpL-9#(*}?hr5eF
z!}>}SwCM@;?plgGAP9ghGwJm}6zVJ9H#4=5dF$`Yz!Tz>SDWid15M!VpO3X09P_Ok
zh?bUWSvMR+XA~Z8s&jA=^ToC+<#Pu5{s*jn(ub2ZZj_>g!^(S(dwI(}i(bFo6GG~k
zz8@lCN2BLQc9&(%FM`vBrTOTgMn)WBQ>~+Hlm!C`!sEYOB>6rIlK}sB?3(REiKk30
z{IE|m-mrjT?NdE}Q=ES<N+1vb=fIsIYvrp9yYMtQdI(IpZ^Y?$l)=<%%5-Y=Bv2=7
zWHg))x>tL6(XL+Tgq*|Srkx`XoEGiLAhqTQGvOjH1)?)#8W7qQ-6f%Xh`9S?S8Cd@
zMtX1b<6T&DCfE4IOu~+@Z7{)QLD2U%PnO8J;6!1@m-%8&TPVETv}l#_%KAP(aaz*L
z<aB8;W>m1-Yv|XmY2*OuI84I2UU6$#3u|UHvf9M#kgQK!`hwHMMy>epV=RUvv3mTq
zHctgTSPjB?mG|v)j!4z~3{){e#-5un>0+91@^vu`{qOC2(Q^5}C4@9f8B!K0{l1^B
z(L6-ZHtvnCc5B(4{hI3e^ilG+hd*9_(=|?t3~xjN=WT4`F3omvwMwoc*5VC!xUU6s
zwEl1P=whGkb`K3mRjWw9+H$zcaZU2=zqtFW4h9wwqhdyhl0z+1A=qUc;GLim!&~-e
z11u_Ubft<_S3LK`|7|AkT>d|R4zD+9<C)`FzF3*l$EWS_JfB<F#?+C1e?&$rXu_`>
zBtdhdbw|aI4$80*nd9v%mse#s+zV%U*WOddH%Bd<SXKlbebqjv&WiUro|kX>`5tcQ
zL#K0sswp9R*67H6ZqP$nl#aEdW*z{4HcWVS^Wq|E_f1$pcB6%-ww$iKOrW~^nJQq#
ztapE$G2;-tlB%6=)Fcy|iY#u`cXh^UUYJAuY+#aarH5yD>LMSsjCM77xw?1r=pLmC
z`>bSa)h|0@&-b!w>c*r`ekiB(&RS)7+4u1b(P*egAq7>fn<$VslXw0OVrvP+Dz%SM
z+UkL;r`=$0aJ`dLf(#W(F>+io`B~e<d=kPPt0#(V36~!UTv=WejZ<DR(-b;kfIQ(1
z?(x<ot1>v3cQ?35nbXX24~#5`)xTmi35pk%EwbM=y%6wxB1`%{=f?Esx~lP*-iXR-
zg*E#pnpiwt|6_W{@91CiJ@+Ch<o(^ALofZ#UwQjYfl(clG!eX!kjtfkt9(DDTLg%V
zj%i0FP5v;KB7BO%-aC84wjMV5S^dXr+&-oUIWkK)(?t)e&~-j4=evW1@~0E^o!w%x
zuke1^+&z5cQ(|r#%4UcdZsR(>)XOcHY%)OHJ^8Y0>DllPIQgG(f<pq0L4yGJ0Xzyo
zLL@})2b`axHjdvE5w#OFmRzDWXPMw=FCHTTBYM^<>8YyBBWs2(x<_KBQw~6)*QDnX
z9!gueo&A7v5Zy&#f>x0Mk6Ug%P1E9G_u@XUz>3Vl0ZoEq$2B!;c>)(|;~s(Uwr+X6
zm7*T(6_BEs{xy6o;4pTh#F6~~WU?%Z##25WcDz8}Jaz!83-b5n8<w~O5;j>^3JL+>
z#a!ud^Qs^m1p~P!1(IwVmk|R)-hZaKeW>uE=RxGQV=QAy3N%w-fcM3lH;w6_jAD{q
zunpAdxaswl-;#yY&3*}S61<GRV=LF7lvBRKisziUE9QTu!~tCi>W=FM6imL^5J@n-
z!OZLqUE>%7W?{~hGjiH}L8|$Yf4z$7e9@3o2OmK|G3Pt3|K(*kQErBo$L)vd5Y>j!
z<c+GJCJXTk#+E2J2U&&dNB?OlDLo3PT4qgXInA5P)`{A8OHy>=WiQ=lQF(Or;&}C4
zxxzyD+f|ew`?tNqMhFm|bEYW%F)8VhWTF?B0_o-Z?3&MR$l<nC?1)un?nB~eD(+v~
zn0pY<a(D{Vj5yvtye^V`ATOqM(6Z4;#sXi!Zt-bCXP!x<@2Y+lB^pzIv9O_JGmLie
zXaO7GXTFx5PR7#zbxxFAek6Nl=>K{15EMU``wl)v<$1(lKXzan!@3H@a`rmi03wwn
zuYitRm3xZnaqRpI^`b65F3`m=5+GX!>~!+~n4R+AZhT96+z(5G_05x`$md|=xP;~=
zkV?Iddv<Ve{0Jr3fvjrwyHL`V^c6-cEJ5~dxmT|f5ud@#GIh>DpJkQ9<!@EXr5w*I
zkd>fzUh(15ScE;FbnzZV_Mvo8E+526#ssW4N5uFobU!z9NDX(e>G#U%BN^kS6>f-K
z%j|Ef3hEZh8}2H?=tNk`{<<65DECia$qC0Gq&F=ua<qX;$q*gcv?WRf4cvW{xtD*Y
zG=3310b|i_<|Tm!79UnoaF1#8kLJ7JB9vy!e#Es#m#J}0)iQ!w*SQ5xTz4`@@}KNQ
zx!)PAk^1DyDm$teIAGR#cU8UK3qbMDJpEBftl^0IA}e^-@t0PWnfn*8OF``;BytL!
z{NsEp?D7e@_d9DD7bB7UQ%2#V59J+V>lErJ*#TZspr)@9ogpiw?JtK5g0c<hpt**I
zk;=<yDt&{+&E&9*Y}rHtuZwMN<+~H=j*1CviAvhFzzrECxOc>M;Y4Er(O>N0f3^nz
z03oIc0GxhV->(FKZW^Med<Md6H+hVb*>f;bxvjXBvk#wN3vT;~)%G=paiWN<LN%R0
zy%>Aa^2#zNv~sRCu`@j;H?$I2g609>Ziu89H207HVl&!{Jt73P@qE7WvSQ2OT+g)&
zzdz}_tvXbXGnO;kYbJlsWz)HjxaKXjK|B!f*YMvxg9GDsx_G(%CnOK?T)KZAtNj|O
z*~p?j5!ANH6!Io@_Q1L!ip`Nmlg|9vLkX5;cbc)YizTRcaL`4?on*(h4qJ)86SEPz
zq1X8%vA)|dUNnO$MiK;6i35Pm)qFAWG7_GL$BQcaa(=~R(1DM~^@pOS&r3-i9~;Lj
zxMk*uU~3dyPnnYh4l&IA;yh}7paMalU#Ola(Hy<`i{0cle*66d0QH^#W7;_ncyd=_
z-p7A25#TrpSU!C^&vJ<n>q%o>Rse)m|JPC85VW~9TLqj4jby`m-jayt?v|XC^fbKf
z+AIbc|2TNI#d%;%`9a1-OpQr2^qZw8bU-OxP6Wg05Bus5EkeXO^b8du;p6yv+hUG4
zW|v($T8ws^JG008>94*lm8qR~#%5&B(?nSc0Z)IW(8CYa)97AFVJdOkY)we~S?4y0
zz}Q|V7ONJ8kDd9JE<pLzC9t$gOV0b)|ISj_{|?6govLf=eF-E0;C;|cjPhao4#2km
zi?T}o7A1zN-jq2Rae_L-;cmxTy`g;O$J+;*d*E;;^?bQvq?VE6fq>EQWL<T-`Hr+X
zvBxA0n!BWe>J0jW^`TT(#>;E5So*eiD0ml3T+ckT<ZB*Lyg=7V=G5<sZ@;YbY(G3W
z<1Sh9_Q|p43!*0{_JxN;V<bN7Je18uPvZZC(Av6`It)!;L^>p8H#=H+Sly@kdtDzf
z5SI|!Jw+%$pGU9}DnNCV6tF#7HL<(ZtJ&seNS-1N_4vX-F@7INLU_<WU^fyY!CjY6
z5hm6QVE1m_C%HEU!=XHi*p1Uiz4F+N-(CV=q{MxS*g1c3Bk>IV=57~43{G_9nl*s(
z<tVJTJU}f%xVUMWLbfW-#mED2DL+zcRPZTh^{m8^PBbXuA?9w@E}7Vzc6zqRkZUJf
zQ=PLO3HE*Zxehkq3G%7HMM&MdDq_3FgO*cxk^K0TS!EE;1<Bl!DbiRPmvBF$pmM|s
zEbgLD^C&Lr{G*8eY~nJ1jmZZgutfrnswh+Ph4U^Ru801QWqsieHX2deC={kGQ<EQ0
z!{~45r=;cz<ey{3nl$3DsWZw&5+f6$iNV0VV0Y^(U|(#7{U4vtz;uZJj!?nqZQMlr
zEJ8-ybVZsnf2G9vxIh64bK+R#t}-Tor*LhN(EC$7@Op%r2GElUeM~62QGarx!2XJV
zpxV!<afw_+!K?R`A+{bV^5}D9v`oZy>C|MclL)Su{qyS+>KEf4WCi~BtFH{DTF6Ny
z_2lp8;`IZ$$@HEnzWSOl^y1;!{vkK%o_RB|_hUAXQROjPAAYAVv6^!tpYK&kO17yK
zidrhBHZoph<uFovN5`*;-G7<GW7%m~=U5;wC!|YFU>!xj!B)7emRpv<*!CBQP(AVq
z`!vjjenV!zg}T4C+NXJ~dN}2s?#G39!6DJ;WZ?1imR-G8t9R$vdwMtUo=QEp;QS{>
z=Ct_8w0I!h)+j^&&bX|=ND=P7EFX<TZ0|CgjikynY$${v$B>YhbY`V@HgqRs<ZD*^
z9a8+l9Iain#NvbpU2+e*n<6ATo*2v$1`1U7T7824L5DdERDuT~MxOaRLzgUXJr+1u
zz;67}l;Wrj)kyrx(Ces;RiGn`ww|{(Gf;_F*H3t~vy5_$;ac!X0m_&C;%b2Y%ib(W
z!yx}3^HAhw$g85c?OkEChb*aJyb6{~bg8o$Q-08ps!n)&8(!=5b0u{VQMb_rcHKn^
zQauNl_}tP`uHh%ux%dz|_7ySGd==3=z319KVD!t}#;3bThc`~22MlN+uVHhu)N0>q
z&C5cgK3u#O94+3J@U)T)`H-RM9U!zTz))`8+Vwq%@Pxvn_d!8@MKH?qMenN@wTzDx
zMDhatExWB&eX$?FUm|66H?-tLOZ;-hHD7j;ac4)YSc_Pnm%+q5of)TZJYV1#<S172
zNJWU{S#h9!Y<vPZJ@=s;eW-bpP^UZlEAQ?6T#|(;+>PkH!N&JL(Fr8ZL(7f4eX<%r
zsv!Yxv=s5kQ024xt<=rAQAiKw#>DgpqwGWbhg}0+^i0OTE@6r!q%w>cIfkP_Cu0DW
z4>UPfY4Zs$73^YoF284nPa*9btmBUMGiRO>?<0MVoCPb%F6vXDpICt|Gxj=PH%HI>
z6>&_PnfD?EciZ2VDs^hDhzg>`wU_6$A#vo(ui(S|*QdO^7!zefP>!zH_R4b~*JEb>
zDSr8!4~Z=qwavBC?6dJC)munKo|DgF4rPe&Q!;}g>fUQi=7Ejh4HkGk>VumhOEUA+
z-fk|1?|6v7I0Uew7&ektXY|*CC_i~ZbF>5GuYR32d;CEc!Su{`cmGuF&3Nl^Bvw$M
zv3kVE1WNxrT{(+K8z1)MTJY83)5l1PqHTbBKVDEdd5a*?iwA}3alKlI5mQ%s*~?)V
zEfz10Ck4{wXTzoP>>s>S*=d&zsU&U7cRHYBH(n+RgfPP5KelUrdqO%{!Ty;QQPOh{
z>-PUpb2`RzWew-#&JYE15;F#^A0`yxi9=4S>sqbxw?q%LOE^XP-Upaem-EYFo-$;V
ze8{dak&Um6+=KNrae?}F=fRfS#;HrPN%vMVr_M-jyFS)*nPyZ6;pn&C9m5zm3#MUo
zhD6IE{qJ;934>3MiAWa<15Jk%7=^}5?$UNbEZfME01qy$0R08@D)TP|C<GM9;I(=r
z9})+u=wYrXoN2`*g(8b+|1Y|}GAPbyX)_6K!7T&`PH=Y#?(ROgyL)hl;O_2&I|L8z
zFn9>=?vj0T@3*zJTeb6ZW@_fV=k)1*`f1BZ9*@I_bxUJFxU--u>9J-;Iab@zrbLU9
zVp5;wP&ekY4QociK%|BaeD%h%HKwa(jWr3*fnpEH8;&~QmQ_ue>rVMD3RQto_r19#
zX%zRH94V7-Gb6H8Vt8BQr0~j~k+wfNeJ(1EMq>E#EYHp7hq)`mo0qLw0o>_rt?~*|
zW>#0GJ*CGi)pS|FoJ`#_LaO|ti?5vmZ}h;iM<Z5Vd~SMrSc|Md{So=I++*4`sWbJt
z2#23FDv0Z^{XZ|Ds0#+x30Ei_)=y0OHlwNwnvBgK!Aac;^Q3C=8@rmMtM+KN)q_w=
zcge!H4qZhiead5z3%y8iZJx#^J)7m43Dr^egyq1+&id-aW^+$SMYs6xZ#1=POu=4k
zxZO0a!s?8w$3e}m|Flo)XbUC85O<2~=|&#8u2$UC6NC?jFYP~U)xy0fQ+e1g?Pi)!
zc11UEe87@_v8S%Unvy&I)IZxy>vh{G5l3`)uzLc{sbTK%5p^gfh`iOQ*Q~mo$Mnc>
zeDANrBgXNW@8`dCmqOSyQ`KlEWoRclyjVE0U~8A*ioYLc>T-4v?*@NCX|jW1ZVn$q
zI^=$mU>Ld)-z{H1gBMG=N2(aC?$ZMPx=jSCwFOQyg9m53;4Hk!*RB};RKYy&V^X1G
zJ0=JeGKq@j2tP#JI@G3a1QNQDKvTVCpbn3!ri`K8@_HJNlx%{npPgEpn2K(rf3sQA
z3(FTHab&hhl$sE~c-?%j%6wSv(%fDB?0MM5Fz1APr_U8Iy*XUqbonwpVt_6{+p>M~
zb-4>-NW#n9<ZilRw?_{l*+<>J$eo+6Lp!Ak6R=`y3hgpBcR5}}__%($bux?Tn-vPW
zjqNG2+X0}7_&?y`5)7gxfqr)G!wh5dd`BO5FSKbGGxPTkHO96f9-1aDy`NJ)l5@Hw
zT`|(zp!;*47#S26^_NUm0rP-@GX5%btIS=Ak+baGKz`ULBJTVgeIeDH-?F&NRhcK$
z7+djatv!TR8na?GYd6I3{DNWfA9rXCFl_yf6>!f*ezVr%L|f>17TGEB{8Hl*lwDf^
zsjfLBte|UNQ~(W5X;Jw3mp@-b^NG0{LOKOt*KbOFnT3c#9eF>AYyzcoQ;*8&vf%xh
z!MADlCdEc&idMb*M25HFQ|k!CWJEH5q2=S5k#x8a>CA$K+OET<AG$xjjgzF~)fE%n
zNN41kr7BbZisdhTe{@d^$M38H$-eobbwO5lSM18a#ooaaeXJqzH!~+KaTZm+!MgDB
z%C1Pc8~&qhh!@$av1&c1SrKCIWbDP!h|^O?LXqdw#vM5AP;`G*be#A29nyWtMJtx%
zZP*cfUBcw$PtzF1_Qskj0?O>o_L$0o!JmlKHkue8No2uVNF3FiwHS!Fwa8PvWCv|0
zVdM$B9`-l*+C(9d^+>wQkJ*Kw_enO!AzM?S#xFUGWvZ3%S9M5g+9|9G3|LlLxUXc8
z$MGEi9e`qvP$DJiC1*LVc7kgh9of>4!^^)``TZcLx(TYT7C>IFVrC8r)=4nK*x{nm
zT$q;#nOSFwA)4}@L*<7}4h?YBe>^t4=iCeOYZ<!m{VAFbok{Lvr%bH5M2j3$ldRa_
zBw*P^%8rs}Q1r#B*1b=b=f0RY_u%~D2M)D}YxyaW#(2RnCK*qjR4J@O2YYz)ejw4?
z?Uq9;>Vlxw>vV}cfIl9UAMe`3b9;Bk3?W?*R6x}dPHJH1AhrDVQN@e3%Lq)VYRXv9
zX!xl4WPn!_`ZwZtP1BFWQRx<<=*_s#!^OtdTk6?T<^uEgF9`XKjBbMN8KBHW(BE#<
zR5FvmF7rB08kM$o5U1Iuj_E1bW6BSsjt+WNgc1_65<8&JG5hfK@pZA(9h4QrJz~zV
zGbZxae7`#4JG;LmR9SXM8UtiyEy(w(kNHHK3(a)-61OtSaEx<%{%~CrAA+*$RCmsU
ziD8qlfgE@mZ9v{D5UjE<3HHqxf$?U0<CYoraN;$)tD^EX_@sUw3A5@p!~7ECT6mIQ
zJJwv8X^M1Lj_GfduRvR_5zrmNk7N6clpp5T3$9VK<R?@;B?=ZqeGNmiykI4P9R2eR
zcnL`$((t`+Sr-EVuX=+6h8i+SRmzw_HPL;24si2jma#b2e3FsrKCG5G--|iD3ZzX%
z<}>!icV($HJ(+OU9loip`;bE-acnS7h9@mFE6`{ZoZ}HV62r(1xNcd+0xHyggGbQ)
zB%X{%kroqhqMKZ1&Us7t5OJu(x>LhupQ@5Q$#Ht{-wnS{p0Ox`D&apx8rvJ9KDC#?
zJr-)@Lqq!c2KxmhkB!CjHH2vYm3$;k!Rdsz665BR4(S2CwH86BRy?6%O)$Pqtj8>m
z2=ko+(g8slF!y2-@5Y`Jd2JPi$orJp!Q6VjLJ2vUl56@nzG*S$sgTI&5JxBoWs>~;
z`vlE#igY5T2Ac7e#h@uN;sh)~SuXRK(I%O^34P9SO3yR|;_(tB&r)=3&`SRM7bAY=
zBVw5}&a%LbRJds;wUI^f|3D{}dCY`EHT#$8x$+NI9~*`{i_kBSYGN_u=$USM@ye6a
z7lIaCx<96?qKMHfd|#?oy5S3Pft!6wR?N#Qj|9QdSHzN1E^PTKY=~uz?q?moV@;T~
zdb4GAh+`EOeKvCYV^Kl8&2*c)N1ZM~Oz-Dd$}_k~EH*`eoa=e3Sg3;(9Znp{+`}H6
zZ}}Ax_Befo?y}K<WB&A<2lr`#;k(hRExDsv0>9wU`zBia{E>6JD;z8P*5{1=pZOF+
z#k1ScoDetmka#)%*0X%C-lJhbRfV?(iCRZ&#WGPKGv`$1_B%o|(h4VaxbW`L&wGkW
z0za3xXOagnwzMjn#F7e;s`(2O?FK@1#;3d&7jN0*qE#eTi=M<9NS?ec6r1Lj<nVrA
z&AKcwx``g43b&-xss>XSEY_`B-vnw<8kjokF93#Nmc~*5Z8Z}GA|FCj!t+cC_EAIC
z62&bHkAp3HY=(RO62!^d(oL5nqH+*@jEBWSD!o-8UJLg$e##f?f3lbdqrk>yN39RX
z$pocKL1ks54vq-!_ti-GYPvWN73jgCc`^qB{?o@79+-9OrM&Y;C5UHIj`JII-xSeM
zw;bzqgEP{+{WMw^WmWG8<|>mFh-$vZIBMkYa}@M5*CcqRzyI#{(&L+jofa{Qw(9^M
z<;>P_@vb3UN`JYL{uA=ev?GM{bLs6ASZSaib^9DU0Bo&9JfRKu+dWxnAnwb_1tZ>S
zDZbUhS#VvHzXWwhT;{04=Lh^mUEcl*J6p{aFQdU``Ul@FMF@LYYzh?R@AGZAa)I;V
zX6|mVwJH>j8`;Hh9TYqge|Vz#+u%_7D`=sWxg9wx>aRR8>E#A0$E(J#jV3(yGFGc4
zyYKR^VMY^o^qTA`-OkqR0mm2I5BCFx!Gx>9BX$!?h53ZyjLT^pkscNhzt79}yeV<#
zVe0C)N-f<mC%O{bOZ@)v18-rNMn4*4$pFaj#v=?)Mhkr99{KW-96~Eal)`@&cUO(9
zWY$WC(~a;gx7$>)!dE8RS0FZJOuJSqb%~pbCoec1UEBUPz9`c*Os}tffYRe<yO&`x
z!ykMYof)~Ti0dlr*WYdJC@XLa5`?sF3d#&v?3~{NgzR=$s^R|b2ar!hddp(#8A%wP
zCD)XxFT8WztHTjpe9c@p;L%Muv6RsMHZ_2Eit07<)NjcxHL&{rV74FGl<$P;wwi#4
zjWM7d$$KV5FcCrULB2M+FSK~tu9{xA#Z7dRe!vW$fq>U&8a-jeWHH&5N!+eFtgl$6
zf2)e>RAG_cjWY2h$q#(4fs-88*dP4ReE_NE8bvt_ma@rKUG6Gjl_aOsvkDt!M^-e<
zq95vU35}@)YALl0EwZTS6;f@~;(w3*^TVQ~3G<)oGA0ildpJWJi=__;Sw1^YE$0hk
zV`{#hP%K34R(W#`8M}@u-rQ1$yiCwD9WCQ|)l|iTR|zTY?4n6SDR%S*SkZ0NB_OCu
z5h6@SWl*2ZH1kdWA~I3`Kx(_%6C$Y~=4q46LG_do6c{;zdk(OKUZ7Q%2>ofUZF-<y
z4Sj$7zL7q`!VM4)y<njOOY`r-s<lB<Is2s_lZ(8LE>o!W3fS5uJd9r^hnTEY2#A(^
zEteg}+cpVrGY)#I%*k$+R}g9}Z~N7U?rQL!er676F+gIFgf^@ByU42ie%WQFiCpn{
z$Pp%4DiLhB)I7^FL>17}p`{%J;j0Q3)ok6k<7BJ6mZ%0BraK*Y4xt#wa*CDzF|+9C
zkC^0C7p(t3s=z$p>P8oTWbztBT*z}v?1$nOrZ*;DW;v<tgH+%bR|oOE;+o7&mRm@6
ze6xlzA_AzMPo&V9WJ}S=PXFb)Y=~(7d?7g}l}{a@J?!&?oM@LF%%IOH4;k<IpDLC(
zs@?E?`qI=__bjI|9pdwIr-C}G2anF&ZTO&a1J8TlJ)u|n2&~{?{=8V$TwvG1?K>A6
zb7<oyh1qRUL1+W~aL1X~-#qQ4H=`**>qpIH>PomU8B0N{Gk$pP$)Y|&dRR0+Q1^sl
zUFrmoMN*eS{N4h~&NgxUw$AV{4+Gx|E(Gas`7q&IL`5j$YA*YhoSa7!+*zoy$KBv#
zJ6Z=_Mns;0MVR-MP&F6mqdU!ZXFR>#p~ddSK%xpa=_+u=GDn45R_5&&sZHu*(3v}X
z<9RN<W*EKg@jY(BtLhYroi^xL<toH}j@_2`*^_}(p$V-?wp#CF&DWUOOIR~p=t4L;
zo~E7CK}9Y4NWGIp4#x<ThRf9g7PH+rJm*Bw*i!Eg)_Z7Z+NQbhBiE4#=@tqHTe4>I
z9EEo3s)F9a;Eart;5yZ{^G(_SKfxS!SaI-+IX;Xx^Fq8-M>Pm!6lmt$LBizpWk{bW
zoH^`NadQ@)LT5ods5$hP*68Q#W**~{h4*;P4Jb4z6JdPSnTE2n@N^zKfhng49~!N+
zAhwQu2Nv$op)O*pcTdv`^bvN$U9(4U#_zK?{i0}Pa*O5lRUj|R3Kay-<+0;o#GzG{
zaD^Wpl^hkFk$H{-^Qdu=H_U@L_+|4AN{M`k8+5350@uT#JM4L}dvnr{B*x%=y4tWO
zvCs$eiSN#^u8ABilf=mUB!4!wcX8qfd;DhYWe(ft?TCWqUOzCsl+&o|f{r_)j~@71
z45K4}dRHC<pB$VlS1C4?nliGZ4bP!agD(tj0$9gbT~@%`iD>%AKc@F%!%;#I4`w~s
z2?dX@+LMTCi~MVgSr*=BmGM!ak-Z&$=#a9VIk!h0mqGsd+w}Bzz3-P1TAeUx-VI!R
znbrQ+;MyuR`HjFXE?4rs4cD;M6}JPnCW`jSh5%qt{J4x!P;N|;cB{Frd;j-^>KR9A
zTCQ`a-XxF34^+fIrL3w6B7d{Sf^+S}jvGUs{WxU{jh`Y0ggAbs%MzJ<V8&8maFvKN
z%|?@CVTv0GVoOtbdS~8{dmpxxdpd2HL19zc6t?8)-VQb|{5l55Q`m#axLUY6`w>3;
zvSgn+E@d3L5AH3hG7s#?&1G<}`e|NjF_1qqScEwbvjfhRAra~D&3fT%OBmb$*XdPI
zMkd?1q?D~mg5tsve>6;9!C3!9Qb|_TGR#HSdief6y?Vy9jxcl+KbAXw@}LdO8hFN<
zZU%K7)7QxAqR(&^8^H+ithMMR3ZWPgVS4&O<|S(xFv+T&w>q?ub`g$JMRok1<vxPy
z14m2g)7*#H<5T9V8MN}@Fry!=cjs*iaDDE2wA!WkCmQZU)4YD5!b{q*CTQ=hotWNL
z9!0%lnSBb{#03-tj8hnwNmzq3gwjJfL)JmW^_FRYT(G*Ge+8UuNqKCM$ItzJb@1OY
ze3jxSfOrr-qVX$$8BP0?|7d1jE)h0L{YN<)WQ^xwSTUa=H`V{VfItEvHJ}j&_auPK
z|4U2%Kd4(s3`}7;%_Lm^>6~+z(YOe4^N3APHlvi^NwgA2>_@4C-3|wfM9UAqgm1Ls
z((3Tdcw&6~o9!U$8Z!Ljk>`c@s^g&+Ryo{Pg0q8D!_XJ8>o4Z-ec7Hyh!V-;)oXAM
z|8LskKWq3$BAG)4gOL7lwR*oJg3th4HLVUdCG7>QwuZKs0N|_F0iS6FgRCpaHlska
z+O^AA233C3#+EBQw_X5SxU>5I|0xeaAe?}JKk8J?fFTV2pC3sDmW=xk?^XY!i2rG7
zH;!)rK>%EpWtbc;fUU;{HtSHB1e&)i$HG7&7#Ppqg%(JEWh?gIZvmq8{@=<0orMF!
zP*3~>G&9wyCjaQ;34+S1yOrWlg>_KI4!ci<JB7}a6Cx*omnK>D378fKFT03D0gQr9
z@|I>AtQ0H(iY`)bj@&U=>6a-KUsoIu{V<!+1|Rb2MU`txRFyc#cf?|xteG9x%oyp(
zb=HCy%~f3L+UgG(GZT)tkHQP=6w}#O9`Gzx{X%WNG)4=4D_@Mcd5S-U*7>BQ%W+B=
z6f-$xSFIR2K`2P3HpcUQ8OxpZn`t@zaWD{7nF69S|MM8I|J{ja>xRf!%Vk%p`J(N4
zW(Js!zo8>y<b|LHPyf^nSFyRh_M7&|{Qi#y?X6Uf53+$>X(sNo_*BR%yMdM?g_6`C
zm~BLSvF2I7^*ib@vxnq}m?AAxkBkJNH#X3API@QojEa(~^io>tOXA)@l_n<(<W~JM
zSI4R01XQZti#Y?jEV2)?jT#}A`4nq4R4y0sxb$wg=qG@3EQ|rwk}BzYb<@hqIg6Br
z<9h{1_dSgdq>pM)z~-NSA>+y6D`Opsn2h?GaN)GH6gUo(`6l;)|GE=tjnjMjv5zQj
zcnwV_EoDihO&)+Xo=k+83n(0LZhx4dPY)3`6*&?FDg`r+;R&St)svt;anKYw#nMn)
zDd9pfKF{4HiDn-4oeaNjHRU4(=Afqf@p&=!nh7#>-F@F*tik(yDis&zW7L}>r-KWw
z=efBu_mQheE7<N~Nc(tRbqqan8{9CFH=Lug0ZpjTW=IKJG5_y6=92w)`vLhz0ptr1
z#5;{JggX?f`4V9JNqPmCWEmhfZ^sCl9%E2l`%Qtj7wQN8Yq;0;?fGKIFE{NspoT;Q
zHzouq>jfaCIG(`)zFBxRe`4BL&0f}zTiL2f1^$ku{erk<9fzZze%dvgcdr<E@Ru#e
z0oFYHsrj<;O;<koyDHa=(Z5TGw*<I(uREbiUD6iJeK`I0Fd$(I^Tr$d52dFy<Y2N(
zl>#c*=*oauQ|Fm>7^U92k1NrZ!70Xc(@rJ?mKltT$`jB=?_aYW=Me7Z2=Z@#eZ)h@
zl^h-@;WWBB3t(tUYdp+9<UsX&gipZ6z@Wsw)Q9Jpet$a5@hvKE=-@7jEYRRNu&KQm
z;ZC~^lv;tbiCcddGL(BBD8GHwYbEK7+{vMsv8{n&qwVje?C)`I6|~rYocHKJ+xpq9
zFBpqhTY>>n)pS;kv}QIRVEThXcj{&^xU_59T;5j`hU445oE|ezZ%~r+bQ}d_>yC+i
zOe9wg;Rcx?#1&vn1#zl9aNgzS+JXqDKg;W^Ge2v6S$mC~yWA05XYK+RKZHul*S0N&
z1MVi66&MbY7K3MFbsHx7#3dzdbGai;==0{V2@n$G?`hDky@b)gWDOX97CKw~PV^#(
zxp68&Gn)k?V09&5-BO*=MX^=NwK2moEWbrE+P<UDEeX5*Z5~Mlvn;3cCUk5bmO49g
zGVvuuaj1@nr>ZGz-~M!(qm29MWmjsSppvzUD7v=*cLT4r9$y=!IrJQ#N;7jm&lgMV
zb=l_QBZ8{N@{OkmvxTl2mdU>U<qF=52iJ%PT1k#`aJ8}H&O~9*T8OOTW-0#D*^$CN
z-7x|SGUk+<MBMLC3;qK1m1qmZQs0_1=|59mw&1Vrdjd{ER6Wx5&e{s7YR?N|&lB=#
zFMWh(Q3U-~syYwrCMt9BHkc|k_usc0pHu}`3?Z02J?TCwglV#?js_M1>SPwn;LwBm
zZq^UE9#SeUU;R8Xl6lgOzGmK8Q!fk#955GQbxrD)HPwf)vEv<Mv&1dtCXbdhT=zX3
z#~w6Qp;v`2iAPCQZ+R|<2ym<0n*{P->N?|rw`)Lw@}=n@Z==~lyMxcFm^g)>3MAkc
z*ek9Rwe%zjzkeOE!*eQNUx8i<+%0PduW!JR8Qc{%eAA~=UT5Ym=hXGD`!+|iVCdb*
zOWAoAAn>>FK7gp@Y4B4}Zu_*CFxY?Re>5U5=E-`8yA0z`efVa;dL|D%!Qq^2lS52H
zK+ao;cP4ak1kgH_fi5p?h8qnifi=(|?IhavyRSi=HhP3m7&d|!(IDB!7Q#^iWvvCP
z1NTu>XQJm`cSC+W?0KOY9D3$E_Txz&99l{BE<PENRQ?`C!};_zm_qvp!xIB~L-p_h
z5(RWN-Nm>fH@3ZDul#dG))fT-)idj$`1?arUPrDMT#e#--Ljnp^h6cS$_)qExPy<h
z)|A`g79ETDDw6d>XO^+EHi8S*{m1g(=SRD!y9I5sqb>RM=Jn2GjlNjdWsYedOA_%e
zevx8SMaJprn1SK9?ji_mt9{P57NoRjQ*75z@h~`yt6TCasI*4dDLvf>M$WuVrGI`X
zMr!ut_t-pw$<(jfP1+E=UxZIE$uc2LjtJw`4b3ETkIiCovWETZ{mOi1rO|j^gPN`T
zsOadV(GE_X3VR)WKQYEsJ}b1bvIkzai_6oIKj6;DnYvSJ!+6ql9cGiN_gC%Bkxk(K
z0L7n{beLyR&4cIAN8E6pkR@LhRPcD<Yn024aHrrB+;FE=NM5Z0wj=Zij-Tfzi0oxO
z7S0_-Zf_Y3-naR9Jfiv6jvN+REv31<&>Fr{il6DNS222d9-}yFzv!yZqIn_ij-M#%
z;QDlK0*~8L57Qq`*6VXP%t&vVGZ^J+Z#=-rm4M{Jl1V+DYpQ)K8ixWHUKu@Y6GTwb
z^Em*<J$rik`{<2K-x;w%d9pY62WAg_*PZE+fLWJr1-VZFzpGQ2Mtb!X<afRnMfDX&
z=C52d<27!=U>Zc{?Ss|r7o7-$VWi&UUCM}H(I!AWN_O&-b~0^KL|ot6m8qAbA!<~8
z+y}p<y-Z`0xpRaFc<0K-fSkv5Dm1QDV2x!pz2_N3cZ(+uTXmVf`Z1LZ-+WgSsi5VS
z>D@{TQ&mWVh9kC%a56iAjOL%S8_;>IqGrRT&2F!iu@&$K5_y37UN;<WzJ>_5l?%un
z$mWJ#&AZkU=j_FwxLq?yO^t;d3A*+-s(Lb_ChYvoMp2CJrgZ{{&2_U1B-HG!t|s*H
z>sddfquxLJXN_{_F1<A-p_9XeGu~O;SJT^l6IT7Neu5Q@P^LyGoF3KXp#_aqWv=wC
z`fh!{@Vp_<sRd8jP?YcK(H<7FkBt3gWgJ8+&q7^vd483f2bajK^q%KK>Efyj8!kTS
zi=tM4yv=jn1p;SxsJQ<{FaG9%zQ>F7Sk#K|T&<S+CJ2D*5G|a!{?DL3UnAb}YQs(0
z84CaCQSF5ag+b_54<m!fGL+af<so?!Vp*=^1u*xzoNNO$P?UYg&w5J%FFh~tt2LAQ
zz;nFI7z5AaLBWVPBVa^RDIv1cQB5`yxCOGES~A&;Uar)#$2i~U6Y@NjIajtWa#Xdw
z{7~%S+AqwGVf*~!+d+w0e6Av^3@5|i{~X*beWS~(r*P>#=Pl$xoa?^n;x)vP`Z=xU
zsu)Z};Mp=9EV@`ge-4`&0cuchAhE8PbF(DS0|?u48*LJfu4&<fIlD=UqWfPi8T?X1
zAStlif#Z|)6oPN&(1rIn5MRY$wd{&8tXAyfYnk<`*s0Wqm7jq+<lbQE<uKnBo3V)C
z_hs3*(f2S~8*DC9${KZ@*z%ZE+lYKMM!fS<cLR{sjWbDD9e0*|Oo}T3l{&>oiQKo7
z7ZZBOq-Gi))_O5<tm@{qizE~0)9fP;3W4$*Ob1xPd|b|GH7nW`!S4W)@~T)EL^B3A
z%Us8dApUc15V@_aO4PxChtX7TVE?m4H7SHv%l!fxwUJTenT09f)=se8j;{3D`zim9
zT4ZW!ee^>=aa`XE5@GRh`@~W2JyGI*UBY-R1&-jogo6q34WR*X%(JTa?h`EaFY+ny
z2VKUI_6Wv4N!h0*#HT^0Z%d6Nq1}i@_21}ZF9yCJ-YVr|bQ!>0_qOU=&V#=Od}up(
z9D=pDKL1j_KjeelAHAwK1BOpdrHv!n?~+;zGb|AXJ12+sU%K=XO+j}+d!tH$Yr#2W
z8y5x&S30VPx{S(b#T}|*l@WkJGX1h3L(w(~comN~I)qB)lpXxVOd02gv`x|tc3X1?
z=MYSFCbLz0Ria5wKBiM;B)pyESEk}G8n=-S-Ge*Y>co^m!GG%r=?;7q^%au;9C#FP
z`d*_bqT6hPte@DPW~gRR6OC*YD?bowbo-QbWG^U@Km@IVL6u|dK)w_Y;K`Bnnzi{p
zbI{Sz72zs3+h`%*T@Mz7Twl%wdM+omtuXt`m(XREf;e*9_{<#BMhszbCLa|`#?q=I
zEVWo=dR1RU!99nvTTI+!tPAN$LxK2O%u1|t_?Rq)on|G>flVg5;w4u=E9OR<S$O~X
zS~Wti!N|OC0fA{;raY4dowA}xz3QQ{UkgDBy)VXupwUqpjnLJ{c$bsJaD+5Wqp%8!
z<&es5a!93eXzyTdgoC_l#-Hfo^0^Da_Fz4~er&?0REdxjIi`m__;N9ME%5Ei%B;R*
zMsW@Jy#w*DU@<u`)hNvBa6H4na01AL1d^T3mj3hXT<9TUR1;~#sQuz>c{TV>1FebA
zsz8<~VM+a#`JorBJj!Opw<I0W?cLC6bCNrIHGC<OzA`t#FPl3;@A(Fk=W*01IR;e*
z>)sUT4oz+@u^WlsHIz)ovnsVXu<O@FOTTFm?rthM$~3<cyIkSry<P^mWQiPlz!}dQ
z;FQf*U>(6}8jF%9B6=b<lLNJF^~#GpoY|vPYhbb0j2rG9?7#_V@7tj6GV=^vp2w*C
zL3=-!8hMHmkm<=cO-?ht7AZeTu)j26$eW#P!d0Q&587-M=eh`i^o9H9!bIDzNvG?G
zB6iUvK!pN|G(BYSr9D1ttjL$pSHH`4qG<7GbTn`sz`EP(2QS&8`@9RO<ItJDB~{pN
zaf1B*eAQE49?{=^C$v+GyO!(bwwLLV5<4Z4NANQTr^F1dU2{-Rwx=B9h;=dFrF}tQ
z?MNnpPmBXv4cIP5kx|k7otLP9N&uZFBQ<N0A;%F*)pEWIf=x|W=;b&qyNgS)3rlmK
zfu)48T%~l8C%P=K{aEO%%>W50@AQGWY5z?YaX+4R2DTa~0^AFZjv3xx?a8P^(@nP~
z36&~2(5nPCc`R<k96+dHA?~mi)=1TbvGr9I3D)bxb$TE7@auX|wG_Bi<*_QY(IAR+
z)|!reC3eGbIZlpMG6{~JT49%G`dkxNV5*C0SJ)YEr^pxYpz!f72M>1!NK)DruK7a&
z!aWk+R8$oVk6`>fT|$_6M+(+7RWOf1C2XM@%Cd|Zs*X{#0%3aaJ5PLpP|op6I?*HC
zWlmbChfFd9*URU>RKzPGVl(O2uV2GsV@o)1@$SwAzq=Cn^|$B3Y_c5xZ9#wK=QBKq
zKwaa|4gK|79oJLHgU-J1v0I6pR@rLB^OO^-NJbCJiU%2-ha9<N@q|(swz!wMWStcF
z525q2Rj9zXNy#oB|I%86U+7p8+w~%6aS>WMLnUtKDn0#Sg8In-u6RNc9wJ7s!)ai5
z;BJ9jJJxSW=%(-$Gu#mGKwbK%LaWNsdqt)l)X{!4bA45~2iA8HnuPWyrzExsN*J;+
zu*n=csCWMY%V^Y>2!##n`m@L+9mFVq88lp#L7k+tXp}rvMgz-_M=3QFSlTsH&tOeh
zYFq(|Ju`>oDOUt>k3g?tpN_?|VNr(;^|VTpPKe8zvGCtoak8~=ip><X72#MnSM$NR
z7_PN_eA53+-DELE_8zakGgg)f*{YX!GE9FM6pd;dgJ|j`LY4ZJC-jD__l|<(%W|uI
z98PtN()^dMTe=n{!z5IjDD+EmEFkW{d|S+)@u^`~%&-m;zrorDGC2P3rKaim6_R`Q
zEP`;C(4c1$l!eU!=;wIL>IIpz*8b*fX2iNx6o|KWE1GnZeK;jydeW{?wNe-O`@EH$
z6Iy4<LO^^3!_}{;rO(_hN)?F|uo7{US|wi6HXfWGUO&)Ek0E)u^?wjU;>gD2x0Ne)
z&R;X4gt*wK8kD>(AQn$Zy)1V}rF<*xdY|T9#eOv-5V=?$mahQB-s#xUx>YLkKthj>
z>h|FzaS#ufUd?zGJYU!(Ap!Lo9W*%(FXcyz$1moEb-#0HPdZ2Y^E?E0%;+a=_$yF7
zBeA|4HX$CgE@V&Yar_ZDrWC+HBDxVyOo5$^dtZg!6KQWQ8(Zw$<?D#`qvuXH<UrR>
z4W=n0F>jwCnCCi6l4ThJ)z5T4@$Tlc?g!7E&G&6O9Q|on2GBMZ!ODY9r3-ND85D|z
z_AqJE`&Rf|iJ+-cXWxfOv$7RQRG1xCm4a{jSk=m~gw4EjrM-uwIij^QiR(ndo7vax
zpb8+|ux@Y~g8%jPw?NM)*-`9ZhGQHCTUJ~|H4gEvTpmN4`YJK+K1<s2mPmPSOh|B>
z5za!K6tkPf_>k6gF;905fv?etpKS%MW9$JQD7N6KEnelwPhk_=^QwQXi3E1Abv9k>
zHqaG4&ixxJ9F%2SZ_%A}pe>vXCB*YOf5;5DiBA9fCL%REDXXYB3htp#PUG?@FhDO8
zFaGiRdc;$e!JaBV3v_JyIa!1Bkr-u6`7?}`^PUgZ*;<rPMQ4pqtPdtV1X=2nnI!#`
z^<kZniwT0|vWv}^IxPu+Ufflm>*1U(KD5FJY_x1Iva7)?I@>+Tfi&HmW0OxGl7-X4
z@)$$0)|Drwxg@ell99)i>^B@nLnL=)DNPE)8y1Hs8aJeA3@B3V-2CroEDdb93BGD^
zyiWJ2V%V+_ukIr@N3T0iXz$r^6_8jjkEuY%q~1{+q73*@w51?$WCn&ek;WCh*1gY5
zl8{b`Ng0QAQkFd)Y+tT--7BFH|MwPOW^=!|t=X6vt+-T539->`6+v}wg6yyMuE|hA
zTMdrzIbCWLhZGJVBOTcae6yxiK3YiWEk*yQis12v*aFKDVP$OUM*cN!a;!<VW+7!{
zayPv(*5*@f)6D~}S7*-Tn40Brz50In)hXCjs&k=5?6@l5_a$!QFxRr9N>-hdQu&dM
zCR1oND@|ZlAba%$t`eouhQGQeQf^tyv??TffpBq<*EY%bFw5-TtHBrSHQ;42Enwi)
z+gl9n6wj9W$wa|BC5F6)Z&bj$Gx+FxmHw|EM;XFZ$spHlstUMz94EI-7+UkIal1l1
zxn~pCxZ4Mi%4|%*(@66KER1X|fz40W#a*8WRYA%2VxHcT!o&qQjuk<Iyyzy?hHHbT
z_c9w^^b1Iq-&yX0Qf*c`U|hNz-oG;~45uAw>eQE2xXoXhID#P{pOCP0@f{3*vU#E>
zUa84#B-H9M+>PvgOXF(r>OX?x*Raf}DR11cDc{YEp{Y@&DtfMiQ*JA5q+g^F;8v>^
znBM-XDv-UHIkcm#M6A4ipz`^fsp^t)@=*}l2{FTeNxU~9Xr1_^BzKROov$_eJwd<5
zIH5Q3mh3l%=MNixC}?P4ob-igMMZx+;c*v(lso@%_C>AH?Gba`N}r$GcHYlKw-I(d
zA`v&c29-`-Rz?G{N5uKvCzbJ_YC2RFtm|hQkP14C;U2q$W)nkbASG-WJ_P6e(z2=!
zekqBvWH8OB6FufhRVisgL@>+f9GWR5hEWE?f(1Rq09~JdraRW8ib}Z)B*@Wq8=_*s
zip9bZ>C{EX^u>m0A%NM+mHfCppJ54kp`E0Xc-e`_#;!}U7PH<fUz@nG8uRd$q)YzS
zQIJ)(Vl5IT>pYB>uVgLK;cb8hZZPPt2Le3&4}tS?l^}F%*A&`@W%O=M+W)v;uP~XX
z_rPHIFsp@%FB&zv@CeWHFaTjcbvRdQXkrqa#qCV0ki!R$j4aw>w_e2Ptf8U7=l8O!
zpdMdE2K{^t6a<JCAqC5ls=|;KivAM)-=zg%8VZfIWa&WFfU79{UD$ufR0Eo-rLw4~
zsGD^6W3w>d=eIr}S>Ey54BBoDh&s0Uy&B=@{%CbO{ZOO7i(UhKc$78u&83lLzg4$;
zoGX*!L?XJZj8)4)o0NrxRlXP<y?46^F_oblGb11h7dzNwGz1Az-lW$tILv&IIpTVs
zb=%_8{^TWBLEm!2=;uABy=ay&mMx~YXM3s=c|thnYvo_53b?fDHG_lUm9zJ`0O4+v
zYCe^dFB*YCt>5X9p?SXAf(ksnP}oPpqG8#_?LU8ZrqCW&faspU)fZ@9J#s&X-aD+o
ziCTar7A%tYk?TDJgY#8^E%)~~?D}0$PyjX>L~OKK#_;m;QkEgKez)9YjSGwNiQM<D
zN-6l3&%~Gl9{L=H*IwZL$;)#B__|v(LRqub;_GBqN0J*MkP%P5T4KA}%*4(<xLB<-
z)9z|*X~n^jM>sZ-$!Tb9O`8p|v$G42iAf$6>(-xz?!ZR4EBqoEMCHh^(g4Nhh!$8)
z1B6xPLP%N5(<;azy_hAPsUQha(LAT(QKoXk@45QXlPQ9dmq!t3Csjv7!}C%08sOo6
z?7~0UhO?Ted&Of$*NfTVtv({~cbsWUwFcWj!#>Sc2NJKllL%6=NJ$JsGqcb@7$j-s
ziSBbe6atQc7y{0nDcPyjmWWw*l4DX@v={iSo-fBACxd+9y1lR&YY7d23n|7jQQPwt
zxz^@ve74p$ySBeOmKqii@Scd@i`+njLoc&Htiyh@+vDk`+$Z8!s=Tr?##37xnSK1)
z#q${cv7{g*Nx;UT@MK6@R?)Z<I&(||mOxT!$O(aCT9e17$iX#5I*8_Lzc{i+C`y^=
zhxj2$YzUi3)Xx$E>9BQ!YUw;SuriO$7YckNa){5;;jfZS<&YSx8pMcTM4NZ@F6n8B
zJX|r$mSCaD+4SV2%1~6Zir@6i{3r?V+%`83_~hu)vT_swiUH8VFc>x*c`BdCF`Xb^
z<P(*p$dl5jg-G)Uf>jgXu_eI>96u6~F%Y?XEq^GYVa}lT6WxkFy49oS`9IpqXtyxg
zLTBzCEmTt5>FRp<C3Be0_}cMuF&+nR$ncmUWu-tW4Eu{yMd7f$ti-%;6!Wt&7A;-&
zXE~r^@h!-<e)j4YxZ*S>9HfYkx!{-=Rf-~^uu0&4%%;dFH%xxtF(}6lijdcyb#%mJ
zrvqgM41q@?DPpF#N<+&)w3Seyq2dp=+v>WJoi$F5U!i%QLtM{eqob2V+dZ%Ml;ec%
z@awG^7W3*XW=Mm>!i@WYt<<b5AYY!yU>DgQsu#+Fye?@`Ff$`8)ojLVpJVL@e!C#+
zoqVNTvLo5DE$CGDSq4bj5w=tYy@c*xyzXaoj3a!qjmbKVTGkc6QUMvUXSQ48DqqEW
zrlWga5=xDzp79i}v<cCJ)waqDLCofI8UN-CshE~Up^br<<XM)u`~a)wzXnqhe-9Du
zptGzBybTt|x5%VGVV^Y<hGIW*ww%aM7Uices}v`UNYP@h`<MZ(7Gx;5>|&u-q1wMF
z_$Df<+OBFr3yJLXyaur5=fMiK%7Z>P=D=Zv0x!19XL1ixO4+PPefdd?jRI^RpI2tT
z7p%ATK${6j9VU}uA6AwAwP0{I;?y*ILOdnpE8yje>vwqpecu>B%k`!QD^0Xl`{vg>
z$C6!8^mKGgo>wO2gBh>iYT&)AELzL-yLjGSt`(%3Y1Jx%`$CYm2O==9*u_Le>#czz
zER&3f2aoh3Ep1XtN^$)RS50?{5Q_#JTV}kKrLq1nRCFAi(A(oB<Fl8LG!|FN68TJu
z2WZ($0iA@TBX+>WPOk^LqtvSo>1bS78tz~IDW(Og68O0Yh{{P95jQlz3(n7zLFe_m
zVG}lBqXq3G23rPS31Ix4QEwl`jsE&x4dX+zp^7NWq2HZsbn+DitKW-95{;U4g|Tee
z>B$L`^&(wxXs8*t-NaUZSaFIK<t7pi-H)1H&9tlr+hqtua(g>GJly2(e@^}6kIV0$
z0kf&Em)pa;#VflTUEZ_)uqT2r9C#~0r_LQ2(Qa}5PM;7YbPb2Q&I5+KOHneKCs;n%
z(Y-Gd>8!Y+sKipHEnLTl-E6Ya>7d~m?!U}Z($Yig-l)Y>Ps%$@_9<ltnXR(287zb$
zh}bC%57_sP9M+2;N+)%{Ty~H6*8E;2Cq4R9P&--@4y|lT)%Xh+;rJ;#E30aj^flk}
z@v3-UFKb~zDv@$T1~`H4kblc&A>g!2>Rv0A&!%CF4;i_SCzJSnco+ePO7u&Hb?@o+
zIKiSJCE@k?eoRKJTm6rIXJ6NIoWs6d^lvE7n+I+jdTq*e+TkPELa*CTT;6A-XM!H%
zzOlc@eomg^y2Lg_>7p;wlL0p=adM{K6wt1F6AlgzKZqJq>H(8GwuFU_J|b^O7SwR|
z`{d2qts^Hq{8tM$5Q@~=dwIN`9ZU-ggTug7gF^(}W7h?6-`w6h?v3MnmWThkCv>Yb
zwy{B`rLAlXu*4G*61rjs9?A~l63Op%^J8*MyUD6pFYo#Bu{gU{wzXEbjWjtbJltmk
zJOq2Ujnh$@v96G<rMW$LvDIJ9Gx~`Ma-&O1O1i24PcHG@dK5A_Y>S@3p7aYgObtNy
zMHv+-o8@{jeHzj$-_Z3V#cFMKOHp69p3j+-A+9aeN`<h1TBFhvjR^OtW{Nl4TsZlY
zr8mCW<8ROnJ<Fe6m9<{4(rBU7XuTxgEh;Ly;~cEV8uN)=`lxpp^e1b9f8ORv<<1`=
zGxiw3CqGgnfu%+P2@wgVkS@_k1C?~ei@rVE#+H`UMXd(2m`+vEo#&{+!a_D;z7E&G
z1(d~4y(Kl7tmd&UZ@|jsx=X@;rH%n2s8lSCefaq^kBi01Z^_7)+a-fpmODM*1NWWr
zbWHENlXymKbo576!xmF8;634{%KhCxIjLGetvy+ZSQyJ-x0W`B07CAw3M{68StgYs
z`K?g1&M2gl+*p&7QtV!YBM|tndmN5eeCuj;WR60MiN(3OMD33quE&%pUnttwBYn!j
z+)i?`vPG7Unn<qd_c;yc2Y`0Wvs-VU?aDq0Q$k0Nk3%Jxj&9;=crIRMS4^aoD=Kep
zM93VfG#-wfy&gz|2Tn!-I2jA%=c%A|)}o0UG)yY_q_;xQoU+dW7B?yBGJVxxhU@Av
z&_uihqkqv5Dz}d33+Yu`pLS`fY&z*}5y<%63(y%?d$aU$)xL+spxY;n-@Cc<-&u(C
z4;4E)J15q7R;X9gOlVAaaaa;?xW(k>lZ;PHIG(L>0}=;3B-+0iIiF68U9z_7+WPt~
z1+XeRO&QUV1d8J4>V}MdHWHHei;Ii1gX*fPN&n7hF8DSLwBED)XliH}@Z$&CBgSbT
z!^`sP(#d0~LT<``j#(CK&dFC2f@*vM$2x;YLVEQIq;&vWE=lQma}Ynj9_I>$iiDJy
zYL*iOhYE~XFFzC&6;NBO(W71Wn+DoI)9JKBx^ir!#ddoqup*+PMFH(FU8%tcXngU1
z;=1K|e}w3l&Iu<-+)c)a{_kZ793~*_eF)ZSAgFn!I>T$Y$}ki&=ifiypKNsL?E0y@
zc|#|j09*V^2KY07$TxGFpZtrvH-H|zn!TaZ@6@#F(r<Gr?iAh8k+*Up{d4HOKd~y>
zsnTvuajVAyv{a7oLrmNx6?jA0pe)`L{*jRp-Ew((lb!s%D2Yy6US*Snc`IhV?-OzE
z_W@*glFt61?I@6?CO*_(+*oMOa;FW78RpsRP4M<3Y-x!(R7d?G-u`4Z?SGa(^AAt~
z=f-7t-^N06d4HdpTDAuOs#)qkHj(XVX?ULHC*3@Ed>kms>Ou0rg{*kF8e^P&=hNKW
zytZh`@dG3CFhGvc{qf4wvs}_`EU1fhdc+NJva8@c6^X!b^C!+WheX0CO+s|I0hCg+
zgHTe%=0|x3-|0eQ%rtB!kyV6_-l153!b@JBrP^TSTe_JlXHKr0+u_-M_Y1m&W{p|+
z;tI~7E@$GK!#T`mxyrmUPn{PRwyt53qkggr3(Zerv>ZY$`jfM9(Osw2O8Sg~((Hr*
zXpf3?mopu|XX==vU83>|#JrI;8<FBLmJ^n^8pn}LWycjeTyeSX4}&)NdGm$JS;`h%
zc_xQwTubG{hd%Hy+I|3L{dP4Y9aHx9+H%MXK6~kvEZ=h;@5Xc5>z5D15v(PzTmL)u
zD*@p6ua=!}kJJv|)HswWt#2{WN6rkL+Z%)?(vnPo47SXWb=ooQ?iSlsN?^+$`Lr4>
z;(-Q=adB~MUnm$)?qHi^TUuHkW~g{6w|H=FY~xCxmPq$btxwWVf~8|#FE{xYrmhE<
zT`er_Vi}O+f5evTPxM!Exlu#67?l2T-7#~aGx)HW_%}INXEaFUz}PbOrP!*#HFMEo
zxsyAC(>~zeOf{)n3~KciqE)-HY~GQ}Rs#G`5sBFCU$Mmp>ZRl^(bk4*-7fh4er6OI
z_!<HCdpGHrcCY-{3(mN~o?T`ZbIsVNVRs7!*j1~V`NDNR)ch9wIh7CBI>F;k!s*&j
z7x&ei;k+-H+KVRvxv@TN<rR?XZ&h~S0H`QzTFQywtDO<dM`hr$#NWpOz7k`?-`8{h
zSs0>cc3n|&-Y^uRL2*}h4vtAD#fB>AX8_yGKA!#l{RKsyg7k{}&(;=6wz-YpaTUhr
z&vY>kQ{wHoBcYzo*v{Fjg>6%?e6l_fdYE1X1%qgxee!rb)Yq1qER@>W+A9z^HU@sr
zk0iEU@gdX}aukRxKV4|M3ixL8de0QwVQVTpqGqfZoxiXX?cR(Q#60_)@Oa^cef-?_
z$UBAhT8ZmKupoNjkGf+$3e(}C_F&US!zeYlFhQocIE`_wz?YJ0DNWk9$6aXS%6Zax
zho}(8ARP56HqHOydShv#dsS=6o&!VBy4tKT;ChGw4S4*=9{^5xBsHw2jAUqW-W!hx
zl$J@)T9-F&hui5aBrrZ1)R4vFium{CIu4ISeJ3&O)uP`{2((#xyi}W-YDUDNz?)gB
z(Wq~}Pfp@AhXrxZi9ou%!O#5*qj$VY>JjCHdx<6bR{+s83P%_}D%OF3>78AdjiQ(W
z>g{KoEi*(k;t_P4(e1?JnPO3NtlBlKb-neO9)CeDSKFwHL79T(p9T&ZRzKwjt8EKG
z>JWH#oz=q4?{5d2tMBQpQbj-VEV+yy8TIwvJU<)gEk~Y-!zdMa5g=>V;VKl_cK-B_
zS~D~&i#ww4$j{}q?Vo_r%hV9tN=U(LxMn#O%L%4^7?~kD4Yd>b{KwJfkjn)qhTPAw
z<UCyq3trdIt5l~ygriy%IrNp-#szk3hVow`pC*J&918AZ5(DD0sy<*OoY)YW!+-6=
zA5V^oW14RQ^M#0#QzKt2q@<*OMzwMcba@4l7o!g-Z&HxFEm)J2U;0Cg#|(Nr0$N*f
zJzhDu_1x61K1N*DnymU~e>Z7XKH}~4y~L>9BroTqVy8&IlUVhpFi`mV)qeZ(3dVMO
zw^BB4-#XaWAc|N3P?Q4ZfaUa=0jH#XB;=9A4Krd;kGJRkSN$eAS0dL|$N}J@|Gr*4
z{%M9mXCQu^M5`g6F&aLxN&{$&f3K^$<!)czl}1az3eBEl|9jZS*?(VGbGrN^#>K-U
zecukCmT;3WK7IjWb~zp6H)dNn3k=|ED~3Q>WPH!^I7&%LiDt7+I-dPE!0c86RgnMw
z_m{>vZ)d0bC)yxB!?^(rTQB)R!L9pQabEe>PE4XM3B&skNt=v=*b)?7@X55T<??E(
zd!7HT=uM+##9lQa^INJ&D|V(M&CjHzI<CJ<q+D)xaeEV0Aj?&x!oTjw3Yb_yU%UFN
zUukDLN)WDgXhK<<v<o)V^b{9Q%x5I(s6F1%WwHseF4aA}{x<DQVSLUqocp{2f#kWL
zZ%9f#`UD9AHpDt2HdcJ8Mz2_B@)M_Bbc6ZSXzIVk`>X@k1K11CDcKA*srE8VvT3s%
zcZDfK+1xV+JzSwUB2bfr_xwqZx`1{a-z9q5bOqgw71!3%T>Ud-b8Q9A9*H%LjUdoi
zK`ORCwa`XiFA0nngjp9!)iZFXbP9q@6Z(ttNfWpndOnEXP`qy@?m(K_F^v;mDpc@>
zlU?@3x9spk55Qly5-ANvx?7X^f&1b9PWBu2tNO#CXjNzM)x$e4wX$f~w_`MHs!f$6
z*3Yk-@T%nySXNZQgk&ix;fJZhnXFjr;U@B;jW^861w!x_RZH*lc<22|sX2JHa%C9z
zGoKC1sDCa4IOUL#*X`%{I5M}>&i9@k!5o2NMnvH8<8812aI{P#B{izC37|1nASZP)
zn;%nYy^Ln)vuEJLMXsSr{U_bj&|;(-zLqz<z|O((Y5O^BPpP4ST<t)_A#A3DID#vT
zFOQ>?Y*VQ+PspvRCo%LhwL8{STW-J1qKW1St1~zPLd3}C%Pc}WZMuZl!OSeaIaeJ{
zz4{)y%wjsEu~ROgQVdO}rTI~z*{Q!%d~C(e-gu!<#>WblMiV`*cgSDpX$nuLV?4@u
zsvT3fJudPZ<C<+(rOCpg!e4$FHvE8wfyr0Q7p6Ao=JR{K)tD(15fvq01>{t+89uW#
zd7XDq+qy<~<i$t_umPg*%_W^8JN80lI%7zG6Do%Y4WeO9S3xg8(Z+ftxxsq0S;)<d
z$%9)_i%^%yKyANLiHEbS;0vBTW6ihSKkUptQ~Zxkqu1Mbs@kaRUi7JZZ*mGW8$-ie
zmkp`)+}~AlK-CJYX-)70_`8-9n07`XGGsfGhCv3&(9e@Omt|F(ACUTI$Lvl&$JBcz
zZ(Vygc8ccAt9C~E217I|1PRF3Hjp&NfWC?k<cFTfIJb5YdqTXk+Vf2a9brk?1^`eM
zCKdHNV5$QssRmVI0Q*Lcr818FN32aY|9OWThJ}9hH9sh1Qn0Q&-oAPIZljgNXvM13
zZN>tr!HW!+s0_cSVpbivV~NN&d+$7*>u#&8tZjtHrRXjWzB`$T72m5;NeIoK9>r`<
z{yO^}3ncomZr5MD$}~l}SoP`I82pACbE2F!og#CIQVqyHXZzfi=;wYz%hN--x*%Nl
zq2ASLmp;@h+bgd{j|^|OJVwfUZZ%iMDAqX5*VVGi2_?``>TI&M_H4Lp<5Y2hJnjU~
z^(xP$Yw;qz1C?32dUnKd2GZ@r{ZY^O*&it3UIZ<L+*|v81PJ0gW}gQK&xr6}aoNB`
z1#(InaZ@xU)Z@n%=Y4q(FRucPTK$9NhSF~r{lEYG2?V@V8CERQQlKC-Qp$JuZB9}+
zauk$WE-58Huv)a!_>4H07+D1Lg-(%__8ZoEi)|iGp(2%XE!>p-^XJcWu?+6v2j}gf
zm@DP@sYLf1V%BWy6CW=s#)N<R8wiB-nmkQqW~+>x&rX$Nm7maO+kYzJVi(g^AZ5mv
z&it`YFO18R->Rfw(<85ZCI9+ugG7s`bhF~*ueAhFvtKIj<HHAdB*oWO+*0lT)KUqU
z_z%Qg+>@XGWx0cs)W^qRc?nl(8J&j%yR%E}@@h7^)La}EMcMTCH#I&!78cOA#hde7
z^d~>{d;>wXwKY{o*9pnZZY`1ev;YBLmOm#|h`x6;T-=r=8jNa^>a5d+VKnO<m46P(
z@ZsRpPEOSh7wO6LIx2+qe*{csJEp^*&m+87tCYUY1N`vWpLxq90B5X$LCWm=oi)%;
zP$2;=%+}bu!18_s-oNHYut{(&Uhr)3$wh-QuGklx%xA4{wU>Ch%E+Oa9++cYEBPMF
z+7_D&=)impiTy=aMY`Otx^K9#8X9i-8idYR^h;>jgr8>`I-q#iYC`{D+cG_G5)>&#
zl5fq{lFj7Dpt^06l()OTBlEf+3|y~R=jd@ulSL_F6jRqSo5-MG#Gav<Vl;{k;~lE)
z`i|8((EN^<?WFVFjQ!5o*O9n>rUE(co!QFoi*6qeX0jK*s(c=Dg#(q&U%~3Ga$poA
zrAR<Uxq+MOL=;NXxg3uv{ZPRHS^*dqMyuHC-gn=-^jOm}Q$(KgHZQ)F2W-7{dxDwR
z0gTGwP{g=(#!qOtRL>E)_cf5x*nLdGK>p|BrrFQ@|3%wd0LArY+u}*^0Kq*#fJTD5
zTY|d;32wpN9fG^Ny99T4m*Cbo!QEZ|C;83%@4Wlo+<A59KB~IXRGl2Uzw^o7Yp=C-
zJaAIcc=;bKGh8ItDu^5IAGKN;tK+(0;AQF6AKQ&iaV*!6{S2<}>d}~s^-vcVo{mp4
zvfK+>CDD3QF0H4a1_OEWWncOchZs;Kd<m%KpZW1c<gtR{Twn|6PEt`2a+t(qI3yuh
zGXjLJQB2CTKkMoYUOv7?Bl~9A7okkb{x!~eLji}2l|--a+qX+2Md2`c{mp^UQ0y#m
z*+@z+FC3lL;8+}1$+#>5MI1&D$?Mlew-3dPPFBK?kBsXF#laB~lq)MZXXo<0Q(xjf
z`7nN-Tc>n#DrD6DPWkj;*t4t==kcUqZ95!TTukZyV9?V`imyuEHTrJmEtc@zP~6#e
z*rd>jaxfqhjC6e&5uR$AP4v7)kw1P8OIO^_9+Sy3fq0D6E(dkej-Z%1qME^zc1kw}
ztFW@@Xn%bdmQw3eJ;!{A(Ci0U*Lh13YAJ{7Cux#X8iu%_QZKYvH)~{R>Z4>Y&ab@s
zIwePpJNBH_g~V(~+5h3*szsu~7jAhm>mkwHDSOuGwwB4OEi$R6;;u@Fd51R5F|2q&
z`)qzrw5bJU7K3`N@|U-XOu%%(t+Tc}_Uuj1r}@kgd3iLgb(;aA_sv!!oHCYXi2QB3
ziVSWE*=iQV;dJ|9Zg*j_<@PY(y83u%ttyMT*R1AvoekePTwd&`%}w%Za=AY_8Buge
z<M&@@_~*olX>KxIbXxZs{d5Yb9#+@ZJ@nOZ+;TTx_0<!Eu-(NhhdKzy9}mCozMd(A
zNSm@B{@~e&`PJsW(M-d6ozCKO0%!bg`zGW{-)e`9bX~>SqA$z|L*ev;uLe4;W(#%%
zVaQ$d@05Cl{Lq1(F#7u&sJHxDT7*Cd(0j2{w7N%}ydf0bQx@fMvVxz;&X6;1!1lWy
z{;cjT)ne-)oB#kIoYo(SaVsmw+V?vKfwk@|Z+&qxXrx{a5%1eWe73-9N281cp_KN;
zM9e^}?+(L9cBlsvk9Zz2IGDSS&K)nO&<5T?RsM|ZnzQTOVUM~DIWsGp;OP594}Nz$
z>?Q%@$jp)$J6o<M#iCaQc{-wQXnuP<3t7YCT4!qqX#q+8Vdz7Y@OXzJk1(l<^41&W
zVuf0@@Uwy~L?Rk6#f(x6PSp$F>3>vyU2Ufg#l7d(cgUIsakn_bk>?z*(=?vcj&#em
zgt91U$cFZ$e)lY}7p_z-1G|b$(J@rs>Xq<_AI$jPq=td(J^8K)xcyvZ%5|j5T_{XA
zVf(cT;p>>5+sIEWp3gxolqp&MtAv3GaYjEEhZiSu(xFlf2|EsMQ@$R~!kOQfcbA5K
zA^sC_yZx$IY|ocW@&=$z62s9{D;t}x?f~)j^WYZ8zt{#e0R#n++K%z?4x(TV^#(hr
z9Xj>C+JpM`A?+++jK8e#aC^Z$x#+Er!hRsdY=>UR`7wo{E{+EOfj3&P-v9O6xVrB#
z{U0tJ_k1+Nm&comP~Lu(;?Mp3F5QnPQ;`Kb&NTG+*r$-dsdKoMJXwJ<Y(Zm(<g$m1
zJu(uV#uBdJHN>wi9@wXQaAxu+xaostNaZPNQk;bPP=SDLh|~VsIVX2}wl~d<I%mfz
zCg&OMUE3|8fq@-&7dvOtPtWR62+po2*ktU89id@zmr1<cbUq6?mEEZ75*hnggGd4>
z;CzI0^ztB!GJ@0V{Rru>;jZxpQq1GHWm+ru3)v*?04m6o^KCLE*P8FvubFDBta?A(
zdlN8sKph<@eK(HNyuHh9VPU&M@xWhr?e8a^qXD$WCgj<3JM>jGxE~PHa&sO=5K5dh
zC^x(G^3dU#KH<h5b`%sZT|1Lo)X@?l6ryAmqGRJMFxG-dGm|R~g)8D35fW4_h(K4L
zXTUn5f!6N6+fg`q*IC~R?|ripOZPkLLAk@#!K(e8+(OgoW3`sBsX93|xcwOD|8435
zXtq?~9d3J##Ht8+p3iN!fJL$|CN!C%>~wvIquC-I+jK$J+un1LU@3|}9UUF0T(bgn
ziaNXOH3bzR-p7g$YxVH-PZiXZCRkRNGKYMN$p!t|g6Gr%H{Otmao(UiCtN~XTbD-;
z;8UOAqiVKwR2RscaUYYe7%*lM+_*_f^DkYnx5(is(y%aS)~ysn#$CjlZzwJ?8P8wL
z&F`cd@Lg9BdICuy=y$1iIG#qX#mU;5uzkQWVX8nT$Hji$=rK<sp$|a%wj>03_5YfP
zrD@vz+zROh7sEi%3xpQ~uA4K(%2xSwHrJ%1E=qxcEiyn^n@CCsfQE%qxg4c`1CLL>
zPq$7N+fpqaX}lWg0|fw#@)t!qB+#v@Laq;huk(~VQKIP5sFce(Iyzppy53-7MG~LH
zdA>Yh0Vrm)>Xojp?q=Ta^z#HT@XGjHvA1f5Z$J3_wUdBMt4yu}&KT#R{`YN(iM1F!
zpYIA3yuh31T6$}5q6oQC*ev5m+XrLFhXD|i*$}8g3?$GIaylNT(&Pik#$9BE9MH*Q
zReJ8$Ll@Jp{5=tv@FVz=&E87pa^TA=8r-XnMTVMV5qQ=(m^*FPkx2^GLb7n@7-l5>
zH&Vlot=9Q^T#u6>J+W~1uj1}F^qiu+DYPo_)2pujj2X&ZvPzTP4~3w<sf3yaETv5e
zzhzf^!I!(LJ^kzBWhwx7ALIn;Au(;`iLoFugT$ZGK&r7b{o_kTb+thFdyd>s!*v$R
z!3lJV1+Osfs_t|ERc5sI1xT%t+8m#3(ZqY?d1Q$6Oo_Un9c}k(?3SumwxSyC#$-E0
zk~-5bB~=-s#UUE7{4hI@Oth&kHcx@4Av0BWfaa0dyMPH!`C=9t`0OkHDLsH}_CQr@
zVGF6IDxy*m7cVw2?CgD13Yt4y1@@TVbvm~g9eJMEww|v-s;w@yzj5sg|7A~e6O-WW
zk(7-Ik}c;^K|x0UK|8*t@7k+ha==1qfdg#l4umYt82)MPeSLkCNJ3|43)1Nn=ZzQc
z@T@#!XYShu5DzvqRxX0{sI9IYKLmwB_gG<1`iACkCb8Vbu`|7$Il$PM0{S`Yg{I#E
zQJWgI<yYPoyb;wDVVK7co3l8QrD^9)j$;;Kad%f>EAdyncGy+RMOI}!@)IOmik3y{
zuB>CxmK}g>Em9D+Mbn%9w)nF+1b1s+SBwgtnZ_bi)!)BRUJ#(fj?fQ!ypm5cLL!}b
zciy{t^)t&-7LU9|EEXc*m(c1cwsu*-5{FH;>}#Hy;z{%Zo+O2vUiO^Ng|Z{iV~K&)
zv>QGy9raE+H8plU030frDpq8<$Rd2yrC*tk6+}DeD9`8Wlt2;e4HcXTjW2;O0HHvs
zj+`$<scr6vs;o5|J)&9zLtG*R0gg5KPErP%w9r77&1O`xC!bfuGzVrq^KVFLzM{+o
zpVKaqa_af%VGCFi8FV^2I+J&O+g2DT6S2O&kng#jkbf6+fc)*-NrlBKn%Hb;XlU-)
z8{trFqCWV6{5uOMuEh8-#ExX>xbe(7n&apXgvQEPic$x<0Z4GR6)nB0sAkFy$$MGq
z=3Lx(0%LJaK~q%|D~X>zt5rtR5Qs*IkgU|=i|-609k7DTN_t&-M04+N{MDkojf}T)
ziNXDg3IbllTa{UaaI~gD1USA}$7$o0nMB-+jl|BNxJsqN@2?Z(2hrn->OY0@9Z-%o
z1wQCHx}%y2G-?B7UrHJKdVvdKmtCD@k=de=ra&ZzPZicg3MCdkJ0+4U-cK#crp$CE
z-W)t)Hc8)*Dn$5rAQ~!ms%Fi{G_iHmv3oCvJDR1<Z)Xc%pWw1EG&q<y#IyQ(d8j<j
zruc$oRy0zddH2nN3|vU*SL)d0m+%?#6~r1;?K&ms0EfVbnBSQcTUtW{yF#JtYk<Ns
zIsE|`W~M_Ce23A>c(dOq#|f!f=qq=3_r3KRF1SUY<^b%GRi<rfo%#Ad1RjVoB|q9(
zOu(0m-02w~F&1i8vJi_@*egIamnRWXm$(oo*&`}11@IWqD=D#l=D4V9V31e3UYNnf
zfX5{%Bo`w$odNj!5w&IS^m0sYO_9YeU@1vDJ&sL$uKhyvDoXL>6Sb?$)}N0PWji4i
zO}=hq#d|Lor$KibK;9C!m}^Wkm3g^8EuGr3Ffm(zaV%Bpt@%8~8q(mg_<daJoEQfn
z#zX-Q4)llco}0LSevngD+1mN>ueLVPy(yGd#4sJLRZKeWdu^dwMkCG6w+YK)xvc=X
zXa6?<yls1Ptg)AHy-;fkv@1I}|Ba0Q{xR=r@~I~L(VIxND&2NMyKd%;{I1Rd_CYnx
z%J3)q(%v#=sbrD1H6fp>G$Rd`S$*{V_^{=xgQ{Bke0#N@mKI(X`9eBo@-UvxQKytm
zfx}Q-75&P{W~{eKBFc6YMet9kEEP+$C^zoa$Y!&OOLO=kCdpzM*3ujPus4@^`g=F3
zd=-}A_kI_dzA8eYwMM~EN=k`}?YPOi7@xP!F&pT=2eGs&Y00Qpn+H4eQt37N;6<x9
z>jXLrA()?lVk{?w9;<;fZNL$QHMyaI{`a|%ti$uZC&CRlbhL>1dOjGQyH@IdmeLRQ
zEUwjNGne+}W<<W>=CQJfWJ`yP=8wp;kA>!NWm_VgAn-wEiWOsqt6~nEmt7)dXgTJB
z{2`f}q>Xk4%9DfOKC_{~8<!Lo|4wMpgw)~Ar<xEa29W}_7S;bs9cS0)n^>-j=@oLz
zd*)XtPu$3a{F8v5xHBH{y04Vi-Kuj2f9z2-8^Y~uyp)di<|g-O7=}Y4#>_>s-+HPS
z0|_RIf(pqXAA2oyIfSQzuk6O5>n^?3>PI;jYRf#M^PE*4rWqWkVeUiKyv?jhX(Zs0
zo5B58A+6@;#m-nB2e|i@A@RP>j(=QS9CH`<fdv(Dv__ZkgC+o=0R3GzNr_hlJODMi
z2!m<^2wW5P3X44%Q;25xSoFQru*!{<ajX?7I>2?zK|W-jkWMg#>z!5~qL7)$!{$)O
z@zbV~4XkAxvelL#@rx0p%Ap3ojqOzx0&H`p?BM=DsCP=$`ooxe!>+F$B7j^Z-E^)j
z3rNo=x#x7LVWSRFS>u%Q#N%>LN*s<Be(g@=od5YiPMz_YjCJO$r%CJ2e|&%aw1M~{
z9jIfbv^Br6+UP_44f6B@i#yQevw(nHz9bGhtvWWq?~4X18E$E*+|H<oxXh7l1w#pR
z5ouhG0Iut12>{z7M6-XBL!;caG}`XG`}y;ywuJ?)#w+0d!N8i38`biB@&h=7*-|O2
zPPeC7zfZ<tGD^y~00V&^IKgGJ1>s7*R(}4e`~(5avA@C}A;C5$uzOXhT75hvp6LW8
z${qOky}ki#n#soBKoN+HYzQD|v`GS_yiap8ZIc{{RLZnA{!x?Y-o$*;yan0?p?F~h
zpS+yV+200j%p|~UTn+H|ARu)OGjxh7s>DNONLGlDFc@JI+{3Kl;0p}7zI7Nn)d|dN
zx?tC)koV?|(niYDJ3H?YxR=ztixKrC?v$>Wey8~A)yt)r;3tJ_b6z4bcjj^UkNe(7
z8-DDnm{Y3|<ve1U?G4&U{BEnfPP<Dm))vR2dHq%=0a&fB68dLPqWOQuJwr@Xls|*l
zJ@;+B%azG*qDBBv%@(z>Vbln53cldqEcSm|?Q8PXYH^a&BnH~XUcj=N8}17(9WKAE
zJwM<lSH^$D6FujWYfHV3;p~Hn8Qv*yKj<v(=5I;kRx!s*Iu(OVdBXQ<r5PH3w(Y7C
zhFLPO)r+w+#WcIWNknOw%==h0`Jj|(!X$`9)M)U<!aY<wX0tm7zT|wzJKRDJ!4brO
zn0p?93S5qC`QAbvG2gC)Q@_+|SwyTN=-XWQZeRQsUAVP|sQA;5#}GKy2S++;`caV#
zA6m|tx?Vh1O6QDltC2JaPAEkBkuoHn05Kr`1P%sP-b=r3N)6<Pb##=w4hqOcpC=fS
za{+RI*(8Zb0hCW>&h;UiX|E$P&j(|^i$M<B?E|ihrI}>lnit0n;SWD6S<EC-GPAv2
zQzpiKj+o`K0xYy#Xw4I9ePswD@T8B{jMNckhEz7xGx@IPRXfX^7!)Yw;NkIM)&T3z
zsa2<TkFQ25_*+*9IvT||&*!I|eEZ%!4hYfy&N>0LP@K32Vh`miEvWhS_MN4#nvV4@
zG!2mtx7p`bF-%L07JCsU@>TWB?5~8ylYzTs5;g2iVtmpM&M9i+r98mN(!-}ZJlc`4
zp-DJI@RrKvAchrtI{Kw=;%n2FhcdnbcP0R^(iM<!g3;SQ!PZv#n!^diPBHO^aF$xN
zl*6nr?rp<4G#WG<6@b<S#re3{EA)rFj}Ag|y=cKYa%kq4A=%mK1SYsidS;6jfqOFj
zTO*svgLN?BHHAJ+e(*W^5T@L_Q}_pXN<z!TLbB~{Qjbf$I46^kDbFtNIy3^_C4TLM
z+<J?bW5`04y0`His@HzccKmb2!%esC!!@>I7JAVnugSi0N0mbw@<w#fH^ATn1>hw*
zo$3Bq=iuNFyO{Z1y8<Go{-tI|B!K>eej^X?)5d7PwMp7cUc>0_Vihs@(w&Q07KyTX
z#P_uo{c%y9HEETBRwhAB97e6F`jv%*gA_5BA3Fp04T4lBFYG5OYteLl3L;-2bq&}+
zPdW@M90d0tviBi%TiS~gBgG}fn}t64h((fz_4>528p%a|QzB0Q0jO<QKhw_kfXo37
z&P)ekI;iDKKCyEk9)P?CT-#Gu_Q!0-*V+t2HFGX{(vsXdT6N-~-YI18Vk<Ny*1T-f
zq=`m~4M0Ha*6QQiQ5$}emyzdk!`5uD_sWrbZOkK4r}@EjL<!cx0`*WA+iVJvYPSJ?
zb0B~-PL+5mCD*wy8^e`;RCSJ@AuY8~@ds4d{giD#<hn<_fl>Sym^+Et?x5G86Umw_
zZ}Yxz7OJ-cP+T2ImCK7=l?qUhs`h;Xv*vEHo`>}m5pHI!>v5-sgs29_?+#ysX9~G(
zD$kdMv6t((q95JP@|9iLcbSYwp;8R4L9?LEr$dIG5{kGj{?fNffyZO2^~=^p`ZS3<
z2K|w7+O8jZe?Z)$=ilUihcj5@gy6lrS3hFNkwkH^U_daRMLfBW@%`(Oc0-d+&HzsM
z9JauD_2*}v#EjSenuNYtv_!EOv#YBMpyCNCTnIsOiKs}{ocOixrY-@xnr1c!yAxQ$
zsg@c`AcH4{a~KNzl=!6>{qj6o9fJlg!C#6YPf?Fq?@fI1d&~>SW-F5S@VMj$w7kv;
z(luqm>py&=^|^j^<_?0qdB&F_ztIKodTaQ<=`5jQKOiRX<rx_<emTc9BfBJds+h0B
zrKHa?TqLvE$NYqtgStC24xR9o>e^@q^Dq@7W&Lvpth2I>=c7tH@nxZUy$KBWTjEZF
zV;??h)5(WOh(?<&fs3LmhT)+%_`ysJ(_V_jD@EQKk*(x=4|9Wtfth8X@NV=Qy{Xks
z+C=Tby7agH*oISBC%IQ~kN_#5q~^$%kITMGTDV^tywXHO4Q3RAcj(Y=IW&iN%*mz@
zud*=tiV9)E(kJPn;b+|X9t8IM0p}o1IahAx=SomA%+64V6d%v_$%4`noC`l#L4NF5
z!%wo;A8!MmNzp_StIiI&<(AUu5j&-0Ee>oE&j{h18Di_H<t-rv+_C?xvjHR&)+<c3
z^q1!c8K6RbzIU-X7{gpyrc|1oD5D{$SJlk}UIBpzzw~XaDwPa7yqhjJ4lzYDe8W_*
z7H;awY@i$0OdO8{y9w){=UZ{S9IYMEjgzu4o^zF?y_&&)5PsdY$ylPu1(U35Ct^l_
zkj)GCLqL5^Z%8#tp9Wkn65fmFDU*79;&s5=9myPCn>ocQ@}MJz$fHU}*QCO^Hc#Pz
z#I{3Vw#R$a36?AO2HiHzn4P-WAzRoPdqW@I+M8-e(1~3(REl05dadO98K-a>&BQ~>
z=Rt8{*_~s0$tXw5ytH8}M;|pK-$w_MSC(x?GrQ`DKzyMb3)`Mq{FQEp<b+IcZT7KN
z`v6;^KfDdpB(Hpa(+HCSIkSoZFPYeKkgc~o>ckOy%>jllP*eJ(sY+LGtpB+28MTBA
z?5|jI%1;E=bU(8dV*0`M9R$`~aT1xdu<YSI`HVe1iSn@|q%i_3-QF}j-q}|CVOYI_
z=d>z>lyb^+SUHz@)`674;KsB0rsI+E(4E@%HR4`l30|YoUvb!(4L}XDI|QScdDyd#
z#{pc+S)l~?l|w#L$NRCDqs4k4@*>WlHQTi8<xh=|k8g0ht8xnp6rH_G^>%MnW}5yf
zavonyc8#Enap(wYLmS%6a>we;d<SvrFodpsDEl~{|Bez}cZ+jCE*Hd2v)Iv|kHa$>
zp^3kA>MwRNt*uUM9oJ-pW%OO|6R6dulXt$XY1&)8Di-mW@sq)gP6V#E&k@b|P$FFV
zJDaEmdyDDUw)-jL8}E(OmvPyI$D4BASPhhMxFn`@h)$>`lfal4<K~0ef61+hCW*#q
zi`ZLuzco{fOCge<@Rss!t<`k?k*8d5<I1g@69NOZW><i@TS8}QJsKy1MPs6(tLhU>
zKbixPBR^v8x2!yJJVT%za4%VLf#H|I1ILPX^8FK7Az;vspr&w{;09td8h<UoRzs~j
zFO~=)mv)wOAfq3fK#Fs%ihR)ad;1~5;VZhs`ocGQ*Q(-b>&f-W+BdaAB6X7W?0pMS
zzR(E5j6nyfL!`3F;SuI@Jry8mwmM&~1MA3cSTs&{qPQ^r;~Bz5y!e>ekGV_UM_b-3
z7*ct(TP)O^F&~DZxg;Epyk@S7GSeUHUi*9&KD96i%5o`z;v(dnt@y-^w!_P6rR%N1
zPq@LwF?`&4yh>>40-V2bjD_-|D=rx%<omHd!V%M4h!r);{IrLmA3w@<AvD@-f0lNs
zhJ53-=1S^V#!V5~{^9%pGqYdogo~~}L2w7+m$?L<)8f7O=1`K_eaXDxD6i`Z=bO&{
zY`65S;o@Npk=JT$j_FGk6-Ly8>YGe(b*VuyugONgIFa~HwUJfp`wn@iz*o1V)+#Z5
zG}LIF*JI^R*1fd4e$Psei+3yOjBd>en_R=ws9q38ApP<#pRo?9ZUxLxlUh19o3mvM
zSWtaz*{#%#WQJ}&QN>-843az4G-LH-4XQoo2Ad%>8>8E}lyJK=T)rp!Rg&711jj;!
z_i1=i7`4ErF6@JI5}-?(4W<s`FN-|*Zud38y7yw9XQ71J9Nn6uB-A_v(JUV{S9Mpu
zN2fL#U#Vo=3%hQXl<|01k{b45boMI8W^1CSb?e|>Ht8I2IfG}R(W99hA_=V4Hzo<6
z(wmi1KYKrGuAU5&B3r`8Z%$x#ZOO_{ttO+IFw{e_UgZ3A&*I*xHtq=vRpE3@3F><T
zXLo2x0Pn$0pfByF)Z_LF>9%FI=Lu<3Q&`iudl_j{T3FMh`v_@MiIZ+6Ace3a%x--p
z;DB&|1!rtEpqOv~17~a{VHauRqlR)jn;fCA*(MC?*)z9}`u!`~HogcPEM9M`Bj?<o
zcSvig4%{H!SdIs;)QO)E1O<HGza%$~Z2;HDv)nL}TtdJOCO0Qp6WbDuJCwh73OlZ|
zm=yZ<q1g)SPUk`e>cKV>*$isPW<(ZKPdFJcGavCO1^yk5I{u;bS)~kvqDK_~6y-3@
zppvAf;>ZR;T|=T8T{E%+wQus|I!S@98d=n{lt4>{&%m`ZV|n~Uvv1L>QprYaRFs5O
zDsYUa>;~lqY?7IW^Hl#Nkm=bHuyrQC(bLvfTqzdcUfX#+e^5NlvEj4T{MOrwv__l3
zF12*WZ(+FE$hvgTZ(*>R#JY6LUsiB&dCzs!c>P*kiu~HW;oM7b*y)^C{h2@e8@C6L
z<%f!(5O(AtZT#v*+U$Bj>xO-KHQLUHguTP-UA<tdmBd8YVSLo!$SD-}g>XP@WN8cK
z`n9jg_PdBkq)oxurP0t0!j8(4#yA`i7TXOgRGXcjJ^*!k9e_vAshFY&Y5pe30~FC?
z=|IN<C`QqECLgNVw@z<L;iB~k)PE@XlaDR%S5ZTzK*(gWd;;F6A%=6CLMUglbVeDP
zuMJhR77kXk!gh{AhD%-mLMJHDuu5l~DfFMKQ!&&V4Xk`s@d3T6&6ZHFc--k&I}9?4
zJ$}8#s)%lOqQ|+&|8GhM-=_Tk=&vhw@&*>};!XB`6WmnnY0V5_j3OldyQLV-ttOGm
zC_>p+sx`P8GSPTvE8wA~17C5l3fb%(x7RG>?>8*$=Ou{hz%L@{wO&+X3z=kN3xM_v
zjh%6XM5FA>*(o=&E1VMn(Z(Rh8qkfAe0o2U+H~C(j<vb{{v*EY&p}6HeaXU;bjdvZ
zs;V0lGvE|o)Wp5yrEn5mY>_xmr3GI;r{>=5BQ&ojfxhCT^P75q<FMUb%G7hkj=vv-
ze9-N|P$y33b|!0=N4s13?d|&~Z}&dIh~E0S7F_%0&wojRQ7(%61w4>QYWU9W4m2aF
z-*1$BNX8aAFpQ+EHdXK%fG=VKya2cVPg1!|K0)@9yY7#4R`k?jEy0s76NfLx{&Iep
zyL-<};rQZR0-W!Fq4}UP+p~jw2t$rmVQyuJPP>YR_blEO^W{ek9qRZ~0)4kVw(uBx
zKryKOrUv=2S*PR4N11-MPI$pJQ~XnG=`4Os{3@}Ir-;o6<THnoqosGW{m%L=+`^b4
z>LFKF$5AQQM3Wm-4T0OMIbds|!~*DhZ2;8q*SGAvc{^xhVAZSo`p=~L=|eR$bP9YE
z(RjdH>aU09r(OJKI=-zT`}3fjXQ5eu7vSmH5w(X9>BP(HiZ_+4<ZC_U$8L)m*!m$L
z448WitO&b4!Xy29C$I0#_P!pc>Gt;vL&<d2`cyVFoG=i-YwKH{QV?ELh%<3nH6pwb
zK(k7kZ9cW6rX`f>;UR0W>1?wlCXjnbCr%!kf=nK=#1HGvb04$z394y%+>Y95u=_yZ
zD3)!B?-35~n(^ztk}Z%IIp6>^aDy?%cMjQp*O;vy_k6n=zXNI>?7<T}cK0sqwp3KD
zKJf=_EO-?(+^$kBSW?oKX@v{lEB@l$piCEhBePq}YjA?rsd_0RN%%%@qwRLJOt2>v
z(&FhE4>$2^hvzSIm$Z|~&HMXLoNYYT4SkRtQt4>cNh>}QFRh)W8#QGLqpDypE)lJb
zNxle_wg;Rt0x?oKna|Vh)`7f<qGKdUeDR?NFq$9EzaKU-R_3>hpjsJ^*{X8@mU%by
zCYIErM=st2Pht(-vuJ?!0`u?Yh?s8Wk<^CJ$|V@5kg8~)VeSU`QUn=bxqMTBWrg`O
zJyl@qaNh&Zr3{$fzo%rJp}A~~p*ga58r(i(8V)FO&hgM!;A(QbcnO7<gjIL-IAK!3
zAVQ4dgsN7aiKyN47S(%Et!ughb72wjyQz#NyJLkgoKMj%_cy|_NITvSa1k6S!Mik`
zU3mslu|?x=-@RM0a<mhgvLV%0cZYR2bPfTZ*57hjy%JZn?H}`OCHo{p>YV>X5b-%v
z2yxnKCA7GPXBO(g+K5?ruH26kA7X8y7w2f<UB~I5h?UVVg;*Bro*{EMC&4jys}FCh
zT>%lHH<VnR7ewlPc~6FC|Hev`)h%;b#H`P|4bIkWS5P+t`KtC#VP~O&`zs}L_ptr~
ztqo6zrtEKF{D-^<ph)e04M<Joh^`f4vpeycj~3terMav*5S*Ou5gl&Xvz;0{!IgAD
z-_m?JeCynI-$2h51>(BDM1{Y+3%Xp6R7lloM7Eb;=3hG(nXF{2Y-=({a#8%~Lrj{|
z*;Y-i-rSU_5>`Z^)%D(=<zBZpAIph<(W&8u(Z9wdLP>hj>I|DFVe^i_e4{5-tk6In
zH$Trb$AyQB-Qi03<hqXHO9k@2^JB<CKj0oJNcumsVLCCEjwUG>ADh;BAf$Lc{KQLr
zAwdrj3H>agCx8tUn!LV@t&s&?K}4^*_7fvdcOW#rjpwg5L6j@D!B;3(z+)+%6@u#i
zJpOSJ>E+=fjyd9H1m83J%N3>-jw7_=-WkNKuGD92v}@FU&vxGm2ul>(Q*Le=wJgQe
zw7_q=9?_ay_+x&G7jnZLZv?hiJ9t=6SmM&Oc<~f3hchn%V;Y84JCfG?mpgidw{#}W
zK1xqroCH)U*?w@_qgJ4sCwzI}LP0W4DdBRI+=YMS9>7t=4exG)=!lsrKTU~18=4^u
zTfR($J2`UiUo%KnZjzSEdo`qZ0@dCjb!!+P>7?R#9^fjIseF~c%lZguQAxW*zRNOM
zWgAkE>8oS-^XUreIG`ea-w^~JtE^I%NK_>7YJbr?fk3V_V4&Pn?*G0wcN(Y}bGTx0
zP131<%U1tcFF=Z2hH*r*d(dx6PN1Ck&GvE^{zAXG>dCLH6j%!_q^3Ccii?wPE@4&Y
zuAav}Qc1x^`|hx85e07ncsJ<pweSDl=}Qq*UHAL!PnV@Si_E<l%D1mzv<&I!tv|a(
zg)0IY{;59S5?i@XnS4#073w&Da1xIwe{4aw55v{@`Ld2oC?+qyKCIf5;mgz4ZYp4X
zxvE@aIa><MeI!Sb!C;;Wk2$p;rYv}YhbUr46IcC}rlttTQx7Pdbl4b($=cIHFwwjH
z6=gdxT`1q=P@tvA*G`G%zw612^7i72m?~7I2aW65J?b2?yi)d5@oDNUMXtF`2kkft
zd_l3@r!}ZI4#e!1UZXWdF<kBxt2mizAEV8H2?;i5(6?vbp05|mE5ox2uVt6G(P|eM
z_{onwaTcofgkD+m<XXcMgbdxhlMF}ib8Sn81Jiex<rZY|^>UF3^;zM^)xFMulw@5A
zbay_y)%n*VGmVAWBtItES}SY2_pWlNm##W+;A2xHffx^P4LJr<9^j~P`^DO<Pc)WV
z3CjaCg#<=I5XsOE`hulk%7_7TJ>}}`tw{yvGF^^0kzd8~XsFq3?&9`9fxk0|eps+U
zsnG>hT;Ha&M+VdjdCs?q!p-jxU(`K_=x#j#p56aQs8GnnPyD!R#{Hav?mOuh+*#5B
zwNO(hA`%pCq~6FKj8TI0VvJ=S(322GMqs=D(E|sJ0evSaS09AWS$pJfz*5vX-M|1X
z1>4OM-HGk2d=7Z#>Qo3JqBE6+v6jBq*3<Wshmw-bd3y7nJJlOp4R>oA3xi-kGM;J7
zW@ly`uzj`IS(ip5zQ^WulPl3M;+xXY<cy}OYz7@Mh-Ia=;_`HRXlu4R1D%HpC9(KL
z)UjuXgW`u_VAV{scI1w9DzEhCq2pmPx%P(>mD`#k!8sx_Bc5GC!3l@2^~YSGKBUiO
zx@N656f-u6ql~ZPS955h$YvS8&K<)%kgTmPp<W%$Z7j*v@xn32^&i4}+18%Z)7Se-
zQMuNbgE2?cF8LpzfvUa>`}4w!G%qsl;LCFeteHB_-DPo>3X?0CwOTlB2vPg1EYb}1
z&f35yRELG_ICCx?<sxF2uvTBLlDsGOpxerwuZ!jI2t}^i7o&nbzL9GgnR6G8u=mr(
z-!YGyt&+kI>Ly<q0nX)PDUo*+dh&!DNPKY#ZhZeUp;9L8bP|z0noM5%U<1ZEG@A_l
zO7y^lDOscbL2ej2?I4qBtNslxx#+<Pv9mk><imFwz8?s!;Zrrs6`&>V(YhoGF<LZx
zAPc<#2d-uXH8@ifut|d^^vJpgYdqczQkp8pTa$xO*usaQ$zz7VtFoLcdWYE2TM_z8
zBol2C4^1A-Ug<H^rmguKdNikO^)EgISEUn76p(Xym?m}R95pX^B75xfwg9C>weJ@@
z{uIi>3j^zSTr>ly64EDpi^;k&{A@jT;S(*RB4+IQD-tndh?Hdxf{1E0Vr#oOD&r6A
zv-+thZEn0p=s#ZFB(ddvnm!iwP8D5rk$A}VEQks{2tcz6%T;kkKT8oYT85}uCAoYa
z7)E#F>Gbe=!F(66Q#0ap|E{6dlyQOiAf$And~5jQiEgE7HiY=*2+YRhmRzN-b1XeY
z@cN9)dOcI+B<0vxnLs~duUx?oQruWNzp5Ekogpv0hWi^kW(qx6A5?wWEL|am676?6
z-gy&~w)hsUQR$SVTW4^PwS|!G?q7hC|0mV@)JB}QJEK8Eqs3<*gz8p~TB|2Yiim7B
z2Yf!eVCeAK@mRFyL7fn+C49f8Q0PG3-l7`!pv+V^X2OoI;U6#mB^t}4G1MJdYgKRC
zd0)|gxyw6?xEJ1$K{tr$u?1B5fJmDQ$k8+af>0X}R{ytCK>eUm?@Q;3EsDWQ*DT^W
zH+0=nZ}sd|c+#v<1moOOS=2NpB>H+Gn$0Xzr0#oyuNAERn)TURsuJk(X>dhA!mWFG
ziV&$C&>}Pt9cN`U`Kosp46comK9)C{G(ewyI$@xZiBrv(5yLWLnf{jCKZksnn@DmB
zm{YbIq;)hq)>mYvkeXbndT|Y&W8{K14u^m?U^P8U8xfoOv9Ss4t)__iFD*zB(YwiK
zlbkg}I<Fqqo(@sv0j(eWcts*kGCN`)*gA*a8$@o@V-!kw6vC<>l2bKC=M+V$r4lvm
z=;V9?UAEj1G%%h9YgZEXD3qeRmvni&X5GJ?ZFbg#?YNfJvPpU!S|g0|)Q64C4y`9V
z>0zWrA`<Z_($FxLr6?kEWI}dDao^|3s=hG5V(NyN=#FR>iX*$V-$p$mq5L$C(SI{K
z&GMkx0pqtZXFsNy%j5V2ijuJKCB7^|7Wo)ZPH@}!Hv;YVN!w=t)yYS52WLKTmx27t
zs!Rz6a6c&JG92|rCI4E7DeI_HKHbze$7xRe7^YBvrSNIxL|~+MV<Oc>hz!3vNLrd}
z(RhYty)U9;BH1v9W4;U69%g+h!ca;Li%A%aPDPF|9Mg>Qj=4<N3d8KB>OQ!ks`AUN
zR%VOf$I0<eY$1OuqeuAbxz)8nWXTiRr(cF(<7{e9G+OOsWZ70*rH(=zjM!HdS6tyX
zuli^YSU)6h!$Lq%QFA@W*AWYmfv=EL$-og6D?ez(ncw^9-4OgbgP8X?UT&7b`gM6b
z@ukJ-3iD*sRKnR2Z}^^BFmJRI*7F&)Kndv+JQdp`%9(mwS3fxm3x=4O7(fL?)Ya2N
z!NBkXgvHtb_3d`AAY)+1KL-$k)3dVrqlo#oweg<sjL~U??2N?0GnJN}c@KhQ%&Osk
z$Hbn{ogN~-^WcuIaoHjycud;PyaCf_z_1?Et@+=4PEYW4sN6ul6unilHpBwty|^D#
zM&FjHGqHaz9i7`JPCvgz&qvq~%e*2##XP%p)peXcW`CzsDW3d9{HD5Tj^Cqu;WV+~
zmFa9r&*k?r3gd6V(o>ESG_&PhbD4hD`c4+X@jL;f4AAZ2``;ghw|940P==Mu`u4X%
z=qH-dB&CYF?G+Q%x3%<MYE~#TOWwctAL}TZDXz48{?<@m9O~U@7ujq@Rni!_QuDa|
z6E&7f9i1hWe0?k@%1LND)$NAQX_~?-dwUj}RgXxiT+<Ijf-K82M3ugH^E=|Nz4gcK
zdrgGO<5%sZ{bytx(CtXJUMVk_Jp&2FJM-0s4S;9oXc|`lz<to2$QDZEc4p*Qg0%_q
zFj{TnF_|k118i#~<|f|0t=iiiiWl;MM$ENOO-;?c0+jG!02e4nw>Nmw_VV&_GJUE{
zgA2GC2Jn;cZf)f$nkxx<<M;N5nevC*l?gW5@Z{Qk?SXOrRBrcALIA=H-=^_z?1C&&
zqX<M`RsO0!@Yi3-@E=S}q;TdA6PiOp%*{{jmm!J^F~SbrO1G)d1rsUhGXwFM@5c5N
zq;rtG{L1=Xsc7n3_|BlI9c$8UmX#llhy^VYf!$Zt1t_?v!PQvh>tft{jzhM-89aUx
zNa*-u`eGhuudrl%*X*XvTNF6M9fQWKNY~#>`}(d;?-e^?W`MNLb#!P(nwpxTk#F{<
zU`pU`qDduAA5Pjg+Fzc#0d92OtPOxe=Ox#wQjv3T-~hB$@+P~zHv-P4>cH?<YInXd
zTdYG=Qc{vvS*$a+2E>?m)r|h;Hwz;V4GtUW{HM#dcSAISf*Q(ECi;om?JjxD(mhxJ
zzSr6RsVWsmy;A8fK<Z*myq59LwALpAzyAwrBm$fK0jB`m@ejP1Ui(Q3c)>c5S$#_m
zKsKZK+r<BK^<S%jWP0BX9sr7-ov-#Wwnu>;V$F^uyqdFbJ)iFFYmBFao3;&TW&y2a
z+z<;XV1S@pwj8~=uI>~INT&dIoMB~)b^De{*dQ%>0Qe+?`F9{DV*(&1`~HoCs=;RD
zFF>l=n`#arT(%f+=UPOF*#Ica5;v-*LjW^xqQ%*EPc_9Jr``D?-)-<Apw_4z4c3Fc
z%>g)ldEfo_(L67bDQ=+q$Lm2GC9AFE&Og}SpI!ZZmXZjp!}S>8_F}a;fYQ*|NMyOv
zG7v=q6AUQIfzlB)!!UJ8Z<A06<|GU2!Q0WM*x!yMu0T|I%l>bygZ~N;23m+v0mh;1
zuGiGUVYsBro+D)u^V;9cGOM&a?)-SsMj)t#L_`XLYQw^$;%~kJpXZOAjoW+Ba8f65
zDE+}@8Ij5qsJa0F>4OTU_lOtyc=GQzrO<yc+VSMIfofK(Efu_J04wy>Hhd$J?+l0o
z-~4Se{d4u-H`8$B!^0TsjXtrtZnM~v-ViK_<&M?XFG-tJ!xfkZ0NG1yQTs-<TCVfA
zLCq5oG5zZgqI7!b&rAZZImy5+7ied2x|!tU5*D7aMicWv$HTKT|0Xq@<`-|IU`y`C
z_S;%c&@j-w<L_V?a7F`=3%qFjpK0_L82o2$!PfrvGk#KUbx}<A4$+Ws+#UZ^1B{NF
z;lFrTK23iRZP47DSKv&JEVu$w*wW3L%}(m~V4AEy#-<axo})i<HIf*0LUHHz%goG1
z0iTnw)1V*o>fvn-BXw}<<#K+`6lyhF?}uyLTL9bpgNy&)4enS5li}!Z-SR*NAD^3>
zTdu`g1~FiCCuUj+m|r{>b`Ar?x+=?my#h!zm!Q}8+&zU~JcQpoUB5nE$35}^#nVJ^
zxZ}IBW(eOl)>kPRt)Jxuu-BYnfBw9F#!d_k!;0S#j|fv?`J%^7Ht0T@?ix4SjP1k2
zB$6GjBUIz4<<D2A(Qh8T1g1KCBEAcE3a{ph&^=gizkP^+74#z~2^XtU&rPaX<#d5-
zuAjW1?Ik*l=mu9^YaN0s@M2t;1)`$y>8(47eBZly2PDjU1nthT-^_hHRBy&on>*?*
zlbUGoV1OFibwc-kVh`3NJR)aZ$Dloa+dIorv$74Vp7q3+r}w3#yY6Op{Yxs?4pL2d
zu+E-_8%~C9ic=i*$@lu{9{MPyZj7LM?lij9g9wZx_ZMyolv|Sjq3QyhFn}%I-o@>i
z9<^E>0*mQvY?<Y79900I6D6Ugm2T@R7!1W>THD<%ys}dRXeg@&|9Q-F!~T~VLMCWx
zsA6`nU}sdf#U1N*B)B6)4XLuk6>s{W0o#z4enS7@P4=wR_aD}1lHf<kGtgRz;{Ee4
zz6nJc7|wi*@s*F*Av@+h!D1T|`I2(zX1jiA{itWbkoUhD@xa^*c#2oU*+LONzP8@K
zv52hU<#LDiS)BFywDk^~(*b{$`Vn7(OiH*OS5dZX{@Z)r5y6Dn<|Oa#FArHpD0;D$
zEUz{Sp1o%-JiCkT@aU(@P~Ilhe18G2R=Un<pdRi3$~U}S9F;EHP0AA03b^9!(*DBq
zQdz+Q1ob|@HQu0;YNHRw>+aO{_5K#mj1_qFgvD59JxiSsvV)nR5@_?@I10||NMr;H
z1sqZ;2jTG^#K~(+K$KRuHJsyrM4kHKql>uilP~btZsBh2jC|e+Ja;|~(^XjeB5`uk
z34&Ez+C`@uQPVK~fZp7uKFPof`A{+vz6R(&`p>rN>jJnG#^L#S94L59!O>KX2|$SR
zp55xz;NakIFDXDHL;WvKtbq@6hhJl?TqY<KSSvdx-OH_Q4;Yy#W)L*_G`hZ!O~}L7
zNOm=PyBpyx;KhGVfHOpPC6qrng?FJFqrnRq5|(1vyTNve5d9Xk=;|SqB7Ze*xv#?A
z^tz?-`F)C;YbJ#|`QE1Xa`V(6(bGuSe%k|bx2msL1(KAtj}8OX&lQvatP%{)<nRNN
zHx7`T9hvfckDstA%5!bjdczz+NcEM5Gbf2WF0}cfsR#l01~nsY6^GRXC<$LBF1S)v
zFhhemF@7<zp+;CngG4Hob``k8okF;FP)~0sZA)${l{m@lgR|65t$QK^hgGZgcmh5A
zwYbf+)kk3330=HwCA{St%Sa5K9S9?gdCEi$|2hx;qh=Qi;-vaNj=l-w2w<=n5Fl0?
z6%}>aYHDE-&SAT~1{~Vwf3!XsfQiOGjTBCOwQUDJfFTDDHX@&Pzl^<EHdODb9tgpn
zXu{dQUim&i6->K=3%M8w>AG&r-3ZgDU9k2udZN(C%x^G-P~0Ys7JN0~xz8b1v0>TP
z75@F0p7p>>s(-`l>--1(Af)fH{g-|iBA$EJ)NpjBoxIGw7`<1`8#_LhXOF=p2TstP
zZNhI{4_~DYrDR4w**)IfAgXh^;h_-GS@T^|+$+!vEo&ZtIz5E?k<Si3GY{##OMolL
zd+5^30YAJ|e>xzPJW~zTa6Qr4Sd*qum`7X`SeZzH0xd;Fy%*>go$C?1TtL_8A=Jvh
zA*Dut+GpiA9ph=RKjX#Zy5iqBmOvIhN5{KMF9rXnnJyc>Tk;S4(|=Tj3kR8z0AUjr
zYsXg;lcL8cfPM8xiS=K{iryn1vfP}HKGuc55BtRHxxpHAe%G5L*PhSkkm?kYFxe(r
zF&FCRB?l4upaJyF1A$@cJDR?V*%5e(3suO_5%`_ENHG{sLAY4{Nd0y_SlPY1+`w#S
zvnjIIgl2t9e0p#4-XRq471LAp_!QkcJpnXqyrizeuR5_tEYPmu<O9ut<Qp9zL+k_l
zUVjJ>81(eEbA`8s>5{5R`v3(n$J1;HYkYSVsa8*ckZYct-JoNQP8FHZ_Hv%>H6^az
z&~ZFL7EmzfY0`@@%}NveMkv&1wZ^lRc;HJW*}WvUKi8p%f8kd%-1X2ZC_6a?kI>$*
zV1e>XxP6Djpr`&-;`koUYf3BA{&J(mHooo0XJi=}5pD1O50F3kBCr?Unf}@qw^RDh
zMPAzRe>@@n;|ct(%L4~Vw{Mb^GmGuEq_N#G7M<q6U+y7y|02fuq)}4)X~mo7(`S6o
zgxuKc6joJsxFae`SFv*P($G?gt@0CkFU9oe5d89zM?`>)T$TNZQ#uB%;@TZQv5Hlb
zes8osX`56stX4iXG~Z?seOlcgjM6pFZwR_FdvaPQ<w*#-x4p(SS~fJ(n8jDe?FoI3
zHj_A5&7Kn&&R`;nr;F*-glQ#E?Yr((ZJ(NztI;(5PW8XVeBRN5hJODndw>Nr4B~YF
z9sF{C2LA4RO8_XZk5}jjNG8(1-WkilqM80JwP5)#*8JZK(23N;a+pS8xnftYpVuFr
zFSI>BNR}vqR3-j7YXE3Xf%!Mo<xed8SI~}PV(-D+DJ>}}`1LFH{q<1@U>ipQ#7Xq@
z^xqQ_5|}BHj7kAlmqCkv5$^pvWQ{aJsR}kT@b`SF6mgnaK#lp^SqX^0e>-pd>#+B~
z7k`i5kb!}mq!UoDZvEC+{ND!I|INQvPYniKZG`}RtX;X?5Ba=Y(?LM%+&wxf-RA#$
zBdP~Po!${X-#C~WbW6Yg$rQFb<4p9O0Nw;>m@iwKuQ|#)kgr}h@x%z>EY(}FU6^>A
zvrxV5-Cqoa?O~5k5Bi=P7NB42@$K}DFZ7V*+(BFuC8@c$A@HoOPiAY3*Oo3}ScG~9
z-a@B1^e}2K9@KHx0P`ez3kmB`fm3=OT~{Vs{_OM+-z=RQZe^vo@?n+T_~mm2%ipLc
zKz6|L4@m-$YhC~?8URD$O1C?k8p~Azzza3L48OFrlmYMyRd04c1oEvv9;bqB8UNLz
zeEtRbK!$9q&9s0qmB*P5!SN&g0No^Hevx3Dq3UDpW|w5e$7;>xtb3XMXGx;T9$QvU
z2UQMt;mebL@^GR|A={d(1#dM_P0-DX?kc-wZ06Ac2TlJL#Tu0P3n|`RN?4oJq8!#?
zf$}Ha(K-pygK=vrnuJXI+@o<9vm(0d#4s?;qQQOOy4m!3!|qoz{B7TJ%oVWPVVIfp
zaiQQ6H;&I~H<HzcTXvCXHR0>c{!{P39CJ~U@EGdix2%A1s8s5az&pH;-0^i$b)))}
z?aAMtrryXl*YOy<pimvX4Cd80csvq}61w=N{1U6OpV~~W8{Y2EH?KUZ-0K9pEfz7-
zpgGh%epC}4a~>i<8{6gakQ{a<PQy|E4^~MgXhP*52LFG}(B?HN1OP!#)@P_a&Psl-
zH`pvD=+YUyG>A%Mz=m>80!VJwHUK>1|HL^uM<NAFhURpk$d)tDoapYdlR}cmhku^o
z2F-6j-$r~R3$N9cKurr~3USXn@uH;Z+qe~Sq2+nmire{mVn`D=XQSy=I52lRlT&xe
z9>y(vs^$q5Kz=&_*}Osj^X9@&|1Nv-Tz89R4YvV43gjf2IbWk%X;`kSn8{Z%RKZbb
zjCc2QVriBzgl)Bh1of*}+1^RFMzJgz8x5Tt3`Bnke}xamdG*Fv9{k0u*RB4d`<}h#
z-708P`F%v{x`t<e+Jzi!#gESsBWum{Z)HRk^5TyQ4Z&=Nyy|Ls?U)<lGz?bLnu3~{
zH!`$ihwNpKjSxOu^<GJnbrQ^nUe;g2iIO*Cq^5eqs|7o`jfZg>Q$|1S{z5zb5tl;1
z*4r~vf99+C5F@(qf-$?^j=!M}(2EG_Qq#XQFjI4d_br6gpGJm9i9Jv?RUD}lP}7VB
z`STW6y2;AKGEjm_GumC)LX(_v>y2F_;(!?NADK{M+0~!_*^XS*tX=)Fs)tzxczS>O
zE&NlI=7rwd-Dl+L5dqJgD+hb#h*)Z8<4qiCZ;xJcIYh8*QsoS>`iEa3G4R*(c><uQ
z;#r%wpJ@l79!%cPJ}io^B3-E~kubh>a^!pM+Se?uAK%7xc1l3y8sgdSoP!>>7wgbl
z4x>dv6hB0lF60>^US;1Ou)d|S)_2WPK^cd{DU^145G4rWdmVi;QQ1^4be!rex4Of}
z-2eqB9Rix?vTS%43`V1OQJr9KjJ19st^8VxeLWzu_;YR=$&*l~FXf@*skJ?eB<5tF
z7wk+K6%OZQO@{hhH)H&g_v>X!zo#nxG{$gkrieIhFKh93!%4K9iGvJ^+yGHnOaoP!
z$?_5CYC9%sLzvbY(b|sR$){FMyuV43`h371->~pGqII-uYprdwX}W1tbv7f71Nuf+
zK{Fd|`zTnz1OeYul)`NvGt-@=d(+-A@2OwIEiewkEHa@^XT_O8Izx}=)$T=bO90g9
z?0DWe>PW&Gb&&1j;1{bOYML%D;x*53<aBQ=_w0GVP4DA&zuF_15*u~vwGa>Pz}0g8
z!_xhLWhC{_V4%@C^h3aSSkzWV8L$@vH28m<Py+)g0F~Z9U$PNIV1=-gytT_JvBF+Z
z=-`KhY@-EFtm73OjWP`HQXlb=zF(s3aD)fRG_~6G2}2m(X-*d`bzz4zaV!K4aC4%9
zt4m^{C&VkR9JJL+s+{4scsFNX0`j9JlP{OO0+7B~X-j&>X7zJ6Z5L{kf5e@s29;>f
z)bOaX)e2<rrdXw4qlt_edTWT8bXxcZEvBy{4xZY&ghjPe3-T-okLL4&g}m`)%6|=A
z1Knq4OZUB`0@m{^HYF<{CLy_S$97pXR?qnC=nc!;X)w(_Dech=HTsf3OwLlo^X@2V
zl(i14%NJY=n1(kvxS3)Ba$hU2-_TmTAR=DbWqm1m^Ek`XVLD4Gb<)|I^ROl#TW31^
zda9l~>Y6Zz3~cstgGA`-N;9k9P75@L^AD)W=tns@O?+N?*25UW+b1qh$De%>>9@US
zhI8OhWrI<b;h~H1aIw@A2+x%H)dB*~Ft~M-5P=cW*-b;#{~*FZ*klScI1p~j)oypY
zLshFY`vh1h?78~2B}hrq14icD?)M6R&hfxNm;a1zeESE6<O{4fz9XKK)uvX%^f!$f
zs*VX$-uTf690`N+7zRTK%&=3zyZ0a;sQnI45A<}NSHwyY(W){RaR-5Uo_qo})M5v9
zEENm}%MG?4;jXF7@PC2a4X2OW;p)XeUp8sL#y8rwP!C9A+k}KGJ_Iw8yLV)}EHsb|
z3fG6b7Iu_|qWbr{EEmM-ORv(0)GDSRU5ksf=km;pV6O>H$7!)j)yfE2@xv0n-Q}sm
zU!yH-hlH@vk948}z1j5f6MkJnxk%NouC;$mrynVYSeAb}>#zLQ(iZc*{jo{BbjEM!
zUDqsf^vS_kB~=3-0+?Y>v1bjDAy5YG&{NFi$I^H*<O2ih9?w>-c6*>pc$h$H?$LJn
zaoFm0TNmE_&tpP%ShnGz8Vi)K56Asd3){u?v)(jVhaZc)kEkKJ5CJz4{;Cq7H}Bu8
z96&OW28hyt1i}|^-;<P*+G`esdH3$!?M{YgWNa+ZOyGA^2P*zA1CL{<6v*SdIP8*3
zBgEEhj0yWwOu?AgO3eKlud%=ewU4lBte6;Ah_Zby*bW2|AF=?>V>NtwT5@-0A}{4U
zLg)P|o$f}12Zd74`#O(yl4Qt~+Mm3QPDpBfPFWr*OxQ_vebXas)^5`DxEQqF$t&&a
zl%@TU4_9FUUpEfFpWo*f^4$_H<uT6cJ|6CyrY>E=_&b`v6@Y-ijx|HfVDKb)ln-VG
zC#@44iagY1`#FD1oH_Bn^X!|r-fgVmb{Xabqf_}aYIvV%88K>(J7kEEuN_*NYEKnn
zUS5XkY_;M!j;(eGVws}Tm;{{_mjOzLHpvqx{O&ZLoeGN@x*}|>f;lyU(k5uV?pZD;
z(f<FBwzmL^tJ}6llOVwf5Zs}0cZc9^f#A}(hu{vu-Gc=S4#66CY1}1P<L>SbufOly
z|J8Z_fA2Z>y<3l}RlA|6-Mf43wf3B2%sB=L1L+bYH$PlT{pokZ^yb<aKE^Vb^UD~9
zI}=m;k1Phn`mL@T?1aTpb{zC@lLGbK1$NMi81xyhvc7qfUA7ASFCUrbVUT^j$Pix=
zWw<*Do`qZpTQthWR&}<4`4(?#bhr^Ra05y$5;5c#y?a&;6LHs8EBF*5QY0%q;@$g(
zWI@?MnLTTA*hV_t1Zv#98&p{K&_J{MpXxRp{b!*b+5ZJSV+}UHm9IH$KA4%0jpS$L
z<m`d+GG}{}l=lSCXDL)X1?ykM*{f~9Vbx@-=mBYDKbDHZL?il&GT_D&IViqsn=-^E
z+PL=YHhAlyyJ+9jPhA>y4)gyFa}<Mfw6|vo^{myb{rs2ek$1qqx;6iY^upL9(hbyQ
zp~_~CS<igg;;*G3A?)?9_NM<v_4dEwduTYoF|FRjEC#K8(3C3Qe-LUELZ@H4zrUXY
z?Fol8I^?AaL%R(nwvhi-F#6vtfd4O3*&lF^tFLJ5pSQj+>enOHS<gsK=Jw_v)-dZg
zuZ@em{*Ze658a~b{~xni;$Yxhu{QE1je=BfM3PFABQ~R96Fj<cPp9c$cc7sFDFE_#
zdzu2<qAu%n<%Az3-1dOztM2J5>Uric_SN}S>YGAQL*C+U@A~1|l`zE5sM*ZV)8!d{
z?*e<TOh~8$$2B{aBs)UMFg0dA^d!xw6knQ9bDyA0Zss?{?~E2|aTF;ZKPNma2-O0D
z{+wo`V;=QI6UrN&yz~D=_5lGlpfb>}lXa=}c`b1)@Gl)~iVKJPV&;vT%wsdSN>~xb
zqnio^nbC+w^fkV0x1YZbqtQ34q(0Y@-@tez#GBf=KluyF(d_%U-@Wb0PrMTry!&)A
z?EWac^!VvyNXFgp#2e54tKXXj;i$WG(gD<shsX1u4#zN!4==68diMyqb)lntS$*5+
zWO4!q9~_1xe916=dW>!UdH+q7W87Wu?o(IIj+J=^wDZJF(bha;W@K~fG>+%CD6>$0
zYf(u|?A=(FP$Z>v%o<es;2jt$Z({;&zbDa;GOG#mg2JW!&m-$AUgh82V(X|+F4kAv
z%27^VtnC^zF;0Z$4$e+0XG7BQ*H@g%(f<1Lhg)E2S4)QuVXo=7)0#1)vFDkE&bEFX
ztc=IfI)5*}I__eqZwxAQ3sxXY`vdQQUXPP8KydOrhq59x`;#}BYw58PKf|kH=AP&h
zDiD-z)L@%Tt18w^&GMyzmuRO}ay*!L!bJ4ZR{9pDHu2lYM;kOdj<q;{ZjfdUSEz=S
z^X4B+{knX40;WHEjFWoEKfy|H3`|zP#fspP@%K{wsnd*y!BSmf(S3US`I9oiH<+kg
z6W_&s!d(e0U)5lyFDv3!^7^6uYb&ksb1{{K|7w2|1M&T%H~`B0{moUv>0teD@afvX
zUnuGSddU7iO9`NhrmIUTe2$?oRLaNNSaL|BtP4=4keO<y9nUWseU3Rig`i}T*3*c>
zs7RddPgP<vjThZZAC;h$-!;JLn}C-i^#RA6>;tko9y6Orw2{?FBHmB`rV{aKgia#t
zr>WFuB`^@%T=uSn^)k~Q-n{ivwVQD2%bA?X&!8eCH7fWLwhwCRXK|?+eQ&U-Wv?`i
zHU!+b9*o4`mjHc5>p!Kw5%^4{!tz|*7oj?%I(ARC3nU~aZr5!cLX{W(%V_$4y5~S;
zp+N2)9<p;Afxf5VGxK^C_<tAaFoQ|ZHKTl|2(j(V+W3r3vNvp$?^$4>EW-b+M(4jo
z0iY5lS|0<1zNtYc5bBfe4kk&QexGzCC+9+OwdJ7~));XXIq7~!ds8|9?c^zcV;};L
zY2xo*aG_~?MosS}?)PPG_tPOj5N_p<YvXX;_v2ISqNhYmN|7<?3^T$1o0cE-Z@Ue@
z%Icjm%+lj%{LB<8B;ud-8X>eJTZ_p8=~O#%%H5SQ0}N-Yfi}NVKC^{i$k+Sb@NdUX
z!9L;;qsNOv+cmbd5$m((YL9oXPIn{xpq_B`0nZtzo|5A}qKoTtoSXcat8NJV%t?+3
zW{LsNNANyM&fen{1@uW%yJC+%vi$?tR%VvVDbOnCF|~g{A>2Q2#A&zql2H|05?A~d
zTz{&RidR3;!9EU}dD_oErXV_Ke%JCO`HwC#6>JMn^xVCroK5fi&&;|vyzlm7XSTE{
zue{-*|B>^LR;&LL?}9c#1wn76zbe?%kZ&Y0kC0O;)}Dfg-EW?PTW7tSytTp99$xZd
zKhO4rvMy(g9G~G|m0SZ|isJ8B*uNyOQbSwonZ<Uqe6`%jloCF@T&iKb!n%L+=6T}h
z^gkSd32TyGj9RZ84jg>G&WxO_IRx4YBz?cTbw7FRyt!mOGQ3-??FLcNoTnP(^=$(F
z1JD_$<v(icczAT?w3{Q0eDw&C;3qkTOE*0;qELEneIq0g-4$cv@aJZ_KnEQ82w-{7
z1Fo=>=T$`ScA{>E&XXQ!K5UGK#6%6mauoU!GOVyBBeQwh)+55v-??JM9b+hy?~^$2
zfu(yKSnI^%&e8-3zj#F8#@dj!P%=6A1=gxPe%q!A$hr!yfs7+#&FObLEmVrtdWe;e
zI3<jD_1|_w^*vFt9Eff$7suz>slt7IH;KFEl*DRWziOS|I<*#V&d7mei#IFU`?By2
zEKNlS{7B_{7#3DJ>c=TVS?g1<0#dTNpP`*H^}^B>X%G><M&vd--A>mn-yXfZ@kE-*
zv=8!&z8?qzCiNeIOS$sy5|6%0pM6YD(NK;iNNeT{yRk5DA>#muLPe#$c7%o^6L99Y
zkgc5nc$S(t9gW*^F_&+l=_$x0C){0ZRa_5RP6dtZ#DB8ZU}WbRpD)I}Sbi0P3st7x
zJg1`Wy=s>h?D16Qxw=@2*^^m2_d>X#^nA%vYp5D2A{CT672ERg6i#xI<mdR0QiZpJ
z)&ESsLLv9R_6%tB7x2s$AQTAe`MHcxYS|GSwiqQ$56kwIk8-b_fx4BdNomFa)ZgDk
zwnrXre=&z^I~zfK87FasygQ7@J$PLcSH5R!hPsL!A4W6z!dPBao6X~vy*{ub0&>*_
zWX16o9ETE%-|;=!A2Vl!EA$a!J~yzPhY9;)b}-%JmnOeNB}Fy>PyHIsQfHHdVi8^6
zy`=BFU92zx8Dbu(x8`oM6^T{3jxq=7$*5TM#?Ywx_#QLgJXfQZ;yge3-HgF7{$@CR
zoxeG0@u^84rEa;mmt~Q{@+!Dpf&Hk0QRN>2>5U;iYP(&*_JWJAkU53EnmK*FZQ%&)
zcK2tSH@!SrxfIL}P4iOjz)c;`a2f~Cr)v)&wguwv5PZAzJNpcxi{05U-x7=gr)Bn=
zZrk(u55JYA1%S(nE*Zm1Zcj{}x8f&e>ib5prT4s>$vRxr8$$lz(iWxf_JvPD>bA*l
zNRY&A6;Q3+r!^+Oa$&#<1RPiyMa&E2@*{E26a+ue@4vttt-8t-?-mSK4UGAQNbwgj
z&gz}^WjF@GE%kw!-h;dzxdf3aKXGldVA)sPIz6Z)hm}6Ye9k5XlWa^E@NS*m2s^&r
zZC4hl!O@}413jD1*dV*=uXC8f2Cq%r=!V7E<O&)haqsGrWJfQ)k2UEpOl)-LAPpAX
zHL|dMlTsHi7od2rqA!=7zwr=11!>wRyE#JdnkptxR~0b*qc|tfLb6UXzA-(oWlEh)
zc6O$HH1Ce^{uZ8sxdN_Ej~m(1lS>TEuK#YmZ^H4HNDtxorja_w!R1d3w{32;Bk!;u
zTNcIS_e{PCA;>Stz`{!8(r{m1=RNX-1Og1FbpkY^FewuGUr;$o7Y{x7F<X&9n_Gt9
zt8G=$GZJC6#dq|o(x=#e^d<eiaVw@rdFbY;4!J1Pb!X~Jf7_G6L&U60leqsfSSUPf
z)thLN4y-thX-kO=iocc%{xs#nfY^@2gGI>5n?VyLf!r_aZBwlq=S+!GR8P`1hT7A&
z$?M03d{6h})#WH}Rye!4qoa&cWf*4T2;QmfRj&T#v1_H*WDsVIW80*1Y3VjNCAc*2
z_ik~HxVOY9Z2+|uPE+1T>tV@{4pO2nwZrj1>=|)+CD3m2Y;>gO2TL<XO~K)RpzPt0
zkvoBRbaU;$ts>s2pchRnokhlUf{)aV<zW2mvDB;|!%lBV4q@EFMw|%~^uqR<CGELE
zEpoU~AaKOYRwdr|HS(vnV)jZ1L~c=Dze}Rn5|-=h)$a$5o_;_hj+W9nLRKG;)TM?9
z{3<XB+1E`dKBX<M{;uZXk|UaGX%i67K&hG_aZKZ|!!AdXLUz}KeRL-9-HxzwZ71p7
zM}QhJZKfDVUfY`#cl~4?8FJzmw~+--Lf#($I54A)cNLTueG8vb&Hj;~bt&VrlSxZ7
z|LyH9$#kNvnn(gLJCzNixv%t`H32q#BUu7xW2k}{FR${w_@VaMq9d{Y?V)TlogsFb
zFE-{?KU`y@CvhLaA^4An@YC}NIeWe=?`?#PTS$apX&?Zi|EYS3I00A+E$Gt>8{(p*
znEovjzyybu0F)1Sj)o&7(VF6fuLunVLar)*@ip+&7W&0>_&mu!HSeynTH>^2KXP%l
zdWrhQvYF2){Nl7mxIy+@-9w-(>R5y7yroK8C3nQZ>K>o*2k0lRMnq)bsBa0259T@H
zRal^%E}s`OdxppfXWc4rE;r=FNK{-*dPK21^(-*-vfon?BzCRYnT40MBuuDFl9E*t
z_gGRQyWi{gPtkbD#EeOgWHO|hl)tx2^Z-na!+Cgr0hP>4Jj~Zka1uuoH<V7u&BYY7
zFc*F3-;L@~G10W;CGeLRx;-yYOXcfBf_X&m&PVkR0P-YHg+9a`s*`dwj*0l64d~^o
z+#`a~L7rvUAt?BvH5k$AZkT&fm`hrRa3*b&5FaYy`EZxw4gMZDqu;@73jO6YB}1Rg
zZ81K-J2kmB^}>t2=sn)U;q2(Med_?;p_^4im~TPC5$9xcUBQ42*`c_0K>B*BgX*Nn
z1X1chu;xCH<vonFcIb9{7lOtXblaRB=KJ}3qpl|Fln$Zi&2Y&pZAa=S1sB%P=c{J~
zq(M<fb>W1-ZqVQq8jOoHa5!3y)9JCj0LX*WKxTU?mujg1-v32!O<AzZ!t?oaRj(5)
zJibELY~rMhXGZW^qBPs`?7KjC8{;U$9||B3e&^b<SjE1I?xaP08L!VlJuT=U>japn
z3?B!fYB*HJg|uE?!5Jc-hr@2O1Er<r?C_pAEg}O}67dHJ@H)rzhg0j31uX(1_~Lwa
zg17@4on(tLWvis*7yMiKBGK`0bni@L24uq+{t(7{-y=w+;u}v#EXqXDi@!y-v4u5X
zOf{Z9ka>8{@yax<p>BbF>{~Rso0cCaG(pwAhwSgXNl%+I%^N+YTyz#uc?D!FM`BQC
z@jB)O^mJh3lWT{?(u%7R3?4E#GKF?L4V3hmt(Hu%83a7WrU!Z7yX$)sB}ak4maD)Y
z6JE(S%nYXsst~-iZYPg76aklUXSC>(Z|B(hl?cU;b~Z1%%|#1)VbeP}2U`3Hr$!an
zOw{sOp@8>>c4A!Qb4{Od+!$Wj3Smg2^gIHe3w#Z+9h>t65W<+h$`+w1dM<xr7@D3$
zmtjsqc|I(<)GgSv;vM#-Vh7K1FJxKMMx{S*^?W9b*XILe=+ADOdpp7KGEvzfWK%s6
zxFYiI^%feqf+s2|q#3RfOwHMmfSosL?#xYLagR-5E$QFY7<Rg3)Ufh2L&&mWlX}~p
zj6M|drUKW<C>3%V(NDJ5_v;?DME%f14x;*A4zF4i*hc~~JzR0GxVV1VSfUCLdO>s+
zyT=wV&|E3mmKF#?bbf-Im&4c2G(^9bnmB=+7PL?}t~z%DC&Q5GCAu<siS+rQmZ4*3
z0;)ld5t>;GA=2qMD$7Szwq5{Z5*&(`uZ(CTKM`PtOCVmXZ)%uE_HMb}@d5hG5Cw@z
z!}w~kZ}`z5?u8O@`<hVCQ^7)fy4wKO*cbEE*oDAH^oaPEMr<m<ZC&->0-rIbg6`zq
zSjQI-l+@5SPDUL~MXa!J_s3M?EnMPYTc8nni#Vn&7n$}6l4_H=M34@)EU2JU6w_7~
z)KLXQZq1-*CrDh!Vn^|NU0waP%B_2s@O`*2e7G>A61MFtaddc5=&yz`(zC^m7o=0(
zn;?@t8ODD3!JRo_^1$;Hx0Rl_?-)N~07PF?9qc~{6J9Vweb_q#xOw=wagdQ2fx^cy
zt&b^&8*Z<6eiOpLD16ikXPRNS$6$tJ?)h%VoBq8zmG_Ao3P#+Q_IJx(9bm6Mp|u}d
zVUmE^*Wds}(!R)rILAv09Od*#J`P-{%>tp%_i6v&8r+>xgRmx!9h3c)e%ido4G(WM
zt%&T+!LJXUHdSvL_QiK1FXS>Z58-PZLgSSZs0g16(8H7yzdc{^+3Fod1`7|b3k?wj
zKHg#%HjyCx#)bW&53blX!Q~N?A4fc7#>s687>*CO(Vm7Gsh{fA>Ug}su+_fD4%cpU
zTSuzDujrwm_q%bo*hATmd@Igabz)s|w*5)`-bv#4#y<`0o)K+}6T_9Px%r2P#}f64
zpsoGso#EBp6P2NFh_VP_#NhB(^4NpQlOK+3;IH|vNs>#w3IaZj_9)4t2ywgpJ}Qnj
zq)}0}peH>Hosu>xH|=6)Hb=$AKVe+G7OF+9K^7%+`Yv)L@5T+fSGa7}INbPfJerLm
z-`n@{to)nae-3WHXNGO5YQ)BPob7acqrcj+-DTO#`de`>pZ<zILm`UQI@%VtC8wAG
z*CICY+ClkXlcmYt>?-c|yoZV>zS}3^OOOv%IZ(uk)L7=k9X187jh7u(c$PYK12@Q<
zzi(Wd2ViDAtnRg^ED-YX{^Pk6HW;Tctj1KNIfN~l`r9hzoUmkubWUUd%$nSD`<_b0
zgyy6GZuhjU@K<3E>Mc!tZ{i9K>Tio58G1Ao2rU}zFJuIZQd5n`Zi;Bl)3C9u*|e&s
zs;kVN5Fn$?G2Xt}1_4;Yi9j|_+$?HAtinu&!VstVU<|s(`d3bFMgxBjjufN%QsM{i
zW#nfC8l&-T_Gw4M5=zK)W!?Pv2OnF3BY0lp;WRy?g?i|>uuCs~ViJ&qQMR*cLkiy6
z>{ZonblJnKXVO*lbMj{MYej~?K8%L?0BU)XA<w9z4ZDxE4dZc4BVF?J*C}Htceo-^
zLgmotpW*&gWOqYEakLt_;DZ6Xf=K$w5_W}i@huviVktfM=EU@L$~d;;>xFn#>?l-#
zNx^D;sX4*jKW|g<w2i=E@AdhE8w^{0CwF`0#AOln+ofMJW$8yqghgD9j-`4ZRzG8|
zMbuh^Ej6H0hD^5IyP#j~$=;d@7=CE`Wl;q$s$A^*!)^Wf(+H7WEVxa$cUS0rx91jP
z*_A+SX^K;v^C7c&>Q7%7Fm*WfAhX}kfF$l@kgG`O)?6lq(mt}-2FSY+QEyjHtw%Ea
zGrBBj=DTSVgT(ev46MDA|7^o}r3!d9#++^a7J3K`1P*<(yW4;iPpsiRKl2}YB@*m;
z6tr&He6Qz3eyx&ljM$`x)j9jhCga2VUNf{>@#C$O3kGMvEn=G_Kg0OpEs(B^_Ztm`
zueiT%c8ERJa^bY$NpGCQP)SnnaqQW73yKqR(D$oqXK5)@2yYtOw_e7IfXR9g8ECT$
zf|M)Xw)>t+-%YNr1g=;ij}$eRedoy7X$v*<xqmCQ!>iUh`RC*L&{<?P#!=f~7s81f
zyJRcz!<wO9Y-wa)*Vr<t*W5$rk^?pgRXu{(A04fjsmMN))N*uYc${CnZD_$((Zx(9
z;3T-O6I|c=!1iPiN%Gxw&S^~Ko8G*Tpc?<)1Yh%2p}_N>fvjKk$s%M2bmR%nfa&P9
ziquB-pZFu#4^)24e%j_CcaKDm3Qg-|`6VF<qFK{ZFFn%I<{&9M4{BeB%?Pv3>+;9t
za<ty3m~^o!B}2qHCUlUH29-QV4_0Zde?`kIp^5Khm+AMYZLcbW%SpEo9S6c*i$<Rj
zdHRg_G^P`D{gke|mxpaeBWhqgAlXsW3)0_B#PI!wJrWY#SMMY{Ae-l_Tp?-of}BsJ
z9YW5(lUnoIf@Rw-WtD>7DLF^Lplp#F5>th6c|Fonja>M^k4KeFVPGiZ(>jC&55MUk
z_~Ri}xS@8^XBc_$eB7cHkEo!uP`G5s6kOkP7VdTaqvv;440N590N4e6S_Hr(9Z4rN
z%+fDQT*`*Z&7k*`W#+(Df2=c*OTg)%-n_A;#BrjE`@A;T$EoZn^*2zYF@(-MM$02r
zIL<-)!YTK2Ig+fM_MV-)4nMGWUa*H`<&DjycH;*vh96XkHU}w31bSJA@WkDGyiOdX
zd=7O3ktO1?)-YcmVtO^5Pur7$Y8{R*_;b)g_;&oAQwog2X3#+Oz^<VXnwQDw4c*3!
z_9((tI*d>BImCyV7+={Y{y859u4Mc}oeSE-A;f5qA;2#BUUx%P?mirmJ0*$q3E^_Y
zh0XljB|ouM0}(k-mGJYBgCjFyaUZ9i`!wTL$p_p1ZE{)-X^>$Wh0=XdJ^95Njuz_7
z_sfmN0W!L6Pe6ts0xq%1$U+h|BkbI#>rxtmJr~MrE1_$}ChwoTyK1uA(^J<B;Z~nK
zRk#Dj^m_&6^-(6LLvK`w6?E?3Xfuw8r7<Ba?ICkmKkn2NSR>td<O5U*@8|8X<4>Ye
z0_@}he6VHN5`Z0IKRjiioi%`AeRBG_sMJqx(0-}^Gb^e5U`x_wU|<?!;CILOvj6ov
z+^<H!EF+|p4TD40d-Y|?3xq;Sseq-afNm)I`KW4F?dc(Ld`)9RX?M>(54HB;71JK=
zfyVRj3H9{(*zRiHP83rx=0wG<%(gBxXOQ&Fq}l#{#U~ibD#46F;=^JK?($eYM_11;
zNlp`GVyQhy#VLf~<qzy~Ht(2UvL97OEc0$Zo_6ShUQt1uUlNEa>ItKiAEJ70BKeAQ
zgmI)Q_bp~e)lzpX!`}LM=DD3#PP$F7;-&HdgX%EgEf;{@b&f_ery+l&mh?8>5$B~f
zDw1+)gWyyJ>N14$1rXGJF4BrH*Z2q3vOc{{ZdrsrC13WS{%m-_HH26zC$`V_WK!kL
z4Cxd~=aF3}CWBf|C<k+zv>nQ?q7z*BF&Onbc!DzMmoa9D+n~FhW&QwFbMdo#Txh9x
z&A_kCQ7R^PPj8M4MulH|`Pq!I!Z5OyM{7-IjF>V#S|MK^3pfr+lzNSL)@2j+>!_Z#
zIUrXx%p5SGyNdq7C#>|FHuR+|A=dbveO7!G64OYA0EBU%+NwssWT)Fl#QYo9s{;P(
z6QMUcQfR3)OhmmInj@5Vjj`W%-e`B+o=6{ag8~BExI$2-gZumXi;cC5T0bjS{1UG3
zFSJRrEU2xdf=r8$w<LdR=@3v7EdDX0`10iPvixQQ&x~Pu{cy#HRjVHk*}_9yS`7w`
zp<7k**eJYw)JF6wo=J?<2DL!Au>N*m;KRanKgs1dMe^3~n4#Zej6D@q@T{aQFp~h0
z0N|7hbBueKHuXX(=tB5H3!q(CQ~Cik_P*JtqigQ@YF+-_l#Y6&JTi5{(MW$=kt3K|
z^|zu-r;eNS)ob<p5FMrNCh77nxfRCAYd%GUr6!aGLp1-#g-=^%AoXfmCxL8o=PAZi
ztqL)OLBh%dCIoJIEpw)d@|%#fL#d$niD^KeNtFTV9&e?@8dkIL{Bl^m_k-I`uRiO6
z2%dOUztQl%_d2rwjYajg!-aijFCGIH%AxYy&(rj`1gzY3ftdvu52%Fx*EEj777&}y
zhu`di1w3`f`jSFf-~?`0P~9h<dCl~BFJ$={WIcnuPnQE@(<wRM-{c(55yEg0vsv)h
zrJN{l^0^r(VW2lhT8+6*ta(KbpNhafgv^2(>Uw^O_N6xQp_!?p^)p38gucp{T)jSU
zTvZ!|+ltO!Z-S0ZLV^VnOx1c4OYA;2@B#>4)cWFE(Ir;ff7q|S;Qh9OZINAccvXd=
zm&pyL+Yr57|C$4HNQEwdbQ3HzG0WbQ@!T}++62sAih3*V%;sSdkN_NB<LtdX?dlf8
zf*I9Z_myCvr`4D0{NgSk@X64LY{vg!vWPTf9}n!hMWEMiC|&&|=58SHy5ck9jEA;t
z1Y>&3`aDYb%jk{n?w3Z#2H4w%vcSACl^iCY2h{K2FnlduI|7AJ9h2q#6iSG6QB2Ni
zl9~Ij+5v4VF{-iAEZAdT!!@U9Xn%T!^0S0bCB;<kw}<{--gS<c7qlCRO5qBKTft|o
zCk6Gw-v36H^2!w;gvg<E)l>PpYG`y1L4CP0sEXi4z9}2_IUCDf4F;pqc%I7c(y?Gd
z&6PVk?fqV<;j^8{$ahNCHrIU$-}^q#br`uPl*YM=ZhdHdo)Zy&979-t8cJTDn0g`h
zwGcq4(dkE~TrZVv$K4^!J?-Q<cO!){`r)~ctjSnX(-}wJ(JkT~U8R!BE&Nl$2gMxz
zy5H;c1%rU+NT%Zc9-2tK+JQ!dD=Ac&HH4(AMJeVq6nDcdK86N2#{kk+FN<p_NLYsY
zc9V*9FZY;thf8zkYIo@Zx7&lq5brfq_&$cN)`T&{(mQFFU$|#zB4-zw*j+u~C(UQk
z#NthP#mx2H(`|$8EXM=a1b^VtY&w@;i8Khn;-}2D6dako9MjH-s>Vt&hxY1VAJkAs
zFw_RB*eX-&N@gs`c$|NHuux~Fyb>U`UvK`_v8yH+u<7u6UUSAc`jjO-l(b%3`RN!q
zxpQ+C<|MRTptYv(7MWF9cX!f~gm^c2pz#QYIdT&rGGlPfNif~NlC<9{|7J!dBc(J{
z4gbgclwso)qnU5~vl7P@8bp-t)9JAdpY_ve?Mae$ZZ1<0>WD&DhNViIn5(^_4z;8`
zG$+_z#PZnk-aNKRfo;2#Bzjdn=?}MMxMnC@-tr_X2j|^VnI^=|src%JZbgQ!2^(X)
z+k^QEQ$)_T%aZxC_{n+_ZcJT8hO=OEcRao1WkznQOQ7rcm-~|6MPuvnmn1=^;Z|cV
zhZnJ&@Cr6%HcbPgjE>IYyylK-N8Um1*cYeQ^I|5E>`~pg^TU)yXNR`N)#8plJ<49(
z`g01|om#Q>h(^ZojQ72E8@}swJAkUE_T+;}qwQ}Y7ZruA1SNtY4S(o&dwXSap)zYr
zEBr&6_q@m)v8;0{Btw{^loMR7GCvdaI)WY&7RC01%Bw#jr^bJ}4C5xXu->aP-fGTt
zS5n^RB{8(mO*YU3eZP!Y7d*}w+T}iLq8~~uYP;mTMjDc@|H*rceG6A7>HeC4iSunJ
zcKnMfQH3EFR0M<MI60C#*7OpgMaAuRZ1H~&hAfAB>@_X3B7U2h)zL|+7-ED*ygO;L
zZP%;;CU)vV{k49@?5lLUNNE3r(D8CNzIRyqzS5ec$u;y8Il&?-D0u($%!`MKam}PP
zm-qQfcn+rH>Cg)lMJVa8r!|GZTY2p7=X)d4_59eE-T{6zc`&wZMqchU36>ml_q@Au
zGF<ap^&#xTprj+k+{ewU%AX-A9P{fWb?)fPe_;EltRtznvHDh4OZ+Q6cdTnrygx=%
zv;sdEPfCii>RtztK<ljM;sC|0L?frWUhnq+oQ}_)2E$j$yBjzVCwKlsM4fm@yg&I7
z?y49DViIc?6YjxWh^a;r+M<I?h+eKCVUs$;R6BOcJDjFkPTPDNYfE-ac{d?df+mgN
zjh$Mur#0a_=C%NJ&um{K5$bW?aIJ(iofvWU(i36Gaae>iPaLCLv!bSEu}s|ph=`#_
zTVEYcM_(&7X-nIVf1u{U`GbXvQTPiyt-SN?0FF(hfa{x0M%0{2dlVD#hs=-S%D5q$
zuH=AxY%@Vjr3C$+Fhpm!;(;1|nSf<zU+6M9Vm$%$9fFJXI4H!*BLI-kYh;M^0LZEi
z2u|j=sMQwb9FqDi*nlpId-#LKN1Bq8#t2?z!W2Z0P#@5K8wir-&E){SK|PP<tJ?y`
z%HI&<N);y=d5|zDU>jcKZqjea2kqAM%an%6KZS}{FX87Jmw!^vZGj5@MQIj=mXcAA
zAAG8Q3dFKyGr+LniXW~6KpcCvw25VsslXbd!tBp~T`3|3J5vY%Vhu&Rv2z_q|N0F7
z*+st+fX%B;Xy=Rrn8a_MuH}EgrN@W6ya#J6<jOA;mZn2LnS=mfIFp=y7O4leSwJSa
z_XD(J<A1#!j;O+~mOxW&Oj~RT=oLu7H4FTG+}0*mhyD%#pTJ_I;rtVt^^bG3h^bfL
zW8`Q^V%pMugQDesL0eSd<U8eH(<TmyULF6xBjIX1Xl@aeDp(5D3<W?a{_zpy1Ih!!
zpg?}{C%4eQkI>iu0QNJ<D5i}6eKgJV*Id2gpK*-dUk`+_NE+QZ(cT1VARGMnUHoqD
zc@B89Q97^%m({a@IMEb9ur%Ka>*N!==1^^G!+PGhN@5UK&P$D+mS!iGdFL~e7^=nZ
zMP3j0(bb!|<rj9-q{qN+a8b~0CgtB>*v}l_lJRnBPg_JJ_Uz#c)eK5)9C7kL8TH)4
zB)T|{z}X$vk7~pnJm8()8g@Ack2xcv_SD#e0G*|!MiK#LC;(X^(hCIu6U;(xTPoy6
z`qNzG*&Lpn71FktEcgZc#=oC7Um_rt;%X4QGQ*|gS`Ih4y)SJ`ULUBV_+cUDs`PKC
z2bz(f{CgMyIytcEzuf1O!jNUf<v!<u2x{G1{ipyotq<(a9qTh?=_P(11r`Qu>6$?r
z(Zi+DmwYh{M>gep(w@&{jYuh)jYfMAMR&RC^V|)W#ZP8u5i9hi-;qJz)zb9pZCy?r
ziEgXE`(I)%MSA(;6g)Vt*7Z}lQ`ybDY~7A7De)IAz3+-xI5tF?xF;aH{y|#itoMyE
zS5j+I_k)Gps@S#ryz*81Z|pf-e(;C`Q?86bcFOS3`pwzF{O^EK-JJ7?od7^-F5?W6
zOxz+;se=dK?YWeoY#w{@3(Mv}1)?FLQJwv7U7_t6W{7%!GYvZ14ETfRilz!JuI*UL
zBKZ}0ILE2-s38HZ2DyE%b3ie)mIKtq+q*kciOmq^^gvDDv3al#JLuwK4bQFQ*c;$O
zS6s-;ILL+H%ggRZP*~v|Mv?57U}=DudAWgIo1}>iRZ6#h2m~1guyN8Hi*h2$qh?l;
z(Nzpti4H}-an~jQ8!ur1%vJb^d(wt-*c%m5Dl<kO1>HW_gyc6zY|J_dlrTpJ*<w2;
z07XG&E{ZMQuqIdKRR<C{Lv*BOV4R^`sNoffLOCemcKDJdr<In;o~7@4J-drr&q}T|
z7^};A^9N}q>)4~dlc2$NYsdiw{iMEV7b9XlCdEY=S}t_ZLq`J8?cLyC``*9HQ2$<2
z0iZ7-hCyxZaOOwyIQ4A@-mtfe-MaeQOD$m@CzLrek67MUgPId{H(klm!$!P4A65Wj
z(SQ)fFqe5r1V}AP-stsYQNQ%vR?RqT=K#KwhQ1iZAVMt3+%~Sst2>kTq}Q7ew4-Pi
z;loJ$(9gk>22~e^{zF!DWBplGvv}rBaEJf^`yh2VZE<IL^zfQ-VPICa_jl!oL!*rG
zuVraKG)gKkj#P5u)Hm;KJ>ETZ$?<WKo+87mPS(qFttv_cK1Nn`C81?$$(*@$t761Q
z#F}-kudpG$=WN0+KQ;~ojLyL{w1tkk3<T%EZb3_*2e=1x{O=^$S3$k0-7*C>YL92I
zBhGbf9)<)zwIm`PK`udvp0@{qqJf_4dFZw4H4N}nbn9pA6M>Hxp|m;t)n`c83hn^~
z-Q{cT2WS^1j9+c$0!FJf0-muNV;>uC&##{8s)dItd-KFwSZ7ucguJ{1l!fn6p1DR?
zzb<eup_JkPbiRNh?|gKam6+4Q$UV`tYOgUq=WaNB+gE_>qjjY$`5E2>C2yOSEfX>y
zsWI6iO8TUF?J_Po*ReWY=qccH5e0VKg*{Z#a7On5@7LXbfYgx#6wjTIK#QYjXvieL
ze*B^DNrS7qu;NUPcI;X@R#s8EmhAw&eSTTN-Nap$Bx$SM7Uah|I+vQb;0^2HY}S}=
z@V3()L#E6Hb@gIuOfi$EZ&tG=W@r>7uMItzedC_()6Dh>Qx<+j35?2M^_g@ClB!eD
zRws=ZzQ+v_0mpc#0r`u0go_%pCtYS5t~-AdlMl$`czzT7-H{4((uNZSYi(}7l|OF3
zdK5FeCP2AdSF5_Wq?hB((km<7GjFbQVd~RP2YwolEm0!foFXw4>+XU%td}O|$vo(J
zm!%V0T1uVUQ9%hcVuhgze0z6v8M|kI2g}ef+Iau#=TJzaLgfEwA>8;C00Vn!;bLPe
z1LsvxEe{XGG<A`?L(l?4lF^*^+hXde8FBRz!{aPTR$&v^FnfYFZH!7bzbk4+2KnTs
z?`x^a!jOE;h!I`DN%iB^|8NxYBzWXp7gFA@+5^zcqb<h?-glu@8tYD~TVZw8iFsc&
z9yED6+eNRZw+@fmpxCuXe;Uqc@E$`eX22R<$u%HnlNpepQa!+hy#w5Ztg|{VgcJcZ
z_0ZHZpYS4?>WsE1aBZ!{U33_e7g9}@5^Q90_~{RHFtek4YWliHoH|%@2kn^9Is&yd
z0*wSOKmK9YE;OTrAkxfrYYbzwocut}yH|8(+|MU1yOvtFv`l1WA2C!?htCdfOQUN=
zH~SU8f;?B#ia3YU-09szAQ2}~r<&<5(L}q2xfCVcb*h)eTD_v868gPh6UbqNYwRAo
zMuBN*)`Wv?8vtmc%6@R?yFQ0Rhsh;hJE&=3#5_a=6i(>~Mt#LO=%(Bmr5bgwb-{?L
zWnA}bQny4$zTuRn#8VK6x+L7`8nG30)f>T<N@CdPVw+pSBw;wE;3`0aldT(2t|&qu
zae!>>qaZ^OE}Het$>Ub9lyxh9gq=%f%JhdH(iQ3Q25aZShN(6!YiofzMpwy)8NRMq
zjL|e}J$ckdL9P0!O~-JG2n*E+eXi~9XZdh0&db5i*|G+PeTjJ#kaR)DNjDJn)paz`
zlB_>&p|A*sxCM^auR)JCFt~x5>g_P2B5>0I^NL5Zo|MziDqbU^CQ@&5+?jf8r4oB+
ztlbM|Oq_|;?GWpus<xo@2<80tx{=nNZIscb%z?+NIe#HN<SAHeC7J`z#5lIsD>we8
z7QU%ULIL|vH$|0qBb?sO5=MJjF~uNr(aUH|xisH3d904+<({)6)jJKvzPXUis$It>
zvKOwB>&CjT^z8)v1iH#QzY;q3etFLH<^z{u3HOxwV)A*15~bVzia{{VWufkEP>%9L
zl7-8Epa57u0L=^lum()RcEyJz8>zp;jeigl7}j3^;N*9qq`AOTk1C?aD$Mt=8bDHm
ztVG#s_TPs{5#4uxJkl)X1CFU$SHtijfKbEXvy;wd+ymqr9fe+g5a`kiN_dW+WyS()
zmXOraN@YK1!FQ^zBGsTz6&=B^;gi0m#G2LsH7J3DAMsE!{nHVdj@8<<Eg8DTx|PNW
zF10}WuPV<|0)WsE5MBc;;d8z5@&OZzb{$6PT$boJb<~5s1<u{1&86xpfZrj85~;HX
z(s}8&+dJf+5x~po<B-%(?ht&i@ua@`gqODAL{k^Pp7sVTOi^zDu;wlqHuHO3GI>T}
zMHh8^bA`SiwsNA(Cpd6>@cvF=YRw_rkd|P{6MVvvX##k?IR@eZt(|!?lUSOZ0sV0S
z=Y#@)L@5X4P|3Ysm&T)RwH{4!KvIPT+e}hWdC3;v#`xFZ%w-}yG#jb)QDP8h=J#$e
zY5+n9#hgCW0!JyhELMMxJW6=&^5gALBVL*FY(GM_)4-b5Xoj%ztTI=Q=9;Ndz+g*a
z@XJS7uOPM%EqCMPo3`oqQlKm;N2vzAmvR`^8O}b-N-juk$b&uAb$S5yk{=I7_7eS-
z{7PG7s;O;^<a<n2rRx510VmQvA{|K|E~NJ|8rmS6$Sg|Z-FK<`(OB3=@R&!Ti^-ib
zQ^>dhHpQ6~&{Rbdgss+--KVCzpK7eik(FR@v4&!cY74s4B3Wht^rJI(jtwA~%=IEr
zjtjnHN@so{Lfm!jc0IE^YSg0DtK5T;XPf9m6<|(5oC29aq1BF^FPnd$`s{=c8%DOJ
z#lX3p1`6j#IjzKB%4rQGFAVja_V+ukvy96@cDkn&<nariwsC`lje6asEm63GFH>dl
zcs$<;wkDfor87O?DMJn9ZE%m$ZG_l*e90@|8W7mWTz*H(_DjXC10ek}pps)~*z?iC
zMHR!s1>>LYbeXIfC<Xt&So!}XkGV5KykW=O=}kRdCG^YXcW7I=+pnB-y5>FVal||=
zQ136$dhCQHeb)2Mx?65s2Sg(czMNtoT?5AC#huU24GnLic{?Ptle(*r49*TegNi!Q
zO@KwO0&<rotrqq&nxUJr0na|cr*0AMJ!Vm?)qQ2pbgTOx9dLRg2GY-JIRoy4juE^S
z0`#6xw9((OPD!D+)iJJh2PnE&(*6cV7i_Z1EW%&91(UPXL<53^2c$&66}>BXTwdrD
znAwO^`EcMH;=oEfoOKQLHa)@K!!sm`0R8?yIu9t5kIA1j`%w%CPbt%3e+w6(xXBDf
zg`xxv78e{-LR^~Qc-d#*VWRY^UQ8+EoU)O-5=k+`>Nu!PmM$W@EM2A!5x9vX1)7m?
z_zShXnp9jBn?Kr0?=6gUCKcl}0i7Q2?zg01zv_!62obq@ny1z?$Tp%ub5>^xh++V+
zWy9t$xDnrg1;I~Em7@#&9_(GrOwH2v9Rf(`Si&(~X+g4okA=de8`V+;Fq`g!GDaLw
zY?iRbv1)Y~QAdN}172E08x|95r!z%;rlPpjtdqKhn((c?$^4J-RM0^os}2((SVI|9
zy3e1yB!uWS6%TPPuihNsEU+3W=}W>kV0Bsbr$L<7<OBHP+Z7LZuc%hwCtKtO0+pA7
z``PROBjYN`D<O^#X@oC$=`;eL#+?b2U}urXl{78p)($q#@yg5sJr>2{Wp8c2m<v%T
zpY&@np=x=ZbZ@#hhp6vXr^4RFa`ypk?2kH91OHs%0=~jE)>@M&!0#Ci?I3(q6*;Rp
zfckx<jZ!X?LzNNUDQ@!d`f{Q7T8*n@X+-YHr?9Th6W7cIQDkq-n5V2m0Ppwk+}F1<
z>8%M1Vn_S0?MjVuW=Pu<p&UE3lEe^K)&B$y!$ae}Ds*5&hb&0I|L<h|-)!S7kfrzb
zH3%<vJa?Dx?Ke_<JWZ@`jERC+TzR}qw)Pr=`8&=j(^y|tx?ixtE0U*f!iHgXOu`U3
z+uh9{w@S_*kBF~)-#;(?;YUx`MR;gRg7td8Qz~;KXq#uEn?2s!m(0h$umeQCYm5L+
zJ(hP>X=|;rtBo<*zU$9^jsV)fd-mprd0|>PE6OGm&3#@X^c|hr_mOVencQ=+GtgRO
zN43#y1I6Tf!qAe)b0c0Zgvg%BI`&0rS&W2}A{J4RuJ=z%+b^Pb2FX~AL^uVwMIn33
z(I8Szz4R<tWN9snRWEg^b!z|CZp02aM)GoM0>-iz8WcF4b^f+U1m${Ac&AeXsoK8c
z9^oc}2%IbI-X%9gh1w%$`mx2E8fe$<yQd2z*TwNpjbq2j-u%JA+~rO<z-3%Y06N`~
z;PNGs%ft<w`*8_6zGNIE;}V4(3p=sd4GG>Iw}yL3^K`4P!biqfAgh(|F^h2MC91`&
z<w>szIN=m3rw86Mj8DPQOJhft3o4TvNTD%*z34}Yo!4^X*8gC!?I;jhB&WHyQ+TZf
z+MuqMp<aCS-){JY1P;A5YTtDpITMPQD564GszO56$m~h{ky09VNoyymBmDJv!5?m=
zW^H>LW)+oZAO5#wbZZ4s5#tS=E6Y`HyZnCfhldO^l7V*I?_X-3F+Lbj>LFKXiW>=$
zWD9@SR@(tK8NNvfE@>jyssr-58nR#psi}@HjJ(rZsU}dPX6nhBLZsdH-X|J%79XJ;
z!81bO$kwGTxCv+eTKGu;gjk{MqQlJmRWB4j(W3j+ncz1aOY$jv!oZ%q#oDG2?v&83
zNx>>#kZ?(!Gh-m2P|sY9!u5{1_vsjemRxjea_Qm8dTFs9!^z@nZ(9*lvCIf~hAExR
zZ$ZIbQ8(;M`U$jrm}Ewsn+4eCLW_jnpX|Z#jh75JX_}M~BKVN*c}<i&x)4T)5&bd6
z^yfBf2R6CxZr9f%lAgGavxC{CJNs)^b1_Cy_ohUxs^la21IVq2+2L2?TQa$zAwCuZ
zYHG+ASvcMf2dYBP5pYzA)8hF}Mzo}j^5#vZ@ee1#h)S(Sg;eG&oruMj8)JW(I=dn7
zvSsWb$e#KAJM)OfC8deb3jmRBJrakIxpCjf48)5cgAWkJ^~2(ke&hDE+i!<Hqfs>q
zNsdN$E9!#m?HGD^|30eCx}?j`lPZ+OTX<CwVR5e5uwh)@(ji;XjXD8{pchH2;GUb!
z*jK&Q)F8-v^eXc%_9KC`5Q?Ev{&K{1X*ZL;1QUd4Yiyja49Z2D=aRhAW+RJdZ_*Ie
zE1DT16Ir47TG0Q7t3g#c^#2L;G=8^C{2zpMm`W)HV*N+nr(bZ7DSn~Ps%lqH%k~pq
z`<4l_*jjGV?>iokb@4VVVqQZ0+$BM7st<}KloO|ih8xly&rB~?cZluv?xcRt!>?=o
z9goNgG0M5#rnzn9p6|*SU&45NACOy%uHUv--@^(yuk_mcUBLUUY|2L|r-mPsVT7X3
zO6mOCm3|H6@qML6g!J#3J!1$z9Jt+)(!U<B!)q;Zrfg|bFWF@OT<hlXi^zVtQS>$z
z-4^hU7=L)yh?{mhx~?itqRI&N;`Z)FJwJahf(>n)i}TA3y%#wL<Jxbc+dpS)ynf7P
ztm(7HJRd#l$v+l4e>8l->v%fS_cpqID@=St^K@Y$0w#5N57c2(-h^WPB7V_U(==+V
zF1INGz*m=CG#t+AIAtoULSEE7qs{x*vl`M4|5fh?X5pHgC(hR(!{-g@yK@WDF6I%%
z4`(UR?ElFwgKqE?590ZPEm9!(`fHgqQI1+g5c3EZuxDq&<~kF4hgx^pAhZH5(s=EW
z7GLQZr#sf2g;`S-Hi$c|W6@)?-hMCE=KHX(dsn=geV%i_dbS=XvWELAKKHzP+Q|zE
zuc&VUKrXT?vD>48exx8793fsrnq%+;J2Bii-4)pPfKh?)6bVZaMnU`Xm(My=)s;24
zI!!mmh7h-V$^?E81vwfaYvt@pCqn4$y;xg&EDLVC@&U3ghL58_ofCb=D5??HHW{W&
zK#<kFf*2z=i$22m;0pb7?ufI(IV40NzU~JNa%rPCL;dz=$*KtVqBu@JN|_&D_CcQR
z0@F&#M{T}msh$W9PeeR}PO5uCBQ9ytlx{Yv%8o0{e=^B&ZOs;Ln@=KK9efpKf?A+J
zwc6Ijlg@+?x!qL3|95y;#1j0nTDg|V1yiB+O1g6Ag|48KfsiiR(R=EJ2JXrjWMzFx
zRJmQHgH1o^DDq_Fd^tyMJ*UJRe|wsjaxZ<?wMBU~@r>*{?9u-EmWaZ_7(J<m&jJAd
zaxLv1=!@?Ax-M|1atd>mZXU3YKLsi<W9!u>i!wh2SQ)rGBD_3s$h}4yu4fwffkXSU
zyMc+sJ4s{to-6=F%_!hFwp8sLAUdf0Fx1_zGy8n^)-O1_iudz<$H^oNmXpQj3_gg~
z?z?hy-zXm68|n}uB5}J^$|!SttE{l~#8<I%zo^)h`M9mI&Q>*;Gn~2CWsx<QJiiU6
z#M|@WUXk-#bie5AiF3mye4}~fUgz^MI4_~W>kxBIt!9T8`!yD)k*b6ZB(>iC-2*M5
zr~A2Sn$s6VYVyqzVG|?!b1(AP?B^ZayI%VyVtcX8GLGI`+ia4tjU$&mC-U*^j!Umr
z`zJSV>kA%l>j$3JTRMI8gri%FLvWEDd!2=C3-GlkpR{l;rifpmXTe<Ba&e$y-*EOP
zSQGQ;RRN4c)`W%AmOIA<H?E>MJz+x<tRa~A%p#iQ<~IFN5LfxtFZ10FA0lf*e6X$q
zRH9CbE3@=7l`{5N;D#IA;6Kp_HJ(tK1J4860~5iR^`gk0Hc72eg7YUFv5p=v4DAW{
zn_BtLV9<atg~)%i1%jkO9eq&;1zM!GG0LxuSkusH=-8_p#|m96?3~yd?_x6pujuau
zvAkZ0xNmB91o!n?L8R~P{OUg}9<;7worHLtXPwz^m8_3o(%bXhG>rD;_UEnDTamrI
zTxXx{WYY<4KU$!xm3_S-$KRpbj4bv`23lm&m@g5d9cpK9E-U-S8a_q9-bcUo&V?=o
z(QOGBC<J5%D`39z&t*xZK&@PHvL6UUHk)q_qOG=Ts*>PZ`tS+-DAS(rNm;LoOUWRF
zvY>`~rGQP&WI;?@L&BkM!j;F4zSqwW*{P^KBN6*uwP)Akg+^94c<#Y5og=M-7n3$z
zuq_TK3ep|o_pb<kx~8&@PoF_^0Q`;RRh7&Y59AQ=$#K9l<<Mr)>k|VC`oXUb_}IQz
z0vM&J9)f|aZUe;tL66Hvv6ffcS<<OP>Zzu1t;rp<?2+}<y9pc)NBxop+5BxvNX9Np
zKT6+G$hnq3;*U_|ql{OIt0}`L0C?vtn*oBkitd<(ljp<Vi1&|&lW`bS3fmZpU<Yuz
zNhp*ViYjEyK<P6mOZ7K#l?vs_#3Z2koH}$!LI>uN(ua5}wtoX;R0Ci4C>0sM>c)sG
z8i0siG;^{<9_8&vXmvxx0l5`uez>Mb4fJX~b3#=;{ijcOA`i!>XW>5fmR`Q$9k1v8
zcZ2DEf!hUifZ=Mo4PRx(v-?*{(U)!evv@@oOU1+Y<%otG-ROQXJigCp3M>kpI1vqr
zLl-N{xPDu~Gb=vt+m;^?973bLN&W7gW6w90+k1MV(g34Rf;Y|z+GpWp-6CF*8%igE
z{@kbQ<+r}UhEr@L;H)1aksG5pQl+@7bA78TNi*v(i!5x;e^U0i?(E%nSy+m~Ds$Y^
zWsIenUJyEd3Ho05zKXxn8Rlf)3*2GLUg++0vzGqc)_$hjuo)sU+Pb27+L9LOB7N`k
z-QS>%^;^$t_o<)w^G(C+`_i?lkIEhqcd_RymcH=m7u1McTt100&n)d))=F;C?`O|G
zo+nS@u{{et1sz<q7@X#iUVGWsG|1%p1-LDR06mW-M0=o9BLeNmIX{M0v!bY0X^>G*
zEJOVfLyFZIDE}rtp(F*uKW6!_1xqo0Kt?~YO#b(A{NUGLM?_beuz^~<f9mo1`yBt^
zK@sZcp`AYd-RSZlM8@72cv4&1wCL+?VMq?IhKQkSSxC@rFJ?pwo^I)`k^VVjS*8A`
zes_P4UJ8pyx=~D9``k+^jy37Kxl7us(#VYC9tvAOZuA%I6)iPEVjH=(^;K5oo1<%F
z(gMk`ovEsO$PznNseF;qmvi+p#_SjuCa3*ITS*7#>2z6fbr;Ny6~k$gQxtj^`m~*G
zxs$-BLRHQ2xa^5c-*z;Q{kIDes{mdU-ox6K7ADe{rVs^h&A0{S<VE21Wg3Kx(Y&uT
zQn~-&x2%?iAja^JthKIL-aPSb7d2vXO`-n<Gf}LW`q+ZSkB&dW5MSq&(=-~5*{J?p
z3LZv!hyDw5<pd}GSF!d4-tfx{dLBkbg2>((EVFSPk?g1$7HT7_GzM=uy{g*y*kK$#
z-C$YuRYa}Nvbzy|K;J<vMw?7Bg}0gpTeeo23_IA(K;LVvJ7Kjl3gMU`yyzy$v9pq*
z%_{@UBl{08i*UNBo(2Hl3Y+iL539FPdoTC)2#?NAOCk2^vxnsA{FTm8E0^5X<pq@n
zh6WR5&)SX&+hZS~659WmXcQK1jnXRv_1{TQP-ewfPNvB530o$)Lms>n-1j>vHlDGR
z22$Nm^fTPrmj!y0oGHSl|2dc2uT%dj$^V=`=h9`vKZgw%u0(KcW~`)c&ic)H=Ir%5
zr5H*rBi1wrFxjg1%?11kNBWB+|BGP$ZxhNQyx<e~d11&9BhDTz<dvs>e?xLiqj&yO
z|5l~@CGmW%vp?x8Y{$!%{RG4`no6-+s4Phn^VBw-nGJm7Rk2o}#{jGAfo^+l*KGO-
zbd#Wl{NdJLRlf6uOAq?xzjb8zfO2&UH`7#7jFI#HY5ky$F#hW8{q-%Fxl{OdeWHFo
z1~#E}j4Hjk?iWfZ4dEw~JMX0!AOGYzx<jtD;5j7HjQ(lWns4;^8jajt!Vq+2@WLlj
zHMIN&dua{Br4X7>jc%U{ji4e`Kic~J16b&K`$a!)-T9p0>cF$q&)7YhYGJvy36<^(
zAsd-qy)Xa2NPElRxVE)P(-t!`qs7c@F*B8z!D42xn3<U+i^*bUS<EVt#mrzabe(hV
ze0}?y?%NSFKNL|Rs)&lc_Fn7F%qKm(ocM;lsz$m-Y%M7gyu~Y0NVVS6;5j2qL^UXD
zs`SF^1rHN4MSSV_JLC_g)H*P2e!tTS;L=U}DX^&joIugmdC~$>?nkU)Isf=8z>^`J
z^<qrtcwlTu7;k*<CG<<@-T#zJq0~jK2ui-Ffuczi)SfsHm)m%cJC(nWHhVT@pZ|;~
z*@^<&s`{HGCx3iF#ZEb@A#uFWuWO4781dHVHw`CjHYgVpKY@3QxPW`s0T~$J{-tFG
z{uKiJzgQyfdlc&o?B+Qn)Agsw_xSOqY=-Ec^nrx?+JAWzIuJLd>ZI3c2N-)L#&Pt$
z6N3eQ^sHevNt;R$RjR<FdJ4dBF-nl|wqtRuP<nW95X70BgedF8jtk+-9_M+g!4W}0
zY#)>u28$)<M^m&aqn6cSY9U`3$CL@MpII1vT%)vmAc}PGrmo@AFUU(F`b59DHz>&@
zuK307cO~D%Ney<vBRibB(ZV^?I;^gtK~2emE}L;mO(0TbE3Q^SeXBnYN=r>J8EZS5
z`no=reyr$|x>>SH$G{bPH<Veqc=(o^o=@=1mWa_BBi8XV*>fFkS}5CiX+K~MOV;hT
zu%!~|SeyJYBuqDIEcFFdEZxEzDra;{Xu%@;882?gAdnX=ksm@oMogC#mM-qQbBC1f
z>8(yY(GAYSg+*cbUg~KH$j_~PahiPvQQ*tP2({by#-AL&zArXx^bxH*vrHWH2by@>
z5r9ieEm&60REnG)H-CKvr*{gETwYBI6Ib;WQg47)_~&tu^bEPpwOhXu9kPwUm6Dr~
zQbvd(o5Q6sdm>uqv4AYsVwx#GIX6~IZ81q2L}Tb+1~yA&Q9Jg?KH1TZ=sGuXI3E{!
zd^V7F?W3Kq&pctuMnt7oe1gafDQA|>;lzbvXIFcle8mOPdF{vfuU1z<nC0nEl09J}
zIH~*)+vZhBK1}QL2_sG)x*xxO?3-jPhIihfe749ViP)=VjJimOhgj#u4z@n*M?nKb
zs>n?5!#K$sYh|d#&U|O)N2nIp(nakD3v~SBf^xC(OPmze)%6Q(y>4A)gEmToHKat`
zTF{8JE)gO2n4R#^g)5HGH#(7`yxB`^B?8rONegh)$9$NfZ)zGAfp63}&IGQ8{4cBx
zNl&?E!WKuF2MfCsF3^CO)kv7c2Rwz5ootC^s-S0T3S9STsO^(-!}X4YsLo=Gg%%ky
z1+Ym+x+MH~j~AAj90al6W0+t;YDrjoHi@TtLuY})hnGI>5!jAeje@{fn!z^ylrfna
z$=4k2b#Bz~N-A=cKR>{RX!1Rr+OYDSeoVYx*{lnFz-TH!kZ$dfulHyLgPl}5jU|P&
z^OqoIfRK8(YW#D#oFoj)sLQd?J7eY4VuFR6lw)ObVn5VTF^?|(yM9!-@E^=UXT;_|
zYHKCUzxW=|(2CgFGUN()e-XOffB^Y7-vTFXEW^qI#sN&Q&EF}2wYd6{bz1saKlJ43
z7vgGrg*VX}kxC1yp)3z}H-|>)Q?%0Xkb4|8a4h*@@$WbL-%cMKTqen)*;)DxZRs8f
z6tF3Ja*Nroe-cmJ-EAK<B5N{+Y`rgjjpQS4=H&!*zOcw>Sw(?Tr>dO?J0b+xXAq(z
zdQzs>y9p<W*it<W@NT?#4p*zu&e$Rjmv^}IS*%D<+M<T6R^K`dx#IVrF4GYO1mNWi
zT;aH+YA*HKg7o0|4Qqt(bfzr|BX>Adda%MahqAZvj<{wB(6KK>dlymGx&2V)ZCqKD
z{7El{TJjUdK$_^g@y@IkFe{_~MJbdykOBS75Y492txqAmy5yN_XQ=^}8Mhv+j{=6@
zHbY!!_e39<AwO8q!O`z}L9(0!!x`nH43w8+VGrEBJ8vCaCL@87)SL|5MnRtdID&N?
zw)ORHl^ANO5Myl!K;aYGwoa^ujVB*W?Mt@0IUujcgneD}guD>+4K3|Ibn0`{Ks)1I
zz!nglh={4fIf)J8k_|ak8<<axs&E9^SdVZSBppO5uS$ePRalqgo5OP7_zC!*P~2;R
zw{9*b9SW>1_MOo~DEj)TTN*%)KjAtCsk*dr$PPqANLvpl7e0b8q=1+XVuftKU_R`N
zo!*9w8QiKUW%x_dxWPP1T~gq|Js(Qe?DyVtIzygdzgkW~5q)#`{)g&-fKZ-cChq7;
zY!S!9SAjEw9Yk_bXnKL{K)6Ji8d+BWN-1xq@u;CdbZ&RhiO9p~>~6Z5{ddymB!?5D
zB4*5NO7_cPR3Ki5;rKq>f->Q%WGP#@pyRJAclW^YM4eG89>$my`1`jDNbi~?L8z?g
zevCMt^r@F`-ctcBhc3~Cb|4M_pTmnXc*Pz$Fy(kU-eVhufa9mp$yt=BB=Odl6lc>A
z<cX%xKBGRf;z89lz)TVy>J}HW_8S7T+r6MJ|84liM<syE3?tMk)99j`T{wRTGK;bY
zYdKXe<Q>I&Ldy|Lb1HP};20lxCh)oa*$(K#ip<~C8F)kOfdj+jOPJpFv^zL!xSnr~
z?QjH29iJAp^vPwnX)*YG1D(sF!`9vmdFqg%GTKds+CPmYy)RYiBHS7U8S<Xuv7)!9
z+5B%b0%7rDzW=yb^*ye4AQ^RAKgr6<A`tSbJw{he)czGDd-(1B_<B1%TWcU>X=Np1
zU_fj#5<66**MWk9@_lqv%GAuPptMwCw6^1KBW0rDhbA1z`rAx)|0)>W<QQC31TV3w
zEn<!Hrp(e9HV=axT}S-+p$S>3zmO(#ge!oew(zt2lE(mG0H13|NBYs!)pVs6h6fy9
zfNsL1uk=Io56c5{pA>Wu6jJZ^&u<0_s)S!JU;HAN5X!dH3^6llsW&^FvOyF?Jd<Ve
zY{8@McZ}=Uz{zPRF3J#-(k@tftaV}W7r_;mScuCB8yy_(UlMgX$G@pz1;JlPgIFwQ
zdXZcSzq+1pmO*>1)btLtnzO5RL=M;+wYSk6oJC4NE+*}#<Q*#rwBX)*Apt!*bg6p^
z2*UZ=@if{Qx$o*Uj_8acJsc$auujx;!^Q;_n4NV);z3d22=+srw3IOL`D_;B1IOY-
z2u|}sqlg%e(yBNSO8@#o+P~IxnsQ2FY}fobOYkbN*5BVUE?e=#r-qz6P_j}7wV@CG
z%NKo^aC4dx7te<7>R&&^UN@MtSL?CymoGv$5!?|7XP|v2`K7bzf-_(cd0bnM4+9Fw
zQ@7mI=%l#_>8u7+T_Lh!ISw>;Ph^MzNT+dvcgQMhK-^o+ypbFo+))MZ&`jM_OU!bO
zkmoW|8g!k~RZ;&{mf~Wip2W_y5GbR22hnIf{Agn|AYSA+`I5StUEg9CGiyWNoT|8G
z{!1w2+GbzkyD<KMRM_(`Ab6O4s;bWS^{?$0q2ROb`C|ei5AGlDU9<LAF1is`2?8I4
zSm8AHpl~KH!M>U~Wt_(RbpI)|k&S7L_{eQY!fi$Nmvw!?&%+1KjzNM~;}W&|SGVIl
z>aDH4sz;UiWehh7mL=SBRDl8`%Gkq=jAZ27xUlwgGOF6j5<+Z5{NHP%7(zSFzXAyU
zK*L&T*&txy<M+7^n-!}*TTRiWykL$ZaEH`Crvki~5mVF-_o5`XSx2!dkxB}Zcg9Mi
zRM)F4VDyEcho8|Md4GuGyj@ZQU-v)1<!1ker3)(Pzg+qrun-6SXfNWw?Ydd(Eo`yJ
zx(-|N!W6TYH&3xZzO8_vV9OJXIPPxzr&FtrU>({QirZv&Ru1EKln?&C8S~El7dn+)
zg3J7+(l@duh9-iMvbdn!3?Y#`6(JWkUtP8Q4$=QM*#LD#)POv;h@e>cU$$Eokoxy8
zw+85$oB;9iVdwGw+Q!_Flav$`91OAE?h5~Me?D-sSUKC_Zhv<)3!dk511tEr1@7~>
z9p>?{;eHL`59&WoyzLTyfQB5iaaUQJuTTdE2mPLc7j8g_f84z9wYg+OeyI1)Sn2gl
zS|}Zt=8@bHO8cO=wLXHgEmt;-y(PAh-*4`Ru`fr*+Qx$LoUj(YPSmgwsJcFO`GKo}
zc+cPf`58s_UzUs|KIQN7PJK%heX;q-?VB2PS_)atDs|??m=gk1BzZSU4D1qU8oJS4
zHKELEa;RnPX_EQ@<4WigK(q*nnykW_rki%ot2Df1=pkPkV4U*soSYell6TUyUB83g
zh$h6EwmSxrP?f4|-K1od#E&^P;OmgMye>v+tm9CpZ$Rr$Q!@IIGZ6x50wIg{NRaP4
zaMD4j>E;mJN>$zqQiXi}YU`1OK4a^<(Gpv|)e?7l#&j<SS^^Z>e0#sw`h5<Bt$^Yg
z4}Q?#5m_-mjfk)tI@sIDE?to{SzuQ(M2Ea|9ampx9-A8!Mt<m;$Z{!VEzZb6yYPS|
zBvHMgstzE(jcGNQNhdQNHzQ<g{Go1b1e`Y$>q<Z;m{*1lWHc6o$eLdej2TwZWW$;6
z3@0GMEN!JPSnrwbNbBu2<mS|^5d(*Hf5C8ku?;W#DLv9MATt0%gkKadT_`v&MU1`_
znjd}g9Bo;^*)%tey<RIOaL5pCNC&}(V5as(5%Q4rww4HVzFo2P_&JOJCG}Px(<V_F
z>r583g<<vqFWgzxH>k5PkkCL=kJ-8ADUCcy^0K3Iag{JWkMP;%`4c%vVB^LbI62rA
ze(>$2f0XlKk&R!l6Lu-+tnS^VW~TW}M{~Qt{`+xOp%O(jdy=8^dNf>i_AZj|Mg|NC
z%@)mh1vzkkp>%yb%*f0#@_6m&5@I7MCYg$<b4l!NQ{wF@`=ZM#(L48^u-=;{+J&&r
z$$~l;0+a0B2(`f&52f3l<E|So)|D*K_tm^a=|ROxQeK88)+@m<t2PNj2V`0j{bvfu
zn7<iy@o#J8Z;Sfb$AprG1{4DWgHiAclm8RE-%U~;OkPt)%ch?Wio^Ra5bnwUL-V^q
zM_#<dUp97#mmco~w#3BOJz5O&rUa>o?2j~I;!xR4)OripXjfOMAAh8k5R6O>KM}?l
z;ry@-c?z2|oer1}I~;43s=~8?w6*ocIl+f>M7;Y`V8V|kdoL(VGn7!hy8iv^GjsKt
zKMDI!`uZ~$^B3p!js9cLgvRUpnPzqEz3AI1xdFyn)Vr{hlM0JZqM{}MZqI=MedzXB
zcn8VuQCxUO;Zej1Tq7`sib^HLekDchRV?)Sb04S*Y9vKeCb+Hun$YL;dI1>}n;Iei
zf_N7%!e8l#%^QiZZURG-J+2T_rJ}R$@uce(xuU$VUbf6kPUcr*WEKe>7NX8apAZO6
zAbJL_`(19l62GQC&ux8@Ync7&Z)*=B#-;osMU)IGVqj@2eN4H&1~RW8iE{io!n<<a
zx<3{kpTVt+9VETKlSn^C5c}xUNbmT95~9|!PS;`h%Qv4v(ZrCxV<|IeR&o=u16(GU
z2?_5;2i0?sI20V(=!jW$Vgox&2CXEs6~ZQaC!91WOgQX$^Xn$T)NYwc=B)#0nhh~B
zE>U;tJm%nc>;mEyiE1ipaDn@hAD!YD-F3=Jk<*+xMRJQKE~Tr7&UfqMtlFdeM3gX|
z$85)P5mFl*G<<7ComnhCtr;}{6>v$Y)?G@J$7|G&uE@xe<7nH9VEiH(_csIT$>pEg
z^8LXeyAbRJ!^UsVb1A4j5<NlI+h76sQb^;>?sr;=T$&U%37%;rM$^IHrwH8fnZV^0
zc`lgqDjbgG@du_waF}1npiA_GeA|SGBT5T}Fb>^-nb;J40M8lkc1D~>bYZr8LNujN
z&AS?H)ve)!ak~<oa9QZr1ZQ78eL}0KEg<(nE-uJEl?a?*HF#&o<m=Kc;E{v(!U)?v
zng27xn)kiBtU*b_(W9V&Hu2;vYnj=$m504t2=nRG+PbgTjKL0a8J>JpH;&3%vrle-
zh!0Gvj;8wT>GW{4)$cRWmpk{b4`y9=$M4LAn@#6sPRcTK6W48Bxn8R?#V?A~l5sUL
z0jPIBLks+c_^Non`mfX2A;P-Nq?*kTvZG4cQ^UGh(I6?}A|mc`z<{1Vf0X|N_ryOv
zK(aI|D@$2lKQ=lV0Rj?o`)s8V&}4<VzP^6dnD>UTw6sLcP=YK+7El&)dv_HY3boB~
zh>e8><?ZeLI{opA?Du|~XEK&d6J9ngO;Aj;^B3p|RO#^`<NFK#d4wRA4VsaRx)5tR
zvwV(0Or0>0YdW-fmYV?1PDv|6=SwNS*XnS5G;L|B`**RFJgP%({)!3Jkr3rQJ0%<U
zA(d&*p7ucQlrm}qea>Y`kLnw<VCIdi>0hU-GM*JR6O7TZs;lNFQAi`@le!W`KEmv{
z$+;)Xx!A--H#)(06~14;(IDAxQ%0X9(K~l}4)V}#eIke<th*4YQR*g{!^pecek9Cq
zQ2Unu3c2#-cz^Lg=LbOzvSQrf@pMCV+YdiAF2SXVWl2D9^r_UJLe8Hvj@^v(53lR&
z29*+H5Bn!u4c%xpgl}pDntS6TPu(aIDKyA-{)8i>j#zscbIxy%ve1Gf4qCdL%hKNs
z+`;0$Hd@{We(O);R4a9eE(>C#pSjCD{lY&zMP7o@Ga$1=5hCIp@mCN}hnjHc@Y^&&
zn0UJ6aY%xfRUGrVZuko;Vw6DK1T7Yus#G&GX3h>>?6uXJRtuBiTzEORPo)CNrA#7l
zb<c+&eK&+={E{T>cca{`<Asn>ac2^$O@K?g|D%_~W+h2<wyNNHRI2Ou=ZF*ik#Dem
zUv#gt-S{F?`f2Pq7ISWQJvfrfNM<8%A)-3!68U=U4O-<CBCCj8v!RtMrD_TO`b5?g
z4$JlB)M<xyO?>p`Orx@4;d5rM@pv_)kM(8P{;<J%F!%@LQ-B2J|BZw&3d%D52SMn4
zJGewP4K6PXmq_pZq_Wn~(2zu`zOs@ol|d&|HjR;#jI8kO>7)irh>n`N7gU>j&7!9>
zr79{49)?7SHdhYycj5^YeLB0uecsZW2@gKitX~?(eS5hR-V_AMFByDGXRs3H2W*Kn
z^)9uae<|835Z%iyh}Qo0ovAf2aD4WQ$qho>?qU+h5q`JRRQPz`7Vjsz%!{h+IfGX{
z+;7Fwpd958a%Z6De0XI10<<hzUN-1i<vPFXU-n&hxD#%hsjVPiJCB!(nl+MTWLe#R
z=17ojVm+q|p)>3om+Oav7q~m$P{%(eI<xq+$rci**3H^5S!Y-|qg=&T5X9aCh06rm
z1WauyU+zdE*E@_^5p?J)pk>7QHg?w8xRZ@(DPe*J$LWTZK@IFZNTB4LJxHAY`{fj9
z%1!&PNZtP}sJ6*ZjfK3MU`}LqfVu-Jd>z=_GyvqE%_|CF=K8;%8hk_wy&Ws|TWo+j
z<zT*bNA*sdhJ}T}lTDH@^t|pfK{|qJpOQz8_(7u5U&$}f;qt|BMOB1-szsRcV+vLJ
zCGS&|%jc$ArO>l3gcTQu3un~FRya`d3{=GVUjZ~&mzF?=Fv++z(v>p|mU<0P{!SFj
z22#W)gd6^NzqTXr|3?JwYzkbl_TapMS0|*Sun>%wm-lF~GOaGLB{w&h8P50aNZBZv
zhk*gn6%;S3-g%Q3b#$yJxx4K7=w`Of*2LQE@fXU>^k5<U1A^QAb8l-N^rw{(sg?<|
zs8Rn141*;K5>HT*EL;s8HH77A{w0V$eFPdt{g>$R|0PxT+5*d|SS{#!g0WPs1I@<9
zX5?KN01jPfF`e5_yVePb<^M&U+2hL4DCL4!1qJ~Dqcr9gZfgRBt4G1dr;9f9pa0j1
zA9PE;&V&2qWDy?O1orn4#f(Mluk8ZJpO|PST_=w6H{d1}LI?71>*D|0!YC|OI`nT_
zxBvB+^VGu#1a07cR9A}|85J;NK7&x<qf=9<dA=N18X9z(HG|s&VUWu53JO?r{`fp^
zHQ<WEhvzMi@Som0CyExR6tYnymOs@0W^nzz!~3A`qz1TpQQkCaE0H_B3x%}zLx~aa
zh3mZp#%DxnVriUWB$}yv$oTx4w>&fOg;@q0R}%Fd9ii;=!_4K>Ptg5dxz=oQI6E@B
zy;%B05OM2H3e+_>bE2Hv)lnY0WD8h-d8nWIz_|!sC<?tn2SqMdhcZs`79;mg-RsPT
zc!I?^m2ek`%>KR<FR^U&C+Ke#nBA(^BO1BJsP#vNro{HOAg3BBn$f<^RyVvpasP5^
z3CxjuOH>NVCm*Tv*<cWpY|7_<3i&HY3HkzODo#anfbMXkBFTHEx^Ve)PZ%qy&#y#F
z1`2-ewFO_~9H}1GSzVh~X*HDOEJksf6n%KEx2cL>QyawAlFjN}gMfzwFJO=f;;ldJ
zknhjqBqiA2Cbykw$u@97j%pBY(f!|oWFY6*jVSh6XD9!5o0*A;$=&59@nsj)%S`3>
zGI9U=6^njjLzCg?zACLohs)mro+lsCz4H@o@{W#<n=9C#|8<>H09kLcl#?}r60<FK
z4nG#-kFKp2CKqZEE_F7xwJZe<o^SXsQ(m1=S-liL%5Ln5LmOi;UzxCB=~Q~|$;^^1
z(Dx@R4R2HRUo*$i^a`?%8x&Xph9UgN*<_5hRt!H=e&06EbkcGY+oSy+pIe-Nni{A2
z{HsdTQ3Ac<DZ{eFS(m6baYLW#LULQns>InT__^Wh;arnKwJ43A^}Df%R!y6|=a5}D
z5yB-KeKDwXp(3a*v0W*)%2q_zua;~rQ0%s1Q5Rc5bYVR2*w41_0JEyiW-4k+z1dnS
z6Eje6eBa@B=PJi?l)f{s{-@~qn>Hvr;;xzklL`@rps{=(ZiX~fBK)Y7*wwlmM+8_3
z<9@hRiuORm+p*<rrZm|rtK|x(NjjfpN6)*Y)4tj^A0smx%C>{U0eD9Hux3z4jDD3E
ze#*4BMp_vs8CQ2~%`zLzv?^U+|HSzgW(O{*BGEP0V8-cc^o$;zQQ>w3x;t%1a~Ih%
z!Y`-gKzUE|E4CB0T(DGE!7_>|g0MJEWgq?O>^1tI9ZBkgo{M%yl=gwxX;DJWgh=hr
z=`Bn-V}sVPZj?=2=dD7apg`UDJ|4R=;rJ5)?9Z=odiZ0FkvlB=G)$Vv7JW65bo~Ww
zjE`epxOM_IVw6MJ8YqV;V>CH7-i*I>baIhJYsZs#BR!-8=@lUNwK7Ndm0r~X{Zf^m
zW1Zv=Rdud=?HLKa<b5TJu-D=*QM41z-}C`0az{W!st$|DKRM~q@@#@|YwX>)Eva!M
zBuS1yFMj9@qkSnjMsXP_++3*jA!90Q%k<}+`++Z!FCx-~<#rTz`_gLep(pxy4>vxN
zeW@e+_bhjr^DXe4P2?ZS{2IV4<B79zDUv=$b+ogcvgF*IWapPQ-@A6e@heEG=9iud
z@k<zRT$>*Eq~+5W`9oW}TvFfgP?Frtx1IX`aR1IUpWH#j6tXxxNl8f)&>+Ua&F$hY
z!)OT1xUH=%(DLTx@+RZpW9eV_%}SW&A^#%7Bq_E3%3ewga3!d_q7ME*Lw>Lw5j!ma
zB`V{tu15rnEV*zi9|R>(VU^6BctIA?2$tudtD!RDt;SmD-Z5WHg^dZ+`$RiN|4^VR
zzR~ls#Sxz=O83PzPiW@jE=z=LQD#vG{X&~2r-<q_+AU{J->`J^(flpB&#EYRO{4pc
zxn&ATS7htru_p|$9_gYq^XO>>`thfQeR{N3plF(k(v&S(>*mcx-Y@_(jt4Zt5@Eev
zKPYlAo4jEXfEZB>MU>qB2cL$s5c|T2{ooit(qCJ0NOt&FdSdIS&jNyjR0by|bN#B}
z<35bU<)xkQbPfyi2*V1eDAKHRYV=8ms}p4Ft8Hlayg^q_Bg85j-ol%npYL<zzoNdW
z3LUq=GzawzmgV_{$9W-!ya7wN-D*FrJjC|Z#6hMKDu}y6?hhDG+Kw`Unq&C3jfx_e
z1k2bB?m`2qv6l#8L^)xL>b7u)D!qM>(X0L#^4NlNPTYUr?w!7#rOGp|8xpG$!iYn|
zk`k^f-<-Q~beuFsSU!!4`$3fFw}i}T2VZ|E2Q@}5B;2nq{)`D&AG<c3R*-XU7PD`s
z5`6YSIU9c7*_$L&OI+u~Ox|u?rap?*j?IDpVlpb}FRFM7*-EGtw~&=qXOl?h;_WZ;
z=N0D-A&14{iIQL5M*@u&-P$Oj@h93kuoG`e0wkC3KFrP=61;Ne^@2$f0w;ZFfSp4c
zjxK1iHTqCgIq#3r7h%&c2%#Gu{@Gp1-{G+Iese~yra2g++k|HHdJkbuI5&;-P7C#p
z<UIr}9+`1_mg&ap$6|N8B8C1rjR**W%3ro19&p%E7>w^U%?3n#ZodaQloKGTF-Ezn
zFF8N=;)V#oTlCrhgnT64o_|^76?`!3Ox$z?qysgCwR^e@lc>u$wysxH0b2(UleI#n
z?f%h<Jx8DQ!rFko)Sn?KDlsu?X{&Jq@XJiT7r-Ad{f1!TvuzI(?8o*EH7;KM3<0$a
zJI7$ND=y?r6m0Tx_G{+&4RXW6px<(x_e`$|3<)YUz2yTmyza@j6y3s8L^ylFghDKR
zf4M_XR}_f!K&!?ZqoO*3b(_qE+vqdc-c=OpPxHNFUb2Rt(qsI}BFj3fT$dHX(6ggR
z*iY>Yo*w%<obN#v#qA8oyo1|tRP&DO)VY0ga@eGNQ*ST{s1Dbl@Gz8wP=){PQ)9wy
zz0)ii5aCGt;g#x$Yk^1*KPX<xX;fv(NiXAf<Q8I-k=13~Ryb#Jg4no3nZeAdc6J5_
z)IE_!{Gh=n{!aKqQeWo58RUY68aT8&M#!~wa7jDPqLfRf_lA&F)f_-n<+w#(uZJKQ
z5&I})*0`1E>(D7ca27Muz%N?ysQpiYx82zKK&x+=LO2x+=MY0o`A|@oH_OlxhVPO7
z`(4yD%fuM^_?z9XG$2cEOxjKyGV4SSO+EB<&CMh;h^6~A@wt8k1b@i``#4vYLYHVa
zh-X$MVzHI#^g;I1S2g0@a;7~r@wp!=0|}~FQJN}363RJJxmvxdakfFtsi?!#s}bTR
zXEPs_ibt20OgKEXz4b{U)cM@vP6eO=*<Ud#Bv2M*zXQYOcM%UaHy}N6vS|F{aYQJ1
z+FR)9m*Na)_6!69VGaS!C0Cb-Y~~XvH8C#{po~^`p~{P>$lo+nx<36tmMcbr*axT&
z*q+B@CR8Ha+dPoFKM@$&8b#rKKjq-)Hbm`>Z)t7W-)jsZ(b3v(Rt*2;8M+{N=l#?)
zYmBlWN}vJET$>Z%%8MSeh;pxA^NU(kL=0*t=+d~EGNQj31|tp3)+P2Kv_{q=dcTNZ
ztKo)GMp`P9Mz3$f1jocMDrQ+`M&|m&z=Xpg_2AWdt$;%edWubvG-7Wb_cBWFcXYTY
zoniiVbamRz>{l~QN=cLQYRoUy-EpAs$(f`4K1cBv<68;~;B?P-0-5Qeqo)8+5OoRp
z`FB}@=pUb{HFAyA-HB}2nPZC>c}@6`S@+*ryidtO(XMyQp5rEJi4#Iat$(Bo(v55&
zsPa0f3%p|`jZfj}9Ou@MmTI!D0Vp=_WCf6<d|fPG{R!@qOq-Qf57qC4g_<BDP!oX1
zJaDTLYz{Pq39+ib_h0)2kR3_eq&l6!6hzPJPXN4DKc@JN^>9BR=p-_G{hm?9l3IVx
zxuV@eD8`PoJ95sjYQ@f&{uYU;8A|#p=g2&$l;sK|`%Ro}e^%q3;F|?!-%Kyu_%tTG
zxA-z9$9C)`z!KkU3m8QEQ%PX;hdia@lgAA;{0c=>zy3-gsAhwri-sH=pNjkIfDfvj
zpdE(9^O{U9`8B9(%|(vc*PT~erqaP{O6<f$$EHJ>Ci+0A(y}jTQJ=Z)ekkY2YkU0j
zZ~P9@GFZj9nxM90F@ko3xG!jTCwtuVEL@=*3%lWzMtcHvI`Da<+c!pNSpju<zPcc|
z-pUkmyYMoQ2;NOV9Cf_QK|sojOq6-E52?mlRGAk0a8Q+R`v(_{8@xSv8iizdmTJs+
z)R*2F2dJ94uybvq;}SP4y$x7_T~vU72_6%*5Yd}F&o;EY3ARm}$}A%glcMWafHVcW
z`j32<PAaZT<XqoVvM<NTL2DJzqm=bk({HJPISL|}I>B{(<x;WVP|cCqRlKvDwNZY4
zgL*#dFx<^BHnP7w`H989$_Z_N{BwAxdX{>up!w#9pIqeCe#%90SGb>y>zJRyPCN2I
z*oyJ53jl^v9=l4%iHeMaRXz3{)KTx@*I{dzW`xxHX!O&9Z>&&!HA_V?H&qlFaeO<-
zdWl1r-bu=0o;QALh+5OAzB`{JERPKv3}Bp&+m{A0;RD~As+p#U`GUT2F5$2}faS)E
zEt)TE-LYfi@Ysru?wYGL*4>PH8*|t_O^21|ATvTY=YL6o<ipp|b7h(F;#APB#;h?C
zNXhVeB3S=3!R$SczLyZ*xPT2U*e?eSJ@FeYNCeGp|9HzR;_E?EqXVl$=;k$<(dC6z
zg-{x4v?Y2D?ESeq5e~a03Do^%RChm?i_^1Th~M)C(1{&d{JJ4wd#o5wS9=SRa04`G
zY7;~G(55XT>n0LD#WqY&<-of5C4sxxb|;Ou1k4x!nn7PcbE#@;`O5S+){V@62B$yR
zK8x`(g6IV0S3^(_>f~&4w}Mes6-dakKWbF6sO_{|U}L8o!XgGZ#l*&nL3$Znf@Tt`
zV;)4_b75vJYJ!go6@ts3?QUMIp#`YeEH@`Em(b&W&lAeQc>xXi>&je>-MPYFIOYQA
zWi^~dfqNip<Z`fS8)(Mlmof#xM@mDuk9nu4MC8$A<#(~Xx{7Dt^#==yfSW|<)(X(&
z)pXSsi_2k^eD&&JYFb=((#-z+I)K0*v{k8Z0J}Wlkqgzl#DpT|jhy;MvVw?qjzo_N
zTttFx$<6_zSff4r6wwT~CS17jIq?i>0vovcInj<s2STcu?`z^49K{M@I%QowA(|Zz
zKInVu0A$eL$D6wMRuX==Nwub2p_8m=7&A!yR0n|n^AkfSzDm$<rT}QZHvIiRqp<<M
zLGOmv4SF{jdhiH0XsHH+K6OKBK8kfGtQOIJ28&m8=T5FGhHdx0X@B%Lh6$9tXCW_$
zEXt%Z6fTuDt0Kk$kY|StG`UU@ODbc!b<wYP*-U*#d#1v=N69Kx9O1^s1||Rz&eqU<
z5l2j}*UOn_*n@*k+2!(fV#<l;*D?-R5a)fS$Rh-c8-G~n^Mxxvb6)kN)5$$x(N(gw
zo_lJxh)e@fPixilQ&z`EJQv#eIT7Hi<yaPlP(XDjTlaqHv(VgG%BuR+^Lyo2+0F!t
zD%!!k`_THm6ejTWJed^H&9_p{vY=K<8}}ovssZ$8hv}jXetG`eIdcHcn$dg=oN#Bb
z^4<gvJu64Z?Ya)N=@TZVjTQI^gO&K|`KPMPeOPR0DqzNO!8CSPzU>h4qce*4KD)WM
zhvCm6a(aZOnZrtbW;dN6HYz0JJEbtUK09j9fM}f&=7u=R)XO+Y$cGSS!tAkpZ}N*7
zC%{SEaKaXp5pOFA@NRqMn_erkSx%YvZ5q`O*TcZzD4wh$Hr(7u(R>r+WH@~5r_G2Y
zW~*ZKs+gbG9E+m!v)E~Y6(R4anASYm_F77xz5uL6+$BE2NmE-t5-7q`MOc+QHz{p$
zU?=Y;cg7W|<iWez%Srdkv~1&;pCKqB+skFJzfq!hF+0wwobe{a!pRu8?0!O!{@&^K
z1zz>cbDYsgr*;s*Cdcx#^<@#Lb>OgR`?`Q*2H!j!)g?|rb<#Z%yOas$E30%mh|0g(
zD8QN2S+@l@-+rr&dc=h|{AJ!TL-2KJtgO_+Apd1{^t1JJN@8#lML5VB@`;P=WRx?S
zeKDvx0Wow9IN<k)(;7pBm}G?KVBm_}Mj^PVU#At#>gWNoAt8a_<1yf8Rp;AB?5MkE
zlQYwX?3^=AsjzNrM0U9$q)TiL2l_=M`Pto^g2dhyyu#kEcEWY|b0-cd5LecXE8Ola
z3h63SV0ywrjf})$Q4z2QenB)l{H(birVM`;sX@IR5xle=WF=UK=DZ@Cc8p+w$GQ33
z{mBlAYnewbRayK5UaAUY8GE&y-8f;s>oXSds1nmR13uo)I0yz2_@oPQ%0}ttW?+Qy
zT<!Lq+dO{lXsRqmJK6+2O5v=ujTF4-_>vh$d!VP+cEW*}Uut&E`MJ(j;pQnWeqp>U
z7(jTLDhK3y#>+H%zxTkHsn-OR3W!JJ86)ORUiYVgS4^9@e*yNxG_O#c^@zO5KG4U7
z!#lKX&t5s!4LanJU|dmqS@Ng0X&YYw$)zZM(Qo^BXmkIOb_8&jT4(ic9FjJazXpD9
ztm9-K{E;$CUD_G^ZG(j$?43X{?mXn&5Zi_~GYpNkk)*iD@Rt4N=V=SGx+Z*SGdi<p
zKY~ZAqWy?-CpJG-)xiE5qMG3TTPxTyS9R!<p)F1pa#;0{0}zoI`XPZlzrgIfV`VO!
z0U8WBkjhPXvlmGg8RM6D<|^Jsw6~v&koHt>#CHklx}m=@WFSQTnWi$#{YaiqpsZ%i
z_VA?lU4aw%*}3Faj!+M|kDy7xLG=%bXq*6OWFi>Vrjn~XToF-G7Sk(~*IVL`!8QA?
zn3nfPs@LsFAsL^`&c!KW%5JVlKmU(B;+aDVWHEsVNgrdc4v;~+<4VXc(gWxTu*Nl6
z&81*Zbn)d<9n?C|xxU*YrO$1H{2V7mQSlwSi9)6g7I0|;D{B3GCAg0AT$H*iBh}>N
za)%p9)?a6PtU}Ls1z|?7cphjQ9zw-x&@mN>YLiniV7Pk_*AZtO!f%a^UT=|#?owsG
z?IV?=<mYNdwiL%69Qvl4-LB|b>RnKsEeMd1G`W;9pkK$021_JffoayQi}Ohflple^
zLv`~YKVabb{<VTH?&$VUO&t7y2$k*KY}3$!I`$QN0phgBU}tVH!z0;nI$rOb83H}K
zgkh6zU0bXxE)P)18iF0M%y4>0PEGYqJ5ndXXCG%c%ev3<)u=dL%CV=M4(J-f(b_Rf
z439-LQdIWGvh;ml3oK>UomqStWfyBxjIpHl)CwajxSg~I?GQ^LxVafzgIHdKCuK2F
zGb)S^OW3(rNe-C){R>gwfgtCDBn3RDUR-;>IfVTUDQ@YD*Sx4{;wQ&0yt#1{7gHhg
z>CI@m*OJe&-sUt49&x?QvP@`6J_|~?@+)SoJ3`n{Z_xdYu|5!47hU}`Bop;Bq3-}8
zP(B%5q6uHRvk{!wxN91XUI-_S6$HCqMmxLJ$uF^p5tnqDmD`VsF>G|P&|Uq!A&iyY
zL5`)qkgGu^#Ep<u78fY7Ns80+{ND4m?znrpeDL^NQGVHBh;v^|e^qd4v^Kw>H^Ifi
z`|nx?pi7?88>rtYprr|wp5JX(S&Z()`G+ELh{-;;H^Omk804lQgbvEtfHgB<6SYzS
zqafgB&mxblHZLTpnUkQ5=&J(&y`ube45&+Bz)zSdYEysnHIk%uF_LD7v%8gWJ$m&g
z)Vl6IBH=kKw*w2fCbr@*GXvkVo_{0((f(w<Pww9K+`(k}w)3Y4;^vu6*k?kI!d%0&
z*)BCAycozLiCz<1ART<>_3di;AyV&>DM7Qr4-t<2zG=tGH-zTDa?MLp54?*3a}KLF
zkJ{^NC(z!6s&Z>MK_ZDqH+!7Hc3R+#MiMxe-uRBFcYKoPqp*=f=3LMSi_QZ`w0U_c
zj1deYzrHczRGdaGz9c5do>vxj$MLyC>VM&7#_586kYc8#t~tSQG=ktGL-sD?GlBVY
zT>4f%YSE_%=0t3^H8|Il&T~puSfroNUyg~q^wRJ1oneV!3|->I`uGxXv)^%rYa8}i
z)OEX?RsxjK`nT~uCWtCX3Iz2tpwVf*^es$)?XFW9&mY)I$&?x}ej98%oyiOey8U82
z{7z+=MEtA>XKOp1keDjFCnfc&na^)rJvI+CU0CE8_2=vExq4%C8s6!fw>U04dh*A;
z>+5;sc_WYQ6*jO3u5cT+HVLeo+xI>3J^lC+U`_u`94lv&&mB(!m<T{3j>;IHB4sUw
zYT^$Zdr}g>kHSN7^?@Gd1)AJF%EL%|21pQX_?Ap)Dn}chX2tfdvaz%_y7CMISNe_S
zBp~>yQT879lbtW{pTAyHKuKavhDH%C{&K@8eI$^SGUcfV;Z^oYoa>+A1DqWMFdVY2
zLUyzj!!0k<2c8B8g^&9&6706}aK#xXW?>@<{79X~%HLg~0rK0SnOFNlysLykcGT42
zeWoiNFqu*wOdx@=-8)qWMxIGNY;&355mcQSTJxdpS`dmETEZ@tf4=6jGdv%ht!r!w
zt4^UisO1irN%yMQb)9gy8lHj&vAtPME5lWJ)WQnW#j*h`@UbF29VWlW#y!w9sgg&E
zR$m(#Inl;T6$U2+>dylwk7bFnM?99xfp|)^^d7_Wxz@MRbN2dSn-dXrrKkMsslmo8
zu<OX>7;`X1vm5<p@d*6#{pB&0+g7&F_?3=;Gk;8$2;2UCqZml_)^;n@;b@`nIA~%D
zBbA}fs}<2I>p~7Fjgmb5OXl2Xy1tG_V)RY`H_u`KitY;AF6C@JP+$Zf35(Mq!xtt_
zirvk#t>0PvlgeXIw~uKXXBp(L2hqBXHE<-(hVIOcSG2<11=y$zM}ivXlYR6nr|aQ@
zEX?yjy_~hsx*R$dyEChG&k5DRCmv&&B(1QmuB<I9JH$htFci#NFdh(@|CcKx(q<J_
z?uQ0{kRHxE4&TA7Ys22@1=!`H=GBolg&R{Y6yGI!IQi$wY1^UQq7IfRN1hr84R}`-
zgF4&_O$l<MJfS#o6N&!Nmkm$B=1U|IoDH4E>JgLuW~$LcKRIjRK|g<P1>GoX<SdBK
zX3{m%)WhZbcYJJ@>^sIkF8Tv47LY0S9I=@Um!zlwEA7VH%}Qd~f{^yuT#q@Um^+=Z
zhPREteQEX9t|8<ixoT#scN%`mZ#(6SDG@Q@Jnlqn8^isp#@rIIcYV3Lj#5R>YFAd<
z6#43oX51}SjPz7zUzMbiY#bXGG{gv2gJ2h?VyGIFarDCJPFs3|-hTrDD+7JDgbI1m
z;+(LJbuf5BI&bXA(4~s~cSE103<J#iN?)BXgaR*t5r8%-B2SE-WNgu*cj@9D1El7t
zqi6QS!5b;Iaki$nZ*Ur`S|<I8N_(oEkuy?>j+)Uq4hSw$D(h2_e3q3=XU7i{eZ!~&
z`#>$ku-zY8SDRR|t##(KyZd0~{OX+)rC<+k=Ob$PR#_zi!*VO(CKgW0y-|6}-I3x`
zGCTV50JE*f9WxwTBiXkth-q;P$A?lIS0|#y1Jt9y8Frg2{?CnRo1zUnxHd+Pjo72@
zd4X(|sk57I(15JCL9w_=ZufE&PsKJO7yDZ_V7+a44_fq}q;(_7ht`q}Q+i#j?_2n&
zfL+$lxxdp;=mw$Zrt^kzu$gRll|xzEq|*4m^%b4JJK(fnrP;9;WS8a4JAz1A7hs9|
zAnVzSdU9F#X6M^?K|^zLL6-B6UQWH~Sv9@j!C()HV)MeE_3C~E9<xi|1J4LBG@J5E
zw3~f3C5#YrVJ&F%<m=-Z8F>gH)hCb6=z_5s{!mZJNci~hCj@7!h!fq+sD%BD_ht5b
zQN-Etg{Z$H{ZTJZ(}F!ctCSm;ELK78Yspk?fBdtG*vZn)PTa~Xmf7opT|;E22f6zp
zNwrbQV3Ycz`q6LTfe!dlmH_LZ;lO-fy&C+-y2Z$Zs>+}Z@+CHeENigxYL)W{m#_Cj
zrkr^Zz<>EMaJ6HWli%s|NCz`NV1RC<+^G3&GgdZYwUe`Wy*<*^g@Lo`_Y$nmc8@U?
z5^;?9=LoCn3YT$BB+Y{qhPJ`@@jGi#v?`e}%mF^pZzWgDBHhsUJx;`D6%&VdpPA8K
ze7XAU_c>4edFXg|T5RB(FWbXB5=n)_4N&cQ#^{1T)`N+PH5b>f@jF%!gnTiJvdz8z
zPt6KIkwfII^(O+1#9+9}&`Ob=wR28AW9n*zcU~7=%1&>OcCV9_H=Ny8ICqh?;MvWw
zU}J)8R>=7!v4XGP2DLF+`ZVC%06j>cY-P@WL}bjZumL|9`xrYLiIy~OQPP(qLx0LT
z;Qk2u=3O{LCWNfAzHl3Ly?^N!gX|(Pu<TE$!IX&*)6)~vqg5kfEZ}LYh0}TWd*tJ_
zNQj>Qz&K<RE88zQ@(5k<@viz|W^)R>@@>iJEz|6(jwo8l*D_Qd`IxwcOijYLVtC}y
z1Q~teP7mB)$p86803WOCBif+LHZVvRCIlN(n!D8t&FlT1>k;U{zm(k;w9flmq7u>w
zx^(CA@|93~>Nh~#?5S1@Of#ta@#PSS8%LS87+b`ZJ~f6dEMoebT2m9*>nMMEoPIzV
z|M(>|&Li$KNcoqQdR@MHed_tJW&w?O!GG^mvUVV~T~m%mGM#6)s_d066eLP2I-exu
zD8&|LTQn$Nf3QoX@`<WdVgAkd<&Gl#0+jRA=3q6JO+cOJIaVBxPXdOI=@R`ZaREum
zap3?u)l9XpiBaQX@zhR=9m;Y!?k+!-AhN`5P06MdQ17iPX~cy}9c*rUHnv{CUL9Jo
zlCR2R8O*N&vr(^Axxz8>q2&9Ibi?saGPz4iI;YBVo_msNBpemeIQv-W){y@OK>hd7
zU~Txnyb1rn?m+hGr#=`rXC${6w!Tj<h*I`8A~V`loexhCx>U0oNRumE+v~dm2pNu0
zm@+ydJ(l0TeiJ6G$jmLOX2&1`{|FGgfL5Z;YthSbfO7kIh5Y?El;!bqF0>uz|4M$1
z^?rBQa(yuEA8pXdh8tJG=NE5RNh5w16vgdxMxk&4K$t}S2<Gy8$09(UB^LJd&~So}
z_4maNwH8?|3tyJF9Oxx}gAsZ;C%(SV+q7be8h@Kq-0W3E^tt*e<0*6swXU}v-g8e7
zHqO&T-PwUE%5GbCuiyOIiBU`v@^Jvt7YAE{O#dg2S-KI&*lFXlx}yg6KZcBi6FX8Z
ztUR*ch<_#R>1Sv~HW>bTMKLbq(TDZlIDulO+W$w)a0>AhjGMrPeR{ZHDBE>@E2igi
zTG1i21OQu?UWf_aHYC6S|H|Em;}}LJWut=;KTVOaFQiP|k^!-=_`S=J^M%&K1Our_
zy3Fu8ZkpLjl48((-48eN^08pKBd>4JTBtuUF##tpysE-{K~OhFsQc+q6Y{02r*~B7
zr|+}J#(WpfRi(di|2D-_f?a=<t_^NU5R=W*c!*c9O-}6R(%-EKf8K;nX&`B&w!^SN
zP{T(z5K24r2Y~J$Q_6ptYe=*}{uGFR+$+*`>VIe5{x_Mo|NL33VqCWe-{RQw!eb|S
zl+5GM*D(jo&*7gJP82X+u+s~^u=!mt3C&b065qX_uyx*!bIp#}5hl{C+%`z218bq>
zEFfK^G_l-JLWw(rKu;3IyORxQ-{(7t>FM{_&9_pjFK2O<*q5cPyEC32gs&Gl$k&+r
zn}?_Rk9(K)yJbRN;P$UOiVoa3OmWh7y2LS0U7P*We%GAcPC60cXe-=qb~BuozOT@)
z2Ta7<*5X>k-9ZK)zMl?qBSLmM0uG-Zwl7Sfr^(~4tE#~)G}?^zGU=!_iMCP$F^aDY
zKtym2`1}CPKL@_$DffK`=gl7ew)&18rJ}Ez+e2L*aprzVFIfthhy3~$#21&4|4R(K
zHeT^f>yzVOOn|=#=vCjb)2&P14-bEemuSOw8+b6C@y619nadGwc$J6f;LXBjDq5CH
zwV7>~uyTK4;pzOO#ZjhA;4Ke=ZLj0~kjFe;kkHqSy+KR)#v+w!rX=9h>ZgWHtEpBI
z5s5$>HNM3SN}tm-yj$kKR~0|NdDiT`dKhuj_5^`Q1lZ>KIMLYNl_hR&D92MIS{j%(
z`ioi9O+AVwry_3#DP)_&QK)|{0ZdEE*0WVPt02||Kgdol7n%`F5Ev8W%>nVz+rS-N
zHkAm2&%2Ui;R6}yJ?=$xK@lshToY=6{n_nwnE!)q2Hl26N*GQhUS#CT9_4H~=HoI{
z5GRdu=K#&Z5_ht<8sZ5{L+m7C=!jzh4!=gTusRBI0x$(n3~89CZxF5P2`x?$QcFJO
zN?{F&Tx*=LtiA5BIwySdasKaD^*1%F)8R8T-7B2{Pd+l`;c2Btxu^n^gXIuYt@yDs
zFI^o$ID>Rga*`^{7>YY%V?A+4eE3R7qdo|P6Bev8(bJIXPBAlW1T>8%$gGxX8HNF~
zk3~Q|C5#q@LX(<?qX%>6ALu@_S$Wgju{DgekY@TDSk9@Nq3-V@YA|#$szfJnocpS%
z=s_HI`T%c!Yz`j8ek@6o&S^51jJYTfu!Vk7%xsu#kO1&`(r5|b*br|4Q!&c1pZ0{1
zz~_@+#sTMTzt|OOs=B%WN04g?=lj9|<0s=g_*Bxo74Tu|Q*#<Sz=aR7je%{$h%d$4
zg?%pyZMZXxlRPTkCJV^NB$Efr@wmr1kXs9VNm$SqR0NsL0W$t{^mWf_ZFT<l?&QD*
zCVHakJoxi>fh)7==~>YXCZU0}t{0Kzb;KyH5E6mV)!}2YLG1t#W*{h$+npr$qAOgk
z%DJUCzup^#@EXjlbJc@jao>>$iAguIEz4LLXS@S39-%UbWRgh<CnE~HG0pJLFu(}&
zk1^$6to$>^e^k@|>U{eLu?kvPBq79ZkM9s2Fn4_?a1wZHMpFS8?41X>b0?xV+B4DF
z>ADod%N5b|s(Q{9@vjubPb<^G)m51?QjDy033w?nVq~PO$SdXYOf4s95FN1Y8tnsv
zW6<vC2JwdDH<e>mBHD7Wa3P)gspQe@*qr2CU-E9oB_zDyBc=&GvaEY2KLQdBlj4<m
z7I`?Nyt763EtFq%O}`|hD--csX={q@#487$T9@?!?AhH6q$S;qbLzP2tL!kST0XDT
zdnR+jN6hY1Px><2gxxo6Sc!OQ94?UFN|VAhXiI@bQcn|@QY;m<iyHho$w*L(qOA}G
zFQfc+Adqo-Q@%0lDHT&$#;@}O`340$A!s7md_g4(?}tFiFG{J%{B}V`Nok^z?V+t?
zF>PQheGjCkV);jZdDRcFz2c^^W_0u&B>`uh1aGEKs)TZeEQjoc<Wb7;PuY7}H-)b!
z&NRNdq&xi$DA-!ToeLUTJjNg|8^xrYJkl=-W8B0dIwd)?E0z$Y<;31JN=*_{`m9y0
z$eVS%#Ovc3{H=i7ZBXrX;<&eC8ihIu3p;#0NLY=kmV}H;cG8FI0|nA0Jcv|sIcHBL
zif7+&ZmHp~mDQ>DZQB5`Jo*}JiT0br{5qno6a3L(akNUKU|GMTt42kNM>q?!O%rbE
z6)Q!L-eYhItOFqVM9YP&m6CPClH+|$zx-6<0Xf4>S>?gdRD)X$PZZHih)`=`dcw+^
zRqJ28+DOjmCsMR1#=>5=kA6ZLQLu5)AJa5R!If?nUC|~NSB7&ff@TL<C+Kwxh)}Vz
zj!}Z9%ZX>8F=*fzUAr@p!k1WpYpGQCK2~0lwStpAieBhruiPMn8LHYxI#vbOqOx>d
zoFYDwY+4KqX+Tvezg8}fo~|X$4O%Yj6HRe@pe9t=W=rxGftb*!u(mG#93#PyrLV2r
z8eSO%P}d%<v@9juKR%>P?Cwps7^DD0wDU(?1Qm1ciJ9&KCzP4lGa?7loZ^WVzoW_M
zh#j{ovYD&~zhVUH<;s2AJx#z#4x(~rquDezRVDO*uVrmhN~26z5KAFF(1*R*S&PS3
zkEC*Ey?)deOxYAMD+)3Uv(bk@*Q2ZA(~QYfJHe+d3fy5{T+qbDRy3;0g-kt@7e&?M
z`>halOYNr}73{s@;gfYS-RlHu@V%j#PTP^Q1w}q?i}C8+8&O>O&=r4l<IXOWVK8xZ
zLd0ESlP3MXZPpp$$0MANyxa2Ohpo!rv`BSp_dmW|Fjtg3Qs55;^=mN}z6e~eYqe_Q
z^|?(^iYe=`5ecC;@1dofASpfn&=$+#3u3_=cF1$aH4;`I-M*7i0a=+dL3iu0|4FkL
zrTh!T{MS?V@0-CCWENz6nTAj$RA!!jNKrSYIdQ3?Ct|NN@9%piY}-V-F}4R#Ivl^v
z*uanjPwEUnl+}P<zdnm*q5)Bq_zsQ9&mB|Gn_1_k6H3SzYrHvS0<1TOC1`>cU3LT~
zO7ghM-KYiC%V$Ulbzo(d7S->%rP#nTMy@FVf;zIyMKlLc&=2f}^~c;#8$xhw?cq0!
zw9{J!l~B$kA`RXjKOX>&`(})=IPH^Cdc5DXquJ&MzYaXLN)nf5$!I5dT?#HK62a=(
zT2JWuL8O7tDa-70nNyeqbud8T#tbELyf}QHyS&zkn8kv^5xj*lF3)PK*?GI8^{I{|
zzc9LR@U_H=9lSGJtG9m9(nY2hdCr-~sVxG}Vu7#od|^4;bVWHm@ap|)&5iXxXnV`3
zw%#}Ix23qd6I_bBySo(k;KiZ1wzxxacPqt$Q#`o41b25Y);{_DN6yST^UOML&Z|vW
zv3>8I`|{8CQVsWE7r%>rSOqMIfbyAG5ZJNwscO|5_l2)2JUNk9*%;sadfZ2^(Vy?(
z91`|x@_^8CC#V?1F6`q%aKWL@)?nN5^z`&l#_?%g#OO+cElwGPNJ427ryQV#7+{+D
zDY9Kiw{Irp*?AoMY{TtC!m(7KQXtVJTXry*m^Y)@Md-m%EIxpw8Q7LgbSL|~Gq_8~
zjTl@5l`;VVlPQ*LmUf%F>B9wCdnXW=p?!gY8lNc+^hqSAdT}cGNWpn=LR-7X=t5G)
zpHZ{pW1yPyp0v5E7zAjJsN^lUhRuM!E=L5A?;z}vU0ly7_3@7aZ{en2bhLo3v~a?b
zY7CM?0ln^vNcFE6_GEW__x*|OO_Fa+nkcSTA!0@<cR-O91QNbYDI=;V6)jl&l?>p`
z=u0nPjrr0Cs}3UOMLgb!w$1B?f=(7IVWvubQI-8cBsr{=Oo3BvXS{gF3cSR=u?C1y
zy^`lKPAIYb9Y+$C7~_=eqWOz?n|Yjhe#8eNuz^)<V=PImCYCVPbIda2`YKQQ<!GZ4
z8_Iv5)E=}pKZPaHQx=NmPh!nuouuB^PE5Qa637XZ3sLX!<7(iZyN1rs14Z<3sD)oa
z7PnYu8}6{#_)|eoTM{7RuY`3pk-~2;+Ta5V7Q_u<5~-@P-T7R2vn+0CLy9D&>hD%5
zsWI%igUkLrv<Q&rgHdc_UFafv!1x+~4Ut!kZK}f)-@>B_Dq@S&Jl(X>85CF>klw3d
z!`|rlhJ~$SRmx4Vvxmp*S{EGuM}GWPB+g#<Mnl?)mh3*FED?n_uTq?)^Dv-NDc{n3
zX%EZ2R?qyTgADR(o3QzXH6l5PxAE-F<;4uADSvf3R!(RUY&ZN4mDi=eQDF7QYoDGF
zw8R_|4*XrzK3pc6a_;v=TF4ApX>-YK29W5U^*rx$@=l-fxE+E`bV=Z;`L+T<4r~`4
zJub{-PRIdsQCG$unC(9Tvhi8IRd)%<PIZQtl(R87pVSU5L$-O~+pKr%90n+(y>PP$
zo_p-B)KT-j$oTjs`_z@#NV_+_F#;swce&vpr{^%$bwZecXVQIlBW=)=o{2m!YmG6y
z{qs5pQ3Gjv^M>s2V&0U&B+MAaChQJ+Pjzhcs++J0b`eza-I$4X=vJ_z7|bSWZ1mqf
z7^rv=+`kJbeg7vo=tJKugp%Hywyrt863#`4qp`4jwzUI7rV9zn3XxcRYb!W#4{mFU
zBIW30Zhx13KT6}-{gXAqPS*8aO&)iJQGr26HLR|WuK&9`VsQyg%0wxfdYaC+f;nB6
z=g;pRYVRmHmcE698Awro67;JXgAZ(Xm-#&V)cs&z*>DS*6c<?m)oe)ZVaGI+P^z_i
zPI(|-dZ)Oyr$8^OQ6CZG-=lCIm!?_pR^h=__oralQ7FDspvd#3XB;RzDa(s8L_B8a
z>bULw8DrsFVg>EE$^_6(GQ*&!HwCu3<$cGJs5Hlt(!|GoPH<O@ei|`h=QBF80_s!D
zx04JP<}W<5U(r5fWE=Lxj!}+}R{?+4Mo|i?LjD#2SmyHvb8vqz>-SjC5?Q)!YIJ!F
zOkveo2)b95?+6E6*;{3n{b7r0g>Na;xmw0cP&_G?jn4LWqIUNf0uD8OYMib!0MwQF
zHl}H9<xF{h&a9F2R?KF9DWK$qaWft_+x5dJ^||Z1698O3My!J*ra6iN*}2m1qoM?u
z$0rJTfQSx*07<HZtV%AA4lZz6+tT-~i^uw)iXkW{w*+)|6Y1&Z%2M-NHKGPui(AzP
zJip_TJ+k;#M!8UI@i+4bwU52em7f?wBb;uOj2$sxT}H?u^6nS&&9V_j0s9{DAbL~y
zRJ?bJ+mm}0Hyu6`sS3N(43Fh^*hP(}fy8Yx*!C>B&I%{nbab<nE;OC|Q7q}K(k9Uc
z)FJEmu*|W*e$D5>M$)q!L1bPoHmYoz?=~MwOa+j2KNwaCW`=zMOz0qb3L2;1(ZM=p
z1r>U_xqSSQ`5ZOL1RZr!44%Lqrrwp2cw}E6#6o$XDM;x?mH$Y&o%@dK(b!vZheo)V
zC06<N&x*TfvM8*a<<?-35`Xh0XY<r98ydXS(hAAp(Fgh%C_>CQbul_JfT^I64-272
zrzox4XiLNHr|!uw>Umwkt53w>gTxDBJ2`MN%$kTh+|Yv&_<|NCv>UJQE~k#E0DXa`
zZ{Jp>wayYIcH(fyfN&wZ<)KIzTN}1r_!pd)u1a|GJ*p9+e>`;DJ61<??PTbq-l-E@
zh%J4hwBrvIXJ|sX63FRJ6>n6DS(4qd{!^j4U*QsIn#(vwPA#u6R=UX;<T1Y8E=E*A
zNh?q1)7jugl5-!&VZEU*Ez>xX-&fWwL$G^Qm3YJ_O)^NA*4t@oKK@Amrou5hwDrC%
zqf^M3p_a1{b?8tzgz{}-hKoI{x|m?m32AV5OHfOl9L_l_gmP0H1Xa6C`8v`muH4KO
zwp*``+i`$<ZGKYTf$+$oF^8Jhg*Cjd5%B*dmI*A6jQ9^Np+D&5kxalk=02<hESEeF
zY%ev30hiOK*5_6ey_~9FB>*qp@vy=Ql(dVsh#wJAkx&|?sw&Gx^~1NW!dpJ<v)7jh
zGl6mRN>!^ueO5>u-ksU?439DgAr+!0N0g?LJ`;f45X0Vr#QO<>f|)&PRE<{Sr_}tP
zefA|z@QN<1AIzl8H5Y_NYX82q>oX~;%E1<T0PxU?&#;2@K%b@4xhy}GrbXD}CAAAn
zjt=6*-q(xU;3bVzyocsq#mfqVBAeOcIm4o*{zv#$oFOK#>qmJ#@i*S+F)C)n2NxxX
zw+SX}_E;^Goz#&I+mXIn-@vd=lKKS!;C&a2ZqguJ`>uw};|DRryg&~E<p_TBzDx&h
z4I*ZUKa1h*t*c8JO8AOHPqNnXU0@h+m9;y86aTE9AX2muf039PbZgS2K4tv}JM3ge
z@#(hnIY-p*O46zbIvYk1Y@BTpT<k_#$mb*kn2UIl{RM2n*WO;+`8a)Y8HDl$T!V_z
z?~Y&*dxa*8w@@CovMGIk=<6CFe(zAy$ehaw=It9M;`^@Tb5mr=40*y}vp{`Zn1sax
z^M<_?oetBy*Omh<<xQqS;c)a()+%2F7vq{EhE^zG&mTjY7GR7}Y%yi$ew{BbsevcF
z`E~Ng@d?i2xC*T<L+ld_OqD=S`t}!_86hNQj)Dm93wa_1Tj38D8(b-WU^Qu_F#{Gj
zs!{0=Tcw7+P`y41Oa7jK4P6@+*ZBme>L(x$)p7Tqwnz5#CCMW-f#OZ-AZ`^}m}g(G
z9WGAyG+(x>N|9<EIl(mwl|vIvw`QNuVDsa=ew@Jyx1~kTw-Q4EB5=>o)CwSbZCF1*
z4Kz2Ce4q;}REh>B>EM8j<3L-n3-eBBl!*@A%+%_}p-p{UQ`BM7nv{@1VgSEyr{r*L
zsC1KHW~f)2ko&|dW)Tgf7uS`H>32S>oXl*@!||?F9W6gcA6y8JG3eNvSMg(hbU7`*
za37Yz<h-edyXmKHT}?7Vla%VP?${!4=xedfL^s4AwPloPi&(|L%heH};dQvSESkY)
z9YRY1w1^KU8WX`JYHzRn7(yZuQge>w&%vF-XHEHF9sIM8U5UM1(9yuJQcwiQe<Aot
zLq%N_K&2G_%4?E!4arP0nCQUe!P8Q5)M;SSTzmf&)bm!#hc^okB=?^ggQ<+CElPrw
z^L}V+L`%R(RzI=>&pUCi84dL<48ZAxuMqNspkqA=z3*wkU7fvXvT3&~aM`!2VhzN7
zvBsdcH2-M+rn<U4fu!2A0r?LqM}~rCXM|p{UjQG<u`GZU<x$td!75ZM%Ga8;05GA2
zk1*rcvmYEFu7#oR;1BFBkpizDEQ5`wT&Jo+DkjyVh2AsqiAcU*sO0E|B}h{loTl^z
z5p6S$S=@bw5EA#g|Ndl@@RK0#8vm4p0~U<l9d~RE)%6wmgn8zB!t_V7=+2b_f0;ze
za0*+sc&(y)jl;KuTDkFlt9ehbUS2tLq0%k6ZgG)xF?os!>47WMDHEBjvZ7Ty`1un^
zff&IMnHs_jd5v|KGULk2S&Q9%CZ2972qc<#+kxRCQ_1*M1%4Ys`*E0Pe9_0vXx||M
zkIEHxx`)>~>O;Uo<-j&F%<h=6!r$jH?%f*a8B&}|<leZh5Q?lZar}?ijurSJJ67TW
z#Z^jFrX#DQiH;WKrNgK|WF8ZJ^1{W#Gwk+=!=<_T+r!pJesa2Os!3|_6Na-{TB&H`
zUG?_aj_P^QOYh8k*%kO;RGY-ctJ?)0ORX4Xm93)yG9NP77i?KK(-AqSGiN1<@9Av-
zENDiOZLJ#09hzW>i|&E3r&c!d!4P0pLQOSwIYg#2ur<#}q%IrhkKxCr4Rp$q3m?mq
zH7h)(@UP}UCQ-9Qnp+5~*kV2>dV=f<Ag9e8``)-MoNM+g931uKY$6&e>)pJ2N-1Mx
z#6>Zpw^$5@s!ZK3oO7xU??0CUxz?KL*7P~>WSdo88UZ0HhokChj`j&svj({mZ{41}
zsEzJGo}3G}w!g9ogh*WLW>65M*t+hVD=(<j7?hyW6!vTGIX<}4mJVJYs(V59yef6=
zt$k^iv@Pc+f6~Nb<{(0BVZ64r$B#dWuIg@lx5YvZu9^HS^E=N2G_w#Ib<a@v%0X=m
zv@M8}cx{nPmjmqw=RTvF86HS#S`fyvbb?&HNN*}S_NeVS#;1`;_JWNSIZYGQqbe&8
zdb~mK<Bmf>)OCVlvhzYdWdd}~c&cccsQmnck2~O1ou1D}mZY6!G?0&0{0IB+WXVlr
zaDH<zKfB>xQ{W8s8e^a7f1z!^@Ph4*)LWS`WC2l*ww8jPDnu%eb)pVrYe$z9f1yCi
zrMaL1h$EuE^dsKBF@A1L=bTYtu`R6MkSk%|W5?WQJ))yN>sLzQj)!+#Dm?7cOUTr6
z@x{VM94i|*77lTRLaKBSyf5GlZXf=}A#&(AkX8#+6yl1=HY$ktz$Lp8{k@l=M$KgO
z4$T-d1g?-n&!GrTg^VlqN-(mZhc2c52UAoN43vQR?O!d+|EU!6FNBaGG#MR?8wlC<
z!#(>-&fM2=v{b2CTJe12hRk0>)pe8pF4}uECKGAOsIp&^A{I1yyJypbS7g9uN>MG6
zr}!jk^u(b$2S}e|il0+k*o}6JzGa((QMvn@mLGH(Pp3F$+kf)$F7*=`?A|^i7gngu
zB%u!}YyJk44%*?Jf6lG%FQ^8v+5+_7X2@dc<=-|?p7uRT(r&lfuyR!Ocyi)hMM7=b
zo=Ce7EJ7u#ezCrm%6oBZ7~ngm?Fj~(R@RVC9<JOT^1tSNWz<0+D0n1I$82sj-@6PG
z#*4{G#6)qG=M<`;VpW==9%D-wx!Ip_kga1O81sraZ{1@U+E48hFyXp)+)u_F=jIG6
zcmA%Nq92R*-ExVpzi(+7>Gr_}(dX*O!$XJKsrD}PZI4TyHYi2JnWge8Pl5|$f146G
zO(SvA>dV{5+!LQCXuFh$tBi1=@Xr>~z^N%arXA!b4gdWBkp4WAf`jQgNw#!)Jc`e?
zTAJlk9kM7Jv&*2%pBw%!-amP%OA2p$d#zB}j0TJQMu&U~Iee#{8i#Q3IjF(PJM|`1
z%>HzyTgnndQJiDE<X?Z;@#hy?xT``uE8hqgQg?2sY|mYVs?b%T(}B^tD}k}Qw{`JX
z!;fP!la{t&75j=;exj^GY+{pQQJ=8)KABMFOtsX~sm@Lv9_QR3?{=sVs4*S>hDlN5
zxtCMnyK=w7rk!D>tY9tWEYa@orlk3wq;vm0^81Sy{AP+WqG_QjoJNc~c$gm$%jWC9
zh?Ku`3y`YYGYVoiXU)>J0SS9azN8tM|3GXq_%YlRtox6A00-5?cL*<D+7{>#@$S!2
zfIr;|`FQ#7yIr>JHeSR5=CT|e?HZxt5WQ}A=5a=bG57Kxk?xPvJgo1Epr}CCe2lBi
z140Mkly8!P8xl3Eg}W7S{K7W)*3R+eylLC>YXVmWxAKI!0WxI+z{IpU2`DXy5>ksY
za$U)}j&{!Z22I3OUW8QRE5f`9HY(koPD_9m<n(JyQD~v1QZsS~Gp($PihjDadsCQm
zwLej6+ASpZhg|;8BlPUVEg#Ix#D5XLm@<9;j{(sCl$iSO=9vckCqa&PWle8IWb^Y^
z$NyFs`xowfG?+z>(6+qm7~PD6JINXj>f}ZLOFQ@Gks5*wl^M9b9n#LE=`Q;6h7B+~
zNOT>LZ=%>W=VXEZM_rdO5-M;U31tEN>p0pV_z#_-1J{8_c($4l=@J`&q>FU~?N4b(
z`QLnq|5t5v8Sh`<0W60mXpKxp3(5e6G6*Pq-b~<xc4^He*FXNRB<})7h+Xl&5xoii
zd$u$3-!R_)RKa>Ng#Q2Mh5!2pz1kpqVyP#m#TXtsZJT(P9#L6t(ssD$>-!Ts<+jBP
zX9yOGnqPN`2*>@xBTA5Txlty>)-+flz<$}F&=17>sT+us1c2S%`!yu5W}nO=DSOxt
zmtAhIOTF{zXe65d&EMo*RiBRl%^38G@*HZ2lUw#$xIFa)NDs}U#N<asyW9N3r(VZ0
z*{fpyMKqwmQg5M%ZJfCf9a@Ru!k2OJ6iXbMk0SB;v&zek)d>=>dZs~`+>rCm>ox3N
z$)|N`*sSu3L$PRZm=rkDXC+)wwURU<RNn|>3hlpyk&ttu-1@|dTp>)!S~`O4ADk=~
zd`(jyc5=0&oru5n+(`NMM>A*h{#~NkeQ(_o-r1MY?mJtS8+mj6tg)n(@9sQ=hv;$?
zL3_11yA{w*35}qOcu(812YT+E<1jh?&Rfp-OY|Nj+W1T4p5qT@-q;3mRuX!!D*qts
z{=siiLWFrbDC%(^(bxO$m7a#<-be3qPQ(<X3fqc5B<tV?egNZ_<%&5<`$|_{nf!z9
zXZ;uK{oikm+JBU2N}$f{E2!_08G@T@+0duBw)x(Jmc|WBmt$oV7RQrzSa%?8Ce?vS
zX9R!CH@ZJ@h66xuQK8cqb6cUzCUe$jSyIl6bd7h6YsJuQ-8GZ9mC{vF0Py1T-D1*Y
z%L&vANxMn+S&S*Ago2lx{e%N+iPbdto-0;1&|Ozcv$nWz+$VnR^PdXAo9eUmL)*{I
z+S$X5+=K^4H#x82iNAc>7F&a{?rYhxMGx&P!#iBH%I^O~?VdNwsDo;g0@q&G3TO7B
z+jn=G2=Qrpw~#^*(_p^fEHMd}nbvs;!v5WY=>SzK-sahtsSU&Hf{QxXy|IuaEz$%Z
zxYhIL#LHyeo<g<8b9ZlF4fJ#NZG}j2wpwrek?=Qvs={XPqD<*?<)rP*ABaFTTu96W
zKchaFu;8tze;nqyH?-!6SIZ6^vG3IwmCThG!cGQRR|(+*CdGO7DG_<2I4--56~v$r
z(t=wVFV$YzO>DOZb%USw2tEhey?x~1u|-()7(h|RMz`?PzWSf&)Gi+$SHTTdNQFBy
zs}96|ZRRu!^tBaaz@JE-86(Fxm#Emg;R@#(zT;|8#M?lG(Ng_Q!I|Dc%=8;4<6$YV
zA)}$OJ9Mr)#r`Mx{iW1bwxbi(L4jwGk;<%T+8tEjZVt<r8YPqFM+c0zTwPi<Dr*&b
zp7hQb)3-{+Mt_-`Sy(~2FXOdVuKHE`SEFkq`}`ahRPG3IeGkPN-rfT6LFswOursG5
z?T^5!3cB#vyP@@niC()MWLKRks+t05jbEd;GGa)RRDc#a5kJ1$`^n_E6@)F&UH1DI
zhIhNb^GoM%)=y!n;E!ZYwEJfo{I=N^BV7(=mktsg+B9uk(H24DbM1x2j#0D`is~}Q
zrcgD(#IgUPA^%Vb-L;^Rmjtrd+0`2ouY$JKZyD4jo{+~48t$8}A@l1$a15}1u}vQb
zojal`PXmCWRrI2lR<H?S5iWmSdF&Kmtgd}rYprS4e}(fT%Sp96W857rlMFg_@%xJ+
zm1;Q;?3gl_@({tbcCKQ?uY_Fhr*{@yb^+4k^Ln`baFo|bS<f`q^xj(<i-l_Vrs=tf
z%IV<m&lwqgdrOv;-1MZK1gr#IH@6+l?4tNra}nD=gd<V6<SNuLq?Aj7{Ib;sHu~N}
z_V&Nk`UVDV^o_H-y^)oaH6itmUH|%nH)7k`7$CBChfttfn|JiIpH67U^Zt)tvATHg
z$WrJ_E$464@a$QHHJ(Ek?+Sw0h`U~bc{XdDSInydQXaDBgg@J29WhPGx$ISs1V_tL
zfJ#r(p`ZbatET%RPjC%eNnn>3nUbub`IfHfR*XqNfxQsM%OqU^0~6UP8M7J38U_Jd
z-na5F)~=$iW1F2Ivhp4EaZZ->vo`<dZ`j090WlrGA2Sg(OX<IFPXDlfc^Jsd&SXf9
zss9OFN=q`Lp*4F+nVDV!gxw#`YGCF@;#3m!rakY*u=y3VT<BG;xs%l?%sZzHogzN`
zwYg;JDTds<zOCzT=Dt;5PM%Hvv5~8RA-Is)y|_?COnOJzs`Tw0*f<0>xSggyHMF(8
zz1?r?_HW*a>JfKp$*<meu7JG5fTS8hkE);Tr{``bq>EA;+1Vj)N{%4N8(ocqeynp>
z7Sis%?st9e;GJ*pylae6!!q6DCNeN^hH_hPS|hVdb8sB#X3qWw!^7qY!TX8m`}3&4
zFV-AhbJCEma(jU6zT&osdh(4p>K_H@jb)hqy*F=MKo0#??)$Em?JTS;m;@l>;Zi@P
zVy(jwn>4M<-yXoD)%_BFlaJ=uu)u$uJb90up!#J|N0l#&qmI9Q1TLD(W{bqmP(aGY
zE}8u|VDsB$SM~=1AENOmD92JqM2dFAg>B@%I&KoQejsP75vV*HwzHm<8+;Cb0P*Qe
zGVJa+n&e;@84nuC<L6H7P@6Aa*WnB;Ve%_1ZATUj$~`J-%@I!?_uSXr9yRd$-1eIy
zp}#&(f!on}#8$fX5zV1-VUVw(3yO%D<ItQzHhkz7SA51?!Vygbw#+^$+<%Fvy5Kar
zy_DojHJ&zn!`H5D*y^-E)3WLwh}DnQ`*ld^M81mhCIE$b_VcxTsJ#>(%o`~C{a`5Z
zhs*M=&VS6YzyHyteqDbp`ek0{rlBh=c1?IZgEhg*P)ft(0l(1C_(xavRg%-uYGz6@
zA(w=ca<xRy2sLOrsr*)U=}0)BYQqBo3}*R^i|k>z&7Rb$)~CMl9wA|EV1_4#J>n)`
zR2T2T-f7E2nXd(PNeJv2lyyc2OOH{UK1o@5$&mZ&9Ff1C?1a&&^|szod4;K{-qr1|
z6XD14AyiM}9}x4y8O#zo)GtbIuI4IV?afhKyf)E~#{Z&kj^~66j1KBG?S90rK>e8h
zAg*fjkyY$c5`i8%xN@wO=NLm_?+1%DL;bn<d?$E4jW0NbguqNWU;lP*kKOBmnc);5
zr%ascs5pZEx`p}Gmyg@BJ0!LW)q1X}y5)>&XZNVXs%t;}XasY#fkqzA4_iL1T#^xT
zNsZ@V`yJl)d$^j=YbbP8?FnTH10gLlWI`=|z@ZbXY4uNGb-S{ymsdSC)$Oi5LTD4X
z>0)u0Lm5Dl3W<q7gj8I<?DI$+wr6sa4Y%yt9Q_YWK1VbomyVzNiamIz4Sk6!N~OG4
z<?u+~$^Nvzo?gc*8=IuabQ(p-KDK862<t>6F!s<bjT8lF`?kFTFD%xEMcl9tdNxNk
zkb@H%Mu^WU<L6Wbox1cbydR~J88X!>jG2W^t)!g97~^gP4O7FjR3T)Qt9Ha9KV&Xs
z@GKGfbtFxT4>h>W=B7p(d#<pr{ei_xt;$Prl3~Jz>Ag;(X-wT;m%5u(@#+`RJ7(;=
zQ5P2can28p4?sn6#7kOikY^_CXSeSTSC!5)LZE%4ZN2_UB1Kar;vs@~Z3NHL$<s=<
z5&ZsPeM5q8xHcHHtOeLKINOKy`@T|gw6C2p$=7p{{d8pEgG2UYh4_nHitl)Y-_8-y
zYNE82cs4Rn2Sc$uX=TP}<XtwaWpT*pn#z}D1NErs)j}E;mLrQNjpb?4Z~V0)Gzq-?
ze>;%RwKls3HNc)dsWu9&b@sHV<IOuJAo1q0{JhYbGOikU-h%Yep%pY1>S6CQIKPn6
zs~g8H-xr}wVU%s0Qw_aZA2lZcdNntgdBDRv50ZeD<`h8fzsM54U9TiRLJUS^Vw=%j
ziKK5&lUTaoPEwf8;BM)M>s63LQ5E{2u3R)y)1H?kD7@N&%(-c2(P?v+0Zfk&{Z^er
zi@rw42B{->l#sJU19V~|dOBMXyka<o1~nlBn?9OFHt7o)&ozp?LaaX%olDA}U@j!A
z@UG;a)WG>YV$N%j1n)fHE>fSE5lR+iC*EEO$L^)?s(LfQFMFsQABtUvcRncohUIY+
z!;C~Hxh#0pI$LI$F72TH#K1CIoG`jF=36>Y;!8^7d;S#H+6l%dR+^#=lKz=|AD#X{
z{oH|o$}EhDFBYl#lk2p}iS0tFY|~!2Gdq0ewS}<gahpQO%T@tmUVtWY$|O$@wzAhz
zV}PVTikoc0ZM=s8I~6<HiVhW2*oA#achgXFeK{uO8z|r1Lq-|TJV&gx`R5sr@_{bM
zc^lB;=7_&oZt?q{HstG905|T4q=WYzRLd6jIt_V$fA5kMRyF|sjLhR})h-qV!d@Dq
zlfAK6K!0n^X9FsPl}ErP8yaK<px=*m-x!3%qg^;9TC^%b+_*1v6Ec1B*T3G)>2vC}
z?!wh`GB`h2s8|cI*3^gOfX(`8&|Q;QFdcM%Ok{^ScReA`S+jQy#_DeZ4_df5OgD(L
zAB4rFrRj-32BM5OuBbe((Qt@<tpzxyTwqq35;;DKVz?RG82Qc)-?O*S?e$vJam?eJ
zNHQ*XWpvWt2qxaKV`E$rP#wIQFdY5bif#ouo5J`!=!*ma8vqW?=sw4{5qc$N;ZiN9
z$2kq>{*n_Il}h)?Ow-f#z2KMgqvAW_-+TJlp*PG(pTK#rN&6Mwksn^<;S7mOB#2A4
z=g`G`Fg$JUDYC|1rj0lvp9zzAJw8<3j#5z)N~5fr@QnMdVVEg{;wHAQOJpq_ZRkGV
zUwLu_??>AYoAE_un(6(lMz>;-${@<_?LQ(bla-~RZNFkD$_%|^nXPdiBCRfM#h&d&
z8?d&00GZ4*es*YF?2B%Q(nNVs6#A@hDl59~?<VrQv9q0<OvwFitCczjXAcA4VH@*W
zjw6>4h^_d9mXfx0X23P>$seQK_GBHrzS<Lb<qfM#{o%9iv80+V`SbH2JMVNzQ7{$r
z<4}R47RXdAoK|5t+_3bhe2H0X5y#~2iX!DM$3>v(gA{XZ68G8sbZG9WR7$;YYklI{
zya)B!yzDUXx%8DD#sfQJ5lmg*^81w&V)dozZ%O0AKQd~Ds?#<2?W|y=Vs6(kuK`XF
zf%P>TX<%urV2&4TQPQkU=jgh2Ze*7~Y_t0Yw+CvgFCk$@kGvcj=k1xxgMz>cgOeCN
zWC$qi1(-)Qs<Y07n@3%D;Va7SZ$iV+Sr*rqz>yuaW-q%Hfj347_eH<rCx{_tR7xLq
zaTTotSZRSU1hd6$Zr!x%0TMr@c2Cu->OMsjg}*n}HTNOP0*{-KDFg~VAN%9437{G~
zk{BUh99X)$fA*F#Amyz%Hot$*0ZwZPJ&eP~0t2Mi20l#VA@kbzEjBWHvo3^GMYE>o
z*HMn?MkWd<PY~=*_Yu1%@z=ec?9911^?f=zJra+ZOs?-B-NSWs`Rz+=?%ZH9YjySD
zyf?aFyqwUggiui2iu~BS;tlIZIAS6se`Vwvb22~XTl5r~6`?~nHF6BGcZO@RxX#(a
ze|heSmcC4K<`R_iYeM1;?PL@L<i(5^6e=t=$BVjq!~rco!+NweqgAm{Wx}ePgXxYP
zN1O*Iv}LE8R}-#apOrsa_jMopr*uj@SEGPZnuea}p_>4$Pc8K?;mc;k6=DOLsg&+`
zN>sGC!s;SK?dkwTH4+JwQ#>{z$-Qll=^2x_@)@bm)W=RfY9L!fGxAq2ftjXuWQ^X3
zY5ieea|PTA02xtJYsUs)bgYIVm8P@78}{RpTAz5HXnr1#i^zS|QgbngOwFq*ye$o3
zAxJc4xw#H-hIW-eA}f^InTjSh<=EHYI96D59I4sDI3vFbak(gq)md9LkARELx)bFp
zpF+_jjFVhSt|+8ki>EIR7a^Yrhr-mi{%lmUFD-?YWzlJ+;!!k+6VzP%K@>cEFJre`
z$tDfgj`!%rObZqjtN=DV?}@aAg`Lnr4vpgl1s|mHz}8azF_*?A&7dC9eE2r>5~+S4
zO8q?K3ZT-vksHgaQJxUF9|MWV&D`=K-12?pWTF?C*T09{-D={sO?-}M6JJLnBB8#-
z!XHekIjAoI7dziXakB$Bs>tXG>95O{Zf!{`SsK7aZmV<=X^dxDT1Ch1|4G*`>>KH}
zu{~UzeHoZELWg}k0WSzz_az`2=<{A3@%?ggebi&{c|0+_3LzWEfo+dN!F>M>3+}~C
zdB`tV#AaIn`;3p!p*(x8JRK-9^$vkN#R8PBN^^S5$_k$7tStOVfpYr@Ylv|gpeP_<
z{dA4QOY%VG7l<>zfWJN8N9C^mq(9~6bHr7}n?!O727LC7xjB;05xYlBj3P7gX$9O3
z3jTKR3{HyYP)=C@ehvtd1MzItb0KP{d^J6%=*19_Sajh53~A8n)pDI4$47y;OX)I%
zR&|s?a8mu9Fej}yHfuufMXWT>x|1Wu{UQo03PL>OEYxL!g_RE-f7rr?ZO^oNo&h9H
znhHWjuL?yVMZpukOnyp?F0R#NmOMH;I^t+6M;&OIs~&iK)DM58j08zS9g?b8>29C&
zAyy?wZ~G?l^5k2SHqNeOdA?P_<6gUdASTn!&|4T8=9L>%IGX4_6>&#p?gxRB9iask
z?@?cnex{<~wdG&N;g8GP^SS=qv)5Ad_#&mb@&P9?C_{M^lopYGi@#V|;Wo<sulB6)
z3>W}R^jYCpZeOUmJ<dS^=|aj@_}imnzIPfTdKjMDx7jZ9p5Xg$bTwXX9Y74K=Xu$q
zWuF~w;(dh|zmMx5{Xk)$!;wlD0C>b*q(;myE~I%8;?4OX&cXZXhmq#`Y43-+Sv@pQ
zfX0t<&d$Pm5Bx@|yA=A^6x>4R`=H>7dtkT3WN{_C=EBf(p9TZvHfcdUUx#Wxn07FO
z%LZ#HWFn8qIa&=0%tj-u^7-aJYLoGnp}Q6XVM+(78xlnm)3jOyi$o5G*cX=W$G+5V
z6gejW&Z2wdKw26>Z-WT(N@UV}e$Ke=(4J$BqcQuLCXxtb>?zO1kO`y*Y@<NN3Se!7
zv$9y0+w$$y*^`~!R7cBjmzsx;R`7Y+;jpR=HB$I@mvaX0y`#=A6xeVyKhF>%Cxa#S
zo@KY|4_P`;?RI@5PjN=C_s-CaZYL#e(K}6#h0*4ohPwlh%IsD^&2?cNIh2d!l$7*!
zmn?w7$L$ZyOG#lnMai1To)>S~G!Q|EYblh5^%`*p<N~v{`MqZ(ri1uY<FC)lI=nfU
z1mz(Y3M&O`f#`!QeHcrE-$Xxw)1UzXyzTGCzM<T`SSMcud2?Am>933#6rQvQeaoYy
z_8mJ{C-wB>+5|3A<m*#%MI~owOT|o)YJ5Iucl%jMvG&luI6WDB&M!CWEo)IE7<1|-
zw3te)#?M0Pn{jtGe09Bg2=yp?P=PtJLsc@cq_Ja_U_K3|L(+Kk_jVUv(0~FjZVuVh
z$%cA@p?!MK^b84{a+2O3sIg|o@lzfLIjHR+pm>@(vK39%M8qCj3kR^Qgcyg%WS<p)
z=24d2amMa}eCWjtbTAQVSyK9{@F=)VbuRZlu&{8u(~|ZXY#p)8bfNQs=dM%RK<oHw
zuhBsy&+FvfX->oUmyxQfpyfSl2lIx5HJG)P26*3S6pHeLV5J1?>#MCV!+Mu;-akPI
z?SY829JMaJ9$4IX6}eWp1s09SHkUR9Z6HD$(kh_SWtg%Cc+x+t=_kC)DoM26X#PFW
zOZ%Scd_$YLWflyhug}0>0352Izv^@&I90i?J5VO2*H;E5I|1k^-Fp{$1l^~9nORk%
z2EY(lh%gHhhW&gM3^f*rqqR0LGKf}mkIT7{GPlEkoE;Q>VaWs@?m`$1GtT@!VmdS@
zSk^a0JK<YkZ#UWC-0kgAFfkz*M>z6-W%{5!;0$-I=gfnopgZvHOTHMmOr}haT@CBO
zo~`fkIDk2?Jd8&YY~49Qmg=mYnex6ij>dZa0{Mi=<=PBcl8r390^b;8Cf8yL=ysFy
zJ<e}P7+Cb<oq#^k=ZyB9=~8~&eN;Cew<%zQw`)afn={H?Mb6C)=l2DJ*iJc^?|D);
z$)+)KfYZWCc5*uuXNs1Ln)DkT;gtjAY!x*P)mg3wR9>7ZLNWf&hUS0Q1y!qJF7w0k
z;E{I0G~8SY2Z<-HpzTdOYI**{_fkCC5N8yLF!ew=zgjpENWsIzx5o!Ob)A%AdnGu0
zbfIkzKKzyz){vlOS>bqMaeA`VtmKe4cSj*7WLbe^!$M%W>1}A+G4XF$Pq*L+I(mz~
zq--t{O!*?GstQCRIH@y!Ecne^IWsyr&X*$9D<eLQboJnf7hWkt?V$GNd*#Kg`MA%*
z!XP-hXVoj;Wr<JnMe;=(8J`eq?^VBNmIu?$J3Y~CBqA*JK->vn6ku1R^T19cc5<(A
zr+Ri}a>t|M3Il-l1O#fzGUv0Wqs3mcl8p{Tl%~|yhbmWP&?<`1mHDIW5fQ0$i8}O=
z!L`e&-O*2nkgsRn-~*cMQC%$T@HlJYX+3|m5gN6#*0xZ_4&kr(C?4FDL!*UOK^`wA
zRDZOWAfYx!7@kH%c{%(rOxk!!w$C{lyg{eotB5vIlWq}-ha|9G^nMI%85maCo!;IF
zHDl{F(=LK>x-=No${^EH^V-ypYr;k9<Is#JC(;*9UlN#v%ZR*a7;ZFA>MNe6#Qvl=
zd^B4YZ&x6JyVZe4AUzhAj0d&PVe0>uZSXe&{}DsYj_MGl#AMn#kXR4otJy>ky(|U_
z-(L?3x`}*-kPe;ZyjN9yicd$yZVV5^4ISDZ$W8b5WqUV8w{@ILAx+O+m>a*Xc1jJ7
zVi(&@+sC$Xx4yzC%*wwWbGz=D!2J_Ik;q~%_1Xs%{<WV_-tytflIlX5iZ&TGKAt2S
z?^S9W)=$`BnAeZD?VyP~=b#Jc41HS^op<c<QG!2&f0KD9nQB&w<=aX{2O3**EqGQ$
z;|F!&A)U^cVxQAcD*w$7_*`ZT?1PH*V{9qq658+*{WkPwL@Jm!%E(F7KN6tj9<lEj
zh6pb##9Ysb#{>!O1g1M(x;?PJ=l)=Z3fIcuAqk$=S=X}|Bm74~23x#dn5g5+#1@vF
zYe_H*+AIay?3FD-1@J54eU+D2sFN^LB6emx1jJ3#!6@l-O!1r*Dl#jExY#Ec8ofu=
zA5lidDjXnb-pBbpbz$Uw^rrkikwQNY(WDL#rdCiMY?+B+Qh~oO;+lp_S1&S*HYM%A
z-Xw7COC|Y5<2zqJ*$~rIl6d_%J;brGwzL55<9mI1wKH)yxQ%m*tC0qp*U!N$1=X=E
zJgG7BDWdKv51-ocsMtEyzKf33Yk>x~5^WT=@Qy0}b%f?CFq3T*eyf9>h6yF#8(Wwq
ze8RfscZB(b^}vp!Q0Vw$Bn7!y`a82)m==iko23t@_kI?bdVc4>#E4K^bkp}ge}7Eg
zGegv_!tF~+*2yHvdgjRtX*KwKVWr*#W=JyhF`fg5H#GkAhVy0o*KuDT8>%FYEvgI!
zlPlgvP~e>@K;QWP?xsRle?LN^UKp#xTm(5^Tn%o7lf2^-3o`U0VE#E-pDmoD3h4MK
zax<YYG{)_K5yAV{5&F0Jzs0=o0GS6;jFA7lr2l$;9;(SN>np@2{{LcT$!ma1A3m`3
zWBAfNzx1ha%RW8wTwVU<Fq?|N&@kz|e|`D-Nj{A}ScP|J(bZb&upHlk@hi@>ntNx9
z8sfiwtx&Xf8(Yu0>ke!YBAT)MdSJuIoUdI4RF(A~3y*EjTVa5ajTqOTSvpio%R0Yv
zg~;u9(AJ(6U+(_&;P%B>@-Sv!!qwX<3!{*|0coxcGVPt{$TAS@n459|Y1WX>7((LB
zW{wjfP(4;=*zmt$R-{~r!wi_1JuPYc`UN~$exn(%Oyfv)r%T#Auj9617zjPf;Rc$k
z(OX!Me*Y@U57M(%*Bj-1b0zP%)dx`=6kee}EK{D8|GrlLmLF(_h29PDwMJatp$4ST
z00J5?gmC+>Y-4-^{jzGqHtA6`M2eZTafKNrxGWDUX~Sc<Z$~T^h=#lsD6_}#JFk(;
zi;P$}Vo1ib4%*m_xjv=>Gg&uU#h^mMmlBTb>dUb&?NwKqlh&{__g@+!p&1{VsLoWl
zD{l3OEU;?{k_{F)L4-u_I6}T&15xJ-F#?vC51Upu`=I_N@r92EFA`C$@~uSuQw1`w
z;h#$8-@MA*b3+%EVZ9z8+x-4%!<HfvN`%KAA31i$v4}+17e*u9JQ-<oF}_oN=t=eO
zWk&f}^@u<!K7z0Hhz*v{wsu@U8yfd3F)z*ZM$Zv_rqkHNvvY0L@86{ObBF(9WO-ZG
zn=OhiiZ#md9EEL|<$K7gm2ZMZ03Egi-OjzjF~pG@Ly)O6F>ypXx5QhkN)9X4Rzu!o
z)h!##`vE(Cok1GMusCbh0p0Jt=DrX6dcLyHb^!E#5KTNNOub>e_KUX4YPecxWQ&>_
zy54WBEd(9~uSb0No~P(2#rdZWu3f+eQ)6gxOXwW0^>{NT-v2wdrjQi|#rcIMsW5Rc
zD)!HVoR&*yGu9;vFV5+EnvK?&5I<`5p1gKIi)m!WfAuR_-qVaFgPE340fqQ-jF5l!
zH43zR&)?p`Dx8o!;%IHpNyyh)+|J%S73c-~KH~u*i}R>^{URELzwWMcSNO~S9T|<2
zL)qoEPx3SeQZ13Jl0eK-!r}?vQ5k20RqkNvgrmh6(Y<DeD65Iu8{!J%%giScPS%T;
zX;)^G0d`+vdD5Tot=w5m5z`~3V_xGl(;SzJV3UZU+V<&9dA>U4iD(II#pck(-xhjP
zf~$+F`_QZNgyCiz7h|a8DB)qbv#7~O<sc@}4%%-UTuE3-1~+NmV;YR=ZS);g+V#x^
zsAgEz#~32`X@T@#Jhae?el=pKNV~z=b0uy6G$(Cf4-Fddu}l)KFZ~JmLx(L!x5bR1
zQE^e`xUQ`w8$GAjTkx!Iz|5NLstO{3A6f)=?U^!VV8&1M7z;#(_X4=nG*<4~D(ymN
zkL4^lN;L(Q_boikuDcR|nlA*8#T930f};@(<cba6k%oVwOP5veZA%={!n8JKu~=*4
zU4vCV$-HDKekPBy($o+;L4nvS)+UjueNhJOj!KdD=uBcGIN_qeW$zHE2g<mMBu&SU
za0`W>EPRJjfomjImJC<EWgGIEor4jzlB+lcoXfc@KV0_CeBtxo^_!MhH8|$i*=Y0E
zF-a1ElEPrKPSVc<-U()*xbn1;tfw480_koAO8Gly0iLV=8V2H4#pf(EzZ`t37kA9&
z4<Cwj<O9I$^wVoDUkZWrCN2?O&)92GxQGw@nSmIJ={wx}55;uZvox8G@+0BpsmRJp
z8<N)e3%U#t<rG5{IraRxh^#7;_%_nEc!dl@S-AE{OAabnR_iv<26>2G(ul00n{v<c
z-{RTvg6F!ti}0NHS~d^Z0YB(9tcxah5(dV|Bpu<KSfU)<08vWt1GIJx$HY_$PWV`7
zpZ*f))l|c#7mv6H9upHBk63ped0ZbuEXv}-Nb)J!B1R|4n2r`|#?Iul4cH`>u#s2|
z7nQV%maz>dXtq6$11zpjGPoPO^+SFrpBD?p#^RhjkH6RY)L}q3BngfeZG!tEYwybU
zeG+Sb{W}^rZQAY*u@HkmuGBbF+l5T1LCzyw_N+WhFNdMq5yVL9%P582+_6zyj8r7l
z8vj3aod2{j|IKZP$TtG{WqnIT-%_Dx&p5`gN3(F~lJQy#=rL^W)Hd?`%3mCOZdrup
zh$6(V$2@f4_yV$Dx67y)lk!`JqnVrVAjgp@qI>>mgql+5*o1A^;thO!Sl8>EhFKAu
zY$a9?Vdd@5=m*tyk<_xDg*F#4I^?wU2E3R!xO)cWX3{otH`N_T)&t2Lero!B#~|fV
zaow{m9TtRmT)7$}(&A}<K3z6nXj_LgI3na64|)gHqp2eB20)0nQ|Ra+HjCzY(SWma
zBarU|I^z<c%9Xn>_(}GvBRPWCOa$R4iObhVPKF<Zz$XK*=oXCj7N?<4C}hK<%UhCq
zI4vf;_T9}8deDq^L|YrHvZJmAQ`6>T6H{R=1xiRMLE@yUS%`Rs;p{G`?-S0=Gt{B7
zWm{`;0DrNU(<8Do@7f1IgFu(3!4$%?M&97~RHkO9b%aO93q7mK1h}7*t@oVx<!35|
zKkb5K#@0buD}%W!)=^!ImLA5gLTxB-DFirs%{i#v2KG{_OIRfOfrcU=i#`LrpCb}8
z2NYDF5cs#h(nEM#ai=3E>lxP|XQ+-%rTi}?DSI{8>1z%Y#nwo=i-1*O(7GcWDvw9q
z4v?@%R2=KwyT5k|(h^#u3dHRLzV%O~2H${WXGWw(W+-GV78xun->Od^cRRdbW<&hz
z6gAP>4wyihH5`xC7w+-Qg(cglY@5ESPWo)lHfFrSvF?RG?NJO3>8lLdN!odx`=|nV
z7>LjN=X7&(en3<FuHcI@&ONbC7-}@RoB*S-H}4)aYPPDuR1a0q+AAzAjZJ{|TcqG2
z`iIjGh-$==d;?f_s>vW|h-;Zoa>uMj6%`6<`2m<x%^!%L@JdYLVkQ(7Wt=o`Ouwgg
z-{ky}eJ(COOLE6PQpVjLEwtqY<l%Ner{;8xocxe0RmAa;2*B&BK4TJjPx5Gfcn|>T
z@?>G=-lMb!k!w_h(2Q20LygW-$oW?k_!U`*XUK-dUDk+);RxbQo>5p+z3^SNuEp43
z0Hk>ojTb+Do>dWK@HHFi;74!f=tsveRTq>vNF08}SV+7vZ9zi!9nC23LQm)uY$bnZ
zw^Q%x*v@3kH#!Z{3tRVdrliXpy=Np;b+5^Zw{el240mn8eV{%*QOFpceF?qU><HT6
zJ8kaKF#S+(V84A^pE@dURr*^y5v*58g(2V}l400xJ_e8B;N}q))WO`C%SIJn5{C8*
zfOnSK7R_$xf$r5Qbp;VZOyCc`{(Zx8=3XD3(;*W7lu{Tp>8fOcVB+iWEv<@|G^fQv
zsHyLPhXhzrjly+U8L37nYcE=w%l9qR-Ue8skWa4EViv)km->^6JGTQf@DN|wJr1<5
zNZTUHlYCs3gGFP!rgHhX-+Hh*aIX{d&+_GNME4W}KwR^|!8IalYw<gIrc7D&Pkwb!
ze~<ofq1A8i9rJ>AVbSrsmI;EZEg6)@kZ)R`O{fL`&n@Tw>el|_UVWwEk6L<^d>E^}
znyAXmxL+s577$?0cp<Z%J<Z%y4(VO7`BB^|R%V%S4<xa*7|CS5L!r%6uy(d$eK<Kb
zpTYmCm3Vi5IAkHR{`&J&z<hs{N3U)iZwzT^zp@TuL~^Uryd@)v5&ki5hv2ZFq672r
zjf7o((~Nn-M6p<a712pHOV5?nRuSA)H;bM{NB@1qS1*$t`z=)fQe7MowkoBec6=W>
zZ}kaM*9$nyG_b#7FZ&QuRg<!bxx5{AkDt-~8@oP6j^Fj-=hv}R5;CoWSmDqYdaCCz
zv3O_Cpy*(jagm}KMMrwfvmwy*T+r!&aE)kHO;vjL>#_#J2}>}+$Pgw;n7U@%t>-hy
zz?EdroCaLw&;wLq0<^7~l|{W|0GH@x%wwV$=VM7h4#$iRg1=F(Ie3mfBR~OLzM%UF
zHOkz*x`c&<`_Y5`9+k8ePcK5dALt?r!RLMM<Jp5IxE-V7t<J*1fVDne5~<;dI&dbv
z)mj4bTbwc|p~oeUl{6P$(pUjcHLrF?`TnT(GW1f1o`LDqY^J`+#p*Dif=P$J7CbtD
zu5JhnT_@n09-oA^d{X+Gi$sfqZe2eA!a7*-p)6NdUtBC%f|!@1!M%mKc<A@-@Alq&
z(T|}$@Ks+h42q}=q3MDFZ&cT!D76eRl-{*5ZXo-1D-pXmrhbeys-?)?D^1^f>I67o
z-{p<Imo~lmmN>!++kanJYYjWHgwZ$cPV#E<=r+`3xxXFR`9AIJM(!h$CH<17N|G{Y
z<9y{C$@Bt8-=B#4l#L($F+J2vsC31S(9XT?dE)r&{NhLxuk>z-Kf5vPbB57lfsRJL
z#eLm|O2=<f`xmvuk|r+5lKHefn=ic0f?47c5*P@8`J!A)Eohww%P}4;G~_3%QG!iT
zTx#d{)VR0S<oM1qMRsHQ*$`vte55mjN@59DJvvG9A?m9|w=+|x4_5lxRbu&ZvWv+o
z$IXM%X0*9XBvY{5NG&{a@NqZ}&DAM;8}ehAeojknB4fdMj-$08jQ4=a?|hrlhlwFj
zmsMK^7Fd@9SR_~2S%j(y<~0O{++`mE8Cqa<^LP+%tdEm`wG`myWp@;bsadT3?BMkD
zTC-nW=<eqa+dk^q1&2Aaz|LJ;UEzYN5_rvaZI{x=tcGN!9D??lrcPAZ(NP!3MNF{r
zGXn#mc-4{y;poqv`4yr`rRMFuQty(%2bZaXrKgQTUfx$A7;p}DQmGzTxJOqv@yCj~
zcHa=QjO5QPPa8+hX>R#eQ;ku7<WYR|N8_IWx+GWxiDpcb63+n%8bALJ(X84=$OKx2
zwYl`Cxx`nPG~#f`k#XqzXLR5!y(sL<&{i(+6!;N|Dp|-$Xn#pJ6#=8|qjBRCEj=Va
zK*MEbK76i_-(5Yk)x?nzCuYp@9*v2<^TN?Prij2s0NlmE2*EAq;lQ<zr6q7+v1i*$
zJaQ3Z1a&CR)rG*Wy2|krcR_i$vxZ|xyngW6r`4=1;N>RkjD{;x&KTKgwd3Y8X^ZS?
ztUG2;@S!VrufHkvi3ggU$y4vlcc(!Slft-_c$~AP1hWb?zQ3ZSYgbNb<U$ED7#NZY
zQ%LD@aP4i#hYoi@g<#|HoBdH)N8QzEdH~80Y&J=nTI_d1jHcKEVOEsFguLA&JDUtU
zD4x3z1>fGbZ}>!*Gjs~bCEz#`*`r8=)_R62iC4NQx2p77+xtlYN2$fAf3Ex*@m@t-
z(x2=TASZM~870T}6Dt*@3SpJB+*GTWk`}viegRnb0JvciymshhaaR$>QmW??x4N(t
z>4R-&T`qBDX5;mL>GOsDYNwZB1!*!;Q&@E)S`n+Dpj~QX3l{f{c6lR+i}NDNL`{pt
zViz--8ODQ?omVzb;16>vY%B+7=<H=`dZO%2FB4?V#f4Eyh6HeFgfzzUm`L`5Y=2h`
zda>hJ`H1e<oQ3pYCWHk0A|cWyCJrL18tP!=#H@jj=l3m#nK-VklUyY<tVz`%`^chN
zQ&BxC_x*m0_^h!B*ffbUMcyIX)8|byxIlezLzyH_Hrjm=0@r@*@$O6uHh4l7&SlD6
zlUT)e8RGl^b;7t-OC<vJDr(U`r0=%+F~J96>|m1V#5G2U>isASZaUl`a99nAN=A9G
zpo73ejy3sIK|;~bm`B^3bP(el;EP3FFcxqAu(Sx%SAg*c87cX$KxFtECD(hOVhZOp
zRvZU1TIN#wAB^cIeIkY`FY;@B7|y}<IrzLe@=|EYXTf~(g6(M0f=VvuRv7fR4y}Br
zPmYCe%$JjrzAU6v8wUNNAwO~(46**wyib@i3e9dp<JP|0-UGq@gyLr1e<hu&I1dNL
z;Qv(HSw1JHfIO(1d_htWlLnnTDZu$5L$gf(5g3a?1M{T)k*!pF_yqNs|I(P{KW_s)
zB_>R7G2Ggu6#=BZxJPPsM#vhbs~ZA8n^8jUMFhxZj+pS{2-x8qtt1&01lV)JJ{$!h
z=oOVCYHLCl=pZVf9lbZ;{L7K89oT6}6E~5YedMh2RC4c^<Mb!3khf^Es{(GXnnLf<
z+v{~wtE%>t8wC_krB5`xiANQL?ZB7#5J-y~IWKEN2(&Z7pU)IO4Z&hY_5PItY<<W>
z59jCLPFZf15Lfl)c`-=*A_JOUBIJ|q;M_sNKV^^_vu0V-|8s#*XTPp^WSe2WJ3<0+
zc7mZEbJIk8Ai;e$3C*nH9M9#oc$}1i{2$uhGAgb<%Nq^BgS)$HAh-v2cQ0ImyOR{|
zZowf~LZEPWcZb4*yE_DUD^K_I^gFkE?%Y}HeyCM-7FAz3>%Y(5Kie&4bg8=dVy7*R
z=O+g6S%F$#JR+ZzK(G@4Pc<Q*$YJN9Il{yF0Sv6PAf)S#XdruP<!Vq{%Rb>^J4saZ
zb)H2d$%GkylT}+_IOG?G;PQPMD71}&G6cmf3vlaP(y$-;@~T!>vc$N<mHKv)gfoX}
z65xzu`b$AQV!53G$cCeDwHfDjHr3W63?p%pX9FEFk%uI%YO00Ev(CpSsfPBXrqP>S
zjtg}t?v)pysakn<P42#->_@>U;n%pKuzR)L*UkAziKwZp3hg&x*n4V^7SG>@?hFOA
z+OBah4yGE)sA)pPC6kfh*jeuP`8fcQFC5&p0?NL>#Trm_TK7P2;W-Pg2_ZG#o9OrB
z6DJN>IX3~0p<uvA`a5=MsYB_d{-`oTYD-&i3=Rr`MxMnP2n~mDd#GNa7E8mB?0}dP
zY{$D)AsvfPQfFajY*sn^^<F!OFqts5R1Aoj<!%(>)6KrGLcPT*O|<xwIZiwH(H7eP
z^OhWW&xzs_rw_Bi(V;{YLU`A5uHwCcAOMne@s-BrE4I?%J2oSKqB0wewN@>`^%^+B
z54Iq~YLXV6XYR9*A2AHGoW#zDT6~AH(fY2<7;bJ%oI9MLNejFcU2mSV9zuAe(u4BQ
zi6AfHs*=0ZME0yzLF-%rgOgQI?=b$mP^J>><J)M<mDMWZt8GP4_X#iQLxViGL{?DI
z@|!aYZk2+qG{>86vkq>~9htE3tABn3Azo|zYv^zb@phot5<$_T&6>99po~b&RhMVA
zw_3J^HhnufxV**|U9m{Wnw)SXtiL|4|5N3$n71XB?J(SwXu*OiNB7NW&0-b_S9H~D
z06RZ@fTvIra;nyQ9tLoWpAMP{S&`5iZm31@tseIfBmop`Zk0@z`6l)zM;TTh7(ExH
zs57r3<^BU>C~Dg7=f0#kAJdVw5wO}_<JQ^TE>AF%Nt&0!(Q2pQ)`m<dp!T_!*5Rm>
z^rM+BnV$63rbPNux<pIVQf1XQA`}|nW1YINL1qm>Cxa4Ql=6e?4$G;i(3Fat^I{yz
zYz_;J##*9iZOwh523ldnW)<QP`1lu4cAWmb?UQAsv9ZJf_Dz0KWS`YC*qc;LpwH}L
zx%B6vgxT1RTYKYT*P^#2R)TwBy-qw&=5~2m`ZVLWT6zbjp$|#E4*kxU=G?&iTttB`
zpDa2ci~5`qJFvgNXf}bqE=I|yKhI64X}Q$y=0T{G>M#n9;eD!zKx|(juK`-U@G*C2
zUg+?=&ScP%U^6%GgT-FNoa{%YB2DQh!boWeTFye3NoVLfmd1{GsODn2MyoQuCftY_
zeKoY)F$bqbqG&lxUfR8tUYqw7T}$QyIS@IsRyVEmk*J~r8PC*`h7h>0wrcCrM<shk
zc`vvgaYv6FEGE<6ggEX(Z{)$#XR-I0L;$FV+3|fvbmN;vIi3z1qORGOUtEPv0CcX!
za+a`xdc-__wa1ubBTXs1@8EA1wQa&tmxH7qu`<)6FHOXIA%1u4_eqx{dG)j=7Cpm9
z^sA8yCI+m+eJuD=EPX#lzX@J}CCtT3^Itzzhk4WT6>^rgrW|04WN+@N`C;BTCuJoh
zYn4o0=w2IPDOvYh58^7wX{CuT6glZrMakP}s;@ZL1jUI?%enuMvAn?-gSIyl+8cYI
zmN;lDl{ug-&F0YkDke&nxgCAufL0hf{DCm8sLQ7{vr%?R#+u`i;e<80=vKXHt$@9T
zY=@yu<JB`Mw@P*zX1PDg)r>oZq7H8-qMW7Fzsz69v60svnUMoNrHVa@WsD~N0upy&
zV~WP8e&B<V@~I3E_dhyOXxgAaI~`?LcLAeS{<sue{&b-&4#--uGj{t_X69_PEm`ZB
zj};HGDcHkirDYhxOw8<84ITY^#{RMIy&sS}URM`%+?WX!#cXyJ&&<fN?S%VNw>QN#
z3TP}8Km!~B-mIj&RWHJmb%yCc#mky=zU)sguA+Vq1npV*$P;@k`y15yki~rnm>WO^
zJ5BA7h-G<=1bWYKgqvW5zKoOxT3TcWxsHKX9&sp$RGWguDt)?Bpoui7A~TW|#<#i0
z!iw!XV`zf+0#OCi1o<&^+Cd^hzCj$8oh&}xIN2K_!g1<Har~46v=DReEP#AuxJDqt
zZ=evYSjLNr)XqZ?2F9_f&V;M(BnMdGl|&dz-&P^{efw{gc1@RFlvk+QgwYPV+0Fk6
zKKF;#WBX+(WhFEyE(S(FB%_`;1(6<4)zSss0Io=0RUta6|H9mbXy?#;MtQ=$1)y;v
z;GYcb1|4--_Vjr}wmQh9Hbo5E9(<*2%CRFkb`Fo^Aepe#J1gM?$6q-=^)le>N}G;{
z2GkhcvVP~`LH7G_597lqlUf91fs2E1T9pur>#ujn=Qx0?`Al8EPdU<hNeuf^)R@m=
z6J&7PEc-*~L1diN{~OXy(jbc_1nc-BT*Pw>>2E9=Z>ty!>YtB@xAd))LKuD!5{-I9
ztqV6uI)~<qHiWPI>mBl0xuWFPvlWO&LLrAnlo6Z+p-FKd4BDH2*)Tx}#9_1`b8kwo
zJ|FDA+A0fSuOdBcVeeF!M2j-ORVUq~y6C^92q6;=l;DT4uzzAD|N8#FCT3r!ME8Ca
z!-ueY%P8APAo+%7^5g_V{y#94I&qgdA8R7=599Gu;##wW`AN?PD0E3fP=Xv-?8GcJ
zP+h8hCXG=3Fl9qm5*nxl%))3xRa~W1h&T#vx2Q%CqD12BqU+Sp2aWN2z1ft>F&kR~
zwIu#B0}Z1DFJkHuEC?qj+rs(-E&>Xce)wQ--YY;Ev{*Aw<L~Bxw7*iHUxs{UiMuB*
z0a_j|wX@NbL1vKDeL>d?aVD%GO2C!dqppct=B@(Fv~N0W2k%nSG-IG#H!He{3|(pf
z$1LF-i@0qW@o`&=IlsCrB@lcK8~w)0iAYD2gn+q=hI8D1to04noU&g8sd7Mc*=U!N
zqaNo*a<-rO1+t{N262SZYy<;OCDN2zcQO5AjqcET0jsN1t435e)x=qztMtKw6-r^w
zwvHQFC4?yYJ6ZIRe)9hsE&u&<{T;V&>W#X$$9)_QKfKUR1_aMRiJ}o6ELmt1F;C=7
z+==*wa|D@KGa>?0*7@km2u!0qF?=$?Xi%mXGO4gCB>RMnXpJazia6yr!(v34=n5L&
zB{9<WBl6q?Mh-XH4Dk4s!Z4C(yl@|%-f=%+d}isZb-qAdK{}H_dvY#>WY~C=56l-<
zm6|<7^yVsnGF0xcHMfT0^sSliq&!ILdP>b*KPcE}BU2nKk(OGwY%0<3NFT&u**f>b
zWUlo?pwl+DH~f(fUg(fE8ejwM&LD}<NB{%}j}Jj0f9naw0VNie<_ZUjFeA_Kev58q
z34`**YQyr1hly4bTC<3)JI1EPIo&2gj_(*AOz0aMG1lhtS{Fl{WYk?`lwdoC^5O6_
z9mc}9M0;C}8zi6Mwf&sqoNs7I4Vq(C<yqLZ$MIYIhnw!nv_WMjQDNxr=0a|@E9dDB
zpbTt|CI<z@9!qz3uw%rwWw7H5de?a2RkG0+4yLjE>SMTSb=i5>_1KfWzjOSMk^mF`
z7u)v_9{=B+n6NlHFtv+4qO!^N@}N5H%c+G+XkR6|FZ%ETeE1{w%vHB8l$eg$A%&2|
z6*~%`sVl@pSNN&r&SAyr=}DBpxD=h*OGdvlqh2u<-N8&^DZdQ_pC3!{UK2=B3hor|
zOWr6NT4kMk#{j!25_VcjNv{LtJt&L}_}_lwvKSotWU>)igCJ{*!@4YqxqJ?%8DY~{
z=ZI1}i%lVa^6Qre21V7)%Ga?%jxTqdt&-w$gcU9C!y>CGcYdJi??HQ^i%pAq*WsrA
z`m)EJ{)6eGkt)X5`P0T5&ZtahJxWzl$S|qH(h^xZ_{Oe={R`!svelHyy(CXwQi?Qw
zN7!`v1Y>UvRtw<!4>(xZVQopWD4r*B;ld#KxH-qX+PB*Eyj@;}JYr<RAy1V4gCpu+
zJu;noD&PLJoBpZVRD7R}qZr;805yV=OhIK8J{Jaz|Gkf_F&iTRlQ~^+D7l-otaAiF
z;2YML9l~6W6OwkhC1(sejR*WNUG2k{SmlkQX_kvmS?Gy8@k~e;=p+$g1RHAh(8on~
z53&5nQ`}Kg(*j0DvIvfcPzeO$uTr1;0fl5Nen!RhJLn7Ht31K<xfif9;Ar34fB6Cw
z%qAmYHVnjlPx*CHYQPm!se06>;%Mt_)ifA!4_cr}c7Qjc_@oWCkGE<X_DHF}@Js9g
zV`=Z4yHvXUM%Pc*F~wA=Za&C-|7mG05j_NDS4zi)nl#1^lcPSaH%(DX3+n>LLvQ!I
zQM2#o`j}6pF5%6=&bfg5n|V0G6+Ts!dEgl1``|v#!j#xgxgSBgByvV;11?ko#DN-L
za3RC8oyREo<#P~dq7T#MLnND_8#WY0B`B$aNgkuifyqps*<#~1CmS@c5)3TBOxCEa
za@&J$4N#nBP5!+iFp%H9l$4@ugiGjvrYcsggGCbYbJuNrq9or#19af1uPRb)4A<jY
z#+SU$%g2ROzUoX?X}UZmwzCD3`NAFi(47!#9C(QHTbU&IC#i4X_b!Jvo&wWmz9tCi
z6X5i<B%}`B$W<iZx|)n7*iFq}Z)OH0Zj6`u30g(TrU5tcde?*eW!~S;*j#D>NQ~{4
zRdpuAHa#u#*{0)T@p=JGB_4yPgINrV;lS~udUfY6v@!+}&u7zhcqevHPl5oBHS=ec
zV(ECN0J2dOtt}ICGQBGX5%w<2B;Z`wqgg@~uDSVvtGtJ>Ig7`JjWth$BV(84i2EEJ
z&c?N=;b>Y>z17)!9QiD-S+PsjcsnD=Q<EL?Dg!8gR>}M08vCC?|1LMz7U+0rxi!L#
zE*Ge*z7Am(k+gR6S-}kpBnCofL7DA+D{K}oob6;;0J^D|l6=PPT0>`!R$QT<8t26h
zy~cDAD%_p1M1A{3_H7CfCX8Ks5ysaM7m$~<iII}e11SCu-5?G{&rH@&w8U+&0L-fq
z$fs}w2Hm}zQhGq<MxlJzWlv-gvJ=FM@>vRv<)II7#z~F*z_yGhyEzwH@}$+-xq;CA
z;qk&Fd=uT@E$y_<gF?Z;F+bkCEO%J_@C*gsoy4v^F-#QK5#4%Zu=i)pn%DU`YL>-Z
z)hq{cj3Ln9zlg@mZ;9wG7bidB@^r%{&e;i=4U3j&L9=Rc{;pJ<>{Di}$+uN7Jc<Pq
zWU=XZ9SYqOHO>N>_m-rF(4+41HRjKg^BcFI6+gTc|2bfeB`tWTv2loyV^4o;`&qDd
zy1oIjsMB{7_LHJ}qtA|$>DaiU;=K^B?UCuh3jjL_ru`(3x~9fyX_449<+|#o`6I~p
zu;s$^2aX1cCpmdGp;`KlP;fL|ob!b(c{kY#FzVEgemPgnP47M2a+&ORTPNQU)6yU1
z(g1EOtLA!J>G-od<UJ)pNx%L#o~)wYx2fA3=`pz1B&Za$X-kPH@_6s+bFQ2vLTNVl
zO^I|^MPlQ7MWZ?EH(qe9P6efCZp<2`CrJ%qiyE8fp+ZMm6BH@uC0&+u=YaZ5KLKrr
z1ai6rQodyef;D8+E@#<6MYsHd5hvK!gEPLLhXnEBhHBAOyDUNOE%G^8Vfmqas2$c)
z4WN=HCK0?AmguTu6-GV!*pC&mY%{JKTi!TmzZs`Q4?65A4t+6vOp&nnSbK}CxU8uX
zPAdq#j6r1veeDe(nIOZnoh*Q>&<-CgZ}se3z4;u3SlpLEwH4rbl0d#}wSChyHyt<|
zyMc9=ONr$6i?I{5_8AX~#zZwlm)eBxdab=-sRG|zrU=&iRTOZYljPbPV&$f&W>DX%
z<8Dqre{f{db6~CnT4oq4zK3Z{DkbF45gYuWbV_`ef=0Q=kfNzhVEM^kb=dNoC6MG2
z8+U0~g=;Y?trEgDqBJ8NUU-#oBwwd?34q`Y6>>5F(r|!~Zoko-E0p$^M_0e0)R?a?
zT$TYmSR5TGAvudK$9xa(La1}>u{#(T5#&*rLA&Rll5wW$J}w+DA7X5`c?B2wSc07s
z96WTFBn`c)y9mEOE}t`7e&&8dm2%zWyoWfRjr4IcCR3-tBJ!DMWDU_{2w_v{>~qfJ
zhZU4PJi7|`%z97rVzZ=X;nb#q{EWke{%swN3OaN<xTNEpa=9$m8er%$bn@g=Ud_j)
zAR!vDzg35~khW0<_R0T0b&FxSweT%1u{V@;dE`yR-eq%xw=JmZTtbaG;bJD1T$gIY
zs`1M)s5xeV2oNQLb$JwyHqxXt&kfLDV}%ft9*;_=qA}F2nSg}+;C9&tP3VVzcz&i!
z{fe5hKV6OkS6J~FYOrNnA9>LL$;5VEEk51KXnx%R#&?;Ik8*O(Yl?Ur_NY|cR`L4P
zQBnG@xZ>1)<QNWeasAx(x}#}HLFMJh=H_b@CFE!{I~I*tGhH{4ck_2tO#2w~1f?b~
zD^2k!+99bG!qFr`=bX(LTvc68#&)4iu9jvwZ%<}szf`UAdkMXlBw}g-q0k2RTG)l(
zPiK-Z{PJnnU30&9|BF)^=_sy0F9#-rMR`ttA?jO88fbb6ITTK6a)IM>MJjEw`JPG6
z=!X>q8s|-z7UaDJJu$OqlH_=pDl=VQ_Y%qOIW;^~x<uYCB5T_LBv0+qkqU8@`8NwQ
z!w{^ogM~c~Q0@>sRwx9n{aIK`7#C|7Ry9gInn4GT<F06Zpl@~~Dk33r+x5YotGp!(
zf>tX%aJ7q0_nl0t@^oc<_PDO*O#g+uuvxZ;o1T&0lYW?2`3b?Ei)L`t_>JL{5Q2PQ
zR6w(EI^e0CyR#LRk&UC~OGPN@u_s)9=xtqZFd(Lga84htnsP6mf{6*uBB+m7+1sVS
zDE&)zvkzz)JDTuTPXe^)uJb$VIo=dV75Agb=!79GJZe%^(Os~Cpt;x=qswRU2jRxn
z?wcS@G}V5eG}#K+o=yg1%!yifVI6yWRB?Z*{e$U;nR#F}#L1m~_PGX4CX3;f6cIMl
zp2^P-$Agd%d}ug|vW1HbUE&8Zzw}R|<H|d{^97Zm78!;&xe!LhjGCAO5DbTnmDNdH
zkakUD*WMXi*zX3!@6(fso+dF-gHd^(L6Jn1;{oLObl_xZ9wN9if8x;f#b3mAh8%OM
zY<5|7V{8R+<)N{s{H@_cyD%LT+lb89*Puri#1ypdwZn$NHgEh${#f3-0+iK4APa;x
zocNagjIYKYUHjDVtK9JoUK~1h!sq(wJqc-Vk#4k;&%$kJ<~!yTJ!=bQlb;AQ!A%C@
zAF|2nVKmLOxK7Ey7pMGMGr`3bI0l{_AHnuyN+7fqX1s&0fS^VW0SFJqkpYRC=AorA
zZTrfadhB)678>4AlDxSsCtq6G8k05KFio+UNS^%9)A}FM{vWctM)BS)vYwAhC>2KD
zBG2f~v|uUQNjJf$-roVp?r$Bx!o@#rQYt{6DKW#7498uTz@LsM5n#%E08guA#2G;;
z(}BrMlh>^J;`;Q3qdr``+Y`3J_FUD03!|R(lZqKx!TXah%~^b?YeV7!M<}#qr^C^G
zTJoBMOTLA9AY!A6M-@)bfe|n(^3+R1FF8pj83x)qoo?xOzo51L1~>7Puz2apgq+oZ
zKIkKw6Nj*~SPPY$A5qyx8!~dAq(z=kEuMVf687s*s;Lin#J)}nXtt<jJmhqdz6V!M
zeLT2c@JK+`7ay`jqdcG`c?LFf6;W>`|Df3&bM`R?Ev!kgBO+A-YRGtHvY4PNd!$z1
z5GnV$h%f7+c^FHQkhZ+<60~@(qS##JY8$+c5{nO{unoRwtRIW*!zHnx|Fr*6Q5Kr0
z@*J_AVH_qApw9PrnOHTYfY*Fvgdl|v$~j$v!cOq}Ija_2pAPVSzpxP+-Z5?|Qkwj0
zmJ-WaheS%j6l%Qrt9U<v?(G(T<IQAPSvJJF6;DKp_DXj^PvLDgA?2yXy}9%O30!d@
z9+D2I$yoso;F<iadv{kT00TMi_ThCI>DE_>+(%Uo@9n#PqR3ax3cX3-QR-as;}J`I
zf;<=Fgw0k}g+EV1M^QMoLQQOi4o-f?V01NeL1q2v+9{Yg%RxpDhVWRUcE_%qp{LWX
z;fjY_qz(9`gc7%HNNkDPq(qc!>Wjgd@?-gCUg%ZSE{>%qVL#R<$1EsOc@H=Bvmx!S
zz}^K;`e*}9SH<@9F=R1^37Q9_)#lD9>*}3@A7bcPK_i4tag>dR{#9HFXBc)gX!?o4
zRS5jH%cDhyx(ZNv>lN~@UhzJfizsm|F&Q;ZGBkc}F?c|=ZG~_vB(9=MP7yX%K(^I&
ztsrfwD(+A%S1ss#c?03LQd(%pT|NL!ja0JxOchE_Hs|R;kHlOAOx<f*Q_nbC7n4^Z
zcW@l@5eLyjq-Zrc{Yy_2OMZDH@*U+P9o}&-Ou6P%*CxwGshP<9b|A!xrZ0zxSkH%@
z?U+v<Rw2sRvmfwJeecIea|oscLD=Ymv?~byhEn}2F>7N|)|BEETN2T{z)-`hw5eTq
zV+3g`sdr>%`GDJP+Pz#qHjyA1CBu)jOzJ42ekI^Z%PJf{?$h~KEIUy`yFmQ_M58P)
z3UrG1z0cA@I+a=USQsfKcTv)aIC(X-j-sRL4L`1t@4Tw;y2?t13XegEYn)3{4jXNy
zzq|k7yX%33x%zY-U;e%aIJqSy$O2O0CQ0!u6;SOX;bX$a9r06^BHO2VH-+36u3cLl
zlNl2cbG+Lb#gF)?m2SY{W1DntGyeAM!XU1vvtOEO@OR9OUiz)@vcy=&hF=fa+?%@)
zJ=W6!B4Jw%hdRCz;2_0i{*gm;CqKOC*}ctAj3ecX{5ox~j1{CJZ-_Km>~6+)b0{Ei
zgmA+WGNS`eAB@0TrqNn}FLMIc@f3v9e8+TgJt~|&GSP`=Jkn{q>K?qpiwuh+WY<g!
zsi0~xR&=*LO4_NHxuFE>qrl=V(iOkdIN}a{CpGQh<)SIs@nE382@|Jgw3AOQe5SQr
z<UkY4NIq{;-2vy|{`=6U{HOD^t>_1cRuOllKgJCJ^q<qk`ig``$shGR_|ZnoqcgA)
zX*<Qx>DhwM<?U~0zzyY~KL^T;l|oSY)CaGucTyhX=sbu-ST@|)O|+05IRwmIb0AV=
z75)_uMl&l9R@C=ZU#{}CON+c#A7(wqBk#$6j-AI9eM;I?U<CuOiPY6W3vR;2KbkkS
z09Xz78WjZP@QrPyuoQHHCS`S>E7B_2lg7_3Pw;-Z|AxUW`(ZLS<TcAqP(j<(z7M6?
zltS%he+Kguf<~-?QuXSvcy9%gZ%*)eC7sv%?sA4g6Xf3bGKrVT#R=HmraJB_zT8gT
zxP8fHOUjKnSoaGdsI~-yo-r$?`MA;@quY%5fL22c4z5}>r^h-_JB!AE;wgr230d<J
zA*M00-1FHAVki*~`U&K(^{u!Pj|KyT95jC72LVFTupX=f&g+$8Yy?aD9N?}vlj5JS
z3rHbbu*-Yo+qK8eyL^y31iJ^bj2Bxo_p6yM66?5rN_LdDbiD7xtJa2Mmr-XkUKutU
zUhe(Rw-ZV^y&tG(6rOfJH4E<mPL3mp?xIv>)mFM8R^sljsxbrbXq`&ZsKzr~S7W2P
zlOWfD9iqk3VXK~Dap%d!x9j6sp-q>x-~j%&%4iOu6-$^as8|PGko4rQhfEjra`fOP
zN7+PQ4A%{OX6)h(*To`;oeGiVT9-Bg;K~uchemNVCEjSwq}F5(x>e)zzeS|Zgn;Uz
ze*>1W;wcIK30MBh_wg@H%oTt@YKgG$7Ox$b>VESCcK!@-<9)aP<}xe-jQ6$I{0y(E
z;5-Kd;oWnN`4Vk)t_Z5=K`Wl}w-x5xD*xj!;CBaXnr(^;P1eLhx?h^8iKZhm#G(Bu
zt_JPh&F$LKRX$bE<$?wV^|{|Nx{Bm&qH`s)jB4&{{q5kK;WBZuhL}c@>Y~_KeV^Ab
z4ebP`sDgbfzS`4eSS&BT7Sx2+&~)_M<BemE`$RTH%z!Tx+z@FK?1&nO(_{p3tyVA%
z6@nMpYwg|Mvf;)By;u!gj8PhGzP|ZE;@QLF@TRT2V#nUA-jQkk6jcH?!Xk|=0KRC*
zr(HlMr{uIN0R9NWs%_rD0HcXCj(i+nq18s<X}Rk*Ez#T=E3ry21XCy!pr5&4Kb6t7
zsAfQ2P_EsST_jrB^cvwT@8&Gtr%MdQOqyw+z}A}eJmC`o8(lm!+-q+p-XR;Ef!)EQ
z&TGGAu0Pnws{o3y<j)y$WqP)75rRXcUml+(Th{vMym%|N#I01ZJ|#9iu?e!MTC*?l
zlPy>jM)esJ_`$o(O8DLwKTaY81<BD;Z2T5$toCPyVl3_NKsRn@+^`FWhzeDhftqWg
z8U1+t^eFsS;#Sg~BHqQ?HcX2QDzkzypPEbpNcW^p_3yi<AZ$BYH^aUZ1i$^b_<L@p
z-(FkKP@RYKMoXU;l#PF##_V}HxxV$w`E?p(ZN7c$YC4)We+TUKqU=Yk<1M`WO~K~9
zE2>f9jS+bT&%wAr87+HljsTm9Wrca(Kl?T~eo_M)C7+s+^gXogq}=5*#SuVxI9(=?
zoVuzoI_;1F9Rj<WTrx{&l$JnVA}|m%Ubi?(T;iJuLgIFAKt_dUG~Oq6nfN0tx%2Hq
zq?Oil$Z#v1`DV$JfppQP#~O2(ldScB<5MaI$Uk`fo!jXC3*jAwuY>^lbbm}^zr|sn
zg8pWRg7||FsYe5ofkGJnpFL4ilk4kopFh80HfTiexbJ&^-VpfIaQ`q7$SOHZCK!0<
z85jnOg!}9MVvC-M39Fq-IEEa@jzI+Z?|}c`NUeuoDYmMA;z$1QTVv3F9piszQ2PU3
zpAT}9{kO+HI+W|vywly*y5AMb?b&+Va)aa6>1s=(>)!aQjgAoQ*8ER>b(gE%G1-fY
zi;P4f9*5ub1|0$Za;<G`bURCRpVVD$4(DW>Ty}=zx_3s>N_s~|KFP5fwcZCcx*cFD
zW%I*gVPXB=F@B*DE}7^pFK6Cp*$U)=jMKj7>L`3<{^JiNUk#rJg6p7sU-YjD?417<
zx3#0%xK}O>tB1Wbp0j89TC-QZ=(=Da_%{j+&R6N{So!MMG!?jJ@mTkhaMNziYO$F&
z#2_d99iYA{S7xtcw25iheOba^ZPgc2TV?+$4fE7yRe=;dVKZ~<EG7gu7jt6udWCSU
zasKXFBV2~#uAE1o$=6N)RG)F=-l|f1<DUqDaGC4>zH9329!jFSsL6dsc5rYAkBO1g
z(3pKiq@<!Mp{ArXRqO8QDWPU&wo?-m7cZfvrZ$%Y1_hN+)6-karRyug5f!oFyu7?5
zU0&{tFkD<+Wnvl|uQPaGZ1yD!2EO>I<p}w5(<tW(?+o__KP_~;a4poV&h(_}KCYuc
z?lgYlkWX_&MBG4j3;W=E!i@~-<EJk3x|&+-5<EuHksV~UsLxQ`-UP}kul}WWED*A$
zmgsQirxV{dQp56c>aoCZ;HvIioWlB>m9~_qVpVV4NOwnf9-uNw=Tgv1DLp)+SdQ6D
z^)n=S9Zv{5O}l^&IP{@tF+D3}IR_rpt3qn5`1Ee3B=AcHAyU=qD*Ts(7;B2DU5TvT
zW(F#xC+6+^jz_ra%Y9-t#67Hoh<h1`L0R``oU!|22kyTA5Id10RJLCB5WH<3auVL;
zjwGPX`_ZyrJN<Sn?cOI8^EmaauZW0&o}AC_Rk%R0`}fQ{?o1VXga@dNbK$gbmyKYH
zv5=2LK^*a#ligoy9%k$9)IMOEQIwBcO!xuv^F!<xhMQzZ@2P!0{4r3<q-N-7OZJ;a
zwKI?M2#XrQ`JZB=Q1v}wyY2D)>h9sM_+2moSqfM~{dd;;tpwzU|5n;|)ecB2{8me7
zvBPD31~~GS>md`@sWOH2eBbVS=O7_1eKmYsf{?2c)k8N|a1N=Met&G2e=Z@u#Xpx~
zEU}G$zm%<`|LaoWs_Q@g`u8uxWIp@<zGvSZ%N%H<dlxA;xitT!E1zPcWoPRz4l02p
z!x`KVfX3Qhx;u~lGURK^pj@Gy4g-oCqgD!R%F(_RdB%wusjq2dCWSxB#)%PsMVqhR
zIB4%vF>rZT=0?RYaUn4i57X|~NK*!p+d5RiA!`|ZBwP(f<BCcZ2f86tNbA;)c6-^8
zEstMf{GPZ)Tn5Gx2;@wgElb4h<=NXUR!@2L{DcngXhq{+=l`W=-E)U-mm0<v=n;V6
zVCk|X%s8`hylMI*ZH0;#a)V!^J0QK~T9eL!VQD(H3G!cw-t6YJ6ImYc2@M&jwqH@$
zz5a@I%RW@xDqjtf*Cs<<?w*u!KPx^lsC3umIQ6ybwT)BJ(46^{N?J6BPXt7Xs{iHl
zk&0i3PbQ~HcPQeHmWxPSB{q@H2&BQ$TXE#QGOZ~-TLG<c*R^D_4KMV$Fp+znR8a!D
z&qC->F=LU}y729cdqcc<!8{Xl7{Jg5BLTPD652{=t<X6=zNW6YiJ)@;Mh`vC-pX`k
zsE=S(`2fTj{M2No>&Ox3#$iJiCGCA<nf7azkz=%8APSonT-(Off-apkme&qOVqkz?
z;X9-P^G}Us>@;p#LUFmG1(!^ETh_$H4c9oqxzr<r>B|S6{JV->YKq$SpL<jHO>1#f
zmnhZ7#>B=g3Fww|4Y+^sB69NRH#!kDWaIO=@}8Wre(&XjN80CGk)nv|@u{})Jt(|V
zQRC`-yn>yzGzBVN4Ckze##BIg7**n9*;Qy~-1yC0*o)~MaAn#UXjCjRZ`cX&Ec1}`
zyx{d>eWPNXx3hF&HC$RZf|+fN9Plus(Q)*T^}{@l{bT0mMG|l7YrJmEVR~(pop3qe
zn(Cf5@t%IgjA-~f-Ayj}?~e%wBbdX|5BhGE^!_gJ740-9`o{9*GOeSx)@FtcQsJzv
ztpP{#KUZR`)YLHb^z}nLou|*k&>`vtzW>()gZj_MNsT44QQ?Y$5e#{l?W|$RG7t=o
zy_fQEppYA8WdHDi(r>}9^*jmU@U*GFy>WtH<+W-Jt_x-7UjNoIZUhLnr%U*KA(@$2
zc_s$Fa97dL2&)Q##^qxUu1nw}&d$oKunYbv+_ztNMo4R+$bbPhEkngIL;^4Kbxn0)
z;664_vM+{9v)gB-dn6ga6T1cFr!sEOT?0(&F!7AEu8<hWuq!LSlcIT4eojrLD7VK`
z6^;T}IUw}Gy4Coz!0e?RiH;1CDtV0j0@R?#dfc*UBn1I81l}e!!|nh+=%+``u%@c0
zvVV>tkspZI)ECp2MP;OBJD{O@%V+N$H9I1ZS7`fAUw}zRZ@J6zz&W_Mmf~ztQip+F
zbYd12)vdKKn*^D&4shy&QYJ~21$KRFpc)3>VvtAu1B&C5G;^)KjQ3K{)ciX_B;1}S
zXxPl3F{@d)Atb4xlk*Kg=ueJvGYZnMNN)8MoHay?ajczE@~}(&^*YvP!6Ee;+*~X=
zmF=OmzfBy<SZN3RHCem@oKQ5jQ%nF-d*C&UR5-o(8NJvaU5fjTq+-8Q#M!22LyGcI
z?0%M3Fx_o=8_->n<%A_P^Sdd+c=IkT_2{Uh^jECO&|Peri?BeEI=HnBGJVusMNj<^
zOGRE!<nK-uF3>>WQ~!jKB55ySfq_g=!u`oBXnO=6U=G5fI1t|-t^6GK^e(-!<x6ro
zg%TveB6Exz!q5htpu(wuRw9{%t7Ia}BxJRC4rTG1$l&S8xc#zFQ1*O49Ij4aQRpSw
zDA1q};;}vP2EZOk$U>KXnOM}^MTD+F;auMDtV>mzgb<F~2~@;gbkyH3Ll#;6U8nzB
zwnS6PJ|oKjpR{XfwFf&WI3`6%%j>a_{s-w@!~3ADL{!74V}2)KTNA-*X9i#-!+ds9
zzd2hXGs0ETjhb8ER@7(}#)I1}Mx79e1$X928L2vU4;DCf$!HUFwqZY+z}_Vl_k@7T
zD4}J*@!jQdN=+)4MB^5fTf=~UOd*sg>4TGX6<-@Xiix;QjgJn|p{U|I!5*nrLB?=b
zZ(~g(o+_STer4$!7U=ItZR>W?ZWNWKLC*_UQ!)<=eKdfy6k#{yaueBw(3ClsW8s8o
z=GPLP@=92DLwQ?uTPC0PUsacF7D=R3>?%Kk)uWsOGKn}D{3UUO()sKMQs__&+T;!%
zHMOR`jI@(ehvHFE(4$?5VfI8~oVvfY{Q3xXFH9t2Ttm+V`g`=NsB!>Veqd#j2_PZK
z>7x=NL98{@)qHW!I&8tER7d&69~W2<n=uTpQ0v{sj%>uF*3k7Qw)4MCo5_1|;YE}0
zT`2N?XZUD1@y=sj2~-CP2`S=Wu1z-SfNa+(Zr#5x7g#VUDuPn<|5QOjTuuxqkn|SF
z5j9^S$BTntU;hzpz@CtU@J|U}e??3DBfug2762b6m0$WT(ScT;_pAPXe<Y-bgZ}X0
zLu01NtzAWA<U3L!pWc%#Bt=C<8D(W@dwUjs0ReViUiuX(lw4a#N4|ajw<r5Q7pl!a
zVzK}13N}BC!T(1YgM1lsIbaUVPSWm`^)Q<mcy+#@!?v4$;tmh~(ZcrB(9wlw9QdWu
zaugVy#k}h;fMV=_1Ka-l(lh<+5#PQ1E}kdm3_3#l2my2ajCx8Zmd*wmpPU^6GwXk5
zd_|fpAX+@(k%s{qCIe6UmnN%L!o|asw?G5z#MivBW;t|_<UY)IxXT;4vtdyD9(m2M
z%7VD!&KHQ(yKSN(SR;3rxo<E>UaAF&^{n5z_Y{HKkLZ;k8xsb>TGyUXjzr&`O{xev
z4adnt91?ZUER;F?4``$Tg$aaOSw3So2Gv$Mi-e0kcGx;-vSNCO)231J#KfUVM<jU#
zrC~koH^3ZYTJY=(zil(`{_-e_fECb)$PcIgkPxKnk3c7+tm0ob{-m@C{vxj9P=Jz&
z!jm9P$pfAY15u6SnQz59H9uI0go4Q4h3fgBdpp2uSn>IR0G=~Vr6^6ZJf~mTjH^*d
zeaE|>q&TbJJ)Re*IlL=4?a~uXlJFvnCFKtZ@?Cu34Z(U6+OYc$8^eXxxB-S%3<__l
zMSHAaac2J(@g(}?2LEpMmU4^-`>u6MRh8qj#97Z|rcETr`|p!o)G13vkc@8JL<50x
z;m=f0%H2tq=PSN%rG?PUn!a#HXFKG7p5Dy)!aCf`YA6JDM3iLN>GFwPMzYDwfl57%
z$<M@J;^w!@0$A)TM0UEkikI`|j@<yS5V_u$H>8<2mV6^wR6RIvdwjEZOVVAOBA?GC
z4YkXp)X7tw4e0_3bkS}ph-mgJ+P@t8@yFh9tG{TPya$O%Lm#o4=S57Lw=Eo}V>GXY
zeQ!x1(G8z1^$UJ92+RCJtHA|P*!W72w-w>=p2@hB)DfxjC6gXKRP0N2vRajX*EgAA
z^@%&?3xz%{A5-dbJ@UaH%rrYIvg52GLo8Kzimu(LT_xKo7o=V-Uua?CAd^l#FsXm$
zgCuNHY})PfJfBqHOL>dI7MynU-Xx`gthTgx4;e(2JQ+}P6(wL1T?O>F_$%L~;S!0h
z4#J-Lj{ibW+32j;;+0q!I89Mf(bhrD?X)~4wh(EB`?1Im_NPfpI>7Z&u1iCvTo!?A
zm<Ua(MJ;3%Mm)8A$F|}`*0fk&@ljF-LTQ)vxJ{vYo$`f13&fecj$`rGp7GA>tFHM-
zV@RLD&d;o<s>Ify;!f6eL>N@y=}y*+!RTvBVnITrHg9*V8oe)u@Ece~22zBU^D2wc
zJRwWG7WaS+`}rTxrf<|SRfF$;iS-I12bV<QB&R4k|8_=N(tXc~c*}%orx+vIhzSm3
z9ggx1XwJjB)6(y>-mvK{o_;89<T7aoX>oRjs`JhECriiXX}9wWVjk6P)1Gu$x-<D)
zAhYV(f^?eUb57~19G}>M!c4csA(;`ZwTkb_8ImeQg_|r9iXO!O4E+D?aJpCG1(%5k
zpBbX3shM&**1mmuA@wjL@~r;*wxMGu)cEk=plf<MF-d^-!Y{wAExRSdil?oqsj0NA
ztZVXhQ)TQmW^!(>ZwN2b>0m6Ar~9Xf!=I8Cj`a80<v)j&zn3(sKZz`Vn{573@E|3v
z03wM^MDP%&LL8O;6PL=J)CKh&4{J6@Lqx|0-()Ms6xnkcg~tAsTs8$kuEzb1>HxQ>
zwhhZ$*U%|x3&2ylL4EHUq&r}*XYVRL%g-ryVxF7sqMXn!g_sfiRpD*<_@`9nql&8o
zYPI5=fP#!*Icl&h86y~yw<Jn?GbcnZs}PhsVc+=P7@35IhW`6^QB^58O9#AoDX}T#
z2llRtIJ7PwXh~*a%r8EPB>}br(|PbZCV6jBO4`obACWyPA1HYR(Gs+8yHqsOU|Ke^
z0mh54{wP+0a;JNteKi=cG;yfn@*{8Qj5G?1TIF?&3mTDPb~N@Pp=y(m@8&(a94m!p
z@kl=+M|=jz2>$3H$E+mzeCoOG7|ttzb}St?-);E~Uh3EQ!IlmrV3`J1lAdW05Zg?p
zB*aL;cPwfz3U3>})a}5TdW``Mk%bUh?@MkUWKaGc#}HQiY2f&@AAdf-sia}vP*|4=
z^YoR@5dOyneRDRGuj7`!`5GSz5+6~PziMc60jb8GyVLBpXJLN&&Qu&Orjf(+hkSs5
z9g5^?DPWJzEUB0@^)%xn2ul_;=C<MWA%;k4oN1;&C5!ZtoVUdRW3;~gBTWP;#7%+g
zoT#A{3x#R+`YccG*g}TkcC{jZV@FCt+5Un{2VRMHw9UNCqjQ?q>W@?(aua4ax%6li
zY=(Y(x8$@KfYVSBe{F~)E~dda-U1dg%!U!LY6Tpzwnn`58B<iyngX^k{mlR5hmKLU
zS~_<4QBq1k^dwb$kG>Mm{Q-K#X}`bL+-_mE|8jMsw7|s^w6T?}q|7?BZ|gb=At~eX
zT3qmlgsn`9YEU7us*N7@OeW%`>n;bNoR{Xo0Z<}Oe}(*mb^ZbiAM81`cY}LNSZ%qm
zMoB}VV2sR}gr?Se+nO?B@1A{nBB{p{SGLD_e0cxJMlym%immH*+u;K#8&i(&m+J-G
ztWW|9*S`)4LR>JNxMy4Ucg&bI*?MDL8R+vlnbek5rIJfjNi*6?DGo2Ccri$D?1aMf
z2Z`vwiKrNr+dlgoX9fe5BskVAm%Vka%FbKINcT@WJ+FgW`=wuh^=@e?eU<hFx&KYg
zs^3Jh;W(AN49u+9Wi#@EbGDg{#cr5>B}E3yWJl4g@R|3tFUDUkrBfess)o)%*416(
zF5WqI8m(bJvF_zjrwCVKE~zRcQ+wnK7U5}1DDEP3{K@k9%Lxlb3CUafx4_{8I4P^m
z|0(ro>hz>&VsS}Ni7*3Qf%CY!sVO6~&->~21Tro4io9%zxL~0@&lx|@fv5TH`qxEX
zuS5onUvG?EpB5EH0%g9`;bqc1Xm>o~cy|1T%z}419RWfvE-nGJWJLdB+=FyNVgENi
z@{gkOH!$VTxOXAV1U6%X8XoDN+gdp1ZB6hkPUBgNgTflB{^0eqzFSaJ;8@U&q@nF>
z<G6xr@~a5^`c%vwDlJ&ykw{wQ{P^wY>`wmPcI*}2>BjurQ=^YHTKNr^N$oiNqT9@b
zxldj_NkEwP<OR2rhz}XNjUgr)hLzf4&I6%73unH46BHc-SuPWr)75Y9@~XM8;xejo
z_hdk|EoK*O8KE7a*zn2Lq`F4f%<fEMzzv0iK_k#`gqcF*Rev;ztGDbk?WuH#C$J3}
zEeXPnS5MwHbHjL5gg(CIVlL#YsCF@EirLaPFv<HK#<GVw`SHfIr&k~n$vL151AFec
zYVV#Uv1XaK-XEp>nlldsK&%Li2h{MliJm^Ivn5V-cHhuBom~1?kg$@hAR<|il%HSs
zZDAedefx%35>v9_{{ZFSz1m%7U!g)}qw6Y6Fh-rQQZv(6)L6R)=PKLHP1+cn>9#h0
zVt}N`hr;VEQBdZL5TPv#!dX36p$FU1dnikC7!j|$32FMOQ+>c$;VtwzZb6ZFwI0sr
z${loT{*I8rpVr^72$t8nGgPax%Q+X{+ybqjq!<s1l$FiMkCef!!bj#97J^okts;?T
zg@v3l3VN*ujVE%q2Aty?H6*I2u~BAW7)VrvfLypBE6rTXDB4qadcKa)ZMa_uR~VCz
zXZ85_a?pRT=uE+@TR}sHNQl(maoZm;mUh>n+`6?2d5|?n5T%`NO(%%!lov)et^31U
zWCw*)=t2%5s_@_*j6V6GB7-d0z7S29OS+M)RcT?x-z&E%JjP>JWkDxq`OBEW^WxP~
z9~7ENWdXANQ#P+>>}GcJXZu*B{6c25MM=E=&~Q)O28#1*BkKvx&qLi~yl%&+trP21
z4jcQa?rdr*UDMg`6O`SL0278u(Wx-PeQJtar5WXYQ(Fzr*_*y30-+W@&68F9vGmR3
zx=SS9ieAT6@2ZhF4+uLt>$Zy8PT4e7L-LP=9w#l%SZKk`I^N`%J6Sr@&LKkK%}xkQ
zAHK60d%VFLU+KAVZEzm;7Z}~<0yOY_9;d?ch}74JVu~8eFRw*-8i)He_rt;AzOfhR
zU--^Y@;RJ$3rf-3o_X1gRC_|WGsO(A$~zy?eAgd|KoTj-drf#gh$R8widBI^u@Onf
znUZYMwu#@WB=R|JPnEd_6wJ7K&bsnqx=FFwlq{tr@HVbl+`gUAPMf%^PyNpM<eG(e
zxtSpJ!*%;2PKesAAb0NnxZVJt)nRGBl8}(lv#?}eKb$|^o%PJm<NnaD>>tk-XrlR?
zUb-`r27M$+hL8U%0Omef+`@tel}tD~gTu;YV)(U3<Ttc|fdQ}X@AjUHqW>+DgmWCH
zU^T|Z4_=RS(D<fJ&eMch6tW7D-@*~<K|0vw!J9nSiwp(ssy*Dy_*{+X(O}H&Zw&=S
zyFUS@wNq{xjSDFGv@L|X7k$?oYXaO6OBzl|ZtP8v5P;Nat!=tga;Ah!xe7`5A#}P&
z%>#?UF}r-f5btSrk`zOFB?d_oBc3^F6{A!uZFe*|^^t@WmFV(hTMZDW%<o7w`Glm^
z5GDTl%;4rG5LA=wT<K5qiHmnfqM!s={~Phr@iI~FqJ#{c(1PEjZlHR=K~%5BM1W^%
z1C>Zq@TO*dvmeY)nz6x{!q<^ddephNx*&YJOx`Rn_1~voDP}Df$T@PBC@Nr@4p^+o
zWlwev>A}WHsxfx9d!zRsur1Y}Gc;<pbd~GSEB2aO@rs5l2E$pTJmjbj8P^bUXK0~@
z93?yqSZw8_8%a;65J!0zD+whOEx9}m`j1?&Ra@$+>glAcF!oZr7|+Dn4Y3X?f2gRk
z(WkeT=V4nJW>+0ZU=o(Kmg8lnRI;$3>Yo@oK|Bq5x~<hv$*POfn3<CwtNAY^tb(1w
zy`*JDzR!G0AT^A>#@}>jVMKy!%yHm$P6tG=LL>tL$<)b|0!=6})GjC85u;zP1mf?S
zlVQH6C7E&S5{xvkHxTHu)5!R0ik&P4>m|<b9@8#qg>Gh1IM93RGo<je1D9G;rm34q
z#V2up!e$S~v54E6vlodk7@m@+S+(p_TWO>!HA~s5m7!w4-*V?5j0{yt(D{P>*pYLj
zh}+r6LQ?!GAEilEqh5xx0Na~^q?B&s1Ut7i8YV?H&`b-d+9-vRs{n>z>ZWwus%Jcd
z8fgoWj_uRXnY4`^pIT2;g4_<vSh0^9A&aElCBzReJ>$#TgcL)Gm0q>6Z69*ICR4E$
zE00)sr(r;plDVYKi}>|(!z?K@eKBXE_{c#`A)X?2DGI@un*pDT`ePGsq05+PCDDha
zcmmbX-?LDR&_tVx1z+bvh?i1{#U3OzW}dtdSlomx)%3p&xX-wcetSUqj`@k<gfKZl
zr`qZ#Y*GeFK4&p-TpFt_H^T|3o@YnhcN<OZfiZztVUMX8>t^wJ(8~U{8QOgj*vK_B
zCWBNV<$Op^cU*{-RfRbH^`MzP>Zd3sNiM#I)PkIVEkj)DP)>*CfAB3bf4SoRg)ToF
z;s*+(2eQ}zFvml`4)pdq@l2OndCe3ng6ivcLn~{ZRN<a-Z^CO3*W~2(kv`Lb*4*nY
zIgfN-#vB8n{r&w<3EXe}_>(#yn2m$ioifX@9d+jcB&woi{W+FN;Ha;ms%nF_Fv(4(
z2@)Y4ru=;XD|QlZ4<Pi3e|B}8;#`xuI{*X-Q+qJ_1;%9YW7rChnt00)s{*ol9f4nP
zzPMG79Qei$lMl5}B^ChJUb7ZP$DEV?hf;=2ME_3+2m)+JmdYpxYk)*(sa;k>yc-+c
zSw?HO+07mo(uJRy6ml!y)`ToO(bbBw>Ef?fC3Xil6}-d48`-+5WOyc+xzB*`t4~T8
zKUy!Ftl9&ABd)%9noJwuJt3p6`+a%;aQJ@vsItA&V9dfRoh?|@_Nl6<K^O+33fID|
z{~QrR?gqXG@z$$96qtnIiKo4JI8Flg7AAGSZl++zC9PO?I(6n+lC7spu@MGuTbPDJ
z9_<tg(H&@ZT22&a5_)eXEcDdU6_5z@U-d90b{@q6n9AYf_`)=1o4>!r-$&l6$t$eg
ziMypbMPNW8O1mLhtmL$i7tS%_uLK+6e^00l(1JxI0hnXv{KCRHNk`D|sGXgiZw?O+
zv+`;(z=0Q0#!h$5cC@z<-ElX5Tv!gu%F3+kB2P6UTcOD{qz<=*V#da~Z1eXJCY_S<
zUFFs$I+5amR9p8E*o&IBf6IN8Ng_B7@9;caJ3PiWhF<PfQ-L}ANvE~I%rprTgA6NT
zGTzga1Oq1qyfB4eH6S_tT2<wx=pBqyB)}|)IaSMY>yBJN+1)Seq2h!<SzwlcP8P$a
zRAJ-Go1N?X#CDbTiZb_;r_@gsfo2GmdMGy1Vh4>Z=_oIrt<|)8;ufjF8AyU33_`HY
z1OYJ0P$itK@wM-?D|H@#7`zb>735!Y^*@^2zkz`e`{pYipsn^eV<!Ri5#4<9ZanU3
zl&45~dbCIgHfZH)#Lwn8S&7zUl;Et=4R%nbkP)_R;Jo-43f|sdkyg7w+TSHNAcj|T
zj8D#8kiBBTck0=V&s^PWf%S2J0iL>yVADUTxbbZAu=+5h5EcACX$IfKK{%Cv3d#Ae
zPR2m~uAZKt7BWkrJ%vG$r(=%MuUtqFh;(K21Tq-(B+)6yXJtiSUb<XgUn9h239>y{
z39TqJ>OQ{SI=;gB`ues8JnP|a#eIaVw(iNv>QkFRX}tV^$^NpYW8r|tGm(j4Q6P)?
z`*28>-v1%@J|>l>eD4KL<khvyI<(_y?=`r48rq9c40C+Qo%;89MQ7mih?UBM>cA^x
z*TY(1kL9Xu>F=J7UqqQy2;s5RqBOcFNSzlu!}rU^6QL(!NTa{|j9qPB4sxG~uu1AS
zyQ^5@U)4aIYq`INCeA&L54)c)&4NQiDATujKU^~068c5uzKW62<-$-3GQLGqZrsca
z#7mC3P|hve`n9Se0q@;)sr?Fk)mV!T%P;2<gn3_K*B>4DNJsD34n(IN-8O)5eH#bv
z=?`bQU3O16Fd-r2gLk;~i%eVEufJc<@w(k!xA!_ac_PPouR77Xz9`f}qhp^VTQxLx
z_dC!zJi>LK-6A&Pvka6y1=K1tf<-j%gK+H_$e<v)5wBMQJB<G#97*SlqF@EL{&jnq
zA-5M<7;<|tEz1Cq=&6as&j0Drq{2CVCHf-dd9t+?1ljKFG(Bc%+E7y?Ze~`<)_>ob
zBde^aD5<9hSx(N)!oh*HxVUIAQJRv1v(Pej+5wpWUsIACZePiA03Biq3J9zfJYBD&
zRoxkTU0!~sG{w&zs9CWq;<HEA62W0eFi!`%*8VqV_dhaX&u`;?`8XFE^^p(1QYr-8
zP29h_d2I0Q5QqX#0@qMpUwA|Yv^}ITMtyRq3ej(mVK`s6a@kxroM9pnZZkB$-zRlE
zzl%a$mo|r-{i*i7v<ATV`YYyldF9UB;X$7mv$qa_{1v?WlwI4EJFB*J1yJtB=S9!^
zr*-@dY(x)h88%=KCA!ND2}i&M6TM?=^tn^w1t9V)5Y{92ndwFSlK?447w+)&i9hQ7
zP2e!#=_V~4u<YLk5PDwF7%x0WLK6?~K+_uhjrL;SP8Dm=8Xkqm`l~x6s?lwOvwktr
z?Ntl*bip5kkXR;>Bs`wYI7_!I=Ji1Vwxu=q*HDqY%CjjeuJ0pxJY@68Z5%12bpHPw
z=KRuwZ0F6vok8Tw>emH?z2A8sIJEld>VhZmisyd0<5~YS@K*4VEEXV5!B6{c;=NsW
zR^Tf#t$qdN{Q<%L@6$lGky+>f>WNB9$o>ylpg-JK;}<v%Vl=9BYCSeLLE!cspU0tM
zPe))Cf;Kc&qshj5Sy14Oa!1h327GvIB)VV_WHD2&UfGwx$DjOy4zQb=Fh@{mJu~u|
z>`&{$VHdk22%C_w=jVzZ(Np=~4fEzeMIbR@Y~E1|+t&YK?yaNZ+P3}A;O@aSKp?og
zI|PCRf&_;I2oxGzL*Xt75+JxGK?(@2g}VlKcXzAmopa8;_x<|4?$JF)_vq%IJvO!3
zRkc}buDPaszEb`u1(&2KBkwinW&&ko&@sHh&F(L69&6p}F4jb1MaM7cS_y^xP(~ck
zmc@_@0^n#5vfapRdZinReB8-grm>rx!}<-jl<Fn{(Vys;W?(0HjC}#_K(R241}?FP
zN=hRcyiJeuaMwCnu|F<{jEoA@H7Vh~hQg$0_<8{UOg+;t;LCrjE7QZxWva!gejWs#
z{=4KFQ8^n^Oe<kN#)@!`MIl`S-~x=p<nRx+z$RacYH~##<4v^ZKw^Doaa=Qix`jm*
zm>|KvgHgl&h3dW{(q~giAZZo3oG2B%cOm#C|2j8;@kZk7R!|oafwdr!2Ub!9wUl~s
z*J{FcVG{vih5J(`_gq2iU~8!eu0I82apF-OOh!L7avF-Tb6LV(z3fS5rp)!zR<r3=
zn&M_9daFe?e@4@V(G13z3eS2A*&n~tqM8UD&xblY16!&85t;@|Xje-0%8<w#vJ$bb
z%CFiSO7(=ycE-fS^dxgyLJ9_8Yg{n!{Q#4sVS_76tt+{YdtF@}+2Z0N84V3dAuD=7
zuUsdCN~R^)u}wh>)!V@upN9C;`fx+4<OpUF4f1F1s%INu8qnbfc%annY`OVHCEgNV
z)@t9O>dd?9CjoGHOJ}Yn-V2GVlB;4fIEgOWaeyln*8=R<K|KLm-@d87RbTMALxjoX
zpsy2wz!E*w51m+on5|pGrz0=}tV|ET`t4spk(msXt2lb^W}p=okZReAlH#z?6?A{?
ze4c@Jz;CrK^l`}fqJ}m?l;}!Yym<{_lDsNs-yO5XzqVpdpN6m0ebw9yAMtVd(nJ;I
zz6T3vNmo&yt*QfGe(|~r=>J{yzCrZlY{lip9Ic}G;tuXZ@yJIwEr93vH{gNrz2ws8
zeTwW-2)YNZNw;4s>#wo;{f)oYaVtJ+kAxCypf4_O8!=vGe8L#V{|^lx7(MT9;WcIx
zx5Z?C`hd9MQ|R~Qo4E;daixxr>sW#X>88O!-E-Wg>v5QZjiUCB9D6b)*KQeNq!HpZ
z3s3FW0XOf(&~UU%hFcXl?I&I(U$K4n5QQWF^g@JM@nzyM>_I4hy9%zpf1v!O-2hPi
z@rkSj_dR^nDKifYBEQ}lp0bxv9_lcidN%!`$ICwAio!#J!X+y3YJSqth3yUXj}vA^
zA4W~B-!$9uYa5<L@^k5I9lZ7A;1B%~$|2|=7SqwFv6_9)LN(_{*r>}M7@5ndOC2HS
zMG~dj^MDLql>U$shTNvIgq|MzE<1GZ_lpJQ{{!y*6&{wOsKx3-S9!MAia<BpejFtL
z!#ObdI;2~clLN&$b$55~KAf+ux2~M+v|9Fv;3R>)U=oRXN0d?#(KiFv3Xh0Uz)lB&
zjPS1DW_P(Ap6<tpf?PG9T7oFWn`xf0M+O@RLk;vjkr9tGJ1y?t&ul*;CJ=xPy5&so
z%<g4<N<?>p=m?z!qdYzJ@f~QEF&p0-I&Z3Q)3+;UbjYoG98>9v33ogm_#uZ?y>C%&
zLZVr1^ClIx7mKhC1nD{_Zb4G&D(7*gR6SM;O-CCII_1D83){#>F)?N}HXOqX=SuP?
zNC$>iXg#Idr{GudOiw}Tl`4aeM;W1PoAvvH5;vc*qlU?7l*@w<v!M4g4(wGtA%Qv1
z292&)&Psbu@CxhbKc}N4Lc&5&89u4-V|XjSI3!K5{cZ-oSzQOTG1Lv)iO5)N+K1Ti
z065<Z(<WN1{_>(0QgZ*e3ZL)PgM-G-qind(F`ntydUB{smdbKf3$Y>XCpmDGeS&{o
z*MIMbq^ha}5{Ds1d@x=hG+YGD7S9RZQ0rqz;1Kuz+-v(iNN)Z3<GBf1dQwqq3&zM5
zC}<#*xpzRhr{LSZnYnFHQllfC=+`rg=JmYOS-5~i@0lO+_2ht=xdT$z8|xKPqfo^%
zhvRW8yU1GNN&2-r7U2oBkdP#zsX8fXSzAic`ZKKYeKwZR>9W!p9|;m?$s#j5i#VM7
ztej69^1dI+uFbr3pRPV&3W3B(g1|RUo+U1YE+S^<5l`N2Vxy1Kd2MA2?ted$QQuKL
zFsPuKvJ%uk@O^R}^iosrxy^*S!)u5?qmft)ak?))DGj0rn&C_xO^%Q?Bd+7y82jle
zEduJ7AB0CmjKZ{qCdM>Xx7nCUr#<WgzkPpBRqM&XR3A1>APm&#)NC-CXLYbrHKhfS
zu#y6>&F1Pln!xQ?^AL`2)>uC51|GyY3Dq`*mOlMy1RwWVjY<#AUL7{STjW{rGYE-|
z^zSqgK@W2y#s4N4P4hAgC~H!8zkG7G8+5%g{v5(v71~irEgZmw_J%PGM16RLnO)m}
z6sRN)alOT1?8;y3U*dQ=jj0=Ty-sqE@F|M<i*4j`vR+^jGp;315;U^E&Lss8%#c3T
z{qBts&@6N|n7qYGt4Ofu`)#&?V#_KS;wBM!&-HWc<#yvwiWgTtpKw%hp+dsMCi^Mv
zy)Fz*G|4$3R{~7d>stgG!dfC6yUib0)aYJMpw$<&bqA+$;OH)d4Km|Zbb0X%zDgPQ
zVJA4%D2K|bL1ynp54||TeLQI?sYsyUvgXa7>Z=A$9JN%_Hr~{`UcxHdi-(?1Uz;Mg
zPq<+e*af{$FQXGrE9D#V$IiYvjhJa}C$I%1o3tiFBF>+Q1E3Q<FQEr<L5s<5L*?gC
zTOjDGx%DF-ap5}q+)QD6X@R5$*UtIiE$YiErJV-4ghChJ0H~E$_1f1kG4|h2bF%YM
zjXRQry`LdXf(#(C*&>ZdJkw<shxFcYX|ooq{aCKw^s>`Re-5b#6+B~_`3Cx4@$2Qn
zLN!gH;8ET7v@+s+@XEO!1iBPE*G<D#b3aPz$mh`n#HXgj7J|{{rz{?0(ZaEn+rAUC
znZLI{DtfMT`nwh5lAV)z`ir$WZ9Cp^Xwm?2K2xiLYNpe7&YEF23wlBF8O!6Lw~=UH
z?j*y~^N^Bh)#QhQ_ssz3IkB1GVo;nQL3umr%rbF!hxJHlC+BdKcP<Q)iojn*<H9uU
zYGkR4X0lut_e$4&!8&i^$9kPt)?E0oLPx5O_U#J?1%1q6hed2vB0K%G`qh;_ZpKy`
zd7{Itmyp?({vFI4YN<$tFDYMd2}>65$i~d6i}U<0^XR|Hz^z>wPEGJ}M|~E?2V>{P
zNK~hdbJK%#Bd?Pg(~<(nPPf(D-X}0;w&d>*`q7f4>yNwD&=fVfXns-L{nK&%kC^W{
z3+7e&DnWD;!3BCNIXU#?gfjdZ&tr0HtqYLGg>72jyp$moqh-wbD2;EI{~U)#HQD0$
zkPO+U6dJu-Wwu8i$vHQz+H;#(U~d`_yF9Gbac0@_!hSp5ppn`DS_>KWl$5+*Q}w;Q
z1?hvXWnDHKBf1n{nzqYcsXi=@_ygO@B6!<Hh)=>OH{-%RD)j||lgBk7`^^@X@8dTT
zK|sVVx8AhQlx(R5ia)8PZ`|b7vB!A>w+xlSgl2y70Q*twnLY@$xSYsq-s}Lp#Js97
zjo=*@Bcf+5jHI-=eBr>E_cRd?>lD#5)<4JJME|b({ZDOB_y7>{`T|}w))0DOpb+i}
z!_4uoKtGejWk{UpYCL8Trz6SX$|bmMK(J>t^z8{SZAjli<+>6{-rH^SK9|TR#Wt^d
z<gi_%ub6*}w#-6l(KAGNk+5+sc*U?VLB2;ae<EB+5TrvpYW=|n5SC)E2wE@nc|oVL
z!=Od|!>;H2Q8l}6<LT>NtA`-(H5E-XioHMD#h4$HR(?(6-9GQoDHD2u)r6(QfumpU
z7wM8H!!(COAY`6v6=9q*G1^%cg#bogJl@bHGjwQQpK-XDxPsmJ%bRAWzj>^#BNz{V
zb|oRZEGBXLRk*&N#>&otzFY^Ad?~HPiQAY4v>#zPv-~1JDg}G1T*#pj9h`v<gfzpV
zD_Lqx)ugFacDemd8BL`SjTMkUl1af<{Y6>*rss2b1Jyg-SMu1lFYt5=g@zWxg{#m|
z75AN_DwEPT{jw`a6N)_KwhhVIucGCt?U>z7#`9LKN<+L}s@EOp#i-YG8u*Li3X{od
z^^i1jjp9i5?P$JXGodlTA+|>|!r0Hf!VmXRRb<p<-L*VCefLZA>&)EL<*C0uV_qP!
zlI5tHSN7+!&-wZpGrs61JzN$MF$nB}5^@3s(3Z)@$|`5C6tOF#@Ibh;P_JPlgYXA*
zKb>RFTv1m1pE&$x8}1ldDt<r`>stZNi39{At@6&PRl8rs(-dHA+Z$sf&7SG>m^~eh
zftf9GyJVS!#e}l5dno24<R@cz$*th*{Mfg6+<p41iuZN1ooR^W^4+5FIfU@=>2Y(W
zJx~1>ql5s0;h<aghZ<6U9^;(?QGw1Lv!4~LPu0Xv)A}_Zc6dPoTQY8a0`IoQZVMiK
z*!G?6>p8Fw<LKFw=RThWsBRWx;yvHx=^(u3)=A9vh;N(jLN@;zib}OZq5AT8d#;X`
z7xSL_@?;V8k%|!0-D4BI@<`hxP4J}YO9*P@b?CSCTvYM7YKk<VUp`}0<1*J(`*p=c
zAAZ&QQs+Ttv`NN^#gI~T;U<){e(xENR$OY3Jt%Ri?7`?@YC7z&8~^v~M%U3A-Nc1P
zJ9e`TCrszBAj&?sG5qmkFUz632~UE#{>Qpe4gRi#{P_>k?qdd>fS~!ecUNJTX4;J@
zxD3B7MO?9K8HB$ASbJMeDw&3BbDKU&i^C<lch<OhpY2**GxW`Iy_((XNJpWiBN9wA
zp^Yn)M&P0&2Tf)zDZiiC9KR*|tled`r%|?#QgS2atWu5l`)=!+ym{0P)#-R6hNUok
zv~?w#^mZ(2z$`UX{xO7v^TV=tC3T)p6?su-{8@?LJS|VkuV+7bZsbO~wiCn4KWZ1~
ziDlDIEpxDIKPoUE)245W*P#BkIFsYz+7IyW$9u~<k`%h*4Y(<nhtopI`HHZ<hJJ8e
zFR>3G)T)rPdB6J(W9mk|-krwER@7+$M#aJ?P(t&@HOIv0=!pU`vytc2Fow6KEUq{x
zdS`AabUw~b=6cCy<e+_jVB0J|AGe4DAv;crALzjb<n4Fb&;2N~KS0Q*vwn?U%4doE
zPOc{CJ8`NEz5RjKo9q6LaEZ(?I;!!?d>^K{k^frqi=y=royEx5t&Ud6`ItCiKxB$U
zbg^7|4l5U0)qA1SyEn9Ywe8yo`rk`2&K0H;)Ov*cY5PbLcKYHmYmi6X1jsG_n7lu_
zRR8Wzyv;{$Y(><YHiTXkb2TV=6F6J2Z17L75&QMTgw)2=RmmX1Z$5f?w!9z=zc%AI
zs(Y~pe~h8xET|dxkma3Xfib`~K4LA5?5^N;q<b5=jX@ogrs%U17m+b!eZ07-Hn*fF
zC7v|5+uNvzHdbM|d$(Gd9=4AL>6dri+)DX{R&(tRD3dA9(VN{b!!Z`~B98r$$x6CK
zm<=A5%<vM^miv6Hhy7*-lY$l#oL<`VH_41Oze;^pMaIQ?H>P)iIE=a_OrmC*OUv_6
zfmQPfUA~!q%&K{k9*{%(4776rnoyECBw-rB79F6db%y+N3Iu6^)BpM^aB(M~WChR_
z`Jsg)eOvA~4UMvL4oI>)R>ff(;6uyip+5k!G6%4|8f4d}n3(}vwOWTK;E3IqFUSG8
z)vHIX;n{<tn}|bV^i`q_wodIzM32P_PRYQ|CL!9I4bn|O-4jreo;6Z<mh@2v<U_GU
ze?P_ff`X&xTdIGPy<OMio2hs}Th_o;j`eLJIiK~YDS(St<b8ST@wCu9D^PrE@E(^>
zVV!`lH9g{ZOTUAy4ne}zo(C$qVSybJ6Q`xHERfs0qAk05%reqWLr8I7YHpK#wX=G~
zW3Ws2-3W10A&emXkwos&4_$mGxc+==t<hkD$M}~K-*>g;p^$28WC~>$)O2NthJ9G!
zn)l6fH!MYD{KXIDkp9<rxJ8N3<aUekh56CgB1%%3krVVp6-{s37Xfp6n;tZKbGpK3
zO%ZeY_<BZ=#vPyXpFd~~;>yh;0(o09uZXSs?K;NWG0M_M+NBy0P+<NuwxyBed@bDv
zDE-{rrfQ~UnVu`A;VVQxmoWq<>x*)+5R`P+#5zh(qV^T=k}QAeHP#m5>ZQy|hYf$E
z>2r|6xa!~-W_-yU|M~*;+wZGGHE~re=iX?XU9VUd+bDIy;^9adMx(|j%!^)(^b<U$
zDri=^!}^V@h=>-Vbr(H-mp<TEyHmL9mtPl0Q>Hs%VQycTs2LWf73}$x4+r+*;U|P8
zlWI=Ej0G`gRv+|kZrc<!5UN_=Pm^OLpf3-mVR(J6_9UCt*!Fz_^-0nErn~CQ-`rD7
zRgzK{bjFI~9o^;9J>wxj`s$07k^@fDboxZ~4Rv3#e%kVIJE+0SS>*FjQXt0FRY)i|
zQ$o3=#5`z5s82(#*D`f~{I<ym478;pH*zo&HC|kpHA-p<%V+G}WSV_`7{8i&&<!?j
z2)~R<hIY53k`yM7Y8QF?3t{orDB%-mfHihuE6>)t04=L^MCzbYbY(NS&hNMY#mFWX
z&$7`@nOVlJz;XuPS#YqKNtDD8kjvT|wbO~$bmxUG)ncA+jRa-H5?~VxKx`g~?!ejS
zFYT))`_Zws2G=ChmsHrqg!oQkGElBeSmlW@EI;Z}b8-oU7E}pMe_no>rB{;DEXqnU
zAMLv8O-Jz_`0A_NugkJR0~aieyn!wL!;L4@KT7RbPV={O=WLI?kp_P&khMcLoC&h`
zC*#?@pvkUzFD2-zJ==g87Qf<#$&?o5bR|Pgp&~z@_|nNYL}Y8$R2DNrk3pq2yEZMK
z|2ffo^@Uk0=hIDB-@SqkZXLchsMsr;!VyYnypyQL*Pw9W7L3a7^b>9f-l2|^Gt|Li
zoSGntW3DoFNRn^&{E~9YU)E~qHd#`YdgZc&7>8U97FapTm|@h4GytM9bFe^SlLMf7
zgFWH~3Nwc)@;F4!ga^HH>DfPbLzQymY}P^(KIa!zuWh}=BAffx{!_R=tLFUW#k+jv
z(0@Rntjys5wa(p_6})JucCFp|fTMOLpVP`kX=n9_nq|23<o=a0zw5?Q7?cY}%xajK
zYY)y`S}oKsNfp9L+t0N8g=+uR!|cISYW+y)_9m*e`jg{j<Fl!6D9{<pGQ1G4<x!6Z
zY&G~I*NI+$qBDGJ+1%%|q)o7SJ`eH~{8H71I+hY(b0oMTRC%6}Sr$^}Qgq{OA4N+>
z!eK?G9iNW072le6$iP0T8Gb}7rTs2s2oO{M-Awl{PZ?m;{#}rYoApn=^}puPCUgJz
z(Lf)xtG1M=yziujsC<Ux1<PT3Pmy`9Z6p%jPH2YYq0*cR_kJV3mkZ9;PjnxM3ZV}h
zmQ$x1+MJ*gfi`z^?LpB9=TwKHkbV7RuUe^`+$5y~nF!HA4~=@fp?t2+1Bv5~Cye(*
z`jQmAMnWe^Z^gt&Y&u9%cA3$*piB7h-4nT@b7f{NG8-D%g<Szn-KzHQ+tp;*l~ueI
zm2Sz^^jtZBDMZ?_0-I{Z{4Dd<tT>fc-g~lCd8*T?Oqoviox}hGd{$Mb2El7cmG-#D
z`W=7cTW4n7A*VsqFcpTMAl6%IH#9}!s2tnQgv7zVco_GRa47K3JpcY6v?TXA?lOxa
zX;N0wH=wEK%~Ie)Fz*+Vi@YG90d9s_1u|Jf$6f7_Vb+*nHczdwu?FaV1a&CqQ(oZ_
z0Xo}Y#e7BWC552h-4`LlbFD3St3^WN>EoDT&7W<Sx$j=U@DC{qTSX-A0cCILZ8d~`
zTpCM>nMF6p`1=dY!R<ZE`%RtSyv_wT2lWpwa37~p-OvahMvCv>fNJ#)4o=N!smOeA
zLIg_V8V80nM^Xj&on0`{n14xLyr<A6$=tgK5Jz=r?_L~rf`>9`(QM^tUX$yXHA|px
z{?;wAZY^)19b*=hR++%v4ieM4`W=Nl4=$@fRd<+A4QG}&FZho7>zm`Vq7@Dy3iI&2
z--bNFXPubuIt6oM%O2emFUPk{Mz#1t?>DJ{T6V%><GYvh1f7i5g&4S%G$2-04`(#M
z`wyuHl(MdxGJ($8_<Qp$jtCthUWNh948CC9mmhT?G49BDp?$mg;BNphig5;@AF6(E
zPw;JC4jOvLMSFkAZ?=Aij`9U<zxk-(E?Gg|vZxxfr8<BAR*C3968Xpk)gGxK^D_&r
z?o_*E;?aA}DWm9tk+-9Y^9?NUGBAyN<~&x6mzC=waZX_WGS6I)Jp_k~{%%y|cy(a7
zTa#xt<Wn!^f=hK+<ej&8^nna>!G!AJl3dRl<|zi2CPIbX4x7UJUM6)&j9JS8W}?bd
z!*hME(|houqP@|{fn-K8Xq)zTZiEtKqMYhe@|dVNF72AP(`+1SiO1IfPvM~I+hQ|X
zSy$Gi&%<(P)YH(=Rqb@EMXNlai;7)e8X^8Bj#jk5%=v7dWdv&)oxIr30jwTJPYAiF
zz-d6EWd^4-(WW6OVYGs`Ew|A%q8DR!>93fGfXSaab?L=2j$<F>dn)&XiqO*E)p53v
zF_YNJO>UuszpH=KDdf!Mutt8KFd2?lEJt22pK*<fk)jTL7f7tWRGN4GqPIvS56!$s
zB0Hx9Iel>*#ZYO2_&Nv;070|-CG2u=efz~5(s)MGu5Uo=gE+u5o)S^oaGuk$iP60{
z?7nFc);E1adizSbn3g*B)$wsKR_dcE949EM@8TP!23UgVF8#5`J3DOO5@NJ9eKUCW
zG_r?-_SJIUq(U#N!wTxPmRf#>TW2|J?1{(DxjTE)uJnvK+r#b%97j-SS5ARUkpgUf
z8)YiHEzPcI><JMhb8o#-8gy<5eL03!wLETZ`yS(rEsckfewg7FFI(~zf*tKxn4unx
zxZ0&z6|;W+^+OTfYiK5w<ad&gf4s$i+(RX!zn#aMe1Hc1A7ApXSHF`e7!}^eV+sa2
zOi4{KT7yzOEnj2DI+`GqikPllXZc~E_$igR8Kb%-g6$={GFB?B1AXkoPVR=^m(=pK
zH|=JvR&h!8V0)>SEUyRYeP3MQ8&+Gmr%=+Qx+7zA-8h{*E`pvKiRv-8JS+oD=4y6v
zr^6X_GS=Zv#{j9QU^k@Ur6G9<6>zp*s)XJnNz$0Pa03)2&1HGzIx8Twyl?<&wTZCc
zYZ7hMpAx0Ido|_GusX&8a^vkjaBRuvTIAw3RKzP2Ya&SaJ&e<}h1|$Z>GRDsyWzC&
z`so4tfdKEP&B%$mI_u|8w|zsF19)hYIWz0_O`)%triLVfUcI;VloMjF5Uw4<Njq=t
zA~k)WF&$1rlPg+0@lWi*iLe?`<AdUgH6TQ~?60JZpQ}T(8CF2~nCEiN$H<Kp)N#6o
za&JD;uBmVW0*q(3EWO{!*4iezd7uvJcpZtiw))P(36wR%mu8>M3MJ|TCzJ0|#U8J3
z4hBYe{E{(A?1kgnc2GC&B|12*?FR4fuzXL653>}6MpduZ&7}z*;_A$5`gD;QF_F_T
zc=vJ2RMk7Gn<>q?Jy7*}KAi8QCMlh^wPKb60t}3$<%KBMQ)05}>rd7cP#PI&Y3?XS
z4X?=Fe<9h29{o4~xO(UM4h3Nbrv9N^t@K-a=JlNtfNnt3+wsbkYHP6){_VAMF8?qt
zE4%g&hhD**mri-2XGh-xBbpFmC4O!rr>D0?BmZiK(7=k~%)izPCaqrItPOB+oAwYG
zUQ5YX>^%{Ep)qARboO1fzkQOUOw*W~x)tssdhrc+rM(Y{JGC%m(PS2E4f$G^jPq=I
znig%5MDBF{!<WMB(h{TCm8J8S4s})1kk1u;Z;9TfBXwiBpZJj#e>dL@p$|0soL`-E
zu`>D9kNfQjioZk;MUjD{-+N|<QtnU5lUhw%$m#tromD&JDl8M8Z&>-qj<n{UbJ~So
zrsG<KMM-RIq^!GZvZZKPE3&9_3V|0Y?RxLbpjPE73qcPnRzHH5;V>~_dn{=l=46K6
zyt`xPnxOUruJ71ctCU^<>eihaO7Lw#)BZ^0C_`6#;X@o3zp{;7<Cyxj!{Mzly6~^$
zC59<R?_1@j>nHOhvsz-64Wrxb;(o&AB0)-A>7&ZGd@NQ{zm1%JgIm@W7!%BDF;E&=
zc_}D=y@7xn8JTC)y2V`5oT4O|OQ$8|CA;j&zden)5_(=>9+mLS2-nJKyZGh^#fJR`
z6VpMaIM<TdAGHyc)V})k&|`wf?~e3h_W25yx1(RJG-=f0@XG1AH-9{`kPA_U*4K|p
z@%Qw|nHS`xyq~)sv8%pBuQVO;nxNKbo8VvAejXKM)LZWhM1o9eWnZHk=S^%Sb~<$T
zRk6HKD|%p|xyE*f&>n2rS`0ydc>n_UCa1pzgN+(O-30Ga6}<dllPRfej?qc!4)ntL
zpDC|~GFu(g?YpbAnazttNhb;)X|hIca48gjRyYFc;>9n<F8yg|znJo2xZl7gHQ&6A
z6te&yHb<8!MdgKm!MwT$(&2zE_VV^;AJlt$qFkC#`l@7{nIi?O6D)DeVTJM?xtXAt
zlWUi-z6H}YV5@Md0oyn}X}pbc68Mq&c_AUxrq1`;X9si^;`FJG?qcG4tjm}?Q^<QE
zYi-&8oC8#|DDOTXX3%3s?BG?_b`U^PLiETSa5s_)mE5l7gbudCNPElt`W*C7R_)oq
zxccit0V=2d_7Q0Hh#da&h9RWeLNbq4@HSHyuSXHsZtLc%%Z(tW=#s%Tx}TYpKh3A#
zqCbx3IrEin>0gw;sk>eeIcA$F&$T=e<wQ_XQK5>!IQ69N@OWVB?CjRgknik)c_NPd
zyXsHk<;G94&h9RTE4Qcg@&##zEm5!1NTT%D+(6hS3R-UgPBaa`&Hs<b`gaS}r5GZC
z?4_kW5edCfnrd)cHhyrGI}VoOr<sz~e|1<53xB=xi)h2QortHqxyQJ=z0<1Kzel<0
zxCWkgeVh8lHQ_-VqF>WzVN&sWbTlL)kO+0q_?bVy9`@+aOGI2Ta+!Gx04x|<)oT9W
ztd@VjtAB;fy}wFD{gxB=TAZ(I*D;@RFA-OV^w%pHF$!gVpwQjW>si*Br5D6iKW<mP
z`Bp6!p!6GkMHk$CJB@5H*e^v92Ot9OFwBS=aiSmFc)(kg>N?x!Nw?H*P^fK+Jv)GP
z?b%vQdXSdJ@@i1KufE1l>5`rfE39q*C)p2m+g%t}z9O}bu2xQ96*nn6q_IP_@$Zs;
zzZ^l7pIt~&3ZP7UMD55KKFJxdmh@LfPQG~6=Qp!Z0~pu^;_~r5bN%Mk7|;5ZmI+9<
zYWQWcRCD34nRg%7t+1K((-!aqO3ILZy7hcRopi5EbX%O~QM^8WE=>3pD>H9E0h$p(
zV>7+Qx2>Ghgeq-`u~s#X>C1jVS4fwb9xUiO%W1Xj=u$PH>d)$5QYl|fXUXW}1Yr7;
zG1cVMfY?#@Rf17eJC204Th7ga65<rmp#SK~ICYHPpxG^Ef7_aev$H|@ak_`*teA}t
zb9D!xjlHX%?2Z;C)etj3Jg1mS(zV)|z6rHbB>na*!{)t2r;hH`10O&Ie?LD1UjVIV
za8I0qC{?3;B)|=W>R%YEbNRgxZA?`Ns{^{9P@K<VFR1OYaJ?-0hS8weQg6P>IDTN@
zSQF=CmC;2yj4O!=^oPDNl)vI}wys=M+_e0h%46V=Ck#q<p2{1{j3QBU62wf(s;MRB
zbtcB-V;<5Gd>OTQ??73QV2E~1%vP~yCVs8PSIbe3AT(9iHp>^dueG)Dbx3$Pmbu>F
zv_!#d<c)TQpsu>JjTq(JQ0Lv_`v&EgD*3Y&>~XqGx4@(8q6>7$eat(Z;hSENw*gAA
zks-9$Gc98|8;HQO;CsPExJ#1gs|YAbNzZp$V_SEOd|im^%Jbd(+F9jN37>dD)5o7e
zsv1PyV^0LK_JW8y@kO2kwTS=O)_QKHLH}1;zoZB>ITW4*h)%t#q#_EuFPbvHf<GX6
zEQrCL2EexA;f^siD>61ub4@YUlv@2G{1jXB9;JGWCK%9PMl0|;&e5U*joE+A$Ot!2
zPsZGJu(NxFC@g00avNTaKP}tN;?D@q%IL{OY3*KyD51*l!>U?4rQk2I=F7zkJddw!
z|4U8hpZi4j^WQHoA3qyDoQ;{d_T8Pq4{mNk>?wyu?OpIa3~$ky#P?!a5#UKHLuff2
zesu;^-uXKOcX(tn#OEh#09n|-H@yIB%b)A<q|J`<DJ-)3mY@CVBs8E`)$`c76At0^
zvkqnu%F_C_bUa3q@~7MuK!D2ZvDnGCpZ5q?9wX!WP<13=`G;#9Z@r7XPQ?R{7avJq
z#6+E3WM5ooZCEcmQwi^c^bl|`<{5{dUP1dlmTM`jT})snq~J3JO&*4OIZ>irQLS@{
zp(O>3ycfs%q3C1J;HzQOp48}NV<kH<P5^+pjsaz!{$l<Bbo$pE{bJuUKRJUR5xBib
z<c!L^$eG7zKNY{jGMD(RR!7O}vRZX5EPkEYnS&u*cP|`E8vyRSAW%2!@vdS9GhXx<
z7updDLrJ*Ri;HA+3IR@-ZD_HXMubf{f6&G+j&e$8kK+!@do9m~tkh4Izu<@ti!8DN
z80E#98h?r2tS2uge$o1xiO+P1q<jL@acHEECQL^-m0Nq>6eGHoq<q!LWtIcDd8<YG
zXg>7$1Fo<BMnM0Ylqn97dUPNKfgyMV2RqYaCyh1KE&(#K=X!h<2ct-x1qE~>&&izw
z^~|MIAxmdcBX6UW#&{UV)gX@*%NMG1FgTs14<>@vh_h9XRb724^h#TZfQ&|A9QHE4
zhmGk(%hT%`(cQr$>djAGsN139L9-KW4(QdsjZD){s`AZ}c#yHfz^Z$1y8Ho&_;l%~
z{b9MfL()jSFY2yp{D`#11;>+@`t{?)cGp=wmaX_rxlQy6$mtyOT~j43epXUb^`-3%
zF+HbrH_tiCM%x24jbRS~Bv3JS3TN1~Imf->kDjcxYeAnAdU_I!Q@E6mH3E&2%hoZ-
zC3V0U=8<Bl%vsO4k8+$gOTw4N5i|(=fCi!y4U%ONIVxu?An*D}s^0Nby}NsCEmvZQ
z1BjNw>5B)?jYrNUr!I6z-3HP;e%$?hAs_0wK0`?K5Pt?+k@B`UCD#ZJLH@BJN{0>&
zjC0x^e^&Cg;mJo*_V&3)($%9!<vE}czwe5<p4q&~YZX6vC@ZY~BZ+xO8ByKgW}NiW
zd>YDp+*!S8*Hn_KjgjE$0*7A4Ts6r@D~_%fEQj%X7|j2~wfWO4wq&#6gL?fMTiT3c
z$xq7+0h3q8{*q3u{uDoZu%S|Lj_TXbrX9X(zMvU@1ibHYeBKYtm#0cMllgupzwtp*
zga=hWyH{K5vLp^5@X#>EnI*|3&mCu?9zl+trr9chLrTT|wi>6%aiQpXS0Z^g?90fb
z=oLsm@aqMvd!ly5?-<j4V&7oGdbC<3bl*e#Mfuwj+O~mv1P5bb@TKaO*<Cd8jL#Wn
z%#hU%P(BXN<KnU0eoqMEGFlSEY0VdWEH0<UEk>E|&}QAQsUp(l$_OK$u(s@rl&Et$
zkJV{uR4XHf>fWq}ysKvmwkTC(99;w?fn;AyriE`9kSZs);(-@A=)I;;6acwn&Y1?;
z%91J_JNkHQV|+|k5A=ctpWw3+EZ)B^Xq2X#pnnRTLP&gXkG`2kfZ^&9&u%C8Vmey7
zc=H9glu@0QVJ7DSw*E<MhPzS<mZq@J6#x!+NP%~jd*gI=5;r<sHHgXPt>M!W&GM)&
zKAXvtOxe5HpoODteH2>%9dbTXHA4dLd;d@(MDoo^N!}HiW^n=ObJin%!0obJh3g25
zQT<-DB_-AAEc2IR<{-#j2{VmSu=bK!T?s97#3Y{o#r2M5Gnvvz26)22y6!%-?YQ3x
z`)=2CMG1a`QdlB|x&3py!m_NMaZqYsibmZ737_WWBgSdi`4-C!N($T>j&=XO(HZuj
z0x}iEm4KZyzfOnm1t>#yuNn9^2#jjfpaBmYQj#ZfKqUZ-9DZw>)#2Jse<13Ldu`C}
zRc=pWow%PZEma5d=;R8xL3-GjR@ASCKjq96iw@CkK3%7MAou5U5peKAq2s2DXIvmc
zQ`vz>07HJeqr!9AIYXochv*I-caaJ$vaDUp%#u=Zp+j^ykZBFL7yFJQbx%vgzU22*
z-6w91P~}(S0B0&Za_&(G9;G$lv3_tnG1JmZ(n`<rxDilVvHb%rX;oGBAe6|C`eYy=
zx5amy^xU1QM`2s+<gy_gC}~f*AnP)H=m=Ozf#0{@OqTmUKW&BIvprl(!JGFg&{QB2
z1S^N3r4ym+BLOEuH**d=xZi|hs(Rcl9>PskEw7Im^q`X+Sa{8TtH)c&KQq~n`3nQ!
z<ch;as<(LN^?m^l#MJlaS(okL^|F)a<^fJ_Lea28#}~(@>(d>DX7>q}!oS>j)b8OK
zduw)+A!eqV25uTgQZ1+*u=Vnjpw|6B3^tFBzFqDqHKFc+he^B>YY9bjc#_!3iD!V7
zAps~vN?kd*QTD}@tvuo)HRAw%@axhD<xIE0cLoF?1p2@u+{E_^koV}oNDl@s;B}rN
z&Jo`St7W>$5FBvg_x?gxfVh2nXFw@iZ}s;b=J5Lk81QXHBF)$$CVC`;s7VN7Zf=<6
z8GRj0yT0e8uiA{7&XsO$!yh~nGXR5Dw3>*wx%u^-3dBdb@*=5^#4}ilE@Kblsu@iF
z==t@w73#i9exsyF&whfS?wA^x*?NQauo5N(45RDvlii}$cB!+(16scr6s04&FIj$5
zPY>W^VSG!0jBQPzj6EM;QoBo7(Yk>T0UY^!wr5545dEwn_yZC=GxiY+M4AP5+_C(?
z;;CPU7pp$qBlQ|4wM`C^npE@feD~DCG8cc(gES=r*W!Dg1gd5$(EAY3qw(UH89qu>
zb-gS<x{iM%B^-0w`cCC(b>J<>W^<r)|Gt+qTPS=aYpi0VIIb))`#k!RA%M{7L!pGU
zKu{^kLBR6}*gzK4sz(4BO&nZaPW#|@WFFO_S1HPWOVE;8gGICCf0B20EX>if4Oe&b
z&yD*wO;em4US)QziE$MNU)R2%9yLvT1&oxIo5Z_5-jYn{)%j)n5Z^ub;)d!2b>F_}
z!(;1OO6#2f?A{cfrL(OOL$dPYz5@^WzKR^}q-`DxkH&j_b(3S~vNk}S_u-hVdY=^$
zQQXO?8~<SzPZHYtXvM3(a0yN+vW>VY)&9vHzPD?OdcX1p@21YQ%VK}o=E88;G#j4L
zTz7nwgI)v1^mn)k+FbEHumnf@nLaZ(!X)`%^0GYHb|@<ZaS?|~M=e<MhX6re6=ytq
z0NqT84sA2@Q#*k_X7jHB_LnJ5C5BE((~UF$IC|rF;L;c1MHIxZB*6V~|FM$F*^NPe
z4>n|34kZH6bLVkmh@46^lCyg$2Q2XnezJ^efuIs=3iy(_xdg-{;XfOT)?2+ougl@o
zmRHL%I`XOAgr}_vtrcjil+-e7L*PU3uAdiEGRi$WB14e#JM{qXM+`{;!@&Ev^;1Sp
z%$8wF?o_0{M=vRMDKFYMhWC6kNZYHZi>=R|JuC=}R7!OoX=Q1N1O#$L3w4AsvOJT-
z9Sanyn3{Uh0V*`_d5#wx`jOJ8qBAnZ4^D=}bQo++$0ZXGeUja%@3^Rx*w=cK_1y{A
zANv@Kl4oZ-K*bA=ie%-`Rec|a-_3Uy7j(KZ_beKoSa4Q8)?-Dz@E}L9u^w$OPKpjk
zWZN@UHWFX6$XoGP=eDB2gT_}3IBk^)3EQL|56N-EBNgCT=C!McG|sMPZFHWdvvFD^
z4BR#|WCyNSjJMc{$c@LX56D>$H?^tTuB0-s2aq5}O&0Uj2+hm)4^LY84H2iGn6%SG
zXlAABOHE+Pp~iJE6{VkSSywL;fshUwVDZSAS<n_~aOphZDN-5UioX|SG%TUu5^HcV
zfG9A>701`XysKC8wHOR)%i@4(1@Yk&#&je(KwCO-k$7^R1ta!9sf9CP)W8|IG7RlG
z7A>V7>&a`xeA=e>5ojbYg3n_=+z?MMcVP=+)s%0)DoGzr-^;o0b-;1BKdHJ2JaHBa
zQov;*lV6A2cDmKE@y!GvD<k~eOV}X}E$$TkeQu}K!nyL~y~0wFneFbU4m`Hg#4@e{
zcQ=<OR(OJ4xpEc7g{>iby{pD@+s!tLw$d*i=<VJFwg=zBo<M{Ho{YXeMP)hS)UQ4j
zUmFknaYF~ns3G^rO)IcoQ9$HCwJGzB`t6g#Gi3Gz6`Lv?0qM?T6wME9#{72bCwgpI
z3iz9!9r%^S;#(t>+Uk$yw$l|^0-IXMhDyrG#L(nt|8fxinAZP04g&QCJ3o5uH(kq_
z6nF$Jd=^i@DpCq+3LDZmse*I2MQUFcvnRjFg!+dcPQm4l;mD5%*B#7Em2wa+%RN0t
zUB>JwEOn?9D<*<RoVihXKu?_Kcm9-HJ*h4(|5-{2p9idFrVpkb1cBxR;nBG5o0FEO
zQW-@fAfwO8PCtXvLspzm<PNgzq62_#mF}#c19#A@Ra$=$Y}L30MaZ29NR;^`kdMUR
zx?}nAgotICnQ;sLusKaOb+0{%ebuVb9ik+o<ACpbl-cbYG;*RL^=LQAH*M>GF?};1
z022uvnGL$9!slqCMF<Q;KXK|7-(R{(Z++l<h)>B;y@gZ27ag&$8a&-4!wxmP{Ejo)
zE}jAJ4@<MIeB%{xkrEKn3g6Dr_g(;)uW>qjGt(Zq+d$gY|76|NY-&slJsCMY|0~Mu
zu_W$bZ5J1Oi|e!_7RDWLYU;;rzpdb@Z7eCd^qSwPb-u@3>Qk%Hig-Y*>19@&9Zd?)
zV^u7j^}0t#hbhelD4Ml*w%i_a+<*pH@3l5W!w1quv>z^#(71rBj~6?)D6qq#i#s7p
zr-ex*6ZV<fIOxSdK+2h)=ytCdw51xaTk28uVTBovI)BLNxzQ0ganv5Mch{v65KXJH
z2}2J!zlKM1VTZ1N^oL~yW!Qg45!rtq<;QuwdKv$2;gLd6gSR^XcEfd|vV93hfbEeY
z@%UVOEnMH6h=3FzD(w5OvsT-4qUwnBmntrk=$4NONQ{;uqiRtth4-qrrgUD*+s0gr
zG+Z?ry!S50^(1h@(T-7CE%p#Gd7T+IJNJ?hR8GXrOB)u1$I1xRrQIH)G}XR+ePJK-
zF|8Qq@Zws_mgsT*<$9;qSbFXvcmFtronw_k|DBB2-0y82?W{?JUj7y3C8Nxz)ai3M
zv(`htww@sVp4hyQ0Pc15_s#ito_6f9!JLNz!-pJx5jz8oJbp_kjGJRVIwaTitUQE<
zR$LtsK3w_szbTZn3*5CNhWK&cqTC;e2xI^1%oIbhDf0Hjb6Jvmcx50q-eknR)J8a<
zAuh);SzZsy$V)gUJENJzRywodfoT?d4K8i2`=1D!xj@~GC9o8y&<K<WnMpw`E+Usn
zBlhc(6Z_YBp+8qD)4p?lh}*|a^R&u%SFc@mzDu^b+PnPPzeVph?PRlv_bK!UmC#B7
zB7omp#fiRYK>7}tw~=NZfzpKvfb)*TIPjPAL%4H9XD}72Sw<eHIRMOel?+Muh&qZ(
zL1SlUXX;KmR^D7b{I5)_2|O46?70jb__By4qOeqX5!}<$ievj_;yYogF`kOoUn{g2
z*MBp8r^yT{Jb$AKWuc95cV*wkDB_)TDUJA1(pzlP+1W|QB#Ia(w;ad5L@pv8j{I#P
zDpv7n66wqBu;35|*0lSltn-Czn$@rL-aXxnk!5t;>}sbO^s#ECmB_$Ar(4~6Sf!r#
z4hc~<^lm0yiH=VWmO3k{38rHg&o~QHJ$!>E{5d&XmHsf!jN&t-M+X-JVukG79d>e#
z7mwI|dWl`Yi%4^;GTde3Ft922nnu}vJ=;kpka2lQ@}#I@Wgnk$t}yBhO=}6i|K1^;
zQ}QT|?!zF`X>UsZ)w7(f!xmv$jPj>E4}mGaIcYos5_debI%(Tex|4c3d-f5;MRUXW
z@S1(|HxCe+uuTYE`UjvZp6T36g#(L70NZM$w<@)@_7$n)>gA~6-I|Pm`;zC%tegC)
zlmXPL;<cmF<i!R;H~G9p!ABC4$<Mtf&WQwLUdza3Rf5lH?h9kWB61M0v2o08%#h{$
z{8ELfWQ=shD*YVImXx*0PMrOhd-3lWO1M43&?;3N=6){G4XyJQVv`3$<-*KoxRIhW
zT@d;b<s<f!7zja^*jFVoO!}@6OVspOfs`8ht2qK;O`pr}9Iw+aE^@3TX{xM-dORup
zuxWUa<wB#|Qg4;;le+ICgcu$!tWqh-J7((gXhScmZjnK)4^)$kkw)&SAH?WKO4{Si
zyCGGyNNn0fWLgs59jNBnW7ruDDN&;RZ1w^Q@Z`{Yi~1nym{&?-#cB*lmeIz0(VZpJ
zufMWi;_%>cclBcuQCn+$RV0(_Br)V-qF+4cFDcz#)pc!TjQjC^mDOCM`6K2!d&-*n
zJEXLzAFB<{;&(A`@#4Z!ccTzW!4kdL>738A>GCkTKDc=%EPYz*bOmbfsiqi6*SgoO
zKCp32x*KvOc<w)CqTI6#Zprz<b@$s^!ftSJBld!df|50Tz;TeH>)YXgxrjyGm+AO3
z3i44mZr9Eww(rHcXM2rLLEh!X#5|-|ZT+d;OW|cm)9<A%LA;oD-!ikm43{#qlyUjS
ze7Ps(Nh(j`Y3ADG3tk$9lG*a$Ssyn`Q&)%8*0ILLw0CQva`RV(#gq!D?TV7^#I%jd
z$eGvPU}hFJF`b6d&lt<Jm!Q|6A_5NQf7!sqN4V<!pUzx=Jt$1>JV!GiyihI5vsOTF
z+BMRRv^V5!uu-8x@$<KoE`WbZvRgL#^q?$0s+#IH*@&LMc6|@CTG=k|BOZvu#-Z=I
zEawD03>hWedTWlr&z#}z;Vj@}e#AeD#?(JXMh-PEpnPO3ug9_A2|5zVf(*vy<D<QS
z!kYYgDtra|09%d6?-1CvKj8aIe&}WMRf$1lZ9g)L%p~4&Y>1v05_cZBrEzHRTx*HK
z(p86q-tOId%DkR@jkDn`W*K>^Oy$b;#R}Br7P<Qt62zVL&VM%HMjh(F`XX@POpDB_
z`AL}iV(5M~HzU)V+)%i#U;=+=y+wWjv99re_K>Y!ll+$n+f)jT&ZCJVr$!fAq3^V{
zWu7bDUprDkW^p)0gav1YDv-S4GI^=IS*NR?@|2fR^HV1Jm?>^VIYMypOzZD0$SiRf
z?W{f@)eO84g~}u}V`BJ{0y=OSi{e6OUobPCreL#oR4k?1+93}-$J2UQ?nS$|wI-YK
zRg@x+q&`ntRMBD<A<k5FP8(F<!gP!yBNBCj2DtwmGo;)fcDSRzRjJI8*pJi%bv`>-
zY@uW;)M%gCy<a7N`}6IThFgKrY~(5lpA$<q!r_8$qIrvu?dL3uX?g9L5_bhA6?Z$6
z=MMI%$U(b3_~|dp4MtU*yh0S99c)hA0_|((yNqM>(5?GboV5}Apn_F0kcc~8S<3PH
zU5HPe{}__cNM@%igB|-UQ3S6o=`noJ)S{_0uktKCp3)Q?&D@3F>P+yFJ=Air-%eSj
z2=+Q_VBG@Z^@T>Uv@xy(^dn3mb9l(hlQ@=%q2k#6nJuuuQ2dVzj9Px9ECGo6pJgRM
z+5@exQZU$M2tD|1Ed9*OwS4p%clkd%_u|cP;8*_~jQ%+THeMLjR0)~`|2n8tGXdlF
zlvyljNHw$IeK$L?2CYR?1+}i}v#Jle94!7_<1E6*>Fs<aLtQbwvC5&x)#<_wUIL&P
z)SPQ+B>gl>i}=2$2OndhRjF#?7#jO@)Da2f%F!%xB7M{&b^grYq1#<g)#m}4Tr%x)
zrbaHJF_#neqm3Gl*cJ2O`C)6GZh$o;hTK^21DD3G5IP7FI6}5w`4HTI_dz+lmyS0f
z*(iu2kv9_>D_Vspr&JDBQe!h27g%liwMn`<PJu?oUiaxKA;=^xlXNALyaNPTVtJxr
zQ5ipKz!dk2DKQu8G<PM&)%ZEIrmAg$k7b<Diex4kj7>#m8I^!_%+SgP%{0eKe<e9S
z$T<MfFPSU`CMRU5;?bMQR(XTc^R^bb+4PPO!N;nt)0`5VcpLRiFI>0*J+ubPS?G><
zj`4$T(qx)(@JF`p4l~&E(PQegN=zrK793ErQTs>lAs4pIf{zpyfKQe$LKVlTT(w3I
z%s9Kyk*N@FKK)?37Jl8F58+t41hk1Vqg)<F#Qo<sP0Cxxju|L^464GMlHu$3>gzLs
zlujP!ZEt-fqD{Pv<sf+#&iN=L2UrTvBD|=fKc7^JXYhPI>UngCG_wl{2I4h1$bdg0
z3s|_XK!^q~d2~d(Wtzx_Xv)de&%W6G9k?vP$uZ(X%t_8euSpbU0hdxI0I^C!TM_!4
zWQKnZq<^0!+P;zpW*Osemwz3A0R~vT7b9k$KTSSYu;@7}6+Sdz#F(pnHkG*Xrd77R
zU=czA3Iftv9m_(f&-^P++@0HX82E(CK0@m`Cb*TCX@24@$YpD=%Qn+?9PW_Jq`tMd
z8dKJBWB<T;(iq9Y)Ui_6MI0v=sU@?yKj&bKk{*;i`Mzjv6j?PjcJ>KrZ4Y|ERj4Og
z+lSkyWN*uY=3@rPEFFRq*o^RLv_8EiY`L>u)fbz?mU{(AS*w2f-DAc@OJyp6XT?CZ
z>e`AQGsze#iYdr726R$}UMEbFjg4S`6l`ppW)7VrjP==$GY`#S>E`fIlDrJG_M8Mu
zY+ro*K$01hE|AnL-<ePVp=iWQ(6Qo+33>~;t>3SNgr!=Gp`aaaO;k+xM)=CYZ}XoC
z?I-agEmfOk^>jW{)c>{3iP&U8aKRlJUI;^7TibfhO=cD-z?_+#(Um&<eP}Rv0$VJa
zJN45y<|cv_>aZu%l==ctL?pG8mF_$jmE2pA?T73zeUM~Ew?7W&5_XYu9JpsUh|IbK
z?=wpge#%*7FtE9(c5Px}p_ylz9ew0Sx*xu!kDuSZMK7A-3hWwn24JpO0{oKI8toOm
zvb0v(?rVjH{IbotP9wW7tlr`%j+CRCjW-xx$fyt;T*pUMmBn+jflC9Wfe7CVAQbc2
z+E^305sRPkEoG$H{*%AWPB?Od*gu1c?zhWRs4gM10;HPZzm1rUf5y*$vrNiA1QG`R
z#1306^&Kd&DB}qT@Q!_C2m_&Cdk6d&hMuT`O@9Yptmxk?Vg*k>I>`s8<ThNC{(3Ml
zR@a_2{K9PgtW5$vt|{|bR(@f`0F(J1F6?!Vr~qXgjXVQO!5h)I)+faSKcyKbNvREk
zL^)M|MD=qN;O%|)LO;h1nO>y3@sy|ItiW}<psD@N%0UXfMqF7>k3Klid+qfw=xVIX
zvi88BvkfFjtG3;Wiyro@yC_w6<i<WTHaMvC_UTH<4cXgyk469L;W@$TS1@?CslC1Z
zF)BTQ^!!UdR<4U20Zm$1BI%Ec&)uN|y(}`Rq%np@-+ueMAv>EK9W}Y4k{n<tiNx{I
zZr{0_J9+nk2A3&=Er#`ehhB^-dx|S7>UOKz7AZsC*t4n*E4(l+3iAN3`sv|RAF4C1
zSqyxCT(F{uie0ga)-iEM$@Qf_IdP}+J$g=e>GhfMhd5FhrbD;a?gAk!J}c_e{j)DA
zu#eY$(k54`lON}(+M>&R<jg5~!I`6OeQj8TI=KFYm`;U>%X1f)o%afB&_g;_1_}&k
zf${VCrY1w;mFNHmxvlkgHw~{%>oQm9o0J{p95#p+T9wx0?;`i|?wOh~d1zMAv3^P`
z(0tRNAG-V^F{E^|s4T8xqllAKgzirIKMtvP^ozv*Zwx8;2+}Xz7Wwu|OUUu1z#T4C
zc%Uq5wqtn<#MBcL!@xC`aWeM|rW~Jt=cf-cJX3YH>`^Qcp^CKdUi_jR%tonad0C;a
z6Q8fD+JnMdO8i0PCd}q#HGZ{n0DGc-Yn;{Z6VBam64)3-ejpy02l9XI0bAq#6*MRR
zznbX*thN#(kVN{=dJQbwfM@yF>Ye|V=)bJje^zh6Os9Mxh%|#IwDB#M?*|IG&3PHW
zdi~w<*C~9WcjHc?Ung+lhWz7_T+_FnVC$q^iJZUO1oRx>FB7ee=?rv{4L|)IKqUZ?
z|K$ivdxZV(<~cGi$N%$=1`xn)r)75eJ|+ElP>uh$_wxUnkHt7({OnI8`ma<6f$aAw
zdB%|j=}KU;@Z|4LN<YK<*SZQ^5D2WRnt)+s8fnM|hBf-Tx54x?qQJ#}7S+G+@K;(7
zy_!k^lGLd}06Gl+Z~w{qfBdljw(bJvbK}qBKY#~0W%IJorLIVX-~!p1{9p&X{=6tN
zRhjX3J(57O<xeO*A^7V+7;CFhek1tZEgsj*k0&1{>m3=t>OTI&^uD?$IY={lQ%?(g
zkpGXq1gKE0n%Ui_>)P;b!HX3y1>sgFY^G9oIl%}60CMkT8=J8h`M)vuR$+0iTe@(9
zy9ReCNN{%z?gR-gg#?1TOM*k7aCi4W0m0o}f)>FoxVxWPYp>nCPWS1(pZ>4@tGb-^
z%sIa~#&~T&4hE_nB2Z1#4cj8lnTPez3tGqq2w`b#+{RAAtXPI0uw$4;VyR0k%-44-
zR8!jfQ13|DGorW&G<qIp$eEUJuu^sG3wNsdO*}0J4MxGF5pC`$1>b9-jd2WV1eSaq
zoy$`h%@X^{3`V+LyBOmv)f+2*zzEZCr8^}gJ}wHQRM!5n909KBJMn5w8UhOgswQ8|
zvK9sr!g4aruD*`6d-*Go@cs}TYsab0;F<bpY#TehjXMybh(4wp?r+ndONH8O7RdOc
z1_5`|#obORult$WLy7@rt{Rn4^yeRUUXmv<-7vtJ)0WL^93D_GbydU>>@@a2@*Nzp
z$0+}bQj4dC{KAIz?|<vpplzGeU)|duZ|{HhYkySV*|fn=f4rptZEjU}pl~l1>Ufd7
zx8fJU2OusW>S`iu4H8Auh?^0LlpL?!?m#lWsvyB#moLIdkVP<VIz3gV-L^ql+47b~
zG@CYNqS$SFXZ_cGBB4bYCa0hblc6JabbOj>vK~@HTZ`j{6^uMRg#rztFk?h?_mI+q
z!$=3AD^r|H1s?;U3~#2)2N#UisCbP^J~ZAF$=fV}aIy!O*z~xlMP(VV*Me@vvL9a8
z+0}_HW)Vqin+6Hav3_TBTSIJ25j{jqK}XQ3hhh_QKc?Me#hcMqb9Q)4AIZz%X#{Q>
z+x{+FC^}=oW8Xde>7aTO;wuzIlX{roK%6{<FKHkWwT!rQcIhe78b#KFK-`0VFwrAg
zgW{^@;y}E5sHm^oM3^6WWh`PPko3JZpd`WV$D3K|wJAqv#0JvB0;%y6^Eo-9@%#^D
zHge;jpXyq`ofWaIZH?}o8TP|gtU$FaPdZDBuHVd^@)Qro^F^ko;dZh0+fytM7nUn#
z-cFJh0>$1_Yy@z6Bie)VEtPP5C0V$8PsIFS&I@I<Z4rB(U)8E3iSasKNzwD1LL8LU
z4<%T$j-YMq3sCyR^Lw6VtDBuk*9*y=JTb4b5nT?Gyvwpjx<b3=wP3Wcq@)Whamf>d
z|L?X65^SGywrkRB>5X{OrNu8u)&y03{pjOJVI@-Nb;*56+i9PgnMMgB$dWb#v{C_!
zaf<5R`&oS^nNKc<O?pg;t0{(I2i`ZPPrAH-Pao3ZotEh#J3PR~J?+B|y>NVnayl6)
zGSDZvQ`k{Xicnu(XVpHvuX5r_CwM<-XeiO%YT9>~^&NmMLs7{^7?M}YXA?gAWvWM)
z95hsW?+H}s*I>6qKTy*(BVRRnsDLLXYWh+zx+)K_Y(zRZ>hP;8D<REZG)b(>@}_uU
z#g3qoyqhvX__X`D2b2XW6-U<x<%+yB!#WRPo)cFo2W?@inw2s*LDYBAVf`!U-j2Tw
zsnp0lHrMWzwA(-9US~&%A%p|#s3E%8!?i4fP?`lgUI%zA|I3M}6y6)UD(M>#73+U{
z#^6wScG{e_QJ||rMnuuO?3i*fn-)IGMvO@8$5RV=I}p*JGgq%UAaTTfiy_Vqy-bjv
zK^}jiJFWQaTR~9ti_oNT0cQzmXQ6`^@TIR&$byM!z{X$ZGylHa`QmVTjKc*QDO0~m
z&jR#(&sfI|?_X+=X4v@CTiekHM@Olqa$62TIJ;nK>pk<o1_eo#r=AnQw;0!_GS{yT
zN-}4TKsk#$!ycE5*MuByyy96rc}YQ4O$CJGsC1@~uf`5bzoWJiG`a9KX)X^n2|;ZA
zLdC_OZ&O&wOP=RU5+Bhs!SJucSqo=hGd<x|cWHC}f}6XDqJCGIb-((}#fX<F3+noW
zRjgkAF1BxhJDdEnCe*JDF<D^8`LfR_^IYkX6jZBF-08MtC`1>&cGRCXOuSy#_xcHu
zxYM!kqfoB3)=M7tPZmTVXD6J(O;Aoye`)Z!CY^BCxFdc_)79%5&ld|jYd>WDIi-N-
zB~DrSowJ;FwP(fXh!hi>=(Yyu4^nD+Dm(MN@FuZsWJyMf#qCp9fHZXzu-B+86JI8^
zEqu`h8qbhb?2VLm%7XFcl@HfsTW9Sr`1Wx^B@<EOF3+I8`PkNWaaBn^w}~IUSc}^Z
zsFq@=^NeFq8-m_c^(0Pj=IU$C>7UxZLinF%sz@75!R#dAb#HrO)0OV_GU6b7q^X>*
zX^KfD0CHxy;SRoj%uAXe$yI;4l)7skoOnH1lLIU#FTv3VJ>XI7=Y;cQ7^W*CXk9d6
zAe~#5zz;VOmTUHs^I!(4b_b7v!Fq@taLub1vZox2s#$j^A7QFBdjg&k#-~Ym2qh3O
zyK~;35JEaI5mFTghP<WXdgp&nHmasOlQ$bD6;h4v2vAX0;3w*^#uCW+rnBSITo!FQ
zi3uYMe+i!qDcMX1mRLmb3%12(Oo~%4MVd{tXq)9>G7j`0DHM1oN$Jr+uJpCsNT?@{
zzJ}-0xEUx)vx7`&uJ~CyDXiZ{cS92GWPO!=DSuX~4EL8p*UNeiNlEtBe^@R3vUi2V
zUk&@4CdBmjPqR4B$roX<g?w*9>!MKOeolu&UE*^!IV|eU>Mv!?mlXtE+$HGffTwT3
zh`*gt81(SDkbl)zmDbeYw0T{1zs>dum@U^**dW5kzitcdK--O)oc!=Ttk)n)c8NPy
zp#>?naRhs)g*3MHj~_Z}$7C8DccrZ<7IDC_ljJ#z4B!O%QyDJ1v<)uF7V^Xq_P$P7
zx?Ee&msOfb+PaU{fI1cB_oCmMz0uFmcX+;Z%~-4@$G@jb0dFC(WVS`2zBO>@<3#<K
zprzk`5~2$xvsGf>mK7r2b;SkQW`*L~L?Y(jBxi3l2>S)92;MP!`CJo)C;{Y@yg<nb
z4J?AVGDX_mj>`s?;U0`~2Ls60c#7QBz4hq}acnif`ozRe&u7UL<;JgQ`?Y{6msa+-
z*d(K+mFWKO@|`{P7*#t&z7~FDfy`XjZy?-~8HTmjTd(8I2k{8>-{};g$}y0QGD9iQ
znd0O-e!hAK4uq?Fm~7u7e!5<Z>^vDG2_}KGuU_}*%ZdR<O~%wVbcYfy187{Vh*cxQ
zz3W3lnl~{L0fV)>+@*35;jDhEmT0SRKG1vXmC%4O+rcX*|NJxA!wxM-lVpY#RRV&3
z4`2Kl--aGy!u;BJktaCIlV}eR0U}oD?^An<@+#{%jOApK1M{vjBo#E3mS7c=$#hxG
zI0Ck&xz}2mZW0<8?&#e>wVfGc(I3QW7IY^gJ53qc945uk*g5?7uxLh?c0u|$lh=_N
zhiM}Cu$GTrr?-}qo1D#6_vxl%r8`r;KVysn(-j6f{mO7RI7`umB$PjC(9y~nNss>8
zj}Ut12<-<8@t}|#ja37U-k}sO*vHA%0oBvbj|ICrZAd{nw7Ml|(5cIlH&7TuhI~%F
z&!uWo`^TBD#yLV$`%U#^KlufQR9?`ppBbu=Bi3~JtG5zi@-|-@Y%(f+ea!`~Av&g`
zFqm6s$uR8E)xZQIruqB)gz=9PR`XL6!Bpfa0%m~v3^^&h?eDRuJaX<jCNT9nm{Qs8
zMy1CR=pqLTu)-bW5%I@`YRglK?j|h9f(D(}pBUM!_hCj;w_deT!A@FqQbztF{iZhl
z7WvvBvhGK3oHPHWpwdpPtd>Qa)NrCNq1|y9E;;w*L$Lr0R7LaW&=>NTT8r{e3F7~#
z){^6_9wmgPy~~K+$6hYzzh74YeYr3G(*1ZBfrU*JdO5nJ-1MBE+2x0Mk7b1Gi%D}e
zT7BvBtD#x4RULdJ8#i7g>ohP>*0a}BpUO_^9+DgKjL=3q05qJQ0I?e86`kT`s)(xl
z;UD&>Gp#i~lb`Q#E4bVK;yiSo92iX0idCMvC`&8x3V%C~X}Tq*aM)Z(4*`Jam_YDx
zOzm$Wn-kQD1y4}P8qVC@w|Nh@MdbP(x_Ge<Pa1R+@*NeH5-HQ>+UPvJbBkrP8%KB_
z8*A-&F0Ya{jMW5JTq2RDHQ$?PLPB)?D$@#oNPxfhpS(Ato1M-CMsp5SkokGMuku7_
zweE6DG6!QWu_h(Wmj`A#zD(I4g&s9-^SM60qtj#cKiJeQRj$)NV1oE18ylNPGdC!l
z#{HVso{Cx%b~gSj0IMZIT&Ux2h_R}Bk8er7!&cKl%afrf#y>kN9`Ie4y8TUqMEazr
zc9=Tn_Z(3-Mwks0N9P5N-Smnc8k`6%m+aQOYCox`&n(nb!*(*<Lylz2tXE_KwmTkZ
z)q4i0ZZsfcTPKw3_{NDvT<SN6OWp&<cHF310eX{)RR^UR(s||E>ybr33a6?r#(k3P
z9xgCIRHY|ZC!gJ?|5Jh5Ls~={wu=j{;=M|bRJN04YI8#J;FUv{EDep~0$GH7SqFQ|
ztKuS%fAuVRkgzuh!HRRDmv^h4@^V)mjVmJ{-;Q>wiDDF55Vb@m0^{@P6^qFwdew<V
zoAH@mzRy%PS7^OcvP?EF^CX=*7BJnw^0w)S2~dmM{KeF~TJpuRa)*7`jL?QRr1dSt
zR2EE-S+uGo1r{a#8zHxgwR`-p8nhpUNpn1M9JlQsKHQqVrD2R7{9-?+%L2K&LMQ7W
zTQ#`13(WY5c<&ZB#e+k-{?PFj&=qyvsXdMDAQa2Qe3G=1f3FiaQKf_CJ#BouF}=Dr
zO)fmS>cNCx*%5YH{QdKKYeLnX6l}nR&DWnftf%Fxko5%nRKR#@v{3a*7x9yqZ^-KP
zEsA;6fuqL@IbS4OUs3rULsyZ=Z!d$+#@r&vUeYQ(<meNtgI}|7$btY>Fq|HaWm3kW
zM+IqaXf@;02l*Yp3?Of}`zqRHjS*@GTq5uy8E$ObKK2Dd;r&|>=rBQkJ7!@dHepP5
zZLf_Hk=p}4maYUq)K+TndshWQ`{Mh7k|*S43r~hU#yeoRQ2T<sxW#wKZm`GSe}v{P
zYX*I);c`cEGbg?V<z81gNZ})6k67U%atYSp(A<9sF}fiP9f>BHH2e^N$|#-p!u3{2
zNgcV~MJW!~@$)+2<>O%kp;;^5IzVx3%6VP`LoVwjSLfDgjqtD|DT>&RQ=t}ty3~)N
znL;hT+P?qu<=t2nn@2ZBP)u)KVw?2v(}6aJB_QN_{oszoXJr)*qqbqaY#!B;h(Cgn
z75gTi{n_Ygp^^B*;u)G7tk2EFz}kAe!?_(wx4yFJvxhg@(G|VlNbP*v6`R+TJm2!L
zBz$5n&Y_ilrp4=cN9Zz2X<yT>qWX^_N}cA5*eR{gxj!Vcw||u0qT^&@cKOYi-}cqZ
zn=l~rL|7}cU?|lO1fh4mV=g-L%L<!y@tg1~$4U`5?Y=W}8aut%LblM%H#%Ycc`>4L
zwy;As+4$x9BL(4t@<4N7bj<sCX>L8GPum^cwGVdMyuLyqzOxd#3zN<{BGM`gUs2sr
zKlCZI7cN-so4S#~sF3xd336UOWLRX2N*VcjkLo(Xh~$E%)SQwQ_b&<fxcdl`)KzE<
zb*Z1Fz51K!>PRu8DLT2laWC)F_VX^huXsBfEd?EyYmxBCru4IQQ5qx`fugOf?Kxh4
z4^k><>{(xfBa%#htY8tUbogJoFhrjx-LC}H`HPrm=d3EBclo(_3f}L7`eGjd5T;w`
z0Q0woDgXnDUHuDCp|oXYW+p%pCwgmVFAn(b-D7Fjji0U;#{RyX#>=a{7QDj~9GvRp
zOLu9)>Wsbw3nFX(`Cf(l)IzzeXp5S~(n#Kf;>4hjz8Mw<Mn4@z8bE&L{yWVc{S6oT
zB6Nb$pOUuIE!tP(KbN(D7FCC+%ZCRxele5n@Lp8VCoVj`FK`}~IQm>%vue!<B~Sr_
z=jYx_M&l#3_pMCNPahF95Ti-jicyec9JU+;#y9EfvW?1f&#d#^&L9qp9^Nc=jM2P1
z2ay=cvbB2&4Vf#}`ySCF-~EV#>r8FfoYN^#JWKg^-ddV_EHYajFn^C>avOc)9K&VE
zva0-~!HR5g%XgEQJb&R$`lyJvc1ZRJAINo~v~#A&)&sL5zEd}OCsaPlx%~)_9_>tW
z6>5>^*?(nF;2_X%Dm7o3HS&R?*!k|+dcFP}tqv}_$67K25_yK2c_tKi;gqU$y3j-#
zKPN2qI-F`}+qNaG5mSRFn>Egwn`t3KC17GNC-{C!@?=&m3o|by{<HJ4KH^PXa0eLp
zS__fa8?!9%oaX|9HTJj-lRWf(RG@^qD=}c;C*djoi4=PAMPa)-*%(|yX;joue$WNy
z+?77&m)GK4Q~caMiVVqqMM800>IR^Ms`tVQ%dbVVmn8=dcAv&K|3h>8*GT;D+U){s
zuZwGD!w$diIj3(2^qOy8V)ml7z%MG|HDYneXKMm;EGf}VwFJh`87wK>1QFK{RN31n
zu+`5Psv|$XVqUk;1xYobdXN%lzg-{fpH1Pkz&u9K%FQa&z_G?J!<RG?3}2YuF%^l9
zje$?$wxz|$i0ndTsLGWn5=BY+Ok~wGH|(wUgzYk1hX9Da^Si0`R6+WNLX7RxPgKlG
zn-jDhGahSR#|?L%Pw6<fgs5jB5@SWS8)Kaa`~t^OJx7%ExsLDP+y54xr=^#ZTRnmD
z>fOA7e;Ge0=a#3~otb4?ne<^}g$|$=CJJ5f?1X`}6cjPeLArkU6V&@t+xZu3_HWR1
zwYa#1%O_>1Qr?I2f1|?xFCvzIqr#VylUJL%5rlHRr(={*VRo)|`9FLoe<Gy+d>i2Z
z!Rh^f7pDI6hPe@(I*;L%vc|mmNGWCYTwnj@LD~UWv0)yRp^JF1fQXfLsiqL*Ci{B0
zhFrgY$uZtxu&spVTjRSE8L=9sfPr$ZCM*?G!<<9-*&f?5)}HTVsKAaXDU@G*s=fSJ
zIud7$Thay8dph|HP7Sh^L~)<~!t66oYnLzA8R$?|Hp@TsRn4BnG9A!C9&<VI*4fe3
zW*nhS2K0&XVjuoG)HDk!q!wvcLV0zar5LgM#-<qo-ZspY-+zcM!lAF_&8$oNKjB*^
ztpJ1g>8O&60kDq@pZu<XXp;vTW4*ALCUKn-U_!TK$Vvhd4gy!#2Z9RGE0{F2Q*@0F
z3qJCB9`QS6w@JGeNjuc8)&jN6UlpG1@rigdB%Pp$nKOWBx4ofu!#@dyoE8bX@n-73
ziQfMW2>jO*^>v3vvwuuZ#LU)vMgo0Lq;^5Qcxul%=a=V`!QMHl^Dx>Of44k?A7%H{
zjNu{SaJf5P0)dlRv14ZGMwVezT)cfndwH`@D}%IiQ8KFak->jv^d)X2Rto!z)PRS|
zE|0*=_e+ts-(IC?^j17%JNF+|hrisMea^l3DfuZO)}j4|oUBNo$yR@25rJ|u3b&sy
z4Om-lMPW16+KR|6L%7pQDy9FcMp2Vo=6&)?zH^gN=Fv`#z*bs*Ebopv@C8m`beSv+
z#j6AKOH<~gPR;LwAfK8C*^mZmqAHF9>~y5e`e2XKUYcXj8GbWeYw-^+6`MMsGl@sG
zWt91oW5C!^zMDgnOS=Ywfr_2As}GW<wvKU6-y1H~mo%<%%L3=y=a}mTIz9nDL`C%x
zZbT#N$ktGH%{gt?HbVQ-B?N)-MN2vCzS6d|*xn|^D2{RLdhYGCXlH<9l*agva{_dx
zAt=foKe7q;W{E!x8-LnSBnLi+gO9pVw}@Yj|E3}HMDUomt#TIYu)kYVGGiG%Vg-Zm
zNHx;R%LuA^TvWJAFI8chCsoRz33BfE)d=!TP@$VvD>#q3@$hDMU6HmM@pe)=+0odX
z+rLYxqj|&XLBb+nnE8M}&l_#p+Cvreb{Zn<x!2B+C-TAbS3wJ1IUZD!VjMFDqmTNz
zPob>A|JTpK*uHFn_5KieHa7jp#jY!j`G+`zL^;p9<}>Y|9al413{8rhL^E{6&MRLs
zE_lxHP50~t`*d&)8+Rbw<1o|E;&hJ~pkylN>bP}bZkK-V<FBYyH2oxT;w*w()({f)
z@$;ZFeA{mhtG!i*vKIgI(>c?tRIx&8h&a^81~cU3{x|*HKWsn$d_4~W#unwO2df8X
z`aFRZ)##dr!wFjzsnOF9c^B=-ObxA=^?^;aMXcIUsv)pv3&j%E8<J=!xcSx43ZAly
zDUod`eCAs9JjqD{qHTGK8Nn_q6$a@zYUlGJ`68nCulcu4UL069l50jZkDA%k&JQGj
zvIe0G&0B>S^$8tt)h{Ef_l6%HfGTXH;hqt{JFPreAM2xquk|rHo8U1BO%A_$;tq6w
zz7_L%;;zeGMT&G;LVqdXk<*v*#Sy={5P|qTnCIOL-rRKAefJ3mG(@CW*nji)^;$1C
zY-1bs6XB`QMiazEwQ2i~Z?i8UM;4%LHvq@TiFR<q4I0wg<sHSU-<;cY^8mSI@==@w
z9<{rnh3td6FH_@<MO-Mo)E~UBh>=E07ac@f4SyY%vCyI^Alyi-c1f^(UYoxyo6uhZ
z*~VUXwKtk@At<|dtH=2#C)%Hm9sv$J_QRi{x<UJs6}BJF-L)I|aK}anragG4epA%8
zwtbw-N}rTY7dc3z^KYoqf@Ir1C4VRr%yo`fr5re*`yE-`b^2WP?7RHs-KY(n>0Q4P
z;c6A{tSB7p!;SdMItiAdt@SwTKp?ChdsnwMafe~sUPhI-`sx_lryf|d*vZq|PfNlP
z)%U)W_G`e){D+}VW5xiF=%d48ZBw(astRo%dXL_Qo9i&6v_&}jj#XdJIBQ%qPF2_3
z!jT&AVc$z2<jl`&sAR7Y7Kq|RG%U%WpyH0?%2v>N*cj4m3_77vKnMa6F~v`^jEqOE
zv<jx1l!B{bTy_}nA*s`COEUZ3*?xh>Hr%j+%KdpU_o@@(P<|+jcB+wXwdt#zR}o>y
zDHHiX0?m21u_Bmf0Q}x}*Y6&s4Pm#-e90-JqYB3<=_;f`+T$oI^tBgH$`%{?+<oBg
zb585ieGhPkuJKMYC+*khq7C;JZ@2e@T8ffLcrn1AyOm5U)MwtTq0<@~+@~ZO0f#>b
z0V>Xuphzs5hUL%KWvHYB^(I0i>~Ygd>_4V*DFa4m&r12)2C)%vqo~h^Mxu0V;+7BR
zUC8W#bA*Ds=tb-s)=D>_;eBuw5Q?Z)u0+aOJ}tW6Yu#lF;7N)ozqUR1<YSP(7k&!c
z!7Fk&9yz^WS9-|I@qU8S(rO$0<`{@AhjlrkZSRrl9-Q`r<T%<&ZdWc#{o_XVwjX8$
zX@9rJ?W^G%Zm+9#H}uf$6uibqF#arHA8)4KW<GwBq9{}q<AQB&=@sm*dn3U%#b+)e
zy=c0enBfFTJ<7>ts=pN^Vw~^j|6+jn=ZTL97^_V?3TtXb4-`G}XVoF~ihl(jjG6S2
zs`9>mB<)FBk%6jPeObDa-~{JTqj;pj+76gfLZ;es16j8wNp-a5$7kY-r|OajbkuP+
z?|zA*h3-W6L4pa+gtC8)?d+IumgLit&M!-_)J0p6Sx?1PTLi$H+g?cfhXDVR?$AKy
zAse}93$ZK;TytQP7noE0RG<6@lnNju`u^2u*t(S5vYwX}nPiNa{gdyj;oYU1>%qAY
z00c@3x4x2iYx7<#PadqtXh?N-|6Us{`?bXjN-0SHWn`a6GUFFYIaNqzz_O+eW))ck
z(4+~WQUo~+C67JVF&sr+e0P=x%tIFXl(ju|_(ffZhTJCO>w5i#BTXKBmEf@L;86EZ
zdM-`t6YBJ!q=%2`&x+idi@vI|n*(txX<9JJuJJjdH)wHF9~FAjOO}MP86CKY!eMW|
zX)uy}w$W24ckrHd(H?h%3J}uNI-Hg#fIsd?^--;3%#&Qxy6D*LSy+NETB`|-+ujfu
z<YN=X1&>;cO)(&5fmkCh2RIlNDum<1<gMbp6j<@Sv-a!;Ev4n8QRUSY)?6L%M&(M}
zR+*(>uM$V9=q$-iErYkmn=}ZnGR<m5Xo%98nAsf@DGVL-1mPZ}QV>Z)qk4ZkmzLz-
z>wMj0vF!_6&j)WeQjkADt@`a4cz}>88~)6<_}1u7rEMA(zrVv08n1_`ueg5Rtlw_y
zkG~*c8+BsQf7~zB`LdFqX3-KM0SjKzrNCGu&;42eE)6>d)p`RL+=bl81cIB~0HE^a
zSmhIL{C3IPbv!oi?9kdu<giQSPSYy5pa+pYnjOv*8$R+DR*SrE`!;~CYe6tp+vQHz
zopGU6<n6uiMAuJvQ()^Y!c=y7RALB%$=+Z!#6bl96W~5=WWZBXSaer}6hsG{sDq&w
z9kEuzpLlL(olTPsXtO6rK<DlM9NLt^YfAN7(daAx<%x}q3`AR{dtdnVAf@LPk+q>P
zmb)9T%@y6oWe+iqyA>ib$CuY1h)6(q=5#51FG-hDGQMimb2@3Jhv%V#g*VoFK3U<F
z3id%0D}98(RxB-Y&HSXwWoQ}RnJ?1Vm@9%t=(Zs9ekSc92T=FYyw1gpKReyU&?Zso
zPYrcta7;3<+H=paXe>1fJ_Egztr)mK%+dw|gMLP_crb(u#%#LbBe<xrEIq*$3LPj9
zSWg*loW*`5G--gTjMgmy{b@`8Pxs2}Kb@BUvwKAzI;OO*?&)QB{iYqBQakj*83jPi
zj`cnJ<(J4mr0Q($m99>-DpQra=;Tt|MLu$?k5lh>;<%Y7Y5Sd$lQ#<ogqE)g+IjZ$
zFk&w(RMA>ijEwhUC-u7mKmdRcXE~0ILYy?k8!(p}(se{kOUi{mutj#t<J2z~;52pa
zBnN)m?eeHopq9G7y$|9Khlm9nHBz0Xqw=ttvRF#4RTu8s*WzQErccTb6r@_&&G(?D
z0Ie!@sg-@bbYf78gE0u%{ZQ>zyx>&E*qe?b9xC4>p;n18gXB1o>vuxJ!NeViu>ky5
zK&IBanNOcKPR(YMvH8iMZGT$O@}>^hw_w39$uk#N%jf-5n<%>X**mzT*tCpxUBk$a
zC2E{BbkBR^Lws!5SbV?fS?OCSXH5*9HF0c0dh1J5L}ny~`!W@H9n22gMoDZ#R*d{G
zd_!FuJ&rIm7j;d?QsEL5=7Ztr>4*`{wezda_?UE>i4HVv`i`H*`I;<|N3WQxcMNrk
zfm$Jrash3JP8h^{SAt#j-MzEXE4YUnY$}Q$QF)>>T^^Z-<Ik~O9>}BYMZ;X3i-D5_
z*||4s$b2r`c%L*3ce3WGJ&^g3Ki`i%#R0Q@v?K84!0Av57Q5eczDqEvKYchhDN=o<
zD1nJIO_Z2!#EvF?s~p-T`ht&51NsDo&rZ7ywb84)`{Pwq&+;&McT~Qn_Q_|o-6I`q
z`8rnNQY<<81+8_OB*ZRpoBe@q!k`f~z_-U9eKukLO?1A+L<-%TPB*3gS*V2B)9*ON
z+8hMZh4V%M%@(QCm*hPD>eU@<A+o{o$(FX<bJ^i=h}$T#n5h1g$6Rq6f!Q2-Z~-NZ
zZHW{^SpqFI7{gB&qYBsTRTDLllkaHQo$f7rMe_ZEggW6kofVgpzcMgr)%j%fiyUyr
z*=GemVaf0<`}s4(ZE&Ol=RX+Wo$2s#3}F0@5_GuB6FugC*cjh-Z#3|Od&$wY)bX&j
z!V|i-3m%)K0=w%6*12F->N>*hL}hm~Nti~adTnO{S4Ch=r+-2mzrS$>oNv?5TtoA{
zNDafOt{ENlun#ez_%$kEWchElWyL@JVSs;($d{QSfd&t~6sT{<`^VGyKhy0!_(s$b
zD|KZ#^GL-BR(3R%Ah9UWne?8<LL9Hz<8T#X5;eYt>5Xf1^kYEf$~2*H;n|trC&v4$
zOGDVQU0=P9<t{Oo8)Xc+VDR>_<-;4Wr<-c(3v2m8Hc|uu0!8%>UB~Xlz&ERmw|4O9
zK_B<O$a7$fR!e?a{M7h6F=}axTC&NoKSPy{kZ%xeaT%q+ah;Xii9*0MZx1VFR0L)<
zN8jviG9@Q9LUIFhK<tx`K1Nym@HUZ+0elP3716c8ZkJV;To82K=;nMHEB>L-31f<l
z5R5Y>A`MLw_AD0<(}GaE!NntTJ%38i<RqynfsrH*GTa1C`F68jS5fO&swG4v&rZaY
zLg>i}x`g*zMKS*=KbRQdcRcu@m%E~#;&mv<PBzS*+R;vW?F^kzzzogJFjCsfgr6f%
z&Cz{T0J4uM`O-DVx2Edf4;7T4v<1e}ArQ6<k?c+EtG*AI{qW)22w+zNjcyaHK&^&r
zM7e*BUO{dV@+>g`)Ehu^Gxg(y!C($<8q?2cObSc5<uDsaro5hmSLCVdoC;ijM=dui
z1?Dus1Wr1TRPbX*v~tBs$z4)cugtybzaDYCQ)W=xl#e~!3H`2qG&unj(Qh63AaVXn
zdobYXm<Y;wH*A1kG1YPfZkihj-Q4tYnfj)H7Lj?Y&<gtA(9jBDv!rYF%$Z?~FVTxD
zQC$ft@OJ&yS-IcRI85F9S}GXuLG}h$wBtz`yh`17MQCG#zo9F}nO370OLPZQ>cW~B
z2N$uGriy%RgI1H_zsbuHLv#f*(TxIiEyKsbZaA3txe%gdf2FaL(!ewj%%i45AbG28
zTCxt4k!O9%R0AhxNCn|tBoB<FTR%nLC;9R^W+7lwqMY5Q5xdB~H88A`x<JaT>tc`v
zf=L)MRK66Gpy->=A*xTUycu(af;`U(>;~r&3NIpK`ktQ&wGtw)sPeU$;8#>6t-B3y
zTo6RJvJL1`%sG$C85tHxy;(a0Eo$3Ye{1&*1s+}=$R;IKG6pb1O_Trq-24@a^4Gap
zM!t4OMz!^#(`VHmXp3=@gPA?4*5Dz~pq%PKB#6ow*fSk(yjtTwcUo;F@J~->m^XjZ
zIk3%;fw3z7*(X!O&UugV9*7laZNaiR<ERzXJCh^C4SO@b6!b+S@y#XFp`ZL#r0;0D
z5-BSGqTv2+38A-frB7<d<4t^LNjnhOMDIVbaNuw?D8-#w{y>1qw0R_Zannyka8Hwd
z)x7CxIqS`I|M8Ok@tEEs!=d^037F%4?Fx=p*&vuAe7MDt>h60UCgIPaQ$Cp|0XOnu
zs8C-Z?Y_q-$OZ1JHIuDG&44hUU?^3(#rwidfc)J@q&6qmhUMvku=Pjy*P?nxiE*$K
z3M^cH4cN~=h{mKqVXhsa&J7!?VruW0FOtqXaxqC`8xLKu3C7_mxzop4={$>W(u{sk
zpRSRj5!GTCvLC5+GAlJ5Yl4YzI{I<$Kj3D<Ow^9^d2UfF|Kz^99_dEiM@03Ov%#^;
z`rYomF?6A&_Vh^(pt4iBIg@+A=e*DI7%-yxK5y6SnSo_>Br!?SIft_{pO21Q3p2ZC
zFCsc7<}t34zTpDhiDIDZsu!L(um#COKlq!5z)KjT4-Df6i6`|5pjOeFu9IQm41N#t
zx0r%G+g8*yYQH`xxFQwm;$|f#0Ul_lo&p^FR*5oN$fK8BtVph+11l4S<pLKMtQ`a#
zUhgP-&~P+Mr&)gAbe1DO*j*a^I?&j7!_u91K+C_AdOY0Av?S<@ZDBuESJ-SQNw;~-
z|B=5qx{-$Ohhmy<Wqe+QI!Vpq>7hS?au#NPZGo2B-Rz^E6<$E)a(@%a(7OURM?*iq
zR=zb6bCBV;k@nd*4TXTQkqq3t>M3(3p6rn%>a=;l&Suo~M|~lJP|~=;N|?-#7VX{6
zWvhFgQW-)XrSZ5+EAd$#mnEdzk4snHs=Xg=nZn1r1D!7)+E0Wsq8=z`I$-c-lB~vQ
z#x$MDG~A_eH<rlPVRjZzA`cqWWA84xtx6T?!-%e`gi6ucEh;xdtPxOTgFNf?uE>`;
z_rA+wDtFFGj63{NctOm(eDB~u#wVtOx3m7r!e_izptsR;z4sZFuYCu_&JZM_=7XEH
z(i}0ZED{Ftq(yd9l_eb~ZBn|?fX!5KE&iaVZb;QPjj8<h5sTyrXSUQu|G!LsXU%`B
zW&bUL0}7PO-}@DdDtA4Lq7ISEIesh0EsFXPl9)(l^S!0B8-`}Skt!7KXc6g6F()9;
zfNJSQ7bL*Z`0CjyUucPBq&O<1G!{G3mS9a@Eb~pNe%x_4T~Njf3@WGftec{^4bWVG
zyxbjLe&Q>yn~>I%Dp+XbgAC?8ib4D;GLAN$*mML>ufE7@8FgoEl!pOGclQi}bHj=h
z12U0Jr{+k#vMhG*M;|a=GLM;Rk841$4#+D>H=ws(hy#nU|9eox7v}wvlaJxy5bjUx
z7)@p7QBu^)%z(aO5ePBTe~D(Gn=<(KHv;N}=?Db_&v{Iamd}`3YUhdKwkxr|)e-w^
zcgV0$s=eP7^VK*?RvP%W(lsIHyv84r9esl0r`+yrbPyd3)pFB782B7?a6zyWVC($S
zm}GtHu-Zx=3b+<n%X0Spi<WG;iaX&y_y^=#>i_;9|4qKsKT-O>(Hbl>%{f$%G#@ZP
zKk84G<PMV_66qk<ND943_l+#L<xfTY|I0r6|1ajDo=2V^oO})+p!q+MDHt+5_VoUj
zwSS=dLJ{wFwKvAPrf#{1YM>f_fx^^&QI$Fu{p6$O_EMmhtKIzUnE-CdMDQDZrHe+m
zA*Y6b%=bGxlXn_+JM8{K*7+QuUo+Ufhxu}a-aPU9Di4jHH^iY58+1pOFUs?g`>Z>g
zkDPV6;z^-DrNARurQ<t(F5Qbc*oi}8sZc-X1_`noi~(#}dD<_vUsOMT{YUk?4*eqt
z?4LCcg=dICRBv>V4|(+^t5a<`#poMjd9leo!mJ2{nJo4Po>>f&d+>*f*?;giQh$6z
z|0JiJ-Uhp1zM1bdU1W&NbU{D{=w|G=;~fgb?U%8!j%M+}lT`iA_s`C!`@<K4Fye$i
zWUR~Jrk&pHGlSgg46wWMhFYc{p$ib_X>agMCdj%8%h5ef8^eF05>rr)jlnxhk9X-r
zqcCKf9n-+I#BB*&?Th?DQ}?)+{ftox7&?Jo5pG_K6zAK=O*-T0g*R_%bG`wZQTeDn
zb6YqSFVWdt-2(s*c+h~KKaeI$9rJ3IX!)MpKI`fyKwUa5U+x<%-im>#qg?33%qV#7
z#tMNp{LjQcEuu_jazqHt&EQECT9hl8D}W{TVXDrRG$L8U+s<Zc--k|^AS!z|Jf(0u
z7W`tX`-FL$C9N2L>gwynYL>{p0l$PnO|yToZ>yQW_#bnU%l>0nG)zM23{oS{b1*Jv
znjiO48-33(0yY`XmKI@^5e?ReK2RPBFHKb|&EL`NIPODi;ezmUGGL`$Z3JhvwNZ?U
zX;Pr6Zq}jOd=4`ND$}~E*+x-f$p?)WY^d7_(G8^=!o`f)g=@#D=^mFWJO<$o!kfWw
zhqlAq+QK&nmas1QNL1~P9o#&>O=aM~t+q#~%Z#sI28#(P*~aIYp*~F0Y9#+qN+uZB
zN0u=6B8wyUTD$xi;m}SRkPxX^%AB@2dSp9TD)}g(0?nHsf2*<*oc)E0p_H}Ewt;K7
z@>N;3#rn@NJ-#8mw9FeBeSMJC0gJ0At^Ef={D2WH@tA8a3XyRw$MaobN!kWkPpF4N
zc52l07H2OS#$jEOa*A{RY;=I27&ChSe&-bc(9n+RFh>Ou3S7!C0znX;8$H4rerz1o
z*PI31I6<lB59&?asZEXU_ZW{f@-erQBo>$ky-E`RIK!rJy_+f3IHmdXDeeqDFL-yK
z3)T1Ci@K1=V#5_a*IO7CLo`V>Clcb_M){i3$2@bPrp<6?3+h;jywa?`-(PJCRccR9
zGf?Yxgff&psM&JfB)YJiBpM{@!mW-pIPO!f+VifhYlX$>Gw{-*YpE=M^>*OiFZHR@
za5g}PSMqS0z$DnqzzxlCoE9c)0ywum5h!q<cpJo>qRnHjN;$~F*Yub=?m=itMP2YJ
zj~Cui(N~-#*fUhch<qI=>^kbj%P8QO$T$}hlTCcnr&pJVKU9TrI;UGl1d=_&=xw4Q
zaCjW#zW046rh`91pBQflT2ruVJjn{&c{ZNnZg!x@z5|3S@gEI>WV^>qp(WfMJ9#3M
znmspoxbQ(yqU_Gq){3^<es$o?cgJy0jj1MXs@gsQ-KIaY9~Zr=a^3bvRx<Uj!1Bby
z_<C=bpvRU`5J7@Wnk}7U<+w+%%ZUu1W7_fRE-_%mJ8T+pylXFvgdAQoHvo`kF<3tB
z5y7rfk<Rn_o`w#1HCNl{R)v%}ll8c!t<Ud6^4=H(INo2dZN}iQiY2>6yNNO?sy8g~
zGYGi2k}QZ{oBfcb+|}*|)nd|Z?i%3Ol&NTS{T4u>QFrh>LV*wwnr=L{@p%g2lmhaZ
z7Fv(AbRJQKnk8Qb4uwPWLyvnF^O5>o3~4i=3Mq0eV`H0dMBccn$~zi3!LNVv)$NcP
zWSdzsRulY`I?aC>h?=gBAMjA9Ww7i|{gh!5#i*W!?F;I^lYPTsGJ@^W2Rq=N*;n1O
zf`pvwD3@FBg5<_OaV%YIGBLBK{e?r_N`gOvi>!+3y{ln03M$VX6=UkKQiV*(1v)7o
ze%NgokHF3M4`9Y=S?~mT&+hv<$aY3FPG#V#spW5{y!>j}RpN*nVJYOHRxh4(sSd76
znAaA^YrU1ueDyB~OUHQBtp4}X+wH6qwjR%vI2PB2y+6s49rs+|>Pn$_i=U-MmYROX
zCX%V%+g_;HtyOqYZwtO)ePxJ*ujYdE$q$ZtsS2NU_Ynu(l0^>g+vYy@@kStL%Y^#M
z1z-IHdKUTiJ1=opN6&=fHAj|X(pG<O7mA|W!gc(*gHtz)#ta2<T{IBxY$?(;lr;Z;
zyUz-sC1md*v)#3;lGRG)lOZa@#iA;)8=`4sMfIT#ht;=5)xH5#Bjkw(I<Vy2fR}OE
zcXsKN(SYeEjV(Z8{7gcpZ6S@K;?CNS19h_^&D=Gj@Sm|`V2-S?Hr|?_VjHU(=Qwvi
zV<CG$jL<>?th)mIj{w`cz5j3_h~YQ|{9hgfRG~jn`91tV_Fg;mB^aleR7r}h3zW4Q
z2b2(W(#TkaamtupkrPXS<72}BDhUu&UCNLqLdU^3yQ;esBv!mlIQfN*>21{j9_GIF
zIckuRbGOH4E_ijz-v@^W|LB^au(92eB_w@3c>1V#P^nb%bwutoopvgykEH>|GTXtj
z<Kzcn1(7K_=YX#VRz?I2PS#QhVTQicCa*d7u@tWYc5AxA>e|8;8R3*Wq4b1kl+3ym
z*IeQ|Mvn`qiE@exV!J(tBvOx;^n@U0KZBCd5-&;79D(h8K}wgl+vD?_+bpJl=fleH
z8Uzp9EJXD{dcH%Ph#wY-gDT^F`P1IU7F;MK<03NL4cX_Kw8H&U*nw=LULwk?iqiel
zPFq4_ovHjqySxwtRQDwbeH-K{aS5<*9&@D9fbq)y^y%e<l(arWrEMze({sGzN;#aX
z%l8908@-6~wPr8;$O=sAs4Y-5cSlL*7#?SiMLXQQk5jCI?*vjrr+?F?v7i_0IJtH>
zcG0xM<8RJ=Exa0&to5n=JvQPFTyow@<Gk<aNrr<-k{Jy<WvrjOHhUP^ZGw=^?OUQ#
zPEE}Ex7WJP$iN4pP=|?-Bt9|)E8_%eYba6ReNIQ8%OTaCN;q?$x(a3mVQJ_y?)Bzb
zyxSgXK+z?2h7mUrjdW#lyW*gyZtzSe@Gye|r^q>DFK~f`9;HdPWcB@xo*#*c0mgJ4
zag<znB~9F~Bx2%-&5HrkwbQ1?4RyHygRtpZ#YyX1Z5sjd$YRyPL1ioHq6yzoP7eRg
zxDg}_#`kma970#u{RpA4Y}sxYXG2v5sT=o82)D<2sJPA2))+$Kq?s=>Z{b4m1-czh
zu^@_ki&PLr`iz~Z!0<lmj6&-Sd7MO|OoVx|a$|E2^w26iS#RHY^Lm<%8ELdbUL;Li
zp6)wkVzoRJY=>(sX-u+6ITE3m_fCTk+R1P6x?L|g2=`dK@NSsQ06*l6J_vO<qHLlK
z#8D>8aSjWW8{*-Aquo4Yv#aJ54=|+UZhb@l`i!p~NQyul*^?`nSW@h>DhXy(TaA<D
zrFs7KNs+U<_dJkF7Og7TJg_{=Yy<KrM=0ch<CYmEDXvW)=ez0X)#rjnW*m-AaQ;Ec
z^hy~##&$62-0DFZJQi=u?sLd;8#MXS#cl}^?TI=b0znfwNcLhAJ;-CioEgn~mdw~I
zz2?<OKKo3SIXG{N6JDMm)>?+j-aEw*$AP?Cc)LIEIw-DSGlnyxI`v)9c~qpn)(hnf
zqgAb#N-3?(5%R=bVxP9+xHg~%?9mzLc+*oAd@H!&9u|qQmS%=-D&cjZyi~LWS__|(
z;U}@pWPkl$ob~esc?Kcr0PuXC3#XN&EcvCGoCG6;S|kTfE;`Q9_)47cs<u<Q*lbI^
zeb}N3>%<8eHx#p{BvtwJ^j&9d4or}KV;H@8$Rvp~jw-;d&;Xg|s+wz;9ba3gbLtG~
zcy%Oy6@&ut4lz9;MNElWj%*S6UQ%!|f@4Vi*voP+$OSJLJwQzbelr1Mw00&%pvX-G
zx4DqKdy{pq@HBXa(U%r0@zY|Guwv;rQ1%6<cNM*RPR@;x&kR|=jikgc&J{|3{uMp>
z-*Qg>Mt`1Pp`<=zf=##0ZS)(+NRmba&X8as{FS}G(HE;NkMIwhGrr0XGqP;DOE5#C
z>giG(C=sqM)B3n4HUTyus98iSd$V@JyHzE6B8S(KBw!DAO<`CsIWwF_ooT&Mxej_f
zeahq>2)o+FDUuYc&vZk$%9)v?SsDE=9>dwlzL4*^wEy2uk$AY59ued{ti!K8sBA79
zJaDva;(~SY1MP*xvQ4gNrZS5CeK`z2=3w@+##4&sNsN52f-7F2D{8WgOj7png^Dm=
zs;tt^J`b1>V%`%AcjVk~T|kp>vabn|1`^$4C46leX}a2Lh+xNx)+1FCf4HU`EA&D+
z!a=VT!pcA+lZYQe*{h~QtmguVBp0!eO~WW2;$#A@B8;RSjrr(bXXG=XUDu3j*cab^
z^-=@`Rs&0je%qspv$xq5G+S{xJNlI2(N#5rMtz7a1m@23;B(*3o0eP=3x!$5nU6N1
zOT9l%v9JS;C9A7S#r=YcsSjP}0-+k@IYMD*^t1>`4rXZTqT~4w!~k-wNyMT7h`>0`
zlh>D!3GeH`r${Bpmris)f7*9w&7o(Sn%a5zhcGz;qqv)6qwE)_>Xvkdb&47NmwhBc
z?t-unR9xd(g;Td%cP-t<yV{3tL(=GV`AL%C(h_v+V)ss;UYy3@IXQ(z5)>n<p(_D=
zZ8V7qR`0cgXRnkW4iw4)!o8aVA4@hYB7)VPFzh52;@?8d1xaa=1!(U06GzmtlulxO
zE=Ij*K$ainSu#k+*qoj{0S@H&O9>|WhV1xl_m|=mS;D9M235*le*RfTnB95PmTE7k
z6rLuPb;$Svv^g2aQnMFxmk+W8hqrJK<3xvE47}U>uT%EX#j~sS{Brz!SCCh0v%4Jj
zsf41uBZ^3I(l*Q4d;R$B5bLK-NRaUo4PIIa3AB_0Rw_8d-pZL+R!vw2yga+Iv1_AG
zfTL(PV7h)2*(4pFzlHbMI*f|fb2pxy`mW78f-Qk~DYd$;sqM&-*&o%vMS{!&65XCS
zYmVjzB$5awh0U9vB_ljQ4Sv`=!VCqeHnVXKIJJ@Z9`<RkQCpNwL3t0M`>dCZ2qc@>
zgyx^auwg?wz0OsGBwNKLyhs9~Prgzaq*qyzu7ap8_zluo*-b(ir}lK`s)1E0uo4kZ
zNYUO>I8T~s>y=(<{>wDB#-ax-Q*v31yV~3FW;QiHx*Meo2Y;KAIgKU6S7-@GbqynH
zf{iG`sBz>BlETU@z%uARy0WaHDw6XH$Q0*7DQm3H0fxEWFO%yctgX{X?{mFonW*;@
zKp{6n7IC~f3GQ;GodTXN>jz>&66lJJ7`FuJ0@D*S=SW>ATou!jHZsmdAx^`MO_1Ci
zev0QBe_i~GJ=FHI{Y4Y8;ZtpnXbD04{!qsOmmitWd!Oq&tWoVfkOt0KO;E!-C7*DM
ztg}YPH6b3>#ek2fyuhM1das*%l)(O@P$MxCIZ;$Mwj>>0lf4zft<%wKTw-S{iH$yW
zLTfhs(8|PINo<>Cs(&O9{=<X*x2ULpPQ6DsXN2yN>_58CQ7z+w_J!0RVqH+`GvR+v
zBC2I2CMG$BE_J@+<YaP?m)65|Eg<(O?;^Qx0Wjkh*SF&ydJod>Z7lps`(XhQ?84fd
zZ=#L}3W%=L>X6!B<|GvD#Syf(La9e3RgyM&X@i-Kb7i>51ZGPy3{9UXfMKIq#3(Lk
z8<oWSCK@knuF8j{g#^Gb2>0dd=`#VE`+CNdzOT61`!}5BKIcB?z0ZHSys(aQm`z5g
z!gh8d8$}~?ICiXc0dWt6U$k#{m7psX+Q%pc2#=bRR|fN})1rzXU&<g~{{*p-v7xhc
z&5|knvP5GvqPp+Zwd!$MinNkKC94YecqK!kuDF61+%I5-cokl?V9hP$roj_oIXev;
zr7#XI4Bhz9XKUhrgmoy#XisH83CW73V1z);MNHLWE}+E`oscwW%GcM=^B08QEy9M<
zdp>-Wv(3NOvZ#wuOrY)`Lm%l+HEGPk4%tgJzAGe6ggVXk)p5adOK6+Wls6tSYrx*t
zdHOlYddn9ogcO$k?_UM>1mpsQ&6wQyEiCbD4C%%{@v5%=3O}Eb-s;DrzFks{<e3_X
zG!2h4i|ExwM|D$@7a3;)_nr<Rp7A{=mf1cQcE(%qRlCtAQACIvJCP&T<I%CSgulU|
z#6Z)`HVj@&CuIk2@!Ss7uj7HF80(TPH&>bO8^VXHidyTce`*W=B&M0a%Zur);Yr`$
zPCW|x%v8q~=o$)~S6zX*L1p8u={?8Yn>z6zF_@UcxZT0ucXp*iHaBmP2OlMMap&mB
zbQuOBt}~b2m$Ebg=YLN<?frno?}277(ZKSnq{qAzV6)1$#*d$Le(=5jat!54xf0Y~
ztar8dj~G)-fZw<+rZh&{<tQ0-_~blpA{&CYOY*}M^X4zfCxGcBsU~yJZ@7N*tan9y
znw%#I&9{>Z>u`a?hoxKF9TVr8ys{~J<|)m+<~5rVmY8B1gMJuLB`(^Krs*Jn5WJx~
zJ^?>KKkNCi8dyt_5Tx_4@j>y<b1pqOQ6X;`1dJv(3tnb{S6e2vsmQn=)DZdJb@ge}
zSjdt0QDU!o`k_gLJcVzPRKZPJVPwryGi6bWC?2)=&U81cz&o{|NFb}gvk4X<ayhy)
zCb?vzJ|;{{O>c9Y)c<=s(OhP+Kq+}FFj>^PC*M{9sQ6-J-~kCSC$9A>i!R-KNGvH5
zNs6H)P+t!1*X=Rikh?{kp-z5Y9SXOTQ6+qO;Tl0{lRoxT0Vl@;Sr^E@Bh}OWL$&>9
z)(CWkz@%^C9|0sBe@11;B|s-X-;QZ_lC25}L*iBMxtp740OTh*p?y(k>Dz3%DLS%Z
z%=N@@V+g;ikm6-%o=R2Ksq2X$VU9%<a;@9?d$@4aA;O00(h>wiM10`j*R0#tVptXg
z&78zu&bxL_bG_YsqmC-5G_#$JRFHy%*RHz}`!~di+kh4V$Zj$uV7E)*cWc^qM{)CB
zK+VWzN9j4rh!KaO4CjiLaTC(qBLXflh$gs&mA9&h@9JA3JnX9NE-G~e=r{v~f3UXi
zOZgI;f1@86r=*s<BIViHu_$9S5eK^-zezbjFKAbP={Q#60Dfavck5xS^bcyHvA?r6
zYc%SP{8`UN_$zw&5e4cE4sG9)9o6&3Rgr7fEir19eB3Ln+co7tAMXNrT(uxw$AZ{+
zvjVm+EV`$Fl<oJ;1PGX%{U!V|*pER$VQ`AWDleLE2R7F#hS+#XquPC-zAw--jUv0(
zur$sDgQa5Q(s1vq(Ovs6&xbtKp?M9QLmN_J`>#JEs;EFg%FK|i0nMD~Gqt5?%C6rB
z@1GdZ8UyzLoz@eg^H_)SOWFcNfl6*Pbeqd)Zbbulqr|3x>rdXL{Rzhr#vz(1_4f$m
z4?^8@;q`<(C88jsfhV5cH}OeXGM&s8kaR-hm4#7gAqE@(g1PAz8XL`dm@Y$ADZJ%(
z&}JHXdp$$fNPaT;>U6s9+#3uGip)Wr*f)i{Fr0tEwY_$B;MAstfPz`iE`NU-t>x_M
zY;P-c^O-HC2qA(1kLlbCVtQRWB=u<*>L$(|Jg3#Pi7+IxMKqL8RtWh<QBdofr$YsC
z?q*0yi7moZQ7bq2QR`h;p3*-?$P8SY)D*HKsFJi7@m!L#rI^`L&yitB*fm@6WMm^(
z$;%Hcd~!BsH+i*;YLt6IiK}SThF*()1++Q|;)}zB?q*BdYM_Krki3oZ{~1O#b(qbi
z>BXh#jM2^5_&(0rkeb}f1KBHmV!-ta)a-N(W04#w{bgV?%vao0Oid&G0bz)@3K*jL
z#pnG^?o}COLad8OhZmZgM1|w2TPf7Hj7tOp)yhsHmQ+4yJt6!b+TJoMu5Mk^4i3Q~
zxCJOA1Pu-aBsf6>1PN9^g1bAx9fG?%K?-*%G`K_I7Tn#T>&?4Q?|n}9KHWXW_x&mc
z0|v!hv(}pPna_P)ogLkj_`MOmU?1e9YC*#Mhj6|KvCu)Qi&?4&KP!i*iAosjMb|)=
z^7fUxag=yPMSGsRKEi{+uG?35SKT&^O+Ftlse7jyeH@HpOio^x^;?ygiOB65^dmjr
zC-7QQ%{kgYaSIb(`_#SyJC%Mgk~<~s#5CrhbTB6JwFDb$p|y87JJ`3&fJj`jPDXji
z*VFP;6@v#F`9lK}q9E7BBa5FT*hC|bXEAL*`bM=ae%eF(++2!ci42xCyccYxh>AM;
zUVBOJ5>%JHCxfdn!qZV9r?wthv8QPj4YL1HU8EAEKYPr1aq!6PcKu20TKO2(M_ttu
z$6tv1>gwg^e(TSpdMcj$Ubs+>E}uJ|7oKj{;>T^C98+VI_G(L_Txgggyu+hvi43ai
zPvwWi);U3Kp6vy;S?;F6!lhDWJxH?#aX++w`lY3(^AL&+V^M$HAUUWiJPa0cCXKZy
z&Egez6mq*JdEpt$kyL-iYLHVTgvN!1R)OPriuia$Hg-(=*#7bM4&$AF*`rH1*QAtQ
zEO*2H^y@OjU#Dk%@U)&oOSnE3u(9Ct#;9`;IcildLA~nxms(d-ea&A?!@u!!upCWZ
z-m&vtB+|X0KVbJWOWx)(Rf`l}4`*w|{&!x)(cUwRJRnuroh;J^%ckjDZ|9a|V}Rhu
zCfztQnC*5u^m^2jPB5w+w3_@i<BgYMPO;EoT;jsG^jW`e-=X<2R!Osc$c;Y>s<fL#
z`q+*Nk=|FETUa(?TV>nw%{~oVzo}rYX1e-bg;C>_?vcnSpnk%ZP{C_SSHg1)xjubi
zyiwc((*y5Io|mmA+Z*ht=#SlkjC<dElKK+Q+UQ+0J@BXRb${C=IJ-q9hP8)bC>VA=
zX4|`7X?mu$E4lVO<_Jvn0d5Oh%BDnyP1b=b1DDg2qsKHs=ZP=l5+lzadut|YtyZu3
z4EUx8^(0}=*)B`7AA8xE#Vo*$5-gh;nZ9t&_R+)5xn;KmYd1xCmh@3vSU7=scxUwz
zu&PX<TEAsmOyN;sOSQ8?IM8RXB6oS7h&jJnwcO7${lRlf_zc4VJzi@t`d5DNnuDU!
z6JZlF_a5px2090dD6PzPS$`gh1#99RbvUyE-avJ6niNx}p8Y)<mTmzFM;Z*J=$dRq
z%HWmpg;SI-%n5ySZG(WcFaJuKbLryCOYPpi;`GLnhv5q^f_`>36ziPX%c;5%k6nN#
zps@ub!+5YU&CQHK<a+VF2=7GF&)hI|W#NqcirlKfMxfiUYjeO^vAEV}qQr4&%bx{?
zDW5uBJ#P5A7Hs=-!_VzUBeW?8n*=`c$#PO`kX$mwe9M5V*swE!6{@TfOuW3l_|CuI
zmes>?pj4sQCUG2Lv+U{lv8q<kA`T7lOyb$(>oh1Hrf~e~+GIGM7jI)*5iOqCqeaRo
z&>k~zr&K;Y2K|)U=&h~JFhySwxcv4Q$DIG011lTd?9kv~k03&tV@`^U`l!I{84)t`
zY84Pzt<(3-;a4p^a8PIX`22wTlZ5CH+{7~Mn&%9ijV^@QQq(S9iTjRhmh~|eSt<+T
zoiRP(`7PimRtT;dw>3t7WUb#w`fuPE|0w%Dxggy?11_l3yU%XR43iA3;m~EtG_)Lj
z8c7aj7C(6Da(0eb_WnYWI^ny`2Yg+J1=XeBuY7=4nhETaQt#}Y__%n4#mrL1@%WyL
zlxYFS)rpEea>*~N@HhiP*lEYIDpW~0PCZP8iB^^7tXzf^GroeBU__E4x<m)-6&GYS
z|JG1xhkGD5tlx8;f@7|c5($|ZEH3(5X$YBl1p{qyd_MP)GZ&+u6c9UmkiUXFF=}K9
ziZ{7SCsn};Hc++jsv7_N0L;>+j)@_>jTsS9VKibXMD<Y<^U&&%qWn8rSD4`}giA}_
zGyjQxr6mMY%jz}j7K>f02iWw814tuNw3{}qmOUs873C8DqTV(x3=Mx@+AKO(Ap3W3
z-oKu*{z>`4o{?TuYZEsA3kmL_?=4h(L~wanVgH}_Jkp5=4pgKj!T%txV#35Y65#)%
z-syjH{Qh5cQUnmf*MA7|uw&W4KXg7=EB;@uh<`$i;C<x6{=1O;-zz{EDeUD6#y^@5
z{@w@ve+S)zxrc61Xx|p%jH*-vV76T?SjaFY=II0m5oKL9_A$5L{}HPi8EUXs@OqSr
zGOMwHz?L^szc(}%HQZWMwukDB<NzzLL;Vu935?A-qb=!Rm->pl)ErW9%3>+CnD3`i
zxBi+^$W#hF{?v=o_Yd+e?0dmPqRW;S{!a?$buSZwy&VCs*W>fAHJ=zETUq+MNDWQK
z_*)j&k~|?94w2FY5-`&YneQ-U_zdB((tg~Iyfr;&4@jydkg%}<D{R)mHY|Z>jzGOK
z^y7Zcs6jHIeQThnF^y8(m!R*}+qM@5F9-OcP$@K?`1qB;9og+lyDi{QawDp}pk}b^
zdE|PeG2zR1KBOaTiDvTBN#4$of-{vcn{Strr3<*B+F0-fZ>H@2HhuhGFjN7Mr|R~O
zZ9Na4VJ)ZC^U-$y+K6<nR2>zql~Wn{KZ6^05%h5-8>G_KVg?Xa5Hl-bN{Z)OIYx_|
z*Uk;?TvRR&y&E3S%)c%=nqiXu)XSg4D-|}gC=gEjy}pIfKQ<SMoYy6%AthJj=LoEK
zVc{oZR1@V$MY$}YL>lc6`x^5%2F_AKEmAyE?Fm<h`QD9Q%U#L2az96>NsgrYgrRy`
ztUZTdw>Nf;O+z!+G)X_R+w7Ju+Tx;q<OC1;<vL!-gpSFdjHV^#y0_O4rxd78^0g}`
zYN<vD3Kp!J-^;taTA_(&3*k<umCz{^Xw+qmy3T+xktJZ~;p{bOA!N8^E)spyu6$>;
z(qPwnR#P^+fwvMY+tRD5L0`aH1M@O7SDjUf2qP{8xsiMNwp(St@=y;bDyDHeZi%H1
zwu<JI<7{IL`9&*_-pAa<sUD=8hrvy<zUDqJbI`e^w8$0Ux4Q{4kniJH=2_87OI($P
zo&~RIJN;BeZtWAX7tRUMJtx$nlIBhy-5A)md7R5oUo$C<$~Vr)4n<7emuvP!-oWfz
zEpjKBrpAYL$R(T*l9CmCDk<C$s^zk;*=>=$p_q?!9jw@JWlHb*R9^jdt<IGq!QxaB
ztKYQD0ZWH1@<QIm!L|})pI(LvttQ<PqhD8k@AqmtB{%9kK|5aYovrO5MmYFO@Y`ia
zWu4=^lsoyuwNn%Nl%i)xhYY2>Hx)JcB((u+jH~3yEh<TzMZ<4MpuF>hPSwY+W9L7Y
zy_woAX(BDgDi6xFSD&oJrc2o`6#k?W0b~_Nc+}1vS)d-$))k6Zmv#Ng`Pr3^)J16e
zC&{8*gc2-&`d_3=fAY-#M!IB=ydc8<3is1#lAty9({ARo=AA`BMFp()52wZLvSdRg
z_0JCU&2F<CthHhi<uL_TXX37dgof=Z*Bn@zt7+6?*9p=mX&Eff>m->iQ$3%b3v0Ll
z;Mpc7Y`unQpvf3rM43;d?T@9r;Znn$Bh?&?^wFSOv!PJP8N_qUyyG>-!85<tf+3AI
z<!lZsC&|KrBnVH&S$K0(D7KL*0FIaaTLUhS?l=_Xe$6$Um)I|!Y*zmwnC)aGGu80k
zRU|E4gi=i27zQ`wXQx^wYR~8Km>DIWOh}iKn}3VPVw>r&^vDF!^>0&~3bJ(P@cxbJ
zakp!I;(81RK#{`5QDKNcLASAoZ8}k03>G}3lCW;@GOun}HXm8sFzY*N=n`==pOmM)
z2lVir(CY%-h=rUv6Xa@oI&?E9_&fqXBurLrd(aFNXO`?sJrhn-|Lzo)t9$ppg3Uy(
zo!o~+7F+-NEM!N}4%Woa8(+7+`$(oC-21AvZO>=L<L*t{QDKnnc@%`L>D7n(?anDX
zyt)ISKz_omlg;gR$tX4y!=VQR7o6$W5xj%n3^}g5$QFzheV;mXcg8n(r|KwoIL8np
z%`0dGiX-N)vO)IkXTCr%bO3$^YhmrF0dcfZNTt^RF{019h`fz3cKZm@x@uNz-JS|s
zFdWOX<g2wsDwVn@@PeUzOv8=KuHQ4EWvF6>XnJ}f(69>XFY^gvY@R+Is9fAUaAI(!
zhReIdN6W{2mckq1>_#Kv0j=7+9s1HhIawMw34K5oa=Qu)=^|Wo)9^Ku`Ccq{$IJWr
zMYEA0NaL8Tc!-i1Xh-5?Js%ok)T=R*4pJfcJo?VYb?IX`&#c%eWqZMW9uY=qA!rGr
z6wfZ}E3ce%k5@_L)M@o#bko=NL4`65ToS&uZ3?S%;2BW{iy~dtGBJ^wOL_%lE*we8
zt;?Efu^svfp{a|`j}24}(a1gX6eO%39c_Zi8}XdQzR;m<mi^qTn*XuthX0cunqyrt
znt$J<?u`(hT8BTog#Jlk^JDc~Ts?g)Mh422K}juKTNcN|MKv3Hw++CEtu=VHh)~tI
zC{KeC`mkKBytq;yf8>aNaVWFxy^MemP7j*v6%1zZDai*i&rI(gO1EuCVyZBJ#M>)Q
z=8Uz~u`kFh0!_`WsOjs{&y*Sg+q+hY9A5r#^ut<ybA}citLROcBG06Egp-x~$^su<
z7wBON5XnDi+B!m52b|bHg#j=R&F&t_!O#Kxt5(LIOY>QFP{)ghlOU12XLsSQ3?cV1
zs5I5gU(1HSs0T84gfJXFbpG`B-G?M>a^E%Di!5FPzCcWhQ2j2cu~9c-4hzQ8S=a11
zI(ZEk_6z{6)U~PM@ZTLu{k5OuW9drii^QXrWDg*BE&j~-u_BsLS`M<?v%%rD`#EnC
z#dTS$q4G6$U*Q-1JvZl9W9Au4r82U;8EAly3oV~ut%wp3t0YUKutVN=pMB-~&O9pg
zQ+8j3FH?k)3S?e;d42u_zkM4E%Hk!uUf0SeQ5Rm0BM9O)+DfXT#`*T}WsHH^3?kfy
zqlcLsI!P&EQj%YHHe{nfAIS_38lTwzMeiDOb<64%5V~ljO4J^0<e^!h=@ABRt>2Ol
zCu!x)T>BaCAXt#t(8zy$5UBL)aJx>eO=3QRf>@sea~pmy|1l%=quE-W2gVS^)jEgg
zkL}02M#W3hVm_Y1S9%fiF!W3Xagjo3PXb3T3^<K8jyBEMZ}H(UjJK%YT532<(iGV}
z>6Dlpuoi2S<a!0HfB~1Z^bdRoT@*xns*5iJrlOelq}H@dw-UcatBZfVZPYK{WtUr_
z3OCpla6)ymMj>x>A={^)Gn^770u;2yl-sU1VzSq2_>;l)FnTCl!+nZV4iO(UPqJG7
z{y1y@Nou3lUDrDfG+Hf2bxwgQZ<csfwN+W+bs(c`6q>9s3P3Z0ln<MV*-HMbsY$!e
z+0xt&TqG3FT=IuQHUw{c@u_Kd7D9818C1KVdiPRmv>+>GV52op%Z|y$-j6m=kW%vN
zI_%vFc1@BP21fQOBx0zJn`cB=dyWT!C*47uHhc-0o-iOj{$)s|hEOkZY~39VOB)`4
z$n-DyQc))h9&I(nz@-}eVA<^RH`bfg0E^nnt{fo_#@sW3M8ET@)0}$g*SB@tnjt70
zQ&Pgcmv%x_!L_7qbpWXQY^TAm*ThL0ofC_D6h=nuIroN3l_tMWncpQQ&xK2&5E=##
zzg)bkNW9wKBH1W-sF!YXBHXyZtUQ24l7IY~q07@BE&arvyb)dqFnS0;Ja*PeT>2iQ
zwcXX>@@~YPTbi?v>LpLKT5zn&fj;jb()f7%ugIU0PQVC72jQdRFL1Gy3#<57%JYSd
zz*-845P3%GxpG6u_BrRu>$zzpm54yYD<8%d>HHN=GxgpjvLvH-#JRjEIX|w&w`_m8
z27tTvL00VOyuQ*8+(s=hQ6dHWfA-V-cQ~wbjt?X2>+3i;IAf=K&l+y`q?ps2jKyXh
z`}Guke66NppEchM>}v^Pwa8jVa5FM9zyI(7tz>^8%axQMxbBXrCF?pYbZ~s^sbHhw
z&m;TMYqDP0Z+I{)KOgFNLA9dtcgpWA|5wzKZ<8&rZmxx5VL(_X!X$U$&v<F{cy+)i
zd@v_>*HCSr&Dj_UxyVhV;k{zV?m8`?FxKN!>VB1sQsE!I;n(WCF^+hUmcf-1)vGE#
z$G?+)hO9&uM0_dX-H`i$2|IIBS634BEAgaAkuX&zl|5bx>miwLWc!kRSlj9d-MV88
zs;q2>ebrix!>c<5exJOdS(5?|Q`S=dmANu@GSCb6Ak8FBd&(`=dH<z-b;!IpRj#uM
zs?!Zccx_d;U1HkE=0;1Y(D@Z*IQT21JQlH;<C>&SGf98lci~sTb!vXyr^lYl6aEHb
zgae+=3Yf=fK}%05A~@BGugMmla5UL38rkz?Kf`YgJcE?Ts~A*yX|afE9iN~&Tdlp-
z+7U2k1WvNWi3T`Lyxa99MWk4Gfi5Pd5s@6w$VmiRez=5ISz-1Phj)}BP?P$4zTok^
zV0Y|s)fR3bE$EUme6A(uQl05?Ttg&I9qEij*tYQySwS#U*f=>lw>keMPJ*7=YiAp+
z@iUqYSFzuP7LAIk0`0o<6`3K_8tVg6YkBU*w9KfD-LwP7zVXYTU37Nic_6b!9ho4J
zV$X}N${5i3I~T%(!o+$|(xo;Z3Rh0RQ97xqsU3lpb#mmI3e3iGLPw)eCgEL;)Nod$
z7GrMO$Txl6`7CUtm1@wxTW$<CHyt{o()IDnN26!qhbc-%R(F;s)5+&N;ib}nxCFC-
z$R+JS9#nfN4gJ$)jkr$~$FM_S&CY-&Fn3yb7@*D3q4eGu>{`0Qg1dcgR=w=Rim*Mm
zJiqPA$KlRJU+N_0MjB!G1&wv6I&gEyF!*Dh*C(O9mP?LGjWrPFJqtBs;j>++??dI(
z3=ZdYV0N&7;yLWWQM{aklBjQH6g8|KHr_E<yXh-Gp-q7sOtMt~&ZtA^yGqYLUFD#5
z!WC2mJs%08zATR)`01h+iPEgrDZPSP=MXiL^0D3Ao)<J3N&udn>}v5Fhg~1c$lfcc
zD;?41RC%bXF4_rcv_q5@X*39h$+wK)Z^6nJ7*6M3xLN`*M+Qvayt1!K5`tt%4!-}y
z>S@B*ajLmBmT8aN$U<>kPqaFgmwmGd_4}1O8lGOvOl;VG1lPLc<FaI1M7>FW@O+(k
zGhjlaR;Cw)xu0m5vu1tD>uv1+Q-&_MsR2jidG@*U$EWH_qb1~0tyY{mPxsZt$L$S$
zNinH6am#U?j^nQ|NWI}3*;cZCT>~WND*UC4bN@Wni|;R%SaG8~U!a_iYuNLP;Z0gQ
zhPVWQM)^}|La1j~(lP@KIS<%7zaoz;%1X(sy`3VgeNEdz)Vwv^5t@$uLq4bDokn7M
zKyG9pSjT}7ZPz;AFoGY6uf7}4vy^acK9{J-^ArzB{|Wle7=V0H3DKP`#YS|0ZuLF(
z0kwY+d>kG=Y4Hz1hyY(`@aZZ&%CmimCRp_$h&^Nnt-cPQBX}D3T~fV6Cb^F4vim`@
zb$BBFMNN?Or8$n96PqOVeo)&+oeU=w_)~}Uns|Xhp>GeNO}fw{<~@;Ghi4y6Qj%O(
zOmZ&htB}-BP`wJ-OAoe=xIHZozE={!eXXfTE-Gw`G_wG>)*yrB?6GTOa6a8Sok{77
zmwrnegWVYD*g>?z#{#|KV|_dP#<+xfVS5kiMMJDUE5%)~vn)E+ruO$j^?sX;2(ZuJ
zEiugHV;Oi{7r;&`fXe{X%?dr6F8I7!S&iRIf-PZ<caT0SA`0H^a>tL?ioYR;C3_8a
zk}w-K)B{V>)PJF4bruv~5kvK;evX(XLkdRuE;SvZ*c>`+TG9Ay_|Y174~u@~t>8Z6
zkZW+EqpPim<Atz{;;9!BtzCq3B(?RDxlUy?jcixnrqocI9Dme+QoWx#p9Kt5e2Sh4
ztg1-_WZ6}!iETQ)tV0;NRm}$0V&=aoLrlMKA;!M8_PvFrN?qQ;(E&OyRgF{nxaB6u
zd`{6vY4~y|38uClR{Nkl5ngPVgd1DAW~!Ao#<N}KD_@AQx%)y};aslb?h=%v{Iyt<
zER0^@2jK_PpO)aV;xg<Gmj+!YG!g?lk>6qkQPXBe{H~=yg4o)8X+^{*OqVp7dK=@h
zdRw-^PW&|>UMlB@VyAZUye~s}eWjf*Kk@~I!nIyFEQ9gi1G>-eUmcvC*_oobe!_i(
zyB(R31vb}V2;E0^mQ6`c^=0}&ys^9Ynv*Gxo%5n_4rcj}z&8gXr?Ht&_)i;&tsHg`
z+#6xGyp)~i<D}S~^ZqE9eD+HAVT<=UOz-I|vAbetTW>AX>jCY_X$tOl{{#Q^71P7r
z_7)$(XP>JfcjC!Gco-Q$)U`zCuX+sYt{{e8!It6qGu99PX%Tnd+y&>2DL<NckaJ6)
z$n3YRbw~g@w8lbcrgSmfFOhPRs<2KWT6O!UoEP$Tt035;AI`;JU1pPqpq^%9T<l<>
zhUBOEVV~tQ%`4%Mp55Vl+rf53N5I!%fL+h0Y`&(o*GGYBA8Cea;$~j2cH3Gk?XwAW
zmEHOJJPnU_O%J=<T%2*LPBb=opLTHeT1vOL!wuGH_il6>O%uUst9y}9rU?hfqj>yC
zzi&F9+banNx}@{@V!oZ#pWa*Iv*mzK-o15!wMIHwoFnqba&72cbG^K;KY~caaGARD
zPxoySA}{p?vJ|e8%`zj6uD>vTXtBo+@p?Ekhc=o~%#;__0pEyCMW|@hJrb^G{>%wJ
zC!X4zrXJtGa<a@i%{|p?-zBzk+02On@b7MES}fZkQ->TXe`l2eqnE6?TkzIVxxTnN
zc+C=F#9t~i7|=W^W1%rHYeN>P6C&njfdw2P?+x{A`!(Ptd*~IQdVCLU+aYf0GS6dN
z2O1HaD%!a18(9bvMOAh3{=&q9?CLaw?RH@|$xZ*}wmFv%@N<l)4)l2Y3ML1noS~~u
z4peFssN$?Lw4<u$LpJiF@R1gCK1+!zN^~r^#?*z_vTL>tHI}Jdgg<A}I}Zg%qvKC7
zj1!JJLeN88KDd%GT5okNXw+|#KjdoVe>Y@?V)A36wtBqW#{zcP$56jvCzXBI`b@(_
zY0P`nG4O4{W?k~-JJC*Ck4K)gW<5q0r0rkpu1`@mpkdsGpsA0XOM5SjwIwk<*-zVk
zhY!mZ>B#cxU!#e1_j1WP76I-s&5F}}zXxf&^P(PcRr{z%e`3qpJhngp3yAcRMB$n8
zdpH_kSsg3|eslMTzIuqSX}K4J6mSe#_r;peRyvX_We)P_%QKKwI`!B#G!@ctCi}M<
z7JTvT0ag<f3wuFZt=_6J&j(v-l|w}G@V+Upf+LgnBDcZjDkV5>n@lqkm%5cED3N?Z
zqS_v0C2uO2V7Ww*TH^ABD;PY$<o6{19^?AMkn=Y)Zc4qj0G+ox4?Sd+w)dX?NT0LA
z=d&Z}btOb~$zy#|?<4hxMM=B93ECVOz$=UHK(i4v+8A&&0dYXijO}M)DK)B&2$XM(
zi5c~3mn^q4@)lZ-$Z)upMaqcH=3oDacFcXgHVVSXQ*be`tj%T$E^2MsN+D?b_ixbd
zME(s-VNC5=&dJ5)pO`pX|1{(@p6f}x*!Pm5O9pgK39^V1ws8oJ_HW><C0JeUhPxrU
z7y31Ap)gJh^*S{V&w7>;(fIwCAaeY5O{NH?t~4dor~T%QaJJXuDpgxAz2co=o(c?5
zEXA-!q$d}^@L8L}36I{hZ(S*?eEaQRF-R3f?-vlY9a6mMk3Zy=I_@OUIlPbXnA2vF
z?6(Y0eWZRdRJya3Tsubygf@J?uG@^EUGbGA;-U#QKYO~;hS!MmW{_U2vbS;VF&oNk
zB}U(3-i3Fweo|`)<jL{@+;>T@3B<sVPSM@X;<RozQm5`vl+^b3j93@FRhkR7gB2;|
zC`x!w#9G^B5Q(UFyNz~{q~*Gl<(?r8FKWfTnE{jS_dGgOX#Evc@`)J#7nZnlOBP&f
zE33euAe8Wki2P9(k^8w(ut86#wY5_-5AMAYA1F*pAjB5a3I@Z$#k&77k>zD~hdE(o
z-Ag2LYyQwxao;f}P30Fv+_gMGsrRt&-D#s|QwW+Bu?^fEeMWk|Yj4dm{)$Lz&<&&Q
zvUxw!5o$+Co%vDR?1^}Xdf&?H5fhU_pkpt@+8)>*ez&6-KDNd=b563I+ZatCYOu6M
zq|{pmJ1_fis6^4UNeZc#|0!WC!9th>Z6yDz+J|veK<R|KGufQ~PY2EBv$=0sL10uY
zj%-D>u8J^|IwyAftdA1Rw)mF>=>IkHxH8QNB_JS35_0ExdOCil%=9=z3&bGt4Z@~k
z!tIa$tGrU2`k#=J|C_^~tT!V~qJQa!F#ZD$_+N^%u)y5EOQCLK<NiL#!cMb(@uJOD
zM*M^7=3t_YvvXgbOe_v1<+82n-v<eRkN<xnC%sW2Gu*9SkEDl(hZGfmR-e0yoG|=k
zgz{%_we{Qi+vBjUkE@uE@|LXl?G<P!0vnc-^W5-Fp0u#4RZhn8c8AHtC`FBumfq*d
zq%(6&SF6=5>ncMk7#>oTaXRIdGFcG?`K9)}^%uY-jdVi04nz$pZsXU^<wMHX<fzl-
zWlJu~6%Futkp~u`l&cwfk@iuu(G#qpgXw3$fZ4Yq%M`B3n;AP28rU+a>fs*8V!62~
ze(&cbv`rTE|20$Vp@-C5T8feBbys|G`@=84r@PysCHK!H^!@@P=UU*Qn2H!Bu#Vra
zz*fle0r3sZhWrT!F5k8BVz)%TzOF3KaysMDc|zGXScOKMD7u7Pg_idwAcl1FOkc8F
z1Y&hHrMezVs6VGuze(s)UXu26a@<fZ1>$^%Clx9G$z4I5I2+yv)-3!H_oNmhvaDSC
zjt7y<h`AGOlqSXwPc&Ma6EH~Que^jdd-_rzWy|me)jjRX`aQZ#wo=h1?1T(vsP9}z
zN)Jp|lVq<HiDck+V3980pNs`BcjM#|x@Rk~bT4JUnZ{F9&_{>Au7Dh1>i)`~t(8%%
z^uA&uZ%GI-!vbD$z{o|3LCdfl)#F&9o;L<LA2=4y4_P0Isv@W1hFghtSd?qmP62x+
z4VsDVMAPjUHsaL7r;dvsx+#`$Q|rUd4-x*%_J6vyeu+1|{g>N3tjp~Ov$+`KY&eVw
z;gM+!=I7?-hV=KNJs&?mitJYBG&b_<o-Akmo$6$WX%mFd@0NtLp|}g#GxKNC9}+y4
z4P#VyY{$JG5+v;}mj4yy<r`#09US>noFYtD27iJkqx0D6b<42?^{HuXjkjYgV0@~a
zs5ZEHBa|Rlj@@jAa<SzvL!eVkf&kzykQ$itYC0`y&)`Gp2&3qYA1VOAEqzaaURhED
z1bY4WURo-dha$BKHyf)I8n?=acteoYR7BZN&2h5M<08U<<`zLHpa`X6;Yw%`_p*TZ
z@KE`Yc`rF1Df_64-tQ!@#z6xVI~hx#Pn_@{x-VoO`9++nbIy&J`a88;O5!7K4i&OW
zsxJ<4+?)8>5{}6wjXOMkeGb&KQE@ahZ8s%mk7LBnSz27pWVU=ZMHl*%Ye;0%ny*A%
zFLC`UyVc6ZQ)`Z`<%jtV;v3}OS#f~a>-%!)x8JuR^2DZ~kbL)}G3f7H=61AxxKF64
zuw%GKd8?f`i#^4UtPe}H(P?Kf1CyV?vU=3(zuqM!39KsH&<<qgQGf4!TuUbg%9=&r
zRlJ#*Se|U;c3CGvuvQ;%79@@W7GsmJ6${6Fjxos~sQAbxmgmm5o-vhu!5_gHv4AkE
z<d004orailJv#GhuK?I|EV|C9i1Xliu9OfTfRJkm5;}T?CqqaF8F2|@QB$+gSi5fn
zox2ABP|zAtov;H6&DkG3>^>zug?4B5O0dkjsw#SMTUl#Fx-NKpdcR(tf>wCOdA`bJ
z&oq;!AjX}pl6Z}$>Em$RAo-f360_E!Rpf_xEl8v-ilb|o!`PhoV}p(vf1y)tL4o1u
z!6&fJc0ebF8G5Fe^04Df!7R-<19=87{Hm=W;ptlKgaseUdv}HjE@6jKU?r;lwcna8
z?GG=#3|gV=&oIuYMKO}#!3`5er5;>;79p3@OP(bZRpZ@B1OH`Lj8St3#j{%(OTa~(
zlvs|d$U(}KWF9gwn+Hke(9YS@w>!zmRM9M+t37{Z#jSfO;(NRL8=VEFrV(75cGB-C
z*OSqYY4f6vu)4&5h+lCk{;jOD?bx?0xum27{IwrXrq26egUayn?s9_Tugd?&J41z)
zCQ!9S)z0a}YM_f^IA>kYz@Vm!rWDoC?alG)_$A0-*1lmY`|u26AiWBBbBNa8jbZin
zoW|u?19c-ixAHa#1)j2Jqtg1tNNKw4t<id%ab=CXnu;w#hOkXv3I{zg=k@C&*Kb*`
zpSk-xIS-OSKANzqe}}B0j8W?DvG^x2nNjMT!F`0B%#^0uIjr{I)MJBDpAm&WD~9v?
zo?P?IoQ>}9V0}N7F1tM^ZAVP02F2G36%O6sskbzoS){%kvFyd-z_QL@1T40WF*Gfl
zA4MsUguBcu45=-s!C#fHMnu|h!1he^Qj&>vD7EUWQ$76jne%`i?&*v3Lri^cb8PKn
z3EG2C%q<mZT^?^a<+Pm;OaZZrvjtU>E|$suJ_r|}4KNmww%7^un1j_S#gDp`1-$kZ
zzQpArbnoQ%5esuQr%#swgNw_ziJMl5e`<>+FnILtONI<?C{`lJ1JyKKPvAOzLzO-p
zvZ2}Zs8)|dVK9z)<J9YJt6`b0Bbi)wS9O3{v5>$hs2W72gVm+qrO)Za5}A1|_Cpb4
zG0NK4_8B*+at$~11|5GuD^o8->t~<XiUXxWgFj8TAR#rjsIAwecKFV>&<JDvPm;d<
zmQ0bTohjp8<JMW2Tb6c#_3F%&OAUeFawFKsY!Dt~a9kDlde?cx)0Z#@eI%1wmyvX_
zH&)#rk$HwwP-7ut`kZUwY7iqI)|XB}xgls4##Fuw=_dZd;Q_OA8#XnS-M{6Jq-D43
zRCL&MsgEY$pbO;z#xAinytQB2TyI^o>(M2X1=sV`DZaR1pNwszp1JsL_aDYd(a)H{
zn0+0HLY_(Ua$UZ+gOx5v@0e4X$-|6ByEK|llj?ghW%}7<CR}-7Go3eLaDI+>D${G_
zdNCkViW%O@4YXbQiP(f43*|T==2h&kn5l$5anLZMJqCA15bZWR&JHd@1^PBepAny=
z92B|Ygog_jO@)V)XK%34(16EhFw_ir*C#Gf5nX#b`{qc(B<DNbW+b{9T4KbTh3iRt
zP<X~X*-7`YT_Ml981Rd<w(cuxN!Vl<3q9CBV*5oE9P_`fu4<TLke5e|S7WblT}mS^
zUG-*=(2h%4!(%NnWnVd?^8dk1{Jo2D_6Za>|HlDcFN#6ge|9sUd&_{iRm{wo3gnV$
zBmmE|-jC|!d^Yc4GW)+*78bi&uPhR_|LTSzsqRzg{Vg-e@$Eo*2b&5GKNZa;4M-77
zQ2;uE^f4MY;wGFnXA@dT;T=>q%k)aqqy|5r6oSm(AwJ$;i?w@sju%=}g|uDRS7Zq3
z|878!Qu*!_)7^9+N1kke*5~LPEuYh+hdh->=j{*D>rurwEVY%1HLBGNTp0Mc3iPIt
z>&uiNO&{fK@Mw9%3qxuamtX#6C(7SwdcPft*j!eF22ps+@ym_7#UOQ@UZ%OEjGxk&
zeWY8J+fRPuqUtq~LKwZFO{Vb9Y&+YXS-4DlTkA>B3qxkXSl<FOflR~&`z~<}d8nT>
zUM>%zgPE9)lUkp~k{Ff@)2Q2Q9=-mx3+c~8;a}Tr%F8n?*GQ>}!RL<s|8x^oil+_a
zzk6p*<rA?hryXI@wO>Mrc%TOtW-E09IOh%lY|{EX6_HrPqVZ8d7hyj=!dBWloL|Ro
zyISe~R!EU~lR<{XCB{c;cG1S*7>#_sk;>j8DAzd?l2n%t2=5M6fB8!4#xS{-PA&c8
zd;a>M0gEiJf@P;pjV@chO&z)r7tJDG7`N7-O(n-{OG79(Ju{4U!%{!j5jpiMTj2`^
zhGhNKEVv!T*?@{@M7>-uy^X<)E2y^++2^UNEsUnV89CqO15Rn_0(bv`skEhXh0yMI
zVzNVXls?L=db4!vQJ*=X)%AhdNq3sDmtSCbqhTwlf_jvM$XdvaBNq>#FhT-wON8C&
z^@Eo6PVJ*X#TUwvN7KOB0#h(}1>+gf%=!bj6^pHZ<1MRyzOr7mOcOubpt-WZm7s>f
zz@EGGwp}r+Jj7}}`J~3I!7|Oi4Z*|$`68EN&32bK^~rN=fB!?0dtA99eSG4FjSMj=
zE5nyKUbE;5f(mQDGH5k`GgxBxFvjhYzBn-VbO-0aGZz-kx@WE0(XF75HacaE!024W
zRnutVrOXFrz&v2le`u6TNdKNWwEbKHGB3EfaoO43)jxn%7L^xZ6aT&LlZtCwpj+oS
zA~v`1BOscjo4c<|2zLGxYf7Wz|B4HUev57sn4U}rLs3H(2v;pBP6AyP-lv<<rR-2)
zy`q=N{Q{ODm1$W<tK*=zYzfnjA<6Ku%x_1Z!)7y_uz7pXQv5%iL=OE(g7I`Q3$lH%
zL~5lEl6%*&4EXIl?r{|gz1z7BXANnYDm}WB7RwKZ%@+qjBnE?rSP<519u|9lpCvCK
zi<=n9XT!6CjNaU269nDy6?5IYVNPfaD2f3xq8bqofNCc50W|^8grwFb^}BaD?hwiV
zgzIH*<kZAGsZ0%o)LoR*lOxQby5s<R;e6%xX}ia9Uy89C1+dJK74tZbMM?8Jo)`8*
z^6a*`WCl4Of21n~w!{&>>J#q$I7w{-rNKFfJ!Q;wn}SR!>qNzZq7o5P`^toc@qUt*
zvRk>M4m9c#THMvs3E`SsGB;_`C{!hC1%`2!>2JD_+p6;JxY_*>*y8qP&EB8?xIu@+
zJy`C$zs1j<?Ae44iR`q)Cu0^kdo?{}grxx69<cm%;v<k*QBdhJ9@!_w(_wG|TnsUZ
zX?u{iZ~iWGHv_d5Qmh?H%}+k#`TA<L`{EOr-0=nO=<fWhy7lp^TXt@p7xll?OTMkd
zC1%pHg`jqd(y9zC9R!gJ^X`j5%H=D9`s#Lxx$HPSau-emd-LM=w%?l^ItZ<dJx=R(
zd{ZXN0QOOqEJPkNWWwi3#;v-_;g@9Q>(~2H$dwk!zk}4JdZHwISOtL+#m64AQJt>;
zLyiG6C;z)v%k#e1|Dee9rL`@*Hoo}K!u6AK6RD#6_&MVTqTm)BIWq>w#+1FxQQpSI
zaTq%`b0v?DPc{d}C8oZ~d*YNalqZRX0~KH7yZ0j#P*o+L1+4;5M;1)cXh3ZhFr8I)
zMrTk#*;}+G#_r%RjBybG5;kKZWYG-da8rXi35mh-HbRZdiL3AXt`>)3$r1zYG;ZWO
zT1Dyrz<VLTrKEF2bBu^p@D}bzZxo1^1BmA?YWcfV`iGGn7gxcIMPOtI;T^H?;`ck#
z7lzHd8tnE=a#F<llVy>wja4P>_1_#FYNM)%i4mW=NGEmtg2G3pE=J3U7JZ>vesRrh
zs4w7#(#ctjRSPmM*ywOE<SVrk<3Z<%Uyv?1ta1Y0VUh>y-wm!&&dTMegv$QxHTX3Y
z>rz7Un|Xk0u#YU~`uiF&e@OR_?)>7U-^ssgDvPiv7Z}zCmkD9`4&-kh3VqeH0_aY2
zvi=m>s6wru_$Enyha)w=oFz;WvmSCI6^sYXZob+W2(=~V(5AYhxDJXA;UAI<=dge|
z(qKId7<jPSa@QmH*A($!+ByJ|kl?4{t!zaexCD;oJNo>FVuMGOuGg?)!(=CF%#SkB
z)FcuOJ;AWVN0?bM^Sx*xh(RAAp5Lgy`L!_+K|A#no|k7NC_4jgshQ$1$G!Lc3T0Tm
zJFVaEij3ZfOx)3H#~z14628YQ3~tr-FJN=@mGyoSJpBdC6IrDt!DX$4jtLiX1=r~u
zpS?Y0u$T-O1sk?zr4`s$*B8GIhr1|KTMgx%?wd%K-^h4IPQI=%EWwPZpnNP>(nUa+
zK2Ce|9Sl}<n?5Dysby)#rS7Zil*_!6{AR1`dABsdTh$ZessGD(ZF9S(dS3c>Vov6?
zK?8CONcP=`p-Mo|J#U9XW^cks?7W1bVUcy<o52d&3@^4kx^>N3mj-hLSe+r;UHNlV
zbTpb=_^>{o1^Wey6HOAJDDdcTKF;BwiZf`lX5k&g%b&zg4h&K+g-M8i{NqOb-?=Kh
znS4F34m5YGx7fUIWwje@;36U}d{qAK6~@jxRs*-oN;~LItdPXp3@jUR&_!<^mLw%I
z*E+~$M13nxA6NyJZ5~ISm%dFL?pxR~&OqDpC?g=<KI52kov3mxPegnW3Mpt>Xef*4
zN&_TlKkY}(Ia;0^(2e?@+b?Ku1x1hSK1Mp3)Lqg&%RLXAm)uiFpkD{+wzm&_-^;qP
zU-=BTh8jt((B}%AK0FR*RM?o6JY0WR<XML48wNI5R${`wwWpue{and?ciWP9+XxeQ
zyy|6b4pqfVA@qvsPCmDPCOL9fx5>=UUr?o7L6>JPONSfY;hr6Q{7Rxu#UK-3H=6VC
zpi7oMSY0KrjZ9Hd2;6&boK}%MpGP8*Hk#P>b=3o?RaWr*UUGBXz09NC_R)h4FJ-~u
zlnA>;Tc<{zX!ea|;<T+UZR^%{hM;k=jDTy1=iOy4*cloHhWT$!w@A*bvILWWc1YUK
zBJRd;MBmPOZTAn#&!?)Jn+ec+y6FjUFu+IzID#BF&CT}*z-F@iJX|GQxcvKT@2w?I
zTTNtf#p8-);PowK^ZCe-;BoW*(fv}g^Og};KUdy;;#{Nt{eV*Wx1wc}fj*eKY|yh9
zPr?zLy=7{Isopu?70DSmf<_x7Q_O(Be*tbeaLJjwHFlh^??E)q1i9wy0zZoNPg>*}
z7H)*(S(aLG-B<c%6lTh3N3(@ujvH5?+@Ja)e)(t^rNY3LYcFpZ?>3dc{ZYCqpGwr^
zx!4piC<>ldirp@KjVOqq3J~D*2N}b~Y!0msaQiWgW%_;P=WMVWUPY}Hc+RJ^s4Ks!
zg>|=?jJ<xiTCiqREyBUT#I)TWq4<V{OCuh9bGklDaFB_IhY-_gEVz|pd|zNPlSB8V
zZs@yF#F){Plgkg{Q!nzH+1HIjsIG_RtW0)gSor5r*sS^&-xW+I>|PTdxP-orDQ7el
z44MBat*ya>B~Qw`nMoG1WwKaAJ5-P!NQM9Dv(E^VT*9;x!7j$9_&qisU0KH|q*Pf_
zh+4<jr_0MpFlimJx{OQ9^L&I1zWT;pZi8Z1Z+usmh@iMOMWnPhA)X0IhPJUZX~+{i
zG<<FM_Z??Z=tUx|{)woC$?ZDwQWVVjUOtag6xE6FwdM#$xi+T@{3E|~0;k{GS&T@f
zpXYj%G*4T@WTo1T$|-;doglTcF9a~Jv6!4(_`4uf*ibw?i=kd&qou3S2W0wbUFijW
z<)>{hV9BMQ2IkSV2TyUueEm!#T}L9<#2MI~#4xJq^Yzx4z=Fi-xq7|QO_7%xQIG`)
zdnf<t@=S>f(Ei)Yvrc)SXnVQ$*)*rd7YY62ENuE6t6Skxi~0vY>!CsjA7Bb3PT#jP
z@2a@G(ad~VVxQW~xn0iE2&5CdoggExsG+87{q}0FH3@yo0#ks-NYqf0j%ZU#QE>H(
zemf(Z%@hd!&gh4#G!pGbBOCuO6x7fMP<3=Q_2$YusM1Am1ldM+2>!sUKl8xjU;iM`
z=ZPFJ2y9R;d#RXF4c}jd13Pd0^F7$qTm5CPw)*m7`_Jouz1n|FMZR~#V*hUVX%X*N
z!s6my4W;p`G;LW<7GT1|!^dff2jfuFY~c8&<659Py~ogP$LPDyqWa2rMFb~~RM>Gp
zVOpx)f|f`rDa+||e*T2;kMS@&8w&JAS!s==3*%Wm*#w#T@?Qdhu>Udt3qb~K9AY-v
za4mTJt_7o{TkIkWwpV4jh<e-)PqS$?gwJ0b3HGcZq}qfrOalKJOyRfC3(_0O)tSgv
z4S{XGj0S*m>UXel2DH_HVutFf*PV@N5Z}yEI$;uxC)NL8+}=X>oHwIAIN<))99nxy
z*a9tGQ{9q9Os(ZUxzj1tYk)^LV(rUG#==A2J?+#avsq0-@kra%b}u-AT@cvE78cpV
zu~2h{r#xN?+6;T{q{U<68RSzhCn1N;9&Okt|9ORdZ3cUHu*vg1McUXO=YaYB-xu-(
z@y`ASvoZ2tzmTmag?g3P2b(t>HmmPzOvd5+A}Q|IGmc=b=MMWb@=aIiK-YJ8czFL9
zYR`veUkaSC_t!QpSMmU#O^fG*A9B5c@4x&^86Kdx&Y&FRG@h(8`IeHFA@G(5@|*Q8
zo=OdCA5Lt4!=>k}>atSii(!!h4`)M(P4#{D9P>Pfa)zQKn9DT5H2zUGYR+Oom0r>c
zLFl>g?CoLHUUXE*A@7#wOG@hupA4OQ{mol;(*)}o`bL&TDol-L)xGHb_08zWpt{N{
zS<c8<K3Rhbi!g_$`1>`OeNos{P|Gmw5tFYLnN;V_V4eqi7bx+|K>ju-{ub&5WnP%z
zi7}?H4dreka0Jh$4o?jeSxD&aF5)N)6)$KCzR@Yss!SJpl3pL`PB{!3rlAz;D`%9t
zSBf@wVun-4eqTQgf*zm88)+pPA&<TUY;b&_vUOVqI9TdO<~rx*83rrkeOPcc817E1
z^&1Xnh0FsKLG)clokrWzcwTO$LxV;O39}svZ=s=Xnk14#KXDGKxx^B$RBWDPfE1jE
z8_SsCWE1F3=*O@9yLrmwR9xp77N{0bQk5bO8OlI!uh!g;7@6e`Y;Mj_BuLs_7U#f-
zU47QQw0N(1I2(b2e5tT0jlX7eopk?DOW{}B1iFc7K5;*T6OQU!ePkpT#%{GSi6m&M
zn}u{*vf;`(=I<_DW!d+7$tmF}j5g97j=-KnQpvMn1Fe8!dd&o+`&MJ-kx|M3O3zZ;
zE8TaU#a^F_jbuG5H3vnM=CCbp*_gUwcbu&(kR2r`(cH*C-Wx9{=g-BDyqzYZ&!2Qs
z<J~mecPZ>=Koq2a-E3huKYLWj2s~gg84_=fELAj(>-*@4OGXy<R=r$$(5uoMnj;Zr
zus2nVijl|G!`xe@Rj-sSiWJB6`DLMErdmNL4z;NG{LM9DYB%8ENsl;ZjwnHEi4N{o
zx3zOZ0D7(PzTH?)4%QeSi(DhtBSO~YaVy_)>KUQ(mJpQWq&@{hNO7BSOSP}nK^=b6
zEyt=>k~Go^9qTLa)0<3Haev{ikafKPpG)%T{1)z8^hswQI(qexRKzitv*B`i?M3Xk
z7f8~)BvR(*X@u_3ykj_0waLCa|6<eJx$i)J8*Cdc%;lyCNeSR&m#!x8{GcXwI5Q8{
zz9Cxlh~byD{HE|q#&az9UPG{-_^_yK+DuidRWco9QA<g59JJnlHMf&n9KpYjt-p5i
zWb&z=sbtm^v$Zmk@1FhL=Zxf&c4x<~r+`TgjcS%X)e6Zz9R$o&Q;5fi@S<aAJYvG5
z2JYDfeZl2^5C_j7$2Sx8d1FtEBo9LCm7a~cwbmqIWg?cnsVu{vepgGFpw@L7p!9N5
z$GgVJEVt$5cC?`4t)1mk`jROV|BPN)8=FI*!$HZT40xA3sL@^jnf&d=E|hrM?6cJH
zJPU_Ow}pksRur~s)bp^pO&SlJ=a*@T%arM{EFEl&%oY;$9jLNIYRKhJ6Ci&R_M|-K
zSoSAJ)t{Q!I>?IOH%7Ky<Y|bBE=aW`F?<Sk4N5CXBey<3i_<PiG&};)tdAFc{ica8
z4#t89#`mXlc$s$|bQ|!gYol2PHyv$oQ@AXG)egVpnm(2k{cI*=lO7O$7riM{%M>R?
z4UNs7GeexQn2Ut9yX1U`U@Drcc`L_Uzp>0IQBen&0bKYv9~ssT11|Qb;zndK1=zTi
zG7%??PHlnI90sBTXDG{jKG|hOk*9-TP$xT=wFdh1-jo=M<y#ApbsrGkBsO5(f}|WZ
zlW}pbo+#l?NU2`IamsRn0H4URPZ=HGVKV881X6H*FzmK=-Px-VHDZhD_B<tyUZxM$
zw0Wrj(4o>4j`>R81vkrPVBu}ZEQG_zLS2AkZRYnZl?LXPdX9F_t8F#ZZG+783lx2F
zWv|n9VY^iIRsc&?T#EvA*m}U5O~Fa(Z)}9TUeF5#fwqu&TU1^;G0Iqtc@iC@8HYVt
zlIA*<l@v|ZU?L}tbVd46qS~p4@}XHI8RIRE>UON#7VJ!A(Wf8pndD_hd{QH`J+kB5
zr0pLT2d}it`45J0CYf9LMzZW@3$!Ng*OU0mOkS_v9rDQ(B)_WmY;8LZc?=`!P^!k<
zoBnp}I<Qc}8QyE%S8I+N<I$d57qIO0LY9KXfm8E^`ykrRbX~@Ub)Cd@c2eVmaEqQ&
zsz1mc*EbyvFqru-k9|JTvPhf*Yy7shHgIKS^jCiOs{>{1%jH)0YA)K_&H(i2x9Y51
z*30A-y5mF<f33TUx}9OVL9l1)_wBwqgPRvRJG)o`%kM26EGpoJm&HI?QlmjT`rR?+
zs0A%6%5`)QFB@b@&*rRsu%!({h}<nIz->9`bGtBc?K-P3LJY1f&CrYvmh*LYldT(j
zk{zn9gFfqJ5%P^;t*vzuG+i8LQwGqvm|+;Ls~DbSPx!>-OJQ@#E@@_JcqEJ+08&Xg
zz7--apN97|O6wCeQ&i@wrT)$Bq(Pjc(wq(T5|Z1KS17o^X0rkrIJ01+x)K~SvJ8{X
zC3ocA<VNwTkvNMfPS(1tMl+UWrsIebeNcF^aYlzMMQ~<M7t{8ZdWG7Up=fOgJPnf_
zq_7ivIwY=AqM>V5^RGL?!{ly(=aWhvSsTXt7S;BITMj6kcjlnrOSl$*zG3V1ar%+r
z$d4Hl<2ph`8LRiV@AdZjjI^?5ZKPs8#Mla8&D>KEyppv{f-75A<GW}6Bw!Sk`;!A~
z?>)3|?87dAT&L?O2Vxu<B8y0%a4&r6G?glymQo%R*~)BtaV2FMafJ90+sO;F-q@$1
z-kuKmx~AhQ>;r0{8+4!WQ6O12ik7&58;27cNxF47+M3qZYm3q0=&Qf{_KHmFT8INV
zq+St{r^1U-&mYBWy<#}ZN9$l_7)&vnn^)U}&lokjMzAw&iCCwD3PGW_Jh;UC=)1kr
z$6iv%N_cS5i}KM>WC&455b?3jO~Y$U(al=o<ZFsl2}mo)d{S4#r2}ORaA<*f#OQ3y
zJaOnpS%9+I^E=`4_g(kuraT+a`vRA0$CFs`-e}*xz0C_xvW$yk;E3iyvw|D{K+BjT
zM?z~y0qWBSFk;pdRU)@4&-5#&kTkr$g<&8(@}$_WM!EcYJ2d&6X_fcNqUc1AmOCB%
zgiR(Pq(m7;0O$qbNmR!hGEN7oD)Rb_ZfU#GnZBnTk`O_%t?a}r0C^LkpUI3@6e@Y9
zz9e2NZj{cOC|<N802I&)7&tCZ`>vl!t>N-RSG^?l(n{9cGB)e{cS<(S0mazvI2?;s
z-TSbFVUh71l9almm(?W3Ye%A&t}*QH`Kz1#p6okgL@MgbL2PK{HLN^q-bVn*>s?>U
zSVc(Uh^D{uD^}*JKqF&&3&Bg$<05(HW2p*0;BpPB4woCmZb`PK@M6pX*8TnX4()md
zn&Zy)mb{7lL)A!R@=0)4mk?R@$`ZzYR7?CoyR*#qYZg6V1F0`BVBBKKrmn#GW~mQM
zRuZ5_zX02hMwRtZxNUP-1YSzom+?0^2qr{^)DoNsv>-e-U3UDA5Jt@x@COx2p*qpS
zdML1{p_<?Sxe*lww|jz@EoW$#%5?;H@9JDm*OT6T3+1W-=7PF<-7oj(HhFn@r3?&m
z?80F8gs1(}C3o;<_MluT4OOOZWC2gX!HGDHOfs-0N&P7E2NU$s&ESGw-So!h)#2cE
zH)+$!fiHDILee{1CT0c?gEMG<Qk4zcks!nCNby6zL=-iQeI(k{+~SEcoC95A{%dmG
zXpdjM6fTF1l9x(E2kGp4JTGLU?q&A{swp2D>gB+gV>-^X+QkaHQb-@8F1$i_g-rA&
zpOIa46Od9N0705np>oRw#8g~bP*Gu!aQc@lr>;77@KP9UWZllB=L@wA?9ZWG)6YEc
z3>J>#j#+dHLJD!>tY?-qK!xLg+xPM{$2>T0Vi(yz4a1{zB@N$iUyW7Ip*S}|)lsi>
zpqK{%r-Rn3+|zw-bs}vpfdK_V<N41va%rG4zQT7Kg$5J9`2n5T(l6<7Q-!c#oa42J
zbH3t4O-fcuyNwrjC08KXZAL-`hDcD`Eio|}vBCEQ<UL-CzzpOBFbpgrH4GsZGD<P<
zuAxc}*{}fH42!iG9g9Q}CFK@IlnW)U!i8w$4g9d>nM#*&*B&D~Am)6vgj^BCNwF<8
zPk6b7@RVW}T26|<?gl&*%YW+MC<OU7vXIv=`iaEK{13|BIx5PpZ68+Y?k?%>Zl$|R
zsR5*95ReW*x<R_TLm0YaKtPbrp{2XKzfte^dG05E>wUjJSX_%(v#-7PS;ujldkdjw
zh2Le*>mXcuw$iRVb;enf)7V%Cg)E0^U3zKifBIB4VE?lAmZe8Dwlg~Z63mZ$<x=i%
zlH{^ICyOBD@5Cw9hq_6vJl1B;ACc)z-ahHgrzCv5X`NhqgfQ<sJZ|t}W&aum`@}5?
z#-o8GFk?&NIA(lV)FbSs*)ZGe6D+&@fY@#9er&lktjy}d{>kXB0NfVWF4)3ZNHpl{
z2V<vwZqm43<?j5d^VA;^Ro@_0myl2AcuSf$99J)aTzmfDyoR4hNS6q_VDu&z;-F8S
zfNu(x^2F}Y!1f;FGDMp#HaXaXAt+f<bS)E0pv4MXXpiMvLQ81KX;>exEHlpmCw|Lt
z;2QOOB@b%)sYfti8CKKk(xDRu`}Dh|kv)ho0AD8U=Q#^f4p6U=%WnJ3GPz<3Me-{f
z)S#vHguoVUKP#(d-JUgD?RJ}%^JZXp_;9fhYI1y7R{}yd!k)!K2P)N=d5dCJ=b7V}
z)K18whT)GuViM4Ag*v|b*`;uPMar)Tb6*z3w~t~wAMUoHR7n}ivp0(_<VXnPdD$Cq
zVe|_v`F|Oz&-LA1_fVu*d<`ZL;@%%iTabAiN3Y7HDIJ1&VjSh;8gkvXMmSo6K=;8V
zj^?}t9ZMJavN)107Etpb>n_$O@{qZ`V26xu?Cu{;qqE<>J`+uDvX`Es*LZ7p4Z2e)
zxkq4E#Re*)rnjOT(lD3vb9YUk?6K62z6Y_Y#KO`B#DYY8BJko+N1Np-Sj4tdR6t3j
zciw(O>q6;sO=fdWEC$YSMwPMo<UlF9)t=X~sJr=*IYIt8v$mKz#)v=kKs%7GBeL#J
z^hH4PG4axvqnc<AdwP}Qw3U<f67p^R-4tvKeJ^VV8xr4MTcqa$76EBtuA{K+;F3MT
zb0;sBBZSI^##VFMa@Luj&5pT~o}{-wU$ER>c4d!|*zZZFJCXZSEP-E`+44+m!|WX(
zgQHN9ds3v&0K$7O$p!jeW}a4&KQ%O{0-PF*M!AWVsm9PG%db|DriQ%BL(xJ4CQ9;>
zKM10b47X}8bl=k<jWn>nR6q3P3}^2Sj-sX%z&h+}$TlvUCgeJSeX-oymswTnH+1*}
ze?JWD`5cvzEgo|~t>b{<qQ;X+Djqhwh7agF(M8O2>^!u+Y_G-e7`ipRw6L_Ueb(ZW
z#yq*}<qKUHH*%vuqtr!CbN}$#qkslRH|IM_ov3liJqtsV$3Q>UMV~{8aQ!rV$(9;E
zAn8$O^ziFiA5!w8`4AIPp=@Q@c_mMf__g%Pk#yWxl_Z7U*LDPBY+*i;yF5kA;SYNL
zp%c@qT|<OY<B#2<X7<+oQs;a|QS&3k8T&>yZ$Q=^&n+)sHEeN|i;^)xOM4%l1QauO
zfsaFKc>C%$3k8|R(~9@6-&}6YP9*bz_;2-r-ICZeiTL(wbmes|xoIaF>CLC=RTvFw
z>4sb=ZS&*q1}B7ea__o7#hw7S-l9&9ej6q7Sz+u)DHGrJW#$|2*t*OJGMzfP8h;qs
z2@a_V9f>`5N)zRocj~rk;dWbzFJ90UsIXglZWF#C@R3d`_55He(k3}S$JaztwJT%T
zgryB(N!%;+pr$a}v&90MaY-W93;l)1K<~`nf<jhs{{$DI=++Yj(Cub(C~X22Ba7dT
z{Nv_esKrof=xnca$aQpIhj2ep91b=H-MfW@Wkh*U*3##LWX|N8WqnG>I3Hb-6Xoqb
zV?Aps+S=>p(J7)J`Ab>*yVnA_#px^$EX!$k4FGWmSorg-5W}Qpg$tQmpKp1R^BluY
zgicO<fFVlD#>Li%CTe=XgS@zPqdiaPMwtyg=b{rAwBpEMf>hZpty}|1B2v8wGphmI
zf@jX%16XDzEvw{yCHqO20H5=x&$7X;UGL+e+T3aXM>WU6c`uaAr7C;jYIJ-$oT|H9
z1Z%gNRnjl0F{o*g#zAExahQEk;q{-6kH6)ZqX4+%Fq$QUOuM@L8y$M^il&D<vrqOM
zg5M=aN+CKsbd{c%f$aCpTFo!2>R}n@uy=?8nD6RM(=#cZN?5z;=gdZ|DOz>OD|x^v
zT0yW^<MM-i+}}EV@wH~C-3&w!apI8lydlOOta=zOQUH;K;jCU$W=B-=atu*2YCSeV
zUr!8ijZa#t0GiAUK@89El}QUjR3bh!X8uLrBGuT_M=NtX-cK`ucd%;%)2zv+`Knv}
zm}{H+-3P(yv9-OhK|in4cL+IGvUzYbk?MII8)-_b>;;`)pwLD30)+T)o8ziHwhSAa
z#>Mp7l=4%QZu@?MeZLagaS-~;+ICYX!4@!-Avp_ei%Rx6I1gzgqZxfh!N}8u6Yk<i
zZ28K<`TiVT#5~SW{t7VRd6tP&KUC$1o?({Zo5$hVuWrz^=?hbj&(W|L*~h-Upq6H|
z+!D2Oi?h-=ujzr743KSA_!gemVv-|H&{r8CKR!q&U=~Y!h#wKYm)L0^LLQVl++7uZ
zDA4qdd=Qn?zMIkLz2<dypB{%d3(JhCB6mL#&WhR<)So$^lm`(pEQM1it&EN(xk={^
zTEHjK3FUbmkqeuE?YRf_u1LXJMKmMv<U9A+m)&Tbz(Zcxu@f1O);?p!tyi+1_$s5G
z$^Bk3eg{5}uykoe6L+1M9!%T2sC|<?miBuCp4M(xMM%R|9Y#p@9bPbsve7|@&&UV~
z^-XRP>5plU(9O7`nCS(~;^G3EeZDQW-EnG1N7=q?YoHeZEOYv_I_C*7Mmu5D%aT?I
z5BC(SM>XDlo}(>bzPuQ|fjK;w4KJZqF37Z&gwY2soS`1l08igpmh0YM#62TzFb=>H
zD!=kzkWpIjRopWAc^ym3K~_z;^+8(kW@*_KeA>UpY0+;8``u637OB|@3rDHXbfrSq
zP4xm9tOD(fQi7hDL%Os67hrxb_&bxmY(Sb;TrAaQ)+*CcCSGm(uqb5E?nT6I+%Bc3
zN4UDSmLND0+|nZ4JIYJ9*JLr%4Rkq8<F{Kqm~R*dZm`(S)mn#yhifK6k*;q(jE{z3
zd@uOeT-VRbb&7hHN6+ryqV$?MU^dyiPsuParKkvR+AQCVpz>M2fzMCjH6U{jI%fBM
zmm-@=)a@?U4eoeB2YLU!Cdd+5{tV$s0D3+w$)%$%pkJg9^^J%fUOnlVBw;`3mKgH%
zWZum6igD5y7RQG6RPA__UbV{p9Jd^@=X=$DF1UJv?`b&?{&<3S9b*uzE|{rgiG;n)
z!yRY|SD@s>sg#{i6X1gdtUs=Ng}uohNDU=Am`C2cR?e*P!`w$z!`X@WoAb+j<%9kg
z^+Y|niwJ&n!6G9=v$L}^XmLSPOk(SS>g<1UPdrwmuTrlg4EHws;}E9GbY*8M3{9-8
zLUtyK6t8Sr8XM()I9GXA&W;-s6BBD-xS)9$dYo@lq7kuc<RhwN2o)@({i+L?DPiwq
zp#;|gJGSp(j@w2e(Gk{9Jbw(DvIUPvR>&jwXDD0p@8rel46;ijMgNz1gljR32bRhO
z99(m`#3$$td*C1+&tCA6HSAKWQkVV~;<aGU%Ybpsvy*i}<}Vy5U>)E8e{T=3p`k(3
zWG?z`8GG7hC_qq9@XZ{C=b!~11_nk_kiT)82cCYzhXkosubb1@fUWN_FmNdNQdOos
z`Tb)Mv-(Iw`X7@Oh9sGpnHry3ACO`FD(P#+=$<OCnZRP6m*wZaV+~u+C?QW!GU7Kc
z^q+5va;f{O`aTPLzr6Do)6fN_$Kax%j7SCa>o1z@GxdbX|C5r61#D4)D~4h327F{d
z)YQ}_Ha6kdv<h-F+0u_JA*<Rbd2R_$6tt!IulwIitCxCk-W%1x4ooto1Zil8=X|FK
zJl0<_U{K?tXo#|tuVTsmt{<XUMG>D{f_qQEaIDO5S{eIfoOetRcXX%0OM$HQ-5=Og
zLus7pH99dB_u=W<r%xA&k3^+gY~d}Ro&U2dHS0wCokxAJPxK5?cTlS(Vw%^!V$5N`
z3PxH4i{^`VY!~A?;{DA15s9aY4&;t=xhoML^ySKcMaQoJ%s+{8s5am9?%@E3_F2|$
z65JTRSYVAXjmN$<_HB7lA9O*ma_QXa_<(HC9tGH{T<=LbOFX$}w!i(j#F6;`lWCDL
z!=)P1XAI6Ok5Or+@TSEOQ+*kIXAEu|!RcH()cr{BXk`BFpz^2A=C$Rwp+Tf(l=RtK
zxn_8qxpKiw5l7$fv>A4G2)j}1t4EO=^=26dr8b+e3r6lLHV61=I>-Y=jbw&)NUb*M
z@#9&(nb5R-Rf677kBq6dQ29iahAA<DtjxU@8}n+>J3l;9u5Z{snv_(!tF`C~%&eJk
zCaR=NC4wM*(IcN7u*1hW`4R$mzeUP-`)RR^bBg0RvYpY$IHr*BGr`Cx49fR~@C>T>
zzah3L0P~P>(*{|7MzXNy?2XW)hBy!<4xBroD);cA1zCgS{a<^mq5{$YA<$m!lOh>w
z-0#NEWTQycy*=)IR?A@10^{Ovm~_e+K7GI1Um}RQ+^hQ755H6S>i7-54_x?l`SqCI
zbpnfAbobS}M_sO?tg3s(<hv2QOWMI31&gN^mW&H_uCrw`B(q*!z|{tXyYPtyViDQ1
z3-J=iKLI@=7k;AE?7%iMeB-M-vy~hxh{D|!HnLhmV#4o2RH{`>Y3N#KSLuroo&Ixw
zm$Cn%k_~bhexMF|=dIMrg=(`}WM&>e#2&#*+Vtffo4N7JGaU4t<k+YUY#oC{PAb+W
zmdNyUq&N_bBwbe~N`EDCxF%6nlyu3LXJu7te(U@&_)@XY94WErHjDgW_4-AespLLu
zC#MY*I}OSQ!X|eEk+1>iHB@rmO<!PfxF=qpmUTt&K>rz#1i$8_l*BRc*#tBc5-n-c
z9hk2d>MVq+k&+1iz@wxL)zdKU+vT&#v~4qgl5w$GeoZX)_!L%&4-}-LqRM|mFuNa)
z&aBhf>q1wknnimp&Tan%z1imC8_(Vjs3vV_h#C_S_J!}yzP`kYubab$A>Fd7U$i_s
zrxt~^%b!U6+F%0}@IG%So0W&+__4z3Bi3W?*D}EBV^C*Zy{;#n9j%q;7ID9QL7pjw
zi0l!bPt((i{G@Yl2G&92+xfP~PwDo!T5w)g`g1vWF`U=Ox9xmy2tXz(&}N_19^&o}
z_rmwpOU!$bV#T_MxHHAp^J8g)g=qfSkp@Ic2r4B+0u%^<f?6>$pqe-UzipJI3Y)#p
z4jO?jhMUI?B_*Z$P3Y;vS{iaasly2pqW2YfySJ~OPfTYv00?Q6<^*==+A$7|h%*?9
z{rVh4*baE#*LGM$L|<E9-0?~x@<H=&Od#}fttN|iY>-U1ot4P%#S9zt16R>UR1m61
zad6Ns0qa}bsZ#AY85}69ED`XV)8D6rO{0WP#w9=ge(?(EY(L6F`;=N0y!@p>?!!83
zA_APkmh_|Pd9o<|Dem_`jWr&?%~%Ng461fX6cy3ck#AwDPwvgF5hzM41UdjLal?gX
zXOxYB1j(UP-hu*_Uj+8=kMa)0^c%v2PW+wlIY2fApb|^8Ntb3qF4J|Z!yJE`$0KAs
zUbJPA90z3LWKO&Q#>vSNo5*z84_eHJ%p%bxlc(r_iuy=Q?n~$xG#jWq7KvWWZ|B6S
z&G(X+>2OWqT*!lLt<uN}h5|S(Xf#FDci=pUH?oH7r6>4IJ;pf(J2@adHLVgLX)lv^
z&MQv3y1MbK`uLF~{4xMQHkbDA*?^99bqnLK<?2|&JYk64451tyXA4c&w&|t`flYk(
zmYn<pf$a;Dqf9IDeB9HGkx<gvYWaqIiyxZL5`ycxilJTg>NF6g&Si{Ox^3eO3k^tv
z{_;V2P9}}{Lf(}|*vh&tJrI7HL3Iy~Sq%(4=B?Mm2D1gt)mz_vThW+v?|L4S@$)ck
z(*z_VgjK7Ja$rkQnS!zL&Zt~J^t3zTGeyV<d&KDNp@8vY>Wa0?@Wb$!=~#mk-?V<Z
z!%tw+mbloRI=R1bG%x+NyuT*@TP2nRi0Ie$^AQJUV)2tsM+@b?pE50OD5nSJDrv3H
zA+9~WkI?7|%e{Df4pMyAHVTZi!GXY^OPsm%sP`Md#EEGbR>>rvmQ%myWe?Yxugh*|
zrBiq^LSJM<r+Gv7Jengw`5JJ}#TMv?R+_s7W*faL;|?Ot>nIY=DH}UtfRqzEi8`6!
zNK%oD62j0YNM^Pcj9!dCvtHb@j{iV1Nfx<__o^h648RDhFQwzh`l&a+NhyU35eZ4X
zurT`g*xp+1n!@Ma7kX?s!!MBKuML&)j}3+7l8<E3M{HVbXpUQKK;)lA0+5OLSY0C*
zdld3~doBkv%&Gw#KuEXPoqtzRG+}0gq0Cck{NiHsy~%shjmYuf7&G4Wp-cokc>dtA
zuWVLx`G}?LwAQMG@M+(3&W{@L2JqP<ZXM?Uquyxe%ZsnUMrf!D%g_DUuDZTm-O@}1
zfjnMUFV*r8R~|fP#<t<3Sr8h2W;Vhj(LaDUwl(%r3F>gDn6Ze7!;tZq<lf;TAt9Y_
zT89}leO$S}IUCUWYo!80jF|%fP_+^Y_)*MHl)4wTKJ%^Bc=5}DNUP}3mG~rOt-^7C
zQ5R#;b!G!hXA7s!W7!9e+YkI!k&Mylvu8QI@x#gAg5qRjUUlq*yND{}l$z@*$>-nZ
z1)JXQ&|S9yk!pnnF<nBt0b~mVWOD=(zRlWWcTN})UgIRqX~a1m{(cNOi->fOx8o1f
z6M0U6#%wO+>C(@SBhCOEvsc)*&*n$lw<pVZ1|orxCnmSa_>_mxeHiF=d(Nnkz!W%;
zz|5>U4j*Tusj0d1=)cw%&HT6ZYWv%I#d8)mol6)8Uvhlp4aivV{HhR-WFfO-HaR;y
znmR>DwpH6bdgsrPFfhkRFIW>v7-sGLi4&l0L)g5{7?7syaTzmUIQn^Wla27KS8cb)
zA}&q&WGB*_Bu&yxhx%M#3<pO7RlfWUJ8zuDC%s@aFsR#h)T{%aE`UhRdZHLDQA~7f
zri$0;5Un#_u4i!dms{YgFlh3NrByUtYIProSB*(eM<pR4k*}Efs$ZluB*OP$A*58h
zY<03k^N%3t*ES5vf{K^^ELc=rIwRH|z$XpU?*XQFr8`)?(cVNrNQg;OEYRQIpJoOH
zpGB?km^y4ps=mJddxmhs7n}dFP*sw@EEEO2*$;K*^&ulcBKLRe{c!`h()&wo`U*2s
zQ`&|37%oqjoxU&yUi;(+BSR8we|$I;b)*i)1P1+b{}LegkH5U^YE4dF9yL;RDJgf8
zMcde7i>q#7K3ct$F7%xH{Ew-rsfg(4I=_`vzum;O`@cjGsM0CM8iX|XtHKDaE-NdG
z@1^51lk80~=<DlKwEmbb?5gs%lo`rgCJQ+;nVOj;{1z(x@$-*=Ewer%pK1lv??}HR
zHZd_79Uc7wo2G2#a&>5k%Wgypt^H!A+bm+@;{%{gC5kvX8$)RXdoz`?3JPJh%Kz}j
zy2yVIp3p!gRfvU)8-UOHHXB;>xLxiODI~E)LWNr0eSNaA+XaeA3T?AMBz8U`=n2CA
zGrg6h|31A+YmX0i#cDZzJnC=2esJn}GH45}?wZ7pLmqX^(A4eXefVEqM(UnmRS|Cf
zq+5%{otr4!Um!rKdtiG<kId``>zxm+DN|y5MnGUCYn90A9rEQkC^VTu?&Ix;Sej|^
zSipRrQYW^ldNP~^LS$F@XZ7TV>GS|Mk;HF>cn3#}kTdx&mhF5!=dWTRpxTcQhOol1
z_0pfP_lYQbLEgNm)8Ot7=q(vt5gfFg&oqrO{1;{EAX>&>D9ag?eZ`U(!IFX>p^~07
zwNHBO<Gvd<pY(j7D<6!xPr;I`l*DdKesi{!<WWk(WA!rBdA{CuWplG|koF&YW;ui%
zYo8a|1$1SgtHl<l-0Zy?+rsgdg*a^EWTJ{G)p(?1s8mm%<%$SB!y0YODIcHZ(^nAJ
z^kxfUy<`NQh0z{VMvFFPHibF(@M<IP>B-NQLKNu|+)K#Sgp9no+4?~WT<DzrWDkqq
z#~^jrg5)x&$8vfQ++24`sUNjG3P=*e?<+Xyd9?5&la5}-2;51W-mWdd0Cvd$J`CDN
zh%P+;ilF^^k8CdaF(%Y?8qU+AmXSr3SGoc?tDY}!m<*q4VkAewQyHJ+X{6n6IgTIK
z9brO{(gYX@AxExJt~((~=r7PFplg>jA&?&bmGNCh<NruxRXn4!RQ%ZHd8N|y&#>Qt
zXG{y}sM#wP0=e<R=yM>Xg$yN!N)rg@akTW78p6S2d<BVt@tN~%tLWy4Q7BMf(`USA
zFurotnzDMH_k+4hU;)3(4A;3*r54;8-Zt9&1}UEZ2&qgMCTFZ2ci_S<Du%t#w62Ja
zxZxHDO^L^3Lx`AqlTT)<&?o!t3?Jc*{R<r#J=3|9!{X&;mVt)Kun#SfRW#|l1-H6A
zv!*32&zmur!nqFS0TC?)G!W*s@+zn-Kt{0kRh^E{&ym{#^&DM8t0Vs2Tu_O9#0?E3
zs!AvM?E5nq`WcBEnT|X!e~n^`X>^Mj858RWiAHm9{X-cH6zvPfpST6+2qYBol+dT`
z>TO#FVWAIM`E;yB2W^bG0r{2A3H@nVRBLH<q$0q_w90BZI!KfHe28ZvL8f19VYG@3
zv9*I6g8B{TjL+W%0^)esPx<MvYy#g$D&`riX)w$eqI(<>!nTYe>0uY_H$|m}Nc##|
z>Cy^UKj<K$;a~PdM8|<%=wScIl?6b`gRHn(DLoEGY2^#5LpKTAvc*byZpbc3Z%qcl
ze8m&l3{1+q$a`O^Xuhp++$D$wDV2sYq3!V6Xv1aHpZ85ZbHsKEe5a^E#vAm`i-x7r
zMRp$DT&>VukjH3&WLo8uTIGkwT0d5#M#f&!_t6#y3aeKh=4y5l`h?5;U9AjsOA7r_
z#J*!BdwHmBNvTSEVJC;pqsDq98^nn+b>5NLj+$9fb~GEjy`Y{cwMHqnon~>>lrDz(
zdSdt`?$15F7RBm$45jSTenSX!Ycvpbi)6g==oR7Z3+uPYK0J)RTo=r_i?JV)F@X~E
z+|b+AR+5#iYvQc42t#i;f)5t!8SX4y-i_#@&{0xzU{G%xBgFtDPJsc|j}IIG9a}A1
z4b*}i=Q8dV7@5ZHF2105!m-dpNF+I#hcT%yd0yAeNvk*88KQdgz}Ckg&(=py_ch)b
zX6HNzXEdx9Ln`S!(syBgsKG#_7}n>6EEsx?tpkZO6mli5nnzv95#tsk)iW}mmRhNV
zj*g<Lz#hr?C*jC^EmuiHABGO$EbKyF^n~X*O_efe<^{ck@qQxZwaJw#P&lX6K<>~j
z3#zWO$wMu0IP*qOc={H93ue55(Og9+x+c(w7mNEyz{c{4?c#7z*qP58>#0M)^OD8;
z>A`h}mr<vcfk~(2GZQa!o&wtI4dMi~rrW3RFaxFs<Ki!jcpc0>-kMDBQcjJfdWd~;
zwVGnTXI$~G4<w*a%SHusbab2=&sLHxw;~AZ8%^@<$(r(#*_hf^?ccoOxu!;_)~-Na
zoKJ)(+*b9vG6=oLeN`{AF?O|1SgugpJ@<}eP-yab!pCYM<eXVkNtW;$aJ4H<+{(nt
zbtA^(_rCfK$w<y}Z(#wCy<GEx^l@*L+ER=O`b0efZY-HKCVA_E^A>;%h;>@MB}s%N
zgpRjZ1SiunQ4hsN&(1n<nbG*Neu!h(k%`ZQFR=|E4yz?Y`xQNT+eX?Hdb;9?S&n!k
zDUvqdy;v!KXg1kKo$t^}RPlTh6>;=fZ@JvGrYIb<Ty7E2R_<;j3K>S&%mczx9+Blo
z`zSe9ph&5}{uy5LR^f&$uMaS}aLe#|Joc-GVRBpgXKi)-QL>`O#}S=umgXbwAW>*v
zC$F;B*JF}`E$KMhUi$!AAbP#jPVVF*mos3W51qM0S#c3QuRD97IA@BmaM%pQV)0^s
zCtYcNMyj;NsSiIHR|HGZZ1NBsmAj>WdVGAMmnuTsOZ|hIJ)vK{oYW(e2>ng~Wzb6!
z`~Cxi#}%{01)j{rhJRJaTm#n<u0Op_cCAP;e+`C(Ok@w0ke#F9U9Q6qulP)q1eO+X
zVu24&5IBB-;fsG1rz$x%5QYV8r36`c7P!qjyxht-xExhrMvAZ(esJvhnEqY2gf600
z#?*u-lrI!?k}h7b*00k@^VW7-_0-yzXrwvEh*lxbalxsCZ{Ji#)7xx&w(2Z}OnbkU
zBV&MFjw9$Kf|x;W1LdugA1~5nx&XIQ%RJr?LZW1yJQ?Ro2BU>HA^gO}g<9>)sgz38
zS_;%|U@Wj5;M4r%0iS_V)}g-={ZR>I11PTKw2&f>6G-cvE<#A19*G1Bp5;tORDdG#
ztFeR#MZzm8i$&evP6o7xQ(E+3+|fW5ZOp!(xD?O4WUt;}50jy}kE0G!|3ougC24Z=
z3a0M;SciX?d5*JW@Vh0{iBBy#>hpe13(`3bF3-xT(M-tram^mzf6ncJ2;QP?DCwJ>
z3&VIsUrP6pv)H-BA1)D6FU7^jsXb}<kzrx^3eou7gyRSHR2T|KSoa}bULE@cNT%3x
zz@WeD@}}MA{J|`4x&I@eEd><ZeW(OUKoaH#^jShOpU-od*uVq(1BOySj4*r_T|uaN
zSx9?aCbsb9{Q*-%ASN6g3qLdX^6#+0sCt=5KezzabS(X_cc^;lNYF#eMmc!+xMCAQ
z`pp3aA=eGmVeNy^Zi*ODSr-<gnrGnt=hvSx16Em=)`nDHBN{m(cD3-p7GkF>yb@Yk
z)fQUn6o<LDQr*2)fGq&iCv<AHPGG)VNr=)tUjO;pQ+KN%z?gVp;wSS;B05FmNBbQ7
zk~Nl<gdl<vx55>7Ch`)2f;HMq2R8*)?XA!NePZ&W)zpDJo<=zlrC@Gy`$kn(-7O=g
z5zVHwFij>`4foe0hSn68pQ5wtbQGH*gF!g-Dhy9O56veRq7d^j>o*jHN0UKg=(ecy
zV$aqN^#Sq$tkb=WhhQT-VLTjs-K1f287;zj5)`@Y8L$o|gr&{HQOS+>V4@9r(`nVJ
zI>mivIBdR-GOCXl-rg+cd9)cvF-6?8pOug{g(9{kz;K^OX%V7?9k=XJ*E{))q+GFH
z6KB6)Pr9#~3IOZWrz7*&`q8tR+AcJgVY%={>d0ZR;89TwY#d^rYPa7V%$QM)-uspm
z4*Zh0$aq4!vR9%qpdznwf;4(a*(wXCiLz*kf&4*zGPcwz+r@iTa4DhVHlfZdmAT8i
zbV{ezEZCM1cZ|V1fs}U;Wah5OF~huocq21b5<k1Z0x;cZiU!$DJ_RlA`b`_hqm>4E
zB%Mp}ls@(bLm*&2<9(z^Z5!b1mg9^xc*7ygvw8z*7++SkGggl;-XNwBbN^%PIUZ4Q
z=#B$R#=3w9sfE$b=hcA+2WvfwLZiGYnpx7dX?_{`#OY?FL70@|w+ulccUE~(B2r!$
zWU7s9bFPfTmC-Rp&vwfR1Ki~|nfx-y%<J@HP@@ZlWKE2UDQ{Dga?cm68nYW{CQzs&
zvu&X2@`3tAlQRe0%|1t1VHeo_1&^Fa6{7W`)($*2Um-K%Tz_diTxPJ;O|%aKgyj=M
z&@e;vzE;J%J$w-0>O)P=s(P)c6Jo7QQv96JvJna&rwrk1zoFrdU3Z4jcKmZ=VpExO
z4u}+L!D;honz8ili7amx(~Z*{Kq8(J81HA8k0|fie@b|4Kv1uKn=F%TTSm9RI$Q8O
zsDlz5b=w1*_O)#g9n|yrxq$r0l=(@==hA0o-8d%js($8fTrAyjCPbO2KfFpX&!qH%
z=(|ue5zD&bpuY`({&w(ZC<s+G=+~1RHJH)*P1<uCE)!?E@`29@DL<2+Gjo9{aS|;%
ztCjRppDS{K#bEF)yK<HElAoh+nTXvfR_>i&<uIt#voL8Fzhw2LUtNy$ygHO$#>3ay
zbc@4%*}ttHyPp-x-%kVHIquuz`Et*Mq!75S8`=3T)|mH2th{%e+m~lhyf^t+6$S}}
z-Ju1=e2)`eKG*4{4}}#Vt2kCcK;l?QfX4>liO|Y<PaVrq-6Y7zQ{E^e^s}#I!p9oZ
zez1oA`D!XM5{Q^Bl%{j%<?~<vb3%ni)2WbIB=Mr$FAf$7#DwH}!m@%MJnxnorC%Z<
zzhS`?t=SZVPB%}#aFr)9behcJ{Q?^YC*f(=d+6E&Tmi?O#8@KP>JIYE+DZpTOPs$+
zXt0)yaB0ZdOLNzw5W*Jq#HVaxLK|W&)Wforoq0Y$4jf2R&Lb;qt9#UHV1WqAf3}$k
zDmkmw0+Sa*)o*l~=OCID6j<TmRGN_&e9<x{AF^q6Xh%BVLQF1faIBoPLx8lNk^&lH
zeHd{Z6YezSS&_YdSDIDCwMV%6EN#m$8)56O>Q{S4H}(n3Rni9t_5&D`9ZOJ{KxWM9
z&p(Ys1yKX5;HUN6Dlv8^`z3D_v+w%Vtvx{DQ3s(nN}$<MhggM!;R3l~T)zWMex$Qj
zCC-gdtn!Dx@v680dS&n_qS^U0fO_a-uAe-`pnPfstvZeg1t+!#zK`6+qs$RBwU|r3
zpG4HmBsM+Iyexi`bODI%oC3n0>8@3gLaiPGTS^~w0gR@7O&)x+^f0=QA(ZG>FnaP+
zjl~yFCsv7M<f}|>5=la@O&1*y6`wxR_uzsJ$~K>FKEjBy5u0$*0f>4#PXQ?L481|+
zTQdHJK~4|cr0|;?1rK<{qev5`ed_I@$)1(mk1S~j?qyn1Pj}r_96EIf!otu(C^GbD
z_R}KG@JjcnkH#AXRc46LG*Ai#=`w;mImOCXTAt1tPS_L||BKWmm$`XO&iCzMkYb@1
zVW>k3Nsg4sWjkZ|bEk?Yd5n6)2qe06V8Fd#4W;aj_~=6z`DPcYqoxwajf<xiv+7;{
zoiL9oMpuMX-X!_{zO7By=nu>|wuV=;r02I&U;Un6Ihzm&qq;Z*afn0Y6h?H~gq)0t
z0q9eL!j1fIuh<lhl3rNV=DDVl1LZ-A523!p9tvQ-&f<r<0!JFyJAxp3D3#h|as2J=
z@29Fn^`!UO0RZNozag9#nR-8tfAQru(7rrwH&fQ`KTng;7OXcQTgj!omq;$N;*Xsf
zEf@tDkj_qiIR&NMuT<@>-~B|*r{9%q@e9y?VXhMA`UTxSCHs9Mp*K2|-Dt*x(!v3j
z>;@}`EB^d;{yy@v!_9y=Ogh!RbWJk#5*oun%QAGFtwFf7DxqQgaPsZ!zMl#V8VU~V
zz)OQBHE)0-;WDXeu447TE*&_ts=;4ELcgJBl3xk5K@JoycN<0NkyARIEQgPqBnP6L
zAA#u-2cl(kgh2FQBUL}!y7nrX+}W0fpebgOa(ZyR&jLndsoJ98`_ApqT!i_P47i8`
z{T!n+s_(Q{FDys=m(z6oH+4R-TzArmYn}txUB)Ca&YFu2s2iv#s8zAFCO(9KlVnZa
z3~KF=1L+_-X}E1uK9@6}l^Le6x(_=t!wP)qMl+@er);()Rp_K>c;L2$Yx_}Il}<BW
zxfcR9`o;)(3Ujr@o*2wA_;B{+G|%b47CQ-KXjLLh*oxgUolfeGlQRsAp~<<1O={KV
z=C#HP6fQ@7KFt_ufSTYDXQBu(9cT3d1@d*Z#QrzAFPSb&BR|Z;n_SBBX?cklMn`mU
zP!|BA4+8~H6rkEe2<IB;CG>DXi%FTA(;M82cOy})7iGD3)8OQuAYa*E=>egQFA@9g
z>xptI<OdlE<-YVv4QZ=k+aP4^GfMs8g<{Dq4+kjhOzwMvFqfNS!HBC?&#J#;T5LT|
zj{iu_A+F#6eG?$Ha3Jba&LZ~OG9#QYknlE=ojSw+*3r|{gQnkYK~AY{5smfjdXfy%
zyC1sGY@dh&Rvb$e@4gFHQ<rzk0$c_W2T=(>ljATm&dVRw#nO(xv!LcF(GQ8@q~9&y
zk0z=rOeQi5>-XVJ^oT^^uYkjOT1n2Mf^e@50o<$L20#>)r`mzOB2wwB6L{t?^nGm4
z>&yL4c~O|=r0#XTqNWZ3gVo!EXjWyCv3PO2XJ)ioqg$qZV@A|UXApHTgmYC4Z(Yyz
z<(-6<vZUM?3i}96R~J>RY&6JwPS@3-H<G)nl`4{<HgbN3om2buzWdb9>iHadV7Bnb
zkqZqt&-FuMjVA1jy{`2-%za~Q=MtSj`We(;M)ePS!}9z38TvCy2=XuUinD=NEjM?A
zHui?rq5gSNgBs){Tnnio=|ans-tA{+$E$n{163*6J~ec#<=?n1zTd+U;w1`!Yh&BF
zUw9fqYwH6hMOOB`?zPRgq;mkbPLEPw^LmP2mTB;mF^8f6a|0hV;sp-SjeI#AQAwgt
z+_jj;Igo3f_+Zus8Ly|AdWcP?*T_f?tvkuu)yK1>FOa|Z?w(g<hIZg%$Q9~dE8;2e
zdVZG1YH!<Zn#<~L*Nv~+?e@(#-EUA_5tgKxEvK1KUMusPJ6zgA#FwO<k1zX;(MtJa
z5;XM-!)>F}!V>zYv7?a6mF7~uCH1N1*kEJd36$~Fgs_{nP4)w+csFP)fxXAY@_NLI
z=CLJ4v_Dp@NJxl>EiiNk>RxQz&eYmki!gH&{U8jDHx_hkWC~xSGqpaIVu|sroYL!*
z67r=HOIgnVMdzI}JhH5!nDzo3P6Z%1N`+f-pV^i2`_8>gB6d+%l@e$9N`*s1EZr00
z(ily+Lq^QqV@sCY_$IE4h`w$0q?*0vnj%PZDXD0x%By-Ax~r0VO0!*Keb@SKj^aVv
zu+T=Q7D@ode$#AkI-%xZ9>=ZOIclXT&02qJRA>V~#mOJ4{8pxGD9DF-<E<~}er}MN
zOD@qS4O-Dbx-*E;R%XF|P$Bm=^o;`)3$Nu4RgLB>Jcy^C4$1t%9UQ0DM{H(6br8J%
z)*0V{gh^a9b65H0>W)LLDc=cnu4IWdGEG3?6v%ss2}IxIyNc)uyZE9u?r3HtKt7az
z+f09XZM`3e&_3)q8z{sMCsLKT(huz;{}<o?I|^(%`VG0==?o4(wf#lLK2-o(#x2uo
z_I?;2B79?qwvm(IRjG707$T(gMOUNO3zfvBm-O?lc~<xjS)i&)mI9csH}?R{F*9Hl
z)#;?2+W?7jb1|fPjp`{mYRHZp^Nh8eVWJ{gm6C2E6tFk`m+k&%tiO!m7XtvbjDL>s
zpLX;6393Tkl=wpzL;DV-5y2Kvz#q!Yru{ai4#dB`BJ^edSkwO+*PycoReAP7$?jkA
z3d&&N|HUjrSz%}Z3;;Y){kGhHjs-fts>J`*hN0FR0fn@oJPVZa{6!z@2mCA7@etnm
zuQB$wi=bonYa=ir<gX?}=1B``;$$QW`$b2@O38L~rwcc5T-mm2JwhppyOx19CXc-;
zbDHWLKw3;P;TMJjO+=U8zm4_31o6MWtTtSlsOz0QxhFemXGRFU2C@Fy?NN6xgK;_U
zrg$^j$UFL9Q!)|we;oDDdP>~^EO<9AFxA$qk7}mp6twk`{0-<$h9bJEM9%IU;XzD@
z<bczgidkbFBQY5rc12CR_m}BYKOU<O_D_7@@t*@V@jCSH6Xx&}llpmZ?CUX_Y*FhY
z>1SBP%XG!qE)5Jpvu4veH_3XL5j1JPw#k3l(!2jiSpL-<{&-pFY7(9-V*`C)sS$IW
z^0C~aG2HxJ<(TJu8NK82BkW;+Iu9@p;3?fKVfnhnNmPGjf@oPHmidos!wIV~5y;)0
zDd6pY#`T%Adv?$r_c&6Ip#DaDpzMpS&-G8%1b5Z>r7z>R4si1s^&S(Kx|6xO=kL`Y
z>@{(Kx+N9axY(DtssnqntpToF{m#`WwkP=?+v9t)&9YC8`W5<BTncPet7Zye!gx74
zLowJ(q=z+*>U66yx~#G)j}4?N@ca&9R+T(YvRn5d#bO$YuDoEEB9Hr(7bEdSlf;+F
zWZ}%M8W0ysNQcCKm`1hInOXugs6dmrUl9q(Ql?m;P)N!9ipCB6uAB(fF8IrRd$$0I
zS#9lXur^ZIf#*&&Fv3B9z0xvJa4d`*nAi@uL&Rk^fYBD_m0U3mJV~p)G<8{L8-o>%
za%Z3wdG1o?^hG$y^iwNvHY|IrJT4Y^D22LTuOhRtj6&&pxbQtw6agxp4qwoo&zo7<
zioNG5S@hLY$|#E-kJQhz-b-cpA}kD56HtO5edR6^%YE7CAM!u3iPRzDJ>HYuAa4{L
zuu#~J#2^IPVEDyM$d;(+TouOKM;HSGRs)eKb(fZLoj2IRxDISN85vX<*JD5iyvVfS
z1k#81O^g@^!m5<G71Ma1RNYO{HcWDdU>6=wo;wlq;ajMzoQn_^ax0IW1vJoXSG%44
ziqn6r{Vxmp_k{Sbi2aY)4HeyyV^D~FgL2{y`w-6S+gmEeox5_B#~PH&wDni-8`vxM
zN&Uqx@8lQ!j@K7Ztx)Sb#VGh=b+E_cpS3D_NBN@*6{{68Ag}k+ep=dK(|acEGt(LI
zqhaTJ2~Ft9e1IYdXaFC$%P&<XM63R?qqWyYOzVT4Z^x3yco7N`%fVSe4a^)qQ}lBZ
zl?kJJEV=QA#PgE@be#J)t$3TuKCi}iWUVU%YTjaODDZyv-N4i;Q;XOgR9Ww&XvP8E
zO_H7$YY@YoGEI{WC3Fy#vm3?aYh&-NCmn~kM@X;D<?4+|e9uY~)2-Rcza)@pYWA<{
z-Jm?k+Mphbx+AGU-TgVzOKi1NpI&=uUG-SwK)nuI9?U0OC2{j*uYvUY>#T<T8bR6N
z<uUW&_aaL6lF#H<P8kpIvUVaw;6|+vD23kY8i)ZxPNmaK54-iDbuK;jUa&xm4^3$j
zOGK-?qe9lo?Af{`Si^jD$eWD3+GIms^_XjeQ{`wZul~vRc4#-p;N<??Fi($yPe0|B
z(BYWF=qHgu-1f3K`Oo{3enOzoix%U>K*j6V5M`o(H~eg)^?mPSp)OhW-&oo^0^h$y
zpFa*Jl-GZ%Y4;Rc%a#MNFj}Ij=M48PpKY)Uvz_9{{!@+=6*8)&`w2`3ItYrZezx3L
z(6%eD-g}t6*~Qo6A`Wi}aLdFK9-lMsLZWa7m$}gc%gzHz6l*67$>hH6f5m4osuygo
zfcTDix|&@NXK*aGP*{`|#lGa1?z2@b$Xq20@xS1L!R?<Wl>E?|0Go25W*6=L{40Kf
z`hXXO&X{A<RjRG!!EDTz&v-`?KQS+fUHS-eg$z-3xE8_-G%}@>oJm6#Hk!MRPY_B_
z<JQp}DmmZB&^EI@poHV#n6ya{z$rMt9*Oki@Va6nJb)mriF$HQn!I4r%H=zB=zhyY
zk493|QTAyhTl$BNRn;z?PH#uhl9cUa3Wx+{En%J!dIR%+4>SKQt^E@c2dTNZuw|pk
z1ATp;^YHSjH+?i;2Z+BP+w%DOwvNN=+MeZYEuwCP0T`;dZhzb9V*y5|b4EiKL^@OX
z$_co6-5S;sUC=F@JNAskAR2m)X7{=fW)4jjg2jbI=)eJ|yFZN1k<;h3%MHCIM_L`>
z<Xo3f1r9N9#a(UhG<zb=)I^z-#KcDOtFX(J@K>>xPo1{g7qUc7#wP@#W^IG*$M((v
zGCSg&fFHA3(6Xs#26~!mPxaTTpDU83F-Y|!!*-LhP3g`ijyL!l7nEKrYjxygyE?Dt
zdpx&O`0r!ew(%PMH~ejK^knCJUW7VVBfN;MFkR{tVi<q-Y;*q&a_~VoDBd2@2J2Yf
zyf!lMmE-6{lIadx>_nGSwt)+omm)&+IeYQJK+bCa;bh`7Ap&xHq_)Ul$_D!p8;rue
zNts8H1JL=6t(&^=g9C;>>wK=2DA~TxRlvL3z>gt~p#zu>e879gsLGx2@q!l9x+@qV
zstx;-_$~WSZEz1|Niv#i(oQ_Jb|T=}w&w4ewfHhwV)PgGEwrM6s^iWq4Zz^>jNldf
zV`{h9S2g57-O|0K?j0+mn&*R$Lg-tdHjXJ<1lv2_#;ki-HhE~;`R(6i6Fyjf0&h^W
zR#`67<StZK$W*Gq+C6^t&7<2&&nA9KKWt-+g3~#QZGfN0zreV)R-A4;1*Kjv40@|l
zlWfGf0VM>B&~g^3XHVZuC*Raq1iTc*5Ro+obF+uq3*v6ze7ICrYH^SRD|>jI@mbsk
zd13GOG&5){Vy?X~D_B_|Lb^<p@*#}g^`nAg%FRr{^O$=pX*0|eA+#If(G!+4KKh{7
zd%8kB*w-NaIN)!xk`~VdiG7Cy>`2@G=-Mc+h+Aq6AGg<F;(P{AXRP~ijgHQ+C7MVq
zCl*$*ySspEg^;&EIINB^Y;1{w<LcaW5;zIt|9IK`elGJ3dwug?mEJ$|#eaz<e}`25
zWMg}Nq312GNA`D@w!o!UB7A)O?`iy%=k6mix$#gj#KqoBAC#WWU$SFoXQ!c~V^S=N
z&e8#CLe!vIeCSc~2{xC#b6dl14z6OUGqw>}2$ivu?S)>C=T9#K;=Zts*+i_eI)PTk
zP0|}32>U9?x~leq?eF0q+T2N#TC-x#;i-~g=S!uDw0J(o!*g|5T$#kt++ExH=@4N9
z`*30b9f`1>a6H~mI4}*F)Xo=4L6IG_zHRL@xCxVRo^5OcI@_qSNkv*&4KxrV_L*$M
zgVgPYLxxt()}LvEL3YbsvA(?O<#Bi)IKYMHofxtJtq#;jQZ6D-yTcx^O^d^;e(+vP
z)zhZBf%`-9duM8JyI+d`Ubcm*uz~9FXP+>XgMK1cyCIpaQ|S}SGd7M?A?&=bL!4&w
zrjW?@p;Yekv4G{97hvz#cg_AoiMDF3_kevA^PBi9BYMFV^L;_3iHgv<2cQEjIOS9f
zoU-V_px(raFVZ5-^@v*m9rB4!x3?+D{ZbF1?2>3McTp>S+Jy&wdM|3mE<=&IpFeoU
z-s%9r^L`5FN0wob;{Y`!L>%xR>D8Z1RMN0i8(MZml&Y2GvCWk3zvkM<n9UvjvXe|C
zle^<Ws4VOxc_kW6yQ77Q^;G1ijP2w`b&6XOG5tf;WGpQ@mc|aT(NBeSAkY3_iLmjA
zrEm=HZt@3xwr~!+LgHT7>#YYGYZbix_qT*sOlDw<1H(1%XS_^FGEKe{Cf*zPg-cDS
zHO>?2MOxk-;`pz$*Ch2+ZuHvrjGiK0>cVnf9lR#|xK35L(1xz*X%;`M^8&3fJ^u9T
ziD+OUo<c5w^%JU?7k*;H2b0sO?roa|GFm1ViKjg~8b-^u2^)#bSDpY>o)i~cMVvei
zhaEkh{RU+2ZQ`H}EXi-;;QvgCe8S>!g@}v^i4sh9DvdjO15pS7A3j9UDW_&b`{x)8
z8bRk7YRyj85u}3HHq+%`=srK0G4_$)(X`ZmbP|Q2PKT3i*WgGtUj$zi+#!Z`_}>IA
zj`lin9?EbueUgR+@Abf2O|$#8e!VpT`z~JZ^<t5V*T7Hb31>?M)+f6jF_MXsdFsFk
z_Ygeh(3^~fiDi|#`YyH~2zY#=C&fpT-SUu*`3jU}aX%k{OIr*+kli>+Z;;p+cR$&B
z#$7Jb1QTqx4}PR}G#M=-AE+gbIA~YVs%((}1y8<?B(HD8SM@{Fy^eWTkv04LMiDw=
z7iIQ8r$6ksSz&~Oht$K2?tpN-RpS?Ip*$@<cVaFOt8BN5Tfz=I?%_7?S6`iVaDeoU
z^upZ-Lu|=B?BVwX^MLzlJentA(8Fi6+WABo-?yoHr`JMLH%i1*nY>_c3E5j%RT16p
z>`#i@<+D+iW0of3?fkW@_^Tc-ki1SM3k;ye>zKsf71hv!S^77sR6+D>hyJOEf7JkV
zy~v?D`&s?mWzlsp1vOhOn9&=qBjEc%vvPSYL~cdntxp(c=mtI2(emStbddR&5c6m@
zz+gYU-q*n&0d6F*+g*ozgZ#GsJ!G!ss<DCT@A!AofU4xaJJYs=4%?&_aE!3&U@14|
z1j7|Cn7rua&R7O%J8qnPR{0f>up{o~l^3nAxpny#G`r)$7wbS?Bbx`*ULcl}dzzVl
z#NMaK44f?y){~gQWvO(c;L`x{4U*ufQ1p&|oj38ABKl#bk$+GvP~&AIer+~>lSkNW
zOA_Jw6gg`rt{^(S*U!1$Kcr_gy@Yn2yqGpLz?rP~qZqkP=zl=(|C?)$!vlNE&U;UW
zgoeIWQ^U*@_hIWV_xFc!a&j82G!}O{n8O=N<CleMm%oUM-#IXnFlm?Ov!sZrqzm}2
z_Jk|mR7((Hw?PvfMySVzZh40v=0Qyx46Q2XeZm?NncpA3gXD*n#(c2yi}p|E;~UNe
z2q_t9x=v{<&#%c|{Jc73Q^_#$$J0;hTDkT%z_2$7i-O9peSsDy`CE-n9%OvWtt!Za
zbYj$Cl@ni|Z?>dDjrhUo6q>B@x~c1fY4z@_P4k?<*%nxI1dNr}`NAUis(=YFS>x?+
zpj4_d&1LK<X;)Bpi#>NdP2vEDS9hh!$O)Rjz6*s|KRL|=JL3aUh2fj%sV&uR!5C$y
z!t|dkH?&i0QCsarRa@KGEVIp+KZePA7q3R-!)Dv&!sLfraVXZhrko*eC%8z3%n4@P
zAuXNsJ#ZCABWCl)KdP*LcnOe0Ld#5|e`0?`pGOx2WX&tPf%=EBjXRl7uqu|85$_IA
zsva+;#}5hIb{(IUU48f_jlGg2e+p}<0_+rA=w|!b*;Jqha_7U(SP1P{UO>o5P{qlh
z6$QgYFWL*Vl5a_p|1>|v!QQ90rypx`vlAs9IRIxA%f_p6_NVBdIttm0?A%BS#D#c{
zKN`pCh070n@Bc^o^1DX<LyG)QxeP4|ssUwP`TW$$9G0*+7Ub0|zrQKzaQh)~V9-H`
zC{frk=q5yxd5R<?3d2~YcYp7<|AJ5a>mK~K0yCu?@p6CGF+Xz#s^|5_PaOIFJ%sIT
zUdi-1*u!R4?Y+?(awWGcu}`He8DcD~tm?&Tlsik?DcqK(YrT<;UN>Cn>FJo**i?1Y
zf`T_?9z`A6pic-02y3G`lG~6f>R-Lf&<3>}sZeYU_Dg>R4EwW9<((D@mWhIN>2#zz
zVpB38Q58D0za-+{WVQdrjr>kt^q>Eh%HsVe>hwP~a|#O@76y6_DOEML(&j91txV^u
z#M9%0rsuHDWHBWgp5-zUg_xJx<|FRYSM%mSVA(_4|L(>9j~`FufN?2~!Z$WsVc3%I
zS^lPy=dRVV?b@t20-Pc2iiw4lGnnH32StR+EdRCT1=^DM-|9gqtOrF?o1oaE&ffsM
z{}KS-1Ox}K4W@99A7AXx*5tVy%#CXpZjEHgN=W!|%_Kpk&wnsSpYVU*gIws?!CGG?
z-2Z_vtcyI^ffJtwqBnjsclprM5Pv6<)F`~3EL%@YenXjx?(&0NI6!MdAnlVBXto-9
z6omLcNjxaTx##ya`hoRm?@`uI*?n1^Nat{V!2RXa#ZFagv@6kMmQ48@K@gW#Ffx$u
zgr5<5JFU$e{`Hifa&+7iE7+nYY=Tcs5YKA`ei>J{K#%!YC5K1hN?zytWhEu#97-${
ziugHdyajv5+&^Pu#6TKIEB|6k2N_{pOc^(#VKl!ZLAtET7q(Yu_ook)0KNIQ6iOUP
zsr;&~9d2lNqrl7@*Om+B@;t*ip#J3BTN&+AZS@c*Dn7S`UdTl-K(&&4ex$byC5B!W
z9oL2jzeWPj`l%jZhjA4=1?}FxqtPmLwJaw&ujN%Qu@T>1#E2PhPXg3z*+?#MSX}Ta
zA%(?_*N^p7%vy<RS&yMFj@&6Yo72tiYJ3fY=I-B3+vt8GzinWbsC1AeT<~EpI9c})
z)!?{W$DXuV#&(t=@0BobhboY#<a$k$_BbG}$S&Z}@rd<bhW&5m{67Thf9?$^3hC@e
z7NUkdEi7BECf@Op?$iKo%(~y9bOp_?$-Mg6ixZ)9w#y^qAlqo;ml2cK4}F@1kFu}d
zF~23x8y1hXK-Oh1!nA>QI&$x4EED)JbYP5Yyf~mM2T$nv4D40n0&mlfUnGrG_EvWn
ztw{FK3=wB)Llf{<u}gQZ{3a_aFmCuO@;7*~4?}RmH?&4EU&t5V`w`QAw2xv(c(k(n
z%*uW=;o$ZXu>sW8$a^|gpBi4TsA&Ii?w4_n$WC?Dd9Df-KGgv{ZfO=?Utp>nU7C)6
zZvL*=msax*Mvqi9gdV^hn-!d=ZOrpQi$rpp_oE7B|6{P<L%h86_YV>K#;L=eoTz#Y
zL|5|lSv1JM0rFpsZGR!|G^AnFV3Jw2TR)p7d;US$hMc||wM9S@jcqx9T0c+RifyKD
zHopVmT-0(T-dMlJ?eo~GDcy#gyJM5>56-wYJ2$0@`lC&TaO>HQNkw{+JfvK3dGh2l
zi*JKk1s!vxYUGnI=x|ZcS!H#ZX59BZ2G5aWzUkrHUb^Z|+CV;}2Um2Tk1YY2f{eX=
zFKVH85Gs|wX(ux|<k07VXLT;;9HYf0@jB{qdlaahto!`9RCZ38!LqS<y2*J?e<88d
zDj0LnfL%PPOwl%z*&AjruBR9En#55t!Ua9)bU>p`loMa^h*Vm<EXK;31C`9y_5Wk-
zEu-3c+jZZzI7Ny(v=E>;6!+o|#Y3^+P`tPoDDLiV#e-9{L5n*Cx8iQW;iUifU3;vx
z&OT$TarXX@50H$RjAYJdKKFfH*Y7rgG4-D7mQ9W%Uwz(kK|m;pl*q^nwlrhMZ6~7W
z@4~K$*QgUJZ?DQV?4*1D>6?C!ruc}j`M7Iakf!skpj8~p0tP31!ttD%fle`R3BYKt
zPJ#GCMD*CNH@5T@y{2<7<h0Vh!|lbJNK<mbmc~MOG*pO29^)n$S;pbp-F+XuF1VSa
zm1PNzxL;~dv`DBf_|fAYjw>R0JzZt(n(|<fUa)l=q{SS$U4>|;y1Qd8kYY)^F37Vq
zT7MBCBNBeqIPYrwRB3BjrXzFLl+YwDF+D}{I;&j7A@LkwT+@$vSwkAJeJ4GhT1$}N
zEwT1-Q43eGLOU*V?9Pk61%oV-P(8-P)f=%m3mREPCt&%dgPew{qYHO1gK?%p&-tzN
zk)HI90hJP_#mDC*yx}N%k`i0RDxGX8N}>q^KVku9!BB>(>pbCJau#Wp??3%2rhVT*
zsXKT&q`?xht3o-|5;-3((?0#+OeS}c?5zDM7hnx}xS@!*4>Cnj_jwnG4Yu1NzMSFc
zk1iQwU<q{(oD(bIFdJmY;K}&rvtr<WamTzJee(U4$F38rn<LlZEH>WUQLxh~NhG5-
z>U_9nPwMOI^)q9XzDV9*pafN*<1KodF~X_xPsF*v&OUkZwCV;{*ZbRd+0H_QRA(Z)
z?7^0a3DI@1HXp^!GZEN39>MfH)pa4bt+XhkKBV!=hWyGY4~F!1w;R)Dkq@cm?vcYC
z`eHXtssCx`dhIo?Q~be4+!dz&%JD`yozfNDhK#(J2}>JaM=I=UKI7>ZEEvmeui1>-
z-^6Z2%`vDrct7IrV((#Y9?7g_i+5#hAU*G*+}x)lC@LX?*1#RR7GM0$N}j3bz0jUb
zb-;36o2*^M5*!QKzFg$o6eTPC3P;{!3#5LSOozz%KD?N_!#WXyj>pd5o7OFtkZ((E
zT~dy}D~#g|>)HgY2n4cQ-P7s4_L80){qxzMS8hM)04tR%pSQl0;xT03cp)#V8E+l&
z<j)QqD|A&&C1mgtA?uj98ALhS{xe8nj>u?tJbM=oMM+*3i6A-ytjnQ8T>CkN{QO9D
zc_YRB0z24ibt0W0L^ak$NXYxJfW0S##K5p?n)p8@?xYTHhR7qwWei`pSJD|@RVKL0
z?~DYo%oR~X%?b8=v;z?Dmq@<Mp$(HQ;|I+j7<7=(kqgSY#5dC~cV85uI4E^|uVj)o
z{+3PHXDAd*1c0)s9d9lKdW@5;;CZSaozAr~@jYH+5J&F^b#yD$Y#ie(MYSW8NCue-
z(k}Pejzy(@kRkdk;KSj&Dxi0|h!i1awtMwH+W#O3RQKQS@vpGrWcd%NLYAB(rCO9A
zLM>RL>4#{`qlZLW=)3g~jeyMa(=*Jb*#c#qJ2h5e<ht&JLIJFJ43-5@co%<N9*9<#
zx$vX~LH65YN6qhNT`c@^VFahueq-LSUwsF#-#IC0=2p{`bp$X74s_d(V3`~G6rO+f
z-6a0<NX0iWj*x|+5<sdf9L|jfm|h<p=QOhFEU0|sF1=0(gTa1T@8+t8Ps(k7Au;Ol
z@w17*`juMR{^{G~R|3v&W}o8oEf((a_cfV=4};P{<1;U86kfSX3yU|M1G1zTa~Ff=
z)UpI+U+o-`G9|GA{ZJK8ZsL9;8*PaD?CBAl@L)DV1}3pz>58<7_5WZv=O+E0$J<sz
zM~6I=6`iM97cgCXzT0+@1{hMTr#QBgyxKn$hpz&yLB=d-YdkHM<VzhqMO)(C%T<%H
zS0m0(=5}=-DepoOIw#)}FQ508eUC|XGAH@6U2vhDODS;TqI#+4*A~HAK_9S?)LFzD
zX?JgI)}tGlE%?UcJ&W$uI`}jqc_CI4vhwld_2Ni@DjzR}U&c)85KIDkRR8g%JkvOc
zy6;XVR*~Ll#Y{${QthQ#E6}*>z_hf<+eMB1FdC@P{+8Br9yD2QDVI$oD*EltZ!*Y_
zmIb2&9@_&<&duhzCh7f#m9Q!<QOj1PeWy1X{Opuyel(`_Mzh2&<Z989`Kz$M^wqo<
zE&UU*7jDG+ld?kXaf%hv`LBOuwyb2>Ggg>}#B&NdRq^iD7^2gis^mo9uuo+BE#gQO
z3MdrZH7|qFqJELHi4Nyoi%GXb|C2QOzlsoevo`X^7@~~U)!OU@{Bc2_#1!`A1WRxZ
z{&le;&ILM|SojRQUZOCnU~QAKgqo#VY3H>O7`fcB7S&w3p?+Qd7Oc5jN2kJ~*m+C7
zo=Ca-li=uyIg&hx4AeIhf-3*k<H?<r=E?LKR#)K7DPiMr`a)zP2JF;QJbi3T5xgP$
zjY{OxZBtxRjl0Hc)0C&mH~dZoroBAGW}O(V)mb602i%FL4orD8mZ)B$@fxj0Mbmis
z)&s#r$7tD;pQkM5upv}Q<ppCKw(buQ0=8Ad?%Ii~(oymsb91C~1<)825qFAf;?~1^
z`Fm^2jyFx>OK&90+<n{8o(k)`=s3^brkiG-cXaFX?Kj1X=!Qpq?nQRqoIm2XROLXa
zB{)RAN8w$E*Pe%MSb+=LGHHxiHHUj9ZSqFl5aF|%bHJamG=xrGu3vF(#~LNN>0V%;
z_f%v8#|ek>S710R%zPDzKb!~BBaCwP9`=%zy!PXK*QJhDGijgxPv!o5T)XV@i3T|W
z4Qp<U3_bg<G?9$zOwth1i*bHtbxe~Y@6l6v$F8e{0@cJU-MbZQ?j>YDq~#ujY8LkW
z-y*BEd9#I5%|tsGorz>Xi;^($#N_q>Izr**ZzV<+H6Fb$9(2B6{o476G^ANL$F_Fo
zNrsW0ly?E73|@rAeG%;wo=Y09)W@H{(EL8I$9ejTCf>XVq&*sK(>s`}oFaWwz~_Uk
zaK!MfkH%u->#Kp5ukJTagU=tf@XcYB5qgOwd+A5c_}5`5d|o{-dW)!{Ugveh(PG^g
zcKJLvj9US}O`hk^kMA|hy72cO_TMNUdfoAA90<M=^kH4I`~8wRbAd!^*NauRQB542
z^xypzYwT7lXO@^xpssseISq;rI4!W(c}*aZyL3wi$-+cBMf<ko^AeoH51Z^efn}hK
zA{?9KxihFK{#yvEfxXC~9H8jk#vCDy%IM*HjWNWjSL%iJkAS*5UaW*sr!@aW-uQ(p
zXS_i<!xoZHe)z@6J@VZXZn6RTnUhQf*N$V;*+)t$jd{jF-oKMO$%chD@Vm!X^`yH8
zd*#3x5+@K8DHZo=3CptAu77--Srp7Jw8Rf6MgdDXo)tRF6+77j4bxs(_|c{J=6TXZ
zt9u&-?1L_c!Nn~SpDO9_4n@a}E@<TJbXK^PTR+v&;o0a%Vk^cLdU=sTToVwzx`(=d
zX#8Za-71gq<y}><Qj6iK`7`+8VRTfiKQ8q_04by3q(H&L)nGq=2u3v7K2_o7bz9eN
z+2h%VjuBA0*zd;-Rm`M#d=8eT;#m;86^Pv>w4Q#6>C&J3{B#edS2b&gM*g%gmm`AE
zHdu5EWL|~KbUAy<B-QT!5x=_K0ZiyioG{Qqi-4X|3X0*1ah{#p@6ZcaT4jkmiW;s#
zltnDfTcN8%wN7OQIRV~LC??Hr@Wnq1G2?3d&zCX;I1E;9yZ6mmb(Cdu=2FB(Ro*2Z
zj)8VGXlOmdJx4$V$oE9LOd?et1<}8&kj2DJ{TaoyHs-4<TlELd*(X7{w9`c5PpZ~E
z4v*q6T~c<hJqb<yNbUp<&<a$O-y4cJ=dNeBzP9z&C?&n5^n%S{k+<zhoPgE>`<2LB
zol#DV33NLxywgB+UKzp;?w%;UUiIP<yUI0Pkw{Y@K@0Lb*H24T>K&adRUw^SUIOZH
z8!>KicKfv)c$p_2M5Klai`oJFeus*=6cJ4j@m40TFZKCX(j@fF*%UjI!Yz7Y(8{{*
z<$jw{(fUCfVb(nVW1aB!l85xYr_%Syax#B+T(6uaY{!EY*Wpw<|8*MA0;`6}o2YYb
z;^tJz-&FRy?g3|SqT3ne1C~AK9pfiol=Y&F<y7{)sSJLvoP$?XJ|l&a^>TNy<`snm
z*7PAaiJ#wPNo|LF%0>VU6N-Gb?Izk#(fZCiK*tW;s^8;GNLhpq6RzNjMe?GR%VskO
z%IQ9Iq=@C6EAhLQVwwq%ett>Z?u}q4^%EkRR@zLTy;?6;qX*BOx*FPCITdr}vO+2A
zsZ?$f*2>X&;HE`h7Z$z5JztJ~j$%5zz5vTjaEv_MpMvP)t7BDQa7+GMr;u;|i=}a_
zm{;OM)PhC}y0rdH#{MG!dML=_HDmx?yNX?az3O0atC=#;jo-^JZfvGFi6rtR<0$06
z_bv|#qaPbz$y!Ul#4vb!MmZr#YV~R5D`t}KcN(U<Jnv|gowqFfsy~l_nbBV1DFgD5
zs<PO9J=!l_4&6LL(ft0U?NBc^!9f_g|D*lM_>*icCxML*{zw955TjfF=T%+6mfM-o
zEwXF%KJ!uC%32s7#XT`ETa3mNXqf<ua_+~<;^dpN{u9@(3T(lcd=y<cz83Dg{5R7C
z-rzymk)6i7wCV9wseNa0-1a+*&5+c0=rLo%xbY{!b_ku^wTXRm1D4BR4cmc8>KaZ&
zccN<~YfxWWLyD*CYt1KkqBUA6-V>}aZ5V1c5PQyuC`cd9OPS;O*BPpFfLY}Fz+w5$
z=Y}0eBt}chN|bid_;=A;@)B?Q-LLi#U$O_C8m#mYen~^2@cVWGVW=XwT<pHS8UUSS
zKS`1K^z$=LyvB%1z~db*DLaI9=@oJeb<qVFo|JL+=c`bmEvtLKuP8t_K*H2Xdx>*r
zH6slfTo`ZNr4KvF-)wyUdsMx@28<@39BnmpAh^qnDe-`(@5&E9h4w7~Q0}klEtGT}
zO38yI1U6FGu-O>wi5d~I@HDC!izk+WO7T<CE@Npod3cB~I675j1I%zv*&<slhhQ0>
z%V}jE&^`&bLd*^*_lw5TKq+#)Xx@}>Y^=!=(U(<3s;s|umH(hM2_rZ|*U?wNJv@C9
z-fqp5ZvEm>I{Lwq>!5gAeHh?(yqBhi?K$9k0lN2ZU_eXYB~~~ojTabVzo4NI+|s4m
zi0<fK%mXI*6Mv=s#2=|Q5y*n(N<apj@Cq-gF1-Hroi=dyl_-jQ9H`Ef-<?w8YVgp-
zE;O6BOD$wnWsw8T><f>y#6^2*+K>05&oK18jRuDhN8$@<4uC#<yoSu+!2$c+E@s_`
zN*wt?$QE2*>H<-;P3i6U_N0aBe`;HIUwW3MdhxZ;-Po};{6}t6pa?&H+*%vOm0xuz
z1V;2mxt~T#o>|-gWi4tILGft$Wmeyjf2aK8K-fztcMHwnmFqXQ_KutlVb`d`(3Z!!
z_~93Ji}d*hY=TR#<r4NX`cqJ0g7LadOpWigQ_+;M?%GBo+N^#D>cuk?ehfjn-<x`m
zXq1-%nr$jeoVB0w5E#6U=M&{O3;WXh-o9fY2T>4&&BaIvmuM$wu;b0twnL}b9|I9v
zcXNn+)@$I%J$MN-`!VoQuzZ}-=|n))gN;0ON*NxTh!W^N{)5yOdHT(;f?i0X3UqZ7
z{a(y)_b2*Q50)s~mzRRsC=Q2tZ{Q)zlGITefF->^@`#GKA#z_o)!XC-e^b{KrPq6@
z2Ud$~(w9tX?m-|bSMs+<b!Pw>KKc%6z9l(ul&XJ2WjoTS?`iVFJ?jJha7*1qEG8{{
z`000*%h$~^H7f>eZSt^h7Cm@EFk!?DgPFpy4Ec5<_1E*lOUHl(w;FS2gx)i5OY9*N
znX^j-Ig4qNCBGKRKA-*gA3Ne<WfEY{Uug!VDgpXlHRqHzxHiwbChRFlUcK*b;@0eH
zEE&W6=2`0;W7Jl_OEDICjIEs=irkT{$&Dx(Xs*$XJ~h4999cm-r+HeG`jsKIi3X{N
z_gdr>`cTzWY-3S*{NU}45qIhElMz5pkF%_9ufrpHa=Dy%mcv#dQd!DdE4E3p#X!UH
z`Ex*37bIV}Y^D_9h+DA8XtfGXMV{*mb*iwq=g3T;>S8%&KBRvi&8z#w13bO7Um)|z
z_Lc@mXzT?=y#)M$3)p>eS&u(#F9kRu(H@Z&Y&&@*UMeYNFE2RzOPR?=eX*M|xAR_;
zK@uwq-`JS__s%K1Oo9)G%{OCI(7O?CwQAY~;~62DjW(knb83SLCH;&QM)8^C808)`
zpYlRCQcezkp65GL;W=~K!~|S!>HLVN-JY@@1URXTufjEg=*ytt4k6u<*6#$`L^Ou*
z9o2#*;^E3rK-RakaukKDBuaLK*WCnri>pH4jvbT|nGJyN?f^-hj}z!wMA;D17A<q?
zVb6r7dqeU2M(1_e4~zHT=jb7>%kW{LyQUqk#Cuh54ws$7cvjTNXy@6j%j!P4DGZ-?
zydIGUbO$l!PNjX6TSyx|mPHSm`K+K(s)^;HgN?W~7FWmjG|m<9r0FM@s?%Y6X3t?B
zh7(StT9KE*;)SEJn-?|fBPd7o$*k|V2mK4%LFEeJBd&zBi;PIAn+VaM6+g%^lM318
z2d!{*`v`wSlc$0_F<oU&=$EUq{9LYzY*oaf#Vd&zi5S`evkyOyyIGu>M;m9P<|;?y
zBkP=Ht_v&;vKnN_y0b)OU8-QMp<1?3fW=pzFQ#mv@|@KQF3<{Y@x09WPq}dj+u+AH
zOsgV2F9Ipw>na_~nf?)vYq1^w3PT%?Qol5)Yvgb12(mk3eAnb$F|X<}u?m#huyL|M
zBIPMlRLe^Ry}!5rsjBA$z&J)?0Hm)(9E#W~gs8qB*k>~d8kj&AGmr`pwzE?yMX5~O
z<{2*LO70N45vjj(5ik8}GyN@J-=myMa+7w4gICP)ncHM#gmx0i0n%7ZOp!{Bc+W(A
zD~x8pLux7X<@HJ*ib;l;f`&aOCblReXJN1!m`tT75S0KzCk&j-iw8i<D&^6A!Vs|V
z#>>6v>+SRqf-bhis~#HIf4Q@hCb34PS9(c|eWLPgX&G0NLJ5{gSzlSKAF`&E;e$wT
zVr!6t-;7SEHVajfF>-zAz12P&BwrP&WrUu{iaus(<$G|)tHf`;^r}km?C8_wv2K!l
zo8*UZ(jRT9tsiGGUR91t!|mlgK<ShISoP49f`Ig7gI%ZE^5cPiYe*MIOFJj-ZKs&*
zAm?G~G=U$Z=#D&$I4UBW9&|_VqfE$(y*Y)AQ;KhsvlDIEyMJH6vc2R@y?p%`t#R^X
z=0)sU9a0-~q2OdC`&{*vNOGR^YTRf^PY>%Xzp++s^r7@S_VE)p8YWYn5hStNRB*V{
z30uW(Osc%aEOGT^XP!pG-7c^1ThghErKlE@f{52gLouH>FiT|0*$b6bdr{$i5q8k?
zD(amBC1<~jWZV*ek*Cvx7Aa}><?cmoG@Q-U9EWgl-CO>H31}kxX2i;nzi5n1+7-WC
zgWxD+tS8M4usSd(H;O8X`&cqc#%>N2)L_y7G%s?;JgEC(YoA+^tyQY|&VS}1eso-k
znfnXvBM@kHOc(?zi3Q0}^qr>DmXf2vHiQdnDNjB9@YRudC9HVhJ*8)@dcgiQS-_LN
zpG+fp(YVjLD^Dz$2mq@6{6TZ6YpN_}I`D{|V!(&|a}mulX@VD&Ybn%Ix<Mp_Y{r^5
zkBN~`&HH3~SesCP_=*E;WmbCRCoj>H)0Oq)x3m80a=ao!6n$Xl9rn|YWztP7s-7u)
zIMT)&8^%hUlz$}k#rVe1PgMukh9`pWpt5h(S%hHKaQ-Vn;Ox1r12v@aNLR*_ZQ2nk
zpI-guaOxgq@<3v>NV5f0`AiQHX=^B{e_lXfaiBhbxz!n{TZKiuQb!t&ui*=OHb6TH
z+0WCZhh=FH`^?$=5`G5-wpntZCo_K=n2Q3_8T?0VU@D&#IwA|s%G860)83QQD!-|4
zOGRU0!#;3%QV0_dCiuPAkE$~~Z-VSK{3iu+UYl*7JUYnkVRmn3byzc9Ug14FsY9ug
zNn(?shqBnW@N3d6EIDqmXK=7CloQyZC!H;oSybn#BRKD?lm3wTs6=2vYt!n@e8}cC
zdj6w(-)xaYF<wVUiz;xSVPA3MD;d-<xo>dD*7WPJDKOa9;%cBDekkX?Cu`aYA*P|m
z8cG`y82pG2im@aWA~T!n!pO*rqrMJt7lUK!DSP=lHe}W%ZTh5Nlz(%E4uRV$d?vA9
zeiyRlBZCkA`rQvXFCC*B9jyDnOtnZiMmbstTro_a@7d!oPbpHcHCjaTKz8i=;5quo
z@b2X|VQv5az41BidF;)ZLuUPi)MAaG9CE_CuZ_rOSK{zWl@+F@y3qctBIFwy871Jc
zZ!n*{T$o41>!B!B5kuv~nN=k-0vwn-FS1pJ(UFb?t|<SCQA!fs(~oHagjO!Gun(Vs
zzA)N9zPq7KV>M3kte#3sfgh8MHp0YGKx!of(np?hV-H}@wYR&&!X;`a*I{gX5G-Xh
zX~a?ou07_~l(du`+d=C=oM7TR(F7wYfrJyc(D=b%IHVtYMNNNwZ{HX%x8{68?H1Hl
zaMxAjZG@_V79Z@&1iJ{{zm>iBh`9#b<RtH_DOM3m@5NpEA)V|!i^T&=;Gv~S@xsQo
zl7*E|l#LoGY(?P5j)Kdk`sJL-hh2O2hH#36n6Gq>vloX-3@@GW?HNP`S?#U1Pqj6$
z%W2?2BeN~_w$t>5+wAO+Sm-^I1@^THtgyhsBk+Az7QFyZ*`{Xg0`msr&1B<?(qX2B
zoP6G_WrZUqmVVkz^iF*Hg+5<Yhx>X(?OLX!(>Px}R7FQk<*%?z$&8{plRRf08=*8M
z?`^TMJz{me#JcbVKJ~O03th)AuNCjOBAW9J1{Lo1vkwugp-jLXP^ft&X<lVEt+Kas
zkx%?6iVY;z+~zCzVYkg!^yn(=>-K5C1`V0`F*T;sb%Cc)ku76gsKSslN1SV1&y(4C
zNdtJx1#AcqEfz?<?EI!ZNP~NF?;z(P&El(U+nLj%n4*48Q??rB9!Uh~KWE-h*652^
zSkFFxF;*xyiq9D;s?b8;a7CM~CU~+=GH~;HR$_FpWJ!)@_E{5Ro<qxDyCoT9?gttj
zssU#3A(X>ME~(1a{sb!UeSLRJr&So(ql<}x7H^9+L^1(bBu|z~u(Uvxa}AC)bxKP`
zzSod#o&jc}qcxF60Aw3EL4WxgDIB=3C&e}@O*;fs0V|Bd3PIm>qkfjgIyj}$h}Di5
zx#EZM5OId-?7cnHGBPKXZP84PLyouOK7=3PXRN7(BtVWQC9f3v_r1eh{&_wb{yZhe
z9q|tD3%^FTpw+M2eVP2P*N(_uX!EMTJ%M<N%y2IVBeo8g$M4Aj2|{biGI97kO-+|n
zpgAJmY~-gT70qcW4GOwCAyc$1NKZlt^PG@I?`I0SY@yU2#eZER-m47)rQ#$0O+qP=
zEv7@izm7;~R%pf*!H4Alo&KgbG=e@;{5zBT-zDXz&V<aOk1h;*mqYUOG(DSi<Re~r
zVhN+fBKK^Fl6S_dss6jXn;2o!C9=0`LFyShppTn$mJ1ae=_Jtg-&ZLBm+(+DSXWVH
zqvcc?2`Tq3;$|3`!`w5%<Whjr8D>i3Q~ph@7uZixWT1gju~<{J!ar+50QzBH!P%@u
zQF~tiTIPM?0w&2hZh!h7@g4rRVwvWxcFG?0EiAM>C_?#wW9El2DR*U*=g5~lt@0``
zuoXE)MCdI}%GPHJoifchB;BNXc!aDu1-TIm9!D(mE`T2{Mja<$gqoQdqqw;EcZxRu
z2W2=yRO5GoAe(^Oali!;tAg;HVikNPH~mizl>d3o67G!~e%1y{{r-m}>V|XJa{~Tr
zf5~Bl^PXcfGb2w=W8Bvt;#qTr5nn<4i0P(RM5-r4T|Pr#Vj3Ft=Xiha;n=e3@Bi=6
z!2i@F@=W~qt^XmQu5zYYqM(En8km+F0$(ErJo6knK}MEe=jD}cB6Rw}y?pZja#sHn
z7yWn4>3^2+lZF$-;4sa<@iusF)Lu$Yk6gt2<~^Loii?927aF4?xPI^tNUTITOFWvK
zKeh=ZmRPM%W@bH$|Kqe@MLvxxbJfpS{`ptpog70NQaBu&WCORfc>g?a_SwmPbLhu!
z3h%|%@|De0+^MT2DI`5JX-<B+eU>a@R@F%&T}=qrDW2pl>T)YErqd|X!P#O=NqX|Z
z<op0}vS@m41O27e^~B)9QD%2{ci|Dm=UWq_zg|>^VBC&P?2}EM3yyD)O+JuK9g<C5
zl1=>~o4O&J+$EbjC7W6!Q-8Lem=LqIwf!@gqH-rT{$-Hs<`xAV@<b#-c=*}HTHH(4
z@RDL_hraNdXo5b;;5jyX_i^S@R-&3soJqpdH~CnnSVo}5hv0Lm<r6}Syz?_-OQG2(
zBIltGS)5XwcrBQFk*>m@^FGEsyw|Q0s#<LeOvx63^8x=-S5Z(oBp;a8F)>rtF|jR9
zgM)|u^CR@#2D*E9H;Hj*^Q)C{2a=Uj2V{H8W(<3GzCd0sz2JWyLYWXUQdXMaQ24nJ
z92)U%1O94a>VFuC&kb-WW77ZMQ~STf4|V^d37@RtEia~je4zi?5&A#%Qo)xw>HqLb
zHU8x<KFo=u!nC{oH!((O)W%ovrRs0`@~`XkU+?zs`00NUr2dk1|G5DELJx1MgZ{5w
zPJbb?XNIreK@HLV6{?=p;fLM8vwt35T8O%%{eM?b_{aJup3STecWzH<6n(zp|NC0w
zk=Q1VJoA|6Fi;6ofho(GJsM1Yfhh35ZjS!t<p1vr@jnT}3sl#)E2{V6(+fnIxROW8
zV}h~nC2jI-&_q~rBLgUA>Kys$dzoc|d*EOVR~5*MCbki&=;l3QhN%#$1}i3WOu!4;
z>i8LeAlz03<_ZGd7sdVv{6h}d-phTE_fAL($U2lBD`nP8`Z|JhXd3U(3=yQQwDgMu
z(ep!Sw)h(&2j#~vOzBpv;7P<uAt=v=8Dk<FrpkJHVjM^`z#1LRGyFlQ9n@MVR9H~t
z{at|(dulBce!or-k%L_n-Y51+3L(JVLOTqJqH;=LygkQr3cjLG!VHIOTPkY5|KgJW
z{#dtvfBbybnX(^4SCB&XVLcIysC(sZy-woNhiiNrE%Uk^D~w$zVPNBGN?~#lyyLjo
zu9By1kLlddNw@WA05`4KyPpJ?hOmMr7U9Ba6AiMfHGQsG9S0aIH2IvNM}Q=n%^uVR
zX^ju9ZG+!Vl|5^eA+<6n>^-g|hvI7Bg~#`I8DstRzxWuQQ&4$^T9>Zyk)7=#w=wq%
zbg~5GzvRhP^6c7)kP*%at;^oR^TnTt;8Y9XP+^?4mRmjBa52V5-64upqDoo3fD!n>
z-54CvKoE+0>#M*qlVWA-%Ld&Di;3#9Y%V_L?RT?dGh%@PnB%#2KGWp|xppHhmh&=H
z>RJ{3QldnRBc4AWWpf|TE+?Jqt!6QlNV#IqXSE9qqV9IL9Nzd=guu0e$1kG8$ZnDm
z2AdAQSCjTn<p>Txs(pT5t4p<-eR))=wI)|jL}{4i-#D|MTcv05NM|{bkCe`1BRNKv
z>wDz+L$i|rqbZZxAEtI`lfZ13x<rtLLAP;pkm77=*W5e>9Arv*N6KRpPB@~Q>-ZQv
z$o0i~83u0u8nJ)&En>$tl4Oa}_OfJc`kn}|%LtDj9IJ?X!G4=sHXek_!I|SP>W&QG
zLN&&QLKUE$b67Nyp1D>^U&yj9f}>g>HXRf^%K{SA@{_}+g2w_pqkI0Jomt7IZQoBc
zJHEcdvWo7z!XG=BD~l;6MOfSQ3<2m@(r5H64p>kGU)zPa3TW|>oV~G=gA<V+h_laj
zz&(wk``T3!M<5rTd><~Eq3s;lM6S8*^d#4>FC{~Ob?neZKBoorbQTno`EDoo=zA-~
zMTR|AJCW2dWhHJ7^M1R@t9!s!J<A;ij65eyRa$tWMZ^n}EMM*dYdlK?DOwx0>B=1D
zs^&QWk6-_#hl<)gln1n*98sjskM<R2`1Adqf2!m!{C=eHG&DJH$gjj5^F_y_^-H>E
z3-k2XmdF-MPDpmcB>o7pa=*~CO2A0tz-=o2kkyBOGNRJ@Rhn^&c`Jb<Pi5PS>t2LD
zch>p$=VW_`f?1JFszf$3&NKaG0qqE9KnF_^0he?{>s3@MK|Bks?1sR{B(I95DYLca
zu;5+OdXk~NTl%x@Yx5y1^q+KAtzdj%nd;sLU@uQ{$K93EZWM9g1a@~J7d$%Mcm*&e
zLE{;!TRH;VHJyY*TB(e<g;TEkpQ^l_UQ66riCG`hmR4GM*3CN+K%J1a!J3Vn(2M$j
zqYxY(0ZaRKvWpp{j4iXVB)_eGJveY=@JNj^pol|bOMqJ`Z2w{y9<2Uv_V~Z4`wh7K
z>PE!T{|N!X!v33jBr`MyY%~jUPH#aURecv)JRReVkK-N^dz0es>_?%<EocmFt8~x)
z?b#^D$+nPRwEbeZ^#M^e@fm@^sTtj<$7`_PvpP_AIPet~sNM+MnQR<If8nY-(j>*Q
zTr|KG;_HUxG~Ak-a3wDkep#G+H?g8)@0IH;@+dT$-$a+x>JYQ<$8uGHQkQ*>uVQx6
zAP(kLIe4kGIly<;mj%0zhpkDl7`5*mhWKl{-!-wcT$2Pe*j1qxam^MyrJuJM3s0(H
zHwq5i+1jM>BC-f#_B?b}Piignc~+WKgOW5wFWDRWN}I+?>xYQ0KwgE-8%58A#8z&Q
zSTo(z_kCfo(S=>*dp~~*gH}-KD#4=#|C%}Tj7<EI-2Ev{k=aecmu%<<eEr~P$hzC8
zvv-xoN|3vlcop^Rck4mU<{-+h%L$*nCTEfDsDmiq<O@fB7@RCtDh!naEHkLAOSyQd
z3O_Xm`sgZ7NV`!-clyY>2&$3++3xW86ojGImN89^utTm(n`)GheiBqz_x$c`3rgR~
zip0Y6o3So8Bk$@_V#_9CqK)HE6fwIMwFVdW?)dc->LV=@CS7`Z;Vu4uEx7;eUo65-
zSfPr1F^v4=&ZNSv*WKfrB79ZxqfFN-^Cw=&k9XH%*a#BNbKD;dA8UyH=8>#Vj>K1^
zDJINfMe0MaWkeJ5#`kA1)3?iOga9}prH5hwqpgXwT_MX4=J)jSwx<1#Z@b7g`?36C
z8wpTxqEi%;M-acy`-R4XXiABwar<VpJB;H%*DSAY(6z9ftd6b*+;v#acNlZtBS|J)
zPr;6raMIQ_3f>{MS|K}XxGRW>L%YM~E%v<2FGyzSTg4pIsMVCxk=}>EI$mUn2<J9k
zhXG2MeR$*79UQq^+z!4gKVJQ4@7onNeSa529Id?ElG`7ip=LnWFSw`nb#%MbvU&pZ
zGqUvL&wW7+l&n^(yyvnZU_!;4W7~?7n@hcV`&FE*yGsdP3W>|2i*f6ZZuNG{L=xAc
z@t)tB67<*vngT{$+y)mhmoJ0GEXFt&49U%HYl5YB7*Z+mX^#99E}0bdtb#^KNiA1v
zh+1N@!#S{5Oe*_1E{~UAw^(><Ao3zzTq{cLK<bQ$s@|Mxsx%hpQkekxWMprlPb3+;
zF8U7UXf3-sCh3Oc!YVx#-F11~=7e+tLGt-oHJ}`EzbNHhYd=)Zr8f4l5lp9L1LN!|
z;Yb}3q-BhLlgJ?%t7bmD18$A$wjt~Bc70uE(%c9Gy6%ZZSt|XO@t?c~$Qit7@ULT{
z9CyVie$(BuelN7j*}!w^=W)?06~)4rys=s*AijzRuw4j3N4^;dsu{;WYK47tlkilU
zzvU%I#EkMK{(4H1tVRi+M18X4r8{2Pjx2!5A<5QAg=b=kIW3;i*v{d;V**vDOt!a5
z#14)*@^2*lJpCj#o_}q|W`f|nw}fo#Vs0FulBiJ)-(95jR=<T((6jY-$5j7#EW0+j
zSO58<xz#4X9~o`ur!JsO%%O#gqEhf0@`obCaqd9C?xz7{MB}N?Wp2?S3ML6cCnJUH
z462@=*_V9L?XtZ<69st4V|p?D9O0CXE)XnZiT0#xgHHLg;Cm;T%l$IU#k#rO_idWT
z-C9_fV;{kqClK=wUe`-p&L`Zc(PNbA<%w!p$h~lVR_|n`CPew3mEE9$qDi>%mxcnK
z^pI<;-G}ujz^o2|&8*iEfe)5K1#*D`J;m@sCkegY=(_7Ei%^88B<_Lyhw3-hE5guY
zxobyvVILlnR1^DOG`Jfo*CyqI4GQOY?mf>@Q4yCD*5`V9(cZ68z=5fghIrkFa~sO&
zN$N>9x0E*Vw%3K_(4V7-w!x9z{=YKfUzD_?+*>2wzs%ei1sxrV?Jnq&;WbtEKrBKW
z_ePMGqT0gg2d>v5TiuhrnWBL38t^Xxo=UW%97HAkiX3Y`&m(BiQlpNJbk0_i=-hU^
zMOB}xOcgJxOjF8wsGyYkjs?CJ5I!PX<}X%6#Or+!Te&h8^}Id|r%c#3I+RC=G-!-;
z_(j}bG(L3@c8oV?OdB?YlPvm<xY0>*+^g@UjiRv?8nD9)y(OKwE1n(J{mToeLK$k;
zJqIeP*PqZGhSiN6v0)rS@w#Ecah?&_91sI;T$X!c2xt=3c^^ttOk~KgkiLd?F#(Y9
z8R0O#l8-d#z$i#&3HiAxpQ@9Qt53zL=uOT#lLhZ6?Pd6|iZ>bB@1FQkUtw_W8C-yP
z>)}g$X!%oV`#kfrRtnATauZ$)8+;-wYkYT5>(Q=p33f0u&|ej6$Vhr;aM%b*nl;Bi
zJIl-H_aIq(>@g_7=L^qgYs`MA;5)T;8$ZE>ZleRsV4i|xll6O3vuanNZK~7|<t#em
zGPmz)+a~PR<tzeUlobeU=z4YczB(RCA~=&a%I&ixc~w!^RY*4(6tK^-s4a|rzNXoo
zk)i5736k~TnL79|F-x2k#UrOif2GV6=UKD2A#3m8w|ndhkYiGKUV7uG14eP)|3;~v
zY;t&(km~%vM@M=8IzgGdPu5GpazC~EPi6^VxT3^!U}R=@+Jrsw<h%TRtY^jE$wIRm
zF|P#5ku*z?KB}+`dBt3eq+oYiDq$k?QN)#bT^rMbopC5-dk96fY<r&&#30B)5y<h9
zLSSFqVh^2o!kRnMpxg+H$*65Se$<)`LtvXWjPIb`+)w9Tt54Fnv4pI+(>ZX<(0ZcD
z5XHF`7+{qbE~HT41Nu-V*rK?MEVw{)uw`xw{ByyJ3_A((zt1to8Ipn5l5wgJg8?I+
zzJ@LKL5}wwU_oyZe?>6cVxFxGODe1Lud0Ma@FtXyfXC!uqPv-BJ6joi#gmn5@zR~b
z2cf(YCBFbhOpfLqmV3R!VR0El13g@^wjVsXIz}{)niQXM6#&B4kkP<Q1DB#1e}-v#
zNkj%>9QrR1v9b*j`Z1?CCOrA>+^nNmJ-2~w7eblp*-Z38_i7Md#oOcc>6)|M=~^a?
z3OdjoIvJEDBm8U=IoCy<MUnsO3l(+BZhp<$PI2&9EXZxVJDh&!HsDeA9dy(6I4&68
z^K1^XNPH4nr?b1I`USgSS_3a5CsYLI8RkTf6N5rM=CC%!s9UMvrSCt5H1k>YC8*B8
zsMO+ShT-zCDk@K=9bb4s-hJzdAs&Q%7$%0IrylanzP%l5+0(N7FdiEwDP!E<AA>7M
zQvepEBW&H=0JHH+F^-*|V0)l*stfO)w8dbm!17f@oq%3F?-4UuE$CvVgOlgY<$zET
zQ^?Am8xpdQSJ$^ejxb@#T7K&!lJx6bHkTA$po<-jfaRtCnX21ij9YM=7?pFDF9unD
zK~2;`T@nsXnC&IfPZ}O9LEQLBc-px|j}s`M0@hwxiZrlw=GeCTR0gW+6nq?$@cLEq
zZlg8zQXpDlrz(L%cnyI^N*W~GVD;FKY7-jXSKJJ=30L{06`y(pfGVhriZ4EGryi2h
z9_1X_%NV~eW+97iEYJoSS;~Kg96ulh*w*uFf(e9Y!%{m}v6dCJKoBqc$n;zkmJp_R
zR8IdD#gz6<=8*iU@hGs0G8?oU06C6=ES|`J$aI02OZ2pY)@B9cZ3gi&IH0gw8JpZZ
zVf4-RjUoXegL;{gYyoyJ@tvq_`1tfm8DJ&56xmczDrKhPm1OtVTXtvmG!(LPVI6Q$
zwyo#$UdEO54((3SyG8h=lJ$UGV3Cn~G;Wsq#Pdplni_o5EkpeZ7B>MT#S1a32~(@C
zN9baQ_yPnjcd>2nDTtlU*?<o&Bs?Oc>>MY`0qq)6;C4B%mxT59yJ2~a%P*V|gI$-G
z2=!i5o#ht)jQH?Xf|!4$ko9PD^aw%Xa_(EtjiK+7Yo32|rlo&x0t;%LbU2zz8>Y^d
z2J_~;HG)ZfjK^;1Lzu(T$&WCnQe14os_S!=*rAdIx2qXYzkOmPKMKxuVPnd~bP8}o
zCnJ0!2vAz|k;Qjoqw*I)=Ha6n*f+*~j4Vu6a)4!KY3d0X1+kI_1D_v|8)o++kQS4A
z9%qk8b|)IJi?jKH`{Q^WMK1-!YDs-C>7zgAspzsm^#!Ad60e7l?pZS(vF9k6gAGCq
zz`|~cpC7;V=nx*Zx{EEc<xqrZr7xtOU0aoH5=PtbN*D%CKySBs(C)IP=X-MKYSuTd
z9nT){FZagDE~s*f>g%tK{^Rb&`ve~(E|F!_U`1vw(4HWfn6jfA#|XXGS35})L5+`L
zncbaMLs;M$GICjaTY-Jp+l-VjQEBbATh&SzmYbRLxa@3=QqP@{r*ok^F1Vdmyxa;O
zJ+m8oY&quykhWXF%#c7~cO1ZXKAOZ5Hb3g!55;Hbyc32p+X{vau64AJ`yH88d=-cm
zdlbwK^rvNRJnF6wMBy--Qo|TO!ivICsA1=mYoXWGuOiw1Is)3;4;Y!erbfSj4U31E
z>yNv^NP!e0-_XhljbqnA^(W&mg~{#Z0)~3Lyb@9Rfctqai(=!tH6#hx6yLY}S=iGp
z5u;p#**o{E+g9%s5Cw5wKYtFWifT2AeWX)#L@yRFhI9GfC}w^M#j?c&)nDUp-^j@C
zDc17R2X&h-Bi36_ppz1obBJ=O%3Hh|d17sEBiFxI{<c*PEXBanL(aId88{l*6#+5R
zb)cr4vwFBv63UF3D1WLKZ<HIp2^gW{KX_3Y76I~Id(%e&jj6fE1}#CBiA9E9QKY+d
z|FVq%+$Q%3@?&U~(|s(U%{oXcFZ^KQRtfp|NNKrj%gjvK7WZ9uzqHtosC(o-PoGGC
zw_?S=#<@zSIt`O$MEUZrI{2v7U9Q<9U<63%jE!9IV<lU9+^`jo@bZacwT4n+7$w&w
zhlAbi_WhPq=vBZ3@q!8)C$Zg1AjhRIw=O@C@O`~l#GTTFO8`PecMvGz#`SFKH5?gM
zPw@d=p{cq*`SGB}YSq(51dKJ5qSUoETA9n=h1Ku9ELS|wyzcAn8g>P83mG8yvJt6&
zNp@YS&>h@v4c;5($L)?p)XiQSCZdEFdn?rl={#2c*>zga=>aTqJV_BkF-cCC;~kDN
zyDD{E`4m{dI(vStBmGb-JQRsK6BQtpaDWA1i7la{0%ei=mLdDLBFNF6<xWrN`_5#c
z#re5jI7zQz{2`?tFRuO~Hste(?%;h*ry@A(2SpXboWsp8NoU(x<aX&u$b&G<0jgk=
z<Bw)?m+Mh(02Zpp#*RPP(Al8i>&=D)_Xh7SbqL=@lZALJ5*pujNC7*nDQzlIrml_M
zB9|Hn-0<wez5Z48(TDqKf}b^UsljJSR6M?+3Qb22^0=;Tet|A4E5L)zz^J@9s0`7c
zww233fSF*Rp^5&-_b@d|e*Nr^kpt%)sSY-$*AP;Bs*2a>-BpNElpeLUkM*5LCkQqB
zn(VHC!a`;9M!`FTSr1PmePBgmBj*Q<gNL@7_=N_>w}^|IYLlVdLj_m|X<8v$%Q#eF
z4Ntzn`*$#Pm4<lu_`8-lUx!n8jN@7rnoS-x<6K29k)K3e@hxdF4nL6F-oS{Y!Rn{V
zi&@D&hTgj=fJFv%K+PdRRzdTh>3Un|;e*}Oln&n*Ou29_x-s3j$g6exqPt`yjsYb|
ziv#1yJ>davf_g{*ClAfba)bNsl|^i(uKXn7X`4>KK0RS>`z#RH;vG8)<w=VQ?T=JS
zm@s)TV2;aXnw$#~4ay698JrDMlXpYc3Pv){Gki;)kH?8`v)8c?m1RCV>wD!HHMO>d
zazBn*I;Yd|{MjX-u3-QTcux1?qOFZ%Oz@3D{swJnGQB_od|s{<(<XJzH-oyL%xvx2
z$pC<y@kpZrUY4pp%-+!GI0GA)tw^nC1y8>-=SbM#6SkfA+AxYPo^TUN(aA3o!~cJX
z@{N{CqEM&~*wJJJR6H4=RXt(v4jDztLXj&@*x(Qy$F5uPjr{{m7tTy7;u$@==*~O^
zGU)5WC9{Z6Q8{AZ)nddor2wL(hm(yxU2Q}<B>5u@W$FP;-_ZN)rn6rM%8b{-Cu=%j
zPVY@axr8W&*&Z$CsVl|}hGVbgF5$3@z2*ZKglhxgAhv^Ex;(5%HwfOdt~>EYI^$ev
ze3oJt`Nb=hwyKTegObxc9%S|!Ep(o4w!1KmojPn*_oQJu9(5v{U?u}Z{eIhLL5B#p
z5W`yWDl-U7&NZ+<M6h|w2~&B3H79v{P!>Gzgu7W%UA>V$#?nmJmdiyq2k#{wQe%=?
zxCde~Y4@i|rpkKceUQxDm-CG*$(wUr-ehL=%IsdH+;QZ65J6)*7)d_qRAz$O0VY*e
z^?O!3QqCmPD-_?&<-ltvN@P|26~Bb(T1s2ZpHJTvx@`5X`GX=lv`-Z^!L-L4kX9$Y
z6DLY+laqL7i&`w#bDw6wDx~|<;PW~0D2|0;c2CrJxqG~M7;Enb{W00btoYq_oUepL
zLNOcl_c)m_zTlygC%RJeA-Ax9UxXGBhT7mx&RWn#EL;Z8emit3sS}KL;kvWDyHt!r
zI#(4~>~e5ks{UFjL-AKdEMjS7nZ}UpWai7VuW(`6f>JS)Gf<8jyZ3R@+Z3W@p-_)^
ziQ+6iMd~uK@{2SfyCY%J%wNk4PY$-!nOyK(p${Zhn0z><#OROe|9x*?bQG^x4p*J!
zNg-Ndl!T)+QF`U?#z?E8nV~{z7H_m^G%NUjjFMI<?=x?F`7ugf6%Cjr|F8Pvzod_U
z1P^son8l6rY6Ii>-Q0&k7x4VKZfPL}WtE7e9^E&|&-zsa;FT{fljx1FVl?1)6VD3K
ztIy@sXs!Zq1w6QrPZMmGIONQrirUEOt(NJqcWOCZeQQNhdCB!Li!^G&c2`I*Y2P^h
zQBj<fGJ9}JLu3Fh!MZAKB>>COT|M0cvV19QG$Fp(;c)C|b3m2@?^VY^{g3d5$gdPO
zTjLH$yy|ehnq~H1g>MeacaR_Le+fv%d4cDBi{9-p{%DGT41)6(I@3X%apq=QkF`4=
z_5)bD_Y<1x`VXt~uRk-)egK%lv6%nge6zpE&*wQr-HE^>OgF?X1?m^s<U+q@=U^(1
zswAwef7Pykw)~|3Rg3!z;WmYAzgu-1+0@2Agc}CFxR~Z?$@~@4{sX4)AA$1!CAj^Y
zT>7j8(b}rJhReIja6RpBue($E|5z`s1;u22fd@FN-~8J#??(pd2&5TpJ(DR~<#0}|
z`L_(@|DQBKxI-Z>nHueK4wZ+gE&~t%7sf>cK=#owed%EKiU^gvEhH~ZapvTp??xVq
z`CMT-q>$pBXjQ5jF2<MT@f$S{5{Ozo^h|WT1xG?~xds>)A6bM$1?J=85~ec7$IDf1
zU)2XE;IfNyk-yHzD;)Uq9lnmmK%u}$Vh-`Uj?@!Alxn;O9O?AOm+wR|*WLTy0R^H}
z+LUOyl6d#rv3VpsK8wFeeCc0L@A3)|FtwI5xTx_kc`Dt-OHmC;MpEz3fK^4Od>1;@
z^|v7XlebzX+x_b-K2WehmVy^;m8-d!S|z>sn^J!9N0$vQm$uV@Zl^D$0?N3QR_@7z
zLmJt|5d94~fu+;bZkjJY1+di}<+j8aM@yGf0@Vj?GcWnRnNyG{JU1q@I(<uN>imoC
z{ih52O!eIIHw`;4Fxh4+iU&V8Rf(+AG=3_3hcHYb=PrJ)1XgA`X2QSC{jcq!eRu`^
zm>)}Y`fC_e<6t!CJWM+dwiKRUT!SF|_6$eb1U5W@H}N|txiif~m#(65h$%&!KMf*G
zhxuFZg^Q26gj%+Z4vN{F1OlE+c8qFOG=k$t60G~=TP_>H(_$f20>n0*=yc^;5ci^u
z>b#@(mX^*kt5MoDvP$*vA$|YSb7_C9^g`w)N=)o8S1&)+m=YDiH|CJnu&lhiJbyUt
zLSdBxKGHTPj?GYnm?UlO_)+Hc^js;)8lKDktIIyez&9Y*9uz_5A$H@!YsoFMm)C#Z
z;?}Isdqg(!NZIS_U)H2XFc4*eqk1H=-yXiruW^rHaX#YdUOC_|9?p1WOF?0oF%mpd
zpdG(<PKUP%7nu|G5M&{QohYe%));rY2l*uvz*M`Rk=!Tx9FDalEv|Ohm?M<qlWAdl
zqbG%rhYHc%pHm`;Ic%BlcK7pAjz3|f*W%U*t;oF^K0m~8>h9UQ8{dV#JZia;vac%z
z!;BT;e0nNeoW}jml`A3@;M(1CSO>8^H<oAg8~`VY*2}Aq&8Cqxm}fDj;~g@~V$eKg
z-rhebQCx;~;OX@{3^Go9;Sh`<tQk(;_X3q5w<!R`HRv&_eVi;Wgi>IeeZ>cX33qCc
z$E)q>iZfDIn9Rrda(wF7i}om6_Tv^ZEm|MkqXscvBhUwu0u`aYrA03ehaUFJab8I5
zOi9g+NkF2ECV0*l_4`#v@2>3+nG=7V)XOe1&ghC?-*A}NIUlCZ^$t%K-e4;(G+-=v
zwv10wV0Ks1bKL7^0@h0dScH{(@@43a*j*6ogHwMwT-y$Nc)k(VK+2ejKpYmTC;p75
zWu)a^o7fi|Tt{gaV$oW9sG;ahz$R=6JAdWehbgt{(o|Sf3%_nb0k$Gmr~;U&{-x`K
zD~`0~mVQ&%qcSB=uBo`h<-q6kLGad3a_ZGz`@8a&q-826f_NBu%@oNZM)Az$^4yEp
z@w{y8#ziby2m;uiCb^wEuZlZWVrRRaGC^!&AGVSBP5yk)z5I}SPPct&|3r7#wNaRT
ztWi_k51V)gZmC6iREo?s%Z)h}C?@{nj<3Gjuizpduk@U3!&(*CcuNj+cmHKvC;aI3
zWawo<NHCLhvR-oUpxx;z>KxyZHRHI?*Y}bHG5lw$r0E-cq^>t8$T+I1X^ew_-nXb~
zp~!gE`E;aFVOh=&;d{|^`C-MHpE7B2aLlw$-L6+kc#^mLd5}$Zwx27nSU_|9CCI^=
zR9-n{ADc%$hsL(k$MrSl{d#hlSXiLzKxtUbh76o^(94}OY$-s-X7qc4f|>Y+p0d+|
zuV@Y?CMK*NY-vyf-uhZ)TZ6Rg=od73$7t@y-<kS2;+MPauW$T`-s7M7{j{TMN+A-N
zStm*y=zRJ|tnGHm?#9D<J?)b}_ndC8m!5Xh^2gwJFI`EgB)x(3jmyzIyI(E3Ci^g7
z-l>3g4}0$q(R}8KGS+OXdodm@r~xC-?{W!eCy$sHI57vtE%U)QimzR3YV>WGpHIke
zS}Mr-dC6i^*)g*fRwWo-%lIC;wc1e^0WjCMazOgl)x?Ybl=wcQuVw~uASV=fO@T77
zMz3da=S(*8I#^!(5!(iNQw=i<I;p7exd2tTjx7%KdW@RdfpID22<PQMcWb^Y9=V<l
zsvZBk#`QTfzI(UtC8lq;Pc>)e5Bu{M_!?om$jz<%5Q!#)J06jQmB5E?<mQFXV&(T4
z%^d-OW~a^>829rYvOk@*4|V6g(c><B^3Dv9^jkkHw!d8dy;MiY>4IFSXNT9n(^PP|
zAcpAiWv%h|w_z-^#rPq=!0Igkbo6t;O@b(6-O3RWP6FX8rjuS-0Y4Q<S0sVB4t*4v
z5)#zqvncm!%kFOFT@lvckXFnJ?xC88MqDT|?1n`#>YKVOa&q?8$ynvmSl1mJ4(>Yk
zSY(W(`}w%RqC29mNYx>a=G&qg{YV16TlDp_DG>i?Nbe6^sJE8j^H<DQ4;IFw*%#EV
zN@M-3eH1-asQ%W6Jf`QHq+2zQ_7>oT0Cux;L`6z&+yrTP!~ULi6A)2)5G`*@;&tD4
zzc>>vFQ9vc_62A8bJ)zGMRDk3q{R%CB&eClrli_9Z-wUA&{u|HyXU4`!~tiUvNeF*
zG19d{=o6Z@1*~0pF$lwz%-vEH2RghodJw9J{!QJR1J}=nC`JM&2lDJn<c$!(ew5`0
zB3O;Sg>Cu0RZI!yzgLcUtF`gSv%S;bwIc8$ufa|7`-KVpkzz<-J1w~h@7tOhiO7<<
zIk3r>^@nXw=AYFzGX9STd3ANKiF5#`^NpO(0xJJcZP)$QWU_^&iqcUKK|zp3mlm@W
zgH$OZO+*yJl8}I4*boSzhu(DQS!{%^EV5DziKvi8kPaFkD#ipt2|*F*5KVwkZq)1j
z5AOHOFW)!kyze|`-Z?Wre9xJiAE;l9Ztdo^&_|J5`rm}_D@rvbs#n&MWJdI=8uOE~
z26%a?WfWn49iSlUgGBg{bP{~oPV(*JL)KRtmFr5DtV~3p<IIde=Y%OWgf-^S<TL5R
zMH*p6Wydw$Ge8l+Ol-GZT&Dw1NUGIJpV$+=5-)vT-!)^riWGbG3y2Z44b(>pb($<V
zIC2#AvU#b9OIIcpFl~`rW$JCV{(k$nG;O919~6z*{e#$8z9;82Y6^ytQ)Mj50TX#r
zmHr7+Pmr=Yxz63mPH?YPZ@%n%zgoIht~zkPr_9ppq5N}Uqj6QnV~Mrx6JrsIq?h-J
zBqy8w@wpqyI2fVXSKBK8vE7)M1|OheTa1oSKdkD1A5(E1Zy4ea1Ez1YlstDD)OLVx
zR`!<*@$OlJka}?7kgx$JZgxpog#Xqumbu~2<u3O~JyjUC=-;Z^b0PXord5=4?j4gd
z8!+B*%yYTBI5hBAvcfR0;8MBhi9Ri@(-v}lC(RorErqyxfAzuNK6J+iRrbu1h}^8s
zwBbe6q;J*b-m}w+`S^%3c5HZ7^A0;{eH42<h;v#~4;zb6dz6v$6=ip{tya{C$#sXv
zXx1DPmf6uIRXG-|CXN2W_7`UYj#3z$lNdpzm&QJg*4{mj93*UHedSYIXGYyc#Y{U}
z!>l|TD-Ky|-~F=@hy4`Y*~3&#iU(vR@2R36?4r?*b{NyUKZZNTs_~(|8-6<V+y1AP
zQ7xbwSUATziQjD&MtqX-HG`zL?vT}Y3G*ZtrT-5?bJep+f(MEA@d&m$7xqdMShu8d
zL<)iSVz`t`1goM&)yW$ti7{23Z;VyY&`Z~z_53EdXklm0JFK)UFQerk<ArCOx}}|0
zOcMxJqV*E-q)yVp!lHLlC+(O7+kR~~JPTyS-K6H+i;C<i<x%01@s9_o+cSp4s&43X
z`oR<Hfr&bun7#2g4TR0KB!icvFTl|~B9|wg=RPe=f@^GEER7f%p9oi&@|z$^yE-ru
z(6I(JooAHHw;pFti!+!T$Jd6%G22_wsH+;!ufa6N9@Vpal34EWrqXi(14f`(%g%Gp
zUVs`@2hYE^@0!pS*Cj+|_kSW-krjPIhr$H^=G)xd8y!fAnw<ySuWzM;_=C7N`M1+9
zg57XkZ#OT<_lt-{E4JW@eBQDGrqfrb2AN?>{79Ifj(J;{6eRD89#T@)3M<3?yItn&
z0#6`llf=}|9^>~0AIW$0Pd~revoN~3y%N)u>XG{gJUO@K*|6N>#V0^~g%nC{Ska=X
z0I#0+Ye&ub(4Yg%)p^)tg2H`Hbysh+_oP&`_b^8EI=0;)&cgGl<z+77ZX@6Ob*xyC
zbl%ATDzv-)ON<X|VJ<60|HQ@qwi5}=ud~)pQ7YBBt4Szvv*iU}7fx|{X0fhL>Ue4o
z8Qp36<jCO#P{K^H!*7$zpM}k&okys8ve?y1q)XD#x_qxL3PohNiIzR9Ki8H@{#Onx
zUad)*DsK)+Xi1y6*8TZY#}Gza({1v=o6;E0sp`S7RNJ-afXFY|K(z_eLBuKDG3nw=
zl-9T>8xkUJHotjxondBO^6ydI5nctX5ELrQFNdMq*Hj1l19(x={MH-*OhR`#Ftg<?
zVZhh0v8CbonUZns;73ky2hBN~6JjQ3<wON-Rh<IZ(L|`9O0GF%8o#``PwRtLCoR;d
zSLSdUX&O4!0@_P?LDsgxqdf-8tNwYwx1Fv?g>bc60Yo3Fzi;Mob1#&`hMN>hz9|L(
zCu<xnmzf5JGA`y~7o!+KwsQYY8Qy*xb${LZusO8%>X+T-V{^kfdKX#>c<w^gaU)l^
zf^AQQuAgTNIavo>P}&kc;`d@5dOPyfN7iEh1XT194V<g`_t|xgKt*fXI0p=QtPtwK
z*xsg`bSYB7U9V`x75Ngvyq`E{1WZbCmlW2o$HL$Kb)U^`^_vpgm9k7vT&}rBBqt;+
z)+A<vRip<q<dylO7s1V9e%D@}=tnf&QFqwI%0vEP91B7x!r<tD)G}WsY1KR{rBctk
z>73Qd(K7tT`$(6WCPe=!a8SDZLtX12b5#yB<Cm{To#3!B5nNWNMBFm7PdNUo1DRL?
z+6#Q@1lMh3F21IrdUC^LU5<1t%|CPu%XdkEH3JsPZWWA0!j7anAV<=D!0xRw!(Gq)
zI@AhJ-;n7F;CV~DL)*vw9j^Awd~bXR$F!T^n9+3`sLU&*-{0rf<KrXATJt&~8hXZ{
z^CsFWyXCx|Q%Z379WdK~8`#GJmhNsxH^&dzF-T0!+6Xt)jhsaZu=b)-M~xDFOmi!f
zjIkshF}ykc&lLU?1he&eiU`N$(AR{!%bK<GH75SeNe;kuy(&fy;OBE3kKZ6wkP3*a
z_`G(uEQviN5@=EqLgBrMne49Au`u5@!nY@(du59x{#>!kSOSSdagXydr+TSVz>$3(
z^u!0ECQMjv6V!g8C75MQQ&Z~t6W&QIAVw!2Fx0W?&A!X`=N6aH!i6|ax9*XY|J=8L
zNMeJWLHe)#qL(g#KtU{0ji+AOr-HI4QNJ#r5XUPC9tn>`xfTPiob<96GLk+giTebJ
zFzs08Au2$P0kBaUOl<7$1$tmFawzK#!<e=ZSlHxpd$n22<`|<Q#%%N2bu5Z9-9LZj
zT8`qzM>fNy4L9cI`(guBp<!}GEeAH#RYd9Apoc>Y=y#bbvv*!ms+PY@IGDD`2I|}`
zj%$)uY?ZYS;IQtH^l`d<ffp&(pDIdp`aa~8W(Bfc$N;Z=3Ka{Yj06rhU|lE}wXv=F
z?7gn%b@I}oaA7tMdJf}t`h8TB=KO2zSnL^FpGfO&1KCe)UUG;E4r_+*yn&yq%Txv2
zN*(&!JCw;&g8J9*Tm39K<q>ZEoQ21SgzktpR<h-yS&#9qN|eqKha{IJYeR;4@ts3P
z@t2Zv+YXr+dX!!bc@ELJRyY#q*5CV)3z28JkOLrXzZ_DZe$_x;yV50y0fmfg&?4w5
zCRa(IryW*JnK$~3)NeJ8XcCIdtFS3K!0O!K{iyH36>K!CB@zoAVVnoYGxhb_x6*dX
z3M+7oS1R?(?ri*CV$E;$v=2gK71i=6f>f|E*19BEg;Bjm(J3B+yQiwTFSOb5uHN>=
zkxQaAK3!;FP>pWTjHHnsfye4zig>#o9!3_6lWMj~1(h4lXk9rhcc0o-g8e0PV+FK!
z=5|B_R!-9UuOglF(Xl>Z=0Mv+&jYe6+*G9A`lfa^v%zn5sTJ%Q;~+{h|1=7D+B~z?
zzU20lc(?e4Md4**V&1EJCUm2RgLhIx2v|r7a`PEv=D(jFv}+5b^ZkH#kU>2uJG)~f
z8(i}{*qPS(d#%#@OW#2HjOpg}t{)8tw_hSkXqR)49yE4w-M7x>ncC}5-+k{KKyrJG
z3&ln_QmEmG2G=W+0u)HZPn7S5m-Pu`q@VtkoM6IF0y;!Ma0!0kTMj-e2S`KgU%1+r
zpVh8bN6UUdopG*9mJ~4jbo_?-ePm9lj~*(~A^TDG0{7Y;V=w*s2T07|cT$1DkI|_y
z5<ah2a-!Ckt+s@c<2DrEm2b%)s5FnCbksb=epG%3T&`f7?*+5Jj5T#?fZE!79MB0J
z-*gR9ZeL4+SfvDtfX}4Nixcg7*g_D#l+w1UB%cJ|!{NJIrC_Nn6_4bEvC^agwf1_U
zfrUOAl~pU05WgpC8xKtROojh$RV@Q|vLXZ!X8S&hD96wFfB}%q-OcgkmAC4<nZ?Dn
zxE|yG?Ly|UGwm~9xLo!+9o7Y{>#0lLX<YeO=-aCcxTWQ23EO>#Yk2-e;hdCezL=yx
zW`!kR+R(BN2J^(YvQ4?kFMmv>gn!t&cWTH5H#Y#mw?(7;`C7zL$D3NPjG0E-%o@ea
ztR**@{6ACWckOqLCjU4KO-zqfaK5RvQNhM4P3Gk_b<e5(kbasns@(Z!&;--ejh6no
zD!v&gi~h_&-!T2<?){XM;5GAXig3v{dHrbOLjMOxHbP`e{dL-$hT_2!8G8heqx}Ut
If(<<FKYHVS>i_@%

literal 0
HcmV?d00001

diff --git a/docs/dev/pictures/dds_security_crypto_plugin.png b/docs/dev/pictures/dds_security_crypto_plugin.png
new file mode 100644
index 0000000000000000000000000000000000000000..d314978856dbaf8f10b21028c78ee82bd1d93739
GIT binary patch
literal 514112
zcmV*pKt{ibP)<h;3K|Lk000e1NJLTq00g=K00WH(1^@s7_D4Bw00001b5ch_0Itp)
z=>Px#1ZP1_K>z@;j|==^1poj532;bRa{vGr5dZ)e5dq33^FIIp|D{PpK~#8N>|F<3
z6iMFYHpkoBoNn{&eY>~2x3~Fj^SZm{95JARfFK|uh#*14oWKB>Pz<Pu3MdE?B<CPe
zkSIvbFatBBnfF!IOye*Df`Wqf^Y^!_13leUuU`GDx`GOL@EAn!1miKNxQSrzzyJP#
zSXo(_{Ej>xWZXosw6wS`mYN!i<m6~vz8s0f#BjvNhaxU67%?$Hh>8k8WTZdB!~GBz
zb^#$F-new>9D;&8VQ;@)en)!Gv@VvKno91OOzwG^+%u8fGoIWtj@&Z_(b3W5o{{99
z;pCoS<enkqo|niygAfo9fWW{&`CWSky+>$hXctqy&&7)u;pgXv3l}cH$Hxcf&!5M+
zbLZgc=?M=H51cu32B%M-#;H@MaPs6yq@<+C?>@NLFJ05coTOH8keXwMbOr3B%du6u
z6q}?=uwJqlwvt6yEm;6d$y}IARADNa4r9q=T*=Cp-|gO`PXxPiC5A+B6b|?W<IshR
zaI-f=Y``9pkbxLAK@SI37!L@+V&f7K6&riU1fzdH&;)Zob6$S;!9{-wX45ef^Qz~<
z3R9pfnt^|8`vu9VSLJuR_vjPB(lTWV78f6e@Q47!L|#NpbO1ub{o&_-j;UCG3AS>U
zI=-51h1Wlv44V=EL1LsgBUnUYJfdP^;U5`|i12|W*l&}T<HcW=VcEF<!e{R?1YWv`
zfWV6|+;tKsF8brm-xlH@lgx${!ManhVMDO^)CAbtpX@9m&p59^VnQgwyd1D`*U`=*
zGAige!iP{1`5-CSuqIe&S_)qO-WrqjH^J;bFJjHyPmz)ofeSm-@YUpXm}<2bE62YF
zmo>9+$=wnWVLcN}-~I?@eDW0X;*a6YAJ$^bM~~vPy%CZ~F?;!P62cM^@y+DTnDfo+
zFdhFE7CW4S#`d$A^YyC;b6bnuhJPR^EVy3;^STs@KYsZUuRo!JPgPW)(rK>{l6l~w
ze*ljA2Ecv0E~fnRF?bR+oBpp?q59L?@bWl<Jsv0UFuDF-5$w$=qp=qzc;xTzK{ee7
z554mpEd77L*uVuayYL16x%_wbJ~o&)JPAf^I6C<p!RX(I$+vVrI5?Qyt9J$SA`0f&
zsbKEz?)O~59I*;J?-vC-f8L!$^r=qs@;XH#{UnL><0R5uNrWFI#l~T{xw+uPiGw(P
z+!?N}`*G~pJ{&o+2QDs-#2oPQ%dg1q2$pb)=H=zpr6{6_NQ)vjH#e4;$B!Q;_jD!q
zJVx$$gxt@C*};Pc@$0X@%J14UD0#S|k+VB3B7=e><#!)kbVsoJs)+0_zWCw`j2kyj
zzIXfh<(FUNp@GMyO`Gu3Pd~}`hBi{ta)@R3$ztPEyFH$rTO_~Ry~iCBjK{qLZJYb{
z+i&H2LlXl+Fp)@vS6;bMB=#3YMMaQEB=S8TeFgP3fByMr`QFgPeXC&9vFCB`!55MD
z0h*ec<e{O5E(D{^2gBVmGc&tA-kn{&I&^AVg9)ir%8a@p9UUFa+S}XF*4D<XwY8O5
zOG^vHVlgx7_B1y)Gou8iCKL)G5D1txHa4Q6p@CU_eLb_fx;oU>*0S>)?pVPTAHFXy
zp!^cbFG62J`9*qq8SaH@YHFBOS64Hus;XjESy{=fqN0LXd3iZA+S7wtX=$naEp83&
z9l7_S@4-Dg_q_D^xM$*?gZ?i4EqZJq&|Q4fXX2i#C$ezQ+7ns0I94W$a{MaBZFliX
z<MhZeH~G`vBZ761u%x3M{+7R!ExlgK{-&i>cD=Z{>AoYFkMFG;i2H)R60Eho1L8Ib
zlB?Qb8CnbTaWhaAwv*hUMs_1nE|N=9?oWa>HH$EQsy>88q4>Y=|3nK(sDJ$9Q#dW2
zfgis46he~2?ghcNY}tY@zx<N@o-(+1M0*3iQr$`3M@BG_oM33k7*YhI@%%t37zIZ#
z?!{Y)azQF#FHVhuzIabBKUf6&{PWM*mg1dv-jRp8;s(L$<?qync5>`=%yq<HuR}|7
z2_9Ebxn~5UQTfnwUyuv93uT$a$UTdZt3x71!TDA2ze*LX1Fa&iVjx9xYdgqkh+8{`
zGr>sWNZYa6I~TK`eh5#fyp4oilTg?OBxV+3nP)CK+FJ3P%ExFDHX>^C9Gowxg4x)Q
z2AyDi0r!sFd(n(Cw2H_Mc*b34#1C6Pi4dv<?-0TppUHwmR7IXujC^lv%s+YsDvynT
z?U5j~7X@OU?|G6rn(_KGDp)$@^WjS{PPTiJZce`Mg@REW$r3|F<^SY+H)H4%O!i!g
zaot@!-_s(Je&Fq|(GS9kMn7D0AFny1AF;U)*@|}J#0h5f<2GmXBRBV<o7&N%N4psP
z_)YEb;lrKAeGETz=uj7<AIGUVJ3Du=0|yQ;+rNLm{LOC-o?ydJ!P?}GGJSE`%gYjr
zdwE(Jpw}rYSQDvbHq_rxutq`S9V?hJs%z?znw~wN)*EW-NJZfmIBB3N56PfNFj^ZA
z+N{pvSxn-T`nKdhw0B4lTG`IxSu7&)Ovoi}X~i51ZxWW1j1i0wt$}O>LKeq~p8Fvn
z=@7bG3q@p~#&2!S0254CbtY<(U0L{q(=O=#J|4(F$Mz{EETGk1z|tjwz3fIEb(91<
z0&TLYaA9LR^Es!PIAg+;4e+&Jj*Js4;Sg0$UXnP;#OKON@I^~oJtQslKz$l(qHsFt
z4-1!QOq-z3$W<w(Ij|14r&DpYya5YG&BDc;GF+{0#3JjnSf#oIdLu@mb^r->FR^>i
zUU>+JDrteK)kYRRws<o3Ic&k6{kw7OxRX3nOHtY)!S6q7q9AAo+C}A9HGK*;T3W#6
zh%=f9@$@$xVgy@hdlcgGcx>M7h`F;3V7BfcBiNN10jUi);f(WIT->5VYWI=Q)py3J
zgNG2hb0NwI!A?e8h1uqlxE6aBRV7JiYP^Q1g6caXSYL1_3Z^LCoO~-Pn6i8;OE{-s
ziV}W55Ue+J7vD6lJ33_X-7b&sJ1Qc{mc}g&4|ow76MLg$-BtGuM2G8Gm{j%<<zfwK
zzN}|wVtE^Ua~hyO+XRU&mKZg08G@Y50bweM0OG530DD6V@XJI!n9tKhMe-R^m2N{b
zi4d{41=_2eVKHMNqRwn5)ng&T9P~(Sr;I3`6lao3ptt=3ni@*ki+7L+-0YQ(N#9P!
zal;w7d}breHO8X)S`@^>0+bVJk1nf4`nfHrudPB!vKJcbt5H;01Ajj^6epjAprITE
zRkg@2uE4^j+lL&%RP`L>Az<mkxmaSbQnn*bgN}|4i~rT<au9cT73NPG%i@?8fp(X!
zLB}Np^Oib5eas|iSe-*hNg(3m!%4{?L46A?9$Q$EY3Y5HHBY3LH^Y{w93|J1aT6hF
z$iW;9ZH%6v4q*fF85^1y!KRHhAVeZH{CzQ)Gj2Y98#@zT_9m#x@gb#!%)jh6!EOSP
zTxD2TSja=&=cr6SM{GSB(5-^CRVKoONPb@w%x2~G9u;ia%sJgESXPNFhdpQt#+4X~
zaedngMvRNw0avhoqst4+KKTIc>=b?B4&r1=AZuu)VMFT!?4>KoL$;AfS-drjL<VvA
z$+a!S`Bd9*o<)GDxelAorLh-pA`xSBDuaY&5kOn|Ws%W<Q|nd`=d__S0)}f5InTgO
z9s-I;;^r4tvv3uOO0BJ)EPQI&98_ink;KnO9r1%?1e0KGU@<gS>_qTR1MJY(K=L6Y
zjGwa`URze6B6K?=S42(;u0)+f!VznT1+~PNEo0=Gzugzh)HSf!@-VJc39xd17*Q;5
z%(Xtp$aQ9$1+pSfA-Avql{K~4=5ZO*7Hq;%Tm3sHSbJ#%`JWO7IDF(Ns?sh(ntO)r
zQ>0djvF*$iSRRaHFIyV#iHew`?A%e;lNkN|f05^JM~cf1>^SIxoK^`0X~!7B4!In{
z28aEar@j&<YJZR%*n}K$8`O2oU~at?LQ>=LOesZK(pl_ua>i`^4Y1sPk`Zj@{)0FY
zQv?@FBb>BZ2FI-%hdse=g(F90@v5j`HQ8|_F)!Ux!Dv$rC7D=6T@m9>1*1(hJt>%=
zLFRwma|P>8vN_qNFRc91JxO<WMWph}D@%BHMdbZTuudq&cW#5ch-7h2<GKx%0x>HM
zT1cF8am~edd6FB8YZ}L1X*FHqSr)$}Ovu$BY{H@y_MLIuP&Wt!(^H*<y3`Xad}OaH
z7X3a2D7eu~;SyJdaZ?vy<?NZ5V&jAPe@sWZi!q4+nUfzBoq*X!?$~Xh4oSNRQsRFF
z<u|Y<ilxSzFk|#chy*q05T+p}IvPjzJHsoZ9OGx(;+&0U=ZjydY=WS!2;!z(qKvMn
zArbZG9BWJ(Jpn1Fw;&`W6hd;IM!@A$7SP;y5r_2WqOPi#IivBHPD6d<G`N_|M_qLZ
zf&v1%5R8(4C?O>!4ofvj1&czQf~3m{%*il6n*}|+wa7cST}Ch|NsdM-G@X;7w%i`=
z%_Xe7xtP}gO-(E4jGW4d6&>us$YnY5cL;L*5fkdo2)6A=5X=rmV1e2Sa=sZG0t#_~
z#8qZ_9V6IcgY`JJ#RNef`_Wiei?W(J%vin~i$+eqw+bfv-YV^0!CGk)Nc*H<P2?r}
zt6&X6k~<q}`>kNMwzl%n&_;LheXAl;F`j80bMdUGUN;o%E;{+i<u`gJ&YLxZIAsDz
z3;pCrWK9>>gdGr&8Z&*_mip_YHr#^7e1A-vHVr#$4M`4b#o7Y_u-Ux_Q|2y)?t*Dp
zK7Wnu#l@|dPOcj}#R3_X0@PQep;=f*BBBZHViFO}B4}+1Ky6(r8U;<5sH%%|Y1dgq
zG>hvneU=*3CQZQn+0)>jUXF+>*Y3E8r1!oXc=_d*<sli=jP}VxGKh-&K%XwQycJVb
zWi9yB$!8!0yA%+};+&QiYXXX~c(wsj-PR)Iq%CI6nuQ%FywFIhS0lzu!NSpVItkV;
z%z?%fZRCgUBjl2GiwZ6gLw(X*6epiRZgU%)qw;Xt&Im41*HGVBhs|1J3E?tHxEjLR
zG`J@fV9v6`*sy5soe_+Jeu?iLRIg;3B_S`~A<tD5wEc?u1@t&M%Z|~UW$ly02qrs5
zawOSGByA)DM5Kl&^A8$3a~Cmz5KEn-(MoEYO#)diqdBZeC}25^MqEAd5$d|hW&I`C
zV1ho|o#MVyu)ctMVXMQ@oi8k*KA8N4Zz>|?FTQT8YnK<NwsG~g&LYw~Ae_CtmiA)V
z%M+q0MnI#&w@6J*{muxeCR-W-hXd15Mf@)=BK8Dj^_yTXyzm0EI|cnXe=E#VXlT{c
z(jk6li)^PgA6lAAaQ@I{=7(jJ(Nd*FMz9VE@*6wQLgK$L&I7L2Rxn?Ci2S`aixanP
zR#@kBjK#6_t}{51SPBPsf2jWQ6IN_>XYso)G!H@&zh`0#QCFJA;x@v;5Z9A^AS?`q
z>G4Fw=ayjWK_3#gGS`E~aY2RbGtnIp%*$LC()x7y9&o@yyUVvo>f}%Ta~e*q)+J89
zH+GropgsRQlWpqcr`2>|!MZ@^<fG|2VPg%hR8xYrV21W47)%(6?YeW(A`)Y+niI6=
z86fe93F`7Lp^a3jsY0n+dZGEs2?&T2+ClC+dBJRyr+X8EHKMAi6`mQ@Xl|la>Kdeb
zZ6;)_MO~v18%`%6;iMHr4Ofv_S_6x-Y0zEo)-QrltX#PgSFT)<@AVy4R#x&*|3S&4
z2<3eaG-KaTFj;06(+o_El8S!xrkR;uM@t9l)U4Pa$1*c573lRe<H|Dd4F#)6K1DLG
zOugzlRqRF&k$a+GEJw)|jC<+c6iivVIr-)ktULKumT*qN6eV0a68c+2($6x=leJKz
zqo@@pY)ME+kWHEw8_OnaiHeH4Y0?&MvK2aE3!M+c-``*UE4PpC;+w{`yZ_}baot=?
zYTYD`>9h%4JhzA%?|l(jR$d|x5p^cY0nlzF)$q(|#9SkH%ro9j_M5OdMCO~#vG65T
z|5{WAZzX%w?I-?LTQ$PVJ76D_k2$keK!33{iiAYqn{qLCwL7xCw~(vq(NrFW%;r{v
zUlU;btnI^!VBrx_a)Lz<2*H%Q>-gq1!Pf6OrjIs)An$_wD6nzaPPAsZp*G!}?NgsO
zij)dkYfrO%bP%7HY-l?eC77UH3IkOmq`F$5y;W9$q2E~+?TxuN1iKwPND7vkl8O;O
zPQ;rZ%)&O!Nw|E;nGh}xV|6VU@g~?Dy(bFB#kXQycNfq1T)}P!w2s(T9m2x&+ZaRT
zjb0fW_g`c$4K%aJX(ti0);%39<mEev??5AmFCzPf;XtqxZfE6BdkcbH3Zq?fWTSm3
z=B@NXz(E`M6;Ov!hSGQsRA-WilZc>Yv<{{&5!j@mMMy^+`B|!L{Nqynwd|#*&)0*-
zoEcb89Q)lqS8*mP4;L=^ke6>6S_Hdt6@Pti8r1&%EYdC~;o(uX81u<L;c7A(v6qe_
zJv|*i8Xv@Gdd|2Uc>-TAbH-0g?C~Ti&L;os1vcy82_Jtv{@QmW{0@wMdJP+wPVSXp
z9C3OwCnu+Fk1Jbm_v-E3KpTevbn<1nO0kHfzoVS1$X|5kELzJMPDP~u;Vs=Nn1+@u
z4qpiGlY-H4m-hnizVi;O&6dgc?jCw2SX<^v@;`MxD<CAEA$9W6MjJ?lsA-n5)XKjE
zwpxqORvwH-5q0u`g2EcioVpBoo>ruapGAmP4y_4lj9~4OdbG56klToHt-ci**?BNu
zI1_b+!4Fgs`PN%+$wN0_ZEY<N4Lmvo#mw$D22jE74=0}zhZcd#Mkh<*NS2h8#7L$*
zw=5-DL_`E588>YwB^jNzlah>%pz15=Xsr7IT?kfPJ@6xG2GbTUT-5DxWlO)3+wE~`
zLk;h~`>s56f8dT4>`w8<Yp-CQnworX@UUpnB6+BHoIQJ%sg$D8Vv(vARk!YD#8y@<
zS}aoICLE?kBb{)VD&Va^75{$1Jtx>e_y!pn8S+r?pvC5`K#N0V|BEXgIilT8@kmKF
za^z_FuYkD_4+8Ev!G;=oBbd9@bUgjYb6EVx2S^AxfWt0MxI{>|$s+_~|2qjg&IG~j
zQtt$_x3_1%L&-}0N4ll{=>3WZmSD84io^Kv<K>}SE7<F=Phu)|rwaC<fLAaD%$PBQ
z5p3U*afnE{K{Q2zjs4==&LZ;hCttpaV2`Ri3-|EoPJ)g6^pyc67#*lFoWK)I36x+5
zmW;>wm^A$Ts}=a*F%@K_r{JR>R^VzzD!zUEVf;nquSg^Wd+gzd7{QVfqOtl|5T5zV
z!+46E^N0z>!3!aH;@w~I=))@5p)*oWuu*vY@yFTkJoVI5tl5HY6<fZ01D#Z6xPd2_
z67H6hPum6i1Ny0GID#jb67Ckk`h$V!ReP_%6RaDgXJikW^%u`S|GYdjJi!xeh=G14
z<M7Ng&&Wf=7d*j+An13~;jUa9c!DW`j_0I)n6eFoA4WeP^#%7+!z)iPCD3_hm7RQQ
zlw68EDF&-YEA5Fg7@*H|FYv$-OjA=+9=ZX=cBtM6mO{1(VW*Ipc^QFmDfr+|V|?<<
zEExUt0pfj~U^wCjm`wVySAu>2{rBv5=$cC1Z5465WTV}t-gx5;`QE+71F2v+IXNux
zxUMnW_QMZ9WHVX!L@=sg3Bkt(M8RgxoGB08Ip)uwKV%p7;)_TnPz5`%WE_0s(~!;)
zEIor*Iw4sqDI&QZt%+DM^&2D*l2L+D``h@Hh$KE(Sa?*YA4W-L_`er$iTGiCDI#wL
zTFV?ca-@83=z}Mi5-7pwx5&`T>3H>@n)vmNC*iw!8lF~B!NY%1f!<FaBH-u-BwVz|
zHvK6`i*m(I&Hv%O58r1W&|moQJ4P@Sm51=&R|XjS#T!`q-E(;8v8Qf}U>|?{u{<<9
z!4pgg_tMFy-x}!x5`DpoFTN-b4Q=oQQvz*Lc<H5=?#y148Ewm=(=@$E!qi??Sl66(
zIDGB3*W`PB110!y15dC)1|6_M+s5Y1nS<-sugi}<IN%932%ufF4Gj(Ddtf7{9#rrI
z8vs1}?6dOFt<h6od`Cye+p;}-_OPxz_sVVso?!h1jZ`}F=w3m23@RloHwIO4{HgM|
zQ#$698+WQa-c)g{sq#2e#WAMJV@v6{(yXg_@+a#a_k>{m8K|o`NLO)yu3}{M7Gb>&
z&h2hsuHv9v`Yg(GsSY$~9P|f$C0JW~2egi6u<041cNvjuWRuL$74C%1vK8!jg56_+
zH8kA3cK5wTUkFC$46AHu#ZMEpFm<&D{5NXAaoa{%TCIe+)iR{G@8AhW?K@3p{PDFu
z+6&Ji{(wID%Qh4X+wkpjZ(L5x$Ls&I#mu=quU7Fu5sVlYZ!}}l<#}kPq+z~@?15ms
zg58Xs2zDf0i1fpn7`yQjXr1-<{i#s<`Uzy!v>?@M9i(+JxY8&>MwJk=9i#Ds%JYzr
zVsoWu)`Lkf8c9nnJ<ui<LtSkNg7X^DB5H<_Yc$%#LbNpILfk4wtw4mVNcRVxVBKX*
znkl)A$t#!=!Ky3B3zXMk+{SQ}7MGz;(2Q1+<3?`_hN!6#?e%da!h|R;tAU`tde{?;
zd#+oV@^dREIJJ_J5@yB4#mr~}Z&6VZv%<ncT)TD+1qB7n^7HeNmzT#ZH#e8{G|A4+
z?ljs<gIZQr7VA<(XWXVnr)!`cF|TIl%io}T@I~YhAy{9*D_9@E6RdlfPM;?a0gH8X
zuraV0<EC$9OUf+X?vE*B{-lw|R!$i)aSryG&V#g-PUs?=-MdAQ53l@otUr;!;;cT!
z4X4~rBFFClcIwPRGl|b)2yyyy2^ve1SbVj%wWC?sfXIS6XiPDMmd0EhKXwdtwRJ;>
zVDx3ERNim)>8GEvKKhiHLkV04?M=bxwl@V62<~GAyI(*P+Q`TV-+c28^GEI!rZaBL
zleT%=9xSqPLiDliSYfpZZhJPODL+U~E-7+aB#0<##<p!+F@E}5qEPxcm*0rJ))rVa
zaTLq+ySA^zh@XvMVZ9BjjSL_Xi_l7rAKkVY4vvmkPVQ@EVU6SKP0>=Bj{33;?DI{-
z(v`blZMG8CM8zoKiisTxOyLPORB`d*MZEgzt2cdOqVuBlckH8>RBT#W+aV<iMvF@d
zPQlvST3HJ|B_LHGnZgleBgATI7I!L`P}oceC_*}^L<xjVXl~3yJ#h!>>SU|j*4Ndt
zMM*gYtEsMHi;eLF8)l#cE4rEhRrzv#eF0ZIW{Ge3u3d{ry7qbhoqS<sDk~!6kJ+Gt
zDA#>oL{6VJ1JmsPxTQ_C{~c58M-clBlkI=SB>P{8{fr6Bej@fG#@qjZarXbiSZ4pl
z82j%q+WuQ&-(aNO*Z7m!SH!-=A9i2hcf0>!1hL=j{!Q#N{L1W8{A~9Lv40W!7(dy4
zgdgqx4?o!b6F=DhQ~uNgha6JBpichQ#S373G#ZwRjghd|L`E<oT)FLl$*xf7Z1TmP
z#nT`zi6V@xV(o`^zL}V$=E%rZ9(NQ*$5WtT<Os`2)5yLXQNe5QB96YWA{C+*5!_;n
zu-Nt}ghU+^Tx}4XT@IZc{#ZPH5z>6NpeoH9#YE8p3uNTFF9<fm<Xh~QuDPY{ldi@d
zsWqIWmT;6>z(Hz`-BL5`l$v6PbOr3C#;}tv$9Cy5Y?T^fi_`#{rTW+;U4o5LU96WZ
z#yW{M)=IQsD_Mj!5)If$7Q$Mx09Fz;SW4!>LNW)dB(q^AnT3^-nJ|@1#|p_bm`J8z
zxnweoBok3^?e26Y<P_{yPJVwC?16Lg2ZCUBby~1*(!~xe$Ev_z@xAWn*ibkgv(C@M
z>`ODS8G6{*G-t>VOwq~TxqDZaW(u9{0hls&4D-9F=S9bUPu19fnie{CQpon#ZnKBo
z+D))rza7)28X?8i8g_QuI|-I0l3=^uTr`&jAfTiP>+I~XbF~TPj8@|b)|2(FU@Nhc
zkjsv!*LEz!@@x%kZqvaQ68@*buh@hoSP$J{rC<zl6{8Bqb|oF%Di~cMm?~HcF<!xx
z&>w>B$LcNwTVJNf2&U~b?WQ7fD|#;?Eju)znKJ9P2=>l9@5rBC2AV+Me)}y;G@2;4
z!m<f7<RKt5C=i0uED~x%?X?V`MYa^5%m<SqC^DDsp^cDBB56f_Vg!maV^NSA17E*T
z)Hk;v?`jHsLzCGz+!~<>mum!QB4nck6E=&G77>JN88L{7j^_#1lTm^_{@63vFE+&I
zpFEE*x6Q$ezx{++b6>}MyVYQ1{|Ovmg10xT;)%)s!=sNqg7NcT#F7eKJo)yAP*M3S
zzWv~FSf>9DbLe1Miw53RAA$d9{;yvIyH;4tro>#mdbRuw?hO7u=TTQc=hbgTRnBFg
zy(__d1Cz*}1R~~-wV;&{tspfFX)!_Y@bE!ecnrc_*23d_I8(4{La?)E&Jco$8Nmbs
z;?Q66MX=Xd1YZo{3D%SGPW~;Ne1UAy{N9SlGD0RwuqzoEJi(Ohej=Fn(Hm<SQSXX6
z`Q=GrKwTDu$w$zFcI1Q~U@O|v^PCTcmU?0pC=1$*Y#)2HbhI&oef;@sG-kMw3#%dM
zXeCB8kNizjRX#>e)kD}WBjUe_JAJU^syeus>q1bSgp>v$xwsYn1+|zyMuR69BN%Q?
zu+5U53AUz#Z>D&l6wDd6okVhOGlvTy(E55Cj4@n@5%b6306D*p*zznhOmfzP$)<7G
zmM{}e#OGSmw2~2QThV;hOkqcAj+9`3te*{oU1J!*Xf1LR@w?VH&cPaJ!&sn+am&Zu
zGlGrz?RR-d2Dh9J%$#hAL;<jT^>J8Doz4hG|7EuTR<3C{9(on_23lBbY6qW!2ACer
zz>=9$8NtLvu_lZ$$5me^G+%K?YvXmKHg#auY%`Qxzm7su5jcFg5^D@~Q6p+XeOV@)
zgVGVPTL;354AhrIqKJ?y_*xxim^$+cHXMt{FTVIf9_kySz1)ymSa(YWJAVB5EfviD
zu!~H=8Uzojg01Z&(!q{ZI84-PTeB@DY|z1eQs+B}bwt6|VrhygrX5)V)2-vMt6~xM
z5(V4PVa5oyF>V%i!jKVc8&R=sB)kO%Q1x1XS@VCx*bOsa88#k<$40{{emqvS-n$~w
zYQB~{1k{j3ZEtB};dT*`FsW?7E>}cm6M3RrdX2E59_7S;DlRTT2{A!U1*&T57`e)-
z>rq`VYo4fWB-b`IGlEr?79lTB)|<7or~oG|El^yL$37LEPb(&5t3_o^Evl+(cqhL*
z1=|H9%(j{$Q!o-%TRjmguIu-xU}lNanSxoh4-Fq|i>(dv!p{;1y&f6C?vM!S{ckM(
zTHY$bDgR7_9p8n}V|%fB*D<WwbQD&rRw2}N7j`=bF@mi-=!4@?*H9{G#@XGDXcE(Q
zuqL=Wt;5#+r(v<m8g6?xz{X%T&TiX)><BMLuKLD0Bo$UL6|1SOLMc(Ur0YDvhFlT(
z-h1!KLj!|>a`FXoC!ZSU<WqZKib#s?dYKMYE3dfqT9miK(s9$|AsOasEb7u_dg_>Q
zodg>_Z650~EiR8GXK!?wjw<iy(q%e4_A-)B@5T<DnP?UZaZTE_%XFha*rm(#`~?f)
z9}qsYx=i!HU7MO|pcIT#uLri7Vz_|LY&cNpP8o-~W#<gRVQYQCTW`H358WAVmE*bG
z&gFQT+qoRy>95Fhykc&rVa443kAM6_{);>mF=Pp5Vqzi>^^WccM9I@10`;}Hpo1W)
zNKv6!T+pI|+Qf+y<xj*z5f41UCeB}s%<5)bC=%l51y=a|O%2pk*Px-E5Ues6&7wj=
zHbT7WN-RGThr)#8gisYIBj;7#_zcD2J5XE06Raoj3f51Dm#P=9V137ZORyJTez{wM
zefodzbs^XbufC3!W+6|oLBf4Yu#;yz@x%+i;WL%Tk?1%ZsLRCjU#a4mr=LO#>T#)1
zfDfivLeSibZx^itU5A?|*uaA?BKab6P{9+7C)l9k0U%gwC&A(_o`G1z6YOqc_z+B(
z3kTEXfFO?T($2zLf=h7BY6+wz7a74Q8rp&RE6+k#cRM4PrilYgTw*YL<V-jks-s2B
z6YOq+FCuw@4Jw8W!P@K7*jCmBj|dsDHfbw%Mb|TO&0BSbPCC!dg;YvF2YH27h!7Tc
zm62=e{4Gd`PQjH^t6;rQgAr`{qNRx3Yl23ij)9JbXluWY#-;{{+oa^Y0E^9cKqx9i
zv#14ilx($?sH?9*@wGU(1YO3$twGqlcm^R@Iez{41NPfIx?;!@OkG`F9=bKC3UNxt
zsaU6ywThVnaY{y2j8ig272}kQsu-taoQiQu#;F*mWSojoQyz57Lxv$sFdp{@c!Kd5
zRPY4jF{t1P#$(XHlZ(fop$oZa?dkpZ-yaa;!J`Yg%*>V}EiJB#rKH5*^5rNbB}E`1
zAq?^HA&8B=gy`r%L`C@{BH|*#!+jAN>Vx3m^SE@$3xR<ixSVp8-IFdg(%Y*2bjAMo
z`1md>_S1E(>5BcKp`l$?>!&OAXJr?%`}PL<cZ$ZX`cD^m=k7yid-nD9#f1wO;O*^=
zbLY;%%gYNM9v*B4=+mc9vz7nd+}v>T<VpFR2N$l`++`TvUg>H!{BD<YCG4dp*d|@Z
zhS_b9>awAAHWGC<oQ@8oqeJLSBvbLR<{R?6-Fw`UT)W+Tp*!loSi5{KOt$ZYiGwSa
zO!xv94z4An2u5V2-yM-_m(6xYuDG~R#Kgr7S#oioo(2>BCD*(E_yDV=YWRKqhp@(6
zEEG&1UgSzkC5jT}hlIokM8<?5D#9PJadPD%cDu^8(>ETo%?{z`m%c#A(N#!F@WGi2
z!5II^U*UTC3=Rg+dk!qQLPCS#X|IWsn-(MZk~<-rKWvVk$9I2D!|SiVjzeoThZVVo
zt#V~##Ih|{EGEYJAu%DG6^n67#o~qI+ejkb-^C(NuKuG(a%E*k<9KueCR!cF6L0>2
zML)lTxRBlW<e#r2o{($nIX|ep^c{YB>1iCdo{rS`)4h-@1HrM$P*G9AmGm?`r}6=`
zKK~oudhc_*^2%$7%S^}1Do^6+$6v$`Qw`yK@F4#F+RIRRZ!#Ww;u-8%_$&L{{*Y_q
zf?p975{_>*cHo<t=2+=`j;Pfos66=_JdW%m_j{P#^RLf8hew}y3iH+;#M>%=#gos_
zsWVmZ&|^>IBq7?t6YlqvTnAu@(f+!4ROM-?{QeELVkur6`z=O&`y573ej4jA52ItJ
z4NsqIxI6S=VPT#3p~@8$6o`NTe|9fFKR>2iK62%v=IQCll<N$yTz8Bv<oe))4@d-`
z>SCUrZltI<K_c9h6cxuvgdf4FQ!XUJ58=cKXSli^AhsVzkM70c!%lE<aloNNyF1DC
z_S<i>L{l`HfLtPS#m}izr&uD=Npf9XU6~y{dX(JrFuA7-x#uA`J3AvKEt}o9Hz<;e
z+MO1Q)Od3BA6>|GuRxV+FkxzHiZ8$XQoc8|K{HQZY>A#>x5txHWtn;?;Eu`FpRO{!
zAtok99vWB-)_r;08bd<4D5wv{<Nm^sA=f~Ib{2dP5EmyKZ!i=wpyaZ%vy+E-@K7RG
zYHI4RHd>?X?s!i&6!87`-^)XThwcWqbT`1IyRPAi-NU;Z=%Uy~oEq&K&Y_cB^vC)O
z`q0V`-qXYP<pq>qLit4$N9-u~cjx-Nch~P-vF|%Kiiggw7ZyRMkGvW5UdrI!k9!~P
z9q2Q2&&fR-{d?~Bx!>#ww5_c_=qbK?A`17MJrRX__U?$HJf47yTg8!4%A=!bywX*3
zDegMCTH8CwAGV>RO}3(ab2D9E6+?<#-NnUlBUjbc(`f6E!rVI#|6A;WAK&;GSB@@5
zM{6BY9P}Y3M7!_E)gl(b{9r7Sj%^?*)`sT#T!`9R;cy{~&B0DbOy3J~(S6$Bd*;lU
zUdcrpn#oJEV{If7>Eh|_<oP=~+R@b5Fl5N}Kq?otc8Qd|u;NQo+<0-B8r%(X(ce=>
zZ{#9xjThdZ$-X~Mp8N~`_2y%ELS+oTunp>bwtGRYNlR9;^E940h{bJq{NWc#NJ`?k
z309VtkhY7_EN+FtTQAGwST@}h&FGE8kz6W|{R2WO(O<lUU$jr)d6iEfEC>WTig741
z6)Q*o6KamJc;<zl@q)^0sEM?LxUB=Vl2+)Q%D5}arHJ0h#buVERxFPH&x`omV^i>#
zr~ZMzsyvL3^p3JPtcu!)hhG_sM?am;GQ@_U>j*n+0mFA+LrJ<fBpsDFl2QqkkH#Rs
ztmpV0vgA@$E-qn|<+>-y9!zr8rk;|&jSN-MJBKB?6ysVko`*!SNIx7?f1^J}Kkh0T
z{m{#OgjO`}<1hU%%^CebO^q(Dq-fkn>tn}`F{2-^IXiOX2s8RIThZu;ZSLc?q8&VV
zkbUe{v;zkYFx$U>Kl}qj<!|2=Jh_IDa&a%L__E3`%wC%OC^zL1y{^B?)!5Lzay1Y~
z`gWD8C#0rl52*EoTanBCYS%9fTwDXiEDp&o@u=7twop6Wwv+QWkxL{-D@ltMk`6R}
zn@BC4#&4TQHot~IM2-ms^0W}bPQ#MLZAobv>KhtSQ(FhaDcY!~YYovfAa>j2S~YG0
zHgDc0-vgG;*T$ADH})ykdu3zq`6z4%DQ7P%6<4C5g09RUg+TVkXd=Fr@s1-Ht-c*;
zr>r|)n*O}=DjhWBd!s|zh>jK!+8PSsmDvar*LbX)qXw->>d3uT3SE;U5H|_nakU=C
zs&fdj>fs-mh?J5B98WHTfu1GSu3a~v<honvj$BvI+QR98BlbBTgs!Or952axI<!}?
zO<BTO@_z{<*LFu|Xc*dJ#!pibu~`E<*V*8p)dE7ALXhl^{V`>XTo?9lz!slOh)Cwn
zsA|S`3rj|>W^pxk?b-nWNf%3FGl&|BV83}2s&oAqxpwT>0aFWGY&15;lCcZ1)^sKI
z?sH)0Zkt?vfud^lNx2l{n!a#<m5b(>o@9HVmFsSy-^C)aZsVJ52fA3KVdePc;<ew!
zVpK$gd=Ier{dZI((Y2jri!ZHNs*h_IcS9tsXZub;*Py>O5c4MM;ld^Z=*=_6)pOe+
zsn25fimno2>zNdc{^d_(`tBxm<SY^~QufjlRybp(_8zR!o&Z5bEF|rvs82eKww4++
zlL$JIR19?udx%J6l&8DH!2S|u8Xv%(rL$2SwhuZJRFQhljuZpLzadrZgz_f#^0`s&
z@UYTEef4$JG}Xi2)eGMCOHrM64%M|)@Xo4&j`_hMPp&BowBfdFzHFy58rPeo2&t4}
ze?%$PO`QfEoh7o8g4h}-H<+Ehf|c_Yvf^;^<duj#vKAfnacJw1FmlCK5QS=QAw+D&
zinFAcu5DrD^4_)-O`;~uo4O2(b#0LCWrI1h^$@*prHotx;!oBSg{rB8$=(QPYU?62
z$P-o7wf!eocd%GxArHwAa(oM%gECpTC*?9XH}6ro=(%%Q)i)_uUHtwoxvIG$z2C~!
zP+bUDqq+CDa`jMBD8}_bDVJjWDwYbjrChyXi=M7LbTigolKEWC*SzINB<z0e<Yj5&
zT!;LnlRdVgL(+k$U7EOB+YB)y7;!X-BPt@1(I_M@-b9X*{p=E%uRt6B=*!c_K8HmU
zu>N$4ELYXn;h>J{O|m^4i$!T0H_e?4c|P0F&|Hf~5*IFU6)-*^TL4Q^OMC3LqcP2c
zY-K)I(A9FR-06*VT62+hb~9G}`V-XGxkGJ|22O7>MowWdiO&{Pr_%Xi#VAVkBk|mf
z(gxY*ACm>TaL|~Fi)jTgcJ#%<4QJ6niA8M9>3CFL^(7T460d}KtB(d^;rf%%82!VY
zk!$%cBd~9~4UQdgW&0jG*1&GFEelg@*tG}tR_1UzcoeGx${4xqZ1r)(We*~As}R@N
zj*aTSp|vpu;kk{dYn5W*j!2w4?uiKd1*j9ZVS&{#EM7z;zA+n(9qkAq^6j+V3=>9-
z!>$9)q<AbPwVWmtlgL<QZh;;1M`6vWRG6Mj#^h-x(3tcaYRfW)J-PY<+7v^fs9dyJ
z=2prT=y?>unH5a6Ldlj>t|nmv_U+x@t#Soq*W6v@>JB{>i%hkYURe31m5W9C(mhFb
zUyH^2iCh=f>dQl2v0HoLjW{RXJ>4#L3@7p3)*0uk4<~dj7Kza~7Ks##MdDA9?L;+e
z7S9b0@_4Q*U~wA|8r~VdjkU!JaXbLzqD>L0={NeHZ_r(g%Lz9c9j|o&@fXfu?j&9I
zvb*&cA|X0})n@3u=sc$5R828+f<9~)&I8&q+3+#?(m6FPNDcLYmz6f0HyWb7JOO@L
zH84Dx4s(MQ2syP8IYIle_EaJ(DqF?ZVP~#GUcLbp;uiRagd^I=9WzZ2;>fbe5a;<r
z&`<~Uku$Jd(-gtGbz!WkhQ|6r>@k>$2|tcUQOrTq)R&^RrU=#^sh#9nxNsqRpL>Oy
z$R%lljkXCA_ja8pHmE`h6B9F>F<$_;?G}twQHcrgkGYHm)(7$XkFtq?%S7$awQ<2h
zqrHq+t?dH%T2F_Ga{><88lbth0L}6Ytg~i6BUeOt2n1pw&IE>%%-e{1Ik{p^*`cN|
z62iJ-c>9OqfagUl*d2Cnm5ZV$<)Rph%Edj~-Npmy&~KZ+5c;OOFnx|W+aK}suQ1%^
z3N5QWY=8Zd*~qxK58CtRbT*<o9^8N_b9CUDQchl43a_2!D2n$*dvgtO?%T<+X2jP^
zpuaZ+qh=T(sgjaTgl!f}puNl%yU&DS@?3q)oNI=KQ>I|8sR0^Eb$H5zF^D+23I(wz
zp*m?2&Ri)cN>z!5sw5T(E-}T3IJM)B$aSx9vvLWLeQpa>RaLRm%^Rn(M3^*TE<3f~
za1O+c$q*M&2ftLFk)@b3eLA-4E<ntsW2nvYKoL0{SK5p@Ru?dR(ildr+yF-$(VvA=
ztF_Qka~W4onW2!7jgqUPUWh-x8HJfMXR_ka#!!pItE`Qyu}zFola|9)eLCs{6__z&
z2Bzv+Vf?Dow@<GAfaazyAT>e>anR{udPY&X>`o+uR3F)8^rdO1HI^IOThZ1cA~i=5
zi8PW6$@9?95p8X)q_)zCNXI2CSJ9deEdpgPFN=T%_DP~~$dl{ik3W`&Zs37bE@hM@
zhR8!VKwmT~=t7s5rF5eAQhwpKc2Sp?rY~HRAJyfhi&7#wUz`$)zPR3Ud-n3RO+xnK
z%xX%=F&VMy>#DmHi}m%jECOoltGh(NvCz!BO0GF`=Ey_6qdRid<pg8lh@V+_f#qJd
ztx5MoWmYgI{`3<zxCFEK*3?{zb*8%bZQ@+`CKn;5Scq0qLeMzQB7SW%$(ZdD`aQP=
zmK$~>+s^^vIhAN_u4QptQxJm{x*G7wtA_5%^;oK<fkhe`Xl#=CU6f#%k!OjYdL3~`
z)?lH!HZ(NU;p=(e&d5a_dbF3y_kbV1pAKo`jnTXX<nm)FjhHuK3Cf}mVYi+-I;vC1
z88N$;KmzDk>>&=l9(;G2u@-s?`l3GR)i6Dqjq}#psLi{C6?<YZN^3Wcn9hNutqx*Q
z6BbWj!pPOqSWF1o1W|hn7CA;@{VL+v6Q`WcH^1R{G_<D7MqXV$%vb0@)KtyZT09a{
zfZ9e<ovyq_h*pE*x<+jGPQhWDrTrq;S6_W~Tl3A28#hiKx;6T%TofH0vZ)2Q%-c>$
zL^CrnMdhMKLE92(25u*%0+*2)327T5Q7f8xX-Pnpi)PqnK@KAp&8)HoA8J{cBh-K^
zS9hSw)ssxKmsL<MWx1xxr7YJyNj4|joN{$1+se{?yTzjNq$$+sNFh3T%H_+KyG))!
z#|+XD-E;z#$jHbp6R6PnDd+?$it|&HmfaW`!=Wc~6;{#u_RXO2jW%Ite3yx2C52*K
zcan=Fa(0!lGoD+zG)3IyVzK!8b@`r5xe^bpBB4gsl1{0&);FL0FMyOd;j~SezG%M3
zD(tadK=x?&T4Jr_8sc+>`1!*nv5F~IYpX0r<>%#LrArbtCN4s0q8rN<z85awd@d;l
z9{_R{UYGT1P{hsTl66ydORmP~iJDk3MP9s0Dna#X;<)*!O_oigNy(K@E?1qn1m_bI
zQ9-<t;IbzC`|}@g?n*Tq471Nj1NC`6q<CyWJ4v^ILII3+UBa@dv+pjsZU=o)E;@+e
zeo!uJ&tSMkB;#x2qxk0gF$g<uO~@9E#KbrRo!o%1=tx9HN8KU0dPh(3-JNm`8;AY|
zZpbx#QHOccWnuQRvKOZ4kiYPHk2G>!2PRLlCi}Fbp!}s<=+H9i3&{L|2UWRjY;5GA
zzTv(gS4UkI(ofUQfkLRxnu!g@ns5lcj?lasXw93|SuDEP7~x`=KPm~Q#2r#-7;ZtR
zy$Q-Bv_~WmQq%zb)vnN=HI=<^TPvx>kO;UIa~9VV&!Mp}h&4eBC34Y$3_26PM_R}p
z{A>JnJfiY8MnCct5+l73>9q}}2Ym3K>9&kqlu&=4WP!*3`UUyBxAEUMo`a)*6s(S3
z#3PS9h7lh<gQfp{n@u>^9l0oIJoaXNxrVdi;^J<PU-UZO?eW1d4tMO(Q*@V;6myeQ
zBJ;T@xEwVci^V%tu4~t2zuzCwxyAa5tSniLygPIVishlZhaSnbYU~Y%J|{c7)1lW`
zxB&UN*{pD+<nl66L&LRDa@l2ajRXa`S8?=GI%ci%!IHUJ5SIrtVo@_VnSqF1CJ=N~
zVNYx|E~R8)@lGGus7^=o13)fLx#&Ing8s}SQB+hU58aG}ghWQJ&;R|o{K(xwC%HIZ
zsXyRk@K(yjkxS7R7!t}A-aWa})6=^cM=&~v7$sODshM#EqaWib!RTDB9KjUlVdV%G
z5D<W@>;n0(3@l!F;RSi9XV9YlZllXDb~kEeu<hTU{;S*Lx3aX1oNkXR+t=TG*X?m?
zbehNEju&5~BdTwWdrq!<fqUT#^aiR<%0`PqPOWHBs5tX9RV!K)a%$CGaY!fk?Mssb
zRptKRx#ymfhi;7rj$CwbEG3s>4dY&e^RpC<`dgG_ibWzvvRf62lwh<-q$HyQ8z_GM
zS@zvf5&d0^i~eqZ@IWfpQ%^l558WMDSacn5qKw|iHPQSSw8s8~efw6!WzS|LBqhSw
z!4*dPFJQ6tR*V@tt5<S;^wG!6_oO7HDn+-q13I;Nf5DUM4nQ6L+r`eEJLRGND;G7U
zT=K;k`l4KY0j=D0hubA2Pp*3mI^P5(6HN%Z9sSd%UC5>K<ma8_GM+mUaSFxa_lC~0
zrichxQv^q@KVMh5EpiPscybK@=!7VD0!pSQpL`MzKl%jTe&JDk^v+8#KM{fSqzI_|
z^$YAV7zLl5i}Bk>ujAat8BqPt3wZwd=Sbo`hF3nH&dBxTlP_ZNuCsXVv4=78%}4R*
z!w)fXJ@UvSC@3gk?@U+exYfJc+uO@ScMhIhLjaUq$~MprJ)N27Zi6S+0OG?BKa_|1
zhr2<p?$A>s_Os7ED-YcncybK^q-SIgn$fQn_X<3@1_4wthC61>nk5h2K6rBR7&P$Y
z8br_!=6!+kM{DlGbzl81#ZN)Xe%GBKCnrZ9x;^mZ8Uj#u=BX+6h*0cu!x2ld%MC{?
z#czz9Lw~)vQvNHq2JPK3kl@L6k3hQ%ap;X)yL6@?E-@M*gh(@Nk6@(90n8ln9ri5x
z4LZMniP)Hny^?F^E=OFwdX+8BoSB))!gNd9zUX%C+O_hhxHHhE4odcWjR%rk^XAQC
zHMe))eV2V^p<BBD(n~M(N-nBg$#+S)`U;vczWL@G`QFe1uUrI*ZA_F*v<S%{>hjOG
zp2L-lbYu{t<VwDr3{Tq$xJ(E}i$@ieM-V6Pks2i@*B7rni(MDO7`Z}-&t)<Dt2-i>
za`Odkzq^y~sCN@Qxs<?>i`v)kJ%!)Ce3dDee{3=ydHOT_^WDGUFAu+jBtj|`m4^{W
zlq)Gd78A@5Vb0GV;j>qt!EXNuEZXLd*PebFe}DA}cpX@MTjZjI*4Ni(m4x94o?J>$
zEDkxlTMj)fmhUI<<Wd4n;5)JxZ`hk}{v9upEoWCUbLGDR?B2b**U>un19)-`BDh*8
ztu*}c#~&>GAb}^>Ab_sPNJlnNC^mBp1n9`9;R2pqcL>`0J`fAXJ32bvmhIZL3r<c>
z_r%VhKQDj!?!l9*pLpx7x8$LLLw`o`aN|T3$B5GA3ToWg(7wzO!Hosw#)B%31yvpc
zO2>b4V?Y(he$sGnxMOnlCt@fR2hu7=5En^(9YEXN;914U;v!6O;A~$9&C&t0ixw?n
zgE?sH`Cwxp$wk)==g39p=b}@HH}T{eTI8BMWt#kn2Ok4Tt`iBRv{e|Y8v~#|YYD#p
z`%kD$I!?}s&@RX!@km!A;mO73qtN}o*H9K}4{-}!E3h3&F+o`Ge+?pOE3Teg#gj`O
zZ*<BkF5Wtoi-eUkBvmn<T)c91i*DntLxOgZ0Bt1R+N5H9I&C|g6DrY4&TH?9$5)@e
zMdGp@AH4exUVeKewk-Gt!p1UWG>INOa<w(4W5nXsFfmzzASVkr>W_kf#sa8m8{(+%
zC1{)M$Nu$8k&vGQ_rwxpSIZ`ieNf3o<Bf|uMdj)(Lq5>TMfaN;>#%3q2PC3IC@H=U
zm#8bKsuMue+=#l05;O>eD6b{N63SLK8?NMf=9y<YpY2xG-E(t^O`p4@q@>g6L~z%y
zUuQ<ASSl<mWOnV^HC9o{&(CL;mzRg!++1d~Q(|^@cBj#9LG()kHQFtRb{ERX$Y4gp
zy@4+lhXA>F<>~=Ex$Yd@#o=OyAZSd|WMQ-EQ;>RUJ9KolSllg|HWM1N#v<2mJ3KvU
zL#70KO|`LDTN`2$hcwQnsBJ~V^?2fsiIH&F7^2oTI37Mh9Qr04Pp*Pc(1^n;XXAWE
zHO5Xb!Is6dFzt^&&`^;};<^U$g_ZZ7TohNc^Y1%Lx}1hL-+c3qM{xHA{mr1aQZAN3
z$ySyjWtp-|h9ovDl<PqT9jNi2|NIAw7cZ6{xjl48uIhHc_DDQdZFR-|psO&RF%dh~
zSTg0>vF89bIqb!#nJci|dM`$N|0_1^*$-7+3s`LPK~lLGEltI6imiesQDATDDX?F=
z3cGeY!qLeQOH6j4M$m-GS_iPhJ)DqDMl9L@yLXidawFYP9DNA8cJ9DVyPYt%+ryJ<
zD1sK*bRD2iKKX<x2?v^3Xpzm4+8^bj%A*LvHKtm0$!9vt8J&*3nkWxlz?07ZPn##i
zt)z0))ZFQEh)B^$pX)?w1q4L7N>aQSxv09;);GwMtENt_ZuO|<m1}t6<(FRq#O3(!
zw_o6IfBT#KXwL}TX~?!Re^ttg#I;*}ZYma28)VMBqC@W#QFKd(e(M@XMlhpghMmQt
zy@}TSSu9So|KpZ6)&6%(u^&O~H%zww6_c3#jETf1F#8eXiH)=W9%JqQC%6A%wEcI)
zzQri}Z!psCYy4^V6|pbzhus(Wo!Ngd!tQhYX7?F>W%en4vHJu+Gy9m?k9Hps`#=0(
z_fNzn#L1uf_RyVjxhGaaeUcVz)aPT`GG|!N9*@$vBaB?MSACrXn6b(iGk^RE74Zkr
zULKD+ay&!O0?pMY7`cL7w<5Np6%+KGFiX!7ezuDss<;eEM-$YI^vE?rB$fza<Qxfc
zZH8REnz1J^3)AMU#x8R`6epiYeZ>_t)KuR;<k~M?b4%MNwZUGggq?M88%?+76Eibo
z%*-*{iJ6&EW@ct)W@d_+Vzy<5n3>r!#w=sNuzJ7u-dnY`yS4wQS~a67X{KA<ea`dz
z4)>Ex{XTtLaF{!;r~FKld^eV0#kX||?vR3If~^WENNOyyez9Vml6!!*nv6#-%Q#E}
z{(>g1S*bLl4NI{u#d-jei(E;CZOWXE$}lHmrgm$V<0L-8(#)2%G^sF$Q=nNgq0B)t
zo4{etQW&CQ+tvO2RH<{>@U8xGo(ZyZ;J$?4EV)TknDk_Ft^Peb>Yq2qK50T?uV;R=
zDL3BM;ERTL$}+UBp4MbMw@x9;`gj${n@ee_AYSv=^U`yBXk1cNK7Gov2bv1MgoIN+
zc<;RfqoPey$E=IUHqXDw3#?O2{Q;Y91H%>K4)kJ>sOJolU#A=zmz8I?1aaa-UL8zS
z*mqE7K`S&j1IRD*QJVV-l964HL%&dLVKFlqhzxZP%Rw?NuChmyk_!c{ZS5YnlPlQW
zRB7K`juz34+_Agd=M;xMCt_JgOD)FgSVuu(jj~OQ`Ma{L^30*W`{N%e@L$u#z>v=Q
z-N6YG|D|KqZr(JiXbNMAICbbJiP5D|=qiN@Q%Nm|ep#0JW^fSlR@W{wT-xr5^KGoy
zP(#`_#=#n|jq=(TTD{?+Z0Z0X1C?#g4I?^l-4<BUhI*Sc1%mtrlCGyr8`G~PV>~*C
zY>bWj2h#78=@$!?Uj`HJbdRbKr^BUGe4c2Sg>RkgBR{_N1`?5}`jDBO^ap2@^qW$(
z8i&w$FS)}241RIFfj8A(X|;nY|DMc~cEz6Stxv}N=BAWtC=Im_r?H%hm8^zgVBnBR
zdN2z=KeLu5HC+1M3mvM3C>9_T`~+8OS|4wq8u2)-T6y#!M2^&vRyi+|<>QD&$s>f8
zv9{>#%0PTGk6s5^wv?X0b;(>M)2#)_vBps~^JOlfrETb0%O$gv20~*g5SKufV+nuo
zU>fv46v*Bm^ob=DRE(6;C%Q_x#f9VKu#DR~Ml~AYNGTbFh1()pI`Spq+MZ)*N|`;a
zeh_PbOOLz^PR6NhTWPDpUOqG!$E|uR2|+1xK*#HPlJ!0&vOe}Ljva+YG8d2$qO__T
z&fVnZ3vY9tTpP1&X2~zF<#34N`FxTzaIT)#Ok69&vJjtQr`r0ZUDM7KKGV!6=Ofix
zde}W-mx95Ml%Ai)_0|-t;>23@dIXL4bSG@DSG&oz^>88lyjlmsg&Gm{HOL2TR)U}D
z>?js<8eT;6{ZHIJKF%a$TU;l25DBnz0YYo*)w0RrB?dAjIZbi@fJDT&PuQA58?Ovx
zB3eT!L>&~VHrn@XD==Cf(9PPuQ4k?)&^Nb!<}PWbg0ak%SHZgwli3I@eKGiToN+%2
za#m-pA;Wo9ZBVaN+EMFDB=L|m<T5<z@;bJ~n_On1WBoO#)gUg>g=UOe$K+5<W*RG=
zAk~!BF#5z(Y9QEFQuZuZ7vsv$ajZ8wUUAToOixHbn91R~F^DmC{3qVvUNJCgVNms#
z*{;r6!{4+j0*Wm6h2pfhRFl2FfIDHrZmKoJQUjd&yN!ZS5{3Cs_7;<xs(_gD8YBfn
zPm-Zb9)wZOP*v9o-q?wDSV}FS*!gAVp^$MX4ULuJ*6(N$k`?1@^yV;SBc<du#Kh+*
z?!NF;+Gb@RM%V6C)HTPxyqllmA53N_937j3Cr269^10O=>G2uxG}ja^Av@oS+$KgX
z($B6C;)rmGpzA0;qRJLrxaC^0BGgFu@4*R{;FKxf3|M;>mV+)o7OViF^$!VXvVt(?
zeunf?Wjd=SD%%=~EO?f;NwGtPWuh`*f#{VB&!O#YA`7TeV~O6y+Pw94`ss+2Dboyo
zB|!&C6FqwW9Rp*NQ>cr_sOU7KQOJyk8|RLQSA*6ubS3yuPP<MQ1!xy}O)yQlV5Von
zBj=0itEp+<A}bYN_}*|bQKT2yharc_n<fvnHX>)u!e!-WxkT6EI7>tnN6>|GQX{6W
zALZeeC|4dvP0g-bh3et)$hwn%Ka|+?W?;Z;<#iJbd7D(HF&Y!@8ed?{d~qUV`I)f+
z4qI*YlS!4kTcFB+kQCwremA{z=#S(bjRyYeBLRp4(PeDNS<kpT3?S#GUFW^D+RA(-
zH%LUavMYb;XUF8RyAglZeJ9~?u0cAVmmHaIVQR!|NwJQE3Wz>63J?9kKSK;WfQxy2
zY%xAV`m*61NlfPLiWotOusMRjSTj0jD{Xwc5(Uwuhyy$bg%koM0~|kap69x>HN|7r
zF&^SD+MQ#lYe~y!#^-j6Eo)`oADzRY3w8OrI`*iu&UR^Pv7QHkkGct;X}YRB=vNB)
zTzmiAoyHqTD~EHq_JaRhKsHo}kb@(~nAtrXBuT(F1hZWqsHaS13LCpozy93AWpFRw
z&+FJ5OC9m!j8PfPSnwISJovCy8L~z;z8$4BVn!o^Y{QO-K5suCVYQFb7FUc2w7J16
zH}pgwNH(l;-jS0wd>C1U)}OT)a-WuvVwIKVCT0<r20I{iN+GPq_L{7z$RnH-ZiIu)
zSmsp=AbVWaP&PatS5%@%^e%xr=L8vbNmZOly^v_44HF7}sR`KS5*&wh*Du5={M@&*
z*uyMsu_;q8BFrdswL=b-n0h1Mzm|{aIU1vE;y1>GZ&6=a<M2?e4HFH0Bgz+Ug4Wlh
zqng_Lh+FEKegr4_iCI$9jMS6htn^z0(V+$}yK6!8H}x-fM`~kDTC8Xq0o199O0b8^
zaYUNrO1*slwA9)EZPdonr<eM=AdOYyR~q}+e^D(onCxU5A2qWMrNd7Wg;r)I3xg{(
z5Q4CRGWSR0;L*v3v3g_IYBXtO<l`<@)YQ#3;#DUm7CQa;V|A!gQz?_P2@=D@*&(nX
zEM!pw19nq0Hi&cqVPPQzLJj(Kk~A(8Bq3oS;oV8jVH6%=C}LfOE+z)VB=IN9VlALL
zi75W03<KwD{OT*<CZ;VRE$!7Hx0F^<S($dKNHv!?$xK5NA>_vCvpaR<leRv6w~U2_
zHGV&qcA7vnM?A$$OB?wrrJ;f2vnykXiHUjSGdyu0nR1FsGe<nc3_-#O-O$_tMeR#W
ziO3M<as3`19wJ+HAy|^4r?-I<e>0L`hop9No^@zDzCo-+oroRxZ&*CDL9myiQRc)Z
z#3;?MaO)_-_9IyK!Dy?Z#CAXVf~=DTnW??9(V3>hU{8{JrfIz(D(7s`Yfe<!>`<$s
zAgMPAA)JL;@0=W#e%ZS8dOEP2+&LovOie;e98W-L>_rK9db)7oKdyN}v?!jkRy8@F
z!GV?6ZRHzO!(mZs!jX)_X0})W!N{w&LP0_8-`va%>25^a(e(z*?^X7%<$2H*PtLhP
z#PgPcfq}RG3Zb%p|N1qswUt+&7<j$SZwUYZZXX`PqoUxs1kzuobGYoUh-@K99Q#Nd
z2)`y@$R{=DZ_a(PjEzy~0lGFN{|@T!Q~O4D?tFo$*Sr>rcfoRr&h_N?<AUK=UiqIA
zH11XXti<R2nP`t$wjwjvX3R5rN-*{xnQ7d>+eJmgVl_x^Ro@R@nab5oC=23~xc5X{
zZMA3b2|j?kU1^Y_P~If;EI(tjhxG#Z$na3}xI_s|K;cPmf`oBW?=Y1WL7&dU5ld&+
zKV?R5$X+bW|GMIOxqS_a5&2~nas`msh6QtOUc@aQ;n+V!k35%YfM?%lMxwL&N4r(u
zqvj7+W#WOs<uK%T@v_m1G7=J|P(VuT=;Gg0R4ll}%2CFDg5HA<a|V<K31UIGL}!Rm
zib^^?TeyjiyL>=D{7cWP$UR;Bv$KZa1*`yCK%m6<m~CV5J%e)oV^=U~yMEK~ST^Fu
z81%Kmz#kSso%-PI598RZdUMP%x;d($ib#&X{WSWTppY2~vTR1Fo8KfS60KTTb5rTw
z0HC)=lIT4Uu6C18rBK`19`t(U0~<vtM2W)o288)B_xrH31>1j?B&_Jv1?Jb^{nCDN
z@IdtQ@hP&~6gQviCNe%ynQP8&&XV{S2Kerg-^;HMpA8Uz#pW1F!xTew5A2-C(2}!c
zRHz&A0|+0qk1)k~>y}hAc!Lu<ZpWT8z28<kirWw9H8kEr`(KXPypJew>(u|^<dXM7
zGDLxra<-p<UM#^qdB}aa#$l&`0PMJ{vq#1evapr(x!cKm<-^WLcZrDnp{RFnc$1P2
zDgfcSJ1d^qZct&H+i!zdF+DjU|Jl@d0-U(Ba*bcGQU|F?bZV@0`=%K6yR-)ngluZ{
zG*D8PsYUo$*r0<e{Ma}ORRm;8QzAmxB^M{kP<wpA!r_fW>6k16xGeS4gA-X8-p>Ss
zju%a42aO5?`2{f|D5c&JnBej>&BZ1o6?6~{zMAbUyz<aH6ea~ZqfSQ^&-WUtYECT7
zt)8W7c(4F;2bV-=bg*z0=n>`M>PbVB4<pFNFp>3gbH=2gEC#jocs&vK*A(&lnCArN
z`e#DpGzoIEms9MI`Y5%Q4lm$GBNI)2WILG^)kbH$x^i2c6?W20H30BWnCLSQq?BV)
z8?|S62V6WLbjgWmG`BSFO5j?=hE7p>n&B-Nb2XG-*CpN$zH(KAjgQ*+)+<A)DdS)$
zd{-9}ttdA#=un$YXKChz1lJvj@F0L<H7C+(4^S%P!cww=YBC0MGH<xTxW)4h?@nSI
z4C3$qbitwXTE|GDBe1<kh0_F{yx&sB+*9k2KaFmtW!)}r#oe~8YE}7v!F*Tq`8XID
zm7I~5xZmWgL(+?oAssmA_Wlg-$@&|$l6P8?u^I~A@NQK0on7bpOH2m*>_Jvm(csVC
zi~XP9F$eK`omcnpovL4OlfHnzyuGy|X$1MFML#*_Z`Q<oqP+DJQo=ZR3XU^EXvcK%
zpC7sSRDGtn$@$UGSZW$-3nV=l6aE9v&Q$#`()9KVRXaD!Ac&d86(5>;Vr?iA&*SWf
zIXv?oy{WzcP2YOI<EkI?cb+tiJ=y12D==sUU8reAs&6n5gZT2dEtQc25cy0KNPkWY
z!wiC(vR+BCyuO}&G}m@>#0#6QdvR>MYV7^BD8ED2kKL1>N)t3GDE=oy$lUzo+13ZP
zf*oKIX(x%hQ%G(vFPp~J?Mc2L$NwHx@L22n`L8dReIxH^yDzqVy;0)K<5W|1AOp`T
zv9WkB+3L!LsY5T?>ayMNHvsnPW1O*OC0blJtd3?S+<kW!du<--l7MDiRUYDD_fH)F
zFY46!w}B={ER=Ivk^VrEFMlt;#!CxzgEB!LyiGp$mhHkWVvzV(@6dX)nF++$yGKk$
z&&Ze>H6UfQ>l9FbtzA`J&5@Mx<H}4X8o$0z_2rQK-FVCIqoc5iUYqZ6hPIA3pNPws
zdyA>e32~uFfx>_%T_1$uSSN8raWP=JiJ2J{I(XmZJ#5x#sO+5}6(pIGwdSEnM`lcp
z<$b$PF`SIchE^2#r&{R2ICNG>$_oF`<=yQ4?ez{LsjpZcTuON27@YS((}hw)@{m?i
zGoK`b%Q07Uwi8humrhCZvm=q1BcqsPnPX3>i#iUYQtKpP!FQE~&Y#G*l^h!R@tO-~
z%aO5Tii?wq9#z)ctx>T{<cvfGNGV*7auTD}n79eE!`0UAL)zUHbMr>@{WmI{lMw36
z6%VJ*8B@O>$Wu9A>!^jZ^6${`uJ<-}lpm;pGsq9*V8mZLt!W#TwEN;xrVs8m#CpJw
zMf9s3xnc>)z}Dq2$-vg<fV}i{!1QaDK4;!e#xyE?7#-234dz7rBMxK1NsmRzTpF}8
z-*+p<LE80MU4e>~1?R9Z&T5qJ7^KY6(CMuj4}Bfb<#i86P5&yp$3Ze$ThSIq(ldAw
zfZynmu(WAUow4&3<Z+Zu?6b$?Q#W}l61_HA#pqfG8`mBM+S^l*u1iDoua_QFJfvG+
zZ;)(ZC$6Uy3w_ceXmAVOsel?;YfGiWF;1AVRp0@Owy(j(8(wYL{Xf2JC_WouWR`au
z$o`Joy;Xi;l|s_OP4L7aF5JhOCD8B;<~4>2JoO$BCf3iwSMi(poNKP6tUg6pzUIPK
zChz+Kt)tkbV;Pyx|8@(vNVUmzz#vW(D}yoBX_44fbsLXbtlExnZ6$vTD0<pH&X4J`
z^W>EDX`(3@y)pQtnj)fyal3~DA<zM!2vdQ@&*IY17ttghZFr1q0kAG1@I6Xfe+6C|
zdBu+>WWC?__6~B`v<`JMo@II;kh)?pjzLnb(XfV~*f{)AzWv=SzYh4(d$s@j^M!o5
z8$Ym`4~WWLW@`b80fHN3mb!``4OKQ8#t%9-0k66-V?##W!OBe=MpuAPpYIh%w5+M}
z%Ppcot<#uwTpauB5e@Tt+6S4<<~ef#_bdMt{HqABN?p(mn^0u0?20`*|BOyqzdvbz
zp0C+)zY*|eq*m}D0zdZWctwsWkqe<RN0|$uJO>pb5xL47(>=95S<Va1Tg{!*cLx!>
z03r~t^2gsyGI|&DiT<wLr0=|&gp5gj@of0lqnp(??15!e<fyXJs%H){PJM4g8$()k
z<nLd)ypVTEoKRDAV8S{8Vs?eRx#vvag*5cCwt6TBYQsdsYB7Zv3`TNg<7YM1oO!As
z+^*W`y+ZFT?OD$sEAT`2rTd&QV|8CC9PCEP1<33X&F-)<usev=5cOiF6uHo85J_XC
zxfWh>%A)CG=0$6=KZ`FMV%_m7D$XQ(wx*)2qPV05zlAfGaU-!ijmdmQbV@fERs}-E
z#z8oAB2rAuypB>1j~4dqx=NJAcv~JT>s|jdM9TVN@$rLVT}DUaOi7$?rh2ymPJP-^
z%))!H#3W`fKp@D#|Ao`mDo*{}?fB!q)V~r|+Kc2mrf2fyDyAdg*xt+FxHe%Dk%gDF
z#3^IHmqx(Kpp=OY=n7)O7U2MAAQmfxzF~;wpu~pnZvoA{FPnedj$kX_dg5O}k}Nk_
z1$;h{w^8_wtV5#~p8!Bd)Xme`$;t29Ev>EL5fQLl^1nS-YBXKBqPn{Hr>Cd8*C#WW
zVseI-H7uF5>ONTxO^--8j*YR?w)_8fHI<r<k2jZ!l2j%B8Yr~L>3XER<#p=-F#JD;
z2>kTDfT>MH{5g+~1OMO?ch)$ZmO26R>d@I<AYBPh9seb|jSaOzJ6T#mx>->LnLbA^
z^#ZmBY48T8@I2C9Wb)l?xUgdfF5HDd4Dr@SRAFS-9$x}m8<Qky##|ZGqFu|$Rf=zp
z4X1@G))}pbzgX=I@LP>{LR!{cSTXgueqb)nA6p_KQd2JoZpySZqoS7UWnc9{)h8UY
zx4VlCKguvKE=owq3R8q4L~fp2+l|wl%A1te4z3CSTD&odA{3p$Xc97>41s^ZUhB5g
zRxtqrZvv~?Y!TTS<ZFeoA@wO}6f)S~taCu1lt+39N^VHC1>qynex5F@$74j5lXdu>
z4Sf3Q3f1Zq;XQ55u*e+NqsNMl$<1cOhe_%)bj)-JKQH<%cI_2O2`E6+Xcifn;a?C0
zD`PS2<vQymD(?e{IO8@Sg3OYaK8;p0W2Pd8WGSjzozg3@<b}!SWi~ncwb*N=jD4qs
zDcX`3qbUGM)`qo$O}~K&)A1}0P7%N9uv>n4S)Gyo^+Xfx%p<8EhtYn2YPu(<n2LV>
z33Kfe<8)rzO|0x2U#3PxaVjy0TXF5<MhxOQX*TqZCSCJtKSsukgN`+jyrve|v@3|s
zp)@5JA<rx$t;zVBx*HzPh>2p!HjquI|7rGKVn5LWW5p<{=?n{rF@pW8AB3D4VO^IN
zqt%&)#tL|l)-VyCJSSpz199>}II97VPy~ug5xeF57;8r24nAZr0ZJn4D$xRWUf>9B
zVb^xS1~l)slni<YMM(VXj025VOzsRQ)n0)(k)c4s!>T3i7o{-1i7Q8^M>Nr1Z(V6}
zN2hr7RZAcRtJ;o%2HEWjcCsR!nOTdz!dzdEb0M`RL!z}xc3xMFAyY?;QUfX^IYY@H
z2G`G?>-S%x=<qvRbcPb5^J)*4F6&aJOu%<`ZP%4j-)LXJGZWn6JqXB*w*BRY(=1MJ
zeaIb<kBo_kMZyo#*kz2Ye!TWcVL^1;KDJ-?26Tvt2X+fB3wBDd$Sa;H7~sFhvmz=a
z<eU5zrfG7e>}cDQIl9Km!)D9eM;*mjJ#nY?lp08x9nn&9wgoffV8mRwfc#ypO4kgO
zhq^s3K4EZs$o?v2nn3vay@v~ozR5q1=-hIli2W*O!*X7G*EG0MhWwEaOG8_`Br-c5
zK~rX$Nz&nwTjNP2{8y+PPNtSSMHnT8H#k*P6==!2L4)ow`sXokK_e$}k(MDd;jemN
zdT}pG`(L4ElUKZUVz)tDMM-d-)+c5~Nf$HXlX!x`S<>F@%?SrJ^I?w*xbHs)OrmD2
z>ByENZa>852%+!(P{L@efi6_-;`5<EWo6xU?stbx<-u&f5s1+e{n);~Uff%als8N5
z=_>FOgxQ)5-0$<^`Ws7@t`~oZc7gaF!QLjEi1UtJMYZM%s^GPvJorwqWhk_uSA^=~
z#_d`*TUx3V{0cARa%+GB<AK}sl_(gS<F`(mDRlb{MH|h~j*VGXY07PHUkTaPYP}Tc
zfzv*N^q5;(FJ=`T@F8wW)X;;F=f+vmLKVxNh54q}yPk;mW7K1-j7;>?r1yp>tpDp3
z&N|x~EidJ)#~c6e1!DS79bPd^VOtrN(|_HFPL!4-TAFEX7kk-9$B26#mzzzhS?AS|
zTymLyBQv_Xf+_1Tl3UsAJ~H!?4TXAyWb=!n_n<Dj_%68?w`IQU;7T#Z*4Zin_4cvc
zNdHXL86O0o)_#j0JC|HaIq1R-jnx6Q8BziAVJOi4R4KcQGW})|l_e3_)K^_!4AG;s
zXEMZYGS5RlVeyb`DTZSywWI|c|GdU%Qj-r}hT|A}cMO(ILpd-mjy;Uz!aQ#xL0vN~
z7Ifj!nk|wVCyj{bszr=BpI`M)(4=Tg=l;}Zfbcle2jMYFw9nyDYH_dIH=yyhz+!wp
zDl4gp?%Y|^{fV!y7J+QDwxE(1QE~XKMCcHuW(lYwDb#VdY3rIq<ZY!%(bI_)CFW-0
z)EtZ7NH&i@S6g)^Kz&8os#Yl{H@=3b8(DhFaAqTh|2Z0AV&c)^D7aj4d^SUSs!wC;
zljP{5Sg9c?J<t<X6P0oqVZ{1VPH(QcrQQX7BW7u7H)a}Lqw%S}ey)l%Fkn+LiYfUX
ziAfOo{?Ft^-P3}CH(_58KlZopp(I)erv@yaG&?RXNlq&ei7q}-pMG!5XlfFfkKRNY
zVxYAD4I5Ea&rF-&@M9&P(w?6fJ#Hm&e7bLJgz2jwvJGKQ-TsV%vN#K7;{~j?tV0>z
z@3pB3Fe46*c5%&joHfL?8b*162s;@+KmhEikIPtwT)s;ozLf&-Xf^LtQgPt|gw-uL
z7bh<xc`<WeN|Ra2(7m;cBg{5?2vS(MDE)Tn^LXUzR+v@#n1L{9u0jpN2H@PbX=|?O
zv-?)sS%~$ceFv=1Xww(7_tRnoGuf@Due44dpicG|uA-!Yy%D)6gMSA*D=*LS#KqUs
zhAwGoDAf1ZSt?Kx|JpbI3vB;76E8RmuUm8Hw!Ja`DzWwzuW^6iLwGn`a}#CNsYQc8
zLipx__lmryN@9GxolavtYVU+wNaBg3Fk9@zw}vK{{?PDpdjnbdq1iZCL!!&9SzZx&
zMU-=7F6W7hPrs2j%h^Qj?S*2;4>J%(on@<}7ii#Hk(VY2H>((#Hay`^%9_Mu%NV$=
z?Itd88m-|;+e!J&2pg!!hDQd;_4GqAv-A;$tAk8inkhU59D@h7lnv}0q$Mgo+^_nW
zZd|jM7XqSmu`LH|Hb{JikPlL{Vl4h1x<q>OB{-O#ZNQprOlaiGbS8>h=C0QYrp&<h
zk5Zw!n3Omp%!K_tR-4Z6Cp!0|blH`|uH?-g+%e?|pP@uJcS;V%Z|s4W1k23;Ik>J+
z$N!+y8m=ckb(`aTYeS1&ztdVZE|Rr{{&9uYVusT?_~kXa%f7Nc+(D_4rY+{l7mM)<
zhi#Kg-h@~sbRG$F`Q0FxMc|&p0_DJV3{mViC-rK~zCQ)2J`@s%><l7urM0;B8j{+e
zher6OSFE;tZ8U-z6D6gxxWunks~*HswCprJ7|by(#%vFXfn123QL@t8hA-SS=1R6a
zjVOA!v^v|yGo0QL{weC{Kurnv<b0#qPx<YNm{w2SO5Y=P?Ic)81OLY-_b9USJQ(XL
z>Oy?*FY!k1;_vNbqoG=tn{FhPTy`8DmpD~PIZ;e+N?y{yKS;-UjAdnpTA{6&+B%rA
z6<FGwE;KQ&6A}qbIaLh4hLbcn+H!64A+=$bJ}aq=BsV^&PAKMKy`1U4>#YM0o)q)1
zBj+abuaUDde75n?o<|HV-kwIb`u>@eciU_a^%OVBR=uhc*Jxsxkd<{0<=-k1Sp-F}
zGfP`$<PSE^)}-JNyCMk`jp1x~h_6LTve!wEq?cQHN+TZi90z^m6;s#UXZ;yut-sUs
zi;80Bz6r5ZNU%7tXLrC1eY0$B|12&c#JPFc)g>9O)vS`aKSXOl1q+_=n9>Pd^6Tip
z6`NO?Ly*BP+^y8zp2X@4F<`T|7cmTgrhL|K8o`gtRS}nC;_xXH$5%Trtr*^<k_h$H
zNIPs*EbVJ2VwJbVrqpQZZ*1s_%&n2*Bb=so^kq4>tyvIB<i$cyOcmKSi0?kf(nzyK
z2xzz-i7S$Rjr4BI8Z&uuXHhFs2~F4N%GEda<Rs5}{yF5Z;r|;E%7us`$KEAAlvW@c
zKDr9JPN>neR+&faxo)Jpda3wJinn2^&=?1!LAXV{qfY{s2L7>WLJ$WybO<925H0Dp
z((E`(sYAdvgcSx|<@i%XC6H>`Ahn66`=b@=N|QTCsC7J|mj5rwfiCvT+Kjl_rpwVE
z{z20rYLLTmDfJ?uZr|1dwXG;Ic-kDa0y7t{XP&Y-_0oJ_QezYQ?d3xz{5_E#!jHUt
z9K+c0czg509f@CC!H0+uoY$#DKgQ~}*!}t#;#crWnt9Oi*KA5kx?*k%G(?Ff7bx%s
zxw~L;2yN!606QS)W*zpx-FXbQshBibF%9vlfzYek*|eS?Ft#-{<BuK^(q@Ru)0Y%1
zd~9Fcpj!vuoc;Mx@MgyTWaJ{Wb5S;U;I=Y9nda7`lVq}rF->IOYhO`QQjUgJj7VND
z8t;X$Onp{SS%P|e49OPW_>dSGH@~Y9(gk-B6GbQGS^(2xHDf9^9FvvShSsX>7&f!`
zd)-MGU6a8|B?C8DSXx;`tfo+7T*In5)h>_2XA_0lnOaj&+RoapQNpAYf0aLf%tzm$
z^)r4+492J0z66hoVi32u2U@-oJjK^L7?Pwy>LDr-V^LgLb1nm_kw!e8At`Ot4H^%f
z5@C4HZ*Hm>7h#V)kyVYg1M!5u*5glBs6~FOM5gy9M$AOQaR_=WYLi6lntQp?dYrD}
zXvKY><2vu#%gxhb*2u&)AqK64df&}?5@Be`1^AeO4AG_eQgz@-3W^4Rf-17q8{8>8
z$0SIH-__M+orT{mEV^;uotc(!d1<e~)4tt&Dv7W4ZB^olzfoRCeMqPQ^b(pU)R?;n
z)ed89s|V<Zw9oJ0f83ul;b3cVgb41~s&PKjg!IsUXRgbhe}DiW+{Q!~X1;}bFlp!M
z9V*7KewtfaH5+2eEk2Nf>>`6{eZ>t~noCq2{2}_y<C4Gl?%7BYrQS1!=k(|vl1=?z
za~T^bID3fR-oAV87Y}@BH$23O9UF>gEzq~g!ym0c(B&<TdmFrzH#c_Xqj*bDs#yjN
zLmLyT#Gem+UXIync7M`vbs!eQZc)*9$2HNOJh<>naoL!AhC1*<PBjx_U)#j559QQA
znh3OqIu9o)8truE!12jCJiyOUK!PyXC5)uJ{dxSo@<ivEhq~_Hc)b<89d0lq^QTJc
z+Bu}%grUMf`^U!#zC(xU^g*9f9f~{fB_7MAM1g<5oiL7V`KnP>+29Qrn0-N9qr7uP
zvqk8b`x}W(mX$ixhGaFDFUq|U`OB{?)j7x4oxz9Z-wjB%_X3=s;ffER*DNvj#E)ZX
zi)gg&Xvvyf9ZpNy*`nv`=E1<wcI;Ij^OmL{S2AWpte(&7a|L}kr8Ru!og1ZEBE&*A
z8BNfHK5HrS^pdU_1n|PZ1Lbj!fOf(c9_GRGF1P4s%}AynGy4ZFnbAej$-!C-Tl+1t
zJ?cQI8TL?_?a=jD-||yDib|z$6}1~TKJrLJE*`V=RY!&Vek3d5S&GF87>kvWfTs;9
ztoY79i&FWXUea<VsHs!A&F)6b*!7clFsW5yN3=!K<%d{e7=L8Dk!Dag%89g-3{6J)
zGV~OHt&G&2PEvu6JR@!4&W{=&m?)@+PDl(<o*$6bulb?S*^2xa0kOXz#Qo!v17rc1
zYPyHf`#bPMc(I0-@WWktK>6L>lVm~_bRbz@)uik>D8f)VGr-{iE!r4#{L?4VUOzcm
zTW+NGVr|Shh^;&W3Da!>-X_KdL*ocbl~GF70k;NOP4}Cy+Y@u1#y$#W`W+l5mUuvn
zN-~j%0|k;@9ws49g9<^M%bz;l?`C4UAN{-J5E81(Be9F*ZBfe4*QkeNc^g?HZYP$$
zjK@D(MR+;uP*So1Mkdl6>xj|odA{Lm4&5IiwtfcOK&E!}zC@f(I_3P4w(qvIfGkt4
z81I$g9jfHp_SBeFmo+nL1K18TX-tgNP~;TCXvDjll$ISAk8wXhzO&014XahaJ<!p!
zxthTjU_iMib4d(Xs~2J$g{d6#F$e$yae5oBh1ew3aT@$sAUExH82y;Sc=Pk0(cinD
zm@ZBt{A~o@ubhI?Ak5aV9pgENp2H3a*RZVzrXtRcp2N>qQx)S@7D`?}jxAkZw1n_>
zLx)k14CuUKL>B(KPwj2~arF5&pcNRmRub^ndHnbTGSd)fE~OLbL<95tZG@t<K-8ir
zfuZUG=ve*5|0=7D_JF#4<lgq8bD^58@*{+d8`479#=c36Zl)<*rN|*NK6{MdrIX0f
z;$Y0_L^$iH6T9e)Uo3!R%}NmyR5rs@@UmT<Zd>Pq_Je$BhT~5bhYnW|1=coCN%g1j
z7dcjNr}_QuT8D>wY}Vl@Njw0EyOc@#V~pR;*(8BA^jTMway<Og3~ox)8s_s?l%ROd
zA&?IoU!N;$te96>JtbnB&maaSewX1gOua7C!gM4&V$=M~XS@5!Mh4@4I(y8r44@N-
z&vE@=#CRhfNah!Jxz(?dW}&FgJt+6qm=sNxp`1>!%ZE9O9a`&BUQD+73W_96Hn*2{
z@ogCccTr(INwIY9Xv}0?s5T3`rY#fv*d-uh7x98dR)lXe!YFr}42xax=*H)NEIs)&
z7slVZ%m+r}LM`FYK4Z`3a?AJe{_?(?pxfa2@};moAiJn&?&$_57PO*{?&n9$WnE{G
zbk&pZ<k-|0Z;DK(-7!B&hM~qVdhW)*POci;IgD2~2yi%Ow%-P3fV0O4H<8A*Vz=QC
z(F&0VO|x)TjlUWNFg&ppp>N3^8Uu}KR~z@Dc}%{fE^^A68;KK74CJiT>-1Y-qZM=q
zb1-cSj9vtfQLB|%k7h^MB_H-f3(f(?kWRgSIjxM4CFIO!mq+lZaoJFieA{;TMqV5Z
zFInlcxQ88qE0}mtH7HcqM$=XR@}{*EOZm{Vx@mkQBuJ@;T2)S-8|{sV9F}99KxFgr
zbe<%C&o)>!Eq<a)fto}&tak8kv*ipC4zJdszszUTMomhg4x$=3)_+!-FsUJU(`)HB
z?n!Pv@lD2qQ1%b$EUZ(a3m50r=Ag?v2IA?WujI6Xv)dX13|T6Ma@C76PhKtDs68wd
z>GF)Di?O+;Hj*<3XOgZn390gskJT@ij%DZ-RAd2{)tI}^iS01*j1t}FP{kn;Tri}7
z3`cvekFr$1PT`jTB1oZ_sM=b)%7y+i&xbQr2;mYY3Z4A=Gd@1PWfU6e5TtI*!R6()
zjr*#Wtvh!?K>3FXsYX>`V&PVc6*>ti>B0Vf@J^4H*JguZPjSV{Guv+1mCs|uUY&8K
zzB2HHZw7ZPb``tG55)On@A|*8D3n3fkN>?C9=0`G8{8tX4t3oZE07-N&#l5Cy$k=g
zUzp&TRvfe^`edcR9^BfCWet=|>}Uy>QfKXog3+P_nPYdSn7KzMr+1!IAUZOqFm$pg
zS`+b`Vj4MUghPrREG{noF@KQPl9NMfIXW^o==0AZG{h9<;J`#gM4YZ#!@<Y@5#Jz5
zh>aa~c4lqq{^#fT_<sZ%2<YfmczAe`^Ybd<5Y-4W8roQed{#CDwn)Lwo~$b(@<IPG
zU+>@%>9_s^ni9}AUo*75!!vpvg?@$ly^}`UOx&15N_l?dVUNyuG~Ou1)3@M74{34*
zPr`v0&NhwxsRI*XvkT|3x^iAsS%}_+<B%4cb?D09)h}&WHQVMKX{N0*MH1+{Ash@9
zf>Tk7W<V1KG~mHLu(d$8QyH|SSxF9_cdpw#M6Ild+wZeLJZ~rryY)p8&^up{YN)o&
zEH15v{pnF(cmK2wd%<DSt=TAa9WyNKqMg$(4E}eQ3r!1HnYeb|>49_kD+6j`EVDNh
z#g5ZtK7gRGVY$oHo9<?Z@uo7?gTA0(TGTgvI<4lL$b>HbLp@5bCfT}!9e$?1<zoLX
zr2*q;yar=XYq6G{o0A4VNks-gUEQoJeZ(Qi(H(fup?n%kH~S+2O~RoUo@{txP4$%(
z>jZNxH&z?%Z*TOpt2g;>Y(kGxX)`^ZmSwFf*6C!peZ&TmR(DRr_mQ7Ra`_YXBSqM}
zx1fq(LCnUz({)N#e%!+o)`$f%a^UYB1K{fk&dbe?HV3HkhQsPX#sF<I${3w4A3aG*
z%@xWtCb$3rEvoN;Qv&;=;7>m!RZPfuyT-X-nO^s|q~Y8Np)cYw`C#_GY-XVS&@G4U
zZ+>5>OMcOFDv7YGR^+Ge0GKqmPWU10(n)vCc;7*{`;-Bh$1<FnZfO5M`909JH-Lc;
zw{S?P@rc@#;XwxrgpGxXuROxYljs9z=HQ%*^EF+*C<ScnJOSaL1CG6vx36QCV*RyF
z+>JW7iIe<5&dS@GCr--1D<-R+!}H)6{42%<-(wgobWG)FO~h(8&BVio2InbzW3(Fx
z^SkbG=0~@Kpekz(t#r7vpbH64V8tC~^!IQ>Qk76Qrsa9H6xhngNNXl^%iX-cIoNgJ
z79nTk+}bi@0ZYo4I{Xh72lR1*)0?W38^Yt*?lPDc*2_8LX>__NTr+iB64Ls}t3IbK
zC1Qu%q|FfCwtAMs7~b&DDmGwz0gwEA@~I+LFYFb|_wXBrL8pwfUYh?~Uga#y+pudA
z&*GOw<fCFKw_OP-*`Gnk3O>;L2n?uASju#a+?v(=H6`vu*$`!WxaOwi6}#4N6aZ&(
zpt|lsQKt{q<Nhnp{CeZo!2-bPA$=YiblEG&TY3xW$=ZIp^q}2(<t4qDczb*9=obEB
zaFyOemq+0x;{(76V9D`iDzIkr*VDYLPFG{C#*t?@PKCtX8dPu^lUv>K-rkO-Zwaga
zRKN-zAZ-L){?rEF%IN#QO)h!AESz$jr&R7k0N+Iccjz#DY{Nfp-rxy;{_K>Hxa^OF
zza4jLG(E>}JS@8Di*ME89l-?az1<7S$i)A^4)P;)O5hBeTw*&6qk9jPCJ%($13qcf
z0{ozdZ^3j$rWJ8)yYHI_H$wL)yFPa&Lcg1k;sgD0S(z#i>rabBM9@Kx5J2N6y2|$@
ziD%r;1(8q?_V%UO_-o=87TZ0?;e4hG33yg3yCc|J+<IX8=eO*sp<pl;%e4MA+7|L}
zzK%J(JO_p3#r2O49vgHg^>~~1@~})tRl@F-3L^5dM6IneE+fug>?HM@f&p7-W;<Q%
z`rlwpqG0~65f0wCQn<2_h9z7pwDK4XgEF2lFr6I681dW1l2>;L$~9wij9CQJ;@V^B
zDV=9@nq=}wm$JFC92!?*4y+xbe_bT-9Rf-9l_UnF#BtqDbM7F+_+Z=ENJDKja?bx@
zLHd<3*(PLN8~AcJbvHjyS}wtZEg7_+6POW$Up+aVwB1jDGZ&{tNqTr;F8B)b*lBG<
zfCLE)4w0PU6UDakY`C?z$>(%vt}}`{3X|fn+yl*%Ii2D{x73{CW<PHzRYuY3`&tpv
zwkdy3JEvj;@UrKR)_z@)vOxJ3#iR2J0v`fHP_)hG!aISlkGywW&vf0mY~6Cx#7;nt
z@~g)+BXV{>h(oGdII!|*)2<O!)-QwLk${u){)i#a4pOX-SSvFnC+>j>nn|Sp<t|R>
z^R4$m1pZNpAiTc+)5n1@aAt3?uLQ;(F@7E^m|LZo3^geP-eI#Cu<Z=R20%xOc3$9t
zGC~*7e(N3leb1{*>`wRVytWZ?0cqdvx|BC9&ss(*ZHLQ-$#G3$n~aoNp2dIOAJxPg
zw54bfcG;RKYmR+=C!q-n3mF9Z+(WEfgX1Yw$0Z@~kjsBq)~GD0q3>NPOis${DY}JZ
zF{i{kqC#*QJICdDW3+Lalg9~uMNNd;6_3~*jW1Ny)s0yd1&jsOvK2eTv??~ysf3WC
z?T=o39QxN}+26U7#NNRKs0m68&agt+4R9by4d4+w?Qp_8@52OB%*x2ch=Y#JM*vEu
zJ9JNQBPMZH2qY&-BJOIGi=2zip3j(P3WPBktoV-lz_ZKmBvSDNA&`2C<Ij%dbHdO0
zLd##heLM^=OxOqG)}X^n=m8IQN5&zRzjj5k<}1VU7$WW3RCR%HSbcr&HFqV*03g{X
zA%sG0BN3~;;udcDQ0&Gq-?9{?c1C5zu!?(F;Qf*w@NP}InA?SHSN%6~BEf5H62KQK
zQ~fRCp<HIf{8;4J$!Omq!wP)ETNt`Jp0wYiPp++o)jYls6_a(ExgnF7G+f7W%5IZJ
zjE0SVxo4(*=%%g>6rP2-sS;9p14LMiwWu~DAc2Qt;!Fri`cRd7-{Hx89fZF4JaWVb
zUdX=OKA6q_x?ge}jf-Wty5LT3`UiyN3s<0e2!MoG;Sq*Kfn)K6ROmZ~+o*GP&wWeg
z#0j@&*&iQ)XXW1RlLZiUjO-gvZ&}BNRuA-55iibvZq31w&qCsNFKl$ZwiM5VGj!`p
zTQsAf*ES({r+<&@IBb8nfON>tbqF50lJCJXcIY3LF^@Vl_vRM~;>qg&5@ULx9>lXw
z$|vwx`}z8E-rwF1Y_wSA6!5!6D!QLtU+>yfDixSY(TNKA+?k)2M{k=)w|1Y9W4KB?
z05k}qn7qNh!R+~4z^ck2GiT>ow$@1_vKx1u9g&cKe%rHnnDC>&Hwv0{&&Gc`JjOLV
z7{rbdkmJ3LBES)xmX_w<=r!MUa!vEkg`B^};KLT|m==p{<#pQ?-^_MO`E44{ac?fc
z`86yQ@~kuQ{7=&@;i+}7(605A=(6j-&+=p#mGV0eU~KO-WNS$89~~%ZRNtT9_;QW=
zpR4!BtcjS4j52W`VuEE2N2W|)m0<Gk!&~Zq7RTZnM#eQ5uNZA#1NCs;UrxUsmkfTq
zs^JLu;~q~cn2GA(J3kPIKlsWDaEDvy3k@VKSEqF8Gz7~jDu)z2nNx=siV$6irKH7{
zPfZ}iD~CwibDmt^jl$R1fj695IP6A(nqRWeF-fuGz+cbzd*7KwL-zobjv+dK{_=V;
z1K{A`cs=?^5wankS8?G(PrpNaT-<{&^e@J7?%UaUiBXi^V9I^rM&e>haAVM`eBTdk
zVtA+`|GO9=YUnFGv3`w34|<>NFaMl1T5IJDs^Al{zF{B--oM%c|Ex*xH`xdlYX3%l
zxjZTUL<etX#WwJ+kYti}s9FVl#wPPUH@wulMYRliN1}ayLQI7wP4?m@En?mM5q{x%
zglI4!GkT%Ud(girSll%Qk1l-gCB(e|#n|``b3yn%7PRM`*mlVGC*trZXNlbnJSzXr
zOPVD72BT5<7c))@h+0+z7+y{S3}=&nrGoN&9<|$SwXyH<eY6EW@A@ft<BE=E{}_Ns
zjGzEO-?5!L;0r6jv{2i+bNYhFwh+I-(tjeA#`}JT_oj+8{>MPbzbC?7UF{aAcvua$
zZT?eVjHnl~joIs(9V{sBU?`|YxFaCA1xXIXY2OqdzTP3nMyBH$^dyc7bn^v*a1y%;
zgL5~bfDemP<DIUWfioUBcp01@|EV*u!Hn^$i+iTzQp=GFDH93Np>4sk0bqdMsLJy$
z3GSkp0=p?g>+9L|DBS6{5C_$yI4>0wlRO#7MG&Gyhm7bFcnD^1)gsJSsRNnOUYxYC
z?@x`;NLl~CM|<Emzdb<w*!xLe-w2jBOfy8Ip8td3@4a^EQ5SlK(+enHU6Q+XXXmww
ztsQV<>Q^s&1y(I|9@bUj?)mAtwf1;O`RSRp_Owa*>8U?x*~L7y2GSeyrWf{OqY#4s
zK*)dKz4y20!gX<U;pHoEiT(TEz4z;wg~+Qy=f`tR|K}Yq2wX*~|8%q)-}}$cN=UgS
zZ*X@HNHWR7@apeo$s_?5h?}5X6-K&vS7uq8k|DLaG5j34`j2=+A;K#0#2>NNK8(c8
zWgD(fpXLI;hKx;MD+^KV5%X<VdwUe44x)8im(&iYT@a6Z=slU}c(W63VMjRUyl@A;
ztmznRmPh3dx&JEKPRuO*H1xx=vnJr9fTpRN8+IliT#4fHGF_m@kNQGy4<@C@F&f`^
z{6>9a=aJfk?Ie}B{F_hDu!w6C{Oku%B?@jW2+Pm(c<sfIQj}bnEUNNMTkTksY6rFy
zFvN)<ZlB4|cM8zFzx=9#pMl=sbKb}@?>3}ZXOIC#-@7d)Uf&ziCUWn*7E!`#rtg{U
zd6}V{%<5v|#gJ#!?7~3*+d8U)gCWV6qK_WE717g;qZPj{Fc5vfM2wxMAjwO=uz=e=
zhtSxO7WU1{4>o>Gs~d(Qa-GEYL%U?v5uwyymp@O83F7fW0}d9#D_Ph()?r=DzCbDQ
z73(g?ACJ+RGmWVSy~5FSfjiXz@KLySE(fk(u#^Rh8R=4;mBw21U25q7JF)7$E-_?>
zqZfDtGT`&GWQ-7^bz8Hv&|omg<Axnas4<ZT6N!mvK|_D?7td+h>8Fg(Wi?%B4)vzy
z=H{i<B~YfWN)mi)GD0sG8K~hwVzfG?-vq`w;7qVN)zo7u*+w#^DG`WjRO#%;R*u|<
z>V3!Bh*BfhChZ^{0viP%Y%BK_Avu-3wj6H`Xa^;$&!4~i9ww~*Riah`2AqLiMMG=j
zFv!fr+u9ZlK3~MvIU+!Q&Nu`g_5;NH0!T&_DeI6Kq)c_W-UKfQ9+a#O{g~L)X43CK
z9_So6Bl0<J%fD>Ro+1BNMG|V%OCmmi*j0SjM+tTS@EQg3$UrMjx1iCuHI-mW^cl^b
zqRyt$&S;0cXziUrvEVAhSUgeGzarw>jxYk*O@|pCGlt&UDk>tg9VOL@p^-$XWNjYd
zc34NJOMdMsZk*T0r>Eldj-r8%tOq(wa(DN}0i4ZgRx}pe^z}B>2YBYE2I88s9Mzn$
z$q@ImVmVPxfmZ^UnTspU<<iy?Z?-($^lFThuf+_u!Sa|rkW`nS7?NW<T28C61>nJy
z3+NhpqCSQ@5veOIh%`*FFj|qwD=LaBI-q`EQdeC<|4(POUyoaZxTC4iQJo&BQzykX
z(qtHsEtDx`>*-1^WvMeFzSE^>;K^B}l%FaWJyCDLFWn2+cVsw-yUGZWe36Hd4$cl0
zFqbZbUSOBWl}{nS9%|q}BK$T0&%omVp#XOKkDRPgjh({Ov<!{AU>fuu#@x1vGnTln
zN6zH&QuWpl>aW&YUDZ}z@*b$EnOJQqtF{bAOi5xOPdalvA&pS)Xp_lHipJAnHse9c
zZi-3N<wUOprekqzbqBIwHENo)wL!Czejk{1m}TBM^hYx#{f#PW20h!oUM4#q9nbES
zzQzMu4@7qbV!>~V$!=;7ZBS)jt`)a`!{e{eggnsBucDIavvAE2`5P?)dEhS!G!j1c
zqsr8-traO*HdtMG-iY-A96-R`rR>KF9b?s-0;X2qyE7j!Xs`@^K7Rl5G9JPL4}Fa0
z<>WMt+gL>Lq4R#q$%_hSh+W%Vxi~J#Q`OmxP6!!QDJqWutFM+k`SKvethL!s8k{-Z
zNqyg<tx8%lfv96(Td_J6VoB5l%L_;{HzSO{<?v?q&<;9QGuA8uRd-bqmZ~4e?NbIS
zi$8vYr)s9EflHv#ZZ<zzCI+o+CT=cHIm<STjx?Xl>-CY2Vn#We?D!*aDTyv-L#ry%
zZjQGdql&f0=BZMr8>hW7f98!zQBh0UOvIaB6pY`$Kpj_<jf_YnBZ}_S#Q0bqs%hj2
z8yYE~kkd^fpH%tj_qr={P7h4!rcnB5ckxp!9cDM2hIS@I(}nzegk&(zFe<S_3b~p4
z9LdF|(x-2W3k!p3%EA$7qArzfJb)k1dqF{K!i~GR7~OVX2;AptqrO4y-h&3sqWAw1
zG3HB2V-|o`v=ShduW`TR@OE4*XjK~qb~W{?1jndro6J(1ku-5iIr|`=C@zGhba6p>
z5}Ix0|CH#u6C91>KEXD}hOdjUXE9vjuv>w(7s`k>go9h}@n#I|uuJ6{VY8c-BF1I?
z1ApYSM6B=9)eSv`+HL~cE+_zbSPo;kM@P^**!|#K!(kRAi95bmWS5(PIys~pT!ZM1
z{%WP<VcgX6M`=jvJ2OWhD5}B`5fRTbGKwR2X^Y8X$Li~qbYBa_clea*>I{S@#%d46
zJVK^2TDh8w6s?u$iF@9G0S*M|1box1E;6NtT<DTw9Ms>KRdqEI9%iIO(I03tCSV{l
z3Pm_3?Vf4B`%Liqmul4Jm35}JF)~Xn=TyBRRolU7(eBu6eu(ot`zp0zM5&sgg>(^j
zM8TMiJCd~Jc%7A-vK?hB+987oOFx!H4chWQ^(I!R+F^)uewzMkMbD{Ev&LQ;(zDEM
z%3vNMih<)IjuB{%_@~;to#nj=jVcundgchkm>x4T$T(qd`L8#fL!Ti>*8U%RdQN?^
zLRgGBV>1IpENZ}+vrbJQOAAWDzhNPTAHEmpaX__qaKKClaEKIYBiCtdHFe#Mf&?Fc
zM6fy*CJ|DwbG52Es78$lyZ7DX9NQyyOy)cWBXP6IzKzB7fF3Qq3Gr9y=p`hdD!aB6
zUn3SQcckoeN8FJMT1=`T8tm_xN|<R0*U1sp&Z?qzj(9DvF9MK)Se=X8i5NYj3Y}+=
z6uiQCt|UgZ#b1q9bFnc8;@`H1ukj_6fEyx(5MeD)0e_jv$rBgK)jM=c`o#K5sc7Pb
zxUe@|`v3+p(hqD*u7TWNnBMvq$}daKFk1O<SVsMK2)i%m7L=v}?7%P37ZpJ7$I<)m
z%YYGyGZ_O2s&rlEJb083S3kT7Tady!OH3mp(amx82#G^$ql;0KxI)MD5~c&1Sft`|
zUjW*`$<ZPd_H)`2)}6M9s64zsTAfrv6Yi}3bh7$Ncm%SCNkz{GzZsrXJqOxtQmyZi
z-X2$v){Zu2J2cy@S%=+C5ix6G9v+v1q#>4+8k@cs**Y@?Wn+Il5OeeP%^l*AT&HcD
z;o9qVV>JJ0b&}nT#jU-f^lf@SkHlH}3cSA*1pAV1wL6G=dh%=qK|B)1j*hc6I+Obl
z;|Sc}zeHg)0OcCx0f3H~(Y>0`-4PYR&kFdAQ=`GMAU~|enYXlh{a?eU%Ak}Vg_fYl
zT}N&qrNsIuG_nAY$z>=<Vc;Xf3uaY9RG~l4eIv6;5SQCTp7#R;3<S8qeF?b25qi8!
z`z3c302I2TgP^a3zPvsl3O!yL8K1x67JC1|)G1FGNK^iba&c({9`Crp3Q_%GMD~Wf
ztND(r{Bp(NZ~hAZcGKH$><&B+j$1Qh`x<^)6!h`u&!5c0s%IA$TxGqZ@Wip8HvjK6
zLgfg$MZOSYutFg}G4{8a(N3F@zm)Ve?XG{!nRm&8m({m8ET)T8Gz%nG<OlCd-w0IX
zYZ4Dnw)VH1g`<0SKRpA_{!R)tPU9K>nbsu`93v?CL5ks9fr3q|G+M>5na!n(Z%Z7I
z>^e;Z{~%=s;U*{J{bE1J<=c>AHJ~i#j#YIwq2jTd3$MyR&|QF~1?<B9FUsCBDz32W
z5)AI{PH=a3cY;fxa1CC#yK5kLaCZw*xEB!I-Q67m1Tyu0-LvNF>0Yze{H?mH>fZav
zdCuPF>@724Ad|^yk8f>fXmPYaq@G_HC0M-Z!a5N{Q2$2cHFDoXGjLBxY8vwuNe-jt
z*rToA&$#Q@!(=}ugJM`b$j2-AGWW|{LtOXfFocG${doan9dr%e8hYbjCCPm<Ch+Ty
z>mI*o`FTNRUGHg8zjNtyX=Ux~(U>80d7b-2b&ner>z(x_pBYjfdi5)CwBoW)<X3=x
znGIU^BsoXc9raTUXBg!a)NaNPOf26JBfrl)sejpJEI|(9bV9hV_D>e=_q23?1rn5`
z=)S`ro-5sJsC%*cr0eF$iza2oeSW-O2&d#W(nP{xeIbU5Y{smPHz-KMp|`)jQ#7N5
zPG})Mc}mOs@%ppF?WR7{@-#;`y6#JoqK`$M>gqWN_#uVZV3;p@>Jd8K4~F2q&X7Kn
zHL;QPH(pv}@?~(%x+*iu>I6_@)xwu7BJF@YshPN8T%P*yU2EXQLbhyap!Mg~F*+^C
z71-({RwE&;o+q*2Ox~f_OXDCX<KK{?d2)y8IFk5U#IV)oAl>HzV*<EG5W`8}<|Ck0
z!CCi<pzxP&HX-e3U%<mT^?g?+!qSuodxwd~C6l2d<E0Xou$(AcW3;d70#4^{fJRc>
z)RMBzT`4)iaR_jWFt^8W(?v8sqt=EzL*gpr5E9$@>F)a~MriNBmU#r5nn`iw$0F>$
zIZmsA2@Zx|eFoq5hV2peboW}Q1F$Y2Mwqte&?i^<Nuv63a0mo_0`t&r{L@3>hd7Om
zX1wlCQ^Qa-5H?XzU7Uj;E@!cUY8*Arq0GGF6m>$21nPVrXD2#Mzsp{zJ&DsjN2l?}
zh1*^!Rv|{N)_g;YCXNAubszaS=d>BT3R8w>>~g(sm3kXV91tfEyhg=KXZ*7;0S<k?
z5lcvYQ;;YfNy}`rD8c8A-a?dz^La*vke@B|Xeyb*d9m+rY40rrB^^ZSt{);Zt*6Ie
z)FUY!#oeypVrvuKwrIIk^1$KCiN4Zm(Fiy#6RzXqi?MTAbu%pYUd*sIeXh&BQDW(+
zT=N!nr7&?MO+1M^_K@fiRS1uZtRxF(%~|bnJQh6jxlHpjeyixu=3Nu+kB!E^?UU$c
zcWdgcn!jI*z+2g}jCWKWAL~I{*L&#l#Dpr|S_abvnES4<T_3kVx{YDa0>(t@S!XQr
zmg!iM{Y=(mCYrO3TgVMKSoE$Rx{gl&zCyZ@AUb*w=Z*LUrO#hVwWT-DU?FwW2sT=1
zHQLJ&t=$+$t2x8)0n&u3q%k?a?2~sbf~32mVRU6>q7oe^>KzB}$UbK_4v?K$*Jb{l
zd=4)7<oLZH1(2~y72zc*sw)U@+L#UJUiL%E?)89VK!-3IV&i4&{5+V{TQhV)A#ah;
zgYNHeER`9EodR~C@||R;u9Kz48YZR^vm2Us<uM9ftJ0(~t{?p9L!IDr=_l2apO{|{
zH#&lc^t4ORq_%j>zUifB^bav28q5<&2b@X4QZz^m-99oT3PoqX+NEaTr8wfnjw`z`
zwL^;umJ;@^Btnw^Si_hMZmiEXdm0{IiEB_bk#*0m_*b=SATf9JrKrjCmNgKErDD<|
z*s;LSz!4C8X!R<pOQM4@eNn?#hnNjJxL@2LR~3OLW?`nogHj!R>>;j0Qb}+JCUG8p
z?g({mI3~Hcw%<_dLRVsm(X)ag*b{BXbheicLt9#?>n9wHn87d!8PnBriOy}KHBM)}
zZFPt-tp&SkTIIA#lkD@^?@Vt8g-6W8)`;;Eq1Q&PU}(A4LJXH8c~y}Y!7idK-8G3u
zWXdrkR`J*WNEdawOclBqr8BipaIWLLjb*yzeyR>+`cM}-|D$hS{u_CFZev;nzMg3y
zg9;;~HuHAix$SCh6f%RxYLp!`=sIZ@X;#xSnJw)PjLiN|wCKdUWa2cjVFbSm67QF7
zpD>y61t8-)KWBKQ5yn`_mAo<#uopz~`R`U$z!>1KHx6)Ob5C|R4k}@k-5*;_?|ob0
zazsrhCQh+m-#POnR;{q<zL<w|oLMrArJy@EOUbq<_trV2Gd&f`m}*QwD6Y5YOe8Kl
zT^V$p<N3477W(TDK*+KvuUw5;b<fji@n&tgys-Oc49B)sA>uotfxja6!^0z|c|6(#
zMua3o9Ze`5P9v-yNpy^hLEaY`SvTr36`E(n38{v6O}^Gy|A*@tqbAsdAsAuzKMYD^
z+q?_fpDBBDAoBno(kXfpyBvYiRPWms*MHL`z~F1*b>;&+{!b6pajGc0>~-98*A=zM
z^DDQ@@DWsF@rsNCb)qQ@I=7*kNR!79x8Znv>kqPUw93djYtK(hLnyz@TmN%xjFxXj
z_RE}Y<>WSJ{z}~obGt;^0NoigBIihdJ7Md$f=<|<m-YFg0e3w{Ue1x^A?6edBZ1fv
zXP#EAV$cBxAE(&S+~9z*@>>eMk&H^1NG-gNriVGo*gP90U%p5qvCo>%L=9)g3hCX@
zudJ_9X(Ep-=G<di(==+LVJq%;2lE^jv3B`G=MV(zdlWo=>|Uw3b(6>f-W!?c{=p%W
zb_ragPx}ce*4H%igW;FPEbVnTT9@sn_*_Af)V0zzTbni*Yz@Yysv!l$n-FKyPiw*@
z2Y<v|JxDY_=zI>g$5Xis*wKyl>wJ9avx7hc-A-Ca{Vr0HLQdQmE%XxfTdq7-P(KWn
ztI-~o1>cXeDH!@_Z(fV@B}ZGTy=J#{&m2|8h{H8eL@~RtZglxfZ?dnIv5|70T}fnb
z#IC}vC8?W=L^QtAo6bw1WS_eX{Np-{=5P5{O=fp)@8bV#O=bF@>}r-7oJ4`4tgQU9
zwNuQVrx*Bz4|dP9nMZrfZ&G=d(k`l^2hg*PENMZ8f|oYlimTn%)YKF$7Nag-S6|Bz
zqOTqX5pJnVTf%0K_cd{pnOIw~4P86Jx3spzytR`xTf);`;PLb|*IM8!EQw?@V37gR
z8l9=YcJ7>4)H9g7t(03?b5Ao1(xN;L(3Q~A7k9NnwN|(7T%cQ&lmg85beOIKB@t|o
zt&*86Ent}9+|;)jBs{Ij+snv_R+nQCbmJZ_>?^9%e2lHqAdll6-1r|4UE7mj-Tsfi
z_iBG{->zY7f<`aAu&<^d91PI@?XvCXMH~6WvPsb8QXs^I-RZ&xt`qnda`wAg41~ah
z<QF3l`8$fvHb~+gf`<?JQ9}Fz?yQdX_T6>oUaPm}TG}jcI1%p+bO_i+ucBf(Zh!_0
zdcv$zEop<_?BP4o+$VPRvzxe7mS(f*=G}W*`0huq6BC0&pW?Uh+aekvDX%|HPaN1A
zqxX{%g{+p!6%gHC-NpG{o$S3!@x%1wAdFhh?dGli2j_LUcwx6T!l6tb{+GOjg(hE>
zTy7GNP`QaLQGym;5A~mIpR&`9XJ$=e=VM;}Y`3AT+%GOH7bLHw$lj~V!aD3B3+s~$
zK-GGXtLO3&9O5mm^sd6=@up=K^<>59IXQ)hM0($x5J7Sfoag*wTAJR~ev!H-UCwpn
zpTiU9cGxrI%L%qvyvf^+R>pcLFREw2mgZ;;Lp`<dO7a&hHcb5R!gOyVRVvPV5NNxm
zuGYp_@0Yqn7hBe|tY{swc?+*jMO`&5wC=D-{T)}<@o*eLQV#?;4h*g5Ll108CSWHI
zfMPd(AL_=f_tZe@p%6}cTnId+XYIN><??@A+5fYwm9#$)Yw}qZPCWxjxcvQ(dkW`=
z;5X_#-=nW|fa*}@hWQsts<@vwhafBOkK!zd-wh+|WUT@g-+ueQ%KfayGH;bbqQ5t<
zzy33fcmF})K-;4A>KTiKg>7k&|Cc8J&%?V9h-|?xLx8whf}6cXHAr`2*D*wb<v+K&
zx3ss2>aM+aciRH#qxuAUd!SEC)(*zZoJS;i9v4Vk4E7msm9ohDto!kb(zH?IjHoY<
z*4_g{OU0N?E1@4lSS?y-UR8*r@)YHPybS$IS|7-OHL@QI6zL&^|H*E83*e3?=fvww
zXO)uofHxR|+$Tu<Kl6h#GjG}2o}|XG4ShItN%*PD^K^0mYurkv%gNj1KUd{LAb)XS
z`5rAvmmiEah(Vw}?rQdBg0aF|L;d!Q@;K8axxr1JEu7W8aW0W<Pxd&_{LO*LTgXER
z1&39L8;Y!p86ScY#4Z_3(^$&on%xU(G!_@h)|VQtnY9!qPg$@TO16g(b|)eeToSZy
zvy=N)byUzFp9(Sov`;ErX3rsHz$z;2GBR?Otwyqa7kR?>0pwKLeA8bp*07yL%^k>i
zY0FqY(-SYZ7+vmS`ll&^AjDFV7=$kigd9~Djp<3Mj{`qg)}7o1z-3R5cOsKdBr&<o
z-&NaOA0EC&kG6j4ffeE1_dw^^+(&1}@ahQWddd+=_^sPF<IW9z4_86I>~|E6sl64C
z$Go&-s_s<o{k5~yVxf6)hFFkDeu)*LVd;yB5(^yqhC`~FVg7E%yudexZ@oh7N;bI%
zPo-Td5V(-+LFFMDfIG=6C=lpEkSz=6&>E88^8uF-szfT@l>{(^Gt;78TDcB;tZG@|
zvxmN@iJ#Foi7Xy@D$a{u=*N*)PbYyeEJ}C6r7ANJB}o}oAJVh&UmAK^5kju{vB-Nq
zMsbp|I)YE+V#v!C4mr_N!}XBSJE4Xk&uD=5l!);REgurt;(`CUIM~TWyit`QaBvtx
zk{J?2vgBrmlchh70E1j4lFWN|uRm<00fzm*1c5wvBK}Jd2)!G5`R%$_yyRkDO*~DU
z2y!X8<pTr2U0=b#08pQvO&ph+N@zZ-@Fj8Ja6DN-DOSSVTmTz;Aai&mii(X5wz08)
zi0%JT36iiZ5vQVJ!@igH2C)weuu<|XAbkG3H8e#n@JEErNGPg+lHEKH5%q!c`Adp;
zA!>GZHbhDMWD%mZJa%8k34w!Yr+*IURurDkYbYxzQ9Y~DO#hU~<InpF0Fe4@>ECs6
z9{3cG-OF*t#mCc3lk}%2V4$E_;1d%o<?)A$ICB`HMH#58WBP1Kblp!0L!@@NS&X{~
zeSLkU*G_DM-{44=oQ9xQo^0RD!n*YnL>oe>S$00TT?{B)3?Z)!5_;+<I_gK(>c_Iq
zjL@<4!=IRn;#-h4kCNdh3s?LQW});_52HOw>74lNr9tbJg`}lI@0G38s`X#?c!OU+
z0JR)R`H=+FyG^g{WSis|O*L>#T9GNxyp%ydN1qV|pI$dMbohUKB+E)k`RU{1!~3Z|
zNOt$p^<{pG{3JW%;n~SbG=@F^|H_BWxC;^DdS%_y)8oMCPeDQ9?dQiW9P}Xq(O*Vj
zXJ_~RU&(0ra<%-(&Q9SkxkAJ7Y=)i?<1~Fk!|{CYKNbTgF)Qpw^Tn4xuxC>Y1{Lj)
z5Kfsc(zDIV7jT73=>E$bwi2sV39V7qE_hN?)FJiEygNKPU53P-Hd~*1w$E-%N?-YC
zP?HM-KSfZVHVch=j3raa+BCwF7~;3q0N_Guhbz4+-|IJX31?<(GTe<#>I?_1AgF;f
z=iLs}{QSHjzS|v$+G?Kl5#vjqXqt0Phial-oGSxXsr)cn`{n%xLiyf+`{)tbA!Q~U
zHf}~Nwo{%xN7em^YJ`nO7b_ZX)0QKp3BD~<i*g)+#z|D>r5Y*MJ;C@tSAHz{f2gse
zU0&$rb_f5xCr*w`?Ex$~blGRX_+gBQN$9~nPrk4?P@VJxX)*&bMiKV=Sk4t6&d{FD
zEyodY1a(fAUn0iwiS^?m{@A|T*2KRMD<=lU#}Lim9#xq%*xnmv{<@XU<Vgx`OeLth
zav2%mb$x)Ap&8j*%y-A!cS<CS`zKSf&QwCzzU#_#+oxHCnTL&3|Hq|9%m*s&(umXN
zul}Fm$h{!(fTYGXIz+J+D2gCq=a~rRr@zMjx4*>LuI6Nr9iNpFq=iJi1c^R?F&sdo
zzMwLv{_+mLo6VoSW`F<5^-b9#^QpW*ZT~Hd>U+mm8A`0tILD1GWCF;GvZuUD)NmRM
z<k>v?qT~o%Ck>9E5Ax3tjEDs6g1(XIPQAd1mFMoBHUC7+<j3L?C;aIcmJvm=<ghY^
zqKDyGKF}hxPp_-<SN&bfKgfkfO#2=8-^Z)0f6LxB;UzC}(7$)L_{>+TYv5xrR0R{5
zN;DU7IcY7LT4(6bin4+VA|3u(X%(S#RcuJeF(wv~LX{a*O%<Wi5ChZieC;u|t+Xn0
zI|KM4n5Vs>F!ZiXPb^@<DQ?}&iVVy8b<{tVt$2u4ShV23XL@kZJ-7Lux!E-k$?YE@
z%px#oXF!s9VivH?h%2oD8jzkIJb9kRgjCB=-m#27<ql%yE9>w3VwFKeaH=brZyuL>
z&B1#AhE8j<Z&qrPPzVBcEk%fn#R5p`dq3d2VvemYTo8@BTs-XkNtU~ZVO9kwl&^ex
z+kg>~usFLN(U(g{7d~C=@B^Fc6!g<C=56=Di>*u8V<XR!4uz^Ho1`YYy{+Q%UDc`t
z-PUzQom*1D<3T@wC?PxG8NZDdaE_*GxvSt+;z<o4D3)^B5XU5^k#-qqxeOK_U?-Ju
zz!<QyZ6#aB0HvUg@=q~`Iq!G8?L^qy?ze`YlcmWQ{M-NOeOjMHJ!=6Y=Kp3@QkpZe
zz3qb{IZN(+dimV&_XbYnZbj=4cofN5<bkOt$2>9Yd~xTOBb#y12XH7Vr|+lpJ6Rn~
zvFO{~x%Zz*LBd}{=+k1iBF6tbW*w21^Hxo$SgG;+!hT>Lc|qxM&Fzv9CZrD8!UArj
z9P~fo)K`R$v%t{N((a{9`_RzPCC7Uc-^%oT@q49=1$bS>3uDz0l8OgnC(CqAB*FK4
zZUyPDJT}u0gu+04G_cKNSkNhiLVE)`Q0?p!`>!{?!NQpkYwvcrywXSwQ11l1dS~o!
zA}yB&$01Vg9YUC@U@^pHMSd><p$m(F!_NflR=aDRegvLQ>+gNY%aZy7O~0X;)Or(m
zedHR(^y4=<Mvj=sYC4KS9>?|@<Qj0xvg~BKPz$VI(D~d?OkdKz>a!cgzgWeYYPNl{
zrsXybgVRspB@%+u^4UE@a54mmY5U;%#mk#-@0ldK1L?Umr>VJF@uQ0Ob}%uO!pBLR
z{RJs}O}gOQW?cS)X2_usGWIf_KVnsX^~(95C=Lyqgub^+)VPTwq%GTU@A{t36a9Jp
z32b8onDi%D7BFY&tq29y2lZmI{~O1wJm#kq=7-P9%DRbBjBwkr5_ve8zd=tL5oQ+;
z$<jr*xxty<`Jwj_df>jtDO4{3ecQ9AX@1+5VIqlp+k?L*Bxy4db+gh=n)KaI-j_l~
zMw<rxErL>nNrev3TGzx2OA++#CY+fCS}i~jF6#Lr>f@iWRWAYAS$}IXmKmgGq1SZc
zEogB2A2-3slHE>whRL98eQtxWKYSfI!Ohur-VovDq`v62T7}3h-IB@&;`K*e1pP-5
zw0ztBg&0O<mlEtHY2w?Trg!e+uG>9k_T6J5eDB>#`P)B(7!a$K<pw!F+`PZ*)fhQ0
zg18mfw<#VH0e>ekcB2nDwjYUjVk9n$$kd138fq=+E*emSO!$!RYq$D4=5AM@$^J^)
z<HpT<=nu6fbw7KFJPv88a|it(s0%cmSqItfZPfCyZFipw5Bk+kd{4^?Nh8@v#t+2T
ztD~W06(!q6V!TOE3N1}Uhv<{_TU^V*$_`t^d}z`DzJwRP(1quENs?Bw$^AGhKB8ik
z!C@aC7RId;X2o)yMe8R3V3F@cG~94_V<#_VmLqMZ`I#Q?Mf^xS2i|Jl6d>slR@Qwn
zX~gLLFoJvC?vB5iDPF1P$4(CP!^FW$jN`=e-kZ!X?6u?s2fcDZt2qpu=B~;3@88s8
z$$8t%5!>48@55-`kZ#(Aw#<u#CDl{3`b3&<ZfU8%II-cdIXkO?UPwc?WleJK?!Zdr
zIDgK2%XePXj`tI6$gKt*BY)#G{F(`(td1o{FK*}z;4Qn#mJA<9uAinrVm<fb1imLV
z&`Xv5tc`0t|A=zr2v!_b(A6QedBeK}HJj1shc^<GNsYhL9|7OnZ|w=gKSojX#BU_{
zrZArQ*k0evcvynaJ>&JgbcX-gTnp_Kb<D9Veym#l8Y|PA=Xd1y@Y3R2l)<sMUcpp{
zf@@?B#bss+4K*E1G`}ubIq6ocr=pVmZd}GW_~|(4I@f34BBxMaWBcXsAdM0ITKKu^
zy3_60__dbmo#lbM@)a~ysU)jOmnSH#B-><FTBIvZuskxXB<E4-9iJAv{MK%p<*jhC
zkNpa|f`Z-07CMfY@*%^FulAF!2Wo&i*yyRmDl+K5kkSl@Nr3WQD6sw*Q(cM5Z1_ck
z0*Elk)>MbO<7T2<=&@eDP~DNOv^fhuU2R5+`n6&^nLRvi#&33ZH`*`L4J6#$u14ny
z^JCW8G`Hm^)Z~QnfpxUChltS~9bQMB!~aGqkQCNMjylJ`JzY}gyRpCc`|&(HKGNp9
z@xR1(5(fDDj~=g&fh<PQ!I$f87V~AQE-nVH<KPzWTk~AG(n&u@fCV@nD_)tSt~1m#
zA&yFr7lH9xyI1%-0%~a3K6Y+Wi@edyV^^JP%Btnkjk~BPb4_I_Gs~6`*Dv-qWxF#@
z;8=}`#`3;bc9s3JDWRS}K&0#Ja`$WbPy6$W9b=m~UJpK(>YvI2By1ksNaYr?xxDGi
zs>4k}$}F`%Luozm^|fu_%hzIDYH~kC8Q`oeCq@}v3al(8MyOsgOjPp@ZLB3{8VQqf
z+eewpU7D)YlSKoOdMQQkQ(m=@c4i8Jo8Ls9H{3Eg%tBvJwnDA3dBQrkB{G(SZifk0
z($W1eUEU-n|9IX*ih!4Vj0xI*<_EWej=_)p2ow!s46zV2B-im8?gV)jx6S^erZZx0
z?%WF2=qUeb1nFeU`)SpN(_w|<F**2WzbHT36vq{>vCko1YiR)QGfB_Kt9@%Jnv}#d
z!lk`G1Yh}@UlROt5ON*znxG00Qi|2uO;E6^WV}`DQMB#2u&_|j(D40o-dPcDBY$)f
zPpQAI$dGV36b@xYw^F<5ax)U5l(`O>2tOT9U83L6CMPG)M4_HxPTD%GtgOzcp^RkP
zIM~FltSBbmn+T)S%{TrPlu|`Be43anTqnv1e!5*Ubgq1c6=863b=AB^I$`Ok1qMKR
zvd+3Y5rlY(g~QILu_<@V<lCk|OSOjOTb;uHF(Fy>+eG2Eo>0F=@>Z7&TB0quKY1#p
zdT+gU`Va1-bL~OluE&k%^7a{({7S@~nBe_07a1<o%~nd{^qj|sr+P5*rWNUKZSdBH
z;GC?_OUX8$TgmpCn}eO*oO+?UtwKFQenLV5@o!5mv{M>XQd;boNb^Pz+G)L@0K~+~
zR^P;=-pt4-H?pOr#Ze*Z@88$+`m^2#At%U;T-6xu-B}~Z4eD=U?|6#1{yn^mF5xG6
zqD0voR!D|<SuhiP^VP^`Gg3!Khgervx7AEmR+a?frO>w9V!zB&V$y!ED8Htaot0Ht
zJmWKSUii-MMZbl5^{~=Cb@FEIUaL0k&uV|(&MoAmHu(Bbt=6`-wphNJ_@G3Ot}yLD
zQce;-K0B+??RDIbVdodJi0-5ZT|;JhDPfQBlfw4Ww2j~<F?7p#rzNbO^;6(Y3tRzf
z=oDgz>rzdY!uZKwjH1&T!dxf<`M?R#pPT)DBd-tMqdLZaufXNlAR~}{-#@?8ZEJh`
z>JQx9C{w_56!4q94hLJU={-y>*~Js|md4CFN|z_(cl$7UT0b?*&JcZe0jFhey<n}o
z$L381$5D%01N{Ho?$inYBX(O(4SEOJ5BIWd@b3KUesC_<Li0FuE&`b(jF%m+ocrSA
zZ5ABX=UoEB@`Q^mdIH-C-AhaYAeIJoVw0XF%TY_9gM^aC(KMFPN!D7Lz61t&W?WT>
zu77KjVu(&qpcFK#^be`2P?c##8qLwMeRIy$l;zg{;~UtO<g2T*OvZiw39N0*LatA>
z%j|hZvHo|<d&d1NsX-KfM7LN&hh0kQ-YV2vEuoo)Eq&=(eEj_5W~8&XU%Zq2hqa^p
zP2@L@Cy{!s5&w5r&J%^+SNG~#qk!y7g?fxq;G&68%ripGC*qW7otRNSW-Q&MaC0k^
znoEM+$>YG0pph5z#lC5cTrx!AUt$90%M{q(sC&F$j97A<(TTnRJ|bwpBZ3z{g9Pp@
zz{62-F{S{1X8`T-#?3gPnl*si?;Tb48*YhS*r<JdV^Dp_hPR;su7Hb1B(~tqMuFAI
z<2@|u<*oCDTAj@GSX~35U1CLwZ?4eMc}AS1{Oe-5q2uM*yo0=NfGsy0(HMyGH{~@m
z-SuMlA7nVOe}m9|x&}LTEwIuy6eCAtFy9G|!hT62C=90Ty@zm9R)XR`$9evclMQ2@
z<6$#`x@I`JgfkZYvj)9`U}E@bjp`&GQ;3UA$nR`~A}F4~#2@Sac-p3#+Q-MIlERS!
zK-!)uYIlRUb$Tme@H6cI3^l5lUhR<bYa&A=i%5@q%xTyh3HN{(UM>FfSGM-418~0)
z_s8RI9m2osqmQYmevp8x6_ppx3>%){-1&HNr(|>a{u57)+J74WDT<85|L-+WNWEVa
zbR3CBvLcrI>mQ^Xb|{_Ia0Mv8vo|_?!441a{oq`m60kTy!5$<+gi!l0s!_ZLUYmZf
z__+Gd$M|zhF`lF(Ils3n%ND;kk(%hU+9dD33B{G~%|EBBYux_|SI~j#>nJszE{|}T
zMY5|4bbV`*N6?!^sl_pmUM*;z#YHjQN!s!acr;ow|HnxxxenUc+??$V3TmB(bVoA#
zu?<hA$HGs4OzahF<HIPy0aW34q6)b=pUU~oZi0fOr4^x3^ZY1S6Z9yP6>pAkk|d0C
zW3f{XU6<p70zl{e|2o@y?<G0vki>hDNUC?$Q;xa6tLU^0K>MJLsi2|uSOxsD{U*1v
zSNI)Yo~k@OHR|A0d;GUtkz>=p{v@zVLt9wrU&A>tU6~bfqfBCfJ(ogs;I}2^w%XbQ
z6UsEiTBZ`2V-K0m+5>$KHqjk~mhL_~gbdAfkO3}QLAsmErI^Ue#yuhT9RY)a|NFb%
z?h8GtizQgX|L>b_*F)Qg2BTwWRuG>qg0b9>64?5#bp)Ux_y=|=))jNjicK-uz5A7C
zN5Cr(h9_lOCTW>9JKPGP_@=$zp3r733f4FtC*$nee*X;B$%`T*ht!P-N*twNIXQ2?
zj>4<<&vHa3{NLV;4@Znppy=zooo9D2vbC`&s@TB2_+;q&OZA@{IGCdTe|ux(K?Q7J
zvSejB^Qbt++g7@=$>ko-VeaXN!Q&<2+vjC*aE8g>Pchn&y@7)8I)WpGsmfWvTqfN8
z<d7@<UOS{7qVurwJYNhFcz+1CDh93LgY1d%7TTS!urR~;el}m*>iPJsmAYH(2E3@S
zbziVf{P%D*Lt)T%V2T$XM0_FlQHW2Yd_HPaMNH-D#`$L!nYxuGnd=Cc`F959Yt|{v
zyryZ=h$W5lFYD<H{G5T+6?GowD)sq=cwblkSJw&22OvtwFuU`v3B0qUjLPIl!0&*3
zpa;Cv@!!cp?$@L9jz*!ROmOEx8lJ6_BVA<>R{#NF?P_Ru3~j@o?M?>8r;&zJazqoM
zP=K-^YTh403rK>$OvANcbxpncgEUD*Np<Q|t9U?gNAuwK<nu2{rCce%w3yqW?=62w
z1OxBizItD+ssSzUFe-lc22YNBk!Gw8kxZI)o@o&K?~jjLN_7carp|Y;vt7JgNVAeg
zHV>Xtije3_i{)y^=5m!UlB2Dh91#cmG-)RD(J8%>zN%8Gu6-LcuXogzpesB!&@l19
zx=u6*Fd@m{Sx2BQca*!<69c!*KaGm*g^bB*aV~%3G*`kS<o7~3!NZF`Kbj#5Xe+lz
z_PsPPOwB$YF_KPvFmNr|=@13|XCIl`XgL}^Z40@WZ!P#=qb-yB)HxzgX%A#eF?8-*
zJU{>l|L<GgA8^Y<hS>_f9>U<Xn7q*mGJXcgk*@$hKiv?qywPGepB*dyoNksVU^~9<
z@ieR6%2Cuy?thORp}<qbX3vI~kR^0azyIUj`UkxDRipx}qpltdadgw%F*<^jzt4XA
zIAjkxT>$|A03K$M?Qe4)sE^5YsT1@;Y2S=Wsu|r%m>-+vJA`=i-AnBP4(d%OYt1K<
z`BI-oYuzVJZVf2f(;8azhL&VIl=$-9g>VBlIy~%2=FHGiVc=0Q<KrYoLE-V$<NtG6
zw=qL4p*MLJw1iD!K<;)O#amv|nf+$1e;NOiI3yCx;7i(syKoahnrUWc#>N_rG~WdT
z1p1P{J275fULp}R$Z9ZLUR>~$h{w0K<W4Ifbgr$eU{1}uY>5oCyK(AGLJUkXr@$Ah
z%YybxEUjcbw$Y{lk^kdSXl*h9#TRBAuB|izHeVzOg(E-}q7F=@%`j@wCBe^Iy=5r8
zf*g^PaB>t{W1G5(>2MhwH@2@i_Sn~k=DS{>LUb<s+yc}nu`#x!I;&%0(|CU<{bg$p
zc(Bi`E2Mji_EqE0Y}FAy+sB^}^i?djzcMMwE-Nr7tI)gV|FI10(8a#gG@5t((UsiY
zQ~EXLuA#-TS!G+9j(VEfuxeMXJ+vzWx(STTqcn8U{YR*E1sfqb)7EI=)AOzL3MTTa
zvG&Nrt#6T0)#KWlkma(%jCzn!Z@Js=2Hz>~vaeX*V6^L-S+y4ze!01;5H32Xs<Kuw
zF{>*ZYZ)3X(sp~Uf*jD$7X2I>xB8(CbITe-fEiL=7VmeZ`UeeUP1zz2LfFAs!sfeO
zro?_%PZm86%Dax=WIpPLsM=sIRwm5(V!pr}t<}pbThxJ@Z8?(a3{{FYLf`F=3ac8C
z;+DOOx9fYUJjc24C)(q@EOG}mFWe0i+7k`+zfVp$j4GcsjLwC^)*=-j)ek>hG79W*
zpeb9k+JFx^oj6c_=RF8bwB|u;6hqr9Dn2S-7rN+oQ>3g({h=o?yKIC7`BL;3R)|nV
zBCD7*<MYDJHt=wV35dg<!=R|M(ps;$AQ>9rTb$(#+hXeU`5eO6tWluLGfPKXY3i%A
zQHRt-HEV<(46-q(h$SVAnD6$kq8+8TvJ{lL<!Z3kMMNW-w{L1MEP9&kLprDU>p&F}
zLvq`o-wQ4%YJkb#eXHY|EO*RO8}P~p#;k)<`+*f-Hj{F??-!;W;tb$8R$bt0y3Lc5
zv!j%=7#kY4QGV_(C)l6YG!9La*y3eS3mxFj_Sk{G;hDuW6Co`hj565;cV*>JU-O$?
z=>iyg!l8OI&Ceuo013~siUmKxAY$3&85Nb<zXRk9R%y1_r55iSini%G5}!MfWfd9P
zp~k-(d%m~D9&Ksp6J$nd*;|`$4i#2>tBR6h3h@FE6`|Ohir7#eU7&`S&?RiTk4)Sx
z5-x)+jvH3YS)L|1rN}tjn33Mpjda39l2JWmo)-_S#rvHQ=D1U4>N5mCNZU{YuYPru
zEVGehOh#j!b(8F#9Yy9Ia{~qR;Fpn#%>;&!Y|~APT14MoH!NC6zC;-h-4&QGq99fP
zvrw~So)oOLywf)$&}%beLLI2^^MD#N&xFEW80p>@{ogA|IBm1(9U|k072j@G&IO=U
z51hFCRs>iY8z_(TB4fihN0|!#>GHNy^HSIM5E0lJe5a>fT~5==j*lZIkS*>)+6u(d
zZxtu<jQYi~GKWB2BXV<WYskabVhRSEs<^Kusr2Hl^ty1xa!(gAJ+oNS6x<!rjp8NP
zQifp1l)4b}V$Vf#vGBSD$5g`n=29zQ*+B6lr7H^A7^@mH`a*?69YeTmd-qHM<O)mr
zfn-;2ReVyzY<D(llt7pPDnw__5Vn}!Rp<v@VGC(7$z6Digj)IScxj+I%loky^iYgj
zt3`}YVA)nF(%R{o|2Q^y{8eu;yO$<F7yu{6eAzhg41J+jHw<E|=D1YP1B3jnF$Q9X
zQGz2`E>_N@w_>(h4R>3wabsyz^-bFdv4%@xDZz&wfz(asxDA<S!9elH!6D;84dOPE
zy&_D7G@9a~BU#?77IeH@;TYZ0KV}2I-t2@)cqK9!3dG+58^Mp~OUX5{wt5hBg!N*#
zX@&d?o0tpPBEgncLW6Gt!CCZaIG}0>QQ2#S-6SS=_Y`w+(cH~kuu1`<?_>YLq$a>_
z5Pdf1UgKdT!&T)9@~ivIZ=wUX>Yc&Ucsb<wW$<Y*A7SVCGs@1f^(Jli)|RG5?yGKW
z_72x#;-yx@_!six1%xZksgjdIx>DURx(QaA2A<7Qs3YgJ-`2X&b1e2T5rXSX3@u8s
zcG_;%PT`l9i)1m}>{nMZ^LCTz-ye}&Xv%o{ffVaaDak2%Omps;WnlLUlyw4rs{L$4
zFdcdY{YaH&W8P*VNK>PwUg+pbKb5DC7`wRYvms=V(4CwqmLHuk&;f=82Tl{IOl0@G
z0rmj^?aq$T(~NKWo16Wondf^D?A|MCW~3D7Z-E^`dM7pT0O7v^7Z-u8*dv^Q@Cu;s
z<!EsgA~5BBxnqwKOyTbcWgAz(Erl6>E_8J~<>OSXHop8=v({Q};Z&_R_~`hkJbgOH
zX7Ych;lA<-<9=cJz8LB!YOQM$c<QYqPf(RpeOGHFD|8?-I03HGhe*o%F^q@9Ie5}&
z);ZYMs%8xfgSGy2rPBpIDjFISCkp@@bH?D}{SBIAJ!XuC>Y2aJ&e*+TYw0wI3FX(<
zon;nd8Ln2L-2SA5_$5S2)*H-qCqeQ}IoKS`yZtXa1BxcO|8>7>#2HsU=k;aqMJ19k
zhf{0^3g}+fn2Rv5@?nE94k#{_Wmvc6=%y{xf-HvZxuUJErOb>ZRSnnLLY|=6Wn+H!
zd>AtUY>${6P18kuah~OazC}kkt||o*TSu_*G@fnxGFC1B?hYLRU*n;*n%-!3sz6#w
z!a|B~{KfKhM;^(~2J3yOoYhveI)uT(3f8`-%Rm9l%*0Z;u&+q%3qHki<JdqLhi<h2
z=VyZ_<?mz6iKg#$lq^O)kvgbve6><Avkh-dHVVqrpQ+XeVyZGDhnwscuo4n;L7!R{
zWpCnsOQA86W%xPDduVXkMO$YG3vyj{)B_@8v+Z)CW90Wr=Q_;*2@S-Y&}m$YZDjtq
zJS}^G5JGt^W)7<@-M><Hm&swd4Zf|cfB9-H=6?Vx)OY+Vp^G!}b-SbcdX}AU4Edl+
zcYl7$vIEPZ+px!c->$(%XQkA#%f{5C8wuUyJQ4KH0yprf5ylP_<bKDEER+Q%h_t~S
z9#Et*7`p685s^NZnyzi3st}7~e9<bmkFOS(Aen43Z|0f3wpU<O%F8!qleJC8<%{B)
zbsq93oO+PUQwfp$A<E%<WUZ3bgv?x{(%`uvks9eJr=`kvFz3soB*S6kE~UeS&4$Jx
z@t(#IjT|<!rX3-Ny+X{`4#PVZ<AY@(oE|PcmL|i2eUZT27Xp%+*u;x713UeBFK=wf
z=Rnd}cXXMu!sf0gHh1{dDr>q}h|<7k5FH_grGG?%B+bkY(O@RxvlyZDE@p*r+Yz(M
z=v3{^_{N19Gvf<H7SWji))9-%hh%~7Ibyts+lsnTX`Kiq+)!YPtl>U(Wt*dh7cG9A
z5q{s?95&toDA~(`Z`B<N233{QagE0zSCrg?^BfAuRi%Z|G_rq+f>=|-(s&9e1A`)e
z)<yCh6Bc<2QSq|F*G3$V{yOQcKNEv`_c5>_dRuDHsqE|8&*1R86r0e;iI3Sr%H%g^
z(bdnkk7u59qbq5WV<8p!bl1UC(*PX!UfB8_FGp_W^#xI%H)b>XJk`}2@L)KU^J>kb
zG)y=XL>KsP5S0L(B?=;wUS+AtgKdFA+i~|*j6y3xWpuI)3K*etQ8pg0tex~NGJtc#
zSG4XB!7O5oV}UPP-6$n=EgL%X=g)n8S0d}q>&VGSQ<Y8Pu(2@k2HHN=Gerv02~2la
zqOkNXmS*hfyIjMR&uiSjzxU@~|KSdsZ#VPh-X}`SeYRL8Wnjyd(fMus_!V!Icc`bt
zVQE@6h()#WuLOMPcnJq-FTet@g%h>gweEk%@S>MG1R6ystf4>Bk^7R6b%b^<N|bqZ
zmUQvsyq-kw1paPo(zYs&HrqC&qBJd28Al4GG*d0!zQpa5wQ9~(yuIouUS?9`pntw4
zD7kadK*~y%6jx_eJ-Yfc?bnRLVd4ZJt5Du#E0SUPkNEn?jm@f<Od7j=Z0bf3{?qzk
z7BFowcBhLSy`L8Q@9H*Tz=TLcP$lm`+k~_#5cloO=QUjLCT3jz3CO>YvVTydq+-%V
zLd`15Ip@Sq#WyK&15ZL142;8QP;m*hVJLG(8JXZb$`tdYn@eP|0()?}BfK~~LQ0|`
zU<m>w=JLhZf5p?#E}6SqoU>~!t-!+BO|GfbSVdMe;x#xlcdfC5dU$D0VW_SdX~A9;
zi`oU(RV4E?ZVxUgAJTNDU<U9P8>mEa@)Xuo1fxwCnn>xS1FX|z`b(87Dx4$)XVu|i
z%!(@_TaXNZGpD2X^|-}dpv)7sFU{qYVBY+pZYWJf(et*+vF;k8GfLX8x}H~ffNs|q
zD-+pLJdmb(bj<~+F6)d#byXdC`|8)Bp;0%>7Mbf38A~g3RxU0s{d65Yy)fp3mPOtJ
z0AIVLZu&13W@_Fv$9YXnm-YtSmtm{X@yTvs@FI~)zD-;=mg6sa#|n6=wd$lgX&old
z4Friw;x1cxfYKuUjB({CJ5GB@BCT28L?2HjZ_-)-wBKBndwT4}7g?pDfX@V9mxj|~
zNn4a<RsVe&fk$FGCxLwVHxOEh_#rEOUR}p1u8ZqE0PerAIN1G;#JBb&<&3-+gQJHU
z<#E72{NC|mYBaY^(zVycCD!~`_jSB(<lK89=vp#|KuA)zY1}7_?CTe@j1GZy|3H$u
z;8sK-YS?~I-F|vPb?G~tmB*>@V^u|Ms}-K3`=-Lw>0FD{XN#~(XD~>K?QpBY;!(HQ
zOjGe>zM-NA+pLj*_qCQ~!c@Gzy1siB)KnDeZl{-TEj(wRk)SN~kvSEbxNum&o=P$~
zQt@0DrkrPJDd-p<XCBa1rCmBmH9^m6P91q#p#9498YG0Ahb$%Yaao8jTtImWL_zCm
zf>Xk_<$KL^(1A*)E@>bYPS0%oq?J5MJM0iHf`=$RlaPR{AnRePYivc9q0PXvl3;27
z%{Bq{-y^27wlt${-#6kf%F^F1;nL0Lp9_!Ke;lXUz<<9>DminPQ%iB2eJ%_s-|zix
zN9<B5=aEO@|K(FhC<IP-#B!HI3<Vk?Y=h32P}B`|D#bd`GsffyMdy%Eo=42HV_;P1
zKz*|V_<s14a=-`lf_B`!SX{`#anMW)^T+`?a#ewuP$;i&YDQ#Yn{?j#ligf@8sdgP
z24V~1p0ChZFOg0x9e|})(gBW<dMxYD8U8^Txx^P^EQ4s>Z$89sFT`vyX$^PCmdrXD
ztmOK3F+P#|oNHqQo}DQ>92=zg<4^s8%CPVW4TDWcI6FME4;?@q>~20KU}*{LVTxR|
zJvV0iB6{EzL~GnJD)iykP=k_7EhUoN(@3;pT2W|fmv%4htf9-TIk{5w7J&mIWzeyp
z3inS``@3t3CQiApdsvp?m$Du&vZ<*D$#%u?pDTS7SgLyF!L);^W`i1Z?Tv1Ep~O=H
zQ2{HtOp*7Q8Z}Adj$q3t!e`|9(&I*^8kK+&;$S=O*t&uZM4zv)!d`;MT!}ULaZ7wK
z>N?<-5JJ6gUy$W$1QL;CI0!WB`#kSBWc-B9iV{d({5@AP48p#?HF1oZlfV;p7PJfC
z(qG6Iw~OQuC7yx>5`eS|yeY!?oIfs5VK0o(B2Ksj(<zzguz8#47)bUsLJcnRZKB8N
zGb9<=!z*aeCuLZWblk;g;9~8xCDlZmpi`<yquI%$!eTgS7Tdq;f{RiS+l^^t&1!M|
z)ZlhTzvz|74w<e0{;D9>gk99ZG)mH>kgk)YX%2Wfc)zn$iYFH^;;8crZY9cas!ihb
zkQ)`U$(hRNJ9J=VLwGe^2!)AWwF^622&h0bt_`#{#8oup0ABd(vtWe372#D-Hj&$2
z&VoTAWoi;}0z|aOI@gkZBPSV#xXjRTrsDR*A{Q*`xq-nOrlkkGG=5soR1`6cLv^VJ
z)&{9R6xV+XcB4CeWHH37L?FkIYDA!AidiwjlL(omCSWK@jj2M?23H_HZVDCO@y6<g
zfq861rl32QLE18A>ll1fq^5!ln!|0%sTjd18Yr8FyXtocF+nYEnV&p$TM>RS>ezPs
zg#h-G0N4K7F%Ow*1njWnRf%ZyEM=9fpiht5!lAGu;L@V~n2si6Y{#sZFbqCP;@|dh
zzs)5!i{W16r2LOY^L<Z13e*>y`sW~@Y}Bv=SB@?{*3a^_D=mIFQx1UW&8ya-@g^T4
zJ!W0UHT3#SVu6~?Sc-C|@cRkIOdBVpk<((GReZC+0Gw8OZPVX%?kXJFF(*dkE=@+^
z(rySTHPw-&i@SI<VN_X!yllsl!VT6j)S8Lj=F3YuwoWy&fi19NJ)Iir?8C?6lT!K9
zul*w(;%sDI!GP7^1tz3cr%m{Xl#&}wB;C~&^W1YO8VY@xCMGPoT9L?7x**e-OMj|J
za{%2cWcMUdJff2m8w1r@<qRd4a__bez$+r)|4KDf8fy4<Z|wo51+%>AtdOSD6E2JP
zU0&>0jU`!dYhQ>E6^lu0*A;7*yl$NqXLFXwZrY5q<GmbY#6HMPBs1fjs`PHKd|v1R
z{WgmlQEGCO8PI7g1C&I{w#$lYjixcxY9_0jRO-8b{*?EWn60T{!jJIZ5|dYuLAK7-
zHaQ5T9xYIv@zlJg%Ctfb7m|xO*}$ljS05r|QF}%0jl%s*L22@A5NyIVRDE?ML*qkp
z@RK|qg)<WVf1!Dlgv%a?x%X1X{u%#&$VLd?a1J8cPpS6h5`v?$M{9m0>+tQ6+qPw$
zuXdbmf#zAVthNzuuX9ewTg)zd(;mDywzo5)P-6Nlq<fk@?;@FsG0(o~>`-MPO>O(w
zhjzW&tkULp#176*I9}yktbLpbj7AhJCsLeVzAmXeUq4CDEA~Bv&_Tb*PFu#oc&-;9
z-+KEK0fhM|p{F2XePn#~(AoW5Udd9a9dhTQah^&^nBR`&WTO#9l|&nwR)FBsWq4NA
zs(SPjg?$4!PUX8mo|yxRu+-Ea8}5AWpD5R{6>!~qUUl(pUwi6Mmird1iAXG@!_N0@
zrNp$j2kx0y=QNtbwrm%_X)fbH#gI_a=EpptjgpkItUPefna=ZwpSki5X%f8!P#JMD
z4A~(003vrbH2IDq;k(nt<er$T?KEUz_0+@=&^`({ohm3p8LH~d@)Kf%(V<JAD=O{#
zZ0#{JvpTV$zVBBdCtwQf{~qla`sj%w^4~W&K80sjQ+u5Ch|g^&n%qNeRTCb6fl*g&
zD>1K9L!R?w8RV-@wvFC~RnVF>NbVzN-+`ya7I>kvjkmA4*C@FFgrgLeWBR(VVtITv
zD8(C{oKg>H*ZCRRA;*b6O&;}kp8UH`SwUl8ezzL60VS>PzWXJycJTWMb@F<}P}aBy
zB6Dg%rA|mzPo;p%F4MsHfxduiI2hzQT`xaZ*N!<GxOwCo&(|DvKdS=kJrOk-9AY~v
z68@w5xREVuCDaZ#!q48R%WVX$&#o=a;Zv3N+9$2@A0SPwD9%CaLDzKtSE7yr&S%V&
zsXUp3tj!8Wfw-zOp`z=mP8$G9g6e`F|DKd4wy)}DsB}A54VT6wI?z0U`c8?qCXSm`
z6t38Y41Bk94x>(hN?1e`tOR`cBi34~KHQe*@jBmET0&>mwTX0~kj9a<SH{UE^vUD$
zVixqBR4vq~kdI5E#KG#C)2@rU#;e>swVOY&eR_^?nP~Y`y*1@K4)?m3ySSmoi=8yJ
zzrSbS8Y|*p&a~;lUo-(FW9mxwi1I=0gZx`lYdW3O&vZ->*O=;LjjiC|4TFVa1p6y>
z_cDZzOXn6WVLr$Hnt)0U10eLbe)*ZUZNwT5(ogii%%bCwK6`b*Uu<2&L^KDZ@g+>u
zgBx!YP|qw-nXfS)cnwCcwB1cjx+~Bt7tOWPZ3?mpwKrPe0kw6qveK+_U-XCKt5XOK
zv3&BTuPzyCXuNtmn7rljsM|oK*7w@r#qw<)Sc+RvKL`|m4yie@T93lY9Rso8JA_X@
zJSwPYWof7Y@Yglt?_x(nEBP`x=ZQ$l6J;Dr5U}>)?i5f`QnaV1e=`mg{^C@q*M!Wb
zq(PPm@=X%?TzZSBd+j?GET;1~;Ab&xcklDwSN)x1iokxS>fO<ML%7lkLJxBywxNiy
z16#}=B&;@oqx3H>TSSTOia2u^Q}V?%Si;Z)8Z7Ap9&Hq56K*5!ZJ!c=X{C7*Mpk@O
zFc{zCtI1uzk{wO93^xlZbKbXYVIIDGHZA5(bo?6eehY_a*!D>SNR%DVEW$$Aa&Xjj
zIw}~BWAU@i96^^f-i&B@i#FXQ&ndFOQQ5`vjcWlv#~LhqywhP1UL?o=nkWyW=qlyK
zGIDWS%<21w$`VW(kv1L}|1*eiNlRs=jhZ=3S(}|wU%;P*E8tiv@Dw+u8Wo3BXS`$G
zF@AXB*1e7mi<^y6v6*Eu;WIr#r|#6CEs9qH(2<iw(RlsSkC^#_)C|t~qM8i;!N6F-
z-=(S?<d)G3J7F&3goT`Sbfu)$ONlheDHa><^wA1Oyw)|;s8LDb5u0Z5`hob2k_fx4
z{IJ8os0QG)nYlp%q3~?B6+n(!E@eVR4)S7{`Ez7XmaH0h+cZn($LY-;Du68S<WhP3
zW&t#1NhA@nKU5pmfP4TsjL?cYSg`fHhKXSWkei@5($c&bb%au=H&!({MIV54KKZ$#
znvM2YK3O}5SdZ0niX`gyoVyCKV0`JiTv;5aUnmlrN%hcoVD(q94prUfYf&7Z<*F>8
zV@yXV-Y->7vwopW!y3830mTW!z1n3Ex%GxNg<dsw2Ah%8)^H;CQmfJDS`b7$jP2;i
zPDw`T%X;dX71iXFpet>W(mdMe1jJoh&hw{JlCqw?_F>TlxGrg-nWqFx^L}pmu>bnZ
zw5BJviCCu%ftM{25Hp$<L;6xmrAOs@fe-c&?!%~JYH)n}^ygq^@sr!m)tA)25?XVg
z+zt@3Q#zG_mi_5GQf#H~(91A&%qM?8YM-F%$^3gho!NgA52>n`$oL<XEzLH7{Gg9^
z-|OAr89{dUDKDbG1u6fW5Lt4M(oxua<jSEpl<a~6gBkHAOX3gUvZba_1dM33^dR|E
zt%L3srpsEnY<brrp1TlDD1@<6T>sX0nq=TXL~!||N>{C??7vm$6pHQ_71S3mUrNFo
z(O6Ap^BRCl-{hCnf6qu<<-Q0q+G1x&D+vc>4=c0-A}Yv~znaXntLuCnm47Lv(Us&;
z{4GfnEusm}G?p%&7`H;y)HL1Dzi2ZBE44}^`B17UlPf$3uXS89T-?}-iB?i%o3gYs
zFw9ltMQhHTQb<XRF5r=FYasW#2eQy~j1(<UNXtiN`YSa7qYQGs4}y0fT;<kW`lKIC
zN!l1Wi5MNpRiRyMlnf9E9(j(Brh<7=QZ|>66YCZ+UWxX#PEuV8U)LwUe@)O03o~=T
zUAXoigC-weft+U2cdZe96J3L$uda3Y#fpcr%+U+ur5EiZYOqC3MVKE^7+#9?Mtp2h
zjr$9Jj=Lg`G`a>!7Nw?t3l|$&vQfEl2o`YZ%uio0GeK<7zsllmrj5=5x_|vp-P~XT
z^Q?PZcn>MyNB|;{eh{=}b!555jwyK4FPMfE6Cs}y-;US!7V-(h#_{J!930WQh@_wm
zYRqSSBT6JyRO+XjXyoaS_uxcaJq(T0q0-cxl+Ybwn?oF<$AjSGMKJ1y*~C~ao8&K?
zfi7FV<Zf?|p(<?sqgdAJOiG*sw%GCVXg2$;fTQe!f-3UzE&_8ApRPhK5@o);(B2F(
z5$Mp>%$n4lPbx-T@P!1-4c~U9NQEv!imHVE{xx*QwaFO)QzwrKG^NH^eqW`l$@&(8
zl2K>&bQE@jt{}&V^@lhKu0lzCG_Xc!VJ1_R!Mi^GTvFECTYxi)`-~b70tMU6{$Gr}
zbyQnX+b`JS-cpLYyE_zjm*NE1;wes%;!uJWEn3{&0u+Z(+}#PqX>lkzr|*03S~Kg;
zd~5zBBw0E8?DOnLeq!c~)v)@r+2h3_r3^N=(<GWxOVj6Pc}4+G_w(H{BHmq?SvVil
z%OhMk_l#&F`3=9(3%sKyXUIrx7kYARp_YIy^(Khv-ZEz0sDyJ3qh<3=R)@~S(^wv&
zf_dL@w9qy;B`bF1>lug7=jX%_3NezjLpsgoNlK&l@UK0L@>ik1wd=4h1W*eS>0W4C
z8Wn&L+?YB@N@}8Ny_eBq!6ujP5t##uQ8uv&Q56<KeiV0D#L+#7^4%W$T*-{b@?&%U
zSp3Ei2n#w#xbwoQTgesWm~F<-AM!5ag(5`aH(b>^3w_WHI$Kaj&=F=IZm1jg;R_r}
ziQtGYn8zx`U(bitkAVEoM%1Cv?~nX#?z`yHN^RY}A7y@rwjY=5)N_YK_9jrWWc^(J
zV!s#EAhA`y-k%-YvmZuw&15cxlF8%`Pzq~o<l&QUJJ#LnyhQ;_=V|w16^y6@Cf<el
zj>_Kdwh9Gi1s*X=U8iV+2m}*9xAZRal4Rmg477fCgOJ&W|B{C<YIuH0VP{(bG6fuC
z2$5q<(nvAYuT2c=9E0F|$0B>@HjJWumN;^;kgTsp$JkNbpTCI<r5c9X5bP3}3lT=f
zkqsu|+m?2a42tX@vBq#Y=u#nMjlE9T`0VsmEcVzn7Q8!7)OAY7^3|Icp8suL@?y;G
z3cEi69h2Mg?+2k+%9z9*_qRo4cCZxBkNn2cCnU_T+C#xwU_ak7fO297YW*nJu|SZ`
zf}ipx`77U1h5@>70B*SwkCA>>TpPw+4&6QDv&3)0{+!{#xnrVKFmqInwe{Y^5T2sO
zu$05l)dtJ7^0ss!wXw@H$X=ujCj-nPfT|D;t5=p|Doc{m2IJyeBC~MN=hrhu+JNlf
zI)dAMk@2+<6%Kvf*L?8&iKO97P0qx8K5Oh14Xo?XWS!T8H`$VM;zOxE#QHKa_#{6a
z<Fl|Vk0_!@WOp`{WWc(J(i6D~o?rrBb^16Ydh?~WB)42)L<NL5=>nGOl!Kj*I}s}7
zVKb38_3F2U-FS5H^1i>NPP3_mG(2#Oa+WWzvok^+K8~@lRA}l2nzWD~T*W1SG1M<|
zOK(#R@VEdVtJpl0jXFD$H+*y&h2IDUuGpFJhEh3ntLc1&$w!qpw5VAm8@5S|55mk?
zfP{WSge7_Gkeic7z>xG2n}!{?EO?q7KTTUoR?1YPB$6O{A45`mvgp>ZtkmAJC?6#M
z+pk`mFQHLbfAy!bTwSt@T)DQk3CnOHjlget*<r=#(i|sxrziHiw!>u+h8L;7F^L!0
zd;0ssJWaik^5RwY;fFl8QqG*U%RMK`pPND}$pNJ2|A5F`{Q{mk2p6)pF`*=IYms_Z
zcOK0WZWxjG;EavQYLi+aKWK|ywQu6D(imCxo1f=CS(x5WPyTfBAsq+4b)<hqfh`hS
zkzsAp)>!ecsJe<HNh?^>yP_DfZG6utriq+<QWvl+Ts{IN;Jk6hTa82TXRDMf0W+u2
z2ndrB?v#tnVZB-oc1c#D(*LQcR4))%TlA6m;hj!F9P?2Hr`7q+5EG*z5#c4YVb29k
zL?M!&F%cIY6bklbZ;{dt{ELn79ZPJl2Hjsv`9=B9`JN9+>bM}*C}}k<P^2^zA2=wB
z*gDk9)7Ju^?d=sn`_N(2c5)u-;XQ7Ld`Huvio(mQ@{w-9spQC!x$Td5Sn=@Ne!>O#
zWifuO(GNsCcKa6eD1k~vUpIV5uYU7r{s4Aiog-sVMx0s<+teyuL<-!N?$}c<I3Is^
zHz`^@vu@}Eh8IUpw0wOoek10Vp-tgCwE@_GUZsThc?fplSLhdXUcwKTKLY07F<E=2
zJG-bivdI|Aaa1y@ODFxnx=5o49?ANU@YNxhw>qcmNr}%N+4yl=lW0G#_qIT&a|nIT
z6Z=%eje;?$W>eXL%PZ3QyWZ-Hq*l?PK#rN3p*BrL(&^~HBd#GQjG5!!4<0BRB>g7U
z(za2Y+8kyw7Di0-w<xqeEvO9NCOS!BbDz%;QMcY?8|h$Pnx+{nLCA6S%{z{X?ygD3
z@1Uth6AD?+V7&`7f+owLW;DDGnk7f3<Dh49DaTRGq)i#V>E<aq9X?u_;taiSIDt?a
z=Yg#lno5zB@Qp~5+_rBxl4CbFvhST)j52g$f~NJOQ>ui548w?zWVqpy9I$U9Jptob
zvEb<X_`Fte)GD>6V}6YAH%&XCw)0Kq>*LmBBUJ;J&QgmcxoQ+C2@&6^-q6SL)xCB1
zr?F@}r6L<NmS*`N$@`aV6w1Q8RI?Y5HOk$?N<<LRU~c6QO$%_>3`oM@BPABuLp6#^
zyp+Y`3fx}1E^MUY2rEuw37!t*+Se=j=jVng!HGO|H=qA<wX9&-T_|xG`VtijnAVcG
z1pC5aaL6DVC~j#)-s^_=H=5lu8y00dS;xJBMQ0r|POAa+)~WI=K2kyP!y9H_Qn#vN
z<&xJfbI@BwWo7L@Yrc~xGOjP)Hol#mqh8l-<mXtM5#rY~>u(fJs&klQxn99JDa#yG
zcmLeJ*Cy~@aKW~8^aR0#D)Dot09Bc$705~th3e=t?}NUYOwXL`wtcvLN(v1<Evg3(
z<8p)^6xzKaL16`3v6$PpAZof4;=y4XjQb{2YdL@+=^K7?0ww!3R#?U2Fs15J%Z%^)
zI*n0=A(5sk51Ge?mNZ^y^kWkY$`F?sn@8ZNWlRvdP4y~WguMT&&A36!8BwKPPOowS
z?rYt*=F_U8A8D)ma)=}TAu{ws8?n+t1h_B0a8}yNct@;|%YmfuM}e*j#sW~FI3RTC
z^17|gA?PlgYnk}Q^Hwhd`dP(PY!W$<(Ltq<io#MN<X}?%4anlL>YS*jyBbM$(*2#u
z*KyK6naLw}W!7Phk;6TL<fyzAT-KvkxeuD~FIT3rU-@Y2fi-HO(U|^nb`iks93;R-
z=Ks2FNy`efkl%u*P$}*1{LYu1JBNY3e8{m>Sk1tVr~(_6)~bf~D9cq_IU1bk6yu+9
ziGeP!v4XY2o|rD-g`!j=*AJ++rwv0hqI+U<YG1E&+YqhPNZ4ko_WYox)yjfmT7D2i
zsE(@JwkFB)w@e4K6N|r%+tn)_c_n`?F3J${Wf{e1#o&8<ir`@kZK8teC|p&9Vaza^
zxo^yZZ<Qo%+;971Bj*SdYf$KQQnkXLV7w{2b3Z3D^I&$IB+YbaJh8r~)|-3(Z#Hux
z;clXkquy}Lf7FdS-wWG^KS9s$b35FHJoaB#n|2J#`ioAL0dNaL?LIAM(X<cKdoz`d
z-<%GzKCT`y8!c*5rbJJ9N*dxzDR#YF(0M}#x6=*#k+`OK;O~A3F8`3BrDZac`@L?s
z$gu1#Ha{b-K~K_yJ$ltZNlCHZDlsY@zYJslt-$dH%^wZIz`P{%=?&)kkBO^cWl~eQ
zmB8UDRy=Ynmpp4ZH-*_>r~{LW6q{s=S@-zB-(8MW|BD6Lh@*U5*IrqkW2LPGHej(n
z%8WLmyM}z#Gdr7n3d?;}raW*|D7EvG6aT~K1M>O){&ZOoxitsW;ao+oTDFjn!gbVi
zWp=udnYeW}qrj`|Cu5gRvf%vI=THX&M0!kt_=V7_eBkA^DuYemA{u&Zo}x!6x3zKT
z`)~9lxNb!>3Z4Hg$2<n0rU6&F0=s2m6ypBr&Nsi;V#GdO+XD)5BgMXXGcB5Tx3~6C
z_dWIF#k$Z$^`Uy_6#?vnWLD#5CyPSZ{>e$zx3=(4SvebxAMoaD%qE~NYa;S@*i38J
zCoB4ogpKi^mIenB+nK%P7P3;Cu0|K?oBvJF_$sUZ3pda5`leOJU!l@|$G4Jb`p2Gf
zVeB*I>@`9K`D!(if#}a=0KzFCF}d91!nsL~+|kkP_zxcc002!Sjghi(rS&04=f6f2
zH8lPtT$a!!mz9+%Dk)j0s;k=;(T$BW;o;#WCM0wdQBuZ3p+d05MT7qSeku`>3~m+{
zjKsu52re$J(}S*o0g;uxJrf>}jhh=+NJt0~A|fLA>A^Qk)H@E)Sn0BB+eb4Is3yoL
z@TTw&Ak^Vo{qE|k7A-%cIp5%9np<6=-J782Ycf;v%BlDKSG7o!|Ec{Bw%>0^+{(=V
z1F#D~4Xbz7{V37G>)<c1OpOx^%3I2__1<WHkxKovm|DEJQ~Bjmn69IkJngN=PsEk_
zXTd%(E<)q+J$w1_SKxPO=**e>)*)~CCNJ0auYJ74j6-sZH$6h6?)r}8!w<7>|GyEh
z6a+wz^Kdcw7KTqr9tKUf2O6CI_mRx=8iFBR7ambOanfId0<g8pGcGe2O6`d4xVSTd
z6XmN*bzYe6Ra13z;_Lsa5=uA4u9z#~9v*#f1*%(d&SQ#~QIWwpx)VAOAuOI(;T~}k
ze>$E+4ICMJ4R0Vz3-M1-TIaei#pD$%ha<yeaEbjQ0=9J6bZP3OzoguAc3b|!H5faM
zi1}-9yJ)mIOJY20eJ7=jD<{s$EjWbe3{oB?=S6vQM~X~-`lUk7(iczF&b1fKo$^6A
zfY9Mhi`502_M7If?O&tf2vVu2YY<@9o%<3)#8=_Li_ZMYS14GG{Z4WMXQ>IBR6eML
z+xzswC>m$Md2=LK6#S^uZ5X4AuS3qfI+=v_;*8D*oj^{p+fifA4BSpM5%_g}<qU8V
zAxGMJcw9jpO*FBNJu!C&12W3eu@%gwiJzh_vm_r{`T9cPM(X#OTmmzlQ{xYF&;qz5
zmX(Jk;+q~3cOgK%qs!KIUCGa_!^0Y61Na}VKZTHd|6XxsF_mHn4w&XvtUGN5R%Tg;
z$Lb}`+I{{$El;Le0h@}^Uc@1<;I7`Uy3oR{e)3e}jW$asB>1BueLK!i#Mez^L+waK
zE0UZtP#`-Cnf^Jpvs=Z(u>vlbly%um;Snb7f{IkW{eW)?A>aE6alD1<CV()ykI#}c
z-4DpD@e>mie<k3?9?gJ1k<6F;-v~k+Bx!-^6V0KYRI&3%c8Hvt2p%B<w7-55EOM+x
z=qWM3o3BA6+5X8}<W}q5ji7?LBTo@AgQ4M+%cpq7faPgmp|PNd<aA6{+b@WI?{1xL
zVf{r4Pk&qahXk2Pv(*;`D!*3^uxU?)ME^<hOmCljCMPj&j=NYpRsjkX1?Pe{?rg_(
zR~|UL)s#;}h>-)BhHcJvj)T9IuP>Z64H)|pNBzh=%|dJ_6zZIZJSxpB!;kwgsghKX
z;nTfiB>M6We5ygeLr-Sztmdt)=oEg370oyl78aQYpS&9d8zFU-`Veu5MhQy%#TAoy
ze)H@zNW`cY8!_-XZ(nqoSo|8!<#3+SZVzff5Ox&Bxn5YA04cn>%JI@yWIa}F|2}f<
zX>+)1!r`(=k>D+J6IrdDSRl^+e=g#REvN;%65$v`nO3ekOKE<`j%_j(IRd@iK{XTw
zg4r%AfSWr({!#FMqUNBaFnr%`{I1KEzVU<5gj6L6+c=@pPTh{q*KpjND3zXGL|me-
zhu57a668UF_Y(a`lnhHihT$CnU#-iILSG8a?WFX}B}#Mgkl#2t$Z!SS@%^VL`F{yU
zqVVni5={R8A<+dPF|7D48uYM~RAuFXLV+Sn1ZI4^ZFquWy5#sEW51*Ffc^3Yz9*;h
zz)Jl8OubvSfiE}g!f=NL5etx=(^mE*Lx)hY_cMs*UTEpou3QUG2Iq3vohx}2Wo*k|
zIV`gpjikOV=+TWGMUYqjX!D-7LWJj+ER`}}YDxXePdaRTKUY&drz=9o{|6wwU~EOZ
z_xOzCM@DL*g(}hoK(ngN7No+Us`+OPZCRMoTMcK%@Q8cW2{lkKD~7z9x7I}@yG=g-
zca|%xp5NGT&wnD%_H?Nht@FqD-_$R!-)PQtUbK;)zRQlBOH4sqgokT&C|E3w8b$%*
z>`!k-zA4QyXKuYoh$$Npw7A~yA>y@vt7oi1`_ctg<Tqz7HV#F3_z(ha?kr_R>%Z;6
z8)7UA%?}~cmlGnD@yIg`9-uI;eNx3a#<A;hN~kjjiF6a|PrNdV2o8S9!^^Wwq^Eo<
zUPx{l<}nVP=5eFqeqRHY%RZAk510LM8}^dG<!0dnDADdZ0it4KiaP~9#g6Zv)X$x9
z2KD6CdWe1gyP~m?4B(F|9UmjcTEgdNY!BZBvGVceR$lzza9M4{Ue9bf@;?r=(HsA@
z@}7kRN3j2QvR|PNi#hxU>iZKM8NII<H+YwOl<Wp|Gp`Z~8}{NTtiocw-cwbKMXm(9
zk(mi)XP100=JyxM-bEp@5<($;;IR;~e>Xpo85Mvzv{yPpt&tDkABw0ACR)%*;#L$r
ziG}`f7_Ci@*zKJ;ZvSp;LvEBj3$-Q^^<w+T8VydiF&`O1`l>Z&dEGl^UpZ>&U4ct0
zU+>#`Fgry0I8(>6N#iuOhXE@>%mP3Donjq@)_?ryMnm&5E)srv>$pK{o6A0}4yEE`
zM>;EG7D`HpEg-Bv)z0<xfo=Le@c1$3_?~F|xEVIvvY5i#^IF`7wAZ!iKnAT)YPL#a
zxbx#a^_FS8LZUd6TwJG*!g&`4pgne7ga@BYhPAq$2oWWG5cY03V1H|8(1cqs?Z$Ka
zX89w{|F}~SunKIiC~*KySe%FBeOr6$!i-S$1uMZ3z&E2t<&Tmp4$u=1A0PZ}=K!bh
z9&dScyVL$~;$b9ORNSC&s8ZH6<8U%-B-%j$sbCj^-@z$4>z%#SQ2-_o>*xky?5k%F
zndvi|9h@$#rKJzI$1$9*lM8t`LK$-g@p2)(?>W07OU#bOAgr^4IMk?Fbtg`5*Pr+7
ze9p{v&IH*NVfc|H>rccu0qeaI&r^trsQMOHTkf~FX1UvnJ_y&Z5qar|7wjg)BjPuF
za)=gaWWyAw=s1XSA1?50L6}}S0~@A+gsCo{0M;;hYmjK*O6jY{tP`C5xeEo*I7F9H
z47%@?eX-h13)en}#C%PO?oa236=`DY%-Mi204WTRcVj#&e$F6`$l4(OM{7jkxPiDL
zUKdBog=1lXbiRW-gYtWH*RIEAznYkY)I7t&yVk`}h*zv*VsshMmGptlTQ20BD7Lc<
zNWM2tE=KJeU?j3HAGEw_`mD&0+H%mZbX)buTxV~v*JeZuFe{1?J6k|KBK|gNvjXU4
zl_nqtVbw)!aA-g&zl6$lahE2|o0mU+Y;0DvcxUm3x2_J(ke8ku+rX$AR@#cc>ovk1
zl!cgKe3a;BkIl<!qeS(|Y-2~+$xQf_*3v=(r8g0)Acb633pq0-eY!ahUcJ2VJ$B&_
zrQj+TuhQhwd0hai7k=OBF3!qGDe-uT7e^sh{^TeUnIrb8{AL+-4si~C0?TymEL%S!
zVPj+9oyqs#`fE35N2%KA2*OmmB3-x|{~KHBzHXn#$?<E?st-$h&rxJASY=6z%f$Z$
zZE>aidXb8={CLa!Ks{SDO;<gI%5_QoxNima-lot8KG>CD<jnWHpF?8<DHo(vNi!c5
z92RL1imW*qISIoT9JoFO5fnSc0E2vFdp&jpmDm^;)HuV)N)};)H;CkLH;m~l+EJ)_
zP4*B8$XyqK#UToJC{t5y-8=eOt_SJ^&5c!Qk3X7_cs|xqQm8RjKtn?V;;ZT9{*+9|
zg6A#e^%N0dcHff}%$XCvK_)K0H6$+M57KP4+=$FooWlsBx5CVWd}2E0%GdLRkkn|8
zMOm#`Jsmmcmt_d9O!z76RZc$<Nhzctv8?#ai>W_yfVUXEE&~08-ueJTOxDdyu*6ow
zgt#5~g&81?zrxAHq$zQ}nYVHUUQ^wBw=hT#%$x?Gww}Y#{bWgEVq)^IuI95pgb?AQ
zF}z$3rdh#S7u#46Ue59EQeQ9%>>HuofBs#tJ3vfiXPWH#V+x)MQK5{$AunHV@A#ha
zdeV2*9Q4-p$C-S~-ce20`pI9wVeEkJ@u6*e1FQYcw5D7*0Cubnu((cG+cp%{SVaZR
z9tl^;*8PsyuW~SEnf@T{V{1z;e4l|bY0q%hO94J&CTs5!zEzQIdbRA=J77=qUU-Pl
z>+bI2TUPC%WXF5<XOPV4EFt_Rw})x4V!bp8HHG^bn2RmFbzPT^+#d@WC-M`OQqh0e
zLa8C~*yyJr>D?>i3ewb(Hu5wKp!ysS*e^)WOs(UJ&fsd?*NM#F)~uz;4PDus-8bBl
zpW993*c7tr0?^xu!>-Nw(^1}u(i<cX!FRK;tG|1>j-BGg*vC>Y*hTl>{cb^wh=_3R
z6n2Wg>(tuu9(E*M%HB^dVURb={B$<&B7ccViF1h=zY?33MRt_~=qt!LgV481_+fJw
zC8Ay0vEo?7JhC0$_mW*E9lEO%u#}VlrAPfz$%Z=M?#TrdQeHlKO0^d}>6w2hGqTd^
z9)sucbBMglYoo(Vkt2q9+GO8HoTzW9r_i@pnzyV#)guR*xvOUe<EaE9h;%21R$M@Y
z7uB_Uo&#<apN_e&)?;6bOtuq-iC0Iyke8P~?5N(_jb+8Qo1nD5XKgu_R8<zqS{1aI
zE_V0%WhL|D=IQ3Pxr^8q>-HtZ3@VM=%-gUNV|grg4BY$FZku@@OY6kNKYUNcv5q&t
z1Dxd1@0OTKeYJUu3OBD0d@&p<y-5&JadiHmLv;Zj`j{lCnRgG6q&oN!^y087d{pMC
z*G}5{$V0IQ*XHuQ@P(WSg{K8&MdWrKhJNb{96)c07W(6?24TUukPnEQ%6$kMJ$@@Y
z*iU2r+?y%D5m=@;5%hSqa9HpOv8U066A6A8@jX-@*iJQg`wo+Br^Bo@wNuajs}5y~
zv8>rdg!(KDUwIOFsDnwlDQkYix9?hYit=sW^sFondbUq~3*>P|EB3snCejxiP~q$-
zTyKB0cXiSRgSkm9G=gles659peQK$Q(ms<)28sR!{HtQd=tdySv@utNV$bu>eDW#Z
zvcn;jq(KEgiS_-Y(WV=CU(4q7307kcDfvKtEYzEnc#<p}RC$rWztFABpx51|_29L|
zvhpFAzLZ+@qk$TeENu3K&V52~5d<z~_j~NE%jb-V_CK8?!%8>+_J9^IHK!zzG6)GU
znXuRhNrd_^zd{agRaA_NG?T{3Lfk&PtDRf)xJKY^B}~jAih!(=^%LToM-QSH`2K~*
zZWQ;;9Xkrx@Ur7=JP)84mpq5zRWNKKTH1ETz&4XtgpTVe!;>+$geXV~a+?3T67g8m
zt$!MR5hrg(eLia>dt9#|tx7bH3t#?C`Q<<b#N~75k`0r?wtjwkJS<p2%;0a1)GD~e
zq{M`-0pu6)ZlE(U_sN@ZAvVSu6#tAIFL90FwR}COvf&>KvQ(z@=YJFQcptL}bfa#f
zd)N+_5WjsW<MO!>wFMo}t=z3F^qt<qH8$N05KzW0<NzDgr@IBlvwIzlOYbYIk*^(M
z<`m-8H9@nR&u+tx7|rBsF#wenp$^O~B*RlZft}M|p&=IW$}|uKr$9o^U=qDw4t2Av
z>oJ>nLEtM`?5RI#(eI%W27S72DfxCFc3<fr-Jw7k@K!_Y>MbpD%kxj#_*yFwUPXP$
z2AP2G-^xFWVgjroyw!uNXOAtHOK`SC8~IuP_jz{ru9E<e$K}1~pC5hVW(xKbQJ2AS
z$Zy?TfxYsg!)H=tPvUN$_A19^(pAqDIVUFv5IpfF2?4L!eaE9-XGhy$@qz$;C%Mjm
zp5mfj_gXNZl0p1?_mclr1^BG%`#zh?E<b_`1@M7L=-NiYL0_#!Upli#MAnDXk~HCf
zJ3d+ygYDU}_d>qsbOl{qT@itSflkq$!|=g)_+p(E#KR_sRv~WlbgK^n_#jW80((rz
zZSw_f2Z4u6L&v8Zp5IFikpZF^zL+xtH3oIk9Sg#fT}s_+;pQNOWjU(?GU9K9e?*Jz
z8cpguDmL{JexrGeW`1se)dNLBgDOpis|r0_<Uap<%t`;<_DDcc%TJ?w4ap>0iL_T)
z%=;f({sq)5?OPY+CeScj2V9g?5MO$uhJevuPrkf;zkNC)^YRAgKYuEDFx=;FRAN9c
zfUkPl2auBU*4sTNH~s+PFbAMkqs&!<>fby$M+1arI?wnmsAd6IbJ!Ot2YnD?-q}wG
zzuzLk{a%~_7BLk!F4(j7ji?!iv~~trAGG?mRbx6|Z8VlzfQ#j@0VJ2he_zcc;Ab2E
z-><qF@xk*Rp6>r7dY5TFrma$Vc%9aOIP`%_d;c1u^4WCt4}b&-ye@dWA9#NJvtETV
zhr7QMA8>c6MJcxU?-!$xTLiK~*I>Vn+Uf!PFer+4MMyUBaq)H$*wuXR^BZK7Q&a2V
z;~|}cW7{qdNdI)Ao$w1*I#})=U-UpJ+%)m_u}YQf;d&6q{RKQX5pi-9*XOWxN}S%K
z3IET3AN{OmM%RS^J-Ii1{)x#Xk(f%+QOa$f7yFU2VxoeJjx4e;qUANM-v$bre2Idl
zXYy17&WpIuH$l&XJgxcpG}kxQc6Pj`KT1h-C&*_4-#vkCZ5i&%v_I{u3j2tbY;<~^
zknn1Y1a;KvWSE0qA={%*5l^B>*@=FS&ED3797Sr3x^YmGOJq1l%-m9*-DS#bPPPdC
zD8`WiZ8BII<%QLaLbtV(qQC<dJE#&=+~On$Wz44{6d|T?0&2GFT}X_;dDiNP6F5O|
z-3Q)mC&}mjBgp{jMxBY22$SrN1s0Jy7?8+x?0ySa&avE6^DG4Qk-K+Id;*;F3<3EB
z`eUrClrJ57zo(MF+_c62Yk#H-y5`*N&x0#2yusgt;HZ@TFGNK}uZUlgOL1|$B$=$-
zDaj4AES3bb5~o#*SKrsUKY2-(>6G8-G!z>d8g5-oNJJX2>E+^20_PO{=U@SUXM2cB
z$M8f!d>1V4L$0Qt3(m)nI*&4!AbEKa-m1$>K3mZ2&r<M|`!jek-uh!4iT)ekiLfx)
zhYc%~+uS9Vddi7W2#LOGrGu*eBDG+@tU{eTt`>L^k0RQlMtl&$N<)*CuE(_W$_|FF
z+??uyYS9ko<F4KOWC`-Onnua?+Z$rcwSNDI1`YVnz5@wXA5}c`XN!IQRS?)cF!Gm)
zqf>Si{x)vF297D??f-n4w10Dgsu(98`Dn_Un28s6{4jDGIK+KPB7(C)Bm)2Q2P?cQ
z6Zg#=@d7+PFgoGH9qiIBM)v7OQn`}y&Ex9pPkyZ0KfA=d4sfrOB~aYF4I|=ndAt91
z!~mNtzB_3>iqY1-Y4`PU0K%C`*Org_&xdvw&}=C)1}5eiAf?)~yiD>YIxHJb<x#p}
z3ap|eXCrTQiP;mz;A+WcXs}E)^RLY&jk~0a2`d$I78KvCzNN9|+mVJEYM3jn>GP>V
zp^Z(#AZ3sKHR{=|Rebl2Kim4F1^Ngy$A9((VhI#pmd22v&5gqu_yO%+V%_#xz46(0
zbj>sFB(k5eH_aL(V-`Tr*A<8u^l-~O{s$~8>w`2t7~Z#;IB5RM?}fn1#O9I$)@IZ5
zjtMtM+v~`rBs{=U=6$M3MrLLOC9a#`e}eTSkv^jjYXFElaVsh&R?2>|)n#Q+PJ)ws
zz1H(+KJzK!9LTNT|2LrlF7bCN*t2Eaw~b0^B1dd#cJ9}&Uxy9Zp|$p~e?c7KGK3_S
zBWZfzw=GEG>DH<wc4TY}yQbrsB$M%3J(To;Wpn;tI^iWX$TIcjAm@Cb**`IXWUQj5
z6Gl-oxD5Fc2edE%a9c01LE`~G(~Y{^Uw}y@kd3Y~155l}20&imr(u3+!#DFgu=(+L
zy`re78gX%s?{s<$s9L!{3hRG~=6(sB19n!$`x?G&m~BRZ7*Jdw(n4MH#P$eGP-36b
zGoF;ci+=A|(w6wUgZD2<{rA&<t7yI_dgsFh9JyWfdFXFF?4`X!t_?U|wgAx_9m*-$
zP}&7Vz{>Zgq>U5h?b{O1f8&9me-Z|KwvBvWFcHXK>5nA;9FGz#f8UUub|puCmkw;@
zZZTx`62JkcPh|4oEnf>MK0f|oN1RlonbTtJRy7z7i}e9gx}|H2ohnJ-+4aWvfZ&r`
zZtd-P4@S`Lhoq&YjZ=QzP@3$Dr+uuVQOJ<fo~E>OFMRYM!^a4Z@aUC}^Dt*q_@-J+
zZ8977bsb4)`WvIrG_kqxG_r)y{K5k7G%>5tw4Af>{Oqi~B4PJ0#d|_wKvauoniNUl
zu8LVf<R#5ueLbM!<<!Vm(P;=Q^JZKyMj8%MQHAr2{8=pkMZb<c0<0+oKXRJtnN?Ni
z83P5~Ng{`|8>b>^YW2n1x63`Yn=c-8?HrS^R*wU10cr|z+>JFUg~N>lajqVyh(Pt|
z@w=<JLlTNxNDQEojxbFyHHM~?o8E{#r>o^D2g=4xZ~iI5%BSw+L7;_k*FYf>H{913
zYO-*Tf7!Od>`~Z0exMd?d!BK(jKY`5Ze&c=PV!QC%7Ar^(U@L1fT1MhT?@K)K4)1a
z?wfpe!-A|2s`E^a`c~OfdJ1ia<vBod`NIEfA1}cilr2~t5`yp+<a-*ZsES&>?(*-;
z_pAQ={QFbC@%tar$F0Bj_mYpuiq%MY41r?4oZoTB68Kqhjq|#HW%;}lG$)5up~-qE
zVpa3EY&TF=QnBN}es<CVbg|rSKo0yRI&6*~K0Gw0Z)WoHB#(B@Q{HuKSeb0OiM;E_
z6khd47b+iJUeOj0i)<_)Ht|}mN?GyeQ9%u}xwQc4M5i!jgPlR2#Wx8y+hvQJB{HX#
zKq72yK*#C^?{<5N@p~qBwe5f>T>I-y{)%(ioMyt0jzl7T$Cx*ngIG4OIpqO4tcs?h
zZ_X)d7?wtFex_gmC#*Seh1L6N_wr>&489G5gX8uUv?iXq8X;iM7o9$r=%p2~BBu}C
z<z?{6Rl0n<xB`4-A=FfJD-g3f0l&r5#B-1FGgstZ6g5*vRwSZhr50h=%X)cq0{;sX
zl9Z1>>9n(khW_!(DRevvMNRw)_L{DWSD+-id!(WQ9MJ|`)%Q66S^MUwTj^;VP%`cS
zU8wdKsgJ&?)to|}$UzXU$fBXQqf03eK{E=(maQNv_^gOel?P1?exHB2aG?!zZMp@z
zp|dy+lyVYHnX4N075Ra>v8&Rj-P#4=-?71Fy~siwXOiwR6!WUyJ^41M=61LE7$inq
z6JTQNb6d#MIap^8sdvhY_1d>uHdZl04pXE1Uhy5vdH(BU?a!VnV{QWNZ`^HH8gTBr
zLyx$;TT$n875hExTzjBxtp97>Ih3EsH9ZO6-a(N-3JPsA^DBNcL6S<%*dLKcU;WDC
z>m|>9dZhH3*hHM&Bkz?n`#PZUfTPA<g~sgCT{}UcaQC~l(s8?n^G9$l1LYuZP(ydW
z>pGpFs>Z`3`q#Cz9EJP^x~QU$(42ONWjGm1P2d+-(+5%Y@h5;0^&8_q_lXrYSLrnE
z2>STf^WyL)v~Wk5<wDyt0|R!o32d~rQbBr--JOKNWTvVlT(P0oS~Pw4C^hiyUmvvz
zlr=dWrRBXiW)@R^u<_}na>d#d*;4WDVes%`YWZ-J@_Z1(sGgHt)s$<bmv?Xw>6f+g
z3}Yr<`Z=Vi;44*a4qC(icMmn~VvmLvo<CQz5!<tbJl=j_dOfnqWg{S+^u|rCy#G1i
zR_u_Ka~tG<OXA2;zy&A!Qt--hSXPj&u1;DEH@|5P$LFtn-)&!sg+=QN!;%(By3}5u
zkRl-MA`+Q4QSd96P1|x8RD4p?zTaJ3s_f)lK2+2<nM*PUk$?UdHx4Vo0V39-!g>f_
zt@&`N#qN7w-0lf%TIV641O*`n@m}{b((2RBEnsjG|A;<k(y%^hvM76~_!AJPq;PS1
z)8gzl`T%4c6W<TFEyCDI!}{6hE1#tbWpqq%_3e-th!)ml6xxmyT>&{EK)DZC`Q20i
zDQP4pOJ^gE@sSi;u7Iqa=P=J+`+H?$SXNq|)N<5w=QF~1>o-Y|{y>;)iA1N7UTn#;
zL);f5-0GCKfbxQrvm7&?PEU$-cK+cPs0b|(4=+PaC7$@(br0Kjvp>v|9YBcN6!r18
z4M3n#109`0YLl!~cnYgNU*Q>CF$h`eTW)R*b#_v&m8oe?gh%2llhLs;n^9_d4h0c4
z0fpwnRzL{x8;Py8^(Js?;sLEHmlAN3H|nf6;cO?K*Odzs(ZXX)oQF57-%L?c=A40D
z<6L5OTRCGnJvH0`^?!v$pw>bM;)L;3CP&p;B}}BCD$Zk0R}6?|FaJFNR6ywiKV%y|
zvbO*5HLtWbirjsr_p76mF-TTffL_xxC2Q}X+K?lnvJ4qH4Kr%pNYl58h$sBbm2Qze
z&0VIz204F<F4K>X#Nl$`_AU;xp{hk)!zx>{pBy@dNVPl;XpRIsjM69KinNK9m20-j
z^Ko@;^nYGhC-CXyRkl&^lo5TiTaa323jU#mfqODcb(g=vXIiPhS=)d=m4>$TS5DR#
z`{&P5d1n)`{;Q^+<BGH-6;eup9OdPXZroi&f5UA=JpcFQ6w5Iar2)!-G0{M6ahM#P
zU~>IFH?iS4*Vt*a`E><}g$1iQzYWG6n@H7^iS}nsoUHXo<{f_z8P;KINm)bQ(a~b_
z%~P9EC>e}YMoIO=$O<#?(fut$95F;mW)Sgf3<+GjxxBH3f$J5#MAY)QGJq?qmVkQ)
zyM`rGYl$lKucnpHidwG&sTCGUC(>LQsumHvk56Eb)xZjbyu+JiWEDO181dayC%)UW
zL34ph+Cpr~&5ArzVa(4RO`h1$B6-UR>sa*F){))Otgimmr6dudGvpP5h*iQe!xC}m
ztbkGgN}2Q5Y;HwoV8EP^r8FIpmhJAYva<24X}Py$z*OEaJNP*>26KhuW_6&s!UUwX
zf<U&^m_hFD$29RpQZ*1;kIgKOz|!gJiyo-j6{aUhczl7~TbE=Z)Zxu3;CvbuGlKE+
z2;+6idmK4;Je*uw;xr?~S*TYlhn>WgA^ZncXQU-Hz6ss8l()J&pyRR=fNM_syPv~)
zAea7|A@+C#k`#lhWPwgd1<&2R!5i=V(3G8qFk4fL``_Y>nhHEMHmvhNa~B8Ov&mrZ
zM{-t0c*~J?)?zay=>nyc?Id*%^!6u%H&}!;zx%hEgOU60axFR{kbv2+F>aTP9KCnP
zpCp*A720o0^!$ZVteKm31ofS&KeKf)G8x(x9p0fdg1<R6|16-#q6%0TT%N2Dx^`R<
zWZDRbi<>?|B2huja!d5^eEA~axFWY%YjFTw`NPZeP;}XW2FFYPNt9Zf5dti7k+=VH
zTjSL$py^Nv_SDxYAsZZ)Q=uLfjUYD`TWr-O{W0`Bun3iE^1I$;2L_4{EE89yE^RKR
zTgIu~fzw<%McJWg7c|MHLSJamYi%k7jq<2!3L7#Jo<`)Y;uqfSAUOvsPK8}%3Q8}j
z=CsVKSQ*8D#OnG+2-MiM`C62>IxT4F`ggKA1gwe{1jxR0g~%Kc_N@o9U$?b&`>m5W
zEkY?i%|ijaQFtk<QjfeKs->T&LCZLKJ_@cfz4mD4aabr|vI2!1-+bqgK=HKR2<SjP
zjPey`H;fHqO%d{}ds9Kc_POd_D(ln`xgDS)wDw@QjF4#oPtc2(<*i#mPk-%xJU`vD
zg%*q$O-ZG-AhdmE;~%Q-?f;qh(1rfhzuMijY1iu9g|t~N#(}v}dRywPaM2YBoWy=B
z=KP|fcGMpsxrw;H&>^^u?)ry=w#}zj4j3q&9nI)N$nbuweU*Cn?Xd6HZ%vZ&SXGJX
zM0TJmI^+9a8)jcMXzXA`I(*x1e*D!eJBtKC_^H*5<|oAHO1jh|$Drc42oQtRpVm)q
z^K&Gbd+Cxi)!iwdbrTeAN(lwOYfXRF)x+Z>UReAqs?@B94)#PC>U6+0oB3>{C8kPv
zOb63NzS;B#jj8uep2Z}zZQx89+vYXrA?ecHzXAFppK&Bd*hE4yt34ijF*(00#8Viw
zexxVuQ5)egSv)w2v(-ZPZ~0WWu+FU6w>{iMuuNMc4rr=4FtM|<z#SQa5XBTIKQKJM
zPk0-X8m$&~`4^Dw(RyFbkIP%|XyhTSObmea&i$%&3dv6~&Ozuy-|ZtiWTl6dKE`!M
z$}XdE3sdgGA*=ghm8ykB4D5IvUJ6u|g%sN;x~-)wf^xvCxw%j6jd-~(j^!1aYNM4A
z$w_l_P1d=|@pJsrWlWOYCn%4?F)=ZiepiR#unb^wDm0$qP#idaf}G~8<y981vexC<
zat~!{1qOIW8-OA<652kFJ)2zwvJL;cwbbo`cnMpWSG!v{gC^24ETzsd6$UjjvL9Ng
z0~h@r{hbWvH^Xdahk0@}y|zpo?sibr<6pKU*<Ea1GY9d(%U>^G0u^)j+Kb1R=Rn~$
zM$#^hMQR(x9nm+Zuwdc%j<{3>eg!Vm%-JbeceH-y)YkoM0A|s!0!0+)(>k|cU$=8a
zHeMq5CI_NxsjF5H(`ZwqCeeyq2VU|>_>id$3@^R6u-^|!HW7$gsY`e#Jq+7*Xk^h1
zF!4C3BRTJM9E+6E@uwL3rB!I{WD9RLisBx|SA#B7^@Tfr9L?w?nHN`L(hya|(!|K^
z=ShE658G)ab#q&yBQvqblC#1mp${*usTeT0Un7AZ3VI;<T?zJnm=G?lVV1LUX5nr}
z0acgM0w`iuOXk0$jJ3aIX`G5x<#Jy#pc#r90{L9T`bF0OTKtCVw>~jHUL31qx!cSL
z8L>bcvfjm{Q$j2~_t)@=Fo_RBlW>JzO0LhfU4u7950rPl{)3BYXU4s*rzIHyt6jDa
zp=VuT&r_$~H$d)V`|zbM?LO@`_6)Okf;edIl=sr(Ir)qb7F70E1D3lcVet@sX4M;i
zT97djctv=H|GQJ@M1VA$nskMTu!%)Wjb#!v99L#H<%$o;_tb?FA=!ak-j8nD@MD=a
zjK1#5B+_E#R#)O!`l4Cz!oKC{<@v)m<9seFccQ>&FDl<LIv+LixWi;C`|2@S%%RsQ
zA3b4m22+a&#-fh0_iW~{@M2}Yq4Mtu{Q1%EY6_(gZa!nBbFRlUDd2J6wrot&arBob
zwcehjNu`UeQ3%lb(cWaCvNTLcD)UUCeDz#%5-Q>5=o)oITd@osZOGL0JR>8KE&87H
zHg#dX0pb`mYBRb{65P5XGj(x9ed|6cTS(ysXt#?77q1!Dy)`yUTjddK;a~tExx&I1
zXAi?-tKuM}M&xKGbvbS(M+nlQK26I!e$C^9%X*}}zNh9{m^bsnVGVT=Zk|VMz2Drd
zvR*FC9~jJu#7-5>Ww^2EH5*wV7tp7+s8VNP+4b766NK#=4BJQ0vnQc3T5@mYr=o`y
z8!TEPFv?pAHA5KrLJ;9Xi!G3WkW_An7kdG^LQkq&U<~z^;$kDjJZpi6%-uKw7iWMB
zMqS&(1!AqyHakE?_3->tq(Yc?C2$4ChyArW+a54zblPCQ0n_KMh2N^!I4ciySJKR4
z27q1>05xa>%#*oGGoXkP%Wa8(-p&X(xyYLCp)N3J*!bT_q<_lIC`*<RzzCkWQKxW|
zlyJbMqR#2345qN{uAC}_mt%aCsm$UG8-f$_U7~(>G{&XO0*vD27R-LG;Uk$ZP(zi*
zywhQvXu|4ZW$BS>LVEOfw6Qc=YbO65IBya0fQGQFHxEbVVXHxm?>_${>mtjpMe<|U
zR<N+oS%Y`&kM7sJD#i7Xqb^jn&E<FD)}}LDEfyGl8qXo=Y54Nhk0=%9(I4n--GG)%
zc28JmXf61pp42uH&5%3TnOZl1SII8YVDDG7*~ue6jNk1$^R+r<Jo)we=z?f;$IV**
zBp6gagJaOh(W>wyCx#Z2!Lllikh{iDh|L(=+YZ2SM%8V2llq!)@5ExzrAF8JpBP;d
z14ukv{YgbgY}~>&0OQ_y8g)qi@{5bq_T>t^^{4P5fTrv4m8dj5!6=eO+Q?p^`pPfK
zg12SvmjV<nG;J|p-$d2&n=p+n=1kS=J<HBslw6MeP)dRLzCB*lt!zQF-UKO52S|*q
zaRF~}H~DUVWhJ-BAen2xBTr|>J)^DDUo5j4Vj3cSyGdzC|1U0UecD;Z&(V0QOI{B;
zjLrOl*-`bj-JZ?FysyTgyQ3xuLn-FB99dt=1lED@6;gIU251r)H4)yM5K?n?<6(Ss
z;&B$|CJ<&&tqr?TCIyvO4s5GME@B+QVDA$?szKOQoHb_@Aw#QpYV>wsk0x^7YN1@+
z9rtgNs@FH|qcTMXU#4f>h0?t69ZlxHj#l8{F^J00Rrh9vi%wEGQ`O*Ytqza?^}eh}
z31lRO&(nxynSr#g$p&YaA$D;3j@YfuDWpiB(cGp3nU|vk#Sti>?gJwD`=PtVakfSI
zCq>+JGxc=$(q%p+-6>IT0bw1nzLYRv|9BL|$8@@`h;tCL(wBVz?+nW*=fxjUD|qu%
zN9MV&_x6UcU%Rmacwecmz{kbFKkFS!@vRftqJwcC`r48<>)Dm_+)V)ikqFTbAe>;U
zI$}&uQbHzO*e^L%$MZ7WS|RTG065LBo&Hm>U#ufNTWyFnXclTqp!TB&ni>V+7Ov#v
zu0~JK5>HNFSmWgo86-4mk|(rBTx)e_T*(!7XUH@RA$fyrr|69{riiYqM&xtt|8@l>
zTVkSlPa1DgVBi1sQI<w58jZq2?2)vkNGgOfVtZ8;DYB$?{DQZqjs&i(-W63@j}lgd
z|EA9Ywlqm(X{n5qg(DNFjAcD+i-eSAQ|x&-YpBDgn21Lh!5~MQ`i)cCq@1(fQYQTa
za;w3cD&+)2R%sW1rovdBsEQa(ovOnuLZw0>;;g7U6kPQzAvxfFq4(HLN;U&SsL#;%
zuwN<Skn~i%c|qas?oC_+w&&NGT$FgD8+}&KH)w$Y7d1p5=SiM#(gtg_g()%P17l<R
zJt#h1*4(bZQT8on@hC}%HgTmLCpb?_dkVO+pG4L(uNWzUwz*ZS>R@<5&zOM+_isNv
z4^jk$CC9=HkXhedrwyL<3CKKLwRV|*JfI_bcNfIvvt@Js4$=QSm+=&32}k0A{cnW=
zoO41vj-G1(Pvd!moSTD{)zMbm!%`Xp6%|!AQvmyYiMq|;4M|_*asi-IlcvGZo6c?Z
z^BaTL6J*AxIb3lL?Ze)?0RPd$*RkNHgDh9vBs>0sXGz*vFtK6vyvI0Yli=X~RKe8j
zbeL3V1hsWMBhA;Z;By`G%yD0t^Q@^PLQ5H_*WM5Mp~<%fcv@ey>kw=a87!abj<PRE
z+3(F~OSSCZ;BTi(aI>lH`8WN0)`7gnnUOfjc;?NI2dP&?{x|g8RpCB=iWn^%E(HW)
zs%rI|LY(`p=PhvkPz=feq8Q`u^;A7B*X`5$hrUfPwD=OnRKi(%+nc*n_u-VvFfH^W
zj^8Lz6m!x1ZR>(r)aR}cR;T3!-xn{QFO_7abYO{t5G7{emm}Qd630Z?N%>_&DfW=G
zu|OCjN>GoAhIrhK1norp10_L!(5v>%=kDzE8B0shh0?VrBQFQbEjk{<X3+CJrSVOT
zC^fIym9P43uFXnPV7V)iMwXW6V($4xWFfL5+Pi@`VfdG*D20YXEb+MaU<SI_F$C~&
zzi%vffX<qhksF0SE$O?x1FY^dRVtWV)awoN)E+g%eGj^!({3bf<fB_%TcWk+9+m4?
ztGZTN5^Zm4_6IiJ>g`#B^DG&sTN&FOLtU7zCo;0GWxw1&ozwB@nI>NpsoS|f!qAWX
z+9<!BR8v8AAf`~Q4rwQD3^uWSC)`b2>9t?YeC0{G@Q5?s$P_Nl0gR)Gfe{3H_Qfld
z-x1)sFS^B^DllEMNXK7uBybkawvf?LtZbO)-*bH6t%90T{<9ZrqTSv^5>9<BE2oIq
z8*RbQ`+timuDkCAPqAS)%coZY{`!3jE}NoaW^;Y|r`Op2-_EK?Z@)&kmj9i1<@Edn
z&k(DY@TxI-q4fm54Y#8e7fH^(5hjUZjs3hd9FXqN@}@!m_h3#DFPF`(?cx%&`-2G=
zfw~F8MQctJwrK1;K?=Ca+Yr*)Kw!Sn%B91P=x*Y@^(7t0!MP_dOWsK+kfd3lqV}h#
ztQF|#NWW*m3rDv9SU}b^e5w)O0LqCI6u3s2Bp)9fT133l^i9aSpY&__JEZK>;I)hn
z1J8FvQhV{zY+tvX+^Dpbk2YHuUVTWRNv{-tHANp(I2geLKQ|LfR1-2#yWVSe>5E7z
zGq4xO$72w-ynAb0n7tN}&2gcnvi`hUM%(|u;<mFxto=m~6E;UqZ4G+m4ddTfe5<)D
z<G1vxs;FF?14Bf>@vO(`csOBGH4p8`F5N2ZfMo}TLct*KjW1#T(gm5qE9xA&g@>I;
z%MBWtW;Lh|wg`382C^Tvk=t=T8T~XvzlkmlKZ~jrsL_?p@(+z-M#|zFcl<zPZB-)s
zXfW@B)qpi#zmLY?LDBB9*a4(u+TlEKr`0U*4tYl{)?PRH>!?b|tmD<Oa0$)FI)PIf
z?naOrOb!68c^4%Y)apUNaA&Rn{Wsf!#=P(hXTE6v9F#)Jk0H>ymrd9yfY6*!hL;+U
zfujL?%>|wztjw?6IYWgq;9O=nMNGp4m_8C8{4kvDw*RZBA}b=8=AfdYPz|ChqUEmI
z*|C-v3Fj5Fm6rzuT5TIu3oG<zf=gHb;2#K=>sN;r+R%srm}Mn(b=lB6GIsn6gaxbh
zuVa--IV1%9Tz)yJQ68~!x@C&W^4cuZ0Y)^_0c};)dMPopwJfaR+I7bHys#$xwh6}u
zV?e-Z0&3(7n_~fR%bNi50@&~fBC>XniktM{Td=0t=qX98mV0C$*h)ebOdjX#7V;~C
z`*zF+jiH(-0!)EtaeEO@B)m@u$&`3u%Nl8p7cfphTi-O;&%Wzc3GTMf?BP0ZlAMqT
z9Gvu(;fFO9cO$vCyy`97FWa{fBcfe}^<H;#K{BRPtU!+DL$;CWP#YocT;g<Nhare#
zn3V+4J*m}vXE4$3JF*V7=YFKUPNFtTp@{e=<e8Rdr6*<g^w!6o(GgQ-BErbK*^Wc8
z$4Nm?_q%ao61c;M#Qp5HRzNSIYFoOQNL~RLKBRnCs^+ON=B`dTQvY5mRmokIi(=gE
zTvwnD7fEC#S_nYy1Ut`InLm;<ZpWj`-&$2Olg;CV&FsEhT;A@_=`yqpmC#oU)-7Zw
zs3eV=LJaKFIg$W$iXdv+OQ(9{RK-nbIsM&wLu8vej`6L(Fu9f<1RorD$Syii8@a2g
zY5n@%jg#~Vs&*T|P4}Jo-m)fP`NC|%`D2qdzZ{H0b%@jWcNYwLCMyL4`Hv&R(_*>1
z=U&r}t9MU3;H8UR+rn&w+F#vaJ%#%pMovH()HASDVn_)m(_IeHl;S8IwEgGobeN(I
zO4gHVp9#xLTuf^vOsqhCFxUQ~f;hCrI>do8yQqpeJiXVnrIzmnXQDG}^6)LH@id7$
z&`Xs<e<(Nk69?$~CTUw4t%K=HV+~)0`<cigb3<#T(Rqq6CJpsVDn(wx|K2AA4dcth
zoepjT&i~9>MQc#uu;oAsSW9G9H6a;DlzfSYO?t{ID!8fX8s<k#Jn%a!CI$$3_}yX5
z4v3uRaG;dV)^5u`p{hd2(+(kS#kj}um)@;wt=&k{+`?YLm*f~=X2k2k0AG%<SyWeS
zF`nC@DA;RBT4=cGwydY8r=?~mY}HPT`(9F%FK9ocI4t)ypo+0*8)dOB_o*^*biiSV
z%+|C~2c)7r&{U{%*$vWTsqP_zDi&MN=dp6L8nIOG?(T$?>v;6&R8keos|?_$hopp!
zSA~5q%117CrY9z3#!qX`umE55NA^OYxwuV{(5h>p-#p>apZrV%a>pRzp|A`RP8qGV
zfw&`58zwqp{nKA0S#3Hc+|}9cjJ-=9FPcRSXxtv10NEE!<r+zlSxCA3=F9|aE1uJj
z)~ywnrC=Tr5V8YDYcZBt&PZJ>=&n+Hjs2E$1ZKYgPPCA6lBi@gCas@!^uJjE{;O4I
zI5L5TKyRh5O6`yfMY%)yS>zdw0nXo-a?uJ2e#4j_mAK25Ii+QJ8kgnKo!D$QjfxyD
ze{4Cqf|SH#@7hR`b<AY=xoZlzeHY0+i5WTddfZ0+)8lBD9yW*4c}ofN1twn4>mFC{
zL%^P?fEz`JVD$#TG&VG3>1%y2<a0{3^<<pWW=LJuv)=J(tKHExQ~S*J4l0ZNYcYtS
zS*?ud6SYZ0F^vL{NWYY_gE(&Mxo7VQ$8kO484ooFz(0mnEK-bz-2u9%o#1vDzwH5&
zEyybp^^l(<ZGMPtWg9XgWf>f(_m~b=WBwMk-t~CfO`HapI{Ez>4;^V{5}s)@gikLF
zdh)`GDgc&!R?z1jK@Owq51IcLabFb`N7VcoAXsn+GPpx<ClDNhyF(aUg4-a$-JRf;
z1h>K6T>}JyyCk@~4cqzlWzX(^&+fyXvk!B+d%AB=Pj%g@x+TBD{Sy$Hd=@^Ui|(HB
zI@~RIv%W>Nk$2go*b|AF;t}Y1=ImW$w$$56wEDuYm~(?Hv^8kPeY_o1Iod4SvPbV>
z?rV^|_1AbjV(rfDNLA4TR;NTU-<`6}xxJ-`p2d&tn-g<3w8aTHV1(@`A129OFG~jV
z3^tSv5;>$xM`_rqQ|p_VB-`9*@avk!*}chrOM6_!Jv5AnVDiO{nttN=x|?Wzwp=G8
zaD@p<M`64i6-C@wSy5uX991URSXowKS|`b)nS3d<En&;8?qk1@UUf05KP*?eSfctP
zhR4{(U^ZobN>wAyQvG72@EV(+35cG`OrPAB6%LLvMVgGL8W<FDLTi&ue`{%rF_nhb
z3c>3@-{Q>R<`<M;<Lg9c7?xM1RJ%5$SX9uq`xFv2;9Hc~QcBOM29LVbs-%%HGtqs*
zDI4}1o%Q;SjhA2kls(M&F)j~nxy!R90;Hp?47CIg^gczGK+F0Y%0n4htNQ<pg*HP9
zr2zHzy3=`o8yo8Cckr1g4kkAv&?PB|{GkThzg3YcjEh(@=3#X~U|lFJJ&R0e6NNuR
zm>UX<j{Rlz+c+oZa;z7Fb9(vha}j3fr%;f#nKH>Xv1l<C{rIDjnSnzk!Hxj!Hgz_8
z4Lv9|qs%{=XdeFl?R!3bj%|JM@$uHBqfUOdRzK>W`VNHBm^zb~n_Uq~r3fXRB0?&r
z{gm3g5`rK4EA+U}+cW|On~_vL1YAt<mW-kG^{lS-4<DpQ-jj<&Ez!?jn9q!O!=}ej
z%XgJ~D<bhYhertudu*$1BT+5Kvz2p=ynVlLnHr$&j(0DO(99k(NsCcyd=uA1K>U);
zrsA%}GPF}VbG|)gy-?@QN?ps|=Q%B;m?Z?-euy37iGLO1KqW|W_MxI!PtuP!7m#?r
zrzLZoXSd89@GmC4O=>n(UE<6QoR?*bw1S7JlPu(<?Ec0XJ`<Sz(lkqt&3M%+q_;#R
z0|bci1kDU`{`|ag2C<SyIV*(W_Nlo|xE5{^r6oEI*~RE_5t$KSw(g6tNe%^Oia-;`
zkXAefKa#BE1jECbY}!p)CjxO8Jy}9qL{c4GZff0DC!DgZKw;a|YBQz5!V)Qi9XXy^
zBWZ{<=HaD0V{+f(ED45EWr?Hpz{u)JMab3qR$$2t!xT$f*s!W7V`hqO?Mn35=<D&X
z@3-~;?7a%DfbZEaRsFrw?H<T&zNOD2Z}Iu7oZ35F8mBa58!7b=@@r}L78Eqnm1^5-
z>g=_8{MrLj(p&uyFLgda=&DjJ$Gef%181gZ;?V&NAm%mPRdX%-)+X}1K=VUVOgYl!
z?uXj(^4d;<&cmEV<KL_0Ih#!$SlX3~G3~OZ(}2F9fFS>CrRWyShii$wit;q+y8O_*
zv+_o)EXB{EFuq*ecl>m_j0TDB%30VLaM(Qp(X6{XpNoHRl4T+@&)pWEzP84cXIL4?
z)7@(1efTBdzuLY;L|8Z_@Zx0bUCu2l;WM^^LD-wJFwhJyq8pdvWVsS(5u&h|US+SV
z*c?IhS7MOWsn>Gq+z?VhSSZYA0{5Ma57!}pb<?N9s=h~XJec7x7j%HMchN3L++z@=
z8@wMfQ=K`5F&Cn-Ir{mdNFm+k+Y7mUUG@hI+MJWcY#()b?h82v9A(<PR2TUBditFi
zVs5rxPYIff$k<^9a+&w3J_npJm_$k<*NhU97bEXvOnpYHn$vZ@b&ftbKU`T~uXTvg
zOg!3KdXwjtz002e;#FJuXsK2F>{aCklzKRZ+o&>G8C(y%8-AD8?Hh~CS*4x5)<&j7
zoasz;_Nwg9&vYQ9DlQXe{8;3+Q2zxl3&PP+Kt4(!0Iy783IZ}bLu+v!JLVFS)WYyO
zv#65z|Ane)ii4cBens@Vb|&zSs(tzzGgU7!{4wS17W{EyR+25{+gBla++S|^1H;h7
zo=G?Qk@o(DYS93<i8kn>*l4d;gdC`O(H?)Sn>zk(W3<8M=sk8+@NP2Tb~H-#KCkWm
z(4B2C+Zxg;M)J}z7-3?t`(&z^$rG8arnKtg{wp@;(sIXnc@>p-8<&uwug4zb4NiT_
zm<)$w@smhk5s4;DkaOFG$Pqm$S^U>h&^l6FPrn>NIuAsMvZaKR&7z#?QQsGat4J!u
zVROJngryg-5=L*J#g|_zj&%7QfS4zZ*)AXFbh^XUEGCySiNP9c{_BZYrwHIODBIJR
z`W&15azr`!c#U$EInrs*Qo)d6U`D2>q_nx|59b^E*W`DEHPM0xd2hSrztBX0$dt=&
zD50U4xcHFX!m5-O7-1R6A>~?Zk0xB?<2Pz(MizFU9t1=?G3}&XRzGh^%Dcqm9LZ5B
zQ{_>Dh(GdgcPzJU<Pb?toGP1%(%5%tn3?h9Ly5GglT3Kusp)D5(yL2PPuGB43?}5Q
zxFyXCi@$#>fuCOD(PoO0mDV!M9zuuy*u%A9s!CE<5BgEALuFsUEt{}AY>~;uNhbiJ
zOKB)!$k4V?78!vOJ5jw$Nr}8F7PThCUGTGXp}wedNz6zLuVp4g1R|YhK~Xw{EUc`v
z-nXL7cG2oOKpO}ctH~=H9V#FjuPtsMn(!Y44Bwh}EV;1P#_d{%BZYsLa%)H?pZE2_
zET{jY5`+ItkCFeg7K8WAQE7Nr$(QF9_O7RCs(%4MvL`tP{|7mK|EF`AkWd*^AcG9n
zogXhU+IThb1a#<hN9)_#KA5!?d|ZFM23oUw0-nif{tQT>+yqkUsvcx540WIeY7{_n
z^cSFP;^UM^)CoM;mobx5B4<x>zvLz4@Wa01OC+=t?-+)6qN}rxddxmDF`@lp0sp!l
z$jWYgwWR9E;4tVZc+fmMYh6C+>0nh{3B~;6S8Ojs)>vPcO1}HYtqRc?5uyV80HRRD
zAYG#D;`A|4K+=3$QU={mat6230<?$&iXjNkD2eCUwMDRJ=fn(C<k1zSL^SaUl!)OH
zb%V$r-8W)hMEdEGOn%e|NX@Hrjyk=mebP4jn!;?rpc35BM^*6n#Vn;9kN5!E<Mj1i
z+2O&j-xVQ>n&Ic$gH*7ugfTIH^Qm5V6p^oolH>+;KMP<S2GyQ->AXm-i|}#0Jo$db
z3kH%n#H=X)J;^svn&ujcMe<uUW<}!<WrWbMiUGt^)P#5a3H)Eh6uG%--oDgd4mGsD
zEhzkJ3f*LHhBUlcf3}G`s%3f_b75B02{-Bb`Ie~j8o{PaUM;siO=(ksyJ}IU&iFJh
zHfHa2ItGVCz?kA&8K{h#l0ec$R1G&Dg=BF>cXyQx3ebI2S&{?Fwjs{Vmg)R%xQpid
zkh%b8Ezm;7g>eT!V~UAZ=8zfde?a0KDcbY$#z=^eMU{&?lpB$K0n14W^GUxo38)l(
zhgbefRYhLzLh!+HZeBY-$y{xg*R6z-&eYcz;|uFM3R^kQA|<tSArl_+SXH8{8<23h
z#{=Y>z>`aDZ+W%>@ry>lugeCP14ISD0mcUZ&XWVG0<C#|FvZCUG4&YpxZZhW_#Vix
zMi2+h^Aydhx`NajoWV+016ht8u^#C5|9H*_$Yo^PFeI60MnYO3aYc>Vx_sa6jqwEm
zWWeVjX=9I;4PUh-5KP6v;Yn&yvs~jbX4-fr0j`6$B7ntozIc&~cACE0eb=>Z1N(BM
zD;$1p|Gcy<@Z0KW;Nj2AFWSnUOpHTgzxO)8qpkww4sLL_OU>x8B?Rf0FPNk7qNMBl
zifdwTPJLxI(%1)v!lEOrLA@Ic3SUF)`(YS-pRFB&P7{MYk4A3KkT~ln^LWK>dKOXi
ztb!V%$7PX<xS-t1eH$W^L`t<bcFWt$0J}Q;WBvdDa=@cCKHA~sqCfdFcIhZkmiHQ>
z^B+dv8wAuUYO~QlX2K>VRUG9+2=qw!M?ds`^bLto7zVDz`gbjm_zB$c1n%D*Pd*z6
z1j;z_K&1ud?B55N;edc4o|OM4#}sIr_`?KTA3?U5Y$wWc{usxU9k1V`J&z*&f?0<i
zd%vfic=nb;uAEMEV$FQNVG31?VJRmx4>{dz!?9!2oC^eEn3K>W$Ko*pDg_v`G>bl_
zRp1(-$^_(dGHv<((#%rGR-IU@OC?fkkb<Mx?fV~pIddNrsi%!5#%ezL#-9a^t<RX-
zah#kV<3vMA&1((6B$B?pJJ+bvu*b&CCw8!TkX<CaCb-yijMTOHQ=DYo6}2j{R4!e3
zl8|z2xyU8sH@ohZP<k<6;wb8-9}S@s>q_!6q3Xcf!}<^R0frqIu1m8Ze<LR+XS3a0
zElvJoj<10W9YNJf<gYQzH-MlE1oD5u-8nqatmExzYXgbh_5ftkf3F^hyiJD*0`+Gb
zG0{O8pvB^_*`*&`99{-G;Lw8tF!t;`$M%oE0AQ{}O3%9tYqjM3u#b~7tiEwEL?pb>
z16{|R-QB)X8Y0{aB5pPt<No@7Q&i#zYkb2>%Ax-5l0+Q!z8^)YzJ7RYe~Z2;OO01R
zb2GGoK4**SGt`gfpHy8iBxS~B4E?CMD-X)#pVrFxxhoAj!mxvxhDy{fGt~5m^|y{r
zQe*}HhV{1dnEy32ofiuTxcSE@z$?z&#>Yr@8)3Y3?Ur|?;h8fC{24hWdsf>6MNC!$
zb%BagCkBBw7Qb{81BB=D7Y|FU8yYo#v`fc1yZa3<@)Jr9vB8ffC-|FEeK81$t^27)
z@F%uh+<_7EI!vAFW3q&W0met1&-6pAN<Vk9;Y&v%7f8RxC#WO#x>ix~b`hDn4Qi1!
z;k)iGQc^a&C1fJuoU~(#A$`L3q(>i_WvvF8#ce7))hvv|*A=r#sAjyq98&C`qMC__
z)atX_%j@r#D#4%c`+Sdj6vI3~pM|>jVFC}wYO=@Op9={9I;BcIsU|j!393gyH}Z)v
z=)z6E2F2MHmSQU$sv4?=wwr3rrTF+@Ffq#mUBIV+%=1}92mlCG^`^%%>q~XUCenE!
zWrf~Wh{Yu-$Cx#9<4-=zNdaHAkh6{x-4-V}_e_lGuThn(`0xEZ*}X9M!>^x?BbMt3
zm`O>0u~hZ1u|joiEkdTx+!zH8W3(-VF^?{Sg3<|ip$|dEjDK)>fXes83fp;@q;4xa
z4p6@DB+^CfjY%ru^Z6Awv@9Lt$Px7Ps5@>{4S(X@Thn7gV96pHrsvM)w3rvsc{8NS
z4wY<B3@N?L*=*hxf*lE?B03LMd$5l@$cFuGwBYB0YMb=LAXa;<1^Y5v_AR+1Sl%0o
zRlzAtSp}gbAvAV7&yik%s|oumg^jN?MA7+NOcv+NZ!dL?dGQXxM~VORB%2r@Ndr<1
zJm9$^%kt!)nkms-U+|U>4o<foTAN{P(5lGPkP36nTQ|3&uINlc8E92>N^Ak`&VT>n
z@Njy5ec;+{|L~NlLtlcc2G`&ni<%KW9Q@TkeG|lYx3j|&=n=5ENa%cS+W8=lhW(8K
z5Cqti8=b*G!aY!ib^5P-0S^A;10c5m#(n%xHP!!e`ZWqRrC2vOAOQl56$=0cyk0>>
zk^49DzdW@9nZ7<KucBmN0A*xE^8bv9c|CY_<;lC9kSYy|{;fGmH2C%F=fRyF#=(LD
zSqyfA2vu&<$jGlIva;XMEn?!aOk$$ZEMsCZ)VZ-aIhmwo@^mgqfBaya<dT-oHHnFM
z|C5NE{M+AmA)%#2#9r!3{vjc%51dHId6c_P!){&~KPzW(M4rwhea?E2n{r<6hD04Q
zPrF|H((cy0Pgi-?eQ#Hl&vQK1towj2!P!4=|NZs0aDU&6cZM%Vf3kKI1n-xu*bg?*
zJg<>N*2Ahk-(`ofH*MDOpV19=9d2-YsxjovogrepguQs5<LvzTQ(6`C3hsEjD2Yw5
zv?ynl)UX!fs!6BoeDGQ!#k{bfB&lL&ha{PWtw)_shp7ygMJoxPqDsDYYs*2g_KHDw
zSJw0+-oGz#oXwI7MSCt7M(~xYHRZHbvHv&^c6Xb_kdu#Xw%u~nx}yEoIhFp`PknfF
zlzN`_IW;{sbuc|Mv&=+ZJ}PWvWF$sTPA-O!&0vaylQWT%ib}li?#^=%Kykt_GcyC3
znVRy%#Kl?0L`9j##KipOpr)4SJ3Dh4tghx5oSIU_kd%-h3JwnDMSt_g6dfJ?_u13^
zWeiYkW>&D9>w6<G{09;_;vGFcu6T8{hzFEB5A4qrJ4V96!4c;Qx<#Guj3g63JU-g)
z?d}eFZuO&L#8Ze)cpfcqV#EUl`<sb0GDKJuA{Cq8CBuoZ$b~!+Zco?!5pIu{i#Gws
z8}CY;ReV@yXJ<^C$LXBYJQN%wA|gV3veJ_5JQPP3v)tr3l&m6B+F1+ViidOq3K4c1
zNS&kOANW}ry`j`x>PE%aD2O9yDp`&&*R+Jk*4?W8FCV41&P`;laS3}O82P*RA?YA*
zWnE3H8^Mac74AfU?IEPXCP(@+M%rAd?xIa7e#qFTA`ZbO#lczvGznK0d(OV3R5{%h
zE}Uq6dhAS7lW5dz{g}-KuG}dUOxA7Vb*@xr@iC%>hL|w>F~)I6PFhmbtW=!zd9G|H
zqQ8yk1KFumcg6RI3Cx<d|7>&ekb*-tTCn#GnYfD$TV|FU|LAGwqq1zP1J%CQ-&22?
zi2;cMi<M=Y%Z7PFGk?+B+toK8yzTGi!`t|t4khu#;;bgJe^r-{kfkl0Cx2k8X(Jn1
z4MadDx|ds>E>v*dm_pqld|O^s9dHsL?u(pUV4E@#QpVjrFPDZ^WK2hIhRA~Q6G9J;
z=ID%;n<r`3RE_#tZ*Z-JODV>GQeMD3=Z`U$_r{ukf2nSo)C#v3$HR|1l^k8{YNSE8
zcDp(O;+6ohFt>svKoULa=xRflMb6<B8k2^-QRRRh4RZ6x%B`szQ#k$wMMmZdCV++6
zyq*lDtF+wXhG`|~Dwzs{xpBR=X4a}U*12IA3`8d1O<(y5@?hg(`2<qLT@BQqot{nR
z84c=8h;|c%rF-1V_%z&nXn!0UBTAn(l5KqrLA@2)m!DJ&Su9aQS^q#m5=4`bOBSrN
z{*<yJ#=h~j9OowdW3TJz=>i!+^j`3dt`BX*$`jVsPpX^Y@yNa*qvyz-aZkmAOB!m8
z{A%aH)Axzkfz82<y6z#gS~3J?QA6bY;YYnyGxO9UH$<=x_QG>Y4`h#$y$PvaKwY{X
zbt<iiceYaX$%4a^-NBt0E!Y~AQO(Ko@u~#_0JRCYB&pbJUV>xqdI3F2m?kE@jb`s6
zj$=1^B!u}?5vnI^Y;axau;g$ez1-dAz2B%qa%_Lbe3CSi!zBnfwY2}Jp1=;9+<2L?
z+B77BiD0YI;vBw|qT-t7<9u=FKJpEAzS+}mztzSXH*7%sm576~a1y~9xN9u*3#5i4
zF+B@%zggN-Xaxe|J!Q}Hcu<lgHi<eB(T$aR?)Pry%-J4~+s#d^M|@=1No;V(TYf67
zsis1P^?RXota#Pc8~j%)Amm~KymS_CygK8c(}#}8(m&5<=X0=XxhM7q>6>u3ePhK5
zl2;^25MQ$!`Xdf_Z7L&EyHyUVecUNJNOUf=e|th#TJa@~Vmu+4Bw8oe4~tW;G@Y{q
zt2cSO+I^H_frLD`1i@h1?N!&ra==bKqt8XxcUk$^FunCWoF0YNt>;u@0lC&6vvN9i
zirC7~oVcNNqOkM@%IrlBgu1!ok1H*)cg{h=U!GWCPkuZ?3>brn33XUf)A+lm7-LFs
zcatg_axNKBb-Bsa=cICt(_ClUqW(1V>~N0$Jn*0$-VQ@pDjiti(I@z<84cyqt@p^@
z%8BaWElhYCLoTxTEMu0wpN@93jl7GB?HnG-Zyha>5EmP$4(&T?+)~J=lSTg!6%XTv
zkHfrig6N0jTS>}N<3?_-KVwonsx2H){QlD)q`-6+Inb952@MJBGaoi4UAGBG^q!!k
zePYS=J7*4&8Zv1yQ6Uv33|d5ZiN;{)t)91dlX@f&{pxh_&c29niv}xyNXHC^j3nyi
zsf|BK7T4}>J>E&=jOD4LqWZ##GVY5~pJLVX`x;k}H2YfMtCx<urgNKS&~0y~Fzmf6
zL^v#y)nX)FZ8ERM>R6Lyp&6Ju<XkJa!eGiz1{5<5=|>;%1WUUN4Ju$Z&Qy!jRfNZ!
zaYymN_T>kMACZ@qXSuRz4a0ipqv2a)9B!{o^`+4j?N<`0WA+cY8j{&Y4~^K%lGska
zp$-2W5wCqX9H^*(G%8IhS{bp^7Z)bmW(4%3jmRn&7;(}kn6o7McBGfxdvT(^BiwQh
zY)8JmrhXpf)PKG<)r6owK5((|Wg5tA9u8!EKe5FN5=I*`eTE_2Ii%C{(oAe-5Oy-i
zxxoL$c*J0s2sfS!crlqTH9pc|02jAg^|)tINCaVRcJ<j~6ZsGT&K2es=zKCX-*#4R
zUQlb=?ZW)koFZuuzac0{gF&UocUr7s={VeVh;Os)m#g!rqo^Oq7;eUJeY-j@F99NK
z-h7%2{lJxA_)pSc_KJC#C=%v#B*5mJo4O3qQ9p#MAT3hK9xk0##jjNnhH`@89dIS4
z>1cs1xd-e1=tx}82c(zq>fh!CR<x8KKA-|d{^s?I0A&uX0SFX1JRUJm3%=qlwXTs>
zi56Fv7oxxMK_-Fk!-m)pPDqDPa+(TzJ<Y$)DE-yk{rB&i0mP*AoEx4&6+EE?F<j{7
zvekxYFhR|;=Y^+)1d8czIUOG#j>k++Ha681r^KD;iPaRMYNYsfE@E%OIH|7ElZY6~
zNJ6>pA3r7%vNl&0Te)gHI&nImZoAG;fr4W6-PIjpi_gNvtk-m4$RW>#)e+Y5`+fQL
zgpe1XOVR#9S~uZ+YDmU3i9>kM$aPH6Zaa?C3P=oUvYQN@>Lb7N8&<c=a13f8N5)~H
z1!vmk=Rm9(3IT#_IBaMqK`ULnuSn0SL{1)gwG~=ZAzzI7=<P`*aH|^S=52I0o==Si
z+C)1i?%YqCMvAxTz?B*ty+;)3>b!CQ`Bz+5t_zrjw&BrX5AZG*Y?OWeoQ5yXI2Fh~
z@Bq*x{`$TWZi2?$7>Ot)KR5Z@Y1gZ~J<s%)3%2%&P~*s7R_WWWxaZ#w&j!1c5)!>|
zRi2L(LL9O}9gCVbD$?GqJw16Sa*##WJikO&Sx@6P;|2RYQ^1th{1cA7XhV*}doI_h
zsW@MA`}>mR7Ef#!TFFWfd0?UzuPo7m{mO?7U+m&V0>72a>_~fhBtezTx}+(ROVfp|
z=nZ`jP_vaL`W=eZ_5{4R=rLdfc-jv%4DS5*2L7RuEoAD-ZM_@kyBs5)DCoIg@Fa&w
zw!d7oAmDKupZ{@PAov>B^WsUqT~WMQN3LRW9LX4Rq!*Lc`G8<4?Y|X!I-V$<v^A9L
zLtJBBdX{~K?B%mckq>(!KE>1z=(fK!Is45_<S0mt<nK)eLLCCys<fpGB^u;2h{%{5
z2-zWb1n1_Da|}%5cKP4GDY82Ye{5zy-$v26dOEXET;GW=NnReg_IWEQ9X~jO6mMc=
z{Pv;!k;jje3+aXG+z%Elp!;D{hlu@rprtR@6ZV|PVUa{-2wQqfC4Or*jUNX_Q#v0P
z?F>#d5p_9+g(j4I*7d*TN<C&k><^Wa3MtPe!6#8k+K>tfFU5s6_j^hW^iwfqlZJmx
z=%pez`A&5Z!c0^{ixVf>75{mI;dSm}unhSZ0<)OGt*V{YRtk~6q{?p_s!|`rwkzoO
z1;<1*7+X?#76nO&f-ZL_>TJCaG+#|1hf<zB>7_ytk3Jy;pT=Oj+`J~|^~9H%%%R_n
z-)0T&GCLj7cz?1xxrO629Zv^%9CHFG<c9aUybW?7IcE$b2Hn;^_ZKq@5Ic%oUQdk2
zI5N7CIjXzl+xN~#5ebl0ndZd;TkwQz`v*&uM)BF128`$$)XQ|jC!t+J7NH9=Sc^L~
zpP68;&mS5^Js4c>!yW4r=d;n>*bs&3MbXPfqLpFzec`*k^P~K`k(*Cfo|~MCt#%(p
zenQgUcLc)%i<}0`g<j@|&N^28&wDlEd)iI8{9YbTIa)bhsdV1Zr}mP%N^}j_hP_Bs
zwVZCz42kR{6Ky)G5N*(0s+=8siZ}6$`wlGDnrWJC<#gP&S^T`OjUp5kB=oO<T&`_A
z(uKpIJn2daOKJ4f%$r`qb#zG|8zFTK__G1_{Dc&OXf4{7_e5l|Q@#^-8-0!&B2}WP
zWawhkp_J%PI#}=T?x^-F&|o+FuL|fxx1Z+ph<GQnt{o6hKSfaebwIf_iuVwGV2C3(
zi1v^B6cBRO=efW9Jt7*b_f4Hq_5BV=D*ULg*zp;`aE<x=+(Y|)yVo1~_jXd|{nmDR
zrg8l152TNicZnpMtB3nbJU61cZb=ghRU&DLh&s`EXS+Q7p5sTse%v031-68S&z4lR
z!`s#{=Be!=i{^AfB?r3~F-vzo*wdYJc9fEt-26=fkI(&+(Pr!AD+AV-?y5L%XUH|J
z&x$_*=IOFHZdrWd*Nh_h*6A6J!?gIb=tUPheY?OR5sLWk<IA(3Q(Cey@k4bg?Ger2
zDmgs&y^mIRqbFf7TIG-dQ&<4GZuJM0MA}kaK^U{*;@g1uyf3)Xe2>P%qLC(Eq#AVK
zQw(u)$lI7sU$PGf)aNtn<l)z4O6k9ExsxD2=V-wU9)g=0SdYe8yYNDn%0@|yC0>w|
zssd(o&hyBHJsup#ThGuHbHncQ1X;z$6S{>{OexJNzV@p*seY+2<KrI!dzX3So;!7L
z5s`7-R!Axvs-Jm+R4Ti2pOUkF$4xQ%Tu$Jf36sPOzoJNjJjZ-HL&;t_4fOB0N6Mw0
ztb?q^A73J$8Q#JNA*gJDl7#M)3u5Vw;b=knd|TW^Z0pf8Ruh{vKd?^jRjxC_@!AZG
z&#oD>vEGZXUE;Jqih#v8z&D28DoDo5`h+ngHy^xVx!W+JOINIMy(Z*vkILRUBg`T9
zHgQkyD=t#ulW-LyFZpB$*?YgQv|%f|T-|Aw<xZ-yttV(JcGC@H%6sPvW*owfm{~Nw
z>0#|06e=B;Ah~+d>Od!_D#Ej-wA^spa$%O#XM`#k48txcGAy#FW5DcexIE9KbU5j)
zZM^X)B8|`GdY7qgJunc;051QUJna2~Xek$VH!ljqqM4?zEwGh{73h3As!FHI3@Pn=
zk;2+`<glK!^0dEF(UnMsGUS;C?<x^=M0PsUgcK-rll44{7BO?egFrR1#@j6+oZ#Mc
zsCW2H67(z~ndtg>nWcwF#1@g7nnrf|`c3LFmbBD@L;KT>lvK`IxRq?Ei2H=PkmH$3
z$bi(A(as=*o)4F5huFS8uiH@6J~aNI_3nP7MTR2qdkZf*`3qvt_a0qS-fZFBfm4~S
z1wF5viEf*P_??yLvlWl*YZtPmzj4KKS}zY(+s;X(>?G%ie;u#Qj94EimLsbSzn}|?
z90zYRs8DV6`?bSvWsHy7@#C#;AvtdXHmfK$2AaIhc7_~{@xQ#(h+YRA5Bk1u^&rcA
zHhur3LfVs_o3{~q>pv*NUgp)B%k4=92)^J+dcyVx9R#17Hcm{^w_dF$ge#?-;M`K*
z^Wm9Evldf0xxpjjnmzCpM(!IG6UDRuWE8+^0u}>F(B;>_F-Os%NdU)x?5PzY2d4d`
zu|Mg+l6qy&jX@*lPhSE=Pfw}8<<jJs9^CZ;`|znrMTdG8U!+2g5bUi6*sSdZwu{q%
zMKOy(MGO9CSp0R?kRuFd)`50g&HLG{o_OmtAM?39#tGjYH?7xLEIZiIJTAK@TsCDC
zD<e}0U*fh|*QY_$7~j508t<=}%s+JO!u#z8zFTSaC6psBKJ=*oA2btq1brH5h>DY&
zHrV#gfiyHWZUKR{0p_Z9mocAv3lSsBT|@t8j79*!Yg&PQRjqUQe1Nd6pU}_~PBIML
ziW5HxdJ@|69A?U(y{A|r*oVxy@8!Rv&<xT0XGg|-l5c%KWiA2z+<MBG!drXJ{;A2{
zjKAUOX^i$>?ZD@xvX*)3`k_rJ3QOef)uhNH%kunn_DTN@?vi(4)F^S%=iO@aw(<fw
za{~$DFm$pB$o&Yz3oYvS*xA`i$>lv3pR206KD4t8z7_2a)L?Krbd1Aow4!Zzk!)HY
zD;$eFHe=>507@!7v5yNjSV>IL=#E18w_d|>P?&ZT4fb1Y05JX0N#7@s>FDTeU(Xv^
z83hZCf7>2sv>Z=|)6mdpWZ$@vq)zN!TO<F6b5&7MF*P;SJuy=iY2EwLTWsCuQfV%l
zUQEnG$~Tw@gIcc1(n5>Z+RUHE{=h;?W=Nbi>A+{LQk6EftSaIa+{5`41NiOVzkf^0
z%G4<u1^|>wBmjFu#Or-E0DNK4=C0)X8l9L&wt0UY;cHsjHUPt;4){(eH?*hftW*Ff
z6As5ub(R?a99Z!v*iN^Uv|yX|>$y({!uX%D7Wz;GOL8#-iat9ySPJ{g7vj#%%^hV2
zEXSMlh4u9Gi2D}wHal;t0)QwYfYYP9GU$fMmO(!yCB^foW@sV44{(c;0E=VtwJ*D5
z0Mg*qVNOvIG<K*p@7KaYM2*={S$wyjiMEDD-%U6c1sl3$XY9AGyTjGCriT*Ny;mOp
zoTGkI-*KND+4kmdN%yMU5K)?Eu#=#eVnYi)u>0ME{BSfQpYu>Jm4BX8a`dTpUhnPJ
z+V8(pbTMz7NB|6j(v0Q_To@{^9}wX1>X_WyOR;Mf`1=lGvaPKsf`NN|@Pb%b0a-%;
z{%Is48bL|?e|N+7VN&h4qE0P#u>w(Q87#KXr+`}${<RRxw+_RVdRE}UPyr7OYXGb_
zhOOc98}L(t@$sTCB0_dU&HvEX@1wFZ=Hq6<D>x5$V6KUED+ST(LAKNZ53$EogZ6$E
z01G+=Zv+%-3NP5uwUW0j`)tSZzjk+>Zj|&tUI#&#_RGr4&1}E_8c4d2rd^->ZMf3H
zyh9K)Cj*231*U8IR?l`pm@)U!VbdDCLy!-AO+5>y@)x%Sj#@fF2l^<PH2&hBfuqQ|
zkFeffOFQhetK|Ep(@T@P1i8TFLBD~!1T+A5X#noxY&&|q+_Viu$<>?e;NSz=+l7kq
zA8{blmf!*-yaSpXe^tVLpO9ABVvK1S!9O8v(_gwEiOOU7@en37@K^alFS%XvnU6KP
z70J|zvh4fwWv#kKMpbD%{8Ix<OZqtl8rb_ZIe6-X`~80&WOwyu2BM<g<P_j3AJXLT
z=n#&Lj$YN)*K108t)pUMsxfPb3Z_5=1O>Uyg=ME^Rqub#>Ixj#RQuTQ>x;PY8UP>T
zxK?7$yjEf^8E|Zd3K%0ZA1eJ*O{ed#hR*iilJdaI((**t-?LM|&<$Yd8L1nu7ck5R
z7$%z6su+;ZhPR=S26Fmsf#h=$8|X4Oo)Hld#lV?R@~Q9mpKml0z#B3F{IyN}Kz+fA
zSmt|mhvh~kh9-yA(PoRWR1(=@lntQ$z-m|)pZ&BGfSbeb)E9<93^nS4Ax(FsO^=No
zB6)dv*)+Q!FOlqRZuab*oJ`1CDN}HnM?Bc9=}i?Jj%RQm<UgXdwr8oQIlBJ-v-q|3
zDN{X71=yVdb~Dt|_<`NAudPBE`D`jhzyAz;ZS_gdXTt(^yGY%>uotqe7yka!Lh5$U
zTF6%Qr)13Po!b|dLN-TW_Y<(oB-2?n9psmG3RhrZKubI&+EttY+5Zk5997c^{-e?M
z>!P%L6ZpUZl!^c-l>ks`+~>e%3ZRw^Kq)?e!2B{`jBFKfY<500Y@!&7GzkpdEh+y6
z5O@<9c6a~V0-n?@<5gbkI6zeHjbumkuXUC`r990^)n`t}x7vBEzw39AP0f<KHE@IN
zWp$RP3crB$=L$8z4>N_#V6R_=2;lQSLqF%|38}s(?$q&>RSo6@0*iwZ29f)vY5MiN
z`yJbOl}-lR<SHeRd&3H)PQuHPd9FMkux;{bhtGvul~U*K#fT%J&qarJ){}c5!@60+
zh@%d0n4;pBHABCyalg|fXMf?V1<ca`XxM1+|AqoP#8vA0Q8VW{5WdfHO7F_P43RGL
z?35|!)><-{M-94@@D)PCegdNbPD9w$(4hec@f{#U4?u{2Ty_P}?hc@xp9nw@88Cf!
zF+h-#G4#6~5`@A8NW*M98|&e8Dcke@bP8L?-gF@J?qa*q`_>^_kZf4-Ng0qM4!`m8
zeC(~0PbYmY8s=AY1N+;VLMYyZB(>9fR#EKi6p?OHgj5iTRxEqrzPUIJ@l@`c{0sd|
zS>;$UF~GIkz=)@@D(`%<Cue8Wg`}*3WRksV8IkfcLZ}9RBKHHO4Q;3L6>}APP}Zf3
zrYtd4;z;5~7eX$HiufQoVbAGjT&{>*;({c;hq<{HzWdgB`gK=;c4z?E%a#1vHj__l
zmUfz$Mef%|8M=M~Pg&}7v0T7+-^oM^CKJ<<{G*{`_NS!0=c07=Gr&(yz$ZZ9f`lti
z=_hNttq2|>10hwr1UwI|NpGfVy+jBWh8JZQ5FUsP{}v^5n!bA4tjjK;Veyu}>V05Y
zJEd*~DlG;dGP|D$D72-Z=JxR|FD|H^Ay!J+g6v1*#K3-ZLrEJ1^Es9L<6O<hg=DSh
zRaZrvOrtPgWlLEo6>4Syxuh3+FU;DK5tsLkTpGcD`C3rr2q`3{-STtqc5D^0eEk0=
z&wy=R5v1evL;5uQ!@mj{t^J0dx%H#UU5(1<@RJVJMEz*}cChWEgu3UO%gMLjIc+Hn
zJ)g;Z?l!~k_MSadSyI054y`9lLd7;gI;72v(r$B{PnXe=?@91uCS$e5)RH3|r5!^7
zJOJ(%wwu1rp2wYQ3ZFAL5mFICm!xL7=zPv!tZ&z0R!p>8jfUg%|L@*}Bef4-6BDP;
zhWXA(X6)|==~PHYB`UDCBV3Q6&C`oazjnp(t3-uU_EnWAE9k$r9L6iRw9IXS(Cqvm
zee%d=e_JbEL3}5WITfVhpRQQ-R$f9j)QyE?<iqZ!B4^8&ktpNlEf#bcWz(u~MhZ3t
zSIXol&h}k9((25R=mvGF{plZo+$|Y<eFw;0Kx)9{`Ivoc&nU135KM<BCM=1MQ9M5E
zZw0T1-P!LHB}0*Lz9{+xle_IJriDSQC3VK#2GoH$jI>^NzjOF8%clx>SIK<$FhC}V
z0x}`j;JcJUa*&@c&nUiZydvc;{;;xQKtbYX4TI47F)gV)uGeHYGL@Q`diI={0H~LX
zdi$ukdjH44>Y>9iw(rf_5=lTwIjL~WLUduo*tpe0O7xiX(T4cfXbbFQDOUa)p}4#l
zWBuYx2M78Wg8OmPT;$8r<1W(wM-!#ddRTCHRTq-zU-#?d2~t7yijo}RJwFrp_iQsD
zT{ZyevI9sL2%yJ20qHCRsJ>i4_2uP52PcdF3%ceAgEdc)F-eUti8}yLj3cX?c%cgv
zTZSft)+L&*obN5<NL4UV?_D^G0p~_%(_(=WpkQ-A`KbS$@<ri$=an{$^fmDxDA=+P
z><IeTKLD`!(~eu}?*L|e$?b>L{ellEyICG5(!|O%2z-M9w|{P}#*UAV_iub}GIAC(
zCM%Y;`@av29WNTN<$9jndS;R-w02@<NxSb1U5ht4my{xVbw0x{HQodDfJA&bR-vIk
zblY#rDYg=gV2CD*7A57Q-FU2i(G<R?ob}IJ>`xt&K65ziO&4M*HSo6H?J+HBb(z^#
zWv;Sr4kdoBvyP=1&`;qNi(D7?rt$Cnk80*^0_BSlnR4hg9~4XK^}bD8NED91r_kdu
zvC?Y_vZz{fe4jQ7>^OO|)1HvnFh?%nXl@?cATz-X()(nwlU*k>rwI~ZI8Joa;s!UN
zX#E&1Nz(czuM2uCNKvDM#xMmUmeHoF(bbBjjB}NR5R@e8f0MTZX}O?jqO#@7y96@*
zvd~0jSEXwgOS$4I>nAKpGLoi)hfhHnF6kHhhKm5wBZ~Nx!6x|faY|M7x79CE*f|#L
z%1BXhT&YS!m7#~i|Eb1)e{F3aJ_DNPJKR+0Mv%(D%e#2Dc=`y(YneWcxqUDCNhbb1
z&jsuIykUtd52Nl8O<`5sKmyT|fYPd$w;xQ=OPGF28=GPtl+~Tx<sX~yfYfx}PBc1;
z#TF9F(AN*t14aCsPvukZCb(w>3IzEzyIKyKek;ybN@i2s4DUt@Z#~t>%vpn&M9k@A
zXlR8ZC)eW)`S-Z8=Ihp5M;n#rcBU(&3J4DteRv`F)@PUsQnRe}dOGQA3j?ZRuco7~
zn!b-o7lgddSFOrm6WBdU<kga%kn=VN&nnKdN~Dx<m6_w0;A#(wSX=CbX!RtgDrvA+
z_QrR;FtS^`{P89H-Q8*wJ<y0%2YC7y4eTv7dVA+*^U<q>9|dg|1?3%<@>()ubnt!t
z`o}@rwii3E?q*y?1LhNDHFaus8d2d?92&{!M1N+LjiZ41lPJPd($xBu8EL#@8;i>b
z6IZkYtLc5d^lP^tHsjGtA{rI>M(z~Z6NmJq9^u=;9BA9bQqJJDdeJoH*z@Im0-5eD
zG^r_7BLiaO(O)xhCM1RiCMfBsn^Na`9lR5fHn*`UWBt%6^y9~mv*%O)yjzUoDDO`l
zvaGsC>>-M03*P;qlXf)@8e@vODTSCFYcK)$=(0OLdUwO=7TII!Lt9(B-P*+Cb-Olf
ztuyI~27Caeppfu<XDE5mtK&jQBS*5#Rq{Hk+)v>rWL41oXKLakp|^QuDh@Gg@DJO&
z&FB-z#ka7ICRv%)ik<BYf^{?fI~oI_F48KD^@+LJABR<bF>c#S8#Q?y-3=Fnti_vK
zy_i0*V#!96k#3JO#w`D%48jD{k{;fwIHzT=s16v)(;F58QH3q#P2_m4RsXAZb{ONq
zw?Vmk^;B;OG`E0~J<{_bhWv&{0nKFPOV=h`5Fx>aRaNYeb-eQDW4G*_QzXd!^5v7O
z|Ks2*Lu}Cb^yIJn+g%@Ue8apNwrkKN9yBXh&+zRALwsX5+N98g$m0+SbD3CoBkI$&
z&e~BVfj<o1Z2<0We>;B5o8{JuB0dPF0MVU51L@fwCtgZR&*^&av?nDt0Bj}TZLXA(
z=sHcVr^7qr7OhHG7Q>{6SQe5}qhbKM-})Ammc(RwcDGKpD9$DMkv_)6<k9ykaVSA~
z$j}ub{^iJwFFBSWZ$GHrHu}6tS>gWn;q=xof+ziahQQxSLCdpcAb+?FskW-3pS^8D
zVt7=UC6Ro<+y4uWgUq&Z8MJ4d9fnnj92@-Uh0pVsGmZ_j>(mw@MfEM=_Q<ZNOmE{a
z4Ah4w83a{Fw*JgmhJ?ReB<r^4-oJlyA<S=qcIq@}uNJ%vl$e49Ofg`qyNv2LF$2-y
zv>M;p{Mm99s_JUe7vmuOe1w=*mioK<4@b|4o)<0g#-;5o^@UuY;I)2?mEanFllKf{
z+PBb*1msRvjQs1@OgIT@k%3}#NL;lX*!q$WS*MgGCzuiNL9?E`!W3G&83&~5IV5H4
z2G^f#iVo+fY#U>IIu~drD7<$r<z8tA_+B8hQ>L`1?jymj24%(#Q#K-H1gouCfgt$8
z%3&AL?^|#M`fQK4yUdgAmRh4Ts$b7I+Blse|GM#*SN+|u=p+9PTyFI|FN08iZZKYa
zam_aGrjbfh_xA<$3gR<<md@Phr69_RHNuHE{o@?Z_lS^(E0wd6QmLi$$j|%(;l~5S
zyq0*&MMPcqo7;D*$tsjZ^>6SOVV}>#<DRbZS>|V$Z8)|DcAekF<I~r&ZTz|!<0yVc
zOLyZU*YlRytPDif>wLQrIrK9AbEPNH(b!uNH4JvDcZ9+&o%@1Rf9LI;?e;<x>^}IN
zUKA(U-N01fdj{M8hJ$*&da5_VUfhMAw<&5vp2=YsK+|rcmq(SCuVkJWT@hcUPc5oC
zVlD(NOW4?ZG`j8({LW<2p8m|J*(o5vt~}A6O0O+Ra|B<-*W!-f`kyHnD9`p;trhRp
zGUtLJWlq-aRzi>Z?0a}|n=PlD8rOSR&a_N<DKI6*H^tAQ7{Uq<2@R6J?9VM4*Sws$
z@R2t48YlCFZbgM&#wXR(v|@vEpU;FXN6CGk;v-mi#PU2tvg&_+e|L9EQAyXe-asC2
zQx_<zrl;;`DfcNbNcADRSoO#J3B(t~#EA{)BxwR932t!aev%|NSZR_0bohmC^3y`Q
zTa=I})V_l+yv7xZq*LUFnbudaVCw<P7!dlzJ~6=5xWeHWJfU#deob15qBnLc`siZW
zckeYLFh23=o|NDcg1HV+UjDo9Lx8bQl4?H_=9*K4k7QuLNxW_~|CQiqX+vli9evz<
zAHu&IRMEoaVmLgk4>Szs=c*lCqS;M}si@>~nOLN;EsM!cz8P*U1N3|dlbVI*2$L#Z
zMND?}O+<k`rgM+#uY~>zNOETCL^+1_Vgb9ja^OkPPJ@iHCO-9d0ciwWJPoyxH3o+I
zsIUSDq{MNis|T0<0Xp%?Mm$13&^@(P{Qr%{&Qj7LGo)xICt2|phx9DMu>Akd^j^-?
z2>%M=CKq-(=@m$~4HSRz#w)~^)|}lxt8$pRbI-8a-IkRXf$g|Nu-g`u@8ACr#M11l
zdTO)&ALg8GLyV8e$nb8eaIMJL@NRBQ#R#B+ixh*|m=hXwrA5*#b}p9yrUo`^<a(|a
z{~yg3dXLtFSd=mTzDdyt_Q4#zxOmaSsD_yb6OC+8XV&}=$u#A?%?(UnEqZD6J-DG<
z1ROPEBo@ItOYP0^6h@fgo1YL~VI$4mz=PWq|0Zwi*3WjTtmLqSD(9PF0eTvv<)cJb
zRq0NLkzoPrc%P1>MAtd;dqFxHqkQun(k7XSFQEHO^Y{u>9+8Wi9PiV(eVf%*-qYf6
z>0f@j3tj#%X%g{0{#tvEv!p<Q$o=TiTF0ZpVuS6xPFNVJH74#$)hN&(GRtDQ(cTC&
z``(wUjPua}nG<T{S~B?12JTM}U^*H?X~)|+f339;&v^%+-ETY%*y>;Z$Pwdb=w=G^
zT~JJOFIH%qq02%A-M2T%>;wt}Y#TwUMztFoGfai=VmJ~(S|<bOBq>aQhYN&VOtjnn
zC#9qh(%Kp=!PWgHZwk_)M$;T&$(R2e$W)40)(@DKO=2k<TxGO`CAeVe|C14NSF{XK
zgQKFN>S=^{NTg)_{FBX;rYT_Rf5Pu!SU#aM`=vy%OLI5&z^D2p$9i=*k!F*Es3-%<
zj(QK6zSm3S_w9*^lT;wRyyL`4PLSR|PMajxi?=XmZIltQ0*-W~=ZpZ2@JV_O3~Y>~
z=RSc1_>U6Zw52D=yv=<9wW}aKr}<9-t67(c&1nG!3bke=Q@*@*Ad`v3QL?slN;6m4
zYrsg>l};Ik*Wv<{6<{vg1TxhC^O#kYt~rKj1hGsiP3@n#4A@-Lzy(I%<o!S?C@6r<
zm5+-M2!PU<n^1OI&(H<6a-O51{23JAo`{H$7gIENL+Au>6a~{UedYn*HLDf4YT8bs
zaK2xO7~I!rHlyDtnqoL#GYR9W)V8h*Aa~eWy<I`HCwNfkSX_sa>k!Xo+8O8NPa8`V
zc1Y!~rAq1;hP}yg%jsB4-Cuy&4@obt0@$l{&%ZPa>q6wsP*WP;XfDZ@@MuvU9w6Aa
zYO^))4X12hMSbB|{OicCeRF7<WlLNph5tKaYtxN$lFgb#jjjS+MVoI`WPWMtz1_Nv
z=F%KLy(5`B8#q?Kt)NlG6eRG)75=8DYxsfI?Dq(72}hA}xd*j^ew#TI+S99?*E=(Y
zHq%~Y^3?y)&PYiqUDi~i0q!K(y=J?-J4vb7(;w`@_2~+<;3X0z%1guG;kxp5Axxfy
zlt1NmRjYJzXa(_-)2$4-NHG`7_s_9thc2!^Ci1rK)*@YNr$l(}sfU<FN+5&x@LI-u
zkPa<scUl&ds{<~slI$CQs!8>wClN&HW48!k|BkTd<H7~Xzc$x21uWsf7#8&Y4lc01
z5YeypeXiawPuj~*l{9z5Op52(L0>-kBsxJv1}F6c^pH)RKJT+AW(kl*HzA)Lx8K_J
z#OQHzI`qP)FJ55Y!tH&qK|Dx*m&xxd*lzi=cQJ&zv(op7;@CK+lzFJaIyYU!o@+v8
zw+{b$q05s=XmQsO0GoHi-%sZbJ+?iNBE|Y?R<+yx{8=9FnV!4RWPwn(-V<(RWsoNS
zM;I8PtlFiAR54EwKN`!x>a;R&W;xGn(?_KlVjtO(rLy(#6xeKH{<pmLmBwJR$&Y1o
zTAf$qt8L#}33RvDNL&dfdO{K%BACiT7EODD1Y9@&@FE%>vVSk?L<$yc92&&G<g^)n
z{Z?z<WQ|A$J+mg$+VT45!#Lz=bmC(=&llXk_MK7f-N!`lO_0K_PeQs)y%t77#E)01
z-79D;C-Y*@X;!cki)EfNX7B1dxVNGd7ut;pgoK4Q8y>J{?7c57q`GrIe%^nN3mTNK
z_{0<Y9G6^U{Hz93ovroDQ3Y$n;rNDcKa^sm3-ur*3#WFgngEp~G@Smk`iexNxC}wl
z-<f~*e=W^T=P)6i_*iUmhV5=|YFWm3E!6lC-)y^gfYEe`g=gM7h50FJFOY+KqB0{6
z-K&x^(s%H+VlEG+mBfsiwtk3~#*kUkkmoqqBg(oN)2tPJ(<__I8+BV+rN8-HBQe2f
z6!IQxMz~|6r!lATM2OpE|MScs>SeJ~&qmFqs;+v$Zykxk$`E-C#9F9dUr{;sv)7f_
zSiFez>6-9nmWS;Jo))D~BC9<8aC6W%W1N0J@pa$8*PI#98*#VB&eFOaZj2P;fmiL8
z;p+?x#Ei^36+{o;xKgdS4<T3&aUS+!916DS?j8&mA0lIIfZ0^LG&**(UtdK!eX>7Z
za2{@sUEuTwl^w7!Dhb8YSxu`Nr9=qmTsm^;zaDt<%TXIGYQP^!hftzg7Zc<+CuI=z
zVO-^njsGZoZ6B`pI8MCY!-UPia2uA}A#7KU+>2JOmO&D7t>e&LS%;AP=D}fA&0yd!
z6E3IyC&~*SewvgNuPcj|&-~`d%RgRMKCtd|P@QJ-y%i`D>?h9-a{>#GO7c;E>+k=W
z#%9NjNq5jJZp#BEU~&B%e%7qp&qaT8f<S|pWsw{G-Ha}agbKOluR0T?l!0?ojOEm|
zyyMVa+jJ&>ETPbD@%65uq-q~bMCNa-Icjb|qAgqBk1+|``GIN<gxwD3H|mPK3nwBt
zUa7|SzZj~YOmU;|CQYU-jnd0wiKZ7bawG{L*8D*!xNdvD-C3B$d5Kxg3UP83tD|%;
z267DHPqXEB?kl9k)Hqw~iP6op=+u21H>BW~ML+rTl%jKn?{3(*;Ka})d>F(jF`nr;
z?HKZwJ)JEl6l{XMPE)_&bh$>%)oi1``lwtAw_J4dQ7VqSP~baJ%@fm=z?!ZPC!!#|
zNU$JQz=UcTPG3>?H})a*d2+_8hHte&&z%Zv-=$0%Uo+*?nK{;*A0c*=rx2k4qK5_z
z0kG3qckZ}mcum$smY-OEtOY0sYoF<vsgZ9fvvg-@(kSw?8Hf6Fva1p+xGt8@?s0hv
zth3p*F~DE^WQ<%1enzG5w<8IS$@KE$e<zyUXiwY=$;sM`a&fU^F=&kyi{&Kf(?LwU
zl@NDln_wji?ssv&HujoxVBB|hs4KGF{wxFAaq#t}YmHk#1D{zQy_wuzI+`vLZFB$K
zSE}W>1aD<|W1@r8ZFR0{t~0l_)LMfwQuQ}S%W5ap%yNBg1yV^ON;ClRNp-mbH6Zc6
z3$OXjkd;CBO(h)K9$)qS*vpl50&Ow4Qv80nvl=_ig|^Njzl@p?90rxfnCb3~dAk#G
zGFa=1+P;0jnv3V;j3K;X+EZ3D!B|oMZBR2rB!9l!Zd817WXO1;IpB*Gt}azGE}ZQU
z6_<*YRV&kil~muC9QHT8`(6pXu?zcj`8XP%O^eF8N2e$HT-UWAM70<ebOVgcqvG0$
zn1pGuVIDR(imfDj!d`SS;}IapAKAF~;i=<_$^xm~XsxYDELWs0Ip7%wwmq*Z_klm?
z<)~wk3&Hz#kM=aA36tYGAm;j8JAT}KxDVBHw@5Q<xTIGu5<k}Zm2?DVtmX~b7#XRa
z$0h9~h#l@6x<||3jT@xoYh*ca9B}<A+vWLM{hX&SLIAfvpj5B*ZCYERuoPZT=d|qu
zIJvVr6G~!5u&Ee@Nv9UR7%GsFGxUdu`wJm+%iGP4_{ySk+sAi4tu{SA4yitTKL>_k
zG$zJqfo+zQj9qUs=J`y#iRwhHhd2(CmLQdGHJQ*IggR$7rTCQq`vp(o=*m(l|9Jts
zQQT=avcFhlC<vbfn|xkd9%CX8L%?cTP&#FbP5CnNns9>d;%cOx!$Hc5sTh`ZGN4C`
zbk_cl39-ZK?npWtdkke|myrKP+gSz00d8A5KyVKM8V^B(yF&;b+}+(>f+fMNf#B}$
z?(Xi^xJ%>OIGH~8%$+&s)}5+(n0f8DuI~D4@4ddYR%c_BXK7sWFE)(Fp0?`iYjhyk
zlvB?o*sVL|;X{9>X7J582Nmgc{{RD=a{y##x6w77$`V|kyeY`v*H5XX5mE0lhNY>B
z?(&38tWdF4NPlu_D|S-)&~DqB2(d;a!3hecY@9drSNU}WvOzpR>-F!8;hMt@p{v6_
z3$e9OF$d}<RewlLNytW^P%(%kc;(MgCJVt{b6xNLC3J>J!k)hS+}hpWn6{k9A6{DO
z<k|!EHentXj+vBwz1XzzVWyTCcSScXl$nZU`Ff2tSZ+%7#XO!%ffy;PoJ|(I2p@Es
ze1|{*VFXOZrf=wkGyQ%1SVD!X$=*Z2d)g2?yw3B{Aau4~Cb{|r?Y2efh~J2Uz6U&W
zadW;FIFnIX4R_-x#0y6fTp?Ug`Oa6TD>B|#u+bCp%`^(b?C}b4<O#rS6}WZOLNRed
z(e7A^Osm`$6$Cx8y+6$eGuh_;<LHTlml>s!%IG(0IZ`~HC`<**_OHvW_VCpw4Q6GI
zd1X-I2(c1p7V+Y-c<M$uxSk+|DeYI?qO#NypBFxX1d2Y9lIW73mwt!T0#LOZmyGJb
zD$Q+IPf_Az8D-YQ-$8v!mP|)-Mb<m_3wo$t-(8AMm&93Pj}5u(>FcSlxsX>VL8A2u
zNu~dv*Jdn@VFLp&7t+A#^ob_9(maP^(F(PCbAgh?uxYBTN6X#{lK-L-zF07dAescu
z-%5mlhSr!?j9kKCl*UYi-$fVSpKB`10y9&}uboMjJWHLnC{kGhq;7sbYkU&d2wMoC
zsku+Qijg&)Q>(NXTyxjUeGMgq@7Q=p@%*B!b0%Vy61AB_&)C3pvTUP1VRmy0DtRW)
zspE48a>!~B@OSq1es0`ktE{0auuT(b==?xuN2Qud_s8wduT;O?)s!fa*#I+dVacZe
zNvH#!UcJ1!hByRn&bF#Jk6bCu&zWPZpNT=IGo2(YK`tqF%VmeQ>zO(!@f16(%%7$b
zjom~ennV<retm{5V|s!-c8OF^pKWxM{g1w-Wo$L9lQDNlvA!y~1~W=2UAW_x51{MS
zHmjR0m$E=)ZNHX=8S)vT7iRQbnyQxVblp2O!cTXAR)fB@x=J}dCT@c?=5~S{EfHne
zu%wz>o9*B3U8&$%5sV7**Q677oQXt5Fh|a;l}Nz^YyuMwog7|qeTt$LYtF2ZpL7JW
zmdBZr6?4w4o=8CpY{JF|x(eK4*F;4thMZY-KWQE0ghCYP(VB2}^Z(OY!!cJ7M10@t
zN@cLoTeg1gu6ajzxolEV`@;8RSG90gZ8+jZI9r4_R;2j6)|yt|I;e_N#kuqVXlg23
zKu^`R^ShW_pk>vvFPVXUGY)Gfs#<?c3Z}Gkr1eo(f<HgZFmoeh<!(W`nSp+F7(K%%
zEgqG9xIC>sFl?|<eKchy2t=|}M{jS4j>ns1QSt$fOdQB&O?e$!Mu0X5pY(;WiyEO!
z@xQ*jVPI{p$#pJ|lj6L%)Qt4_PYs+LKz~=AvQ7+hRQ{2ZRCB6~?)v@tH#o!Ujv$DN
zNt>Q5f4Rj)6Kzy94S_G-YGY?-ViPXbw=D7RhO4NpzgUy0GNHKu3=1z99~<~j_S|B*
z<%?EF>c2``YFC;=TMNTBMB%`-3g7NG>K<x9G*u}GMdl--a2K;@+oPj&jT@=W91QO{
zrHf3;jK8a@*~#cav~khf`Wp9<^|4`+D#%aWtiKwP0FyS#WG!*fCG3omO)A_!p3r_j
zT4bhTqoO{e@cFBoE<<NABxdqM3n$${rYYhJxU96|yIrxN3Y-E{%&BWqL~Kc~p`0^e
zM8vuLjGZ2ZP9<IFAe1|NXiRcv5EbH&B3fGf3=N#mQk_|jO&yNr{Y_A${OCw9=r47f
zSxY3**x3#wl*Hqv{OU_ewZpblIm}*rUpuvpJf%<1XcVTYJnFzW=drtrmsD-aD2APu
zxEkA44_Zl%ovJfsHh-o!9UExe>#8^ZSZPu7_`<>?zk%!<guO4Ga<t8Z{G^<C6a+7@
zP52>;sxHB2?_j^qP5iV2e00<v`U|fCE-#;9&sY&SR<`cM_k@5Cqh|%{CAZ!en2W{B
zyF5H;w0fnp6@Lj2m0~4eR-<CGqIjPN(ff%r{o;_tdDuMwv9%RLu~|t0<>d?oQp3H%
zmW48?ysCv|d|+B)60e;+h1Kq!9_)q2y9o(B_;hpqt-9qDC&v_zu&E0Opt}fhE!_~$
zm|jwigBZ`dE=8F~mVa1-Bug+8)1lGRQqq)Ni@B}weMlVoZ=p~tF%&2dyQZ$i@3MZ*
z`(E6(%caeAe=JiT&ND7PmDs_yJ#obK&Ae|Qo=i`u38O60*%;<?#5jnvFTudX+RZ50
zmkQr4<&f3b8=#{S2Azd!tw^YE-HlZY4~Hw;eeL%k$WpYEJ@2M=U-+hL&A9c&wT|jO
z_!Z#Urf^~NHQIhb3pvcRoR5d^aq_#nn5(OxZ|j^ld4pzQ*PMiRfax$cfM?{q#mr~}
z{dO>y*7xvabxxa<7V+xp6qZB8{qd<+o@3|5rc05hV=~(YhJhEYVN$g0yAso+wwRNm
z70bVSNHUaE)*s$efIoxpmd#B5*q8SWPzC%^mOmS`&%PNxt7e(oXZuB#PQ0ds<p!Xi
zqN={o2&%~&thMpOX4K)&tsO<n!et7j=Qd6{v@|8MQOwK=%5xbaZ)o<na)OVNB@6F=
zaV~sSC!rp8y?eTZyFFdN5o~K1O8144U6NtRU6OLwV<U%LYujE<NgzG1J{97!zD|ka
z7xB_gM0Gd2Ev0;;mq?m4dDx_dT-rVyCYbaLvkqHO*Rq@w9}pu+8eLnVX*!eQp03Ql
zMdZ*LwLU4PR1(N9;#|2KJEyt(@YQP&jVH6>)E)fTW=uk-ja-Wi_`VqYfST@gSz;+g
z_Ur1MfNqG%`i$c^!SN{0z~j0Ci#J4eJpJ4+GY<j>9%5}v;nIs+)mjZ5u=Nn-^RDCF
zr))%+iDPin<Z@?#kZxcelFkc%a6DxRR9N?RZ{jS?ry}9j<7jhk#=+10dGRwmrOw<C
zL8ep)CyLy1fQ2%(ShZi@MQeWERVi=uEkm(K-+-@?pIRX;ih#Z2(tYXblm%tRn@vU=
za&UeY%&KIV#h&|>&ia_O#6|()IexUDnyZ3oZf~>0YAZ>3j3RPrg^B+|?xq*?cINa&
z4LVepI_-{1r+;ViOYv<E$%DJK{k7UoZM?f7=y<Y`NaaNWEiNAY0P+XrML2$mq%!&T
zX;4M<>2%D|$X|3Y+?TJi5)f`0N3frx<M^ray#&_<cp5q3^ag_=_4nPXyV3k_{b93U
z=M)p~#wqFfkMKRd7A)ffSAf>b_p+^MXvy9&37JPVd(PB5afV#$FZIShPswjnnv*>~
zw(b@)JD3_6(GKphQq<V2n%5um1o<|7a6MuPr^>)Cle`tfW)EwVbdw~f->)Fu{ar7j
z{xnMjvQX_U@MWfElW4vt_-&j)S~x4_3XNMp@MRs0bnk=M5zVwr7;4h7Up{sh$kN_|
zzPbQ*u3axTSTJCCad`yu$ox?VWef|<_CtBOFjrw!lnR-L91pK(Cm};SV+0`n&acWh
z$u(uP!Xfgz+4L=bm6c<L!_DuKCf?d_6C91X+$HxM=iI&&#HY=q9?SBu%q8G@W833c
z7~Nf`09t3r24;p>jN`b&lf#JDT|Qlh*Uc1O5XZBaB%Rk`(-6vPU{^Y1!4$=uLvJu_
zE5AT^C8wHcIRDT%w1=HE&Y_J$M(bfnLi{;;U(pC#Qm4FmA=?wI@^a_V)|DmhJ+c~`
z4dk|k2)+mthh=zCfcGS;?z_nwFWV)~f7P0`ht&bStY<uKSvjIzPKy%HILRZQ_4H@j
zhzvIP-FTcq;R1gdLFZ`|TzX_pyLLY?C!9q|SKZw=?O#@Qx@=H_?V?2lp^6yhPz@(F
z8gW;YToAZ4<f2q5)X;wP*DKP4nJHIt<&@B)e^U`(lOvk*xLfk>aX;r*+rJFWRqeqm
z*Pm_;@W)Y3+yF}j_zw3Ct`97L;%YnSYRAspW8wj@zIkP}1bhB)v+NsJ<78%;Is(DC
zC{W(e5Pp4ZMn_q`%1Y;lO~F+|THEvM-=T{y)a~i7_&I)sn{BbFC2K=;;e$Nq=CnYW
z&r<i%#g<xL0>3-ii=a=#V877jGF_BbrsZ7~dK-(?Bf-43^h{S1KXBZ&!Fq{I4M8wA
z%5z&AdRM)-Hw!XgzwX7zsS1FLMbZ4GWziiK))%9dYXSdbSFW&3CT-@l)zmM@%JW`G
zMKeb$#7h2ENzrOBj4BUwSB_-0v}pMH_#WWWJH6yWBkd6AGADl4Cc)3+wCic>hwAS#
z#?q)@@R6v@(SH5M58LMO+&vZDuMy!gtj&4~`bWOSvP&8L?&e(ON+EXa>nvv5cw82d
z<JoWkF0U_md^+gU=>+_b^NLsztbM`8Z!ia;CX>eV?Q^GR3z{r;4AkX<JxwK3nEh`^
zUYYq;r^&2I3hc}dVldAvGWJ+ZlnFJQZkqfau!9WC5$tUhO$91b<$W)D+qRW>GBm&*
zAfu`>yYb+;uzk3Ext2ejGN!q|xi_#UAN^Dl^z%qwV|Y6O!0v*MSIIZp*ubrK$J1d-
zeZl5$7fB&g*ljlp3(zuNOqQv(WR_uSoJhASd%S%}9bi#i%5E$~Ni&!0Np5K~ENN1g
znIz>5PhhfEj3o#*5)Ix_{ekz(y08SS9dsv&+3R*I7GE2fJ>-O0o*AB_lGJ;#Wem{D
zbueH<-9O!{STr*Ry;G;7moud5bG2{0HfA=w+?rwVLl5O?h2;jhL*Jqr*S|_Un3=!V
z!ll($O8RFK>R3$o1a$cuaa*WSF{aYOYo#g1shmJRzGT{&^rK8+hcZkX&DnaWrqL^9
zy1}RQhGVsQAm^ft5y@&OjjGw+eD4|w1>eCZ^VuSq*L9t|Xz74z5{!@M7g(xiRn#8{
zfSUD)8cXA1tmyrt{igTrSAfG7JU;W*MA?*y0W+V?pP&|7wn7HJZiq(Ib?xVIBL4UK
zWf0?&`bQQuQ<L7_fb8Jxq(){@>u<c_wV!7k0PH-r&%N`XfW#aCiUa#^$bt#G9Yhwn
z(6aeTXE^$>NW&AE(Q1!gVd9mV_jxqTBII4(>Oj4l!L1*Tbj~In+X9YQ^6v{+Zq$HV
zeKy-^@qOai<&?PW+y=t#<7$l)!o=-I5uS)5it#_t#}tBdtDE1`n==SAvD-Z^I{|hD
z-i1V;|MsvZ_wis7_mYRXzDC{ZoBU?6WE3hj`KE02>7S#2xm;2KF_UNr)V&mDR7s(@
z_|gDw6j7yF>662oJL5go#n0k)eo!QipdTy`3VAqbD%JlOdMt+9uI_KQ%jr8Ow*VB0
zJHtjOgE8R?#vqE??yG2K@nx);=K!$S_a;-ToJk#JQh{*(^dyzcymC}UF0NpehE<Cu
zGgyE8<v!;FA?RZn4_<wuSHCeEnpjy4EtXcD(QJ@9!tyjlob6+xXc*T<HIDwrr-~Vt
zA;n6HMg|qMe<BlsqqfMZ!4cI<Dg;^@4P5_3rG^VAyieoQBmg79hR?0*@2SOROBJb{
zIG>#ygqV)oBF>7Q4)zk`G=n&67B0mqO;^8sXeVz;%V90Cn)mh!AJndRH2cn^NY%1+
zVCoPq<?K}}F7GAsPhn^nxvI`>T5?*CMeTa5SPY6%!4UlWQE-}YRwu?yTcThNHbEXo
zy25-o)izo>2|0lp_4H0Nd)7EtDLO6pA97C@Yy#v1B$Zy#s#3V1DX_c+^51NI|3sA{
zH4QYV7<%I3Tj)!r>lJkU&vL%+ps0q~1o7?HVSLoq(C}7)MYWeUgybo&GFdAWN?X>=
zn@6oom&B&9=#=Yyhbmr%S<|XT4z&{+t9L(aF%>KWVw#jFD1PvNXPO4zvJlRHH|UZ5
z)Udwuy|V0g&W<?@6dwEiL3c{_lN|VJXVrS#N;KgC_W$&)EjL`%j27H&`12ju!cFeC
zg|E-nudR=W)xr_h8yV~1E9X8Ran6_VOEws<H|pd6Ccv+4k&p0=!Ba`w3Sx@#ApzHO
zmJ80#6~%Hb)#87TX2fg!RoJ0gfoz>OF0?vM-LZ;pe#6-=$8;95LKr8n;(`5=s#G?6
zM0ZJgUX~)Hp>{J>xJxrZrB~=aKt20v4S6iDma_}6YFo@G%4rNIU^b!p%QP=>Pc7J}
zq>>Q&X7iftu8jX7;l*3^+Ws?LwY9K?YPGLoLSZJDQO#m>T}*Kf-I|+$Bbg&JDy31d
zWfIlQcD3Fm;*aKFqeT^GeUTYq+F28+jL-E0C;k4cwJpl%_Q}}t;cN|31=P54IHWt+
z7DhV&b1y_&Z^goim;>n((J7ghSwge^Dl=y0icVW(BLcQNDgV#)zJsRF=82>poO*jT
zq$yxQY^=P)Vi(I_D1R&BH{xaOkRga1Cy1Brn+EY|u^YScA$0rsRX~8+<mEkPy~8Vf
zAz7%fnf=E#8U_EuaZhM;?|c!lgu&F~rFLgTmn6mvueIEFhQivZTfkS`Wr<RX_wJ18
z{>bO&JOq7A?Z`rai=ISD1>w?6f--YH$%0OOX9{Mcmpx=nHjj^sh)KB{@d1x@)P26~
z{7eJ5-N`4>Q$h}i7keK9$#miFzsIo}T?;5WjJ<lJ?IUxStxFCY@us-j(p9D#1SqLk
z^w~X1qpf2Hv~LCc_*<uc*`^f4aX|s#H2O?ErG?4<{L+WRZ+PHOz(WudxKYP+DRKBT
ze1-%akoIr)i;cr<IQ14T4feygoYP>~p;O;qI#qlz!@*``M>1}NC7cLsCqoROiz8q?
z8){UARxmOSjp156XEE17&T4gJF{{Q-1}0x_Vur8_F@o_B2$Ia|L8w0E7UbcF&1%8D
z6*nm#x|HT<y(-dN*L9fNAPI6xnYo(dO6FZb_fC`(Q><(-;&*Gt$HfkDgtV9x%7=)y
zB@UY)>ndsaHNq_#hl}cr-=)GP8O8m{W8XeS!K`-&M4n1hs52!8*PQQGd;L}0DE@V~
zHJSah`1=FhY?a}84y~zVMz?Ac^nE@E?tftmBu$Piky$b<UsXJ9P46Bs+T76s2rl9T
zwAM@fEFncalohl7!mdA%atSzzV%-(oiqrlPHxpX}y*P=yOBI#>>HTja^?y9+6KPCv
z2vM8HX<g#;YT0oogsZTBT-O$PtrrPyvua48WNtU{l6<y(wL_pmcd#Jh_Dq$av5d9S
zhn6IdD8j~{w9p)j-*AZ0+0P*r75ufRMy>8`_W_gc-w9VH2o`X$0S!!nX~d+QxSAZl
zcp-NBfp0iR{2X(<bo4x!wyQ}UlPIHV-;*b0@d-*OPVl$3GVLDnD;fgMgG8UM8ave<
zm6E$m*%N<Y3<YnA>^<8J1>Ld%SDax~+y@P_$9&@Z&xia`Q)JWVW^$$oA-s2v$NjSS
z&))72`81G=%?QEM<~4QCykYMzjgs+B8Hwmg1uMU~GJ@+alqOK8gSMY*F2xwwt<;i*
zY$>geZ&;iy-uo;mNN6&#3!l~@xD$+{>ErUb-n<819dX`&qz4cw61U>m_|B##S6Yh_
zBb2uWj}rL-8V){i3w*&}GL{tPT12-DkT<v$Bd0g~_2%h)y4(QA?@=kC<Gy~Se-bq|
zBF+MK*=DgtX15kk-s2*w!>bUrHh(7&MdKV$FqhDib3&`C&VlD21lIOp4EZ&+H)gZl
z`30*?x0RwP*{%<$vI&8U$#O?GDY+7uTRYmlso`$NLQDbE(ao9k6x(Zdc=EIJ=v*lc
zVNa{Y8;y-Vf*ONJHivv4oc}I%D0K_bzrASN-pF+@W~f=w=gg}5m6zT3yD}1Tu0W4u
zSm<C$H?rY$-V_*|+6a0@Lf?1ZyA|l*L&*7LQ7*Y)P)Y{yq!3elReh00Uc%kYyujc3
zpj~d5o-0?V;xYKP*A?C3qDF#~54eml7de*f6sqT_`7<^xlg;oQou;uWYv0~?g$j;U
z3SSakugEQLHhe@QH$~pcai?$Ayvto|^@OsyCc!FX$7>0`>SV_?>;9pU6xiB5Q5#r(
zXGM^{HqDSA87||VFhIV6eo%&yIE#ju$!#VN1UbR-usx=ui?~Cg!at_P)0el+ux^Tn
zuLV)Lgi&)+{4|Vdp9(&Lm!w1EX>}dky6mb|>O5^S{?pc(>^IOD&U!R<#$<(56AcWg
z-$J2J+0U+fCRP8;y1f<HIcykAb2aaEs?CQy;K`cY<ODZK6K{AAs+6jz{dCulrps(f
zMdgA(Y(Wylbi+sOfG*6+Uvg8&uBdG#5#6X~WL!|Q7kA@G-2&21HAa9|BYzPiONj`;
z_Ox9N)w0j4c1uURWq=WU;{E2p)uR{-?5R`8sU0TEyO$u}J=P{h8aogibhrlqZ)c^;
zoxp({jbGW6;hij4?xh5R-A*UR6_Dw6qK$grqyot@Bi4Jk6?5oCsy0Yjk|eu51HS&9
zP>>@ETtk>M>z)kj_@k}dpG68ZF%KlPvo4g0xDZ*ZI2Kp=#zWlZI=Ee}o3E!CF_w}a
zA$;7RceK(#&m@k2xqsq)kgan8)BMvG{bGV7(b&~tzaMpmhI?Eh$zJr2y{bXIyqDHp
z($4fKvZE_Ogfb4UmEUQ1z|m|2;%67FZz@@SZ-Q;cGk)yJf^Kl$4e#nE%{W-~#5%Mv
zxew2io4hd-JrCJ7&AXe0FaUf%N!kY|f>H=t;>&cl>o1X<MKN<+k}`SDy<tv#YK@Gd
zY>yQ!%)O4CJUb9~!b_Dt{35n#U$z-XLI*Ttfb-#v_$>_Qp^zz^w8>IPCZO}-o%cGh
z_je=@md>P`HkV#t4kh}eV4LBH(ASScncb~7$hs<wcM`5(){ITgn{^IcqD5x0DWSfY
zsoOL@GQlHGBpdm`T%I0Gy*Af@(%qhR^WF_t0!<_LdQk=4Db`OE*KA(yXTfLqeJSch
z)e93THno2bz95au_9S<%vv@(gDtq2mEq1)DvFYwS0YaXFz;RW(bZ$I7{`>9$5V7pZ
z*95($QN>KM@wWpoh}GpI8%o7sgsg`Bk-h8r3dwq#$51G|j*_-~aQR0fi)i7h9{b^O
z6Ya4^88m_L^9(+d%>u{5jshN5m-k(BYU=90_jeI`b2gDE5C2df8u_beG|Ov;22J*5
z&m|ex?>c_0w!^8i?d$BmU7giRX#7AYhdbQ*)UC?A7*Av5VTdu&vtSqJwl9dTGg3@`
zq|S+(oWHt&t~BLvAHKB^F|VzHqVJWP(mDvys~6X+Xz+^hKcAdlEnY>kwp6In(u62C
z;kiaEwRQw~<n;vjVpLQaF>7k(D)l{_q;))~@Z-=hnthkUq~BbNt4TTcSj|;mYc)3q
zGS^MvpBw?e5Gc}Znx!%k70_Cl%|v;8!tlc7&iKsKP8Va>=U}9<+FECLGv6SAOD{(N
zR_DRt@X`*7P4k+<|1NJH@y0ZNl$97sZJxU9T}&T*v}=PEU$G0jHM5C)s`7ZHS%&Y{
zu3aml&{UNIVu>lOt|;;yUWiCQAo=AS^CoY43B<Kc2@3&OCiI6Fy6U8Ma<6};fyuU(
zQ0kD%QW}ZM<Lwjwhg4@)Z)zH67X7biQJ{Hi{h!^o`ND{fdCI`Y&%Ww2p!fM-^1126
z;xN5UBNJ=dfZ6JV-^A>Xzx`Q^%baNs(_3?Bs$lf}b)|<~%KAqxd97Ylf&;ABbGJm=
zm??3S4O2fr!UO}hbt%4u$~#b<@xKyXrHh3pcsbIl1ka`kF$%i4kni+)(z*m{uuvBO
zl+ZKxliE6{R<I>_4*UnD2TY%b6o1f_NZ5lltCa!Kv;pb1;Y;(O99ySw!V6T6!h&un
z5>yDV34r1MyqJ?B%u!8kR{oq@EuKh}ZYojVb?4Aov^e&TMVWQ&De%8tpS6UpDn~Fh
z)^%<=t>Y-E9F&SUjEfqVjXiYeP&*6#r-}t|q-`c{<y~Ye!wF*p4Bjsa!ehyTw!n_X
z*=l<Owf`#DkXg<p#DnTvs~1&g91oA|1JknuwG7<n*r;eYZKsBp*5j+4XGf=>fa3x}
z%&}@gbWUb_l%2>C1n>iklk#bOLSbcPa#G*N%vHoih{izQ*PF|stfH^Tm}cB^Xng-i
zp#}w4-WGa#6eVqSe<HKRJ8l{ec;{IhEaH!W+1;N^@#1UT!o@6B&CT#RC_P+;zdJ;y
zAGLtPhUu+^u6WJ%hvg%Js;bClog>mnZnaZh9<>;j)kOY8SBFw=l+ZEKh=))>Q@)j|
z@%{b%bps`-s;x*rf8L3y!g}w=fcDRS$=HhP9ht{-118PVxSxrG<Y{YSSm^G_%v=s8
z#*=Ba2GG&xuU>Q1y4|{BRH@}{8Ve?gB%^rj#Wx<l+rB7z)|UcC6K}(bmyx4chtDrl
zwvtH@dD?n6$i4?ON{S!SlT&89`ef^Kb>5cTut;?Gq>AQp6d9vW^n=U*vLbipj8jD_
zp)llkNw^>C>dQzMp~7k|WpGP)>i5}&<fUo67qO!4Q^MKS%0_{s>uDq|Vr5N7LT<ni
zHdn>Bsc6K@SBFd?Y@I=VlMPdR*<>Dsq`6z3E>kQat7UZ0L2X@73!uXbV{5l*aem2I
zHcKDC*Zej2j{C%|p@nd0Nmf#U#$u!FrG?j*#ruHA=Q<GwD7$(xzMNcr%Fxc|)=w9`
zeZ=j>M+bslHco#-^bmSg&AJCu&K-}o{cXMn$+?0wt@`VkDz3y2k&6wNW~o$$a?|Fd
z0?qMqMsr0y4z*Z_YFURp5h_Wvg7i<D_#JuuH8|z%H?g6IDB-0Z97SFE_2)oi!@ojD
zg09rzsD0Hhrj*=zA?9)-?w((C*EMeV_3|53S6NzhJdR2k+IzZ&E=y>Q_%gFTM16zv
z?sFUc@DX~gpr06e`CfT+CV;kW^*Eh$(Cv21cQh&;L+Fm;+v*;&H0!&l9qLahOR)7m
zMCcV8D=D(K-UZNTiu2@l;lCg$`cZo|R9XifLI_>xp&06dw{dIXE!ZTj%}w^lg`h4P
z=C{_rLghl>h%x>Ha+ahO=ag-(an!4r&WFvAMR$WUZMm&E-y3ss0U;RF!N|d3zgO%O
z6XB<X3Xl^kplHeKb4&QX&M0=hSufTHyn#)Mp$Cu6o}QB!&C^A)2zT$@+u#zUNfU?C
zIir_(^w8*t{!1g7WoN3^`tt~&F^;|Na_D}DPqlL`k*ln$&|e^xlrcxT-r=Qn*8}@W
z^|Lce6w|#hT|;^K$Y3b%Di*Hehl@s)TPXw7a(CN+jwLuO{2!$HL<-%1`=PW^K54+s
zWf$`k1s&J>jJCVLU#c9zcO)Tn=4;n|(S{pQs60&;tc?hJc|2g)Cq^CwQ9HrHNI=Bp
zFcOeJFoDY1ButvpQSST4L1s|URs`bZ%%6ecDo&&L6I(Iynu}En0fqxQTflax4Y}2D
zb0_}l<Rit_ym@&?BD{?FM<IJ|j152XWL|UP=eA(uTPe)MWHqVwY8b>0IH$WyXW}SE
z|CUy)zQGAm%WnAgzcHwEj0+%vfrJij;yA?SYZ`+nS(4uaA<Vtc*8~hggadIrSEqcs
za#g~nQUIOC6s7>|Re|TvmD9sXjA|*4$&Hvb7E3$bYF~BNy55JFpeQDvM=+h+D5@&K
zPO;8m0f+;YL?!yV$G68DvkWix>5;l>$)M5keUEw(PM>Juo@!x%03rOI9zRF0C|s4g
zAuBs+((CK?MjI9EoHXd?>vp3hX8V-wVEEX`G*#w6n{Q#?#j%zvSb*>eW!12JKzy7S
zH*d3RbD-t7%|rbwCDZ#F#Ez{rtf;^BroWa>HURV9pGRdPs;5g(D<6g^-geB#SDj&>
zm%NP1JW#@A*rpo~VX3tlwo?G*q%$PT31$ERcZ8RhDwE-CWLi^%1#p+cZnvjHdCH#u
zk#3{i4i(U#84e$_e83`4Bd44P5iSEixA_y<vw8E*13a0m2LX`CGt!tG6^=ZuGEXvk
z$KvZV0X`*TXBw2kE&V;Gc}#o@@#k}vN9zPmo@pB&^a%I&_kR*1Pr0A(bZ|9LT~^Dv
z+RDfah86#rTz!>(CWvgfQM5d%gg#PKy_lAo{|-i{@RJ1M__6I7Qk%!rOlV}pH&<5%
z`}k`A)(mhi!d;Y$g7Xb-lLwyi-JK?HGk)w%gdr_z&mX&((+E@JZaT90#D2qvbV1rV
zaLs4~O`Wc=-(Tu<zE=2_LCVwHPXBeM1Q2^E{<R#Z6mP@(q+~D~uDIdOB8zIEeebbL
z4-zJ(q^m8%__%B2@m4oS`vG;I_(w#$!O{~g^q{Reb`oqG4)%4<Je90{O(ByHzfgRo
zhboKBv~}$!#hSDZV|Lq+pL?CRyJGZkq{rL;2rT8W)7g}s0+V9E_jJUOjD28&ju@j-
zv7j21%CpwIM)m0Ps9ndOF{pEy0noNMV)_S!&y*bL1e6qOU6y@7LVDVw^!{EMaJys1
zU}XkTVe~+9Ol4@Z5#!MTqTP^r*L)gEhx*(CI{ZE^t;uQHJbn$l>{tG}6ZpCL>s$_=
zsPzEGJ}>eR!r8jsA6Xbo(@BTUb80zl(DOx7_tX;p&z~^u=u3XQ6pp>z2#*9aN3w*;
zPNV^g`WC6$QRF0E+2#4oVap%>V@hg9S~gv#I5`$%)$1%O37B3*o%!?A{lagpT`~Pu
zCXn?^fGb34v*Wjgg-unjv#1wJ*Sh|Xn+kgY7{Ls^a{3cSp6x7npYNhiUr5T)Z_d2)
znIl(1)?*~zR<aWpP2H;Rq`o>RI&5Uuv3(`{NnjNzIE#5Qm8DN`A&|}mXI<t<$3i5o
zk@Tr{_DL*%_jil*+<<q!1^+Uy70>8nVmH`D=#+jhZ?il?_MQECjQ&*T(O_6*`;sY}
ztRMozyHXR+=v(NDU}W=YQ&P+M6TKE_6U;{8oP=*IqX|Z$MkD3IZ)g<;evKWBjd*=+
zYY>O$ucROi(E47E5TWaJ)o7GBs(PFD1IsNK;F{`&*MJ-5xVbg<wTNRmi(pn-)_T>C
zdFjM|+Izq)Uh=%JGgKgX+`Ji+aG=oa=)nEAgNg=W0O&JLls7L$p>W7)wl5DrY52l1
zp+9S|cb6l(!L{gwdTyXGjORD+5Cv<FoFwGFsay9nqLbc7(M~FOH{FC*t_3BU#HhHG
z!^mnAW4O3{Fx}ox(YU<-ntYOFe!lL)VbCvbNps}%qj@HI4U3U&8na>b$GnhdzC;jT
z;CU*%fqAR^q=z`nbL0{Bxvx$%yV2KZ@{`I-@<^yW9O1)P7^@tg|7fz>z;pYzod_qM
zEgsLJ$8A=cVQnXJXN~su-gIbCcDW_!HD*vcC@q-xbDLO*XCETD!jM?u1A<pGgE3Vz
zTK!4OG@mRyeM$wvOh6bCyJ}ki$U@z4acfd)gxM%-4!&T2VA$BWYl9mVA1_*1SDt*8
z8qrsh*^WhzYM{k(w>cg;g>=v#pc^r!i~={amcjI7_x3pT>zcnz+s9+)Tcv(}b}BM<
zq>F4o^GGZ2560knK{aMBd-IBYtff{j^C+=terwwX?0VCTS{sxxT<d7@b#V@LX6>7h
zmFh)MYhHGg%J)30ueaH8zSGmr9R8th8}Ct9zo3(7m{p4RS6U65w8{r*vgv(vwO!Ok
zBIFI!!%N04J-8@>=r7v)idCQ&RR*U~wF)U^>O6axo`BkQJ2WSvvaE%R2Mc3UIBO=g
z#|#5UiVqvmIZiW!QogdO;RG|A4;A*QRyDLUGB%9h7DoIj!!L=fXi(1qHnDOM&=Xn{
z+#;M{x#kAv<apHto&~%z9(A;<`+->qR7y+t)+IhB^(yN3UO3KNe#N}YsBFV-*hdC*
z?O?(BFdO$u69$}=4MYZFJ+N^zgpTAok1+aY{o$yQ2L~2-p2#f5#sDPz7b9jrgk;1+
z79!%i2duU)ArSjdwA2|@_|!mob)g0-7OE1rm1g<$?8W^-oJ1^yG9&%0h%$}Jontln
zq>k5z3TtWG8pagX<C}u;q+G%>LNK!ONqsm?^~mDi2+MpcJqwZ|B||w^t_H>%ou%1!
zO}rc2_f+md*oXMcVmY1f*^9__UVAtyjOSMy8!GYD!i_VZeq)cRrq*_DXckDJ^9%^w
z&Gi<ck4z=nsl@En>yL9Amnqx&-`xcti#0}N#se)5&*H6Ya`IRSTs}`*Jbf|mx39F$
zuK^Gx5y1;*GSgNg`)eMYl#j{5`-zEs2zrsg-WrRg#e$koJ(N2DBqVleb2~<n7s{eu
zB8zqeIWrI>J#})MI^eXvcYg*Wu1L}uwsyIQWtE`FuQTkYQW48)L6HzO4$CT%$X0K5
zxw}T}hI4DXR?^gewfFwNb5b?Wap}40cfLKH05~lF*hS)Dikh05ZY^jS4D1X<bg9j$
z*|frB{jjkcs@U1P9b}@QRb7z-*>D}-q@A&e7=FPVV9Q!7Oq~dA{XvMZN>aHxW0N3+
zlRvPa1`nt?V!OZqyK`v&Glf9pmm7RdGohBFj+bsCF2Y55A)oC$z7eQ-zdU<QHBN0s
zhU3_dcW3HU%v>9*a^14DW51Pc-0`%#E&6D-0-s4TpUcxrx1fQF%F{8!4VDTe<CU#K
z&8kfJKP?tQ(}gFu$iG%~O-?UU`^)anDHHF{Z2y-tiS^7_Kdv8F(O*5Ec%ZgBmO5;V
zNhx`&^S9htDS;h`rb19IRwF6YFT&?X6ILlDwe?A9jqSPn#)x5ig##0TiyPI(OEwP1
z>3YDr&SJOAzLqAGWF^E&<11Z#pQXBPN5e%PyG(lQWh6YNUtD5O3>hMYmJnIo(=n{p
zlJIje1TC$ww|mJ_w)y&x0f1Bh-k-=_8NM#PCs-X0DDIM`H~C9Ms8=<+C`W{1Tk3^n
zAHQoX8h03Qg;RK#D5$<M!VCX*_OSZk+s*Z(=^VH!<UgWrMPuonxGL1ql4B5z<elxF
zH1{<+gyknu;uk0G{46b?T@HM46+?G7viIYYmT0-0s26(jNKp=d`ycCf(s3BOhHP^~
zr>L4f39Sm8Jx)k>Y9J1=!{UOTG$-2jKO=U$#36GJEfTI5UGZHIr9&+#-bMfn{Asbx
zonwY`XoX#&q*tSlX(zq(@;)QCBhf_+Y0y&5tq<Mi(x)Y>_9y%0%QqiSw=Vnky7?98
zoSvR7y7#69!qyHwu9f9cSQ%<cIS|>b!&px*-<<okPMIICgXQK*4vSJ|G!6;boo6qu
zVw6ZyI(g(m4UYWn2kx3fBzbU~?7!9I(pz}!0kk}Dc$32kQj_$b#|UC;=|`xb4wC2e
z2l|6{K_n*K-II(ln&uKw_g=)2qoVHJ>ck30g!&)Cu%V&%eWigi-ZZL&X@u3~E;m?;
zx)JpeGESe45E!1&ZcTr!(urad>m3>`fVQP3<$AM6yg_cWz_0*aMJ>IcpCnzv5>}kK
z_ukva%H$XmL{Xn1B(?s`pZ3<Yb*0F0)T6cpT^y+z(9{YC=?0vA3D&fKq1}h!Yzw(l
z4l+RLZ=J6CF1T9y(m#%NaCio?5|@?G#&s_^+{YN`4vTwh=6S^W_GxrfX1Z)w>S)>R
za_clEbb_%5jJu1iuNhVv`vXni2f4LZ(Pz<tl#bCHau1I7DID;~t@-Co4n3_B+S|sC
zKqB;)cz39cyu8?oq`^0oOHbzMzFIIyb71YwN_D+CTy3c$@&}Du^`b@ummaC8gs?^R
zx%c8$kHA$CByS@?OA`nX$(t)88EP+US#)zJ=abZ%cX+2jYz<g3SuvVVkT9NACtPbK
zy-6hPDakk;noIcfwt~SR7#I9x&Myfs5Tdo}n&Mn#DCbDP*5Of0)(PNN7M=D!H-dx{
z$omR{>M_O^y(zwOBZlCif5RJ_w~>(~FYO0D#NG6`Pno0!&_8ebn-x*Sq{T%}n2;!$
zmi9H4<UP>dC5{pS8rLwXI&B>JhE~)KjW=hCE2>16AblWZl1AV~K&zJ*Up}EX_5C*|
z-`(N6Ue|_GE(A9`8%~qi<pL0HOn@0pUktRt?aqW)F}q5l|BbgfQOQrX3vQT>S<Jfp
z>k8&-0G|tnc5AsgLMd8D`r)MstpZ<Ihmu(+Zwtl%{IV3V6(|%j_37&lQX~AKOAcVk
z<elZ#IfmWf^{!YCm96oJkL9GW*nZld-8w>g-&zMIwS?g8XMg(Bw)ot`hlyggTIKEJ
z1|)6%k3S#10Lft|0;aq;1tL5=Q~o20p_P4HecAMq8+Qvl#0KHXqIEMi(=0$j&Ts-?
zj3uujoG~-0u&xBxhtD0Xh7WYAc!+sp?Wm_7+=iynowVFXENgBIXt?{sXe*HuFypS`
z7eju4#2-*Q#tJ{2+5sN}0WU0XL8J-O&n3AfXs-!Szr%}jF9dJXUa?aljSHQ*{StOE
z>#Kv#^S+ZuDgMd!j^V=KGRf*^{}iU<7}5h+v=kTrDg*Xhvga<s^&v%zg6_ueg4pQ}
z5?15ihz$$JVx16(Y<;;PV4)NT6S7`cT*UIBt0QG<dR#~1*1!tZ>XHV@7p^SK?vkLq
zKND*ayxagg$=EL{_fiUlCl9mOwC4Cp{?&TpuKU^37U&o>;ANxu+=*4+M>mVBVHlsy
z4jt_Yjrk3NWS1{QF}7Yz;)pWh2*DE#Kc}cFUqRlZGiK#?BU26bdf4eUV&h>2m-L2&
z>G<Pv_|_=fdo=+Lb@t`#;dEu&^P@1FZrqs2V%pZD=)ItYq~&|YfkWQ|<IQ6I;ets;
zxrKI7MZ%nZRlA<wlXibB%0(9!&`&SoLR_;Vc@q0kh6aoPb=!Q;l<dI`7iAoJUy2U<
zs)`Xx4)L}vH8GB5$3bXXy&TP<R%f=!wZ1Iw>)60#Z=ivLIsg5)lI3w(4H|W<MIEBq
z=OS{ht<R%n474&lu=l*<p#|D<8pEBQ&GE{EopTd~HXwY#l!;1sL9>gECNdOsTusmr
zj3+L2{<A~h%S{*(NQh|YvrDq4tS}kGd$e#YXG-j-RJOT(mSn>UUQ@`QfXf6|84l9t
zbjx*=0=DLV{1hHO#^Rk#QHx3{HRpE7`gW7(qm9=L&;RlP`<D|OB=`V|>;YYL!e(FI
zx8IaBD0zo4Q(uAoOK@T|bi?~(%#98J9{C3vpU(H3(?iEawtB>QlC*-J=JS$&l1Df=
zkd+}qw&vExY^v!$5nvA`ZA;0r>X-~-Eq$T=@?C;#%0%-_2=L``U_1wN@HS(f!WY(D
zUl|RqKV1jp2jBcLE5Nr7(O6EAU<V>MP*O~U#NUD8fR>{yBe)h4Dak97IJrJpi$jkY
z!2c^4OH{Cufpn6%8JW{848Z42hB6zlEs#O_jVovD9rMRS3nSq)?wCn5Mg601<^1^Y
zUA`_XK0##1TK<sC+L*63Gn*!;^j68!H4C30Rt?S7)@Y+3;`KXimftC}snUCRC-!W5
zWDOqQjO@8;<NRkF_6Q+wD6Zg(pqF$Go|-9H#xk*$eRQ7VB;bQdU3Jo%{*d}k9L7z`
z%~%i3YZB|6QY0r%2n8J@Dm_ih=P^z6u7*5ECOS9`_o;!lJdbYO6wD-SR40lr?=Bi#
zj3p)l`}8M~LdW_i!Ie_9rQJO#uUMHHBdgvOWM2V?y*PgeJ&`de61&S$#SeK8Jt@2c
zgpe<qj-#yOV1C*J8;_61jRP+Fk7bZql1Euxn`vs7A6Z>A4f-i9j8SCfKl{SxV#=EY
zPrDaIB+P2_R(u<NdjvUge()>O$U}eD(MUkZc?GJxgr$xMw&euMDO4l}Mqr1Pi!G7p
zjJS%Q4Rjv)99cF;VAsW@4ohqGS=7Et+qHG>7Rq3FNuPLcK9hDySzb*btjBEDnxSU;
zTz`KL55K(lv!U5w)z$2WgUEfR;LMyv60&+7b%-xxP<EKR%W;g8CsC{Gg&(P4xvPin
zumJ@e^^(+Zu{Gs;2qzBg^9qvRv?*?{saEnLzxzpV+1if=ox@Bi^I+ihvAL{NXFdF`
zMn+9zpP7V(X&37Yr`j2u5vL|XV3uZ7W#jA36rhV#BCmBMq_psxqYI-bMXq{IxopUE
z08vZ=Ug#JB_Yxh5Vu^ORxL!SbR!gLyCJ=gEg}Q@I?^Gog7Z6LmSjornp(RQCeJ?%>
zQqi|P(C$tmB)L4I^obB?LdURSLE!V%Z0?pduwnG7Fg6zUU$e6gs+ZW<=M>ZNCeRj>
zXk1-5<c^?;8R4*M#$%wQLQ`mp77Jj^2?Ag@Xmo$S?BqvF+vQe^N*LGqr8E#4rll|O
z-?LCo%w_oC^rmRvXNXf@_P`lD*gy2~=J4j`);@Ug&)b;Ws(zlCDxVy!TWZd%x!*sr
zFx6COL|C#SxLUZNFK}8Hm+p*8wN(amQUR29Ku%ahQRR~<=78!&|9iT&Mh81!mx@87
zz{-RZs@eXFN@VIsmjX@yf(9Ej2q%EpO84;or%3dF6Vr3wDu;j9al7U+wGFB<Y2;k|
zv7eyvaB-y<X1Cgyqf#W_NafZ)G_*Uxz1eS(<vTc4;*AZp4h5a*gwk1~xh3_LE_K&X
zsTAz5PG9hCjrML!&2TQ*%_kY{Q2$+>wS^*a=&iPuJqh9z*cvYjoX~y5KkW__ICj#Z
z*t1wxpNzF)!=Yxpy%$uR{nmPV%d@*CK&-&@B+XY|MLV#ze~8^^10NfndR)!A`$6c4
z4cZ|_n#|(#*|;{sp`_zB{>RqAmrI2<-wCyUcTYj_s<E+=5hx8oJ7!|QK#yCP>h*C`
zYA8}*#srssL@n_%6(@c{&?1ZyD(Zj@UVcGgHb@a2TK~EnZCTMcJRvPAk9=o5kUJR4
z=KF=sISobC>L-l!P3<4Oe2cV%Py4}ce?Kk+8&h+AQ7131kVsmTAEs~OT9}ftcxKL<
zqLVDLl8lLs4|G;RSJ1R3N=(QE5)F9G-;h%t8_|w@qkb+w_cgBzbXfV_$-#^WpE5$r
zwU|xGkN(Aq_tZCjTy5Bl#vBDln}q+*=`H16BH@oL=EPL(J+u5zUnsI1bP}C#Uz0L}
zb5?+abudm&SF}~O9J<_89IJ(t+~{B}@DckDCTP5B@jUKlE-pOrCuxWmZX@tG@^>=P
zi!b;Ka%hCYZa`?#p6O+jMC6n4Ued8=7IO;sHGntND9bZIj$RIdfpC^UiTBY55WWT!
z>!&Wbv7>h#uuWs=?>GMhSyS&%RQqP|(a-ItC+(=TL`-Fk4w9Y{Lpn9t!7fiK-Pjh$
z4zTJ$HF{l#g^le83wiYNMMiKl>GJ)_DszNFIVka&jR|_?)mBEipw4CCCkZNG0FR->
zB*X;(fgECD)So#8Ly*6*uC3IID_e7Ucab{9Y=_F2os3B<b^k<tI=@QcJ(}4_xqlSd
z<t4o&^v}O$qbw|>;NSqhHs03DB44wq#PkW#({SVT<Y3b>F^Yay!t-i!6GM0=N=U>b
z7vKSerFhaZ(MhCk%8&B`dJiHLM>{2(GD+LZ!p8dn@8Lr}WqFk{kBj<fQ}@Ec#U#fB
zh$OzuJ7}0{Vtx1=ZF0SB8DC^DxDywn`wnIK0tX8#^z@~7^#i;J9>UJ5t&{@381Ios
zKFty7!NX0~U!bA8J_u3oy~o8yWOX&mYN`XxKb%Zg|Kendfo2*OC~5e0>K83zj_=L?
z@mD$#c|1l%MYs+=d>*<Dcs$73AXJ+<s!M(2@|4|Vx=|CN7yM?o1^vNcmEAJ_O6!hV
zc(ZErONxub3U~xw+9@yqf^^-jQrDMPNPoCa_2}m1L=VQ!g`w-cA%WoG1O*!B@GiBs
zqw2%Gh_w%T^vfiio;b&wlPC0B{9wwe>d0tGY@&uP&z%lh(6@gD5Rj}~a_RFg-<Rx7
z0Nem=TY&NX@0z}xao|)^_9uwx$;1(>6Fa-d-K9P+DKeG0uFh`o#|?%iybgp)vyj-R
zMU(sNLE}btJ+(^%cH*l9JXPw9-tAD=`s2fa4Rb%4A*HoXt+y#?qD~(X#(Bn{;Z}Kr
zNHE*X%gLq#^h|76f9*NOtFoGCCZZh@AU<d|)q+bo(pb8C&=>G1f+2)s{Nqg00#Wcu
zwSU~4kRf_Jp(Snp*zHbe#>;LsQNA`ItYeCqIA}>)G|h|AXVV!e(m1V<Yf}W^*^*(P
zXp>dDO;)Y5ARfPKa1<u`yk#p|ipJ&kAxZhdfSt~^vIwawcq6%SF3YB8@O!`?U0cKF
z^RcM7Gnys*K99i9md~#5+2#_6JTT_mL+Ylujn3ZF#HUEJx^9#2?eFbuq2c%M$L}2Z
ze``+cmDLhz>->=+d?jku`lQ@9{2wQE%PKBMclW{U9=NNwVmsPM5Y)aj&n{TqJ+guz
z!;#Mnyc@7YM3mKa!>9{xy*`#q^4J*K`WC=qnT_)l{S_^rdy}_R(%Z(O43d$jECK{C
zA|ghU1rV)%4a%!<QN7Pxf1IOOv<axJahczi7XUwXy$T`J?0S$+;|COF`u{c7pkx!3
zSiN=A0?oU!RzSs?+NGq(6PO~H(~bay9TG_h$qCAg#|lB>CAUYEb`KEz5G4pYtofiL
zN44VNVS-FJ#V=VwkF+nUiUweL*TMfY*aqARO|No8XGfou`cfew=Zh;5l@ao!&0ffV
zH*oM8!ct@)31HylIp78GK3OMPYHahEBVe4aM#88>u~AqGFNK9v+mDEh19-`nnp*0*
z)M2zSv`2u3R0#K^J&h%Ui!~jJy%;~tHlzOGB7I%H^10mRi7(I_3`Ad2GMmq_+4Qs>
zl~!Z;M#Fb2fh(gJbBkVRGy4qy4iitT)+s`h;A4lfiT6E~uZS$oCd~RDh~_M?Zq+36
z5idf@o{3Kdo8g&=;FMC_;BA-&jUU2ql7$>F*V;U*T@EM(nrhxNjfhk!@n>6%e63KS
zfh?cqP9K}Nm&*gT_TC*13}M%Je2yB#6HVGhA1csz=w4c!Rr`Y0O6enHN`iwz!lgj!
zH@;(wrUwoH<+(UgGZ7W+^8t?+N#Mux(a$-s)Cy(m&)dR@%CF~d0QEgdDU~Fejtqnn
z)b47D(ykZK3Uqj@aUWij!%4lPjh`&CtztexKXB<Y5)9dK(gW8%xZ3T%BVl)hZ~2z&
zQ#|8Z5JKEjbmo<9(Dn0Z_E_bCQYSL$e+C?(&vC{iSeG0=du;mRLwg&2Nc7(Sx^LSw
zdWM{7HrbP?SL%)|eMO5&P7d9CgETc33}$!U9`$;C9nfo;Q?uybyTgAh*EyVVY!J-h
zDLfGt>fkY98S5!r!m@8&)I?YP`u6Tan>r6B%xe%=l=~h+QF=-xeIqHjC>AV2^@P!M
z{;N0ub!p?S{ncKOiOEUS$BJ=BfobsSXotEm!Y4MVj()RBV^e+Dw9ux-#^Y%DI%U6)
z)s-mHRvGxs#z#@@LqLzrWKHcaa-pBQs2dcow-5ss!E#B+BQ6h?+V5BpPO=*<TA{yT
zvmHdTLx|+!*DZXPy64QCuN!CbMipmlGI%svz~Af;$EbNbnp}pt=9P_|)1B-Bu<$0Y
zq4c27(Df&H+(o9En*qKey<Jhq&VO0eU*T=_1A!MR9ZKG%Q`Pt4Qr7CO3>pSoGQ>eX
zXS=%%0bC0c)EFNtbaex%147ri45r44vKz5@_H{i@=TEbvbWVnesQx#1!|lz0qFL#!
zjv1UK*eJt|PQ&<3B>%BfQQ9#K|C4kT7M1{xr5scs9?qIz5>yMtwpm}BF6xs?gQ~7N
zPz1xTq~TY;#N2|#KBsxV>u?kg(27I)JMY|a4*PPW_|Z~d0<NMP&k-*Yj22aMyODr=
z|31{^b)Bnv>!BCw>??%eP6FG(icf+tzLOW#T>lH7JSB*SZ<9c%#I#j;#-$(625}xU
z0^AzcTwmt2R&m3xZnP`p&bFFMd&h@YB@mcUxkw`lIjc$h!SG~Tu2~E4_Kj6czzxT3
zg9WW<pRTr|oG54#MK2~%b<@ZV9iHu8XTJJq13dA}7*?%iaIj<S&M*&dH|{iB{<8IU
zMBnW9Ue1AhGd~dW)Z0_Jr$?B&sDXT`Vwx^ccs$>mr<ODsLOahvj^RRC_G(KM3m3HN
zwqJw$XkLF9Z<@ARA7i=x;FfhoO`|Hi=!w*<`N_<1>Wf#0@jpm=>wqZVZEaYP?od)%
zK<NhQMro9i?oOpsYUmQ_?(XjH?rsH!9&+gK@fZ8-{hfWzdC&X)rH(T&&wbx(t!u4&
zt?LRbqdC_Jy*}peyi!4Y!VT0bsjI;Gh(30>@a-2LGb@$a^Xgt-0s1(qaO&hro|mEc
z3_rW))vZ7WJAB%B;wkIFvzn1xGmDn@V~N+5jOq>cWH=re-NJ^fajy-)Q>z6g-rK)W
zceXXeVKLHBq*RQlQ4E+V$~u6u>Wf#X<N8@0Xq_S^IYspLW+zHlgfu@^gF3#a=HKjU
zzpKJVojclbE_ApF=J}Q0W$TRiN*&~2$SG5#>~a_?)+KRuBk>D8xSV;kugX}aLa!5+
zVc88tqDFlpxivHQOTF<1%LDV!bWp|TN5-_eC-0Bgsx4OMu~$%W8vSx-9EBCjX0B@M
zi$iXn;D#2Q7p4+h4#I5gj5iCeufI9Jj3#j>JaE$0+bM%f#vAPiX~!##^^h~}!F938
zKufLZqK}qa(7x_6N?3Ri;)W2b*RLmE19wy08SW=<SAO)qN)0_SRWQ8DihaZIcDueU
zyX?3>4OM@FHM`#Gis4lwUU$Fg$cKym#SJ5y9_gWwO5+3j7x6FjhNl`ATsHXSZPrF3
z*ikL7bo6}{;nEG=qoUOY>X>`-jK5YqopHXxl$ZG6gvR8b#{%<4*rWv0WIQFj!=K^B
z3h2-K9e{(5Gc-M&jQdml@a4h$%_^CN_hNeDmCyrN0XiA!)kD0c+h8YhlXgdPOMG#>
zN~|FCz@brN)+tBxGNK^!3!qF3Iq`l<P9Dimb3<Wny}<Fh8P?sJDf~3#S(q^vS6vO3
zA6X4|pUVqP^a}`$uS(JF``ltjNUyh~a~DEUgnP7!5IT5?k(ao29#?4@?EK|j`=^{O
zlU19ZHfbeEmD=}6a&`G4*~A5sCJTfN8Z8Oe@sbP+_G#A3W?e)@xN<5BEe?bzVRK_8
z;l`hN2&2{}lxo8Y<bM*#Ewnqm!(-Ai3jiPKtk)or*i0DaWz+pmR`2#DG@NhHrsGiY
zZwNxWtdPZ3vQQeOmHPhvl|V-$Fd%g}8Ylb*W6j?KQY*^5RbsIf=x=n|f$1n^WCmb5
z%F%IpKAFbp{0JTnJ-D<(Fw@vZ+U6xgqPa!-hHl(X*gLrRN(CoiuIf)lz^UN_m4DCk
z>OAexSUF`aDhhkj_-KRu^5v{BaEtX^`4>Y5Ej7HdfRsN7#D#@}GxaQy4@Lk?i-d+|
zMNUrsZTsY8{aNB0AO0nHLP?+2x0Get&2!%f-ujX&;c2ybH2TQIGjWm&p^5LrM3L=K
zJOYByOOLnCw7{i{+@IrCpVN(P=72PQi9r#}mN{kQBOMb=!)qm$+YK9wfJ^uAvY;kj
z5zM4tUe8vwGxYy2EBr}1LIKP|wov4FR%kUJ{dvo0zDJfcHSH@GQwQQsy07|4tsE?)
z*eWRJ+EoRY^F2bnPT{9?c5UWs&J>PhTlUPiA71{>ylaGGXMlo3omA`!tcve&!FR0;
zX$QjJY|g(~xm&~NAn-*$<CTKH{R>IVmQ4~9Al{RcoBMWjT1|poTi2#(&Fz5EXzh)#
zL&@dX{e1Y2Ts$`J&S$>+medSZ^bgf<%%q)@-V`7YVyu;P7nQ!q$(}2`6sXN<lojh$
z57;+bX?GDi8rPUGW<k&8Qog{Jpx~=uU%0J#7yjvez$Z8F7*STuygF3~0@2rK^ZMMR
zNaXh#m@<MXtyd6xRB*%#^hHUxHx4ORAFPvQvo?n3l=3HN^6CrdJG&lyJf7I|#!dV6
zeSE-NU|uk5cr{OF=hBY=1CMo>2{lcq<&1WO5>Z_^NOl@b?~<%3qe2J@)9TNQ^+;UG
zm`VuA>2<JDPL*2LD8@}3BMQ?xH%l%r>i=`2D(1C(q`$(`wNfi<&?|xgDin2qzYX^9
z=4Lkq+4&1Tv-c-go&6pb5o@4;wp=7FAsF_#<IX(Jua*6gHi-wPHp`vrtscxwHtIo~
z%g%aJKYuaEeM|c8BAZZ+vaBXAR<G~=%<~z)ykcZ$tvatMQ=RQPQhoIC-h?UImm;4G
zD$7czVbzhdi>%0=yhoA>w>uiGV9OFv4UIS9ngut(GPkX7@*Q29;K7n0!*UBcy@?xT
z)j-&NC{V{-lPpoM$4Pf23U-Kt)4fO@tw-l=!3mwWG3sv&qc%f9U~KGY(_>wGEWqTl
zUPikfJYP_Ce1ozad0EV@Kg*Blze^P5YRw25U;S2^9B0t^Xg3p^oAs+d)t<GE05LDz
zr>qIjB<}o^Hce&DSZ`v7td7L{K9s%}4k?nU6;+W8NWI4gg@^U5hTR^RRx33yxU@`L
ze(`t`=^Z7x#g%4DaN_s`(Zp4lQrnI#*bkt$xRo};G+~!Z-2vM_n|`Uco8$8L%SonH
z5+MiD7;b%+TWB!AP}P;TF#w3r<l+SWcSWTnup5u8nygmUks8zuVw^YpCskut*qmnp
zqYb)-*Az*$$ym>;@lBveO?;c+w}7h(XSi=a@(X>|XYQy}Oxn?!6Qr=p_wLk5^`*IK
z#ZtMsv(P2A5<%O3k##U7Vz#r?=6>9}mP*fEjO~Rd*=d;vmMc3Hb~pD*?kpq`Vi46*
zhjIe=p=yn!aj=qG+l#oLY7s8w!cLg9cF@?%#-V@gP%gmiQis@quo<<fhkcJ<kAYp0
zePgMV(_k?-M>|=t#oqmKHn-u2rMUT!BSYF2$W`XrAZC}~MdD|eRC6bZ6@9C-;jQy5
zEGtfJ0V3J?u(l)n?3NctsqtrR=;73v1a(|+mVsBIl|HTgAN@p9Z!1F^(~`?HWRL}K
zO7L6q<oxFSMF6R6gpg17EK`=OT;(ajABa8l=~^Ou4q)|4N<ctyb%ngh0hl5Edw7&?
z72rw&tb;LgO2bFm6xrPq@NxgdP!<ecs<ex?KAvMO6>}FXRalFB>0^wv%0}pOGsCg^
z%`3Z*R$qV@GpEgcXrrNHi5xc%_DAADrSZKmAS>c1$<st)lt}2CXgUR@nPbtj>yMnY
zyoKSi6>X26OZ#>(8k<3*#RqcOMPK{{(4c+ck*yN6k8$fD;ds`IgowYkF!jR~o&8E8
zb8kpgQ|!s2#(A+X56^+PDnWtInQS!ga$+^eXD})vnq$N_mmmVyxx%ni;&xF2i4GCu
zTy+%|=|L8@NCJ@B%o~1HgjwzhTN8NCkN~a8Ui;;vRF+mzah(KK+IB4);9Bv>2Zk#U
zBU@MeSzU$mBXAY9iTvz|ef9N0bP%YPBI1)6-^H#1<J5Zf!_Vgf=(R~qhCV`hsk!;I
zmihzXh9AnM>L0%@enB_D9PgY=pnOf53d%-yQ}t!f(!Q3s2aCpTQYuTzNdE7fxju`w
zJ)}~0WeW?Sb1>paj*Jiy^?21a;1Cc%1#0CM<Vqq8;jyX9%3f?UFu*419Qo|>+Q5*q
z)P(-c3#HA@prE!f6g?XxR203t5EIE^GVDwd)#;a5{?CMT1#`!*OwWxPV130lzOLfK
zw5gt7o+g&@1rxb2)m)Xyw@xU$+7AhrDnb8QxOw+;Qw;hkEKpT0uz#OQoy!y6+xY6m
z0SiyE$=EKDZX$lzH1a-I6KF&jjhHP3^Q)LrtUb=MVW~o;vkf;eo)X@b$6g1sbU@D%
z>}i5NeRYaUyvgf8N4B3on93ySXpVCmsWIlb?!HckM#_yT*|e?tDTJCYak99$v!yUp
z>4yWnn06q=o7RN&=;Zx(>8(a0_B|rvKN1wRmA(xcf(%OfX=e5*D~6e$o5+xGxyXsb
zPv1gxG?gsth{`QYvg#Pqf_|&M%^JVH|A=~%S~?V><r3!5IajS;kjJMjdp>TH9F85c
zBdRvIW;&&RQxs#R5iG5$?o7;&lpKL@)~rQMC_=!y0Ka<=TX7}KLMKC6xhIY`4W=te
z;|i^R`1rf<-svyx4gY81y?{e4V@gvrw-z>b42Le9T6u|1@t=n3R*R7q1TYJmER5hz
zx(gZDEOe>&GwTnus_V+o1o*}M9{V)c(L3YbVw<;m@FmyP(v&!o3`-yIx0*2dZu_Us
z)sFB_uFF|TDNHGH<IXg!Eg8ez=`XmK)X$s8N$a?c@DPBOeC-a6a;Z@7AbWN0hL>51
zWX}VShMOWpmMb4VIcC3+n>{tGS*yxh-kw#ND-z%T=o^ZzIUc|04(2f@$fT1tsbfs9
z63^?8Rxy#uVAJ^f20-2hfNv|L|04+L<kF5#nA?_vOV{v6US_69AuM3*=F@v}G-)&F
zf*fm>V&T@{J~^%j+g+vUKD8kxgSNwk+QK&mkQhj3uxWj%HmXhO_^)rt@6Tv1(mbE(
z>#G61;*#V)2utH^TL$xq`<?qHqwHF)eW;j@(?Cws&Ko0O_S3^l8hMuPo#ByrDeqe>
zOR2j4we$J*?Yx6!<jjCGei4m=t~#(BaOY#5fiktbg9UHk{yv6rL|y6Aiz&s-Y0+er
zfl&dY_kqb`xr6=yt6D4usxpym!3D6JI-<aI%723<ezOPJQvQTf$&^<2c|Qe=*!<nq
zHKA9LB=Y}88clk^ryXteuvW^4ZTE%PHvzoFn}>Ug=G1#<Ti;iQDuQ&r8uCP3J8IG7
zwMw|Dv<V$QNT>XfSa$PVW7|v^uEp6^?@Y(mq=_q|zvKZ41zj@#>EXFdq;_}z(>-@r
z0vJWFujt&8c{9fr>;CyYtF<s@3uMQe#i)l3dUtDZvj6K;&>QY<T&QF=^xC_iCRq_&
zC!D+JFI|otD~}4?MHO5CRCLwCxx@a_G4OP9G|C#X1^-=;iR}Y8`hYkS`{$TLAkavH
ziv3+epm^mKcu`mIBJveC?b|4q2clAI_4$Mx6QiGM(!=$JO%~C|-Vx5KYMPdkZqdha
z$R#r2;-6Jf+Dom|J2-1+8@`;ekO>-(cYb0~Lf&`6Y07%0|5idbX#!S76qtSjFm+uR
zT_b!E95CM0C>*;7$ld__<bdde8$e|a5STL?GC%uQ20l#9<g%bW0&#y!>!vmfv%KMu
z2{U(PH^z$J;ymfWG(<qy{I{|^((cHy$2fGOFaN7Ct$l8*CX1+kK_jhkoi_|)yR9SZ
zbToBVqxo?Q+Uj_UpeXCKgqBgn+rwwFYx1r52N17hiZ@Jex>8{L6cx1t-ib*;Kp<m#
z+KS^ZC^!+LVzw63xtLuS(=&O)K@fK54lBB@8ZiB&ZI&Z{{U~X7w2Dq}cnqS?ZS4B-
z)XV%&3uF}yl@{M|Vv6AJ-npE474Ujq5$bx|FB<j4DpUSClS~Pk&!&7p+tJB^sg>J%
zXG}a2CyjQ@4SyLYigwCBh^F^S(A?U3`4^8p6^+L!MHWh^y`GiAk9n5ov98GMk^awX
zjqU7HF<U9f9zYt)><;EPtS9l{uA$%o&Z?hfx$^2#ogF4ammm;andy4gr{u|jfgy2=
z5sAabq^`Qs&hOZVzG_+#0fx7mphCRhz+HWBbsAXAk>0f^D`0ltV8@3*eS`+>ND#Ic
z^zq_^6K2N(HDa73aPR)3c)C_FZYA{_1-<}`vQWjcW}gT@Rc>Wwug?a!{}<Hsa%!Rm
zl;6L9=dovH<!+sOWp7^@6cH@((IaKbp_k@0c@^QbBOf}rur!`UTUmmT5F3<HuGa+n
z{601>R1*2LGLcF5O2_tuk6l}>tjgLvQI1)+sXi~%_ZE%MehZF`ot=z@?T3*Ohk~11
z6Ao{rN={xLmyEP@2o75now!ax28QG8>jfPJGg!y@EMHK}M{Iojc?J%HU=*Uh;&;l8
zvIFlJsPMCrI?gl#v=*wQ=3odjk*@}b^dn0M*}i0sl1||!O%32E@Izh?5B{*dl2_xs
z%e3K+yEq=muSLGInT%QsBmERPkynx9N>vv|=nrqWsLEg=lWhJT)8)zqG1atUUaxb4
zLI&Ejf99e!RKu|z)y9P>cK!PFm)!HFbMS@^6?7)bjg<Xbs`I-yVW?;5w=i6FVhfTq
zvlKB}K@Y{#V`IC$b}SX@NrDZ2WR8#&_k*jE*D$8}SB80^)<1UrT=Qcx6k3BuAF1yj
zyzb`D){flk4#uQ)E_pb5(SPmmswaHlWAA?1h_El1RXHP`S8Uk)p+H|U^uF{fzS@-_
z6+$zE-g>9+Rzmjz*2f6=);rcuW+u8!WCEt7Vvd=!4vFUK5l5`|)zwV4lE@aDJ+cH6
zA4af81hHVW_dm$;6ZA`~&Jrw?F?;(;0>U9miT@y91tvO`{|tZEGY-AfTj%RfFFL_<
zq3iVHPe}8Li6Q9My|gE-KI884Vy_8H4w@$&2Mjz;m++w*;cAeWeBG|RRbmKuAv`D|
zr0?=;Go;<SJwn2r>CCuZL1R-(9W8?CRS2ZGZZo{SHG(n!0jsmeZTsgVbpD{+@Fej7
z$q-buYI?FYux9LXv~Imgh8LmZ?S`$u|AfOuwi-g~^*~5zu!Xhd`KlCALDXo&zGdD7
zN8|BQ8&H?!<8c_p6v^~5d+6&|-?)e0DgPYo{cyzis`W6iGyNVplK+~Rf!_{(SKg|7
z`RSf7uY46zxBXcQATz&kw2hj6@VNIFYFe?6#;%7Sxmo)3h@0+|9z-v=*5G1BxOAD|
z(`GIBEp*<*q@ir1!$RTypq+%Za-Nu=3i_<C<r<d8R=`h2ZOrg}p!2B&w{waq!eKI(
zHs#PT{elD);bi5yU?rq5LC_FGqwZex=Jr9<<0FC>BoyCn>jM7Qfi8Yi)F;zsVlHcy
zwlaHfk=>*C-seiK1nxE@apj9a#>MgEy><u97W)-?%S)FFHRiac+qbm?<t44)xSFv2
zx*B0eOAX1DIMvK12|4Em6E~(nCQz)^r%QB`Vba+n3&L4OOP~F^+AtP%I$(qKY^x6c
z&8}<0#!i0!H?M23t;d10nh_x*dcA%91`|&@J-Sa1Fl+9Y_Og69VFmP-r*{gwlo748
zM(g7DwGV9KWa*Jonqzw9N5Y};%~ey*XgD#SuyINJRM(%7F#`Ma=NraZ&AMNTS3W#K
zOxOLcgE^s{)9s@Dq(_ho=H-ehXAYgm8^eYX>DqZG*)Gj&uC1-B4^Xx1&q(hC5!>C}
zaVSN7U67rIH_wAEmi^N2hmb{JU`l%2;1&2EbQ@|t;4S5$23u0h2A!-zaB#X(q5bIr
zCy$?jim-iygC2(0`KBG*&7DEK8m-6A8U$OmX~)+buQK(c?L0O=mo(auXzRF>mOq@6
zv^;KMvRdO0AFWQG4te)=^)DkbSAT>giiJ*YF|XQRE^*3!b!qK%a6N4BZ*PUdX*eE$
zYy@6Sd_5G^YOveQ3+2#1UTI8VH;u3!^~0TkVOae<1M6~$>8%%EPT6vIMSOpo)$2zB
z$UK=S0#?{MSk=E~Huy#^-v4(A5-1taRZ}YxG7`rAHA?gk^ZY+}JuGfSfKz*vyol0F
zdKQhl-Rmo7fXix|v~Ll-bGT(N>G0So9bAzc5~eAO-%HX?GzGJusv=<(>W*Ug94Bq%
zT9>00<PkeJ;`H!!pJz|cWN)F|33c<yYRtDXDq+f{dj|*eIU$p6a`-B&A8RQ`b<OkK
zqIU}2l$6=IYQR}H%OyHFEBO$5bAnth>m?5=F?jPy0tfUAk2d^Dqd^=a8o2B_--o<d
zS12&0V&g6mipWVS3v}xXJ2iUFV@vY5AJvYo^Ae%QIl7w9*Lg@El<0Hn#Nl`|T)wR$
zVp_KBa+zea9^VB!F1y`oDsf}ij1<FJgF=gN9^$T~ROJ}C)mvl&5vWX-BSwkO@9imy
zan_PeM0Dl0nTE6_m9uyH-tmkH4KXq4^VHfS+@GOY30xZJj@HMF#$9?EH5F~P521sN
zRiF1YM{OKf=Y^IV4s&H2Yb)Hbyag)5|KTV9-A4Rp^EyVHcBDnBrY2@827j#orC2*}
zHs*lbErHbSNNe5X53b_YqMMdju}NkU@dF!h%;y~dipHC>a#tSrm9@_;P-YJ}@N$BH
z-d3%~@Svy1>vlPvY`%EF*!I=hw~nGn{WA=6>x`}`zkK<^;y7hCL-?fuOnGthVQ+18
z>4jt{B70jFc*<})iPO$(8jqN(OzcZzZFLiK=%Doyr0|`Mf>?4{1?+ylbfnkuOq@()
z+1T>p%(pqJlAXa<Z6xuw2^GuJ0o*~hOYbb+rtsHi=Y-sL773>h&IqY;Hesg7Xjc1*
zJmUfpx+F8***`QkvgI2bR-&yTSdJ?qwyj-%A+KWlWN$vtP}2AV=Ii52hNdxT&RXiA
zF(&bkqAyYePoA3;P81*MJ*H86mLAQ%;SF0t6*J*stF|TQT_IitjT%_ePg-B-&#+g=
zR`ip+vl?Bnc_<}m%fjm3P5qX;fzn4RYtWx1)*h=?>RfNJKha#u?w)>$q3#DBY782q
zGBKDfQc2(*48W|!Zneb|MV0kXJP!6uRZ_7Pj*oU%>JC#e9+5u`FBaZt3LelinRPyg
z^Ph;iVW8owI8prcZ9>_pCAxF(&efJ6aqxV95&f5A?Hf71&>MWVAE40R_UWEYoekuS
z|L!pS&L#ip^{}`wlO|H8=~=ByO3(SZQq66$CnzGIIo*r;&6$0v-gX?-$eF4@=^gr`
zXMH3j8HFh0UMG<e+uQB(`tXbDgkA$&bA6e~ZepZ0JtJvNgQ;`V7RG4D73$*x*EGD$
zy$p7Z4THyd2|Cyv?Q>rqZ;eyMm3)ik6oHnW=pLs5thd|b58R*tzVVH&HR`>Cy7ZfB
zVV5*n<FP`xZJKgny$;6_^%j)uzHte>Y5z}_dD|tCLUFQ{TpjBx?IhI>+<^_*obChf
zue@v>ZZ5>yS{!fRXf=?2JF3=Z{i*=BFE>a~egC>>|BO{{<O|%bw(#zgClV^VcB<h1
z=z6w-K%~SWRQ^cEx4Q7<o5*(&=EM<O`-`3~*~!G~I}<5N4TmS8liEU3s@5b`t@Q>+
zZRb1<UuepV2^3@9vBjMGPMdXGQ&qF#5=)Y9EgYPL{JU!2ydWeh#<sLck%&xecHK%{
zszx*YKCEOo(y{PCX47*Mi>CBlAkgGm$`0CI`E_tgzz>H|ci3)$);?{_B-c4mSZseZ
zLMpqs7rIo0#uKg;b}%oWjeBSFa)(IvcmbjJkehk90Vy&&cqsZ1P$^^wge|fG^}hdz
zlxBGc&H7DAsB{&pr5Stz8Xo8RrIN4xWH4<Pv-|VOTIpwp%pl~w&p)=R2d0dmt-P^V
z;+{W}60k9vz*U)(3TJ1VQc@8Uc)?w_{T+KYfUdyd%J|fx%Oq;qwvgN>hr%mlm|jUy
zd2G(yx=FbJI6uGX`~C!J|9Y-|zb+}W1HcaDqZ~E`-Isu-llJtbHKL=`>4EOkQr(3f
zocZ#@i!Za~c$iKrbIc#YZweH?2fqDXr8E9Rvg5BO!$yz^_=}GJPfw=@NO}CHcm07B
z{`j5$`su$A!~iH%Fm&nBAJo70a#})UCmU$of@aAz2Zq);OD5MHwc8`0y$V}^zOZR%
zv!3SE>v*=D!VAJAizxh*zZ6FrMt<b-c(dC$wyuzwSQbco42=&{kllUwZpP1VRPpir
z#On?R=R13Bxe(ffGqIon$M=smZ*-ry2zjkum$}_hi9nXPefAV+*mwuyW}RsZDn6>K
zccGaS_HoPFvtFV=j}TTjbC}*9`W>Tv%umDosOWQ$FZ57o4Sqx&br9gseE6=haozs(
z{L9C#O0!AI<)lFFh*$4??YH|D<BrP{xNS*qFTmZSp?DhnNR`efIy#QG8J7JIPNu_x
z9MhMl{#P<y{oUP$C}-1@H->}Nc@a{5+!yN52fVxMll~-54jf-RUD|?deK&(+8wj9R
zX7*-prIFptCGqZUf!*n0_4wKT2_j<w5kv&gUi;(wtZ!!Q`%s^^5Rpnqst7*b#tSX!
z%x-xhS*Xh^gel!M+%XQIO)OYlp>MWh=;p$BehuF{$$@#8Hy39nn($7QyeLArxC-9`
zx6U{nFJs)gw?Vf;fnJoo$?QPu<424kS_`2&@&Ld)rA>GZp4hdVc8%NayF?O~?~C4V
z;kQ><LspTA=!}6|-@4p8_N&81Kkl^#ZxAeau5>vb!|hIGLRRfOFI4dSd|Z=)Nf2J5
zw=UwU?e*SfvOCF4Jifr|uR@^wd|C|B9EdAf%Y^KFH|`Si4N16~&W(U#qI=9H&d)r5
z!<ho5I>vTQkz74D-jAW0fhJAIWYZFN55u~TzVo`?skZL*S(fu<D<vx*7<5_^p3rL>
z-2XTrHM(bf1P+#-hYOW<&d$5CY5asj&`wOExL|4-fV}?k7~ZiGQs4eCTIb-6=qPq}
zHq3k;`qUa>+wCABUNvqw4fR*Isl&lB#7<A}Ur2aw(~z~jg@v2kan(B~1)}76jiwY`
z<H_G8>brOV2|_~O0nyV4V*8A|O3~d6J8GLmLJAgDS9}KRC${KTyqV?seGvuS5X8)|
zVA9}${p#m<9cI&R-obXHP_L$KYd3QjnHQAeWXu#;#}@h**wcA(-6M(Yw!XJRSsCq>
z50+o*F=iNtppb3I<K4;f9DjpIdw(|$a4F;>dPiNm0f|Y!@8Qbt^&{e#U=1&qdMH~B
zZJ5ua7u=`h#nki>v3)`h9x<9EpKpIMb~fqi!g6vV)Z)_eIgqm55Y>Y#BS{GDJOC!V
z_Gvse8Zq^wMO+?Jv60XtJDQ*FU-@k66U>6ev`qSrpjkfZ?i5J)bLic^*=pD?h`zOZ
zb79RZl=TM5#h<PXdv^?}6jwNPv++M|>Oom?cf3825k{5+=XDPeo(`@b<>U9*e2=$U
z&xYus?N4_?ZRvNp`-#422axT4Ynf{%`BdJ3I_pwHupq-<yZ8~6Gzn}WSYY_c+Tke=
zV!Z+mLBaf{U`N1|(%2K%4cYo?o4p<AEis>YzVPJ*$m3qfrl|#UEC7fyog)sHT23L!
zWx6dgdGxPN9-4D!9ULEn63Y~!x=Vrm-cL+SRwTUuWDSQ$c-3vI>DskEj`=8<KXKXG
zzO`=a*iks#cG~KN-XEdc18EK1bSJ9=XXT@S)d#{>>7TD@85tXQ4h|01U5xe(#?Vfd
zr8<VK2QvO;?-rea3}-z?QJ0cHtz)|sU?;4ew+_owNARnh#5{K7Y3|4GMv^#XZffQq
zCi3W6S>-LK9n%q2=BFnlG(0Z<GKfNWOu%n@O<+lQKOE><%V5eY&Q2GXw++FkWJu0a
z_V5z2=};<{JA<ckKg46(2M@N;<50e(IL@0l+S)2yRhho5H*KPfN=fJ#Rein8b<ZWM
zX7~P$!9r!9xD@$bgj_tCdu02RLjWkC>n>^54n82D;)ah^JAR}4$}=F5$(F12J}Rlq
zmTlm|8{hX#E;Nv;M)!{`nG$_TNJ!{%z3P19;?V4L)C7)Di{aB|tz6(Qc?l|Q^Z%J+
z1U*Xhp<R*{@z8qxYVD3b&26WgX9w5kyjb!ybfCB#Q+(oP6uO8j)Opv9N6AD1^W=I%
zEnWfc;d<)5cxY>AF{E>II~K8OAWOTwmU6k9-L+p@Cl<OrH$_@F8N5Cp(M-i6c0ni?
zy5SLg#h;#BS#8;$m3^Roe*uZK_nPLpZ+%b}XMMiw{DrTNY27bI1~IF3*@gdXS01_=
z+TPb2r3VL}-Yvu2>c{N`MWMkk_e+1=`lN-9+F>d5M4`cd3&)j)*;DnQ6|%tI-f`=f
z--zs9)%&S|fE4!WnfHBhuOZLR?MU|K_|4#cZ{J8a*)A265fd~Q{O9>&y$b2B2<J|z
z9lz++Sl!=iwm>yBJs#)rE6y&cYuq5LR)SuH_+z9!#LPl|3hoWtu<Uxey$;m0wC4~`
z@B3}Cb+v5biOT!C^`|;U&sMYPJoJ+dX!Cy<JYXH=qz>G9#=~)Sxrls%PxoJ~7Akx&
zGrWp{T%wUl$d91zmA50RMhhp3yQxF(@Y5sObpKVyFxj}6sKKi=?=z*>)Syl0NWlmu
zzrM}%NdAyd`p8JvYhm+ihv82b+TYd%o|s#%X2`HpvHTKPbZelaPf=LJ0eexFW{{C~
zEE0Ub^ja6#Hgi_!=r$vi=i50xQ&(O$zMb0*Rt<2mF|mR5N_#6T5}{oG9H`GXe~Wb=
z-&$x%Gvj-D)875k;Q=n~))K$vVL5%%Lh+f`{MKhJgOg?_4+<SOcch5XBcJxjRS;q8
zBWiqaU}7hVaNxXG5GQRJ>+~gu$CjZ>_Tzjan3rhJFW&p?O%o4VpXGRchtIiS!qoYR
zownnPc_xy6!}hxurm77ag$lHrL$e2F=kvS7vh#5<YNrcSLS5?23NG@OU5B;q$(-7`
z#=KrqQE7Vj-DHp7faWJ}`iC!`u`ajZeCw~yfJ#By$dmKG7`Cp^p3>cOM2v+v(nrNw
zaERP{aSIDNT2>upfj&xV#+UY1%Rc}HE+!_5;8EIBa|;}~7;G}jQXSd%@*-%-lKp+`
zF)vpYYZHE8tt+;^KW}kk<ps4eBV=ak2W1{pW>LA$QVQe}5R%fVu!6`#JZ+Sf;e35z
zv0rpu;o|hj%}>h7OzfYG8}_9QTk#2*G^O?BR=oEQ3^*;4&=nGT{QTI~c6yHaQzfCT
zZofAwY6G<2D=g@ZKJWQ}O|XYZ#&rp48!E=~Ec;wc@bKW_I=iKEa&UTn>2vL<Yk8S9
z?x@vdRH}1fQm)<X_W5(`LY1-QNP0WL)3x`LaJfz^RJ*j9a0Y%5FdZY!+Z|t`8%z7U
zfA-f+?jra<PP#H?uf@dNI!l)v1P;-`<{c*cbUuBe_djD4u*k@sYR5#}wxWvS+K(E@
zA~wB{{>E9S6SDDm&O|_LYe?70iTGG3u+B|L!t1aBniSl#-8nq8(wqV`008>s_8dHZ
zz}t?(39v#J3?mogNXvlF&KdWtA`xNxrTOM&IGH=t%ZDZdp7@{Mj*tkq&wQXCa=qqW
z4meF+d_a5Dw#lp+C`@?L=g|uZk(FxHRxz$VEY#bQVUX||X-;+hjpF|B>en;?FkMqD
z@+R;N8*XwWuCUwuh~AeaG2DiY$E*|4k%83HNBy;}lusKNHubeWKJGo@e|x75c=A7y
z<R4E6z&)Z_WtCEU%!0c(vZ)L{2OS-qy4-TSnSmz&dcF+_4Yjr`QBqX=_U`M>LR<~j
zKQHjDQ<nGBV~g|$RK_-X5iyzA`1s|xBm_cM3%zm)Lm&s)L_Uh2@de;g+iC`FZNX{;
z08HPD94(lIjoDKE(fGAf^DiNWOk{_in|r=4CjbvqQc<e(BE!d1v6dbEMS1W1KOpcQ
zUtGfs;<ycr!|90SmoPCg-HU{l6ARrfj$3_QU;URKnJ)4iKR-WzIqtYUgZ0Ub<uLu}
ze)syNgDfVS5r?uOnd;)=VqN>=1K~`q6wn)OE#pkv_VjSFywjHa&(GS_zOB}N8w-F^
z<bBkG)6MRo$GSEQ=jw8%#`dzi)<6E(x!tE+^SZO<N6MC+oDO#W%ELgk(p*(FRd=!a
zH(=HPzWw|InGt#0arUh<`@qU8eiudals1ec@a>oB%Q;QkO-Uz;lh>DCLB!lPr#@9G
zmEKQYRx1sYbveCi=>M{LzmI2=w_N<BS<h6i%*|?^>-o;&+}cA1ox<!w@D*f$Dso|`
z%}X|k1KHKpwJtZ1YR|{7riOz-vktBO;mGzT^@!E5@AT_^GmFck^IL##_;;KaaH%w(
zreT^|SM|`$qo-s;*|Z`e)aTTW<`}O-#;hkQN2*I>QdO$7N21=QPGn`%<v^$Geu)*7
zu=gIW%27b@p4m5hfeU+b#SWg$kOoan_?wW&;!Junn^5xRSpZq`?ahssWga~RD>_~%
zd^Mob%Itk36GkdP^zPleI^Er5^nDs%w7vS5mUAVW?W2A;4qj7cFUs3)=}u7m!tAuP
zUOhe3Ky84Wpk@QuAVls*NTm15Z0HdH-fjXOR-M;><z+NNxn$=r8L2AzPk04y9Ow)Z
z8c`aXh|}fP0)r}mhI=ThyhQ&-d^`AC#VL|Y%`F_hA64ZSb-qIgveZUzt(}%Vf_}6b
z<SvbUk>i>7Qvtqcx9G%n3^z6wHbOn7j)d@ga^HuD%}?X2b|<UwYNDQ}F}shL5f~VD
zhZm$NswqG7EYBzE?YCB(YLY5Q1g|F?TAv>84q*jxw40rF{R*d7OOSDC^Z@DTI$ea{
znZff9!%^>WMP_HN%BKazOLSVB1`lj(Z0gk7-4r>0mU}-~E>F#)@~X8R?K@c*I_-=Q
zUVx_&+o8S8P(S9hw6uYtp(^Xl06cEM*#2A>p)|Msx3Bn|!cZT%S<^^Xsk1)va{kO~
zMl)(Mi!yMZzHn^3Ol2xEs8MAHX|4KkBe-qodP7OBQm>`Nl?m27*8>O(kr?*Y5!HOD
zDqM%KQqYX@4$hpy)*O5Y*=#-7z7UFbKcDQge|@JT!c%91vqr>1TumY*CTvIEzU*id
zijPOy*4JJ<-s=fnx7F<-kK{bPtW{;4n(0^Vg#rNjqYCp>O!yOkEgE1JT3p%7O<Kqd
zCo)9d%gfg>uBIy~EB7F70flPz_84e<`#pTVLb{}iN~|?1V@<>PZ|4j+-Q3<%U$n_&
z+qOYD{6thX{dEu+=co~>Df=a^d8x?@m7pHyR=IgUERL0NDKbwWO6)5sDRth#HOG*P
z)fx}u-5)!*cLP<;V5MwH$ohaD%R=3RXs9jCUzT7_;T!fWvDkUdH8B1#*>a$`NGD82
zcIP1kdob9ZyOjnPKRrWBVI>+|#hHZ}86v^Ju3OKcZAC<a+rRt;9)7hDd?se6_-)Do
zzH%H}CG7E#z07?*5!|%Dje0^Ke{->)djbNcY4o|0A%If~9PjVzJ7bjtoR9Z5u;cXH
z$_^1L@_ycoHPAdDcKr4nzeAE7(16Flg=q;t|I0L?P=5z}Xi?+hjJA~pdwLR|E)j~S
zV9={1l#;SLK<4B9s6b+Gux-TOwc~x>NT0Q}WoM#~d0%WuTLYCt6o-=a6)V(qq^})@
zZ3Ml)BE+`4IlMk>jqI|9Fo{<>Y6_$-oZ;Fzx}e(1uSQl__MZmQdim4pS_jaJjCiDK
zM&LirBw3%!KvQ%BbRX8S#6fJ&@mxs0*1r<XIkDlt8fk_qh321ndqdyOrM5;)R9HeK
zLV-#6Y~5^YZYPFAC_h(fhiSWc=k98qc308oGAK;)Q_eUK6aitootZzNn_}c5K%xs0
zU|P8!#w~A^7D*;J1v`F!MwQaC6^`1Rw-w)R8-VY9MesQ51Xsptxby3t5J1cvye-#s
zAO^v2tS7DC1~tbww!o{<{;!Ou)$5O#hzdgYd7(|I(E0X9W6h6<wdq+WLN+TrYd#FM
z##%LI*xuzqrfIHyT=@Zb*QUS4$$->vYD+%*-884eEd1-9eyX#XFZX-rAJqBoNm^#7
z(et?@y8j8$8ofr`F2ox*7~2tpZbVDj(J{c7;$4cWT|MqC@Z8@@Me4UlVlt)i`Aw@m
zx7VMByT2c0;&HL!)41P!{<>GYD_h}#5ZS(Rfv=KtEzO>w)a&WZ9BJFPulWiaJ&W{6
z0`1>DcNqNP5zj#v<4={5mxcYpWIV2A;y<2r_#d;_ePLk%Cc_}wG*|f6r%PB2E%d&e
zNN>N&5xoF7T?ydQ$q%@6f__MbG&niDO@pdo`h(!~9~Q<>dkc=BWbE3Au)bJW1ion_
z4yDaM!@c=$Jj2pjkmPNJLd~0*HoA_@U49AKoI<WTPtsgqcOy$hLv`ywk>$*N&X1be
z;3a!x+lOQGk;O)`yX)hwxmGDsw`mFIqP^zH)WZC9FQRm>+qWm%#WgiEbpZexc=cO<
z*9BPRP`>b;B7Al>HXiiZ(2=lQQxkH*IJxQXH%<OI%3SIG(3}@WIW*PgbT|fvSh(pU
zBg$c=ZmcLD-WFO3LF$Tn-@ne!A?He(qXod^BG=%D;GnPw39T0@%peLb3K)p}<lKJm
zgk4Xc_=<8XK{uMVmDLa6^8}Mh`bbDfJ(DkSA-7~{{S&pOn<r!)a`Q8uf<Yk>{_W`i
zhjIkPx1EQ3*ZP+*k8?~^zKiQwnQqaZ$CsA#35jQh{a8pR2al)i$Kmv9o>&BSsem%5
z3XKY*jxhoQc?ag2a;wWFTiFeCbKe-y!5moY7u>zAO-7sdGixe%c;RS!w&s2U@oG&;
zNvUwZK4vCCN*+<u*Uz*DkNMrU60sQtSp)FuIQ<_UFBLT8u!`O$oy_DLAvIx@%mheN
zYKQmqh>xVaixFbI2^6}Av0kd#^gg(wC?I2S^Zf*TJpZ3Q4iwXLrX^-QFPzf_+_`LN
zC7cTi0^OVZT+4}bViKpp4t2SFsQYI=UP6GU)%~q=^_SzB(VfKC_2@i#1F%4@a2}4%
zud?ZNd3fR?$R?CG8+Z8MRB`KFERB0z@lQ=vw^xC)inw`6-FRa`DVbNFX1e(Zi|#l-
ze){B!m;->fjK2aE6Jwivj_FVGx9`NZW!`@n?aGeyN*99pps@aM-ENzqd7VZeV8Vd$
zihoE}3k&D_RCJ8y$Wz+eLhhtPKhPsZwQ;WbZr058?Afp3$y!UbM?#~JLXq3}+H|)l
zUtZ6LB13Gi(@w;?cYqVU`p2_qtTboP@il#Nxnkg4x~?y^7922Bv^^*0vg#0ex>2~_
z;cnk__OjV+)!>k<w^^;BrL2Xj{=)@ptSo2LDb1*cfUKmYrMrO9k{fLngM|wH7K@8y
zf-$f@GSSt3F<f}~dzCrhNv(e~3j<Jv30TfM{YrHgzVbHDyRBF?oz3tK^9?hL?AN{{
z_~;s?^9KOb7CFg18c*dj)yxj?JY1?p<#Rr+VKmR|eINt8&~GSRGqE-1TU3ZaCOCp<
z>vgqg3R$u&hg7~f8l6ss<NWbdm9d!^$Eaxnq$fRU;NVA~T9=eLyOs8j^{z2P+t1nn
zI00IYUU0t8#}EL6JIf6Vj-3<(vzgoP&(x0PMNlpKOUK5>>ZpNb+xf?Xug7K-wPuP1
zo?!^+dO#$?2v~icpM=qu$u7vBM}I%NygQ+cY5ej_+D5v-6nYm8uq@O3+}))g93Hk5
zwXr!S5y50D$fzW<jR&M3sS^_u<*=yu7N`(@)YCFDmLfZp6=!_yN&ETpC!g;U#gbU+
zucG(w-z(yfk*&k+`%1#28`(q_4HJqUUn>B*Ws?p-Evu#Yhb`6L!5Wf*SnHFOe?udm
z5)`lFhU^Vsi_Oi=P6=o;!3-JUDsr<*Y%ZPIefOQfUa-7-foBTJe)33KQW6oh18HFf
zhM~$tH^x<zkD5MP;*SZvwJU;ffO6YU<b#BS1n%Bg2}%>6g@UVVBhJ2!IJ`>v@~4j<
zv;3Rbltl8@NMk!`+R6rL{C)DQ&Awei{a;+wvoDPmxa0o4X$|RqOg1x_yWe1*yXeYs
zaIM!_FE_lO?o|z44iy3r>^;U@DR4ZKz&HhH_z;$aGXEas9=hA+I~rj1>oO3E9F|p3
z8EszDRpJ-G>1N<~iBjLg#zJxFAovALu>Sj$<ciuza7C!FnN8$K{(CVSPA6-rYM31O
zuc0$Ow3kuxNBISY3PkLY;-5opnF_|4_oLI89IgNWy*&Qzj^9u!Z-lkWN_AJmP)DWG
z`FS4mAT!V^ZS?!5pQ&rj4x0{OS4YDK-d>KE1g`4!BWD{8koJJ1gP~NWe65HaEle%x
zFC7MVmGxRN_`5K*tiQ)(y%e<~Z0vh%x=fsco)AT3Kt@>uHWv6%5S#+IFh%49VQM3P
z=>a%85!?mTBw=a`SPC1sT5i{aQs>hV_VF{)Df5L_yyG<uPg%fxt49&=RcCne3~K}8
zD`vP~t~NDR8WwaTw%-QzX>@ftKLx3v?q;auM+6OVZ}hCBK`+<&GG>fAU)4vOt<ND>
z%Zqn@RP(!jdc;Jt+XFd2o?yC^$KcEMX@wE(gkY4CRQ58z%(K9a8zTshAX(OXfDkB8
zACx^zHlI9$_TU3V*WYB+)Ott=LI=7ewLgLJ?P-^Crx><u_GVM}W>zO?fcmHuuso8=
zqQDAZXTEq%{CmlM6Vf*z{oN_?2kB}y4!tO~I&7>NvT~P1L61xZ4vQ$Y9&BtBHXQ|S
z0i2v3vl(n`0nlin)-SK!&;fS19-sEs;2;Bf$NYipGrYXmna-0+`Bt)^W>o7_WFgs=
zu+D`@$rZE7fyKnWny%e+?ftZxqOvst9p!{~r!fILQ<wQyxDZb~eKjkJ;aQxYulqYk
zWapc`&Ecu;4u{V{6d4m}C%FI-u_neRIe0Hf5?|5uc$fVeb)HY`dxa1EpfOvj<^s3?
zhH|Rysf0Kc$}jPV@;%hsCu7Ts<_%xbKbhlY{*Ox$)tGg?M9kD>R3z#+%P5P#47w^$
zEK62GCd|ZP^O2r_yYi(`3{DaTY9vl(&P_JD+lP+fB!u%78czJPIi^M}79%W`u0^~h
z22Cb)>L(W(z<E$fQta2EKrc2qC{Cy>GCFu;!8m*9K5K{0u2T6>!9rNNWL&0yS5WQ;
zk*Sf*)$K_&i<hnrYR*)1&idpmmdr8jNCu>lL`wfSzE$Ke5z4ziJ7FL1v?aa`fw65D
zjFPk5xbLb~7qI1O;^QT6o(e<H7V2&$>1R=zGQ1#HLp$6B!Q)Ts6_$6|>UcaalYcm!
zJJFR~pXAGsLH%}65lt{*$Z{pM)2(d%?Lf~IjbMft(UV;<kt`ghOpL{1hNb6)az+y+
zx;E`m@6_0;l0Mhl-Vnv$mzg*WKGHRCbilmA7PTTWK_(81kMsaiY!tGxFHHqLhmZ6O
z98jF90Ng`;xqVd|@*!$8?44*%Mke`NeO<d30|AnW<;D7Rqm;@?5-aGfO}ME|#7jAe
zWp{5lre}ksgW%{`DU}Ugn_*FXWkh(WMg17b)B!enPT#AtG5v%F@Qo3n-E1=_WL9PD
z^u2XS9Ti=h?N!H32<<>O#8T857B4{gY#*)nOSlCp?XBuoqvslrF~B;fH<%GOz%`$-
z<nY|vyq>fvLnXm8Es;^x01YEFu>a|C3?+$%ATbJF+_=Mx&9DpKIts4_dAP;)&HwhH
z@n+^`w^z#ExztFY-UCX+Ly3JJg>4_AI*SG_y7$5}fh<X4A_T<B6|DO-O;|fC7al)k
zhka#IJeA;goo3_X>{c!r3n{itkgi6GHNkckD?b*`KL&A`=N$+FwHnSW97-Q6;DXrz
zFlQVQO7Z%BbLsl|Miy3fiTasBKv+Y3=;NpU-NL45o921;1BomnlYVK18%0j4fL^WM
zi1sAZnBb$p2bcu%&jG+YLvM*>a67-l50S>IW7Bow6o><c&m>B%0~`Adn+^uIz#s64
ziNe%ou<jzb1>$lUKxKok?I5o>uMBT{-2+eUYw4}(C(S@2uJBc`Z~P-WLG*`rc5a)<
z{uR?V`(Y94L@D9(2|gN*EBG>qZGJZF<r{}BW6<><enGta#OqJv!s77h{g@i}7`ZC4
z%!|9ux67DOiXX%GQe#eglI4*wWke>LDC{)c(E4{Ay4}ShGRqjAMb@}r#Ebet`e`-E
zv$N2IEFh@R-kyzdMp7~H&zxJH+}n-#DN#gU2pCBpxGB5tAw!s6{t1-N1r7RtRzAQ^
zg;phYx}zaJz(NiUBlRxM3<<8r=o8%Nz;XYj@B9xbK&)J$muIEUgm+UJVOm5r{cC@9
z7-;!h0gZyeKs3?vmu>+f5S214jpBddMi^Lr1#DFIr}dlFSGwFe3yH)x=3}?75_T&X
z+iMqB@11U8l6KzVURC=Q_N*s#-V_`>tGPcIXZ@vz^Zg2~lX?Bb@6A)I8RX|Wi%9}5
zsp}(^vPJ?^)wnH-Hs1=1hs<kwWmUuI?)1~bZAFh;u+XW~lV5>p-oaphYNF0u2e`dm
z<a--IyA{L}jpQKWTGx$;cFLh(sP)^f?iVRJr8n%33i=lX6wu9UFTYoQ$hP%R!n4mJ
zGa2Jzp}H*~4b{{86NPlquu1<IL&0AEY~=bGrvK)!9)`yymJTBc`m75~!$#hpI;I5E
z|BO^yF9R3R$&0H+wzg30uX1R|&eB{wK44;h*EDC>mP|>7!rYz&Ps^&Y{}qOT65s+5
z$~4VW;FoW`La>v|AbjVwwKP2UrMM2Yj=DwGRdItW!D+~h)%`l{$I9J+hbiC)Z6J1Y
zq~&$wuKB>OeXV4cSBxEtg{*8KzQXX{#E9f;e=>WkQuodWe~Zsxj6OU5sV&#n`Nk9$
z{VX+_xMBMvGEm2B<As%jYZvDW$(~!QzU}dP(XrZCmy%($z0gk+S-s_0sc8XY<$}Sb
z(Yes`ac}=m*o6s8k3!J!Wx<}K%MSJvbP<gqbSt7uY%Z;k&hIwmoi~bX7DE7O^&_kj
z;alj%uY5aRnMfG#2MWoOci~^@Z?`@BR~xvhNkAk<)NKt^W{~BG_i{)*)sbyJXLQrn
zsQ)u&`FpV}Q-qn`qbUDwy<!4@T>V^ObEX_no{a?l5nkZ`J_CoUODD*}qG$qQJDzPE
zud{awUWd#S3&6;{NW1r=Wzb4sNO;_|h5WP?g1J+++Pk4kyE$r~XkA@~IvzB#^c{+Y
z;y(ox7v8vl-5DnqJF&+FZgKtNXS0@zg?dd>o3no{13dTod6xBjAS*P}EECZuHLoyc
zH=eET_I6)E_ie>tIW^RpgSF@552yAydvbf-BbsJ9)FCk#8>6IrfUc^_2M(`$zunD+
zVs=v3`}Q~NDr<Fm$jVtj_`%P_VfK;kK#Ki_tSl;7;4hnj!{O7K0sJQoP|o%vndxY@
zU2of)&L8)bIazCM$BT%FaQ64}>z>b3E7#FYP7`qVvUa=JvtOPF!qJVlS#9#PHp>Yq
z2S&lQc{rW`k}?Wj8WDEwb=5!44bWMNhOckiWTZ^p=^G`mx5I+CL&VN5Gs{yCT)F3}
zt*8c9+)KXZbv*VLiBaPyu`Dw(o1^Zi+(l7dx~*$Woyz=I*!3HL0qFI2ixdz~fA=Z<
z<8QzHYz^P<7)s|Eb7C{NaF8f$mJlXAjuab#t*iE*&bAqjb@nRwHV%lpe{HKMwIpop
z8*DlyoC5z~#o!p>|1IqO>j*8+H}Fkz#pYo<XPMHGP_>nT3OPa*&GGEHFZSgf_HE2!
zfVPutpr3_`jsif`L5jfu>X!DG{sBj)4}b&!h5rzy{^&1V07q9zsq9Ow_<!OfS8Uw~
z9KTSZ9Dxq*dEMf1YsjK|<!Z}F@k*9lf{t47h)u@~h8^o?crs0EsUZtq)WJe5Ia3^>
zx#s?@alPr9fxZ^gB<7#x7g)7qm^PM-hcKl?oiMKacerL*u5Np+r&%2auo{}sItMq5
zls$r-IL%ZVF;MyEMReC%Yzk{a6u~d-|J7-@Q+$sG^k9Kxq6%pI{xg|q<ryr1lg_|-
z+XZwYb70dG|86o1j>`~fIaCae7pB(pm+pY0qo7h21tLLGht32Xof0l^|I`^l<EC!e
zv%|=@F;T?mWVP(u0BgDKqKkKzhu#@(L4GiVkfKoZjrHL*!WdttuH~#LVS2>LJ`xd+
zX^o+7g3NQ)BeNHJZ^iRFhi?wDwE%j~dmrs+mFHU8EO3Je<jiJ#W3LaAEJ*L>ORuFL
z)54P#vJ~c#J-jv*)h5V!lW8u6je_Bo^6|Q9%klDNwgFP+5gpd-gN9Tqi_TMs3_#9H
z+In|d$hp69%nwuRh}UpIGA0PGe!_+H((&?C_ZU?0oybUg8L8Y4TlU;$uI_h(;VqQ?
zMb&d2LHE}mhl{c6yqRE87ee;Y(6n*CQ9gz9q$>I^4Kc`Sd7$Vo_frNQ<&!%g&ZWrt
z=W<|p(pvlE7NN<@e}!UOe>p)HnErV)_FTydW{iQ@Cwp?lXceg|th<th1${X3T`;E_
zTY_XV@kMb~*SAzsfeO1L8sKgpLrju+C$$K4eBJ{l$U{`hXZ@1OJv3Ej&~;YLqPEjf
zxh}3;VU6HGgz47?OD}aHqVbv2*Lk$77s_u0Pts8}3@#|1%)IOP#X=AY>6J=VR5b70
z&-9E|Qg>U{$ep6y`s<jx>?E36eZ|z_z$QihPd3Y@<<B5{^|wX;!?qXA2LDL7fUd#+
zNWK2E!-|qqlaxf@bq41Fw*MxH-v7JPij7NS80>0F5p!tARCZ;75rXM)uhpZ*6NX>O
zv^>>~!-=wKj{jk2<%@%x$?8yIfHS#rTlGQ6eHRA5cQR1_qnv?(LDmP^uu0|VV)Hx#
z%|mqJ5ES)2-}kn#SH7*+zOD2@FW?JdvoZ`ib%epc8nz>@yx70i^Q2e?homRDJ_xKG
zujy!B3Eiz6ACeNUvrZ;`n5V3!Fro{lBVkI89ISKQE#Il?XQ(C!N-IlVv^zs_*2;@?
z=90`q;lY*7Eyf9qU)VrPj0my1pPq|F+mlgyiBS#_*NVIPsuufFzhac1%fo8<b<PWA
z{o-WKF9|{c0LEi8KR3!LZdJYg$Q{-nZAq<eWb1FhRyH6jDs-SS5mk3IA#Lj7))+Pa
zMq*03)FE|65Kn3MTv0_Q>`|;w^utd}|0l1rD~<&I3e+i16#`>^qM<63oTDV)(zk>I
zLSzANJ53WEex+da`<F_6aM#pW^-=<BfDQbssbdeFDW041Y}lC~`_f?cCi27oxY^a)
ztH2`+KB#>2^Yu(F$^r&a1gr{jOc{;@vLr^0sL#jn`xub~l7x`wp{ZEj;VqJ5@HMP8
z6xNPRO%8VAUOIx5rjepk61UISo##~tYZZPVPI4iG-Fghn%?G`-)46zjpSUk=0D%*Y
z{n=vL0(c$QUoSuJ&o*;T@&A8Zy>(a{-Sa-&7I!B&B@~BX#ickDcX#(9L4uazPH+mv
z-HNnGaDqe8Vg(8mO>rqs`-bQ9{r&Uqb?r$uJG<Fz&Ym+f_dPReA7A(N%d2>bK8m|+
z#3_YypYKO6%x$Ga`ZDwI^Uv{8<dT3&luvMW>$+``S!7B_{#%Pmzu)jxv4yW_>STZX
zO~HqmtHVDNykW~M>1FYX&91$QLU;m2nQ!V-x7=7Tq;&PBzp{5ee8uBX8GY!pngZ{2
zq}H$XAglEIVkHQn1#u)ewqZI$knsX0_0s=6>xhtT`!pUv0+o`8=s5rY@D=@c((^CL
z{@ceQB+Bc!(!#a!9(mnZXJ=<^UOU(;!g1ft=`awfE8}I{Cd344Fz{(0%zrx~9vDlW
zoadp1eAj<cmNlKlg~ebd1Cv88$6{bv@9hzyT8p0iqsN=OgU@H1(e%aA;pjIH7gN08
zeN7}Y45zQJPdM24zQY@A!==sNnp&??F|{8>=MDr2|0>RRIKTl!zRf(If_T;Ot7qt^
zI0^mj&X8+)#&p+yQpPxcF}wc0tY1Dq0*f54tL%CXB_1q@-7(@lgVk2AY74g``vFhd
zvCSSMhX||W+}Ur=P8vsQ<3YvN%(?Hxn(Q)|8o(d>=oBk-Hnp=12#Xj$TNq7-n6#vJ
zzCrlek}<I}Czi1veRfV~{kr8$)}=8j8SUE^5sWV2*Ch>OQCBlJFf;C7c(gt@z4UO@
zg6hN4Z&?~WbY9ed!jztF4<aQcFDY$nF#dwgmt4|wq0Co@X+UuDe&w8klyG^Bo71|W
zqCtxIvp8#|aO&;;O-9=erue6CavVaR-v=iJ@qLQbR|mz7?y<5@IBbbPA`j07w;PxL
zcXRU(rxVFDgxKwhii(i2Hux)Z`W5Q5owvKW{{J4YXTCV;v~_eK^SpghQc<y?)`QK2
zrpsP4|8#Rtt*`dV6A2{JU%TIUXm4iKM0`?aP3xnLZl+ICK!_|&E@SMpf6D&CtrKYB
z=Y1Y30=uM|8jAO7hBo!n{h+hx-8Wa*K2|l<z_Q+AqpsKh8g(js3LwEL)=o!(V=>G(
zF+H!G`R2uyQ-N)CUrvaqmXlnb9#)8Cw2Tu7TBKttD0>#X=1UT;y%jLzbV#rse%#|D
z%L^_3v*jAYOAD`lFQUZ4x6NaZ2V^1Wt7>B39so&g+{(P<CYv0$E^KSSa5vGA(yEne
z`^RI-%>8bDQIkV3pucSL?T7gfQh8&n3epeaoNvd%%C%$bY1cHh$|7zZLzztttPL#T
zP}jpV>KGDsymY7B2H-6fd;C;y(77+G_Z-iF4S(GEg-5{DYg7x)$dX1jpzId1OyKiC
zMiRLwsMWbC0x$*i&>-aOXpsrXd~u<GFK2GVM)Z~Qve`Vgxr5ny4XQFS$u$sBG&I8e
zYfG>ny^Kko_0_?@*Bm6KI>aKsuH4CN%Zsx9ye_2^Nw}Gw=efX<^0ddL5u}kfH<#3Y
zK|`dG|1JVbh8<JOb}?z4GOle)XDVG9kGVL*<zbpDHLxf8A~<?ePC;-sxx(^3)2-of
z8E<p%f~aGOj$yC9q;MY_W;7*}<bINs0wO{#(3PlTND*F;vNCqLS}r;U28OS|A(H2S
z{jTc|dC1>e2k^lHUQ0_0CN{PVGS~i!(xQT>pQCI95TmGLVQYCWf3W-1V@*P6PnyPD
zHxD~9I$lVeCOD<;dE8uUKg$hY$LCP7A8%=e0gdP&Nt+Es4>X}_Q)~$1XNXPXpA`Kb
z>sC;NP|mK%D#hOTC{4~8#n#T-Q<)Z6xrf%id7Zaa{O0eSM68ko&(w)Ds@L>M^*;^2
zda%1PM-n5`)EQam(2Q{oIL>WSycwlekLpU12L#&Dg*<$t*<R+^-fJnu7?2IR`{mCD
zZL2g|g0#G!(0S&~?`_JgP0BNalW!x=<1`7H{^V%CCR&uP1mHGJ$lE%-1T&7qQC76o
zEeB4CvPB%&{@$%nW@uV_OodS#2%*=Lkjv_n4}nf3+lsYhJ;7Y$0~YdjGfvq_E6VvQ
zksBFl8=J>iCs-GSGwIf0J@lO;e4a=Sp^?sT|H?SZq|Kgn!WyRkUD6<FbcnD&FM+&K
z1<#LVJe`M%qMms^Rz3ObjV&xc1EGnZbm7It)`!`M@NsM=qEXYO1PYZ*KVtHzPqhqY
zJzs=AWL02@n~66bY(NBq;iT_`+ta3mMBX3W!h&oG6jnNVN9}NvEWQoyWDhPu*fB)p
zCU);2X^Y^<;R&vh@u|T>Eyj&slISF+wT*(eqQ!eAR*MMSZGeSzU~|>~h7UQqko_WH
z0J9?){F+%KKcVOEUA&v{&){pbASC4T#L9mH3_UhwB1npgsmXur#n=yD9SMITPQ-3v
z*pfyF_``lQ$~I(iyF|w9dLrh0bh7;)d+xzb?g7D0Q-Jm4c*UMKfXI{K!IJeXl@BN5
zOnui|#fy8^FDhs0jK3@XhRf3%7}gR7!<^avZ$LW@di*0)$v)cl7WS%e0#$cWGaG{a
zPA~}NUC+Gc^@yU-U0^$F=YE3|%qn;j=r@K9kXLVG_39sF<!}JV?F`lonS<~}HjBTL
zg2)a&GqISGA~*JN0A*2N&sBBUB^&36qSZ`dh*>9i2B%#A4NHyz^7y-^3`IKbQkAC(
zYdaPvBl&r7;Io}}<S#|JC>nD7I~wh(u{;o)=5h8*el1VPt46|1kT&pl)G;$z_AVb4
zzu-V4ubw^e6*CLmvs7Xdupcm(wPX3E3*{Gxv}s0GnuBK+nPSfEADFdSqkpuIsAlL#
z!vPqo5gsX7!pma$rlSA=!X~Njzi4Rn><tK|&I2)h(5o6Er8j7UaKDceKgmgHcbxB|
zaB9zJ^98;rIXr5-KP5X~!j7oT4jbg}A}Y}O@D1l-gV$Sty)q`lV8eP=eJPP9a)cy@
zm9a@L(+}Nu;mS~K9(_1YxrpH+0+fsCkSxMl{s{Yymi^jKqLy=5S~@>G3uO0}d`Kj5
zAVM#Y=(QiQ*LNz`dKR0v14g>0$^D0JfmUu?aVn9@>FnpcKF7=nK40N2OJLW$o$#uf
zD<>vZy|}{2t&MF-oLeSkpfUD<s~IZw`O@67{L<@nfFLL>MNc;&f_B`}#U(m|-$=E|
z3&h+w)$H<3Jg-e1t&W1@L1IJFhO9#-*vb>jlq*P6DuRRGiqV&@J?>8kU7NmkX<B{I
zE3_NS1E`AYjcLrA4|9B)DFxB<b3vAS%@mNxTRGUdhoA^*W@ZUt=q|h0XlL_UEwpUf
zH`{_Q=fUm4;AOJ1p*kp4R=;m-jJ!y3k_U@g%pGet!DnE5M_R5s0vsE&%6mx-{VPNp
zwxJby+;#JLZ(&w``v_z+Tf-tQA+dQZf}XoIS-hS1cTj77e>D(DU4eB$oq)U6;8I{N
zHENWtL14F4mHS|%cxV18pnp6(CM+62ekcJ+149?k*IWgsC&43er^8M@WLMl*QR~$&
zOUr0K9DNBM_ztE;aNtZ2FVQqcC)<P_c=(3Rq3uSE0H^ro8*s!WRyU7#lX5Pu2yG_b
zpA`}bXXnMWU&(4l$bi3^!nZkW3f?4<Wm%OaQ$pzp+S=Q#4vV=eD<@>Hr7sLIkh;Iw
zM{TAB?z|*vdqyj}C0a_m9oB9d?ECkm%w{TEAd;e4OW5E`QnJ0Gf<HlyF_sWtAzKFp
z^n1KPy-2Ef3DpgypC$3}91rBK)`4Rn+Mmf<g1Z#_e%z_>mcD=`o(c0t;<YFkBQpaT
zJm4~VH-Npi0;3V9Qi0P~@s}P`r>Nii+<5-HPoH>$kKNPlU-bsxK5wZ|(fSxkN6sHp
zyC%G9r~^As2?SG50O;Sp>!E9_FSX9ZfxE+@Sq-@SaP`z5WAML}Eivusbs6=k)@^>S
z1O^T)zJ{xzSL)jqYSRCtcVl9b!jqR@nlgO8)-cc^-Q9g@7mm?CX+bi}1oWzzHv1X+
zBPh9yB7X2R*wzr0p4Nr}hw^6v8t!Z%$u7M4Bjj|$V|dkhl_z@B_?v5+E<euX{6s_=
zzTyz>kmC?IDm+Q+^z#tiTy-P-yR!mcd2h?d(S|B};#wa=US>W{N)ih4gfqQe8b+S_
zkDC-G-*}?vZCK&0V+n9l$@y$cTpLVyE^qecAVn#hB7Yt?LQw#P;#f~%zD@7X=b^9F
z^oka3x^ozl2|wqB^(ghX4Chr8H4^H}F=(n0lN5UMi4SD~eT9>u9Zo@-!7$}m)M=Gh
z4Z3=TrhbXYN_y(pWN2#{08PDmtH5{erOJMxXq2-GC9@JNX`Ee}w=zs(B@MNm3F1j~
z_N7~c)9HGJx@zTmx>9wzQffm2)x^GiKl#3XoY3I@TKMW>1|GYkNyJtd7|1?y(cmf1
z+Y#~MBPI!%_uT`UoMigtV*@;nijM%A*biJ|P#}vN-9juUq>?%lymJ=&vA44eOctmA
zl$>v6q${(of_2+@>0!m&)a<?NP!aeAd&GNorT^i@LjCOeo9}e`uaZX>j~Qm^taVc$
zUQ3&8){(@J<;w;dT95*WauRs4v$tDRS@{eAvLobW?@cnY@szKUk(Op?YL00zol+oz
z(%u=h-ot<$g_u|ev4-~K4Dm5I60ccl%_qK%4$UXjv<3WOueXCvr74cW|4iVTj<zZ6
z&Rt!MjgMLfqkE6I%yA1Y#$HaZ93Ilxnsz0qARW}+c4<zO2B589Wi{I(e9L=nGRGyY
zizD9lUj0l@a|HJnBFCc}lFVL$_?nngaUf?kuz&F7ti0jKQ`3uVvMuBzRE9g*fhO~W
z%hgesfN;#Lq-8z1Ht+;ew#>$!j0l7d1@+@THDL6ojXLKTS3OzV8Y-Y!1lyCOYW<U>
z_Ww!BJxQWIH8;xtch(Vo0XZ0E2rkeJb^ZT+hWsWaKwmCWW84^giM*&LJ-nwggNar-
zVm%NZHLv>1;9papj%=xBK<-CwR;6NQ;SVbVO>zJ4yh;EoT|1%TL5Z_NYV<>5EQ5MS
zZqHMT@vT{?IeoVVfMC5qMW+4@K)#1NOD-|QlqSdmgyl4qDLI=D3jPw@?hO31IjhKF
zBBWyy3@eo|xzlW)RYc07_ORqU=>zh=;bjEeCQlQ-tqk>xCqt3W0U;W?IYb%!uT0!|
z)(7E%8V3%9m#)5r>E7-w530}u5ZYC7&;YYAl+j^3(OC{C9c=`}d(ZkfZ+WS}3yaB*
z!R)fQB+&0fUMp5c2_UVMH9|tmVCKhd*23Q%89#K!jQEH}eQ9bFgSb2evY7E(ChivW
zM78Gjd;sKjMky3@p`Y;mcO|Mw+h~lhluqpVg?p5eSO}>I6HGR$bu_HK1e&TBCF{cS
z5)nX2y60C?Fplk&{9=tOvl+rnK>5D5iQN#l1yxz2&pAYxJzl-2=U&verzDbgpQHWq
z_lW2$y~RP;k}BD(ud2c?pCdFU7pYyhdp`_P4n0F_2~2iAWUawx6HDH>i}-E>osR~Z
zdj1s6R~8CJ`os%z7L^R9mt8)$MI=r0b`2-9*fW5*hS5MCub4KcdfN9>V}_M{B%9rQ
z*mjW>8!!;s&MgbCI~?TiCK}bWx<vtKpv<QxC@B^v2(Hac*{kc#W{@pn)#+<AP<iD*
z&d3PihiEvBh|xy84MWJ`^INsE#*Jo`{}P?BKeEyGk%j4E7PyAh@y05NrsFzPuxSz#
zb!2|Q+7e;`9^B9^X{@7UG-1l()oE3NBILPkNQq~>n|u{KtB3)=7OfRt8sQK7TFy?U
zY3|ZQjeqc{RPnNORms;d!bC=Z_d_|_mw4S#)puREsTq*!8iUz2IfEJSE3yfgMRWM#
zenGaH`R~Orr{ctr<HORUBIkQ*)wMT_vpWetKjjh^dG)R4b?=kECiNbR-lQJR&(`97
z@r~trkfs>b>@Or&DckqmVnn>zDSW8U)^O$XL2F1sL$~=*z8WtcqvpSZ-CBz!slBO9
zbN6sbe6<aEI<a=!XWgbV0Fs!_$A{s2k2uHJ=M@tXU@U}n`+R==M7&>*_@P?fSCk!t
zM&LH7^5k#7QjEK651ZC|^7~)@H>Nb4)8>eur5Ih-UBvk2HOv0rfd;0p{1Ojr`iH_~
zRIx;vILypoxK`e%OBCVx#Er9as0Mnrg`CuaBp+g=l=}_iLecLQmk#91#+SwlR`so!
zp@Kg;IDP&&=4qy_2)MUNX@tI_6!K*|m>ayS)T^E;Dq+k~j^a>0gA1+y@*v7lEpI)M
z{Ge)3oIFgGo}u^Bx?Ccak8Ft_9_F)D;oyIlX!Q2y7*@i1Nc!6>SS^K_>aMh&%{u_J
z{w=xEXhm>$dK<AIUdQAPqid4bY!gD`mel&xQYbycyf39{Q+338*XUQec3lSOE4Em9
zk_@^;PID(|_qM=X>%H~A9iZbF8IQ9Bs(dvNcb^ASS&tVaHwiB<X_tXHGaw&%XD%6-
z`_H+ZmJTMGCWVdRScw?0$mVsug(XOQy2^pEEwf{zLgVKkXB#|ZbMeNho!8y~R~E+s
zXohVQB)N!r5o_3G^iKq6D5L^dg9{|C{&TvIY8Yt&HVNQz_xzDO$X>Uf9;U#d&gOo2
zA-Gt_`!@&>)YTxwoI$mD-@bNc5}nLLL@oo105^)`2g4kFC-VnDq&0RgfEu=X7P;{<
zOs+-YY+f<0`}F3ecV9dfY_DX0r^k}80I!<P%i(dvUeV-iexjX~RnxtTYm_9+3DGAB
ze>7db3*d7pM+0!Cj^$PL*~)Jxt=?>T%eFZKY1O~)mCMGX{!IZU3wN@Xs%&H7x?x6u
z=hN$rkLKhfYLbU58epz{_+09P9uFcN{5c?e?uAV7Oc&!NO9<W0w1gBG1wc+dB-o~1
zSvg(sD&Te}>ug4mz6eReb`6(f6rFt|jQBN!bh)vc-Hl)Y<SklWJ#|;&+vI3LROHxN
z3`X2}$4Z)g<uJ1uPLf9kLsX;fNJqv!Bg0@rx`yCUc+@<uOFXaLSF<0Nu4YOUeXd_T
z-d{WP>`{=B4GLQ7Qqbwrm4e9%um_TC+F^}>Du=&4+p4e6E+gZ;WWQ9WKwcC6J|9+s
zVRPG@lvz)heWm@aossWaMJO?a(sh3&+tb~(*&|4-Eb%-ot={^)(`IeBDBGM$Rtf2&
zfU<}s=YqMSgd{^xM8F^C$%6BGKJ*>XHyrqIg%jN3cB9e*ZHy7d3A`|u07%0oM6P9*
zj6gbkA=HwnLqCh7{ZGGmKo<yT9G>Yb=eJVsD7-IpX)znQdNNdhA&@q*z{xiy&L^qE
zV&**}+~vM#DxBsCG-+@MZnuYr#V+FVxm#)iQ2egoqzSLK@KMFqHswWoXd#_k)cG%{
zed)W@v)<(R@p1B!g`d_+KmK;{Rb#v`<o-+A13H2as00Rcd)ImB<)m#A!64CTJ*6VQ
zdroO?zi0B`IN?lT^ZV00(E6+dCxt;jS!OOJ$7XR)@X*QDl#M4R-1EFT3lJ~mU}VI(
zy1G(rn#`A|F=;*lt%v@T2zfYDG&C`>namUU&v9qV_HbH~nOj=Z`AmKCcz>ZqLVV4X
zFj%^%V{0MD*$L+kOXDOz4o}gmuswt@KX-N{9orE9%;v(-m*1|Hjyb%rjV9`r_wx4*
z_9fN6iaQ7ItUXOfXzZ5d0yL!N!qQfc5GvMz;gZ(;j+~qCU36$b^Kfk|^@Ql==QGNf
z4ITN)5eeMnjOeg~`^Kv_;%VEh)7ws}etC-y6>9z~@$N^ljnr!FM(+vFqFQVtER{wO
zG{)Bm6qRg&<8#cQirb@n_?a-U<O2`aITd95c8T^2dOUG6!bIv{2+7Dj`|vaa$TetY
z<fqc4?n}EB(nArQgz93jp&GWV-7-Y@vzqmJS^Y?K(S<^~o-R>is_5KY(xrZbmseCx
z4F?SWGD5kk|ICfQ;m?RqI-uNUWJE-6!D}XTK=u4D2k-C@CS^4>ErLWSNpYhp$kA)g
zQUJn@%tXd3aq|jdphv+sLCsVxgZt1-U0*Yn(y&B_wHO}>o|i$|g5Qnlgb*JC3Q?$%
zekVp={;Je7S1l*6Qs^(7VR8M@`C#RLl|`OS{1>A;UjmmIg&NMe293$$_{rn{d=3W#
zndLGR{>zk6{NELUYFkiCixkRKh^t1{^#c8j>*UJ`mj3fjX&c|7??!Uj=o<eh3y^6Y
za6|s)jbt!NzV^@T{75n+-y)Y5`)Jj?AtwGuH~8WBl4Gd)Xv4w|FWi7CWjJ^17C=o{
z)fD-!Y_f9h&;iWv^8W9zB4K;eAbnjyG^Cu#)Hf)aJ2-&&Idu#mH%N7NQF*cS*I%BS
zZANBm@(anK&m8wfGbU3+Mf{fHF00u2!z&vCz&Mgv4*}jv+3(XY@Q`D3+T!1h@ja{0
zg5lnm-2RL00;|L!@;Y-14d&-sf4nJDc7EZI1f5SdHyGeST(7_qiyKZiiL}W*|J)OI
zzvXTr<F`M=#$x^2+FCYGWsxAT)>u@%pHYQPqH8$JmQ5zWw+s1gmC0%oIG4m*f}Nrv
zmPL<JrjkT4gIIFbBP9WpkhB$L;UCVQ4SV__m}&KD`1ZA-nRmuC;(kAa<OA4Mv=#5v
zuEMjybytEzeYgT+&1su}ln>RvRD{!1I+n7ElfPM?U)QpkHPIqeYCO1n8GH%*q%&Ti
zDBQ@FbVijJ>~H>1ewc$(vGB)_dZ2~e-8#sbv&lkc(7qfih|Olf2fT>enF`=e&(i9*
zxpW9Ut57w~`(Cav$!$-<?baARfyoN9wgP<HabQ9<#xUlbty1L`4KB}il+-3Nr8Pc0
zv1H;~UGsjz+?;7b#BT?ItWHMDM))&RJ%s2i2_nuy==uF5pt$yw6Fu29K_#%ldi=~a
zoefkZt1<)qYbCFgrBt`$nFb0F>lq<m7YKYl74jh2>22Cr`5mA8VeSKFHVc%ATNT?K
zE&Po!NzwU0O4v!!;?Ph3yE22#k6SVA6p6d<-X!MV*Yfa|asQV1_xf+%Ize-6u_odi
z>w&C*n^uO-CGt+KdrsM)itMNR6*24`zf1`%aZ{r__*O>ZhVb^ISFMEPry2S=m2YQu
zX)yntxgiQ2@zl4AI^TZUIWVbD(8Um}hoD;+wF1vy6HC;ths_JPFq^prbYbVZs<ffE
zNX1hI^OQNi{CRVQqdIKad8f_Tay`b@ME1M$QZ&InD5>Ygoplhh9L3x(rq{d=VGr{P
zy$7~puN&VDUU>ztG|;V%zMiWp_?3}a@asVEbHB7~>A}Xy&B$lk)zp7d7f`oY+nnO-
z8;vv7$3@;If1X=T+0z}spIC|<alu(1p<vj)LVo>L;MJiObvz4OvWnuJ5&XUhUTYj+
zV|F-5MT@8ks--?j=rjSB(u;g~bNA<9cz>mWpyiY92%T~12(5AHX*3y=GmZZDbgPpw
ztbMm73=Vj5vuw0iG(hECo#7_+MRTSbRHV}%1vWX#;O7s0Q#!(k&y9^BhP;ra{=ibD
zu^7bXCZdIneDmV!Lb_NZOE~asG=5*{-?OrKS>%LmSOAhhf@j4@RP9MOiG3KBrG7C3
zHAha7^~2mqJghB+XKlKKh}}4-(sFGi@qYg&cQB$lgq4z&JB!XhkIP8A)Qa8E&bDRD
z3lBmoh?Q|UU3wXqN(Dg__jD=g=ow93)oYDvyNqnTE@Kt%eqKcR<6cj-MfdXUve@UB
z*Djw?^!2$+KY9VPwnGrkmv%ds-nyyxq|@opJ(kbXp{-iqqDH}=kX3?|M;t&7for6L
z#)#sJtPFOaS-pthW^v6z_CZ@e3)0kKRuzH6;rg$sdNF1{nT3st?UPNM7YP7fUw@Tp
z&Q4Xyb*sb9aj=*7Koe6oJ+e+N#~)VvgMdcutPBO8pI|cN-uN8L-5qDNgzjsZyJc*g
zC%4?g%Cz;rl_E6qjC)HfN}^oF2sAsnS_-*(%nQn=hC;3u(|bHd7m=-_Fi=ee)SoA8
zv?gqv<!w%g$w;C^%7Rt78LbCjTFak05H<o;ZJzd5RY%3>3CPt}GkD2o>naQ=4-fDG
z^+lP}iI6+nfeBBN2}ns`!u*r0(*I<Ur?7hZY=*EAc|2J((z++_OXH2%?BiMBB|M(T
zeQzQl*MwP51vC^jef?PNxp29&k5b_r0EbGWsth}-eRigKE#Y(7Tj>mgcYk!p6;m@v
zP#|D16MAbvwz83YY&Q_{3?{=u)fzunNTkZA=}Ec!w@>p^2|%$c?wsUcqxlaZQZ<Oy
zYmq2=)hztca7HBT7e9r75Y<>|q@j;$EJt7k@Q$jhiLGH`2A64v{gOg5I?;gGQ<>m$
zI5oIRIPh5fK^5b@?};DZ*P&y#BF%I*D`bjp-v}mY`JaJ!o4^Y-N<_^3N`H!lam2A%
zt;dzCs5;A0)Of0#E6p<XVr7EX^BUIhw-`2eacyl5;w_)_ZPMmmn(AdR+HD!uuKH21
zXjH&`Hl&c<;d=@QD3Z$}X7eqMt1U$j^PUbx%hWvSf(WPK)iHZq4EU%^)wbpfuKpT&
zO4f*cmh@JvsuRyl5KmmJ#~@eJAeJ54f+(&O_%|=j8wjz)zs3*16H*1pguMR)5vg54
zuj2`1NihnMY!ZFE6romAQ4$!+ty?|I>o`V73Sb-Y7Gc;iem?QzYT)ckiIN0O{7=D}
z!fuMV$eF#R{5tDFk<0THwTSrjIi$Ho`j*n@aQG`gjB>MgCrI_HVBgLQpfA%c&+)tH
zevTrK72gk|2IuS;1GZ%Rh%xTTVaxN6Y*o>oth_IRUG<B3xN)?^3~Y{Ojc)4FaIoW=
zW;#kJv9Y~9#XYE6%FUnLkmv7!SKwF)Gvq9|m4o5wKQlN$(LA&apADhf@1_}CKBAzn
z?gBm@GyUbEbXAVnc}?v{J&U13qi8*lE$`YX>?x^FGoR1U?ldEZOKBgQlCI+V;H*qI
zfsWUA$c3?dQ*M+`VQnAPg>^YG%wC(rPh@W|%VW1gH}P=;x0#{bkPL#Jks(wX@2j}p
z8o(Zvo#NxW=}TH5hB;?t-*B2kAV4&R?L*W_!^!h~5=H)_vS|#K)cSMgr3Me&mOO2n
zt^Mb1+Qkf0dQtN_X1q%iqzo8SC90tsS;pa|rvem${+LmL+`Y^26)SNMOnpwuXn9^a
z*sP%CVV($uqixc54Vs*z_w>52AXEZx2#;UEGZMWKrxvO&ldq%qo-KcYht4VzzSk53
zHVbR+Vp7G(wK538ra9tVI-MLr;W=8T&!5|a!&=F{E2GU`)x)KLeQ9RsTbPhft160C
zc2;qH_%@z(DatwwcOs}fGh@O$Sy=NQ&yw2GKUXrCJ!0hc+K#+T_ynVY*ak=+%iko@
z#97JGLW3mZk8Xdo&eEeKU|22uz-$?w2x#M9nahCe5>6;)Tc&hz*Keonb>>HfMLqJ4
z&C>@5E-@A;8GJ_8EJlpM8+)skIFW9_?RDg2odRMoOLoZrB5Ae_>YA2~6S((!s}v3R
zGlRsw7-+Ri_fMXeM*powODIGFVlw{+j>)d*iMTIT)X2&Iq=u^L#rjeqcNP~mV8#{8
zq_f7!71SFiAT1?h95>8k16Zb>f8j-Tks-PT=dfXIukcmSrEktLBr64}-<-@zy0cN1
zZ*gqI`sTxzw-7<#AJ%-TWiD)xPSj5==?#Q7BSDgfcc!{6`*l|zP31Z<K{{e^i#pnc
zu`FuJtC!b-mY^<4q%YvsgRw0QQQtJX6Y9=0QCz#c9DiBye*YbhHsYhaJ3_eYn4ARU
zrBZPlMJ(NB&%tPR8DMIBR@~FNPau|^?4~l{@QS%F%B&<ltA4c5psLk=aW}Oz-n=g4
z#RTtLn-7zJgGXNjO%H#V?%KX3+5~Pf4t*KSJ|}80yCP5kxRkkYPE5BusI<+=ChOT#
zxZVq`jz@we*dWBE@d+Pr8?2lNvQWEp{tx+MnbJ{^uSxi`lbQy?GXL_#M=^gFPuEnZ
zhL}~<hk;Y&@Ab$sSl=<2q0JY_SLrr{nEEl9LAD`Yk>D9j1aZ~Z=_n}+7`byyFCjT%
z=wx7)PY8VVnrU`B?5cc7HQ}MzY}2=wrYqp#d1x88IKXFUN#+e_)wxWC7PFxiB0^nf
zf=6<Wnqze9M<RV#dqp&yeIc?7&?;iaW3&?;^64M5%nk-euCH9?kY&K^%LK`zC^RPg
zeE}O(A|3)&m?*Zomh8-C!JB0!Mj94B=Hx%U*@+Sx87E0qjlmn)M^PejO%sX_YI5U5
zb*i{I??t|ypjzxCcA3r3`h;Kx2>%PWV!O)DbWgCtsN>~wpuh!uBqs8f`WNQ5^rzzo
z?r-VRF**{0>oD2fZ?iiZ+f_&Yj5k@?MT>ELa!syQVyz|mFy})=QxrT--D9%#6`x&X
zx2y?CQIk|n2<>Pa+K}x>>*6@2#dJvu3)=|LI7YvQ1TKEfN`Ip@YE<CYuq^vFeOO#n
z|A8tuu7*(9{FfFF?zy*%N(^Qi+U`tdS7u)UbX_&9e3qgf&vvH@V(=8dWPMj!dQBUA
zzx>Oq$~Re4ZxeEPvPdtMY}<6!HO^AfnnQB#nCz3fdf~|<2%Oq<pRAulbKG#@eU|?>
z*RY3E1fgxAreFboZn*D|G*>3q@H*0?fhQ8tz{~n-%F}vW_~B<YM`|;Nr>Hwl!rk@o
zd9agIBr#)GYf*I*b_-mQxUpJpDd7y$;xH-lZwas4M{aymJ<ET5244=A$S#4!fGwdC
zzk=s6Z_+UEpnUX!EdEr~40lb{QLa_<?3_6~#KEdG9-{V4f;3DQX^Yg7V0QLuWlR1s
z>V<NYMt==<<=7bcNx%MbJsnHo@3dLk@ages)V=d6FdH-@<QYo9^-xQ88mm_NM*k+^
z<;e=5xrJrpp~&)*5$^5B#IR+EYSa?UYi~t(u&1Z3{p`(s(P@4Mwy&f~AuIb(A6N5C
z;D$%3*{FRWtk^)k@642`otqjzDZU6sigof$vAV40B|n}5h{MR?CUv#BfvOcH(l#Jq
zLjUsjJoU=fY>q9NtwlshEH7tg7Q^S4^aj5&8Bf82M0KWlF+ZNk!ox7%N+jnU(wK^q
zB{FPZBz)|~hsX^OFWy-xZg^cD+C`OQy`!-veZthDN8T>>*s%p!3UAXVO!@Y$mwJ{4
zwxWyq4s66eTK--o-?|9e;N7FY*}k)WTL$=%L(m_`XFvh*9e&9zyToi*{3m;JTjHkQ
ztAzpm_9_e!N94MCdh(_*M!WzGnt}v#AGXl@LEq4DNK2-J$2^$Lx;X##6(Sy|L*+Pt
zGWprWZ=OA_-opdkg#33Q4PD}DqmIv>{kwcCC#`D~-U;jXSJl8>bBjfzNX!fl;6Zrh
ztv#2-rbLK}Vaft)c}k{fj?{iwJ9Y|`+Y`vP=E!D){~WEw9UV~xHoOT4^pg!;Z1G50
zp4-ugK)gHodsuzh!T~EPcxM3Scb2zxc=a$z(RU1d#8WuR2f_BL*R%2W_ZG2a39{e+
zZTmX@H-CR;o>GG48hA~h2uKt30MR5_&50HZ<xF`vb0^eL;V;J2^IRg5pyOX>%OpC5
zNy)cXdeyi}58h57a}AYJS5vO2OZdq8DU&VV1U3}KjT2!Cr$;u61@X8+p6S;aM{@Pu
zk4QL!kL$W_*wnUd`IX+(ZYvA+YvzZyhhkD|tnDYq4>Se%(8UPU7+CF83t*~zLy{`q
zzW_Hc_g;CJB_lCtfd-!@iG@S4h;e|n6@NyjyWaCV*b({||IFeT2FsL1Ur<)j2pbwm
zuD(Akg-kd%7~fmgy3z6ka+oVj!SX$0B<WLf??t4PIeT8#VB!7*Xi3#LVrM+d=1&yu
z2up~=d@JBUd<q93tA=`H_`*KnI^t71Q6}?_luni0Vv@TYEWN=iCydXB4K!Rg@VnFn
zlS+t!($1MR>D|C=L`@~9a`a$2E$gUcoaDk*BY2dU)1)2Wp((BiG}*tq6K`d0AHVv+
z)z!EK)1KUSe{GR`Msb!<bessw0Gns7=?&C~j5Km_dMbcP-SsN+q!!H(nRnsE!aMor
zL{-pmS50H>2pOO)zpEPb?W^SVxxvzL2wEJ@MbXR8D=j5xaolKdWYNKv3J$w2j{eWP
z)*c!-+hk-sya#SVfJI_`<kT;%elBWwt3Lbz4X44?=NVs9v!zHc#r-d0Pe%;s1$^;|
zlqHRz9N~t2aL?qA&33vDLAqs$+GXjG?q76*4h;Yq5B4L3eyr;X@i9y*Tm95w+KHf5
zW6=<3xm9?ys8^z4kim9~lS{NoJo~3DlFm6-#GCo!Yp3Ge;%{4C{%7SWP8qA<fT|ek
z3#bX-1U`4_bkZN~eNHkMJRU3=APkj^`>CJuJb=8Uyz_&PM@2O0a`3i(;3&Fi&lL~j
z<2OZtoO*fzB5qOc4%cvH`KVDB=x};gRwF$AvVGrWF1~nHHePpiX;Ush1ij3cAWMPE
zj3)y(?H0kr>`1NhS^qO_MKoQ;VequomEn01Hs2eG@BV-HrCHfW14rM6Q$t?`C_&AY
zWy*lp0Oxzpo$_d#;O|Dr3=7uA6zz78oj0-xa;4P--sJ1TorantKUJjvCdwwrU!K}C
zK-2^Lq2}f?e*U~d+yzQz3=mh4Sf0}GvP;_8YMv|KJ323LU@P{y_h3GV2-@*2JhlEl
z^kIo=%F|-D>|k8}-g8X@Y35(QG(&=t?520Lh>D*j;28<?rdd4!84lBJU-6?ACZE#J
z#V-^}YsL~d_1<<@y1vCk1blxYs~Q>^@fNk|<$p=K3<?Edb<+bheCR<ErIMz1N{?;+
z?my<rWLq=<(obk+Ds`}92YYl#C@9Vpxjwyqk5-`%c>+q2Ivz17_!6lE?qBZ}E2Wkt
zBUyP+u?RubYYwwH>x47EJ>P8Y{pZb0_WN#g0PhRMlJ))L2J9AxDG3HJX3($blFvHt
zfO6YkM_zw+Q`p~H0O)%MZhoet-SGK_!9UA2;|C^C9lHQF?cj7&1zU+UVnnI^M)`cC
z!1Ga*kRN1Hk{r(fWqHSJGN+EGc%rqok<EvVvw;q;5AC0Jd&xXNFyxO01@XDLPQ0Y}
zaXql@^`q)1RynmQ&p;iALWGg-KU6|)v%h;^k@s&e*G8_CNgRG()T&6J3ZhPoRmA9T
z%^S-^QJCbl4Tkw6ir-jEcsPghsYcZJqvFzvS?zyNrwIOrPC{nSgD1#H%=|VBuXFCM
zq{7C*pVTSRMLR<T-5=cB;7`&f50<TQuiI45cjz1=?Na!QGF~Ff^Bg|?^@4u?c$wtN
zMYOj_s-t3DXc05Y+|AN+K3xgP3`=58E~7;t6+^GL8XCh{79m)SjEpTa_pOkW*|JX3
z<m`(}A?y>0VcCU-b<=I{Kty%_PNl%ewC*aWSq7PK19zlPR4C!B4}+Hgh}E&D4ujF`
z<Ejnj+YS(iDQWO>Y9$_mU3;5xe+kWXrGY?x9-y32%0bU^^)BL5m&D<bg7xu`BcGXh
zr}K!uJDqQBcJg6=5E8ot67YRtKw2Ez3#(Iv3X>8%yz6_+eW~FmO6!xhFU4>g6$`FB
z;#$L3`spY%@`qit9By`<?!i7^_^lim)kW+RyBWo7_K!Dj9EwHCS#ZPLia7!aj&Wet
zoDiBLC5?Nqkx?t-2Z5*weoTB8Gou0!Jm(8z7xfRnM~wPW!G<Qccq2Yq#IV~Dc9!YU
zPY}-d!ePRIet2LbJa!Ui^qw7hqVz9W<=vOB2$V%8v+21q>N}Vp{QX(*X7UWh<{DiZ
zH}3l_vOBSOAr*t%d@~*ta>t|T+=S$TY*txe+n-D0Oh<_Ggng{|FPqt@E{5uE7($Uu
z#(u7N0Yks!`bmMRw8MXx`2<NrDO(u%mZ3^|4oh~p(UBG={^|J9pVVQs6%UCFCU{md
z`4!ja=C)Nx0zIjW(5s^#U*Ye19?NsjExppfdaR9BbNUp1hjDHuf}3E$N4A3%hsZPm
zubTHuJM~NHso~YdIt}@>(#Kl8w%gW%$$<r7g;|ocBGaflXwe(pY?RZs#TE17zCEAX
z`8#Oel(HNs(euxtv&8h6B^iB~_8vqch!BYiNm=Pf*Rx7VrNw7~<sH9@iCMeo;;Z@q
zBNED&*GnqyWcz#Fsge>yCQFU<t>&&XL~IbfHV;d|mU4SpZ#L|$tGrhy2zJ+?g=UCE
z9q00e*cGqcBE8A$YVIUJ6*Qxbt{FaAT)ZJ{>JVLA%n5MoNS1*(Vd;tz*`&(5hwlk*
zi9!w$T^v02{_kwlGfHl}SPxOOH9aNJKdDv_)#zGooSw1j>}+QF4r%JYun%qNkA2|d
zY!#64Z6r1*F|hL8cdBeo-4ql<Wgle9{+5h3=FJ<t`I<AX17A&@y+vNW*V%~%GRS@@
zaQR+a5A}cne_Gd(r`m*?23FmBW|r1)q{MulbTTv`F<ivig&yDdT&@LM^J77jR&%(P
z%+Jv0EM{+AhWl-Ht&!=%&=>SUBOIJE&Ks_r$)fSKX+;#G5CF8NX5USe&e`rc=l#bG
z;}8b>4kJbtt(fgPn?|NvzIvv2@SDOC)=pnk!7V}J9KAmKN&!f>_?Np5lF6NP%fxu1
z*+1JVNGIr}or=s8apO~N=>eUQArf;T>(2g62Ok1tB=?C&0>}++EVY;@xvAmqh+v%8
za=Rl3T)Kg2kj~KtcdGVxZ_5Y*SAmWM+#uFJw$T89W9OG>07oa!XYD}bT#}Q2jQCjN
zIb2IDG*RQRNNaxCs~U;3o31l6OKV>1(RXRh(y|y&XP#H&yMXli8dR_}`REkXkIiJ8
z7a`R%wWIfxb|pMUR>_EIq>zqPxTH5m^IwxMvX6L<79cTIZ5IMA?ahyc4gK3*K;w)S
zR2NlElST1PL#IejY;R_x!&4w9Z;LJJ&<w}Cfsv&t0yCkG#~~~6l#42=ac7oc$cmzb
zVyx5!e3l50@7|GXV&C5!EaLHY#uH*NBam>I%9l4ZJo-yBRd)rR=~nckp0WZR#$7JQ
z)-)V@2$DL46Q&rC9OpV#b-j2@$uC(t+HK4frtQHF1Z6gOmgM_xhvF%SO*w3Z=_vjp
z=Ka(zi{AWKciQy*N~Vp_TR_)4sU9pa{wuD=VM?Gg9dr3%Flj!cHh-Fug&xCgYBR=2
zT-ZsHj;r~Uv>8-U^2ZBrSzG8?cDsJtP*Qg_&xjogX~ngr0xMaIvM~5KEQs%Q;fbLr
z3h~GR4ae+Dr$4APW5vP!-y8h$WbD5^aS}D_yCE6|lV3SlS>EaUFroH*Jxr+CZr;gX
z(&sV*J%8((ocAe~Lpc`wr#T-Zv6?i04bLe0-m<5tO}kWPmG8|fJ3_ZQ)*+?ykIs6}
z>ut$W{fuHIj}lX4cdKgIWulS9^8*C1QYC)ou^^w7qbmvOjuX3DNyKB%lUko?c`e6p
z3IZ{CfoX^8sWq!RBeZl{8Vg=%vrWR6_}?EnZC!(zkUZ19Gndjj?!KK$c|$sHa)ygM
zPuAuXv(B&4%cPaqNqt^-bgXe?hJ0R_lMaCW(i%*YVf?<x2WwXBddtG`0Mi8HB*?vb
z8pNBYR*k@vjkEU+vgA;9Zg@H#9i~{Qno?HGNZom1>4Ee`gV^lB34$1)NH*(JfvgHu
zjLdcWly7)*XD2cqfS6yPH>Zo1G<!XsH(}-ERAqzO!eVaqY4074{deuH(_;K~*?7{Y
z^$|%>c(5AGCE%|1^bLI$mBbU>-j1JpYkOBmz^%Mbub-ZR&+_}?9X>a^a?FkYlJydj
z0pG!!t(5ezDK9^%1)KozxE;!L;r~H~7<MT<flrZ79D*l40W27qu^P?K&u?w11Uf7Y
zbN?|ej|}vQ{Z{~<j{tDxM{}9^tyIMK$CD?g)Cb1@pTp{hFjD26{d4nn(HqZM1GYbO
zicA#*YgFVX(1yh&xedW=j|R0)1n&35euI(%7_S-4vWg9UX)b*Gg_hno1QBho8{h;O
zq&RfCAgVh<2!9?BK%K6+&E9e-ZdI3GS|}M{fes6jx!5ReAGKc!`4A+TcYna5*3qnG
zF}?iz^=I((yFy-cT#EOI1DQhB`rElT;;FV|q@?||75t=;GO%NoCr*mMWdP^UBSz81
zo3-giv#jAv^?z~o|9D~Zg%>ue6)k4G&ZUf#`5gmP+ksFJ>^U93JuWhzmIU~Cl@bbt
z!tn04(vaXhC&uGFbxCl|0)@3}#D<QaB=t<-zGE?`l>G#8?VCKj`7)lHlb*3-Z$7GT
z?rJdO=9N)FcuJ@jPD@^KR~h?EYb#?rS9lkk)A!%PS*9v16ZZt;M`RD*Kf+xF^X|7W
zN5wODcxLl(UXKTUSCmtzl-T!m^ug`pK@f^Z6{-?Jep2NGHfdR{+_sO~o3C`cIHUiB
zO2^^;gdOwcg!(1+C}d1LRMlODE{DWISNSb%*^JShZ1c;S3Cr0*Y2XZls+s0Bsmc)@
zTC<aA_@Xl5S6AH0nJhhv;SH=!&HUv=va>9${LmLRnL{sg-eyrDI+!g(13>KK=QHc+
zzSUDhJj3(fg&TcVHMjNk`zA-|#?F;#)+Dh^V!=BF$wS)`4lzn(jQ3zxW;Zc~pE?M&
z+4*&U9&|jusG=%*s0iAXI(3vzJ2vTFo`OZipAqpdL>JdIEC=31wTX&_QhLQ1ARy%G
z5reTuF7Y7tph0vOcT%o?Ak(H@?j;V-v?C{^n?_q>m-XdEt&iX!LKSjGjPy}x$B&M4
zOYQz~4clmZ`Nm=eaqnA1UFbAdzIpJuXF(0ZcmDDUjOL#x^PK3@w$IO{?9}kMhY}AX
zsM0YTyf;L*+7ZK7$5+hm=GnGs>`<E&45Q(hMAU6F0!03!=EpsOknIN&$v*78blaq~
z4j!L>x4EV9e@z;AQzh)nt3>Vy&h6kFig?oa(0uvHp%LBZ4j&$4!Fs<Y^flymbPHee
zV<8K5Der#I0$F~#$J9Nks9}w4&tW`h=$Uy(0b=FwbgTm4?__Q{Pk1FP2g#YkjIUAW
zzkl0O*tCYCQ+KL)mf^P1w4y({>C2XA|B~4!O=zGGSN^KpTA}i-e!E-v5LYt@e@I<L
z)7S(5Q9>})LECEojT_Y5I84M>|0Q>F%ChfL$ZHh&Ed2g=CRAzlF2g9ie(Mn6<43C5
zud{=gfEd=<$-8*d=q=YU;@E@L#%no2>^ZoVgu|Qj$q0C`J1hHl5ene}%0an_Z17CY
z{7Uwwbr_YC^jzb4uhT2{Q`zaN7u$J>G6z3f<hs3P%EB4XFV2ZX0!dRr_E?Bnq{loa
zCT64uQ$qYt>7FM-smJ#6l$!SYw`l8we;tfn<+$eLj66X%9$d0&jZ6Y0$05(R|C-R7
zbB;^I5!K@qF`qNhTBnPBQL2I%o}mX>)c41q3489a>$8|vWpdHYRH*#-1xj@+;^H)1
z#$TorN23K#FZ+w%b>A{0^Op??I{y3GiA<UbD`H_3IwE4+kI#w7E7aOXP4t@jFw}QK
znU<2qkG*~!zh{o7CZj&d>h(dP-9oxVTvfV6Nn2rkj{03^*c<}z1X0Gsi0?ljOBNtY
z)PGN0Q$m)s|MA5sd?=CnpgiVu#&OJZ$62u69urjqe{a&l9vQ}haM=H|NN4`vvEtC8
zb$`T9cG#ZuQw)k$%+vUZw?^yk>>P(AXknugpam@T_Vzy0c=PzWqt4(n-9gFauXyfX
z%MJy0bN){m_Luig&(3D*27$<hfcZbJ-ItU1@$vEQhcj`e^aNv%S7*~FE7H(|73tg1
z>!Y^y5L&NbQP#Uh5mqnciX6RV>)&7?X}uUbzQH1w?Pd-pcWp_uV!szCo+8Qak;W?$
zgjj136Lr?W3;hoKkF6;KyW!7+A*+A!J4_Ny9xTv2i3a{ZQ5;0Tm$Dk&VA`IX8=~i9
z^3%Bdhr+&zO5{29>{d->+F8X)MKXH|Zkk%==#lEZq)f`^{%GIJl#wx$(sgWh{bjlt
zGF7bgnRUc><{8*^wmX1^Yco^BLRxNC>l2}Z&KCW)bItyt3r)k6VOx&Rg(;o?tdUaN
zHVV-eDIo}UkVW^z2yo6c;Ieml^#!wO<aXEIj_rXh2Tr?fc1RK@U%o~@2g?Cfy~AG0
zREh<cnaFMXHe}>}bkuq)(m{5!Nu18;iKr|`=Yjm2z8mjHnJFzYb|WJfK0K%lH&{-p
zQi#+sU9fwAFJ48MzDyo{6Hi~)DxJ|ymcOE2XjnB=K;J42HIB4e>nKWCo!no4(JnWk
zt#7n381+d@zxw^}2j2udiD;F3`~DC;;<$5us0Sa(U)s>##ylBQiTsF(+8W`IF3c(n
zf{pm7H7#Q>d9WfU^TjTsQx2m(-B_>v;*}E1$>;Y<t1IiUVmZ&}Jw7x^T)9G4$f_Dk
zB%w5siyB+>TZ1E0T@lQ*4#hE;tBqe5Fgvm%D~;eD8>;w|!=T~HKZ+^AN3U^l^QD9A
ziJ;xCUv4L|F_$SHoO-B?mLU|U9YlOyUYo)bm<AWkPyQAnC<fhs6kV7VVD=BIO4f^t
za6sSC1iJoJ39s`H?DI~hY>8sVP6tq=(|EaN>b1xhyEm#Iw+KwASzcL84$p^=^Kc!D
zlFGB39^4S7r;~5OCnpUB0!TT((OQbwh+)UaH8@6zxz=%7x$J$g_Mtm;<FvAqAa?g&
z+|->Wy`;2H9Nlu8v70p~CEe*;{=)4#Jk>j_7Ao`BQ*w6e1<wyJ;aV;Q27V#>qBQi9
zuQMKo#>T`7mTF6$G}&Uro{Kn3`8+N-Cb-S?k(4XHG*d#cjzpJ>c(|j3lIXQ`Q{sID
zd$v3#d~vCr5@%Wj+mz*86s~(xLIiLONKiJ2QzG&XvQEb<dKeLxWKY&UkU;#uhYbt|
zm8x7Kicg<BM3+0&B5IdNZyynan6Xr)bU{Yw@JWwa`vhK-vS|C?GtWje%cSj6MD6>;
zJpbPi;`slB|LGyL?G*bq9@m#${#3d=yPn1c8t;sBfM1BolxUe7^}VVwHH+9V6Z2qi
zrl8`>_vA!(%8{Q=XB)W;pHAPlS?nvpTqB8*0XpZf5I4B^iGSarsvNmd;qLjMeFstI
zJNsMX<EdN}rJxt{Nvvf{YF4CDIm7U90fh@AVffDjv8hN1p-JnZg0B@;9GS8s`}>8&
zgDp8DG)OSsB(2DME)x`J9Z5sKi$epiFqJ_vy;OfY=YMwtcun-wIWqq>fvfZe56>|c
zC+UVxE!O3twK_aJl;2T^-;3u5*5jMkUGu)aWwAO{$2fOq*OdRu&614c<%)K4TJxTn
zmYeGG*||pV1~tifz>eY0Ecuj#2Hn309RFi@CaWS-TKxxXymV!<7i%HI1N*KMR1Yjv
zuN`A5aB&GkiYSH`SBe(1A6dUig!xf-#R~oI!VPcblA6-x)JJBoTU$(#L9G?$C;IlY
zHu>)J{2<PeBC%(JRQS8-VpXGrQ%^S@*9*4)|8L2FTKP;G)tY{#>L8gL_0E#j(NC(q
zwB;mNdhVmgv@)ls|1lb`#sIh@0~#A`EAJ!?<IvyK^#uvm|4eR5HLb-=iu_3D{N2%m
z4f006ZW+%9LfOH*0DC`g_|=(AzkVq}#z%xmf~>xR#q!$^C0m+!h5j5)Rx%O8c7GAR
zxVXl^TkKN1U7NYzi9ci$;)qe*4C7V#YT4QPjnB>1EynwP+?r_V2GP2ie1*>jD>itY
zww_|QBk9IZvxy||sRy1HWP<S9|C*9^b7w{D&;1w5vOSvk-=I$R%)r24EqkO(K^>pX
z>x0s5C^m4%3JX{!h^m$PMs&5=LF0d2o%4TP-R59(vxu4mLIY&+OYg`K8(YJsL(1pp
zts>`6jZ~q49%MxNQv@;;<9}>^*mII-z~H8Q+-i|LcBrA242?M{^4ZY-f8G6mHU{!>
zA)5K0+2OuKuZJiuN*!EJeXctell97Imgm#n!ml#2I_yvHXU3&QundfH^kMs7JA69`
zWF&LSnU#vm^i^7&nGIFDzwcxV&Ehg;Y<ICwTJ|n|)67DWv5@*8@Vrg#KdZ)l=}(yp
zeAOsh5W)u{*Ya-jPB-Y^Y(_-5<5J9wn+oYh{1j{sOO<OoE~Fk%22;aQ*7%*@<8^$J
zw0_p%;i#}rO2hdQ1=5(^RN$(*m1!lbjGxQmnkk_Ucs@zn(dfy?ze_jK^%lm?;WfSP
z$&ou)nM>ADzhE70#X7Akt>f{0vRkLYe&#hUJ$1rrrHElps>(oh-h^Hii>aOPR~Pmc
z+9_t4G6p{bUc?yVbrBC4KF6<^whZf}8jgip3%spv*%9ybVigtwpq(7-P!(!YEG<9j
ziA%#$`k%@(vV{z!Kn793tU?I`VSEH95mh-Ne9D!-)2)9ynh2|{PafB>zlB%Jw%b+`
z*Qfb5IQ@UTy>(O^-MT&)$KBl_IE3Jq;7$m^g1ZI_t_d_W4h=yfxCCw7-3byb(6~cz
zcb(05&d6GG=gyqpU2E!}x4Npjy7ul}d%yNPZ@I5!$u!38@~?N)Oit`0_-1MA#N&*X
z<yRb3C;^jPia&m{7%v}DR9fn2T2ORURY;I*uzcDpd%~zI#&PTNli2O|*ANq0{cO*l
zM#d%qkyn@|Z8N^PY@D+1_npy89VP6o1)bkkVgKrFrZF%lked=jYA+;*{mg&WFJb6b
zd6B=wlZ5AiziPw4SUcU~yrfWQC;;;bek%}VAV&{OWwC#)!ax5NuE)4qp8BaMKC&p4
z@*RtP+%FYg=IoUe*FfkQZBBZkd=JyQSNwW1$^P97cbx87KR0tg!aWubu2Vswg!JT%
zJkdR61qe|yD7Z$R8D`WFZLkEq&pt<tXuQoZ+pCS4@mC#*kAt>d>oLB+SP{i1Sj()*
zU9i~b{cXGll09q6e)$CPOKo`(hM^wX$Pp#W%)1-dM`<>|%}dXI#2He<NACyRtAB?0
zA$3-P2q%GWk%+M|H&W>Lwf3psl(z+$lfLGl$1Lq1Pjeq7EkK_12Q|)G_0Pxm>>BP`
z1(-N*{qYqbgT5d+!n9aaut6r@mNl6<Hn%%eIBH7bvwu0xWPylbzZ@0i>AGtBJw;it
zjF}!dNnA6j-Rf>Y&BDs!Bx+7oxV^K;=gHms8j|1e1n&oh(Z)i6lKE4MX>=JHPrrI&
z-=S!c)0tc534djIh-^@8Qzl3dr;jZroTt~9Cc-pIo2HK_BYAkotGl>mkM^^+^|?ko
zZFoZtyUsJZq90Bi(IF8psQfZ_jJSJA645l|Cd$#>_^KSq#Hn;GFBiQ+>)zKnV{x<=
z=Cayp>*RNc&laiWadh-^s}ReJ$(}Fvy}>>}HF$xuMyRP>dPo07dNOH62(?Nx3R%=C
zIb`~&%fS?;@-Runx6*KA74Fl1$M#=7Pc1HLTYG;$tdIR2gXocI9uIbOD`}A$-3<|R
zeaLb+8TQNe?_UCwGGnIxL#IyUGP^;uHSCRFon<JyC1s_p`7Lxk1HYvEFKdZy>>u7?
zAUW<RJ(ocumpSfbJ}=PFdeT85-JPx;5@Wus_ZIp4;IM-j{#O*PV||p&Q14KWRU>$x
z2)gY&TJ42kjY^hXVJ&kRW>H(h%8^tZoX!L;n(^CUY-hDDD!0djd~!G1)yXm@+4X6W
z*cEoSYBE^#?}x=db25OUNnd#O^bJVsWba0_3THJeJm0pUeDFthv1BpV4NG2y5k}tP
z{l-6cT`AuDc_Vh1wYRF(S&Er?T7Z(lDqny+QT~^b<H;vv&0}U#p?-wrYD#mme)fEa
zUo?<QcA<|<KJf2t<V$E|Khqk;O82g&A>PJQh~`=9w;=k#xb(8c2NxhRSIi7$F>z8d
zZOO6Y)KR>inHqe?J(9&R9f>C?$F3htSh6{PCuN|us5FFbCzvpB>bAPFBALmlPlRQ3
zJ^u1bp5oA`$0L?r7Ncp?2P`bC3tU6!U!O{)sqD5+U_fCFGnm7Ob&@Crz4{brnKK3~
zl$F?FjOwT2OWsqLRZ6`G!BWJ8POQ4@aqGc0E<~kVvTdWU#^vJ0h-#{&+MF8tAxc0%
z&mREZ+&*MFOC9V8LL+k8JSKUrK{VW#*rRDoa~P{-tgA<DA#Ko_PLPT7)$bv&uv+pe
z;#N+ahsp~GU==12>keq~0lN&WUFpEg|M4v_@5Vc$B=<olL*noN^MgF$8ysx!Z#@G#
zKjai84Te2kh()47(Q%m5#iJJ^?F(hMT+T;jL)m9iv<@We_S_T~L4sUcT-cLAo;50B
z?x#T>$E4*bd98{#_%#F@2xsmu@>(1Lj7hYMN<u0rB0<Wg5wL{#$c_i9PqOv9c&oa%
zgq8x_Y0aVktdUcp_ls~};KZoLbb3ZM+0fh}&5}lPuO9JLur;)x0!rS;nsrr>4}5ro
zZNU0vWqKiNmK!0G>H-|wZUHiqgGMV7^Qw8@44fsrFOV<a0|0HZio*s;#LHvPzCMM?
z#f}%JVl0y-`R}fL2uOLq!~Y03<f_fC&u23if6AyqW;yhVms-b1-C6832?8X(*%IDX
zYSMFbHzJ)Nl>BXk3`&&uTmeczpg?e8XM;~@g~gnZAI}d0&Sx^>SdE;V%`x&?p<xYo
zu}honVNa!c*Dd=8$0#)W2P{+bs5uiU4A_8|{T=q_KE}4JT(O3v$R(4f^><#Hn8N7t
zSnO*=Rt{)AmRa7Fs7KEESgdbR4=bT~#rlI5sZ6O2Di&+J<a2A$%JPXx3-<wZ9M710
z#krugq~sI87F=O;$)XSuC0=z+PF}zrot<NYP&aP401;q)S8MC*U^RYjn=c{&WOEjj
zoIJ};?1@JwI~P$@wBu`RYWfka(4lSWy<&l8(ZbqV)UgZj832u`6=(@Pk|?w4&X>nJ
zKZIOms67hPw%B*-8G*j<-2Bfgd~avd9%6&{80c8{+X@Z%7H|XHZ#|O0f(P2n{RV?#
z|4W;^{{q%M3hv(<<vq&eU)P6-K)}-Wuj_F<k^e_OaK@(pajm}<iOPq%=IOvU-u4<N
zQ&+`*KjlhuigzrBxVU)#cmBuS(M+>E-BApiaxKG|UjpTnvpaa+zJ2Z_;0(d-6YvoT
zhW#KfqC<sZs$o(yhvNQ{Q;IO6r+;(GgGo8l9TJUY+0hxafh=vu#sI;=D^J9sP)4zk
zlHM^U7r^cai9r8TN``~;MSr3>wJfgGVIH$<rdEAnX(>b3ruz5qWZ{Fg?+#0u(PCZ;
zKIe<jGsq9QIZT$XX9~b}-3vRL_iui-*L20f#?J1ls0Mo1n4XW3kh9@{oYZ%6pVFGT
zoy_AZp&_c;=1uc62hF4R7^Ip<`D_?Xh3;qutz=~ldIMWRoBjqw$wDq8>?9!U{x>CS
z>uRsrvMnn<+gp-V`~9z2BDNwk2B!HKwjv|xjVFq%I-#NWM+?6*D6(p&OBLoCSu-da
zl-MVL3wFj)5;V(BcSaR7Jp{~!>DcVZ=vY{gPqvzK?i<9E>Jy;;Qw4`a)X(s~B97DX
z`mhbCL_osK%sfUe=nQc>-#3;4b*g!xm=q@T3=A4^Nl86`d_H$=p*1k#{M<uEPfw4x
zw6t^#ls@3f$jl@Gb!5iK1sp%&kdWvoOG!O3y}P{`+n%nD#-XG%P}bHauCJ`BvPfN2
z`?c~bZqgffM)+OUMjiFxdUk$3s)PTHkft$hLd%|EIdKypJZK|kgYXl!gfE0%?6-*2
zm~t3n>XDQ$2Ix343K%nzb3e}Hroe=#?L$R#S~1m8)Q$S6<Dv5CtcSa7+z$zfu|7t$
zBeyw5baEYH2IKbk)N|48wLu!tda(~xp2fMp2r*Kc8+dhS|18Gc<O%;V(=pv%4wWar
zZ%=(Xajd(U+?*Pxgeo!9T~Or~VlyEoq-W=2^vFqI47@%D{us$E)1WcY>AFMkIX=tm
zNWs_sekBiY?>KX3$uGO{^*C$>WxE<B9=}EsSq*@wGi=R(1P5#4;o`R4+fR=kjc1mX
zy{(qI^UpJE78@@%j287io#B7|`gH_wn%MxJdi?>oem$`ZXI=;JXc13WI}}@h!blNC
zy49NHAlhQX=P=hl0SL2rK|!nrl*`&<ooaguQxKCLd-CMTI{=#eW}{hbFp%cY85+;3
z^+K~yTWtW8gCKd=05%sz%@s9yd3h8+-kWFP1wMPB(i&pg+5p`dhO8A&w5El#2yp)z
z;Bzm=N96JXJ>v5GAKc~OBmoYbg;q}kbHDgs=fR;dIVBn;c$u+MK5ZF5=-+=U7FlZ*
z#0%-$G~^)#&d+@Sm|x>t8<Z<2wudkfoTK*8#9hq)*J*IAxqr?5=WR5ifRE-50^A{X
zI5JwN5J__^fp;$5#myBEnWABK1{|2KtQ<lz23`?I<ajzmaNqBsz-(z`_z$TY-P?i@
zUdvrta(U4r-Hf|t7tj@5f9t92tL@HL>DbBqF68=x%Ru>G8AnG)UUyda*ogyYrceq_
zurpgQ^I@VSoz!5Hl;6Hkw~RJgA=l-`<g&8x%`Ap$zRS)2jjEiW7pb}VY8?YmhN$lS
zANfIBP6-@S3wiId>#{HJLW6>&BM05ZkvHB)^Ur&cb&vcG#h9e~(yd>&p57%735B3+
zJ7z|>Xkb8?L@PY7Ml`f@huE2Ma4tkNM_lO{PNPO#*Wb|N!JoW{RM0ZPZ6p{uF^u8J
zek+HFqt|!9*~oydjSd=&up7hf+$r5R4*OpOw0lZ6Ty-Kj))*l(bsCNT>_Z9!SWU5Y
zG<0^p03;kv7X1p<MB&%59F{S<<HZH{@KyihZrQq?l1Xt!04^xPgMZIv<)*<;R%WCQ
zRr<Is9D|H_m~>1PcHVIVaL-Kozhq-#3*(D*<q_$0c|waqAz6^XkZ{$O^sGRMx*Ft-
ze2R?>e_fa?oodHoXRN`wqm9=2JKV{9Qb@CmU&NWeeZXg;%Qif->*%ii!p(3CQE}?n
zF`^<pap|~}NbYSfPFg+RgUOb&p^vLX9`14<$L}FTJ<Y%F4C|s8O~R6eap^RTW<P5~
z*xl(O_sp(mTCq{2+TLOYnL;Xsg>EMSS^p$;5b~s+Egst;38<I3gH!qu)6ZcZ#VHgi
z$%SN6sXe`f!DC|sVZ`H)XBRw4OT$d=mg6TEf+hK9PCBWYhnU;AVE@XY*`zgRAcSV5
z@?$8`X~!O9{<t&bwpd>4k4hn0Xk(-cgVFN#K?vPpJa)qa%<uqgS+TnS*VYic5e-1w
zAW@fcEP^t!>a$>ZT+j8yltp=H`jWz<6~grdWBv|bj5tKbSFE$%-$yD3Ln`_;#-f6~
zuMtE>bG{uzbl><VXU|K?3X&5(nc+roE2&%Q+r5$aG6$4GONXxNdE!NF8xgmNJ(N^s
zZ>Pg|B2By%GE<A#FK_H0s3gn1>f_g4(pDh<;pc~BjKYnq%SCSRus#O2^3ex2OFBU(
z&bcdBe4J2XpUDz-SfthUrLt`Y6IF{`X0sDDGp_oxJ4gpz{cuJ*a#l`<NvNd%lNbz5
zA3f^Z%Od`+lRJ#hIIU9Hl>QqE!ZjF}>ea35iJ#?!VPVC(WSN7Bkq6Zm_~i0}0hMBm
z#9}o(mzY$~sy`u@iAW4jS<#DmUQqxW2({hs=83<q@@rgJNvWvcD>j_U#hvC3R)@yu
znivMIQ=RZ3f;nws(&(fKfh3<%LV1)@$IUaOZ@v>xg-_KF!X&y4WsLHY1*>+VYi&zG
z^3&c30U=?)>HJyO?f#Iig4V)XEiiOKMPGX_m|80*tQuTjDpEb!K>_X)=RT3!5nlYq
z`tvj+X2IMVIp^2O?hDXXr7DA+J60bw;RU?<g!B3>vh5KZ2fsP|s;{#~--n-$dx~;j
z9;Tl2Ht+~noG&J(#^^eEsIAPe-m&SUAb<M+y=e6wYV*K-8-=|=il87{%796v+=aWp
zUs_*$<1=A`j8j%aHgYohS55#wa_A`?mtP+xd6>3}lnEh|zS?<%u`NAJmr-9HCuEWv
zr3wv^nU{`)8N~Uzy(=}{yw7mIJC(iE*`3;CSz_pJu({Ow@D<xc<5p=RJX2QPcq)_X
z^mlpJRF9;bvZ8ePn*OgF=8)-y$OAGgqsjsrLMVmI+ca@<&7JPyFW3#!ofuGc%;moc
z$uK4R*~?0qiAB2o%fIR!j11JqS5gz4$PzvaKF6opk&q-VA63ea>kE|E8x82U78Ion
zyTno1*=bvxvyNOG&%7TqwmQFmpfhe^_H|}rnjvdzyocla4Nj7{HHU;-VRw$`;zX4*
zVO62w16Cq&=XpN}bi1wME82q5-_LobmZj!=e*J7pN3I<Z9orJ);dcU_7p4w!Tmf$O
zEywY?I2E4E2L7dj*S|_qQ^jE=`bjUGP#%T4d@yV#@8jQ*8j5<56kXDlKOkHJF!DZk
zD9BS~=zaWlV3MTjTjtRBBaS*F<!#fp8Z@Ywxe%SYs%}Xoq-x8v!B+a|A7JeHc+uq&
zt72jjgK)Z8V!Bp*$?|A$F{Ei-d`B`Ocl&Yoi2wfNlp8VoC4e&aUC*DnPzb{yDgMVY
zLk&2{Az|%ND2+zzmBdU-;~C$Nl*m=*0D>fS)}SsnW4~K>r{{xNr3(Wiba_yf%;@*;
zSL8~l?WycS)CZ3E{dKod6folnv3W}M>S8dKIYJ`+uEG69-SBVf-DKC>VA|#4q4HXz
z^Uvb0qNuGAFVT~$9^1}%85_&JfWfVWHm1Vop;tVUmm3I70hbjnz02Fk{b@O(on`as
zYO(|&_t!=)k7V4h&@c_=9No`aAcBfGczBTuV|Ye9A1Rs~ENQZ~IAFSbNN${6F(|AD
z%Ua3U6tz@Gg?DWs8(TR3Mo3LOlz}}9u2#qT{vEPGi_oqQI3%T1R86OpZhPUMM-2zK
zO?|n>qj*1W#Zn;8ynOsYFVR?4j#$iUf&}ME;@|+f^UDKSsPaQlT4Spt#XecUsYACV
zJ5n5C9%{Vv-gq|Z)wcF>w7uKM{Uce55D3b~CFiQVK!X4*1QDqylVn8R<AVMWBnooI
zZt6&Ll5jtm(~xm2+EmRM4$rn3G;lGd*z|5K?Zy6GA^y)2_Ek26?ndoUuaKwFUKIff
zhK10RVNRu|xMf5~&K5UDVp@8aE}2RIO0$l@#Slx1^)osl3##?Wa2S#Vzy%?h2I5eX
zDDa7RhY*AD5)p-NlDy9BR7x{ZZiz;#!{jBQgq)EX5K3<)JSvU?C5on+dG<4Jn(Lh3
z^oPLLFf6i{9aG7#iLX_)q<)fjvLx;%HJ@R}x~T@uqO$0>S{c6x+S#xf&S1xc=@PYz
zW4qBmr7RLR8i{Z4XAZu^`HK1jNwRvZP!;i+oyU0Jp1-5Bo5l?R(%gT1id6i$;IK6r
z5*aG-Hz6U(_Cpw0&fM|QX!PIPzvsh&CE1K)*t!=<>L#w5)o!<o6f~Fcv5{Z(_(X2r
z1wZyiq<ga3GQNp*@x7K|Eo*37m`s1lw~g6a_iK%q*MAFR0~J$dlz)nj{v||SYbZr@
zf@=(Su8%L>N!W55BPoDrvnfg@l5}w=_=KCzh|CRXrz2YYF7V*7|Lc}03W>T~Nl#j#
z5yX<~eduR~IT{3q1iZN^7YiD&f4uTHRnz;qHJ`z$kDo^;Iz4)_h5bWGwfi8G+02u1
z*%6>2(=FK<sX)a;4`kVB`tqpbV=np~sZ=Eh>*th44}l;y*_~C|b=!{4IP1`n$#5q*
z+I9eyKkuMFyp|6M9e2whqS&|-b?#ex<wERtIf}pBKV|e$n|^wf*Jh5eBdDm`VGVB*
z&_HKz?Fq{v41A_a=xEy*Hc;E<Vv5c$zN>Qk4Y+Mj))UO%rO%G?RxCScH<|M@PLY`G
z=GU$p@yL@KTu1){h=X1A(J|^*H>&_B^YlmIjSPyviN&)V{-+r=Du~Cw+Slc%D99pj
zaF9Z@t<PN8(X~;F<;zP_BcMS~OinW%K!Spec8{gaz6P0e{dtN!NfvMtzGiZk(m2s*
zO)zdZ8=0p6ojbJ<>$tx&vd_Y3YD76{SDfne>*MXtS8OSKc=fKy>+TMQNR~`Qg)<e&
zCmX2fQ-Ku1?xqM#0I+Wc(Fvd;>~c!fb+`f*R8bCbvuZ4dh+Hkl3Qw*xm0Ta_lYP&J
z@AL~9hD7r3YXR@E$>T(mwfv$Lrzs~dU$}e<M+noh`xiJJ_e7-yFD6q^d+$e)SS(qZ
z#TLHp(0pe7(9o+zyT2h5k}xwLsxF;Lx>%)V+YQ>~+qqNZ2-JWrN8xRz(SNe6rbYBN
z@@wtDkPwLg9s#iE`g_Wa#D~1{SHHG-fnqIHHZp=qv(tg&^S+v+O@$suO|Io&xq?bf
z1P}ft6X`32f}vVA#3MNh>(lFG6#*}LT*XI^l0r`WHmnOH#pLK|-?Qq6A~^~O;&PJy
z>Hhpq=!3Wze{Q&_yqZ8#iJ|adt0SYH)4^5Jr{PB9(oz8O9$m(gNt^91HYI>%S7R8+
zB7c=R^N_~l&h&1k%yCH;Ne*dlx_LD3dq&Z8UCN3{F5hTP=?lE-znp}J%cAL`vTatk
z+(s%LvYF~Ukf;wRvse>CtdHDoVAxdQHIHem4sAI*y1Hi?U8H5wr;FK3=xjLs>_;fm
zajtAbg6{E@w0H9}(Jt(*+DaijQssn^#^e^CJI~!mcy|lAXLwJ&M$D1Qhp95H`(&&x
zz3Ce6rl+ka#A<?Fl-c;(p#ImNN;U44z&p?N5!dSlA!3mu+HZ|_93b4?+H~A*b+;jW
zUU9+XvAUxQlUh3gd{&!(Y(JgN`8>s#@@O;dDdzInWH=@kMtXMQ-!WX1oqP4=;oNx*
z0cn!~70NF)?d1`I#%}g*#b+laUa}9Y|7a~erq%b3mRj6N+)UFcKkM1@3r>O{3!L2G
zx*GUV>@{g%QB}T_H8~a%xjHVlI-C>s=xTXT;5tG;N)(pI*qrtYN|mN|LsV)r2!}H2
z|NKqaQShv}e6i-ksPX<=esXa)^lo)5<G)eK0?x+*wR^;;agk;cK2O>*aZ90g<k93&
z-3e)2wAIWLP3BCoc^(W@9aSxF7>&4byi3iGz<9aHXp8?LwZ=r&67$$eKq`whrDx=H
z=sD1zkW5RBZ=P*OXCF$ZnC@6~bZs+{b?-=-Ejz{Zi~&}J5_8=W%_ds6mb71-+fE0t
z*IXVax*f2^$5*FDC!1pv_0bB5hj#M~gvM8A#;d)&6RJ{ncelvflcgwI)z6j-E;&sV
z`zaethVav2I1{pKy5-I!RXcOxCEeO}8JG}L3{V`>?agPVK2Q<2cwS)~=i*||psua-
zLp$j<I;QcmtyXc%NVe@S$BD<W9JK1w?j~E88rrXKZ{Jl_*=t9d7x3M(ZcLSNKPX=-
zYMELMFELvc0&raGU7flGr0S>Q3+=5GrO0#V_3FMZ(<VV1U-^>K9U+5)tRAUlV}SmG
zq5(eH&O3`6$0O51*Pb9Z@!aR~Ae>9oK5T<HD702`(Ps*O)Cek1Fuu=8B~!)ZVEU+#
z8%J}$)&l+NrD+88DP#Oe>qk|8sbFZ^S_lmuN3#On1o;+b^@}2x+Er4M3L9#>(Ylsw
zB@lt!Sxr|&@D=k}@w(APQHn=IZ#6-3SBkQ<(en?c$)C;p&$TD9;|P3fAS`YgrrK~(
zMTAp0zI5V8H@Jfp&XlfSO^s?(kU%#Yn}hpuM9&w;o`uMT(2{KlaZ%c!<KfXYSnQ*o
z(svvEC_rhtyY@Z2#=w?;(wT=~ax|!omus_WxYn_JGD!SMCXk6%$c<{s*}G0+xqbi9
z+1xjbZ?E_guvF^|cs#Ix*Ob`!oM_H|Cvwy})T4g!%8~d(boC~mtb&)&WupNR)$JU{
z5ua?P=j`A8)p_6j6W!v4Y0aJC`kiVki<NM?QnLL`cNqbKN_5VqQ@lcDuZ29B*%;?-
z<XfA4awQq<jLGsrqs}IJNIyxiYCjPT12cMYjJ0I&w}k=AEhAfCp3(FzeAk@a?}nZX
zS<kqEI`vUeU6Ka~ghQK8uSJL2hF3OsVG)~=pbzqeu5Wape7eUjgY(_ct(29x>^mj$
z%iBqO2i`l3*}GfR0byZklfIWCR|<IOo717}mhyFNAwQ1q4)u@8Y@!I24cpsxqJO${
zc0rcgg;X=4FzzO=BOP=KvR6_r6b5$V3Hm$YG%DWNw~vvmQadH(s52CTSPx&JFPUb*
zl3aib+-~MIABQ~AERUT3w_h2vO#9lUXqm!35ui3m-0Gzusoyl!Rl7tfKRv$M@bE-4
zXW{!giMG?y#;DfT_Zwj$)Pu5}{LityLmGw;L_gQ#)G$5K7xyPbbB7qut^c+XwG(o~
zSv1@feb9V-YKmCTID!U0F%^!3?;ua&h3J3w#wM>&WYU|Su-$#X`I%^rDk7B8KQny5
z#g1{LGN_-5xCZSz#6^^^R%_$EMAnvKpe1*y4Y_bb4RO;p_VPZC!}3_MSlfc{TCQ#}
z$65=Xq|#iF&Np6LG{3SdlD)<w^axy~1DPAk;kGL*54#Ht*CxBL<_}`6itNp;?<P#V
zvNh`%Tc1^tHFXw<zw9*B9N4${zQ-MpJbE<f7tlQQN3wg!j~Ge4;c712il^u)X~QwD
zo>71?&$q=qeuH)gzJVU18OHsV2lp}CSSW|SJX!L=?`S$lMusPxVn=M4S%BNfDkSr7
zl*#^lGYuQ_L$RIt!1-}tYTLKkV$g4FhM3CpXB7+<sM0OGV#Dk#ZnbsrgED^ThsBaR
zjV^W$r7?SKR-Vd*%?H#SHwE%%v2vJDZ1U|vI+9Hf+Q>dQJ-282_69KcY@G=W8rd5?
zXVi6TtNFxk7I@5+y`@{lWHdYe3efe+F3kmvJ(AP$U3lWvtcfKYm4y>38X9d-81BoY
zYW(_c&$#&os{HGZ2X?~VS?gI_QZ^z}KIgb|)MVxMRihK>T?}(w9-Ez72fIYgwATxO
zLx{cW)?CG-a_|W~J-zX-ea&-Ar3Ye}-k5QibatN^{M__{X8XFACx51PPw)9af~MOl
zyzAyJaSOCKy2Cnw);m=l@{=h4X4ACcwl{o5)ITjAK0ntL@j;5zja{Zap}l0P7Q@e3
zI~bXk#IQ-T`hDH0bnw`DL-PcC;oS6zfV`H74weD^-uwqt9k_Ru@j#BgQk{X#@l!GC
zt;AN=$P#`&%qAKClEI5(bqAvlj`VJvq>)0dh76;A5(_Nie>``Y53BQ$?vz{2bb=PQ
zx;WbxHvaBk_6@dtT;({nKV<XUGKMx9(<GG}aqFlUC-D_xq|gptNX%lD3R-ctofdZ2
z4~h>M{5|tC?GgEYaLuE-Z2h9iLzk<`?p^Ba+3Whn2}-UY3^L+|@QWz@A&YaRC%aRT
zt74D8y6kB4g#O`byt8(3{}!ZgYZ<pFlzaBb^Y-UlR~WnS;)i2a@2Fr0z7|EQq<4yl
z@yLSx@o?83U)4n>Q!G3DkrV9|zpSlp%M{>7)~q8mMkfR=2)<)>bis`<PYp`0YHzH^
zDpQM<M02#unMV6+>TJ{sD`e+9O{6^7^ZxpY$kB9uS2uzamea;U+xucV)gohbf}nIM
zRxxo)6J+<GtmWgg!FIBn$;%H$`?Nn;gIl%6z8A&e&PHLHjhwVsQSQ?mjWbNs-4FSA
zu-vCB{un}da;T82wmk{wSm&C+qiDJ##IX(ynXG>_AbyE$s%0m+2@~jldGom3O%``!
zDwN8<iY7WbV9~+QbiL!k>RjEOTt2k5>f+SnZ#~feSV(pZxjx<fcBE&JSt!72l6|Lu
z9|y<W^9dc2RCC<CL3^(g739>tS0c<pzRdpKwC!>yBytAgFopG6LXX%&@T5!igECji
zPPDcvUu^Tsb4ue<8i5jjx~aQ;8n18Oi?3GNw?+Yg`5Y;VO5DwK3MMxq*ARp;&9{W%
z{5{DpSPoHuEbNr=zOF6QWnfD-%T}5m*L|?He8)i!k<Q-av8qdFH(P~?ky;#0mlt}T
z^itsnVF&R}E#~%^Qh{uqx==(;E07jym3m1&XaZ|S!gi$0$G}9KA73K&rTNY~86NmH
z`JuUu5}NK3tNR$O2L;0TsSF|}*Mk!0w*t&ZXAdG?^GK<0Tvp;-R|n&4ybpNB4yCo}
zlltR(g;kiu4=S9UysLBxl9kRFV^wW8K9s1qJLiqiCA-$%-3SxGj+_|UIbRD`-QVmR
zT>4A1jNRxjn)2Zg33qAP=z6zLo0KrHh27Rj%msTITS<>9prteFys!w(1e5&L-m~{=
z84bhz5jShut*U^ZTI5r@KYw8NVRA@h)F;osnjYngTe(LvXb@TG@|X}mA4l?RqH%(<
zEUoAfcA1uU61RXET8jUMFKu}%^82N?qMYWwZ@7ef4Uo$Dw!1{S?Q^d#g{`J4m`R&8
zu-Lt?Oc1A$j-`C9NDer#JrUA+#6ZyNoB0wRM<Oquw^-`qc9O|Nn?}pOcP4}eOS@9w
z7aXGY4dX{AC7#n3Ku>zT`*%NMudDgZUE<z?>z_x4{uku8-+1ubp-mVCth>O%Chz3>
zL$fn^7I$Upmo2Kpp90bo1NXP~IKi-GZ=xIFeeQ|O*2UW`9Ows~Z93($n!#6pqh9wc
z`a^(4yKWof3YN&-FQlZfrtSTuB%Ymv_w%XTl#*|{7j)27Ha_#G`V(flc-Q$&OeN<U
z`8NPkl`O)en5-=e${q$f%x>7TJL#8~nOITuqdbJEKNMxMl9hrp$MDO3Tx@hZ(%WO%
zu@{x_f4*&6aw_9?k-9!u7Vz2@XxNr5U7S7YHqq#LO)t9>P;|#aE|1>*yxCJuS-x}5
zHQdPFJ~9~zcQU<@PJWo!-1K2L$wL8W0TLuPwt()XSve&+DZO)hbSjIevDaogOq7r-
zY%-~s4K?A!7WWJLL;jG!;`pa_Ke}l7IHG!9KUb2yq88(OR*H0L{3(*jWXXhkc9yhB
zv8vVeiy%&()p>Mjd+>s92=e5!@7(2~{W2yOFF6G+IX-=_d>YVmlypWG#5JC1&AAQy
zIBnM_$XKJO2va6~VWK#UN3b4<8Kj8xaUlPDy2}<BHxC#k2l?DKL1EMsv^wMgQgC<r
z)z3lG%LHF!y_clT=-+~RLXeYu4Y206GMtQ-^=jBAB0|`CjP^%T&3vO}p~ai+wyP=)
z%1<o%^Qq}$TrZgeg^(wRLJ@{unBKTiMzH9|2@Ys&&JLzNa|7|$MG`~xcaGb$)fk-3
zhj^#EC{jaHP97Vxlmb8SpDN<9KG{W)fexm0(@wUBFLN#R@eeulzhFD!mUt}bzMU~L
zw$8adQ;7#EwnBatxGf|L4Vtd4y<$5g{Y3N)GcN(2?bmf)Gw@t0=tE}=&FMsg+V+MQ
zxwAOM29YV7g(0sjg4@6SH1{#dS@7BJ?|t?Ww=BblR6cU!#+=z?Yw>s+Hs_QL8TILg
zHOv;KFBy~hCAyh+xRTN9$=4xK>eD7KwkN-akLI%tStyYyK>+BTbz<8lvTAuMMysOb
zJgn7998N((8P#;;7ob&3;-eTj^m~geqKCNW(j`)80`*4qIEV;V<Ywv@<Q)%^C*KNt
zHh@r1Y~lJ!DHJOvGP*`3vBs=}jzxdvi1Wl<Hu)#UzH{JUsh2J?Z98Hy8*9osdn?dO
zyNZ+0kMM3G&r&?FT3#1DweI0-r8*1RSdPTT>4O{DlLMclW*qV+sztMJgZuvbGpwm;
z)11n{5i|QeG2L@nD`Y|RX<{kbg!EhY!jvffU%}g3{)N~L?wmSq-o}#`WW*vT=suS4
zuDKz0kJ=Q?x<`)#xw=MTc8rNvo5_!9^WtRO=#~e#=JU{|-YF)Y?l0wB_}Li<Q)x9E
zYx3`;z}??-Z@jo&rBHfbN?`l<s-*q9BowPfabP_KKCV<(Wj6;|r0}PYE=EiBEC9qr
z-SlS+`Vd`%7Xj<Pw>ZUuQZ3Jz+TrgvylyD^KZn<tL3;4wyLIb2I@N5cv$k;JIVdjs
z(!7%D<8$Qu7-<7^`L+`b#ipjYW?y9VN!P_EV2OTIt1A-oR;wFJZj^JlC@0G1A<hOs
zGh?sX5PhkfEU@e3wMI*kW65qm&yn2vJh`!^=(1m0NQINA)VyyXF(R!x))63zkJW8Q
zG*(s2`Y1j+Eyv=Ne{~Gq0zMTTkXexha`%9<&2X1q|1Nm?-=R!Hv5_*E+14!w2@S~G
zbEd0g)?Zr6rM(LRK{@G-u!xyREkoaXhZfu)q|Acp(&QhK-P-1vIG3CA<!AxVL$1l8
zKD4pfeZv@dQj(F+?FEs53?Dfl?^{|jK___uk=u?e$KQ*;%Wz@Wufs<p<nX4?>Khp;
zyAP}0-^>diqzZy?-OVaUQ~(kE^QG{$EF27KjDs$3lWxpVjI70+LPTj)=?5}%cIyV_
zhY{?$6?StCGTk;K9_pH~uJ2`UyHUG>G5EEc{RB;C>&zo6Z4)=O13o?IT_P>ik<{tX
zZuFut9RvJR@vMKhlAr{v&p+Ch_*{^)y?;qT<@*P}PYZ6|>A|{@VLhDj^!obR#%^Z!
z=}ja}^h~gte_)RTel`Ye^h}r2Y@I8(H$oE+8`}}jcD&Gdh;>wPsPWww5F6JlH|Y%f
zuHED#XgXPD&bxndBAqP6NxidjAuCaLUtEUqn=|f-!$q+ok#E2E9&c-DMLD1;PXD*J
ztCndagPEOO`rSKpLQefihQ4tT`~<OA76S&5R>}Sl{G#@eRkNwb7L#F>0!c|>e@r*r
zzi@o(OXM_FZjqTB)Yt7{CrYXMAY3v?<39fZrbAiT8kO8?c9CM-mzcrKI?6t9r<yC*
zbUJ10aWufc_dOVcfi#1L#Q$oi`e0nw!MdA@8iVv@F7Moe=W?XKG-xS~`@ZAJyynU<
zay*<0$)^?moRdkzeJS({Jb(9mquX%8iv`d+tJGR<#5!Mh=zxg%$;9h<{zfj-W%qeW
zmu(tNkUS=ejQR6NLqQ`KYEbL|>lr!Lcf6k*Wvh4uarEAInO(!nmM)41cd182Jd?(y
zSF0-<;R3#EFD^{VamDYhS!IOldVinMOWdWzIwlLc>r|UbQwF{CDR}5JQpjD<a%0F-
z-h#n{s)xdnWUzpK_lPNgE{7nZ>(3*kt}l<gl^B&+O6Vf!CrnH}V=&@tn~JpKE~Bz>
zB`nD9vlF-OGZP1MN2Kp_a0O~LF^e22FTlhhT*SK<fyiBu&wvPQjjUA~`q9r{VD-#g
zVC}4R{d&%^hrc8D+5nPL!Zfk!-YqAiHGyk)Sl_}@jW_q<j`VaVngF;iwQ3zUGSqB)
zDHU&TuN(k4ifVnT67BMML)SL-sfNaO?H*%%e0<s9L5WV2&(jpIP38!aWxD(R$OJWJ
z&T_m3uztQ-ymf!`S;T4c5lEZ=#0g4Q8T#BZr1&>s8u&?jO9aoDrkJfe7v|>vVb_7l
zGNAosha^Yh7548?(Pr9*pRkuyl1Ek*3B?*izwgFDf4jSDV^()JAs2y30=M?N2=<1T
zUfkEOzf@4uZi3-@wE;g<{Yb5?t?Rr2-6XWEiI(hUQ2b7hUplKwQdKhziX(n=jOP~n
zNc3Q#j}xGbt&EM+?E$HWEZsXU`bm#3>E036)4N<#PrFsEuKdO1&P8_#2ng!3>1b(F
z?<!n|ha$;mm!+>*h9)K_7Xf93vG4e8!LOd4Pvzx2-}oJ(0JYCXPS_tAtL~HWBHiU_
zhh}q%xonV26sWHN2}AUM<#AP)mZB`m9V5jjNE8{tXZ>=%5Qw$kNn{v%y6uq5yIOWM
z%eg91BehF=2iQLo$<q?m(kT41pW~xeC0c^MuVcO|A|@dzb+DuIJ;o7UjxY$8$a0h5
zEPah7y9qUDj=aTKCxL-fwKF2GoLz*W{{Tm(q<@9J)XH7_9VnaR14_%)rGHC@didR(
zXw6ReGo|`n=Gli(N<4=|Mn>8ztr!P~HOpiUM}pk88CxrgO6$>J{S;_$3Oyi~=?(@@
zZvk<ERoEg_$iopq2L7Q2x$%Plj|nHk%`3V-=%$iWRYgQTJX#wtMU>sA`*C^hHJ&Z3
zuZNUd4wgC9{S7zJQU&>7GIB&HJ8uT56tc7&?}~HOGG*#$O7st2>estTPu^XSYOC6S
zEHmie6z`~_z_;tg_(Og{_ZfH`H<u@)7_%X@wSs#3`mUz5w3Q$OrEVV(#RkW?!S9M0
zSXt4QyCO#;t&2-kB!xeQJ3z3+Qc_aZ#|jedw`D+5OFst%xYOZ+gul+`+ulIG^<vr~
z&IE98I*B@$bS=EUSOvq9!YV2%b)|PQ=olF3?^s+-d9heWc($b|_14R>n|1Q2ytHAr
z{m~#-Fc4!$;)T@^^(?XD&86!s_C&hxa3^RWNGIf|SeOF2N@Sy5-QCcegav<wOD6n%
z4E)B5;GV$n8ItgqEb$8b^x#?2B+qCS(-F;mgM$dr^CCZxH|iwcSJ~-g1|In{9KQh}
zKI{8rL?(s`L!xH>yD=@pF^qp-7k*7t9503CyOG-Y+<7m3KKG)_0A$=PLT{IPc4zBd
zO<Mq~6Sq;zgW04IxgA-M<tWF_L{0sPqW4X~SRFIyifD!PVuzvB1za3Y;``*qw~FaE
zRqKOSYz7V5{L<iFYUqu@h@wlKun>_R<c-V3^hDKjPKW`kg5LM7Imu$D@ho{fe0==%
zoPY8muMu=vTZX~64~{{yuZyXw{dzQKs(_OOKjWc;DX4-<_ODb)fE7WALUvm{MuerI
z!NCCI0rG!T8H9y(L6^K0#u;&q2Kiu3_UpeQz`C6X((@LlDsAhyK{s@B)5%1%+}>Q>
z|NmG3Ua-p@6clv-DuJH^n9Nz<^|B0cZFZq0@Wi(l$D^v9(qYo~<qLM{j-jQEAnD6g
zRWl<aW5VH0*o+t@C1puv<=Fj@7eN6F2fvFXxGmp(uIDayvaov>Aj7`@rDzAQv)uu|
z%>po5A3eIMO(Qb&Q9Esd4hZix(0M@8{WC!kwk^1S{SiDneD_37S(yO&_GpOpr1@lA
zccRQ3Es9c<MR+h1xiLc8)3X+yAuUyrev<?@Xv`<WyYPp&Dc2C(PpLzZ*F|Zr97v7m
zG32C?YY9W)LVarQ-+L*pFX{-cqgXkA`SN83H%Nj8t+8;p=s62ZY>*pTY@or^U(F#y
zJQy7(XECXlbfBUCjm8<G!FN}oE+QhL#HjTVxsc0xC=ECFL5jSbTn+p2X4jd5kIyxG
zXn1%%!?C5ey{wW_KYM6YRFmbpanJPYVp}&(DH)l$1n|G=N(i^jMfqNx&c^QV@7L1`
z2%P6w8yg!}Lr$;iv?L@X?9mz<x{E;ESe5r!wAyMoAT%Q+<V*KS7Pa7OSWFy#*pIX~
zD^H{)RNew0E-eicGrr*K^d6Kj$d9c5^SA^I4<AKP{(nF2p|<#IV4#sfP*AXJh)3Ds
z>CKLjAl$H-15FfVQ`5}CqBj->Q^W98zWn&v+}!>4t+(t(2CL21c#*5As>%v#ylk_!
z=So<DEZmV{B`i@E{s{<e33v=Rs3QSS1LC~|yu@<_RZjxm0?z%Ag%1IdEDK);B1IN{
z&Tx#DDhq$O0JBA=Um<-&S^MmDfCKUKW1cF9c>}Gdl|=8Eoc*<0lhe1(+WT#b8*|9K
z8fX#ritE*rxXwGg((s~$7~7xB&L1iudSuEl+waWIJ7o~P?@BP+Xoi(3lQ2DDfB?c`
zIG#2@sjbqIfX`;HS6AaYe<*_J=_<l(Ex|?FVR}~zFk3CKtARQXA3<b|xE^~5U5Hc{
z&)3Jop~G_G+dTv<(SD_eJp}C0dW#A@1f0=&4;6a|N+EhQM?D1P5WUwxR6_KOfvAD#
zeFo<QqxI5(5RTRx20}Di??7>#NGw|KaSI&+Tds%qiHI{sz>|5dH|x%Kn_I<BKvmag
z5IG-eTr!M9`~!U})OH$VGi<uP$75>_jASc1nEZ-m7#m789I+hEkd6Qoz}yqx`7ako
zfBRlI%!z;`;*Sm{fd6=`KSlJ45hP}ICJBCAQ|?dV&iuA9`m_APO4hzkOzdCLQ^YgH
zp2}wY|D;!d3im_QU#B{_7i34W4{>Tz)@H22SoKh9mw+%rsijSbVKt+yH37m3oCCs+
zvi4D8467qJ_ZP<Mf>LV&gcnL}1`vKIH*J4mwhuhOKaWxy{7Dx6I%a|F8LIxSq3;RC
zh)PQPSj1MHjYo;+8%w`mW0`u%v-y52Hj@6yiMojnl~KJ#-p*TJX6k6GDSK{wvzy71
zZ)e@-Hxi_F08lQ5!%q|eb#V7Q7aD>(H~_J@IIZn_F0`~btp&s~%tnQ(>DkHRv^r&z
zes(c)))pp=^&RDn324fD%G$R07*+%D@SqJQD76x6Fjfnc+5jMIP-@$N04=(2m@{Rq
z1Q2eZwLo}L)-ELuar%I93|d1I6Jv`E8utXH$vACjl|vq}%3Ar68vzsteSQ~zSb=P<
zP`$=Y&sgxS5N9>VybVRX?%B#XbFHhiy=ctUm4ZLNP^0yzMNd!R4Qmz}2zhrF|GnJb
z;lMIP0)idOkV(XctN_bUR>bEjAIs2E<n6#lJ0eZY$Gf+^y5N{M$YqwsIjA?&uu#NV
zx{pq)2G_Y0h!$LDX*L?I9uenGAcnv>b{ee-5$C5IG+GPb+;2Lqb#NsR$KcZ-oz^w(
zWzZlU;=w)`wYbh052N)0sayHc@#|&)!x-hr*vd`L_TCrR*KA$dN<6^HqgvNnENlFJ
zJ&1IRUY8Rk-PSTQLr*{R!x}<EsA1R_+pjb!^hITUS6u<t{IjF|Ek3N~l&$vadJ!Lr
z_4ev&5ufD!{SSp=J`@N0I|X7s$p>=0Kd}r0L7SPe?q5*+5m)H{(;F$}`mmtSk=p37
zg2E~vU$%fJJw-NnJEaGxk09`r&=S+HZ#Hs%{ja~P0N3pykGKf0^cF;-(XV{2|Lq0&
z48cQ<)~7#yvj*kt(_*F!Na`GDbWn)}GRNgCc*t<SWY9XWZI_uKaDDde5OrIh7p<V0
z5xe#+-QR0tfC=baVU9caMK(`O50lfqeX2w(j_DnxN5AES@@|DU^AVwGYYKgCJZf$@
z50`ZtJ$duDXxuUtLs7!W>#|23lww#<tNr?l{)gk@GN|BwMtet8hEA}$a<EdVsHl;f
z`)Il)x38jDRtyubsH|6_LEI6ew@2joJHZWGMeatItgwS13-8Y%i*cMUfIeS75M<@6
z@V%{zjC<QD_Bftf2u^Dvn`$^^l=sr+xkAs!L}b7^{C}V9U26Xs+Ol$5JMvoQuSvHP
zx-<GXWz0<TUrWm%&$$11t>N~l>E)qiYNq9t%5%Eval_k=F2wh$&e|oG++yiAVQLg2
z38q%JQRa6ETIuaffj#8r=NW(L`Sv*K=W5>NcC}upOgLsBPnLe<KH4|G9&^I4_m7Vw
z8A1Cqlv_4jx+kSXIYA;A7E8KSbL$1in%_O#cTK~Zp97+;y}I;r-?gK?x)_Kqy0IT(
zJ{X(r)jvgi>J<#t<q#CKTDc;ZoxOBg6(Y_-tTb8;;6-AiAt)33h6YQ*{}GkycLK>N
z#NB1r&6LysEE!&8wBATjOJq9y+ZKzt0sZA}{e#{S=bFkb$nlI%%?WRt>x*57bCjwq
zy{@2e?sHocfnEg_)7-&l_(WzInWcEWy<;W2`@+9t2#%quNSO+rn2kuvQok$Xti&A&
zFWfW&Om(~I)~0llF6@HdG8tTU4$%GQZ#Bxs5?xk7LRPqswX)u3a3F#+^JvA_ZVF>V
zC`1K5-E*YXQYWj5pN>i=cJ<j8-YjMp5iNe3w2$IP-1v-0lCjNlo*-8--s;L&{GEoC
z(QO}7QmMT#NFHp3*%2@v+Xj_0tgeJRF~_(+;T-oxyEnJQY^I3oRo6=Bh$(%q7EF$n
z?1bahO(_tDgJ6!<r)<JJUYypYY*O(!=hLKWit;!=)u3wn?UD6u6k7b+_x$t=)In>*
z78R)W|D|S<6^X2><4F>Ha)~rquOE}7%E$Ii!K2EqI39k{UdmDQAl^L4>Wu7SP5o;$
z<72IuY4n$uE1c)&=Pjf8XpFmp;dwWHUFIVXa>Jt22O_j-9Y~cvmbLXV9KG3FHpqJT
ztM!V#K`n>n;YC|eJ1hB6=Lo^voaw%8d9hPu16HL>=x=e1j@|SRG3tf*Bb_w=^<4UY
z^!ghV4D|X)scj#gEP`G+BF_(7l%h#4lQ-vd7w_Vco!6m%W}I{3yU>FfN4*JM^}09l
zpNoSzO^z_{RzGA}usXeL!Rm`zNk2a)MaPhnK&ZIck+8dLMz<s4Yhp_%N0&#2M?6rk
zB>Ib&FSlyNeCqq!5ud@T0R#%xeAgx*XvLau0)iy^-N(y)-dwEtl*9cU7GGshI50#n
z{cxR#6{s~p9fCvj4uB|uyzAi|re+d*z=LJbHu&LZiKu?r$e6QBrHe-TlV*(X0|}Co
zwT@4I{xz{NG^ks0bV?MiN>PvTWZmyW`jF1T*;;HE`6{~(Uso>@M%aj5@HTwnBincG
zhYaS~0z_hD-W)$(N5cx_jcxf&{#OR{U6IQ$mD|r|y;tJPvn$35TG9*`&(ah%%!BM2
zXA)fq;+z^?-`eZP=|We=F>0G@XXay7h(=tm_P3y*TL#*T#YHZ6UPkK)D=#8=eb4#6
z!81rPJd<DWz6{$ENLE8umgk67H7~gu#iR<3ogp;)(Q*qZe-p>q06p82u{u`!V%>Ax
z@A9KbQ)*n70XGw~98QZEq&Gf-i}p17Jerh7eg3P?m(7H;N|qw%n-8}pp`~$Oj<P^<
z-p*(?+t{nT=bvSY3QPU8ivQ|OgEjMiK0mb*Ib-zrR`4*eSG|2ZGkWzkO<O-I(^j-Z
zxDlJ+8*S3@ceyZw$7ht{rXOr5!+uk>F;V#=Uu9p()8v<$nE^gVn1fc>C~<|zR}ssH
zG8N~9{$$Fna(JrG<qrND%C|%V-(}fj%Zc619u0%@v<o6Rg+UXtg0?o==V55+HJ#6t
zsQy#!>DD1T9DW4cPsqr~EuS7f9xBw~Ih8C11>0GkVNv#T+{*h)gf>y?-%)*Y(RfE|
zH}&d||6gC9^HwB}t_5>)R%%)qO2xlVVO;O2l=|~oDn~T(8As*WW941wdLWAOIj~})
z?79=pJPtatnzvu#x-U*I!+b8Dn|OZ-ciBn__Bj|bM68U{)VfOUI&hp-XN>~oO6>YF
zJ-VW4{eFBne*o&gFfc(f8SHH`UH1(icw})tc9t{5K3;6*TBoaQzFe<v1(rt%#BZ9l
zwYv7d)!^PLgEi*=7Y&YTWw8?w6t(pBqKe<1)1~;|dJ+>8r`gZe)p_r6I-h7~{tj^o
zQhm{}-QmM`cYd2{BJWI@aB3YU?tk|%Rp+<t#)+BF*tQ0-$e9=)dF``-Nh9Ky=a>#+
z=AXLeVVq3a=GtOqtlsnbb_p>jjraw@m0gBA&64Fg$rCPtKU1Z@dks=wDxicNs<tmQ
zrmE$$z)Ru3iX@%4f@kLSb{*t@q5*!r^Aky`rpC2J1Qlg%6|gCjb9yR=L0`U<hJOIN
zePH*6G+Y$eg5k`UpojIy*k};9Z;$WSjmFi*EeO=X^ki`>1nOW2M1*X<pzk^9AE<+>
z=eb*aQ%($ASPK5e^Ef<S7H$R1RbVH200B(d5QY`hud?tYAil}MbAk9SdvD6#TeLmk
z5`78y1Tb?AB;e~n7)mtnd#;c^psWpkB>|@aRxLLDdGKe6#H&UH1Ter#Ee1%le*WCb
z`E(P*cjI&X*U9Ry;bpa_l~&fzkyUXyRvE}?CSlr-{&E|mj~>BhX=NFxvj+KrY2h|$
zB9B!O-dH^oSb>9u6Gz@>m-wuB%lpUW#Y=;l{!7`GsU|nH2n>gC*j7~eEnib(Q^)BM
zgFwS?9N(MMr3G@+2|FRr(K^Oz%wI)h&i)^3n;DWhvbIha5m;dD{024j_gI+%rj6S-
zT7(QR42OYX_>~sH0d{}k*Peo|V9)t)$M0L^U#<VadZC8{jN%v3dfY&OiB$~<zUY7K
zW?(+UfE8T_(JKX_5u!H?L^H&1@u-LQ0kD}rL-Ztp2~91xkMTH&<4jndNdGR|WqSe#
z_*$7kR(a=>@Fps;yu3W6GJq6yRi`vb<*52uz@O7$z!V^z1G^lt>MikUA)5FY`X@Yx
zT;HHDaG?*>7Dj})@Qy1WymPiMx{vLn2-J){R%h+)L<G4Br4?xPCGWa=zbN6ejydjK
zlE65;D6&~SYW=)@j@QVZvoY6M|F??=m>dY54dumf@$g_U-2eqI>lFWCP21i-Jp-I|
zdC8i#?*x4Ik;ynX5eq%7R%Qg&oS(evPcPp1h+tBR^n|FY<Td#W?o6%5F4@u3=ae_;
z|6d0AIiD7IH~!;69<GJPsqHK$t;qkp&fQC$rjLezht<lJghjseXtd&~UN0y^D~b*n
z3~cc$#TWqlSO{6((3iQg8qaqtqVYZW{Qvs5{sS*ZVjRbmPLpA?pVdqa_tMgmi@F0v
zU18Jt5*om>ZspAMw10s&;?<ctcW8XkLa34up7~G-b69O<?*n2Uk2?ZDk3>06-YYd3
z<VgJT5=A+c=hbNQP8!>&5lq9f>Sy8XzNcBTmg(4#c&W%&Hr60q@9yuhS1B@Td8F!B
zw;?%n;~8%({$Ktk-s}}0>J;w_^$4=RfyJ9+pFb{;9Eu!wR_=YyiKrShGhm*o&rdo=
zQr-QG@;Pzh1Uvhqm{n>E3;q&C;8_~Y;Og`h*|l*q`Kp<aFS>HA%z#ky=#ZPX^pwjB
zf?|?}Cq&{@9$sE;roDQndM_EmaCc5fG_sT#cbpk?p5^8neJB;WdSKw)j;e8d6nFZ)
z>LIF^H43hmxwjDfoz^Q!N=5N+3h5ud$7iqbvi7F26hO*qu%$a0wz;zzD(>Jh9RHOg
zV<~<pk<B+(PeUVr=my&55oU*+0zVQOXV9lRgLS_pp_{LG9%~mL7x~QBKuAv}SW!NG
z`{+eS%?-&Lo`<6)e>LLs<zBNIz1dSflx6Q8cBRZc@?u>{jB$7?)waIOFuVla_!?!n
zg*pF5iD{Q<9<Gp7p$3biFM#l&oBi<n{x${!F}UXwqPXH}^;+F2Ge8C!zR~bx>L69+
z{v!OcmrBFn`ToC7rFYL_UGxWgC4m$2V5fTCq%VPed(Zvn&{SIT#&m^s`#5W@$e(he
zUsXZ7t4mu@dx3R%y0?)r&|yo{lQ(WO=+DFj%P~w{WxWV?<cg<_U?61Fp)74*xm6JR
zzp?g}QE@)cnh6OK++7EEcXtRLLU4D7Ft`PG5AHTVaEHO21ZQv!lEC2Zvh%z5?B4U=
z4}0(4-TBfp{k~_;+x=Eobv;jYRo6)xBc07%(c5jdzhgD_Uk?-4z*M*V>5uxeP}mVw
zih$>7c|GH+e~eIfTupct&AV<d62%`(#}8UL?^NLHeuB6UdajAZp6!ueoYWDuaq&h~
z3=`B;o~O^?-|_hU@dn(pQ=Zs;aqsZHwnH|megqH&AaBO$C~o*uZSdLz!{hhtqy&mU
zTXg|W#7ixY856I4w;?}8WW8dVUQ1=}G__X>2j*Pnc)d{C%S{})4L!9=k)PCW;c2Xl
zrTs&+UE9lXt#4Vs^=V$Y8~1|0JJ>W7tJgZ&ci!|jmS0{(?4pDsFH~nWEPB_U^D_W~
zTUWO{JJ-rN^Qa&jP(Cy}E%bnZ9U?*zLkvUx?r`r9f@k-8C^s3}Sss!B^+j_3EojE!
z?O`GxdTVfiX2RL&+ZbN?Wv#z%>@-``r3MDee}eNPR{MWHr<K2ceD~?evK-uk!5+Xx
zEKb~sDx4y2ayHK2R^BERoq%sZW<ZynA2!)Fdgi8s`CY~cR%Ghg)5Y|b=Id&ZLPi#D
zH9{ft^Qeg0fG?|PN<ESqQD>CM1*>AJC+2AjM_(&Kt>j~uLWe06*n^NFWzh?KZ`_ul
zFGCy#@Vb4D$9=d&`q&wKxV59}O6)g}_v13@F6cz-ZUr+P`J;<fI>pP8D6SfbU(8;f
z56<FGUv-O-V#!M?_4Ku+M_PJ4nA;Bn&W>O(8atKt6%15kFEqY`8LBr42GW#Ni<mIf
z3<=wBKw_)(P!d>@J~r^3?Kvy?2KmxA-2UX8c3buqu;2Ze13F9PA7s){TKo|6CR4SC
zaKH9{M>qdBdws{J7n}#bx*g)9zz+H7FUaZVLwCfNjZWBc3zzvNs66VK)5lk6`1z6(
zeHXXzMJa#A`K>??gp9%qp4!C#!^>G1<yD;6^rR53e2n>ggWKH|kEv5_Wpq<+lJ?l0
ztOU=dpff;b)#+f#-6#ZpU2NdT6#!^^!&ie_d5&OP*7JH#|8%#5vF`}ZGW@QWnKJ&@
z*q4T+)D91!=M@g!YIYzQ7Zx_-Q;R`$=noGL+;~$KqvRswL6GD4kT}v6d})!5v%f}+
zpRHD8;El{q1ni$5#Iu>3K+O6?O9%8PVb;|Ac|~&Scwbn_dm!=OF>%N`!J87Jn(?lI
zU11YtAMG3@YTkplAVx8xB(;MFFUBUSU$GWq@80Q8;r>PhXpJBT#YPg{bq)Y!mY&0G
zKhP@Zn1tm!YR{;}@LlH*ZLML8NO!;OdX`1$)VUS@p6vXfPD;P&v=LET%fAtLZc94G
zIJBbCV{*}5x%6iVK}mJ*xBgAFqSBcl9=el3a0w*c^u~=^;8Y+)dQ7gc_)xW>0k_|6
z7`t52ets9K4Xdv5<l1GO_(dnI>h6!%i?DVM3UR`e4<x^5+9Y?Nw(5KZx`xh;Q@gp;
z`vLkR=s$KrvI^Q00bHJ}hHFBMt^dc(b9Y>~ByGQea6#iL-;Ga)VMo7%6Tm~Kc_6Dv
zq$R%afXm3gk^6wpQRT0C(Z(hFwvQm@!6MG_9{C_!k5fk79+yY#6On(JY?AlI*~O)E
zB6~fpS42~X<sUqS)!hi|EHo+086v{Yb9&!u_!ILawQivOSM%w+?6)>clUQ1RN@e^u
zYF^-!SFf?du+L*y&Tq6gw^4R<OAvTm>|gQI=q#n(X%ParLo||bhS1r6D2+|uR<^nx
zFeP>HzrI=Td1Sel%GIbyWgA(yj>0vf#a_a?hf;CeRk8b~Iyn=Y$R6l+UKp73b^Cw`
zYW}Y4lZ^jg;u!>W_yO;z5Z57iqLu8*>Er<C25eZKFLUh!S%dXs<N;pW6*NUt?5x(C
ze)%c?7_JNdBjJ#A*LGBf_BNb}mn*5d`O^$9N)*ZN@H&I<65^~Z0X}aF(~(WizP@W&
z^_w``Ji9;R?M?N!&~t|6&cSB<`E!(!NzzshZsX`Ap6)su(lBg|P%EW~v6DDe^QnTf
z?&o1$ZZ}*^oPIC=F7}NI5o!vN#&n{yZd092V3242j|kEW$C`6UZQbNgJZ*sK*{nnk
z%9V7FBBD+p`_P{do9X2bDu;nmd_ET>ZTeI&T>l}g=09bm{t3C7h2<*OZ(U9;fnVdD
z3i01Mvg7^0bP@J7LIv?X>EcI%b1pBx)i->rQz?RYUeBes9Nxe4@0#Lx??36s=M)Ps
znRBPoo^ji%g^Np!{)CmKp~@oUv5aUKV`85E8{$*99)Q3|b$L#j8Mp@W0w`X!Ix$Z-
z!;(P{csq0^os6;X%>QLzjvTq1YNF8(`grvUqOy`P`o?q%2(Wt)$_uRIp8U&PFd5xX
z;=Gc4-GeH(*&V|jZPwQGh_AAO8nL)}N_~`!E$MW;g<YOn6RzfN>O1-cd?VE*KEctw
z`KXigJxsHZdHFEw9#KleZ^r^#@a`rpq80~c+2<o_smZ(jVGTEV#owzfdv%I#(LY<O
zS`S$;h8we8>d(yoB)*J3{39)_yFZY5l~?>Gzntym*?*(uOn0?>WB?ku!cH0d`o+8d
zD5iT~CfDE{NOkGIRw9=9YI!7JIDX>-GqnkomWyZ7#Xd*g0Yty0#k8Yp)CkrYEF0H{
zDii*i>SQ}FiKqz2%T$Crl#gECzJSEQlS1FV;_l#t5F{4Q+3>5%6bySlM~}ba`nWrW
z8C`A{FoM6a8+oUR%4^4zR-MLbq%4}8X?X$?)4YO|17AwD>vrzkb2k3Obq8Q6gFk*$
zf~7rPoUygjxz_5r=67k8`Y#f+|0Jb^!brf}RR?Gq6&lVK@yt23$n|gpLp2LMKr439
z$YxY1U+IuM%$R_27Cef<4LqbHvuYjO7qd4YU=Ntd>y$sHa<zR<T`&c29Bgh#bcku*
zncA*@snb99(wK>J@5(?*{lV~#b)&$4dX%qR1I6GA!!kIq^1sFAJs16{U|Z9tbmVZ#
z=_(f$4mTp}Xh?qPHWgeDTHYB*KcrTXG>XBcK6azc9i58S^+bpb573;=<&vKIRONkB
z)B*v*V^w|futF6z2Yp{}HP3n{=67sKI;E9lHlNp}5V#=EWChb1ValZm#T}itRFH0D
z9wu0bE_*2}_Mt-Uv=LPfk4#gW(r4le@9$O8&n*?jXByAxu6HYOXxX8km;TEWf8|`j
zZb<e@6xORq?V44EEn6|hX*NR3_dMbGLid{9w?06EL+3p(C62r!FJ!ho$Vhm?oj=j&
zoJ7sGn;-rhPVJBbiwv1Kj9&AhyuD3*aRP#2hmRwS#bM~WJ$b-0j3l*z!7VWnHRe|`
z=qvbki-L~AziNFS&JF<yO-2XO*{8pdA7ZFiu2Un7J+G4%EdB4?vm=bBX!qH<>!yll
zk<($k-TwoN*VLCN&9wFu8`GAokNR*a3VgcAL{U%M02eTRg=Z}^9&gViaDf%B?LZjs
z!f*YDYB%Wlice5uk+PMIV)TCn%Ai4iNgZr&wSDr!B6|Yp7~)bGhb2j_#68KMdeFWS
z{MN3tjTB3Q#~to-`O0wrh)W&tgA@IaMs7{NxTqs0w>#$7<>FA_&uZqche2zb+7BHw
z|I<&1aIW>fyN-x(F23GcWG4?WgvjgN!aN6A@@~-uc|C1duOSRZ&WJE>h23XB(Y+4y
z-~W4iod54wm2aG=Vd;oT_X~|&6R)Xzp+Gx%@r_l(RzfBa`bjs^*qHm<s?)I%$Mrn7
zdRofQMfB~!qi1Uutz|G7>T9EO>R8|t_!rx%mdAbB*mb)@;H~em@08%}4HU8tObLs`
zE+Cb_hNJl&mKZ7{_daNp@++nyrHnd45Y2b>Nx_qx*6q7I!PYdM=FI6Fw~i^nb!`mZ
zCHv~GStC93D$c#E%gl}%eiP{H+OPCR9S%c^P3DG2iJM!k7bl1NVCaKi<ZT4EOcy@Y
zhB!bb&Li9_FbeaO*E({AMXHlPHqz$^RU<|=^0tOs1`T%4Dq!$&ji~4(8q@nXs)n;{
zqzD$3T@|+sc@*aLJP}|@h9So-d{ojp(uYZEPRnB)9&$}hMg0Q_R%$OX=}TyA8?wbN
z9u;*R98nbBXe5i2oE1EmR7_%$UQp~3z~a3&C3PDd(NEdY$QlVb4=k=(=ENkU(AX#B
zoG5lFx;Fp|sR9YQ_W+CF0ts9M1dsJxWA+w&k%1;KT9@1xH_L%&alZsd#gVhkmjQkr
zX9-}h6^s5!bZpK?1M!Sl%P|8?;4b-QOLx_`FSa8bZYJFICSb8{ZHwEWqtnW#^`#5(
zbm&9HixJBCA_bsKCUT13Ix+``N^DWa??jMJtWhSC)II#J3Y$u-IEU&&FZ9j<o9gQZ
zQ4vBUX1@GU221@FY(kYsokXxE`SXyL(HNvWsF^S+Fu6vZKEpR;YXu!y;Zb$i;t6cl
zO(w2)B3tm+AuX#^NqA5*V>;Uq4I<`q%Y@K|+<gOv+tgWLQj|<$s-$rbMpUEzdZ&YM
zUdR$+(~xsc3py-|hfVBx7oY>fBGCBH>2TU>yE1`2%QJuAB|nNzZ!P)jh4IT+K3c52
zcofvE|4RI2<h6Ib!_#$dGS?W*X|wxTcMX<kUu}3In_oN%mZt3KXIsGY1HCIOGnY7#
z1Ln>Y6*u>#+Au5xTPz9|5B>VH4G5j3cRk-85+@>HGq_`!%ol&9--5-@<PR-3TEAN4
zz~W|7Mn^|85Ixpk2LhiGY#dGuI1EuhF(dtlL*ms1EF1Qd>L;+u9k)eDf4aX*wrl57
zZFIo8EMZ+ONatdn;a@j}rFVn4ag79|ccYNPxVa)lunS#2A|zP@a3=+&cMG_2RfVKk
z#v9CEENTgs(Z+{$#(w?UmJWN;>s8*(N6w7Gq2hKmhP9fM|Jwf3k8DAAthD9uTV_;w
zC0)vDTV^zNC0)V__8Zp1e&Y&|@W7sZC-6xP1*CNGJ6SZt0)t|CK=$TMk|?DG#+%IE
z#y=>a!%M0Sib>44G^FzvEUGLP*wd#Yog2A@+ce4iGqxEEL1`X6z@YCUQPB+c|5`Dy
zuNS@l)^i~f3VVxG7Yd>Mj6^bdQR)JFs7WFJ{9|PP1hAgOed~JLZ&ZO<O3nbD>moW4
zOD8CH5ZOWopNhH>j;K&}RH0fz&H;-nm^l&4ASiYhU?BrrHXTSrP`ptEb}6|4_{l*6
zDx5c1TvY0mIB-~8lIoPm@7{Hs^n728F&p(_+{unr;>sI6@n05Y?J%~yEj)TjUgvM{
z?Z0=fR(@@Lz1h@QoNj@w46Gs}Vd+janMfg4sm_QTstrwmj3Z1#OhsYx>V}q&Ok$pD
zU=^Xm?umeDh(;t0U)U=>1;|XehmRs+6)i+#wr`_qn9D{Qd<`$J2FTPzxh#Cf;xe?v
zbWbI7>jOS3j7Bo`XI23$N?<yn29C&Eb`+^fLe31H3joszx<RqiuuESksaueU`tU}P
zU^?L|7FQ8WCm4ptULjkQ5KvL~z*%p{B!2jYl!?iZ_#p@>lac{5EGWqEHh&c;>UH*Q
zF@9uZgqn@*MorG)h}6u?Ou!7DVGM?I!^=znn0^JpL{<$Jb1K!#7H`<`7n7Wvjq->(
zG;G3TZ&LRtrw^9k@4ds`QunhtEJxtv04%QTjQwS(r}vN_ue{n`m%}h0DbtBL5y}^$
zTuWr3S1kd8pmN21p@i5VWb$#30(FCwQ-~~lsw6-|sFTF7rVrWTVT=-D1kbf@nP|%v
zqHK>h+LR^<YDBgmhV^SBz^Yj!LYYF!D~~c@!X_^z_Ze%_0yaI>NJOr9qoXjfFoEa7
zhP`{;(AaTgi%^(YG{X_q!)6XPJudKE$uWsohC#7Mu$hC2MHdp$J)QuLaj5benbA;*
zAY~+((f5);45+9_;MX;fQWWSf-}mlHgI<a#e&@~N(&}^)w(uHw2rU|HSS||=`1ug0
z%rDHC*WPx&IPZ8#ijK|W@_s88h?mWCIa-+rIg}meG-pbJexh=Te(AklR6g{pAkQBE
zL}n#;&qCKuKGviiRMhMfLax`fm9ir2X@p=y<HNjYfYx*X(_k?uL>hQ?m>&*NiEL#V
zEOP0B8|oWvoGEZJ($v%f9QwuRE=XlA8VVV{LlptAgfng5$N92hHLyq8RmRbI&lNxE
zE56x>*jdA!ake`)8RQUrU>)%Lnyv8uFR1$IsS3L&a06KHaKlw}c-3SqcR>`Ky|44D
z3CVhUN=oT*y8ON@O{_=x&EMb3epp;@F{yCi;JK(^&3pJF4vsqe*F7#n7UHZGtBC=)
z7q2<qrsTf@JkY&pwM@1S#i<e7=XPo@!?W?ZgrPSc8_wC8c_<pKx&nW#t$I-jT|{kI
z^W7E>6is(AB8*a0As3mn++dZ%Gcw|OvA>L<%!Oq1uZDCJR-A&x>kjSyvExLxtT9op
zvaKUF&Q~-h#N)szG1bkuOE<Dch=^n3EH47#YumSRo(wW;vo%g!Oo)$%k%Mpqy6^(*
zx^MWBLaT~JQ67y`u$@oxA%{5oLqIn<a~)v7nv8{8ZydO6m&s{*V0V}2FAp9YPfsEd
zyfH8l8s|yR6yo-kOXPI3sSC=dhL{$c68d^>hPv*fInAR=R6+&{vLVLR9)z1U(SxHV
z;y#DSzf&JV$8n)ma${3UW$w7anJovlJw7XGYOQ~MD{BZZYNhH8OvzS%YWgC(*PHj2
zxTf;Rw*|w)sW^W|_djHNsYeH5>Es_IH()SHL2mvmkhv<reQC+*=q%MgrY8Oww<rMh
z_Yz3UkIcHU^tbu;BqDui_uH~d#7G;T64CNZs?(gGS#xt+wjov?MnN!r%4y#=T&18Y
z5M~S5x@*I-P2ZrpoPI0j^`jA*#WBCl&-_&9d+Rh9D!;Aqd?q5rT;kCiy|71Q)3`K~
z=81F6gkvmb-@wARYajw&9fgK*HImI{xXQd%qn%>gQ1AftrjZ{8n0b=c5b#cM8=w~b
z%tB=HE<IU8OOfQz=iX=R2wle@iK-fRi8H&-a?y!(qdSsU(Y{6_^_dBN$l39FGWE(^
z{zM5g7YqnW2-YcoQ2$k5J(IoUfb6MW9(FWAhsX2pn*`-h9?uCislUp<2bgc0^a>aR
z>;(HW)^j8*P}_OJVW*@hd|;%LclCNDr#XrrdY(mB&dxp`;1{P%xLdfrq4OA_p%i-|
z#M89oj66d;_WJ?Lrdo7EL&<c`Lt!<}XAp6Wb##4UB$h9|Nq@W?a<*>kXUs3nH~so?
zOLN*zlcf7HYG~t*kcNB;6nsVlMscDRGQ}wJkTD$<iQ4*Ac^0Sqr#9)eZjB)K%e(Fm
z?Sm+jr5IBHCN^|NYx1`%o=81fDEnD;7SaMYG=o%IgN|ZzddAoOC4+<1TmU$K1m^Iu
zS^x(v*@t=!fuw8nv`Hzy>v^u-IduP$DJw?;kMK~c*nmwA+s>&AS)iz=`8@b@Y|7hD
z^F|{Oj8vTid^sVCn00!mnalof5{u4BelKFm{&<n`u`<d!G<H6`mpqw$Rz$&j{Ki`*
z4{ou1f2sWBc|5{LiUJ~)lfejY_n6hw-H>fPQ4%qULiX>xgp4SN8Ut92w!@@-x3LHV
zkbJl-;R(>EZ|jlJMI(PbK5A5Qx;EnVOi~QrEVk*c$-wJHY;ZxEy$k`MeL*Y84J8+A
zL^lL*dnFb+B16scLc{*1HT@4I4-@hh7N-sQ?6li1(IkGWbhXybc%Ros)$g<Wk<Ob+
zx>qib)1u4GdK^b-CJ|B0;4WMGdS(`+TO)pRnW9>8Q2oDKOWUU@Cva5=yn@e*<@^TZ
zuN>)EXV8Q%m+3KcSnJ}K&ls6x#;UrQt?LAy#v=V;{L&l?>+;PD8a|_nYTp7CXq-sb
zgNACH>ZThCvmCr0-xnF~=vW7?1(e)97A0}}uz`+Q6&PJ&6$EB=dJ}YoMckBQO{Z$A
z6#|b4*=vrk(O^+s#dVgUQ~5V;d-;=A_R0`grqPS~p)r!wcXX<H{<pq&4?fh-0r32e
ze{{=SZWOTnx)#in>={PWDES&=N!U<6B<8n@Z(tB}RQM$5&r@eC@csUk0(Uoi!Jli<
zKWdQq$h@`lCoIJ?`sZhrg6-iCoxa{EM*0H<d<l}8?l`Y^^MFo=*&<3-q#elT2I5nB
z;1^Z|CW<Z7`8O26tZcSR#I_UPA^Wx?pxbLe5@NM*_`x2*e%4)af$g`2Mt~>){gE2(
zcgqvWojjTBBZS+AnD<k~NPOqm<8Kn+8!IN(bwMxzaU&VLb^_Jj&4)V#Iw@hzh9BMm
zct&|fUV6)DD6GP{U<yyQK`MrATt|EPPoqLrXB$ybGp$RmFK84M8wv<)k4LsP9UD}~
zbBrq+Bx>1n7ImmzZoEWsvixT}k8~pbA=A}>orRp3&6mIS7KwthH@vggSN+g3JdR|l
z!|Jx^u4R?afFkS+UHDrS&bo~2(IuSF34OC^`BL&71rqd}_K3tc&IW#8Cg3HMLKCi6
zLQ#kwT>w3JaqVU2B>|zzX$WMN81>$b{2#Ls2$UD4o|vSqz`r)rw*92uIQ1~edUtU3
zLdtd~pp<iNAy%>pli%<v0rwYmmNic)YxoPHqP=Zk#AnuKhVk}r%cQ+Ke*G_vGpL~R
z=LQQg41Z45Za16rCw1lYw<I?rzm<;SZe5Dy!kXeLP0H?VFEM#;T(5xc+w0kjOASC;
z@UWOQcm)f1gvPH=OaI(QI5RyR=Xv!A+2PyK2q7-kT6C%M!h~oNSH<}#+Y{D_JP|+B
zu%<m66|bunv}TT{y@;Bf&d*qL!^Mk@(Aav;WD@cafu_G0CPXJ=uk7I)RDUroxj<0u
zwi_AzPWIv?nE^mE{)-*<;n8nk$SyaJ>`FE_AXzz{IF1_OJ<IZYZc#O(+<55-OJsV{
zH4c@qyWS>)S#J`fQu!iD$B}0*epFRes;?pR6q=sF4yVxtI3;na&XfuvYCbjLNqO&9
z`QdwI_BfmlMuyKC>-O#Hovcx}*?Wc#&AZF_rZ0aAy`7@qOW7jn1>E8qtzL)b&G1U&
z%Tyc2{5T-yDlu2UFhGon!t-(WN<0etQfzBPm7ZDSoaWe9x!3M>v(LmAN**#l9ewRf
zAuYYKs_8;{d*D;=9!G$eSJ7K_G8kS*!qF_OtgW`pdeo&Y3!41q%ScsDGFNnPExfz8
zYqsg3W>CCma+2i8U_%xhQ1Z^HaHNnt)xKI;8*dbtDmkYGIv1~m`Xo1?94^)j7Ny$P
zZ#?&o&#H|yy|A_zRhQ+u_rLc0b|2|ppc6vfjO*C*Td#X$j&|5=Hgjb9MhQU=$S$B!
z&RwJ?Errg_$PZjhA3U?}i-dhU@5@F$%2$7P8_%k#@Q`VoMU?f(p#Xk966~7DuELx)
zc0ry9scth``yjk-!zsDyg?Cn_obF!&M>RrbK9?KgK`MTAg~G(Blho*p60QI=B1NI`
zR5Rnqh@f`<+%(K!kn9G9z@_&V`(-zcA}QNOyR^A{BQ=HRBQxEExKa<8(CoB`9^lvh
zVioHlTi?+f6(<e;W!jMQm+h`pj3!=xYuhz4V3+4h?XtXF+(+b{6rC;$W;&ZJE$XQS
zU=mah%N_07-Q8lXX12L}_)cBWNrO?dc9Ck1{d+<p#nn18mvf4jTR(*%jovA{O!3$0
z$UJ^+m-Ayv2N3y@&@(=Lh-e{T=hmf%{nx`pUAFvI{Uy_I9GZafnxw@iYKLZuaUl6j
zO${L}j-a|XnYAs&fv0uSe3ktCwW!yc0FQp<P^9?E1ss<3$9=tntu9V14=%^b1yI4s
zmZX8tIy?&NX16T?e<X97V~D>pM(ek(PQL20T>x7;u%PyWu3NX8_;9gyBpmJVEY1_~
zqn6%8f;YOao7h3<4C(I{UDc8#U1E*%$^sf89p}mpIB7CuaBIMjbjm)H*RZ$?Z|Q4Q
z<g0(<jl(dKA$#WXr{4}uFlRXJUtKBFJ|JtTo8J#m<-v&tus->OK;}H^4Nu+qm7=74
z6LFOe(Pa9mUUSk*KEO?KI23v1bn2)d5v@_4k7eUGhi=dsP{p+V)>~Pn4z7eqFZ&`|
z4Rr`;yOnko$zIQIy=6DgfL?8^C~F(7cynNnNz%`Lb{fMKtWo*g2}KsvmCO3Ll1~2S
zlZAsGUMy#pwzkp0ax!`B7vqtcU@>LY^1bYu4`=~r%W7p}Z`WPeCnhs%e($i~9}aB0
z&6F>`%TroYC{s+yJ^}oZCCIGFRv2>}9xNdXI?)%i2RCSTk%Gpor1lEJmD7b|ODcD=
z=#ILdNLSf=`tJ4-VZ|G*vA7M(sLxI3!mHZQ)_}(bdmM&4nm#O>UzP2^s$K%h+I7O*
zhWN2WKY_<0(x6I&psVrtjV7Y0_=n;!<W{C;{0VoJPLTafIL*e|&hk0OXS6ygaM<`9
zCi+8_)c3^|UC6b-5Xl5K<a%Jmi_o1%1>UmO+0eAL$wc}<bECVm_4j+HMGtC|RQ~aC
zV1-b9z+<y6WZuvRkN)c+hX6<9<X;5Ticwtl4b(Wh_aV+)E@!gBnKkO24o4AA-<7q`
zG;9JYKrvzNloV0z{@iZ)7*^om8s0ae?PsV;gF){QU06ilS#hDgRFayvs1R0ST`F)I
z#(wXW&}Y1ni`c%apk8_`AP0wcoF%M}w5lof^xJofd|{%kxG&6L^L<vy@tqpSh&&UX
zcF69Jr?vM^<>uC@yD@R=W#eh``0Y}Fm<kay2Z#Sk%$ZlF&0`dy+nZ#oMqI}Xn~xh6
zZ^4-ek0OHbqA_QV4$xMC9EX9+zI80yOo3%nm6M3Z6B#vJNA23uyV=9V&p|fxaY;yy
zy<@Gs<=}dhKQb*(1AXP>g~s+2;ns7sU>%F!BIvWKM>>B!(=hxT8`UUXGD%Wv{_-za
zfb3!5@lhl$B%YWZu>Y4;qrAd-*a-t;U(qiEN}Nq9|I;-Ps54@voc;lC(fqtAbDlKw
z{#pq3;0>QbW=x6crHclB@d|S|It(Fi+I*kqp|ZO~AcW==8EQ+*BDj>?6Mb^iD`cAJ
zU6*4L?CuFqfj@2pje*LtJO0oDrqX(42FHbQB3gnx+g@r=cy$pISF3_%9C~l?4oyln
zTg_~d=*nf9zAn;kct{xL$A#+u+4nsyhki0*2Rld0K6l|BDUQkb%k!p%=j?#&Ep-rL
zEedL6d<$b_?4Y*+(~yw<wG_3|DM1LYdU{x#um?3G<A(}F$c&^JHMc%;4h*Ntgkewr
z;@Yxg)P%Xj=a*24+CpkZaY>h35gi9BoV(qdAhVv`a{WmuuzYe@)mBXW$@rmk6hmR-
zN_V-pM%|N{3KX5?P}$3!VgV14cZx~%pWo~n3l6;rK5e?F=x>Cj0^LD1Grx6fv^=Ia
zPfQN~zGO3dW;=NQ{`Yu$Oyo)%@#%ao-X@-3M}l&CJI<!lO3-Cl0`-Fnx;;gLlA^H7
z1*|{{UECN0O~};?_D$E(R_%xNb*bs{FIyOW1br)q_{K`oD?foUw7CHGFX3k-Rl}9=
z#_jK^cCHi$DcbwucAp2;Nk#n;Ms8&RP+j_PrkdZqDRf4VKhSMOkUgC5+RvrV!(C!l
zV)jN5nQ2FIoj7OOcsf~jU{5sA1r>i)03F^h0jxotStI1v%!E`nn?QXsjmE`p#bZS=
z_+pP?y3Zita1lVdfs-(MGjksvGY~r4xFz8Kf`!0LLB+O(c{2;f6V)S}(^~TTfy?Je
z#y6Zd5I;&&Lbeo<!cII2yx#I;Huvtk{aHxaNx`vmHfbo}vn{agIaK)M#6)~;QQ+<)
zQ*$0(u_xLvrf02^9<RLk`iM~@;2K-A)h8|BwL`|bxP8)1STfs?yTz!UVrtLOsS>y<
ztq_$UqtZkCut2ZC?hukSzOvDVL@Me>sDU^Md6{d&JV|)ArLSY>d(YVJ=mlnf(~kB$
zozOBc<oU|J3Vi0=Du)6fvL5E^Aeol;RM{=TU6d^CIl*6cc#u^i%slxrYZmF-pjo6p
zdjD**t;ocjeRCo8k)VyVrGA1-nEsNo)Ib+0_VcRhPFY1;j9YX^r;#&Ctn4?8qUIM#
zZM`WfUyLp?m%N*P!53!hemjhCmi^k5lU<|P?R3>M2#ou@O)`c1FpPk)>3?NAg#0=H
ztmAahy}z~LSKhv_f8zvp$U-J%A}!(8>Z4^$CrL9TdG>bv^o=CRp((N38gwZ75}?9D
zHV(^8;*sa^RL2$+=;VHnaB7?H9f1qs4V_3LfbK!g`N?|Q{7GNNJcaC9BbUayRE3Bw
zg)(cjD&iMokfT_S*)hG3S+OdJ0&jb?`y{p-uUG$AfQQvRso{?CQ8H^7j3AceKZX~c
zF-)P%eG9Rla*%F*gAUKJoJj*8-b(Z8D)?@^Jsc$o&0_)t*$frEUivbzE@L(SN>xtJ
zRn|uTl;6@n?Skk@EN9x1Rc}5a#Dhl6F{>5M+l^RA2f=e~A*8eFx1lh8KE@!N(N}-G
zLuw%pct2o*C#8U^BF8O~=Co6biQ_LaUCO`p={x(62jJ7S*~N|^<WCDHel7Z4L2!4a
zUq<+*V}~-R5{nrZg7+s%b!9U<)&<wo{`~5WkCfd;`W?5SJN2|J!qyh~yJ|(1Kw}J>
z$X%|+(%xm8s6-;xe}#+(f}wgydv}V;i^d$^Z`wXaLRdhVDMc;|ZU{yY_aDK5wLB&H
zIm>xB2ReK|7u=ghEc?cZee=#*T6W@ZMj%y-fNU$Y{c9B@!Mu@lwMm{53KGw`HI-?h
zDia3^^L%rIV%t-L^pT3+qJrnH81frld6TADlR+wKv!|x{Ev_VhVhqio>=v@>p_UY&
z^24Ou<~d(8J~Nqlj#^`u@Irb1d4AyD`{HG(o)Nh)6Y5hW4!K7lZnR2WR$QlO^|}+)
zaf{$Wu{T*J<AP0obD8BTiGrqXw*HOpL=`kL;EiIGr|BoHZ8L9-Kr|bkac528N9Be(
zy}HbnMvJDUQ}ehJG8G{mVH55}hnnWkck{NSK9xM+#qlev&y1H%adIk`P3$)xT`erW
z^ADy&nM3~9UfbiS=OFwFz!>h+abH%?j4}0)Lp+UQ@jzP9O(O;XP?NEmjS(%K?vAB;
zmtE`DW!04UPRPW5c-WXJ$a9B9ZCI{OrRCY=g*e?U!;UXjk463hrG{Ttfta_P(45D3
zC5NN@r_wGFF0U$himcU%XJZH}y2FS?{WtG%?{ilYkSZnG+pQ(}dFk2wN5rfpH|zDP
zy~nJG$Mwsvc5T$1-RFQrBi@WrTH1|#h99S7>a)4B^FyL=GF7r|NJ?ErvbF8H2tlB$
zNQF*?LEek38taMp4f-SD7O_A)h2dzGMzsZfSzF~PO1>=X%bedbVwRZ-J|mt@v7-|o
zbw7r9!z&{Z&Mf<&zr9;>U{ps<L**)_m7;r(Y#~J{MTdkeV`^fu==0B}k}$9uq%>m&
zKe_ePg*5b8P<qb1=I3M<Yf#brBxdt65m&X9%Yr3*5#JPKW6Gpuj}l@*&+u@FYF+(|
z%^-A)s^ON)S=Mu<2>ylK|LHh4sPQB^(Uvtt*&1(@2ZpHEqH-B(Q9`s3G_;pFUw^2i
z6YhXjOUP6PQjq0qzl$>-*^vq*hwqFexRsCzzU>&0_UE#Y!3%Q5izgEcHXn(1Eh#PS
zGdqyicxC`uMLsZ&MppJ_wrLI<?fMh`MmScZx>(8}bB-oSOgHW;vkbMuR6It7(KCKB
zc6wj3Uoi*hvcE3@NUfC6iTZTA({>P5C1erectNK%lhTGg118V)p|80ADMrr@Gu4<o
z>3R@ah$H-@l~T~Z(+s`3jj%!L1u0h&S*(mxLM-9ARIKh4(&0y&GWv8wV3dMRP~#0#
zqHQf)<_Xs*Pr4+i8QDS)Mlk5YbH!OE{)@Pd8^=N)l)_@m0XaXJq~!FlxVD)Rle9x)
zdyy?@VC+i+5>Y0MePNZ7vxDa{gV75x*6BCw5{!KT!x1gR2&q~LIUg*p3uYI(ZlugN
zkuV+xE)x^h1jA_%5-zzL!+1cd;o3gn%vz^+rW5z*RhA@ZzG?#h(E?nB8@*@C8zNIi
zWI;SZY1c42@T4|xZOxkJk0Y6A%NbJCwapV!)bVQ-35)9)#+b0%-}DLD`~;@+mgno=
z=GSy^<-%UF4nk%(*C<dcNLiam#?W#E#ypB+10*e7=qiz5)PkS#hM)k>A`urHj62c^
zQm`Vjuz(G$2`Oo5(uJ;>TgFUyAaf1y&ycX!iN5wvNz!z1TZI0f=p}eaGp5<o6KE`c
z&i)TKMBI=;FHR9p_3w>eQoz_%)|Pp7-r!jTy$yLo-;#E8<sa$G=B$OE!s($i6;Sby
zm3X3gb*Nhos(7rAkZavJ)9m%o=dzP?zAyO@%i+Kn#h4W9(~B0p%cdoZzCR4cKwB2$
zlA%ek{cOwD%A+c&;`ncG+`YpZ^wic{bLdLk+1XNP;u3IU<6s0fGtUYM=)HA{uPOW0
z%Em+%;2#p8O4Onn7;S2%lHM*#!75kQVwf=)K`xImn9n2=Y_<~ZlS=K@0hb03zQ0$|
zfnJV83B#*siV0n@2tQ4kgXg+<O$KB}BgYF8?==&XGFfYX{3tzk^vX#>UtM~-G5iuk
zPR~w&CAdcdGa+WogpSpH1(V7pe1*+LsKtiPg&@bjSh>9*XA05Cl3fc}y|UsW^9=sE
z?^wBg1&iCq9X^C;{sJ$*pXGNKuR8~D(%yQLL-#1NsuBw2ynmA9W#(Oj83PidLPb9?
zI3I<qL|si{DvB=|MTEb!TOvc}58jfFjTT)mbKx0nc1PwFYE)n{V8WYtc_EFct%IJg
zw)zJa^YP#j{t?Dzqkj{|GG*;^Xs(S}yL&ecXv76-!!#-K_3C@KFBO_KdHMzP=80LS
zi4!*@nFTXUyO#2?|1D2!{LXx;xq$z2l9;uRavb7Ns={gqfg_l6O{9y0og{V55Ym?J
zic0S+9IxfahQ<6Y#Tyx5==R~}L>wX4zuQWfBW?z~XXC^wI~$}~r#zDqmWHvoXL`DU
zJ9l%)DS2pN*cEmtj}BO~=k=i72$r1>4aS!T*gLM;A1R7`;I7ube8LBoJcqXc=6F7v
zsF@L8SuE&K-){{|%{Fu~91;#?_@lO`vu!;Wk12@0emgCDdXa4NagJDcs25Yyl}nNm
zy6aX#%<d*@{hD{_e{DBWr*k~o<xf$}3h!mCAHD7yFXh-++;hX&ty_=9D=oyOMJ<rl
zfT*_F+}pppIvI4{^Ejc!qF4VR?w#JguU(yR00vXX+#1j@>V_I(DeE|?1uN1m@I5Q^
z@V?oi=!&q)KR!C^)8MhHWbJTo;}n0|8nwT&++_i}qU8DX%*&&a^S0vgn;(r+MFC4Q
zCux~AKURHRAN~1ltMJ#oN6yPz66_tkZ!BqO@&++&g}L=sUgT&7Plsc&oVt%IGFaDu
z^>UZAx0BQ_z24<O;@BT^HZ1;;UP7<Q!))bpT5WC*s76LA^0S$~>L}n!379!38Ww{2
z=&*&r75BQV0t2B)t(7c499e8}uzgg+umTKPB~@v|+Xw$y^U6g_85nL1J|Nq6)|z0k
z=#nGtQqWPJQ4v>N6?Xh6`8VpN-n`xfZGK2gCktLaA=y^vux3lIIxCyCCD6)j2|R@(
zQa~MCM@8Z_;0t#+VMbdt&R1gHC2P}txcs)0yg@-Zy_h%)t#)7~n6tS5qvD!L(z0on
z3}KQ^0)EQ!uc?$=?njkanxm}xOOZ}1!BfHhk-dh*<*hE2T~G`!(7H=r2f@2Lwws?=
z_Z<*tg4;~fHuA=_{>Ro|@`<US<MeD+Ap|9!Up_H)-d3Yaf{jM3Ri4p7{5kXkvYYkZ
za&!^*MW;|dB1NxaAEAh=+>L#j!a8DvM6Uxp@l)2IJ#Ta_xlUb(>}B_6HOSW_*|_p5
zk=JHM52}OUWTivxW!2(UtXxf8+;zGYct(3Aql5FzX4RCTXwEODuSVn)j0WHL@nft5
z3kIq%e+x!hs#hq|7<Mri^^i|HYNPwoZE=^*-=vSAn2#Yr_8R=<MVr<#=YMo8_%Ute
zN7b>mmL8&)%|y-RBF|#|j#AKM&vz9#Hh{vQh=|C75NRG!xZD=R%?>%pY1y&dd>j7X
zpq95*;PC0i#gW@FnQwpch=}*)1I5Yg<!}*fyA$H;Ei45LTb&$K!IF<2NYc(~82-23
zrY5jhD3mQy7>P6Qi(`Nv7&CvkjtT6W={R*u3gp5?c*x<icVV5x5o(!Uh&yi0vN3zV
z0d-zVPB7d2HPktB7gNGYXx1Rc8@r^*{?;CmPj2JSA&cIw0yA#UM$)gnkNxQ7%kKu3
zqI=(|DX!ULP03Mcqyp}f%y*OTdKv1<CUUmEX4Kq__$F!mx)4`2a~u31q{<HqpU%7P
z?Nd3tvz```pRB!zIk#DO_Yl7)kh3XIydLL{Xf(rb?s6_3hWImpum~~i$1dTg{JPKh
znl6SN3HggBm*~=7G$NQR{<{6Mr-kJC!Ob^JH4CwD2TX(ORsC(6D(Sg-XeUZ!qK~)m
z_sMegBJuD*){fuVFVT7QLJl#by*67|C06`1+(YqN_L|W4lAzTaROL8*OfVJU&Q%qZ
zp)0b{Qo1o*iPO+yhmuduV5rUU{UM+R0^afJTtsn{W6op??CcIi)n?vzZsq(I3*~wE
z<+O9LY6RSC*qzDEC~?y{N_pE+gSUzy2C`1WTQ_uH%Ja#-<!H+4sN<wd5tqIysb~Zp
zPQLX!Z9sq>S{hl5;Wt$%mRIVNH7NAgk7e?zJu9^@=wsTH=9q0Px;tXSb&ub^iiO(w
zeSM>QO?~w=-8-MV01XH!8OMG(idx1-!V^W2>Uk#j*AsoXm~|-zd**FD$Y$4cgFo(y
ziiI3Q6Vxxj0anm5^OZAn`+nzMCvLNAx-|SCCx;%J7hOLwd=;>*i1<;0R~nbpPe^HH
z|4bQ>THn`oYnY5iobp2Ta0|yPwk0dPm0qc`_mi9-A}bM2iYBAoNA2i8`jMXrhs0kt
z;<AO(3Uh`gc8}F(;Iu61$UT$#>^dS=Sy>L#@$5x*yxp(E6HyoxF8XtSU}YSf?%3VG
zF+L$lRy~aC8(T~=|68|c#m1*yw07pPYYquJ|Khikr3{gK@3b*FVer)jlZEG;(npXB
z7S?dj0pC56e;HcGm~gN!VC8im>V|{8b%M@a?K``k`huTA$Rw74Qrl7J>>tmg=ehP1
zSbubt7xO~yPR%DGh#N0-P56tOT0^N+)_zlol<}Z%P=c}hLT#k2n}9s8gHx0<9Ct-r
ziD<@)8(+7XdQ|mXexMGy<}HEkD-GA?3wiBh?5J?_I|?~vhOV?={%3r#eu=eXj5-p#
zv+D~N>=;)Eoh~w~RYEoyM3ZTe_;C3M^$OFSfXuTi8;*wxi(wx%p=>sM2fxvGZ%+t8
z=5n<gNTNiO04CQ(G^mEVGez=Am%O$cd<!{q@bVn`Vwa$dIu2hoppd@bNrwR0?U9;v
z@-Vdi81Ll-F^eC@dC2uD{Dqnn2u~dt`}3kZBVKvc(Z4}F?TG+$61ZkMn@ppcrcRjx
zZr%jAD7wbN4;Kb)lnkwiv-H17Z7^#=F!_#Zv@-@_*tZ)xeLdy6O8PD11#cozJWzQ>
zR!+)QB=}0BDqbml+u^(9@qou~D9&;-)R<G|bwPvp)2L>D|FHL=fcwf970I-MQK2As
zkzMK}LhQTIW{7<1`o1$$Z_AZIY*Xs*4m>wdOlGI%R)E*0bYNp~hx#<1F%8UD`gbjr
z{{zbO6X_M^j8%Lv5bh?ZRNPs6J>zY0`XC`8L5W_{IQJpsOvGqkXNvKron<SF@OUTs
zTdzd-#H6Mm&Cu~uKudCMqnRb{tMbY&hvD0?t~+{@ey%jEjW1zK*8clbY9m5wfh+QF
zf<rv}lrJ8WpgtLqOx4BeU6!T7bad`Im(NzaU5wHz!>Lb#SWO;yL|DJq+jVBA&UGQY
z8}~?@YC_&YnM2Ps#!g_ln1mfmalCDM5LT0)plvro_Lo{&qjUY773c@N>XbSMP6x=9
zG9iP+fg2Ya^`FR}ej_N&MbNC!G@v!R^Xbr6{+0RCvtM5Fo6D|i*6%)}33{p5$_8#=
zb?z6!aj;?-d>qLsvR-IOA>_v}wfwEPq=@7Gt`_U-0h;ZyAH))J-7k6s@ZKgpYFq40
z=M`UylXpZgP&(@iGLLH0T!dc?G<YvAZhZG}zh&pd%5RvynczZZ*kZ<y2Sl@}U<=J(
zlsgh`qDb09@seC~AQ}4DBmMaezA@+I98l}#%v(zZ|7j9;mUk`ohbdDiq(LVgZ@O}<
ze#?bzaV@V1BA`15!;MkfD0&c#fMT%E5_uBpfC9=wd(8lZ;9lWkHPlEb-!TSXx_Z&1
z>4Y3z%=!L0gAM;?>nkZE<;V*>XFBP%V4C--jF}m>)WXYK(Hq9QjsSq*LDPr5sWMYv
zQqjAIv3mMS^oQXN9THrXRr-G4`&+-!a5Y-_+}Uo)HBI>_tIS&Swy59kR5=a@X?{my
zUc?0P^d_+5WOP~1J70>i%njL-Bt|rTOz5bj=S3phbGI0K#U$NkS_~J}TdM*1SYO`S
zF)6WbcqJQCo6lQ*N6jb&*?XI@72JQT)qXTn>xbnnuaZ%XA-^qJ)Fi^>STyMC!lzc@
zNt(tTkl3r=Q+=08IXsiog`u_@<zf+CUJ&}7l0asJ-b8KN>1ngM9w;L3^I-<q-Z7H=
zCbn-jGop<Ij{`%SS_A-}K1mUDo9UUcANcMS0^d}PmCZMDSzr5UP1`&+z_WaeYb61%
zrTzoc2irQKX;bimI&@5~G$G1#<>pD4@WCDnSNc)JpD-XwjYAbQMte^*jxT)U(>7p2
zHqfpRctw2NM%4PDcqhK^3rPdUws!~QP?pQ^ZO<z@0lQ)EvfJJ?U%}r{7zQEXumVrI
zejKybqVaiSIi^GF-89;~+1L!66ZlIC)a<8Gx~%a|sCBas7=*|TIuuN9V7ixB%B;_`
zA)PDUnx`EEfp&DZJq#*|heFoH%8#`Aikw2M$7u<hLtM_q6dq3oFznHhKuRiR(s0k!
z6rYLFe2lEOAF|O&&(6Zv*AQAoTYE2lezzRnF?D3m%U_DWc#G4o%~I;9rEbfs)57ou
z!4Lz#I;zax?hkL0Cw141SjlkxnR*V`i~KE{QXznwpveOsAzYqQJvHoE7jIPbNU2ne
z_roBPh=IpM7F!&cU@Y)b6qfrE3lBdsQCiJwB1`!{9CfuBQ03MTp87Ho&iYiHs1Kr@
z{IDsM^0|FP4s)iLeus6@XwL)`LzLT6_3Sn8IIy(u8=6ZUVr2>%<MfHL0WXO~PYxBE
z&7o^5@g?gb+||nsb`@FASWv*BH*5vb{q7O`{@vINOkPGA&V!XE_MT#Dxa|jOQmYLG
zj-B6a!sZ0GA@3sgOi6xTB@__Sl7(F908ElSiIP%TbPctd7F0twb92BSM%b9S44yxN
z)?c0O3rZdeWY^d_vSK@bHg%9|#e)n1`8{^zj2>G@%tgcHevyJ=kSqQcVppA^mhANs
zB3xiVI8pW`*OW#&<q=d+5)7>sZXFfQFW^XMPh}recRdfS(H5(qT&TVDA~@z>$oQ%f
z{_+O<iY%BejoX2rrmLIHT5I{y<=+=>3I*Nr-)>oXQ-E`n)3sLPxLZGR$cA0-e{(-m
zYoAQfTD@W|kxuZ=;}{`{5QJP81cZvKF*yzH*cyr>9Dc=guYYeo>{PY>U3srOV(&nL
z$su9qDt^L-Fw3`VN!uTz0;5u)Qvdh18!mNo0;VFoWlRmu=1Y%K;4{eHXBNE}SRS5W
zz5rD5q&oPE*nM>Tr;B5jEP!L&6kH`b6>9oz6sV$NmP|wrrd@bGejV=1!QYm}yV(Pt
zUmKU4{?)3>=QgYeV-Y;?gADZtYEiz<Ev`%SL)es)q1(KMEgtXd-@D;<@SP0C;O6T>
znlERCmk>TC-TZQuq#%#m)0#f1ygj?G$$6e#jA;a+FugBb+dFLO5s3iLxUR*y?#!P}
zg6vn;VtVHs9;}FEiA-%uX8*djYCT;a?vxx8ZaFI-M~b<m(l5F38IlB^1?9dt4g6U=
zD^Lv)_=0VwkBVn@Tqva+4H`4&e`eKHA;@H7s@_<u$G3YF;F)iA?JjX$09G3{gj0-s
z4kXY;qgJ?H@2#AOlg2xXq?;wNw^q@fjfD!4Y$d$CB-}8JmlaMO)lt!gmMU~om^zMF
z$<^mqL%)X2i)lYv0wnL81~iPGjeG(K$a&DFxDE9ouzN}P4e<{-zPu;hD&D17KMCpn
zdqf1e#tteoI@hkRkStW!u(kd9!-gxxYHl-XWVuy37-|=0eUwTBaYv%dMQ6-5n3gu{
zGcxAu6bU(;_t#N^EqjoXeaWnY4V)Agv&meuNz$gPo?3!@g|LQr!4~N7IT1@uQ*?%}
zh-!yFlJ?~D12yE&lTUr&!&~h9CKp#^ohBq|8iQ!)L2YNu^DXnVf!EtsXltchM4hr%
zSNW#|lgcSRv85vgC9L?3+QDi1(4c?k@Sk|lpk<tMt07`|mA7TV$1dUz)*xM*2t-rM
z_+duW&y*Tc;!?N!b;F#}2(t1keNxq5QLF4JHy8`ai`=!U@Cd3uf(6zV<sW42oVg3i
z$}n(vCMYOWXI?lyoFd50%nSGO(V*o7djQ`UJ{Q;R%eMzq%7wRkG|H5&=QbH<f6(K$
zWhM%8oh`kIcgm~!TuU4jmsSshmyhk5T5pr@O(!IW3(5COBTnC->fu$Ho2z5p9#siO
z%BqDiEu5{#2c4j2RG3V}58bMm(8coJ+SogWt(X)B*W?A1<?&w=Hrj5v|He}b_+<yq
zYe6lnC{4-c<+fc@2qXySk;~#Qt}cyow&u&UMk9N-ib2w1UDts&K>V;#AZad5otsj;
zxa|_i4!o++#F)7iYU1H9>Pm>kABz)MNuX*ju8^lUBmj99Kj)U$I`@_@$b=m#aEZvx
ziHSsA7?F_`;|<usf*J~m4~pFn)wOTmI<ANK5mjyxAJ~pWfaz>T3+nr;Rk?#Pnw$4Y
ztUjpD??VqLbIo%z=JpRABpn^89p#5VmP*NMirO9O-RWdgJ9M{ak`yEr8o_MBGgx_%
z0tb>tm&4`~TU_qs8^RjY=cR<chIN$~zZ5;<oKJN<PpOQyTt3fzDjL^;=wWVeBOrH-
zvqXT`uY?z(wY=0oixf9d#qx$!#foTKJf2aL`ozy9%?decge;Dm`^NGtIl1te7w+9V
z4L!|}anGYZb6J~FRk5l>@HuVE`(ufGZ{*ZPj7x-+y4$U%7`kppHC=o-=$(pmydG<8
z1*X*FuYj*8XvBvjAp0T;-x}>R+ksxh_s+|~@~0i%!SmZ=h$bandaK4oB~!}q<>Wcu
z4?!tvkZb(DAbs_X!oQB4JQGuxDzs5hDCe3OVOVax1*!wi8j@gkjfxYM09HL3J-PN*
zh#C3QH;F)T3p{OV-pX(cqNFs#iHW(Gv5L0y799Rt`pdWVx*j`MOD0Dufyxjc8VX;z
z{3_5G$zF2n)?M|Yj1kJ!02)%E|Hhba%)lP934e>}R5KT#2W=7kXeW+Kp7>%5$2BTe
zmv#25P&qD4DYw4i^41F-u}prO!D(pm9$lX9LisuxY9<IKHZlyUef9X9CMu~h!jN@Q
zTU6kkv9M?wSWaR0*a6KbUBiv@NTcp$#|(>mH|>ePr7BC2SwpboeMJ299IUZkwoT*A
z0!B05tY)Yh9ofMcU;qP=;@&Z3%&iN!Y!NwMx<5(~p7c2GC_X#osme-x6Te_u85OWi
zBy=TY%Hz<A(|&xO;VAkGviIM|dVhaU-BFYqJHrqz#8hW{D2C0=%0>|-wV$_RK*N(I
zCPSA)>+0I{ZcMZpLsXh6M+Ge+@JK_Xy^df2m}eVRPiVnwi00jvXFRp)^CxE&ann$~
zPFyS`K#BbmyZD|XINVpSj#}Uir!~1L&;oWiMe51*9FkE(kuaO>i-nEN6=Fi#N$tFM
zT}tKQ_Z7j{Dejhl+Uv%P3Mo?PTheXov>oXV>;TD}gEd3=D3NkHQ4<CE_A|p+roiI4
z;*6y=jLP{&hLPe4U|_I8&`%8Lfb;01VU)9Vkcz3RKIcfuYrMx|icQ6sY^qI_s8}X0
z>tFt29O$qPo)7AMgGxfmYXrbuPnCrB?#3?1D{*sV$eopgP&{iyaO~Rt{tx2LDy*%r
zUDL%W?k>eC#oZ}R(NbF6U4oV1R*HLp;ts{#A-EKGcefOWpg|`6|LwD9_R(B(&H-eF
zwZ8Q}?|nbg>z?4N_Ws1ix^ZK<0}UsBJv8%>NJ+~^f`28{I$36}TbMi2z8k1>Eqb5R
zSM5J0^aux4hcWl{^*PC$MkFSc_Wi*95|l5ji)Gcrl9E<!Oq?nI`6oha5ACE~S~il7
zoFOi)bLItZ_yFUNID&~-LQ>N3!7zhn^{LpovYxvm*|<&G@XT(7N1es~>SJ=pXRiy5
z-Dd)lTphlv=pCDn?(I^3O=c+}5{ZXs8Lv5{Xqs!TNlhJ-CM>0&xwd&=RL^&O!wSiZ
zHJ}WY?_e^i>zGqGNO5Bb>6_$#!^HjF{0zH*u?rHegFw9i<tA7H083WtdCY~!U|b3k
zwaqn#j0zDAEHwJ0!YF80gPKaj!@PWik%|lhSvUffy$Qp--bod<V2lgD>sbQ4{Q)kA
zPwnR(gd|E9mZ6!0hTr^Q5!vVH2R;@2JDmc5V2s(@83c=r5Mjv**U=?w*34ZBC4Rz=
z#Oo45PQ1EOXDd^l!7w%{8or~GL9e=$=kUMW66m{5{7ij*=w32zwj?Y?Lfg8pmg12{
ztkLD5EIW0h{l5fCuy~r&fEyDA+ZZ9I-mo~$!+5DNSVU9-FYA&?^WP?2Fy`d{C64&d
zk3N~-fNX9P#)Sl9Qa_CG%=kxv)8y3V^g8ql7cf{!ZS9BbbhYv}cHAJC#S+7c9I$Jm
zoDfQ`#A$1GMFcES$)2-GWq<d>hC5I>b_|)%i`U2!RNqU<IjTG{WAua*arEH#InrWz
zWZAQ!X;yN@2%AvFzr0<y%>#lX;JDUPq36z7JpWRB%5DF}4q5%<+A}P${cqy2aeBgT
zQ*oPvz__2mJkCO4o1eDF-_uv1x_!>dx67D!rma>mN5TiPCPm7ox-(wrD_@-saC6r+
z>K<#zS>ulPS$fVbGL3*4V04z8b=eq~hrkhtHQtYEDzi($o-<8?7KDJTJ=(96SEtJx
zcQ-EMj!Y*$k}@i;gD~|sJbTH2p$=t2XN<_QZ|_rSjrWpLOQ<6ygCy=eq7459q+wR5
zb>=ZgP#IE5u61}sOKP-?uq&f0Y_VLKn+t273wt}wX}PJbtisJ^6@8L=Py4igPp8wN
za3e;U{cPo(N^hS980py~qg()Ual5nrr1`e!1~5oZ;OB{&s?jl2DC{l|c<!SY^FN%)
z9f7p3DIRe4XCv&C3-H=}otQCiQ&(|1v3MA-U)G7Gtlo|)ddF&39+(h!5Md5ATeh2>
z>pp<!rSVUDrrwjIxm7Cm*v^04P`t8C$m<4>ipg6WR@urA?{R0DalL`CKy;_A(z0fZ
zC^es|W7yxcI>-U^x0U472k^6NuVyBA3#}$+JX0;d^8LX$ITuTuDAIYLavLXW$ZKIa
zyyuZVN+~+KzX4X3PI1iq2aKj!q7|H07-?xDgyFYsECyzzyuH>Zv5k8SV_1S-rZfuB
zy*(SCW}(&5sa^s)%EyaZ)&0(q8T^#Q6GF;r;VrM0a{4$kc;*UGP<I<68>>4b=_XYt
zjccBw?Ws9gv?T(yq->S8*CMO|;Yb2VhZa>S7y%iL**QCLxpm|<I}kf<a_StwH`wtd
zdN7})vgQLqhaSa%_ZEb&qxYe>Oy+A+K-MT3kDrWR((RtyEMwO1)VM`es1>5+%xV;u
z>C8in34=AM{lwSdDD@Jxg86A~5vsm>li6cV!{cUFOn4@NiV20mB)&GmXft;u&e;tt
z4lOn7=)$G5l-E0qk)3Y5V>k6CLDS@;g3W$>nN4P!cH(K`bbPoU1RmkY=_tbQFzNxx
zP&sRR^GOBzlyl}Pf+as~ZmlF09U8Ipru4KL@oO&DG=6|mhf+@$MzWc2(#J0}?J&OQ
zYlta~zzv7p4p9kU;9QV04nbH?R~HPzfi1;wnHNSfV2%q>g)|ueH^@(Tlq4t{bDL0A
z{A1>eLe+n9n=HL(N6{Ea2peYhJe7*iiV1!bu;msEL=sHZLrEyb#U03+O4>Qs+nZ>(
zRLvk>4p9-LCVEu|nc}trVL`p~BkSMHZJ_^g&S^cz7~dDzk*pQa_8&AbQHM<OZvka+
z7MfuYnsVAE*!$b46w~wh30kAwYWQopvgL2nqcWc{baT&G<oa3!%#CLkGrVGz!_baI
zv5kG|kz2=qno2z(M+y{7C-IlByI>o>Z1~H}e8gVQ!juej#Y-zaQsA)uU0;E%*P~_z
ztcHWT5NI}mhHm(dc(0dykWamNTWz;e<G1nwGArH{(8eCbde3I-^$<q}A}t(pCV^i5
z&{+wjeqL}?pA-A`>j&G%r2%yp0XVfZ`NNDWoXo7q@rY1JxrY!8m%GRgaJ3cQY9VWv
zwvGC1NwZ}uo`zOQb87l})Ewk9k+}2qSabFUViLUp7X=Y8eTuoN)(fpZ^yiS$fQ^CS
zeK?hMv%SsVk$I!UrIJKtB&<wYInxjMWi=xCGKzUUgj!uEr?M}c=})aqh0O1NrPpU=
zoUwer+OJZ4b|Tl;AALwQms<d<HeO@thOS~9cNlzFKIJqZ<Mvz;LztSM3#RPQ<5awI
zPw-J+TaC^`uVFqWksB$)V8s@T8BapH3$l3MEB|uWHa`4sdk17Mb?KE7ENaP>1V_^G
zxWG-US`JF-&!1VRPldcHNm@s0cxd56HKcHzI}y^h^F8=R6&(7u?yP0xL+Jo|uQct~
z(HbF!y4<w+`9GXHlN>v@paqN6L@~kzJiE%uD|$aZ!QzEi0x^{DKg;l98E|Y~6|O5H
zo?*!EQYBd@c1XlU92PSlcRv373+m8sK^L8(cV@G!Wn`(lA_%E`GLw^eti{nxxME^n
z$+v6u^6Vnweh%FIB^I{cg6>|1%yoH+R{0aNS6DXyv-NcPb&OeyKk}-7D@Ax~FHWo5
z>kXr*gIiRkp`5qq(>F3x9dzf%z7mZ6A?Md=IEaoPey^an<}hqWt0;GmJ-wM7yZ6xL
z5!CZCEwsBBCRlfg8`Cm;E#2-)*2GS=6MfRF!9LxH+{^(*_{5!UqP!CEs}J=!$F9c<
zMSSTjmT?DB_f&RE8_daAPpIIV66?6&D6OEt@_a5Wni)%^=XXaI7v5w-W+P*6E$Al4
znDfCt<n&3_qrdRY1;nC!wJkg9N8oYclmiCooc1*~dsysJNTPG>5Dw{NJYi(S1F<%B
zR#;eOu0pHktMnT5vd#w-3Zd-K+%yVUJ-D>BHatiHBNcoZ;~(@Eui^uDrE^x+<dTYD
zEeC0<+lh?+gNE=vv!-t=QK<Vsmz5qKubdd~6E#lDJA$`wTWg*_VhI?Cd^)|Do;xZ}
zSR@7EUwp6{4Dtmu5)6(e!CS%hp?I~q|1*w@4x|5IPeeWgM;`b5xv3A2@;h^qYP=Kk
z5z%J9hn>V5uFGVbUpA>u*IQx=sEBQbNX84O`YJ|&tZU8@Rdp78O60r&vK#l?>zN|W
z{z6FJhBp^y`=O>FSo;4vcdjuhRPd>g+FOhLU;>3fSE<hF;=vwZ&`ws7q?XR^+sl?w
zIr-59h;{%!f8~m?mbjSgjERyj>fDsZ>wPC?TD5R_Q+LZwHITWITyuQOYPCo&)p#N~
zb7F07q!3ha1b68LIoGYv^4D_pL?Nrdujbq64UWK_U00D^4Ig=&OS_FvG=9zLr@bv1
z3$KYvWY+?)9#`!?!PXTY`!o7I$^Kga+QOgx13`_+NGNVrim}dN;0&i6(stHDveUCG
zws6+39AhU8t44>eumH62&);rz!3g+-x(9Q>)N;X{RxB?TpEGo)ft)GDU;qMtt3$ze
zcl?fmBO><>)IiVB>YYs_b4x?n!^<jTGU{$@JNK&|dqX+;;fJVVFCboM?3uKtA!!Ui
zUpm-Eo~CI}mh5z)45@dI)1a)wC=~o!^Mi3$VO8>v+|qn0Cw?{TDXp(qqzv{7i`8Uw
zMAKeu;JZ>|ZMMu+Ah>mX+j~Mmzr%;rX3DVn%Y3jT|L$}Lkp2WxU@tNiFOT$;q04QZ
zf4*3q81te35{9w;+mU+aE_)8>s+F`2Uc+BZazo)T9LJcrN;UQbeRt$XNc(i`b;w-u
zlX7Dy)ECwD>fj1LgrzUc6I4GJ*7{Rv|9iyyWtJ?8xz%UH&?P5qf-0>0OXYK_ca*84
znXvI-iK0_^U(MJ`y)i}tPlR4wfYwutjc|^cYFiWfo?~Q<bqR-B%<bEmg39*DbWF{x
z7lz-x3G*rY1yPp~Fo8LgGK6i$dPFQHc@5@Z(Vf~b2#r4;fq|xI6?R>XPwwh3Z(e(2
zoieU@e7ExTDmUCO)|J@aQXI&V``uz(zrv*MM}wCb6QmzTD=)!c(Vy0(%tEO`H*N7Q
zmFfoMOhN2pVC-Tmcm@EG4b6($%;dDRQx;T3R^O8oV=OT`GXTWuXA(#NezD_e?t?AP
z6n0n#J+n__@-D4E+PLuGBn3V?Su;KGt}WttA?(oOjA$Oy;4L~?B@?GIlVf?{d4ffY
zm?{=GT~L$K$^;d9I7{riBJM=mLKJCQ#|pbI6IZ%J-h*&X5PEkJAGJ=u749L$J1m?p
zS4K`{ku*k|R2?a550szlb|P4^h^dh1ZY8H7^(s(mdNI*Kr|3le;xVzcun*a!tpScw
z>d*MB&^6?gQQLBDsvaZhj?M-Y&rHUQD<jOnp;tVKf@0Vf6KU*$AcRUi_HNaEr(egc
zr}K4Oc>e(QuEJo?b$dtj(c$z)>hS(@nV&XGKgm$4+WQrWL&3s$eZctN1gfi!GKPw8
z<XVJywpK7>)WzUi!0?*QB52*apUy#Q`!}$q=KxpS<a@j|=!nN`-oUj%Iz=x|^v|uE
z6*7+^VdbTf{Ep&+tB0T9+A_Nzki6`|q8i5&vX1DZG{I+~(U2(`y8IM&r8%V4Bl9I1
zNhD3;XU6TRbq~NI5Tg`ib-siH=Oyd|0HwkB2|33LBvD7R@bGU;TI^kN%kKmXG%-G}
zzu^%=Okaz-dm26GoZ*uTwjg&qRt&kFvTED6zb|apKS<9m$j=!Gx;buVrl{T?EBRP|
zG+M11WzzcxHKhV?X0MJ&xDFHhlUt6oUBFyrAatK(Q3dn7RXcL!^>cAWN9?GuSpU$^
z4q=xcKyQzEVEb^`d!bZzI&XZbiM&d!fs2>>R!8gg3*nlZajLdIUmX^HD=+A3M;+S-
zVL`<-B?T(K+buF!&ym%OiA057KQ(tS;TRy(5q^{3+U^L=LZ@5>lFq51F1u%Uwt)S-
zsR=V}Sq%wL$;Adx&}QP|XJ}I@VIm7jV1`iu*wlpDGgPCBlJA2AQQeSw=%o{HXF_KW
zcQG=!|5yB^a47hWnNAEH^!A#vK)c-s=|;>UC>Jcw-llbN;+ik*1O1!b@fkdEIQ^+G
ziyFLy9c0up!nJFX(#ycF(LYyI{fPh4dz;wi$2NiZ_;!X*-<i-oJr$hR59i2F5DfQD
zn%x+X;V}55H<_26lfF+fQLgXnDZ(-f&_)qSV%-=io4~$fqIKSJm|YhPM!&$Nr`*wQ
zr~h`tBW48}M|PgMe%NK7#j2K+y*@lSrK{tKnuAM*r3NOUO6TQZ5MDLf`~+<54pS+*
z6vQi&w|zRhf?yMy@#ktt#Eh66!G2PsWQa18OpI~ByM}p}J27WeLHR>(%!q9BPY^yA
zub3sc|KUd&33=UE3cHBI8Lf+Xtx44xV-!xfwqNPZjrd_1cg>3h6DcFQ{({_<*3YOz
z%e7aEE6^bf`~0i=_cNN`AXZ3%*X2|!EZqg`(5~REuRl>9D$EoN8}Rs-2MQZRiho)5
zG*=R?e{gRGUxsyvK)twZ>zE*GLSdao2$+edj|K)5g?3=g2i}}N>xOtDbTRf{1G<Yt
zhn7*QU|a5=8hY3m(F32J4$o}lC#qMSxc-O7bdjxs|67`$Xd$BtDqY@|DZEkXxP;qq
zw~HG3W<%Y^J0W~wqPGMhx0!oo1P0-~Q}PY;MQrD82EjiuZkE-F=oZsg#)`^)8?@^z
z`BcR!wysiY>4ZJ-8&6w@tz4$_YuwtYv(`j0lPWLNeK^^k7J)VV&DRs-Jr-YH#mI7A
z2}IxI**UqceQV2uHs2>v<s=XxRvAW6wG)Q>9aS^zqpG3=$Ad`+WQ=HTM2&SW<hQ6?
zv&24E&-lKxxkvmn2&|6>lVwkut}SCuPIg>X6?VC1l9vv#R$n*>cmWRRz6++aCy8F`
z^g9U0vXRhZ#$Ka-kDIr$Z~5cEm{YB%G=WICy4t(hX(KjG-FfiVS2>Nyr&AcQ@U=)K
z1?q3)mrRn6Bg;V2DI;fmDme3B0I!Ug^Io|L63CG?r2&3V<>xM24U?;ReCD<+IYuwB
z%ReX|Zoy~79zTF{LEEG4#eW1$i#uMGX|>P_(op(RQ_(i1ld_3nc{Q7ST0ngX#J*cW
z{OxgHp)Kj($_Hzqr8Mj~+qAcVmR@ab*G5Enz6J7D&0v_G@k^91)h3S{VODhDn<OhL
zSj}0pct`M+X>KjHo32-u3E#qNR_X_?wCD)lmlE3l)^a-iBF4Ln8{`mPsKzgTdf@sW
zAI_bnA&?o+!a3-0P{#ia3)KQQhly2fAcgdo7QwGEiUgrOI9K1EU&)4Ed>xFjQ4ur6
zi`^RD(`Zh*#-oXQ`<XwjCoardzrzi#^>%%GrRx61`x#6zbHjL?RYJHzj2mjF#e<vb
z6+K}`X7uJ_QRtV<01jAgv&B`wLBBP+z+Za+|5u?saO+4Yot=@<yO%c3b4xUd)ukS~
zeA<bm<+%F3e8Js%K3aO?0Z;uya*mB(ltD?6GgM00?^cEOe&7Sf0cHRG)fpGxr+}9|
z|B%K;vkR^Cd%sT$J`*a*rQ3K|mg|KKx_z=tTRrz?g04+bVM0OF{Mo<hajWRrNcKx!
zKYLC2y24|$&oSF+jHOjNa~pKtSCF$CwT1DJS~+u;#Uska=8SbW`!L|cNwDU9niL#%
zIPESO2tM>njkz<kau(lV_9OQSR}|e5q~8B-RRIh<ppxntW6{Q>)IN2`-7yDsJoBeD
z-9I>ab4;sQNiG;h9sb%89G7c!{4A;E3>Q8j>><MT#ef~}hO$4HrwFI^>Wx3!{fWRc
zJquBay(K^oqPM<cS<is2^qA+gb?i+4t1~EEQE1`@W%Hrkr+&|<e?7412N`uVHiGbB
zh;6moKr}4U^gR(KsW3Q)#KLS>2h}$M8$Xzf&rcTCSAk#Fm!mU?C?SD-i!BE@)3L_^
zBjT1I-5S0vB1Z(bTWk7hwM@y~8-*;yFP6<D=CJMjIv8q4#!C91G-V-wr(NS08mX1p
z{EW^=+YGRtKw+nQ+K1>X9wA|}(UGn4HLRzszTQ#vU$|P9PNbPU;hz#?RJp?_vt+_D
zGct04PG3W`1vQOHZMsuk4xG1okYcV5sxCwRM8LW5X1McaojEeg^_^m{OfC;XN~)*5
zB~lAxMMT~*DoH|DQ0h0X1l><52BMi5+O}FvyZTg>$5W2Fc&SYf7?9)=s6uyQdIit1
zw1!))qLbijX5vv(=V9c){}H56UO3pkx$u3gyXaQ07hW%X(h0=<jA7wd8Stnt7$!m-
zRc@+$5uad2Ighl28}r0@d1(?o$QpfhRw(GabQ?3#vK|Q_rK|jkR*n)eEggdEzFI2f
zVTs8Iy*e*7kY4#=Jt<5ZcVJq1yN$R(L+SW6;x@_TOAnx#VIDp1H+^FB;^sosrkk+5
zrnE&vw8`o|iRE|9$Zk|IKB3b$O>?RXeN!4C*EuF5LPKo)ixpVgJW?wjOy53eTP?fQ
zAVZI5R2j;P`(_>qH<@AEVUt}Vl-2r%QM1VSc5RNiHVDVS=wnuVaVF7|1k6KWX&~cA
z;fff6N2|GU#s~YTO;#6is5z!>BE}G)P5K5jGrH_iL&fu`fpDUXO%do<c^ifCKXDL7
zMc{{vzg{<)I=;|YzD)3j(K3+B7l`%SX$+P%i}TaX*zk|>dc;F?xpZj>U~rbLRc7`6
zG^NT98#CRU_kXhsIi(=$Mwx1pkb2=A`41(e8DmNC|F^5=&sC_zMN*!>o=p|w8+KO%
z%QFy<7!H-Og4>3pp?}eq_plISyi>YQ6h5J)`qR)sojK8)_(f9M5{tibKAx6L8oU)!
z))wXw{GB%fbeFOCe;rdWE#E1||L7h2`)b>FcVGq*uUO-*fQ{>IkW=N}r4-G<|2w<#
z16%_Siy;K<s^MkbVSLIzVu(Q?j9Y2J;I4oX9=gb><FIcfYv6w&8otBmG)5S=v!$#F
z(*?q8X<7kMZ7`D{EQF|mCykSZRRO+-jjOpo!HijYL4UcGzmmZgRMIJ!Op9Gg&I^fq
z8s-`^3gEer9Ylo9`To<muM+x?ai8CP;fUw6k}~l-*ud@rkIyT<k@&zucx<zL0^on_
z@;!!!aq4gaT(6uAqjFLMz*WAFBeo!t#fwb7lx{$Q?_`m3C@IYQm2+4zrwq-xinFa=
z7xeZ$E~l)LaUsoc)wJT2EVC49AyQtbVwCwlyb1ebT>28F>C1Uwy2RYo9Bx5;?VzYZ
z+JC`TNK0V9JdDTriuBh47pEVj;A9mB^9sQ(g<!%4>HqW%oNxqvK9^AE<$0Pxp0Qp0
zQv<cBl5Vw18UdyUfO(*ZKqpKwX%QSqh7Dwwm#Pn?M|g{bM{CNZaIEe@?5gCD`^Dia
zMgz4j*ah!^wy8(ist34KGah@yH?yUt!h@Lw%}8&IUcvc;|9i!qi_Pt@K|i^IpYHop
z9+v};3+CoX3s$<iD<77peW}jLlXmv?qsEk>MN3xwe7R#!Y8%n6IfWecNu=u|9-qfA
zVRXZx<d53gVdV1p>XV{^Wes^mJocG$Mh~MCVX|}8&T=l94O*%0)@9P(2X@uUX0XqB
z7)E^|{flPqir5as7$waa<^OoPrr_{cgfV42RTb1d&W%4IU=Wf^WoWC8T4tQ|3m))b
zLb3#POVflQYZ>*~0aE5xi>%ABVeh19N>HB^sO$HIF2}#`qsVKg7iISYNoNBO$>+xC
zTHu4bSj(K{vDb<X?CUTE4-`~n7VJJ=KZ^|y4}VnuGO>ab#;6pa$|LjZ*+!Z8NKt=b
zQZ74Nz`!dL?M!iFa}A2^0~NZQ2$j0inXGM$5f?vEey;4dg+!0CQlHAJXe58eATgJk
zT!O&0BS;_G+sO#{4$A~c{=<Ly&%o*J%=L{T#f0-UgULbz&Fl)LA8z?VJ+erkXpQSF
zZuPw4S=HHqgij|LCAEM-kK_WO!V)+puaSlx#rqAXHFiDywMLQ~AW96m6VuM=bcviE
zun|>U=joGfqeR`)*0$NQ^9GXeUQ_v%UuRzefZ+Vk9~!{oabQmf+@%J!-7VzT>rgsh
z9HLh2vV0wu?6<pF8`uKw0_Nt4Q*Bsw{<pWN7@YyHzlb#6d3Kv!sRGHFE@+4F^LG*s
zz2ZVfZv#`Nn`pt82<5l21E7lTMUs>-aJah9E!1CTv>=&e!QCYE7Fk%6j1>a-IJZ6!
z)9m4Kmz||@kl)1#fitw5H(9uVl8|eefC~*4t1U^#3Ej^D7uX3slM?61-SXq6Cuw}m
znhKyforsOcQ@e~oJ82^`E+2sk`Nt{c6#Ezm4(;a?j&tmnJMUE%dwKUcGk{?`k$246
zKAE8l-Rs~?;Wkn7&;g4?)V2E8h9X$TLA-h!$+16nlDBI539Yhbf3TA~zkC**cXX1r
zROOrg?j~i=*<*YBUf&CAxaws8bt_>7Wrgpz=9R>l1N9vqeRf;M==trf5;5&oKZMiW
zImxoAywl%o<%UgI-rQ8vZo&jvYBJZHD-+Dqri~^Q2mEbkWZU5_S5%pSD-W)y5<Y?C
z^@9Z?PK;a_?BZL8)Xs<1b?Y!^AdEmY`xo1b+i3P0P$k9dyf9(!;fW_G7j0;XjfY3V
znR8~&59JmV244Lp^j$?<?K}rBlFssj2+ssrgG(>p3{l0|Jq?UcfxX-ZK_1#@#C}5{
z%5q-fW5iQ#F|RF9-(*E+eaD1$E$dJj9SkOoV$6>kira%M$t?Yv8;A>hS<~C1e+B=B
zsaGdJhOG=@eL-tz(3Je{7sSN=l<u?~eAA+yki?W6wHpyO9^}YtTl4OaNT(F`cfJys
zDr1xx?~cEv4vvMiq-3RS&Xg1I35m-s*yHt|`j{u*8rNSCp7NEN{IWkuN{xabu2|!1
z4j2|7sCHM{gy?Nbsya1NwZ`~_y$&Q5XmSjS@#EkzEFa+;>6=j0XD#D`+Ls3uI}|Fe
zSf}t9v$`TH(GC`-wwOXQ(>|L8zKC=C04N(JL>!$aqKGEGsV$7<odiJp4L-)5gT3C>
z%%8pD1p+h`%|j9`PAx-5`a&4E)9z}PTDb9al_4TG2j@|PF|5z~smFu)9`ys5XULQW
zsiDx)t%S5dby^8K$OPGK>?CBcm`qog*z&!+JVg(u@(MRXy0?eO`gGu*ld;b~fo098
zQPW%yFUk;c8Vrm)FzD+wW2X`EcDDPV^1{6a6Ariu>vd?%j@0^q^qHVMIGA%5i+cs(
zSM%Ez{GuBEtO9?Mpo0sk0otO)gKY&gUr}Q*fc|3PCb27Swd<QV_ed`e1(9@)n!}a?
z0|)bOvaE0?%{1;9x;}-&cECCPn*+#IY@f$U&QCaJo(b06zKvgbFn@M)dn4jw%5J(`
zDdoJvnU*H;#wj{~!E0aBT^sz$!V~H6?5r<6l&Ko(g<0sjCumSIP%~@Zob3^k=8ZCC
zLf&;7cWYh7)$I9uh9j#7cR9=R%M0~Spd1-uh9~-UC@Y2U@-DLsx|e-+O3!?vL%k2h
znnlauLag!ceGEgp{Tku4EOH`5M<$*!mhN%#Yf*y<q_c)<wdii|UaZA|vBl#?at${Y
z`q(zP<DJG>Wnv|nKP`St;CwixcGX@*G7FoIz`8xU;+7U-Calw*1UE|B1$!WUYUZbI
z|67$5<jd;4uY?$K=%Pu0o}d<D@?O<Et67<MOIr;`%+wdX)?8-!cFf>p6T@!z`Wsx$
zd-?6IfWR=!%kJoDO^BxDmW(8^Z&h!Df;&bnP=QMzSKV$h!5`k;*2_vc8P`!2C3l(=
z?r4!<mDn*reIeEgX|I@-qnDlAPlXQo_|b%mG8xv8AmA+8`LtjIS`3`${uuPc0lkC7
z{;uyJ81cd0as7fW1;(D7)sFlYhX2?)e_-WYR7`e2J5L)?5cQFJdZo2mU<X(Hr-Y=;
zHr%o3Mc6!*yv%#nKk21g#QlnIS?Qk6F7^$Oko&N_2{e`$wA(zf(@Kqu$GjwXd9`}Y
zTIuc$!PmS5pBHFuFAaa%6-~vt<H={W6*(5x%(;t*f3Bq=K#NO03^v17{0Kba{HmwD
zFY&IY@w7km;VYt?p;g(Ax+xA?*`I3vNc8n+*j<BjJ*tZ6Oa=_KJ;uhC|6-5XBV`tr
zHq+dC<W13$7+WrFvIu$+9;V9fE?6)Cjt$^Yf-n>35>YP~RqbMEOy)lE)?@W7KjVcb
zXXV^I+pKy@@UFNSC-s@<anrixHP@m!XKmz{Z+x%JQ))JVVEvArc0TB3#t2M=9a*s2
z*P{9;oq-v)K}d)RCTU$$e34H1)g%oJOA3N7IKeta&QJCn03xwQdlgB(%$cNUTyrM?
z^Ke*i`*(Li;)CdsDiITs=Wmk;5RuDDx|1&=q)k*l*Zu;V*R7@$i-d9mb#cx-#(E0e
z#}9tIH{)MyR^-xaST5lOSOKHITWdNF8S#)EKXgNHEl`~{WH-QZ`>n{bdlkhKLZKr<
zznPnpRSUY=Q{*<bvDxE1zFcBW=?(q(nP{ryM4=Y)@Z9aZ%H|QhYKP*~>45r>C4jo&
zPZ}J{v2#=*-#jElx)uAlV1c?qFc>{?gSoNo=YV@^sL-D|yuPGcB}uET<;gf7nk_Tm
zZ7ga>`F%d8d$>zluxZb(FB24rVwK=j1)}y<@zf^Fih;XEHE1;^NG9l7Fhk+h<x8!^
zWTqr>#p!5@P+s8S6%z{?Me+3TyJBYVD3!Ll|I!Tj@H;)80uVJwk6$SDwTq~Y^{w1_
znnX^U?>G<>leg>L17d{H`uov6sS-}ku)?y+T%?!1&PQSx=j&|9+9xq__gQ5j9i7YC
zWMZBpYOBM+yij(hO!nQ>{OUK*gBS3YYwfWOY^wIdT1{=1pEs|vlB(j#R#|Vk`U${b
zWc7QP`8l<IC{Dt;sFg04U#S`-ekeFp+Y7`b%IHgML-V;ihl`G8YwHr308Ry*%6LdA
zVLMsI!{f7?PJaw#gHo$Y4u}0B9P!xtnaXbYN-gw0r_>v9xtlDAVrYPu@LLmdM*o(t
zyR)qe;&{+WPJ{P_@1n{B<_*kIGh*sEtErV+T1qzNOXdK=5_i~aACiU5vylL|3=X0K
z#OX~d^3^^X!e@NqKio+yRH~dW);L+EWy2;+JlXA=NsrOiU}ReD(bl#v;tn9AFOC~9
zQNA5)2%Fy02iDQ<B0Kh4I85|+B(Ir+;+>md$0ex=lTfJTPc6+&105l<Wp9(i3F$6R
z{-iu4y`-vxV3j~ilDz_<^YhD4M*y;b0dgJEI=f!UCKv#sdh_t0x1KO%dD^A5&NP|i
zPNp@CqJYxSoUj?rZh*e}iCTnvx>G#z%2D{EN4E*6Heodmddg<l=@<RgD<n-$ubSVQ
zTG-3WnQaN>%o~UbeMTwPPRs5ORT#5*xSj_tg&azz-CE@Lip1yh!~1e<`5(iH$&@*X
zEmOiM6-1D5Ev_0#MtuG<6ersad5Pi6x5_lDUjn@AvVFgai+zm3A(O7gB{~v`6t0R;
zWRu%vYuk8?4bKi%4+B)DyA)5Hh067=033k~<}YS>_xuigWL)b{Xsu_y#+C6^6Sg3X
zsFFs@<7Nm}eqw6ah);M#1R4dFK7wYUZY`L;Q!Zp!iJ6pFNm=V%64O5Xvar{yY#C1-
z(%Kn!nxeUH-f?zQ@~r}YQ5DTk0xtNkRk%id85VuZsCGVI+IZDdd$!{Xo}Qxd&szK;
z()!Cf$y&T6s)#MviH0qL&&ZTEm>iVI@PynP6rF<>;9D&a7sd^{!h>)CEs6|{;eO2w
zt9v08dt><et*+!sL{&j)ez(rIdy_G0rZ4kz9_p7wXDo(0P}jK6Xmz=lb9DNh-Uwwx
zzOk<tt4%OTY0{BGi1>MBQEKzFcAnFlm^}?52#u<WBy6cWuEgM=DY%kwTqI^T^n>NU
zJ-wu*4@ybcQ^8*KE5w++UOx{kX|6OGHQ65m7Q_uUYDf{tXm6~k$FoFYAz}fG&Z5+o
zUr6Uq{o$0XXy#?J_w7+D&oH~n_D!tigq^k^IusbUl6RTNs|CISSk@-h#kkdG5>aFi
z<o3&v+dc5R`Vj-ciiAD<AmfkrU6BbZ7kTQVAFCt<Qgef#)E?7fS{uN_Kh#@3emvZb
zQyU2k;a@O~OQ0s&_18{Ho?+{yC<+}0L*Y6eTx1++lzavj(qtWg`p%FAV9CR>6D=Ep
z4a6Ny;wpoh=~R_3yoY(U_@|BLf|)CCYSk8QTT3%}f%zRpp;GiJf}!9Ggu$?Fbl{;X
zc~Tgw2B!Izyz#1OZ>NMw@BIV6!w+!kpkGY9^NZj&un=&gYx)I0;ZV3G+fA9_^)V>J
zE>wMT;*Sd8JW2#x9F(p>|9s9TAZ(V|0<$WSqMc>-wU^>5r|VTSv}aUZt>tAt@;F4l
zTR017TKM6|M6Je+y{SVE-k*KdNHG?YdP9KINStWFfcn8w8q0T;pZEqVh_WMmdw}>t
zrH?_l!Ouf3Q|gP3xZm9=b{ld9M230&C*Sr~9H%H7tcpoGchT*Tuux&*?DPRE`Q7J3
z|169RB|eA;xJM$SIwQfYd>Lm*WuaYK<m2LE^m>m*bBab-d4jWt1R$hzpa0Y8g0DGf
zF{N2$>GS6B+wSMg6)sziomM`ZRp1hU@$t!#sJE|Qn2Nn0uL<>MyDyy4G+~)9hPs~n
zw*3(&Ros$qiqZFc6Td^giKu{gU8X#A4kJXf?$}$p(?q+w?cG_gB#Kp%Quz&RXT=4>
zcn)H>?yju{g%g7Y8a}^2@r6_4zvD|~&py*MU0n>^q(o7dLK+NfmR=;pK^G$gu+5v?
zG3oE;r$b5)V3fNGF`?6kSZbriP?WRQoCT~mvjXtJzbCeErGgFH;Re1x#TjS^ac)$Q
z%pM*r12Or!9Nm#Gsf^?ogQZ9yzUNNp`A_ZNp%RZ+gytYAzZdUNu<fAKC%2ud1=tG?
z^yB=M#qXS@C`h3q1q;wTl)8j<b1p@_Bf!T`|Ha{%^L<@zckRo@hN-_Bez};ZAT$Q^
z=6zq8&-m+0p_xS8K>#U_!NDE3B}n_O3bK<u-%+&q^a~wdrKuVGy$}soODCGx>FgL&
zRP81tE0x`j$1NT_Es!8t^7V0lylG<4<KtVvnu%Lnj;9M*m4p@O*Z}gzcdTj7T{BNh
zAf}bep^Xw=z<>?-NIJupYu_^-^@$}h>MECjrKH*e(96PYFeBJR_hZ;S#v=oomi}%E
zsG^#_MdTOZxbk?%ybf8a_FnolfV^*8F829-|6ig<I&smn1D>^W(Q||F(4>kh6(+Fj
zy3d5;bUG7?Mo~jIp<<B%xDodc-T$u8#<+seKPtQ`cY6nnR&z>H)|v`8b_miD9USf7
z)#eZ|U@dzbx5uUDw@j(f405~-$ZCZC1arqO;Z}Rm$$4GjCa=MjxnfL>_<f6MYzO)B
zAY&38-)O5HaKa@-U?}w<Xv36wu0Nkck~c0Fnxq@5CWXp-Z>Tj*z7AuJ7>l>5wRflU
zw0;yQW<V(Zt~KeG0u)=s@ys4yz|wFOvJH*Gnkk?~n0v$%nIL>$q%N&=;K}GoE&Q(1
zd8R<K<l=Z&l|n@^&xQL9-5}u_{d=;tSNiU2As;kQn%c2*9p1_9wwS^+4<61DGPUy1
zsUz79gesgy2Qi6|+#|kKjkCP;7<})d2$_J?$}vtduPrj?EQ~qk2vzwB?{;lJ28uad
z9t`?Codd^sZ68()jBLA^#JIQsYQH-ZO9z_gmcEINAJ0}8EX*v9dVNjofV5PhgOnHH
zwJC3PjKZbzTiTbHR9-4xwHaj%?HP2<Ny?&d8*VAHUx^R~e~ZES9TjPh)~FBD76p`-
z%J~l$ua%=?$J)p;(dUEuxcX_+sSak!U!&P|boFmyE+$}-+nsjVg1&m+d9hm2*i{-A
z!C&&)DLB^D*6ohTEE>-r3sl?XeA`nnKdSxCVVBjFbyO}uGZVP99%){#?I)Wg|JAhT
zbkb6n-_p6h%0i4`iD_hFuo9nKz`cHpDq>lF>QWTHpk0@QEryXS0*vR)ajC9gxjg;{
zGiLo~xi7I%;oQXmvE83;v?kLt*_-`t#e)Lgy-AJSj00o(x<bY}vtLJD=v6FikTfG_
z*n%5l;n2t6RqNdui>2ghhZ8S-pAU>trqi6S{3jX&UFi^N+6v!M29E+&z;Sqok*=rd
zA6Izb&s@tm-@DHpk;_+GuIY;UoLF0Jp8O%<7!fM0FIb$wT&LH35U~X{+N16XSgw>^
zX*XE1Ijpq@teMkuR`h&Y7;AgdyziaSZe6EjsL*X&-QlwX^>Eb5CB1)6e9~4LnDCqF
z9*eNg$-uU8di;o?7;0WvhRHr;j>A+m`SJ1<`Furht{xK5fGLi!Y03m-TP3WV96mbV
zg4bc7V#qi@BV;&IvWZ-JwC9X?I{Ze{<_Fn!fXaIJ;itM%>jQoRx2RddOS?7+K6poO
zHj+xOu)Q+Po!tg+ClO7VU25sOeOHgE3TfMFfqBQMzLH(ezyI4UHVjq4wR-ZD0~Z)l
zN1Ta2!#ryA)@o?X1ytj7c;jujF%wF1?Bbd^NQonbjk%7T-p~eB4rqSH1amo@_1-=+
zeV||+6#p6Ihkvpl8nt;iQVrbQp1f+*nX#a>@80mg7UM5B!glOrp1m#>g3E_rtELg8
z8pt2anHGX1S@zg#z<aGrd@GB5$6cu}xp@j*1y+ch<9TJm6)Yv!Bvr0;li!Q3_$WOS
zK0H+l`tFhWsC6=KO>Qa#3A6>8ZW21DST#DbwnSsrkFP^o+YII_$12T13a@x|KOczo
zrCr-?ZFN#6o&+AUclL)q8`I{H7We)+A(e5%91j5*`%4MxH}#o>T~|+);=V7qvSQ0;
z9#kAio3nEQo4lrG2Rr9M%fVzcGkZ;Eq-jd0#)(I^6hm!MlqjiSP)u`cOj>31h-fY;
zrKH)GL35>U<gdf`ZFDo&r~Be<r=Lu$Jy300-McIji4A966@mk{T>k3wJ^QmqU^Q!?
zsrh;S$aQso)1z#vyb>oEl%k^BU~OZQDy!k$WF}-&&m%MD7BW3FL>iI$LlOp|a7I%B
z>|}g>pIC*xzO;#zPS@BF)jPPDA+SP*MEFv94>iasXGViA+#09@ZCuUlF>USathkiZ
z`fb}tUMxNWwUKM+5>Vv_7{r!aLnmj}emBh504fVdNF%^s`&ZM0Vrkqo@w%hunKu6}
z0b&pbjso8P?U4DWn+z7I(een9$U1Ip^-qbdetZ1DWg@BW{M!F)<m0Eu5CQm?8sptx
zFBI84SHrx}H9(Z?vk*2<5E1I%wQ$CPkJ_Ju@<<7Y2&5eIUBy3a-v_xdRsu+ws<>5(
zS>J9~1yc;l+c$;a>(Ml$%9#hR4!0q=h!L{!o{7S?)OGo<-o~%CJbg=5{8D$t^Q&<M
z>I``x|12gPtjcYaajd#aBx@YA3RxR1s*Q3rvFy_fn;?t5QVTdA@5?q&b;9x87YVon
z7}9|1aG0;qwo<n~l_5JZ?YvpPvChdmQ$=Kzulg{dk|^aTOF^=A5E+obIr<}8CDODj
z$>s80He#s4=vbsw&aBhhfAqGjaPS#WQc^xX8-^LVKYp?U5ws_nbXZPE&f4SViHk_j
z!q5X)H5II3CxcH12DAD{>4>@Yh+?{ZFCKvPR}s?uspi?Q_YhAh^h1j{6_%dTwF=Wc
z!hjJWxz^<vSM^`M!J23Y*kDd<4cvb!v0wob%fAIkEKV^)LmYqmsRCeaI>*OssTa_a
zzlA&hP@mz1k9mpJQvG-#fR)hv$Cj0_`#!B+#R5f(tZPFG2A)0ER~Y|$p~%tmKngn}
zJs<-Ve0SadU+9$|U|1K73#>w>%(!EJ{QplMOidNBQHM{sKh*JsO;=CPDv7m^LoB7A
zfr)8n<Ehm@^yT2?-rq9m*@E_k^eFY2f$MvF%i2Hq7I>=PD0OVVyvDjdK`1UQ+i593
zsLLuZyTTL#vEkY8%XF?{twO)&W~JRR9n~qv5^|pK>5Y11xW+cEJ>ZG?`RtLgGFq|m
z=WVZ>v>g#{i2Jl4laK1^``r)`Z>x3vdeQdwme@5e8L=(bsUurgFUn2(uykdXrswk(
z*#MLpqk#9n8~<R@NNiA4F`D)$(}@pfe615BJBt6)oy`tIye6{MWo==G;wd|6xKMw;
zC&Dl|{K8X4larA?-IaItXF?jL3|l;`l57@@fLkOGlXdLUX=t$GTU;7u%vdG5UDw<A
zwbadV<C97ZWT7p4w}JNy7+wj452-ePtCzYJ9B6C4`lRj0WyA2S|5J0>%PhaaN|WQk
z2{G|@GWoHePObUt=hL(2m<?)H@h`BQEC6C!XL%Jt?DGTKu2xNB<4iGhGHClztBtYa
z!JcNF|K`F~8^YK2JF*Qgs)l1gzS?gH8F<mArorrYK~W*C=q7VOB6EkpV3mSdmDTya
zsK2K#gQLV(>)RhU!tCr?8!+^s*zE1Q!=rQ>a%)W3K;pY+J*CjZ28|ce2!~vR2wzAW
z%uTPcG<@CBeu(C?!_foC4r*+Lo5<QTo$VtVUHSOsOQ@*u!3Fs3Pr}Z=BM^I5x)Z<$
z?<7&y<Du;p(X?yfj9G}JsP84kg4rskuu7VMcmOs7$45wG0AvlT*P2*-c42d=HObSy
zEd@C?wq_$eFvO4zK!iDbly<&5qya36`qfJW;h&Q#0!zyKb5Ke6ArpeLKFnY(6r5WB
zAq`06t=aYDU-v!SMR*pmtEoIgAY!|bmA++W4N({MgP>yi+CHzXl(ni)tLQH3MBk{3
zMHq@o`dOemqL+~aWR<jtPdEI7#0h7N#JtEyE;hT()}hd$A>YHPbgtD;VUbnPDaZrE
z!<>uPiiRhOw?oGPm{u+=iw^9-H?c6c@kpg}>%u7oLxD<3!QH*k+o?sK(R8=n0+if9
z<<(-vKu{CM1t(MXS)fHBbz$dJySGlUEqKq7sx<Oy>XUj<xm7TvUEeN~?@Lf!Aq%V$
z%jS^-Hf2G!gJBF_DpocF-2>M=JVr!+cZB@z!J!eO0HIeDD~Ag4Ok@?FZ@we>jZle?
z(`WU(zh~QRNIm$gZ~ePju3tW;<+Z6;O;DfBZ(w%le~U=iOVoGL9L5z6wr#FM=VGeb
zdblQE%*KhNx>}Skv;&NWo#4t3wvF*F6TE>rqhWxgNzNY@)i$cfu+^)aqu#7Rdi@qJ
z!q;)Qhtql;lR(nH<tegbrLh>vLzZ2)ofotk{fc_R1Qa)2C}WSy9Dgg&iZptCrx@2G
zzs?9en=itGZK+4$yt+Dk8X6k?(7qq3l~3N=IERgRE3~FHFS+?MGY3*%Trr7R<T&Rt
zqs{hwwVx9OjIvxfQN{SDt4?VtSjoOOLI@16g}wHW`fKa4-k&eqKf0`>jkWz)N@>83
zmebMefw^#ZaJwZURpmFI21(X4(50i@@G9JC)$K_GjV8sPeNDW0k*$lexeYWL;qEBS
zKWH;;-UmwG(k&o4)fM~s6RM>*q)g75Oq?((r;}G7W#vn!RH2VdS@cX-`QC$cyb-4C
zGec_j7_f-1b0yADFF{LZygd@nXea9!*k^$NjpJKG$wE6aq)@4INm-=5+)orBt?;cs
z<Y66#m?Ejn>e)I8Q3!D9T!L8Ua`t^W6(}13Q7K~AZ$&mF)OED;Oe6{R*qda&(J`D@
zv188FYRg-#G2;p1Grp^wfONTo))B$@jpsO`bXHAPqjZHM-A$N5X5MM<A^_)S+>lve
z*`Y6&6qZ=u7@|ZyY5$=<^|pc`3Xrd9)AO8*at4j~)+43C;9O;R3+j1S3!m%fY`(3K
z9Nl{k`LI7hmzmQf_C-g#(dM07@L3O|fIGw*<Ku0o?D>#ZO7)-3c5_&RhPB>=HVDg2
zUv=?&t;2OW*mhhjs?1T?SiPy|-8~tklpTO3syZ>wl@YlZ2IrMTu~H9@#1=UDd95#(
zsoZRux~S$q)Y$-}85VCZ(XW7{EV#~_h)KtS(cQ~{@~_UlBbM@iP#0%WSC1oj1jdbx
z9I%0V#OJ!dLCdOJwx+1_4wt{<NT_|TdcUr>R^RW*mVY$}t;Lf66K0>)z1Xmvh&o_p
zWwyNj{U^LUd|+Xo$YV;?PqP?uoZWURZ}zs`I>K1ho;g>x(+(G$hx%-~*V%PTroY&l
zYl+L&@;0}&yBEM!e&KV##~_}G`&%xh&hFch{IH$`!PI8VO7`_)t(woC!iYh~-MRu^
zIY%p-EpCJ{Yj1b?)DrNCC?X+!icM^X)A4Y$b#p2H!G1+3v|{tP4Mkj*e*$77(YI&n
z?r$lPl7Ga5$kSun-uKPZeHN^f{Nhf|kgw5<LyS>jahhmmrb$t&r_-eOuA(SF?~UF@
zSZ}Ln_19h^;3pfK97gocr$4tI`tkxAa~jQ)HF!K!)BJ9`R1tk~&9CSstotgSM5-<A
zQJ49!X68P7V3%pOyxH4U60ZW=1vQC0HO{;iyh>6|9*SZj^{zIRev=kj^0V+HWFf|*
zxfRgAG<i)z>JC(C{1f^^V>t?Fg#8P!5#|Vwb%~d1QB5XK)z;g;X@;uXKry6s2^RDU
zf+<_HkMR%!KZN4ftW;0)z^~a-Mrk5w`Vu21q|Vi*o(qfNT$72Vy~{SGd@4N0ziqY=
z0k@Lg#{4#IaVH6xGw%oLuBxoa-s%y|S7B`$6h9?}zOPc3mS)&`^+4{p=JJ}QLe93C
z<iAzfKmII?eA*AbJHqI9b#!!mTzGjfvP$w1hCM>Rc+rrt83|%cmIcCW$|@hlVhG>$
z-p@8}JQI=6SM`Ei?Y5|$V?`Cj^tBMTzkGn3M>;+@0_co=<x|~E-|&||s&O@N-j0s<
zk&A+jZ`K3mO4RQ0^p5`e#roG1M__VK`AlLbk0O!rjgkJ$9rfZl-({c;3kPk!l(gJG
zNgDge@!zzNLDyXg(da7%v1-gt`QvL{WtGF4uY1U%!=Awv5Yer|5x#hFrkY^C1Fwf@
zyM;<gV~AK(?B_05i#K1<jf_<`B^MhKQH9lq(SKJ>1b^pZTD0e?P+OUFi*z^WR=9Sh
z@R+(+SL^5E=5*M&?-rI!6X%zlXyo^y_DjIV1~PEt<eLMxhcI->&bE$M#IxYHt6yx3
zKOnRZP1YWaxR1D<3t(F+p=bhHe_z{Yfw@Vm0V))QbBWq@XK&ATdG-B}LXGP49&f1b
zkRP^eb(nnouk@bD7s{P~CoPI_#)BigwXqRwI&VuWCKD`^_onOYF7Q?d-*)v=9(Zs7
z19eccG4;TnIoVo+7JLRD+-*G`UfU1Yl}CZXmdivgekB$}PHumHQLJwura9Ecsv5HO
zaYidL<QGyVws&E-M$oJ<RGHZ1yL*Oain^NyK|f^-wMA=irBCH>(MBt43D{KU-eO9r
zcBY-wLkh^={X_Sh+W%5sSoUV;O(TkDcQD38jFUW8`2^C)453fm>uLexl@rU3^27In
zz+E#psL)r-Xq&}zB*m;sE@kYbH*7`glC<`OYB9D&7EmgY%b&Z)w_BdIu-Xf0)zMhk
zt9O<BrABD#u+r;qA!r}vA4LTv=lHNExu&Dru%Ae%{tRfIz42><VH{=yO8OpEJE_rT
z3*0k&!DecuhuAy{3_r$58kO_eZUqh965vYxf+RsxUdyF5f^QP$=S<@k)F0}*?PnYs
zy;D%of9Tk~A1E7{w2_}&(nq^Rh~<<m1Zef^DaW^fsE&r}$XnUh$D0Bw35t|JQ_tIi
zm0D$kQ4KVger3JJq^(<-8Ic#HbqqWPJNS&vtXMMg;-si^ua?Oo?zxygd|YkE=Mu8)
zo^lC>ZT(AG)(U`1eqPg0VMm)&j8rjgt`+a_=B<7o;v{qCZB0|0q!c8rCn95E3r70*
z!D|)m%avIMJEhdbRiKBYEU%?b;86LJ>zX!hn(DS$cLX)R>8h{*0gh4x$bSs)&|1QR
zn089gwCiZZTV0LOrpAtTv|jZp5b-nC;rWdsJlYB$^Ej$(LU)f#3yk{xzUI*N$FZ}w
zangRV(Vkq?pi{a|GI&HQD<{8z^kDFZCYGL)@d;jWl=-x-OZBZYrLZEmbGzv);Y{T2
zqeob4Lbvs|2{gxnNktHLSi81hI!8b0IBa8b)H>XW2oC1B|JRB~*v+Ht*Du7EEr~~z
zbq#l#XW{P!Z|+t)pY)nrS}xMgIl{B^Xxd9J$tu6tDa;P)n-iE6MD_y3#0i3ElHe2!
z0)Jf1F^dsJs9q5;MyuS32*}&dHeyOX@>oA<R(7__f<4w5T)bWQ3=9pY9_x-ju?~lv
zn49-Zz29?MOV?=Do_{q_oc;*ic^>(wgmkI40K}v{<b21e)&upHS6Nt|GkL7r{lv@O
z1`hVEC%b4$Gq!IIk7Tvk{spJhY1x832CLRd0IjLM?#r<!YkcMgNEiicL7Q^cWP<mm
zSRU8<5$dB!#REd`{jl%LcliuBZtbP>-6-%u!T=hLi?=hsZ9!P}*C7!yyl2{+>o*O8
z%EY9Ut);LdrcSwO3y7?4Ga*Syo+OaNrp100L!#;9Wt|(vEiiCcTo&n1`r=EieHP4N
z%1)=Rk3XoLw$;cLVYTa@)ks+&2Akc)8@`JdUDz?5CIXTV<k$=i#JD)-X7d>kg@UJJ
zH)TD^Qx}~9Mjdb_0j*ZHAi2#g*#nu0d`~_DbI_++GUKLY&QDOB*9*frr|*8>@C1`k
z^Yr)+$q6^nczB)_9vSymm_IxjD5@l5MK3|)zDyxSRuY#zVM)ztU{%dBJrV*2x6g{Z
z#5RETBX_}R>_qbcKJ=Z3*{M*UQAYWbF<I?pS5d!5l9sB=5>ejhR}a!Pe;J)%zh9U-
z#MpG)jPP%<$#d+QBNttCe4tiU>ys7N;N9W~aGLc{&k|awMzLT!!pV)zv3_j`Q}IrS
zs#YvptD1?EOfbUwsWD;C*BQR(^=*wo+nURT$k4}j>u9cW9pae6Q@CB~*Rpkfrt`oW
zN%dF>_I{i-Z6&Sa0@op+Ck~hqsNF^bA4@IX)hoYbP0F47N0GHs%onpE7bP-qyk}M~
zC`j*rG53~HaedvoXK;6i0KpU7g1dVlBzU2P1rLQ=a49q-xCR1A(88(03k~jW!Be<9
zUH|v=7-x*z=RMu`_Wf`_RgJZ)zRW%M+G{;?&FAOUvc3&hWCH2v8#PFf6CJMhJzyp2
z&6aJIAU<qia~HWm+AWh;hitZ)oblVw#w~v#y%no}t^Y|4%i<bux-F)LFAxT6^?<Y!
zva7AMiDkwVZw}^PyxZ+PW*s2%DzXDI;&k=Eh&+x~q&LaGcFM@#nII3$^W^r&ohVf4
zy$P$&6>|;!wLziNO49|aWfJqe<2_tzPRQB0sn+}HeA7VILSXop-H@97x%yk<1S1<y
zNl`^w&O&2uv^kJ4)qv?Aei4<~u^s$3^y8^M<f4cuWEFvOr?Il@8I34CjnGw(D>a>{
z^|X(vodq9dF18%l75$K|vEWx5&P_UV@~rDxA5DqZ5U7Hs%CKNxg}DZyTEI3*u_0+V
zY0JFP(m9RR=(^gKklm>Fb`i-i&iQkFvT=R%^w56hR81VxY*|G_L@yyMbhUM&e__5~
z&fUAw!kLxTn=M+O7%BWvxki)M>Pg;^+3c5@n(#Ra<xi1~6u`@nf^#85C28ZPDEf!%
z!&DGZ(d9`ipvsZUaaU0|X-vwAOhL~eBRnk2RYrQkME*7lJRYj^L;Va^rr~!+Vn4a%
zFgYDoUcTetXQ6>Hpg#9HQA7j&f%6L?jYF;nxok60g%|2qzj<GSYX%p$)fBr0T_dv|
z0!&T3clUn;@>+hfYzRi-aJI<!eTfWP;B6_hc4_G4cYWTyENQ&!Q2xnrh){Abpa-n#
z`}r!dtr0Fa3L`2$IK!t3eSKnSvu-Eb6g{ymAD<G{&TIo;;Wp||t~iy&<kHTjJ6iX3
z#c-Tvarn9R`*X2(@XKDrErTGpU5mdjmh#b}?<9`>WDo67W7}ZQVw8-L7rZG5LHPmt
z9+-yTl3<XeK@=XBhXcB&n!h?OsE#9gDnhs^7$aVs7q3V1X%-ZXrq!S#E&s{r;r>$6
zU*mWyaNrdfVx~*cw_(obxGqqYez}$J_GqS0>w{Oti{(tMn5_hE9tS3rQFaTUpV2V)
zvs<qzZvy18oifg@Pg%l--{rkdkR|qPf_fx=gYzAgG<=$F-k~xGsrA0*G~XUO3qt=@
zNJ##!;ePx-*8=bB_pELBFwH#b22SUwQF6VhgIC6vkp2Z?p`S0Aq{OH{U90AfeR;0P
zkXbp<*(m0FMGyGFz8@<azd7g}LrNDGNLny)0S_s%A%1toHh5F&skNA$@}-Y~Q-5xk
z5=WYT(lgZtzbb7hwMq5x`f-Ja`kiRU(-_*1Tf|Ao;}x!X8EC?Z$HJ{`&)VxXyE6{6
z=<*#(`&}qat$O)oe7JuxWANZ3-@^F@b#MrokNG4T&k=TID?(`le0IIe9KClNeur{9
zJlU@`7eyo;-c%jH<*!csL6GI7yprmO;d$Q^PMexjJd2dOB<8M)=?$z$3N7d`w8D3G
zDLMeFq0nkdWBc%BWea0((|e57RzAP_dcR`)XfS3W1MOPug`M{7vV%lA@A>8Bdha9u
zJA6|;52okhjL_rTLy~(7iS6rR45m&2YBrXdzyn?=2@K*mF#BUHY271?>aR+CHU2xM
z>kj&JVM^u~TTEY->Wubs<3kTAoA_>JcV|p>eI1F+r@Ys!<0VJF5PtUC>nd5M8lN<a
z8urMfW<df}ooK%*X^maIw?1nq+TA_u`nfAd?zNlz=agP}Uy?L*NRDbhU>qe?IYIXR
z5o^lJ+iG#!WsFwaA<&=n3QWhpbdM`JSv!9F$fSToZ2@0f&L2G>P5-R2h_VRY{Whtk
zrw6zk-`x5Dq48>7#=<sGT#__n%+wOH;6l}L1N~2{<;NRUBCWx5U3BYIdF-iXCQ19}
z4x3ZwBSJ`p`M-i^-6O3eF*dLQ-jkAV{-`&K$rqhl{ro!0{<^gHjV&~Ifjau?_j{o#
zI-E)_y#wLIvAzS3owf31{C$e;#0xI^s&g?jJq?rJL+PH2rX)2Djri7gruKnLmoq33
zes1d#;CzY?D}LE*wV^M58HDYWo#O3IW36qqK8oMnFR$I1;W~&*aKzx&L!imbNLuL0
zs@+?wjnl6}cN|UJs>+T2hY8_in+G4-%dftT3y0Mvt^P4P*K<5l#;}GN+y7hAczZ_F
z`RngJ_xk#&k)&UXx=(lTRdfZu_@z-#i<gLd?1ZJf$2ZV;8<m)mq1)!UubOEOq-ftj
zXSY5RZ$ma>#(Hpup4irjAGL~Amcygct0kj8P;-1tO4yLUHP3MD+3(J+qo<kqx#t(b
zU=uDff{rkT4`>e>SHGn}<I^6OF^-KR;t`O>$PNk{N}&;vX!t5alWCkpHzPSIC^Tvg
zgO~x!ahFn9r-xMg>^CF?ZF<yP>mgPwy8-6E1W)qB5+^7StqxnWpAPbeYfrk30#H-E
zp3na@EflC#$@{>4Av0Ko$MxN#3qf$c=#sPMjExT)meBMS0Y)hJw~luuq=t?RsvxRK
zb9Ktrr`M$fIBA56<ojYr&Gl-WNA{Pf=MzBASSPPRgp`~Y;u?Vbu>Y!A<k&N_GV=N+
z+;I{fP2?9Bosp4|`Tgnq8X*jjWr*wi+&S<5D#K#%H5QVzSdhVOAHzOK^AFMG#~|~z
z)@<KD)?`iNx9CXqE%d|!6RDxWk=|Rn=LVR{A-U_ws?k5c7py?`#{3&MF70_?-^Y9L
z4+D-*1M-Pa^Ji32`NVMWk|A*otC}JbBcH+l$8SU^*!6jHGxf&ai^tnjP{JZ;_x&Ey
zf<K)!OJ2neLr?+P3xgEC=a3yV$TpcKG?nwI7J216evZb@ABt9v8?u?lxc{%vnx|$h
zDwq$j^P?h9cRI#hz^l%~JF|(xd<mos7`FErQH}QPA5_o(5p0?#<XyYFI@+*!C<}>v
ze7tdyonJj#z0VF261p1Ya$RZ?5W2YeQC{BNexLqCYHnVBuscfEjybs{#W(2^C7x?n
z|K#b?qLg5_8ha*~YnSX;hpLxdTEZUuuGAJ<E>|*uFDPvnt2<w+1*X|PpY2}N>aUyA
zxFg;{cCCbJ1<cc7=Nk0&S$%P=3Qhc;12(_2g$~xeubO;h_2-&2#QaZUdInwzLREqF
z2mT0<LO|6_T&YV!5!thaMA{I??&JSwr_)F`B@?Mhl=$Zmd?elGpXQ)1$3n>|fCwZc
zor$Ft+x`#u-(Y&4JloCj@$tKlg0Cb;2-tp=m8~Bh?pB|UGR?U?T|GUno`t5%QfQfy
zl98R{KTd`y*s&u{?ssDIS3#M?UTq+|+fqE`GJ%!o@Hen_H6)hU?p2_Hi=?8Y2Y2@5
z?yDA97VhBnl3=Ee&_C#+Z-W^IHq$eyEyjI2Ad`|oTwvDFT6vEM;u$kv%R@OY*Fu@=
z2)yXmVN%_kQlII)_De>gtG+s;5@c_5UU$L!gzMC#X1%P^R(~?@@@uqjHr6C$WT8!P
z<GTAkFGDxl-jcEKF~@C0)qlx@3W1ai9y8&+H<{tn!<WRRZ7VO`Opj92ohdrjZueRd
zyq*8i)IwB}X&5K?XT%Cu(N<Ki6moJSjv9hb<EPw@Jv6p@92dd~^zQ9bYACwtp_n3&
zBy!b0voQclSCwq#bJU|oPK8guN!FJ|1<!x7Z$9!%qM?CM#0S1qn03d~xT~w(%)<!E
z&!xnam6g4|y<J!LV>x=Yp#>@`A?kVWA{1^Ol6Q<-7ZC;?*tI-p1i_oKS0$3}k^9)9
z@j{p&77|N6=fjqr-T~aSCsrSgm7NPS+*)Rg{bW+s8(J;467bbl-8I;Yq^Bb2EtBQ7
z5w?muv()GO)xG7r9RlA2{LB|G|5b0jYgfwV^<Fk6QcasSk0s;KS)2H-DdgF{Vi|&E
zP}_HX*K8@}>T2MB^KkPA>DMO4g0F3nkrM1b5mT%i(w#H%t@+h+ZER)dUd2bi@N&`h
zhdoTt@aVwrjmx}cu|^K!quc$av=(|~OY(E+K^HVNST6WLX2o~548ET6%<PqSG1#)T
zcaquXMGnIPHv>oH+T#0AV9}>GALHZs8nhrx1Gun7qj*11T8t#NxDL-94AnB#DyrDU
z3=9lPu^2to`Mdr&?FJEg<aKMPk(8oll1%F8*2?&a6V1EaQ8I^bg!y}IgFa?Lr@m;o
z;ypMb7iEsrhj0dG!b8ybYEKL&delnsTHF;n#Nvg0eA)%hVwl_C=$CGwO22YbwR2om
zb!5f|xUECxi7w#m?_^~nJvrX4x3gh;-;Rj5%I`-?EvYYp%Z1djV`McK7j@m)Q7m{o
zRkH^YFXND)_3NTvPQW~Np~r0X$w{B`F3!e^mWmJS(=5lQu?k6vGldUTCX^^;!!g|v
z@2I1*)TpFAYKvpt0v>cp^UQQ2E&7=p2#R|!2}ZgxSYB|W6x~`~7gHc90BLtW9VQ%7
zT6hReQacM<fl%gIp71Qkx|x{s1cYy}QmZ$yI+H1}_ZoXeQDl~I)&97j^W|LBEeb_u
zCCT-n#zu)|DTBhfcSv`hA9g}kok2xc&lg=^^oSxCOX{q3URH+IsAEfuoR%lbBH3TH
zg#Vzm{#B&97`28PeVhuvK@;+nCDr$aj+xY5CQeAZDw{fC^={*~?jk;fk2r@dNXeJc
zT4saZQPHX1?P8sGEL}dgq8ar~Jy(a3xVRiBIjP3uCw^;hr8lq&kz#kLdn06Gy4dMG
zyEub8nNc$>>@Tq}Hea>w+1gX;@yC{a^-1`ky}ly#=*ce(>lS(7YeBg^l@8(<Pu853
zZQ8j|A`~9Ehf_BZ_)rw&D+Ijh2SHqW!izo#*Zb7w7B&B*@keT6dr^0V^m~e)J1<Jg
zC4@!lZQ@DN)THD^gY<1!;=S#roYhR~$?2C_TI3(xeYi{(?i_A%aL5Q|GnV6fqu5(U
zv{>Obp}Ci{(+e@TGp;7Hn6-b=434A-awCT_JjlJgyr`K;jVjnd=Vg{me~?(|vo{CF
z&!VvW$5!X#XAaHd|Hf0h@P!7Pd+o+k&T;!s%}iNGU^|txTUq!}EoA*I6hKt_j4IFV
zy1BChx#(wOZlgwwCwtIeuykNZm!q`JhuxN{dTbFqRPeA1PtP0+lb6c}O_tTpdG1kE
zHOvrR9n*ehs%Kajmp>;I|CO7)7_gffukVBhU058`H4IN2@%|BW5BPdTobi}5lHEXa
zsABt`fJ0hHXn5G=$Il-M2(WO@tHVt@9ib`I{2$rW4sP-RHUz(DO&kEPNpj-#O+{(5
zCC79x7!v3omLk3`OGZpdD!JBU1|1~4EGuV&E34>~%CCL)qAotODM2V22<A=I<|V;@
zaC0eYdvd&EMFk8K>>fCD!LDALy~voSEp9(rtf7tI^IAux+@S1$NhJ|O5S)W2Z4Hs=
zK%JMsumU-9%&7J+dvC+`VyP`c9$wSZ21{++@V!1gJw0xJoPEm5%*HdQwh^y4D%{|s
z{|}Up0q-Ma*({7{H}D1tI9GifAQqb<7lREa&~X^Rw^H@w^A(S!)_3{0p5K|J9eW)q
z`F0M83Xa3mhq5ZrWMKK#7)H=QDkLbQpY$_oDYJqfpJzM~JU}#)#gyVt-jxk>2SX=K
z>~JrfiA3uAm=s+3b{Qnekjw7<LRv({yu0o@mSdF~Le1x`sAN<VlyY;Vu{G$NKfbt+
zb^<1r_Iz3wB}w0w^?vzSYj6j#%^25FV2eAO*!`KoRAB1<`OlkhhZc$?N*+Xcab&=p
zaas&1BAi~FN3!OsXhkrgj0wRnH;M}LES#%^pAMJuD-%`H2Mb7Le$cBT_?t!NJLVek
z{YK_+nqVVi6c=R5VL9E%va5i>UZH&~u8%88({)|urtaD2?&9-8V&GF;3Aoi{pGQ1;
z@jcouck`z^0@~XLy9nM@xlwLOvpxSl-vBvL*ACLrjeGH#yw)W9QrS%iY3upY7)VMH
zsRo`?Jcrk&$@?1^@tb(#j4r79cFq=5%5~iMnCaW&wE&^tX863$RRHajT#XD7iMYM7
zp{D%BrDwF|k!}+%KTK*o$_v7Ump=h#DS+sz&3hB6OyH9_wGcANcsOJA#vjRd%M0MN
zHu>|bX)Bw1+ui8Jlkg*RYBitHBO|cu!nPsu9AExQ&(9){<9P9~+MWDi?gx+--Abp+
zsLetq4KGUHO^wkL{n8weaXv8^Dmo}sM3T?5xknoW){g|f+r=CTN(rCh;87C%*s`AZ
z;mSoO5#5`Ct3A4=$+Ya*v!`=)CHZ$>_dhSMPukfaX+E!0W*vXWtOjimHw@D~U(87$
zTyvxzIw0~Wo5uy&F_oo`4}E%VYJ@5&WZ*}yY*j<`hL3;#2G<@O5VI779q+-qjCX3A
z8MEh8ezlE0ys{JB2xrXZjc@z|8{QXP>~EGNz5TB09G=z&WvnMn$`+;$_9K_9Y(smu
z6$87-YZ$lDw<NXj$$wJG8@o7XS0$ZmP>nt*&>>iKr+F*5s{6{RZI8BS!|e=bE7qn;
z$*mg}%!RAtD$jv%so+z5>x!ivZ>cZ%AiZC7yx<>pK*{0b{70d|Z_isRsSNTb<cR@Z
zB2bKuzBb)i;k)!r5mAQMWFn)cQbvWMx|-Zv+Y#i4-RlS=d-r>K?BuHafigEu9bZ_c
zcbc|u4nU7#e_Wif1*6GkYK4Pxag1VlISV0KJlVf!=zLbYFOutZCo$@$Ry(I_Tz}B!
zuYrQ8-t1K~#i6G$+fl?q>#<hU-wFQZ>vNlpge%xB+unI8!2-j1i;x~r#=o%1xU+m>
z0;g~X9q6S<tE@f_J(JD%rH-e)-<I@Qfq&eY=wZbsWa*73A2bRHnzfU1(O+L#Iru?4
zX7%GWkt$dM@<`OKI{1S|T(#@xmokN;JEx|1;;8Q@^_75>@N&n#8tvGYZpxN>Bwxh?
zwJ(t#zCwT4@A6l%co8#Wz+q-}KKvU4fvb}LA8UECI_>6|HZ$~TOR^<6U*`wf?q6={
zcqN*V9DP1ajltN`TRzoCBLVnNF)#U%j-kit{DA$oFOk+Aa|mH?+53gCR!(wl3NEeh
zrKKAokE2hq?N4{@ea)Ub&oLU?-2-b%5a%O&m3!aX+0AWjnfcx6mK(wD*J~*ItL==&
zZ;aY1<$W3WK;_%yLm+{@#8dO=AS^=5)iyM-y9nX2g~Wp$qY*yK9u3uB`Ni6av*V_K
z=Zg3O;oE<FlCvxS#rlzrO}=ieOM3TQ(vMJtw9~Hy+|We)7n42&=~$YK8%d4mTeyJv
z61KC@8MvcmG*9OuJ5Whi6PJb+HEl4$h_=Q(%Te=awlWTf`=Sb{i;Iib#>Q=^nR8oG
z$zwE=aK~oe$E_g}n(CJ6S?U7g@^nx<>;<eoz&{ULseN~OOH^EF1&q(G?95D2RGPGH
zthe^+Rx~eDUU|-D-&oj`K9n(y&(|2#^gQ($8bw>ugdc55uNs%i+MfW@$r%;FX1B42
zThfsf14!3CI8{=2MYJ8sO{&cMR@-#Z##ohjTd2|FpPF6mv#haO+6Vb?LYt$5FP9Wr
zH^hUjuCA`O5<)!v@Rw#%Ir5~laW1(2^VN0b%YFr4wP#&uh8qvWbQ%d-=@5#_SK`GM
zo^I4%vUn-9Ya8)Kulx&)zV~czwT;nw@&A;BFdt*nx~Z=J{G5`PNAe(o1V5>?;xe>b
z#J8%)&M7WIa{-CaK2_r8EBs$sD>j*<OuMQJkU2gK2~O74RYZdSLSI!E2vSYd4qv~|
zwDJmOwM#8}tG=22)%Ez~q%(@mqA<i67o}2YKrdlrK#$}2cm}6@aX)EfhLqKAT7LCQ
zB;$<V@d2O>fG?ukUHZ95$8q&V3Wr;6x1fb84$D6sRlfEf>|OeASP+NCf=sO$4s8jh
z2`cektx8?35(fBNh}tY(>92{FF1?pvH-Wc)1e!B$+i)lDCpanRe8L7+BiTJI%`e^}
zU<dbWz#y3?iZ*@lT`u0L_vEjm<1nrM)?EV2Ad%tMhVE58YGm3-!W1<UQ#a>Xiacg7
zmc@7kFEZdtguzZ1>Zg+5Biq%Y8k49VgKbFZM+Gu|SwrRQfPQlrTFD)ava*r0t(2VN
zn_X_Eq=z!lL~RZW8~<;Nt~fq^1Pdv;J~=QIBBa?+kkaM?m*n`0LD-J1pYOX#oGP2|
zzP~>gB~p){Z3~J5>;PPWS34=mQ|o0%2Az|WWZAQipO$2#|I9+Iza&1a>!7YAh`m*e
zZ;(;^J!!C_v*uYc$hAl4kH^=+krTg_KsI-_hKA{MxM8G2=2FH2|C4wo>dNH3j7z=S
zsNzN_?{$f6M+$hZ&BJ$Gte61cEfa7S+0erk0@&?h#t{dX5)O+y8r96uGce>Colej0
z(oC-{PA~eV-Cci`m6J{t3CrY7P)R~q(T(%}2=gc=luVNDObu$&O@)}&%A{3^D(z4N
zRFKoV@%|agmRU;jRwSS)(yJ$w1f<I=-r<?G<e{&qv`@!Va=w!Jc?2IkgTyTO&}QzP
zG~EVci+Z~#Xdm&Phcm7r8)4}qIXpJs)8TYtC;C-oz6QW)Uo#toL~1iI9M83o@XBKq
zFnGm8{)eIQKhsmW_vg&`r&EhZJi@W?uMe%pW-xDpryJQPdvnBD)zd}$_FyniC+64S
z^WE{G9G1B<e}l5V;3EtDdvX`(Z?~hJ%$<71!?liB)=i%*eiJ{eKJeTkv2@@hp5OYE
z_*+BXZ99ji7if)6s#eY+iJJky25uK@X~k`@^$o5nO8PVi!e!_cz&JZvSfiCQR1|ij
zL}%?er^aUD9M>wBZ{T|)b}Ba_1c-=TXWkDPduC(GK&fnJ{njEnS%|H;HR$>;WBbO=
zsqhHi3<M`<Zasm7Q;#xtG4gl=V+rJ!!#=4DZTDbVd_wPPLAA`u=?z|eeO~^If#Fnj
z_d+6`fSh^Dl>o$3b?h>ytd%N`dv>|w(lenTBBwmsR@V7(vL`Fb8Gulpb;9RLb5k4;
zkKVI(V^~>^Q&n3C%6lfcd`0AIB=o7IFZ!eyfOTg?bU)Hoa_5ZhYMOezh;ihF@~+<|
z_O0@ya+aANndqvI{HkH%rw8Ei`GL`f559=WtnD7}9FOAhk~cYtD~O<+G6(lWA$uW0
zG25^pX(T+ea%_kb|BHD~>Vgb4CKoYTE8Z;UUGtux_ZD+&F`55mlsrFx#3@~&$md**
z$Y;J|)ly29A~Gi{c*?Gn>A?>Tbk1!=mxTf@B;o=TSs{y6LQDyCP5Wf9<W;GND`Qpn
zhHA8`i3a9&TWZF<{GO*1o$yetS)#Z-jmulFOk}Tzoi^2cae<9r;C%QdF?9?@=|<R1
zLS<!ZtXN@*Qx=0eCtjIiW=Bc;UBL4Zm(uJuoN+_Wn@g%9R9}~o9WBETOtrRW+Eiek
z%ESr#Hy#p?Py4wTa_@{+d*`QI8eu-|2fmF<fJU$BdKe6bhCzlW4}rnxBzF&W<n{ER
zba_YjqeGntUvk|q$5KakrrRTC)aZvo?afz9o~0(Lh5XJ$mrB(dFPkD{Y8{>{kodo*
z`INdJX{t86d%@eEbk$jR0L@HGPoU|)I>z5c+G+n{T%-m@Q-QzZ{oHjczmv%k(b}Ps
zSa#`J@q*YY?kN~>`)9juBM$S0s8ftPCU`4uPMa}$vA-<?BXM?RZ4b23gwJr##zL-z
zm!X4woi}eqO6n)HUu2U9K0DxX(S7HR0T?2Df%wG{AVYPj#=u_h8i7~tAV{_}R^urP
z)P<byW4G5yEythJ?)}zEl(W#3WRHC1APJ-i@!4${L4Q=I>6!4F_Yu9sEIlT;|AtU;
zzD(rG%Lf;r7Qn&j^GTxV16%VK>|!K&Q6mH}miFprDI95C8DD4KuRa)k<Rrye@8dsE
zLvMH1O}ZsW&dDT15?pu31MxrdNqn<~H>g?Fc%_1RBrNYAiHnu<dd_os`-cZR<3knQ
zdDzrB0Q)RKA^HulleaL^?Fe)BMTlpP4wUrsTY<7w>^g>e`d54E4o_}W-KF+jo{bnf
z=;rdplbGdR;2ztZdLsmRX#BZSor^fN`cHLHdUGjSUxwkuj2Gabqf#ouUWxQUQH|NU
ziWt~#WG7e$;^P%dJ@>;F0_y2yv;4ZJi*By1@-|*HN^3c)sjQI?L%|du{b8T$^q3jh
zf>KlSr{-ckn$a4$Itxq=T5Suu$*B6pKr3>*nfm5*eq9~<ce<=Jr1-R?1#`j^!Zc}B
z==a#|!q8x5eZAu#yEjuPPO#_B)IKZ|z0Ef@P<|M%1my`(@h^WNn>4E4?{>BoID-eh
z!TedfC$qryN@gON@Sw>wtPS&mCy1d!@yaoMZ;V0KxgT8vAEoe4y`}bbkhbo1yZjqh
zkyt~KRfAodlk0_YGbKsq&SpHCeS{tSgDzF^SfR*eNg^*!ci&1$t?L$}SGr-*-Na;V
zoJA67wf!&#Eg^LakdyXX=~ZNf&&GhZ<4<UxdWOSMySElkXWv*&QeYcgX*n~N1=FPF
zP@|7>Qcum&B6X#kQj;otr8@4U+B#FFSI99I+%DrSBA_R#VgPGHZee7}Ue5eH7Y8u{
zW}>6a$8J$892`?{sH|R^m;hTf90KZ3)eXJzYps^Q`_^nI@Q+U5TE+fJMiYA6I$M7Z
zjK&~5>4&a`y$l|ruU>5?Jfq@Kq+Rs)E;o))YS8|!1hZO^;xf~jb$NT&aJ0rqp#Q~-
z<WjHBt%cZ>=<kYv@zI0@>(>yXH0;>6Pm`UX@B32R#&zW9^tQd%mU+|Gto%i|vM?&+
zI;)-D^^6^5bLQCf#Ok`7q(Lnehax3COiCk@j-F+P@t@-NGACF%<Xb&fgY&w<k{ny8
z+qFAhi7`8L6{`ce{Xpf^pn0-j599qE5QVB4%Y1KUwAQ8cNMp5}ks0Qy(IlUrWlt~J
z%a=pZ!<Q6BEg!J*f4p-ZTSyS&6CyOAOsn>kh(5z{M$?Ilifk5leqe?y^X62ff{U`#
z;9MeTBUmCfmD6_U&^!ext{CpiO1p<NMQ8YE=el<G^)u}!{Q%<B?v-YhrY>m>pZkze
zK|J)n8iGp`u_61>-uX|OE!2r_^YK7-K5-fx{yYetvGc~N>k^%@@=v3dd*an<N5zuR
zb6%{O4r^Zes0_UJ{<1)P!!9=2j8Va8PY2?}fIR!i<WFDIYHy5ciWbx1ffu~Kc?*e~
z!Uou{#^-#qTAhZ~x}X=T^D6mqiU?8Wyde6cR7qlZ9CN1nsD>wAMBjI&2?V*_a8~q~
zkpa4Mk$JNfqwM7yvSM@GYWt+&-kA+vHJhvE{nfBtCn#!@b0fNHc-4zcbwgNU5yWxj
z`F;(-=0*$Y2A|D}u%?-YTBzh*P?m9J$26+}`99*vtRBU1erFQXZ{^`-%ZP>ik2{Zy
z%uKjY2Z47X#C@e5ha|m<iAjXiG*RrtI_6j`bk7dYBajZjD8zsz>b!%txACXa`s|xu
zMk7$PlCArz5pF~SbxZ&gKu=Ha{ub=*?ft!Xe4K=VfdOfgN+7#*dAaBY@9&SXaLBFP
zdwG}hdt@CRebP<#=2+VQ-0cQY)z0rc$6x2VOe_0zFVyz*7$Eg<KIwbdywd~{aa+lG
zdJeSEjH<1zHRt{<y2S=yV_Q2{;Wnz4Ln0+}FJ@&w+K<P@F`Yxd`V3<k^o%w>qvUdE
zirs%JC+gk6WHLX|6}e9tV=kh!IN4I>IRWt<F}uv_ZE)(cCOqOi$m3%I(4;RxwhO?n
z-u~Y02W<yxMFLQTCgB)qQ>E?KAw#zGPMzj&V#Lp=SfsfWXW{;JHMTK@&NxjV8e$)T
zXX$UNItMuZ^eTe=)xH6-=RbQCfdHyp#!=M2)8yFAA`EKqQ!Y3Q58nHaXs`hq@c`_l
z`stM!EozPSJBgo3!Y^~7-vX`<k%#gEn2RDr4QdG9<Auz6;{oY-<f-t!hiEpsE{o+#
zg5;Gx>}>~<^ov+_YSVeRqS)d8)xQs1hI;pQk&)cfr>*x^EXNSM3g+-a{<U5X=CP{A
z9#|pD#K}vZEd}DcjOrJ04|QglWnNsvh@yis)g+j^Z(!!f=)w+mWgU6$T9kMJE|OY6
z!~nR%9X`v<^^B*6nYcer4qQ%*zF_@gcgH+$LU~eVEV5^B!BH4%I#(_q<}}N@zoI?6
zyA)Yr+DNGw{eob=#m`efxIWBsqc@?)d9He$eOF7p6Y7PCGlqG)2(X3<I^0u0K1~0z
zMq0QU55-Y%UH2^pN#6!S9#6LhA<pxH+{QJ<)DqeHn1IF41qe==`(t>E>TjVdP3UjQ
znia}^|Lo)ok-`H9MWD2Hzl4dqz9B+j-!`;79iv8v9T>!&>~nen2S@cw7`;GPD9p5?
z8Xu9?jIg=xFVm%X@h~BbL(6S&jN3_T%qjZ)zm8pUO51-;sf>$rR-CqOf_zAEsY8YL
zX~IyDVXT&GAX&XPx^bC8omb&Wc9}B)(lyC7gd#6BQ_e^6CcEq-M_T0?#yM!Y2XQ~~
zFCEwS<02!5jb6h%#>|Bt+CYtc+nins8fTK1xSJjwty((1xZvsS>x)+0=t4I)H}4r^
z{f4^W$?ops!`C}JoUrltuSq-@tSL~3rM|Yg`40ael2lAg%-w-6M-E06cX^KE?CcyT
z?sI4+U_YA26E*UIRVQBt5a09-v;9}^Kxz-U1x2_#)m<q9GtK@B=+)k5uWGrO_K5NT
zjG7fTV6LXa-88ZBENM+1MZZK^@&y+Y;(chjA&yJcgeT`7ClfOL!0WxglpDs8k!V7l
z?=4eq_$L$)xdtYu6qg~?dCUss20i3R1LZs>G6HMJ&{Qfn6e34pl=CWl$u8%}n6&@<
z9J&}5T~+JZbJd;ja@zZ*m_a}%V%;v8rT;7NW7T)A1wQPp5Z!ZcdP1dJ^kYZ~o0lj+
zRb-CunQ~MsKsV-7Emm>{;N^j%!pwMBOIM(nQg`R{C2Jh3{vFU9uXCw+`(A7CYxbKL
zlIc<2U#3QlV?N48X4K_K9@@eQDgVcu00Ov@|4mBNr}5HW`!=SymCp(+8TAASQ-XPo
zT$)a{Ap{yrZB`qv<r+>VFsdA%l^B)y)jOcQUP|_&JGc<i>-JwrxG@;pgVzvbHMQvt
zrXZ8&0Fy`YUs;1po)lyhcad>L#%vrJvsTLaUcP^mH(Yza7AB?(Izx_$@NE{;?-$Z+
zhbxK)of;{=Y21;wFdFw!ybY<58G@~hKS&a+hc9?hotM(pC02%K9vtIs>i@WNP45Z|
z3>FBXb$>(J2g|}7I}7Fo()&G}-GOL-zp49HS^z#eI|ARDu8yN_vKI~)Y@L7WLRuZ?
z7k|N=-=QL3Prku6>wk8dNxW5)SOR%xJm1`3nzx;s1D8y0bK^DH_j3>zt$Nk~-g)r~
z_RO)c)Jy*!XuHJ!3Aue|Wj{FHUUhox5#nDg%P-I3y&rARldzUw)?#$*kOWNS_j)wD
ziK<#^v{j~0Iu3o{e0uJ`G87M537NWR2{2A7fsATvsBfSl+-Cb~koWF3oqr#|^B+mv
z4>fp!Fj1JPMK$gttqEoWwsI!_-;-<rFCen{Ra1tRzT~^aIbP}nP2=0hw-Ii~S;qv|
zQFoxvY=0W<Ugm!bGgv?E5ix>z7d|#z%HR$##im_zzQc!FTaA8)f%$f@Tzf+CSb-ST
z4Z_NVi)*tc!^(tTaVl7f!P0H6W>jVa1$TG?%}#E`o4c5kh>_b@+$%pE;X4-j6pH5Z
zguMjM!QTRxVXv~d(|&8H8M?|;DVdAa2~5IdIUB?7&Da2#{UX7k>rqw82G2}@$}f^B
zLMe@zu<Lr{#zq0^h8M||*XR;ByN4{PygpR+<+&2Xun{r1bQpU>a}cUeLZ9FwH7nb#
zRsRP`J5qsNQB|Km6Jv+aGU9W$0!i*H%l2oIiXYwAe~6dt6ZKMD0UX4$M)pS(lNf5R
zC8A=*+OV^itGYZNl&<Z*7px8`-UpwJZzONGqqwM6*pB)U&~xnSl+#YRkUuqfzq2qK
zz#!y#jycMTT+o{6CMPDs9kXJYhjte+UhP*_kOeSvDk3SH8+-+Qa|FkW;&dGFx5OJw
zB#TQM$@?|WTkQ_)^Svn!w7emIwR_cM0Lr}F+@jV^d$_@N;!ePGn$~0=PW1(^J&DLR
zJH+*BKh!wYgGri-29ihZ;E@sZ6T9x9_ES*E4fSL*)#o|YvQBB@%p3qWV9(Hu|3iiJ
zX)4<I>L2t|AshaFUxI)~h4=$e;`#k%j@S2Cr3!yY8r;}*l-X7ql5FX@lP~y~5ayxf
zJ~+lZq&1Zk{ZQl-SS~jMi72<gF|NYJmwaFF&zl;VMB;`3fhV(9J9`@5a#dcz_ud;J
zS=CQ=h2s_n5T`-A_~$OYJ%8plx2ugBNk&kDGpt1z=?qQ&_{vE=<<OsLL0l)<>naV2
zgb{<+lsq>N>Cdk$#}^X#^Q9PyknQh(E<~JJG(uzdoSn_;@tx=$4jiUj1W`3-SA7eO
zKYn2;8RmBx*Wk{Qq~J{-m^+2ICt`@W8b#xzLDh{yDkrHI4Y+&GnOq>CD;#u}Ozg(8
zdFMrq?p+dgBLO!`XWlKV`Q#BbJGY8N<BRa0J#V?Qg(y@NK4+|L+Wh9$bY5zrWGQh0
zS_n`bI6Z+~vKuY$V<3T_XA}qftj<v{1C`SSJW^Rw`DRE@bd2mnP#Po~S-@`93Q#Ds
z&Jh%0XUfbXnr|U!9X78pB$}US!xY;;Fx)$(M+R}7)`-umCAd*;rWRG>01W8qWLQI}
z2f5i<#9~{^G{L>`&1aAg7<c!>4gJF-9eiFUHb^@+>eoPF!8sUTrZWyc+aU4(!h5B%
zSW`V+q;X+#tHqDAOY=r$CL~&5e;)RB^lP}l$6qu<c0)=VtDq`6MQFkr<DKY~x}h}$
zG~7Fmx33N8)*F)k0lOd1s0_MRg%2TC6W>&^)VOeK-=&5@wpEi4nrS)scFtx~JX}Ck
z1Zc3&yIbFk`M542$?EFFn7p1_(IjrkmG|#J)D3YJsh_qLeZD2Ps`JK4gK?sZtXkb!
zCF)%WE`zCiD-gA_Y(hgBu5oGb^cQd!j2U0n8dn~LvJ&=vFF`8A40m5L$;LX#TA~2>
z&51P7Z+{q3(4d&C9q=3f5~RISAsHa_6i1e&vxKtPgSI~0oy;J5G#A!tMWl$uUU}Xt
zHV{BZnG25SBm7*6nj>-)m7-r_{d>ys$CIheC8jtX!Y;l$ipO*urZ396xdpFtw7I-Z
zj@$>A@*|9{UG9u#I#G?ENNWy}3#0U8FJ2~uNoctfj`1iikY2O@_G|LRFS(hrhz7$w
z@uQ!h@8+;D{-oB7x=DH}-rbV0CP3vV68-L^LC26<$y<9<bLOuf!G9)ZHIunV;_hzk
zV>Z;Uq9e~F(fB;!+mL&_c~N%eoOh?(*kJb;9q6FEuX7GALTIO>1x*CWx`*R-*)G2n
zv#<(T+9wKBfay3_3_1wjytJ^O`&?OM2bi}j)0`Xu&&i5lLDpBqg6?1ZojMv6{qtmk
zznK(JNgIaeOh>RJLvKF&k@$m4BAmoHFdgJ<Eix0ohj)pI-bWQLCp?U5^d(vcP*P1d
z-xSF7%wFfPFGRLc8HEf+nDCQ7j@YIay^pWjN9@)QDj0TUlXUc+*GReCIxA_p8zVj~
z5>z32h?y>T+oNKwF)GrOoD%I9?jYhPah@4@nX9cw4WV*cs)8hl64~3=`1tSJ7p7K9
zQH#39PnEx8EoCq8n6>TKNepj?(>$N6C%wQLk+(8ur){7~WNv`mx-nu^k+T8*o0ZgK
zhgv$A%xuY(58y4*AhG^&Ts^%AjqD{B8{kXMIdD@CCyiMF`gYl%Q{7FqHhS;UgkVN<
zwpfS$rmt*=+wB#g2zI%}NZ<)PbnmXdf*L~-GeX32ma!us)2P?LXL}4~)xDato68Gt
zcTmxwe=m{t>IDIZ`-7!cRz3%q>rh@mU3AQV{#|C^GALhrjv{N|3IrHHlW3re{7R+*
zG2}@LV;wT{C;iDgcro!l#$Z@GB|kkpo_l#+d+@NmD5)oyy!!6cc;jkUIIqfQBd;=*
ze}21DB0ES&<t65jY}BA@HiRSjVaRwV>4Q!cVBSH}`PE&El+yF;Xd5e><FTW?I2kLH
z^kS(;T3ZQA%+IJqoqv5<)7xW*vo|;c^tjV1@i+wTl)C@t()uQ^a)~u$|B~0QQRw^2
zWi-V`gvhVUVTpfceveX`z<FCZD|#skM<yuOez33P{8d|`wJtG?Lx{A<V0U|7!fE~r
zbC2|-(LC1Q>j~qa{Nti9jn%E<9aXscx%C)u!fKg5%Y83v<+~A-_R1uDe@xNHiV>c!
zZQ8hV=Kb1vC7&;#+Q(f1DwPRR&a3NstmeKvd-Vxy&pMMpG4a}r1K{k5m`eDn!yS<B
zVREHOy;%R6OW-rFzo=o1W`m{&Hz(HK3SBh^H^Kb6YW1XK8Xo0v<&yP%T6VG1@^xiX
zhK5b^N0Q(Ue2yZ02oT5ztRAj<!AEzHxk~|%ireCa^jlAOeemb&h9m&gX3sC7gE-?T
zI-;v!cME&m^uf&ios`fL9u*G{r!oJRxF2gtI^w2SjMdZsn?<al*WT%+Ey6c|sed(n
z(7^JOY?y+=+R;W&<RBkEaWG2g@d?4FB#u-*BED;1zcVL#sL;*n715{YY@L?-Fw{)v
zW^3D36|wz&0((Ou-)3<k<Fikx=1navOU>?nzW$xd)5?4RLU%8aWle8)MV5x4F{w)}
zA&R<$qNj8<?gQ2v1u1|+INRE_Nd`T>oVhhW<|SQ!Fjc7)T`Jh=P;#B2PiZqw(pwVY
z?^EBS@TiwIt=|XtEj(mi_!2tom1<TRP~Q7XQFW~JiB+bQ#S2z-@nJ}eyu+WHL|+BJ
zqnAwP+}b-8G+rIwde*yc=75ST#B1&R6g=n68$nd%zEc0(ur`jE5k$@rR%N{&F-|RN
zi}o=??mGs3FJz2-6Y`iZV=K+5^2ftL921`!KY(3zd&8c&^i%7L;z-MFO3{et4Ph4F
zTv6XM3-ywrVG;JOb%yiL2cnUQEa)W<=Xt)mCCZ7I!(Y}-j-MmO-(6*tq=(-eCnXC>
zy60WUN_&5tL_N1bn3tSD=V|7|2GJE&___;+orv>u!CocoYNK{Z01vpxEV%K&#uy6^
z_@LPjHGF{pD9kiRlsjS6RI&l3k$WU=CWN8FOc|<i73qTc_nmSe+8&tS$}(igtcld+
z@!R}(?eUwkfqRm^=?&ukV#IE-LCof&Gp(IYX3R+m*;<DPdK~=nhFaDGm;L<1C=nlR
z<HYa?1ISL)G^s-Jg9NJCmF2bCf@Lj#z&8P{-XwcE!Q6FE6t6zOs;;sFTuP>hWvHT@
z|3iyF<-|o3F4<Vs&I_&lW_*C@)%wJR{R2ath@iry&0IVN_M!~VA;=fPPnSm4XWjL~
z!##c&ep(2)S?`(DjJ7KIj?s%xmozpNcq#RhdZLJEXsCj}#=~<{aPPy(8^g!fHY2<p
zDQDs@)rjQ#m{OC$@8V5E62S)M$ZhvkQ~a{0{aLG##2#n&Ujcf7kM~MiIhOH1oo$8(
z1{Dp=_<IusdyUB0Bhn{tGWpAPGOWTNINL5V;K0j6d!?iG`(x|d>1Xk;MSA;jO0YGD
zlx{IZL3CoMc3{II$0JC2OwF<C#^X!i#8#s%`O@bvAjcG!dsH}q1-SfK9a4yS!G+3G
zqd@Ec4lT$J_?pJ+9WeccLCoJy2x__yWZsHt%nxQ{QAv=88!WGP%9K6~j#|eLsB!17
z5E#rPiopiZEkyn%ScOB^qkHKsrGmvCo!u}+eclKM9pPP$Qv`hoiEw41TA$h;*oAb{
z_N5baXHDw3dwX_fw-ZKPEQs%pxxK`^Z~&uuv)YuN+{xPTe>W9+?&%)9_PtDs%(|73
zOk3OPm;KCrcG5fUENO;5<_V*AN~U3#SBYjr8;uy}P+M%>Pmv`Xme$ta>`}=IvpMQS
zB6^p96T3y(lG{dDM$c00n|>H!t@y-f(z1;6#yYS9-$NmlsYZsfADY3xZy8!1j#2Z-
zh96)E{<kamf63%u^J+h<&jO11DHQGZRf1hH*)K%KSB)>pH-RhHSgCoDEc%iH!{f@%
z<;)<>#=^fc6Y4_bCXqzK_H@6Da*2v}uBg`MS_%X4pD8=nLC0oi335so&r@_Xx6_Nq
z^7m5Hvx!Q-viA@1buoke`t9ksq^stV9gDt?lB{y&Dzk{#Nub4y9Fov^=(sXGwRv8g
zd2c~>NazG)B~@#+R#^^iOLhtpGK-UB>>yRyUeR=o|Dh>0$=$&|GcAr`)Fc4F&P7!H
zBK|xz2^N-3>rN>YpD2w<uz|`2$_Ch|E&{~oo>jjmwl;$CL$sC>SD!whS%g?z3+>(h
ze0+9&<GZo>dprX=hysxHCCO_u7pwh9Ov&Kc-CU76=JqJ>3(M)e3eowL9xeH|<({rZ
zx^-;3m2qwVZz5YOt@REKRnCG0{X-gKBp6K4_EU%<QL@D9GBNe~p`tO9n!Zl}v3$LI
zr0)K)x({+e#_xzgxu0<*f4*OJbnte<EC1V(Jb(b<hFH(#>EySLPv8AOV=_L$>~D;D
z1f-qpk+A>?Gu_S;kM{`HefzFF(}!wIMHYqJn*9$t)qk_a|H}fnlE@;c7pCK3^41<i
zR@gc-Y7)|uU0O_bB`iRY56knsqHg_-3jcc~tFPY&XJ@ez+ME-YHzcj{!>LkvIRXu<
z81L1gX^CA+;g!3mop{H`<7%_)Wbx)csOG$-C+)Jmo_n_!Usu<^r&RVxXMl3Oc+z<7
z?WyATPWhlSP6PoyqQVcC9OyT99fN}eU{S`X)^M`h>7NN`gY4G(f8o{o0noz$U@H$&
z>|{bXE6hxz8owcndMH<(8ILH>#xdr@1LkV=-y%g$>#l0#bMY^QB-yJ<ZUz=n?ulbO
ziwgv3_WL7s5+j9~s)%w!j2d&cx>k+RpT%Vn{UYypqUg$ydL2^UTgL^`RUySZ?qrv4
z)cL4#<pu$yFja@V_}@yNNFD3n&Q9+cC%0Uk5>hM8jhfG>(<`f19&xlEAMxm;b=DCL
zAxOEPH2o@kT2D1+*&$xfDG|Q7Mc#I8gP&f>XkIyd1*-Qw;u3@L&o4;PuLe!hls4)p
zSFz0mzG!{u?74<s2sc$P+Fw?}^Sz!_a<}O%wWFyH-dHVn>KoNsi?1TsA~e-!AHd~}
zNXZka2y6F4O<o}WQ4CRyRmo~x*@3OdY!hTc*o2mYasH=d!P3u_q|A%D_0+EA$fbD&
zQUm7tC+q%0DMkjZ2DuPIhH(rzQZLtFg$xl=9{oop-9(N+<r*N!k#nSATBY1@f`=~}
z$Ww!gl!;M8%dzYFapenmFvEfm-vgj^_IwlTJ&b=ZRCPbeww&AZ``_Ij*HTGK%?WDL
ztRHsD{2ehrKL_nFN@w_v%lZ2>w7EjDse<##?sorhkC=nPxL`cU537&c`<vGtIju(X
zEC`p-@<tqE3$mI@q=cT8>{TcC|2L70E4~k2bgMs9AYKir%NaP1y4j7p7QEC7b$WM7
za21;%EPjYu0cg?c7ct?9RL&IJeBLQKS2wtm0`JpZ_D3s$m@=I>VxK4R=3!q*_{HE|
z^&SEwAvSj+Vwh%s$nw&f1ZwZ@mvXLI{d}PR2+se@5uH|t?(X+|dM11Gg~WeK3ecGJ
znU@Xl|NV*a8~x5D`s!IgAlZc`MSg7>d{Bx-x>KJzs!%ell28A7qa#D*;F_7>GgV>2
zyTIZA#~0GM)@H@V(F*X5KJUFA*@^GrzUQ?QJ6lwLXY8LEEyU<E_pP!MD4VhX{d~qA
zfVR_hm@V#p)$XH*IUPsGmWIUYr?dGZ6`vct<z6!>Ul~K6fc0*Yeg%|}c+Ansf*@p>
zeB=CKr>4&Vtz?jRJTv*`R{q=v=7EgTe_fyW?;cjKRNm0fm6C&!M=eF|@9UW*%%TkH
z>aYg{mDo*D73WE*<I*UR9}dczU}P~%U?2I|Bw^I>vg1o4Cm-ZXIRwY}3K!U_*)M?<
z4Jzbj>X8mv7&VD(zz2<f|MxEt?-dry&L3LtPY17bpc5OFOcPGB>_?Z~-!-Ae8*b^}
z$T{$ro_Dx4-c}LZxlz&v&0-r0)mVyyp5<q)Z=Q?H{b2}?_)(kDFi!F_rGa0zAiHP9
zw?nshr)0fdA|#wWl;5Q)8#o#S*Fx{H@AN2RGtg#?9J_x0f{j{nhf&2KM^=T~6X*o!
zUM1*dmPusKZem#Aw{fQ2NDkp{xf<zQ%N0&CVpe&x8rG5n!l$*?aIyl`UTXcqU9Yv0
zLgg)8|Ga^@kEhlVT-#RQXhl`$6k#LaCl=yPdCxLZaB=*)={a4Doj&1-5K$j!FP4@4
ztxmSxn%3NFvC3@xBvy9WN7Hfd1sOANlHAjL04R0S7Sn3R)eZQ)^hLIMiYuDkM7<ZM
zcN01j=Phcv-H0+fjE|)k15U-DqL4v<t1a6R$3lM~sjX!4#}@RLpH{qFEdtadR@Ddf
zWWttg#t#T1(@mxiPq8yiP9seU4%f;|-m>21YhQOBv&{iWp*{}ywEs70A@EPd3MoYY
zKUbJ{tzRpjMMOpY#U>Q-)k+MJd-g<4N{SnDdBVPTdZB1puu89)4vXf<&j$m+u9LIH
zTQwR~^sb;}jdZj-Gpt+?#Fm32T2Nz_=JK_3rgLso#c=Z-FW_A0dM7`Gn1Uj5cXwB#
zFA|Tc_)1lE@`@|^kw<VOUzU$eQ1CQONvWFZEzbJ-dLt`0x0c39gO!|`TE7dnUA`s)
zeN~QsvCUOkS2y`fM~B=i;ppXx<EyK5>n3`qaaXuWclM8L%f*X|v9|SzZwDxfb*%-;
zizFtlyLf2b*&>SFbYg$w4wqpz4L4HP7!k`b>3^hNjS!lGFWL6RRH;Q!mz?+)!<#=~
zsy^^IZPRM6JHn~5Nuo%aPU`mY^eU%Xhhu`&qF(4h=V`OuTtGKX176=L%^v*>K747~
z6yk+2sB@f(tMF2m5$Ci~BJ<B7jb4`wzpf}ka92C+hzL8*q#qU1u9|W9Dyy$&$k?+P
z48QK(XJP8M{MfX@MWSfP*jM0}$WJ3p;Wuze4at4X#c>e7;Gd*tk6*s4uF{XG3=!#^
zaWSoSTz(6pX(Vb!S+sP7EAh``33>aS?J;JIeCs)$zQ4Ti(S}L`ybVEyc^Av#6kNI1
z)oykcN_Lb2R=>kN7IoAJmf~K!8qUE=%;rWJ!`7zET0s<63gICTt4S4P<(4o+G;bK4
zkLu2FsH=g8Zv2O%1(1B(MlGDOpQm5he^;j5z4=!$g0df|`687kRI9G;pKoM5Jc9G2
zOKy9(wZ;T2EG+bV!Jk@17(}Il$;w->8l6!V&-AYMFZw)YMxVAn%hVEA1x;X~$cUyN
zRN%fRFNsda(lVKb%VY8RHZ2y-S23O)9n7XlukV-8&AzAI`w03NrQRMT=KK4QeedIn
zB;D)PeY5~}fDT96#?PHBcxS`;#FqO9zPmh`KF91_-}?kc%aFtKps&2RE}k<pGe$Ka
z+wa!XSp>V&u&Q&&@2&~kGJeZ3;ys(K&Y^kAAEs3@Aq?{yadEcur_=84r<RLAvGmI0
z{s2}$r1(Hn^1I)7=Jr_D{WF%qle$oR`{FCJ*SG_>G+R_W%XmmSlddLRTcE>R`@Q&c
zM=Oq#2cq^*i5-!~d|{=*rxm%H>5wOL=vMr>WPHzTY*#hCyxPff=z$D$kT$_(A?+xX
zZdQu}Ae}wV`jcD0Uf?4hAnheRng3Pi&lq62&>>D)eZ$L`+GcfVuMf)}sumWZ-IMKr
zW)CjH5_pIBUUp2%UeSOtoUMF18+@u095bp5)ln`z-a7x3Yjp4&Z8a#(y;a3CXv@lB
zQAVyrw1ggCK}Sc1FzZ~!ENyP`eT)~2*AwO?kl)l1T&CkR-!2roXT%is`a|?oSQui0
zqK2x>tm@Ss6a#sG|MO1wD`|qY8qlu*(EXWp$desQocfo$!~x%y0q!;qr|d2M`=h&j
z$U!k$K>G7f@?L+fJL^`cg+VVFUi(waf@or8=xO08>gge$h}awNsM=={C`1kW8`WeL
zupvduWURlBmyDDN2T`|xK0%bT(9%W6sizauDMpD@^$ZR(LhfESc$%f<qAb7jqmCH8
zNmyw-Ll;#@yj=d9eE4QUDKYtOv@zhX^{|zyma91<UWH1bF?i&<;ewUd{EjNVv%{}U
zx75l9-);7pi>k@mQs`ITKYA>IXEs>>7iDi57UkB44J$}Vi3mfdf>J{%IiNIBN+S&-
zC@LUB!=O^qC0!B&(kU^-5YkeEq`=TH(w#GWH`~4U^SsaT{dnJhbLh<-Yh7_(=M}3~
ze8TE+P3|!+uU}l%tM0I`otl;6J^sd$WZiWw*|GS6U*GJk+`JF^v<w?NlSvIbOJN<S
z<nhPLy}pj0RTKLrsO@&wA_c#hwC1ewa+%gAHjI3jt`iw=?7++LHDl~`WA5laV>9Jw
z!dadNWDCzOfIhC6yHf>4rhb+&Gcs&^!3h+?1kHn{cVBeyIZGdoTN9Hb*?df%dTbw1
zDn8~heR?ul=YWrK>thU(;R+RUnYF9_96rODuzS{c^o(5?zsy|tCW7=)nF}aFu^yHk
z6;qt@LqOtObh3IQIJ}bRHw7mAr>Oz26#Gpdgqs4=GBi4FHGpCx>;yZi#+5Cf2m7R%
zIe`4wq;GqIogAD~eDP3_afbc{qpL;75OH;C<b>bZmoW=oz6?l$n!(`ENn*qNZP}@b
z5>ujer>gcWKbX3~`w^YMcaO*<5I0;wmC*^aAL)bI#yM5#%C^a<^YKz;%dbP!53>bD
zSlZ6q6f=@i#s{jd7_k$TPu`(DStliDl+1|aRoR;k=X^v`W(v8Q`4VBY`jX9OFcWU~
zE0bE%)h>v>H*&k&z~e+>Tne3tl~SJ5W+0CrcoelE0F)EaR9lW6(-o7`4oB;Kj+|N-
z{lWB$h`BS7Q$#8S5+9h4_4+avb+R7dK%u?2Cj|HMT||W)P<58|NolH%@kez7<vYfB
zNk9SK<u9NBuj0;EVhqpB@WHCJq2qS~m}~v^8z~*}46De-BhprRzoG5uAR*TUqgoLs
z&xzHS;{ibndtw>>;l6?|T#CX+hpQLXBaDt4_sFhImNYYFkSRNUl1lelXJ4=0Yp!~L
z&N?Y-Ts_*mC>!V}CpRl3;k6eNcgVoY=DzT+?|dokuuo^w2zi>KI!$E@rW<jm?UzYM
z2$`0=C8ONO9=nL9G!Re-P`G0;wsVV^4}=+wf$|T6EceHI#b0dsM`Xx^mZuENCAhJ4
z%;+4_&8+%}veq-@x%G9nm13_Saqg8|q|j?22U!l!;%9x|aL*1dO9-BBQ;JJXE`Scl
z*+TgZ$5-4Me!aQsd43@COw%wJ(yKAPf-N;fn7ppeTpmVS?sbf~uLVC7cR&B>6Dttn
z`dU}<VJ317@b(`f(_)HsjJ~v~yZrt+hpt@TsSnuoE?yCY{bZXVsBpOzM}p(6f3uka
zo%W~@wCcK5WL$rpc3EowC=OD7b!A*C=DuOJ?b0J#81kIRZS6y%{~VjT{Bu7cf<Ql^
z;B!N%aWl=JrS+xtx|go*8|fu$U4$>LKlc;))<tM{z3Sr~`AZzzE&Tn-f4iu^4VN%L
zO<a1f>TAF+E1=HuG64zXA$jBwP%lJ3Cx`TB^ooZk{wtZb#avT+I-e&*RO~HZkGh7%
zK}=*9?;moR4m1n>mQE0;|8fIbgk_4)co&r6dxfL*<DBzbk8&u)d_n&B?6mpC^xcL@
z`>W4<PI;P+;Q}ysoD-kqazDKA#W4N$?m@djX(O2dEBO3J&RSw2YZL64glTto4rOEC
z7#<wYed@i>@L+N%QxU|sb|lqNViK9x^oo>ntj+y2EpQv^(t(Kf{nC<(JwBLLP7IUC
zoS~+)Tzd%;mlzi|^1Nyr!PgwiO6ivnMC8r<U=L!N=k_dXxzgc_Wu=nfDH2%=#Xi@i
z{?$LRu-*~uUV4Uieq^M<H{pgyk#|&CnmsZ6Eg*P-IwM<SZFF_=n@BaQ1WXyFxbR`J
zdc@TJ8&3c(4T(D~gkf4JT;_6i+M-jK!p$IFm@U2ho_su%%hu%zX99{898U`@?Q@i3
z!d0HE(Co)AGROW}{Qun-;98+u0Fd~5Z~l+}{ug8X<9W;xqw_<aIw$Ylr+skZHBQ1T
z9&^mzXD4Is>%|#27#PA3kuvyFT)HsahvVHj<sF+d_T$6pJj(^pdmY}+xt#=b`wDAQ
zg!!o<$NMb|LvCzIXV~^8xA|-wH*0IpLc}prIc$5W#(ZJ8#=IjHUqBtfmHon6Bn{el
zdefw_@#$83(9Vz+zSG+aIl2+=XzUrXIa?{R`5j;wOWs5voJ>m&MXP&=sYlcNLx<U2
z&)B{9PeAU!qm|3hE#$tiQ$Cq9#Qp02&0q#_Q^0_XH+e?2Xuz+lq|!SrS7dT~pZdBx
zl`cJ$KAit`yn7+jnY}ggfjYK?RTa@cx$uL~x?$LZWt6c-xi10TqP*3Bm#vIkLFp~@
zna`~{;+2kh-^%bg^cD1+lVXz9JB65v-aS9tLayYMI*gZna6szu@2w1sp|wwde~eCe
zN7dEvu?Foa?_2s<uOFY+G%yAzb^LeZ7EvzDm-|<7C+g2m{;ey|v*7K3Ze7NS|A)E!
z`>Ow34_v6oW&H7s-?U~y-&UG_MhkxxyN{2-?%RqDUGcoIm>fP}Ko7&2pKM`NSs^a?
zE98VI((e;Wo2RPUC+tdn6QKeEn&aPmm{~l|?~8lZwM<~xUNxOaHJG^gt-08OL+)`h
z9UFy-eljEbiX8b&<t>Pvs6>6(-;X9lg<d_FyvO;SK5YLfaY82a4i|hIeKpNzG+&3i
z0e8A)Ql-23W;LwiEDmJuO{GYm@Fa>Be+`myg06l%5)mUH_b%fGUq~(gpO3-}_Kn<$
z<-giZ6Ta8eXKk*Ge0|q+{THw1qx4M}un65fKjfay9e5x<L%aVG`+t}1?`7z@Z3<t?
ztppvQme#g{E%B9ihP%|f4zq3uY}}i9Hpde$AZ9?uI!?-1{HE@?gjAYbhNaHi#OS7q
zAHyTHsv=C1@9;K$ed|mxhXpfBZF-L@+7M%5n4>2&a!5a*l2!)^b&&TZ8ub!$n&Su&
z7FgIDKn}_lXzS_Rfv;H^*5XDFYD<#*)#!opD1|N>Etue`14(VukJk23{(fMTHh6g8
zk#s>UZ`ykr%$=}Ob3Ri7$w$M)bkmg2vmT)j)ITR$V79U=X;rIt4>FX47(nEe&(RNW
zzSweIj?F<;-DpR}8GOQ#|87ZXtUTIvl^c+W_YU-APyvrpWhvG;AM_HaJgVtViIT_b
zP*5x4&fyJxE8=fwBcht!83&#IbZL<Rp!o-0{;>p)Tw(-1+$h=oEYMP%8}?Nl1!t}*
zRrFu>K};|F)TrphY{`G$F3*6Ss$Qs^1p1d3H00-@+gW|jGtCi4Cz!m+yXs>bOE*z^
z$jz<Ov72!P$x`tp>xKP^Zq-$LPzlQ@*t?$(!e3h0(n=nPb}WAI5pq9#0K4cmN)xgj
zwOfY*&E79L2i>~vDsZptcH(IjJsNw9wVbNQ&tP)V?$kWT6{+D?$4Wt`kwWq{gf2sH
zum;uB_uoW1zt|o{Z#O*7@V&Z0sIFN5f$Q8^K_%w8uz=<H;HIFtD5JdF@7$^~Gch6v
z;@~@vy&D^tiF{nC+C2fZtMk!fDqG5voZio#{-k!Xio!ZiUD2&qXB$$*kcM#WWLUc*
z6aCvm>`<W2z-^xuNo@3E>bkRz(3|rcVHprg4I+mn*<oiXP^NLD*|-Di_odfzZCr`M
z4Wv`khjZWC)w!N{l$i^D>NdO{sBRpT^|8SU!!Vgee_?jd`7C1ord#*kEyUq!;LctR
zTgqXS4cwyN|LN*a2Qu%{91hm}RVi!63kHz)z!$fplEiOTV${{Ib2>b&O={k*3OR~e
z-4uzs<v}68T%?5FG%Y(XBdWOlM-Alv|7`o;oBiM0e(91wL-pF|F_&ecNMf1X&<@!l
z%XXlIoRdo_^}-ZKFYPXPA;mucjBT<&<*1&*dzeor(4`QQTfZ^67b6SSb^cJQN9hj)
zMMQ>6;o3CL%BUr0cWzqa<S(7qNcqfP79)>FqctKXzpgPgy{<>mMNh0pP8NySJr-gN
z#SPZedhRDtEOuCQaS%0md%Bh~E@LDuB?w_d2sc}xQssE@Yg2u0tEy}h)YEoS&4peg
zmt|}^lVs!PGl_?8!K}&pR>u)+heR;?M^6)|ZZ3vCctf-UF}8ZAtF;ze%S1((VoF-J
z4ZSTORnp-(aP5{2p;a@FZ<FTuD3!@|EpZQaj@viZxDNuS+nH)h82a-N7N-HU@`<+s
zSp7!sC1>G@TL`g~do-_JB=6az)M2AaGQwpzEr2td*OpgMn;3@C2C8@g(-3$sZMM&t
z(0ZltkWH62?5hy(Z_#B|lE8(EmQVNY%4x!=Bt?I>jSi`TOtULA&~@i^s4PvZaARo`
z3d05OFS43%Q-VA?KSq1wn7B%u9=+A1?fAA9c7Fak-;wHX<n+IG{$K3;7y7y+6aV%O
zss{Hz3v@s9oE!yu90HEezO1GQ=v-xOf~{SoduN1I6S96_K=vZ6(d+1U0*_k+t870}
z6?&k^tdTHNhC+-O^r1mqre6*Id$}K|IVo?O5)m_dwxU0W`lctg;H4Uyy-7ce4`ZJr
zCMTC)JTbhLOJF_a$=X!X*ZN3IBO=-T1h2Y3>HSRF<c>X9vWSH=W%e%aglZ^ZoI$82
zHF~D%BwPfwV($7LGa1|U{GCWRgy`&DJL-O(*cncsGh1+!ic`#Mu44EV7vES^#_A_0
z<J4m~NKURTI>>u}UG!#ocRn$siP#H2<|L;C8rOq&h>Vx7;TW<fqGfWN$G7nFlaG!w
zXwE65&p2CaKHfw?^llqP6P5Qs=C}aeYoMoQf7aiYPoG8=pAdG)8P6^&MwA44ZCO3c
zc*f<bVDj{8h4b!EwiD<uZWxM+qYAC|TW0Sv7khv5PW!=&!{7e1U20unl0kE8Y0*Dq
zB8*=SG{GKlx%~dVvK4dLO9ZqgTzYE2k^kk6|Jjv4A<kc6&tJjL-`@K(6heoBlfQ8b
z1%W$wOB+7+r#YmmoW9*X7&Au;UR%(Vx7A18@hFg6b@P>_ycg22KTm2>Mg|Y15IbB)
zrMtyF9{ItnW-t*G+7IDw89osGjYWOpx1HP4k3HdxDC}g9QXLyoExw`p%lYkXu4ivQ
zYy`hCbX9Oud3PXcEnX|0<%LyZ>l1l9l8pBCgiBCNNX|DGc#MCW!8?mU;7J$=zDB*P
zO`VPmE_^9aLV9dFb+xJKfi8;?=(V8RFOqd*2^yaoLOgoQ)i;Qn0<L-6oda*`pvA1y
z%(zSgM~htxCKtyJrCuSrZ|$TB>+zO#A{zPzpOUaaZT%xGZC+YS=D(gllpU9lw0wr{
z7+=WnZwR|fmeEL`cUasi+qk-(B^}0MjYm}POlSExPZ?y{m2n}A;gKuCT3ySDeZItQ
z(Q9bZ*ZVQsRxkr@rebh$>SBbctf-L<rSi$!DYqb6(fGb8@}P`P7B4|~H`=K$60+i%
z3PF%m9-ggrLf<T!yRAr5Gs*Z+RCb2Tah!S9s}s)8N=OymXAPKROazLAT0Y&W?y^DI
zOcl`VUjGdJ3!VKNu>NNc-GMzkaPtT#VXn0s;=soAG+sYI^NBD}#PY%KuJ90&qs-?N
z;5|z+f91`o86$p|G}byE6XVJotd2|i9FuSx2(OZixv!+;S+++N7psIrYg;dlhK0$S
z#}vhC(+N@b^7t#H2N?>L!^6UgVs<h_3mva*)fDL<HYqrv>GgdR1l^=VY)Q7tk<H3#
zL^sOY+={KS#32;ww{joIcOB55aGso2(jR1`45VkXfrF+K+GJ5|o`<EemyI+)U<TwL
z{)0vTM|S_UEq|o=3F^Q?&A?*?D3&=j<~icocRL2U4(5Bo$a(MMIc4{Qk+F~j<ng@P
z&q4z&Wc6b`wWS1s`1Q~33X00?M@oD5blzz%WH!oSPk4iWNS0_(SrTLG9SDL)Hfm)Q
zzxPEcOjE=Z7VY0&e38cy+Z`=l^)*g_UasmbK|-N1Tfbog&EL@F@_qkzGyZw=|J6UB
z=sTu_Q#nHSD|A}b?usN<vp^dU52|d$Bfsk4*3UFeXBStH!NYEP#PN^8{a1g79>=r)
zFIu`}WdC0j9Z*>qw>j*<rA~FszO=Ce?$<#S4-&pgz3U=|$F;cj_L_Q^fd@%qR4Iy>
zj(imd1on=zUtECR8QTn>>M5cF^xFRBG-IKDF$%2b4fyQR&v#8fgPXp>s4Kev8^--Z
z75^`3O!xOk{BMN!PZ;=Di2k2=(c-SDs6d`e${{gv$XyU7Yr}G}E84rYUnx9AADsM|
z<@5+`zv?yFWKDTC9bixk9nz)zX;5<=J00UV{Wh(K?q<n1`!T@3DF5}Uj}Z|pkPwiW
z`&EaAoxpj4ObHhrMh7IedLP$AwqbdXbiXoT+MK>N0sX6xQ2OG0Z+nOIgZV?lI+X;K
zXP#UjiDcQwPFrjf9Orm)C)avuXgozmOU-4msPN2gBiXZc5v=xz>OeZA{6!xFR(mNp
zrsQ{=wrYaP`nPM>0+j9*&;wzb#1sSzkJKaj*p?;anktk)KCwWfYIm#%T^*;VS^=xF
zf*n-CRBAsZ_8J@*yPn+Uhu}Lo1&5qH)GUDsw_PV|G>U?2q&zq^*5hvUJSh0ws`wP8
z*Qm{f;o-saN}!=Izj&f}pI!7EFCBJDe}1~=fa)wH6%E8-@-hPR+`jDZggjp<!MgAD
z)y(!Ps2m<QzCTR<`gKY}g%D`ND>5%Y&<j~z8!a}@GcWM|`_9_=u*^#6gCdjnwuw>F
z#2&x%^N#6iduSQX<g6|1_`*US>yb1@XKrBT6%pwwBV^%o#Xm0pG%IKA>VR)J13UM<
z>&izCEpwd8`$zg)gSELmcg;S(9L~i!<bT!04L;8oee<cOF%(!XnmeYHj;lW^C1o$J
zJa6A6ErekY{B+U>AV;aV_@1;tfwHMGOZjsEPAtiB9uhuu64|fJv@h1L9%Qc@Ep{;=
z%72yrcrWlCroike>fnkk(249Q>80YvJ`&bzH{C!b%c}~1_x!R;c`~SnF4-%1ISkdG
z<We)WB~kPC{+7Pc$`q=<5uWB&SheRsulfG*o)bv~vsA}KtrMpi?8FAEg`6J-f=Qr%
zO#!L<P0ra-FV~~?amYWfKI3!t=8ItYu~os-M<s^U-gUUAaXnGF8Y%ict?=PB)sI!w
zNi+NvNvjU`>0ha8yNX%q$9#^{`|(}jt4$i29<TLn3t8+wbw+7v*50%mddIisf#}xE
zV5a<mTAbLvl*3eQIV}H`0$@gfM-qvOI@Y^{cC@#)AGt2I&$WZn$4Yl*{kbBGe|Q}i
z6&LReDYNdhwZz>?lX6>b<&4dfQdAw=fEQ|}NpA1&Dw}v`;cA`;)s0l|cCz|zlf?4c
z3z#DO&0!~sNL`n#oI+3Fa{Ocfg|lPc4U(f2)kT<lZC!k$<b-t!_4xq_Co{#&HXh9^
zfP3QDA0v2_5Dh+fb8Dci3;rpYBd=0AQ>O)BtH!{3C4=-KaXySly-Pj3i}8H8*RfWb
zeRpA30~MF>?kc}=_0Q6SS$~16x->6_a`8&Y0Qr%ChvqWT%Xo`l7z>m-sX<#_ozAGm
z0$II1H66X`D90hjgaW!drX#$M5iHGvq*K4)v|=QnM;wRU%B-tn-eq#&+Bd(dN5J`0
z0>HaP0_}N_<k{HeAIU=2gvbXkJ#I@&r}kbqm8#;)?A6NuZ2tGFT^X)*qBaTMR+=L4
zz4uFuuMPPA1AAG+O!{iu{?vT)f+-;(p%xtW>_F{EEbbXXddkUSAf54h?-PVc+D7@_
z?8{ogi3*5w2)gEFZ_{J2sZ7%&ViHJXP7Y8>C{6`#I_BsIXYA~}6K|WVndaH))qpwr
zq7C~;VaOVvL^4ZNCmNV}1b}J`SwvotWo7lRjls5sEt;>uhGq()fPAWc*X%4H0keY-
zkB<qOJA0|kWN_Pi2l9r7g3@(R5B6p>WlPHk;>fVYk4ucrqX(4lk)@Q<(mprnX7hga
zF8z)ed<d>Zc+F0`Nw$qm)6ZF6b$kc4x)7jDgG$u5_9gj1-&s~H;M*#vxl7d7w$Ajk
z2)sUlsTmBUH}0%g4zvKBz7BcI%gc$vHX*ngJehC)Nl6pHM1#=5H*K9YuP3s6b;TsM
zQXHDPFR*$Ln`wCiqwK%rDd9Tq2zdc0zHa;N+qY-o31;)Qw$r7${?HR5kNJVkN};R+
zb4Tm7RI?dS#u%&reNx-ZrJRH98nhon#)I#ZchsI<)NhTC?I;1H^Y=vp`@tI3H~VxB
z1eJ4d%Iq@8r(Pe<=T+~`0_Vk-BKJW>8z$R_DH?Oja}lz?9|VP_kW%n5`PC7nZM$tO
z8<ty1z#L|XG&Li{8{P@4KVbSU7T(b^C!;o2VtOWM`SD&t3BY-VZhgqk2v;#QG~Aha
zcy(ikI`dax<gldz)ufu@0%M`4o!6&`h*7ZK#@)ZH4jfRN<Q(}RilYr-IUr@`eQq&Y
zA+x?-oqg6*d0wXlW(<q7ZJeE3^791yhFWlQX*0j57}!zB&hTAEjo=y$=9V^snR7MD
z+GYs)&-j2^KAGBIoAMi)`i^cc9YhY_R=jFvaAo&RQcWGZDk$TbtL00P7avxlPmbZ0
zLbPDBk3$+w&CArTj*hO1jinbYEjFBG$6v8Pew1N&X{D5LSTUg@tK3BNB@gqfqSs!o
zX1-V#Z1EYR<l<ukwXXty1W`><)qrGZ^WN9>%#*QAWuE6+30N+uc^Rwk#U$AyoQyhx
z&~lCh?CyECa5l!s+2uqD6OAhAXN9#=D#k$HAOoO{TBxNvIlc6oEVfVc(BkL9FF2<(
zi<Q8=e(Uz9b3Z-RQmdTa_vVM&L0k!7=Qwk5N!^G_P;5+$;Pb8<4co1xbfR`Q&}T+N
znP^Od$KJl$5qDKkA&<GYG3_6v*ZmBQi*ntV+;Mt10ufDk`cg;88sY6YKTF~+KGE9U
zMrs>RsWdhxzcYD;w34Ofkqv@;Elw!uK%QS`<uWyu!RdlcHC#~NGE@`dG!d}PiYsr|
zk0gJiFUrp-W*Z}aIbyPeOsFqTZv-)?&CSmG!-tg?ip6A`qa@a5S6AOJ1W`24;K(A<
z${V+=5syW*K+G&T<z{attA@}zP96s%1_w2pJ}R|5Yc`deT#pe22A`q%cQHJQDh;cO
z-*{}!k9WNLb5Vg5T0Yw?L|@I3G6|`_;8_5N>7<gLZYEw=3yx2(8=((lIdAXL@FmPH
zEEM+}(h!SE=gbZLlFykc-fj#2EgK>N!noRqdzFi#^pf6fOx|zWm|7eBNjrjx%6jmh
zr`p*4(AA>`-=s-K-m4=sp#PH8Zct(pT#CdoxU7vX!5tDq5(K6vLaRV)Tyv;4xLV}g
zXR43C1+@%pC^aBYnF&`6fc3t#-P(YF1P<1_dVVN*oY~9dv)3m!UTz(POGgF0*vYk*
zl>vsooKJdM@r0L{*6Y_oNq|4w97LPDFxtAv{%r&R(<L1EeGO;^KZO?nCoDhMZZs2}
zzQQiIVDa7OnF8z-!;M+kw{pxDKjGx~E#04CtDwZzj7HBoLDq3mU*4x|f{URi1lQWo
zohc*<AnF@v0A}UYfbsC~X1h1Rh0vh}6Jbn+n`2-~XtrkUI`iD``6pZ$NtaW;RHhBb
z(;pJz;}g2Z7=%G)ED?+Uzly5{*EMSNybn8`BidgZqrAYKm1@2hMctxZ4+8~!hM3?t
z=9a9)#=RP2XL3!R8xt~qi$Ln4mNxMB-ey=1qO2Vu4a5hN0|7NF8$j9I;sftvZ4I1{
zk3LewWU3_8KozyLy6%tk#W88FXJ<l<z`p|=7zY9&u_X(P9dpC79W8&=Hn>{|g}o9D
zIEYVj->G3KlgR$H0M9909GvU1P4`%CN-H*w{#Qv8LPSNYLn%~c0JLg1Qa~eMQv1bM
zK_-`1bev#-0n7T4laq>;C5#na^dUAK=Qxg}8<5$#JsDXk=U6L?J9<V=2iYa7mOQcE
zX3dyQGMH)oAo6y5N|qEEi4J)(!0En}FMES-JxJF4;<^Crs^NnQ_P_|{Fxv~JAo%*B
z|C{RL*#q0{vZ1y_-*Iv^?gORpF`14g5sK}@cWp-luwYH3Pl&|Xo1NmP<m)v@i<LcE
z%qVhOX44%M(M1r&H*`xa31nN5NKHmI!6wLD$ifc%b4!rLp=qB<X#gDvsq}I-I$J$s
zaV(pO&@zLum{&278!HnrnW9)P>_u4n)%*Kj3$@$&CT~OZ8yR5{+^>B6U5FyvaQly>
z_i+w_n>eYN^AeF*K`yh=U)!g#1Fb)QTvPh?Y<{&`!u=q!sZ7F)aIXW}ZXN0S$)-MX
zDjFK?&u3g6HlX+IGJtN3<J8yJCnh8N37+;)sa<v3{qhHT2>>|Njf$aEE-1Y~ZIuDG
zZ>6yZ!2(d{{7EKXO-#v3n9N75CpUmFVQ?eCt*n0rf8$~e&&?e4(`wgQQk?EV@7Zi&
zu$N_xy$lzh#HU7D$hK4C5HZPaGd1`kL`T2z>0Wo|>?-W${iaua;OR<773QC;6%4SM
znX*+ZK4GZ@!2ol|alw+6`<76f$c26AlG=;xz@fbD{e$lp<)EbvR~biV3DRuaCjY$1
zl>;Z!w<YU}^@N9YC#~)6fe@Tb19p1*RK#H+YUE)9_Uz%Y=dT5tY;LFVVWI(9EZzBe
z+BU^ma(#cDmETJu@5#|y-0|e7jgjHKJFz9yYkh)_he}1MQ#6qmB6Jb96cwFjEmU5%
zqOgsp>S!m5jHcadFE*sZP4@`fRs%+XiAisd_<o)u2@`E)2=24`(&TAn@WeskaJXg5
zM*?qQZONTEm|4=7B9FD=n*EwhKGBPDYAxwZb5FrP7&HMe7xh2f&^|%O$L>IgMINk^
zr<r!+$M>%}pKqJuS}g6(NA}8GUF3_oGnB?M7j||zwOYCO=(s@#&7g%E>l!1<hBK^e
zqI8p#%o~fa*(<(Pu(kW5$5^j*BWYsOQ|QAQ0_79-4g##bHA+Ak=KfSAVR%{SIBUY2
zDRG1ze1Fw1sq%$&I-EwjVQQyoh|zHu7`C2AIwM*@zzAmLGTt1oaAi+Tbf<^x2{%Bd
zXV>RH28YYEub*%oBUYrDQqh#YN2b>eK(;?icWzWqdVU$ziERDVo!mXlUFPN**w>^e
zc#42%3b4N4`Xz#~mL&?B9^RhF$Q`$uWGVGN;8r4g70Jy&F|2A(e9<z~LJ|AS_hV9h
z|6K92NQ;X)XGig}#XyKD5r6&M2>4g)^DL5Fjf}wTyhSg>Iey!d@6XXFRE)Wp%WU(9
zPaz?wix)g@s~>ljBUwhkas0PUM7eez{T+MpJVx}eL+`~`s0%zB;Y<*)ZFv6t`;mh5
z&f>yxNjp&XSmGWyee}cm+x7{m)@+%>jrFleD?A-)PQvPdp@sW9qm1aeK1pmXl-XSJ
znvw%HVD^j7>$Fa%E|I9<K+2+1Eb*|ZrU_#C@RXIXRFWjYr}CI3H-IQ&?u45~xsM@o
zp_i*;`@pHQ9@tiyb%I{zyaxl{IU~m`BFDbVM<V?e`rn!$yj2j13KPs`Ey(^&k$!PO
zUpAJ46SDN@=36I}jLp++G^MgfcW2JbDZ`4+2v}^*7lwlDEjABh#SyjOrZ*1^WOIAz
zGH?=9_R0@F3}xTnp6fLKvK$FXf-=7!szkT;4^iau%QRQ<=LsT@GTc|AJD;xA<+*qv
zs{31ekw<|W6Y}nJ<(*HmmB<?om3>oVn9RKA0zf-Ib+mT265J0bY<K9+n5dGiH@dkq
z8m>Om@_)-HGn1oAjm>`O>50INHj*-*^4Y(0c6K;+lUDiHk{d|)`-gVOK<?I!NSn?@
zQ+@hm;UCljbbLHfx!WoyKi(;L4b|-F3uF!6`(A0C=xly}MIkWgH{sA3L79u+$xLxs
z+2H(#ec07U=V6Kr4O?rh*JN3zujM~_^l1AqOQPPJijM9ICFL}m=fy+c+B!2?ujrBi
z6?7=KS1RG)Sw*Q@>(abcXg+n&e5Tt)KuSGtYzgeR@)yT(*@~0XyZN99Qxl-&h^4Z|
zZBPU8yGJ2BH`LMbV`!xxZe6jOrT$IZ+hKNfsl%c6_F&2!H>Y=teybQVWriA;<sU{e
zC%+|JGqU~oH7jkTemQ&Jz$R6$jPH#*&BcUcBw_P>xbr;+@AI8bZ-M(U(Yrr#RAY~k
z8)kvIk#v&KuP{}3&c80YFja0?WzgG@QtmBagXQ!4&7KSEmh3@=gpx%%@obq)kCQ@I
zirg&vMzbAJ8I3BaJA%?)PaTmfm|e=jzBr|Y4MIwmAK-8DK@6DhLA%7^^;stqn>MbS
zQ~5}^w)TH8PDCbXaiY?8Eup}nARLOx3#|om&2di=&uzhGjh-|>Xt~7waBw0ND)&7t
za4|gB`s?bTQOMCVT!GxbH-T#}121j@(6VWb<5e$p=olH-w(fbYO04vy<e4KbGTRPB
zXVd|x?GhSu=~H-YB4SE<cukjRlCK<@X~_=dYA|Ap8TXb`95{G+)sXuZ%72Cam)9N%
zDn~F4p)ZLJJuG|;=HH(x+K@_l5RK4ZIQVzD)>vNP&QH9#Hh%-C8PIM{(K^Aj;CsTJ
z`>RsvorMUc|J+X;N*th&DG9{<e!$&#pRhLG%gorCY4j4Z>A8h%<l*=iO(G~yfFLj`
zH5K5CPBCbtYyxeP^z^;Qh`0Qv-y>ylPb^Ufz{DpGAdipK#SLk07re9ncTHR}<SK&<
z5(e)W$zb<&nuwHm$=rYg<NVU)9oNT&D40LqG&D8_$y={p3!-EdSO&NcZ3-4?!yg~;
ziNt}kK)^2mPN#h^ovtMv;uSK{=;bC<@4A5?NsfK|5Of3d8r{^G2<#0_B>-!!s$WmE
z3f;foo|oYhF&ou&U8>=@UutXBA<kDN2V*tOBlcg*c~5j@Fo+fQ75Jn~wT>vkA8Aso
zw6yxy1K~>_y;|e>rRp3Bt_A8PLJ0^7v(yp<PT{*G8<x6tKL36h{G9<wWNovps=*X%
zR<`xN?8#Y%Wn18meA5!u&BJ(p<KGFoZ-Je=WGnzMoj>JLQQ>^+C^$sZ!-VS-MK+4;
zH1OqkStc$%<kKHQ39!dJcUxLo0DhZCkK4^FT$y2D6gV3dU>r$ENLm2geW1nzw2=RO
zN4+PjuRDH=cBm=Ba|T&Tj7bu@wvZPkFS5t}16ye5lEZ=O!I@z&z`Yd@22`stO7ea)
zt#>_z8wYWz!zH?Pq5rW-1VR0H-bd4Jz+-?HsLG4S!Fr{DsZR?*43|_+&7W|9B#YvH
zf$oSjFz@TscnOqT8Oqh92i#;jE9Wwfyc2vA99KZc;OkO|{MFT^g5{5s3jg;5b#-+&
zd7xY+b5P0z0n=8X(jnhmyKeYj306~7Tq>yq7*$|H641Gg)vVszSCKwqnZ5Eu_XSxO
z|Gls<hKr5up)c_9uX4VA{j>*6BtsuuE8rNxB*Wcq{%4U;3W|zz0I>~(?ETVvKSbP@
z;tY6bz{vA=aVr2H5u=@a55yy>q@=Xux$}zQiNo8sCFY*n|A8WpQ-Ky;3xJ0Pvd}b=
z-U?%Ldq+oLvGeoukR4#|Q((IC?8Zjl&h9QxpjjdTFd?nIw!R)D4>rRyFc`BkF)<0r
zBo(CA)YNProa6rhBnpKN4-ebNCnjjD?d^@j!o$f|rs|yAQz2f}i6XZBx13M+F;=T(
z$?unIZt|Hm(1p_Sqb>+}%#+0&B0ha0&Vj>sAZAN(z@X|2-WrIl9{<03TCkWT;mq~m
z_4pU_0%;HI!I;BMcs=~~5UNMtBQ##Wx<|gMs=`Gq%Vqw1uoVTX%#ZK6if~XAkdkfv
z@k1R6JyKOyR{$QjuSTi=uaxT%pfcr&1jOS2eFqpn2GMiMs~;@Amk)bVAH12I?TO<(
zh1XMJ&se|zXJ<kdPgXL<&;?9@P&lDz=x#;$``^YoWLY`ai{VqAvK{aKN8oig?>+`9
zYBZ9B38Y-t2f@>+y$Rs#r`bxUcj78;KX^b3=w3UJjnFR%dZot$gt&jH(o^95%rIFQ
z!@x-d0W~w8YQ9=0K}`c!@d;NG-ZHDHso@;>BL@wu(Y_a^NL`<p=;#mDoe`M;kaXW^
z2kijtxYgQd@wxxCxJwQi(7OVQ`Go~45D4JG6Lnu;c3o>eoWz)}9|E(PXt-+xTAM00
z9i3di&tN-e=b<-a$CwH#P>N`=zUvo263PM~kd{0TzgVtX{R9HDNEin9qSc>74@Mz1
z`Bo{MAz-WNjKbXKfCk~V)qfG8SK#{>H&E~~^U=@S5SpZr7y;JSu^^<1hu5&RKL{kC
zrNwS-M!bDASFwaqJ@TU6!tPoOvIvN2vAWmRweF1bhzd_r7}y#dd)B`5aB>|DPKd1(
zN#IvTM9zHy33&eKPrqGcmBV{i9Pi$}mnJgyV<mmy8u{VS#g&ycU#TMjXmR^Wx))%r
zh4NRC*b4s_E9eRv(ge%NP(`mwz&CcoeD9s!*JT0x@MZk3C=V_xZ9Ghd<$KF%%Ykpg
zRTTlqoKA1(dw44un$$76)AHWjy!CiQxy*Kk_=ogr7}i-bYon^TOsbmZ!Zn@T+|8H{
zazOPu)pUD$VZdTfRhjH`NlLsHVSQAkY3QA(`ZIdT&Z2>&MAK^r+x5-ysH!Eh@kLAb
z2suB_j-tNOcxSAPpiH)$>Vo1KnHP~V-}<j>XT>#H;X6v>Xj{zb$%^^*Wg;*$h@}-E
zkAMono>HH?F)1mbU%q@v8B{u~)gQ;h$9DiuK7^#n>I3;KshLnEFS}k&02a3co@HMx
zjyowS$pi)D3VI3F(%fcRDr|a>#~;wp0Gk7dh@Lpmx$@PZG#!T7j7?4sVS#wg27t_F
z!Av#OWkB(p%zE97FA}UzhIt<gYuUCsIym0~xf7nWq;!vXee0b2<U#a9YW<3@oBhu%
z;ULuna+wp$D-96H;HIC}+yW+;fZ4bCo~_t=`V75VB2<FKG~hzLx;0#NjFNM#Wulva
zdd-(eEC_2S<R}!skE05ga#hOfH{IzN-fEi|y4ug;>fShaZU6Nl<N9>!Rv{Fy_-CtV
zU$$3cxTFExOs$i(%okJt?=Jw&7ke1AsGyQ)H{r;9IvpCuD7Kl~iHVw@4&*w8H##px
zi_N&p`xegMq@^XKrlvjz!rb$-%tphiywBea6cqtjaj7ltc2_nNg{=319BZLL=`P55
zvhop_Z(?HNR2iE82`EO5C+}Ex&KoQ`Bdd;}^u(U<GvVXUF1;i3jrbMl=S&6%>T*tO
zL>nM)IZa2^5$ZKBb9zZAMneZb1dqO86kET)6}X{kw*3OFQ!0DbGSot)MkLyn&Y3d!
z?uVqf?qH&TWP^%V-r>ftAntT`Jb<_XBcZxBlp9xhA_o(dB!7A!<z($A+myKP4x(kc
z1(+Y?Y$zzgtDd4R=~{;8lT|P2fD$9$p|Q>KyQPbZixxnzbUuB)K2dq%Jh*Wtn;SZP
zXoaWXhnaY{r6k*2Wy|?<QzB`4g=7uhR=!)y8Cy)fD)jCi8h^BEgUnqB!|<%;YJ)VS
z%+pXU)duA<`0Cmyv-A7<LVO(dREJ5%i;h3fVF9IRjY!5$Qf&$#%1tYYT)s<XjI^;E
zPXk}$uV7ur^GbcJxZf<NTn^e{)f>;>Ycue(k$8jP6d0-t$fw9Y1jQne%vuN-l=B#a
z+}zwxVPQW@Gqc{={`stAe@!s=Bes*QHfF%ijmYBdV}^;g07)PxW0f(vxGM;Nz!a7Y
zS>GnyQ;V)B_H!A@;Sj=W!<PIEItsSY-HRB_dq#+oOAtMREp?csT67zp2*q<+p6{~-
z>u=rTT>UsqOH1n=k=H}Vu&-sE#-nDZ$%n|jlZHL{U0Axy`*0nNG}oB;qP_Xo3#q}s
z51y+4u6!Qf&-O=Ri+LE&{C1W;Vl_-b_V9fFsj9(9FOZGxD9v}TIax|D->-QLVi;CJ
zx=Avf0SI`v(GU==<)9a=KSN&?P9gs?MQ{!cIXOJp*Q&NE6pRnnbKBzM9wDv)8KJ2`
z!#3kSPc5Co!HKl0vBOYsQ!@bXy0mU(B3WtT0EG1y;BL><nR$uo0LX;|R#=1UMlvos
z#kmrC!YTX@?KrD1*Re@S62ltbpo6(iL2)k*>fwH}jkzHWfjYayDI!u+O~;jkp%YTA
z(|xMIn3DCn)ZV+Mw&TuHf)kSD+(c49oDv0?lzHInE^o^9>NmdzfoSj&dDzV~NQ{=4
z8kc}(^q<zH{P`elrkJFh98_Z><6{HEG7&Rj;rWHeFcuiGi{ya9!z*5?#qwEg4wVP5
zN6Fg77OLAarVnk8hOJ>ZMCl{z@8>U5=~O{}O-=d;sMWF#pQ&is47iz5OU4MlNd|GY
zDn!YpciWWZ^+ek9uxVFF4XM^>Q412uFo3*j?-e5y12(7?Vt00S0cylzc^Oo;=H)n)
zjwE&^>TzcXT8a$k`Bpf!@U(^JN~81k_g_Ai13A4r->*w!P1Ia}1(GCc{^(DuoU5>D
zW8uEaNl%SZ?2X7fD&NA8rdCe`GdP@IJ9Ex+iU|fmV85?Mmq<zcPzfTzY_*M#CuT@L
zL>eU5glV$Xvc`Td_&TNfmrK;H%cgs5U{^+(E^<mN^XL(=1=#yQ#)D8<`n-JL6`k*+
z^URTl*OUoov-6-<)uSEcF6N~K*~<1-JBK3bwdWT5>!e@zmfH-WKWTEOaW-p^58Z2#
zj&&8&jb!&(gyf3H)>=CJf)j(tVV*}$-iOMdpWeG9TyLAon5N@>`sL}~ln0X}f^hje
zq6}E<RY~=UK;Oi~H_qGsywqQ(Lvv@tvbjBB=M2xjowGLK%2~q9?Avbl(i8?^gY<`s
zpDeUT?kuGY%pPPI&##VR&b?sAJ6f~v4%u+tD>TykUB-r0d)HEr`r2bz$ro%@P9<Mk
zp+*QbDOLtIj@-sqq(8EY7_`I(k47p*X4@WdtvBVBoi~%DN>q`2dnNPHJjM0JkxyHW
zJ?K@F5z*m;6+s&ddt4oa3*6crJ7SKoyW*v4Ym7=SY7Yfvznw;SYw?A5b0pC$l>O-I
zJ7H0!iR)qd%X$Nlt0q<e`Thp<Y>Bz(+unQlgmkJzJ*yTSB#`<;OPToyrMZ^Ol^UJ;
zvUkIe_?XVYGN-oJ&b)mEZuhT%Ic68-etIw2?{7{d1&>m1?;o}OZr^kA5AI9=%Y>;)
zF<H!<TUS+z`<Fd5mc|`hZ%frvDQO`iflTh~OMrCz*++T6>On@THJC0;Ne994G5M$<
z_N@^nkii7iv9B7{+g6dj$Mdn`E0_>gb5HU-=3>kJbI>+9+4sc`*37*Mpg9|>>^M2i
zXxap0=l}){^y1jUSk8zAl#9oYiqUPI?xz8V0P-N!;fuFk3TqPdybu$Y9M7yCYAc&`
z2%R3DoSzoZw>wzqr9&<gGes6zXSkUnrXot4<s+MdDK>t68Rew33_3VyG#xqF=19AL
zcll%XJw`h%bHJ7z8&!&m(Q2S?Ff;eDBK7PBGD98%QT$)V#qCxd)F<qHncy`M-0|_f
z)OXG=D)xA29i}72SiG)3$ZQd>`%2W5T1I3acwa8fRo=<HSJxZWOvnC69g*%sZrO6x
zapFbTm@gB4y|b;;YBT#W!O3jr3X9*){u15!QEy^7nr3*dDX6KipN*{xUrXjGzCaLd
z^J-_mxZCor!;KjtTQ~4euXXy=?SsISdZOe}PbOZi+Fgi6{W5uHdaS_e-jMzH@>j;O
zZ*EG)RmtMyTR)j8+*ah>_eUnZxz6tRz!a=Q{eXUxAj^%}kQb$pz&k`6bHCjKyHRUp
zQiv;BFj2aab^F?1MQy_a-`bl_{I(x&&>A9Nl7z{e#zu~uc7NrnPW#r0A*bFpJ0h?<
zL_SOWh81Vh+O#rXDYU}8o4QY`1Qu<dfz+2fO-mZGmd<z~Rs}5;6s{%kBnSGJ1U?j5
z9=5bfK9y611Iz@#1PjDTg}hcD3$=<IkdMr2JJut<zWtpWEKQKj0RFORtYuNpOI=|4
z!aHpzw{7Rf*)hgVWBW(V8!FnHSF&x*<i%qJWM#E}o@~1`nWZ(+Zj)}yub@{Qr{(R=
z2WnPpj_*njyy+mlAHMygaBD8J(;mn=QS-x2qI~-!`IYuO8gTCWFPV<4QA^8&Zh6_q
zv)`Vb?<CAz5GtoO4q~$n%7HmmB?5UT)})kDt=&5}SPG0t!7>MQ>E0XG<A}O!?AF$7
zW~WSh{+sx(2a5}@r<Dg^_7K)?riCXv?9W*vQZ@NHbq4Ntc566qZ_6vWW3w}Mx`xeL
zMu%9?43G%^+oo$BvuV}K;<Z*c%~wvuW^B#Z>}7J-cEn)s{icmX&-IVCj%y#8r%LKI
z9zuu6HbrY2f!O}sVRg*hx4p%W=;RwShGUS`XFnRIK@;~I^pE}rq7-ex>5&o3d(4Vy
zk<TMBo0Jr!%Fo^Jp3w!f!OX9ia|^OvS()hk^01nTzJCnDO5aU12%rJn)kosKGI%%`
z;=_Iu?gJ2y21J^(ok=!%4|-cXA;z0{<8+vnAT~|0?Df@-t<n4m+mxw;jMq@Fj@w}t
z=q&vuWn4-S_2h#SqDbU1`4q$?5z4F(E(Ti|*uW^+@=G>PjHLOnZUR$5LW#)7ZEFr}
z!Jc-&*bBF@w8qtrbaYEUZOLYd_j+_}3h!%R0EDx8|N2WotdY2+MBC^x)0x@6Em&A0
zyAq@|Y#k9H?sckL?x?4T$-2j=Vh4nmpR{DLx6rUNeq_}xQ<2Xsu>ln9unX+bDO^eo
z;F-48?tIkMea!gJDv7C$O*`l5D1E|kJWdvtW6KR?gAOa!&MpQol-b_QNfB;k>C{TK
zx|y?#;d!HyW%uF;V4-$;&l`4oc<BT!u3UI9nAKF~Ol?dA?fa-Fi>e}Xva~(^Vo4Hu
znBktP2HktWIA??q^lp?u^)%Ag_h*q2HPBGk0)*9d+q!{+IZZq~aX^IsPtXf7L@5Tn
zQ4XW~aGA<w^*t9-S64qCI5VSkMUGf@#mFJ+fpWvu1YO<B8aN>T3^-IEE(fN3+fs9J
zbMJ*}4--_r<RM~M*F=L%%V%MMT)*L=HRzYC4!VkP;eS;wrsR4|3E>j2X;ofGQzsxu
zdr8wk6d9hclegO|p%=(!-ozy3w)qptDC|q=Jk3}CgZP#rE=!9X=h%06z&#uma!s27
z?@3O0z<&x3m1;CJG=#h&+D%o*mU<ITQVpS8?BVTM@`3vY7(_taeObU=z;U?$+5&M=
z_vC(UFAO|^<+WJ@1pGVG1?|27F!7UX=PQT1y<m{6zA!jTc|eAkBAD+R6rP*gIyuR3
zSpYSltRu8O`7LxHSZ_owNJ3Ay!1M1FDO_9uvEAO6mTSwpRbzQDN$%Y`+{xla22?`P
z;IK7UJ%xjl-#(!3jL7&<YAz^X8lk)&!23y>)vs)OHKmELJD#oAf`O31QPYbch=RGN
z(`x9wTXMyR!)y9MgJ!D9zH6Ft)@@3WEXC&9PxEX4z`S>3s+yWMS&omK7_+j#mZ$sl
z$7nb79_fP``>_wf`fQpR<t_7f)P$hpj<E0+hWoGP!^LJ4dgF`7SH9DEr-h2M()cZY
z78ST@T>ZMmz}%<(DA8qOGL90K_h_3(Yz5%AmdBvFPxHI}JTB`UYbB7<Bx8IK7WwoP
zpgZ=DW@JR`CBx5vTi*gkwYP)uH1L0vn%3u<%foY?KY#uOhCMyK10dz#KhBKjNaD7c
zd?48n7^D5<$&-czp4+#tb#!zb14zBrV#th7vcWaaSzoVa3iFc&8pvgO_EZs`^+&ct
z9uqvrpx`DAt1)8G7F$Vm73-#SUz`WP)-pReIeGW<#ihu{rY9#QVG??1C2tjGX+QlV
zK#EH;cYqNSTjg16cugnEDaWhXk;m_k5)<jL49#%0gk$S^x2;ihHiz19uExngK~d&C
z89>&7kn~bRzD{LFsq-6_y^p-(3FK%7%dM4}fb$3fCGz6=j9MwZ=wATUn%>F8amLCU
z-?Z~z{ryZhliWhF9r!UoeI2LsNE!p!$;JD{Q49sO0KmTi?B7pt{^tiEu$e-(QusbV
zjmF9T{k+dYq7<P5SKipzw1b28ffG@(fI=W|rE{siCZDtYn#D}|Gue|xYM}IKb?a&7
zkL3Gn5z8Fe^7TACM^gXXBI@(!TSex`^ew$iqb1{-x8Z#$z|llkvmh^upM8^S3nV`{
z`a1P;wL&vKKK^op&Zz&GCtWhRF<4HU5A^CPz~w|l_Fg9?UGS>qkq3yZ6Bp{slmk+E
zNmDLCQQP)Y!PLMX!PtEm)M3JJQX4fucmZ(ZUp)4f&s#_I*a3C};Bpz0!{P{!hpT8u
z;%s{3osw|#q2ObM%BmuF!LMC~5B|PIv%dho^X{UmsQqYI#>pYTu~`C1hs&y{(x)!+
zyW%dtb+M@FfaUA;-Y3EtJ59oJ)Tuq6!owSbc@0WbGJVZoX6D~pRo9ibWAlAk=Q#KA
z*6FWUDjFIW>V2trDth{RcQ`oaxm14I45m+^ZZa_N1aKYP_wSJDA-;Y+<|ZATJN4D8
zSGDa@v&klP-VmE6eE#xFbk0#RJY4rOyjO!i3+(600pT&M<9c{Y9o027Jd9SBmM~)l
zW|^R8lj)42cFkZfXYS0a*xS5u5>S;VgxG%a%p{!6V5SxQehs^y|MZPyHw`6M*F%lL
z8F_lq`X;hdEPYIRx<EiKTXb}CvM05u%u~V*Z1khCW6|3}LQk&;hp|KNnh<K>co*K@
zNx7?9p{lzwP=mU-KaKvgYTEpAOX@+v0Q2Ans4oo?d&r2qBHH*KV#lufrScx~Y*Pvg
zfm8NTDuM0dB!uTUE(iT{JmxfA2;*ks;COria=G}UU612P8|@^;#kVEO?GS;051;~Q
z<3+FP)pmoW{_M-4$??B=Oc#=%1VIXH{Mi0OV)V;DmM{NjCP<T~52%rz->5+^S5{Fn
zOWp#Q>2m^2I5e}aXmv#yjH&^0Q^1tkf_mtkJ9(=Y1)Ex*p%{7m_0^&~$%?0s7V`7b
zV`fV4%EEw{orvPpjS{di$mX~^y1xP8RRm79IJRsB3^_hvsOA)l-yLP9+oPKxpqoaQ
z9|W{xoA|5O5(6iGD64`<u`MIT#s+{_e0SE>lO9FW^icoQzi6MJVjk3Gc7=F?^!>v_
zxrbe5z}X8Re7VDqY=iMKX&wrdU(o`hWj+9haSRX-$9!{8Av;P+O5B!iomeKQ5h%>a
z&`PoZibdh*<+qdl?<U6jVjb*(Q)ObR%cr~#A(aEjkq2DV0&?|zF992nQ>gs{Fem4f
zH3drgGX6#HuT|XScz)-06ixI)eU<MT@SI2b>i$KE*Cs!rIC$@Vuzd6~nudm*m-j<a
z8L^Qi$@6x_t`IdgUcnDV--(TaNuJv%b@iyT@rugnzruS{Hw4W7QuJ>+0@75OK>eCG
zSRWvFoDSEGaP@k17wq>QgvFGg+?WmwWxOI%r=%B$-_fq6@ck}lx>YuiITUbGC!wBu
zU9ifB`c|3Oszc+KvQOPfnytbUh`RN?572Y$FXEiCi0<d+eoYBesYUZFz3`=VbyGK+
z=et|?q;${@^sgbK##JWTk==;Ur~}%k@iW5f_vA)({EM<bRX{&mf=M3#zH`TvCN-Q<
zY*%)wfWheGMg`u@uE(DQ`Plda@8l@ztN34bJ&=Iduc-wByI1_2o&)$*{iUj_=P?^E
zpParSo{<w(#r(~#>%eyl$?03+86{Cw2vc`m508pVerWu*>Mg*L@ATE6=YBa{5CO!Z
z3_9xZ5@{c~jlF#+kb&4m``APjZGGBZl{7+9p<umWxr@LzRE`z`6w0}r6Fvm-o?O{?
z#fUSoVmJMg#pHrs{)$R)p?5$Y-u&TO%f`M=<_Ucn@W@A*;|@0{;dRkq(biqjf+I>Z
zpCwMF!|(tsgGkk@Q8I{ExSZr#O^%9jRpHnz{<9Pg2`LZ-@A4N|rT(fIjE1_3PvKW_
zyXV<mQOxrXMf<;w5{v4IjU1?KFvYv8JZ&%zGA~t&akY;zo~o(_1VBEqTT!7aM1_s_
zw%lbi9MCuibUONn0xeg~K>PINe66CQYZa{=&jap6(SX=_1wIrt1LDQ`{0>)C96dX)
z$cLgqVxxSLswJg0*Y)wM(JR(BXiJ_KRs?YwV2>9fPta=rwJu^u#w-G<f}O#Gq{r}K
zVXkKqDmx~AdNQ|7*^gf@3M?+tT1`2SN9#8)7TMqrzGRhc(pNr;Y}WgkW*^FXNGgPN
zqzl=-`4m|~0u1_f>=(F|H;}40Y%Z%{s43$)cEYH-ZjFMoDR8HE{+c!b8g^LoDVE3Q
ze8aa)McxjPW%k>bcP;h2@lqc(^)IUVRI#t`0o5~->?upQcIO}lz>GjTJ0|oKpf|J2
zawzu8W{_Iq%citeMPRy&1<>|+IUZ79AJ52=s-pE~S4e0SO~ONc3p}G>s*0P`T|Hq@
zaY+yL?fi>=UYmTE?Q)6OzswSwIRYLRdJ`YJ$?N>wNBOhzSodjo)B&URln^wW@pSBE
zTT|gVW6s)ei*YSf<0Sj4_Fm{<siKd7DY|Kh<z?`Wih79h>e6j4(@;SVU*hY|^L0>~
zW%z6#nwyi8pE)AFcrGe6sQ=r=Ln}=dl+L{49T{R@#;xZ2hf)aFJ2wqtwWDJb0)3xF
zw6ZKze^Tjdc=I1s;)yKbQB$TrjQNsdrj62T0kS3UsHiG908I$~tM3jlcR-WN90$-z
zDG1Czcn0*y{@)u8fN9tNnFv@16AEhfy!(669_^$n9EL=-;Le-axppxxhegzV+z~n|
z)!6_3u&4E=jID{|vmhrOu9oNSvZ-2q9d{Vj5;rNVP&7f3zL9hI7^%^hfvO@!gN1V!
z7SsvB{$DtOGy#+65rcmy{mJ-)S67shG!>5Yt)t`P!uR@#sD7M2A96z8{J+@phk%t(
zuMX+%lkexx31tzxB_PN94Eo@SX7#2FAOn}JUjI)9qa>!J07$&Rw`x-)`6D6RvR*<7
zKK~zOZvhm?+I0&DcXxMpcXv-nf)B32VQ_c%;O<FqhatEJhoA|;-Q5DY%{k})KmYD~
zrwS;#rlw`OpS}0mYp<2!^>q>%xkqAWYa0g6t8%FR{?%hqFEprz%XxHk#8NCRtSH#`
zmlYVFMjvMBsIF2Klz>;S!TfD<yCbz{zI1EbJhg4ed_`{9JBCrkF;zi3wX_&`qF-xr
z05c?O0A05&5>Xcm$vjM!Fin%{v2#x~@25dCYe@{Aib<z~_bcJqh>83A4k?bC)!!Sz
z*j5kbyS1kwejMF$yhM#rc$)M;i~mlzt+Ewdlo|znBkH9(+zNh^iHAq6&tbfD^jOpo
zP|y7l{2!Ob|Nl${`}}dNS7nhK9m$)lR~0{CITAO$4j4&vBYZ>t^giv^|8}!Y;bY}q
z{A^suJj(r!LG{_|Oos=XfxX@%L|bD$B7T<hi#7w8t3`hBy@cqW<%q={cO=81`NGw}
zUxY$n+WMt-(bGAxDWBiwV4GE33jZgJ-#9$AZaX?J<6ln*Bn>X3(jWVT!L}<z#|RVB
z@Q>upYJ~CXVvmIjduo+q^>u!~B|{Bwdb_U;71MF&s{ZA$@NegC-vz{Cw_VWtw0Q0#
zIw_@&l9GyGfIz%OO>Hg*#A0mcj>wC(#!n*boP`J0{^650n@#S}>PFvyehYk@miPHN
zM%C&wN!ajE%^!EORV(<;yLy(_-Qp6zu*5t<djezvNChYPlPh00l61hd>DruKBK2a~
z+I|JR$rQ~c5-5Is8Oq}zIp2jzavFz|n5dPq^rjEyzX=veX*~J~{{C#w>rQejZLO#N
zdGue6dH<Z;f)ATfmqVUZ&B{+lfnGTkU*1IaJ~xYAxsQera6)SH|8_${;wwX8m$|uR
zfv2n4z=b2P8#S8|Y{#4IH+wIjs2ws;tqMV&+CP?P13zijkUR>Q7u+NaGLD(ZrDldk
z+U}p3%`^$HA`PRi1Cuwn!A9_Q3g|2ia~=Lt=2T}Z`fm3+H6Ird`}+k8X60AbX0{eF
zY3o;Afl@oX+F9~PfPU@i;X|glp1B1OzVNA7Sc58C5p|uB%;A9WMM%ZM6;wHfsGA8q
zF!IC7Y6WZpdfGr+2Y~Gk8hy9u<qEbRIeI<~HY{4<MEWXC+B~YEpqc0hd!Sxi=yutZ
zvM^Abe)ok1xEBMYU5o@AGQcv~Ytit5_fc4biczTLof!QgyY#%itgd&3DC7$(nZ<vK
zyf3qmecaeTU(2_73AT8N&Gb!Bax*<XtPd=v+}Y>htj^ADR8icukDmK2_iR{m8ep*Y
z6%@j7c@8_3?CkdVxCtDgs=;yxPnq{y;%=1`fpW_T1-<$8zTcA<R(@x1v+oOJ_nYcW
z;hJ%|sI}CQxH?)T@q_45v+$q{@gJE;@1RN0JBQQJC8nlIYUzYl*230rP@4|`*D6C&
z%QUpIAGV&G#@vEF5s#RPg)gZ2r!@#@B?Ek*i@;vhuaCpCh^pgOEt}`N4A+Unzi`zv
zcqkCG#|FO*G?<Vj_Y1R7v|DBOj6N~C=Uw%^OF=q=Wb_JKQ;_=|VT~Dip~~qh)pF(r
z(kXn+Y_+&NmEhQ5`~Wr_cGQp8k9<<u?dGFL+fVo7av0OmX;-+Y78dn@?`2moKH_|9
zFg`48DNn4$&KXj7u1srDD-b*FaJO+jG-W?ejJs8CvYQi?(XhtJ-N2JXXp`{%@rcVg
z5>6C@BizjxmOdd5xUn*I%xr?q{0UU%jQ+}vzWn=C66iC~5n%mgaoH>PlM)2KwS#xo
z;C?6h0KFn2{m{8jMwQ#~RyJh!I%ErFNkkqZk&S1B&VnmETOPQgaEj=<e^pQf{p`kl
zFVd?zMVE%+;s$eQvmyCFyabMlC;3Ikyifh#Ue-jnaiYmTLb12VY_m~<_xD1a+}?!x
zb}LEl+ql1;O^_eeHP1E2jj$lIxRbuKP@TWZmxLX;>Y@fxH0C9@N@G4<7GX8#xDMr1
zOBCIjiuhl=uK(lk-P&p*nvE=<n8@VVnSs`vVf~u;55nXt4$%)+(A9M{;wLEruRW%y
zNwXF(<k|3ho#h;PDVm_%^#|8u9$b@BT=3ZPyogB*WTy6S7r4Avkd88DVe&onV?A%@
zJnvQ{)=v%+I&l04tk8xw3%s<y`<9{`9J{Yk6;CF9gH)G1GyhMK>Lm{csu&>gtoyNo
z$#o+YzRvC$wC>=^7XC6u{8#GnSHkhHKDO1OxFz!4dz)ofs=kvxy{S4kLO^T6Ct*ba
zIxXV#!&mftnX<j+K^UnYgMgxiW3#&WvY10?!5B5r-o%kqr%kDS7-kt$@ZQ5Bd=iBA
zY7-JrTxgf4pbQhs%gznX|K&$c5pXVXBg8?OCN{g6U^H~Da@4dRO&0r{J08kLv_kS6
z*s|(NG*0he=}7B3b$GAmG@>{VAwNk)$3vosZj%28$5c#fz2&+6j*sXz_8x09UXH5I
zk;m}fg8bsb?7V*Z@r6wEUiBk5)j;<DD_Z`WJoN93v;dEd?O(}5Q^D`6823$Q-s=Q<
z<#rBnuz8#G2gY-H-?8;?Z}sgBU@SHeP^MRzbro@t^LP_+Wx^r;bbv0_qcFa!{biTC
z?7N(;ry&+C#8Nr^9J4#!eERzLr5D?n1o5CO)2JjwTuxXm0cRJZILpy&Yl_@+Cu!F?
zQw&FGfr}m_r)_8QZZ${DO2YR}MJ1MK38ltY<ds*Yf)eBi`+~FdSo^Ndf}`<qm!~n)
z57xPQ6ky883@gqlEi9VtUe8#32Jisw0f6=i)G2>Wjyp{ozkA36?`Y_j##GNZ{#}j(
z`I!T573z&!^{PT}YO33%u{W^kuVnrIUfKN<<sj<ClWMJ)QEO99TX?t^V(+91v5vUr
z9V@%4?@xMW-G+)kapo&62!b<hV$KqcOLq6dm1zxy5^9H8d<kWBUQ<$=rRbjSKd|xe
zK?P0M*>$jn-i2MnXyKe6-S?U;HhYW1Ix}TPBB4wB>cMl*Vy_c8XKF-y3sK|x`%C#g
zOC2<P3VhYiQ}@kW44-UksB?%=e2kiIom;xN`eGtF4qg7LiME8^Fvw_1&fSRn_t)S5
z%gR-l$|{2zR#D4|^44b#CO3E1^_!`<f;JGbvQy`u@ysyEG=krC&bYA|WBjt?!fW$B
z|2B~@<jR*PqrMa8)A3iX`w5W$20#IJX)Ob2-5?}$Iv_#<#W9bxmL;@qAy&O6j`e8V
z{QH^rO#mfjD}HnoUE$b!+?kCf!A+NaBHu7*pG34RW97>a)OJ<ML!P1%_SvFicDC*5
z|8c#gVxbOdPIPg-<hq>{;M}zq{PUdVevgI#{kAsXo1mbO!_d~q&K}p{D~@uMn;*3o
zjV$3=tb_QMNEr<)`1@QZp4T=s;C<VPUv!q6!y7hxBF0cNOSg%csUgL-WyUv97-QrM
z2sTSZgsXns{FB5HuDfqBkDDo0Ah&^P#(;xEMjVLVY;Dgz0i8^K-9?^$1NwG-h2Pc5
zw2f&#A5Bur9h*L$N5;~dxc=>?v1kDXJ$tR?Dei1(nA|WjPzk0<Y8ix9w!+p!;|wbU
zl^_s8Eki5EVC$u6%uDH~(nzW*N-9181XCMf^@tm_5`c>2@$0?CK4YID_Q&rk06kGq
z8KTTiEv+RBZI88$x7GJ)2c^Ij{&V2P1xix3cI1drSImxUr86HLk)y;D_g=4rn7<!J
zA<`R8?=3mcysp4%3W>O;PNciTkcf3s7dRI9KcQ(U?v(uwY<a&+$gs(F3N3TjBhSRc
z8RB9SlT(5wmxjpVgCaFzC97(d*L%IJ2<N;}<c?N()-PM8#>^Q+F~&lsN5zsbeP7Af
zJjVtmN`AGtB4wvWYs&LX@C#_OzU+(9asNibg0K*_k4{mdgnX#39K*@V24q?P_scLs
z#=!ZJ?M3GM^uGzdz|GKuX7SM|(2?AmnCr-=82VeJL_(#3@r?Fqw@_F#GX{eE+<-TM
zqv*LB1}?trW|#(KI*eewzCcL$D5^UkUo?2{%Am3O91~g-c}XVIb8(N)j`*A-`~*b?
z{ZZie)x3-W<d=Xq#YouwuxfliNy0++WWZe5^rfTgKKJvHnjnJ}6-C`Aiz_DVklW4N
zG|Qtyi$a<4axBnCKp_$H^WE4Um4S*y*idKJ*CSM$7ewG+LP?nSzvuylf@>F+062#n
z5HV-mhg|*-ML1#FwA`+n=kL_XsU{T$QCsuS_a{iIkYC~2W!0Z9G{2f$-I>)2dSSIK
z?V6ZhAwJvwz;djA^nHsmeU)uB1&JXdT|n<=G5Q^U6KA^_gMOJv;D?zYdda2NVi!X2
zVebaq;dm9G$ns6bcNj|a;ecT8dnFcmzzLf_{7mTN>L3cmoO}gjb-iJN1&aa<f-KvX
zurP=q;I9NoABR_+4QX>!h=IKSWA6N|KMLn%4gh?-+%yAFh|=53Tz4ldiU3NN2b?{E
zhYHYgI>`c<Z|PA0n7HyXn9yOncY5w%19UC8fXVuPhJ4@X#3@Ap(ZiwxZF7LyyzHLF
z-t`+mLK|7>byXXaYYe66J8;IvO@cAwhRD6h_8HB4UCA~4r%>-loD~&Ew#wgGmC#bt
z?+|zS>ni_zf8(}sw-6`HkJBW660Wi^v6-uoC-p&#pWUdS!Fy3eM&96vuAi=K^TU<g
z%~vm9jfL|J+?<5y^;7a$%@n6|Wm4|N(?{hixRSDRs;qg7Q{??zb5$^|X*KN`ipeMd
zmI1)xzr|=kOYGnOk81Ik6g2<_<N~Kk#mK1maQj|2@yQRz;{K8UcQ*d;a~aa{YSS9_
zVap6Q4i3%s#z2fFFc;~BGd(@6Sp>ACrpU=;sA*_QWo2a*kuWg2qH1e7nF<RFOX+E8
zWtE+r&eWz>i(_AO$AP|r!20Q_QEWs6f~qRRXE6{S072YJLaqo;+;@H2kWn~4Dd>};
z#csB*xYpMc%ob!aj?EsYr5^_qnAZ>8vJ!^jk1wyid(B$!(7*x+=r|J36I9pP479JK
zas4FY_|J&Y%l|jhvcrav0KiQP0Nk{R9gJA@1av_+a#4TB26T?J&Q0?td20+7WOF~@
z57UPvx2(!OMBNCi{~8ODHQYSwp#Oc<OvOSQRGERO%Y|gVEjx^?Y^?Jd@Ftb}*MZxA
ztI&0802q`{Hy`-T{on2#xaI!N{9htbWg?<36@ZNc@Td|c3xl-QYv{fg{G3_(Uk3pH
zPP~}?hDN;O7*%RU9%30)(no}28592Jr1)?6W*8aRDZR9oDzvT;R(&uwA^t~v-8WeE
z^#CyU{}OBVMbzhQf%;Qz-bz*%qB?IP>vg65Kb52Z0Kr;{(7Ie$^`_Xv-=Y%nK6cjv
zIC*sR|6`2^%%~&t7}wpz`b!b$u40w$3*+vX4vx7U#Sq?rpxE0^6s)D$xvRZRV{BP3
zRQ6go#79}W@hk2XC+9$3#jG8cix#@NHW{5W@kZau8$oGFxlosxEQxuUL5;DjN8)xc
zlTR#3sZ{&*cZ{fnf`~wuv;T|>KT<=b%RV5g8iMbH8c%@j_(Okt`ag%*YF9I)mB<$l
zbUf@g2Floff5pIk1>NT|WBPJ?0X5&dcf>DGE&v!XvdjG6E8>=q)vySxjT{}Zc-tjZ
z57MX^J7=_Xv{c*676!_#znZ{!h{F0h>C^_%@$$-Ao&H3MW`{=Y?ns~^`<>CSd!oo_
zQ=<mOUp`@Wxwc%>t%MbiStARkPV35|`kB{;{^;0?`~+lVea$tvxV7pm%)<ls!-@tL
zt2j#9t=H0?{X3Kb3@{@^OT%g!Q~4_%<kJM3i9_NH=ilUHWsNNSl+s_B0#`7!_LEA+
zd<}=DD~iKG^Hqs$rN9OjwmbP!8^rdTWy544&vi9jIS-feK<XVXD512UN=OXOe(1#P
z){0VuCoaE3;c%ap6^DSjZ?PG71TLn!BLjR)-CN92;8R{VJp4_za!5P}RZUvn6gO7D
zi~9Zm&LCQ&^Owm&@U+cu_?xELq!eFr5QCk({0C&srQ7}8-3VKy&tDrfm;9uHo+H14
z(U?Y*S~r@Z=CNo&BavOCXhvO<wDs4YDw0z+)=v*(68A<G&7W{daH1Aj2-Y@LQnW@N
zmFM5c{znKO=>CP{5`2UOni>C;k^e|u{V#|H_dc>))8Nkb?3Cj&cIAqnX27YvrV~<!
z<*A9l1*i2ItN%jx>hr+1>P=I#x}+q2`{sd=>hey|(WjIQFHY1H@2giU_ATbPUvW?{
zZM(4AVUiO)29QAX4rU3o#p4-lSEZb_5lnxq7rp9scltO86fx=s+GNrMNpoU@SsXHa
z854;N2%it^2gca&KoGU{e2H2mqvvU}O+i^J!}RLL7%RXxlJ{cdM2EfIeh6Qi-U<D%
zt|#}&F4>psLm0|zKQ5TOE2}Cgh8#^_rGy2c$EVzEZRYJ5Cr8og*fHann$#pYB!A@L
z9F)}4sXXaWHvDa*?^otvYp-{FNle*1(V{cupG>=)MFOaWnRSRCeNJ_KfU&$FJe!-W
z;a8E^g*+LlLAl>QtZ}(r>rI6GDY-A|GXgD)P4oSSCnjaIAZ2~kVFgl;CORD-=yue|
z(H;rijr5>}-T5uLssNIdO@giJi6zE<Tt=*Dj;={`hhaKqMSAsBh2frk9l`z5`5sp{
z>1S1J1&`x61Iw=thxE1iM#u*9@jc&<Cx%sSWb%a`Gb2+wE56OV3Gbj~{G1L{$xbgF
zS#DVt-SEFVR+4`s20#ak5dQ_g`Y%1amr#(Zf3mOa8l38y?7w~!)ubPVpX*Z`@CVBJ
zTmw|X?XkaFD;B`Y02XMD*y^^wXY?$a8t7(ZvgVd-5kOH=Cv0ON9aR9!Q+Lsj^bI*k
zn{-?9ZW=X6EdRM>m|3I=&(%)!!c*B%lWIxY$@u<->H%YKk}$CAKn>7J@!Ao;(QWhI
zXAT`_eyghAN%n&vKGe+jW_)G<!p6{pQB068`Nl+?Ki)dj@M!frpwz`{Cq&o=C1UJ$
zBkFR2T<7xLx@5S-_SW39--?o<>(x`1hdh2t!5n=@o!ut-7{w~uZl;|ac^2I2$9J(5
zLKJXbHU^OBjM~O*ztCI#;069M3B2&oOZGkP@322w?B&XnMAkY#upXHvC-&r7tp$z@
ze;e=aMi0rvtovoQ(deYZ(Qj$7y7=<^di7f3?(7y(K2iHS3gKtIiQsZDqCEW)2*PpZ
z<|dBwnUuHGLryNr;hMVOtZs8OpGk$y&z+t6VygiF@Cb3wl`)GYyrlXT!8TeIb%QRX
zH*kYI`@~_zSlUThL@_%sl{)z=KXvQlssF?G3rKv883k5+K#fuO%g*EPX53#1)(bZG
zQs2MGsQ=~t@Y0<FR%|C3B_c{3_TCp=^}pJfFM|1fFBRE;tzGQ_I!~|+4G^T0etN4C
zTt`1!Dk(XIZP#J?yRHvU{}!&0hSbZrn<yyqbN_BOt)Q6w@{_PJ8$z=3BVjjz0aD!)
zbfyY>tUr9~Np*@0iCu->is&)-pfs{t+3WmWTWYdvK?gEX9?--L3co&B*F<M4Dc;N=
z!`}ZU)tAR&4VP0(ikMv?prS2h$h>@;J-SfX>L?K6$n3LIgnD({73rmqI><U3C%|*E
z{DkiVDKo9mVAZFASz%z6QFlRn7#A5zLouFiLh5a}OiWFQ#rI<{P0@y~uYcPH-rlh)
zlIdC+HuF2~@FSkc)9Af0Axjz)=b;-UA`7>Zb=Z1S*@$BGloNkruRy~iK*FPdA*s%O
zC_5kX*85hH_;5FtS1lq5Oynppt}h@V2A><jCa*PU0p|WS!BG5*CpF605?=m_Ec#tD
z>2@m~N+nFpEtn30EOahPa{hFQ^H?laNrhF<Ek8uG+0K3%q1|t@T16W^r5d0L)8^70
zG8X-NFg(KWH$dwuG1C0JM~MF!KT{H$I|z3eR+AD(QJOvxTE+|4dSDv!KX0xQ{E&oH
zB1xYZS}6KqI+|uY?P-w2k(&A<IJufR`GQ!Hg5V%<$+gmnPewrAc6GVxx0!zqhwldX
z7H;{d`|GxT#zY-%soDOKuHe3Fri6UmYA3QvOMXyO6N8a@Jb0i|H?1`zjpG;r`^)&{
zm`Udcf<Ia19yOu&2P-8pl3JwAxi@B$DG~NRG&oI|yYW`vW^mb3nHK%TN=puDr4%tx
z9Ffy9B~(XX*a+S<)X|*?Yikp-oLm`r+!~AL%iwWjsgD5%r@HizS?<I*e^{k5-#Qrd
z0<GQvv-{|a`GJ{p%=FrAzx{9f^f}EYh(kSdWbL%jfBb5wb$`uZjz5!81Fn=<8yIr3
zU;y>A^6=!Gcg3>OOB0Q7)$(S?7pp%nwvHlY?q?!4{0Lc!nKv5(WG=1par|9iayUw9
zSgx7jRV5;A#pi3$652b*8TyUm?@7mUgm7GU9c86Iz^~44PWl)heB3{aR$u$!>8;7S
zGoBe#W#yNcmK@sZgy3mZ#06qPbP)~xJi9|p9p8LO3oAm=-)PgYzI_P0JM0;{cw%`t
zNF}sQoaQJt@{92oqX9q}Tie+Q2Xu5vUnKI1dcAJ=hvx&(C&eED-pAP(&!nQ)&5}ON
zyca<Eo37M#y?cP`k)VVvG}*n@&sMfj_flHuKt<BBtV96xpTi70z~Fspv*Zkw)C;uC
zBQ-)Q9~}9QJ7_xI{ajajOE_ZJU~*x+b%e5Rws@t)Ej5Cq%-opmvcB3S{`!6aP`!X&
z=*{?hOLh9O^rN8BvVFx7$bIiqxML;k%MV>g-Hax=&vq(U%s47Cc88$n9V4y>Mk=vi
zV{N1KCcWA@AegWQ@Q?;CCnXZP{ydXx4kZi$#Mc*UjK80-cU>WYa%!~7`y}?2yebm2
ze~?OmVX^)~ixLuQ6R1*&I8t8zkt>&A8+zza5~HYLMX~f0-dp+tdX}Qt57pH<xB6~>
zkuGFps5Xq7bu<wOH{9CW=sY<&0cLH{y>CzAfY~vOKeqvYA^^rT8E_OL6p<1xTZ*I-
z{yF)b8XV@#x9sngAgG@`_h+1+&NkeD<Q8CcjIJoAODd%UR7pI%RPHdtpP#0lo}TI)
zSH;Kj#7F>9s2*SdDH0f^gQ4)hqk5Tq*U{7400y`tBVU^hozTyLApL$Xtbks*sXNvO
z{gNMZ?;-s|=I3vyLDD7Gtm(<s^$Gz0JzBX5iL6M}<AhYg{2sVg03WY&ErQ1;Ru>>F
znV6dPmPgjLwCrxHa)dJr?4-@4=0~&Gm_|oDX7uuc$t&{Jiv(NJ*v~y@$yMI;r^R4M
z*AJl}BRjjRdrY+*(CSe0zG3#Wl=3If&yFdJ7#=lCAXxGIB+~LqN3e*3d!Ijr{kiEH
z=D>CF;mY?)D7-f{rQ)#-Z>w(7Bq7Can)RmbsIJ=&|Ex7@=!9d6!gNg9M2Z}FapBwe
zgtVbJPXEsw)BU1drr}98{AvU5oG4@OtP`%4V_x%y-7&Mt^fC!oE;g|g4y*cI)$O9x
zZ=E#;=2rXgGYsV=CXb}9{dK#UVpFji1X72{OVn8U0?lH<*bR5P38xD%+Di*`OGW!k
z+&nWeax6?jsWE1n*ikyv-i?GYA7yjxO6yK}a{cV7bd`=C3;GI?ys=c&OeRya!f|if
zfTsv}eQ~npfJ?0o34tlo$e-W{n*oF-zXFU?g9$*KLIb=v1qDzqH#f)jj#Rv*{1RPM
zfUIW_njovT0G!EVCahIs7%wMsbmy{a^gP%+u5Zk3iJEVQA{Rv{;((1mnTJ}lXyAFA
zpD>`JWqPrw<SXg>#)Xq!t*-wYU(8frD7^yQm|D5X@t5}*kdeH3#<VKai|Sra2poU4
zQ7{CQ*5HO*yX=dfeul)8cCoD_Mq)N6rEe~u)8Ff*QfGZ)z8FqNW&8*$$bd(^v&c%Q
zuK<%NmC<=g>Tmm<L`&;%X?27Vce{)$$U3}K;VBW<GJ**o#e~lXo86MT2T3B7zR%M1
zK8uXeI2k~tT%109CQ7T+iN}%|J6l+_zu(NWjact51;di*MJAQG*7eVzijYpwFg!B*
z+s}~Lrm;zOCE?WBY%*VwaKi1=s?<Gm=GmcFcr`ek_;S~8JaL&#i0X`U4N&RpkMZV5
z+&8E>eV>ME*cmtb)2XWyFq5wIM!0z*H!w^kz0m#%f~Y(xy|?d{VbO`1GL*gH;vzg#
z9cJ7cjAQVrcf!8=e3<u0x4q2Mks!UAiwrYUx4$I{kH?ByoDWW0+J0%$mwl|9XjAnJ
zuh}2EER)!*2U;Z~%h6mqJv5KaZ3d6T2|C3x%dC3e)6=Lm{7wZbL(m2tUvGRc_S#*w
zxq73<`?%Kfo*I>i6H0qyBNZSKfBN)pVG2c{qhPAt!^p@8;E<zOT3Ws+w!QGChcbbQ
zN*~`!BC;J(zX#scc6lGQJy#ajy@3YaBqi++zNkf_?j{%P1fg<9`7`TUN=~|QapZNw
z;~c$NTz+ll*MDkg0$4>nMcl)7dp$bp0Dl5sTJw@3rPb@-&a_K?y*I?}<AmX!{tEc;
z2`jLnr@f*P6~p6f-G$D%i9O_PQmu;#t9}E<2J87SjR!5sLR#qT3h*1>M>aqGD8R|@
zJM6DKDTslkt0OQipS7y>>hV-vIf*ZdwT=ayV#Gl4a2EVP_N>ef8jj`VJypJd2V0Ai
z--mVoHhD_ae1&TN9a{))X?RRg@{mgZwdXS<{Rzef&xq}<i^c9%?^i2?R$-BlC&8%_
zXKi+nc=q7N*fzMceDv6b{!!PWFd%)Mkug#s=45nf)r1_<Lf9=4u-Wh5`Y|mgHDr0s
z*P9+E)4b6}48QG2XuO$R&f0*PyD!0b{>BV3K|}7K3FS=OgS35Kujum#eTmWaK%!i;
zqK4W4QcNeJ)#U0I|9~5hyudM*YQnl@{PeH4CLJtFZ@H6;L7bNRLM0#2Ig$Yp@C7Ia
z(cf#^$6?O7Kd9F}5SO*s1jSzAmT(d`<pdFytLeD0$NC+cALR)l`fF>t&7>wrcd}(|
zF3;)EmdF<FpS^D-#(^VfPg!hnqtbKFif(MQwf^Zux&hc7<_X}Ezp49s`FNKhT1)Vb
zcrjpaiVBc<DF(3EJ3u6*HDg+kXW0x;M&Pyk(ToP*iN6Oz(3RfH#_Q-8`yE=|ojjhZ
ze5`q?p|1PbjaEp{>FAd1+0^APpLAQ@siG;u+nrs$lfpXi1^IA4iC(PZ5XF^s?70ZD
zDmB--L=HVK(KyGgCWQsjg5EsV@@RS}a$ZY+3Ub;n8TEK_iUU_kKI2)buIvw`6SzB~
zWoi7m8*}h2^Jy>yx#4^+gD=_*-aL}0VpUb+v`OVtXD5mh+5vygd&hfPA3M*SR_)dI
z;IvP?+KJND73r6!Va<9$ozUx<Ad!AUQW7II!ZFtKFr9m@(oqdKn&Z^2WT<Fkrm%a^
zgS^6)2&XJ))2o}!Zn&4I_YWc}j|?jF3sS1*irbxoO8bI4$$N&!zDXIX^J7a-7WI`>
zsqWNcQTP%!bv?ts`JBl(+#da~!j_0d5ZHrql$ewiZno3W3T|?cfD>9$y{S*e^n6BU
zzbEh3+Z~07>Az7YZ2x&fzpp3I3<JF}+xFV)h_lb|R42p3E(lCNP7C_elo!I{@S}DE
z%!r+$SvzWn32j=Vve1pcl9(qSA^djj2nRmm8pkP%-at)V@@ZZsF-dBM4*<7`DomWT
z0U9~*(#%RkoHE{-ntENS-x8m|P~4XNqEsmE29Ngq2jCdrFJ)%)+ix%+Pi5dge7#Vg
zrB};n@26&ALT1b2m8_Vra%2kJ=1cUC8UU;2io&U22wrSE1n_QBG=wypx?+OfaFWcb
z(VHfZc-|R~$cK)@tLAYMrIhQOpTB2R3>^7%o*_O;+97XW;8SZi$g7&ojnp6@R7)oV
z$X@94s}5>}X138iAGC&6C5H!f!1vhgXkMLu&sAB#E9WC@@#LY_s2pTW8PRF;=YrSQ
zE&f!CXqApSNZut#3wJztRyuLiN&DTgAux}4{4n7a2=|9uijcfMsnjx@Ml4@$C|6mE
za~{$ghkldTpZh)y;O#Bb%cFhHOm3nw9JaMaXMA~$oFKUrpY`uRoH)vkVRGH+Ge5Fk
z3}vXBY>TGvb9dSQuuwpf4%`3`DtbDE{c{sS5pU{P1-1UqXRx&SEfMFD=bV-jeJ}_f
z#v6(d``9Xy^kR(mRo@Zh?<9f=Bf9YMHMww`Q7K$sY)N3tE!KlC)nl!UY=0}_^wXA7
ziE&}4uwl@|jih#6Yvyz$_F#<981hkpY=?OJhNDu9xu;>@vZc{5@ewT)iE^fO>~rSw
zLOJZ#a78Kg7YU_snrz7GR0?;8G9%?alT2W649YE<{9feZB<F$uwOd0?zX;#)h!HZ7
z3<tDyIJh&xb5E{-=k;4xgzoFFe`S4msV>N9zsscNuB43t3NtV+VRCo2?(4WzQPcTN
zqVsxQpAeX|X?9pac64;?WRMm?{K{J><_MS&y#Y*!%nhY3QjLAjm;Ri87DRn(IOFE{
zwjUuore`asF?-i@mOUjIZ-yvVwc47gOY)X5y{Sn0nWuE<;_?zuVC?M;-sri4NL@k_
zt}<F{600;qPLvw0YemueHLR$M#C$lI_;OD(i+JcS7l$g3Nd2?t0c?_RiF^E1Zn8qe
zl`F<bGXj2M)^$n&TOg}2?>U$ERNKJ;o%`yK!^5(W(2{SUu-KsE?9-9EmZfn1h&azZ
zH@wD5Zzwa=;EKXIit%h-xvH=aH%;!!JX*=Bl}S9yQC#qnB#L=$00LSffe$1S_lDF|
zG5|S+$$8$CSwf$?>25VA<Kx(>6YYLYo8kujgr2J9q{^r%rPv5*ReFCXIfc$-Nt`T;
zI2D%jQSm<)_>tUu`ts^(%V$8Z*)A$S;5qY@t+>vTchC-C{@2#lb^{~Dz}U#Zqz+Eu
zh;<kk37KdY26Q&@!|_aLM)pfEc>l(3pMaNYgj-e>&je8^4fU88OHVNn6_{9;Bu{B0
z$;<a+KR%yP$0?K(Q47USCXtDTn|<~2rpC8&Q%!{XkCZ~#v$EFfW^Gr}AJe=KnP?EH
z^uw(!-cp*6Vp4&^6U~WC8ULbv{}UBXy!PZ`1{0>2ya9cNz3-oKI)S;4tAk%qVf*P0
ziR@7IHNE45#1x%>$mgp-F;9=TmjsR9NRO%H*z}f|(#WI!s&0Uy;G-5Kk_4UO;DvLK
z!(Q~Y6mVf>msU&zWVgQw{FA^so0^)|y5EZeZY^@EgNk3RH5Rih(l`MD0glSQCP*6V
z<&u=OsmQWeCH9#ar$AefuO%@P{*|mVslD?IOiG<$;OWhcLwZ2f8vAZt7QlP|Ig2lL
z{Eo}00WA#+bTK1%7n?~bxNt)a5u7Cf7+<euV(tK&kb7Jr@LjUu6tfy~^0a%217$~~
zYHQ?SZ)yU3E`BgQ3*X1;sm+Re-K4*ZoZ%7{iY4o*p5zsFhW&37Lm666cTafiAf|mC
zfg#dqbp$7RYQTh8c{En$QaIq!IVdC|uAjX96>XX{1iR=br)4P&HtkDYCkMPrmCJo@
z$%j=16MlauB>m9^*Y)QC$1vdd{nfz=!cYR)F30lnPZw3~-$G-;Z!bte)C<1xCU+T1
zt!afMS6w|HgwQ#1(NgAy?zji8yRkDS^u`g|QV`Y2xlr4WYK#W=1Lsi3^jZj3;#$tO
z`=@vag~wnC78gD$5j+BxIW4_Md?M403of0$OSgpbs1#8RQgufxTSZ2P-Wjb<BJH^$
zc=Tpm6LwVft|*D=<RKP-z2;)1#jpxu?^I9U8ewLCSOud18IRhK$;NlQ;o(`dT8Yj9
zWFBn?xmog<M3wqf7jiQN)FGuV!Y$5`i=XY7?epV<<U@*`th6z(V?VrM9z9~E*X}V{
zSJuPr-2Y^K=1By-j*KFUF#QpXl+m)zsxN@zKP0f$zph5e@4~-PeP?>sofN4)Gpc2P
zD33-GZf2O|i~kT?Vy#Ll42!~_Cu#bTfnv91y9C4M2)hi8B3MbqoiZ*;TTh<2d4fM|
z>7XN{#Z-dZ8q+tF2Of<ST133ZhFg<5-YowXuB6s&C?PBAV+m!3qsxX*M<}?-P853N
z^N8ZOvO+}X+stm-b>&u`a17$mx4)7MAlNCJbuQl&RU3W=!!DEHAER&b0Sb}TuuG<E
zfjzb7UEN_U`v-8Uq++ClZ__rAaT*aL>;>&zai0)kCA$Z7fYG;?SE@+BpC<uBuWdZ>
zK^9uU(9`2Kkok<8cL$PiqkTO5_>Y3^0-^^W#}pkAoxJEBfn9Wgowt%#HLGbH49jeR
zY6e)zEAwlTp3I5l;rk+ArwUhapFQ2z-0d(X0&lfkLz6M^X^Vac(u0Ja3EKs7Y8sjY
zjGp<>N?E3znM7yzk_>o{+faw2!|5KE!GhBteo~6hK7AHik>Y4juvC>5PO170OQE`Y
z^sR&!wxgWfB%!2WZWwe#v({!wyOGILozDehb7Wg0FJk;K@rqWEHB1FNcRC}gY=r<i
zY-A7chX0dO&=<4r%}2ms=^o@L45Ho}1T3vT6HHJ3#$81r@aQ3XveI#7BAKgYa#`#$
zF&#oz9Qh`vzQtA9oDlkSunw5f#~)Sj6Lv9RhRH2Vjd_Y(xNJ-*{mJ>|v)gyCNk5Na
z7ovLOO9YJJEm*%wZ#JjrNb`%J;t|8s{@G%hZA3c3&J(s<%4<FlQF#BF#k|}|_D5a&
z{Zgvc&h60lckogE#1=bMoRSjrjT%|tR0WgboCXC|NySrsK!JUGv-OWJOl9`<avywg
zA+dUW3?^<mBIq|<`#Qh6NZ1)@Y1p_hbIVU8iwq&yo4wNxN9_JuJ9TY-PFzfIu9+o9
zmaC49kK!4p=hDMcJe9Q~2_L_+SdVSpWC3v@HQB7yN4M}(<y6c_NS^-bzHm%t>Cag_
z+jdev1)|Hgkul2&7?9%r;K&=-^=4n(uXnLmA9;C+3c5N?lW_)*68gWr0o~J<@!rm#
zab>?ItVQyZ*ZA%?E|jMF8nqOqmVY01IbY6ZC4erGAi*K`v3qV5!*=j`?GhYCv=8D}
z4cadfi$r&p`g5<)2EOJIK{kIVkgLJU5Ok(iEuWM&w}gskBTpbANucf?f-1&e+T1Id
zXjP1$&J=7qY5(Y@CwS0u5)y?&-`x-9{#l&T28Oddm@xRden#Ey$2J33)`!sTxdTSc
zvS9?t+<S*9i4%4%le@DF^-2g~?AJACfCWi~yy^@fE}PKP1#XV2ocx2bDN0UpkuvgH
z$jxl|VR=soRLsxRX<2bHf1v0yhWyh;o5|!tAJH@NI|B!bGq+02sbfY|(|axx{l>}J
zyfKDaoi{m6l8J&-xH&zXB>Kxrct(_i`s%08S_uPY*X8QUS(w;hLVobdj(Lfo>f42s
zgu;gA)%JSd3W6P$;m+-zJ_2SN-%aSTIXw4DSRQyEg)sU6q|3xk7!680rPgNISk<VV
zf}J11`0E90dbJxn0aiL@1pPPz&B<TisD3#7nfT*;igm-9QDgHLZKY2!TEu$zmkD`Y
zrH!=@6&X7Nzdx^IsPmwyIj(u2b*;$aR0t37Hb1=Y<FE$n`|td=djAMdjDMMuM-gLF
zQ26|tBKrOozH{L+_oMgaAMLR}4IbpL-hgaK+y&Z~#vPi?1(uHJmuMeP9lZHREN9J*
z$l#<PSB9k?B~eADa<#X=Sg4snQlEpV5uue&$56*mQMaEag?IqvzG+xh)rrSHr@wqA
z#9GEYH%0w#MOJgapWY&PQeXN!<<(wDF#CH14q=>&jBRGDp4@6b`Kt^#qMt9OI-;JX
zKly{!7c#nDpYQhPv))U5ecBO;7P%|`oWw*l4Lh3%GG_`&ZDTkjLIhz$YYUzI^oA4T
z+jsim4mWBSM@6{?cK-~cEZbqtAsll(;z7mMg-9dua3aSA&f!n8;23kuU8ETanwpEq
zn-^sjHF%}#$4^h(|B7wFgd$Z@zS(5CoQDW(Vdq54W*kyXl;s`tlSaja$ghq9V!gtq
zVz2G~ThY};&3sG~fu}Jk{yUra*-B#g$qwn=>7<kuh@O70T1vx6K$JCy$iM-uRwnAT
zyU|`U@?ou~fFDIEs`>#xXKg$zgoMi?m^g$z;7Mrsa|)%s3MF?%sN&LIQ1E;;)fC+^
zcHi6>5*h6C{NrLlt6cEgQT!q$YMGIx)C^lJc%&tF(>k`XvICi)KSFZF2X*pZ2YpfT
zsS~S0<r7li8ggSRF@;hE|D-(Gm#qzgI)J05tvc_o^3GD^=(Q9;c-IoS81n@|nqWym
zdA$l=IBgvhIosI8E}<EnD_9NudX8E4LEb2b@sqsG1wX4;+T0({y3#iC!L1zV&xlao
z-k+$>Hf`);m-(sUSsN6lnsL!V1_l^3Vr+hPCn!DizY|Gg<DSra!~Hq>y?46(hbRkH
zr_Zz(F%BP&M@a{c`o5+uWqYB0eRmW!_jJ?!#lM}WCRD#myZikBd!)Hx_t%`IOfRAa
zoJ&o?FN;uEPt8NvmhJu=;r3m9k9H3opC<JNv=Ggj&CxBI_dFEy+j=b#Pg<CQAMAs}
z#s;6zk9ZC|Bv*aI&@!Jg(K4Pgt~32IuW{$YG`if@RvhguId;6p^8ECe=R*Ov*xp>-
zkfk`?+@(}6bjzbBj%ef<T#s`N4H~WTm~IrdE2Z@?<@wUc57*b2ib=OOZXWf~hsx8^
zdE8oG-&LQmL$l;^dr4_B*E=HIOO?~$Mi5f!RW`Q24MtaDU=deNIcP`Ri<C75k8a5+
z?H9}IT{V=KXKxEAS>VPBPp`0X7%028dJjVis^aY4($9O;i83fz5ePNog0>cC(6N?7
zkB@YCy$t8)Mgl|gvZe9;auka7I+Q7CcT3CQ-VDGRT6d;o*qu@ys*T%Q6CmnvcO=e#
z`%pR{Eq4+8Ng7HBL9L{Gmu7ADS3Ev6GFS;EyWW6tMgwPeKc>oN!|N>|aXNgzpKs<`
z5$HR?-~3BnoP*6^`L!RxI9nAa|4R63eM2RC`s=B0YoX-X{#tdPNKFuG5-<6wozC60
zbegIS$&ZVs<UmH+eZR!?Kp>gwmQ=s8`84_)jFUl2uk0P?IW6r%NLf7HvH%}n^5$^L
zPBsaN)9nQ4yTCUUMcyQSzY$-MAIygjhf|XAMk-J-zGYv&9QZG4>LKZdh!M7a5&}Cv
z?Uh!1ju=NAphq^8AjDZb5D2RB$5}I_?=E#xrGR1&D}F?D;`(bl`v#*WG^pP;6A6q}
zvrkhy=LoI;ME~*!)XxIEi|K1oLbp~I67cptYQqWDf*4OCo*?#(Qa{+{2Q}l0RoK=H
zB;Z}G39r(7*E?WaaSgw#{IeO16~T?OrYTsG{)&L-<p_WSfnv9WHb6$W!3MS${I#9k
zG~ne3{KsG+k$#ykJNoB%_o#17>8Iq5mj3!YU~hpjnUVx`B*5-XwReOvJl0+N2MlQ?
zOkr@w0+@-p_K4-)L?-dC_V*^f4h{cCM%YTuYhff5^2Ubl2=&H^hv0K+10I4;>r%`Y
z9{l%Ju?{2Nw2{c?3QkU(!NI|iFiES6{-<wf;5g@&VwlN+U*mH+#KeJeNsm;xEX*^r
zL@_X|l5c)<z1u1+Oct{w)#Em;B{E05a7sA;%w&$X+XL(Yp)YNw4~l><g1tJwL=fz}
z=WS4Uc=g$p@vH7P|Hgn1-UbD>f*A1Z2kU_`-hyjI<mj!Ry3oL%_3#?siIF<JNni$}
zZ5B?^wJ_T`?>(GsObq~H9a95^htA>E*>a^@2;jSP=|33*g)uVeUxdJMmB2pYvR-zy
zF?D^nkAML3%N0y9_+&lI2YecfR7@pRP3v=AaCQ6AXUvb=MTWFw(4gcA{-c#<C_tmM
zFG~$!O8v$Ma}WF7s;s3FSp++<EJ?rt$L+MICzrBEfenGDpK}F1osS#B0dCqhaU^GJ
zK8u`V>G$Q36N>U*L4fGEh&|;qXULXf@0l{)x?morzz`m%^es89l^)R;m({-ut8st}
zWRg<F8{YFS#~vKkL^5bJ6$8y=fl!-qpEPI60_T_@aT$%w;A>@*_9IRr9?s>tx!Fh}
z?}{b9+Z$f9_;GkJ=Hdb7YE0mWlnNcR{Bo6mS)I^5e>NxOyTA<WuOBhXe4+Tq*EOLt
zUc>bY{@ZmCBLr7b0sd6lW+N_`;H2h-C?>?@HndQ7?q6<?L!QsMR_BKd0r6c=yOVca
zVLb1<V`K;-svT?A3o1%?_#F(FVg87X40Et+U-{>Ta$f0bq){)nR$GX<=lg~oj&mF6
zo<_R}C%yTI5|Qd`JuVV?&BPb!!Y_?;5BLXXZdR9I1P5<MDzVb6IS~&&Um#y(;WrX~
z!o9TDo{~WiVwaNV&EYRC204-KykU}5fD^wn6{i*B_SE~);HQ<L%gGvZjwWxVQ3GB7
z$tS6u1NE2w+bQXZ&ki_Ic@xTeY@#sSs8sSh*3^IxzyKCoy|^7pZO}(jYmZh0ez?Ut
zh>1w=aKNNP8m8MdwOKJi^baJ@Ia;ct*W_R7(Kl%t-oySbacZayemxT<Y39oBbHRH*
zM$HAs$z)29Rj9_AV2&2Zj%H+TVX<-1Ru$Q<g@VLJWMUVQc7qPPoKc`jD`jJf+su$&
z#A<_ppZoO}251AFDrdZMTDo8?-4~shN#E8soH>b5`!<yF+8xKC+&<{dntJ5&x5B2t
z39YRuKH`7wZazfF8q%X*L)}q0KE9iGZS&=gb4HT}PECA@%tDbgnXkzoDAB{5TI7kl
zg|6qox*v^o$$@D%^$DE(F5#k((nzr1+2ksgpuVK!D3Sw#C3TKnF&)jAfJVgblFiw-
zjG!9n!8&nxgK_V>{vENqXe4kC`lW!Hf^`V`SBM?3T<)1d97`(1U@B@v7ct&}4&WDI
zSqHM3-qdFBrOrV#=l2g-g<_xNa%G~6Cz?~c4kGXsu7%#mkCW2_Te9wDjmNW^bT~ao
zdm!rtEbt<ia^@;@V?~-s;M5+v18TC!O0l5fPlr-FNsO`&?VIK^*HRpvCvp=f#wFTO
zRQBH@Zf^|gLC9{!g!KV@^yAIl2k$E|iHyVSwQUnUEE$5OpXwfc`CZiQ6^tV#ZVZOy
zw&(gHb=uKXI*y&n45DF9EUga;PHpTWnvY!+e>j+yoj_L_)Ik@rhYK1mBN2e~wZwzv
zTfR+(QZ+sQDjx9Po6(n%;G(qc>EGAds~iu1`XZ<}d=stmqmJpCJ;&;E@!OyA?#>97
z<2S*zis&HwCa<lWiAaM^Qk2{)=f+wzJZ<$}j{*8h#QL7j3cS|bdaMeLkJ5~|-IBB9
z$?jf_F)|Co(J}-JpQ2<IB=_{*RG~bPpx;S)u+C$zT}beg^Usk-p49cJY<Bhv>zE!H
z;?!UDl>hO=NjeKm8_13fB#8a}M`{`Nr}^OBQN}*!)OI9Ysw>w?D_0s8<HM~BSq7UY
z68(S{?60x2q+N5?L;jx8_*ukmA+z}7(F+Jj?L&sIAq6l`rnLNJ8d%OqA@HBeL%KtL
zi$$+~YCm6et%|A|tk#ElU_)n(XO?@b$GgEY5K5D^-gto9cuml7>}SDHdk8_)Ziy(C
zRu=XS<19=d5UH=D2gRF=ko1Q8p-sKo(@U4XVTv$W#A=>gn)A1&RYBH%cZDYb2d$TX
zNDc;A=<*JJ3$OR6*UER>;*J;I;6_|2L;3hB(pYZS#W;0l88SLOf+;OC!xEdsKa!&K
z_ef)1xZf2>Gs+n`;#g*}D<rg{<4Z9t-W|mHwf<TTxz<Xnd?u)}P3xG03zJ5o4WZyT
zkgXqz*K{$ATO!}vuMCO1#Rp^QwEMfjna1cjFRs2C*L=9E$NPYvP5D|LqQ`7Z<V)%Y
z%RQRnu?~?$bvu^S(ytVB$AfB~k(%1>F0}pFUl?Qiy}wWe5At=b_0CO}m&EKRx|tTM
zTlKyKrgTdW-f6-U_8X`E%Nj9^Y;zdj`)L-~FQNq|7sB`OE9=dtGQWrXMe%>m^hu<B
zz(4_wu7|dOpF_f;C~!QTgQK4Q^mNTajT$HHO8BG2kj$O63*-;PP>4qmNO)n1Updo2
zb#zVM;qp{I$5DQgZ-0qs4-Sx2Z%lgn=GN)&J<BTicMTQ`D=~rr>GKW<*zRn>skWRD
z#EvVairVf)#O%qP2K#qDGGc4><_uajDP6SftWS)wv8;)pIWE}NPd{oXdNMV=&c7pC
zk!)$F_J|sb9kGokX-$7~fe^=N8h@~ie&3#gK==K2!}7=ym(QcHp$Ya)dCc&Qx+g4|
ze1a;x^RZe+CZXB!XHsr0cquP<)mSym&L>vb(sX0hc^dazh3NsZE#j&~cRuo6Ww|}-
zSP#k>yyuGB?qRm*Z4bVcPSneLdBGgL{xxM!Gl}|a5z3Pzs?{Kdk}3;Cg8+0*xe2ZE
z*uc+iTw`Nn#^wZp?e-VcpV78;YdN`kl12rlr_~=rBaz+0&2&(8PbGgGzat(0DkG^J
zx?E(QF`l0gGP0lxHNWv4CPQKsn#rboB!m0sh<I=Zk$I)$D~SX|t?pFdxdg)7%X68|
z4EDlqbr~Yj%QtxrZo#6zl$HHOIws^8@=1&4w_C5a`RBMA_v~a>!S%NC=Wc2cWZn^n
z^P;zrY0?DGcg_Eb<|{<iN@uU=M&w#3&+ie2mF|`0&ILBFrdnO46w0Q+2kg80-Yz}~
zlLWRQ{~K)l9w^tU)j*?6V)~r?gfsuOzjB&(nFZ@;=(NUC!gVZ_I>5sqrnd#1DL(o}
zQ-_VAdtSt8hq|ej7AYp3RSFPsysUq(Khm0%*RdD{sX$o6Yed9~2~ILx{wZPW+<hd+
z&2G0Y4E~rmG;nwglf3tSC7)Je_^(7yHBGyTTi3sq$r#NF9Yn(dWH`n2=pdNF82ag1
zZMdqS7ST-dJRMC7s2XmOP_1P%x}f@6k+L)9=Kf@15-)DQ78rvV))5HKPZw0onf1^>
zd>?pFqq(ec8&ZrDQ=x6syY#>uENaF4s3(cF_qNFCrZ~_h(dOQnbfgWtRI*90DWF6`
z8%n(2|9#dG7@(~`5sG-N8T*t2l><E|CuH8QbpO}}$Rk7cPzTiAJFap<f+{E=k)`$Q
z@J1n4>@Gn1H85~32_#{-kP~fgX<haW6J>eS>e;5s71%%Ak2&L}v6RjFPZF$0MMzh^
zHyhSc+W!9HKD^g5_+hUe*uSC>urqph`_}@#0%w3;+eX`NUZ2S6*AS%?`a1gr3^3X?
z<{mXUs=o57Po>}#kicHIgtLc5z_5Ry1EcZ(l@uCa(4m78@F6Fe>9K_Ndl2_yVngqJ
zI##_##p%mEIjWH7j2wx8yzK|T+mNw&*yIdQ=^uI#Nq$J@Fp581s9|XihJt|$S_jsd
z|D3x%)JYLMp*#UcHkeGOf-6QtgN$$$p~Zv@M?^$~n)ZA@8L$E9p?5p_Uy=-HQHqF=
z0CHuE4OSS@(b0<-++u@@)+L23-E=y2H*7#=8hmCJ9c}=eMH6=8E28GS&SyfYbl4~n
z{sO*RT8DXzu<D5u`my{9bPxz+P265o|Nc&LYR>zR`o@qwoj_q5$hTt-hpL9qA(){}
zRqVAAr4hB363~ViNTA&6$i#0!z#2(?lGU>li(i?^w{B=&18ukp4e>rQ@sdVE8E{$i
z7Tl|k&`yIF&8m7VwB-t7-Arky+mlk3?}pB^ctEsSh**D51`qP*%i<K|A;TXkr!JU0
zQa}O$`c}O_hc9|<EdmA+8Tv|L6EJT8yk1g@2#z@X$;im?<GeTH1kUEPji`i$_3H4B
z6h0Re1U>~yd{`lXWF^<}ewLrUvqU<KPRdC_@xjrS)4-U)*?9BL?^L0>jx{}&DN*17
zlH?*zPUm*J)*yPw&0USxJ*;ooSE2tduGKXv@dg#c5LAW7*x?7GM1WzEHzbVMF8tcJ
z93ScY{1etULc42sWG8lZbh-ET(O)i=Zws~^xW0^{IG>m@LoBFsBuFCAbunNnJIT2w
za^nW7;IYh0R@CBg0(MX@Mu{m?8tbovqvgRKQBFaXMi6I&dUa@nT<(uMv^3iXXy#k^
zJg-usvYl?Oh~71WhYKtC@phSE6Ne!t$94EKH}tetsgjj}>|P_0+vXj)zV1k6*;N*J
z`vbl3{dwYXGs{|9L7l}i!9PcLu>yoJH0$#}$UUG-v8m?^23<h3;C0E0@N<ORu%psZ
z7H`78QRAks_C{?oOiy`Z{9DOD&asCq-QQ+&cYpXN_`X`m^JIykAYcxS1WTGUlnwdq
zUbH;rJ_==iT=24VGdY}u?{#*5kCAeB+$(L~-%4E)A=LvdJ7&*$nRnN3C5C>3c-G$S
zNe<3(8S21c^apm6h;C2GE!(cEs}`W)b{psf`{C{z!6Ad#b!yl7e*dsx_0=QAL?YmK
z5UP+r4V^O|W1dl1kD1VnEqUyQQW?2P?N=Fw3?A)rvJHevEpX4ohvE&!-qZA2Yl>Ot
zi}gNkO*Mt4B?a=Sw3bgbwVIRWz0Zz3a~A_}VwxY7XEo{m@Yhe9CiRZVq>xC0AW7n}
zt?oH1<$1M{^Ko*PJ?75$;Xg`S&X;X#r~pITr%w`}E-o(40A674)KsEau&R=hiG-wb
z+`D%lczH>|7I}IJuQW*Z7F+vVm$c+g7d{ogT90rUQD$hI%hg%H<}sV0rcA{RQBf1y
zW0wd^-E}N(;fDcy5c`x?)8>9L3)dr#%;kO(Y#~QV#lAxRKUBR1P#bO7E{tn&cZXsD
zin~j(;vR|>DGtG<xJ!ZJ?(QCnyEeGH1uxoS?MdJ7JO7+NGnv^*CYzbvedNCEcDCsG
zVcJwmd`mK^qWGJ%tKrZLif<AvEw@3{REm;D@ebY<dE^wSp;0q0p#Vom{AjJo(^LlE
z3X$Hldu&tXPmgk?l)g6e5to>%!uvw&?obXt^RkNpWlcu8=fZDr8yKPlzN8yUv4ijY
z+}i@h?>SzMjGOMWZmV5NJ25>@C|ntP(R0<7f2N*b+~H?rJ2P|TH%hMHVKteayYgMs
z&!>V1$aVMB?>xQk6~S*oYWXGTF!tSBD04?AkV@nef<Y#7!_~Re5Q5cW%l?g?ph+!$
zVK*CQ*>0n)wp6;@g3=5tO&2eO8rHxYcx>2oRm}WJT>WGH@I}k?&$Z;ZEowSza!y&%
zdL>D=|0*NjoC14-;Oh2|&%$Y5D2<A-vs#iUI^YMcz2)A&{H70!eHkBLQ{l8|P163*
zl;sNy*N?{aJLmf(!%cGS=vxQnCp~0re~%d>cYJ~UqK}|A5aI8`A|vk6Fzwliq?okX
z1S-lC*Y3EaM6`bVf|=Ppe&F>2*H}+)m`yeXJw{o|?F;?~akYoPleb7yl-C<Hfx#@}
z8Re3J*+Jhp^SncHBI9si9TQUy#CpAN&|iFC{x--ss6KreNg!D&QCs?wur2Y56nMK7
z>;355%Xq<pW-Ig{t1tDyDDbE9IFEi(67Ox(u=|%kM1l8rDZls6aT-Vkynk&=4m#)k
z<quSsSSL~RxNiUQ5)(%iDm*%3KK1Rxj_-|Z+~X?g%PCI%uDqKXHBuXB^J8Cq{vW2i
zm+7mW*-r>RYPh(MNP7F~^Iq9QuDzv}BQk2ePb;_kHa0>I6%UV&_D&b8V?-(5va^SF
zcZ*X}Q9WOromH<qd7t$p)wS`-nI@Bny)qLKxF}a7FCX7{B+33r|ELzxlSh3AI;Q)%
z;%HUtC9D2L-WPtsf$&P-K`ruj7k`L@8(Ob)b>4~D9p1&`UWa`*#?!K}2vKi)6I^G`
zHpiu*Q}SbrAZVcq(6W3)U^^eA_<M#9A|G39z3hRloz#P(J^H~i@fWCd(Uq^4+Of5L
z$Eg~p`fI#x9cx5vE49Nw``!TtDo4y}?2u)(ONCNgD0L|N9Etfkp$G9vPB{<iF+13-
z+;Q<^QqQ?6>0Cs$QhgVG%Sd`n7eRB`XBndaqKE1$-I7H0w~_Z#!q9Im%`tbpHk?5f
zz4YSnJ*@64!mSI(J0{V%Hp|{-{Wnxmq7C@j+TN}Uim+whq_}Jp6C83~fBYpO^_`FD
zGRoYRRDsIqQ$2T&La}DBhW0aq$>)IU4d*Y4ZJm4LJoQO|U%VB26MwX4S#IQiLHY3@
z_44a)AfjNQU^U0zNXeHs?C36)GRyw2B!wv|44TviIu1cxwOiJ-mU^dgQD^f%=Qb)i
zeD4pO1Jy=^_CC37w5x7Mm^b0YI;__Imh^WWc%u;U!~Am=e_E3L<MQ?w<X-~XaXu&c
zHDN=^Pd=o#!(YZaFRo*Gdg;Dk%w*jEsW;PNNCc_%T18ae=0%t`BGaS2omJ9@Qel`A
zLJuBTAomaKy+MAFME-M<qxP6(bTvQOUwj^f!Z!0lcz7lH=`;2hZN9*7Q)8k4O&j{O
zdwaa%a31XY*pD&A?0+GL5cb^*NiCP%8=E^=#K0u<IpTk^`R$2cUSC%eA&EeS<oQKc
z#6nc}F=Y}E|3Ok+>5*Q|yMTZhiSxI(1!oU-H7a!$tu3HI^#SSaVEJU_4_pj=OVM2<
zZ999L*mtelA#|}I-9ZVqOlpkSsrcSP`T));L3|}*eX}YL#&w(Aa`xDB6Y$rWHR1IQ
zO?rB6J~VJdz0x)&FR!F$Kxdb%Yh@LcPjqxm0E+-6MFP{DY|;6G%+$iY^;!AAv`d3V
zRMvtmV;Tm8p(EOrISG1!-?yNbN8oLp%Ik#T*RZ~8TEgy_%Fi~eb%)<U4hNiAhP%g=
z;y1z0tijSFmOdv}mjmy9Zbhri&PmdqPne1DCk@ZjiU#pFxWh75N7IG(%9JqF)CBMD
z?&+O!DcVY40He<TOma2UT=-+}Jbt5Y8J8tqpoM0QZ1X&}Fn~DnBDG6tCXbB*v@z>v
z{1Lx2&e7-F!w2#ou_EwGLwEx4nrGI`H+UsO^S`w$<_#ZraWqI<$o8F+p_m{RsQf}U
zSOzCcki6JU5kx_+`)z2%;H$d;Z@{KYSqY0SqrAPZ{Antx*EET&2Vyhc$Ig~JTi^m3
z@P^>`Xp*V&2HO>yz*`lL<Sbl>F9kc)QVs)1ux$ysAIc~nXK@>d`*kV3+`^|#`qUfu
z*Ku~>T`)F$iA_U=J0S3W;_Sd1`}f9+IPr<^^Wn#VP^t7UyWTJB(NfFt^*?K#<igUi
zaDaJ8JAr?@SjNg*Lua$R%-2856`Z+$r+$Zw`Akg%)j9%sc#Jdf+$m-%e1}?&pc61R
zyws8LTJONR$ZV@@E!uuA!9NkLa^3;?V_?*gu=#?MKo5-XoEO>Fq=2p{7F?!jf=^aL
zUv7k)bTn;~tN9r4NZvUmU*$=>LlViJbbT4JYZ>>Agd_3L*Jfoi>OzB2dg!jUp8=tR
zH<m(vr;MjeF-T7dzBxj!l!o%HCACO^Q)<3cqJm1<2!Jc^jgw$f51^!ETc$mZvRONb
zKrxZN{Cj3=*KoX$=fT@K3^vFnECP;ey8}~Nmk!nrEFo)zZNrJUIJVE^I@MiiY9`Y7
zHvlv%#-+)bKqV1p%#Wa#)YB}1#iC+lpq`#N$=1{je>@+H7B*g}LXWp2bB_LC1M3ok
z9942dViAjcFQlB{-VBz{o0l)R_&jHqqdH}^c#eF3*x_29!~}`Wy4w30jQEz(F>8L&
z#0Ta-rd06x#9F7nP`s-SUzfTpD<#E#J-~$axIe6k2LtOh=l9c;dXs|EZ}Z;&UUdEv
zT%Y#2c{DZxP~X?8fDJSrdq~ft2rW>TbfAaaA7rHSj6M*3cjBiy+rivs_-HXz{nsjp
z->bj(ddR+>R_A>D23)ige*E{5Z*uWn^Aqa%sfl!KF<|ADHSg(G(!BRXc1p}LxKzIR
zXGA7>XdTH%AC$@Qxx)h?vB!m!j1J>$xKvC^%dMfIW^1c#-lO^_ILR+JWI{S?v|0`!
zAAdYaVFTkuyp?aiSZ(G>L7I^ga=2|?Xv|D)a4sIXq&YVU@frq<X<n%FIdbE+|6KZ{
z&42Pb;C*>X|IptugtXf*@@4xkmDn&6IEG~xxJ`z3#ly(`Tg5g%GwS16K!3qmykMR+
z<i4I|%)r3ReA49m&jkW+7Fz^qEduYuFX4YV@}CT3mX{Y#iX<0c9+j1L=lr7M(ZZyV
zx>-VG4%cZS+f!)cX#9dZzqk~hp>Sx@;dJy>pO^N#6G{=kMkaf%BfGOP8Zvx}48LSo
z21!3nEqx>gajJ}!$0AK35OJ~pLlGg%l0qT>FC?dh@szVvO@MCojDgPme<aR7@<zl`
zbCIwif;X}*iRgcB9}0|8duM_8^79vu<<Io!eS_o|W(2Wb(p!APU;9i9fikc+#((rn
zHA4DasJY6CA6{MXfBXw4=zegS7RI1q17)XS)hP+dvh2wy5|D3BUJ^4m=`9zDG{Z+s
z)U>#re@u)b?LSOWXS&ed3RWlDFWgy%);ZVA|D$A<6QwA@)Ks8Fy~XC7IvNBJ|DsM|
zPgP7UPH<hD^|vjy0ayyI%f2=12@Uo42snLNEVeUpAy`kV|3PI){uSDZ`Inf$IU|$m
zPW_I%=QRA5Z^^RD-E9-6+z|O=i3xek5;mOqb%w|~r(w^v%S*aZre}>YdK+n*<!&!W
zwyVURp1fxn{lvW;kd{JXTo1%Z=2wv18gg~#O=g1lCh$#*$S3iy9?d?PRyi;HYWVW+
z0wN72B#KqptPA8*jtslBV;-=15T^iXX4}Ek7}>zNKuB`3eOi*IAWt}(W>*-zbr&ov
zi{707yVtRd(HCS<ZKpytTB}l)Z;(Ym-O$~mCX_zEwzv{5LV6UUOdE@U`TCt++E@}a
zdzK7pX}$;N$gU*m4bWDXs*Oqbsl<vsEv_sKNVs<?^_f+7rb<!syw*&I?$~oXu>K>&
zVARvo`-z1W!urH7MD_80lrIywfBg)4Ut0ex!~J~?e*NLfB_8(C>Q67~4W{f%;`5X9
zuls7*mu2TW_NgC|VSfi+ZV(?k>Ha(iyq*WV&f)$g`_cW&Z)jx19ZFuaq+;MvsX6-_
zWwF$(35*FSHwl_d&aIie>9xfBaw0atbuo~ZLgHc;PQ%6&VB70KOu&JVl;%d<6N}T>
zxZjf#_wDvL$;}q|Ay<9m$;@km_@T%cgqhG!;p(RS_69j%Ot^*EZ$G7xXDWU14nIAA
z^kGFVhj#tf)tk}PlF6uRFPT`7*-&-!6B~Vd{>bC&nM+Lr{+8+F*DP;*X^Lc0vszG#
zg8!V)N;r*-<&3(V$#)gnQp}HP<?<TU+<`evdjM0Zr#z+eXqCP!DQCV3-$*I_52HXN
zc?bEuPDGdM`{CqbWN4a)RKS2gf~7b&xg<f?Ox~#02b&gUktE6s_(UQ<7YBPG$`^e)
z9w)&UPiuUklOb$L{TwBwpmJHbusL<g_?ywrFh(Sil^rD=xEY{oSbjGrwmd5R<%WFC
zgNICNRG-m2e+SoQ@V;^SzHBo;Qk2oI{Z;ty*v5wYtpv|PwCmj^TS5#7GvQ!h9(&j{
zf5$iD0qb`Uvgy0z0<ukqGoKu~G@|qn>|=pIS7rcq!o#I4J)C}?4{6~Uj@ea~6y;3y
zX=Gj7lCSrwFYUty>x#Fdti3y?x`Ow<nFD3fSpJ7Un+gY`bs?31MRLSDDV(bJAuy0B
z_H38$1CWBkFQieL_zv+#rsm3v*5ZjO$kzIAV13Hty{Ph0bpy`Q!#Ye?(M)pt+4{qg
z?mHZ!F3V57n+-+VbyG?2(gV5DIW-!2(|AOAxITGWC75}dnbJ4wH&PM*S|{F}5_mOb
zY`*j|NZ0L^?c&gN2*$N`KQgm!4n+0HWOE1!XTv^k=RwGbf4bP_@7)drMqp5IKfgQU
zeda#n@#8&Xt3j*}v>$BVzReKNXwBH{;?or)ae7?}Vs92{#=NCGLY`_a^tt5C*-Zk-
ztJG~dk@?yaG>R4C1K)j;p0C#oVAC_HF{}1_siA`+JCvO@w$0RZc4!Auc(K)+E9{Vg
zz71JSetJ9$7w|D?C@ODWJXqZFz>-<P-y~`<PLEpP*LzzMOs|()Mc{5@v_F&kZllMO
z+G#eOj#VO>AN2=q`*(PG#X;Af8|XTGEk*Utw4nEFT;_IDfCEDPosn6zbET=#+PU?g
z+0H@Od{Tpl+`d+uP)3*euk9r4DOIGf650O4jB)%)UCUQ{(N1+#STlnCqf~;QTgmXN
zw9r%Hv_S?jjN^J!#ejZI4pE;_>GVrg*ajOm?=tA;dd*nqDr3zp`R&~R>B3S^&^A&~
zD?6~<rv<(y8bz?`Rl9T-z-20?oBe1dKS%fMPbj`wemZ{x>VIHhap@`}izj+q>3)WD
z;J0BY)QZcUxt)D$8>zDt()nPok<vwCYRt7~w8ii6upk><LgBRL88aFqL+LUv+pQtA
zb4?!#cva%lLSyTVsq{66R(wY|u5d@HFmmN};(Yj|*KgT|5-jw%KW1nY3;D(#S=V%T
zagcL8HZ!5nQVnoQzTM#LOo$hK7#MUDP(RonzHhF^P0<NC8u5kNaRn7TnzsD^=C>G0
z(}P43*j{Ax!>@Qy^kkA2vld^E^t~NgBD-ZZg?O&C@VGS?U@tn;XsuFpkc|a>8$TRz
zpuCju&|)tCVR0eOaD7F}bebC2zSH@NapUDjm##%7ychkAeq|-1Y5FUAlHnTLN0!qH
z^@!I?3Wryx0dj{Q_N1_l{OH%*d%>R%y??_u)~J_ylJa7xTcoEy3&KyEnn-w{#S11_
zsIk?aEV|=>O+1rI3CkX0R|BCA{fo&8C?-`9`R%T;-x^w>tXDnJ8NV$+zm&`if&eP<
z$k2;#uuL|}uAA&6@{9Nv5gw$}bUY=RUz*T&+d-y=RCmO~bH^D_r;h042!XLNU#{SB
zO#2I0-Id6^E$X5A)}c2lH@P6Mq62T*gbmysod#rb`If%Vyw=9`3bMO)HC-EH)YW=c
zxr(s{G2Dpk$e`$kX;11b+XZ`W5Lt~y(4s;DzfA;D$#l4jfiGpqk^o_zQ7~-K8<-cN
zo1?C_cO&z@(JR)32YR_Dm;sGA87<JAO7rCj9!)-z_aH&S-imZn8Us>sp+@l;atJ^*
zN^nO<PwM{_TG+|qpP+*>AM3*^8<8#Q$Ac%_Vg!sIJiqm?&k)XRnd1^HoxBxCjU28v
zGq;WzI=fkZGo8be&spjr?85gh)P79iVN1biH!!n{AkM)bvWA5=*=%m-2%lX*s#mOH
zl8+^5NkA&>vwIpo$SuGhN+A3p(gCtRJfbDEVmvsoLHu}+e;$1o8XZoy*L+!^$SnJQ
z&xtgP)be)q40=X9I5<IisUj$&xS5bsilLq3)wEF`F`&ZD@VuIQs{+0{^k6Nlt}e!=
z!}jFn7aV?^!bdVB9R!$h#(`?dK$+7GQeU%$zo(zm?~5ii%@8aTLJoUXuz{y#XS1xt
z#lHvONy#Y&McpKa@X_n2O(P!<nteGE`VR*+9X8o57#<XTEqkK*+lDwsg3oH9w$2I_
zUC7^M^v%j-385;@ABMw{uWuU<4N&Be+LS*i7PP3LN&BJR#gWKrXa^OjU32KGpaTg;
z)gmh^S&xi68FsCijL;lPb2s1#+_nza)r-_1F=bg69ioN<BMi9hXGR+N?zrpPDq}0e
zlt2n3Sq51L2{&}kX-*+Ls;EbWw3SZbH^y4dg|wbbMFdVf(79RA(LXw+;U5PD+q3PL
z;|14&t>lI#8Gzd*55_Ew60JtFzAjk#O52kNDtz>E%ZH~U@ge?%goND3$0WEbU4mUn
z%-`mRd=J5HZS>*1ha%al6$W!*zTmo??y(WbYTP@Xy2GP}Um&gHgM%V98QM4}hBSPQ
z<acjVnqF<Sgn{MgxA@T(OZ0w3U)@lO#e(ykQhu1~OnuhLY#m#(qR6dON_SvpP-`kb
zqkpU!p@<xGWjtX6<Zs1=k{#mWkKv<*-K@qt0O6iaX}Tb?wjFM8tV~!O1N<HI;#4f{
zVs?3%3O$6D-=gn8?^DiGc}cUMZ8#>{S=Zx-K%zi_+057&rtq2(<~*ez!}pN?_c~~%
z;dh`Iqia=No^+yGE8pKID2zuH{)$n3%t$gYWVUFyl3tRUl(sKOZQx&-z{d-nw&ueB
zT?F_3Bao5)!tW;^<iY}74(Z(X=KIZT5gVuyOan&gq-oLNK&>mJHer*o(_Ml6-|#)|
zle83xOhcofL8-G<0eh8~Re}AdE3crstt&k6lTJZ(By2bRUQz-I{$-%K_>Ylt>63q*
zhIsr?hG_je{!cAM3WCY6`s8adjH-?x{7wHM3Qsc-`G<R8afB|~C^3h{mhw|u@}Z~2
zVMi_6pupT#nHY)T+yyAdtB+4E<<+j&?F}LT!O}Ro{i{Gg`5tjo54!Xa5`;FA3&WVg
za9ak&Bzq_Rq<<tTm_~pWh7T;I+>^fTi*+czGB2@Q!bSwzkMZ!`ms>E2H4@)=z0-mk
zVc{IL4k_;#A$!ev4(iDA*Ys&XW5VnuLGlA+)!-U#b{U+>ouES(ax`EAO8~Zka+>l^
z4DA^n?T)+ykwCP+mMDseijp6C4H<|tn6*r9YS1FXJZ94225X{ll1qi^qwi;KC`Ks!
zh@YJc^eG8C3J<)2F1bMD1!tRZ|6Qoppjhf8z$fwUo6%?nBw#XttYl&|c3TjHF6Yo~
zsX^a8SA_lkuT5bh4Gke!?m`9|hyjz2k@E-WL)TQ{l$IUvrxJt)L_zd%g42;7BdAoD
zP6w@Pv2y@EX7-7a64@eD*rIWTCzaDPB%TH|df9OW&Z1cE_bdaR`TRvOj^-UJa3lTX
z1`AEN6h;@^t9k^)*&f`ce#8z-XVUZb0LnIUi-cz}1YOL=vN@D8iaYa06GVx{t*GyI
z(dZG)xU(nW(ac#$Z7&VKo9N<-?#ys26bi;j@~Un6T~Z{b^lkfC*L@72bMG>g;U<wk
z=ehH^FIhe8*&`M=Hf&U5%3hHfy!B+#I6|u3S#8*;i*9tc!9fIKnjK37!@=NmU+pPO
z&B*t0<ks~IHZGrfRMPuNLIF)6$s+7mXeZ<*HyD@v;<POcJo<)|BNLk|nCJ+a7}}36
z8^%v2<G$)Zs*oHQP2}(1$~|L6{sKnx@0=)PubD^75<Rj=t``wbLjZpl2E7{a%|Sj%
zTx~fFJD27O*oru7^Bs`G#D1x;fY<@XO<gDj0<e2bv;hgrYUsbG8RU@?@asJ4Q=f;w
zJa?9epCTH#q$BVxC7JF`y2+Pb2$NKQW9{3jYDKBv@1szp^(n}jht;smtC!60PZxh;
z7@`N;(t2Z|0;fwpegX3$aZ-XS{?i6VNa;IsFL@!GcdOpJZZBt?pLM$t(|3{di~3`v
zCFlRTmyzV?{EYc4z&C@`BEc~LKEt+rlHTBty)~|oAredd30lu-AH8KB{5-DgL$=Mk
z6cfz&s7LdNb{+xDi^A6J@VM)~At@ENI@&3oJT)_Rv<C^on2?6DRVrz_w1$s7sHe}A
zjY)m8cTx=RMkwYTSTi2Yn?@WEKK4XK@LD^y1belR6ASp!fq$gtC??7`p~x<a&9i3I
z2!uP_Mnr7spa3IA2+$aPXq$#9!HsPO-VOpUqOAU%=4JOe=7p2}U)~X?1QN8rN9wUX
zm?U;jgYrPN0={>=5y<#1mFxcnsqOSg_E!g<*e~^d1bDka@;{DC4QP3CJEO!|?juRg
zT7L{&5gsMd`jE5-TF0)ZNkQQR&@6l2_;Z_>XbB|nw<LfwHc*ln#;+P_HSj(5n{({{
z{%jzG+PBh|+WHL6+I6T2T}0I~%s!n`_+lUw9vnE?eetPbX;xujw)!R>I>P(`RfuaH
zLp#5_rksAC_Gp@Sv=zmN|6%vLO)HK`x}5B^gLtg^rt%gR5EwwI-YahegyiyIFJTIP
z^`IM=iZ?soK`bmm750<WSVdHdQ8zQzW9Zybs1eIR^XpxN%z1|A?khJn!l#TRgwEa=
z+>MLuTsdGIA9kT-cod$&@*<pLBEpw3?j}$|^tCnFKp;@VY2POUW1oVqY68JTPI=z|
zRE)&>p}Y%CZa!cT3QsVv9l^Ow`+&4D!8*Wn^fQh2Z~6Qr#lez`s0Y`eo_VbnP3{!5
zhM9SU2)()rW|!uXY03zJ%L+$43+)E1BeJzUJs@u|Cmvh#hvcgn(zC%0O}5h@B@JX$
zAl2_$ad^!xG^!$z-$++xnsqhB>>7}{XbnFK1S_|nMUd8MZ5lyiSbzD~LMG}8+_vJ@
zQaqLKoaQGK(Pe3{)-JVUaqB3KRI(*o6=u9d(?`DVpr7sRq$+CRb6%H<@}vzB+mJh@
z6_;^O1gjx)OK>XfZ;^~n2AuC3|AamDH<aGN#u^ObIb*4WkuOV!iMQ0;Px2!^n$XiE
z+2!Od?xvjRRAAvsFkBq(@}M39kiY@7VmTUAk%=TWFy<>{?<Y4Ck#-`70u-_SRbXFM
zPYLGx#bE~FXCE=e2HxrxvXdU&vfySIDLohmv8r&Afz-5v0purHWpzt9z~;6!9w>(G
z4I|_*g3NSKmIP+0ui)u_K~kK$h^)JgDu6617o4?Vg{Tuili3O;PyaxO)Ssp|deOl!
zp3N|qg9zd=M{0^%-ruQ)4ZIAuZqSih7VEx7nsG4fRg7je%ra}j0C9d^2+rChoNCIB
zYn&e)tQ`LaTS-+1rS(t$psg6e=H6iBDSv%d-z%8Vpjk*u$$khCKz!+7C;TIr)34;w
zAb&C9sf547fC0H=F-q7EG3#k^#dAYE^x{#*WD7s0t3_Szqv+IkPXYySNI~pP%<sq?
zPPAmKc<)71g9r=x3q6n6d!*#5hQw4lTbZvZob2p)y(?k5^&bpqhJ%XQ-oh99)fF}K
zP_U;^xGelY1Y@IW`bd!L+fx)e$tB2^lwV>!Mdazu=;7iD89SB!csjYytXG%yS~dJl
z%`Qg*&!)SR?CCiuJxzIm<WR9-O;#8g*V#5nfX;u>;X{vqtYS2~xruFa#(f8xcUMT+
z2Mx*%W-UIg?b^hDHYZW%XtOj^3f9@C$8gkd-}%`p`t>WO{lrQT!7}^m)5Y)j3dWzV
z<s2lpB$q)gtvN4)r*DTYE`-j@BaOAl;*M7u)=X`|A!EFcwr@oeThR|Wz>7M`QQ=+h
zR?ig{m6ict97&B0`se2GjYKdZN;~%H+0<EUcAe1*Q}5!Xjjx5}D5sgZ8HR}6Hks7u
zg+Z+txK0J~eVQ^7mi*`G`9rmniY}cc7^U(DBKM(m`21!|pbt04iy@Z%OC6fy4F4P>
zHAzY(AM>mcrnz~&BUFbh5P)Yfjs=&6$g$J6*QqJgv7mVV%u#w^AbT0!jsa4=8kqad
zVnoj`F`>>6%u<9g9$u7%$EC=jv}zoVI2MT{#|~c1ki!H!`*TvzG$d=hU~=RWK765>
z93xbEGBL-#7{Cl@WOO-9>|C1P-QEd)UuN_MoJO1>BWMe_3*|$jogIzk9rye&bk~Uw
znI$6zFYvP@HJWnYW`sp+!>Zc*meGmA>ftxH3C1ZGb&&g9_}9|Y-^#ZVi6r8%uhYGZ
z%<I-wp^8%>YZk&FvN{O)Pw(01@5Fqeiv_Jp@lyD~wG!;MK5C<4e@}keHU=-R3L~u?
z(W#mt#TSr4-eh5aC}esR;N%&!cxQrU!b-z6ms7`$VEM6gYB!POOW0bYCF-*@MNt_e
zhx#}Dgul$XLjYMBT~y;=9!VrZxgw*)ex4UYGeEy2Af3#TuiydNx5W!l?)3ycAC}K*
zk=vP~D|??tcA|*sfIBd9SI~3N`NH#jqmuyjLyq;ZG|UeKUxmxC&=dftmK`6|fnSy&
z{g$&gcDhcX;82?t#Gi7Qsic1{<U=;?<!;`&$8mBZ^Yu!kLxHNlP|El`$|S_JMK&Pt
zjkt*<s20>_4QVx-pgiB|q*`xtRGd4s0Hx=L|42F;lrTL%A*O%m(-X=THM@xmhUj{8
z;2SPdLC@3rCLl>c8U!uf3A`&XXUX<#$7Z@zdIjbzHu=hTOA1&_Uz|1xSBhiq+s?F*
zRJuF^R}KOupZ8I39>UVoIq3yyWDRwBjxx9+D*z+_p7g`|7el+y^>?f-M_K0cW$`Nw
zb`;5&mj(2eB%a3$yfCAH^#JE7eOM?pm(%USV0@WpOG^vgnG~Am$I6g-RSzE`Uukyh
znQQ5ja9f8DoS!Tc0IpIGn*u0683bEq_tr-9L6o7I?VwN+cg>s@EWqRgt>j<kN55Hk
zDk?&-7-V53EKGN1tg2%FUzt!qjt*U0P$W2(HT?FO*D=K-OXx%Kr<VK#O~46hTcSmr
ze@;<id~raGoUeccDaF{6HG&c7fnKes9Q}^ZCy!|^w2q6BmRN}+zyIxrtY4OJWvV5K
zbZ4^@a=vp3T2rPbs5CXnU`u(_RtoxPeI;8rF}1w%=v%%_Q&WKu=2><duDTF^6oz=W
zSq}`eNzq)~+1)6nDQp9JrUvBnKXOlp9CPyNH><Ie5${WEaLbaFdc*oiR7%R5NuC{)
zj3q){c?{>2(%l{`glY^*?3266W&AEv<IqAa9*T5m_Qe)qJ4L0tqipA<jjXFOY*IhR
zu##57j|t_v8^QCFCK?MI3jQrD80+YC(a!yW@{~r-BlLS#cx~QUJ5I(Vo{t&DZ3NId
z<-ueI;fitbkjL|D3&ED@^rH4^ER<WsRUT9seHve;_Fc-9s4`;`Zapt5TDI_$B8IPM
zS3A{-*6*Mbt0xH<(S*<4wVE4q2}2jb4JKZ}((8HL0S@W_#p%+wLY$(gcWu(sL6nh7
z#?ztQFTUx$s1p?E9K&@3(HqJeQ6Cd?4Y9ta4iB9DgfSF5<39#a)nw=%P?G-sQEkzX
zhhv-q3E<nWyWTFab&TZ5I_?T{h<uGzw?pLHOlWvL`q5?vTlCkH&*!60H!KZ2`7l#`
z%6FPy*~pt8%$<#RPA7SHY%SvlPnas$RYt#`5V*D#;QP2{|7?6@b9;k_Kn2uTHo+Xc
zPSIQd44;%@EA{Hey7QPSaa6Gsq{fGLH5rUYiDsfUidGZfBbn(G+E;f8G_g}?Y8!{*
zqO$7{M6s(!Nvk?gJB>K^HLXzKw(7}jJJEf%pD?%G2@xoS8#%qiZQ(2a>5b%BN<@Er
zXH?VcLWS&V<pZDzPk%6b7h0#Fn!m>!S(lnHcJS|s-61D~lG`P!jz^)^&bOuok%ZTK
z{InJ}(L`$LQOm6(LTVWMIBoS_Z9TC^oh05j{C+bO@M%0s1L0#K(u5F5Jdll(N#pJ?
zUFpLI{W~%0W)gHK9wl-PAN*JG%C-|15&OpS^tyYzpk(K>;tL7+B%P+MP0rAo>>jo#
zV#N#V^@C=TLlv;vs-n&NhkFn&<n%nbP;n{zvVVDz!4g@^j$ShNUa43cl$&r>GJaR0
zcE#&!>Vw}M7MIdA<l~DCE|J$AhK(lhmV7&VGPKl6l_glzh)`FiUba!a{{4pZ(-7a6
zYO+e<!*e%Jq_re>h+&M3-fA998-GWSmxdZHD>ved{gc)*%$DU?M~0+Ts^sl=<peI<
zE`5=ZB?N-#u-Eb179(-B181gxgcCCCSf#+(`lkZT*#yCH_QCj*l?l5r^@Y8oy?Mdn
z!Up}9Wrj!qpbnKF5^z{N?3YM#80ZZxN+d>=F!jHK$eXL!=|cC0HEATN#Jq98yzJB9
zk&{mZuIS!(e2atP>sf3Ehn_cUT&<Ig-hBVYOPWe8<aeEi`ol=a7v=<8xbq`-Kryaj
z4hT<Ix47EsewFZR&2V_mI|C)%@7>+5G`h1)oTAPc>0}KgHZ&4?p|_ZH%kD(Akl|KJ
zrO*A-7jH^hY7YM=G|s6NS|Myg@%w+Nt5Z~X;K55(B55x>XjU<ru;XCT85L;1^LSB+
z2@0SE&5{Eduz+_-^x*)o$$}RS*tR7WFlc*%cDOGOBLh=S{Vw=R%C@qlg$xogK`@h9
z-~Cvj$}W5&3DH095+>0-#R~@z;h>r<D36gl{9k=@+0`4M)piu7f&rUucv<9a6Cs0b
z$6SfmAy1DuXx1>s_iTD>4pl*unWO#8943UGv$s`4;Y@gPEMVtQBnh-A4}==QqpAw%
zSw5QJAOjo1kIArpdu}0eF}ZLuoAG;v3K(YXPd4tGWjan3u;;X}sAmlXO<Ijx`JXV?
z!?@71$m)XwtM5MtFvlh*weS3!{~@PZ{Qn<a>lF^j+Nmq!q0Xuv$N6K2*l{@*Y?Fs0
z);<;5RxhyRiEQcaOzYse*2iIhI8%Aau^L!BM&V0+>LO%|&EM(@F?NW$K#TB*VpeT4
zz{_B;6xlHITA*B0@h~T_#{{Me|LomI?4re5F?F#XzvavN)U1lQR`?Vp1D94pvCDqX
zigxicVwIT}1vuNC$BmwWbv7?hgCC%gLx)hGAvNg*p#N00;{m%F<59XlLmXR}^&UE;
zM(v3mv}zm4ow$wcl=>!#*!?bcTsB?bf)39H^JPeg`|iJ@-06QdubQSr0qX6x)Dees
z3A=EHipL??$b2c6P$__|EP?vR(u286>rMSFs~^qPzhNVCmy5d>;1#I{O`vSCx{n{{
zpm8;lF^g6uHKrYWn8mndC^JtU(FuE)jav4P^E!sy%Myks1_i-=f4P~2X`mB}e)aRu
zL0UaFv4_{%b?Qkq{ZJH+P+&epWk}JmX8K4DMVZiNoHhFxh=Myf0{(xkhtTAE<wmOu
zJ5W3!=smc>W|%q6{$4hy&iFb~BP}&5Mqn1^35?2Wm>NX}001tak5QuWvcdKS&?>f}
zhYo}XH~WA7Wrm7>WmGCJn(ppt5A(jiUNs&Zx{U{zc#_!MFb7*t2^uFWSrMMul#I8}
zdDOW4hvR3qOdktn1j_vQ1GmE|Mu^Q0UrqVS4iCYs)f91~C?7q#H~Kk`R~JEBKO%vc
zs`N+1k}^?(yL+j&yc-dq1kdLKZ+HV1*O3jx7NIJVGE}mZ!)_6vh>`ZV>uY1%G`WaP
z?ylOyb?v>B>N3I<h9G&5dipM(0g9TecRkF~lpoz%;%rw4pM#OR+m=R5?GgER%g}(4
zg8T$SLK5{-h9#`TuD^8-o_#l{a>)%^#7q3l0CWk<V|bi_Iw%yPFDz4-MUSD8qsBFU
z3t9x_`!v8pv->1Oz4J5RN#FxGzhae<Rwi9oXW$DYN@dAQf*!5y2RauKwBLf<pik0g
z`F~$ns;a68Ya^Ef3ago@G}CD)M|?#@A<BWjsnkpe#Sd`Rux!(tWVBV^HR4X!-aP3d
zl|obl%|yYMj_GJdv<}swc(wEL3(M>81H-acs{JD(>m-!qklqX-O!36h?LR~27o`J1
zXS7M<g=ZQ;)XK>8Fws>}X%Ddn)^ts;@zVPpS*5^l<JW#7nm`~{qbjyJ;RyL>dky35
zA~<fcHDh#Iv@GsXE3D8ur%b}d13!|eLkQDnNBaDB;^~kFI>_SIQdpN4JGzNSL7`z^
zP<3Sw_TG%s?-S9&$~p{wtlE-Z#E>I}76HMXnN9L2Q6wbN%LXJb3}gI8G?-N6oRY9<
zO;oN!TQ7p#Etl%Tu_NGF;52)k*5b9@wY)5NaSI>!cU5&wU+$@|&ho$QCPtQ~mR5*0
z0v%z;Pzb(U?zCc82N`^<fGne}oV;#;Bq(|)K0|ae)xlXYQU}Q~;3ER}L6@^#U+td7
zf*>pXN2~MA^>&x8@A#Z80W6pj#&ff(aMhia*n-Yma=>D-o5hWdFk^W^O%tvDH4lET
z@q9%hC&DecfPIbM|M0qhZfZt;B(PCV;Z-&IV0_veHx#%f7v|?Gy^``_P5n=qQlc6(
zvFt#eVZFZ+!<vY@EpF70DqaGVVyvKWi?%0K<hw`n<WLELSjwl^;wned9--5LP;%}y
zv$&rkimJMVic|(kTO<T6*3E8sXFG8x{nkHyg7zxb6!y&t_^J9gF}dwV7@<!;g4GK|
zHZalU-k)=Ol`}289ye*>4a%gCktL{<(+6>|I#l|>R)+g)dQKc3HA^=5w@q6%(b3fI
zjnEMjQY(X|(b$%>^!vSWG-zAs^uRUbP0qL}o)s>yJ~oif==>VC06lFDbMcoCoK_Gs
ztLDNTi<VJ>1L2CkN)xpHeOm4<DkzYeect4!1f?D_?XAp|HYBb@AU3kbY}IRe32!V9
z6WrjNKk+FpwGMAmPIvdEZo+pk(NV>-{@nCI-fI%#5O$|1JYvR8xr}AcbuF$%#Uk@-
zkgP`r>Q-{!tSh!f6&yC@ay*+klFOyZ_N(Xx;Ay@;gxY}<-be6AIWwHU9?te~E7~`)
zeC=3xb77U)xI|P+RZ<SXWLGDWVg4Sz`fvte$LlwkSL;bk#S$6kr@``)W$HXi=!!OQ
z-^CWG23Xub;)D222j#l?kq|y10dl2XU5k4e$j8)=2eDkf8=w^`3BiHEYiDLupqRLC
zX0uiI4aS6%)|6ni{CM>nvKK6ChT1B`<wVYr;bd!*EifGWkBy*;-?$)uG=I<30dGUf
z5}?HjnQ(GIkcR|zh2z!GEF6QI4(;oXZ-;Hxd}2^Hdl8;vIi|UwMm}YH#~ky<`>kM3
z*29WPaRiU$)~_+^W(6nkAqhWu8s#Y9JHm9S-&T^~zr{1J?h>yuTBCDfaU_Cf3Cfdn
zd0q`9#H%z4U!sK7VsZ0(Du_Pj#BzFQ&eF@>7~u>NEf({6hz?*|-O1{!xQoAO5re2p
zM2`An^0l^^hjw8puQOKkfN{=#kQDybA<bFN3va1K%G!E{^!?LK{2`Cd0sM_8M*`b2
z`3i%O9kW6kmT+rk1V?R_PzI&+g(%aZNdY8u=Mb@}_Dq?Aw{QL!A6b~I;p%-N?`P|$
zqFC?gr0))0mqU=~M-!<FXPvAib(l7?QcdvUf{ENDiDDW5pou93c2s|-hA~#0Q6kw=
zg_)y#a$f@z<C}L3WhZ4i1{W+T9RRD?+4H4wAWmog@CRyb4w4M>npTlefKjyy|J-4N
zr-)eA`A&Wjd@~4B?#{>}i~Ui;Tsp`OK&khE0rDw!2ZIVaOlI!d#l!q;mmI*!9S}|Y
zhypWUq@37o0-o^CE8WYR#$bN$s}FaP>wSH2&fl+5=H})IyBW%#6~J<21_7mNv%h^)
zDL;yp2%V-ASobY{f+rTr8Z`I1F4(I;s94=%PdN3w6A<W_q0yq$onOGlB<|>Q88HYk
z3oXPHx~P_H5Mt}EY28X&asT;NtX6eZVq&i%Ifjo^RDNgZPrQq9ew33rPtD*Af(3#W
z`G||BXGDBIM@cKF@Y+|b20`C^`{C_xr=A!CNyLrPM0!8J!cRnMfWHDgITAQC>go;r
zbA6XJzC)2e6blUm4z7!I*ha=T?ai$nf=jB=8_1A=flo6ICeCO49S-WUr_5dle4a(!
z0Oa8EadFn_LCXABq~A_W?jph>18XkW52m#W_tS)7zl{cM76F9JRAK3*@Jr`0qZeVE
zF6c1>TWYbm9+fC(8=RU<gtGKC!~T&(Uj@p{o668BDJjhgd8zE;E#y{=i`60Ov?@U=
zJeOm24lp<;NglkgF}t{lY^aY4vYAp)lgG#@PM%%ch%>%sZ{)9rk7&l4m7`JgTrewB
zCpEgXo-90@k#|$KTv=W12W^2Eb@_|m+R<>lFf@7qg+jbcWUj}#9lErlM~;{)rqQJ=
z5&snk&!?iY=>xM=n2n9>Xg48cC7aYy8Fgk3v}Nnd>}eFAq#afz%Xl*`%Fm6rrJqV}
z=qvc51G^pQR0<OH0HTNn2mzq<UYHXQ-hknzAAAW{lls_b^;DrwQ*&`Wm<4#88umc?
zuIJ%x-a3`dG*_R5*LRxAGFN|EH2eW|`Q&C`LR~OTu2)MTHXm$h*oB!kX<~>k9^Qz2
zW=$~WI*4JBbqv$)&5;8aCVg$A(T2~50g4>N1bxZl3?{Ln=M6fVl&MFc*|+-MkyykY
zYe{YNNj;;)h4dI2FnEFPVyTAvl)jQEM4r#kG*6X=xv{T^+FjMP%*W!FH5bbJ>D70X
z3Y6d;7DHp>W}3s<IoR%^K3xhWo=7|>3t*{z3T*pa*&D<efOUY!Ww`mtVd``ETW1pN
zO-5Xn>fpdJbJCNi#*2ZRTp>4=IEqO9Jzomp{2F+LEx)lQwElACm5lB{&w@;2#KLME
zM?+(m%IH6t(S_FJh$owj9Pyl=o_|ki+6-&{;Nmg=d1z@npsWf?V;OL`c=UrTvIGV8
z@qjUJejydc_*?&aBtG|73oqXxOBtC-(NWoVqpu*VH-BE~toigzn7<yhAiDP~lP<TB
zP^Iw5pxcgaX-?r5A`u&Yp~D0^k$!uj@H|bhlIn_DNg=KQS%WRjRzS4|*LaIjR-snn
z@lOZ~dfy70yHFih*YSKFMEs<GrK-(jaIaDah`;-mV;b>^WSmD3nW4RnDtUx{%GC(V
zPLUsG85*I^EgSOQX=|Wj88FeD<)GJ~ADRtsds|CV0A&2a3F#h<b;2cxDiK%$g%y-y
zM5y!BJm_1*vCmbnH?D3GdSxTw@*fR)&zd6`$0+H~J5J$<gkU$4k}QJ@bygIDeqhMF
zM|EO$qWi0%t`}UVP*KVCA6no+&I%<rWVZoK^q-llD2SQl0-S$e&PPa(nOI<1-)<h2
zd^7}DK+lK25>g3$Y`4*@WBN1#!OWa@&RqmYA;I%8fp`*4a{)$dGLjC=4t1G#vgu7G
zVJBH+5Xrhx*a;DUU=Vt0YHG|9)E=f7w|7@(06n5miu)>T%`zzH{FXWI^j6zq1{3#E
znX?P>7D(5_O(G(?FrRJNsI9c2uzL>eLL1p@HcfIOf`T-@wT?%?k??;Sm`cgUYkWi!
zxGdJ}lNfSNlo?9~cKGfR+McT|`C|6ldllF317t`5L*XG7IUNQ;POhAu`K(en@Hp=S
z=w4o5zPeRM2S;@@lJ@_BSLzK!jN~FLG+v5l9~Csej$kn870o;ZMH{n^T_fOTYfG<b
z5$0@#u(>YdLX(pnGg-Wnf8a$?w8|XhtRnZ8uDb?O1k1VA6;u4$T^Vt45X(`2ARvGf
zjuJ&+6)|$!vvuNUoU^VG{x;(VUORQBd)tRoUYAxB+S3BAqzpa)FP|sKyBiX}y!bb=
z2vG13SN^=l?n^Ba%bBj1Miu@sUcqGG$BpetoeiPGFKWEQ_}<-}1nQ1C1ii1CZ}>Ig
zh&D{$(HSNUF^a1Q)t@a30%R%CP*J0O`SQh^D^5xtQ7y+=T2@}*rThC=U)j9D#kr+8
z;3Ohm=N~jfXK8H@o(C4fCb_560Ud82-@QG4A8dV(Yo_1cJ`C5&BG^O6g?kg4jD$-C
zg_ZD0?ASM>u_h)TS+Ic<im|__xh4X>K#O|xVUNiE@Zr>Vq0>Y%FtnzF-+pOl`|lsY
zkwlur!AP8DnhV9!|5azd55VSdJYU&o{frr_@gQTr=!UmY#Y>_q?!8nrN7xi`yOS9U
z`v9h~MykCu<sn|n92^-@FlRTZCD@Af#ly+yuGpK+?tUw`x+r8|WSo4(i7QBP$?K;H
zNyv>QE*85W)w<fq?yQLW2UfrmaU!Qobqs`!T^k<H<pFihtpCK*FqrE*EWCCiP@{)S
z8~~C3^Cb!earqY(Z~++lkX{A1{0kB2HkN#)@(~sEHyIC<X31_?h462ohWWPtGjIPp
zM?g0ehp)C&*TA3x`uOMmx74!6U)(|%9Q3~eku?ba%AhpKy&24ReZTp?@dp3pyA&2Z
z8s2HnfBbVpva+^DFDjb-y7E`!PCE#&CP~`%O;3i{@A_U=D*f|w7i=cF`3aFP)>B@w
zI4k)Z2;uLTE<Br!{-@Y}Z&OFz=JGFjCqp{ja{wx{-06NyXfLT6&j%7F-)2vEs$F33
z^OtwkDUE>PH2pBq3TX#q9hqj^*6nNmY#sHtkveHlAPdZHX?9ym4w9sWnLd8eEv(@W
z)aAhd9Q;b$wY*VUA2cYwSG2jsPB1n)8B40!;mH2j3K2$9hb5dDk09axZFDpDHUxL%
z;73_Q+kJ3BwSYUSg>ySh9Fp*#AjXKMncBMR*a9c*PY`7=@YOUV_ti9xYHIhjO!qQ%
zD}p=RE?BoTG_#!>m1ka`#BoICNDWQL6;9w`ordD+VpMhetOE4LU*~-KG(>(d)`zN@
z#htJj^_IM&+Q9U)jFV4gv~B@^A2D}*m^&<xta3ZaMW+#wy#P%4Fm;zIGikPbRobAt
z65*esJZbMUu4eD2Y5X8c*|HF}(Snk(VLfF&RW?;PH8Mpv)X%NuE%E4?D!{niFo!Y~
zJoPjM57BM}JeH*{(QON~3N&-widoZGINR=J{{4gEv+NXy2AZWoF?x<tXr?Cl&jgK|
zr%`O{-~8E$(QLo2xPix0_YP#PKlRz<yJx-8pW4aM2D?NHPs@B#W4&6rn|KtTZ0Jp4
z?g~{lnx)aZ5G5loEOtF7DHZ*z28etEW_i23`Fx?bfW*ZDwgcl?KtQ+Eu|kfzs*LKC
zXO2)_SkIQz-Fxx|>qF%nC2+!4-c}$qxn)a1`8{Sys(yp-J$a2`SHiT`IUR0#pueD=
zbD}&f=B`UJYqGh~;uZUMCJrhvw}QPR$e8KGpv@Xn&g#1yeRu;i4LiL)?V&G`71h0v
zUnvqkf=TTsea$(@91d`<?Q@L*b@aC)k*4m@cww-;xL(~>v|iKJ7G3}JBnw{iKJF2P
zHy#wfSjY+UojrOV`q?h{fR7w=&$Y7VJu*0^;HnjiiXOgXfQ|I|Ts~4GC{5HS%Akqx
z(aV_B!J~!WY_m#<QoS2KNs0)(rjbMz$&@r(VP|LAu()Orv51Gag6Bo#SORo=M7p^h
zf5mUa)}4l_O?3VZFr8Mf9}>{1#o;*C&xx%z65nk8hKbn(*@z$IiK`(V|6pnAjqBwE
zm6n$`>tDaXic0Hd+!LIs{SsJkj;lVJ>hX`k8lMP=JFp7+O5SSH4~}ggSLT`m<r=2f
z=dl{MZHh(kdVy(s8gaVZ#(a!!cH3ES%GRhI{4CdebJ!TTT|q={M!skqy5nb{`>lwJ
zBUJ(Bxv4bWbecCnqViBp^(Vje?4*`{vf-9*dLIZ>mrRi4m@>{3chw>uM{Z&sB8>VS
z3<KE+<u5j0Axu@OL&?8Ip_fTEXEx_=hEq?m52(=k4<nr1ru0ZVX&70mB2@T<1(MPW
zuNxq`AU;z26sQ*+b3OxkckXlpC|&VVoukpBb<pH4m+s<pg!v;*i>C@H$YXp6(rki6
z_GqH-#VMyH&z>y6DOXuSBEI)IgF_;5rm1-)Ln|iF2@iDSBelUK-_gZcV)YTj43krp
z?leuBgPih2E3`2Q543Ph`$vyKZomlYcPUd|L-70>uPF`pV|oHUqz>?n@k&l-Lv4Yz
zpt|<=8=1tzf@&26KZ1{FYwJ6(RL}{l4I$#-1vdCP2anOqDYvnq_ClHlRL*Hi@V9@n
z#%a+PvN@WDJ>yRs8<O7hy-}5z&J&of5;bmaZiM!U<voBoqNI|VUw`hw9(?{v@=x{5
z75xJnlt)LzQSWR1ti{{`6qOsdhFz58eQO`Bt-iP$tgkjNZ@!5Dkk5*Ax+C*po$qkl
zuyL$DPL2N&B?Xa1%omjdF`%b|7!*`;G(ABZmb*$-DcIqF%s27N31;_?>ka|s+2m6k
zQ|8vzDD4HUUrn|Xb)$)p^n4p<r*owyxFH_ibWK?z2D4iB9<mQl)QT6vLX>`Z<@B|h
zY^jB;_7wP46ubLfh?}|eD8K;6M@WLu;O-3OBplq|yZ3U^I@H1f$CrZ>m`ok19atlQ
z>`CA9(1DS_v5f<1+HxYQ12NAwOuCcPpxit}a4D7T6|QA`v+${{l^VK9j8b~=vgd;`
zjh!Fj$h1pP#~$JL1fnLi<#^e^D6ZN*j#wt7B_!M0u^`6-J3gxmM#y4}J*sSh_%<ms
zGxNcZdH8rFqcq_Y^UXX<CGj3g)LRO4Q0MOXg)f@uX@OI3%;MP|gb8L4s#BzY3RwY1
zFfS|#y17ddm;E{yj7EUPVGwI+YZHkl_9`%zS3d(xmVvY;^YE=?H_CTsxwU9U@Jz=`
zJ937oPoGopeD9cpJN+~2!EllU?x5rgGGqU*^Kw#*x3t(M_A*|Bx};5BTy1?qKe@#T
ziJ_S|6epj@M8nyP=2XAoun3}>bTCPMJX6a62n)Ued01wtlNusaQ?-7b<0b@K4dAcT
zCQDY8R4J`0*Hz-#a)l?cbTiYb0+&-h2~Jtt%J4aqup>!FqD6V>^aT#Px=mp~ALoC}
zqQ{=3kb&Nd3?KN-$(r~meo@!A(Pyc_qC|5;K$UgSgg_Fy;mbPK<?9$cQ15a*i@KO-
zoG1t&ES3EWnNGM~%8eV7#1@%hhhC4yM$&U?2_N8KDIIU@hU(i<fojX<c>Y0f2E2E1
zA#}1_GO8Y$AEca<LYY1fZ7OY(g$%Chz9s=Q9f>KI@|ay#PzVBS(8A&&i#G~h^>3<c
z&{SdAtr1Kk348gX!5Rf)eR*Er{`u$mY9H25`F!+#v?NKn<jT%j=KU&=FNwya)7Q29
zj`*|j39n@55GViJT8$&``@(ZQo~-q&ekc2Ts&D#&#f|UB*1D0DVq#Swi|nX%{YBzl
zDlwWSrqgR`{D(Il@7na4<vohwx{(B`swp7zoAK)Ah%jU_M2<eFBBd|70Q~|f1U%+*
zii{scUZtUB5|%CKT-5MYigdO7&!r<Fv2H<EB+Nxxq_PnbLNRPhD|w{l78m^f*E`}9
zFsK~=G5i2L?)}dm2~2o7Yp1oX4AoHG9$kqhHO6eJC$w-yonWId-19Ft2z#+#)=>K>
zFr9pY+>w_aDcU;S0W^($c))I1Ok=q6<zbt+Y9fpESRHk3Yl!x5_u6R`PjT#BUx7)U
zLIm8pk(a+_XUEz<4m-3lWcMr8F^RHMcyP)PU*lsSccf*9?sa)s<?FR9=oghm{~yl2
zGN_KGTQ|77ySrO(2_7_%;O_43?jC|Wgy8P(PH=a34;J(eyzlqbIdy;C+f~f20`^SL
z>h9(1S(LL4IXOokS=k&WMf)ey%Y%<tr^dvsv^dV@ICIX%7`}0`$6LuZYJU>|Zv;Y0
zZ-YPf0BJr(jSNC7j|NtAs~JC8gNCkcxpOpK+#EXDtLH>49|{0LHrci8>r&3BD`XF1
zRBA}->lt3cRaRCWr7YJglv)n%PK<t83=d#Pbk_S?$;*0HkC@!Y<+?}uPsw3EscI86
zs9g(^j?i43sU%PE+>v5pD7Gc6dXE~nhr;ZezWm#S$@?wLWoP&N)6mfHT4+Pmr_zl4
zc!a6rsVm71`!k^Fa->6ny=OANWiP+Q?2tgU0L-0M*YP*B8d}q$hh^cU;{WkKK#`i-
z`^I}1I@nDDx<QHFQAj6l0QfxyVcpkNsLw2~G(b}!XuOY>Uup?`5Fpv|L%`UNHa|o?
zD1hSLxInNUox_^W#Gp<TcF<)j_z+}I-UL7)>5t42yj3(bHj0Z}5A5v=zH)1L#~;M(
z$!h`8p8Lo3*XW^m%4cSNH&=PmWx^RWD!He#Oy*5L{!J2D9p{&9LQd-yk^7QI*T$;t
zH#izEsu%*^TaxEpur%=;q8S~}ONc+m6&=xw4l@dh>Ro_WF(Sg^XF^g^h|lw}PWT-E
zq|fTt#`^)m7r*;^54M@cv!eEPh*^#(K-%D{C~<Bmf93{bR39!Bk%@@m<N1dKli_0k
zUZPcME(KN;{L^KOPcH!Fu(*v>{um+tY@GnFGai}tXy+n(+SWkCNBhrr6vFomtyUTp
zCf^S4!wZn{4>&j_3RJY+Ab6cme1n4_M`VYGhZQa3sFbG-H}E*EH<s!w!nFZ1luy3#
zTZP%f>4Hn3`%d+u?#fC`w>;k^xO6HJn=yQ*`w<P_pHa5^-!|Sob7t$hNG?9!S3^|v
zSdnjUOAb8CVn&n<;puYh0+-KA>u@r;TVUnd=?E&LU0`L#>1Z;!SzzUd(^1#gxuSDU
zBP}=lSr#N-qYT1<nVBCF-EXV&4Ok^{S%>{GrPAk%>+DXE=l7opHvEe(F_72rP<%51
zeiATr0P?Hz59J_&{De9;$j47PCbnLL`9!ti;~PtSQYDyjK(HG$d}bIlJU>6**2zg}
zg+&t>>wql=+&(omHN1`}^DRXC7V=Qa85tZ*rXRs@LBIk^VO@a0d$|H|LDZ5GY@aal
z|NfozcGVWx=UyrRjd3}ET7LZO5(53OAL$z5&eZ~Zj$sodxUf3wP>u*(KGJMpWr>Nu
zP=d<UtF5RVy&Nb!-e_xs`p;d<iFh2HHZ(&~P_4h^-HypVxir%qQu&HSGvs!P`ITnS
z!`<n*nKLy1M1{D3CP8TsAw3NYt>uNTb&9nE%?Z`ANdv828su8StOW|ig~q5*TmTP9
zVTNXw<OGstnU%0}`bT>i3d>0r|2a%Z&D=y!nX8q6;$f+8sOx3LK^tdArp*MR4hCSU
z>gq#Ia1WnKn#v$#fA8?9rzxyYh?eICbt?1wiP(?*f`rhW&GU=2LaWV<u02ju*DJFQ
zPTd1)!vQ*y0knBHO9gEY%#(=KO%Tr<Z{zBr%XX4;omqsV_VSdc!oqu<LYtQ&YrMZ!
z+MeQ$CbL3eFpxUJ3|~y{KwMO1B5fx;A`|Qc6;Y;D4R;~9H;Z4aW_=<S4`dj5)-%=p
zaNgH4$!H#2mcR`k<zz>i2VVz)rDtseBCX-EQfT4-Wg$?P2@4yqvB&m1BkhuCqdgBS
zVxl;6=D9R+5scDMNfk+(`XzyLZdDFQL;Ocwts??ZtGY@%+kQR*GW<rx?v0`Qj_pc1
zV-^9GhW@JOH0I}NZb`0If`>gy<|=0q5d(hnsl3f5Z@f~I(XO=}(jP`AJteO%@C7x}
zc4<J#G}b)yzu<E7Nchd7r1t5Ey#x!v5dHm)i`0RtOOQ2chzF<*27mm`3eS&&`a25p
z0%|qvT{@jy2#eWV$XM$zyAzM^Nr^G_!;pQv%;9g*VTjQ`=R9w5N&Y0bf653mrKq&$
z=LPGo_iQ!8mfa}9NUDLg`!h@-2|mkJvqr#z!?DoNiOZR~Ok!!%tMZx_f~bJ;!a{|c
zTd%CSZV<9_go*Ez5|PXwVh6O<!soNao<;b*uxaGijR_L{DBmLs>i!!P<mG|L1zOZ8
z*$`Dyw;X~eo+?jiA$%21ptq$aV91G+<W-0nQPZYVJFVi&+(ckv+Q4Q9FIW@>&4h+G
ziqq32DL@D6f6KY&k?@+2rZ^408iNH?5Qb*A>oSNcnN37D3uk{0|6H*UH%{KWKH$cD
zK)tXV6w#nzN4)@wk)c@a10VgPR!BWQQs?;u%M`gTCrC)~tW0Vq0V}UvDfA)j@_xac
z6PC3?gxIvFNUWdB^^|h0W-;)WG03gDXV{f8N~y7V_9uE_2@9H91kT*Lix2)|iP`P#
zC_y;frq*b>bE>T36H8g^KynTEw4DKrE=>00Re`Blp@@M91?))iq#{0C5<-!wRcYsF
zSj41Ezt3&&xLy+*9LFpN_1I?#k*{z9FP*9Bc_4NX^s(M8go{wZRez7PGN=3c`Z)f<
zE&_ZaJ;97&jR@`9(YDUEfh8?a<;pM<>KS2X=9FCau4w%gQURq8q^0Tp8;6x2{1jRS
zxtCbZqwHeCcq`?$`D;;hN7l_l93WC`FYJRF+Ssh;>V?0=L!lYaaV@rxp4=m7^47v*
zCOTKv*mgz*E01R8!BuqHMm~<LPfkn)SO3sTHZhKZc3}wYT^DBqp@q^gQEh5AI6ahs
zhEQ_7L}Kch>>_k_cCM^e4GrGo@qFqa231C&mR$#P(V$ycq!&^$VB6|uuzOKPJKH1l
zKh41dpOU%^pG6GRSnlp$K_F~l%qt^7V&iv4zBl(D!zY+&U?(w(K!Wda$;&BEd_NDN
z|2+?Q&8C4RBJ@UC3Uf4iRy-OC;sQEQi))`hNK+sACYO#3npl{y;XoYx_`Fyhpvja`
zMST*BOl=+@y3~gXly6}!Qz%}k?S|bj^eVDylVVnpyX&<iM`1XJPEuO>mHAQdcr;f{
zIMNmeU5UD<sscGW5`UU-@c@6N!gJ}VWj(2vCv{fS0=1yBG@Ep;4e7oG`3NMaE(7?m
zDQH`EQ=C|XC@Bc;(eanB8Znq+!d`HTF%)z2oY_&4+i~x55cxm6TEG$Eb^~x24x=Ij
z@Hc9L*S%GXaRXQk#rdS_8aoE5X&MhEjK%7IB^73eSy76W$29RzLTGSUJTu-{<bNg3
zoBNIiaE9&p0!cPM-V&LBI6I&?VgJ`lmo)W{egX)ksN6Tnq?r0fRIGQAjQ%c+0BC@>
z0T`>{4>TewDiUOSo-a17_gnZs;3S}$&Eu7~@&V95IHo5I$aWUPQbTB41>}h3TAaF_
z^x{s6!xP`dj?Aw0!5602XEDClf_1W-(kKxu79f}e$o_ZvG%b(O+&ttw?-TuLC*Qqx
zeI<m&$0H=Y3aZU3Lz3GK6~aY><oHMw3r8m|BYe85DE7uNPnuHvWRctv<-U0IbN}i`
z7;9t7?BWy1t@0mnFV4ML++o%3BtOBMi?{tRe!W6m>G{^KYTwVdnocqGWgI8jUf-+L
zB5#<t#fRub{$-0c!utL!#^rQPtymqd_8FQ6q^kXD`@ZK<dQwF1%S!n6Ks4#0IgIEj
zDX59QCXWwl5Jwc3JuT*GfVMkO=kTWNya6r(C>8Nhj&Zw}LI`}%-5q*{sJ_4CV%xQ`
zeJ=RsPWj=tU)v%BixJU@-~d=&S(LUxSes%75|!ET^_S=mxQnl$hap_5OMcALuUpSe
zV_fM<(Thw^2zYmdospa`{wtI?0p;^;1|%f56bbcuqdG4EYs(TBkK-~ZHN7|;8HX^F
zr{DNk_F_WYV<93`UVK9tcrS(oy(50&f_S7;GYAB(cVLZ~Tgtj^$Edcsu?cus!z-Rc
z$Ke_Ty3FEN4zA)FWV%7Hn(@A^3}g8@0KfqtQe|Cj_suDj1Ty^Qs<9#Hk93RP_{RD2
zv;%;H4e6j(KJe2!?;13Xtyk?y@izmj2yv6!QW0e7fpu`$m-^Xed*c)_@TkLYn!@S;
zMJawevMb*3wZP{QT{C7?I11L$$+>=G-{;ZaR)g^6{IAJHfuKN?j;xb-mP{noKx?S+
zwQk8VJ>T6*%};(vJC|ihp(IuME~%cX`#&|~TPB8&eXJn(S+6*93E>lr)+7@*tp84)
z`ahEwJ4f;kp+Q99YBu5Mf7()l9^&3_f1$d!<PKc45e#56B3<FCM1D=*3=GidxhQy5
z|BizCbfnVJ-EQD<`2g3^uLr6{(p*8dDF<c9uPEcQx35}%^FhFU535mgeuz|y$@G4^
z^CjSd?FrRE#biS`mQtV^dcfSq;7Pw4Eug$$fG@ynvFX0Y#yhNSXTc`kU_c2mu$)kh
z|K;Oe(n5m|*4kfwzjAvJ)cJ!g5dxx81pA%1e-1I(zYAdhGXfvs^M176T_(S&)w$u&
zpM!W(=Y2$=I7f{0cMj>cO@6Qb-I}VS^IfIrLt-`GiC{_~Z_?P7a|yWH5Y?AiO5?CU
zS{b1DOD$;JyT4<ldQDs60|<Cs^r^Uw70;|d#ZVokma2Tl8CR?=`(6+RCgdK%r?zbm
zJTX&8?5p-A`EVnc$m$BCKdDIcFr08_1~`LaaP;9UG*O`>%zwAd|B3ingFpM@I+jz}
zuIpA45^;R!yMbos1@*4EKL5y(o&^9_6_GOQ3a@)cwed9>{oOB4#LQ>aB8q<j@dGep
zhL3A~kw`kdHa>qyx2ox&J^&o(Z5M{Tb0V~m@&UZ&hfND)OPc?6-he|V^1pakZCxFP
zh32|g4+tp-RPQ8+D8&cB{6sxqeJe)p<IsP1)#p+mHZ~ENEH5kon6Fz~xGe9}JUlp{
zo@*q;;x`qIdI-T*!eh)8e`Z$TFq(-J@COzJm`xnO5&<QB{1BJFG5e+5_L7=t@iP5w
zqVK9Hu;~E5-usjK-pmqo;PStx_kXk4a+_dAwFcxzv<O1zW<vs}g-T}xMjh#a)IwQP
z)XxCFew(3t<Uib{C#2ltLQD)K!Wj`x%TlZTgbV=n&-=hY5jaT^L{H&KlN8_=amzAD
zdd%;Ikc@{L!8rA6c_%wRkcl-|7)vARL$`3FWwYoQnB_HV?`pl=+k650hmh=@08!uo
zq&D0q0G)0?IFiH{U3@I!vkg`$0>R>K=MY+~GDY8z*q$ne2i)w?vE5$cht;xqmLaYm
zk){JCXm!Mt7X3$ZmRZ-QZ~)x1UpE_F)uTDTyE@~iRcDSx(txEWNl@*8oDwV(OmqFO
z_T0mAj6p+J)3HjFdY6}=tjh3Ec<!=7fdMSdLsy2eIQF>ts`}R9$^ZuQ!O>ZdvOL_1
z>38CVsaVfkWf>(0(kw|xIuUtC)Z8VU)(>@4gg+?6$?7#DS565-Lm7fM&M>$J$dOf#
z#cNwY{=wDNj7fPDa;d>WNgI@;WMox)oe*LJoFg8$eAl#dY4&&eCdT|4^2-Ndcvj%e
zd!t6DX&(Fvv}6n4FhhPP6~jns1&q&G*2{`8MKXBRA}mhHd_}Z8u;}8Oj}o%L)kMPd
z>u<rI-JeDf$v*xT3vx7=IEMFVTPX=GDFyR^A}-F0s{tsGzrzoVPa#wvOm<_FQA3YB
z2|qjYiz^rKS6gDk5}I3%vc^;`8CZ#BJ0P{K@9xJIE`oRBL_<bxB0R?Q&=u3ixN>eJ
zD@uGifP?$*&Um+f*-_)l8O|_~<MMarVDKeB_vQ9Ll)g$fqTxbQK$s2caIm8{Usc-r
zkSu@1ZpP$o_JxP|>9WyC8eOSkF6g*ef*1En0INk6uphv@21I{3_IoTO2>EgKN7=uK
zB%Y~59#BBh3DjX8&XV3HE5K;2dbQck)QM2xB)K?pSL2yO2_-eQ!0o9cp14MF^P)Ka
ziu{j&Ckl9{x;SM)37p>AE%c&WT%CD&RzOfbg7w^x4|u}^M72@hU(;`B-;c_h{J%m(
z9iSxYj`YD+=OeX$;$2L>@guSP910_i$<=A{n`Z6^MN{NkH-PF(=SiK75L8}kl>`6M
zJUsr!pF!$rO9c`G+S>{7b<p79mc=Cbn=lXp>)k!TFIYKyhVxPmj!%ONG^m9Vr7n&z
zIJ>+0L5~e8;-1qsTW(PO$_Y<2FoT_o;OpF~m{~Z)rgqsaKbMJK0$>5wKo-HfOT+G+
z9Ze$%#(8J&#?FRZMH)bB)Ivv~BQAUUS*noF(8=Vf^rTP@A=RVSe=B=SRWGi=Oi&)v
z4!nT;Wu`_(!;6vnwSQAi1Gv$<sumOXP9Q@0gCmOL@K4W2cpo&^u^c~>D>{2Q`tZan
zvO>SP;NG~vgWkKUduSI_-bDznxlZJWaQzl_{by<+4F8Bcb|9s`UE6K7oDi4$_}GZs
zV4cd*sYJ7*^eZcPBO!S6Qho-q0J&owjM&w&6_&Tf0cxxP^Mbj#aaMl5tnaV>oC&c<
zh%(vd%Gni4Q40qHK~s(f*a=lZ<mS{=jfFbS*q5bLb=F@Pzjqd9XJ^5iBj0t(sO0z8
zXjeHnIu6dx7(;o&Wm!-xMMHpK>=TDIv?Q^i%PEnVY=_d~x0I3R^ebnCNrljN#*cTa
zH#N5+Lw*an!FvY#F~O>7!P*{E{(|^sR9)^3)Kz>#S2+z~gyGHnMhbi|6fV&OHHwTr
z0617Ahk;AzPAfD_J*U;I;K|21ah3(lpJJ9LNn$(|29I<v=E{8;QFwzT$wMlFi+N4S
zq*1tkq1FZ(;%Q9@<Om^ZTcLY{@2H+K*e0L*r%_OZuH%Ivz)+Z4nFVD>CF2)}K{T4S
zBy=XD)~XLSezd1=*49?<PW%f6X2(?mo!~O8puq%H)-TRepYlPCj<mFn#Yhf-?0|OU
zVDHi|$Mw85%F7f|HgF*5F1@LI`O&JSp%IckeOzg2LT|0v68<+8)6}#ms63G)e3;JG
zcpUYf;rf3HDWD`v-H0EKBu8MdxJWp=g0~ekU~+~cB!f+ZbmL?z(1E+o_nr~6nYU|z
z4O~{Sx+)LUc?8Yx7x@WoZoYyaGXvaJ2Wu(9WpG415~|dpXKzcg!4852lbafh(t&xq
z8)l{)+{PwKcpk`-Dq0=5GU8byT`mMwbER9ApyrCEoj^hG>@KaeAhd@Duc)QGsLKdK
zW2vmzYW`_5pB?TkRg$n(FcVl&>WZr>4;Lx*5i&@f-^Q$%FGH{4N990>?u8XJ31_h$
z&2iKO@C_a#)Dv|ASQ818(iI<+3`Lmm?|0o}{g~4A+JWCxBR(L>b1ibkpOZt;A^j2|
zRTfS{cQ853{W{t1#P?w!9Gv<yHzJ<IRU5;izcZ+wf3rRp@1mZc3AXwY@0VCdY&k?k
z=;#$0-BK_pEYqBJtw{ctu|i9VPRioIfOY3@`<cP<b^Lsw%6SQ$%4d`Lwl{FTJ=Lb8
zPK&<%%AmU7W1^&>W>G3Rr-YDrycYCJ&VFKTXL}T#W0N4(a7j6SAJn7`xLYw7y1ORf
zFc26nCKW>@)!{r=50lR^{eL*Y#VROE2$d2Zi>xfV*xsshBrck6PblKe)S@DnjEHJ(
zIo}fw>cuKK{ozaOUk@(IVe+eU2h~eRHfp@ro+&B)K;gu}%x)_N_<p7g@;31X-#CrM
z&b!2CN1do!lEEV|#Ia(PSo`$TxC+N~EclMm?Q(iF5)>TAoG!f3xrbVph`1>LqC`<O
zrb!R^@4B(;>8Nhp_ekZrC}uCTs}7Fjx(oP&8bPIvT!r#!zy3xArJ?>zSXOe0?4v&X
z<qT>b)acrlA7`ekOd9_7Udd&LA|LOvukBF{8G<fCn*!SjarVX?Nb(+-RlG>lzTe_g
z*(bCW(zb?UhHWJXNga@W!7Q#oAi>db<O6TAYKv9U>8uWHiLF=8{ds~}9=k1{Wq@Q>
z0bWz*Ik8OB_xneLDNU2F7;pT<++si`BW_#sook$MQh%)(IPvP{_Ay*XtSPAL?_{&q
zA6gD3YWVs9N?yb&-;A@1@HZE<hT?PK9!gZ=ten$1oKpFcE)*oMnF!H?LYe-pZ8z%n
zMvVPo4Q7jGs^%f5Y!-xw@fD%9D(I8(a^uO8aQ_i#n2X+TPFCq1+9KI>XnP7~re@YX
z3N~M7U{m$7t-;jfsd{CDY_;P<9U?~U%JLD)obnqrU9tRjc+D{CNi7PXrp(o2Yv(Xj
zhL52S&ibYd+)OEB9VuUENv-M>6g^>B%v|CsX;B*-5UI0E2=Pw#bK-mr*5sIeD$V59
zZLzXro>5IWF=drhHT~nh0NO+VIWA_<jyKNLh2kZ#`ZED$b&Gt;L>4Kxnza#2KzV(5
z@zTfZIql%}cFm9CE0ZuLT5z>f5*mgcPH2lFo=DBr&OxMy6N=wr*MHM3d&VtKL<8aB
z#161;dWq{Wf6015CMYBt5$(rB;-Z<^CIfwI4+HwuAT5TFT#%=v4!6t1zpa)5Z2_^2
z$Kc4b6d-B*0>%JrLn=oT)Ptkb;GbH)&X@cfioz<P2{=Ht@@5>drWNTI=R165a-~nU
zf6x>0heSiZ!P+qJLwk@X7ZHS77h&fnLMGZ!P=5FtYmY7t2fSG#t>f>E{E)RXM#q_7
zA|qCGAT{a-+!bORAS1)WuruuSdcU6*3*$c%lV;^qmE%9a<tlhJfV$9H=T(35?SXF&
zM0S?c{fQPThKU*L1UKkXog7IcAtr`1Y>|rXc-rKSHLK#HucJ-o@kDJ#6<g5sA){=u
za?v^H38!|;FdOEqmZMvB9!JS#_=|fBc%M-nct89Xp_j<iG&}_br4Zjoq4~0%vQR!Z
zgs7eIoYGd<5vy9ef_B6gIAwhuOVG2u6N8D_2~`lMWdv$Q+U~L`&rzo(04sr~@EE*O
zA`ZRrsKkb>sS;3o0MF#VOG-|vC4FNIG<>e!(+m_p?JfTe)Rgyq4kLYfvO5_RpkH%D
zX;TUdU1)@BnP(6dr&wH5Ks?TevBW2Lxf~-``RncixAL60egDFs+8U$$y(8fAEF{FQ
zTtHLv3}_S_t+!n*bfQ@p)rWU$uzW;}Uh5op33~rX-@hrcT<J;2EpLOwc&hGC02SS7
z)unh{uNks!4(bKo%x<z+{Z&3~E67@n^Gd#4<T?}V;tt+FP(0;ZPKgGjpa?&t*8JTg
zaa$FhmWzJXPPdk0!&+d`F)BX4D{_4QQBGM4UYJHtrPDe|BbP+>sWa`9vQ>Xq#&Ok?
zE-s@cgJ0w8r9Ra!+2m=UHRFaYH0d}di2x7$@!gq3b_>#xC@OoxuP$DFusKMN?AkK0
zfx+9dmOIjk5j<Iam|I@6SUXb8E?NN;@U*%j<XRY8Cl~5Do5g@WLO9!o&%Ws*ISZNI
zNs$&^tnx^f>s3%J$BCPg&J+=jzo#5KGx?V{Y7GTPKt}j*1B}v~iTOI={??V5mJf&I
z>5$J!+>`7oBeb&5Oo(S6A7N7c{MJCM7sNj`ax^jZ4eT6(aG}bJ0rR{m+!l>vrQE7N
z4nwX{CcBZ;0c+)MhuB5sgW|BoF3io%jjCCG&~U%_irjKYXXxxgofTT?Nx;O)@EdY~
zW*(3=2>4CTIpSXYW+YzZtA1%J#IeR?hPOjX{;esI`Ke-kmVd7BGwhoG>Hzz_4c;{$
z`(lPvrlh=1gsl6JH-9k|Np4&rVYMO5&8k<dlN3qZ@WeDlR^MQGJf=B??jY(R#g#<*
zsv)nHOU?F8T$N(C$JC1?mJ?DF;jX(!2>7Zaq=5%ifXuF?cq-re=gu$U(Gv4wxrnzo
zKewDA)d{A`J!-Im!1qMM)gnPj9xYK>qlJI?o=_=L&ccaar6e2TML8-SR4>Ot(ER1|
zR~94XKP-p`J-7sru7p8(wwx7Sc{180O~^iSa^wclC)8l2X)G<6n3Er~XO;R1DUop#
zYRz$e%qwg1tJP4`PO`@|AX_YuyOgX-p}dVB7ct?O8i;@lJ~Op26IOnLd{=|XXy2$t
z`PO`+%?)3a2&_0!F1s>EUCLiL%$!_C&0VkZ{I_AN2`obZLr4W<EgG{z;ul>^NBB@r
z1v+U7_<DQsyy9IpTqyOFWsZgC55Knj*8Ntl)FMS>KN(fx_#zm<>fFir7Aowrm8f#Z
z+f^nI|1vjfV^n(oviWbu{Dco57hFb0zBm`4VxggKY#jw_G+4)<`@J7&mw((4&wgHK
zP5T?CrwBwuSwue$IlQnu+}!vp`T6-n7J7QNd6!pLpZ!ku_MC}Y5UWa#zqB+qdYUk)
zR_bE&B30G=xp20(e~@!_bj0sR>{;saV<foTiI?BHJ+=Rb2=9590FcSxP*d>Ail_D2
zKtBdX0{lNQ_^2O%ip`Izq%@n|*!UyuvFgw1GDdhy@|*Xu1&|{Dj(IY`kNoc_e?!p)
z_T>9`L(K(@{r5rW2i)u5!4LXwT>u6K;Aj8`%!z-;4K$#F{5y_OfN0DA%LD%Nphj=>
zEx-Rv=f9ujL_x0E|GD>nKaV9y2>)?5zt830%Y#BF)PLvw|99J*bA}0u_@RlFl}I3i
z$NDV9-ok>;-Q6AC1@%8K_3vkrW(@np?95EyP(0OkipdK!f16uqD0JV|uAXZB$)x+?
zR2QPry!|-I-OYCjDX2S-OZ}s45JV)Rlb{|h<OoazC)MOBkbo1x&YT<(0@N+e!FCaR
ze7*$%XjsL%yLtCbVe<+QMEL6`NDpFS-OAO?^9u8Zin^>UIySBOsnjT{%zJK18SI$q
zYSuo2+f^kMm5_x6Rm+t|l(dgl50mbH_I|Id=N)Esjb-r00b%~JF}c3gf%gTw+5YC`
z#V<!77{q|rU@u5&<3(-b@pG+OkIvb06=?4M4LV4;PpkXQ3uf<b=*RdF(-b4{0G*gf
z+33cG2LYkd!MVS$gR=v#+4Aeiaj%sxpXrX5Q{_<ld2A?04sYY+WCmnxSPG|qXmIqK
z6Y8JY5-F<N$6<`4K#;M)>~^ls!$T~{`>WkQ0r)Y}Nsy2DQ&Zmv=Fexo9o2xPe-|d;
z?Hn31f#jk&ye7^P*5A_25*79@mS@&!Exf)2X}8@}?J(n|*oD8o;aK!i`ua7mak@PN
zNVdA{hGW_Qk~?}Q^CX5`yc0YJRN6UB3=QFJ-Q6E5+dcnYA?q|d9^z#rCVuR_=EXkw
z@#6=HoSYot*3X|mN#rCYU5RyCUG03CG#i<F_s6q{<}NQUMLf?|nn0o>BJj3qOvVve
z5P+(j6gHFK`|HDL5znKUA`$_&s~s=d1|lxo55TUypU!##hk}B-zP+VA6Mx^v<wPM@
z6}#IvoZ16;(>g&ui43_*&nOh`?Aml!WVd~(-jBK*HJr)_l~l^C9=Z@Uybk0wc!?33
zk8P#vjId0)+QTQ2&~a#q)UB#Jg_U64DW_GTi*kMS&}fT=3%EI?bbH9g(g4UU95~GH
z$F?t~{rJ@EN(+J9LZ+i9OzcMuS>5g3e|v*R1x6u9*Mz---r5LbRTX>*SrjQ;wQ<?x
zGv>@m>`t{ky?ZNhz%q8);#QqFU$p&&S=3c!gn2#HzqJ^X)&FxSUR4+z*!}a8hj9?i
zz4|OKkLyUA+uOm%^K2mqLj1IUgyy%24szw>1fph3u(pwW?g<cy_`{Bt#6y?*!g<fS
z#0n;&33wAB2+DOj#x%ctxoG1N6!h_}&}#WuY9>CRyT7-GXeTE(_QAx&1j$ZWc@Ejc
z*chNWDB^7Z`0*K5rAMsLs;wXQ5fscAzo{-G3yWPS5jpc6b5~Q>CvF~Vpn)p=f>?m5
z=ACH3kBasO+Lx=Oj*V59^*)dDw!469pO-&bP#>T11Nc`OH~CiDd;Vs)thwoSJl`&p
z9W|`EANxH4&>sS<9hd!hNIUa7KF@g1KrZ+ukmwVfkwL)2!-MWZ3lQL0bkQfX8ByS)
zJ5&p@pR5;2%naV6e^@|e&N^IGCO0z6C<yE$S?VIvak5uRUb0tZ{dmi|#Y1bd%AFhS
zNmpz5A_3jw%0pZ3xRM^0C@WK^y|Kxj(Wsp2(te>nl<4&$8<SqWf%d3n#D#X6H`7s_
zG2(HZ;=*_C+IfHOpYxh}Y~XbGGZs>o-L0{U$=sFmq1@Rn?cKqnFKv*c-fa)hx2LlP
zw}-Pzs!(gN9yjJ_;|8~ebEN<26%A%RdSrX9FaWpx3XKre6wVt0FxKOi2&iU&)v9s~
ziaoo6H!CX28O#>jKE2$@8;rM;QPUR-X?wHKmK>wItOkV1sXPJV2pJnYw7Xl_J_er1
z)BVSuUwM{Xc7&YX)9SfTOraB=g5xow)JQRLyc6BoSk^CLVd1yVMb)J|5Bq{ES%2;}
zyYA+CR&-|82l#(oZ^%d-5h>PhhoMmg-&}4Fgxpja3<M_|ZzJBukx2yKUu^b>cpgmT
zkO;V5Y*c1)+7P~VA*)_T1f1=U5s-l<@>v1$zh46QRe3C#&Dnp0X~jrnkCaIe*r>Pr
zBE3Gc=w;)sG`it|qWC0t0<a*fy<l2=6Jn*fJGtJTU|LP{;dU*hu>AZ;0tk_BggAbL
z6`rsQ0MnX>wa(cPACi9vf_qDq(zCG{e>n+x{PWoUq;-aO6xZrfNW|_c_ACOc%Wt|7
z?%ue8aU%&;dGKwkYpuiQwepwWLdWx|O=EH_e2!$~ne~f3I%E0f`_peG{K~Iz`#%8>
zZ=a<{c;goNz!E?;hbjeV&hSm#c%?x#doTHwKOIx-oXZq#AwD05K{i`jSuJKg+xmE~
zCv}W?iSU2FL*zhm^b+(dpO`@AdwtTeJ2;?OX;kZf`K0`Hz+%MK4gnMRyF6eKNC);n
z8%wYC3cfy4wcbxUxE@Y-Z0wG|`X>o^BQkkE(QDryD2+<Ziy*g?Oa%SCXyZpbA9sUt
zH{!WC_h9#9<Piaq98^|5zo`jGOoRux`9dmlyKG!?zFeF3ux38XLMou&w{G=c<F*?`
zm%~5I8{x7`wMfpP#l^XUh5#M4QzG_bKh<9fVIeubU--|q{K{?GT?*Z@k3A3_3F4rd
z4}5B7o`O&{HNpD8wAO9JRZO!Wx^?};_=A)8A8ECjQ$E<lvM`H5+kMHR@qdim)F^>j
zF2$)F{5If^2?p*D*=m|?A%H0i^#J!0jK$Xxh<6D0<FK<x|KrI~?Z#>el;A;Ep590L
za+%<vn-tqb(;lcR-6RttyCley;@J)AZy^q=?AS)Kfoci3D>*sP&cHl@Gk*Z+7C(TM
zD50hu>id2CQ!6%1zuNm*oyXo`I?jg-ilR?#r@7|Kx73(r3ODNJIKS2xp?RY#q-hy+
z3?r0--~9~L=TT`*)D`qXn|17llab{o?3yicVR#USgJc6t%?SZ%K`OCH@%|?#($v(W
z;*+vhZ9Dm-HG&ffffhmB)J#J{#^Rvmh6QB%p`6;UBZi{sQlg*aP+3{02kVS;h?7bS
zbjVK)clPo(!p*ZIPSRv!(nydTwc0&FQg%|yweq@J3^gg9i@VB4cDU3QvFvCPN~bNW
zBVB)93eA(<kRdtl?vT<Q5(}R^RsMx<s;KFZ&5kIi(v>Kr<I9a9d8S2h*6Nz2D+(2C
zgnQin9w*oTQ-{xA%=?pS^9?&=9Lpi!1h8BIz`kDhJpc0NZGnOOf!OyY%#M)NIH?i(
zvMu9zyO?!(Nkc#nn$d3RubbS-c1PFBd-}>O@CofxrKoEbBYd|`mo%kLXTFO7s2=?5
z7SqMle#Iw#8$=nGwjiI;N6ugQ#bh6XZGZp8etkHCh!o_6YiI5j-gNZjI2UW}Fauq2
zH|w+@JQ?eVP$}RGiD`%lG1%t=cO37RX~4S3?J2Mgq+EG?*C{O=f!Y35vCBK4Wwdte
zhPT2y3FQrPs^7j8jEDZYqfN3rWk>IbnEAMRewo=$HrFdkVjP9!D3Ag3xKTFP=nOGm
zGp<*6YI48mVAI3u%3WU;*4u34e7~+EAimKRL9d&b<?zA!yu-I3>o2HWgtGqeulx(v
zj7UyxFQ}Tbrz*Q+^-|c6J%KcA8||0a)ec|dGTaa+Z*?~FUwJlN=O}i5W_4xu{ka@I
zUk~|gOOBY);X5LMxmCm29_X}VtvMts{v;<@=yQz$ikL2DZ45fa#<;O#F5UXv3{sy@
zzIl|AFp>2UZV6Fa6|V-g1as+=tSo}{F%t3fFvJzoh$}h17RcASA?C;xKQ@Kvd(UbX
z<>}ID>8le);9PqNnr0s_ak$w=l<%Y6K{ca$4S$5Q-JQ%%GS8-yXqQDf86F-I`?Tq#
zIifIhroVj9%sP<|?@JS)SsTNckfNy)mmyKkO%-8et2H#*HJi72e;%=2sq010T5cHY
zaRqBX=wxW3bvS<T-NdB`vU!ll>JF+!vO~&O8s`ZYc}KC<%vPFXgJTLLA`V`8!j5l(
z;~T&af8QbA3_<{tdEab6o*y;g!9zQkmLbg71#3?PpZjYvuDfKiTKUW&4D!^Vs@F%n
zUxtTd@Zm)fhKDIvI(&Ci9oZ^YlDD%#es>Y~s}-639ZoONK)V+NNLhEobdV?W{_Wol
znceX|9=JZw8!@gg&w^VOug_$eZf7ujM)v}iymgz?0tDMyuYNA`a)G>iU1;jIG>`D-
zUbpn^jqGr1$s=rUHi)>a;Hi+xCraxz$u4U_k<sKc-)R+tD#=s9WZY^ri1`X)CMGZl
z&S^XSIG)VcZb+yprnq)TO|tncy9qp-X9rqOmw_#JZ9e5?nXV22)~@y+j+*201NmUy
z_ghRl#P^}B6HdsPM6U!DY4rX1>FhguI^BP7=3KYGBG3!CV{*?klJT11(f^9+15e|S
zY;%U;PT5D^=EL!M9mSwx-K}e9Jpa?FF)k}Q@uHeY<NQ~WS-``F)KdBMlejZ$HS2aI
z=M4JSUk3(XJz2}sVS8p8jCCjDxOOP4{r;+)Z`}ZZ;q>Mla|5Nl!LoFfgT|!VUN)fq
zx0$^dsjE(ZLCeW41D;3ik`3F@_oJZ<PX3@FH|}FI<^!xI?_wUR`D(~%Z>v{br7*2|
zTUU_})66GqoZp2sB9ei6bfAe^<LNj>XPZd9ohvalVC6a<S}`lk>_IQI%{^+RMx}B<
z2chF-8?RE^16J+O3}8sm+nLYM<-BNi44g<1^MiIKtw9A@57=<Ia-?jWU?E8wn>s#E
zbOK}p+$qi&hbEi`FFW$gs}`KBSN6b>gY^5V)3aQEY{z|E%s1iW2_xWU2dX(YuqCDZ
zkyUO$=ydurdA}p#sUbE>`f^#9?a*gJ!!8`6gVDrrV-(lnX`A2Uq~(X-448Dz?IQWX
zy|r+6{)nVN6Ubgozkc+HJNZwOK``B&Obv5hf~*wrt(8MlQ#pl@-{D@8?LUHlpdhM7
z8dmy8Z~K+!JWPT&qsGU&(_jpJ{wYX<LsLW}DHFTS7B*DW_#;)OpFEx=$(B1RTKY?q
z3nQ`LS-i}cNPo50P*uF-W4D`Fc0}Z7DY@Q0IIP_Pk^yO%M&J8Jhfpf7&nKy9$Ubr$
z6HbWxLx0EP1u%DbTnMR@mp6#U$2zwHE+s=F`cf9S>|b1a`-Z`^s!X<Rqay{`h!-#-
zYD(n^cX(t6CjU$w^SEFZVE8e)*&dTGdSg}@o`l60EU?HUz`7z}?c@?N4vGP4m!_tm
zC$P>)#1pecL1xphk@NE<WZ-+y#(f82%d^Zc5gnT~Z0gXI&k?%t6=?=QCom@cZnxA;
zBlxT*ri<tSpKJ$>n8?YH8^4CjyRh?aP5n^aLr2e-p>>wqKwMCv0syXsd)J`#(@SX`
zz#<~tDm(54w5eWiQye@P%`CcV<O!NfUZYL41P4H=kKeS6cj;~7s5LIGFlKk3DmMUs
zrz9!60)Hys-)%W!hQ3C;t(GkfHr`<oxthd8Cdfqam(wA(eHz8aD?g@i0eodJ0jl}s
zZye0+8s~)5hfJc5uuH<p##Dah2@LO@E-<a6+ve@xCRBr9THFDkT56vM2PH-2`agl2
zS_rL=LjEH128qvKj`OBKSxma^w0IC5t=A5ghDh1rVcK@r<C&6|FmN*jkIsw{dD#6k
zD9P);8_jl+U(Y0$sSR>-siXh0g&?_yqZKoH2MFnH$R?8*rn;^l^0Kz%$EeEY&q!#V
z^|2nsAKcvLW90$-^U=#AEJ{_M7uZFrm=8Tph8fynOgfLK;?mLI9~sbEyf`keEYuf}
zvqa8<JPk9#dVBW;g43k3=`5FgE~2%e84V5N&p%=fwSZk-noMstQy?y~S2`WSw>nX7
z1h|dZ#ht{*J3;zQYY*@`>!2O*pn=tmQ&tP9s5@hpYs*SJ-6Gp($p)>zNH@B(qZ73i
z1Q-o`kInFeCv<r0GkBvVGo2jbrk*;HS^!a3WwRYq@q%=VH?}dHFd`}45=d8Mf^5l-
zKr{;9x7cVZ<8FkSo)=T|q00qPwb0czHbR}FGyi&n7^}`aHX`+(Gs6Pj{C!H%);@}%
z9p55S$pcBh>D1AabsFt)JAQCI?=rOd1zle771KC5wJY+;tL&o+0@^@|K2X-)7#kb9
zQ{%B&dP~IjJU*T+xDE|@^iWwf(c8il)z`hcuX=GJ6N#pMzpZn5W{IY%hWE*9$uaU-
zm;P65eLw^n{Qg+iPx%48ayMk>ES`{ihke@zU2^ud7vA>kg~&fJShmhS=%vQqq3isA
zQ3a;iMJ^HzxT?koU)}Za)0NK$n*J0ZZ|emz38qKvLg}OU+`{V{$m<(q(+GHKp~XpT
z*`9qtw{&!3me3-=#Z{k3Wq~s9k5+9z#vV)O4*EK9M?7PV*k8=6Kay#RJ)R8iG@ig^
ze?|VTc!mC>c+sI_s;Y88IVj5pJEYMFKR~uSv0#haj-&_TXxnV$O~_|w6+sB9C%2D7
z!+ALAIXL69$Bg?*a56~Qd=M<6jFj_+jDmN%kF6JU+_2r1_B_186@Yssx(4u^(yra^
zeh0WTK#q?2gqs!o>P|3rxH0P%;R9P@A?j-U1V-r9ip~Fa_QC=6p*=Gz_-Er+$<}nK
zm$<CJhypoc1~#yHwQLK<mxmW{RS(rq&t*v$!;eIt(uCYKrC`f<O|pp}@#m;no4<i+
z=?J`12uEv*`jJlT-VA9ZXX73$=>~8LOm}VpYPPfL*gY(o)jTnWJjKLK6W>IF69-HR
zjs!Bd59rI&6<+dQJ7HJ>=H|%Vu3xz$?m=!{Q#m;ql^dFjfF~T$0o0ZzZrQxpv4d7`
z!u8jMrhX#hX~Evtwky^(R}XrbCrkqyOMDzOB=tNx5^F(3BA&>Zkt!|+S5CPs{?8BR
z82S5t<&$^MU|PL@AsXGt;5@KW^jZ_i5XrL!P}`U;!<Ij4w*4ACsO}YfVS$SPPGJh+
zA90ZH4IZ0+7W-A*wpg1aDs+>^IU$<INF0wO?pH`rhg7PE_#dpmv?4AqBhWUQSrAjW
z-*`*PPWy<EvN7pLH+5l$DH$0L1Kd)qQ!(=g3`6ZEUsDf$nUqccfTE_I)T>w@2E2Wj
zpq`ZlSc@2n&EZ{XNwT{I{Svbsbrq7^L3^2G=J+R0yAL#cdB;^V1_TFEQsT6Kd2Q>;
zFe%6Ey2{ZWH#oMzB3%{(1AmIzcaRgaP-L#mZ(r<><5%s2F79tZkjJjaZ_~+MbRVmS
za-oO(X!Np8xxraWJqTQ_3X_!Li+M)*cz=;U1ihFC?Pz7&*YR>qq*~4s4sOpxK}p!(
zjgz%OMxcW);6aFmx>e<q!tip}QL%yQ^&|a}Zwy}@;uJ}zhdir{%V!gRtiNyb!d|-d
zVZR7^%?b8$f7_0J80Gb4{~Nt(i%w>~lQGfL^)G|gU^t)%JS3i1IOlfGwb7E)$An1x
z^W1u`38fyF;}&`}5wDy#TQteAHRRg8Fy4qWfx)7d$r%1Xe~|J0MUC1;^jffO9*nD7
zDwK03R~Q<gX7=6Wp##SAI*!&JY#NEG-mK8P@Sct9v3><ejZTGk$6pPsCLk{k3Xn5@
zp4XbGvzlG$T_H1Hvv6*8<P4VoEG%O|bvP+BG5Q>n{%+SlHvBw)sDXLNs<B%Zk)k$a
z$bDZHG1PcB*C$#(Iw}M1)kEsFP0Dth)WF7iu#Cl2O;LA*ho$DxiHEh@cVI?P4&wDx
z77=3=#aN#~|Hss~gjk0nZv^%A{u=?Iw21D@Uk%soZJ0_eyAMe<SGEjHSZ>@nT-7T$
zUuQ9O<@FJH#f_hglVhfPwnT~yJs5G4e5vWQupexMk7g~ERp@R8X%BEz$voE~4C9>V
zb{$mr^dTAcqa<_dI#{=>h7}QTKegC$e^rPSV2es0fqC^h=Z~z>h>5^*?iuSuAEQIu
zRNPZ?V|loy8<dLaW0f|*<|-Akl;Sx|n%|ciZ;XsExg{NyLO5@`;aU5ui^->QDyoUP
znCV<0Fi(Mdp?}kCO2DL@cWgJeojEC10BjQV=pwXV-Q@b5(S41ZZ7v+h?#zT{j<^P}
zWgT3IJ}<p69*o}~BUhkccGmc-x}lj`^8*IS_R;;y<uChPp-%YXeSZdSf@(3|-(^vC
zdW?Lw_t6s4?<N74d4(o2ci-wXv-hD$?`hBfc)$MI-@_3M*}N5k<j7FdIdTW*2sBJT
zT;S>@(nk0#Z``>sO_WH~5yI`KVS8(dzlB)ddD0*d6fBJ{7iW;cEnC3czjfcv5V}~4
z5E7l)Ni*eQevXSRj~{_kPgmtohbG|Rgu0@9-u1Z;y?@hRbEXHP3GjIUezy?7jRFKd
z-s2e$?SMt9gLm*<<L_LbC+3EtyKS~K;f5lDW05+}3a;raaT1{SpGQSp2_>->=A#}c
za*>G;9w^oU7QefYP=p#_xdH!#_2v#*_nr_+x{{5!qepVg&|)E~Xsw8F+CO+smpB^&
z_AjZO4~RPklJ_?0%?2l<;t1R%5<7#q;KEhzAF#5A{yvYs11NR1K<~;&xXBV#oDIND
zGoT_Ej;j?mB-vz(9p^n#xjU$q&Rb0|0!mtSZV9TWxQ%kkOxWRZBVwAG+G9H>DwD|q
z@paElx5rOa^XFGAgS$?>{zq4%bPnfqIYYm4uZZ85w-Js<`sw;dxn$Z8)B6_-o}gH!
zZRLRh7a12st^CUfkMaZY+vz=P6nn0BtK%EBXV6V5<J<6Q&G)SRQ$-Q%6HXryt3u|w
z?*m@9>Z*<^HLB4<4Dc_`u?Bj~ZrWc>&gnPuxR#hRx6ZV)g=q4HX&|ID)U&^=to}1#
zkcB}}gjW(8L&%ZIdRKS<8h^y%iZ*jDzo-iu>p6cVYiMY2ZaM!m=226_%*_6ye`m_a
z5WGzq@1mz*_Tq5EsZooMxUHS!x=v1St&s&=@-{~zMsT7)g6JBz1G|OM^ppH6iDRA3
z)<yKqg5%Z4Yj%14-DZ9+X?<tAIBE3ez(4`HFySO>N8l10J0VD+aIi(~I7z747y9<w
zXM(32VU@|Rn5+D)8^_xeH*4-UGhzw{?m_Aha2TRF$FCJJ#?0;*;bTd;8d&n9&j@wA
zO#KXOJd*s}E@cNoS7Q5$lYjL=zdA(Zf*fJ&M^}Z>j53U_V@IxyrnkN}-WNrP{Yg&c
z^S-GS%Nyu7%%Eg;|Hg;?OvZ|&CUL2I9bUjFpg4M`%7V>*x_Bdbi7vhiazGS!Bf!e;
zx@{Iw0hyNsSymwL%})G>7D=2bvzeOwTIa|6+fX~gz`#6zeV~TZ67W7F|MEagy#dpT
zb1vP-P(cOleiT&TC%<tc9(TM7t7TmamD~WfqG{$g5)5u(0)Efk({t)nbqw>j6-q6U
zP9kR{g}!GX#4^4F1D`+}t0_IbY-3Zl{`YTxnO8xK=2D`r;eKp6ModEuSv?CYXuN6}
zER||GkE=|8g6ppH!b!Bb6E`ogn8jj@;r4zd*t4WqVoif$Ie)^0=a(NE;k3jis94pd
z<Yk^L_7U?78*eE4AQ+Xj1)VNAD&Vv#a)KC?w6U7C^VAP=C%O}Xn^BNouP6Mk*Bpe^
z8oRiw8R!X!pOh2<BcQShX==fHI+#XF*!y$s95f#wYpPg;id(A{G~ms6;SEeGjo&lf
zsmf#RL#;J8{s2*0_p}0*hIpN?_^z|6yBrqbnzL<vn;$}(x6pq3wC&`KIIZrpTFyvc
zALv6!zpzLiBu@<Y2WcieF5c8Qx6zCHEzjDSLSJXFIgu<x0Cl$DxDB)UWU%@AcB_HO
zTsUvZR<p`8^f)azH(K23I<*B!+|cdg+-sL`QUR7HSiqpWF!B|oJPP&(oXwoc%nlPq
z^8p&pGZ^y5KA60id^yl3&fd<6YM>8l?M(jXypK-Kh#c<d+UhI>qI3Nem!=p5qs9Vn
zbLVLo8@}Z_qjMYZhCvu72hK}sT`QyTm~$U19V&wo`qISUW`!Yas{F^OV6|+HJH8ya
z&pU*W!fL%!)n-mm?SM!6b--D(pHVYz!4GaBl5OGMhslwk-yXkD>Z(CA$0DZ}guV}j
z{%hqAPw%i^5*Sv&y@W3ZsbQx<HG_m>eFCwEL2oxBCl|d@z-+!olIt_UHM;oogTM0H
zHXw`13|&LBtC*!D*LacVfJ+x-EJHP#srcKco~*f^-g6jFuM^#04xl5D^<t+-922#>
zLY7Uoa39N~FMb9wxp<x6ToR;u&!Zj75%dL<5KPvpi`8PYW6ejFZ5X*gjY!l502RzR
z__VXdA(?40+ZWwug%`3mmQ$YK@+~#k>pu~P<J_bYXkv;v%=4_<)C<2h;MJSsZom+v
zul>gS=u)4fkrr&qVvWX*Br7ZyrG9U<#Io?0JGQ?KV`ZgG&)bQneYP-?2+}$@CxSyW
z9X{L5k;UChnLvqFMfkMBr?-}%K-cmw_BEyi)yVP!dl8vb-C49)OM}5_Z`PL*afaFh
zKAeH`<8D6zyU981`u?OU2W2Mq!fyl&OGtfVZ6y<BMpi$Hfr{_4Yg>nDXm;Y|X_qw;
zzIw7h%Y6R%hY0xE0;mM3N)kcgWz4oq=9+WUBnUk*RTH}rzPeE9_=_kUKhK-dr4n*I
zg<oF4^G9a-<Q?QY=XxHUx<-~m*n^)oByu3gY;5v(-FlK_l3+gzv`_K13#?uIoF1yb
zkL_q1d=l8<CwkzPSKr758=p3F<aYev?&9j|-aUJZxaU|H(@a3Ml^cfV$-g?(B)mrU
zr-Ly$&a60y@hWvpMU$D%T}R=B)CVssJt}<Gd^62$e{*9~YOF4IEAbmRSymFPNiFrQ
zc-P2h1!}s7Wi{G#?)Z*`a4kf{DUXT>qicTNg-Oz+4E~c*r^;e^FH`ozKqVE~i{8oT
z^gL(VO7_mVORH>!ItF8c`Jgtm6l*I6j80PpDca;XqXktutme{i$kK+oU=9Y~&wr*#
zaok>`{DUCqhaMHXM*9&HIXSmSjuO7)-H@)-aP;QTXep@W(NJ2piI+3LC1YUGkB;gx
zG7Pku;+j<XV{!oO-KtF^C&GKa!UJq+>ioOR*UW+NOt|Y$kW$mGUl{D$1Z>vo0IV*`
ztoSjae1{M@PBuDi%9JEI6&{}#f*?j7`ALhSMzOW{#5~vM;?A4wgIn>o5Tut5fLI+L
zwf4NM#Hu1%DSg(bQG*ysaym3#fk*PyZ+q^sj%v=~){P{HAKHs?FHr?f8I|PrEwnGh
zR)UyR!4$xVz1mRI`o_J=e}1hP_)Lw_Jh*;+^Le5}WjpZtmG<y_d*^jqHH=KvuV?2x
zerWshj}3=H&aS+wTBRnf=4Ua+tJhE6Brp%|EVn3#`nckE6@IMb1wWVXhp5;a$kAW5
z>PXvL*tBV#Pves5s^A>LVYPN%`MJp^+q{&1FwBCY<^9t0*mSf<H~xNStgDfum{Vd)
zTmSvWs^?obx+SA$%|u<1E$YXB)_!n%bjsLQDk)&T=)gOY<RHltdF6}@j}RmlQ0AnI
zyRkodaXYT^U97Cb&VNJ@Phd5gyhxI*gsJW<!qHMt$|HFgT@Pj3kJ&z`PdQk~hCOo0
z0FkAGx_3X+)5z+dD7>d}ui%9;5kzu5wCRcApv^Tuoouw+kNlFvoBYSafmPloy{a;x
zqeQ?g)(0+1ouKk$Sj2Tg1NU@H-!e+^zV?}Y#m+t?>+qA~Yb`FV7eAQ#Pm*&Z4+6Lr
zpJ>)H@vYn{nn*brG1;Q*?p$1N{6>tJ)hIiw9z*yeP6CNDfxxy!j8dW(0@~O+s8RtK
zIw&|U4Rih7!HPi>+}zi05oU+_;MJat1EpiMZ;!tO5e3=(R_iECmGk&$+41~)+{G_E
zudrQiWxMw4MuhUZR5gJPDLA~zom*o(j<hP6PRrK=!>cW}CmTF6r<1U|wCw#0UMjj)
zS}QHb1~iU;iHR3b3I<+$k8nG-LsOVC1$}}|^z>Z!{vyLI`G|i{SmUxjg4Ge!aplF`
z+*z_SRjT=ZossZbOSfm;0_~u}bbtTQHU9z|JXai@8ui-gyH+;H=frF{i@<eoDiSfA
z@TKH0u?&C&CR-eP-g1<L-MUGCma!fxaEklgZ6x<nMWpI6kwvr3Ys1_Dj;*~Yuy{SD
zSIvO)-i>#2vx?(jJ#I{T9LpY|mcZ9334TM=!)<a+JNg$_hsDRGkA;5n2YmTbd1B{>
z3qCzR@TED6pp6|JX{A&OBbBGeJJ+U_{tt6+85KwKz6pnrK=9yhf#4q8CAbG0+=9CW
zhY$h;5AHI!ySo#7aCaLlxZ5_*^WQzc4}12!D<9rDhiT~P9;&aps&1{j=xlj3SNi{c
zj5*aF3Yn-Hnz9XB?YHZ=42s|SG|IwTkE|bkS^HqfLKX2hP%CbLCr25xJ!1JgAyu8d
zLuG&VkSA;DbpnlUi0vYEfnK{no;4r5n3X3t_gwd=C~oncH)6PHTIF`Sz(cFR+KxgQ
zAFk|S+6)ZA^rF$#0KC0@RZzf_I0L~7K1%K*CA)ce`lRbdS=8GSn<Il_SD0)c@_z6)
zK4d~JqO{y2CVyT=c*Apin?zZGPC2l*7l+3)<g=E<<ruHQ;hc#1m&Om4b((b8O%ZZ?
z5*wdC$t`&h_to4O8vfwhtvCLhk5fQ(B<WIfAONGyWWHIsx7f?H4QNSNO>=kj0Zdvg
zHEiR3o#B(G#z&SkjA=+F%Ec~r3`-6KXd|UL8~M3=^1}y8X+4d$a~?y;5p{=pz6?*y
z0ZgBe<_Prq!-U$%7VnW}bSWz#U06-C5r*sEBg|Fh9Tcpl#PZ1}E4EAGooydC1DFKZ
zbngkiF%bu61djHf7GE2F%?#Zfx|3R5@E(LQ7vk&@TZaGYL!7$GjT6pZlsS1a(jX#u
zFMR#11f7@(7@g<1$+I<4y>aGOSZxo`joIVSMtj^P?O{B+hx|Lm$@{v#OmXXS8$=fe
zs_1b(`#*EnQylQM9rEmvMsdsfnIaJqP5E(ysyR0p;*A%!nhHSm<h&79wA%}pa6bO1
ztLowbbR#S)u5T6S5p@>-KK~@3bhT^q=FYRRfeRnxIGG+kKDpeD%ULS4K2XOi5x~Ch
zmIR9>(1j$*lilvQy5?_U?HF~Yt)5c2mt&>rfr*k89`GmA@@0F=yg|YdqoPD~iGI?A
zLKGP`-+icJDpTYVLbNqiShR~V+o%@R<9(iD25%gFsO3(Q!_sO_;`lIpoeKi1a<z<P
zmYl8MK?6vA%fhO{Q?lAe@T@zXtw++n^IR`vZ*#?kp0zHxoOIWfC1!Ao(AnDbxyh|Q
z<I`!-_>bXug(~<TWU-|kPimRF=26FQNA%u_Dnl_aFz)OxPH~%BGK9@0Ng*^Eu<d0n
z$YW$0Znq6x=bffCB{~Qwe0G7kL&U>J;$gDc9DPjMLCc=?zzWnOZhL#`t5jYzfeG%j
zv#IWQJ$b3KCH%!>?T)d~i1XZV7ojPUa9(5k-cbY*R4$fmBu#~0LGG(LBE3-$8GsBJ
z4M%HV9f-1jX>wX}A<Qz^tgqX`79Yr-ipM2G*@0TQ4A38rwLU#f#b`O{+JTZ(SwAFf
zoYP$3%D{goY!ZE*Mk{7@f;kD|PP#K~SR5KcQM?y3MGF_qXRC#%7*it~{o5rO&l<sm
zqg{i_%20wCL;@Gzu6_FJ^(|{SPd1y&4xECeCeny~!fxmvx2eJ}1eb7jJ;w0Ha|<b*
z(sraCH6_7{`>o5_LqCU|e6Q_|7O){T-S0|P+6V}_N_uum4=QZ>;SQVKh)sbUeegkl
zJ<@Lz!c6ZBcWx_lSpuP_lgj2u_f|r&Y%j5gB~O~Z2tt36<;AQ(33sn$GvbToAMdxE
zQ7EibMRIw)?f>-PMveKeA0MNQ1vQ_D_af#*3BuOv{5btEOmYwB6C|_6cibwC1T&V=
zebfo_u<{u;_X&h70I%pax7;^e$D!1^4ANma|Iyw{dr_eMHn+H@`^LrWRQQ=`lxQg^
zEk#jysK+lg(w3#I0Zu3?(7ATU*Whwo+bz?HIOyA9Pn+>B*y^v;s0bIopdf56y{bs@
zyxBT*6UA&9_U7{35@OE%KIoEYjqv>|J9uJ-<K<*Z1AXIpaWVe32E<kKSkX|X&`gVM
zg)&)<C9UO9ouJy2$+H7{r-`nT4DH`vi(#7N<^ru2TpdoKB-T2$guAx;-GeJIS2#_e
zPh00)k(F$hyarbTLH71+{yV4MbG7$xm{upcN-+;0`7VrXieh1l-ncV$R~6IEzm(fK
zKMVlshJzN`C`lR1>{5hntxWb`yHEB55JcW)Nw8`X;*E6&6?CDoW4V{)8f{cGTV`8n
zbFm&t*K}qFvLx{Ka=>Tit_9Wuh3E%4tj9)k-`1R}T_9_-UH3$nDpu3ek0~Z+&H0Y;
z4H!<vn_#bFHHg!=CaBr7b8-L=-t19fv|91xvEUNIS?wR*NVVfy6e^Q(-8Y)j)KKM3
z0(V95Jt;+T9UP2Zf;Cjl=KVcJ+cevC>@Rf2_!Sky9K1ZNF^I+kfxv>KEB0?Ui)%Oe
zA&3{Dl`pb?bO_DR&;kZ_1QWz<!|n4}OWnu3>_^`eX=q`quz|;Do7CC$fc`giE^J-E
zGwXP*k=x^n9VqdPNRaE(3%7wCS%YRk#%RxR^lLjIY<*`R8EKgUZ=nK<-IBfgB&|Nj
z>7WvwCy2yi^RNsXZ+e@{nS=!=^jfFGU(#90O*|?z)hy6Mi@Vka2JYf-1k>_!$InYi
zhifo-n0e=r6g;(tylA`6r^@pV1vx?ptapBCw>YCWp1@3Z>0~pj>sQ5x2PYx9^mfdI
zTGFl#$g3vTF~i<p8A|1J^LY#MC*8~xmD^J&sXDCR-9){eGaR7dqO$?=n~=}h1U>|n
zC|s8przf4T=DIvTdSl?SoObn3hK?yJ?7Nkhre^#i%9u!&+I~%cg3Eq{G|qW%aMv-C
zgpam=>t8EOvHx4g>0E2!AWO*WT5fPXK?}Vz#zjtVAfQGom1w@3RywVg{sOkTj$Ktw
z>q&w^LS3JEyce(kw9*(zaj<JFH8y&)mv0EFSSMpzZ42f5$5_?7RK#kE;6@X63U|Em
zdSI!N=sgOt3m>mVFspd|$#g16f+O14im}VYx}V3oCpf|Q#5>KgVE)$Cnt`%hENHXY
zjxKvAOk^&j8tYR%Cv{~Lr%x*@N`GZ=i4y`2Nv4phYBw5n-Ub5|*tnUFX1e9mj4`o7
zu7b!aD<w7UGwof<NC$dJr}S`ts()#2YT0IR)K_|o%7Y`(SrRrIjWhF$yVlq2$?TnE
z&4t`jI|5-Ai7mOb>@pf+L6a1fgvO9+V~*JIg0Mg#Rk3-*uiB%iojAjko*XEPXMM(p
z9#!SJLtw)U9B9KDeNDy*tz|rO0G)n)Ur(a+*S6C{hXx+HIOfnkzNZc?x!&}ybtqpM
z=P9HKy2+h-D6c%m^sn@Ie-VY#l=u5*6T44x3la_q$%*S^XP=LL<`i|Va-G*l)pBLb
z+9J$J2#vplP+8EPibezUZ+E60VU~4aRe@3=23_p!o7{uizNts9b<y~PZ4m-xU-r+p
z5<-SU0_RzP^8!cRSDTQ-GP38Rw&a_pmF|VMRWQHB&xEosm;y7zeG$Q{!r7*t3=}A2
zT2RNj#<0dC%V?Jv3At&~O6ZMlgPXR9)gmOTOM07`#dOz&+kI{=7|DW#7(ddHfMeW!
zgFKhDY1q)qfm};ApsbXouGz0wH%0n@QM(eONYyTEhEW@=KFtfQT6;Bo#JFbUjzk|+
zM~M<mTDgBFz}=YGIl6(PerfeXM*pg>^IpQ<Wunh7SSahu-UN+q-RmON(um|~`fNGc
zDj}4<wW4jYr8)Lg_Cu?z>lRoyYdd7^p+#=)O)gbtUAXN*4dGryY^8XwHit2u2HTt8
z>;yt}+PHC^&Mv($6libWzWqQ(_6p|dX~HJRS&&pnzadGlui^NQ`-~|~#NI;3bT7g;
zbyF5EDT3dob@rEM{u$kBVFk*>mwdKA5L#`b%DVFlAk$SwCSD8fd~$&22k&c8O!gkH
zP=EAL{MTC_`x(B775#YeBt6;8axEyEgMVZSW=SdZ$b|~h?1>+AZPOXH+Wr|k`rTvG
zU6HePR<%DP1GMyuX{5vM1MA^(8)~+15mLBJDXUL8YWj^^7pM@jy>)=ntgU_Ojaj9?
zI?`uDh}+QY8GX?G=Dy$gvs$=B;<wMZk<2AM8U$((hd+A!j<ik7;}=V>r)cyE)6{kR
zx-sDsQ}9GGuE-jF-@?1v^iDXm%NieW5Z00K?x5P&O!XE$Wr%K8XH<$zVx;F(9z(an
zsK52i@!SSwk?7_lubI1H`A!vv$V~fm)r{nH7P-Lk1^Pr<63DYYR*W8q&W@pg$Guok
zEmJ!B;t#L8krE+===;v;e)N$cWt|fybnBr}o+p3&B8E&P%c|pUTC~KcZoUnq1eDp-
z{IdFSUVIn*rh=0<a@D_CA`s$hPwHx`*S%fLWq(cX-IN9$ztp(U@Nm{#1a;rcz#!j)
zX=N<Deke*2(W!vpv>v!owMTUV(jCSb3*+;WK^L;b6HxQ-qm%XPd81-Wf_3kX2ID2u
z#_~3+0w_w@T{o}og!*T@XVzw51(tYP(U%E*Ux(NE+ba#lrV`FTgz6DjW6o=J&Q~kX
zdTgM3f<OIE1xiS7-VV<0{nA_<6Fnd0AkyW<av7+7SUxmn$*Uh)5sK*i5;;7^YB{M1
zg)a5(ji{W;cTapxX)^524PyDk)zKKfd8!uo1wz)Q)@042S~7+4Xja}I6?&a>-ZwWD
zX5EeGrJVhN;88GCu06zR_nWa%ejklSBNC_HOhE9h@seN*9&u5e$jGsz;p|&^^JRX&
z`SyCzB-6BtwK?6y<kkKNbelgOQk!|ZMyb<NJx6@k;Cv@ImA0aAnagIw@wUkZk3Gs6
z`F&9W36yc)OMGaQ)%EC}JaoK>pNGl6^1OtKB>Mb$E2J~$RNdLrr#A#!+0X5Dt{0Do
zCzl0L#9W|uAY4O(59R(e^?l9FE8FG9A8FP1Sw8M4Q^a*R^)8nuCo>3PdlH0RfWA_(
z&F!#<7-5(GOFhFp^V>c8oToglR?u#ybU;;sYCb&<F?XakZlvKnG()+u1dfg~<3SyK
zP#1w}OQau2O0U+DFBH+6*G+A||3^LS{`Qk<!91!Hnx6mF@@#7}2yjlnIL%M@GH9IB
z<aK|o!&+rdY1puITQM>j@-bmB8NzaEqxODB@vkKJ;!rUDXewv*T_(dj)E)i6K7OSP
z)PPDo@O+=<0agyMG_M9TdxV$yJL>v&75!A>)@{K0#Kq+=5pZ`S=86+BDT<?Ra1>rg
ziCggF_?uiu)Ubp3wXR95<<lp1W9*2&aLM|oIPj?jz1&4cQ1{m-W6;mI<Rj&T8nL!{
z!8h7_4Z6NxpbPjySnb}ra3+iOeL279xxe4e1!;o3ayc~3OuVXX-hDGb_HZeXXenoF
z6Ph8UnBfSNsD*=C2nHVBB3loU1c+=F31>U#I&+Z(hihV1Q2DUqz@zqdL6ku;pAfXM
z0?G!l>A<a5276b%BVQY1>e;E>jg`Sxt^b4;yoK)opS!r*eG@s&91_gaprWp`pYM10
zAL$-4lin@5@A0619j_8*6?HFi6s?^pCYRBLGv=Us!UU(i{^N_?L$laVJ{Pp%FMmW?
zD6SnGym766x%$+FeA3)uIR1?#bs=ti^T9zr(}dqat5@o}Y@QJ7Y|lEZc7-Y6Gi6eH
zdn92UP#MaYF6BQlna`vZV?%x5RO@w67;2mTl@N;go>*>x-HD%kaqF)F65Wn{X88c`
z@}JeK39<{S3A3eKYAS*lI7;H5D|itK7r`N>6}}u~kH&K`+XC*Q@O@lyJ757*ozy>O
zP!-$(N1}lT)NgizF5}5wGo9nH)}L(N2>#dx)&>jKiQ*Dx50Uf-)roP0E6f#2j^c|u
z9LPiQv{&ri?BOQwYeaG#bI@f8d^2K;!cqO>H=7#i=k<JV7WBJ12&R>u7i--P%T=Kh
z^MQ)eRpZbgd6v9@viv%3wg%!NOZL8pP@EI;b6x@NpDT>go2S>kZsx}bu8Z1<S8AH7
z7JSHNBr#5NLm0d9;le3n=Eqdx%mstBkh59$27|AP5pnS8pymEM{H>*8EfI&}1UQ)l
zs~=^?QpS^AZ%O{zvhcDY<PK>_6w~G#9824oIs46zq(K)OQ3zDOFx2aOWWUKGok^Pr
zn8d`zOVj=_26)&W*N9o{zXgO=W6CLvN!(V|LM+BVHn=UWU;Vv>UddC$(vd`FS-+in
z@_5ggJ{}OBO>rm<>t%AxOUZih6I&y;4_XE3pQ!}Yf<f0rmqQpLo4*EX?Z?Uq?6!N1
zzvC=x#oG1Kl<Pe>9vYzR!xrF!b@#BWw=Gn#4#Go;sr_{<zV<kq3mTH)8Pw}P(y^^e
zFC455ec6k(ol`9K=q^vT6GoKl<nX5+jL2)OQS1$5a3_A*g*j-Kcg;;8;`H%y*BBvd
z%_=V`2p25mph%Po!Fn6VWU<D52FuzMYD2S(E0YNK)`p+tLDdKBe^VwFjfo8{3W6yP
z^0RH!&X&Cv2p8>s<C(b=BAG{)0Y+L7Rj|p0A6)z_OR>A!lm#0~0>hy}Q6s#+_N>Tl
z(IsSK==k)!JPndX)#$T`(g*g;qkPg7dp>mZDpe*X?mrCjOG7DPU@-JBqi%|)3pkrj
z0jtytL9#tvFQD`AkM}4&1+3ckL&F4tyR&OSeYwi}yNwMNU*S}oWakK$ds5T&r39L0
z^k;g-MpQu6mK0aSlRqoN1r8Zd91ei|X~LzzRO2{E-nHdYC0pNVQhOF6&#{%)G=i`5
zaiHyTQ?}W$Aav1;28Xx-rn;YZj<1-|0(rW-<Cgm5duohCBuVGo6p?y74vV|>PszyI
z3UBUUWwk}a0a{{yPWJDe6cpy9>HbaAgJ9=c=2IliZwXAgr=F4N(8+vikFiC6KDa<g
zYZak)I}=*?6@|mrj2J&Bq<3KZao|o0)@l?150uoMc*Xn4{pSH6)%qv#$TICfH2ZIl
zcwWk2WV%_Kkn)9^{>US(EK44gDbh+**AOJ#b|1uW3Ej%O3r2pon^)I%=^Z~a2*C@k
zVwJ~t-l>`knA<}MlEn^u;LA0^zZOE@|K7ToYu6*vv3NKyx0MILIyFZbgHT-r?@7{{
zA3{dkA41C7T_x-F9$8F}l+9N>m#ah7wz7Z-@bC8-Pf?xFN)%kAS;OUATl0I4)19-L
zKMMTcdv*{<Qr31+x+@q>D3a`W@*;`@WaQg>4l6Fp5p|te?o>blwOqV7kFOptxe_<3
zYs|yST0SN=*1pwLe>-&qdF5gi7Z?91z3c(4@qY7d;<VW@-}nY9F_EZEpjMpu*t*9Z
z&5i24QzM+VkSpy)IVl@sV=<1ktQbzFEgPyMUe81_n&Ed!2t7f#9G|t1c0Sn98}6>F
z07C@|(Tid(r8B4-6>3S7GtX<+=Rz9iQa-(2UeFLv`ZB^wZpnMQL@Bp;&r_sc;HOX@
zXz(e|SY_!wvd+RAHOmPwC6sM2)AqWYrOOJL)38bvnp~HUFrYD%b(AJDaidcM;c%GF
zFDOwaY$f^}`Hxdymed3+i>j!&Kq#BEk<W;8j+@>D)l!Ah?F?WZaM3V1wj#KXspBR@
z9Cx-o!rRL}qo+giS?JQ6q>yxbA)@LIQN?(?fB3y8ve=F<3q#*nS%s_<f;5$ZSToIY
zZ9dc8TS0Lt^Y;&4c*n(SM+cD|Ywv#s27aLAe*ZKWz-p)eW}KQ+@X~kFA{^Lm!i|6^
zEMLUutGDxe_q)%%!ffFsld?eQT+!|(=E!aTSWFLBz-63^?7iRCWpO@JlV`_df5Nb2
z9_GUyCjLOnp#OMtQ&YFUbx=loyYpfWDKXMeEtED)9FR@lNqLwA|CUW0WOZ)t315^^
zqSF$vuciQjarQZ{af1tm(Xtb={=V*!w-LR7JoFGP<4|m9=8kq!Va02WL0SrdAEX{~
zb#NrxH9r;JxUzS4@Q0trk&FXGoC&r-cqOzjl=G_|HEtEN^8<?~TX`vQ>VOq4JYR3A
z`AmhYb021v7a@HwNH$)*!insD!+@USF84GJm^+Lm<F^mrz<UxpGHFXM?itv<by9Hx
zfhMU17dr34^O=&POf+R-p_82#rHp%wmPRahu2FXaO@CZ1j6-C#slehNQDV!+v5tJ6
zuyuXz->!P=B~V_(K}@GSmN>|FLpEl5Lq?uEzU7L}%4tC@d5JX!ZXLXrrMx5vBsr4n
zd+l_6yP1y`HqIB~l&%(^<~)OXW;6oIl5Z?F(D{L<Mda~iU?kn_x&xal6(L)4JfpUM
z+Y38R{@o|p7>`%4h-tdjQcdM>(6Lokpj^bTUv~%7{_P22wbuGqh;vxI%yQ-WnOLGg
zQ-q1Yo=x+%()0Q8iPP>Xq)|oNOY0Uhw(N<K%C0f6zedUB8LRJ`b=ZW7)#gw{d!|!=
zxl*$u{*;B#+x!~jler$eK-UOEqx`(D>AW{h-qa6gPM%(R#r%UDPuQ{%R-HW$ZK}{B
zomvX@G~ZVgV!TWVFvuv!M#ne$N|o&Mfy@iwbLK547dq+IAGoBA2;SY2Zf-V0aJ9v6
z!|5(hZSFhg>{EAVdXE}PePM^1>xGjh;>Hh~BW||)QE%3Z<0m@CUEs@l7>Na-*tksu
z-+K2|!~>X)Qu<k+@&f_)$5`AwWR};D*5+U{rfPcpp&9k2u-o;fL{F`d98}mFTaT!l
z%*zXD`t~k{kMjrItz4)bU#7}^xl+CkzUreXNI9~eZ(~NB9DJSYn*+(s1o*_4L(QZY
zHy12B_v2G$J<|j=piM#RY4gTE;1YlLfkpK|74IJ}g%s(!Y<#?gY>rwN?#?)P43RTB
z+gQSdCx=7&t=o*=-(PM$PmBAH%PQ*XM0A5RRq?U~nquLy^IIFC9hdzgyR`eg;u%d1
z_4b|gS225%@8A)4je(V|T}vNW6q{O4Gkd%o*>{c1)?c)_>ucjtVBpy@r%LCIPz@^)
zg!vHgeE2jlo~dY&8c~{<#fJB&Y7I|ZkuK;RCFtP5&xxh*p?u&z<g^ix(Na=Su_z$1
zBs+jfmYa`W%u^W~7dU^QuMNE;r16n4V*O$mDsmcw5f_E1LkFRzpv%^Q(n)v>W+B#8
z<jS0?V8ppU*7VLw^)h1X2{<St?9m3xU|~0|<P>yVa@PFGMLb&0MlNQ_;!kvAErJbE
zQH96MZ(*`;4a6x?1&VgJm$f?{Wc^edzqYfrWVqDHGFHVG;Ph+!*lMH9`V^o0RxUSP
zu8*af=Bb27F1K?jbSG|<5J{z%Tchub^3=rAo4~t^Z>rT<PJP2~B;cHp8B`LrY0|hZ
z1f0(1CE+GAkKiOCb6+O}+#Wbd@+QcUi0Ko|Eq`a2d=okFfJREt@uva01Xk2xXXX5G
z-s0o2E><PD?KJR<VR0_;!LA?@-dWf+4IV;qjyL|Oa`>DrDegZ-xG&TJc++4T529UU
zV5jKeGJOkV;k{=&#n^P+-+RFF8nix%Ew$$d@VWjKy>GJ}_XOnEMn2R2zOZa4Dzxma
z4Y4kCr9FtR{#f{+ZIn<^cWRt!(r&p=xAYzYK990kxc<8_Bkxh1!|D9T@$d2sWx1W0
zYzpe<a{2gdX(PVd;noci=l~nL-FjY4Y8DJMmzr*c{9L!4T)v%}@f@yf6+(Hw)O)1O
z<?y)gvNY9lzF!!s<vQ@RL^WBi`*C))HfwwN<9#NL{Y#n_<bE7TQprkXToN@19~Vc`
zjYUBOg3Alp^u8#lxlH|?HF4b0?KspGIQ@tk?Hl%2Y=`pNA^z@LkD`N!!QB`&klI6R
zc%%U@4B3zn-3uJ?U~!Cl$`uCZBOoRr5O7Wzi=^93xnp3~d8i?!s7q;`-^&z?58Ng`
zuO*z(P;fCN-nH|C_U8ab3MG)1L_>&3MT1vP^DR6E5On|Mkp+DKyl(+aKOCb%fy|m`
zcEDZvl3;U*3;bcWvfTo18FLECdZ_6&(!*_7*=iMXsceAczG1X3{GtQ>B5`XG`XUCk
zwCt31mcB^vyC_RRkH_IPq0u0E2OXmk!T_KQdog85h|WJ>46N&YR{tl94Lvqg2TK`x
zmk;cK{!a^(p>%so;D2)2fNZdoe_8>&z1$J|v?Dr;2CBDh{3ns>hbyD=-sW28QGsSP
zudRh;_pH!G8jw3CD7Zyrh@0`G01UBq6=;*s5kZl9X`pfc81Sv4!2kFCs|1Y7msGl^
z5#X8s`L{rz-&e*L$epk}+Zr&RKXZyUI3VMmLwb5DJ2}6<KaER|EeJ#M@``nc&wShX
zAyx0R$zbOuWWy+lt+%&oR=j!^cyD2f$2Oz@J~4d^$@-BrO^Ag%6idq#-^!HS3Vd{G
zT3PaoE7SxPm8zVEE)l<7#Gz9TUyDISq7kItlhRxDVTB=nybF8VrBm)0#k{fvPkT`^
z$H5Un-**{NEGYa(Oek)PSNc<~DDHHV%K;=y9H|f;lZZ%%ou)ZsRS51#GY^@uqw?hH
z$|tm4i~GJ<y!u*~dy_F)dBto!EZ_V}5XtPqsfLBssOO#IUvE^*PugzxaG|2O<B>v7
zzeof;q*hz^E1#%u=~t`SfWCLYYO1rI|KV}Dzj>vrdvg;I^1|f|DXgadg74=O?PF;G
zP^#Vy*h_+cFqSs_?($%LQjze9-h4_*m!JigfKxT-?l>6kYX+h8y>81A9LiMg%DrDI
zY<Z#fXIRe50nb=o7fY~A+~Cb+eOZIocDyQ9rjqePG4QQg+{r?|f`jplp}@mNZ=UZ7
zy?gZ0n=BZ=4|Gvz7trqxydZKX<n`U`3(vJNX??aWNWVt;bN!5_oRNA^#8MV?_qB<4
zs#F^un@+W(e$^)^t@)~z&K8?1@%aD<P*>PY<RJJwKe`saJ2QJb)Slu>`}<2nC{RAY
z?vzQKZLk?@5cwJW0Y5;ECc6M<kftS|s{IRPcDY5A)p(Y8fnF<bo?P0ggx$YBm{!_<
zX!I9QH-KL-Fg)7t7LjxZ>1b$rsw;3QGv7+LI=p%Ig>tK-U6N)Sc1zHx6|qZ15Ww0H
z!&)@ycYNA0dy2b(lYOS=VxzGod3uKwsh(=+tNS(};MXq?TE_EIm*;-)Zty6q*i?}&
zyv;%l;B8FtMX$NWd0Z7M><|YJq?P-=Lmc3_(Vv~nS9I8)qCH%wMH)&d@9GjCsxUu2
z^TiHLDCqzab1EFCc^R~-h%l+;#oM1?bDt9!bO#=W;o;}YBhz|`7<3xm>;kEDUJ{Kg
z@~3AAFL7{k>~Slj#hoMbI~7<Wk46HG3MAZ$N4rh_I`q1YCHlIxk{;94sJR>i3I$o~
z4%*;L4C;?F(u#TvJKQr;MBSEeizy>yN_x;s+<FaxG(4;z%J{X+9;0AbjL-^Fq&U!b
z??mQG4WslPlHkU<aGvtHfO!l)R@qLuVB$pbO5#auISR?FU!{pMi61J(jjDP~<)Y_)
z1|w2QS@*aFqu^bKT;kDJq8ej`QAy_g;=mKfqpj33dSl4V!`q8YAsNgTO9Tc_tWN&$
z$aK6MoU3%oh*iPaeVGd=DKD7rBmtdXMnSr}dRO_K2LaU$;XBmu9)Y7E8vVAGsp1@!
z{EXa1mWBG`U$O~yYwm9BqCy?V6#O3u_VANJs`nphI5@=UQY&Y!^(nVBv51ItPmk(t
zGQnWK{b{S;PJ1w-1I{xKuYF$ocl~j}4bIt8Ro*h9q2<{Q@9GkQVYG!*zJkpN?C$%E
zFq+;RR=G*FQO~rjlq;jQmz?P}zAw8p?m;#(q!qEY>Bre;zD`fYsqB!4h=5Qy2<dpQ
z@3TU{p{*)jydr<1)^2*!<a_?ir+;ZDaU+Lt*JQ3`6`Y5t*Z%Y+YanBy$afRtHtRY6
zBjg=p61$iG*lK1cVU3&rUAZ|=0lF5-t?FH~`?H6yO!bosf=g^>xxV6kiLcGu3%l*v
zTD|eumOOTHUtHyw7N)Elj@-)6D0|Nv7V<f>KVhcFGtJag?UWJHc%P6N<5<ze|IvDM
zFUtYX+vBIK&1i_I#%5oJ(cVPvui)U$+w<M=8Vi*gi%GcIa(zi#+cG0ta&oEN?gHg(
z7L!4&y}I6bM(r%CS*8%zfS*s#gTuq|A$|x51J6RyU!ro>#GR4l<c3+Su5=tnxg<uC
zIRM00jgA&v8l3kK;ZO*|*i449%*N6u7{`DCApGH0N7M+>bN)wU;O8^qd^1xSf$sr7
zf8Km%#`WL|vSc>v)TicVM{M=Hj`68kX|hR}GG1Eb`pI+Lj<Vn{d&zmSAv$~ibgBg?
za_vCA^&J|$kPvCHMtMA(4+)QB4zLq6F=0^16%BZ^0+NqDQ>=jo>`U_-(NOf+#%8Vp
z=4i2AQb#9sY7W?OCX78Eml#PB&<L@^U4w&zCxp*DuMR~P>sG;*({wjLv5N|~QzHvr
zVyi$p4i4=8NK#1vv)m1JC8hUQf0ya88=*HkfG`vl{TSM}G}rL?=I(8Gzs5<~4Lra9
zUsy4V2jPX{2BY2(JZ^IuhEgJQEFyC3Xi&y|Jq8w0;Bbj`@B9ZK&-G%K5)kYTAE~L0
zPu4mUd0mRw6IpCZj+PqFOSSW%lP3U(KV{<R4DT-XCOVEppBcwtGJ(yho{Cr%Ltk0V
zmc`v{Mhg9or)o+>@&;w~KA4UquLqI(bo_XWl!FKQB9ak-J5#F7Wg+ZR1cjPE+#Qrd
zXUj=9HaBxE{%O7F^G~3MsRWdQSCSk~)<pLD_krtW(Nxf1GDym$0qLAWf>7f++U9-#
zJ0^xgAg-w4`n4<=4318kNY^XXs*O(Pr@C+my}Bp{YQdE0wH76QabBVP_>r89OjxD}
zC>oRJ2Ee?D>-~YOl}aH)ur%@I!GT8~3*Oni7#O{Pw^(Qn6{L-Sde`W<Ewjh*NS?AX
zLjH1v{%?S`(pmL8Q-vy$9z-p?gMa?~_Tbps-lola=WQ(`Ee&*-P431{Mlh9f`}0$?
zvuyTnNKgr|h%+%MNxGh`>a%C_XbKlvhVK)Pm$x^z3cxnt^`xonyU^nPsp;Dh-6hBt
zk_n@b&QIGanen|aJDcK>McS@8Uy%dn1%bpDou~Y>Cl%y09smqW<>$}udaWK{#SFm^
z4eN1z^gUQ)U`by#@K6`)zXZRo1I11zy0Lw3w{iDoJ}=NHVKZ8fYkxBvN$&O1mwI_Y
zGq6Vbli4kPWJ^ZM2z{Qcbo2N3$3DgxSY6d8h}fzg6O19@f60NqV3h&TUx9Q5Am#Rv
zv<4_^)+lq?EU@q4NGd8S_Nsy-b)6qd%iEu{2!`Y}ft-Ew*|O#0%8-IOyVVH0wp$7Q
z8eypa`*4dIczQ<2ghVGWu4E3AJb)crVwv^z2>Jno=%qcYbi7#7{Sn0I=;+|YE})Ql
zd~EYL%%MfZvzb8B3t)nu0TmHKnDv%v!9PeaAnGHqEZ0K#45-y4TVI3V-2%Xvd}04u
zLqnrCb~X!kV$y*O7#zL8^;%Gj)+Ru^b98q8yxQiiT&l&fhl7?3O`uG^LBnGaZo=N`
z4aE&9{4XjhjK9Y97UlH*z)}u%Yp&tubcQMwCRG0h)>j0*sD~c1%F4<UM?43!<r;GC
z+RkeZcQ;0?uWtKkfwE0C=Hsuq>{e9e+*N=*p2UMtiC6Y-UH2wFPL*h?>@zV_Uf5wC
zg^O<{^S&(x>OsjUmIM9!(#1+OzRx~|l7g*q%9<AlVFDf(ZkKOt$N^0>QVozyJy_nV
zZA-#KNl8f)F}eht)-)(93>T*~3=GIVK0YBDc65Av+8$py4iZE?`0(Vjwmb&j0iE&B
z>(TeKC&lx_`Pi3ESv7XW?8f^*6v7t{0iX)LfXa6;Uv2iqb@%Ub^H2ml*~R+M;vyk1
zkNQ_uRvLu>5B|>!(k`u0rX!Lo6L<1(>+}M0J+(qAxAJ}~Gl}Sn==_%{DZ?Wph87lu
zZXYiy>1b)C33h*7K`}AzxM*o;-Wm6Wi4?1s_GC}~GX|a}2gk+|(%V22!~_>$hRgkF
zOtC1S-QLdss2MN$w(2z}G8s79tsX9Wg~~NSh5xqYeTH6}7wvMK2&sg4MiJvbJOwn-
zmq+?3NRykFw{dg2S)h_1!LFBDU0uCF3;_9pWjm1cF)EFw4;JYB=hByTGmvL_XM?j^
ztJw{J_5MI5Bcmdqqj`T>0G{B_WBA~9-N3-W2~0zv%9A#~*Nqb8=D$Sw=iTmQZhAUC
zySV59_Dl=#dAyTWbi%r;5QhhsYgX@M2*v@n&vPzN<jCTc?!S%rw<SU`FT&8K$@Q3o
zPNOVLtyukKHu?2m&;8QYNDb$uvKM-Hzj^7(e?9}ZtGT<ogDQ;z*y|$v{QO>;N(pfC
z&No<aq}sSYVxlzI(9rO|b6M249;%Dy{M%!HXnlSC-?OBFfW8hTMdug>oabP%Ak=s7
z-YLmp-@OO6xcf=KVF{Q;5YNf!Vh!b5OEtMPUbQ=H&3}d{Fh;?E1j+^`9#FMu_&>ye
zwCe-pyoelJSReo@p-s&3iIN6JM@Q#ud{t10c)8@x<8<Tg&S+XFA~v1D{ngPIJH;0O
zz`hCql>y@<o`mdTYXH-44ZEzY47%LR1vKF&Ftoatm(zGMgvs6)z+Mufp`lSyQ`4tH
zA79{pc|CECZ`~y5`-lL=>J04c$`k1T4p3ew1`Dzm09bxeya!4ucJ}mqKJopD3Ulfz
z>}ga8dsL~9;heOyvoj%xrRaG99bbLzy<f!(Sy!GC*Vos#xwyD^!hy!*O|N(Q!&_z-
z7vI-sW@l$}ULUV&AlcX)wZG+ks%bI@$UU;$?D~AX)aWE>W4qc`$_Z?^W+$Al+h7ml
zeSakm@HqG2(R&YAKm%pI2*qI(?G8jyZujxt^YvTvhGdHPx4*H{-0#rJ6F$)ZJDj%5
zEjPI+7ppVw*?D*uwlOP_dhj8HZWs%gL&zE$8)<a_T|){gFD@yWt=s&K+vB3ZC<OAX
zeZd6h0t_mp6kwzC+Dw7s=>S0lO<gE4%zkuQS}BgErlzHsCwq~sghb#%PJVu|yp~q7
zR!&}Ck-Usd$O1%<dtdYzSvdg!sTTNtB|=`Rw5Fck-a>h6>ym|@o}PlY#BiT=3vdgN
zN*@bkRaLPt?}#BA_#?Wj8Y_1zh`JZJnPWoFM8I4fLMtjt+6EecLo4~|kE?#xiA0aE
z9uOCH(j_C~X7G`Eze7e9IMTONMC0gz29TIbJ_q8ei+01(7p`xQMdPPa2F2B!WF<Eg
zz|sc;Hx2_gTDlp2<nD!RiU=fmoCDebwzB*S3bj9e{K#?OTHP&&0!mLD*I?%$?zX{p
z@W;+U6yW&NvEodG2gG9_UEwGM95aYYbQDq5BdFo&>**2H6@X(xj9BCMUL^YC7%`67
z82`A<fzH9BErV@m#|lRt;1)gU3PerE|M3%|gVmH#(+|zh@Ciw&|GQx!#ci~SsVuy)
zsz2>X>pX7I<n!opu|F+~7%Td$S2?UgtSTRitM*9^H@@+#gAL?jki>|_Fu5II($-QT
zmxvpWf8NDrLIT<;L1oC^@iUnL&ZgkTy8~w(^+186utQVRekLdU1q3a;704O5@u%lq
zGOqwIUIXa8HG#TReH}1*I1%&w87N5YpkoL}npp4*0)Y&c8XR6UMo5#3Rp)asP`ys3
z<GUcrH$dWjk$X%8G(6vSRVOPFP-87oiB}UP$i0TBWJwcMeT4y@UY`j;Jpwp##rwx$
z4s{L&Z7YrV0&ungnCS6<8q0`Eh%`{AThvk273ksVBjfzzx&h>MflEpN<W+!UK7jle
z;8MDPzh(~LgZ<0JlT)O?AdOd|>EdJwJ<07^*Xq!P3PXQYXqJc~bd^5dy~w{P_^gXf
z)kTRzT@M6TjLJ~G?Pt=|QZbx>8;<}0Vyp+s8-^W91pt}iuNY3ojkf^K+UbELfK7fO
z?gmLs07U8VYW^DV@$0}RK6)U8R{*)b<EmF>A`7fqfQ#i*>ME)nVlm*KzbiQ|o6_m5
zua^J*{T|Te;6IrT|K1o0qSPZbxg`mhoptm6)&EI#lP>_fowmgxi7WoBPjJPpmr&nr
z113$PzY<)pR-)7R<rF9rgaP<b^-CJa;OTAubcWD=><r;@tk{SmDscmLuSk#kX<4%A
zhmE#v&@0OWs#HZ)FJVMbCyMvS&Ie98@PHijP~*{J-waV~8Myx<Vu+0L-xhH!xQihw
zdg_Ix7Xr{t0MJ#Vbrw=X(oJ9Sdxwfb%}S<$E-(#9jmQ2THbnq3Wq>V3s6~B)NJ9ny
zKy~~TasX_%0HB6?Ak$%_p;!Q*YTk;lWcYYZ02~`V(9Q_b&>we0d|osL6#%l%^GwT=
z{SG!SJy72m5<SdXK-@cE<l)4Ecbgr-L$gAk?*bV3KWMEZKKrEcyMLi$f+RlKp_dDt
z-Qf@U(zHBv9l-NfYNvsQ2r1l+3G9eA!U<bud5&GAcUwI!i>8Wy3wqxe1M2hRqfsv!
z59m}JRsDe$LESpqAG?0bpqB$cqMQ=Ms*I{W94p3=ch(Wo48Z6pU9kah)Qt(Aer2fh
z43-Dvqm04841mPpSkWSd8m}?Xc~%vzbjeKu5~P72q6XMk1Psy_Nu*$ul+Rm`OvB6|
zrUtKO42-%8-~qKsKzTz*LtgHNNi56^pLPOF1_3&05`!d0V24V8vz*Kf=fK&mmI~xF
z`1rzN*r7FdB@Q<i1AIYdhRxl8xK{u!Z-7CFGzd9=6k~Qy6ZF;sHb;I4m_>6ls^_hY
z=aM+<V_)I!A>?u^cUn1!9`!t0;9$48!@sx)Uq2#5e(q4(^So686nWov(5V=zx>uAx
zwy(?&>=Xb9MjlmT0<@9_4Gc|9ER6FB>5?HYKEW!QkeIDw>nATQj=Z+OwhTXZ0{Y2`
zRkuiNSAa&_(FVO%0H!*q>MaTW+whJR4_TBTy$|q1RsgG_h#1PF{kKg%g7+QxE4-9Y
z;}!plQGhWHP5WOm$kb$)to^%}pF7XtHFg03%cBm-W7wcG&LCBZjHx;*Vos$u;vcH7
z*dI}4j;rO8;Ny7!yb1uaaWFGX0w}JuRD`AC#)Hp0*jxYv`O%8t%264*cLPiwS}HJJ
z>4AcQG5S>m-=i%Qu%vPSgHD_9CER0#32MgXtSzk3TzRK`<SPxGo@wWL3C?<jkW0-^
zP{L%XSxosJu?$JN(J(Ycz%h9piY)|ShznqmPYJ4&Mpa(|_%#ch5<r-Em3M0)!j#6G
zL87y@OJij8jl?^+t7T(WywO?2hvc^1twYAq8vEGHboax3F2at_G|U0x#vf1j^0Qrr
zGZOjkLPVsqsA8JHac&tQ4JD9s%idkV1_RpWH4cRXeIh61{I~QjMWeIcspub%y>F&P
zeQU$kTR3*wKB$_K%Bk^2tOKpp*hn-CIg1i2Dj}2jTh;Ej^M9mdC8>Bu=QTq_390`t
zd0u2%#PlC?0Lw^X%!b4u{V%_r{Gd+g#oMK7j}T|0Si6zzH5dQDmQm@>nBroH?<h8Z
z_Tt690A~?O=7&F?`0H*J?hH+rq>;DUkz!+v(RehhX1TX3EEXIzoV)Fa|4+L2OBLyZ
zd+KiZP!Vel-U{9T;iTK<d%LBz)=~FzS>6}tP;2r3WN3gK<bf_75+jdJ9W#9R^ReN8
z0P(*1)40o);SHq;g-|3>wG?ca<qXMCjeiKD9P<%ty_vSxf(;dFsz3nB!HmIaj&x$%
z&O4$HY|6i}VY<^)PQ{Kqpe!D+wgOjTjy^CGqG6S$Ge!)Wtr%A7c0EmvPOMJHj5j?d
z(VOwX@4E${I;ScZ>DBm)t|c8Mnn;xfa%k-3^8~QFhd~iXPB~O=Ydu*mpk@~e^>V#%
zlVTjBrQg^MH@`~!w+@r$HKkDN``5#(Ssf4gOLW@soOZ`LmqyUg<D-I7L1(w&R;;d_
zMkQLUI95B%-G_0DncMiGheQO6lkfl9V@|@4^eFEtxuq_D_ftXZW@W?2-}Aa<qfZ~|
z47mmdyfA9KJ|IS9fdL;*#J~&;cr{>#ETL2th=7kr8|*xj{#PL9zhD~!+9^aWq5{N)
z(zM7l2oM7$ycNUo@bTmca!fpJh4zh2#Pr{E#q5nJojDb{&KC9lWVIjWcx<lykp_8p
zqSMa1(~zAv=`ThUPR_1HjAAp~H4?Yo?DK^!IidM6PY&ECoy_P29202#khq1ru{hyP
z3^K`LVa82T)@!Ks<kj+ddb{949I(6)@k?RwGb-zRSPogLz5pUDPRvo_5^kxWRRpsZ
zhgfUTwo;jd(?x0v+9+$|pGcJN>$kNxxtF-+SDM-vByGfSdWKS?WTq(!zO^!vqKU8y
z!$c9^!UcP;F=xg4IWX{(ava2w1^8HrIA`nEcCS`5O%7IBu77d1q*H&OkKwFh`;Bw|
zrr%Vq$1p{zN1!oyI^|m@B?}ljOB>ObK*UfDOkoRv4gx4;QGnQV24qJWDue&7$n+W@
zW^aJWEdy8mbq5kXIv_6@XvD@`fr1Lp8<&!LLdLgf0kiu5#6zBnfPm96F1-(+A20(#
zO;NhSD2Aw{0niW122Lf0vs)X^R8F=gB*O4p@gtbK9PC7xFBVOHI5&CmDl*MK7xX7C
zwII#x35wea@<dcdfR<X3;B4J~-IToEit-+fsOo#@^k?0xApWBK>tgpV@lwsR!~=`U
zTVr1F7<{~Y#Bx4}nG<~zpO_dnyp+HKnjy5wOA|KNqDmK92`?-4?cofi!NS>!wxOIP
zIqD|Oi0nJ+V8_}q{ctKy^N<d|KCl@CnfCooD5<`7ZR&EmoJIdmaa6=MO9)kAKY&y+
zO+-op#!;$8K~YxNP3fIppit*dr|!7R70;XAXd5yI){g?{dR()avSYywd)Sg!Nj<L7
z`er}pjh6pJCDyIJ29NHt7HnfJU4)5C5by=kcZci(Ahi-P2>tfo#{JlNhQR~Uqkta@
z1*jbdP@5h>EppRu+uyOm>kF!SnGE=z7I29jQ~uAD$aNI4cz>N1_dUagb|+d>#`b{U
zQdT8U!8a)+H&NG)zvEP1<un+H?dm1^Krm?MZ+k*iPPeAyyskH;mJp<<^cj-kiP5^#
zs!z1XbWfz1$YL-~%~kB!iGA_W-EV1V<oaVUV<27~>J3z_Z3>e_is0Rbj}2mBEYuvY
z?j>DB?@zhVMcV3hs=PJ#1n2lNQ9Ovg33F;XDI|WJVG=~aT$O4GixB<lMsvu)wXsMt
z>CnZLN{MMfc?*ijSQrje{)_{Zw-luETtA$mowFhMVSa!K9XIAiUFfB&``+^#kGdp{
z2l>3rll)U89*4#E++L5hKP@77wPI)@OtUQJCzOY*SCVwzig~9W;s5v58(plXm3Fts
zsM#^lli2zt?n@}Etep<<bl>-ekOI9FN>p;Af>AODY@uX3&>3RoSkTv!%3tM6>8itF
z%wVchA*s_rd~w7MLoI-rqy1F%R0Fvryen;tOhm4F{F>pEWzFjQ=e-=aK`53M)FUqv
zztjRuuX9)Cn6YPMJ_Ivoj4s~J<CtnbTk)DQsG+-8hzOr2$<4HeP`CZ?7o#cqRzr-<
z$e<FP^Efq;q==J@*#pZxTUOP%lviH(6`uLnei)8FXSV<oru%>hH)kue4}m*|;^cXh
ztS_EIq<?uf_F>vcrTd({+=9_B%BnjrN94UavmX9{loaX@7!x^e=`q;wp(;q@c3Y_Y
z2u{5b2;QtuztN2*Cz4LJvDNt#06*!r!L1(=Lpu#Ze8Qj3GXj9Cl<-5v09Q4o3p|L>
z7)WFNw_^a?NeyvX@x^6G{on1vcrak}R02Bszjk3!pbiF)v##_LcfA`TRr$E&*8-S4
z7eas7c<@(3DcHOmQH_4|hV7Kk5e_7XjxmP5Mm!$h^iYe<G2SC$7#7et2TTeszKv?&
zsHJW@=0~=w|JxHmyjbbI$ay%|ibg$3*g?;afIsjg9#G~mJ76aDTDVyy--8}e_v#Cn
zo}%a7r~7O141DcOi>EhF<YVa8o-p3Ls9jCXZ9Ny84tDZFUNa7ushEzxG$;EoSq&`y
z_&GP|>I5?}`gX)lFIHIHb6PJqVQbePbv$Kr8SI=POV_|i^uLll>CaWmW^wLCxp80Z
zPE0qh+yvJHR>0f;59aMH6Qb_1e#_IJ12cwa@X1~1OLTu$AE=h{zc3=0`GU6E=9vxi
zjbHbF2Ysc2>pt9}xS{?UWkb==F!4S+#iiryzPFxf!SL$%==8p**)2)rD&f%STMqWl
z<==3iaQE-e5l#vocr~+V68&}Em3s{cAF7a|h;1TUhcpcS)>PuLdNJh5CkJcZ*Q{T%
zr7=)olHc)-S31C#aG+B3w-!LKEgN9ly#(>N9ww!p(n1qPXIX8Q3?3$2-}NbE_`ATP
z8uu0)EBg*JHAv+9p?=RmC;i1|R%f)aHjeknn&wV1HPmI1bj_WBXJ!DV!N;C&M;<>C
zs9SFM@M|Ek?djd$#x}By5z0zF>?pnX2G?B#jH->bvyNBsOkgQ6YZ`j9X2nJ$U^6kp
z520-t+=@$Aw0uU5p9RSI0U#$Z4GhVMPH(yy+-4FnWW@T%6@P*H00DdmU$9B~ex_v>
zVECvJtA@wn#&;IM4q3Y!5I9P|ua*$umy2NN4hv5}Cwj)h-9her&`$r8wUfFLQk&Ln
zd?tcK32=#t+H~#UTerg`R}|4Eu%v4F^y5wIIR>bW42E2Ym}%E+t$Lh#9s3>wVPO7G
zXnl8};3KQ&uJ=uUA31Li!F^z4&s@MPdaPU>-+W|?Z6s-*j`&=$XaerH>qkUgv^nw=
zYZ=ou0puq?hRqzFEU6A3bc0~x>_suLY|J{L6G;yrrY{+qM%z$7yqZlIQR5BtuP%sU
zDHr`rlPp_ifg3x6w0JxYxWlh0q%tr3uV!xXAST$zqR~+?althpT%u$aEbWWe=q8?U
zpYoaey(94otvD4oWl{h4jpqARWhk%L4a@#?aS)LEkS*d5_a$qhK$*h%XaU=5rlb?-
zP{5%GtF5j51`bYU7B<|Qy-mfAR@!Vd_4Wo)w?;!)53yv7N%WkcRymT0%j02xrZBu|
zM9cVwiSb4<_xJ62!^8G5vvV%F00llc-ITla?;AP)tly$L_tpRE)4wf;Gf(<pR}K<f
zTF2dAY(3rooU{jTKQX^JeWnxpVCnzHeO4wK7V#nX{`KY5DjI%rGdiKzO+FLN=EEts
zPy*_M9u{@(Yl5TJ+zXccjoX~#AAKg<ozOk9^DWTV$$Wk~BP%Lh+@wfUJZ5=%y|Nmg
zGxy%Bagn1>u^Y_9gk02I<xoEG<~kjUgrYAylgA${o~y5(YVg?_J4cC(k(O;ku>S}4
z{TB`e7iCT*!2hA*Ld&V@@;|iLy|c4HuT^2g(WyDCNk>Nu*h=UCbNLR1A7INSmUbnE
zhQ)iizP<edBh6-YH{X)gX9BK~YZ^6jqJooM85;WtSH^O%Vc|YukRU!usX`sd>|Oum
z!*B5j+<ChIa@pTw$}0KoiPF*mXP(YP%tkYfy{j=7@65l!7E}HodJ!`Ij*A<kwCYh%
zP^|y`%fwMouHUXuXN3TVj7PSO3V4LYfUx3tjx^?ruS)3Q1Qv+e1U5SD${Yg@Zuzqx
zzM-++m3V5aF&o*@k=PWsn2gTb)ZNZw@64x;BE%w2Lq5XtpmTy&>Jiwrkh|P9?zYP1
ze)6Vt{h2~BG!&_rnDhfXkwvpfd5uwoH(Y>jxHUJPmYW;QcEZ-?oU2F{ep6Hm&?2Jl
z+%?!7`Qx&Z+fU4P*$|7(!AVfWa6Yk_cZWP=JiNC37U^&hk3%x=@qvw2EM(W>Vow)8
z_}w>l|GGNjAL;j<8!O(>y~VDlQ|vJ493Fv*Z*P&x>}iJ*+I9Jgf1xg!k;=qxQ6oJW
zM~rm$#Py~+5+eVssOURh)U!UimANiLG`Dj7nM;XX>;NXPEB1fr(=@wdEftPtJRtXK
zz@gblskhy0Nwz&=`6U&%xcfjSk#zdu#bucQuRaR6ENA1yc<Q$U{_l0m|ECVh=hAwn
ziA@R5?;JJ@s&v-jz(%-33C#UKuywpd^AivtB>@67y+08!b4YZjke(O;D?^PrTk1(w
z2f84HnqfZGb=@jyu#pq|Rlnc(b4EmgN*%_60{83VSkdUO;_C}J<(Xh*^wOuqpzd9}
zwJ76vU#hdf)g^p%@kJ4J*|Td)mj~Rf79X_KnS%P#xVp(XaRUtV@D^)nZ>>3;lN(UY
zm{R-OwzE&fv4O=4ZNyB>nCo8O*a*~Zf>{p~MP#p;M$1S;CDaJP*XXj8W+vHWe8}~t
zS0eH#C{z3VZ|@a!yN>Q>Dtx@)9^0+ng;xm~t*lJ4*gJJki>GBOx5Hnh1b+BLjfBva
z4AsbnTae?1eWt`XkCBbAXmR+(WqYEx+cNtxO#_Jetf-aTki*lr{Q(nrZYhm`-3_)!
z0f)0G59k(f7dn0g?A%JCl2j0?x**`jhG#<fkB-ltgPrpG|69lF2QU#h0h?ghU;ouT
zoUfLoQ<^T-zMeh`#aiGycnQDTYBERzp_MO@Obbp{D=qF5N8!D9H2uI<1I|ap2;s@?
z1~F}D8yH6D@@<pQ1P7^sEPoVCG>QRTJ-s(fk@p1C$te9t-;vLFHdq^PrCbF9a7>Ce
zibXWgMe1lHy-0c9&fD{_5)oiqZX`TL{PDI3W)+$ipC1o;pDZdUX&0mD8>mw4>lY|N
zn#$S|o`g~q(>|1Glq*vJ0>7qHFAPkswam5%&1DH5eB;<<ZzbWXIs=VRL0y;17HDOw
zQht9Bc<J9pbwGe1pONtA&#0);n(^>mA;LcLQUo>mH_)}W?$l8Q(N2`Klw#C><L<4Z
z>I%Db%>;LMmkk7WcXtR5!QGwU?y%8~d+?Cp5CQ~u*93>)65JimN>z8Cs{X4^)v2y=
zF8X2(#$aqNHp{+m&gXe&;=g~oyJJOZ3Ufs-CEP8S+zT9vBs}zo>oqTIE&uth&l0JP
zStCpu^)}`fWszxRP9n)!(fQ7)zVF>~MUZ5kE}LH33>^xut-_R?_57zg;(G$&qR~UD
ztG3aTb*<aFPSWjxAr?Qsp2b>`?H3<b^vYZvV0XzFRgZqwa{-2!_{0EpRG{!I4U|<B
z(9$!~!oLijcm3@!iO|C{>Xc4B1LSU@7uKi{P*RZsN-AG~;xh~@Q<xTf`r^eWyXHTi
z9ESe<t;lD}j3WXSdGFE6U*Z3?X2z>RA$Xv(ww7)G;K20t<@xOVT&?Z$!`0I5#f5~F
zR5*_0XW26bE-oBkictzy_FsTz%Vqjw{goPi>wXpZW2<S+F>>qA??h2tEyWSlid!Ax
z$CGru6io1+P}zMCy;MLa6OV*MrS_km@8X+%Z&_GQa%1PTMvB$SQES0!C(~NkqKSH8
z4LUXJL)mqAMGAymgzfm%t}!lr>~LBNI^Dd~bL$s*hYNxY@OJ56!zX@_QL}TFf0muU
z`mNS-MPYF69pW(~rl>qABc3bBgL;ofRPYoX0Y51*$%vKJa)99DkFZL_D^=CXt#&@!
z-Ms$*Wy>I4EeigRuMV-fP#95-qg+v_W8wgb%{aJ1%+>_mU}_l=xp8_Eytcm=i}UUX
z{}5dr?ZOG(E^2lnC)}DG^)jTGYjT;NBPL2Nbg`Av=Cc|(^64D~XB1xhMKYNcxT?2P
zS~?!-&U1;qS+?92|A*$KDblk;?Fo@)N&<YC%y0AL4foBrjcolBiCU&RU05Kzy*^zN
z&n<z^Mt-zpvZd6Fz;61#RFvNx0e@-vGMXck0}g#60d<`9<vD`coX*~$5U~?6vgS~6
z3E<vG+}G>|%qIQXa&)J)*rVd4gsPVLUU*9USbj;L<E-r|;P2sSGSp1ZXG2;>@RI|%
z#b@}et(_S90j;Mb!g}M0D!wtNKGTXBowSn?Ra|DT*22a4ikOQa3?6@$JivE+fSp+t
z1UVkp9Bh7#i-Q5OwZhg6k;790l&lH3(f<pTGOI$yi&C7~g9mcaK&DlWyUR&YMd+bf
zP}rJ`H$VjG>gy{GMh@h9Va9{e$%MMdgPuYdw7$r-H$6Q);hd&dCSF#6@86A$N;DRb
za*^wHu|_6*y>7Ce-b&BOi8b+)T$%S0lR{#4X}<xl_zTF)D|#<wt>1jJZ@wQQ6K9oA
zsiDAMY=IpLu!^ng{24Y-L%e}=PEt*~)Ld8vzc<Bak+Nf9Rf26iB(ALv%4J4%xgNn?
z33N!DYUbL;Nt{m052jcioN6<Ld)=3!$5X6J<tl>|L79AU$DgmZ>t5l6vR(8@dUjdK
zoXz68$Tm+-=T#qSYh#b+MLQor{birq<M&)&&HIm~ZVCP%mSq2jVi^>V-KS6nOMUYf
zX?ze))Lt8m?s0Y~<t+YYB`NbdUGK&bUL0{9{KMRBo$HnEn4t$$wzZeJ!8{?KIZn8T
zz#IkORU<eZ<wv}Hz1>_oV9w+S6k*Bc?>*awLpk6_XlODBcK1d?a+}$ZzgR}A`UC8t
z;68ZmM^@mECugQb9sS&6>-2nc8Fel5`vvTJkxy-80nt^s*q5khPS=n8lq`eIG>ax>
z7cShCaEDep`b+w|WyVHE(ldk3#PG0~L?-q`O>PwC^Mh&MgJNya1D2kJAhLSF=0Ix;
z!ICvI3e+a}!f8fEF2FAKo4bt3n0P?*L8Z85JRCt|_XppkSz-oIUDob7VY0Ws1#Bb=
zVQkuM+fcoG5{X5^_@!*oU}dpOoDvIBpNKGQG8x>0kTVC|&0%74Lt+mT1rebhNTwW{
zHTqjmDD6kJh7*a*2>7k@LT-ZVN1UTpn~1a2q9=Z8YTUZFcnb|SM1bmUdNu{iXTKgA
z9nNJd_IOpv$7l3GwJk`5WznzuWJzR<Y>HG;ha^P#edX2m0L}vjWLwvpAh&1CHH_Wl
z9x>C$SKRB><0}6LEZmFhOmiYIg2ZL-j^XM+_zgDRNmsz$dr-=;obvr)3)?8GLg)?+
z@Dh<hOUDPgmkhwBTpQ~P*&y^NJWxw20VstuiCc}o3mti;OHFt!Y@l=b`OjJUuv^iR
z&HIea9xWqrGAt+$_6kc_8~=0on|&WD7Is3!NfK9oC)L#X&!H#CER=jz825xR(a~`d
zB(@Zw!HzEX3olJgn4aEZjDqa@KltUjM<^f}+2n(|zBgFsp`ekvpDyay7=)OSwPyq+
z7D<sPiwTui<;?=s&|mERL%5g7q7!I#={{=EqNZMf+M*E#FKb<-21?~tGa4G|<)~><
zo8aLkihTo=nu(=4o;AH!mcr-04U1?VhCy3VmQYIVmcl8+GfyZ<N_g-|NET32F_78z
z?H|lqaYWnF^h>QDT)Ifnm0(Hg;I!;Nu~MB=i9kT?m*?MPwBi;VqpexDFfQx)-V9KP
zuuC)8Stjk2(hXAo(L(^xt23rQG*}wL9@4z_OP`7k6=D(x8m2H{qQW81l#lXr(xL^~
zN<{h(`tMIu818(h5St;vnMtV(0kmmMx3GFnE@zxG!HLwUY!`&m=1lw>H2LsR$>!<7
zneXa@R0}rvvv`BYh%r;-cGYm|)Kf69Ur;DPp9Ua~Dq8d|xWymZ)Zzb^#72?b3&6bm
zbHn&auaFU9kTX0iuYP_24EvnnmN9>N#EDnMXE6{1rfilP=>u`AACh!*$gK;(lV4+n
z<+3)ZGC017`pRwZQqzqgH9Q7|T?BmZrlE~j3Tl9tI8Q_yX?rjgN35vrU)OQ~p?<1N
z&0rJZfd0nCu=RBf>@v@dLT?L#dzC-hiq~qZi{K?YGwQ57jGq9iH4>)`+D}PgxW+((
zv;gQK)8fHekk_|YZ$(*Yz4yJ-lbV6Yqwi<_(8%y<R0F5)gq1*Svxn|3a6?NdzHr`y
z!7W9o)^r_z>dt`(CBGbU&#~@iMQf*RlZZOdQOnPV^=s7bQ+MsE3j$pMqE}ZTyQ7+P
zG3M^-xvaP^=%n%#9X0;6?je#G>q6bs%LC+NNccNZ5GezHST5eBFJH}3t!xuN^J718
zgk0E8I_8~{By>S4GkC@lfvEI-@v)Rm>tKrc`zwsZrz`xar73tK?j^H(OSe4uhh8Il
zYys`c$OP=_P5#BIl{d;Bjvq*W`I3ph*A@}GxYF1PlFBN>K3}(m$|rV^FkJHc>Oq*w
zsG}lISRbG@U3N(6U7CECFHVkuiw+JbeqSgfd1cT{@T|`(y*wSYan7L}dz)3aw!nMN
z2>JdRoW@IvflG{9PW*MMV+5a|?Sit%4LKR#K3-b+@RP@)c4lB7hU&0TzE{)cVXI{!
z`!+#-DNWbTrknq-5@hX_M!FVff-&@XS=jhLceW#>QgW)d0f=G0gx^<t*m9B8L0i43
zMF+YeQ!mZYEDK@q`fnza?S!IA>L+c@AQGSOQ8EaiXzyig2(}jdM(vTV!9U{@#{9^@
z+xz+WgUj`0WW$Ntm7^Z27W`4Lp9dsWzu`aX6&C(U7W((<)x#G>D<*f0a;V4;UcT>C
z;%T~{M+2Mpl~M1nseij4%%TsAK3H@cnBieQ9KJ7Xgd5RzjQtIVGMGv_zrNv#E}8vP
zYIVYIJw+T|b3!(A4X?4<5Iu;5L-upO+LJ_lkvg=;ojC!m3SqqH5?8QHKVGJ150=VO
z6x&q;(K|_{3db5mUB8|L7+7M5{Y41Da``@oHxsQYNqn{OJP^m1SG!Zq%7NTq66B4c
zpj8o4KsP4#N<MTkB=9AHKd!vuYMyxsnhCiD_TcPC6G_z<Ug>g54S=hMQX*Tx{6_q3
z@PfEnZhTzwLo=ckZ&m1IYfaSZC<#tdKz!X=RQk?g(fk8^ZA()sfgzy>Ndw&AWd7hH
zr?tzUZNe3Ao3K4Z!lB{V$d@nG?=&hz0*U!iFRc<J=O<(6?VlpeZ<0&I)8n_x6YEOs
zHBzf*u!Lpfdc)bD&y=s-Y^Hoft_o5Hw1X*k6aOg1wV>E>y&x7h<p!62#chgr1iO{m
z6+Z`0XA0Qj1Uk=R6lmU|fvW{6`58&OAAU?HlP%jRPqn<dDCPPQ@fbyBF1IlddFi2o
zqdg8{Qm3^a&!i)k?i@D)q%5tds+!-HhuWPhkpAZpp#JEfLzAmEp!dVO!R$eQd&Vr&
zGIVW(Y{>BsWX9hPhfdvQ6wnu<f@ge5g<<4jFHEbpkR5yOU>}*!gFm$3DE#y;Vfq#+
zCG;HhE_B-@R$~6i=yTCDJpPJ#vW_lAf1MD7*ZOX?KbV#HQ-5yGSp$FE=?HIE7bzZv
z9-)I5noO0#Z}X^+DDqju0>cn0a%b7Y)`Inh>&SOQ^1*92l%SgDw>c-GGzDja6Q^H_
zeJ|CfkcQI-IL1ck#mXLS8{cUm7I+DSmk$LW&u!Qgog;SS`;dtr0Bb?hMAU#B@vW2^
z_SaVAnITt2aN|I1!B??jZR96*H>@({{P1B7Ym=K?AKjKqp<KB&-S<iHdk;BN&A#Sw
ze2$2h)YxhbGl>gM7|};h2H_&QVG2YRL38@z*L$SCUPE7hkZ{x|r;r3=V=u|^`yMxG
ze7fJJvGq%8&X;u4NF*juQ-(%;a1NHVfV+@0%1O?WOdu29<_9HM%L}*S@l=3`zU}pL
z3FP&?8f-@qo8#EZrjof3bkn=mwzuL`{m~R(E&IJbzb47{#aK4A^n0V~tOU-Y(TDvR
z<6l6k_xAyXXA=wTprMJx@S8D}&lS`7^8x0VPF_gu@{hZtby4g0kT%sIn}o~34R+;E
z=f5Zn+?#qses@Um$1m**c?;1dkS8Lhl$p%sE@lcJW5hid(IozVXnytT(~id26^k2|
zM8ZA`Zt+hjKamg>+;*MQ#ca!UbST$(n~ZKs=rpeprB(m|Y-j=)TjLq6bbH&DTP@vi
zjh}VV+tCH6HY)HUgMMLDl^aUHuvfmj46ylnP9N#~O&m#2fHatoa}K4!KE21fvntHq
zmx^rsH7#>|e!*6p==0)qb3+q4dq3JjA$h0+M#IFYtW~P8_EqKE_&IDBUJAGgx+wVp
zy{d!vB;3ed8ttq5x-}#W+y!sj*Dc%}kdyH3!c9f7Q;Pa2v;qxail;2hMhFqOmST8t
zb4(VjH2T8-n3{}!u;JMT<>Om)UG_-$7psvOS{?V2t^)1!U)|4s0^Sx|37<iBtrgx@
zK5tVVyrh5BeAt{_`W4+h^Rcm;Hq83nnE%`3@vxyo*4nE!V#tu|xZEVgV7xAWI}KL~
zSH}z|rn4VHyl6#aQ!)2B)-apiEcrDzk?9Mm=uGsen4Jt7#$jB4dk4knAFzEsD~4HZ
zn1j9{%7?FsHf{!-a%Ra{`EkLrKh6wG2MC%^FpEO3*-Eq=xsHPfI$|sg8BlpGb>sQ|
zH&DTTgnx-Y?4(V;qx>gVSmfV8-Cj_#Z><LS%;y)#-+wW1^uJW}x;kFQ5Av`DKj119
zd+bash+Sw<pb1?17LCw_xs20^+h!&jB$ZMeb<_H56?1TnX!U<jVWCvAn=I?L+k5}>
zU2%wdnyB=$vEL`1+k&YgUqa10Pg;~v`Lf&sgp>emAc7kz``bO{)<h;%-wx74;0LlD
zJDx#R;fGJoi7GY*-<ZC5>W0gz*VLuzd}m>4SG<s^N4>&xF7Y-0ok?EO)_C9Njxa74
zRj|g=SYwF!EBjmjX}jM>hBI-Jqiu{HU0xDIRU||HG*>RT|77E{(&ge8W3vlPMo_YO
zN={x(Qq-ZEVlj#x?`iN!fN!zRWd6SV!MR`{DF><_+3cnPT8|RiC&R6g&)3Tw1it)R
zM@PTkix<C*JmT&fjbqxj>hHc-5#p-RB}45z2^W>qfBf#LtXAy+9k+6UFue#$O#G&e
z)4JPzB`r`7^w8t*TK^PZby0g0Z6(ffE=z8u5ZyiOk?qeO@;2UoBPG)OoRF|pv&Da%
zy)qwBjq4jLp<@JUEPDk4*sHz!D0!KoZkte~x$BLUm!9HIR);&Dmhg{rbixO|KfA6m
zlf^jgO=ldbwk%amMI1S2oQhHpmb3Ue{}PwNx{m8iM{fA90*G*<$X_=;q4lGJh0N>_
zJ8s!`4!=y<JW*>KH%PtTcMpHi-x&I7e2&Q8l3wi9%`Jk?9%-*uEklaZxgm?@onJ&L
zk)E6aGaJyW*8V}mf3;cUkB2@=!<olL)i%}45r#mrrRGCDxu^Xi<-0yquQ_xYD;;dZ
zy+0IW!&3#bS(#Rfl~W$#n*LZ4V+qBwhGx}{gIn2Yy!pZ(2jjV))eMXA9;)VKG(GW1
z(D7GW`P3Mb3_f4YR|%CotPUi#;(k&qMaBDlMRS<g-QLn!94RA=vU-l8+8b)(>&f0x
zv5M2{Nkk!#w}vE7&Q6Y8e7yDkhYEG0oe?y*{zR0Xg#ePA#HOd|+m4yfk*-ly7zN4H
z@sH{&HX}nL;zhHFjn(RyAD5Vdt91}UNlwfH%dOrOpQAR3qDiU*(n=^NZX~u^s@05|
zt$1CDCncgLD7_#Oam&|Vb&+RX-KZ`1+Ngg)>L7A~Nnm$HXy6Ys*4L!Gyy_RH)(MAe
zm2h7s@c&T8u{7QpTbrs0bLiMR52_$+A0$HDCYW+<S681+P9Z}rCf!mi_muP(zbW?x
zFS7Zk>vEyJEk4&q`HDG+JlY0SJ^2CLb}z*84}jWwlWC$Fk?KZHB9Gqrn9{rfh|jkG
z@*m34NB}$+{&x01|FOi;Dk!Rbic&ukANh>e@(uuZ0W22Koc@93O!u#^7J?XC;S9!j
z*c#{w4E?x*W+SBvyLl>{l{f$Pt{Rg=W0)KFZBThm=94t)Pa6(mTD3)xW7&6^8Hst5
zpOp(xidQ}FGgD$xODqoHCrMg`q*q3Vhh^Z}g|pi-veU)q6bpLf!0$cekg?1Gn^fi0
z;8THGUw<4IR`LFmg<j1Tjh+#n9{e*(48OdG{s9+6w!9RC-(OzRSY#@KQ<s*Yg-b*P
z6ZNQnW}X#$7dYg4SDvh!Um9IiK|fQU$sV7SDzU|!B^zsN@!Lj;_MA72WH7Zvs;_?_
z#b@Ydwwb9tBeDcW`bhE9V9~ok{QiASko;(2uj{)_9z7s^5sWAg+EY#|D+SR~By3Nd
z%hPXP9>~#-g5wp%IP}n;PaxQva&aZSp&-Uh{+QKs3&L&A;qAM!a6yx;+TE!sn+V&-
zlZ_bTH!I_lW-i4@ATMKt;&q%0!`VxU2nTzTn2c#}LgJ{t?V=4a1%R~HY?nZra|Li>
zZU9HeK>trO#Lk3_bYJ4(KKe9-BrD#~pxYv<p6_paGUW+FbM7(sJ%Ftc0<vQLD|ED2
zHib{jUuJOm4l(FgH|Yr7(Ao`?4Hzo|7p6NYxrlE2U4Pj4_EIl)I!I+6_udkHn+`e=
z_Vy++-HL_H{BeRr(u+OJQBko+!Muhp;HP6YcXYqtKThV#zrA2ZyV3Ghq={8On$R83
ztQQwKoTe-#fX*s6FQIFYj?Hfv$-pI66Qx$3NKo%8KZrNin4NTMud3I_eTkZhTpp9G
zImm*!Of@H7OP{6tK(EL{(Ug{ZK}i5!4T3+1?jWsHEjY0tOObM-ZzLd5<z#mGv!BoT
zD5?YnBKO{0JF=4ZB@4Uy*dSCMd44mzjulJ7vF_uze`T{%B8-44oIDA{s7vb=C7mTR
z;=moxWHJC=inc^v9+~^#>Ppx9PhNlM@NAvUGVDSGh>DdCQ*|}Y)$U$NDXSh~8C^I$
z2!*sOg%++N+9M!XSwnlP^6g^Nky3wfcB8q_Dml6X!O!d?RUMKBe;KTTD_$Z8rc`2Q
zpz-jZbtROIERhXi<<B^#A|);Gkj(r|t(@Ymhoz13Q`XU+4|z?Wg_M1j(+E%E4l}Md
z3UqPi-)F`kcu5}pZimkCBJHyTzbTns%hc4vtZfN^(&srHII!1_R?<+=cEjGVvV4>B
zNr^(3U@4L%`hB1=C9q-uDCK;P8e)eUH5M0K>c1<7(ti&zOHNU2qrQYiVLj?TqDQWM
zO`yiAAFeMU$N>9q(ucs6*ZNPxt#~HV+%pQEq`@%Kj&#RnDb>3t<8OtSAEukm<$i0n
zBa7y$SD`oF4gS~ce3oYG(Kf+dreSYusXN=pC6BTEPBMJul~Q*9S=_Mk{}%he&f@GW
za$`3sV90GSJ^drlkR>X(F@OzF6;Kh+=VA-U*W6zM^AP=-Hc!W+x<pRS80RtN&x{;H
z9F3#*AgPJ-HYOoiOmYa~Z+vjXB=c?;ONUhaPwal@Q`lO0-^2RUXBms2k<Clv-Hm+x
z%&Wt>0#vaYl+i{&Zs28Qq6XmmeLxT~B-MqR4Exdz0Q+aab6b?P5(aQ(r~sH%?|o$c
zB@JGy8?>w0wp8UDqD1bY^4LB*s*d3S>Q8Bf>y}t?W_|PI?!!p`v8^hb`vWlp)RKs5
z6Otodvab_DYH^Z~sPHKYn1@Gk=U?xhcy?f*W^kly#wc>L*)d1ab10<QE7%5L^#>CB
zXGYiLt^^Xh9jzq=&pxWf1BS7}89r=V;3uNrK3ny6B+QZjpi}%?l`B9WQAE==ND0He
z1w;yLK#EWTL<$B#qyQTJEEzD2MgS-M-^!Ib&X%rLfWL#EI~v=!8<;MEDs2yd3hM&b
zo4>7o!_X7MY2E)cB0lXZ{qRy;PL?UFAn=m^-_yMACs;iC-^&J1Ml9O!-s9xcMQm(l
zpYQ(|h9Q*pq@?fPLxO9viSMtJ$mleSUR~kyUOF&6P5nJxw3u;sJ}=D|<VyY!@JjQC
z%O-NpI4J(F4z_v7s$aC#!-*hQSWKvaOQGw`>x*uT)Se_qP)QifLLC3e;1A%R@&^Ga
zQKI1g+vNEN?&4o?%-ykmfcg~UR%=#9@`XJOUV9}i3^zkD6t@OA7w&+N0eDX20E6~l
z?4$yHuK%l(+QnfAY)JrxCmgt**;$!10C8>tSZ&ym=~@9!)Bo00e(Ls}g_f^C?7Qf0
zHw6>Y0DOkoU0cdoX)in$E~v${H~Kf*S*>sh7xgXdRTGN%Y9zD^bFfNG*e^?Fp~jeZ
zz6I}=?x6;54nqOgbMrg<qv@l%>!D{69giwm9OjRYn5uNRpsxKstT^KU*h%wYUzx-%
z1!h&8jILN<m2>gGaHjtM_n$r$A_xeiErMDx0j6>!bO1Aa6s4m5Fg7{Bit7AwD3_sW
zE%ZuC%o|785la1MhC|BT?y7#7nVH=u@)TGNvA@@W8HU4;$Tj3=eNG?En4ROc<NsAN
z_|}}!0}#oBMJ(^ZtQ}o{gNx8e1rS~$8l8W?h>oKJ)Kozkpv=D7cD%kkzH&J(H$Cqc
zJ}!RIVoYT*B;w`%_97g?lD!W6UfH*@5^&2gYBY&s|Mb}DUUb>{U-a0O0LKt;oB;>H
zWtW}MSLm;W<6(B@2Bf;EUPij8KEMHJhY`Rc7Z%2H|GvYlAF1)VgS65y@8v_`A$dCR
z4U8w-=E*0o|3+z5Nn`-2-KNpF?m+py1Sr2V0(XfLAP52vF=XJz0bI6zHQ>3XjrNOg
z44P3Jc!(tc53zH%S|LF8kOl6gB#6m9n1tySpb}I81q9#}JJVoBAGhCMOOxrY(Zi4G
z1KQwgnsDoW%*!Zir(7ojA`DcB7{%SKtBxZ6OUR^j;h}K!ceUYVHVf{fcWtPAYj6ar
zTk?5u7|zs@-zj^RlioYRy!TECShL7Wi=O>Qi11&K-?f{7Eo)XpQkh8~Wv8?g@~_{n
z|9La5^)XoD_R=`u(5y4?`JbZ+w)+)!e~NQgY(=E4pZ6$S0rH(cu$kZo6i-t0$`Tb)
zT|_eUN>C!ccF!O(<2mrLHy41T2kbe*|H;uio&E@<9;xj^Y|qY(I)&!51?J&S@5cmq
zeTeDW;*ozvzK!_)wkxM=)(7D363UcCu>q2!lj&dgM*iF1Fv(z`%@;TQe@Il!8{B`0
zx(3o38XXp~ie=&@EG$a45y|Uc#`LuU5_=BqnaIt$w+R3Ad9O8(5i9zblRLL<#<RMe
z2OHUUcXu~?pHq#bF-AooXLPYrXe#vl4e~LpGYcm9;=_$znW>Id=}isKNCrp%$^eYD
z19>0+QK)va5a5sjIwl=hhkXNH550gg0I0@%fX+DqET}>NswSL-2_3k8*@3GX&^cw(
z!s~<1dqz|N=~x~ByZ%qRoVcU2v)F&JyG(ZTsVaRhkC$)AfzMTkvg6LLzOC)b8Hr&m
z3R3~392R_@$7|^LIyE|o&41GyaO*Ar1M@%UQ=9B`(G+IiUUZH40J>@`;071~f9eRZ
zYaalDu@dmB0k`^u0iMwsP=)h>pa0SV{*Rr_{~qi2aZr6<UHiiaI4G!s?$JH^wtz6$
z&{x4L0}U1@HKBJ#A#!p`+PPWe`7ehN)uCf@y2Qj?bD~=8I|1+D-~`i6YlhwX4|)4X
zfY<-dTumWzeB|0q=>m0CgH52eh#^*`&<Ef<=4NDs>53As{A!e`ymDF7Y&KYm^?4+t
z5D1&-oyeoPKnek|<{Es%l8u8(&dZ@ww%!>96!YYrAyCQSU9YAFHcv9)(74s!=t!-b
z8NmP5lJxsH`}#8Utd6-HM#54ZJfyjqS!!OcK`0C4Ri!>X3+K*Wi>V{2<}2;WpY@mS
zxYruZqE-;v%9(DrGwJeIlZ@~?s=Fbn8{chow+ni2zo5K4(ABCg6S{)XF1OobV%S|e
zTF9tn;`#s!r-XcRAdWDey%>MJwv7JCxR07WByavp&xq-7iV%mO&-_i3hKV@|g)`Q=
zEnfj5@f#r8e<7)S0wi!F;H>^LGFBZV#*bL&;&~x!;CWvB^VOh*e!E0<SV|;j_LUcR
zO1AxR(?>nQ460LicUU@5fa)m#BRfeMzsRE6|1YP%#y0mvQbOBLA;2PeF2YZ?HsNv>
z6ymURkKjz`LZ+wf%O!M_hjGRcKURFvf#gicM#nUpHY6wRpb6TXX&CmGp51@SvW-FT
zQy?m}tt&ali}ZFwv$SrAzf&IK;5aCLF*I>Df6K|q30ua-?KLp_8RVwqmQ-ps#-wY-
zBtCI)mV^MZw4h=XBxMa-G2J=>XKs63v=sU1mgTCHS(gp;OfJ4<dBK#E5AqZFD+e#v
zg5?yICB_;|!ux4bI&o*^xA+(tai=GrO`OeO0RCC1$t~1amuYd$ql9DpNm;jySysUf
z$|zi@zadi!#ED{%w!IDN>qLkIS5f=t4^r^&eDk5BnYO&|8Xkt8G@?z~Y3F$r4YRzW
zkr0)fJGIz@`Mo#2&8@e`DJtaZD!UKn<3L|N(=yE#f&ceh<h7u<h-$OalxD1F4l>pv
zbJ)<%yq`Zk=w%<0N&^cSahvw$OnNpo5acwJd<#Y<B|JXCA2C&#>^+m%&g6|m3`HZ$
z1_!a_i(ZEm=b;)%U=3+PysZ0r=Eupj)8||Q9-#Dq{){-B5lm~(z!H+SM{ZB8)HdE^
z3O@WGu^@Zky7y7DZB+Cf3XbIitQ;66xHyf5={V-J-;$y1@(=6@6Jb=EKzHnX|A_dJ
zJF9L=Km!dKS$;0fG4%LX@MLjY9N%5?b6sO2^-Do;(JI~P>}!1r=ARQO5ogL{#V#;T
zMLT6cBO6vWcweAk2H(HM%ZZ2zIsg*~GwQR6>H<WjEKTvvCWpL!wOF#>UWzd5n7BkZ
zxx<j}_;}UECSh#Jkx)Gv;3aZEiq`iw;y;xKy3|n*j{U(*U?K_;=S1&WpvE}QT9gCv
zhx?g;X5_=PM$+U(jFK`E-o4V*79D;(lT?yn(W4z+<;2F=-iZ-|^zKgi3vm)o$`gb3
z?~$coTDxafQ06?1qNxU1MLWGwW=XbpQ?A4Bd#7`^yUMI;KcY)1+0nY~KZ5pD!01sK
z<)S^tGL-8vs9A$hH`S`iNy*A?FC=aWu)SwjNLL5E(1TZ`CD*eCxoMpElJ4tD5b&M_
z2pHr9Jr);lx}k8x&kU~Q#ip;D+&DOi5DQ{;dm1ybvkIg8>y}a#Fi%8j7(tF*sqeK=
zB>daf$*~gN8(U{)C0Q;eU4lg7E5mlD=%X(<d%Jxk*=+{i3i)ove-7t@<XBU3Q$iVe
z?s`8h;P9w)MAP#7!j0R5FMo?h;7wwkuV~>PM%@m6{<vpqDl1X|kr63~EZH~V)6azX
zFA`|04xKB}&d$!tiR8wndZUwM38A=82vVgTsnR<3@-27A<dVl6$RkiYa%xCQ5@av+
zp87D&%xK{9y9)I@t!y0OMxU9GFAxxKB-im9K*{Nc?JjcRtI)m<O7|=;VgZAN+1TnL
zbk2}Lr4Y}b8pI^awQ%^kMoAxOQ+%*DJ_aGvI<<lKhAZUaP{Q-FVD*gnHnG<xLa?!o
zd;V;bToJb;?gHm4#6N#`gsbzW^#|s&tW$)R6qY*Hmi&vN+XbInplDraNQX$=*l`ID
z^y&Z%{bW2{fwGv#XWmLBa&gs3jC7~B-k7pCAsq!`OK(-lO%Kjm_^e5pb_Td~lqn8l
zQK{#Dnm-UiXD&TbP(^OfpZD{-kSyL1g!>9~YZ{}YUtgJQie0>XCg@AP-7+(#SeVVq
z?Oa2+@rsHl6uCl)H$5c{CCHW?tabkd`B#x7x3X&cBg#HVe|4^-*Nqpb0nK{irt!>}
zV|3{A`3^J@Tr2p^vE1_o%X4-19mA4$7W76HUp`MscWhO@$<5~usciV{T4K=m;J%>9
z%;Z1ouQx17$v(MxtCa!4b`IHjmf1=&pT18i(4lao)(TNiW_*peqh3t(m)-z7;0Kh~
zvUTorbL-po<mju5?dq@?P2aCA;Bf@4eKjt1OJ-#bKhi%Rz`(`oWnr<|+1sNKv!{kr
z7JxZbx}f#RQx?g=afowdMC+mD(SK0-GN{aC><L%RIuko4$eZXStcSma|K-SFyVP&v
ztXZ7EX9~~RAYgH0YE1|;Y%ed=3yR&>P9m$%+ub<PS+WznLQ+o>p=XWJP_|s4npn_C
zyyzmt1O2?WB89UUX~1FZ#3HN$JH+x5r@22uu`HiREo?j_q6n8C$psNgs);(XZ|a#k
z@V8j>xynp_ExiOKGBHY)MoXh)J1FLF8jR4zXr^BX5n2Qdd1WZiNhZD(R=v2WPnMsP
zj~8TS#HXLIX8(K&C4@i|!}zSl!bnE8^vG_zB9Y5^BW3`1FEadMT`JXcGGY}+@{J%{
zl`0z3I>{1p8cAaO(5|qDtsFc9<Qvn^bXcZ<g7GHnhc6CXhiETnE$9^wGOALq9Qu~Y
zBwqu;g|AGg{2(=Y2CGtvyc2lgAUOyGz!!syBy<!MIC>1L%@t0k7b^A=uaqDTa?)Qx
z^{;g<zm~!fQ|5Z7Sn&=jer{_F3+YMkAq(GF=!17zAC!>z^A9ZU=|P2sow`=Z;q=Tj
zh%wHYK~#|8$E#-RlvCPq9pu?a<zBT0F;F>8&*VNA-o)=W0R;plkdjZ$nQ2K<5E!>H
zo1P4os@spMY}%OMsLi5Z#vxi=oBt4vA?!c)PxFSou$>DTdB=$0y-vGss)%b{X4tMs
zg)kX;oO+w8^j+nCpSEwepPzhZv+v`|b=Ta^E^N&_e|$$0gcb9?H;iD#k%5I@R<T7_
zTn2@V+$h?X(P>>Tl1s2&V!ZC-4GBq8e6kUpK<>Z-y}rql0XsCuy3$kN$-pRrJZm-t
z<8!=pF}~!Xtr}b!xoxDSIjw1dd^DA)a@1`eX=d#@71WF_A)}%*ek;VF#$;|Aw|T2_
zXw@Cd#M2*lfK>qP7D%d^F%7cCl~ERXGw<EX9Dy)p5aHD8*~7^R-;IuLy8C2U3)X%b
z$}2ztZ`re3r|=lb<&+u~f_L|Q4hoy=Ysr08R^Vo>={+ci66y!@4^nD>y;Jgy=M$_X
z7DR?eDNq<R%-(iG<+O5+G&RBUNlVmC)X$u;WaC*mm%z(|WS}&xYOr~RVJ<R$!O<nn
zjOu1|rU=Dr7_#2Xw=tV&CggL#0g>)ix?oq5@skjrM!d;7SrD-m;#s+r;ZfF033GAn
z)%75&!}Aq6pTTk;_9WBgA<wD#p?El?c-<XCPhI;|ef!m&J!+eMHj1S;pc4i%yGuE6
zjfRJI6a_mNk3mm5K;r#-IpiFhr<W?1b~hrrK_s-Bnx}^+xee6v)z0)#*@m5wv@m^-
z?PH&kK`l7-hUV8H9IYpDyg3Ui=4n}s&ojKq4zBD}tILIkxkDZ|^bax^iWC-6M#2ev
zeDgkEVG!tHYh`Kr?&G$A&=rF~6la0H`Q)b0g8wlhq?AXN1f@y2uUT2<lWZp&FHzZJ
zy4e#%!^KB@@)D{<h;#5JOQZIxgxv^)zZ2w)_gzzNlu8*wk((z%)W9lCc?_BnQ9$Us
zc2r~wxWx7Dw@UWs$7erj)#Y_0nlr4IQS!x`!4h(@7;#~0wtyy|b=TzxAe<1nk!+k4
z9wX%^j8X~}voDLtVm0xxqZwdnh53EQ1)-Mh*<NtFdNGHa$bqHE%Lku}@U>eoSe^I;
z*ZyPz!T&MaSkG!c5${B}P^J-ys7PmVXlrxzdc;xUH;V}$`>E67Y8J<<!b%WxUw)MI
z$%eW#MM$TmOACeBV=*@$>?9mzy7mQiq1jY;uI6{}H$`jntLXmb4I-AEmKge&Gu{Po
zow?3t^%iGI@>T)a7C0xz%5+S9Mg>gK;#309;*c4_pToUDo}qHFhXbSkyKl2@t4?ng
zx2|LyQlz;LL9(6}X|A_rp{)@`{~nD4`B6?ivqLsF_90I4b`?`{35vZCZ$ZS0Z*JvU
zjKOwq8^WW~IIb5**hq34U_`-vKp2<6BzX!r|06@lG1~@X(Vl}bG%4(kgTgTVv{WkN
zX88YN=f@TG8jNgMlFY>2$cdp!bYnlL+NBa!z73|PqiWH;D52{9QNh;#*1pxVd!2vK
z1fK+^;1iorLtEUU#@u>Q1iq0>RQEj@do0bPDQ=ky9~LBloUA|8N6=*b9A$cP)in(!
zOJx<#wB6}5mu%=b=8TCEbVFv51Pn*P=1BVZ!pB9FLe?ToGLr~%du@}gHFI5dKe#y~
zuHFVIB5`+&vwfWOu@w}@atf&ql!#xY%$fD;C~df3SyAS?!(Ud}O|G@PVTGhk#4wB)
zv@flFe@tmb+YnjMRd!o4lDEa7gj`pxW^#SRzVgS$xtw|yiX+6%*!oh6-Xlrk>bs+f
zg+Y=WrPOS&8pfS7(Ivn}GR@kvQRan(jOQE~Xfi$d@ef|>=X&E-lh+dCY10KN13);x
ztQE^NScv3rxar!poJP#SeL!F=ucir^AWh!hM!)3jeSt-;y=+1*@u#B8hv_}IJ4v+V
zbKFnZ6LG5j){zhaEn_wszzQn0NKPV)g8wRGx{fDVvYm20`%#p$cR;V9_F_TuE)uT$
z=?~f%En=u848N$kQeCirV2zJdvh5(B`QuT@{?#K2$+UZ4gLR0-OI~KX1zj9;%COMA
zTw-HyH@~~9?jWKnH5DeN2{?tZ%xu~RzC<A{moJmdAY3$%Bs^Y63G?iU@QL)q^!O-Z
zq2^FI)cdWQda+5MCk<TuGK}PFhTQOwq*DoEI;wH7exUqN29n<5&@dfh{0S|Jo(n8x
z7LYHLAWhIRWFDhuY55iBM=Fvb^-Xq)d3vJIhqe^Cu;sMUeNkUg1Dn%MAQ?ok36t@=
zK`=KW+2nBGhu=%GH}3FpP}sxYGQ&zRgvSoAh-FxWQJ3F1Hw(FTtum*un=G;O2~o%I
zu2?kZ8b^e1-fYR^AWk%X#y$iy=Ioh`#A4T;okc|*NHY=e=77HRmCUxeX6AmqOvs^N
z5r+2}Hl11(#XS~48~BnU;DU@0epq~|D`Jn9Komv67zOiZ45ryYKQZP|rFVoGqtHT-
z^c$MV$dx186<Eefg=h0AzBW+G`YN*(Rlw88n`j%h9owEgVB+n9bSb4E^V^q5c(!I%
zb~Qz_R(X1FCm$m0M-{r5A<mMr^3FenG|Aba77z9+c0^{-O0}+ifS`OzLH6UJYghvR
z5kIkS1)E21Y(&gXfk@pvuhx2u4}$R6t$#`p+4M+go<Saw+<@+Hh*IZuPr@W(5gzTq
zA<C}Fx@t(U;Eczj`$+X<iKTATyna=`sN1-M<lz6bZdne_b1yUBc<Tt$UkWKH`8>t_
zZC=iyeJ^t1E+aZNPRhap$IL9h_hi>IuAq@D5h{8Z650KP_|>($k1(X9d(*Kd9#vz{
z<W?BJkEWdRxs<%xi45%7soM9lY;|^V9ntV&J4Sbz%M}od^I)$#gS-Ga{rK}q*xTd~
zF^E;)U|9sYJ&-g4J6$y^qPnC{*PA%6I}}mTMf>;LwGbn=AB}`tbf@9AE=&+CsY3Ao
z(+Q-l1CR_LPSaYwQ&xxQh_z;L+j0*>*Fe;loIx&vei%J+f<NNT2WB7176kuVbjir-
za8nmGs64_O1aQzJs&G_XPqVAJym=}Ioa7^V_Z6-eMSOPpN#fVTJ(Hj7i+q*$ZxWf6
z3*G%m2gX+6Wu?2{tw~~E%1jKB27TBc3Oii%*<WnujZCCB+SQFC=7fTNNa(>NUTdyU
z-ycElZt34*bNl{QJvCciPaK^s=njU2%P*l4$LokhfB-z%EM^BcMUGb55}QhT5N`gJ
zuK0KJFTSALw@PtwE{A7CN*`Qs@*6ip-d!Ub+II7GIzZtSxTPa$!p0hDqm}QOtcM4<
z6o0D;m0B=dj76lDHJc70p7OImO7Wv(b03p1XhfwZbbD*I>TIS^fXL^7Nm(T*%1Ra~
zNNakv6a^A2QwX^hmo8-FEZDxOV*`e423RE<aAa5Vi{kUQ_^7|I9J?2BHnpqmBXwnI
zfocStVi!mrdYxI2+_8YQ66%BM8r&h<#VT$|m!ds>BszK2z5axl{v?8SWCokxkoOVY
zV8#)*nZdA^unSZI0q_PT32S?DXmg>Qr5)?FEVseI*`@5U5QRh4N1h#0+8$nQmAgDk
zMX+(s3*JDU?BdPZz6Pm|eG<J;5QIeGPw=u?zcDNq9WHbq3bdjc*<nc^(@P+(c9pyB
zh&`W0?_sCKzIQd^tMkW8&u0_&kV$AvXp1Az&DW0!)M)Bv;7Vf>MY`pUAI$uSj$x=9
z98Sl}=6J?O!UkAEaL?j=VI&Pwe0j$4A-z1^n|eaF)}t#Undvc=n$EeI0$7|A3zWii
zsH)==ChDCBe9pLWn%R$KWz;!GU#F-0_eI@Vj|$2uIJ5k%3|KwLd5ARV0IW(mV}tY(
ztIUt~)ADHmyZ@EV0VM}e+aB0YmSi{S^3JVINWJOa9>TgJ{7$M3GFDPnq#i{YEZ$;d
zGd*{0mMNp6=6<^&lHMF>M~;_B8vU|OP`%~{?OFYx%bVKx_8Pi$&7fa&pO#Ll%j7px
zoRJG*AV^hJ-v39JR@~3x!#-di+yJYsw(V_+^BkS8;<g$r`#Al0i@ESX@n*3OZGp!X
zVStRSXA~Gb=#8zRj%oFgXzM|>3laS0ZvV8mOPtenni9%(7%{q7^i3y9$jyyB0nZ^q
zZZT&P88AEriSjrO1hbq3B*s_oPX`gm&?ijqt5LJndXX!wdcx*!Aj-x1!CkuBv$+iM
zF|D~leLq==3YlY9B4R^}8Ven6&F|gE;Ey!t>Fs01ItOYcv8W+0(>ny6>lh>wTS*vS
zjf_TtLc7UM=|82@jBkj>k{Rl;9@qNJSdg#<b;fv_)<e%-lSjky`h#i1iOpX!#WR}@
z8RC@XO?cQNBEC`Dnj}bN@b6)yD?^3vF^|!}dGQ7l86;msFCOIy5gn2Xr5MpI<#i2p
z6Pv0T?2iN>7SH~uecqSPT?#^)zaCpBA&7c{;XTS0B-a1dUYgH6{PH1lEdT?Ld^QyJ
zxLRS(`9T-o&pNSdzu$`@twMs_WMm3+!IntH*j4`9R2sPl`E1m97yq8_!N=tK4L4tU
zxN(uNq$7zE(V(~;Xc_atXECflF{!?!YCE*DJqH_>B!WSxw~bt`W``tKe|S-&uAxc;
z=${xPs%_|w@`Z7izd^^Qi<jYBwfBXQa<aLO8%oJFSZ=m_rLQLA4`K8=-FR4R*X66E
zgL7^He@3Z~Z#icZ5x|G8NT!=|WRbEeLDWVg1BdbSM|9}!SLFno3dSWVSP!H1R>f<u
z+gyJXqArv4v%<X{D7yX`ieIKH;6Z}+0a#W`v8yZyxYIV-`Cx2O!zujW*l7!%IJqb2
zJYkR+;@Cef!aSjE4m{zTF!+Hy-tfp4bU|^I?~f*~=OMdk8t6j#pd^fN3j`{mxTQ82
zZ%!xgWY+Iug+hi7+fck$7sE|8qU-3UCbuc%{IKCBsfMZA(~@rn3L`3Wg)Acem`;2;
z=d*oPS9_zu;6z{i&V!Vc7ejdH=@O3x$m|clcV`b;W#3=CqYhz8$+qOtQ?c`)U^>a|
z?w-~8<g>+qR+$q?7GS;kb4$zuXPc5=7aiFby_<;Hczfz(y+yv3pNANzj}_^oT_6Jy
zXPW{j1%A4JT(y((!s)*A6ix2`nnDM5<4{ZXU?=?JI<2Jrcyr`(vuS$Him5b3sD_)9
zh|E@TY|4t3p%FPcP`9ErzD%4UYS<@>?U|Du_7Jw&mhiBs2}zAh4z%im#1KOnv)|M~
zB`MD_$ZS2WnACMI^}?Gr-`(nSGrMGUg%fg%;l%s4-7&3$;CkU%g42zm+%7fNE52b<
zKQM<j(b+!DlIe^@uv9FhsX)?|`e2F7so8V6_Z%=J6WEn8HVc+FyPmQZo|Bk<P@t9l
z09H7KveBxl!BICNO4&+a6~rM0Iz;H>4=1JIQfgY0TWHaeJ*$m~U+gG^%?P*9Sn_6s
zp+EGkOt-&)&k|K+>=f#MZZWLwy-knLi!;16OcrZm-9$W|=7#elgH`-~h<6)3IxJ5+
zXfH~uVgN7M>1|Qo9-LFbqjD-3?#^4ib=0k#$$o~8vK&ahfmoqlcsMd3PtdxFB1AR(
z07*$AI8L<R{!!4OMqHSs7hTU6OZjZQ6{(K{v2{yIjcsIeuO#Kfr&Ib3gpc@zN#EO;
zquHV;E&8INUwOE`z69*Abb_Igqmreb-WhDAB;!o7SPU2b)!nq;g8$!9#5P!ep&SW`
zpt7Jz0>g;tj~$U&TX+()Uq9o+9|MW<3u0rUwr{<FGK9d<M_^NL+xoa`zD6e5$FL+8
zfw;!^-2w?O|08uxy@{6vyA1P>;JpL&rl?TB6gL({%NsnVMV$hwHKDhLOhiB4c!k-N
zDc~ty)U=r6ZPwen#*N9QuIed~eZ!L}Y)fnZ?&s0Jl-Kjqme^$d>%#XQE}@nV!mVAB
zU`Z}V<C5-&BR3^o7rd8PeF+Vc$)tf(90QlLke4;-%+?bgDqQKVl?*37{vZT6CeVFd
z<51`OeFgOHQrIvy|89P7I>jpJ?G6`O5fNy8RB+%?Vx2(9G_{VzUWFM-!xM<lU^zM@
zk8Y#LkZ<^O`1VG-kP(sAuiWJ4gRD9$ZH26kYoX$w>9i=D!NW{J)3<suC8=QilDo~j
zC)3Qf*<h|E;ac~La9&>zLtS39fIZR>MNKt*Ce|g`L2Z`)^slNVA4`0HcQvogy7Vi%
z`d_NAyZRBsy|82aP*Py<NcQ{$BzcW&B1EF;q33u*%2S?><9p`xEhy<2QB{>y%}1L1
zn~&9gwovfS;Ss}M4Tf^wc<=fUUjk!D`T0S{rT5+pPgg3Y_mGNAK5v>v1L`Dkzhi(W
zyZXYu&-?l=w+9z?)y0qGLlcaC4L^1A_F&cl>zT`=RNR^gLTfqfBIeZZ);B5hMq#QB
zYWh5kH;4)21+gvg*BHrtv&G=;<AXpx!2pnzAuxH}oC>H}@G$kP2zz0sW=dwq-^-!$
z3?{V9);^`u8<o)eddPog5ugU=;yZnBGQCT6oC@%U;~Ze>*4ksU*nwQK31S+x{uuUY
zM3Yg)PR_fhi>NjSUh2cH&C;dGH?g8jaSrSFX`v*(8Hl#%AINf|Ox>GICtG7O16SZ;
zviiMPliGOZ@b~cJdvdAMqca5NEEHPo<RhwI%$s_6A{!m|^O&!kBIEe@Rw<4frw@lc
zX_Inu9B$hk3HWWXQG}@FAF1K>N=S>nOekd_o=N6>!+O2>>)U^9b(?SB=F`leA=*Y?
zct?Lr88Ex1f$y6lpZmQ(offw($D3=^@aFP%EyP%fp`JsYm|_UU4{xmROL3%kdQzzM
z?jT#`Et7$Jj0~-<KFy$L*nP#${`KJdBVI(A2mOfZZ~)eihyr@Rg}_k6w1RuAlO~?C
zgunt(*yO1%ANEJC`d;K`>*h7prry6>*?sGj?Ms=WH0JLV8Sg$kyvOuRLPby4jdmEB
z&=na4jNSHCq<3lgjw~tAC|j=5Tc`8e_zzDGu4zP7gY{Nr9@V}&?lwiA0`hky$yg*6
z%2T6#i8A~f<?P73zEq=AYoalEbN`=Ze$jM{BZ*#vFN7(zH}%A^m3a=v&CDuf!r({W
z`C1Pu)C*Re(<JFgJ#*^CYUO!D%82pKpT(nuer0jJkzY@0g7QY<`l`lfYwtqgvoPS9
zAqa7cj-m6t1^wbddrVikACbiAEqVzfs^bu_D+#2K4W(Co)Be_d-5_#r^kXT(s?-$p
z8I|cTcDRVMUk6=OCZUJb(se}~+SCh2374(n2kY%shCU6(vQQuLS34O*rh!@%nB=1F
z*W?M>_E}=*<q|NC62~N7yML@pe7{shGK`GMF#WSMico|oWdtYW?A-VM!@dGjt0T+W
z3rHqTG@MReZ%7Ns9CVu8f*<Qcg&gh3zr9m^e=_}T5NEg#<~La)n7}oVrHGWp{Lc_<
z^N!lpBhhme+wd!8`VDzRp4V!!MAQATgbr2Za9};MVa2wus%+AMd>na0G=V<}dl8dG
z30?Q{I@3+wjO>D<aqfo_U^UqLEbPwa`wRABb(@kdCDUF8%fQL0zt5+9BTqZpp;M6H
zw=<T?bdRGr%OaZFy8<GU?$4CEfnX3<koG>(r-<s91xFwxa4~P7_U&ci4n8Xl9>07a
zOonQI`1mbGIwa)kXAzW+oi8oNroW5dyzkNMb>C=tnL-4MT`K)dRamlWV_o3=2NJ<n
z+y*bBs7bJeTP60oPY|n2f&m)osqTe<GEo@CW(;k5ym7St3H#8*NEh;GF@X}Y;S1un
zpi1!QuXutVX9&5y*rl%B`!z1?)!*gagz>G%LX#xYu_^ryH)%6rnzwr5HVA^ILP75v
z-(|>8M2Q&~3E&Ci8;HFJdOsO2aS|Ei)d0><>lj{UO-a*-F$$+VVC(k))}+ExpGm&a
zBuAE+=wlzK0(1F9BYx{iu-&S?@7AEVO>?>)Qw}RQ=gw_A4*m>K_nfi1LZ9(!e*Rk}
z_w2sE1MPr`b_d411j6UZ<q2g|9aV@`vMLCw<??!O)q4U=oX%mAD@KmvBrIscyLRhX
zfY}ewhQ!W&9n-{2=rNNkpK88F2;O>_>=H(X<Ew6LZ-5E1&*Vp>k2GZW?f!I$te0*!
zeJ7E6<d---aa`%JN3ed)h$Rzf8|mW2w--XxAzaVjPBAq~pK5i7zr7k?$IfH8HiKN4
z_oGiOf>i6dX&;L#A_iHyhu%#jBG;ewOrky9I&Dp?!n+_K$a;8VtdO*0%EHq!D#=C{
z;~M0b%Z(Pb@O|ylQgThKMjjnBf7y^dbNLoJQKdiCbS2@B$Io*gYbu6xnS_gvatOaP
z^|K8eHQ*E-8z1~NjPa=$lB}N;b+tgDOQ_ew$PuwU<<Sfe`CTgAdp|9_GW}h`#f-?z
z|HyPx>Vo(nYKp`*uKH=kLg=G63iG&rv)^x$zoEbnL!RZG;a?+Q4MMl%(By8I`QKRU
zOm;s#->x6oMEY&7O!2tLNZIi$D)l!vTVx%a7rL<h>=`Hi{>k1UaXmxr>|1TPpDxs}
zs#^)UpJUwE#yt~SmItxiTB<~uUe0pYsWg%v+;}0-?0zEPbrKG)^1|WRPaJpN`BjrV
zuwQgY_ju@3mZ(2py_KHN9J)0->^dZ&o+?^Nmeozog?Hd#gUAu&D}#35n!h<SVhKw8
zCN4DGyU%CbQU`2$&G7J&o;_;02l8@w3rkO<_ZovC6$JA<!lV_hlO~Vvv3bcedoujt
z7d=FcL?ZIm91Yriu>}%I&Y39V9mwzF?9>h?fvoQtWMiR@uQ7rGc-}-Av^$OGrfc5*
zs@OU;tHDh%#8ksxS$a?AuIixtOoE<V108w~!h>Oi+uGpj4(Oh(;tlIpg6}m3-D!ud
zwXQ*tQUXmn9OLa<7*Bmz=y4<%3WM3Dz5bwns_5LXMCMftOj)Cp9U7^J-VesuIzt>R
z#_jOP85Dg$<^v@UU%eR(i$L<JEKxBdVjy~x+0});w?Y#u`xrLdhg*{q%ve5%V5io;
zLbT-P9QqSTK)dTP1HTnceV)!Y)8l&_R&0ndsthY`nOXi;OavN>aa*|kEz0@@*9RiI
z67M*m!sIRWASiZw!fnvzfh&-Hf{<9+J~s3}n0u?RxT2<QGq}6E1$TD{p5PYT-CY`Y
z_dt-~4#6R~yF0<%oo?Kj&Oh&b^Zq9@*PP91?_TR#yQ=oyOP;&x1!R`30>QS#8D#5}
zLOEP)x-mq-ag1>5kTk8=5xn+Lg^rFPv8c%vj+f2Kv5X>ZmH|$UK(mwt(-HD!Tx0oV
zSN*g01JdI>U%6#mAn>?gdLZ#;W0V+{CLTUMTE!=eMZ+H~tziY1O#r906p8FTmQyy4
zMrw*94#Dw+#8xX)-8S_nT04sG2ksQInSyZFo6w}fuPuHI{hq&gOXu{0mX6hpab48}
zir&9BRQ$Hzz?BZ@d2;jbdjW0gjxir}J*+=;SYCDZ>2dOxYKyr{@gG&<f9eg53@(U_
zDuNb+K=|?bD2p>Bi7LZ8cM(nkqdm4)=jMEbQ;u2D+p7FwHh0y=_QKkDu_Tfu<4{pf
zR5&nBTj*5N4Ks-_S^wbcy<2E2M*A>k4t*Ft?pO8~3MiJtBO}c87?{I`1#!2oRwPzS
zxvWxKW~zDRmBu`GJ2OEw#~lajxU<G^M}^J?MKT#t+9Kaq%Jy3Nc0V$M?ScyWsqBV8
z%Nd1~c{p$T8dHO`ywY2i^@~ZTsS#|ECBytQqS@5}6HSZ)k}6}jDR>RVC1tI5!X>Ig
z=Zg%*W5PiR!_-m@y){M~P!K`0+w3HCwWg{wXCE9cIDI+8DFmSmb=F9q?^1~q{1Y!^
znf+A%$SMqbf-LY-h0Bh0b~t*nXcfCqV1tZC>|usB-)$7a!Et0ZhX}6FP#)c@1~Qn0
zfPqz@m!ljJ@vvuQ;mlrIRb<;EPnac(H@wl0%YY}|#?qI0iE^S3!;=uV9NWz9q@aSC
zxbSNGl3GbGugMwM8YPRno-=2vR<wk@N7sr25i@V;JhcpycDY|rKn|12(>yymDS=nW
z!i|5lp*GuIkiP|?W(i%^LWJ79OdRXVInI-(b15zzNZ`+bI@IuNO{s3uq2wmvw8@5n
zHWmTjvv|)DO?AGLvm!t3NOHqmgKk9@o>p~}71$3QRufk3U&No@_bff>8Oj2S>nIyO
z`)mncU$WJwZMxh>GXr-Gv-?Vws5b+{|K@R!d;l+G8K1rsBFVBWU&~EbV(UEGi+@BM
z0;+c;4Pj;J9b?7WketyHqT@l5<(dyWT6#5h-yx2T-AKHyC*>SNIUj*dB;AkSo>-k0
zUpo7&l;s}To4rrRr-k3UOo^@iU3mZa@A@S>LnHB?f>)$FS8s;vQ0+tfP;zsP^Y~ws
zv>Smuat?CBD#@%y6qdt3=)JnsyLkg+Rxkx5S&4e=L(D<yqovB;lTh8cjbaNSu<$48
z(#3&BWf;@*d&WvvZFRH!zro*NQKsSTti-R8gnhF%di8bU@)}go3m)>vCSttYwurGQ
z8-XX*tU|UFrPUTeB2vfx$&hE9@n2hhLbJ*s;S;RvnhXgdGs{I8S?zg^4w?e|W(kI;
zR;eykuq4kInC|=}Jqkqi14!{IvoIcNk>BPSb*{<NOsa2S)~8k}%kA)g3p>Lvhr{UC
zsBP~PM?_<=3pZE@MY;~2G~7C@wy12vjC3Es#k3H|R*mFgBJXK;ATd#r7No%^IY=+v
z@Oc7;@QkCshQtz~5cR)Q+Byk)5|&N~Cpo<cyfXVHs_-Hb=pyQ5MCAp_0eE{-S!_mw
zt*j9hyvl*@?85|OAHi4VLOxqC5J>M{*oEUpKnw_pUK!l`V2ov|{Iikx^N}vgkIT^N
zfTgCO@-}(CEb8vbi-jgMX-j93eTcSH_cs{-`JrxM;>Q*qQT&FDfrW@+AaCJyE%;dd
z#TXiE{LJbXLEk()EwtsID;E8QXx)e)hntfAFGOpLY<9JL9rY?g(f3kL-rO3CT6WqO
zJwUNX8|CFM=LZu+YYegKLczK8dvA768~#}lbx+?Hres@v+}Lf=po=S#rt<c~iKdpJ
zDcT*NIRu7+hbkf+9pPU<<m*Hf528jHe4IoBZ$7+^bBJ294weJMA`5T_RUsHtSspz<
zWytCz@0L(Lk-@IEG)6$hNcm_T^Jwk{4`J2dDmCs|ThPb~l(K92LOCmmn5^{Z<8{O7
z`>yl{CiI^|k$L`w6PfZxe+2v%0fN;0w)cvkdxpOgXbC5TR*Nn-9hd?#wvoC+W$2i^
zV&-=Bgyg$Imm`=Tsdx!_MtJt|?JFdA&M2|*@B%`3YvleED)<amND$`U2qFJ@R}0Tq
z;-+KpjVmZ9a0DJs5~<&^h&L|8YT2qucHnPIk9ge2ekQ?vA*smUcCGd44O`N25N|1l
z5zqDf(ps$lQX@Eh<c0!~JAVMDUxSgy!-+c@_NKL^)wkB3mZZ84yYicdTp*Y8owSSZ
zq(5Ydo(MjhN(BA%d*yfukYNgeCP;~`sogDUT8t>VM!FCcLd5b-m~I)BHJJqP_8CP*
z<r_dn7?Pf7l2T?ow0cT2&De}M@`o5kGq_3lS<g`i%Af&lfEJM7O`_*$0S!t7&Jq4z
z@UcH|dWQ&6WZ04J5k4?~n+h^KIDzRL#%Bv`Fe<@%s+SxR1pSZaq2Zdl9bGXw(Z|PI
zvF*Lt=h`$iaI?)yv{&Nim+id~u$klTf)cRKpjc%Vp+r!9(eG~zBzlH}z(1aW9WxAe
zjDrvQBVQHRF<M~9)Ph^+gD*CaLW|`5M)Q4DCwl~xivXR!!)i?b3-EV}J=dHFh$Equ
zkE;^T#0#h2_%CE_3B&oMu>Y~~R^Z&xVV?7RRkz6Sk=;Mj3d5fftt}Ynx?RCGUg7fU
z3?7Bv1x+J>M`~$D_n5^Yx}dIUbER;>66-tl#J26a5FR+KO$H6K#ujqXHwshuv1;5<
zoM89d?s31^yY0Fe9z2}{ZXDqN|Cse`+;g;z((4ZwfDh#NmFPWsM1diLV8iy6>`?|L
zg>@QTy(G=Jo5^^XZ8d<$Z@BgN*eG(2Q;Q5kmMa49E2Kkq?_wd*JDdr=X+bh*k@!k9
z-*qjrN4`1{;LTo0?{E-WpZ}&U{NrN{*b4e!6SaU%WRC_(RtmNqX$6`uu?E>=O9lAi
zVo1-h8n~NWuwhxj7pup5PQ5<6k*tWC`A*%iEni8Zz~o8@Bi{>ZfX8VBcD5zB->hnI
zV0M9T>3{4|PqFPf6#<c3$OG*=wW<u{w+H{d1KgI17uy$g10BeJ2ab<kqTn~wcd)e{
z!EHfcb3hu=Jx2Zu79^kE&4>T{Wn>-7f-7h9CMr!9nr7%&W$GR`==gR|3`N$w2qz-q
z2YxEK$d+lo+2FpUtopbnw_N|m6u%C^JYaa>CChz}z56~Ay3ZNrQaQKfOZ*GX*Y}AW
z=xhcX_k%C*hrP&vYkUOJ859}qzrHF%bm(a}X{fi}?wtP<Yl99(9_7AUAmQb4_mw-w
zm;tKPFt_O?Apq-ROEuVL>os3aWHoVX={~cx*2fNdL40=0O4#y;Di7Tpl$wx_pKrDY
z3xjo#6JkwIT?GP&k8o6<4lPUAIlGbbgNWEb&YED4RKf)%l!A>e3O2d{IB4~L2K~MH
zdMr>MF!GpnWO;5Np$W>R^>xnksebo8f7x~|+kzU8kn^0bdsAFg1`4c51WvDz#-h~f
z6L~gicQE@ORiM3)T!AAi6m8&CU`Y`SNJxL;H$qv%^pYV`_s=yw>|ZTus{SQB^$2#r
zRJeF?zJTq*3#2_mzJ+}+q|<LM$uh2vAik$8Zm2ac3%_Zf2ZGEqbs2l0f=H=7-SSjC
zLsLhR>mdhS`P<Upwr;d=$ssT*ylna*K&6W;Aj3j4N1cYnzk)LLL|`J&mByw@G#Y7E
z`>1y=lpDee{X+6;P}`HE$}%JT;UyBm`a@Zl(adf7-IWo2{J3>|Kr6rdiMSga37-U*
zYQB;u%hlFTeC@^5DBCbIp-A<dzWKktS)Erh;!8;+D@lISsH|@GU)WZo!kaLhC}cnM
z(?7BLRT_CdU@f9(y8y2S@tZ9^9PY^97qlh6UpU|nI6GVhbl2B-J@ziIuD(x{cJrhT
zk@`z4`TO8()a=b|Wf@AH6@JxvEHc$n47g;AukH*!Xit-H%@jO|g~>RQtexEWj(z*U
z;<;%g=F=*7zy4*((ZP3TiD@C?QXu=HHsfC4eL_-EU~=x!g<!AYOvk@(jP9iGyC$4u
z*YTmr4}0`dj!20bOx{JDxK%e-{q{`$y&2te?K+QzgVxSb=lN;93;?&SX;WQF_}B<f
zfyv#h!L&!&Lba1}xkkBukyQ&GB<Ge}EJIUmXA@&|Ik%Si#n81$g$O?0=dQuwIQPd1
zuc*Q*#x#(~AQ5gae|mnjV_D<TPo^SxU30O6watFlgIFXv8Q|x2f+@{wcIw4zcW&X3
zNqvJ!ljyp*=4HWp>8woWfoVO>Z?8V4af~m7cQMQDe>|n2hiy*`FQOwi-f=y19@BM#
zcY?72`mBASk$@UA%$h4hDPId5Tyvdx`qCy7BH__uJGjA4UroefX(HAA*Q+kNbKN1r
zhu3n);;jC5qAoU91@X7^z`Z2mr2~_#`i))fkC<odEb>S0r8i#`AEo1!G4lbj*1g*+
zdD=P3b&Pa_1oL8K6OuIQY6hyQ8jGu_U#k&&RX+UHiI-_=hEgv%wOv6efPCd)%P<og
z8E;ZIGA!Cw5iF1vyYp6!7nA6}ulV^<b$DPx8u*#hG&i~v!EAd+vD4>^4o~Prck)>$
zHTrFA77DkkqaykM@%CV)bM(ZVZa=L-Ij~7K4fkhu^s#zgK-ohhxSkE`74x2O&R$@c
z<U^zj6Qv6&6^L3Q%d)foWVOKjn@;JXGppfEuy$$ZU3i9HE2JlDa1}Zyg0KJT8{XU7
z!{qtunHyS+W7dslo$Q^ONrwQ`ridoUSbZu=mth66&8A{jph^6ML`bz*g^_J(DH1JC
z0=?cet5AgaUeF?>r^zB!o?MgyTC7=?jafHL=NoEfRsuNT$Xs$Vu*8p4))?(lCTv&b
zOo+C}*W)>~b2k-LR@Suqf!gll#IZImAhzDqoQ|2E0(<9V62GNwI4{p9>D1qen8iT(
zx&Ei|{(!eiMn&xaahn|h)ZNcAE24<>>J?TyKbQ>SAA`mVDVhbQCK>S;?&r^ShCLkE
zlr#)csWbPdh<d)NGi-9u(&AIuQ<D$hw=G)m`hJj7vOb_hN4tO%_k0R~BU`T`&gYQp
z!mL4s%C@@WUe*|OwHoPy$NSK=`bB-j`h4G3lii7~I*QET=(Sfv3#q)$DQAvnGhG!)
zj)k@x)l4uIE;4uw*`BubL<A`U*;6ZTeSavmTe{^7v`Dn)VGH}gCzCF1ZfX|4;q&h!
z27XO+XOkEls}?*tW1k0eus=sQ<aC9#DzReVB!;FPd@rl=im9v!a*AUeJl^*C{2ab5
zt;o(`!<dxok3mXti*n#0w;F6#Nw~x`wGA!|qs|j6R*gl1TL0HU@A;sH&jKSt^Ga4l
zYb7@S9`SRy)UJ*Ni-@}Bj)Dc|tLf#Bt9cDK8SZ%GB{Co@p0D%OcLJN=F;2V-C?!*y
zEh#xMr_VMWt)2+?Q%gW&S-cZZxZo*B$*>5jgIOZ=??3lI7krN}G=&zw?r^!%%f`cx
z9J~A3>ptm+$SvpjSTM|EpyMV~Y92f)YX|$JQDOKrV<YKh-ys-OLU^$0poeUI+;cJ&
zI8bz#5u1mhVSv?p3k42z+G!S+ID3u!k;sYz4b4|&c2}U&UUPsCO`*TaTJlN`L&!}=
zF0et+xuSrhgV{GW)W|Zc8L_W$$zE%*QjEs{cFUEfMW@#z(Q<cE;E=F>``|p`OdE!d
z)jwKJ1mY__5xGcH==xX2bQnCNr07xc%*qA*VZ-;M=~|G2q=z%XCXPt2xhUGeL6bz?
z6f`NykciM=<8j3Z6ClR(YCI|6gYY$YPep+4@U(-%T6#YrpwF>scEn#_%w8jQqC(6G
z*(=sRi7>MQQJ%Luusw=Bt6*MvRRpD21a%TN1ZQug)NMVuddFG?!C<5C9zj9+pca~F
zjwbX2X!+_u5_5F5N%^2b9-j^D9gl}`F#0j6h2?qFw?U20KOluyo)b{wt@C0av6zY3
zG3gf>BXSw(^%s%fS!+~}2%NKZ8@utMKiFd8>(8tiwO_b!33<@_9rRKs<1&#bz%KxA
zl+;MH28FE0miqWB4hKg3-_pSe)KjbBd!Pu1i5N5Vcn!+gekgX&oZY*2N}+BajH#*F
zk&CQ7*ywI}eVB9#Q~~7_NVqd2p-Q_iPyL@mp@;Uw{MltU_sQvnpzBV)r>m8<zS4~E
zf~G&tH2H=%WW==jHxDf-SNmZw_!ZE{%H<g-+BVlE-1c#VCK$!PsgODhLQ|aE@N9N|
z4R&>6&?%M5Vx#$4k*9t6rM^bATF5s13(KIS4ENY?9ri&Fp4Vu!E1Wi8<(Y<0+;`^c
z3o<Iv!^$a1u|<^+>3S9r7sUe=a7h7Fh?hZ2iP;~pjyWY%eZwd_55L*u)-#J+IW|Il
zf^y*7Qo`{DYd{Q~5C)16EnvYSWEAo4n>ZfPzCQ66hhVafW6y`IQ%&GCsd%<uq7Hu#
z$R^4Rg1N?lO5l}a&JcHd^32yvKOxu>_`TyIV~_9s`YS@m`$?|z96M}+0d9WFF~5T}
zpjYIUz3pf@K3X7W9PNKi`~S^p|1<3$+WAm}*RL3li>$8|--WwC^$$q77}0TldW8WD
zQtuU%vMWB87P^YXf=cuTT7UH~k6@C%f1^9i3bUBb>rHim;8tSkUm3#3n~-omGDZ}t
ztisR~n9NS&+6oDCCO(C>UEi|fO+MIxHIw%08M}p)uOdOuNQq|b^>|z}e2+Ga&kgcB
zm2q-#{vKMr%LNe7?mG@9=%}_RC{YqL>9@12hn}*yhwpSI=^eTS#mP&g0Uq`}?R2jZ
z@Z#h#a_*ta*$vnPTwxb`N6U`SB_zZMA?2rbLx19_j>C1?$;p>sDDL`M2<ctO8{3&c
za!%XQ+2Q|<c44gg3SO0?%^NzM2Me>{#<@Hgg@{NOKkV2$z*2D{0Su-kJ|NpA!lU^F
zvs|M4LsFd533G?FiC915{gG&s&fqYPtzK1OE~Ngz)w`H9HnT&$8em$uuL+DpbKYIN
z$4xPf17r~+Q@Q+L>BUPTK8s4W(475Kxyb6qF4M^#E|15!3`<MSK7&b1OqD37XklH3
z$qRL1Y+?sV6yapnc|{)4A*J~9Qdf5<laEL%biJ=%kll$xAVe)SsO8}v%lq`&d2kxD
zR8fl@Xn{~tv|7G=M&y>O6ZzhT7wO_27?p$}FI>HAZq6H8Ikgr8@R>v_eLu(r9vQ~%
z5UB;8xZ6aaz|gG9Chl9tAW75Iy2cLdjj=FQ@V3nU4hgH~wmY{oYT_Y5Z3=36p@dTL
zIOGfHg{-bim=&Pkm1bP_vsr;8bXCLH9a>$5Ke7*TIx`o>9RXEVI~tqjBc!d9>|pv3
zB%v;<zq|7J?c)1C?l?Za+3{_<v3_B(lPJiB>AQjZ)6T*{`&&!g_M1SkU98h#C64bd
z-4+4Gq6T%D+)YsH5>~ABpF;b&DLbtk&;E;ZJH6Yco(we$AhMFg#WDv!nQV+0S48}e
z7oc-pP*M`Ryn>L^n>Mv{DB@VcDbtnM?@j_e2O+7=3;gA5;gETct`@0K8>#A{U*ds7
zSzljY)4I2Za}#>`?qP-`5#ePRPFkOKRbm3+<G^XNZ(YQAFJbt0$6l<x_Xe!SBEvdm
z2nAA?{{U;kSYWW)o?UisD=?bRiYyca+dga3wK7*2N)qn1fH#&7M^Ap6X`TP>>12Gr
zm5)2wXbjYRWKMZdl%UiUpY+h3R0<D?LMkW>*|9Q@ZBPfVg<cuopZmW7XpfA|%n_f&
zQrVOMa1cMGXntZq<CjfKbhJ}9%T>m`e8+Bz{Zh2>MMM>P`ew1^yRejG@F}lBn3D``
zXsH=Fbzjt&5wh(tolwPDKV}*(ze_oO1C{$o3qEwatDTIz>2id=jPV|wq$<C9^tX=I
zW0;B_$qutE;U=hra_->Ej^3ULL^BQqn%|c_#}B!{G|_pVU4NM3PNejj&ZznB_Py^{
z9M~ztX)3IgFgJc>4Bin_D>%qMKlhLI5v1)(7+c%Kstx;xMNQ)@#76V=%74Z+b^e2k
z0Fl#j*M(8DcbqAEFs_IiG5X}n*5o#HK>Hm(LpMlE{^V!z_Cy^SD6RVyWmp&!RBef?
z3WD?=JMlxR?a$ymGP=YKU2Ap6&&B)FQh?JYvX0W{IFtksmAuMV?P4UIdy&pgO{2JH
zi}8;KNm1aIKCAq4hRN~3bGiiAAT8XQ$;RWx*VP${PCQ-Igf?V^liV2X+W@d;nLe$+
zQ5J$lGIBa56j}y7UoH6^!n}L0Z|U)02Arpl23n0$klFKX3C%Tyja*M!HI57ZtoYqX
zRNZz(^slG*x8J_pD~$9-+&e4M?NK2L{M(D*!)ycZ55}L9bE+TjS~%K9qFF<iDWVlm
zc{6xxL>AU=q(zzH7ci695#iT-4J#D{H3mPFSs(Ysenq(x$MFpiM%b#PVX9&>aqz&s
zxmkEpsvZ9J!eo{4Olk0}(|_r~tbxKjV#8XUEeLUT>v6Hwrxf`|5N&wPJUuJB)c3HC
zDNFi}M3mT5R+@F~$;Tct<8sKUQ%{OX%eMZoeITw+rK0eDj76`hN%A%m<5KA_fFH6-
z->JqU{zcbTmP<4`FievHcDa&H0d99XTgI&Q{#S8=b*+#^j1So}o1kb!Mk@?FO{UYv
zAaOM>BZax2$nLOVjIK{UPTNon%TAU#rNDsgdLWnJZ-R-4GZ-baMwUR~M(##<Q<6Kn
z$?^WoIiYpL`a#gv6nT?xI1bF({MC-N3u*p93{MNlA4Z3R()c7hS_Fe}gvSi)3d6)Y
zX5YsCiMK><$L*D?FPip*bvJiliFYybqg<n|+CXxLns!+R$2bacfbVH+c#Y4G1|H{T
zVR}_>`1ugE>4<ULYZci}^Etc9oz9$6-d&?Gj~p#5?5PEBFR=U7F1*E3Us;7E^9Sxg
zjtJ_@%Z1j~%E0O~4-cLVy3;1I=9ZG`O1UV7)gX?hjHFpWK^LOF>vn84_vyvx3}6YZ
zJ2z&SHb~q@I9rY5y)4f*R3TDi@cI?{j>h>h4uxrPeE_EY%t~9uR81&!;`ocC1(&$^
zTlOFtJ)hK_FK=OAxHJro^U>dO)fNoRE&~bsW@<@$8@36*<L1Vqf~{ZhcW97C`@YG~
z;kFAN12W%jMsQCtEG=Ra(>iDDs>K_X_E#C*>In2J=Co7v9>UGHsgS?%)+ruz0p5{)
z4e!)Cqm<^{?Uq10eOAPxByp?M)J;WHBk|4=8DY#531kr$7XoEG#a81{gHc$d0M!kt
zt$1T()C42oJW;6jFREjI66ghK&a3L3=421RTx;-m9FXl#NGeB@vP<?d?L>?RouSgK
z@mf%8=<o{vNR3_Z$UY@@ftXqNGbLpw<_$;F2^P^gb#+@?@X#%JmV3TOHZCUb+vZrf
zu=tWADPWZ?G|YS`8Mls0F!IORt**#P`1z3Y$mg4~mJ2AVrOack5*{j+alZ3w05zq2
zEXLTX26x~K3r+1;rr{r2f-!R9_S|YdcowwuZ}$X|M{Q154Kvgcl0soivlfqUebgzQ
z4~5;$aKfEX$K@?CNTM0r8W-4R1C~dYkuiU9cR=%{fSeorC^6i}G_tD1#5HL@NCN1>
zVj#Z<Bxy!2d1_2uz4-BX#QZn4&z)qmf(^Dcf#!6Np-lg?wf!D~q>srZ+!-;>&K`;S
zFz{qLY;;N*{y6R&N!_<4C%PT5;9)iiFY1qJz#85N$0hu=w(C>(EBghP_SE96lQ4Ys
zQZ#u<$f>n=K1o*6=I2#mB{C}l{`LmxNV=Te_f)QuzDGA~8#nPK7pemNjU=rFgnX^2
z4T5$zV_FtLL8|J!gf(*~_i9*U+{Lfnf;Ga^c4}eKpJn*A97=v9Dq#2CSF&T;;I+<&
zFE<ro<ag%=Pmk-fN89i|a(yb*uV-u4osElX2C{?t`Yr6+bg$`s0WYv|$&_EyEZMn*
zgTp(BoQl!3bShHXEnFXQm=xQ04z@4pQvM)Cu`I%S&6VI>q^q+%W2_`>8c9+}-cbu?
z#jzeuIV;qPM7QT$M*6Hw{#9VtfEDHRSubCm&(}%bzQd6Llr+06MT%_p@z0+fn@Pys
zlCooQ7xnhNGY}$Y%nl;x7k+IPjN#P${pVmkeQ=ykW?7FhZ2RWQ1kTj)s;{3Bfmtr)
zW|8Asf~9BS42G{+9%trOBy5!4u_I&7im`~aSKm<(P`V^0ePZ`5B8lJ<_2ZAUgUl4O
zi<RISp<8!sP?Q9w0JWQw-=}8gxb38kN&fF;!$7_nSdUR0^niD3J7YFc0*5Z%+18G+
zINuYTHXBuA_aP|Ow$vy#JEM?QS$1{gfaXs^*1xD!zf6_xBe<-UQ0S!hj2x5eFuI~!
z3~eU++t9i^-o!;ZvxTpPBqZAKl(&Az2P8w=W?HE$(A9O;!46*2>eX>cJ2{9hf=52`
z;<UCy%yh~1Md4@(p79Oms}k#%t6fZfGc^2m;l47(W1Hz<5CY@6wax%drb}mASk($5
zz!2CIQbJHkpE|4hPFPd%%+|~nmftJprY<ZK*?_aIW^>Hj8s_fB>!6d>_hkE1xzd)8
zvR1LX82y=9-*+Af=0%q;GFBO{g%-zDL(INJOKc;=NGt5nG(4;Fmn%@V?5D{e(U@MC
zOgXD`O|1NRfsaneB~5WnQH-AMH^hp>Gr%Jq7PxK;`MN~kAUt#!&E7_0;79^tK`%p*
zWydgZ7dadbZf0vGGHo>H@h=kuimM5wIHg-h^zcc;JKec<aJWJp?(J@M8vVNCf>Br;
z8~re7;s`R9HBGE1^@F|yM6(G~>Pu#%MP7J==pcJL4o5&|pBd)XfnO~d{zFtAGm655
zLn8>?77HM113m&Oa-m+-@J>9v3QN3YV4B$qj<VPn21G5^5yaj<6qFW1JT><p6FlWx
zNd~+B{cJGIw~Kcqc&v?$<wagkh2PT;kH<H7Wa1XKD%J7To+#4wHlBByu}onY)He;?
zEx11XDf6k3(Zvsiy+{_}c~h@H%up|Bo(HB*9Wl%ev3QiiDZx8*lbT?^z&fP_(8KW?
zfBf{@e)#Hc$}rR|s|w-zp9`3UO_VUdFAS@Z>my;D0HthHX?dNaa=RZGLP%@}1AWxx
zp;%1=hzQ<>p*xSQd<%+5<Y`me65f1@uXos4ZxR?77(qawlQ{HK)u-j`XB_FYYc?Lv
z;OI00fVOC4RIh`Z+n+oJRvd$&(vydo$tcslO<u{z>As_HRJ>I3bTqpgDJZ;Hc<c06
zL0>vzFMpUVXN2YZrgSwjN|KH^CunX4f?CN*^W{Dz0irHj5jd%o_Ww-Gw)drOU?yc-
z_i>ZKNebKd1zW+$37PGX_vJzT_eqt%^b!NjujnLwWu@%Z4T%q3JDeN+Y2%lpkD!kS
zv?Hg^%QF?DJ2xVm)g!(x6sGO4X6|!`HxlusP9Eln?++BCvjk~!v>x*dzg%oSDd?Lj
zgR|+9%7o`qzmon5=#pMdiRQHIFH5M+tgFXLt7OJdE5d1OO8w<DI|)T^?(;(F;@d$6
zc@`LvZe%)q%A+UbN}6=_M?9%u522E|K!v}-^TQKmNN{aNxT%kMS_nW5!#G|&WA28)
zY_i)qP?}NRmfO3@Lp(^OYL#k>?t2P}`2f5n@xlrY5QTUc7S{9fbQ9O??Wvxjmbrnd
z`noiXvE~?7J^9l+G+PjX>@=Y6CN`v+<!;yBnE%<L6!iS#hBV(6iE#ms&wZ7sm@_ul
z(J1?RC4)Zb?VF|$(GLmEI|$=No)%gA--UBTeW;&*<%V2M5=PQxGg~8>D3L^v+_7q8
z%rt^$Rge#e`r}oRp3Yw$=amvwXqfDV4W`~2XBuT+b;G(WRrtIFVDIDx>Xzp^zY|Dj
zZc)|zMhYIJ8DMi})(6iHdW|RB5Z}C#*dBZWck!ArNS~qs<vcY{Xrp{yLvYl|40af-
zX2f289q3K8dcZ$2k=c_t3+t%C8J-N@sehMslJf;WI4bRG@-qDG?9kJgP1TteDEmh6
z*{MyJmuGybT-co`@u2q7=CrYCy?QB+F~W-%x}wF31hXULECjjE{dvB$*G2c@^*&D0
zLD-vc^AuA7h%b>fcUNL$A;xw|j81dIn_KCfoZ@8Oh+jaqxfiJxFeGHQGeT@={Gju4
z&n2hxA`;SOq}tyL2>Nw8`L+g-t@5zcjaLHAAYA8XZVc~D(a^Po53*O$_uPPzElr$5
zYM)S+NzC7l&pTPe_HI+rEqmT!)mxpQ-+sSZ>UelEB&&mcTT-5f4kH08;#qDmll*nH
zwe8VEUexLw2*YZcLz@(j9qcACGIdP?aluZudXdZn9VwHGlnxcD#%<Aj8z-Nz?^(~W
z+RPFokCff}aV&*g*c$7i+?!&5p0+R$iyfTF?lxmiGzvwm!RW5j5e3Rm!XDyikupde
zuQb4SX~t=15Hn`YxD#IzD4^E?2?wGwW)6J88?a;V3KnkGxV9J$7V(Tfk=kY6@#hir
zbNHcFp<J(a98BUyB8si7>?9>5pz<+tS662_>G!2MBsXsB3B1TX(=(AKR!TaM5O`=J
z>7L_f23K&^=U{G|oAXN8pz=jXf!Cn$#w4ifE`n{5fw>?dKvtf2SEck?Y3I{}iLZ3!
zo0hA18U~AI-APwC0ahF3v|dl6K<{M|^Q|ywn7$NQ{*ve8Sqq^<zBB1Bcp0{snwhk1
z2lcVfi=VC^oG1dj+iDY<#UZVZK;)dSevhDkHvb)-hf_@6Ki6Y%>GE2tYE&7+Hiol~
zI<c-e<~-2?-&5!uJ@GH(qUyN)%5BIWX;lLhonM4N(4LIA@GqS<b{^&u)tbVyd{ITM
zQj@Qfp?DWo$sK#_mHI!F1HR^;-3~6{TB&{d^l|%5QcT@5>l4g3R#o5gZR{8HpJYVJ
znz}Kos{#wWJo)ZUh?EBcO^a!Xc*YQ!8!G%`zp_5C^!QGKUNK-Ec-19Z_RM9-))SQN
zF2C?=Ch$?R*0E~)oEwGsyRBu~AmgZ6ZgN0==UjLs3NZ|2ku{Z>i5_=oa*7Iwjb2SC
zt11^m*`ex$V}46Ur(b@)Wu;v5468mBto;K&yoQ0X*g9KnUq(}bZeboX{v@niIlW^Z
z$<4p$=3AtAe*4NXuz*^wVQKV39R)_XkXiAVBY3=%F!C?aLN(%Tch|dLeoW5Yp)dFA
zRBrIio(DsWbh}+r);yu^?{bV}36CvWH{sn?pm{fZ#VyE!^6#Mw6y+of`L-1A!W{j+
z3hmaaAVM*TMEb9c{?~PMm*5E_k{>bjlu((`q>9G^c!r7xpDFWbj#wT;<(g9AN3BD$
zWRB-Xj)2d<vCdh#hY@vy%dy(jRd4ZV`_?IuarR^#xX!=i$7If$$Hq8%24J;c5g_G^
zEl#^Gm8YavD}>x>!|Ab>NiS_fTa1c<#}8@hQV9b!K2sSzljK8Cs`Nr$;~E5?j5t@E
z0~N}`y%^fra^x7KX3UR|H{wCkVV71`MnU9{l9ucfR{a3qR6jiUidvbdX2zMKAteDI
z-hm%KCXPki*Ru10)ijk074=QH3^JCNpERzI|M~=;B01^|gnP>}y78}n8Lmv!r7Xvd
z+Z~ibTb2^(?V&tiU14-nc{{+2O*QBp-Rq(w)DE&UWP-vqHL@tfvhP<rX8sm9$~pyj
zwa&`yq{jZ1pXY7y+(vb70P`%OEGV!cv4nWQNYoo+B$z(jv2CG=5SEf^LXb-;vs38>
zy?Hk+LG$a4(v5khL9a}r5@gM1$)&ovN}V7cg)bom;!`+a#MhcZ)VGsP!+7)eeqhxv
z@?@RCwMaQSHe*!XP%y>;ppogcv$1i7kAevGisBO|CvBL<&C#93mk0pni^j%YFpQGk
zhl1DJrl*mieI85*c*@y_acYa8vh1RJbS4ZhbffD%sO20aY4(H}>Jov!qVXXoUU=)?
z2C>(3nAmt}c}0J)4{*q4XL-ZDr0D=7ePW?vaQE-T2>M|0gv`D0%L7)de~f_7m9roZ
zq{w}|le2rMpRy2#fv1Et$=zz@8Sue1A|x4#IGA<E-vFs73s}%tJS5MTsoUHCfT}Yn
zQ0*O9b-#UGZpx-)|3dl2o+%$(N48Fc#mU1Zywnr@hv9;;bP4s6;BWSITG31Q8U;Zu
z1seN~uszxkps^RPk`$cD<Rto&h1Pi7Xp<RMnXfxs5X+^Lhewd^SIV4}CZhw_X7RX7
zyd*XO^N3~L!Sq6Jd)B5s^XKn?HNpPTS(HtGO;Eivx{IRUE>`n>@WDhV%PEj(jq>td
zVW5q_ckwStFa6X0+6pmUn~7XV-5Bzt@<&hK6o!M!w-Mi0__U7Lo!7EV#*Zm*2u<Zm
z8<AqQd6ZRoL<Xqu{wU>Un&?yJVhXpr7KT({P8zr~j}*jooQoU=@(7c5Ro`~l>2D8P
zbS9&%>*<U8SCUlr8wO~%X$24sCumbLoxrk$we&6i8uNN$fAZo7u{EhRL-seW0Gk`b
z;^LszJ8E`8$uID(o)KGjvbCdbx^qgA0`H8K^JQrDjBfVKzJaWFX)N8D`vPOSnH+9i
zEvRs=YRlo>eSFTqM&Ya%+k81jkE$vL_B9PKh(fl^$JaCa7t0xKEYj4vmcm+m;Htat
z(BY<frWoa-PL{a#vINPW9Z}*hF;*oVvur@V08BSo!<XYmvjLb^W#NsooCKh?hP+pK
zK1FrwoMtqgCS!VLM1HN(7wb{BMUD8(q<1IJ`jEm-G!sm+ybd2!CbMDxAUU{r!PAyn
zo%oYO-%zdWVS*)Wbu?x%daBDLS0rPI%i1Q-Kp$o3YSHSR<NB0KO;df2*h*!%<>4b^
zS^0}1-26K)CKj#G?Qh2Hq_m+un^FFSw?1xBEkS+1{3EqD5&28TYPOHIDnVrmv~KjR
zD<<8!k&=_a*bGmI&u7tPiknU@^%25vo7q{Epu8fC{z=yDleAz&hQh2W5ArTX60ZcO
zhfhVFM1kt`lJoO1z!?9?cqv)k`>L70plgQM5AZ3az1YRUKD3OC&$56QdE!`x?phd3
zod#X9Z0gJw5OztzZ+q7Y4o=WflDcTm{^j$4Do=<Ua-9=yRaizO(tY61Y~d_nKMbE2
z935#~zIc{jCtn!uWM1b*{Nrb-ahVI6PZ5MoMfr5r`WA<vcJQtWd;|IDoYkY82;;(<
zw{46OY;Ap7ya)GsL(Bj=f>fUyT{Mpwf{v7iw_S1{s}zq<Cqw!jrCU5cyAjxZl$*F+
zd?muT-D7p~p6m7reN}jHZCQogdvE8FSBT%9&s=lzXb&xz9*5IpzvY3-_aCJzjepp8
zA~K+E*-`4wp`zvP)u(s|V3o#)C1TBc7hMc0wUCkok0(^Haq$F!c9a0W@DoBqU%n!s
zNKJHNy2T@m5>%R2?uxvg48QD}k`0x@Dku5HflqNk&fi{oJcf{r-(S8BXjqlP6Pc{-
zdWRAV#>wTT`8(u4<kR{$wniXi&v0MEvRLXT%@*NcH4iLAq1J|Z%0jdam9TAUCivvz
zKF-%QL^92JoKiSQ|H&Y7NOd>y)ex_?fs;c~+P=h$u0#~znTtO{=mp03MG?5*{#3zz
z6yA;Fk;ZE`<cuVm!Uc|5t?F}>OB;enTwLl#?2mg#0BD;QdZF#Ml!Pml45|I`*zTUM
z#zY`=g^)sgJ7$R=FWRruTf3-rZqCr<xZQirWgL{B_P0-Fp53@jgx}E9zQ+e88M_6H
zh?QA>a=^Zmm?S=XhBSaB>SekYUiRf_Lm8Wj;FHL{*6bI^w?*gGXWCBEKw2Sey}#gQ
z`g1_BJWjM^xS$&044=EX84~dmkAv{=guXT%VVo|mDXjmF5*bB7yrm0jQj5P&&ky6{
z59FIfh*iJ`KE!3vS7xHn=+k@t#6vN0%?rO}k`JWV;H&(SPO`Vk?AH_1ms(WDvjq`J
z;<0M}p7kqS2Ehonxvk(d`ggv&`R;8ylga9t?+H$4YPE7z!Cwc14{J=S>EVJ%g8;8h
zP@LifX5*7BfE}(^gIi<2Oc<vHqkL|-%|p@_?Q4X>w_M<PJ!{r(jtM|2@>ixJ-$i0j
z5?GgPnk9PAsp#{$u(B90gaoJML?-^V7Y;r}9q);FOfAHzml=Y3(ygl-rPxy(c$OPQ
z2i@I=ooQ2jEdB$;o)zhZ#Ln*we&S;BT}>Y?o4-g0IF=nMdsAU<Vw{v6<3}j73|g5B
ztdp?r?NRcZ;b29K?8ufT1+2iZjJhY<{jTE>4&Ds<20y}of!F57-e&ji9j)6|uDzw-
z)<U-LrYVrqH<b>5(tvh+aV2H@q!zlG+w*bPEd=tm%2-thy~lIryU&C(sMA6r#KA70
z$2NEfml!bRLRKS?EF5tb4ViZ?UZ0a{lKjEk-En>%J>w&FeC{CgR5-q`ZmPV{4tcO_
zyZm7jIxvPn_g((@w|L9jx7TrPQ6UD$FG@1PIn>a-!a^ujoS0?U989RVR0AW#7`F;G
zXBSd(cSw@jxxGpOoMHl*?xh)$VxcJSHtr-Bxnb29LNOlU=EoAZocVHX!J9vHoth9O
z6z$Q5EO8@0MY4-s#ph<=h+iG%SGPiCXDa~YBsZ4^5bKnFk<X0G7~&^z1~m2;9y&*k
zw7Rml45S?DQLzZ-40gY+Ah7!2kz>fw<zjTiIt@&J$Zu`J4O(4ViAgD9X6f~V3Y?KC
zaotizBy>03`PQU&yzF`XN^#kjUSM}pJt7qYLWV9;7x308uD65FsP(lBjDyZBmEFOW
zoCHb01vuH;K8K9lHwLN<aK<V=?0rkeVG6m->!>5SP{3&++lw^>pKUQYs7rjAHds)D
zPjemKdCrptFHFHwteS2ADOk;G-8yniV{->|m?bEqs{p9tyDF<nK#<m2^5atrSu|h1
zEn;z6mN98^15u$ZOhGXPHcdqD-y04CKdUdUdxGl;cOjV{_6rHD7qE4r#Kto_|3rac
z{cOnjR>I63+{zR#Hsd@#0ZISzax*>&LH~L5`M6DN0Ovd^X~58>ibb30ivq2gz4hnx
z)rP`#O?=X!nMdS-vorhvlDIt@&6#JfzsSYyU}PR{x4GTxgpU^~X9{xBw)GyjDWi6%
z&)@fO>zq(Sde@GKspNttEuLrjm2{@@oKMrDE#S(T<um+G=a4zf1)9C)EnkpB{4;F(
z!J1h}TN{20^botY$m*--)xq3+RkV?HozS0vGd`}Ew3ojV%mTw3&D8^a$K=n?QEFEO
zH8qZSoyQj>0|QygM8k50ol3g6V=*mtitzKW>`SQ7w#%2v4OqujlTukq$k8&N*XIl_
z_;=TTBJka}lZ};p*K_jLAmt{)-i*_&2=n-oA$L=;_j^O=MCeVF2&m3Tot}#?t)$88
z?d{zq?&-;!kJPz`l;{ivmT76=j9-n@DA>_|E|wV9c6xD?@MfE}yV_=pd6HV1?QZjF
zEFctYCQ43?ksH4@eem;(Js7ueJ=vYEe{9T!;eQUe6!@K1^nxQKewFVm4Zot!cuB1%
zb=pob61gUqkvG`qTHCul4Y?$8UNRlg>1^dbqd&bN7jQ+=@i(}7E%|-Z=q`4t{>HA>
z-LX=8!&#rS&6XfNuYY&S|69NV@ymzf6z9}$tVWGLOI5ziHX!5fNOSoA-ldNZt^Po1
zD%SZj?{f;RSSxj{qigLIZ<JtbHCuiB!fLEj+V&DL^%$STK0MTZM%ixQBl+@hS@(9o
zl5|>2Th%$_!M-Efutdi^CX<PR6j<&Wys!6AJnq3TD_{nDQO#Pp*=B0jEP2_+e6gkH
z<mF+NIeGlFYqxTH)JgBCX3*xkded%60I{51H8}U|g4T$Z`AZ?*b26_5S2z8w$HGl2
z&-ZoQr%mGEdDYADe8oCE3C&(x%MNOazkb8GY)(*;R4W$Zg1yN$`kv;{EyML-&0R&p
z`s`QoLA&%r{hn>+IlrS-HhXbR=Iou#*ZYGEyIPfM)_9#NgM(G&%thSA@^d@QRE4&9
z=A}L9ANa<rMh!V0G9}BX(YGRYm6rsas|pc+6JYih$|R5J`~#Om?T{n67kFH5kMu(y
ziaD56y)r_+H}I?$`QG!plC<dKMSZC%f3oyrx5{qPYu812sGe=uACr2h&oD%+Qd_#D
zDV#iODAX)#!AGqmU0<-b2}oVq)W<WoL*#Fyen73?u-9T!JPg#9r>7KIua0rqh-DGf
zV>k}B``H;H*|a>xD`44)<gk>s;TgK75;0aySuilTh$+|Ov7}wh@zt|gcadb?sSeg7
zn@v#qZnoqj3_6lpU5S!f=UOW7*1esjo<N%kHT_4i!ig102fQk^KCNB9f|B7n-Ps{=
zyE1s&a5<KxVOcXBbN0sU3OS~fdJ~)$wWU271%q_-lK<k8r@bg9Cn=N)){wX>@n`a?
z!YvB_%w-#0T2x~|jq=m6Bl8KRxa3K#Ks^AF$?CN}a4<ZNBWii8eLrvzqR{d)F5*33
zz*zEXEQa94rI3lN=X7-prT3!xeT|2HQGoWwvZCa<{?4`5b1L~c9GUiV%zsqesP!M<
zlb(Q2^9b4zy_N=(wV6|5O%g?M8^doO22*~Y++Ls9W?WADjae<<`!dVp<x^HY72!6F
zYV#i_;<}M`2lUQ-x6+*+GFSuPd|K;&0WkLl7p|8nManXFibE{oF4|h8I<Amtd9ZU^
zuSnV68;9;#yE<rJw$iGu&PArc@J0n%?$ZTD-d;PLnApW2$a?5vVSsr>zD#&sgUk(b
z-Z*csDI!R*LjbvJ_Ydr@?d5MW9~dSHP*^`9>VHeJpSO$ziDW0@@AIn~QS2`^(zQ~F
z_9fq)))tJMJMfs*<L~e99cLC-gOXrQNZI#*O&<~fEnkoN2<TjizX|S<mM@_4Vi;zj
z$Awpf4JyvWnmXGLKDZ7%->F5gEPlgLY>7T~W@$0_u*8Ck*LHSc;ZKY-m#@t*dgdWx
z&LH{QHjGOX3`=hR;y<~4bm!D#?KUy{TLt!HL9-?NjY*RoP*<jt%s2jp?Q!)RXTC)I
zK?cFZ1OhpRe4!^GDU;*v&OIQPb17)r`X9XDK-cB6d%iqI{M_Eg&esXubO+KrdI*}%
z2Ma1o{qcP-)}_#q(%2T)g3<m?;{Pgk3Fr!+ib`eMT#LGYM_@vDB<Tc8{r_L|`(TB3
zcNYj`3qD$0eD0a9>P8bGtpYO&+F*rN1DH`bz6wd80xR%&!3umuFudUV4_*L@El>NP
zK#(2%!w~*43YuU>;R1|^`~kxYrguBGIkx!!e})$R`=$*|d7U{n*#Dsle3u=9zox2!
zmxs%r^7h8pRi&HOozWuRN&lJR{9tt528Lm4=*V>SFRmR-&?VvjMst9S{cC$KxE-2=
z$lyfaU%ajiYEc|p5(!`8Z=4O7Q<NJ#4!}6ousfLG*z+gj7|~v7F#@?<$On+-w3Fqw
zR)${g_`o9C3w+QWZA=?dSLzqF=L>W}iClt-gRDDpAV?kTqEfJZ<-k2uaMXH}f_F~t
z(Fp!=N?m*l{ouIxA4UdDcQkNA3&^}Y1WrE@B8t%3(cKFM^#^W=ox$b0ihvOjYl*ro
z6*5>~#WiK1pmTrE(Fm9nlJN&aF8`n4kH29of6rw;%NR-<Pj8Z-eyHg7sHHUk$NpZ#
zzc>CTstkKnvn8752>^%IH)g|6V3f#+aw!~06&%1H59GiV1Z1Y^2EepA>hlDxpW!)k
zHbXH@2(SIjN>DrN0dq5A!%5m-BQg#lg#fA%Pv2!7ldlb5Lo>yU0SjHPPdfj*4|d*+
z>i*!a8IbpVFfdrC8?}eufVQuUMX&yf!^GL(UO7bcvc6FjMc35q?R7A*q=~PF5FHL1
zIk!VZfB&lqvVHnr)QFx)t<i0a@b?z1+~{T~#>8oEa&|7<nzo~RnEVgi*#7$MTUQio
zzIV|NWUMW|qR+Gx?Ccm(2zVG6xKZOLIO%5jpWX5W0f0&o-<@icuVDV{(jIwS_b0lq
z`=u@L|A{Gi=4I1fLV^aA7R1?4`{Y%bl++PlwOJr<Z9ZPrX5U%w>my27R9HPk?hG9X
z-G$_URzJJ2)(bU?y>@%lKKBySy=Zdl#z^MEcbuF0kX-uinLUKS^ynqW?ryX*+{)9R
zr1nP{_@dso=bbJ61Pd~N5`Amz%9rcT2YPsjxf&+ng9@uhfNr>KiA^LAJ*r=l3h#1%
zW@X9_ta+jdrSr_zrY~FLr=P&8OJ1B~e`k#QMcmpy^}#rBNLpH9<ehoASR740$lX+%
z3E$%&)h_-5)Yc&>V!lZYKW5c|Iixv(vL&wcYH)7R2mL<?IQwSW%8JyuuneH0G8o9H
z;Oafkh3B4BMuroE9Vbqg`2r(z2UJcq#>c@eDeYk{{%<&rcEL5-k2^gkT%!k&w@XJ<
z?Y@z7oISJieyY7}Il};|S84u|pOV-u`Z$g8dTgpODYZ^Q0A6_d7^&Ln6;2?(i$w3>
z+>dz54-@oY&WgIvsbcgw;wx`vdhLes^z1|{0+?-&|0ml5M&jV{5k=~2@y`83|D&w(
z@c`t@1%<!#vfZ@B7+)Ov1(a3AzyYsy=+5Qkjfh@8O{y^^E66VjNy(4ktarN-<iu+L
z{nx)S*&_v4o9H3C1!uH!LpmH4_`Hv^oKB?Nbken8d?K=yOJDOM=V?H6MP$z1`r$^t
z^2+sozeMJAZijBLpk(VQxrLbr(&kv7m@qme4)>ADPP8YbDI29Ucmiu>?jA3<bk?*8
zde>sDv~<$@rx=N~|Mn|`^;&;6!WH1#<ecb7Flb8dThhO+Ctq9+WUmKW{U*pT-mImr
zHa*x5Dte`18uNV77rX)NOkNY42KXLs!UeTkD1^U1pkeG-BdE#kQq;_CyMslxjE8jD
z_KL5oKPK};SYc2XHEP)!B)-VQ{wk5w+S=?rJmnZmCI*df`S&Odvycn4<1!MC1^6LM
zdOe^^3jJMQhrGm_SLP<~p#cFvU#Y9Z2Pm6u!|tGK>zaZQy`>@2qS>3jJ*eiK=2Jq$
z6&04eF=KW}I0@h3f{Sh#fos8V*I;gAy<_ezcnAigt|K<|=DwfQJZ=o2s<irPnbrmV
z9JliGL#n=4w;;kB5Um*6kJcd)Osk!H#x}@dZ^`t6>KZD6Z#4`jAaDlkR{C~i1ZC<|
zXG%;aR{(3-!&()va~4q~>KfyJzPsolB=l4*m_4?x^sg^q$3ti;bC&OW=&M)IqZ|lr
zmW1!wIK#CWlv19b`lTF|^sn_2;(A<uopKy1NV%riWIdS*i&=4geNqbO|CaVu=z}Y!
z5k){`C0?`n<iXMgmPqL|t@ElkI%Sag%^L_1y)tLFTH?AXYa>D^6n*1-_nm+zrQpX;
zEN>O*eN~34H|a1kw?KtkiW#XQ>*3g2J~yx?Q@xn(-7(<otg%&Q_M~8BfUmQ@VrRz9
zySeZS<xAh`gR#`>(EZvihQW&@S7ji5(|`?a_)W%3g{QAPr(`ica>6$OL`{#)1k3Df
zHY!dQO{N#b*_crtMOEO?@#Q7<lk0^SynCeNN(wO{|6YUJn<|`x4<F@DKi8Xo1n}I3
zT*v|2RF?d}WWfKhbHJECzXAj?^<mLxzyIeqWwo5|FX!vxd|r5wt4JC97-h9pyR^Z<
zUTHH!v^<XVo?ol?V%l)H&?%_H5rc`U`m}=MPQuGrxOnnLC$1zlM9*~-Q?BAmd@doC
z+bJ5I{}$~{m=h>|k`^g~Ovf23?L#|K3cMED#JUt9jopsmL5LJ{n!fP~=n}U$+X<4C
zMg{az9G6VdI9?$MEhC}&m}_U+iHtEzn1>m+1=J}cb3^&nfY9md|DuKQBR-TU+^Sd>
zDf{{$H5rdQ6JEud20do*`zLlGX`WYSIM`4I3B4ki`7K}tW>;5(f@Y<x08KjDKbej4
z+EJ=V`n7&UvhlLVYnOYZ{a`NsWNLb&Y<J%3=!4T&F6P$MoZnfIwpQm*e1zgFKe?0r
zBW98Q<cQCZh=D@-S?m1*KZ|O()+eih8-Yfe_9TKUfkL*z(k%RXMfibaO`AxptpcWc
z;n+ieVRh<v=;=!D-~WTUv+j!P``dGHcXtc!?ruSX2X}(IySqcsz~Jr>0u0XJ!QBb&
z?hc*ruYIIXyW0NS7jV`ZJ9GBlpX<JES0_7!Dxo|5vNq(qU$$+BMfnS)yDY1qN;gvf
zoHHwXYe~-!?Bc3+6T+j{`(w6qem%9^l?e>reIF1uhl{bz7MG8p?$nG(Si`yBV{Q|u
zQ<FV|4aupik!9%B2~StVzqhQ}P?3eP9=yTgYUV<EOu|JqGvh7Ja5K}X-3lqWu%lz+
zU5Hg4AAh{9K-xjVbOADLd@Yx{!6(g$(C!pZ@WUcHv0?g(Z04pbW#3!+&C&F0b67zz
z0eo02J{iH#?Jj)Vib#RI7o<8>UnVwPgPb*ec;9eh%OGp1GoAg(P@!Gg`9|-=y?}pa
z<n+v1n1#)#b8raJx0PM+_zpTn@)o(2O=K>5Fv3BxE@}2>jZBBF&@uFh)F+<9x1@X)
z`cGTSH7Xq9U-@Dk<ZVsmBEI2j`*lxAUpT8*GA878hVU$}9Ed$ICAC`=kWTN*T#nlX
zn|ksRHl-dfEyRIaEV!CH)N|+zJl-l16++X1+itL>5K@|hr4*`aq+`LO8SE=>2zPg6
zsvB$J>^54>>TxpEeQQ>tutOOI#-@b)b|qG@!or~|UivmXD7rEUzsRWUXocFE1HFj*
z{A(VyH=+xY#h<mOW%UYjSeOAe{mimvfSb<fkwFTdTBc8e7!b=G5dw4{ZHZQ=!~?$+
z2VkfVJP3;KkIqPYmUh`zL<6K0MBf~qV>T^qqK98uhQGCm-7!73K~hO0)HlmXQO)ad
z@g{V2iN_(|=eGtQFU-aK1w&<;w8r%0Sc-*Jw$Mn7NE+u5ienR|#qBWeP3~65q@iM^
zyCFM_yApBS-60>*8z$LFk@vaI)l+W_X^`9D&cAu*3QB89?cZ)uT|SG~;<TmvChxo8
zHg9=n=Kl)7ZA(RDLQAC>8${K*@g+B({ZpYIQbF;1ZXv(46c+_-L7}j$!s+SP&LWiY
zyg)B48=988tEjDz9NpxSvZKv1pk*}?pM~K(bgYt`kCeGZo}*gN8Fn_M#~pAfA21tk
z$3*;Ke8R_5f78iVmibf+8RyZIUs{PsMkv6>(=9RdKAl|KXVUHE{=W}v|7Sp2my9{M
zyPcEx)ZWDBnfLYag#H*H*b4$dKrE9OxvqAP^04Xp!B}WITg}+Vb@9Z|78DHI<$$ED
zF(&{>GRr_sgVi4oTQtsFNy36PX0oA`Ckak%t0StbX{E&aV?L4mt%NqsNB}onvU6Av
z%eF{_Cocf=t|RCLra3x6lN@VtqxYx!*5mM?nS1jkuF~KZoe5Me>~a8@-H~LaG{Mb`
zcAm!rDXv|kH}4nFk)+I0D|q3UAVtPrM3LBh<yHym=@C3ktz^GvfjdgnHqb0Eg#^u@
zU)RC(3GdRE0t5QC!dRLs=GuzUJYVfFw0OobHxukfbTJ(LOtcOQ&5+{3g4d`BdWsgg
zSdCvH1u<OO%QD;UqN^sk&nh9P`ksyAbB%`Q!b_USn{vB2si?8hi|o@TFzVy{PW(p^
z0K>}lW_<1=ysf}1>QXHT^9yzDJkLn2Ftl@?*{5-eHD@PrwI?=c|2pHqG2-a7HUbM9
zH<9}x>nbi}o2A->+bm?fp7Ux>(k7(x{cLT!07zOSqmIL84hmzl2AIVVA?KYp=uYcZ
z?b^=Z4dtb6Io?kA?34a@wA|^Y=B}8MbA4d;3f0|?kcY<-c@uimLlL_31=XD((x(3i
z@uI?WbflxH>(`ijJgv=RZ>${C<3zh^(`|d9i6!A4zPmRO^N5|fCnt@B7``q0&}Z(@
z63@*Y4;V7brP?^cws%A&qbQlPUWVqDVk>WSc(d)ZK1${b!*%@uw>{>}pJ9dHt$war
z9kxs0g{p<R&y$n#{p@{rAo*VTt-8um^#?wDOJ*59jtxxXHwGiE07xeLA{BN@P?pOl
zPm;+#iYJ&{!>eG|FEni#X-UfIy)U~kpXXR+7+a*@$d4nfVV#C%h#RE)=45qb);q~x
zEiglm*(v5UMB={_h9el(BL+l46c92jlXDnM_T3o@L-$LT%qbiD6E*o^PWCZx%DfTs
zW0iZf)+jPaELPzIILo-o_Et7}NrM$4CndC8Y2w~rp#pfD!*Xg+?Cjv1)7b?45fkw8
z3SBjk({zKLHOK%DqhcSJ?TOa~0h3O0kSzF-g<i%G*J-L99j6G9nL=?21eT??{g7P3
z2t)j~$Eyv$=xDp(4NSKm;w+8a!gZ{0Wu)vldKsFMu}N5KLF=3tWJA*ElU$n)D#VBa
zmi2s`;eVo4-BL?H`<{5;TgKHs#N(3D9*jN5Fk41^E8;(EY*7C`n7(O%moQlrYH6J&
z16e*jf-MnOYTzw!C30Nf2OMtOA>8vd#g96JzBFx7{l_!j%$NRc9~VeW%p10R&*s#C
z)#N~le%9{ZV;g>;@@fL)c+0EP-xG*uPm(O3b1IhBCyLG=<4Y8JInn_kyd7Ah^<zz2
z3_eKP&c{QpV1JS+9J#e(_|*~J9K1)%fq{cmoG<+O;-t+$wL7(stw?@D0cJ+0uyd1J
zm`LGwTO=?4aje?pIyPl87mHti7vVkbK~(o9)T=+~Le7?VoLWDkT~YOJx7Mo4u9jOQ
zGLXqqUX2MJ@k86Quj%(i$X5nQr&$Gi(tKRQMZO!>-v$Jkz%Vw!k~s=&<CQ6nF_b3b
zoJMc9b8jj&G&Yi9obAQ`UV%Bk$dN=es7749#t@3T5);#f+SPBfx$WwTxuLaB{#)w4
z<9boIo%#(jE4-~!IgGCR7$q@Pt=b7@V^HHvm~UxtCNj6A4a($1Qacy1zny-)e4S8a
z{bBHF3KD*a`j^Ps^|i!ntdav_Q?)3b$H$H3^VH`e=itt~8?PhV_^DnI#X!ZOa8Uzt
zOM$`oZR@agpouGK*W}C5n{l*#!9@eBQo9hyK|zfF9T&8)8-(P0Xm651H+9QLI+1K`
zg*TPV4DnYAFyx4vF<mcJ@$08)mU!`M7DcV!kJWE7j4Jjf>PtbxoSHyGNu`w4=%h2q
z)-L7UXU#*Kw3#6nWtHbUZte&~Gp98!OtOs6R@9W1IDTYMzt%mz#che#qxH_(Qs`S!
zc_DdW*gz~2#jm|INcWp;exnO$p^ju)e#<-^+cr;v61w;%*<3j&bp{1oiOjcC{CWUQ
zm-wqEnv>?zdrJPSBRnm_x86xk>g<ti-4l1n9&5Vem-wCTfR!qfQckpFrx-+h)*diw
zaVw!7oWzllYx(nMPB<n!O;1Qf(JBM2-0~#(bSGiBn&-<=&JRzEo!+aBt>i0&5oStf
z7ng)!O}?$X@CKZ4&9LW@0$WcgeIu-*_De#gk7eSPs=>pS)`;j4Unh<mP*ng1zqiZj
zE+F?wxA#E@FKlN%it`DAw!@*&Sw>v>JIO4H@|NX60^B&#TBEkQ8|7B7H#ByFm1hCA
z8x`{s4hupneo8eKg{s-FeF}YM{Uo(DsAzeVpZR2HLQ0#9t}Ia<egsz;EL)fq?=C{7
zlIu>-VJNlT=aKrtaf+5^d=1un?RnDUDiDD9j^ueRm^AsQ+Qn$T8`cB#muiIGZ<H#>
z-q-_zpy9}<(9HN_xv3WhNXs)!RbCbljW85QjK244LLb)=bGla;OSod3i4C3}C+~M2
zMajkn>F!7fp;(t-13L^FogQCO_7n2UXzd8&f1cx~p7-FxtR1kK1R5+{`8Tn|8!mXX
z^4~=@Z^E2yB7c#>qF?Nh-;%4|nsLhIe+}p?av@*1?6WopCsSVgT84@s85|#RJihxu
zo?m$;r~M3uLnB4!NJ>+WI*wpZ$YbU;2Mx>-WPo?(-cFE6h5WxoyCKc8y|`Fx_&dvA
zVAkT@!CuIf+4ZaJ1~iB7-^oK2ZbZ&S{X*7yIow#!QPEGD{3Y<ND#{=h*xH}d`4aEZ
z8|RaGFWFpr)}Q$kwDd)M2}O?Vb^lJly0=zk)|fonGo0G%V`N<68c3RDmMJ-}r@-U4
z8p`4k3DTtd&=uHP63uiS)C)U&1?UStcF6hJxw=CWIP`0Q@xHq!AAR?RaNjli4(r2#
z$5Y5sJ;UDBVS*#~S^Ypu_f`@)2c9Uu(!GJz9}a7Gzru9b)^7@Mz{LmXC>cHL!`K-c
zU#&eq;WbfBe^CCaBuXa2jUzs;N5iosXL;s7{<|hIb+(wPWiPh&fO$VOmZZ)8m3pmr
za1gvQfvf6!n#*t*?BjvhtCi9^=g!QjmvD0-JTKdj)YT=NnYo~1Y{$=g-p~JR_^xw!
z{KFXBybkOzT6=~ZY)!*wX_X*e!>Y^FZfPCN(OaGJ0E8LTZF-Lo%MJAJL=D+;*)C~J
z7SK^ZLukdY3F<(IRw<MN(oKBT!y@3e>dAAL8}j>~D`BfN>V6I~E#*1)h9=HxQ~l*p
z^?@miulQ*F@?B*)k;{`a(~xnGr_>an)!B?{@}kZMXc$^=b9N|`0DnhVHRqfKj7_*4
z3`I7j2wM6~o7tM-(%}w~F8qU)=b&eRU@q6VL=CA#))@i-tu6i)K;+bTBRf&1Gq$+a
z(_l1?p6&)N$yyscTSfLvzPja)5&bIGS&7pYz#9#UoW^lTi<IdKs=P(l_A1VIPXM+{
zpoYsQ3>0Xl?g>j=@6mbr^7V~w;0$)>ifdf4amg=RLMYIr82{d;8H@8%5hFIN*)+PU
z50uf87~u1)IR|=GAhj?h_Hk@dmr}n0cl;nM7Uk>7i+!WJ<#!RsxWD&2r;^MZ%QSEq
zhFYm_zdaC<t2C~6N&^m8wE$7B2SS$}{y(32Q-)W;3;$x5;nJ+6L;L6(r2=5U36H~i
zM|3u?!}i3wub1{CgunVI`q#P5m?HWyNcE(bX51QsP<+RU;Bk60{QyDeRtYe88_?Ka
z^NZBsK2w{ar{{%hDa&`;xet0?_BQfTM<f7zQr!U-IsqA=b}m2oE!>!SDOP3(<;c2n
zlW!AO5~>NdhLn3bEya9|OCirKhOTzxsI;}Uo$7!84!XJ`yE5D4WKxMVTDwE8JrGXf
zeKoJVDJ?{bZvO8`ak%|3jex4E7oJEdI9(Y+-GPb7HfI#7a9#`4o*Ig#;W!4gz0T%c
zo_KSz7}*mjIv+32Iz=<}A}ZMYKroO2>T{32a}3{u{|L^@>V>Q$<9OE5@f*2+Z#)b+
zgY!V@j^f;4;SsGO`iF%S<E3+Bjazf@pJUm}Mj=^}6<;p{wS-^1{P3P068cIRnq&N_
zQv)-9d-~fy14Ir&7mKRxmrrZ#kNH~2m%~MdnE_gZ5kRDeS7Kv}<IuSbN0s{mVr8>+
zClPWevo*I<_qfh>6ulF87u4#{f=fvWo8G^n;_QW!AIm=tn17>_zZv+0w0oMi@}RtM
z1)Xq?P@W5r*&8PpvLftnpOgA*;c49V&NF6uUEk3VQ-OACrwrV-hVvy9)YiJC99V$w
znuI%~SN~ZcqZfgvBw%jp7thbheyk?x^qLpgucPj&otf>b{%ic}#AaFd()M{fhLwku
z7nTF0*&<UMr)soNTiXS}m@-B(VN$@)=%&GR#R>AES@?b4lY*6%&4fUVmV1frDefe)
zcy-*2sn086F7?C>q_}+cc%jv65~(<Q+dlb7`YfIO*i9!9E||)Y<D044D1Rns7U=w+
z6iF}-39|KIHqT=vu(hx$sHO-l`*KZWx+3iN>r<%E-8zXmrI1Nj_KE`YF&8@vRk&9o
zBS8&7y&0sRKDd)mamM>^*gI8r9?J}av8?A9ZJN<!id4Kyr0G|64b}SL-z!NM?E?CZ
z5^};T!uiL*C#DV-F|I?2py3@tLcA!hTcPkj2vnanlx*Z8EeK(z@A+hky;R5#(nSN#
zroKr*XD(68c)sHR_|HN+YNc&hd44g9KV+Xcd9;QM;^0IW$xOF@5T|h9g!Nrum{>;I
zhWjVEu5zfiF&23dT0k`BGa<__HZa%?nin-*`cKE+eI;mfW$il*V?}H~_+!FIo>EoM
zLL!aYSypyvK&oAMU42V2zDImoWN4N!kh)}G(Iyl2ML;w9%Sg)j;g6a>Y}zhRnlv;{
z@JgVYjzu~~zfYde3H?*vCGuetAys^?Gf<PdmPd}12pkk`h_yXq9K;tDSoI=C(LJuT
zTdB*)6><C?&EIZ_M_2?v6yd~Ayb>9h99!_Y&v`w0fkFsou9WKF>G&38iR&u>DYuzf
z!h86qfgfc$#S*I_3G7SG8`x6yUzKOw;s0U($~ASXVfL3OjKreM<&tb}f^xn<0_HgN
z6y5X3VbgBz9)0Q{nXSptA5vLH0WS4#uGeR3(>k}cMP9O9_oOJD86Qhcb7w9`6xn@=
zJF9VLa_^F<Kgzod)TPdMmjlmIurAQgPNU1t7}w;(a_;EA!!7sRO$aj4MfcH{ssIjA
zV=svn8_dICmmv*(vMKYEqLp-4G3R!Ebqbr3aT|y8^&G3gsri#^CaXo5*V5@_*7}Ow
zT@4`}b2&-`-$#P@98y9^uXoOto$DK-WzSNPiS%sZ7DYow(LO@d|F%qxs~&p`J#ak%
zXm@t}AQ$o2n&d*o7b29d$_X<}6dI!ve^NX?m8s`hy457&sv3=8Tn+fEU>T{7HBkr;
zLx1di{2nZlIS!iP&i;Y%UCNvC^ollWAzGbfk?MI2Cd{%$d_<E8zU_){3^(wlJ8=u~
z&QsgSIXidBO9zoD@cCm~IXEr_3$E<s-0LIiW3koB58n(6vYGtU8+A4BtJB%r99{uq
zEMK=Y18nA0lbmdZ4f^-fU^tZ7q~W<GHRbJZ9jrpVjZ>Zd7H?yPl+2i@EQ>0FHT?_s
zH0icKu1*{myzG*uN(`ET3?#B(<0)T+uuPs9!u%_(zN-LQA{<KQ@kr=_v-)RT4A1Wp
zct~gB#9n#=K`+VokE0*%sPx=BZgx4x<Pz$dTnQhE8|ZG`n4FmW(2_X7!=sSc$rTDc
z+T03Nvj%#oW*H1RB0P*b4KWVQgf9w2QlixZOmEDDH3QsQL|$uj197R>t5~qRj3TcD
zcFhY+hO>=MK!fPL5}YV*2BrWX2uDU<{R!KB3*_;K4r(Qv&`n>mL*D#g`ISh)W=rF|
z1?c&G!tZ@0@V}i(+jt7M6GT~n8&V{CR}{IRAv>N`20}+!&8P#G0v_g1-Gs7RP;WI@
zZ44JMePhf7%&zj~dwpIQ`@!X742tz>|1AG@`$0=@9BQUHCK%u1U{IXr48V`+(icbX
zULhf}S$P{Qho`(K!68<+^`T{>IH$cc^!4`MEAC)p*sqgyy$gJwy!}V#v{Z~+KT!OM
zs?l?F;t{sNVAF-u^fV$VuR^&#=5Vwnnx=X0@&XLK<4Oa$Ht0K2(<+R5*z|*ZkETX_
zNo+8#6L2)0C5EDO<4k{+(@RHvb)UyL;X3!2Njf!_>eaD(;IkeIk3O>K@oJdmyjl7&
zhoDBN-mT#Ki744n+BHVa)VDO)Y@;#fqG~t=fr1kf5>9v71+c9!|E(-$`YwJ724lob
zc+0N_S`qm`ku$t(tM;-@3k7D@><})U;2;!;=f5_T6|Jqnti$$kL|oX#S!63q)jQQg
z?*8sBsiZj9iqziy8r1#1j7@(rcm)5`g;?2i4c)CyJR5KMULKF1M;2Q2Xc|#zEv`0D
z@emT4u2g`Zwqs!C+_#?Da->_hWA>ycUbJSM>Y`9kpQUSX`<(mc0;>Y*Bwlu462tT)
zVy<nSz-DYYzz=$rY=V-d3=07L=s9+{g8i^#7)NVr<Yqg-;j-Fz_h8~W0()d{r}T(u
z7`f83yG``PvlR-f>)b1+FVA4c6YQB^jS+OJFS^gOtf*8CoJF8rYh-Wooh-G3PK5e;
zdGd$RO3ThPau~xl<%hQ85`NAg!iR*CM(S;cc-#=es~cqku>h6$N#-1to4x8;`!7GI
zwI}v{pd}DW^}y9j0FEM(xTChy!j`mmfCAFnfN^OBWBU$VFba4tZ6j+LA9rrDfz{jn
z)Wq3#2>gwcG4Ydp|Ln6z`MUNq+~lDPD7rEFaNfFhj3+g-S~>ELU$(dr-)6?)bL&bk
zZ;eNbfhReEUn1SjhOrO$u<bjM+bFh+1oLL*TK$XPQ1YGw@=Y<~aFaY;>TDD6yDzcm
z<9D;HsJ@kb0jaqN(5+v<OQSF;x1xywvy{CD-}`+AI0t4Bgg`$ZKNC=@e5jiz9Z*hE
zUE3M%=8i=a!=L&WmFhYv+Az7<g=mI-*WfO~_K`ELs$9rm8Js|B1|-j@vNmm%mccNY
z<(e5Q#c<!B+dGO;;ET)s5}jBzkgXDnGNeI1!)VjCV~zJiy_l`*8JfX7@KaOeWFUtu
z931&VUC2rtc{4AeNVm{xUa4T<h<?5mEXX}ORc(`x-MqaL-gwE1U+PGTk@ZBQf9E9a
zB!iO-$x~!Yvi*(;y~<C1uEVJrMK=unoWWw~EBtBtl5vT+QQ}zkxxR5Zs0#D8yA^fE
zC_vKc??YHEj@!Ob#7}eRzlrh{{!&)ss1Xep!fq3zKzcAWmiVQfAL*vQr9%M^X9mZi
zG!w?1@GokeaoRv?%6QScGoNBjZDBwJJUqX;i1>-`CRPJ7DB$WCtlB&U+cp2IJ(a5E
z-))EQRd7WgEzOSG+vlVorYk!uPUL<v2mI$Xf|C}m4Za>9Lc`5Xg?I`^wkyAvj0D{P
zcSrb3)$}>e<|d2vfk%V}fYov4Gxqg~Sf($+w8Sn$zYB?8e0_O4U?WlFvjrda@I5zp
zu6q3!?M|0fo&7^c#viB8H^4~Sseq=%h@L0FJ;B}Gcxbs{vcu=AZ$kE0=|z8su8XCG
zHV;@lq=N>Ty_p4H&p%XHO<XHGRc`St0cQ*?QnFDGf0Co*10$tj_9kI%c*EA>SX?KG
z4)y0$vaMcV2*=+uTbN3jtB|e?p0g3OPcyR+9QB3Eh593xPgy*a8k_$J6GgCw?Bm&C
z;(aena2S9ZRsQo%liSl9;AHJ;Zs~m%Z>ex_#MiFn8CL=d<K~amQvhV4Fg0?xQf9v@
z#Oa;`V%EX$4eJb8PpZ#{3fZ1OvRVVjh&C$O%n{S8hXG8Thiu5YE;O4ZbLgAjp?H=`
zMMY`>r5%jM)pbhX!696ou5(<3$2nhiE`n{GI$8Ss%Zd$-aGuNDcC=s43EMQ8N_Tu8
z8DsxYmzep2tJyCGq<Cv<-3&iJXC1gSbZGz8_x89k`IwXv@<34t9id(8bJlrf!5FpN
z(_<O^U+t?t;N0Z*lhMc9duEXYD_Iw}W{RH@>eHOx&4tASys0eq1m+bi1(PN`3U~L+
zgaYnK4b0+!C;L(D%qwo18PAus)i5`N>(>I6jk-Y-*AlxzrM@nPPQi8ax59cx;HCa6
zu@Li7MBIy&gJdgL(68PD{r6VxPW0njc8hB{jf`%|Awa>&`=91w{PG&9q23G~tFZ;@
z6suw%5ueo1?MjEJ`&2E<k&=Lpl51ffK<ITs#iaNRSUqRutrv7Et26wkX5euf5>`-m
zngci%?ID<rc{{IB=${Z@Y@Gw{YnL>mOtR{Lsmrre&8?dj5{gS$K|9nb{MC4qZ8LVK
zxwD+YBsBI%+WY|-dgrYCbq=i|!oU8HxC0&A!ZYeJnqi@{8%(yKtv0EZ*!zy`u-`3W
z8nc<U&LQoOh2Xt!JZ+Mw@qp`eH)5QUy+eTd6uZkV5eG8&w?c5B4YAE3dtf>1NJht*
z8#Y7ZmY3fSMR+l$rJM*;jd1tV&y>09{2PCkP9hkq+#l8_&80mWmN366kkP;;Wd;Xa
z8Yg2{9F{dbR(*P@0f(Vc=LgNAh8tln9nir_i&J#^eLVbq%;i%)LuBVIB4QFsN&>Ut
zypx7S=89h?uJjsg?Q>Qts}Q~GTrMA{seC5FB7YA1sV3Yfn^&LNCHI*tWfE7|z`Qj{
z4+mrh%PL<_@o_~@Cs_E|9Y?CjP2>SeO}+8cSji}>qH<f3;)9~u*Ysnm$KZy&vSQH;
zurkj+qGn(#BSZK_Q26!uY4k+$>kFY2T$;}sU}pwQ{Jabz7E~cLQoD8OrHtI!<*T0S
zdqW(5P#F+d_n+{_XZ~Q|x2#dClb|Q=gS%(3z$tQ+6L;5;Z03rqe6<|z`1qtV$-u@&
zyB)I3dBB)=A}(iwku?;4`+#RzK2t4DpDAT)PTDfI`TnN3o4#n~rW4Gaz%|S!Iu+I1
z%Wyjx-Rk=@MZKOwae;hr60Jr4g~Ch;0C*X>^p#p!CEu6huT(JHqDb45{)U&XQ?G2W
z>D^|;wj9$jrYPiV5Gj`&GaQSIM3tBHK?n6fDkNcOj+b6+Cs%S$TH!@nvj;<0bKb|{
z`fF^<SxFam`W3xWL1B7|7mgkSVH)x+=K=rd;e1EVfuN0Ma7t6=!u$fcgnCfXNEq>Y
zqrg|bhu;iWGM2<wT_b)=8ex~oFj%A3p9dx}DJv_wBL?=jpI2<lc&IkUtnjw<?VMIY
zVHaNPEiY0tJ;ecYNwb|#c5K{lu1Z;vW8X6JA1Rz02d5|?L)k$5Q|eEVFnN98L&k&+
z@FC+TuyGw4EO7qMfGl{&!`2LQ^+?<Cx%Tz5Akp%RIDoCH7~v)+^hE;j==#O4uc15E
z;9OW@?d6Z;w)UK|iGNyMQuxp^8C!*R*~tSug@EcI`V@izn6NE4L7zg@jW81hqlMZ4
zy(VMmw7N!TQ7SAnGLcu<pFfpVzrInhSTNI~`v)t{JrfeL^t|XBag&;Nh@m(O;-p1m
z^#ffw6g?NV?9CbXspV_5?{wC-BbA_^Nj2mN2D6QJ#ARU9c(DlVz_a2t<-nkWlDkYy
zOtcN0mV2{q{O|C;3#Ybv5JVz^YSR>Or&iZvCX%VYl-IrAOR}a@Kl55W>-KOU`w4+9
zeSFnmi}L?Lg8W=$uMqwx;sE}^JtUcZ^{fY%-P+qKo867%oy=-P2fNg3bIcpd;b>ve
zSRsnZiN2e}cUzlu1?){W=`ru*30*5T&dlMAIO5%#WAS#8a}3Ke=sxj!NT7QaUb@f*
zOQ}PJkskpyV2-uzgy<w`vYGr~Lh|=i<hi;9A%{Xc`RbA&gE`Q3zb^pJ5C2lo7ECgx
zf}P-vBFK-#O(OL#pJUH}Cw8z%54K*b+(<CV$jt`7et?($7(1tN{fqudH5IKpALZ(c
zTST-0@c+WY4yM4@tBZoK@1R(^*aSc5Bf*;V|Ah(5`41-Sv)kJV5n1;_B&$UF*5=ME
zSQjk|CT2as#4K2q?)&tc;(t=5laVb%zP)OZ-Mbn|)@Pi6@y!1XLL2;l728w2M8-{e
zgOSgiaxhs}9tjE<vH`!&Q}BlUUsiN(Y`=*`u-)4PZ1;`>e~{|`=)V75e-7r0!KUa(
zKnwWVU9jQ%e=x<D{9cmv8z3+kiVD6H_yfRq!YA;ZfB_bse>Y)WdI|U+s@8|oFNe>I
zydnYrpu)Oj|K^A98Oi~}sl4DfZv>W~6N4FIAlP&6YziLR^?}LNe{-Gl{r~DZ*9l{p
zcVVquwXA<atM++Z{Pnh$H4tY&=qT<_)?)d}dqD6AY!dMsFVPWUK<*4o@MS%zum1Z?
zET{l>xpy{oLM-dkGU%1oH(#B3i=2aL>W-i8-&;Hu>ZdfrQUxcco63thR7p>4#_l}}
zO3a86an-^id2fRMGl0#2yCB&dm2eDu`;}Ev?&#8aw{vr+=LJ-&9#wW#(TX9wBQc^t
zrmQK^$uQ*Q58?0^?DOdeo8c#x-QQ_@zWllR>(fh$yO-wQ(1D*K9gGZOv#HQF11)~u
zqIGF%e|xW#hr3)cKp;>%yhKnSer?HqftkzC*p`7I`|f{y^x^nwSD0;#F3zG=#6^r6
zUF+Jq|F4F6Bo9_o5M4Ka*#I6~W&0A_LHlCzG0a|HN&CUlzyEeG;?Q7`qW(aR-0*{o
z1P=V3dO{3cK->?+JFdOHpjwlw*2jq}elsw=OaX300C3^CrHnLuJVI=Gu0acwt%fI;
zj6%Af3r`+YcLy;$?$(v1f4USrzX&e*1G8TIv2g)J3w=}iM{9qGypo@t$}`Cy;h6IV
zk$<97|J9&V=ckT7s|al!SkM0Y&{K<Zfpq-m;PSyV{47jzPj^d@w)ndC^@19H6jD=Z
zMA9>EH2eI30t&3E{x9VT|7eWwmcMxo2!VhOQ2nA)&AeI#yO81v1ygqDL|}sJzO)%?
zEJVR}L6q#k&YxJP)}mg~3n|zSXG5lZuOY|2I@!p`Tzrt;AX*|GMG1Ljuu^T}Nwzg+
zW+fYAy-{2!96{t{P08sri<_l-XktM?gNd$LF`T=(Xe(g#@8-2hSMquhBh}7Am4bVe
zkT)Ud3927zv3pm}z98ub+QEvcK{i@iaH3@()F8NrY{7xBB+jobj&FgZ(h;_o;}L^q
zX+n~Txp$$B&}F@LM2&iZr{ypJcP(e40@ius3bML3!$e2Iy~vfAwam8|ll>r4+LWKm
zE|faKvrhc$8M#(t{z;s|Yy-D^9xyEniEt9gZP0hczU>l6#-2b!VWcFYU8&*>T4?=r
zlTDPQw7B!D2;p_+nA~{H)BS7qekCR*#mypEHeWtAhp`ZCTt$fUU2U+t7@dQxoibSd
zhCA{d*NrvJHf=>7s7T@^pV5iMgf6rSk$fh=Y~idpzzDdoux7Y->7QJ*@`T7x(UY%8
zP}|~o+LnfwQe!dhjEL5^m5<Z>8$1t#_I(~zQp$ZFa#EeJnk0SLbCQ+G_0F{8k*I47
z38#cvO3MV3DXt^w#v0aTVbCoBCNx7$k9lm|)WHOS@~3GA6=Opih2+DH0&o*QQCEo=
z+yF#g$iXB|M=ipHXXb4}+Su5rt&J-_DBNPu#gt+kzG5oP6zpUT!O6*)X@D&@0y%fF
z)uWdD>86p>EdcjMVGg_-sYo_C{EFG}1Bsm?NnG4r|A<-o`>pwIQ$u|EAwQF9muoEg
zFTP(dUNvzeT{Aa?U4w&Be#@}zZ<;ze+G~dMR{XDH_81wfgJ%(R%P1VIxGW|f7Kkb8
zvzbLMzs#66g@(M3cxf;ieI|`vOfl7G8@0DRT#Gkgax!8MRI|M?YP*gObxS?dR{_!M
zv?0a;xG6h3_;~<OVUX8RuJP@fW6a;+rz1H<F!2m7jWfjb+iDA;9#d~0XPx$yFef4-
z>g&HH?lf}ypa7l){1aPP8vO<?&G=816>mhDruq08JHMu>=G9x`sr|f?LT*PW&Xhbp
zQ0=>&?g&nci_w%>48+gtx7!zONazF^rFDS(0buzB%?$tf<HMCszW_P_X-MP99Ke$R
z8j{A@tLXHs`)6K^Q}a%GiJ-Fqx7XSb*H&E><@<MZV0VSplmIdSoaABhDn~w3Hgy8+
zQxaOtOCdKsTp?)dvYC=geynmy{be2s2?OvV>31Jwb%sos{7aiI09T{4Xxwl{0AS_Y
zHoW80Sesyb$$4y9Vl=b{dE}@Xcf7K1b26}X3WZjVDSR0@3iA6Z87A+$j;Cr%mMZ0=
z6>-Tog8Xqa)aZ0|9h#TN>gVsbd2x_fUd+^S@%g$3a^*tc>LL^)+Whzax|r3mFBAMS
zdjQ5L`l;tN_^A$|pja$kp)WSRP7Y}4j(bMHz?Ra!H+o1*x+8JgH8#gYX-#x~(d7~<
zuj%OQ*t{SMit3LnKg}w%rK>S0bA)$GczYqgrpOh4YlMd0pdVtwpd|q>ryg~uxC`Yv
z61WCg4{8gnqetpiYa-6|a!>k678~nZHDU;U;xh_;-Xy=o2&$`BES48a_+d-Rck&~w
zw1JxP=*DWK6`Jv+>XA>{-DsZ{2E69^*MDF)PMb{B>9NO|@IOJ=j}eRVsU~VtY4az&
z)QsINizwj<9XJZk59Seh1(oH-@0mciq%*6jdoEa1&{O6Cs-0Og4V>1jyz0|6<>?vL
zrL}l_c1rOZj!@0(m7U7O+qlQd#9d2x-#SfoU`Y^(v27>N;~8JcSEP4XV6V9Zq-}yZ
zW@oA*P`L-X{__y!_AnHRwzKkVO>?z$gCEcwBe_@1b1{v#^_U@=C!=AAH}vL7GrHwI
zf#6Bh)Rb=sot38_)^y>{HD>Dz7t(xi+2|r=`Uf7EJ0OEro69TXws-F7ZHeHxy>8-q
z#ZSY}?u^qnz`MEqGc0jd*F8DW_5#KhcD{#^PY;&7Dj=a<wsR^9dPtp*G%KFIndEg4
z@o%YDAI&xQzGpk%Nu&8caCDqf!~G}W_ya>tC*Wc=^T`6oh?>MEX>O+;kGy9sYQy=&
zmjKa$J;v&8n4**hEA&Q9J<v<4G4aO-iKL>l=t4Ow1%Y4emkaXUJCuC#enQdQI5F-;
z9v8Q6#jrF<<Vu>|)CJUq&u_pp^Z3g$fBpB>6UK76`yT!}#oH*I15c=;3rElb4=Nc=
z@$G`0_|gmEds$$JzY9TnR5qh#m<k8zm`J1(Os~s(qCO>i@Lgm_uuycOgFRcm%f0Vv
z5Ek>M8iqW5iDmw(Y*Lf{{;=WfO7+o<{Q&*YZ^x`wr8ek$IAQH+W-4-7=ue|Y&SR8>
z=1|onTI`zMNVtOqbVM1(X1-7g%!ymy38G#_D4IQZ$n)%bQM3dfi#1KH<8@W};|ujf
zfX2QkWCwfN>L*z38X9QSG&biTkPtkznfxhwMtVY*WK<IlrO|IO3DJaas${v+OIrXV
z8dyziZLq{jNlR5!AYr9in~&c}W^d}Vh)7&e+5`7ooLq%+3Fx~4ZU+hE)#DCV%Tuaf
z7a@h{2TGZNW4?)+#H4KKbO_&T01ITAx>|MB{?)lAbVpI1aVkPpwmh<i5GY<S+^S+C
zB*m9F<^?y(cQpE7Bws%*|3-)DO;hdCS{}M2>+Wl&)f02wJfeZ)rlSWU&lc|$6E9k8
zYwK{}9rPmP8@fjeJQgLv(0oY<MMv8{f^VM2?=ktKpLO|X-zb?_ftvy2(7S}x`?|S3
zcOg(}h=LUQ-y}JvgNSl@>SM=2J%#x4e-<V1R&TAn%ZUqcOX2-jqRjd4^q_^kh>zjh
z6&%^<i#bLzj<P*4(rcZ)c*%>K{|5QAB6+^9Zw3}2&zkZ}-Nqw4A35?JrG_1EnU^o_
z9ZrHPd@TD^csjm-V}LDtaAeB!aE9lVaQ`;luQ~`sEKq1v`AVirrSDhwcKNQ_Ttq5u
zIO8tF<QFQd^|s|MjMumQ)ec?&Tu~V}8~~3w^Vj%Ghv%x~uN>|%KL#-gw@<Gj7x}-t
z5SKk2w#~DH1ZxOcWL+q^fu{=V3+A)s0f4Z2u|Q~<{vB&?=9mlF?K$P{&EMhRDPzk;
zjDemuL2d8&Xll0+`VUu8Q_U;$VoS?b6zjzciU$J-2bf2ya|aQBWDn(lp=NN*sWUgE
zqfG|eQa?Pg1+3B!h_nueZLD!j+Py&8P_TYvW7;R4uw2zJ`F+k`D+8;h1Bo8ch~A0R
z{xkX|+4~QH=<5+)rdQaO;oa|hzE<QvUzpEj!h3n?AX{PuDfW13Qn&r9NhY96b`1U+
zK&u@rT+EQ9a{iK>-w9)7aedBwNT;G_3A;v?kr#*Jhw;%7y||XZtH7PoNKN>Z_esCw
z2AcIkdb495hl{1+4#|M2F&?Hv`70>rK-%jkCSu~@s+TC`P`V4T<19<>#v)mA2FDQ;
zOAldM?CQOjL0l;wuk(pCwMd6|5Wb`G<A7zML#n{5`nXprJ|x-&pOD`M5<jgmJ4Gz<
z7VauZ1J1IXvxcEj7!8<~=JH?ri4LR}TMvz8d)Z=rd<r3|{n40ZDafw&G#>)d(Mkd(
z>L@B@5D+$ag=1Cz>Ze}+1YmpNW6&B@edB_F2nYsdzQQXz!1ncWLyWtE3;GJP2pe<E
zfkb5Rj*gCx1AqJ46RhbLm&aK7VK+p>h8#t=9m|+EiSDuAX1>|gR@ToMh3jQd9SUEI
z8xOl<x5P<QTND!PRRN@q#y_u3(D%%qh&#o0g?omYT1i29jUVsqL`KD;sqp@W2iNnh
zt0qSq*?A69uEih);iV1mo{KQFl^$gosK(70rLY#1F%WIN2f#;nCeZ58?*fFAb$CGt
z27n+Mf}t1LKk(O=L0WDM^17LlrW1zo-^MYsa?7ar-v|u<cEVq5;tN$D$?WVvORX{W
z0HvVfV`@_-x6a=9q>4KRI((oij|4tP43QT(#Ei5n-<nF9nBylFRXdB^QouqpICv6z
zD7Ci1-npTe+SOp(10f*!k&Ib;tt26S6uoU7?ZIp;xpiD*28Dfz)TI{l-6G+8dxm=V
z7(|3f=0DU)mSn~<`BeiQ%?`S}zLpXDf*2!;B1vx6*j0{PD85UrKQK;PcX<iU>s0(r
z3x)h*v3e!Mj%=9Q6%{urw!X>KKNiecHrdY>{RxV@E(!mrT@TmhW&)v2M$lbPVv$Ap
zF8}imreDXQUWyypkyeMvac<P0L4iVVt--0R>dLpr_Vzx`A1kl3@L_hTY7*XGo5(r&
zVIFctOA-=9Ls&}+UnMDe?d>sMe&I+|wm1m1WPXYI{u}iH^Sto4C8BF6nbU<S<hi9e
zB}Ffu;q41TpjsqMTRIll3-Vya?V#@+RoO+FDw6+jzAV_`?*RpJaJYTF*b*-3JElw<
zE4-5CI1P9|aaa|RJ}8X3#x*W%hpb>PxV*lUa_Z&eLRC^<k#KocJj{|%1;8j}(QM5Y
zI^|8xhjY~-Id$kp5ZE9kTS0_=9ROlToylF~8SQd+R38lp5k(ihSUfX0KU}+aR95!h
zoJ?POxXOx+xc)|-G%@$ifSz)1l*~)YAcR3f3)Giyja*G;VY}*zR&JNjx{0lFa#ECd
zyRDsS`i%^lp{sOtpco#<sfD=m(wGUcPSC(t!gpI@bwfc_cIgLYcePZz+S=R4|NU!t
z-yrg@Wl)I6BY^<}mutuzRopwMsO>mBAa$>JOI`zB|I7d*^AUNTjI{5pPIR+4o>oF4
z1Opp8Y%?EhS`~~?Um(cbJ=gCCkBXMoYu`Gufrff#15K{9#{P8%qiHZ-;XQ@ojac|7
z$)onL;*zGsj$hy7K2}*^Iu(EG<cLKi5_CB529Qpr^OS5OyUW``w-Yc5I{#V0WS1^l
z%iGS?2j)2Ugg(QZJJ!%oU-J={<zP-VO9a+>P`<BuOQqYsNZ)W<*NfaEjRB%FRQ(Ag
zAlIDVhsd_P$`COZ4g{?%@D#r1q|HOpXem$_m<{PXEwEp5kUBUgveB4n*-Hv(#-HSp
z!pA9rW?%J%M!TQ_Q(P|tx%<@$6iSoNOb}k?1h#7w#a2VyPN~kNlLBMff&m%cUhkJY
ze&Fn*UmXTVo4KVzOcplY(qFqC%)0`$bBp|j3iJR{&uJds*dM=*AHnhtM!d`3MdWUn
zuAUzjDSveF8NUXH`~UNGp^VGpsnLB*RioD1_hQ%l<a;`qWb?R`A-~IB%GVXk=VeNK
zLlBismr#0$@<G~kT>+zrP$~}g0ZrGzXeV<PjN=6Ld?vx|ca2l%c$UOo{wcZqtI7WU
zFy?s7PAktW&)??Av<-$9jz7CVo^8F?!&DvfC+tM7(GATU<7#G{pnDI(vtQ6O3|#3n
zBbpJicE&l4h@vS75@}lvf1Wr=%pgJ15W%Qa104ASqgmKXl!Y>!ji2O^Y7P0I9_C=b
z@J5FQP}`lsT`hj&k6=_YvBV8pe8aS}AKMJi!<g{u?%~?mu&dW93AX9LuBDwMuXf6O
zwsUbipy_=r>)tFb;a8k^p$e3O7PlmQop?o|Wd>|X3au|LqP+*?vWdQ9O~92pw;xpD
zRbkw|I0G%3(Yv)IYRLmc-f>CGz9wt)|G9%nk37D*z4HGI-PSt@LZMK7P+8wdjG1H8
zhFOz-=)jh5bto+&9IaV);=4!~i*Wveqxflu>~vkQh>@laX(Zm>Aq4V-hy$D$@`mh&
zJ1{ntjtZWU0toNKoHk3B<MeYM1ymSAdOI($-B0vi`r$e75rTGg5pcsW9TvK!YI}%<
zsZLTffjZpCt!@xaXzmhtO+|LN1I`wYTSGTag(7T3=noWzCp)GIdGCIR(KtJEo=FmX
z(;?OUpS1ZRsJL&~b1h0K*Om$IO$anR3HsG9FdkPgoZ7U|3KSKE(yqxELSBxLfUh3t
zKi0n?y@Z1m>sY^T|7CKycU6=8r$+Q2*ZL@30$NZ>G6oA64VV;t4Kh+D0F8}-OJ~6I
z;VZI@Jtx_PxXTUYo;UUvFOF>KgbZrpbDnL58+a9L$()-pAD8)_(t0TR041QB(7g_}
zno?@-&Jw>AuCjBW0-?HzpFj)%zwFZ3w-%PdL44S5j-UDYl(WFBge1ej0OP|VYSd9-
zX1oHFJn7R^ME+gSmUB44MeIx00)%NHe6!^wMXf$9(@~4P9F;`i?1DPuPy2$0WY&O|
zu272jW?WmUflIb43C$`G?~&4SxT6fJ%Y1R(807?;S7B4T)1-yLHOw@7CbD!(p`<D^
z7TXjr{9X9OY@8$~NuBJ>O8GJ+Bg(9!NG&4AM9yRwbcfSsKpPo-?O&jw(C~bq{Sj6z
zaA`~J9euB~$$kL-Jd&TH%_{E2x8{SO6N|kZuqgatub8SI-mqs570%LTZiap2Vd>1!
z2CY_0r>0T%2%_9&r%7!qtCZ2Z{{|f<+Rx^Co~<y9#vYM;A{l2x#yDq?==|<UD|EJw
z1J5l9+;f21fV)d-wAFB>`|^3l^$BI)opp}kjqU=rXY2qXq7}~uz9L=b(r=*-=Xq&(
z5l2~DN~mw_d>D^t-4;j&_mOEwNtnGG)s_2n*92wQw?83Z!2sR^v0{*wW$w_frWaBR
z;^MMsO>>ojCIpB~sLJxz5$<413Z}&<iWAyX*k4`YfXfz3hEmRPNYyO3E)4`=!j4X%
zJ#KjQn>NisPpJiCI@~4Q3W5VY8AXw&kNR@#YI>P7O(}G*`+~zLIEMjqGewJ^ag<w$
zeMjJY8S57&j)65~p^~{9KXqWBQfHe%DW9S1G&=z=4kIZ=%+nz7E!w#K)7lFgB+g!^
zII3R(HJro#`EYr5kcH$xycK}6JIV*b*6!KgzQ(MU5@rzhj}=axsjok-w6oIVz&UJN
zI`&fjO-St`{4I)@$EXnPYlD&qk-P3WLr`54;|zmr!RHxJvzO-800p1ep((1Ly*q53
z8Szz>I)jg;Y_jJ#lF6h1xz;Q<2fd~Rk@NZ>JP77Z!;w2V4WR@6clh2sCOmfP#R$A1
z^#CQ!8`OSuX1#A%3Nw)86h3b*5xu5HLb`uH=E@m=C__BourI;~(K~s9E!Hmrp&{aB
z$+4C-Ux*sJ%UPLS3RQ~+U&^Bcuh7s#qBIo)0o}~H5LT;Zg6j1SJ(-69*3bxC35O|?
zfXF9NtT{2;P6Wxh2(5Ie_6OR^4?E_DN2_(?FD%iU#weRMJ{r{tkrfVRFoAy}c@?Kq
zn|ib~eN&np>|RT!^B4^(S%g;p6tn*l3|76ADbI_1*wI2+{mYY3;dNU@=V6YvT_1B9
z(&dQ5!IwA*fw(g9b9j0G$fKu#?_Pjj??kTOEMKCG>vhbiyl_p#`&$V|IS5i`#D(sg
zi<_AT3#Cw(_3_RleS3Fw3wQz`+bvDdS$EcrF)lx?$4aI5tJAf9Pw0NV!vnB$M6hEN
zPm*`v?rbFVF*iUejIeja+{)e-F(|TPn4qKo!LO2p^xx>a&@z^xD}CPWIWKF3AGfA(
z=}k|MV$*jc7*c-10O^Nl49Z+nnw+MD3^u^nz)@-zvSZH*x`J+Cv!23g)69`GjE0uM
zT^q}t<vHA6pq*+(NJ?c)yw(Nd_xw%q{+V@NOdMt{K11FEws&@}Ha=bghd!<XU&)65
z{Mq_)^G}QC+hTnml0m=svWqBByS{A0JNhckyV!=%JPW-Ujibyhc>NOi=0gfvHt+>@
zK+k)IY`Rwk?_4V$`s~@lw9mozS-Sb-wyk)y-Xg{nb!<ukqP~huXJOVTZ(}&^aHlWf
zw^|Sr1f*a3PQAA>ZQ!-Z{0^)dN+vjpG#;dGlBK&K=;$~^u-r}=WpZ_gV^KFEuQc_P
zds1T#IeT-i3(y>W%KQU&Ma~528S~P_IdqSxw-K~1?br6mF&1)RmX!U}uNWr3ZMjdO
zlleKIL*NB9plr;kQ5@(S05{UW>-2o*2?XP6&7%{@xjvbFA~nf7*T;Y4!&a7de4hFp
z+RwyzRHN%>%eFilVeQ^$CKhNk8t0>gy)h5YAd@p!WzU)-(lwMb`33rBnUTz@zpT!B
zots5XnTM+|p!sq(7n6M9YUwR$X>UButWnyu1`77x=mgpl^@1Z@RVV$?;mpAAX2JOY
zk8)r@JnS1xbUjCW@5{7YN4se}Cpc-S*EOOkUme}<G&GKA*pT5o{lU^!(r>w(f9OKe
zoA7};^c$9rX9-h<XLCJ@(V`is!zt<Kj&c)^X5xquw03T8=P<ibGr47Z9B!Gz=q7yU
z$fMb?mH}5c3x2qYCVt)iy%F=TDjk{3DRa`GZ4>@xUaq;oFN04=)8(1zn5-6WC@A|?
zjyr4Cj@YO%(SauxZUz*jl;L)5m|L3ZQC^pryb^EdX?GYBN^~V%nRdia(aBM5cetD}
z+;j(`U}JfdXJT5<+i!v&l{5vKU+RTKBU`1nGZl%~R)W3*{vy$GF12IvB7K!%c2<LF
zDb|v)reo7hM|O>MO1;Gj+>%H{A9_2FtMymFs~}ktduF)f$22%>E!H#^uk0DoX0G*G
zp%5s;p>)8B!7Qw>(D&plas0v@mhIvuMDc!-6|!G}QwgVcPA~Ctqm8fAzxj4a={ync
z&)Fu0&(IlhQ`%4tz;snmo1eqWv=2b`tb$KPMygm{3i*62+eVvVB0d4FOx>T7=QMgk
zJON!?U>4zZ3`VK33qib2g7zU*=8|CcD{zj$K>T2GXS-e0O9l_CEg>(=aw6!yXG{>7
zofBDM`-!sL58R{xkCrH<|7u>0{aai-L2ND!D&vN9nCP8@sj1>nqOb;mG6oz{0N2(5
z?1$NBwZd;1o#C%tLeeaWNzKdpHYQ-M!ruV()I?*Ut7zT5E4;|lsw=Nll$02*N4SQm
zw?WzX<NpzN$ehCQ-iNH6x3&bZPgh<<iz@M(8@seTEgnhkm><Vir%Rt-kjz6H4*2%W
zaeX3i6v;30{6uBO4YV>188$uhT3Wbd)CPF;jf$V8p50Z*L;o}svlAx+@;fPxy_`Cm
zmq#@X{9M8uE+=X2%Q9KJs+SbgL~3O)ZhfOC4tzvu4ls#|fiG*ORUwix>Im1`dsCVH
zHqN_#)jm&xoDynwfuSHf{e;iMGIyoNW_+|w`j1)NbA<=zVLPImS}C)Y^0N@6iHQk3
zN(qP5(5C!?9x}obayj*`YT5F>3l8tIl#b;58#JDh4|$*z=nZ8a{oHFAqu>dCU>|jN
zj<n$5D@KN(81)7SHhZh7V$kUiH-H;K>IlDSW}n<aj}S!FPDGSCc<;jKuRrcIGD89~
z+0sZ*2@4CO_`x_T7zeMh#P{V;w+OCHATlI&f{*AC-E5oN?iYcsU=_GRE7Wt7+u>+?
zq7*(}XNyf_FN*P~wfuc9IQR(lyTJ5Io(2kk)BMD~&|fM3K1!ZM5nyVBOqeoj9cVv<
zTH>Nh;;R{>fUi#yktI@9zP=(>(URsJShv0W=<<aJJm+cNuFN1%%4(;~T;cls85#sC
zfKQAYEQzGX*G@9|+8K823t|)4iwlGEF1L1&-H<|>v779@wh-=AutCPw55D>-hK<4`
z*;z?bEiR%P%ywbCR+k&(<BtKeCG+?MpbF{L$qu)|APwzbMZ0p=kI0GV#~$FAK0<vS
zKB}%6WmEA%O1Q`H;-%b^>DQ(;s?edv)Qq<hgwyvCpGaEy)?l<bvn5ub5bwUsMhc_T
z_o^mhp=qI-O!%p2Rtb2&iBn0aJ0-jlwz^<x?B9s077uG%$u4x$5<HN`tDS_7kz8Mr
zI$h62F(YIDUeHBQb2jdUZHn?z4yjlXO^&f_Dv=>40VAd1G4F*!NzA(WyMzcbw5e!0
zI2Z&U8&$}|I?w}vce#R&QTKCt|BZynd95OS<bgWB)iyvtS@v~`PUiA+KdfaanTb_0
zd`N0MAbKh%556S`dM+_GAAOelz3gh#n-)6a_!>b%#p-kIdO%nkJA#JUZc@zzh`Ez6
z)=nO13L{*XV(hnoG^wX81n)AHC(ZJ#MH%X4O}N8(lW8ik$T}Fsd`cbCYoQq3pg1Ws
z(hIq0J2aJ-7m~l^_Io1gFxRm7C9~)1Sa7U?>(3KHcx<_xd*2mOLpg;@e)|1Rav98G
z^NlI{e<SRzqT&j^Ht*o>*0@Wcp>dbs5Ii_E?jd*wcXtU%<E{w=2oAyBg1cLw3GNPG
z|KFL5dB2%ibJ=Uvxv1yVsoqulx1Y^oY}yru{`hSb7k$@q+~Pfqd`<#$P&rQX>lGIP
zPllkm!h#rZ<Uph(Vmtf0L}-<Sf{z+fYvu;y(gx{Gng@?Uu~RE&)IWIJk(L~Ml?XXP
zJ?@#W7;!{`%^Sjsa!p9zuU4ceUx<6_M)84IbPR>FUrCS#^C|5q)<6)gcKI1LjhfyG
zRv@g2Iym?ZYS0~81ihdnISQv$Q1WCyZBbl+BL@eE+ZR#R*W=D-Az@+R{JOf-$9bCn
zwCoL1f4n7*542NBe7OZB6O)Ec)@aIY1clK!)A>`@o-2sAe#W5hrjH(GlYYHem>Cuf
zU-SL~h*})gm|}fY)$4SjtYd4*2}Pr2X`u34(1{E1PW8no=$qSi5g#afdtfJRW9LNP
zFfn~z>G|)H=h}eTd2OUW-(Tq4oCEPjXHw62iNt}kwCGIeU`!f5DMbiJ21z=xgML~~
z4P9m6_Lf((`peD04xYj81EeDTFfb`givS%rru%0lyQ)V~ReaqENka$HLvEcso^h<9
z|B$krk|r|YDUlSLU&K*il7XHU4%_KmN#L#>SeE<#sU}P0Zc!{$qaQC>S4gdd1y|kS
zd(5Lm8(~;F#}X`!=#~_(NLT`63!>ruiREAGqo!GAQueeY8`~ew3vy#h3f0+}I{!0@
zq7Nf+(@XdeI>rN*i{B{V`$i!Ydw*ZDn2Ag}!#UI<vm>DFa+v=W=Xc?5J4X+kQKY$M
zB9dsB;wcZKVNvmH`muM^<9Wdu9=hyE>WA$cBgyt(4G2pRtX!tD!r}nZPu#lIll>Mr
zhgt8({C&fiw%;LGq`7t$Q_Bc$Hgn0_b(=7i>6&N0n6BX5|7vZ-)!N_?&b#ib3&dz#
z+T_}C8l@%p{6Hnc8+X2^#qbm$>&mx}R9gH=AT$z7p|g~<@bZ`ujE$k-Zb<8<yB!qE
zT%RW1^X=@-w%@|pk5W9D_ZoGqvx6a;1bI--{9k8WGVPXUmCopdB)^=8nLc`)GLB5(
zy-YP}8AxH18&eldq7+RG{&~CybNiAIS?&Ek+up+wul_e67bGyf&43TUk8ds}v(GVz
z%&xNFS+E|J80yFjM*G&=_m*5=PljjV{lp#VI^>Us&6k+HNu%tL<}<o&zV7Ib3*v-c
zEKL{S_L|MVESot?Wp-B6@=)7fD8mKPO1^WbDIY?s3Rj|)y(3TLx3eDms@l6@VWBY<
z)4u`4#OOhtn&97;h<}Q(mM1BI#AwePsp#C(2GPZF1!tFd-PilNfLt<1tIc1I#eMpA
zk6JfO7znfK^l8r9*JWDKearmy-7vGQmm*L%tOcJIE6h9318u9X?g_D);debr-I1`+
zqzV|~2GCu48;yP?Yd*wm-C3<@a;{=+Lt+(tLH4JCp5ujgdc>FREBA@&APa@ts}b*o
zF-r>sUin-EFv$*Jgjf*m%oYfGG)Mj;KaQtgvL{D$GI9H99ZX5y1x2T&>FdrDeXUz%
z{=hGRIbinciOa+MB(pH@PDWF@F73QhI6rk<KKZ~z5Ga`I%Il@*eqJMZ?DSSrGB&(U
zgTgm_8LfUc8|f5_OUY$5$M7273#bgV`SCby$?zeZ>snQy@DtFj#9N3a*p{N2i27_o
ziehWq*h%8o8O@1ZTe8r5obCivhsoz7!m;e?0*jD2dlILmDQ>=mensCFslJsRVD;oR
z#%dqjiRkn+vPXap>3LQBkW+QRx@)Zu2~X-6Y9bM<8pL{cln6N<QcNLoi0I624Y%#y
zvW2+GkhRC@c%xI~b^YN&$D?dGZsoEc#0etv-tdl#&}BazsG1}(Q`X3C??uBhsTCL?
z{R#uMpoo=e5+|qHmI62wn;V#WYF7%1RXiI@&t}(<O(z~}+NH-`?Wiy3Znx|yd;aiR
zmS#Bi2!QPFN;>uxY6KTLqrn^KCgBYUoRyq{o0&~w+qsRwY9EY^3)SmyeV$-n!l6Dm
zjo+#H#K(KN4yc>;oz$WS?0AH)d(F(hfYIP~#K+XW3#o19UJdw&_Z0kJw5%0HdKg&9
zW{yIp9!KCA<kt&6s-8<8*@I6U@Fvr$bVeJq=8d9A>VmV4INFQF`$d_Ka-mI(Z7xtt
zJ?Vqk$K-$RxavX`^)_0dLO~Af&gW}1gEfmH<3o5Ebs-!58{8=kZXh#ZL8hYo52?VH
zDRRT>)YZ!RZ{57%%gb9MS<XWXUNu}tit6<^V_|s~s<p8{1>Wz}P4<UYR>|;wh*5Ia
z^fHJ?W}wO@GSjyFx5McDJ97JTQgAdz3To?3U2p@LXaUDGg~FC0pyU=Rk#~KqJ7kxY
zLIJ~kJR8ieDaD6uN6r{FuT};JODNt0+4(}<;{Q1W>@yaBWZ<vxV2g2!bo%gCuNYHl
zPs~lIi?lHfi~DWajSi^btr%(N>kP>C_uU?4fr^ri&W{qn+ZF^zc)x9j%+2ubZw0r}
zZjFlXj6_l-QAGA_nHF=x6#t>2&&vJlBVzk~7?<~QK_mp%K!%arFUp>btj|`6z)f40
zUoT27P5W;6STu7fo-2ZQ#;N73&hwq6n~-9nb=}WqT5E*3Gco`{MLxjiRvu<K^SfV_
z-&jH4f)^N{lbo!bWJqq@_;zr*3k`hR81a3><b4nZUp9BWB8*|56N=8W1dR$ddkLk@
zDNI=rm7S0d{RX%5@TKX+vkN$@w}@Z<5E+9<?#h4N6}G3G2pL)&vP`G`^yPg`^B7{_
zc;U&pyn%28eUnY>MY3h>!P_=9PJ;Vlf;b($l=YH07S~q25N0hjXHnyxkU&aCIeY6u
zhgr$Q-us{zqEFRimj22~le$v<e=Ln*oN~!OiMI2EWa(1PJN7v(odO3zrcG0#<4q7Z
za;&1cW_vr-Q@_9I`1svMRPUriDaVDGw|CB{2(Wt5!*HVrT5ndauJ|SW?`j?w{_Es#
zS0AJyvp{P}*|%c`j*R=wN;a_N=-u5rho#(-u>3dZRiRPp<tP0e(44?zCH*y;<I2RY
zfWG5<QJEOHmr!%De_oF8vrTAP$mZWA-x{e#IMAEq;m3V*VJ(|aR6Wnn$JRoD?1hKt
z?dy9ICI$wFx;`$kMwiR}lJY#h?Xq;o_>D<Gv^x;tT~3o`o^$edd!Dzz@jEKKv80Um
zuyCW`qAHD(xH0w3V1)#rk6CCJP~{&B(6DQ6_3H}zcOg(t6?kB8@@4AUXe#dhrFWZB
z{nMK}t63WCV|O|7uRloYt<45Y%JOQ&S3-`yRt)_BM1=n9LbYyKI0u=`qQQNKnIK3F
zQQhlzwUMD1qEY>(a5@JL89j8dS|9Y9O2WBYc+Gpo{(oxgoUBrhr_bj|-;OmNAQeB?
z*c)_pOO$yv&eIj)#`u3rJRL~*GO@t8#E9Roy_`bSD4E6iY`Hv0w$jZKAlE=k{{TC<
z;aj($eLv#p<wZOWdlBFgBna4?Z|a~Bv0SLbyW3lrIS}}<-{I%kn7*@^dNVF4v}1o*
zG4gRG<d|yEv&6iJ-#Bac9lSJuPiZO0_;B?DAC4oQ=)lqqi{9KaURh=XtqPnYv{uPl
ztYpc#v^nmh8jJMwBt=T&Qb{EuSv<=8T&3FDXo~<dl+1FZI0^f%SzBUwnC-DlS9bY1
z>k{DcqT|)*k?8wvS#IC|ty7~_yu$sf-KkXm_6Xrq;Hu={&4eW7r-`bC!)L$tL!3cJ
zKPQ(OFFQNCQa@1+6(vL__i;M+adIZ65C)}aI(&4dcS`8WbSWO=BKw-f3{j`A>$gAh
z*-W&mTm5`n?OOKzTl+`9uirj)oObx#XK@FN*1TU?UM8`r#l1KKmAZT^-u|sV!Ad|}
ztMRnqxcVz!qCqJFid!}p<1it*`o~Lp>=;DNm17$a5aB1wEz~&#FL7ySbRRX{beXLe
zB3!=2&Vk+#_6FRr_pYDsCLORm6Q_V3!5{(fgh+jp_;Ll-Yh+X`J6Uwf<uAGUZh;30
zu|eJYl1Gi+EQt{4O{J_~9Q^_(fvqUshFC88<yETSIm6y?%l67Lp_N-;;*;7uBZ&k1
z#qJ`flJ82vM(WJzKb!un(*_&p;Zov_yJ7`k=DExS<5XR?F`_E#@Y(re<_fE?>OpIZ
zkhZlkEQ@)$ZkVYBK|_5!`ToFDY2#DM@vg5d{o%e`rfD7rpxPf<KTnC+Q!RBvOoXhr
zq50r6wxZf^sD=43o6K#rXi&+t#^+8*K)aq*JOh3Qw#(o2T;D|g-C)MSu8eg!!SCx~
zLDal?;ccn|#T(_)4A#RemQf1ItlhyG&zjO9@v8wzg{H7*UXu;}4Xkad7EgOh&8t(B
zl(Nx+K@WdoMn=X}e?Er5Y@OKyf9+H&>nCmnnEQd(%ZwaV*?p5b|JQA(1W)9a1@9kN
zxSaT~=S;2@lZ=LxUpB)`{N%b%q~dT(%9W_Bd=4;ao{eIEFNMI*S+aHmvLq`DJ{9jR
zvP$2a=j1`u-UTFEKuk@K4(`EytL8Y)zDr&ETAa4b0zIV)l=l=S(jtKLjIOh;H>gpA
zOzjLKu~H(5)?#Q;k+)Eld0D^PgVVChc*{_*u^&rF_Ka5TDWmlYldX9YMtq`DqhIK&
z-=}o0GTLYB=U$!3VG&Al@_u0flwD!$)a%6f6i3;Q_yc#jF$&SimkT&QhXvFd?cM|g
z1Xzn$Q;7ui_A&xe!TMI#eyC_s!y;>Z2s_rfTD5oq^-;O&lFm{vZo?wF2pdxCg1zfQ
zRFkN`HB?Zu*9%87$n%@n%6*~{Nf)+FxD{Zb0lB9{J>ikBJ@ew_Xpcn%9F+?&9GjbE
zIJ9>9P5kfnpuW}u%Fw(|{2-5tGg$oMO~#wMf~tJS95suE75QNC@4)Le1|eX4x9uE{
z8TRGD_~K|#LR(8i4azE}j{1FpBzAU&y;stV1Al#jeK0qQWIV9*2jCuG1$}y-+Q$6;
zgM3XJd&J4U#pLzRH0nyV271O5Q8-k%bx0ZcwMTELUhH-4+c#xmi4Ige5bfRl{qPo+
zi$+i%8N^)I;^A_uhfu?2k+uGP7om>4YaU8ROeCuajils-ckj#^)&lKct8~4R!jR-_
zS1kj?3T)sn5=0fqhE)L3Vd`}=E#Vsw2;}YOcRDyqbb_FNR{km4F(~%!C-<5@12!NJ
zDW-Nh3LVLAHI_<wS|5i2plV=dVGfWBkeM4D96BYnaPo2S^(oLph1z39Ft5v4V6<o&
zgmNK6%Q=u#Hho}srfnVM$fsSuy;nqK8ns2Au}cSjpNrCC@?;1Ava-HmHQ`1w-@za2
z)HFbS#|C7iBZe9#N0^>=#^)anBv9U6O1*j@qoBAw1{vUvTHISed-D%}gMdLl(V<Ox
z$fL%z$fJrJp?`Box-b63nm@ph%zdokdj4WC$Tc7UN>!pm;kMx4H*`^<`?|=ZhwPz$
z-QYtT(Yi0{W6kdk;0F0FB)u0^vF1MWVad1UGUoT%@-_b784OIn$=qIY!$g4_<u!fU
z<h$}ZY(QyUR38fxOcnEQA<T_3<}p>82HPCOP;~gz2V^W_YVi%WE3ttEq=+h&5j})X
z1vP!fY(RQ4OqI!qF8Cj@IYt})E{Z9+K`4kAdWIEY^CrB97g5F{1H}+_{WAJvO8)eZ
zuCDIn^mNbZ%gO2X>Fdj>mZl~hx!-@yU6RbVb8LKE!O)O=fxI8STGmLQo&V9`RMF^<
zql=Lb=qLKR*ri$2(a}o)_lHi^&f<KhkHfw&y#LbX{%=_F^}y9A*0Nvg5jQE&1+EP%
z{Bb;v?EpO0&Rn|DRR14rNo}Vjh^HP0SXQF1k1uH`*Ny%=$JT)&6OZ%;H2MTU7nQ9J
z@AR^r12X!nQT#yR(V31YYnr8it^C6*n@1xb1DYGzNsuN?#l&ZW9T{pTfezJx3!euU
zUIi}v58~FmDCq@@dxZ$*+>sjA@{w*r9h+n_y@DEKJ#qs}4rC|{GlIDTu4awqZiE53
zK_L(sDhyvt<q>oo(<2NV^CLZkE(Jqzzj?V)Oy2;t^iiRcSkk7O@K^GGT1OjmWpP)M
zgw)i3B=}#aXrBpWWMx~Ngn{tw;OQgQ+~}7tgz4$&uI&{s<EKx!pPZbgmX?MKz>^IL
za}ngKsuN+J15dJ`Iwyx3ow}YKTxAdDjrZj8u??a}c^4A#v^wjT%U`yB%kyUYI$U(#
zVoD{xI0A;DAAcVbpS0hCyzHu|XjpYNFJl|se*bxN;9YysP5u1EVzv30x^hBr`$q&#
zo3>F4i(;b)o>~@9N>1E(@1y&_R3QhIduza2p!3lUi;#bqGoDcRSL#~a;j0fxs<hrM
zhRhLMsg8p3k)MZK4+^~mSyQ%r5dP7CxEo|kzunnX9pF1t411>B7YC*b@^&)ce+YN9
zj0n`FCuf}qlv3R*8U04JaxHLhM^ZKD=4@s^sJ`0CtX6*HyKPfB>BM?DIq>hmt#Cy-
zYrJ5ly87oyq)~;VB{p<Dtl)uJ+{x^Xpq^&{kJET~;E&+|J>@L)l*>-EUviB_ukzgL
z6~0B@{y3ENif;b`9Fpasqts@#YV|Qh>qH<+A2&i93{%aSOU0?KZRgatkPT?FkHh8L
zFLuPW&)`eC4=yTM-UVvKKrUCDgUi9x(-i-S*Y~0P!#t!jd$RVI+}7#kf0_O5i_RNl
z4Z!Jg_dECoQJr1r<U$%*hjg!Ig%T-zPsgjF=wS^>7B6##-Yk0N{((@(d27oyJeQq-
zg6hNgvg;yiWBbRdwlb0_rxYr?)&&1L5bw)pTT+IHw=5F5)=~}zEYw1Le6ekmq{91W
zfObg6hmH4HclhUdPSg3C%cF%rNXwPM*#se^-8$3cR5XIzHybASK1+>0XhN0a)WPsY
zhX82y1KlSNzNsI=KT{4ijxZAMD{j01m1#*mNu9=D{L=|lzeHRmW?pJXpy)W&X8D%U
zr#gliJu&6e$r3Bs^3N6fY_!E|<Cmco*jJGnubnLa6kcY?$|?W)O)U{E<GtHk0%ys?
z+x94w>JRaL#cH>ft*8#;Z?=>jm@(D9s6G4f5uHP>ScqxI8bu%9+Hj?!&fd{UX0ROH
z3g=XFQbG;N47@9JLRR%8W_aliklSd9Fm7U6jgfU$6DoD^8mcGo6bXUa=$8+7_FppE
zJ39<c_8}T}Y~!m6wtYbT&W#lzSSunn9Zi;0r@16F8dKV)i4{WT%+OIkb(Q#`xNl8<
z_gZPSjVNj1vqZWn-J^VeCeg+75UT!&%!YVO>4T>JM!e**F#~lY$KEGW(tV!QJJPop
zOXalLyOGLBl`Z$=kZ-nI77FB%w!>GvTTtKyB8Zs%s6OFm%DB6@+W0%0TV&S!8Kloc
z-suUgA>WZUe2@9wyr%<QjL^}VzC}{Gi|FBfBV$31P*5`#3cT`t)oqy4H8oAVx`LdT
z`u^8;dV<*=^!WI=Q~ml--4caLLP8?$dlfyyeP8%g7H9dD^`UF>0HO8P%l|H6bbOik
zy>@l?(l}0s^`k_)IDzXewVZ*Xp8~p0pgU?}NSfQ<T98a$y}3gn!rQGt*IPUpb9?Sk
zIA`o$4XFEo*C7(~bO!+A;>jr)u#ul)DK2N3XyGl03HO;OdGZaMPbA51Y>{Fbv&QhP
z4ZPDrMD%|m*rbd%uLXmWIK1ao2QfIUl-eN#iR2PrI+d4l<!vr-?tC7*#KM6>lSozT
zTHfk3rT465)RpmbI~LJsN2>w&_?uXG`ev&j*#3YE2(n{1qK52;M$eyq<QR;WEnZF6
zZW(?Gz+&{aR$EXG<61A{3uwR=6QfMu_T|3{)(@6K469;fUnQ_h{L%G_b4;Emj%1F~
z?xWnSkQnBr$t{D3xOuP{I=SlwAR%(;q?hTJbt$KP#kBjJLy)x)-O_*)KUc;m%tpM`
z5rU3;9+j5GC+^bOJw!McCO<2A)&D&&H$wXzKt?tIKXW~NDdas9vS0698r9?GJ9nH%
z2BuPc?L*@}Ga|E2{^0C%V|4maENtA+&OFv5>d@p5voZ2q_(oCQZ73NjlCEcG5iakz
ztIY5s&ohW7ug15+xOmq_yd@USTFT1ET3ABy-}(JY^hq4gu&IsLjh|zYxgE@to_LF{
z-y^Z*`$(c-pA=Is!By&I+WoLB-ik%bxY&>DncH!8388-^h{%SLyHnq|w&w@AEn`|N
z$ZYOghl3IiHZLv(qlM;&-J_-QoO>nkv=>*uhnGLTtxwDj?=X22+Kae(dW@mSp$Jyy
z=w>@F!`cyuZk+2*0jYO&y`WxDM%6SohKKyXMs98Ho{0iWnM$5PKFcau5@bYq+l$aX
z(QMm{HFin|U!(Y6WMGbkozhqPP;tZ|4aMQY{Y%AGpPx1l|01H@Rt#1C>wlW&C6`h@
zL0fOO$B&-=r5pVi=X(9+?by@yc_WPZ1f{umY6ea6CGhO#M#dE)8M!y~Fw|DqDpwxh
zLxoDC@Al}4yrdztXt+$rea?wmy8o;Gow&0hYR{VZX0O1GY+~3?&bAYhg6eDLHjv1+
zdLSNYnu8h_?=ys!x2mO^g^jY8W2W32LS)foTIdz&Z6OlGfzt|1{J{uw;Lsbc&O$9c
zbi{%IeUQyID!iBa&`jXT413V~km@47Re1T#{uYWpt3EPoo2=9^a|+PKww&gz7QL&d
zYp9UOi)o^|>&5TL$`RACu@sxJc!t+f=Gp9NCTX(s1?@F&A`f!s@haDI=7owT4k~dM
zhNecm8AwLm48ZwqPp>O&v-f>ZoN*P>(OPe^*31Nou?LZEbEPk_;uYA9k)5zxa`(k;
zm~g(stsF)*u=~~3W%Qy99vc3SsNDC?EH2+Mpp|AyvO}pd7m9r^@V1cR4glziiau?+
zH&yC5s{Fj2_#HKLJ%IAK@XTU9YQ%Z6VL4=FAk#YMsW*kc>qE5l(vzrX&Fn3eXW3`h
zijUC8ESGrGY5Qj`h$(x|?1#!Cv3-hq{?%k5IVX%)&ln<ymd{h{Gt<Fwi8~bAtGoT#
zSnb7^!!<2$DL=u%c;0o&PSEPI<5_N^nc2~R#P7J8cwj%_6790`n}F1wPPG)7{T14e
zZY#1c8iO-I)qgybDT}3?|K3=nItB-l-V=B>e_f3hP<{kEI`Y4>LNhsZ9JTk`4yo3m
zKKrP|lDuZv>w2uc_}#Hvs(}W}I%uBBMX!0?zIdfC!d$0PfB0ss=tS!c7wn<X6>c8(
zxnmGuI(u84mKTNBYX5E^?j`rm!=;?5w`8(O$WJ=$YU9b>duZbkkxTjdQ_sJDyaSZl
z7H$f(UL%7wE$=swwYr&Rl%d0QX0r#v576kmNT8zwX~IO+yTd{OOH(g%3wd|b7_Ec1
zfyiPwNXR8RR*|1TojLrPsm@9M*GKJ5Lf~&MCmUFsltXDxSy_o4EtzslNDq6Xco6{%
zRUQajlMFkzXdfZI6cB<fQ^R*2t+eBT4vDh^7Q8?CVVS)>)5MrXs&1>Bf<{czX%L@U
zgcZ|8`Cgt@b!BvgvXVBk$n(*yiqMI|G8j#~PCS9JBsR}d*+HoeAg^}7$}-e`=Mh}P
zoS`8I-Vs%}qZo?PAL+uZ3GX2cEU3W_)-+InpK0pou-Z}aD2t@vLFYm>zkonWRPTzt
zqhl)e5{J$NOd{PETVCFNvZ0+na-h|SUx$ogeFO1Fq~s9W5BUHm0SYv^_u=no*~Bcr
zuGR;~YB3q<G56L)##E`te|a=msN>F-JPchm?I62unDSrD5yq;nL^yHj_>}(?`BvvR
zH~2=R`7MPsUdteE(|loN8?j5>&Q{>LO15i9RF%kj-Z;N_=)DhCapTOaGn!M3r?5Nk
zo6o;j-i?3>xN@eXbuu(JIB6k&7(qi+6oDD|!{T(64H6;4K8{Rt8WtWcI0Tt?7Ua6!
zQLe>Dm8u0rKk+>JKwRpH=GHZ|)CmG?oLn;Nsg&Fzo)nQM%A1elAGlzJ>&D_=(a1hK
zfk9+bD9KxWVbxyS&<;_5vzh!jY$A=KIC1WzYax#Y#JCM>`e`*HDT$MCyPq?wK4ux^
z(#;vT;$PtNS(#s^LS1Q%9)}dw=HoM;=59qsy-j=pqhY8)OjPW>cjJim*Un14Ql8oq
zB69a@!~+AHSnoL9aZW#h2tl9FKMz9Ur;e#lWgj=`eE*GV>F5Nnvhuioct&IeTTY48
zsW&#z#&C&pw}X*eXK|{mD&&bbYWw6T$nrIERv1q=i>nY<6cfN@`t^(;bMkLOM+F}#
z)vDrbROeZxZ=+GU_VK>#$oXF)fMV~LjW__nHoUc+0kF%dqcNocv#F<TIhLA}EI#O#
zq5A`lV$KY=wEqpoy@~n)Q}5UqmImeEupqGT#f=W4Ry3uKyXosEdNl!~uT2L!evY{7
z!ud2YPq+Av))|lEmr|R{>F?j%nswbfrQ{c5HL)?ZVww`p5%DMTpQ`X(+UjK*f0Lb;
z+U3)n<6hQBew$4T3@#}_f!LyK7XM&f#|2sWIVB&iJ%pN}4v^WSeTc(P-OnB#d7Kng
zt6EvMs7yXAVpyW3Ad5G5EW{yM5wp()_gT+a0ciE*H!r!|{q=@h)1vpOd+X>-z)XV{
z=AV(UaNbUe{6x&#&#@Li@95i4`Zg$YT1m3a@$gGnDt4iXD&K)LdaUW2{Rs`r<1h6_
zM~c5O(%f~eF|8Qeqx(J@ZEU0ke5YJjTt*DPER%t$r(JO<w2+eS2bi)!1T$l2aWa<S
z`rl5OX#u-z)?6X>-w4{)zfsps;G~_N_p~GukCTvRWTj&PwHJ>1R?i&bn1<jcw4GqA
zmv>64?hV0t-{r1I(X$N`KWK4NYYu-Y%`GE8PFyHjG}$@`AulV{j{s+TNSxs!o=3-<
z=%1a_d3kA)Hw@#dUa+956xSxAWhn3^Tb!d+`fuM`0IK*PosVgHUS+qy@r>}+Juzcn
zl7@O*4YvWdnFP*ae_QVm@_9e@#7O904fp}L1b)+?i+Oz}wVCfoJ@dQ<56h*UwqzH}
zfAla{y~#0gvUecwds-HPDjfm8_CBX-xX$k(i1u^rDvCwrR*q`UT*>H(;phqSfc<Gp
z2Xcp;v$pJd5ZMX+Ei8#5THm_k3n`??2Zq1i#qpi_&JU{5v&S%zHH)pQzc02cz*wLL
zyNVQLVAXq){yu}bb60Hyp@TR)?n;E*;GIAjtJQIXe`x{U58;Gida^FjP(RZVt6f_3
zscVoz)B|uy@>Ermv!=I?zV<|(ZQ!*EPG0hdAC=+NihU2REEIbsh0Ogt4;D|qQ1rym
z#aM67--=1g@z`bI3AYx)DZg)Hvf4X)h{gI8kUG^qhV`oRhjB4ogsvo)OsXV|OLXc1
zP+Kk9y(mC%>~Sbp6O}?_k*J{#V`$AZJCWIug?(>HMzakx^Mo$DO{`;c-C{BiTHu(7
zEEH56CoTkB0Zz<+-7*u{60LGj?;-Wi(HGytWN+PR_F72d&bX#=^IpRQPoOteKDyxr
zd%Uae{1MmJ`T!CabB_+9b5oYx(ko29U7bnIPo<Ho&AMx6^-i&s5nxV_gk~ED#05Cb
zIP-A7Vp(sk*fTqcGcj~iMR5LUv;}oeLw$4l53f7bK?}Luk0_dYqz_XPb+Kv;trIe!
z?xB4G-~IU^U%kmxFQomK8+7ot3QxOCBfQ@qhyiF0Fnw30z|dOZe{Fsa;jE%av3mI!
zOr`xWV3$$x1xU%S43A_r{C(C*mrPU^SqcZ^xN)kWlhTO=^C+z1tcYwsVnR@P$TW-x
zL{iL{4`cX+LMfMMrY=MY#zbZ%Fhff_K<n3>u85-R>9}H_`TD-$SZ3&*=N`Vxt|P^+
zY7et_LNcag9Kz-9FO!-Z48yb>Asw93{uagUXtlT&m@wtTP_y&7`PdpgtHOo5p>_OP
zT~r4j<r>b-eWYf6Y)dTp<qj6)rL+A`=rQVOkaH~O-o*^~&75yzNwW>#rE&SY2FtJs
zWW%_O`i*BJ4gAz#5yeGu=<64%Vl+O+U2JsJ0fjb|aj3}zKf*dCY-1GvA{hWE-+Acr
zVs|p3iWKEkAdW|9)#7)X8Gs|b8!71RI(x{-5VeHG!@lnUg-y7FT|SbOlJ((N11*|)
zQ9Sk3m44F7>DHqJo?lLw6Q@Mve)m!Ryhm?fMmB!lpI#`T5X-7bx*ryY`U1D5>7ApX
zbQ}vU$|V&iRN-bZ>at%^K|aWd3cOQ+Uy%#6<d4$Yb<TD-j5U>)mv4R?`I@GmU)zcd
zzh8D6+r(Xt0pLNIzHIyyINAN|s@u5FYJ`94jB52-2Fqf7<THt>@lZS)RyJn(29agT
zm0qdi5Dr>LNIFDqF~uiSIK)48M&Qe1;!jYu@GZx6JITB==#K~BDNM>EHMIm<M;S{0
zxnYkL9pDjKOKP*%fEh;aIEmf+H5K?+{NG{>f$ELH{J6mRyD3FldOp6?-y77>UU!4V
zh>kbKw=uiB)=#^vQr#|311_%A(yN_8d4A@PrSkAQ{L%6t3Y4U?LBO4$BjgxZa2H8F
zeuUN97{h{N9=^I_oENckMXtDeb!Ns_iQ5@+DZ(kIEJN|a*FwFGpfD+=K)uBN!&z*z
z(t&u{GvS*3<F<tBk>#6_!TUakQhIV*UTJ;DP|ig1^+CEO;cdHv*QQ}4VV^~K!Qc~b
z9_Rud#V;Y)PM%FH(?S|9r59wmU?2Ox#j*QIlbM{7o&%nd(g_j>U;Q!2a(3Q*qB3hF
z)AC-yWF4z6Oc6sa8bLD&tKNi|Vx^Eg@vN>gUH<giZrn1R6fh=0`dK%x<dE6NV#p#?
zDM&Cdc!h5wu9W-kE}vsehcZ_=VYRW^OCsdN&E0u~rAF3FCe<QqO{2i$fhu%;QiGu%
z9zsMB?Sqq7Bs5;uL(BQF8uuZtb)gDhuj(WoGPWt?cAjB0geh<LG>I*6NM?-fbLiKd
z!z2~|6kRnkCfcJGS?Y|Tn4GH{akqcy^Ks{bEgQ)3h^SBJJ30#E-F);#51Q-0jvoqg
zZjQbGB?-Zemu_nfJ#S@#1%4*5s6H6AtL1cu-+aKw=hLBzDkk6?i$?37Xb;)|Rq+V^
z91kA(lM()$b?ZAPP#CUTuk|Lcu+Cl2=C)s4mvhiX73Y7}<W{(e6Q7J*v7anSTCrg?
zU_8v1UKszx8Hy8~r&`|C^8+Apdh*Upmj%Y&p5QU~Gi8nuqcu9p#Q0D)bcwv&%qLDH
zL|R|5R7yQJ4b|k?`=~Gu>m>tV#&ih})V!~UF)!L60~9d=vf#=71sEnn=XYh|)cp)?
z1$`}p_qmJ{hg*6WOHqGOUiuH((2Lrg>`$mzUOZ4dz>}X*b2B)tsm|ATo8$EddN(Uk
zPSS4hX;sX0Qg?u+Op@-nb+SLbb2h^~6eqe?2WZlcoQs^@K`^6yX?;mr2=iAgj8>Z7
zi*j~<+BtJupOi=9l$*p3{`Gi2E+gSn3YA<5Qtqo83LSL=#-cF1R$JSl*1Z)1C#A3|
zuk@_)K{YX1gK#?wb3H-`=X5?tthnD2UCYO0al0WjlVhd&xnR-reOc`p|I>@B*WR`A
zYM1^l;q&^i>t?mmsas{)eg2;)3gQ>mlyKvQZj?je`Z2-@E{xX1-z65o59SmQoNo-1
z?~nw&F1Y;xkbp}Wm(r10m{C@FXmu4A!}?U#Qj@;t-sqO+5i*dr@d9ZGXBGS`JZ^YT
z$IBbLvv*wKI`e`lB^WcXxh!Z)`NiCQ9MK`i?_+z5K@zu#K(pPs3yEBbkn77=)^+8u
zs$-v7+kx$YoWrxa&mp&ejlI8aB=*OAM9#?SxmD)#(#~^H3G1Hd42F83JFmA%&(p?~
zA6nFi24Vlud%H=)_fVVfw?~C|2}>|DNWp8JH_{$X=y}64S3Br|Bj9!93I-A8RLG5?
zx?6aGaY8b3{L%a8YL+=h8F7?;@1ZoE{Z<Odj`bsO))cb~t|@cMjy`51flS%Bn4dW@
z=}ausg^4xFiN};zC8Hg4usk#yzU8r7sVfhpK$23VT~!Z^FTOKAn-xo#p-~3xN|Kl;
zdO0(ZLE6dl$L*q`_Xv&5)}uO;gcwfBT=R17mrdzpyoin~AZrZ7;D&DfR((w=`SGPa
z@mR~sv$`S*SF9HG@ooWdXCSpcqLbUj=*-#J7eGpa^4GHU$fP3B5|minA78%eo3`-r
zGr+2E6^Ppw@%tajouo6pqE{69D5_xp&QPl*&ZT3C0e!F07ZbPb84p+V)_6z#>g|65
z?&G~+x0js>*SFtkC|4X|KGe#6L)bA5saNIZK7|0uk7W3I+zN?kuWFJc8=udSbE7C^
zN9jpqDOXm@qAn29zJ`TXC8+VVx)<e3kIVb=@$hBsu)S|Za8YzwRaI4ZYIk&<5{=<o
zx0bl9SY#NikQ6}AM3sX)lKql*EaKECVA&yE;B)9}XJQ(V>t6ei05<cQVqrmS;|bk=
z8MvEf!~COdc|l3hALqz&ckkxZjHbA0)JGx*PIwochSKryo}^o3Z86`a&Hft<ZDCV+
z{52swD!SbdMV%~3wjYF)Dwl6mE8_}1(zZPW3Jy!gruC<vjLHV5&^v!iOda(``0Mr4
zZ8!DO6}>c%4?OUfL*I>ah@dR!g`8?;s3nu~oo_ON`jT8hZhEu;!;Mvg+vJ@Li8RQs
zMghCGBRLMMHQF^+|ChLNnC9G$CQd+@p^?g`jP!zW)kXWIP3ikL_kWr;JCX#%w<~_t
zv<FXT?Fm}|5^h9l<L`ZdT%gpAZh>qu%lN(r9(T!7O`6lNxJU#x7=eXP2ToIhy6g-G
zWf6yp!RALRPV*mJ1Qd#(&G(W#DSgG~0<D$FOUw-W+7HUds62s|I_tl>FpP>E69J(a
z^j~e(Lm5Sy^iTU3UYwDst_2D#NE4^Gm@CJ0=v9w}$5HppL+7y>FQcR4wto5`sN+=(
z32Nj6r?Bj}gm>f*nOtb1%kc!^^xP2f?Z|Fe6^48E-sHm*rbzCfIqWE^=FGLnMlRe}
z<`HH$iK(i1iu|+jIWYg4ez%vy#vH}qf6IJkE}S|ha6Qz>OF2FL?tBz`+M<1-2b-9*
zOw8iJ^Pgp=3JMBCr#FNzy+L<)cNLuv9E&R}MFj<0X@r<T)xIX+vOF$@p8jDx{VG#M
zrC_0R{I@X1$F=i5yu2Wbh)Q(|i!&Rye5%{_wJj2gkP0n=GrX%XGka0ryZ2@W2fhjB
zejWzC5eyf5POAxi!LDMu{?>r-X@VC6=h#gA9b4ob6@sDfG;}Y{SZg4cu6_>ut*r&O
z1pCaqIH5wUXqT-${0|B#_U@>9NxzwbQfmbwzMv7DU1PlC4xnkKK*l>o7yn7MY;y9?
z0Es5juV)EFwNS{_JF$jjk@T-6ZJ($i<BUfzB-MqjYNI)<IjU)^zz>09prCwfeJzPD
z<PKw$KQL!DX*A0CLKClb(JXR>X8a7D<*?12nqaH%l~xM%Htoy)mwsF(LX8r;tq_id
zLf8G9fK{BjezH#Po}AFYmx$L9WK%`IcN3Gi3%R<M9|Hj*7P#DkpJmuGSRVqhoxv=*
zoBM;Cd16X?1~N{el#&u3!;Z#9w*SIzDy>S3-ZV*=3^n58xk*rUbeNvusK_oLo@a<<
zr91he(o$NvONI^KcZ6i!TH=2SAf+Xb$cMP599@#m%Sm_#j#4&O?LHBl`uu&5UOB5F
z(|=FS0#DDfCUX@1ZQeRW(s-o<GtY$Iw|2i}!k9z4?8~aMsC+<}4fLcy5Rq71)*^;X
zfpB4Ead9wCb@^b*rI%z^Fz#hUog@C2Skzw)YjKaLtmi4Zh><P%aj&iBpFIc?c7^@V
zXSC5l6a%6G1?>u9Rjk~?ewaU?fzho#IBBwoTmHj1LUoSZYI|meCIg?$c&e5UdKX!!
z4FBffbAk$*fFzQ*&SzM-%=_oOOQiaDYom<oxp(@?=_SzziC}MskKMDkT)FyJgi@<f
z*_0u!pKn8?t{3S$T-|YccfM4uX^^Q{nz$<TVxb_#^=X5?>^E|kXY<QiPczE-i1u>Q
zA;bIPl@*?xVW>&-1-Pl*<OQ~tKlJOnzIWMc7s6>BIo;YOKw9NIq0fb2Gau-iTOEev
zcWHt<sE{>4AY^brBs3CyC(=y!U;;YdgC}m{v?Y}Ayn=1aNh6_UTB(6}3#XmZ8)%Xy
zROQMcONvtc<W~CO3Sb3q1At7g%+~&KT(F}X+i6yh_<7gWOh5Dqxp_sjSBwsQi@xCO
zvs<LgnB$fDlm@nZI!&eYHc61Mh##FWKXLai`CLCE)j`SH?>w%K4%=`d!K6vqHi2h|
z7XMO6CAzz~iTD;JMQHFFyv1b{hK78UR7h5tqUJM@P(hT%^{n`|h_ab-3(qRyQrLws
zVb9QgoTUQ4>H$TvAt*fXUswx;iTqhdIbv%0LX>pc?(0VRWY%|H=>=S$vs?g05Akiz
zO_TmQR;%D|x4}hxQ}QpaQ5+Tas!4LL?if%{`;wv$$R@msI_IWJ^@32m-#d0&=SN7=
zWSozog*cG5w#dt%N1?mUR}B;kkf_Mia(d<N$9ix8Uyp{uC^TJM=?hx-tgY#yZ>P^>
z#80k^no2y43(d}^yt<)to=Amvq<gTg2+!5}`KaDwccm*@6(@4nn(LnDdV|G(1`Hh^
zPrL0LHgUlA-_H6(T?z8P2(;Q8(y)iVGGncBrP8cWN28hcoM&@6>&|#G45V0k5Rmm=
z)^zv@52kDtMQJ3s5Lpy0OpEeR`6pC8Nwb&1tCFV%zN;LpW|4OQ3%OU(6*W)`Y_+&x
znZ-BeI3_JZ7S4cp_Y9!xw^gbWR8+=_oDOO#xwh}@{MDrH^vwE=k!M5lM0uGTvZo9L
zOC^Egm^D$)*N9^&Q)1Rq3uJ!yhvg`vL%fqE!1=!I&>v*$@h2ULOoJWdJnOr*`h4$^
zJ#@KX425m8ame~k!o`iL=UH-0dM){mp9}CX#woZl|FGJ5WIcv|m@13ohxtlV)9_%=
z;#a#=S~=8XT11kWe@+Eot~`62LvS+}Vw;<sSHBxE9(pxLYjB<v*f~ewwSKtEudvsQ
z&$-61_N~~-_8<)!8+P$`^dJ=JFcS9U!WOtZd<?4^X8u$)QNYECU22=ACBfOw?o~7S
zh`WH)bCxZb+p?Z$EXqFFZWt?2OHWDJ2Z@0Pyd|*{PTM?k$dDh`BCEik(VIA_bJI5?
zP@bu;xQ8C__3l<n-Iq)(x3%iy(ne`UzaQRFQXE)|xnLrDRv&oOo*$>jN(PEA;vPV-
z`}~};AvPFc2BtK(UhT0*vTUc?BF{<swd5OKag1UD{sTHmm<a%YU1hC{K|pan9@X*g
zixKSi&Y3%l<UwCQ5U`FKvka6Sq==1A|5&wN9J$zao|Km|0UKvZ%V%SalW)lNRsu!|
zi+IlVFxB&F`|G%P|731!kZAzqiyUjQlKj>34<7K_Rdz)gB9+C3;`c33@7_<4x%iRQ
zh>oJSMq+M#_d(!N*2SMPvLH!v9qxfvv@33$a8APaAeyeLHjK*|`H$+Ql+)&=ZWuiM
z0S2bb`wmXjhjqtFxL5-}SxErQp+Cp$;xD$o@zx*$3u?m6*nmiIAc+7Ua}+ovQ(Z>e
zQx>Nqgo=u~xxF14bY1;I68N-3yVD;>*7+6f5q{VXoQwD;hy$%}Xb`ainZZs&Odmf;
zU5^4cD)JA}w5+q1&FM2#&3#+~htJx3@X`cPdf5F_Y5jH%KFfvytCS;=HjzNQ)klTQ
zucccvClL2Ts59#|c-mGJW|!n&pcX%A3i!KMu)s^r<Nz^U20W8ycvbu0i{`0XT|wG*
z|I$25OlH2;j+PwmQ;e{Vt|vP%ggeHY@{%w3F+DSRIELLWP(ATa%TMhzwMe(cF|`?$
zn6Xb<96qV+w3iC3D=u53zTRTa&pXK8J=IOJER~WBpIxhMYX~j0bhh|FhdswWGc1kL
zAdus%#%Vc=@WVc;g`GIau5!};rPwc1tE;S@DdmR>SF=0KTSbV`)GL4ayJj&P=7zH|
zQ~Dl01wym$&1CY*j}5!85b`VU>4DQ0i>ta`l3K8D;?Viu<-u=bidlpC$4**7>RD%-
znPUb9J($=1Dv)+a_U`IrrmZzi)i5@uA(=$SwtU9T$AgE1mt>psUeX$+q&WD1Ws`dP
zJD*yOx`d^(vzFMgR*Tv^?Q(xY+=@v%0K;J(tE5k0N^Ta4t<@DV!O!;ooV@4#FZ0M*
zL{pi@UrI%Uhpw!Ri~qp+lNyR5GPjk994z;?eQS!MvN3m1xBO$kA-~hE=`u2AMpPgI
zy;Lrh_RH#+2PmPXv1QMe31?cv0!rgSa6bM!5UMKc*rley^ZYOBzX4^p3k<Lan{PQK
zwyU)bvUe&ksj?lPEZdmznzGgM;kgszJhryu>?JI|=GxF)FT735?^x7DbmCk?GBqKn
zPiE%`b22+t&BCkF$IbyeoMSi(blsx}1FfQy0=!{%{s;rm1s>x^VjAcJ_ti)rpgqdv
zr+Ge*WF5D3a(*hJ|C`P%-f?@vGWpx^yi_b29gOFbys<jT=rVfK=!%q|wH-0P_Jo?Z
zK4Cj?S~a7v7J7bCX1Oc0!I33N+6o*-Hxi9Jiy0k6S9=`N!Fn!f{_Bh3YXnb_5XU@?
zd?;RRNl5>+{Ejx~^BaxOwzJ?Mr+PmkDg0I#&PDRe1sBzy;a_te@?)2(t5`RRMp!?8
zs7@@g#nMD{z0*Kjw)JezHjU3D^V)J_#d^kil5cMp4_yVgz;c^pz{*m3LUx)tq!^A)
zoc8|~85mx0C`LYP9%V-B@%%(-49?sgt+@$^PF&Jer)!L^;hMPKQd6a?#D?S-xg;EF
zyyp?`Omt!(ydvuOd5^H$kM_<?pK^H*H`@C{=tw17^ICzBn$dGc^uiuH3#A7>%p8@I
z6UlocAoeTF^&}xHJyy&KTU$JInzhNiq6h_tlLL9(H-u}7aKU+jw1ozBbhyzJb0Dsf
z+&#M-@H556mT{5+fI`I2&tUnk&${x8w8fSy^)NBJzeJr0Rk)j{5m0Eu8>nCDV?Q}(
z=8A^e>N`2Z3e$oVRG-E^f<~t_5|NI7*+j(tf#A8HKFXwh%4^I(swyQbJUS3)ULENP
zRvL>S=HScmc3&eA{UN9Xq@@!&wjl0{>IJJ1!5h3cL+>zkU3Rv1q0yx7@TNYjngF6V
zDzA#LT$Ubr<ggAm!h|Mzu@NlWR-@gg6*}G`VkADftLVikQ=7h><Du3a4C-3=wYQ?X
zI;Pgs9dGs!4`psqHxUoO!>U}V6BQofnqGlj_m$b5k&!puo{{Ij+kc?XI_SwNMmPBK
zchZW+UkHs_+rv7rmb#F>jsDS*@&?^0b=M`v6+{RJ!3E$}|J1@p<TBbSln)Ax(IadM
zw=gRG1~BlWLS-FJw$&&-!}fdm=nB*J`rvs8Ubg0~{P_@KpY`1|FD-<6;au8sgj3kj
ztV`a}g{jSnkwG2@ndDV|EJ<)ntC_K02b6Nyl7)VbSo*-80yx19!y?OfAPFvRQ&62c
zIH3IT*9X$kfrWNSx9b`2-UGsE-6Jd0%ArE1%+qmCAmGV^b!VYT*UT2}4`UbL)t$3*
zAn5x$7eLGrM(fnPH?46V(-~B!JzLA06ZN)AvpA}xT$p;;7-UqD0}IJqh-A&3-;HM#
za5$GS(e+5-Yy49XVdPsoCk#xJ8NN|<m64R~5BPycGI81+@&py&$KKk!e8Zd*mR@Qr
ztpJOt;W#rxx<7kQZqNhgLlN*}+b}dy;WX^uC_>0E**|9cou#Ww;78~GoC6C;A6yNL
zjj_zk%*MOmnCPoy*;GkMN#}<NASax!^fJ3aF-G*6unNK&nm-{VjQ^F4YBEwo_6b9g
z!V*J%o)Ieo>jR*s^czEt0tFOZnxgy&H}$C<i+q4n8*Z`E#f&Yv`XxeQjb=JuMWooN
zo4wb$yaajr#_aFbVCSogUQJ2#b2pURfJTo1c=`kV|Au)sfj#?ry-AKyIP|5EBO)2a
z`H{CQ2%^Ui_Ev%(xJLi+kMO!M(y<}KYt7xm8JM`Kl7_<0|Giwj|NbAQd9%0TEwPkO
za7~wact=xC{q0xH)ggyo_M8_a%OAjt9(H1A7dw*5CpcTXhF6#P=lHX#K%0W~P{3DQ
zPV;&u)GA2_fPvA<F{UB<hwf+5q1c+*BO-fd^SGa`>tya0HGM`raro8IlMgH;1SjgQ
zSFLfe1%_OA1zQW#BiON3|F&l0wCuOmm;J@Ix#aa0zeO;^;LL9;Zw<03`UPS&Hn1B`
z_Wp06S=l;3!l_=2nK|P3J{7e0!i4zYU~8$)u0_NByHJPEC5zC}qXBMM)oDk~Qv*YB
zpb@!2-~*k3q!C<6IFak3hrA*c1b`~S$y`b}*c?Mbe;N_db<u@Jf9e;}b<=^yc<KTF
z-3-qou7sKU7{O`fN{0W}i};_sZC4!YeUr5h8i~=jyTjO@;{Q!UlZfPdnBdIEZbwS%
zP6vUHk@&R8D&cUB*{YyM&JZ2w28X=ilppiFOo0jarEcv8*`55dJ&Tj0igPnD)Emw~
z@4|00TJa4EtFVC~WT9<caBBAq{`~(Bg;)=w4y($~rz`*dy`VvNTBjQ!V%^N?)2Fi{
z+GlhW6qGLoa5mTfStiK1er@jcUg~up4T<4jKp^^GZrH;K)~FeW%)hd4A%Dy8WY%S|
zLjEWE?LEQA5&Sm=o?#t;D`P2N^Hc*@<&JJQpc>yG7Y;60SD-@&;Uw}34f5y=oJO{S
z53PX@)t9dkKa{TV|G{AJzk-`^8vnCFhn7W58ShYBIh<+#f&Jgrg2UbVY(N51OqF=}
z9Bt@p`V7epWH^zb25=>o;rw!wrhyC>F*F}8*}su4LT~yZtTy=Cfyb0vWSFCG&?9V+
z;rKUJ?d0L}LW2TXdt-Zh`#D<B8QLA_^=~H~7gyqMXDOY?$jCFYpmVajyPc%YrUpmc
z(I)MSi;FYXpbJ)E_g(Z`vHRAD2O3|sDRm<In)gTrug{&YLbv4Gn{-Y(k5OiUCZScw
z*FNzR(ZeFC*mpE!J}zpj0`q-*fV^*zRwk+3u8aBD#nY0eVfT3+vDt|E6D?r1ONxW_
zU{IIi%uNB*j$52Z!~gto$8g<{0Ju>ZefxYNYB<kZ`Y1NJC>eZjvm80Q?)|^4*Y1nn
z$Nb~|@x**D`;T6LQ6$>%w$s0oCSYQV`XGEOxbd~M>SgXebFZzUsHW~xcmcVCnAW3(
zj|u!moIEBU*bYuD%|;C0J6s7g<=eSp7p{4J#0wsm5(poN{m|xjNdb3pr2?7lF?6;e
zAQ3SDlMk$)xgy~2Q(EG1?1(s0j8aQ?;e8<Mt_w;I=vP|>yb|CV{(b2Z0E6IAt_B=R
z*DslT7RPSI9Tj2+p0CRD{)v)<*0SdFYM<gha@WfIKyRgSZsG0SjnHKShQKQa7HP0I
zlJ{<IBI5xZXe$1Olb-!U(%Z}HUvRBrYJl}2fByXW%zON}V_*sV8i2@Y;bW5{=2cHd
ze!y)+6zg1FzlH!6#<I=WFsqVQhkr2(uo7-kQhV9+D}x~uK1%<ctZ4;7!#2>e|IXL?
z?upyM<0#I(o@7j6eaBB3o(({fYmurgjb+#Us-aPO&>ot!UjT9HXQgV^z?RN2ArtEy
z$g4HQ@mDf$AN#Pp+2B8Mw(GP)Vv6H4RJNsy+d=riEjwP3KLWVynb0v=N~D~kc9_4H
zg7p75)7%DO=5bALxTve+l6`vGb9rGI&yz~JxNsj{d}fAc5i8dIo}7%Y?c<GBD;8v0
z+Sx?~-Gg447gXrm)BM+DPL*GGf}Zf6PEKFA;MU~LQA|J1I}_#a^Br;8ZI+b$KVUCO
zW(GFc5GGaf7x>kIOFfEc-xaK9z68}FybNmeGA5n!#N4i~O5J{YmIU+6h8?@~1rqdY
z;Z8zg<xdf>ldUOu*Ze99d%v?5{#l=1r~1S7?$#4!q2v69^jgJ#P^vb<vCZ^f-aWYu
zrjt%Cmxd=xEy&niGHdKNbJHeu75xqT3@gacDb&yK-dR|>_k?TNZoa0WTZ454AOW}0
z1aGH0^uks}?U7!l&%t(zJ>pj<?hZu{j%{A0W)_on^b{=bM@y}<zs~)CyuDRa9BsR<
zo8T_N-66r<-3cCoySq1T!QB%i5H!KvA-Fq@yIbS#w(6Vz`sZ9@u08gcV;}6JrUz$T
zRd2mj&wX9D8#}6fjDP68k&AE9`tP^>aV|fL1n=ElH+FrzQ>*OI%{Cjb0a-E24{pv0
z5mWG$1X0UdRs7nSPimETT$j~>5Ts~%Q*H!>PnqGFw?ftD@mM^&-U>Z=X5!M{Bl7sF
zGXo)0=pbfaNNwd>zL#w3s*4MW#rk)az<%APAG_WB)s*z^(5(xJ=w#S&v#lwP$&&2f
zn8w}b`;wjK<b7zii^~~JWsi=)?0OM{Yo%nb!FJ{Ot&&=zysKsMJc@;9$~y%L3opZ^
zk)2N6rlMaVr>ib5#|Lg=DavsjMcaJG$|YS~<#CKMhw%^6JAFx43LOhZT++((a?5B2
zxv{$}NjEO-Zg5xf$we`Dp^4L6UlUG#*oXM1aC@>8%)jHSNP;`Q^U`S1b3wV^r(Sw$
zi5R6LQEsKRM+zO6X=Pd;C%kwwdr(6XJoRZ;fA`O&n8E_A#-(2%!f)O%`g&)$J2Er@
zsn1y{<+HFZ?<1-x=Yt1*%&Q47xp5H&?RLHEo^r8IY31M6Q(>{x<$r_DPtwlC89FAu
zT;Oc}d6FW&8H73!QPt6+Y<0w3xd(P9zVR%<d|kZdhrwIb=InedGf&+ScR7xKid4Y6
z;FJ8TgiX*Q`?8pn2BDE^k(O*@V0PGZ#>x)QAZY3Vq8On0?T^#d=f+=U;m>37R8K8y
zk@#4sS~T2==CZ;PzY{J%%~SR%CnVCO)>b#9X2dMmGop;S+>`J&-mf1CbZEU9Fs-}S
z8j^M=jaOnb5cY3j4B&Jn2HrmPrw)2rFGvv;(M_L~XQLz|aPY)Ew=v9_c~{8D(!)$y
zM_5f~2=m10&eLn7VP-dfLP0|@`6AgHr}P&bZiX(D7TytRWr<b#R}2rweW(Gvdy2L{
z;4D<`bd<XtiAg?Pp;%8TOi!FRkx?z`pIxrpV?>-1?aWScf|CHJoLO`n^-KzCzDgcz
zG6!MrGo9wt)e@1|ms?SN6^;*%{)5^2VVF%ZM2`M8v&o54lKcwrU|>-gQXi$+`Mt-3
zMqU{`>D*enJhhCjQ><)zAwL2<?jgV8sFuYFlaXEo_2E$`sRO2Yw4XW6UO<0`c!jO7
zjD2(9_1mb@a3{~BQ8GTtM1&D$k~U%_S64Ayudq{JO`4w~*IDt>YIj_}xz<8^`mE#8
zE>%SMXh%KHX>iWBO1Lyp&D04c%nF8iQ9jp#7FYOxFMo~=DkDhSEXZwJacY}!vIxwM
zcfkAQKJjier-L3b1y2D}jbEVxlm46&lD9qNLcJ`%9w(>Rb^OfeEx%=S9g6g<R>~@^
z7&wE$IGV#YhF3VjzpZ^mZi!p8F>PS$-Wbn;;bUPGRTfXy?}*jtA10S0wCuD!#7^tu
zVstm_%=?Ec$y6*(Y@LX=ln|imNlncRir?p4$u(wFB)>A*V*IX(0n(oqVz}O8Z)$e=
z(OC=tW(Txx%Z44ZTpR3fY<vs2a(qQK=<sJE@YeE=0QT;%A`e5#O@w-ji;GFQ-AJ<!
z0f#^;REn%$GqT;WLSgHK1kcK_C9wa~WrDmQ)Ex#(`sq<BDyX9cl_(?Q<0(N`uP5H6
z!(Xv=DiXI{^v$B9h!77Z{7igNbsGc_N<~hT`<%q^o;Y%z;!G}PLfl%Sm$C7@4i!|q
zZ%`#?P~!Yr<XqPK>(qkoxxqxwXq%WAw7l0o5-qK#O)r5H+YI91UD6evHy9Ds>aO5c
zT9jCKa)D7O!>li%J>_^1d;%$-Qxb@wQ&%##^~sdtbw?XA2ZLpAn{_W(1$~VMwnuB7
zz*<p{Y%T4~4|P7d&?r?)5tQiOUL99pCIVRs-&R*dmxk9(a2`XQYmbEdEPP@lKc`f)
zkHzbmA4Gb+@PZH$irR`H9nT8)XgWmVYmuuRGv>a^!7vUsGg_VX44%I`baCib=)swI
zvLZXt)%sODfC{Z{1tTmrQ5A6<i?66mxw!>`Wg%)|<DH2Q)4X#YS|OF=@>OZ9SAorD
z5$?w<H)^HmnCQQC0O3)04|l#-onT;N1;-8-Chnx&Z%Q3;a$7^{xT7z3She_9#4#s}
zbGr<_ni~Wcr_dSPM)SpY2!DYIFqOYwnUK;oME|)a6cqeudEX5{Bo=c`wxEiRcexF;
z=TUyK4X46&->G|4m$5xQ%R~&&%^yg!Y%z^*=NqO`<o+fdW4f_A_(ikkZ9gAAEYZWJ
zYROGJ%ejduF}J!JW2t%K)U`>v6xp8IueDJrtRW+7^Qk2R$$3lzcE2^-IP+@2c0un*
zEa;DL<`x5+z+}Y7p7`^Ccp}OzXNo0$-E&%IjQ*vp!Gm<VX=Vw|uTf619AKmoNzFIv
z6pj7KG%uX6z43^#Vrdx}s+#;Z<DC7Vx+S))kpp?d;`N=yeZOX74l8eW0=$WgO>XV}
z^JAzK+U0~}OK9j+fsa;JGM47d%*#jO>l`?%SJ%7O2H=~T075D^0w*@^AV-r=Ves<K
ziwhXci3CNb$D(Rt?3t)6n@d-4qaWTF2}^o$R^!iWuiPVi)FW@lHCh$P=j*}*3_wb*
z28J`~&^*vGE2GR(GL}RoE+$6yd*R>lik&7|2Ucs|GkzANN3FzdsWI~JM?yc6CjUt+
zZ7C1`C{qYrQGY4$qzFO9*&%zgdY1wueFzWsaf&E;%v4CHfrv$f)K{2q4ZI>^r*yes
zF4z8-V;4>?jZI)IRsmf<pdQ?tooqgVLVi|&#f%TPAty(|Z-eBtK7qZjSeftZM2P%P
zf~oDQw&$Z9Qeb*J(T6Mg$(b*qg_<O}rkJ6Zn*`%B@jQZozZys?%v-6pbthF)U<0t!
zJXa?Mz?>KRSVDs+^F4-d*Tk)-LK5nxSS5x+-(usKgE)XFZmZ#sM{RAhmr|8~Kbru1
z*XJb|eOs&_=d-g?y#lXc_x3-2J+OQFUeMGX2V-m*Ly=^|aNgeKv7Vp_+K(9<J3!0G
zh)8yn^^}c9H}6*C{x-Py_TvWuofT%PevbDciXO-P8j)pm<>m|~-p*Nji;kG39Bzfz
zLeJ7LRLY!&)Af1q2n`kS!!vT`*XdAGUz~Z}%|{TAfpqv*QaR2jBhx0t16Ho`uRBr8
z`hgeH7#2P2C2}ZBa}$Y#$>iYC0sKfq5sZVOFDzEaM@cxJ?rvFl{*<f;zn{TnzyF>$
zvIm6)5<CL|yxPCn%V{SS{XGbVybIdh-BVEg+`>)C27%f(2o@PmBO~v~-mW<^IT~bk
zGW;DXVi(Z_JIFrw4q;p1?p0m30TqPTOb3)}_lMg}VbB%&sNa5se!5m<-1NHR3Ts;X
za3Jnc#l9A0*$8E9Zi?vI^7dZy;$ufNGE`%u6+%N;;uJ{l!Xu0#eSMY(K}-o4EN~(0
zVnGEl|9r3mZKcdvXL6rQ7B%94h{Y4sXJh-HWe}XmkGLAY#r`3xpl+80`d!2y=dA5f
ztSjhwZFXV@0fjy{$G5Ns8sB`fZ7=B$l)fxtZ+WDnZQH6M4TGUyzjLXwtQAOgEl$DV
z7Fe*h?*td!r$Rm?`mIsyofXi{2*2_P3)mv8N2KD@1~&rg|CF0|?YDa?4SF>$5|UF4
zpea%co;#?5wj4R(4IR2=f#|T*PYABHVUf)=nR?Kh_JxsZdz(f0v;&chmWjkig^k@C
zdsgo`TsbHs(9YYk0&f8rD$A>GXC-tfwWE_IuC%NB_5II%O$t)mfsA{Eg=PJqVuD3s
z3EO)~+FTpYL_M~vkAICrslpPivT#jJZE>Kb*uc*RpI|JxO#_MJZ$ia>hc9;RT~blQ
zYj2KfyWaZ<bg#rc&$a617Fq}153{*s?Wtg%#a;D&_4ob?P3jThsf-oeDj3-^`gHEx
z5EfYcsqFaIMnFbd--TDrdTH9haB$%*qLudFuEj+-Y1%|dNkYthTjaZ5en$IqeL5Bv
zrF_A}i1rbz7zdVIwiABhRTEVaw!5s2>5lzE9jEzg6p;QjSUCp4ucsGQM}9<$uvBJ-
zMq)vF&p4C#t@yMtA`T&>mhAx*5E#rXk%~D#;HMdMu6QCR`MI4h(q(Ud|A~ls&p*n@
zXp&coG=%x;RL2!uT#R@<MvUosM8Izmp#p5TGg8n5KMb?V&GW2=)4k%IC#K-7-Hw}@
zTVtw~A5`(1#`#Q4Z&rAH@J`hml4!<Ji1FLp&qGxofwwZ$>$=o~pL#BHzRb_wj;^Ie
zXn!FL?ln?y!=bupA$wRQ>{%Fv(iqS6yl%lY&GTX$Rm|lcA|MO+^B$gsWx<AsoSX}}
z8VxUJ>wB2kDbo*5qo12=!m*&a+}|ar$*#X->!!Oet~AbXYJwwAy`Hy<XrHH#D0F`A
z@1<uPi|It*#01r-WRb*O6}oLYb74E|@Z#eWb}ekOXZ>(9io%a64m6R(&m7qAxW}d&
z3Kn}Ffm0Y&&TV5Q2qcZ`CC3+EpFu*)norPPi<4^+a;=3hDSlh5jz*ZU=@%>?8wgDp
z(OT9Mo4-;iGH~j-N};HEp(>&pL2`Ev!O?DvjHFN?@x^#4!_5cY2Vm4wbQvHQqUbsA
z_v7#;UGT%fRUt)4XfG#F=lm2kG<|OZrDtSqfgoXO2?NKs^*lN46fi}N*mAj9VI0M<
zh}tWQ8O+8NS-qxXmf*8bL#2jKka%UZ9a<DZT!*E`&2=#r8}u)&z||XeFmtZCrzd{E
zQ)57MyznFB+_j%fC6{IPbfvjxwu#^Gk@NA<%x8Jc5E9Mgos})<1tlUPGG6*x_;#Ir
zUKsFLcz>WA5S5olIrROFGy0ONB}IjFA5mxkA2i9hqsyR+U#<|CT}oH69w}j`M|fHC
zmv!X=MI)OeP|S*b4X15aSbl6`qR$?li+DN)E?{pU!9|Y9I}uh3=VwznH-+RbZ=K`(
zImN0O!OG3VM&7)B>#$GsbE_{lc87FkA+zuts!R_fTPD!JWLb<<3vT?&;<Z2QuyIYG
z*_!da%(EEnb?N8%_~Fj0p4CM6A7tq!HEN##ZSg*6k0Nb7iTsG?<}cCje$<|O@{Pul
zFf}2TSI%q@Wkd>IZltEZp-ELHZMtk?qg1p*)o12xCfHTcAg_KuF{Tzc+%P$JjhKTt
z@jH=}$3q$IVMU*Mwa?9ld19L@Cu8{S3xCNH?sh|W%@lAZBwb8epSgYafsr#eARmJv
z1GKojphYaBuSDq}DI)sW2FU?lYjfcu`aG)geH*nqZpo&{A^!F0*FYaZ5`TD^lW8#Z
z0QdeZ(av7G^x9wI-X^Opsy3$?W#;6Q<?h3kcSvLd+v6ubvPwP?2zXdUnS$^gD-<;<
zH6ltaDt9B~Yt|%0J6#?bg7I91Fx@j$g!a?D3@mQjfxB`=_%PcSM}n=C^B{*)dBHeP
zXSHcRP~)U*vHT)ir!jyzfE_b*V=|7^Y^74)uoUYPR_MI;33^+%?iPoj{qvlRp(o2k
z4(}4249HKFvo45fOJB3MP1YS8rfA2+x5Z%P4S|Pt+*-DXaLg#{QFjp}F{Q7rQnZz3
zGBtOGYToQu;pzx?XY=CLap<x4Q^#NXL^F^nNT*KQwbROWihC{IswBve9-h^xndq)k
z8zs4#mS&fHEWdSU3u3BdGOc1I^v1JK{KBDdYYPY4Se9$ziBqp;_GUe?1-MVO2%wmO
zIn#noga<e4{T_WY>A2X-7GGx5MoihQl*?qoww>GiY+LV5RSoVeORT|arH;*SmBQ@O
zCNBt*Q~(s|181@GNTgF>2+x>cu1T(y%qWnHD{l*EKR!x)uVwOeT#+&ZyHT5UNZHS`
zF4YD*X^24m$gfSy-Zw0XDhkjCM7pzHndrk^JKe22e;A<C3HA9KqpCy&Deu1gBF>MT
z!*dexfY}FHr<I=_9J_?@GdaYr|0<0#Uvd?uSa>HAIKZkO$<ClegMS?a=NBGdw7UMh
zmwuf3US`^WdN=6W>y>S%P^OUonHHjxnJo<{6|J7Pu<a_S$pr+WOXafCv)(EHnpUZm
z6J1`R#Ep=#XB_SR1$J7AqMCnEH%!ZX#U9W%0V=h7VD$-%rFkugL-J0oM<<mj2ZpLd
zC5m(ttq0wGAxE$p34ai@4T1T>zg|)JZ-~u*;71yaC#Qi$Hx0`5xx`k0GD&!)#`zSF
z%vN=O<1X58Jet~bvLL4=wABZD_2ZmcL}Q@LU+(6sPJ@cq7$(0#aT;|-%fb&-A0{lp
zqSeyWx@r|<5q0$@k?kH*)dSQ_kzF}Sg%6;y8S=qy7-97F+`pE@@>BHkdHgVhL_I)~
zSF_EdnFXHPk_+=fXD`simcX$RUyS7=nO<A*8Y3i&FCGlFX)kLR{dv>nnwt5KyL{Mj
z&PlG2Qo3MggqaMFw_&IB*oV6j8NT=H23g|rrl?Ed{owVrh_Eo1-!i<S`ik(4CHH3b
zwNyBSg`){m(heqd3L2ftXOt_Xv&qYxhP~S)AH8*Bt7o-$9u77YM45Tw1fY)eo2;#&
z?!vG8m3ljFJ}IbQJC&-?g7va{YK<iD4L|MlI&t#g7cv`2j38m^xsXh<8xo*0^{9ML
zAZo12DMj|U9^U||kaqlHXp3;03me}}O-pGeell1Ks;(BHlU(>I+EPo%tR)0x$uNjk
z#z`lB@*B10amcepV&qqoc{y^1Kxoe5YQF-9!vaCqgFk9x7L!R<bz9gR-Fua3RB@WI
zw>e$RVlOmYMAU^Gu6KA#PSZNjkMoyo13pM!+`&IE-$P%ie2)iX*aR%p6FE7TVX0Mr
zJJdqA;$4+`Vl?FPAu5IVV<K`K8GT2?46b5}uQ-JI?v7%d^9NU*Yu6JK4{m!}#^~2n
zx8}_nu~<PN8>jCSYfV+yjX5U&QHhH7dZ@#ry_Y%c<(CRkO?}ioOjwM>BX4<y-Z@#k
zHI|ma*T(HGHy~5CD9R#8T8@Pb@$(~j<j1tq`Po_e&eYf1o9IOEV?)qpjVHdX7Dcs9
zjE@>^)=@X~6EYAw8bD#=Bx3OMw2}y!KH-Dl$OJ3v6kPT=NmF6`!HUMX+3As2#BsPA
zVI5Hy!ZWSf5oY9UyKwL%u)XGxpxoNprHN^@=vGoE(!6{eLUq=b-nesB0oRL$IJuPs
z<LfeII=6&3RAbJx`9~MD8*nCXtEv8smq|S3eX53Yz`ZuIHYYGeRW>d)4>{sH(IQ{w
z5fO+AOA`EEcb%}U8<<oB^?Us??6x@B$$u%X9+l18KrggHoj2-<mhI~cKIzh&lhdt)
ztR0_)20x~$Hzu>PF6-hgu@ZgBxm;Q2Obvc?p0OY@doL_y5(%;i<0zAnLmkGN<#^|X
zGY6Z22?|c1=u_JJQ}r05Um6mIbOY)uk;}IQP1rx8F-@Qjll9O4lrUx0Pne`1Uy1wB
z#>8cRQ*<H0-MbTZTPcT?%H0xKkEDiY@--$1j*HZ0OxWhud&Nj8P?BXlp&M{SJK@vJ
z^`pQrpGJlZA_1aL0YQ7h%{8Y;TwFGdD+CLEjR^l`w8=aKA)0DdVbgDaX(Y68C-Rsl
z5oK6H@?A0&lx=k)2fdE`-$$z*B8)mvj9}z8#*`(eSwYW_G~tnj!&g^F#QJ?}3W0Ch
ztB9{0_ueo+!jSepx?tXCI@HZjHBk8$G;fX2I6ZKn7B_gBxf#@LMrZG9?2cD%YNlU@
z^e9W>^^N_Tsu4Z^5O++2aQH}HG{WdX@74<E-Qw1@6<;^!cvmbYND*vQ^$FeqZ)VfC
z5=N~TgC*(3K%clLBV!y~*B*E%RueNMq}KIs2NBoX5h+MDw#n~_8_*BE#@T{ifx#u@
zZ2u-hy~r|mT0lU+m8-)lm-hND;O%a6Z?8XAgmHaBJb;CtpZ~sX{Yj{TPT~++D>Q4~
z@OcYQFUM`O8x{rz#)$+I4F9d?>TkzKGLXGdO(|}lI*HbO!tR^KFq#*}c;N298~WQ(
zJ_mxA5CwtK2pVk(`}u~Hz}=VhCON^H$*{GXN-U82)dWJX{2Dji+N<^c>4=pMt&JfS
zS7Q=-YKjkrX({3|giyGXLP`}Jn$91xs6|Dc@8>~!JWBCK>xJtq*ZWRCy$R0W@;0cV
zzF~lM=DPFh)eFF+BUBz3p_|pAwWvz@n-($nUyw@979_@aP}R)fObVNgx$XpW&IqH|
z`bYrwDQMN%O^@kkE>&|46@A$1<Th)(?N0oNyU5lUR}P+fZ`*H!(~;ol24?2{TPKb5
zl$&&&5CfIKv3if3n+3CA=2NYx4CmDa1YrUapMh_Te!njPQ5Va=^)T%oKZmhfkZ0*-
zn>#Mgz<TE)!=a+iprKj7DZl6#13`~G(E@dQim<N6`dtv|#ehA>(SkO~K&=V`K1^%S
zaiT6MqtsTL9cXfbi|6S(N{hx2XR;?wkxW+Y2XIGq=#6^K>jT<vX?^MIQg7@5y(Gkz
zLBUeVJDE}pb4SGN!H-RF`aPv_+AbYB16z_L6@;aUrt04oPZZ0TSxnUhqY7VJSew3x
zX5kES#5dtIUf<`)E0CV|y}+KcSBqL%VByY3W*ZoE?M<<=i<jjdWkpo*T^@`2o_C4O
zBf%l%<$8#H0F@{1U#8CIRBi_HK=(FQg1vgvh=#*UhrRCGAruDwsKI)%%pR>IhP`Hf
z{AIH!PA5_{2Kx2iT9o0u#`CiM9h`yWWF-RIU3RXu0?ecn4Hbl5rmA0ifp+f0n?eRA
zrhJyq{REk2Va9o<KD@{)*&9~C8_mUo#PnZ75hp{|2tub|MzuR>ii@BaW!yi5Gmxn`
z?{I7On7evcEsS{b0RXvXJk1Thmsfp~Z^BQbV$6R(-8((SLfSj6FMG=sTp<IsRG7lL
zn1GUx73QhJ0e2yI(+`;FbSv})5nul9YU!mfY3ADoDsZS=!Q6WHH|cYJ&f30Ts<PeD
zZl&ZvyQ?K)`#TfqDesnf<sHQ4;*Yymtb8o>vr$-hwk@V4P;OMYCb*(75Kg7h`x{_6
zlQ(|&0Z>CEEK=X9*(yF^o+5nm1-n6|pwqOm#<mCkDG}~=)fw!fLjSl!?LwC=*ovmi
z<iZ14?8i<k{YmxbSF~(X4L}TGFagAnA2}rH`$;U$XmYee(<V+uQ@WUhJ_-GR8)nk%
zFs%NSy|R&)G<sw7(-8C_c89-<SX^?l9MR}+o=_5I2!D8ID}_V4I1*}$pi(L2Z=)~l
zX2@d~?!4C6!NNnEhG*kpKU%m*zg`Y#2`0cdMlT^K*lyT}f;UXPIMGw%vV!MbU(3fd
zo?dfoT_aYgnM=AD%H=LU(Y^`2Tu!lLmJqaFPWBOG+l@|7z#Tw-ph;>&x?aU-cwWpD
zDHX<lk~i2T2v#X2M5pO(Y@6Z}5O(7?JKH6nI4HXGBbI*zmDxGlyG-sf&Ix~OaOREr
zfzqP%u<H_txcAd}wjYCAl@CIY(YpXakcPxtd1AcuVC{s}1(x5i{r0jFrDKi9lCVMQ
zMZHiFG7h{Rms+EaSjIH}BZH!d$>u7cMOrGFkjUMdl+pZ>pUvptSe|pDjWAQ+s>=D<
zV#%t{%>`>ei1~7V{3~kE*tK!M6OOk`KdZv+uXb%x(qox3FmLnblrrj_c*PyC>Y%#l
z6(o>3BOb=xfj{Z=>^<`Hx!6Md+>kZgDLztkw<yNFkmS39(Y*rSp9;9JH5+qp9)>2X
zAO}QC$$@`tcERiCM-yq`xlyc*y@NB5v&zcJu2RK3kna9-1$OsW7@eoZymDj2=rQ+a
z!#`NOKmbKZ?@y5@+37hQExN7%LKhGh8_jaQ=c!{1OKcukP|mg!c%a}!>;DNvi?w{*
z<iPccA+50p4}1{mog7D}cYbYckdq^s07o8v{%}?*gMLOl(63-u5L>~Ze<d?Z-jf^l
zbv=|Se><fYbRWEaG6|nkOHSlQ>Z+Emp@n~gEZ;{+UKfsLw1PfP#T^5yP$v4*m5tM9
z#-8&9n1cNXOo*rSDFMBcQaRoH6np<+cDIJw2hb$_KGiP5EcJY6z23F5LXuBBf-Baa
zb3Q*}Z=NW&Mn>9xYy8DE?(?V-(WGnw-w0!3hR9%Kz}{T#55Dz@5u^0p9$R#x4C~>j
zK*2I$!?l1*yfFYvp@6OBz)~^tnx|ZPU;l=LbW4MhO@T?v(B#}yP(`3B<<@kOqI(zK
zzJ0<ZyP~8|oF0pWCuvS>GOja(dcLc*7uzYDbUc!kZy|2WBh-q_Mgj>BWmW8Gfs<$K
zISHXWJr`Wp78JCk2cuUdp)*3A(o4x{2_vRHM#8cr?U^i=A|w`*^rPiHvj|mzi7}cG
z&7Co5>79ps_@HyTq}cCIafgz5{w`q%_t*s%du;2;$ht1XE2Kc$P1BlkG=dNPbLraM
z!Pap%%FisAjn)<c7ajOX>A27(ZPOL+=@`t*zeF_qRSa}6GD;8^miHQws=GnV+eB9Q
zdD#TxM*d}pclxn8XBi>4lLRQU!a)a-(Fg(4ivDER!b)>eD92oW>h54Jfna|dC(inf
z7jiPDUnf@94tv6tHV$^8rnY!tgYF8x68~GLIsYv3gHV4a8vJ5UI{*ZoV7<M)@5|R8
znV7M2xdNCCS|b(~v}We#UC~)V{H9w{R`@Q5GoN<$_j^`WGBZ-<2>BS-v&C)oUmD+T
z*Uz`f-tZL_6<1hwN}~^{Z=k|=k5bQ+O|J!Z-q#{pYx)_voHBk@pAZ|PAXXlMudc5a
zJ>9Q%s+kEyA}BodBp~?X$DWILvBIQmRG2&7_K_(&QJNM0dp)kCRZ;hjKM5JcNh)T%
z1|>w>dh?l29rCl8{M4T4V(fY0*RDY?rk|6aO2=P^N0-~6F!ZPbYI#f^%F$ln!K%f}
zQDLN?QD;pkq_mxTJX<roVp_4a;wUu)1S;VI?HhFUQSBS!J>$QCHb<a8D#V9`{v;g#
zH5(GTt=M`*xc|K0MS+Jte=q19ofjv*a?RSQjpLTq9I_!@gjLp)G&$hc(iAz=g5s%d
zySYPvQ?v}XZ9Ip(a>W72xj8)aiZrt;0$^;nqKkMcsf9reCp1uFAm`IjZ9VXfw2KCu
z!@W-@*XMum)r}+K(I!I0-X2FgV;|Qz;@|-U&Ux}D*DQgCYRQbkKB65S1ueraCv$or
zp}&Q_n1YO!D?2>e&qQX*`=`#x)iT<1#7&{Ty+_dlx+vj=%^9WFtwuzns~1bLGLT!O
zrnw;^_t7q7DML(O3U+_y#EGLE<3)aFF?<dR5Kl(sla99(n(C>5`)V6%BDzXY?iUX>
zXRL9omf<M!lkQW@F^5TcH_NP9KZk1$K0Xu(%|$e3+YE)oM$wA1>rfPAzb3gcD$P($
z9SVY0DmO|}nd-hONvv+t8_c1(+DlH-vZox#%WuWTOk@RTNx=-$4%T)*lMmPA8y9+E
zT22&;O|X4np%<XYQw(;p_awmvVGh<VAL_AW={biGUc@w@msZK{5uKHbxfF3+&#F76
z-2eIZS6P*VRic2-KizYs%R?3X^-7Z2o*~+9U0nJ7vm)wdmP$li$$Zm+>F4oKq^}@_
zO;;8?{ruYAHzs5ECc=3|mhRh2d6Y9aef1`jocF0RH)e|_qlzBe`u+O6`d?}0Ly*R;
z2)ee%<w5bN6fE6PbLjM}9kR9#iGb%&sBI$Hd3=M=rqF^-);A@(0`;`rCOAS6`M7jd
zD!8Ic-18`VAXP@$+1~xjc;d-S^_>(*12!yjV5i-Hd;~YvBX46!Q7iE&d{~<c!mlUc
zZjDUK%QDK7&&D<rGrIhK#|wg@lsy-wrh;;*1IMPge5aEs>Gp+{QOF^$B;GOKHVh@3
z(5@$=$q4_TWD`aE4z`eC@T1jcyHbw5tD?Imx$pu~;Y4O&RM>mHyre|jT^PkiT{9r+
zf7n-Bs=;gPMnEGpjo~b&$x_ojI>b$zcf$(#qUB#sn7^LR5co2X-MR7JF~~~$C;+um
z-T|TG4uQqcjAGZFylnL>50u~-j<nE=fmv@v7a&<^zSURD*c-OEF=A@DnKe10$foNF
zD<k63o8c_C!l56(oJ)F+;PcILktN}Uks$R&9D^h~GMvJo>aHztz;UTs+~L$zT^Un!
zF5qNS&8%ZobW~lWsc9fj>Wj5ap#X`EA#tc?#rc{~gC+7N0L0$!$dP?*06R?(XWOhu
z#_yb0x(SDF%28dO^A5kX)h<NOh$5#o8A=@161R?ybt^hz5evByRuBlSaBA7~;z(dM
zttj;@mxwW!=~{WA8Opdkn|!%=)~2UyUBv|PkWn&j{m39}ck+vBUd<_uUFn=Lc5cKT
z(L4ErdW|O(#IpEyB&U3S>_zAh4w&v3NKZ05zhD|jyV_uk{_0LlyFk$f8rkfMqXKyM
zqLZ9A0gSUGAaY_g+cYprU@@({Sf?i7)Tx6wSiwbUnoKV=S&f`D1;xcNwP8;BVsI1X
ztB_%mU+z4sAEF2PfCyJ-{;gE|(%lyZ%9seYrU$euz4|lMQTLtAnno<&ihe384lFsg
z&8o%=8I3EH#W^NB`-zQJb5|?=)y`<mU3?v2l%qvJxw5i>gBcuCrXbkvL2w(_CCfzC
z{nJjspe!d^oTx*OY#<}Uzsl`zOt>=p`SqrL6G2vQVZYc%qP%S8C>6pJ7$!CJ6~!^h
z+h~QAc&G5W;_Pj+L0v|>GE-Mwg*Z2Ilrq1BglD*4J9}D*A7GfEEmvd}_HD!j<E}#v
ztCPW1ihIG#ls2WM9G*n}@86F0_nr706VkHm6*MKcuP5F}Eh}(MBUgMIxTO;ga$~ct
z4aBy4DK+z>{r8Igm_#f@0f?B6{!eMuG67D-=fvxZ4}QtL2&0_j{TClr#Lp=Ct`L(<
zs5XrDB7Y~5MhsP_9eBg0CJ#6rNWaGeO*XXbg)um-u0iGU`Dv|h*g7z=M5?6Xz9X3y
zu+sft`n%$rp5rcHzorZ7Fgyl;%Z5qwbAtBPjliZD1wp?gKsCupEh*DIG6p@lb0?r2
z;^mc#C09`Zu0;}u;ycwQ7>c;84ICEng({rkAC1<m;?)b4<ss6$jP6aoL{m^k-RQ$%
zu+sIW;@?GVR+@6+0F&;=2SCNzN~P%<^gajSUy-DP-=692Bc2^Hq)f_KKvaurSZ{ZZ
z3g^Ggv7>uoVz?|i_XgQ`R~hz#D*DpJ1aBsLt*4)McqCs7?9C!u68DOc?NfC<UrV5%
zk*^@0n6N}X9(vKVdFe?JM+RtB=w9Cr1FcQC3sip@MQ4-pNa<j)F(dmH(flNmaeH*r
z%HXFwb|6lgnmXrYgVXdQiA;~_UOu%hV{#+U!mrCdl*&y<Zn3gwA#_i)J;-8+d)>iW
z5OLT*86f7P8%y78aykaiHbXJ-FGxwGdcpaBIP$VIOk;i`PcruNuT#Vbwl3TcP;}Iw
znqsvLHt#~24v_Z>%8GrS(l_ZY-*7%dg=?1Hkb*G9g}%}iZax)VwsE%*era=h{tlg0
zk7C@!gy+w{RCN(4K4n@XGSs+XTokvRt>3#^qguvXN3|x6BQo0_)zXF7E<LXWeY#}5
zndc*@BLgYSz=C{K3jCXn`s~=Bd=lB?X2_6-XxMe(Om$b_Tye)mJaI_Dn+z<ZE*2kF
zX+E91)P?di!_&|R^`00h>$xCxCjWdts&H1nedG3@Q>XB3=2IM-AZx2F2xM^f{=x9=
zC}5N2?UKbg3}5jPaa-ic@(m^6)-oV${XTZRb0Xl?_4FCAl`H1XGnYq7^$bslyb%K-
z`KtQ*zJRy0H<Ez+@PNVk5h*f*&!0axJ@L22-`w81bP1z64i66}WM;<9%zPE}y~hB0
z@0xrc*n@%rpw#!PA^OPOC&*(8(gm4B>{-GMBhf^*NI<-$_Jrz+Ai^U>S7nLpa;JLO
zDn|6Pk83+R>_qJlhb;Fz^Qv&f{@5s!<Ot-$#X@U1F4D9mgJ{EvZtihC4Fj=uHe<+L
z>$OiA<{MMLrzTg;boPd|G#vX5#oD=?KT}wwO#W3B6sxsQ{oe%RtzxBCub&|!JFhr5
zO{7;DtpR^dAk1-^R9_8YQ+P&Lm9rQ$nhNl+sfbKYBwA4}6j+dkIG9gJQvCB2bKmwT
z*7grLT5U<Yrr4?8C5tUpl(IXaPB0*@w;y$lPQ(MCB6Pd+Zkl$MjE54+aS&Oad&E8G
zdm$DV7R?`K>zXJ~n@bMr9|$2Ikr_t$5&qkIeuzIQoc_AYq7FpN;uzIzPR>^5eOq&*
zk+CasxzCSQ{}W`E-$^3BL%CwG35D5w^nXuZN!%jV_$G#F{vBkLZvYb-B;A?9W4DyG
z0c8PhiB&X>r+z}+U_zx8Rug>cp5MQyj_u?^(%J*JX!BwR&LWxYdkq@Eq*i8qX-{T}
zxHZ`sNlQ8)Z6Dp9`Iv2}3bz^(A1eG%1$hZd`e9olpC`%JiAHDI=_5*>EHcITkv+H$
zCIMYZqd$2H5*$OEM0z)eZt2^~jj5v&rR2#c$=tHaxu|1PFWQDbkRAv<92$8vnmZnD
z69+lJ)}?x>7PJ+Cx$z)^UvdkC*j!4tOKh*Y6-$lIZUlRjJLonT7Rcu(`yUM?GFFKG
zoSNt%qllS2ur4-m#mx8itZbtFwCL5MFj4gRx<dK%lADEZt<1)-vvBqo?bD9dG>>Tw
zWxMQMtR4$UaGinbB-i3ssbYWhEz~?T^?clNR9dM;Ta~N=X7eZ4dCEoM76orXjZ_-c
zDObjX6Y4$tP{#0Ark~s1U-jsoT0UAQf4l7!pO^BfNo+6An+DS#);Lz~S=~6goN8#M
zG{J2*XW=*7=gd=|q=%!eWBK#H91gSN4%XFBPQ+6U#A{Ti;7hUD*G4N0MDwH8M`-8A
zuE|UKyE|Z(%J&R5A0zx-u4Ls@Op&m~naYWtgM7IYRT`jP3^4g{u%BwSZgCs=iXwRh
z`ZZ#f89^iiO~)V8;V}4+mhV`83zL21mPq=Be$yh`p#7K<&Al|i)B71EYo~VfL8|7Z
zZa@-{918{1Vfse0;b*5&KS_==Xy5*hd7tCBZp9*g{g|FV5IM@jL&b)r_l_rg(XWkp
zim;Vq1+-ExIVYrOdp(Q~^XcDGe223;K1kj?1}e+z7RzhU6DVP>{jnm4tNHaR;B`We
zYA@h<ARy-Lp6re4^`_%>UT=YBH~Z}>U>ueSL~KjY!3=(RY8R~xUVlAVU-KYsM|;~c
zd`5QQyMC6ly_K8)5B6Z?AyxmZ5s~XK;6^h577q{al=Q-nxx-y-9z91EP*yD5%wi9@
zpwWY}?gZnYe!prH{03;*L2rxP!7wfHjUGlRjDYsy4XY%}Z>!@O__BVN!V&BF8mYJV
za&3TOwb#%d<E>q4c`5HiTJE`;67Yy4Zz1yxxm|P}g>vK7e11-iLARhd@(ZOTGeI<-
zfG0zlccr?RouP6)v2*qZO+1l?v^L@daRL_V#dq=_FWc1-F2zzPf3K+%{2vji|A_bd
z6PQ~@3l=59ler{L_n-FKcI5eOGz4=)MqekR2G9FuQPVpmA1HmWp81bEoRPw5ilQi>
zsyPQ*<($CEKL&ePQ7LvpHUCTY&z$^&W^`~h;dWJYP~r{+mFBl`3X~Ql5cwA`qh?ga
zg;J{u72VfQ>p^)Kn<7;$petZg4(ABTfc<wFK#1PQQJ)~uf7K(LnYzQNVNu~j4tl@~
zGd@=evGFEWRxnuXLWD^Fw%I4XkkCgTpJ{0Sr$%(Gqf%^sx={H7U}Yj~SxWQsp-)au
z*5#L$meT4P8rtDsB!9rZC?vtYpeSec_e;~FqM|B53ezrUW@p)o%gfEbsHt6%&d$y%
zl$4aDebvxtmywc!O$Orrv~{>Cf<OvY!Ag-Cx38}c_!Ra+LPkyp-?nPC`rMrg6|tp;
z`@=mQ&N2XXK`!&W<!mp0|6<LwUIBQ?u^geH@s*X43}|NX0N^DahM<F7^#6|Jq#4}5
z`+q=kLRzzNg31DLkVbj{G)EsmbIO2*hGIa&`+u}CBp?0@%5ney2g-RO1f{2?ZM;2a
zzxCXt4Iufpvs8)GMS;PQ-AKPaic8QTF@W+AP=9?a14mMFg7ScW4)XwC*MYwW!<D{R
z-BY96N5}SM@HnQm`oBC1SpnJ?NTJ!=Il4$#)UfvH&%zU0zxCmNiX8BOB8T2nybssw
zDA{8{yM?=(9pIc1?8AB*LjfnlufBI;^KjY^w|j7NgTX99v~|I>+UQK7yNT9{Pi-t@
zW=Ps-<<%4aBA-58+af&9!oLKGx$^?u4nezt04H^a6u9dJ{HiSg@T3RSW1NUp36@i8
z2?O{ZI>1GF07?8>fQu>we*FKERIVzQ%>GAL!_q%p4dg6&0Mt~<-pW$fZG>3HUe&9C
zz&MG6q?QTW{lPf*AG+?pVPeLS4M0Bz6Lv}hKt%md(7ARv{epr5J+RcWx(TepI-V8<
z9>9F@qqKy;>c4$sX%`H7?Q$NkySqg<j=s-3lYhvC*B@zf+%VmZtZO;Dqsyxa-K|6q
zO8HZv=c(mQQSP7l1X9%szP3{ylSrwdkv8?lFIzdykLA`c`*^&y)JM{z7NBO;L~HVG
zR6=CJ^kF~P=)pp&%-+t_wG99LE6;g}EnEhJ>0o?Y++f;=(Imgc1Wuew3YIpdg4_Y{
z=}KzTh6^+SUo+6v-8FK|*em1NJ<LP68|<n_b;%h2OtJIAI)TKkAyuSs9iHWk{d0ea
zEs6U@%;>=wK%LIT2A>Qlsst;6su2KBiw6!vBT$x62poz5;4l~iN9$j$Bt{Qk0h$eH
zBxwhF1u8%1KFQTT0wf$o${$+EC4mhKigma1@DVf%0fWukd?*D*|0gE%8kn#DG?tLE
z<Lm(yUL+4F!7F=?IZs~LWv!?A<`%K^91?akDolnzu^5KOy$Is~RC9rKh9YRi$AkeR
zrIVfFu#Im$cI9tl;%e<+8`IX(?$S#C(pQ|kU^Q?Xqx9J_U6UUJa@&Ymzz`=RTY;1K
zUoo_AO?Z*QwD()n`MiY%Xl`z9MZZMQQLzLhg^PRd1u-R>8&xm27_pa7&#mkUSL|2L
z%lxuzm!oNh$xJ$A0j}yhz;Rjv9Vzt~S|-3rV}&eb&;*ov{12f*^xz6dIEI}(VxZ|q
zEESw{G{O>ZWMl<3R<2K6_p9qnUR4;PBfbdj0a=jBchzQx=zcn~lDiwww)cU7YwFqf
zO%IjTXk^_0ovvyCR_BYZ<)1@{7?OIUTu0pk@&%`h+5O4^x5&hNxv@vEFIo`4_oZq&
z2oq!gf?(co4X2b{+nLPVu2!78!T_FW4k^`abGiuPjzLk#v9=3lh&+fut?QOjSGOXB
zrTXiP{h9CL7YztcBq*bu`|A+<^~<&jM;(;HkM8*eg6cmK>?gKk+xov*S{+)&1Jo%w
zCk(sW2IS6bTOv5<xHd7;B3eGZzN=K^-Wva-c0Z8q7nDy|?|fn}qCJj=OQ&<b^OH`2
zb9{^VgzZcTj*vEmkENaIta^80ZLL>pQnASQ=9BR2y;^2fwD{u22km9tJ^0TT<fAxC
zmS3HumkGP>Tqmh?_WU0Ed9y+df^sLQP$plAd;L5K?U02UVK|i)bGG%NGTpekZkXkK
z;K~jIJ);ApG1U7-Uyf;dg%u^zN-4%Oh2c5wbUz-a_wnCs>1Jr9A9no>r(m7=8{t}F
z1Fl1pvG78-_-ojG@CAcCgSPp=il~tjG=g>)w0<I}fOWQdxquhOomiB<);ag+FQT{{
zq<`pzx*uI~E?eBgzKVCLApX|Kr2{2m>mk{35|(B+u(ZTp0B>{gaTFE~Z?IaOjq*sA
zZr>%&_H&5$-s~(*%uHJsi3oD0kOvwbN*TuEIg>XXo~Lp<z4%SON}Be%SSd9`hhpRx
zNs*{;0u`rnc3@N-s`%+{j*oYsBVH<_rr>03-b^X$+-zsF>wa#rdAz{HFe@(|?R1%u
zbq)5bjg3=;QeO`SomCcJC<m=W#E5Or%2ZZm%3Yhdk(U9m<W>MU>OcKCJ{XM3z_lI^
zT<8C9_d1&!bl`*~@I$7%+`b8@rxRcQteq`sJ}!^#aY7JbuZm~T;S1Cm(mQ0N*_C$x
zEy0bs<)ONpl<1`^+}1y8Qo!pw!mkL3=IQIT!xiZXUa%}8(<A5UR=@t*At~-Fn8a?F
z@0NLMQPW|^gpyB9N8*f5O3_h)b)p_R$a3_aPK_wJXm~{C1PsN)WXR1rtrki52^}*v
zA;z+A3}WvSjj(;iTVNedbRmVW|Ksx(k~HBO#f!1v2U1~~o{h{HE#}<Xk7Q>h87eRI
zIMwm4Dm;uQ>Mj9^a2gBRJw~W(0bG9gb}Z75!CJi{Ug2>Ba+U)tplid7w3Es%ESIva
ztq+N}WiZgLwkz$^(z|_BsGjM%k_w)f>>sug(}?3)ZPk4%To4<l*K;h5p^=4V2bszS
zetQP%F(lbc2_(J9`F;!85v)^|_ZC@7ldwI|#pXga{Xu`Y#|}sMSygK>>U8hJZz11r
z_u+h2ga$j3S&qJ0+}G`q&4J!K3ENlXx9^j(@$#baVGO|YY&<J59uG7S$eE<71wEh4
zg{RI^;KQuq>EkN)&DH~nrSHR#Hm{_xr2h!Dhp#35S<fg9<}X*tI_|+bGohZ!v(CkR
zVM5xWs$FC3KYzB&cgZ!ZOykdB^;dz!Q}-ti69n8j8pq5c`=5RCWNMK6Kc;q(=(F6#
zozah~&y1+(r>in18lN65dRK0*#M{E$F3%nkHFgU7DE17XYAz31DQK@;P$w#lfAhmC
z?ZpjRWekkdl7S|<M>PumCT9PLNlSZ@^-~MY<!eVaQ!1N}C}L5}t^bJSTz!Xul@T!-
zq@lpVY#Phm+058)CPQGblagQh7n5ab3zH-{Vr7_gv>c;L1f>P02Pj>t0(P*BVt7#U
zGr+ohE}nqr2`ty`D*szofHZ;tFwH>S+WZr+r5Q5{)%y-~bpdy(LTr#d3N9t(0-1k1
zY1NEImu4ZS@!5gQ>#dZedqzzBYl}I_*e7P*lI_^3PyU0R4j6IS*V0_s$`|IROrsO}
z;$M!4@Ak!A2^X{EWh-_qKirvh?J#h`bS(M+HbGxh86`rB`d~w_krL~;pLM(@RqGx0
z-A?yK3@xPr$W<tAnteG5t`ylq*6#bw3H<lj_k!1~L2_2yv@{0`!)DN5&ZzTDOo*0$
z6@&k71V3Z87nVj|hF8_z3@oc|kr172&Nxd@*9}pJ=d&1#w_b0fwP)NeKFY98*YxG{
z`-{lP=Nmh9k(@QP*SR-MAU3AhYzDkC3L2t0PY;IcK9R5CWgvfybq;EA<7{afTat7P
z<57aFNDdI{Z_wghpP&c_uQ?0#PMKD71zK*pv%0heSq0b@E%oO3MJfmwpalpC0eZ^b
zwSx~7XK{22ep77XxOG}yM09aS<n2JTKjYq`=6a3MF!L+2^z1Re_6z4F<!a78cI;B1
zT*N)|O7m`O+aBV60v$eO&wX50#NFy*_g8h|>sh<RFCu`%l=iHHfF<@JhXMVxWxz>%
z1nCs$A-TN_i*JNKjsfKuLxM;9RkzYL!O3{AFVUnsD+xl2<ie@<J3od#cxDN~pW#89
z`QWPf{yP4<EP=wDxI3-%W00fss~0Ed1mA|-2+YOqRZ${h3-^2~IP*Bh)G}CwZh3K0
zg%+edbtM>$s!C??$9%)hoGvWPdvb9tY8cPMxWp78`?n6GoxPD)4gM)zTo=Rub&gw;
z!oVQBi32*U5agV17IAfKI8Qe6q)+kxWoZSfAG$M+{Hxg6!>V)P;{0wuDH(8nYi>qV
z7<J5X`EslIb~8Ng%eNBu>)URR#t;T&M){D6P;S^Dk`29v%2g+{OuT+~azBB8P(9-B
zr=Q{?8w88uI=JUcZ%}cz(m8SSxG`<f-&%gcuU${`kkm2e(a#~niN&*aT2HYzr^AY^
z-*W5h-QQcA<{{;J)8(3Hqn$dNR1>b@acyKzkHo^$CSq>D%ollJVEU2EU~UzQUEjEE
z+;GuBy#APcb&<6ooHEL{4t&Cy%A()_UmU{O#Ym`*9Xzvs82x(j!;3f!vPn0xyeX0s
zP<afi<vMty-h;O<bY7xdlYc}ddj}3xwL^V_vn__j)JVlhTdHEvDV2~quWJukhHVW@
z^CgO#h_j(85O)zA8qP4WcN%6y^rg8(trNcN^QvVi+U=IESy-EQnw<*^uz+{`$nE_P
zY=Kgtp4beJd1M50l;J1_3XI7RTSHZQ{@O>X{Ab_J4|_3{r3-vUV{x#q+pDK#)x(|Z
zuB=x$yjg4?OZ4DpX2{L<^+Panhl<2tEw{-ZD{Yw<Xqn8Jzi}4y;NNx)G!iG@xoY5O
z=FiOt1W}2d={n#`r!Z`T34`BLFA{cgvZK4&K0g$2P5h>qf6Xa{cRuyLzptGJb8v?e
zcvW$5a0F&8eafsykWqbu;*Qu{FrX1R1+>}=>(VcrZ>DS5ZWMj<Fgna~ko@LdZ<ZvM
zgRY%n`Iz$aBb@jj<XW1@sifb<6kwb{hF~e52O=4zCPZd~D4E7I9+abL#U|TI_~jjG
z7wiUBRa|6fEObHptiAqe)9EZP*aD5Nj|3k~eM|{{rLW!Zq%rfIK`(5e%`;{_S#Nyz
zBb1)gXwE{=2Hs)p1T&Z$|JUyK|87$ZC1*JYL=wLLx0vh>SZFi4keWYs9Ojf3?CB!3
z(1*h4@0|7IL~m!ifa^7JRX?0SDQ4(G5|*|c|D21>V=^gYyTZ9(xlN|<797NvQMxe6
zRVF97%y4s>dS-dJp26#<v%Y>21>gK&a)Em=l3PiJ9^k;kOqs1FT41_u{nnO(>5wY_
zg$LH$vH?+3an?xASBR{u&Cmk5a;px_O9S7&yA4Bgg=ycfyor{Op6(=3pgY5J++yr|
z=S3#HuL0Ur2N1>cZV@7~k_B~Jw;^!4>>Fj+R@%5W<7n2a8{OmtUR}V?9h$)DUk##9
z^?fRp!C%caWVQ=(|J=lpg`P2OgD^-$gZzt{bOp|)KvQ*2BaDInuu8eC=c@-=W*z5-
z`_m_+&rvF!FQmvSdS3$f4DzIU1;^D_`XfzsnlvR=1TM-l%t%ZfD@Av|!>`3fius7G
z=e0#fTY{IhVu22@rh{!5EOi{<_Wp@?%`f`X*55xuKc{b7aCN7QD{La4%!9Sm@j-22
zBYjs+K3Y=G0>4sX@<|fx<G0hZg@xy$C6{MV=uek7W8QnAVJE&A=GQlBRCB5YW5m{0
zMcPshw2)n-*5zP66RSlh5gHI>q?OAD<whaq$-@oSb_&{j`7MUWx3=R&E24lm018UH
zNLlguefQ%T>bv?}u7^&{j|*?0#2_egpJay%WNZaOp%U6{vMEFR$JO879{FR)#50o@
zE?8g}qq0)8RpHj{oQt_wPxQPr3&@s1{ZAAqbhC$KfPr!LLcFP@m<qzxZ0sK$3a4Ko
zg9D>q?ZE5K_6}!zO4bY!$2kk!3_?E9TLV=8s73g_dGSOdaRX@H_m{QXD)ZoPVc28H
zU@%huUt_k0)Fn*w;`jUa(!%6<<}xusvdC5o!mpxWso^<FZ$f0J^=V=}^$GEpAm}ZF
z{cUG34Wvn=mz9p+<a__p79AN$U`ZG)=bxjF95gNt&0ftfiNw1>728>hz5c{{?!gr#
zm<IRB8FhEIH3KUMkA~Og-Ww2Sy4GEgAKEVBE12I0H$^k)ydVdAH&pwahb_p^1sdX0
zRou9FfA}47ivN$;F27BFxziN2!`*b>oQ%I7Se-{I{(*3b{n=S^_C1R?M6mA3wEd7(
zbI#k@(GbiPyHeT!c9!oZzu{cgU05_2_{Zb$rMh!l<L5i3d_E=wdioO9o2ahnMjERU
z@Ar<-B)lSJeUIa`VNqw|FKHB~nqTfDdwpz4s6u&ii}${zzC72HJ4DdUN5M`B6x%Lz
zNj~^NY@5kz-F_mx6j1jrQJVtuT$@NWcXV)vY>2xl%Z9fIBxwe6Dce_+W+%Xgm!YTG
zKeD3(>buDPNl_~k^3dhm1U!z#hohRIU_Q)pQSO+4+7Nn*Yq>qAnqxwvba_3#qF=bF
zY3)m9_J6JQ#IuN^BAlP3HR#h)EKva0zrU~&&J=lqZ5Paki;c!}+6=;G(&DGdbv2KE
zCM|WI7Ryd!G}V(E?#{@A+M(4CtVn^*;#M}cb%iA%Si8S0!(m^-Yhq5+oa?os2m=PY
z<};(1fpp!&NHy3LWO|=~Vp-t9-xhET0bQvVfKF!+(CL6EswDLZw4hjEyaIuO&kf)O
z(lgNJ_b&H8vHCVLU{r&mF(~z*4y#{p=5@BEe{m<mA#;7i&VFnQqp!|Y<d=$&93Ti+
zYD@63lKg*h_m)v{F59|r0>NDy*M)m<51s@I5P~+)cyM=jXe0!8CnUJLyF-Gz(>RSg
zx3l(M`|Nx7K4YAF&l%s3??;Wd$G~2yYSw(_GiN<>vv>&lnhTwfJqdcD&h+C4%a`XH
zR34@DAfrQ;s?3PLAyv9WXCASdeg+G6Mxvx9$&HuYBOvTAenT^27q#&;Gr!OYV;hrW
zMQp5M5<B{5P-eNolcKE(gxpc-$SmdytCFDm7k4@<)IaZ7#h!FY2amik%KWXw({F+i
zs_t*gDSLqP4Nixwa9PLG3OZEXCF;)D>NKp7T$46l(lSDqhO7K|k@Q;H>r5=xlDrS%
z49i*8PU7~R;!lT+?8`rBJVyZb*67hbcY;$H$GHu)fXC6>unN9Fv-jkGoTycDeSD!z
z${=l;knQ+Y#Iq!FqgUOGNN8DB!V!SDz+$($OoS+wvUc|R%&HH)!6gS}hFQqbrlU&$
zdmck78K~P^*nou9s%U^4A2gIm;l$r6+fX1@V$;?wa(S7yIe^R)TGuaC29u`leeY64
zTq8=Eb1@1(2XyFb1tdTYtv1CvtLq$kHxZv?eiX6d>U))iG*55M2ctE)aHawxHuVK*
zZ6ihStiB*Eds0`pL`doZSsM8kRqnR<L_|gG&t*AFU==DZRtYz%`_-R0F64{A*MTX!
zqBY|s5+b~QWtpH6wsSErnEzdb?2iQp?%O8=-6QU<*vmAQ$F2zD#amzEsd0#uQS>oG
z$BJ_)L{RMg{C_EK#T`McSi7vv;E8TUdOOZYptq!&6y-h6XtV-A_sEDk7aoFdoxi4t
zGEsVyaq)a%gn+s#75b>n`vr)0=b0oHg*$PV03%Mp<&pXKfnH}%Z_Sl~Zv6S3s1&}Q
z+hnQXZA{cbkHyrXSQ5kNtmjAjIpA=&fP0x{3Tx0gAWPz2b{^J@;uM##f1GB`<Qg<V
z=fC|KM(tI?h*(V+EAYRo6a6KL;-gwBW|em!W#S1JlQC^i4dLBsd<iyx3+;;?AE&80
zgSE4kZrG>jc)LifY(ZyO&kNolRcbJI1h6dueaWrIZ99h8ah<sz!ZnYFLqmsf%mux&
zWoO4|w9)i8O+It{k>FS%@CC_NjUZjv8JC2bIQ!bm#%-3xjZ}N>F3l(WMS1S}JI0zz
z5vXbW*vKqIl^L>O;q-k2TwUfi-%VMX5l$klNz!>B1Gv7{o^_lvC)s@e^n!BD8mw|J
zfX(nMfzbI`krKJ7ZsMzXsFCTrwSz2}Kx}PXOQ$9=i&R)R#S*S%hgM`MsAn-NB*Kvd
zCsd+G@U?|gMx~7QBRU}LXoR1(ZxBvtQvJa!XVVtsyF&x_y7{KVN-lEdTT;&5;BJNd
z=Z=t$Y|Bzngw*~LsMXsuqtx#K<^JS0E&DyFTnNp)O?)2Ejs+qYu3k;u-O=GtODAXA
znRjU4TDd#6y?$2lg?*$+)qdI|B8(#kW=Y97VAqTWoPJVuw6pwy$<Mym!MG*Z_i505
zk*Y8x8B1|C)I4j`*DQC;N}%`v)>i@k(`xagOdZGsvG<xh+u9w^8Sm?+`1_vu8yW=~
z`GIL=1<3&ZsS9tFx$*Y-rDXFCQ4QXQn@HNsS{Ofh_WP(i>ncV6ueOHvfpwAK-hyXm
zk_;>h>GOzhSL$9qsE-Be$x%F&(X#U45!4#%O3^uN+R|*eh-8XK`*XX0cwJ@Jn{gpB
z73+RreyR>dz4m&ve|+)|YEG3H=Ox3U?Cn@Q!K{j4{-CB4_;X1PxzUUKnv!9&santp
zLt%~Vl87#0d*EFIoTVB((Sn}rLbK|}U)s6}>P77C(WIIF4H;J<XtgW(y1_I0k2pTh
z<4=UlAvte-bpmpi@O4qpB^73b*^!48+Ym#GV@}Ij&`o&Om|5iJi;Zs@WT@H7i4q95
z83&?6(=wQNc%#-lcriKl<g0K=>=LqT1OQl)4|b3C>=AmRou$Pfw=cjqiM^rve+nD=
zK%yp}Cx+g*5GgFZ=InI$U6Ep+Bmu%M3tA|gy`f@DH`~n_^*L2L4;J&BTt6Yu#se!2
z6J6?2uOzU`Y2PGOrp?8Bzf?riB3k{396Zt;wRGTYA7|MDw%H`C+iGK6f8etA1uHQS
z%jx&Le>@8@eyq8cwjr{nm$un#O#Li83{hxDyg%UJY-v!MY4e9hDBRpGNly;Eo_A?t
zea)4UG;{M6qtS&LYnXE1+1@g6q?+cJ%h5gwpE(gD(;|;<-l+S4LiPKWrw}Lqt%hHh
z4%XK1G=U8Fk}bDwdH{`^1(OHe2azg$8P@WWBMOEpwI#5%hXS8@QEg2a9Tc@5n07Gi
z>647U_(#9Hx5>E1@P8+ZAXIc{^@itX_<jWHRNa-4&u5B2peT`k?qV$lbPIc-S+1hT
z*H>nUFtIRXf}7KyfPHkn>)|ax$dlfrjq95U`7bH!BAVgS65HO1rF|cqY!hpo$0LlQ
zk`k%$Q{*#4G6M?WaHzD7JkkDf-$44IDu1QGN>m8RU12RMMyZr>^MHW^H|3Fytg|{A
zeg5jVxJPZOMRk3}!cv=#jv7tVN8`o2rU@~g{&M*bIMfVp&;X*<6a4d`h=$rMd(aJa
zLuHX!Le9B`jw4rRZ!FURMQcMhWT`m$rKXu(*@^e;J)fI0(i?E?m$W-I0fLydibUF)
zy+b3M3!btS4YG^fUnABK1;;Xq=;&Kos)%W62JPo{``q;TJ^G|Izok`)MJ-v@!D{RM
zLVT(+rcH{9_IjpX3uZ~baFZxpJ>W1XDka=5FfkTh<l<}h``$)z5i^b_G2c;Tj&Hry
z|N8x6Ax)P;u^h*EbasYKb22hzifLfjT$ecm*S@;>amvov^ZQ*j-Kyr`p;(!+s50``
zHJk5V=?3CWGSTF=3W3M=EqJb#j1sKCJck>_N_dk%V2`=7@cuv`!u5wYOiU8)*4&7u
zHx>&YdmtC2#y;A>=HeVgI+<R^;)A}6pCt2q-wp68X%`!5NThU}nNYz)A6EIoZh05_
z0Kh(GLNmF^>6LJ(;JbV6bnJ2?lgtq{{Z7%h@w_gE0qIE?WfG(6HchwTdS{$66cz)4
zZ=LU{3K`@krk8_bQ)Fz2b0=-4c)xBk<Kof23HC_2&*0^`1eu0Eu+jb;s$lu4kN0=2
z$p70UAdG8lBQE&@ruhS6VQ%%t-s2Vf(*+!RyBk=#`241qm_vl)8?^>)s?HF$ttY<k
zP1X~p(zRYrW!z27j^R?(bVn@Sm7DfVWMS1S^CxI~|MOJ4|5+koO$`tAb2RajukVkL
z0}gqW*$<(v@APh<zK`<hPHiz8g)UB004nKwqlex0$<9aqX>)69iFW~bPj}ZoFWVV<
zi;7F7fKQ_7_nXgXqaFRyp~Whznvv$4n>T~+JVjWFrM#`_R{pqMA8x<rinQI$E-Xad
zKEX9O<M%}v9adIR(R%0gp3kf8fmo?&MGEA@Tr&Rf>N%S@gn#;Si)cCrG7p4!-Nt-C
zc_-&C!xRA?{_yDw+=22Fr5N4f9nBbJ*2AGdiH&J?LkYgj?^93@Gmu>-SOkFXl3f-t
z<6%6VSt1Gih27(sf?RFI9+}%%hFIEt-r~z3mWEb2AYPwHKQXz2g;Ux_N6wCPIV(9&
zz1YGt8PhlP`m8x_YGX-GkogBp$yxG&L!%iSid7XaMPkSl$g`!2xF0tguB=aT)W3EC
z_bEx5hyt>^@SNZ?#5n9po%F(3iZ$mDQS*JrSvL&OtOb7ge@}P7IAc-P18}RGJ?)Df
zz#c<XDko}$oXkmR+s|i{MD?2XCV1Luw27&ikU9~-boTl+^0H$!W4L|buPEF$LL#Y;
zS_9zkAB=-Pa`Is7WXae|GU}F_8U@iS^W=ZUn-7GgtnI=YY^*@ug*YfG#1H~lZwm;*
z*SHl!tH8ELcm1$}0kkq$Qu}{Q(-TH~n^s7&M{K})nijhUzlh4(_{Ili^d$}-_q9iK
zxz@|gX~em7#xO6;GStfKQ*L|Rzu6_k^Yb><0=kn4|FqNo{EBeWcH+Y&wzlsX?SuaP
zt0|tToWv4_=d#<UY?e;)=Mx4w1Iqh|$Z{#53<W!BW|#i+5^)N_Wl`~WS<qL2&zYxq
zpvHR~Zpe>PZ!qbd{`yIbHZ^ZM94{|Sv*_`nlFa>kj==M5Rwu_f#>R;91~<8~F+hE7
zREopvBJCOX`APg)<6%DQ3FT=^nemyx_u-pwaGp>SG=1iYnMwBDXOzt4y58}pGnQBR
z`P7=5L~RXg{@-kGU6Oyx+t$I5&Z;-)))IztYiW{K?q2-XxV3ur;)IEaA}8vLA^-21
zq5u8;1Ji5$|EM(NpVszG2rn=Gdf@@W!(oeXW~+Q)uUVE98x_j-<yR7*iySoTY5Cdz
z_R`FJ|5(CPop6aKTB7&#^_gYr<OdS0QGJgI_27jjN$E7oe(}s|ITt2tj>AWoVx@w<
zmY!eG8}5hElV@t56M#0dcY4eZ=GSGX#19zlUE@kZw5=70ifoqy%9y<=?GK)0=L(Ws
zrJcY#R9CApSOXi;FHfwPeEs5q5w~nx2}ybRH>baP^<@NM$LoF9*(_|fVGHwc0TaHh
zq0#)Cvg`j(79~4d{=F1lst#<1_2r^{(X>-ZRO)r|4$yth3Q%w}x2brkF|js&K?@rq
zMl||)CH2+R1Co?gW1)pa(={p{k}{JlB1*pg0cXr*{&x`@`~w4SA+s{uMY*C}pAt8%
zmH0A^TVy}eJ@)+gI&zMvOewluxK8qogXN8jg-~WY)7Og{P5+29$(FZ@(jysvlo=&`
z4bT{POZ#gJaB|h7sjVGSW%$~*Pff%-HU{?{{3RV-!P3pf1Hg?45C|(3TK9QRcm^Ik
zT@Klk{~$X9)En|;hKX=mx|8$CJ{Pn634#Brw@S={8Bq+Z)=C&w=931CDu-c3Qv<N2
zHG<WbRMKerXu`^Sys*#OG>}=xVL9hnSk8G9R$F3?74TmSLVt_o&a(e0l8eDM0)6F<
zQ-GoO{+qAw5(TS-I-=f(`T>uI+SXOZ!kSigK~1=O5MQOtb({~yJJRfY4D;7LS5kK8
zoT%1Gk+xFuM66Knm|EvDOY^(i{6o7$WEiW{2dgQn!q(g<L1)b&g!`*ft_Ma1QNzTw
zCt%EwGc3p0g1v>HN30nDlSMy83pRNH(@lnx1f?KoK`#G{jbMdBGO!lD)0>7sps1FQ
zpsLqMPT5KD$c7L*a@>ivN<_`9jQiFi`o<zguC;I5_`UVzDU1a7F*om(totUTh3N_O
z%7Rfq6%`RJ^@MQ4I<Wct2AiZjg3ha7NZn@>utK!$z%Q4uxBZ`-Tc0o!Ya&}!RcM{j
zr`KyzCK%S^G$6{WSG3@&$zSzqnj3=>ayB&^Ln*YJ3g%C1HTTl-53O9QLCwcX4bVhi
z^96oA#Kdf7cz`(wg}hu9`?-n0@Qgo+W%O5>+p_&5?-8*I-wQQWzk0vX@2Eit((B7}
zxI3wOn+~VeTbJx#A6LAT?XIQDZ%wB98#f1(mAcp=BsR-!!8-Le8+VtSZi4QcPY3j@
zC93vjXjQDN&;%1}BfR3xTI71}U^!LVPZhzug987v%eb9}1avMcEyzMX4kd6<`9}p<
z+q)cz*^`H{6T5qF&9=0EKEVd=%yKwIYvJbf?hG`2ZmG6ftFbj#U|U}q=4L2i*72tR
zH38i4Ic)1Y!>r{0LOT6pw=Zm;?7LCxPETRqczk@lwa6q4#%QoGL~S=){z}~;>&nNT
zvOrS_%6zDeD6BcK!;J1+T*7xFHkVRd#MVQRN!Cpac`wfx<r0#hfq$%989GFal>af(
zz%d6v%&(hWR)z_*#OeXKfZSKPRs)J2c>@lka(?`X>6q(x!`?vs_9ZDfH!mp_=krOJ
zPH^|qRLx-+gGz=yc_E_qhvp*qv~16}Q5gQ60Lsn0@fZn3eq3kA2j~($7VSwUheFMi
zok};(wc|c#ZSxbC@tsf?lL(?~D|(LMVMzY|=fQ?Y6J?%3%Ee*`+dHZ3Qo^wxz^==n
z=B<`=e`gC}akj_tA$$_O6_~6c-@L10@>~$@x6ec@PFvax$7z;p=UI>FS!CRO(_18M
zp!*{&o>rxx&?^}j`jA?s#{QfTsJXn**;Is6Pi}4hc!ZttwZsUa7HY#;=i@h~{zP^d
ziQlpKMB-p^W<R=w>Z9U{ZSIWog8~$GQR6>d3dcI}#j=tzhL-hoQrstqLpdW*%So`u
zsecAA5qtfju5jz&hh_KeC&W~_M3}ykg>@XSi)r`R2(bp`k{@0pCYw~;q-F+!4tSW6
zOm7Pzi`A##k(kW7`^zt}z|v7c{Qic{AqJET`JOjcL#UibQTD`9SgrPVL8NC$fQnw{
zZwjHdMx6X)u*)k&<bXKP!Q7l~_k$bS>$1kq4{_<riby>zMST!l;(DcCcZ>r|M+oD4
zxr$)=v5a3K8Lm7L%?y<avvLYu`_k}b&A@=?O;gzQ>X4{flSuw8s-8h?v+*CW#%Y9l
z{80|Wo3GrXh!7^JhPY`!`FSsSr@>3NUMjOOw*)KrBbV(m6^(2*V#6}I?c_XTnSq6i
ziuiTP6pWCw09O1&0hq@Ae~&+hA%ZJMSRQK}iyD%<-~-)|d5Clq^xzO?eRcv{RnX(#
z+9@KRy-dU2g6ET|fa8-HK(v$u1zSaY!I}%A!k7u_I@^aGk4`X{*GRJ^+K8>`^FXCZ
zp$ltg0ILMvh1s7i>@=-}ou;KQ+na)Ur_VA2_hwAp-Q5DtXMa2$jz5#pnM|8Mfe?Ud
zZr;;Kgoq)WQ|*3vS>6$N`yM?IlFk7hR02GfuX}Ai^C=vmi<Nj4UUSUEa3%HhQkOv_
zG%Q8mH6;{FNTV%Y<v4g{WEsc@X~beqI4k#IyP^Y57xdxHFenWC(hT4)uaE4zw!~y-
zZm2>MZ@-#D7G$$MzK+!J1|Qn#BqQz`&Nf+%uBG(Ln9mjXd!}oagj~yD-0WUB<oTl*
zzY^#WVkOPna6Tljm4Wpi4NP2=ie&xOUOy4%Ng&j;;>O>n*pbj1>*Z#tP2CC}6AXC8
ztxk6B;ZNstfrQ4Putlk}>2~-71)R_4^Gf3mJFgt|0DrI|81oO=KI(6vSMtN)WW3Sr
zdJ%+~KE8(7*>MEW0iNx;*FIcX{M&%qQjl>duruzCtAzCnX~!YDENNz^%Ji#PTaQ7J
zG{{gZ0?V+aIey$;XlA$WA`WJB)9FBgut3B|4dELR#z6C`S7UO@U3|e<D}Gun7e70H
z3ogKDGbi{y@LH}>*cU*?mO||2&om?ra&PGtvaOx9p)<y>UXg3ba|4Ri3+d>Wct09c
zdB!Ng87d;sia;|3>YbVTL0*MdwsG{I;|8F-{!Oz+k?ht6=Yf)pC{17C?O>f!?K7=n
zD#N)tU(q9y2sq249bd120@8OgO6hpSS{3?&a~;0w1}+*m>X0Veybs+Ll<N679y?s~
zay@n7bkM5z4v|2`A=<SscDoSE`B_1s)XHO7HsZyL=ZkmJ5+6a<s(g@zzB^Sc!_sl7
z69<$(H29bfirOqg&bQnYt-m~`7D-)fd+Jv3iV6oqD^+S*!GYh~Fl=_O4V=yJ&PC@d
z9?sBpe=b%uR{KxaVvKy0-F!en%Xb|C86~h~vO@9T<X^xFokCzuKXPG(%#8SnZ&8Ek
z5@Cp?5QbR3!{}QAIC%wFwn`nAk=I}>f!#;=bJ)ofdbB<p1eWcX)=VW(b8k}{8W};?
zI^i?t?!%OQqjMMNYiesMcGW`?O{X*xa~Ru+YS~K7e=xtXaDdyWTFFU_G=mjSwfcb{
znhTMME3v*Lr-RRgULOjhH~lEK{GgQ{v&4VPSVrahE4w)2Dpxb=XN#3cB)G41vEH7a
zkGvdhxPh<jhfg?6JV1*n0!?r8^C$Kd0zxLtCP+p7IF9Qzp^fw}>-Z2|<E3WZKUUkq
zN%`ZTH0>{f+vBrYC~eR6)(5+ZbQ>K2OvcUUXL>Z-D;T=1_E?|C^=ZXVX89ps2|X0V
zA1~A%CMh3ro*vtuuWv?IA4a9{p*rosl#dX(2Pn<6sZw_kOrMXnz1EY}_Yc8Dak8hQ
z_IuZxBj0;lX!%q7GgkZMV*6<N4$@1}<4`Y-oc0)f4WG0JQ=e<`2a2b0{YMO%vgJ2Y
zj!2V(HXEZ&KFPdIpJZ3N_Lc;1T1jHjZ(WAQbOm)|7%`iof#`2~Z%D*nCVs%#g`Mg3
z6JzRf8-eTuftnZgoBgpC-$EVx^ct?IDD3U+!)RrNsRaqN<_U;!Yz-|dF;o&s?4oU#
z&`Ml-7{hA(LXI}EUID$d2%~bZoDp$P^n*hi2@YEy*Nh6VfaS*Mj`ORy5k`mh(wDe2
zlp@lSB3k0}AvZyP<hQfSvH<2V&Lxt}`1JGk{kjl<ThEJew)T6;s9t*KyMAb1oWZON
zY;*bV1IijdNjE2V%?YCK(J2xU5qH~pz6`i<UW@yv98F)rHHHLC0ylbCc34n;U5?7O
zAdSA@pN5c-^>@8t@`~ayNcs?{o=RDYNzKdiVm)SM!@Yqc_q>^N^2<x*I8sJN1%G`_
z^!;!372G<={j?1BdnzpTqaDv#t<^7LHkP{VvftRdM(9)~f_3a|{Wm@>Ew?s!#%>%Z
zVoOSXX=p|}KBi_rT^97^!%p<A#*296uyWs0Z|q{~;xaSlbwB*;I*?u4Nt_zeRFr-{
z+pt@O6sY6eImIhn;X7_)Z(n11O+hALfyz*xmTkpG4be7n<an}gKkfXXl2-vq=I`2A
zF^6MYXg*uGafN##t0&jclMUad4ABh_V4uvjL}Xub^G}{5f)*>*oVgj5rGh>tt#Tb#
zaO6szbed0MU!>Mi&UUR*vD3dVx!<@$P&oOChNi49^>$6-VcLhvrD0hv-h7>)RAdHF
zq0dd?i@p$+jlC_liq^D3b(X_sTKgIN(s9Np#sR0ns2_9vIIth&vx0<0YlP#xN`AnA
z-uGpX#eQS~Evam|N8Q$OWbYRM4byYoM3+oYFE9H*SwWm44ANjOEiFxbkxPwOdjPgB
zi@_%Cl}KXkP%Zw)=uypMZFwJEg)JXd^+LY%Uxpn^<%P$yX<%6gxWTF(jcs^KCbg=R
z%cW0YBwY~ASD7@%CTfV<Xo0mz+*`cmfftn2-hOt&&T`)zeK1?TxiAezMnCnf7l(C>
zZS%p<;Lw*o?PY0j*<@zdZwz^nmofnQg3<oah_G^PyO~=p$X5o8rfXJQ&#_9vwz_4y
z#`C)UA+S=c!9hEr-w0bIhi1PFaFXHW9bUz?>eJQLr-&K@-8QdxCA*Z^LGnZG9Eb>A
z<GaAq?Y+HHd<Xv_sBVu;@7fD-H%~g$<`yq(BK$}yUrIOT=PR@iGZ?BA<@HI(jV+H}
z299o+`$YK?Q7bH<0{}WqN+x|t0C(HLL^2xpa?<SL4}~ngm+(T<QWEg+#_Yey95J<+
zua91G=nL`do!VWiM#!U{w5&_TO!vdHhj+07__5sXnfupvQ2DVqwuwa7cJ@)Rwr`jY
z&oAr(<MQCsmqkIYPB=a+Hhz?g<6Z6mtOlXp`a=ghr-0(-&@%yueRKHBJ=l#YgWWZB
zvpj+#bxz^e2^7)rbypSNvWLfTqIc_abo|o?QuA2&GAq>+7a5%c*vQg#S8DYfU4nqQ
zYr{hegi2-Xb}qSuhAwtaF8;-5^??}<i;G`|-v`<8d})iT=GHBZN+2nvM@Ro*(6et;
zQ6U(D(oP`VM{~*LcuhQ~rN+X6rpdTCzrYmJ+xgOEsPe-Ldb9@Ihs1!go)4vNn={_J
zO%C7$x7&U4?TrI=mm@*HDwE+n&lo-AHYZ@?(G}7`)m^L4xxWL@k*MH(lI-)#Kzr!x
zj7{53-IWhzj?tv4j9KJ}=Bqh*XDKACdZbm(T8Rms&@)AqEY*et%^w=JD@~yS<eLTu
zo5HZ3+31+h(bC^y)7BqZQ7bvv*L!k1%@-;}XBt~R*u?nVNAH<0dsC<5AppmkP1nmS
zNpbQ~n#RUX{KfB2CSCzi$8{_6pAA@-P9pocCf%IJ$)BUiqX(b0*S_zpi(T?}K0wv%
zJGS{~3?=P*9nhXErr^98C_~M|2sR?xJuiB^xD_WZ@3_XEn$dmB`TA-B>tW%T-2?~A
zH=cL+tSO>6w1mgK+s)Kr`Of;UjP6G!iSEaVm)r@$A-hR-Zcw6&ENA@sp2yX`Oi;$8
zX<~R&wtT*@?djA#w(KJ>PN)b472lm;OH^W>QFS4akLIs{{YuirNRl9XozhbQ5mcP<
z`13|5WQ*r=yhMt;${fE2jkX)JQ+-VfAM!~Rt}rlaUtwn}mtnBrG1Fp@cspv`^yXxt
ztdxS#Vc^?XrI*Sr$_8DO)2Hp!X*deY+<6phQ(dqQ3Da-M>^%RN33s=OddKG5KPUCl
zHn5D__c{2=Q32+dJVrzBjE=%8HEkf_q2t|9`eQ+|E7pz*92NubOBBg&N|=-=D*B!%
zJbjX6j~>kfX0GMpm?p>@t9;WHZg%t+r_&zF(zms*+D?=9A!>etgy0x=+K*b;I9I6D
z<y}2*POGwq&7Q4lEQN^+JF(&~8L?3$2I4F^f!vtBii`f)-*ASw`e_d9@IJ**gg_5Q
z?KV@YRz#H_gexf#$N9TPkv(*Cki{xrEqjc0*_Z1eqj|&W$MHfIjo>hwmSy7|Mq;sA
zD_s_dM#T5OiD2=}dB3s|KI#cOHmdBudYu_8+OHl8Pc-X}J)^CwHs(o|Ycp>!w)T>!
zeH!;Vv%ROfS!_<cT--wAAaa|bWizm>n4V~|MYNCt%?;p$Kq>cJ*IL;d9LTOpXz*SA
zAH(pw3ZWjIoK{$Ytd?KFr+*o+o$b-;doQ6uk#Bj$Kj!`c%)oKeuxL2D3XJ7<B*CX_
zBwu;i*#J55W7~XsGf9cjgCN(E^5Mt&hr`ON-rj7g8|_ChA@NUI>${PGL^?L~pP!^w
z{YAepxE9tg=9ex|$UmoqJ|_$WP^OLs@{WEX!hZqCn>N3+1m$}-+rk?&enQ)<OAjuu
zvK22@G*4v5LrtKJ!aK&-Z8UnmF&#))c_D5*7@n@>6S>N+NMig{%Tbr<7@QSK_X*1~
z!V2;87ulu48!5tg3(l8v<gIH52T0!nee*uP+`jo~ER)$H7<((X-H_n?%e2V<oz6H+
z*#U0qC+sGK91<%~kV3p*IK+W1X$=m+*ao^x$b|1uRUJ~A$E~|8vc7GH4L?NKg@w5H
zg_o3EpSp&G6FyH{UD7nrBDwJyPFHt%ZQF~)QTPFC5B-PX+0}CLWNw9nh&YuzrckC6
z^g2z9WymQV43CtUWBnc7HfA>z{kc059$@D(?p0Hw`({3Lr;_Bs&q**MXL8_D;NTE*
zHjV|hs$Zol?gQvpzZYi*^Oh(+%j`a+W)CmDEUW9&oGX5L#<F{PWW+ZR`C2i=pg5eD
z?C{9$sY7?_Q{uP5FT{;!The_O;$fFRcNs$|hGRM>Cs9L_Vx()kQa0<A<0$4Gc4V&<
zJ{x=~Ba!vNc1r2i6SVCkWyrROZ5fDPN6J^B@V%paO=VjvUTHr2E?pz~+7q=2`3HfN
zq~7{|t<J{m<&=$|;b{Ts=>=v-N2gS;<+o=)30U)T9Kh$75@$!6%ZR|1XzRsmD&MDv
zqEDql?3xQqyElbS%khj+)LZM@F(FZ@YqQJ*D%A@dM53kvZfq0QRo0q`>btcEuBXf&
zoow&T-8k=*JJZZX+6a+PSg=-INImg<FhU8VyIZQEMk)mYD~NgyD+q={A8hh=GrZ~(
zt42M2Eur)(?GHhh@sEG7g0nheuZp$gE)?_Ci-bX5S)L>>^xb<~AJg(va5vu(MP^<l
zR47PPKQ8**R6?&6t6BOuz-lhH_%6>QeTTGqVc4K0w7FwoaKYjTlv7gB#-vqKXotVa
z%rG+C^Lh?%jFMcKT&?EQ^FxvOe%0IRxAY}=;vYn#z7ecaJ}(P7MQ_F%MMW!3>FdwS
zMV<*5_40)${US1e?#473$jY>?mWxA=oU&9d_%q;5T5l$pRckoGN@V6TjMoJvcm;Wj
zG)!ofQ;cZkU-Ml4ox%P#WVZw|6Y4|~lb4Cw|1#D;8SY&^l_CL4hjs!b#=aJ5wTtb~
zmWMXg`gCV?n;M;Hncdv0f!TbwX{NB)Khe)M+2JByp9J&q`b1!HMa*_yNJTd|F%kL9
zq)pH$%07H_CR6f21kb2VNe(>@IBjtcguFj`_TP*;I2EoXBLExsVU-egd=d<Kk=6}S
z(-#bJSgu_D3GeSe<b8)k#mR{5KP1NZ<*afga%S&!p53iI=S3J+6Q+VqxUP6&$66`j
z=`}Q@+#!-sr$1Z41|FZN0rPn1^}VB9#n}l8(Ofe(N#Y<|Kurlk8Yra_4KBWa$IFfV
z{myt$q@vkodQ#Hal6$Au=G*x3SUl(c6TjjZ0Q+HvzYyYQXuAy<bi9K!92FRQ6<Sg>
z=SXgqaJh^ZHMzZWjKYEC+R)_QF}#kAn8XwonW7CU{Z6|COkXcyb>#)d>=ZasJ8r9R
zI#hMHH7<YPl=^&;=}LrIW|}-%!&pUV>2D&7dFoVPZB=RQBuZpF7|b^uwQlExvrq8+
zGG#$2Bs>ZaMx?$uNEfHFUG|@|@53ominep8=sQmFWgJ%#t08M6=QDefSnisS-RY;f
zDfnbPRi=(s3u)(N&Utg^G>}@HW<Dvim_oi7wXGJCYc?xBS>fP+v)g!Ko7{Gfo=$dT
z|Fot%^?JZ>V_Fu}UI2f1bZAhRUVWHSoh{w&3zPlDY}Xh=4Sc^`xxVGDxj5JH^nfz5
z|4Ds5DPLw*3{8L~CP!&d1bSUyebhN;zt774wu#H<IGZJ>@NJczkr>K_mejb(chv#|
zE2|Q%p$9+_!9hHeT2B!2Dznq$z5F&RvbPh$72&rp;`(~YDJh?AOo(<YyCi16(Xf-b
zwj9~-pHh>FIlPi}d2(Y-HS+#!2)+4=hK@zi6`Ln#|8bZ$6l>!Y!B!+(*^x&A?19%+
zx|ND;>Rl2ZSh{t?x1<U>JTMnQxp*_Ni7nFXj`Ff?7Kh|o+pHoX{v=p?@S=5%IfWjx
z_Uqq5hrfpn3;)g@e%r~qx<h=hrbRr0rbWX4If8Y<3uf>6S96P<DDrK&05d*Mr_TnW
zzOVEz{Pz|>jJ5`TsG@+)^aDEGYyRFMk4A$JRTMi!jq5|b29x_g+?%Wz7d;3L%U{uc
zm|w{XDC_<e+fPOM!)XET1nC;vxQdK`M<Pk_4JW&MW^bfYdq+q1>kwPP7<qmhs)62D
zXrY&HlI({;8<5a9i)>%BiwPX^l|wf~lhy-fWpq&-dS+BcWBILRdD1IM84|DG2n8M%
zEqfD>c$cqz9j0&^&mx{jtLyb}blvV+H~~&v_DgDdcytZV0%knF<-Pa!DiXG7riY|P
zFCdC%%a*HGKruqf(@+ZepHL9BhVl*~ffeUxav#2kr;pSb_1MyVX?8%1)H6f1y*46J
zEu^Z#Cy$VdX17x$${HRe=esY=QHUmEoUao6u{|2<;r)qecN))Tj6Qk31R4D`KxVQ1
zx@&L|>v#r<t4sovKl}+%s$SpkaXq+5gO%-deOmbW5Z~DD73giN7w5ngOGv5MOMXiI
z1}(ClqC&a^lLRie1eB$b8OUDK9EJ`XYo)7)89w*hz@b*cjV*Tufvi>kWA)eF*;ce8
zqIMKxFlZRbsBT1qsWsm{HiMbyS(qn1Q^L5iOQ{K*ivcOhvy7Y3q3b%MW3sbX2(@7@
z?{8@&sy|l9%x0e33D%SQsxyT-rR;<H#L#Z;8oRBoU!xx`p{ad33A}AY6DTKe@E*zr
z?-vzolp9{|Pn)l_2o5E(v6vR_&y=PW9VL(Vk7WqQQcEG)m)SC&c!#{}m>N-drL&^6
z>vwuTL^r2aqANlw112O`wM6gs0t!Ihn+$XnZzT)-j&Dzy1uc+%Z$|Aw6~f;T?Vlmr
z@6UgSZAbqu2>u-$!+yb#BrER_9Bb{rjIPq2p9haRm`&{SM>5UKGO>Bfl5=lil`j^+
z?d>olOW8chN;1y3YAD`jRy`}cc^{~)KRabP;%6qYcdnYE`HbtmXs^*nyO)Pb01!-`
z^Z*quAJDdV-UjOOdVr4lWQx>sUR1eiqU&tCOd5`?B7D1IlZttN8%wRIZ9J|)9tb$;
z5oEBP{MkKgN-AVL4*sdmu$eE{v6#)G(f44^?<lx)VII_iNUTyOAzmU1LQvKhcWcxF
z?JkKGX;X=!qkfVqcNea(1z{O8XOo>X<K3tv4bq~iRJu`Y?X~cTLC&E5qfhNB)y7;r
zDJ^*H6f1U)Jl*>swhxg_=Lv^F)87u)_Ksfaoabrs)o~92#^B%sYi_vIcrP;A;E<FS
zyGFb5Rxsr_s~p~KvGL=E;voUcYz)y$<Ayyp<N_}kb$sEX7n=L)Zybc^w4F>?Rncg7
z#${G5=wb({I7qHC!$o1!=BB~UXL@6{k;V9x1^%Z=37GhvqhtC>B>GS@Xr*?TN=F+$
zfBYl)qiI?1q$8gpI@`B6%Tt{}xB<1#=$Ne-O=N3sK1d!(jFArro}jo!Q8G5A^;NA_
z6%pT0`HwlMcM3Y;yuUniZ?Lu}9LFd$g#^1cPT?LB*#XQmSrOeR60>dXDq{LR@h9zw
zyNA{w$EQE|MvuV`ja5`qg$@ug3wl|nvZxF3nV#g@eh|o!EG{kKP1#RHPR|&@!xA=-
z{R&YUAWEhfwK3s5<z+BSP2bcdlEDw!t-EB{o+m_AizX8ckc}dtHXBPHNaCOrayblp
zyuaSu8BNRWGa%YIaM&Iqz-Re{?paqxK&`P<EG#K4*5TK-tkUH4+5WMcb7VF!u<T>V
zZ!#ymyLjt2oH5$?y=h@4P(=QJ?)Lwg9iN8Lq#71(rmb+;tOZyl79Y;#cnDmsbhVP&
zQpmy}|CH%t`{J(0V!YukedcGbO3JZ1BHOO)!*E5&k0R?XR`5dKcnt*3)z*wGd4}Yc
zTeZF=@}?2Wc_?!5ha@`#18P$wSAm3$G2=&g?kk<{Uzf|Qkto&d^q)NIdS9)kIdjEA
ztJ&IYfBzzSbg}YMt3DZ3&pw&gJ~O>o1;m6VK8Gb>Hl5neqvjYp=oyA?vpvA|MD)#@
zH!o(&^<!X4C)BnpEgQLwifMdvb=GNa${$91y#$M9@;wr6YtltM2@{yrak+PVI6jOn
zRe)$CNfxlUIBeIQA<Oj=fZP3blXzAYbfdn=NvlrS^!o*tamd`5km)v}hKf>H5JKqp
z=Vj&^bbE$Rm7jx)$#q*3Y$BUOt4U`J>Nm+V4(Kt<H!yl@Ula^r<m)pyBY_q=)g7iW
zD=y?Won$t0Z~0hPZNLmQ3b@95+|&&bQQ;j&Z&=b@yu)UxI|WS5qrg~_3HPy~pp#&Y
z$;vSIjX>Zqp+Vo&V6uqd$~!!I(E3%}X)9^Kob=)V?97stmZqUUCScE8j#2Elf>QmV
z8d+LEZZY_$hyLxUgEa<Kg#Vct{Oj|7i6Pw0K4@n`Yka#bq0!>w-`U``U6stGLg*07
z!~%(!?H$Ey%cV=>Ujj0%dGO!U1Osh&)bjbAjhuo4>9;nr<=GK{QKbB`ZC<yNHJ=^h
zS)RFn7Jw-`vYNWp%XGDBW=J><Uff;m1uA6-f!4c%Q(XsyA+1UW&L=CP@0wkXB02++
zEbBawrft3NuLzb;j2G$Z<dfJpJf+f7xXmIq<E*8gZg;aZn_Wsxk8F`V9@Y3K7HTaw
ze-_B67L51?>pjD=1bC@DpU;+^Z^^`c;Cza8(6GwxTV_*PB!X50i;swnhf^{7W5|D5
z^>U6R?G(QP#$u6I8qe94R6q6vU!@TRF#&RORKlaF`B2Lx^{8oN(Z!?Z2JC`lrK$OZ
z;5afF0kX<j>*~fEMm~WMyKO@ORya_3CJR7(9EXrxJX782Mt)mzA1719H@rym9rC3R
zVh%?Z)1rvXTQ~e%+ITc*g?Sk7Y7djI9F?|Za|47^#P^48x~NaYZqDRT01_uq0B)JV
zCgkJ@yJwXfipYgiej3TXli4yMlKE-_`yJp3Cl=ZB7C$Dl^+U84#n)DV?&PYy3bMP>
z^)oI``9o!nD<D!3_re7j5DiUnD5DVdh-4Voqh?mBZas6$LL@b^f)P6g9w@P~lZFOv
z3(V|7Wa9~rm#6ErB0dxW14MTPtYS40;iz&0^4spH?&05JDAp#yoIP!y>eQmQx2yYy
zf>)(P+;Jj^v<v5DUuoELg(15~ggSwWO3p7#1PmFG<?(G`mm2$uca`IFPpLD5#rz*b
zKoCv~ahqQ+4!NN4L;bSB>wDcu4X*l)C%ZXAj*|BiK{`%W<C&Y=EZcJw%z)UKct`R}
zbWELZpgt%SmnBUrnVxt>U&%|bfzMHJ)hc7qPj4}g5YBC~iDW&PumRVQ_e!H5mv3Ev
zgArhFqz}n&DBR=mCplWehTZ<)@DP`@rKwY-<Q$lx!F3n&c*)z(th{TpySm;#@oYg=
zubo<%a{c&dvBB|~OD{x*xt|gtm5z&$+HU?exfCIJSJZB5w)}iFVzTcgs}E_@fcF!#
zB-!d>1<QN)#~_jJK;e4(gT$&;q?ps!Ji3jFc;>+&YkQjvZdYdoXG<&H8H@Gt_ddBT
zGYQt++Y*UlzcKX`X2ldU+JB56<bN?u|4D#a`==|Y$CWR4#cX;?tNH?-0yxoq`fZq8
zkoTvLeg_#Sor!g1PTq_NKp5!4qXvvFxSmZBk7U$iJ13aH%ty9Nw^910#&%Wgg9hW>
zL*9vwb&+ZIxWl|_VBH0fmR4|8!pV1G!Yteh__b|(?^3z+=gvq<-aO5=<mE~tn~wDC
z1Pr%<PlR`Vy*UZ*3P#(kU-juGFNl6z$-cHIOP^micYoi=>GdEnAft*_&JVgiJz1b*
z)TtwbgNNtU;YL5FyA6=gAYz{f`a#3-1gb0r5nUjD>+-IhH}N=1L_%vW=8>kYF}tJk
zW+M-+<g%1**Z#QVZph0E&ix*MJ7;D%3eVk*Ymep1pFGGLZ}oxQSA$ZV78w|NldH&`
z!7|H}x#v#l%{Vgeuq6YO4Xo-xb5{1EVl}9Z5u(+7pfe>>5x~2TWHt*&U18MKc6X{?
z{?Hy1%DY;d@U}SRH@ZqK4*g4dt(B(=U28$(Am})&0??f#rq>RwvSH5+7YQ??3p)La
z({4;<35?A`vmZ^Hh)x;Nj^)l`7VCyy?Tp7|IA*_uhvY<hFU#D&<jl0B*CL^-z(dou
zDq|e}4!JSD-2D~tm_$7_>Dp!3m^2xT!|d|oE9KfZuh0Zk)>ru65h>_-5_0e;ADn~f
zlLZWMubRaPef!1g`$xn*L8bDNpiBH+LUhS-lR~%L?{S9ZncYERaTT+dnP;<>OOErw
zdd>@=E0FC6LBJLBD+zk}iTYU)O&}J*Vh}=#;rrFtIS7d_7omGEJ|1FZx9o6Q>L~|Y
zn_Qy7O_1}ckF31jrpy;=Sy%FKQJZU-IYRrzm&1rPa*H@fcA=lbJp<543v<Wgeb<>N
zsvTIPJ-KWk3S>~XKQb4KLT8ef@&)fkgukaR@`pvDOReR6hH&n29!vMPkSAxt)iv)X
z<#=b+o??b~lD;oBcahs(@}0<)$8(B0njl;@v+Aha?6<psaFL0(Q67B5=x>Pn<c5nE
zI@d6Z+-w~c+>K;3=At8#2OrS_|4Th?!gC6BZrLlip@B%`lDliJ9TAjpE5kKxHo`4_
zn6Us@E~M<M{ld6y-$Los+b6r}ekwRZA@a%*%aiJ3dU~2bofW$5m~e>Bkma`X2z>G=
zxnCwYa;5E<h9jeIZUwL6*SZjmq0#9^2sz=UMTkq@Oy@1TsIq+nsFKk8i3}?b%z*<)
zct`~P4klpk|7#vB4QIKr#@sl>jy?6;miv4D44nTnSNz*0FTH1NT@i%b*$zpvs|s(?
zm{0?LJ6_DDw&!g5RU+Vp6rSh_7{DRh9fF~fD~$qeBNB2dA}R)JcNg8_2+|oC8U~bT
zRTs`_q3j9gYLx2@WQsN;HyQg=oZC-$`UfakbUGi*u#Nsa0m}n8!moGFWUAxAX$(KV
zut=ab(PZj%ceE`}mH|Cg;9sMko7^(9HRVz?8TvdwX&RAJCVDY{L;yCMZd~hu*UqSz
zeGq~=txw1<NZWBFX!cM$Z-ZMWKTojh0_w#(DhD4YN=!5&$@uje4Txe;@E8ma*T&2>
zT?LeMJ;G-}opYQ`{DnuC(?Oi5wp|9*KKLHW0)?~?)##l}0D8<xx42qp&WT@aGM6u4
z$yPtKcVQ4B>?nR5)<KOP-Q1U>SA9jq;~_$?^dTD5^(vBlg>+QMwR^+yI>GtaXf@2{
z#^~y^BJBE1P@-=6Nve@sT6D7OQ<<sY<FiqE>H^YcbYDFrmkN@TgpwFd8Wsz#TWeT<
zN48u`((QrOi<;K~>kH&hQ0NQ^SHFUe(;d-YY-q72i@-^JdkUnLmE{zx!O3g7=xf1y
z3M;T1{4DHIOCCvX6Vt<2IZnn|?XFg{&!y>ZwaI0(BoIj|P8ir!Cp#Qnye_A#zQo-?
zrW4B58fpZc2^6qDW31yyi_C;K>$;!`W_L|+oWKz^&3gIBey#0J-q#x5t-dJ;5!j((
zH1yneM&A_Tk@DQW>1PD^81+YY-`LYmv^qOpq*qhUCd2{m2T0-;YWjn^{b_C_4|xyC
zC-J&n8mO36H2NUPvtdm>B;5;_orLuaL(taMU=>0q6>u3e<Yc@HmvjSME2@*X36W}`
zyu>aXmd)<IVMF%74WBbNS)3CHTCM7Cc@pLFuIJX1UhX>1@y(sJ;ui721Dji{6A%Pe
zfEgyrtu<I{v-QXITG5*Hq*=<xkp!ASL1!fUe*U!mhD&o?Lq?R~*udtzcWHW>Ha<Z2
z<-YZl)z2eo0_cGZrCt6o8q4cMoM^HUU`h#n15*;v)2;7op#X9^7mH>x@A5M<<8s(&
z8QGj<CcEzA<{IT;v!hghRsEff`75kn_|u90&GL#_{|VZL2NrMrvuFL==YMvbTiM{>
zsUADJ<fTpsp42M;#RJSU;*twFVN=76*3DI$DW?nAOSZJD(ZEzFW&Gg~dMxP*-i$lL
zqKMOBj`pxwy7Rs4SwZK=d_OR~{Ec4Do2Jikg^=0iG~~*f{_U^f1ECF$gYdk?j}h~Z
zJ9ZUAochV-+_JN2v)RX5T=q1;Tc;k~?nLSgPN&d%WZf`8nefEkwavR%z#O}IZqmm-
zTgeI@h)1AhAKHY`lIg49mV3V@+j{bDdaIyCya-Q8gKBSf*)i_EMVyANa?o}1*p1~+
zdvXa4R>?gYo_OuG9z6S19Qk{GiHwEIiO;dr6k*v17{@}#-9i4<_Q$6AnlWy~UL@81
z3Zd(CO}?n^UvZo!2i?!%b~P}1J1(zMKN$|?V%wG+PNEn^_tZmBp`sBWQ8}Y54KFI0
z{<Dd5<dAwufQ+2CgdE=a1j#R<iw=@+H@QcnifZUK;xE$Dv%=cLD_+n>9!_E6VS301
zmd$d-7*rW!hm_U%xIPR)=WR0sB*5&9;~!ovxsFL*<5;e7XxsL#9@m(Wq&g=fZ*~BN
z0%jYWeb_uM^|4MgQl0h0`-2k#Cw!)SmU8+Zrbvt9(b{h1mR7|~rFFY=dbukM(lE?t
zC$UO#5rDS%39}<tlSAkBB;!SvdGrGj;hs^u>}ivg-NxyS1Z89~4oDu_PT^(X{>^@0
zH&Ovv-M%a8j7i%(Zb*XNDu^KjGvg)gNhp*JGvT@YpaqNeE)vJ+TW?EvAHgpZ$bu^q
z83i*3cGF_RTU~Bo#1+uAOENz%T*pa<nw=dVFmBTak#Mv>w&<eOxH@oo^-GrJ+L?>Y
z)+W6x+vTxh<+x0sj6bX!Z#<7^WzRKo@gPD&Wh(aoRt$ct$TD&~jdrdm0D%>Az<h+u
zUtsW0XY%h^*lEnVnu1wjB;d26)_{yfsBS*%pT1;J0)PY@3=VP3_CMseSqe+#waj%r
zSxMDV#T-s#!((e!m7L|>=i@W#Lx+kEd1*t0lMr>EDViBAq{?&7OyoCjm#J`^1_Rhq
z!ral*szVsRaBz%_j`DgM5$(vIE@Q|()8BC|DV_8zrT7}{@zLJspY=gYJq^4wga&)p
z67#tD4n+bFs8RZfgAbIxRfHlQ6AG&S0XOPmI4maD0=B^KqUe}6X4x5gBCXc2>S8Jv
z4*Q9^V??2^dTfbcI;tHI2w1Z7_$6?m<0dB765fImm(grM_{F?@k^{%s`2`E%Xz$_t
zdFB4<uZFjsT3goX%a2$)<MVL4_t5p3v?9Q%Xf=R^aHKE&w%7pTgn;6X=^W@J*nmN*
z_#k}~kB<Tbyo=!OI(A!|=tCGnx_NzAZx^&&2^83gwR?Gi7>fmOaC5>u^5}_~SR#md
zA}>+FBZk18q?0QHhyuH;&c0$XW9_(#v&n4+j+_s3t~SCsK4nG~99(rmhX@+TM1y{@
z^JAay@Mh{)c3)k3f_z1#m*jMpEbT>dTt)1i79D<9-JI8xbe>-|FXE8;H?Npg*vxy4
zq;g|D!;tXTEN=8DrLISpqN+#B9;Wi{290_HcXN1C#jJ1w&#{i)yH|YVE;yYERtl^u
zEzv!B;GstjogxwC^9qYNrU1%NYNeo$m0=zfL3z(sJvd3tVFmWnxkfkucZ_?vm`=pq
zP{VXii_zfZ;W-gEfkZ9cJX5Vx@p^zfKk4S#FUFSWD0gvKFC|D8;@U*Wv?h;j8Bu#c
zx~L`Jrz76r>(Zp$=DkH{Day`SLrTIi6+KHdjrF2#x*%!Beo6vySq=PPYYyA4I|$!M
zmKX+i(osP02~e83pO6?Q95VMow^As2nO?~aA2-J;kBB_@^oy{aSS0~?ccf?4QDd#a
z8#^;(a!#K|OaotU<vMh5ry#i?{khlDrHj6U(go?dbKn?PPezt{3q+-4^8}D94S>=x
zYajA&#h%^GH6iq64n4}ryzMT@{}(RgPlNiM>iDPB#?){8_Kz?8l?VAV7dR#{>#GI}
zu@?RY&0zNBFwrY9dyR^rq%1)e723<W`g)3vUoQHPNHCvcrc~Fjc6hgSSA3{y^dQOT
zabJdVN!CWM9{uuQ>P@DId(Sm_H>ZBc2|MIYsAny+oj6fBGiXvO1k^LIP9)|^fJx*@
zwPj6oSrFD`QoNkZX^tEcLlz#pfJqt&V!^P#H1S%G6}VBQ6`iFt>N*UkWN9rE>kFF4
z6aO?xz$H7cJV%~vs~1J?a_#@Y*GjvMLRQZe8xKI*9-Rn_kq3F8tPz8kM;&LBpbahj
zxPLg!|M%3-Ux&``Nr4?UOo78m9N_s9_X*n_$2YU$Qx;Ku6u%PNy7#=5xW6l9i2<i{
zt1jQ(jTL%x!2su4HcP_S-<1BJFYu3;xcuv;=SxBaJ;M|Sost=A?SJ9ue{=W$jtUk2
ztNQKV5d0RQzmfRwZ}_tePWih8z}c2r{YO0VJ6QK9WMAKB{O_y}G}9sa`TyCYHjqP=
z&?mO)6#S9&&qsW)e*VHK`0tOzUp~<kq7fUt;2gDG_6GZdmq@@YA`kD6FxqRx>fN$n
z$~gSA7>o#(OL=Y5<4Slgb}|260^t3P3q8)^##mw&2IZwEWO81`ImG_O;JMf(=>FcR
zwSPjI-<j?IAPoKnYyK(Qef0a^{^y*=-{*<(&y@Io{NUf1hTrM&-}NiYQ52%6)5Wtv
zt$8{Ts7;V&f5fsvtrF&sMSf+#<_P~f&nrl5?qN>%@p5x<9qgLUvzCy!L$jAb5_{7j
zYpvt1@!a>gDJ5KCm&0V%@6C(835YgHi%;;2^|L0z-;WmdlIm=in`)5}PzjhLZ_fcN
zC(XsSQe{&lPAVAhN(~{72kmcamje*czR<}NPO7c9AID5$Our07#E^t>h!x)VE~Bcl
zq?k=a^d@KT0@wq5-sNyywt3%2V9AEOLor8k9#j{uP%CCFQ7d-QOd>M@WoVoD|2arZ
zKtP9h1Q!?~>I};kxmYCp{fU9%eycJBR}W*>m#2~itmMn8IuuK*CjNOu<u8`$w@1H=
zqo+12)75OZ=MG@k3)Sz~#>aD_3lY1Ah<ZbRsyBGvRUYzlAZRC*tw_F^NVt|{Kiih~
zRzvd6I-IMNid2&>rHmV1Zg!PfOJmdFJ6vtoua3VZ`>_1xrN&B&d!^&9lFIDsruA$v
zNR>W|74qJ%iE=`L6GnLU*6dYtf;R9IP1G9V=#`~r%a$iw<&+iD|IiOryj4o)A?TKi
z?n|!R>~&<;3H8<&GLs68>KITl;xySu-xFHR-DFVci~r1Rf7npDvvC)J+=v@cro#mL
z6C;74%GgfOAIQj>SDt4-6As*naeufMd{g>VqUlc~6A`xd9%JgV-k>ue*K?!)m2sp;
z5yGk8OZYD=8tgdlU+=H|?PWzE?-d4$ISY!~;Pjv6ZPBb?Z<_d0LIZTN7J^Inp2m8i
zM)Q8WeMn~Ke{pq{VNrH#S0p8+8;n;%YUu7#QBvt{>F$sQ34=yr=<e<g>F!2g0O{^;
zkMB9}Ip_P~<uI2r^E}VqcdWJUwXwG9EPA7TF|P`=N_6SVO!^`a5K-IvXkm??{J<CI
zCb(kMs(Mp<aP?>+Z>lBrc_7dnuGI@#pOB@VdzjJ<Nc2NMut=Re0{FaWrP+i;Ng9rN
zih2@z3Xa)`fX%YVh~zhQ8`htGe$0Wd<2@#!p-`5b;9$B2mrL{^9sd%>AHEqnF)4!H
zAzYT;()CqLCC+nvhcfw%e)wYT&obsp=ryhiGO0<=_JxDPNZIu}dK6qvE^=LpjCRTo
z0|TX3d!x-^bJZzys@bwh5kX&)gYD@x?lq$7WF#de{Wd-H0e3I9aQN{p7uj)mps;Qe
z)i~2gPY)U@HpOGDp7>wwqQvbPZ-v~4J0Wj-jRz7qFKRVOH4p8P+V=H&FIIANnh{Kw
z9XIASFAmpwzCB0HdK>?&OGJNMG{AdnG;<{H0|RRWQ9HN?ThO0u>J_Fw3h7d*uE!g6
z?{mJ!O+@N7aq__Q<Dwp+YGFoxPNg6I_#30Wo&S^Ry1vjVLh?Meh+iEit0KKn{C<#l
z5O#<yx2cUCb^}SEUR*J9<ug9VZGxA|1;KTWJI^2xd3%g@4|f~zRq65JdoEgxz5GML
z`$y@4XQ=wg%Z@Ouj>fv@4_Rn;#(Gj%aL)GE;=`M`0Vo(m&TVCSr+<er&YALB=<Mt)
zN3)i#%w#A6UUdRi#&n_Xl$)XQO3575o{=vqT@)B9KVK4XnNR*MpQ-q$G{N<8RH70v
z2eL8YWSmz+To%&@g(uG7^;aQJw<rb`>}<J|$%fhZ4*97XWDKI<cw+E0UK*bp2niD~
z4yFiGSDH_Ct@p)p%EZed!*2!KpI!CTwzQOl$L4VYSKgN%lc__R-^pMrbnKX@@_D0t
zCS-bPtO&Fhp0bHNPf_+Vi5^W(PExq#8jfYX>xpO2=J6I46+JjV4@ybV`5bBNJQic@
z9SOv|OcQ;5JBWgUf|+hEF0UM&o$p2Ja=veEZ@--A?38@zh#$H2>(_}-L_~xlB?U!>
zVjTV0;NTvjrKM%&?DX`j%<~^r%F4=$OiWCf>Z+<9PbzI<T<>mNb5GKJsw(yY^O34r
zs;}DM!s^XzT4T5V8Li?YCOApM@&1#PD9Hpxwe`{@quw0@hlgkkqZ-6=mV*jsmt8ca
znZkkfZSS9b5MVJ=Mkwk1GAtiKR^;Lq1g7um&Lc;yh;FH76M1MD7-JScA#e4Q1>FN*
z$ixIsz8=>PdWbEBt#xv~J%O=M=ZK#w_XZ0NMgj6&9#lYO(4F5i<*SEN#X8i@_jjmP
z3w5ExCF6qa^huFIo>xzvJP|4X>mzt<PrM|cn_n(n=rnJZ?(c$7u*jB2(xm}8v-wHL
zn-{)PQQ?oL7m7jp^4Sm>^}}aEn6-ErB@8z|Iir}A@Bq{?VKLxQJRI;Me5%Uz*mwYs
zrdGh^-~m{?l7QG5PM5}Ms`)xx?`-X`JNv<(pTfZw_&A_wo$%1Z%x20s8$2JbP}`8U
z5*KG)wJ`8f2)Yrdl^b{djHKn1A*lo^`r!SiW`feijvL3~|9#6OhXc-sgjHHrUB`rB
zMRbvqkIt&ZlLcyRFAnquwBz;(&1$(#ho7)^VQQJOQR5&#AO8^4wVQf)5a+@JTZJ-I
zB5V1Gsx0p~<9<mI7;C`zj#C+!F@#&U1TNnI+|l5WkdgVT(^|)!7+A~=eK&wrqyV%~
zV!I|afG0(5K2;<Mwtk0qJPWGl9jK@v^f-UEpooEv!~P<rr3R<u^jdzNFEifCxsAiU
zF#(IVSXgem$Gv8~(>o-N4|(rf*Sf!O%8+g}gOG!&H4BFo!IN8ZA3g<HsWb&1H{4FQ
z(~Oknsw_)QN1h#OW<(*(Z}9+-|9RJZ`p?I(%Cp?=ztSHRzRy*JEj2eAKT5~A640u1
zpvU1nB!mv>z`xLXD?Fg#<-EGfwGq`kb9`LRI7*_K7v}P5TE!Wnck-CSY(CE9^&83I
zPGtbAK-|wPaHH5#BKV#6f{P+@u>gA^KD@p{+KfY~7wgm#4RvZ+r>Sy&M_@(Y*Xfq<
zRpxSTU;ufL!r>7BMB@{oeM9%pK<!-QO5A}@M)q<tiOmQdt|k#O#~^(9R~tHC5Q}!h
za6!Bs^hw|JG)bmRED^qK+>amTR+k?B{{B$qLUq`5>2q%!R(iavn{{~lqJnRfm&-?)
zGC7*LZ0Ns+La!Y2ymcFACx-J}pI3aGk#M`VJ~dm7eIp#oa`Yiz`Quq{1`4dr*Oxg#
z@^_05BAjb{!Na49sV(O>J!YYro4HPbszpug;OgeuvgknGg-!AaIjA7&*1Z9%<~<Ne
z^tzoHtMcj5T@6fQksCD^F%OmqRS~t<g?9w9GasDT1g*D9UaSqho;EhVt_p|+9egEX
z5fXloM##H&qAK~ymJ%&S<~#no{Aaqo;~!1uYgl_@S-#M`OVFLKu}zD1c(d)BgTZG4
zvWs{K-is2WJ|YPzDKjfQlE6P%5gyUQJ{fQROyn)!U<q`kHuEtA=rM??W-*YIhh|Sj
z_1dhPZvz3R6Z-Q(Qvk-&mlqRAT0&k2RlH%jo}0_iXm-Z4!tNz}<&}zZZV%4}U1tYQ
zl#|3DK~!#o_g{!|)bjCZSoo3n<yc(YT-&=ZF_qsYhS{<c>r15w4>uU;FwWIIV($)X
zJ2K!pI6CtGar=l7Hb-sGW!YWE+9+QvCGJ38PY^hH23e>ix&1LN(I|Xv(CK4uLns=T
z*2t?oL=l90eAcd9%Yxcod9mi5`IX*N=)Ku7aSTPN??T82*rGd)(~r5<fdx_%CzkGC
zxyLpa4bL@`ayw($e-Hj{?<d7C`2{Vrc2=2=``uE}te$E-Km!}KraJqf)+UPY&pVUS
zKG^AP&>Kcs;=tDW`EIS$u9=jAqZR%rz&gAvMA8CjOuQ>Bz5}_0EEkNsVUcr16){Aj
z*vR$Y-Ck$z{LCl{nw2L>vAK?8HIRsXv#}%QcRY69ake|hDH9j<;Gd*K0y+cCW5?9t
zos+GxGz=xs59k^j2ZG3IZgng43QIJ$xS3j0mQnI}60vmj;9&$4X>eXR%}Px^%S}V$
za;9mmD-!y8o=@rAP`ey2&fQ&8$($fAp%<0EmXkJ`gMiP<J2R-+<|WV0M$iLq>uCxd
z-zvv#UD)Jt@1aZkf*WcbVPE*RfpgmjUhI1j9E$iEBG-JJHYyntm&?oc-CyYA_m#+j
zg@TWWS>$Tw$n-S3yK)xHnHU8Hmy0x^@kNxrY?AJJ_0hB*4FWb^eRKp&3#1IP>Y>WI
z+Oo8)nWxmI+%8yyymf60hZM@;+n<;Cn7fhB$Kqx#ymRvBjn}r3t=D-x1c!9Ju9aaN
zcAWjYiOb6{Bo$ir0+Mm6aDLg=r;&{$69r^<adn8w*w`hJ{+dhT!;)IWh!0uTM%T&H
zjHXU^s+U(*BBB{o(o9Fv(tfP6G~YZ^?;j0d!@@XdY+MpXJrQpKp+NBix6~DLPb4kQ
z-NhQte6u$wz+cn<Q{V*R{&|VIO;+J?X?L<ar&5u1t$nfQ$4sq*biu1X<xh1{xT#5^
zk)W$R6==$N_(0(1c6oQ5-j_M_UAlaoyt75+k#9;htw4jvvZE7a!X{Jb-hJHj>6ypv
zKgPuds6uTQJ2h&l<)$e#uC#~OjT;dgW$we0@8epfXNt4GFhtzkq8?39hqs?G_X;(x
zSXAI)<yCbIb4q=Of;c!qnyri_mYY&%aO|qG?mB{Am$Q==$}hlJl`d1c#Ok$ROQFU}
z@F72<71v~)M7BucRxwjPP4V5$WJ#)N{4})H+H|x4nNLnDXiWJm?L%yNDB|16cVg+Y
zNf7sLRtwT|{+E@B5o=t%yG~2i!<ohqH!{D^gSc2VvIYtY4?y7LWOX9m{o)sXo;oCj
z?g7+$41){jn70R_2vhsb_sl38CW<tFiVlAeX7rH2OX|M<cy@&b7h7AOZpiCze09uM
zEi5g>lXG3^;5_AN`@M%%Z}&nblQvq$2Z+6d7E5N?9@esNNc)xk&|RYp)0I<VgiRBK
zqZS2)$Fkf|=19gSK=TFM3OH|J(7u5QWRvQ*A_HlHr31Z`$y8RrkyTdK#>vrdy=g1w
zLmkQIje9Knh?$mw_?S8R^Go8FQ!u}1TE^(^J?#8;nUM@DafkSF#2D;B8(W?)Ok*hN
zlJ!5QO}sG2G&m&lU(e~T!_cnxYj#$<2kTzR_Z4jprG&-^*l!L>rb~r)oU>OxAm_Eq
zs42M{XQ%Ko52NHK628A-XVz&dP&>L6(IPlr?+bF;owXgl#A^9d^@GZsL<+n-)`1>s
zfD${f!S(nvhQY?M81cB2lvIkPyeYanD3ScV?=Ddh5D-?qggOHp^T@&$=TMuxdUv(8
zdzX5fJv}?7)%VpM9NS}#i)<WA0;0ny6Bh)QGZSMkd|(SJtH02svoF-}I-w_4%r<ro
z{*f|m4^EhEDyoChL-RMRRcd%<+b0(l`qSu8(w%L6lad4}5)(Q7M)})Y7i9~MttKT+
zjD)#rY+CUqoqF#mcXcf-8R{sSxOdX*1kS1^OR5}QydiGtL#^1#M4L8~H;jV}*QH7^
z{Co}M{>fcCb`B1Y4eUZn>!S=V7E#mhSwvM7L7nwPKtNyuRjZ>boLr$qw{?G2n#fHE
zoV#5cy2_3AKhdy1d$}`|7`E8R?{&3BYpc-fL1mhlAn1M;{PE6wvVeZ@bhGB5(Rn{P
z&axa-$2p3b=trAFU#cwU^g)Z1R)d3uHBpco@t)A(<3P=Y)1>5jvlH#4!Stt2NJX}7
z>B&%C-1LR~j(DYs#@mD4f>3oD>^i(3kF8#CJ)Is^M$*E=f5>bJWYis?WMZ?eiJl&(
za$w!JKUfwWxe8Gi_3T4JLDBCB#;tKZ&N6;<TqyEib>p8^pYq*gC^=R73zdE#UEP6^
z5H$g_;yF#-^!4$OFfIW>M(z6XV{&o^<}TPn`!@ea&&D&Zi<Gh>=uYTwMmX*NLe)xE
z1WD!(Vjt!O;}l`4H=R@uyc`|gWP#tPBY4vdPaB|!uH#U|VA&phMO@s!xeiK85&;*8
z-LIaf>ZqE{UX)XS&fS^FSFt_c(;ArFhm!WgsycRhGaTt)qk(lZ!<O$4tY<48ahi=k
z4!Fk=zWFp+s1dq#Ku@qeoa*NyC=dHnI)Z(Sd0hD4)$!j~iI1-9v^RgbF!Vk8J9Joo
zx<rpe*y~0ETz5FUNSbs(6=VTjx~sKTd<AyplQHAn*-HJT@wQOo(Ch2{=FU0-JB4XU
zVgyolV~IM4Er}^<J}$Cr86vjJ%gg7G7JOoCi>~=Ye8}q=>RtQZjMs5&CahKDb1mH|
zlM3WfBXx^56++>DQd|eev4zJ?Da<f%Xhb$fm~(MUaC~3se!=qw&!{;Mffbuc0x9XY
z%g}-y`bV|j@f}?0&evBgf|T4R^|uYzUCH<#mB;S-)HdP^2na4;&G<4)^YG8E7W{l_
zvE;2@&bS2)y)*w<ffXtBuFco6TX!pmvAUA5S}l1o=(4@bV6e;+QvD&uI|AC*OUAX)
zU21mr7bbNxS@)pYa^g=>#uPS`NFqz$Z?(vbOdtRV;f&A5KfDLE+7m{`w*dc%NgdMt
zr;vt#`8JZkOVyn9X@IaPG`cy$rJ<6a2}FmI1xuaxwZTyQ`Y!bH_UcqTmRU=JfhLKm
z?gr6@ej1ryx>8iuuMGzA;yj}e2u4IbGuRBAft|=aHGHLkrBtQ!$yygW-K8@_1A)A9
zn8QRzm(UgYRL1D#?Gx*3tEZ*&t1pI#Fq^uyGgS0oYF-Yis`K1(joABbQ?EB-lqV|P
zH5fKo1*b6D3~&oAry1S#E^+jDh}Eo%_nEpIksqqkp&dH}h1cRbQL=ULx~sS_?9@=i
z`Ts_lk*~cKE@>t}qc)q!e6<o+jW%rRt^MqQJGq@}2ae(X)>f)oY#T(*W%kGN{^CS5
zM&W$Uj1eA}#Zn06+@!9@W?fIQrpNk)<zuI0$M=(tUvP%#DAI37mQVGcxUVmbABBoB
zo1j;jF1s1kW^u;lmkA*o4G#7;OER!tRpV38|FW}h4UyFP%HD^QBjEa_jD>jM$q9#U
zV_C8PgMpBTkaxrD%b(cEgXq5q^XECKKeFehomLt)vJSF$H-_ek(!4k2z@YtYT8m|2
zxf?aN7+{oEsgm}!uZzYOqr{o1tpKQ=dz%XjIrT`fYP{XpXI1FY{3s|(Tl*iH027#<
zw0L>w%H!VxMvus4%vOvLFpM<5pW!ZT@9ZFJap13kNLLDq4OXk<0;3oBIN_8oYh73)
zikz7uf0AkhC<@mOR@y;}asK~m#`eD?-@lJC4UqI(Ryr3qOO-Sz86mj1KHH6S3K^H0
zAkhM{{>dIad6f34Bp<o2G>Pa9!TDB!FpX?F%+KeYdc@Q<2}SMHFUp>YpNY|ZsG@jt
zA4UFg)JQ5^kAKBc5RGUqYqffGrZb=iX9go(x$kh=+W~{`Hi3GpY+d{(n~_4Ds&)ov
zj}Kp?O8e|Ro39`iYnqtVuY3-4sV3qTPqP=>v3*&;pEIblu!-4xCC7eyjX#6cYcO3m
zc7Tp4@+li}GTe%8kJg~7;UX6%ci{+A=c$|3Ux#i(dJcud7A=ug+B<X9X@p0?`1Tcb
zdAdu!*R;M95jhH{NR=kCe4Zxq`-@r*bmKn1qXC-bl4u4G&jr0IFU*%OuemN*$&ZNX
zeeph^=$#{z|4s&HTns6~c<*^MZyO{`Up%Boub|7Y``}>T`Ey+``uhE#k6p?o#>?~L
zYt!F?mE_{R>mm_tl%;oJ>;emdD^AAG)ro!vXcD3t42<F)p2rJe91$`H0&xF{T-M2}
zA7HRt%i2GZyerMgmX8JHRcz&BGY;}_t-x#6Qdd&Lw?7bEF^DA(^#i`i%+Q$U#>7?k
zVahVgK7;k9CibOhyzQEN9#rDJuYE{1TV)98rA5-hwkqM)4xf}PXBblQilX~~*BSat
z6lMMFWh3!wR3^~4hjTtnL0~id8QvxtnrfP=*=rw<E$L1A$<pNavZ-Zot(N%{@mYtS
zm|`$UDXH+pSvf-{U7+Yjt5gBcVMaZvZCe!U8<T+*0h1QddS8sx%6$B{YA0_CF1}EV
z6joT8vJeM^*Ac;LA}=~F;LD;3lX}IckdP2l%D%s_0(LkQP%B^F&gu~(YbNnI;uViP
zmyR%vVOzrg-{Mcl4+b-}Wj)#{ZeBfF?*mJCDo|a5QLPLqiQicY3`BK&IzHJi)Tn;O
z!*h{t;&L-2sv-g@swGYJURZ_nEaAITHsCI=e`+^3ftmy<o66@uv@^^o`o5)*w&J0Q
zhThc~>ci9ABz$CajS!thCGn}OSj5_$VwMBPbFNaNz3zj;Uw%Gi@A#sug>Y%L{A^eu
z531&*pE^(C!AkXoC$X#o#U|#UIzjhObxOUa&1w+5i3UT-1eM!*X&>J;H63I_%_S&F
z4DXTCtJGSAd*mu^j_j*jdqp{QzaD#&RIWX|d3d{0;mvkLW+<6?X1;90^dO7jDoxdi
z55<xlx>&;m#OWRJSkD!DpU@^?E+UazQ;*E{^-U1nM_3jVs1P;Al6;1Ss_S>6YV94I
z90kUrIyyUa{xlNQJuqM%PpKegUK~#vA!Y7$Q${sORjf+vEoBVK9HW10s)ikpe&Z9K
zHOW(HO!t|bK;lPfz243`v%2R@LV?&$7z&-TGY|HxTZ_v_=U@Hbu|Lr4`cy~KZ#ZQi
z&b-v`cQfFjJ70nQeyFh)4pZfQj``A|Gf;_(r`h!{JNhq$Ekgst1|r@kyJM)JypkMp
za*RIyP8ux{%51_jlc0ay76QAKHW<ItktFzuyM)DMeyqUbGD#E>lYQVk^b*peOxVty
z=-(JAXu&9}Yu2~g^S+Fih`QW&rtawl{U%P&j4N)xWue|jOC0G)??dVJn^7XIdRdKj
zhutTJ?_#BnDgHV`C6GTeFf;Nwz6XnONXU&^9)oFnP-cx}v_A_DM?Rg}ovT)QADUr}
zg^uKXy~~Zu77!F<9^=JJx4b=Fnoh#<O-ys+8q9D565wyR!;cvN^Ta_f-b6jtnsb@|
zUW_A%`h{Bf?iX?JPn^15{SH3+3l!An5XgfjDxztgG+uNv0<rGP?&U4Z0OZ}zEl=E$
zG1a_LM5hpSn;KZyG6#aczl&|%P=xr>!_<kX9X=%6Vybu+LW-R^*V{5M0}F&64TX+x
zn{)J%XGjK2j_GZahCv^AUtCWc?6xF4n}_tsBX~1Ge6w${D+azH3uj&9y1u-Ns5B9<
zWo=P$;Ld>Vr07-Z$roU6B-%)ol+E{Ps0?#Ha+RFwtSqUw!%Ys9k#8(1TSC7r>0YE(
zxhW{sbCA9%wqq&a)x)wD#)&H=_xX+@IqWqn%5&}BE?!%cc32ID(^5C@k6NCXf523=
zdyH*GbzoE7y^`stz`l?3N~M%snN)pkJWspVwfBot{@dlXtt`^WK4hyRS)RHa;v@R%
z=zL`|*YX=21MVMf17oCJ=7H%2b_lV>>dpnc#t6i*7}I>Yf@S1}o%eT|nCv(>Buslm
z)DG|Fv2a*WDH4}ZGrb`q$zAQGQ}fu&5t}6+Z>Z^Xzmk4%XYmawWFNfEFWy<Dh~xR8
zZ*^?fWB8TYdr*Zc){hgrm?H3K2J>s~sVW7(3Aov(InM@n55lEN>`VN@16Yln-&Zk=
zP+;I_wEuMBOt_E2-zwv1J6XuGDd7#$!a#w(rCN6#Sh#F23Z<C@&Xkz%$}^=S6utFl
z6c}oF6T3ct^G=&BE`%6d)2nLBPo?#BbE6^n#OfJ4VTTeiiNY0^Ir2|&y}~H-1p*Da
zC8~9>D?lN)5UHM`=xmlivMwWnK#UywaV(2)h~@b9Z;t2R-CiUf7(yX0GyLg$x-(@S
z16jg1^D7D!wc=rO<{^t>46q~g>KYQh4?8mITi%=vXLXp+<8izA+zR_hEwr~;VrwBc
z{!*O^%l%#F-SOtZ{%}mrh#|yD)rH|2UE<R<azV;GGGVW>#4XpDO~)*r`^Jg*f==)1
zCiYtCSO<lMiG$Q(S7XWGIH9QMp@B!O#(p=ft2xarmYzp{EqwWbHAyj5uwwL1>So*8
z0Veh*mhd4-rs{^olC^y+x|s~}$%L9GJxi$Cy_QW>XVYwr?C6tM`1Uwzttx7JyH){7
z>{qL?ct-NO=ijD{Hy(P+F;J+o6I%8~i-y=$4(oNOCpy^#WD|#XuLmCUo20AdN|Ds{
zKOSt-J~Xg=w6L<Wjy+dSTjFHrd{g|!HH!HIf+HDL>$YFE?v4cbvTY|zrF1%t%z;)y
zh}Jk$&Z4ogcFfV&+Cn7}cBRUXld|`GvBKxpH_+BN#T7=Ma3`E;hJ`b9r*E(j%IB^;
zE)cXs!5);g0q!g50Z(JXZV-)RVx$*h@Jluu%9b#?rfV%2$==_QzUaO8r4c7u{kny0
zbbH~mJ+znTV`h|>dK>(XXLFT=+F@p9<z^+*ROL5u#da-4*IDn~5UKt^#Uh<boj~3c
zx$i0JIYajh_J>}_uA}EBde%mP>jtyWbWWWBB}?!dOqChfk}(8UibQvL>kX71mt-US
z9wODdJrT+g+pJd*E|@PtLG&sPDw_z@52{7(|57NuwDdAv)_MKZeim;shNy(c+Sf9)
zE6uX-h)(^4_-5qZ`Zt#l2FAdH(<|SiKrHf9hb^|A1kU^#G@5cF;KZ=rn+is1ax|)o
z;*z48+!;RP`2)b+bn(SL35V%p!0^#czV2l+>J2t{6BZvIuga_;TuS)zeG8~GIW-#n
zXma4%V$+$+Lh(pL`IcAg-CnXenLFDP`Ff_N7bAt*@z#IX2%|QDYd{{pbOB6`;=}RG
zAm)S5#4OCl9tKU+KrT$*(oxPt6X%lE+3{yi?691<iAB&Ve)iA1VAgA`y$~myn(ppT
zD-Q9pxx`Q%$*ie)b<HY`d;*7N278+llU6piAEZzC$#*;<_u45(G0_4T$B9)}r#~14
zQ=EPt*~VyzkMd=T>+o%8$UA{Kecv)t;-A%iBj&FW`^<kp`qHW%`3;%pv%u1bw7l+!
zZFjFIM?6RR`iOzsE#AIQZ!|+_(Ps_@dM%1E`y@QnSnsQoToT$aW3-#eZj|&r=s4Do
zE>godxkvv+#QcE@GdN5GO96ovA{sY==`fh#0obwEqAE9G!9{z?32TljG5n!6yrL$=
z+%9fPJFLV!FVJgvU{@S|BT6*@zXaJQ0<bV4`^z_%$LXSeD5}*~l+0RnQP0#-c7b33
z$$nfhL@y4YZU13f;0<D26uMT)k;v&1DuqL415{?NLsZ3g7D2@qJ_UkZgZB$6BZxyS
z<X>7^YWhx+9gT=i{sAE1TfsV!cyN~Kda&#R6MGv82W3oSvV=^}X6Ti&pnyZxZ+j5<
z|33_Lqw^qv!YL$boXQ93wpnzrD>B4srJXW3@p@PUtG!lE?Y0Hda=<-^mrGCv;ZRGB
zq)B$x7}1yJ(;qwjH&OJj{`SvrjI9FSH!48W&<wjy5&gtXqrs)r)bXs)Znfjluij{x
ziT>d6@Fu`qngY24@sGxDmrl@g#Qz0As!_ChHhxB;9&Ze+krp-K!l^f)=B3FL+1~*w
z68+1g^@JDu$E%$f0L>*1z#t~tmk#{)-`waQC}Zi_xTimgZI;jXj{@X0M*l`V=tIEB
za++8GItjaR|J+`1u}*VW-iLe%?oK!uWrPXnu>UYfn9l($a~V_Xecu$9cR!`$-3j1m
z4w?8U6mZfioI%Aw)dJ%<pvDa)DpdS1EIIT7D@Lw3)H=NT3w3DgdcDJz@9?nve7!S{
zMwNxAp<#wGR^SNM|6g++IKz^Rj*_X$+AAw737K!-tN;S4Cq-BoKr!^jqnOy(Qu6Zh
zpV=Xh14P7!4>J^XX_YKLN%cPDQ2f_lM9^<#kHg2YhhM4v{XTdjg+XErdkAlw5b7CG
z5*9OZNB@Lgwd8^EP&|uR(WjQa+$>4rBxyHqC1*P`!c!((eEjFWMS#k%Z|VFC<0=eD
zsQ;$X{=NyxP+xX%4XbI9uhoVNY=L^G?TheTFc5+SizfF)%czaA-a7Yr=*F|9w2dmt
z#NNG+`A(-%%<(4r<>?IQ4}K9xYlq%TZf{7X@HXF0KJLoyw>cbj#I?)Jf`$UNS{yKz
zlFlvgh!(@ve~$6L=;1jE)?XeQ{iG7o(jeQ?f7=`qmmqoUaY)wZHKtf2dH)Wr=GFZt
zmlR<+t@2Y!UOS{2pztmg=AsbtP^}P3SI)vb*7;l30tdd}PZek*Bvn<BtQH!A`c$mT
zemk!x)t}>%l4b&-472I)4j|)51$?y28KY5!Y5J#7<DK34TKn(a1cZby>d1v%4n)fR
z^?v<7ngJ7x_GbUZ%!~~>cDS6Xv$>h*5d!hR)f>N|9Y14TpgB*2eSfnCV+~{eN7B)b
z23{&+I3Tc_3{tQbVGrbWLBLFWihPTt79GFi_K8AaFPHUV7{|xa;1CoNDU|=YHE+#;
z^Aidt$rF?bA@92eV|uubgbC~&atb~Nm?cKh{jB9E(5mp-Z***pWdnkIgYth{y4>hk
z79IVbuTSZ;8+Znj1@qN<;h&Ff>iZS2>Zw2<?{WhBX1taC{K=CCfWz(tY9~&aJN|Lc
zZ|Z@CYUNVkMy&oVaQgSneZA`+7^r`++)Afb_E+_RJ_tDd!~J1uWrnRFEH-anXqlz9
zo`Q`S0pg8m3<MK?Ns92_@rOCXA3EL~Vg*cm)XNX(o51~+(FllHgg80sSEfr1zVSO-
z?UD6(ME<{<|0g7XflvzgCVByX6r0N{?Lj$O^;HL8fHWbq&eqOO3{Y_;RttOsc!8IE
z|L+&T|I1WITiZhrVcNkClytVUq<d^WUsGyo>wbA;G%#A+4!$#BrF`H_UJN7`7Y_3M
zD`CPxK0wC4epH~{NcMxvQVckQT>QA>_q=idkq?80hDLv8Dv*Zl<8;YW^=d07lxY)1
z+W&nLVQzsq)DfQv8QPYXbjtlNNpc(m3kwTPJM}(({8_dXaN?E~Bec}^U}xzepcde@
z0a~5DzCMSH63Pk1`Q8FK0DW8jC<Nlik^X0uU`7h$)MS#9-QOI`v3?RvPqv(^da9K5
z7B*8(3zRWF7{tuMKKDuq0OP(DvA4I+1(WUH%#4k*)RmN!ayedAzcrgl+s#$V&LATv
zml1S5$}pq1`TEh+lrB11Bc9_dsj54IGSck?rjW~FkWvNGMT{G4_-QUG4po%fa*Gd~
zmuoirNX@~n)9Q;1S3G?r7LXDi=RDj@@s<L?<N!AEd|))H8>H_Nn-#GrCJiD$mVj7j
z=JP-OUf?AUUB%C2L4KUi1$e^3!UW8kBw(}Q69=3)znPetI!E;M@W^m;cb7RmI=T{(
zlatFGM}L)7Utj;eu4Qy`V&X$yXlUqr6BCnMj_K;Ef9rQ<=jLQ8%ge7t%w}lEy1JzD
zDl1P>)z#EqM_1N8%UzFti>_TM2)5UIHIalT0kO?@R}6K|`$ev&>}HQJFz{Ou8d>mE
zn>=bw1y4`5lm@;>A$t-NynO$v;Vga}(R1$~t;gSNBsD0I#)@@>ZNG^VZ-!aX)ubLv
z6uRW>WHai%q5mU4_I^~CGXYOABYBP*^Nr_7Dn*MDE-wBXNi80j1WxPy@k#>T^tfi1
zul%-@802UiMN;bjtR=WK=ui6V_ud4hUCxJmBD2YY%Lx-CnOu3BKS?l`0cPem=S=k!
z0{eVm)Wa}P?*mra3sayffS8Tv5O5n4M_xgPwEh>s-WU^oiiAwiA2jR=_NiadIE90t
zXRpB(Zn1VF9+Tc&wROsG+kU#`G-y6hHmy1iL3A*#-md*m648reK|tn)t9gLJx?7z6
zcEsF#tt(ug?b9D-{L%@~4Tx;U{lTEAy3bzAo<hUAY6j#lfh(2i<6EGa{CKC|^uqMJ
z&%uGsi0@aLJwU?;#*z4R#r1<^3H%IcXwuah-74d9{7n`N<D%dyu|Lrjj5CO|Vu5Oh
z+`+ZwN5sGsIn_Pzr#wASjF`dLE86#ER+(-7@rOrqr|;g|14cb6n04As9`wo1WU<@l
zOWxgb!ngkL65M*JNuOo_EO4{Q8z<<LH_-PCXUY)cKJ!2~oty(QfzT<*H-5>&3E|&p
z89=HuM0MVq$4y}c3%e`hb>u-ewRiC063kOM^9|v6t`aH;`UELzK<~9-Rfc&S4p-j%
zDX2D%#apqpa%6vSy{qVb6%K!PQ_@IURLKWU)t#x8`K898PbuaFqSt?7)oHG5?D=9y
zbLriE_SUml|EtQjj3?|-BmYV<@AdNXI)X|z#&n|v7tt<jKxAM2q}JaxS_V+&JVDh0
zhw_eFeo0OTwPLDXdmuas<bl8pB4_CNBP~PkofKjmDghA?(d29Gj7G$0IBj=lIdK!;
z#<RVc@Y?f!P4_kJ9Mh8~j7pFU%vXs38bcxD74G38D542Lc}nxp&<$s)!4?18w{HoB
zq=A>(@a+4yLc$2T$2pGtOr=PZ2Z)P}KW_W@{usw~xNMo4!zS-?Zl$)5Xj{;yz1wCb
zI6hAfiY>FonKK|6YkV;)tLoo;&DA+1i4HXleX8mS6A)-<Sl-<X88b&ow>zdH;m#xP
zB`OMYy4}=$GsFzz@?c_IXjoaZ3N2K+N?WvUhnQ^Wj_1AC<gI?kYJA9?DA0ube0EBD
zMKg0`wK#xBZyiZRh1<o2zuk03{$|n(Qk87$Uw=%>xUGdHZ2aoWNxV$z!Ua~1t~Xiv
z+=N(p{Pl8yfKIYg5Ts00<*laYL+rsp8wb0<`Z=|Ny*Vt;?&3~fY2s-e9)Dy+KIofd
zfgY7gWR!tLOeJ!6To+zG{*|`H%ZtW2`2ry)>};-Z>DxhjUDND&<NI4wEz8-Pi28G?
z_9+$;+VFuAiy1o(vvK(fi#++%hct4@jAw*+cxkS&9>SnJ3Y}yd9|&DM&LuPxm3T_+
z=$LNb_80ZlUfAc)cu$EMn{!?e1!RL~O}L=4#a{_F*9Dxmb7t^lRx%f!4Xk_0h8bD+
zUr)&O=vN3V;(e*UBoZpBc}x}stWEb<&o})%k2=-tNg4uyn<?8@iju?YYZ!9Z>2Vj*
z7$-|Mc$?>pBG)lmtoLz#M{%B=e0y9$kdnjV9DYM~3dEb0=XL1G-8Xm5se99n2X()L
zl=|GD@*~2fXJO9;8a*B_>jkP6{zzTd>9c7aKyBLNn&!!4dh=m7v{706;Pl8pv{U(n
zP6@&DUJzAy-CB;CykO@8;){Bw7Gx9dbzo4UGfe&=;iRK$?CjvcA!se$61G@?J=@QR
zW@0T@!%M2KpI(;3sz;o-ptZ8PjlI)2CSPhs%P6de?2JR3sL6@)jvrJ0Ob;==b3x%(
zcGL9cuh0iN>mC=#t=A`b?^!0PWMoxaezsC!%MO<C*P`s2b4uSEx!bx-{KZi?iEMwC
z5)c`Q_`Bj^5z@b8ML@HKkN6?K5@1OQ&b|DmVYD-KY+GqM<mhMsLVBj9v(e~&&Y{ud
zXZ$_7kYQ|m{Czp0giISyBZZW#$cUvB3%Z>=)_e5^ofqz_0R(<4pu7bo4lW>^2Ol+R
zgEk@LU!~eJij2b&nEQ8iBL#+Td|KJyAro{Q(m*|j{{)sDkpRJ4^ml7}8RKn9%u)2q
zX*xf1Pah%cjEng(d*$+DBjcHM&%LG;jinaYJu|Sm4J0YsA{g9D40U3vGbl}sM5}9{
zgOv#dBUo-jJHy%!Fi-rrD_8B{F#3Re*&Sx$qXWOKBPzNRCDa0;-3M|k)))2Ws9KY%
z!e!6%CV%)wG7B9j4i@$W48WAPO-{7EQG~`{jCPaVpA`6v3KDr44zE8np{3=iuWNB}
zWr?!lphU$f7TKIEgjjVWySS<uEG*CVD6HdzC9si3(!RrEa-n&b<Z~%Awe~fhlY$Or
z=MZ?CdkRy{CUs+(4Hq}3O`o~H>$njoj=JUdcx>~64x_fm`UNacqZ<3}B3)2BP-1y-
zK^hIMp`by^qjP!EAz8i3B1FB?EQB>5n}X*+%R%Way}Zq6jjh257DpzM3_;z<7nJeu
z`v7G~$XpVZOA#Vmr~)B8B7&0tGjrW|cuE&b`qVv;)I*&2G!GjelaSCQvseWHI}&er
zIrDddo(eFQPxr9_Qz4PhOmHGaiJv)$inSu%K1=}x?h0J(#Jpj8LyO*mr&E%VR}`u}
zsmh*)I6KITUVS__oZk1Of6kq1@owDlkS>su&bMIQtJ{}Ssz&!?U?KaxSY_SwlBr32
z1O#oK+6)GC!VAiL*||_6t-HOfxRE^Egfs2W7)6JoQ+2qz@}+x7Bzz3rBBE25?_in*
z9BwxTDAXfqedy+OA0$hQj+aohx;IWm0+#CZ8bcb7JZjn}j_9OLEc~(zCRd^|nG%1?
z>3ZCL&*8J$oP+lL{Hb=i?^>{{gMlJUAXa|JueZNNV`X2$=lgosJoWCYB#)ut=P~JO
z{neDp5$L^Q+ze04&wx7SLGd4hekH3tq!b#Q1eJ3`Ev$3nBaR9Kx+eryBdVg~>X};g
zPS0LtO{$G=+XEFujn{3R>1o?vDWD$-wU1Azm-WJi*(cTMjb@;61X5RaB=FcidlSpd
zr2a6HgGRa8>lQAWWEG;m)fFqeZi?RL3Dj!>&SQV;ciKHXpFMj9#&fhdfbNo|iz1bo
z+@X{oG$D-I4XQ}`CqNJAup&|@Y6{(iLZ2j!?t)3n35!$gy5X$dttp2Yr;unz%e3oe
z+qFQLv7{f%SO5+sV9D-Y`ZCqQQq>A``2Rw7la8Rc9P}%4!N(E1S2n6O9hpc_cc2W|
zpO8UQ9yI@yg3}<dgeA7WwVN-X<8^TKieu*)Wzd(YIW=Oz29MQyFMg6n{)VWv!y^}N
zh+yH`+Ex+i*F|K2OdXsZ`D>)95o^t_Rv#-@+1n~lrnVj~2qij>ysjNcI$O^WBx!t}
z_z@GrTGGU?37j0EoM@iDA*iWxf3)9ULvI#+i!z|+6F@E^SuJITtW;y82jtg;<Xjf7
zzAYpxJp)}L5tB*o&J(P=A;1`_au`!o@}(a{H@OF5lEUq<LZ0LURdE^yP32%(QSM2t
z*b)Xs7f2_H|D==1vQ!MT?K@FXJS}-s=N)J>y$y6vj^NqWcdKk&adPxJy0;_Mw?Oie
zNjyd1pfD^}ox<mc4hD}}aum`#Sgts%<iKZjxJYu$5h80<Xq#cx2@ncuTH4;UF#l#R
z4ahD_UQ{D~F?u=4^>lue>*+7>2R6!O+Y-$K`yLNR4MFMi3(DXs8jER0D82$p!tK<d
zVbB*pmrE8{<&4FH4q0B=uE6E&FLY3@6auvQLE}ckZIuXn^NPuK3pE4|us#T_%N*O}
z@hk#eO$zFW3CYF}-+ymw%t%eT`Lsz~0y9R<8hMWhc?J$L??7fc`W&cjH(rn(0W2e;
zC=|?rr%j9n{Y$_7pV>q3#&^G>C`zER!)c@e(*N)JUAt+MZYQ;`_x<kQynTxaFG}0k
zuk`fKe$S-6U~;6-j(_w~_Z+Sh?)*#$VQ0tJ(x*RJE%FB~yfwVR4f_QDY7U~Jgai6g
z#5Z8>0UuF-7${IC@;<b~M$$Va1uMCf5dW^rGYkKjEIt+#-N!K7dc&0C0AP_2xVHPe
z5404lz@LFNUNrMfw1kS-m4MY;RUrv&sCGAj{s<T7p#Sv5f44br^<l(bWOAYE2*aIM
zVD6>^S=h03WREMJg0AK@8|(;2#O5o%EMxp9t`GU?F?LH1_l{;$5(~=S`m4g-%dkDH
z`v;Xz<Aoo3B-&iTXc%V=^M31i)|_SfGFwx##91eW0ohsFy&L|8OEb0GPauU?8D7tt
z-`F+`c)nwtYCg9lU+9K4{*e>U{EV!vS8`_X)E-$Y!p5mWdGNG3uGA2<pUEQH$jz4-
z)o3Y8<4`4E%5>O^N_P5XAKkAqr8DQ12Q*ctVM}E1I+Dw)dXI)4JE*C*p7}nSl-&!^
z$#ZI*x1`n6^TZ3it`u2_@hm+WR-0B;dnNwIcc4d<IFbTZ`DQIx0i4jbI~Q6P<|Pj;
zis7J|1Q14NO;A==R*mBhk#?h7=FE418;rnZ+<y`S@X(RRchEw2Y8_N4{MHWT2rS_8
zsV^=@^V2Md(3R3yFYkrYxiNA2nutKlzC1v>aBm;!!rL$zY?+^bh;6l~&%3)c)khk%
z=_t0x_))=Wnom`gx22u?fzMr&O=W3|n!VAF@=e{fReCXq_kgWS?QHwa4f1q-ZR^OD
zz}unOmd-J0wQd|CD&`Vi>mp5?mvg)|ttvBvo0c`}h&sa5HT*Ml-3EbU*#kC{ZB%>O
z`@Sr4SJl}J7R-sQ^pWMgp7rg9t}2ED-*GEVs0sc0#(1=o_hd`>3_dGmztuJVh{KJ8
z-UVDgLlFn*`+(8AU*mvl97)1*L-_M~&B9WvSC%9szeG=q>}}uHS`!nKQ_OKt4jgAo
z)_t#pIL)c8-zDkU&LVYXGwGSQBhb*wu0|bxBuV1%O^rwX4OD(6w9^_XN@vzcW5+Qy
zx@MT^O2#Esm94z%OWj|{+kPbyQb;~F#z;TKS17b0yO}mbtD<CUMK*Wm;gf%2%upq0
z`<pI;N-1Ju78^SPyTsWhuzUo4{AC<v{2QEZ1P%A;P~a1_al_@n@D*Rp9yrgibLrP6
zB{4Df%dNn^wevV!phctzAj<4q9LV^q_wsTIxFFGn4YrMLQ-sM;bhaW&>sdG<OimuA
z#u5hTZw}b}9u}qGF$_N5kcwLh8dNh1Q}x6o;_8O1RQvX*W(XPY2_f>EV`xI<e<za4
zQV9k(y5lSdACU}d$;Z&*I)TBMU6Irm6Qbjv50u0Vs1?tx5}@t#^AzAf2kHIAM#*z4
z^pej6^v}9jGi=Mk!ozK)E-}+f%W^Uqzl3xGsPOPVF`^0SCq`Yb?nNE@!6Wp~IM9d8
zs|i1Fucnx={d^m3T4u<dQ17Jxa*;k=TzD|G+<LKde*g3qCtkj3PO3&5BQSlWnPfKa
zAzKE!$Y7o&#O#WXVxbW&Jk&^ZG4I_-{k_P^o;;2#CfkZPCDC%jK4>T|+dX!5^dH}b
z)ykyX)(^t?%>@Vf)bu@zw|f%P@$O*Um<CeVB6HiqPwhjvR4sr16|u0iLW0809KzxH
zGF5A+2^ew+=55>}kmgsk3uo=2VITO;G>a>&22p=acfoRijbJ3rjf<8tZs~pHLfjq{
z^wHIEw;-D$ay^QcNFVfMb%2RDSgGQ=+ADX*on{>z90zpQhMOL*;Xq!c5E|`Nh;1h0
zm#);jV78zR@82p*RouraIY0JwPb&)DqasMIZJiiE)W!~iWLW3{dvJrrUaXPS9eKui
zy9Ybc9HM&_og<qmO8SC0JI_gGGdR2$CrQcWl3RXHc19f^As$5)L{w?jr5o(<UC?{-
z{ko_n=AxJh;`QbfS!6_crLyX6x@7sxiR6dD+>#bBSw{I)ERVBW?<AhB%=wjn;S1fO
zDUwr?y>I>DoAH-Xlv{RF;whzT5Uby+VU*ldYtl~A69w^KIZe24+$V7dO{!8&c2lD4
zHE=EY9Hq|(3+3sZ)eZA*_+zLmKczQP4pJw6x#~4YJ60?+dtR|WPleUHDW2e<CU1Wu
zJ3W`wRrYk?EB`w_f(uF4c}jk$>jHYuZF<?ex^0q6(P2mBnSD|Vsu{dmwp;(%W@qVp
zuf~xgQC`D74N^p+{Z6&**&ISU_+k}h$DGXjfC0oukF}6aMVT~m0~nB}L3Zi*^)s^5
zBJRE12y~A?6-<G?=|8Eloa16O*aZ$r92z@;UHxe@SRYrh(R<;ejen*t|HVDw-AqAu
z^75ZvP0*wG>3iA?&!7sONyRM`BlpHKM?6Ee2g~%MuI^Wa7vwB~A8a7LEGVltS9d+J
zyQuFI+|Yc8{gyXv@a$2m#n-=g%4gUJ8NN1vT0~M2YRLM8xI>r~hb!x7G1)f7cLKW5
z8VJztKZ)?{#($!S_j-&FSH;U;>?`OPc~aHB=;}98VfXsxea7P>!-)c&B37bAo7T)0
z_BeG;9JbA(AY`c`w39>M>Si2SrmZkWHMX?HHhdcn%?P4QubX9|p49>A)sk>-4<@cO
z*SdZ>b#wGE!3N1s>w7DYek84ZWw%tmnYVhuc-sJup3z*0a?Ej0r-6}aW<6nB-}`JC
zGic*z8(1D{SAUBeW}%9wcI4PL$!=0&W+QkLSB{cp#g9nLt@PGf5wrHqT}Zfz=JLua
zl8FlH@8oeb6g9i_2{r>B3N3%PPH&N{sz^Qk9VCqPeVVN?sNwM=9<##v>PW;y3QJpE
zFIu1x43YA-{M5PSEuSs#bfa2>xM49J98S)q+urqVy22Pe;aBhH0^WN4^jg70OF4tv
z4DFnId)9T%_YZ2>XcOn8F5H*YczET9If*MV+0xz*g!H=FeM%~%WOR}hU13yHNLvzy
z@He3sdMgiFRyLRHjw8cex?9^wj@_o-pM6;OBho5AQ){_f_IS@6v(~t|QaFL4`=hkB
z!U(XMOEdt;mIUULBhB94BM*-O1x~`M?@xjlYW!FKx9345_~rnV)|YoqFp5F(&bCG8
zjRPFTYtsLYh1-5bTs<G<2^Ng4I$tX(B??(SOn?3ZlGQoXV=Rwrz?I}z{DqUqfeyv5
zAalfEk2x+$FmSzH{h4P%7~PBmsRc8TfDuogOW#=tL;IIGOCbD#@q&5nEl{4ip?P1W
zEGbp)J2?WjS6|Qzv)lXGg<yQ;d9;{i#1gULo3^|>51N|p4xEL3z7g6z6Cc!Jby$Cz
z$UYZDPw6eW!5Gcz6-(&rE2vjfgY$-zWO-9|tYqnc0K4#qZ(zV!D^wGok#Ea4)JKS?
zvVnXQ$eI)_y9}~ZS+OmX!q1HC+Mc{~8&5I`)&+}US5=a?3lGL-kB=!w1vYv3x6r#}
z+sCrKuEzq^2m@m#N>rQA5|2*<vq{qXDEEq#rvXyt^){09#WqgccB8be%PL(JBUP9g
zDVFZnU6T_{H@wBYZb-&kQA2t@k{}AL<phXOY$$o6T(RVs$IRDU3EW?O$`szRGl=}_
zuJ*PZtp!BF^xg4<>-Qw#SnfCmLsvgd)t}(AZCd+w24a`+S3EeCx%q_IjMb9WNNc-t
z^SXcgGW1B*F4b#aZQ2%wc2<z&Ux(~15i?o{xrY+Y%N0+KIhK-FsjKSmSIE-kCC(jD
z(&+as-cC1|5||O+i24WH<0N_u!}3^hg9?6wGbIGa6a>tb39ikVEGWWQtL@(zrmc}e
zQ2Cwq+h)}e56p4bdEaQf8%^7xNZgGukUBo<iKAgjz|#5LcwMb`_KBwF*g&)*xdb6=
zld(o}iu+->APE%}v%1BIi|zQR+4gvDj(X+GvX{lU=rwO*7(>7?2owyQ0K&~Lj_?~O
z{VuEiX^`4I9-W{7K?554K}S4gK5LV;FeZfniQi8jM2O2g!HxYqdJ}?ZFJEs}@7bN#
zAY`!u$>5I6|7V|5OWObz?bO@$o<}lzrkm*n#Gf8m(~?+fL4O;dbq!7X+FKPtmdf$g
zg0MQ4U4Ph4{zRsk+f1FhaOE*wiGV)wo+dBsZc$h(J&Q^&`{M7jb-PRrL%bflE-^fU
zoNTc_w4b8zEzGuKY~py*_~l54W&KPrj?aqZ3M(#DFuOp{paBctJ)*N$aKq;Om~f|d
zj?7>nQ2{n%EfBNI7j92`*Ltub&g#CzJMy`syBi;S^Napv94>4sTUcsf9#aXG+ekyM
zrrw=yj$D5Psux%CX;0@;14(NiCH>sSxot+AoYnHT?#W#~&J|8vxMlZ%?*29cj**~q
zHv2ThmH_3;!UOj8!+KKy<l|T$lDtznlalf)xL8V&(cRm4>I<RmR*GBvMQiwSk^~%=
zq&Jlq0$cJVA+iuaXP`A<C5kQg!wPdQ?C5FrJWy$lpZ4l~GgJNCf-$_*br1>jDxdc1
z<VQfE^nmWpufI@AoO#?Ik4a&+eJb72J92`!xld~(x0LDmvFZ*hQq<~VNb{S=QO$o+
z5Wh|}+5b50a6u4uUf6XY+skSpgpI+^ubMm?lDlxNe-ibM$B0naDK=n4Iqdfm^>dZq
z-N@wT)3fSr?|HcmP)|gQn`v}!_nuETnW5A<Qh)J2O9>2!e#A9M@>!@o%U~zOzND%`
zK1QwO_p~e{neYRxx|6n&Lz$AH3kpU?7C6+^BRUmJ%gBfc+@V^&J(uqI?Kf^&0?d^4
z84CcJ5#qD>aRz``ok-{eE}dOnW>t5Ow-e$Z5CKmiPbNBOy0QVc_2P|Oqz@p3Gl>3y
zN+3E9Z$(vl6@Y)UBG=lpKaKSxb|&EUJlTn~HQzIyY{@FROG=FI%N#%MsIXBVPo%ZH
zv4sK$RO#{&Fh@U#q|ET^u4Gs+pk&FR)uFF-x1F+HL$L(3)=cz0xOY~s&4#Mtmfg#l
z%`!w=jA;7HathDFLJe2riSY9Uff`7EQZj_2KBo$<I-&#TT>XOXjNt(RL)S=JQ2?;0
zkp@0)f7;X37!@Xsst%wVu>rF_heGLJU$U_&mY;h2Eou-XdJe>6s}!ogP)|ZeLW1+q
z?U4Uq-(WA&)vQ1nUZ7}^MH?ONj4dU^6LTu&NZyC*$g<OSF#spWf7u18=$ksV!X+P5
zYd|yrpNAf?ED`Z}D7O6uSV~ad+@3E%I5`RRRDihOcxSw`;^UZnuHp+;DiXlfr^CHZ
z{_dFjV?X(VpA>C|Gg$#>p(|GMpN3pz8*qXe%K#|`-UdL60}LyQ<0eY<J3pr}JWWag
zbN-(nba!+}I1FK6VXg1EzJ}9M<3(E6k(J5@AjnYtL$Ckq!hog*7*XN?LO{?P)L#;S
z$dd;ils6}1a{9(%c??})q<#ZGxI;IS9v1J@ccgXS!j19HTVnmyTNE&=xh!Y@zGJih
zoiz!74Cqu3n3SPvKKcV@fX@&@9Y<&Q>n|i?7VQo|A(uF8DW2?1;Q$9)aWFkDpZA^~
zIOvc9-yC8stS!!~UqA5&CUY^|goznd<@@I^Uevmu7r9s#YSk+Pr2$COaJ9fcwB8EQ
zyA?U5GbQd9YAsQUaNob8dprlAe_H`^9m$<ZOQrY2r#F}Ohw4H$%MSp0^vswr!)Ia3
z^L6)JsyJ#G@S|vu-a38bS2tGR9hMjzjK&)IJgFV5A@dkEupV^aE*bxRI=*5k+p{Nt
z!qWwGciK8eCB^HHfDrdy2G#?aWTd38IXO7q?}p&hW+?7($Af=!-I6Z-<&B`-ui)|a
zAe{Ud_5Gd<wLL?{ug~o7?{2AU0Gnu73xGtN`ErvX4SbflM)&G*0CT?1v~rmp-FY8g
zu?MUeLcyYX2E;d}lMTqg`v8}~<Fp*Gb}znmS*9&VC&$8lv-h3QOO7@M7}TkNBPbRa
zsq?9=tu-x`EJstsVBTmJPceY28nWK~;E;h=&&B`Ejf%5pBO@cXj*g;tN08DJZ+6>W
zK>EBIq$3hrRy+F?>YcPItnWb#+zQfbm(uT#I|K|b)@1RL|L&Z#!Tnu(Z(SgSi>sYJ
zk{!Y(5Dr*}mFdGs9=CBc=?Joy*ZhaAcM~oL%L>yo^~+$kcOO~vk&yeH*fF*|DzYj^
z)dY}zONN#MMS>m}oHHHGc+?w3?+5p(DNQ5evIqvVZlRM770lu59Uf{qm70Jt?z9&j
znu+xnlFKFB0_z5dS_1VHS^lj)0ay1kGJ6R3v5Vwk*+w(t4-Z7YqR&L{m9hsV&VKWL
z<#*Qp)&C8jH_BTHBOhq<^kBm)u=!es1TM>n6z`&7v4GHE$528RAD~@ImtAlJv-tG0
zRkw)k(qUbJ;Tkp<J&)oNlKjd;X>Y&*f)8Yz?&~tAPK^Lff8f_TO%DZr9_T<v6AEVF
zf{Xk(rd_~pRe*{hRG3YmKbHz?`TjyiBK8$}sVO<lx>(^OdWV})#QkE;TE(|0A`9OE
zS)<7QpG%2)5RObh++BA6?lUp0vI0m~Ml7wTOIB*!PV->OQfu-?L&;iU?~F`LsPEgx
zL|P@@S`@$@zGAX7{R&w0;!xJ!!9-p^5CelnUh?rt&D@jQ>Np6W?02N1Fr_p5tgPVn
z-fH{RUXn8EG-=M$I=;xT@^`@eKla`ND$ZqF7fph@yIX)jkObEtjRpwrE<u6@CqQs_
zm*4~l?$87hT!IJJAOV7FAn2>kUTf`j&OPVeyZ5{Ajq%2KjPcP;ck}mORnuzDS#xsR
zOm%@w9f+nH>8E`VY@+SD9KVlpa`SA_{%esEJG2O}MuEmZ6$1K6YmLv1C#UH*m`5?v
zUs6vm^WvcQ+2R8#kvB|;mqkZy8^iA+KuS~u35r$bdoZ)PAUSetv4!`!f<ia-cUaC&
zISDv5Ys?xIAXBLTNOS^rg7hDJ4jlC_i-RVCzb}qai4w;>C@9Fv&Vy>3RK`yol$7VN
z7$kPyo<IS$WW;A{%;TQERGa{NOjwQ@D0k2;2@g_9+>dBI*6cV-VnFOO%&wSAel6wg
zLo!&j8)SMFYIks;CwTtT4C5F)M|VLgr~)TB#!@xG2~-K-ErsxkZ!4yX`ugCQDThLy
zYK`+rPfUV?UdMfj%n7OGFEsgjIIOj*jQrf+y%Y5{s9ir1zt0+V!sC8u1k#PbfM8Vt
z{u+?F<#X2Ucw%z$NLb>b-#jQL#H3?579<j+4wH=FY+!d;(Ek2D?V%1Rg^x_x6GL^^
zAfL|$j@(K{kk3)oAJ^2^e-~RxGh6%dgV}!)sQ2TY5M$zvr+<a|z;`C1x}4{+`EyYV
z)q}GFl^@hfXmyN0RxmOMDSlq|y?ZRqW^Zo~{Mb~SoSf<93BfuZHy|LKC%*<f?rKqm
zkboZ0cYy>H$pP`ke9H9Qw+1%&>6aH5AWIKO$86NUq$BV*TQNoErC~5<3b-FqgNh>o
z%RW~M@LKo}UNnkZL+U-xtT{jP484`1xnKY7lKj<7l^DDMm-|ic@%AJOP9~6gQ7@Iu
z;sgD4t(7kf4ea~<EO5`x&c27?0PVH^PwfR#>;l=|A1pM}_0Z`+ol7j+$3J?!9>d)!
z%JvZlDKkgl{v#YC%F4?jp=X7N+qVm&rfK}I9|A9!Kd4o-3Mh1W$kbHiF@7W_g}`Y<
z-ELma4#;K1J`ncScLD6zX8t$A&L`a7cRSfo(9+ThO+(M%vZ8I1w%n!JmYd0gpuw~U
z`i3G6;gDIXj&9rwG%h?mJhf5{g}SBO6LHfp&cSJuxjHM_!0#1}V16q9sVRwrAFx^*
z!}^3|ig@ePbzOo`(F<^<etjrIGf)dyFC8E`1SDo7v$M00$pyA-m23j$N#!tp@Wia|
zEjUXqU7Kj!#>!R8<buKT<jFWIY#-tCHv(Sf<*Jwj%BQQ$o-6heWS)#xn@az#R3|5+
zj|!44SrEO7B8*6RBU*U9J+?e9GuL9h(NCcyPs~D#@run!hm2$wm$lBON>n#Xbpew#
zjxU3NGz3WBW!>9y`KRUY;Y+?8H(CIuQwanzTC@DsRYBt3n!J2=Zniu$OFs7Y{eg?M
z>_VCLQ%(^>>wiW_I^WC-`QDPVv9ZlG+EalPkzhlgUkIR-gVg>)vvRID0*+dlPCaT*
zPfy;?0#L-NYN;JvCl^PioOUD_;fBCQi6rO8Ra8_oET7afGNJ|va}PU|AG(NDHm}QM
zGg?PQM5sQl=Tc`;aEK$%&(BvUBOoZ$K`l+7i&`nt*hZ|Fs;c6cRM}Zrmnrw1loL%a
zPHM}TxCBT4%w(4ntP5vdCV{R~og9Z}?T>52n~)QgqfbsATN82K!UkvF7~Aet(f$(9
zpjwU?QK0jEaZ|n7`FT?imn0T>(_|SXcAqdR3_>FbYFJgh9HHbB6kG$1FF^Y2FOeLy
zfdodS@F`v{GIJnSs$ov9QaXKVUprVT9;m^z29j^m83ucEC{P&+U6~RSYm8)4YK)ke
z&D&q740O=w!(bgEF3XG-3`!<r{!kGlmXq6iA(LI>06zE!=5k{}AA(r6zX1N(8c9O7
zgo2cT!CT}*Qd@q)8ql8VUcgU`Rp31e&+J^z>w7Eyy%`hdVETaKpR9fIJr@nfS|6g1
zVD;9L6e|MCKgM1Os!HJpK+i!%4Q9p7h$$VlzVYtI3D8^(4K9?=DZ~?5{uSi>PN8UA
z8*6b0I?xGBSb1m5A1Z_vU{JAzO4>Pv@_!*UDY536e9CWdurQnZC9~DTs(XTeObpTn
z1FduZC;q$;xR~G|7&x_j_MEYX$~GGGy+XF%H+fAQVrK+iyCwCd#_DvX;se;ZhJToF
z=qFaWXx$)_tbK40-S_T>*9V+48%v7q`I3{&&m}Si)P*BRV!XJx2sKG#y9Wv_JtGnX
zmKRQ~i4Q6)&A;!#WBq|YV2z}G3A?!x3NRwp(eZx(+|YkHD%j}$7#VDIzX5I<b}{Ra
zKQ02BmObzxbp(B)N>n(1wzXdoDSwWD`IJGPD*Ci1sr6{~K>qUheLLz?^8xxcF0-8~
z)-UhrOZwiUl~&%@Cs(fC-q;8R=QoXj>IaGT6tE-{3r-f*_vo-wB09#}y1Ee$64<6d
zTAUaW50@es;OuCQ7~I%d99x?xBCyyoVDtIsI0rh)3MMdXPGJl1*I56&)!(c1#|r(2
zH~*Xj*m%rgSKCJUJ<v41zVVl<ur6I-M#!C8LB`^Su;n#YI!`95^P|}JO4)2aL0Q~3
zgc%)~AZeM=1(Z=-&3o?k3q%mxQcpdva8=H8*l83#-4$knU@Vd2@p`|ZWID#aJfGug
z7yCva3SL_%NP@jHi6-OSj{u2fGv@{7a7dVvATuqF+eV{Iw^8xr@z3R4w5k@jgYdWE
zOS*syq(RDbch0vUR07=c8qc4*%pK*bMT%jBy3UTEP8R_xYq1ThOIYFk{U0Y=u!FC<
zXCNW3NbEO3!-yJ2i+$rotT1}~I|2U(;{6-p{>ce{(G84#{zf~ni_{0OdczjMY4i*e
z91&?8jTAvZ#eZ8^SO`i~6vh(pUnUX=0tf?$SSJ!Z1CQbWk^oWw(g3mm^58uM@Tdf!
z44?|2242&YWoD_GU}9-FWoBst_z3VBplhO7Kk|pFMq-JwM$?#+fb_(N@SYk_m@sYw
zPo4LaU#8dC)HHxX&@~5C&!qkQNTncj3#wnC$Bz^IHD|vLa}lZa)7H}z<2E9@g(e!G
zrkv3)3k!O+Y9RH~o3w7HsbHdFIbKDh<%fz!B|~AEhP<5iyZ7?i-pNMJ&gkL~6pgeJ
zR`>|7aVt&LChY3;XYiUb-gQ{X`+kg!5-TX+`Kr-^84(&TxkV?sOR`Kc8LsxMh~VYn
z7Qv(+xw92ZX{j@FX(2$abBR7L7zQu+9`+w9Eh1oP=47(Nc4)i@wi)I?k-Fy}EP(9G
zi_OK--S|Sw;snO-3g8Lw2F%M_@E8aXd&>Mc_LPYw`m{t}2+Rp<iE@jPN`9I9cu`p>
zKq^2E_`3<Pz8`2nS`CC-JHQIS{r5`RH1DPMOrB@g<UNn7>4+-uRymS-Tn3tk!OP3D
za4t;(qonKJ{)9l9#lr%}YRmUf8j0Z0`PSCf?kixyVdaw29bJKbVM+n66e)={q>3pu
za|$Uno{yQ$>vaHIap|iF6H?#>U)`rf{&<c%mK)>9-$%up9n5?cF0~%fa`^hF^BoaR
z=zEuZgVpzqj1Tr7E$gOu8+jblKeyF$l+YH{&=wWgCSWtrikWh`3)xs}X#chC9Vo>#
z&m2Q{eMG>gn;9H8hR}qxC_%g@s!}qUc)35BPj+~C)Y&cXQ}sj??)BF-Es-jU4>y%a
zQ&|q}QPS)<IEA~S*UbLHyGABvfeAethi%vQDigf}BLrB<aRyAo-CfBjH-|sZbfHJL
zyCq#|+7+d<JoiAyVRxLIrj!b1bnF=*n5O(BNgwobV9(gN@^DKE`=hu2q0Fx<u`0oZ
zN@11cFE-rT<v@o-0q6t$0hLRs(E%U@m}6!(cS&F~KZ|Fp-^m9A7j?>98sVI#R^A07
z^VTalJ3BQ0&3czmz}gF%{ZRb_PaQ#t_Ie3Wk~o~vdmx+%fZ2Nh^%3~Hv>=fHlx!!^
z1q`JJU;tnQU}8PN)&mG<01(lF%p4<uJ#gDd)ml8RdU<f4T+|V_!Y*sTE4Bsi$zboZ
zfEixfIW=cA15gbT)Vq23z|?c(DOF5a^4G$$U;tMD1HdBX$%!=r3KnY4nNH$a-xkW^
zwge8)DHj~O7I-K)9Nnl*j&x=<Sq(h*pY3$mRu63=BnI?mY(;2I=W!iRr-q_wN_6o@
zp$UY)pA<08I)aQcg^pp7bH1OaB6dBDZxZIAC(dZ$7EcHZZek3UjqFyK_Z`h`e@1@d
z8{WiQ-E>fegCVa0IjF}(E>h3SZZ}?(yk7F8dBc3*O%bH4Q94#7=S!@w*d&D-Fci*K
z%;C;%2a#myb)_nLe=0uo^Qp08$UYM}4@*dnMY%D@CnCQPo-Z#-b(CJYeJmFe2#WnO
zBLGF3d(7v*!`_j2$^L+IEXJtK8GQ~@4{pRu?4t4N;KDlyBTFin?o@Qbq=pn|Q|KeG
z#z}1E^@(ie+yM2efEym_1K!rRo|cv^(I*4UPxRwSiB1?eJ~j!Gx~C;H*0)qOb^%TS
zE{c^k?t#ys|FzbCuDL3##iU@Dis@>eY<Uf>Ty~8KfWKT+%_{g(1kg0K8#H-BND(m)
z0zgOwkEx{f5uAWFo^TJK^2Yy68_nApiGGKJPj2`zj@_`w5E&HQIcjQYiHM+sgM&Lt
z>v|(pqXT&Pf8ggjtf+1>NgAUOVzq-tVoI$24hL7pYk_^Pt$0C=lCOC#2>L_vE1Swl
zhkW53HPg?Eu{OA0h28)17zg(X(U_N&qs)}$bos|)|H|Ivh$Gbvawe@j)`1ijMrctA
ziy<Q9cvCXUV-qKsZ=umJ29ZF=bhtkPS(Wl+r<k!yj|cT}#*qI>zGW9gnszr1YYOv~
zzf-+{(NvE&pVKP7EBjXXgGq}{26{xC6ot|HIs2{FK~g2Ud>pa*v}42Xv2VBJXJ#63
zoy@*OjN8ZL3JoOn#S9{NuDv~w2n-5YQP-kh?FgvOwPA5iw++o`e@JXlPm(;lB=M@i
z=}LO)zg*Y)orgeP{~POSfXz_O3e(Ad2WTVW8d})X1xe5`ha`%acLN|Kf%Q~Z89;^c
z_+!A^Yyj*48~~i$)<mX&r_BMM+tKeOfHa+7ABjmxou<2$-u^dCn!;IW>bPt{U|mNX
zpqf&#wwr!*(K=1)-Wu6%^IZ#Aca<MG8;x1ewQ#7MgO+PL`q)01Zrw(#W=e~md>-Ez
z8ubmpGw2C}AUE4Z=MIsXmKkFw*5)ySZaNGb%)^6M6y0-npTEyscuNZX><X_?k1Jg;
zn-PtAKx@A`+LvWH{_^n~gBQ><MBc&VT;pbo)YmJI*s`<2p|*_eLKh`Y5#kF^XDZ44
z9#If={v1Y=l!APl?XFFo_2wYlb?G$!l4Pmv0Uw!oMkjHn`}kpLHPEG{KwoPDJt_|%
z0U!wUw%s@oOyh;F-ie8G^>HHRE^%xLA3&y^iOOT3=!MN7(O`N3ATfYFVo1#qz<wkM
z0M;Mv?|_v*2jbP5ND)l&zigkx)hPk<e&eLW6c`s~^_f5x0Musy*$=d%b$vnNq!kpO
zTif~hwQ00!LsV|Efju^nd?SQz*H2V&kH>F0fTN3Pr&m(MZ@Ryg&xj&4R;Dmnbt(+Q
z_ueL6Pt!LaiMpKdu;{LYFN!lQ79>2RE#YG8rfamIV>2A4ot8iUYYpR1X=Iea<Ee&n
z-bH11tI3Sfd!i`4@-f&I6JE+VG)?=~2y_xi3mzo7*A%%6n#gv|+1<$=uMf{Vd>uQ+
zsm|>^R}X2B7T%BqA67X?_DIs4R<K7-vGp$elCL_dL!u0PG#|pkt=Z&c$bQh#{f25|
zC@m^z$8AM?^yWe*u4hHXx~3|W>3e2xC}%5eUeYFuz-j<n1eIz;zcnk6habQks6!Jc
zRRCT9D9SRIW`IRa0R|Ek*o@g0C~4~#d?~PI09K|NIC^P_wf8_es>Vbb*en1Y;Q0fv
zxfGYlo})?jN$OyFh=0FVBiFvy!{H5fxf4&erKCtJd}le5F@-zQ$^g$CXj4aps4Z8G
zPZ1q*`!IF9jAsD9G&)ZDI_c(<uI3-Y_1`z3VCSi_iD3Jb|5}7{=?~a&HIGA|htzno
zGA~ztjn~ld1yt(>sCENT?G!){Km{<^^nvy87ytuc4{WuevcR^IO_@7WR<WK2R`etU
z`uu|iID#x&4?-Jf{}Zd*9>Xi}nU@W`h(>relAnX~d3QjpOqZnew<C4Y86D5nC6-Hd
zCFVSX#gJ(PmW!p<m@hv!_?leEFby0!Z&Gkfc(OxN8jWv9?j@FKVcl%(2cOh4nh;W6
z79JW`!71)8hwTX}eDnE*L(8oSj^&;9YAzUAZ{GLCvLRon*K{PfoG6Q)vz0dPybmY|
z=e<xgQ=n)orcFZrOtmeUD@Y^DCR4(eLP%vw?Z6=*3nH3sb@1GDeI;s%TvR%6BMAwg
z@1#rYC3Ql=+>ACoc~8OTx<t^J6+-hwkGU?<w$pGaC?x6Wb&{>P;e!8;mGpO?r0?+?
zhd?s^`z#CFL1}ye3)2bkpSA;5i|-|V?;-!@8kmEL4ek`c-e3dG4d4Q#_Vy$F0c&Oe
zCV(P9>I#6w<)IT5G4U!bJis((8#h;}$Aww@K>-z&A!U7IMP)MpTL6d3`DOROXRraN
z!^1VAX}YL(Kp2(2(`cb~)_>`-)VCa@sHhyFid4<RIexeyo5<kqMN1~6$UbQeVgp(t
zABsAnY4KGgV|Tk|d<OZSonsN~-K_j0`aHSD88kC%S9-s8xU-OmP1V*ci0gZ$(LLpA
z58Wv;0x*Xjc5Jf^T@a#tYVAByZP(B;byF(yOSPF9uVwKZ;c9<MT1>NzGB_OxIdPR=
zxqIY8(6!hTeN;Z?P=R33rkvG+ZOCdhbx+|vRX4?V2OKZ5`Kty<e%l?j)-Qjj1+IHZ
z8H4^e!kmWKc~nit%9RaU&><Xlx<r4LCy2_8LmUO_(u16*JuV@jsnQ4bpT9(;>Za}$
z{Xe&yH~;T0=Vl0kGWzP0P)PUn&kOSoP9g7gzcjd({LP2Fk}DV{d3oQ(rX}PfnKbW}
z^EA<JC`6`S3jAy!@gx9+wqDwa@q0Dd*AkxToOVA<@p7jiLfjmJi({~Ly;l2xK9I;3
zHEtG`$E4Lp8cc<vku^(vaX=EBSBUue@c1?8ffIZPtnOwwsDgmMVD7+LG-j`GO#aq%
z&XW&yWI<6^(d}D_%u~@<6a<2=dNIt|m0oG)nB;0`dEO#+B;~QPa-qj@C3j~`hx(X=
zI2P8>$lvA-+@y$?s2n9T>A)B6u)h8Bl|wQxh*n4d^_-1W;><93)$E&jW~w0a(ADne
zq$(y!`h4@0e`{;{-%D1}vdP5nl~#sh$X-WkzlJ>mdzG?Q&E3_mZxfWicx!$7!9&v(
zu40|m7y9BOy7G38BxtX*j8-FVxVi%O>m2ph;n>r_7hl|Diy2h^aF*<$3AOnmfpat6
zZ~|GHmlEv%(r(UcZ~MQr>|4G8mOfNo3+ayY`E70>;E>>vA$~GdRnET=YFa?)Ngjh6
zeYx+rfEv@CG4moxEQJ}YdZ5P!I1OVOa%MT|iTv~8MMMRk(1~b}<B)*S<ruX>M1_o=
zPz&i}GM6rkk)nZR<wJSeEhrgb#MaCET4SF`wqv*vZN*k*;41UCl&kq3xy*#KjM={h
zENZ_<KJ@Zk7aga~sJve4BA)0pWzbj6gLdQBz7soj#CGRvy3XAqSX~Vww#qK2$_vq<
zlFl>2nTGt7wmo)!o80VWdtWhalXcgu)aX0t5!6)vy)7sRJ)MA)yE|X0OTPovzXGrb
zFdhHIF^W+B{OlO_XQW+VCP{6cNkGHaT)CjY-4eF>$@>7Y3er@UF0$O}0Z$WavG1G_
zcda8Cyw!5=-j^&V>d1RE)zKQT%!kb<U4<DEkL>V~V$#Z$K;M>zAkumLd~Vss=%dk1
zO!^`#IL`gX?uNH=t?StdPTUxB>l;E-Pgm)bip9|q7vbwfy2s;$R|K{Ku3|-^Ehb%&
z-c6Dihe@_emOpXuNT{qKlD*Vpc1ddyQeE@ZEGn<FE4vSgP|lSCwxt6>aXsS!PWq)@
zGEOZYE#e^EN^H^+p*#n-=WNMnq84l+gcL}oO9FU$-W3zJbxK37_6986A8JMd1z5Qv
zhr7wTfTtunxAs^E-JPl;Q{LQM62jD5!CEx5W<q=PXq~|z2tpm4g<oB%Ni_k|8vY%7
zN;@uJNxK?g3}7X{r>i?o2WA9=8t~_l@7Y3+o?di?KG?2LZDtJb8HVm+l-BMyk>!!(
zvz)RmJXh)vxG=tE4^|6o{fN=4N_g0MqjD`rOhFLr<-@~Q_nJu2V@bTJM*sP9rv1yg
zZ+-iZXX<`omwDUMK4*^3qvbYr)_3jcS5<7f-6a60oRUn|nIG8N8g2RzuqSo|_&7#J
zx(9#3+?Y8(kb1S?fyyS<=&<<#YgiXyrNl{aXakP`&yPrR(YVeWk7t(;`Sr3ca{d}H
zat>uk*LDzJ4MiJuUY^Z3j^m198Pe)7yLMFu4gBPE9C(cj`6MOv2*EOwDI6C`3$*9~
z4)cG_`}mi2|6iC2=HlLjWJL?prDQWg#X{(E4c(a87bBY1?GSEAS43}<#}SV>Z9bq&
z|GSD?j=oqF54mK?l~Y8HVt(w>jh~-mv|s1!3y}pfpJ}~XAQN&k2&wU?&2fk+uM*&b
z`;Lwt+vv`p_$ZdZD#@3upg-JjUa2!}UTLMZgg5-9TJo4vH||;Q=i6I}OhXZPjDdB@
zbgnv~$4|^zB1GT63OML==#uJfJPg;Myh6KM110%{eRdnj+m-SY;|~cwo-0XN1voRQ
zmGRYpN{6CmTZn7(#$dY_fgoH;Cm-x~uKCTkoO7B9dBvG6o8L(9SBH#!EYT;m%1Ckk
zuVF4vHm?vm&zotv9^qo$D49By9`{|Fc8HAUyO-N(z4XH4960&e;eq!dY4FnZ4srGo
z%RF=~uiNu_Hb<zYP?j$FWnUtO`CN1_O^hJ2CgliRim$Q~|3;=qM7~k(>43ml)#XRt
zXr*$@fYX8IGBt$4V>6t23${zLo=P3RxcUfMx_8-J+AqqMob{S6wMu@7l#Q7E%@nhq
zRsuVWcVNr-pIomsP?;3jNjVTaD<K5AN0c?RV0ZDiT}BujYyE&ftG65+o3J(SYt1z;
zg%$M=i|hJPVHvHAy%!q?{eO9AT4I66^<VM2{`aa4Z~N(X1@TcIimLVIv-h5KMm_=Q
zV%@DR!Wy%moLKSSfcC=ezRTFe*Dvmsr_6LWx)<$7gKn364G+hOZZTLg4epKXayDEl
z_37Euut^2cT^y<<K4A)_L@USf{c(e+B;=M8B&KsccSfZb{+>`@B2HM>qHczyc)^G2
zN}5N)6P%IuWPS0qhSGi8<DPFa=QF4%(dSL&K+7`*EU5TOqi?uVHvj0pz3P~W!C(gk
zPPFC-)e5u`4n1bKv!VX$DA!9VVq!Dtcb|T)J><^x+>c~7N28J780Pcjm#oVQ$K;Vb
z3FkK+b>e3W3a0LJzi<7L=dIX#!?Bke*01KP@q&|=nq03q#fx3hVx$&KS<r{y;r)sj
zdFy3{&qkT)|A=IKWf~>K@jOXobKJvwJ#3Z&BxP?N%zSsmiV<qe_iK+SzP_@)XpMwq
zI_-BD3V#k`t~ZLUC6}T=BP?IeyFSmA+Ar(VHz(A~`g*T2##o?@|CltfOD*3hkcoTI
zx4hNt|E3p@GxtI^x&}l6{|A6D6WFnm{^@S0M`H%wxqroT``@a~W7{Y~GNi7c&&DUz
z>(3LA%5O#d$>NUmF|1M%4?0;!^Bq~9FW3Y~<8UG`2ofWD$Qjqo+J67Zr(D_1bQR&V
z5&;?Vm72Z0;rQTfyUuh;6bahlxY9qsQj*pVI0fhA87n}U$K`KxKM;yv#p1Z!&PDGG
z(7+#11iqSml0Uh`GO$O(k-bRbf$o%ZGk)Su1HJ5C{m_p)(VtA%9daGPGLj#U3H_-c
z=@^jBY0-$)k!YJ=9CS@*$hxNnkNC^Ca{(`Fp!FVBWD#wE7#kO{1-d5@J-q&G4SMje
z#TSJQk=+?r4O@mMjKp<%!8w~sIInC%&jh2sxoDP<Q7&{R-FyA~){uu7-{vhr!}(FL
z#a5deCEV-pl5HlcEBLr!Wbfr)2pS5k+qNK6#+Yo~r@0;{K`+z2hX}b^F{@G`a(@L8
z4)|y(^plIS3qr%XP9QF^zt**$&cXBoM|H50PI1;Pb=hZPFoELNPKCdyi+-f{+pl=(
zblGCE&jtI%Qb_+5$9^gwtj}sF2+Y8u&VL7ZZ4VZS{DXAnf)at3>R)yS0=Ixw?4%Re
zbvgjp0ocg?@_9!XG3_33h}6dS(T+BKeWc`vK`IKw=Da;zg2-XboC~z{3|=1g;po%H
z?NnS;qx5()3Q;MojFm6q+?sag=$nBreQZZ7HM^NHy^@~8!bs|p^|rcohxRKL;sxhR
z)xkNNs4E;!+K(tGJl$0r-H^tQxMz%?SCok>4EREuZ^&pQ1hyZfl5~@y_dI;9Boy^x
zKcQz^WxIN-Y1)0?3!Z|d5RyLp1-k$R`sQ5mvl8NW4(k>oahwPl^Tp!6lqQo;NZ!_o
zpgysW)9nG);8H6_e(8qP7*y5hiW<}XM<famF`zap-)lyZtqy&g(+Xu`M1^E(4#|?u
zEQ9tSil<{`dbt-TX0eFo^D*6+wf8=%?K86Km9QUVNo4Es$5zh3&j_JwM)Trh-3*)F
zEZi@?rE>{+9v}oEGde{yy;#Ol-X3!ha<~QOLymLCkWCll@tr9$v<MJ?v6%SJa(~pw
zYT?Lkz2J7^SubsS;A0Y5amB|Stm913ZPrPR2~}hIpSidGvpIGiLFe)iv&#7czK&z%
z8ur;X$^OE}V2~%UHgJZ7j1nXMO0SIAUY^j7K?6jE5>OeA4i2$}e2yO&8?PJ$={)%@
zVE*C9G}dA=Xno_atI4){JapxL`v~7S%#LV9-4Z!#sU`Ybj(pS21%f!<AOG}!P$H>l
zl*Uy9tIL~Fz`}gF?pnWGs*$BPx$5~Z!Hss0(~+Zm<PvnBYpR}CuH7u7_xA9kgWB&#
z&G4W0h3uoT9!4q>ySPnExEyR(GbtnWQ0a2zS&~e;j!l@yC$pSO@5o!%Ae%2*nzs^j
zzBcW6V(xqDwjRPwwwDt9Zl8`;PdlZ@uJBB9v2fz;K!dV!T>7WAl(C~R0sEaN-#>Bb
z{+!oQneaH+uDZCtQ__R3q~_brUbMGG+}UYm7-qv+n2dMj@#&!#WPTJ{$@L}CWo<{!
zTv)*t@>F2_=Igz)ITxaT%Lk21#A`jt<_yAco~LO|-(;ibAaSJ2gfaq=Q4#I7n~yEE
zd5E46+)@c(kVkXohva$fSoc}Q68_r8=sEhfIq=J)oY>bcDWn_(WNc6|Rk(T?6HVl<
z<ui2)pW&gQq$^8nEB(@R|Ate?V*fTWpkWOM0}%(0>aDV0q3~0s)x5B9nxWQE5|3gT
zyq#W1#5~<HX1dZyf|fiwJ$v{=^F_B74b+Y<h`KxdYFG3YasKkK6Taxv7fc;i9M{k2
zPMI?>Aa{DmBOzQ;5<*<MSOkj3IPBQYu8bRldf|8mZaB9*_f*5#t-~v|LGvv=ZBa*M
z(DRcM2stqz>>NQz^Z^iVCO|Lx19Sj908wc1=TURrAYuhcBQ*~qlf8l!`V#@kv;Up<
z-0q-2hmkT}JMKYIm#BD;5^2E%M?BSIJZm2AHjD<f^cSTioGZN$?l!dAiC=7e<CXu%
z-K#`Wq^4`w+btML=ry@cy~0h>jBLqJw(%ycF=P)1IJfK|+Hl;G7jDn53i-y#);pBC
zEu}I#E?)PEN7`JWJt3{@pj<9morZKRbm!s>#dhaBB21e%QB5%cr#w-DB5nfp(r!nV
zJU(|jX5Q&KMu9q=34E>#y1O&7<czMnU9Gw`0@UfxkniW6FCoZK#|C;Hw7Q|FV?W3Z
zj+MkwI9+P?=~ZsKOKZ)isC6sqy6wL7GW4bF+#4QF7Hn_9sy$ffyqP>AQu-KL*?~oK
zH|MI=Di@Mv({$eMYxHB1$9X{j^&rf*Hy>*}&3+5&b$GEu)#-5taXvlG)m3{-;F`TM
z8^S%mc-L}nY{Gfp_qvn)FmT@0`9ne9JWk}ablkL(aF8@*Gt#+`Q4pQ_9+O}_{F<Q;
z{<+gr6lI^FX;J5{p9_Re+t#PfdVzPkBP(snG2ecrWOwE-RNW}MUxZB?H-Dqo!I!He
zr0lBWrRsf3rRcw?NwqTTRo{EGO@us?g~TAqM{&#TbMr01VL=_4L3Um3gNB|SUSN!Y
zhhEFFa?@s8(NX>8qlH(A;<+c9k`h(%%o0_&k4%jiG%t-9w0b_vHK4c4H357C_zch$
zDaK3k6rP3oDWb-zRIWE_o;)&*&jPmOG!|Z&UNn{lW-k(p+gd<U<&S`*(jNh7pN=@x
z%t-th>Mo4>S-q<Q38`3fyF)7ap1{jn9<>kDUl@JYdQ)}$$QwXJs~MlFj657mW4{1P
zW2p;?#c)-ES9CnY&dv;3!=NjqO-~kEU;O%&1h)QNixC5Vun~hGfG~gvxY@Vh1_LjZ
z&z<u(WH_W2@Az(iWOoepeN{+4XB0bS_iJ6SEHQZIN)hMleIHBIGTfU0RiF#y6e~!-
z@!a&(M(LZTA$@+HZuCceG54GHY0lT*31lYgwQMg*ea^PcUbR5(Fk*KmS){CYd5O<v
z4vb&tJou2Oe{rjHz8Yus<pte=U-2%-ZdNPSr(YddR+DnaQa^JvA4^T4l0}l9J=rCC
z*AX{sad9L3DX4$j=EYbq+gQ|xM1D}oNqU93@*Q@GSyTN};>u`Ga=eb{-0FzvIof_A
z*<#6Z?mqq&Dx2hoG}aq#?tzM9H>EF)>zPwB(xF8ssNzd+2tRoak`$3y+9GlDPg=i9
zyQHL~ID1K7Fr8bzh5f$umLuze4V}n(eI2`HG`*3;^xzl4t$8(qy0=O}Z&dFZRxA8@
zYxmZVgj@$h`rD(v&I_hp>hwbAP*K@^dK2dcx10oe@iIv{sxq?y?6SZCVy*rp5iOKt
z&Z_vwfLz!B*a0{II88?tdcZ0SMEWH)DO+ayZ{doEQt`r%opr*qqyVz$1Z%zs*4*aO
z=({z5{Tp-w?O-F6$0Ax!<YA<N1jr(nr3SqnSLaQY6L=Zat1tTqzWXB}3vf7-C1f=q
zNe~bhFSt_5#pqDXX>JA?iGLE&Q7*eCu4D?f=scjtJ2oxZXd1140NEHCt*{u*DqL!C
zgSlcd+3|1aeSRVd9bS!Kw|>HYvUj#)*Bq@LO|@3;xUc0>5zX2MnJ~=m&G(J$z<>}<
z%t?j~L%$}cg=+d<;fpvpb~mMDbrVqvD$Co%e|S{oIlw}E)@AsuVJCS*Spvd5rS&Py
z%lC%#!3d9d)+dU5!%s+`oU|gQ>}oQ4B9L#_8;Q?$Em;*eds5?U2dd_NWD}nqieh`_
z+~aNZT%DDs?9grV8XFKsnu&gT#N)nClz$j`z!tSNM;V$T-HJKwGEL)`UV1Q^*@*EF
zE2iT>^z3u)0%pxSWTflcAmtcQq>!6JYI{tmU?uhG(B|Ri)&tYw64d=vFWn02)i2Wy
zcg0H8+n_Z{IHpq!TN?*I<}~U0*1k$ky%`p(k1S+*3MWr~F<;#F^2wXqjsW*p;zCaI
zTlw(9mQ9Z6{WM22uF!ksxFqzEW?(s<m?LY5o1>SlgXMw$0>~nnMhhhc%r*c@DtJug
z+<IsVnA03E=K@oml9)3JO;-#VD8tvY79%=*<Ao=VOmlmOF?ACxqIFLCrfQ$_!e~+R
zupOE`igZO85LMwY+51jLBUy41NxtAXm*oX>9ag$(+xe1LXn3@kqii!ZH1NVBh#Gq9
z)_(cj7<q~vN21CnjoAN8zMEL<lOB5eCBsv4oq4$+=*L>EZ~XTwZ!}KaSA@^of=Y1Y
z9fgW07hX-*kO!)coms;>txHG}{m3uU4D&A^c6XTYcHe2?Z(;+z;x$L>9+VE=hK6L_
zVYi_;rd~E~9!4l*tx3#l^J&ZkS5P_`P&8IQ9)SPkVTlg}4-TQBEhMIxbn|>9WOAN;
zC1qX9$MMe4h^Xa$8Ue-D>LtP2&om5&+hgrW&u`NgAt$ut3&a7wZSL$@#|!OY75;no
z-K{2e9JCWU!`KAU<!P*>hO=fb)<-_kY+l%0&$E(V{bX3_RE}Bm?tNFh_b{8xPICIS
z`?}u&r;P!8+toZ?!QR)44m*)2r8@n$NqSLi8Pk+KuM<q-7TKZUZk^YDhAVJ;p%t$=
zO^+@l*gv}{;UqdSo1ya0p^liEkD3YHerA`+K3_`{)ixcA`%;V}i-`7)6h$5;$g3m$
z7-~=3<AHX-)eas_`p2VD7^_4TeKIFH>~Gk6@p|}kMPPNXS9>wY$OPoHPl#LIf}hWe
z5unRif07)+7(>?x3y=(-(2`-=z>Gv((}V<09tJZKlY*IXI4e<SQRmrjh8kQu%_JU8
z)7GcrVK!fiR+>Y8U|n7vZZl@_Dbq-2r{59;*C{8P&R&RqOJVnpnw;*(x@l_{3As%Q
zwkcg48P)b~()PVfId5dVO4586w9M$+jdxnzd27gZF8Y>nsj7Q}r9L*H;pQo*1>+Wc
zXC8dZP;^%*IyYTscsWhsK?Jpms^HCT@BEY*-l>jT-1js6(>3~?eDwS572oeG7Q17^
zs}e8I$F2!1FGk&m8g6>ULndn>fEj4NV6%pqqqC+JVkLJyLHuK!{tPhj2Be-WtLZ3A
z`hiCySvJ%?RiNCEkJfrXIm#euBHxbo0i0h(--Cge47wa0LOA2(x_jDHbv<(Lra85G
z^!kg|<!cdBVgcG-V#Jfjo#;cG=$u@YKskqeMPl&<!nPKO$Y~&KEx{FD0ww!IMC%tZ
zRhiIpDrj?xi1P{f%KQ%><lLQ=L$mFX^LBiR%FMcega;@9Snnd%0;aGQ3aHd5i$+yf
zG5ML*e_=3G0xy+qZ!pw*OS!b^M^;G1O9sy1EhPhdIB%Q$N}@&m0b>+J(Xznc>~?LU
zBmpNN7+|6}3;^X1Q5;Y0T@_Ca%nV5&9Hanbf=3l%fzDthfn&)XNBT_!PXE*&fu#DP
z&#RpHfi@tgDqD!c(r9~+rBMNp)q}*Mv}S54Vu7q70{&*}K@ub~?Hp)1Z69a`Lx(95
zRuL@^ps+j$sLJ$!)WQTx#BCgj#U3aU_M_Yksvi=(yied+*jFVCE9gVnXnY!ILM!g{
ztK!LlK|}#S2^0qvxZ7voPQ?NKylZLjToypSCntjg+_?w1N*F*IK<*Pn4W~jZ4SygX
z&Axz11?U2RAH*(`1m~U-IKhRVfQ#DwlTXB)Z#dcqzJuF#0JqHxRx2HtL;xP7RAtwZ
zSQ-Xkv{YbmiNNCeg2ny+NBRGiwbXBVgp_kbnmv8yM0OT;z|F7Y*7zP7Zcl>OcPAvN
z2(0CZ+CqVZS*376CCwLY4-%@fH_rjRJ|`-KhLEcgtw&x*0F$^7E8SG~`=fnNmL_Pi
z#4&qGW=5Q@;#_}{zFsq`Mq9VIWNe(R)JH@8M@}O2l~?Re>>37>H1XoOi4qI^Z}?eK
z0L@E)FM9{rBLmQx{F|)}X&_so(Ax(hE=E&WQ1awMvu*z&3+Q{X%gg}Qe}h=+TAcfV
z2CZ4BF-m+~6)qj1Ul<r*0A^omq_GyRIei)Z0Ja1|ay4ulL7c7zxS}0!LJhDKIsjGy
z9spLQwLpjV0}DYm4cKM8|CD?b5p41Kqt{||nm&kQEFH59OI3%9fgkMlo@i{XJ6>*$
z%x|3sh)thuI<H^d7V2H)Hj`;9HRgL;>Ey^S_@}2olu>i`_N|a=o8C9g!P;|r7B!xa
z_H8#KuoUCbI0OrdPs^pIo?ES&+kYa{a=W%0GA~MC3g?k76>F7j<0P?o9o3+m;39l#
zl)+A8eaRJQHxjI+@N?Fj&psayd+f&1+v-X)?mOM_lR1qR`wBx_vUD%2?V9a%TeEi-
zR3>`b2Vr3%Udqx9s_5$m67!?B+8$|<tOufq<32_nqUk<cp6ZRbNhR{e<{MFq(>v6v
zeRck&_pMk6O;@0`#R)RX-sX%J9%auIS$<?F;z~L_wd<gkx@Dl*>sElw5F7a)DTeXA
zdyR(R!5f$1g{K`d{keA$Eh2i+KXo?(m0f|2Vcf2?|CgkI2Vu~y4@HAPhU%CtS;ecj
zds?F8t&5l?mX^biIgEAp-D~-;jT?Ld0(~_!{P>MoY;=arZFRO<%?Uu(-~rML!&<zS
z0a_xCM#}?->e7h;SZ+tP7(hTB<can-;W;OunG!$uk9=AD5sK%`kj#0?DC#Eeo9E1k
z4&=BwwK5bgnBlq96E0aOUNEC#52u<DiM;PIc$+}0XFU7)B69#rk|Vl8)qY^^gD+bD
zTUMhRE0mrH$IK!Ek|I!t=F_xg{rK~Wi|nCeYFJuD)?t)h@Y*cF3+rilJ1YN8OT57H
zxnS<v&Xs*GiUtwKnKbPvF{DDN&iXYi{O=foy=e}wu|DT{6OHBMye~u=`qf+Qt_Uw=
z!DkZOLX{WKLsy#T{fsrY1!MMQ1MO5NT*Yw3p^{dpwxUKVWdq#g+`Ch`0moOJ4+7o!
zjNd0Piqmcw_jbz_d-lsoDHfq61uoWDXKH;yjuT;XaLqy?I=I(m4}D8$g=AOwO6pZ8
zqXpkkpr!*n;j1r_2_JP|N3P<Qq1JRtrWkd>Uv|#VBE4RfFgC>tJN0~2?KwJ6C!u~x
zNk4+=NB3ji1Cc+b3V|<C7fYR2Sccn<$`Cy!$4t*gEpECsRxKM6TF79LU0mSh_i>$1
z+<SrZ>nsUd#lC}Eb!U^3XjjTpjr<n{;xSOX#_>kF;Sr=^%xH(xu#OIwUI*QUAOiuG
z1}NEave2%+AeGot@^9-Dp-mT-e9x=Icb9gs-AHitA020Xc+td&yQUz-VZSFHIOP1<
z`FQp)+#n)?L17_sMlK2WcuLM}&mfrEmz^)(hUe=NTwK4dLy3;Kh*~`#_8Q`5Gm<jP
z!<+c)@=|HP`QG@IZz+Lg+dO*9q;Hx1kX}qfj>R6mH!El2tHzMUSxVjCLVk(GF8O#V
zsI)PI{}+R1AB`0>Dv}}sXKND$N&1*Sb$@v8#Kc?>--*PEPHJ&7UyG0`@W)TZL(FhV
zy;QOuMa&MdW0Af@RHp8F8EwLV(F?fZ_zzrk(Dipr0`-V~c4193W#T8_%aM<xyW@0+
zVz&pQhr%j0XkVc=bWDtv7gOK8*s|nLFDlguukyCTH{sQz&ZcnsSl}(K$~<gGe-Kj1
zvTHH;Ho}l;!&WFLz6Vn=FpOc3=~Je^dMzA>>3ceI3xRfCS7uBL{Jf;=;lf|Kos$Zw
zV#6!$Bn0~Oym$%bkRLOAqNo*LEn@c;zELzFhp-dm6{>c9H+g64(v;PPhH}5np*H)z
zw6s@K@L+ee+Bkdvp5(ZOp3Yjp*uy2QkH!cl-kBV>+vrV*k9$f!%GJexj7*ZKHu|mr
ztUd-{>Ct&_Z2&v#JLJvQmn3+Y<<0Zk^45qqMgGhBHX=d$ZQ<9T=dx5s8k^Oa5&vbe
zR!55cw$6cNZu!8R6^aY2Isj*wl?!_gEZzSt6DMC%GX}j-Q^{!Uz3oh!0OnMFZzsPU
zLWAvWVARz}PF1rZ<Ytp*Xc6<uv0}zx=7YX?KB|p`H+GE(n$xkIfh+N_X<2OIRI#=K
z*j$rL;R!o5#p@J{B<@GF2liJtEsPafjk1W1eMdJVn9jX0!ta?ce@5aWd^47e7!%f@
z<=Gt7_W5Yt$i16NeC-(-f5ky+K$@TK3rNaj;b)IBk_~;5bfqsKejz}ftpBZmoTZWs
z(duhz7J346E}u_nu-+ABakCF;_2eSH1qu;jH(6LRUNy1(C;XsOS{b=&fj-2qxLEmV
z0*{>Yuh$>UJdco)f+NsxeKE1Qs%A|?n!ys6of1Mu6m9C5`nWAq?lN|Krwd!3+X}g{
z8q!hn=opH%sJB0*Fm)=f=7d{I{?cSWi#*ipax}lVv#rmn3S}w8VjL<uS3CXLNe+HI
zqkqgzuZL9^X;9E3gKVsD`{9>@Ag$H4pc#tUp0ElLg7BXZ;~EnFMk#)%>=m2S&0H;S
z#}XTQ2wM7BVSLVN52V15?cpbOyA>T*o+p^)!9|Ps&m;K#G}7t5$X5*yQMR{KN{9{1
z>cj<Gii)xd>LaRGlFw#b*XPMcQM%wMGBkarwdUO}Bt0sm|K+6n6Y=@ev+jzFGkPTa
z+*2LGVf{yvvwK2%txgC(kTg0Lr_f!Uv$w=Ln;EL=GJ|T>-xai?JH>x(*mxCED?$9z
zppveVz>-ZU%o2;YtXT`IUasf6u}VCPtA?R?-i|YTWxr&E911htd7h=DCTByi?l(bs
zdseO1`#aO+-2xp0zmy%SswCDgYm0x-|9W|)z*^1gch$2K%Up=<5=yNu7u(oPWICAO
zs5<U<4R>O+NgVaHa4+_YjF0r?LD_(0W<Es+uYqKQc=Y@GW0Uur#l=Ou`Z*}}f?FYb
zpd`SOJhw+Sgcti@JuuYPj4ZxolF+cTS(T)Z9U8P-#;PZ?7}A{em9zT^X^A>*{AR=I
zv8QMx8HIoCr0oLoldv+(qD>E@nrWwnGOHCS-|Ax~{r{z=^-o(Te*3q*;_p4SWHJp*
z-&Wy0yr}}u|J-8281nb)xWI!8dmYA<FpnB+`x*DYu)b<*YH+8f{^6@**>{)JoJR=M
znKgCXz|#F%%J7=uRryWz)wV4c*HnH(L-G~>3tiO!i#UH9y23o0It1L|38zXcrik;;
zK6!Yq1gggQQp0o4BDuq)qh<1=El<aL_bv;XpdA=%?|AbSTQVb}(U7_7CEr-X@m{|4
zs$<dHe0OisApHfk+qsZCqMaB)bI1Y95@v+s)9Mu`1k#<IrnR!Q=vvZx+b5?SP6GOt
z!#!bTZIpdodzK%V#CzJhs~U+TVnnZr*>-A2pIuhaY#JyOmsE(GyP)B#)mcHNC-{*@
zKkFy6Er^V<LoEXg)Cvdv!mO|{7e7EkWDwQuiR8|ujmJ~53%HdDUIuP$KjhELqm<s@
zGyO1ay&mE9mQq2aC_d3N{}aRR8fJb$HKzLd!xsPRvWhZ#!_w_hS?F#B-+lHI60KAn
zKfq+_)=saEP0Ef>Ix{I|u}N5<Kc$Ro6mV<$>%VV%o}K2MY`F5JH=A}Q=`fj}@g;KL
z@wAmX6uwWo-Y=p{=&M0yNo}zeFNt5zE?_sGH}A@rH-*e8kn0kJjH(mSZ0`ljF;n8}
ztL=g_pmd)xHC{*OXv;YX#|J3$Px*M0S)?|_c~3oKD`~%-Ra_8ZSLcpf-rU>TD(h+E
zkWX!~m*Q_;Vz@HpoP9#LX(J$WEA7PZguch?+BwM|kEf4XPkzRWMcp+9r|YDXqhSq6
zd5-D0$IW_L7qVQ##T93hYv@d1{JM&v%%3NxO8<UZ;D)wIe32{l`LhQ-F>bxlHc>Ac
zEND%R%`OgFyJcC^Rm1wH{TFjDe4NPH>bX|Odt|iuhTDIkIt{9fOR<W*{0<p(X^{9l
zz{M47YBK=Fg<6R0;q}tE#)IRhJ~XUDw-I#EdaHYCV{l)tl#FKkRr^ptSXI?wN6#tk
zM8fi~sP&f$OMcqKrmNAyy#1RxWA6#{@5?aTh)a7R@i#~nupf0xHU{-oSQAR75H1RZ
ziC<yEJj6SEzPCa?cUQ}6pp4cWgZQ-}0!u$<V8x$48WWO$Kc4@7&9$R|>TjCR5AY;R
zL;5Aj0Dl<lc~xZ4-+W?540^yRU;tnQU;>;2k-$Hl2)06w`J*<VI5+pl;{le#!&51B
z7h%*0JG9?1l+PDG@beEOhGx|dF~T~b`pkS@$4or*lGK*%nD}ni!J4x2=caRvc-Y=~
z!Cndy+D#P6%QGf6xl+NoMFg8ulAVGk%s=1pN9E6_P;*e@NFNtNw?8-6uQ<f$1ba&l
ze;W+bmpMFv><+)`<3EuU_axKB%f}XQ6OPUn3Fw?pX`eS^eRabdK*lANcXNq((F8I1
zzE8*Jwn5y$9_??l&V%o2y-o_#hrcRsJ09^}^_biY=ksNF;v%`SNraA=WVWUU6STF3
zYB#|3swl18<G;O^qRp2&T^47$YQlQP<0pGcIbj3Q{4oZfs)*9gzdr_fX5dM@<oXn+
z;SH8zwr~XK0#DO1gnoC)hiw%_I;QUAPD$Rnxr$mo7Gw}wI!yg}0>3s|bqs;aKqsIi
z+XrD2p~dm%scb<(CN+8Q5#DTZVazP|rpekXUwB5_j<_{ON6Q^K$%{+VvmhPk^Z3ll
z7Nq!b{6H^wTE`oMOc{Rvp$Ku~%OgI?y}{-H9DUAIAq(`()v49du{FLrQ<4WlwAK9O
z_$u7}(gg3C94#qd?ZH(!Um0f#c|1VU>~8m5)q3u#7lLcf3$?sq4MJT##&3FagD|)-
zog*U`9k=mXj+3p@rB`cYv6!JZKbD2YzQ1=$Mijn>t#{b8*U@ZKF3=s(q(6>qE4Fl$
z!KSm`JFMy*<y!__ET?JnyJKQ41!5$;qBExCubG;GLgPK%jF>y;6zwZ;x^Y{)1XMnI
z0p7ej)N7Q@tQ`#()RGl4(k!!$k?Y0_OeKSl4_~A9jH%$zPx3k(U-08k)W;Nmoixn1
z3AmGdV@?o=ffT*6wIadyobTCk%r^&CVbCR_Ir0^YxVH}~?!p32tNYWR6oQe9ENkDM
zi|AhUAIWs#$_PGk^gMfYan)^fwjaP(=Zh9E{st%U%{_+4X1-?G7%9`n+m`m^8`jQa
zy_mWVwl9S;fAHx3TpL~5)570}`?Rj#SJcb;<JtH68|2!w=+R$fRd;>L<a4zT{8SlD
zcQ4Xr9P<(6AY^P6PQ9Aho-13n<y-N*)ZDWK%L4Q(a^_F_hv3H`#^2@Yuzv4GW57ZG
zm6D>Y4p2BI2DBC;7xu)zIzJ$~KoQ3q5i|!U#N7r#c{QK$-MRXmyFk$B`Zl}Dv^V-L
z6jZKS<^;7=u0)M@rpnz0lOOBe(rxukWIqD!a-gO>b_?#kpw7+8T_mW*w2T8ja}}cn
zD_CS{c<MI6nEl2diRw)(y`3==8}lYE@9(Gv78#fCg;i)pi|{2R`DbApbre@E<#tc(
zm_esWAJtQ&sjm&`=IIq&mE69uyCh@1pKWZbJzHzpTuZnS4m|v)zUBEw79i||)UP&B
zT!zTaNzpM|jk59giL^`vs83$x%RkNg;!5dsNd+m~oL%gmoFlzhqf0V@o32$-CC=V$
ztZXEc6G)fKm2@-2(s}Jh_nG-V35H5>Qh;xu+6P(PciKc&k1Hx}O%Ha0(!)z=c7F7+
zJUZbz@W6uhc^1kkEMXCt-S|4w?<MLl>SY)>Ew=QXZ9SZ>@STE`M3Q^yitr4}euj4P
zj>%SNORE#c3+Gq0<Pbb+hQ}r0cXevTA76<trMhf+Q9*w-c}wGYkNa^MI|b(stv9){
z*fP;2l4aoom9SwdDp|pj%*>XbSQDsefvi-=(vku@d2%nOAQgrr+KS7s8StH$&o5TK
zQDF;m?et$siV`{35ewTfd)P~6ezukfNiEat8<jP9?fZ=Wi$H(%Kml!CV|5`RTJq>>
z00=RUCTU;(_Naq+BK#OPF)(TTNluZdZ&tL_)FLAX<@vH5aY!DBDm?*(1L1u<^`Mzi
z3m?T36UU`ZtgCI#MXrCb`*v4S`I0Y3QNk&)vx8;;u?gj;F?^bp2H$ao)1AMP5vAw6
z=8g2Un+n7hM+Od&7r8i;Y8^~8)(pHoks0Pg7_SBC)t;jdRuyO8Z#ReUlnlW^r*N@H
zKi&LLeHv4<DZz}FTU~+a0)Kh2>0tdrbvl%%n%qeiNk>PJTHR906N5tA9(|!KR0St}
z+eZ28C@PA61%V#)R2~EiC?NL8i#VqNv1jY#8M-=SG~1G1uj$eS8R$?)PB@+GKGFoE
zJf<VY)|TRMR{KcfEZwye08>n`Sn91eh@aJ-{ux_E&a>eF8^OT#9KzP7z-!Ycby{lJ
z&tbwkq3q07amBy~o&CyhTw6o93V{*f;SOs(7@$jECZ3^>j}PdqK;CwJEdS>6N0Iy0
zUgOb}uKmjF%k1v_7?FY2+pYW<4wr2;;9sKU;=+HuF}Na?GKQ1r;o;HbeZ`ZqFb<!!
z^bD1z>#h<w+NmC1LQ*(ki2+cUy$TDJ437UJ3fyqYd0Y+g`CDYTJzo3LNS=-7k3cc(
zPuQBn;>XVB$$!R>Ln;Qx|ABv`8GvtThv|Jc{4&Fy2fu$r5qu(ZctcJt{2tb**^SXc
z)m+D<c@yH}u}Mf!h=_>nHl!c*Zsp&N2%nQ{o*XOrUgF(ePJeQW(egR!Cc3!2I#}7*
z=n=M%rxGhVE-xqul%M($H5TK72?99Ffz(i+)X^IcFqF|%2~CS1zZU^^>##Vtcm(X_
zKi6ez0Axj&fm;VJ>%#{B&$s@=oc!ZLu!~7({v)3PM7fQSVWtC&5W%liX-rQEIeYjY
zQN*ocIWf!Y>+9bJ)1K-LeFU}BXqcEn@hs{zHlB_M1&Cg+U@e@3)@WQ=Z;oY!ZZFm@
z&OhA^_1C1P659pN`oST^rlo~}+8_HkRGy|1_Dfq)^oxwGR)pfAcMsvm%&9%Q`?SdJ
z7ZvLlkEv?NfqOD7?i+u0M{%BGsYK7ZIJMePgXBHu!kRm&WM4@d#j9l83013$rL?4A
z`aL6NKk_rk-RA3U4_y_-b)r&BM<(YP#El2ocKKezm9M8--IQcUZ>fkcvPg`@F~D4V
zHfK+Y)i1k=U`Zo?Oyutc7mtYX@nfLv{c7M&8Zk}T5j7xZ_A0XbIzK4Z@}=o+2t%EK
zpsXkcWQOEr1bZ6=(pTn<)F<YsgU^SIY}Y~vLY_Fblu+bhHmv7?*%sX^ZmmJ6m|Ede
zo_nAysOxan3FDkUND~T+=7HQ5YA7PeKlwf7zkj)DkCMrI;;HKEM_pgPQA`Eh)R2dV
zhpX!9y1K&fj)r)bzZu?L5~VDtI7$`H+Eljow7!qAo12+&h;bZOwyMjT1(mQI_80i=
zF5MmtZDAm_(h#g}QUG_S&exS+tthzT+x2KZGcULaS59w*XR5ETRbGFfAv<2L($R}5
zB_UFtdl7P7w>Hyi%804Y8Z7g4b|v;jF3+9N&)vD80LGdZ<?k@!BHGxv7NCKhf^J5=
zeoxn>KH)*J7|$Qg#b$d(zWRj3$fnobj?k7$_z`1LLQ+$+*Vc@3HfnDk>zke{f59T@
zk3n2rsDo1k*TD{9F8vj{>#M~eJfd1h*LwDcgIa#LkDxMwPV}){OC9~4Ue%^oio1f&
zl#ROP3r9cCO2#s?|1ZYgIv~ofUHeu#q`MoWMY<)1Zjc_jk?!u6p-VtuXlbdTyA+V2
zyHmOa0pHR4zMuU(-@EsIzdwOtxaMN5YpwM=kK;H)z4uUwVL+3jTt}U$z}}a}i34!|
zv|^EcJnweJhW35H5XVnnypn?x-n#w^HA9W<b6*cx5)IX2nlAM(BQ>i=f_APPo30Xq
zERGiIqY;OYj~?U(%@lyah!;6RZUk>>8GKudUVdE;&C+D-8|0@nn2Mv({v>G2<irm6
z4qci5Y$*&feEFtANqMm%|GP%Yp?1i7?gL12cKlSEr^)I0i_~W3{1dY{cFea#sbHjK
zfgoZ7KBvL-6=sOWB#L?frG~~hZI=Wbfx{ewthp(n2FO^lQ7+^}jKq;56APxx67afv
z4LVv4Ic@`O_yWkZR)8P$foM2i>c4GjX^Wvb6`8M<#Ls^gC-7;ceYx}{$>kjrpW|v=
z{oEI7@O3AwQ7H+#c1^gXR#XKOmf2E?^1Sa$cm|BzZSS3&`DEs8>_)Bii*wOsE~h0w
zd>u#rH<I_*ycrvtP~f~$(^Au^z~`@|G-<3f_BAp$2Lbc2wtak#O9@(^zj>+z+7=PA
zJ90X*07&na9hM=v{#K5g_YqS9N$F8CbqHojnMXRIk-duZT|RVt?-t@yGGd`Jvrw_J
zqU0|^>aM=<v{syb5iB^{7A-{`NKCU4eNG$9JYVn=c?f7MZ#l?2w7Dd`p=Q^)7|pdb
z6S&$EWa<+v5z^BkH<&nrPYOq>XW<TKg!s*hG$%Gp#{)Jsto<$KZMBZazDG(UZ*X$s
z>*~$lSj6-nmvseT$Tm9--eY9f-D>fDG7uWRo8W^@Nyzh?6nK|P3pMw~Bsbgg@qvSt
z>{`!b#v|d65litFKG`y!jmgK0A6Q+k`=7tlYX%+OstqbnC-NOvxd)(ssm|@`N&N}|
z1X7YOG+|cEIm&*C@Sk?+Rl){}U;kbf{+Y`C-+1=-pZOMQXlnL}%J|%0*^-NRV}DI&
z-;&9?`}wo4r{_5=nQu`1*PW`!&Aj=KW2d0F3?ttdKc34KueAZ#p0ImHn46os50(@P
zA+b1kSr2Qw>%xzJg`^bS#{V7{_#M-5o||fX{N&6vE3(cwFkXHtXXD@mZg03)u7e%Q
z_rNKcoPc-&LYa5R(KvnsupQw-Xp=Ts+Ce&Ltb9N*>?FqerM!@6yEILe9nWRu0{PUD
zr<ryXHWi+wo2FN&H{p-L1)9QXdSvY18G1F<i$~^0%6phE`SuH3rhep>dt-9@NzZYi
z;>J!|G`g}rDjRFxEDG{`_`A92>Q2&kw+)exy>8gH2@>iVAYx(F%C4dV9i4aa!3{|S
zN5Q%BuRw2Yem#~MINNn{4=Ndi;I`Vo#qjJ$=oY`@5o-8(aL^vX5W*3?s#%oghL)rF
zIm+?}^DtztN`P_)Y42_bI_q>w577O79KRr3BcWoXz^Y0!I*v-_q;SBRlXn_#OUPIY
z62<UE9pLxunGwchQm}V+{7BK6_nJ(P{lfyXL4A6k8LsHAinEcb(*2Ex#QyBN>Qf^<
z-kU+e9vXitJFR6#wQ0j%5mn@V@~$z8`c@Id6T+>HhSw>6SbozA!|nsKYFaC5+9log
zV06#b$s7i)Du~Ap3&)9a_q@wgEk|1#o-MG$b$J;#`rKSHNuLv-nnw<hO*R#s#r&#5
zkW>Kxw~>_U$n?^g@S+J#@1NMoDCF?UWCJ#}e3))m<!YQF2bxoGI+<kY)GY^e4@BV|
zM~0x($D#VGps!12rpMTE(+a*6BR<hzU8q;dRJevFCZ^(UDh^G!c}baAcz*FsgM|#c
zTrn~d*usk)$j7H`nl!y;H}7Xy1v+T(Q-Hf$uLT{I8|Zi!ut4=q;06F%S_6rm!PcuW
z2QiN6kzp6l!mS&@{zXtk@g5`o*BLdfV%p_dLYgHGurf4km6GB6YyMtK8G27^9SOFK
zg5w*X(Q~(+Wjerit0E0;7gfIoDydU3^}E3rqvEdUX2qd~UP8iPo6K!ed|<>pt{7sT
zzcm^%5kI7*71!|9iYpph?xxF)CpWzr%kXz+t2$OT5uHt6Ad{9Ifsnmx?cyAoX5met
zBz;K3328b4q}TlEd1}*_e2o!ks^1G7&<%=y0AV8q?zAx}OY1OKLxzb?BE_g=6S!7h
zsYyM*gO=c2g(G^+2X&0X;iZZJ*0*xX`42142+}GQa9nRkBa4+qUfT-|pUSw3&i&Z@
zS#w->Z-}#4q~M<P?NTPswl-!pX7XOU0W%5sdu#bWt>2OlIuf$^6Hv;lB<c@ZQ|hMf
zC5kL#Hlo}@cJE**pg*>#ehm{mmU@itzpQ^6dY$LJiF#5uO0q5UWp0iL*5hQ?E(=P+
z%?WG`zqoL%HWtzdU0t@5Nw+DzAqtJ#+%!{>o;+-GnPPO*>chhE5&>6;!i(XJCb@U&
zwXH|R48EVKrTRrM_(8w>%VMnG=-ihtxP(@kT=sL8DzU>~vHE=e5LUZpxYPkZE^`=R
zC3N#d(b2h262nd8Hp|RFVWM?-HSWV284oywM4QyhpDh}o!D<n`OQhrIDuuwd4@b{i
z+K9SYozXuHb6pX>8`$PrGtJ2=z9B}Po!zcLB+sz63&&G*#CSv2u<4wS$Ot)wD?Mw-
zyDo7<H`#0_9Z*=5ivi<RtczH}m3-5WpkvZ>dGcpTM-=L|mmn27KnlneAaFvyoG7#@
ztbs;+Z{W=|wMApiixBW;!C25MtsM?xTqequW=&HKc)fk18mT%#n2JvxcG|u&T+tbG
zz4~!JpdLY%aC9KFN-!~nTV6RcGKP;;t!$FqSaB9jSEUH781C3wCQ3A7#EsMN1Sc)J
zeUU~LF=w5(A&iHvn{o>Ri8VGfbmMcA{TLStw)?E?1VCFJRmT3zN%e)J(ItW7Q)(j5
zN^cBB1&*Cl?D-bk20<e!GT+dqA3Qh?wC{>;6n!LgzYoU!<cMg;;TSrlh4pU4QCiiB
zRl`a(Os_j|I$120g|`T?&6MAkaTZt}Cb<w{<igAsIUcS!Ni!|qN^L(j#L^7?an&YY
zo1dqSj*jV8&s=+}{Kl?@*sk~md+~xmlN*iUD5H6M46mWJLwE6#hYd?dXy4MVc?mO6
zjDXUuiDs+!dH-l_FFraI+fo2RDfd*Z(?=>LU`i5j2~~c}gUz)u{97zrLj^%%EJI=}
zsSC>j3E@e$T8TE;*_gcK{S(@j@)$B`B-AKqsyuqd4bcIY>&xreo{?UPCD#x6(_)`q
z(gwuXRht!*iaw;5fF&5CGEbocAvi$oTFiy_U`&Q>4X(K;L&F3&`^WQhUDcz}>L|$7
zGpqL>gV!Gsx4n5i+J&SkAT8Vo=7aZ%-_+4#LG0l(x7>AHmwbx@xkbuM77msIujUZ9
z3<=jY0K%j-@1|p`wH>GR?J?8(&Cia#H8Zob?P>Oe1`yKgJqwEJ(hRrIx7T7ZI{7@L
zCO;g*x^N-fJ<xYAPviMH@+GbDYPsK;9PK|N=d6-t&ArwzjBAK6%G_^7SxAewSXkeR
z|2?fAf9nTehbIYljL6@5!+%!u@E;@nYNj%>S?W-L^{8R3$@8P*;}%~|JVvE%9piw3
zct*dicz%K3uXw!s7BmQphkpT!0j_2b;Nj-uONTA$ut?YCm-UmA8Yfm^v&(nC<kQ)W
zJ|hHq-!qp1W(55Fu`0)ywu*^94*fXCt93dxI&mrgMIZQ@w>7m`mty;Q*Nio^Bw$H;
zAPVQz3dL8Iv=ENuv^wcI%6V1y-fA-;TJ-&LF~lHN<WX_G@eamZle%o)5=L@asRfcB
zD!DO$gPjSHh?i1N)w)Vex$)>2TB+9sV&>>@D`w7>T5e(UOIc9_M%tOApD3UajO3_p
zq2`;Y)3;dnpOgTZ@f2p73N1Ji?|OI<CS~+|LdoN>_zY*>YlpRy`W2RL7-SPbly9b1
zyix0|Rb=;XvOgrr?Mv!?XPNgGBMgk2f=Uow%O`eD;Ar-$xX^u~ZUuS&v_&xtLi|us
zAmgyhIQsC!D!?Wj#&`UZ)nf~T4VAm6YpuB_b}K^d<{G@|j@$XeMx=f3ofJu<2kh}+
zFXtZPXj<M(M$2a}>&{H(>|e*9)7w<2R7s-2SkW5X!d=qq)yJy>=b5oqu&?1E0o8~u
zY}0TqR1pTF<62Z*h1|It=*DNg&n&cDo}@f?IEwuc>C}lSv6u)Oz2>Fn2M4&Wi1II4
z>iC(TJ-PU)(Wn<1%)H;KFEv$w&0Z3^)_#_<-w-$Wq1`oh@H`pw<nic$ZQx{KJae}h
zm7&Pk<<1gzWFhs5Uo<}{AA))t>#E*LU4ZIeIwrX-6|`YSZHk;-F9r2vJSS71m0x}6
zbaYSsI6yvB_ruxub@hy=B!j)wO{WFKcU;P<D)rq`{46*Hg`Wb0^*EZt@)1BUAe?+F
zjuHQv^6Gk6J*|#VCH+J<MgP4@7WuJdmfV@!;89pJH3c!0K}PCHJzPk@3>t$gmx@-_
zI_$AW0eu^c@qBv?!6%P(II6z64IOBAVbqkovoQ`6qmTgDapn5s1-fR5c0uyPFYTpt
zocN{Fh+chLz{QMVE<3@OTFi`U+&FQ5ztAfxR-w(R7UaPBaCC&zcnwD?m)&Yg*SZK@
zPzM#(Io6`-#@T!1s(CR_X!|17Tg~^{Uz6}O@KC#H3XHPRI^TOT3Gy-MvvQcHm7;d?
zT=st?djPX~6c91O6l2ve8ix80jDTT~U%-ibGj{}H<qKQ(dRCokY6gY~GG-a7u@~s*
zThhd7X2wB}yhc7d1S0qQh29$xM3B>R9>2X@FG!LVRp1Yr<dl>;mo1s1;^GZha_e$D
ze248F^YCkZ?+4hCTG~C6>fYjdKWW<47&_BC)3s3V!7CH=C`cLj!&E8DED{!?Z{N&A
zF5YN%^=Vva+vtm=)h@#_n_aM^c@bn^y`g}o2787=-&_i;x*EC}irX+8)u}3KQ_~qy
ziJk@VW~aI~t4i7g6M<Vb497;_4DJ|eHL>vYn%Z1_QPW8bi_0Q%Zp=p;i*J0%=>*3=
zp+IIQPlr~|NlQnE&aYrcv-NR@3}5daT%&3b+}Vsiw$m~!C!V0l|8-(oH{v1Lci7k0
zR&`%fQ7zz5h$BZ;Rz_Rw`=T&Z!yqR46JObIps%gE?^~uX)yC3Re0rSPg*CFVtzdGC
zkKzgF8PzG5htl?M1!06PUoGWk*+!n1KAvEh{iRfPdz^n~E3|n3jgJwf<6K<+ZtP;k
zgoaUY_T3D21@FKify3M34)svR`%I#{+tL$lDf!i!_KGaIF0D{cKt>5r7Q->w@@h?k
zQLu)OWFe|mQL|8SGTeaQ$@#ici$%Y|C}_i1#Z#Sz(NV@lg%Ng8O8Vf5gSh>esE*2L
zD=`v}F5tIIUcH^3Vy_E2ydq|}Iu{nayLBN$1QeICb4qLbl8)zgg?^U75hN^bLg_%b
zX5de9t01IB45$jOtU}_i-T{LF2qd<JiJtkNUlFwwdtl4+0uEao29&qC6C<XlN|QbW
zVh||js!fmrah2maTv%H$v-X^KM{RRd+JdvMGSkqa4L&(P`jg(iygP8y8?Lg63?-M<
zyi?9m6b;iXKY-}##t(isGi1s;9`wZNcSp#`A$PMDy}L~UX_ihpSLLG&rTg`mZU{Co
zTP)i!l`Dmpe1Wsb5sXMF8rwOvv|(7fncGhu9w_UqMORn9bom5{$U)be(+>$#gx_eR
zg+JbI?{8?DZ{aays|3jIIYVcl&=^n?W9kl2M*q8Bj+jR*S(e{LzkH5-$NS9>jPB8L
zWDXm5<0@Q2A6Q%-%}6ysrPRlh%38c0&ev`C_U<0BLKB9-@XGqq;csV}a$OqXkxiJ<
zLQBxa#mL<cW`-lJAXoh`MFaQFcyb*#W#-RQDx0tcNv_QqV+TXZ-n}uu=?dw!O6mH1
z9p3P8OGNCaB}i6U{Ny6xWHsVU#KN#Z5QgP7Y1Yi-VtDLB#V{l};rn3E5FsM;dg{f0
z%xIeMkNK{ltNByeIzqHZu&xfU<Yok>kYpG%#l{ZKFb*WC>AYv*|9o_}mq(S!dzmCl
z*<;|;F(Asgy}8-jXx!?~d~>??E&g>Ox0SZGwkv;3gB5A6O>k_5Fse`(Qvm+eLpeM=
zSTRFPk0RgZjo&eQrGXe#P5T2aQ?1pvkA25^AL&>F?ZAhQ@lS`WPLSAQ4((UXuxf^;
zM_uqjD)mvjF2=oy<*(7$dt#xlV48jFA1eEK>QLQ#Yb_q6^afG|qBNsTeRAVn_!Q>!
z+NP%25JM?Vd+B#dfWp)x<6@ExUV#d*i;YFPi&}^!n-uJ~BA-YI;tPUg1`6bg%o=7_
zx=#?3oO51B_|Zc-%mh_-wVV(2>e;?eif4m$X#w`<dX>xW2tM1^eG%;Px>-igNfu;-
z$iBdO3FiHNBhw$1vG)gg%70x^WC08){;vlUl=C3`E32H<d?;DM(a}4{!BJS{s&8lr
z85W|SgH6V5^+N3NN>e5AdXC%g@p`TWY6&ZE?G&Npnx@QhD=I1V_oL#SmGVEKxR`VK
z7JDc`i_y0+-gvPpI9kyT&tW9|y60;D^@OZj@5}48HA@w`e{UK}HeyNtZ*=`%roEPd
zp>Fe7neKn5*#B_)mOmASKh}?b<E4L4{{I_W!}e<@;CzjcRqv^6Wg*hIS(dmLH!{tT
zK^rJ<s?o7I=+iihp^z7Tx+df1s^94VjH#~g?Zv^iYdLKac$?yX5p$Tm@NW;<-^aY)
z6@))^4;Wkjn-u?3Sorhp-%$52p!@Hy{2R{yZ<zh}^-kv38;JcpauWzNVa>O(h^;Je
zZfwI>4sJzM<CU6Gk4gXTZ`kEcD$G~?#yg)#?CvZ;<mPY);%liY`pENic6B;3_I+I>
zO!7s%(eNUv+SCMU<Ht>dzivCU6&QQto2t|NW`P@$!_W{pxxyeTn~lP<s4e>&{QoKE
zJd{y8ev*{e6YW=MTK^8C+<&_((~&+KEk=IXd_CPP53&67hQF&1f8U+om4{I?n&fDx
zksI00^_b14D#^QJy9VenNoYl0V9X430W|n&X}HZ3F@wWMT3efN1CGP6J@x^1SYdi>
zZm$1bX&WUCuXL&&I_~wyPoFDDyZZX~zZ~|*{;_rbQ*Zg#RvcS$xp-r5F9GY<HOGgF
z3&;@8K{N+T`^3zPtC;-nl`=j(3^@W2jJl-fud+ojPdhJ(+V4u|&YQiSK<9Xj-D6|0
z(DI`<K0bn8DPlY)KcD~~UX|n3s7jU?&z@g<P}ZKiw;{Eti=T2mk~rrz;s%1(CvmI+
z!l7I}frznbqKo&yq7KiMHxtK#BY?P5)<jY#Zh=Fy8Y`^~$F8D!8r*jl0T40AyEA#B
zdpYAidLnkYnklY1tFmQ{l&#t7!q7xvs<we)ys6D={W`!sP3bG_4pF-@B<b|nCFIAN
zAf1ke=nfhvph?pW@u3mAG)AF=rT4}fLF?)(JAg=#WwKcxu|*^Pq~t}op0CMDv9C=v
zT1QjEWB!DOC-fGaEgUq)b)DRqmN-J7<~CQEU}yl7NXt5o;P2BO@}7F}r=pP*Nkyb<
zAw?)uJ+i5pmWLa%&@7FNh_&(3)@K`%ea;O}(Z_Wiy%PC}$h5#@E3Rb`!?5i=;x{0#
zR2*u*R;-bDj10(-V`KPvJlS4a6tDGKD>#Nat(n$Z6Ye1+PevJep|lJwYL1@T@fvm7
zQ-Oxj!J^2xSn2(^ClIEEi)lw(Sh6y`fIK5-wWS+UL}b2u!AzFaI*PT6>E_be5c95(
zWMO7i0)3m6=d>p0M)jVQv6aVR-=pA^S4XxINY}kM{IvM#a~=IO1<fG`SdT?ATidL$
z$>WVuH5bz>1~d1DL(mQF(o_Iev?7ksBGQhIq5+dng7mT=^n=ywi>FxOCFta6x`7n*
zZ?ov%#od1!V9{-__Qww9UA9bkEonU+jbcoKu-eaubk2L-zOB~{Q4aW>b|7P6slwU_
zP{KNzZ8}brDdqFe4Mx_1<JwG1*BWwUgAcSuRclHWTgW`NZc8{@)m^>C4B_yc*OxKy
z2@HEqww)2^kEA2CrX=+}QMlKBV($hjx-kAEjE&<kHOL_%Hv{FDuT7P))`~7ujBivV
zdeUL({mkg@6ULN9AHgt&wIpNm>1Ot%d+p{(b9=!xdg&f|`o%rEamnj#-q133P=A$p
z$g%+<1g4A=845sdJIjR!S8$p0lIMc!9u4^v;vCoaCtnFjpT22Ps!$wmoJ1yI?6|;v
zhxs9<djQ#4@E4(@)sYNjOxNGB1Fo3G7x4C_XdPj_WJ>L?UW{cHw(fy2*7YrdSkV>=
zcg{rK9dq+UM8=k?-n1{ia(=!ebyXpLy11A*9WqTLLp$d7>&K)KK%K*30>%tkt?)Dz
z<8}1IS4U!b@#uTi1(n+`HYrw;Y7g+M36dNz*~8+bUVzdX3bWA~#h5R!IHWA*{mCJT
zVGj@40$qMw?d^2Vuex$`G&!e}&EBE8hyLnafxM~q8*j-)X{Lz!#+IJ{2D~k;r30Ua
z`y9on9XZ2kxqoI#82jWnuDJAT{`bPkN&+Ucu`{UGRPDYR5=W7-bf6x*1u*QhJ!D(M
zwH~lbZU|@mYe2x~n(@NX%1kztv*d0}qIL!0qLW;rqZJuwVIY5v>g|8dzRYL5XH|7%
z+ZybAI6}<5fK{RS+WGN|;5*Q5)X$tM$P9gi{%YhX?}_)`S_*c<J1P#NZxY{|7HTQ2
zk&wF(1rpQ34)?rhCIgYco|c6v<HK?wdF`|aM2SEY{dPRPxoVojA6DVscV-JCxWign
zvkmK;CC&l>C+Yi{Lx|4-etHz7$8E!v?c7CnbPx~Xx+TQ%aWT64pi?)91KD~mvRBYk
zRD;v7@A^<rpjLobQ&fkxv;ZDAiyVA$DR*@(K`c04S&`vlW{q1Z{_t!|G{vP+8!bX9
zv?P=+I`bs-NBmHd$0LhIGn3ii70jMGEf+W&O{3YgvAFwkKB`*65s2LHej|;u&~!jb
z=zVW84vMq+{!T((h0hUxHb1_44-aVGQFrP~uqeDFNHe4F2fvg~Z+dWoUS@mzhDpyT
z*9}2^b$pr2+5#y3r5bRS`90i67M+KiKXy^g)t7+Wp}o$8sD+Ve-1J+r^Spqx+1iY&
zV`^6QzMYc;VC)*E{ec~JF=U;ez5{X=$rBEyz%KM%gbq~>`$uJiEsga!#3ER2->fz#
z2VRgH62xU0K?PDZ<3Zzmuu$T`s9*O;H%S$V$v&tV-%cbdvngPKG7|A2I7a^?-9>RB
zLh7g!_q}>~bG%mLwcG!T@wdd)fDul)lvZ#ns_I}SwFPZT#=!jKM9X4toBAirAp;Zy
z>H2XCFy@6v=d^+!UggLd&~7N@da}C4E8O({*0~aTCFuYmO+wGMl<*Siz?Y<$7>FF~
zA7jor3|>KaV?b;O*?QDB_<El{4W^%EIp+r9IxNn(w`I5O^>P12VpkTCrcRk?{1sUo
zw+*E{Juw}(KlZ&Yb@{<}@e<<VC{;8oX9LeXnPO!UI;6rgk<mf=bvBicigCO`y>bGj
zo)Ul@%Z+8)mtHkr@5QM-(6YJ2r5(NM3a_x3UxQb=d2B-In<~88xhi(`Wl8-*0NkOD
z)4&saTb-}tGsZxX=Qv9oZm(+$48zmLOEO6^;2ag;035s7@dN$q7?8vO*bV^Ln|4$o
zr}sUCvkUabDm#{}r8t>~PTYZN)^Ra(rOnGsuK}-<(jjc2?IJ&vd~a{8+gnHIyE69&
z1?BN_F%L1N+;los$yIb05<XewK7l!Ja`~=M){KKdj*b2j-ONk@^UE2=s{;7a-FXx6
zvFmbj1+*&H*5xG~K!@o9#35z!hCV&nZMEeW0>`cnxcrGR{Tolj<<VA|j+Yx)NyCja
z5M~~*UQ({w|MDg?4S5z=xpAKY#WAMff3@aA>OThz)?EaR@`@4fy+YRWKr54{njE~0
z&a{XfHn&_>N@Ve%Q|T8nksMZ;mQPb_CNu+<VR(Iv(&VIO<;K&?c<tiufX}GRxaU)h
z2?QQPTG=r<I8b$)&FT1#ReI8T(RlcYOzew<mvLv!ehzxfrzA%hSbAV5J;r`_+&J2(
z(rvNh_H;6ikmEOa|70e_w_+oqqsgI-Aka&9M{GCX>bRXLxg70g-}`DN;Cc1zNWr_7
z;NkN^Q^Ka_d#|~F>j8?ai_C8gk^Q+CNwdaYyEiU(<5FQsSBpm>CE<frSn8w`Sw1AS
zEK{Wz648{FV1Q{t<BZ+!%z_-*TOzN{6}ae+-^u~;qEEZL`WN48@XQ$wh(s};>H1^F
zyP^s$F3O2JycEoO;fCjR^yM&Ez>DdKX~A^kK(Zm}$-rQVCVhs^A%tmAka0`jfo!oN
zDw-oJyj?7A;<SryuLaY3YAVt9hD~E?-0bJk!4KC_wxYQvaD4|s{M&(H0m$<>o$7(~
zc>5%5o49YCjeYGMa})H8zfLfRHrmc_=AByz!A*n>*sfkt=F8!7IpsFf!k-oYFI@}7
zKI~~76CHghBQG$XQ~XZhO)&EP9pvZTck2OuIIrP3aa>sO$@zNm?XfD5CJ^K@1Xfg!
zyXqTC0t!Fi4FBRwZNBLq;e#9cD%_}OBbSsBNJ!H1LH4VKrIx!M^@dWF6)&pgIi-sG
zF^jfK4Qm3U$z;EcMWd}zN|l<oBh@TrOZYOpOQua50$@7kTK19zqLKqjTX0X+Vj5?|
z2>W*QSVraDs~UM!Rp(p;j=L{QuRqJ$j~-)ywe38Tvb@J3Z!sE*Vf(#9Z#o4G^vEgI
z8YI{`!j^wK(17XZErrzN>bEloD9zcRqOE3Lx&yhgrOR5A?-t(dBFMfC`-j~zf>S1x
zuK0!#jk9dwN{xW&4GqUDLZaL|-E}U+n>dw%_#Cfhh&N<kW6mTh0nw`Z+t!EMs81qz
zOISt#GC@Au15^a1+>i)s79<d0#vRd(O=-PLB*l<7@iL~@duit7;fa*04$(po=O<9|
zWmX-&kJ)GQx1u0=#BRDLY|=<WA-#a-8lW6$(-gRl6$h`EtvsI<mDgCu80h!t03J7l
z^AA6reoW<cMXF9R^W0v&Db|u$%>;FGNda^idn?InUsj<3EsS3?2-ePi&E)MPIFGuZ
zPHCny_jty(oIzJphz|Q{&i)6R*x|xv+30G0Ay;Mnm;g8b5g$tFt;EaJ>FxEi9{laO
znEd<%>Ey7J1Dd`0Dda|t_sLuGnP+L-o*B^)S;98IHX5S0>(0yW{#SGSXOw!)r+jz(
zb5*oUH<GCxlvd`-N$yRgb}oXRL%w~ift;VDw?*hRUJhUgbSxuVos0}u)BVIFNW2X|
zTjtwK@hZVuxjL7-Ft$HIeK+rh(`d%5wW)CweFoT{#49@>#s|Lkp-^G)>7KSGxHw!I
zaW$9Dz`9v0lPS%d-L{jBl8yw0!aH+kM=nG;<yVy>EP->^vE7JyH9pte@VO^Ht_X=B
zGirvqfDPd+fkNQQcQ_rVNJ7J{v$L44Y>fhxd*Sj=hw966H^N%(@&h(b!#!rQnh>Yf
zkZPlQ;!mN5oDARHKqklIN?Ivf<*l_im{uU&BwsSKdq|P=`^a{wGb*Rh+Qx%20uM|a
zATM@fqbvAux7zuAHZenVb)MW`nlT8g`AJTT_rs1XwsWA+EH&XFHd8k}p}j0NclQTV
zX{=h`;4+-bO;ZM15^3j3Vu|@@Uy)HLdR~JPao8+zl~8(<aS$+Ty@{Xq>Gp4Y>&8OQ
z`r%5C)n^@y*mp)b=#N>0GaAN(MJY!b^7B~?JS5(PBkB+ZcfB`^doycvJCplGsp%+X
zw+n)cv&pM4I!}Zfa<0Biv2Hd=o~RWRus{hHHNO{KEeW+Nv1SxbkEv*=vm|jPv2L;|
z2Rb_J8Zx;vUx!j>o|`C$L0dDO5nh;IJbUWP<ar?uidnwJv^3rtNeDtDLpP|devd8Q
z1u=(S)5+wO;g>cu^^JWYB_y0$-)+NYy0GUd%#f4&3hMT#<lX&9AqM^m?MG}=#9w3x
zuKbS6*Z;G7c@j>OLZsH@)Uv@9P<c;X)fugPN%yL6lw9+u1E=`{C6<S^5gMWIdYQL>
zf?|(uFM#;1FBxL;Bho=OP22FQ{CiSU09Pn^rHQE{#_fdkQHvG^LF1d8(Mha;<&-ZR
z@(Y4&aTnoP3;3fbO5LA)wvB5Jg;H4#?m2k2DFIhX!kH=NjagjiOE<^854CR)=u2$@
zI-Jq~*$pSL=evP!E+raB>gUY#ElVb`Er=z;$fi3X0lFK9A+?rF&`$)w3gFm=&>p@1
zzPh_tVX0#1CifB!(KZ72CG#sUSfkZkJ)3log3|2SvgE?=-vh(PGG#yma8u;wbq=SV
z{m4kv?h8IAx;73K<G8M3N!$KPV_YjinA-Hod2hIN3f@$%f9JV&S9Jbqhen7v)~|KH
zI-k78O{S@)#u=fneCXe}=^jd<bfoPJj*F##1jlitfU92;uol9tzZxJ<*WRtY$cq!*
zi-l_Bg<+^uW(t|&jsmSrkDtb(Kj*@A9k;-PS$hW&)#K)<xh#;BlpQt*Kf~=Ql2SAM
z)Q~qwtYakB{>T~`UHw8jE0gYCw`<?7cSL|m33DkzpR4MYK1y;GWS|$twU!qcIcn;_
zjaNTM0dVwS+IH2)`UL-0FDg;wYqnn=TZwKjZ@7QtIIyQBz#eDEHja7wUWv=?jZH71
z;it;}w8yv&Q%g8a?h7Au#s1xZY;04jxb6C#L|5J-{SmQSTF+e`U47ji^BWB|Oqa;2
zIZ4B+6iJ%2H_Ju|_EEFcqhCK>na477Na!}OQ}9;h=CtF=TiUdBqE{Qi0CL%LTKy$O
z$@CqnNO9Y?jRyz!hCS2xIVA*6MX4|)I2=XyW2NAk3}X}WJ91rpz2q&fsPaZSI5X|7
zt7{FOB+r}&yK<TFtg&ckx6tBplF?kbYRKga1ycQyK%4k#%m%*n#5~lm*heN3Pr15%
z3vPsbd0%ASa#yVsmqQ!bM)6D!8+lvxM?B-xAP{T8P?4iypAX&dAB1&lc?k&OKfv8k
z95)Wj>%ptqqi23lqRHFSo3FJb2sLcSY2;I;YXyz>+~QHx+LrAvQiQ}X);nv%bX75b
z>8f1j5IYt=zpCrccz%jCoXs1+1*c?XdW`}`*5!R)_FNkiTQHO$07ohPHiDa49@TUK
zMG{$8=*=)nx-&w8iHk8dR){W7Xz+7F%)TJv5%Rzn{&m4ISVIq{-dL}kh>iN>HqXc<
z%<_=2PBMkznxEq$Ia5f8M14isy%M^7gX_qsLhjP%OfGZu43jSUAh)OcqxmdKiJLT5
zpJQ;@^OAV#<i7L}3|g629>Hg(x>$7Y`|J=3$kSi2VfXgu(0L<hBB79Wze5P=C=tn|
zHbF=ce2C(*eb!~FL>|dGgaCS@6uGc~<+A1^vmv8WeN$SCEnfPAIi|Wzu&f(QTV=2s
z3s&4q3KWAUA!$wAIha#}vLUiBts19(#4~|kv+o2+Yli2%zVgF#$bMSDZ;Prt3=*vc
zNnQHd)ZGO_uHWx8%s;H#JDmGCF09{%eU<Y&ejod29K}_{9w2IH1?5wilnH72Bx$Hn
znDDWfMp@C$?i1nXhh^pI7z;JKfw?zSQWnJQGUEYj#)%)tn*`28+111$hL;|-*a6~n
z=}De_Xx|h^KAYA=vCTPhtA!gyJvB*XKzlDgoO)R69U0dID0dRY?7vSMgM6kV={!lA
z_ufZ<wWf^k%TA{e@#VYOnU+$CNNpkx5I21Olcok4`|E_uA@xIO#=0Q@7BDrLBqEGM
z#?1;D!sg}XO!n08;q{lEqn4UGXgc8J5r6Z`v-K;gl(p_O8|-uE@Ey->AnqCP9D1Z*
zPl=p84(kyzOJ&?DR$3JhKdQo1#|*I2{<4Qe&;~mAt1j%zXbxC$0({to540BR59p$Z
zD2!4CUwJYpD12?vD}kj#{ZU~Plh+jk^Eu@TlW60{UKLmdZ@m8cDs1zMK;#!TsrQKn
zzQi1@NC)7;k%o--6dlV)p^v}u;l%4u)7M|0g}weN5E;uR^&-RIej}V9!k<&KET7Wb
z=>RrTtS!lD8n39+Sg8q8P6u#ZJHzOjf9z-I4(7u|_FP(4FbCP_<d9mqCCYDAHxOpQ
z{H=V(28PkV5@ujx?P~N7*eL(;Nsw`YvMQUNdIT^_SRwdx<Z>`3y9NC}B6%c0hUvfP
z^uIXpA8|6<2rM=2zcB9~Pxf!rJFy9qW&h6E`~MK&KkEA55d63Hd>{7tek+_q_euY*
z_ILp&!rx#62WkJh!;08In2iF)+5e=|{DHmNPMpBf1N(hf*q`_xr0raWR?HKC@is-~
zD9K_OEJ3E7?!q`E=?txLg2YpbbIO~1#o~1zcNgs6Z;_&_L81j@d1>*V0`I>+?mtTT
z|51nC4<zEDfjw~QU^|;X7b~6dI~MF4>~150OYusHe7pPY;aQ?a!KGxs>n&1%bfiTo
z)^WBMp?hD@)oxxinf_fn_`78BFJS&#UV^JwpjN>9>zSna?3S<ag7pd_TfEX>66;K2
ziunX*EB^j>hrx1~8sxr3bk}J)@^}elsoDH-5rA@w+4EtVR!+_U*fWC#t42srksZAh
zc)^LxSt-XJA<Y~WPSXP8n7Ds#;(zO1`CV#g%|{KPZha4c{X=4_?-ZQq<vQxtRit%l
z_>)`9hhIy&_n^nT*6HUFrqNeaisClYKez>v_E%@JMsujR!qQxR=OyxNf&e<QNd8Rv
zCPs|8^{2?7kDl8U#_*hqZkhUvJ=Q0V+cR;Etnz_sF1ShD%XJTDE|m#q;WOJKwP*%0
z=sRH!Hf7o9wbts-l$6Iz_Q*j%B37t4Q(<e>GvxH4-c^g&jH-0vTg@efDkZbk#RZZ9
z8+vRvA5bfp37vE6apT}9xJ2EBKm7#g)ZjO3@Y9U;ki$ADOP%E?Lv-mPttJ6Y%cMxQ
zOr1@rO`07^5P!<{(#+n`WrVe$YecbMp0wnTp7}7X`-+<s_G>5ZCib}CstA%w2dUa)
ze^mOSuue+-RHOKtUY^QWH>N$i*bzR;=rw1;8QKWSb3lSdWVRn+cONU^5<h!nMJ~bU
z@HJ>5IToB;F)#ELnJ<N@m&Kjk^}B@y8SgX@;o_~f8@%xD&)(_x<OwNQgjDUZj7hQf
zQ&rjpg%`B5gNVI@{o&*(bY|M*(t-8F$2(cNykD_2M_jozFMe8G<1E{y<QJZhHjSf(
zb};LS4d6PWk|pUa_r_a+%@m8Z!HxSO=~3T;W6CkwX$j4ILOCnpbv9(e5P(IwpA;h_
zd%1P@PvP7yvNAV?$b>a7CrZ>@BK8Q1lppUbYdwu33}^*YwE~$(?i!3GdS4j7Yd1u;
z^ds>czme?jEi6lSPvR2-SCk@J@3oq|AAs9VI#fj8o$9@_yU>F)aiOHEw+(w_NHV4+
z1;nbkT(W70kA@d#G5f5+)$RVU)M`|unN#4*f>0D6v|$sOB*dgBnGj(o<nF~za4-g_
zLEn0lhnz_0W*Z^JXduPt!j)IT&+u!$`Zgr*_L0M7KJXstL)jJhb==jG(Z~1zR$5a*
zOEe`WgWiE4G0@seS+W(Q$(YaR2J75?WM92b`~96{Gm`?}_3CUsRQW~^^jQ-BQ?i3S
zj{a>X{x_zsKNADyf5|=LCIq4kx`vxF!_^Yg=!WE*evWI>i&d+X7SQg)GE#g35s5t_
z^Z*+~2@Ic#uofA^ukb=Gw|@dG1esda6D(IiuRQ$WosgAfa1Z=wc)+Y#4SJG`9CTmz
zJ5xq3o{|hNHx%#Bm>!W$0xuETe+~_ueS73?7?Qh@x75u;w%wDuFD&egjOOr8-q|ie
zKS7|HoJ~owcJD$Tx$v>LGo%<vdy@`zNJhOp@O^;;bOzAsrOTy{(Kz5q02Y)a++F@W
zu_Uje)M25EF<+50x|fEiBvvtrZ)f;lxt&QSc44(!*9_iW{DNgxUmy25^STX0l8uES
z4!1d(1DvU?PCGI0ZBsKSA}@(q=}Y)*W>XRk4dR$n9$Y?y$Ot1^r_hJT{P4&5SzG2{
zTjMNt`&z*&;<x1^neTGnF9#k13ZD?HRB}QZ=MFFm5cYHcef(DZcF4;aFEaQ6rZVf=
zTGxpg6j>-AEg~V86dz^`-PeP^z4+nOg4s%<>4*{0fCJPIaoH*{w-3oVd|o!-sY*7_
zIrhwJ`!m|R*xD$M<v<=ARm7ECIUvsSIlZ6is=~Gk5vSn?x~>JJu37jjV+_xHuj5a^
z@kNkMUQ+Y1Lg#AzK?m@=uYI_x!r_i1JJlXe321jqaIajxzsCP$gHBRiecmTfI#ZT-
zdm4R}+JT69;v%5Q5&Bsa8J)Zmr$v~^;R-6;SOU~RCs5GDY2&0iw(!aDY$^Iq>&dnj
zlYI@#3@Dd;t4FC)8PlsZ<y^!+!OA>XOwjoXYxTVXD#c?l%=3sxq=RJE{wQL>F9&6>
z=<9)GWfHa$h2_N>P3HnpDr`p}Fa;Qoo>;n&0Nwd8`!K%3@k>s`R6AxzN7Qaed7N{-
zCgwo!{3L+26?f&;eTBU9#Z5>}4X6L(!}{UIGrW3|=+)F1#&TRcA9m0<R=DD}cB;oq
z!SWK?pUk2y_?~<r0)`WqjbJzffA)3A11&ueO^!ihxQ%{T?=<4nA*0|;NvKWPJ~%<9
zDa};1f$m81)@Jpmn5$91%1hyo2o(qD&W*~5K0ZjW$b<NbotZK=&c5SK|00LDkeIi`
zn9G$6dmJ(gcQdt==269aEct2*)Px@3ANz)xN~nV)7b?RHVV~pvqh|d7+%dr9Un)O*
zVyhX>WcLda&PtATP@J+r=X_2ZTLkHH>j=8ogq})6{qsTV0bL2Eb-M<-4o`5WL1zXc
zmowHV>d@my?0_fq_QPK|qZvUMaTsge^t%)fBiC-;(>`W2{y2V*eh*uZrDsP(PJQ$q
zq?>;2H~}7PV$A_qcyfN19>(Uq?LnJVYyQDmGmg5!Gzpx&Wan?U&Te(62HM(6lRVs~
zi2~e{zOWK`SNRb+1>RAL^nbL-WnyX$1wEkG1fHq>xDo1Ey%rR?Sz6mL-pDh#Xytsx
z{B-)Geyi<O2M>jtpwCXMUi08)cDd8$luw@7B+?|~hQou;z4cjI3w20k-jaEgt-8}j
zyj~&Bqy?z%#%X;mdyFePmJ_B+g>6J&+6uuTiiCYTQREsIt4zOYqd(&BOI8!>jqoD&
zpDsr~xL^im1X)n=`a6Bb3;RV0ij?=U)lfn?0nLhq=<v_pSVv4kraD}Y?VdD#Y2t$)
z2I)%O_FuA-qFHb__j_kl5yRGWJ(Q1Tpt4lb$s$}bDe{fizwj3uDh@pPy}m{1tP^To
zKksO6>UCe{8C~^98A_mF7?PLoIdCI^xV9m#u+<f#AH1b&J*pMd0WV<Kxl8K^@`bnb
z*pHAjOr<a_73hRk7|?N9TG4*aK9FoRjGz5vW~d?>T2+yPZDNge`gU)k`n!y3LiIK*
zpk=Octp3%QC<*@u!74;cdk(^uC0g$-5652}q6*uN=R?v<1f<Xzov23|Ojsy05E*mp
ztUyY@{R|tEN;qV?;jqj$!?m9N=E}36z66_SQlmCtMg+lUH2AhMtc*rnRj2|jG0T^H
zNt=;oc<Q+d$9QcXABL$tOfh=K_sKq6Ew}DP3gdYHxWVhs-}H}AYoi=`)f<NQw-SNd
z_X;lN_V}ZQJYdBI7j#xpWz*v>gr5l%gFW!b&cV)S!>AU9Eit4Qg8Su)fZ#MT?VOrm
z!v)UPZ8cA3^*|m%JjMZPn0>w9OrGNlOnth0>D&=NE?wqBuU?{2c=_EoGe8`t{+pK6
ziaUH<M`@3PDcbiUV2+5U`-oan-E&MU4&A)B=zvQ>1W;ahK0H8;nTM{u$dwru)njth
z?_9(?Ov3?lTWF-g<zmd$O^=1=?3o>j`9J%4b24Dm+ZiUC^dT+m3m?hiB^GtJ6)9ZC
zJ6Su==U+bAtGhZ<<S+`F%(Q4k{{+n07_bSsk+~vP{bG=`ym!^jhM21wk>P7dxYzx!
z3#uC)P(l|@RRFOgJY!eaEU=#U$>EW(Q(#>#9ob&S#-pu=Z=Jo}@s7eO$x<s83e_qQ
z79Us>yCaqWhHN)-CJO;^^h}<&Ic%*vZ~OT>UBXe4UE|A8d3D1H!71{>ryQ+z8+Qz)
zsOF3FyRxdEyr1w_6gYXH^t8xErR3b=?+SWxdXh63|LHYbt4N|8NSp+eN%@4i>T!p;
z5g;aKmmQw4=0}opX*gUbcn4Qj@a)+<y}Y!9R`2++W&7?qBCS?~D8<H3WOr`RP#oUs
z;Cp>*`iA#I;zj`oLHZ)7rtF?5)lCv|D_Zk1UExe(kJ03!0ozc-b7zUOjiB}N+b7Jq
z+45TFAiPuGz_?cvLlm%>+CS%@bIniC;@&X_*r*N?)3`jGnAM88im!9N$c`Gd8!KZv
zIEK$WFGk%|nRWghhU3|5^<K1z$TrIMcTUR}lIruH>I#nj74^3?6HsJDRh@iUVA!!b
z$XRJQ&VYAYrgfJ^`=@X>*MWe3V*<ksFL1zLoN9D2IYi%;+tAfixP2%9K6~AvY;*An
z%wj24S@LZ#Y1uA%(ayzEmA2BFp1Mk(t}4^j{$)}8{-%ci?Xgy67i`e>%c;8ez4wVy
z2QDGCKya7L9nMbpLAoxRLZlzQyF3nSc#ppCKi3$0S@|*2JzVv6C^q%5jBaRA*M-6W
zEP~y@1rM&Kyn3H#7zSqbGpA?ENp`L(H+Em?hO<`uQPVakx(kbp9*Y<IvFgg~SnfM=
zD0by;G-NiHg#vVa5wTs;_FbEl(6^PwVt|B)*{{H+1N3%vJbEoF=ChD1o^e`2U)-bV
z2^k0li=X~@T+&ChrLJalpvS^Vsi7%yzyg_`3KF@vi<D}0DjPm<`{Vv6$$XZo<Ak4Y
zfn!@_M0Ka!e7Z_gRZrDbE=uh^+OG!V=p0|vR=?H>4R2iN$+p-0&5P8z>4NP^G3jyo
zF4dcD$=Ml14^?iJq4Ds(NuFq=@1D#BC)IsD>j%zye$R2U@Y#!gEe>i&Tee=e@_-MO
z+UYt!V#n75cFHO%-&npSU_s-q6S6?c*`<&QlSXP$2x$t%mlkNDedmA{%UYr4e?Z+!
zag0;Pfj4H+<(h@StJBoI)QcK-V=QS4<aJHpj0(F`ViVRu%F>7d8OUzzZ6?gvHn)%h
zU$-D!^CwXErseF-y1nG6>8-jH#@Uq{cf0k7PGyNk!|d%_#H7idQj-DI{IEmA6;(Q4
z_4Cxtb}^u9oz&@luxF*ugQe#X*eaTet&+64B0^zetluX1|1`i$qPWb#!m>}o^Ro9R
zMLt8yM$qy)e+hNM2<&`e-bSv=uTZ}TPC~Z?JYQHq%ju7}JDq680QLxRrZ&l@fbeFq
zI|K<)i!~3t^I1hslNSqtf^ZPA489K=PC)@kzYIkQE{8ueDEKKg1W*KRNb5W!lw&(z
zXzS|vDQsmz;*+a{sDG>Fe|OX8&Fq4f{GI@qb95o;n!!Fe_5;0h`AoFZ(0GW5>3G=F
zJ)DRD$hir~_y%jm99`|>Ovg_ZG(@I-+EX<{;I^cEc0i=Mm7)pSe(;B=n_j8Iq;=f$
zMs)yk0zHdt!L+q?&b-dZ5kbDQ#a|pxHcyy2q&csM#)Xpq#shQTc*D)E#I>&C*p3wg
z3etcd_Q_s~s5VofL|92@+)nbi+Yv$c56O)3JLfVV52TH$D0~22hln~safI2YCmW#h
z1hJbkcCocS_I)WV+o_piW|^9k6Gj6JB!?PGjquK{ypZ+Tiiu*zB@AG}ipq-exItU=
zVVwP3l%u|%VwJSp1|qq59<qFMQ`%?BpS$6v<0U)|!!v5kynwy5?Y+0(x-o}+%HK-G
zLRs^Z=V%$ku+@>#V7}|)lQbGHMO^<3N~!ov!U~;4^P;`#Q2)&B?@{Be^U5~`!t!tU
zy<W7|b4&^uuq=LTI+&e)NVba`!(tbzp`A;^OWgJ+a2?y{sGew-E@AHEq!2p<OG|>n
zaw@DspSf1LKPHA=nw95VEr`<uhmxZoM;RiQXQt@T#-zSe1$hnA#kyyOHYCOJ*8Kc~
zO#Y%w|9=2Y=zc3+U?ey$1&C10)LXM?lFsvNB>v`%)maiO^bCEZmElZ6ZSnR;?-4=!
z`9i(-$^pE;=$1$O)7=n?2DH`C2xajR_37@o-g{$<=p6L;^OfE$vzYfK)(@Lp-sCrj
zUOqHO`x!qj{Zuz?vpLt-4nm^cjMtA*IoGppe+BbfKf!Nl`-2k30;Bfubiwv)tARJ_
z?e&F04H@H=aTW`3<%nWGf6V>p81l-TIqaD^*p$wg`|5o{RkM)|@j9O+`nD18WIVKI
zKS=XN$=;zQ*|R#@DG%)@;_0SCT*io?Nc`N<uUMy)AsWeJuwG3=nCu`vOge(S#6>{4
z$BsR7*gJDT%G~l2M$&%6sX)+Q!50i^`m^ubucib%?q7`OKzHy}KDI|s%Al5EekU@d
z%MbAQss>C=c(|}C+h=<ZZwA1!F!0gjdOf)xsIoE5Ori3z|6rOewXs4j$g8h1j-~9a
zYs1^Ut)p^$a&b@c(r?BRmKCW-Ved+b1;2th9ut@~@X@$Phk4nZG9(Ry$nGp>_7kC5
z<h+NnU)Td971+&*Ss*XCwBC`J?N`P|60`h{djEIn=>PK=@E16|;3fd}t><|pp>gR8
z1frHbE2L|FK(;oZUz@Uw6D$X$yA5m}%+b_yB-gkLRxQkkAJPI<ji+QuY}I}AgN?Y&
z6j@tP<n_zWz=%63_acHw^g0P-X8NT)9$P<uSda3f;J1W;mM5b*kmrRuqIC?#WFcR|
z-kpZf!&Qy(R$`0lykCtsP(dHlY)N|sOOJ6I1fVIps{f6QSB@nt(Fqu?N^(~brn2*3
zvTAZzUW5H?Wk^N_k)fd>glzcfPdAefP{Tnk$#(}K%njbecbVY-h#^TgeD^z*L<#`w
zbO4(K|KQy}Q6K+kasTdg@>?YRZ*UftQt}U={g-1cx{bp|k~*5h97j4s49bfy^mQ|M
zn^dN2eljAKgQYogQ?$F?^o2sT1hhEGK#GJM3Wy*Kn4XNn(_5~LgIBBDQJ$UJX_zI<
zWv`>6fC8fTi17`7kF>d8`tCd1+uePA@Ty{W^yCy2E!jpiJQ9`&9d{+k68!th{(5>O
zj?0jcov#_@H%AL+H#d=0RqUNVHqqN3Z<f5zdXUd+f*#}SOUc}Y7kArEJHv{L8FF%R
zYW;2<Va6Pn;{y!FG`7}1qxm0|^}l%cUm+}iMY;S}@XQ~K``;_C|A+jO|4Z8SZ@~BP
z1RvP?f&lnvLl2u*uuM};B49*BgtMpTZvQN6O?zmI+aCDy=j676U%zPfeI~NSSmGw9
zrUZSYoo3y`R-F+L5jS9=HN9(3H~j5)yV>4PcYEjkc&h8a9sTol<{Kv`AO^*BXMT%T
z2`4j~HCYh(Mm6(s!s@U_&zU*Qa2S|L%<`vO34SZ+isv24-vK56q!9fZ!-gSosJ>By
zC()fz!Lie@Z~6o&T5g?7KUYei4OJ^|tNZUqsz3~&b24DE)kta}o#Wpm)xV>A{vi9m
zas8hk{k6b{|0y)U81wNzu_Rs+e^11<XpTuF=<+r2o5Z~ozNV{spc*tnjSbmW)*8Sg
z>CR4btV5fF9Z5ikLi31_?D<O(3XnB{;^+q=+-Gk6s)8W~&hahEfNdgRgMcWzop^J?
z+vq28BA|<N|2sIQrhD>N$lN2HHe~VpA7-po#q=<X;_>ukmnKgSbmGro<8Otbbw6G}
zxeS)8bM|8^VQVMDSmxb3whWtJ_@S#uQ)Jq{TW>WqLMtoTj@G)UU`Y#Md3jWfsvqB5
zfAm4x+1XiSM=FFsh*d?e@tdC_h>X_9kC&Xf07^<P_#76)r>C`+TRq|qvk4yIwjASx
z34x+$4SYOcDK1y7MJ$TV_5kPl^WK{r!sFy$5?8S<jxFMq@J%+>z-`njSkj-0oh?7v
zdzqt)tVj}84vDclj>&WmM&qbRN3Q!GxT6pGhk6={8Agu6u542GrGW2kZBc}fIeah`
zW2;TbHO--IRgGzK9P4~FaIA`HNnLQdn9{Y<LXh40n>?KmEA2|@&7#c`Rx~}D?Ub^o
z!kj%Qid@`w&N%vG@6085NClBblrc>v_F9pxSRrz<?{d9;olRfM?&{MgmzRu`ikL>S
zObh9Ug%xCWpI3&>t`_x(@T@isrVtEm-^~qEClQaO5!KFHvMgsL2Qo;>_(C_Yua@^4
z3nO+dUn~F?U&@ii6Vnf|OtHbPTo^5(XN~=t{Ww&Q$THDpAU%BisB8j_U;m8}n66EZ
z%yDhezBF;l;g3d~W=@K3Vm}aaC<{`ihpkqB+!K)suoe}t;rU;>>yy?${521z<8SVL
zbvUi-Z+0O<Nydv-_%cBxmT0IQxgw=nca(VHIxLza+$3fa0~F}AAv*VMV~RAE;Kc$j
zb<1$;&RN*)MKjOP@HS;T<(a5i+lXfa;oPsf{SUCjXUl;9L)u#a#rbV*z6lBL?ry=|
z-Q7uWcXxMpPjCV>n&1R?m!J*79U5rd-EQaqoilT0=DSmM>ry}$4ZQW*Uhm#(t>^c|
z@T~i5y9uIp!c^o;_S?F>SOXAG&EL53L|)}q1rF8x^DJf3ZKS=CWtlGnO!F!Azr3ap
zZJ6CJxN2Oo{Qg$?#3F@zz|rJE(Up5azwUXD^y(~a58U^Dn0R76+&Jsi<NM&^EULN2
z>+kTSw;Dv+%6<0?rQ-j_7|3%d+`;>Tc{#~XQK|x|XG;M;>*$QF`2+s~ta#K9s+!mP
zAUvUw7^d`3k4|Ch(FU!q5rh|5L`35W7=IBUe<5)YHVAz8+sj!ix;jL3EGi}z;#tvK
zKv`X$S>N2eFRe_>>-;W*#Yp<|XKb%o>5^bH%AG{1jBAY0vPIL2UD8LGpRgXdx5n$o
z*5QNHrd!*C+Gr<<KuB}$zU3PnFPCi%v9zfsr{(Z4C7m$5o8?4rB%;Ui4d=j!Py+!v
zhy#mT;Jq7#1e@K%d#pw^g%Z&Vn|fw?6t`^*S<+wV=;^_E8T6y;jpS85DNKmy_(Wj?
z161QiO>koKX>3CNus<P`UmY)WhV30R0YC24y-5l2KaArmLCB_#5aGghM8n~@Zv2!8
zKH@@)lr|1-oDN$^rmzW8SMyCjpb_61Tgy10oM}k$LdyTrpK3BerXh$7faBOdfrH(g
zZ|DJ`((6SpesujF<A#ol`JObND)*ChXj_Jgw;Cd~)NQG(;&UGn@G9N-^;vQp;Wj+Z
zi7MS;F&=p=-6T*S4btmf%il=!(~$qM0ye-rNXx56++Gt4u#K6_N=r~!SCOJSUAdHB
zPt2oIDQ&JPs3S8kBSStSlG`ByJ;K+8kdorYIaWl0j)xXAk%8dya_u`HJ=MF~!WW&C
zACU~<Augtcp;Uc5Qsbg@(_nwdLW{+_44k4}=-s#_^f%@~)jFb5_3{#1SBp%`NkhZI
zNZ_5Bs%+sM7&nY#xPd_TAi7=Zku@TOvGaiPG&;_r7A$(#j*`Vq@xTRQhENFQr-7KE
z&hm|#Q}zHUno??EsdW<1tQAiR!55iprdmrUp=it$y`2fs0b}M%b#P@PUer9JsJ1iS
z_J|b~Hx*LhFWen)BZ2HUSLP`QA15&n9vv<*Hv+uG7EO~so4l0cT+)_DM2KxLj1DFV
zZ#=Nb1p`*1vtym@1E9o10ce<*QDD4!gH;0k%F|$d3K|F9WG`<f469*sc1P~LfpPJ2
zC$jD4TrsJ*%v>2-`KhYV8``2R{B9(M(S2J_Mb=e8s5)mA?(73NHZgZL;QtBT`ycfg
z=O_Ron>LF_@7+#dl$uI6N=`+fxegIG2Dj=7+6{Ww<ts{vQla+RE@IS@(+>2$%4Wlf
zUdPqMmG|7%2Y>Eesb}D++x=XWDRN({+UF}*n$0t(?pUYv?0%QqcJG&}Amc|H2JMgC
zAy%)?g0BZ`I3_2(+RXVO7x^LyGH3V^Pb5BY-4FW$wXK`I35)X8d5H&C8~qhQ0T@B|
zuMUcW=1Ikl3CFtPw{-~U=0WJ0ZlD0c$NNrij~k?9cY>o$#H5z)t;VT0<R{FH?fjr1
zoFF%n1h}>;dz##gmk%}1M|6Tur*7WEew@#QLbdN+wPj@)bHY(aFJ2g&1)r-EhKFfb
zwjY9?(RXfDB%ls55@)hm^5AQPNVgkR@`pHr{0N+~13vDX(vI)WxA*y+=AS?9lk}7u
ztwzZhzJ3ta6~bp*6V9x04L+(?Ie(??9@Gf(!Ox#0jv}igOx=ulkoVIb>Im6i74B)M
z%HNz|c?}kkj+fCa<DzL1irViG?i;VzVVmE^7koRg!}D7u_|;Cd)pZrn@w#+2>UYVO
zTS3%F*=o;b^PJY=^au0)v_sl`B7%eBa%fXxcK`f%!)Pdz7?U+%i4c$L(B;{04eQde
zoq`1AeCnAXUq>*3cEcBiRMH>1rU^eYA#1g~a-{z3;vn4WeBqvD%k@IQpW}e;c`I%I
z{31~fWRMw?IpcJm!9qGLR3yE%E<-XzYX1r~cFlIbx+~Rz_lO<pcY>bz%J%xaEzxqe
zZnXJo6_k+C^+J36tE&(8Oe6_)KY{#=kr<kr_!rh*X4eI&_t6RMIjFg2`^sPkZIufd
zSi1v9_lQC2|0XDGcu6-D)h%B=dUgN!j5Xe;dI0HueEZ@~EZ~cP{jISj*#nxH*>QEG
zlxN*LjIi^wo?gWZ`~;~cX9B4R$yvu03PfxuM01_eC6`7+&cdS7K4&~lD6h+#mpB06
zL3A&E-^qpx@wS2h?Q0OK<|10M13vJ~aQE4C(1~;B4&B%-wWP|dvm6Ayd0PyByQ%#Z
z({})otHDoee2Z0`VzqCdAMdOd&I-P;?2^U5bUD_*HUnyEd?fu@T%%gcg|wr%x2ap^
zDQTLIz{K^f+|f?vb^cwvn|74#1c8#fd5_nnCS%LA_~b8mSPcKI@7_pEABxhkTIvMQ
z9sj}Ee>;mhxwDk*;&eC9#~TiFFyUjtcD=L>hb$@nRkSNJJ7Q{sPSAy5pF&<{kUkwK
z=s?o_eEk+%bPX<s5suV@B}!_wS2_u%_&#*4i68Y8yd4!KwyN~3ldV1S*3}FMfF1#M
zoI^U2<eiZMrsd0*wF9##g?d+_HTo<*Q;1El#@l}^S_X+#5!FqJ&-0G>HR*g?)HE7s
zbzV_;wI58i962;o)hq9^Q0|ueQa-DOFMCe3-b6c^P#>%axQNtW#;Gk7Zl+h1FqMCz
zm$tc3GA}OOT8*iKYi{n5oORB%BYV4jB5>hcMo+JU1p*2vJKIKtEn4dM5NMRIlGn(j
zGBS^6<DOAsc*CV#W7<B`J7Rryc*M|Fgzr5daOKX^Vq2LfR+w7fBN6!%e+i&$!TQ99
zHW*;Y-1xfy4^6MlT1pGRFr<hyF!@JOe`H*8FM?5@w-d3>ah~-~KcR!0uT4O{mTnch
zIwneuR>LiTehxu1-w4sqPUU#SMjF>=BejyI-^%K}CJ2wplnw;41AaI5cjCug%0q~T
zl#GAKzjx6P{?e)v67Watk7r6?35N2}nsDR0J&>TvXW0V#3hC1cjIX$cTb2)k0p_$A
z9~dt#7LAF1SA{8(|3~?*P*a{9Cq^|zy82rTF3PHHlsNl+H08fa>HkTW{8v9v`2Sl@
zPypS)ol1*y@B1qO%iH7o4g!Y+DIs${m?O6;ajY*CPz)mra|kTjEh7C1P>;?B?u=9?
z={J!S7c*Y>JLOLoZAthTKLj=Sx7)i#VmAUFu}%H_+4^s#1bGj|p81xc<lu%==MV6B
z4&-L0I5NK;CQ8lN+#ff0_c)2XpoMHZS4P5?Dg_|it=}nh2yGBtp+!<V%(6o2ahqLg
z-NTt~RD2PZUvXau8sCJT4;SvXcT1YIL(yC-t843g6OXUncYKq)T_OwykpxkF&e_oz
z(>nJ&rW&C4N6+CQ2@2XFiGSRja;`idV*hCD_-frDY>O56Fi%+9aU5^%-N&?t4RPXo
z-@&>NdoA*zNa>(XB+iBQIC**(>TKd|fPtkWm}NoRg!_4f`_$P$w8`h%>mFPn)T%5D
zxAe+=8nj9BY`Hpoj_qfHp1aAq?;-fy6Xs3r%Z~BY6HnyoZng2n_y%hxNnpEuEoIs~
zQbk52T<uOMq6SrmGQ<)0j>5(Z^*hm(@M^X}it3xt>toK-`7~lpfAxCav6HHM!eqm6
zhogYvMbX(x&G}^LMf9PYl>W^}f9?ym`eS(imUSXG<HV`;KseN{XL_3NToD^pqqUhg
z^no{HGUt=N8m@wq(IamNK>-d}(w(;yLwRNUwn<rIM*W>dfiWUJK~btLWT*3G_iHR?
z!%o9Nk!1Bs`b#|CyDX^2e=<=wivTnBFrn;k5gCDAq~DPrF$#rH;5sjz1QmouSeAl9
zL|p^Xmq<68RaT=mlmbv^ofJd;Znf^s$IV*q3inOa?IZ9MWmG4J?`IW2+UwrPIMiQ2
zvwYZv@;T&xQ?ihSrtdu}>gI_^cUTk&MZO3>y9?ainipx{RnEpH1S`8svhN2W&GL~`
z54@4O3{$r8yVdrve9Uo^p2vT30=&%VF6zo`D}K{#H!lYNl+B8x)7VLwXss2Vp!5td
zu&(;?NB+Ab$N^=rW%L)U6s|9sO_hX&2Bj<aqiM&E?;q<0XJ86^_vn0P{*rh$x9J9v
zQwuH0@MeE1!s==s=cl&cw|$nC44xaM^^rtjx9FmB64>;5#gq^=bUid}+t8AUn`8H4
zMK3q10dN=UZqRDF_ayXHC3Y+az&c?^jQ|@!)?A&WA9cH2p}k`f;<U<Bpk6Aig4zvk
zYqG$xU&Yz<#Vl(qu%8&D@Y4I})G>L|-7FKc%Jd3Ro<K#ozr)XVVO)m)QU^N?m=+|E
zC6zf&Z3H}fa_N>JOq8=Y>OJxnVK{tSsIyBH>f({>L$21~T9S^LzqDIq^CNhDnF`uo
z`SB{-s#Kk$J1BIk9mI`p2C0pn>iq$6Z95l#sN6;^QW7Km3}H1frLboGKsTUQgP*@&
z>T^(o831*D`3)`#K#*NIa%nGzssiy}HyMakRtcn+q(d~^)bgm(CV~$g`kau7gGVpk
zl~2pM^pTYfiQ3m6f6#XA2fm(F)!vH>`SQn&KJ6hi7gLs#q8YeqT2zL0Ho|)9+lgoJ
z!p5YhZT^ajW#*&8paap<w~4bx3KJ~-2-ene=h`!gXhwbzEG|kQYA#L_F8w6tXGZO~
zn*q@f%Xl18Xe-_hBpx-Q$&Il690{D&GI`8A&<=Rz9(aK`Q!wG=K@J-8|6>KznHIo+
zP%+x5|Jf$NYa;-ysOtrxuHL#57|X0%V`q}W(T6Bho7`YfbROEeqk(sm)ZN#anz$a@
z<JxEYk<$A{<b2>|%J@0vpf=|gizM*Xq2*7M$%hUTs}~{?yc>dJ1*lr6E$s-j@ak8A
z??g9bubqJ~sZtV>8H^Zqx{MdiS|oiRSe_Akf2vkHF0hAF+@8aN_KtA91*ee^kz$y~
zteoG%ocaovVdF-so=nBX*S(*ws-n&}e{~NYnQipZzMgH~@SF~oC%r<^&L~s1b@f*i
zoesxY7L6{!COf>ao$W2$Pf&IbTwUyC$~@|bPtsA?5e-GYU<VOjQ5e3inBDJ6ByHzG
zr?FOy!6HV*R!eY<bmf^i+!6|&Pix?1oQOYOOJew^=tIJ)|CX5G`LW-*&98p%_6^fN
zPfoo*h7xk~VKL+c=-Y%JF5kyLUOGA3xk|CGqPcGpLl*5?-U91bF8W6EcvsD^7t@GA
zM09P;i<DyKF-|lh@oFsHP;sI7nF`e^6uFyCx&i>ZG-!ZhK<vizt?=sIbKJf6t=~QS
zp@Bc~oA40h{ktO6ObP@JKH$wh?&)wEN<NwB-hf>5c^}L9o)GG0(sz+?@MCI6&aJbe
zFFLC5J))q=B~4d+0BpY08?g~}XOz?a8)ACvUM94_$6f#Mh3|oIHPV3*J>L(a4+-g8
zAo)azXl8x@!|o#fpSk9OpKb3OJrbxw97P=+nQ6r#B<Yr=H?Uc_`@lTu+r5k<P0tUF
zG6?hftDT0X=D=Js`u1roBrPRk>b@!%eLn&xNy|KtY7xiA@*8s_;f4s!Kos{k%dw=p
zGgfLUuBnYHhUHXt1oRUEr)xAKK0;!Zq_;IEMmpnAXt-?n<Wlt5XU*IZHRs&t$e8Rf
zAGx?%>rp7lsEOXvD+@e4fpW)zEXYEh04ok8rBLg<<^NHMW7vH|seGDSU9*&ejgi1D
zb<gYoU`{nCO=e2{a90#ioIuwcDX!~bs4e-5tkk<q_%iepaqwxcXOa$1;R~^tjs~>n
zz+_KGsiCZH6Ouv(m6@kCuW9;mzXRRLd+@=?a2xoO<W%A?lxy{<8z#EMq}9`$e0kfA
zNSn8Z!6(HN%;Ys$DJ{~kObaPsW0<qKr2>Sc*lNO~wTs3B3an3lz!fD@1N)%|k1KR+
z?6CU?P{;lt1uHK+Z2j+o<AVr!%}BGWel#@Vq*g>6Q((u(@x++kj=ZQ^J276UBFyBL
zVEwydZ%3c)>_*vZuc&q>sy!zC*hWGva<)IjI7KJ5Tq@zht{p-@rE~Q<;naS~K0(LT
z*^g34w&ZMc44a#~LCApQPIN<s-`L=&_JxDip~e#u#muh-iI{97+7w2G+A_PDpuPa3
zrbUm`As9i=LYXho*vcGe0mWztYC@A|22n~f)dgxle>iX{y5Df`XyytDznCM4?@bPe
zK3uWoC-XXySjr3--z-5zTkFkqH?*SpWzeSPC#adf_>afMNqJxUA9t&Bor6vNZa&+`
zAdAV46Hzf{CKdCgz-2eW=zMbkEq(?6&#vKcM~NfrxqXu}_0+2HacR?S!AmD<f-N;U
z-me=YqXIhpT$M32KACo(mYmqrnGGYTT}bX9Ib<s38MY)BP8xPIpAWF8@)(KH46uJ7
zviUT8@B}r9(M2=U{I?t$NS^&~-R@M;-NsytGksyI=U%S6KLGUwqucLAPVi}g_TrC1
zci+oheBaC4GpxQ7tXb6z;vP!(aQWRE%v3gO0vO=YiWb8qWSF`4ia}CHDSR66-f}5W
zTP#BZ$aN$2oXXg}ztG)xw&9DR@^+yn$a)wk=<v$bCm>O)Xp#hc^F}KoX(3H|*{!La
zycF$gbh^0gzuR6n5{WH)Rc!V_LS6R~c{S!C_yuaf>nydzrER<Ij5B(9B<W~?;DVJ(
z07n^4CYGJj?o1&f6et1V`$2A~rvaC2&s!(77tcodLsu*!;eHzrn8)%RvPJ~J8w9>4
zTtyj5d4{&s>Y$im(g$k8=;i_O7GvM@F>es=-KG``<j6X%1fI8UjJCR90~5Nbv&m4p
z2!LE~7V(dBXXn6>1KCK@)a8kb1DWnVmQz2pr0xsC=dG&Y3vf|)PkHle{J~tcc0q0b
zqD^;iIqDnIKL6bo;3y83^)Rlxx6#P`Bnb9S70BfWnfSd{d~r{K<YgCj?zz_zE4`!^
zA5<=uIqppUn4#`?IlaJi2c2l$?|yK1pL9Ck(&Y~whd)(V@1eX~3yb>x#P$7gtmXn-
z6By$6ddXjjc!D;S0Di;>3VaoQb{rZ$Ux=-)4V}6e`b6K>CH2XMqkWs9<8h?3W&aiS
zqMgpES1_XTO~A*gn~<W7{S`9#^JDprPto>$OA?nDxEsy8WbSYGpyyh3I$X2iP1GH<
zgD&X25#YUiE8#6)MjjbkZ3jtnlm*5tSOp{$7((O&+JGaGERPf%fl?mI2HB@Nv*8v(
z5m;DQe@LB4zs^^8HV(pkD_Rqe&ewhZ3aK6thf!2Cd&$<_qgz8{B92ncI|${o7UnA<
z$r)w=(TIW>xl(1G=*VlP*I^MmjlDumyv4lFaDSEoCk<>46?B{`8NlktkvcECxG6WO
z{ZTd`)VaHW<J0M>$y4#koW$e)BLwaOlsWSA_)!3W21PlP=~SPRbl`OAGqJX97*4bq
zQvX(Fj@UR>YMCqb5&UA97UJ!csz5Xr1!)0K#nGUhHoaa0E!(bta7Af&C#WN=8gED^
z1`NE+VdTTEYQPK7VoDrO90t5BOp945Q#l;4d3x2w0yShw&4XSR0#u1SU8J^T#@j{`
z@HFg}%iDQfO7-Fm=_#M6hQ+6{7{1pqX-`d*e@YP-3+(z`%nzyR@6vy}^|f2L!v)Yr
zm#{lp$~jufMp!mvipyC=V7Xn!CPM8P#=%CU%PKBUH}OLs==@iO{(pE7{0E-tzpJYK
zGurjt)mn6L#nOQ?SfdMpFeC<la0-m%4DCo9{>U=(i`%)h^H8v;gc)4xc|Z5coHt|7
z)`c?~NjJ?#SMOi+l;fHNg#BirANm9_qNz%O?6XBS)OCZZPz1A{bQkmcs)-UNc@a@E
zoD_>}50Kwu8_T=6R*R77JP#LiFh74^T*uxtqaLqnw4p|Y9r-g%+;rL**H{BIxUsRV
zyhnbo>(Lo0$0sHC4ho7%Q6wqHB}KHm?53r`dGO%J^bAgcN+_+4bk`wPkxKEHXxA-n
zQP~D2c;S`e+HFfZz18KW1zZ`I-KKwiv{@N<vAnR#&Xj$#ynO{aBI0#Zt&=)(oj4#=
zkN)m20;^oSc5Zs@vReQ5Ao{M@0ysvxzqG|qwv=aiu$4}IXDn)L0W-!Cn2M&m)HFtb
z5AHH2A=Bt$qoSush?7&!P{MI6jZp-o(S!+NxVZKYUJGF4ik$XYP;3Q41`3olYG8T@
zEMJ^~rTvUICR6Z@Gk3G?!=ptyoAWOyg3+GiSjG|GYL&dERr?TWh}48rm0UXA&WIt>
zUj?78`5vF9F<w;5^}sB1kzKTVlRdKVujkvpTQdHSD)fKX3k0nM2eETte2V~Y<5f=0
zO-*OvM9r|Y;c)Ty`t(}iHTQiKy9rrkcPy2<^q_8aNaW>4FRe>MTgEEK){(F@_+tVe
zCGC!E(XvV)-wpZddDjN8`y?`78ArewT0yGpelXs0Uo_q(TL7>VbwoBXo*zU<`b&85
z;ynVO5Y&~#3CVPC5}5NxSvCy@hU?%irN%*2N92JW|5V`rR@WCz<B&BpFIahhkMRDj
zxc~E<g1q(*q`&|Bb6Dya>wlC<|Bd$g5Bb2qxnPjL`rk{@|Mo!nM_7glCFYJl23d;|
z$l<}#wnd`z2mdW7|Ev3N_OJIX>;KsN-);TN*5iNTuOM$FgyZ}seFX#l%g^M0t#YgS
zP-6fc_<^GVb1dEN7B~i_D`llgq!R8aP3HLy4)*`GfB%1US^sn#{5Lx`Ec>G*tR4~Y
zoR`T){*LZ5d-*r}AA_Ng-j4sJOzmwdX6M)V#oXkkgIc!gr_5v%wyb_yXg#;?&R8-S
zLyW#=XbVoj|Kb2o(Ze~sh|&V4bmCe}a|TDh!(gh>B8JHT;zyQ@;%b<{*S@uf7mSQw
zVvXs+`hT_O`M1RB!Cb+g@YTs)ieeaN9NRcGc!DyT)OeP452@BAc!_c`n3v`VeT*#9
zYz@v5xz;lnj9$4FP0(vQtwVNzl+-q@L*xNZXuQiR9#t0_hEuaZjW?F{(S?x^CV)tz
zf5rr&4~LI>gTv`hg4O+Fh|6D86#3d_JbF&@z6!bNogrl=stSo<%d#=0%YMO4FJ}w7
zepCu?Fhoe&m({D77>;foyE2U0?-I=Sfj8cmJF0a0#rb%&Of%!)!vIRZBVNO10Fw3A
z)7JQQt%b3Ka4Tb}t7JltZ*cVcN@+9{1ro*)THOpfqQZVwLNar_(tfx-)-5>N6`j(c
z(5L)o=tL46$%QGlQ*HOg(q6N1s&Toh1?Kw@aaTfEp0lBcRXyHjJ9t3RcCC9qou<2O
zZ1SvXBWR~5TZz|w8;+YXdZ>~q%lhmvtYeS8i6vf25~Oc0=nSv)ljH=)JZBGzXt9el
z%V!~_-jUoCuv6=O2mOZu*3O2mg2i~^XC7~sFWeYKQQh{)=LW9|pnh`fw_j%H*v;>9
zltG0WTph1p@&Wj`ch!Tr(X!*~&P2@uoWnnDO2j7;%(QuVaDHv4)(REjQ8+eAyWbQN
zIyAGG>;rfurKBir)`UTSWPuBmVxtjZvfr_l(x(O^UvO1vKNBV!Haz>GnkV=yHoLwz
zr6@wns3kd&LQbCj+=-y6FC6XTW{ReiXfgai5&ac}*AM}2_ZtDar*923Nx`A!M3k&d
z0o4CQtamv^|713sok8Z+_!CJ|t?iGid#PUQy^8|k{3*KuLAH2ta33r5)+t?~lXT<3
zR?q6N?|vFvjv81334$NWZ~+q4(x^;|PT^qnl$Q}Hu94+-f(syebUgKgvG4nz3N@y8
zmyNtGoiOb5bDFN4*rg^nsY<de4m+{CafqJ%OH^p>GgBr<0PFB@mVxznby?Yb`G{2e
z*%-i|m&Mv0Ugk2Ao{mLp$zhhh-U@7MC%XPokI_tQl9-2fc2yR2Q6NhTh`xNVab&TZ
z2;F2WTBjDK%+-$U+bDU4+^8@9zyvjKqXVC5U*E_+8~)SG6_Dba#Hx1mPELjijsZy{
z8Z0})w0KimlNMRP6a6@R*@;=*vnmdKwq&wg1G@r6SaBWPFb`yCnAO=Iq37~9;43uc
zN&6_!+E8vG%q;BZ4aWMgttuwP-4<_oQXWWDVjC1E?GXxW+KS+2$Zn)6hpLD78T{J9
zsza8lDpoRMORUaH!hT{dXwraqvTOk=U}ONtY|Fmnjt%YwX?p8&kLZ+sRfN(I(^wZm
zo%!`d<@$}iLqQ^=9LZ`8JkxzgQC~5xWr(TAje7&mNpm3>s);#2Y_mX>DtYQ{uAU~^
zrkjGk?Y3u@4=;xuA{G>oBz7ntm+MV!Rf9u`>FG1DQq^3EoqSa@YS<WJHzzTS8>v+d
z|0rVye57pAnUkGYi<ytFub|Uz_hp#0EHN4D;0+HCr*v7t$6DYltcqZ2{q+B~%+b-&
zY1#ko#~M2crv1kSD@a`aw+$rZBlUj*mN*VBC7`piu|+jLQ2D<s;o=F|AXJVknQRLa
z4kHXMN4`mM8i+=(nJ+T)M%)HA&$;5)L3DC1rJ-pu_4WPEuR};|!@s$XJ`ZX;TA@r;
zJ?OSdit9x0Do<tx{S5V^V-Scjo{fRi&WBEEO6g!nX6rK44ru-6$24IWQD;_WIyZ-M
z%0)1XZhe*jk?Ty?jQbwVpmX=*yCvbc{X*b2uY|}UNfWioIgtmn(0B$3+-3+1ehNmA
z`Ds=1>It!aD6FKw{`LG)`})%||C<beZQbPq{Ud6JLgMYMsr_AD@Kve)iMT8OwkKy}
zT<a1N#A2J}kb|dZRtUq2fophnVFg-EhT&(;NmNZ9?ELo{{1)l$J~Oy0<biZMCeUY|
z*t>9(4jZUyYbgV*i}$=b-lk&-(haMtAqPbc$^O;pmB4YZ_BVFeBHH#XQTR12;@gkQ
z+j<#XpE7JGn}obbJM7o$XgX~-p9L;aDZ@`W+OsgNA0;zlb1MM+AASjTrsS$4B#<75
zRQ`gGz}MSibD`fOW)2QdRMZ$#b#bI-?DFbaj`IMMpHMY>_Ik!srz)>T*0<w!3K>|-
z8bSS{`<1fvNy5mBfn5vQBwh|q9YL?f?CXMoX#5)1ebsMCfjs<Qdhz2H%$eX?oWV<G
z*L8KQ<Cs3GBX9FL1uhPC@x%^;x>|UHh*cVRe)>rY%OQ70#WIW*R3TgFWrCk-t}k#D
z#6-2v;vaP6t4%VHs&24bQrhrMCbxJE>Gv#SH0h{63AerDPInoxPcEuZh|dw|V;i&}
zubz)B08s8yl`LXgMmZ7TP&TU}sl9M9UN%HbZM#|T2vge15;_^{^tgXK>42we{f?l<
zoUW1|sRMi2f=|$ju15iHe!{2C>VdGzV;CvR7%54!|1l?;@1J2wd_G~dVSI_@mYIXe
z$jEAOiRW*#9p|890VWGjpl;;-#fz0Ftl-jGFTtU!tRKd~(9h~&DL6B>Om<Q^(4{kL
zjM+(w4f@5DCI?(nk6lY?V!hf3VgG?O0WpVamki&FWgK^FB;U`9rSVlpz~_fV;X)R^
zDPle_RY1e~Dza6D>hbR%5Y;i`f#m4uU~PR|-`1+Fd#qk^em$J!#-j0So!|@$pOqSB
z{rrPj#|e?SW@BN|XEXyZg@4g$jzSZ`7$gRqI9oue|NJC>y=u8aH`w2NcrhO+d+DKU
z%VtNjK8gqZ3UmD^<gtivl0*me0|H>McB8fgm!aUT%H7}pc~~)ieEI15;RN1^g~eM<
zFaQk=Bl13=HJ2>q8;L}4r@*`gm-C7<Ia5Es2;sP*q8OpikCrBcogt<EJ%2u*xwt+9
zV5U7cqRxbTH6QNU=S3`D<S!R8z#plU0firECiNr5BP=~Of^9U4Kwt{(0AZL}{R0=D
zzS*?RU1Xy-$zvfe!eylb`?iQ#zb_QygXkJ3mVG>d9In~?)7r@q24hyegS{xTxk7AS
zJ3gFvcyn_yuNn;tTgxepaHyBzomI$!ru*c4Gl-TO3B%Wg!`mm&q;FKmB1Z4232OT%
zKBoEK0qT;jRY*0CODQL<uM7CB2ulO3!XjWK7p(J{%D;J~Ent9-<A=Yp4E0S8rge~#
zoS%~=2RtQTZ3J~;sk?T({Q7j609N<>QJC6LaDRx-2!|M6(TQBzCS|hz?7SFX*BeUt
z3{cRoMdYB3+SE+YzXAj55r6(nbI!Mpd9d*SaV{s<3F2vVW{@|_DL<-;X{JToXMyg<
z=8uxE-Noq61_nQW&lEJnM%Wb!{)wd5S+?~AKkw{u7u?=15Ea#o3MKJ{@)rP_J%T7T
z5eD>qJ)~8wE7Qa*!e(7<(OZyo;sm+H$CY7E^1dhVC-(8P97?l|(6(R|E6@dpo0vCd
zywYxjuMTgI#&J=DjD|E>-QGPv*5*omnj%%4B3-=DvA<*vMBBV#x@vzc`Eo<-{Q7K{
zx!m42yN2xONFdnJU*|1BU<<O9bvlVEioyJ1R1T8%wjog}Hm!j2duB4haQm2W%_dv5
zc{qF?U5ye=g`xRfabWR`hMcYnCbixz)57Wf*>0KIEcw=QjK#?({#GRJ9V^oSY3Sv+
zyZ+bq7&sA4xF6B;TecE@R)nrik7ncHqPdkAg(pJ=;KQ%(1%h^%L?TZFmbc93&TbJE
z6);{ktc<!|FxYt*4d1LNmdxl&$I18>O8aFeI^rw)<Jbb~8Rjj&78Dt|CuD_S+Y}qs
zPc_ZcU=ih@j?t|z=C8o15k93z|GOFY@9Tf|8-E0P(Ee|@gdJLqq6#|1!dtV8yeHRH
z5R8yV;r2B`OWTB$ZEL(;UjmqbqU{}9J<dZ9y)mMr4eYl@&}m3T2}inx?efTPW%6;5
zg0{5%umk>Q>$Q;$0n|z1(UwI3ehqc&GD}<Ws-631V~rNX+&xlp;=3u)h?U_q6Aq@2
zuvaUsH1)BwaE)%F>hg3vhZW6RoKPbZf%oee*Pj&X$Y&5k5Y?y09X7&d%oJGNbXjlr
zJZ7M+JL)mr7V<=)J?uF7oye9v8HMw%-xmE4?_27h9D`O$-|m#i9cE}8jAvB|t=G97
z(i#d4R_th&(k&F4GPCd*M=A7hvgIrxA24hjQ}K~pWcROAtsGEEQ^cbyYeVu=Jo#nw
ztA3}gtdu9KW&5v*v`vQ0r0FIzGE&-m+3^aE2uP~v7UV6FBzj-JZuC?m`<*vTtQHnx
z4}XE}r>6fPSJ*47A0(9=5sWf8?7F#yk(5@#E@nMycpQ;Yh1;}tR)AdK-$sbyrk@=2
z>plM{1L%oG;(YH(75MEE;W)vqhn5jo!dBp9j3zybSQ&RMqrYY0j_~wnb9c+WB`x6l
zr<7D~=?Z{?6DOd#=wnnY_s(<}%%xnx!Qj!34_t#=)QYQC_@0qC&yDS&FVWQHfRp8u
z@o+i1!I*GXLeGsBP|TpD3%-m4YAf3xW5QPG@requOvlGIAl^YUAP_==5h@;pMc>?v
zO2B0p!GA9;#f3us&`ak_E8qS(8B(_I?eNd_pNHC_TL|PMIg9T@@(ZdQ*Nt;y(JiEP
zS}0J9d|C;+FzSASyTXauac|W}`*!)bGUAdGN7od>`(;_8T8)L@=r~N|VU@^x@ne4h
zdj0P)S<mbkBfskYBTwjtSV+<y_kGgl4X9JA$f*`r>F$nvU=lwILW3=){K?6+h*?Wi
z=tq(i%^X3HeJdcVdmLMdh+Qf}=H~&P`#B)vUgbPEzI&uvO>>4GP%{!l>3&H-q<0W1
zMJ}L5mm*P;4tPH1_hv*L+&lU_oqSYk-IkOqs&!vNEN+njCGSH^a;g&Ce<_(8u$H(U
zNX$321J`U6TW)|lEp_^VUnU8xPCq@X6M^Yt;*4q-C6gcoo?}pRbEAdAO}i4*2_>mY
zeeN6?20*_qN(*!7=Hb*w!fKNq1aG`%2zUyWL-M_-jQZ{u=jVzo&cGXHXW*a|F0O&T
zy9;pe>fq}2Z_#OtkWcGpf%;8B#jl*z%)>}h;$r;c1;m?(hR7{8BXO9~gnD&xC+YSP
zrMmfN?JT<N!>ed_YM$<9!h-n`pb|uB#OV~+1pDMWI?;*I)}=<6iZn9}f1u=;@zJ$@
zBFE0=v5<CnS;@({L>>%lji~Fq-q55{7Fry)dY`(J`qN`C#Wrk@z`)$D6Q*8yHo-Bf
z7*?0kf$d#h8*E-5vNLR(-=9#ydV+f2WC*)?nBnA5RL_oKdAYq{`VbnOn^!bZL*mii
zNy1J~fa<p)-VZ7c+$>y@xZ~NhoM+{Rh6aEEg-lHfP9;y(8PDNJ8*>9^b3vybO4S$S
zACd?jH6fJ?V$^8>z0y#}a<tA6N2}m3bW(Z>9NF1=K)Fc??dk<Yj|S<nw&plcPTbN_
z1NgvR#!Z7VJA0&SlxzNQ<QCL+<DQky)9fWts4l*&B+NpeK=#{r4&m~<EP2M*^!iM6
zWaJn3u{rZR8yxA!#T@ndgh|J&^A<xECP@~1iE5sJugVH`u0JB&9BE%ZMcKLEh|5eG
z%+JL>w(<YrX-d9Q7gJbBIjgqaGJ@t`$yPc#A{@OrB!>_OC4^~-LE4A5c4}G+!QAz^
z^SA21M?4(LB^(?&otcFYE`=LY@5*K50#U#A6}jg%IQ#k`5*)l1C$yyI2Z!HSO;Z&W
zbyyR#U}M!Qb8`Iww6(!_FcBxyX`1J?N@t`t9QlX(ce7#%*@R>_EZjD2`+uRr@LH9m
zeK?*S*4G<#`NNauFnYF_1Ber?w$QTUAUHY@{yCvp_%kvWv2z~O5`{RKc6<5Vv4LwI
z@bf3a99IIED&J{&UzN=_EB>19fb8XS5dZ)+2kPcCP@jqPPY3(L`vm0><j8HT^+)WL
zKuF3~h_)3BYKDd(KOb@2<wjm3?I50OCa^k2pF`@|>${p_o=+PK>k8qShz-E$$#)%{
zSsk!9*5uu!63_<%x;Z2DFby-@mUR{}CFAvxB_jlg3RxD&%x%(rQn;w7Q{jlX24_(J
z8V-NQg<!t$8Dw_y)of~cg7>M-4g?&WB73~uU;GtFSp7Ns$SFYCWTN^L47R~e*llIs
z)rW^@L{uqn$&VC}c}&8<@6|Z#6UyP9Wa)XlY$cZt?a4~(ghHUMld0rJFp<jLJ|#Ef
zN0Y5BxMng=PAIx1tLbS4nSf5d8HHr+$}F5JR^Km!b$CJ*+uGA-KhL1-Jf+wotv+j}
zI8aY`d)C3RnH0jIAc*<z(daYSgoIWWL7G~0c0wAyc`a<M*Y&q7EQaD*DQ|68nYuH`
zNIUCXMuG{#Oh&m-%0~!TBvS4E*&pQeX^eh#OPzjo^8{!G>zH1t1=$wx_SROGbD<Gj
z3z&fApWyIcQR2e?v4aO-7YYIY4;U*jaTm!5L;lH92cpEQgd`A6Yo%}r|DMtG@p_oQ
z+k(8M9a~ukNrkdSN-gjj%QK;CvyTxl7E=HF*ANS0E^ToIr2p$)tiu8uk?BT)b`v(!
zx<=-!20Uw50vwZHsw%D`er>ob{>nkl2q0e!=d|}LT04_*caVf~r5D_E86dR#a{+2G
zt-E~2V3gO5#G(!mqG%UZ0e+6Q264BU#_ThC3&Dw!v^tcfRs=t{mja<t3f;Ee=#v?f
z2FlP4eBh*hCrD-PIE0N<8-q+4f!N~9_mrGY+<Q*$k~DaLI7YpqyHKZFq;VE!(ckZM
zqNa@8El_+Zx3)}M@|$HszcW(S3}YA^oQwKjP%sMAW6ANWnD-!)M_HNtrX}4;gVxx3
z?m_<%Msx9vAFM2##|*bB{9$$$hhlP5InZq_Mb!kcJy<SN@P*PpwF~Vc;J?DOa70}7
z6wUvB4*xHw^<NkE@AU~!$7B3^eWo!Wtf_&&*X2L1hY8)UN)x*JAxMIDU=v_R^{?l|
zG|R_sCtzcOd?~#V@1yb{X9o0nCqZQ2I`#+yqG(@{YO&Cz*vNa*;$|w7I5v{3yH51L
z0pdd1jud_TxQRXCCS)qg8g@K}?^0xCY)Exhf@q$9V1FRPFS5HEUK2f~*6uatPs=RA
zlTvjfNnHw|^75<nn%4}%37sX)#cCdtIq-~9q<Bwan#c%30CGfjH*|enA4f})27l)S
zYO4`J9vr7|t>CbGyDn`t?3iP%E;u1j<axz=?JD^`7>kb>D(&Q;7TQ!>KpnhhXqFUi
zYOOLsZ1|WXoG>Uh*{w_VC?5SIE_Ka1Z1wki<JcTz|D<~|J<_OEn4ke+xB-FyLGB)^
zR&Y08!fQ1DZoFvySxY?{)-<|NG_|DJ=T;U|Ls*K6QPh-Sxg5;u=n8nL_olV!m85#^
zgJjL?_)TM_{Vynx1Xltx-o>3h`pw7(H6Ed43V11Dij)<?_yL(y*>cK-{Z>S%Bu0r%
zAJj@sjY5lbJviEzNV3Lp?DtXW<o8VseJB&d?qxpFU?hSlFoHA+RLXN7eql{#?Qh1G
zc{02T&GqOG@VkwjTR5LhxaQ&?nK=$gU*FdgLnQ-Gq27Ltp{<-);TYin6twr^iVt_s
zg_=GJ(`Ha~g#4zRfwAnBdNr6kOSsP%+jKK#>!@aw5nMW>zbE^#h=OP!GQ^p`<lG72
z(D^#mGd&>L8KC>Fp?rt6-||apIJ==3`vJO?G>srm=T+*Xs#$UtIS8f-BMgnTG}gsy
zC6PxJ3s)QcCjDvvG=+`AhWJY!3}@yxyt{z$Dn@C`f?j0jg;g0U#;ebbW9ER|a2=#R
z`BE8b>(Rq^-wO=6ZEySE4v+|@)gF+%^5?|LEm$DfvcLB(3^3{Ya#>4Y4U{YYQK1i?
zf_1`BL25x)+czRYhcO(;t!|$F$=v8?Ixer*A-AoC?rgoV(4Uipa=U|2T@}M_D}aL4
zG@xP+`c%+6hPxG~&9G^c;O~uJi=|`sPbm94R0^qwY6sNI3sSf?N8{Kz8@&o1N0kI^
zQpKx?qQHPLYKKo<K_sxK$HVJu?R7b|b_<TjBL46-M=L;y+qr%;eF)($9k1c^i`ANf
zKEE3xcGVi?O^f6|!wwSj{zgiL6fT^<LmAhAatja_6=l^I5lDXDnFOYIVkD52e12@r
z%sGsKGB<_AKucpo)_~+|biPNf6)R1a3})`NV=?%BNnOxcjKh}I6(PN1UrVXbiy<yf
zDt2%?U!mrXu2iH7FgLX_;`Emg?hWk|wHJr+w3gUB=0tSlF{?|vuJdEXZ{0N+IZYJT
z{H-{yeIk=ci`jmy1}C2v7vb}LgrnFDcc!kD>m73lM{V(^cSp&QRR}?hd3^9!hyisW
zl^bk$@NdC3nIMxSO*xDM5$x8xbd$Z~AI{xGkqOt2^b(u+?8tFEPo_+%b@+ABdOROE
z)K`;}u*9kzWbpj`%ld95(GGZGh*XeFUH6T@{6xIGE?r<iVd+8I7?eF^O91PZokzrt
zaWV=K1dE&G@S11v_gTJjwg@Bj<496i&I&4K3&8eLn-p(+w4aCR<#FWS+ifw$=1cT&
z8f8WYHu}Q|I{K0O-wBSR=!JvlSwY;qCWZa(-oglE`{)rwF|<Sm!hOf)u1xMJ+A8T5
zT71Tnxi;sY;3)#6$eKO)_Esi>_uYcT603-j#Q#+DWt#HfqUY^Ex)7p*!+&IEZ;7rO
zv?YiDJjWp-o`~p_S)c{EHj_(;S&#X+frN}Zbj|<{REorMQv4|ax<SQA{Wold+8!$c
zeaDs*6?liExWzc`%w6se>x19Tvq-;uVH!Gy)~J2{-d;OFpY;J};t7x2O24*kgLoZZ
zgN-K$-bd@;6D#V+%KX>^F+{Ygn<3kKvLY)!BFa+Z-nw1TtR!?6gTH#2scsXo`eVRI
z*|`Jo8;qCaT6Prl=oPw+v$XN6reaJZy7b@qz7+1%Q@$6D!Ebdei^|@ZnW^SI?1Xv{
zUZ}pf%cf7W&*&NX2l~}zEa+iyr#0Z$b4(;tqc##^HIMB$Dqvd_X|LTuvZQ*0u?<2(
zS}sIFnd*?O%0bYY$>`@kg$kFW9d)Iz9VvARzvZH84i|p`;YlL^a}ah=Z&71dW+G3$
zf{()*iiWA5CEiNjrt{-r@W71kFEKzczR7PxLKv3h$3<hvFoi9h&d1mKHr+*o8NHu!
z1%#sBZ|Poh*tv8<Klo8$P2f)E-TuH$ze%%zsSlKNOu0Jd5#Oi?a}f=z$K*SYn;ib-
zDI_H4iX3130!}e3bpW#+y8F&@6$~@T))~5)1ZZ@!7J{E4xptuSDBCnX{-{sdP3JNX
zG#-<<N)nLj73`aKu3pgyrhZ~Kz^vCdGgN+@yG4l+aTRuNjaXFwVNE#8#YT+Er#z#~
z$JiiC$mL+xM$*Ucrshjug9U0apIb;tt0NdD;S^O$)B)ZStYA>2xHTr`{=#sbfo1xt
zGMG^UPMr;0R;Z)=O)|D~SE#HYqHrC+CA#uTbOg}fN(n^rV8_N1vTUW+f`h&~;3|Z^
z-8FA5nNGbKiQo<eYb3v9$IU2|ur~-UzHg3D<JFo&j<A=sm9x0^jttKyVxI|Y7)f={
zc_hXOFz+t1$PB+;o0X7BkQ?pRJO!rMm<!<=U{d`1N&kkXi*0c2Q6`e^GdaNcbdcHT
zO}|&nOI{^_FO}{f!lZeMw}Y0(1M7ydmOPuG{Ky?sZBsp#!d0ujxKPR+#OtFttQh5U
z&Uca!zW*BiskZl;4Ay)^LzOc#x|qq0b;$}|-Qq_d_X<pEa*HFkC3HIltj(fwk`87<
zafPGvZGNK7RhelZYb!d$(^30bQE}?JmxjKagcpJg*MalJuxo<}2lRRmIAuqTcHL^z
zDfM!HewRL(6)*K99*%CdVuE4d#{FovW6ZupgYT1+$GYJ{(#K$0m({Uej1m@f?7oQO
zT?9dl!jA;j6J1%UgeZYbKN{Xj>er$ALzS6ILmcp`nvz#`M&{gDIY!|t{4htj*<?v@
zAg6@!3kl7>g8(X<`s@hv<Ndbp$NmK`c1x<3P+?2Fb{A$EJ{EBRl|0^VqX{b!Fb5LL
z8idrj*mkfCm}}i$;Yj($hf+sWSQ+}^b=-XtC~=afhOL2(t3DVw4h0wq!s~d6xg=h^
zyehpj9KyvlXyN;l10V~;<Z=$7rc9Y-^UnHy`}_wuC(^0tY90vU{+lkbvi9LE8_tQR
zSQ}Y==*X=woURBVx6Z9BcM{n5s!r;6H0U?Ub@*Gh%{{L<`8HOdwh}~a_BwLx8s0ff
zwRo(pEKJ@N{V6+E4#Xe+J7CoJ@g7h^))Ri)2^zEdO`DnK5G7eJSTsz6SoVTK%95!l
z+^xadzdmqHt-(rb{~i#(Zmx&xO&t(wgWn{}KAmD%B$YwS9-rupk`u3UghSc3hVPO$
zwwdw_PZKpRp<RUe1+Nvn4T#$hm}-$+Fc#swWaey6&8go`gVV45$e_{zS;fb(YUIj`
z_&N@#5W+K?NA&Ud@W{8%P5-uaHvNVwoQ)A(R6|`#^N5mbfQhgW{_-iq+E|loQ!-s-
zb!Jk+*7m)%f-3mrV}2#XspBW`(izo%RigHaoKM6|C>CI_ndb#DpdkK3%%Y05g;4g5
zcG~2%rGjCSoSPNzVPC%Bcn)wg$QC}8|9(F_%n~>kb%<%BecXhwU|Ry_89Bf1k!M8J
zP10i5piMU&!=P`00kI?>DZhH21OzKPuuy%|O4$>C%>mb<&x!Nc3a&L1n55WU)aty?
z>%u*mN+O@(L0cioT(1c975c*8%Y2BZizJQI7k#*srA_iV*bf5fPrzBLQ6Zn<fYNiC
zPosogK68rP*;dW9D-d8SFjv8{RLuVP_EOS^lo58~g?@$|R@EHmLcM}cI&nF0>vsdP
z?EYY}|HTB@VVzr{1;-&qAdpWX(DMO3r@BzdVL&t=W_KTPa|bI4lO>ycK~~L`f>3$V
zrez&~{xP@i6w3dk)Wla7T|P$u_{AvhONp|+XG*t(?|~c0&zIs!pU;=m)?Le}|1jAb
zWGQJn#3*AQKu>-aMiTj+$?!C>r}6;UGG8kFR)B-OKi_vyBzLYT5WdX~&(Gjw>`_i?
z%DomoFfDVt5)sFcvALjeQg;Y8bN|$Kap+8gGm#lfE!TejQzx{#UP0FNO8l^QIQd4M
zPf8e<MTKm61+gMYNKCI8D`6^;>^BheLF=gSj6>YO?>(>@2x`laC`~TBc)%}~EG`81
zaEJR1m<;F1kAT!U1^Ge-qLGdlo6%nzUT!eNdfa)0h9aGfB&)i^zqG=1>SAZ-6H66G
zv0P4dNJ5mcEQ#jEw@$RZ!p^kxfB3<36TBJ3@1n|YT8x%Z<n-_pt)luFy5MT`cKhz^
ze6BdKhF~acrZBI;oZ{rZ-*iJtX=Tt(u;T+%R)7jtFZNC{GPu~HjKI&4c_6=R2i5nE
z9o6C%I{3fk<6PcAo>a8EJGP%`H4&B#V}BnJZaEx<A@3U&w6^23DAz=ciQ`tbs>0Zy
zE_taSI@+s*hdE&+uGNU!xp7rvRR!-{vL1ID!M3WKkhc{l|EB&V(uxpwQdIk-Ovk@`
zbg?;2&+Av+bFhyLYP&6{0wK(ZcaHe1OG_vSEaxaVQ%#_bQQj3)>Y+r`Bi=QI8$S-u
zq9uD_3?f%qGj>IDdf`esbj6k`(@(U3ee?VOD>E{d2{;OZqEC6;L2vgY*{eDiecw8`
z@em1?$21(aoEU1bwgM5%)I~Kct&+Us$sfIM+-EnZA3`%A*K{v2ixS3(u?k4mw<5S`
zgtZyz>cF}Rv+SSW#Z;s<y5>o?5Qt}k)8oRunl-3v<561ND3vDV^`7Xd{~)HVvJ6Mr
z_NoV9fX+egJ$KGS%Ap7nt346Lm>2XISY0AD(QV4mahJ-Gb}yMlH;4%Z``Srn43Ux;
z&Km21!a91XE`^6Ek5WGDB@@EbWNew|$PU=wGfFOu6vaKj$@KO5WS%s`rA!f<9C4c2
z19v&06-IB$C|fRztF^bei4(Ot#EyKcPEbX`kvf?T*6RX)z`kyhS}0IxL9W7k5#utS
z9{fRR!u88UCTHC6Zm!ZvV1#-|<9<~j9nORDU_HkqNCQLmb|(&;cEvhthVx7hLD$a^
zWb_P~ARO1sxFHSL5-%maK!~)BSU;qByvvjZS653w24zWnz7*yQ?&ENINwWBm31^)9
zk}EH?N?#?^@=#8LOT^UgADQ1FQ%s-?G1K4gw4Jg7vpb18<^jg*oQiVV!2`l7moe@V
z2)G8JoBzb!i5N`UbqC3eLvp}LuIjm}qv82d@zyf|qd_VeTuR|J#N1fln&MXI2*YsU
zyKYF56(5<;3klI`H>%&=Y5#X(yG?#Of)1~YG@JnMHaa3V9ILI?zEAcX7|4!Qp8bN|
zoz@&I=rdRE>f&%IUm+Bs5{hx+uGS24jv5$u?|{tbo22D1Y5H>cJJYS>*7LE&(3huM
zgkk5+%`a4pFCWu(CNrhKuz}{`8bYA7AR&_G9BuhP;R>yCGN)A=^b7i1Cyk3N=~_pt
z2&s)vPVLzyx&2toAcmd{6_!v)Iyc_e9oJIC^npBVNzxNv(Yf%PVQva)2O$(9zG&iz
zQRm!NygGq1F=eF;vCuI>)2)0DV)>;H15)+_-=4}+w$nqRW*k>_a}u%n_JMOXy%V1&
zYh6~OT{{o%+s>TAJC)*f+*6?I7e)|orQLx-pGL?lY^QpHE|GW#agC?e*A`pdXgyC>
zW2sOH$K94<3F;?|U!d<<bix<SsHgGc`^rn3LGy&*!UfKq-%aiVm4-=;_zbnaFM;|&
zx(Sa0gsfiGm`w>71~s>mChL{F`aE%eGw~u#?^ISeSr0v??`{AOz0BTBr~}{2h{2@E
zo8sA&IFHAojp_1?lz&R1w(5HbS4f)yT2?*5^#lSt9a}j82vzhSI3c!o*Wbe)CPD3!
zlLm`*0RpkHO_U<*#2ot%JLV-YAB1*!bJJogJ?v6Q8lm`BP`56Nbg$jhH&s0mbPS^#
ztm`|#tkr_m5$dxE3tA|qN`3M(`-aDhsbM3#AOWL4++RJ*3l6<QphWz_9Xn97>TqpK
z5NxGjnfD)zZF-ph5O{nNX~KvrTc&WGfU&0?Zg6-)IbP0%UdWo=YCI)?sAD+=SL2M!
zM2`d3;q#<z2zI5c4DAC$pUHT_(>zZIn7&dZF(<}@U0IXB1ft!*cS5bN%ZXZx^64sW
z6Fmt8_?pQ3=$tDsY{Lqp7ukp2H=lgZ4~-cur;_>`zu?<eI|g5g8y$COe8^H)ULGk-
zncw#Q@(w4ea`+bwA3w<%XB;#9R|IORDbyZ|Eqlf|{e%g<CgZC;ro}G}Br%h}M()l$
zJ~@6XkeN@c7l=y9lJC;Mb?lvF@`=9GPn5cKX;Gykzaubc>E^<6vy|TU_aLNNGbglQ
zaKwo;?s5|T&gq_PL7Bv(`<v13--%F2N);ZGSr!z;WIl@k1E$-w9wp6jVaYH4AI9D?
zsO@$C`fhP4?(XhR(c-i?#ofJFacyx35L}A86nCdM6et9D4G@aE!=3K4_c`Z(%QH`A
zc)?^QL@usezqLMVeI*1@cv)(im`L|`xE45Vgo-}}GwIBee@$xtD&Ij69bN2Ikvc&6
zT@2v>t@z4*nL5shDCSD`<0`w}yMRxh;ke7qLgf(4G?wRbLRNla(ymfHt)NTlX_E5C
zdxTyU8cKDjUI31PvCm5tQBs5Eu8PgD@#^F;Xio)pZbaL)zcrESgly0_&xs?4%TQ!w
z6*9{(MYT+VxlxELO^0V`gXVUYW(a_Md{n~@u>%PAK5?ukKp77u$}Oim%3~MGI@;Rd
z1Ej&9R?LOi^6k<NhX4tyNb#+cd-Fyi{5wM``N}sk<Zr`3d~N5n;0|&xny|~{DcrBU
zo5Y4(I@8!8g>@!iLK~$j!U~e;!EbZ#Xy*}VnmLv<N)FKS-=U5J>AM98%Zj>&<HAuT
zzngHveAn|Eaq*=-ZpGl%FtzZ8b46>oP9aFpFRh8fl(pX>9&U0=4`Jt--Tx`a*otoy
z(RLIxY@ID{dn04k$ieMSHJq0}I`&N<x1dfDI?|ivKm==f0|0$?buj_*e#g-@%gPZ|
zr~Oe@7__|il=hsear)`po+09{68S*}DiR(s5mkA_h8nU(O|6uN$F3o3o{|m($!cy-
z@-bBvuPG`@Kg$k}TOtL3L*V$x(q*b(i{{C=ILI(Be;~h?WMii&v|Yt|iehcI1#YA&
z%k$1duu-Nke5l7a!fe{cJ9p$K+rCL_Lqw!YW$oP1#@kx39l@C?G!=u$BTu`!1g#Kk
zxIgy9iMgJ>K9~Q!+n*#uZ-K~mlv?ak0yi&<*z&~Ct5zm-H|74bI;?@hO2J@NAkv|L
zcpIaCD~1HROUo2h2QIgb!@%NItDqJ$BfZ-SW5{Zdw1E>v`2pR~(^G52vL6;*>Upi#
z9kGaZhBk;dE4U<vz@saF+1@#D`9lZ;#k=XreYA2HCtsMA{G0svdxjm@iW>L6;yvbR
zA1XbO#b$hxs@b4>3aGLMe`ma$?7-^062i=!Gd2M?N3PNj15_%dA9afnz}!2GT~TnC
z`feI0)>mGHij@$E(;Hk6>}v4S8DBcpdA9AC+AbY+>eoC<L34<_u}Nb!+X@Q1RCx(1
zLS9AZ*V)>tQ)d+EUp<JbkVdZn3;073Nz9CFfH0c|HnTIE{TmRSf6R&rhcv+|fplus
z!&_I_;pYiH<Rc|e!R@7N#o~)b+!ufM6XrG~u#*~v|4h6X`ulrA$Vt!YRZrSEAZJti
zV`>2;^bM>mY;<rZ;~K$J7=&585ka}jwq^ERY<k1~!N-F0Ed)5<>i%(AwELJ<!JOka
z?ZewPc;w-vQf^FWoQxUHuI@-3Qxj5z_JZ;pvf@HHInqYg5=kF?^QP@aYNv;Y_Y1xS
z6HfAPczwfg2o}hz&<8$?(LlCKp1ui@8tw<LKTiWWX`V<e?gKWRPQG-(m+*9+MJk|Y
zHw}YWs)uSTFmH>qq)3uKfZOZz7NZN!u62l8P&I{UEL1#tZEabVHLr35b1`J^Gt0{n
z<WT1}H!43|mhwR=T7qUw#49?DFe<eyu??B=XlDiDe(y)&`I1X5ea9jX#U(Jb>@5JG
zgM`)S`NX#vwci!k3?1c5FSM6zTE)B}_Qtyo;RyBZQIemzjF-8GSO|EZJaP`X(|iEi
z4YROQ%_aKny?rKK{Xn-bhwN_6)HLMV$MeKlPRHCJ4pqfa?juYO3@uncOa2^Dw+S6m
zb>}25^m5C^{C>SIsV~P<<%kp<BZr>tZVUQO{gAA1>Saw>yoj(hJgRKN%L<weI=Jge
zJJJ49V&K*Z%`^R_q3(2I8R7)xrQ^$8+)cCzN_PCXZ|01wQh_%9;Th*4O=JfzqC=(V
zyN2epS_>h3>$g<FE9C@JSbD+nz0m*~>5iTfXkIA6oZgcXsWyDiEKF21yE(n}7Ke3M
zKT4V}*|4XNhb>k%%{_i(lCcV;6T$u!`q*1YDfMjVXV(<~Ti9%xH$K$<lVqkPBYZlX
zMAL`Gy*rzwx&(-&3qClea|1sIbg)H;K7L{_x9VcUZh>$^&)E|%iV&rxPT!j}YQWrw
z{LsSg%OVbB0h{id%lBvJV7(R&&o2ckxcrApk;yEmE=_K?J<^v~2^ssHi%1^2QAO8|
z@@zst=KYL<W&}KU!REKG(XSOYAtW(|0``;ku6%^5vs-2$JFn$M(^_BLIdTSpYuSqr
zpOY$8YDMQLVim|X+Rb>-@$e|k$C(<?mudKZR-Z_fpKvcMvdQTTYOPcz165qHAnql-
zgN!UgpbkRT+Qwk(UOm#)MA&X<!g@ZvKeF!ZHGe;xN%|_bU|Y#{e<O)t3l$>K^08El
zKN;zlrX6yvyM;a~KfEgb%ihT|Qeo{|)5WPG=d;MZV|xJ?5eC?|?T!-V3=jBrzP749
z<*&%UwzjM*R<6IAIl_qF-Ujk9{CtPE`K}xLhF_+a!HmN0^3n^D%D)MNN^G$ORKYuY
zPRyHow29U4v((4#MZm0yaCwka+SZD3)>8#uTIhLeOH<Wl7o0uU`kUlS?LNI0+#St>
z*=&nUs!@sL)Ar|KpnG3Jk%CEc$fKvz1^mpgCWN&$C{x~=)c_m~nMHKj(V+5sI(O-o
zis^dIR?a~{WogNdeqw|em};rBiybt+XPmE~aIJ8lvrpSnO9k^<H+53tz;gf1q(-((
zp^6B4=iwKv61kjma=H0_8kbSL1{T{&Ha3Z`DN`)NK=l5)0S{+q<sZkR6QLkgJv|zQ
z>CgmWx%l1vHxG0kHJ`8geu@f!W)_1Imc!$JAKU01<9`{0^_*N$ja85t(Xr}=Q^@R$
zYj|R<A{&#inN#j?NQplgBz9$+fq40&+vbt$I6#@jnDAQvB7wuc>pZQ>&~J0izpHv;
zq~M|BCRm$3%k=+T_0pK98fJx0Rs*+?Q|JKjMugR<LGLOx-c>?+gJJhi(U+qV$VGiJ
z98HUI1QKGqaP5pcsoLc!&SUK|htYmK%6QZ?HxuZz^^>!cyDWI0QQ0l~hWP08BC+cV
zl%J5vSw%yKY~%Owup=@YYfDfcaLsPyyEnCwoPs5>s0~R+eA_c0e|;J{O7M}l9cL|j
zQ#pZ7^OFHb+nz2Cm9MSP!kZ=Acqu$t3>~b;8mcXg5WDtWTCTaQN!!zxtm;G;zT2{?
z#_%v?p?6jAvlRw6OrmpJVWPozc9FMnD4wZr45~jtzXudSQSHkgH_~-NQe&W7$H_nT
z3!uugN8MEoTE<D>uNV(c289LQyZW!?kM`>T*}o0r-@@V;h9vhzM}wh$QCkR>VMtQ*
zMm_+*o;^X+0O3p4Gc`56?ZF86auRUU?(FF~)M!5+^3qgyE(YC+;w9nnV~mW#?R}d}
zrlAvb+h!BS7h293$!Fz5v9zUlSoF+oJO<7<HJk%F(xN7S6nT()K`uPKW|&VU@f$m{
z{yOaeG|&!0iym1Aon~Y?r_^`FRG-HAI>MrU0aHQs%&`LyUA&>7XR%IHDIVt7aL~Y>
zQfaQ5$L8XGBho2g;CF}nLW?Pz)}9rW=qCoFhLMr`JhRKKG^>vqlG7{$fIj^=T`!nq
z@XhnUhyiVJj%+~!Y02c^&k6wboAFXX@-UQ1V0d2d#kOVX<f9j1g3fl&|6h3E$qB8q
zjG2|SUnSri=kaO%MRa#8J=p)@8d*Sm8;!s)M@d%JA)P=6;H@$5^>1tXZ?~EWT6|~X
z12^>nVgF53fvjike{%!>GPuv0AjFbv(VRSQIvMVbN;TaEC7KrMEaXj)88yHn8ojPX
zVVUhyW}?t;*?&3Tf3So9fC|z0y5|45-!(}FxJ!tCozg{cC@)cad_NY9*1#OhHdx`A
zKfSzKM$pd9Wx^(+!_t|Kk6@FGsRlh}OA}O1&r$#kEZ@vsW!SmyDD=i@QN%uW#S<Im
zv_q(y_wVjiEqLM0lEda8_c=I*4a)P(p&ZyO{&9;8)NPm{tW#Dp01ob$OFn38te6xC
z-q?b$BQF13Qtw4jW}Y%{0`@%$M#Uiyay4!%iy1R1mhNFh3pr3gCRMe46t6bsmyRjr
z@()-hVryw_b}8urSLw!fO3PB&dHn?F>SS;88YE$+VP;{ewH(FY3>)OWv`SqIL5rck
z=Y>*X^&=4wVv@hPfIl86m!4S+;-BBynik%?uQ>aWpgZ?(<MMCQQs1?<Hc5Bxf3r*x
z{sKavPU@e#{_Ad?59}yM!2ou0a`J3s%=^%d8+K@MlIJA@b(IOfRrTpRD(+g?211c6
zf3B>@%veLPwJE+#VSFG@$b3>3_^L_G{}aQf{W|JR<Bu6+4dXVpGWSHQL+HJZwA9R2
zLd8{=bO&0A^R|-uZQXeRA^vE1`6Y2VfDr%m=T(XORmT9OWzhVk2;>mpHYn3J*5C;5
z{ZtIe5B=Rt9qOR+9v@{nLt2~KmLdi+ThB$4{;N&CNeYHPfnO#>394q>Z2BzSSe>8H
zGymYEZk-GMH7TDufb5@kpLd{>05~s()MdJJ0auzn-ZjRu8Y>hLP|Ii7Oa(UBBFLQ!
zt+Te2;_5Rr5YaVbDmMXXquJUZ@>Qf$>ppokPZ8jJm}vZ_k|%s>q_dJe^R_(^X*ak8
zcQ*}!EW`LFBGKMaNmn&0+1w-Bc0RDR&_#X`IDfQMM4tw?{Dvk+UA*G>;)~Oq#@Lvi
z<Qf|DkSr}hR(gDsKHXRw#2nvH%pzUbPg{AQp<zIt|32Z09BGl~Bcl*S(HVWUQbBtu
z_(L#*md3JK{DIu<_(^e3^(q<*qG*Vop{{e7+!(GRO0z^}PZsO;Upt&9a%cQvy)}k|
zgTv_#M<7x6(~(nreEipM--sm?{mB2UBjkT^KazP@RK{=Z{`m4?4pzievH?whjP<`4
zQR$E0G(#!}fkbTmDRh64EPoiHhOqtFf*b>3A?~OyD=3=6Dl@0^7qRj;E|j3_fU9b&
zD6_kBS^Hk-96;49%fnh%$Xyph+zIZcaO#>6vIz~k%&CQ%=O4?5uQZ24=KscI{y|%M
zp_^4Opei29J@)nSY)W=xK0eE6GxNKL^>PHzTOq`gESGyZ{8o84_LJ%MYK-Vqgdzm|
zkT>kNiChu~e=4{GjIKi}6h9AA7&Z{3KpsS3PD8+sZ}7$sxLYoBUO9?MF4~mu-V7QL
z`@G@J5|&Altm+amQrk0ibu7;o^KKA_q9y!S?^dRzGg@Y>t(vlYWpuC4Hj2f%TYoPn
z$!!+0q^t{4uK-8?<11HK!wgD;5;oVsg{NbI+kR*g&ltgcz}!=iEh}VQDeLtOPJlcI
z+B@ewG%NN@ly(CG+71-isiGYnFb_eOCpG0*Z-g|s!#Sw(L=tWd^_`D5QUbfMN&Kh*
zT#_s@w_O%BVE~ASlPzs!p&LnN^W7V*!yI6lBOs2kpqH7P1c5rfWgX!&3_dmFtGJff
zMabUI^fZ#@H@5dWQ}i%u2YXxF#>zpf9t5<>_cWWkuB>M{@beb|!zFdU4W$X*&WU7E
zbZ99Kb&OfcC*M**`zY`$YGf8rooGee!%)4&k38E<@mf14j+}dY-+tV@7n!7O$BfNH
zKpaaK$9YEU8Sc}eX_JiigF0*D-(s9Yb&YISHnVwgQ0Eq?@)yWJ&8cRQ^K!RY)o9eh
zN?UfCIUEVhEAa~wMTtd_d>+nws_R~uF|-VLAV4|7`v_^GH$9C^h$3%X<HMc#>=%su
z*zrL{pssWGZb)f3!1RC*?|R-KZf+B)WSA)pi;F^H_PDpS%B_)SMZKhlJ`hXNScvLz
zO_KFIGiv9?ApZ4vYtq|ZItLUnWSZp;Hwn9LVac0c{WCvWky3pV__K@6E@7*XR^FoW
z>jE%ceaWp@zoD<sQGsNvP2EED`*9VcY9vGm3=5#=hVZQ7VtOwhpRJSU<C73M3>q4m
zv&;RDo3i(T%qR5_^$szl>Y{*!r-soE@J-xn_$oYvK6VQR;<XCz7g;Dd7Yzymbn#oh
zDr%SF^4F#M>Hg$2b3(l6(eRi*s@YP{PRNdIEirn9ah*X2ErhXqc#YaaH+Id?Q1lcR
zI8Hs<5X)L{B#T@{HNrPD2&W&AzI2&b4=PB@oOts<+Mx~^Zll_iSVp_DPoOH0NwMuL
zV><$(B!CWdxfR|m%r#_9rmz;&lmGUS8)f?_ykzv9W^c&_H6GAWd*+DaW+D917+)RW
zFwb(y)xdFI|K1JSYZK(qFvBg;OtDmL+gUV;y@dS0^~qe%@m^bp;Zfv+1L#U}eYYtk
z-@Y`)JIgjBo?nU@@GQbQvW98kh9HY(F(8MPP=kDvK?^Bs4euReb!az2D+-G$C!hK?
zGryd#fS%k$0`z1sJGNi|Q?!R60?D^}`odd$FK}IHU@$eEQD(_3NERc;640(_E_*Ny
zdnc^oW#=&7v+E5TEuF&MVHrg%xMCRE!50=tr%YOv0@X(4cxF<i&3r^zn?u~)bW>{r
zY_f`G%>Fqm{5L80@&(A$=5{vhLll%efuw?z4ALo4q58zO<gYg@)=ctW-gzuFEhW7<
zad9iV+#DqtlMIlJ2;QA4Vx^JvYsm^`%Q!l!gII48Uez$D&}_(rI-zN-$6}pMJ{bi1
zXp!-imbNM*Mz^OhhEoVS_?HCVBp{5Y_xde0*cC}jV89%83oDrycA956m9x%p)83QS
zEiLAUTrK!^D#Uz+ix7B=cEL&0i=|tx;qdX!d_QwUr-38HK?TT#{rr0R^nDb=96D{{
zr-b;M1>_5|J*p0FEyCHx_hbk!3;Q)}r?RiT*`hm$BP0gRIpB^B!hY~5pN?e$(s{&t
zA4Q)RzR*s2;!<l*^o-FmR2(Z&F85R3ox+Tr8b%jpdz}lR>uTeh{LJ@`Na;`577*=f
zA@4ao%LrP$GwQV|Pec36HR6qhO{ZpI$ht55Uq*VdnvQuCJHbM$a*taoQyQ-|v50YK
zLO?HOXUt`%3BO;pH|1s#!IrTP&GotZSdKUmIzz{BBe4HBw(pp}7$Oy!sl|(!GwQe3
z4?IRXJh51YP+Q6%9jJo;OD2Sw@a|O3W|LJhrbZ@ciuZyVPoL#@!7QNPFQgd*nm$R;
zFW`!-a)6_}i)XW1RtZ;$Oyx9FAZ+B@Kwft^UsPz2$^S*MzXLcOsbJE%{_zph7^;H^
z=>h6KoS>hKm8B(j5k~sEr6c+!(3}2rb!E$bOTD$|8WJBUr4m1}Gc)4Meogz}&JzRq
zKsQu%AxXc2#r?s}vKN&p3o7C8k+Dx0j&R*k-i?ST8gr68t9x3+`8z|?X;3eHd@^GM
zm4F>-U~@kv!m_j@SD?3hq64~Xtjb-Q$$`b=(h2-LKy%`Qc~>LOE-t~wHX>Tq{XgdT
z--H`~7-K`ovki<1zI%^!>Kp|4jH!O%v8}vq!?l3;euS?=1vx0V9<{@drgn4equarL
zTfn7;VPA2D^sS&!4~PYK<PPzyLWXH9h_SF6vD%43vaOqA#c&lXGakrmEY~u4BA4i`
zx|-VrKYvX?xinAoOIa*Jd2HxxuaYxOPCF)oiQnxKAHmJW*ZIxjh^bD~3R%4E;_w^K
zUd2?UQfw<jxad{BmR50$uK{b|Z!NujY^3nvRRwCZD)aeUGt7d&vO<7jx)DDbj=W?(
zr559-0ux>md|Ud)XW<>iB;=R9@vhXfI6vo07)7%6G&v*5zccfDb$B%GQc#75H-8Nk
zHwZ>EGdFSKBO2w%^Yra`-&cPPxNJ(^oT}nGy*Q(t&msl*!l3|H-Uau*TOtHm&*a`c
zt5qnY4AfaVBB_i>3W-vbxHD?1gJkZx8P%R3Z(PkEH;%U??<1s-vr!q3rV@_IHWD^m
zQ)sL>fbXn)1XC8m%=TtoOCKJ>4&2ZHY&<@l_z7Vp3(Z1UU&()gh2pn?<I<qWk2>46
zm}|CslU9epUmd>Nbwy7Sea7rK!Mg<eLryvXA(q(@BdqUyDhN_IF5amcQ2pwz2$o!C
z!5!_cXT$!SDoxo;iJI5N?p)(8BXT!p(CJF*&1CA_pbv9X17lEq%#F+ugD(_=TjZ&1
z;+}+Ikd+l`pIraI8nv7ZnN?RSlC~b;a~M|qB5+44#72`-Kg>!RpcAyE;2Vce@Jh~_
zf%Ws1l-r=A$R~)j@0F5+ekaV=*jQ)!0};s)&srXiNjhywD%|fUKk60Q;~_irep*55
zS~Mf0<mf$jUQ_w9)q3zn74Ry`aZWZ=+0Hu0a3`nIxa1w-T10q84O*$hm7ahNq85bt
za-nzD289LnNqpMzm`Pub=2@r`lk*w5ks>pk^2}%CITAyDV@c0X`!neXGQe2>Y|j(;
z)?ctjIrJT;6-j<Eis8yIZgj*W%e^JggT-v*<lAT+RG?Ann#Ri-JV<dI_ALw=PH0Hk
zxV#pT_7#r58G`Que{Memi_SDDyn|0~IAfYiIKXRv`uZN4Gw>iQT<<%;B7>km?2K;W
zrF?mOY6dOXVjHQa<5muMI@=hctgISr$XA7C=o6l!8_B#~Y}QzcIiKE7<6A~;T^<(L
zk#`bgb^l^5&95w0DYHk|JNkd}_C%?W-r;Ru`l;I0y753n=E!K5h+i4OiyCfM`Vm#H
z?;&QS)LT|&dUXu^moXxaggF8P6s^lNAG3q<sX#k@|MJ?Ad!ro{Ccb7*E7MZBce52Q
zsq{TsCUW^VV(=$;=r29iu2}PnRLdgosZ@`~N=$S8(%p>WldV%6!T%RKl^Y5vH;Jsm
zb(ll^VGE*NAV;Tq$OTFjn>@VZG$3OzU$RrdMUSkic$*dv37KtcmVtIMC2Ma+yydUQ
zTEUev8Zsr*ZNidp_WTy@jR-T$4b2=p^5%~c0aBnS<+KT|O=s=cClve>7rEY6nKV38
z0A7MkT{U6ei~F~C(uOXw1~_E3coM$^a9P+ndV|v7ojEcw9;g{CE<+RDPZ-;h8oDX_
zDKdaWAXF?4o=Eol1=Fd<&@>#*dytF^bc%$RCI5nX-UE~ny(Gjpw7(bKY;<L|sy2!O
zKfkhQ;uz=%O{@if6Rs<R1W~BlA8s~{ql2;>Pe-@`RRPRDM6l}8{TvJM6Fr5$kOuFc
z4X{??_+hX~G%STf$Jrzb;Z3VM#OGQ^vb#=8R+TLO3Uyv{fGzpNuam-ymsqSc801HC
ztJNB(Lh>g=a+Z{uN+T$!)3TWh6^0rfN>p<29pTpJqZQn)zN-bC(DFO11bu>!)DbdA
zU%_#$b-$3USocJ)UiKYF6ZiK~K<^o~g=e1uuA~v!RZ}i;AUx!x%epnL>jLNiQZB`s
zUQ8D6i~+rt*Ye$SR2@~K=?EF2WnK$3X>6{CD7fn#(FX%crD9o8cfUwfl|(_RwDVXd
z+tFyivX;b6bqQ8UZsmOc7Wp>(iJOu>7CQ{${km9%(~Ne)MWF12S=nGKl7N?!&#N}=
zlojHyO(#-UAg?jc^+>DxsRqnS0`8hgdmiR1aHCOF>J9mZtvAlM3_DdVz36rZl+Cs=
zw2=n@)uRXcPnWmT@CsXsG;I(_{g(awSw%5?rTc6tBgf#=XZ=k9C!#x}GdSj{PdRlk
z865<D9NSU08C~>;=sIxiW9@{71YH*fD7)T{(xJr^!QaqDy1X$ae*PXobEo?dWxTb!
z$*1FZ5_?Hg1lB=N+}mzLbAJkk2oMevq31_t1BZlgSw=v=mz?dADM+`j^8;pvinh;Q
zhqTCUD;6bW0^g+akk<Z4HwqTJOqcUOi`n&2aEqTua2NiyhuFj9N|HU-Aemn%3G6s3
z|4?zG1DA7o5d_K4SDf{O-{je&a!Z0ld7l3G_Wg>J&}|ZOKfJeztmSh{d338_!^^$0
zN*uI!Y}>M4EZ3dgu-^p$!vo@7Td`m*Nc@cnstSEg9A^S}zq@gk6GMp{l4}?61@~bM
zBFHC@0mfk1J7vUVl5f*FNi>ClOwLvccBybTjBFmuar;YB;>6_S0$lpsWh}(E+~sKa
zZHJwW<iO~j*E1L&9k0LV8i(VM<2X#hC>WOM>#2fp5P~-cFW9%iX!fgpMz1MBTzE;P
z9t1qV=$rxEd3zHwVUyD%zt;F#gDm<7>4_3!VwtI`mZ`BHAvV8(B)|X-ssoFn*!V0v
zTPk7VL)lW7?}~)*{JaVF5dzZl&%6sth7oZy4!Bip(h{arD4(aX4!cNysb!p{MOFPm
zIaGEFx4wVdV8<IbS{TOyE)_`)l>rnucWJ>JUby$Ox%d7|tcK^JkH3sFw;d>Y<FpXs
zBqbxf=rnBuDhjH2Vsg#g?cusXp9w~|EFWowVh~;`NV{I2`VSmkJI0Gzynb^ZcYDR8
za*%KLbm|MX(qRGcy-ml@2q0Qlxm#|;R%16m*7nF$M`$4_?wcdZu9b(}F3n{)tN5<=
zyeZW7tbf8s{|SJNLfJ&9ycZwU%k9MKnGwX~c&!7%j#=R2;apwC(uFO?GSsKdLo(ta
zm`+t3a%g_5(=>pWm*K$4WBQic!V1*r&R%@WHt-XaZ~sI(hRzpRmEVIm+;;G~`Bpcr
z(@)5XEggBe#Zuk@Sx)+#b!_;2Ff8vNH&$ZH7IC3%tluG=D2<{X4hu+K6Tk_7=`uPF
zz51WXfLVT`$!DQ-7TR?rr)$d=jOVz=&u4K&a6t7RqiIV}Ro#DG60x7w<wb0TxcK8K
zm*q}fgp3EZLp4I$ffjeBrEkrb*or+Xe7G2?kks%?`m=`)w8*7_(*G;#s~(b1H9stw
ztr9NkMw{f^lmzGE-AS;%ro~)vF1lkSKuM{?G*1$c<$)mVv8QcJl@0DC!VdvU;$4db
zd!1wS?%u_;eL*~)%;Fw;Uu3i2kb<aPJ;R_w6iM*4?(M=X0*H(X>@GN{9W92-r2UE0
z9SaH=gJcp{ewMm~js7G`+doC#MHma~`=*<QV;+oj5mCh&%90su{bRF+g?r@S5IUjy
z)$3t(A4&+sZ_M)%jwi)G=q)n;sjsplBg7oA8?R6FLHpJzC#F>y%BLRVu#VNrghY!i
zK>&pWfZE9&bH!^~V~B8R%ejPEBpE68@Pnn?(y~hMs+PVqb4MH(1nvIT%r%q^zeQ#6
z(vk;jQc`T_ftB2llv&!TYC8Ee&hMB&c^k;y^_sx&Wmyt+U?PnRHt=~bFc#X+Z+b9S
z*&BoI|7f2N&XRL`e?q<V3;E7d(QLo|!$VA?&Td?U{WwiQ{e6ZLB|9(H!&v_J>&p*g
z^(y^$2|m0tS_ROEB_Cg7slAP4co2Fs_r~3v{8;UH|L42m&tX9(LHNM=2ea%G^5}Dm
zcNk=OO}P8>OT)Y43+=rGUH0tXXyf9HI)oITeW0b5^7qW^811b_3$E>N+<Un+3X0qC
z8{Hdi4z*DEa@JDx3-bK!oCPLuE@07fv${w*kz;;ky#2#fX@a$#YD(Ua&~#uX`QsLW
z!;FeR?`937(7LXXes;c=$kL0dTC;NioPM$2rAnIdl&m_I$ti@hry<?U_C!{na>}X0
z&hT^C%<_2Mt9isGdz=7&y66l)tC<{B!B)-4An;QYd?Fz{;~&iFAtq;3BP@BLoLi_#
z9ZmV$);mZ9ScGKkNq_=z=2-vO(xl}7#5pBLh=@4pA&S^!M50<jeG*!SAdKU`@vQ|1
z__JJ1O)F}ujynnTG|Qi-pBD;Z#FI{qnMO#mje*pAIh;W&?{b5`#x6_^Lp?D-om{F~
z5*czvYdz=wd_88zZ|bEHE;VSePOBYN+cD)D73MMpFRH(-50sSbmW~DT^a740%2GCe
zr7*IhEkt0qzDB6ya3A_ayR<;P?|>E!zP%hoH!#@$dIxR(FQ4mSWa^vK;b@`5+w3`T
z#qACV)vh+$zB-s^tg4V|hZ=<wvs2sg?r{??@YyS3z?hNj8pCg~!k<Lr8U+g49^X1<
zFGfmRBeFJ7tt0Mo$V`2GD0Om>2$x3RANAMapFsa!&DS%j866X!jWjG8ZdHVDmyFW+
z6MbccIDF@ItCysV_Kj#EYZ}IjQtB{QXaB|C#M$EjYKPYy3SE&qMBPR{V_t`XJi72m
z08~YYW%zrIeMOhzHOUK%h*Js*O=m?EyQ#D`V{ErWkO33H+!f=<Uh}z#<lzVx?y8LM
z#YeCYhlEKFnw#Co-g{=cCwVn*CJY69_$_&+{qMJ&BKU2TCm-Gx7Ggw7BNP>r&3}gF
zn$I9r_<pGbDpHeJ@*<18*rPJphVSru#syM{4{kH4oPzgxI{XY{_|r+ViU{I1en$^C
z4xKjSqbsphmioHjBP)yq_BF3bqvAPgxQ&1Ai<KK!m8XNGcx=z+!HqTQe*Jz$201oU
zV2}Ef-TmWE{71_@?}DQ7girFc2WRqa4oIW!QU^nN{B6KI_modzgpLBd(_4%tTnE(2
z+PxD6R)&R*Ev(jt{TTxg_%U_B^W$IzKnh6`fS)74^LQc8<zqT1V=6tL!NZOMzdypg
zTLH+Grmi1Dto7`~^mRf~=}(L7+KvoSX9kv@MoIUaIsmNT(k;Ut6^pdU!>sfQLrgWl
z6Z9%C_K1CcEom1lFPsS0qq&h8Gt`z|Gk2bc$5IiEFXzR}HkRTd$fuwt!JUTw{d$h6
zz;HQd(2_ylRV!nG^gO4AUHWi-#CRLhPbfPuZZS!HS%3n<kh0b()cMsRxFM6`ONFKp
z&`M)5|HjWjn5>F`6q6;7+g{qOlJu05%jTJYTwW`lBZdRNXKs_`kv@%}U@sqFoezF0
z1I+@%0QOjz*<WE(Pd1*jE*28NU)Pn-`o0oC!}qYvB5#w>ULp)KTU;=JPB}wOm-29x
ztte%baq<wP40jhK#ieKf2KmO|nNkFb!cgsA0|qjCH88~Kr<Fm=^D7L;9BB_POl%MF
z5GxzO#5x$^sco#(c8ccX^`T_*49pG_dQzI3H}jALku~_h9K3~qYoTnBmdI_A#7&}l
z*a7b8lQ;U#F_gI3C#f4grf`oRo3_t8A6mQ}F%k@Rx8^<U)!w&*nzvV$bOggJpqxRw
zm)8k>?5>Q-;1EBO(dTj2w&-58)=q8yUt%m0;rTetbAvtO(4$m!yuH_n5W17z>j&e&
zH`PIaIHdgVr1plpKj_X_A;Mw{;;;PoXu$XICOf;^EzcY1?Bt7IkS5?reb&(Hh$nfs
zY?Ns;`#!t;{!O;h?vI98C&hWy3_elXRGO@Hh8<)#pxN85H$(lk-W6<b?Lh^yBoAn0
zBpCQW7VQtq>CxF=4AzmZUW{aEcHF)%Ba@Gckoa{ruX=UUXOpzycW$O=oC(Ap7nCOO
zuGDVa{-6fau|2mnQ$zwC|HX~&I3lUoFPkY=i@v7ZqvN>&<G9`#_SBk}#&1jf=-CMc
zTw;YI^aKg&SJi7@dNo(tTw(6G@*>vVu-H&s$G$nP=uo^N0ZMlK=0X9AmoGa}`V5lx
zXO?qER*9X9(XkI*)^yrv*@eK|ETu5$q!Naf9#R{0c#x$6on-uMcwK>=?=beIzLyV;
z;5{QLuSX?nJ8sN1UM%Rx!KtWtwg@6ne|}Ii=yHM8{zcmVt(4Q^Xfe_O!}^xNsV_96
z*?Ifiv;rAAF4TBjdN)~U^UT_^4;HtOj=IR1g59t)=;H$_mJJUcKoV6E$Zj_SDes8p
z<q$7)6bb?eRBzlKlftzQY)wwnGva+H^|kc!rzCT9(LXD13};O&kjo2eI>OSr3#U9d
zHFvvm+qgO+X}QTq$G*4OCds!il%3B69>%xs(XuC+xBA_2vl|LV#xQLn>3_zgW79~v
z$}PI3uFHqTOsq%TV>cMwe}YHyK<&L}!HZ*g-|fm|=X4~U>&vKxN7j=(O5mJp0^jjC
z?XoKaYk>k^hz5)&*o-_KFNO|Nj!e4r#b+Y#l3#Sjw5~S#v6(-M<Q&t}BX`xy^)n;e
z#Jqzdb9g<zz?ywyYSDZl2^<N0wx`-^TEUdo9*Cs%<8>!$5`%8k95-^NzoT^ws<!hF
z{E_~FMT;OlPNos;^<ZLr!@g+jzkaONFbxY#qN;klzM6vgqC+9rCK2qf!ywqQPM{&Q
z{q5L-yn4adch(<C6AYXpp(?*6y^2W#)FI)RA|j@FPa##%GWO-y9O2i--9R}c0jcG5
zD<fWLssL^*!5)_ensdPdSq{>+N=v7{l5*2UsWOF{om+HqR`g_R!!TK8@v*m18h*Y8
zLL9@HKgxTrP`b#s!7dLqn_D2?<nuz?Gcqz<w)&B8Z*Mm|yC2A&cb%RQx*vBqLa{Id
zBfN6}AeD+Yk*pUA_E;A4Uu*}ZwZ>$?wt-`lM^GQH0n*`3H1gw}_`OaR3P2WR5|!%d
z1{Ho&>GDS3K|p?BdiY*U?{TdoN|rHN<%RB{kfsGXU0L@2$Cj$%eDJa7Wd%SoLyZgs
zb1!w(Y;$%i1|5{CRFv?Q^Z?@Dl@%}*i&C9OL>?{)jQqeQ8r?@=^Ulivcr9o$Bc%ZN
zk$80}G=0G7b`Sd`ducZw3PBd4Sqx&IhC&(k4VQ$7ppxk{l)mqZpAhaZduf6%g;`~!
z?EOIYvP)Bu@NYVc<F$%|F5vFvv+`6H#EXEWIIH2`97-7Ghj}+&Rk9W1p^SdF2?YC0
z?#RM^QdqhIZ9|(NJ+`j~`WCuw5QG|vak$(>WF;hNwaC0)zkRD!)JiDI#;;;6jk~6O
z&q$wz3^IsV<6X|jr9-UWXy0Wewq(A%p4qzHRkS#4iRCv<N`)cT1Lxour|QN+i@`G7
z<4IZY%nJbHqdvo8Bdy3M-CAfxnU{QaoziA@1@wC?(QO4o!sV2m3l)Hdu2l6;-&o&$
zFMdcyuP%@uI|#kesD%FShvQ#p$9WhUW<gRCE@+pp<Ylc44->BAZX_KwUDf_^YYp6D
zLjIWi*~kR!ZEK<87NCKxaXA7dKOc~#S<;3N>;V+$mah_51X=ddwuIHtw<$u`*`F2T
z)BO=TlyfAJ0hJr@lU(nk{dBQXuet1{Rnpp*=e+Pgtp`DqlrIMYc9W|s5n+R}yj?P|
z#KcRJ1^h@rLG<_N_GuwQw}k0fE`Cs$W83udFv|R_7+muUf~7B|%9Wqsk(<|sqB&bE
zC%s-w#Lbt5=Q6{{fvQ+f9t)&u<s%OZne!sTH`q4uN*Qo5`KA{CT=Au_^L6r05%@%p
ziMgB@G+RLX)G2zfl@`}k_-WkcI4QTi6OT>ls25U}2hwN#({Vw_);4ISV-u4I;<jfE
zv(_O+Oo3K2{GV5vs85nVWahn~D*hif1KPNeZ(s4|J#2P!pUk{9&a_R{8JFJQ#SMQ<
z^AT42e_P>hk^lJUe=c7CNsvQ*cP`r6LD-LWy8jQtMd$xcp<kjxFKxC%|9Kh!Kvmvk
zhP0laAT>2ij^8<Q7j%^5wu13JHYq7-h?<^=(_f#&-^Ti1QTabC&i`lsL@2aw<^R(7
z@mB}Me_mPGKcy`H^I!)x>77A*Mt|O-zuv3on<#c6sg=OTp}-A}mvfG@)sp}M=pf~u
zO8w>#5^|sI2_BC%Ymm%=z`l<=r`{a!o?@Kx-bRTwORe-h9sWOzOOh^Ybf+C7u3erM
zu7XW1rk!{h-z3QxwnBAiehK1-O7g+3X1dhLFsi?3q0TDpQoN$Vt0Gx8>wmXqSVroB
zU~Pfec42=yR4igbDQm#oZk`I01-U?|NXpiz>KQecl<<*=?kG&-eQNzc3Y{B*w5=!N
zlAb<jYK3)%u&|-QLz0={0c*(*I;5P`SWdr0b=&UJ^`9sCUu6XUuVpl~3Eqg#5q^Qo
zaA#ta6p}i1R{VFXlfMuMPfU=4ODCjk`58X&ELnVLM`3;)I&OF1Ri|2^z@A8s|C+8F
z5iMiDCEP4_mUqt{f#!${Tx*EQ%Z1}b!nzcKMoZ^glvrrBp~V%=aEczQA~t~TWbA-d
z8!Z;w$f7gt8Yc>bF;dYCrrh^!A?(EB+e5`7%nG+A^QogUbhJ~sapEN=T*e5E5>FiC
z*24vqn7Nj6cD^@@54e}z@5#27zc}lU3ZBU2y-f5l2e9Ym3bWCQYe?sW;78AcpvT>i
z6x9X)nVvV7M7amEC^DP268EoNl{*W-TGiS3K_}sA)%}TCn>7HTuUdLP)>!Kr3RU_h
zYZDJtP@7TV59K1+^~Q`Cr#L#Q8>)@!9FsPt(olb)4)I0I31@89v0@JyHN}5=PeJUu
zB3iW2E<_@%+#Qr@0LZ=<9!8cQ1feip>fvb+lfCtHJ^bBFN04msvkK)f%H_xTLTBmh
zWYB{Tp}hEcxxM`LXNmsZ3<&K|p87ZG)F1~Qjp%IrbM5b}aA{CGq+bBZED^s`JAQ{g
zT?R1QEWQYT6ABVEX2F5Wd+(MGSV29}t!}-2$Z-8G$H=Hsg=kBIB=0IFT2QDBR99Lf
zz{5pJKFtR46T3QaGwJ`USm)1n@PA(uiWql5J7-nSuE!XT&G3&euV30ubCAUQCj^}&
zsz);>?XULlQbS*EiB5w}pVv#a9`YaER{We+9(fW^0_*~)PqSX=UpU8r;&|)$J968*
zeJ&SL^y~K;kJFs%k51<?rq5>|FWl+Hy%?SY4E&6fx_zyoUs}e#88XIwp3vyv%f%+e
z_Ilv;XM+wmyjec9-qh{&R7k!+2Ob_CBQtYv5IpMXpMTuj`}uBmKku813n@*_<W{-~
z>-0Z$1c(t$pCzAR)1gi9$wo=!9MT46_)Vl@p%>Ob6R89OdKHX8&^-3X#Mf*eetnX(
z7-K#Z`LL8J7!uTvR7l3rR}=jEq<_bK1Sxi;H`biN#l#$eTAhE>=rf1zVsLwV0#=g7
z7g#yv?c4Yx9U|h`*&$;|>lE6jRgPLdUwADGr=c>Q5|_&j*%0<LwE2+WzI+8EKNy$I
z5uN56B=$_vNHSfQ2m?<nGM}Z9WwV1%uM9^&RiGP3Dj@>5S6XovKE@%Pq^)`xzL2(K
zo5!iw;K=>T>H+0Dz{yn%Jy|8cXJ%rl<?6-nZb0ix>11%e-Vi%ni9>3qt8H2QU^)5f
z-hI3!EhD7C-Paj%NtF4vj^um3WV{cAOGB2~iB+0lQFhS_FTSZs{;jdf4UE4wJbSii
zC=P@2*35prV52z3F;8(H)gA7VoB!ndQD;g9bQfKHmk@(JDc?CNenC8I<{iRAp593(
z>G^u8h}aL(YrFn}F24mmc87W#r(h~Xu3bs<6;#$fivC0&FyBqmbvBF#c0K^NHmVvU
zkRt|mKUe2X5``?{(IpGi^1a2fZ=&c2;V?KCmc9Z}ffii4@nB&^Tk6H$T*vFH(Swlu
zZ?0HQ9kiK6Xy!IGOJF#zrN7Cfl6UHn@q$;-E2CxI>|T42F+8yTlz>~@D+UZes1DqP
z(1b>-Oh2l_)HNRunVt)~+31t!OXjP(HDh(Q89{u6U8)(;HeJ#e8cvYzDvo-~IpzF#
zd9X{OmUHvA6xAa|_thed194WtLN*%AHolsr-OU&vBNsvKf{?mRWaXTei23oUW?66D
zs45{e?~@n}-rrQ;+W;}?-)m1i&~S+xDchDtt0@_1k=}bR*Pbi{I56a3t$%ULq#7zH
zEEonWwHP&^fUqv>{V@@*9i=}=6JpP2Nw_!Lx<RYY6wr(Gg0vaVF|o6Pu9mO2C%=*n
zN5@JoT?1_5hC{Ke>*mZz*V3YHqhkbXUNF(g7or*>O!}+3ql(ExCx?Q^CDM2o5lr98
z2>M)dUOSG+q-n#=<#>mAl)X_8n=$*Rn5F<q#{HjpGO^2-gTmSC{PH&ZYQU(PfqKuT
zvtZ`LE9S=X@`Lbh!jC_P>%zkDq3Mx5vU~WajP=Lj(}le5Zt++Oadtn`5`k`!7apP<
z2r;H?>gDjrxbu-r2y27fZs-Tb9nm<ZnaK<}*eA~^Z)?~T4wc?Ut443+$#pjz7b@h1
zn+gRl!$5XC9;iH|<3gYzdReT6@_rfCf;B6ALu%FywPS@mrnM>EtBUac5&cK*w1jwW
zPkrUrw7pJLwp~6+pJS?@bFaTUy2WvjRtm;pzk1;#Fx9fB?ey~ZLW3!|&W+F9HJO!Q
zO*aQ<rhcbN1)0Z5RF(H_ate<rbiUeztYhor$I<^x=sPvu4M!_++St94D^2{(Sz7&L
z$@0P^BLMvq__0l>eR7pXY99nQmX;VL_o1$+oLE0UwU6rnS13fnU3SK3EVSS=_i@8V
zs5m0liLm-fiLuL*d}zX;f3Y(Z$@N>zI-4Otov+c|3Bay-fkrDRM0Maw<1HE?cK+am
zE30;$e}9f}+b*+xJE}bO@GAPZ&mp=lTzJhY<9<SZ{i<8Np>k}WhtVr#fw*m(*66sR
zW9VcL45=I}ALfMy%>`2O*l1XlJVI#Fai(Akg2L)%5W|37S?2%p3S4~+6&)x&L><4z
zvVI&bvMKY6v?oy6SQwdJ$e{@JuHX9++CgFHhHGHVz+ULp^Lf>sF&aTWN`;D^7v&+_
zEw|e^xTKw0F@JO+{Iwx0x=d>?)i!V2OebX42BeTO3M~hH$bWU{Hv?B$MS!A9Ks=hg
z`Loqr(Djk_8Z2vaT=CYK?jh;Nm-0kg9dHeHa|Sg0S%E<8nq8+IzPXneQox}HvY*U9
zx<c;vhBpzo^CNL5o|GfnFJ-VC<pCqMQJFoVxh2@=k<&Hn<lB2zh^B-%_7}AAH}DJO
zm$f4EP5h!B_{2qO1~_d?%#@lptk7w|#FG1vH_Mn8H!UZh%qU6<SVWyZ)0qk#YS;R)
z#sk}Y;1hyn;aWs|9`>NKvmITk1Qj{=W%j0_l-&{pI#RU>8@0sSbm+)zW^N|8t?4zJ
zrFKoPEi#ONp<KA)>-0h#Hok!t|9xKcWASL3cGnF{9z;}9tqnccPBCl|W|X0obWn@N
zdJMTPhQ>Ga6+M!uyJvW>xdr$|K?-w=KS#iSH8{mkedROyA0`ro;u{2-JD?}Y&!6^4
zv!v+ZeRt7J41vZOdP{i%ejWv_rJVLQHkjlDTi!3{zi8TKk_B5laM-m1ngmpTr}}QR
ziA1hIn8y`{txKN2ar#)xyEPhcgiN2m5t%~bP$HsSM>7(U)FpTtL(l&$kFv|A6DcPu
zm17F4H%h*_RPWj$LJ0JB%uo|p8h!6XJv@kPPw`;{75P_Hq_pasts8nXXlvlB;;kx3
z22rXpGx)}Ug0zCfJ1JIH{rQc`Z%e{L?lE---FFliemwqh^M<mSeTt8V*4<zB#F&p{
zxhX6ASBLm=vqx#$NNYv5;g<F(`CJ3|`k+_;df&aYk*wH^0a0o|JuUKxp~rOSm)iTI
zg@yd@fhL$syTZe#&eHwG!g29cp&&_(FSdHlUZIE`bxsN2d9Z`)uz)8Wl8B=0Be1k=
zo<rY88-qA;EJ}-E4kUwX&wosxL5F(fA1t7-HYg0yyyu86?EGrbooy|=`5QMlv1oOY
z$-b6n>UFlRHWfoV8Rf(8laqc>1T<w;L&7IS^QKb>!l$`F1`fMjC8!Y)e{DO&oXe0y
zmZkibx^4JoEWn(Bz4*bz_FS#O9#Rmk2f2Ts@^8ao2S~a=+=UxNXBY5guUmhkKuQMX
zfA!=#_2hBtv!bm8>rHiK`Dq=c6mQ7ZlXi9z+l;Jhj9kE;o<&0wCUcX3s&jxmI?|7(
z@S{SEdI)tO!;TV0{Lx+%gv}FFNf8c-stuRAL{A!31U@j~eyCF+G9n%Su|=mQXh{84
z`HUEz9e~;L0M9GLhbxLw>Z9q^DL`7E0^UfjLmU{=>RaR?(*ABqPb7PvDzGBcR)V_a
zxgzITji1#=)8><Vq?v!+OT57To_?>4cK)4Q3ejXq^2Sw`u$TJU8*dfF<CBQcn2*HA
zjW#Beai29<R9ywpr=j~d1Zu5TsMkZH`a_qLCES?cL3juxFMc9B`SyhWc1kHMbc{*g
zLKpYN`gS*t50CTNmP|-^_%=cJZRqI&6<MW>wFoOKD{fceMMt1_P88@MgTi$F8}02a
zA~mnjYu)`boh{7BCo3qj!Q!sH+8dU97J-EPPW2t;*3^Z|tptngOgt9Z!~~_a46R=f
z3>G1F)C}968cP99$Nl8<7Okr`J=KiBtJj;g@<y5=8JgJB=3ga~y!<~=sKW$fNk<se
z67T1&okp(2Ak+)~K42Pn4r1*OO^>Bw7K0~&p7GUnCZ1P)V9&)hr$0I9CC1vgl2U;U
z{AkSMyY{)i6_I(lI*V%chxQ3Dz6!ALURwHC8vo5cpXqxImml(>IuIRD_50#`ZNJ#-
z=A}|U66u@{xb~^OO)w<p%Z5(H&&4o95;HD)D{Mz3{GSoO>%C8rM+Xx<>LGS*VQF+w
zU_)MJ{#Cg$t@(9zK#X^lL<AC=gtIdz6{bX9##!M<K!Bk@cFuYb-1!4JnBrAnj*SKG
z@xZo6j4FkK6C_wdH~6Ez7FF*kK|qh1{J25n7a4YW;oCPT+g>u-DEMryl4eHi>cLN&
zID`?ynh$3kU2>S`2%QL@swXHH*Kw*G#lTO>17YL(HO#*VJl2F&*&^848ajn++H<J=
zM_5?_!jb&u6qisMOF42#rl$s3*v`i-K6XRhb8|L5YgiE}*!qijP#<*-wG+j$rU%j!
z#7EO6AOM@iPjqujw#o&``$fP})+$;c<rX)uJavw7I=}rAd#*^jXL<-jLJe770j2Me
zu2%564v+ZWtDqcSo8OxH?Ex(@pO4L~-KE_Qqi8$&Yq9Un-5<k`84$53(nBwH3{~sN
z4G$~&vs*%Mt5xuO`^1sHz6N(vp2#_y@Nx?r_r)aem+}^;llm^PINKgDONS!%j?QCH
zfju2&Q$8~~onX-;t1=apw)zs2sMBojoL~gHRu*XCZw$v^yRj(B94%9ve7RV0&aC7T
zZDZ7Cn!Mj4Md880gzTdlJKcLL55%%eOwtzs*{^fIZ!&pQB86lmvUEI2)^Z23q110}
z)J`HI8hIo_S6XmoPnsAV?p~O5Y7?x$IV{&G%Mfjw#h>wJ|3v?x>3`@gM*)(0nDcaK
zeS1|M7^9TIpV!c!(el1X;6en4<|GmFZITPMBA@_&s>zDCxgmFl4HE4|7H9tkLQt6M
zt^XNv5>rO_l)+*Hx{TMwA0PNFhgT|q*96T@MvZ3>8a4#PJt{UA$gDn$AJ}5K=Xr^e
z<<Y$Z)K6a(&-)jy3xHQ9Ytf={GfN8EZG@*?KN_b%$Blt*8_-05<qc8U*7|nph3!Hs
zhq=mRK1rb#b`mF1L=KTYutKLIEQQxpJ|8U-lwERXA?m6;Bka4otqbK{%2eycHWdr4
z2&Vuh)1FGT60bA@(C~_(sh#LJsP<?NaTUUj&PLn^;@43a$>k30+V=P)CXp<qIP&<&
z$}R!R#wV}c0*U#uG~?gRk@)Dlcz+^42RP<tbvSwl;Fi5UI4#s?6A_cQ#P`1hsk@>{
z>?B4V+F#bD=eoDbS{aaLyT><`&<qXpH|!Er=3U8h`2+<y2s9YIpPO!L?c-sck|Q5E
z&x5&=8i4qYEh7&}2NZ|yt~1JtcVv@>x2lRBrJ}IvMH|UlXBAeD5A26pO0IJk|EDUI
z)iQ<eAC)sD0U-JC2jBnuwuixdISAevP3?^t*~40TNn}t7A;HNO?|`;!FIq?=L33@R
zHN3<bROwKi(b|BNfu4&uAdGg-ixAr|pK#sp^5SSx$kc~0nqESV0)P_|AG$$|Dq#g$
z#43A3dWd61Op0xg(!mDkCyLkImcrCGE8TYp>70!7AkHEex<INp<Akb(12)h{mzADd
zh)&Tn=c26}g#9~;^(VOX-_QOZjTRckf(o_bKa!G@P0zt2xBDuAQGMYU8L0tnlO&Qt
z#P+Lg?zh!1_Z*KKh~k(i{S%pQamvcd1l@lpIpg$Pgr^qB0k@#iV1jc&|HVF!4|w`N
zft~-f0(0)9AQh{rZU4Js_)ilpR5MHqQh@tg==vY}rcLBOZ2kWhI15XIl$VwDbUz<-
zQwxRtl_dMuD?rBg`P}wtnLqD&wnDc)g!<$qi<gfNxt>f`PHuayQolC_X5yu5@?IhE
z+Bz@{suQC00@fVr9h2VXpq(&d4WcSA>jcx`L)&lhpgqQ@W;Ojm&~UQ}nnIZgT8a*4
zFdb<HXlY5vaV-F>nYn9qFL-#H8+fuFIygA!BK4ww>HY47yc6|M&UA5RZZ4LDIbl%2
z-Tg{fO;eN45t_IQ&#MLi0Dp3KkJI8$I93zs0Ba5-jETarKjljQx=r|!-G{D^k1H`A
zXQ!qzM6VI5KqA7TqEJkw@t<IR_0ix9`9NmBYcF(o^W0UmnlExQ1kr@|Z9YEh{PM;*
z_gswb>~p=nzuP|DH1~SWCxq%QeFd$IJ9vDmj2gS$r-6T@=D!!Kb<ploqy6oON&q#k
zU*O|yt@r+N-V230bG?C~;aMNWGp6yw5;U}m;iRgH>2bWmG;^8{+&w*wW@vEs{`@(^
zxq$b6FtQJNb$KFw>Ex-e&!C8-`Dpr|Pb3=|SMP<62O2cPB*(_4{$K5VWk4KV*5(@l
zf(HULPS8NG-~@LKnjk^C(Liu_x<hbxNN{&aa3?@$ECd>NPiP#1Yi|>q%zQJmJG<ZR
zudQEQR8e)S?yYmrbDndbGvbPe>3tD2HaJylo4)IYf;(VFAz+ynLDc=#j-ULqCvK|v
zAw=@K>h$9E_V%yLNMhx55q;ul=c@~MLy}UE<Ck7Szkq<H&QL%*=l4!W4qQb4-=1kz
zSXoUiT2=3g8FU)*XnOIu<yhE|s0ncriFg$odykWo^PTs(%gX91=3%{qqoe;9#Ki!D
z<x_<eA~%vr9ezXwKA~<oEVW%En?FG%V%4GhlmPAcvF!&U=?OPCHwF`PRuUBzm5W0V
zqFObXL0Fi=a=c91(2#nSD<dOg!O>?fC=%e&arImh<%5}$vhwFuXcCVlRNBSmsP1{Q
z$D!HhB8_4ZKt)9bxO}kdRu^Wx(z5?mGbwJBwVNA%o^onPz2mA;PYnI;w{H>#2KSM5
zp8dLrjE#*^mX?<MWC>VnsW7M5SXq_g;+eHD2GiFzL+4LFyZXI8mW`z3LGXP2{`M9Z
z-CKX@naArL9UV!inKlD$fxTRssAy<i*s1!KO@ouOP(=`EzAiKS3DmdEfSB)KpA+aL
zFk6>VIo6DMurCNSXU*Fav*Zp3#4GTy#VLHLGgOLXM@{90G`-8~0(3a&cv-&7>ojXi
z!UtjXt?iZ~f25;WKJ?<ye!3XimV|-)E7R_pbG`dML(AD{IYw6EFH`A_lvzhkfA`o9
zUZjfH+#?}*32f&|`%Q2B3~%NTeNXVXUaTw6O7vT`x?201#(4L~(VtihX-PWN{}vi$
z`Ce%7_d;J}$h$UQdTVtc9Tx!5LY4uD9*BotXa)Rg(=pYLF4lwh3m`?{DSz3eUl;#d
z?B)A~D}TtHBU|xZ?);CVe@L7E(Z=g1$fUm}IDXI|`aC>5ui*|34%DLKnGFp%)z#Q5
z$54YS%b!E8WB>e*mxNrBj{8$i{r6k4_^zsc4LlQ&cmK6GS3UFx)$+&Dzs+CT>Y?8i
z-mlH?kG5S4zh9Fu#O2q9^+7sW^=UcwFN3s$RDS<nC}J?#8Oh`c|H=4VizEN>g0C<9
z<4V_kbsd%N;8awqdCIfA*XbPux?uL&5uAtCUU@$h;=);aZj81<%JbBs*<az7#`vw0
z6am6aS;b5ZT>$9Md;Dmkv6PAY{iiOAYHD}DN7*||g7cS@*NhbIe)A3(O;krGXmv}S
zkubb2iX?cUo7HVrAwuz6OK=&ElMBycCz4Nv98nhO3JgjgAq8)Ln%Z;n|AWpJcX)XK
z-)ZrU0!`3f$}x>J0EZn)DZMKa8SPZs$}D+Q3*-?NB<txSoy)SLQH)B{eT`&$-`cF>
zst&}8hqJD%@WB_w<|!TyxMr?9A2RoGRp)bG=}6}$;y=tKIAjMdtW}b7k2ifN^!9v*
zIH2V|j`CI@-GgtcZL$gYJ{a9vA?8+f(p)^7?3k!9WoMf!7pr}}Im}YEqJZKtRcyD>
z4JNRj_whBO%oNXhr7muoNUrc4&`SlBf{m3j3b^6p%BMejci3&B%BT@lov`$6uQ_KY
zmEYx%1F2z~ZzX4QD8`hSRex~<XJ;x{|GYf2<UI)?F4aO?wnCL+0bQ(kSyblQAqDw-
zBX+WD8nmNVv)jXj0Y*>1I_ri4L<pdWY}jV|R#8P8Fcf@@>Gl{rU8f^YCC9U0p*K;O
zQkFQ2&WJv0He==`O8qc9BqNuDUpYuK?L4vw^PhH8Qw#le4p6N!<x`$zlu3T_Iw9l%
ze{=R7!DFDfy)l}}kTQ4NOsCK6^n3RW>KU*`B%3@y;1hmv^Lqlmh*>FnCBig45uYsQ
zM*D3bla8Nvb#~!8I!>OzaysOqT>EY{nTka+Y;rVM=X?JnO}g9M@~@@9wqx~hkK^Cp
z*AGjgjqxMU^W7X&YyYlRaJ~GmvV?;>OL4YX{Cqz<=)k2j1w};L^N5GQd!>12SkjWR
zpT5ey3Ae0|JlZqgUk`v?wN5ECM;ShU;X+T@heiD8neqNb`f@&3jD4kyjOa^qp;mmv
zX|!MnB`-R@(xe+eO;Mz+Txfh5+<g1;7U@hk(69Vb=q}oJqQn>)aY*fw83aLlvB7?Y
zvft#It)RRiOrq+^i_&@u@!{8{_tDH3JB_}5F-{I5XWPIN8P`_{G1%{$Z%2rcc$nhe
zy-aTnSRKnZQN&kbs#sNln#{8nY!-aL8R&Vl){4s`G4Bg+d5<A_mPFywWbUh;E4J@T
zVdrEgw%&pkMS^Ca`fT~xl)BgXj)=s_)oPSQTtVY|5-x-{&TCu|Up*BtS`{`wu@C^U
z-bz)iPC~G5BQ&!a2)X#`x*Ph^(ZJZ4Rxa~&f7Nii1m%u4gwh%L1$#`{c}miKeR9|_
z>3|+5tUfY3^?DK^a_`EMGR8Z4pr!$tsj<3<aNm(K)#9TQ<{SY%_XS;fF?eC9WaKE_
z@II%NnpA?aQ)n(K$lrR_tRTett!o}}TDyz5aumqIu+5O1#cZy)Asd_e$kYWXnxs}Z
z?jx%!yyrUaEOzDZS+McUIAfJM3nGm2`R(f9gnY#NN^)JvTMNWaSgZo99t~6ec!pk5
z|1B2eVSStfNkaoYT&*Ajww^KmG6No+wbp}IclClnPZJ~)7{a2(y=YKD_0?@t(pMRm
zbrJ~M`>U`L;u{q^3MYG%b!kBa=BCA2wP=)|S19msjuM&;nZM}5HvyLTX+G#0&f<T9
zP=V-Ksfx><Me*rNd{DVU0V4xm!$p~}>P4xEfjuqA#f__#P*7)W>#?`jj^{kB7u7ss
zu6FOR{1WG_)_SI9VGl>u@}9r9oRfCYf=06a$w!_zSLRI3hZ)a`2lYJ&Er)5|TPbt%
zl0OdjEGNqxDS!=M5G2!X?WU$*q5>xc?Z2H+ub?P(Xo<>0eQ{6-c(fLUEh$qf$}%Oh
z@nv2yX{6S*GTn&S&$7?<+05P&kN}^UdhOY^2Jb-9Dbv@8TlW{|mvs?Dfx6ZX2QIB2
zicTvH$y%tw9ZDY+Ss!Gl9SFE8=0x!d$ymIi`1%4U{a`Y^WDT_){EhEqNvp+YCkEVl
zKD&c~0Iznmc8nwFF|?9%2Ax_Z+VII(Fjyp{8?nBn;WP=QggkE53o4D&&4_Z&&OT*}
z0iUBF#nb@10MHd`3)cu>v7;5i0KQ;mCufcpn|7lFiarlIh%NVr8R>JP_bQit7+`2L
z>}$4=^Jq}>_GGroe<J>I&qyve)qIub+G)Jr7{q>6RN>n|O3iqFpSAz>y!_Kih|ys|
zVm6H`0dq22>WTgvlqhC{B@~Y!VyGDwO(A~tig(rAQ1nSD8v0c3yFnjl?@LLO!Ur|M
zxTiN__qN<O)H276Giph7w?x_lMV|)<=gvy-2@J`8YC7Fj5DewjV2`6viLyZGvM_r6
zl`D=JFB2h~Ouko2V!5kcL{~1KJnqSHy6UpKTiF$vpR?o>7g5J4q3L>yi4t?Md6|+x
z=dl7#{z5kBv*hPgO{}3*l14kEc@s^29uxwd-aYS>wUZMKRi+Tm2Xlk;{pXb(KQxfl
zMhR{-o|FyTkV8X-<v-0jIurPGvYY<Mb(G$zM`O^5F#E#*iA!dqTK-zss~Sv|NV7#g
z#1SUHwPzS*IKJ?Z!sfvhG1m}#c9)pQc{696es|z-SIfk49iBrxIS-(c<7EOZugJO>
z!hi}ZTT~0xq0B)bsR%RIY=7~@(UrVBN`gAqx#i*eX*2x1yp+J4M6Vhi^*9V~Povdl
z9XUeIXZoKzK0Q{9a;(PZtjCJ^n%I4m>K`c)nHk-b7b%@U9sxZ@z=-<v5{+Jb0FGE<
z=akzJfTnM12@0C%7Y3-$`g{6+KIv({tygRzZkBjEq^3(w7ml^#_p~6s`~F5r*J;UL
zPf}xo^Yt<01a#avJbnO~G<3ZG6@TPfpr#EuD1N8fSiE;bdR=V?@GKc(`O(o6QnOlX
z2}3aDw=vt!MKXH0rbV~Cg&$1zVf;;2Q&)RCeUTdShOmkn-e)uXfzw~CbJ#29w@LMy
z?EvNLx@!9?G`uUNU1d)rVMT*t#cJY(su{&!nLd-(g@oYfREDx_y!_~!Eo*=19IGm*
zSeTHxy=O|^dUl7ElP6AJqt3wuQ?qo=uVXbmvs708jDs*Qaac`lh(YLaHQI*b`2BJ_
zT$?7FS5FGs=mQm~#V?CDCV+1OdFnUb2a+qs`dP`=XgzFD1D_K+jIS7Y!#IRWN}$D<
z5A2V?Bn>&7-5$?YyvMV?9P(J{CI+^5B-*)~ky;`8(H<1%svf=x89p97(_=3;v;`AY
z@NReJnmI@Hc;2VqFqySxtoNoA#K4SBPYg{-Nl`N~J}k1X+btkXolPz9aG;PK5SHX(
zHL+zAVPA`mYAH9i1rl+N?X*80s!_DiVPCUqE8YOue>?CVsUFq=>6_D!AI-EFyQz+%
z2CFu;+=x`(=~`?wMW(1{FCJoV&b;ycR6?V7e|1v)NP5G|xmt7SY;n2Ht@bwS76lx>
zDfaY~Hl^MTUByBNCJlU=IjV^uT}6_}i*x&oWww%Lf)J<ZACP4A68CQ?=|2SkP}T6V
z_r#ZVv)W;48ul#OmCPX=*R`bHr96j`CR8%_b|1xzJ=B|z4=ZfF)biTbrCK_l2l<Vp
zYN^gK`8*-EH>K!%y+1}QT$#lqGf>1&^h_)qaD)|V1xKpg4Q?TY+<zcV_h0hRn9a{u
zvo>Zse$^QIrPzWTt=9<U+SdIS@9Fzk{&n<kl1z%QzZHl2dzA7!+-8=A%vSrJVdzo$
zS$e$jdpW9KNbTpnt`W+0E09R&SB6<(=Xd#+>z4dF`p@y=51e%E;awB%-yOtjT*d|a
z1*`x2p7t8N{d#FX0M)f*(skVHcR1v&`S&OXvNFtEi6iWA+wjjP{fUnMc;86y_4C2M
zU+D+({GELF>%sp3h(B8J9aSTbe#d;f$n8nhzx9mY<s`r+0<Ug3gnf0)B7x^yPa?B8
z|LAC>#Lws&$#`H&pwH&`%!`Yx&?+8VW2S2Df)P?U@%Rg3eRggOwg$#ui0|64{a{qT
zSEu?F+)E24`lq(hO?M*bdbBlB*L81zCHcxqbOLZiPiQYD=fM<IR~@1Y$&mBJlZD7D
za>S;lAE~t{YJh(tp7$+U0V}%<Dwztes_ran)b4s5(~N-=sE2XuOMTIJmDeLQech)q
z36Iv5%Fp47;#G&3->l!wo8#-4r23R_ABs)kqO&wakjrlP6P^@{p5MG$89)%tpB)9B
z>`J!twMLX*bRyaStvf-f>;gT!%?#1GTmEx{W-W6oq@;&%9>qtu)@qNW2wG0s0<~kn
zR5}%WsR0<Q*dB+_#SP`-dBv&Yb#8O-8Y)WBi-#>orMAl*<p}Jn1C=Xc$iV|p`+ThN
z$=G<y>z(PYMVaQ1O*8me>_*<Ogf&O6Vs2iSbQ#xLatKGf4BD-F8=ZLPz0RLw>l%{(
zBVfM{v;NBwj+A3#Lw3z|!~$ymL+%S|4jYxN8Fc~5ei#@1fCf6{^RsS^{5&UuB@vk~
zs7dpPnj#S7WMmMvX{;KUXG!+nsyA}aA6M=i_X<PwqWVG2Y=K{|fuGM&xefGf>Eg+k
z@zyZWOzSH+<_Tb0j@+Fd?+hMDknaoeVZZ8h#dCg7vhr7V%apyr8f2kd<V~<Q52={W
z>-Zy4C>qrjX5Qs0?yec=#Mo<i?Y@aO=Zt8K&vV2H&jmzc9^wyTL+_mH>WAmHhlZ4e
z_MB9<o+w^C`YN<?i7Kx5((@2L%wsTJk-ii<pBCIdup-t<5b2U@upNnDe~jzF1_>$m
z=BHpjniFr-jO=aRK8Y30>g#`k-E}B~ZZWX>;p^%=G4QII>JndstUOagnaYt{G_8O~
zOw0XtY|H8R$x!Qyg?JrIY(kSH<(c{SH!C3rUq$X6&q-iT0*loobzG@X%BYq**kOl|
zP{cdMj|w~Ki@xj-vIw-k9`}N`F`@0hOu|nK_UnuPpM9$B(&PD<e;+AA_L^yo{;fy7
zWOkMyQlg8lV<r6H-Okoav<okp+scWDcUC8z9%4WcT9DW5;N|qaMwL9nskr%tuK5$p
zp(EKK;is4fHO96pvL_4dVE>W6@OECfR>s+y@Qk;1h;lsMt*Aw>5xR?0&=rBamaaI?
z9bfoIj@tC)KB|d@M}+#qU*sGw%)E9xnY2C2J7yxu`NlmK*hNlgy$;b35s{*ALsUer
z=v(%+AYr&I`(!3_R<xG~mC^w5apul?KhUyo`PE%&K=Pvu^Y-k(W4lYJl28)_J9&Al
z`>Mws0YzIa>N&+Z%3L%ds3)3lANnLa7%TbcfO~neU$+jt&-*x?Y=W?vT=WFd%?tVB
zcW+ePocpVQJ{Bx@)I0-T(CK^bYWHQzd8W}3h0Mr$Z@gW^+rC8sHT8n0BG2m<l@~vH
zv2C=a<WN3KR{*^zQjK^OrhqJDQh{+ju^_wUnpL^BTfYMe3_3r3eWV!Lu>YS@gM;|S
zRV(W|d|7*5H?NL-*%xGohj#T|iZEeit=lnPg|Q$eFL)UF{^B{m*sX=^p<H;bJ0A=&
z+!Amak6&JkRd6aeBp#_U()wt-*Oq>DQ{HStEM4Sd24$*qt{YI#AICq9Wuwjijr{ds
zr_N%pf)Tx1M~MMndS9%eVcO@6(KV<iUfrd-7z2!x@w8`0UN-CVC)VGk^4e9|o&Gjc
zg%BYm?E@~IZdf=ygfD|>X&b;PZWJ<^j!8Gn8>wiH0Fc1e%U}ST>%qdyOu?4@F3?Bz
zTVqRKmvx**K)wSIFdo$toc3^39)ppL1F=Vs^K1>}p_1ZG8dO*xL06NAHa;S=rS)Qq
zgOT}wRofPS+?FS2R?)h6`T_@seRdDJP!M9rYpq0ll$zPqU-5+?dk}wbV7ZpW_&)wx
z>pAHaoGOoICqjOg<k{%N*Mp~Q4N&y|y-t8<NyE|34htF^F@anVA6xI!NPn1Koap6I
z`2v0miHab%gyETp?@jvr3d8+r2)Ag%N&d-K73*l%76OG^YsKYMGNu$btEUV3piBI#
zH#Mi(qEJ@`LF#iWk`WV-Q~I|et~+n`Y)>2;t`J@%qQI{>i6Ag8<Wko0-TVdIXnkpC
z(HHTp?TZHwYM2Mye2ZNJlg&E3YXx#bwqH;w+K!v&ZqS$NVcs9fR+AFm0rK8c2^cU8
zD!+h_+bN1fJalJ&j7lMpMk%?FLbZqqc`}CR0WD{Dw(RPjq@T1W<{8g!F~ECx*1T${
z6tDJd{kB>kvEBsiq{vkDv+pHV4X}Hmi|Vb1W^^I~%E62C(eBNQ*sxso=}3^*vf@b}
z72R^Z4rZ#dZ%tR=qUc88$xUy%n9cp=PLbWW2+WHfQ2&RsY3#vuXH{;|PMHCwlkG(L
zWYJ4fuwkNK)radZ_Ttt|<g;B_K-a6EzSj5Y2WiWGC~98E{#k#<mXY-6+TU3_^WeQa
zIB7fg#!@ng6eJy{=QkHN__--5fZU9VwMe9BLdcq{p}6fzB=gPLpoflC8c`fyxwPnH
zYvG4WWR^dNM|0b=FmML0$80hea|A&dUvB!QuI!X~HBvVH@IbA*R#Mh~%|j`Y!=gHm
zgwWX|yKpPxrKrHIS(m?1X9r8dOh_IBzI~3~I&5DK)JeT@dC;8GC3Chh3Tr<%Nd|@^
zONnKUwad*Xi=?Vr%~k0s)gbEu!_HnpR*sb<Hv+MVVa3#<#dLLzNcqmwg<D>0mWUt-
z;tTuk4q^xG<Xid`Q_GR9Vck&9JDsSsKdr-m;s=J7sQ~_gps0a+B=g-KCk`XhH#SUq
zX>TQiS+-|@lxOWg(!c>%%3+CoQi+5z1Mg0FbFeE_Dk6~LiGSy<|3?mC$v+8|{z=LF
zJz;}|o{yxbk^BH_-NZk7-v62-`5mp7`hUrU{4<QPe~3(#MMV;6b*?*<+jGsKg09<k
z(1oL|>2%Cmn^{smKHE8RK0ce7lTY>F%d@(Am#wL~I*-HkRVb3DgLWdb0=oKh6%(PI
zNcK_`z@}IC$mVmpsHn~7RKer7jz^o5_Krv?Tzki}gSCN_r}@g^$;kA9h-741chim8
ztA#e-lhJZ8ik24N?^$N9@uzdHuB#hLg*fSY!)c0vB)T8GbJ^1QOiVyT1ZE>3AP7so
zxVRWdX=-X3@SmBP8SqCUVEf7!{Ye8Uo12>hDM&sU!d9YFZ82kFYU=&f<i!gxn~8~u
z*Vml<{K#Y^OQwQ73+@adJb^`mZ@aqU{@43UP_-^0#SuKUBN;>5JfzgH#%M!~-chO%
z_#VEY!TkH3<=`;`;Veef4Gw9dgvbXv|8PoB7IBFzLFeyN{>#ogFCip)z5YkhhVCCk
z+5d-Rzwpzw$M_E))2~9m|Bf>Kj?4cZ6#i?MCiCBgFZXH&IWy8z*ay*kI|Z&`Z5)#F
zc4(;rC5a!9oOdI5kU;Ad@H&b8M_`lZPdf5f3y^sHClLGvC6Pz|_3ZI)nMq>SiUSYY
zGc-Ya&UPZMB^7an=`fuE<mKn^_0L4ao`*=Z=4!(e18zOA$;zoAuRSjF-^nU`r})@U
z=J8{q*@^5%WDEbd=+u8^L@KZ5g4nXja{;yY2RnSoV`*b}(`8F5=9`p5mdHHsZmr)I
z6!fg?vToa|;3ZbF<S6in7>!WYe!q3UrUa{<CK<&pSU;4^l*i4(hM8uI$RN$}4zGTh
z-)AB6g7W;^$;M51)h>XV9RH3U7wXNM74}!AJPKu-QeivzpKA9cw<qxraImSfIGmPI
zo>MJWk=MBNEyUMhyE0D&M&_y<-Cc_)>*n{MM61kt=jDS<6j;_?pGeUj^dMn@v>jR5
zW#Cd>ulLBua_Pn9Yz*p-H1C@oa^Ed2VCGrRV-r~cqd7fUsdB+chWKc!=}3_VeOufj
z+ihv5S7cV!fQ~s4;*E%TS+1AE^JaeU%W+Yi@7ZkYAXh+zz8jpxeT%l8t!VmTL5!*)
zeJ8M7iyNmUCOTAMN~fE(p}DM)bhVbD4UE19sTaji5fX3Ai%f9`d}iP`ZUG6@e1#hI
zWT9v;5QR9Kfih){6M(3~1X~()bv%SXWf$$L37o#yj&^5;*m0;1Ubje_M56AX4e*!r
z2e-dIP3s0W-YceQ!fRMV%^|(DmW_KEqiz+X9q?sM7Do5ra(x1+5QN0c|9vqd2$hr;
zM1={%TmNqLA^O2r)1q&f-MSDAjYE|vLW0*#m^_ax*$u>AW7Zq)$~}I~+n{<$jPCfA
z+5qJLQW#au{XQu#aC%UV0!tp$LGLGc+n{fjXc1O>m8RA0svoxNeEi5saS|+yhDpJ>
zYh~`UM7@;2Z!lU-wD`r~T%YbN!07TYAli6s=fhsu{S%Wk8Gt@xqc41t_l~HJv5tyS
ziNMW#_qhp>vLN`WP528bCwV)D9!eJx&q0&*n*kw`+Ar<}Em!Ld-}I)ak@cW4zjW>{
zH03&2IPEm%cPhlf&%MpsuT%i`xUoiEw%gxGo09$hEBA#Jxtd$~E#F%Q56xA<VBE3o
zMjz#BJnyXRhOiZ{bJ(Q`dlM0g(eb^9Bt3iU9=l63HYM{Av{~eMle25jI#5(q%X~q8
ze@7Aho7Y8@%L+X=RHR^9(QauMJi}-km{W>(co<*jS@l<o^7h1qoJ53dAfS=vk*f>-
zw#&;Na8Gjn!>)k4e79|zK1(N}{2OEWM|Q?P^E|wtz(%Jdy2i^FmO2&d+!lq(MA&=}
z!l{)Jm*%>*_g|z@#NZ|xe`vB|6z-H=Y#qUEq;yS69AvcfbmS(N;LDPb1{P7#y8BRY
z+Bm(@j0N^0m-x4Iy%>2Ds6(>BMq~B-e$A{UA@H~lNW=c&Fx<OFzXy8roLeX+8PL5=
zJ7)8^!nO*XonGa*-SXuloR&=@ASOxNqJubbg7l6UYct<geJK3-KAy`2-7Gww)T;S5
zgzSNp7t6hbcXR;LD!4%E(w(l6VpWXhzs`nk*}d6`>>yNl8eTL<YK46)wF^yF9dsOV
zUNSP|Pw^hMyD%h4(wT;h&Ia9+kFX073UL{da&Z;jd{J*Su84ltAIW_beK};DMcXnF
z6KX`q>Qo>Q>q}qx+P*1=4C*6d7?<!q(n<x#JSqaIkk;Nl;ur<9E<j2d%alcO(YT8E
zO--OlcUYUa)!(P{7Nv|I&#14)?vDrDwW++_V`d>w<<UeSrFGM$rWmCV#gqh~PxGhO
z_@B)WhsVn>X<AYnE9oc|tfTp288a<<<rgSzOjrC3gMkg98w-SSLB6%j-Tj95C@K4V
z@;!x=<C*<R(Fk#)9(mqSFMH!hFc>)`ocZQU6XhuCFuvs0<J+u9ZC@MnV9zgyR=baY
z0VkKa9odyS?50LXStdf{MEb6H??2$Y9Z%}VJYW<|#XMdxA#c?3k2pe|c^rk}I$)w#
zkOd7tV6OLnr}BbkSFC<l=dM00U_scDX-qf{LlLR5z)924V9#mKl)wP|IG71nJTls2
zVJBzgD=tS$F=4p)%r{sfrO3`~^k#|u>3vS?o{#xOj3J9Prv<%jO-5ZUpf$(Ck@Cq$
zE|qCxCmZi0g{j-$b8ownLl&RGzx)f!f+;Ckms(@ZfLo`VjkaFl3`Y-0g+0)HSf{TR
z*|5~7O}G+xk|nDu9#F|~^d{NKBM$E2Kf2v_x8hP{#Kco$*t-M=xs>A!nOAKtF1co1
z60RKvQUZmIa8)1B?Pf9F=E{><M&?l&{~fgZk08dFJIC1oLk9}HzuX^dbcM4uCuSr3
zkS25bPUbY`w_>VWD`vx-!<Ly0iTBG<WiSR}O>K{C=cufaMdVv>J7S54!hqusoaByP
zS~~$|!8x~dru&|`%?WMLlx~@_NtE*u`x}#Qa$x~d#>v*|v8<nb_NByqe*aU(#I)kr
zup>NBobOp!3l`byS-hG{5$=_WJBc#7f!6OMv=gAnW&6Kl@c#*H`w_k;5iVZR4hx$g
zy^R_c#S_2uxq73{exJcc$8PydLl2^PtG+C<iVqoD`cAw^B1?Lp=vuueNm8>H3QI%M
zH@2VZ7&Cl<)4mNut1C(Roz)wWs-xQBU0P)eQ{jznYO`4W0aeC9tcw4w-penV1*uMA
z{2Mp^T?Sa^bXK3hcLQtj{{J%b@SkS}{-<s(!csc1jAE6~gl1;})4V?v`l~d??~LS3
zX-jvKFV*}>i4m`}*~R<dn3a##8}?STZ`@22q{-MNrqrJduY<F?F^pynWbq4MM`f=~
z*Wc(FVxs3$zypGG3FM+jA)y&`$`><>+mt~wzQ==fT9O@ibrY`5o-HOT;YbpZUQejx
z3UYxt<!He7s6i=T#+J!!fu|R#rKaD9$sUxlvb3OSI|5hGh<H&HA~J|=s-}5cWUNyr
zbHR(rgMd@6p{HR?Jw=BMt;;k`4hZ?n>}Z9S#uyjK;}UhK>8DkT^=&M1BAyVF&q0|w
zxh&hCg$hqMM@bePhvB3h#*RV8mLMik))CdczDXlGF4S3uCCU;$_iFk}KYW`q+K?ew
z8qDC$)7;|ky@9{Dw1Q<O%O_=O4LyA@nxp@qfo_Yj-u^DroU)yhgY?Q#EdN^o>H{;a
zi!)IKMYNhBV|mG!U)jm4&B&6a-_t{PLgA#F<C0^O0m=>?Q$woZ-$IBA&QN<CC>nGu
z)HF2%*1xhHw5UnXk~d?NR%@6fKjfC@u_ZF58qBC{39$kNpS?gokQ`<n!XnP3<15h@
zZq75>L#5YAZpfr4Bv%<iGu35o(D+(N2E#2aAsi(%Wn?b*m9hpZy9$`UYHCKYo>h0^
z(afwWqD(arbRe=tFU5lgcn`|ysA{OcUW!rRc7AApEH@9El(6Y0R8>e)d#?B7%u*&Y
zBIQGde9+<H+mIT|oKi-1W^we#T|{r8dK0rO_2%|xJ|c`$WU5zZgdvtmN{6jy=LRE|
z_g`9yH%g)0a-U_kZf}-c)3#a;F4gLT(QAkoZ^{@;3KBF+zV53kO(K8#vd5AjF*@1J
zoqaMfnyD_}u2cdr5a^7nLrOL{B|W#A<j@2@#V~cIP~E^<5z<iwUf{EXVnqmbo^p7I
zo39z%pMKcbBLZsu7z$ul)116hs31tw=*O$$#HX=*xNqk6Tn#t42;i}Q<kYI9k?Xd%
z`54&5BCA-7Pa2PfO_*C?4u7RCdG_wEK50ej0gRU=#W=Fsb=rWgi;J$`!;=RoIU7(P
zx@=#nhLWo33oON$?bk4&QrX)yMPC;%$-DZLrI^cb+1IH0^ax)iO-S;&H8X+9+Yk&k
z!pU?QpNIyBCbzTOD(UeV(N^W^vDSnuTp63<y848V$6UH!f*jCEi!D{hXM!m!caceB
zgR>H{w|O!Y^IqvlM&t*R55#u49UKroBopkesj|iumjRcrtBHfnEQ)%Ox;GrH4Zb%)
zf+r>QIE89xJX?uF8i8CW?}K_pLOpUZFrK5W_bRB3&IEid8h6`WpiXNk6JsV+=vWH9
zcoI=qoJ%^8F4Ep18@boeKr&lF*`4#Eke<GadPB;35>u!S@z(%Q3%ym4v%(v2x~UbP
z5M^u=_-xD{8Uo;d4<+OJ+O;s~n^<6BC8_I8AJS(Do8q9WZs-Bio7<LrL@tc7+iANO
zH(o0~L>pM~g}TB!(MZkYrjb>m@n|PTH{COr=&hVBH}xv~HC@L=o(>}Wz%<DzTJZ;j
z$cn$NmXC2>_){Ak;-yTJ;*OtKzt-CzB|RNw74O^cxT9?q`KB4SdoL^uYh&G}twSGO
zd;N{SV5zm6Gbf-gF>rB#_FJv*CTM6jKo-DjFcjGuS(if`r#beU_}&Np<l7UErJW9Y
z6yJUJCQ5)(iV0Hyc{0RD>#_JJ%0H%l1!ne(og0_z?aQqDlU9CGU;GSZoH#FU%Vwi>
zFYOr4(w-0~YsYkE?{$G1Mehg*B_@4}Z`c#iJP9zI4i~u7qBtEiYd?3Vr<FC#{3bzN
z%r@!(cBHuHy@VN1VCUS1S{cQwvNZ;EA)#oOteYOgIx~~ecUpre3h;=k3_uyed5=rl
z6o(eY5PxAcfSI!!P&xPqeT?mucc=AP4(^z%I&9rJn)i4WD<8VIrzg7UHbN6rcU5M_
zxa%afS@<wBH}jHm$lEKbVxRii!D}q@J*)YLC(x3PW#xwpsF{|{!4sV|a{L#h2M=+0
zK{A73(sC`@fh}ncR#^K|D^SmsCr_e<r*Ev%<JFB=c+9$3V-ro4d?;0B?OrnwJ0qB!
zW4qJa_)2+whJd~s*X~u<x?<D;cGkdd%?c^LK58~zZ=Pqjo(M%~N9|H|9A!39B;VQM
z_*4D&r^@%vy7BebZt(Xz$inuO?{G==hN{7LeBUV5W;{~tPOG?gXAixr?40$HDwDP=
zNpz?c9%L7#{`JcKGYAoQ*ecqgkaQ>nQ*IaY<5AaaUbw~~e{1a>GoUMadNw#4tnJXu
z+E8P(NRDRZ_3$2V?hd_@?J=_zhW4xa7G2d$npF*VRJ90Tx6lcJ!<5u`MBm2JVrmuP
zz;xlA*yYjp1S}Q7AA*N$DnP<lh@<TbrXt6I<rC3p(9VU3=<Iyn!&*+h;3Vngkcw`G
z0!Hy*MLL}%T{ihJvSK6cCm;0h>e+Q<;1fuTNn4rV-MyQ%o!7YLpEv0};7B@^!P`4B
z^S1cYvBn|O`}2dx`MB5`UhD2@PaTc!rGK9N7;ZL8y#3|9h!=`zy0@R@$>WYPqR$Lo
zedEdC<@cRR5D;@d9}Cph^M*|RJ+0Q*fPK$9k+Vwj#sFpKxuY@8Bb$=|DhEnKzPR_s
z@^?4D%xxpZBEFXlHi$D^39Vea{LYfO{I`LtM~@J+5ElR(PU2+9L0rf#BIOiBwNE5f
zVSheAN5L<n<{!aZO6+9*lyr-~;o$^;KXeUqxw~~d!m|KZQiJXN4OkA*s8O}xyPEh)
zh&RD|(UqZztrvC~$we2pvoviOjx#CqJCvulxQQS{GDe2jpKtJObr!OuRL1#^Zw&H*
zR;fZSC*8h@%pTcT3FA0D;N$FqP#s&@96FB5+xH55m40A%T-f%s<oWbYEKzOTJKJIR
zjM`z#LRx0FD0fTT;e$=eJ=hh?Oj_S%mQz;ZgQt^^b-JBruHu!}{E<_)+36~nolu`4
zJMCKvRq&m;-s*f!kC6cbhq$u~%k1{5tUhySQR_h4#Qhg#f_`PC_k0)QnL^haES|FT
zYYHD%XED1`JlN(oT33%uo~n104`HMByDQPum;=X`XmVxHaC+N!!o(0lub6;b3iK%?
zH4ye3iW`2GPF5jI!{mTx83R?wZ+YnQ`6}$C<LjWXu=_L;^qetwTi<$dxZ*|zEV#>}
z>q^|3bg1Zky418X$)kxjU<7T-fQ=VPv4!6^KjIbv#wzKiPeCs&U?{Z0*g3XACbH4!
z0&M&Jy<2+bgBJJszD#bM>@KsTV?}z|D=SJ6aeBKv5(SMGTMImHc^FmBo8FN}$Qk>l
z;pF1<kuX%JjPmnBV7TJj)!H``sc+-Bxz*nZhrQd9=C9Jn#^q{%6n>igmd6&;)k?W2
zV%uPQK5r4wU~=F!au|F^_hT3W%jo!J=>+Mbp(YFH%r>`5(YrOE`emrjUY<(<mJVg>
zGbdrK0oQ~)yasbtKvEUvK}rNbI?=`dynuZo6!D2?W!#B_pHm8g_)BuilY->MplsWh
z{?M%AYQHVTj!F9>(nJqY$xAlMRcljmxN>j5?>a%?nk_S(3;5Aq=YY^TIk}U%?whtL
zJ4k}Hpq%pD^KX$92F}_9jo&Dj$hUKagah8*KuS=<jo+z|Ip<!DmR+ifZUdRI2|HJE
ztju0Y-M!HkZPnA%y==xiAje|c_N5WtYtmMN;swbG>J7ozzOqlyXI|xEHX_rq>_5Q9
zDp+1)3IlZ|Qh5hJ<oFfaJJ83$ny**)*JKTI^uSM$e4E#TRlBQR+oOfNF0S^z{#U&E
zBV#h+OBf;-CJa97o{!JY>?Cfje(OoOgI~tW@n}YQE;Ospr(-)~+&Yun8C!hX!JLab
zw$+Ta*acujx}EuLP~e64840HEs2Ssv&?&PZQBaYwRc~SYT7|0f3jpTVk9H+ZO3fgo
z@OV~#-e*PqTlpO!J%i$k9kkne!o9B4`{?stZ<5%Yt@{Z#v310rXx5uKz3ChZZ_W?L
zoTfRU;g-L&d8DQvCHEnaic9dm-|p^v$2;h%UFm&Evx#nBZD?J+?{g(yw9{6i^iAAh
z&u`dPZVdnYK-z1Ese!V<GC#tQN6p>sRwdx_6KgZ?kP<>2Hfp_-b>xAHmmY|e>kjX+
z$?Y>yFRxs-E82N^uJ2N==Qm%Yr!$pYAJq`7ArCR&o%<rzYp+063p-k%>w^OHW$saE
zJP3Mo<eE2tO((<>r+O$tR6H+E1=&>j7B2INflG6lwxSjLOK3T+`e;$ti4H7R$)0=2
zbZy0lKwshxwV&I79E{%2ZRbf5{7iIL2j(AIaiA^1m!4<rbV3lO%_I+$+&y09utY#?
zRxUnkClrYu2vz}QI5a5@CpQ^!5`|Zma4my^$7M*vMY_b$+^3D7r|NJEaKfwc^s`wS
zZi2CJX-xKXmK>WmT!p(X7P#l7KSmc<x>Lf4w^I$aDh^k8&9h?#_>bmU8f0W<)+5gZ
zbe=%U@W;+~8L#$Rji3+GIYnuLJ!g%V`(~_Htn_7^#)JpDA2hP1AA)Qb>|QpSnZ!WP
z?x$ljx6+<R%<XHd=!?L>it@}{;Wm$kdZURU7kp`%!#aKJv1|<<uovM+)j+epm@gM`
zq5=|OhRox~<%`9po{Yndqat4Avxn-iYN43)Z<NL3mR}~4L&{v7KT$vV68N07E@Zy9
znp15#Yun->bvldD>e|E24oU4I75py%d7YQ5aE4pq7Y#<#p-am9BSrZw4FN7Y1f$WE
z4=b16)UuGIj?rTsHXBMM@;Y-wtt4+999s+&TF*2S7ddDP?=WlT5EyHWD?ylj3ksB0
z5=67-xzq>xhb`YqvCm6vH@kSuYTD$McZt%Zg_Mano66cfOTX`wCn{JrvYW%`I~twb
zUChZ@P};_8AnQu6(R?NN&50-gbqX2|9|~a;bO{ttNsc%mG?Xfhpmqp8qa+@6FLtcb
zT&<wFA5fL7#D8A>x)R{s$zk-mg?ht<OSqgspDpp8r7TJ?EHpTxRjzn4pja#UXfkwo
z;zQ?Ua`4<Pvp}V$lST!f9j_xVdG2SEuG!VR#zS0iNYK(M7w$WLa$*aN$p#C0(NxB+
zndy9yTWklTiIWWu^n%JWT|*lgS4+wlUrQde=G{v?3#&_;GjQytp^3q8pIV@R@ziJa
z8Exei?-6+#(P-a;_z*RQ0`r3_HkG{U86zA``Q(9wuja?d(@0t2mNrpUv>^rIBzld{
zecw+@Y&0)Ji1c~Mhz_44=Gfz?K5Gn*9<C+<^UByrF_xe6izYlBP1Wvyf#oc16^Uig
z6ZsgPbeJ|iZAB!YTlBcm6&thNMSW(7L%><>=bR<`W6qk3&$5)#y?wbv0xoys<z=-S
ziE56Ic}=^iqP&<mGw*KYVZBLo3DsdUF{?m`2|NgK(r)fd7_xo20+m0Uxq61Ps-Iox
zS%No=HRb-yYtr$_4u)PfDs00>-A?HecJ=Mvx}P3*qCTDA)?aAql}tt8faz&YLs{2D
zmdBmg2jTI0w(JcHr?2AIlg;?+Afo3_!PKi3^Z}Gy09QY}rZ2ZmUCX0VQ{>jyHr6jj
z(cQ=4LrM8<lsY>g>iq?94DO2<*Tx%Nucp?z;YNoYQ(hg^g4La7@+wd0PHQWlRZXgy
zK{NW~zKmiLXw(c9E1S5P-}SVlH&X_v+iq*E@`jbJ@jlMC*&Ts(Wz@)wFT9%qv0LMo
zMWrQ4^s-O!z%y*kwS^HLZC}DQk!4I)^%Gu%45TBA27M6DIU3)AW;C`Ha?w{ku0r4r
zniZ}N^$01Du^w1jdSV|fZhC!+&wfkyfFU-)**_`ILjl5`Rab<aKLsr%d}+fqD(y}l
z7WsgKE4{Iws9Mz7>o7&KJbOWkAs9WFF4x4aFbglVFrMu3^OT08JC%xC##T;=weWTO
zLnBM3)sHZ8h2&2M4Nyud&(Efw3NRRpGSOVu!n4(vd|Avr%VO#`(a|`&nM*s?o!o)>
zrLfWA;n3zwJU~SLdt2L^Z`Xxu-=x;1Ou^Zzm0Zz|%Twrhn9}@Kp0H^NwQa)pN*2F3
zk-EFB5p;!8x`!Yu3&5sF$0=}o1Y<f%W$p>P>@4lCyD8tR&INSKO?1tja4Q4mva@wP
zQ)|)^{S%5d$c4QUdKqY40&BFJl_>gxtD6Iu^DE@08Y53mZsVl2h+7xSr~1|qUrvm4
zc7mlIq-U?R;~i~I$$l-QSr=fnpfa{}dfxb6_lZzp-4m$K?W0Xay8R35q)}d%jfwUH
zBIh*J!+rO!cRgKpsOg#0d!fo!v$Mq0&Uzx?uu#H&3((Y&K6e6Plyg;(hwpQWt`Ezi
zpJP*9eFJc;Es))u=;5{b<|WhK`kS7VCLl7;m?GaNYlhYYRF*MopnkrQv+cs6#Xh@O
z2-_sN9Nk-Cd;E5C{f&}#!*n6PYs&I^QZ*T{6*C)FkYB`@xETxCmD(DZm<)d37k1Ti
z3t19mvUG01W~*UE?<?3i@T}ymiB#fU<fJsGsP2SLJtsItwS`H<a-WUOW)qKtWDdX2
zRi<{WjNNGbo7hcXNpx&)9`W03bI@F!O0(uiwtGAtveJi#@80fDjdWVKW`|P^=dpS0
z)WG{s8XvZ>md`ocXN9#EFHL{T>K^JXPh*JK389@3jarDhD*=>8%B&P~+8B@bJ}PZW
zy1%?r!2i|_5Sad?iMD1g0bn{tx3qy1+QNBN7GfJ(`!VTBlk2mTC&0$OC9<WB?T|Dl
z#B-<43r(3?v-KsoKH+@Ao~x#pZWT`{L-P1`1;2O`Z3RQDR%j{Tm)w^j_n=~l(gVJ)
zFQvd&OkArd?-*Dkn`SvqSl{$RE)M4>FD_lLUx44;rBqt!#Jfw)aVaUE(5Sq`fWWkT
zF+7C8GG-+JD$Faw9*O1Y2xRSH2q}-T%4*VyIh}$g!>qjkFP6E$1QRAp#VpB;Eg_ts
zJ&hP80+96E@{@<xCudn@ojmOQ{R3*|)Cep0CNynXs^m|;-x5+0yj0A%PY9x)l-kpX
zyZ+BfDOd={&iIr*S#@KN#YW=g7j^{nbRS^;(p^SUGWMr0VfNjZuzd*$VxXsY&*MNQ
zvLupli5O2+t>Fi+gumTW88}#rLEyqfL~q>iAs2{~)}OtnQlA^I_w#x6X^_urq%bIh
z`O;P0latp!udq;>CR&aTu@c5!+f-O?n^j-m$%U_u^jz*Pfs~LI`eR&{5?`fuiIWqt
zx$RDz936fS!YB;NHo&cWjW~i_{eLv>dSLk>uN{@8c>Ux1p2QRMA2<H77sMp~!{q-s
zfrI|~aekh8hdS>zQ^Vi(KE~ZgHucB<Ay0pUe?3Y3zVOr6|L&$Yc0n{v$)V>YFTj5x
OH+gAgsWJ(J*Z%`oqM*D0

literal 0
HcmV?d00001

diff --git a/docs/dev/pictures/dds_security_plugin_components.png b/docs/dev/pictures/dds_security_plugin_components.png
new file mode 100644
index 0000000000000000000000000000000000000000..cfcd6921257ef0d2a15c03e4e1cf6cb3f92b5519
GIT binary patch
literal 241869
zcmV+KKoGx)P)<h;3K|Lk000e1NJLTq00Vje00Tk@1^@s7M}3Yi00001b5ch_0Itp)
z=>Px#1ZP1_K>z@;j|==^1poj532;bRa{vGr5dZ)e5dq33^FIIp|D{PpK~#8N>|F(1
z6i*vIyE{I+6}!9pZ+Bvg-K~g$irwAair7jCNQZQaU?&P9C@OmQeDBQd;eiLz9I(&t
z_pq~b$L;RC^UV9s?Cy*NBGNTP1EzC`22AHrD+5X-l4NIOWTf!xa-6_=9FeVw#zV5z
zI3QbreKKwAmMy_f*+OiW&BGSi9Bh)!#0J?ktdma08tFu=mX5;;>1ZsMj>IzQFf5i1
z!9wXk+`fHVI6~?|Z49VURpYOMJuK73LD@<w*yY$GTS^7HhzfQ-wkj2@9u@3bsTTAw
z32QJ8I#Nw4*x^_r6m0fl(J%2R*8X*zgcz{z;nrC6{ci(q-?3LXLh2&J7;v?0JO=BO
zM=ysVSdJ0+U)5Y#gu%&fz!gusqS)vrScPF&Nx$F2x)+A;tSlNZ$p(~;$4cp#6jxwu
zO{i!<(SV6Ux-sBhEK6|%F18ts#m*Bj-)SN?{+tipuvz>#lP&sT#dj_G&xu%v38Dd2
zAvOaJv|NbFk|H<&9dw;h6FV^<+b{<smR3iu@<p))TBx_RCnoICNRj~$Vl{H+&5r-o
zE`^*0@}gpo1}Iv)JPNj}gDlyyp#9C^7#BDWZ8vlj4X6r9X+qb@CW%dGT0@lq%MI#-
z?Oww%a8oA?x-b+I);Gc?EW||HaiqN2*o>Ljh$-lIp*I!;kHxY#{o-vv)<-;r4Sai?
z@(R=T82xsqjXjWu(mN<!S8o7DEUSWE_7mt>(;&%Gns--P>owv3$0AXQB(G>d29*Zv
z*Bb>(7w3f~k(9>%UsJI17pddR7*fV84AZVb2AzybvpNU`I$l&@TA@aj8h;gRvP7Z9
zqhI356dH-yci^aSgw%!F7_ev0o?Jz49*>iqG4cLGaH7f1@$=_!m7k>r;$^_?rq6{G
z@X*Q@dyXCE=?CTy5%TjZPbUS}uU{8Z=>wxijl%i!=Y_qrh1w`ko#6lUIi5Uw&C{>n
zeL-kM^Z{`Oe}8`=m9|JT1G1(_9kF_{7D|;Z#nWD&BC&keE-W|j!-iY#n6>#1&sX5_
z<G-8d)JCe8Vt9DCkP?v`_@@D%J(T^$Kr<NvOl0skl;QDR8T@X^;B#FD?`tx6UXj7$
zq7-iDq;Negh4Tq19vzj!@sJb_`=zkkBZciwsqpI}l8Pi5@R^Ae&y9hWm8+q9hjH+}
z1yruo0ryv&h4*D(@6Mm_x&SO+{vKv)@4@j1P`}}HZorVwUxXv5CsbXxf=?}kGBB0l
ziLp?T?@>j*BZDui%r~eq8_3|LFI4DDGPqw5D)kvDTuuoU`<N6?M}*3KKnnYPLIvMN
zdAo%Z`3I6@z$ZrJ2S|Ydcgd-f@%(RspRgAhZ_kc!u0WTQGPs=p4zKwbO@W!kfPR-l
z;ByryT)qpklHd2B3f-oBSKL{!3GOF>S+fIRehe5n?h%|0M8aY((5(5M)G=UEn$XN*
zKpz7NhDd>rE&(g18so<PFj67laPT#H4m05jyg26y=4xJt^T7yMZt{b}Zdv*<psTAZ
z->Mr_UAKZ6q6r;2*BZX(%wa+`Orv;XJfUWE^`=j_y>v64Q*-*7_WRXn8mj?WH)8zw
z@qEiTbLPybu7&cpU%!4)-&wV4mCEnDc=00YI|?d3i@8;%A}{8aQPp)Tm|=Wi><T2m
zcTSdRn$RZ{$OTY5P^>EXw$;0FXq^>u7ia{})9$dPcpy){YUoh0HuQQAPkRFzEYXQF
zVAT>;q8ZRj2x1gXXpsUMnZkey1qR#$SKu=;X5ek|eWXC&t5hzeKyRX2D3CQTudZ34
zVW0gx?SIA;R%b(TbIBSqCUp~9AI7{6&EZZ?TO!E~=Tj`wdXgy&7_$kzy2(~$6KcQz
zg}OJP@eg9u6{@aVL4^TlG^&moEjQt*3Gkd$SE4kF1xRTW1LP{&4&J0dR>@Bs{z}_&
znBTq;dXBS)(c;aiXF!EhPi{`1K0`QydP0@q6iin^OiE+-?!V8pTa^l^Sg|RkKB3hD
z18S11@_hd=zDY3{7*I$pAWyEm=-*XSHM?k{A7f`?Cr$M2sEIy|9f<8U(Yqb7t(?8u
z5L?UHvlX$WoIRQgY^I6-nrfmuV-sRyO>`r&N**7ixd9a@P@n+c1_lQ5ZE7GOAOPm(
z=E7e3gxVO;($bP|nIT!hiijW7#()f-o{sSFaEL}XH#@kx+QP-f8jl`X!pX@34i4t9
zw|@XzTNBvW7{l7ykSf4EJbZYU6m=VBX18E!dIKgV2FRK<D{|z>Asj)D`#!;tJ~O6f
zDl3YX*1)f~&cY|@4;kKo9$vBBIhTILz5DlJ?UH;qWy_W=E2L5n>Tf^~%A@?2BUa$l
zj#*fL;2?68>I^Hxvv7Q5hB`G`plj_)(3{XLVFt_~NEZrpCnGWiI=k3%1-g6KMN^=?
zt#QH?m_eZS2DEYh(}dbl6YBEFRAm!tZgc^bR`=AxfE_w?5K<`*wKiapoDy8OHALqg
zqu}Lf2vau)-aqPFzZl%zY)~XuHaI$)P+k!jU04GLm-}enzPqTvv_h%|F-e5$<u&v-
z1RE`$;ya~E<*CK<FS&*CZE8WS4EW>657^i{|C83XPAc<NQB<Isph%G-LJH{BtCx@x
zq4ox3s$}TVqX*wAprfNBq*UYV*|S0_V<X)tP$rWJDd78e=5^8!9zJ|1q>>-$#(*MJ
zBV8IWy(usykuD9W+?>V*Pft%Fr5?C<@1BrKKBTGv-#Y*wl=#jTcw-5?G6P;11JCZu
z9|n4206e}5_+A9ODHicO1$Z0-+z!frN1?zHMN3EfJ!QVPqu;jy-dfQy$OXMNr{g@J
z;|PyGJfpIFdIt!&Nyobm_+OJB)9<qUxIX9Q$M!l+$3H1QzWZVMIk@iUhffp~_dSyf
zu^RBsb!!|rb{bxGhFCGS1CAa%AbgT|C_k34WyxXwSOR+_fj^FLi+JM~T&WP*Gc~KV
z4#Mo%Z~oYU<6$Wdtoi`E-BLVq@r*Lyfi+j6{iZUXn#&OQK>qB`6C)Y??+efG+?K)j
zrVKs?GXBiU>Zw=%dgNj6%xl6U4>D|;Weq3cc^><{bS`^j{Fxpv@5J>l=gyrgq>=}J
z8Su*f69{xLK<#qXAdzH2c8LTbzD9fq%i2F_qYTOg{EE~uV&EK{9yc0KZ+OFw)KIH%
zA9#@g*}DW@mjD;4{q>vdgZt57JffQ4uy9*$Kn0R)KvG?x!4Hh=J_99NZ$OjEP2oxE
zvnIuR9e;<Lb2h>4IAF8(CY(rt!)tYc^WF&T(T#}JfPQ{{@bK`6Mt662xVgE(#l;2A
z&dzXha)P6yBkb+%VP|It8yg!~TU+y++ALyaPYIZrnc=~M2QV=)fw8eM`uFcI93eVV
zwF!+`$T1bjo^11_=1lQa8+-VNDbV?dO#Vchpg;wZLxHh9bmVyk(H}Yz6v)mYE(QAf
z`lg5h7cN{V93eW?&VXK5|2&qcFd%C}Q`>-lJvA1G0iQj4#<y&+A$9}0!`;IZCJwF`
zH=sF+7s!FV`VY{$R&g?>6RKBjfl<qMV8P@i>BoRiEhvB>0|wp=jWXaWz1JyhKvIcd
zKuN(ai8i2*@1N&(-oAY+q~cZ}GoYKR3k=R2;ws#H<Q%Ec0k(nyO|7h9Yj2l64EXf6
z2RGor#V!aq{}68}LX^~;g-3huV&CpCZ0V<k#}|L$4jC`W2BZi#&`^egC2Jvoe65cu
zFsoxz1m2=!mK_d1{ogzit=D#Eq7<kMg#p=vSuqXh<LwdEgnD{<{MCfo*xE&FLLZuo
zO=zk#p~_GguwupXkYvq;051m=q5#m>%L_HzEk%bO6OpeFn|(?Hj%3X31`km>kA#}h
zhgdMW1FF@iigFD{pi^-PChgWo&iqATqMil>iWMx39CUG&%GZV;DMPDK6Dn9BTmB9h
zIarVP$Ewv?iW>FjCyN1}8v-?p7KQssM;tly10BlbfagII?A#oLS^srURs$+CLk2Nz
zn{>vcuD$S-3b|RkDcm<5pSKx4`asS?Jz=<#`k>UAZcw!cZf<>%ECy`bxI0XC8sRA!
z^2E_dXi(+xJnn`bBhEsbDo=74kaZ*22#_)rMr1FuG9x~E^oScVAqK2esgiJn=n$LG
zWNtzkq*7@V8CtYx!MDo!iJ>Z_ssR~1ydEc+3aG0AW8z=;E|Y>(H(+w&-v-1#4S0Op
zQzZjJr2)4rwoQ})vuDpPq*4wU!hkQW|1{70^v+}TjwkTCY>hxm;KuT$@Va7$Gy9)#
z13tYSj1KKa;K}6xZonCH&Eb3b7d)xi?%7orhj)Z<1Fl)~hJu|ixE_zhe}lFqNr5Se
z46eW!Q7H8X6$)f?+ORtjiYC<eDpIToO-Ur$fbo5QEhVAKfG;d%cxA;D3EVRH4bR)5
z@VONRKMItX0@-We0Tl73rVmU>B+3fix^)v$X$#c`1UByUz=)BHxe@1$p3D`<W|45G
zzNXoZb17oLWy_WcsnkW30oj{1<;s;)$@1mPM`MKw75>VLi^`8coW{l&(;ctkQ!2Bm
zj(5lwL`|o>UOH8nN|{Y@JPO*<5quiu1=0b+FD1MQO{pkUS65d^B|lC%yvO<}{o&)|
z19zL-2#N7DLX-h5EG+(_qC;tFY8us{G&D5C{rmTE_wHTXxpRlF+I92hP29L~gTJDD
z?b<cy>+9pnl`FV>`7$nEyohGanh8f?tB2{u+km+X=i~-#d#z720|q{Q$$yI(@QuY6
z^cuV{%5b4Bz$g1}2(kk=p#8y9&_DkbQ+jmd1~k4LiRA;j;PEX$d$k`0Fv0M<1`M5e
z89o=uCte_)4ujSVYg}Hm1D+><U3y>OdFTt=j{t4{TN%xOtmB@RNSFalOrs2FWOyHW
z>kdd!12P4!!#K>dZi)H9gHdKw!@mruth#74kHD3E7Euap-*F@^?zG?vT-vvbN(GJ?
zb29z<z*r4vPHD3Turj~N4f)^FgD^2V#|@afc0V-HXv&S&u~xMdF`%j@lo^nzzjEcu
zSTspbHMR7xaH1X-OdyUYj?=^ZvBWWY<QMfYSCcqW4|7K7VfJw1Fg?r~N*tnxnS+Ug
z^e|%}aeyAC_tV3)zQjIynA)4Rz1Ncgp9oi!wn)<^^cdEvG~iau<_263wjxXH222aQ
zd-qOA$+6?mDIt|Mh+#lWm|Z`C0TX86(*8BDva^7t@ilHh_H2x`wGDKp4uzqSG42}~
zV%xdfxPR{+hE^*{-HIH@SE3sFwXcV1LpnhJ;3~cXN^AyXtEF&5VhuWUEr>nP#>BvR
zSaQ7u@1k%YShNuG=8`~%no*V)(+8$Cp4%J4<(_;7e?)wcZ&Mk6DX>)4CYZkY5|&IF
z0DDI=sG$KjV4iI933~JvPUHr>M@qbN_a1KCxr?FI|3{zY!r(5=aP8(T{=fQ%R-sVV
z*bS&4Q{X`|QDU0V)Wne^6v3z=Ql$xP-aPqzpa?ml49LJ7b3%FM>_wINF{!|R-T$NJ
zIA;`d{KZ_+m@^u4BS)58Y3c*j4bcpkSR~i5TDEN2gp`Q*BFQD6J9lm&l{`3e=8TYv
z8!4&4J$v>DDfLJ4NGBQb`}c1l6*t5tR1UQ>V0@7hcSGL4e=nrc4@3i|bBLvo&XK7V
z7!nd9q|z^vPzvF|uUEM26N-AB*TD2yIP^U~|MTtHLlYXIL9q&y`i1&EH{sy4&S3LU
zT=)CTKTj<*Y}imprEjE&0<&bvBBW9dNl~DemzR)A|46q@s0cYy%z$&|%n?#412GDf
zBi)ul^XAQkROUvq7?6#gB$U5?{o;&_jO6_J^CzEHi;+D9#TXG0!TIgmH_oqLzjCr=
zTp7c{!tmwG7tYYoP|nYvKXbAOlQB3rnDf)8Px$!pBWF-h5a)*vA2?YDo{`<GWn?dG
zzIpS8^Y!c3oUdNJ;(Ym1z3zmhnF3j~%BXm8BQ~S{%do19s>-nJcT^cQreWD{#b#86
zVf`Mb-qHyFLZ&ca*thS0RQW9eT8(OA>7e>JW&a8}a@FDf^u{_(=(Nz_hJEqrGlD(_
z<MT&9lrNA48ojh}d+kUV`@ZAf6%9y8Z3Qv|`dHt<3s)1B3cPOb7p-ZHslZP`Z$t$u
zBP|Tb6liy574lW>jIZIL_(I?N6!L{H#P#{TH+Ecepzj591K#u|Bhr=`@BPOR1d*ZN
zfA}aGP=T~EVAKEQ!K*J3*gmZ%^3~{phX<!4@YQSNtUL;a-fz*QW@TvfoX^#F)z%xA
zR}I6NX?+m*{29h?xQporj6?%6q?G~x6~x5Wgo;5-45Y0A<wl%7aXE&zY=Zx4l*ZE!
zAy}{Pgzl@aVE>uxsM&52%*~B(&%y$?ADE$h{<66L&>sJF8Y3EzA*~ho?JM~|QeP;2
zSCs;TKN3Gv1RM4xN`XOSc!dH}W4t#$5S!2>G@<G+oF^Jk^nr;(LJc^!ZBzXI^&15w
z4H4vY2IrmLp?(7m{#*W`zwuEDME(d84VYRG6_`9wdjm%PlH#zjM>GR|kHvtJnqA<1
zbG>N5)IfX<czNYe9xN~e2K@vkcB+IBw=0n3ZGpudYU0PYuPBk5KBwQ5)b0wuJDWjY
z6AhTsh_3<TYC<E#CRFr+q5%c?`UPYfiV75wY!D5Y&LJ8w9YZu;I)-SxbPTmI9_yf|
z1Y<&ZQU%7tGF=>$t;BxWa_o^U!!FrkVS<IZ*esicjk4*`lTP82Ea*zdW2JN~bcBf(
zmP&_Wk#rCi$W$+dlhRNd<HamgMmA%`ewhyTQlTnlt=J};hb^+%RH!rf%oXdTlc-Q9
zU>zp%*(+9H6fe}ptWc!`;Nlj2?y{K2NT~7JZg0hn*ZNAYKgN^x$D6l7!Vyvr8OC_a
zWaGK<%C^XlvRz7H?D6VYf`Q3yyj7&Uc}{Jy5<{^Hn$XzYUNm0JLS;;d@mQfM=8Z{7
z<*95oMdL*;R7TNwaU*>g58Bv6jbKU}uh7s=*iFaTMaS7LoeLd*O{^p1ttaEn3>Zaz
zRZBFUD#R>QMrORj<XQG%IdK`Pk8VJQoQjfpilXL<9;ni(4A#pgQIMjA?8S>F!Fa21
zfGSDhL7lMi@i6q6Sp~i3RO8CqgqhI8G_1vBXq{~)8c!8s7Am9IY{m_>Hs0YMi*bZ>
z#f&%n{1A*a9fMpADqzEh(Wtkv5Bi<#1?|WwSQ9x4x{)L4n`7c_Jk|%C<G&V-n&d*R
z#!axxV=xZUFB~9+Z<Q{_^2qt<H@zHoVlHY;X~K<HsZv&SGaQ1|7>z|vtuP^Em}oo(
zWuqxrxqJ>BrvhF4b}@#`sEGfKZo><Gu$30-tnbCs+CQh_e+9B&-M2xIG$<!3FD($W
zP#M!rvnk8O#$$KSnTl@SHiVnU<7B1ZWBEF@3b4EQ?>_`5n(RDP<);PyX}r=Eo8z7B
zG2r(*n3<VCt8*Qmf6u~<Z<7nGP|^b&931$TO-!5CP>T{v?#1nsipcO_JPVLdG8-B8
z0m1KH@w5W0rBDZ?kLsRE`0>sO`1J+;2J2Arf2C2qbSa)+s&pA#T)Bj&6=2P8S|ins
z$L7Emkvxdgcr|Nk{I!b7Qw#YzLTtHHwuX@39r^k}-Uh;wr)=et^TN78CxsPD*s`Yw
zq_E#7h3#%Bu3oz(93lOqMvWRmD)o^h<DEbF5=;N<316~>ISHzEt)*Boa1_?AeT{~l
z4}mQ@?0yoMP`5d{*Y5_413;xhWub3yTR4Jxg3a9$^SYJ!&xNqAQ)Rv;ugsp8sX||r
z@(S&CmMZmWd8KwfP8Iv8yka{Z{Cg=LAHV2PvMMCWcu(14_(q7PJnzeZ=S5-JQ9*f+
zj!2=`sTWtC{T^ASGTvhYz-osX8ISg<Tq@RI3eCO?(7BHRDwXU-WkVJGD6qZXDCEvl
z8@G1=1&VZqZ;UREDx^uXnVF0?XT&Dh?Q@6w1u_z~L>^~>gX`bJ^@I%0M?#{MXGrC8
zVd^@n+`!JI@6w0y)Uki34$WqY8Ly8<YiKrZfY+8lwZUic^414DHl*)2(1Fhxe>k0c
zhjnX%@ZW%2Dvj5xci$+ZDR0@zENshIwQ5zB-#L2pXw-L_G-;ypJBqC`6?rkY%2ecK
zXyeJ12SIt!eO^M9mp^}gA*DV@sPUc|ed7MVkfb2IsXTV>_=x$PJK&t274j77h%!aH
z!t2bdv^SouseHxCqswkZZ#J(3rw&9!8E?lz>v$PY9g$e&J*D97@h!RX{MhQ%HvsRe
z6u@0#{w|G`_tHk*tgz-%QgkF9>pR1iYLtX(+{^19acJ*1Jly{Ve)?b0xcwotE0G<;
zM%nZK$%w|gxWgjOX48)%O+~ZmbLm%<@m!N&Jhr~A0!e5#lP6$NN5t271@aYwq;xx&
z>TW>5eV}8rUdT-qwQJ4hm|C|s26vkRFMYt2BFtQr?|u%rw`eomPf?_qNaMM=xe2L%
z7>_~W%#)K=Hjcut{~M#a4i{3XhYS(0q%;N&94Mp|h`>enVC;SHTG$6l=BdlKjYn<g
z+mu9`Hf@9y(7&r@?Che6ew~S(DBXD!`gYVrpAG`sYod2MVq0PxP4r@HO>Cu!o{TMt
zEi}=iIkB0X|25S__a*`xYoc2tO}KkL7S1F(5~RG04Au&yXQ<8Dv-zMISd*39$eukr
z-#&SgGAlpt*s()Mr99M9dCYho9uCpy?ru*fYYP__8#p^#!O7_%933s-;9v$jJ5$)&
zn!wuH2v%12@$lh2SXkVFx%n+Tc)*q`zm9e5mZN0JlEM+>Sf{fFWm}D<R3w5tD3(uW
zU=t-Mpf<*1GqNYQ@wRPSEBtzNNPmA9Qt1zBsl3>X=jmYt&DkqZRgx9%ZdT|%VkCMs
zs)Bo_#yEb@5T#2rfvx4`1Q{=-uxr;YA(e7SSH@$?^M33KZ(k>_yhlzJaCNhxt(jbT
zHYN#HUP{8q$Vf<~419fkg_If_Z~wsqaHp+uvw6|r7H>9hp4o@(+c!sRHf^kKtA+7W
z8tFoL5=mirdOM>-$95<}A-$)sGkQ$i4yOl4F|T!X9_CMKQWjTDO_05OQ@Ge&LCZER
z($sjVy-;ep3s@W+%#$3jBnMj8>MW!H=lfUbuN0r?Z}>A;`Wr&$>&!k%cBpM9-NxQI
zR`%;ZFe>fj;u-BTWiHoQ6_xh(Ri7!RQUZxG-hcrEgjDK)-SZ0w2oUywcJ0~;slUOR
zQ#RS0I-qgm#zHFjptj0W1vVp}GWz$Ad)f?LU0orS@sTLwrRJF6xpU`)RQ$oFd(5av
zSIWx>$df0JkV-m|Y`oM`UawxggjB*YW5x_2r5;GGcN@};@kIQMBpWYRu3SPY{$PQ|
z2L}p31irTe-da=t&H{L83OqLgp5B!|wBvsb@VgB7oCmzl0G=lR_rrkoj$gvB$)Wsv
z(P$66vz7n;8%y~yUYP+e*l~=3XNK})1>Tk)?}-5&Qy+MIg^qg(@V!9CCRfXkeG2e6
zPRBn&1$PK=Jpg2vB>eizl`AKtk`F44XXpI}Pd>?={x=ot;wMIV`3vNY_9($CD=Iis
z8T<{Eo`bn2e{5jA)*=23jPnU8oQ}#L6JU=B*zab+$e(xPlz%T8*>g5#GXDGgSsOaW
z<9ot!*wbA%ga?GK|9L<t+G7gBGbSs>9>Jrdkx|dz*zE;ucS*5sELk`aU~^z6wHp(s
z@~&7vL)FIrQA%#LvDK>bZBn6ZylpFu(Rqdi#txh#FW5W4*^|HUVAW>0T>A$9tAO(X
zNB(Gdv;Kx~ISQCljaL{iU%q_&H=`L$nejB9FDd-#^+-(Uzn{NH;Cns{o@ZpJQfVB<
zH*5pvV?eQTL*T#^M_kvwH|+jlJP!|#zsL&Q)zy`cx;%RH2#$`9{0&<>J3H9g+QP=h
z23A&9u(Y&<g@pyo&CT)P!2_6@n!?!FIM%`LL^Yeqp*;2wPi)F_zaW45j46-3WfW6+
z$z{BMJs`wYFFg6?LdLV(BmJlHQp$Lq-v0delkD>ngTxvyC7aEJ7>_rbu^5jPF00TD
z8#av9c)mVPXj7vMnzYe`tMz5f8POTds+Pe;3r9HF+oEl~$}qfg@Snz0Mxu;2fBt+S
z6@REQ-iwD6D6oPRjOTI6Endb;jPi!hv**V1q9BDC&zAy~<T9S}3zo4N&(+lpCRa~m
z*OBvhWN!|8Cnp@-y$g3AlJYF>!|=uhQlCxwP~PHBUAXZM3>t)|_ddYo>JON#*a(}`
zU$A*|F!t~HO2(7Hl_I^QD$mO>oEz`i{V(vnN73cYpYXp4T;Kf)6(r?QyI>u7knye`
z`k5%>DT5j7vHuel#!Gm!`Oy49#%ngy!sjK#cwHKnf}58YN)^owXJ0>9T+qY%3lC8+
zS5`c-x=u!X#GBb|w`};fUe^)Wcl;FWtW2SAYK8wwWQCcz1qQD@gFHDT>Sa9k=(nVF
zN8~PCA6*9O<L0Gb7^P*4ELn2$i|JLV5+3a`LGK1lv8nfH3fC#pR5D&*p!`-(G=nKq
zh4GvYT;;|qTCOD|S;`=L7703(kf3n3EGU&TYqA<ICKIbXwQM%KHtUR+)MU=<(GQ!q
zJVCc1d$DqvH!kWNL5qgNV71*6E(hFjZGR-(4t|1j4C5t6d9Eid(XIO`oZ9saOPAPV
zYEMl}@7NQ*)Hy#kb5pVz&(qWMFS@(C^FnuVap4AZB7esWm>A<JBh`$TFOxKz42s3B
z7>^%6j-f+`M$1bK6-X21F?e`APBIyW3>m_=Dh<b&#>Pu6q^j|f3xfv_=3AA9V-$?%
za94_Z+ipe~&*$3PIE`n%!!DZfoDT*i*?5T=(1;6Zro7|^Gt}+1%c6|tdG0O@PCdi1
zIkPc$@=91zw_w-k3D~{*JU5=_d1v^O@n$V^h5KPsEL{8uqdIrO<I6wLwX1HF^7KYb
z#md#M;IZEi&PS*ch{{Vo#8-LB&E|6xL^Yd_Z$YK<*vpSeZ8q!Gt0$yV21!!h^y$-u
zRN8|X%3$TZD5Jf$35CB&I9^%-Psw=G22YAIp3Ak*aJ&8!zIWv#Ea}zfc~SpSfkY|q
z;>C+XDs7;wycgDg6v&L%tItTBS+)$%sVicjt<8<sw&OI695fz-r`*QSA@ed`z`|}8
zs$%)_<^N*YvSn4~$3|tuoFe#uOg;hlF4-b%kD7vbI@U=i^XZ3IO2=TiR1-_3^2xXt
zEm$P{Qo@?e^cZcnX*mS_>lUEC#|NyL)>Fv+18zJP5wXr;Oq!XQ{nc5#fB!!2-Mfdo
zckkl%?c2C@>lSX@xPj}}uk%T8*bJ~&uU_R-GhVuMiL2C0se>6`<K-%x6AL0H{$;#2
zt=dOZUYCv?qm1Tv*#w>YF2WmIaO2GzF&wW+fjjm*6O0E;?A962sOhvLzt^JeaQN%X
zpsno&o8uvHJr=-?=Rv-2;&kdLuQR}&^<n7PLkG?WeqsKsM>siYX_WEU0>-Hgw%D-(
z2{N9^12b+sBNG$sK5{<Z#`E_1^G0fXjkhYWC(7t_#X5|_s*s*o@O3ceI5+*vcq&QC
zyRzQ`fr9dejNOX!JIrzIKtP<z8#Qcqyp@+$uH&zOB`)J#HM|Rr7BgUJa+w>iYu)lN
zHZ{RW?ZYsn&stP0$BkFF^OR&YUTn=KGoAvAC$Gn%NqQ=|P)iRBCKAWXIe#p1j2`9@
z=Z+$35=ZJ`&Imos9wz6kp~S&@m^p|zP!BT(=wW()JxuFI?4yUNz2!{qzFT4uFXcUa
zXr82IGa<&?hPl{+nej4ST7a#a9v$DYe(f6UK5<RhPg%sOyvm)%!^*}Mt$IyIwj4#!
zxkWYP&Q~7!vq+GWzO(W8RkZ9mmVZB6)z*B=$PB4Hbs+9sIf~`GPhr%kKDd5O9~a4p
zu^CVA`&t}_Hu?`Mg{CcYqu1>z=y*gETQM7b`V~RGS{l&BB(z>q3$5<-Qyb$c<Jfs~
ztUP=}UJf~n3Aw3<XvUi`ybmm`<oB2+P8be-<A;#sE`So*B)D&I3dRpisR{j0ezMsc
z@$G;%8eDn3ThzjR{bP_+Xo%T!W^&^lJbm$>%44^Onzhc8sAe-WB0)YcIik&!@_CsN
zp`oEdN-!P+3+KJOpCpKl8aGjyACo@5e_qeZF3A~<IsRg<Xv`VK+?+nC_|9F|u3d$c
z`ao?5rYl#jETlxl2DLPv;?V{XaU<DhgLwDuosddAo;~~bEO#Q*xY<lgDCRy(Pe?Z7
z_2|(<NQp>Eh{{s}>&~QCB&+efy}gB0{4l3!^3Rr#(UC05Ggv8~KDg&pUF<!25=}dd
z;rp@SqYUV{^b%^!IxFM=z4Ob5lxj8@!M7s*jgXKKAtg4O=?*FG^Ri~mDx}m4n>K9{
zQt20&GGM7+zrK)4-|+MMv-)(38E@UXbwVobp**#3dPlM<kImuy`}gkz@z<|koRN`{
zoNNJIMmBR1BYWwdF(M*@^V_#?{Mil0@bGZXu&^*r_L4p$8*OJ~hGI^gF*rDw^V6qK
zoF6}a<O~W5;$%}}y?_6nlZ_HFzJ2?alihS>WU~=6vQ9jkyqw)7Q5PiHc!?RAU=Qvv
zDqf<9k5N?_G&ZCDWzblR8X89b^CdLOpzL>;LFGo38&=t<%$O{XooiYlS(TR_jQ2hK
z3qHTF#T|b#+Sds5uT-5IuXv4t_!1ThNtWE`QoBCS`|{;2nvOYuD#dG)T7xj<q%B@K
zT;RrI_dP$PvGJ6VIh04LV+{TLcXKLlN<T$wN>w$dhcB6m%40|?<1xd1`|%TDp>hL$
z4G+Wn9}(PuU&6k~jYkX#{>1-3<kLs~e_u$sOnL18gUGOHX*^|QI^#X}_rzCfD!-Di
zYf-W!eeW~2-Ec<G$6!<+q)o>A1ovB8@Scp6MUo#k_bnttzriVUUjzkz6qT2j##7yF
zMvp*MHJf6<A|S1ecggJ?f<r!I))_}g^8OEgHU>C;<32ZD$d@4K?7M(HbNb+ONHFgC
zyh4SBeeuTC0CP4TLb)Q%MdPKV@j}RO!6Bh2-*P<ve(>in{I{6#KGQz)g`a|iuEKlD
z3#H!*`NWmSqRkgCUhs(m(gI?$nGDS)dzOTC-qRAI@zR;kQ%1TlUf9zI^u6!!3X|dH
zT>0Y`t1h_V{(e3D`W=bcOSeFGa0?i$9U~eqArO_9c2Ilc<;^0AX1urF7I7Ny``2*M
zc=1I_8;^m%*di%|27@<XVXrzo?|*%C;C*uwN>m$*&_HuYN;bukfz=`X{uI`(exmW>
zgVbs^f5dDy1@(!|W)hH?C!G^xJkjU<jU*e7!PhS!Q&C-zEXEU&HV}=Mjv*RPgoreP
zC_WJ)(g>pXGC0i5Eug)0d8%@GBDsCrcHyiu2SoA3K+Wp4qD>kT8`)$shh(d8P_`2L
zWjfd=Th1qz*&|zu-LfUvDO-dcvIW>Kn~!a>dDtqO!zY{BB%6tivKiPQn}+q$snC;7
z#yaUFtd(l<320VJ$77XrET4#Gg>)2jq?*u{j=(bMa4eM$#S-ZdES3(!Lg_#(kPblB
zVsV@BDAuYxe`U(AWi`JRHbKsQx|V%1ZMv3a{91O&7Sr`C6t0I|%UrsaIoK?lC0x&R
zem#29DSRRwb}eh96X|-!)Afv_YZ*(|GMcVs6qZXz3fD7?U(aH?9yZaA{CfIh`;NW%
z`Yl2@`-}}yd@-O=RYPS3jmeY}pDre#{OpccB^!&SVZ-@MP$hcR#NzNlSPrVR7$z6r
zkN#YI*-3mZZhzh)iixxq-x|7}H5iBL_3}dZ*AT3LCT7^QqU}h`3LlQ5EvleijU3Ry
z04$Wr#rNiIkZ|@H8>0APAg#r>7GtThlJEk$p={&ASc%cRqIS3Jk3zMIpqp_I6sk}b
zi#~Ns7vftji{0}rlPP&V*&oj*iZ7EQt;Ltnuv6{Dmx!=a6kjHVD84`9J50ggK?-(7
z@udtz@x?$w#dqNALTKBJ#{ue%l^@!gwj@MKx9(jUvplAwSpKZof%*7fg<RN-Ihgip
z8g#vTV)gT(s5Pl6HbD#d3+2FiOhSeBm8g=E0I9#17UEm5qX~+XEQ=#pLITuAp`o2o
zs%|-~H1B~{I_=Rxe;jsVF}fR0pzU;Qr|a2?@z8bcf}Htspzh-T(B{fe%++s<c0Ef{
z_^gE$UkCI4t0=y|A&M^s5-Pq!<SllEEhf>eK*zm9v7bD}UM$6=gKe=YWFDIJsldh8
zYD^VgSvO-gkv!jziD<XI3pSGI^kkE;(5MCXd~Coay@#FcMwJ&mUpyd+F9zZ(zGKv`
z%frr9{|q~~<4@SRg^O=inuVPbNnW(<Ux`9WJ)9tadzA8y)Aj_`(RWu9SMjYvd<V&s
z?<Q}zi@1+GqC$Mz=$f`sW5TXyt8hK6QCTmWj3!zd{5U<X_MxL_VI_ITF4y`~!!j1j
zWtz0F$;Gz}bWJi*d?EzISA69L^+9$G4eazBhSlfWqPK2)G}@>MNtRL=KD#pZ294sC
zb>;6x$UnF_@=7GgPTWM^qTa^dR5`O#$T<UxeoaB~LfN_avX?4~>P_=vUBn=&{^KEO
zSS|&`S4N(u{K9psqt4J4Xw)btH6*$yI<5<f(K+t)8%~YOLL4G5zU<RdWG`O@_1l-m
zI=la{hw_*IoCissJjg=d9lo>*32+vA*^kFyC$=0;ZhkG2ETu7QS!Hz9t&2s!C!p(%
z0Vv+PK1vtOirPJkQ=BjiGrtexA{E6af+M8{T-e)C;%KKBb}B;@UktDph3XHifu@>u
z(0o)~zE#cIoJ}-qaW>YhNz_0ifekfl5UX=G(5%K;U$ZJ_J<Te_%A9pID{<E0tccp0
z6$F+?EzWYNsacj&L$i#)(x^eKKB^S2tZ|9Y(a{le<}6GT&Yimmvu4d#`I#zi+_(*H
z9*;%wB^0kL&+u)ItXb&qdur*kp?rzLxa0N?wx?D>k~2RL=80VGXQFe>%9yi3A5SdK
zLTA$n{(otS&6_t1DZtRskgsVre*AbLM?_M<){84%yf}aRvQeW(LaqpgWcPfQ=4SL)
z{^I$I$L@Ul>&F);UOath<Av{E-r~1Z$Vg+b*K}*vtSRgPIdkR|QX-NIrAn0&QX-U*
zDZ@_oe*Cm)(}X<{v7z~l6L|9j*wVW;-+yATfm+hHs8p#EO1B)1$nX%1?e)i-RjynK
z*(LdS`ukHuzEwaWKsINAzyF_g_A@iYKA#8?X@n$+&&9<BuWf)gwsDhv=am)f7XmLW
zC>%8ho<AU(0?&+rr$)s4K;S(f;10F0w~4m^{~N&L>ww=iqCVhz1@O5HcwZo%2fWS#
zp48R!I7K`OxE}}HjsdPmh=&2^L%^d0#QlKP_Md7q>xzg!s9LqEkji{WlK5)Y)WEZc
zvVZcag$#ja#0N42n8@(Nm`H-lCz0Up#R&M_k-_hl48AvI@VPF7w*m2*3|?1d@Vr9#
z*TUg-Q3gj6oZC4mT+c}P&^@E;Ng2-V{*6aRrEoedh2tS991aloOEF-iE$sG4VY{2S
zQwn{9+X(smML2sAiGhQ`8@ytTX#)9@8ehg24~f(OKW7cF88yDt2tT7n_^Anz8sb2z
z7l9P922f)hK#lQ}yF_Y`{i#9rrv~})O(HeQeymY8paz*5W?yQUeXbIzarS17^CfDS
zFA}Md_M|%Fd5#)qYN$P^p>{t_q{iBf8f&)`)JRi<?Me-{%TXdV+Rlnb`=GqxcA|#c
zX&>OYm$(O*+DlI;iKHXV#8;{CQ25`Mq29pLIB+Zstczg1@c?|NU;_+-NPK`172d`z
zAt+saDD-D&!~MJrh6fzsN%>ExpgpJ{owgalg$mMx3bIAd%g9x44crfZh1=msIP8<b
zj0&wr`F^7Kk^yWTCRO&04_O^}YOYidOqCmA8T<{2R39GSBi^OPm^H|^so_;L$~R&(
z%=&*CXYH|@;X?xSxG07D1>$)rZ=~JM${T9e(^9ycqJ6eKDTOsP)Q^r4X{$YOJ!TEm
z<BhidjvrACxBWiiUMX+9*UWhg+g<Vo+;KOF{c-ZFN}guoiz;kILC4|wJT4KbV7;hC
zQ+PgJpj42~C;k*9^L&q}^-?ZC(eouA)KPre<IljGyk6z5C(*6jGE5t?2G?im@Ot8V
z_6^+5$Z(6i+wf@~Xqdkxtk<50^KltWsO~WD=S$wujXrnY|C|I!jXBkyDpj;mvBWeu
zDY`9tWw^cr=v1Of<`ti!MT<*(%3-G{zT}0vdOpv~N_8X-&!?y_ZWJ*^)tMuI>W$;U
zKXr$No-E{K^~a9YpN!)947T2jCO(aUNB<IE-8M^8M0}y4;e4Qo^%vO`xFX_@j3Peg
z<4ScV7V#;Eof$%W4Qlkpq76@=*|-6G&zVwT1NSLps5;;jN*8L3m-izPz&hB}sb0SJ
zHTunP!2S{A;BnLu&nVCEkQV}|FSvMV0H!x<heoZoC(855WHJ;iSP)ycZWXRXM0}7M
z;$s7GY~V#9KK~mZ;TJ=E<{MAr%86g1_*4~iOvdzlV%V8Jk)q<e=7pu5yGMy{`++cM
zHm?Q0lcor``3|os&-z?An)N@6{X+-g#v&cKT#SVAIbhqi5UlPx2!{@S!;>pNNPr-Q
z!1J6ebBj+RsYtAZ=lWK7`4DI_;3y>7iy$k7eN{{T4=+uCYE_%z;>ide3Kq$o9lD)5
zqh*_AIJEaG&tts5d^c{bxy<kP<;_=?@^a(Wg59WFsR1lc06Fs%p}bt8_)-vJ*eMrZ
zwQAK-y}FzVDE7;hE64ZCmM#0&cVZ$%#rODrFrL%)sRi(u3fumAC?4JX3YTj^u)XjW
z{`Y<oWw1T>7LTc*txmnC!VKpHY;!IGu9u}Gw%?QoDqz6*Jm7HpH_Z3EfywT7RG2at
z?Rtwx$LW6$M#6B*8&P~Ih~yOCi-%PCuejqm)r}#IYeSMH9|Fj`v4+<222egnR@7)T
z56*{;P`7e*exI*onFgrVZ~@k~ZvkHt;OZI2VYvDv|DVU#rD#^V1nPF&#rNlTZcN*X
zs9QKUvgNIT+Y2|s{gf<CJfHINrOHT>_!>2Cq_Uu6QVcsY29i^JU3<*obzw-CL1gpS
z&{=NA#{hb^9mH?48*jUTvj<+{3Du9bO?tzZJm2^pqww(DcV0I}bsr07YLtBqfPS5q
z!CPNSVJXnA*>v2}Igh;)m%*JppZN|~9Nq8&rfaXmjl5r4i0}FH=Rztvk|aI_Ts{2Y
z7EfN$zo{}mwa5_P*M$sU{@~lDleVKs{&J|=e-$)a*TA>8e_FDhJIwLFJau5ScQWw%
zE6+P@pRwLYV-G_!T)cQurLf||j1+dNh3CsCNUPP<)d@Rx?BL;Ad=@5m_k66fVM{EJ
zpF9T-FMpMvsVfr#QG5wRg$fmf6c7-gKC3DI3o~ZS;IB-@1iQVW?k}^lWll39*mA0>
zAc`**lr3A1djfUl!-o&~x!%5g8-9NB*7(VjCs@07El;OMu<Ocb5ItW4z(OxiPe*uo
zIK)YJcY7*WJEARIU2WmwVneisv$GW*J+g$8(?g;K933s-;9yQPgT4I&*x8xF*4Bj6
z#>N=d)<#4_SXteNrR6;m72{o4SlofR`EBAYn3>(eg9kTZYI=is9VR9Q*tTsg57$(I
zEqtxOuTXEkt<ZKdWUtJ5dfvo-DA{rtZrr%R_bWG=fP0U_cv?j2Kop+}B!~EnPcHdO
ze1qE5rL-BPDesY4ii$5Iz|zuENTqLxo-YANi1<A0^s#bSJGgr|!rRvgrE}LpB}oMs
z9h(PtH!HY0TjJ222dJ8}9C|gX0@p_-T#QV7OGk8rC5ch*@;yAVzXvN4p_R2hthoS1
z@nv*~;!}Z)5O!uH?BBm%NTpARo-YCTm-r--!Z1F+4w7tzaLL+^4-y<VG(&!2AmrSl
zfwawr?poXVeh#9mvni&ws|62tTb?((O%>$MDuJW3F&dOBh{~PEp+n7Ls8qi;T<osE
z+TNIdZ}q{mqUTHJh;8~3QG6=!FY$HjH4NT9PSD<Y6!-0IF?&QGxO+NaM4#^D4Nc)f
z-mu3=Eog5!h2tA%agSKB*EH;&H;#M0&YipC!v0mbetI)`MibmIH%7<q17LRdIBwoL
z0|)Etu(G+2ITQN9#PWW|65sD&oSZ+1C&PZp;20c<;9rs0dg~FYRd0nkoy#F2M1E`M
zwG?PQegmfUZ_4+d-A|uuwu_!G0bmon`ue(X0melpL>79wyR*>Kj)$JEuF*r!M~_(O
z`B2`^bBrE(D#A||dfM11hn|Y?QyzL+Sg_FZc9Z}gJdg{pefw6K((|$RG1C*&LVVud
z@*(f^gl`ew6U3}pvmr;09Dn8a>C+cWmM;A(KR#sPr<=Qn%FjfoKh#2etP*8ZEMLA{
zNF_gN)v85a&kTWqfkKW51!~l&A*9q7Y9YS<{rd~4j0Z)-(yUoCzE#HH!GrPryWC4P
zXwZOf6N1m5Kl82P7~(n-83Ur{O9s4u|6WMN4u$xViebZs2`LfE@b&c-QtAhBz$K0G
z<A?n9q~ySb3m1fxi1ZB6^Cc2_^X3&&@k4TXJ_VjVOP+Z|G9uU%4h(G6S{)#IJ`tG$
zF;|}&IB=klQa@x!&zHYIUX^cCE2wy*n!Qb}n9_p1LH*Zs7K*7X*qhSAThfYYEZCdT
ziYY9dj!NOk-iBsxLbJD^*&EQiX}cS6a`xco6w~t^SaU_?xy8xkcpF@J6Wlu)-UMgY
z&E5p(*B)c~4pnb~uN!*_kNs1}W3!io8BUx?`^8ri?fGPo4<=;kw3u&em9K$)1L|=h
zJ$(BE`?josBwrO+AD)R<5BBo>fx9g6!QmuY7b(I2C$$lq_+A)2#ydOU=>sY5Z9a|G
zotIO^l{X5{*g_qKK)tT}P`~9eY?-<QS7yz|n3)dny$V#XHVIocf1-*BI9~$1&jE{;
zyu^}Dz2JQ41IpFZg3B?$@(|GNzpE%)X(AWjBNtEV@5vVnRfal<uWIhH@-+@feE-$1
zg$w(`;B)aSvgN1(r`;wbK59IudwFQuX0+^YfSgoL=O-;7@yTFx9B`+4?Y7$)hX#(t
zBVnPD9{r7>({~nj&Ax$0dxK%W2iQAY7bjMQa`Ab2C+wjB*1y%#(n>U^PoIv$g$t|v
zEG5WZT8@cKb)PRb@x8JIw1zIjGpfM1H=oDzhd`hyuwsD;0*nCT%is8_IBce@bB9CW
zc+>;l<Q>M(b%Wcf=TV;T@Z<yJ31pZt+5na$ILDp7Slpo#9;~&3(?P1R`()U^D&#Nm
z<;y2uIFdmf#AkKL6}#4YanCod$6R<_A}@F16&&aq@2$Oq2OCXEJkD^ZhK4ONGPn0q
z@`Cc!eirrG8s+&;ZVZFV;Yb+oj)Wt5zJ>jkp?7~1%pQCV*XCU#4+uEyk|j!fY!uVO
z!{eWHcX#KNoYB?Ql|KdJ?Ci|>=+PrMIXQu?PtWM!-~fAjd)V38aoXD2!p6pi)7sh^
zR#sO0btXpk!m@>h1<cLOIobVIw$wGFsi`SUOiW;GY|Lq7WQ2ta7sA8qv2gZsh~iUX
zYKEQ4;@i7-FW)j`*058R_{NSM%j*Vvm|)qmWe5%q7CuQn@f}(>|1a^)pE?P4_LO!c
zA=)ON_&j4=qgseBwbtfVSMjNv=S!<TAM-SdhM29Fp?n+W-Me?uo?1z$_$Icff^v<<
zz}>?WUhb~QU8*t4G#iOU1DnFt`U(lr8Mdx2$k%QRnpdw3JF_!zav?$5*`fh?e=A2P
zEY?{8ofRudd{#Jk>j8<<GD+f76^b&Xs`yyJrUv2^pC$0ZI$XX;BQZze`lysI2d=N!
z0?&KE=4CgrclRe`%~KL9hmE638jb_YZsY2)U&xiaG4kfCiPHI7pjFvga6c7+Qxmn-
zMtq$Ho`nsC%){o{qh!InSUXA!Pi}n0(JdY*(_j+H6={z-UD{#i!b`Ze`y-am)<@}P
zE3mFdPb}!!4@bw(#EvOj`TB=;=Of`MG&Cvg`Qk!)3_I1*^Q9Kz?fIzUzI;IaJ|goL
zY=YJoCS-8(63?mc#}?{j-XV~!gvva`CF<`mufSG0B_`DKb?MTDZy8e3^F22PUePrv
zJl_lI&-&k?{hQ!RZgY=Lp6@B8*`hSe^Z6Ud7ngiO+tdy_<ASpIx-=-xpKr}wtQVXf
z-omOq=iuk*1l?H!(Yk&k)Na%oE2a;J2MMwNxUD$5dle>YZ|6d+QnebKA333Bt-iE%
zK>g;u;7I%W1{bm8%nh8{t%uPwR*^U#!qD2D8mRuTB{5d6QiTg}(2VWqHfjM+cONz%
zlXmN4@S0ONzIzS!p1d5V_+mq*5}(mYH{3tr79;GWim4QK-rD1io4eiNLX|VNu+!ya
z7+lpj?DV<unNP$2udvg2w})Ev`Qn1I_&V1w8kL^iy9u)9%8w_W_Hg#|Lm>)d&CaZa
zueUeWp0|KTyM-uTumB1dEe-P<M^U;=X*iG<lt`+<@WO5$_By*dV~f58PnR#64@C-=
zkc-dC9y{ju#;xOPQLS1v?9w+uxdubfrEpd}G}4D8YYvRtaTSACokabzg^;UY1<~^<
z5S#dNQ6aOfBzrw%&6ZnkfJ5i-+Vnem_1=Urvz)2I0;9BSQ9f^WbZ32nE$8^Hh8zX|
zL*bH>VX^Kk9_==RFNJ2O_xz;a$U!Uyx1*ond=zntPZ=pGKBog$@!XI+9eM9rYXWd>
z_EJ>NCZYZ;aOya4^E^<8uDxTa?C?BfhR4@{;%)UXZjvK(S~gKz@x?`T4m)E*<_<f#
z=aX03xCUHoPK3bgvJ^g-s4|_3<Q0-tMuq2N%L_l)9j4X;E{~~Eu|F5gr(1Wq@CA>B
zkXqUEd7h7e+eP&XI~iQvec<Nd`%ilN2Jm+&RehFP^zsSF+@6oEEx^2*I*=JcmFLTv
zB`dOKO+~Wfr7^Q)$&x7X#fI$Jv*XpPSNQnxBj0b?vL)ZD8#0yn)D`T#J_S<S^Qp_N
zhU64q*REZKlzasxb%iKCHG{JF?yS|uYa2ut8lxr9q-jIEvIeHj-H#!oH{hjZB;_^2
zGc#bz(mmL`(E+<gPapvTEt)nU5z0qynfN@<Qy=y=(5Yop*ipak-16Pnxco9-R;zKd
zhFGx35mV<pfM%z*Xxh9D7hl^}jqqRR6_`C>B#94jrZCi#`iM+?_m0SLVV*7y&e?{c
zLsr9WpAR09_}aB-h@OLYq?-8h<jEtX(g#HGsR0t>`3`Toj2D(N80vq9^+{`<zIpl;
zoXN|1-TwxEQ^0heIrn@=)?G$`(0^s(^DzkGp6~41Yy1|2ufcbCobiB<z7%_Ou0VT*
z4=(R{jkBw7QlIuWJV|^<DZfMStvEAd3EW6@UKgnHoTYvu^L(dBgv|3D`-<y3gW-HA
zgnPat3$Nn93fB}B-^r8Iu}-H*)0^xaI&=_H!0FScg;eH4a)zDq=ThSiJD=W1h7LQ^
z3)IH*DHdAHj8G-M7Y`$`d(KqcIqmb8*k0R&;thqPuPN-D)2AJ}kKK(|mOt>?3V2~o
z!n$f1CBCN*sNZ804#y(~TzmsYpTmgh_tCA-bok!`0?6~F7xBG#@gmyuof#FWCcas-
zX7SOf)CODgjoqh7E3*4a3MAF@*`Kk(oH?ht=i5DhD;!8<nR&n^t+Cr&zV2Qn30wE@
z6EPTm&)=g-xf*!#>;?a<kM<RO`o)ufA)5Hu(737!q>73gj*6R(?1rPNn~sKthPZ$K
zKIgrA_i*>_UCujq?(lWx7;oLWg_}2T^5v=+uV23o0|NujYuBzpUtc_(Wmp?sw6@zK
zE$;4a1qu`>5Ttl<EAC$03B@I7@dCwNi<aWSf;+T06bSAFcR2H&^IhMc{Fz)cnaQ5L
z_gd?D?v;DKKl8KMZ3}&8Yb4Ee?+;Ul7LSEPeMoi?b==@=*``@K7xs`gJjem%YADsB
z#(~UhB-J#{0nclY*tE@ox^Z~hG{!+dV946M&_Q@svD7@<gLhV;A&(<FXy%WrE*n)S
z(I0hPu9>h#4`e_QZ5HM6hWOKKvtW-Gi@)vSCntADoY`U~?o}RUg#$lQpQJEBGGVqm
zP`n-jI<c;Ga??P#P1gF~3_q$2q&exRiF1#66Z;H~80WN=H0c;_oAE43c6Yj-$av+2
zouhN<<|J`>w9`E^asgBP?WNyx3$l<p1p#9Fcf=OCm>;A1`z9x<X<C)uLfkkpEb^7O
zI=V`^EiV0VuBc;}c~L~iSNd3N_W8W2qjs3NZz6YJx9zUGi~1lrmpywwY9M=DP@8F`
z2`H>1jZ>n*)~=}P{3J+_m%jx)D|g+Y=Cv>4Q0ZTXEPV;QNhZ1Iz<m4Ht9w+a|HB6#
zW+?Y7F1g1Wsaf>XmK-Ev?#u2q^-@=tMGajiUdY_1wY3r#t`4swxh^Lg+N`UNpgBC#
zMM4ZrDn&1&TDimXa*1D&HI9F;bbsIDE2KF_C!s`l!EW%Q@|l#Vf8-lJY7d%J@a$``
zp)lZ=L`Cr^e6EO~B==YE)Sx0=X$v+W!O8PE?{D@$M{UgF?K(0LoYD8Q?@(ULai;n$
z??F(zzEj3J(ZuTD@_i@sx*_oUj>WoWKVa$njLxM}a(?gk)uJXZ;4xeh&5{}v_+%(A
zBlj!vB)^zxbc{OB?kEamvT**d(|J(T*kfV<nzMZVuZ7{-552~lj|$w;8<vfJ$`fDH
z1q{1pmciW%--q|?M`RnEC!;~qK4N`6C2t+sK&BO@4rVO(qrJV~1F2VQ&$+f%^FhpF
zS9+D}e>-Ji$r$gZ)_e2`_b1<sOn4SfXj_~%bnLcN<6uir=(C6vK1a{aU;6Npk2^$h
z(lpe*w`FcL<KoWb{1L?^tehve&anu^6Rs+IZ3K9-sSbmPeog(L5`L9zj2*4%mySju
z=tQUy*dwa+G-z~;ez{lUXQ@d)6k)!w8NbDY>1;@L+3&Eick!(^YGRf+Iou;OyIr)z
zxusV;SF}<@Sg;10qAjA?`T-YGKZ0=(Tt$XCMomvqoPIM-`7b8ipX79cv`O{wRpI@$
zOMEZW(Bhj?0hO)Wt^3g;M{Ue9!>pL(cBaX4SLNxqNf_QW)IANEO|)!tFJ$&FdWSgO
z^8#InoJ^8brx}NqSk-fCf?QNsYQOc$QzuC4noAhGcT7p!IVtvQ982TIVAMNvnHabd
z9AQ4My28OXsSh8N+(QvK0<YNZpEtDrjW69exRtiVhWaqj5XDAWqKWV=1u1I4RJ2ja
z@D7>gYHN2HTIn|<({?OQ`0GA7tjnFL@TZh_m*<}fE@V*#)(byZe!bieOl<EW&Hh{n
zsGU8u%QYbG^9a1UNauD1I8RCHO{@1&x|t}A@3pe@I<B%`Io1^;5`pPNjwmGS`^THP
z8p9uG`H6Kx0*)&sXZ5{m!9eQr>T5#e%|}OS?ijSKci((OJwN(sQ!8M0_}u~qBpNaQ
zyIwh48AhBxhJIKS!zcH(PbIAqw}uL-Z`lB^@ZQvU-K2^1dVXV$D%oLU_?ydM^L8Y>
zPf`vX3gsy`g!1JHs#JL@)W*{Lv_@bttJ*I;GDXyYmy)hXno;mi_6;d9r#@p5FShhV
z+HC??-$23-?-wV?gLANZlY=j$hBcsHDf_RgtUX^W<m&b6;|Pa5p~UoTcNx;Xw&iyf
zH+~eI()}e#)jL3Ki<|gWjpB67K@-Q3<q#>LbNxQee_^r>(+YiS?Y^^^7yABR#JDG~
zH7O$y{Gvzl)1@RXu4AC1YaD#J<VE`9IG;YXwz0ubByH(cq<C8Qy6rEA#^O1Zkejr8
zlp0B7&VOZXNr(8&a>&iR-+lQ@0iSZ-h4<mZ50CfWgnGeje7wB8<bh8QWU&sOpHVsk
zpQ&T<@bIPvt+g}}fG%o^l$x44_K=?nWx+jv7!wOCwjYS_<#-qw8Oay4{Dv(jzOWC@
z3ac?6u&|#488CHA90}HBPH=@%<DbfqLs0?QE78t@mmx&FG}DXcQR|A-r+bDT>oC6S
z`xiC@{$Z2eO58bN+0PWv2h!-CMNM2n{OAUIpyK~I@w@B-6a^85d_6xzN+Tt<u?c5*
zb0@#<XGX%*k=+)*-oxkZM~`<R7C?b*qhofIF=MF3;_WQ$GWnX+NGvwxr-1vEqkbL!
z09WSZNk@2odpvE2gmHB`Uct>9G9$mjC;KRs&{ETYgYf00tzjb~GrZiXTFH;dkcfQ!
zy0<qED>Nty+OqPjkK$X9aL9&e@wuAG`%R2Tl>{2eQ1P=4wv8L3>$<yWq+#v-82-Z6
zjd_2Tw;gL?SOoeT8}|}~?4Jp+Ys9<nd~g@jD&i;dY1HbB1^qC;#y2)7Zv2jFV--{X
zFYVp<UsnGIZeLn=pWt0k3vCDP+qR20DE8h1fuHyDbvx`LZ|*QxVN$yw*xo$6%%l}n
z;MzG@fJni8YKH0;HchU`#(A3en_J2dL`{B(+}oIuxg%45bF^hlfyA`?NY(rayt`Xq
zJ79J8TRMUqa{5$9C)RN;H5oC=*)b2KFGFKgKW-n1X@VD=hP|lW!Xf@qO*;oO9Xx2P
z@SGZBDy*q<Jn0F!!NYY7pRHJWndr5JQneJb9hS4W{Cqm~f`h3t^k4G7@@!{jfdcdS
z)>tggNnb4=9dJicy-n~`7N1U+`Oe30lL@8|HCrFT0?{Bt$)=-rRlzBu2C$u3RQwgW
zx57>`OR8XeLi7OuMiX!xHi@Vq4IHGzTH@>_7};=Xu8oV68Ng1X;eNkKknx>0u4C)~
z-tbojdM^?3guot|SbSva08~cjxU)SyQiDUyxS}+4^)agH6`<UZVLFyV*a6e~L#->n
zYb@p4B1JDRFDQuY$3G%V(-5r{8?{4@9965O`HsTDm;;g1+w3C0h#8JPF^<q?+Gtfm
zlZr_0#@ggD(=<JxLNC+DqDnD(JT5cvq)OMdI5XmYS~rot+o4WPLc3+fd}?JKxvnUC
z3b(<%@RXZ!_8&Mg>BQqoE+{DCspdY6JvpHct{U~9VR*CiZ>7+weSg=mm^b9X5n)6e
zWnmq_TF&#vzIq|wf8iN^uE{rgIAcs`f*Q`+VM(~Unxl#-B6He@t?u`Ua1}ZBmETC0
z?8)IP@t!kf<YIe*n6rUK;W@Tg@7z_>%d2)<UME3DJ@f+0?gvCi3)<2Z<;T=@PIcB8
z<ow|6A02ia`<H*WIzJ0F0kU<$WRgdf+oef|Q2}*7GC=;4#3}|s5E^XXwtgN}T$2B0
z=tc5pwR7-3(dL1=TihmRV(V0K)Ik$vbx&k;=`m^eL;B6`+tU<K&bOx%IYvnJYKMEx
zb>_IL9=PD<kGS+HQ|Jw8-+#&s$$a8<k-#UA+s=5bVT)Ti-oh;-!9qh{awX*-!Sjbc
zz!nThb0mOzdKu(KI&$zEZXb)JH2Fuu|7yT5)WP)9MK7h{QMieyxRC!2ND$`y-vKhp
zkyKkL-@P-ftutv}zK?{)m~V}L{}2~Xr=HKN_WO4?pKu-6;v(I+oeO$v5G(cTGl05^
zdgP@#Oy(RgUf>11d3{a`=7&j~Fzkg_0QhP^U;*TiGS*GJ;NXxt)+@V!>5!m2@O4jX
z_Y;dnwg>+I->;tPGEv2({Nd51qe7u7XZ~HxP^TnJsaV`oD=my1Qyf|+FN}*(j5KLx
zLj@n@6O)Gbb$zPT(GyDX(JfIV^5n<XkP)RdpwrTJG}iMTNmY|E`j-6*B57qs<XNqz
zZevF9c{)~0U2w2OT_#(S$dk9G43P4a|B5Re7FH=MD=aUFgSl0d0XB6>87g+I>5tF?
zu6_x4<>x|=P;>SPapoBrun~@6(9e4d_#vObf0t)-Py;TXo&@_FN<3>Wi3w+8-(Q8D
z<3v8T%>5?LxjJ}hD+)#aO5;Gr1l=<EI=}`J#8C&Q<A33VHo!w`$t{F*LO>{Gun^G7
ziP?{5E83c}^G=-J2b1r_VJyjYIxf%Q!eA)A42C&TznN?;Gx~IS_*JMvfo<--?R>>M
z4<5picgT;~zIh%sUkebte1G)8Msh?w3JbcUF_bYfPL4biB`EC5j#1+q3VG&fNu)Hq
z$QGfm3++be_awoNDi;u^&39+(8|wD%Hs3Sn@cUZlWD~9VYuBtu-p1?>iLU%!MUsJA
zSr;`R(D^H2_tFsl=)8qvF4oW0$kxjh@j`J`YOStxXSh;z$f1*qc?PYxIR)`e8YR;M
z$x-<wtWZ*UdpMJa3sd_W?v79n;3u*HV-BW>6$y)ZsSYkcXdo3J%z>fD3Y`x6@7vLc
z)TJa_P=B!joT{Ik5(N#HqgJk!)c50hVd3tFco^5)-nZv;hG4$8uSaTL*VkSh**YYt
z^i-T^)(JSg{r&dt^kB-3>Mc4qHgJXDFm&gGYa%Um&&f)~Pt%-+ght`t3(?zf7u-q0
zR+8~-o0|zPR=!E5yu`{sSkA_9_UmFKWKTpo;31mXZv1#En^H@hTq|tJ%Di-;$^ftG
zUrrnO<j0XvD(Ab%)i3sTAmHuC)I+_x<$S?w@K@^gmI02Lax{ge@+jteR651u!@(4B
z3J=jXmv})DKVEGq4Dw6#!iS>S0)&<X@K!NOgAY!wB@#g>pTHch3G5F4Udc?BDDs@)
zE2<TNRld{A;Vsp@AhPi)J_0!)L2Q47kBRpeD3t!PeP2u!tz8+5)hSoFdV#*Y5$i8X
z+)A3sOznKycf9+{^@TS1r8L!;wmOVM>n%(8a%Rw>9@G4%xnxc`;?}qp57ED0M3AWZ
zzste(t?GuW2uO_Eav+=e%*^HuN*CY?T691@wSRi`RHBv)T4^4udS_~=`AzpPVO#kx
zyNA+Xqs01mH{0?K&!R|1-dF4S)=gH9K4lBGwoDF;c#T;rIT6-9?Xnh^@jR2*6xr7K
z)@~Q47w=HqLs=sIp@IM1dQsonaK<3o`dTzAbTszn&B>d~K|+{_v{?x|{0K%rZVT&i
zKp(T7^0NMp&=u!yK-IzSoRusk8>36K+`2Cf6Xc1Tx~vT*YP2#te~Hecw+kg%{5`V`
zTaq*Od%b=Bk(e2p{oNX7F;@?%wh=X&utpc1vjAnpy^Y`gYyYPv@dXdIXXf_SL^dzH
zs@IkaN<{j}73Km=ikp$~2xdE-4P*1kRO1A#sv!T>a{Pd){_%Ltyo2{y?1viiZiM~2
zM%k18k}?<n7UM8#PP#itg<BZ~)H~%5{9X(HdB6Ex{@sq5ApWZKLsJVHiSbUA<D`$t
z0U;i>Z#=h7dUTn(T8JWJ>;@siYek$a=9<6%3p!!xEvL*ZY-`U~Nc}?u@=^fj7DMJg
zugjt%$<1Nr?m(&N(~g{em@(^e%S(3a#5}JC2VH7`C|}UOpy%B*=KT0A7p<Di7z}RT
zmgwmni;&D9!<k`**VzN>J5=RG;n6Sxyg>Mo2bmJJIT49*&hVC6yNZ*;IjO{>sH0Z)
zBvlfKNG*(g4!y8(lWALXM4aZ}9f_1&N^ffJ#*oOUL;&+E^FmSoch4#q9)BDohcSfR
z<KLg#`B#(;aYG3_h~J9ZseHaLn*MP$XAwCg$pvNbNac|9NNA8p;es+7jhO$Opgjx1
zsH6AeIh!sYf|UAqGJJJ*i271fQut6iTb5`N5@*3-dQiio^>z9t0Wq7{G@_r+N+L|K
z(reLB_FJ~Fe^cMKqZsR#=2JmawhTNffx#GNppPQQ_I|@TM29ope3MM~YmBe>NASO!
z0QGg$lMdTD&v&af{!qFe#iaQ3?(2iMN28)ET|!%fQc9aX7P+>61UO2J%F+&DF|p<}
z+?RB~sMj!eu>v?Fq<+p?m7yHvGXpWPz#K&b%u#FaZy7$PXr>Q|R-|jdMn1o98$OT!
z<cVk8Hr4>lklM8_HRaY+?<qb<IDf7eupt=JS9hq?OD+qR&ElU-s28pyC&xXo*Cx_M
zx%|LU$YsMc4X>213|h?EQdcxp9&_vcHM#b-M^CE$eI4Pi?G!{bc_xB%cDK4OO9<m{
z*yX-J7eKMl3Mh$Q=}?t{7b9DCcA~LehQ-EWv1^qDk&}}f236vhi5UHR46Bc)0*uh5
zXt|x>*bIJqcvp81ySPqYu6Q7tO?F-4TbM!XDeB4-GBK7@=oJ!4;pMJg<ii=EPt5oA
zToUdC3X-gqv*FPMQ90_4$I<5!&iPj<K<N^ev%JA+(5N&|kf;SzKT!b?6CmwkH<{E7
zqa31#k`VjeXwU5m1<3fx9CW-^D>LOJB_lh1xXP$!?OhD%P>wcpiVp{ggYb1%3VGN)
z4ZAv%XFvGgy<h$HSw)7CrazWqKnM0&V(P})i_xBKuqZK-_G61r`_?@%wv(T|lNpLH
z2FW1(rr7vHK9H?N0#F-dRpzX|;&?+yjo%w00aOnSlkJx;|CL2=s7_@%9+^ng5Q08~
zH=9x7tJcnwG0rB?``#uVyqUhioNQ+qOAR=`^NOK-R3wo}j)b$cZw@AYzsPuN7_I#k
zeVJh~{%WV!_B-Y*PpP=n9(DO7suXse?OQAk!Jdnrz=8}QpMuUtYtZNbB)}Ln(N2Ig
z-UsjFtXh_J6ENaIWOcUM7!Tu$RB}}ilSErtI{i!utnpAIN#v34g1>dXDUoo1_5H18
zT;Q__z<c|dFbu_&QU(OmFUX9+K4*i@Mv-db%bkFh-Aat{6Bx^$e}KZESD9k1fgceq
z`ILqewLOg{h?JB0YC<Wpze`h!Ho*bcB@G-Qd<3ZVG6A)oG*Xu;4N&mBF{CpF3Y|#C
zggjq!=yFg&Dld;&UNmj=76u*Qb=~43c4=M3U1^NU7-L*!>8H_b#uM=P=#m&g*KKs*
zD>Y(4PD`*Im(&^(K!l9y=LPX3bw77t#-HGw46k_`pspJ5-YnA^r*+>0V!b<n5J_j8
z`X3|mn54)>L>0sVIrsvQ8b87PLcoU6asx#!!t{_0v-OXFTu<JtQx(0fz4xES{Be@`
zOxa&BK0@+?JKlcSC~L=if|YcpCG`rsG%#9?-cN>iMuCC~VB;MtzsRp$lRulq?5h;u
zLdW2<G{mwf-++4%8;bUJ4Qt4!cU7!^%!(p+ASj6iIXiFneI)R3WW-e2&U}XHX&9pY
z2&X1Qqy1Q4eU-#Zcy^?h`53Q9=n+a!8y)t*ihtHFTVy*Z7a0!aCSapKYh^9nL7|tC
zqb8*C$tu26m`W6pk#qXS!p2*`I+Rktm}Vgz{XI*s$m0h+Bb~mRutZVhP$E6^KzmRR
zwdr62o#YortS`(^b0I~z5Yd$d`&u>Cz}npc&5xyW47<k~O6IvQ$l}_QTFq1j*r7Z`
z#vSwx>Y5rfD>k7ndiKQ2<+PdK-^MPYEOt9>D1T7z7E-56<z7W;7@6&U2<Ke;B}i(N
z`K?=u{hd1alic~;(dVTb6T<y2O+FvdH<p)Oo2o`&bJqBv2gsY<(`@nBx)bGM)P*(G
z!b8u`Z1k-cEbMMJvFAcUMtU9|;RS_1@RH~ige#^^X$nvc@HmfjqJLbe^>Dsl5fCYc
zp5CTo;vg4AA#yZh2JXDLPsAW&{YF}ojJ$R;*p%o4i3<ahj#)f$->6aUvr!TG+GFwh
z^&<mTA9(y;F^`|hvVBrsnXo_+vN^^0%{oU+Ew=*O*cG%ZFS1?UBCMD-iue47s`*mm
zph1oqotrE#4tC!0fW@($*{2BRu+~dzx+h`+k=T{lU@b<vXG)sY_h}X*D6jn<6~Ru_
z&jIfqP2~CF2P82CnqlY}5TeQiJzcmQ<WLnJhT|i`jm|*m4<eRbHux1Ak@40;&8b^=
zeoYA;($hhLD1!M((1kD%<uE|d%*)dK)a2kqKSAimT7tS%Y}pJVlx$FF;{~!Ee@2w+
zW#+ld-x%_}smp_n$*Ww$4_Ifj8)l^q$9l)7+x!l({Y3jcU#=~<Kn&;{BHC3bN5=Z|
zqAsr}*=meXuqqVKTttj8xOqZ3s7WlJDGgnV6ZjgtiGcquv=wb4vw+UIf`RLv)2!u*
zumoE_>QY$jL*S+$w5-~L%8#aWU@T}(oo0pq^aE0*?j>GC#5ZQM{Q}qYUw-c&rtrw_
zumU6LQYd<kcAcB4Za?{pu<hGbN*5~>y6U^rkx(7%SSi4nJhe0ljsN7uQJ?fLF1-`J
zirtUI<O@I9%rEH}#{!!m3w$$<AJfEg@q+6$Q#}tJjC|vnTMOuop=V?h;JU)!kHwsg
zcyW&9RJ*b{BsG@q-?ToOy4w7k?v<jPNl4F?DjCBxAtdc7K^;|ResH@JRcAR)O^_+|
zzk3{_1zqVU++Z6&B&dg_O{<Sxuz?8H(A4RmT}$18XcI?~Ox09RS>`YcXBMSQf!I=+
zUSQGvlaI&|MP4BlEs=cvYBcx{*3QSD#{AItm~cUr1?3r8qbpkHs}KapF8W0%H`s?n
zxA~5Lc*f}4M{<6(`WbCfdzu1C6u)u*po5_>w0NS75KP~z!>Gm8W><!ZnA>cpf1B=>
zy#Luxp+8p5CPLY-NI3O-&&>mDZV+(wdtzc@5cjsX!gp4@hMFJDblcwM$9%n`F)b6g
zeB9el*C(sb!!a$~=-gE3ClDrF@ZQJo2<9>OZg}D&9{8LyCmAtc1u@PRD0E22b`f?-
z6YiP?d*YDR_u^a%)AW3s#hS|d_Yt&snE<6;lSDc4(nw{EFRiJG_q#odat~s}EvJK4
zLk{E!R-%h@0@31?pSjRgKY!%VWW6X;<C_(u_TiCvDR+7Lv^=0VuBJ&Q=(HTv+4-Ps
z2RPf9Af+?E_*(7v3yqHV!L`<WT+U6B04>7)nZZ`Qgg*6(=G(wsjf=*~ORxRKLWSh=
zvaBXt=!96$Z9@s7?SZUxPPZHWYSOifXkJZ=5uMu@risp05XSP`mW>sJcPgiVUQ@r#
z*_<@_1EHi-!%`y`%XJi=0}m-_pI9gIg(idz<XG~y0ciuvD1It^$-oufGjP}K?ZIj9
z3zrY)6b$?sd1g)i>3U#^lr!?FumQ<29qXV=$E&OoJ2+Wob0|FJ=TE|%ftFQ72LdZ+
zx&Vk6jf!N;hNyF{Si0+k;c}iKo>G2JYJ!lkU1gYg>@Pw7;lml8zGUU#3!$G3N?`M{
zPkvULvEC&eU<>8fN$>mictR&T^-+|v{7F#G)8xkK+ts*qh^gzvJMe?npMOTR8ma#A
zt}nFdHbi`Y2e-~-z;-d!e(i&YC*q@J&@FD+O`gPZq+zK1Zuy@VLdx`1kgx}U4I>I2
zcJ&}cCtp%V3rO%0acFODX>|DcbWD^5nRhCs^Gd3C6qO-{r#}56s9JDkaOAHIbm6|q
z?TGOv4iak6O{%=58#2O~-C1#m-)bo8{61v8b3*eN%O%JR$Nb)T{IPOIDgJr3@ANO+
z`;^0v>lKF%s+r-Vu&t2*PLx)($RU}sI+zWpRIh9p(5!jIL$&C`28?lpJBPTn;VoH@
zk7<bUs=!oc>KYyHTTBO@!~&SFhv0XT)}DqY@Y9+|4tZc<Y8))2t#eHd#nB%w8i+H}
zw?;yQ;J#6#TgrOEY>LUR6?w`bsl0_ZLDe{MI)b;J1hs0r3jcPlDRBO{FP8^rG2@*C
zM966cT><lFfxHU5Zfl4!$qg!2JM7?hB=~i@;@ew240^;0PR@We1FIU4<4kb~J;1n7
zYq$LL#ASTR<-4Y6Ah*9%cXCPQqJ1NZ7WXYzX(?&4OqZsEQ6Y6l0#EZ+mgBE9IF>??
zSYrx!;*pVpNvdFnj85oawkQXs7iGWVq78SK0{gWb?d4vHw?jxOmhi?ToO{w?2`kCL
z3NgRNS91}td8CiiKD=sN2cp5YSxn`i{pfTzdYLCm!b~xB_<kInZ*e-5VkYHqMm7dU
z07(l-G=#Z}+YjyhL-TuKDDsTuzlgJ)7(cLOqg($cV;_04YKHbkvwf0EfJ89PpZ=pv
zo_~GfS*z<F0V?L=(80j?(7~G0zqk(NudvG>;(;<{-f1biwet~@%4DqqR4=aic)wA4
zu_=c&dF*M>5m9}@HwLuNH&MO0dRm*s*m8DpvQG~vVSFTsq>-T<Kp5#DpM)R{c)00S
zWfY@)=Mp*mFkMjU{owq)lUF2i7ORyZtDQXF`Hg$$w^eb5wd>Q@8L{(m^j1H6u8+BH
z)6nENAJiK3DZ-jfKIWz#g)M&z1+3czGNITNkV|fBb9k|QS-M(nvNlVvr<nU)qwIau
z{hHrbz-Drwa{4WZptL5>y0hwy1r`3wLwJ3Jj_RLPm*v%@r#Vwot3utQPr+0oUU`8!
zV`23pG*<_2Ym@Os><VhS#HhZ{8;`FXAvb>h4-unL+kkKIrJ$78;K?k0n`d5W{FyY<
zuAnVM`TM*s!9V22pCT^=8prok!E-g56FOMxodN!IDMH=aisl$@Dmfs%!6=Ghb!oQ*
zQNf?=CPufXnvrVw&*A!SRR2u@L5XcWMLl|=I*;`zsa6G}iJ!FeKEr3oTt~a#C7I{I
z(Nd)ei`-WNli*hsuM?_`+QJ#+;@<e~M*v~XoAPfc#5q4DE6{5!2I3?Y{LO4_S&KHy
z)C*D1b|$zF%elRdm!kj_0lIHwstWfHG5^+t;SXvtYJ8$^;^6?+&d=pzwqC92N4UdK
z<nNjn1`j;%-)jM}(k$*h7_DnCv1bhqN8l{>{QF1k<mBbz*}$~e1%RQ)$G>TVF9z{d
zRB+(CwjbX|goctG9*vpWTnE{r{~srsAlB5;5t)NSN>_h{Wu>Pl!rRQuHRA8`gTUyh
z69Bu-?4@|e-;PZ{fHdxTFq`kO_s0<IS}l%CED;!RzPW1=KdDvt>TYZvLVx=UE;H}E
zTfK^N?Ja(@^99Sq#Dp$|2hh;HEh+#Wl#RVTN6|C|gB<o}y5B#PeBnp)4LBwpVHh@5
z<o_zPKSl`curZOW{7B{kOYP*e>G~{p_z;vZt9++GyMJ7#d|!^nGp!YT!3d4d6~nN3
zbYAYX$F31HyLsAU3Xpv@-e?VD*^kJ}qoqsfpu0N758A|CIi@I?g6vqL$)!b*3RrTr
zzAsN^hAFD<{w)QdF{^4A@Y`FaN3y1A3CS?Q4oyCfoT3QS1-G@X)*%GKqpQ{bb?v{d
zush?HceTbSh94SYW2UD1@LOV<WH@3Knj7889fmN3myCK&lkZ(u{~(Wrb9FglFsOrH
z5%M(_+x+)l0Vkd_ztI07B9a$Z^a0eKy>@gUox3m$(P_ZI^im3oY2&{RR|4M-Uu?nZ
z8~7o|H{+A5JP_$GXbkoDq>Htv`&e1PLO>va$^V&_C*Ruf6WPtphc}NR9L-5TprS`>
z()p!sG$(jRZO!_pYJZ2OzDH#Iw?37Vdmk_3Y3vaITvHNYRzp`s;oV<T_zG!kY)nuH
z1V&c9R0Ou9LOWh5!tm|d-j@6qUrLc*2E_=_a-~^iASfI$>U!F*{9!(M?U1II9qM@R
zWp=QwT!8q#w!O^^6mEOPj9=lFA{@B7msTOGzsIwsLKsHm5Wgcz8T18zM$^x<oj*Dj
zE?G!6Weny>A<4#RgPaGG{1Kjlg<|>q`vP`hm!&oII9v4-hezLTwKW>C9Wmg&vI5?b
z(uBss18LkQVOkzV6^LrX7J6XRJmcq_@ZpfoFKh(1Y!>WI)`>zNvs`zpQC25pmU*FA
zK4N^$E&5VPoow1U9et3UjjI=_<JPu<=H%qc#t^>?qn~ZBU7xeCDIGBB*o-nU;vZFh
z3UK=DrjtQzJnf1ThJOHW5<751lqX#y*Ld1vq;Xpecd(Hj^g@=gokvms^N8K4c8uff
z)o&OS+h+kQyLyY06pMr^gl^T#?&vC4;b8f_<M!~pX9OGRd;?Xb(zwRWmyqLZ-+}`K
z&+cL!4J6ll%D&k;{2YvwW+aJl&Xe!Z&=sl_`}OH;13rY(h0|h#2zVw+()X|PaWEJR
z$@ZacgS9%A_B>c2ud1rzI_I&x7!qxU$qMy#6A4jw#B45|VOhgdw#>fQh~qB)dk@Ze
zm4r`K=jkVMvsbfz&)xA5u6@wI+qP@?`;*0Aq-jYo9o=c5yCA1}i<=BsBbU=@7^Mt1
zH#1Yx5B=p6UT*T=+?T}6V!rp{>-7y*>wIzexhXR=r)<c;m(mw#PU|ja>;?I(Xlhil
zg(Vdpft8XGH#m5L?ZI8;U3QkJ>ja|P<Q7;(A33<imYbg6IZzos4ciQyBF^MoYH!fh
zzDif1JD;xiNwWK|8T4Kw^E?~~e&;em?F>*X+>-N4oA@@`IDC5w&ultL;Lzbp$>p)u
zuI-ZmemQKz{|50<-U`IJ67hF>deguP3ZMlrxa;y8&HME5rr>L9w1DOv*dc@fPDvbW
zK;xTlJ5>Ox!el1z`!(_D;|kOV^8F1e4h{}oaR)9WO)`?L1RxpEUA~TP;{EZC0Lk9o
zo{lLONmlwUf)#2RR>41`_hTpz*Ve`5-6}IO(rau&4L8;RP3b!ba9ARZ%jl+2zroJ$
zCnjXg+=<{--?LV=VY;)7v>dR=0zin5nEaY=hU@+NAiZz6nE#yjz}T=n9lry`i9tl<
zQSj#PFjgpGS1{7+u<1_qHZMoIl=t$*8gxwbqEdv$^sX1X>U2cnjB;h=L9JX*1=y_G
zl|K?Ra3ZO>(@$^RVL6FPD)5Fce`NvT07_pdIhrG-=Bolk65jCj%z6yq?|;LF#}->>
zF>vPSCg2qX0XEg?uZ9m~LH>7I^5rzVMF{Mwws0J5LbtL4QN#*1*aivO@M;BwY@CTy
zL!F?*`!a{(<pk!C?R8L>h(wq28k%SMLk-?#@PN*XPQ{=Tl&&4hHGfouFcvrm85D<f
zEcc>GD(Iklm$TaK4nVX5(|6w4!}^+Uv3sDLN?P`_f#NMcv@XG9z@87TuLL>Zd2&|<
zSok#udq%en07c8hqzmhoUyLWgWM|_i%+r{-`m(^KeFtJMcE8iwt};~f?>x-qaUhKM
z!$T>hA<m09-^~%PQdE52-4yM?1Q>=}kwS?br<1Iis8b`cpg}}tRrlEJs<plIxn~oE
zziHv?l0%ha<G6r<g@~QMV`H^|f#!WtZBC;(m1ASLfPr{sRrc8I*b0-(Upu4Ihd%oN
zm0_4gC<FV%5shDk$MLhi+%h-XLF74qFXR#kVsh}Sb?U-z>cr=c7%ORxN#iejxQ!WQ
zO7Q_o^nld(Z{uX1q5P63AG_f<0y-1)n<+Q}7=?=wICY+#!Au6K8{U?rE0Chc3cfnD
zla@Xm%7q;=ZursC?(0?i&VsNV&pknHRpD0~h2m!IJu=0JtSkQ~MKHB-{H;)VAwq?_
z6W#j{OdKMYGnQ@Jy5s&GapC!`*8C8!nKIFALNYJ~w#2hQn}Ogm>bRPa(M}?$98DP!
z<xF6OE87~sY>;&*m=^R24-zN2ps<j`Uib0J4UlV_oIzE+5#YqlMA&&5hVBriiWVol
z<;dP~M;~#j77bDHZ_IC!RRr-r^!3zjGeyIRAzFv}cEo$1ULj+qIj&JVd!*cz8CIiY
zdFg2~eeceJ{aj><F_S+sp4^+J7>}TzY;|Dza47R0&L%|_wxb9yrhuf59^4w;qJC<0
zGXzup)am|Ln5f%u$4T6D7-=NMlCSWu1tENolvJ6L7pNAV9V$zwvv&;b-V+*r*~C^<
zX;MjGh}{uNfK%sgHk5>8``3u(FZrO2kzyr+StaWYCufy(a{E;Gte4KEo|~qeoZN>4
zaruye<d|yHYH<^)sTQ988exoU-}@;qgwjI+D2kEhii<RuS@bvSkHCl}7S=&khBEvW
z4Eus&%(&Mo>s>cyr2hg@tFv$hr1qadrB9Rdx7G6^;CGdRM-k$e!PJ_4AO-qA2h&8#
zZIse|8Z+=ukCZrPsDHO_^EJ!E5yIz0Ilk?uk?f||aN;s88y>F<O6-V7+7l8ZFwlEt
z%K+6AcV((?;L8YkUJ0vVHInRuAi+zWKv*a!=k?{DUt~jTjzpEh-&(-@(5xx7>8cT~
zjda|dc;}fp8{VBBLQ7J>ak=+94fW$sb-v$RpW}eAU+Ldlf<=J?x0l!3l=9yZfIZ=-
z_;W#9n+S_<(fG^^5f>L>B5rne_9<YJP+?(V`5-KO=6yqYbaZsPMDMWoK^AC!Ag1qV
zW!3lP%a<sCx9p~`tJ}4_OlfUxorOaU3i>~j#D@iPu&k_X)?wgADEJNcBb`9JcMdf3
z=*W3`0*TrFXr1W#;tvwoS}Ff5p+#482US2xOd^FVL1%I(*$MWDK%x$JG@)R<IJI;U
z!&o-)C$YAtQJZJ#*$r4)b0KW5I~Od8g}%A3Qhi3}pHT)Yd06;Pgwi<rbA_!92df>Q
z%3c{t=a*pCmo5iULDEp~15Fp^DO^M^DH=EbjSxG@=j0%Jhme!lxg0k7oW1ik+!310
zF&}xY!&McC$%3ErXiTQ$rM`eImhmO5$zsm<!O}htZBVO;Aj#bY@_DrRwazYIMOYnH
zb=gk@zF@Ot?6^3p4z>FHo{|=SbCO;d3GveaP;(_z%0naxSCr!#TW;oRzk5ViZQhoS
zv+HLDU0J^*ATwACjgko7B*@`&_+p|5#*R~Qar5Xx;&WG`ZjmQ6c9Wojlwzub11)wZ
z^ZiEHy;9%mHSgjxK&cjE>daR^Z_e6=ETaqqju7mHJ@3lhdhKUrnX#*lJ#Y7}#NOTY
z_2GDRArr;vpHsMv*jM09Q;bikl(mh&daW!t<|hT%U@=%grRftGNTMmVB02(MCEC1>
zYApt^jfo?$)eS4c(23ZkMPFx{!dra1;<(8-qL=wIdd7MPIyzKb7@P;f=DuutDIFTV
z=8AVf45ot$k{P~^Eyl2;EOt!|5%Y=g_imyR)jBNjF8d&GGfOWe^6@W|89|@x@!u6?
zApYZ1Y7H}p!48sY^xwm)W=?Mu!9u^}|KuVr+6&Q6hSz%n(Q2G8qy44@8X(^A_0L?O
z&!!<ULKp_-pq#XL9FXWTE!$_B2(A^Tnr&&i9fo<$d7r~&QA1E;yrhyZIzQWCQNYS^
z)j^&6IUTi~v7p%jp}xh|a06)i_pc(gzx3G=8B*bx0FykvIjkv9(c6R64L|!_8}f|8
zM>*a08iydy^LlJo!9R9E)Rzu%#qD6?hV-{|pTQ<dU>DH|17;%Pdy<2mopqf<V=#tS
zscwFC=#yBw{+p9xb=Ipma-`><#t1>=_XCG=X*}0cpumsdY_~2rk<RHR_GJA8swMXl
zwx$7p*X-U`#MJBlZ(>p9=gT~PH+1ihy>NfFVM%Uy8EEoPYXSQO)v1B=^Gm$fIvNzN
zXf+2nONho7*WjleWjs@4(v?@?%I*^N#x{t>@1i|77y)w&{?L<Mp4~SWHWQ)UAjjtH
z*W+XVA_vl54s3MRbxfFQafyoo2{u`UH_mnk#ASb-M6bb0;ECN<J1ql9aG!$tmuqXV
ziqFdC7Nzqmq4%-{ZY%5v-WNHwHtJuNDh9-$Ef^qSBJAAr?s-w$--~G6Kx?9>fR3p%
zQVaBW$d3v+{_H0<sN99P5;$&pE=C!wJ$sQ}oWctI5vf{s+mHGtZ+N8VJ^GZf*b9iw
zMc_3ak=>n!NhI22Xjs2wEz4Y&)H`NqSa`;2=X3g{kkvgn5}khm>Ca(?E|8G>Zk=C(
zV>DO4#3<?Ytg_p4mrScyHsq9D<Uzw-2RpyG>Psrzp69854HXpyTsw|nU!MZ&!mCLk
z52WzB0n@GZ;3vMh_3afR!?4dkwV3EyO-GVG={6h?W;r@_-zE}l#~(uOQ@wWe+fd2v
zr|DiU7HXsn*EZCD6cA=6Fy7lQ%x^LUX*-FBOSNk91gMedf_`^F@%$$Xzlwc3)J=ir
zklEQzYn^lxX-Af$xVp%2fjlV<KSd+{<ISuv>~x)uztpPMLSx!jEk3afPOBmLmIX@u
zX)fo%m4KAy*|2ux6k+It4x8#riMPATtVGiJ`E&Z2!FgvpBpkw2CVi{Y*k9{eFE_i4
zVk(>S&HsA7&cYB}__bkkr`A#1L^nBtqT}>cDpfnA;}YE+UPbjM=UO>JU0mN$)L0+m
zq@@`1TD7%jLWx`%9N^t4hc@x}$6$H+DDI$bd7W@&M){>3Cv+(S>6sIB=7i1o8wjmi
z+Kz|+8m~Om*N1z#!Eb%w9ic34+71veMkq!r!J4&2<Z}ua7K1Oz=0qBaOw3G3%#0QK
zM;bck@k3JKKtc9D&L0*@yZ>|(GCk>_>tNE*V{Ey`>o_7a>eVv<+(&_lLoEAYiss|@
zXIsPJ#8|^-(h&;pn!sHX8>xv=cj(-J=~a?_D_;RzbIAIQ_qEdO?t18@w-$#ET219<
zKh<(AHo!LP=Ggz9ie-!Oo!bCo2gkn$k<swZ1tEK5loBZD92GpMU5SKlnX+o*Cc-t5
zChrEwqP9LoYv_Z86uh=zzHTfbxfB?J?iwijMh&!C*co(+R~5}J=pSlNL>OB#CcS@k
zrHQgCFVSsKmlY${3o5#aX8b{}E=)3bX^1SG?BHu5hRWF%EX92!tDnVD=0f%PnX)_}
z;;`#YFGk^qCe$A03<jMiI+tZ&CF8h;#Xvs>KgUX3ng3IN*M__zXAC=^7irG1Oks4+
z0^UnIG-t^f*yd>vd#v^bY;V;zQ89#GDN-<aq%^qa{u4Nf{lk1G_iyqUx|-LRG|y^;
z#=Pj<0+tzS=fzl))q37piwD6ZIDuvlzhmZqonZBQ>_#!v>%f!7xj-!#l{7-Jl6-dM
z<jT?m<4bG5pYcYUmP012@~k#^Sat0P7aNVkxv+%0&TVn2v-2MGpQkRj;x)nLWOj`X
z(^QU;!Ph~vo=ZKsu(4YtmOQqFpslJ|*8w8@m90YYsmfzr!>m^H4%Du^;CmkPkQ9Bi
z|A?EpTEuz(MU=e%8#&TgD7=aHw>JC2g09Mx!p{A(x$+PD9k>Ej=b=p8GEgAt+P^Xm
z^?WV_Y-LHLzPpirgdTpNp1$}-b!IJkX^R_CikrdDeq|&1L~WQK-nTu^(y+h5^Kf^G
z;Y8i>T+~)dGh4azf~Hd<CASn+wEa=2r{@{knbCr(lLaJkKatHiXt!rBzTp;)vt#eN
z8>mxfPF8;gaSW$&jx<$tBrj^omh5j3vHr-#5UuigS|>{JhhkF+BNUSCMhmEwDiK=n
zo6`;3KSgM&0A?N%@nb(yi3x<-$SVHx;>%d+gbA7rG9jBrn6pfL+C$`RZ9^-ARCvaI
zG~lm2uVRI62CsiENMcevs}iQyygZ#I8e#)2S(JnzUeFY<!;OUSC`%E3)d9geZ($;x
zXViuhbSiKv<NFMZ6TGQUQv=E<@VZ-}g-FY<L98JDkY5Pnr5EGY6|Y0Ns{RG@5Hziy
zGD-cmUwpy+HkeHc)#9%5Z*zwq89BdWhy+1bY?w`+_lq9>Icb8N@sbz1M}o4YP8OfQ
z63NzBJdPz~aomgF967kUPxkF^43Sb}DI+lM#WvvBno1eqNY(vKFTDBpk{DC~Q4PkY
z+n9nevHNDS(n_kC@-_2>OITeFTYtO=_Kp;+%n2QX8wAS2DJvqeY!%B9meK=rR|U)A
zXkj=HFEh+HJ<&gKQ~VV(RbI9KS4kCqxgTdglA1Jtq*OfuDdqR4@v12}>Bn73fJY#1
zu-Cj-$T~JpOC}n-e$B+gy~jhtuEQ}VRC5EGu4RAkH6eAR6(QO#GFJtBnlCeevt(g|
zyUjNok57TL_(%GHuw$gTp4+mwGhu1!v|piG(vnhRJKL)+*KWA4PCASHyGAHKG;N_%
zXE#J_d=WXE`x}qWpGz*YwjHH273O`Q#G12w8_Os1IJoht&UwpfRR0h;m%{`eupB2j
zRs-y3p*1h=XIs0HVan$OaKs1h&>1pQjohgD8h;M<X;A*bu+*4Q3|I1e(TBEEq}-L0
z@oHxm1-O`TI<Hlj)}7?&5(auvGdbZw3R~D*-bbX4v2XIR-6=b;uV{z<&>x{34(-UZ
z0~R&HJpGi0r%-8nX1rfwIV2c@GnOtgGtzZ?C|`)}*tMP2-#7zZRs1r^64l^!-l!?p
zDUfTRSIa5Y3?@`DM4_}W1Mp-J0QtW!ivt!D{ZTieKVbDNCq>YjwVQI1)8!;kvMciH
zb?Y@*PB@;{9(TfvU=nF&u@=NUM(rxwCbHjx(!6(BjV#Q)4L_P1iKJ8n?s>ed2M{Ja
z_NPAq9-)dis_-L)6!yNRbfOB-%9sWA2j9UcRqmQW%>+PFvBL&-LV?yN!%;5J7wwKE
zY6LXFWi9>_^{nxNehC8oW6)Tm`_;9*v1@R^Int}+k+h9FXNfy}V{1|z`4o<avn>qn
zQRU3}SFGtIb&!mSlt07M)55Pa3w7Q>pJ|V8QL#uvuL`}*hsw+tL0zd(16oKHu&asf
zSZDKTPk(%!CpQ-imR+}~5xP9!LpQqPmKTKm)T=K^7@n7JD1j(zWDuLycoZ?EB>wIu
z%9{)HzY$1~RJwMLrr3Qx-mnUn>(`+8SbeuUmsei<`h7N(re*(fXD@96NxjJ$Yi$7I
zFmpO)r%(Dld@P+Wf_pa&H<jB&%-E7z^>cvRyT-oP3luYQmiFdbbPIO>+fxMS3Nrk=
zPOg!#%`&D=vk`a6>by=_fW*MEzD`d7gTjih_M-q6KmgQb$qwWH6E&F<H^9E9TlqaM
zJkH}k{GWNc$A|w~j?{U)BUX4V`L{aMMIbQY1H8}qzpDE_-Lhh?voh7csjvNJmOmG$
zEGWL1_C<-Xs@pS;b5X`^OL^P^(3=e4-wm$NKl)+Gjlyn>34HcnndbrKfSv!kU!AOo
zj{k?-9nTiYYI0ufuQF)*;JgBj0t{3Lg&|v0(;&c8=(-Oy!ve%eSpZPI`~P_g$AOfS
zn;2jnYmOFAuuLo?%nAXD%eS3(-2;LW9~gwp(I;|yi=Z?V{082S3?PAuPuTqVFp&@T
z0>IP<tTx6Z0mEsG7V89Ib4}OVx)7VzJB<R!fNV>Ojp@kSL0njy3;fk%4qkxFuavtd
zTBb0;>#rD_94RC%XV&rfEBnq!8-zJECbZ%-pYyE;;*6%M>~WxtcfOYHvkDa8Wi-i1
zjCYocWZ!HTj=14fONUYJF~nU?&t%XdP>lT_R=6XTXk?B5u_wi(I8`uL)%`}-C>cWJ
zQ9gkC1a-0`jVq&(9JwufZq0QY?Gh_Ezx~cVUeGZZX&D*b;3SBwy)<gpe)$qQUVC{O
z^3FbvKxJ%t3+68LKq1Dm7dT+pZ97I#yJY$D-lzr+rTI`sQK11&H^YUrKUSlYDS+{K
z^vA!Sfp32jZ&BCCADQpERnZ7za!1%HpPN;fX@38ri>qkWGimMTGp)b6p9{0_;Q#C|
zVm79&x*JOqZZq43_`<>i^-Svw6SP0|Kl}m80Zl1Gqv@bXn#^ltJ|CU&S8grnZ0EjE
zUa90#Gl8z{B}xM_Cx6Z9H&fL|EV<$!s|DPv__rXoxjmm5ppB0%_LoBVWk}FZV3D~%
zSlQ{_yjTD;NzS<$870nNpSYGcW3GaAI`(Xo@?fvcQ|!v8EIO&N8(QP*(<Du>l!5lG
zBAC48z0328GAYHszV@~~9q`x$X4py^-SP&Jtu9*2aH<4OTleJr6d6VbX1^O|AO3<V
zCgOyI8{U^z8SibCD>U`Wd%QhvcEDXM;B}fe`9^snA&IyC8VnmltYSz~xziv>5MaxK
zYGN+3V;Gf+)%aTOz-DIf!8C3f?ugMKLV}$1J}FT1FM`x<!KorWMZ<RI=%g8PQ`7Ua
zW?uyy$EDxW_p_Wlf%igMWBNo=OLM(g49xOpk=MrsZX;8yMy>4R-r12G6x;bSF~@e?
zAQ>7}7KisZ{5onh&bLi)-IvO{ri`f%l$E^GTC{91#feakIZP+B#ou2f*(|Yb?d>tj
zcjbQ}tS@cD+#2p(;i9z8I&E7H<K1H%@RhyGcf100&bA@p?Id|$<Mx|<JgmMC*w0&_
zUWW@FC+)QPzZP`<$DEkmHAb-~1wN%RRDToC2`!U|zY49jO)`d+7e_z{whZ3|e=v^P
zh_twTm+Sg1>zq{X!0ebcIOCPvu#inyR(%9P#E_7ESr^@Z+~=VW@@o>Jqo$O!wVgmq
zwq$p53lno1Q6;Ox#|X~%WgpvJS^h#Y>gduXmHD_p82F?Z{ITD3X;i7L*(H@{o7#NS
zE>Dk7pQu=(Vj<~DVcwtol)ylJNkNdBn+;}xK=@&DJ3lM+jfQKTY?Pm`4ZH51I{HDH
zu-t1=>Yv`I3JB?irIF$0CXVo>QR3k}5pzw5!$#M>CuH&fS;@LjVl-mEgBlu?e?J7G
zsXi@)BBPyL9R*^X2yc;*8Y(6sWWRi-hdbt>C*rhwel^PvCC1h`sT>$?)V;Q%(~jVh
zt}6g~D#uKE$|yQ8!H@ctDp^jeaHv9CYM4#$7EphSzf=tTHW0RSlowM+3az4Ut*M|W
zMetJ0hfr6zxR1R6bdv^V@$5DcoVp?v93|YVBaq=#1?vPj)@q3jqb|4=Ngtk=Oz^v;
zMm9ORB|)$)tR^8nqETdgMbel(kGy@SaR2#iZJu9hxuce3><)9l$lbnD+z09FIdk$H
z9~|Y2xkFfbhNya>jOzYIm8=+kuU%EQ?TRB|iC|4gB?`Ow#hKK*4p-ti`5zAONKKvU
zzt6+~Y=Ih|MsY`C)~<@~*2IExzV=12J-_OA#5}K(gKr3wTBIpdH&&&z)I9PMbitby
z*Y9`+P$?X2SBqJ%!7Z8ZVc1Fo`lGUs{*SeTwfxrE&hpQhRQ7q0J3jmK)$&JiG#bNn
zCJH+A_%8Y%%?N{eUW2CnUwAf6<1&A92-IubTuH^AkOwI4KKRaQ-e~trWl>LT9%EH#
z0d4{zGaJV^duy-3r1lTdw%?=!*lQzZaeRs`3QP^^BdnVp&Bxm<$9_Rvym~BiR%>@a
zgkSi-`SxTEc$k5os}X_tr2pFEG6_@TW`!`5Gk09F#YS{mnHQA|RC8^5y0<J`Y=_<$
zc9z7y{cPY0XM56l-rqvTIMMCJf9lMzcE3%9WXSCLjvl1gYmz6K_kHr{tG&9We7bEl
zaW4o<6Zh7Z|FzTg`|stDP29jA6M|dsvzh8J{k~0DCRqf6SE{V#>!lqXQ;6A8qay$>
zGbhSPX&|c6Ds>_){Iazif^cBt7Gb<)&!_e8mmKT=9AmMSQ{NnT^g;hJeGoENp)KP<
z{th)<w*Nu!c*?79bjo(c^BtNq7RgGh&xU%vkKi&hPFlSr$2a{}9Pdk2H~7||4u0_g
zcER&laHz0_YmB5?6eG(oo_L)KHf$%ukOC`vrq=jU+Jg<Me2Kd83#WOxUwe+iqMu*u
z@RCQ9aB~$&v(jQ$mzmnd+m&n!Bg(O6yP|I>03mPF-(ZBarPw>8GRgPwI_;m@Rr;r<
z$|_fX)@ke{q@?)mr_1m{XM}$0JZH{SeAeu)P_NYI7hZtg0_6TJ=NDy#h;6?Eic2p^
zYiKsDB>z)14p7aBNV`rZERA=jC24I^4H}*xP?-_5akn0W98QaC^-;RM^S**g3hQKz
zmM66oHd`NkZS7}yFyzfZyyxeKe2<*Rtx@A^=)MC1&8G0LG_XfEYKL=ihbd5Ia+$uX
zzA{Ff53<56G|TGyC}bWe?ASn!VOrx^Lh!9E2+($iPDhj$n>bP)8wk9wj{k8KZO+%4
zg(fH%T<lJTV$?_kzmilrqivtSV-t`adfmV}<bQt!$ke-j@L1ej0l5*sOhfsJd}agJ
z&(g4|8WV9q_wt1cBygE4OwXi$eZda>{8JlHaHB!=!!w3W`BKY~bpNaJ89zPT-U<lO
zuBZ(9srkaoDR_MYO8}vRq=K|YtqWWdI1P|IB|H2??HTbQGU-gM4PQGgfv-647-rDn
z*YaO$dwHFFW?$6zRf!r^9j)jSV`Ity++C%J1KxLqt!YQk2QdKZVk7`~m12EO;Z>qu
zm<}N30P21G`Hc++fO{8cG)*UpSsf`aR-_oO^S`o`yFmwk5FT5o2OH>$&`<Jo{ED%4
z)*i<%aOk?z-*=$Nxf7`&<C|0zegocZcg_w^mg`dx-6e%OJEgbhz%U;g8x!a%#6`bQ
zx6T~65d|s7usMrvHfTJu@LS;smL|{B?mbKun$_5kod3hvS4PFr1=|L9*WeP|gS)$h
z;10pvVHn)q2@>1_0fJj_cXyZI?ryL1-FN@IUvF5fH9+^!eY#GaI#spzwlUg6e{5bL
zA5VQuA^)7%p7}vfM~EOsM_F{o>rYd5YbsK_asN$G$(%JryPyx*&WH89&N*UvPrkt;
zbbtbBR%m@RogH}ivmY|7L~*{hxet-~y%s;NCS9~O6A4qcQ*_S2W@!>!c!#o&=LD<u
z2jN>s8p+^|fyLSkoXKcuWn`#Wro}+EPskWnL9TxM<n`hm(Vv?VRmAsh0+F3aStuyP
z0MVw;Vj;f)-CSU}HGrT{Ua>Iw;`7m~ECzyjGnRpjOnAIpj?Cc~mwy#zxnMrB2HEJD
ztc$0cL(0OhxQEqonl+}f<Wyq%@p)onv!HOkqTv0513=3g56FZARJgMUKr|NNnNO96
zE)6C53GUl5L6PSv`0<LWL-`(H$H(3Wdh+uVh&8(aq=OVCR^#V?5Nt`V=F(Azjdn>&
zLJ<{K0RaI5K)NzNLGiB8$kNi1!}sllmmnPj$Mia${-1c|6p&09ur$4=!g;ya66a_K
zxI73p+Pv`kfPh<S8=&yWzXY0nRJ?DG)Hyz{)ck%3U*3>$*{ZjDwlJGa4ppFzlKQ1a
z&=<`(ohGJem!Lswm|bz6VH7e7Q;)(axkZ(8K|#?@DR3eWfa$KNIDT9NMgUi<Lf7iJ
zl_>=K%G5d;ABTXO9ari78a@iE0t$|16qwK@M3?G*+I;>%qhvU+T+c7-xbqsAZQQaB
z8yt_XYdtPG_>AX>;2rhlsm*XhxNG~=!W$8_OQ%iWn-KE_VIP%L^g3kV&j(>&#O~ra
zQ68@e1n!BmZ7a$gybJIfDllBe_X%YnX~>t0BZT!tnV=wpu6Is^#NbAC514fTI`pqS
zg(V2SGFHmu>~PUxoX-kw!seK*%*Di(XeC5K`dxgTHChNMFMeWw+`QFIATFol;K5L+
zAXoz6VB#qf45C1ngY+fB?r)>KcGjj^!gv}d6iqfCfJb=^R+>>Vx-?ZxX4H*szb7FT
zZXHN@7Gk}9|B&O=VpL^K`#yI2G@h;lss?bVuo&wL4u&8}wC6kG9KT5iX=oJ#d>vQa
za5=^2P5DKdOm|Skkr`6g;wx3N`rug4SaV2J_glZg>>+DfSb8F28#?aQk9XXHt_HdX
zg=cc|uDTq;O8ts$L4=FG0dzH%EIg#JhJjZmtcxwmkSbE)T-l}k64e@FgiDwjQzr7z
zANd0#dO-{p$i$u-<JY&vB|_POk^jEivu^(ge#$OHsVF!6j3;`&YgHXbgBVB2j-c#m
zMAhD{%1YO*`jb{b1w@pt0)pB*?;fyVhDS5mvV_JXk%tTO-pkizFQLL)S*SGj*0tJ^
zLUt(Yf>UXqWJ_NZ6Y?pvLqD_48H{_SJAe|V#v@@1fAYZM)7brH62$Jjm4Ls|-nDWM
z^!sEZhIfy2c0b=Na>)6k7N<;K9uOU*VF-7ql3p<IDJ({PeIJt^6T?BjyCv*C@Ib^V
z3GR%$d3O-Jd|T6X)po;h%U}|D{c);7o7%c@&wB#3-tHNr>dumDvk6<qk2eM0amQw!
z$IlTLPAU;c$H$I-3?s?kO&j|kJR>YFNsF1|#ypZ+sby}S6#v;S{lZyPqY@q+hj+w6
zo-r%v23hi2y=&Mw3;pep*t1c2k*67F{aJUjPgPjp{Q`kKLqinavvY1i?@#KAU>j7X
z0`n#%vBd^4&FGp#Xjq&fnL`9F{z4mox_8=b#45#OrVst`t%UCGvcJ(TWO9NW|7)dv
z>oX`v$gg(?1s36K+Xu8AV}q*v4|0kXLW5dS2w;XWKDS(0&zA=bs}uCmx1y+W6a?S1
zJ+MdOGK7BXi@cKV{foI?92bDkvk$a@Km%Y!YK-jdAu1J;^UXRE$7YXA;i)So3hbwQ
zk_+hpJ_W6~Sk7VN`@a~@4tPdGeHuk#szinY_|%OPR~Tbk1-N<MQEU&DrrM)N%jif?
z9DO!%UaZ{QQj^7Gb*BP|ijh0LZ++s9=K*x38l^xw3?JxykqzE=vZE9VgWlc=TrZh+
zL+wxpTKJgC(I%u=5m;G25uLXOe|zr{dH8s`)vY^U%7?e^v(adoTaQ#}2XrxSY|n(<
z^IWlh@bFnL@awrMnf0VTk}Lh<$C`}R1nr01-JD^6u-F7+@Jx^|7SbWO4!FFjR!<jW
zmTfU?5^{E=I8Q!zdt1UgUi=Qf;7ueu!sPSN@X9TLUegIX*syqz437fHkj@a}+wisU
zmiS~2H<pkuVprHbwsj)9_TWd%7dD-eAt^C{b&hcs8QvQKDD^9lbD4#AQ<}PO(c$Zo
zDvMI{!QgbOe);1!fM4159T8_TUsC>G2=Oii^{jW<&B)*fyNhS}5u0WDGd=o(N7@=b
z_H%UU-AC-_2*DJ{NFPaq(bq*XL}hG)VI-FRO~l&AWIEO0wo!!tFva=+xc$FJo=Oc2
zCuFw?<g@IC$vYm#B@_wy*FWg#7l02=Z00cZV>N#3<Q8>3aiQkA>j2QnfPGLET%;U6
z2fCe?-RT4l30hy6yuINdY&aT4O|g5|@xyuqsmEU`o5IsTya8~o@<Z(`_YRYR2i%vW
z$#dZ;$25{wVJTo5<^umYy8Bq@7(d(Zc`T$@viq5-V1sJw5A?{F+JVn{I$Y>ynkkfj
z_gMxH(rj^HA`0Pe+~6p#YK0Z<m8px~I#Wr7*`9+1DSTf6P=zSqfIo&5=PnLlh1|1*
z|FdR978C%d8`0h31Y&Z=dm}9}!CTMHI77h9eumM1d3uY9`fZz<4%`zNa8IJ3gpR^V
z0rP=A>K+!?oGNSrOazLJ6_e*)B_3B>;R??Vu?Yl*hl~|L>y*wG=~TzfO%e`WaO9Qq
z)-{riul+pBZf)?b<yQzH%>@yM1z!c>{pc(GeR7svkJ4*lZ*|NZ+SVHs0Ly~DK9Q3^
zyJjgsh7zLr;Nbm01x2xukBwl~ga7EJxMm+Qr%5WF*a#E2c5B?MpR~`u^}XaXj=A*y
zl}}RV#HZGLkeL_3+rsTdlz?SNANQY&Pl+d>W9x9%sckd-@NQtQnYLiUjc&Sn{QAik
z^)Xt}BRl>==h~#^A~9gCHtFpxM8pfq`<Vdsx8P4#)DBQM-79f~p)dv6kYUnz$Q6a}
zMf~-CoWle0Bb4!$;UST)RD=??!M~oePl$0UQ;pky3w-7qO%4}fHL+LHd<1rVNec2E
zXzngQlK{h5dx0ION}?A*Ct%i3&8GtTNNB~}3N+gx{7MEsfdkVZWb_#pYzqVgY&#>V
zXn&k{zq0Qsk?h3^yA*rvsmLm`2&;hDa&fy&;Nd~2h8-UgJ|=G&1DyXDh$S%>07-+w
z|HH-bza$OhV!`1GP*aBy=>Na(5|pOeeZ1<jX7P_nCb~j9J!Stsb^ht)os9ZxTfUtc
zQXjw`!Cn>W!siNAY+T=|9-tbbT9xSXSp!-rP$@U1GolwkOKBFBXyQ+_3sDMeELCh5
z=J-^viWZ}zia#|jZ1kttPRQ}CG*Z@R7lY0(qbT@dMA5vNK|B^NsJ-R>5WR0{LrZAv
zkWb&5JFOsm!rNf(x@Y~f)4G?Sl6YH8FiniOZv<x2lp$#;wngho!+EOhPx)^2)=_Dy
zNoaCYKamXZjhkr6>jf1|?g|9X@kFa<hE*jtLBi$rczzhECSA^au0r;zPHuv3sZMjj
z!^Ob+M&ksBi@tBdzvpD%qi5Sk^w-vQD>Gy)ZRigIdlkk^glctw3!?s(sgj^Ve(fxU
zQX#upricZ9_P8t2zI8NJY+kJyk)nk_<hWLnDjeluv^09y%tv<Af?5(eA~6f0;BjwO
zC-kgGvh^lh79BC#!{7qfp1*3oHck=^)I$P{GgKA*<m2i*w7L;cnG98iKgIQ8eKMC9
z8FWJhGv%vwr5fTBh<Wggi=$7-DEZMFM+R{}*FZUyMca~R1Tkd-dFKC)2q!c%MOt#T
z-OT*I0ypG<#Lc*@7Q@_MJ<2S2{X^)#pz=MUF!kwbts!1mhQfk~g4~{85xdg~lY2w~
zX46}}##+O?*z$$qRcS7)0NWb|+&A+54~+45(y2WtRURAU-l!;8a(WU{{s%V_y$CU-
z1U!<=qUz%5Uxo=a)+|xVTAkE6%K4@UG(5LUEwxfFLftG{2{fD?#d?Mb<`i31fWOWp
zPFBT66c`g@%vHTvso|g;8&TM(!O?M+LJeM`NZftHd=T`E$c-Zxix?m+BE%lKQF7Rw
zsMfl4L3ZVl7T<5QE^fS`aRDK?fc1wC?KZ0M01=K$K*8qA5ydpWL@^D8lBs#|02pXO
zk$YfG4Ww$G+iv6E4OI^VgWU-6^0L<lC3pqj{WTq(uD4ZHsG;*`C=+7{I2jZKt)2a`
z<Ez&1bM@U+EL`<#Ml8>6s11LGSs4y-<@rp4)RES)NJ0MX?0;}^M?#&Sqvsu>|Kxb(
z>ul7dJ*v8bKYq-g!NQ>F&0YtMw$I^<w@O_}sizX@jZ=8C&gMeNsgH*g%~n-B&5<(Q
zJ{xro4_i7lVexi!4XW3p!x}gQi50n+APhc+xQeD5>`vXfy1Z06+cQ#x(eSku^0&FE
zy?H)ybkZ+r9Y~={ria*pL~0T<4I_@IK>lA_)wt9wRgt#?Llf*^uQsXV=NU6S36d#j
zc(AGX)F^eoid^MU>Z~17^R*!(1KuDUD}C+o@Eb+s4)fso;qP9px)Uvbf@!B#l~cY7
z9&_nfsr#WKw%uzPHQFDk8w+JKe8N6CYsWLa`3^x%Gi3|)@SLSVo;^AxhA5255rS<y
zj$o|2`OaiC+eJ@Cjl}H??>3kkxtjdb_PZB@<3zlysRd*7Iy1_td`%}rE-9nGLAZn2
zl7aJHx|h%8Goyr}*J~f1Y|#nona9r?Bb9)F!WB&MH+XS|5KT}a++Ep$ledj?=fl#)
zp7Ss2)3}t4nWPx9V(vgRhZ;B?S5^UQP|_{+gAe5r8Dk0xb{Kck&|%R|5M%z#NE&)p
zb~q0?pWtpNrx}SUMpiapyM-kG8A`a4vMU&PW?2SOf&W=FFf#x1s}Y(1J#Ff+&lMb2
z4G#n7+AG8;-3H-SMe4i)oGAhRZx%$<IfI{bgO(p7H$T)>A8s?A;1bMd&2C;TX=0-=
zWCTe5F_sj_BvIoi|7@*gCWlhS=)&LDGb#Cs``zha1lv_uFyN#Lv%U<cbGlO-zoC^G
zG460U%ive@Zqp1QTM_clCWS7<{Vq$7Z}868^w4W)sw(x4sO2;nJM?PMBO8ih0|`ZW
zhiou}*>`}14wG%at>r9J3~^c{K;t0t+{5Eas7+EUPHj@J$&GETN-Upko&WXEH`7L0
zt=m>Oa2m=0#W5HDUS33L%*bF)ISw#bp#R2RLXJ;xzDlD~7XfY~TC`(@y~J2Qz#u5f
zWaM0ZHqAzyf=<Gd&vK>+pR;ON%e4tZif6o^&D!?1eKfGpQG3`ha&BIbHJf0%oQfgd
z<x?0wFT!Ip$Inn#)ZrWZVZ!--JGsQ#%veaKqi-y@MtHo9rR@Au7CM9J9q<jtu>E#r
z0g@O=xz81(I{F0RZfX9QF{Q@qZ9nm^UDfuS!5ilJdE>0nnR+m~MGS))BPvbaibND%
zL{CCUkJ7FYdpEcrQHv*1Or96g2h-I9f0R9`da`t`VkxrrxuaX#;mbe_>z%+82bHS6
zZ>x5X3CyMqw=(N@*&e{$NM&484w=_hX9XsBI?x!^OXJmbum|4Xa2Zh?9lG|tgSm1y
zO(Aavr*P~v3E9Wz2OjoEx&F<2;eR%fDI;6#0be#%V**3;Dn$6(J!TJ8$wi5Z(YFOU
z%y;y4<Zx_h9e%qtZALf58pnl_`xe^6<l`Q(UGN)jQap`=@zEhu@Ol(EEn6$6gI1$t
ztaJ|of!3Q1t`8USBT`DI)Ue^bIXwO7$zYbjRAha1_U#SpM-=|=(o1)oe|mJo*l784
z5$aH9`^zt!(uWWGxLSwyq}P<q#)*gs!R9Un^k;{sMK7<|!50QRO95jE!+T=i@4NRe
z{Y_gYu{3YG8xxq4!?>5;sE;D94VrA}cZb5bxf4!HXX!=Tq?nvQsuGE0e1aHG6zpp=
z8BUEz!^sTYG?}>Phrisxe}fqR*8_*6)fAc(-@CC%k)DNBOFx^8Zb2;G>-Tv;_b(h0
zlkp?3Z$yEemM>kvvonP5C0IAUH0y_lL)7`_d0Yp6g-jM5ly<Dc_KvPAgZ;+QqWlV;
ze0u*mgnzR%V#gJXRbQ63nk$t2HdAHqK?*55hsXozx&6da+z9B<xoGGLxoT)pbVV8>
zRbSuR)~!8}c32di+@ySLjQK&U)8zz_l+RgC$OgkpXUOj?7wQ5IGqe#+EJ9W?5gbQf
zx~+U|Ky49_mi#WgjY8=d{nUU$uqRfX=$TMtio&?IfZlhMn&L+z4Z&fr=U>c;dpBTw
z2r0L}d2hIK%NPnSI4ZF1%Pi@r6ZTsyaXJpPWUU~1)8ym-;XpD<$~XL7F>qIymNjBh
z40Wq1G4QeEWZ&o@ahO)6BUvD>NsJGxXW^^hp$ZD84z@%dm)oPW@+fmN1kk>dyeBVo
zC~%B(E6jVGyoaT{VD|%0zXDBS07Fv6N=crtN9CZUN^JICO5h_jF|xS393IP$tbLp_
z%_wCwU<n!h7X^l6(QVx*ePQn*$ZWXQDNs8kinmnjtv0OnG+5aE{ot+`%+&x!-aIsC
z|B?4a2tmhot~VTplYGbkUEIMkpVsH6d_}=n=jXvZ6-1K>_mEEjb7QA~>#-`b9U9t}
zU}Ro_+&|^8#o+Xkugq}6?v=6quX2<&htrFJzg7<qgA*tRf56!cB2+y88j4$S))q7^
zI=zWA8PZ1n>-jxYLpq(FSEa_oN2sx2nO{)$W6cKG+4i_(bx9`_Oe?uC<tiudnmvQK
zhSxw2*8mYiu-A)z9D*JFCF0B`I)A(63t4{Dx0^K_a=yhwZX)d{wcK|@nU3_Njgb{X
zA*`5Zjla8J3*{*hC2)<U2S3f8YiIAjI($L$C5_{68-%gc7p4KHDQrRvCI5E&;%-D3
zJzEiY)w6SNXtR@=TRaBP<QsU*OsPLO$h>K0jx#sU=*G!D7@{K7t*eMoWcW8^A?EcZ
ztnb`hQA+>$wpu;@%1cn@i@Mh_Wg7tdW2`a)*M=Z|Y)8pq@7`GJrh(ljJJq^?RWkG7
z<}=KHt5IR_%*wkr(Wel(%}<<*$MzmUg;J8`EmH_EIvn`|4NWK3M8TUkHQyn0Mcfyo
z<x04!`R`y8T!wWMgbYI|W<kGS+Ta<Ymnq(>aA(WX;<i*r3Z`bI230D#8fwBQk~7!2
ztOc|w2eWZkBdrGe-*OuMSn>}!K>MV8j}`ieG`37(F(x;QK7yB`PeaJU(`Ks`a+&7)
zN9YsE$dq>JpPA>H4}u!ERMI%FfXIuLYFx=ZBK-vE%}3rIS-2LXAs0KKpR~&tIut*;
zhrD??Z$#I`B^dS2J2P~h5Rk*hbk&{;5Z0<YzlXdrSi)@My35ag`1*LUH=+ID;K_co
zzMgS^wRmC9vbLvnFE8}c`qrc6sy`3S*Tw#Dv8T6vhVSZ$&Se4{ddS&dho^&`sUZ0t
z6EkHmi&Xx`$!UGyIaZu^P*p0ZkD@#4L4gap7i&>RseYlk?KRtG-T8tQeN8faI&CjX
z%$O9@jhIdiwylU8e_lz*pe9V1v1wF;x~2>>zD!-WY;T3opF*EHG^6+*f38&Qkxa0#
zJ!@JWdJE5~YkTY3V9n>^Y-^dsS>s%R9?D%GQVf-P;U!}`=jyJk-0u8DaYEjh*W}Qv
zp}f!VGb}-zYQG-FrQqyvNK?_`KKAF#cZGec`N4|Rp>smJPXhx48rDyqEP*Hv6(P8P
zU>}bTy+Nv6DdQUL=7bqzhIl5kz94pTY*HX{F)$DK&;Q-rks%Q-tF6wAT%gr(Ff#KA
z0yA5N>^~#AIa?w;e%=3NON%u;>j*wPJRCEN-*CCQ^vb3!Ug$9N;~-GO;!{%1+fL(P
z_Q({=M79IA2vT~(ze1>Du_Ca5$X~#T2p2)`fG34VYSWU@ktpOb_DAM5kMuWYr`T<H
zD%1hn0ps4hv_9To9(;C~aYy{%LsTf<Vkgv2wXiqHXX8k5paQM1cM>D3astB?mYs>k
z>tz(!<A*=7M7&MZjL{<HR4$Gey>${jg_;#k%obS-#dlU7b+Y8#xpMytm=5^=?!@2$
zXcR(@A^o<0_G-D>L`T4334I;r&RScAlP=TjCA5b^Pw4`dg?RSsb1;K#_IfISgE3{a
z#Lwd;5Q@twdogg1|88fx!;)7hS?FPES<Iblr9w{i*RZOlM(qA<O{Kl{WvGSE?a1hO
z{x>`_@=lI&8Y={#d$Rku&!X44;DAAq6oIkfckvlF!7-UZ6IJmCN7o;heO9w!Y;4*u
zACz;1aD;Hk|2mY!%&hPhaZ_Ai#lTkXJ_{SB6-<CBvwhFZP=1|2(Kn=z-Dm9o4h;`?
z^hSM-toUwoAu#hC>x~3mFn@s}FxM!{)-L$Dl=7v+Tio%&A~S0Psglx@>u8Q3oa~sA
z=lD(~oBS^eZRl!rOw6yag|uSH@Gmq~WHIFODU9$aD7%L=%GqQ9n>J7<gWbR*7lWvG
z0(S`U7=Lfa+q*xE-VmT6f*IzJ_?I<g)C<20nrc4xeH;3f{%(BlM%e26H!!nk<yt`Y
zPs+p1B~*jL$4JPwy^Gc^Ci!hU5OiP`OYTacBK*?@?(GO3`2wOuD{Id(zcOpBjm6vA
zXzcz(4kbWaE1(mLFkkZWKz=7BQ9=Vq1BZS#8;18PW%Il;eRz0)_oDdB-s=TU$A5Zy
z8cbm#e0fpZP_|xc=6sKZ$9T6mXWT5+%4dyTTU+}*adxJpU|U_)g44o}(b6I*f}Rk6
z#@wRI7V+H1?&5LjtdGnX{OEh`<#8O!Kk_({o}TrJMNn__r|xFE8GK7`KAuVU`xg!Y
z0X-7}f=`Nnc6>eomo4qTALzma*)bk8LUeB7E^jphQoq#ofIz(I<hluWO+LOj^lq8(
z+$@H5%zBt9%p{AomY*6HS9b@BhcvL)*VloBGZXTd!&Xl%zl?S@4oR5wxBJD|MaOQ)
zhM#a#pha`v*0w3rhYkp94&u>;?;MtsWPmn_tj*C+PmNzlsHiCo@CXP8R0!3+F+jfY
zij4Bp4TD;{9*sc#N`OyA+~ZT;kmA<8+}is}nYjtHp<cuc#8%xMvU<z!?UnSiRZm!n
z^&Y>hy{*>)8E@pzlBASwe%__cZI3oxb?T1{Gi{q0)6;NjCpGBv8B#r`Dyxd8^Yio5
z(-xA_(v+T8JCMF&dXV4<wG%XNfL&<%2cRe&WC(N_7IEek(nGXK<O7&?XCwsR)%Uvt
zu?^s$r|^t4l}XXtKj-bs@o=Upj?P&c9NwWz>MOSxOVQ@ohDY!T0|-t6fc7$Z8!=f)
zKNK)AUtQSBqjZy};_Y>V#un_gI!<@_pyn)U{U_acmNN8i+X}I&k4tK&x$>r1^-wH{
zEb$X%=$+n5Fz>ZH?AFg&)Hz>Q?ms;SBMJ>rk*an*(>}^@G%grl<ynG0lYSx%4;}Em
z5~^RjPrR4tv1{DXpK@HI^OWY$iym4j*c!E!SjR;v{+-w;(c@IRjG8e>I7FE5l;tVt
zsn214w@m(Y9vs}R3h65=4_vF+NJ>EJ5RzH=Yl$B|Sfqp(U97SL6WosZ&<-nD3FS}o
z>f?D91pA=o_`T~sYtp3BNz}n$!-vQ72{LDoUf?CmwLc^n(5roQv2DPfCrFsgqA+vr
zJ4NUodefiC;?`^?z>G~Kx)Ec6E?6UDU#*8cGk}TQWsKG}NA~UfJ<_QNnTOow@6s6~
zFS01<cmOlijNCR^yV;4v2L+uC`J()x3tCJV{5$I>vY3@F8Pmw*wJ;=z@K3&3u{^wh
z!ax$uLJ3++P-i^7+olq_>)NlteP*1n>}TeZF6qhZMF>!Weq&J2cwcx5f<H3Y9%uo1
zD8sxlX!T~waw5+YE(QQ!`8toyO=jYLs&am{9X$k2{uzCcF(CB*zX3#8b$=nb%g}A=
zpkZoL$YSPm$u!tf7zRv9Xuf?5QInmoptaFVDMGAuFXH`KFVoT|Qz~*T#}P$Uqb;dZ
zp&*ZA?ePakHjgTzk=m+}b_mDzRIWj9YQDnOrtULu4Pv9-;d}*1-f1xVq$Yw)d{aqA
z&Uv!MSk$ov^5jPqvX$!3(79ih&?MIqZ}d=Xs(vVYM=YX`B+~G5>y~W2kPxnyu$U(=
z6Hrw0x1y|~<9;1zp-Lzs7ejco+GFUVGy&OE)}1*9uO40nJzr=*ShKKdfQI3=$i1`r
zVLt4W8WWbP7lT@%5NbI>*hG6A?S>^%*lJ`-mQh=VnZHPp-szTNr6fCdAU71rAMbW%
zN16+D`c>>RXuc6`8dj$lJ0ANF)U%eTy3L)?H^G>JXRCjLbly3?zInas<4(#uPP+VD
z?ER}RGN}jxzpoY^b;!vgfs==RpRW<#{)p`^42V+UP-R}6?E7ebg?U)3-d*T>9sgT~
zy}63+n%|Rj36VQM6i(2U$Trmf)qqwL5bj(-6`w+u+)^f6UDQQGg|6S+j+<=CK=6*m
z^!_pH|CTF$Q8YSkHO6~T_<#mcw|0NQfL+Q(xc;n8fLDab4@M0>RGO4TN*+>!H)+Pt
zcPavFah&tQ>2G^KvX;+?&C-3r4V@wFGX9Q*ECo9gB6Go@1$CCZ^~cUT_Gm1&ThtUR
zh9Ch6-hgY%O>#)6HL`g4O60V>7ZlA)NEV;+@y7dC{)u$8I2O3Q?#xG~FK^!`{BJ0<
zKu(aF_Rps7W@RnL%fyp*yo0appS-PvkH045?aO|*naE;^FP?V>eGSP-A2YF)XS2{Q
z8?RdI_eCRS2$)F!JGNhe<93|5ZSJ_q`_*j4GbvJh!m0o<mheyuP`JoWd9%;SUhc3V
zi{gfG0N_}bGgjQ*g-B}cJf1NMdDOUNu+(#{tL_qcZikVRvMHFbLB9{WldSc=+8uj6
z-2e~nEfo5uFzu2!J$wJmNR25O&y7%FXN@voU_ICI&rp*SZj;XyLTNo8WQQPm$>L(#
z9RwExqf^L-l(IDD7kF<WDH42Eq4;koFgLF1ASy4pAah5`4^Kp(D4nspuCUm1oob3!
z_&~2)sV&+7Yn7gqgJox2*!rx93eJ^WgN&dH3Vd7!p2(iF_%~!CeR;O94_akLb|8Ex
zMa1ObS9eGTrs4@5+_Sn$m#!mgTIPF+h#xi}NpHm#16EySR_w{=@?PY&N)*#ajDtRp
zo1gyKlN-QVhs_Q+FUU;$^u)#bJrYP|$dQ&~<K@<ji?!3ZugL*0BvE3|)8CCHFKTqE
zkY1&Ed#sY!Bh_=@!gi%u{kl{aE8Ij8vraCkHnVb?pa&3Sgy0Ik)a-o&VQy-0ox{t6
z&Di?wr(~1Ib#dLjXmvjoj}#)^6CbfbJGZiB)FDVQ2wiCWoc1K_8PN*yojdL^G9^2O
zyE0=&fTJ{0IyS)P8AY={KFiZ+iE521ayaA@cy^&qW#&gx!j6N!;rNtGlS`8fqROS|
zi>?$^ru2Q87ZMy^zdLdeSr?e|{E3HU;ajCV;WoowIPn!#{}@g3P9SSbY>7Bdc$rNm
zQas;NRUQ%y*t~!C7mB2RgMkToL)(6VUqEc(iw^!qHllo_EY7ky9absElAO|kAXqao
zb?+#Q`=~5Fv9?AG5Z>?MZHHq}UTk(jS;fUqRwnqb@28Oimo;$PlIJl)j|kx^`kd*d
zh{sn2>iiUJV0=IBX?#2V!PRb(0BN6>d<V0t)WxrGM1_C`)m!8sB<^4;mmL<37pR1~
z3V5cSK_FMmV7QHFN?-oHb=-w_TpJ`rdAA8L0K+}}MqHPM$cTw8(Qn6ywFC7_Yw_Bn
zNSq=nR*kcwufIUX1omXp@_g(F-8Yy!56WH_%H;7xm5$4zZkpS|)6Ws|K}SdT9~_kV
z1?>+6rvF%F47IKUs!4^szX(WOyDTaW$_+?J{vw4N#U>%C03mx-mUBC-(~|V~1~J~P
zB*z-R<7%I8bZ7zx-vj&$8khK7bk*fezHvX3@7Qf31;=!~I$nYuv^%cx%@yfRE#{M_
z-$)+?A;JH?be?=Bp=>o72U-=Czfh}lt^R>U6>PKqjseDj=dlbh#u5M=Z^Qi|@(h;9
z;vYELbx#`mjMjaaWNLMtvsKCEZCv71VMEH`Y$&~kA4c;4(G)qB#BG0pPI~iT4zJ+P
zv5qi#)l{Rq{DGHmw?z}KT29b>Lo;NYKBz7OvD6p&Q8Rw;;@B0n&`H*FU6Lj*BnK)#
zJ@(2GUZ5O|Cf0oh)7fbNjiVsDl?GW0Lz#nndN$FxwS{NS0~lYto7p5iXx0aWgI9H`
z^*zNInhOp%W?SbTlx9n5E~|(ykl!{j2o=)Kdh!~j{aBe*Q*h<*Kv9s7)m9@&AW~$}
z^i|LJN<FluoT8{K=Gph*LyF)O{TRk-%R}+z+yD&4WpdrKqpD?$K#eTrYcFe5<&9WZ
zI#rV{HM|ERSfx>+NY`I8dHMsty?Ltl-()hiu8HPtyf+(^A=e!O*BhU1lyZb(7`1E2
ze4cIq)eiOY6D64gi(3|Pmf1i>m6C2^SpLB5nXUn7k<RxUn};7?iooak(33Wsp6<fS
zPOik3h{C1VaH{21D?V`cH2DvOxNpUjTi%S23(@DsvSAH8#y82I1tB+prcAbGBoA1A
z1Te$^rBU@QKx7u~kLM_Wn998oz}<&~+ScQ`O8zvujV%rD4hg<Y#UG^L)DI6}6cg)E
zdZ)hma7}ewZM0^hHmVK5&4l2q=47ANfNie_%ZQR{)R(e=&EVf&KhhIMKOW%4IOUN{
zC^oSsx~vfLrPNU}nfWUQ9fN|z;4d%QIctU&x{;OX0>bjeu{||o_eD=QhW-=D>S!w?
z+3#EWLC+>}Q*b2Wfxn!6oL7kefny9RBz1|)Rv0$04tyULPJ=6H`0L6#x%4{jMUh;+
zzro9Yj^)$M$nCi~xU;L;1w%&L;5n9%=j5oEvEPts5C2==9(U`lbfpv>YFqpacfx0N
zTs_LPF^3J@kSlEQywyG@<9BK3?4}rc;(NyfyQ6tj%~(k0l?n=7jX;xX9sIR+N_Ph@
z<t1HcxqSx7bEXJ6MciwzyV6~z(7-?PxnH)x7y0*|w)dUWl4xvsAwoIdB~8JX3&JRE
z{C6Uve0jvyb7CfI;!S<bpeV;ocEnsHk_$c(*b&MJqh=!}*UyciJwvIjA5IkgYYEpL
zlW_4bx({w&VDXx=A~eL$Poy*T&ZGRXDjluG$#N{0jb}K)4qTZV?r;kYp`E*y*l-4&
z)gC<Uqd4}qVpgbvI7E#b{ZmwRG1gAyp$&y?%)=TP2qUNGj`otQ`nmMYwCaxRzOg}}
z6))6Z7xd{f^><KLi0L!a_9Jap^8c-z+7SVaUnR9$Y8YW_Uff<=CTsJSRW~Y1mhA}*
zygu|D^q%qGVKgc&Ps>(x!Bw3cZ=k62*@|8WVI7#B$H2`WK~|Zbo)-(`CJC^Mq3VYy
z{cz@K8^>_ruNUp=KgRGDNRA!x|4=%Vl_NyDgmkbqo?cwXgs1-^5*7W+xbBb`*TXLE
z$M4v#b9_gi3H}G-n7w+wG86;+8Dp|{X6eAK1X0+MWk*6t)Q%!Mt1V^D`XA}8RiG(`
zrc;Pe&EL`XZFVY^BH(EJEwr39`nUBcU9w!78)Z2WWf5g8FsJo=x8L`&T%a<~W*(O{
ztp;@0nw(lxd@YKs)BOGZ_Iw^?La$lDc={^zT07ZdaVAZ}j+BjcLBbEA{2S6z@FR(y
zW?bj!cR}vY7UQ9%&}~&%3s$;_b;o|;=PlrDMcPxT$&v8qWQ>&Yctq{mJ@H6WzBH~0
zG*KdOI`7T6qHbrN$FVn0;*=LsDzU%2_B8s<dbfvR)r~&DfvDZwY2IiRDrP4AO(X2g
zd&MnqJtQLPK}IR)*I6ACO3useRVI|T-&y&eyrj=GnRgIwNQFIV)#T7^mhI<%H6R4@
z{8SO}z@0m=>hUq(#Cy)9F{s7QKVSIM4>wx*A>SOF=Lq_q{G6re%^hf1%QIQ5L2hGR
zcF$NRl^C%;fG|!y@G<4e4S`^J809xDdidI`2BpTRMl>{?5{RcB|M3P=dFIk$$xhk&
zpn4#sntBxdi71Ei#?w^~7hL%)yR3v`JD-E+EGD>AN7I*>yKNh*h<>Bi#OnDGQ9TQZ
z<+pA=rpr%FK${Q*2FuxOq#Vp7Sv%z`E6W@#(B+9uj6HmEb)M}N=g$?<AwF4u$MuD)
z6r<7i6v(%0v9J%kjkv$y5JJjgbi0_uT@>(yvQ?5YQe03fnR#RFCJyMv9#qCk!)>$<
zK&=1SxwR<mYv}Mny+k*8IOeXcq3c%SQ=lbbkkKgxFRORCw8F^+r9aH{UHOTNyYv=p
zUq*DDt*Fx{!M3xNI}CfmF$DY&46&T_l!iZ82h>~@k%*l0l*uWY9;YE+=kQ!URM>Ce
z;2hib7SWBs+_aNJ2to*w=NVQ6!?*EsO%ajo(e!M2p5b`MHmiszDYANxL0u<mTc~t^
zm^qG}@f(@fcULq<h2lyd*$Z4c<g4@>aQHsTcY)4SI4lJq&!7u}*ttx49c^0c;66`X
zawQl2#^-<<(G={u9y!vWxnop17i9MK94--0TmB`?v>%E`tXnC9J8Q>7EDt-rxq{EJ
z<WRS&oW9B>y{r-6lVF#@ek4H6^(*!#6d(@IwtECQuait@L!Bj>Fw2+5a|_EHsc@e0
zWHZU{dVp^JvAkQqRDUgRc~*G|wrR{8rO8aOz4T6z;R>gQ$}wmO623)&OOt;#dM&Pi
zs|Af_QNpJZg)pnn+VVt*=<b8|-iKxpsDr;IcfyK7Fb2BYKY!qQk>EOj$)3NUOopM^
zl9N)`LNLJ%!Oh+kBK;6t88)fh5%lNx0x@0#1Z*_gV8`+@Hc$SCndv``0mA*_uigw-
z=2z5{k}~Tu&xiG{0i{(n4Pk3;nyucqQheKDVtz`136;`D3AJsYwvo;m24(+*47BeY
zVA)B1?(Q4masONXx4qZe@cj$u8TOhnZfvl|?3l}UO20*lGjO9M^&YC)>RCxb5{i@*
zZfk2~f3Y>m`opKP0x!qO(GV6FNlByPOD-ZlQBIucVm$5yax;U>4$RJl9=!^qZG%!t
z_}8RwGi|p=b4a&k+?t^?=QaKYiNOZHb?P^Fcd35+=psOZJLGM@nvFf;h6s(!&8h1=
zsf1AK-m>xV|7NJzh}+b4zb^}lcWfWLT{R<}|FQ9RWa%K#0#DE*^so2IH5rWp0Vnh=
z!=CgAPO@*(Rbg4D;q#92<s+zOm8VRz?UPzlT%?btoNn;j&qcjb`Bdgz_9xTPGz@!t
z`)QK;MWUbS(-u9H(wn$*c5mUo3_OySbgtCVUj{W2E5C$9E`9y154OGgJ~@&&CVD|x
zi%a$kCmcm@>$k{Pd33_IG2OsHTLT08c?t<sBPKEDGW7J@U8h>0(>x<GTGyKV+YF9#
ztp)`ben>s$5R;_o`qxj5xCw0!OkWbw0yhWF7LrDPh^K2KCC*0fjO)a6=p-yshOTPK
zC(i!Z87`m7-{~IJ`CgbpWnn&F^QoShcj&kLS0pSicM=EVM4fb^Gz90>W6=w!a?Li$
zaXnrTjKC1L!y7_%F5Qir-Fj<!PI0!NSO1U2$K%LuwkQ#39g-d|tC7j^+efT*?ri5S
zmwmxSOV2O|v<|DdZmStGyU-WMw&J%JQ9El98c(n-d#zLm?94+0j-XAxb4yVjcC3_H
z)TD!449>u8!0aXTt6LHmX%RgA&A`s~b`Xgmc=Je|VnCTz;Dy*BK&HeT;*U)u2|Q|B
zS(72poB4i9Js+DF=$EduZ#}S%`lg?4bg(e_&}sCbp`d)94}O!Bl#sZfp&V@XdFDbT
z;z2)_#p?Kqk&u8epOB#9=;$a?Cs)*D_^@A|fBn=_=kx3?0KSpYd2Ybuyb%)<E2PTH
znX0pz0det|^dno1SeOmQLl_$yPyd)aM<>Mo?ET<q#pGMl(6DE=*x}~~4Fe;q8xowD
z4V?Xh!-|3l;gxwv*}^D2$A6;|>zI8cnGOq38Y^OQItH+ylQT2oN3*{Ym~^?y^;@{+
zT@XWj6_m3DwqBFP-a{p>e*)WSUjsB!q25pwLRNr8bGAe!$O37!NIq36gUikcK$rsL
zn0fYV&4US)a2qtAPaYV6#4)}AsH*NKP#0_Ve*7#vaPs1QvWO8Io9}n+Q3lAZQZT&1
zeabB+M?$(C6v;EB#C7!X&cwh!z$gw16hJ3BDQY^eUBf`nZRqI8Fx7l`9C8n+WT|E6
zepVtSrLlK#khW)Gfg4&l3`_;8lW6Ar_8uPQgiU|g47c6g>SL>;M%0Hi9NklVV3d?b
zQ=oCpk?i5%_C{70Dl-Na*Vh$l=uS>%8|vGj2?@=y^jiA86IPa=ARA-GBn#zJQ-rs&
zewmN`ATq7t$dO~Y@i4QodG33O6GH%Yp<*49K#4&-M@W#zzqRe7w{JhPj<pw<Po`Zd
zH_=YH>YGN;$XLu$%F5ha=t|%24^tb+?<Zx@4CV~>($aej(Ddf=XU7Xn-)tTHv}<^~
z<QhK0@R_RyV$~8DEmW|Tk(=9%efW7dSBCc~C+z$8WzCArByZf5lu?T&CPt+J(Ctx3
z8m|kp`50SozGM_Duy;tK9tP6R6xubWt%+Tkf?n=G;EWDD*ZuoXRtyIxpVQVOL{8<H
ziU4gYJwJTI$aWu?*LyJ8RX-I6aWe!4#*r>)I{7p@9PJz(11CTX#`Up5^Gv#GX^U-H
zt*mDuBp9;*FoH=BS&{Pvafj2VF>i{1;t2ye3*L4_>EkV_rdDrOds&aHLV1-BXdA8F
zi}v-oev^dfP!stE8}*>uC(a+qbio?xQJwwgxMFJxU&^<=-?HiSmo`TD>pr$+R3i1w
z1KQ@30Px33kv7lrWU;!*X*;y;&JN)K!6y|H@n&_^s$-=wZ-2|`{Ui8h*nj`bK0_vt
z=BBt87Ny!(GcTBOs`VE+M4Msp27;i2p(Y691`<+__hytOJ0xrbCoL^w(%lO(i<nuT
zFRm<AdAqb8;e<$gW0f<LjTddeX5ZMi4_JG<*^AM-LK@gF($k5;DBJk-1Or_EWNby&
z^D2y!?q0OGp24@3=2@7z6S?0Uf!2ryV$VXDy5hy-K7iK7ll`sefLJp`tG4z_cRY}@
zahN&}Tz@=GVsqJ$OrB817V>4jxN?_z+>zWmK89B2YjBS2zCd!7RLNSs5rRuQ&-CXk
zW`YlGn53IVCOPBcX>(_7&})U{X5mj(&=0o=J1xZxV?VuitQQG=AqG)vH7cm^wCG^q
zvlM)*HEyzRCw?07*t)0@9h9xVhlIJJ^vkwA=;%$e0B7{O^)9Pg#IqZEW}_e;AXr6m
zdLX{~z`(-xBO^YOP+1>j@wv(AU_NQTwku3vgr&rW)^;!~-xEwo+r1Sh5zh^$iezX0
zsXmRS>zcp_aYdYbCNgU9LDtBQMrl(8RIiRh7#wL1aOAVY8kX|R%pfzvQ1sR+^DUdP
z)0+0st&^FNEgH*Ot!567$ak!HkWm>&TxvwJFkuqdEl{y()e~ykMyl92`}MYa@Hc7&
zPl%bL6qIFX6J$6X5PeeL)N)8h&iGOtAX!MI`-BA9;w5Rx<v2Xv1S9qoQGl&IA60Sy
zBQPrw)FHk7q=6(6`1a^~-KU${C%S_r(jxzO9N#W`Z$Z{YB+(s(Uv7@GDQjwH{+(oK
z56`><A}nN+SwXC<lQ9OTTifTc(b#GyL4sSO#^xx(@5cg@&~PnRLLwi*>+R!dT9w$%
z3VKL1f!Qqu2*Tr$WJ4bg#_jbyT5zERJ<tdPbE!nX8~n@2Bl{zl{Cu_$r}2Yn;wLJe
z7=+}9b3x^Y{UQy=4#eqN-&E5OUbO++e#L!7Ja`QAERfmT(emwvG&Z)EQ6%Hrwe1Pm
z@nV3E9l)dTjOd3)cHEuV%4oPI67y!hc=aV;ml3aY7tPjMDic~p)`s%)^J-_|StNdn
zi7eQUW@268Mfg~D*I5W__Sin5q%>I@x{HIwv!pL}AIYndzpuvAqV1Sw&*z2UzCS<Z
zv}Ej)U@(Il2yj{5ji1A11?J@KA6O3wpXV1aWwKO+C>>2h5B~FdV(;Pqd4a=JQ!qIR
zzNF)@ejCc3GDRA?KrBB`fh9GuE1?iZ&@%UcR!_Y*D^k!p7naS#Q`+UWH{>c$X8%M+
z+?)@A^MR+A!R|9MUb%m2s^HaRO{@|a1X?x@6#MBhcL(40Gc;<#ZFV#ZV;6ROZ*oNB
zSxHN$b3RzmOo&h~bNpg^U^FdM?r}!E_)8!Dfxbt3;Iij*zG&kc{(1qz6TU*=80Y*b
zUGDva3{FT7+#T7;6k$8~(fWge)oUM3^SBRj_4R>vyZ*czeUD&^vY23M45Hw1YIncS
zPw!Kc2a}WKHo|kEx9kBn1Rq^nB^?I`2dmQ+%t@>#W~v<_K~25}rL8(5wSjVpoa{-9
zIYuq$9Fk>Gk3Z?)9(m#99FRgABb`Iv-HV&$rRxhp;%l;9G&ssle*fE-IE_iVr2x`K
z@E6J|DTNjsC==q2)g$JO_g*J%4LwB3vF?yZ@blf#1m2S%=2!-S^=wJPKO_DIEY8Pt
zz+Rl<;J0?IjL12f)yR=}X9i(a$FK1dMzr4&!=`*C^BS)lQIOx4FEvZLr>cm&to`Um
z*NuC)v-G&Lp?<GCn3ZJzgx|m&%;=K8*o{a&t$kIz-Me!0_J$vcPi0+d)^1~tAf~+W
z0<tMLE4?HlIwfBqZjKj_e4gK;y`23^*C_iLlcG=0s#jaMYtQh`=H%VE?cEu@PM4DY
zl%=%vHc6vVc}U%#CAy{aJ015s58!(o&y&x8c3G&XSs8FnWj<{hNo9$-!lCbG*$nkJ
zz)S>zrMkc5hmf>%0;O-DP-)1dd@cfdgno60gWZst%I^ay@{%3={LA*E-FYsS)aHD%
zwCUXgwBb9iSrXLtjOr3jM~s!a<Y_uFf`y6s#4cAi35f1|1R$xDzY$(-zSaI@kAHZ4
zBzM^x#b^5#T(^Jx?cCTr?%*-$Tin~>WFFM}*+3krJP;(cW0yq(n0Rd+tS4>2rN~M~
z;eJmEexpM9_!-*ms3d3K{c1<n^?W@mXveFUr1xlRt1IsQ^0Euy6)zO*Fg)Q0*uP_W
zUG^^0A3E;2k*M^mZ6r(|g;^j3WdVF4@KKn}i@j}(9{@2%$>l3;YHDg$4vysczw<$G
zXp_HnxvdnL?s|^_@>dy~4$Tu@8|9p<OJBB{#ztv?{I-abJddRaP=5fp$YpHAE)#%-
zMVM(m^ASKHS}E!izL5+K0D)z1;6~1HQ)X5c8_>YeKI$8kp3WhWT?e}SR%c5mJf|lk
zbKpQfC3db1!=GnZ42wdrxm<5EO#ngx0aEtUI;%&^^$dQk@H0T=@Z0xSAi>P$b!TgJ
zdS42}Y15cIAfR~v?@B78I0qU5`dVP9Fd`I`6aCjaDCe=WC?pZBPHWp6BXq8{b(SYh
zo>X0`to>LBSG#?IO#6MLzWCJCH}_Oh;Nm|)wE0PQT>S}SG}6-1k+bnLL`6lNP6UpM
zh*2}BHIJ#IzF`79<A1NdJPD+>8nY2Oc`*bPD!F8Tfbz2L?znKaH68tv4oPq@W+>*V
zVLtq41l1Fg2DM*bWo<eP5OBZ>e}7;{#%awE6YfwIGETM9$wH?E)3|Rx0%B4{^&17j
z$ZZxA*;^g&Z%Ok&)!5LMRU?*&w~(_QpeUnfqWTwg057VqRvHICm2=+2yM(IcL|8D&
zj0-|v^6}<Hk2rpPTkB<xG6P#p7beWN&o0$k;0P=8VDP4+W@cs<V!k)tKHb{9IeY`A
zZp10p6C2esd&(knDDuadtq3H?>mNr0cE7u0%B;h*6Dmv4tz{d&knen6(hD(Sula>2
znmR~L4{h+tkSs@&d^2<T&0@$x?SfxXs3`DU_6h+=EhNSL+Vn~G{zPC9MnxJKx-WVa
zU<o>*Igbi`Hn_^RY&xYrj|@Flx{9@IVkMOB@#J3$Z)GA-(jC&x-)c&4r6WN7uX^qy
z_}k%wb+TmuV8L=0GQTT19kPXd2v%^j)P$rvmQOMnGCl0w&x)=m#)d`c;p{bVzj`{>
zeoh#s`f0m!MGjZ>d77E#SNV&!w(M@-*sub9V_HqpFw0NmB4;&5`CkGi!)o*kX*J)6
zxqn6%Imgo3{Jz>VH)Bq1F<%<lWif=haw9WDy1FIP$67tkH&)JGv*6C5qG5|rv}B&(
z>NS5g#;UH=ZH!f(OHIC=umF1il6tq&IfeBP4Ar76CO>aLVtzf55O=yt<&z9ckQHY_
z7k4OP$*$t(3%LW?&DCyQPP;BQWlXvEnt6?uohn3v?uhNaU7+W?>m8T~(b(8nZ&rLS
zZ-SP2EZy>Fl~?0~Utfy18Jo`15i9pqyyfTg(jB=4FpE>~`ZZR<Xw%tv0}XvT6<hT2
ztKW!-F=B8z-wHe+;rh8lBF;@Dq}wG*GmmI63|GuQv`DLY#d!x~Du!O!=~}o3O~~Kc
z?%>!QZ;$V~RW)DVrZXq<-JEF)O9foLqPue<qPC32*N%#;w!xBkJ7`03Gh!ftjdAPj
z5lQsK57bdh$?<@q)ddV#P<dqnvK?FC^|0RHG7-Lr;+8)o&HvCVGvz)sUn~sDQTPIZ
z1diehvxO6g1cG|b{=+_0u761&98#nJJ_R*=^J(txDg9^ArptP1Bm!tW!^)F=vkoJ2
z^7-M?MUt)}%nkA2SKhuKY)O_N_vn3a&+{a^+F&xu+1HOxUmhP5IDz_a@^I#`GKwHh
ztLX(XbXfMjFL+IQ<#5i<0UIv+^~xpf^R^Jv3>N~}zD3P(1BGKOlXP6|ELIAGhu5A7
zHV!dx`>RWIwrf}_KZD;#F!MC$W}T$u$W68)Jx`yS|G_f#ChwI^U_-4Y%t4zk5U)c-
zD2E{7?N!_Nz&-`Z<UbWmdL8<}+ElDccKqNhWD-fKyM46TNjg4g-}_7t@RKYk19WE{
zct^_*W5=oJN>MRLshbxjav74Zw7$9pDvrJwA>42Kte5d<8@P`zsG0U<q_@H)qGnI;
zs;+6y(UmkfeKa%IJf=bUywe5J9k)$3;+_1*(G5@LAkiEw_X~kNJMZX8Rc6cOXJnx3
zgAw;Ubl;53V|NO^O(K59<)e#+u-M=d|DcK$qkTHmYuT(AIt1&(ER-veWgod#nS?fU
z4lI}ZDN2-h=fgX_aq_y3!dVMJ+i`<fi%{yO-woEVrU9(-Ff`ZgNf-n6jg|=G_ez8p
zTCKeiJ(Tum+RZcH5CJNw&Y%xk!qSROsvlb0Cy6+JoQ8y9u>MiPTEuv1hiz*Dw$-5|
zBR7G{ei9k)*7=Urs8#&k4Kt6U>ezYIoj&Zjw)0Z(pU^c%RMXa#aq_WL@Of7ukNNLA
zIZK;Bq_D#{R&c`f=hRErTc5x0-kM2Qn=dg8-}!5J(o^^wSv9^unvZ+K=d7`){CdNE
zut$<u4-{n08=zO1)%TD7g>-$Ks~RzUu_$}7dI_O^OweVPfk=(DVDeleb23dBR8*VO
zl~jSy_I1}-Zr9IkPlfTvE9SVa2+nb4)e<zw4jgJutniM1v#6I227{~W>vvuH-^zdg
z{%r!F>*w%wwY8mUi{l5)Yf*<9s;d4`8T+*X35Lc$e>|g?cJ^zQoJIkf_pcl_^xu6h
z|4N=A;W76<ygXjB33;69MQa=KvOg0hjWuJL)@rAk)=G!6<?uLB^q*AgEgRHZ&pF5%
zVA>hz74%!6)4;yM-`FpGRTOeC(8}@&l2+=R&L*z%U2s_}*MkXy5o)ryMcqaGKA;G>
zR+P?OWw{LnBCZlI(jYXhHRVMm2@gEBr}?x%7f6_V`;p5A)-TZL;L&mRpefD*k-c;-
zhz3SxUc#Kqi>Va*2`w9&Cn&Z<dOUD@vtX{(({{%-bET^WI#+8-2tNOGjX|Tk+f#X~
z{+P-cZ$3yEW+c04*l2=a7<b;YK-EvP^bv{)X*QU!t=T?CWLGBx0c1FFvzVFn@v~|C
zypX&|90VE<r#YfjOv9FT^B5n}&Tj!Ea<!l7Ga6gp(*%1gjE84MptHlJQW%*)AwOjk
zrX7p#aYy*!yOO6o%G6-XQiOswvf&OmHVMpbM0Q`k^FsT?I25=my9^&`EkQ}TEQsWg
zk2_M9#FXkIaNU$HwI0@A^ZuygL&KxQX>dCW`#;3JWmFvNwl<2p1a}A!AOwftG#Vhm
zEokrn!QC475H!I<@BqOz1Zy-{um%#`wQ*}`oLgCYt+UtJXP<k{_uU_tF&KkU6iwAz
zZ%ujTe4dG`GbSpv%jq#LxRsKPobqJlVh8KhC#z6Wd4;Z&%7~BXr5$m>HugT)0&G(G
zDuk2>Q_E@M2lv1CKLHk2@V9RWo|?2Yy;y@yrc8Vbb8C|HK`(drn3}RO`&i>wuNn=4
ziX4Q#C<@tATUk%64Ol1D4q7L4e;8&>FtgT3bF{Q1v1Bph=oI5N6L>zDYF>fAH;}|;
zxmHx+bA0mEV=~AjnjHKB;wz9!7J68<JyC#UTTSGP`*htv#{U}bK%SZVCWD@G-VRS`
z$^_%veksGj1POHFNwM>5a8SPbX!iwQ^Q1#W+@MKc@>#<9c9WKu=@Um?JO>aBSuI&G
zi<O7eY%yCd!udCNqI#6)=1)>7fedN1lKBvv9T`Lee~MB}%ew}^7eI0=tzPzt7zs}N
zLpt>^gg%oUrU*1m0AV=|OKvgIdK>U(k8%~sq1R3|R34P1fZB9uo?KKf9<_O;;ny7i
z0MDr+l#qZdudR`xf_T&keXgt9(SxwT+($0ng=-QkJF?3Kp6X%>k@VuJw{x!?2@ATz
zD_kBf`(FFFO*cW0`Qe{FWr^(V?N_-6&jMh<Eju>M7OlxyTKzRRXHZG{a2INcXrTjv
zNy(n*EI+Vxv3xi&dAc>K+3Mpe`5toP-z$X-vWWpv*58nN*z1Oihx{0v!xXbU=^R}m
zybE;d*U2M;hykgw<Hh)0iLqTrYRLG(Bc*S&>NzVB*`Dt@e*Pj^%=UUbZ;kir)q-Z3
z4qqc5r6I$!YgeP?)q~j8jGgX*6|oVA>~Le&<duwrkj@>F^raRdHRBpK=#0f!hk}T`
zymae9@Hje0=heC)o>AaYmF%Hn%HzCZtrFq|v<jdR(0l*qH;(V<5VNGwZ=C-4;JiI@
z3@{l~`-mrUQPutCDI8@4NtpZLfVA_k9Zz5mCyiE-N;J?OygF8(IG%Fk2=X~XiohY0
z-5xJobGW)8fu0_peGfXjUL9{>pAOs>i!xEVGAYpB6sdJ$GNg9M#~UWPv^$SvvkK8}
z{s9$_FAA8{AcsXV4nJ9L#<YsAJnx5AOTAi<lp7tp!rCFwN3-!xqlDFzJG~F2c{-kj
z;`ifRjb>OHf;?d!(1ViVZWYzUMQ7<r?&&wuBLPWmeB*8m>_nsA_<#3nlB7Tk@HfZp
z08$@@>9WI#(-z7~g61^lWks3E>mgh;Ee$K=N$)8Z4?2s1uqQ31qqi{J3yp{P$)P24
z$5@T@;D|bH{2KEG5}Z$Hl48H65Us(O=r0)9HLe(9BD0Q_FX+$-6WgL*R?nP=hO)N2
z3_+K>T7*3DIk@%D$qrt$fh{zkaA|LZcaA>7S==fRIht2%lYz-U2}?SBAe%zsb^SbQ
zPjm$=_5qb=-T%=i0>~ypk00hskFVIVjnzm8jGJZgz;@BB&-$?pr4czO2-v%m2&Lyx
zM4&n^yYUjY5#LB4+B?r649m)cc;LIfX$aV3k8w8bIX_6XM%ow<i)r;amYqHEyp7vb
z&EDQ9MKX0(A1h{iA)WC3;}hb{Rb0?@g&%Lg8Q0HYQ)KVQ-7V($Pe(O~zf}>f6By(V
z`sjsgxhzzc;R^himnAfo8zqWwG(SP2s!LHg!@<|6la+hKA&l{jTS10xNg7QHTAyBr
zCm#FwVK&-Ld~3)UT;PpPEmngQUf-R0ceP`;5&dIS_VnzmYOF#fA?aV^_!>?626zk%
z9bqda$AdL4Bh1OeS}BvqgSixBWIgvj^=CZNJVV4^UY1LQ^di$mrfc<t<$8}3LRdw#
z&M{w)XkrL&=Xg!*;VY$mQba;)-sq1DR_>@z71St@wbbERLSk{>>L}^%NM{u^lS}!q
z>@Ho(AMoJWpzyZ-si&I0eKm@h{Pn33MeVMR!h@7T;gEd{W6VOWVuiR`e2oeR=Fdt=
z*mrwHo}s4iWfxpsPuzxtTeD!fh=MDl0Pqn15gO27M_jR*vyB|ptFFjv<;yi!@tuw)
z_r;Ed9gL1wZt8^{%<*6ny@>S2=~ZL&&+XIhNR*{dx^bFC`Y)4*OlkYPBAEANA9*On
ztwLKQ{D@*30)v-AG+qxH;*lv&^+46Sc`eUXapH3{9_hIz^XTHs+pC02S^1IGQhYw!
z>CZWoYTQF@^#XNwwCU>4xijr~2ediw>Pho(-*RLuR&Yqu7+bzFs3l5MQ((FX7xw5g
z)|2BYMgvXgC8rFnLNk@j%6|E<I%WBV>}BBQ$qv{(HY$?Jk+)GPc;X^i7MZP9vWS&8
zrDio);1Esy#kg3imZfaiSy)uck^_gLG}NLA$6{&IMW07BwAJ@Vf$V!F=)U{=rC7<D
zv4^G0;RT~e%04VzDu;?>6mb6=6ll4dQ(KOxZ=}Pt&E`>$>+BslT#b`Y`fIBD^2Tuh
z)cqSMBDtirYhjpW5$f*M7Wo?P%v<NV4mA?50iC4m;rq=ogk}HwW&g(DDH%p3C}c4%
zM%H_gUjL2>cKd~x1+JydC0O$U@AVj#+fr~gW&cT2`FH8mc2vk_io5yI&4NF9vMw1e
zll@m2tP|Je!<qVf-qQ6KQMPm3jMG!m&NMBracLzWiCifJ)QGG|+W_i`^QY5Zum|I;
zQz2t4Y_yqG3AOme-Q8{sTI7!JFuk2Ed=PECb?%*)_-h(@EHC|KZ}aB7DfhCBSIqrF
zB@6H*ARtXPXS=6+eAt<3>IIG^E3mZ)3wRUDF5){zH<5p)fViY17aAsJe$W!Kh?852
z91s3&TkQr%E->Np@dqB7la!q(flTXMw;0!>v)VO{R-a$=Wqlr>M+e?=iN{^|u{w&!
zWCZLmD~~nv&NhBH-!_9qCc!2?qj^y5bzf$k<|T3RG&nAGT(c9Vzlx@SA1t&)spqsA
zZ>IoGpij-o0_Y!9NF;%hK$VZ6gVE8Ms+Nw3T5;?wQgoO5F=ijJCPvPu&qGbz8Zj|C
zggYn<U;@Kg0WN1yrq5jCly`xFZ$7Y-rP8(mu&*<Z`m|=GwfhWdg&n!VX`a#Y$^k*t
zt{N}Ig__K*sN?fOnq}_R+S-8B6f6|f3ZhMnPvsHu&3z216b-;1IZwN6@0nb{*G;Qh
zez)xlx7EiX!=QA773Kz5d+n$=FRYKCLGIFj7Crspk)xPV#Pwk!kO~}83J<A><1*Y-
ziqBRiG?!kJ{UYpx{fVxs;2~WxHmHCdlvrlR^TT?<b>KVgRHfm&&EbnDC31(As235&
zl{$htoG&wS67YKye2*ZW_&y$VjaG&9om3vn#2-=^f}<vL&2Z=2apoJ$3WSkQFLyN>
zd|s{(B@)cILFG*vnYd{`A2xml;XJ?+?_=dG8kIn$e*{T@Ze^iJ5RQ4%Vxo5=c$Y51
zF?*0^`&hFGM4nZ(=x9Co9NbFiB3Lv!hbn>%>j}*soFsXk(t_@!No6a`ll~(*g(By{
zt5Et(VZqpjI^U-T+E2qw9`6&1DqHtyHcjt0Vj?WZj^6(mxqk#12bLgE$GZGx8to@C
znmjUu2YA!c!$RdAEGq&{p4a{lh^gP@O5dlSRaa}Y4Sf_0lY5gP=nB4ON|)|Gs5>RZ
z3r$GFv~rL{lW|@w?mL*UT-ujIO3oAlNkCQ<6X7oIYr~m)CLmMO!}KCmVQ+N;l_uYb
z?!ip6&rXZ*{QcJGiOy)@!e$ZiUify?_|`xG_<V|PW$#(X*P0OKfT%DC9c|Vpa~pSj
zA+K{Z6Y<4*+e7KZ)*`3X*K_-O4lcu!@f}|1Q&{izQUvV{4GoVEtDEyNvVq3d*g#Tn
zxo>9-QtxC~yumobn?RgK=M}GGI&_`0F!o{g$5)4<(WGP;#PEDqK=XB;H%_6B*Z^wz
z7C+R-1wC@AB)08pipWQZdXtnh4EELdIP^`KH?m2ukd7bMkLy%|c*+D11H*35eP7t;
z>jYF6_Z;N@)NjJCg!LJ%;&rh^@LsDGh8ffybOmKH+{QmWTD*_Grx#*dJL}o3|CAx+
z%Gd^tQI5t1cYNUH(yW=Wp07h=6|9QF0P*B|POei5Fe7;nciO}JV4o({<hJ}e>E;Ea
zH@7Y+Uvht3SB>5`lI-Z~f7f93Fc{^OMo1wWL%F(EULe`Ikz9Bb)$_zg{!nHL4NeLd
zg!S|-?M#rM8lb^HBm-+=yG=OmQy~~%E-bh0!9F(7fiieiFLx<6c-+6kcOUk(2x-U3
zgHlX%cNN|Rs;}V9)*#pCiy^p*_qap>BV&HrPA`|}*B!|sTEH-5I+~WdGvKf>$dftv
z^jsZ^J58Z9_rZK&sO(EB%UT*#xg;!rMyhl4f`BgV9SWOc!6@bI;iJe&ivX&bKpgPl
zA_Nfb+fjUJyJH$<a#H@w)#s9I&)6<H%)Zsd_S_Bj`bkLGAZKFc6Jq5liO!#_zcj1i
z5B9Q~veE_*=rk#H3!W<JQsb@->|QqT<mutbB>!^UohK6A<?6T`04!HC)A@+-1{Vej
z_y;lc`WBkWZ}kqa=^zUVOABq;{Rv!&yH6wD{I3Vn>1;pj=DG(7TpU>PD#s5|)iQeW
z)4^#1L98M_WHbpPIkCWd$Zmx%Iuk|{#kfw=a=zP4CGfyMIONb<Sx3?tJ~VDF*P);J
zf>+y>))42cMYBC&Q{ZTjmn1=WGg6uppEqBOnLccouwKIdP~aYqj&|uzQ(9f7t*!0m
z=Be#?xRf=_W}(@0muJ4g(Wu_;mr^Ge*+T6`niGKC>n#AfQS!p}lPaC6WDE7%Y1Uiv
z1Hgc}yHXlKyYHq+EXt84kh5iq2T%AR&M&0Z2PfMJ!F(awc(0=!y++7JuAL*Ytwn)O
z#CAIHM;vSj&_gvU@(_kmX*gFP)2$#8$p;KEB5k{4eAmauQs@344GsQ0ng}dtKN-A%
z926LKNjJw(kAD&1JG57_{Y~FAhwKvPg5;;OK9YIbfIr5ATJ~EaQ>M&Bo>I&gyqKDk
z4?GBNGVC3KpLN)t<zfk8b=`+wMb8EHAu;?QZ%p{YAhZ*Jbt4Kk!R*MX-ESg1npQ5t
zO8~u?3!w087V>4w%!<IbX4Ed)vUs+LA>z#9oHvvJ5)B}^NUB}1%}R0C=;!K@gb*^c
z`PWMN^=~xDv!#rVRSAi2;cR7PX8CR3xYzL~{s_rTiO`{+FIV~O7R^r6<lo;}9$P>7
z;z`*<U0p3-*E;^BA6!LypHE`g<w|JD2DP4yrt_!#5G-;iJc(nsEcs;l!?3Ki$sl8J
zqtf8q?Q(D`*q^R{D%2nJd<sqYWh8BX3?}`30W>CoUedo`pcR12%>g_`!d)d>Le$yq
z^~B@5=MU9^U8jt4LWoshxHA065ktI*ydQ{53j?3rPkqlmZ?(PC3^$a&3p9;>hE-QM
z+ey9-v<@*7eYUN8j>ey<)J7VOWKA+a!Mrl+FXPyL`eC$W-%t01>T7_SvZTBu6}Iyx
z$%h2Ru9(a8*=$7?2F<y(>UBAy`2$QAhPT0Ufdkh+y%sop6K1(vSPr%3e2drV?8K>*
z7wM4|t(gbrn3g+QU!J65y;|b*)kfRP5LQ}zfGoaw_F+oCBh|NJU681nkp~teA|uNK
z4D{A-ax1Ja;+!m}pu64QHFz9IoRO`OpIlkV{Tt@5C}H_1EPrY(tM&Z(9;>(z5{GfK
z$M0?$ASDOR3eFBTk&Q5EaG3c$1+}82M}f<0fA-}cg^x{D;2daz?5O#n)dg{4@_E3p
z_x`T{?-Q}zLCd*=S8{mp>2RbQN&?9%I)UQOb&scqbGU0z)JX&lo;vuYochAIzN_Qa
z(Ckr0;UN=xYE;m<$m2^4PbzTdR%c${75p^}Jxf#l$%Bs0sB}fSnn2Lf+D;%y6?REq
zaK;Q@ELiS1o!*Z6rF__V2xY^gb;HR<1LcIhMF&kLu*r>P0Zm%4lI4LkDRqVA7lZup
zd2gr<v|(~Vw|n?`3M{v;R*XC?nO^&Q5!B+_Bdi|v-?d%W=h$Gva?^abUr)Xmf8)0M
zRT|P<apt-NOg3LVsffu=ukOf@s@(3hG95BpjayzL=S{bczOHvn3Xyccc8T|^?7V*B
zaxccK@QqFuJJ7~vwBtN0!8NmiXJ?M4a+4Y=9z=4bUAdad;<DRChnKT|^b!{FQ6cX|
z+51LYrS?lLH0rN337K0tc}Av|lDILq%>|T#i{zbb2l)wid}t)_O3sD&l8FT(pH<2I
z7My$SV3P^4WFiz9Hpx7->%yCD$_napxra1A-IlqjzZ!mL;QHA#;}ZJmYD{($w_&ZL
zSNKTs0S#F4S~A~ziTS2RlWs09WXf6{PGy0ke*P#9--+^z^NTqYKDT;~d2f_68vO7n
z?$DivmN&l~9rMGpp@%@snD}5@Q2><IeSTD|qGFr#;c%u^rh7At$WA$@#f4qhp($?J
zGR?e^HT@h_ye}?-&dO~Ne%<-w5lWy<m}ZqO*9AXpI3w;3<Jx8ShhM$ZJchZ)Cp<`I
znpCc4(&7>G+brV-^g6wZ05ULV_wIZnc6oyQ@=oLgl&&#KU23x0)%!xD=$lywQf!7<
z)Uvzgm!*0he=M+oAEKjvo4zJ@>YIT!npOja3n%f}EYBL1X*>C_SrZ#dlue~vosjaf
z@=Uf<reyL)NuIY|DI+(vBD;_?*x^hO5g)d!uzWgui4#YS2onf#9EL{gOCSg&gfU%U
zHSaS~KMM90#u16|nxoEonBI@dB`mz+Hq0ch1iAq<@^vh>CoBm+2+|4?CPj@V95=qF
zxj+qE+nK=4cO0gE+PQ9yJ636HFG4(oGOCbgerugB;lXGqXp2e_Iy-d*pOz?Pp8eVj
zlQ|u$lC${%n??<u=?*U7ecjL3NaJg<@J<nE@RS3X#c!so^MKl5aq=Sp5GpFFBzgj;
zBMcjh6$E&R*L;Z^3DOCw;Vvs(=(egbb&dfcXS>k2g=KaQ(>DLrYzoH8Dw)FuIu~Vg
zzgKNG_c-7yOxHOD-*#fSlObxs^{~vcs}Zdj{K+D;#r1#>u8?sYtLFYtc_MzzM+%6{
zU=zwpO0`hG+bhAGI#q2y#6i!=#^7&yEjJ5np;-a>b{v;B1B9(>W70JTS1rGF&5&`1
zzGe2W-;94zz~{GUKx^O>&Mg;v2^(fNHni+3+D%_{rldwJbtpO$9F7xsSB2PsC(Cr#
zh-J1v)R0s#V}KW<%4^)Ww9ztA*IE#Ls)LW~-#}5=gv2eMx1{od&fn)Eupsy<*x-(4
zM${U&8o|`~Pm$yc)<8py0t^y#pRHFp^L<eEzLNN53xoaU>+flGl4Io=9%lu^nZ;YG
z!OS5Fz!tWGEiiZdDw`uAqzx9Ym-u2!BH@Nc?U9wxLP`T{Z&_4`r+<@u*q#4(*0Ah*
zB3uWd=Bo7Vtjrc#iYdzOb6PB>G(K;u2cvLVwTS%D>A}Vq8T4WFneWPN%R(AEvvX{y
zqf@hruwb_su#Ar%PxSM(N<MSR-q#Y-kxlmuylQkYcYV)lej6<b^0E(Y^*<ClN*qd^
zx%mP)OI?Y;tT2W5zO~)Fp@%HjRZd&nB#w5MOgXaVxSw)!aR@puHZv_0^x@AJS$4x-
z9!#|4@g+t$+PHt_zlfHEnBqc!HvbpOvh7-BeF;VP?VVj=-2RYUHI_RZ33;pAGyf8k
zru_aC4&isnyKk{dHOWT+VLn{a&cHr#|ND=cNyxuQ9Dq@;Q|)@u1mKmG6<RQ$)BU00
zkqOW&g=1S=*cD8d#n*AsH^0<Kaz*8xJdYd@Hz$`c-`7aj#MOikcK;Ud%Cn{mvz^y+
z!-exY#UIQMH+sfp=F@nSxLJCzc&|8xkIdr_;5Uj>O|ebMDXulo)5Y#4+8039z2?6{
zQ|EgdS(`At?bmkJ?dB_D%kmd*YIPO|J`0=}SUimRV^gNjiq-QS$Op+TmIf4ZNfTw2
zj*q+lq-==bk#7r#M4cmN4!9cXPtIe#3HUimg@=c|cAcS=?355Cq@eG&aoXU_t_J&6
zZa@NX#jjV9gQYAlS3;Jqkz@n}>L}}2F=l`|%Bm0_U-WTL429*8H4q?{q|ZF+t{u%1
zr?B*jbs)#H0@!IEGm+)bf8*)?tKXw38KeRwdi&z(VvffO;FxTeKuai}r2hpk0)VM4
z`~mtM<?os<>a|~Ck_u)^4P|dBy42o&=_Rig)rT$fOgrv|(oM4%J0YPmYx5*KR$mOE
z(jv<+JL<`@q7TJpS$6!BrL5+0c1*q~x@EnVDR#8FrM+%d8gZR&zus_a$1%~EmDoK>
zeU{L%3R}@91;t8`;uf6MJOpEHDiX31hML2rhhpf1o5pSjZh6_7d90Ic<agg+n^}7}
z54}Bz*d7B7fOxr@#fubnEtEWjRpJlcy%;m*WiKW9_|z^E!62z*qhJt34c@cGeFrVz
z99fyhM`5t?4MGCn*&s1sw30ZRyDxXE%Z!>|)1erPygDx<&D*LGCT88G|BeeL$jn~Z
z+3ase0iAzG6+()?&BD2*L%+H{oiZXUG_cQ?>|BxpCQSX}^5QvMlGQi@wcQB36X>d4
z9?bsCAw`7HyHLz7y#|@xkdwA!C{Vp~4LLT_xS`?=#D7;_>pHg1PcP-mn(}O(7^*Gj
zZ1I}yXVn}Qa)>z=e#`LaaDp}1W=lPaq($_VdCmuC5~z@Bc8u=uoW*_o!*G-4kn9RW
zOIUwJqx>~Wf_`ow<O(Krhvh_sWGOR>lMZd6kgYJdr+4w+HmT1Y<ug2t;0-nXB3d1=
ziBoScOv*-45wXAhMjnQ49NViEM)hW_ltSga{n@gw+52qC5zd*I&5En8bNxr5BLT7#
z7-wVUGY`XQ&-+$c%xS^&*Ukl|m_JU=QoGhf9=I@3(*XfR@&Rh@oIAZlp(2iBRx1J5
z$FJQxzLg>(UgVW~=%Xhp_`+-XH8{$C@V;NhIX174XAl@!b3C2>@y2{^us}(cj5(((
z;StdgT~#CV0UaZsJ)KS~HW!yG#`@2W9L1vDo-H`3k%~2e$MyuExv!nD@p7_A7!}El
zbcgoJs=qxjo(sdcWe9*rXB+MqBk@EdOdMOFt_o<<HxJ<X`T2=#>h!TR!fLZj$)t~R
z(;nn`kI@F+F(x<pU#f_x-f}>Va8S!T-aK{ugdZb)%^ND`OcZH>4Y$k{-hB0vvX%L$
z<f`*Q0Jcv6Z<NWFYyxV6F9z8BqY_0Oltf#{RF-EivKex(n2UfSH`e>GN?^&lwa<SW
z>S%Dh(yF(gp$5Sf3amJc@%BKmey}fet?gBM3*?RV1taIHp^GcgmM$CRV0h6IHrvpv
zowzJ!jLvMN-rCkW_oD8rWE8kcaA2GmW8&G`SPiDlQ1ImoGjQKIR%6H2d2kbG?szH=
zgV}YTG{h%|!<rg{=}1LH48Bwp7*FqbsQV2ldwf-EiSVyf9nFeQ=bOlqa~`dagF*A@
zX6qTEM!2rK5Y=EI@+HV9)ECyn!w<rM92g@y!uUal0f*3vQ^QXgZ3NeoLCXf&Q<D$i
zG%nbfy<8nNs+tlL?rhV940d50#PInz`aD|!W0)s>FX+pmNh9&a=7jITxYq-)H!O_Z
zaseBRfVwaHX72+XK}1IQrU1tE=!>b>ploPlHd>prOahm^-01gb(g~O9HsC>CEKz&i
zPKy-DPA9C|WFDmsnox8!2t2~wf^nZmw+?B1+*4TeL#-rSp>(wgdacC_e`+5~dWK^u
zgj{8I5S#v@BQt*Fu}~f>Ygr&Y_?Ta2^z|*#4_<|?^?tee25|I?TYTPtACi)Z5erG)
zR=a$$pS(U0z8Z5{d?n>6DqB^%soF6+O&tbK08~yB*ar)4>-Se@NhpO}*a=klgNJQH
zvt*0<4u<Chyu~qghQrrNo@Z|l!+sK5+w;f*8Z{TS(M8*kY)oeh>4X<pl5VJ(dP{2=
z*-OVRDl{Sl+I_Sk3}H*hZ}4aW_3<H~km<&!$#REXZUT5PC!{s9yhdJo7L^&=3^a(g
zc3M{`f1~PEotaz}KfDzI=~F>fraaFHm!H^MY0^U%nyK%3!iKjegwjI36fAB(`&s31
zTuU4eCWdmII$x;5Lp?cIX}<K%duMZ4b<_+xj6?z_JjNWT#q2wvYDc|o8R;NHfjz&)
zb(uXPo#+!g0!X(rTP`lH7kYWcPiN|&?NveKU|l_{3%+IJko~V^jn<Yi_LF)nFoTZS
z9UKP-2Q$kcV|>u*V55aAmELw8Pu<>OElWVdOFXzk)f}<3idnNa^3~`ZE=g!s#Th_c
z9o)3$g9-=;Z*;W0wo}NlR{#>8pH*8=JJ@n5q+s|adc@2*u+vRd42Z+!MBdgw(PNEA
zf(j7YU;}e5=)hMtE1%oMW`E@D?ZS~y1kJ^}%z7mrl!$0)L^Tz)K|`O;OYeGE4h=~j
zjZIPUXHy)Av#9k$<)=5pi(RA1{x9~C>fSozz0Tu299Q(o@$1XUr}vNM|6J$1;;G;`
zI<a?_WRa7Ni1u#xd>GSrhd_g<*Q?}SV`9{zp)GbKGG5&rDm`}HVF+J*Sx!4fAU<lU
zuwsGl8kcM3en$IFcMo%ygS`5ySOktLYj^J|C63-UDhEowQ$>DtqpZu^H_~ARr)6me
zT~?0D2c%p)3<_~-6D~93D1}-np-ma=Bm3zwk^<jIU@D0X{%o)E%boAv@##0+(|V0C
zgbGIS<i4y4O&4**=}pK9-rP7{>Bxu?@$N(;dzad^9kvU#JCglG20-KiV4$j8P{54g
z&A_m$DcwHI2h|4n!3xfIy0DryNVC-(ll(hU{RV%suI{B5dclbrp~2Z?<?McCT1{Ns
zl*8X!>54_+<2$c=I^J7q*0^x*u{<;+f&chL)tw1y`Ndftxwy#k2INU&<wO2PlTm8F
zE;!;+M#on8y<FAnA0KGJ6oeJB8DL{`St{d?Zg>Dfddjp3e-j)i&~U_gcp)T5`ehoa
z01!<rLfLS+>+;<*6~|ASqLa-!c?o#L(0=$G9}F0Qmtk`@3%<GF1KMfg>7=+m^$*py
z>=JMv5n^qqX6CE&9LMx5*^IV<j?{HS_a^F^z~ntY@N>)6@LpejM1!wlf(#r^LXW;3
zhTnTewaWv9i{oSM?-bYJ#O)t?rOA;&m4^|FYMin;R9}5EHp{iCIl9&`A(!;clyqX}
zxUh;|G=TGzjjibQZeFy8xF*l0x}Cpvs`Q<FY4~sIrV*!PjeQ)*_r~wnUOV}P#~|%)
zh12m_eZ<{b)m{<IE>3UUp0qa2aroOOA(IdTWBcx184(=@)BI<iptjpWge#>eNG56)
z|DqYX^ot>6@mGwWC3+*@;CXlN2>mbI;;w!xMKc>`!c6;|1e@LSb1%M*y1Kf8{izE+
zJg~zhHJ82Y=+&&C{+uBbRlps(vi%U%^xmm=QUBXh@>JrZq08%`p{IE^KV$|z3W*+J
z1v)IhqYC+uu=v?=4?@ACglaIPl9(hp@qGtJjBGG^aYD#-I^)x{>QWj`@ne^4QTJ3#
z=qcJWDzHPxAp0HoP5`c!wRtGWPm7jCeCFadM+;jojT9(Wb6c)iQ-6R2G=5MXX^o3!
zUTZBjB(~d7Sf98Xc={M~f>qn!r%svC>$Z4DsvWz1SrB3N;D4>q7xDG74P9OFp<?{&
zFZ|5}c(>xmr{iE(<Ik#vs36RM?CpvOWGOGkUNadNMMJfaO<emUOEG;!NN328e$5s!
z!}FmKLz-E$5IbHmg3*}Rm$<oJ_czZCnjdajBK_D>j$EG+$Q_IQaC2Ier``$(S%~~9
zP$Ycny!guS8d+XaG2qsb*NC6ed^|@tzP#`!F3+t-$&8($PmJUB{zZ|v*BtC>a5ya^
zmb@}4HM=0BQ;jxrfyTRCk|7kzkXTd02awAi0c^qJ(CoM#_Sc_p_tKT{4Oc=V1S@BV
z;qQv%ni>jL-1eE4yvGj2SmP-P>=pGKvSx{9l;B;SQTF{^C^JPQ)hrsRBOi&^rszU0
zL&!*9#}GesOcZ6A3nH~v6gnC;2MUT12Ghy07r4f^188En>GUS}S;?2?yX&!$J^W_N
zA8tijEV(_#$@<7>Xr6vCBv<yL?E|W5+X3vZ(bB#vQ0h>56Me&pJ0^o%=QnuDr?~Y}
zqAFE}dG0my<A{E>s5({~=(j_cbdu*SWTW9?-Q*+>yiaa9yy^Pt>G9te>2rOWb$UKm
zyRwc>0uy|qEYm6}<4o^yqSGDWu6TLeqHgj%eB`TUX_I6;0|0!_$y^VTt3<Q5M4I!Y
zc3gD2T+y*tW7<KfEJMU5{CJVX&|{zt>(jDFWtu#6JLQKljvlWvm<DopMKG)ei#n=l
zlE$2U%t<q$I5fOeSIWxFqq)7w$F{Q0oEY5P@e%<v8V$lYSDAy%e!Cwj1FCVfDA;4^
zCvft<fA979Bw1Vht20;}_3{=R!$;{p#;|b;%Uvu~gAapmPJ6$AfAdqG!_r`VdEUe1
z-G-@hm2Ugy@@ArqzCv`FL{oHhnvmyql;t8gm@Q>Dw_8>ECwd%ugq#Pa3^Rj>D3DA7
z^6C19eWTKHNjeBWa%d@DSuxJM6+!9P5=mR)$!oXG{b{=QVSbo098$9VGH6Bj$1-<;
z;=aX2)$lWYS{scaWC0F)%8{&?y5yCtg%^h}GALNnxS)*+qLf23MUf^aKX?TMJJAWo
z9Ymb%;s@$BSJr26d4)xX+qb^UlX$SF;sz8sr}9HU^&m2WLj$FpjLZZA$8-)l>Nw+&
z7+Ns9%g(&7L*}oXU`?v6bIt-sDp%OLL4BE_1}?bo!rLJ?Xzjy*wt4+^2ZR0M>qYs#
z{T{8*1q+nCX5S=;cjnJl+h>gfS(=y_!o`*XD@6)f^>3U-ag6w4CX0bo^DO<HYO;65
zOV#gUDD+`K1LWIZ#osX2EU)0HBuBayPgBhw0dH393LH1`SQ65+_filmvNQy4k8yep
z$HVq1_jRYY@^jY#x7xbXUs+&a0#L1%P7<psuLn%SR`oed`L;$90*t&o-cp*Geibug
zZ7H{_RmVEl_f5I41ThE1B<H0w#WwPD(}BaAsts}N<AF`;qoI>Cd~WU8^ErLz_UF4b
zZ4wPjKXrB{3Opxo22gTmS$FOv4O4*;DsR+C7UzB63mg5o^>ttX5Z}S_Ds@Qt!JOq_
zt9pX4ci_R4<(z)dVu?1JuPOZ;D`NY&txamWl`8G)H9QuJXYQy;-C3a1Nt=nGpDCG_
zMe5tg;Gps>(<9Pv-=)d1e@od+Wsxd4<J|f^(Z~(1fAk0*a8(Gk6h5tuJ<z+<L)C~}
zIz-CFYhOZ^rV5-zdYzL5@HQL$E^uJCC@?_Vjo|(J_rEpZ5}|szY%#-nTd;KkHk*WJ
zmU_Yr0CAHfjjNmtanE&qfpMH^M|ISO2`*Gl>GheoqxF~CG1d>y(tmCpX1v)=895#A
z+v=QvZ(^>RRW9X>tFOI<w^-G8bt+`>M92*1a1>BT)sKp9HBHDk+p6dlDeuxhp<K-A
zyE;ql3`XqML>Hx*i3ErvKad-^g5yr#WQM^g@Yb1y4cZqaPF}&85gTC!)&+#O9~Re5
z{1=C*U^4AR;<wbsSAq)~UtSXIEqK4p5g2Q|JbZJ$H}hD#D7K#U5vf!hJ&4-eynWdh
zJbMLaM*-jlrKhPm#(MQ{G>1&9gQcvWZ8x@?dsPPMa1LVQv|Y{xoKB(!F3NTtJU+Oe
zAi!%T(tcsq=69Iqp#U_pl<JdgrgH6IM&MxImIoS~T5D+lgQqmhbh*&b(9E_*vidWH
zd2$Nn9y@s+3>}P3$W*>+`pku`$E*;$thy<SE$6_kB82`4&=X1yUL<^*^;>x7C{Ucr
z3qXvXXNd_ixIQ5@D#s29371L0Z=PunYOhxWb|@g+r>qQ!tEhK&c3vFCRX$W@v4t(P
z1<)`n#wSm<=>TQMu{s-dTh+InYT8ZiLD>~d0O!s5j;^V>`NV!h5#@a%G)L=0Bt1#y
z7v0Iymt~C+Z8`uI*JZ62AK;Tr5`JXYX0_#70T`R3cFP?hZ=ljcitKP3pym;zQ7&gJ
zz+3ApBkr~LxB{E6#(EeT72~;mjX>K%i#OY}wHh)+su<v70<;U+AYFjLE<Ktfr3f%<
z01AlEw4(Ox@F#p4q2$!?5AXChN3GR}h_C*jNbQeDn#hu8Zf`1Dn^C+oA|fJsp7Mk&
zM?vE`%rqr<QTY2+1s)#WXTiK6RXnIeDt+EXOqLWz3xlsy*6+Ikiis=x`&@t@1oX%l
z&mV)w<}VHIwTgh|$4AMHzpuRDuF&jWoFzBS=PSUEmOKtl|11MD1%#ZOQz;8smvbmz
zHn~{=<t%{8Lww~8u%%fge2%064)rrQvC>cCjK!&!%^tRr1rdoFTJM8RBziW9NE0ev
zTmbwoVx@V2brq!XvQ(!Nn4kOk>rz?&m&ekD7Wb}@AlkRc;IIc57oZ2nD8--T_&zVW
zRL>9)R_4SF)HRe5zJBKuB`SBu=XFkfcD2j9u9}J?FqN}jCYc%qt-62IT2y7GC0|C7
zpP#&?Mj8OVFOrp$ySxN=yeaka&tXexz|s^l1%C-^dLl+WM*K{t^zpMdubtk%C*ljf
z{5U<IwP#YjRE+hSW13`27(d*0+Nf<Kwa0F+`tk;g&c88Ciy3j!^J&||$4uMkmUKtF
zk^)*{Y_G$W!hr90us%0y^P|(0t)8dIwUt1&P;;An@VaZq{3(B7N#0^Eqt_>BdjT-o
ztUxvb2QV5Mt3YWhbvBtj>I>Tl4DwS4!nnizQAPASg&a5M_nP1-9}<7;CLFzv5BoO3
z>Iv^FU*iK~rLloWCtKsTGjc1;Xr12Lhka|O*SnOifcWVCpzH8zHSYTcM{kUXKly$u
zihpa=JuBVjT)~o*Lf!odlWK#-QPAhR!s|`ELd%JjMAZj4Keva!WzeWT+q~K-=_xvM
zmbp%{{8mC}8sxXca0vS~^y=~j$vrWAdSYS*lKMiElX7pNtP&4k?3AQDD&2#yQFiZ6
zqlAZ-O~n+ChNe~+$^|{wqdoJBRwtx=|INn=s8yq+G^_Q|Lax3nwTjv$^WbM1IbZnA
z;v2ua)@@ln<~%_9kv*_=c*s+M&4R`!9kZ#*nD?DSXy;;cICFgV8_R4-U`=l<RTx0v
zQnHWM2KHzgX>MN;CeVLLr=nUoiN~1t=+Rhf29n3>cWgZBr_T+Q{jbt;(*QfIZ)Buw
zAFaF>{m^!zXyf<3D+Ma950!?P*Y8+hEV>I2KRrWYVx`%Wv$Kr=#1aP)B%JswvGOUa
zJ%79VRy<$=ACZ~@Ais5u%_-UA+%`{X*yt|MiZGbU#b@yy3-Eu>pBv@-3WPl26U4q#
zzE2Gz`i)-SXiEOpgdk^R%mey|(}H_YTrAQdl6=U&sbPS+oQcE+Fv$^Uz+$xQjqO_E
z4KpcH$sk2w<KAP}?W%hL%q3ojY2IxfgXgeaVkonq(>x_3BjdQ?>Vv_@?VE3e(2Z!V
z1=7D;2@RZ24MmRjS)H%%S6#04CAeO7M-jSS0Yajtf;2N^X-j~SD>e{Vo4NrOQ{?vQ
zY*%Dh;XH7d$FwbWg2$xwqSS!F?Ugm5T>RkPdjr$cBsTR`IPf`Z@B+nzwjF?=)@ys-
znBM4re|M{Iz0~uhLiU9^V2;8Q62L+whwp>wOJu?@qMfiBiD6GG(8Onys*@_v#8f#t
z)f)cIk-gU(A!-wUoCBPiJ5f*k?~d4q0q6YrOW<>a;L|o_+&WkxGUi98>aWQ3^Qx4e
zI`_(<fNTEvkN@4r{OdI|>j%=s$C0!Y=uVu&CR*5PH>(o#;2BaV5Mk$of~EuNR`4+k
zJiFZ|Vx>Zv5r`PW+x_CG(fL;!AyV1w9cm4DjZ@BmK5%U->{lHd_=6wJD`Gb;>RpFr
z>dN_QgTO4eNLb%^vjfZYfNp5kUX{$K)WdMoGT9fvl^!Psn>hUazW(bn{O1+J5}R2$
z)POj!w_ZP>=jirBtcadi^AI9v5^CHnIOhGy<Gp#hpgu5Nv{(9ZcFpcYcUSCgMeHF*
z-&RDPR?xKOw06d1p7&3^d3X<z%S;VlTAPAjA28a-dG(hTgprse{K{CY+Y+hMXNW<V
z_FR8cPn6O_y#iJ7HL9^l;0Hw%n@>_UchagUTIY4=z5pnc>n2SbwAm7Yp{NsLU950q
zx2-a@;6VI^QhBpAZ<;&uURc{CUJRy=Tsu`S+}ZbS>n{)NULK7KX&JNyzepoB#WCM=
zDhb~!ykU2nj%E^FAMg~>KHm9i&xBEbb{XrzSevbJnPup)poAZBWIl`0@?8?eG+!kh
zH+YE*AOt&M!``F8EsSV9KI)=m6{VQ58DRrIhGzY-+<zVMs{P7X?D&rd;2=LeP{iqM
z9i!wDbP;*qmT+jw6!ad$Wk#HA1YvUQaIk?duJXz`Tyw5!WuwgH=a9~WLuTfq<Nbj3
z(s@*d#i)Yk-FZF?cNokc$$JI~bFe-#jFmnkmk2y1_rsrE-Wg6qYuR!ENnlQR8y7F#
z;E2`=D(bAWJqz@Y#_y}}-SnQbW=o~w>LZVlmMB=#Ykos?rMkk`jzC8~9hlhChZZmv
z#qPZ=lSw!_N#(Fp7kzeZYN@cb(|EhXS1OnpSDe7W*x|-;KD`h=aYr@1aS=Rn>c@HT
z5?4=-Va+xXJ@T-+r&}?hCP1Gf9OM_moFvxuWRJ>3LwB~upHag14o{KIJGk3etk1d2
z)qlcH!ask68XX?q22l0^R_OF32C#_I#kRlK>YuCk`-mgd))3pP_OD+8J6S(bn|E+;
z+I0^B39K*)BDvGeIwN}S;H}=xm?lme?Cd0Nv4^Zk5G-6}()-k^_KZSnVzX>&PZ$z!
zyXY^U!^P8Aerm09#_z{qKkl!VJ0p;Xy5|(=wD|L`Vl-#$I=ekLU}sb1+~oXfeL(vP
z!t--DJsDf_eFr?bEy0;t04C{og_f{Atw_i)?z*ElSw9dsC1-f3BPi}9MX2~?0vpaN
z5gDa*y2*^PrhNqhv?~EAgMXL@e83X@^``x4l>T9GX8*I%0M4@ylbdr(D*7OJeVEKC
zr#|p8ccQ_IA-ll}#%@qYs6NNPyjtrem0k4p`uJ(ZOb##{tDYs7f)Hr0Y!Lcw`u>k>
zUJ!C~TGbKE>mkPZRCm3n;$vq20xSt@mTA6rpJUPxVRl^Y;DtfGQC{<YrtGnrA?LOA
z_to&$OJisY!`@pH2)F=HrUY!5@T95BB{vKd=s_dn{rl+x-6j9WrsmH}XFcj#l9a#W
z&pPIQwJ_E95hy7HMG1S;=C)gK)P8;*Bi1~4fi)tGFoyb`v*S4#QY3+eWlv(8mOT$e
z=^N=+lJH3ng-D#~FY>jHCF-*YS}LzxVV4=4eIJ$EzP#k+;BHz<ltz$x^$9(+oK5aG
zDi?DCG5RdJ$i_sliR?Lv()aEaaKrQ@c(Nh44{uwrM-sBl`flDoS6E7e_^5)Hv?Z8$
zcws++<ZdOCmfgLmOr0cOa~xco%12Ag<R*!6a5siO*rPY!>YvmXmt)8nFYMM#GeT>P
znig;3_~ax>{##YxPa{I&Hv1o&{@)pqKllFM-jT`h#X(*p4`VC(y1VmzlGq$?N_W4X
z-O5)1JSGr@DPl60K664LeYEkz=7>sdHI2#hSfnka1uC}VCvbiRnz^;%7+#&7Z=p6G
zRgaB0vucPL(63BG=6#Mg1x@D9q&vZD$2Z#~KD0RrHG@JHz{G9d#U|XMc(nd49?e<{
zl4)x7$c#f!Yx7~mxa!vF+D0sN`=^qQ^8%p}EC7R!qYE*hJhb<cj4&J2C->uLms9vk
z@7FB-zyZS1gXx0qFSkC=3>Ho)MiaTcIa&iR@h<HN^Hq)*vq8<#rE-&&&rW9><#Nd~
zOvY3C;j4hK%m0gc_|v$u{AnfrX@^x|d{HF1l_nzb%*CqPOQ+;KCX#)=0*bB6svmh=
z&GYE@4y%#5d0Z^Og!8$v_K1U9pOe*;X4}(&fW1Zc$aAUgvaN*bw1=DSyYInfg9S#s
zkb`akNsNjubq0%3TMmiBy*;m78ZSB#l_iAi!lxH=spln8P_`XU?@U~*7KRq}!|ggY
zk*_usmCYDkSF~0U@C=8ecj&iwG3S!B)`W)<W_>F$H-T+^2<NWpY041qgHzUF@euAK
zEXZIQ1Ignu(voNG`|sZ@s;m-2W1{{y-sYc1(&5hq`I=YkI4s#p=&@*`#4M7r)E0!0
z2c%(!10`4nXFh(QTA#iIcP$rNsRCxDL|whXn!&_DD!=@&2{u9Uzx%g;_kjO2(|`>Z
z%<FS<HrqPD4`4OY`|TK^HFLP@R*p~zK~R||L3cZniGOZi;OXF&dOPwT!Y+3}Z24~t
z*l(-(XEcH>>iGAl<!>=c?!?nDBcBWH*W4PYhmx&py9|pU1^Zh-aPS@@yA6!3sHiya
z2T$%kxLj*#^u5P!ZAEnzp2lSK&T;7nHB*G57<^pm-H-AQ|56o2;~(mLe7$4Qfw&^V
z+1L-=Qm0zZ?&zMtL^z=_t&cFzW1WN~m0<=*1&||0I|fNFZLKZ`_wAk9(p=L=?M@N-
zUn4t@w6=QF>(YNKT2i>qo)62)0@05lc>6*AJ_&921oN+Gmp8WGu@O3TFAl_n{rWY4
z{Ec2x0gw~SJ4_6we<97&@KpxzhX3mO{(7wcO}ydpF;H!huZAu(JE+YwWZ3#7HPCrb
zw(!B-x!_`JTO4_}*K#yMbVy_`mVz;jZzEVBN@KY&WqQ|##-x~HwR+cB0uG9K;aBC}
zAJOg;yjNkfnt=wo1|_*nUy@^v)@7=}Ui*CP9-Y{fh(y?h@NeA7H8l%hC6A8fYLK;p
z2b>ZbBQOFcSJ>&i-G=o^uc{<zQ4gVq{*jyLPu9?Huf<b%BDZ*QNcQMgVbcUI%?P~W
zt@F^~xIUk|bs;6Mk5P*C&iCOXN3DuSfnWx*+0ke3yCQ<Hz?^b=y!WI?NcZp;&t!By
z0Zq|BFIW|Ti2M&;^<M(}f7vbb%2%;@`*w^r*%FTpOYyuu`ZC_Mp<*~R^(s2mYGygc
z6n9aLUi+VHzjxftQ=Fjg&uV{2PFu4v2NvWGd3T$-d{$=j#ia7_$@*Z75}iUxF&*=A
z4f_BN`H<rE3?8RC-#1VEc^iQ)3BTYEzV3O_D;BW%CiGO(qfTZi0m{9aZsyRn9dlLJ
zYwX*RsJzFY#0lNDMiQDG*;Y2<%3$pSI6$jz=-R;7{!AW19O$9wK4q*;GS?=1!QeF>
zBF+(W6cf*bP@{T)Qc`YkI|8!ec5U!!I1|t&>rP~pOXM`*|5*wQHC$XAr_cNT5E<h0
z{Qr7WrPhhF)NKw;@i^!D?0fmBEp<<sf_giAuSM`S?!;LHpgmT@k`j)C0p6|#E$ZqM
zv$sAUb$2E>v_4}2@^kNgmS~^)-F{$Gj|WDF9PI<3*SIN$MwJPOw5VKT0v(rp-RjA2
zNjOv5g4@<M37rzCBr71vGH&wKZFA_dhfmaPJ@LG>XYy-;x%E9OfLCkhN+aJ1v&Y=h
z)F+s?Yia`%Rj*bl&u2brU4fQPGruNiUUBa)b&r&s^8u|(Y3HH$aZher?4~NY=ooV;
zc>axv`Ddp1hj{^#Mto7nKa9@b62gC&A&EEg1Aof~S(lT`|N3i?=mahnUZFiL78cfW
z&>UW{Toi$-N6?z=ane8D>A%0W|HWbb*U<Oh9|26MW52D@@0i$(?b;rCt(%k0ig$K)
zRtO}+^8Zsf{one_ziiDvJt%PMWaOuYKQ7v<HV6YO`vL&x{(ZE5JyA?3;^0P?Bl$$`
zkR;$PQ~0nAiQb(P3Tcdq%Zw#b%VEw%{6~rnyoo~V^?&B)T)Aw&F^zwdPQ{})s}u18
z1M1&`@o}qK;4PB59#PwG-^F$v5s;bJThn@Yd|1hqN78wJ=&PNgR{Lp>As(dMcX~z?
zbIu&Pyy^Ax!Cb1kCWG9Fi3<|b5=b_4mc<r?PQF*&As#v(byN(~sKOh!=0f?FIlArL
zD%Vc_D=+B@N4zN7vHAUCDyt8}F>(}l6Vof?Ki2v`GQ5BH=>E1+K;XN|feiZaUsG)U
zBPOPTF-d2k<v1Q{g2m{5b%t&40O@G22@yDaE?J@RT_9W2TQ$L1@(_{&qs~)Xw0Qzm
z`M$O*|K+Y~qHfpDJMz}}(Jsa+MW1_iVls}D&?l?Rq5Fi4ay#>H#+pG|8=UW+UzP7<
z;H)_6ppBm7=j%XuQgP*?2)Aw}0dV>I?bIRQ3_z^kDuRo1vYAc8@-B|lMAx+caL@me
zXZ_vR&;SwYKXO|jZhcn;5H5bB9sfC<>H7ii$Ft61VmdzV#suGEaxQs>FnIfKDYX^^
z5Um%IOr5fhsyox0e}~n0%(JyN?-GW+FL3#Vkdy>`qWA%;OVcUJp_Kpk9YK!A*M13v
zhdGwL;hMajIGrh3_D47Sn61}G*m`OXef7RH>=QR{za1`i53D00J3pas4P=-ozdYc&
zy!Dg+1MT>aYyUH){M-Ej`}=>q8{p-)m;1|(^-Xw`OM<xU5o@-Fb@yrm|Ke5t%IE$G
zApP%lx1Hkic2PqjpCRD$xVlx{4gSKRW)uCc4^Wx55kGeEoXVR{Nvx6pKG6TXzmR#3
zx(s2jxx@6nL%b7OFQt>J5o45M(@0KRaWyM&D?ECURLM-qFv+0x<xY`SOO}zV`JT`h
z%r0Xa7)*;&(wCtI8edDeQF2-f&e+oV{U3N`)hK>1CiFqvq24%*nEiyuHLkc}D67q`
zR?e{u%{WKbbStiQW+JfMYor-KAlk1k-PhjE$D4T!3Zn}+gWX2Fo(F0uhnPMLMo3xj
zD$Kq8Ijp%P`x9E$0<i_A7<yWcgfA`*L^mn%dRNc-E+tu(`Tl)&{O5|#CQdZ`2IzqG
z1y~yXEV+t6T<rJ<KJbsM$#J;`nWMRB!feQur)`A4Sv`kodrHyu0`yjAtU;aEREqWt
zgQn9*#~tsLeb~nBZXO~w<^s-#l6fttFhy0&TWE|vB)N`%NK*H{d6QDo?sURF2=-_&
zw4i{xU_%0Bq6Hzs*TQV4wuIa6KKQ<1S{mh-QETy`plCHl9L>+oCBNBSK9dMQ_WX+f
z?YoC>78?ro3m<qmVSD@#+CsH2^5%$$*B)UyTE!u?<3rX=pxsVKfnT%F-5k9~T(cu5
z82p7G{a@J^d%1*+Hv9#e<jrdH15taPTd*LUUhzw&ICFmfScwYxBc289F*r@?c~wHG
zr=jv8``d5z_v=IS{tG9Qet4xXb!OA>COg%!gLx7`aaX5v!j-`vC(gUJ_K4S?RF38$
zevW=RFI0${jJx35<-sh=OXDWw|E$*gZ66YdYZA5P4wEN>7kNE-7f+(bygY9~`bP32
zVS~YR9l2DhZ;z{Rt0odqsdf0%r{cn}d-VRRFA2>q61+ZoEwH>zt`yY_u^HP^Tt>C>
zwpXYRz4I6FAK#gX8Dx-Z?Om7If6uOs;Xx&adx&iaum$}By2-^Z?KN}}zCVi^{=h_j
zJLUh3s{HN9|Lzq9@H`+@3gP%8I~T;Pd}D;|^EV*s|D%!l3!?d3gz?Wy1}^X~y!xNW
z^Iu2)Q+V>%QtIjH0i*2Heiy$a*<Z50<^aC!^&Zt%=$I!~=omojwIXC1{`j_%nNT9b
znEB&71znZnB_(h&C2%q+Egju^KqNIheDSyFVJRBC-UG2HhZZ$YN=|+kHN-D*P7AWe
z00hs0DgxUh;4As{|8GCQ6W)PLoq;x)bkP9a{PS|DJt}RRhYuf0iw(*~tNx)_nLFKW
z<mutTdwhb#iJy5iVL~jFEkO`tDM237)$788M-zu`UeJ$`J_;g^{IC@f*D+tcvTmME
zB9!dsl`iRvg($D?T$f2__f?pdRw1P60CAN|H8C{tAaqWWH9!Xgc>(<pKK6PFRyV}=
za47x!np{hgCm(mcQEXqN*9JYwY{WcOft<KGskb7fi+9KKgY$JSN}}0RKc6==cu5jZ
z>&co}uKa}L7r_SAUi*gI4!A6=fcjj(OF(^DCd41zCz$NcQ!SelP!p1Pl(oU2N4P+*
zPc4BAG|jhvpL=;a5Xq}G+%0s_G+p|!8zL`Allii)U!W%1?|0X{yR(LBH~5#%32C{u
z>ZVEA$8f>Y==rjjB>ihON`mozg?5~}Uw~E6i(^gb;!i<FX#IN58BN~_5dn+%Qj*IP
z_Q*N~aK5GQ0!e{+eIMWzU|P^4kcQ$8MnP=Nz#>>H?wXT(GYrKZs2)U6t^Y^sJmTjY
zW0mNGUXW-rM-wiqymzk$j44A6=bv}SDeZj!l%b{Oq8Nf3(~nz2f?FNtCmCzr51~6X
z3vXH%o$dwE0PP}vxYiZ|)``WIB#5UD9lvjctqK+0NTtir38x`fI_7x3OuCcYvgSi(
zDA!}C1u24GBew_Z#D#N(UZLIXu|ZB?iRA4#<9a7t8Pj#NPx`75wQ(yCc!Ia9ZS(HA
zitUYr2u?UFBHwf&$qxeztvVP%-F|xDG%s5ATK3JGFCIlfD#l_Soek<92c$^k47jiW
zY>?OfQp-KslN68f2;vAp>U;GkP~6fiHwo-{NX2mfv7?lrlC!$<mZ`cltjx{qC8pkf
zNAq*O>e^hf^w3gTeQY-^;NY)7Qk{(srNkr@4%|{x!g9_pfdu8Kw;u~ka{|X_?)W^n
z`*VfWk0tv00M8FSC2YlZUV5-y{{L|G7eIA1Z5J+#ySrP0y9aj(?iyT!yE_C38iKoP
zaDqDo2)=Q*U>moM2RM`G{r<mBolK>Qf?}AN?mgXo_gd>hr9}X`$518UKq}OGfr*je
z0?LT7=-tqplb~8<dX%dES>m@KWH9<bmntkrRHvAAa1qy|JaH=ygog1XZH!(N<bIDA
zZh({g@4~e-qBa8-Oe-thk@)S8bAD(<ZjwR1QbJa}!pgm|&Nuy8a&Ip*zeiD|%9Q8c
zf_zm2OW1O9(@u)U+ZQz+10pvaATp&-0v2O(;;QoEsthW$p5S<4y(C0Y<wSqg%rATp
z;})6l-7~;9&F{3CJoR+{(bDgjC13~92oKOg-Dm+S;?MU&#U3Ltpqult@u=I@0|$fe
z#<w6lYsNUgIap1T7P%v@N6=smd08b83bO&)bHVlCWs34MJT`3vG8s7)|NFC#2g+lR
z1I<X?LNDtvJOm30Bp<v_htkJpem<0AO!FX8zcw1#UYl?|KZ`#n=NYxfUq0u1a2|=k
zYo(I-C2xA~gnF!Jt7M=62~6<aSJu2Un+=4Bo7HPIYA({~V`GTLx6$iFSCJBRq;?c`
zvA_<I>E$3r#$y>P3PzRW{wifhEULwCQl|XNG<n@0RAth);%kNN94JQc5S)g84>|=r
zNBS$9$Gv1a0iH<y8!1#bZ>gHKIj_g68uk#~!XOKb$%allQgp}fELL1A<Uo+CF}0S-
zCvwO1bjf{kWn{Mv^}AlB3eg%C!SjlcSyEC!>jNb9ArwwVe@dxA|6?^*Z^#!$Hva3`
zJV(aU0~7ppl;RdZu!wN!vJJ>Bwh(2Ij%w0LHSSr486=V#ae_^W(E=4$KBStB3a)U(
zGtmO{NMJCQbX5>flu*Uge_kwr5(?>C!ptO1J#1x~DBR9!4d5f1b$fkt(+E+L?bpC;
zD(<B5z2;$96y}d<8H=AtMKPn3VE3Oa%8(%bwI`>nw)GRxe6WX5oGdYa6NUwHvzNsA
zQTt;yjJcrT-Ae{on6g{mUC%yVB;Hxvm@B1Ftdi~x{Z6dLY~i<yXXtmPubibp?M;o~
zb+>lb017>HZvQ$yBXqY!1~~{XKGEx-m>*s2xai?jHlY4j07UZ1zzW$<B&l3VV4`gS
z&oiO5e<Iyc-OQeO?86flnZJdd2c{CHbGSmv6`&3~|A9J4)tLR?1&;T)^Dq`p4HQ3X
z4oPEL9a~AH#XNGH!`nNZ$2O*3UrVqwiFryN>3bqah^SS%5|l7z;}#opgKotosxs=I
z>B_qtzar2ZTsC5Z6uW>?Ge#4}FMP(r(m2kCdZR_Wzu9eJf<cX+kjr{H;%Fw2bEs9c
z;{mJ@vLKZfrtcHNYRp59GCv-AO6#u9aR&W@yFYWGud7tpXHeuppj4_0-JKsraWcoP
z^?9RwMAo^A2l$V7KBsxx$Fp!KA*-ov4zbqwXIjp|0a;9DKQ)}sW&b!<T|-c(8<BOX
ziuyHeeIKT7YSq+uiJg-I->Bq_Fdv#43Y^F<*)jV)Amio&zkJP}1NtgpqX+tGNFJG9
z@b2W%Klqnqu-5;&1;Eb%4)zAXtk0kVw8Vc0E#Lpz1R$UQNB1u}pm_P=zqB$Su`GQV
zm>A%d|BDOyFES|m|4tr~r?KKN^r_OpmK-?sTiXBc+na<|g9kjE3}M=kj`b#PG)a2k
z<S&~4J<woWKT<K3UjsJD4V-o;)*Gbk1?8n;(B0$(x<nd}730=}v78yFoH%|Kv9916
ze-Q-5%|<usV3I`6#qNev+*EWriy*aN01~Y<t|gig^2Hm$G{w=Ry5Fbzm#tEVKuY=~
zO56ZZU5}nhUDJS{d5Hx(%b+}qPJACjB1OiZCHTQJA+tg|2KMYsZ%<BoJ0ybeZ6JaT
z_euTV{a5xPh)n!?Li7Xsc){_>stz??j^-C4vVt25s*pu&#W6`h#RY)L8>Ipe&VK~H
zW-7REci`JNMKp?at=OpGaGv@U+{BLJ`8k5t>`6XfBTAePRk5yh*tGZSvXa%e7B^&;
zATE^V&a}R7R{JwPm@jKJ2JcMX=s+eq80d@Mzq$(Y<TF{>LtS7LblAo7IS~{uJSA+_
zLcv1ic&qv6F`q+?k~)Lnnb=`1C-ZP%Klz&#*}HrETo{x@lbLyQGehn^sMA4e3O6Xo
z^~404kn+FY^mGO)Rx<B+;UJPx8Tv!W&EPXNOxC0#pDBoMg`O(_;p?UR@+9j==Eu#t
z`Yy0zuY#)zdQp>a#x;PrWFnVX^E}}o^yf*Af_xecIl?OX_9gR77Yk-JT2LuzTEYH|
ztxyk~M#)%6;VY~!-;B54XUK{U^3hF++*SzmvBN+!_S2WU5srJOjORu~Yw7o_U}6gl
zt~AEb6?zi0f;CHr!dv5FRLw}fD1PTV5^Wv=2p<lO0-kE3R=b;7{XP`lcwSnI@`3&X
z!K!YX8XZ#|a+k(zjUmNES+&dJ!Z6W`4-ZM}q+-4hM*B^vcotgax2)>o<nK`YB*Z9|
z!y0Ji)lMI-7g(dL)C1M*4BU+wGrfC7nAq(?k8hhy5&VDt3;6d2uu=>vFHYc^+vCt6
zCr$MRYifsbhXDpV8n;{9IC73(aJzP3zdQ-&_f<7#%Kct~jeBDsp;xd@#1cj>J@Gky
zd-H_4F^zfFgqYcnncMzmpl~oeI_Nu%b|q@w7efizt!L`OB*{OG-PDXVUyXA0n0Wv5
zD47zKAsfuyf#m0dPQ#HPewX&99zq_|xX?KBLp1WDDq@EnfyR4bfRp=?9v<vC7{Ftn
zhbikZ6^rSpc;e3Cq-~`X{4w(bE5B0`E%4N&6Gk9vUdH974<xs92TSH8CesEL@5i)M
zREZzopOa`eX_WEhZHf`39`Z<i4wuzaN&Wt}l*^r?mJTYx^;}_uh$?WVI^_!eP<dL!
zI(^u*I3|OnaJtDwWDtkw{xg=_5(|YUAMiondiU?;a4S@3qg2SG+M%>eR1ll?9C-!E
zf%*N5H)gQARGnXTdo;@aOD;`&x|axzSpkxq(8mZr##+s2`tUU*^(_@?^P%J=`{ZxN
zp?Ve`a)*VT%BSQmVvygW&h)t2E>ojg1;eX%eGW>o)yJ9>O^|jDr^$Fof?<v<^v#D!
z(MOZT4oA={Ac>P93WKa%o3B^CfmV8KW<x31^V@BEov{vb?c*0_+>ryC)XU8IO2*QV
z(ftYb0{s+E4a^HLh2FT;emIK0S4~1|XC@q6<$wB}$BeFFtsJFZSX_UwK()t`k;iq)
zW82(HuXFvn*Z?BcCDPoCJD8kO%)6Cr34r8zRL<P#@$*7ZtiFbB{<-f?s#25KOmF>0
zwd7%97$<6&*eE>q^e<)~^S=qz%ej*C_zN}I#TqZGg*lFuWv=*?%3>h~&*iZA{=vL~
zOC)V(pG5=Dkny1wV_s(QyFTc3mdbDIeaS=;K5pWo_z#OfhIcs;3Mu*%<!H|ER=AT<
zsS=~Fo}Yd3BAqKjrqXYbA}!Q9)pec-!lyySeH~zZ!ufnnieh8*{(uE6@DxMjXFRPN
zK6cd+x*AcD(pR0uiT2#CFJt1*X<yK_L=8ETZM>^{Q)`;6+Iv&2d`W+2g~#bV+9qsT
zPJ(`L2$uDF!fPAo1v8&`^P)M$ryYp+-ZT+)GeWrk_hJXs&XL~Swt*OY()GYVTYvS)
zpk=3x6HAHKuXfn53~^=YFd`d(JvlxcR4>)!^jKbqhXLcoiOir``K67_GTerwA*UM@
zYsG%gcr^D=GBtXtARHDmlSoCkCXP=kCn>UwrOEgk(TIpr`!3Gj?5P}Zn<_H=_?;(M
z?q^8_zo>tK(8p0E7Mx(LLHhf;IjK4L=>Xz;FSy%_e9Lg7gUR!68BF}&YaSSHC^4&h
z57WNL;7JSBR7D(=dkldm;Sjo)Ta%H1u`1`^P^P63MuA!#Nf~KcsIcA$(B}%$Gk_rx
zulzd+1ZN@8&jIx2YJ|2du_Z-u$bryloBgL@?}CYRVt|L)C=Qe2Z3AR@=K|G{e=;g(
zHB9JdQTtQeW*33;ysbtQO}jckR0_zf+O+Mgq&^5s1@hF@0IM%B<LD*v6JiA0A?my%
znzauo;3qyQ#He+ZNZhJOXs|?STrciLtFGG78*o-q{RCPI9bzyRWF7PR5krT-o5beG
zrIocMx7v#2-+<S7M09(F+7OlYD0qNPMtIdPEz}UQRomx;Yu1`l-)I)D_Yi{5l+Fq#
z!B>^Mp+X~-$m%@I<M8c#&M^L~mI|(Kd-Z^is1#~v`S<v3OOT<I)vvKH8w2%Z$Bkx9
zP4%I2<D7sK7BodtA<#%RTe>K5BwDKOD6jt{^8~TKJ&G}JYDDV`<IhFbAhvymdfJEO
z)GcMpZU@V~(J(PrjN6n|@xL4!fA>cL(@Ol;DkjL?8+ZwNSS#XY3Xz*$D5^5<U{gpu
z@fLcw%w{*o`IO!Sr(=x6g1s4esPo?;0zC*PA4D%iIrCFguuWVn0Sy$1t++E>WF1@h
zdbhnglyU@!Ih90e!`dZUS<e_bQ*pk)O)vV5$x1ChQR_1}fIVzxa0m1;A7j*ZZC<YF
zTbQxCm3)6<rSr0qU@#-HvHOgfsp$Nc7+kh7hD_sxzFM%0K#w!Nnfc^ykbDxi&@l#s
z^4ct@Wi-QiiHwm%hqg^we2I~^bb3}oq?iq^Hz`0s(aB4y0|Vu*N-h;YutX`Dq&YHu
zzt`rJ8;119H&dc(%a4(-5^x{Fj7kyo%|#WL+U3w71VxD5bc1`pdooBD$SX@NxU?94
z^)J~NQ(OM{{_dcAaMOzrq-g%XzJltv#^|6dI!nB}L0{y<#tT_KWl2`?3fWxg`P&jP
znW79?Tg4mSQk9u*R_44Qw(?|;e5aVUSHay)O|U@{-9!ImDk08ZQZnt>RK>Z<?mS^O
z!qw$ue`2vY!inb~cX_ctxXb9TM<xp8s53vzgR-i~FrHl4no_W2?utGUW4;nD8kt`{
zEwuPO4bdXcj_QfBCKlTp0$ORKLwNM2zkGoOF(<RpwQ*y*=7hzE1}3qXaFUg-+ihPC
zRCIY!#Zff4rzDKoGFo}xe1H)2<YNxLi!abDA)1D9pKF=nFE1Y4hN%dar@R6GEn)kH
znEY2(qeV0-u`IWv7hx8EI`N~#AR}tdRCfNMiE}8Pa+SuHFMSI64KYlNCzXE+*^+1e
zdLCzU>Jfo31T(qKSCVVtc0Is0bGc*okVBSFuztWy3A?1}iYxoA9yU;xj^$PQVs13L
zXh>81jZs@cD{#iiLo_9CH9F{pYOmyi_@RvuLO>wf2;kzj{1|iu1&+xbW%l0{q^JBh
zK@P%%5EM`U{v&V5Lur6k*Vh`~!;4zexi5PzSgPKnZER_$7u&~=_=s8}J|-+M;}b3D
zuJ>Y1#ATzD@P?o}7^gUyR3qy+aSt8~_vl8xRp-%lL&M<fGZ<U;@X&C7sEHI@Zqye$
zcy2D;PqF3cWSX6AId_8P2rEc0cP8h#$RYP^X+G?;ugNFWXCf4Dp7Q-xWsW>1hgfW|
zI|2Hbgm6pOv{e-DO8NYTo0->hf(ElfGj>N{f#_%wSi}9@W;7vf_oQH99s%5L!_dMF
zw)*|i>er@C^d98Gur4d{%V9RP#YR=vXcLhmsrv~xWZA<KHlBpW|2*YyfRg`MR(5&e
z{gdGD??$<_Qvol;e)eJ*5h{%y9uq!eQzKUwrke2$y9ct^5GSuakVWPL!yFxh7N5x0
z(opR*At>A2kdl!Z|A50#=`btxhz3K1JmumWs&9ubZN;rj_vXsCCS&S(B100-vNWkT
zp$))>>cu3bU1iLmPfL4DZqHhf{_B5@fC%AJf9bOIBUfq{OScIaa>Eg)n2@wyU2;%)
z_cLEN3bBC|&-UhUt{*DhH3eSf&xMgnXp3~A77?}}hP&^LwPT)HiE>#ud=f6_jt}{s
zlQyD7{Evd@Ak?r;B6M)PRI-!4TA-r$=1+ku7v7T3#?S~SV^kKEr+<Z30{yBpxk<@Q
z+-0?SjMOrFz1bpNz}iMj-(T@zzkO*z@2b036?cxlf#|JyS6W{MYp%(#sux*`#$9Dp
zO+jW4AE?2T-Rl^%olEZvNQ$H}$m2SMkTs`yq%tLL!4E6HRjq_~jv}TrDd=eE9hpT6
zQ0zRXqImWde^~}(feZso2*23j?FBX{uUSgZHEr~UY|=2nE<*Gz?C|kwQlQ~)?akEN
z*1H5kY+i9`p3I6gMZhI0vDV|v)N;998AJ>JSNm~#!2mnH2WvBAlKCZQHbhBkVXO`p
zq^BAmc601Wq{Hj;J@SNait{6MfBoBy<~M}wSL~$x7sgMqs7wukGbTYXd_X_hY*z6W
zsec+o8e6-ITDS*3z*Cd60R8>`d#RjFww5(~zBIOQV_UdFoXQk5E;EAJS*MCcCc9W}
z!W~_Zj=Zqc`h?bvh)n7?jD}8{WwF^UU~;;KEr4oN5yrWyB2wh;|A6<?U_N2$C7>#L
zLMlrCwn5)2dI1`C##2sJ@GXUZ(mv#o-Ny89rWer;Z(8DBPEaXomU2yerT6f)+p>7(
zW{Kh%$U{L{$^Sznrh&en9A=HTccB}R+&(unYzvQc6fF7U6BARNwPqFWysX(3stAw1
zM&j5g)Z9x)QUClH5qLg1J(R>xY9{ETc3iMv^nEK^3`z9e4Ri5Y>QuyWD92wA?roWN
zxydSJadpMDM-jU94+sZiHSh6cRY+1|r$t#6AzJOC)UFgdvYp6`tGx{5`iSBG)r%K3
zIgIzKF&G^BB+_yiO|kf3xf6NQT8^l6lkM<q4{a^|xFFU=pG9t=B9RZXZbDg37?%$w
zzvr}6BC5<+B|!`7yH&}-4~J1ma2QY$mt2^ROeau$HDgwIr+bn0GnivbG(GGjV%)RT
z!sA<|o$F?oezQ8ARx&UTO~sJk&fH8iSO=2M)3yHhsiK8stbFsK&_gCay@OBFuP?m%
zn+6}2gKb4D8$r(ZJ`Y}pPdF$UPj97<fIv^b7d!jHl^j}yf?%4$V9d!xPuXdePpGQq
zd^qaYcxWnmR66X*;m#$(EGz1}dZjVCWeW!%Q|*SR6bxEn&4N;vMEHeAfDJbi#zcxE
zCYM@|*!Z^s9w<J1kNGz-o3D%9bnX_&ZS41>)uguA|6@9B^UPIG*N{CI4Ek5=_@|tZ
zbUn@wqkz{z=;0-zlrvSf1fBF1*i`uB?OOb+aFo#eTf}(YpBv%5MFEg0WvK%xkUg##
z`1W`P6*X{#Dev$>Py9j=Ogr}xx;KOrD61*`chb3X)!*Of(eF$v%?tjj17+mMO-m2i
zCf2upm)Gw;5*L8MK^T`fPzAFoSMKjm8v#su%t58Y!VGHPjwaE2o<r)4W8n;8`D<~d
zB;gfbsCJ-)O($@_p9ijvLjFD?bWeRh+(vXipm&(JZjs~v4cLTemrIrt@Z9BdIUW<4
ztwfb|@uu_sLvcQzv<^L(vua@*x8`~x)VxpeXC5KE-O%EjCbOF&+MZLtNMEIZcW}8i
z_;5a@vrZF;DuQ@A#Z8pXncwBWcR2u-xqnrn9ws1zYmXrno)<Ef%<QsstjlTrI5HtB
zb#}bIZ{D6|tdE{9v7pB`X+%3*YW_*T&XVP=Tvu{@NS$$b$ox}MCxiDFBEqk(zTE=`
zY!Pk^pRlYfK2Z%@wcU)keeMn*nTmy(Y@*SOR1!{(#)M=P6&E*{y&%L<iox#=E30Vm
zaS%ma?=zW?rRc{z2QOM5=<e*}vJ|8v0W)ogvW%?kpT)Dz4*?J!gcD4;N{v$2{$DUU
zi%Va2KiiYaJv{vg9SOL(gFSM1YdaV7!MPFmI7DF_Dm*utBEUVtTH8Ouu5{IAV)oX@
zaij!P+yOwINZ_k10LW9{Xm>|ES*nu*2(SP2RV7N9I5IH=`=MpFGv;{p!6x56+F55x
zTUw@g9PE|@R=__qyN4fve1$G)AZjs5*w;;~S`V65A#GqVO7-(I>d@})iOsahM;kqc
z28Juii%LvEr*5_yq(EgrO+8emoUPVmtxO^9V=@Dt`4IdnyxAL^*w-gs@-Z0!Fd&Kp
z;s02~r2}i;7hi&tw3$-1a3sZOyo?s>Oeley1~xDl>T((md;o3}W54+H#dprlnUe^C
zwTGv2#9D?F5!_kJX~gnpO3oiv<X}G5C>?hd^UwJ$@<}Z4c6{U$iSRTt6>h{O@=0X0
zCtf>-2zXPYhli*on4W_5XrDF9B||luFEwJ=lhesZ-W}o=B&u9<adYp6pkiXCw*=^X
z#i0dNsK4u(FeSpjbtnD`SS0Z}>2h;&)GE}ddxG|UWA~g*WO4@>0e&T9Sih=r+Yc_x
zD$}z=M#z%!<9llC;$Lp~g7oz2ge8$oFC?cdHjy!fgI~#1!`aMsR>Zr4$s(67iXUf~
zJ9LIoW5#Dx*JsRbcvr6p@Uy0dvk9lK0IjapXYOpu!@zYc-3ysQyT=3IkLge6iR{*`
zG+IgNWq{YP6!Z+*-Doi=MdLhA77GKP?`CyOm+Q@b1AJ8HGD4hLEg;KcDRkw-DQUtV
z0Va9FkhjLYq_mK7Op}3n75w_e+mRMS&bbGkiOEUVl|Lw9lwFb!%A_TQyXc3LBbRhm
zSKl89Uw)yJ^XY5iJV2GMPWD*|Zm$33%IOZ9r+nJstHLylikBkYK0v%JD`De9>j6T`
zW>;;rYYbAC3IOnC5tsGEZ<9`sqXFlpq@k<>X6>p7KtuOyl`Z9Gs%aKKBCj)o^hVgL
z0cuZ>sRDhq@Ch0_w*^mL0Nf2N7~1(8tBvEj?<JAFEdLPvn{NFo50NZE9@0&-Oz56q
z+aT550HP<|>A^)s9xLIx<az(jyq!meZ<h0kS}7ZCXei+2%dDgKRL<f-2JC7w;^L<}
zE8Nx-eGgZ=|8QUt^oxY7t?~?`)6<xMh%aR^;(G@UL_F;on!*Lr*`Mz0-$wnNoii|O
za^Z*11DB)$;@{lbciU6k0Rg_4s+*OGkanlorTqC^9~CdYOQgVo^e>_(>+SAcn1DVd
zd^T;`{3XC@JPn}dM&Oh!hY(Db0Y<z!MhPiZ@I8}MBpPUGDSgpAcCwR^pA;GS#YyB!
z7_;~Ait_yslT+3;1Oix8Bg_@W*^y%>!G-Tza^bPPG&=y)*s+Q{mT{0;_{m}}y^qH|
z!ltbByW?F_xTp$42g^XT;K=Q5tlzrZn~XIs{YHYa_+PdQOr`(!<&rswkB7n{mhhSa
z;D^5yn$*<)0ZI!2_*-;RmZXXHEkQC?fGfPi#SghqUd9yY1C>ppr3$oa3hAP6DhfHR
zu9EfR`ah3au{MoWDzqBe#1>D$N^zgO!x|e-ey2!?m`>U{Xp%Kwm6hr;7!=?OcXe|V
zNLUH)qQ%RemF<F`7yIrc*6)c*Rr8GvH0*&_3QT~c383oy3O-$F684W}?gaM!jpOZ&
zp_8i0E9O7<{M?6+@#alQTVSd#ruZt-?1+!YtWE|H?qsGsMt5$*oMpeIziV+c#>`F8
zf9!Z1bGr0Jj>xK(+#Ha3yplmZ=-;z24tRr&64CP#g^Nc`llg>9Me6$(Jo65486$}D
z0c37@z&uDp*s03sc|1?VWf}d?(|WiUV2e<FE>~>#I6Rw%R8qBQ()}=x%zfWhP@&@3
z(@~<yDtxHew>E;=htv9b@<$)<9(9!NiuvQCXcN92c%!oe`8jajQY-K&ME7E0vb3|z
zYuG}YhiQRya48i6pw)&9aTlxg!%2AU04Ux^BVe4>q7)6-cE@cbxmjy<26T{;y|TM<
zs`N4NX7{(90WW`^)EP49`LFlu`ucUm%LTWloH&_`DzL5(#-sdT=W(SzQ0628U2nHn
z5U5*uFxLOzo_Bkvaj21qcdk(^e0?w)j-yQ?ufM^}BD4+XUi=t+vEc<|4B&776Ui%<
zRO!@^^oo51%$KZu%lrM|4`P#&46Z=aB*`loumCy<2+&n%VH$`JR;cj#&b|Zo{BQqi
zH_s!@mZLa(qc^^J8h|&`Sy4$k*W(u8mpKKnne>o-r(JsNRJpRr6=o~{>)Nz6&DF(o
zq*1kW<Q|DZ&Xj8g{7Rdpv-5O5Ib#Y0vQ&`Hsfq9*uPgR>>1wXWMz!VL8jN?Q<L{*k
zz7YrX^&W*5jps!G<-P*bHX4xWfU$1M2RooNnm&)gOKk!t$tEv~377vaUt0)__Q-?f
zqj3F^YCB?YH{^};TD>pvk>e3-+h6S(y3a<;H-B~0f7Bm}{a|CyDCAIOR0s;w;@Yb(
z9w5!3yKFG|qWU(i-aL_uUx;>>HUSR+Fa6V}PjC<43tmYeDEq7lLU2{tOIl)Qq>Fn$
zESd2KGU~puY9m?w9|-RZ0O2t{en*j*pxcXOg5xq#quv&N{QslySRYeRdgw>#=kEkm
zM9aeN)ko!uc0Bd23vGQU-cv?LBHjdD_t>^wq;}DhICYM80;$3uH?h$Ptu3zaY(J2G
z+$2CRui0arak1P~+QdVTinlY_5;s;gmb+M!{!+z@SqQXFBhdq3xc>4z;nl#STCI`f
zTurA8u7R>SWHTMWy<iRj2KjtR>i6$USiHTxp?lt!yhrZF;-*R=bBHlP5XrZQ4$ZsA
zPUV8!!R9sIQzQ7D`(H|d+*f0qC8yb`(2PZAVcow(yoLd(!b5dK!TqD(8J$(Jtb5NW
zJ$7im;Oqq^eZ=rHOE)eITsZz~P9p3>crp0w3x>WS<&WA$hS{32B}!=0h}c{Vk}_x8
z`+20$7jwIS{Z}EC1g&nP>LQE+*0@~b?Mf8bnJbK_$`$f1`kd?4W{<eu{03X5H}L0U
zTpe_4rhb0Ud|hyC=Ix1M;4^<FE3F|Ee+IiEAL2lUzF6=466M&$(-Un}hP?I5>)tl%
zcl|9f0dS7x;+ral@Vm@-SSrMv?-Ro?-(DDlT$-++EXAti-4%CX0utp#t6Qe2M-dn9
zM5!{F7AB1G4BPIj&OWBvpKsXtpMLMsbo7pqTOYQ&xq>CxMf$Yz0Vciyj?M7Bv(8$k
zIp)1=b6w5rZwqzF&ZrL`CD>Eg4mM?CXRjb~5`<lo*YO!W$Iwv}odwQwL0(sGVC>7V
z&yRFQ>!D-;KNHzZ5ky)}RqI4&Wk@6m-58AaHdFQ=9eTq?xt(XY&TO{dZTrrAIg%l?
zDrS+{ncS2jbhzwKXE1a}{p%$v4rC*=sh5qgDPaKkLOk!v50{^g!fwh?lZ`yiWtsAh
z9zpP9Tp~7US2IHg5`;y&2&q63Hcb5yW&Z(+yR>&{%bWmq??VAO>d!yW{ISR+sXJJU
zXVl(-w%)<E%?P6h_?Bl1jaur9wJalA8O_X-8bkV>+0vaq-k0I9YM1z0WwlZy-B;GE
zc;d_j7Hxc?X=b=W;Y;MTtTMINZM0xoZQOUlue6tGDjf}F+L-A2!>Zkrc{Umuc)vR!
zQ-%DVinc)s^MkM}PFAZ)0#?;VgSCoIII4g@=1P;c<bB#pQtO_)=j7QQ`QC4J^bTeJ
zLamp5Bq4Xo+-LoPL_5ppC(H==g}z$0Wtfe--GU`6RJZiJ5OElT-GFw`&qC;&#hih4
z-}@sPcsf4Y$P>7Z00B~(5aaF&zJvN%JaR;%sG*!(y(S2{QI2@~r{+hnvh!|K#nud*
zlh#R<ZUx%v0%@Gv5NWXyKPk)>>U>ov=@eY&OtWE;F0Y73MP;ntWMW?u+lPOBw%`wK
z%uZ4=knIw+sqo^i*JH=(wBA8)L>z4Lk!{Xm`$jB~a*`=U=Il<3=;vmo3*7|gau~7H
zQlZz(CnRdD7IyXM`{zeZ0zz@Z+R_~+vO?5oD__U)rM;Dnp9all%9l4HL~#-b6dpS;
zlQFs>l;a0?V&eAQ<CiP=acO=Bmm8khgV91V2tVx{kS+p4%zoU}+q5#AK1Vb0^5KAs
zTz!YV9E@I(>E+mlk7b-6;cW$dx#QAg2CQH8iKYTZo4Qbl#|M+S#M3A1W-1;(egJj|
zXt98jHFy+cC;_r)0H3XS&n{efr<N4h2wLz>HTa)`i!dydbBEk7<Jdi?=-QMoQG28_
zDFv3{7;>r_o+!GxryCsi1JP=<5hV^ki&-6KDiUAvJsm%i&_r|fD$Wu7`R0n}oX?(A
z#~zRfqJ%b@r&XMmPA<~k@yBZuwn05072UZ%epJ6Z>}OXi(5SWh8`OQmJi+O`Xwh~K
zgP>gn#L@Sq(4m_(lY3Cly1iJt03E=wqu-5myM+}d)!sRBjt+l<j@SagWCRrgw?Yet
z3=X7(1TY3=ur&9zZ7RB0-5Wjtq~hFse~P<mL(5i_Mf>wXBWS-g)KiX*HLf`7#IsI9
z3ZV)Z<tuBi-eMPSjX-)x$eGk#f9Rj7)`I&#`}Rl251k4cpiZk-68+izUlF0PoJGkL
z$1Q7pLY0Ibwqcth1O@K5V<|CPg{UMM%RdDp@AM<P1Y-Kqx0iYx7?r@SaLRU`(k6j&
zVTCBP$Lyh7u6+e=jy_FONAK#sF$HVptX+lLIfx&fR+@gerx3<~nzPp_iX~}aQ>uey
zN}=cQ({P-KYwSFjw3cW!b1s=S&cEMXVe5|RqV2R0-|d%A?Lg@L*sb5g)D=8!mP9+O
z+BVJJGP6KB5X5cd0j&0srGfks=x*G;zb!TOpBIco+lPMX)HHZ)kYWf^#!xzNppw#4
zNll;B`-#V*iCly;VTkaNd;*A?!uK<W3gP;CX@@oexVQcWeYxBB0&AN6xl9Yi_BtUo
zJR$o}3W)Qz0a(VJqJ@&F_;?oJ4>8<am&<(uyb!Gbj#ylY=`U%-56gQ*!fR_4G~mhy
zDj=B-{v}sbMDTU&5Zl1v5~Z`iH&SjKE#z8;?0x(%6xt?Kel?OWL$XGXO{f`c2EkRO
z4c5peUaktfJbbG$=;p{}v29AP7y&?#R`=-B-A{Xq(;~~_%6Y<fM)k85Ox`egv7Gf<
z-XeeRX1vc6`+|8F`%~G(({3y64YhES?F<v#SpSK%LIHI3a{+(*NAlB+zc><j>|OfY
z^h4N-B3wnE5nsK9y?){Q;9f4DsyH%hmpXoKusV`@IPZ*_3aml$V>%__z$tTZStH?|
zAaW=8+?XQQZl3EKtC28Ytw@VLK}bIGw_Q~LGL>MMP{S-nEw|bz{90e8yk*3$*1l@p
zR`YXcTb<ga@WWiD`A@(1HarSiMlk6$eLG3nNnt^{)8|oY-LC{bpcXPKy1}pFtqnJ7
z4#Z{=T0euI7yz1`;|nWz=+kl*Ve>Hj%aBa9=an75s%`5~(*e?3c;b=dcqlU*|0WtW
zzYK#oyN<t*y-oVsYU>Xd^S@3(JBMtu2wv5TLs>+7)(G)@p049zYLdWP?X;~BNhF5y
z6|VC!a9E1oNVM88C_NFC!(ju(I!bQ|#Z;|^U>!M3WGprGot3Xc{rb<%C{saC;ydSr
z5X8_L->a;yHB0~ASB@Na!hXc90)x(CAP>tRSJtI)VtNFOaeT)SMQ9Z^6caDr*W>*=
zrGYH+XLe}+SsAr%2TPl5$lBaElnt^a%kwypChdISp>GzIwCg-*_T?Q(s}MS7j0~Y{
z-8QT8)CmlzHJ`rDho9jSR{A1#S8L_B^6%7%fN7sZVFCoeDr0q>f)n53SdOicyz-Tl
zIy(Smgc#s9TXvN~_G>w*-R6SD8N%XAcMcEJ-}c0)$e_WL^~{gL-Z(J#s4Kms<sg`t
zNAHPZ7$&oJg(os-pc76AnLac831SeX=@J>z^4iMVXq?j%ej^?tE>H_KNWpK!-ko94
z^&`+}IYHKpp~qmZEr{(|I`j?FKf!Ul&~5<|!4A_nJWfB4AWk@f=Lrd0p?+j}_m85d
zs5@!wTyD32P#hnLnjGx0VhY+a-oe?OZ&hLS{8h1IMl(03V;*I!G;*UVq1q_?9T0ec
z0c!QX#)9h(ftC1uzeV(bH7|U>DKm^_<$M3Joa>8grumlz1@4p|O*!{xsiP@T=4hZM
zJI{;@M5g_^FXCZ&62)mmJnN~0^^!?u!pVjk`h+@gocXYn>Q#HfFeI`3;$OS0KoyUo
zRq{XTn-9fLO(==&A!W?{wc`D?mnCu24##{f{AeTl@OScM$?2+I!9k~jW5;Bst;Yyl
zbmLRcK+RLPbQ$hLU2nKkhnI_9U0Bk&e2yVH&~g6_H^{WcfZZ*DQ~_jhHF*EqUg@Zt
z2$f#%dS;6yp&pq%4Z|q@);(}r?t~@nf!r^4v?JEEnLca;Z-n)gNNoGVr}!|lj(0el
z&!VQIEMj>Zj*D9(<pLgC#RFy3_NFbY-_6lM)F!TNGeJw_Ob&DWVcZgI1duo}vnvKb
zc++K;Y(8<)f@HJQH8>zaxZRi<e*lLOFBrX$ESbda?3}m3dL9^&NY&c{f~8NBQ)7YA
z!CZ!=2Uv`AfCvegS^Y`<_w=y|A$vqc<Z?ePJ}L<(nWH2!vy{oZ$_Tam`bF5dl!pn{
zDP|o`z>NONExcI&p%_|Z(&uI<&=0QdV|-ST?^&U(K^ck8lrIHtaL@g}8S%fPP@4H)
zC*5_HOdKNYh27R9A13v~^Ui4r5nGzeji*|Q76abnfZ%YNumrde02&5d$W?10A+ALb
zjGyqie1n`gI|UH5-A47s0imIxsRsw&O~KU0(8m2)-q@&_KL5XePH=dfP^2ZDot^3p
zokH7P&IjjTn2quA@LZ;zb6bU){L@dSHXkqeg}6I?x!v~1z5r+e#dcr;%MRULcLFpc
z5XXhqtrw9M^vVWV_P_1v_|^+6!uMgr@Lu`vmu!l{5%E^5ae}>xOkCgVz5Ytg^4awt
zViB{wK&|%p->-|*iXnHO5IDOUoV93x8&>pmJnR+JQbI5ML8#nNt7)uZXR(mSkXZ<v
zhyYkmI$g-yDMvKWAVh^h`+s7-boom3ZmL1uHnSUe>H`y(xl?58+UpWj@{9#Py0{km
zLf;=>FX=%>{Jvq|+nb8?(|H4!xSGxmXS$qJ_40fb2{}xg_j%$l1PinWDHy(qu&>^V
zOdx)DB5fv`Jh=_Ix?1`xY31(1cEO9${d87}no%IXDI6dw$Y%tn$_GzultV#Mhb2x}
z{^Q_KD=IHa7wTZjFk;{fDzGcf^1*EnX|w0WFYShq-FSO{Jl!O7pYd4t-b^Q@@hoP<
z4C{48RH^qV5a%M<r*l0<qvd7chwiKn6(66@k*M=#SJE9+Przf5N51#P=12eEP6{b!
zH#>ufpE0)qRky;uS$=A4YF%TXac>ao8FWvr1Lcr?_zP+3*<erjCm?%Hs{?b~2G~~r
z2a_wAk1*b|(q&o2`I>}oFw3{ya^%QEY!Pj*Bd!P&a`ffC%?c-+tJ!9^Lx7`327bK}
z{*;gM*VygSRZ7oN7F+JN#7yqY_kALc8H^>R5FOg%9gI-7z(Wd-;@B$;iAIO>#(=!Z
z{x|J@?HW}i;q%0*vqW=+?%{etso-oV{Z1_#xD%`gEm#iAFzzy5Fcc+>S(QX$cWr)O
z`2=v^x%%p3E!@lsD_+(zjB8UYgyG*C&;CC@XcrBBt@iLwqLC>Psc>-K(&<ngj6^RL
zfdahqrO#;Of?BJvp!s>Nj_E93`x225pg704aR}6&W-0nYpkY(a0VA%}XUqbpjShwT
zqxJTtpNMMprV^#k6FCB!tFX)M?&Y(AcNbgJt$=3*IA}HOB-kSp^h;cL;mCyIiL)gi
z;cJn)%a~HZa^k^DPpAqDSrMdg-Cvc*sdKs=3r$q_e&^u|H111#8Bpj3V}^fGEUbD;
zU~?+)y%LO`N0gk}luXV#Q|mRrt*~TFwEtNnIdvUfV4G-EvV@ejfHKFq?AoR{n5--u
zNRnYt&Xm(^T<B5ycnJi|+KDGJ<!2aTnjUUP0>JUvURohR&*KQ7*so|~BG2HNYF02}
z5YF)CT}Y_H-@6oVnJ5DXd9CFlgDihJcLT#|H5(U8rKYu|GR)dnX<QkCc^RXKVj#6_
zpCTvy&v*FF%6Tn_9oRypRL_>5eZVp^joObIZO+Og9Dk$NnFJnx)t`-}enC8=3_Ry_
z)5%B_-De*BTGU=K-q&|f{J<m8Z*UK4iQ;RyB|=+Et|U6bhTwQx`d)5BA57;@xAHo!
z;z2`01NmNsDY~+u#`P^CIu32G<Y4IM@>7Wqp;vMs)OXtp>^g8V_A25L#xM`S#V2sR
zhty*C#c4~qPW};CM^b84x+px+QpD(XlF6FG3_0(p?kRAJ9cptz&^ud{NgFV78N^u@
z`HU^&-(GLlOd6c~ZS;B)H2WY<$P4QBqnF0o7EWj@uw5i05_l3W<GX;PgfYBqUjpkl
z3y#f`Az+eI$sdYD@_r5tc>J+*U8wu_&(C%IXegM%ySp`H!hOoHydol~!^v!VD25a}
zg=tWy4F8b&Y3b}w3a7u&K~MSEW-x8GVv-rJ%pdXt6BuAjGt5|+4u8P4qB>iFI<HAu
z3^1`|u*t*oMk?iy1mAE}%AE=o&e|{MU*z)<Kk;7lAN;ZqJtGP?Mp~d`qd)K8hsXhF
zp|Ghr(GkkN*I)Lpl6DBfcV6(pj$x%vIY6u+lZ7Pvj7+VMtDJ`Az4nbvfPc67h4L4n
zR_RGRWXJ19)HF|nk8M)Ls9HPcN?y7I>1BxJ+)z`Q+=%$hIw@`u5kV$L_<l?1bruf}
z{w!z9$j}~AWYv!0LnpN}ui{6aG8=5q@g2xHDc%vZsc&48SY4+Kr53jy@%s?hbT~(x
z6S(8mEa!$hyS*?G@t?EsEM^u-E^u<p`9<~MEBxs*kR!`%M!prI*xAlrZ==&;`Po-g
zo7>>wiN@z~7Ejw$_vd#GEEr@0EEhxCSp^5>?$K90MI*(bySHY=kVIBC)>}cz{Q4Z=
z(Z3d8S{`KvKE(i3kq)Xk4oF0VhSU+Z-%?E|$q>olVKkd{4N6KDKW>3;t&hmBdYgc!
zd-aZI*P!B0-Qv7K??jpn7`5v3Fc-#_Bu0hxO%?fvaP8BJ8Iro=o={)y>tmn@qlk9d
z+v;cFend{ow#zbO1*Qho$@tOa6m^Stg!ZWLueWQt6&bV(Rv7fKHCnMnxQt<TUlQ*#
zB@R3u#nyYTNdZ?4sBQralUfY3h$MSVA77c1R25}jvG24+v;tf=3N6VlLe!=RJXre>
zl&ya#CXK^m!NMRY{1$PHVJdm1fK*gU=BEz#GeCy4PvZuj27R;8a^sQAFSChHwuA!9
z^--V$Q#igzVC@eZdA6gw@KZ>yfCyL%uLFbU*8ty{nKufMg$V?7Km+zSJY7G>&A5hy
zp|-E-W<UK9bC5J7Y-$>89r0=#<m>d5i6M~lA`e2(Dt3l}A4cfP*%y+K)Mp0u5|**_
z>PUndKJ59Bt2cbP0=Vwu+q6sK+z#EkNH^N5Ld|R|HO2)}Y~2u4MekyzQ6>iUdLAW}
zq5gm~<P-)SVyhV4;V#<OE?;-0&P=4ao+uebN#9(Wg8LJNB~a%HNi4$tk3y>v^0ra7
zhYNA`Jq?~}bkUtZv$x>oK+4(%RN+hzYWH7+tj@Z35DzE?Jjzg)BWlQWAtB-qqbZj~
z7%vEUbmk2V;9%$Knst{;t8<FMk7QXdkxy8_p5SNfu<(?LXkh8ExRojSNx`;2%EH>K
z-!mM^3_^EDS|D`*!<=;CIA*9tNn>LXL+#%p879(<pL~CKlI}<Xpyi&W_F!K!kpxNF
zPEFc;<U$M&&J}1r`j;J>C*&nZbF-4;c#hq4h9o2S=evjPy|~X6>!$btp0)i3hoz?j
ze9(VAoFq+HNtX1NEIP2x=EJswXbBFYUbek<xQ+TuI4X=i(TH5JjSn~b_bwe_7>)Wo
zb_~dnhD%{vu@pXgHAH@bs&%*@*njcHE>YaN@<DUMj^JsH=-&skE?0H$5?XH)Z(q}y
z5S<2Nh;?vu&zng2Tfhlpi2Z6;p1BmE0Fp>koc;|2PBFL}MB|gr-*C6yEA}a_OX6)Q
zq_mX+%-BEKhrjp%IRRri1XV=NRDR*RUiTp#f;L+uuYcW~3?>g#7HZUd{%k`p6{_}Y
z!ZF?N?;qh)$M}b?GMfs&Ga}k)eg56=axj4iu3JS*J%v|qQWDs!<q1=j;VY65u$<P$
zYGz*Ad444A5ik5Cpw=eu`AJ|;#h3g+%W}|OSEi7LSFJ_dIHj^TPArZsSsDIVsCcGK
zni?(t589c4{kO~n^-2S0hvQX};xd2gkfL5U-=<=RqbG(mA)(b<0oZ8~43G5*2K6G0
zYin(ZL+G?iU~Z#O{%?YlEakj%t<7N41H+_S8wLR4hB{4pgJu_CeEj``o0ZQ2Ji3Cv
z+BcWSMqr3PTcbZq;wd!*Z@549G2bJ3Q*A#GTe2_0dms6HEhKb6)tamf`+?W~c`_r0
z%kzMG7zJ$dp1aKPt3>uECcUl!3|$Pr%iTveaO!YKLu2I#kh_-yZ{2DaH+mC><u?{9
zbuqla9uOQHW&(OlL@J5p4`G`JE9Sd;ynaj>&4#sFqm%{9P_dsKDkW`nB(Q#f<alR^
z)0)6W%(@P$h!*VbMLt6#%rzo?KtH7v#z?iViLCo8i3i;3e{(tDRv*WBD|CCIDRI|}
zWMX|10nST@0aS4CTV2a&x7`BMXUx9kWxXR&J3G5sijSHdU-CxO(T&@gR|gSn^?3Nb
z$o#~i0;X^FK->kfi4t`hFZ%&leqv#pDU+PGDoHDmj%M|99q8qAt=Q%);hUgQr)WB`
zRjI|NnKTLKv94_&@DS0jvDY#RiHmjrHv3?SigVmN@5g0(2Zv24PXybWuNB0QPe?9q
z;P#8AaE0?MGQYws?<4NVZP&i|wA7v87zt-#3FmlV-O{0L@P#5fV*nf?GDV59bNTEJ
zD$aI4i~7(!Lvem6dNuOyV`LuNcF^^LYT==`Acl?3O8>6qy4XUOKCn;!nf0?mKB#ya
zy~+S(Zt-!qkp416_@^5qB*!YARb-V$@$T>MWM<5|zv0LcXQ&5~dF!+VqV9YW&icX-
zI>)%M{WK}H(G>C_R07$S0Ca4}sRG?&QUDLWim%^vIG7n&>#>dzV4YSu2?QV4hB18O
z7E+kcP5g~o_pr6zI)($^SXE#d`+_8ZnL<^6!1ReQyJIwq{{`90GX`IBvuh}cxd{a!
zo+}E`c~dJQFB%dtTQ|!DAl*cZw&eI$oFk^YXu>zqI|O=8pq^gn#S`P#I+Y)jP(T(n
z(hkRx0uVjSscfzMUl}v#)o>zw$+(JgO&H8%0YG8MB8kyo;%5b*9s@g1=Nx`9g`vpa
z1NO1UM~<*B^~6GvVi5G@+L8EBQ6;9m&W!QwTXD^_(xqp;7M-c2=@VcR7uc~a5xSws
z3vB7|^(aQf;6-%OM%6najN>fGx*+FN1`18FBC~(+yK04td2D?tXFMeQKXoKBbYyor
zy}+{(QoNhLq!niC{X^J1{rG&zYdVKIGxXygMa71aCW}qWi`xH0IAUoiF<?r#Joz3=
z-rLS$KragS9z1pWjy3=K0NE?FBR>GmzXKJu6g6cd7yhUxs%8~8VrC;}awZC?K&UZf
z&e_Z#0>8dMF?jTVxCw{tf>1B!Ly2KWxuZx}#=mcPTH5O`j8PkvKj`;1UdJX0teGJt
zKaoYmy`S*rPhH_)f8Y;y-R?xwZNukz?o4m2T$DMT@V3dS-7Ip*(J|Kfrf>X3(6b-L
z$<t9EMegRlz*6zuU`~<kelwsZ?6)32UkmV&T<L<Jx$I5*X+l7h_ZY_jyE0jixj<dL
zc`0xlx4SlorNZH0T!^=oCZNdpK||Wx{5O(T-G<4Nkp7OF%ALP;9?xh_TDw}vqRk|7
z*xhLazY!X#MFLQMde6AQ=gcJdYOdP_Dispij3@+oQEo*PE(a8XJg$`8Ws0n0oLBd7
zc@-I20JbyDuMYr)L-{kdAOC46Lc5lW-U)huwyG4ZD!nLmV0NQGL(qlMdQ(t*%@0Q(
zT-)xV%zD*ZVyA53{#wt3w$E(0)CJjg7lBy}YJMzEnLTA)N@{Ba(w;~%@pvm=a&N;G
z7QcT8ejuRyL0GGbz5Q{~q<|<93ilXudthSdw}}OpIoMs0o1n;LL*@gw8=95^=72Jc
z-Ho|EhlMdwwT^?#=v^mP;4AGL#*}c!^RFdVRdq=Dv&!OURYP%h#{brzI0~+%GT@D$
z=F`*K-x6sW0(?;~Jt@OBgEO@YT#w1?NX?OamK;Oeex7wDRMUb5?R$7qMCzPZ>QN2&
zz>#<4<<|*L2SV(H21nNcYrl~X$Q-hoT8kZaB!!*lS`4Fm0;1}o6hJou4v{OGkcJvn
zXAiI|F|}5d&qXgx>L-x`5kHn|UgHRkF!OT2J{f4tfJRs+^_9;Mt88#nATv`{p4=@m
zFrO?y<XchyEX293nz|qz@4o^Sa%tNv1q8?@)KvR93Ij*nBOS71h*k|aABQtd9S?OF
zbp79JrJt8?sqn#J?H%y^2)Bzb+urVSOi9NygFG_f(I(`%z;OE|{yHA=isteOmvEG&
z4r|F|F^-M7<)_xV7wl*ukMj5G8_OdHSrowrH%Y!Rm8w_$r6SXJMWzMc3j};8|GRK{
zwA@~AUrGJS{GHUI+<$vMT764=+GkXDuM$L<?j<(^7$qC@4UYH5V-k#7%=Qa1)kclu
z#ZGWR&+V@?5E7JsOIj<nQeN-|6_WDFJSKf}-i=@=y8fkrS>*Yd?hb*YP`eMJUrRpP
zAv4~U`b%F?XR$k9f%izJOXqdc5_Zz?1!n`0s6||lSUB8x_*Og84XRYfL?aCh^R_c{
zw&mP#3gJWdHy?$umsZPKAgxyI8)`nBDP0lI*~De-)<L=iMeq3{@<rX`ZR!$I4uq(e
zKRy)&?biG6I>O~Y$6-50iragmt@061ZB33Ir<zt-@S&STisrWVKeLR(BJfipMd7{?
zK%VZ-m}_X2gVFt}&3i5|FnYFbmE{^?S16**%3?FR@zQR8cbLI$qMmf5PB>t6+Y?y2
zQ^l;rIiQ45os`0F@=;0<vb(oYXR;YA7JkWYo<2!B3bV2%*Ovq*uw<~QId#na@iv>y
zCF=YD>)Ge8-Ea?vuSdO!+nWp7Vr)#C05<ls3SyI$2x~AmYJBbGbr8Gee~*Y0zSB<)
zNa<cuwf2U|eWt#a=yMo{#bY)`>o}~VV)+y4(E@CzSI=6@5v(ZJllhtF7!QXSy8%*)
z!`<D%{`8KilK1QuLWV8Xm$#Th84bI>PeAtcEU{{5OdvS)g>I=NMNRg<^+m|0H-t6~
z<--RY32Jr5W6<SEMyn~O3Da7hIyp&DxQXd$4%bqJI_%kM^I$r=NeOqJ;H;P{UQ56C
z!&7POVm&`dc6rd-=j~V&kd=k$Uf{gGzHso93Ao{5ZU*js-f&FjFg+mnt&#6?43>B>
z@*mKYJW_RXawvkw|F^cdQo8U*N$i4t>$}AB^sz*{-WwgycVt|9Wq)Y*Nb>dbqxtY5
zqpm!{fbTRaJ@n9J@t#wapEZS$f9qGj#~PeNb5E?G2exeYLxiq(_l)1QO3(BxcFpAn
z3?z|W7*g~w26_zM7|X*o<H!6VCryH+;UcY6z6a^&_D}0*%ITc}{!y!E*xp;jhDyJ<
z$9`7aUu-Gbb2SLy|In(LpifXkshF=1G0uwEJZF?$Zcr4zNCX23Yqp?*&=eev`J2OO
zY(?z5I`G3pOB?PzvWz`uirZ#Uz#8#vhZ3(g(@p7G598mk6#rxywCSbQUUUoD#F$<^
z6GX6SqCT2=zHe}I@R3>P<6Rq}1X%cuhM=`7a-@>99)(sNsHPGL`*5(A>(m&0Y)3v`
z>ZOe14Scw{%Mdd|M9^#OwiH@1)U91pXo2oebYNXUffH*iwM69;iiPBu_$^Y7RzGx^
zyiS;KowN;1=Dj5A(-SyVVu~}Iz*1cxid$<Yxi<AcS@P*58Xn_f{d$69fS{U6VYlgT
zL2+G>Qe9ArTa)Xyl?K5CRp*Cv)j_SK-{OC}C#1T0g}D}mwRB!|7B9RAAv_VHx)2jT
zctON_!uF{Tg8TZ6^ZOb1+XjY$C{+{vK5y+R@-ST*j9;+i;^N|mfD8p`FzL$5iaK6S
zl<K12eJx9tLZh*?`EP4YvfO#{Yel_MJ<XLdTug|*UGypwug`VXj7|<Dg;%qu;{d>E
zxauwSB3oWjgR0G;IU>8uOfG}Qv-?J}ZTXUea+UJ8c47>9OcpXW$m<wU9OeUQRZ(9=
z@Yy~QJznn*0tM77$dM+aZoAvw?}WQazk=X&^~#H>tqw}}a_RF2kwn=ojN%?QN?>E$
zrL%6M(~+k2F~M+row>m<aD>(BJad_~XZL{X-u8~1U;F%AxyOrNhF|B8tV!pOb##3{
zo)~<F*o0icn-MnPe#J@oouo}o3xHly_I!Wge!2fU3HIs9LorL**Qj(&br#!*u&3+L
z8~=-*CGZ(i)zz&WOIP|a0#M?u(p^b?o)&lw_oj=&jsa3B2%OON_?2sG>kqeraCC7t
zemw7Qm6QL6v$qV3s*B%+=}zeu5NSq0njr-gMOr$fk!~2el@uxImTm+Dh7jqPp`{y!
zuA%E}pa1)wbDgi}ix-ZJd+$|yt^0RJGOcG~_KE)=wsPmNS(7g8Y|0z5o2wI6A_noW
zGHtTKQ=J|z=n5S1(oV@*b${0Pt2CZ^qtVsO@Tj%g>zCM!XVFyEh1@Kb0Oma~KK|{|
zIXr-GdUD`!LG$!ij@k`b>l=D0Khf$}0Q89k27_&fj&^qHsg!fXiYe;xT3)ZR{B1Xn
zA3ylrafIUf>7Py>;O1{$X0S9gG{6hrka4ml8G8Uhbhau#0KVWcLR$Nk`du+BXQCp_
z@BS{yk?g_0_{WE;cT47g2AjF4#dQ;}Ba{{lc`4;@=J3_zEdap=fwI0RAOYf$BEUcP
zo{ggy(*SZ~kVhQdav-1pG1d3u9^b6`1Z2?21Dw(BRL+V~mUG6EI5m$~yN|$QJZiZp
zpl*QUy6VQY?1PV6WNE33NaoRd0;G*3YRGkPd-7ou(uUEAv}ez~)6t=dr4vcfkmD@1
zhGjDwG}^1_=%l&^Q~}l_ALklu+uXjvt8D?Q?0C8w1YV(6U-+{ScxXf_n{)@7A7`~n
zhA?yB!=3l-MP<^N{{T$duFir&IAcu}F*DWf?<=+OhQt50yF~&JMj)V}tsUOc(J?-l
z8XIaswE#4*^UgTi*kl@-8B8^roHGP~_1}su4-O70>ys(-*6!&`GQMGY0#E$+WdUK~
z-Uvdvf8jqCqnR{m0+w<>M$6Te)HF29BgPb3{5M>uLYKe6epchAP|eljbmL6`BS049
z*z8AMotX3J)}Z*DZEeo$k#i)qn2lT|b7_Cmkh9f8gM7n4Y8Y2EF|~Gv1;W4(<k!)X
zcP=h2CB{(koN4abC`#VJWhyH>JMK-Kdrn@xIt+k$m<oJVdtW4(9%$NHzRP?cmd!s{
z)gWU@DpJx19OBE{s@aR212W1j?pf@-JXc@VXJNDWU0uWW-|ST}F!_C*v9VhEB%XGv
z)N$Y4rx~qmvo{I)`KK}b^7s4B&<uqhtRHMz_8sila?fHhG7e8K93BpTSa5VqS*WTS
zrd;6T+xj-Lvd`1RNzag`(#$~rJ@(hZL9C5!Sf#;CK9Emw*Cz12mdU}w;+bkRF2#7t
z-z2*xr)8j<ZPfwlLTP@cn41eVCYHd}T{b!zb%Vvq>1FDCvT4u0T&`J4Fi<v~{W3p4
z&%b1BO!Vyl_rtI!2G=hKT&-bY;2waxsjB*L;^|Vm;py4<)t-o*-Ad3=Ny&=lkHxV7
zvopV75KZ^!=<7P>uD6cpfB(KP*=%gIn%-`#8(+7&t!D!4IgPIC)C&~-2JX0F3LTQj
z(7k)uU+5=R)jiNr9GuFJLa1D4<!#1#c>=4!b8=1tbg$3l=;AdUX_%qgOzZO|ul_#W
z6{@k@WX`7i_60ojFf}k6{t(mf^Jme2gOlTp8SDh;R4j-+6IOF*q*kr<k<`PxBrubu
zW?=2vaCX)p^LHV;4@-Xru#)NzfMqIG`I)Q-?M1hyszc_5cjrWe-3_Z@x?1scV4aBZ
zOAehUU0xQ6fvt9<5pKhPkM%vRadB$beS-ah@%mup$xa+$BXz`S!&fy$t%&gK(9lro
zu#6CZF6x6&FlrrPUsH+t>n2U<@hqERyW2=9X4W$LM1@OssbktyTRQBm+wF7}XDDM&
zC|r9!GXJ_RU-=h{sDBT&PPK7(LMbO>`?ve|?m7gD@I4TRaS@d&KCa~}VAy?$<KYBK
zo0GxWfh$KH)H+^3MX6V4k3A#wIAW7%c*#7BI*_}>g1i50H<d5qs{}FWL4Nc_fpxy(
z44e1G8gB0tZ*1#6|JwW>_0L&qrDEbgbPu?Bf6V0FblrK98vpcaKL@J+a&G{4%enAu
z0i%L53YRlXzs1Eu`p&VqQCS3U`@`lr>-Y5Z^{J+bGCY5!v9Yld&EmMEC(7Jr9Yq`e
zl<jYnx#9Rk7q8Kf`zzZHOvGR>EO1C}eCmNTIyi4~Eb#HZZ~L4=S>k^td7Uyo{H*AH
zchV_VM!J|u4z|2QFV43>OpKPjGh5lbZ%XJyr-C%8CK3V8sLODm<F1`#ISzme0XI3w
zC6q_SxEmYv6of%?<p;H2S=+%AOpHFxcOZZmJ5nC!A`Z(|DZZ!gc1KQU?GvoXs<o8`
zGD-!ECbi>{*|~W?K}s%G+APMP*hKfpr?2#f;~zT<MV7|W$f`EFdwg7}4+}ogZf@4^
z9#*5eQPf%4GV2Q7UbU64sShfzC-4K>%5@}1I;Z2~D-H+XmY!sQG-9gXh!s&HL!eb=
zE2pfwe_Qz%?!YUKHQ1Pg(|>Fkc#}p<NQk5yYryrCMYI>4dRd7j8kNlPNFv^ySbc{`
zx!Vm-axM)r10u%W8qZ{x-f^slIB^>(Ut)#8#_zLDsEu|uzh|~ES}L`|i&GiOrV+19
z8zMG$wEqTlQFCJnb%&_TJA3!ByrgLhQVKlt6$<_tO`7hWfkwp+G+=e|LevM2b3nqC
z#HCD#2oLkl|8%nJ+}=!+=$W}Xl5vP7QTtjuUc{k==ID1mtB$F!r_dH-OJ{}%_lM-%
zrV=`L`-9c>qnK|~8Qsf$jEZG$H4hc)l1Rw~hgwSw14Gxk(D-u~BCtr*F44##t{bru
zvP3&0ZU?A?>8UrqvrXbOz|zxl9ow#0Is6!*k!&DiJ!Dg%A;ArZdy=2P;<=EQf0nM(
z=>KsW-jt$3JD-ByeKNwAlD#OIapQAZau@j<?qV?NjL>5;`OGW+90RJYTUGTagrt0e
z+{b|gjB;oeBojcCtj!l~yI;ZWLWf49;PoM?k<3`tf1@wRL{9pvUtiGT;ChCG81{C<
z>zzFXBFnQV=VF(Gel6~G!KV!YzblSV;I(@M)IOI9HYjd9iawlK*_22CzL#?9b7tRv
z@goit&n_0#S}a_&Y!*_zoNLAE(S|0gI#Z=I+g*7vNRdQ*h*t@WUBk<mMP(wZa6!?R
z_~okn2-|{Lq!B%2+v}a|g`^OPY4w+?p*UwmZFc6r)RdwO2B*Q7lI^q#(G&^^YdtT_
zXZQ!}e}8|tUtRS>t@kX6wuZ>b(Y&Uigygfn1%|#v9mfUW#gHNBm8GQHOni55=&eL)
zGDv*v_3)`bq&kPrugwxF5{hQzbEKjQV)xeExS0BiNo;T<!RPEzA6)$#_{&WuQ1wy;
zVT)&HA)uT|_ES|x2Kr<-bY>p@uKz~KvwKd2&v&M7h{voT^p89x_5Q}gi71#~)Cd8y
z?TMlgby*8bdU7-IzbF5VCY(&L4yQ<ot!a%ySqvBP23QpJ{sRO2O|Y=As3klrfG;He
zf3yF_5`pO>r>a8{G3|NcL*OmNr>G`TT8Yx0BNKm`c`&@Pw;t4ed-;1Jaz$z0{$Qjd
zI6JkNjc9*<Bxjo+v6G_{o-(S?%uWWeH@aV;q}EScS^ENoPqp#@1IlP~B!kLn>GMv@
zV*>{A8QA|OsUuE-!xC8z$HzO7U5>zfVb!gNQR`kKlAn*ZQc{nV7Ud!T!j}y4m5PP+
z{^~0x7FasaD=fUuA4)>GHjroSW5%y6looCpXpNR4q~IO*SFk`xyjr`sLtecgr+~nF
zX%vU}Wge59ur~?yBB#^R%8kvO8>Zw!<?0)C7T<bt1M5z=vl{l-bDfDSij7I~u+XQw
zn-1}Fm|8XKA<R}n)iEyRTB|Z}H;Z|&{R-kKc1}<>iMP{<PIaM|IPN_^(2PY<8fcKb
zJYyT(T9S^}b|Mv#!#%C6l7Dd7&IXLr_3K<zm&hjc?PyNP%Ol?<^_{Bf8L)OVNV%^E
z=vy)Or=7k$>qN~``!%KIt@)?P$Cd6S!;8ezdgiYW#we&RC&v-=5XY^)1h5zB%L+Xr
zv9}@{E8@cCbX=3RPXa53gehN0v?`>GW>T=Z1rUO*t;v!=-!hzFnk~5WnePDcVAw;x
zZcyU?OkYk^uv5XJ+JHLUOcmz(emXM-lu<2fjwn{Csyj4ttRzJVGd+c<M(pPkF0mn2
zmO&=X-Bj88(hSooDW;+fn4HCD22@sVNwkF;|4(l22E`FiiNS+I=s8cl$VV&C%-LzQ
z$VYOw?VSj`qDV#v;*KSiLJDsd7}YrEL-JKb8n|)@&8O}16@J-&cl%2CwMqWtoGK|K
zeGjWZEjj^*=tQPlK&)0#{-4H~gMqVKF5ZKgGIT=oeFrhv;cu2cUNV<I$&(G#nP|E^
zjW+fV?q#8C$#w-st<#9PN>;7v?=A>S5FAGqqp|3KJO80U#c#!@^v47Vy{UZXS6Qct
zupfxFQ<Ao}%&|NRB6{%xyktpj(p{%lw-)j;pV{whI}{|x4REKl<r9QVaOovR@)anW
z-@=EcDnJVUjR->tP_HBW)rdWpXo)qNwTRs$_o)!l^SxuNAsbh&<&YHuUQ0O5I7tq_
zEk@E9VI3w;hmRKs@E~6)r6g%9zk;kj)IA@VG7v7%I9ce|$j8p)a|}}cG5+_L9dB?o
zHhr6+7_yEnBzrYMtlywfY;@NsCUPm|&4~KXZd1eBhTlDln%A|FPGY!$)#VKj=Ymix
zsE)aAw;V#$T*MwWlnydVmT{U)U;jSe#2EF#DQ*hC_xPSX&)VOGeRH#C?)>dogNI$F
z2tNt@tu=(?kcihvu>Il1FhjM;La(j7wQ|qecq!R&M>gE>VsnZ$b5b1l=-5}%e|`cb
zyd2qgu5{!xx3epT5W_n0$m?LeFi?&I2G_SjlL+G)k!cuRL>4=t&)nh#J>;AQg}rqM
zA!0=X6KwUyfI`m0wkYH=u39?>)F{v+VH*qvTB&i}`(WDROOHRFyTEyQ)$vkUknRZ>
z&C;P2Vy2#sz}|s`-eLq4Ku64e<(-~OchGHR^bst2S)CIl#!d8lzMG)CwXtu@Je_(9
z%IZGM<Lt7`Lhv0LLu{=p@Dn6l`spk?s~k}E?r$2@Ix7cezI@qxILlgljj#paoZm9r
zC@t<gK@3Wht2Q9<x<bnXx<wk7t1w|Qq7(O;L#}tTAERI});x_L(tdHU&K2$L<E?Y<
zB+g}OC#hi7pn%~+%3~=k%bRK$Lqi@<f>QM2+Xns%u|Z*zp?INuOAicb@6hcT!!bw*
z7t9T=8}oHW=3cSDTc6_`IPC&i6PD-YaLuhG#^P;@ns}2dHUpwiP*IO4nE6MlZ0d_!
z_opq%yw5jL<PDOZ;ymx)gg+BqxF={MT(xBJT9u-^_LK&=!$J-MQ5#ypQx24iP{m)A
zbXSdNc(>&n<)dc+VZ#`|nkAP1;IqVNrWCKSOUj_xwzSy4+Tyoy0pwp%FqXJ5RWWrY
zUttLsVdPp`wQxh5Wi{HIP(CJ$1#jXN$Xd_4TqSfKJ!Cx9*XHFLl}6?ZGJ=JI<3H;d
z7qd$ndRPY7-J<DoqFB%m8Q#XfqAIVx?JTgF&kmlE#4I^Q$A-?Y^0GNCwuG<sL=QCr
z3nZ}C<06VGT({oM|MxE9oY=+=ZdR-iZ#=6>I%7Q8ODQ-rL7}>5>a=~-ZC*%KFl(eO
zPY4|>+7GN0t0B3h{i(bm+bEa((Gr4YKwxP()%NN+eeJI=+pE(YS*&!fTbzWj`MQ>^
z5ZYS_C+FF7N>xE#gGPeA=}O?J&B==jegg<m$$+)wU*sgS+TW)f{bx;CC^BMq<fz|K
zI-F2BLYHSy-VsPEpv-Zh<`M)%p(J&~de~3{meJIRfKLZktYJBOY*@L$Pk^8Mrq8xP
zK{cPLQK5mac;=$Nd`SQ<1FWujT4T{vpsSv#CMVSxM(|ye<fq9O1M(fG{RvTwr^!n3
zj1i=)Sls8wtHYtshNdG4%^6Gnps#`5ZOktFzB1!64ll&}9_t(qfo;^7952MK#m_o}
zhoK!OL8wr8tBy_pqsp*72{k=u?q&RIf}DRlb~5D@<90t>DiNmU=0~v%y}$XI#Z}H{
zNX-@_M;&657zPnkyJ-il7O>F%4q4dEIbG+3gv^eoB~f&9S1^01akINsIPj7P16C?P
z;T!@a1HR_WOPV~8ASNLpPuR6m6D@ZOR#H5e^U!LE&kvO^NMKiGoUAm+spg(%FJe$e
z88XR5QBL9M`S`;=hv|A0tcQ&c2<4;;2=Ji*3=1d*OY;DI_4+~UWvP|tUD4arJdGk{
zdI(>Yqw=LDvh|Ybx_y{Q^ZIt+{-Ik5h|EO?YTH|+%iEw@;NPuWG%t>9fukxAL6-!y
zG4q8l5NpAM{N~FNHl6}G-wg*&ur9gJe)0g<U?2vwv$J!GoKF?Kr6Pi!@68kdJVTAD
zuU}nj_cUV`--@v{Rl&Ymm{Mtl<52(*G(_{^?%L(<$|Wo;EEm8fIQ~TdZ}yq345WgX
zBGp2%2n!b`sWP@bfN0w9!Va|0-)HvoK0|_QYkmJIaQ~q=sNnH~`6eGr&ZPD~;sgIM
z5r7#cIl^b<<#qWi-i1p&ALEEt%Iwc)i${_GrG1G{Ha34ARj?Kv<{M8un3*m0TRnMG
zKqh=eVFAE7@7cxfgP`>&&;!V)A|fIICxgq9BfYxWU|&ig^;6#6{Uz)+LDwfo(&yX!
z@82OhT!Cd@5}~kiKu%p#SND4xmg8eQk}i~2P|!US9+vb)CD#SWsO4lsmIF~gwOcCu
ze9!M~fL|!l|5=uFqpw$IkuV*=Gu=@7mp@D)_FvAdMkzNI0;s|(mty?et2H(@YAC-(
z*wyZxt2Vy2(E7LC;f|#jdjh0!rf8V#0dbQYA9z02tuVcry^9E}le=cj)N^wH+<cRs
zJh{;~n=X+C0n_3o+cfhlzUg<BrKOxj?VxFb!E~WCAoDT=9h>O*9N>sP);<R!Z{3vb
zg4)~L8=jMe{xfMPN&;e)m$f3ovVpJV=jZ?Hu`!@6UIg5Eb7D?b8D+roZUk$sUR~F}
zoaTPdDAo=+$BU&ETH7nF1gO0|fsw#y`#m?8UM&a>e9V3{0J{019pK>s{?7frlek4p
zwXZn<tW87tN1?DPmvAtbT>Orzkc;Qh5(9w5Z|@NV*#G?(U)vM0S(Cw<xA9hT0tieh
zlCH(qS#nF<xjx%|v->&!Z^J+mHKhDQ<qfM!rhP?rY;0^28UU+N63a5@<?M8YVz&vV
zsGa`jpa0f`_Jt|RKa4~xWMd>;db}^5sYod8i9B#&cS_S4IyyDb%t(fa*i~5AH!fj?
zS)fsX$JY3tFH6@oH7Tw4#uiN;y`@1ur2NhD)#&7X_KeC`m<MwE97umF1bDRgh$6D^
z@bEWwoUGGHH1za5MGsYfFG<!F!oQVod{}#I0pcVo#NNgPk^<4E@pbj}^0yZUMM-cN
zaJu+sGX4z70Ce*`MQ!9o=@@dR)?A6lpz)n@5#i46Zj{ad4sH>t<!eN(@^cQ3*UGp>
zLbX+Q`-I!2c@2{Z3Vat>5kT<8YffMZ=qM$?1&{d(Iz<2Ms`nAnln3g)@ABP3;MM&z
zGgQFH0pPpAXW2VI63KX#xYuFKP%7wcX_Ah9_|o56^Yvvij%P{q6r37is-^6OhX1+O
zH*gA@zxi~j{I(qKdw(M|m<j?F0S)yJCd~sD1E3=T#kjJa-2ePCyYTB<)t4tl+6ew+
zPR)ppZD3#d3&6b?oOYAS0XmJXmE<mv#>)5ws;?*ma`*y$At)fAp<I-GxbQ2{%4EHJ
zONU&r0q4Gqocr?l*m*cZL{<472w!IX(zPQ8ocmM&zG`2ZpmpKorHSEPH2}y0iewJ-
z&#?y<xwqNMseHUZq%AP3cV5}QA9$ChePuM#arjP8tHx%GWoOv0axj_O{C60x#;$>o
zjhe|0f4Jah!BSu=nWAA^9H^2efC*RuBxsn}0X_agL<DH9H`>5lNKdD2gF=h6Zm4{T
zl6dVr7u?VpA<veH7Y2~Cw^bHYE7^jxU-oepJf6;@dwo9$ns2nATlpb0i}$(q86Y@C
zG<kFb)k8y(gzI$vS(4AfPfalMkpmE!4T@9Cr)y8HSx5qc{TOj1l%_G|(maAl98UF4
zX`Wuaye20pRFJ~O`1DN`1(jCdwmfkPrNcbvQr%RmuLnL^nDt~wi9v67rW%_}#Y9rg
zHBMu4-|y{qW=59R&VpP083=^#Bi26@GCU;56)#aCStzh-waJo9D8kKD8nZU^#`wd=
zUParJRGRvP;kJG9AyuyKE7zn!fp*Cvfmo1^&n#CG2xQJ>;>cxgWjv~(*O%JVHoUpX
z2lDl~9;!wS-+LNlggySVQ)LFd_4%FFfV<Jv*Cv(bn1K7+H$~YG9-D&{OGyLS(cDog
zr|?Px5uik%1&m|MhNX<`>}=|ZKrBbmKlk6N=MxXsoJUgZ$s%p+>L_Lfh}0=9&O~1c
zWb`oqPO^Uz>1<x7PXC)=0LujjsyxlU*TcLKHQbdtkh(_Vp5Vt!6udpKZAO~=cKS<r
zhw!yM&)w)()xO`C<a*qcQp4=#tCer0WThDKL4<V>9?7ZxKC{(4Whq+xOICqahUZLC
z;d`>D!McBs0wVQ29uh~@LIN<rl(-9QIGhqnoS!_~i`+&>MqAwvf6ZQ}rUtjsZ&=E1
zSu!UpJ>w=Web=n_>$PR~$e<Ee!IkT`R0^@MWSupE#6jNn|Ca{s%=)iEN2;)Q(w!HX
z@B#G)v!0&yv&Ci?dC&VL=+FePxtB9FHI2CSdWibwO9V{h;I_857cIacnFYD;36(A4
zN+zMF4F}<!=|7M|$X)(>2vleX9vBu{R~PrWEf{!1zb(pn=wX2Z=uUTk|7WjB^T%E+
zLfREz860PP{4owj&NZd8Ro(;ZR=cNSxUnS`w8rL@Q7dN_u;W4ni$`EU`%9=XFqK{x
z<+x}yIT}eBegt-Yh$W~*j@^~Xv`OUBkU^K)lqk06(fvgLM|N8P*3`s}-@G=jknYW&
zV~;9gr`#V^SZ+$Q86hTym#<O`&sRxLKNsKgoadH0_01%*qC!O%+_CoK=FRrLk>NBv
zgwb)LfjgaBaYN2!C^%NCu3zCI*G%h2Q1^b=n1X#K(A+R=(NV2~58ND90=f8X;SyLS
zDjjI5+BXu?!N%Sj9y{*<K0XEHq4>!3{-uzis5|k;)C3mznM457+^w-Q;yT9<AH>VG
z_X_yvgr>Z&%zQ+Yu!6RLXs;j#7vj>~@Rz`G_q71h@N%gyO$GG$2EnhAB~AhCDinZ1
z)m0((W8DJ>lE?FX&!T9q@$IbS{p2Ou-1~g}-81}>jT>UswwLO@os?3)oDW=+kCEuk
zL$@r?kGyiB(k#ANQg?2O8H%RyXa4Qk(4c)(<g`nrDcK25EyyWPBf3-)w!Wcp1^uiL
zI$hv><2z^*I*~{S&@a_*pTosHBDoghsizBxVhGxgqb^%`wQt;+@^GLw_$%oYYk5=(
zRupz&{NCZTjyT2%iqvX1$~@JQ-3^j2>}5%0iE&co<LUiSsSWFS{9ve3)>2)NM82DN
zmsg)J+!}VvRN&^x&m0nSx65hRWkE#keWl~92%qwvHxx@$#$!J8nA+|x$C4pA0CI5i
z=C0F(4;4&vEJ>VE;A29FVI0-76MhT-vCPILLUSxvA{qMZcp#4oSn4L()Seupah80Q
z2d&uCM;brnomGi_wB?dVGe%k5c*$kR&}Ge`ipGS!^rj_+7?KZDd)r*@UnuYxrW{^2
zE|q(ehkB>_0x@<8+}RruDOW^o1{18HA=U(+Ai(7$A^WyVRA7;w;q$F^ZeL+_HS95K
zpb{yV{y>d1%fZZ_;xXc}Ghl!fDRJEvzx?eVezR3oz(v#|S@<*cB)r?mNZ4t?!<uY3
zO&E1bd83nZeqIvf8~os>w_SdCE#}RrSy|_CEY(X+HknnJ8B@I>2a0$<@)=9}qtgXx
z6X#lVo^Om@V{P;1F^#-|u+k5n@Lc~j(rSBi4!r%v8q~Ti4pj5SCY%oHARjx{5;IIs
zVg@`W)|ItPHqqKc(ZR{gSlXY~E8-4AgF{6xcs?A3q}*7CFgiQ-$|1<$u9i+wFO=(*
z1q^Q~#m~n>x8sI%TTl4!N?Gi6@+d-VI%FzEY{t)df{FhM`LTiajL2z5GZ|3>&%H|K
zPH`mT{(LklURBEqz)8~*Snb@6lnz^p{}TtwrNWMM(5Dt&Ou3x25a9{l?oewW$~5*P
zPurpQ*sUeZ(+WU!Uw8GpU<_EgA=Hq^>8e(!oyIA;Q(Lq~z?I@tYHg+iq{}F|f|z3^
zI#YwZYA#70(!|bK)pI8?qHYjQnGYdc=O5&J?+EDUuj7<1mb4BX1|K4yqFEJ1;qO?n
zQ(o*<o6g@@V}PTqb{j$@6apQ6tMl|93`-VGNn5lWiA_RQhkFlJ2O)Nhkf31JVYQ}L
zoLW^)A>Bu+vPZyype@Y>pppcR0QKL^$7xblMUKU6W3c5Qxwp6XYwMdnv&V-GM3W=w
z+)I0T$+Nz;#5$0*uMHPLHFSLs8b#R!ZX#1V^Oh@xaZK9_z^umw3iYo`B@_=5gp4BS
z9D2F#Ioh);a|u54azA@F>Z_0uK=H0x?!`k8c$)YiW~MGPP_ARV%_oEFQtTd^)vdOr
z8M4C`{{Z<=8eyQNrRtCPk*^`Y#MbWCqx`uLaYPjC(p5Or{KAQ7zeIpQ1e2B|Q@81I
z;4%66(<d*_o$~s~mBMyW6L(*}dU-(hV<%iaTAnoT5?6b#S{7N<$6@#bKP7H9maU*E
zPpyjOcruSJpYi^qY7g~0zA0ylI}SAGMORz{VX5vZABh_G6T*<EH5EQ&hEg)5i$uOW
zdd|^00aMXQK_efZzB&*p`#BW?L<Km>g0AqKZGT~%T8)PKOz@B>k7aG6n#W|Xha0%d
zuea^s#4-Be$NN907VRM<O+`Jp#$Htos+e$R4{5;7%xG}-J_1Znu5%R=9X{uqPjXM9
z%G!&DKu~($<FD+gC<||hh`yck3MNZ-s#ezKx4sG(W@^E{r)}(Qesg#%MIWI~=EpG@
z-+e;_HC4?$W6`O6ff0<+m#-kvAHhxE9y>VI*cEN6^UH!=O0vs-z!r(HLp5o6-#g`i
zcPS4<_YrvSJ5kfp{_g5pZE|pOVses@X!V|-o9oR``8#Uw;K1O-&CRW=uip#WY^<qS
zv0A^{5Ec}SZYnJ;)yVk%-I<P#t}nwQGa=*NH;s^hV9g(}AM&n8XgUI12uI-!Ime3#
zieDh37V;wiZwT1Lr{c?1jHUhC5!m703jn56RDs?Ysfg4UVzN5)I`k19pI%eRzuy-k
z{9|-0FS^T@fz3a+^$ZWLpi!d5D|yvl4?pbC0B~V~-l`AO%^DXAPVWFO@8<3(6feS`
zQIuiIKkk}0IQM?|Uc+5(9t{j#5*5N9qrPE-TLh&X<51A_2!i8c-;`^-lxC7nskAYV
zIgrLTzk&58jY(Wx)eI(6uFz`NjHPHPZgqAl6PB<%f1w*7R~ey|M*6qx1Kn_+`>dmQ
zkY;)gi6aVm89Yk~k5p$l&&OA#;t)=8NY2}AFCF@;+==ydDvOx#`{;bMz?R!1!&+vh
z)a}4Y^ogyA?(Jta?f%4~YT<v|U4^`JzG=IkWq5_da994;aK6YN97@gar;WWlwiau&
zL)O|}Pvj^<_A!4BLK<)p>PtN{f1%)X>FC&IJbGF%<?SW3bMDZAzpYO)1|f`J;5!l;
z+^b}dn8IWP)*W$o`=~oV;#sqYvWzy#)CN0zC$9A&!PHf*WSyE(>&Z{h9O?S0w3o!&
zdgO{<GqkE{Lf$XQ_dP&xa_g#+GM>J+Jd&5ToL<-|AjQ7_1tgbb2zjABCfngk3-f87
zlhU3yqoq2;QA>8ki@4p=HwS;wlw0xN2k%aSF^JI?#yz2{5Da&Jl%luio81%-7)W8K
zr5Jz+cJ>jS^W()F=db(w`}KqEZ7L_>)tB}0@v3dJ-WI>~z|10aTYrZ0*?!HkGW}Xy
zSXevQ-KBM+qM~xNw%+!x|H8lF>F&Pqo~UNC<^zz)O4gm8#*hK7e`kBoh#W5wn9G<*
zq}x$2X_TLMz;=n0p>lwbVMaA{`g@f*pMH>u5j1VKl<oz&DaC-*8cmI)p0)%+TaKBJ
zwafofU6#mYPqtuAJ9fnGJ+Fql!WF{QF@LqWNnq5;4r9T_Dxj2ri$6|5Nwr033qoWe
zNg6f}ujC#s)zI39(!5JHANVvu`r7Lu)w()pbWBv&$xDVZIbE{FV5$uLrDuEih?Vum
zC>W((YsaHZEfr+sb!)m6^ZMbPliQ4JO`fuf%+U-GjjXG@QHj}fR_i`-iU}^$31(Z&
z%*=se?1>mD^<Pt!7*~h|HWo`+v1naNN8S_pyYKtbY(F3E(nd=?ClV~NDE7zsyiVK1
zwnExTG-uZPZST(Kpi}(k6$XYB`+6?ehqNr&rt=K_y`(&86uE!<F7%CvIN{vy*v=g<
z0m|ed5K#6OY|-Y6@6Isk-iA9QRo0R}d@_Nz%W)dcVv9P|bybM*)4LPmHLWC4cryh=
z31=aFtWy9NbO6FQ?N_4d4Cny_(sJ<!u)&iD^lAO?u7h9UWKa>@ch9}}{r{rb>sf!1
z;9E&PQfU?WF5=ENn$s4)S211`B|LY<{Nus^O?4gA_RT}gDpE`nrrEQB=Y?i?{ENd-
z@&qqWOV5$UE6L01BUDr*PM1I@YF`cq!h4#kguy%O20bWfJdPudg5!(c;?1XEoEZl^
zSg*Zk-S+!l(%v^X@PmA+=hUiZDs)EH?u_sy!jpChqt#NrVYP@BzkX`#MNt%xVYQV?
zEJmOjk`uI4EgvuBq=@kEy{O#-;_a=xN$+%z45pcPCZDJb(-wVsp>NHgr|WZ=Q%l87
z^^0u9hG`M>ecX+)f)mdWJVX@i?pE(wf`tY{`;ejXvEa?vQw7L{gb{yW3$Gup8DB<2
zt;GQ0QbNzY42jmv;^U`&H10h%RxQr_`1O&DR7#Vswl`bNEejZYW#m5-4jR2bnk}z?
zzcbNnW<rliP5ZqsLm#-*YLSGwK-~NLqubL4k&Z`m20cK&Nsr90UVd0*C1_Lys<5d<
zNqz`_2OmtHYVUP!Lm!25wShryU7sGVYPEH4jh>R#Q|_1pIB`bfq6*@a@94Z31$yOp
zpxnE2tx-5rr~5JH;3uuhU~(k?UJ>U}T@_p#Tq;lb9RpcdcSD41*7VI}Oy0Zr(yHEW
z7$`OJ-LGHHwQnblPb^&Dqu1QN*w$w8Jy|y1%<pA-!2k8qI**EkoG<Iz=|7a{cCHkV
zKlmsrgHZx0Ag5LPs1|`y<ZIkgs8A#!n9JmX02CB-=^Hu$*h#!6Eu=M~Ysmh9Rs2sQ
zT*L`j%p3s1YQLUqI(T$71_d_od66%|MU&={5m|CaQ58BF#F#P84TQ2${8M3T-fUwR
zv!8ZgK><8x9WY+i;F3jyXruxE4;xl0pHa&(?8WwAGX6jMZnMj}_odH8@8cgbMgURb
z8Igr8&r^`il--j<_&%i8D9y*9!zLEfo^E5AS7tTa@S+3yL%2z5kg=RXDmlVmb-xc_
zv8y=(^MI<=HYzTz_X`<&4WJJ~9xi4uCH_*&le@#L3PgtlJfI#ISgJX{;I#yZERswn
zff!e}%#xyCXQ<kdda58a=1u;U>#OVT`5{d#Db<@8Dp`0p{vtkQ5b?p@;SM^nNYupw
z2cCO!?)KW?49&hIPVQj?A5gwl0(xF;3^=(Z#Rf5oh3ED4F0lpJ+5sT)^+~#j)9Cgu
zi#_|LAz;?7piu2gTB4qx<FCA(k0FNjemft!j(MH+qhcLpK{B5=!qYCq)!})r#f$=m
zoC%W0m~sN!Jw$oS9^R50%AzNjryLzX@An?-U*^#h$zj#Az_$tFP-ojSjFR-`&ci#t
zigAH$xS+a8@Bx**%PL%XBmX|?LkT*!5*mv_Nd0zIQ0S^{rf|dk9{g?9zhgOIPr%hu
zD5EMlkvOO<b5smBKPsh@@Z<@!R0TK#E(kbt5$qBGK1bqxkO=kc2QnBEEmR)<%Zee)
zhb|xX#Dhpw^Jn<?y6q<l9;l+CP(gQlzZyG3!IF$t*2!f|Hea4q_?}K1$9~(6x8n~E
zV_$(gKfjs=Cx^c+KHam&)X$HgJkdxzsxWp3i4IG&$#+H^FtVvVuW)vSNTW}aMTl`4
z%k<cgazO>(!#Iv<2#+Dhso<1hq{6PEjmA%5S-76ek&_(&RDS+^_0uZ0fdds97WG~R
zln0pP_DcsDBYzsu`|a!Nw)=_wqY9o;{B&Ft4~rOFI?aDq!KWUUWf+JC=~_zRSau_&
zL^|M@!(^7)Y+Wt*;?jJMw|zeJrJ5CIlQqUWqOw{`V_b{&$X9!fxjLU+$_KSllo8C!
zkevM)%=`KAFdql3>duPz<>S*Q59{fn=u3?Ys*Ds8f4_vS>SeA~F@w#mQ_+cc8Ug*}
z?CKgOfm&m;(<s{N_-vX%<gOfU4tn|epA=lzx3x|g1m#l5v&LU2JYNoHq{|Ih#9983
z4#*japmZOun33LMY^V@>u3s<0Gm>M7pdTvdj@kB-es3jOKwl<uiS27?Z))-cR7y|y
z3ZiT`z7NT^L-{m)IGQt?RtA!tRqV#m<tx!Id@5<fgawwjUfz(0Et2^UQiNnhx1u2p
zZA^S8OLV9xs~DZ#yp*o*e4NMr;!#bC<gVr>J9~O|B{`~m-2N1KW3<&duzDoyROkP#
z004BSZ@E}G+488~ctxDeDEMJRg0@&ZUg@qy!p%GB=5vX(Tqn2BM1aHyS3Eh;AR5A;
zUffYFjU&{!@Wj_%Z!6|FM+SCQ!W$U+d#oGuNQ1b>4tvU?v3j5N<}1BtUmQcCYtmjk
zq25z$?62~2K84n0;=~4^dDFg>gJX*<%{G72{Bl%lVx}udt9eHX;}q2re9jkzu|lUf
zQjjQ1XeCPzIZ7X#NEbZZMc>lf*mn7&K9*E?UyQ&2o#DIKYp95kQJ$w3VU-5xy_c8H
z{$c}B<fOZgAp2hb+SVZ!wi0`@+9W%6cF>ZEmaD3q{>+iwQ8vCdGR^`^Y7d4}fAyPt
z9wjuDT){86ddbePSUFkts6#G!)#)ltr$SvZXT@igB45SgXac|a3TySoWTohqQf%mF
zLDVU}0!dKLs9m!ybPdF6naq~aKDf7m?+u(pQH*6ZihS274C4Z2I&Ej)TFg#rFQvP`
z<GsEG{IoaV(fM_sSymPs@&xi;gVY{>@}P;_d?w+-Uyg>6D8BtCdsB6%^CV@)ki2-1
z&v65hlu$*#AOfR}vT*^LOi?ipuF+D#6;estjQJgF9IYT@422-RbQmdDGIK`M@aC1K
zR8AQI1OqVk<S3fJM}C`6U<0f^)HF2{HKeDPX^X90Erf+L>$Sx#f~Uw_qg^1&IuW6a
zcE5qrNk!5i^$i1J@n=VTyJl?7PZMH{8s#J<$ZA_!z30wvYEgTUi&5RE8~+9pTjUeV
zvy|UEP|{;D$KV@>Em?;tAM(ltI(4l)M<!vM1M%uV58>Niq2A!kd4IY+i0ALNo$VT@
z(E#!iVcd^Y!9EV@X1#@O-^UsWQz~1&7~LzHjek%4D;^*ye%XQ2q1hQ6oM`G2(k_3`
zb}UWGo=ZgxHkHpo#c7IFNQ{%X9(lc-KIL7wT?}FLiT>GH8~dCi9ZV$$#LXJK94lF*
z1;{sx)$dj8^;|KdZ{vS&9f-K7JYv>umIt8^A!};9m?|=@U%^`<+bC{iJd&AdH({uB
zMo;&DyKM|=)AW5XR!GUDAPv|QRHmv7?S30OR;N$cj6h))hrwGCv4{wA@a6&UFw2(+
zHl;v(NC2uV&hcC7azNvp8;MQK=r^$`3f<Gm^BTgm(XHc?^LY2-W2r>7A5elLfM^eD
ztvTs8Ti()a;;U{^*k}EoBC#YKuF^(T*=<l-*LP4WdhMwDWVn%d2a~mB-dgZ{y9}Pz
zp^u>Lg5P{)x`2rhB%2wP<`+emnX-pv6-Om-4cSCdpO$SXtkXKcOB5wG2EXNWXo7;c
zMx%Npx;z(chcg+z=flmV87-YuRf*we>K#!oZ_(lPr-5zs<QXFOaW>}DH+DG198Tut
zp3VaK8Q+JP5kkEfGXy5GY=H{K#wvRa3hjQ~q;BVIt}}+=FQB5C8DQ)PYh6ut4m01l
zf}wNu4tG*RsdG#ns><#|FwAGdN;Em=e6G7h?Uzup4&BQteX7OhznH(WfGauib3Ipt
zxXA5CmNS`iFSqmhcz_w2{q9i`DUcsP0of<qE!dkZz`NqtM{4%P{(*Dr(C~W_KyuWo
zj>(Cjb5D?4ljY$yXlp9mXfsonI7P3`Zog*NJii*q^NLL&#M9~w2lL}RZ7wC>`D|16
zQqa;a24@b0{B4J%@x}^wYv|!Ev)9YMt<`DMAdosErLY6_rJdlrm~HQohc8_wG3I(L
zBCygg$N!85fLE<<c#&K7?Ol0I?b-&okS+wcmwbkBIrmitL$mztV!ptc<Rj4x()g)U
zG{c=(1wG`#K#1S<4zoGSAM+=_yvv(Ce4d%ZzEeUk97t#Fmot}uSaIPa$QKT-dOHY4
zX}t-F%vS?=JF6kgUorVHC8*;)z;fm6L<<eM?)3Z>8XA&xRJ>9s1L9%HBsO@>g}mEo
zwl`cll7WqcuI#K*5`#VMi%o*FD;by&jtVty9xnf)^=g4u9QHCY=l5&li<xl@i>3+Q
zj$+-a!cS&_;t3#T{a&U0UUylf|E^KbHP^JPn%f%65<XP$KDoE#Lm(<kNyws933tUa
zgeA995G%?1PvZnaTq26=it=iPMb87PygZkzw78ao^821NyYG|5q?F~qD{U!JZx`-;
z@3uCQvDfl`ox%#%zP-v_je&_2-9YNt2ZI*9-9NR4T`ufv7Vt!7ALVI&hpJQVR65Sm
z#%Vnti%?AvQ*xmuOKK#dizrK`%hyl)B<iw(i@GOvD!lkSbZM9dF3o`5v7XJLUr4(<
zW%Gp-tYo$va6u2EREbVfa^UK#(=HwpLTlhK3Mqa|S&pqL?s>eE@m&OjVt4Z{SlXAr
z#%Ae`4=I;fecS=^TJ$U+rF~N2Zt^P-3%c@ECP`xe&-XF6P!=|X-CdUa`$F(T2P&9q
zpMIX^9KstGT~Fpen*8X?H}~r~9pnQREg)aSVHAeA$J{wPH@xLXumKUEJ2D;UU@ITY
zVQ%AaW_&LOy=Sr%l|J;2np%Cn_)o4J=ldZ}iloo<3aLJF?DapfC0NqxZRx0A#cRWU
zDtkyf|2_d&%Y9Cb14)yZ_&gw{6y_WXq@-GUr+DgR<eKG|&oh)xfPyfvC*Q|TVid1?
zhFnVWu=tX9x&jvA^v@dnoID~FVv4cXW&1iXewx(>WN_1@er;5YqrT*um`t_@9WX}Y
zVX7i|v)PmH{=swAVmculsv5uerzVcOP4G!FRWwrfSJBK;2B2Q#yFp$Kt!`yezY6y`
zJ96zxJC&EK@fo#wxxYZ{7(jln{;Jt&jDttQmG<YS#>nfPSn7^<6zjL1f3CD6SM8jF
zZhr1{_D^R$FreCK7g1*3p|9?(h8b7Vt#-8Vx=f9KL5KBBlc?-HMk<bAb@qnm3j$F{
zJL69xL32-zB|k!TL}{l>zfed_ttzPJmQH_gr)i-t|3M&s%Sg65D1$Hy4bGy?`;`1c
zw7_W~ugTh;YVrt*<VF~=AZ85=W$S5^)#@Fjzt7H1cw$c$9(f(^lWLXgVW+3Yh#n80
ztL8bL&#BFbKMl?1l@I~ugMNmY^L#Ht@{@1{jx*p>!ZE!CwVUDNOy*C@hZiV|wEs@l
zX}~ku=vhIMJ4eaJ4-d+7ky*-9{#ijb;6b0%G&F`S?LhBZb+01KuHn5Ub7lk$7uAJr
zr#QsKePyeaxf%`6M@?RYbuHN@<)B-`?9Oa^KY3&Zfukej*{t8bdWFF%y(y-)xm;mp
zoY{yU5jkMXGv^!>v=VRDFd}p(&R0^^lOiv!Wqp+!n0EKqZxHVym3YkMO#VKJQa^bp
z@?zqm`xq`aI27aGr<&(VMB#4Y@&x_UM$bo9FYoWRA1}svB~RxC8@XL6c*6C6e#!%k
zlkb-ExA(uKE8unaj{rXU!b+u%nk$F9{gHnfcBQe)pI@+aCWjZ-vn>anq})?a{N&Se
zrHYHpE{G;8qa2M2o|rM+3KHhf^TM#N2q1*0tE-Rek0-6>_My}QeriC={a<IR5jhZ9
z&UA%+TDn??Y1~)%i<iUsA>S;ya{=zq-R<m{mw`|lrg%K~^V6G!De%PC))9`d@W}iR
z&nYq+PJ?rx!de2_vV|Dn)*ur4@6w+G+h5Ici8}X^NVNxipL~!89^7?mZ!NQw!D%T;
z-f8`6s|4(cEy<ByFV=z2#kSXJ=)tcwC=^zm%5H@$i%MbjlJ}rNO^Guod#7hF@q<uU
z0zVpA)<hGXn9lCJJNc&l{u`8TlyUKkhUHL!%|mAYjM+0u9EknA4?g?fbo%0>OtSaS
zX)*SroIP_(MmKo0>eyaE934OOE8eE^>M(99r{=b?)VS2#vmt8zzX9b&cR*DCf6h0y
zln_f2N>bV!DsuX$_T)3ugchO0#rC+B&m0(-m~IFU2CpkR#8lxCEYCU>2l60GuhkyV
z-t3&Ikf66pLoXxa7T#1$7iXV^oh->lia4SohMq}Svjp~3;Sdr1UcE+Ft2%i_&7_xv
z0?pQjyZ+&en$En+J=3JUy}EWgIo6nK^O<^s#fpu#H=0nXUO4oMai_M;jR4XsfbjWi
zQq;y%V<y<XU(he0BUiY+W)<INANW>8bY8E!YnCR3GM{w_^ae2ek}i;VF@d)tJOhoL
zAHCv3I;x2eBZoxb(JxSAh;O@B)KCbBuvWNcU!Pmu2|_JokL>AVyso+x&Y}U>NCrkw
zqj4UZBWoWe148_!Loj?+{0t-t?`<>aDYNnjph6a^diztkxgQ;cI3akrggxUQRXE2b
zI`fK~+|cTp=m+w2LNCM|yK=oEE<munzNa6lsH225AuQHQAsl*b9O5zhxPfRZ{V7uk
z9ct?2+*;I{(>aCW-Pq8#+ue%1_})Ig`6k^_cSl=%`ZPp`#_;716fR4;&eTSgy$`6o
z5&OSW2KJk;)$?uCU+xHFJ62UGOVk;9p1!JA4p+~$q0!>dBuG1L3QGlcbS(rB#a()c
z{YA=ksKMFY=}!r@LY?FCI3E4^Z5Fq!cWMKfG@;w}kyD`mj$Qx8L+*ww@e5sXI=$1B
zR|lVB)$(jmH~1D%o9JaJK+ekwRv%`UYOrZ3VHk91^yL<MkzXV{WyrM~DyTkAeDY9l
z)i7!)smrxWR<v32#5A*6rrUTSy!1ANF(ZoS6c2EUVAis&ixRkdLIR27T8oxJk%b+?
zdA&35<dUEHe~8>1Yj5DI#_<>0@n%QOAq&b;%nZs#L+10AX4b*8I;JC?a=k(aIU{(0
z?BwC!<MyB55OjS*jaQ-T8;pq^OB_kPK^5*}I;o4!zo)s=?MqSP;-*0&oW`v~YzD;Z
zaS;CHOtSGFYQHEMirfusbTRU64V=Fw5yiiH<&AUnljil9sg^f2@B`zU9OC2cBUtoj
zoY3m(wXc{aM8h>TYWk^{OGsJg*EkApb(cFQ%=oghC-RiK>G#kpuU&O=s+DbQ9UYMn
z7KVwTP!Vg$MD0CJKA$vA-O9%P@Aw@A;$5FtWEK=GDG4@(`8tXpcQEfkZLxJkbpDRD
z)G^}|-8B<+O!=PWL}nxUSwf9#N9mjsWxQbM9B-(?BQ6YVMzf=z6qPZ1T?~KkSRy8p
zxH!gFRA8f%gx#`uJ$&N;JS)qDjACpwL#WHOs+Wont~qH72al4NPB;1D>cXS*%_`IU
zp4K;|bJtnsn_KWjI#QgjTqVRiFIorlxG%h$Ei2GI;el&o>r-k3?=BI)&~L!?DMN0|
z&&uE8M@n@){&`CdOGz6~<A?gQ6VM%88NgdT4`|KI%>j~`068)y*zIi-Grq*7`%+59
zNwGuc_ZE+<j{3*12mMK{6#2NW=w%;PeOM!$6h>K~q}~gtX?Q=^67jWwoP+zh%k}x_
zq=TViW{DT>XsSAu(y1x4oOnsWKs>c9P^|@BSp&Fb&x-q|+3hnW8X^dddIvf*gHI;<
zRE*!rk|fi^+<AtRNQpgG=3#uo2dTrBgBOqV8(owO!_=l`-``>33UV&9A(Mx#BN?uY
zV?(PW=r%27ITWxNPRmTYqB#CgqopC%BvgXzl2kD5rWd<@4w+nG`WU0z7`+snyz~zm
z_{N|%pp{Cjb);X!b3;`7C*nh;dht1Fm?m<j#5*8{e*MM(ew+Q*Yk&jZ>Ub0P=qrii
zE<(U~avtO+<?d){e#19n5Ji72&Z4$R&n5QhG>?G&`Fq*mwNMiG-!y5QH`efS&8H$*
zs&#$5-Klrf*{M<|Mfky^M<nI$r#J{sAQlub{^8p7%Jquox)#UyQK`h3Yqxn?qHBrM
z7{?GLr=5BnypxOzdG792E$kv*w^<g`Z8tiuphceWVOj2I5_#SKt$=*;LuNsnVS^E+
zLiS9IJPt!>*CBx{h-s6?COH1QY_yR*!uWw1a8QaV)5Q0W(EX@2vin`ME0s&eR6P_z
zEv7GXWDSoNXqJ7<miwIN`b$y99OfHyxyx#I7~n^r-O<8Uw{d_ob3og#V}ZtkTw7_p
zL^~yaO90K(?Kt66ILPrv9#oE?=#$v9oE+oBY{8L1*-rpKnBo85r=mg8VtdyYQ0ey5
zekSo{N;Ypk83H|JLR*chs#L34lUo4N=s0E6XSwLKcvG;4L=?JRI)o1{d6B<II0S}r
z(8*G;y39eo)LGF=kTd-$rEpr!yjtC4CX+o~`rfJPkX;X|6@<Os*-jIjE)xaXWhE-@
zPa&{b62Jad<!j=_<KpXT<z%k^1kTDNw|s!nUu<2O>5hO~=8_d*Wo627s-vi)ig;+{
zx|J-OD(fF=@aAK$(Vjg#Ps?Rvcm{Wj%IUNXea~U6!Woq<!T5cJW>7Yr!b-Scsp;UK
z=<kb-g8q#`z%&0-7Wek{Dx+R-0|z7ctz|9#M*x-5;4<g<1+Sm=pms=im!JQ!2zNV%
zU}%K<W}#SDTZP<s%yn-xlcm382%$FUJo$>MFGLqj(yfG0tH!)=I+vNbaaegp0oWt`
zEQi5MdQrk?>fdw4kCi!c+na1hc%IL9X;6L6FEMk>Inn*~2mgEr4P11SmXBwukxHuD
z#Db&EafBx8<XV0x>UBj{A(E+dW|grLh^IT{i?^kExv{78+_Ae;YFAgSo>4K@<&hU)
zwZ-vNXpa5aVi^0OF4AE8mymbQBP`*N>J^=TX9(l^*iRT%*b@xEmZ5_zz-GxACzCjh
z*{+@MbD?B>L6yy{_sjjp9Qma+c~U=dYKJ+V)y<b>mQ3`EXVf1dIb%N*@tbqZ8Dg{Z
zJr)mNNO?w&>H$<6widr@fgkU)qE=Q+fo;isV<I|0u>Xbz{PBH)4Egs4u&z-5`AH}&
z!USm81YKDGN-{ApMjhf_y28^j9^=xg8=xyzQa5iR>Q8PZ!Q0@)Nq!ejD&r$)Af)Ix
zIFwV2qE(j^A)S$6lBaP8>6fENZXd{{*!$Q%%C*&rcWf8@dntVre-9d5!4xR9$gksw
z$xIW>gNd5IGPFp5SY@Y%vNR`5Fa(Oej~CKR9n7M*KBJUdq8C%IyD$tR!NEkfYXh9`
ze<rHP{aG?Vgnq>f(9`behR#|&_EP$dl3VO%oJM|Z+@?u*9p1%Cc<dq>yzY7#B)GgH
zi5S{l0C+mk<|4&+t4zC`<!wsE@kLQa$k*3^$%qmVJ~Lg44OTYEL)`4YZO-<ieMHls
zr18%7BVvy&#`)Nps1u`{*GG?CZGL3h`iLtzxl@0t46L$xaPznyk|J5w$1PW+t6Em}
z{c_JXTeEzyj?QvQ+AKCNzzF^`s{U+myzRtl66I?GZ#2kYkMTzeT1LXh&KhzzXB+Yg
zdj{OH*cz9K4@I|k_(buAr>rY3i2Gdne}R4NE}!H;?Q3^qE65yKRb$*iZlHbv$a*xe
ziXRCeX3mgP<jFca<ClJJgoy`+|FXlp*NI4T{Sk~_Zl<Zu|B($_gGS2tLQZ^sSy=`Y
zD(4gfL=+*Q3Tz>a<>VN^1s<LwH_XiC6YYMqdL4xb8Cb!xvqY?|29t1svuPht!$}I*
zGI29Bq?cA*P7Gp1H3M95f%%32XyF`s4fKrOC{3B)oTQ9lsCT?O_TPUK8q^Wa(l$FP
zG-3p5j|kyEoy)ZEwX$TcPt%VXP^_E5SD^k{9YU;ZZB<_vW`ycAZBb2$_v>~0Q@Sz|
zcOro8RX?lKFkp@PD7Z1Pf6aJJ?mI$q{Y+0&m@FFR(rFM{@qV*JQ3}huY;fNt$qz$o
zXY7=u#`Vf&I2|0njQczyyKV-Lzm}=5I=kB<Ez4;q6Ck(pW%)XKK5SY(1!4Q>ef80M
zz1bDP+CLPQksPfhyinm+C=dl=_t8t}*7ITG6D(a=8+u=RS11qzQYz(HAJXKSxN=QS
zt(3by75H(w`9r{JYm+D0!_Q}E$k6!kv@SKZ<BnFXnMiWh<Eat;f;+gz?srxdu2)DF
z-E79`BNp<1arV|>Rek-sw=_sgH;OcfbS_dsX#}Oar9)y-($XR!inM@AhlH@`&IL%r
zqG2Hoi>@>L?fvZioOsW5y+{6;Oy^{dIp*kbfA7x+ZeCvA8%VmaLj(|%d%!C;!m^|T
z<b%<%zQV!+3xXJ-G%rDsT@B~v@d)@q-}a!C8?0P)NPh(87_pnGZP7N?8I(ERw>JTd
z;}rt4HBRZt+*{<9X0qO#UoASLm!_+1{f&_u7S<UckT72m;&<|a>yqxaQD4-?H$6xP
zrM9_!rMKPP`k=yYcKEwP`tUo8npDSQn#6(B54_SW@+0e6q(hEu9%<jL$SMzP!vyG_
zi(JK$*kJVP%CMyAo31lMdUdUc8hOq?44_f5n!caDZCv%pS}Nq$-yo|kt68lQxcrjn
zZ(y^h{o$u{Ys}xzWiw3nA)$Xe=f1wNjkj=bw{&Zq{>#G=4OeUF2j~0jb&r`o`0tZ_
z`9%B-af_!uaM|N0)0((lWBO{s9(XO$Nyq$gUTET7^XFz@U{FmLQ3F!;2(VL@6Otd<
z&?XRco(ue+I|je-fGsny88%uubxNshY+WZfkh$puNSw-e*C40@Y=QQ}{cf)6t5cap
zO5+Ky{$BGRqGI{pk6>tE0@Umv5as;T@BA=7Sz&TDj_xY%k9;qc<j3B>MDd8^e=Z6G
z5@g21^+E3ZdmT-DbjU}^{y>9|#7q3^u%~&k?}cwvD<_32H4JL$#gKca{s1*)xTE1T
z3N#>r4A8ej%Ep**0dY9~XdqgsrAv1Gio_Mz{AGX35;Js^{{R&`k>0jsXA}{R0Ge|x
zfH~w$$p$L57>O-WAo|Z{f1*r;a+W~z^O9UHSeZPRIa0G-tWjw@aMqUSN<6gtjte=j
zgJ8qb<13INW@x)pV;c|mJExjD>Ut&W*q-`rm)v!1M0n@e-c{Y1C7ZPC&F(fi=s^2+
z2j+@#Atk=e1%#gkkJS^N`Z``^@{A_M4X;=pKVoKt25)>7VoL9B!5Lr_3)SE)<aeNv
zszz(Ba>ErPJEcIOYjk%4O(wY*YKj^X#4Ez4fh`@R+|L5xBW(HT@BfEBt;#Kph6Gw-
zSlb0KjbDFHO89<IkAU+528O2<=|z09Tte_xjwG1Us?T{_x++hduq?RyM3F)y^L+c&
z>)dzwEs$aXzmD6YqsZWO)^yY+P`MV2Sg#D(nDw}kAI2_XG(pSot??j<2ychTM*#&a
zUs}Mv0=h};nqlnrG)A0(XU8<zDe2S2OH$O-onzL#!fdUoF1?!HxTKg(?~2O!bN#5Q
zw?s&*pu|eda{Q=KZGznyv<&D_OUEMxQq>m2i4vKsvOBv!MAC%R2zd>J+TN2&lBj0m
zv*8XgNZnO4^zJPERAlBAapyZl+%*0isjCR(eF;8(>j<pv+AnQ~6p58~3E5Q7F5m3b
zqXimZDukHUB4$ZlukaK-w}K0JXO{N6s2P{ywuDI#j^!6_C*EDaKmO6wV;h5rFvfJ*
z^L_J+ND!cR<BP<@3(#1QO~@^q7wpQhuVS+s`^8EtTAHAuEA5XZY8{``;|f%Zbt`Cd
zteQheQF>9lFBlTuox;j8p3v~j0MV5iZTk4Vigt`>?7g(7<^$*sM6enLrA4Ca9m7=O
z$5zF(&a<#(xaG+FDB8R@k0owIKlbs8VAT~abYq>bqf>D2yqISOpK7J=6W^4O1^FE3
zj~F)Qlh<Rx3NF64t@}ArCn3}7nAF%X3P_|Y()Zhp<+h_C<0eC<6y*dtjHXyJj7$l!
z|IFpQg|S==pSoE3oyVW7^P@)Q=#v?*v|wft!5E9LN{RCon<|S?TGu%*(n4bY)-Xon
z#pmbS6fejcPQ!4X`jcG}tiT10+(=%}W*&XgPd(X5H)jDZ8A-qk8SafDMD-NgCq4Dy
zjoe$DwIHtv7#78|X!rBV?=zrMszJ&IL`vs!mYEI**Qs^aZJ{WyFPxSJKjSMAwD*j}
zR5&j^Qq^<p&Jndcvk9SX9b-g__+ahM^k;V$u%yEaSmGU}B15-4vwv+0v<(E^fe4y)
zryaPmzpvQvMf{+0J%d}uZqMT^VYX_b&ki)TlRVkqQqp2bPvuEt7A;K&HA`XGc$|n^
z<jMVgsce2fHb*?y$U?OcmUIhMQKCYs(g^Xj4E=IS8^_Q5VD2ALtlNJ;4~@#&#Ci?s
z4he5clh?9&9N=u%{U{lSacPH9nw0Vn9$ZqyoK_XrbNf@~dbRIg-x@I1%OT)=waI$^
ziLv$h^*bty4_APLCGA4_d;Ec0=-crMW0$#tXMFr9#wqEir)aZcS0_Vh!Td>Oa43&K
ztsS9l`*7W_^E(sUxSfM%w$K(}#ZuvCii@_x`>Pt+v+?v=>+6Oa>aL=OWGF|TSnT$1
zv{Gox_)EHq01syLp@_VvRbEn~WBTQoINnd%w!&mSi(X2Mst`cvqES)_5*EKP8A4_p
zP>y3^N>KF%l$*~&QP{JxJp)Yp?f}4YsQq)*D)=}km@X)_*1L_s(U1Y1=_iieYyn?Z
zj5ZNuGQfmddR?e-906ajPrRS4Td2-(<NhkA`a1y*<V4kFtU&FBGSc*=d-f@}4QXyh
z0pV|NnuB%q37sDSEnmtOJkJPr6cBahN?PzvP5N2qcMi!x7jFfhdb`2JmvP4OZ0fRo
z$tFwm_XZQ{TzNj6BCIm>iW9`;-c;Rh<K3S}q*Hl)+GiVdjXrFwE?e5a=-+Rk?U$?w
zBY_ta%`E+H<%r#a;NGt$j@ef|HCP(RNvHnp^jQ8F?Rt<BxADos!2kpDdox(zFFBEH
zOL}84a*a+kPC{>BtHk^TUo!e4WVqX+=NTb7L-0--m6uDsMhiiEe(3N@)@HAt%P&Tv
zNc?m?gFhV>b<=1#scBlD-`Jq3m(;}W!8Xf9X)mc}TP%tMzl^%=sfnyI+YWtsERfqk
zkRwyDN_5=wk034l1szldMI6EN(ECf~f;|<_mtSZxh0im8QEsS9UAKxsLS_p>sRcaw
zDdW>4@y3Q&l5?B;xogc<_pQ@JZ76L9gcW-<x;A}_d~+2}@$`huDSn|0Vi!H$$~=AZ
zE5^Ge?v9v4iz;SSff~Ph!WNiPT)A|0bUYK64^rN4WLMf`gf1;D0Zzrc<O@pZ_Jc11
z*3rP+LN{3}o61^!vYg`616k+jn_P~=%Y#Kv=FcH<4&-=;r%Z?U@loQ@XSoD#-#;W$
zCx+qPP#!ZIPtT57hmP4x@`k=)UBpAS&d#PcpB;nH#24}Ktlu&?kOHH6_va1^@-Aol
zOSt&>AlmpgTHr3KBbLXW4hsB=IbM8y2Odv%!Jebr<nIeii$0fusl2<!JIyZ5*9v>7
z_)m?M59@>Oz|y^1c>SU~0x_W5`IW%6SuW8SlNSqh!-JZ-JP5lfy?KtTIMo3<s+h9N
ziwld>-FbhAgaj?GLG|L6yu3^Z0%p}pG9~Gc8KRFvX*~;8Vcs9b*ZCjt79{8mEuE^s
z1<@vA=|VLH@%-<hVkb*O@1s4J-5ZwIK<;g2g)t^skQEvg+Y1T_>41^V)&(PKR}3Q#
z+i8_AO|4O_J{ZHYt6L#~P@Y)8FP`pj*kdu^N%^^?Q5Cd3xLaD#bMXP=+Ee3$*89ge
zm|`>Cs3ToCzQ6^CT!Ql=YJoX=k@EE!Ws@#qnU=0fDbXYwk$%QD^em5Wzv+y2ovx-W
ztp%+9|AIF_kGUSOu;eFe8fexyP6LxO&URUiiYV>URRkKYwIe48S6)*IGmug$%Aq5*
zI3du&<mue$%eVtG^x}ip1O!okL3P06cb1+f8YXMu{vtApFY1mRDb$ucE6>4!HtE$%
zeh_u5l-q=0^R*L>6_)?nmturY7Qf|(uq|TqmeD-198WbfGO48)ThD9_&)9(HFJMbE
z2aKm_;j-RQq=6`<tFL4S^`Ko#cmW>;YoycsFN(Fk6!6(MU(!U}rKF?;k&BVZ_tesF
zf9d6)9@#?Qc6XAbz4px+f7|(Z1SOmOrnv27PaF+;a(TLVn6E1(Gb2Q>GAXvSI(M*N
zf&J9)ZP$Pn*b|P7SJ><GBZ6(!kRSh~Q76s$-SM4dQ=AbV_FdZ5XM*4foc}^-D|8EW
zjvF%nc_eg6X{)F^ejP42TTb{<JxD(7zF8d<_SS?;zRY7|h??I5Si&d|_i5&6g4o8T
zy}blrH)nx_=iuVuCD!0xJ1EnltZp*a)x3oX?J@%fj#yB}6&BtkL%dlSR55x+?B8}6
zCbJZVUmD~5qC#{il$mz(ze|*v)COX}XvZ0P2mwPyq>{gaVa<k$h^P5YHlu&bFM23Z
z!%MdpE8>xvCyiL>(C?VAXbSGGQyLQG+dfUWrP>!SFR!TvZ@y+^_>D0u4s_tOIjL+8
zk3rvAywlvXOqyEU3jLQiQ@CB9<yiEay*awP$k_IQoPZ^@>}dXmD4L>qD~Q-8b*SR5
z;u)4k@dD$QZ!GxP5`J8$M}g}M`i<4}@RG~N1Y4r?F|VeWN6Gc1EkNKw(u5KU8Iu^=
zWx4x~AK3QXRY-_y=m!XDBje3wlD@}%npS2oG2qSDv0yk3oc}p>kw6QS^U<hETx4y_
z@ejX<{ZFYE)#BfX@bgZ6*0BcuOp_&&A5;_!(O?uVQ#!nODMLI~ltrqhHP0J;(G<ZL
zbA@YHyixGmF9{Z~#3mltgC49UZ52%TvQF*}xdP=2Mkr8#bbx?r5a=7ddCg!qWz^mK
z6Q5M6cdMWwd*wFP#b5#U05K}iVaL>$$`LP+-?#K)(L;4-p1c$I678smo(1~&G0c>D
zyV)JT(3ha;b6p~7m{LjRI2aak!p6aAM<8ypgkt`Hu<-{OQDrGJVD-gvTgGxFRv$U-
zfH}YiiDRlHv2<gSu+6eu%RM^ad#`r#9&5ru`%nFMF)KL&bqz2)%#W8CcS_J8{!;#8
zGNI6N;AGjT#iOa|y9RG#-r9uR?NV$7nY4d=yXA1zlz%5aDJiKZhA(Z=pv!*1#;KDs
z+&}KbGU3qkMaojPZi#_#VCyYDn2d-@4B1Dx(OxI5RnT7d1n@^R5Gy*Mx;S=CsK1XS
z`GqMG_s-WxdU&@#jw_v05dQUE(h}F3onQjl19_H*Q4hiXfa6-bvRgKiI;ZIFfMPiv
zw|nZ`JFk?71$7Wg@aBuNK|bHj8A+ZCYiLlkbZ6-$9Jzj?u*#W*QKVazI`k|AtWJQ|
z8VqX|w6+CxURROpz9J5t%+rwK?(!raI`7Y}t@m~!g0Q(zIiQM6(VoVvNB*i8-76y{
zArHCavubu=+Ib1b4~(J>-#YMoacnH{7|@9gC_ogi+RLg(Eu5S3;dc+*==y5%t*boT
zfYajU_N@^J)K_YbW5^+`<)40)Fe__9{Il+j7-cQx4>t!_A!lJ<iujI_4)epDI*Qdb
zG3r_ZoaI!Dpt*a87TYm~VK6uR3U+5SUum!I!S>R+`Y9UGNGUqWWgBz9IaSA)^x%?;
zu?ki%T3;@aZuQoJsop7S$tWpOx}Ggdb~EE`pF^?YIEEPE3d?c{FCky@SDo=4eN&`*
zq>^8x2>LA}E%diZc;XmhSt~+&Fe=2n?xb2U>j<##umNKp**&GZcki|V!YwGQuQzL8
z62;DevfVZ?-;1#T@8qp2+#Bb0jtoKeNJIgeu-jY*mh{kt-JGTL-Q=Rs#rK-3d(+gV
z#MC?s+1E&na)=m?Xj4<|_4nin%D<%eP}ub2J9KpE<W)a^zG*BeF0PyQ5UZbFNSd9S
zlS0_o*c^xm3&+()MLll>LG~-aW}wG(uXSMJpAeZr?6kg;vN9$Y2n6P13OMr!;1?V(
zijg!2SXHs705eoa6T2$yy=&C?=FOXxlDs@J7bmA3A5r_!u;I0j<W73cXfaOg9N{y=
zUlOxxIZ9<Jsd{52y@R9~erJU<;(Asn=XlTm!7xIZ-0~xzB7^QPqKVK>o*nAuP-T<h
za3AZIOS@B{Ed*z-EK&Pp#$I9}J6m15g?+%L?qC`}M!s^&MZp_c<S=sZD6;MV$!a21
z*O_(14{3ZuIO*J%^*vBdPmco;5S=pG{3stjTkpXh<PluC!O?7aLZIkuXlS^bCC8uN
z@(uT?I0;2g+6%KQ8uB1a#Trx41LeOss{l)R5t%`<93cvMU#s$r7D5^Qe2b6s8=gZQ
zpdVC$e&06AxZ9aC9N{!Zt*XBs<`8rTs&%n9Qs1o}M!Nmw=PvsbzupKFdi6nLVh!UK
zXpu-M<83h}w591l(0mAy_fZvD;k|vl$A2&IPtZvK)McURX=@19`D6B+AO)~?iS5e-
zf$DJ91$LuDWg-|QZ2;NIZAW5$r=xezI~h#L@lf&)Na?sGU5ZCl{s=-u)XT>AcdiIG
zqG|(%TXjSE>vZ{IKi3hCpz2qOYV#aw(H=LRy+2*2pDvV?@I;0%(_N836WNIQ1NNB-
z=$h`zIZ~syK6<i;9pSkdpCQ=@54u8olKvbbN|9qrQ0D-(klk=j6IDt-MG!Q&Q#njF
zz!!ECtW{!3o$q|fti^Pi^=cUjMR`XI%T2x9x6`ofz3;jC8|Skh=S2f9^3g1AMg}Ev
zqC)bw_Y;<P*&80q*b&}aajh61TMbVIF9_!om_wNS9H0qJbR<8H$V0on-QQRJf{wCT
zT4fXT+!ea>k+^ZO<p^?fw+cJ{>9EO>S>DNWY?$Tn<C48+s7)BAS9ep3AqyJR<aJAF
zZ#umG$PDQiG?265yGoXtVDPpy18Tkyt?5ILJweEbQ{u}$QonM?&LuF>5m~YDz>gIU
z1o!#$IYB^fZ%+c<?xtn9Uiqk1K!tSbCLkY3!4k)}QM&n1e^$BJf;|=X1l}%IP5%OW
ztEJ_13!b#V^AHb;S;T_Bk!Sdk(Qd4i<>j{w^XyxG^Gk1fh4=JxFnnhyx;Op8%GGD<
z$3SjM)%13z_&aVTOZk`D4zxi~enX$_MexFN)Le}6u3Ze8mHLMS&q*TGOK=XH%r{_g
z_kFhMFX>TW(0zr@fbF={PJuq;V>Tc~7G_!>Co=zW@iV7cy#k@%>0Ae4`zdnNfiD-=
ztKE-y1K#k<i!Oe<A=J)b0pd)+!(kvP9CZI=r%564KK$oP;%M|>apRfREvf4r4<_@5
zZi1r8g;gL{uMWlvfbLu4`jutMfAuz7=GmU3R*=P1e6x$*T-EX}erM6^9xl)u8qb_4
zknD(N2PpYyKB4xxVv+EoM!O|*N1}Zmqgpz=8O9w$uOUjm6Pbs(SKnan_4aN5;?ytp
zU=qEV2K=GDD_ofniz*^A@$C<HVZbsb2h@TW${dgww}-%CNhJ@CpHRn^65*a-_{;?m
z(22Y9mW#cno|DW)a88kk;u-Q&(6zRR5^dT0ZBmX`h&T(CB((piOVkTb#B3d@R(*@$
zBItBKyi0HsfJ}60xTAq<!mG61#zGvDurm4fGLuEE)O_x(x!q(9nc^uju7ah|{OaBJ
zG_ltb^lCD#8nc*wzg=$2eUA#RZ9SPPY56A>El=30ci$PFR3OD)Q<ds#hS@z|aDZdy
z!|`SI;wT(o=TnUiT@`loZmbWEoy~8Qy%CKxftzSuyyc43H<BR;=P=TNRrstVl-dZ-
zrr3AvpylQETtL=?0^jlnXIRF}&wlQNGDqL|Yd|{E(DL9-YKFz1Ybd*kVJQ+-cea!W
zSNb~!)BQL{JtQ#BNXm&4(lI0ryzC(~f$S@bYVXr$Y#%pjkm=117vjFpl?a*o=8UoQ
zToY(=US`QrPY2N|9%m^B1!2b$`$x17J@(xCO{d_eA%FQw0Li;KO*j<Ev7G;{>}h0g
zZ%C$Q7b*AFU%yk?Jz^mj_4d2n6UY?_+H?zcb3wK|$F)X|$pSHVDsE*nx&+|FpVK?S
zn6@`h^z>r9gBIQ76W6(B%^R)NBF%f;c>YC?@2qvbR0=2Rd|#;N%+ry*5Wy%&rz0J(
z>5FbM3SvF(ade+BMN>;mkagqOP1j(YFvYbfc$-~z;O*C<UA-A7SGnFzV1dk(>CTqo
zK5Q`-gehswpwE3xpFoiJh8dz|(sq$=I=#9JvrDS2zI8;PHa$^XY<!i=i6%w6N2F?r
zi260U?C%%J4@5&uhIdS#Lf2<?Ds19JOKI-(;~a;kc+p2@=A)zZzKT|DnE7O~oS6j1
zoS<Bce%=`Pe-$lM(!dO4ADyk1Ajq*@f!7-AM#~3B%}cbY9t)zYH-23qkYf&ZeNq@-
zF0I%ibwa%(5qrxuI`*j+Px6(i0`MI?Zy70<L?76hBXq7Fyo764J0fUHlfhDP2TDVB
z_=PNAfE=H*1fT(i=bILoTW(vaB6Jy&cKbey>Oz0Yxs)yGtxpmSZs^KwM#WX6<~H2t
z?$4e*KcTjOQyQ<Qw5=8@R4^9{8*II4AFXRe3Vau%{7Qlf?3{GUv>aJIPpjR3=q!ez
zh%;<CimWgH9TZP}Db_Is)>qsF7d7^k31I2##1)phxO*M$?H3S{LA}^;4<VAyjj4wm
z2F<M@T7ubmzGP03&g*<}*KDJL(F#4`vuO~239n*r#fL!!-uRa5v=%p0;$lrQpYL>o
zk{Y@0^!87%pPry4jz*O&6nmC{-x+B{P5Lf`^T(KB88!~O0kfRTU>YHPpqxZmg~b5+
zKw3E!8ad4gZ5>wYs2~iXaKiHB63b?=?unU-Pl5OAL@pj;EVF^da962ETOG?mhxj6D
zMj9KoOmle7U@dL$KtoT`i=rS_`mT2fUCbFJ*jqCFDdzKI#EmkmGcEYY)qX<-@u~B;
zMO&3t3g3{ber0tVQqEGoL(@$Ahyc18#X{7kAiI~P6A_vDvsb)2v--RcF6nJ{|J8Ss
z^_DRyPm(U1f+?YT{AvPKu#WH;Rbzq8^>L^-T~O5g?(5qAggEk@l7x(RBXr#6eeG`4
zzsiN6286N)l~@&wmRj}ZfjqvVnD|+QZ7&QST?&w6Os2G7P37oC-{%<lhM8))Xc~$j
zW{^=QE|=L2QBm4)OFVxEc|>2MK<+Y>40UGv1H_|zzZ<Nzzeq2}I*k=r-Ug?;!cndD
z*CzsdRgps`l9=~an>Jz3;dH{oPeL*VI7QX@h;(0VN3Q6jUwzIiXKUf4t9<{edvk3#
zE9+J|Tp)9l6J?jd>twxH<?XrbJ2a#&HE3qLwJ1BgNsXeh#W5s;c+snH&nyh3w#Vm}
z@Bk3i01xgLN=#V;%3)(7FQSRZwUyzVF(;~nW)E<(DmY`~aG{D_S7`-oT?cT%$6r}X
z@R1<g)ys@l=ZDTiq}oy<LMpW2%tek2HE&EDj{TeUj{1{MMb?U7GtuWIv|SysEe}g*
zzrlWyLLE!u`}#kdV@2dygv#qZZ!ruG<d7`FOTAkBlqqoSi`25RIiSq3aUp4Q<T@J0
zF085-!5~C1|9+S{+)86{Muc|ZVm0B15#*jWdLN(srSbXIpcpKf_RCPqhT8?1)K5fV
zdh4cilbnBs+9Z22e+m%@8%okPtk9pOXP~QHz8rk5P3)8|ELUVhs98A1gPujGDEcEF
zJC4rsY|h$F#2kaC#7Qeh^}dkv^j+b8iuSMeEAU)v{8b(!e9F{y_`E1Fw+^4&Er=ED
zO(w%oEa~iuV(|Iut?vY}*&Aa+(pYxBn}CZ{wk%=`!^`zObU2N%*&or}BZz|+2NE0U
z7>AB4y}?8UZhb=NIG#NgHwT;Z=PP2xH;*$XtQquQHPH}?SedKM+3^I4q8BYIns@p|
z17b(F^7qsA+*<PE3PidoN89Dq3L?D^C7NAW%o3B9xHc?1JlYq}XWHm<-xy7vMhk2g
zf1LPG&`bnT!cj>s8fWO%jq6lr(AFcvw5=_UixG)0udHdW>l!z++k0E_lWV!Lp21Od
zIA<+vkRECsO%?ewl#mCdkv;OYgnUQe%qQi=<MQ&hdW@rr7smpsoMlgTE6LYBk)b5q
zke@Vl^r{SSqL~M^>J{1bOd;{gaX4nJSLb?_o{T@LX^0g<i|W2M5w)i>C^q!Hbe(R|
zl-(1}J}vCpWW|H_QYW0M003VR+(YJ$)zD`=K!8y4IZFsqlE2NokwDQGA8X}w>N!%+
zlXer9up-BU(SnBnVi9JohMW~QQyt`j*H)|yqn2}YYsib80F?bRQo@!m5>d|8={A1V
z4YwpkAjB22{a&-LGyM*p4sW*;hmxUaT2LtahMZzw?bACmnqgwqT7+Mk9yqL%!&PM9
zDs$UQ>+2EQ`W_aoVaIv`)+&Ge+(W1YHI(-stVexd_wQcmU8yn4$?Xo@!Wyu&%9N2v
zRAN2sDTBB?3E3d}D5YAzL7=vJ{{xOot7AP5>!Iu?+g=EB;-yQg>UtnvW)8CH!{tLC
z2@e<6-Je)wze<<ZOv+3Go;+Q+$Dkk9r1jYjA=T_H9dGheVV-vIEbwS{yfY|H!u$p`
z!ZGej?WlKTGuU?z<vC)}#zuqcOHR)AMmK(lBrGvf#fDuURfH%E(-R(%cSIBZz=Xvg
zFz62qqTUO7W6e0<wItL2&HaIRrC{jEUg|i%%STEVgrnwneuClcmNPZlTwg&9S&c^`
z75nG-x~@yPnXcGXIf*p#?YWz$9vP;@!C(kYV;o7$lnM%$&>hG`a3`f#jYzq->-(or
z-q#Al2%6N?SLJy-2MQEl^Tj{$>Tgg0|7Pv)8wH=*T(QpIW7T8?KRS4iWm(y{QGgem
z@YFk^iw&eu71v*vkmFC%TlVaa{Mp^)G`^v^Z=c=JETMMZ!#Q?4&UyO$_7^L3mgQ+)
z%3Ne{YtOvRw30Ro&K9kD%4<|zbGs`Bsb6ccOeNMeQzwA%tM57BBYRON^L~wiN3X;f
zF0UgKrW&pBQy&?g4AuYxL={%v<iwPl9HpA7!gm_zK$zyvN(E&vr};e9HW@?%)jMQB
z4z@Es9`1A=SQ?A35Ems=aN#Z>JsTwgG`D6b3K@)sf&J|J>gF}<j?cVr`y_<#b$4^)
zZ$(`ON$;#yTQ5$SUl=c)$o;D&!)e7Fp+W*Qh>iF@CMua*9Ig!$q#Jiw4_7W2K-O5|
zwk8Dg`NAb-wM=Fyc-?Sgnu8Iq8&0m;v{BzkLcm0+#!_O~^y*XGIKVky1XN7AvTmfv
zYFr~lsSfXEZ2e5kpZ{GkdCq9MF#eN9PvP5AC1ZKh^S75*<PO3^+3Jy<{tc}s&s`h%
z{KmX5XLd+VTWAd9I*;0_vsZ71g7Bd6@#?N_Zi&;=&-=WytB-UqS-sqIx<5-yS4m?_
z8io(+>*qg4+4W{F@K1gE%qBHv36qK=2y$}$#kk|QIr?;_p!*{T)MBsrU`p<Bl{$JM
zk<61u0~sD@`4a=H;Bvoz;k*-Efg@?Y6S_tZb#S~euimsniBAzb7)O{bCd!G0P*7L@
zkk+}o+WyWX&-ML-rYKv9>}Exm=o`vsi3ooJQv=f5!ELz_gyZ(ZgfZtx=hqoNziZ>N
zKSs&z_3I3H{D~dvZZK1r!*ukKxwoS`-oA~KS1uBteQHB8v*#G)D`yNhSHizIA@Fa;
zhUCP42cQ4IVWzcJuJ3tt6SGoEj_bT6MFeT(H#Jgd11mBBN**HbE0E`0#0Y<B+<hBA
zw?Z^~5MY^wm3`FKuLo~@kQvp#Qx=n=<_<#JN%ygZ%kBl;w;I+ai^r5M!oLI!e(7#0
zW*g?2__Md3U-6UW`Vp;(6FW<*tK`Je0GDFGCYx}Kw91;7%)^g9O~W?iR#@%*?0WE%
z9`<>-x!0`Q#;T&G=Hf1tk}?%jvEK)&Pa>qIrfP2P+?8Ydy6+_Ecv(nDsO^Tras=8T
zqGtqA?;ge=Ltl7_!Gf~aqTGonUSZHDu#-8_55V)m##E_sZjt<j>{QT5cp4d@t0j<r
z*Xzr#kh|ekW*MJ}BIloCD_jg@g&`thcHaNgGiIEx5OP?S3Ra_r)L{y23?!iWU7CMa
zBul2Aq3ABB?8N_JW)6Q6m`SJV5<yFNlxKBYL;Xt;8>aQKE88e);G0z4BLhP27@nsp
zmV9U~?CTcD<>+txC6X?PVuMHA%EzU_6DxfR`I`6p(m~|c@|d24mwMYC`3djYf_+ua
zeRmtJR^%2-#UCx=OkIapyySeT6s%N2RB*EBNwAi7cHElUJC642zNK2)8%e&UP0?Tp
zy+Wp;Nu>$C1orCcmooGV1NwRI?^1q2t!^=ygtc>C(U>kkY8a$Pf_NhwH|%qoi(VGJ
zdhYOCyE13vk3}zcSxoAqebiywHcgUSYjSQ`49=znPxx-h>jxgY@^F!g@T4jh36T$I
zm0BBGt`F)M(kH2oX9<>k+2Tv}q<xu9U1VIbw|5*la;v&~O5-^BWY~xt<32zNSLQPH
zdko5H=&4nCkNKg?I(lTkiw8=x6*v8RGV>muWQ}aJ2-fF@_jP)(Xvfd#!E|F1#<-Id
zuoNz9o*?e-m{~*dUMf?_#`{05Fx?UeSeLrJ9Oyr(3Q~|p|IVs9Ffh_=?OV-M$=G%A
z>zhIKorS{gx^QwV+Fb8Y0i>w2$l+Q~SoE=kHu<x}tayp&jiLCv$1}N@axNR3kPwqs
zL@;jMM>$Rb5>)!`W}}A;b^A)$wRqe*>CA>O8%zm(gc}hI3<loR#sPb|KUq{G&Ad3j
zn+L*`hvdahY=8oBogKHdV`(GlTwHwLlR&5MV~D|=P!nHJQ)K7Wm*R^nVbsan0L5@w
zQGCfBU%P;t2AUrEest@~oQbYSQ`DlQD)WX4tlojuMmqT8uQwFGpAT02;g{oc5GiJ7
zj)%O$^8Gv!;;%>vcF@71|Khx)c<P6;qb@Wba=RERQ#~%C07D%)#35l0e-l1qMR5W#
zJXcxEs_z4i#L1+aO+S4gZ!L{bx)Uobvi?#nOq^EUGwFGjav+d3%rrLfo`t{X^)^>E
z^muEw&Me1ARytE}4lR@THtxkZFr@Xf-WVe=(8T}tNJL%J6wbsYeiND=Nyp<^qrj?b
z?Q?OS>$bU_7IY>sw3CUKazze#;W?FK;Fb(Rq-N6ctPtB*)D*W4=*J!rm~3=H94T~U
z6AmrQU>(M>)7;V)h@S;5PrTHS-%Au?c3C+3s^rh-^x-x$uMk!<A<RPVJN#*Xw)0m~
zRuvdhi5#M8EWKWQ^$xiud|J!&3+?h1Z_7y@n1YB89!-@;G!b%V%dQQTKOS32ITzuD
z{N_r*fY~~BjeF4gH)A3<N5zX0{y4F>4It^8?cowZ=Lt`sKlsUz4XY2PoVq#PS1x=<
z4qGsZVC$FN?nnlfj^7*~37raFDdc6axSnm2U#Jq%=k&NN{9MxP)y2eN($aaABP3M*
z_IB3GoQ6m{tb3yNVKn&CeeVxN&4|4IidSFv^{e(*XjLMe34`6N&6Fg(>@T);+V&r|
z9g69H{m3gBkf%irOyLfNF5e(4npuF4>ep|p3JKebtC*s?>|eyHF<7f?+K^7R50NS1
zG3kOes+$pggY0c1I#kv%8*)cO0X|rst*@|Q?mKL4tq3B6Ely~*fBkH%QG!#uVfM{?
z>&8#oPMv1asDgt6<q4tJPB!mY1(imdKAruxVs+<2k3QTkPE4BkNysBMz{4|j2Ek7r
zeo9eQAgwyc`<^9c*;Xgp#UegD)G+(FhxhTA?O^)3xwTX0>CQs*14u~bIwGa#qcK(n
z)N?&6QLao%B3>T{g9Rfww^5B;m@;Q=sY=)N=`B~^y4Ksw3tvxOV`Nct!wGU)1|7B%
zmgMHJ)qOj!O3_DJCt|77ylnT&Th(7FH7?co?4*S0)e1?d$pn4RCqc4dIy-)fNW=@2
z(pG*$O>4*C&*g+kPX{LSStBA?YYZ0&>et8xPpqVlXkZpCw}fT~`x~os0ScB$9r>t(
z!SX0s-I^y8XV;2h1f4%337|Z{0g&OxJE^$Wcahia7FroqRaJkjhhGWW47>;9IV*+X
z=@YIp)sxr8!LT^i*B=MMM-0_f;M@vu5Ac?q4+j`Di3uA@Ldp_YZU?M!Y>8l%PV9hY
zVw`QqZD>Cw-e9(}&ignYskYZ+5q-ne8l79yWqow?Oyf;2i4~V7jbZ^MT+$<rNo8RM
zjkj+#FWQSZb~vl${?9R~A4OWs++D?DcLGW>zFnBANE8T1BG$>EkNJfa8a{}R*xo#%
z{_}0Ar6TF79uXopIN}L^O>Lr6Xt|;7Q=rSppy()<WWhxZdydb>ll!%KFms0=`Gy)M
z!U)|;FjWk7_Z@NDcK<Rt*M6!Ui=rg74>^pBkl#DhFP<rfG%2XOR!B(ScfV)IIXa82
zhR#S=*<$7sV!=-Yn-bP@nPAXY(G8(})tmhhcIP)Iqjo+@&c3J3oaZCd<xv|N&waji
z1&Y-bl-Gede$`6%X2lRsag>L{oDkT#d}C*>Kq=Cxw(eqN1``!E%Ozin1GmL5xfp`q
zbxF@AEWRRP=LuW_0v|puC9!YYrvnRa)>H2rmBh@OUf4H%37PAP0crtj{x1v+tjLs=
zM8w4Rc`e|#V)ce*?XHzVKHL0(>5`+~S183Fe4Ok?@=bv4vm8U8xGD&N?p(CbOvIm#
zei00L$`D@udgNj9u5iZbwvkA{!^)9Bz|C$+RhR+J5Ba^;Lbqk)!Gi3RPP$+^H9$C=
z6S$V!^SOa~f*~0)R`i}-u!aQX!%o?bZ>JL{oy5tv?(!l$G3WjxmG?9LC=%YIZm`u|
zbQdX`n0c}kCl%s2?SShJf3fqx$-yZ20R+rbG!f9~b=0FT@@weznm^5Tb#l^!jSEY&
zEk?HW$_heNKJw*i7*e`f%V&)oxgE4+ZT932M0IaE32a5HiXWK`hFbggphudNqGL9u
zfS@IT<weh&YVHX?;D<c7Oj82aI9AH;9)KEEGNus`9ZKOSOCG+#nOR37Nt&4qZGCwL
zu`{cNJBam}tNd#+;eKNgr|Z=pCeEoL+}zXU*alqjW0nxX=_-j%M7j-6mavmDOjLg+
z>}_{;x0<ix?Bv+{-UzPp9iV<Gjw}cccKpIPoX6U4>pD95k$2h^tL8fTx1YAOe=skf
zabwTq+6rpw1EKAEZ;R*LaP54b=;JvZ`a<upr~WjcPXh`mu<My)-X8JSGQ9i35`Ib1
z-;M0;o^?Z#_N)SHPkrgf8Tth3x34(w!h$?$1#+qj0WZ+3FPZc29UFh;w3pv+DZpMc
zU&V#2ii(Od9v-V2CpP5e%a{3!7Yu(riog#ZUjA3lH*fx8#yC-W`7*wTR-2y~{IEX?
zyut>-1~2H|x}W8X+*#Ydq`1Q<=6VPCn#=2*38TTt-y(ojTE6go@b6O-9ThNMXQbfL
zkp+(E+VI=X%jVnUdc{VE-_J6^=I{-fZjATO*N*xbd`Zhd(9hQTvdJxlOGY$ZNY|ON
zpz5PZrFSSR7F5NNjqC58;Yjw!pPFnEE=$XwOeA!4bdsyt9-?ef?FLIg|GR%g91&S)
z8c`XX!wJ|E*rv_ZM=l<x`)h-r52-9}2%wJJFXGXs&x}5^C)ta<(jZF*je2(l8m%7j
zn_`x-aN3DQYNo8(&j}-vcPElOu$c0^sry}VRnEi49Agn^JZ*tI9nw6DM=rZ+DCm6=
ztZA=-)s>?uL&~Y5@ES8N-@5@AA<VcT{;`a7Wulo)onjZ1mc5q9^w<Iy{^+L8XNR~K
zZ0(!r1bHq3$xXc^hh`Tdp^taey;plbQE82cVxdM8r@oE=zxbsRh`fArUX9bNvcvN+
z4TtaqCK+XyG#eMTA?lL@!et5zfb=7Mvy(a+a8t^1@F!&(Vk&db;oi_EVXDd>R=2FS
zmslG;AMop|)?W7XAM_7pT5VjF_NP7?P8V5o8KQ)%Tt-JlEm?a2Ejp*tGvs8-+=B0i
z6B~+NFhLiL{bU6%0=2LbfU#<oPcIGQ<Kos9_`gHXkem-5xLlFCOx0mANO&!4eXraJ
zn#nOAIT+y&&CCV5?#w9<5Y$lx8t!KttjS#P{&yB?+}q*?K0abH_KtmdsA8l8o?71b
zwf%QnJ;457#&m@IKKJZ~%cs`8wW7(<>Gy!#;bi~UJpUiM+C60&U<3uU)PwTRp5X!j
zLhl$5(}%^!6PZ%Ictjaoi6488fK2y`j#b{J<l!j6yLPH5I7?(vQs%s$lbrO{<X-1z
z{ga*9NHF8xUm{j@nyGG0<F`Ef1+RUftJ_^}-mcl;<wQU)rrAev4|HgLV0S4O(HxXO
z$!oBG4EUb=tYb4j9nPzyb6h%e%|+M}=cyl_%9CB3CePW9fp7G{)YKFZ<u3{yO7~vQ
z6?3wAtPeCFN36#d0LDW$$U}b;nV1v3uimG-#`X>~$q5Mw)oiFjVgEB%0tN}70>jH^
zxE_N8WlU1_NlB)309P&zRz-oDh(oMVPEJmvy%?`b^1^}^@PICNU6SWyeVAN>(wMwk
zWjovjwB_d#>6OuHRBT^?LT>HiH37Z0L1gq>L>AQ+#bCh}*}V&GF0I_K>QtfYv7hMa
zksg5Y@IqPV!@}5Kh{2eR1tF~vhnlEc^x>5U^k5lFW&v>RUVupOEG_q-ja$zWK-r8u
z8{$!QM7KM5ROXUjP(Zm*-78VqlQkX|9-hC+rj7=aVL8{+6>-V|ccs2H5lA@;vmX4M
zq5)$|X6`Iddy3@Gw=Ty;UW-R%ewGhXL5KG0EN|!l;mVa<<9k)dUmTqUgB@@>0V`Y}
znqtWxP5p~g5@-TUL)pKSfvTUlfc1dp&)jSjmD8QMR9?G{e=Ygz%@*YaYLf-{(%%5*
ztrxOjgRnDQR3@muwfS2ISn8<lFc}?S<9s$J4``ybfTSS`zS2J&k5Mv|GompH2)3Sc
z<}8eN#nGMjXNHH3R)OaV6a#2Lrw5Gu1z=I|TXf+5&F?_g*I`-Dbai!Al~UDN0iN@R
zW=@EYGk3BLYvyKt`IOb~+~@28!0zj`v#YYQ-VXe&A0SC`K>Vessrf$nqBbQnbMtSD
zY7N2-@;^LT;{*k>>tjkv3TV8NPr#p4{w!!q1kemD`8URRNNdN6+Ci`$tM#{Z1b|y|
zpI~uyZCdMqLJ)1b;3)m_eh%s(8cavW%Ia(N$sPy@TIucYk7>U54E2IiIYD{1fes5`
zgILjEvH9AC>N&E(=%DH6SOMw)j&^0KvCE25)8_bz5<?YGOM(<~fv~GYuR<PxNc%w+
z-RnEMH;lS@Yh+~9!E>}J3sgJuG^T)e`wZwnyOY>8zUo}O*xn-Hk=$j=|G>^~bw3~m
zMhQImS%B1$coTq4IbQxqPF8m641x8m^>6T1KHOZ*6xOTS;4z(iHJ@<DQkcF88Cpx6
z#}7q`ogo5;YWc(KX)NaI4qS2lTE+}13EP7P{Z<Z?n0NdAc+!ONY*k_BA_c>4Ztr5$
z&J3eL9c}*e`#Tw%+UJL$00@A9lACM^uWejONlDHW=<CsH8H6IWY`YqE2`l7B%U-Kr
zWAj#oB3Xi&&G75T^(S|IC}LlYy*!t$x!h>mSz@2_mIz_EsI1V%DEf%A6F!_UUydwx
zH2CRGA#t=;#Gy1W>bkb|XUuO25?nL>mRG9e8wwKw;#mOjrr3IUwKwUX%zY-i$9{2m
zo>YzPe{rR6kaw(+<s-zZO`o5lBoUP|lk#I|<_0&n?8{Go98R2`!WY^GN%k*l|Crr=
zpzhDOy6l0iexq7w@?6*RM8Y#SU|&&%IPqygA8KID$Ky9^4!zwC9l2H|k8np#Lb&ha
zk+LLFSH5rRFnKr7H!(b{(MNi(PtRh~+dX+Hr%>9PS(^0TOx$e$82;?5xAeALYX%3_
zac!)wuMFu}KI=TyNf!L!oq@Td{o|XSCG|pJyFU}XOOX7eje?JX7C%4#sKM(^!p{UV
z=zJyl`+i*Qhi`xQehq3jT(#q;8H0{5ZW50urn&b-x%e{JV~oK!#6<HUrOg}qcBVDB
zj3f7{QIwf@*<VCCOuT<Mu6&%-^8r}Ci`QilmzLS~*MU+cz*i2H_x?SJ$^G&IpZhtn
zTxx1+pnmqj;eNC>u}^1is1e!HosR@~U+ano8s|4U#=dA64Tpd4e)a?r5Z-xRWC70(
zMoyN=&?a+-P}^^u2yarCq4Rs@HSw$v|Izv?dOOsWTG>O$l$ED8_=3Z@ip7Ma!v<AE
zMeLrpV(9Z!)c@eVe%EXRhb|8ltrsov#>&y6S5{kBoi|6S3YHvs$2>|{DcI=KzG=6X
zrw4P=_kcUnkmg_|rh68q^`HTf)_yqrAR|btIO!!&(2~$`H_wEJg{27y0k84M>`5-j
zHvM#pOuvP}Tq(NCU8@gD&^>AYuE<lqoce&F$sBhh`Eacgcgg6ls^$88nti0oTYs1D
z!@}-yw@>1FDScca<ZXzXY8jKenANOT7xdf~r`G4LUh!3+os^AqHXf<7@eM=7%Lgxy
z1I7aTZwE-C3$a);X{|Im#E*Azb1w?!t?>^l6jb^m!&+xx0`l;682N9|-<df(Kgt&<
zkPf`+v0c?5zWA8E0X8hI&X4|S3zT}V<A4`sxd4=vyK6Ha!T^Dir*P{6n6CUSXqay*
zPj=^H00;T`_gHo`Sam+=9%49waM~WUQfL+4N!GtjJT~#5+YOYDjP#VPr2tlu4)me`
z;v;`s0LBMzjf{=Y9eHWAz(q7K0eQG5kp+i`mp7jtG(^Cw$NmY;8(9EjpCR$1%6$L+
zJx|ZGe+X##pvHNvkkZm}feIfM_P41n7kHtRDi@0V+yPKRnt^+R4*Ax=Xto>%0Pz&2
zkY)qzw&ab={=q?_JGg`VB@l-H(*>wlkC&M;0cR8tU!cJSQ_zq$M}gk-D?NazbSUq-
z7|HUb9N%2~t@fp;DCY;|7urHMX`n#mrkE+^`}Hp@=M>1Ov4vd_QePy!)s^#Iz`Hk5
z0`(j4hJOAR$-)H2FmYTkMf#|e%<S&23UH~Baz0ZWlZ=T085m@I0vYk`kx|{--XwOF
z?<j75b$~SC;01RPZuL{07nzKe{p|z8Mn5nDrgI6a8sIil^60&ttM_1WK{U3>xPq=C
zQP|;C{%lzIZSv7tKb6abbq37f`7;jAzX+nqO5lop==O$(wjUSRW*&K8Z;lo2eTMPv
zDcyh`-Fp!FBXHQUaXR4&42||K00Ke=1t=@c4kx?KOrHj44k67x2g?nC;9lav2pa!k
zu<U(Z3WTkP3NnFLXAOZU<cRm+ZbZ=PUsttBK=HZF*_&@THC}-Eoi;Rqu9X;AvhVC&
zfG*}BJ}OEs>K>~rKqPHa0j?A1&=P?{nXSZ{zT$aQvn}@No<5B%MF~N!J9p@}xxPC;
z?5s&r3~8SH>r`%voR0H9r~Xe@t-Zq5eEQFg%>TOazfMJ={n^^$wkbJR0zLJ0h`=(w
zSW2t9vvqlrAq|qegun|tF=MVzw$Se1Phn)_{@<?JUVViv0iO78H~#mjsGN<BjmV*l
zhDF5zr%ftmR2k?Ns6cr!v(DD87MSY&=b`_4!oN;=M!&+AtpDes|2hSd_OGk{Ew%sq
zsUTwL66qvzD&ebXFuWP~*_gh6YZ8(YtUl6b#$Nl+1OM}{|LYW-(}3o0g24m-b!w`Y
zH*&UU(&fz8_jZ@p<O&^?3CRnf7>&Arda_e=b}Z_$F!DltKaB$I^lbB}Y<Q&Tqp~@B
zExoHoX7fAKkN?WdTU_XanakRT*{ArRi!K-V?<bKdJgWGgUJs<HxP{E{pM?BpW}2~!
z;vm{_lX-RM+m+&;Y^;x0oJQ+Poh7%b?_we$-QUmK-B!-I^WlC0GMM?Zr4Kly72bZA
zP!^_*=+?;O!eaD5M=`Ganc+uD_=o{|dKbjK_mPzE)wNv$#_kANtetUE%jpv^0_tS_
z-xK&>S@Ewl|5u`F|LrwQ$Go{d7fEF#5!1Vuao#l)bil}*M=7B~yQiAmFk-jc#a2yV
zK5vgGZ|YoMQSk?g!0W8SKMrRtEeXpcKQhLo#a8!uzR+oMOYXG;QRxmE%AtDwi<s^h
z-R*eMznZb0(8WZ0!`1J(=1j8_zUsXEe)5Cn%SnGTCeIj*z1|&?G+)#1o?qcUzf<qD
zDdBnx2RocGNI|d2*@<^Mue&w&_ie-`N*3Og8=fAZ&b5CRKfcpcqg$@F@_<ps;<5j`
zt>99<T4$E4viYU=exA2%k7jXNQFHvr>5FCQ)}5PBC0F5wcd$PfxbBZTO8hWY`aA@i
z-w`$tuiR%)k=+9fCj{R!S-#f)sxSXt?EmZ3|DjfGuLe@s2Os<xG8ML$4!XIgtDDfV
z%Bys6aE+f#SN<XX=x%yMZ99uZ?Re$)7S`oQjv9|TFFX)FM}PSHL_bGOmYG;OZYkGo
zQwCoy#ebXfBF)tPT^poIHo!1KR^M0C-7qOY(&X>P#H#YMqy1x<+nZreqz~fjJ2+DY
zWkxqyG<~Gdk5JLQh5PBsq>eL<q<?WzU`pq@vqW}*Al5AJBAKH99Lf;U<U?&A`b*)X
z){V#SGEEW}levQE@0e2Umf2O+#M=)TAIz-rM3jtt4eG`h;x=R?#;p_eFU^*}Y^@8t
zL}QyQi=IUp3$LHHHpRr(kuAx0b3}CyXD%X9&hW<vElHPJ9457Vj52jV+?8wvnm}L`
zTuktPsQCX&ZT;I~{MS{xTPNMF9rxMLeE3Y334xq<@Xt#7rKr#G3E_{Ae<Biw<wt^!
zu^Rn+adtK`zXoJ2bz+#t&O67lPdZh|&f~dc8Yx_F{<xY(cw7wKzH|u|tuB5gMC`fU
zZr<qkAb#eFD^fhusC6%GEz|u&%jF-uKVEuaN@!3$w;_DKtnfVN({XZAHYslZj?er|
zkgiYD5O}}=UNlLTh56}4-Q^!F7lhR<f-atRs(2#-hnUIIsg|uyVL^DV6F0!mE4w*`
zP#>Q%Z|{uy*OnslHbNUgKhvnL-3YxVdFepVkra9AmUT#5ORunjWUS=&*GO>`J~-=D
z0Gl`uRb&(Xf3=~W7XML?15bJGrAQ2Pb`zuK7hsX&H~L~*-o(HHIj?62D^vTSNcJ1;
zSmzhSWec#bBuxy}c^8G-)KkrjQJR{O1oJWxs-{zumCkEsp{$Z2xl`sI%#!ttuN?c*
zeaX8Cy2F|Gew$>w2D|&5U$AbEZ?yAVU?IlNYorU+Nyj~;@^P!6aVK_qg}k6mh~P-K
z)GMVzjh|YZ`MJrEzoaEpIQXp4Dgh^OGQ{FTjGX(C$4ju(E}@DUaedEX<If4yxW+0t
zeigr}qkLN8a<H_fM$RFQnSl3t-eIz9%r*h{Z7uxUtw_ip2Av-g1bkW2tqehys43S^
z@orQpwDGN%qMn&qMv)gUy+;~3lX?DMN*qN_;?!_fv+Ua_iRd*Qx%gabw>F78d!`YV
z9m*_-)${FXd^?Sukc<d9`p1ff?2D^t`pGqy)x3LOEXpeGemWF+*a8b%KYZ?QILzO_
z=_1n&BhmJpcjau-R!QD*Bbf2T;=>hzeZIj-p+9%~-9x6qC{wVbQBkKPPK`C+nb)n6
zEm3PLAJ&->BYTA#j<4IQf{xq_4=|(l#5v8I)8YwwrQ;w?eOu*CY4+0Eg{s?`l<pw`
zc|}751_nOQ;|lzS@`i?n?p?QHa7wbG9Lp+T4{_=&W+Zw`b8gcGojkf?+=aXe^*e!1
zieGN8-2M@cw(fnWo4jfw4U0n^N50pR?u<4sSrz#sbQ<b3!-lHQVop*~kP5iM6-{{5
znHIOPzrSSZm@%H78WVA1OlP^&x+SzjI-$N3!%^*gzt(2|bi)JM{HtRR>CjQ2WHE-{
zKDx>?@+m{!*6VJ@2+co7o{F9}g>ae-(u`@&|LI6GQut|Ps<+ERT2^!0)}67&1g3=+
zel^m@JWsY4rg0DI_cK%dRK6+15BCx*!2QQos1C2A6~2rjd&o_-`m_s9V+(NLUQd-M
zD>B8p3!qL-zHgX_&gq`Ff5_0cGhABOQ?WPWv-f*&fM-dbq0?b`@M~EBcSJ?Ik$Bwl
zsQy-a%+g>lTrWX&ce<*uk|hR-#pUNLUEl;qMSk>RNgu|%C@#|!NfKln^%FQo_&;1&
zuvFkv7lE1TIzkgk(oLu(@&t1QCBuid$^UhPj71Kp=Lkx$NK|R-(SkSrCkq}lx`ioy
z%8Z{(o`YVTba@C!j`$r>K(d7VOU2P{s;CN^ea@+kp@apemjXr_Y7A|w59B{(5WTUN
ze<J0NqE@OcdlESm;JS67UA1(;ieJ2MF%}axg=+iX^HkCH$-ia%e}4jSG)<#5xw;Ae
z`)NECdDMpA4gF_g!3!W`snv$=i9k~CrJFqLD4>e?pZ@Q^UkMpI^zQH5R%!p=j{cWi
z!AfUTiBjXc2MUJ*c=X>A@E?izx3ch`=?3NF-;X**k%%V0(2^MTwmcJzFR*jj%!W&Y
zu?Elev_@)UTOanx;ntg?gs=6G20vO8hAX>i+aP<WhW)3d`2bD8Z+pJ;%Va;uMmp<M
zMs1H@eOD&78>I*G=l}ghNA?kogt9X}oNi~M5X@0;vFzvk#nQe^Xefkfqd%)mvj9vN
z&7xRs#6El?Z}@t-zIPveVP0wC^UA(_8Y6@%>ymYlEaDV2E1n!FwBDfD?<A#@442+9
zX(W2D$R5G#ceE}H5&1Ny0^RG|H|ZHZAaJv!{FvdWnl&qQQlO{dKg5nbMmA>B<io~<
zBPAB|B0%@q7#TK)bm8`I3y}uf;mn@3ryEq(KDq4#>5N-@(P|0*U*9wJZ&rh%5ceP7
zG*8gN{y%?1#)f@Ds1)z&<Ik2#<EOLv`8EYBB}&=tX@S&qx5jO_tR8!*;ajy<DcQoS
zhxIz5D6uFSmEeB9gp(Z=*7^Qxn{=_;i^1Qtir?qxF+h1MV0SuV((%|Q<ASv}Usdl=
zjqaN?{SVsSG9Zp+?HUabAb4<h_u!J?8l2#+L4!kp!GgQHyCq0)hu{PqB*7s}2n=q6
z+a0oZwteTk_q^x3_Xp5)Pxo|JJ++>-R#jI4B8D&PfB@A=z@gkc^-Q57Q_DCPz$kdy
zLgG`R8N>YBMv^#P?~P6KR};BQqA{p%>kV;S2~0Q}2l-;U`&SSqO=)^_m@!OpDUiov
z{TC<TfR%3rB#X~enoLmu%YzU>ch#W|#3{O%*tx2HE3X3lP0}LvDWc8sEQ@KgTh^Mb
z`2VyC)o}l8&<`=s*_>LvTA&a!<8glG2Ih_j8+Li2h4M2Voh|ES>CBU7vI!3)qGSSJ
zcZ+4|JVy=unp?2<IL~3eqWS(9Ed}B<sKMFpk~vUter%T1Z1`<EhLNE464tP*-5;!4
z&|CPLc)eOg$<UtSmFA!`Tl4XdQH=lmM-M^HFIw7PJCVmPyZTztsGoTqppodz7-W?9
zxNnn@=r@rlTV2QAlK0YDD_ylu#ILZy-4>tk-#<CwBkeoP2zI)jXWq^Df~n?inDp7{
z{>EP08;r1@v+zzonr>Lth>3RMU1<_Jq6bbN4}d)jqU{F-I2zuLXMbyqe+8C*w&LH~
zv$$d`mciu<B?#eaMrlV+2$IiH+>}ajj(jo9)#_64%7{{aoIECAS&Klm3H9bPP3~lE
z!*prrecL(1_cSCJ?y+h)izP2SW5L)an@1LVZQ;aT8+j{btj7W8Z;PkC?@|MNIGeR!
z8gSTdxI!n|L37z09aPiZTsV8F?F<s;+<?Rl%oj*X>wB39;xKtAAtZB^qg|mB27A`w
zQ~Bn{Jn`^`8&{Oc#9A%9_BdQ8)Yo?z?)`AOJN1q17B`f;DatwmZFArBWNw4sc@v3j
z>R5s}_0z51plaPF)(a3c%hg|G{a5J7DbyX^;SxXJA+#^#{qD=OSE0=!p@*ZDFdj)8
zv*N++2SnMdB|O`h)!q}W>UaT9{n0sRR4=V4vE;WdPY*X}r(Uxtm#oK%lr)Ov3M@Ka
zuA|c^C!kdi(UiI}L`t~l%1<MEyoE#JYW*C!ZreiF-5uFf<7V%tzRRI(7<UJnd`Y8}
zjx~57TsR8|N9A~P6cMH5rt7)ohd(*3Ik3FQH`)Bko|~{HeiTBPKtCLq*~HfSWfGo!
z^@a2TDs&RKI|-I;LsB!X{qAssuI`1Z3hwWX{m9=q?9>R>{9A<LXH=uwtOc6}OU`#9
z{yUhr0)X0c?gODyW;+OvFVmRiTWiJa_w`z`7jJcV-6LDOeC@TJ^!!mN!kN4u?h<<U
zsZnBcoq?&qY$V=b$LTBttZ)oVf9}v*`(^Q|XvvR*d(<|~>bOuYMe8y0(8lVXy}>((
zaE{q>Ps^Oou`aj+0&BP;eU=e;6om@B-!dCDXvqGG<oCHJdxW0DYXuA7ox0NNIq&r2
zXxTPR%=!o^eSuon;(S}G+40(+q~`T~;}`8#i&Ab4r~Ip04co(@ub3t7)|;-Vx;_bB
z4z+U-D(e4z<LSvX^az?{B+FVr)xx*b_c7%Zz0dRl`gEIcwz9M9JS~&QaV?Wb!gMm-
z<1cD->!$`_yhkkUu>z!&tz=^61KxxLjyfoOuo+70g;UObVLEMAvn3_{24M1kX6oPb
z^Iy~d&lLZY2tc<?xP>N9j&Gm$dSp!)fpBTLv)7P*=4u0iq+P@IgeKxz?smU^$dgIp
z)6a#6v)eUWx2^vTCHYB?9v<QMdj!-$8Nvfq`Hcp6AQ!GdFTL>JU;2SR+`o$@?+XUU
zb9LaeD@=Di6TG)H@(yLsy}Z9yJov2Eo`0YuG@G6spcsp*^FQYVv+otXQ-5W6e-a~x
zI<F(9M~Pm%qT4u(aopBS7Z5!HL0EZ7ZK9Rw=cUgaFHJhO43<JJkSa__+0j9L@{fsk
z9;dbM4Bt;fa*X9hBEpFIXzhh~qQ{|(63UpEYfY!AYqo-a=aPSZ)356M2g&*i3H=N)
zG#+~gNNc^NGVCa_W`}#$6iIJ?f%t8=<wLXAEo@Bg3--YYob##YE>|o$OKtw8^}F$A
z^opCeLlmiJ*6%K#D~qBko`F8YkqEj5HNI{i19Gu!fn!K#$B+*0SeN{cQA5wk6H}Q;
zgk7KT?Pn?|kBazi!;&p`#C+eZ9;O^36Y&jr&c_A<#(%Fx1n&{2#&bx(WC{Dcr2C9Q
z9|M}ZwDq_dGIvg$$mvOxX>x)<q_SFk@h#EGKkbFqXCpR!ydOf!5*jNRyz=_53*ng%
z2bDZRW`GB^v;YUaNcZBq(2wq{;ladjspJK<u28EFcdy8}iJQ<)0GeXaN)jK<_7s|v
zc0=CbE2}Q|lPzLof7+vFj_0k$KfAkpPTQt1B^$hTnb`7mGy|3$EEG=s*`9a{F81r5
z<Kc``pL{aL^ZOg@Q|F@YEyRhV<9VSX*+dLAys942YS5hDE#rQ!PHco?i0R-#7iD@S
zu|3HxT=~f4)uuz9CLO(kZY$>WHLv*feA^MYMkJz05v{9R&B?0Qyl7YhOV9nr|AKLM
z(jDxoumy_YAddOCbz1<<NB@BY`AgXRAxoaPc-=3MBSl^h?;Iwrg&(Y~T}Fc&FP`)@
zc=p=h4iq+#tI(OfZ7-S7Sz$ymOhk%Mx7y1fKUnRQel=U*A)j05fo%D>-IsQH_9CU&
z>9&P&ufzKkivtTkrF_5q-o*p&bI>LXJ7a@T59FxOICYq;+^)jutftx9l;^5iSZr&b
zk&cfwHWReaHP{r#Y$jMw$RB9<{E@p-W%noC!J}_eZ#|+f4aio!&yHdA4KfmIge61t
zqrcs+V-D0a1b&DG^W-i|eSKwM&OR=+Y-2i+eq!_*U@8K&{Yar!zhzF(m1=(pKGMHy
zJH=4Y`4>|3cPSOr9ZuP=pI}}zVbQ9;*1I_9IHXUWDdX{d368Vaa^j<3BRlV#v>5BQ
zD$tM2RL5~$((2FchC(lb^}mFEUyih8Sg}DT)O!Rf84c!xVSg%`E1)>4KD8UP)dBED
zYFR@3ERjgHH(%<Wcra0CWwS(~hKvkTORJ=Cup^*(dK4Faz*yW1OBe|}KOuSTGE3R(
z9dnKE{>kT)Tm{*}Q+fxH{$f(KXWq+%)&Q;ZQK@B)%%h7b`}#C{Id9Kbn|&vi%8myR
z0IIGRG6uPj*q0~)$2*WwX3oW)!`w%h&k3{=OU+Ik&{0m8ZLe?V{sOD=e@_X2u-$)Z
zJ?)GvTB!IdGe7?ZV&k7%qz<kmt$khXujR0suL)gXb_{9S%fp1(R8YNdM~nUNYE37}
zVUFnRvl@k6OwTbJ(w)|MH<R2OeV;2VFTArrgW7fIDwgj^HxDu=Hsb~C$lzCT>5m{t
z#hsg4DlK1NFQy@@rS1}@nMFexAD)nyEsjj6Go_-ierFG*8d)%IenBEwSB;-gssJMs
z%01_`g~?<wE?K>&Tz<rH+*~A4yWTjY4$L&%;ke6ML3&;-{O<n5Ye-e4s7*$Dsts>^
z#V>$<f{apP(t@A7+W@ccz~}brR5pPI3Dh4+AFXs#qAd~&P3DyUOy*Eo8ujmB_|Nc4
z+CqX|X-{6wCdg2DfuE~EVE8HXTzhRZ9FDL5_Bdw^lrpL9euudNbf-lRf4`D>0B+ej
z;%cXy#z81YRX*Gm=t#9Jf!h8TYBp-AEH8?Gtb*Xvvt&b|v*0sdjh2vQDz7_l*EBc8
z6X@#}3C2?>cJPz0eOB|kLboP$p--W|n>ZR;vQ=v@$tVHXcY54$*Pm~Ev2AiZ-<R+N
zPYnzpAYsuM7hZq<myJa_vF<?|LbE<}B(?nCCHo)Z{aHp1ZO^wpMUzr)#>k@&7?}VE
zEas4=!NARG@iC>)$z9j75p35qRHazXmawNAc$fntxQ}}v$hb@alHqU6sTpL`Icc-9
zvrTMmZC98TYU}C(3k%Kop@T9;T`0RO5fMY#Qy2}~n>~@f^#r3BjpB2^nFF>zhQ5_<
zvB&A_>$^ew?qwpKb*huIGbcNYD|GpUHiatvmQndf(2mh*Hnn0o+!L%%{&0x(BlQle
zE6_7Nj!gGBp|fuBvBNwJh-!=CcdeKyQ>EVHgbHUKc9<k4jqS)wkQaWJJgt`2EPD#(
zy-4A|3W5Jw4E6l!fhBH9Mg7Ge`qL?bNKWlcH<2gMDKZiF)R+wp?}c4TFL!upWdy}v
zpC4pyiti()oWPsv$$|JP^`yOx<Ur@8deS%K$$bt|O;MsRZ|+@B`p@%d&P0|uL4MG`
zw9A~P*K#2DYUrozll!h`S*g$HX^(`!DVW!-2^Yd{BVh+dFK>)oM{fLn^XeY#m<Ra}
z4cZ!LHUD%1z)=srm3(5|&nSnIL2KufpH9|1V-!N^13fGJtWyAWxPA|j-|d6pC8{21
zvye0gfU;J4LzUMLRErp#Jk(rubvnIUZuaW5|B#fwU-%cZ`Q1|b_k89r#rF@&deo&b
zQF~r;VTTN-koJrc)E6EIUFCH6_T8!NpT5WMH~&k^{>_v8Bb5K*Nd39*pJ}3V01}1O
zWn%K~>({Sgq|bSka)s@3dapG8_r~YHHST^HU=c$ZIjSIc#=F!CBl$l{?jh=aLiOJO
z`nQt%6L|h&tNm%a{?%54UM9k?2cq3oG6#|UuM|T5gX{UPnefN08Y*U9A*hk~f7+wZ
z8b8SR4o12I;BYq1j(Qi_QI(Cko6pIGO&7P}=W6enR_eBbe=30AYYD0aes29w<h-aQ
z-k&iM<pzS83%hj+uJ*Vibcm<4h4a2M=M<gh6$!~$flg(tu-J0;+$QQyXy)+`Ze6+=
zuvNy~N}KyIL_wM<r|$Pg`iHIg22e5dX9WFZQO|>mKkJxs3y1+jOZlB|1<tAr<Ph+~
zG;VD{Z$+O9BQ8nWOsqI6KE-CECHh9)u|MVC@S}gocZcoU_YaFh`$><&?OZ?uC+^M$
zsjm!&tgv}pi(<at`D=?b<a)n3&_$kL5bN|gCu_rtji0t@B#Txy_f0)#gT7Ik)8x$6
zPJ7~Y&-RGeJ*PLhckwU*_0{h(>CX!ObL$^f4Rt#;&HI0P^MAKrqeAcrNMO&iF5k^s
zPP$I9dEXpjGT$yKmYi?XVYSr9<sQuiuxSHsIE1dkqUJM!p?9dINjmE<D79ob-l#tz
zOt&U@pO@*EH+#^;K-npJZ=Lz0zR5Br|Mr;ciMKljqkQ;Unz*C$GIv(X{Uf%9(4p6l
z{BXATL#I}~6dW|rF;=>y&T6xd?(F))mH(pp{?vcJYX8r^gnt_cg<BmR4T$!=jd_5^
z8IM!K3u6<2wYNn)rtha>9*LTZ3+%_=c{t5a3ouBdBtMe^drAc|pmSV*wY#F0P0Nv>
z^hUo4n@!~{Tnrhxkd0-wbQ8bBDpqZiLvq#iK|gS~ive^rep_B_@;G0^hJ_oaFvyX!
zTBv87L^YtRrknN(q>#(lVnXY0)@^Y-=E%$u{oC{W+X^T-KT>;YQC}Irmn%Z$ehPCT
zIo*?Pc#@7+a*kkKI|DC_Sm=v~nALub<$pj<t+b5=QS|0bH&jX6f)`qfjmXvvb3iiq
zU>Q8oeES61JFx7l=Mas5Cy(>DPrb9Uar|(GeouPF%)0VlRlhb5Ay?(nV&m*%E)%ig
zTCsYN1Apte_%k#817y2P1|ur|1yIQHPgBFf1s?j}At1sJ7rAerUmp6&Bkk^~p<eIB
zad(7TzWsKwms+c}Q9_Gd^X(JQ<Ed+HZl_1BXld{AjHh`8(Q+gQF3B9oas~(LFb?-`
zWk{AkKB@#n_YF=sJbSzLc3$U)+9&FI+exfzw&m3DgX!x{@N_3_3H$uZ>T{*H#+alA
zEA764O@5Q<QhzJ&U;e@WB7Wqjxe5Sw(m|~+#6q{r2{H49_;|F>=C~gc-9vB3AL{8Z
zTmS3}`In&aca;3+DgUw~<sX^w|IQ5f_sR3$)T<IE&YM<ibCtZ6n}?K{mdWpKY3%{~
z8xBKLJam1)qkTJ%Y3x~;ZNd8Aq4C#K{x7pa9rm|r7j=dd14A6cGG_yC8n_$X>FbLv
zA%F*O@8E>kea4m#>RlK&gpAM7m&^um04LHznSnbla(OK7_Rr45Upe(ZgFg?5eH>c~
zE?{DjcGYF|D%d!?3$AKUCv3ipT!uJTQ=6xiFXf<(ZftL3jR(x-&C#ys*4sd>2OM^P
zBn<B}FzhRAo^b^9JVd=DJFiTSmKHWxyT421Zp>4zo~*MrBkB4POBdaK7#`K2SSZc!
z?ud(^upoJGD}?a&$X}~)-{Wp0aCcdt(ScaM)eGN_n760=`P~Hp1j+g{q|vZ7`Yby0
z+fCr6$Mqd4pusMtZQ?V<YUki*(ys0{Rc3wfLvh=`!Q?O6@JE;Huh9PsVE&cJ1N_;Q
z6LqAp4>ajomHoRfNJxT&xQ6-)Xg~E4x*UPQuzfBSO4A~Rx>u5EU3wK}!E(`Fc@mYN
zu;f<m7<O`*=?V^qFXRMj?Ch_aHT#M<e5`eGUZBA`(?!Q1D|+Sm>?JrGII$XvUu70X
zU^J3;1ZSjUna-!<^YgCaYg+FN^`<4)(u*gp>pZi&F>V>pj?Imaxm(z*ilQ{=Fvb<a
z1TVgmKxNi1g3iBX!q=yehO0JsnmV%TbE;$u4aGm7_Rp>Vh%ltDln#atQGlk}c*v)U
ztU<R()AE{~BCyuFvO|b{bl9GxkdTyUiIL8{E{>y|D6H;@qVC5&9<qLWeK>vjo2f>K
zpx!~z`eD1koXpsf*TQk}@S*KItjZ((#a)BBzDc1RMj{=-01c*YVQX*gezq8jtE}YO
zzW$+XzN0e<is8+V-D!KXucsDWe*}}PP7gB)t^lu7N;b*EYzPyKFEUP!fhEmphW}S!
zmQE(VLWxZHdF6Ta4==;XRqP{uqVJzZ@nj8c%eaL&1V`eSbiS=^g)8I~`o}64IW7As
zGq<-Z#8&!$LWImJ*;AXnVP<)LsxHhX8|&9*tb4bQm~nX5>Rq950C91`ypa*u0~W?M
zx0#_<U}@z~h?k_Y!eqoOvo$4h)!^dgcv2}k)IIA+ZL%T_+=}-+W6dJUk>E=>@*QX|
z{_yRd33LMZUxMC)0Qm(o5MdwWzTWS|MO(53^xc7c{ueHCW;E5pbLIdlp5+U*@l`kK
zM;8<dEP|Z$CF;`C3rb7j6W!HMBgqEcSwk&1{bbZn&axt##3(w(hbaw@TNDRikE@?`
z5J1jx(pRoyb5-Vfko1pJf-09RbRSQjt1#Na;xK9{u#s~aIMvot6qO7Tvk47`rt(?0
zKI@1B#<0M|j(<*KOo_Ei#CBNe_(Jqs>i<VHKJ>W%O+y<`n@MT@jn+eh8d72js^e#S
ziM4qW^cfz(ujHKY&34P>K3WyIF8YT#>#bY(3`KT4Nk?p~^I_}`?tTpn%8ixGZLB98
z>gml%Cc8@-=HdrO>jN;le7wT&lW%1Y#?HsENwtFdmPvwE{7{oZ`DFH58M~@64iqKg
z;HR%~+%=z`&!Zq+M$MWVcSAN-+c{3>aC-B@4^-Z0{oh4lHm0YNvc#uo(y)|gglGBy
z1}{hC=}3!Yl7k`F8CsM9c^no`84Gvs#aA@SagUs^i+e+;`6Lc9$R=q~dLTBqANzxZ
znu_MPo*Cxk{k2cvZ?N}|V*U%*{YnPEv*I;ERRsEv-c?Y_!^t<YiJZNK)c4|F;>iCJ
zQJ@l0K9S3mo1YXahx;C6KVi<FboF0v{U@>T|AAVagJ{R&W|BciUZDOOi1RBe{EEka
z3f%uhIsTFpwM|WYB3GV8|1T`^-_xf*Db+t&QA&yX6~sD;O)W(+_B0jR1<)Twh^<v^
z$RlD_bEn&C+7nilrvi>Z3a&DKR=`Yv(;6U_&x{uZMn(v((*Eb38kMI5dd-d|H;v9{
zYzCd<&|ZaH=q1BL7`)DQp`9*l&}C`*Z<I~_{QB<P!^XVLKsT&?zRztS+Udv8BJ`u>
z6+$s+0YJZh*_2=dQ9LahG)X=E%#|fY=?wr6`bL?CRsYbl(b)bmJ@+v$&d6f?OtQ#+
z(;8pGnyngb7QCHQ%>Q}^^mOQ@Zp}e?gQgGHdbqB(NIF0GkAGOcD$}6@em?^JbD9_)
z`19-ke>?S*d>d-Bm+7}~no33@eJIlm%X!9Rx*&PI(f5RQTSNf|&Sbi9`os_Yii{Rh
z5ktA&L3YM3odMx)w!KTylv%r<vZ5kxhK>;WCP6TCO{{dkF=!ci;UNk^Z~k6WRyK^q
zu*q&Q#BJxR3Dk{6Ju#^DyZ3$Jb2W1_a(lpI`;|rKS?ZqtlR9CHK5x`+64ajEgLgUv
zRu=EfONzS8LyB_ETl?6PtiiS=7$qT7dYn>I@|-$TTuCp%CMD15LZ%csVGJY)W7+bf
zBrM@N35ezBqvBmrU)L7}n&T`GTZP8w*Y`hpnW+*YuPYytufZTOIi-N|`Du8p`Ntwp
zhCm>9lE0N{NsaltqWGe&KD{Yr5N-rHQHC|e7IQiK7IiuO7HhffKw{_XU__sh2*Cuh
zGEzDBm#i=OX1G-XJKci47)${pp}27`a(NQyU&cV+TuJx)@=yf04@H1$4gdIYp5zf$
zt)rqI18%#8rqoC>nN>}}IA6b|lpS0H@CL;uWa^Dnv`Pk%Rc+6*f*WhJmO4uDWW;--
z_n)5Q@P%vfGldqKFeC#hk|K;${G@_awksLPVSdoKX(gfcyR^h}TFCYG1_&m+B9be3
z%RsBboCGpbaq+BCv0-5+f{~)xA3+IyB}5V|Uf$Sl%>P~vnP7-qE?MQcn>DFDfr<IJ
zz}OF;MuA-Z&Z0j({9gCV(tB#Dl)kj%s%lgXE(rz&ANtWJ`Ovw1MP(FHi@bNSA3eH<
zyp$AES4pETdC4$}sYZ*lF{*&{@DU1p<X{2QgrFW04pniJ@zJ2C$gWt(F8L~X)C0jP
zaa>%yK>=Cm9F#a4;=g?s30{DU8hU;h=3n*&3vfx$;()^_a~Vg|32)MSvK}rdJEg#>
zBA!1!`ffr|eCxiYh7j3JQUobjut!-uKL*TfO(2&$fi|jAMh%c>n8ECzaibNY&9Qg^
zq)rk9lOYES7A#sKyIHi#*~qneSDAbw&6X%<JG#|ZoXQR`PEVh=z7G$;W!6mlYwa;Y
zXL3cLjYttqfP76mY{%a){@CbogBOHbQBuHD5b#C4ejEAg%6*+N4{l{^K!aX$fSW#p
z5nhGaeXTJXv#v&sjm}4+$S)rQcq*(k`nT_yv=#feR~faT2Oc)x*FaDFP!gb_Rgr<L
zsa9jd^02eqSfl@aX}<O;5a&Y*{D*Swy{puRy}120{ZcLFbHvXrDlYMFSIYp&+aJer
z9#0EjIsw1u$y|?M5I`)#@+^ZV&FDcl{h9ne8^~lLXMFcPIxJt$X&!Ke`Bkgmy)b8y
zi`YU>`Nu~R4Z+`=0s_epJMM8Il6>6Nb;VCvYjBr7eCgTYBR||<Mx2MgT!l7fbbxag
zQvPkoVIt610+I~$HQV?QU^wJQ4jG8b4vI{5ScA+n^Sf<ul8Ja)+$Gm(R~$%@K(tvj
zi)aFJP~bbbaUdHmK$PIXl~`;@0ey{lafF7`>6MU9S&o1^uER<v^d|2~oq*R3fh&)=
z#W1e+itEGut(*#|rI)~A$qaNLy71t%BZY~=!LR@Vfo$Nnw+4{FxzIZqAWC^?XIV6|
z9qBj0dIms2mC5SmLBPuA>D0q-YfWuu$^E8V{bI5Grc!bw5Z|@D&;jtC5y~lFvh?z4
zAA)IN9*z(j`~({9T20mC?Sl_d_T<EQ4nszdJK|cwq`NS=X0IoAEzktw`us>C3jN!!
zm)hO#jfCn3#SUiC0SR$*1OX+IT&NP%GdAhSFXb(yOJfzwY3-uKoPl@_EvsQ%UZ!z)
zN8XRx8D@ep03E92+3dK1W){z9IyF&z`Z}>ejEJ^d%;cG8*<{Yo@HjfyC=o2n6|dzl
z@@CN*pp*BJ6p%&w>ss9-K^Md}y)FBhIjCsS0bPzj6zibQ1ERd^lUDFu0P^@dT?PXI
zq*pj2A&nC|lh85pKGHCI4gA<9=$-}7iNNf*c^wixh(bCQIV?d*Rg7y+b&ciPxRkMX
zXQ(w#00oZ41sX9pWhemkA~}X{ZZNmBlKI182i0qN=c|u}-00dxGV;#Hj%AY>$(-3M
z#KmHIvM&`p{J16CNH60#6-nmS6+-G?+pVS1W15yWiq-HWulv%Rkz#JxTog+!e1*5p
zwR*?aBu8xtZ`;SZ9z-OwY~F0^*ZOSg^~*3CNSg~wCajVaHg%4oI8K^Y#u@xVsJLX_
zhlqseR}^l6kfHf0Or;-IEeYZA6farKN%WtPN`3qOP$Z6jD-u@Caz`mMNV_`G*|<}@
zg9guZ`janiYWiL{yWt@tCsekC#5yF>k%>=RLU5%QwF+c$``?2B8~!#1Bx_5ZPg^Is
zMF9H^49u@A8l+>8q$blFC%>Dyd9Vz_Y<eH9zXcU3hKRdF=G`KymPN$TM|@#o_&P*(
zX@MuR>^2|AruRmdSCFKgv+$_yJs1@oaE}80u>%rIUPsK9LBdk!FvoH;?aL_;%n3y)
ztM`H2VFw8a!tCu<<hGBT@Y>nO4(i#-6IyA+8n_y)MapAW?ta9#sK}WgB$0)KB*ktD
zwygBXj*Y{cJH!(&37_(LzE~$sCFhyNODLSt)YEv9j8H0un%Y<9oKM86g-FVdBRaK?
zr259p6FIbD9VTJFEDCEsJigJz*Y%;$ZsYzaIugj^0_{_h6a>}1>AZe<C%PWj=p3;9
zhF9Lxg!w^<&R`H~5ZIS4<y?Hah0r9C6aIw*V7Sg(=pZ@7g+oStQ4g=5m`*0DFI?3*
znSp=j^L0SOQX1*ka_qvMc$;H|P=+AHDc1=xbXh}wINirzOJM7H1+zvYFTzc`Uq8Yv
zp)A<ZA%&p7k9zR~i}LiNc&*2eJbVrk$X#z9{eJFwC&ICLY#_H#gsPRTdFw#(8Acc1
zmpCqm7v?0Ia>A*z;9%}Nx9xmsWiJ|6C6rt~&^uWn?(}q+qeNQCZqFaUOJBkwWqd?|
zjg;cs60$1<4G9=`VjAll#Owf@?(>G{f|#8LHhH#=imrFsa0UVWzMvSUy<Ou~3VK16
zp`9z8CBAAp-TeuqMF^wnwLQ;*y8`0N2hJvv^6<Mt7D~|&JACs7t3ObBZF@M9s$?Kf
z43u<hi?;*WKjI;4$UYggmtt5CH~j)FRR;aVH$(nKXP;HBGw9))0Ea}IQQGSKbSwu^
zpk*~`lb9JRNEt8g2e--ZucgdciSUtJN<{~B&xXF`3`<6<JC^@=_oCw@e{668EEQ~Z
zIq-RHj*(oDIN}RlTOG9&k={%Txn_kkaJpCQpbG^6D%m1!To<oTdZ}{SjChOHm+t5m
z*N4J7yCFH%=k#rX4e>o2OOP|1ejJOc!knkM%;GGF#RCrFs|GJ1M<eA=i@W71w1Bvs
z|2=0(Hf@0D^<9PBwShssND{_NJL?VrTUq-vk>S|!$DzAU@$L3>+<uJX3tvJGDotgx
zSviJxt4RRSIsDHJv(D&C_dVBag++UySbTNV_Y0Bv!Qq&X7pp$UfUOe?H(FY2wKc>X
z9^qzdc<()>cd_B_)Y8Ih^d-0HHA_Ol8i))9?JO}scqFUe4G(EPV~nW8n~*xMUnu*Q
z2>Wv6wHTs6fiYUrnNq~XW%lH{jvc@de|c3y>a^QBj$4gsrsWlykko9Qt<<+94n`(2
zm&E=uYf&UV9EUj6@s1O<i$c>cFUlSx3JF0&uPu*W=Kbx=Qy*bMnGZbhLTXKxYTtIS
z^~r@+XQiq|)n>;!H+J-X7_)TefbY8D*7ghWLE&U#ZopFs(&@5HO4Dz+8F>0A2EsFv
zn-tUO`(%_L<FKu(uWbJH4&ExWjTu!AdnEd#*(;HbgN63B+9I{Tf@y`F3?fdX=3)B|
z!OW##J*-y!MTGVH2d3bQa|5_+E4;dRGo;VOb9_1ucQC?JZd?qTDxO84(sTX>Y5gFT
zxY7_XY@Z?2|0Ik2eSvqZ0z+37EN)7PZM646icE_?n`7lx5Nz*B{=9@c;bEUKOTopP
zV=uDx>^SnhK%0UO4BCuyZmlwl`-z07`&z}0^bs0=AQ{(k3eE0U8j%IGX#r^HuXg?Q
zo;w+|qb=!NAE?Tg6+_DU2O8r!qsV21_rcpM*bfdJKmz&MY*K%nMfN}}jM#r2sJMrw
z=m*XKjgE&VRgM2}{9)HuKWNH(U@uU_f*xC$jf5VD9)t4iF07wCoAH4HL6h<hG}k{I
zgQ^dspVBEJi68uM?ELh%bD?VLs`@YC2jv`q-_C_{gj=n@Kq5cbr^B};FEl4D!XDh-
z3d_V^5nBV%S0Hw)gINkmk)93B-txS-4f*}+Cc+++T11lXavnXhmTrg~87_oQZA~ye
zM=vM+8}!~LUUkU<GsUlmTp`J$MGi}aZZ_JpY{9Bvsq45o2Y?B}6_i#vNynyS2a$0b
zh@KcPIS7tiVuvGv#q(>X@vp}SGI+^4ACE~~<ncx1#D;i~2!qi|J*g?lLg72s9&QW<
zfF5~ER|Fq2S>H`L#u0QEG3ZPfwD;Vmi%@nNq0k!a+xyV&Zc~4I%3>o9uwn_wZ7HyI
zh=2=o>FedtC%#Jqc^o#AXp%x9bEn~lvc8{+C4*S>VBGq;%T!)QGmM@N#`)}*@mBH<
zc;j8GKo^R;*sBOoxWuBC=4O^uB)|~RO%<KLiuqV>h73pyr@S7alA_b|$lZ}##PqLv
zF0Ef332N9iA*Ihi#o_?<2dZ7}S~=CQ(s{p$(KX<tk~-FQ&e15iaI{l@noZu&%a8ol
z%(`>%;~PiEm`Daw-<h<J%qcJpjod|!v+=OTdfY^DFpM8IO5K-NaLyQpqD$UswpCK^
zc0>aG0?(?Iqg4z2EQ%b%7>($4cljMFQgEZk0cv@Lw_yQBtBJ*NoYkyykk1HhII70D
zw3Pb8rIH1v>A)j9HNss4U?<n(6-QfZ#OJx<IM&34{R=&1wZ%jT!0%r(BMXN?a?XG*
z;6wdGL(1}ZjwvDo+>r^k6;UX3wq?39MZm3@?t$-Eab8K95aOVe%`yQ8zEs|(R(nCL
zt}`2eJd;yWm3h2tc)^98xL#jHKs=Lvn0&IX^90!wR1w6l#zB`BVBkm}RXq4zd_pO0
zTrR2@<f{G*H%DyG988RYc{3`;-i#K4NxiNU_7NI)v-x6`45R67`T0Do5)*-pOYm1i
z*1hH0X!wu-hB<hi(tBf<t3{k!kymAfU4h~X{_K!ZNm;WC_*Z!-Hc>E?iqD=D$P>YL
z#7V1DsMQdezToN>W2d_PC>DE`s6%O>Ql~0tZnaN`0pQ+C!9;hHGX={mq*|?}iA@VC
z52Ix!je{Z0^m}?#7nAKxtg2;>-hI`283D<RU^F3ZGRC^O!XtQ0NT1FTdYR61M$^sl
zu&<lClXpPHw?|oGJIcNr(G@M<duj}5b-Rf7M6#{#kECMZG}byRco9}kgXGVe9rrbY
zH>U5TugA4BM6O;Mn2#kqC2Vb-?4&5U%+ocaH{aipzJ}S;k}SpbjH@uWaP^(VqbAo1
zE&RZPJo<rkVgs$vM`l-|_hvbs!v_l|-AG>ez`YX{G#DF561Zf3h;4ZiGUd<_Wr<vL
zpb>KSq257t?j#))QFN&fyh^tABSdANfw+ltHjzMx-vmj2=cLftQn0%1iR{Vc+hhL;
zRU*v4LDf}FU=F#3TG<XaqsWvxW5`<Wb^gJzsUuT7_Hyo7pDUBD)Y^idp3WRyOfUou
z<&(=>TJ@bAl&#}e95$~5w|De{vL~672?Pc`Ue(C?$I0cJlz#X$Da<zIxha#agR9~W
zKw4)=B0yqZmuO<n8A=o)16jNb98Mf57!MM6R3b(U-)d+>aP27@bc^pw;{g>piOzG-
zs#;1T;Z)g0g2NLEjt8#PhhBa2ItcE0{YKSMla)z!apWUk1Z-B55yIRoo+ZYDDY!Rd
zNOcr}S8A#dRAgEvQ1=XZMgg99liSL*7!$XGwS3MlqIFM=TC?CnR&5bCnGRPvx?d`e
zH4@Dk{evVtb8y#Fr;q~77l7grpGt2CQfA>n^sytOMdb0KjftqJ+d89NEEUQ!bRH%s
zM0cH<AqY8%7V#}W#-cpZx$>?PSHObw<RE${$r0vdbNo@pJ_Tfx23<jlMm?vi><F%P
z5a7k6R2}nnqaxhS0<FXZ7^<?U+T9AfI-XrQnayNs!qV!s^{|!m*WshQZAqX~N}6M+
ztKy)GfTP(~xUihoIfN-?>h2bXVY-<NYMh?*rfY`_?$^X2Q|qa66^0;fiynlR_#KMp
z%ayB|6yk^IS3W5vQL^&*61ve4xO((THiZ|a_M9auqb{QG3SvrUfg>~K`TCnnyYL=L
zCGg;lb)RDPlYU;WDc^N7L2S0O<Wi0Jat|i;h1Ey5_DK>M3UAANq$|u?l^h=3k{-4b
z1%H)v+)_vN2@q1P58z4oIuvN%U4Ibd2sEqFzOVQ#ac;?=0j3#a6g(GTrAA8L*`6<?
zk<1}!EbYZFd?3N~0*wZ5vGnzo8V;G7MZa>%7y{C_+DGif3@ld#)=$1s(SYwb$AQSv
zi&fQ7fluSa9A-`zWOD`4LHsm<@}~-A+?7lKVH;&B2QPJZW!TJZ_-70sBVR<)BWpTI
zE9<*+$43lB@L*Bv^cFy(uS}yD6w0k|Eg4!_#-Iy?ex3yD%4e*=^zOG(n+eOz@Gn3M
z72RMK@122(mg^I%z)7)am4Xtqg6H%Syvmm5<;i$DHYHNLvGq`R4-B&A?B@H38{AiN
z_~yrB+qQbETk)(fwjpBb&1W5&=v$l%1!v_U>O;ITp=h4QiNj>k`<|KO>%rUupD-F!
zKZ<h}SsOg*2-waSH+w$!WjN*x#t@8%4#3=!*>4pHEErDXYKSXW0dNaW!mE*cQtJuR
zFW~D=2~TP5^L?-Or1HslJTzDI0-=330;zhjaBFTU4F3yqc>6F=7_XbKBd*cWMLu9o
zfa}wyzHQX?5@DhB>ih4BMByZRadow<Ac2K~jr{=v+$GFFwy%=Bo6WMir3?su_K|?)
zDN1S3dRg-loJ8P)N#Dpo*#ZZeX`d46c}Mi?IBd&a=wz*25G6NrwsfNMh*IevW2cPX
zjmehV(vx>8g~@OQrL_{#m2S@{n&A=JkHl|%w=nry(3Z}4`y8QF0^gw+k|%>&;#0g+
zMI~#n0J9ZYD!E?+GJeT5zvubLu5B<q!Ew|glIi-z<iX3=%^NSn6Ns0ra|C~Kanswn
z-`N1U0C?;PB-o2uhJS`dF~1yN_v~{}Qt^q|Cod<u2^<Jr*P8(S7$jAzf>ah$MX_p(
z0Ym4|Y>k4jKtoxrC{JaWeF-hyYWjgr>(G@!p>G2GhzWENR47G3$;Sovp={2dpsOk_
zT8L67os5U*+6t)@J2}%-<d6pj_%MER`y}gWQ9!+*=9K)*pITSghBZ>tiLUx!jdKW`
zLP}aSBN@|kR;HM*j8jPsN1U(SAo<ajy>&Qz_UZD>LdL9Za5tr}vnUd@G#+>KDWwCq
z3Nb>4_A^QX8hRIAIF=<5XOpX`W-$v4-x<<FGoIhkc{nkrg<_Px8dJf&j2hTwPZMW3
zuwxCs=ONvp2G)dqqObabJ=>sEsx6`x^kV+UJPxR2%9nHhrToQ>CYmBI@2A72<!9d{
zg}4`IvwTm4){U9Xa<20FO9a99wUIA|C|jYgUGPPDE#hUnHy7?NAs-qVp!nQ82fEf&
zKkeR|G&4e*$<#wfYw|SyW;<CtKl4M!)twA`4!vW1M!F;TwW>Q(Z~}cLm~YkJ_j-eE
z0(k-d#vV{`d51ti)g}^ZFw4{`f`I|?KfvUh$<e}cOVJX&_EKa3HWb|U)~}*^tKz%O
zrpRPoNB`)=0@yL{iS+ildAdPS?X8#%X~wkciLgZ4cub`Ic=URAf|!x3=f*>)#GQ`Q
z1JcA##rj6CutYG!@ur5_E*B6$YRIKYt3pO!*A?{c+1KurFlY|0*n|amVt3Oel5%Ru
zg+}#f$F)cUilV5-!R6iBx<lRCwXs#$0BMKa!jK_7Dh^PIqJLEK6jhxbQPH?L++vTw
znpY*qQsyGHZw8I5kuaM6$YL*@s=oQYdJM7%vX4V%zOEj9pIp{c>tVs}h63ze11t)$
z0f?1zrzbca$^VJN9{#4(O|z5g8%3c@ee{8Vuj=}IqUBeOVaYQ@*2B+LC|uu3@DkHZ
zq@%B-wr`18Y`5x^7E`~;;w<<c3METbW5nW8WrOeP!^l|aYEfBaR#VnS9|zOSzTZ+g
ze+7qn=q`Z{$hG&fRei&OTX|)g9GC-~cnY}?2CO+$KO+zZ`xJ8`&&t9tLXhI$>$16C
z0@ZVF@n)Oe=lv9P75BQosTqh1>VWuA9p*+sa!>Y;vdn_E5^ZVJ1<u~3Jq2{2c)k*D
zg(>0DlJ-ZXJbub?eTCp=(m;Zt;F3sxD#>nSBhM7^C6Q6?pmuPHHG}q6jdhv_2RMkJ
zEV!gsy`Bg~Q!Rf%GpB}_5h3~`gKlV#YlwK(WSr#{xP=67Mdf1#Y%W2bRCKE~5vMOs
zM&TWWB~4`lwgH@?lx=eW4^4%!#_UEgZUqU13Jb9#mmOSwJ5bL)dGqwURl`p<(}ew-
zyt-u(Q#Se-0xx9HZNsGN2EP;Q+v|#XOjIDQNUYtj@Gju{NP(848Y(I#{0AmY#RuD(
z2M>DLyBL1(ZH3r`E8We=V#3cfwyN}7x%7!0SfT<p0(c~s4E+xZ&mF+INPs}AT;dRT
zq79R$c3Ms2MkfxBg`Cd3@T`Qw^x|($#2iq)$KVJrGtRRepga-=YdYO2n4n0C(%yiI
zfNCP*UJ8hU*`)h)_F$5e(&qlbGp(Vb|0NyIq0h3Hjs#V+L3dqZ4tNM=1Iq)lnUswz
zjjZ80{FM4Tsgn1WzG)}Pi}x~tWB`*ZOCxoMt;Zj<k5q1&EYjqrA=irQ0XYPfZ$HI5
z%UY4*Ix%gC9Vk;>5T0k=Q-Q;uZU)zW!Lqt1mnK=jFPdANS=!UVhA=FlJt;$;U2?Lz
zY-VV9&vZ4}_#mF4BT|18jGc>lp)hHXTH=u9tsvDq^*67|i&(Y$8$5FX#(jb41Xn<O
zY}kIQ%zJNOBA*&Y0c>)Fp=w%;?<zXnKKJ0eLAx>n9{fshkkes*nJCjM5ojS`!&P}(
z`5T@S<!=fdI6|KEqX?1l41A(s(mWDD{`wR^4o!@2+t^yKy)q@BLi<1%yzCHBzh&0L
zB*#?GKZz(0)~b2h%fVhozuoYXInr^51)c*kO)*+>Yl4no($n$P3dn__k22reVB%Xp
z_XR;MK+*EvV)BNNeIeg85i+FS#o&F;D|tzzB&*f-^fm@iaDT-qn=690gwHn+_uWmk
zhg#@Ws+-g)?F!`jtT(7_Otnz&Z4omlC?V0-Ok32QaJ$53AGR8^CGNefZnJ|!IAfkq
zIKfE;ZH6KnYARLZ$B`UZwq)mmHC}eqdz$gl^nje^0k?}nx<jHwd~1}VyaN^iecSbr
zb9-I3IjxlpN&Ou`us2V0O0CotI_)I;$3oAfF?0g#8HCO@rh<1eMEtn2;iGmZy_-dR
z@B$05R^&v{npT`bd?e0`g}bm<LfMrOrovmsMl)paA<1H?_+wkdxYTx2ci3|Ttb9q5
zRojiS>C{NO$0gG9=|8?*t1mrX#yRU52R94=y^`Z!MSUdhM~^<>F1}YnS-|K|@31)Z
z(j-R1TNew#Vq8;M!n>5lm)N;>n>0c-rwLfuu^CFBXS>Dto)6i!Ilh|RpB<rWdhUZ*
zOrmmX?1mh9y0uvB16H%+o{z&wUw%cUA*P2zr1gZA>}!E%$!#hAcHYs=sN--pPH;)8
z=m!*9)tN!e^5YWGs+E>Wuzwq>J+uW@<ZAtnPaOyyEjYUw5Z9F8FdsBNCITrAJ9GfI
zGERdFl2fDEZo00lVt=QGpiF(se4u#2)@~3%Qh)s$KLOYF=6IKjJbL^0Y$53fb^xXR
z4_kCQLggwvp+b;P^-W`O&y8TU`(4E|^|Gzg_X%);$jh;OqUR&5&k}lan^hq|>L2ke
zHMpR!Z0}6EP2b^htiQl*->AdR7mLk_?AAdbVU0Am{@%Ml34<ljFSFzU8ko`yi)TO=
zDz$#=gxMvFz}+#efIdZqtj9qx!oXoH4>o3DHE-g~on#ApxkGn88k*zJogFbr$-O*t
zJIei{9T@;8o&n@5ZOvDGg6eJ&AZ{4e)UudPz}rcQTLto@zACXM^mKqaOZVEq5mB)T
zCV}k=hj3L4L9+`|ql>*Ve+9ztBdg-h=f{w1!UzHK);!ZO9Bx*oDRuT3bi|DO<)v32
z8%ij!m~p+8TnAt1+FyOg8%meSdRZ%83z}c6tK<L}Y}1?v+9$eD3Mw|$Mnrr2ECWyD
z@R<PoL$50<OsN9#?as^iw%sOZO8b?P;f3G;lU}F6df(NZ(|hDIhJE@Rd^l+GUQcmX
z$eP$uG>~>o+PUc9yfJ!;*5qM^x`&Yn7MV%zQBeR)qzh^$n>eE@+SV03M!v)oFEoe-
zH@y*boVqtA?2E7nwxV?|m@SQgq(3jXy?GHPQ;qqB4M|S1I_fOcrr_*bh3wP76^8`#
zGS7NOyE>j1t(oFA$r>c<U_+A1*tXtE10n%d-3S~jkHDV!!fi)IQd|zw>B7Bf-g=|A
zpFZu_GXN={GmSIF+QWcSkV4>S>K!0mhGdL==fwSZXw@E2)t}U3ER^IB_sagc*d%vZ
zO$}_uy$%t)ZLug0N2R)Sz4umh_d!p9VT<CINmpOGz8E6-a-t3C>!#E4FC3FL21?q4
z1?Tpe1pOPhGT%FB<C-i?TYTCyFUwEMWLDpj&Jcsc2#&d=Wv*fbRPJRNlMdFx_)T>|
zK@2XyXx&QPkXyO}pHL_SpHlx0#J**DGX8eRxV1lQo>N#<lsOwhXprI>Oe~6IW#MD%
z7{OyD0nRt94mg!rSR7^<DRmKeaEuYJC8wwNe&`@Ov3JCme(2$49CL9KJ;Ec5f7Z!p
zrPCi4gCphq>0E~|s$HAZx}O`aaV2=tTEcn`XqLI;$@th!s!c$km(}bwF51_#Bl9Cm
z10nJ&c(<a0#tss<y4$SXFuCdPTEl^zV%wuZ7&f!YY_ns66`b(gPLaWy1pb<b%Q{%;
z&iyhFf|BcVsc<}8B&f@B9I}8jqw9kS0ZapY*pmVi&0KYbh2>aqEO8`{7I1FKwPY}3
zal!}}Z#pEy5i(zttGF2{dVUqliY9=Jlg>v*<Y8jW>%9&#*w#LF(bka?(=RnI`&dcj
z<AnxI=h$KsQbDz4vT;n938i)U-*TV4B-v9b(t~#um=5+m0T~Y%N3F2$U(4PHrq#r;
zm^l{>zv-b1zaZD6)MyySsR%I(c>)k%d@&#wkkRI2y$q8^HkE5wP2Tznh~3rJw^Gaq
z?NTAX<#05!rYW{QLfMeaP3^EI+Iz0`;)jFq`)KNgm3^gawM|DcWfIZ!i}!?b8nR4H
zmbkP`AR6U&I4ygs9<sC$?<N0$B!1Z`G_xFTQGanH#je~kRZKp3R;^D+v;*qW)th@i
z2oKo<4D;9r+HK#p<BV1m^vfi7C|U_j`zO>`g=(7B4Fk>eDk*$gdCL~3aUi?4_~N<7
z987k4sO<*ugjhgZx~SL)L}Jy$Hz9!AY)tl&3)1NwnyA1&HeT6-MB-@W+2VWSIkahN
zWB^DZ=Yah3$2l&u7SYAUbf@@rWOMFH-cyVumh7-bQZ&y}jh;`j`#2EL<OxGqHV`5b
zk-*RKo}^rA_1WHYoZ~C_ui|T0FW1}W7(vw5c(ycSZ=z|oKpC(CKBYfmXY=l}ple>3
z>b~K_ufJ3Y70*U&6=n&B2=q68F91dy<E+@+NB<+(lk)iDsmAKB72|lgaBC(jRZVnI
zm_$QODOqQ&O%40-g5x8x7lgpklQK)j#1qIISq8u(O$V0ZX6~J2jAM&vsbFWSnWa^9
zt}<;>w?@I;SK*(q@ue)e^A2Y*xI`MHwunBj?^sxA=6u}^B&=?aUtvV3012wDF-IKa
z94_ikkwA_M9ULtIe#;!jmQH=)a#D3NFsSz|_On3b<QI~Z__&@Wv+;0BsGaKw^lc1b
zDRgKVt5#yu3t~&UYa`I4Qw+pHyA~KR71X)ZKlJ$$k>U`$M&7Q{(z#V3e$`l9&R`dw
zVx}NAG5(x<TWKgj8<LTJog{9g`YA$8r%ZOwvkH}jaZdVWIu@B_N4b@KAZG3hmAo_t
zS+jhwwEKdl8LGDyTuTIf(xS2sA73j1Z@$9<F<R*Jk=d}6L6~T=FNF?~fh!_YZqvi)
ziZO3fEz8_S#!Ft)uO3QoBteLqUP_Ieb<0Hvk1&EJJeFg7mK+zLn)Jsyp%5knL?>41
zlWm=e`B*4}E^sB}m8|%*Inc`l8StIWivmqC651_hdk!$Z8LT2WuOg=NJ(jvBR-807
z#4M7N?q+bJni2S#;(NbL(P|%a3B)v8aUYnA-2-lB;1el+jx?tVnx_w)?Qg_UY17V{
z+@YD6(Qu$PoJO|RO)62I3{TmKnsgw_5Au4IL54do(>i?zq=Q7|NMwuGvu6aZup$GF
zws<6g&%Y^NzhXwc+zs@H8GFV(huA^>RU$I`bzEK8)@b=okQ{`#^zxn>9M0u?OV&y$
z@zzGB0+c^j``)?5gu7#L>y_*e0yNDdskD<%-(tUvSwc*y4j^)eC)KE_qxFW6pt6r2
z1aJ9>o|2Vq+g?S*jGd^VP}zf5p7>ZBZQ*Ip;yjUf@p^U)n5V_V0(Q&K+sq1l0Bh!7
z-7L`f4PRLV2Y&hXv>%znz@ThsOCG+A9KP|6z^{QVYp=XaekTka!z+IxOFT?@M=G2Y
zC7cASXF#DA5*|Mz03Q);ExLHp3wFVQys_@EdV455nS-px(P~UTW1X$rS>=-GtS)}u
zQ&f5yKkgr3NFr0;ykfY*RqfCWm5x%|0m6$B6ucc>7d$5>qIp{jg{rYTRPww`hp*;(
zuCw@<W^udO(TCsIGf3oEKTBZ`TzTSz@I8?)LJQlUneLdiLSkBX#P%dab#lQ|LYSsV
zg|I_g+VyTdQ1d%yMh_e2A}@3x<45rdNcklAE%m&R8czA1){o!@Z8{57nvb!Fwusog
z<6mWWv!2WYl1rfLI|r^r=FuY*hlMPCADQI)5_U&yXw^WKX?;s_c32{w4vo}j1oD6@
z1D#^Y?}5uyr~ueW4bO!@JO&M6c+<2A3zUMsaJWrfTHw8t5wf?$vs)9F^&#ngzc<K$
zHXk&x2@HdQ*NI{it-g#=*DNKcgYUl3z6M5WQ7{99w8W~>N%|YHi^X^JsKA#!V~Z(<
z><GxLR^r#P4ybMG{ynq_6q+|_VX2%j2_^DDl8hiq-w2#C{w|n)736pI%BcK0q%9}9
z)D|}cVV0?nUQX#ys~$JYrVXQinT=q}!Fd$!doA}l55K_?9dg5fV1`*Qy%P*?Y)MW$
zX_d3ZB@^t%Mn5yZDdn$}wPqWvyR5Lxt@efODb#!T<i^JzS?7)f%D?e-h`Ini($ITO
zm9L1}Cr5(FYhA7=i;HoDH7GNn*$=$UZZ>J{C+x8O5!aW|h)D}iq;D;I?@tGb#&obP
z^wy)NQ83?!5tS_V86M|C(G|vnQQ{+zr-pcH63!p@mF)FP`u|A&p>x!EDB1C{N;Zo|
zumE_+a$l-iNRi_6DoI}_rnA2lVmIq=Nv;NrRAq$I?czi1xTampQfv?9XQ(eCfhz4C
z`kx~waT#y<4fsNh#}SQ^-0^1_C+nHufot0Gka;~~PZXUIYfzNoVp|8tau-MKkEb%z
z->Doh_#o};foEMBlI11v-)ctT0*xZY=teCecS^vMY7EQ4w0eCkbsbg2j{PR-YQ?KO
z{7~d6ZBGN>uBZ>BeKi3#iyd$)HqGcE70reW0T1!cMT_epMsdfI5lj+x#9IZj5u;E!
zy#d4?*{Qgi!n@{CEqN&!&e4a%LglflMJ1x$2YB7Gs?5`qY5Ky0AL`a~^FV+#$v2<r
z$j*)pg2Mn<eGVrCY6Q-DrboFa`&PB(49Gmg0mvwF`Mq3f@iu~m(B50Wt$SjKLfIlS
zYX5FrR|^`TvZda;dGT40p7a>G_#&!^?jCB(zA<vpt%S^Smh_3mG-MvKn)P0KxyUGv
zf04dtO?`o0p-BtOoEzHK0Sg#X73i<TpJ}K}WXSO5*rwYf21T9Y=o(U>Cq<RsQoUJM
z#N76_Uasm(ZPI!gSQ}M*>kK<aOn*jv0)xe~y&)UMmPcwu&gtgPOIc-&Yfx-0us}ZZ
zNE$@(`N=|cUngyqSMqFYh~zU}J6WzPI>p&f=*TtAv4&5?@+VwbSt<huju$kiDWox1
z4fEOeWZ>2tstR`M<{T8RW5B~(p&`z#OV#30*XZzVajo_CLgKqJ8_@1sUZ3k6$k;R|
zWyvl5o33!H)t^JZ!hUyY4|u@gruEC~-m>wOgvYMs62Tx*0rPfn0Pl^0Ptu1y)V8Q{
zl`?rL$crzi#qCo)jm~dfJ698tbvcMEF(A+N5r6Cy2l_OcJC5d}<CcDr>>4x}GnfFF
zL3l9MSyEv?ADfGPh$MaOUSF=Rz)O~b%{WCT(GByZi~tATP775~1Mbq6pTbk=c~Y7d
zqR&|yrAtU3RPN(kAx4^N;^glE?R8X}@stp*vDnI*syT2oOpU|Qt+=@ZS>9vej)$;0
zjQ&52y=7EfU9&YB+}+(mAh^@GLkKRx-Q6WXaCZ&v?h**@P6+O<fyN2$e4FPv_Z{Ck
zXWTn3zn}-bd-twdt7^@fH4CPc0vw$mFx}RKq+F;FvF*I}5u6sOM)xTchFk1W;E&P|
zX~M$a3HW97rlMK4oRhbS_%M?km<B7sEn7(x7(cFPW7hozRlhX~*No!CS2-9J=Kt{~
z<;u@jb=k6slBXF}0lNn1auF34PN;mfVQuKt*2gV&>IW(Wia*kzFiT`25@hIRIFwR7
z^VZ1jw=#JIl|5VYmu5UUvVdYYGx(YBsh~+cH_n_#i*bV`%RY4+fJL?c3l_a4yn;4_
zu?EVuZ_G@KIh@Lkb3spV&=fOKu0!YhT6r8Px3oyhBj}u!DpuT+KAg%yqwi;LuKkMi
zUu1^L9GU;%U;2ois+BP>s{oS2DLFwDy?Og1`Z%DNUV{hVEIiTxhJRx-L|!}phsyBm
z1+0>FmNms%r^&~^0eYN>o+Iol2GbeqZ{&)pmkTJ^j<n)jZqH+J0QQ=9XZjcX0w%a(
zu(g@^t3YV;C<azLJgGUnaUy`7yJrM5%*r;{>WlSDiHQ9`1di%^DUlvY9+s0pvc2%0
z0P<6h+Y?rlYD)AbGju99MA-tH2oW{2{2Y@IapY+uBi@H}45$iPPnqJ+p3=piJVPj}
zZ8@h%5=Ak%W$~!&-B2WuH45=#$6@=gs}NbWs&b8Kw|N()oN95FQ-mLtX&ab>MIRFi
z<!Jk;8x%%F)GhSc*s&X!rDYeIBaSpfg>@D_KPCi0<`Ot+V+J>)6@`CDfJhijc)?^9
zMmmwfT+aD@=YK;ZEheoWj_;UwLyZ6<?ATEebVGx1B9k}Si5(GI2zMAXtt<M7J%!T1
ztQ5ws^hVomD?}=vapIiZRknQZ6dsv0a#Cx&;FBrf8~ygYNdSHcz~yL2X4DO#Ra1&D
zv*AVVnvuq>vQq7`4+r((52D|9?kU|<qvxq2OVy-`6{U#cG#67YsBT7x=s*L%Fk`bi
zM2ccJBYxSGFJP0wX*Plu^|!ndW{t?rCBkV&WVOl_jp8T;+I5Z?q)=3&N{rN4V-Pj5
zNZuQVvnJdmOsNjjNh+~cutXDE5DF-+diDeX&`KXQqZmd3Qu=wGy~<Q(r&93S6%9rW
zc+w599@GX({Xf7e|0N9J_O3?+J_ygd4@Ha>xPU0~Vm?bWAuT!;{CttUCb=XE$5aNQ
z29_&$MQyg&UPmdi^Iq$!YC*I_0VuYYz1!yL56G$#a61(=pjCT)&ZPkcB(ZbYPGg5-
zh7p-+_s}6ygbbVeAmk6m1Xu)pZ@vyRdvTBag1xxHYt-#W@x}ul&upW+C3<tg+kfie
zN3TU_WP%3sm72pTG(v2}&JrOF1o6v)B-6aSeLSwP&4r`lGdhMD3^>F#Dx)6qWz#;l
zg)el|&%Gd-=_m3+*H5vZzn2><Mf?Q${tc0+djLqOGB7YOJA+kl%?<~}$B08unPKch
zzNZ3FQPpWC-OMVD{J6}|DC*T~-@)_u+08E3sN?$07_D6z+pkYW_jqGQb)9(sEbCWh
zU<Lqcll{iv!}SrX=`U<xoC${I3@?@2@nRSj4QjpwQX7v$Hvj!@yn&KIPMbrPVJE_%
zgSq$<R}R0o-HYjK6XMGgLDQLF(wP{v{NDa9F-*|``+jg^q*A_kyl*14g1>yHZrxco
zE5V&_=0*>-POB5pUe?L}n($xDY@z&hq27L`xh(<n91qCI>j@c{=AYIJM#qbF*qglM
z#)DCLd2-lvZf<VFS$y1dU&@1k@d(DiXrxpwTS7!UrYMW40xHXClQ0Y_*o4WA0U5Pl
z1@rkC#C_isGP}N#G@bGH55?yE?()Gs+L-GP$1>$RJU)&B#!BTI55?fK8bK2i6Ysik
zb8{05ep_tk02)&y0F<7xY(nJB!EgeXAzcWq!kw%y@-}D8S#a}r^$E!3gdls3KRoyn
z&+zdtQJiz2{?65ltp>;*Ld||H7Op06moVA$`W*H}qYW7ekEuJ~mCteLwZjAT;F9P#
zLkM#zYn#HnFZ<4R9|1bZZjW70usw)V2G4kF`#T622@3hTLi(waOf|nk3m73};*Y^;
z1rU?JBYIr!eTT4ny8C-~IU!^UMnZhJ;HH<{I9{kB0~&v*`*Ie?fe{r-6>5wv9a9BT
z87U?}Z%uN71$|Xj6|3*dH<R&90^s!_V20A4b|^U1T;N?lP~=is^7t2Tu0HBR0TqKz
z;HxuSZLO24j;Ry(HLbr}*A?GU9+-5D`CGb7FMItl9MpKv`e&j79`!y7j%Ger_5w6K
zYr!VC4Pe8=&=q%StVYiS&~Tl7qj>Htoj$CEqleKa`=py#ICE#&Yu!;XbMc*FX!1g6
z$=W`SZqyh3@?jxVYFkTf<j`>5{RQktiodupE;!S}7MwnA?mUZ?Cb6^9#XLjN4GG*i
z6aJuf6lsem+Ippcr^pf7Ts>n~WHUB%0a$<S*yvZgwEU%hx4KS*@a=(iI5PS7i)$<$
zP`F1&E;q-TyQ3*+i67*80RfFa9FArRK@v)ZVInkd%|+Km{nukKh}eFKiHXM|b)MH&
z{jp^F@@*cM#U3BaQS{ooH+uq2(GW47#8>E0JAtP<4-oA1N<|&MI(fZU(1j+l_vxLJ
z3yfzI;rh-0w8+0v82V^NZXJM)-~L?f5m7{1pzm)ptZvCL`<*lv?YAhKRi*^gGxgLK
zr$>s1^e;V#+d9W39psZ47{+vNv9W|DjOgUiDF+U{bOk~mA5X|HPBi{2@14cSuF!SY
zoU9scDK$yaGS9gg>8|e)LR$8NWwLy}UTq1OHPXc-wWRM{5M6%59nD>+(H{-itpU`8
zJ}xdVQ+izNg1(;TdeFV~UQtfZRj8Y`X|}ppLc_xTvb0@k{Jws2a1efbh9cnk8`J#p
za}q5DT4}f|Fk_CXj~sZ9W<;PKsG~n=4@ar=l(xNSv&mT1*raR{Mt!b~LwPa~iZ+Xf
z;Pb7XJqQUm;5zV-+~*=4^n45fi}Nd7^h@#PcaPH*`lER6POR2fw<-RC!fto8T8|!k
zkn>PdZDUMj^dgV-)~<@!ZSzFa6i*Hm@!I2N*$9-$r1R)^{4XV?)>rEWA?gUt*e4-G
zTTHC?QS^_#Ll0v#f7d62FE?%UO~$9theq&D?a5+oH0cdbOi39dO%uR_9=pRBfHIO8
zE)gKHGyu%I8*}cOU1_r4+S;N>A>nl?{r8Ey#JHWVeq5PY@9@efNgdw~Z@jL-Mn@-K
z(RFRCar*P?>wUs==73RJzlcJCHk_LARe}I|+QG<y96p;F1t|fPYB!_o!51<DOqwK=
ziZ2PX4)&~wDFAP02%IHEgxD-sxQJhzYp%{(Zc9?w_>-#&tB-K$v!}tqU#~rC+B*S(
z*q8MpLoE7MoevU&0bo`$P9LHL?5V8sZ9h+}9DO5yeJG8{6BCOtl|2>jA$2+7B1i%Z
zx%IO_#Q7V|sjpzlJE8~Eb>3!Ns=eb}av4b{AEFRB9e<h!85qs3IPp627(_l^-d`Ir
zAgy-yGrh~zFlxyq>``D+4rz^EnHbSq<J|)xup5Xp7DeJRvMJnq!ob1p%#=7tc>y~$
z^IJAG&s;i@BQ#p?2F%s|zUHf3_{krbZ25e0Dg+E*OI-N=UM3kC5PafRFa>ISWcngx
zfwUZD5c4m5zziS#m~Id7B*i86+vmK#C3V+Gzcx0=vUpt+n#Ar1!y(km)oYky`C|z=
zfAIsYD|J4oC-|CBQ;1);pSZ!#wADi@f%Rb2RsoL-=%spdDPX>j!}Ejdr7Cd22#vSA
za(-hP7`kKHjn$;{_2p@0RW%(Te0D#aV_WYt4g77}-u8d@)M>)isL!&_MvlMW#vJ6{
z(*Eg_ZS<GlUx&3i3Fb*UsrL1rZOJp8Jq%V;V`^i~gTa=cjaE)#&xIOs1#vFPwXhwR
zM6pe15B)Wd6hg`5cy}2ae;>z2+|P`<$;R~qtQu7PXgsGL1Dk7Wzvev;HP(cJj@Igz
zXFzy%hIqV8Hbt*r`T)6xX~uD<<-XS=Z^FLTeE{*8=Qb!Cdh2|CPQ&+ozQ_vYJP-kQ
z-_ig1^*yqdXb%WhyN~F3=fKXrSN6|_^$(diub<O>J8DIU=b;E6Uzi(`7+9pw-}Q8t
zf}AuFjjzVxx-a`mv$@e)8IjtqV<+e1T@6gtQQJ;KqAwnA<_)jNI56Anpf~ph<3E|=
zkO^?>uunYu4G8{;`)NY9ijZ<BXdv>4NDJl}<bQBwk*~>#L_l&Q?_Q+3Jhd|!0|$B5
z$7ayH<C9vD{4ILzF!gQZZ$*6<g+4!C)RNrUO71?MI=Sy*yT;dE2c)!3FYswHo}Ksn
zbmBW%3oQs!t>365sV8TjQO2h$)R`}_J5)DEbA*K81aTva-r5I`Xr{ukXcPh6GmkOd
zg!j@c7L(-s-|i;)QvlECj22v9i~QUeu4H^{x4A~$Y%Uk5T!lL#($jl|4Ha1=@gdgm
zD{0Rk$Ax)h|AH?*m0xZlA6(FEf0>H?T0I4?ZJ>F3-X>G2BR)N#bQcC^ocCuEkmYEG
zmbXk(*v-DDRj#93wf4xBFjjakZ-{gjTq1`Q-xyu#j}OD|Fuv+~dC@8ohQrNC=mLi5
z>hu<E+8C-KgGD8X)WsVhXlL<mZ^ARxRW7)R%Mu<&`Px<}9xs1s&^ij<NNE=F%mg_)
z951q7CWQ@{-vNwo@wdb6b1vp>6EJy;`1s_cXe9EHC7i0qXqWSCsdQc;I`g#_=(Ks<
z`AsacEF#@oArFf6l}<FdD+GwSSaYOb@vVm=P}tXX*1&C3PsDhX=x?1CZ#m@WHti`d
z%IVkG;v-5~!!_hI!$9m6pDo=-mx2=zgEPjsgGXW)rdVQ;E<EHp-DjX7PqQVvTJK9w
zqJnv!-9^^?E%reQ;$wR;I|^e+oh>2q)YFu@b@QNaL*ML9ci0(@^oi;)ar=tt4R7^5
zn|(iAn9#*;(1!W6w%|}-e($+@-kN}Z$siQ)<ao0x&KvcilI#<(;h=VOW#Rt?nqgnQ
zKFofNMtXDGVZ_0;dM{RQ3twbn0R+DBV3;C2bu{CL+JWYq)$Qe<ape5%4P;m$Xd<s7
zVl3{LtnDur9^LftO$x`|yYYdO_P=G1zptS54A|1MnExSdSBea6?<+%*VJY1BWCOx>
zdo0*oxUKUzkVVeta-ZCl068B$cF1c&chV~5pXV|Hi|TDhqLN<4-5Ss0gGb!XAo~I2
z1~SZ3^*d{P9(qZ@J@&qt%3BI^aJ9)^pFyLxn?D$E#(&zA9{?h~aa|{r?P9ISI-m3^
zLz7Gj)3--Rz=Ci8G5;#l<uZxYHvr6u!~g>7ATaY3e@{p(s<6@ZNX<im*Rex48E6MK
zA14OHWwpk!M#DD#6iCJX?o#{b3Y5%KS@oLrW??w=xWKG7i|k*(_GtE;AY$JihVi3W
z{(CRNm;i5q`Di?N-RSN%Fg9(kZ%R(8ehXY~@qov{Is@X@#g6Ws(cG%)p-0x2=wspK
z4D)*+JoJ_xYLyHL-nyqIfhOIuWG*!>c7vXsR%DNIle9{;u<l<IzGk*GE=&)f4=DFs
zRwJUYRB;7qwM}tQeGkpct@sGP2jo?64ehT1nr|T_A`_Ju^iE1jsy~J#1Bwjj;yy}2
z^6U#mO9{RVn9@E6vp9G$J6J0WH|<ZLuc{t%)zd?BWAmXL!}qujxUu^NZKfM(<E#5}
z*Uxn)qw6TyaMgZ<PQf7>vw`oS9(Z73s%Ed}ibAqRu0-8=qGPA;1Kno$<9rxr;;ub*
zrZrC{)G*p^FsMtD_#lsfo34pIIC2lWmj+^8=+0z`nc!j>?Pu+gWoMTq#*yV_8S9TP
zgDp-4F{IiUOq&y9%5t!5v7^!rW)R>7^kMml?T9I|X*2eR;gBp;ml46#znL1x!*SEN
z&d2B3Nrc&063;|Bhsd0(t9#9RLwXqNA7nvdlHJh;b5q?nk6*aX`c|*q=NYx92V+$!
z_01P5YbJXF;Y>HNba_3<S#Xc`r<n<^*!cDV-x4{4L-Is2nbiJiM#ZGl>OW)7yt5qL
z29KcBbpIAn^<~I}e1f{VgaBno$}`qq;@LnJGa8rjUK+DMng|b=^_hITIm0;0vXKBp
z;mazqPEq13m%JnGb9>kh+wK#R?m0O!hiz_OVogB*Y#wHNkgPj;<L??wM<SB`&gQB+
zsQx$hop?827bNz1fJyhGwn!{UaG&udb31lT@`KPocA33{6NJNOm`)xFZ1DO_dkTo3
z{tiHLdhVQmBOMdo{v|{3G#}TEZ~sbQ@L~!)ulWgPM+ccGS%&34lW<$5rU<lUugB;1
zuLqVT7I%0Ycf8Bo;83pXhg{dSbqnncG~1&C%YxF!>xP?#ZlJMSU;5;{;YXp`S1m2&
zOXkukZem6T$5$fNSETabt%3q8{IS;nvj95W=4Y7iuYz(g-#Jt{6e*0-!L+Y<N$gV%
z?PP>WhcUn9VN8hPXzWQ>TU|$2d24|dz!D_gjR0S2uu}KR3jxx~PqF+|f=x|dwqms9
z5RX7^qfaW!N(t1Wt(0PQzEBQwnQM=GB52rPLBpe3C=IR$igCqeKB<{;#@5K<CFk6L
z{SR95(4Ad~p54LJ%v03%b|4d*2&Jqh!_O&Wsk0vJ&(9=KM-BeA-=sL~yim<8m+FxO
z4aC!a4JVnxH%=72yHkMcD5C)J|HZ+*KOHE~g8;Gd1ij%fM&3n`P*6&BMlkQ?k}!Rl
zIwC^hf<t|!1YZ<{IsF<*S!Q7{=3)09gte*gt%Ac)k!5_i^G;AqPBE|zYsfDljBObW
z$s39%XK}X<k>s-eN>mvt*#}kdaQqy?yAI8RMW~QqV7X#>$WMvSD~YFU;9@nZR&jwV
zq8`-ylq?XB+!5aijyIX2m%fqxahzpRYTj9D$zVlf>up@>Xp&{Dd89GVf3evJqk2i(
zS?c?nGmcV+#6$@V0Tn&;!#lVk*u1Z}?u+jm2ZNFDepf+{Dg*wAa?&KcP%AZ?dPL|b
z*XR9=w)qf3f9~QW8oo^LU<v0C8kc8B?_k;|Q%Tr_r=8NCXPG;gQC#I4%?Y*F&8UFT
zT+9f|TyuZtJ>{jd7Bne&cOmK7e!-J`ogTop6fx;kv^n#Q(~S|e|BtH?QBUgJ53+Vb
z+ra})?AFq}4q;!kD9zAcf1YZs#%Xl)P%^VUu%ky^`U0eHS*oPDvB$NL*1mlxu#5NC
zV5fmkQHSuo(hr&*CqSQ}<4P#{9cv~iRp-^un*=nJAklR7-J3R$SaD2DZ*=s{_f#p;
zq>~2qiKUR6PG6n>?TERQF|c6qk3`bTlj+PKPW2^3oodJ0K`jtJT(wx+;vJuU+HtnH
zCvcxC6DPX5=@3DoFQq{48ENTB-4}T0O2^n&P0+9!g`SxTb4=!n17+<NP+^RU%_NA9
z6w2S%UTnPe=LPOYuH*y@DLq=e=%W5F9H+b#&CE?PtfBm~f9d{TJ~!l+AieJ^l+NXu
zr5ct@^C*u&eORJz$s<Fui2LcPNP0tAJhQeVKhH%X3_r}=JK*&HPrsH9T3Id)==1e#
zX)%$BEr;`-4Kysw&ZT*0=D`23;a_+nJ47#S$lB&1788YZd@imsrCbLuSz=execE<i
zJb!z3Z?qNKevWIAa@EsR))N@gQy4uGNIM3BfNA;a^Fx=YMzK+Q#NK1T<<bg?Kg8Uo
z9Bq^c-%Gvzb&&f)Qg5!jn9%{XM0}aQKPlDRNeWWPJ6%59KW9|L_o#RZsmBJq0S1@T
zG6M8BYpV874oEuh^yMKItksI`^hM8arVHZjK6Ec(y%BN5Iuo27)92e7F+rS1&~%Gt
z!aMUNj)pL{zC5)pE1wFRDgw%kg|?S}+~O;i6Dt>A4F<5H)p<XWJPDpMz2JM1IP;B*
z*Cok2IGu!XssuPVvIf@<p2Ra`q0Ot1^Ko)Rm(U(pS<S&&W@Z@N_oHWKlZc{F!!%4i
z#tX@jA_j3ghV*X!m0p;d<m6K}KaIvI5ZZ#Qa`)LILT1uOsWS%UI;RYQ<owV3n=fh4
z;-KaTGrJu<qYG60#Hc3n0#p#+yV}G^cjPGUNN=U}?)tHPiTkji_{53|;s-jw{xK^q
zAd0M8D3=lvpvTG&@S5M+*qF(#B)N2%tqU*;2DhibYlB>G*zDFkg#BaTDpi2J(AuI4
zrZq$$e^6&3Oq*kM`#$*RM6G+g5K}4<*t!d<$z54P>lM0w*;N9u;(h6cosivB1J%x6
z50|Ix`v!T~3~1@NVZZ2~R8~LNgNd*SV`Vi0emgoFE#f13U}MXn)W9e9OCp*PL9rH@
zF`A69!avR{e$A7-#e`{qDo7^xN=U%xW_qV?aW4~DovXF?RJwA*Q5{zAgS{COs|}Y@
z2s7!ssG<Xm>I{dX0$(ftk$laYaL{yF(fQotvcz{qr;SVSS$>EBF-%6=g+2I(rGN9M
zt@Gg^AtjD761wJzp?n`W)}~uMBecB-l7Zy#8V4f?&ecn?Qh(_2@ea7Nt9!+&d8SN_
zPkB+rS!r%qKiT$$2_|$woU!W*mFSsyUF-tsJ@YM8T*|b3LNxGV^et5WDpEH2`$MKs
z7QB5;)8^!C<_FOziT;V~{y1Y#n+f?8xG|_btXA)0XD%Y!y?O<`wJS-Xh_Q5eXr>=Y
zeTXGg{sg+$(}U!X$|c`0_W>ivNflQJH~}Ppn|sEsRH2AcPueV^gT;v;_evVLejstR
zj;mse!E_v~ScMsosE=_a|2vP@48m51bpv^hx1@BBHKg5`9n6>iM<EqzLx}83)ZrVQ
z_Xj1UXQ9CC(#U=TR~@3@@WAZqyk}f6;Y}E!vo4k0l*2~uxtrBI;qK=&)aW+S-XbAC
zIN$VUsY^Gs9Df&9<vhodg60+|kboDJQ-7UQJrj+i7q>%BvF^q>@lN}4zUuWykZ|-S
z3Zk>r2L_2f3wiML8SH69b?)q>J(v~xW8(fmHwN|~ZjLy?K0kQzmWy=KdVTerU?qe>
zJmzb7+>kA){FGa@vRG@;k#M22RoL8Yw@#tt%|*I!RE-*x<`1-9J49=|<Qb<f7$fmH
zD+dM+!jg}~dK!}ck%Uv14Nt|@eQ{&!BzgnZ6k_s1Pa-QkGST}UhynHO?S|hg5%=Vt
z{4VoFW;v4c9r-1WY>osWQ02d{*v`Ub7Qmiz$gQk;AhRv1_B=`VG)o@kq~Z9DTrX3o
zsnRr@^Teu9A}fpWj;tYZg;yBPm&P`KI?B$#3fNeV2^Hf2!nmhoNP8j{S-wwWChcY;
z=}>VXA%8m80qSANX!Pf~mwrP;@6fV%J}ypZcI!sJ3TK5%BAU+q+W%p2N`kBL8qA*)
zmK+oM&}FtWRKaqH@8wgGr4x(%J8Y$0tbB<})Faj<HpC_iZrj0Fl1ghz%~!I=SUU)c
zYmR2?QopVCLNDwhYXQ<|?QK^eDa=Ak558`J;2gG+VHP=$x0&dZTpTjOjwV%_E{QBL
zwn4d}8PsUTt?;*!^i&}>^b#{g?+XQ3fpYtp*pA2$9+})9`#!`OkN^#|76d*ZT(<YG
zHjFK0UEthK57E{uXu8LlN7f9V$Elz+#kA_jED|06R>jh9PZpyRXm!~7k<boNhyKh!
z`ABd$ixS2rp-3#4aHq~`PsQUo+bU|{+QS@APtrGb?^6aj0x?NNp8HuJNFD+pjJCIP
z!E1*wO5Hb<878))r*rAWj3vhANgFaFlig#hTc*)hKyL1<k!43W?GRVdjIZjZx?{K^
z&IQ@$5H-tAOemMO)$+p=Ju(Vo(3mfp+lJ$?%bFjLqvM&AN_8fo4u3I2y-~sElR-K7
z_~2zX{^hGFLpb3a_f{#qWim=Jq9<kQ7+QC?ldDqeHX?DppScyeKNh>bk=2girwm#i
zVjZh|^NeSWIa`F!ILCo=v+uIf2?7dc7qbdn-EKD!Vs)rX^BSZ^E@oJY^|;@=SNbpY
z32kw3CbT`;iPyQHu=ohSlUFRo(&cD!(e&%R@-Ra|C`88-MIj6Bh*wu)c6V*C^^kz&
zGwvIFYg4WRfy-L`0<&S_fg!!Sx*9G}oa`lHWw3k>iB=hxd(|06>qR_LN*|4R8ctj=
z@W3tbU$@CGga44#TKD2ql6YgRn0Lfe1>_*%-B@^+E6I=fhRYQ&89jqD7KND6_mfix
zu|V~-_+B422FO&PXwQR(<J>(B;bWAle)=4H6X!kb&IX{DtE}(Dvbxv0yP*eH;c0L`
zAvVVNM#&j1%ce{Aob_kkYRoxPIK7ufnFv`qAL@Tcoc%&f6uR2GPS69wAiT18WM4PB
zoXl91@IUVF-=WQ7f%!GJ7+{Qz9~<hnhTV}OXe=w?-fVIj$*6L`mv)aoR*x%uaJb@_
zB)Y-6<n<AKC1kB9dCJ~I;RD7+j66zDCu?k-)w$Sli2)51*)xtn>P__Dp+iBuTC+)Z
zE!;(+hmZ59H$(p6`7e3bl7c<Ie9&q`4@sB26N_JYo>=FvygmeOu5WR4?MqaW+(qnV
zc=7>-=EwgL|D+}ztci}o2rYGYh((Mmt^KI1zPd)+YNQ~j^gT#)eI1*sua^m|b6?iA
zLRZUIJ!EjWTnw0*9kz;1Ac&1Q2*|Emfr4qD>^w=QGDt44BQ1I7?y~Kn`co#Xfv3&L
zZ9_(5?TlE`%Pqh=f!Jc>hBqd%Ko5gt?FWB8HM&$SHm($~>fRs)IDs#C4wLoWivMQo
zp>;3KwS*vkL%#AtxzMi&Y`LwE;tZr-cr+<usIVo67*jtl`;)v&6P5`yof-$fb{T7M
zKOjraSwpPc5lr=+kupUn^@ZDZlu%avWdHRgGbp%kT&Z~p_LhMFomouksS_Q<vxT-R
zmxk8yD9|5Vgbn|Pc57lQqk=p_T_f6<<7CxnSw42e;ZqU>&V{S!#{3HS+Ro_PPtQ+h
zt2o-UnOViT?l#L%SG3xwbt(%zL3;aj#>(WuIaIWJNf0Pn*+?Whr?W|srQhq&%e_vM
z;QCWItfId*nzGo+l2^|-Pq|)FI-04GC;udruQ@`@Nyhs_&}X}5*3D_E8AWo3T0#pS
z@vyH@-or*sA3@=rvr|~=D&90|i8l3K%r2?s0uFVCjmF|(yEt$Qe-y$F$IM8tCNg!w
z4dWNcTqFt~wN!VXJVp_opY@)4d5<Zoof^+L2Lu*~U%wRhZJ1EPm$sGZEx0m3w)I9I
zZ6y=kA#RDIttV@Yf<gscWaWRm$Sc2yg3HQNP!<-G;aDjjs5LcN6BDyqrr#ImYIfk)
zwr6`F)>GZ|8AI~DZtmcI$MK=VaZM}hKRrN|HGpvg4k1uIaq$nM9XLaaZxpXXLDufJ
z9pI7o#SrS29mdY5Mv`q9!^vy}Mjz+`^2A6tF9=nJ=`C~6)uyoem^`c&Ke#3>Qp*LW
zDjAbo`!9hSaTnPgnAoU)h4=(Mo1UwzaZM<HZDXj0(jg5R;XI<U9yeU1wmWGEJ0whR
zvOmW(aitAp?c3Pwr9||Uft)N5R@$ZIMR^=>>Mtw9+uX|}T4$8sAr`>vNRU?mgeFJo
zb7K~i%Kd3=l-^+reD}nm4YrZk-(->F<Ml*C<l7akPu_P73D{_{<W^eY#4_raMhG=I
zh@-RA>P7gN@JHe&A{EPzON8Sz$!iptpX}@#dFCT*pY(0$P$QPjwBY5(9>RJ|%c;ye
zKQ79N$jS0aUN*X=!QwrZr*hn3$*b5lv`eFbifLm%210#=j$n7sCxvvo)ryI-v@*Qt
zjs;0WI4YdYIW#gx39e-;f!R^intmQpnn<f52YSM8g64$aK2DMl-4Zi8eHZ^5apV}+
zn_C(Uu(<^sCucYtHXwETNR^DMt^27gntii#%_Xn>xo-krB}FE_);WPKROxpAsg+my
zsuEwpm&1X;ng*rZy>rCr%VOkqw+-&+9H5e4vGK-`4q2k<hm9XwE%kK2!OgK3g{XvU
zf+P$Tkr7iE)g+OL|3ad1rNLUawD<?CZ0|3EP9fx#O54N@9lwm8)<z%26sfXj>VF2>
zZ>0d$oHFDuEX}VfnK^FoFw;2Vp?dC)jtDRx5k2<J^~JKHEaU5*bTYALaA%HCo>8h}
zs98+TWim@@-I6ud8ksTq=6j|`L_lrAS0<2Z9A^Q@Wf_Jr!3FGlT9Q!$wbgwFpc4Bi
z0$p`-`v_6++$F_$guy2fd*h+0PbBOlo;TkZq|llwZB@Og##c|sT47o+&BX9F_^{6{
zG!cE_;Os@zN{qluYx*&COv!v)56E<&C90GaLV^eRab!S0k8?BiH(Uj6QdTNvK*4t9
zM*pKlIuEx~l3ondw$1u%EWTDRO4<+Pp)=Ke;w=0CtVF?Fb!l!BS`dM+avY!d&$#Ax
zQ<XO9Pp0|^SdZS_tm)&r+^?PgBOk%wSp8R31wfg|Q9YsOpn%gW%Pi5B6{_4x-eGKH
zg}-i}k64;4PaLl)@B2F3z=Xme-HWSFiN)wzZlI{d?FYW?Ui+N7&LM0Q=`>hr%pyNI
zQNG0wqki8cLJa$kg=d5vDH|9){o`HR4O13TrMGFMegxfo%BsNGi$aQ9ILS(LB+cfz
zpcJWu{*?Tl>WBG_aJ^PXoPZ_8)uq?_HYYue3k)hc)j*Z(_(cUn`PI{d)c`4rcpm0o
zU)BP4u%QP!yeGzdLzV2V<KqqkzJ^yA|EhiGF(@BJ>|^!IGN~yBr9%7<i^m-ikJX(c
zqLsN>hj1JJK|G6;{c&!bn^7`|2(Pn|b&i_?#KQ-jxOPM-SIo5d9yUIMsrnKsCW=4g
zGr<o^pUR*s0=6l0i?HG^yi~^93Ha-`)QoWD9^mWZcHx{KKjYt5qg3v!^u~+2j(odn
z+5RKdWvB4xIT#IjJ+>EhY4XQ4iU*ehbgTC>SKk~jH*Z6mIiYuE@9JL!g-Hfy2yEI8
z+(%0SC4f-!7ER5UhJEN=P`t#WTdFZ)bGQCEg8~_i53J)PRVnFauDO5SI=s5Gg;gx`
zVeEHcra|!v-LN)&7)GZrQkx)iC25}P$1B|;(;6(NNl;{Ke~@JheFc0SNu-SII78k-
z!GXF(T7BdI|HJRmgStFB45+4IZQ7uDrUtomH=jKG!U4rLpo6(lYBW1t%rG%v>wA%Z
z>fRDDa3nVx2{On`qd$eJJS2EvK(Zil^v)><;H-?=2gx7-PyL29;}AkA%2wC$JP#)a
zTt|9X49Wx6If3opYw>mJiu7I(s-+z&o$Dx``uin<;`PKZaTRyO$9d#mgRIC|(IeqQ
zhQtNLf5r;SXGmVs1O?5B?i{cyg82leT<i@=T`!M-((%Hi57K{oIwgdk+24wnxJRMb
z|1&P!<-f4Zk}qrZ=ab&&e_)-Z&btmTmy1e0N@BLc(H%3=Y{IunVLrq|2yWtG-cqll
zU@NMK(94<_o#N<|Ttlw--)P+|zmY?-*bb?Y&NBt=b`p%`ab&Jli=_tJT~Rx%!o2X{
z!;lWt$KE*++-vlIRfu%O9vLS&k1;s+S|#}dLNWrg^YS=2lD7z@-{^Ib*K0uGMCAG%
zaCk+&mTXQJQ}Ozy<cn{GZp&z-6#Gpn5&tk@@}VF9oZ&DDz*`Bd@HK}t=Gj6#_qyOc
z^=J9_TBZI<JR4X01KTm*{|>aylk6NxA%krBz{EC|7etY>wKjK<(=I$LDsdQ4L)pH+
z+~4DQyA5xE8~^|BHn34W)8D=&;I8if!yw$;%L`3?SBt9_zAL$KIyzAI>Rg=|oDHpm
zocWSpI12{{RTsVz63NLK6DU!YS>yW_=ic6&XcK@#P)Q;JV2~&Q&O{g?C*5?RbYS_H
z3ZtFD=&x7ccn{0BLY@zxyp-$tmehyD(O9FPdTv=0hzS5%WeY%W?*ILizri`!j|y-M
zXAs>J+Vx+rVc&I9f_2v*Gj&`@F9&sdgQMZClc+4BTu~e>3fhwA^`A*)+M*@oGnyN)
z1|@&0!8rip?<iH(j?tw`Ur@^GSm!vi2PIWzG$dy~9TE<bv4YElxlM-AvFTJlRnv>=
zwz?dECf^G70J8UQc<UBn{zhV~If{Qs0LU$7|7YJ_;M{8yp843HM)Ws>&!1>-@R9EC
zIr+H@nkdmp#fl%FFJx2GjAy?9qTj8h_g@{3<sXK{aqi|v&KwiwX#0dnjwyTkNVd6_
zJn6pLHlfWDu{Acr&9HZD0$nX>y(BO#L>#ZDWY}Ocdnx~2f+_1#q3jv2_Rm`iQFhcJ
z9G#TO1+LKBFPwP31s+?3>RS3ypCv{k?$y<&oYQfuMR5AiBQa|G1?(*}SsChVgrlSP
zM72UmBPB0@v&;z4y)JI-_Ok7&)9FccOUB;|FriFy>6Ht^ke!WMkO|nj*VaffxNLiY
zky>K_R}3(iBcN;aufd3~dKXxee@5kH1Co$O|G`n*jE&{Dj>h#29)*=AZ~Jq)B8eo&
zMYmQNYn|@lR*Ua%xi>^kGBx8@oICgn+yi@8iw5}Om?bF-<y5de>c0r5^`6r1ro+@3
zE$90jc{jiBUD?~m*RDrU9*B);9%0Y37=X~|xWhWN@rWI{&gfzF(b^sP6T${lPN^S4
zJiK`vexQ=QLm1pmk9|JxdK|#Pr8)AAK38%4Gi^dWWQ55GT!schoS-*Cl4DNH8us8#
ztVRI;i0xKF9mD58RWZsfzq)&PDQu=ajsF}A6WlQ=;;+s+6Hk8#gBxm~wrD9IPMn7c
zw~a8E^jo<oE_{@-m3-kK*o<qX{k&Tpg1IEq%j#&RTGK%)g{!hzAbGi(VDQ^+8tWbr
zW$5O<I~`R_sog=SvH<pw0j4vIP+GU|ZVkGlRLx?x`D4CRtcZ9@bO!a`ogpcpxNl%<
z%b4?ccbDpWzs2c#sLCT`x7zF*u3>itp4#K=t57MC*Z-MyeYB9VfXoaq^$3(*k2EnE
zwKy{Q+{fF^zM76Cz_1$iPga|Ue-#3l6I?X}#XwDR<ctNNF)m*-V5}T0)t7jjoD*_b
zOsabeUG9ys*AVCdKfq<ZA4?r)N*%U(FCJ&A%%y?)yosT0S#B;lh?kdAtx{w8Ix5T*
z;0U7Q<6G$Q$=;rAEL0bWwVO}PX_Npgx~G$km^(Y*!UlTm?YImqB(hUg=D@9Y`$4?j
zx<Za1@EO1;uXNzn(a>VMI!OLzOeB3w^cXw;mBC$O!|ZaTN!dB{`8!?O0`d${8#b`E
ze*E$%{&;gTW*xe)SZCaI_?X7;@xwz7)w7%lh@TK}9p|o5ri{j==D?=u`JYWwmva|;
z`P9ZYh_q;w$~-L`RR2seIO`lLldZSdhSS`klDWn1x>lJ&&v(JGXaMiY7r#Kq!>>)&
z&FEMx&qNlmbX`tWWKCt0x9Jiox)XhkHU+AInpVq*9yLm<@=sN)hlQzh0?&DTlyu3A
z%sbgPG)bWb%Le;p+4B6(A&Sy&IELM*u9e@8@F~a{sdw2%-uPRFJ(yrFQsaN?_{C*O
zM*?N_hp<)B!F6e#5dR~_&F{`wf-!GHq78&jpIe8l<P|;_ifI~oRQrw5=0?H`K~CTj
z2h?PaNrXej#@rNvStJpvgwgS~xJJ1XI><J4=v3b%DWxE3l4@@F<iq~pDeuT$&wSX}
z`jnGTEQyNLoedEgH^s&MtxdP!etR%qpDUp?<Zl~-r&1-0%N?z%TSb7=AG+>2PG>Ly
ze{e-b1p~T7cZGTlso7Y%>C2zc1v1|!09Wh_L3zcj%LE^mCDO*cp1K{*mIVULQNUU?
z7*vwOw^iB`39YV2R#0Jz01N8R{ybp*uL4RgTAz_+XBsS32;ko=Ecp7vbo4i1(8IZk
zu0yZ&jtn=Q=wjJ4$}XWb&*ZQP*Mn*5%k-^3`}=ST3JNE0FTDcH<I8kIL{wDCqxmYO
zE+6j`Psx6^Dy^RhTa(I0-DGRLy!~Fd5T8o`7T4>W8=}(4<&%6a5b(PBHuq{ZSN;X?
zK<oR9KY#~5Ki&e1rv_MXuP3i9cVmwa4{sjnh%S1}-U_Ucjh$M<zTeg%($Lqqj9O1s
zuPwsgs>4vV!t`MEFQ1=Y_z03T-@*d|aQgXw3lH4fyWFpZ<V~m8R;?x?WuDfKmZQ22
zbjf%;^s)n%h#pNQfuu^4D<UGyoawIo(jVSgl@46=q$)KL+OTu>sOe4??7KI9>n3k<
z`gFRC^hn#RtMQ1iuZCp}Sw;a{t+?hJACLwrXzEl^FZ@9tLog$_NjTOfK1#+8E5K?y
zVC+J#jW}X^nJfC;Fm>6UIT=|f)D>!vTxFZ1I9F=)gph^gpz>t0e8E<y==KBQ+~w@~
zDSjgymDX8zh`-E7u&HoHc9WxzG)oNgUD(d0&~|@-L8dNbrV<J*XVUgyp%)yZM9gl>
zRC>V9l;fk~@CeM@AwX+J^rYd8F03|uvI`*PG#j+O>fZp^(8C+ok$B7|BJUB!98L5Y
z=tT{}F{yXE=>hiXP>Dj$?vJ;e<*oUe!U_`S0(yf59PYV2o&K0Q=g2cZh7<>v&_xGU
zB5|};VF~`J(0uob>RCK0brZD`X(*Vux!*>>hX=QXDYu_1m3s8wV>CC{UcU9-Iyr;o
z9P#~U<RJt^rz5W$k;crET2r~W<5rJY$lMZm&+8}=d%g<|p1d-N$&6D?>Z_=AIYhT6
zt`6bQ=@yKYI!Ipkr2wHa*7l#Lq|122k<il4y%p;g$QA-9Cl&L7x|rI{+-o7u+YbUu
zuJ!E4Hjzf@fTH43(6<q`{QY+-lWomcAKEX?MDl09PtAL=J*7vB&9Fr)&hiLhzW)?<
zXshtc`huwnx%bJ8B%Z?%F^ORxu4`{*Q>C1((wH|-VrZsWcC_-04RXYIiCkg55j=0g
z>&ZnNG%bIyxx0#w^r3U8WnflAWmtQ;oJ@y}W9Wi_VsXif*QvNBmcV#@tNpJ{w!~YC
z*0qpJb5}8V{AV;}vDLMLU%3V{7Ys`Sxd~8u9k=@tQ2pLAZ}hj!+y9Ij9GpFcwQx!_
z0iN2Zos=?+*+Z(v4<wcAYIVTV!7P>voTqWvK|{0xL>jCh%8B|RO#R^<l10uEG(t%A
zF$24%c8IR@%)Y9M{g@@y5Trp@w`k=pa5wyJ`OQzpS~g5ZyaA~1XvHMsTu#*ZeE?70
zShQ}gI?ec7pnAemmV5kmMT6_Gr$Y5?4Y|?IwO-_mZov=xvrdX=o)1y7>2|AdY3y9!
z?Yd&#yJ~=ypV#^0d$A_Rta{_O!9Qa;eT3%Dec!$l?#U1ZAfzjx{IDn-ct@Xda6jOh
zV;a`R1gob62v7GtrV;A---FZd;WNP1mdBEg@q~+`S5K?<vj)mLbVRy5lZc!#qXB({
zU#!HLmBqaLi*xiaWiKsst^6jY^Z})3PR@q?ln}*00tTWnXAZd_KH~xpGgd~iJOz$~
z{EEF6iAnCHL0IJ(mX~2bP%8Xgv*{@AQjrYMn?j;cXEb2qE~%@|_m*EJZ|6!W3Y_Z$
zx_8}o;NL>5c9SAHi?Eq`4v@xPC;b?R)|8o9`t4W)+a|(zT|~{&6E#?T4`^b9E5zVg
zE7-%`ai(W#H5+r)GH$#!b=V!=Il_|tW6|&=KuW{Ez**rq-@z@?Dqd))T4HSV9z*|k
zWHNf16X)Qf61T}67R1>_`O5jY4l$`~aSyw?yg0i(Rn*tg+3hfXbZ>(vHx6b^6gS6$
z^u2-4;gr;#hFh}>Y_s9HGy!YzmP1o{`EbhA=nGv#eqzhz;Q420d8HGIqv+sU*7jmF
zWg0HsS3nJ3o};vlxD6M2hkx$FwsL%8y}hB$P}L$YAO8NHP%p>EPYu3jfjPP>kAGU8
zB>xl0|E<KnA<?nFG)bdXN~>`pF9F`PAus2*K}pv95JgTu-;${rPM2~=b}olK$&(Fu
zPYh|DM4YK>`?rmS@t@3fvkSrV>e=o!Y)OuYLaZ|zB)nx~yI(yFUPeChePr;03|H!q
zn4~A<6W}EZSeHlil-^#+wOgof?huP&6<*PDhB{3<i7Q{V$t<wdEk<`U{+lzLIt;UZ
zqA*$qYiH*f`+^hETee9~yaCCdZ;58{JhZZ2U|xnftmnZsuDICNdMKD~Cg%@M<27au
z?#syVTe<Qv^PHC~&h!D17l+qD7L$oqd={&7@qBkWZM|N+@U4~+zHbyaQ1?cDu`{(%
zqQ}weRr-_RcSPGZ{rIDBrCw&n)^NQqUirRFNQ;~<7;J;%0X|~c+k&<`xE-NwSMD3R
zmcw!R&>y1nCYyh|B%hswU58CG$kx2phL#TCl$Jj-r~ec(C*;vluK-)&j<y0&!9R?x
zpa1*O|M!FE=YNVao$CKU7y!SHG&r9mhqbSS0`q;P-}l`e?N&G8<9-iTpF`)>qRkJ7
zq1G7C9VE{o<gO9?_<YyV2g$M-v|p>d!#wYG4Ap&-KZ2(kMlapS16@65?Y%`|M~{x|
zdPjS3QOCb1c72AMty!HHFKRrmo<?BQw(sAXqXe&s75ui0Z+bAw#9HGWXo&7fRc?c2
z+XDyd(p#+LNACR?!dI&&#q5uXEG)Yy_%t3tt6oTY!BZHZQcb#8C*J;nr7D}R^0?gi
z@3F9sUQw$}dZSmM=*GpoE(W8TRTA?W>@|IZ#F~@s`)fKE;ezr&R_iMjPew#1)fAmO
zl*Lt7XyVG5{3Aaa5SJB#jWKUe$%$oVi75zdc}V7r0_a(7VEp$}?Ei%oU~mG7SNy+p
zCa?eJ5oVX!HP?wDS2hv`v#a$ieq?sAUD8XEOF`>|su{7%c%=vP6b(nSs_4H?<hq+~
z<qVr;p^`G9jxgnOTP~TBc*m3LX*HbsV4HJKzNQ`~K_zk*DE>&IRW{}s4`;Vy0~d*`
zTSWrB-V2s3)Pm6%ebvat@;-r&SLq9CT|N1YfpJVBIQea}L(3jlJRgU%Qd@~668puH
z6B6q}dlxy=8>`O53nQ{HPuJlbtWGsm<!s?n+P&+1=J|Nkx`PK^@Rd7wx8KvoE@5qq
z<hmP5kee-7hq!3+8qIt&@E)QV-d=?tEr!{m4E}6em0zLBaD*#%0_cAO`ppsll;P1@
z>dC%3#DU(emJBrkJnj(K=QB8gN&aCG&FTyyn<<BgQ}m|Ny3QLi*pA5APkNdPC@rZU
z0<+8XJDNcc+g-R<79<{7dY>!`KGsYX3|>byE451e7cB86vBfao1V~5&LG6_eoQ8_2
zVoL#;`Av4E*ny_H4(mEF)!lIpCCUbbDr3f9Vk%w*aWNz`Rk6fjqw$2Xz?C7o_Vc=i
zwc}FU<;)uyC@+?N6o1Fhe+2Kja1?VRr)EGlhp5gyeZ%e3pS(r1sa=oNUVd+AaSH|d
zy!9FR=EGs6OohIoWJVqSt~=rWK?}a)<#g-B;;b*h)3WUl25V_VYGa7#YNibSlmmJ@
zox2#>hVEillvPj~&1BJ_NoA^8r+n-oTHSHaNXcZ4q5iD<QJ}vr>JIuGnbEg*tniV|
zF=ze1>G9W1K<)Id!Udl7=PTmA<>umR7-|`r1>H1*Xy`w~@$a>Dy3F~>$3zrVUQ?|B
zi1-yyWCKdtufR^UeCxIvtdJLVAw?IKPL3og>l^XN!OQ@LaPR-I-BB)?MQG1TJGv&o
z5eq0uH*sf5tsOIkeV>FPDucK#`Lo|(LD!VQ>t%kNKX{1>BRHl1g3CFZXUNO}P9p?o
za46h#l)x^sfy0q92D%w2`@<viC7^t=lCdUCCktS2_d;${=bNdwHJ3(x4vf4~k_Ec)
zYbY#ETHa~zdn0zd(-Ms?#DBSqcvHFyjd8(Y0*8}-8Vxs<fMSwt%NH&Q$ks47-)I@O
zBq8I8lpnxA{FageYm|0o!%@QvtpY35P2k7}BWCPjC1@*#JSm!)H$?LV>LZcF@(q8w
zLT2I6kU3Pz{<M>`xER@+COtr?2jDjhRk)`nkqJnQbJb_`>JXOtk$yb5Xp|sQel>hl
z%22+zN}gOB{!-$IJUFFhJ@NE)aeZP7+*C9!YcyW%S*qgnen_!NtkUK8#BZp)H`PD2
zl~>;GKrxZjxnbQG;Y&`9m<>1-aW+rlwH6AlDzx5?4(#-oLW4#tv>!CUtinJ2K?f7N
zVHxhXFvfZvgieKJnWyZv-d8%!)5dj-5?j3WECpY*?-xhrkOU4NDC=!8@A>P*2wYCQ
zp;JBvg&W4(+dli@2uS7osaW-+9}UUJ@CR!fJ|syweKJ`Z*lw~uA5KSBb0nUu9OLI;
z(11oLnEt`KP33$Vqrq{)X;<A9`$7I=Z%6Fco9`_4zeQAQV<aXb4VMd>F1Qf4;aB5F
z;HE0Sn!XRG5hR0IYqnGb2<dxrKBj^Zl6iIma14ha#QT%6v*@t+ZWx@kLF4Br1t5u)
ztI}q_x_&=(GFdp|h|Hkkmp$ZHGJ%n)&j6ekwj%@T%11?;O~)efr)0T_6fCsyulezI
zVh^^D$s8<Z?Xb}c{HaGmW1>q6L_>au$&E@xXCdETq79bU<v1ij=2T-mX-5OJ9+l{f
zI)8R<tACJW0Fi|g!1{;ECnaJ}T&>p?d5KrEvl?s-|Mhu()#_hjhi_UNoXEhV3uvHN
zaeFsr&KhdVcbC1`<I8uUMPeNDZAh4o6*lmR7!$$Og~4{z{slueyeAT2dVn5k(??KO
zhTzcjM!X=ZEwi+@O<u?qfp?<^W5(!-M0gHX2dqxKIZUjArawcSMGJlmSm1&6)UFxj
z%%;quMZ9$8Si$49<B`a|K*CNv9T(1Zg(Pl`wff18B%9~>&&}}<*KRGVX401zh(4>-
zb!R6yG8+wf2)7+)7utlBVrnU*4W#C4I0wrf)}(N<#NzMWSJG#@rD_%59;q;@QYP1-
zW@tJGv!c5Pvv=Ydb){zuCmLMsSc01;7TFA-c;^YjrJ?Lc*hAgty9WH8cy_JLN<nxu
zACV)pIV$az<xvMR+wN?LalDUHx&rm3F|LdX^dgPXbwLy3osp6}_0tWd!@5qGFR2na
zk%WIXcx6SGzbYBx2*Ewv`UWTN+!W+`LuxT0>L5k;HWFMB)|2LGu4i7jvYU}aY<$Gd
zX5k7chj`-q|1uif2Gbe_dvPiI7~Ioq05OkKs`mHu<tF<axBIZtFBQoEbd=8LUJd*O
zUTbUe81vQphgRDa2L9pUbwoWoMmhdXLSp$h=j37^o}86?K$A8JXaMK+%EV%MrvW+0
z9a+Rafdb5URUQt$+5uFM@f=)x%s`Qwsf$=gYAWyraisxz%f|xeG%z1ATB|F0{mZ3k
zXT_sq%>wOrE>_2eF{q!=#y?#kd)F$s93_cNBo}KIxYhSHx8q#+coMauB$+Q`mXycN
zMILliT}x$%wpj8!AfHSq^`Yrx+9P|OIXa*4xiBY6*$Mgn;RO9ub6LVhVUWe+8Ljsy
zW=ezmaO|%hAMpu;1~FgTTx?)^OtGJ-NQXOd<y$5up76}YDB;fp5oYr#%f+s^fTiiC
zt$=lE#Jn~*CP_1`4{8ygQw5mN_xC~-sibQ<HaQ>g7(O;>j(f9nl7}kMe!m-^$<uv2
z0(JPUqj47RSb2_`PMaMD%BlD#{#%9-0^oQ`Oc4d-a!M<>DJpO_KAd0i^RdX;Heq>W
zKlKNqFjrM9MccnXxYp9wO}s^e?odGjKSvxr;X;%EfZRkbx6>?Wwfz}BrDnaSh`#CX
z=`)RUMbAGu<}2rKU9Ju}T`rZ~(%6^I8P?hz6RfLd_2<D)43OGa?Wv$698z1JK(-NE
zi+gbCvJ+DES&<*BJJPRW=?_iu>>OZQQLVacR~!c28`7pm7$Z9*l}VYz4nDWYsS1Vw
zy%~RQ2j5FEj?s*m<j7FOpT2#Lh-T^w0{xlt*0m<vIK=uS?`y``v!?0`{$S?2&4@Ld
zpn4v)p~U$Em#+FNWleB}ndcMP2a-WKPFo69;u5)I_q66i6IIq?mi)nn&vunfjOd~L
zdOw^(hvl?q7g4sOw>6z_eeNJHel*~(eOYj!$HSen5gKa^n{F0dIfti01<2^gbZGy|
z-B&iib{o%I(7A*3W*i4+Wjw+&UPj!S1xLX=7|->if%wiC%{WicRy5SYtW+=yLOZy#
zrV>S%8J8Q|LT0u-1^+EL$pMF(yI;BPp@%VJKF=m-gj*D9N<WNtlW3Y{T>B<)uf&_%
ze$c&hUPcp>UZ@Pi>vKuGvY1Mw@`~{UFPuP+NAzgF9OO17Sq0rIu(m3>C%NYMLv1hn
zj<S2{<6MbacpHe(lqcqEP<)9YUF4E!mxPBC5XHOl*|oj`x<ILg`hfQHF_ky9V1PUD
zirC!|*qtLLMg9fZ%0?w=sMpl~k41)4r_HSYBU}K>7%{Yp>5)IwEWW;m8#c+Px^O1A
zLGP)dRL2@x^6|!BF3Mu~4;Rk9+dFqRpZ;xBUBjGD(Ad_h)^!l|+D#(Z%Q5Vnn7$#f
z9f_sM46rcL)*M6*DDD=^(Trzx#Ty)|BgrU^79JQeIzQ$`CaNDDtOQ_$oF^+%R9w~?
z{H5yq@<i;#ZvDd~j@~<4gmFd=gSa5!hU`RxWs6yo8NA>s(;d*iV+|BJXd<#BFMzW$
zy%9RBIi!}w=be@;!ku#^=U6q^Mu5>hpaOT7UycpTDkxmr-VzD{0sn`ouMVr?i`u0_
zN>Y$+q(i#9OOTY1?#@G(bO{pD4bqKth)5s0Tj0=j=(>Zy?|%2rpFGTYX7*mQ;$824
zm$YD>vbiG>&Q?ijNdHu@Q_$Omsru?XgFQyhL+RKgEI`O*Akd}Xs_hJ%ON%Ic!40z9
z6LvW2!XH(bEq;dg!)oyTfzAys>sKL3Q(VeZ^Ynrm;?>2gUSv*;y@vjtvtv&699w>q
zQT!ig<{9WsMO34Jcs-)wGi?(@{PA>XokNU<S8Hg=<<~WlyDHI(TZ4p_NKPFlx5|kh
zYuisWrz@xN+!^mp<`cH~IyiJNe^|T%6=U<URr-f|8w}*D+|r%89mH|;jc*+O9&Zu9
z08+EX^}7_~!>o4FqvfT1ne;2dWlPbxsyy>1@ZC-zy-hTiqNB0Pa8Rjw1uNql$A}$~
z@)~<_7(|J*5HkCuloio!nAVy7z#-{_e4DZ+!ufl4OqS=+;rB+N?ZcYohhzfqn45u~
z(@?8b7p%A`Xa@A{?weJK>q*+b+pM!h8O9i4v>Z1XB;Q<D4U}y7(T{0~3p$t7M&5cO
zTb5q6Q0QC|5&MitWaTSQ3;;9j##`gCFCWzkteD&`7oxH*`f2I9WxC8YFU+Jh7yUDn
zf2#e|!BT?w5KZZ0iO)=Su-pFnsC2d;`@_7|v^T+r^H)|$>vs2FG{O%hf<N9|$gD6X
z)p$WoGxPPf8~7piheAq7!r_^I+eLIhpTQX%9r`bM4oF<`8LYU%%||P7&dyVR)2!1X
zIUGst{6jpI+BVAeN~#&nCZRfdiB65$Kk2Q<%*oSt6nnfo2OM6=&z9}p(W3_DM+`wu
z+3|pq+i9n0b)LSsU+HjJX>_j(9EJ*9_9KX$!+P@x?{pqM$}ax3$1M%&kO*M=LiQOq
zK4{p4(Cm)Mp_(E)x(fGACq#g<c*0jAGaYw@w@WBkW-4{cBf?ct8lGV%dSIu(VqcDk
zJHc`^(@<{w&7|ookCM?9ir#Bi<X?X>fRr4YTas9A0Vo(1rc_3;KfkAGP#03cIFgr$
zX}^`0EPdPEH3bw40y8Z{#C)y=|Cg5OrwmS__HgWowzxI;BltB}K2^iZ>vh^nZk!NI
zX4}4<cY@CHm%Xto81yntJ&@86^y5T99~`>P;-DLU#77A)4<Sa|I6?iKe0}UG^EWEG
zLKDqXRM5&bxT}d@K|1;k5I^13P3z}B3r^T`9RnW0K3N=uGyZUlW(30F6>6ok3YjHu
zw{}vl3AHOZl@&ulq$(TOGg6+sLSi{X+-h}R#4#k^8nd+8DTY$qshTx)@1n}M;7&7b
zay6zr@-5;NO4aT0X2<;4`c`LXQ`Lk!sO{MZY<M4WP0XCOxIvri=O5Lp)mW&=a?-tF
zXi55E+&O@0W42KH4isUVX7TS*`Pb?SUfhDA(V7P%*A?L{(9X(=d`d2sx#~-y_e^?=
zZfeT{^hlUKUqW!>3nUkY>O3`ip)(U5dkPgKe(;^N%4;7-LWwriP0^9u=Yx+leGbW6
zarki}VfXFSYOFk=j{I0hj68vrH)N)*`3AcO=VI5uR9K^FNfK!1e`(JDoF2-EpDla3
z{wzKolSlle>0VlDh1G3^1zlWqsgWxG7;mQv4{il<qSXNx+x;8LoOJK<n`}VO=%w0u
z)cX&3^aO;H=^W+n2_|_zm>&lp5yLr~Gu0l$?ej+;ESvV$A8>d-uS%L)QkiNpNx7Fs
z^ee(Sr}nPRtnJ+wQ7||R(qLjn!;c6eqld%Wv!y5sS5S`=G~3`%dq#8lZ`Sh3`TA_3
zHLztFbyj6*I43jd5pSc-$?Ro@DXqv>PMNOXq_!vypFl)0<DByc%}sx)M8&Yusu!6!
zDv^0(?7l0FtasC%>*#?9kmVIP45%iP@z?$AX`5B5_<k$#MabE)V;D^(&rFZwDv0}S
zqrkZ|ILRHE@_5(B^imL7ttswM?G^To?_DpsADOe--TeHw8db4s{AReFQQzqPOX4B5
zH=>sGc18%^86_HAarv6xLmN7U^%}YuuxuP5hx9(YMGTyT$OKa^iiUX_&K!aIczD(I
zlG(J$*H;Focr0iUJ;x?_`E!)sPWmJ<1lMazliqxG@8<iR93p18g6s`s0rqNX_{$)v
z|D_KAH1gelCsJOf2KE1=L#$T^ua2(ZG3->yfV}k!7$Wewc(BnpOi`5L`*nqZDJtwB
zJ(w!irC13M4r6>l>bscMa9O-3vPYuOOH&?`iZ#r`La<8~+}hwCQz9)#Whw=^jI#Ha
zaGxOLB~jzs^~SXM04xtSzj#6Ywa;qb&L^v*Gz}tc@%W6?DlfZ9-jW~Z=Sp+`mj3bX
zZ-<w(+A>~f-$j+N!-=$&UPDZKmb$_&!F)qzZ^2Lc#1_rJLyOJx98c_YO=QtHM9P*Z
zXj*!)Q}3S_?<hvD&c9A=7N2)NSUWmr6-V3NJ67CB43c4B$M5vZX&`rvV*Os6H855l
zx94p9{W}brHFdCD=+shY;7L=sH=8bKyj1s^xnfDIGY8?PAApNN>4H}q`WU|H#f(&<
zg8IK~A+WgG>%s`&<5GvpN&|^)o%Uq9w5BKv#xDj>tXmO-i`d@|&V$2_P@+_16A5lC
zZ!LC>&f1%#V#hts%#dtpVF05$xKu>yVBULyo4JhbD7Z1GUli{9@2>v)Ai97LVq|Of
zw{2-EJ&U)@r)jHJ1I$ei+mgMC%=Oi5v5_CzieIAASXpYaB*uQ;wy6zrH$sW12R|K{
zF7$eyS7fz_oSY`RGo;WxJh~ua{#-O(sT0$1T6%bED!iXweariLhU_xKkqfaN!;vGk
zS8Eb7@tUg&-o>0L9>;r#%J2MdM0Nwr9cCxxI6=0N3u)GHq<U=uh5ET2LvkBulm%0a
z*%>aCdlQci|4D(6BE1cUv&YGLDCy~+?0!76zC`pQrqP~G{9;9ER`sm9yj?Rh<#$MJ
zT&$@m=F2;u$8ntHhb%{`K58R%%x}hI^8@J)2!=LmbF!{%eQKw@{r&bSr11})DuV5l
zt+$V(c*%$S!1ySf%jd#Y83bYVa<FH|4gAjg1GL?i;vN%;$m58&*%?k&uq@QbrbG-O
z*`!#%djYYtJR?>}qx}+rdV$nH6|J_@GsTPg+2`1Tmj&Oteht;rBBLS>p0VW}%m|Jm
z4t9B&I??s@1%SbNsLrJyhp4CF8gP>1cv|UMWf@oD(+FA-ITs&2&kLf}l&0{;EUm1p
z95o8oba;5aT+tB<Arw@Tz#l0*n&+fepLy%sYM2im%eC>`R(HM0=lNa7vJJ*aI@i+E
z9Z}$t3Z3CI#>aQ&SKN#2%~C38gJ4uS{39&;1ddP%%Z}}T^o85wB%4Q27rH(rm5~v@
z8p7$~K#3`8p<*ef=#FWm2rLBg?h%d*LVZZSmGl#uWupaNwoE+P-DBJhf(~?knzU1L
z@Ih%6e4sk2q{D|<{IW1J+{LC-O;SIS<nC)|ST<a0QHaOV#kSAfMx1n&OvG~H4e7!D
z>UeE(n>ardUlR@Nz~P|FKokuJrk*D31`(|@zmk=M{af8s5CUsu%u+(cQZ&TgHrEJD
zAVJAARhg?3j@K}tb$S6LKt1e<HJZUIxdA6#Yrltj^L<%5qF)0cL-e+h$0wK~y;{-!
z4k3usD5-uB7vYcZN1HABQ*DzjrVqq}3#X{Q=AF!zA@rw-x<)n~^rtDhyeozRA8dzp
z7015sT}}V7i&u2%WT?GI<S!RhsbBKuFPA?Y@>Q|<7-^6;uHZ+vGFGzft6)O!oukye
zh00H!Iv;eKHZ4orWGO<m+lRA6`t?FQ(moyQk9XJf{onR$4m&)%=972twGeX^le!WG
zRUPcsYKiBn^z%O5o?A^dk+RxAqB0h+X4`hhPa*xpg$hP!sHo=Ts9@><M94co!U`DB
z5E;7bl3WFpvK9~8c~hhF3Zy{(c9@?OTA1P!k+~sWH{ybo%q6U;1qZUmO8q8eHU`a2
z*S)LJ-IKJm_=!B8P9`!e9H`>+n#Bi&<wPmB#P~LR>H}EgDnTzW8>Yi?h8!8h$+0fz
ze2!o-k`^?mL1%gskw_?DClz;II<dv>GEG>t6zbX;j!qi4$7Qjxe5?4d(+@gJTL3Ey
z`%yy=XEN5-0cDrCi{0@pfWk9bt`G5nswRsJ5m?9JdNdc(N=Qg7$n!cZi^YDQL4|@)
zz__{eVyc0wj<6trJ<}h8jCHy<MQ=SAKSPcNifZ*fAPbf>y^;R9LW-LjBkY597VXpb
zo5hzQrw-KHRlN|)%t#k$)OLte>;DMCV>2XqQFf}TVr3gQ1feBSXVhw^=5u|$2ou(E
z9YK0N)mF+`uk64leLExdb5mNqLCQI~dKDe*%Aj9x@oxGa=k1(b`~n(Xo>tLU2CWWi
zXrIxRav?3<m31s*kz&5pL_UK?5syHe(X05sykGk`{ruq?FL5VY#O;%rb>aF;4Qr{)
z!4<ngUdvxId+OOup``}N&F`A7Oma})oCe$9+#rAiEptD|4lx)sphP9J#tX0rm=ts(
zua>yq`vvx;`^~$KrC%f55#{s_73_FXw<3mx`bT)2tj50Z4OPhoGmBa6H4z}F|E=1{
z#QiH&aMBBp$oYCz60VFGPm10`QFefil2ZVd(eEw~pu9LaUr5;b)=jqdcI6b9;yQ2b
zkhXg##mSv3C@XJ|seqm-V7OY{df`5@3G^)K2)Cfg*mLyA?s?E%YfL4SXkpFM{DEC;
zvpl`HlA3;O_Ig_y{u{wK+8wTlIH<*TNxe(u4djMqYp~C!#dR0+SQHe@P#;n{*+T6`
zMZ<e%$(xUjmlAmW@J%Y`_%>hrzy?y+r=SPdjyfgT->d9APpA9gbOVXNvn(2zLFe>5
zh`U_0wf6HGM)gGI^ImSTRkI3NsfLr^3EuQa-JrtechGnci(X>}VvY}a;Zj&==->Wq
z!+J6SE-o(SPc5%6_h%%Plw#a$Wr_+5*8v*@2$|U5o2}wfVi&iH1#em#6h6PB*9S~p
z7#3uN2!bsM#Ml~hl@locF(xRE05MO2=^!cn^-C(aeMn7RJuw9Z^)X-%0?7pkV}#r`
zcy@Mnr~5NZdnpyuvS|+FAug8#)HmD6URj30QI~h!%rZ}O510b3t$7Nm3lW1(3h%rW
zoGwon1ck2V=)krSQ!1W?OEB@0Q|i@quNp{w*SGdyv9KaLd>>vD5`_6w(<Hd}>5?81
zYfAo{9OdvC#eDj!s;!Tam7y)&EX>o6Id!1+4x+0lc5>k=8pEm$yTxPGJ-5btbVHVH
zc#4HCA$2Y((C60Cwin|c``!3Aws!uK&WP0lp`W&`Bzh_SoyO(Uqt9}?H*QKwitl$R
zK#WPPLWg6OOFLf*HHKW2Y=3_r1p}i$gV&L7<WV&J`**5<rw6OqT#S(!_}3>;>`2yk
zUGZ78DhUhnJ#jb#!-u)XK9O5yO&T?oziK&`80Pgh3DYa_?A|#yj1auyN##?ps2_=I
zuQHyBiEAk~PKv?o`eD2kgV~mETo8lFt$AvWNX($~tbv4l@J@%fAjB<MN54n!)vS^y
zO#PQ&wxXry{9rb-2J-sW;Bh7$<(}QiBgHHAkEaW6K3qBKn^P_#Me9j>S0*BPz)D^j
zixjUH?0E>D!&(R)n@H{6k|bD+rw_ogF;l4oX5*lOhl5NcFXp9to;FZX{i5eJ+yVju
z?3P=w0qWG&9CpT5v%`u20y6Ri{jP3aYT_J6jYfbKqLB2EFfaPSJlZ|WW}$u%)^$63
zg*g8-c@sKoUSvx;UKB3ZeZJ-`COFzFc8*ej1ggSc96}~SW4e;C!?55B!@2-W#z0I?
zG@N6vGKHVsZz7p!pSqw`Q96!ebRX#bMGrT~i@UMwL=-LKAp=ALu=jV?)$<VS(*E>(
z>z=ndP9txzvgPldC9004W<Hp6fWnb_O>mr<DA8MycMCN0TIU_!4j!=6E@q0AbjkDz
z><Jr6r{&6q_khv87*-f*pgvJ6s`C$D0U^Bm-Kp*E?XX(Yfz949w1=njf*tJoYj-E7
z?oxGX^&$mx%`!crZKh<|+o)bn?Hd{G3eCiTaD2v(xob=el@|joU!6QWZlkurKiq8(
z=YJxLboN9<D69w4*TZzg;N+&lbK5Vzf09bZ_=t;hR}H#7ryUs`<p6j$4c_dPdvtFB
zd9}*33+Ubv+OIH#Zczq==Ip`OF+<PZQF6~HLSL^Y2bs9HNgZUvT>>$pTOvJkII#>K
zq5G&N67U;uNP^lvMEG1#0M(@YjjY4dML2K#YiyFhh!(*c3eU7TEJsRaaLy_<i6{9m
z1{*%k-Dp4AQ;m1G9bWg&XvRd%XGsxqKBG?GcI_&^`zw-7|DyQ@G@i;JM6Yw$oYT2<
z#G$!Sdo@5HZ*>dMkd?3DU#}y>`Mi;7;(-+r5jD_u&2PCF3L{KOnU}-J<GT+~(M8|G
z<AwZ=BNfay>hhP9lS@c>1%zwag+<`3blC@?8{-~P+h)tL%ne~THpA2R(hDEPjoKwX
z^^PjJW`uQ(p~^RV%j|NR59Mm?vZB0-TZgHvsH$=DaQ)=VnJqltd0oOLADEqxpw@(=
zKNKW9xK{HSzPGox)4F9Bpf{<Ps!^_@Q3R^WL3Sf(tw1-Yl$n{CPV3#UPv9`b3+<{;
ziL<Y9fa{KwR!mh+4wBKov#6t^V|=>a!|<UH#btMFG~9<1#mrXoNfdP*_ip7EsJrXE
z_K{^It&R!1Cm`PT-f=Y(tIyQF-fZxz)j}ODAec9}+r$C6|Ne^}h~g3w{Q7WEm)!5~
zt%E5gzpNiELHU&=B)atM#vp)V+XO&{{5zVFI(}_RByzIa!Bm;3`{m0QA>2|Jk-SWX
z*^JSh=Gkha9ITFXe%E3*#o3pePS4JI07`ZdEm8lF?j|mhtKGZc!=~vdwJ}W(uLw#S
z8mQlkoqa6(Knp0f0^K#WCIU3{c>!G`t_BU595t1%(a~s&P4>eZahEp8h=}sd51zHR
zwdgx4nS4P{kM{*u>Vpzb%&@QE6`FQFX^n2b#`#bT$lIL(&B8?LNgQBz$!R%cRT+|i
z82gB6(l<;vPee$#4&2&4GC!Y&g^1rxpS<!5=hfxjRQR)`!(0{V`1xG{9yxhDKo30)
zxH((|Y>a>0We_x2Z!?HXndg|;+{~MkF<PZQtIrI)fGLgGe?M=IT-%?pK=sEijjm0;
zHm5>6ZWPU=gA@o_yRO00)6;z2Kik@<-@S{hZtK4?2c7>#Rml+<g}3xTpS7*^Ix}H5
zXiXm9H~{B`01IkVTw2P2PAZUWlmReCH%~9Q?{;$n)(;NQK7RbD^!@!imXPf#gSJBM
z&`_7`dA|(d1mn5${^&PFMZi8jOT$4!IRRr+^B_0~x;fo|H}W}HY_t^;q|az8%+K!?
zk6Qu%9sMfJF2=0iWVh(iB$Mh(ngZ$n^(z#4advjLx7WyCQBe_)mUOwfd%FUp7e>{G
zt+wD?*qE4@PCn5{;Zoy^4+F8p1LR6Ieme1P1v0Vh0P{QT`*;7#Q*+9^Oezl}%Q>I5
zPCsur3SbjXQelMiluUBx0D5;d=BLn5|6&|mT<<TUO{aH80gY5({V*2&+0Pd{jcb2n
ziM35<e$eW)IPnxK5yj7xr~1!1(-?**XK?y#$w*i4tk!I-wKImyRX=~#wm5HfXX@-7
z{yA6m?Yi!LweE$Z;rE_HL5*YD^pVbk7{iKnX=}ruAAV|A7#rSvH0<;Z`oN}N47q)k
zow`$`Xr6t~mK|=`(VFkHA>rFeJgiX0aHR$)tK$Cw<m|@P264XojtYFO2oJ%qHWi+M
z+X;Q5sr^}KmyS7WG2a>uto0f_Ea>Iak+I`2=TWM(U+Q{Iav1hUE+91Q)&l;X;=Sg?
zs+;M@hBv%|*KR&8$cTf7i9JC<oNbm)VuAW}_xEj#^I=Qls;gtmot@_%3ia{vBXQPO
zS1AjWAsy|9-xjB)RC=0DPt_VQn%mk&X01J3lNK053=Gm)xaRxA7O0Z4vPSXkejoiU
zgd8}zB{y4tCnYiKOzFA0q9Ym^`eeYuZXEauOG#K*n7^<#FZqyLA1{+O)3`5MmyP70
z$W(YjqgY9N^gFjR6r#R||5TnFb+0Z`<Bs;*mj6lVaTnW<M;~E1S)YcF8-F~B`m?nM
zzKqP=I=(mB$@bOl%>(Q5(Wuh`7%w|WJ^?+S0OwAmHVn$7SxR9Hcrw9%u8LtGf;Qf`
zkDXqLFeCycAT<2`T~L+LXIRkr)09|zI_d78L<8SaCqUknf4w%K%E$%K&AkD?=b^V=
z;GE59CD3nn*j`{yZ)|9|sZnWamynV|$S)|kWmo3OOu7Y1#<d!)6(*}HGK_EDHeQm|
z%$`az;fYI5yCG&w32^nJeQE{6B){5|2@*xt+@z9Z+}WkM(z>3K&0=S{%Z<B>nY^Bk
zg+=^*V{;EIIn4jO)mhRt*12efG_3RGp9l|xUpqQcgVDG2ntCHfwWoqkR#@yvricr8
zjruIx!xr-sA;Q2Z$h-vLQd3F#7f{IQU_o%uIxYyQNPCjxa-_zO7WZq8d{f8uog-v9
zd3j{crYjPzjMRZI1NA?_fPC{#AJ^9ACgh@R>UtX$NPVqrY+TkeMEnGdxLknG*O!%X
zcx>=XV=Xr=5ltO`xzS{sejG%-oW~;5X`sY1FAbcJ1ghrz0I|Lg$feg`-M|>ZWRX~@
z>%ZBpSS);#;wX%Syv6`IAsZYfgbW$;tdJU$u+A~bop_ob@B#9_s6FGNy$6SI$z=;z
z7TD+Rp)Xfm8v<lo4Dig-G^W@?DL6n?$3`ExI<ZxPo#RFP8QU2JHM)O`e!NKgv|4@o
zn}OB570RJQ$+~$2cI*2S4EOl9$x57sBhoOON?Gdl&jQIJXLB;6jQAWM6*>Rz&Wsup
z8ga|!f4bJ+ALe6*tVIMIKVZoA9(<O8_<As*d?Cp8x})@SzAWj~v-(&~JPn_-zNL%|
zb(}%Hua;G4eg)+5wft37>d^_{>Qo@fXGnC{U}#hLuM$`*NiM<W>v(?On^Oqm_|+M7
z4LdI_n&d!h?BfbAOMoF8o6p>4=|62Jj55Ie9$e|prSuUiVfGIFxttzc?(T=jnh+i^
zoBxs6WIq2fA|NTaE$BC4$t03_ltL3evjzry$+5&uAM~m3%~{oa0F>(MLRTt%B46tf
zLhwmPk{uq-okFd-%RKjQP&-i4bTa?n2xPAPKZTy0T*MwYPqMw^XthIMkBWw-kO6Qb
z=`W$=<sCAuGr})v59b?ki^s-LFdwjTWw&7sclc^OsjqB5ePKJI4iOR+h$9dB-u9-4
z6gD?!=_AQ}E!hAxW@GDs0jR#S6Tob^`p?OYKZ&?3<P?GJ{0n@F|DvF|_G5PLu5?Zx
zG9~&=DW;$n;Sn(jGZqM^1`XqK)4ZqWPzQ&>YygesPtqj>QEg@2*b@O52QBK6DYi%#
zB($i~g^W0H28XiF35D=ab-JMki|JMyS|w0ljUC5P;fHts%4ou#ugw+~MT&Px*zLQz
zPK2I%4+UkXHp7#Kcck=^eyhzE!%SSQi2L`kJkvGJnk7<6dlBf@K2;~E$pA|<M1urc
zX?4ftRm!s~$wUEdxMf$(jTsLla-E{01;)oBc^rzs$&#xI1O(iq9ZM!j#MaoIh>skt
z;e=i6NUVOvXSdo%n)kw8#)kO<KFfSRTcA>jsnhB}u%9{_|H*v+^V5*E6}Xfe)2LCF
zu*bkELQtg&68;GTWITNQ4Kh(k)zzbI14b0&hB_<T!wbCsn*6QMv{KL+wG$ogapm=9
zaX4(HZNX!&<Y|E^BGS^<{BqSFWp~}jPd^z=p8QEeTMZ-zzBGaz`-pCkTPeD)-=<ty
z2W3xr_EC2ut{S4RldPYZ$9Q*S6!5ZnhQ-&zHYpKD{Me2<-@<1!B9$zz3azcgZ!e^P
z*p!EmE;UJvPvRJkec@{{6=pSTlUbq#0{{z<pQh{lUOe9(E&%c!uZNr322J2^{}RkN
z^*A_T#`uWS?w{Wz)tV2?=7IFwX<T#K@rf6jCHz{2g7EDQa?U~c1hck?TV^Lbta?vG
z;W$3-0b0kAsalPlEeUU<tXZ;Xrdw04R#iJ;yE?x5gm^^6tH8(p?b46c+;M4tf>!ro
z-88D>h3`@#qM*`d4R4^$F;bm4A8Vk?AEjjO)Y93M;zz_Umt&p&%zwE)<p2{;w_*w~
z1M>(dcyH>+I*ctz(x%|0%Q5@hMQ6DnQDVsMfV7_{fj{imY*EL7=$kfOv=PBl*k>5a
zoBJhfnjg99<NQu2&_EV(n?4Ednh!^>9!F_9zJ11Ct(nt{{_>63G(3gFw;koG{cyvs
z{mqdLPj}|y+tWJXX#d!KQ|NEp)6?3JjDJSQ_L7`JCX3K`?B=`cU4T3vusR%^A@L#p
z+}&sh19|4!d$|7SM?`metTgiUFDB;urfpUD`KaCV3BW<F;`@mfV@bP7V>Huyxi6-Z
zPn|pi;7+lR%)-uyi5##9AYxRgjd8~!H%OEXA<V1qDi{ZBDhzVJf34Jd>g^MR@R3f|
zGT)|;RjuAlN-h^ISYpq2j9Fp@Zl>nru+n+9f*2cLH(8sdhvWofz*dxC#?tOrRA@Wu
zSi4`=hD9BD)_2eT4O<>|QGRmn{p)UNTYZFy`@O^Op}t{^d20}kG)`|4I_0;+!rns&
zBWc{o^q1(~)nvp?dq)R>OtQOqdV2~wPI_3ZNEvEHa)?UHzENUeprn3@VF_wHiT?$$
z;!GYlu9&fjr9(bY10<B?dkV@m_*ZUmEXP4EYj3Y#kuXRW{B=FoEeV#-(I%uuPSi^;
zr@xzEMy+|*ZvLi@-?!5`xB0kSOcfE7E>_Jort3=$K@?c;KFnqSrpll%qnsy0Ask>+
z*9#rEH%S`h6ZO(Q4YrF!OAX5Fs^FdNBNQxs_ZT}ZSnkExUg@cW(=*pE%@_D~S*wVM
zQH{UUB{f9;PAx6rl%%3dRCaw4Uz@;0y0^%8#>Fp9*X>@K`rfSqg#bGXT;^|H&;lG+
zXlPxziv=eExri!TFzqMQv;6fntPM@kO4*Y;*!P1UF{0xkeX|gR6t=Y3Si$(d)upU`
zZ)yfGytwAvuoiB{PIXXr5$VxEWH*Isi~bMOsgz1~XBQdv9^Kaqny%zK_N!?6s;FtT
z2uyKwCAI#;m}zZ%)Cqyi6kz<Zx$)0aU%!Ey>%P%AoN@Lgl9t!r2m6C&m7A7>QxV_C
zRrQVR)jNM0MtLHmoA2<Z#oQ-+XSU)Nm{ZLHRXP0CbFp}O<t(Q-)cdv8YpQnH-o4gw
z%48&s2bL?fI%sF6{4^g#<}#?$-oB@!nL}%OmYZXk%|k^Losa+ym;}z4^*gCh<}oMy
zZ>(gr49;%nvRE<8-SzVmeY^c5^cES4itg)u^1Z!Z07P|A4BUA=ytbC}y!P5T7M#QI
z|H9a#L+-#FxWFaFjy8rZ>-6&AKLisfhujqu6eIxHPQBVtc)2UUNDn|P?iGPjgzm+!
zSKU2|slM|0>uA7k@Di$l(xCcHw6%`b*kq9+wSa)$%fI{lfB$ZtD|>=ViW_{>Vk{-g
z=riutjfQq1YiGx9VhZ;<MLPFQw_&~ghi=o3;0^3f6jYCK7?2&Y5#b|~I9p&G5y@sG
zOhA(rNCs?bdvq2yuM3xwg9y?*J~}`#BKPrXQ51`3=~>@WtQMyE&!<9c`*-#*h&V%=
zHPFz|tjiL>CrmGaS+i1)8@e|o`%<7zRl{_g{t*iWLAFk``u8k!agum!DXBzIHi-7+
zDdK0`Cv@XC5nU)f%S70nuB8y{@6~e$nvieOw*GuYC4BEoYZuavjlCc7xYY{&xh?&i
z9=<XBCGdj*Z+UbYzZN2{M`qsR@-r#);S=_zCx)WHT*21g9`LqXrdW!1l308b@~w{X
zV1&g(j&ugB?Yi9Sy@RC2++BGJ>#|xhWre>IRSL>A*L6g}9q1g@lB5FhIB9hozyMkM
z4aR@C0db?pk>0A7ySsZ4fZcbM0EICs>NepcBN*+XJ%+MUadNZ{kIr#U-0TxYP&Rpf
zKK%MoZoKlvK<;z*#C*8}4Dk^QgL;BkwXf(Wk825pEK{=<<O+0ElZmt-h^W`=lp{ez
zdNxmifE2$e+&qMk<GFF;5g7cK^foli;}pJT$9G83li0+I*<SGCTgpVk8qK9(aeG3@
zUx|&nOR()a`{4{Y<f(J}rtR9;j;~NzZ8y-A*dkZg-J|oTTA8js`mGO1u?i{1H-Ep{
z{bT~Tg>zH{CuZuB#w){^gC(@2UFPn;JeSrv4}_hYrEm~klfBZE2d^Wfs_-N?ozjwM
z?6``YNLXQkJpK48LLN(6H)UnMLT}Jw-@rKL7g;T1x$114_DeoH=Jz$`t6tE9g*Wx7
z_Cd9kMQ)Em`q}nV6B4Av7BRt5Lt+*4?j+jpc?-PX!F4by*RFxl#aCr?{)ku86gvnp
z!3xg~?|w$qSSipEa%Tr!9mkeM&q|Ju5IP)d0p<D2^`zszKOOmO^a>3vDdj=uUkJMU
zJj9dxhCCQz%r#=89kwRM)I=Ond4FYsC9Yck1E+gP-x(&R{c+u<27@~qx8iSE6bIVu
z`e_da;bap}^_0h<mRH!_q~%#i!46V#9;cRJnK)a;N(a3Dn|O&Z6YsJLl;0<6A*q$D
zJW3zM4S#6-P;s<dZpPBCsNOgYb<m_IM;Z}`3RL4wvm*UnTGe<{`yDeQDkOY-GwL_%
z!^f03qdY`RB3!<@&)HRrgoa&&Gv$FFcgIZa<A3|+*kI@vI070<v@nND&AfNlM{!6b
zB(As+`#_%vCe{klNE2xGk*s5&eknQC0|rNtxpZehGp!HG`6m>Dqr4_Fm?#aRgLih5
zu6#|0t1;fx0u!B@TKPyRWki&JhEZJac>dm}IL@Og@;Y?S&TvgMIlMDWDF<;C<?e3p
zq97MMS{Zdxe8ZQ#o|vk&AFxq^%n;sMciCjob%V!nj;kudU-IIY3ml*PKOycA7StNi
ziH&4A%FU3KLs7WL{^|Ns+Kg|eq%~VcP_32%{znk|SySJvKa1C?QKy!v+tDndL7Rto
z2@i&PKFrLZHn~1)I;8+>M2MmFkJK(R+ssBcaW94pPs?a`VOq6$mt&PsS>(;T!7v87
zYNqB4wD8x#ztm(&{z~$qLM_OG*pA*1Y=&k{EuB4T@?_GKUPu|&5Tjo!NmDYGPg-Jr
zg3EHUdh0WpiuL%0R9r5CHpSCHtlG8Uacv41%A<0)(uU!4Z9mZCN6b-bs_ZYcS}?Hl
zbi1(mV~28ts3cg6B_m(H!-gT5jkj7OVEJuJ?dSXtU?v6gutm(E#1P>eG>C&crr-D4
zyqY2o^LuHX0|zPUJ65zA2>Q%{*6CS8P<Sf5-K9sqH2+;TBd_`^P-hSiA7?dkz_<jy
zZNA@t2LxQpBG7Cf{8gHeBDFi2g?{7sGYjBnAk80NWsCX-H<wMO0`Q2a@(Z%~D|k<0
z;p0NFEE@+pCC`9*Gfhb3mwDF(g2+g0vj8i5k}x>D!(B>n+x|gR5|@snKI;RwKT|Jo
zgz7lUislyrC8GcWDk^0J%7p}jUz{8G9__~ma5PGD&v&w~+5FyM(}C(`f01QViPyv%
zg(T48#_jvdg~F&bLZeOwkW(%TPt0dYcC>uSuH#a1F}?Z&I~|Y@g;000*vT{2ik+wz
zZsszSqm}kv<W>Gj)D{ZLW#L6*_qoc9cUISq{V=#-K&;y7p0b4sURd#C>3ehG$RZB!
z1L+q19H}`0#Kdwj+7ZG0Aei7uW4H-LeL4jYfB8G|);(NftV?C;8=sVYb}|CrMDJid
zQJ?IF{<SsK?Bf&!FB3>H5M|1E`QEo7|L|NyoEQoX<vak!yLeq45`Fmap^#P-@E0z*
zQnSi=hd+!mV#0#tL7XWJ!K~U_Ay!6h=vc?JtP#aW0{Q-VLVpat1Cd|Cu8>%Tl{omk
zB9*PukoE7FHYzS}W}tS$n`dUsx3;%VzaMDz)?>o(pi~vLKk5;n-$xeXz<*#`GRP!%
zU)hyX399(VEQ1ij={!r;F7nq#LQYX>ozO1>$Fi*%X#Lob3VhsIUP~-Jkg%D^MJu!m
zsSaN8*;+*B!tiFtn4itjm=d)Bk{)AfE9`I0_qeuMv<OD^p2K!7%ky+LeA`v}wUR#X
z4DP@zio1&kV1jO!o-ibR1TjGl1eV}7XY3#PuW)C}dNbm7t=wLBWF+t2D`vjoe%l}u
zs}Po0{=qcZT9=bxw(p(t?@d!=RV>9)`;6cpMP_S})81(LQ-$X2wcH_0s$*0yW~hIu
znom4iy&PX-DK?b!+Rm^QG4715NMAlDXMM6M-Ac0_=M_F<-~*y!o<|!j-^S|!-ZrwV
zur9sW{>;G;byiPSyuBL2NJqn-{lA>=t2Ge&FLtF@^NZBVz3J_yJqHAT8veYeEG8_U
zB>TwpP5cS&Hj!7AGP!ydr+i#si?sTTtd;5RoF`QftMOKdG<WMF!qFSYBJv&lV(y39
z-an~bFbbMKLddvyC{DA@RI9E%^O|gNp%3$|pz*ve*EjEvwrH0Cv=leejQM}yfqm^j
zGTshVrB8%7xV^9Y2zXPM2*|L-mL#yrRhRPNA(;=}D>p3^q1Y9JoDN@V&*zPQ^&@I@
zh{^M){H)06p%jUTL(R8;(qtWO-HTKc@OMKmKluirYOiO^qbp>k@2Eoe5vOYNt-9FZ
z+M(O{%deGA$mQL8t&IZ6efapl_i5Vlw$8Aqh^r%x@Rx?=8hc_IG4m@LN6=@L@CM~5
z7H{J}?D_Te3Sr|xm<<ejusi)(8$>%qGfsAQX@Vp?j)PcFufCcsL$A!;A?>;+-<h}Q
zzTMxpfi3f{^FVbK8Fm@fIb08WkGEf6k@2`G(F-(D3$0YHZw}Qt*A<bGY!ubB2NNHS
zj}7zM^CK~;D*mDZ0nxNmx$LyF0d;gyCG0sVUd}`4OV@Xdo=Y9?KR%)M)Qh<myO%Au
zx_UC8M+&mIonx<?4P4*xF^Q)kmRx+P!avYk5gw?0%yIPC)<!w6*ZB=LnXq>h@A%hR
zYp9V`Efh|q7DR4DG2f4Ys=9W%V&<Ze6aT64uID&~S;RY*nya+{R6^>-%o5458r*v6
z)6H-rV%X&sB^yt+u~4oZ!LbxSq}<lWu+!K;w`b3(b?p!@o}rW=F(ANGE(#je=ttYz
zIX!i%-N{yqOL;-c0kkdI;BpvnOagwS9d0F(hOGgk!Fx{)UGbFyNS>u}z0yqird{%C
zZ5A^3EiT<jf!R7Q8FfN}lq0VFM2U*M68~`+)_5>SmA5i<%}E;WGiOJ{@0PJ|6JC)b
zfBCS=-jSdF-GFa@dO*!CvB(1rC!YEP%{*1UVy()Eo@kZch0$+|Ng>m5PS>ZQ0f+X3
zKE7UoTZ-X%z7rp;W<N9Y9M1<m($6^CUCRCaA&P?OX(sGi?d&BGWH@k?0NsXV^`Xmi
z_$Ja~wFmb`cHxY4{qN>0)#umC-nWK&8u?Ng1*O`RxYNQX8{Rkg4P~n^2T)p~S8PT+
z>-KuGvf*6>I78MiYakC~N_FK35I=Ir;4C<){pmb-4-Wd0vKAfSzt@WSl`Fk(JQ28%
zoo*%SLO&@mB`2Q}u2!UJ9<!Jm8`^g5OuvYKaX&3RI9rb`%e>=b!Skb;FcA|}=v3cP
zs{R9A=4e_1uQ3U^dF!)>0|q1Bk2w5A|MszHW54%*v=Qq)je0PGe=qS;eReZp5twF)
z{B$eW$Dp|=DQD^7>@TWm%?D2=uX+}wED0ixr}cZA`{`c2<&Yo_8H<c!Y>fn0kXvlj
zVHi7UR{jRt0(ob>x{G&%XTrR+$D`q>>2;4P=Q?vtY^-;i#Q|FMGNJ@O5G6x7%gl#U
zUIyE(b|euGv(hAExB;5r?;x=Rx!0t**Zqi7h>*eCd$IVAU0@!<jp(!~{TKyMyo1RL
zG~2!1;6)6NPfugJljg{aw!4S#&rnd}ejmiAYnXJl2EfB+J2<&sOKxWEy5S-EJw@E3
zZn&vBg*cjVu5vuxL6K^M{3F_)6+VO?P#^ye0}J=QY0fFufb7OUQ*g|uUU`NGsKKrJ
zCZBjd@VpFi$`bUHIbQzx*~W&E1s`YV3D`0kn&bkvo72z!Q*U`4@DPu+5PUi#qFz1p
zV~Uv-=0EbsSTvCH!cV*1y9`Sfv~TyQuX0)?H>1Cu8r>N;M;OSZ@H~!LhotPdIk_p<
zQ}GqU7b3jHXTgfYDUmd7C2g7NnGhM>16!r`yxb=Aen_8;gtlo@D^!-Z8MtrXCK0&v
z{kSped&6A|F)M3tA}&jn&AB3loK6H!4wU$qH^3u8Gxh-e2toljhMa49nq=HxRdZ4J
zOco2DH2(E+L_bv<b$$8qgYm?#N-Ym==o?e~r1{W}RqCy%MNX~Vf(wIQMa$&TnyE)S
zFxfHJEAlHeKKJXSK-cWHf5LD+p`YXSkhU1n-AH;<ecegJU%`r)1=pRvo<UM|4tbJO
zGlG{@0!rl<q!++jQVx!mt|MYp);k!m)ls{?nQl4u4*kZi)NkGpmifk{9n@Arj{M5}
zvTHVRA`%5Xj^+;&<x%8*cxa)Z!oiLi{c1~eR@>FtxK6R1?x*&`*p^Uzg#-U;^A69U
zk*1DYS@e)M|N6#{G-7PwdmDY>47znRbjsgD$8)*@gxV6o;{<JnC!$_4ka-$R4*rFS
zTHe>Pfu5&ej$}5YAjzna`z!Lzi>~COYnC|r(k0JzlpNRIIQ<%9%1_hajhd1Qe-(G7
zW#xJPmRvxz#(M2@#~p^T#b?Q!%dUWUBNwG*jODgx!gre@Kxx0U577IZ+}%g(`b)z?
zpUO>4O|c0H)67u`5Fy*_y88MTVh{iq|JS(9DYG2U{=C>=-A;P7KZ6D!7_zJF-nR!p
z+w=TLR08$vtQ6=By?tPBwwl;%9$_3HgKMyvi3*TO87c8RS$%1WKi{sy>ND#CxF}?4
z`{ZPNSCrcd3?nZuKly<&?~pn%Mw%hSVk|TA1$<y+RCod6p<KVRU(J<kV*&H_dQw>Q
zPXUIF-C_eOzz>iGI#hgzkAE67>6FsCeJ;#|LCiYuG>XvynJLQ3GaqX}=jXwdQ^#VB
zLton#XsNZ^0plJ`_=#Q`pp$@Z47=Z*n?D=B-(3TM)iU@1V6EDB!wyh?NN%xm#wIXj
z2Y4*Xyb2usUbE+?M-m}Gs|X&L#j{6Xy!k8gVW%Q5F9@JM6abTi<djD<^B;T)%gP4h
z{T^<dJ00lmvoPj>;di{q3P|Ez830k^cGs*%$Yz=Wv+?Zg%oj2PXi?p+83V#pCVyIi
z8pw0-_wO&FX$KPp16ah~lr&JImkxpQ>gwu)iE&RHV3@P-=;)A01wEADnQt{$4);zW
z69wuGR_anxQm2Rc71`gueQWp~pz-Mw38QvZOb|TsxuN82$atKn#Ry?%7KXFkbSXA+
z?wUM+FFd$b={Ls(9Dl(e&Ijbcyv{Ze*ZjABW4Im6#$p|rQ2>o}8fc{n*2qGFk4H5J
zC+Amyd+{g$RKyBX0PE1(kqll0SQ>IR0|SFj5~)0iu-xKeI+n+}<F&4M!0J8&T{2O-
zI#GCmtEa)i!O5>NCX#Y!1k8VSk)BjcI!YezF1OZpyZln^#xOG4{(v4{CUw2E$|a20
zu4*D;af}O)=R;^I^NeW!xc~{>QeeMK&i@WR$P9yGbl6trYydexUxuRa@bHGeU3-AV
zJO}}!rs!GJS+6?nj#p23LR}Z?%o(&Q2v5`>12{Q2Hr#DzD<Xlg4!}sjde7|vd*{pA
zP+wo)AO(;-Y|l3PA;5;E(4zfwo6vzMmcucJx}_%j`<=Xm$jC^NAwrrblv>IRI}t;`
z9*Ss<2o#kjTitC%+Rr?PdcAMY&G8u20^v{Q_JOg8zN^YF?RKp4e<d!E2>b^!Bu8NE
z5(#;+hx7B;>8Zbv5tbev9tvrnmF-ZlGXj3^<PZM(!j;1KF{%q|iS<REP2^Y7W$+`b
zNlwS7pDsdeHSO~x@;smFUnXM3#pde-6U+_|cG6#Y-rk%QxB=+m%gf~eC>g)pKpg2-
zP)u3@;8Po2oSioUXQ~VYg}hG1^uAZEuNwnw&did-C+t?I4LHZ8C`q1Y3~1W?Ii}sx
z31?`MIg5EmvK>k#6&M(fd-l1G8G9`C7fk%6(^KhT39wNCar1s5qxate=ILmXXH4cY
zv$M&vMFUt_ZfgMwNr)Su21GV}dvo)z+vQ(4FA8c>A+@!%(+y*@zB*j+^(V~OIy1s2
zCLYG^Mkiz!)B9TWj100vu>@oTZ%n$ohF`0sd`$B*G{>D{VP?K*T61R+2Tab0{wi0F
z=fl>ER|1?y#W%U%RLMYpS3*LUo=3I{u)R|C0;K%>{KBI2{+;t$)Q5^U$FdQ^qo%mE
zFDw}r`MGC!;o|OYF_G$%wK0Br`KD~LjOr4lin%0vZEfvTfRc!c`p8%NmsvUrZ)3QP
zfp`M=7^(k#j4xYQCj+oSckFF9dcziM=GW!|S5N4!(uqcDv&Y!1feC{`2c>0YWq?Tm
zPHrG_C4645_;9tnx|$7$$aiNiNz}im71cuD2e?hcT*8YB3-XHf@lR6Vd%fCAB-^>F
z$_DzE-VsC=0>nB%EDTVWtX<7kOZn%ZDk>_xsDf{9ysRVt$FdUCwDtfcGOMK~7IL61
zy@-bTDEAM$dI>YYbr&Y!x`RIM&zj<heV1sWA*+LvTk$sQr5^i#7lik}Ub(1@-8_bV
zawbdr<7Pjawe{7vw1R7QlQmpoy?z4yH?CLzkg`yke|rpgI<nK3Qb=O07$6sap2(LL
z(%34~C@CyjFoFY)7y(0ZHV#mmtR{llf&g~Wi=jO0>rhokM4$kV4{qLjxV@NfaW+k1
z*`^d@LzXvN0eZC_wE^8goRtBHHVMheG%TY;IJwvMCbp;q%sL4H+V9@Id-2P_-eV6h
zkIa5FzqZoX*MGr==M;g~xWdbO<T*|que5n*d_Jh!mO=&Jd%T3QljzI!m(J27dMz1|
z$C|o^Mp6pH8~uDr!Ad|j=-_{MxKjmCC6ukV7*zwDYfDRuoT6(skn-l3^(_N0$-;sS
ztm%-RL5ow+nx|H!9xcmY>F#(=f%Q}|WU-Oy>2{agx(uAd3fSaJ&P)S+#>d4C0XQsY
zhz_E@Hxw+R>A?FuF1CAf8C@%kWC1^Sr(0KByK#L01TQ&7P6bufc*nVk34k5@xcARs
zc%FRjpnJe(CH%8a;2mCCD7Uw_c>s0nrFB+(I95Sl4J4|ifZ!ha?{_pn=lXy5mLWWX
z<-+B3T^wMhYUq7s1$;Kye01Kngc2Pc-GiRj9ki_B@4!p)qec*c@zYfDHxRAzs;jZ!
z;o&z#=MUdHd3x?XL%ZCmM2P)|Mkc)i;^!L)@$e7;NZy&{71}O)eWFlaUY^(eRb_)T
zn)w?HVxAcIrJJ*@u6Nu|z|u?rZs)ztG|KhyN)ix9%wqv214XS^Jfi&}9c8j`|Bk9w
z)hATM^Eba@CKPKuXZT503S+5>8|!9?8=Q0|4vGxv&nVO96gp(kkheSZ#>#0#C@vHt
zuZP<u_P5hJ9Mh*2@!M%ueBM|>v!y?<X`aF<AFrHevz=9WzshF1B#HDK64Ku!9jV6?
z;wot78czVV2A9aU+uO)EW>M`9zRE6)Wcgc})L3J8quyW(PDMtt>s*;r`u)u23S~9w
zi~)=^&o^BmjrTJKW<^^>0dYWYW7@}JTfIGZ*7`$GYTFKeRvE^h#xSKL@zryC$tu4;
z`n8pR1S?nAhZo1X8YsO>8cWz3nY@P^IUK?~iXjai*F{(Kj@J5`i*)HlM<1-0G#e@^
z85<VRkF+eT@0D!_qU?1hUfJud5-nb*F8<6nKQfeGO7$)uIlqQ8zlN8t_X&ZLB@W_R
zFG;afke9@9tfb^y1$`~mXvPEvoE5QrVi1G?Jiqo`R>#%$7l$~0chBwO>biA(38XcO
z00E&+1^}@Vq&QO!EC2kFOJ*`c3h{~SCskc97If<4zTBOs#g`u$+f#A-x~RU1fLwM|
z)TAgaR9`vGQx=i5ptq^RRK`LZSDUc-$);XYipxmVGr4Sfu8>Dwn&x80O_os6PkPgd
zx(tIBvyHj2$MRUskN-fPB%i4<?pM#^2U~fP!gq~deg%!B7Ixkc!H&Es)JmPtxow}e
z$=MkAcLu}{I07PLk^^v%FNs!1=!-<ohzv&tXs<*OKdod2*7g6$ZB}60`*vaO#|GgS
z6uj`$8e5D+c59RKc#NDg(Mqp6X*l?_p|_i2aN;uO`+cv~a%>vu@1lgBPl6-v(BhX*
z_v^)1Jr(m>lgzeUQTDR681JkVi58Pg+P*sKD=ZQ=S7g0wXjVE>$$K=n3VCI(Zk>^A
zn@Y4;EI~Xvt%bkH?AUy6uU++6+-RyxoMJnCu3|g&%3e_8KE-y|+TNhEgQ>~qwyD|+
zD?#_kkfMXUa0U1837X4wc!N*qvS09h+OO;fOU4HkxR6C<*-kibY%(%ddjOA>2Qoh2
zV}nlL+Zv!T<o~RNm(f*HSvg9+tor?ZBt0f>2PmNFrA_V=4h+~X`VWmv0I2njxA*r2
zI%iaA@7+YmZXf@4>&c%oiK*J?1~QP-)CH=EFlZ8>Fe3Sj!a#jhUWbzUhVZz5RI3&@
zprN7L>K~pnA{o2w$n`v0<nA0_AeCu3xFi-M<1$!-gZ_boa_V88`)h+uuL^tys>;5!
z8)WF~Y-|tn-rQvM{S2$q8qXH)1CCJKto@LVCLrq0#OOEQ#-&&J+W`uDh2INgXGQv9
zPf|dr==xOVb$QBR=qs1l`Q#2nkq*G`QnKUcUQ2^*^{cV=rz>LvbDgB5=qZ?~2;#{s
zvm*ffdd$ra4NQ#&9=78DbN?uQ!s$4dicw9)Dnhj3wkD_08kUU5kwx7WH5y%|*T{JC
zQxFJvY^Jb&>73@^N_}4F!5kLg9Hrgd-mlR?cjW_D*-{4j`~PUW(7@#Yq4Li2Q3<T*
z0e`Fp^PI36e%nd!lr*#rzjg=*a^4Yx(-nb<Wk<@d`jBqYean{n<}<>t2@&A<zUv`=
z8Ag!P$~3yTX({Gwd$DJ=dUPn{aXN@%W?Cs|<vQ3<=@ZUs*Lcfu4va8A@c7`WPAsU7
zVBwW3shr8tBzi>NoV7i>U{E$eR+mVl{n2zxZi%?PD*PG(h*DGZLxu=_y;f^qnGl1d
ze#v#K*mW#g8PVbc7Gj4+8H$kXGaF<#0I?(D4<Duvn^9*<lP`cs1BWZn-@cD{e$;U^
zbaG-hvIwfY92_EGGi0uO2QAsVM(WUx<g0OEsR|P+eiNV9YE3$}@LRsgxg)&%3bUci
z2)9UqK)OeQR=w84m07J35iR_<HB&5nafQRNM{}CR@b%9hm%kg+N+O#0zK~TO6xeM9
zGw3uRFwWY<)Go2EcP=~ad13|E_<mxWuKb7yOe&Pgg9}q{H{(XvuZU`!)M3)GWEsLA
z>3@d#=`!<cp9@btNklZN`*#^*scz@{C_KgpD)aJO^Dbxbbyr`rYe!dzt8Mdo9X*o|
zX6)mV^KUwtx+8$c$mVlk8E9B1h-jhR&R(x*IbEp-FTJ<OqEm{Zpj{eGH(I>DydX#d
z=V*ou=0e=87Vi6z?Z<B1>n;U8V8Dgr+S2CZ_Qa(dt&{!3je7XV1TiQcw>!l-xc_l_
z&}AG%HEmclW`uJ4Dn%?wE5kTHr8kJ}1E8tl{7QjG_mypMt=cQX00xM90)Z35>yG`V
zzT{gDl>E8#pp|%}j=Rf)3uEJ*k@U&QXEs>StKx&FaU@}i#lKuiyjfD=cP#2Z-S}-}
z!%82M#lI<xPPC1~>e%>8C1dxfdcX+7)dlwPSbc0mo3;NLFGqS8P$948v4MSsZWJSp
z2LD<j_bNdAgi3tr7CCLH3A-^|Xzv=srRO0`y~UWQVc!Ft=Lgh(x2$R(Bc^-;$M4I0
zZ|c=$s^j&`XFm?Zx?~5gwZO8|yL=5>LLqj7g`1Hv@U{8xcuvkW6iB+_o|P9`eRT05
zXy%TOO}U=q`p5>~FN40UnYMRWNBb)anp8_yxG`xkj$A8CB~HSxpHp=39$mBzoYuNZ
z_7-@yoRobL*jD`9=^yH5`>LvfD700Wfa>N-L&)2U9Ekq|7jIOZ+;{ns_qnmo9CbQW
zTd@B|pZ*PpvhKB>cw_ee;O_NkgQ6yq?Y_wq8~l9gO~oIcnn(xvP|w;#h`4cEKj4dV
z6hc3KO7RPw^!v=f(1A<NMxT8J$t)TC>_mWS`|pLH0R;oeTwdo{eftYiYXBd0YmAgX
z7jKAX$Of!<1%sm`G|^#5I<iO<M*p;~Mt`spJ^NlF`fZ2P`iS3hUTdUEH_Kv**)>w<
z7teKjDB%R&G@XVw61cv=R82Rt-_~n?C1`iMB%-eP(GGP;=e6xED(si|*T&~T!CJwr
zue5Ye-#R>?AA`oR<$J7Rh+v6fGgHT0rPNQ~7C#eKy~V=zy2Tf2$fgPnRz~tp)E4cw
z8%BN4xCVE?BimziA}j$l?7n=^Kv0BNA~Sm%9Ct=g^#c!`2&Qvj1l%gduLK+qx3W?B
zd{>62#yNFM*!jCv#Q@wnhj;^-^!XIk6Cq&FZvB7gddr|VzAt_gcXyZI1a})WfdqGV
zcL>fPVep^<f(3`*1czXQ1_(a56CeZzCop&*+uz^+#qL(^zN3mNq^EE9z2`jV`FLUt
zI)^kma!2xqMI0Z-c^f@OFm-OjjweZ13WMH8WOGBHxYbylIXJhZsW!nEeEBn>uLL}N
zK@Vut99vf$&phxenH#btOsoD!b#Q9o`c7q|^abHxE@y<qUp$KLv%%+!kUL$0TWIku
zl%%+FTaFH4tAU&-YNk^)$pm-lQF#G%ych-Fkxc4(yBvkKdiG)%)^X&^`IQv4g7go_
z^YzdBbxx@j`J&_n=<iq~M#r)GMT&-YCOsr-WL2=*jFx2CKHegqEyO}aW#^h$KT@jx
z?megmRrkIqE(1$dFFafJ|2cVClYygE<MsY8@y3iyMf0-XiT(%CXUNS7epP-S?u{oD
zx#5a&`|AT)J4exw6#)XJ`stx41be+Kbvp#xd*e&2?mdm&?*!Ip5;}~FcFkV-qJN=6
z?D}3GETig(<%>2Qr>I4$rD$9+t2S$!EJ2s6x85>$@n?)hbJjDdCjobYCj?OT{<07x
zR9TEfC%vjLxrqD1M{iJWq&)bv;~z0yYS<_FpJOxLl8ERt`i7k_-L*26>-?&ese!-?
zISr<uZS4B<9^AMgL^uchk*N4~Jpt6}wbsh@FHb0yS{Q?it1ldp1Djbq#|C?mG__ml
zwbHz&@wz~X<M2~HeLnVnEc26IHp|cd$<WzV_nkgiKviQPF)r`|UPRb&96&MUDiZU#
z$lY@SmyULYgcr;km)tGBv1z_@#NCwrjqvXal8Yl2rEbDT*)}@S@lVQAU~Xfm9pMeV
zBx(Wau}&S>?!>!?O_FX*NdpDEr3>r+?M*j@yELpxFC7%zQBMDJYLis<84~~gE@3%?
zYx+pwX!!(3^!71`+$P!(U^=6kf?ThpxsO8-@CTL%U%7AwkBLvOV~#+Lwx|9QRv`lu
z=N+W^l4_xe;eji@Xl<&CK)zvIvHu`xY+SNn#cMraV4k8LZ|~%g4*R0++u7^PU3>wb
z4Hsv|tH^0FsqpJdz&=mDlTwVNgqmE77`RXL`uOT`nCOHphs_Q=WJo1GirOUR$1{<-
zBIin0vq&4yJQT3g&yH!VL)2F3Wz~8Xgd)3)P1Dd+xv!A3(JQGcUWB?x5Aj|qMLJv|
z7pYyMF}so7R}wP0psw4G>1~s?zDZ}2ojgJ0lyDk*;Y_w+s~$@HalfOceW?D&0LB$7
zR?KZ*X+0DplxpDLOaQmB%g1de;y>cB+_hMS;9b|?4Gohr5{-i~IFazAC?O>VX4Y$U
z)?3m<HP3joK)%>)x<#Y)nt{3bL4wB+WtnFu4yS1~f67^C3=s~&lNP&;UlawE$OtyF
zD`MsWk3MmneZdVv;~#5n`_E!Uat8T;l2)PIQ9}e?f***p-GdH)632x-dcqQm+eyNH
zqo-)*MC%TZmxkw2OLVYdS#}i>4T0CHr(Rz$_#2+Hv{HV3J)CeYV4p-I(jFr33l#$|
ze*Lg!K{yz-%@<kBKX-x3H)R^x{F~Nh<CTW9$8Ge{Zj`fO4Qp3&SFE>G#qZBg3+(I)
z|4vl4<{1<{1b6f0x|Td+s9)L=ztyIyzQwDRM#yhIC<%mrm!&iLg)y`lpk2L)B21~m
z6p6(1>WVb~M#|3k>zeaM0P3_mK`cw#>tj(Bod$XFe3=VE#Z>`y*Y&e*joAuSr#eet
z(pf35#-=cp1&?Oxl!bk}L*ulCrCg<jpWAow)m7SE90cd#QB}ANjXi2cB4=U5vPXVD
zrEjSf5PI*Il)D<HqGsQT?FnU~7W|ZTYOT4Xq~Pz1`FQ1LB^``=wH6>hRuk4}8%xet
z=hKgq$yH@gN5;LF6Rq}0jhF>(N63LQJtAG^2e-8v!Zg!vAId_e9G&&wld#{&Mm*sb
zlt|r@tYtPpdWYPx(EhALwvuVZVPz_Wy{yQ`tF|l@&-yK$AwY=1zVD53gC$Tj$y~B?
zESq^|ZFwcSI)#o)vFGveX|vsP^I__Emz&f~Xn1T4+iUBhu!^zXO3H8E%869!#w7a9
zgS)tUO0mZ1Tkkij|BAhK-DfMq(M71+$t`E!c4Ux6mR*IE$p7XONDfXOm34JCEyJF^
zmrXlE?n(Mqk>~ifHK&82z686&_ZXvRO0(3UoEzS)OZhk8jvKG+cu{dQt(*AcM|J;Q
zo7zCKA*qE@IcxH|C9Gegwm5U9iF4>{N<*Rq4L_UZ;J~oQJ?${3{D#eT^q$$bG`iE6
zDZP-Apx@z*s?z@m8#knJPcc14coQ}i{ltGYJgX5u{Oz+MQ(V<E!3T?j2K0WnbOwoI
zpPYe1ql?0sZe}baaAI&v6^C2|#KPkqw<7R2Be;K$#mr^q6~Eo2a5k=#q*<ycTC8Ew
zn#D10l%pnuQ{AiwlzNt1YA=VU=Anf*%Ztq-cW4mhxZhHAW8f=h513+c6eqUW`(qgf
z&?`qh{PH%DM*m<~Cq7GkIxadKi9h?Mcv)~CFF${_O;g2vB@7cA%}oc*nb|eKS+57(
z&{I{BC$q^iMq<b;XQ_(!K_fu%6E(WdXnm=F+w@AuwOElHnLjfTsK!vCR}nGO_)78<
z_p~_;n`+x&eBZ70KdJXYY7jo%D`dwu7bTDNq}!XOetz>~>a0L`jOBZ)C^?8NtX!WU
zz=+aQp#UuWE;sV4b8@BeR*mrIXMdDw%4!0}uH5mEf0`*dDPpJ7{kg>{Qxh%b!6cbA
z1cR#}ulq)g_uPH$-i${E3@O4PvdkYrJC$}1^qT#Rv8RHr>HP0?|5<?%D{`b+;M{w+
z=O!$e-UTBLxVba<-9kMH7Mv=y36oDJw!zzD*?*D=i~Cbvzk57;57ySMMnt0U0n7XP
zjVkk)GiuS#WwO3g6jgdnBsi4Lkx!3B%xOn1nw5{5oqq&MZ^&Hw!OLtzVl2sU&<`E(
ztw4iA2!h@&l?dg{k{RV&IebSx<ss8VYfWnkO^*e;R0db0!{{k92AHg$785O>aq6Xi
z<xb6-Q?yId{kMqq01c^1f|cGU>>{_(wSXUo+K9S;l<a(1Dk7&&Et=%lFK>q-oBTwY
z{xY{FWd_4@oW>nIs+47q7@hWMx}18Qpb>n@B)enV?Wr|Ug|bIJ;a2Wh0<$H#?S`i+
z56mKs!Mg_!0lyycb7X{Gc}V1gQ$DS1X1_ZN5B8FxCac}6U&_v#Gg!TTJXTvnS_gq=
z_+o)4aVbyrgL#`ARrOm4{3;740t6um-5lse#5iBFMGDQL)6ONa)bj`6!(<3~f_3{~
z^5oMJ%GKOTLm14QQo>@#GB~c-J^&SJB4P#kB8^EQdv0H2;~d?V;S=&Hup`;j{vMaF
zw)RKemTjw9WMt&r$z1{m#|a6}wdG}_YLl5#p%xwcgqzFDaeE-!qWtFK;)gvTE-81U
zenZZC{6?oWF;R`Zg)Qb&F7l^RdV2cIwSfWVjMLLo;aq4@Y%B)1epQ4RnO7rE?W&37
z3+jo=<y2yZ6HNY}01c4d`{QENh>)0pBqh#EC^hEq#RGOJO6d0Q(>Qo^+z)dW@&?8Y
z`3QcCo|2}Z=PZY>4@r;j$b#5pi+|dy4o^IOxVXM~{rA-APzj_bw_~G-mKidzEQd4m
zJO-oBWwX8Vx9kZT7!AU8kZa0wTZ&-tPK@;L_Ndh<d&V*seoVsj8IWEN7?nYycQtx_
z;3C#>fSX?=OTb3^^_76aPdlO7f6?Q1Q-%FM|AH86f+yI}DcO^hzJ7kWqwq2N4KnZX
z&K2lus_a)MMWbU>g(Xpu>dHu#8vc*!5!u#iM3syY;r_KHqv|27#(LD~-KN3-#oD6b
zUBQ%&Y+j0vE+Fhwtb0Z7U9m0nIa7})#Ac36#IqAUh3w*Ox;#v4Ex=`jPQ>*aK1SXG
z?29gAzQhfQAR2_nCUG{uyvnedRFmO-B7EWyxqSC8&{^z%mnTI-b{=VmY55|5>X^CP
zeO~_5H0s^uwj5d*&-RyyqmRN;`qi<J`5t0rWSbvjScn=u##5CQ=A0w6d=9FfR|CH_
z^;)YoFkTw|+|fFVnvokF@9QeH3#9MR(H@Qb)~}Z;*rGw{N8_#vVY)M?Gpv^m1930p
zVnm_3<JT?xLj#|@Wek~{_$#XQga+rjBSZ&f1+fj>QBwqXq&__HF-1o3e;z0j!Pb?5
zwwrX*{`L_aevZ;g^E)MN$A?2`HdC0B+Bb{aCmH58zFgh(U0_+7o=esZ)ASCFJa6i>
zA0yw*yNT&%T;rJ5OMlR$H`>NgNSoi!a5nW95t#{p5me?|0`67$I@|7Up>9Q#goTO`
z<<(R>gCueiO0tFKdV;LpvE(u745NusUT2OUU)kuvI$d5_`YQK1P!^Z4hIH~^ZSL`?
zXQ<Z_b+-MNiMeSjsi><)#K<fmmK{-bZloOxN2&9NSr{ly@nR%4UiIMTxLGp(vgSY<
zvz^YjVMF7h5-|-22qmNzH=tDK`Vc0~eK=+J!IVynw)E`>4C6*l2IeC?eT&&@UD2dm
z1!T}BX{e?isLRN>UjH>zms_Io9v!o*-)@X*v5Fi_5E#J^btH@mO=Y)LFKDL{jok$j
z*BXBLH55N-;TOfkYJ3~W-=2v(qwOPwf3<{uevbi6>=wG{Qp-H4zC;ywbhsG#+jdcb
zw~>=MK-==7L-3zbkRFET<oI^-y;h{SqqKCly5ocmr?B)55O#Lg=I-pw3hipC^a1Fa
zx2)++_Fhf2@0PCN$lpM^)=hSVrVBNxQld0vhHVdf7*$p+#I8%n38LLfAHP$MRP;}t
z@wF$@L^eCrmKkP(t4yHCuKI3CO}JCUo|vqX+DN1BS@FN0LP|ncKUW!a%DR4PfPgKG
zhF+c1d%|w8@I(B*8elq1EXY5tox*xI$tD>@X|E>;zYiyR-D^*GOc29=wxU<mRos62
zBA<>jL{;XTRI^GlPl>5ptcFZKVBYgbsqSon9NmXfu|T=jy5>4}2Gw?;>L<2u>yHB5
zm>MkzGrEO414AAMSxIJuVDdznqm@6}?6E-S7eZ=<R1~A9z?Io=gr9Xk9t}rmu90r{
zj-v6tG*s!FYtwE}4ryhHFW3qcI?^v@LfomKNWIlQ=v~GD)fy>{>56KX`H;4{3!njp
zJ^6cZt&IZGXzaUAPiSPtqLj^g#Q~O~gD-?r+wyCQ>o9n`znv1R6lppSR4qplXCrE6
zgN5!bTc`fnSs`NUeIsD(!2}&PPH{#_8_W68ac9=Xbs5kUJ34f6=zBy<`FT0Re5n02
z<qka3Ktb4x@dKp+1v({u8u|^!jBT|duaa?2vD|xzUNus9UgQ$~!PCd@U#RfVE^+tJ
zuhl2a#NL*=UPHxo?bB)9bcqu)HL6b#a;Vx|^i0*HceFPA_ovF(iw;k}ngCMx6Pv^D
z<uc9j(&ip0xTFhBmsYD(a|&6T%{mcQA*Svj`AU?*&Qw&PK9p^?_=>?;P{M9i+$C>l
z|BADagK}Kl64`eNH&AD;@JZ{g)Tn7!o7!f&L_n{ZEw|bNlm3r#H;sm1xF;)P;ne;<
z`kdAkxf86>-Qg3j1?IJDfc(MDl|b9Nx4yFg=E&$up!~VgxeHVolXt>Mh5BLI)zCF1
z3twfYVJ%tb+mMaK>{EopYELf$jV6mBUbuVfiXmJMrTe9Cdzs%<nnd4Y8LQyL+e<zz
zzp7ar;r;I{@>1?sfhbT>x2202Yfn!;`P4eR%N%m%RFeqH8#HLys3tSt4#i+KFco}x
z3Ju}GeW}((LHn|(a&Po)ge5^b67+;OfMt435=_#v_mU^b>3m=^)^+PehaO(IiBMLa
z{;lj{*!ElheC!jlNVB)rxUBQ-A^O?)%jzF-?d`r|!Q5S}mQdepQ))rn=mso=X!p7B
zbyo#6vO3rb!z<7$&_dq2TY-5Qqnit%uObIng;8X16zvY3npfo{gnW2tS}if%P+FXE
z#O7O`kek@?==6jgZuL%PaVv^HPSGdKIU#R5eQ6ka{W$l|#G3jw#9jcG$b=t4fNo9c
zEcdVp-b6=KiQ-h={EMPR`y_rSu@&-lw!%-C$C8YLdc0g!ff+rg1QCLyHtrqUpF9cv
zqqykYEizHadJL3!s${nHkKT`WaRF`5W+do2DoC=0!AC49gZFFy8k3t@sAu7%3wBx+
zee;&Qp6k$p<LZXdeNtYtJ&z5BU&?|dDO|$6!;wnsBdc4UADyf3JG77P*q;QzQ{YXz
zDvy{qEgrGjv`LQZdqQ5#!J&0uFUxiIvQ%uKVeVsOSrFk1k}w8f{eR^!-Yge4^_L*v
zh?HKM&n|qIaRh5ptgfG{>k_JMD)RFTtwzs^h*|S9t*}7py+Y6vb2bOeShfUrmY~J)
zaN(kMOk5Eb+ic#$WG{)a5#fLQ8r~U~rI`L+x10a0@>jNB*t4*F=GC={B87>vr4>rA
z^=cH;Vc6g!+NN~X<gLV}^p}qu^5+L8)O&(2qhuWa8~9FPkc)}_vQCFkWU;+?xc>K#
zk(a+I1z>#sYnC+8{+U4nl^c@$<;H;KMw$;78@^?#rRs6SG0a4(%tg^<Q{X&yh!^ho
zAbA>6stMg$fwB~ia}}pMZ0f%`EW`-@hXdACLmlyhW!z0nyliAP;c8qzi_W!(D>bdI
z0rcq{jv8Vyi(`ajD{rIZBBcu*Ed<-TM2;(X3cAn`b5WAWV7VXv>uUVNgk|8bev-t$
z5P}q%)9O1Xs;+-A@1BH-k*_&dwAa8KgS#`mx_wT?r#{Q~140+)d&;B5f@D(Z^NTo9
zfY5a*=4c_id?rWOt5pk3L=}d1XL~)m+(zi%6@?N0YNN=3wNr9`s)0PT#o8R=IjzvE
z?F<S0&Nh0}&HrPQaqf)R=N8*DQX2S!evUJxnh^hwh?D0>g~yC;X9D!=dFKCFU;rnF
zulySoxH46?+tpOg+!)#8D5}Fux`NJs!LUa~rYfpCpx543acmaBa1UfJwTkg9XZ<cf
zzT8_2Sc)k8Zq=P)iSZ+2ixJq5VAfkXID8zf!wM3@{XeoTcpR{pZz#HnabX!4WtYg+
z=}h|nbEb*?KYCC=AHHvLax#cw0Eqar`SFq2xGx-}Ss;b3q@=_^*OK&!kU^&Z7*J8n
zn|c8N0tSNBnvzcSAERQ_dp!94!yjMV3q6d`L+^vr<J979`Mdw=(GXX|G^+qS^zPX3
zLF&EYstO8%3<Y2h<?s-_2Ef<q%TOdJ;wGzlldDw@8SL|{B%gW+pgS_%w;3E-M2w6x
z%n``j0Ffqn*XH%JkpBXhNbvw*y+XMlTeqFxV;OM`A%->jT!6I(okclm`&z3|<^#ab
zT`_%z?9Nwe{bw5ieykw@7=ne5_<nXjG#fnP88jz|`iu(v(U|>1s<<rrVB6EqV}Rbg
zaQtoAz9Q?wx?cyv*OHS8kKnIou!^z#IwC*6lwl1F)d>Bta~%DTYD55+v{2C+7&MF6
zN)`EkT}FrGm9+xAIVv>ndEh?@ww_+1up=xpp%@@xQ@!wgN`KD?!&P84!xfMrQ$Vxd
zNz;k9?<3t1gkQaD8hmY`)NzkFxVcZmS5u?7-jC9&&?>iRqfJS*N7(Ha+YvfNyj9;0
z`y!RiXBAc5BrB4{v!ix#aISUZA2s_LpX##|X<g?|^YrU{gZap>wc>HgR{Ty>mQr!^
zP9oNa+tUi#b9pM(2WLq1$!Y>k@6sZQD{=i6+e<V63|`J%aQc{PXmy^J&(P@IVLso<
zhD@+lQQ}uFJ_}e>K`lqmoP28W%p!ql_R639owp8_`pW}HG<^9|DR!09iZkCa7|;^V
z&JI5wXg=QG1r2Q`Z%<D}S<lllv_5HJLIJktk{~~ovBfc0>_4bT?#=&wFRW;Dt;)4F
zP>TT_%K^VlT$q}dSMFMY;v-<#JCMUdFvx{Zo(lr3adbig4h{gj{cHe;E$7WHQFV3o
zFQUQ;=rxr5mV1dM!p62xNk9Uo42ZGP_^o6`+?MbFH5kB8@B)q9i@XR+&ai(w0-#<p
z4O9HM6g?t3k#D8J8Cw#byULHzOd>pVhOV_~a$cVLRg1LiTE|0MtH{|mQ%ad6!?PjJ
z*mtmZz&P+bZ!qP9<+$x#=~JV3V^muVwP6bIXhAg`D%j#@is+vmqGGAZe0^5xFW|c=
zXuKlbzr6q!;j+S8qzN2qy&m=69HC&(zA4uDV+$9sk=}Sh+0ha>w5dqAxpuQ#BDO=r
zAVLC%3{4~Oz@K;^TfzZD;{)hh`r*O1ehXY%=m&K&J8J%aLkk*R`~q7U+sHL#d(lEH
zFRlUxV|5B<!3)YAr2U`W+*N+5lFx>$nZl{^26i6|@>gXk+uRmM5%i`P7wp?CKdu_Z
z2ftXpFIi54dS5pV)$D*^0V}2}9U+5L*E8tQy8nc7tYWgVe0(X91GjS|B`2&v#|=`A
z1ZBhk+omw&)&t^0dt@**FJ|z29yoLy3tV@=3xJesYil{8ZWM%`nIF)n+<&l1v(qMw
zS*PH4+WWQ{6EYl+J^m-!A$`0(Kd>H6Sp*;@*^Mhe3^hk{_`nM!Ma43|fMF+sMHLJ(
zUwac?d>?sNpi_QtoD&qoB%?1BngJ>Nom<YS-HorA6Y}Ri0QjZR<EPUNiUZ>w-mvcl
zy_oM$@)n34Oq2T!jMf<FqA%nF>!#7b%2ej{QeX`kl=F|)V?<hvA(JPYWd17W#m!78
z!g6R$SJdlx!(CdCWG5sPlqjLdLOBS-;#I($a-UGSfb$=&phwJpxi`d!l^zh|U5DlH
z-OX14n|U@gv_~bob+QE)VTxFSEi6RKNa@WY-0L$YIxhJxA*TJb*82l<{|Cj*!5E}8
z{NH{Y{eC0UE>N8&&-dodjiamNLpoimm?w*^(Q$EkNYMX{Eq?(*f6L?{D1etRrS%o3
z^#9MZ=9vs8++`cd+2xgE`R#kXMTns9zPf(Bd9K$4;Pm+~|5K+-`5nxze-u0y{v|yl
zLpZ_$AbSCzG!{smed`u#(x)brb@Ag(hb1U7K$OPjUefJV5RHxY1Upr?0WLG~4pvrV
zVdjy~9=9oN?P47<Ik_ehRpgH!)>VA8(Y6|o3d@2>I%&Oh2<~sRgu<yzvR|&O6ubZh
z0BtwDC0e`?Y+ay&D<R<VU-9xcKQ25=FpaDq&%gf3;?e!z!S{EAn}6vr+8HCCIBrYb
z)X3?CeD>DE!swgM&a<lKY-o6(N<_+y)NjryNodesD&gn%+9RnL1$MNQ<P};r&aXyQ
z7<{&VerMNVR#l?%i#?}fht6C^W}6$h9ZBH8V0Pj+GqF_Bm;b@w0MDz!Y0)JD1esng
zYOO|x*Ee&(o6up5zsC98RxHC~SXDY-&yz=)vO(PIL_az|Qa9~060<P2a${7Fqv){}
zQ~Kj$&8m*XBpbbRE*IsQ?klw>%SF)`-qtmducms%jgkD{u*MS^tW1o==^16@(ZgHg
z7uW9L^*0CukyZp%FbG}8=af?~MAzNO3JL1$YKNR{Tio@GlTsHD4PBD%)$T$9#oX{N
zPy5oq3k(cYyfS6sOJ6Z>&Oq`I|BLtI(f9wpU<L3nPjvbo1Yt~jEuLrk3*+r5@U1l2
z3f>$_GO-V0su)gwA1})$CR2WVtH7^yzeXhzj`w-FE+Vw^ve@~a1}^Liat8{J5=0Ny
zGaY@}B~zT{frRNd@J^fi#-%ElQ#l=+y7YZ#4P0=C33%Gi5a@-7DxapU@5#@g9;=AG
z8sN*YIb}u$-5xu^+C3fA<^0eU(7-&@iGAN##59f~dl0vrvmK1B1)*GqIVo$erFZMf
zRcPRXA@lFPwzZcyo^cz8eve0*Q4z9A^|<njJ&JX4wgimHdp5oTS0zE!HE^L&$s~7+
zox`2!<5hFn7+_H;Ow5rp7)s?xds1l9tPQG_aGYzQf&idBKGEXGiQ-CkU<0s3y15>2
z;N?tfM~vTz8pkj@-xA<GaQ<k`_^WO&=fUZmiQe2UpANw^&8kjq@(q&^85u*bZK6P|
zrAL}Rj6ncQCRq$U7rpF+12^_iYAc+oQ&ntu?W-V`=-+q&96mN=4)ju^h&R<k_<zu0
zWnCDp1#~qkupDfJE^&?0`VVGANaKHAP7?yKeeFzq$1?@-KGz`>Y`D-)g*JCCxS+WU
z7Zt{oqu$e5{~-Qh1b+Ej(7PGkw(4o@TRHsrr0x63tvV1gIU264x^9fp*7R~Bi^b@0
zTEge9{!6l8)h`fOKRZHeACJ&jD5CHSzOr_neP7&5Wa!02U4EMqH)Zkdyh1Aeruv(n
z<R4XcJa0z^!APl$a)lTHz!bti&qlq4qShW1OlXT*TCJ_{iGW|p3~dZ&R!0nz04Jy2
z(v-Crornw>1R<TsmJ?OQlOLgZvo@2;+bMrQLdTTtKTilj6f!Fy%Zw#V;+-kNL80Zj
z;wFTaOa&QzyO%h!`kMYxD5%>?)}vPQO`rH0wtwSWWi`#~1p~^5O)YSJ@7$}Gm(=39
z<SicKJpXN(7#o7G_W$r0p2V^Ml%l6+9}2<~tgY=x6`weYO7u%nVW*ACTxR<N6OML<
z1y@JU{s%~Tp3UNo#KxCpx)nq|tkqKQFGz(nZ$wi*W~1|Ctvot{&X0%!+>oYDL{)O|
zA$&3Mf|kg4am{V#&A>iBj&j&yzCf*$)hEaG%dA%uDQd;wT?+Ju^a$bEzbrS&xk;K)
z1U9$u51g4+K6t_3&Z;mNar9aI(%)H+o3>V&zU}&oX8O%6QZMBE4T^?~^<e`=3~$*%
znWl?aC99n4Vo?MyEgX<xSyk~tO7=<fKQ|+5aDO@&<ua)jcGT!4aKbrL6xHK;gBHox
z8@c7GVlMfYq=bgix^V#8^s$iX?gemg3jC)CQ){$?kw)QmhY`QJps>r2#+5$V2|gu#
zFHhn`7n8<oW<AF(w_)8-os3r0nUt_-W-~$p;yDyYVmmxf`)16G$54$?Il-7FKl-7M
z4icX1_NL*{oYTyUr2c5`;EM-@@^4eePwh{<`El*!uUnRc-#Kf^AeXl$TZE)IgvHwS
z8ymRO!5CxiGW>!mm5T<Ji4{GBUPY}<=iFDB^|tz%1^XShk<*M8enDmofss@I?{JQW
zS3^DyK~PtqSNh~5ho=3Q$fQEs6aBCo1~-2_XL$9=C3!5P)jI5u<;Arg_8pwcG_?e}
zgq`JjPF(VcvqnpA6M7`NsRfq-u7JoUZ7(IFS?HL30+on?VY<cT+4<>hF{R?8BsKkL
z#2;VpfpOFlG>>Kna{K9yI>jyrZw@c&jWIKZvprrjQ-v*RB(3RYQ3P25HsZ%+1dtw_
zU>Gff3?2uzmGN?~kGG)GG@`E2gp8jsBNh8BPn7@qDiC)3%8jh8%_<JhWAkR0@Lhw_
zY8<7GX1-+f&THo&z8lW%P%3u@@vPJ25r7|3oco2UtE*TRh&#?PWc<KUr>NlK(ACvO
z(XucuYpDM)>C}YS_vqp04h{cw4_WJfKf<dJ%cenQ$XYAmev>LGUQKVyDNXUEQi;}X
zV_)Okq|z&jH)v|>g~a8Nb+Bh_1~4e@m_8NzACh{SL`Dvot;qOci+Lm{qChp<i-A*m
zJ-->m{5N>#WXvdDoLOQmj98RYqM%74UX~EIj_aa_D(*KoZj-AGQvR*g>%>9)CZ8eR
zjW6;NxknqN)+_$&k_!zhsG~Q1UywdUIz>W>7P0WY{=`vY?_@sN4V!e|L=B708N4O&
zpe)V~djg~(^=z(;hGqd};hXO|Z1YimvN+9t*&@o9{6{iYr;>m4om$2A%`Xh9ZyOx+
zh-sQ)zkz1B_!6Grf|%FryED_x(Tycu?e1s84$_Dwx95>-i6kx~Vx<b{3(Fh(TK)V2
z5#n;!sYsB;C}9Cx_{klyN-Uw$F9OVMrRAWxHcI2UTKY>e+7B<$jK!-#Tcz!G&7qQ)
z;-68>l(@@o$m)nw98f8K!64l|1Xmy_r|W9FwA!^GDz^%zl(mGJ*<)vm8Y&D;Uqw86
zxx#T<{4<;Ni`O|V{kioXPOY_ulzLgQmv$SD9+}}7^un(bYv>zY4#HlM;>D(+R(WRA
z@Ct?mi<Dvu#fhFp{t=cT9s%#7!yP*0>{VbBs=#f@;q|&d<9}5VMTVCDp8h{sfYA_n
z_sEu}Cc!><baTT>^4$T10X?~}8fGj+|2pA%*dS3~!rd}O(P4diC5EHpU?3tT@+Uu}
zun_ggupuhVEh<f2!5#%Y{9C^4?#Yj|DoaN(_b<iS#RmzF?(lsX#_xJWpY4NjTU?El
zVq7-`I+pGKZrY(>1OhCl4Ya~~Lj=@el^L<stAm;bAZijcO_s_+=&3h(w<X>h<W)r>
zaY5XPy${3~$0?=$xk8A|#UU$=kW#zazS+)j)V-P&LMJV#!iz<{B6S6qa)l1R8+t-^
zwxJ<iVub;B6osNcyBa^T8%U(uY2y?M*lp!Uu{ThqHAY|z6YtzdEuw{BW&Hv<;SY@O
zUU#dC77J}44;=lu>((_9Ij=<KUuxl?L~^8rJsM&I9nwGug92q6`TXx%ooajEeApe<
zZB(2#j~1#sC@3$AmbU%=HB9<zA_+OI-PoD^MzNIp-9G+t_R3NxEzLqkB*Os7dZ7I(
z4wc9%$t;@Yhvg!h*E5Cy)B(b{&0+PhA|X7KM9+w;8G@|!C%f@CbvT)ko%<m@FSM_O
zLM0wt8l43%#q*JbJ-}0IE15<TeL=W16ub$#4tb>>ErsyE%i6794d^>vwRVcL-#l7a
zwxXc>`j6!P@*-05P!$r_5}FkLFumycWV0}(hw^njY3Qc~yREg8tJS0h`_8!~Zj*yA
z%6YJpN5&Ik%PGFg;mCTfM*ywpN`7>AxL9a4i?AE0B8YC%{(shM-oOcoyNUmul;nMr
zffVD$!sqO%G+lb+cMT{JUzdrG3E6kEXbXn^Aw!AXB75<``dQA~kiPMSp{h=X(4Y3)
z!p5C+uM@=k6TULXm-Hhj(AyQVH)i`BJz5!SGMCD}d5NGxhrRDm;B2~}h9^qx8hN|A
zwT}^bekZj0`{6%GP>-@y>Sa#7t$(s?MNxXMp>K|py{?r#*e+2yP;=nxZqx32^BTeE
zfZKOvL#11W^Vx3$-&aa3YJl_9NJ2K8MwRRsqK9euhXI5UoMI+ATc^r@vhoKHqLL45
z()6k`4MVm0j1d1sh(?YI6n*-Z<meHsj@U_q{HyZi@3h>d{V2sXh6L(@#V5__<6nim
zUB7<;H*iiG?)LmE4Yx=h0fu*APLYywfalAl$%em%tR^Nm5k#!&vCB>`tS?MPnzy8I
z>Z!7$;_=}c&~Ck4dMEe(D;|QX*re_!1m%AH*Tv3ghtlZVu4ih3Zok<QU7I~_Au5^$
zOWW$OSPQ&??XFDi?oH2?;|it^Tg#8p_-omGkbw8cFSL&_M!vbn*YIW!$Y0~X*CzEs
zP*Cm@VP)UpO5e!rpQeC91<hI*{cG@})~atWHY-#2{o}S_&z12nevm4O|5m@n0NzHB
zmr+A3L=13<@93?~uaT*hW(T#;;$CYBWk=aNhl~kTRan0t-$!LCFtohb9;?F&F0o<u
z7MdN*`d!=fFPb?tvU(b5Ile~=lHNVJ(J*fEAx!eva4~b-o&dwHzDS*QfS)CncuYQo
zarkeaXs(xkJUBdr)UH(m1HD4-tJN50Mks@I7@&tkYr6y%Gb6h{HU8S&w&+GGZuznu
z<hWT4!*4f_^|QCNu=k!+Ve2hUgcX_v3G3gy)YQW3{+mdDVghQs4R1#j8-FW9>U?n|
z$;GiRNa$smAt)QHksU#aXeZR&^puMXyBJW-Fa4rhtQapVyoPo%z6CQ)fZ04(D*Hnd
zrLvNiqr}mRvFEmM82!cTs03-}M+)L547h=OyvDzn%Yn4kp8u+;mfV<^c-vz~GiPMH
z9k5w;CuN7cf0?M~+n{;bU8qM)T5_BSc+9=caSMNyB*OKo@x~+na|<R5SbgB`ovVOO
zSc>;k_llsaFoC<)HpH$<f%`?W?hg1nZmkN>$hPNIlTST;zNj8k-Xp2998@dTZXySt
zYRLg77GE|VH^hs@ID1N`l<6bp2d<003+#c=UIuin134XUPU_}dE+T!rzrd-_^xq5E
zulABB>~!0&dO_@KXxxcyU))v_JXnl{p>a>X0lV;7+Vp5;eGc<=!WNFR!Fyk=yHJ_`
zn#M=Gh%CCH1ZoN_Cagr^%67%ykZhDjTf~bbx-cY1DaK&w1o3}Z>roXs;(iRVH=mQ)
za5c88{uPc_Z)%$*bl*_8P7v6RC`zN{smiB<w3~i9MRU!IY%6-Oe{K`x#)ZA<hq%xR
zwvOtn7gZ3tCBG-CAy4)n`nG+N78jpBJ#Tj%HiKdFYekf5&R;BRsuv?9IW^w)>Nbe>
zi=D-r{vED7fu2XQB>mM7zK`id>JgNMSs&TZ71p@0<|_kg)jTvGNxkyie^lg@Ra$q6
z1LO;V`6WSWlJb`W(W=&(H;)v`wG2uEE|;w8`4Yrs7y++WZSU^|^HNrEisCt=)ov5x
z<6rry^H{x?;1kQ*;>Stbp-!czrXTvIqVk$Kb~*XAJ(>q@>MOi;4({|VIT9VediUxC
zPB8rlg%Tm53hU{Rtdc$}GJEEjb?Vm^%D30XKA8wh5C-HV{{_+8(ZnxdgNNpkQBguj
zmQ0IwzK?_OJNH6+3Hqp+Q{0c|vsWqt3hZW|KrDOre}-r02QrY^70Qax{!%TBr8hTz
z;Xg6v@#Toqy!o86Q-A?Z?|Sw**w?x?8Kj_w-`{u6L5m4z)>eHkXjX#mF7Wd35TT(x
z-tLP6&w<tE?}h3+h$OnYXT=DE=Kjnhf0EBA)(#)=6R#PX&Sdj_=Whr5QJfCpSoHOs
zLJH#JtM|?xsH~*S=jAJT4}I~&pjgDQNFcUhUQ``!l0999rVPaL{*qKvm_gQ@=0lh+
z&BIYRR4`Zmp};0w0pTCAtuMlO=&h=1dKQ+0%99j~<t27FdDND=LcOhaEo*JDv5FSW
z$rxs6f&x&r&L%JB*oUVbK0IdvnuWT&1=;UX;B>LvY7g$#S#=MCk|`Wm24Kb)sf1Wg
z__TV7*6Fq>h3e8N7>PV3jb?%}(&AD~ii5o19kDNBQ;yxfLYTkST->S#TDIo)P}eJv
ztRy5}40korSIH2L8&pRO-WwMP<@oM$^Q25EjBRvk*Bgc{a5J0eTkhIw=Qa}!tuLm(
zoQT4RG8~ZPOp?`;z-ym*CCKfy;31l?ghiqR^|n7_+MBYVn(89x2WD|+%lzqky?$r0
z*lh2`ecUEO>#`hPsrOH-bap_{$&ma~CQ!~eVym(Y_sea>tw&ZMb3%LZV-pJ)aMb*L
z-J~~^!jumAOeqq;`|8Oyxcq?C7g^*4L}*k1#U?;~cY5cuP<&}iepITnc=?0ZNZcw@
zQv$q5J@CvR(GDg{px}%Ldl(3~BHkce&5HOVEPD*)@&(%uBG^$uH=ExWx{#-z2e6nf
z?2)KR=;G&(l`nq@!Gr^@V&YC6)Xz-_gK<A8VrKRUhH4Y)^Q94XUVa+rxUTVLGrqd<
z8y*;rx(_F>5mnB_8J?R??NmMf1N-K)-|ti&NcWUCmfrE!{EI5SKA+|&kN!Sxv5NPB
zdm_t(N|}2J;wk6q)7Qjd6~CYcU?c`m{bLZF*seiCzWrA~1V#}5f0`BVpT04G#!4^7
z^ZV>s>OfAh@D&NP?xPZ~a+x0njSK-+*TV(t-@Fer>GUb9FS@3jPE_9b@$6zF#8QsG
zPtf2Q6QsrmeIFfR;ub@xh&w1Io3J-CK=0yX?s&&SteM?jN)Xbgo7|}JGdc3{RkXCF
z;!6yp&SUFuy)Sp2t%gopv?Gs1kJ<_N$nN5#oXhN>>1ZNsu<#YX6QlX4f;_^~QWHWO
ziAYpbVmb<x7QG3bP9|ix+y^S*KzcsQUV^}%Ouej15*|(<*KjoOz?qRi9XD!!>`J*y
z>cs_9l?UBu$yc9RE`i^;*_bRmGC-8+L5WOewu=ZJMm?la21?Sl>cqK<L@Vmf22JP{
z%ULbpEl;B@V5fuRRbnfPm0V33pm{tbjkcE^3ADV6e9uH1OM~RaFBYx0RJKeRv-0P8
zxJP9s_Zr?gG_j7^i;&!)_ptsFLZR2S^vfToof=muMEnlixpQHg^@EpEb?F#WRM_ab
z)1slaRIO<PK~FK50|j3Mh<vYF;*s{oPTKGzX4p!%eB)N|<ZPI;WyA${8JHiX=D=oM
zm0UiOq})dYT0^s@*_~k3uHk#!I+!nKEMpQghJcC~psaiYwCn+;X-xnBx_gW+UA^e=
zG~mqAO1B3*Bc30aL0~5b5IEicaOGWT8Jm(AOI3Z*s!Qt+je&5;r8c!FwQ!}@&_eaR
zfZGk-WG)DILcAz0FsPLbAvGs>ReHWKkCpHti;m?pWXrslRW+@i)aIBn1)jqxaeS(1
z$Nf^j1(R<T^98pM$-s0M+$0}~Ind%n2L(LMyn|JaBr7w?s9bqtd-O5fS*McZ9Nq4x
z(wQxO(?h;wq*5di8C`-ke+b=17g`iJP~qC=5cJ`<DPdIBSMf-o8V|8VqYwGnQ`lqq
zYqon^LmPgeghWb)hY1Ba8%C$-l#8b1h73HMa4*=7)@{+KsGAQ^Xx(154*iAT#rl-Y
z-$i-bfueg01@wQW3JziHHpKdX%3jyl-h>0mMh}iBv$V|&n&IvRvSR|e7}1qWDcg?%
zu<rdG+^=E2I`!Iod%ULP+<Hbzo7#lkBmO&}7zYE#{*5tGS)XDf=pq``O4rcl6ul<J
z5!|eB8x+W#v|dR_c&rAW=&zGU=aIET(Gqu(knA2D(<McvCDW7j^Q{yEl-P}7_C~TB
zt?mV4RDzClBS{R&vv#94gWs{Kq;14*@&%)z|E**$;8>{y@VsMZ+X^A<A(0%aI|_~F
z+mF1(qv`UEMOL`rrY!k%{8gGa_KvG4<&IpxI;U29WIC<&`H-fBVDlwU*AZA^{8|(O
z<0!B0nbOdsFBM9f<+TMbNQ-aX3P|Ns*H9)5C(;|fPpl=&><Ru8f@QG2wjE1;0o*&z
z2PlZ}!e?o?!EnO-QhZ9Xu4(p^M`8-jV3R|Xr2MC<H5$?bzQITnJ6M-8YU`;iUI?Gb
zi}bBL{LN1hmJBFRJrfjgJ=&-6_O2XI9p;h9alFO>FEKr1>WVz3`sr}27sb%tlM!4v
zcDw6H4A1!|9dCCkBn8S?Bn`I#)19gwDE9i$dyh|Ma0KX}fyAt4)-@@I@(j0&%E9x6
zIkH|16-h@?+~`=-m-_v6s2Er{mA4X|yH*MfSKnE@19~H4Sir?L1&+o(8y_PC$x4uK
zj75u)7rEkh+zfV3Ct{t$pXfk(ft2oan+bjOvknZCSbtCW8C4n{(*3;>0}9bdRc`S>
zU@H`8Q;6U8!D-~L+R<W(#R;=g?uVrOXzC1=(qPdWr~s3Jtl#|95PpD>W{H}`lAQ?=
z@Uj{~n9K`SO;}Z#L5UwyEYNuMP$XS^D1h!fPz8m@sYX~%YcD|<yw~$0Zx^q$b2j_Q
z@+*yb5og^b2MeCRvM`|yA{S46z;iy^{*k~jgx`842in+onTA>Yj{uD3t$(nVz{WXU
zn8Pi}n5(u#gMpe%#%f;Kf5`zfI@Lye76=O9MYdbbAn%(WA+Lz;%F*L56<*+C{f<&}
zfE3$q16;?lR9+N=n^w3}5-efubuSL+-JiJ-)^#QTG*J6N;<rT(8b44xn=5#CgOKi(
zbpRj(xA!QBJs$b<xT6sHRHscmrmB@TiWW-uh?E$P7tdO;Qy1}^uVNm5)ja6bnaVKY
zQq+AX_Gby21!Z$+VV4!{D0GAdFz!!TMzXk4U@?1VoX}zz%_kanIum4_8^t&gy~K@6
zeIj=+Yj&U|>>m-1SF&mRMo++Fl@yFCzLNkYeBo>rH*wHpyKnBkS&4gYoz)~vW>YfY
zEwVTeYmg{tH=;gS*oRW-H@Qtpq<+CZ)=T|e$PXiE@XZrd)^t%ako{)8lU@M(=2!ZU
zTw(6s3mNO8d308ELLg+CoyxdN=Y;v~4-z7(SH*i+rx_tl-dpaI7Cq=|?Clr$c+o`-
zgrU`iLyL*V(oQsv4O^-Q#{&~#J?7qL{Zi_Af|Sx)RD&6|xk&H5jPu~O>k0QcQXbqD
znkMn6PJTPvXXuPxV=xUbuRyA~kf~f5(mWs`gw*4T>4zO)_B_NM!i^IEf{1vmLQt0K
z^?%NzwlB9fLZ&?~KLxK;)?iAj*|}RtWXm3t<O{b(QbKYdN8yoTYhFXd#u9IueWcbc
zhR=pu1RR#k>E=2Kj3}KXx;qA^R%s4yJV)x@&Nun|A~tVn9;}AC3A*fu=8H5&=arEY
zcv*eGo<H~%F(N7<sg`B#?Gq4L{(+#KzaSBiCRm>h`b&HbBPU4F^ltpuIcEId`42Y1
z3{3oW_c{{e%=v4VoO`|sK_LwNVM+EEE@i7-=K7b$W$97iFFnMpbw*>EtfO|-c5%-j
zM<^6~UrP#?^fc~G@u_&eafPbY<he8v+m+shQM;h>UnsUpz^fNo?ZcmCqes^4a)kVd
zgX!BF0-|q4BgI~3fj%k}wW`cebU57;;Yzht-12|m@_h<Aw|?Q_1Py62V%V8G^39R*
z7G%e_jJcku+bMk{79_JDXW~yl&tLoY&Tqg*ow}VEGhpO}@vUIW)JlSh-GWUR7dkP9
z{&IYz!8O`RZd3M=$MCF$IA>#bGKf^n`b@%N#p27U>xUJP4eq`cEV}cEBl-}j{;@#N
z3ns*q??sq;#a|5FLvh42P9|@ewD!LQDe@_hU|AwX^7jm7wiyWm<yD>>N0dB0Mw>2G
z$_xXsU+^w_94r$<#TX_n=0?)u?AOz0#ZD@>5iLeADKEag1{h|x$TK~VN*NR%z<M*a
z8kaj{Xg&5qY2~mdtyPd~Z`c%RHv4>cZ>}sy$`+O2<b&c}W~BtkOWHA28q=*nOD4}F
ziMoxsfL21nORge$Bf;)5gUHjHFs{ODu;=ZX_kt62V@yIIjFv*Z6YHhM+Bx@WS#Ct~
zFEQ%}3HlW`Xw0cB?j&O`hA@X!^q)fxgr$C*LLoDe|2=3j@U!jGM{;A4TO2wOxqioP
z<O;%#_+Qc_*w3tPfEYVNcoP?><1Yk4wzOKC%gJ+0i0UT~srlx4`@#z+FV(nzm}SlC
z&hiv$`+=9H{3@L`CgF&>tivoTT|n>f-?!hnpzi}N#<{6}&D`J1GZ`lDOwe;3sKtMO
zb$3B`ysyg>628!N92Q07WC9o-Pn2}<e@t3{J3y4ksq-AOyD<Seq5oI~&H$EY>S7~H
z2WiCu?7bDK;MS)K4s@F?3TGoh!c86;+x0))@e4u<^CX=*b<+|#B*oB+`v~ET=Y8=E
zoYMg2kJfyHOnApCDJr><Xkc<vyN55NFbSFuWu&Y_ys?u_`=DqYQv$e748BHn!ac1W
ztINIvl$b1jO8}bMNpChM%O>EGm2E%klsF?H>>wnk8K+}JJRIBXa<5QML2If@Ax!z8
z$D}qY82-Tn6?_GD;I6j5`95SU=)*vhRTGVZRve>-h{8ZOZUWyn)v1|THrQSd<cR;l
zqQEbVT^k-}VMJdl=S~^=eTC-Ekq;|3XV`nWPUx!gljSpt`NZO*Bp|e?l11_zp&O`U
z7}EaiWL*29^Xi2p(dP!)l<~SGS*M?tW{s|snuz*!6gC`+FW_=Pn{-N)#rOE|Fu+5|
zB|!^JRfG@t|3qJK!bZK!R&dH(T#<Mrs<?qCq9DX4%z9~4io#ROvi@10H$MM8H?FbO
zn*1C}RXf5b|4Ya~yHTExjAsd#a#8Q2{Uw!KNXw3spI4O_(p4qhKr^wh&bL?SdzHtX
zukO<X7G79)Z$k<*FPXJ+3$>-MQW~Nt!>6&QR4INxQt)k|*r}WijqBj*bhGBsej)_L
z(Y{zf^Ii$35M3c^G|!x^JZG=V>%x7aZBu-^C8lco*Uu=r#X%dm5xW?%U=u*z2nynp
z$^RtmCGPydePK{c=?0HT5yhFEDwQ&HPyTLU#Wb)>z*jGq@(!v}7BWG=X%UU?Kz3(P
zh)?UgR+K^<q)F+Ypy$0B^nxe(5W3>6`A8O26gYe&m^j<_OTM*=O^w9@r>wFQz|IQm
zoOW@GN16BrPFQ57?`@9Zui-y;yjtr`vWw)@Za2JuLHS%_5&GUqJrE_Q7#^7NFvtjt
zCmFfVZh2OQFf;pv&_lG}A&+}p7n=UNa$t{ysQO=SL&HIjQWWrVw0!rsFVYel!+Tg+
z{_49*v@VP`_?dtmK%NfL38Pfjng8yxsC&)jydUAxd%BkjdG_lOxE?hgKPD$GzO8+d
zjwoa!djEt`v1qfpn_zdAWxUZ^aiiz~xlW<wwH#Z21MLeKJc^d2f%)fsyO4)Fe_<*-
z`VO!*l1?#wmwJ+r!u{9%kNs@=U&0bH3$REnz;dKuM%VXSaR^w%c;d4a%<eY%^GeSz
zg5CPLkemv6k2`_AvakvNRs8o*4&w_W-0<EECooI;QM85QEwI^HPr2Ts9F+L)GwRj-
zkD=hYD#8O}U|>l2!HEFwi|2pVD*(8Q`tJE%&H?V&w;5lu{lq-55yrSJ2+h8U%ndag
zQ_jHJ-P+mHf7@P*;So5Pv3-iYC}`FlpPgCXN5P<<m5+?5=!X=arld)m{_%IKu^Fy-
zvk}0-)KeHSJGByh=#$gMO7*Apyzd%5+}Lj*hZQwJQPRAd)4EZ_PZhSzO8qOZX>21#
zAUx|Op=Xo<J?z6Z8JTnBX$a$s59mGiiESa;(bH{2fNg@7FZc)56x{!8x4`=jhRd2m
z^hUS8TH1?z=FXsI&M3n2gAPpUUI7REO`yqyR4V)LUC1Zi!PcL)c4qB`x_o{|4TN$i
zP%I6pK0659Ao*I6Vl;ZJj{+h4{(16A^uL+#B789Uqf$1~0fe-Tky|S(*ZM4WQEo-7
zBXQ4^HaJF3qVw(VZysBAGw}*NJx|3G7t4Q?`InBf8)Vy0x+jhW);&PqNr}ifw{U3y
z7lzX$OiFz5<r+m?itMPy%Nmu_)1w6ZbbB&#0P%FSJ5K42cL3BSEc$WyJJ=NC{;TM6
zWq~W3U-R~QFkD~c9DUEzrR}3iK=wE8dVEo;qUCrW0zrf`$@7;1I|Z2Dz8p0Wcnk<}
zB3AP0mfrl&tD?B7bE2GIJ_ckV7<^884a7mM{KM+uB(gV=0Hsuw@R_Yw$_M+M2r)!S
z`@Q~yk{+Xvn|*>yAC=niR>66Y+^S07iD@WBhbRoAXmD)+_5N507(Z|>`rvF~k!30=
z2PT+T;zUn-=K}(dEuYyqV%~i3qhg=*I{<<IIR4u%7BS}0DdEMq$w>+jb-P?XF~)x=
zQe-0JM!r=tnk}yr(W40D`ny=iSTlEyu68q2-cm#qg5LNuocL=(OR>ITgUp(^fr8`%
z)Sm4SHudWUZXVm;=FVRT*s2Tf$2U0@1_J9#S&HB7LeUTlp0?(~OHtXFQOc$O7|8eP
zlp)I>{yjv9b#x|qJhOYJ!G|Y@H|0+T=sh+3gCuzGgaCX4;55w7wuIz!^(9Gsx(4W`
zXhPysMZ2)Q!(37t^7_aRxTi#(njXOB9Au#~lTf~Q^y#}5??Z{yX?BtP`QSa_n=fK;
zA9+j<wPwth&EVg#`qzwG^G5md=Ry`&Hb<Ut9SED<;R}Efk=I&8##d`Bd_DpeYyiL=
zJ)6x1sQIs95TbH-|HV26`yFg^hNP+*bd_4LiHUb`j%WlD7gq-Hf7~Mc?=|1<v3}>&
z0lwz8wYB{;xYW=J;IW1n!ILP6XLXp}fjA(6+#Aclq~v#D;oGVBk9VeY+ddiL{NKn;
zpWc7qvN$LLvsd*5b)&>%OkYLzLW5nt=NI+{%g=XZr_*Rjh^u<(r?Vf;PP#~Hnx#Lz
zTDtiBrpXW^EtZ&=+;-P4v=iTR-#C1O2QHO;6m!oo`ONi^?PG__P;6qwxC0g|)0c>A
z47Cl#6g%I`A8*NW*gqrdkm<)BZpA(L&^yzqD-sQu<7Ez8-Xop9rqxNRzbDB&=vU8U
zI@!g~H>txtjS?q*1#wz%Xx=i*FYNh<S(JHH7n8|OuNAkIjb6bc7%gIrSHUEn5W%lX
zh?Rw&K&eNpI-0yt9)@)p$rm=bm<iBgF_i9_J-@L{Bl&faprgo}+?nM!Mx<&K-(SEZ
zk)T%l?gU^SX^;H2FCI<p>5i^y;tuRopFpfO9}IV^Hyg{TjJ+5i$FkVcTDiI`lNlB5
z{x7!PIxMO;YS^Wu8>CB7P-*EH5D-u)5tX4!O1fd_ZU#lVMFAy;78n`^q&o&?2!)|*
z=sMfq`=0Au=es_<=0DV#+0TCVTI*TszUwH(pgdgR^O|x~HeCf2dQPi$=s2L;YRe->
zZ4(_i|H>G{(H0{d+937O`(OsO+?j3lxd2tC*AC$8)LT2}&F)LjOWj?TLzaJ&ABbli
zqOE)(>Qud)K~At5zj3A~-(@i%&W2pVMa13iLk8t}jq=~X?;G1pRr%;YxW57Z*R*|#
z2XuWNZ_kN(Y(CKc=D#yvcXey+<Kt5gdwK>efS|$KJ2${A7Uxk=h{9TBgaR<3g}5?Z
zf}Yzi{~xcVk=|ZH85tP>4=LLg$;fZ?ADYz{O$ONpj_6!hUACqL0HHR}CeOw-oeq>E
zf?#dB??X{-0D-BL32RO2_CGy)Yk%*4dk+j9Y%JZ?Z6Ej^kS0*sZZ>l2FDwDokF`!2
zxaYmw(w8hN`Fmyqs!~(gkrCS2H$d<ICVw+<oV7G+STW4)dx?qs&orWUtmKGl-}f%O
z>0}T4lBrnk;`am@n}py9zSv<N9+pm2)Vx)?Y4QD(Hq0Fq(}Y2~^G=@1Ddw|0z|FHr
zDyE(VlB4?*$2p6N+O6f^^rx-qk%<<pZ*0|JYaW^(Bh4?n@7n6u;ko@SsQ<((`Fm<3
zOvOE6*&;m@9163=6VE#e1S@=$XL-k;u;5$b_@_VY2}P9IxstjMb)!gMvgz>iwMs*i
zkcUo?81(@yb8xBGqa^KliC5D~XnCZ|#w_>q*X+zdvG0EZ@yCpY+)e-nl}W;ZiI9RN
zd=~`Cw{O^;LxKE`BV%8gdh9OT9m<qcLnP*;Oket1qme=GlFLHP&7nUW`jX6NYfiaB
zL%C`0CZ`kryCnY%JHUmwj|-s<BEx*YldbnC{ejx6q0~2K${kP3=d7N2QrNOeYvh%s
zWlH;exf74ZgSds51<O#sSVBbF5oQ;+ZT*^z|Nnha*SsMn27VTB#}D=4c#>J1YQwdO
z9Ezr2NE|Kq5gKi3Eb6%01@P~6&6RkdA3xY5MKOh5{eyv2g(r`u#|pg!YOdhVAPNBD
z!?Ve6@7^NODmBgBJV!P<Z~TLphO_JQO>t3;EP1+PR<R|jH?!yhz=r)=x2-#B=P}as
z?6gj9p?~leiWt8=pfb(1uhalAlmJ1G8u$VUi_rK$w{wxdONO1Rb&uH_k^eps3FHvh
zEV3PFVXG83Mh88>^#9|Uy&(WaNc0L&`MT{0=r-%x2ASf4d~Ix#-FDspin|RH00*>n
zyxgU>@aqz1Oe7}y+vUoLhmq3L&rS==iY=dDk9o9nW1qbHdAQdMbp5hz&hFjid;fe_
z?w3wmAbw+`?^uAW{>DN0EkA%jK3?2;4FCoIT?mQDR-YIPCRtmaJlSF~@X!<B(B}^3
zr2rZA->~Nl)W3-$e&Z?jwC@oG=kC31_u8WqD>-Cjk#Oq6h2CMfrNaILDgwTr6g=pY
ztJ7OR?+NgfOoB}yegl)c^z;7%*1B{Ae6hS7MnJ<oEub`A19<|Sdp!V<%%?gXfG>RY
z*ce~<`0=BhuI<g$xrqOni~rS`4ut+*!R<d7=Rf>yg=t&je^AZWUMawkv~!i_Rzq(O
z{@T7oYl7JkFY!~q?7G$)rjWs+4a%hR%<dbWH>N4`XChbWl`jBFQ0r6HR{{DT@nZt8
z-=~uePDNVoZhz;ltDiK0F87yZI8jmj5PG>CsIy5%+x$a4;D)B5G&6hT<@WuWpWVYY
z-{rYs6LvqeUvBsLzuBaF!<lxG-c32E_Fevv_+&6jbbdE!lIUSQh->{C5O=m{Z^EHw
zn)P#+Op#d@RX($d^n75Jx~<8Ox^m0;vl{@TihdFh5D>`DVGu+@GhO+`R8)G%BcRxL
zopk0Rt>Rp4!gD11KVV_)2^X5@OC81e$vw0x{rsy;D@Rq>&XqdrXK#alO~8ka>MvPW
zQ|m+{{%887jT{(W6nNqYteL0E$S?Zys-ku8A|wWo<^ISN`!>5B@O0!|WVJ=sds}42
ze1nm!w*A(t`Q|~d!Rr4D3Xf<G6zT`f_EvXzSht8`oE6qG4n}!DdH67bS6aW`f%)Uh
znMeTu;A=gU*@L^ggKT)AsrmP|t5mOYxIq-h{{s6M9kf22(-Pm2_rDIA0ye;2$UIQ(
zxjiegJzqy=KU0oa`91&xdT^E%7G%A5LQ1nF^DaNxIowhazyU&{I$p-thp#K%-uWW%
z?gr|T!TI;I^yI_9T=m-*j3WhtsmFpTYXF7iMKyT>4*XWA{tOGiy?}mo3Y0D)(sVdo
zB&@hM=y)@w_PsT1@UxDN&bS_J0=sN#(4MumHGs`7;N(qRo*W-PG_4%C1@<HWQ(G2<
zYF!0M@~5X!?M6gcS<m!_5kbG}4W{+v3Zj3x69Mqib?v;iZ?y$kvXx7@R7r!WGkqIg
zDe2{W{X?nvpBhAy9@Hd<vOm=NGN;&aLR(X}-?&5XKvrd?HtxV}V;?g&PP*`(w4T7?
zuVaCkJC`b|`WxSyn&<q?{F=R;L$p<W$mbn;xb<(9GUwb#+^k8Gp3Xj6<Y#_EXsR`2
zmKyyq?0ACxXR+C0Jmr{9l~+?(M%|yXj4?$P($+6y4jW&{Ta$KitUd4KrOldJi{Hsh
zo`vea>#%uvl5!rOt(^=kV(z1tck+^E4cAuP<auCelQ;gDq5>RvB|YoPa4NIU`Qi84
zKgi>y4t!wnC7vq7#{LE{UOoTsfOu=zsMSBCa_;^Y(H@IK$;#Vhx}jue)Ln+PR^Kg-
zT)BY6FJDH+`TnBC0g^TcCgsUHQh@54oNAr=?{FVDT^byt1FUkbiVgvdD?M?Afbl_p
zdg4BS5eFLViCzGFSXx>O+I+QVfU@y_-K6&<vfY1wdHj!@>V$3;5E$YIl+HJxnmdaT
z;nfDfc$QimgFrPuRn))7`@buw1Z=>>n16`_F!=LqkM+;$YFCt5^`6s2k)~;jcXhY`
zzcg9aL~(I3?>`E^!9PImfAHr<0u0S)01*Zz?eA?I@+}A#MCjuXh}Ptl;1!B{Hu8D6
zgYd<-JRpt2TvvYjp*0=G0nfvw)@qB=*=GBZcR{8oboX9ba8lflTShG2<PVNH(_oWC
zdc&J%#>P37L3+R3{@!N2h|v6G2aFs6<lr<b+=is2r~gpE{|NWpDO3606ZnnV$H^%U
zmw#^rN4Z_xFXKz?(+Uww5yFx$KLs1{j9Lbt(ncXP+t2I_h>K=o4nckZIL@M+dHc+K
z9*|lzOH#gk|7P}bBcJHGsc*2cC4<?bjB~h=Rli;}9u^}-;FF3Jvbg9Lbr~fHi4!QI
zG$q?fuB0xA%Ois@Vy=fDm~G6efNSoP$IQ}u<KR@mUOrcRi^~{-^F2Q;mg{GwggYgK
z0!g%${ERCFSP;w>U82RBS-ow%ckkX^X!2BV`aAGhk%Ltp5y(h;0dRDA{{!7d+XI6X
zC8lliO`cnk!2P4HF1qFSY>!egw?Fmonf)Kivst``g_;uH(S*dE)KHfiq>D&&MAovv
zbD6-;ehSk^C$t=@FNtBdFSt(FatTFT#9KnBkx&AsS`Y=6sSlQ0t>z*c9ah7^K7x_|
z$|k=`NF+~!F-BG~Tt`-hmv8WfXDoz=X|c6bz(0Lh`4VdKGz4|fFDmSr%Axc$m;=r^
zMbhfVn3yS2HPafCzr|@M+e(2Y-tIic6S3)g<}jZZ{9Jl8t_CM$-oDW&K5XY)su9!j
ztX7&@9XXD(Co|QSix;$mtkQ`KNj?z`g+uon)5-OA^rBl-5oRtnN?bOFB=Rhh<^d86
z!v;bmXY%dub_f@0QPlf7a6Zl@FF_JPmP+d0Y6se@h|RXp)j1!Z%~9`fr)(0%t7g6z
zgmQIgy0d%ue^f@dxQ2?WKzH#6L>rb$vy_%R^71hpcud<b@9q8GG-eW6d&DNr^rxCU
zn?SR8LHK;{T*?#kIDnJDkTI`)6O3mx+?M=d@huMAta?2IStWJOgv;`S_)90pK;uU7
z34LmmbJwL3X((8G@jHEEUQ5^(k!7Fc5@Z)Y^oJ3iAAj?jA(-=3=uV7ei?{Z4A!7-p
zPhKG9QGiHe{jEgHa6s?(U+SYlf6QmI0d6SWpXKEa#RQ7xg(~x|HhE$?+TU8hdgyir
z^Vd~6ENlHEL<ddGgm7&Ax(o;A`&=gD?k~lL%>Puu$XT#g(2h1TJ@1+m&fwY>{Y+By
zg>%)Ae8KBB+8*isRXdMl7LLA)n%V0ZXs2qn8R;6;L7LedlQe)xT;kb;n}W1G^fF?v
ziHw#lz4G#v7`gqtI%lQRXgbV3wU4U3qq}Y{HR~r-_hCYZRK9$Qt>013)5?K;@WTnx
zCWI7aNfxLTCo+k-;foEcbgjR-FIZ**MS)b8`Zf&N&cIL;)zQMeA^AINeu)-Izh5{k
ztl`*PH}8*<b}Xx?kDl&{Hx_AEz2G{7=Oa?}h{q1wu{QxCwu4@nJk4ODkZ-$d%1onm
zjB5gQs=~M&_=-^hKVNT5Q>mwBbebG-ltB&5`%A_!^Pl8z-Mqs^gvIU**0Vi3tq7~~
zN}ym9+wF3=eK*K1Pi`zj+1=!+7@aR8LQuX%l-S#8HQb^G73f+j-3<K!m;Gv=_hYuc
zgCcQ#Z{>mmKYklU(p9w4p=VmXtyBeh#6Za$uGr<RbP2xCrmeQL-y)8gf%9Ep(fEe!
zKfRe<6g()nFQL7k!nA2#KI6^GV^l=^YVpU1K=YdzON>?@Zfh?_A|p<d_{;NgAO-{<
zZSGf@_4zoUvZI9|>@W5i$^!BEZgS(rOO=1{-^q+?DDZCR05^@YF(7t3A#GIe6F8tw
zaO<V*oAuB4vWg2uR`+1(ZI5tpv6;BJdohprfe8Zq$eqw>lh9RsnpuSa(1rI-d`O`-
zP>Q_=$O1xsJT_hcH1hvq?SDV5FHMn!Y1^5h!~<&kBEQ0()%cAXG?3@0IYy=|8=qyN
zLeR%*(XRJLb*uLpGAYOsCL4OfaTiIJ2rc)6+eAtfj;JpJxMb=#qBGPhxO-WnC2PAz
zal2qUF8oeMM?||#Z9U(u)I~fnPCmlI?pi$pp`8x^CH)j-<ZfU9+nhhHeUX+*@vyOo
zeVr&RF)=eH!vP%Ersf<<*OBxA!=qS1=Hj{d1j`Ahp`_<TdHSZ{Vx6Q$&somRwV;BS
zA4+D*>oQe&-C-9Ls%cu~BDRsZ_kTEDod)NM=QQ`Yvt>WU=SJj)^5V;EjA{}F2Nq*T
z%LkaUrEZd1p)WKzpW>0toN;H?tJIihc?`Q==%kDLJYe8=Rgp?jGdb+W;Bv#f)aflS
zKK>XUd})E8_&rhD(rH3}X6&$x<(s`+a1Dq9*87a9!=QGVH`}z9I)`X4j2qXeY*`Hg
zCs-up46hLk;0SvgzBwUndJ|2iu2-O!w^LOB8B5d6Z?=#nJf6c-$Ey*R_@YY+amdXb
z=-^|TwR<v|D8CAa+&W`;!a#e<@0mb8_a-UZ6l+iH*)r;hlZ#Emgy4C|K)(2$DI!)$
z^z(GWkb9i<B;h8I5V&QL1tz+yN~iD$M3;<<4HX(+&#I$-Lg2er{D#IuUfdB=B$E=y
z@z01_#$d>rX0>p&zZ~|zoOD3OL8$}4gpG`hmUea$0C7vp2`Y%WX-+0C(urr{V70Qz
za%HIl?9D|E#S4j&Zx1lN*f?g8?|r#nb4CQrBtSz@?KHDq540$;H}}%Pp9vwS#wJT=
zSNcrCZj5D>@+$F*Y7b~y9vV?~E!+zb_WdESV%ug2G}rffV#HnK<0;T95~a%2-pB)y
z6V1%%G2P(~bfk%_4FUW?Xa`d=G5_`qYh1(G;oiE0;)=i_dlYnkDj@=yGV{4-yp0Hp
z@eDoov*ibe2Zrf&87bU}AzvXLrM1mEPc_DjI}3UUwRR=gd&8V2nKUx(!ns6Wj<6fr
zf}RiIazjqLLcco^7Y0~TtW??V6Av1E2zxD~C5Fpt2wvR#BTl|8PhC1g7)XQlm%<!(
zLh#_}<oONHNFi9}3LMp~Q>E|gct)-JBsy<-2ZJ{^=w54bKz9SY4>{nEl$!`8*}AGw
zapvE0JLzD3&!8bWT}~9(ua;H6Aj=LFs9Rjn+H1#lw^ErR4LPD5icKc*6&#0=3Ge)u
zNsvL-<c&Qs%L1YuDgqh|%%qKa%7_2PPl`uNB7_J|2`a~d5QO#eo#w~=R<h;1iQ+Xq
zkX5_P35v`q?EQ-F<Ho~Q|6_6infIMm>ZX5w5OttWY4rN?6lOmo$gu<v_pg8b-slH^
zCgGstFN9f6vytyka6Wl*J=&nHK+Yt^j6C(>N<D5LlkPUDR|-nOo%MMX8D>&VkDX)~
zQn?K=TpoUwuz6u3+%b7id92ySxdeO8+7&s}S)|!CtAQi=VNmCcx@^()mVC9YbpLep
z*KDmBpDG0tK?*7$f81Ma+M!A@oqltc4b=02zieG-7xI*H*f>=23I14G{!iz<8zw0;
zyy>zAH6Vbmt0Vvcm22Wa0r?J(;wL=h9Fc+Wivp@kt+$cpE0dO0<GxW~JXyjZ9ReGo
zb^e}qRKQr)uw{GjW3aTJkm?C%NQAoa+31ih-3bTDtcWMaMGeHGB?RBbY-eGSX~B;G
zI6qR`lX!o6&Fan|`z;K`OccK{ja%B#V}%2nIu{))y48}R#=!1ne2U~Wf7LGDgf=U|
zZYl@06{Jg9^QCHLMxX+`+arVdjq*<PpxxQ#tFVubOi>-LDIp%@*E3R2U3qv$gd>F%
z^N{k&<U5jt$k{3lyS?0}fSvlVvsO31#s}1NoJ%rfxks&<grKdeI`_RPwt!iU`;%{i
zl5SeDpp&m{x@~sgwoWp60*?@fbj-#h4HjYg8iq5sQ8K9!$le?C*7K)4RBSQwpp7H!
z1#6+&UhnTQy3r`JHxDe&>z+zVssT~uCxxKEY$?}Jn+bZr(*XIGq|o+*fhR(GVAkKe
z#N)F@Ete?T8dP;WQr8taEUWxW{fX1qR&y=qNGo7O?Bv>~Oj-Qy2o!%)1CmFGzMUpL
z_)swOc25Gi_UOk*pbf}fj)qLT_wz+is$PB*L7D^W5ru@2Zl-6lV{?CfzlKYC$6Lva
zDPD}_0N;Z**8~p%*2r?EzZ5SnmuaA)OnfrMSiEFFtn$Q~`PH8Z7ZI%<d`O<`be?(B
zj#S4oF`Ml9m*6irb7vg&(5%SEHML8c`(7idsM`xQrZS|;YY@r$NQ)wW3Lj9fOX;b8
zE{N5Y-?Dzd$GdOYB~}=ZGmyh5Ts<O|Eq_8B<KZOPkNYtseWFs5hrdcmI7|j$<2{@`
zl3fk?5ytTBxQ|X=Qb_4mRIqYBjD&8uOC@g8PV|g>^qb={LCEcNVVbq3jA>{;mzBPx
z(D(b{4+HPve4s3tIn0opNY!gh^7Xw_pRKg7BEyT<i6ahRWDFmr>YY7={G%c`E%Yhy
zWwrfTU*}x}lDW$trfq?b3~C?U=jQ$&0)BM}_@o7J+O$B9Um1MXF~x^SIxV!r{Z7AC
z0@o@~Eyfc|-1{L_pp>fyIHG^NU{w{?tpMr3`rtLT$DM#BtmKOlOoN%}7_3jueADIZ
z_{4@mEASw@;9?xeZEFkOj?D$laB&XIuGc_=Rg|%Y#}P57OheqLgfL^4JU=8Q_}IH=
z?mft0UtH1s_NS!Zp-Hv^Z4?(?eM#*@h6h@P3fgOxV3UyJ&2!Ti?fq6!BJPuN8q9U%
zS?`Ua$}bFa?L@m|AdqM2YwT=>ZZvxD&>ew!(q5HEkqRBg(GGSId3C^GEa)*XMMw&X
z-NJm=4@PP0zIj7?ak@96unMR)4zAAKHyG{}p!EQxA7?(0_ZBFI5dukV?zlM#P(>3H
z7e7A%(&1Nt`vLeqNJhEy2UPPBjt>uRS(`G}_V7T`x9gtR@oP{%@6oNPn)dMcx$o0r
z+*};E0tfbuuCBScdB{_%-}!)X<TYSUaiXEU0CMU*s!u5?cW;$zJge!Co%6jfPaNs_
z-jm}KlJ`}|gMeIlPWk^!mQVk+YdsRT`b{rS1nrRq9711#xdcUnR)6VR%bIw|;RP)Q
z#%tacNwKPE`rer9-(Oc#OJwUvx~B}dy0Ae3RmmV=7INbRH<zWgYV=o(kEDdDmOfnQ
z%<$PrOybTJ2}h=)OUp%U{v(>y`39O1h8MSU`8Fio8Es)h`a(>lXqDQlE4e$Pmi_v8
zV%+8~_X%zYKEnPRitqiGBLg1@Iu4YD#=gBw)=-w3(-o4CJ_kww<FqlgwY6tGuA7sO
z|MTvQo`#?_@hZ6rxiCMYxHHW*5d5D7om0gC%C2^9<i-&>_407L(CWzt86q!^!3?g~
zq>vVl8nOq$Y6|CjZb{w~2hxedhLLr$0iT|GI!^@l8hV@kHWCPz`PRjuUe$T^a8%uF
zPSUY}0Bg(1iq|MMYS~spAn@TtR+<9qqm8n8o*D3<_(QndQ$wB*T#n2BlbVHk)@!x0
zkUO}#c>gkITc9123=6)x|I~_<BtRcH?D|jVrqEb@FZ<9!St5>6C=pPE#oo&TzGY@C
z(51N?n;&QOOAHC4%<0{UQW)68JbrxZsxI&d7xctNUGTx&V$@0EYWmqJPVL?(<>F-m
z;v#`(zuG^qK9@7Bjau2+A+MPlE>o}4U}9Ni)eI7J0w<X0YH=k6$K#>}iW#Luf&_Vn
z#FZYvTRWnh-~1YoEfF$M+6%bz$wTl{6D89`1JRl@R{3iU!O6HHbU4Ore}1i;NpzL%
z3e2N{r$FfI@R)Ey6Di`qX?F%5Jt#Nn_%QNtkVOK|7}Fx-!5P^TCuUY~85+j9HKyKl
zLv2{3+4V=IKH9>He7{6)fs2DT)wyfQDQC1m*OVXp5vOj-P}ug5!M`JYH!;ljZ{POM
zy#V8rA|MT0{`2Pnu+2PpAjHsB^DW-ti^+SSX<1?tkP@B^8MzV{YiyIu?JomJ3=g~T
z$jDdf5x_0wEiEPW?A^P&09QmV>Ed%MDV8{U_m>>vQ-tWg9#R4``vYIbb2qfYShkSv
z8dY#@ijlFUjIV56S7&?#>Xnoh#Vi)BMs8%7yF{7H`ahy?*hobTpSDsh1-@qwkfG?<
zi1R+Pzw9C!`-RY8Vu5#p>L1{T*nU<aUOU~2+)akMk2Y%}ux%a`md((1-<|cwmpHsx
zg=x=StxI~}VK+qYu1|3;^C)t;KTYA=8LKHAak!*KtZ5*&#kHb&+bzk;FSDn6((kF8
zK~jQ;9szc5kKW0<UeV^qb8e(>5vGeQg?=a9zjMr6)b<HOP(_cEg#$yxzk;>76iup{
zm<dnVB6IvKfj&1{T(kRANRTTVgyJp;_;Mc%+vOuvc{J07aRDeqB!I>N^hw_g|LsB%
z!11gyjMWOLn*m1%0a|Aca|HE8@in3<0uLDez_PA4CW_DPfe2hdS^rafM5U&hC&xJ+
zL$gHw#2G&ESHmIvP`-L=<KE?z+nx+XC_DOKl%sa1foY}^u4yO<Jw4RtH9PLhO>ab{
zwC{qnv{(}gYNn`v&vYga4m4}77qvOzHfhOqD(+G4tov+}Uw9gmyHA|Hc#i`ITWZJe
zNl>b3q1q`zTW)35pi2V%D}>XDSuw_HPWOf%Fx6Z@5ih4M8&%eq19qPh)^bL;uXDQQ
zCl5{(j+mVgAd59Ss}3?h=c)pm%>aM8(?Te&a@vYa$m`HMXKWzCU<uh1i(sav#{l*t
zBp0xQ0i$)pBhVhcvM43M{Pi#Rlt@WPplCC9T5P%t?7df~0hcESz(FhN3b3!o{JU*~
z(*F&iv)<ou?Vv|`Bk#p8MN_1_eZO~^!;GEv<4KP)KX`VRJP$&zwRXG2foom8Xq*ie
zrrYrw?!DW^*g_=qdV)Z?3EMMooEu%>-n?}~Qy(>A;gVL5xyRn*8~2-=0wnA{O3fzY
zP1QiM_8}j^pm{3mhYPyRjT(SByTqB?+Cy_EV@^CY@HzR}6c}p|gT1|uA)iqoy!x{(
zZ<uALFqWf<BTYPSITAml;4hhN#awU&`z=p?OBdq{8(`8<5h{?#VM!lzj!$HE#V^pv
z8l?I(r)`~CU1JA{505Md<e<-lkYOBt)B%ToUeXI1F#%=Yc0fS*9auj%GbsIF71*&W
z)6x85`RwAqALALP?cH7{6#_+?x6kf08+NFE+O0neSkE?gne)Tu9{<e4+y>;HhU8={
z=1`cKTCb5Gls+psB@=a8kUCHg0G>Q6TMNJ3djx6x(=<7P2o$gMyZ0ve_N(H$4|<5I
ze5V8&s~^Ql-$0$;`8!;bH#0c&#KYo5M!MOG1;V;3azqC9ElJ=)@Tj9iQSe||#>Yr^
z1YT9ZTOlz_4M&4^jg@}OL3v2M`&yyp%=gCb;saa*HvP#Q2w5`6wXofZV~bhC@oeWE
zKHkd6jYvI<n=~aMo|6hE?_L>(j8kwDXo}hMh`IS{_E3Ow5J{B$DNZ<GfdlMx6wGI;
z72nzKbO|Ot8A8U1t8=cx90yCXGS4Nw6nZa6N`)Q2Js#8mxdhVr`HLnlUoC6<xWy|$
zmG)-HKpZ~YYKin)Z-85{#sB<`Y!ufDZ-<bx1@d!%%fZ+pEqe&x`{pY24W&F)#2HN>
z2h_#q`srX^8<U||UT10kNKhPF<!ou8qZ}+2#PNO?6e4*;GcSFs@CX}dem32lKITKq
zqY<4cZXdhndqzWWuzpaSs|Jl)+5sWP>fhh3-H@ReSljN|)Xx(6scSfCFHdMqgty$Q
z^wj##(9E_UQl)gvxle1s%PeGLDe60Zq~-5WLyIrNv&Is)jx$3{w<4QGi58QZtpi2V
zQpNAh#(lBC|6DV=x<5O?Ns`SK_)gG~BP!NYZFxhsy~l#`mEKO+fJvTOSb$Xn-g*4*
z<)y`EJM@X1YxVqzv0)Nbe=Pmo5aA!^UIYFpA3OBLa_(u>2b6<DT@B*w<gZTCwb;V(
z_>E)Ye)seSyH3@GupH^M#)=V2g0iQSynAufwngR_`S;S(?q8A$PI@+^a8tHcGG5NQ
z*ju;t!=tsa*1a|&1e8<x8bYzJH{NDpYI-<Q1OBu!+h|@m9#y0ujtyTIYff|PdCYXi
zptLg+l&v<R<F0|?lQ2GIf-`RW$(Uc*JjSNeLkJEoX%A>uS=Q7(32q(Gbb!aJ`41&B
z!X+U=@+nHtgNtz*Y>EE!D>j}NU+^hpu$^U|YG!SI60tl<w+WK3l33ski=(Je!b&p3
z*TOb02NiB;%}2_0q%|Sr^S&ywr<aF$N<#en@z<dwJVE(#o2m&c4^jNU1F{P+#dJ#_
ze;D|TMgS7R%0$~U)8(+8FHiJI?c9pGzmefr(UDc*9|bicMYOk!9O#B=oO&FV8PbV0
zMbx)692kb%i@?Q}g)W&c_(h~Mma)_QVBYKpMsYEn;_3OGa_`9yBznuv%dg@SJf(YW
z*%Pcfb-+*99vg+yboMX_8iku1L|GKLM7!V;lC4`(yK}kY_+dp(Y({VzIQ<A410rh1
z)a;#4G+gF{4#0lZHepC*Dg4EVi7`!ky_0yCX5!+nH7=wwB)o-%)0Ep8%k_+Cs#Ckj
zmLbvQ$_M=}fVy(0`FUbS1~Winx}P|6ZNPL>QBdsP>A~UMRNc55+gCXH?+<shLL`-Q
zWxjjPM<)1|1ocjg-O$g1uzsDKMUjvOt*qCBkEo`ld_NWo<2e_ow`!EgeMsiPcAA>6
zmswT)I#C^*-Y4-I@VkGHs_FTh$l}T;uck=i(<ou%X56$z`P=x`)248Vzpu;}T4lF4
zD}}$l6u=tzvnXsjBojvca|(3ZCS9dz_J4k;Q~F*2rf%+E4_qO1&*oI=txf5>(i5t4
znZwGfUpM1Vn*dMYaWnY)tCU*@z)^Wy100-Pi~ycootLfrXk&?YKi|Ii^5~Nk<+2};
zWFtRF#M82vul%~X-(LTG<ot1_>d5rR(4kKKPR%jV2-ZRyV#(*)Gcpug5xOwJ>BnHc
zY<?p;(91>{$k%BS@Iy8sBW93R<NXWga{fQz{D0C1zUudhq^Z^<O*B2o?8#2*$##)q
zAkiNbVN|V2w-h|<wn&t|rHhkZ<{G4<q#wQ(dnUE68&rNREIZvQOmot~Z|=N2s12_@
z=_WU)(ty^<7LhcQ6bEiT$v*rMH$9xr|3L?ljr~#RvQkXhNs>2j?-+H^S<i$>a0(Nl
zDNlNoLnBkWb!LomZVSS|5Lk)=1knfIej?LzcICZC`!9G8jb{HM7|z-vQE>eB>+3Q8
z-C4(7qTK*x%;MZo1)}9zS6PTfvY~23HpmvkF6Dv)L^2FvWo&?pS2l%fMPzJQ%EpVy
zX3y`4tkLy~i&DC&N+WKWy@K5+LiO)qY#vO^x72diiM5RBJ>y-%vbe>sjE5Jb))bCV
zybaozzi&SDC0GY&x?GDJ-rv5XQGBejF}Ts)5*{O3U^4SkYV~VPif||XG?Ho=g?v%Z
z(jf(N=49hMx3jrnA}0j_7Dm`%7!ei2x{te;S7dVXgwO`?{=OaR(qjg+|2&=;8`F8B
zkd~t1=jZnWu;|`I6>H^u{_Q<=_4(?<<^>S1-YB=edsdW?kTCi0MEq~t((&KIkNvgP
z)t`SWxcmkZpD(}BmKPk-ZqI-I`t@rPFbLi%w?2HnR-hd9?eNmL#yWv%`AgKv>4Ne5
za1%W4c!h~H;L)NTjzV)9aNG5Um*|vBI4uSSt3mTRkVq;t<mT;-Xm5}nD+}a`VB?CO
z2)*}U1FgdW(K5To7;iZ+H*#U(T%S9?C~+%*1uwv*4`{h%>($UC!#=%gt5=#zdo*NC
zTgW}L9eTfPh0c{kW3RaYiXGO5p6(3j!R#yElfXBaMXL~RZ-l7Et^^4mgWuB4u4MXD
z0RP%hU?`D8t^o%2Vu3yMFPyMIzvfOAa@Z+Z^LDJj+mg>r!Ct{YVl(>PQK&0Y>;g&*
z2SmFuL0*SQ=NaI78XMQS6Ng5RFwsMR3~JinXSPx2>P=F_WaU?WOrwG<Fl<ba!@t&8
zoxgfh0=%|?*G&E@3#|vhh5YjSwy=LD*?D>3^Fy)<bmNcf$7g%5F*=w4V3=wlARHk$
z(i7FF=d^1v8ph<cGao_2t!f5{KYea*24o@oc_3wFC=qH*fAux2OU_8TT$(|vejz9Y
z@r_9{8QRnjg~k0ETsxo<JwLr-l3Vm$Y2wG8<@0-=<UA|>Nl|4H*DU3n>xP+Y?VPPJ
z7IqmwmnuN0E%^8NFSj>fVH?|9>R#v4ev}@{dmE4I$+K?1<h>8cdm1vtSPUNR%`GT6
z{Q~Xn_W%v6El*~<Et5>BNMaKY#$MD7R8_9{3C2lkZo`mLEFt2`QTgUIRxb5_3=djc
zRQ70^w>$m2L-z~b!!)u-SJUR?+yj4-G8l@aowrEA5Jj98M{{~NAT;DO$vCjRwXL;-
z**J@`b1ener%w<)hgjP=?rPZ$6ZyFPaAAI=2-e<QlNPYZdObC2IA_CTP-jGXnRE5j
zB`yHowYE5Smz@{uv=hxR;k<*>Ty`LFc{5#)kpix)y_nO%IX}i{a&fjZ71`TXojzYi
z0wPLQww<VDeLn(ah0I7EmHV5eiJRD<%zArsiCb)q(0ywnl@+(!;%j#o`wSU}1Zy_7
z&OEB@GAs3Fp5NAvy1Tk60)prs$5cK&t*fJ4u4r_eGbu=ZlRJVVBDdlqgt0JispnCg
z+-@Zkgjv+uVg&uTQQr6QP1VH(p>5FpRti!$CpBd3>asElwGBm6LpX2S3Qn(jwxkM9
zxrr>73v9&wp8oXK4=<I&&f3V&xuN-+;WH;r>2o!7EOpFbcaNw#JPs5GIpm1zwoVWg
z<ukKHa}~DpUIYvoY{46$0qN5DoGi60G1r$@2W$7^gc$5ui-uKeK6;9Lm{i>s2_Vp8
zaJ7)s0#;Vu(XI!z1O;b&rnsTS_H6mA)Cl=eWP)N23&p`{yt_~PN+J<jlvSI5W8$tj
z3$}gm@nu!V2eL@7ZD`_9X1+m`w3Pk9%WNU-huGZtYAURuR)JoZ3}Ew-OVyI>nzt)r
znyr4kDZvU=M&ccOA<BzjEvj`2<r!)&R4?uaOYKm<PcV&_@cdXf5e#bVQ`(L>=FK*?
zidtr$FLdexhDwg5w!KtV`g5}!7G*4c^E1L!_U^^~^1C!K_nOfv(Qn}6fi5O^PMlc2
z8VM}XDHYdPTR?!k`~=tXssQZ3+miQG<%X0!wJ<-J^*AND(^NL-<lgKr32LYhmYuvK
z6ZcxDS<yK?UN%@<m(m>79#f)MEU-2r6(+LNWQifRS+HLA*7J);ff&5?B(v3^GC5Ti
zpNKfNp`qvTg<#1`LczTcpH3o14Hup1H>Ygl*93^n$M->CaVNfu2HS*40qa#vq<3Ri
z=iY82aXsqjbpr&1-TcME*UQ=4qR3-wP%6=MEEinEzvfh(-V7HY*do$aE#IUN$v-75
zW3wSl4ouc*Q)S0)1+fhmW#UXy0dYH{o_y!*`<>Y>5kj6WDzo#FMJ6Onl0}R?%JB$K
z1$)paE3ztVF!?dqDJRYR;E^alI}E?eph0cQz!>H+Z)k*UH@Tg17B29$d|Ns}&TcT$
zzOWos<udxF_NOu35VE`r_IIqYDf14RiWmgAM&da@EHQMvsz6lKjg|@J3N(ELgxcRe
zA-<2su|lq>wz|}`d!qKEqlJR{ZX_RJTb(fnA$mM0yBKS}p9MXeo3?coPhP!KkNEK2
ztzhhxgrnv=iOMH3xgWzaIQ6kAK_IMk0acOQkEj-_nu47jEn&qGv=|oblM@%(B|+q1
zWE<(I4sHMN%z4sQgkWGj%W}X%)WO)3a7HWON}gBSrs1IXfMN~18EfEaV9_3&0k(Bx
zs*mzt4t&VQdU5=`a4kUCZje@kwFXC5O{hJ-EzRut`uj&S{`c7&P+ei5ROF>rzIt6G
z*y)1MdDby-ivc8mzqsd%YsmzJ%|SrEeTc@QL9;btuOpDCwsM}yJ*~NFomfiFRczBM
zJ)!3Pb|Cl+1hX88>LS`^8>5<<AL*5z8kOy^*zCh6|B0mM=9TS=SWM(Y8y`uL{ie&S
z3K)DnX)D8MBQO^LZteK;K4I+A*-zwFq}jPuWe@g?m8aG={NA?f{(yfRYTjIVtm^!!
z6fA#YyU7>d*ubOXEuALj7h6L2Mc|@N<&m2d=cH4Qs7(W6cYUxLZu_Q=V!HgKM^qw!
zH!k=|f_1yo2(KIvCpBOe7Xv94Kh|~s`O)B#cW1dU%$z?x@~goy4`$4YmWK)%ab3FL
z61RBL^OpfL+lW71M%>wj&%b0rXgP;)vQMM3_HvAx#&_(tN->r^XMj(azi$sAVn=%>
z2Lx2{5tB7hJZttUazRnB<<*mD{`BrG`diT0fNzmDl(oIJ<9Rw(>`R7a_n~Y!!HJr^
z{NcJ2IQwf8wCezLE2-4n*}I5U$IO;IR3&dqWZj0iDpNIDZAQ&G%6>JU2w_6nkn|p#
z1h-|ZUh*roF$}$i9cX~dFZ%8$F7l88QL@a;bYxfN9qi49UX@2a3CmmiSdv1g<yc~n
zw}$OBb-5pS={`EMA#!hp1PnEW{`4d=D|{JD+{{S>`3DXM+K0OHErG26Hby#OK1bHO
zR<~7%9zqWp?^}I?=~o`<Nr^z|$$z+IrH3e(#hDCNWbt3D`PD1s#{bZ9^;P%srC#gZ
zZR%H>V++n`%^9_Fzw>1?iR!Ovno6Z#j{e|rPnoSIW=K)UL!uv=jsL`)6pZt<xKUC$
zM<hbWPdy+$2yGnSBt2Gh$ADij(qiW*|FDb{vp!9!JEp?w>;G*i5##)h!;^Bd=d3Cf
z)7UH)>p2+lQTC_hhYzwE?UfBGBW}}DZ!yBBQ9DiND+_9J3XBv`zU`Bd$ffa)=Git6
z)(Z*e;KRF53NEXzUEt(rRp)Y>a&vmxCn=Q!d^;6c_pv`Ex=D3UZ<!$5VaM?=OXe)-
z6EoD7DGVc{I20(l;2;U0F<d;g()R}i99A-CEyKpIu#zHyU0_37URI$9qjF2XlSR%r
z$1AR~KgWQiD@fpsyeP|~{lJnbr#pf$uzQ_<!sBw*!kKhkABRE;P%B^YoNm0+I5Bsz
zQ49rK{5}@k9Uy{5nNQ@Sw(A*JwsF0X4!<seNM<+ZB(DCe`IOUay$G>(U4dTRxl#67
zLGhyJ(QrK<=C_hFDHVtz=#<jGz5JT<AX*I_@*;Z?6AKchwD3XJm%RPO|8r_5x^4hp
z9|POkj6`WU4`RkCbE4)~D{u>Deond3Ku#@`oU?d~Jhnqmj8B%Ik~Pwa)_>JMt_Rmh
zMfZH;!JY}`N=`34AF&=1w(a&j$*i7ny>b)#F~x3}s<MLeV(=;2KB>pmOUqUEV}Mv9
z<msCOf%j!ydV*P)AWze0LRq3vogA#*qUg_z38iv}(?sSv>w&hD4r~li*|4so1+!);
z>ft!SuiSn&y$LNp=pYGWKN`dZG2yvWjdi2pCQDRgAYkJa05(@0{Xedcf&JGbMTG;X
z6Uj%S%=o*_$W8R=H{#vDqPK3gtG#A4$-5o)rXT4)6?dx_f_}<{&xtB99ico`juhuU
z6@3+nJUi&y3d;x)c>PmVqPAroH*9F&p5Mv0KIsxRRYGsZV#9Q7nf&2j^@J53agl=n
zZHD9kVcDPTAH9de*+9R|9mEvs@W@*8iypn>lm5&&5Rqz=X~rf4d*%RLTdlsYyuQM8
zUI6Dg3H&s=+5}5l2{~3Kv|KjC4qsU8L>H7813D#&?8F#u4dI{OL1G^l@cHy|x?=BL
zzb+1xCErz`po<!6UlKGPE7^FxJ$o*3k`70t&Io_A6A-hLC3k1c?c!EDIRg{i_+jAP
z(TO{w-Yv-|OrX|xg0xXZL(jYB6UN|(=kc5}WXdw$$~jH!RW2K##=}L4jFFvCGntPM
zvQVVgms(wCigaUzUDQ~oDK>H0VNu(eA>Mj97bi1^tkja3Z@jA5ya?DeZ+<`*q3xnC
zv%{%MtmQF>VM}jqz2@r%I~xx>QTjr{!Op(iu(3uj_bbo_ztf@Re!6y<!pc(jT#0F+
z$OYCQGOVb>r|FbuUh-Uyi45&|RFJ_rO~ITfQ)ig34gGP}j3&q0EmC^2p4jNDMG~oj
zsWXE*Pd+K@v>s?=k5j<Q(?($imKy2)x-}|$uj#!KG9sJmGQX<L^fOJ25O6nBsZCt$
zh&YDc<*DBbQv~7&j`-%SwZG!UqZM9MWu|Kb_l3y~ql9|CiAXfIuWVLGoB^ReE*bnT
zJnE}XPVV+OM=b85jhV-3+gP=UuE!3HjM8w{bJlZj`wA!ShvDc~FXLJ#5O5BVVfF%n
zTVmS$Se4wp`yqq1f7&1ti8kLu^NlrH8`s*)YVk`}89Sdy8CYDE3^Wd^&3_m;=l~mt
zZ3hD~GVobNmflR0xhkS!8;+#8meID^>d0+N%^9s4vvo*cjVNWE^OSsUhVLh^HEkDz
z$|*8`d#cYg>m>#8&W#-Q+{*VuuQs-a?rv^Mo;AC&*KS!c^I{XLJxgDgGER?NxEf-K
zL(l5+M=w>aJ|V7e!%;71a{+{{Ve=j>gm>0a-%!8iY?MOIaOYSd3MFFC2j-~jbtMJa
z{c#0;9|&cl3J@bXjN^CzZo$&CUURzp_8nMazY<mdh2%RS2m8i~dE&}L_;19TorYC|
zG@6XqgP3iUkg~@5wZ}dCg;q)YFYz9{%pv?W@J%Jv%St5o4vHMxT^2q4Nbh0F87Ms%
z9(h$-@gwVQ=Tg2_`mmC7urJBC(o9bLP_gylEb2wvWF?lbwh`D8pQ-{WXzpyl5hE!)
z?;e#ztJUs~6+?>A4uh;n9)b(1xg*!Q3p)Z2_GFuc5TTKA)M2pwzi79))0L-b=)}az
zkweSF*<<k1FW8=?8j`*mX#?vkJ}URV;^XxAo8iU9z!9D%VQ4v6RbJH)9n9D)q|NJP
z$_o-M)g|&^Ze(oGuG*^N^6z(!3z|xyTKW2}n~SP-RSst^pbFz>hgcIiKdrFXzbla!
zWK|&f-BTIM<j7Z#0oj}$WCsLvdZRxa6!}5!$UhpO^UAT&V3f$A>g`N(uloS|CdxE`
z&tT{8J;b|xp`GC`&zY{`J*gRZPJ&)3mR;eA12IZm({Lt;dQEE9U)}Tai}K~Fu5@6Q
z-zVkF{yUwDWE%Y{lq%p)C(AStW?U&;(1oLsbwTW{k6lD{RgARC|G}@ZZCLA}03~>z
zRv|wehP>b1oAR%eUQ}A>06RHB6WL4t=Dz0$k@QqWO~yC%S0F5QDWU4SUiGcpZrgoX
zS?7<k$1H+Vv#t(#5`faO{26JSe5<&2Uu#<jk?|O3e1w2^+)#5*D{7&Atul@Qv9@UT
zk<fC?#Cl*ev8lfpy%bizkE;(}2vEo5C<Ji;BPk4dcY#%TT=2iEGAJCik&J+u&&lzl
z-EfNM+-@IYw`ZSDTO&oBf6Hx4C=_Kld6P=`F&4h9_=<VzN~bkngM`&}<Z2FxSlzII
z*=+8;DByj^;A=z*KVyVkg>S5Czf+MZ^so&o=Vgdqlpv~FvMe|)kln2Bi{{@s-%a-)
zKyyh1aTUqg2FvyKzqW-0Ft}ZdoErPR{g_SjT|#m!`x)q`z>^v6sH@eF)mz7%WmJwj
z-&GC%FuzWTFmQ%tt@C>z(wpma%spH^g2p%|Ml<F}r?#w~i6qab69bR&wFes@&4f>N
z*7wN$XK?8XDS#cWGlFck!8z|t|9t-C_4x>@k_Cb;)56#R>;CI@ysUMdQ^?OL@paY|
z{qm3RuuS$Oj6|B-%z>RA46k|7%UA=xt3^2L$EwSp?`t?@ymI0kw~Y7GhrDHJqQ5H>
zetp_3G$-S74yoO1p=1QdgQj{>X<C)}Byh>}vDSwdHvyznDhn{;)!u9aMP97MRAM7@
zsnegB(KvgDrHydZsT91Eox%Ck+t0#0h>qXzPspY0qHyyFf0^NmdHcrQ+TD2jY+b%?
z5>SGxR(U?1Z=SNYHiLUpv0gMt2NK@|oEznugyh9WM4_s!2D*Ql9<2@W$%|4G&?x-B
zn~wn|2joY{tIY<Ca$U~uIXY-}bR3Wm=fFCyLO`SL-K1>NA7Vq;S@Ja^GMU62AC~Q~
zx%7UD;<$v&)9U(pc8%U)g+bP+zwqgj08_N>=xbT?_Cbm&n*yJC6s}j4#MgIQ@0s8q
z8NJGKW8T;C6&UPPfSay`o7oK=3?-Noe!f$hgY1}9TQhEh+2&y-vi+?bbM@5h_TJsG
z#%ivy5#RpiPT88mg=rtYh#mYDSD>=KQDvss=+tXAx$%^cDDhxx&K$AgYCGln;Kbml
zJTS9Qw!`TtX+y5od5Uq13LH0p7&^5Wo^35LDk6XK_D7VWZrVyxgt$W@XB>qrnLESV
zC;>3FLDylQIh)i6O1`Zi!aSfLQo`vY@&<D)6?8kg1+7=E;dY;iO{eW?*tY}jN47jk
zoTI`^vm{S(`pP6ylG#02TkHqLgoolHO3edn4h&wFBX3nvZ_Y<YN{PrCbJP2koPKAi
z3Ja!EPMwI|H9Rg-^L#e5`2ADmlIhB+`OjC<ubs7x;{#@xb@l&fDl*2mfN7+EuB)c$
z?aWy*cw(YsIudk>^m*Qj*a!EE7#@+6gWlc5k4~H&vibQNwLTQ=6@?rwN?P6@SsJzc
zIFg4b)b@E}nSF#gSlwx?ha9dRdc;$-REC?x-#@d!6OxbMKpQ7FD`Xn4@oKE6)tP3{
zLkw<}F>tq|_H#15(K3B9k#b;y$Oo7jI+4Utq&~Pq3U_`B+{yZw9O*5B;)ykkVVm5?
zQ$vFFxZ-{9(vOd3EXWh{q!IUb`LjoW0HAzj8y`aGk=4YJILzq!cU<2g7lflf{!I;`
zkDT4f?vcLi!Wcf0q_uhy<|~`HdiedwMa~t6{mEbDy4EAJk*^1}UCgt)`r-b}0NUfA
ze)fY?lzN)b3TArl(Wh}@<|nlss_uqT(s_s<$^$xrRtyXdM=qTqJ>TFU$_kD!rI)1U
zo4wppp5uuTkI4{=?w<ryIIx*@WHvc$W<i?-YuHlghaN-A;yM8b?b($tId@dWe?%Xa
z^LE4<L-%&=EL&+PNbjmZ?XvX4Il8b~;z@PS0?KB6>DOnkWo2_Z#@ORt7rw@=Wosry
zfVm6|IlEj-1DGcB$zO@FQ<5Pq(--O_;_Xj5odzr|(sW4SLdpfFmP*>>y|hF4+U~J;
zt|$1qv(=m_$vUOY&}yd<Bynw0g-)tR0v?}_Fe)|eafz~<Yht$9ECS4)qM7|GT0xUT
zG5q^C10`7i9a8Yt7;abbYxd3?7OjIJp>UHjQ(0AL&*CXD-1H!Pqs;@;Q$is}3Ib6O
z!?(7A57?*U^0xYQi-6HxISVpWiH_y+`g-McKQB-u9^mAJ*o;W8Vhg@MN|zVSq%b9l
zS~Ywv8pQHtQ-X+6OUva?vwgMHYJp^n!DISLQA$M4aEH!z#YUe+A7L^}s?r!~m`nE<
z$uOlgM!yUv_8oIfA*GFYvtO=MG-b-MlJhCvpTQJ%%_4`$Rc60znIX9*_Jmh!imN(&
zbI04}Hr}y!kn$c9!=cqfx7Mz`N>I&PH4N-;S;O%2Y5HH_@XT0aN$p#1?3pWs*UZm@
zX#R^p!bwmK;-hnjqUWoESL+#7@}4ZbROQMkSIl$v+0-vTKZvm$f6%Y<&BS?I#*Gc3
z->0vy-!(l=s@wclab?@HYAyH<!)a+$t$wUU=7#w!+eCM+)56A+I61)x6!ZuvrdMXG
z3CZUQU#k~LdhZ%dmgwNmR2WZa#i;xENPV37k<d0fva@!c${#NuE8ur9AIGw2*^+NF
zc;Nfl5{r_u^Jia`2913DgIFgS!E6w_zBvZ7d(_T6N*uXNv&4q;9@paMZhd6c3w(1d
zHIMOO^ZCh#7I>>?A8mPTQ5Rdfr2`UB7|<@`P&;Zov^;A4!!0Ur7MDo0`de)^zVHML
z+Qn~0@^Ti4ss<Y6R?J(TSS+&7q^}-X{4MnS_;-C_6|vUi+T4p2i9Ooc=p%A9KU_U?
zaval*@9T&DooLe64vgnes1Q;G{?Us0)sqTDqlp@W*Fvd%$Pu5snQdIei!Z{kGxAhv
zcWZ~m`sC|epL>DYqh|aBivA??UlEog{TV95ER&B7Na5CdohoXg9zP8TDK3R3yK^P5
zsxyxwzc3G2c2ul3`fS|yqZDj+8{nrONM$eYbqvODHs$r>fb>2x@uW|bc@mELqv<kA
z0*`#?UO3iw_m&*auzDkot$sKX!6E9s67Lb0yT$}!HI!vT))08|Np=PAmcOpo655uv
z9$1@eA6}!5oPM0Bp^{~Ot!TgF8sz}uZz$AWowrqRkxyh>HN=*gyLZxx0ve}^*d5s7
zZ^F`EZ`E9j1enDs4NYjR%HF`gbB*hnQTvIagfrtoBK-@N)7?eoN)vdJV1U7cSD&d>
zNfK7zBsXGopA@FL(dh8oj_#Lq_Z^$WY{zS*n>;ppZv^uqwvy9UPVv)J7atI>*uTbz
zh$AqtCHLAM4qe@Jc7+Ic8!gMzHO*PiGbXkXTdzeno$?3qab6+)Wg;bCgg~Fa_eD)#
z^OzycS+iXy+5EhxQEXv9Q`PEJ>CAeZCPFmbtHhP}2(89^&MX)piTu-S=FQ%ZUwz?^
zq!exF?9gF_yl)<@hrF!Ks#1NPN(@gX8g1~WncS6oM+b4ZC^$~m5wTZEPdA7jU2Qg-
zhwW!d)>60?X(r<Rg_yMsz2s*eBb_Vt>T+Um6DcT`7TkM4S(Y0-ZpCVOZo=oaID%h2
zJImHp;Yl_M_Z9!9dBXU)NF!>cPS$LAK1XWUDU37EW=LswDRBr~XU&>ey)RoG#F{FI
zCax)*t{Nxgh(M(k0H@HG`US<%pl4N$j*K&m4_@}-pN{}qh=)Ae*uO!^_qhve6_yDU
zyCpG9|2<_EgrZOi3G8;d%_`2%r)VF&E)$}Z&F*3*I@Xc2)cTQM>d>uOabue$(i`9O
zqjLBB$Rb`E9@+}L|H|DLSxuYJ#{LB6cooyd#))?d`xamR)gJZ`FALNP5X*auX+owo
zR8Z}gpRexx3DP|qxoQoFa=GqhcU<UCOE`cHi26Xz{~7P*^Bh9CR=DXQ=o0?JMl?M{
zLk%$@)#A=t?*Jl}ZB5Y<I{a5!e*53&3yS1Wq;8`GnxL3YPth-uxI)g_y{|7kci2L?
zZV3Lj64EA)^_Ze+VfrtHD;%Bps}_NJKWNz?$++duYu37DJLvb6fiKkBLbe&|c=oHH
zfshWi*@Xt5+&F(9HH;hsv&j?a<{fu-^NO5I&g0WHRxFAv`w9&vvV=yQxnYK&90bYv
zxlBimbiKchKZr2W`2qbGidQUh5bTTW+3Z_3Dpm<{MMcGVX>=U43N1!vnKoCo7tBhO
zW;Qwr-=A>8!8SMI_Pc%QcH{LPA_(DRkSL3;_GIW(lYMwKrSDOxPw(sY|B&|9aaDEQ
z+OQx<Y&tgG3Md<p?k<%QQ9_zcNq2{Imr9q2f;5}%+^|tvy1Qi4-S5Ktex7rm@0|0!
z-}gIz_!C$)*P3IFag8y@xW=k%b&+;FlaB35uQqtuO;@h=ls(EuOS!k_LvUZuNBnPq
zZ7y*d*gvn)cxav22QNCtGoCv4QRMRep%!#~I8G^b75{R>C#U=_T&cEkr+96>v73sK
z{9`SYL6lWI;aLMMzw)HVj8o!^UkX1|&3vz{h_hT04Wpk3Vi!r1oA*YVST>KtfmDsM
z-Su+T^uWHba53c#n|4Sw1SG@n!(-O|$wx2tv66VKYFb1U1nIs}Y&2hbxE=eG??VTx
z0UnMomp{8id}k)}k%lp~1{8ISYrK3{Q<B)LhYMU$A|N;PVly80(zE(zGhSGRXy5%q
zu41?n(lJ;1U3_r}*M$UK*dua)4h+@dp_3p;g4R2APzT;jS6ve&sHq?FbM@&>hh%T$
z&H(MEWHq&fwlKa##$e<Qn@Zi&Eaj|FUu696P})ejBcq-p<JfAEicqbtAfJqwTh$FQ
zzZ>1CS_*3Fq6}#QS#QJJn``5d-lNT7D8M~2l|P>p>mU2HUdqK;$FPUv+(;_+frTJI
z@*irw-(nqMQl|**M8^lxgd`IA3!)BO65BOJR<C|HKTEG8U@qc9(2OTxV*0S;hBgU?
z9Q=sl@)!`RZSsr(@_aguH$kG!p5(`e<j{-7OJgD2EW@VnWKmnU(dLA74psvupYjLs
zlV)13cUh&bIIj4!*S&8<k+C%Gj32oyUNy5GtoB8U%KiMT+|mMbZ4l}g7U>9QUw6Ji
zrG_XEmCF;F^y!eQkI}RRE3SX5Ip@2Jd5CAPzvo#;!W=B|NxD-=6FimMu`YR1J@SfR
z4nLHf-@PS1KU|T@6h(j8B<I$v+lT_L&Rev<(8LuxxrXITl$+3+^&1R~CCsi5Wo&3R
zLCQ_pLyVl1CT*-9Kw;(L57L;t1{>axn*210!V3g<1kA?VNJ8dCjvz5_ji;BmSPkf@
z4#upb-*`<N=#YJRk$=_ws^l@)*3`ijeie%?Mhld3yUJC6l7IRl9ZRfVwY?;H+GMi)
zqv?-s)96888H`?Up@iA_*UnZc!PnF*GHn+g@k^Y(O`j~va@Z)x6%n~Ca)H<PwbJ|A
zAGppc?<#!u9er(l{($Q37a~w?kT&<1R|?RttEWGF=^j4&bnl%N3BoW5rgdDz{_C3x
zYc3+W;<<7)Gx5`NSs(JG=Yg_ZheVHL3$BEQx(Y<Vkqg5+_2Fs|%us-k*W0*`F)*zR
zjpj$<qJsblar*BZ`%T_w>4IzGM2z1Ym`B70A2@vpy<$3IF7FxE15z{mjLEMPP~W&!
z8^)?Qi8oQ`+q^7v0Y6lvtWd#<V>AHs3XMgGd4j!r^XDLv!!Se&Gy6~6?ogafcTuZE
zRSi**DP6l9+~zDYK)b-{q-A8dT#;J)A~`_2(^{|764(CN#kIK~-KpQe5WT<!S4%$Z
zRnFK^^O;H~zB9e4D3iJuM&};0gP=2o4J>ilh4baKGI5KDAsb72r__;W35<`UekFEr
z_e9$JT)m9i>uI{(Bg_=@!`l6fxt+j=CRQ#V9q^6Ic3s(ZkzbhPafr%cu~bJlfuC@T
z)P@l3rAVkUbech^!S;gan9KZ_A30rv-%wrJ(fZ&K9HRx^)dxF-3+XnxW1WPKf0oui
zQG~OS$wSPu-Nx{|+-wmsVxjg2Ma2CgBAs*1hrx$}P&b^0$*W?W8e>F%V40K2a7Mc9
z1hDS{W+}#lHf(B8mzQ<qFM}uQJ=pNHr~^AFz<x;n^nRiCgF#yBsY(iw6I%akZP#gY
zzC|#T1V#PwkL8JqPLj0ho#0stj3Sy*9IVNDb1Qywmi}}E%%;MqSK=u%+k4-SWB_Lv
z%|zWS2~S9+jBs_j+5t6r^94b_;FMMS&d57(G>gMZD@Tz*3tn2ycE|q5Jp0sO!}LKB
z56V21sinb88?72w8h-1!kdCoxL7$7S{5#f0P*c3&V=GwZY)HZ=q4i`f9+kju$Rm)T
z`0dwXTs-7l2w$NFG-s1Ti*}vKB@;-g;OliOQmDCjG~tv<V44=wYB{_uXk3lHePC`j
z{3>U9<yg?jOPb0P$=~Pp#dK8ETAyfS(*hL){%|$piHOlQny&_sfiXIe#ue_ObGpEq
zX4}cw_v=GvR<KaDjc(+(9u4TaKa-$kGu_sB5&TzzRT(rZC9E*HwW6%dq$jP-x$g;N
zv4>7Hz~&HxL5JuhyTQ-}GTE6p%M0@0DZ}5>?tzZ2U0a_sL6CSATWQO!ncG@T&V*o2
z9h6}`3^;Ga{F5VIodxC+4wkvl=LN4j+ufWxZBxrvl~bm*H;y;r-ds`V*=XalmA&s=
z(1p3!bq1<*C(U4nJFXy})#Mvb5+1$?o8}NM!A-=#lV7ELJmEr|bF@+o=`t(7O!XJ)
z?~7w%_wqCU5s-<0)5Ux%&Z-~K#C+~(*xeIuow85<v?;E3K#8WX{h_hwm=TeNA9d7;
zj8ph#*GI~VII7EpL8@R=>#0_kPTnp3Je;mz{0>KcpUpfJ3yJ3y)?;&glS~vLi&KL=
zx=qye)@;!x))}Cfg6MbTVRb{-6WovkeSWD-UdYtV&!7`G&#-BO3mE7(uX2wq+v5UT
zo34N|{M>V1xqWL<B+-{a<P=hSv#-61YAR}gV~5A|m<S?sZkv7w65yr)_ter^1CTCt
zGs3<%)Lb*zA|;lrRgW4!z*X>04@buj4<=I+Bqp2HPNDXB?jCiEJ=JN+1oUQar#oI$
z=n20bx&&+x$cC825C65=S;n_k>vk)?Gg}wd*+j))Fn2*d)g)B@jV<O~8oT{+zt2p)
zVd#(9Cyb_x8us4%9+!(v9fvQgEa`MlVnPNI^uE6;zF(wkVTTrQMsf9NP{ePD!fWkB
z#`6Rv!|z#dTq&zCPI~tj6A5I$KKzbV|N6Hn*c{k`mQ&tXU8ZB54DDaZkALLmOTrO{
zk$<yv`&>2RB2aU2CV{O?qLwJ3{86Y{u5og$F$Ui5^m~psj*(lW?*s_*CT#R-SI~xG
zHgSo{%j3!kTo~9SkiceuX`nrLIC&^1=8Qg#S6PGP$t$$F@~?#BoVw<ic+(XGCS2}a
zW&%?Q!!x$nuGiARAV!6;qi2aq6;|3OW-^8y(gQoKj<5T_q$G;ExQ<v)f_T8ip_4<z
z_RY@dNgRS5LyMJ|q6%JAy;OrF&nL^nUzr6tEVg%l%&=4Ak}f&WgKd$6#KAszc`=42
z73IdBzecoQme~`o^e5_9a0nF`@9=}b-X~>d@hL3mm-ZR-3_2WQj%!@<+pbWD4Y&h@
zd=TyN#6h^aiR6uRaGXftiSHAafK9;TFh1pKQl~LdxlT&X<o4kw;h4S$5-3(sfHohq
z2&EpG(e;iObsensz|zrYes@;9EF{4X`TBkM9e<G)8Yk7{13%c-dMUtWBVgC|lOiyl
zQ%<^CC1uF2BtPs0)uD~W8;;W2td<X7W#8U-l5|HNdCyMrLQfEep>=#QIy;?v8VPU-
z6ryj>V!hF$;zhieAFB4>qO^X=wa0z8p{+yHc|uC8#>nGk@bFnwZ{0zT<Q(<0_^_s%
z{6pjSKjgvQp?+!Xp56kz=&sRm53>o0a-T#!w^QbAFpfAEMKd>QulKZoRgy9{D487Q
z!UmU1-=V(Nn+2+XNxG<W5H(AE+=aoPkmr4~4P0jWHnF<l(QySP9=%cN;kYRG)nJy~
z<d2ji!FV08@J9o0mD=hJ`I~GlUDNUhdmRZh&QE2BjKd8-v4{Y8FtTqbP^}QfZ-7~$
zV_Qrc9!-W=-=7s^$@<QrKVb5x$MEMR7voGbiD!>?dX+`nd;``?2P>WGnWqj>bBrf0
zOPi@nS&tt_fZ-cu4CHk!5Tc46@5$G7uNX|RPkh#_H!jLBA}eo@YWS^Zhok#s^IuX}
zv3`-hh*XmM#R!e(?bc<!U!L$hlo4cAZXOw&$q8yIvaWmhTy3_5PYJ%0Hai6ML4o-`
zW+Ov%Z)5>!Fv*!w6g&}rW`uxO&!)y8?*97%t+Xi+&gIN7x8r`zEJ;0nnqm=j;kgiA
z$d)PY6&=SqTQ`Jx<bWV1Bdcw;H$Su>c^Pn)aQ3djR#+%2^pHXXsoQXGmQquyS+p*W
zA(|Ny74_<i?l7UC<8NvXxb4vLVYzW@qff2#DiMc)b9=i~bmswj!AS>UC<urYaNFuO
zq3QGlYE`)N%j0bX7*C%2El0=kE3hHOH=`7j__C8iloj=>`A()X0}tye1l@pg-b5Vv
z2fnX<d5>~Abw043s>RY7W0x9s^k$QB<fW@5GA|W0n(a1Ql7TieGuh9?BU0~siRQs-
zRmB_(08QZl4)#t`p>+&(E9uzdU{~Wdur>J+_aJ;S)bqxlr^!JKGT}gCK5<R=R_KAy
zS?GYZ=~LUACq)J|V5%{Q+_Ytv^(6fJ<U2g;jQ&>VS1e!6PUFj^y^vyEHOR@f{;>yO
zh;&R=S;un`oj$B#4<HZ=BU<TzyO;?+%FTlNzk$Zb$f>lCnC_omt!mX7qmLD72XU;P
zjR`Wn-VvffSgS6LU@2bBW<N>m61R3u!?$XFv%jHH**B2WikafLA~W<wPA#a@KAurd
zt+I^kSKg9Znv(U9h%xm3^hXvWD<8DntwiWSGQ-Bi*C(&SYXzh?X?Ywz+4+!U=hf{N
z=;gKsWWAqVBj;D$ibh(es+DjjH(g`8vXcj-BkTQ0zXzI%^ck6YpeYm=ml;{wnHUe`
z0pXZUDQXGhi0WYO^66WUOMOh&ht9~dxF$Omd<*~Aq9=~y?MpTohQ3-AB6)zzybnZg
z5+y~nK1XY5$zKh(vZ|YnXpi8jm*BRI4C}pYN---`FJJ21J3XYBV3$^{kSqOJpzk1U
z$K(WJ&ek#L)2NocI)9ObAwwHWhFB{;HkZ<5`j(tTZ=g~+hcI4yLB@;BKWBMXPie}<
z=gh6)<*EQ9LN>(<(@^eO#QrD=<eF@z{k8Y~MJBC_CV$6wE4?9eA32~jG%gtGSy{ft
z9y5M9Rg$KdGR!e118yD_mBapIpoK5PStGMclMp9H<;R&Tt9KZKypVyq&Gu@26J@UG
z;mPEe^7jspr+3nDZk|*o_SzNBaV5Tq%|Pp(%!7F9S^A47zEQKZCmb=*Ar73aFEg)B
zGK<t#+L*kd%vK155x`6DXDq#^4>L%hqXpJs0}sOW^PAPiXPH&3ArKMx(iUTSMux-w
z!JC;zZ=%303-Q4Ox<=~tQoUdqWJ#J3m-P>Z>KQrRW_$1<Mpux&AGOGOl&K6KN+Rqf
z6J**53n<lt8NITCDTNp}*{@JXO4)3DGahyv{T<1am$3ks?%8Z4K4IU8JwkR^qb>_;
zH6If6_TeqYO>FOC_Tr_q{h9)sXABrFpH(l(IA5eT8NS;M;<;+{Tvs)+t$DlDT+T-o
z@zH$yX^spoSYlJH@Du`ze2g!R;8~ZoE}@(w`f*lHDq_?!E0oMm7moZf5sIKD<+AFq
zr4}y3_d4Asi--Bmi&Jw;M5xE)!CX8A2=lQb`P;xf9|e7WKUA5bC1Y@$Xs2X3+xLQH
zBWyX1D0-*OexU9JB{$ohvwnTiEnb;tbXsAHae|x*rx9_30?b+yea-VugVczaX*gC>
z>MU97#nHQT5+Hy6>?}!7prJRg(@33{qtoqBDFT~a!FUS=L|rrIAJgTn7)xjw`!-<t
zN~>*RP%)?;asw%fZM&%D<5%7yrSf#r+St|;es$>XsL`6vZdN94iBbsF&=P@Baqq3?
z43bF?coV-}Th30x!M#-NNMz4NUe^<*DJ#P~4w<cIDoMTYsjqCRH#&d*GDYNRC;L?i
z2&+7a4H$LGHk@U&faMaKiDsdRGqM=iQh}O`hI{DkCPgi5_%U;ni-|pX%EC>1<y#oO
zzskJLS>=3fFiN$hJ+`-eEW5GK?)l?acJQ@i6i;dFtI>)at%jfE&Q6#buxGkV@-yl0
z&+$ca^as4V_4qhbcXpyWvzQHCjx3bwW@w}3Nu_ooCSQK>5;}7H{bMb<)6rYJ6BWOS
zlsv|FtB1+_2l9JUC9aNFAD8D9FG%rAsNvGKh6Q)|(}Op?QCE7AIm7vQPtTvCfu26Y
zspVcXQ9dE($sYOqHu=hdzTrkPxzQ&0g>pHg=Jglyy>c=|-DZ$Eos#!2)aX1C`OGIN
zaTOXIBU)<29doY4@dCtRT<m3!EUSJ-S-Vu^P=I<;7?0|+TjVHKzJH<(e((lPjx82&
zw!C+IEC)p3I|q#Cn|-R(u>$Bv&e<P89fbX8UA+=NJL>mw1U`TDRlZ9pWddX4=vn+j
z!nDMDlTTdQY}0r=fne;Q4g}QX3(&;9$6Xc<o9%tIRutrLm<ZjO*y;Z8w!+FFwWzOb
zc#I;cWFtgBYhqBuX${gZG7TMyTQhd+2ntuHzps<$oX^(~mCL3}403&2aV!z(bdpFu
zr&|$BuU7urxas3<0!jWa3&s$;p$Z54keqF)BU3uY^ODb4#J9oD6x@vJxlzy3B76h^
zugQcx9Lox?t!;=F56@MLE3sGtzc1)V90OGTtLn#BGYUUNSD%_*Go)8b;9jb0B+u04
zV)g}ve`FHV;jsC=k~-a^kHsTE-Tv6i%fb7z@5bardh3sm{957#G{0aIJTKB;7pY(H
zK86eDc54uR)Yu_JF*i4l7V@DCCs$4mDhB%cCRcmn3X`tr9Nj!R5*{#Bt0cBzJ7kx_
zQmZx7OzzEi9CJR56gLkd%E)cw?guw<hGvH6Q>ak$AdvojaRGL?%130sa#dqr|G1Sd
zU&)V47E6Se4^B5`70;_7_3Z*))bZ+Ae#lb+0tUm3kLhZe96U!h#R<Le_EB_znm6@5
zt31t#_7CPEF89CoeL#KuYQOC@(dUKkG02>mvCPqHLSX49@v^5*<9Em_nHnjq59JKA
z5x}!LJx)@X-F9YxDj-5Ihi=$+R?1gF^kH_(0>VuJ#Qg@f?<3a-7QaUGK_KU>kqSmo
zbNqD>nZshE6SCZVKyab<SgksWPh~2rO~@BXn`S$()cLDDAlRR#KYbLSi*7rowvOF5
zjcxDu$6s@#Wr?NhBy_z*s0x)$i-1Buve<vp8~9zz9$8e&WSc3rg=TKf0#oreK`>pp
zPWT85!L~N>y4o>p9Yk>pnY^`bbF7=F7wxAskf`qPpCNK7Ye(28crn)3G)7)C*r8QA
z(Y?Lr2UlOW@QgnvOsEN*!#t7Is#-c>WrFVAI2!z}W#;~F-2H}-JVU<=k|K8eNGWSP
zYSAcYb>75v#xLMeCZ}%px8nR+vt3+GgaWD)<(HKmLri894d(bKNU?jM!ewN&jS(@h
zlgI@tB5jBjYXG!mb_ZiB-u85)Uc*T%GVI&jCMjg{db_PZqhaDAd3i&PjmwdxC3aTC
z)o?uXx~#IgjVrQaqRL0awR~Ez*LIoJOYdZNHri&o8oKK*lRCsd$$Kb+QRZ~XZw;++
z+bDB|D}xlZXsTM9Gp1ptJ+4UTDfEY}-TF!KL_L%YFBLW(pl5ek&Hi+@niyk3*h;0;
zK3Q)(pl>>sMn}oWvL0Q;bsJh5SZ7vPeBzQlI4l%P3#vbk{|JLG+d&R!L#yb{-Vx^_
zG8I(Q6?d0SAjeeE=b1S$QA?t+0F`8wYy|?p2Xqp?aG<;_9-__d;E8r4kWP=e)FQn;
zbSdwm3hW)&u5_}BRH14L07;1%GO>kzH;v>j16gFy-c6FDXr8Ium~wSCd#H>mLNGor
zXXi1gb2OHi&+$MunZVIff#2I;au3Ll5s6~yC@v=3-;_?C=)l1&vYeZI(%O25yg~r@
z_~~xEbDO==XHm-gQ-L>+0wktaT8_TBY6P-u@N8`zRMjO3(Dn`fPQmyFoHhI>Peu%=
z#1uL@^QgPJzTUsN_Sz;1pl@awFEt2-anVutVLGk%lisC{(KieHy)SW>`CI>!F;)@S
z-8f|n1$H4Mz&ENSc6N4@Y9Hyt=zemNdIHr!q-+(ov%&yxr8cEjOT>S~-W$o!eLk`4
zfB{~{kiZ-s-K@s1z+ix~LEssfjQWNzH_#tE_~N+w)A(!tyW!mM!Lzrl*AfZnl&38Z
zC^f+ry4s%|j+dj@K)fZ8!P;`k<${0z`PS<05JVn0!!-Wnk?CUBs?PG!Y>QvZYw_CX
zUelh$Y=H81iH-^chO`Zv+cF+B>ufx_d;BG}=dyVDU=LiT6udLzaaNi=p0CcbKey6i
za5t;~dJ~|uiA&V)h8l{9ksB>|(^+EkO)*I-|JAo2yNrGueo<F0ODrPmr|P*%b$-3E
zc8ND1kPbIw=ZESQW;WJSjc<ZzZU<?IJ?5E?-0!idB$IE01>hWzc8%VIkjc|T>0L6M
zrj6?4ppy;P=IXFp-|Gjk({Yff=T+1LC_@-scdl|;9JlEUATX~W5)6pf>2jL1DxE5)
z!G2qipCp5ya#o9dXw@;6$&dDdNb{h#RaVQD*V>Kln;d#Ks+tlz#w&Eq2F;GQ0|=Wv
zcCHj|GwCH0EH$X1M`eluUGe(ZWp;I{j^=={gEfVfO>xzrwAG=ORToUVh_6yZVOUUO
zSg=$$wX9TmO(Pn*T=(Y2D5ox=N+Y5wyUduHs&`1sPX)br^%%lZ#8L(MjotHEg<A2p
zV+xii&2IEVa4cP2+R7oHZ;galBev>$SDoC;cQ2&AawfjIQabrPo7A++8&7tqe^)xX
zi$T|FvA58+WDb<$3ER84jP^4C8Dh74iZnT=d|&380xxwqxeSAmfjsB8NeX(yW__Jh
zPox6SjLBvI2h(`*%QyFv8C=z@A*<6z=ldR|Gjog&d6h0>ZpHWFXU;;St;S2*)`Dny
z`(l^62@B`t+1RLx^qXh_+35H_1nrcdGU>SvKN!E5;L@3?^-#T<8@XLa#TUDAI^QG?
zrj@!PJKG%x2w%clJeIqnbBNQ4(e`@??4)DE=yYrCQLu=aWlxZkowjThW+|UFic^=A
z$6EaS&Mq(CB|Y@zkB?V_uo^7f+#eUDJ6kT~(#ZvS+B41>0JO{<`NQUm1vE{cuF6lf
zSHxUBLiYABw;Px^?h2ZBttZRT^VRdfEQ0HZ_r$;so8`+5!uf>m?q{!oYSk+@r}Kl=
zrM^zpw6+u>C*}_ip9fr>A1(v`j4AgI7aM{@f`gf!J|#y%k=h>%3u7&M+a%wJFh-8l
zflvbjman0g@gX50i_3`8T}mZDr8!<*T@6-QY3?7YmFkO4i2=*nfD&75sezc--Fu5x
zLL<sg!eWqqTQ@BJHHd_jK9^Ig>>hxNhk?m*p%wECYV<f{)Gjw!YJ#se;2aLA00_z#
z?dr<yYWJ<A<a<|aDZncM1=H@&F6QK}b;sYQ5q2g>I^PF*pC)FCc}4Va?cE<g=e>Dg
z{p%}MrnpZ*h77?i-u!R48{u4;QJ_2izB($P-LQq6*5DQ91C@$ERDl5aDk;EMkq826
z1j8rPqXm46WPlBG_yW6#+s=r}BTS*(+}tHHG6{1=3A=~4nY${h%gapFzmGSDWEvhy
z5d;a-iF>yqCo5o31m2w*#9UH*xpAGnH_Lw>y6XaD-R6CF*qsx5o&QP>XX96cn;mR4
zmfqRp>I_DH_5PN}zaut2McAc45GHPZeQ~_hq|jjRE8-kQyPvne)<*?1$MTy$6jN?&
zY^(%|CF#RBrLs>$i3kZ9R9p?dJ|pCUw`2!}hC(|dNSDaP0|vhVPkfff&py}eQ<!m}
zdL~qK#*ywVVBBucdK4ys?%S9Fw5tEWtQ-M|?)AD;G7<3p&w=r_LG<chduxe$ofNr7
zJZMH|wi+ukc2*G&ppg1r?r~_gpLy3<)HQ;d*4?{qXSTsAk03-cTj8pI52bajH-%|#
zSuPU%P3<#Qz?n@p^eBw33n=M?J9v7>;rN`vUIW9E$rSb21CrmjUk99VdnffNrEq5h
z_Ic_t<<4AFWV6rZ&2lopYrvbQf0yOxik*!O%(TeT+FHn3Us~j{JJ5|<wZWVSZGTz@
zc<#$HI(2dGFV-)?HwJHR6q4{`cag}Vj28rsXJM({t+Z}#ZrdcdiHV6zNy$h$Y(A^8
zuX=(lD1bD&1>WKo=+>1BK3vejV*#{uSnS>WlZf~F00|ZL0O`{9C%<37^4n)#VPYi;
zib~ewciW!&mT{0$8cgeVyYEp6$}<8k0fa~PDpWf5?2%TZJItNw;A1gy5XTjKgM!;6
zjK)+w3pm{zC=fTkX`vZc@a`HKB244AAz~sVlJ#Z)m;hofnK1(f{ec^pE+Ae3Q8-+&
zNB8%=4gquO03^G~cU;y0ybDkVfK#Y43D9O43tmxs(B^ZP8&FwH)}{c6?%gN|2h_0c
z$`~ZhN@jqnNLhe>*~rW+WMjkPZciU`$sCv_0yutfmg;V+|NUCW)d*MYeX#|d2@gpp
z)lAWR;G5kV03DNu@>J>en~QX6O30&=fX{Mv3tZ?;ChmRq`8tL^EDHsg4z@P8fugrn
z1@00tlziCP+1XP<z*m4LE!<Kco}S(s<>0Ds5Z+Sw#_--Ce0mburyc|1WdTT@0Sc{q
z3XeIMR@nI&Q00vo@X|kKh-nEOIEUEowYV^g)P^I#7Wlg0H5QQgIjq9ajByw32hu-V
zvIm)#aIaeGuKI)xTki>PWQGMlfSz;xYXU+5C8`PF1&SXZSrnQ)j|nI!fLFTu0mw8t
z@ZhXAfcGYzO_SpjM4M=5XJ;z^ZosGSfvema-S?%bOWOw0R<^bZfot;bt~nb3&$FKZ
zbk~?TIKc7`yTzl^wdzk70`@6kXJR{dLM8)zd2dzV=I&S${;ojv|4V?woYH3-9}oum
zB@9|xT8puwlrs-tr=qY{=}yB4vI1BrY#bOfytEI{$Z-O8`VXIfK-(HC?r3n^{cB~P
z;Q*F`K!OAV17ihHZh)cq^BsU~Zv}r;bVF-vi0k4*OqsB-u=nBNSVWIr1OXYr!#gR!
z3$-wic*0eefn<=dh=^bMi~x|71Y$V12|6{lZGC;pUg38WI$2v=yU-O)wUlKifeNgI
zyw>}r09JaI@Pw2@ul_3_2=E$dKv;kq?o$cN$DS3Fa~TJ@%N#oG5K3f83TTRY?nGyK
zB+B?+siyM2gIlS31H2@E0GRLHnskL|m&-Qhld-@3njw9KBYvhUUr3Vj)OY^=_NT1-
zxLpU(&x1_OAvHAuQ<d)mrGv4<)#3mZA7+3L45r2eNFrE@76bYTY=1gaA&Kdyiqb#q
z>l`buNMp&q{;s@t{W+z_W4jW>cd#zI)Ba5@|J9>U9G}Q0BdbG4ujv=At#IC{fmbQ{
z6h0QLzASLZRho3BwcF9j(eGSh)%t?-M583?#p(+tzqSi4pR4Q>4GKDMn5!Y%N{<e8
z!X!ZC^hOqjDip`8BUDuBldIjeOM6jM7_fpA8u*m+bShdKgzsCsqCjVzJb|TsKqBu^
zt&#wAY}jw_9Qr)|qBhuPL^p}h{+3nPnH+b$W_NFAR2yf93zI(<wbH2t56IX97J6J8
z#@b{3##(m+r8Iur-T9XBJD5W6%LmBPJlMC0mae}6(98Q59o-_OTjZ|`A)ci!U3uTf
zlP4-4yj2y$nN=WhAHZ29GHLx9=und@hkn^6@)Re`JrE@t#Go43xi{W_*iufKa!3k4
zQ`V@p?^i>jdQ9z8Q^yubhLgxW9Y(^mc4SO2y=A0ZE07(R&(K1H+HcR%kJz>DjZRym
z_B?Cz;xw;(mO%)0)g4zl+X#J}p~#@QwQuk27;?R-F6c5v+uxt}v`Lwiq=1_^GxZVr
zqHT<YS{V*AU1QJKDdEK!Yp89Zid3HIx4XpzPzo+?Za)6HxOZ!PhSd*bG;#R$pFJxA
zm=nhSdUaFa)%_mLoKmEh&d8myEU1Tx^k=nTwLIHa)1sR<HY>!ofI6aCyFxfs*cDQ_
z`y7s*hq=BWv7OqHzBMC_d+5OUP&JKeTOI<hL!`!D_^Or~?!=9Cf7s!CsFZx)=D|Rx
zHkkyMstj*q=1e=TW*?U8wSg%7c)C>9+Z$I?Q}fQJAZAe+Q3>~}&D0J4P{(F`NJ@t`
zBOLak?gcbaZszl0qeX<M{5kBm^9<q6)$C6D)IM{-eSIUzVMbO_O9Q0SnyVvWIca`?
zp5{C~WP+}_xmmiU)lfD_p&b7-RrBb$j{W;5CV>~4cK+I1r)^UgXeG14u?`6@vgNmw
zF~N$@r8$4&%JXx{k76|tlK(VT^SW&Iy}`u8Rd@{-@%|;2%z1#Tl&UG$*Jeey$3>)r
z;FX{2THfPb*;2St0~AW^BGAlXW3nRe?7RS=-Jfgp$oZq8;26NCEj<`?q<t~Efi*_H
z*IbL9pjhtiMRGWlxxbIwHOle6p7;cT)s%-=Z)a7-O%@x2ctOXXlAGp71qz7M_3ZD@
zipW0jfG(GHb!*yT&uwT-EBN*9Y7r|V(l)K@ushZm*wwyGTLvxNFH)+{)(sW1j~wa0
z$q4t3!78SNBFET}0d!zDyZ3m^iDy@XIffOr66JXu?~Oo84p(q4>-0&gcfZy;YcmAi
z<7bi&ekH(;oyj3a(A}l<e0aq9zKv&maU-1g>3j`dhT^Ks&;zLbfa+m{zODd?b_KYt
zc2&d>>O_sf&nc61q8uk6WBJKe`2Nlm8LRLHhbOov=%<)j>;46CwY=onu=;lcK@sfH
zjo4zdL_vpkRK+f5xlCU4r^8nzYY|ayb{Rv>jyAok4FU3^ZQtdOxs2A|Y|oSeT8&^n
ziO0M@j5wV|Ih6!(YdaCKw<nx@ca~K(NSc#&xzgt02bR+CVcOmOc2DMCCY=7tNdQ)>
zvXCjAgWq?M-c9Li1jr%w{d@@zFI=U7E!}ud9m<nMQFcl<+V}OVj`Zr;5rDy<095Li
zs>iAPcHs<Aw+=<O`6deqh_wM>=azD?Ktsnhbc^v__>DVB#bR7*!*_c$baW=s7v}5z
z8y2!5p^Ut*nn7C_4jJ@8L2}+kY?~~yWm_2N!Ar9keQY$>n>460(tA5OJK&mFOb|%w
zr3Jb8?`8(^CIu~vrwzWCj8)^e`nq+F=(v=;1PzIV^Y}bGJPzes@NnYDkH3ih@Bl*+
z4Dgkl5Zxi>?(D(H^|M*wfUY+>(Ax}2@4fo>C#HqQZ4R2-x+;Pi_yu7kq@fG2EM~&F
z^ZAaT++f2`#lpS1yy$C{X7{+sY-5&dd^$~4_U<cw>PbTPz+O{Gq^>IK+z)oeYZ%qk
z94!36_4~K&P^5cEe6;14Qz8Xd1~j&MKIyG|Ghv-7oQ{D3)pU~#`Y=Cfz{=ghgndAT
z`eKOt$i6oDwB}y0Vc~G4ksi%Gq~`A1gE#D1BQuQ$bvXK|h}Ky9J{!8e^lRFFTN*Nl
zs=s`8B4;sOPx{vFcTA@j%_3<5#meGv1HG<zJ(f>>l|oNq##5(5wMMKJkz1cNpVw$#
zD$~Nnn<J%H8vLkomwSN5D2m?iX?QINyq+0IJcy#dkp)I#05rdd22yW+h5fP4LU(W;
z;kZ4;_w`vkDlQfOS2gryE)5Nhr6jEy+u2I>uw9hkxm}ET8Xf?4Kl{iWJt6k-=7${c
zUS4;GbqGKzs2&F^QZVCAIHr^ARp4I;=$ckmR@M+m{9bZb^z~J4=8L^E^E`l+y>SN+
zom!Kp%U7ioqF6esei{Wh9WXE)63=}qGBUD}QUilVUzt!mxjV-S@9qoc-Qh$W-=Y_x
zcr<XVvF+{cD)sQQdjKZ!UK`Ao=}s5o`IV>28PjnWa=Fn348JsnukkT}Cpw1JofzGg
z#_!<I`?9j9Bl+qWK$xQoNJXl=i-LzqPyq39`X#=<ART~l=<a^^WyPlxhbMDE?e`X>
zwn>(}BoQ0eo_mMBzE|Ic3?APJ+SMQQ#|L;=1S}dXVG;nthXKZom&IKU2)VKNi@m-y
zfjbTvU@_ie1k)0hrU=+&o_%g`-h2hPVs~HS@^%?;*ZT2O=%r9cign014Vp*(Se`Jy
zPym63`L*@-DqY3xIjIr0(B74;15}i9$prKG*iE-|WE{GZ+0wyrf)2*LDLfcJN18u)
z7cCnP_$sWe67G*wGpX6%R!W+fe06=Y&jw(wD*$x*iUVDB<O^Qs$MKk}{LO0wj1k}`
z5es;^GFf5Xohc>)^c2AmKHn?7{|6fEuD9MgjNBn`(HhIq2-ks!cNYMa@n}Z({QdpE
zYrz<~O}g&^25bBE(k&M7s`HCE?|%IOfACWP1JmO?6cwcw^E_$|!Xn<gi^u`zq2B>Y
zV0pkL@&SkEEXw(GM{oPnF5p5l1Y-cM=<ZVSzR$HEnNTP`9k>N9?7TtG(UZsoWE_87
z&D*$>r8xky!UP2c=?$8_mt;Hu&a1&(Whw_H?B~9P>^jvX2IpS+fXBIXP|86!xULH9
zD6L7%0xgEFx%h#u*7}nG^{Ye|AR@QURD6~X6C_R_DJGKmdGVO_h5`J!mbXvtq7neR
z1*U&~e*PI#h3~Z|APH_v!onA6D+m^!LLf+bWp?gY+alM@ciO^wY1a^OMP6c;fPc1M
zEH5kTUEwXTZpQ_IAk%Phaj(r}q@|mGEG#V8@w2jSq^%-w{0hA#^X-P_=Wo-F4-YTR
zfL2Z|+P>oLc0<$Cmubfb2Nz~yVqz`N@$q9hf36>n+uhL?+U)}ov#ORlz?sch^iw~d
ze|(d&sQ|1GOv|w%EGQIO+i>Rqw=k9ysK1eDf1MzgTyXaz*yzbm#$EzbhTJcZzy5kb
zXch(>Q3D$l{8mV2_$jR<ryZ34B=YH-W2XOf;-AZnfy<TNTx0UcYJbl^JK3Ht{W-n`
z{MVf!BJj4-;)kz1Q)SCJFe<(5Hm$HMU^@&I9eV*-15=OTrD2c-U?Axc<?n%k*cbd{
zRFTter1%0^di@DKz2KjJZOwlI5`1GynD^!Gl7Ag^c=8if<&E}#9Q3`r`tN(z4kwh7
z;WvpwjwpF8Fv-RNiq8Wa)vP9y78Z*U&44o+z)SPR29(SFyBkCblA5CA75wXBci?^C
z`K))({KsGaG0eZ8d3W%?jQ0BO>c8*lkjG}gc|Eu+?s-L0Iy18$e=W`o1T_Ny7y9wb
zjZS=%|HmDGS6b>L_@7_&uW?!`RidMZGK#{<PC3)z2aoToW$OxkDt?O*sKmc~z$6e<
zw*Cm9HS+~FG&jX}R2_Drh%;M`Wei&-lH$?Rv;6K!2Z$O8`9XwT(gQ_kQ816z53dMG
zh@#9jA%mq-G?lbMbmLi`jPLtCcFv3gbKw^!v6J~!F4XglTC+5|L(H&XB4?oEF-FHp
z3{``w!Mk3czS{k+oq^p)CrT7iQo|>Uq+T=P4r_>iPwUJkAQy_+rw5}{`+zqcHV?Y<
z<|MPpB;xL7GfZ7gVh%^`|A!FZ;$X`^Td=aGn<PpZ*63;vT;J;wAm2Ury6O-?^AK;J
z@g3dM+^@FxTnl}A(kL${S9XbOyiZo*V<5*M%B#h>hDz9FAR#XH^jTwKHd0uM!6?jl
zJRB2b%5W-lh8obZKXgkg{E0J$|4^0T0QxYJZ(Gz==c*Zg`7{8X1tbZi*c!&R9S%L`
z<x+`dK8#^ZZV72?7WA`Vz&7s>GRBo(n2~X-?)Mko?<yf9kFwtv2PxRUym#f?-k;P7
zWo^j#d{3FA>j7<pKBiYj;6y#fWn*ivEoofynn@#$U+lA{(=2!V^1&n1A!b`nUbLI$
zteU<3X>4%KDw+9PL;Emyx)3ys)^P=5Z*k-WXDO{@6{Bg{-h|J|SpeUz&`t8hu`^Tb
z*7kCtht1^WlQ1!UI=kz$!vF~{{rleME=`lC$YYZ&%7yj&1AemUEIORZyoWBw2S@M8
z{B9=7>wB6^dpr)0%}=RFy2mnR^8iC7bu|PiRtcb3@y!44RdTTpXo|Zv;qc^lXj=Af
zjK9|G-9+97RxsTCes{{B(|`#E+rKFPjEV0XGuij^i|nDc`_cgI{Yb9aVprYfs@N7c
zM#c_@^)jrV33id4k$GRtV2#~+#T>uOO4+-R@7*kF&)(C)X(KPI?tjm0!7<aB3!R5j
z@j}!om~vA;t2Z5VCo|)|`qme4(Ui30uW-++UuM76m9#wX8Cnk7^Y|yG@|Ao-?>~pJ
zHrBh6WNdws%ha8W=dgMERW$?4qoAq{FAo9fN0r+M4nkXm7c@WpIfIF?m4M&8%ZPuh
zY*v|GiK{B69S3t+>Ir|ptaI+2WpudG%&JCD$8Gj3)OnMeQDLW?TyUJ47UFxQeeYtX
zMr!m|-Jm%_?j*hJCDGzaET|#(i+%js)0SnF(?Tz`DOMKd-MaqvvulZYzicVS5$_3~
z=Eh1gQtoxh%SnZWzWcqmq+`*R{v+sHhIz~P(aI1Dj<$4DqimrwLgn<henk}J*~XVJ
z!QJ2fgY<ON+?x@QM^wgxt+uS1<pjU-08;Abzp|gVjN0#;#Kxj$wX~4+@1z9&HpOQ0
zTEhVV8x6NvZv^8Tuf^_Bb88<hOwY^qf$awu0!6|4>Pd#qS=Fp&>BRXT^CY{j5?~_-
z4?rT|_jBUzmj`$n_*Rkabxw>jzbm`b`8X|IDWh(-DL=RE;ks{kFpXmD43rqDwV1J{
z3$Sp1Qx2?5;bw62f010(N4sO)<i2<30cK%HY`+Ak?e;f@nEp2Jp9dr9y6@CEJpVhL
zUC1BZ3+Q{_T8e+F*xQZ@hCg=VKa@W25(y4gZ0i<i`eo5GEQs(qTD(!)ZCIn0Hi`V1
zM8{W+Z}Ek{SZ9vS21p}6?v)Xw>k1KU79Mxd#L_F{yycMo;f-s*u}0+`hV4JPB>pU;
zMF^?uP1wK0LLVolzdOC5`ICHholfQ@xmWR(fuSV=`#bMX5?=;nwak5cV{M6*pKACD
zyIzr7`^8>u5Nx}&KIt~pH?Z|o5fIQ#%w1QZ#dy-l<P(AR;aEpIU!)q37yk%dGwBXw
z>Z~MH^yq4`+-{dvA%{_W&}0TY<Fj|K#&)i?Pvq2oy%*&*dkTh6wQyvyX&ZyB)@ZY^
zrL!)sz{!M+mW6izZn$yPgT(`oLA7u5)3iyv@DEqPN+~>%haH=#%*vLp>FV)pZ@jH2
z=f9AJX^zK!*1!2;Az}EmV1+H5&`PB}Nuow-t}JDqst%h!_*hIe2+eZo$G|0fiGg4s
z=rpqfv5g9JTMPPqJ=V%DSz$WJIf$XKej=H2L2SRy?iFR7dRgIBCbAuc;56u1om1AW
zbG={Fk5tHLL?5&i1x?adQ+v_cX+tDqzM^vtEIk07-vb+o@155Aw~_w*e3`zyXI8ph
z;iRL+Y`_pTyN1?sPXhLBAWbYYbSyHitrjvSTpw2E=jh6FU~V!n`$eYKC3JRuwWrqc
znwdk3L!oWt5!Y?EGI(NcFBjNRT@nGD4oudgC5(S5Bt#m+A8-Iz@kjxgPyav}f63Ut
zZ98DTfrD*EgnLa;{||CeT%NnQCvSthq8sSJZvLuITMQJU^gSpCN_XTFkfUXnzpV(}
zy~+9(2A?)I``)WMcpb2LzAo6}f%8HG8O<}`P56`U<0(5%(JPwe8a*is+3&S@^FD{$
z$4#v9xddj&mYBWo&l-hmD7v)SpcTVBCsV;~x5uQ;oN2_xYg%EmRD2EY2eXf_9ZWP>
zR{Cba=K5&#5K&A`H)Y8aWG4*y6~x%?{_H`=Zl~!{aXNlyYHvWK1V{_)mCfKUSpAig
z2=;l(qaDSZn#R!1Zos)!X#G&o?}m|9)Gf5d)osw~GLK0o7|-6(Cp^02?PtgJbN8h_
zHv!Y3b2!Q|_L|JcA&f-|YRr~oJ&{KTdfXlx=Z%d~gvSx(^vaRqJ;()wTf@<zLTite
zg+bvxN_OEV?awPfd7LwuGacX3P8Zr}FN1BM@eR6E6XHiC4LY8e7ailrIB(x@#HuxL
zRA_;M5FP3pTG<3qJ=KVrV-frI9TMa~MyLNbrZ^TIhav~>_L831W3K?AVym3h4Ig{_
zz0ew#dA<=cGB*|J{9m(%yT1b$-fK=w<cMRFQbug;G+R^jaisgA&<cv?h&<uvYm>37
z-tjLjtMjrUc{~KdP@P)-n!#>ulj6#<=)Q(S-JglLHn%k%SDE?(>@nQ=Aq4-xVI#4C
zto#i~z<?6^2Q2(=U<y2+k_a53kSFljy6Y?JkeOhwN_xj}nt=V{k(v_S6cL4^MpwXf
z65+Wx$z`sK)HhqjMOu=WIQnfvi0A{KEJN?Yh-aw}AHCpDi^9;iZkq6>wKy#X)5{!?
zbnEBS@Y6c97N?PwIT&lMC>r26o#;u?d(C7oicg%n5w8>uqAO(Bb@UD68!<GO>5hQ3
zhru03eTl#Vd7_e9EEn1C5m)MspYFR5L(u%K?~oycpFK*qZ*7rOC+Qye-O_{@Sc3s#
zkz2(UT)FDGaKPpl6cn=1$Iiyf-T&S=Be!+u>W!|jdFVIj6n&b5P_MAPe=sPLAFO?K
zA+Aa@#AP7-P$dE77_ked;*TBxVefZrk_N_$1#@}foYcCWGjizG5+DxOITxyX6v2)F
z#B}P2fw9MnDX=4(_lWdQi_}C^Rh)G^QBjb`pd-I%8>Tb{#j#W^sBLV|x~j47t$g>J
zN<vo=F@@S)nWz#2ykll$s3tv#hZCTNZ7$Ojz2~8L(v~m|Ft*&I&6s-sYI69?@mE~?
zdUq^yYka8Zt;Vw~Q55b(ir{JQQx$NcYQMGg=C9+j!(WPMaOBVP3;qZECGTB9kV)?5
zJ!Aii2_xbcCVe3n_rV=E0X){d{9jauxzE^)RC@VaQ2d&`@?tr4srl*srg|+V><Fm=
z66%T!3VD};NNbPZ#vMOIkSAiB<UmTDj0ez7m{!!CUL14<C?rgjVErq}zj5t99fLdU
z^bgegUzHLdZ>hy@QjqHQiO`#xTDN6vP(oy_?>PD#N_H5|y3YATIm(>7`|<<YmLu7?
z6G3r8Pk#nXe9z!VdIi~*rK|QJY+?j_zu1znjgzaz#bt!H4&<+v?S8Yt59D*9CXMSG
zH{FM82=^t{OZwS~);p1san5$=(E0U=y0$P#HM<`yfcr%<5V+MUnKx3Y{_3*5=N*V)
zTmeqK_6{<;P8ax*)}+mu$KqVEVy%4-x;~PdF6dF5+{QE+N9~d~SS6`sag)k`YcG7q
z5aNp>wddzTsK=Hh8yk$!ibL<T&0a>#*3Gq`u&}TQiijvW8y|AC9k1%Rre)UpU8DBv
z*MacCa^3<ezEpMw;$7%qD2Fu#oi8<=4#4SMq6eo~S9EWsjcsW$iv#1=<kfoaN7Rbh
z*=-xL>C?K~Z&BKcx-%y(4xe$k_=?lk`dwmE(+rdg`i9jYVYOoQfstguE>obv0P(=i
zZ0k3+)5ZRh4h*x!aTmYMfF6~kefV~9^4k6y&=<P?{pEnc^7*V4@+5sPtavzl^*X-r
z_dQ*|PPfh|itJ%^(Gap&+r_9HG3t!c#d9ir{ysK<Tj?&nlIJg<_y1i2?quU{FZMsQ
z%_#mK&(ktpj}P~0RPdrrBq?i}_<e3NNGMm@HeoBR1l@CW<Sz<vj3$}eXV1BU35Orb
z)B`N-FAJIXa0G0-Da@4MKH3s!!S2fw0nOd<d`ym{)=}(vv}K4M4CwhfM@qo~!6jI(
z(I>}2VS-l)A7Jo7fRF})nCOn{h68dMCOw%Tk3+EJ=!yCQ^5TIwEIyCtcdp9FkCiPs
zAnN7^zT3X@m*(`P|JyPDr|<p$#eI$xd~*(S-JNTZk+paR5b{uxQ%5}Wee$3=Sk*4`
zZ>Rd8_A<|(Asg95)<2eJhccq{@jq)}-xz`IO(OVZRB(M(tYB5ZAF>G%y>rh$7!!yk
z?W_L}uo80TZT^?|!M}nFf4r4H)ADD@{uK#uf%d=r6Af5;{h!Q)Tm8ZDmpd}}|E){=
zS6t&GMfVO1FGTc2tVn2QciLDLY=2wQqGceSnhRNK&h>kV+0N7s-^6iV?i&YMNE3zZ
zmAyne^ASTcB|LrOb45UXuzG4lKVP0p=6dlHb*JZmxahEKL^tsc0sV=I-1&0a|C28#
zaQ9vQTf=v<`1Vhz<!>SVGu^+9N$=;MwQdd)jc_D`&?A%Nv`;XyZihJazR;JGkGCCk
zXf7be77sr|Zc9X0njeB14JCAEgs7A$m0PO>ywQ|A2CrpYuLmXZi)h}^J+G)l)RBop
zPPEQoi0w^Jln$yS+49$NPdy@W_1)bgohE)T#$Lw8T}IqU`MX;*fWN6fluQf&`ga4t
z5B8o+5wjHTZ)&;HJjueMCPNp;6PM<_&yS3^wvQi#g7Kw`QF``*&~wSsIPPBIPhjS5
zkyem%n_xcCEQvB7$b6UQ4RG52-*onWyJG(l$9i!;_D5{rp@%yTpOdNdGS~DXDP?%s
z;KIQDs-O_2g<#^4n#~wsDZ<wK$ZGm0mdhhWuI9yqb4HD*McvWNIqSlRBM?D`hH(<K
z1}*`!lhb=A$L(+Ocxo>;_!|0&C$!%#)OI{-Ji(HDc@JOOl_pD|*1|S|@=-;$bLnQ8
zxErorqju503(j8fR`H>ru`i}ssOnOi6aGmus<BLLZ2ji(0{QRUXR#%R#e|fEA))4{
zpQVN%-7jltdO0La2Yl$gp@A`3OY{VDrL^t+KT$F8w8G-WeXb^LF3Q4|+fGl=`==%s
zel@Kl#Vb*|b1%y$>P_rGh^-RqrkS!boyT8Gc&JZjChNo4Z9XI)uB~?*wtW;KbJ!S^
zqJAn8#Un6z4Rcv%a_WLp8}yG~vhV1MMgx5o7rS9j?oZ_5NB)RHMA=Lg0cp9Z%=A!?
z!^IVQ<H<tJHi)ityw+joVeiRqC(72a@oRMhy3&d7heroNJ<8@2!ZYtNbWT15^11F#
z-Up>sq{fSg@j9%xjV+GmSd~=@ha*Zw?N9H*;CG>NG3ozB?CEZyUih=DtdAbn$IiJ#
zX8+vN+k^T)r278I3`9eBwz3^9^Zl)$#LpVqsMSl=#c!8XS`cK6HJ|5lfzD?^a|4U-
zbVcA}nIDug4jpVH02msiS2SK>ou?47=2+USU=ghH;V%Ey=kISdKpz)u`tm)#^>~bI
z;!zcB_e!SL>w<ppRA>yxE@-5#$N0-8SFJb{<}gg#kxC|$>*!;@nvjL5=v&eVJ#3&i
zZF`a|>_h$YD_?+GdArv39-0wDeUAM>>mi~EYV}e$l<O^?PO#!B-STP=;;Df!b;_%x
zHcAn3M;0$?@d2(vnKvXmjnt)+rgY%fQq8JdH9C5)HyembQQH@MJ;)And!v}|uPwDM
z%1pG_(VbwO8V~Hq2)gx=`ufia))`~|GUp5qPm5U``pDvbvBJS0Z5eL8`MY(gTI6cN
z^V~zUD`2iFzWKFGQI#Re$<gDINgJ6y?|e0@Un<~WI~eo@)mM&rLY5No_ALQ@$ZI=e
z<K^;hTU~s%Uh2KUPIQ5OYUw;8p_gUHI5U17HKOI+-cDpWR7vtBOVL~|UCg?TyAhYJ
zTk#?~6p*s!4(T-XCpw`DdHi3jhb*;xmuS88ecnah$ph*CP98=9uK_R#9CYEsmy1{<
zY}y2VyDc%8VBL$JJ$6e5qs1^xeAB~gd&3tBD*(@vDynqnSZ(V9L1SGbl_`&AJM%i(
z*<L@{bXT=(ICyw*i6&~VOj3(uBicI}u}s)NU4hQ|5RMC))|AR<-dd#X)<@hUQz|fc
z&?mneplQ$A9^eBrw`4OZ5yOdXoPeH=Q&+6hk>H%Bt$kOk#5AL>W70>wH}AL5W~Pez
z0B)NvjOj=!-a5DOTP`K(O7>Z)7fhnV7rT8=FX}WG&JFYpWmXFK`uqdE!x9{J09ChC
znP=+9+MokMSkql!O!7+vFVlmw5HwK*nh)5Sw}S;hE1z2hCdOK59m%Ytmj$vGJBL|-
zgx2WM&SMJwmSf}7Eq|&!e8Vv~Y-6&X`2({`n8}X{M%5D_3Y9NLoq17)*ok2W;J;fP
zVeNY7fB<<#LvE5*(&zV*XJR6O{OFNi)}=+x%CvCzykdfBo@9Hk2fMFr(}}d_;)CYB
z#(G{ds%cvbouc_8Ve=v|B2%Z=ZPk$j3%gs7RDLXM`%*DkCIQ5DYkOFD?R`Kc^jAX~
zWb@gl;5;+MhktBgx`-Pd7z|#r8;u2$tp4o|`nKj5{38(c-y?><QP1Ca?QZ`7_|b?S
z1fv&#Y`wkj@#LiAQH`W*5G-u*6fwpp`h;j;z*gbB@tn&VA%|8klH=0`)QqePN45~a
z5>%<@*RRQ$QZ>y8%RwOFQR&$>ss&QYkb8do1BVYh6Ig@5Iry!djOpmF=%qUX78=j(
zO#0tE*y<N2UO)Hp^u&!)6liZtv(sKdXH4D&PgaRWO%Jpy+PpqE#yxcD{Hh@rpM7F6
zbBJTI>o1wEBY`dS@l$IIn=PghAv`B0i}yP7_|-~JGH#&eR7b1?hP58u6htnUmlU=Y
zf$>G68M-_D%-hhwVAeI{{72;8-s1RaNR8b+Z#rt3Dk9RSHtXWfh1!JoH8Y41tLNt!
zOMNz004%^$UZXV~MqMawC}bX=rt%lJ)fy~i{KZcliO_Fb5+geY+P@nJe)foQ{(gMw
z>JIQ@9eGAP*89omRwL)$GZtU!_wqAYui2?=+uK0<&RH@tWrb{$@EwS-&muy#ddGn#
zP?1D3@UFkE^dKUwGmTT{l&pV4pONgRt3gy=rZ47^Pw=<v-#IT@65Ln&Vz-v1Hn998
zRH;)(Nj=h{+DhK!y!@`KneL11XH<8(qP>#{4}g>F{|0XV9i#kf1LvQJ@b8_B7c#2d
z9c<(^MdM#wj$d_uc#?l6ll9P4o}~CCl}sXCNSXnrSG2Uf?J(v_?5rG*SyKPKpb(6O
zm4KUPrk^nNz|?`9UcRW4&drKz$~?rcS%*;$*P~=QQB&YH=G}V#r@F6>iZXBeSEL*1
zE-7i0jzJ`Ll@tS(ZV)6yx};-(5mCBPPytElhGCEzkQ$^L1Q~{I-g}H^(cS$$`|R&|
z|9CmfIn0^EJ@@_1>$*Pi#gK))g|Tb+Q90UGJvpZ@EyT=Ga>;bl*|;Z057(k%8i}IG
zF{{be+}WD(^n2OWI`kSZF4^GXg_iY0;`K_f$>0Zew_!=gO_GrGo>xgnh&u7%E=>*t
zx~nv$ScSS7SlD|rB~bhUK_gP0kq2}fHv;T}J2EE64BY3lWtBAu%V%2BD#UfJWL%8A
zI0sVzC-c=GL2EPQjTlmf@sxR1rhyBZUV;NUkHL5~w>s<So_9A{@EQt({8$}ObW2wr
z;=Zv^1>0}(Pj@mkR6qn}()642)rp=+b{nl0bIMnbSqPh=d~4TtR5F++WnF0=au`>{
zl(Cgd$XNE#HNJJG)%Fxsd8^6;-Hhc^bA9%9h)nPETG8Q-e{Q_sg#IMt7FLHzPjQW%
zY@HcobaP`nFt4BZS$7I<)yi>{t)R?wK@{NPhtAM`0s*&Y0rc$~CI<ydh-gUi&#}JW
zlLts`B{nt|J0IJvL#7CMTo6hunaL~C5LlR76ijjSr}Yq7a<!p{E>{M)ZxhbC8JPFI
z8u<WoizVFjihiB?CUd&XXJ)US#n)%&x6qQ&?cHH!mn-rqIV>{zrP~6oifX<W*E2{z
z+jd{Lby`N?3(%~{r)jV7b8cNdh*$}2qm2w!Vga|3qU3PNc44{D$eiWQ03jJR%;6pN
zP^Tt3#OhHbe+!O!c(}X+RSci&$b*Oizts}ox#dqSLop7lgDLI$&eDK~bAtQ;BOquT
z7w{_(<&qg*YvysCH6Nbd)S2?I)hKA3uQ53&SyZoWTdkVjG&PN0SzhKh6m+Q1PguYM
z?NnoVjkN?V%xjjz*ksJE(Oh8xAp2`aRezOdpmQ$(=-j^WFZ>qW@@L+nAyD+<`sFo1
zYpS}m+>yOL=wiEde}u|UaJ0pg6}L%hag@M#Q&t~tGSnDeRJ9L0*<(Y5&v>P<RYE#D
z-0>L0$I;^S)}#CV=dZY>wdoo8?LqD54@;^|tX>rh?-G4d9&hN#>fPLC%%>SR&yTGh
zJRX&68m}?l_~mpj>i<uS@;gv1zWx>3{5{S8KFqEzQ9OgDzV)sHvW^+}&#3U(Mdi<v
zvhS(LUt-l?>q`Gxtk3}Z+N1ezDLj~pU!lSGcxr9!ZR&;(FcmP*z~SF-5uJ+v-I?&E
z6aa(335f98Y~xoXD(yKelM{?lA5ts#)?Z4@V}RmRzuvNuZ%S%<E<KZsFEMlKN;`(Y
zT_ez*myG}Z0cC<{C#Lg4S5r!rbFpy~Mpvpd4j_H7gji7Jz>SDkRy0PcTV=(NH$QzT
z@e3&Xj-@SvYY^{z$#T@w!HjpQQElMybl3VXH~y_{1NPE@k%;l<;N{;z+`ljbfUw``
zf*@|w1VpGt+rqrvfLL3#V0xpCylGVuZ`~uB{bn1B#>ae`qEA<kT8#y~&&9}-Im}eg
zc<e12^Lb--XRwr~*;Rv>8Dm4)z~zXhUlBel%7&y~pZ9raJ1lsy`Zw)y2Z8xa(%X!@
zCu1+{4mMmZcAsg2!56udv1NrW>~G#_90DJ05lY4I40S^Ik^FHaQ-Q74km1?kK^f4A
zovhCZnS=L$di}|amutGO-LYsNjawCBf5yW&regu7m<Ak>N2sBmeJ%VcP1Wp0uSu-N
z{_)gcIs$nrFS(D~a~GQ3PuLd_+apq8O}aAs`$vd}NA;$;HVd1ug-pgUB~@}bNzDV-
zWHc=b%_sjysWLiP`ZC+mGah)Eu?uoz)(dd;y|6YcOZCM(nKr>S&&;L|U_&5g=Q61n
zsKTz;hGdxr3QJVlV%?|gdVDFIe6}#f!o(9r+1z@L{{$DGsQI02zh<SP9-`WP_Cp+s
zyWgGE^?_a_org$cJ2&l(0VKg@=Mm=AHC()hEg?*z(BezY4H2f9^9DgG!Ba7@lGtwf
zp<Ony;U2X3cc78muI?>3clt==#P|`1Je*~`Q8L{NGaTUSOp-El-Xpst(Sp~jI#P?B
zPsPge5(t!aKeZek5v}S7(NW@C3{AM*FMoUN)Hp3r`>u()(X`KLko&fsB-LFUwZ1w-
zn_|1HlzAar@P#qml<>p#&DQ<EyuLRIzTFQv4hT3tZ8w(Bijz`o(B)OzM#qN>8|Cf0
z(=r5bQAeBFRamyCN2EtI;qo}&ZA4h$pt=Gbmd#>dDl^{BM1i(<o1O&M2sy}KdGTuu
zRVpXHeBN&sea<~n34{-#@{b-7;W?YEAGNr<AM)k6z6pKAbFq=z1G|i&ip<JkLTN(A
z1HB57m;i!sQ$d`Q!>|0Ie+sIhD|KH9Gi{jq?yo>yIc~~v3O-IP;DUY-8?w}UxQAu8
zhDK9R{KGxkXnF_4_Wo;n45X=X%*@h#(-wu8bTQU*Lj+z;mG}MheHeqnrnnOB!f7Nw
zMK|&9$_Ir8v&o1sR1m8xRc8$rArI(-iWev0^Ah(h_@fgS+(@_OE@qy<i(lz+%)JuB
z6gR{P+guM0D%uSzBxn=m4G55pZ<1x<?%|=@;~`FyM#}4E+a;9j;)C1Iq0YlbVI<e;
z;YCH-cV56J2&pQJY$pVLHHy8~7*>nwgNt6dtuAulBSFDah%Hy{+ts{1pxs~)SONt1
zqA`#bd^pVDpC{-;)@4}JyRMm{3nFYAJe>L9%uLmO-m%7&^v+X@YZX;E>m6LUF<LR}
z?o*FFI0+m-t<eV+jnX1Au72#UQ20ehqUQ9Tj&zya!)HqvUiW}6=bJpBT|LBf{&-I@
zlP(t3*r}1yfQ;L>dvPO{(kK37W9TFZYy*qRj+uCMZXwYqSg=NbS#rC)3h${Ek3Uvu
zVeu0ZbAQ@MdK}9PRsSKxf;&0Z#w|1!k3rO?a76K+^z#q<$?t?LatGneVZ20w-4->Y
z?)}A?Rs%=e+I0Qq8Ks-k>j-*{)w?VXnQcYBOFTW!FgFcCJQVCCF;(-`;G^1&?bZdr
zlk(-Ue&xZ&A{VB{=i$spFQX+;?ewhYy~S@(8D#oP)Bthd^ZR(Cp>nHr3pkyLsamxM
zLSyE_G|g$lp+f{uB)pXD96j6CZaN#v7!^Z%D9w_nuN9xqn+6Vu@Ft^Jjglo#Vo`ee
zwz6^drk4!UWYVH*3!#hiy~ZSM$U8_sIk6sRwspuOZtWUTYzRY?uvwc)&sFl<f{Enw
z2lgS-evzvl)jsBO_{A{CgBUIh@4D&vmbB!1@qO=p)7{cvY)sSk1<B3mdtU?4lZPuZ
zVqNr6NgSIj+I>3`4@aIW>9E){B}L_X&`-4&+_N*dfLhv;q7WBpyOmdC=i?1n+j@Ai
z_a5R|zAFe)*tVJ}b~qP+FiRWHq<cd$ib1l&;JINSKJH+wGcU4KIwes%a@AMXZ&#XT
z@RiJO2@L)f=@7(t|L$jYRcixUH7;aRDh^2u7kn2un5iMRtE;OQplZ&+3rCU?Fa3IP
zb)rtM2B2A<k^qeRbc}z1P@JiEqBr8UHU>~%`J$|<HE;&(=G8W;<UAnXR?_)})DTo3
zG=E(>OCC73z;^d>onKvXj)vJ)rZPsR)%_V*2dbCAd=e!2?)-eo+%?oKXs_eyU3W~>
zzCSLJ6D-cxC8n2~JcO@21c#u(7|w+d%B1`-pMOp}museq#M6mPEssKR^m*=x7fV8c
z9!o7#s$!{rqLy<zex*Amn?x^;xLtXcQX)h9<U<Dg>ir1vXE3|&O%!0Y9NYgYmJ9Sz
zwdAo|*h0`JnJtV9$HsCEBoXhD@b8hF?CCbjHUy~;KFs)~g2R1{I*8QIVGQKp&-4z=
z;;$u_FM~SgZ&xL6MBR1Ykd{dKa|joKx`UwL9?pJ~$EG_4&k#{hp*JZh&0`g=;Y{m=
zEo;&H^!j5XKG-;o^J7c{9dYD7aieS!TcUA~UWH@xu^1IEriJo=1Wn=}N@|uI+l_fH
zL)ktMxB--kybi3Gciw&yHT9H*{iQcoT_bH<w(@zsR1McRwxQiErCP7NZ5e7-h(Qj%
zN9lt00O=yJR?Wm|lxQN2X?<%4dOdl*-Ka=l$H>QDg=Fm{*KBLgYY|`#FAe6!?<Mzu
z<T-D~5dsIwQUy-RxUb6t>U!LnVW1T9J4F#)3!%3U`4<WEuh0{8CF~5>;>*YgNxLie
z#xkQ&S|AM(YNMTN{9#KMVdq3_FXtWq-dK1k;xw-YQR&OCKH+>_h`C6SP;4gjafT+9
z+G6h;b3-&le9eUQ<1#DXkX_#kMJ2vs4_uP?n>ylVmpKJRp)U^$by%>&o7DEE*iTO6
z9P3;!66C12d~C6rp3jvX66|HxaF8}RUgb%Uc);n(Q1e)Pf=^)N7>1p87etk&QJB^k
zF;DNfAC7ahKO{ruX_q!ko=~70b)9&3dbV(+1D1=k=QWd5K)Vph3|Zd1*Rr!=Rtai2
z-#^c5;x?OD*)1**U+e_MmKb+4i-D@lZiPUGd3BJ#LB_e>HYXP}&;$jKr-8swubv^D
zt6rDeqLTd!EOSwFL?Bl<b()5QaesBUW9=b+ees1d_ony)_>~<RalX{x2ClBgoC{nd
zF14+{j_<SZP4LaU9a(ESDo|M;GjNu5Kn^>OHQ*(8rLNy49Ba<;sBhva<=64(Wpa?I
zok9%-77W{_$QDu3m#4PbmZ!PZ3(<7)io5MdZ#!q8cH3jvReDRUG-&AQ!6XsC#&Rmf
za;hoz0{#I;M<)P1br@hp{LuGb`u#u4iqWOBSInMo+FDb?idZxd_Nk$1jL8{}Jsmpk
zbDRM>wfna5cqWtSIupzubc8JzG<I~L)`=hc1c`2gJ`rk>yM*LPN91I-MV9RIw*h|D
z2FLw8OP#}DNOfXzuwjdG6l!kyrhc6(f$gxp{NWCxR=$of%Kr)S;Yhyj6{i#aj|wV)
zB=BqkcYuC?Z<`ew;QLdQ>n{^3;P4MK&0n~^3R*~;H3~DtA@np90h$kv-v2SF`&Z)O
zzJzLkVi8a&zSXaS;>h~|sx3ZKK|sUrlmqhK(>#o469CxfQKe(UsxfTAdx?Fa4HbJ-
z*GF8;sV?9C#jCq=9mb`1a&v?KnMhZ6_sdSd_rSpsHifj*_1oIzNAYuTNxy=v<?)(|
zNBe?_qPBNY;<wTP!P<@Z)2F}*-9v^~1gv^eVgyb(0N(uDI!k>qhY3Cd;Cg-R7Dvas
zlON_A<^WU5vf;>^KqmMCxIDeMy>%gNe3laUMtuBxzll90kI&v@GoX&RS;&6n-dp{T
zwr#<nq4~~u@MJbxkoosfl<(|Npn=c)iAKJUfhZ9)NBD&R{H1gT&`E!1Z@pr6J=oZe
z7|9yWxW+Eyvx6^aR5d%D%~ez?%`Zm?Jdr+wGYllLL6T=s{mB2_yLayC06~B0Cpy?!
zg#8=y;(JejBWiyg9B1mdUy}FVf#7e1?jN#ZbaF{3X(Dwh>jB8+$sT)mQcrfkE<ABi
zvmGtx=i}#x+Fl3Db<pC4pJ3=O0TddB{D0ldnJxA^l?_O+&)mTe^#L>tEplnA9`jVT
z{emN)US~VE|JF+QJOWTZ=;-Q(F9PDDNkGN&XI=KCNB$0Ik52HvtpnfU`#<&=HyDk;
z`#^dRFCOihsh$I56}MZ{!^6W}1pwJEVEP{P_>Z)KFAe{nH^v!u{uwrM$Bg>DdP9&1
z`XI1PKw9))DQo;JJvcK)zdkX*Ilx58{@W@FG{M^IRG4mWD@N_ms@Lb&aYt~ZasMNM
z)8vxJU{Mi#;YFR3J=Ramn`cD;e;9|~9~|8az=z*T&R@!vXsSIJkk^DE0nyFR1MfSn
z_8Xd^T=ME*i|1mTvvjum=&~b$C1f`BW1Jk5ofeX9{ZktrUs^53Zk?`>^7|Hbqhoh+
zWyNWqcHVrt0nFF29FMi0b}f}|5H^GARDyaQqVMDTr1~fIsMg(}Gw2Jji2g9V(W`Z(
zM2W?oatQ>vUxE~ce}?TQS%V`Ki_*o%>W*~mY}f=YvoTDhIZUll2SAu7nvkDuYrXgB
z>YJulo$eRH*o67I81)W@{GE!`9o_ftrYt2njDRCOLrIX?Q;YM_i*TdH@fK#SqkWTI
z4h0A;!xWLYo5PNeMD5u4dUH1;yax$bLt+Ve4|}+t*5jI(P&W-NU(gFR_H%I6gQHeQ
z2x_<S<u7@ul1)nqQ!_QK#R@J4FKVPuzf8taKuFbt2U<<6t!eZMxr4CxrUpy7+&5+@
zy#t%qqYGl~2bAi~3g6fK5>$+2XA_06-@f=w5A)~6=dT~0<&%BqGXS1O-)2|_8oUD5
zm@^9ox{!BcR(+3nRkwAVoj|i**-zh-K780pJma^Qt`Y~m_kzeKv#jLu_#=}wn)9Ye
z_*Ug+w0j8%ZSOEB|LUA!Gf699=S7zrZGU}KBrzt-4y3<JNZq%D`XpspE&$Qrr#AyX
zCr|Uhp4NUQSRVNx>KT@;$xd5fky}|PbdAGW=as~7(c^gO?YpZUCy%A6oS*RN;y-)v
zk-CQefzwzsAes~~2lZF=TAZk-xYdWUQ0ZHV5vx3Xge7Fx=ZY8|Z5e7KoYjj{-iU-2
ztp(7_6<JIayHq_WKIifDlFIQ(sngg5*<ESsO!J<r+(WKRhQU6KdEgqYehCsfLURc0
zBQaM&w~0s@ZAqL>H2d(l?m9|7s?jHp^3~mP{(Po`rrCq@1Fwe|a(dv<p&PpG$H`~M
z^bZ@w_ub*2O*~+`DBZ^M^{4&Jo25AXavib`t!C}ktX#8}*|PHAolZqu&c&;9J;kl_
zS0i9IDpbR@d`&}18xHA9pSu5!W<RpSY?8>KoPj_rsL@-|j6z_L-pzYIt{GD4W{!O;
zM?KmbdLz>=@dLL(l5P&+4a&|aOyw$JpJ6puaHGNIve1ot#Cn4DRC+}06F&0ov*g^m
zZ%8>Aov)Qi$O#6F<J6oQ8_86;5#7acGl9jqERC1(Mc$fgmH;2_tuM2)ji>f<8wix8
z8;5J|NGV!ZY$(-PF^i0(){%IGO}`XjvxxIfa^bmiLnr4E&zx#J?t6OG#?p*mT<bK8
z30|k?F(y6Z4z9nc!HU?V^L)<lZ)sN1BrCx%ow<>5`1HTj;6LXop5C?-xf)uI6T(cv
z5oJMjdNgBjJNc0;(c)u~!^H5D^}$~HMg_ss41Qb-e`<112tPGjq2UrE(*&;4jqN6b
z29hw#zIjtwdK>)P{v&nrpQYumZ^0aQN<R@dJQ1q3f)9?j^cz2`k=mI=nfB3c!vRO+
z;8P#M{M&?-Qa!DSypXBo+0cx2?mhj{a6ZXRlL3EezAd>agGSjc!4$^9gM!dgX)51o
zlQ8pL)WQ+*fZYI@G&~g+L>Js=yy{y!{1y^o9kf^3(%qu6`tf~~Cv!Nj7Z<z3>mdmg
zf~2s=PH{hAyBJlLhv>dd<!q$=*VMLedY#_`tp8y1x~?&M2uUYha3u@$A_*M~Jjb#w
z$LWF$5arXC^PY2}3UBF8W_9Q<b|<4C_k;^&6bo<cjz^NF_Ig=MGD}9?FoP2b7E`W`
z!`v#Jt*J_0s`(Ro@ESvTsCOd#n%QC9ukMzed$`E^I3SoHTXQ;~J-tw50of3wNtGe9
zwZ@QynZ0_a7#Wu<wxuH`SEh`**hb^ECERF#dj0k}V)$}s{&Fc>gVQw%0YiMs`(lli
zl2^2@m>E7wF!wih>N2J{GBSV;Sc=AoyUEc|Uyf|X+F)~zzN};HdR@_|vXCHd>usRj
zh;tTj*Z8#53jVeGTJHk!?CXf-FM%sxy&{#cPl-Co7Mpo6ha)3VPxZjF2kL{=R1EPM
z&EWeljoP2t2JV;JA~W_O{k%mUM-(`Hrg`bEbg@X{j&R!BO6_c5*#`j-q;8Q-?&f*j
zy>5Jj?R%BY$V8Y5JTh#i0?K~NibB0OIEJ78rL>3@=0x!xg*enSmiZ<%6_vnHBGQ+R
z=?V=&ykMu>@EkZoe!lbmf(^DF9(iDab<afOT4;d-4S~dXlaBeB*z<eT@dq`<4+X*R
z0MozU&?P8c*n2e1vOen_F*t?L)4O1w%`|_nApa4D{UJ8^#=yj#@dCVH{;>+=|Mu5a
z6ds&h$U>2soOf{QAE5=vj4jWTAyecRIh5<Yxx%FqfnvNU=f}P3S^|QAbU&76mmEK}
z?<&>v)Mh&FG)IP@Cah3x$I3?+9FDJ(zI9$TR4ofGvGHBgm|AtD>ltQh77T-*TA@#L
z`&};kEdu=>`F-6be~3B$4hDC_Onu=HvPUr=T371DVxhoJ^RhkcDP>-!>*pkHZ3&#G
zbj3Eb5hfw~F5brQKpOMl2EdGRYL@HsuAP*hy=0Q}vQM=5xWB4g#ENn$3_65rStPMd
zZ{?2XTiP?e%<LmnVaq{7JKt*Od{6k);Dy){Ld3fjPIGm*pQH{~v96zRy%|majv6qG
z_JzZ<soU06oE3tWAV{<L<1N%C3m;hwGQ-E3uscKW$g?<xn&~yI&O$$qQ@R%0)BX9~
zFyl_t6R>H8+oT;a{`z8}`}Gv}i|y2;oi=ML&XrhLd(Fq&wv}F<?A$uypA?|RBFyiQ
z<B%hn$9#lm!~Cy{^Y>)+3!3^B1xME{&JuV@C&|BMa=k?2*U=xHNq=r+s~gG9%zJ_O
zR`mRXpOd}W8INE&IVyQPqqpcDzh9LG&6?M9+-Sb8SfVLeQCz4qRB4Ar!==$!uMrWK
zU2Zm+5^d`F`ecQy{W5n1){U)P7CUAwJyi!0Ct1tw*I3z@Hd@&h<iO6Zqq@kcuEo$_
zVQ8wg5Rtk60jj>3!_!A&WvIeBw~uu+UPkzo>qG|5?S%i#MwIrRA=Z>ExOf*CU{YaE
zvGL+2U5#qo(+5HiyfsihiFndYrEB$r7-U5@;AbkuGOwYvrk|~v_%9Js?{+DysoDSs
zMLONi*Tf#_KgP;_k=W-ubbe1sF<gky^V4Ha=q(nT@+@nuQodW(NO1C7J6nd@9lF&!
zrwpDWQCfw{HkWR$dsL;kgiLL$uu#=%xm$}eS6!rKRXLt^pMo~W1lxwe$@6K)FlnLA
z`E`Z?itUCk7>Nyi-(&QzPkmvXf5o!?8!Hi!wCto`nDRifvvr&l9znQjg5`FYYz;G1
zW_(;&G=6fL98AsC-^3<$%MuxObK+xx$*RXO=~RG;i*u0&tuU(BM|gaD$=h7bI;b`(
zciQDKN!&)S*)acvuYh4_xYGK>tW@>wo}Qds*!sKp5eh%m2L=%aJ>im68m%J!yIoqG
zk_4#@9mb<jI4GGZemBGWmYA%CnoiBZ^y-_5nVl=543ON+kNkeuNQCkq`U=;5m@{D8
zV){)``Le5|)&f4lr_+e9O=FgnZZ1^3(6G5hI;_qfNjkNNb;v*agcGj@^1{W~V;F}S
zu|m6b#FrGm;GaNz9G9Z_q7rMzU8C@NA8<;?>T{<lf5EgOm_yeZjN5=G-_`wcTsW~u
zL?4lJ@ybc?&ZY)ifNY)sES^QY1~Ntjn~Bl5B&SqmV(4R5u4?*7&pgo0bY(_*Orn;E
zcNiJ8nVO3`r+0Kocvlp?NqwW`{jq{_cBAq|ECU6_f0rrS_xilw^{(g+qfXF_4-F-w
zgUhihEXgLrE<lhu%bShZ$I^tYS!zS;(MOLr^{!^dzuaWoE7J64CJ)TdYu10D$s-MJ
zYyNEPH;6ZW^JS1$&V7k37Tmq5z~H(!r7N6D6+B|NDpw~^2Hc=M6Yaw48L?4yF<9s?
zB&yb00R}z(%ZJEt14d?@Bo@i!^s<lEl_5p2Ha7x`VIS%(8urUp=AAiB=E=4aLX|m{
zsg|68-g;eYwQYY|n<l#JK5x!S2-75fJk*_g4ZCQYy2e?#>GU=E!Cl_4AiP+Xdoc?-
zm4g^m$($_O_*AybdW|O@jf=g!i2+!aT71%n0ZOKqn%O2;$3C+q#dS8W<*~%2dt%>P
z!TM+*PCp&QTeBwZYUD2{{MvvO=#;WF>nKeoPcf;?#a$+5S%GW|){{yRlLdeJRgVaY
znui+(fG5?{$?C(L?`7D3u-^TdT>#?!T#XgBoQq;^iLN3cW&R*uo?AlG#}0;@ZLSJ;
z>pA#Ms0c^h@5<~7>ur@h(#Lg3?VT;L!jE@7iE5Rx50W%7b<)r$iJ9O7jx*Ydj4a9O
ze5E7=a>d-ld8aHT#{cV@l!QB+Im|QaJ^#&8i>KN9Q&>e3E=&$}hQ_{n_0QqB9+%x<
z2X&T0qcz0im**+_FK_AMF%Lx+3a%-}TwUEEw@@Aq?{sS25LzI45MAaCX3$dyZHZ9R
z1W2DG^?IGk;Ya6Ww?0fHaD`Di?3irC3c9M=<w~jxyJ#b-_xy<KM3M|t$>-jLz2_}&
z*~s9j9^m23p|llcgtvgEimQ5rJ>O(5GDbs~n;ktrYhE%LR!e(**)o4TiapfL<ThAj
zrm9>2fyCQtoQT;Y^J}{t-@~~7&eq+Lwbog0Rdqh-u+D!IWk54hEc;uz9XQkMUgKI4
zL31{uy4DZIwkW%nKK59QKPd}&%NetFm@z6AiQi#A9|(%unblj1)GVF!bZ<DkG^9fA
z>Fp`9m1Gi1z57|%*O;qpMfjo@Ba)r(lWf*r<K@+IHlK8pm8U4{5BVG+{2)y6Qz4X0
z$YIU&fIkt<z&oO(cgw&L8+IruA%%Q;W(tlC#=~=atQ6vQZf1@vaZ4g5SoZa(#u!?D
z=)pijISEo1QD18p-P4_vwfls~or)s-m(TLNWLjkF?w*vqTsta(2iwBE=H&J=l~IhP
zAz8wD@g6E~**<As4KOQTdMOb7e35CkBSv&-q=fc>P!B&Bwr1L!(C!xFzV_%`px#ya
zJhCfJ+b&NmH4}|VR`rD_i0CR{wT$tk2g{6x2Ewq%JN!b%ZB(^e1lJ{)6R*f%OkZP?
zuri6rWc)2dcaxY#+L>HH=8+koXj`{W*8dAK;@_zUeHUukqZRdEc*=L?ujSfz-IbyQ
z744w_^|RFLi|p5Cf|3e;+vaK#O^^-Y?zWE$+iDI-8${H;SdxNboAh}rs&==h2!Bcw
zXwqcY&G($RdVQPk{fN({R-^Y%S!p*5FC|?w`tWQCa}*}$4#!yC#7zxJH}r=fc*>Wa
z8}G)JaK}l>S!L4FdVR#a1A^q+RQ@j|Pmhd5MKD<Ta4|3fNvZbJ3ThUf;iX5(TmK@2
zaRGzuBHdeYjcjx?DCz}CJZPzDcf@S<T_RC%pOY>g6jTrd&Njswzh{w2H3c{|Q(^fx
zv3_`RDE?*U{9yR<6PWRnd%?fRcK<dPiju@SGc7+PXls6tsQ-6rsec*3|DXA~_1-ID
zVj(p(HGnxRFWa94%l{0}KsP(U`u#&~mCVy)1K<#1q72Z80s*xE1^bq+p59ker9Y{v
z`~ZaioJ0RGg#KMjDZH_NBwOlt>U&8&g~sP_2L_IJSVzp$evvW(4y<II2iq%9=7bbU
zXVca&vIKDlrUiJq#tG-f@TL`D2|bp+27GjqTx#VPTY4JE$;o+2ZPlH$-Jc5BN^7{a
zMbe&91NN3D{iy&{a|#8_UQcjxy<@d=ylY~)G)|V)lddj<cb5Bc0I*Ui3y8Swj}$BA
zJb2h3=-BBL1CUvg?D?&x%XkFfkT5q*O!KKD(gF&`Z2)`jr<eR5yK;SYTG^46@mgzR
zLn_(LL4(qgNA-$Bu>dP-R-j3ZI3zATJI?gDeA2sgGR+G7&#xP>j?<lub#PeZz{wrJ
zb668FYSRp0KBTyKF=T2=^Xr9+G6Cvz4JW{2!2`J5fcF>rH*AvdfA0<clpma0Vo6uc
SG2|TZ^Q)4&;#&pdfd2u#iDX>>

literal 0
HcmV?d00001

diff --git a/docs/dev/todo_list.md b/docs/dev/todo_list.md
new file mode 100644
index 0000000..909b953
--- /dev/null
+++ b/docs/dev/todo_list.md
@@ -0,0 +1,32 @@
+# TODO LIST
+
+## Security
+
+* Reassess Jeroen's comment:
+https://github.com/eclipse-cyclonedds/cyclonedds/pull/177#issuecomment-494040238
+> 5. If the security_api just becomes part of ddsc, and it should in my opinion, then I'd prefer you propagate the naming scheme as introduced in ddsrt etc and name the header files e.g. dds/ddssec/auth.h or something instead of dds/security/dds_security_api_authentication.h.
+
+* Reassess Jeroen's comment:
+https://github.com/eclipse-cyclonedds/cyclonedds/pull/177#issuecomment-494040238
+> I've spent a great deal of time stripping out all the various different error codes and make it so that we simply use DDS_RETCODE_ constants everywhere. This pull request reintroduces separate error codes and that's something I really don't approve of. The security error codes start at an offset of 100 and should nicely integrate with the other codes in dds/ddsrt/retcode.h. The messages should be retrievable using dds_strretcode if you ask me.
+
+
+* reassess Erik's comment
+https://github.com/eclipse-cyclonedds/cyclonedds/pull/177#issuecomment-490718462
+> GuidPrefix & BuiltinTopicKey change
+
+* reassess erik's comment
+https://github.com/eclipse-cyclonedds/cyclonedds/pull/177#issuecomment-490718462
+> ddsrt_strchrs
+
+* Reassess Jeroen's comment:
+https://github.com/eclipse-cyclonedds/cyclonedds/pull/177#issuecomment-494040238
+> If the security_api just becomes part of ddsc, and it should in my opinion, then I'd prefer you propagate the naming scheme as introduced in ddsrt etc and name the header files e.g. dds/ddssec/auth.h or something instead of dds/security/dds_security_api_authentication.h.
+
+* Reassess Jeroen's comment:
+https://github.com/eclipse-cyclonedds/cyclonedds/pull/177#issuecomment-494040238
+> If the security_api just becomes part of ddsc, and it should in my opinion, then I'd prefer you propagate the naming scheme as introduced in ddsrt etc and name the header files e.g. dds/ddssec/auth.h or something instead of dds/security/dds_security_api_authentication.h.
+
+
+
+
diff --git a/src/CMakeLists.txt b/src/CMakeLists.txt
index d1539dd..48daaa2 100644
--- a/src/CMakeLists.txt
+++ b/src/CMakeLists.txt
@@ -178,6 +178,7 @@ set(CMAKE_ARCHIVE_OUTPUT_DIRECTORY "${CMAKE_BINARY_DIR}/lib")
 add_subdirectory(idlc)
 add_subdirectory(ddsrt)
 add_subdirectory(etc)
+add_subdirectory(security/api)
 add_subdirectory(core)
 add_subdirectory(tools)
 add_subdirectory(scripts)
diff --git a/src/core/CMakeLists.txt b/src/core/CMakeLists.txt
index 8f36723..c97b8a4 100644
--- a/src/core/CMakeLists.txt
+++ b/src/core/CMakeLists.txt
@@ -50,13 +50,15 @@ endif()
 include(ddsi/CMakeLists.txt)
 include(ddsc/CMakeLists.txt)
 
-target_link_libraries(ddsc PRIVATE ddsrt)
+target_link_libraries(ddsc PRIVATE ddsrt security_api)
+
 target_compile_definitions(
   ddsc PUBLIC
   $<BUILD_INTERFACE:$<TARGET_PROPERTY:ddsrt,INTERFACE_COMPILE_DEFINITIONS>>)
 target_include_directories(
   ddsc PUBLIC
-  $<BUILD_INTERFACE:$<TARGET_PROPERTY:ddsrt,INTERFACE_INCLUDE_DIRECTORIES>>)
+  $<BUILD_INTERFACE:$<TARGET_PROPERTY:ddsrt,INTERFACE_INCLUDE_DIRECTORIES>>
+  $<BUILD_INTERFACE:$<TARGET_PROPERTY:security_api,INTERFACE_INCLUDE_DIRECTORIES>>)
 
 # SOVERSION should increase on incompatible ABI change
 set_target_properties(ddsc PROPERTIES VERSION ${PROJECT_VERSION} SOVERSION ${PROJECT_VERSION_MAJOR})
diff --git a/src/ddsrt/include/dds/ddsrt/string.h b/src/ddsrt/include/dds/ddsrt/string.h
index 0023d12..1d8f184 100644
--- a/src/ddsrt/include/dds/ddsrt/string.h
+++ b/src/ddsrt/include/dds/ddsrt/string.h
@@ -12,6 +12,7 @@
 #ifndef DDSRT_STRING_H
 #define DDSRT_STRING_H
 
+#include <stdbool.h>
 #include "dds/export.h"
 #include "dds/ddsrt/attributes.h"
 #include "dds/ddsrt/retcode.h"
@@ -169,6 +170,8 @@ ddsrt_strlcat(
   size_t size)
 ddsrt_nonnull((1,2));
 
+
+
 /**
  * @brief Get description for specified system error number.
  *
diff --git a/src/ddsrt/src/string.c b/src/ddsrt/src/string.c
index 24d2631..3e4ed64 100644
--- a/src/ddsrt/src/string.c
+++ b/src/ddsrt/src/string.c
@@ -178,3 +178,4 @@ ddsrt_strdup(
 
   return ddsrt_memdup(str, strlen(str) + 1);
 }
+
diff --git a/src/security/api/CMakeLists.txt b/src/security/api/CMakeLists.txt
new file mode 100644
index 0000000..63caf64
--- /dev/null
+++ b/src/security/api/CMakeLists.txt
@@ -0,0 +1,25 @@
+#
+# Copyright(c) 2006 to 2018 ADLINK Technology Limited and others
+#
+# This program and the accompanying materials are made available under the
+# terms of the Eclipse Public License v. 2.0 which is available at
+# http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+# v. 1.0 which is available at
+# http://www.eclipse.org/org/documents/edl-v10.php.
+#
+# SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+#
+
+
+add_library(security_api INTERFACE)
+
+target_include_directories(
+  security_api INTERFACE
+    "$<BUILD_INTERFACE:${CMAKE_CURRENT_SOURCE_DIR}/include>")
+
+install(
+  DIRECTORY "${CMAKE_CURRENT_LIST_DIR}/include/"
+  DESTINATION "${CMAKE_INSTALL_INCLUDEDIR}"
+  COMPONENT dev)
+
+
diff --git a/src/security/api/include/dds/security/dds_security_api.h b/src/security/api/include/dds/security/dds_security_api.h
new file mode 100644
index 0000000..1304201
--- /dev/null
+++ b/src/security/api/include/dds/security/dds_security_api.h
@@ -0,0 +1,48 @@
+/*
+ * Copyright(c) 2006 to 2018 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+
+#ifndef DDS_SECURITY_API_H
+#define DDS_SECURITY_API_H
+
+
+/* Various security plugins. */
+#include "dds_security_api_access_control.h"
+#include "dds_security_api_authentication.h"
+#include "dds_security_api_cryptography.h"
+
+
+#if defined (__cplusplus)
+extern "C" {
+#endif
+
+
+/**
+ * Integration functions for Security plugins
+ *
+ */
+
+typedef int  (*plugin_init)(
+         const char *argument,
+         void **context
+        );
+
+typedef int  (*plugin_finalize)(
+         void *context
+        );
+
+
+#if defined (__cplusplus)
+}
+#endif
+
+
+#endif /* DDS_SECURITY_API_H */
diff --git a/src/security/api/include/dds/security/dds_security_api_access_control.h b/src/security/api/include/dds/security/dds_security_api_access_control.h
new file mode 100644
index 0000000..00ca926
--- /dev/null
+++ b/src/security/api/include/dds/security/dds_security_api_access_control.h
@@ -0,0 +1,375 @@
+/*
+ * Copyright(c) 2006 to 2018 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+
+#ifndef DDS_SECURITY_ACCESS_CONTROL_API_H
+#define DDS_SECURITY_ACCESS_CONTROL_API_H
+
+#include "dds_security_api_types.h"
+#include "dds_security_api_authentication.h"
+
+#if defined (__cplusplus)
+extern "C" {
+#endif
+
+
+
+/**
+ * AccessControl Component
+ */
+struct dds_security_access_control;
+typedef struct dds_security_access_control dds_security_access_control;
+
+struct dds_security_access_control_listener;
+typedef struct dds_security_access_control_listener dds_security_access_control_listener;
+
+
+/**
+ * AccessControlListener Interface
+ * */
+
+
+typedef DDS_Security_boolean
+(*DDS_Security_access_control_listener_on_revoke_permissions)
+        ( dds_security_access_control_listener *instance,
+          const dds_security_access_control *plugin,
+          const DDS_Security_PermissionsHandle handle);
+
+struct dds_security_access_control_listener
+{
+  DDS_Security_access_control_listener_on_revoke_permissions on_revoke_permissions;
+};
+
+
+/**
+ * AccessControl Interface
+ */
+
+typedef DDS_Security_PermissionsHandle
+(*DDS_Security_access_control_validate_local_permissions)
+        ( dds_security_access_control *instance,
+          const dds_security_authentication *auth_plugin,
+          const DDS_Security_IdentityHandle identity,
+          const DDS_Security_DomainId domain_id,
+          const DDS_Security_Qos *participant_qos,
+          DDS_Security_SecurityException *ex);
+
+typedef DDS_Security_PermissionsHandle
+(*DDS_Security_access_control_validate_remote_permissions)
+        ( dds_security_access_control *instance,
+          const dds_security_authentication *auth_plugin,
+          const DDS_Security_IdentityHandle local_identity_handle,
+          const DDS_Security_IdentityHandle remote_identity_handle,
+          const DDS_Security_PermissionsToken *remote_permissions_token,
+          const DDS_Security_AuthenticatedPeerCredentialToken *remote_credential_token,
+          DDS_Security_SecurityException *ex);
+
+typedef DDS_Security_boolean
+(*DDS_Security_access_control_check_create_participant)
+        ( dds_security_access_control *instance,
+          const DDS_Security_PermissionsHandle permissions_handle,
+          const DDS_Security_DomainId domain_id,
+          const DDS_Security_Qos *participant_qos,
+          DDS_Security_SecurityException *ex);
+
+typedef DDS_Security_boolean
+(*DDS_Security_access_control_check_create_datawriter)
+        ( dds_security_access_control *instance,
+          const DDS_Security_PermissionsHandle permissions_handle,
+          const DDS_Security_DomainId domain_id,
+          const DDS_Security_char *topic_name,
+          const DDS_Security_Qos *writer_qos,
+          const DDS_Security_PartitionQosPolicy *partition,
+          const DDS_Security_DataTags *data_tag,
+          DDS_Security_SecurityException *ex);
+
+typedef DDS_Security_boolean
+(*DDS_Security_access_control_check_create_datareader)
+        ( dds_security_access_control *instance,
+          const DDS_Security_PermissionsHandle permissions_handle,
+          const DDS_Security_DomainId domain_id,
+          const DDS_Security_char *topic_name,
+          const DDS_Security_Qos *reader_qos,
+          const DDS_Security_PartitionQosPolicy *partition,
+          const DDS_Security_DataTags *data_tag,
+          DDS_Security_SecurityException *ex);
+
+
+typedef DDS_Security_boolean
+(*DDS_Security_access_control_check_create_topic)
+        ( dds_security_access_control *instance,
+          const DDS_Security_PermissionsHandle permissions_handle,
+          const DDS_Security_DomainId domain_id,
+          const DDS_Security_char *topic_name,
+          const DDS_Security_Qos *topic_qos,
+          DDS_Security_SecurityException *ex);
+
+typedef DDS_Security_boolean
+(*DDS_Security_access_control_check_local_datawriter_register_instance)
+        ( dds_security_access_control *instance,
+          const DDS_Security_PermissionsHandle permissions_handle,
+          const DDS_Security_Entity *writer,
+          const DDS_Security_DynamicData *key,
+          DDS_Security_SecurityException *ex);
+
+typedef DDS_Security_boolean
+(*DDS_Security_access_control_check_local_datawriter_dispose_instance)
+        ( dds_security_access_control *instance,
+          const DDS_Security_PermissionsHandle permissions_handle,
+          const DDS_Security_Entity *writer,
+          const DDS_Security_DynamicData key,
+          DDS_Security_SecurityException *ex);
+
+typedef DDS_Security_boolean
+(*DDS_Security_access_control_check_remote_participant)
+        ( dds_security_access_control *instance,
+          const DDS_Security_PermissionsHandle permissions_handle,
+          const DDS_Security_DomainId domain_id,
+          const DDS_Security_ParticipantBuiltinTopicDataSecure *participant_data,
+          DDS_Security_SecurityException *ex);
+
+typedef DDS_Security_boolean
+(*DDS_Security_access_control_check_remote_datawriter)
+        ( dds_security_access_control *instance,
+          const DDS_Security_PermissionsHandle permissions_handle,
+          const DDS_Security_DomainId domain_id,
+          const DDS_Security_PublicationBuiltinTopicDataSecure *publication_data,
+          DDS_Security_SecurityException *ex);
+
+typedef DDS_Security_boolean
+(*DDS_Security_access_control_check_remote_datareader)
+        ( dds_security_access_control *instance,
+          const DDS_Security_PermissionsHandle permissions_handle,
+          const DDS_Security_DomainId domain_id,
+          const DDS_Security_SubscriptionBuiltinTopicDataSecure *subscription_data,
+          DDS_Security_boolean *relay_only,
+          DDS_Security_SecurityException *ex);
+
+typedef DDS_Security_boolean
+(*DDS_Security_access_control_check_remote_topic)
+        ( dds_security_access_control *instance,
+          const DDS_Security_PermissionsHandle permissions_handle,
+          const DDS_Security_DomainId domain_id,
+          const DDS_Security_TopicBuiltinTopicData *topic_data,
+          DDS_Security_SecurityException *ex);
+
+
+typedef DDS_Security_boolean
+(*DDS_Security_access_control_check_local_datawriter_match)
+        ( dds_security_access_control *instance,
+          const DDS_Security_PermissionsHandle writer_permissions_handle,
+          const DDS_Security_PermissionsHandle reader_permissions_handle,
+          const DDS_Security_PublicationBuiltinTopicDataSecure *publication_data,
+          const DDS_Security_SubscriptionBuiltinTopicDataSecure *subscription_data,
+          DDS_Security_SecurityException *ex);
+
+
+typedef DDS_Security_boolean
+(*DDS_Security_access_control_check_local_datareader_match)
+        ( dds_security_access_control *instance,
+          const DDS_Security_PermissionsHandle reader_permissions_handle,
+          const DDS_Security_PermissionsHandle writer_permissions_handle,
+          const DDS_Security_SubscriptionBuiltinTopicDataSecure *subscription_data,
+          const DDS_Security_PublicationBuiltinTopicDataSecure *publication_data,
+          DDS_Security_SecurityException *ex);
+
+typedef DDS_Security_boolean
+(*DDS_Security_access_control_check_remote_datawriter_register_instance)
+        ( dds_security_access_control *instance,
+          const DDS_Security_PermissionsHandle permissions_handle,
+          const DDS_Security_Entity *reader,
+          const DDS_Security_InstanceHandle publication_handle,
+          const DDS_Security_DynamicData key,
+          const DDS_Security_InstanceHandle instance_handle,
+          DDS_Security_SecurityException *ex);
+
+typedef DDS_Security_boolean
+(*DDS_Security_access_control_check_remote_datawriter_dispose_instance)
+        ( dds_security_access_control *instance,
+          const DDS_Security_PermissionsHandle permissions_handle,
+          const DDS_Security_Entity *reader,
+          const DDS_Security_InstanceHandle publication_handle,
+          const DDS_Security_DynamicData key,
+          DDS_Security_SecurityException *ex);
+
+typedef DDS_Security_boolean
+(*DDS_Security_access_control_get_permissions_token)
+        ( dds_security_access_control *instance,
+          DDS_Security_PermissionsToken *permissions_token,
+          const DDS_Security_PermissionsHandle handle,
+          DDS_Security_SecurityException *ex);
+
+typedef DDS_Security_boolean
+(*DDS_Security_access_control_get_permissions_credential_token)
+        ( dds_security_access_control *instance,
+          DDS_Security_PermissionsCredentialToken *permissions_credential_token,
+          const DDS_Security_PermissionsHandle handle,
+          DDS_Security_SecurityException *ex);
+
+typedef DDS_Security_boolean
+(*DDS_Security_access_control_set_listener)
+        ( dds_security_access_control *instance,
+          const dds_security_access_control_listener *listener,
+          DDS_Security_SecurityException *ex);
+
+typedef DDS_Security_boolean
+(*DDS_Security_access_control_return_permissions_token)
+        ( dds_security_access_control *instance,
+          const DDS_Security_PermissionsToken *token,
+          DDS_Security_SecurityException *ex);
+
+typedef DDS_Security_boolean
+(*DDS_Security_access_control_return_permissions_credential_token)
+        ( dds_security_access_control *instance,
+          const DDS_Security_PermissionsCredentialToken *permissions_credential_token,
+          DDS_Security_SecurityException *ex);
+
+typedef DDS_Security_boolean
+(*DDS_Security_access_control_get_participant_sec_attributes)
+        ( dds_security_access_control *instance,
+          const DDS_Security_PermissionsHandle permissions_handle,
+          DDS_Security_ParticipantSecurityAttributes *attributes,
+          DDS_Security_SecurityException *ex);
+
+
+typedef DDS_Security_boolean
+(*DDS_Security_access_control_get_topic_sec_attributes)
+        ( dds_security_access_control *instance,
+          const DDS_Security_PermissionsHandle permissions_handle,
+          const DDS_Security_char *topic_name,
+          DDS_Security_TopicSecurityAttributes *attributes,
+          DDS_Security_SecurityException *ex);
+
+
+typedef DDS_Security_boolean
+(*DDS_Security_access_control_get_datawriter_sec_attributes)
+        ( dds_security_access_control *instance,
+          const DDS_Security_PermissionsHandle permissions_handle,
+          const DDS_Security_char *topic_name,
+          const DDS_Security_PartitionQosPolicy *partition,
+          const DDS_Security_DataTagQosPolicy *data_tag,
+          DDS_Security_EndpointSecurityAttributes *attributes,
+          DDS_Security_SecurityException *ex);
+
+
+typedef DDS_Security_boolean
+(*DDS_Security_access_control_get_datareader_sec_attributes)
+        ( dds_security_access_control *instance,
+          const DDS_Security_PermissionsHandle permissions_handle,
+          const DDS_Security_char *topic_name,
+          const DDS_Security_PartitionQosPolicy *partition,
+          const DDS_Security_DataTagQosPolicy *data_tag,
+          DDS_Security_EndpointSecurityAttributes *attributes,
+          DDS_Security_SecurityException *ex);
+
+
+typedef DDS_Security_boolean
+(*DDS_Security_access_control_return_participant_sec_attributes)
+        ( dds_security_access_control *instance,
+          const DDS_Security_ParticipantSecurityAttributes *attributes,
+          DDS_Security_SecurityException *ex);
+
+typedef DDS_Security_boolean
+(*DDS_Security_access_control_return_topic_sec_attributes)
+        ( dds_security_access_control *instance,
+          const DDS_Security_TopicSecurityAttributes *attributes,
+          DDS_Security_SecurityException *ex);
+
+typedef DDS_Security_boolean
+(*DDS_Security_access_control_return_datawriter_sec_attributes)
+        ( dds_security_access_control *instance,
+          const DDS_Security_EndpointSecurityAttributes *attributes,
+          DDS_Security_SecurityException *ex);
+
+
+typedef DDS_Security_boolean
+(*DDS_Security_access_control_return_datareader_sec_attributes)
+        ( dds_security_access_control *instance,
+          const DDS_Security_EndpointSecurityAttributes *attributes,
+          DDS_Security_SecurityException *ex);
+
+typedef DDS_Security_boolean
+(*DDS_Security_access_control_return_permissions_handle)
+        ( dds_security_access_control *instance,
+           DDS_Security_PermissionsHandle permissions_handle,
+          DDS_Security_SecurityException *ex);
+
+
+struct dds_security_access_control
+{
+  DDS_Security_access_control_validate_local_permissions validate_local_permissions;
+
+  DDS_Security_access_control_validate_remote_permissions validate_remote_permissions;
+
+  DDS_Security_access_control_check_create_participant check_create_participant;
+
+  DDS_Security_access_control_check_create_datawriter check_create_datawriter;
+
+  DDS_Security_access_control_check_create_datareader check_create_datareader;
+
+  DDS_Security_access_control_check_create_topic check_create_topic;
+
+  DDS_Security_access_control_check_local_datawriter_register_instance check_local_datawriter_register_instance;
+
+  DDS_Security_access_control_check_local_datawriter_dispose_instance check_local_datawriter_dispose_instance;
+
+  DDS_Security_access_control_check_remote_participant check_remote_participant;
+
+  DDS_Security_access_control_check_remote_datawriter check_remote_datawriter;
+
+  DDS_Security_access_control_check_remote_datareader check_remote_datareader;
+
+  DDS_Security_access_control_check_remote_topic check_remote_topic;
+
+  DDS_Security_access_control_check_local_datawriter_match check_local_datawriter_match;
+
+  DDS_Security_access_control_check_local_datareader_match check_local_datareader_match;
+
+  DDS_Security_access_control_check_remote_datawriter_register_instance check_remote_datawriter_register_instance;
+
+  DDS_Security_access_control_check_remote_datawriter_dispose_instance check_remote_datawriter_dispose_instance;
+
+  DDS_Security_access_control_get_permissions_token get_permissions_token;
+
+  DDS_Security_access_control_get_permissions_credential_token get_permissions_credential_token;
+
+  DDS_Security_access_control_set_listener set_listener;
+
+  DDS_Security_access_control_return_permissions_token return_permissions_token;
+
+  DDS_Security_access_control_return_permissions_credential_token return_permissions_credential_token;
+
+  DDS_Security_access_control_get_participant_sec_attributes get_participant_sec_attributes;
+
+  DDS_Security_access_control_get_topic_sec_attributes get_topic_sec_attributes;
+
+  DDS_Security_access_control_get_datawriter_sec_attributes get_datawriter_sec_attributes;
+
+  DDS_Security_access_control_get_datareader_sec_attributes get_datareader_sec_attributes;
+
+  DDS_Security_access_control_return_participant_sec_attributes return_participant_sec_attributes;
+
+  DDS_Security_access_control_return_topic_sec_attributes return_topic_sec_attributes;
+
+  DDS_Security_access_control_return_datawriter_sec_attributes return_datawriter_sec_attributes;
+
+  DDS_Security_access_control_return_datareader_sec_attributes return_datareader_sec_attributes;
+
+  DDS_Security_access_control_return_permissions_handle return_permissions_handle;
+
+};
+
+
+#if defined (__cplusplus)
+}
+#endif
+
+#endif /* DDS_SECURITY_ACCESS_CONTROL_API_H */
diff --git a/src/security/api/include/dds/security/dds_security_api_authentication.h b/src/security/api/include/dds/security/dds_security_api_authentication.h
new file mode 100644
index 0000000..ebcfa15
--- /dev/null
+++ b/src/security/api/include/dds/security/dds_security_api_authentication.h
@@ -0,0 +1,238 @@
+/*
+ * Copyright(c) 2006 to 2018 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+
+#ifndef DDS_SECURITY_AUTHENTICATION_API_H
+#define DDS_SECURITY_AUTHENTICATION_API_H
+
+#include "dds_security_api_types.h"
+
+#if defined (__cplusplus)
+extern "C" {
+#endif
+
+
+/**
+ * Authentication Component
+ */
+struct dds_security_authentication;
+typedef struct dds_security_authentication dds_security_authentication;
+
+struct dds_security_authentication_listener;
+typedef struct dds_security_authentication_listener dds_security_authentication_listener;
+
+
+/**
+ * AuthenticationListener interface
+ */
+
+typedef DDS_Security_boolean
+(*DDS_Security_authentication_listener_on_revoke_identity)
+        ( dds_security_authentication_listener *context,
+          const dds_security_authentication *plugin,
+          const DDS_Security_IdentityHandle handle
+        );
+
+typedef DDS_Security_boolean
+(*DDS_Security_authentication_listener_on_status_changed)
+        ( dds_security_authentication_listener *context,
+          const dds_security_authentication *plugin,
+          const DDS_Security_IdentityHandle handle,
+          const DDS_Security_AuthStatusKind status_kind
+        );
+
+
+struct dds_security_authentication_listener
+{
+  DDS_Security_authentication_listener_on_revoke_identity on_revoke_identity;
+
+  DDS_Security_authentication_listener_on_status_changed on_status_changed;
+};
+
+typedef DDS_Security_ValidationResult_t
+(*DDS_Security_authentication_validate_local_identity)
+        ( dds_security_authentication *instance,
+          DDS_Security_IdentityHandle *local_identity_handle,
+          DDS_Security_GUID_t *adjusted_participant_guid,
+          const DDS_Security_DomainId domain_id,
+          const DDS_Security_Qos *participant_qos,
+          const DDS_Security_GUID_t *candidate_participant_guid,
+          DDS_Security_SecurityException *ex
+        );
+
+
+typedef DDS_Security_boolean
+(*DDS_Security_authentication_get_identity_token)
+        ( dds_security_authentication *instance,
+          DDS_Security_IdentityToken *identity_token,
+          const DDS_Security_IdentityHandle handle,
+          DDS_Security_SecurityException *ex);
+
+
+typedef DDS_Security_boolean
+(*DDS_Security_authentication_get_identity_status_token)
+        ( dds_security_authentication *instance,
+          DDS_Security_IdentityStatusToken *identity_status_token,
+          const DDS_Security_IdentityHandle handle,
+          DDS_Security_SecurityException *ex);
+
+typedef DDS_Security_boolean
+(*DDS_Security_authentication_set_permissions_credential_and_token)
+        ( dds_security_authentication *instance,
+          const DDS_Security_IdentityHandle handle,
+          const DDS_Security_PermissionsCredentialToken *permissions_credential,
+          const DDS_Security_PermissionsToken *permissions_token,
+          DDS_Security_SecurityException *ex);
+
+
+typedef DDS_Security_ValidationResult_t
+(*DDS_Security_authentication_validate_remote_identity)
+        ( dds_security_authentication *instance,
+          DDS_Security_IdentityHandle *remote_identity_handle,
+          DDS_Security_AuthRequestMessageToken *local_auth_request_token,
+          const DDS_Security_AuthRequestMessageToken *remote_auth_request_token,
+          const DDS_Security_IdentityHandle local_identity_handle,
+          const DDS_Security_IdentityToken *remote_identity_token,
+          const DDS_Security_GUID_t *remote_participant_guid,
+          DDS_Security_SecurityException *ex);
+
+
+typedef DDS_Security_ValidationResult_t
+(*DDS_Security_authentication_begin_handshake_request)
+        ( dds_security_authentication *instance,
+          DDS_Security_HandshakeHandle *handshake_handle,
+          DDS_Security_HandshakeMessageToken *handshake_message,
+          const DDS_Security_IdentityHandle initiator_identity_handle,
+          const DDS_Security_IdentityHandle replier_identity_handle,
+          const DDS_Security_OctetSeq *serialized_local_participant_data,
+          DDS_Security_SecurityException *ex);
+
+
+typedef DDS_Security_ValidationResult_t
+(*DDS_Security_authentication_begin_handshake_reply)
+        ( dds_security_authentication *instance,
+          DDS_Security_HandshakeHandle *handshake_handle,
+          DDS_Security_HandshakeMessageToken *handshake_message_out,
+          const DDS_Security_HandshakeMessageToken *handshake_message_in,
+          const DDS_Security_IdentityHandle initiator_identity_handle,
+          const DDS_Security_IdentityHandle replier_identity_handle,
+          const DDS_Security_OctetSeq *serialized_local_participant_data,
+          DDS_Security_SecurityException *ex);
+
+typedef DDS_Security_ValidationResult_t
+(*DDS_Security_authentication_process_handshake)
+        ( dds_security_authentication *instance,
+          DDS_Security_HandshakeMessageToken *handshake_message_out,
+          const DDS_Security_HandshakeMessageToken *handshake_message_in,
+          const DDS_Security_HandshakeHandle handshake_handle,
+          DDS_Security_SecurityException *ex);
+
+typedef DDS_Security_SharedSecretHandle
+(*DDS_Security_authentication_get_shared_secret)
+        ( dds_security_authentication *instance,
+          const DDS_Security_HandshakeHandle handshake_handle,
+          DDS_Security_SecurityException *ex);
+
+typedef DDS_Security_boolean
+(*DDS_Security_authentication_get_authenticated_peer_credential_token)
+        ( dds_security_authentication *instance,
+          DDS_Security_AuthenticatedPeerCredentialToken *peer_credential_token,
+          const DDS_Security_HandshakeHandle handshake_handle,
+          DDS_Security_SecurityException *ex);
+
+typedef DDS_Security_boolean
+(*DDS_Security_authentication_set_listener)
+        ( dds_security_authentication *instance,
+          const dds_security_authentication_listener *listener,
+          DDS_Security_SecurityException *ex);
+
+typedef DDS_Security_boolean
+(*DDS_Security_authentication_return_identity_token)
+        ( dds_security_authentication *instance,
+          const DDS_Security_IdentityToken *token,
+          DDS_Security_SecurityException *ex);
+
+
+typedef DDS_Security_boolean
+(*DDS_Security_authentication_return_identity_status_token)
+        ( dds_security_authentication *instance,
+          const DDS_Security_IdentityStatusToken *token,
+          DDS_Security_SecurityException *ex);
+
+typedef DDS_Security_boolean
+(*DDS_Security_authentication_return_authenticated_peer_credential_token)
+        ( dds_security_authentication *instance,
+          const DDS_Security_AuthenticatedPeerCredentialToken *peer_credential_token,
+          DDS_Security_SecurityException *ex);
+
+typedef DDS_Security_boolean
+(*DDS_Security_authentication_return_handshake_handle)
+        ( dds_security_authentication *instance,
+          const DDS_Security_HandshakeHandle handshake_handle,
+          DDS_Security_SecurityException *ex);
+
+typedef DDS_Security_boolean
+(*DDS_Security_authentication_return_identity_handle)
+        ( dds_security_authentication *instance,
+          const DDS_Security_IdentityHandle identity_handle,
+          DDS_Security_SecurityException *ex);
+
+typedef DDS_Security_boolean
+(*DDS_Security_authentication_return_sharedsecret_handle)
+        ( dds_security_authentication *instance,
+          const DDS_Security_SharedSecretHandle sharedsecret_handle,
+          DDS_Security_SecurityException *ex);
+
+
+struct dds_security_authentication
+{
+
+  DDS_Security_authentication_validate_local_identity validate_local_identity;
+
+  DDS_Security_authentication_get_identity_token get_identity_token;
+
+  DDS_Security_authentication_get_identity_status_token get_identity_status_token;
+
+  DDS_Security_authentication_set_permissions_credential_and_token set_permissions_credential_and_token;
+
+  DDS_Security_authentication_validate_remote_identity validate_remote_identity;
+
+  DDS_Security_authentication_begin_handshake_request begin_handshake_request;
+
+  DDS_Security_authentication_begin_handshake_reply begin_handshake_reply;
+
+  DDS_Security_authentication_process_handshake process_handshake;
+
+  DDS_Security_authentication_get_shared_secret get_shared_secret;
+
+  DDS_Security_authentication_get_authenticated_peer_credential_token get_authenticated_peer_credential_token;
+
+  DDS_Security_authentication_set_listener set_listener;
+
+  DDS_Security_authentication_return_identity_token return_identity_token;
+
+  DDS_Security_authentication_return_identity_status_token return_identity_status_token;
+
+  DDS_Security_authentication_return_authenticated_peer_credential_token return_authenticated_peer_credential_token;
+
+  DDS_Security_authentication_return_handshake_handle return_handshake_handle;
+
+  DDS_Security_authentication_return_identity_handle return_identity_handle;
+
+  DDS_Security_authentication_return_sharedsecret_handle return_sharedsecret_handle;
+};
+
+
+#if defined (__cplusplus)
+}
+#endif
+
+#endif /* DDS_SECURITY_AUTHENTICATION_API_H */
diff --git a/src/security/api/include/dds/security/dds_security_api_cryptography.h b/src/security/api/include/dds/security/dds_security_api_cryptography.h
new file mode 100644
index 0000000..f082477
--- /dev/null
+++ b/src/security/api/include/dds/security/dds_security_api_cryptography.h
@@ -0,0 +1,337 @@
+/*
+ * Copyright(c) 2006 to 2018 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+
+#ifndef DDS_SECURITY_API_CRYPTOGRAPHY_H
+#define DDS_SECURITY_API_CRYPTOGRAPHY_H
+
+#include "dds_security_api_types.h"
+
+#if defined (__cplusplus)
+extern "C" {
+#endif
+
+/**
+ * Crypto Component
+ */
+
+struct dds_security_crypto_key_factory;
+typedef struct dds_security_crypto_key_factory dds_security_crypto_key_factory;
+
+struct dds_security_crypto_key_exchange;
+typedef struct dds_security_crypto_key_exchange dds_security_crypto_key_exchange;
+
+struct dds_security_crypto_transform;
+typedef struct dds_security_crypto_transform dds_security_crypto_transform;
+
+/**
+ * CryptoKeyFactory interface
+ */
+
+typedef DDS_Security_ParticipantCryptoHandle
+(*DDS_Security_crypto_key_factory_register_local_participant)
+        ( dds_security_crypto_key_factory *instance,
+          const DDS_Security_IdentityHandle participant_identity,
+          const DDS_Security_PermissionsHandle participant_permissions,
+          const DDS_Security_PropertySeq *participant_properties,
+          const DDS_Security_ParticipantSecurityAttributes *participant_security_attributes,
+          DDS_Security_SecurityException *ex);
+
+typedef DDS_Security_ParticipantCryptoHandle
+(*DDS_Security_crypto_key_factory_register_matched_remote_participant)
+        ( dds_security_crypto_key_factory *instance,
+          const DDS_Security_ParticipantCryptoHandle local_participant_crypto_handle,
+          const DDS_Security_IdentityHandle remote_participant_identity,
+          const DDS_Security_PermissionsHandle remote_participant_permissions,
+          const DDS_Security_SharedSecretHandle shared_secret,
+          DDS_Security_SecurityException *ex);
+
+
+typedef DDS_Security_DatawriterCryptoHandle
+(*DDS_Security_crypto_key_factory_register_local_datawriter)
+        ( dds_security_crypto_key_factory *instance,
+          const DDS_Security_ParticipantCryptoHandle participant_crypto,
+          const DDS_Security_PropertySeq *datawriter_properties,
+          const DDS_Security_EndpointSecurityAttributes *datawriter_security_attributes,
+          DDS_Security_SecurityException *ex);
+
+typedef DDS_Security_DatareaderCryptoHandle
+(*DDS_Security_crypto_key_factory_register_matched_remote_datareader)
+        ( dds_security_crypto_key_factory *instance,
+          const DDS_Security_DatawriterCryptoHandle local_datawriter_crypto_handle,
+          const DDS_Security_ParticipantCryptoHandle remote_participant_crypto,
+          const DDS_Security_SharedSecretHandle shared_secret,
+          const DDS_Security_boolean relay_only,
+          DDS_Security_SecurityException *ex);
+
+
+typedef DDS_Security_DatareaderCryptoHandle
+(*DDS_Security_crypto_key_factory_register_local_datareader)
+        ( dds_security_crypto_key_factory *instance,
+          const DDS_Security_ParticipantCryptoHandle participant_crypto_handle,
+          const DDS_Security_PropertySeq *datareader_properties,
+          const DDS_Security_EndpointSecurityAttributes *datareader_security_attributes,
+          DDS_Security_SecurityException *ex);
+
+typedef DDS_Security_DatawriterCryptoHandle
+(*DDS_Security_crypto_key_factory_register_matched_remote_datawriter)
+        ( dds_security_crypto_key_factory *instance,
+          const DDS_Security_DatareaderCryptoHandle local_datareader_crypto_handle,
+          const DDS_Security_ParticipantCryptoHandle remote_participant_crypt,
+          const DDS_Security_SharedSecretHandle shared_secret,
+          DDS_Security_SecurityException *ex);
+
+typedef DDS_Security_boolean
+(*DDS_Security_crypto_key_factory_unregister_participant)
+        ( dds_security_crypto_key_factory *instance,
+          const DDS_Security_ParticipantCryptoHandle participant_crypto_handle,
+          DDS_Security_SecurityException *ex);
+
+typedef DDS_Security_boolean
+(*DDS_Security_crypto_key_factory_unregister_datawriter)
+        ( dds_security_crypto_key_factory *instance,
+          const DDS_Security_DatawriterCryptoHandle datawriter_crypto_handle,
+          DDS_Security_SecurityException *ex);
+
+typedef DDS_Security_boolean
+(*DDS_Security_crypto_key_factory_unregister_datareader)
+        ( dds_security_crypto_key_factory *instance,
+          const DDS_Security_DatareaderCryptoHandle datareader_crypto_handle,
+          DDS_Security_SecurityException *ex);
+
+struct dds_security_crypto_key_factory
+{
+
+  DDS_Security_crypto_key_factory_register_local_participant register_local_participant;
+
+  DDS_Security_crypto_key_factory_register_matched_remote_participant register_matched_remote_participant;
+
+  DDS_Security_crypto_key_factory_register_local_datawriter register_local_datawriter;
+
+  DDS_Security_crypto_key_factory_register_matched_remote_datareader register_matched_remote_datareader;
+
+  DDS_Security_crypto_key_factory_register_local_datareader register_local_datareader;
+
+  DDS_Security_crypto_key_factory_register_matched_remote_datawriter register_matched_remote_datawriter;
+
+  DDS_Security_crypto_key_factory_unregister_participant unregister_participant;
+
+  DDS_Security_crypto_key_factory_unregister_datawriter unregister_datawriter;
+
+  DDS_Security_crypto_key_factory_unregister_datareader unregister_datareader;
+} ;
+
+
+/**
+ * CryptoKeyExchange Interface
+ */
+typedef DDS_Security_boolean
+(*DDS_Security_crypto_key_exchange_create_local_participant_crypto_tokens)
+        ( dds_security_crypto_key_exchange *instance,
+          DDS_Security_ParticipantCryptoTokenSeq *local_participant_crypto_tokens,
+          const DDS_Security_ParticipantCryptoHandle local_participant_crypto,
+          const DDS_Security_ParticipantCryptoHandle remote_participant_crypto,
+          DDS_Security_SecurityException *ex);
+
+typedef DDS_Security_boolean
+(*DDS_Security_crypto_key_exchange_set_remote_participant_crypto_tokens)
+        ( dds_security_crypto_key_exchange *instance,
+          const DDS_Security_ParticipantCryptoHandle local_participant_crypto,
+          const DDS_Security_ParticipantCryptoHandle remote_participant_crypto,
+          const DDS_Security_ParticipantCryptoTokenSeq *remote_participant_tokens,
+          DDS_Security_SecurityException *ex);
+
+typedef DDS_Security_boolean
+(*DDS_Security_crypto_key_exchange_create_local_datawriter_crypto_tokens)
+        ( dds_security_crypto_key_exchange *instance,
+          DDS_Security_DatawriterCryptoTokenSeq *local_datawriter_crypto_tokens,
+          const DDS_Security_DatawriterCryptoHandle local_datawriter_crypto,
+          const DDS_Security_DatareaderCryptoHandle remote_datareader_crypto,
+          DDS_Security_SecurityException *ex);
+
+typedef DDS_Security_boolean
+(*DDS_Security_crypto_key_exchange_set_remote_datawriter_crypto_tokens)
+        ( dds_security_crypto_key_exchange *instance,
+          const DDS_Security_DatareaderCryptoHandle local_datareader_crypto,
+          const DDS_Security_DatawriterCryptoHandle remote_datawriter_crypto,
+          const DDS_Security_DatawriterCryptoTokenSeq *remote_datawriter_tokens,
+          DDS_Security_SecurityException *ex);
+
+typedef DDS_Security_boolean
+(*DDS_Security_crypto_key_exchange_create_local_datareader_crypto_tokens)
+        ( dds_security_crypto_key_exchange *instance,
+          DDS_Security_DatareaderCryptoTokenSeq *local_datareader_cryto_tokens,
+          const DDS_Security_DatareaderCryptoHandle local_datareader_crypto,
+          const DDS_Security_DatawriterCryptoHandle remote_datawriter_crypto,
+          DDS_Security_SecurityException *ex);
+
+typedef DDS_Security_boolean
+(*DDS_Security_crypto_key_exchange_set_remote_datareader_crypto_tokens)
+        ( dds_security_crypto_key_exchange *instance,
+          const DDS_Security_DatawriterCryptoHandle local_datawriter_crypto,
+          const DDS_Security_DatareaderCryptoHandle remote_datareader_crypto,
+          const DDS_Security_DatareaderCryptoTokenSeq *remote_datareader_tokens,
+          DDS_Security_SecurityException *ex);
+
+typedef DDS_Security_boolean
+(*DDS_Security_crypto_key_exchange_return_crypto_tokens)
+        ( dds_security_crypto_key_exchange *instance,
+          DDS_Security_CryptoTokenSeq *crypto_tokens,
+          DDS_Security_SecurityException *ex);
+
+struct dds_security_crypto_key_exchange
+{
+  DDS_Security_crypto_key_exchange_create_local_participant_crypto_tokens create_local_participant_crypto_tokens;
+
+  DDS_Security_crypto_key_exchange_set_remote_participant_crypto_tokens set_remote_participant_crypto_tokens;
+
+  DDS_Security_crypto_key_exchange_create_local_datawriter_crypto_tokens create_local_datawriter_crypto_tokens;
+
+  DDS_Security_crypto_key_exchange_set_remote_datawriter_crypto_tokens set_remote_datawriter_crypto_tokens;
+
+  DDS_Security_crypto_key_exchange_create_local_datareader_crypto_tokens create_local_datareader_crypto_tokens;
+
+  DDS_Security_crypto_key_exchange_set_remote_datareader_crypto_tokens set_remote_datareader_crypto_tokens;
+
+  DDS_Security_crypto_key_exchange_return_crypto_tokens return_crypto_tokens;
+} ;
+
+
+/**
+ * CryptoTransform Interface
+ */
+
+typedef DDS_Security_boolean
+(*DDS_Security_crypto_transform_encode_serialized_payload)
+        ( dds_security_crypto_transform *instance,
+          DDS_Security_OctetSeq *encoded_buffer,
+          DDS_Security_OctetSeq *extra_inline_qos,
+          const DDS_Security_OctetSeq *plain_buffer,
+          const DDS_Security_DatawriterCryptoHandle sending_datawriter_crypto,
+          DDS_Security_SecurityException *ex);
+
+typedef DDS_Security_boolean
+(*DDS_Security_crypto_transform_encode_datawriter_submessage)
+        ( dds_security_crypto_transform *instance,
+          DDS_Security_OctetSeq *encoded_rtps_submessage,
+          const DDS_Security_OctetSeq *plain_rtps_submessage,
+          const DDS_Security_DatawriterCryptoHandle sending_datawriter_crypto,
+          const DDS_Security_DatareaderCryptoHandleSeq *receiving_datareader_crypto_list,
+          DDS_Security_long *receiving_datareader_crypto_list_index,
+          DDS_Security_SecurityException *ex);
+
+typedef DDS_Security_boolean
+(*DDS_Security_crypto_transform_encode_datareader_submessage)
+        ( dds_security_crypto_transform *instance,
+          DDS_Security_OctetSeq *encoded_rtps_submessage,
+          const DDS_Security_OctetSeq *plain_rtps_submessage,
+          const DDS_Security_DatareaderCryptoHandle sending_datareader_crypto,
+          const DDS_Security_DatawriterCryptoHandleSeq *receiving_datawriter_crypto_list,
+          DDS_Security_SecurityException *ex);
+
+
+typedef DDS_Security_boolean
+(*DDS_Security_crypto_transform_encode_rtps_message)
+        ( dds_security_crypto_transform *instance,
+          DDS_Security_OctetSeq *encoded_rtps_message,
+          const DDS_Security_OctetSeq *plain_rtps_message,
+          const DDS_Security_ParticipantCryptoHandle sending_participant_crypto,
+          const DDS_Security_ParticipantCryptoHandleSeq *receiving_participant_crypto_list,
+          DDS_Security_long *receiving_participant_crypto_list_index,
+          DDS_Security_SecurityException *ex);
+
+typedef DDS_Security_boolean
+(*DDS_Security_crypto_transform_decode_rtps_message)
+        ( dds_security_crypto_transform *instance,
+          DDS_Security_OctetSeq *plain_buffer,
+          const DDS_Security_OctetSeq *encoded_buffer,
+          const DDS_Security_ParticipantCryptoHandle receiving_participant_crypto,
+          const DDS_Security_ParticipantCryptoHandle sending_participant_crypto,
+          DDS_Security_SecurityException *ex);
+
+typedef DDS_Security_boolean
+(*DDS_Security_crypto_transform_preprocess_secure_submsg)
+        ( dds_security_crypto_transform *instance,
+          DDS_Security_DatawriterCryptoHandle *datawriter_crypto,
+          DDS_Security_DatareaderCryptoHandle *datareader_crypto,
+          DDS_Security_SecureSubmessageCategory_t *secure_submessage_category,
+          const DDS_Security_OctetSeq *encoded_rtps_submessage,
+          const DDS_Security_ParticipantCryptoHandle receiving_participant_crypto,
+          const DDS_Security_ParticipantCryptoHandle sending_participant_crypto,
+          DDS_Security_SecurityException *ex);
+
+typedef DDS_Security_boolean
+(*DDS_Security_crypto_transform_decode_datawriter_submessage)
+        ( dds_security_crypto_transform *instance,
+          DDS_Security_OctetSeq *plain_rtps_submessage,
+          const DDS_Security_OctetSeq *encoded_rtps_submessage,
+          const DDS_Security_DatareaderCryptoHandle receiving_datareader_crypto,
+          const DDS_Security_DatawriterCryptoHandle sending_datawriter_crypto,
+          DDS_Security_SecurityException *ex);
+
+typedef DDS_Security_boolean
+(*DDS_Security_crypto_transform_decode_datareader_submessage)
+        ( dds_security_crypto_transform *instance,
+          DDS_Security_OctetSeq *plain_rtps_message,
+          const DDS_Security_OctetSeq *encoded_rtps_message,
+          const DDS_Security_DatawriterCryptoHandle receiving_datawriter_crypto,
+          const DDS_Security_DatareaderCryptoHandle sending_datareader_crypto,
+          DDS_Security_SecurityException *ex);
+
+
+typedef DDS_Security_boolean
+(*DDS_Security_crypto_transform_decode_serialized_payload)
+        ( dds_security_crypto_transform *instance,
+          DDS_Security_OctetSeq *plain_buffer,
+          const DDS_Security_OctetSeq *encoded_buffer,
+          const DDS_Security_OctetSeq *inline_qos,
+          const DDS_Security_DatareaderCryptoHandle receiving_datareader_crypto,
+          const DDS_Security_DatawriterCryptoHandle sending_datawriter_crypto,
+          DDS_Security_SecurityException *ex);
+
+
+struct dds_security_crypto_transform
+{
+  DDS_Security_crypto_transform_encode_serialized_payload encode_serialized_payload;
+
+  DDS_Security_crypto_transform_encode_datawriter_submessage encode_datawriter_submessage;
+
+  DDS_Security_crypto_transform_encode_datareader_submessage encode_datareader_submessage;
+
+  DDS_Security_crypto_transform_encode_rtps_message encode_rtps_message;
+
+  DDS_Security_crypto_transform_decode_rtps_message decode_rtps_message;
+
+  DDS_Security_crypto_transform_preprocess_secure_submsg preprocess_secure_submsg;
+
+  DDS_Security_crypto_transform_decode_datawriter_submessage decode_datawriter_submessage;
+
+  DDS_Security_crypto_transform_decode_datareader_submessage decode_datareader_submessage;
+
+  DDS_Security_crypto_transform_decode_serialized_payload decode_serialized_payload;
+} ;
+
+
+
+
+typedef struct dds_security_cryptography
+{
+    dds_security_crypto_transform *crypto_transform;
+    dds_security_crypto_key_factory *crypto_key_factory;
+    dds_security_crypto_key_exchange *crypto_key_exchange;
+} dds_security_cryptography;
+
+
+#if defined (__cplusplus)
+}
+#endif
+
+#endif /* DDS_SECURITY_API_CRYPTOGRAPHY_H */
diff --git a/src/security/api/include/dds/security/dds_security_api_defs.h b/src/security/api/include/dds/security/dds_security_api_defs.h
new file mode 100644
index 0000000..82baa98
--- /dev/null
+++ b/src/security/api/include/dds/security/dds_security_api_defs.h
@@ -0,0 +1,189 @@
+/*
+ * Copyright(c) 2006 to 2018 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+
+#ifndef DDS_SECURITY_API_DEF_H
+#define DDS_SECURITY_API_DEF_H
+
+#include "dds_security_api_err.h"
+
+#if defined (__cplusplus)
+extern "C" {
+#endif
+
+
+
+/**************************************************************************
+ *                                                                        *
+ * Return values.                                                         *
+ *                                                                        *
+ **************************************************************************/
+typedef enum {
+    DDS_SECURITY_VALIDATION_OK,
+    DDS_SECURITY_VALIDATION_FAILED,
+    DDS_SECURITY_VALIDATION_PENDING_RETRY,
+    DDS_SECURITY_VALIDATION_PENDING_HANDSHAKE_REQUEST,
+    DDS_SECURITY_VALIDATION_PENDING_HANDSHAKE_MESSAGE,
+    DDS_SECURITY_VALIDATION_OK_FINAL_MESSAGE
+} DDS_Security_ValidationResult_t;
+
+#define DDS_SECURITY_HANDLE_NIL (0)
+
+
+
+
+/**************************************************************************
+ *                                                                        *
+ * Attribute flags.                                                       *
+ *                                                                        *
+ **************************************************************************/
+#define DDS_SECURITY_PARTICIPANT_ATTRIBUTES_FLAG_IS_RTPS_PROTECTED                      (0x00000001      )
+#define DDS_SECURITY_PARTICIPANT_ATTRIBUTES_FLAG_IS_DISCOVERY_PROTECTED                 (0x00000001 <<  1)
+#define DDS_SECURITY_PARTICIPANT_ATTRIBUTES_FLAG_IS_LIVELINESS_PROTECTED                (0x00000001 <<  2)
+#define DDS_SECURITY_PARTICIPANT_ATTRIBUTES_FLAG_IS_VALID                               (0x00000001 << 31)
+
+#define DDS_SECURITY_PLUGIN_PARTICIPANT_ATTRIBUTES_FLAG_IS_RTPS_ENCRYPTED               (0x00000001      )
+#define DDS_SECURITY_PLUGIN_PARTICIPANT_ATTRIBUTES_FLAG_IS_DISCOVERY_ENCRYPTED          (0x00000001 <<  1)
+#define DDS_SECURITY_PLUGIN_PARTICIPANT_ATTRIBUTES_FLAG_IS_LIVELINESS_ENCRYPTED         (0x00000001 <<  2)
+#define DDS_SECURITY_PLUGIN_PARTICIPANT_ATTRIBUTES_FLAG_IS_RTPS_AUTHENTICATED           (0x00000001 <<  3)
+#define DDS_SECURITY_PLUGIN_PARTICIPANT_ATTRIBUTES_FLAG_IS_DISCOVERY_AUTHENTICATED      (0x00000001 <<  4)
+#define DDS_SECURITY_PLUGIN_PARTICIPANT_ATTRIBUTES_FLAG_IS_LIVELINESS_AUTHENTICATED     (0x00000001 <<  5)
+
+#define DDS_SECURITY_ENDPOINT_ATTRIBUTES_FLAG_IS_READ_PROTECTED                         (0x00000001      )
+#define DDS_SECURITY_ENDPOINT_ATTRIBUTES_FLAG_IS_WRITE_PROTECTED                        (0x00000001 <<  1)
+#define DDS_SECURITY_ENDPOINT_ATTRIBUTES_FLAG_IS_DISCOVERY_PROTECTED                    (0x00000001 <<  2)
+#define DDS_SECURITY_ENDPOINT_ATTRIBUTES_FLAG_IS_SUBMESSAGE_PROTECTED                   (0x00000001 <<  3)
+#define DDS_SECURITY_ENDPOINT_ATTRIBUTES_FLAG_IS_PAYLOAD_PROTECTED                      (0x00000001 <<  4)
+#define DDS_SECURITY_ENDPOINT_ATTRIBUTES_FLAG_IS_KEY_PROTECTED                          (0x00000001 <<  5)
+#define DDS_SECURITY_ENDPOINT_ATTRIBUTES_FLAG_IS_LIVELINESS_PROTECTED                   (0x00000001 <<  6)
+#define DDS_SECURITY_ENDPOINT_ATTRIBUTES_FLAG_IS_VALID                                  (0x00000001 << 31)
+
+#define DDS_SECURITY_PLUGIN_ENDPOINT_ATTRIBUTES_FLAG_IS_SUBMESSAGE_ENCRYPTED            (0x00000001      )
+#define DDS_SECURITY_PLUGIN_ENDPOINT_ATTRIBUTES_FLAG_IS_PAYLOAD_ENCRYPTED               (0x00000001 <<  1)
+#define DDS_SECURITY_PLUGIN_ENDPOINT_ATTRIBUTES_FLAG_IS_SUBMESSAGE_ORIGIN_AUTHENTICATED (0x00000001 <<  2)
+
+
+
+
+/**************************************************************************
+ *                                                                        *
+ * Protection types.                                                      *
+ *                                                                        *
+ **************************************************************************/
+typedef enum {
+    DDS_SECURITY_PROTECTION_KIND_ENCRYPT_WITH_ORIGIN_AUTHENTICATION,
+    DDS_SECURITY_PROTECTION_KIND_SIGN_WITH_ORIGIN_AUTHENTICATION,
+    DDS_SECURITY_PROTECTION_KIND_ENCRYPT,
+    DDS_SECURITY_PROTECTION_KIND_SIGN,
+    DDS_SECURITY_PROTECTION_KIND_NONE
+} DDS_Security_ProtectionKind;
+
+typedef enum {
+    DDS_SECURITY_BASICPROTECTION_KIND_ENCRYPT,
+    DDS_SECURITY_BASICPROTECTION_KIND_SIGN,
+    DDS_SECURITY_BASICPROTECTION_KIND_NONE
+} DDS_Security_BasicProtectionKind;
+
+
+
+
+/**************************************************************************
+ *                                                                        *
+ * Submessage categories.                                                 *
+ *                                                                        *
+ **************************************************************************/
+typedef enum {
+    DDS_SECURITY_INFO_SUBMESSAGE,
+    DDS_SECURITY_DATAWRITER_SUBMESSAGE,
+    DDS_SECURITY_DATAREADER_SUBMESSAGE
+} DDS_Security_SecureSubmessageCategory_t;
+
+
+
+
+/**************************************************************************
+ *                                                                        *
+ * QoS Policies content.                                                  *
+ *                                                                        *
+ **************************************************************************/
+typedef enum {
+    DDS_SECURITY_AUTOMATIC_LIVELINESS_QOS,
+    DDS_SECURITY_MANUAL_BY_PARTICIPANT_LIVELINESS_QOS,
+    DDS_SECURITY_MANUAL_BY_TOPIC_LIVELINESS_QOS
+} DDS_Security_LivelinessQosPolicyKind;
+
+typedef enum {
+    DDS_SECURITY_BEST_EFFORT_RELIABILITY_QOS,
+    DDS_SECURITY_RELIABLE_RELIABILITY_QOS
+} DDS_Security_ReliabilityQosPolicyKind;
+
+typedef enum  {
+    DDS_SECURITY_BY_RECEPTION_TIMESTAMP_DESTINATIONORDER_QOS,
+    DDS_SECURITY_BY_SOURCE_TIMESTAMP_DESTINATIONORDER_QOS
+} DDS_Security_DestinationOrderQosPolicyKind;
+
+typedef enum {
+    DDS_SECURITY_INSTANCE_PRESENTATION_QOS,
+    DDS_SECURITY_TOPIC_PRESENTATION_QOS,
+    DDS_SECURITY_GROUP_PRESENTATION_QOS
+} DDS_Security_PresentationQosPolicyAccessScopeKind;
+
+typedef enum {
+    DDS_SECURITY_KEEP_LAST_HISTORY_QOS,
+    DDS_SECURITY_KEEP_ALL_HISTORY_QOS
+} DDS_Security_HistoryQosPolicyKind;
+
+typedef enum {
+    DDS_SECURITY_VOLATILE_DURABILITY_QOS,
+    DDS_SECURITY_TRANSIENT_LOCAL_DURABILITY_QOS,
+    DDS_SECURITY_TRANSIENT_DURABILITY_QOS,
+    DDS_SECURITY_PERSISTENT_DURABILITY_QOS
+} DDS_Security_DurabilityQosPolicyKind;
+
+typedef enum {
+    DDS_SECURITY_SHARED_OWNERSHIP_QOS,
+    DDS_SECURITY_EXCLUSIVE_OWNERSHIP_QOS
+} DDS_Security_OwnershipQosPolicyKind;
+
+
+
+
+/**************************************************************************
+ *                                                                        *
+ * Listener information.                                                  *
+ *                                                                        *
+ **************************************************************************/
+typedef enum {
+    DDS_SECURITY_IDENTITY_STATUS
+} DDS_Security_AuthStatusKind;
+
+
+
+
+/**************************************************************************
+ *                                                                        *
+ * Some byte array sizes.                                                 *
+ *                                                                        *
+ **************************************************************************/
+#define DDS_SECURITY_AUTHENTICATION_CHALLENGE_SIZE 32
+
+#define DDS_SECURITY_MASTER_SALT_SIZE 32
+#define DDS_SECURITY_MASTER_SENDER_KEY_SIZE 32
+#define DDS_SECURITY_MASTER_RECEIVER_SPECIFIC_KEY_SIZE 32
+
+
+
+#if defined (__cplusplus)
+}
+#endif
+
+
+#endif /* DDS_SECURITY_API_DEF_H */
diff --git a/src/security/api/include/dds/security/dds_security_api_err.h b/src/security/api/include/dds/security/dds_security_api_err.h
new file mode 100644
index 0000000..8795a44
--- /dev/null
+++ b/src/security/api/include/dds/security/dds_security_api_err.h
@@ -0,0 +1,121 @@
+/*
+ * Copyright(c) 2006 to 2018 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+
+#ifndef DDS_SECURITY_API_ERR_H
+#define DDS_SECURITY_API_ERR_H
+
+
+#if defined (__cplusplus)
+extern "C" {
+#endif
+
+
+#define DDS_SECURITY_ERR_OK_CODE 0
+#define DDS_SECURITY_ERR_OK_MESSAGE "OK"
+#define DDS_SECURITY_ERR_CANNOT_GENERATE_RANDOM_CODE 100
+#define DDS_SECURITY_ERR_CANNOT_GENERATE_RANDOM_MESSAGE "Can not generate random data"
+#define DDS_SECURITY_ERR_IDENTITY_EMPTY_CODE 110
+#define DDS_SECURITY_ERR_IDENTITY_EMPTY_MESSAGE "Identity empty"
+#define DDS_SECURITY_ERR_PARTICIPANT_CRYPTO_HANDLE_EMPTY_CODE 111
+#define DDS_SECURITY_ERR_PARTICIPANT_CRYPTO_HANDLE_EMPTY_MESSAGE "Participant Crypto Handle empty"
+#define DDS_SECURITY_ERR_PERMISSION_HANDLE_EMPTY_CODE 112
+#define DDS_SECURITY_ERR_PERMISSION_HANDLE_EMPTY_MESSAGE "Permission Handle empty"
+#define DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_CODE 113
+#define DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_MESSAGE "Invalid Crypto Handle"
+#define DDS_SECURITY_ERR_INVALID_CRYPTO_ARGUMENT_CODE 114
+#define DDS_SECURITY_ERR_INVALID_CRYPTO_ARGUMENT_MESSAGE "Invalid argument"
+#define DDS_SECURITY_ERR_INVALID_CRYPTO_TOKEN_CODE 115
+#define DDS_SECURITY_ERR_INVALID_CRYPTO_TOKEN_MESSAGE "Invalid Crypto token"
+#define DDS_SECURITY_ERR_INVALID_PARAMETER_CODE 116
+#define DDS_SECURITY_ERR_INVALID_PARAMETER_MESSAGE "Invalid parameter"
+#define DDS_SECURITY_ERR_INVALID_FILE_PATH_CODE 117
+#define DDS_SECURITY_ERR_INVALID_FILE_PATH_MESSAGE "File could not be found, opened or is empty, path: %s"
+#define DDS_SECURITY_ERR_INVALID_CRYPTO_TRANSFORMATION_CODE 118
+#define DDS_SECURITY_ERR_INVALID_CRYPTO_TRANSFORMATION_MESSAGE "Unknown or unexpected transformation kind"
+#define DDS_SECURITY_ERR_INVALID_CRYPTO_SIGN_CODE 119
+#define DDS_SECURITY_ERR_INVALID_CRYPTO_SIGN_MESSAGE "Message cannot be authenticated, incorrect signature"
+#define DDS_SECURITY_ERR_INVALID_TRUSTED_CA_DIR_CODE 120
+#define DDS_SECURITY_ERR_INVALID_TRUSTED_CA_DIR_MESSAGE "Can not open trusted CA directory"
+#define DDS_SECURITY_ERR_CA_NOT_TRUSTED_CODE 121
+#define DDS_SECURITY_ERR_CA_NOT_TRUSTED_MESSAGE "Identity CA is not trusted"
+#define DDS_SECURITY_ERR_CERT_STARTDATE_INVALID_CODE 122
+#define DDS_SECURITY_ERR_CERT_STARTDATE_INVALID_MESSAGE "Certificate start date is in the future"
+#define DDS_SECURITY_ERR_CERT_EXPIRED_CODE 123
+#define DDS_SECURITY_ERR_CERT_EXPIRED_MESSAGE "Certificate expired"
+#define DDS_SECURITY_ERR_INVALID_CRYPTO_RECEIVER_SIGN_CODE 124
+#define DDS_SECURITY_ERR_CERT_AUTHENTICATION_ALGO_KIND_UNKNOWN_CODE 125
+#define DDS_SECURITY_ERR_CERT_AUTHENTICATION_ALGO_KIND_UNKNOWN_MESSAGE "Certificate authentication algorithm unknown"
+#define DDS_SECURITY_ERR_ALLOCATION_FAILED_CODE 126
+#define DDS_SECURITY_ERR_ALLOCATION_FAILED_MESSAGE "Failed to allocate internal structure"
+#define DDS_SECURITY_ERR_INVALID_SMIME_DOCUMENT_CODE 127
+#define DDS_SECURITY_ERR_INVALID_SMIME_DOCUMENT_MESSAGE "Failed to parse PKCS7 SMIME document"
+#define DDS_SECURITY_ERR_MISSING_PROPERTY_CODE 128
+#define DDS_SECURITY_ERR_MISSING_PROPERTY_MESSAGE "Property is missing: (%s)"
+#define DDS_SECURITY_ERR_INVALID_PERMISSION_DOCUMENT_PROPERTY_CODE 129
+#define DDS_SECURITY_ERR_INVALID_PERMISSION_DOCUMENT_PROPERTY_MESSAGE "Permissions document is invalid"
+#define DDS_SECURITY_ERR_INVALID_GOVERNANCE_DOCUMENT_PROPERTY_CODE 130
+#define DDS_SECURITY_ERR_INVALID_GOVERNANCE_DOCUMENT_PROPERTY_MESSAGE "Governance document is invalid"
+#define DDS_SECURITY_ERR_OPERATION_NOT_PERMITTED_CODE 131
+#define DDS_SECURITY_ERR_OPERATION_NOT_PERMITTED_MESSAGE "Operation is not permitted in this state"
+#define DDS_SECURITY_ERR_MISSING_REMOTE_PERMISSIONS_DOCUMENT_CODE 132
+#define DDS_SECURITY_ERR_MISSING_REMOTE_PERMISSIONS_DOCUMENT_MESSAGE "Remote permissions document is not available"
+#define DDS_SECURITY_ERR_INVALID_CERTIFICATE_CODE 133
+#define DDS_SECURITY_ERR_INVALID_CERTICICATE_MESSAGE "Certificate is invalid"
+#define DDS_SECURITY_ERR_CERTIFICATE_TYPE_NOT_SUPPORTED_CODE 134
+#define DDS_SECURITY_ERR_CERTIFICATE_TYPE_NOT_SUPPORTED_MESSAGE "Certificate type is not supported"
+#define DDS_SECURITY_ERR_GOVERNANCE_PROPERTY_REQUIRED_CODE 135
+#define DDS_SECURITY_ERR_GOVERNANCE_PROPERTY_REQUIRED_MESSAGE "Governance property is required"
+#define DDS_SECURITY_ERR_PERMISSIONS_CA_PROPERTY_REQUIRED_CODE 136
+#define DDS_SECURITY_ERR_PERMISSIONS_CA_PROPERTY_REQUIRED_MESSAGE "Permissions CA property is required"
+#define DDS_SECURITY_ERR_CAN_NOT_PARSE_GOVERNANCE_CODE 137
+#define DDS_SECURITY_ERR_CAN_NOT_PARSE_GOVERNANCE_MESSAGE "Can not parse governance file"
+#define DDS_SECURITY_ERR_CAN_NOT_PARSE_PERMISSIONS_CODE 138
+#define DDS_SECURITY_ERR_CAN_NOT_PARSE_PERMISSIONS_MESSAGE "Can not parse permissions file"
+#define DDS_SECURITY_ERR_CAN_NOT_FIND_TOPIC_PERMISSIONS_CODE 139
+#define DDS_SECURITY_ERR_CAN_NOT_FIND_TOPIC_PERMISSIONS_MESSAGE "Could not find permissions for topic"
+#define DDS_SECURITY_ERR_CAN_NOT_FIND_DOMAIN_IN_PERMISSIONS_CODE 140
+#define DDS_SECURITY_ERR_CAN_NOT_FIND_DOMAIN_IN_PERMISSIONS_MESSAGE "Could not find domain %d in permissions"
+#define DDS_SECURITY_ERR_CAN_NOT_FIND_DOMAIN_IN_GOVERNANCE_CODE 141
+#define DDS_SECURITY_ERR_CAN_NOT_FIND_DOMAIN_IN_GOVERNANCE_MESSAGE "Could not find domain %d in governance"
+#define DDS_SECURITY_ERR_CAN_NOT_FIND_TOPIC_IN_DOMAIN_CODE 142
+#define DDS_SECURITY_ERR_CAN_NOT_FIND_TOPIC_IN_DOMAIN_MESSAGE "Could not find %s topic attributes for domain(%d) in governance"
+#define DDS_SECURITY_ERR_INCOMPATIBLE_REMOTE_PLUGIN_CLASSNAME_CODE 143
+#define DDS_SECURITY_ERR_INCOMPATIBLE_REMOTE_PLUGIN_CLASSNAME_MESSAGE "PluginClass in remote token is incompatible"
+#define DDS_SECURITY_ERR_INCOMPATIBLE_REMOTE_PLUGIN_MAJORVERSION_CODE 144
+#define DDS_SECURITY_ERR_INCOMPATIBLE_REMOTE_PLUGIN_MAJORVERSION_MESSAGE "MajorVersion in remote token is incompatible"
+#define DDS_SECURITY_ERR_ACCESS_DENIED_CODE 145
+#define DDS_SECURITY_ERR_ACCESS_DENIED_MESSAGE "Access denied by access control"
+#define DDS_SECURITY_ERR_INVALID_SUBJECT_NAME_CODE 146
+#define DDS_SECURITY_ERR_INVALID_SUBJECT_NAME_MESSAGE "Subject name is invalid"
+#define DDS_SECURITY_ERR_VALIDITY_PERIOD_EXPIRED_CODE 147
+#define DDS_SECURITY_ERR_VALIDITY_PERIOD_EXPIRED_MESSAGE "Permissions validity period expired for %s"
+#define DDS_SECURITY_ERR_VALIDITY_PERIOD_NOT_STARTED_CODE 148
+#define DDS_SECURITY_ERR_VALIDITY_PERIOD_NOT_STARTED_MESSAGE "Permissions validity period has not started yet for %s"
+#define DDS_SECURITY_ERR_CAN_NOT_FIND_PERMISSIONS_GRANT_CODE 149
+#define DDS_SECURITY_ERR_CAN_NOT_FIND_PERMISSIONS_GRANT_MESSAGE "Could not find valid grant in permissions"
+#define DDS_SECURITY_ERR_PERMISSIONS_OUT_OF_VALIDITY_DATE_CODE 150
+#define DDS_SECURITY_ERR_PERMISSIONS_OUT_OF_VALIDITY_DATE_MESSAGE "Permissions of subject (%s) outside validity date: %s - %s"
+#define DDS_SECURITY_ERR_URI_TYPE_NOT_SUPPORTED_CODE 151
+#define DDS_SECURITY_ERR_URI_TYPE_NOT_SUPPORTED_MESSAGE "Unsupported URI type: %s"
+
+#define DDS_SECURITY_ERR_UNDEFINED_CODE 200
+#define DDS_SECURITY_ERR_UNDEFINED_MESSAGE "Undefined Error Message"
+
+
+#define DDS_SECURITY_ERR_CIPHER_ERROR 301
+
+#if defined (__cplusplus)
+}
+#endif
+
+#endif /* DDS_SECURITY_API_ERR_H */
+
diff --git a/src/security/api/include/dds/security/dds_security_api_types.h b/src/security/api/include/dds/security/dds_security_api_types.h
new file mode 100644
index 0000000..4e669b4
--- /dev/null
+++ b/src/security/api/include/dds/security/dds_security_api_types.h
@@ -0,0 +1,489 @@
+/*
+ * Copyright(c) 2006 to 2018 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+
+#ifndef DDS_SECURITY_API_TYPES_H
+#define DDS_SECURITY_API_TYPES_H
+
+#include "dds_security_api_defs.h"
+#include "stdint.h"
+
+#if defined (__cplusplus)
+extern "C" {
+#endif
+
+
+
+/**************************************************************************
+ *                                                                        *
+ * Primitive types.                                                       *
+ *                                                                        *
+ **************************************************************************/
+typedef int16_t                 DDS_Security_short;
+typedef int32_t                 DDS_Security_long;
+typedef int64_t                 DDS_Security_long_long;
+typedef uint16_t                DDS_Security_unsigned_short;
+typedef uint32_t                DDS_Security_unsigned_long;
+typedef uint64_t                DDS_Security_unsigned_long_long;
+typedef float                   DDS_Security_float;
+typedef double                  DDS_Security_double;
+typedef long double             DDS_Security_long_double;
+typedef char                    DDS_Security_char;
+typedef unsigned char           DDS_Security_octet;
+typedef unsigned char           DDS_Security_boolean;
+typedef DDS_Security_char *     DDS_Security_string;
+typedef void *                  DDS_Security_Object;
+
+/* Sequences */
+typedef struct {
+    DDS_Security_unsigned_long _maximum;
+    DDS_Security_unsigned_long _length;
+    DDS_Security_octet *_buffer;
+} DDS_Security_OctetSeq;
+
+typedef struct {
+    DDS_Security_unsigned_long _maximum;
+    DDS_Security_unsigned_long _length;
+    DDS_Security_string *_buffer;
+} DDS_Security_StringSeq;
+
+typedef struct {
+    DDS_Security_unsigned_long _maximum;
+    DDS_Security_unsigned_long _length;
+    DDS_Security_long_long *_buffer;
+} DDS_Security_LongLongSeq;
+
+
+
+
+/**************************************************************************
+ *                                                                        *
+ * Simple types.                                                          *
+ *                                                                        *
+ **************************************************************************/
+typedef DDS_Security_long_long DDS_Security_IdentityHandle;
+typedef DDS_Security_long_long DDS_Security_InstanceHandle;
+typedef DDS_Security_long_long DDS_Security_HandshakeHandle;
+typedef DDS_Security_long_long DDS_Security_SharedSecretHandle;
+typedef DDS_Security_long_long DDS_Security_PermissionsHandle;
+typedef DDS_Security_long_long DDS_Security_ParticipantCryptoHandle;
+typedef DDS_Security_long_long DDS_Security_DatawriterCryptoHandle;
+typedef DDS_Security_long_long DDS_Security_DatareaderCryptoHandle;
+
+typedef DDS_Security_long DDS_Security_DynamicData;
+
+typedef DDS_Security_long DDS_Security_DomainId;  /* Valid values 0 <= id <= 230 */
+
+typedef DDS_Security_long DDS_Security_Entity;
+
+typedef DDS_Security_unsigned_long DDS_Security_BuiltinTopicKey_t[3];
+
+typedef DDS_Security_octet DDS_Security_GuidPrefix_t[12];
+
+/* Sequences */
+typedef DDS_Security_LongLongSeq DDS_Security_ParticipantCryptoHandleSeq;
+typedef DDS_Security_LongLongSeq DDS_Security_DatawriterCryptoHandleSeq;
+typedef DDS_Security_LongLongSeq DDS_Security_DatareaderCryptoHandleSeq;
+
+
+
+
+/**************************************************************************
+ *                                                                        *
+ * Simple structures.                                                     *
+ *                                                                        *
+ **************************************************************************/
+typedef struct  {
+    DDS_Security_string message;
+    DDS_Security_long code;
+    DDS_Security_long minor_code;
+} DDS_Security_SecurityException;
+
+typedef struct {
+    DDS_Security_octet entityKey[3];
+    DDS_Security_octet entityKind;
+} DDS_Security_EntityId_t;
+
+typedef struct {
+    DDS_Security_GuidPrefix_t prefix;
+    DDS_Security_EntityId_t entityId;
+} DDS_Security_GUID_t;
+
+typedef struct  {
+    DDS_Security_long sec;
+    DDS_Security_unsigned_long nanosec;
+} DDS_Security_Duration_t;
+
+
+
+
+/**************************************************************************
+ *                                                                        *
+ * Properties.                                                            *
+ *                                                                        *
+ **************************************************************************/
+typedef struct {
+    DDS_Security_string name;
+    DDS_Security_string value;
+    DDS_Security_boolean propagate;
+} DDS_Security_Property_t;
+
+typedef struct {
+    DDS_Security_unsigned_long _maximum;
+    DDS_Security_unsigned_long _length;
+    DDS_Security_Property_t *_buffer;
+} DDS_Security_PropertySeq;
+
+typedef struct {
+    DDS_Security_string name;
+    DDS_Security_OctetSeq value;
+    DDS_Security_boolean propagate;
+} DDS_Security_BinaryProperty_t;
+
+typedef struct {
+    DDS_Security_unsigned_long _maximum;
+    DDS_Security_unsigned_long _length;
+    DDS_Security_BinaryProperty_t *_buffer;
+} DDS_Security_BinaryPropertySeq;
+
+
+
+
+/**************************************************************************
+ *                                                                        *
+ * DataTags.                                                              *
+ *                                                                        *
+ **************************************************************************/
+typedef struct {
+    DDS_Security_string name;
+    DDS_Security_string value;
+} DDS_Security_Tag;
+
+typedef struct {
+    DDS_Security_unsigned_long _maximum;
+    DDS_Security_unsigned_long _length;
+    DDS_Security_Tag *_buffer;
+} DDS_Security_TagSeq;
+
+typedef struct {
+    DDS_Security_TagSeq tags;
+} DDS_Security_DataTags;
+
+
+
+
+/**************************************************************************
+ *                                                                        *
+ * Attributes.                                                            *
+ *                                                                        *
+ **************************************************************************/
+typedef DDS_Security_unsigned_long DDS_Security_EndpointSecurityAttributesMask;
+typedef DDS_Security_unsigned_long DDS_Security_PluginEndpointSecurityAttributesMask;
+
+typedef DDS_Security_unsigned_long DDS_Security_ParticipantSecurityAttributesMask;
+typedef DDS_Security_unsigned_long DDS_Security_PluginParticipantSecurityAttributesMask;
+
+typedef struct {
+    DDS_Security_boolean allow_unauthenticated_participants;
+    DDS_Security_boolean is_access_protected;
+    DDS_Security_boolean is_rtps_protected;
+    DDS_Security_boolean is_discovery_protected;
+    DDS_Security_boolean is_liveliness_protected;
+    DDS_Security_ParticipantSecurityAttributesMask plugin_participant_attributes;
+    DDS_Security_PropertySeq ac_endpoint_properties;
+} DDS_Security_ParticipantSecurityAttributes;
+
+typedef struct {
+    DDS_Security_boolean is_read_protected;
+    DDS_Security_boolean is_write_protected;
+    DDS_Security_boolean is_discovery_protected;
+    DDS_Security_boolean is_liveliness_protected;
+} DDS_Security_TopicSecurityAttributes;
+
+typedef struct {
+    DDS_Security_boolean is_read_protected;
+    DDS_Security_boolean is_write_protected;
+    DDS_Security_boolean is_discovery_protected;
+    DDS_Security_boolean is_liveliness_protected;
+    DDS_Security_boolean is_submessage_protected;
+    DDS_Security_boolean is_payload_protected;
+    DDS_Security_boolean is_key_protected;
+    DDS_Security_PluginEndpointSecurityAttributesMask plugin_endpoint_attributes;
+    DDS_Security_PropertySeq ac_endpoint_properties;
+} DDS_Security_EndpointSecurityAttributes;
+
+typedef struct {
+    DDS_Security_ParticipantSecurityAttributesMask participant_security_attributes;
+    DDS_Security_PluginParticipantSecurityAttributesMask plugin_participant_security_attributes;
+} DDS_Security_ParticipantSecurityInfo;
+
+typedef struct {
+    DDS_Security_EndpointSecurityAttributesMask endpoint_security_mask;
+    DDS_Security_PluginEndpointSecurityAttributesMask plugin_endpoint_security_mask;
+} DDS_Security_EndpointSecurityInfo;
+
+
+
+
+/**************************************************************************
+ *                                                                        *
+ * Tokens.                                                                *
+ *                                                                        *
+ **************************************************************************/
+typedef struct {
+    DDS_Security_string class_id;
+    DDS_Security_PropertySeq properties;
+    DDS_Security_BinaryPropertySeq binary_properties;
+} DDS_Security_DataHolder;
+
+typedef struct {
+    DDS_Security_unsigned_long _maximum;
+    DDS_Security_unsigned_long _length;
+    DDS_Security_DataHolder *_buffer;
+} DDS_Security_DataHolderSeq;
+
+typedef DDS_Security_DataHolder DDS_Security_Token;
+typedef DDS_Security_DataHolder DDS_Security_MessageToken;
+typedef DDS_Security_DataHolder DDS_Security_IdentityToken;
+typedef DDS_Security_DataHolder DDS_Security_PermissionsToken;
+typedef DDS_Security_DataHolder DDS_Security_IdentityStatusToken;
+typedef DDS_Security_DataHolder DDS_Security_AuthRequestMessageToken;
+typedef DDS_Security_DataHolder DDS_Security_HandshakeMessageToken;
+typedef DDS_Security_DataHolder DDS_Security_AuthenticatedPeerCredentialToken;
+typedef DDS_Security_DataHolder DDS_Security_PermissionsCredentialToken;
+typedef DDS_Security_DataHolder DDS_Security_CryptoToken;
+typedef DDS_Security_DataHolder DDS_Security_ParticipantCryptoToken;
+typedef DDS_Security_DataHolder DDS_Security_DatawriterCryptoToken;
+typedef DDS_Security_DataHolder DDS_Security_DatareaderCryptoToken;
+
+typedef DDS_Security_DataHolderSeq DDS_Security_CryptoTokenSeq;
+
+typedef DDS_Security_CryptoTokenSeq DDS_Security_ParticipantCryptoTokenSeq;
+typedef DDS_Security_CryptoTokenSeq DDS_Security_DatareaderCryptoTokenSeq;
+typedef DDS_Security_CryptoTokenSeq DDS_Security_DatawriterCryptoTokenSeq;
+
+
+
+
+/**************************************************************************
+ *                                                                        *
+ * Policies.                                                              *
+ *                                                                        *
+ **************************************************************************/
+typedef DDS_Security_DataTags DDS_Security_DataTagQosPolicy;
+
+typedef struct {
+    DDS_Security_PropertySeq value;
+    DDS_Security_BinaryPropertySeq binary_value;
+} DDS_Security_PropertyQosPolicy;
+
+typedef struct  {
+     DDS_Security_DurabilityQosPolicyKind kind;
+} DDS_Security_DurabilityQosPolicy;
+
+typedef struct {
+    DDS_Security_Duration_t period;
+} DDS_Security_DeadlineQosPolicy;
+
+typedef struct {
+    DDS_Security_Duration_t duration;
+} DDS_Security_LatencyBudgetQosPolicy;
+
+typedef struct {
+    DDS_Security_OwnershipQosPolicyKind kind;
+} DDS_Security_OwnershipQosPolicy;
+
+typedef struct {
+    DDS_Security_LivelinessQosPolicyKind kind;
+    DDS_Security_Duration_t lease_duration;
+} DDS_Security_LivelinessQosPolicy;
+
+typedef struct {
+    DDS_Security_ReliabilityQosPolicyKind kind;
+    DDS_Security_Duration_t max_blocking_time;
+    DDS_Security_boolean synchronous;
+} DDS_Security_ReliabilityQosPolicy;
+
+typedef struct {
+    DDS_Security_Duration_t duration;
+} DDS_Security_LifespanQosPolicy;
+
+typedef struct {
+    DDS_Security_DestinationOrderQosPolicyKind kind;
+} DDS_Security_DestinationOrderQosPolicy;
+
+typedef struct  {
+    DDS_Security_OctetSeq value;
+} DDS_Security_UserDataQosPolicy;
+
+typedef struct {
+    DDS_Security_long value;
+} DDS_Security_OwnershipStrengthQosPolicy;
+
+typedef struct {
+    DDS_Security_PresentationQosPolicyAccessScopeKind access_scope;
+    DDS_Security_boolean coherent_access;
+    DDS_Security_boolean ordered_access;
+} DDS_Security_PresentationQosPolicy;
+
+typedef struct {
+    DDS_Security_StringSeq name;
+} DDS_Security_PartitionQosPolicy;
+
+typedef struct {
+    DDS_Security_OctetSeq value;
+} DDS_Security_TopicDataQosPolicy;
+
+typedef struct {
+    DDS_Security_OctetSeq value;
+} DDS_Security_GroupDataQosPolicy;
+
+typedef struct {
+    DDS_Security_Duration_t minimum_separation;
+} DDS_Security_TimeBasedFilterQosPolicy;
+
+typedef struct {
+    DDS_Security_Duration_t service_cleanup_delay;
+    DDS_Security_HistoryQosPolicyKind history_kind;
+    DDS_Security_long history_depth;
+    DDS_Security_long max_samples;
+    DDS_Security_long max_instances;
+    DDS_Security_long max_samples_per_instance;
+} DDS_Security_DurabilityServiceQosPolicy;
+
+typedef struct {
+    DDS_Security_long value;
+} DDS_Security_TransportPriorityQosPolicy;
+
+typedef struct {
+    DDS_Security_HistoryQosPolicyKind kind;
+    DDS_Security_long depth;
+} DDS_Security_HistoryQosPolicy;
+
+typedef struct {
+    DDS_Security_long max_samples;
+    DDS_Security_long max_instances;
+    DDS_Security_long max_samples_per_instance;
+} DDS_Security_ResourceLimitsQosPolicy;
+
+
+
+
+/**************************************************************************
+ *                                                                        *
+ * QoS.                                                                   *
+ *                                                                        *
+ **************************************************************************/
+typedef struct {
+    // Existing policies from the DDS specification are ignored.
+    DDS_Security_PropertyQosPolicy property;
+    DDS_Security_DataTagQosPolicy data_tags;
+} DDS_Security_Qos;
+
+
+
+
+/**************************************************************************
+ *                                                                        *
+ * Messages.                                                              *
+ *                                                                        *
+ **************************************************************************/
+typedef struct  {
+    DDS_Security_BuiltinTopicKey_t key;
+    DDS_Security_BuiltinTopicKey_t participant_key;
+    DDS_Security_string topic_name;
+    DDS_Security_string type_name;
+    DDS_Security_DurabilityQosPolicy durability;
+    DDS_Security_DeadlineQosPolicy deadline;
+    DDS_Security_LatencyBudgetQosPolicy latency_budget;
+    DDS_Security_LivelinessQosPolicy liveliness;
+    DDS_Security_ReliabilityQosPolicy reliability;
+    DDS_Security_LifespanQosPolicy lifespan;
+    DDS_Security_DestinationOrderQosPolicy destination_order;
+    DDS_Security_UserDataQosPolicy user_data;
+    DDS_Security_OwnershipQosPolicy ownership;
+    DDS_Security_OwnershipStrengthQosPolicy ownership_strength;
+    DDS_Security_PresentationQosPolicy presentation;
+    DDS_Security_PartitionQosPolicy partition;
+    DDS_Security_TopicDataQosPolicy topic_data;
+    DDS_Security_GroupDataQosPolicy group_data;
+    DDS_Security_EndpointSecurityInfo security_info;
+    DDS_Security_DataTags data_tags;
+} DDS_Security_PublicationBuiltinTopicDataSecure;
+
+typedef struct {
+    DDS_Security_BuiltinTopicKey_t key;
+    DDS_Security_BuiltinTopicKey_t participant_key;
+    DDS_Security_string topic_name;
+    DDS_Security_string type_name;
+    DDS_Security_DurabilityQosPolicy durability;
+    DDS_Security_DeadlineQosPolicy deadline;
+    DDS_Security_LatencyBudgetQosPolicy latency_budget;
+    DDS_Security_LivelinessQosPolicy liveliness;
+    DDS_Security_ReliabilityQosPolicy reliability;
+    DDS_Security_OwnershipQosPolicy ownership;
+    DDS_Security_DestinationOrderQosPolicy destination_order;
+    DDS_Security_UserDataQosPolicy user_data;
+    DDS_Security_TimeBasedFilterQosPolicy time_based_filter;
+    DDS_Security_PresentationQosPolicy presentation;
+    DDS_Security_PartitionQosPolicy partition;
+    DDS_Security_TopicDataQosPolicy topic_data;
+    DDS_Security_GroupDataQosPolicy group_data;
+    DDS_Security_EndpointSecurityInfo security_info;
+    DDS_Security_DataTags data_tags;
+} DDS_Security_SubscriptionBuiltinTopicDataSecure;
+
+typedef struct {
+    DDS_Security_BuiltinTopicKey_t key;
+    DDS_Security_string name;
+    DDS_Security_string type_name;
+    DDS_Security_DurabilityQosPolicy durability;
+    DDS_Security_DurabilityServiceQosPolicy durability_service;
+    DDS_Security_DeadlineQosPolicy deadline;
+    DDS_Security_LatencyBudgetQosPolicy latency_budget;
+    DDS_Security_LivelinessQosPolicy liveliness;
+    DDS_Security_ReliabilityQosPolicy reliability;
+    DDS_Security_TransportPriorityQosPolicy transport_priority;
+    DDS_Security_LifespanQosPolicy lifespan;
+    DDS_Security_DestinationOrderQosPolicy destination_order;
+    DDS_Security_HistoryQosPolicy history;
+    DDS_Security_ResourceLimitsQosPolicy resource_limits;
+    DDS_Security_OwnershipQosPolicy ownership;
+    DDS_Security_TopicDataQosPolicy topic_data;
+} DDS_Security_TopicBuiltinTopicData;
+
+typedef struct {
+    DDS_Security_BuiltinTopicKey_t key;
+    DDS_Security_UserDataQosPolicy user_data;
+    DDS_Security_IdentityToken identity_token;
+    DDS_Security_PermissionsToken permissions_token;
+    DDS_Security_PropertyQosPolicy property;
+    DDS_Security_ParticipantSecurityInfo security_info;
+} DDS_Security_ParticipantBuiltinTopicData;
+
+typedef struct {
+    DDS_Security_BuiltinTopicKey_t key;
+    DDS_Security_UserDataQosPolicy user_data;
+    DDS_Security_IdentityToken identity_token;
+    DDS_Security_PermissionsToken permissions_token;
+    DDS_Security_PropertyQosPolicy property;
+    DDS_Security_ParticipantSecurityInfo security_info;
+    DDS_Security_IdentityStatusToken identity_status_token;
+} DDS_Security_ParticipantBuiltinTopicDataSecure;
+
+
+
+#if defined (__cplusplus)
+}
+#endif
+
+#endif /* DDS_SECURITY_API_TYPES_H */
+

From a65d3db7c8044ad98f84f872af1beecfddbc6b69 Mon Sep 17 00:00:00 2001
From: Kurtulus Oksuztepe <kurtulus.oksuztepe@adlinktech.com>
Date: Mon, 1 Jul 2019 16:33:24 +0200
Subject: [PATCH 067/238] Dynamic library loading functions were added to ddsrt

ddsrt_dlopen ddsrt_dlclose ddsrt_dlsym and ddsrt_dlerror functions can be used
in posix and windows platforms that support dynamic loading

Signed-off-by: Kurtulus Oksuztepe <kurtulus.oksuztepe@adlinktech.com>
---
 src/cmake/modules/FindMaven.cmake     |   9 +-
 src/ddsrt/CMakeLists.txt              |   4 +-
 src/ddsrt/include/dds/ddsrt/dynlib.h  | 143 +++++++++++++++++++
 src/ddsrt/src/dynlib/posix/dynlib.c   |  95 +++++++++++++
 src/ddsrt/src/dynlib/windows/dynlib.c |  95 +++++++++++++
 src/ddsrt/tests/CMakeLists.txt        |  46 ++++++
 src/ddsrt/tests/dl_test.h.in          |  22 +++
 src/ddsrt/tests/dllib.c               |  25 ++++
 src/ddsrt/tests/dynlib.c              | 197 ++++++++++++++++++++++++++
 9 files changed, 633 insertions(+), 3 deletions(-)
 create mode 100644 src/ddsrt/include/dds/ddsrt/dynlib.h
 create mode 100644 src/ddsrt/src/dynlib/posix/dynlib.c
 create mode 100644 src/ddsrt/src/dynlib/windows/dynlib.c
 create mode 100644 src/ddsrt/tests/dl_test.h.in
 create mode 100644 src/ddsrt/tests/dllib.c
 create mode 100644 src/ddsrt/tests/dynlib.c

diff --git a/src/cmake/modules/FindMaven.cmake b/src/cmake/modules/FindMaven.cmake
index 5a2e3c3..02d2dbd 100644
--- a/src/cmake/modules/FindMaven.cmake
+++ b/src/cmake/modules/FindMaven.cmake
@@ -18,8 +18,13 @@ if(DEFINED ENV{M2_HOME})
 endif()
 
 # Chocolatey installs packages under C:\ProgramData\chocolatey.
-if(ENV{ProgramData} AND IS_DIRECTORY "$ENV{ProgramData}/chocolatey/bin")
-  list(APPEND _mvn_paths "$ENV{ProgramData}/chocolatey/bin")
+if(NOT "$ENV{ProgramData}" STREQUAL "")
+  if(IS_DIRECTORY "$ENV{ProgramData}/chocolatey/bin")
+    list(APPEND _mvn_paths "$ENV{ProgramData}/chocolatey/bin")
+  endif()
+  if(IS_DIRECTORY "$ENV{ProgramData}/chocolatey/bin")
+    list(APPEND _dirs "$ENV{ProgramData}/chocolatey/lib/maven")
+  endif()
 endif()
 
 # Maven documentation mentions intalling maven under C:\Program Files on
diff --git a/src/ddsrt/CMakeLists.txt b/src/ddsrt/CMakeLists.txt
index cda6f18..2b5171a 100644
--- a/src/ddsrt/CMakeLists.txt
+++ b/src/ddsrt/CMakeLists.txt
@@ -66,6 +66,7 @@ list(APPEND headers
   "${include_path}/dds/ddsrt/misc.h"
   "${include_path}/dds/ddsrt/io.h"
   "${include_path}/dds/ddsrt/process.h"
+  "${include_path}/dds/ddsrt/dynlib.h"
   "${include_path}/dds/ddsrt/strtod.h"
   "${include_path}/dds/ddsrt/strtol.h"
   "${include_path}/dds/ddsrt/types.h")
@@ -102,7 +103,7 @@ list(APPEND sources
 # network stack. In order to mix-and-match various compilers, architectures,
 # operating systems, etc input from the build system is required.
 foreach(feature atomics cdtors environ heap ifaddrs random rusage
-                sockets string sync threads time md5 process)
+                sockets string sync threads time md5 process dynlib)
   if(EXISTS "${include_path}/dds/ddsrt/${feature}.h")
     list(APPEND headers "${include_path}/dds/ddsrt/${feature}.h")
     file(GLOB
@@ -176,6 +177,7 @@ target_sources(ddsrt INTERFACE ${sources})
 set(CMAKE_THREAD_PREFER_PTHREAD TRUE)
 find_package(Threads REQUIRED)
 target_link_libraries(ddsrt INTERFACE Threads::Threads)
+target_link_libraries(ddsrt INTERFACE ${CMAKE_DL_LIBS})
 
 if(WIN32)
   target_link_libraries(ddsrt INTERFACE wsock32 ws2_32 iphlpapi bcrypt)
diff --git a/src/ddsrt/include/dds/ddsrt/dynlib.h b/src/ddsrt/include/dds/ddsrt/dynlib.h
new file mode 100644
index 0000000..1f9270e
--- /dev/null
+++ b/src/ddsrt/include/dds/ddsrt/dynlib.h
@@ -0,0 +1,143 @@
+
+/*
+ * Copyright(c) 2006 to 2018 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+#ifndef DDSRT_LIBRARY_H
+#define DDSRT_LIBRARY_H
+
+#include "dds/export.h"
+#include "dds/ddsrt/types.h"
+#include "dds/ddsrt/retcode.h"
+#include "dds/ddsrt/attributes.h"
+
+#if defined (__cplusplus)
+extern "C" {
+#endif
+
+
+//typedef void *ddsrt_dynlib_t;
+typedef struct ddsrt_dynlib *ddsrt_dynlib_t;
+
+
+/**
+ * @brief Load a dynamic shared library.
+ *
+ * The function ddsrt_dlopen() loads the dynamic shared object (shared library)
+ * file, identified by 'name', sets the handle parameter for the loaded library and
+ * returns the result with dds return code.
+ *
+ * If the 'translate' boolean is true, this function will first try to open the
+ * library with a translated 'name'. Translated in this context means that if
+ * "mylibrary" is provided, it will be translated into libmylibrary.so,
+ * libmylibrary.dylib or mylibrary.dll depending on the platform.
+ * This translation only happens when the given name does not contain
+ * a directory.
+ * If the function isn't able to load the library with the translated name, it
+ * will still try the given name.
+ *
+ * @param[in]   name        Library file name.
+ * @param[in]   translate   Automatic name translation on/off.
+ * @param[out]  handle      Library handle that will be assigned after successfull operation. It is assigned to NULL if loading fails.
+ *
+ * @returns A dds_retcode_t indicating success or failure.
+ *
+ * @retval DDS_RETCODE_OK
+ *             Library handle was successfully loaded.
+ * @retval DDS_RETCODE_BAD_PARAM
+ *             There is an invalid input in the parameter list
+ * @retval DDS_RETCODE_ERROR
+ *             Loading failed.
+ *             Use ddsrt_dlerror() to diagnose the failure.
+ */
+DDS_EXPORT dds_retcode_t
+ddsrt_dlopen(
+    const char *name,
+    bool translate,
+    ddsrt_dynlib_t *handle) ddsrt_nonnull_all;
+
+/**
+ * @brief Close the library.
+ *
+ * The function ddsrt_dlclose() informs the system that the
+ * library, identified by 'handle', is no longer needed.
+ * will get the memory address of a symbol,
+ * identified by 'symbol', from a loaded library 'handle'.
+ *
+ * @param[in]   handle      Library handle.
+ *
+ * @returns A dds_retcode_t indicating success or failure.
+ *
+ * @retval DDS_RETCODE_OK
+ *             Library handle was successfully closed.
+ * @retval DDS_RETCODE_ERROR
+ *             Library closing failed.
+ *             Use ddsrt_dlerror() to diagnose the failure.
+ */
+DDS_EXPORT dds_retcode_t
+ddsrt_dlclose(
+    ddsrt_dynlib_t handle);
+
+/**
+ * @brief Get the memory address of a symbol.
+ *
+ * The function ddsrt_dlsym() will get the memory address of a symbol,
+ * identified by 'symbol', from a loaded library 'handle'.
+ *
+ * @param[in]   handle      Library handle.
+ * @param[in]   symbol      Symbol name.
+ * @param[out]  address     The memory address of the loaded symbol (void*).
+ *
+ * @returns  A dds_retcode_t indicating success or failure.
+ *
+ * @retval DDS_RETCODE_OK
+ *             Symbol was found in the loaded library.
+ *             Address parameter is ready to use.
+ * @retval DDS_RETCODE_ERROR
+ *             Symbol was not found.
+ *             Use ddsrt_dlerror() to diagnose the failure.
+ */
+DDS_EXPORT dds_retcode_t
+ddsrt_dlsym(
+    ddsrt_dynlib_t handle,
+    const char *symbol,
+    void **address);
+
+/**
+ * @brief Get the most recent library related error.
+ *
+ * The function ddsrt_dlerror() will return the most recent error of the operating system
+ * in human readable form.
+ *
+ * If no error was found, it's either due to the fact that there
+ * actually was no error since init or last ddsrt_dlerror() call,
+ * or due to an unknown unrelated error.
+ *
+ * As error reporting function can be used for different purposes, dssrt_dlerror
+ * function should be called immediately after calling ddsrt_dlopen or ddsrt_dlsym
+ * function.
+ *
+ * @returns A dds_retcode_t indicating success or failure.
+ *
+ * @retval DDS_RETCODE_OK
+ *             Most recent library related error returned.
+ * @retval DDS_RETCODE_NOT_FOUND
+ *             No library related error found.
+ */
+DDS_EXPORT dds_retcode_t
+ddsrt_dlerror(
+    char *buf,
+    size_t buflen);
+
+#if defined (__cplusplus)
+}
+#endif
+
+#endif /* DDSRT_LIBRARY_H */
diff --git a/src/ddsrt/src/dynlib/posix/dynlib.c b/src/ddsrt/src/dynlib/posix/dynlib.c
new file mode 100644
index 0000000..cb538d8
--- /dev/null
+++ b/src/ddsrt/src/dynlib/posix/dynlib.c
@@ -0,0 +1,95 @@
+/*
+ * Copyright(c) 2006 to 2018 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+#include <stdio.h>
+#include <dlfcn.h>
+#include <assert.h>
+#include <string.h>
+#include <dds/ddsrt/dynlib.h>
+#include "dds/ddsrt/heap.h"
+#include "dds/ddsrt/io.h"
+
+dds_retcode_t ddsrt_dlopen(const char *name, bool translate,
+		ddsrt_dynlib_t *handle) {
+	dds_retcode_t retcode = DDS_RETCODE_OK;
+
+	assert( handle );
+	*handle = NULL;
+
+	if ((translate) && (strrchr(name, '/') == NULL )) {
+		/* Add lib and suffix to the name and try to open. */
+#if __APPLE__
+		static const char suffix[] = ".dylib";
+#else
+		static const char suffix[] = ".so";
+#endif
+		char* libName;
+		ddsrt_asprintf( &libName, "lib%s%s", name, suffix);
+		*handle = dlopen(libName, RTLD_GLOBAL | RTLD_NOW);
+		ddsrt_free(libName);
+	}
+
+	if (*handle == NULL ) {
+		/* name contains a path,
+		 * (auto)translate is disabled or
+		 * dlopen on translated name failed. */
+		*handle = dlopen(name, RTLD_GLOBAL | RTLD_NOW);
+	}
+
+	if (*handle != NULL) {
+		retcode = DDS_RETCODE_OK;
+	} else {
+		retcode = DDS_RETCODE_ERROR;
+	}
+
+	return retcode;
+}
+
+dds_retcode_t ddsrt_dlclose(ddsrt_dynlib_t handle) {
+
+	assert ( handle );
+	return (dlclose(handle) == 0) ? DDS_RETCODE_OK : DDS_RETCODE_ERROR;
+
+}
+
+dds_retcode_t ddsrt_dlsym(ddsrt_dynlib_t handle, const char *symbol,
+		void **address) {
+	dds_retcode_t retcode = DDS_RETCODE_OK;
+
+	assert( handle );
+	assert( address );
+	assert( symbol );
+
+	*address = dlsym(handle, symbol);
+	if (*address == NULL) {
+		retcode = DDS_RETCODE_ERROR;
+	}
+
+	return retcode;
+}
+
+dds_retcode_t ddsrt_dlerror(char *buf, size_t buflen) {
+
+	const char *err;
+	dds_retcode_t retcode = DDS_RETCODE_OK;
+
+	assert (buf );
+
+	err = dlerror();
+	if (err == NULL) {
+		retcode = DDS_RETCODE_NOT_FOUND;
+	} else {
+		snprintf(buf, buflen, "%s", err);
+	}
+
+	return retcode;
+}
+
diff --git a/src/ddsrt/src/dynlib/windows/dynlib.c b/src/ddsrt/src/dynlib/windows/dynlib.c
new file mode 100644
index 0000000..38e1688
--- /dev/null
+++ b/src/ddsrt/src/dynlib/windows/dynlib.c
@@ -0,0 +1,95 @@
+/*
+ * Copyright(c) 2006 to 2018 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+#include <stdio.h>
+#include <assert.h>
+#include <dds/ddsrt/dynlib.h>
+#include <string.h>
+#include "dds/ddsrt/heap.h"
+#include "dds/ddsrt/types.h"
+#include "dds/ddsrt/string.h"
+
+dds_retcode_t ddsrt_dlopen(const char *name, bool translate,
+		ddsrt_dynlib_t *handle) {
+	dds_retcode_t retcode = DDS_RETCODE_OK;
+
+	assert( handle );
+	*handle = NULL;
+
+	if ((translate) && (strrchr(name, '/') == NULL )
+			&& (strrchr(name, '\\') == NULL )) {
+		/* Add suffix to the name and try to open. */
+		static const char suffix[] = ".dll";
+		size_t len = strlen(name) + sizeof(suffix);
+		char* libName = ddsrt_malloc(len);
+		sprintf_s(libName, len, "%s%s", name, suffix);
+		*handle = LoadLibrary(libName);
+		ddsrt_free(libName);
+	}
+
+	if (*handle == NULL) {
+		/* Name contains a path,
+		 * (auto)translate is disabled or
+		 * LoadLibrary on translated name failed. */
+		*handle = LoadLibrary(name);
+	}
+
+	if (*handle != NULL) {
+		retcode = DDS_RETCODE_OK;
+	} else {
+		retcode = DDS_RETCODE_ERROR;
+	}
+
+	return retcode;
+}
+
+dds_retcode_t ddsrt_dlclose(ddsrt_dynlib_t handle) {
+
+	assert ( handle );
+	return (FreeLibrary(handle) == 0) ? DDS_RETCODE_ERROR : DDS_RETCODE_OK;
+}
+
+dds_retcode_t ddsrt_dlsym(ddsrt_dynlib_t handle, const char *symbol,
+		void **address) {
+	dds_retcode_t retcode = DDS_RETCODE_OK;
+
+	assert( handle );
+	assert( address );
+	assert( symbol );
+
+	*address = GetProcAddress(handle, symbol);
+	if ( *address == NULL ) {
+		retcode = DDS_RETCODE_ERROR;
+	}
+
+	return retcode;
+}
+
+dds_retcode_t ddsrt_dlerror(char *buf, size_t buflen) {
+
+	/* Hopefully (and likely), the last error is
+	 * related to a Library action attempt. */
+	DWORD err;
+	assert ( buf );
+
+	dds_retcode_t retcode = DDS_RETCODE_OK;
+
+	err = GetLastError();
+	if ( err == 0 ) {
+		retcode = DDS_RETCODE_NOT_FOUND;
+	} else {
+		retcode = ddsrt_strerror_r(err, buf, buflen);
+	}
+
+	return retcode;
+
+}
+
diff --git a/src/ddsrt/tests/CMakeLists.txt b/src/ddsrt/tests/CMakeLists.txt
index 02c92ef..db27665 100644
--- a/src/ddsrt/tests/CMakeLists.txt
+++ b/src/ddsrt/tests/CMakeLists.txt
@@ -10,9 +10,11 @@
 # SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
 #
 include(CUnit)
+include(GenerateExportHeader)
 
 set(sources
     "atomics.c"
+    "dynlib.c"
     "environ.c"
     "heap.c"
     "ifaddrs.c"
@@ -66,3 +68,47 @@ set(process_app_name "${CMAKE_CURRENT_BINARY_DIR}/process_app${CMAKE_EXECUTABLE_
 configure_file(
         "process_test.h.in" "${CMAKE_CURRENT_BINARY_DIR}/include/process_test.h" @ONLY)
 
+
+
+# Create a separate shared library that will be used to
+# test dynamic library loading.
+set(test_lib_name "dltestlib")
+add_library(${test_lib_name} SHARED dllib.c)
+# Force the lib to be at the same location, no matter what platform or build type.
+set_target_properties(
+        ${test_lib_name}
+        PROPERTIES
+        RUNTIME_OUTPUT_DIRECTORY                ${CMAKE_CURRENT_BINARY_DIR}
+        RUNTIME_OUTPUT_DIRECTORY_DEBUG          ${CMAKE_CURRENT_BINARY_DIR}
+        RUNTIME_OUTPUT_DIRECTORY_RELEASE        ${CMAKE_CURRENT_BINARY_DIR}
+        RUNTIME_OUTPUT_DIRECTORY_RELWITHDEBINFO ${CMAKE_CURRENT_BINARY_DIR}
+        RUNTIME_OUTPUT_DIRECTORY_MINSIZEREL     ${CMAKE_CURRENT_BINARY_DIR}
+        LIBRARY_OUTPUT_DIRECTORY                ${CMAKE_CURRENT_BINARY_DIR}
+        LIBRARY_OUTPUT_DIRECTORY_DEBUG          ${CMAKE_CURRENT_BINARY_DIR}
+        LIBRARY_OUTPUT_DIRECTORY_RELEASE        ${CMAKE_CURRENT_BINARY_DIR}
+        LIBRARY_OUTPUT_DIRECTORY_RELWITHDEBINFO ${CMAKE_CURRENT_BINARY_DIR}
+        LIBRARY_OUTPUT_DIRECTORY_MINSIZEREL     ${CMAKE_CURRENT_BINARY_DIR} )
+# Use proper export for this test lib.
+generate_export_header(${test_lib_name} BASE_NAME LIB_TEST)
+target_include_directories(${test_lib_name} PRIVATE "${CMAKE_CURRENT_BINARY_DIR}")
+# Let the cunit application know the location and name of the library.
+file(TO_NATIVE_PATH "${CMAKE_CURRENT_BINARY_DIR}" test_lib_native_dir)
+file(TO_NATIVE_PATH "/" test_lib_sep)
+string(REPLACE "\\" "\\\\" test_lib_dir ${test_lib_native_dir})
+string(REPLACE "\\" "\\\\" test_lib_sep ${test_lib_sep})
+configure_file("dl_test.h.in" "${CMAKE_CURRENT_BINARY_DIR}/include/dl_test.h" @ONLY)
+# Let ctest set the proper library path when executing library tests.
+unset(test_lib_tests)
+process_cunit_source_file("dynlib.c" test_lib_header test_lib_suites test_lib_tests)
+foreach(libtest ${test_lib_tests})
+  string(REPLACE ":" ";" libtest ${libtest})
+  list(GET libtest 0 suite)
+  list(GET libtest 1 test)
+  set(libtestname "CUnit_${suite}_${test}")
+  if("${CMAKE_HOST_SYSTEM}" MATCHES ".*Windows.*")
+    set_property(TEST ${libtestname} APPEND PROPERTY ENVIRONMENT "${test_lib_native_dir}")
+  else()
+    set_property(TEST ${libtestname} APPEND PROPERTY ENVIRONMENT "LD_LIBRARY_PATH=${test_lib_native_dir};$ENV{LD_LIBRARY_PATH}")
+  endif()
+endforeach()
+
diff --git a/src/ddsrt/tests/dl_test.h.in b/src/ddsrt/tests/dl_test.h.in
new file mode 100644
index 0000000..69a05ab
--- /dev/null
+++ b/src/ddsrt/tests/dl_test.h.in
@@ -0,0 +1,22 @@
+/*
+ * Copyright(c) 2006 to 2018 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+#ifndef DDSRT_TEST_DL_TEST_H
+#define DDSRT_TEST_DL_TEST_H
+
+/* Get the library name information from cmake. */
+#define TEST_LIB_NAME   "@test_lib_name@"
+#define TEST_LIB_DIR    "@test_lib_dir@"
+#define TEST_LIB_SEP    "@test_lib_sep@"
+#define TEST_LIB_SUFFIX "@CMAKE_SHARED_LIBRARY_SUFFIX@"
+#define TEST_LIB_PREFIX "@CMAKE_SHARED_LIBRARY_PREFIX@"
+
+#endif /* DDSRT_TEST_DL_TEST_H */
diff --git a/src/ddsrt/tests/dllib.c b/src/ddsrt/tests/dllib.c
new file mode 100644
index 0000000..21086e6
--- /dev/null
+++ b/src/ddsrt/tests/dllib.c
@@ -0,0 +1,25 @@
+/*
+ * Copyright(c) 2019 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+#include "lib_test_export.h"
+
+static int g_val = -1;
+
+LIB_TEST_EXPORT void set_int(int val)
+{
+  g_val = val;
+}
+
+LIB_TEST_EXPORT int get_int(void)
+{
+  return g_val;
+}
+
diff --git a/src/ddsrt/tests/dynlib.c b/src/ddsrt/tests/dynlib.c
new file mode 100644
index 0000000..3c3fc2a
--- /dev/null
+++ b/src/ddsrt/tests/dynlib.c
@@ -0,0 +1,197 @@
+/*
+ * Copyright(c) 2019 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+#include <stdio.h>
+#include <string.h>
+#include <assert.h>
+#include <dds/ddsrt/dynlib.h>
+#include "CUnit/Test.h"
+#include "dds/ddsrt/heap.h"
+#include "dds/ddsrt/string.h"
+#include "dds/ddsrt/environ.h"
+#include "dl_test.h"
+
+#define TEST_LIB_FILE     ""TEST_LIB_PREFIX""TEST_LIB_NAME""TEST_LIB_SUFFIX""
+#define TEST_LIB_ABSOLUTE ""TEST_LIB_DIR""TEST_LIB_SEP""TEST_LIB_FILE""
+
+#define TEST_ABORT_IF_NULL(var, msg) \
+do { \
+  if (var == NULL) { \
+    char buffer[256]; \
+    r = ddsrt_dlerror(buffer, sizeof(buffer)); \
+    CU_ASSERT_EQUAL_FATAL(r, DDS_RETCODE_OK); \
+    printf("\n%s", buffer); \
+    CU_FAIL_FATAL(msg); \
+  } \
+} while(0)
+
+
+/*
+ * Load a library.
+ */
+CU_Test(ddsrt_library, dlopen_path)
+{
+  dds_retcode_t r;
+  ddsrt_dynlib_t  l;
+
+  printf("Absolute lib: %s\n", TEST_LIB_ABSOLUTE);
+  r = ddsrt_dlopen(TEST_LIB_ABSOLUTE, false, &l);
+  CU_ASSERT_EQUAL(r, DDS_RETCODE_OK);
+  CU_ASSERT_PTR_NOT_NULL(l);
+  TEST_ABORT_IF_NULL(l, "ddsrt_dlopen() failed. Is the proper library path set?");
+
+  r = ddsrt_dlclose(l);
+  CU_ASSERT_EQUAL(r, DDS_RETCODE_OK);
+}
+
+CU_Test(ddsrt_library, dlopen_file)
+{
+  dds_retcode_t r;
+  ddsrt_dynlib_t l;
+
+  r = ddsrt_dlopen(TEST_LIB_FILE, false, &l);
+  CU_ASSERT_EQUAL(r, DDS_RETCODE_OK);
+  CU_ASSERT_PTR_NOT_NULL(l);
+  TEST_ABORT_IF_NULL(l, "ddsrt_dlopen() failed. Is the proper library path set?");
+
+  r = ddsrt_dlclose(l);
+  CU_ASSERT_EQUAL(r, DDS_RETCODE_OK);
+}
+
+CU_Test(ddsrt_library, dlopen_name)
+{
+  dds_retcode_t r;
+  ddsrt_dynlib_t l;
+
+  r = ddsrt_dlopen(TEST_LIB_NAME, true, &l);
+  CU_ASSERT_EQUAL(r, DDS_RETCODE_OK);
+  CU_ASSERT_PTR_NOT_NULL(l);
+  TEST_ABORT_IF_NULL(l, "ddsrt_dlopen() failed. Is the proper library path set?");
+
+  r = ddsrt_dlclose(l);
+  CU_ASSERT_EQUAL(r, DDS_RETCODE_OK);
+}
+
+CU_Test(ddsrt_library, dlopen_unknown)
+{
+  char buffer[256];
+  dds_retcode_t r;
+  ddsrt_dynlib_t l;
+
+  r = ddsrt_dlopen("UnknownLib", false, &l);
+
+  CU_ASSERT_PTR_NULL_FATAL(l);
+
+  r = ddsrt_dlerror(buffer, sizeof(buffer));
+  CU_ASSERT_EQUAL_FATAL(r, DDS_RETCODE_OK);
+  printf("\n%s", buffer);
+}
+
+CU_Test(ddsrt_library, dlsym)
+{
+  dds_retcode_t r;
+  ddsrt_dynlib_t l;
+  void* f;
+
+  r = ddsrt_dlopen(TEST_LIB_NAME, true, &l);
+  CU_ASSERT_PTR_NOT_NULL(l);
+  CU_ASSERT_EQUAL(r, DDS_RETCODE_OK);
+  TEST_ABORT_IF_NULL(l, "ddsrt_dlopen() failed. Is the proper library path set?");
+
+  r = ddsrt_dlsym(l, "get_int", &f);
+  CU_ASSERT_EQUAL(r, DDS_RETCODE_OK);
+  CU_ASSERT_PTR_NOT_NULL(f);
+  TEST_ABORT_IF_NULL(f, "ddsrt_dlsym(l, \"get_int\") failed.");
+
+  r = ddsrt_dlclose(l);
+  CU_ASSERT_EQUAL(r, DDS_RETCODE_OK);
+}
+
+CU_Test(ddsrt_library, dlsym_unknown)
+{
+  char buffer[256];
+  dds_retcode_t r;
+  ddsrt_dynlib_t l;
+  void* f;
+
+  r = ddsrt_dlopen(TEST_LIB_NAME, true, &l);
+  CU_ASSERT_PTR_NOT_NULL(l);
+  TEST_ABORT_IF_NULL(l,"ddsrt_dlopen() failed. Is the proper library path set?");
+
+  r = ddsrt_dlsym(l, "UnknownSym", &f);
+  CU_ASSERT_EQUAL(r, DDS_RETCODE_ERROR);
+  CU_ASSERT_PTR_NULL_FATAL(f);
+
+  r = ddsrt_dlerror(buffer, sizeof(buffer));
+  CU_ASSERT_EQUAL_FATAL(r, DDS_RETCODE_OK);
+  printf("\n%s", buffer);
+
+  r = ddsrt_dlclose(l);
+  CU_ASSERT_EQUAL(r, DDS_RETCODE_OK);
+}
+
+typedef void (*func_set_int)(int val);
+typedef int  (*func_get_int)(void);
+CU_Test(ddsrt_library, call)
+{
+  int get_int = 0;
+  int set_int = 1234;
+  func_get_int f_get;
+  func_set_int f_set;
+  dds_retcode_t r;
+  ddsrt_dynlib_t l;
+
+  r = ddsrt_dlopen(TEST_LIB_NAME, true, &l);
+  CU_ASSERT_PTR_NOT_NULL(l);
+  TEST_ABORT_IF_NULL(l, "ddsrt_dlopen() failed. Is the proper library path set?");
+
+  r = ddsrt_dlsym(l, "get_int", (void **)&f_get);
+  CU_ASSERT_PTR_NOT_NULL(f_get);
+  TEST_ABORT_IF_NULL(f_get, "ddsrt_dlsym(l, \"get_int\") failed.");
+
+  r = ddsrt_dlsym(l, "set_int", (void **)&f_set);
+  CU_ASSERT_PTR_NOT_NULL(f_set);
+  TEST_ABORT_IF_NULL(f_set, "ddsrt_dlsym(l, \"set_int\") failed.");
+
+  f_set(set_int);
+  get_int = f_get();
+  CU_ASSERT_EQUAL(set_int, get_int);
+
+  r = ddsrt_dlclose(l);
+  CU_ASSERT_EQUAL(r, DDS_RETCODE_OK);
+}
+
+CU_Test(ddsrt_library, dlclose_error)
+{
+    dds_retcode_t r;
+    ddsrt_dynlib_t l;
+
+    r = ddsrt_dlopen(TEST_LIB_NAME, true, &l);
+    CU_ASSERT_PTR_NOT_NULL(l);
+    TEST_ABORT_IF_NULL(l, "ddsrt_dlopen() failed. Is the proper library path set?");
+
+    r = ddsrt_dlclose(l);
+    CU_ASSERT_EQUAL(r, DDS_RETCODE_OK);
+
+    r = ddsrt_dlclose( l ); /*already closed handle */
+    CU_ASSERT_EQUAL(r, DDS_RETCODE_ERROR);
+
+}
+
+CU_Test(ddsrt_library, dlerror_notfound)
+{
+    char buffer[256];
+    dds_retcode_t r;
+    ddsrt_dlerror(buffer, sizeof(buffer));
+    r = ddsrt_dlerror(buffer, sizeof(buffer));
+    CU_ASSERT_EQUAL(r, DDS_RETCODE_NOT_FOUND);
+
+}

From 09eba90c9060d0c2c6b8a2d6ea80fbe44c106f6f Mon Sep 17 00:00:00 2001
From: Martin Bremmer <martin.bremmer@adlinktech.com>
Date: Tue, 3 Sep 2019 12:02:20 +0200
Subject: [PATCH 068/238] Fixed dynlib Windows issues after merge.

Signed-off-by: Martin Bremmer <martin.bremmer@adlinktech.com>
---
 src/ddsrt/src/dynlib/windows/dynlib.c | 108 +++++++++++++-------------
 src/ddsrt/tests/CMakeLists.txt        |   6 +-
 src/ddsrt/tests/dynlib.c              |  11 ---
 3 files changed, 56 insertions(+), 69 deletions(-)

diff --git a/src/ddsrt/src/dynlib/windows/dynlib.c b/src/ddsrt/src/dynlib/windows/dynlib.c
index 38e1688..9a8eb46 100644
--- a/src/ddsrt/src/dynlib/windows/dynlib.c
+++ b/src/ddsrt/src/dynlib/windows/dynlib.c
@@ -17,79 +17,79 @@
 #include "dds/ddsrt/types.h"
 #include "dds/ddsrt/string.h"
 
-dds_retcode_t ddsrt_dlopen(const char *name, bool translate,
-		ddsrt_dynlib_t *handle) {
-	dds_retcode_t retcode = DDS_RETCODE_OK;
+dds_return_t ddsrt_dlopen(const char *name, bool translate,
+        ddsrt_dynlib_t *handle) {
+    dds_return_t retcode = DDS_RETCODE_OK;
 
-	assert( handle );
-	*handle = NULL;
+    assert( handle );
+    *handle = NULL;
 
-	if ((translate) && (strrchr(name, '/') == NULL )
-			&& (strrchr(name, '\\') == NULL )) {
-		/* Add suffix to the name and try to open. */
-		static const char suffix[] = ".dll";
-		size_t len = strlen(name) + sizeof(suffix);
-		char* libName = ddsrt_malloc(len);
-		sprintf_s(libName, len, "%s%s", name, suffix);
-		*handle = LoadLibrary(libName);
-		ddsrt_free(libName);
-	}
+    if ((translate) && (strrchr(name, '/') == NULL )
+            && (strrchr(name, '\\') == NULL )) {
+        /* Add suffix to the name and try to open. */
+        static const char suffix[] = ".dll";
+        size_t len = strlen(name) + sizeof(suffix);
+        char* libName = ddsrt_malloc(len);
+        sprintf_s(libName, len, "%s%s", name, suffix);
+        *handle = (ddsrt_dynlib_t)LoadLibrary(libName);
+        ddsrt_free(libName);
+    }
 
-	if (*handle == NULL) {
-		/* Name contains a path,
-		 * (auto)translate is disabled or
-		 * LoadLibrary on translated name failed. */
-		*handle = LoadLibrary(name);
-	}
+    if (*handle == NULL) {
+        /* Name contains a path,
+        * (auto)translate is disabled or
+        * LoadLibrary on translated name failed. */
+        *handle = (ddsrt_dynlib_t)LoadLibrary(name);
+    }
 
-	if (*handle != NULL) {
-		retcode = DDS_RETCODE_OK;
-	} else {
-		retcode = DDS_RETCODE_ERROR;
-	}
+    if (*handle != NULL) {
+        retcode = DDS_RETCODE_OK;
+    } else {
+        retcode = DDS_RETCODE_ERROR;
+    }
 
-	return retcode;
+    return retcode;
 }
 
-dds_retcode_t ddsrt_dlclose(ddsrt_dynlib_t handle) {
+dds_return_t ddsrt_dlclose(ddsrt_dynlib_t handle) {
 
-	assert ( handle );
-	return (FreeLibrary(handle) == 0) ? DDS_RETCODE_ERROR : DDS_RETCODE_OK;
+    assert ( handle );
+    return (FreeLibrary((HMODULE)handle) == 0) ? DDS_RETCODE_ERROR : DDS_RETCODE_OK;
 }
 
-dds_retcode_t ddsrt_dlsym(ddsrt_dynlib_t handle, const char *symbol,
-		void **address) {
-	dds_retcode_t retcode = DDS_RETCODE_OK;
+dds_return_t ddsrt_dlsym(ddsrt_dynlib_t handle, const char *symbol,
+        void **address) {
+    dds_return_t retcode = DDS_RETCODE_OK;
 
-	assert( handle );
-	assert( address );
-	assert( symbol );
+    assert( handle );
+    assert( address );
+    assert( symbol );
 
-	*address = GetProcAddress(handle, symbol);
-	if ( *address == NULL ) {
-		retcode = DDS_RETCODE_ERROR;
-	}
+    *address = GetProcAddress((HMODULE)handle, symbol);
+    if ( *address == NULL ) {
+        retcode = DDS_RETCODE_ERROR;
+    }
 
-	return retcode;
+    return retcode;
 }
 
-dds_retcode_t ddsrt_dlerror(char *buf, size_t buflen) {
+dds_return_t ddsrt_dlerror(char *buf, size_t buflen) {
 
-	/* Hopefully (and likely), the last error is
-	 * related to a Library action attempt. */
-	DWORD err;
-	assert ( buf );
+    /* Hopefully (and likely), the last error is
+    * related to a Library action attempt. */
+    DWORD err;
+    assert ( buf );
 
-	dds_retcode_t retcode = DDS_RETCODE_OK;
+    dds_return_t retcode = DDS_RETCODE_OK;
 
-	err = GetLastError();
-	if ( err == 0 ) {
-		retcode = DDS_RETCODE_NOT_FOUND;
-	} else {
-		retcode = ddsrt_strerror_r(err, buf, buflen);
-	}
+    err = GetLastError();
+    if ( err == 0 ) {
+        retcode = DDS_RETCODE_NOT_FOUND;
+    } else {
+        retcode = ddsrt_strerror_r(err, buf, buflen);
+    }
 
-	return retcode;
+    return retcode;
 
 }
 
diff --git a/src/ddsrt/tests/CMakeLists.txt b/src/ddsrt/tests/CMakeLists.txt
index d5b479d..36a4a5f 100644
--- a/src/ddsrt/tests/CMakeLists.txt
+++ b/src/ddsrt/tests/CMakeLists.txt
@@ -10,6 +10,7 @@
 # SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
 #
 include(CUnit)
+include(GenerateExportHeader)
 include(GenerateDummyExportHeader)
 
 list(APPEND sources
@@ -90,10 +91,7 @@ generate_dummy_export_header(
   BASE_NAME dds
   EXPORT_FILE_NAME "${CMAKE_CURRENT_BINARY_DIR}/include/dds/export.h")
 
-generate_dummy_export_header(
-  ${test_lib_name}
-  BASE_NAME lib_test
-  EXPORT_FILE_NAME "${CMAKE_CURRENT_BINARY_DIR}/lib_test_export.h")
+generate_export_header(${test_lib_name} BASE_NAME LIB_TEST)
 
 if(HAVE_MULTI_PROCESS)
   # A separate application is required to test process management.
diff --git a/src/ddsrt/tests/dynlib.c b/src/ddsrt/tests/dynlib.c
index d52d3a1..76d5871 100644
--- a/src/ddsrt/tests/dynlib.c
+++ b/src/ddsrt/tests/dynlib.c
@@ -185,14 +185,3 @@ CU_Test(ddsrt_library, dlclose_error)
     CU_ASSERT_EQUAL(r, DDS_RETCODE_ERROR);
 
 }
-
-CU_Test(ddsrt_library, dlerror_notfound)
-{
-    char buffer[256];
-    dds_return_t r;
-    ddsrt_dlerror(buffer, sizeof(buffer));
-    r = ddsrt_dlerror(buffer, sizeof(buffer));
-    CU_ASSERT_EQUAL(r, DDS_RETCODE_NOT_FOUND);
-
-}
-

From ef90c11e8dcc9b37c04157a22be952dfb90cff1e Mon Sep 17 00:00:00 2001
From: martinbremmer <37294015+martinbremmer@users.noreply.github.com>
Date: Tue, 1 Oct 2019 12:43:33 +0200
Subject: [PATCH 069/238] Added DDS Security msg parameters. (#263)

* Added DDS Security msg parameters.

Signed-off-by: Martin Bremmer <martin.bremmer@adlinktech.com>

* Added ENABLE_SECURITY cmake option and DDSI_INCLUDE_SECURITY compile switch.

Signed-off-by: Martin Bremmer <martin.bremmer@adlinktech.com>
---
 .travis.yml                                 |  27 ++---
 src/core/CMakeLists.txt                     |  17 ++-
 src/core/ddsi/include/dds/ddsi/q_plist.h    |  71 +++++++++++++
 src/core/ddsi/include/dds/ddsi/q_protocol.h |   4 +
 src/core/ddsi/src/q_config.c                |   2 +-
 src/core/ddsi/src/q_plist.c                 |  63 ++++++++---
 src/core/ddsi/tests/plist.c                 | 112 +++++++++++++++++++-
 7 files changed, 261 insertions(+), 35 deletions(-)

diff --git a/.travis.yml b/.travis.yml
index 2d59e91..2335a4d 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -133,30 +133,32 @@ windows_vs2017: &windows_vs2017
 jobs:
   include:
     - <<: *linux_gcc8
-      env: [ ARCH=x86_64, ASAN=none, BUILD_TYPE=Debug, SSL=YES, GENERATOR="Unix Makefiles", COVERITY_SCAN=true ]
+      env: [ ARCH=x86_64, ASAN=none, BUILD_TYPE=Debug, SSL=YES, SECURITY=YES, GENERATOR="Unix Makefiles", COVERITY_SCAN=true ]
       if: type = cron
     - <<: *linux_gcc8
-      env: [ ARCH=x86_64, ASAN=none, BUILD_TYPE=Debug, SSL=YES, GENERATOR="Unix Makefiles" ]
+      env: [ ARCH=x86_64, ASAN=none, BUILD_TYPE=Debug, SSL=YES, SECURITY=YES, GENERATOR="Unix Makefiles" ]
     - <<: *linux_gcc8
-      env: [ ARCH=x86_64, ASAN=none, BUILD_TYPE=Release, SSL=YES, GENERATOR="Unix Makefiles" ]
+      env: [ ARCH=x86_64, ASAN=none, BUILD_TYPE=Release, SSL=YES, SECURITY=YES, GENERATOR="Unix Makefiles" ]
     - <<: *linux_gcc8
-      env: [ ARCH=x86_64, ASAN=none, BUILD_TYPE=Debug, SSL=NO, GENERATOR="Unix Makefiles" ]
+      env: [ ARCH=x86_64, ASAN=none, BUILD_TYPE=Debug, SSL=NO, SECURITY=YES, GENERATOR="Unix Makefiles" ]
     - <<: *linux_gcc8
-      env: [ ARCH=x86_64, ASAN=none, BUILD_TYPE=Release, SSL=YES, GENERATOR="Unix Makefiles" ]
+      env: [ ARCH=x86_64, ASAN=none, BUILD_TYPE=Release, SSL=YES, SECURITY=YES, GENERATOR="Unix Makefiles" ]
     - <<: *linux_clang
-      env: [ ARCH=x86_64, ASAN=address, BUILD_TYPE=Debug, SSL=YES, GENERATOR="Unix Makefiles" ]
+      env: [ ARCH=x86_64, ASAN=address, BUILD_TYPE=Debug, SSL=YES, SECURITY=YES, GENERATOR="Unix Makefiles" ]
     - <<: *linux_clang
-      env: [ ARCH=x86_64, ASAN=none, BUILD_TYPE=Release, SSL=YES, GENERATOR="Unix Makefiles" ]
+      env: [ ARCH=x86_64, ASAN=address, BUILD_TYPE=Debug, SSL=YES, SECURITY=NO, GENERATOR="Unix Makefiles" ]
+    - <<: *linux_clang
+      env: [ ARCH=x86_64, ASAN=none, BUILD_TYPE=Release, SSL=YES, SECURITY=YES, GENERATOR="Unix Makefiles" ]
     - <<: *osx_xcode10_3
-      env: [ ARCH=x86_64, ASAN=address, BUILD_TYPE=Debug, SSL=YES, GENERATOR="Unix Makefiles" ]
+      env: [ ARCH=x86_64, ASAN=address, BUILD_TYPE=Debug, SSL=YES, SECURITY=YES, GENERATOR="Unix Makefiles" ]
     - <<: *osx_xcode10_3
-      env: [ ARCH=x86_64, ASAN=none, BUILD_TYPE=Release, SSL=YES, GENERATOR="Unix Makefiles" ]
+      env: [ ARCH=x86_64, ASAN=none, BUILD_TYPE=Release, SSL=YES, SECURITY=YES, GENERATOR="Unix Makefiles" ]
     - <<: *windows_vs2017
-      env: [ ARCH=x86, ASAN=none, BUILD_TYPE=Debug, SSL=YES, GENERATOR="Visual Studio 15 2017" ]
+      env: [ ARCH=x86, ASAN=none, BUILD_TYPE=Debug, SSL=YES, SECURITY=YES, GENERATOR="Visual Studio 15 2017" ]
     - <<: *windows_vs2017
-      env: [ ARCH=x86_64, ASAN=none, BUILD_TYPE=Debug, SSL=YES, GENERATOR="Visual Studio 15 2017 Win64" ]
+      env: [ ARCH=x86_64, ASAN=none, BUILD_TYPE=Debug, SSL=YES, SECURITY=YES, GENERATOR="Visual Studio 15 2017 Win64" ]
     - <<: *windows_vs2017
-      env: [ ARCH=x86_64, ASAN=none, BUILD_TYPE=Release, SSL=YES, GENERATOR="Visual Studio 15 2017 Win64" ]
+      env: [ ARCH=x86_64, ASAN=none, BUILD_TYPE=Release, SSL=YES, SECURITY=YES, GENERATOR="Visual Studio 15 2017 Win64" ]
 
 before_script:
   - conan profile new default --detect
@@ -186,6 +188,7 @@ script:
           -DCMAKE_INSTALL_PREFIX=$(pwd)/install
           -DUSE_SANITIZER=${ASAN}
           -DENABLE_SSL=${SSL}
+          -DENABLE_SECURITY=${SECURITY}
           -DBUILD_TESTING=on
           -DWERROR=on
           -G "${GENERATOR}" ..
diff --git a/src/core/CMakeLists.txt b/src/core/CMakeLists.txt
index 255ee90..1ae731b 100644
--- a/src/core/CMakeLists.txt
+++ b/src/core/CMakeLists.txt
@@ -53,17 +53,28 @@ if(ENABLE_SSL)
   endif()
 endif()
 
+# Support the OMG DDS Security within ddsc adds quite a bit of code.
+option(ENABLE_SECURITY "Enable OMG DDS Security support" ON)
+if(NOT ENABLE_SECURITY)
+  message(STATUS "Building without OMG DDS Security support")
+else()
+  add_definitions(-DDDSI_INCLUDE_SECURITY)
+  target_link_libraries(ddsc PRIVATE security_api)
+  target_include_directories(
+    ddsc PUBLIC
+    $<BUILD_INTERFACE:$<TARGET_PROPERTY:security_api,INTERFACE_INCLUDE_DIRECTORIES>>)
+endif()
+
 include(ddsi/CMakeLists.txt)
 include(ddsc/CMakeLists.txt)
 
-target_link_libraries(ddsc PRIVATE ddsrt security_api)
+target_link_libraries(ddsc PRIVATE ddsrt)
 target_compile_definitions(
   ddsc PUBLIC
   $<BUILD_INTERFACE:$<TARGET_PROPERTY:ddsrt,INTERFACE_COMPILE_DEFINITIONS>>)
 target_include_directories(
   ddsc PUBLIC
-  $<BUILD_INTERFACE:$<TARGET_PROPERTY:ddsrt,INTERFACE_INCLUDE_DIRECTORIES>>
-  $<BUILD_INTERFACE:$<TARGET_PROPERTY:security_api,INTERFACE_INCLUDE_DIRECTORIES>>)
+  $<BUILD_INTERFACE:$<TARGET_PROPERTY:ddsrt,INTERFACE_INCLUDE_DIRECTORIES>>)
 
 # SOVERSION should increase on incompatible ABI change
 set_target_properties(ddsc PROPERTIES VERSION ${PROJECT_VERSION} SOVERSION ${PROJECT_VERSION_MAJOR})
diff --git a/src/core/ddsi/include/dds/ddsi/q_plist.h b/src/core/ddsi/include/dds/ddsi/q_plist.h
index 4a9d6f3..8a77283 100644
--- a/src/core/ddsi/include/dds/ddsi/q_plist.h
+++ b/src/core/ddsi/include/dds/ddsi/q_plist.h
@@ -59,6 +59,10 @@ extern "C" {
 /* Security extensions. */
 #define PP_IDENTITY_TOKEN                       ((uint64_t)1 << 41)
 #define PP_PERMISSIONS_TOKEN                    ((uint64_t)1 << 42)
+#define PP_ENDPOINT_SECURITY_INFO               ((uint64_t)1 << 43)
+#define PP_PARTICIPANT_SECURITY_INFO            ((uint64_t)1 << 44)
+#define PP_IDENTITY_STATUS_TOKEN                ((uint64_t)1 << 45)
+#define PP_DATA_TAGS                            ((uint64_t)1 << 46)
 /* Set for unrecognized parameters that are in the reserved space or
    in our own vendor-specific space that have the
    PID_UNRECOGNIZED_INCOMPATIBLE_FLAG set (see DDSI 2.1 9.6.2.2.1) */
@@ -100,6 +104,21 @@ typedef struct nn_keyhash {
   unsigned char value[16];
 } nn_keyhash_t;
 
+#ifdef DDSI_INCLUDE_SECURITY
+typedef struct nn_tag {
+  char *name;
+  char *value;
+} nn_tag_t;
+
+typedef struct nn_tagseq {
+  uint32_t n;
+  nn_tag_t *tags;
+} nn_tagseq_t;
+
+typedef struct nn_datatags {
+  nn_tagseq_t tags;
+} nn_datatags_t;
+#endif
 
 #ifdef DDSI_INCLUDE_SSM
 typedef struct nn_reader_favours_ssm {
@@ -107,6 +126,50 @@ typedef struct nn_reader_favours_ssm {
 } nn_reader_favours_ssm_t;
 #endif
 
+#ifdef DDSI_INCLUDE_SECURITY
+typedef struct nn_dataholder
+{
+  char *class_id;
+  dds_propertyseq_t properties;
+  dds_binarypropertyseq_t binary_properties;
+} nn_dataholder_t;
+
+typedef nn_dataholder_t nn_token_t;
+
+/* Used for both nn_participant_security_info and nn_endpoint_security_info. */
+typedef struct nn_security_info
+{
+  uint32_t security_attributes;
+  uint32_t plugin_security_attributes;
+} nn_security_info_t;
+
+#define NN_ENDPOINT_SECURITY_ATTRIBUTES_FLAG_IS_READ_PROTECTED                         (1u <<  0)
+#define NN_ENDPOINT_SECURITY_ATTRIBUTES_FLAG_IS_WRITE_PROTECTED                        (1u <<  1)
+#define NN_ENDPOINT_SECURITY_ATTRIBUTES_FLAG_IS_DISCOVERY_PROTECTED                    (1u <<  2)
+#define NN_ENDPOINT_SECURITY_ATTRIBUTES_FLAG_IS_SUBMESSAGE_PROTECTED                   (1u <<  3)
+#define NN_ENDPOINT_SECURITY_ATTRIBUTES_FLAG_IS_PAYLOAD_PROTECTED                      (1u <<  4)
+#define NN_ENDPOINT_SECURITY_ATTRIBUTES_FLAG_IS_KEY_PROTECTED                          (1u <<  5)
+#define NN_ENDPOINT_SECURITY_ATTRIBUTES_FLAG_IS_LIVELINESS_PROTECTED                   (1u <<  6)
+#define NN_ENDPOINT_SECURITY_ATTRIBUTES_FLAG_IS_VALID                                  (1u << 31)
+
+#define NN_PLUGIN_ENDPOINT_SECURITY_ATTRIBUTES_FLAG_IS_SUBMESSAGE_ENCRYPTED            (1u <<  0)
+#define NN_PLUGIN_ENDPOINT_SECURITY_ATTRIBUTES_FLAG_IS_PAYLOAD_ENCRYPTED               (1u <<  1)
+#define NN_PLUGIN_ENDPOINT_SECURITY_ATTRIBUTES_FLAG_IS_SUBMESSAGE_ORIGIN_AUTHENTICATED (1u <<  2)
+
+#define NN_PARTICIPANT_SECURITY_ATTRIBUTES_FLAG_IS_RTPS_PROTECTED                      (1u <<  0)
+#define NN_PARTICIPANT_SECURITY_ATTRIBUTES_FLAG_IS_DISCOVERY_PROTECTED                 (1u <<  1)
+#define NN_PARTICIPANT_SECURITY_ATTRIBUTES_FLAG_IS_LIVELINESS_PROTECTED                (1u <<  2)
+#define NN_PARTICIPANT_SECURITY_ATTRIBUTES_FLAG_IS_VALID                               (1u << 31)
+
+#define NN_PLUGIN_PARTICIPANT_SECURITY_ATTRIBUTES_FLAG_IS_RTPS_ENCRYPTED               (1u <<  0)
+#define NN_PLUGIN_PARTICIPANT_SECURITY_ATTRIBUTES_FLAG_IS_DISCOVERY_ENCRYPTED          (1u <<  1)
+#define NN_PLUGIN_PARTICIPANT_SECURITY_ATTRIBUTES_FLAG_IS_LIVELINESS_ENCRYPTED         (1u <<  2)
+#define NN_PLUGIN_PARTICIPANT_SECURITY_ATTRIBUTES_FLAG_IS_RTPS_AUTHENTICATED           (1u <<  3)
+#define NN_PLUGIN_PARTICIPANT_SECURITY_ATTRIBUTES_FLAG_IS_DISCOVERY_AUTHENTICATED      (1u <<  4)
+#define NN_PLUGIN_PARTICIPANT_SECURITY_ATTRIBUTES_FLAG_IS_LIVELINESS_AUTHENTICATED     (1u <<  5)
+#endif
+
+
 typedef struct nn_prismtech_participant_version_info
 {
   uint32_t version;
@@ -159,6 +222,14 @@ typedef struct nn_plist {
   uint32_t process_id;
   char *type_description;
   nn_sequence_number_t coherent_set_seqno;
+#ifdef DDSI_INCLUDE_SECURITY
+  nn_token_t identity_token;
+  nn_token_t permissions_token;
+  nn_security_info_t endpoint_security_info;
+  nn_security_info_t participant_security_info;
+  nn_token_t identity_status_token;
+  nn_datatags_t data_tags;
+#endif
 #ifdef DDSI_INCLUDE_SSM
   nn_reader_favours_ssm_t reader_favours_ssm;
 #endif
diff --git a/src/core/ddsi/include/dds/ddsi/q_protocol.h b/src/core/ddsi/include/dds/ddsi/q_protocol.h
index 93bda9a..9ebf7c5 100644
--- a/src/core/ddsi/include/dds/ddsi/q_protocol.h
+++ b/src/core/ddsi/include/dds/ddsi/q_protocol.h
@@ -390,6 +390,10 @@ DDSRT_WARNING_MSVC_ON(4200)
 /* Security related PID values. */
 #define PID_IDENTITY_TOKEN                      0x1001u
 #define PID_PERMISSIONS_TOKEN                   0x1002u
+#define PID_DATA_TAGS                           0x1003u
+#define PID_ENDPOINT_SECURITY_INFO              0x1004u
+#define PID_PARTICIPANT_SECURITY_INFO           0x1005u
+#define PID_IDENTITY_STATUS_TOKEN               0x1006u
 
 #ifdef DDSI_INCLUDE_SSM
 /* To indicate whether a reader favours the use of SSM.  Iff the
diff --git a/src/core/ddsi/src/q_config.c b/src/core/ddsi/src/q_config.c
index 8a0982b..fd1a911 100644
--- a/src/core/ddsi/src/q_config.c
+++ b/src/core/ddsi/src/q_config.c
@@ -52,7 +52,7 @@ typedef enum update_result (*update_fun_t) (struct cfgst *cfgst, void *parent, s
 typedef void (*free_fun_t) (struct cfgst *cfgst, void *parent, struct cfgelem const * const cfgelem);
 typedef void (*print_fun_t) (struct cfgst *cfgst, void *parent, struct cfgelem const * const cfgelem, uint32_t sources);
 
-#ifdef DDSI_INCLUDE_SECURITY
+#ifdef DDSI_INCLUDE_ENCRYPTION
 struct q_security_plugins q_security_plugin = { NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL };
 #endif
 
diff --git a/src/core/ddsi/src/q_plist.c b/src/core/ddsi/src/q_plist.c
index 50a9721..74114f5 100644
--- a/src/core/ddsi/src/q_plist.c
+++ b/src/core/ddsi/src/q_plist.c
@@ -1172,6 +1172,14 @@ static const struct piddesc piddesc_omg[] = {
   PPV (ENDPOINT_GUID,                       endpoint_guid, XG),
 #ifdef DDSI_INCLUDE_SSM
   PPV (READER_FAVOURS_SSM,                  reader_favours_ssm, Xu),
+#endif
+#ifdef DDSI_INCLUDE_SECURITY
+  PP  (ENDPOINT_SECURITY_INFO,              endpoint_security_info, Xu, Xu),
+  PP  (PARTICIPANT_SECURITY_INFO,           participant_security_info, Xu, Xu),
+  PP  (IDENTITY_TOKEN,                      identity_token,        XS, XQ, XbPROP, XS, XS, XSTOP, XQ, XbPROP, XS, XO, XSTOP),
+  PP  (PERMISSIONS_TOKEN,                   permissions_token,     XS, XQ, XbPROP, XS, XS, XSTOP, XQ, XbPROP, XS, XO, XSTOP),
+  PP  (IDENTITY_STATUS_TOKEN,               identity_status_token, XS, XQ, XbPROP, XS, XS, XSTOP, XQ, XbPROP, XS, XO, XSTOP),
+  PP  (DATA_TAGS,                           data_tags, XQ, XS, XS, XSTOP),
 #endif
   { PID_STATUSINFO, PDF_FUNCTION, PP_STATUSINFO, "STATUSINFO",
     offsetof (struct nn_plist, statusinfo), membersize (struct nn_plist, statusinfo),
@@ -1288,11 +1296,21 @@ struct piddesc_index {
    nn_plist_init_tables.
 
    FIXME: should compute them at build-time */
+#define DEFAULT_PROC_ARRAY_SIZE                19
 #ifdef DDSI_INCLUDE_SSM
-static const struct piddesc *piddesc_omg_index[115];
-#else /* status info is the highest */
-static const struct piddesc *piddesc_omg_index[114];
+#define DEFAULT_OMG_PIDS_ARRAY_SIZE            (PID_READER_FAVOURS_SSM + 1)
+#else
+#define DEFAULT_OMG_PIDS_ARRAY_SIZE            (PID_STATUSINFO + 1)
 #endif
+#ifdef DDSI_INCLUDE_SECURITY
+#define SECURITY_OMG_PIDS_ARRAY_SIZE           (PID_IDENTITY_STATUS_TOKEN - PID_IDENTITY_TOKEN + 1)
+#define SECURITY_PROC_ARRAY_SIZE               4
+#else
+#define SECURITY_OMG_PIDS_ARRAY_SIZE           0
+#define SECURITY_PROC_ARRAY_SIZE               0
+#endif
+
+static const struct piddesc *piddesc_omg_index[DEFAULT_OMG_PIDS_ARRAY_SIZE + SECURITY_OMG_PIDS_ARRAY_SIZE];
 static const struct piddesc *piddesc_eclipse_index[19];
 static const struct piddesc *piddesc_prismtech_index[19];
 
@@ -1318,13 +1336,22 @@ static const struct piddesc_index piddesc_vendor_index[] = {
 /* List of entries that require unalias, fini processing;
    initialized by nn_plist_init_tables; will assert when
    table too small or too large */
-static const struct piddesc *piddesc_unalias[19];
-static const struct piddesc *piddesc_fini[19];
+static const struct piddesc *piddesc_unalias[DEFAULT_PROC_ARRAY_SIZE + SECURITY_PROC_ARRAY_SIZE];
+static const struct piddesc *piddesc_fini[DEFAULT_PROC_ARRAY_SIZE + SECURITY_PROC_ARRAY_SIZE];
 static ddsrt_once_t table_init_control = DDSRT_ONCE_INIT;
 
-static nn_parameterid_t pid_without_flags (nn_parameterid_t pid)
+static size_t pid_to_index (nn_parameterid_t pid)
 {
-  return (nn_parameterid_t) (pid & ~(PID_VENDORSPECIFIC_FLAG | PID_UNRECOGNIZED_INCOMPATIBLE_FLAG));
+  /* pid without flags. */
+  size_t idx = (size_t)(pid & ~(PID_VENDORSPECIFIC_FLAG | PID_UNRECOGNIZED_INCOMPATIBLE_FLAG));
+#ifdef DDSI_INCLUDE_SECURITY
+  if ((idx >= PID_IDENTITY_TOKEN) && (idx <= PID_IDENTITY_STATUS_TOKEN))
+  {
+    /* Security PIDs start after the 'normal' PIDs. */
+    idx = (idx - PID_IDENTITY_TOKEN) + DEFAULT_OMG_PIDS_ARRAY_SIZE;
+  }
+#endif
+  return idx;
 }
 
 static int piddesc_cmp_qos_addr (const void *va, const void *vb)
@@ -1348,12 +1375,13 @@ static void nn_plist_init_tables_real (void)
       continue;
     struct piddesc const **index = piddesc_vendor_index[i].index;
 #ifndef NDEBUG
-    nn_parameterid_t maxpid = 0;
+    size_t maxpididx = 0;
     bool only_qos_seen = true;
 #endif
     for (size_t j = 0; table[j].pid != PID_SENTINEL; j++)
     {
-      nn_parameterid_t pid = pid_without_flags (table[j].pid);
+      nn_parameterid_t pid = table[j].pid;
+      size_t pididx = pid_to_index(pid);
 #ifndef NDEBUG
       /* Table must first list QoS, then other parameters */
       assert (only_qos_seen || !(table[j].flags & PDF_QOS));
@@ -1361,19 +1389,19 @@ static void nn_plist_init_tables_real (void)
         only_qos_seen = false;
       /* Track max PID so we can verify the table is no larger
          than necessary */
-      if (pid > maxpid)
-        maxpid = pid;
+      if (pididx > maxpididx)
+          maxpididx = pididx;
 #endif
       /* PAD is used for entries that are never visible on the wire
          and the decoder assumes the PAD entries will be skipped
          because they don't map to an entry */
       if (pid == PID_PAD)
         continue;
-      assert (pid <= piddesc_vendor_index[i].index_max);
-      assert (index[pid] == NULL || index[pid] == &table[j]);
-      index[pid] = &table[j];
+      assert (pididx <= piddesc_vendor_index[i].index_max);
+      assert (index[pididx] == NULL || index[pididx] == &table[j]);
+      index[pididx] = &table[j];
     }
-    assert (maxpid == piddesc_vendor_index[i].index_max);
+    assert (maxpididx == piddesc_vendor_index[i].index_max);
   }
 
   /* PIDs requiring unalias; there is overlap between the tables
@@ -2094,9 +2122,10 @@ static dds_return_t init_one_parameter (nn_plist_t *plist, nn_ipaddress_params_t
     index = &piddesc_vendor_index[dd->vendorid.id[1]];
 
   const struct piddesc *entry;
-  if (pid_without_flags (pid) > index->index_max || (entry = index->index[pid_without_flags (pid)]) == NULL)
+  size_t pididx = pid_to_index(pid);
+  if (pididx > index->index_max || (entry = index->index[pididx]) == NULL)
     return return_unrecognized_pid (plist, pid);
-  assert (pid_without_flags (pid) == pid_without_flags (entry->pid));
+  assert (pid_to_index (pid) == pid_to_index (entry->pid));
   if (pid != entry->pid)
   {
     DDS_CERROR (logcfg, "error processing parameter list (vendor %u.%u, version %u.%u): pid %"PRIx16" mapped to pid %"PRIx16"\n",
diff --git a/src/core/ddsi/tests/plist.c b/src/core/ddsi/tests/plist.c
index 603d07a..a9b96a0 100644
--- a/src/core/ddsi/tests/plist.c
+++ b/src/core/ddsi/tests/plist.c
@@ -19,9 +19,9 @@
 
 CU_Test (ddsi_plist, unalias_copy_merge)
 {
-  /* one int, one string and one string sequence covers most cases */
+  /* one int, one string, one string sequence and one struct sequence covers most cases */
   nn_plist_t p0, p0memcpy;
-  char *p0strs[3];
+  char *p0strs[7];
   nn_plist_init_empty (&p0);
   p0.present = PP_PRISMTECH_PROCESS_ID | PP_ENTITY_NAME;
   p0.aliased = PP_ENTITY_NAME;
@@ -34,18 +34,43 @@ CU_Test (ddsi_plist, unalias_copy_merge)
   p0strs[0] = p0.qos.partition.strs[0] = "aap";
   p0strs[1] = p0.qos.partition.strs[1] = "noot";
   p0strs[2] = p0.qos.partition.strs[2] = "mies";
+#ifdef DDSI_INCLUDE_SECURITY
+  p0.present |= PP_IDENTITY_TOKEN;
+  p0.aliased |= PP_IDENTITY_TOKEN;
+  p0.identity_token.class_id = "class_id";
+  p0.identity_token.properties.n = 2;
+  p0.identity_token.properties.props = ddsrt_malloc (p0.identity_token.properties.n * sizeof (*p0.identity_token.properties.props));
+  p0.identity_token.properties.props[0].propagate = false;
+  p0strs[3] = p0.identity_token.properties.props[0].name = "name0";
+  p0strs[4] = p0.identity_token.properties.props[0].value = "value0";
+  p0.identity_token.properties.props[1].propagate = true;
+  p0strs[5] = p0.identity_token.properties.props[1].name = "name1";
+  p0strs[6] = p0.identity_token.properties.props[1].value = "value1";
+  p0.identity_token.binary_properties.n = 0;
+  p0.identity_token.binary_properties.props = NULL;
+#endif
   memcpy (&p0memcpy, &p0, sizeof (p0));
 
   /* manually alias one, so we can free it*/
   nn_plist_t p0alias;
   memcpy (&p0alias, &p0, sizeof (p0));
   p0alias.qos.partition.strs = ddsrt_memdup (p0alias.qos.partition.strs, p0.qos.partition.n * sizeof (*p0.qos.partition.strs));
+#ifdef DDSI_INCLUDE_SECURITY
+  p0alias.identity_token.properties.props = ddsrt_memdup (p0alias.identity_token.properties.props,
+                                              p0.identity_token.properties.n * sizeof (*p0.identity_token.properties.props));
+#endif
   nn_plist_fini (&p0alias);
   CU_ASSERT (memcmp (&p0, &p0memcpy, sizeof (p0)) == 0);
   CU_ASSERT_STRING_EQUAL (p0.entity_name, "nemo");
   CU_ASSERT_STRING_EQUAL (p0.qos.partition.strs[0], p0strs[0]);
   CU_ASSERT_STRING_EQUAL (p0.qos.partition.strs[1], p0strs[1]);
   CU_ASSERT_STRING_EQUAL (p0.qos.partition.strs[2], p0strs[2]);
+#ifdef DDSI_INCLUDE_SECURITY
+  CU_ASSERT_STRING_EQUAL (p0.identity_token.properties.props[0].name,  p0strs[3]);
+  CU_ASSERT_STRING_EQUAL (p0.identity_token.properties.props[0].value, p0strs[4]);
+  CU_ASSERT_STRING_EQUAL (p0.identity_token.properties.props[1].name,  p0strs[5]);
+  CU_ASSERT_STRING_EQUAL (p0.identity_token.properties.props[1].value, p0strs[6]);
+#endif
 
   /* copy an aliased one; the original must be unchanged, the copy unaliased */
   nn_plist_t p1;
@@ -67,6 +92,24 @@ CU_Test (ddsi_plist, unalias_copy_merge)
   CU_ASSERT_STRING_EQUAL (p1.qos.partition.strs[0], p0.qos.partition.strs[0]);
   CU_ASSERT_STRING_EQUAL (p1.qos.partition.strs[1], p0.qos.partition.strs[1]);
   CU_ASSERT_STRING_EQUAL (p1.qos.partition.strs[2], p0.qos.partition.strs[2]);
+#ifdef DDSI_INCLUDE_SECURITY
+  CU_ASSERT (p1.identity_token.class_id != p0.identity_token.class_id);
+  CU_ASSERT_STRING_EQUAL (p1.identity_token.class_id, p0.identity_token.class_id);
+  CU_ASSERT (p1.identity_token.properties.n == p0.identity_token.properties.n);
+  CU_ASSERT (p1.identity_token.properties.props != p0.identity_token.properties.props);
+  CU_ASSERT (p1.identity_token.properties.props[0].name != p0.identity_token.properties.props[0].name);
+  CU_ASSERT (p1.identity_token.properties.props[0].value != p0.identity_token.properties.props[0].value);
+  CU_ASSERT (p1.identity_token.properties.props[0].propagate == p0.identity_token.properties.props[0].propagate);
+  CU_ASSERT (p1.identity_token.properties.props[1].name != p0.identity_token.properties.props[1].name);
+  CU_ASSERT (p1.identity_token.properties.props[1].value != p0.identity_token.properties.props[1].value);
+  CU_ASSERT (p1.identity_token.properties.props[1].propagate == p0.identity_token.properties.props[1].propagate);
+  CU_ASSERT_STRING_EQUAL (p1.identity_token.properties.props[0].name, p0.identity_token.properties.props[0].name);
+  CU_ASSERT_STRING_EQUAL (p1.identity_token.properties.props[0].value, p0.identity_token.properties.props[0].value);
+  CU_ASSERT_STRING_EQUAL (p1.identity_token.properties.props[1].name, p0.identity_token.properties.props[1].name);
+  CU_ASSERT_STRING_EQUAL (p1.identity_token.properties.props[1].value, p0.identity_token.properties.props[1].value);
+  CU_ASSERT (p1.identity_token.binary_properties.n == 0);
+  CU_ASSERT (p1.identity_token.binary_properties.props == NULL);
+#endif
 
   /* merge-in missing ones from an aliased copy: original must remain unchanged;
      existing ones should stay without touching "aliased" only new ones are
@@ -94,6 +137,24 @@ CU_Test (ddsi_plist, unalias_copy_merge)
   CU_ASSERT_STRING_EQUAL (p2.qos.partition.strs[0], p0.qos.partition.strs[0]);
   CU_ASSERT_STRING_EQUAL (p2.qos.partition.strs[1], p0.qos.partition.strs[1]);
   CU_ASSERT_STRING_EQUAL (p2.qos.partition.strs[2], p0.qos.partition.strs[2]);
+#ifdef DDSI_INCLUDE_SECURITY
+  CU_ASSERT (p2.identity_token.class_id != p0.identity_token.class_id);
+  CU_ASSERT_STRING_EQUAL (p2.identity_token.class_id, p0.identity_token.class_id);
+  CU_ASSERT (p2.identity_token.properties.n == p0.identity_token.properties.n);
+  CU_ASSERT (p2.identity_token.properties.props != p0.identity_token.properties.props);
+  CU_ASSERT (p2.identity_token.properties.props[0].name != p0.identity_token.properties.props[0].name);
+  CU_ASSERT (p2.identity_token.properties.props[0].value != p0.identity_token.properties.props[0].value);
+  CU_ASSERT (p2.identity_token.properties.props[0].propagate == p0.identity_token.properties.props[0].propagate);
+  CU_ASSERT (p2.identity_token.properties.props[1].name != p0.identity_token.properties.props[1].name);
+  CU_ASSERT (p2.identity_token.properties.props[1].value != p0.identity_token.properties.props[1].value);
+  CU_ASSERT (p2.identity_token.properties.props[1].propagate == p0.identity_token.properties.props[1].propagate);
+  CU_ASSERT_STRING_EQUAL (p2.identity_token.properties.props[0].name, p0.identity_token.properties.props[0].name);
+  CU_ASSERT_STRING_EQUAL (p2.identity_token.properties.props[0].value, p0.identity_token.properties.props[0].value);
+  CU_ASSERT_STRING_EQUAL (p2.identity_token.properties.props[1].name, p0.identity_token.properties.props[1].name);
+  CU_ASSERT_STRING_EQUAL (p2.identity_token.properties.props[1].value, p0.identity_token.properties.props[1].value);
+  CU_ASSERT (p2.identity_token.binary_properties.n == 0);
+  CU_ASSERT (p2.identity_token.binary_properties.props == NULL);
+#endif
 
   /* unalias of p0, partition.strs mustn't change, because it, unlike its elements, wasn't aliased */
   nn_plist_unalias (&p0);
@@ -112,6 +173,17 @@ CU_Test (ddsi_plist, unalias_copy_merge)
   CU_ASSERT_STRING_EQUAL (p0.qos.partition.strs[0], p0strs[0]);
   CU_ASSERT_STRING_EQUAL (p0.qos.partition.strs[1], p0strs[1]);
   CU_ASSERT_STRING_EQUAL (p0.qos.partition.strs[2], p0strs[2]);
+#ifdef DDSI_INCLUDE_SECURITY
+  CU_ASSERT (p0.identity_token.properties.props[0].name  != p0strs[3]);
+  CU_ASSERT (p0.identity_token.properties.props[0].value != p0strs[4]);
+  CU_ASSERT (p0.identity_token.properties.props[1].name  != p0strs[5]);
+  CU_ASSERT (p0.identity_token.properties.props[1].value != p0strs[6]);
+  CU_ASSERT_STRING_EQUAL (p0.identity_token.properties.props[0].name,  p0strs[3]);
+  CU_ASSERT_STRING_EQUAL (p0.identity_token.properties.props[0].value, p0strs[4]);
+  CU_ASSERT_STRING_EQUAL (p0.identity_token.properties.props[1].name,  p0strs[5]);
+  CU_ASSERT_STRING_EQUAL (p0.identity_token.properties.props[1].value, p0strs[6]);
+#endif
+
   memcpy (&p0memcpy, &p0, sizeof (p0));
 
   /* copy an aliased one; the original must be unchanged, the copy unaliased */
@@ -134,6 +206,24 @@ CU_Test (ddsi_plist, unalias_copy_merge)
   CU_ASSERT_STRING_EQUAL (p3.qos.partition.strs[0], p0.qos.partition.strs[0]);
   CU_ASSERT_STRING_EQUAL (p3.qos.partition.strs[1], p0.qos.partition.strs[1]);
   CU_ASSERT_STRING_EQUAL (p3.qos.partition.strs[2], p0.qos.partition.strs[2]);
+#ifdef DDSI_INCLUDE_SECURITY
+  CU_ASSERT (p3.identity_token.class_id != p0.identity_token.class_id);
+  CU_ASSERT_STRING_EQUAL (p3.identity_token.class_id, p0.identity_token.class_id);
+  CU_ASSERT (p3.identity_token.properties.n == p0.identity_token.properties.n);
+  CU_ASSERT (p3.identity_token.properties.props != p0.identity_token.properties.props);
+  CU_ASSERT (p3.identity_token.properties.props[0].name != p0.identity_token.properties.props[0].name);
+  CU_ASSERT (p3.identity_token.properties.props[0].value != p0.identity_token.properties.props[0].value);
+  CU_ASSERT (p3.identity_token.properties.props[0].propagate == p0.identity_token.properties.props[0].propagate);
+  CU_ASSERT (p3.identity_token.properties.props[1].name != p0.identity_token.properties.props[1].name);
+  CU_ASSERT (p3.identity_token.properties.props[1].value != p0.identity_token.properties.props[1].value);
+  CU_ASSERT (p3.identity_token.properties.props[1].propagate == p0.identity_token.properties.props[1].propagate);
+  CU_ASSERT_STRING_EQUAL (p3.identity_token.properties.props[0].name, p0.identity_token.properties.props[0].name);
+  CU_ASSERT_STRING_EQUAL (p3.identity_token.properties.props[0].value, p0.identity_token.properties.props[0].value);
+  CU_ASSERT_STRING_EQUAL (p3.identity_token.properties.props[1].name, p0.identity_token.properties.props[1].name);
+  CU_ASSERT_STRING_EQUAL (p3.identity_token.properties.props[1].value, p0.identity_token.properties.props[1].value);
+  CU_ASSERT (p3.identity_token.binary_properties.n == 0);
+  CU_ASSERT (p3.identity_token.binary_properties.props == NULL);
+#endif
 
   /* merge-in missing ones from an aliased copy: original must remain unchanged;
      existing ones should stay without touching "aliased" only new ones are
@@ -161,6 +251,24 @@ CU_Test (ddsi_plist, unalias_copy_merge)
   CU_ASSERT_STRING_EQUAL (p4.qos.partition.strs[0], p0.qos.partition.strs[0]);
   CU_ASSERT_STRING_EQUAL (p4.qos.partition.strs[1], p0.qos.partition.strs[1]);
   CU_ASSERT_STRING_EQUAL (p4.qos.partition.strs[2], p0.qos.partition.strs[2]);
+#ifdef DDSI_INCLUDE_SECURITY
+  CU_ASSERT (p4.identity_token.class_id != p0.identity_token.class_id);
+  CU_ASSERT_STRING_EQUAL (p4.identity_token.class_id, p0.identity_token.class_id);
+  CU_ASSERT (p4.identity_token.properties.n == p0.identity_token.properties.n);
+  CU_ASSERT (p4.identity_token.properties.props != p0.identity_token.properties.props);
+  CU_ASSERT (p4.identity_token.properties.props[0].name != p0.identity_token.properties.props[0].name);
+  CU_ASSERT (p4.identity_token.properties.props[0].value != p0.identity_token.properties.props[0].value);
+  CU_ASSERT (p4.identity_token.properties.props[0].propagate == p0.identity_token.properties.props[0].propagate);
+  CU_ASSERT (p4.identity_token.properties.props[1].name != p0.identity_token.properties.props[1].name);
+  CU_ASSERT (p4.identity_token.properties.props[1].value != p0.identity_token.properties.props[1].value);
+  CU_ASSERT (p4.identity_token.properties.props[1].propagate == p0.identity_token.properties.props[1].propagate);
+  CU_ASSERT_STRING_EQUAL (p4.identity_token.properties.props[0].name, p0.identity_token.properties.props[0].name);
+  CU_ASSERT_STRING_EQUAL (p4.identity_token.properties.props[0].value, p0.identity_token.properties.props[0].value);
+  CU_ASSERT_STRING_EQUAL (p4.identity_token.properties.props[1].name, p0.identity_token.properties.props[1].name);
+  CU_ASSERT_STRING_EQUAL (p4.identity_token.properties.props[1].value, p0.identity_token.properties.props[1].value);
+  CU_ASSERT (p4.identity_token.binary_properties.n == 0);
+  CU_ASSERT (p4.identity_token.binary_properties.props == NULL);
+#endif
 
   nn_plist_fini (&p0);
   nn_plist_fini (&p1);

From 7c1e47218d1ab84e84083dfc6e8d84161215c803 Mon Sep 17 00:00:00 2001
From: martinbremmer <37294015+martinbremmer@users.noreply.github.com>
Date: Fri, 11 Oct 2019 15:43:30 +0200
Subject: [PATCH 070/238] Added DDS Security XML configuration elements. (#268)

* Added DDS Security XML configuration elements.

Signed-off-by: Martin Bremmer <martin.bremmer@adlinktech.com>

* Extended security configuration tests.

Signed-off-by: Martin Bremmer <martin.bremmer@adlinktech.com>

* Updated security conf to qos conversion.

Signed-off-by: Martin Bremmer <martin.bremmer@adlinktech.com>
---
 src/core/ddsc/tests/CMakeLists.txt        |   3 +-
 src/core/ddsc/tests/config.c              | 382 ++++++++++++++++++++++
 src/core/ddsi/include/dds/ddsi/q_config.h |  39 +++
 src/core/ddsi/include/dds/ddsi/q_misc.h   |   2 +-
 src/core/ddsi/include/dds/ddsi/q_xqos.h   |   4 +
 src/core/ddsi/src/q_config.c              | 164 ++++++++++
 src/core/ddsi/src/q_entity.c              |   9 +
 src/core/ddsi/src/q_plist.c               |  49 +++
 8 files changed, 650 insertions(+), 2 deletions(-)

diff --git a/src/core/ddsc/tests/CMakeLists.txt b/src/core/ddsc/tests/CMakeLists.txt
index a15d9b2..d128134 100644
--- a/src/core/ddsc/tests/CMakeLists.txt
+++ b/src/core/ddsc/tests/CMakeLists.txt
@@ -54,7 +54,8 @@ set(ddsc_test_sources
 add_cunit_executable(cunit_ddsc ${ddsc_test_sources})
 target_include_directories(
   cunit_ddsc PRIVATE
-  "$<BUILD_INTERFACE:${CMAKE_BINARY_DIR}/src/include/>")
+  "$<BUILD_INTERFACE:${CMAKE_BINARY_DIR}/src/include/>"
+  "$<BUILD_INTERFACE:${CMAKE_CURRENT_SOURCE_DIR}/../../ddsi/include/>")
 target_link_libraries(cunit_ddsc PRIVATE RoundTrip Space TypesArrayKey ddsc)
 
 # Setup environment for config-tests
diff --git a/src/core/ddsc/tests/config.c b/src/core/ddsc/tests/config.c
index 3c9acb0..248cc5c 100644
--- a/src/core/ddsc/tests/config.c
+++ b/src/core/ddsc/tests/config.c
@@ -19,6 +19,7 @@
 #include "dds/ddsrt/cdtors.h"
 #include "dds/ddsrt/environ.h"
 #include "dds/ddsrt/heap.h"
+#include "dds/ddsi/q_misc.h"
 
 #define FORCE_ENV
 
@@ -118,3 +119,384 @@ CU_Test(ddsc_config, incorrect_config, .init = ddsrt_init, .fini = ddsrt_fini) {
          "</"DDS_PROJECT_NAME">") == DDS_RETCODE_OK);
     CU_ASSERT_FATAL(dds_create_domain(2, "") == DDS_RETCODE_PRECONDITION_NOT_MET);
 }
+
+/*
+ * The 'found' variable will contain flags related to the expected log
+ * messages that were received.
+ * Using flags will allow to show that when message isn't received,
+ * which one it was.
+ */
+static uint32_t found;
+static void logger(void *ptr, const dds_log_data_t *data)
+{
+    char **expected = (char**)ptr;
+    for (uint32_t i = 0; expected[i] != NULL; i++) {
+        if (ddsi2_patmatch(expected[i], data->message)) {
+            found |= (uint32_t)(1 << i);
+        }
+    }
+}
+
+CU_Test(ddsc_config, security_non, .init = ddsrt_init, .fini = ddsrt_fini) {
+
+    /* There shouldn't be traces that mention security. */
+    const char *log_expected[] = {
+      "*Security*",
+      NULL
+    };
+
+    dds_entity_t participant;
+
+    /* Set up the trace sinks to detect the config parsing. */
+    dds_set_log_mask(DDS_LC_FATAL|DDS_LC_ERROR|DDS_LC_WARNING|DDS_LC_CONFIG);
+    dds_set_log_sink(&logger, (void*)log_expected);
+    dds_set_trace_sink(&logger, (void*)log_expected);
+
+    /* Create participant with an empty security element. */
+    found = 0;
+    ddsrt_setenv(URI_VARIABLE, "<Tracing><Verbosity>finest</></>");
+    participant = dds_create_participant(DDS_DOMAIN_DEFAULT, NULL, NULL);
+    ddsrt_setenv(URI_VARIABLE, "");
+    CU_ASSERT_FATAL(participant > 0);
+    dds_delete(participant);
+
+    /* No security traces should have been provided. */
+    CU_ASSERT_FATAL(found == 0x0);
+}
+
+CU_Test(ddsc_config, security_empty, .init = ddsrt_init, .fini = ddsrt_fini) {
+
+    /* Expected traces when creating participant with an empty security element. */
+    const char *log_expected[] = {
+#ifndef DDSI_INCLUDE_SECURITY
+      "config: //CycloneDDS/Domain: DDSSecurity: unknown element*",
+#else
+      "config: //CycloneDDS/Domain/DDSSecurity/Authentication/IdentityCertificate/#text: element missing in configuration*",
+      "config: //CycloneDDS/Domain/DDSSecurity/Authentication/IdentityCA/#text: element missing in configuration*",
+      "config: //CycloneDDS/Domain/DDSSecurity/Authentication/PrivateKey/#text: element missing in configuration*",
+#endif
+      NULL
+    };
+
+    dds_entity_t participant;
+
+    /* Set up the trace sinks to detect the config parsing. */
+    dds_set_log_mask(DDS_LC_FATAL|DDS_LC_ERROR|DDS_LC_WARNING|DDS_LC_CONFIG);
+    dds_set_log_sink(&logger, (void*)log_expected);
+    dds_set_trace_sink(&logger, (void*)log_expected);
+
+    /* Create participant with an empty security element. */
+    found = 0;
+    ddsrt_setenv(URI_VARIABLE, "<DDSSecurity/>");
+    participant = dds_create_participant(DDS_DOMAIN_DEFAULT, NULL, NULL);
+    ddsrt_setenv(URI_VARIABLE, "");
+    CU_ASSERT_FATAL(participant < 0);
+
+    /* All traces should have been provided. */
+#ifndef DDSI_INCLUDE_SECURITY
+    CU_ASSERT_FATAL(found == 0x1);
+#else
+    CU_ASSERT_FATAL(found == 0x7);
+#endif
+}
+
+CU_Test(ddsc_config, security_missing, .init = ddsrt_init, .fini = ddsrt_fini) {
+
+    /* Expected traces when creating participant with the security elements. */
+    const char *log_expected[] = {
+#ifndef DDSI_INCLUDE_SECURITY
+      "config: //CycloneDDS/Domain: DDSSecurity: unknown element*",
+#else
+      "config: //CycloneDDS/Domain/DDSSecurity/Authentication/IdentityCertificate/#text: element missing in configuration*",
+      "config: //CycloneDDS/Domain/DDSSecurity/Authentication/IdentityCA/#text: element missing in configuration*",
+      "config: //CycloneDDS/Domain/DDSSecurity/Authentication/PrivateKey/#text: element missing in configuration*",
+#endif
+      NULL
+    };
+
+    /* IdentityCertificate, IdentityCA and PrivateKey values or elements are missing. */
+    const char *sec_config =
+      "<Tracing><Verbosity>finest</></>"
+      "<DDSSecurity>"
+        "<Authentication>"
+          "<Library path=\"dds_security_auth\" initFunction=\"init_authentication\" finalizeFunction=\"finalize_authentication\" />"
+          "<IdentityCertificate></IdentityCertificate>"
+          "<PrivateKey></PrivateKey>"
+          "<Password>testtext_Password_testtext</Password>"
+        "</Authentication>"
+          "<Cryptographic>"
+            "<Library path=\"dds_security_crypto\" initFunction=\"init_crypto\" finalizeFunction=\"finalize_crypto\"/>"
+          "</Cryptographic>"
+        "<AccessControl>"
+          "<Library path=\"dds_security_ac\" initFunction=\"init_ac\" finalizeFunction=\"finalize_ac\"/>"
+          "<Governance>file:Governance.p7s</Governance>"
+          "<PermissionsCA>file:Permissions_CA.pem</PermissionsCA>"
+          "<Permissions>file:Permissions.p7s</Permissions>"
+        "</AccessControl>"
+      "</DDSSecurity>";
+
+
+    dds_entity_t participant;
+
+    /* Set up the trace sinks to detect the config parsing. */
+    dds_set_log_mask(DDS_LC_FATAL|DDS_LC_ERROR|DDS_LC_WARNING|DDS_LC_CONFIG);
+    dds_set_log_sink(&logger, (void*)log_expected);
+    dds_set_trace_sink(&logger, (void*)log_expected);
+
+    /* Create participant with an empty security element. */
+    found = 0;
+    ddsrt_setenv(URI_VARIABLE, sec_config);
+    participant = dds_create_participant(DDS_DOMAIN_DEFAULT, NULL, NULL);
+    ddsrt_setenv(URI_VARIABLE, "");
+    CU_ASSERT_FATAL(participant < 0);
+
+    /* All traces should have been provided. */
+#ifndef DDSI_INCLUDE_SECURITY
+    CU_ASSERT_FATAL(found == 0x1);
+#else
+    CU_ASSERT_FATAL(found == 0x7);
+#endif
+}
+
+CU_Test(ddsc_config, security_all, .init = ddsrt_init, .fini = ddsrt_fini) {
+
+    /* Expected traces when creating participant with the security elements. */
+    const char *log_expected[] = {
+#ifndef DDSI_INCLUDE_SECURITY
+      "config: //CycloneDDS/Domain: DDSSecurity: unknown element*",
+#else
+      "config: Domain/DDSSecurity/Authentication/Library/#text: dds_security_auth*",
+      "config: Domain/DDSSecurity/Authentication/Library[@path]: dds_security_auth*",
+      "config: Domain/DDSSecurity/Authentication/Library[@initFunction]: init_authentication*",
+      "config: Domain/DDSSecurity/Authentication/Library[@finalizeFunction]: finalize_authentication*",
+      "config: Domain/DDSSecurity/Authentication/IdentityCertificate/#text: testtext_IdentityCertificate_testtext*",
+      "config: Domain/DDSSecurity/Authentication/IdentityCA/#text: testtext_IdentityCA_testtext*",
+      "config: Domain/DDSSecurity/Authentication/PrivateKey/#text: testtext_PrivateKey_testtext*",
+      "config: Domain/DDSSecurity/Authentication/Password/#text: testtext_Password_testtext*",
+      "config: Domain/DDSSecurity/Authentication/TrustedCADirectory/#text: testtext_Dir_testtext*",
+      "config: Domain/DDSSecurity/AccessControl/Library/#text: dds_security_ac*",
+      "config: Domain/DDSSecurity/AccessControl/Library[@path]: dds_security_ac*",
+      "config: Domain/DDSSecurity/AccessControl/Library[@initFunction]: init_ac*",
+      "config: Domain/DDSSecurity/AccessControl/Library[@finalizeFunction]: finalize_ac*",
+      "config: Domain/DDSSecurity/AccessControl/PermissionsCA/#text: file:Permissions_CA.pem*",
+      "config: Domain/DDSSecurity/AccessControl/Governance/#text: file:Governance.p7s*",
+      "config: Domain/DDSSecurity/AccessControl/Permissions/#text: file:Permissions.p7s*",
+      "config: Domain/DDSSecurity/Cryptographic/Library/#text: dds_security_crypto*",
+      "config: Domain/DDSSecurity/Cryptographic/Library[@path]: dds_security_crypto*",
+      "config: Domain/DDSSecurity/Cryptographic/Library[@initFunction]: init_crypto*",
+      "config: Domain/DDSSecurity/Cryptographic/Library[@finalizeFunction]: finalize_crypto*",
+      /* The config should have been parsed into the participant QoS. */
+      "PARTICIPANT * QOS={*property_list={value={{dds.sec.auth.identity_ca,testtext_IdentityCA_testtext,0},{dds.sec.auth.private_key,testtext_PrivateKey_testtext,0},{dds.sec.auth.identity_certificate,testtext_IdentityCertificate_testtext,0},{dds.sec.access.permissions_ca,file:Permissions_CA.pem,0},{dds.sec.access.governance,file:Governance.p7s,0},{dds.sec.access.permissions,file:Permissions.p7s,0},{dds.sec.auth.password,testtext_Password_testtext,0},{dds.sec.auth.trusted_ca_dir,testtext_Dir_testtext,0}}binary_value={}}*}*",
+#endif
+      NULL
+    };
+
+    const char *sec_config =
+      "<"DDS_PROJECT_NAME">"
+        "<Domain id=\"any\">"
+          "<Tracing><Verbosity>finest</></>"
+          "<DDSSecurity>"
+            "<Authentication>"
+              "<Library path=\"dds_security_auth\" initFunction=\"init_authentication\" finalizeFunction=\"finalize_authentication\" />"
+              "<IdentityCertificate>testtext_IdentityCertificate_testtext</IdentityCertificate>"
+              "<IdentityCA>testtext_IdentityCA_testtext</IdentityCA>"
+              "<PrivateKey>testtext_PrivateKey_testtext</PrivateKey>"
+              "<Password>testtext_Password_testtext</Password>"
+              "<TrustedCADirectory>testtext_Dir_testtext</TrustedCADirectory>"
+            "</Authentication>"
+            "<Cryptographic>"
+              "<Library path=\"dds_security_crypto\" initFunction=\"init_crypto\" finalizeFunction=\"finalize_crypto\"/>"
+            "</Cryptographic>"
+            "<AccessControl>"
+              "<Library path=\"dds_security_ac\" initFunction=\"init_ac\" finalizeFunction=\"finalize_ac\"/>"
+              "<Governance>file:Governance.p7s</Governance>"
+              "<PermissionsCA>file:Permissions_CA.pem</PermissionsCA>"
+              "<Permissions>file:Permissions.p7s</Permissions>"
+            "</AccessControl>"
+          "</DDSSecurity>"
+        "</Domain>"
+      "</"DDS_PROJECT_NAME">";
+
+
+    dds_entity_t participant;
+
+    /* Set up the trace sinks to detect the config parsing. */
+    dds_set_log_mask(DDS_LC_FATAL|DDS_LC_ERROR|DDS_LC_WARNING|DDS_LC_CONFIG);
+    dds_set_log_sink(&logger, (void*)log_expected);
+    dds_set_trace_sink(&logger, (void*)log_expected);
+
+    /* Create participant with security elements. */
+    found = 0;
+    ddsrt_setenv(URI_VARIABLE, sec_config);
+    participant = dds_create_participant(DDS_DOMAIN_DEFAULT, NULL, NULL);
+    ddsrt_setenv(URI_VARIABLE, "");
+    dds_delete(participant);
+
+    /* All traces should have been provided. */
+#ifndef DDSI_INCLUDE_SECURITY
+    CU_ASSERT_FATAL(found == 0x1);
+#else
+    CU_ASSERT_FATAL(found == 0x1fffff);
+#endif
+}
+
+CU_Test(ddsc_config, security, .init = ddsrt_init, .fini = ddsrt_fini) {
+
+    /* Expected traces when creating participant with the security elements. */
+    const char *log_expected[] = {
+#ifndef DDSI_INCLUDE_SECURITY
+      "config: //CycloneDDS/Domain: DDSSecurity: unknown element*",
+#else
+      "config: Domain/DDSSecurity/Authentication/Library/#text: dds_security_auth*",
+      "config: Domain/DDSSecurity/Authentication/Library[@path]: dds_security_auth*",
+      "config: Domain/DDSSecurity/Authentication/Library[@initFunction]: init_authentication*",
+      "config: Domain/DDSSecurity/Authentication/Library[@finalizeFunction]: finalize_authentication*",
+      "config: Domain/DDSSecurity/Authentication/IdentityCertificate/#text: testtext_IdentityCertificate_testtext*",
+      "config: Domain/DDSSecurity/Authentication/IdentityCA/#text: testtext_IdentityCA_testtext*",
+      "config: Domain/DDSSecurity/Authentication/PrivateKey/#text: testtext_PrivateKey_testtext*",
+      "config: Domain/DDSSecurity/Authentication/Password/#text:  {}*",
+      "config: Domain/DDSSecurity/Authentication/TrustedCADirectory/#text:  {}*",
+      "config: Domain/DDSSecurity/AccessControl/Library/#text: dds_security_ac*",
+      "config: Domain/DDSSecurity/AccessControl/Library[@path]: dds_security_ac*",
+      "config: Domain/DDSSecurity/AccessControl/Library[@initFunction]: init_ac*",
+      "config: Domain/DDSSecurity/AccessControl/Library[@finalizeFunction]: finalize_ac*",
+      "config: Domain/DDSSecurity/AccessControl/PermissionsCA/#text: file:Permissions_CA.pem*",
+      "config: Domain/DDSSecurity/AccessControl/Governance/#text: file:Governance.p7s*",
+      "config: Domain/DDSSecurity/AccessControl/Permissions/#text: file:Permissions.p7s*",
+      "config: Domain/DDSSecurity/Cryptographic/Library/#text: dds_security_crypto*",
+      "config: Domain/DDSSecurity/Cryptographic/Library[@path]: dds_security_crypto*",
+      "config: Domain/DDSSecurity/Cryptographic/Library[@initFunction]: init_crypto*",
+      "config: Domain/DDSSecurity/Cryptographic/Library[@finalizeFunction]: finalize_crypto*",
+      /* The config should have been parsed into the participant QoS. */
+      "PARTICIPANT * QOS={*property_list={value={{dds.sec.auth.identity_ca,testtext_IdentityCA_testtext,0},{dds.sec.auth.private_key,testtext_PrivateKey_testtext,0},{dds.sec.auth.identity_certificate,testtext_IdentityCertificate_testtext,0},{dds.sec.access.permissions_ca,file:Permissions_CA.pem,0},{dds.sec.access.governance,file:Governance.p7s,0},{dds.sec.access.permissions,file:Permissions.p7s,0}}binary_value={}}*}*",
+#endif
+      NULL
+    };
+
+    const char *sec_config =
+      "<Tracing><Verbosity>finest</></>"
+      "<DDSSecurity>"
+        "<Authentication>"
+          "<Library path=\"dds_security_auth\" initFunction=\"init_authentication\" finalizeFunction=\"finalize_authentication\" />"
+          "<IdentityCertificate>testtext_IdentityCertificate_testtext</IdentityCertificate>"
+          "<IdentityCA>testtext_IdentityCA_testtext</IdentityCA>"
+          "<PrivateKey>testtext_PrivateKey_testtext</PrivateKey>"
+        "</Authentication>"
+          "<Cryptographic>"
+            "<Library path=\"dds_security_crypto\" initFunction=\"init_crypto\" finalizeFunction=\"finalize_crypto\"/>"
+          "</Cryptographic>"
+        "<AccessControl>"
+          "<Library path=\"dds_security_ac\" initFunction=\"init_ac\" finalizeFunction=\"finalize_ac\"/>"
+          "<Governance>file:Governance.p7s</Governance>"
+          "<PermissionsCA>file:Permissions_CA.pem</PermissionsCA>"
+          "<Permissions>file:Permissions.p7s</Permissions>"
+        "</AccessControl>"
+      "</DDSSecurity>";
+
+
+    dds_entity_t participant;
+
+    /* Set up the trace sinks to detect the config parsing. */
+    dds_set_log_mask(DDS_LC_FATAL|DDS_LC_ERROR|DDS_LC_WARNING|DDS_LC_CONFIG);
+    dds_set_log_sink(&logger, (void*)log_expected);
+    dds_set_trace_sink(&logger, (void*)log_expected);
+
+    /* Create participant with security elements. */
+    found = 0;
+    ddsrt_setenv(URI_VARIABLE, sec_config);
+    participant = dds_create_participant(DDS_DOMAIN_DEFAULT, NULL, NULL);
+    ddsrt_setenv(URI_VARIABLE, "");
+    dds_delete(participant);
+
+    /* All traces should have been provided. */
+#ifndef DDSI_INCLUDE_SECURITY
+    CU_ASSERT_FATAL(found == 0x1);
+#else
+    CU_ASSERT_FATAL(found == 0x1fffff);
+#endif
+}
+
+CU_Test(ddsc_config, security_deprecated, .init = ddsrt_init, .fini = ddsrt_fini) {
+
+    /* Expected traces when creating participant with the security elements. */
+    const char *log_expected[] = {
+#ifndef DDSI_INCLUDE_SECURITY
+      "config: //CycloneDDS/Domain: DDSSecurity: unknown element*",
+#else
+      "config: Domain/DDSSecurity/Authentication/Library/#text: dds_security_auth*",
+      "config: Domain/DDSSecurity/Authentication/Library[@path]: dds_security_auth*",
+      "config: Domain/DDSSecurity/Authentication/Library[@initFunction]: init_authentication*",
+      "config: Domain/DDSSecurity/Authentication/Library[@finalizeFunction]: finalize_authentication*",
+      "config: Domain/DDSSecurity/Authentication/IdentityCertificate/#text: testtext_IdentityCertificate_testtext*",
+      "config: Domain/DDSSecurity/Authentication/IdentityCA/#text: testtext_IdentityCA_testtext*",
+      "config: Domain/DDSSecurity/Authentication/PrivateKey/#text: testtext_PrivateKey_testtext*",
+      "config: Domain/DDSSecurity/Authentication/Password/#text: testtext_Password_testtext*",
+      "config: Domain/DDSSecurity/Authentication/TrustedCADirectory/#text: testtext_Dir_testtext*",
+      "config: Domain/DDSSecurity/AccessControl/Library/#text: dds_security_ac*",
+      "config: Domain/DDSSecurity/AccessControl/Library[@path]: dds_security_ac*",
+      "config: Domain/DDSSecurity/AccessControl/Library[@initFunction]: init_ac*",
+      "config: Domain/DDSSecurity/AccessControl/Library[@finalizeFunction]: finalize_ac*",
+      "config: Domain/DDSSecurity/AccessControl/PermissionsCA/#text: file:Permissions_CA.pem*",
+      "config: Domain/DDSSecurity/AccessControl/Governance/#text: file:Governance.p7s*",
+      "config: Domain/DDSSecurity/AccessControl/Permissions/#text: file:Permissions.p7s*",
+      "config: Domain/DDSSecurity/Cryptographic/Library/#text: dds_security_crypto*",
+      "config: Domain/DDSSecurity/Cryptographic/Library[@path]: dds_security_crypto*",
+      "config: Domain/DDSSecurity/Cryptographic/Library[@initFunction]: init_crypto*",
+      "config: Domain/DDSSecurity/Cryptographic/Library[@finalizeFunction]: finalize_crypto*",
+      /* The config should have been parsed into the participant QoS. */
+      "PARTICIPANT * QOS={*property_list={value={{dds.sec.auth.identity_ca,testtext_IdentityCA_testtext,0},{dds.sec.auth.private_key,testtext_PrivateKey_testtext,0},{dds.sec.auth.identity_certificate,testtext_IdentityCertificate_testtext,0},{dds.sec.access.permissions_ca,file:Permissions_CA.pem,0},{dds.sec.access.governance,file:Governance.p7s,0},{dds.sec.access.permissions,file:Permissions.p7s,0},{dds.sec.auth.password,testtext_Password_testtext,0},{dds.sec.auth.trusted_ca_dir,testtext_Dir_testtext,0}}binary_value={}}*}*",
+#endif
+      NULL
+    };
+
+    const char *sec_config =
+      "<"DDS_PROJECT_NAME">"
+        "<Domain>"
+          "<Id>any</Id>"
+        "</Domain>"
+        "<DDSI2E>"
+          "<DDSSecurity>"
+            "<Authentication>"
+              "<Library path=\"dds_security_auth\" initFunction=\"init_authentication\" finalizeFunction=\"finalize_authentication\" />"
+              "<IdentityCertificate>testtext_IdentityCertificate_testtext</IdentityCertificate>"
+              "<IdentityCA>testtext_IdentityCA_testtext</IdentityCA>"
+              "<PrivateKey>testtext_PrivateKey_testtext</PrivateKey>"
+              "<Password>testtext_Password_testtext</Password>"
+              "<TrustedCADirectory>testtext_Dir_testtext</TrustedCADirectory>"
+            "</Authentication>"
+            "<Cryptographic>"
+              "<Library path=\"dds_security_crypto\" initFunction=\"init_crypto\" finalizeFunction=\"finalize_crypto\"/>"
+            "</Cryptographic>"
+            "<AccessControl>"
+              "<Library path=\"dds_security_ac\" initFunction=\"init_ac\" finalizeFunction=\"finalize_ac\"/>"
+              "<Governance>file:Governance.p7s</Governance>"
+              "<PermissionsCA>file:Permissions_CA.pem</PermissionsCA>"
+              "<Permissions>file:Permissions.p7s</Permissions>"
+            "</AccessControl>"
+          "</DDSSecurity>"
+          "<Tracing><Verbosity>finest</></>"
+        "</DDSI2E>"
+      "</"DDS_PROJECT_NAME">";
+
+
+    dds_entity_t participant;
+
+    /* Set up the trace sinks to detect the config parsing. */
+    dds_set_log_mask(DDS_LC_FATAL|DDS_LC_ERROR|DDS_LC_WARNING|DDS_LC_CONFIG);
+    dds_set_log_sink(&logger, (void*)log_expected);
+    dds_set_trace_sink(&logger, (void*)log_expected);
+
+    /* Create participant with security elements. */
+    found = 0;
+    ddsrt_setenv(URI_VARIABLE, sec_config);
+    participant = dds_create_participant(DDS_DOMAIN_DEFAULT, NULL, NULL);
+    ddsrt_setenv(URI_VARIABLE, "");
+    dds_delete(participant);
+
+    /* All traces should have been provided. */
+#ifndef DDSI_INCLUDE_SECURITY
+    CU_ASSERT_FATAL(found == 0x1);
+#else
+    CU_ASSERT_FATAL(found == 0x1fffff);
+#endif
+}
diff --git a/src/core/ddsi/include/dds/ddsi/q_config.h b/src/core/ddsi/include/dds/ddsi/q_config.h
index f06a8cd..6708d31 100644
--- a/src/core/ddsi/include/dds/ddsi/q_config.h
+++ b/src/core/ddsi/include/dds/ddsi/q_config.h
@@ -210,6 +210,41 @@ enum many_sockets_mode {
   MSM_MANY_UNICAST
 };
 
+#ifdef DDSI_INCLUDE_SECURITY
+typedef struct plugin_library_properties_type{
+  char *library_path;
+  char *library_init;
+  char *library_finalize;
+} plugin_library_properties_type;
+
+typedef struct authentication_properties_type{
+  char *identity_certificate;
+  char *identity_ca;
+  char *private_key;
+  char *password;
+  char *trusted_ca_dir;
+} authentication_properties_type;
+
+typedef struct access_control_properties_type{
+  char *permissions;
+  char *permissions_ca;
+  char *governance;
+} access_control_properties_type;
+
+typedef struct omg_security_configuration_type {
+  authentication_properties_type authentication_properties;
+  access_control_properties_type access_control_properties;
+  plugin_library_properties_type authentication_plugin;
+  plugin_library_properties_type access_control_plugin;
+  plugin_library_properties_type cryptography_plugin;
+} omg_security_configuration_type;
+
+struct config_omg_security_listelem {
+  struct config_omg_security_listelem *next;
+  omg_security_configuration_type cfg;
+};
+#endif /* DDSI_INCLUDE_SECURITY */
+
 #ifdef DDSI_INCLUDE_SSL
 struct ssl_min_version {
   int major;
@@ -389,6 +424,10 @@ struct config
 
   int use_multicast_if_mreqn;
   struct prune_deleted_ppant prune_deleted_ppant;
+
+#ifdef DDSI_INCLUDE_SECURITY
+  struct config_omg_security_listelem *omg_security_configuration;
+#endif
 };
 
 struct cfgst;
diff --git a/src/core/ddsi/include/dds/ddsi/q_misc.h b/src/core/ddsi/include/dds/ddsi/q_misc.h
index f410ebb..569f342 100644
--- a/src/core/ddsi/include/dds/ddsi/q_misc.h
+++ b/src/core/ddsi/include/dds/ddsi/q_misc.h
@@ -35,7 +35,7 @@ unsigned char normalize_data_datafrag_flags (const SubmessageHeader_t *smhdr);
 int WildcardOverlap(char * p1, char * p2);
 #endif
 
-int ddsi2_patmatch (const char *pat, const char *str);
+DDS_EXPORT int ddsi2_patmatch (const char *pat, const char *str);
 
 uint32_t crc32_calc (const void *buf, size_t length);
 
diff --git a/src/core/ddsi/include/dds/ddsi/q_xqos.h b/src/core/ddsi/include/dds/ddsi/q_xqos.h
index cecd24b..30d8260 100644
--- a/src/core/ddsi/include/dds/ddsi/q_xqos.h
+++ b/src/core/ddsi/include/dds/ddsi/q_xqos.h
@@ -321,6 +321,10 @@ DDS_EXPORT uint64_t nn_xqos_delta (const dds_qos_t *a, const dds_qos_t *b, uint6
 DDS_EXPORT void nn_xqos_addtomsg (struct nn_xmsg *m, const dds_qos_t *xqos, uint64_t wanted);
 DDS_EXPORT void nn_log_xqos (uint32_t cat, const struct ddsrt_log_cfg *logcfg, const dds_qos_t *xqos);
 DDS_EXPORT dds_qos_t *nn_xqos_dup (const dds_qos_t *src);
+#ifdef DDSI_INCLUDE_SECURITY
+struct omg_security_configuration_type;
+DDS_EXPORT void nn_xqos_mergein_security_config (dds_qos_t *xqos, const struct omg_security_configuration_type *cfg);
+#endif
 
 #if defined (__cplusplus)
 }
diff --git a/src/core/ddsi/src/q_config.c b/src/core/ddsi/src/q_config.c
index fd1a911..c6dff08 100644
--- a/src/core/ddsi/src/q_config.c
+++ b/src/core/ddsi/src/q_config.c
@@ -217,6 +217,9 @@ DI(if_partition_mapping);
 #endif
 DI(if_peer);
 DI(if_thread_properties);
+#ifdef DDSI_INCLUDE_SECURITY
+DI(if_omg_security);
+#endif
 #undef DI
 
 #define CO(name) ((int) offsetof (struct config, name))
@@ -314,6 +317,149 @@ static const struct cfgelem security_cfgelems[] = {
 };
 #endif /* DDSI_INCLUDE_ENCRYPTION */
 
+#ifdef DDSI_INCLUDE_SECURITY
+/** Security Configuration */
+static const struct cfgelem authentication_library_attributes[] = {
+  { ATTR ("path"), 1, "dds_security_auth", RELOFF (config_omg_security_listelem, cfg.authentication_plugin.library_path), 0, uf_string, ff_free, pf_string,
+    BLURB("<p>This element points to the path of Authentication plugin library.</p>\n\
+<p>It can be either absolute path excluding file extension ( /usr/lib/dds_security_auth ) or single file without extension ( dds_security_auth ).</p>\n\
+<p>If single file is supplied, the library located by way of the current working directory, or LD_LIBRARY_PATH for Unix systems, and PATH for Windows systems.</p>") },
+  { ATTR ("initFunction"), 1, "init_authentication", RELOFF (config_omg_security_listelem, cfg.authentication_plugin.library_init), 0, uf_string, ff_free, pf_string,
+    BLURB("<p>This element names the initialization function of Authentication plugin. This function is called after loading the plugin library for instantiation purposes. Init function must return an object that implements DDS Security Authentication interface.</p>") },
+  { ATTR ("finalizeFunction"), 1, "finalize_authentication", RELOFF (config_omg_security_listelem, cfg.authentication_plugin.library_finalize), 0, uf_string, ff_free, pf_string,
+    BLURB("<p>This element names the finalization function of Authentication plugin. This function is called to let the plugin release its resources.</p>") },
+  END_MARKER
+};
+
+static const struct cfgelem access_control_library_attributes[] = {
+  { ATTR ("path"), 1, "dds_security_ac", RELOFF (config_omg_security_listelem, cfg.access_control_plugin.library_path), 0, uf_string, ff_free, pf_string,
+    BLURB("<p>This element points to the path of Access Control plugin library.</p>\n\
+<p>It can be either absolute path excluding file extension ( /usr/lib/dds_security_ac ) or single file without extension ( dds_security_ac ).</p>\n\
+<p>If single file is supplied, the library located by way of the current working directory, or LD_LIBRARY_PATH for Unix systems, and PATH for Windows systems.</p>") },
+  { ATTR ("initFunction"), 1, "init_access_control", RELOFF (config_omg_security_listelem, cfg.access_control_plugin.library_init), 0, uf_string, ff_free, pf_string,
+    BLURB("<p>This element names the initialization function of Access Control plugin. This function is called after loading the plugin library for instantiation purposes. Init function must return an object that implements DDS Security Access Control interface.</p>") },
+  { ATTR ("finalizeFunction"), 1, "finalize_access_control", RELOFF (config_omg_security_listelem, cfg.access_control_plugin.library_finalize), 0, uf_string, ff_free, pf_string,
+    BLURB("<p>This element names the finalization function of Access Control plugin. This function is called to let the plugin release its resources.</p>") },
+  END_MARKER
+};
+
+static const struct cfgelem cryptography_library_attributes[] = {
+  { ATTR ("path"), 1, "dds_security_crypto", RELOFF (config_omg_security_listelem, cfg.cryptography_plugin.library_path), 0, uf_string, ff_free, pf_string,
+    BLURB("<p>This element points to the path of Cryptographic plugin library.</p>\n\
+<p>It can be either absolute path excluding file extension ( /usr/lib/dds_security_crypto ) or single file without extension ( dds_security_crypto ).</p>\n\
+<p>If single file is supplied, the library located by way of the current working directory, or LD_LIBRARY_PATH for Unix systems, and PATH for Windows systems.</p>") },
+  { ATTR ("initFunction"), 1, "init_crypto", RELOFF (config_omg_security_listelem, cfg.cryptography_plugin.library_init), 0, uf_string, ff_free, pf_string,
+    BLURB("<p>This element names the initialization function of Cryptographic plugin. This function is called after loading the plugin library for instantiation purposes. Init function must return an object that implements DDS Security Cryptographic interface.</p>") },
+  { ATTR ("finalizeFunction"), 1, "finalize_crypto", RELOFF (config_omg_security_listelem, cfg.cryptography_plugin.library_finalize), 0, uf_string, ff_free, pf_string,
+    BLURB("<p>This element names the finalization function of Cryptographic plugin. This function is called to let the plugin release its resources.</p>") },
+  END_MARKER
+};
+
+
+static const struct cfgelem authentication_config_elements[] = {
+  { LEAF_W_ATTRS("Library", authentication_library_attributes), 1, "", RELOFF (config_omg_security_listelem, cfg.authentication_plugin), 0, 0, 0, pf_string,
+    BLURB("<p>This element specifies the library to be loaded as the DDS Security Access Control plugin.</p>") },
+  { LEAF ("IdentityCertificate"), 1, NULL, RELOFF (config_omg_security_listelem, cfg.authentication_properties.identity_certificate), 0, uf_string, ff_free, pf_string,
+    BLURB("<p>Identity certificate that will be used for identifying all participants in the OSPL instance.<br>The content is URI to a X509 certificate signed by the IdentityCA in PEM format containing the signed public key.</p>\n\
+<p>Supported URI schemes: file, data</p>\n\
+<p>Examples:</p>\n\
+<p><IdentityCertificate>file:participant1_identity_cert.pem</IdentityCertificate></p>\n\
+<p><IdentityCertificate>data:,-----BEGIN CERTIFICATE-----<br>\n\
+MIIDjjCCAnYCCQDCEu9...6rmT87dhTo=<br>\n\
+-----END CERTIFICATE-----</IdentityCertificate></p>") },
+  { LEAF ("IdentityCA"), 1, NULL, RELOFF (config_omg_security_listelem, cfg.authentication_properties.identity_ca), 0, uf_string, ff_free, pf_string,
+    BLURB("<p>URI to the X509 certificate [39] of the Identity CA that is the signer of Identity Certificate.</p>\n\
+<p>Supported URI schemes: file, data</p>\n\
+<p>The file and data schemas shall refer to a X.509 v3 certificate (see X.509 v3 ITU-T Recommendation X.509 (2005) [39]) in PEM format.</p>\n\
+<p>Examples:</p>\n\
+<p><IdentityCA>file:identity_ca.pem</IdentityCA></p>\n\
+<p><IdentityCA>data:,-----BEGIN CERTIFICATE-----<br>\n\
+MIIC3DCCAcQCCQCWE5x+Z...PhovK0mp2ohhRLYI0ZiyYQ==<br>\n\
+-----END CERTIFICATE-----</IdentityCA></p>") },
+  { LEAF ("PrivateKey"), 1, NULL, RELOFF (config_omg_security_listelem, cfg.authentication_properties.private_key), 0, uf_string, ff_free, pf_string,
+    BLURB("<p>URI to access the private Private Key for all of the participants in the OSPL federation.</p>\n\
+<p>Supported URI schemes: file, data</p>\n\
+<p>Examples:</p>\n\
+<p><PrivateKey>file:identity_ca_private_key.pem</PrivateKey></p>\n\
+<p><PrivateKey>data:,-----BEGIN RSA PRIVATE KEY-----<br>\n\
+MIIEpAIBAAKCAQEA3HIh...AOBaaqSV37XBUJg==<br>\n\
+-----END RSA PRIVATE KEY-----</PrivateKey></p>") },
+  { LEAF ("Password"), 1, "", RELOFF (config_omg_security_listelem, cfg.authentication_properties.password), 0, uf_string, ff_free, pf_string,
+    BLURB("<p>A password used to decrypt the private_key.</p>\n\
+The value of the password property shall be interpreted as the Base64 encoding of the AES-128 key that shall be used to decrypt the private_key using AES128-CBC.</p>\n\
+If the password property is not present, then the value supplied in the private_key property must contain the unencrypted private key. </p>") },
+  { LEAF ("TrustedCADirectory"), 1, "", RELOFF (config_omg_security_listelem, cfg.authentication_properties.trusted_ca_dir), 0, uf_string, ff_free, pf_string,
+    BLURB("<p>Trusted CA Directory which contains trusted CA certificates as separated files.</p>") },
+
+  END_MARKER
+};
+
+static const struct cfgelem access_control_config_elements[] = {
+  { LEAF_W_ATTRS("Library", access_control_library_attributes), 1, "", RELOFF (config_omg_security_listelem, cfg.access_control_plugin), 0, 0, 0, pf_string,
+    BLURB("<p>This element specifies the library to be loaded as the DDS Security Access Control plugin.</p>") },
+  { LEAF ("PermissionsCA"), 1, "", RELOFF (config_omg_security_listelem, cfg.access_control_properties.permissions_ca), 0, uf_string, ff_free, pf_string,
+    BLURB("<p>URI to a X509 certificate for the PermissionsCA in PEM format.</p>\n\
+<p>Supported URI schemes: file, data</p>\n\
+<p>The file and data schemas shall refer to a X.509 v3 certificate (see X.509 v3 ITU-T Recommendation X.509 (2005) [39]) in PEM format.</p><br>\n\
+<p>Examples:</p><br>\n\
+<p><PermissionsCA>file:permissions_ca.pem</PermissionsCA></p>\n\
+<p><PermissionsCA>file:/home/myuser/permissions_ca.pem</PermissionsCA></p><br>\n\
+<p><PermissionsCA>data:<strong>,</strong>-----BEGIN CERTIFICATE-----</p>\n\
+<p>MIIC3DCCAcQCCQCWE5x+Z ... PhovK0mp2ohhRLYI0ZiyYQ==</p>\n\
+<p>-----END CERTIFICATE-----</PermissionsCA></p>") },
+  { LEAF ("Governance"), 1, "", RELOFF (config_omg_security_listelem, cfg.access_control_properties.governance), 0, uf_string, ff_free, pf_string,
+    BLURB("<p>URI to the shared Governance Document signed by the Permissions CA in S/MIME format</p>\n\
+<p>URI schemes: file, data</p><br>\n\
+<p>Examples file URIs:</p>\n\
+<p><Governance>file:governance.smime</Governance></p>\n\
+<p><Governance>file:/home/myuser/governance.smime</Governance></p><br>\n\
+<p><Governance><![CDATA[data:,MIME-Version: 1.0</p>\n\
+<p>Content-Type: multipart/signed; protocol=\"application/x-pkcs7-signature\"; micalg=\"sha-256\"; boundary=\"----F9A8A198D6F08E1285A292ADF14DD04F\"</p>\n\
+<p>This is an S/MIME signed message </p>\n\
+<p>------F9A8A198D6F08E1285A292ADF14DD04F</p>\n\
+<p><?xml version=\"1.0\" encoding=\"UTF-8\"?></p>\n\
+<p><dds xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\"</p>\n\
+<p>xsi:noNamespaceSchemaLocation=\"omg_shared_ca_governance.xsd\"></p>\n\
+<p><domain_access_rules></p>\n\
+<p> . . . </p>\n\
+<p></domain_access_rules></p>\n\
+<p></dds></p>\n\
+<p>...</p>\n\
+<p>------F9A8A198D6F08E1285A292ADF14DD04F</p>\n\
+<p>Content-Type: application/x-pkcs7-signature; name=\"smime.p7s\"</p>\n\
+<p>Content-Transfer-Encoding: base64</p>\n\
+<p>Content-Disposition: attachment; filename=\"smime.p7s\"</p>\n\
+<p>MIIDuAYJKoZIhv ...al5s=</p>\n\
+<p>------F9A8A198D6F08E1285A292ADF14DD04F-]]</Governance></p>") },
+  { LEAF ("Permissions"), 1, "", RELOFF (config_omg_security_listelem, cfg.access_control_properties.permissions), 0, uf_string, ff_free, pf_string,
+    BLURB("<p>URI to the DomainParticipant permissions document signed by the Permissions CA in S/MIME format</p>\n\
+<p>The permissions document specifies the permissions to be applied to a domain.</p><br>\n\
+<p>Example file URIs:</p>\n\
+<p><Permissions>file:permissions_document.p7s</Permissions></p>\n\
+<p><Permissions>file:/path_to/permissions_document.p7s</Permissions></p>\n\
+<p>Example data URI:</p>\n\
+<p><Permissions><![CDATA[data:,.........]]</Permissions></p>") },
+  END_MARKER
+};
+
+static const struct cfgelem cryptography_config_elements[] = {
+  { LEAF_W_ATTRS("Library", cryptography_library_attributes), 1, "", RELOFF (config_omg_security_listelem, cfg.cryptography_plugin), 0, 0, 0, pf_string,
+    BLURB("<p>This element specifies the library to be loaded as the DDS Security Cryptographic plugin.</p>") },
+  END_MARKER
+};
+
+static const struct cfgelem security_omg_config_elements[] = {
+  { GROUP ("Authentication", authentication_config_elements),
+    BLURB("<p>This element configures the Authentication plugin of the DDS Security specification.</p>") },
+  { GROUP ("AccessControl", access_control_config_elements),
+    BLURB("<p>This element configures the Access Control plugin of the DDS Security specification.</p>") },
+  { GROUP ("Cryptographic", cryptography_config_elements),
+    BLURB("<p>This element configures the Cryptographic plugin of the DDS Security specification.</p>") },
+  END_MARKER
+};
+#endif /* DDSI_INCLUDE_SECURITY */
+
+
 #ifdef DDSI_INCLUDE_NETWORK_PARTITIONS
 static const struct cfgelem networkpartition_cfgattrs[] = {
   { ATTR("Name"), 1, NULL, RELOFF(config_networkpartition_listelem, name), 0, uf_string, ff_free, pf_string,
@@ -814,6 +960,10 @@ static const struct cfgelem domain_cfgelems[] = {
   { GROUP("Security", security_cfgelems),
     BLURB("<p>The Security element specifies DDSI2E security profiles that can be used to encrypt traffic mapped to DDSI2E network partitions.</p>") },
 #endif
+#ifdef DDSI_INCLUDE_SECURITY
+  { MGROUP ("DDSSecurity", security_omg_config_elements, NULL), INT_MAX, NULL, ABSOFF(omg_security_configuration), if_omg_security, 0, 0, 0,
+    BLURB("<p>This element is used to configure DDSI2E with the DDS Security specification plugins and settings.</p>") },
+#endif
 #ifdef DDSI_INCLUDE_NETWORK_PARTITIONS
   { GROUP("Partitioning", partitioning_cfgelems),
     BLURB("<p>The Partitioning element specifies DDSI2E network partitions and how DCPS partition/topic combinations are mapped onto the network partitions.</p>") },
@@ -866,6 +1016,9 @@ static const struct cfgelem root_cfgelems[] = {
   { MOVED("Internal|Unsupported", "CycloneDDS/Domain/Internal") },
   { MOVED("TCP", "CycloneDDS/Domain/TCP") },
   { MOVED("ThreadPool", "CycloneDDS/Domain/ThreadPool") },
+#ifdef DDSI_INCLUDE_SECURITY
+  { MOVED("DDSSecurity", "CycloneDDS/Domain/DDSSecurity") },
+#endif
 #ifdef DDSI_INCLUDE_SSL
   { MOVED("SSL", "CycloneDDS/Domain/SSL") },
 #endif
@@ -1310,6 +1463,17 @@ static int if_peer (struct cfgst *cfgst, void *parent, struct cfgelem const * co
   return 0;
 }
 
+#ifdef DDSI_INCLUDE_SECURITY
+static int if_omg_security (struct cfgst *cfgst, void *parent, struct cfgelem const * const cfgelem)
+{
+  struct config_omg_security_listelem *new = if_common (cfgst, parent, cfgelem, sizeof (struct config_omg_security_listelem));
+  if (new == NULL)
+    return -1;
+  memset(&new->cfg, 0, sizeof(new->cfg));
+  return 0;
+}
+#endif
+
 static void ff_free (struct cfgst *cfgst, void *parent, struct cfgelem const * const cfgelem)
 {
   void ** const elem = cfg_address (cfgst, parent, cfgelem);
diff --git a/src/core/ddsi/src/q_entity.c b/src/core/ddsi/src/q_entity.c
index 24add4d..5d02d37 100644
--- a/src/core/ddsi/src/q_entity.c
+++ b/src/core/ddsi/src/q_entity.c
@@ -516,6 +516,15 @@ dds_return_t new_participant_guid (const ddsi_guid_t *ppguid, struct q_globals *
   nn_plist_copy (pp->plist, plist);
   nn_plist_mergein_missing (pp->plist, &gv->default_local_plist_pp, ~(uint64_t)0, ~(uint64_t)0);
 
+#ifdef DDSI_INCLUDE_SECURITY
+  if (gv->config.omg_security_configuration)
+  {
+    /* For security, configuration can be provided through the configuration.
+     * However, the specification (and the plugins) expect it to be in the QoS. */
+    nn_xqos_mergein_security_config(&(pp->plist->qos), &(gv->config.omg_security_configuration->cfg));
+  }
+#endif
+
   if (gv->logconfig.c.mask & DDS_LC_DISCOVERY)
   {
     GVLOGDISC ("PARTICIPANT "PGUIDFMT" QOS={", PGUID (pp->e.guid));
diff --git a/src/core/ddsi/src/q_plist.c b/src/core/ddsi/src/q_plist.c
index 74114f5..8b637f0 100644
--- a/src/core/ddsi/src/q_plist.c
+++ b/src/core/ddsi/src/q_plist.c
@@ -2760,6 +2760,55 @@ dds_qos_t * nn_xqos_dup (const dds_qos_t *src)
   return dst;
 }
 
+#ifdef DDSI_INCLUDE_SECURITY
+static void fill_property(dds_property_t *prop, const char *name, const char *value)
+{
+  prop->name = ddsrt_strdup(name);
+  prop->value = ddsrt_strdup(value);
+  prop->propagate = false;
+}
+
+void nn_xqos_mergein_security_config (dds_qos_t *xqos, const struct omg_security_configuration_type *cfg)
+{
+  if (cfg)
+  {
+    /* Add DDS Security configuration to the QoS as a Property policy,
+     * used by the security plugins to get their proper settings. */
+    dds_property_t *properties;
+    uint32_t idx = 0;
+
+    /* No property should be present yet. */
+    assert(!(xqos->present & QP_PROPERTY_LIST));
+
+    /* Prepare properties. */
+    properties = ddsrt_malloc(8 /* max */ * sizeof (dds_property_t));
+
+    /* Fill properties. */
+    fill_property(&(properties[idx++]), "dds.sec.auth.identity_ca", cfg->authentication_properties.identity_ca);
+    fill_property(&(properties[idx++]), "dds.sec.auth.private_key", cfg->authentication_properties.private_key);
+    fill_property(&(properties[idx++]), "dds.sec.auth.identity_certificate", cfg->authentication_properties.identity_certificate);
+    fill_property(&(properties[idx++]), "dds.sec.access.permissions_ca", cfg->access_control_properties.permissions_ca);
+    fill_property(&(properties[idx++]), "dds.sec.access.governance", cfg->access_control_properties.governance);
+    fill_property(&(properties[idx++]), "dds.sec.access.permissions", cfg->access_control_properties.permissions);
+    if (cfg->authentication_properties.password && (strlen(cfg->authentication_properties.password) != 0))
+    {
+      fill_property(&(properties[idx++]), "dds.sec.auth.password", cfg->authentication_properties.password);
+    }
+    if (cfg->authentication_properties.trusted_ca_dir && (strlen(cfg->authentication_properties.trusted_ca_dir) != 0))
+    {
+      fill_property(&(properties[idx++]), "dds.sec.auth.trusted_ca_dir", cfg->authentication_properties.trusted_ca_dir);
+    }
+
+    /* Add properties. */
+    xqos->present |= QP_PROPERTY_LIST;
+    xqos->property.value.n = idx;
+    xqos->property.value.props = properties;
+    xqos->property.binary_value.n = 0;
+    xqos->property.binary_value.props = NULL;
+  }
+}
+#endif /* DDSI_INCLUDE_SECURITY */
+
 static int partition_is_default (const dds_partition_qospolicy_t *a)
 {
   uint32_t i;

From 64cc6311379db957390dddc94f6bd154552e676a Mon Sep 17 00:00:00 2001
From: martinbremmer <37294015+martinbremmer@users.noreply.github.com>
Date: Fri, 18 Oct 2019 19:05:13 +0200
Subject: [PATCH 071/238] Participant generic message (#273)

* Extended DDSI (de)serializer.

Signed-off-by: Martin Bremmer <martin.bremmer@adlinktech.com>

* Added security Participant Generic Message.

Signed-off-by: Martin Bremmer <martin.bremmer@adlinktech.com>

* Updated Participant Generic Message.

Signed-off-by: Martin Bremmer <martin.bremmer@adlinktech.com>

* Updated generic ddsi (de)serializer.

Signed-off-by: Martin Bremmer <martin.bremmer@adlinktech.com>

* Changed macros for functions.

Signed-off-by: Martin Bremmer <martin.bremmer@adlinktech.com>
---
 src/core/ddsi/CMakeLists.txt                  |  11 +
 .../include/dds/ddsi/ddsi_plist_generic.h     |  10 +-
 .../ddsi/include/dds/ddsi/ddsi_security_msg.h |  91 +++++
 src/core/ddsi/include/dds/ddsi/q_plist.h      |   5 +
 src/core/ddsi/src/ddsi_security_msg.c         | 149 ++++++++
 src/core/ddsi/src/q_plist.c                   | 253 ++++++++++----
 src/core/ddsi/tests/CMakeLists.txt            |   7 +-
 src/core/ddsi/tests/mem_ser.h                 |  55 +++
 src/core/ddsi/tests/plist_generic.c           |  66 ++--
 src/core/ddsi/tests/security_msg.c            | 328 ++++++++++++++++++
 10 files changed, 881 insertions(+), 94 deletions(-)
 create mode 100644 src/core/ddsi/include/dds/ddsi/ddsi_security_msg.h
 create mode 100644 src/core/ddsi/src/ddsi_security_msg.c
 create mode 100644 src/core/ddsi/tests/mem_ser.h
 create mode 100644 src/core/ddsi/tests/security_msg.c

diff --git a/src/core/ddsi/CMakeLists.txt b/src/core/ddsi/CMakeLists.txt
index 988b58c..2e5cf1b 100644
--- a/src/core/ddsi/CMakeLists.txt
+++ b/src/core/ddsi/CMakeLists.txt
@@ -123,6 +123,17 @@ PREPEND(hdrs_private_ddsi "${CMAKE_CURRENT_LIST_DIR}/include/dds/ddsi"
 target_sources(ddsc
   PRIVATE ${srcs_ddsi} ${hdrs_private_ddsi})
 
+if(ENABLE_SECURITY)
+  PREPEND(security_srcs "${CMAKE_CURRENT_LIST_DIR}/src"
+          ddsi_security_msg.c)
+
+  PREPEND(security_hdrs "${CMAKE_CURRENT_LIST_DIR}/include/dds/ddsi"
+          ddsi_security_msg.h)
+
+  target_sources(ddsc
+    PRIVATE ${security_srcs} ${security_hdrs})
+endif()
+
 target_include_directories(ddsc
   PRIVATE "${CMAKE_CURRENT_LIST_DIR}/include")
 
diff --git a/src/core/ddsi/include/dds/ddsi/ddsi_plist_generic.h b/src/core/ddsi/include/dds/ddsi/ddsi_plist_generic.h
index 8853ef7..481aa6c 100644
--- a/src/core/ddsi/include/dds/ddsi/ddsi_plist_generic.h
+++ b/src/core/ddsi/include/dds/ddsi/ddsi_plist_generic.h
@@ -34,6 +34,7 @@ enum pserop {
   Xi, Xix2, Xix3, Xix4, /* int32_t, 1 .. 4 in a row */
   Xu, Xux2, Xux3, Xux4, Xux5, /* uint32_t, 1 .. 5 in a row */
   XD, XDx2, /* duration, 1 .. 2 in a row */
+  Xl,       /* int64_t */
   Xo, Xox2, /* octet, 1 .. 2 in a row */
   Xb, Xbx2, /* boolean, 1 .. 2 in a row */
   XbCOND, /* boolean: compare to ignore remainder if false (for use_... flags) */
@@ -44,15 +45,6 @@ enum pserop {
   Xopt, /* remainder is optional on deser, 0-init if not present */
 } ddsrt_attribute_packed;
 
-inline bool pserop_seralign_is_1 (enum pserop op) {
-  /* NB: XbPROP is never serialized, so its alignment is irrelevant.  If ever there
-     is a need to allow calling this function when op = XbPROP, it needs to be changed
-     to taking the address of the pserop, and in that case inspect the following
-     operator */
-  assert (op != XbPROP && op != Xopt && op != XSTOP);
-  return (op >= Xo && op <= XK);
-}
-
 DDS_EXPORT void plist_fini_generic (void * __restrict dst, const enum pserop *desc, bool aliased);
 DDS_EXPORT dds_return_t plist_deser_generic (void * __restrict dst, const void * __restrict src, size_t srcsize, bool bswap, const enum pserop * __restrict desc);
 DDS_EXPORT dds_return_t plist_ser_generic (void **dst, size_t *dstsize, const void *src, const enum pserop * __restrict desc);
diff --git a/src/core/ddsi/include/dds/ddsi/ddsi_security_msg.h b/src/core/ddsi/include/dds/ddsi/ddsi_security_msg.h
new file mode 100644
index 0000000..a92eb8c
--- /dev/null
+++ b/src/core/ddsi/include/dds/ddsi/ddsi_security_msg.h
@@ -0,0 +1,91 @@
+/*
+ * Copyright(c) 2006 to 2018 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+#ifndef DDSI_SECURITY_MSG_H
+#define DDSI_SECURITY_MSG_H
+
+#include "dds/ddsi/q_plist.h"
+#include "dds/ddsi/ddsi_guid.h"
+#include "dds/ddsrt/retcode.h"
+#include "dds/ddsi/ddsi_plist_generic.h"
+
+#if defined (__cplusplus)
+extern "C" {
+#endif
+
+#define GMCLASSID_SECURITY_AUTH_REQUEST       "dds.sec.auth_request"
+#define GMCLASSID_SECURITY_AUTH_HANDSHAKE     "dds.sec.auth"
+
+typedef struct nn_message_identity {
+  ddsi_guid_t source_guid;
+  int64_t sequence_number;
+} nn_message_identity_t;
+
+typedef struct nn_participant_generic_message {
+  nn_message_identity_t message_identity;
+  nn_message_identity_t related_message_identity;
+  ddsi_guid_t destinaton_participant_guid;
+  ddsi_guid_t destination_endpoint_guid;
+  ddsi_guid_t source_endpoint_guid;
+  const char *message_class_id;
+  nn_dataholderseq_t message_data;
+} nn_participant_generic_message_t;
+
+
+/*
+ * The arguments are aliased in the resulting message structure.
+ * This means that the lifecycle of the arguments should be longer
+ * then that of the message.
+ */
+DDS_EXPORT void
+nn_participant_generic_message_init(
+   nn_participant_generic_message_t *msg,
+   const ddsi_guid_t *wrguid,
+   int64_t wrseq,
+   const ddsi_guid_t *dstpguid,
+   const ddsi_guid_t *dsteguid,
+   const ddsi_guid_t *srceguid,
+   const char *classid,
+   const nn_dataholderseq_t *mdata,
+   const nn_message_identity_t *rmid);
+
+/*
+ * Aliased struct variables will not be freed.
+ */
+DDS_EXPORT void
+nn_participant_generic_message_deinit(
+   nn_participant_generic_message_t *msg);
+
+/*
+ * Some struct variables are aliased to the given buffer.
+ * This means that the lifecycle of the data buffer should be
+ * longer then that of the message.
+ */
+DDS_EXPORT dds_return_t
+nn_participant_generic_message_deseralize(
+   nn_participant_generic_message_t *msg,
+   const unsigned char *data,
+   size_t len,
+   bool bswap);
+
+DDS_EXPORT dds_return_t
+nn_participant_generic_message_serialize(
+   const nn_participant_generic_message_t *msg,
+   unsigned char **data,
+   size_t *len);
+
+DDS_EXPORT extern const enum pserop pserop_participant_generic_message[];
+
+#if defined (__cplusplus)
+}
+#endif
+
+#endif /* DDSI_SECURITY_MSG_H */
diff --git a/src/core/ddsi/include/dds/ddsi/q_plist.h b/src/core/ddsi/include/dds/ddsi/q_plist.h
index 8a77283..5f82529 100644
--- a/src/core/ddsi/include/dds/ddsi/q_plist.h
+++ b/src/core/ddsi/include/dds/ddsi/q_plist.h
@@ -134,6 +134,11 @@ typedef struct nn_dataholder
   dds_binarypropertyseq_t binary_properties;
 } nn_dataholder_t;
 
+typedef struct nn_dataholderseq {
+  uint32_t n;
+  nn_dataholder_t *tags;
+} nn_dataholderseq_t;
+
 typedef nn_dataholder_t nn_token_t;
 
 /* Used for both nn_participant_security_info and nn_endpoint_security_info. */
diff --git a/src/core/ddsi/src/ddsi_security_msg.c b/src/core/ddsi/src/ddsi_security_msg.c
new file mode 100644
index 0000000..afed603
--- /dev/null
+++ b/src/core/ddsi/src/ddsi_security_msg.c
@@ -0,0 +1,149 @@
+/*
+ * Copyright(c) 2006 to 2018 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+#include <stddef.h>
+#include <string.h>
+#include "dds/ddsrt/heap.h"
+#include "dds/ddsrt/string.h"
+#include "dds/ddsi/q_bswap.h"
+#include "dds/ddsi/ddsi_security_msg.h"
+#include "dds/ddsi/ddsi_plist_generic.h"
+
+const enum pserop pserop_participant_generic_message[] =
+{
+  /* nn_participant_generic_message */
+  XG, Xl,              /* nn_message_identity_t message_identity         */
+  XG, Xl,              /* nn_message_identity_t related_message_identity */
+  XG,                  /* ddsi_guid_t destinaton_participant_guid        */
+  XG,                  /* ddsi_guid_t destination_endpoint_guid          */
+  XG,                  /* ddsi_guid_t source_endpoint_guid               */
+  XS,                  /* char* message_class_id                         */
+  XQ,                  /* nn_dataholderseq_t message_data                */
+    /* nn_dataholder_t */
+    XS,                  /* char* class_id                               */
+    XQ,                  /* dds_propertyseq_t properties                 */
+      XbPROP, XS, XS,      /* dds_property_t                             */
+    XSTOP,
+    XQ,                  /* dds_binarypropertyseq_t binary_properties    */
+      XbPROP, XS, XO,      /* dds_binaryproperty_t                       */
+    XSTOP,
+  XSTOP,
+  XSTOP                /* end                                            */
+};
+
+
+static void
+alias_simple_sequence(ddsi_octetseq_t *dst, const ddsi_octetseq_t *src, size_t elem_size)
+{
+  dst->length = src->length;
+  if (src->length > 0)
+  {
+    /* Even when aliased, sequence buffers are not shared. */
+    dst->value = ddsrt_memdup(src->value, src->length * elem_size);
+  }
+}
+
+static void
+alias_dataholder(nn_dataholder_t *dst, const nn_dataholder_t *src)
+{
+  dst->class_id = src->class_id;
+  alias_simple_sequence((ddsi_octetseq_t*)&dst->properties,
+                        (const ddsi_octetseq_t*)&src->properties,
+                        sizeof(dds_property_t));
+  alias_simple_sequence((ddsi_octetseq_t*)&dst->binary_properties,
+                        (const ddsi_octetseq_t*)&src->binary_properties,
+                        sizeof(dds_binaryproperty_t));
+}
+
+static void
+alias_dataholderseq(nn_dataholderseq_t *dst, const nn_dataholderseq_t *src)
+{
+  dst->n = src->n;
+  if (src->n > 0)
+  {
+    /* Even when aliased, sequence buffers are not shared. */
+    dst->tags = ddsrt_malloc(src->n * sizeof(nn_dataholder_t));
+    for (uint32_t i = 0; i < src->n; i++)
+    {
+      alias_dataholder(&(dst->tags[i]), &(src->tags[i]));
+    }
+  }
+}
+
+void
+nn_participant_generic_message_init(
+   nn_participant_generic_message_t *msg,
+   const ddsi_guid_t *wrguid,
+   int64_t wrseq,
+   const ddsi_guid_t *dstpguid,
+   const ddsi_guid_t *dsteguid,
+   const ddsi_guid_t *srceguid,
+   const char *classid,
+   const nn_dataholderseq_t *mdata,
+   const nn_message_identity_t *rmid)
+{
+  assert(msg);
+  assert(wrguid);
+  assert(classid);
+
+  memset(msg, 0, sizeof(*msg));
+
+  msg->message_identity.source_guid = *wrguid;
+  msg->message_identity.sequence_number = wrseq;
+
+  if (rmid)
+  {
+    msg->related_message_identity.source_guid = rmid->source_guid;
+    msg->related_message_identity.sequence_number = rmid->sequence_number;
+  }
+
+  if (dstpguid)
+    msg->destinaton_participant_guid = *dstpguid;
+
+  if (dsteguid)
+    msg->destination_endpoint_guid = *dsteguid;
+
+  if (srceguid)
+    msg->source_endpoint_guid = *srceguid;
+
+  msg->message_class_id = classid;
+
+  if (mdata)
+    alias_dataholderseq(&msg->message_data, mdata);
+}
+
+void
+nn_participant_generic_message_deinit(
+   nn_participant_generic_message_t *msg)
+{
+  assert(msg);
+  plist_fini_generic(msg, pserop_participant_generic_message, true);
+}
+
+dds_return_t
+nn_participant_generic_message_serialize(
+   const nn_participant_generic_message_t *msg,
+   unsigned char **data,
+   size_t *len)
+{
+  return plist_ser_generic ((void**)data, len, (void*)msg, pserop_participant_generic_message);
+}
+
+dds_return_t
+nn_participant_generic_message_deseralize(
+   nn_participant_generic_message_t *msg,
+   const unsigned char *data,
+   size_t len,
+   bool bswap)
+{
+  assert(sizeof(nn_participant_generic_message_t) == plist_memsize_generic(pserop_participant_generic_message));
+  return plist_deser_generic (msg, data, len, bswap, pserop_participant_generic_message);
+}
diff --git a/src/core/ddsi/src/q_plist.c b/src/core/ddsi/src/q_plist.c
index 8b637f0..3196b3e 100644
--- a/src/core/ddsi/src/q_plist.c
+++ b/src/core/ddsi/src/q_plist.c
@@ -114,8 +114,6 @@ struct piddesc {
   dds_return_t (*deser_validate_xform) (void * __restrict dst, const struct dd * __restrict dd);
 };
 
-extern inline bool pserop_seralign_is_1 (enum pserop op);
-
 static void log_octetseq (uint32_t cat, const struct ddsrt_log_cfg *logcfg, uint32_t n, const unsigned char *xs);
 static dds_return_t validate_history_qospolicy (const dds_history_qospolicy_t *q);
 static dds_return_t validate_resource_limits_qospolicy (const dds_resource_limits_qospolicy_t *q);
@@ -127,26 +125,70 @@ static dds_return_t final_validation_qos (const dds_qos_t *dest, nn_protocol_ver
 static int partitions_equal (const dds_partition_qospolicy_t *a, const dds_partition_qospolicy_t *b);
 static dds_return_t nn_xqos_valid_strictness (const struct ddsrt_log_cfg *logcfg, const dds_qos_t *xqos, bool strict);
 
-static size_t align4size (size_t x)
+static size_t pserop_seralign(enum pserop op)
 {
-  return (x + 3) & ~(size_t)3;
+  switch(op)
+  {
+    case XSTOP:
+    case XbPROP:
+    case Xopt:
+      /* NB: XbPROP is never serialized, so its alignment is irrelevant.  If ever there
+         is a need to allow calling this function when op = XbPROP, it needs to be changed
+         to taking the address of the pserop, and in that case inspect the following
+         operator */
+      assert(false);
+      return 1;
+    case Xo: case Xox2:
+    case Xb: case Xbx2:
+    case XbCOND:
+    case XG:
+    case XK:
+      return 1;
+    case XO:
+    case XS:
+    case XE1: case XE2: case XE3:
+    case Xi: case Xix2: case Xix3: case Xix4:
+    case Xu: case Xux2: case Xux3: case Xux4: case Xux5:
+    case XD: case XDx2:
+    case XQ:
+      return 4;
+    case Xl:
+      return 8;
+  }
+  assert(false);
+  return 1;
 }
 
-static void *deser_generic_dst (void * __restrict dst, size_t *dstoff, size_t align)
+static size_t alignN(const size_t off, const size_t align)
 {
-  *dstoff = (*dstoff + align - 1) & ~(align - 1);
+  return (off + align - 1) & ~(align - 1);
+}
+
+static size_t align4(const size_t off)
+{
+  return alignN(off, 4);
+}
+
+static size_t align8(const size_t off)
+{
+  return alignN(off, 8);
+}
+
+static void *deser_generic_dst (void * __restrict dst, size_t *dstoff, const size_t align)
+{
+  *dstoff = alignN(*dstoff, align);
   return (char *) dst + *dstoff;
 }
 
-static const void *deser_generic_src (const void * __restrict src, size_t *srcoff, size_t align)
+static const void *deser_generic_src (const void * __restrict src, size_t *srcoff, const size_t align)
 {
-  *srcoff = (*srcoff + align - 1) & ~(align - 1);
+  *srcoff = alignN(*srcoff, align);
   return (const char *) src + *srcoff;
 }
 
-static void *ser_generic_align4 (char * __restrict p, size_t * __restrict off)
+static void *ser_generic_aligned (char * __restrict p, size_t * __restrict off, const size_t align)
 {
-  const size_t off1 = align4size (*off);
+  const size_t off1 = alignN(*off, align);
   size_t pad = off1 - *off;
   char *dst = p + *off;
   *off = off1;
@@ -155,6 +197,16 @@ static void *ser_generic_align4 (char * __restrict p, size_t * __restrict off)
   return dst;
 }
 
+static void *ser_generic_align4(char * __restrict p, size_t * __restrict off)
+{
+  return ser_generic_aligned(p, off, 4);
+}
+
+static void *ser_generic_align8(char * __restrict p, size_t * __restrict off)
+{
+  return ser_generic_aligned(p, off, 8);
+}
+
 static dds_return_t deser_uint32 (uint32_t *dst, const struct dd * __restrict dd, size_t * __restrict off)
 {
   size_t off1 = (*off + 3) & ~(size_t)3;
@@ -169,6 +221,20 @@ static dds_return_t deser_uint32 (uint32_t *dst, const struct dd * __restrict dd
   return 0;
 }
 
+static dds_return_t deser_int64 (int64_t *dst, const struct dd * __restrict dd, size_t * __restrict off)
+{
+  size_t off1 = (*off + 7) & ~(size_t)7;
+  int64_t tmp;
+  if (off1 + 8 > dd->bufsz)
+    return DDS_RETCODE_BAD_PARAMETER;
+  tmp = *((int64_t *) (dd->buf + off1));
+  if (dd->bswap)
+    tmp = bswap8 (tmp);
+  *dst = tmp;
+  *off = off1 + 8;
+  return 0;
+}
+
 #define alignof(type_) offsetof (struct { char c; type_ d; }, d)
 
 static dds_return_t deser_reliability (void * __restrict dst, size_t * __restrict dstoff, struct flagset *flagset, uint64_t flag, const struct dd * __restrict dd, size_t * __restrict srcoff)
@@ -310,6 +376,28 @@ static dds_return_t fini_locator (void * __restrict dst, size_t * __restrict dst
   return 0;
 }
 
+static const enum pserop* pserop_advance (const enum pserop * __restrict desc)
+{
+  /* Should not start on an end. */
+  assert(*desc != XSTOP);
+
+  /* If not a sequence, return next. */
+  if (*desc != XQ) return (desc + 1);
+
+  /* Jump over this sequence (ignoring nested ones). */
+  int scope = 1;
+  do
+  {
+    desc++;
+    if (*desc ==    XQ) scope++;
+    if (*desc == XSTOP) scope--;
+  }
+  while (scope != 0);
+
+  /* We're on the stop, return next. */
+  return (desc + 1);
+}
+
 static size_t ser_generic_srcsize (const enum pserop * __restrict desc)
 {
   size_t srcoff = 0, srcalign = 0;
@@ -330,6 +418,7 @@ static size_t ser_generic_srcsize (const enum pserop * __restrict desc)
       case XE1: case XE2: case XE3: SIMPLE (*desc, unsigned); break;
       case Xi: case Xix2: case Xix3: case Xix4: SIMPLE (Xi, int32_t); break;
       case Xu: case Xux2: case Xux3: case Xux4: case Xux5: SIMPLE (Xu, uint32_t); break;
+      case Xl: SIMPLE (Xl, int64_t); break;
       case XD: case XDx2: SIMPLE (XD, dds_duration_t); break;
       case Xo: case Xox2: SIMPLE (Xo, unsigned char); break;
       case Xb: case Xbx2: SIMPLE (Xb, unsigned char); break;
@@ -337,10 +426,10 @@ static size_t ser_generic_srcsize (const enum pserop * __restrict desc)
       case XG: SIMPLE (XG, ddsi_guid_t); break;
       case XK: SIMPLE (XK, nn_keyhash_t); break;
       case XbPROP: SIMPLE (XbPROP, unsigned char); break;
-      case XQ: SIMPLE (XQ, ddsi_octetseq_t); while (*++desc != XSTOP) { } break;
+      case XQ: SIMPLE (XQ, ddsi_octetseq_t); break;
       case Xopt: break;
     }
-    desc++;
+    desc = pserop_advance(desc);
   }
 #undef SIMPLE
 }
@@ -350,8 +439,9 @@ size_t plist_memsize_generic (const enum pserop * __restrict desc)
   return ser_generic_srcsize (desc);
 }
 
-static void fini_generic_embeddable (void * __restrict dst, size_t * __restrict dstoff, const enum pserop *desc, const enum pserop * const desc_end, bool aliased)
+static bool fini_generic_embeddable (void * __restrict dst, size_t * __restrict dstoff, const enum pserop *desc, const enum pserop * const desc_end, bool aliased)
 {
+  bool freed = false;
 #define COMPLEX(basecase_, type_, cleanup_unaliased_, cleanup_always_) do { \
     type_ *x = deser_generic_dst (dst, dstoff, alignof (type_));            \
     const uint32_t cnt = 1 + (uint32_t) (*desc - (basecase_));              \
@@ -362,16 +452,17 @@ static void fini_generic_embeddable (void * __restrict dst, size_t * __restrict
     *dstoff += cnt * sizeof (*x);                                           \
   } while (0)
 #define SIMPLE(basecase_, type_) COMPLEX (basecase_, type_, (void) 0, (void) 0)
-  while (desc != desc_end)
+  while ((desc_end == NULL) || (desc < desc_end))
   {
     switch (*desc)
     {
-      case XSTOP: return;
-      case XO: COMPLEX (XO, ddsi_octetseq_t, ddsrt_free (x->value), (void) 0); break;
-      case XS: COMPLEX (XS, char *, ddsrt_free (*x), (void) 0); break;
+      case XSTOP: return freed;
+      case XO: COMPLEX (XO, ddsi_octetseq_t, { ddsrt_free (x->value); freed = true; }, (void) 0); break;
+      case XS: COMPLEX (XS, char *, { ddsrt_free (*x); freed = true; }, (void) 0); break;
       case XE1: case XE2: case XE3: COMPLEX (*desc, unsigned, (void) 0, (void) 0); break;
       case Xi: case Xix2: case Xix3: case Xix4: SIMPLE (Xi, int32_t); break;
       case Xu: case Xux2: case Xux3: case Xux4: case Xux5: SIMPLE (Xu, uint32_t); break;
+      case Xl: SIMPLE (Xl, int64_t); break;
       case XD: case XDx2: SIMPLE (XD, dds_duration_t); break;
       case Xo: case Xox2: SIMPLE (Xo, unsigned char); break;
       case Xb: case Xbx2: SIMPLE (Xb, unsigned char); break;
@@ -380,23 +471,27 @@ static void fini_generic_embeddable (void * __restrict dst, size_t * __restrict
       case XK: SIMPLE (XK, nn_keyhash_t); break;
       case XbPROP: SIMPLE (XbPROP, unsigned char); break;
       case XQ:
-        /* non-nested, so never a need to deallocate only some of the entries and no complications
-           in locating the end of the sequence element description */
-        COMPLEX (XQ, ddsi_octetseq_t, {
-          const size_t elem_size = ser_generic_srcsize (desc + 1);
-          for (uint32_t i = 0; i < x->length; i++) {
-            size_t elem_off = i * elem_size;
-            fini_generic_embeddable (x->value, &elem_off, desc + 1, desc_end, aliased);
-          }
-        }, ddsrt_free (x->value));
-        while (desc + 1 != desc_end && *++desc != XSTOP) { }
-        break;
+      {
+        ddsi_octetseq_t *x = deser_generic_dst (dst, dstoff, alignof (ddsi_octetseq_t));
+        const size_t elem_size = ser_generic_srcsize (desc + 1);
+        bool elem_freed = true;
+        for (uint32_t i = 0; (i < x->length) && elem_freed; i++)
+        {
+          size_t elem_off = i * elem_size;
+          elem_freed = fini_generic_embeddable (x->value, &elem_off, desc + 1, desc_end, aliased);
+        }
+        ddsrt_free (x->value);
+        freed = true;
+        *dstoff += sizeof (ddsi_octetseq_t);
+      }
+      break;
       case Xopt: break;
     }
-    desc++;
+    desc = pserop_advance(desc);
   }
 #undef SIMPLE
 #undef COMPLEX
+  return freed;
 }
 
 static size_t pserop_memalign (enum pserop op)
@@ -413,13 +508,14 @@ static size_t pserop_memalign (enum pserop op)
     case XE1: case XE2: case XE3: return sizeof (uint32_t);
     case Xi: case Xix2: case Xix3: case Xix4: return sizeof (int32_t);
     case Xu: case Xux2: case Xux3: case Xux4: case Xux5: return sizeof (uint32_t);
+    case Xl: return alignof (int64_t);
     case XD: case XDx2: return alignof (dds_duration_t);
     case XSTOP: case Xopt: assert (0);
   }
   return 0;
 }
 
-static dds_return_t deser_generic (void * __restrict dst, size_t * __restrict dstoff, struct flagset *flagset, uint64_t flag, const struct dd * __restrict dd, size_t * __restrict srcoff, const enum pserop * __restrict desc)
+static dds_return_t deser_generic_r (void * __restrict dst, size_t * __restrict dstoff, struct flagset *flagset, uint64_t flag, const struct dd * __restrict dd, size_t * __restrict srcoff, const enum pserop * __restrict desc)
 {
   enum pserop const * const desc_in = desc;
   size_t dstoff_in = *dstoff;
@@ -448,7 +544,7 @@ static dds_return_t deser_generic (void * __restrict dst, size_t * __restrict ds
         char ** const x = deser_generic_dst (dst, dstoff, alignof (char *));
         ddsi_octetseq_t tmp;
         size_t tmpoff = 0;
-        if (deser_generic (&tmp, &tmpoff, flagset, flag, dd, srcoff, (enum pserop []) { XO, XSTOP }) < 0)
+        if (deser_generic_r (&tmp, &tmpoff, flagset, flag, dd, srcoff, (enum pserop []) { XO, XSTOP }) < 0)
           goto fail;
         if (tmp.length < 1 || tmp.value[tmp.length - 1] != 0)
           goto fail;
@@ -484,6 +580,13 @@ static dds_return_t deser_generic (void * __restrict dst, size_t * __restrict ds
         *dstoff += cnt * sizeof (*x);
         break;
       }
+      case Xl: { /* int64_t */
+        int64_t * const x = deser_generic_dst (dst, dstoff, alignof (int64_t));
+        if (deser_int64(x, dd, srcoff) < 0)
+          goto fail;
+        *dstoff += sizeof (*x);
+        break;
+      }
       case XD: case XDx2: { /* duration(s): int64_t <=> int32_t.uint32_t (seconds.fraction) */
         dds_duration_t * const x = deser_generic_dst (dst, dstoff, alignof (dds_duration_t));
         const uint32_t cnt = 1 + (uint32_t) (*desc - XD);
@@ -547,7 +650,7 @@ static dds_return_t deser_generic (void * __restrict dst, size_t * __restrict ds
         *dstoff += sizeof (*x);
         break;
       }
-      case XQ: { /* non-nested but otherwise arbitrary sequence, so no nested mallocs */
+      case XQ: { /* arbitrary sequence */
         ddsi_octetseq_t * const x = deser_generic_dst (dst, dstoff, alignof (ddsi_octetseq_t));
         if (deser_uint32 (&x->length, dd, srcoff) < 0 || x->length > dd->bufsz - *srcoff)
           goto fail;
@@ -556,25 +659,26 @@ static dds_return_t deser_generic (void * __restrict dst, size_t * __restrict ds
         for (uint32_t i = 0; i < x->length; i++)
         {
           size_t elem_off = i * elem_size;
-          if (deser_generic (x->value, &elem_off, flagset, flag, dd, srcoff, desc + 1) < 0)
+          if (deser_generic_r (x->value, &elem_off, flagset, flag, dd, srcoff, desc + 1) < 0)
           {
+            bool elem_freed = true;
+            for (uint32_t f = 0; (f < i) && (elem_freed); f++)
+            {
+              size_t free_off = f * elem_size;
+              elem_freed = fini_generic_embeddable (x->value, &free_off, desc + 1, NULL, *flagset->aliased & flag);
+            }
             ddsrt_free (x->value);
             goto fail;
           }
         }
         *dstoff += sizeof (*x);
-        while (*++desc != XSTOP) { }
         break;
       }
       case Xopt: { /* remainder is optional; alignment is very nearly always 4 */
         bool end_of_input;
-        if (pserop_seralign_is_1 (desc[1]))
-          end_of_input = (*srcoff + 1 > dd->bufsz);
-        else
-        {
-          *srcoff = (*srcoff + 3) & ~(size_t)3;
-          end_of_input = (*srcoff + 4 > dd->bufsz);
-        }
+        size_t align = pserop_seralign(desc[1]);
+        *srcoff = alignN(*srcoff, align);
+        end_of_input = (*srcoff + align > dd->bufsz);
         if (end_of_input)
         {
           void * const x = deser_generic_dst (dst, dstoff, pserop_memalign (desc[1]));
@@ -584,19 +688,29 @@ static dds_return_t deser_generic (void * __restrict dst, size_t * __restrict ds
         }
       }
     }
-    desc++;
+    desc = pserop_advance(desc);
   }
 success:
   *flagset->present |= flag;
   return 0;
 
 fail:
-  fini_generic_embeddable (dst, &dstoff_in, desc_in, desc, *flagset->aliased & flag);
-  *flagset->present &= ~flag;
-  *flagset->aliased &= ~flag;
+  (void)fini_generic_embeddable (dst, &dstoff_in, desc_in, desc, *flagset->aliased & flag);
   return DDS_RETCODE_BAD_PARAMETER;
 }
 
+static dds_return_t deser_generic (void * __restrict dst, size_t * __restrict dstoff, struct flagset *flagset, uint64_t flag, const struct dd * __restrict dd, size_t * __restrict srcoff, const enum pserop * __restrict desc)
+{
+  dds_return_t ret;
+  ret = deser_generic_r (dst, dstoff, flagset, flag, dd, srcoff, desc);
+  if (ret != 0)
+  {
+    *flagset->present &= ~flag;
+    *flagset->aliased &= ~flag;
+  }
+  return ret;
+}
+
 dds_return_t plist_deser_generic (void * __restrict dst, const void * __restrict src, size_t srcsize, bool bswap, const enum pserop * __restrict desc)
 {
   struct dd dd = {
@@ -622,17 +736,19 @@ static void ser_generic_size_embeddable (size_t *dstoff, const void *src, size_t
     srcoff += cnt * sizeof (*x);                                        \
   } while (0)
 #define SIMPLE1(basecase_, type_) COMPLEX (basecase_, type_, *dstoff = *dstoff + sizeof (*x))
-#define SIMPLE4(basecase_, type_) COMPLEX (basecase_, type_, *dstoff = align4size (*dstoff) + sizeof (*x))
+#define SIMPLE4(basecase_, type_) COMPLEX (basecase_, type_, *dstoff = align4 (*dstoff) + sizeof (*x))
+#define SIMPLE8(basecase_, type_) COMPLEX (basecase_, type_, *dstoff = align8 (*dstoff) + sizeof (*x))
   while (true)
   {
     switch (*desc)
     {
       case XSTOP: return;
-      case XO: COMPLEX (XO, ddsi_octetseq_t, *dstoff = align4size (*dstoff) + 4 + x->length); break;
-      case XS: COMPLEX (XS, const char *, *dstoff = align4size (*dstoff) + 4 + strlen (*x) + 1); break;
-      case XE1: case XE2: case XE3: COMPLEX (*desc, unsigned, *dstoff = align4size (*dstoff) + 4); break;
+      case XO: COMPLEX (XO, ddsi_octetseq_t, *dstoff = align4 (*dstoff) + 4 + x->length); break;
+      case XS: COMPLEX (XS, const char *, *dstoff = align4 (*dstoff) + 4 + strlen (*x) + 1); break;
+      case XE1: case XE2: case XE3: COMPLEX (*desc, unsigned, *dstoff = align4 (*dstoff) + 4); break;
       case Xi: case Xix2: case Xix3: case Xix4: SIMPLE4 (Xi, int32_t); break;
       case Xu: case Xux2: case Xux3: case Xux4: case Xux5: SIMPLE4 (Xu, uint32_t); break;
+      case Xl: SIMPLE8 (Xl, int64_t); break;
       case XD: case XDx2: SIMPLE4 (XD, dds_duration_t); break;
       case Xo: case Xox2: SIMPLE1 (Xo, unsigned char); break;
       case Xb: case Xbx2: SIMPLE1 (Xb, unsigned char); break;
@@ -643,14 +759,15 @@ static void ser_generic_size_embeddable (size_t *dstoff, const void *src, size_t
                COMPLEX (XbPROP, unsigned char, if (! *x) return); break;
       case XQ: COMPLEX (XQ, ddsi_octetseq_t, {
         const size_t elem_size = ser_generic_srcsize (desc + 1);
-        *dstoff = align4size (*dstoff) + 4;
+        *dstoff = align4 (*dstoff) + 4;
         for (uint32_t i = 0; i < x->length; i++)
           ser_generic_size_embeddable (dstoff, x->value, i * elem_size, desc + 1);
-      }); while (*++desc != XSTOP) { } break;
+      }); break;
       case Xopt: break;
     }
-    desc++;
+    desc = pserop_advance(desc);
   }
+#undef SIMPLE8
 #undef SIMPLE4
 #undef SIMPLE1
 #undef COMPLEX
@@ -733,6 +850,14 @@ static dds_return_t ser_generic_embeddable (char * const data, size_t *dstoff, c
         srcoff += cnt * sizeof (*x);
         break;
       }
+      case Xl: { /* int64_t */
+        int64_t const * const x = deser_generic_src (src, &srcoff, alignof (int64_t));
+        int64_t * const p = ser_generic_align8 (data, dstoff);
+        *p = *x;
+        *dstoff += sizeof (*x);
+        srcoff += sizeof (*x);
+        break;
+      }
       case XD: case XDx2: { /* duration(s): int64_t <=> int32_t.uint32_t (seconds.fraction) */
         dds_duration_t const * const x = deser_generic_src (src, &srcoff, alignof (dds_duration_t));
         const uint32_t cnt = 1 + (uint32_t) (*desc - XD);
@@ -788,7 +913,7 @@ static dds_return_t ser_generic_embeddable (char * const data, size_t *dstoff, c
         srcoff += sizeof (*x);
         break;
       }
-      case XQ: {
+      case XQ: { /* arbitrary sequence */
         ddsi_octetseq_t const * const x = deser_generic_src (src, &srcoff, alignof (ddsi_octetseq_t));
         char * const p = ser_generic_align4 (data, dstoff);
         *dstoff += 4;
@@ -802,13 +927,12 @@ static dds_return_t ser_generic_embeddable (char * const data, size_t *dstoff, c
             ser_generic_embeddable (data, dstoff, x->value, i * elem_size, desc + 1);
         }
         srcoff += sizeof (*x);
-        while (*++desc != XSTOP) { }
         break;
       }
       case Xopt:
         break;
     }
-    desc++;
+    desc = pserop_advance(desc);
   }
 }
 
@@ -852,6 +976,7 @@ static dds_return_t unalias_generic (void * __restrict dst, size_t * __restrict
       case XE1: case XE2: case XE3: COMPLEX (*desc, unsigned, (void) 0); break;
       case Xi: case Xix2: case Xix3: case Xix4: SIMPLE (Xi, int32_t); break;
       case Xu: case Xux2: case Xux3: case Xux4: case Xux5: SIMPLE (Xu, uint32_t); break;
+      case Xl: SIMPLE(Xl, int64_t); break;
       case XD: case XDx2: SIMPLE (XD, dds_duration_t); break;
       case Xo: case Xox2: SIMPLE (Xo, unsigned char); break;
       case Xb: case Xbx2: SIMPLE (Xb, unsigned char); break;
@@ -877,10 +1002,10 @@ static dds_return_t unalias_generic (void * __restrict dst, size_t * __restrict
           size_t elem_off = i * elem_size;
           unalias_generic (x->value, &elem_off, gen_seq_aliased, desc + 1);
         }
-      }); while (*++desc != XSTOP) { } break;
+      }); break;
       case Xopt: break;
     }
-    desc++;
+    desc = pserop_advance(desc);
   }
 #undef SIMPLE
 #undef COMPLEX
@@ -915,14 +1040,14 @@ static bool fini_generic_required (const enum pserop * __restrict desc)
 
 static dds_return_t fini_generic (void * __restrict dst, size_t * __restrict dstoff, struct flagset *flagset, uint64_t flag, const enum pserop * __restrict desc)
 {
-  fini_generic_embeddable (dst, dstoff, desc, NULL, *flagset->aliased & flag);
+  (void)fini_generic_embeddable (dst, dstoff, desc, NULL, *flagset->aliased & flag);
   return 0;
 }
 
 void plist_fini_generic (void * __restrict dst, const enum pserop *desc, bool aliased)
 {
   size_t dstoff = 0;
-  fini_generic_embeddable (dst, &dstoff, desc, NULL, aliased);
+  (void)fini_generic_embeddable (dst, &dstoff, desc, NULL, aliased);
 }
 
 static dds_return_t valid_generic (const void *src, size_t srcoff, const enum pserop * __restrict desc)
@@ -945,6 +1070,7 @@ static dds_return_t valid_generic (const void *src, size_t srcoff, const enum ps
       case XE1: case XE2: case XE3: SIMPLE (*desc, unsigned, *x <= 1 + (unsigned) *desc - XE1); break;
       case Xi: case Xix2: case Xix3: case Xix4: TRIVIAL (Xi, int32_t); break;
       case Xu: case Xux2: case Xux3: case Xux4: case Xux5: TRIVIAL (Xu, uint32_t); break;
+      case Xl: TRIVIAL(Xl, int64_t); break;
       case XD: case XDx2: SIMPLE (XD, dds_duration_t, *x >= 0); break;
       case Xo: case Xox2: TRIVIAL (Xo, unsigned char); break;
       case Xb: case Xbx2: SIMPLE (Xb, unsigned char, *x == 0 || *x == 1); break;
@@ -963,10 +1089,10 @@ static dds_return_t valid_generic (const void *src, size_t srcoff, const enum ps
               return ret;
           }
         }
-      }); while (*++desc != XSTOP) { } break;
+      }); break;
       case Xopt: break;
     }
-    desc++;
+    desc = pserop_advance(desc);
   }
 #undef TRIVIAL
 #undef SIMPLE
@@ -1001,6 +1127,7 @@ static bool equal_generic (const void *srcx, const void *srcy, size_t srcoff, co
       case XE1: case XE2: case XE3: TRIVIAL (*desc, unsigned); break;
       case Xi: case Xix2: case Xix3: case Xix4: TRIVIAL (Xi, int32_t); break;
       case Xu: case Xux2: case Xux3: case Xux4: case Xux5: TRIVIAL (Xu, uint32_t); break;
+      case Xl: TRIVIAL (Xl, int64_t); break;
       case XD: case XDx2: TRIVIAL (XD, dds_duration_t); break;
       case Xo: case Xox2: TRIVIAL (Xo, unsigned char); break;
       case Xb: case Xbx2: TRIVIAL (Xb, unsigned char); break;
@@ -1025,10 +1152,10 @@ static bool equal_generic (const void *srcx, const void *srcy, size_t srcoff, co
               return false;
           }
         }
-      }); while (*++desc != XSTOP) { } break;
+      }); break;
       case Xopt: break;
     }
-    desc++;
+    desc = pserop_advance(desc);
   }
 #undef TRIVIAL
 #undef SIMPLE
diff --git a/src/core/ddsi/tests/CMakeLists.txt b/src/core/ddsi/tests/CMakeLists.txt
index 7aa0300..a071abe 100644
--- a/src/core/ddsi/tests/CMakeLists.txt
+++ b/src/core/ddsi/tests/CMakeLists.txt
@@ -13,7 +13,12 @@ include(CUnit)
 
 set(ddsi_test_sources
     "plist_generic.c"
-    "plist.c")
+    "plist.c"
+    "mem_ser.h")
+
+if(ENABLE_SECURITY)
+  set(ddsi_test_sources ${ddsi_test_sources} "security_msg.c")
+endif()
 
 add_cunit_executable(cunit_ddsi ${ddsi_test_sources})
 target_include_directories(
diff --git a/src/core/ddsi/tests/mem_ser.h b/src/core/ddsi/tests/mem_ser.h
new file mode 100644
index 0000000..d616a90
--- /dev/null
+++ b/src/core/ddsi/tests/mem_ser.h
@@ -0,0 +1,55 @@
+/*
+ * Copyright(c) 2019 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+#ifndef DDSI_TEST_MEM_SER_H
+#define DDSI_TEST_MEM_SER_H
+
+#include "dds/ddsrt/endian.h"
+
+#if DDSRT_ENDIAN == DDSRT_BIG_ENDIAN
+#define SER32(v) \
+  (unsigned char)( (uint32_t)(v) >> 24        ), \
+  (unsigned char)(((uint32_t)(v) >> 16) & 0xff), \
+  (unsigned char)(((uint32_t)(v) >>  8) & 0xff), \
+  (unsigned char)( (uint32_t)(v)        & 0xff)
+#define SER32BE(v) SER32(v)
+#define SER64(v) \
+  (unsigned char)( (uint32_t)(v) >> 56),         \
+  (unsigned char)(((uint32_t)(v) >> 48) & 0xff), \
+  (unsigned char)(((uint32_t)(v) >> 40) & 0xff), \
+  (unsigned char)(((uint32_t)(v) >> 32) & 0xff), \
+  (unsigned char)(((uint32_t)(v) >> 24) & 0xff), \
+  (unsigned char)(((uint32_t)(v) >> 16) & 0xff), \
+  (unsigned char)(((uint32_t)(v) >>  8) & 0xff), \
+  (unsigned char)( (uint32_t)(v)        & 0xff)
+#else
+#define SER32(v) \
+  (unsigned char)( (uint32_t)(v)        & 0xff), \
+  (unsigned char)(((uint32_t)(v) >>  8) & 0xff), \
+  (unsigned char)(((uint32_t)(v) >> 16) & 0xff), \
+  (unsigned char)( (uint32_t)(v) >> 24        )
+#define SER32BE(v) \
+  (unsigned char)( (uint32_t)(v) >> 24        ), \
+  (unsigned char)(((uint32_t)(v) >> 16) & 0xff), \
+  (unsigned char)(((uint32_t)(v) >>  8) & 0xff), \
+  (unsigned char)( (uint32_t)(v)        & 0xff)
+#define SER64(v) \
+  (unsigned char)( (uint64_t)(v)        & 0xff), \
+  (unsigned char)(((uint64_t)(v) >>  8) & 0xff), \
+  (unsigned char)(((uint64_t)(v) >> 16) & 0xff), \
+  (unsigned char)(((uint64_t)(v) >> 24) & 0xff), \
+  (unsigned char)(((uint64_t)(v) >> 32) & 0xff), \
+  (unsigned char)(((uint64_t)(v) >> 40) & 0xff), \
+  (unsigned char)(((uint64_t)(v) >> 48) & 0xff), \
+  (unsigned char)( (uint64_t)(v) >> 56)
+#endif
+
+#endif /* DDSI_TEST_MEM_SER_H */
diff --git a/src/core/ddsi/tests/plist_generic.c b/src/core/ddsi/tests/plist_generic.c
index 04c91d1..54f7647 100644
--- a/src/core/ddsi/tests/plist_generic.c
+++ b/src/core/ddsi/tests/plist_generic.c
@@ -15,6 +15,7 @@
 #include "dds/ddsrt/endian.h"
 #include "dds/ddsi/q_xqos.h"
 #include "dds/ddsi/ddsi_plist_generic.h"
+#include "mem_ser.h"
 
 struct desc {
   const enum pserop desc[20];
@@ -33,28 +34,9 @@ struct desc_invalid {
   const unsigned char *ser;
 };
 
-#if DDSRT_ENDIAN == DDSRT_BIG_ENDIAN
-#define SER32(v) \
-  (unsigned char)((uint32_t)(v) >> 24), \
-  (unsigned char)(((uint32_t)(v) >> 16) & 0xff), \
-  (unsigned char)(((uint32_t)(v) >> 8) & 0xff), \
-  (unsigned char)((uint32_t)(v) & 0xff)
-#define SER32BE(v) SER32(v)
-#else
-#define SER32(v) \
-  (unsigned char)((uint32_t)(v) & 0xff), \
-  (unsigned char)(((uint32_t)(v) >> 8) & 0xff), \
-  (unsigned char)(((uint32_t)(v) >> 16) & 0xff), \
-  (unsigned char)((uint32_t)(v) >> 24)
-#define SER32BE(v) \
-  (unsigned char)((uint32_t)(v) >> 24), \
-  (unsigned char)(((uint32_t)(v) >> 16) & 0xff), \
-  (unsigned char)(((uint32_t)(v) >> 8) & 0xff), \
-  (unsigned char)((uint32_t)(v) & 0xff)
-#endif
-
 typedef unsigned char raw[];
 typedef uint32_t raw32[];
+typedef uint64_t raw64[];
 typedef ddsi_octetseq_t oseq;
 
 struct desc descs[] = {
@@ -75,6 +57,7 @@ struct desc descs[] = {
   { {Xux3,XSTOP}, (raw32){4,5,6},       12, (raw){SER32(4), SER32(5), SER32(6)} },
   { {Xux4,XSTOP}, (raw32){7,8,9,10},    16, (raw){SER32(7), SER32(8), SER32(9), SER32(10)} },
   { {Xux5,XSTOP}, (raw32){7,8,9,10,11}, 20, (raw){SER32(7), SER32(8), SER32(9), SER32(10), SER32(11)} },
+  { {Xl,XSTOP},   (raw64){123456789},    8, (raw){SER64(123456789)} },
   { {XD,XSTOP},   (uint64_t[]){314159265358979324},
     /* note: fractional part depends on rounding rule used for converting nanoseconds to NTP time
        Cyclone currently rounds up, so we have to do that too */
@@ -94,6 +77,46 @@ struct desc descs[] = {
     7, (raw){SER32(3), 1,2,3} },
   { {XQ,XS,XSTOP,XSTOP}, &(ddsi_stringseq_t){2, (char*[]){"tree","flower"}},
     27, (raw){SER32(2), SER32(5),'t','r','e','e',0, 0,0,0, SER32(7), 'f','l','o','w','e','r',0} },
+  { {Xo,Xl,Xo,Xu,Xo,XSTOP},
+    &(struct{unsigned char a;int64_t b;unsigned char c;uint32_t d;unsigned char e;}){ 1, 2, 3, 4, 5 },
+     25, (raw){1,0,0,0,0,0,0,0,SER64(2),3,0,0,0,SER32(4),5} },
+  { {Xo,XQ,Xo,Xu,Xo,XSTOP,Xo,XSTOP},
+    &(struct{uint8_t b; oseq seq; uint8_t c;})
+      {1, {2, (unsigned char *)(struct{uint8_t a; uint32_t b; uint8_t c;}[])
+              { {0x10, 0x11, 0x12},
+                {0x21, 0x22, 0x23} },
+      }, 0x42 },
+    26,
+    (raw){1, /* pad */0,0,0, SER32(2),
+             0x10, /* pad */0,0,0, SER32(0x11), 0x12,
+             0x21, /* pad */0,0,   SER32(0x22), 0x23,
+          0x42}
+  },
+  { {Xo,XQ,Xo,Xl,Xo,XSTOP,Xo,XSTOP},
+    &(struct{uint8_t b; oseq seq; uint8_t c;})
+      {1, {2, (unsigned char *)(struct{uint8_t a; int64_t b; uint8_t c;}[])
+              { {0x10, 0x11, 0x12},
+                {0x21, 0x22, 0x23} },
+      }, 0x42 },
+    42,
+    (raw){1, /* pad */0,0,0, SER32(2),
+             0x10, /* pad */0,0,0,0,0,0,0, SER64(0x11), 0x12,
+             0x21, /* pad */0,0,0,0,0,0,   SER64(0x22), 0x23,
+          0x42}
+  },
+  { {Xo,XQ,Xo,Xo,XQ,Xo,XSTOP,XSTOP,Xo,XSTOP},
+    &(struct{uint8_t b; oseq seq; uint8_t c;})
+      {1, {2, (unsigned char *)(struct{uint8_t a; uint8_t b; oseq seq;}[])
+        { {0x10, 0x11, { 3, (unsigned char *)(struct{uint8_t a;}[]){ {'a'}, {'b'}, {'c'}}}},
+          {0x21, 0x22, { 2, (unsigned char *)(struct{uint8_t a;}[]){ {'o'}, {'p'}}}}
+        },
+      }, 0x42 },
+    31,
+    (raw){1, /* pad */0,0,0, SER32(2),
+             0x10, 0x11, /* pad */0,0,   SER32(3), 'a','b','c',
+             0x21, 0x22, /* pad */0,0,0, SER32(2), 'o','p',
+          0x42}
+  },
   { {Xb,XQ,XbPROP,XS,Xo,XSTOP,XSTOP},
     &(struct{char b; oseq seq;}){1, {5, (unsigned char *)(struct{char b;char *s;uint8_t o;}[]){
       {0,"apple",1}, {1,"orange",2}, {0,"cherry",3}, {1,"fig",4}, {1,"prune",5}}}},
@@ -240,7 +263,8 @@ struct desc_invalid descs_invalid[] = {
       SER32(7), 'o','r','a','n','g','e',0, 2,
       SER32(4), 'f','i','g',0, 4, 0,0,0,
       SER32(7), 'p','r','u','n','e',0, 5 // string not terminated
-    } }
+    } },
+  { {XQ,XQ,Xu,XSTOP,XSTOP}, 16, (raw){SER32(2),SER32(1),SER32(31415),SER32(3)} } // nested sequence failure
 };
 
 CU_Test (ddsi_plist_generic, invalid_input)
diff --git a/src/core/ddsi/tests/security_msg.c b/src/core/ddsi/tests/security_msg.c
new file mode 100644
index 0000000..ed389ab
--- /dev/null
+++ b/src/core/ddsi/tests/security_msg.c
@@ -0,0 +1,328 @@
+/*
+ * Copyright(c) 2019 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+
+#include "CUnit/Theory.h"
+#include "dds/ddsrt/heap.h"
+#include "dds/ddsrt/string.h"
+#include "dds/ddsi/ddsi_security_msg.h"
+#include "mem_ser.h"
+
+static nn_participant_generic_message_t test_msg_in =
+{
+  .message_identity            = { {{.u={1,2,3}},{4}}, 5 },
+  .related_message_identity    = { {{.u={5,4,3}},{2}}, 1 },
+  .destinaton_participant_guid = {  {.u={2,3,4}},{5}     },
+  .destination_endpoint_guid   = {  {.u={3,4,5}},{6}     },
+  .source_endpoint_guid        = {  {.u={4,5,6}},{7}     },
+  .message_class_id            = "testing message",
+  .message_data                = {
+     .n = 4,
+     .tags = (nn_dataholder_t[]) {
+       {
+         .class_id = "holder0",
+         .properties = {
+             .n = 3,
+             .props = (dds_property_t[]) {
+                 {
+                   .propagate = false,
+                   .name  = "holder0::prop0name",
+                   .value = "holder0::prop0value",
+                 },
+                 {
+                   .propagate = true,
+                   .name  = "holder0::prop1name",
+                   .value = "holder0::prop1value",
+                 },
+                 {
+                   .propagate = false,
+                   .name  = "holder0::prop2name",
+                   .value = "holder0::prop2value",
+                 },
+             }
+         },
+         .binary_properties = {
+             .n = 1,
+             .props = (dds_binaryproperty_t[]) {
+                 {
+                   .propagate = false,
+                   .name  = "holder0::bprop0name",
+                   .value = { 2, (unsigned char[]){ 1, 2 } },
+                 },
+             }
+         },
+       },
+       {
+         .class_id = "holder1",
+         .properties = {
+             .n = 1,
+             .props = (dds_property_t[]) {
+                 {
+                   .propagate = true,
+                   .name  = "holder1::prop0name",
+                   .value = "holder1::prop0value",
+                 },
+             }
+         },
+         .binary_properties = {
+             .n = 1,
+             .props = (dds_binaryproperty_t[]) {
+                 {
+                   .propagate = true,
+                   .name  = "holder1::bprop0name",
+                   .value = { 3, (unsigned char[]){ 1, 2, 3 } },
+                 },
+             }
+         },
+       },
+       {
+         .class_id = "holder2",
+         .properties = {
+             .n = 1,
+             .props = (dds_property_t[]) {
+                 {
+                   .propagate = false,
+                   .name  = "holder2::prop0name",
+                   .value = "holder2::prop0value",
+                 },
+             }
+         },
+         .binary_properties = {
+             .n = 3,
+             .props = (dds_binaryproperty_t[]) {
+                 {
+                   .propagate = true,
+                   .name  = "holder2::bprop0name",
+                   .value = { 3, (unsigned char[]){ 1, 2, 3 } },
+                 },
+                 {
+                   .propagate = false,
+                   .name  = "holder2::bprop1name",
+                   .value = { 4, (unsigned char[]){ 1, 2, 3, 4 } },
+                 },
+                 {
+                   .propagate = true,
+                   .name  = "holder2::bprop2name",
+                   .value = { 5, (unsigned char[]){ 1, 2, 3, 4, 5 } },
+                 },
+             }
+         },
+       },
+       {
+         .class_id = "holder3",
+         .properties = {
+             .n = 1,
+             .props = (dds_property_t[]) {
+                 {
+                   .propagate = false,
+                   .name  = "holder3::prop0name",
+                   .value = "holder3::prop0value",
+                 },
+             }
+         },
+         .binary_properties = {
+             .n = 1,
+             .props = (dds_binaryproperty_t[]) {
+                 {
+                   .propagate = false,
+                   .name  = "holder3::bprop0name",
+                   .value = { 3, (unsigned char[]){ 1, 2, 3 } },
+                 },
+             }
+         },
+       },
+     },
+  },
+};
+
+/* Same as test_msg_in, excluding the non-propagated properties. */
+static nn_participant_generic_message_t test_msg_out =
+{
+  .message_identity            = { {{.u={1,2,3}},{4}}, 5 },
+  .related_message_identity    = { {{.u={5,4,3}},{2}}, 1 },
+  .destinaton_participant_guid = {  {.u={2,3,4}},{5}     },
+  .destination_endpoint_guid   = {  {.u={3,4,5}},{6}     },
+  .source_endpoint_guid        = {  {.u={4,5,6}},{7}     },
+  .message_class_id            = "testing message",
+  .message_data                = {
+     .n = 4,
+     .tags = (nn_dataholder_t[]) {
+       {
+         .class_id = "holder0",
+         .properties = {
+             .n = 1,
+             .props = (dds_property_t[]) {
+                 {
+                   .propagate = true,
+                   .name  = "holder0::prop1name",
+                   .value = "holder0::prop1value",
+                 },
+             }
+         },
+         .binary_properties = {
+             .n = 0,
+             .props = NULL
+         },
+       },
+       {
+         .class_id = "holder1",
+         .properties = {
+             .n = 1,
+             .props = (dds_property_t[]) {
+                 {
+                   .propagate = true,
+                   .name  = "holder1::prop0name",
+                   .value = "holder1::prop0value",
+                 },
+             }
+         },
+         .binary_properties = {
+             .n = 1,
+             .props = (dds_binaryproperty_t[]) {
+                 {
+                   .propagate = true,
+                   .name  = "holder1::bprop0name",
+                   .value = { 3, (unsigned char[]){ 1, 2, 3 } },
+                 },
+             }
+         },
+       },
+       {
+         .class_id = "holder2",
+         .properties = {
+             .n = 0,
+             .props = NULL,
+         },
+         .binary_properties = {
+             .n = 2,
+             .props = (dds_binaryproperty_t[]) {
+                 {
+                   .propagate = true,
+                   .name  = "holder2::bprop0name",
+                   .value = { 3, (unsigned char[]){ 1, 2, 3 } },
+                 },
+                 {
+                   .propagate = true,
+                   .name  = "holder2::bprop2name",
+                   .value = { 5, (unsigned char[]){ 1, 2, 3, 4, 5 } },
+                 },
+             }
+         },
+       },
+       {
+         .class_id = "holder3",
+         .properties = {
+             .n = 0,
+             .props = NULL,
+         },
+         .binary_properties = {
+             .n = 0,
+             .props = NULL,
+         },
+       },
+     },
+  },
+};
+
+/* The cdr of test_msg_out. */
+static unsigned char test_msg_ser[] = {
+  SER32BE(1), SER32BE(2), SER32BE(3), SER32BE(4), SER64(5),
+  SER32BE(5), SER32BE(4), SER32BE(3), SER32BE(2), SER64(1),
+  SER32BE(2), SER32BE(3), SER32BE(4), SER32BE(5),
+  SER32BE(3), SER32BE(4), SER32BE(5), SER32BE(6),
+  SER32BE(4), SER32BE(5), SER32BE(6), SER32BE(7),
+  SER32(16), 't','e','s','t','i','n','g',' ','m','e','s','s','a','g','e',0,
+    SER32(4),
+    /* dataholder 0 */
+    SER32(8), 'h','o','l','d','e','r','0',0,
+    SER32(1),
+      SER32(19), 'h','o','l','d','e','r','0',':',':','p','r','o','p','1','n','a','m','e',0,/* pad */0,
+      SER32(20), 'h','o','l','d','e','r','0',':',':','p','r','o','p','1','v','a','l','u','e',0,
+    SER32(0),
+    /* dataholder 1 */
+    SER32(8), 'h','o','l','d','e','r','1',0,
+    SER32(1),
+      SER32(19), 'h','o','l','d','e','r','1',':',':','p','r','o','p','0','n','a','m','e',0,/* pad */0,
+      SER32(20), 'h','o','l','d','e','r','1',':',':','p','r','o','p','0','v','a','l','u','e',0,
+    SER32(1),
+      SER32(20), 'h','o','l','d','e','r','1',':',':','b','p','r','o','p','0','n','a','m','e',0,
+      SER32(3), 1,2,3,  /* pad */0,
+    /* dataholder 2 */
+    SER32(8), 'h','o','l','d','e','r','2',0,
+    SER32(0),
+    SER32(2),
+      SER32(20), 'h','o','l','d','e','r','2',':',':','b','p','r','o','p','0','n','a','m','e',0,
+      SER32(3), 1,2,3,  /* pad */0,
+      SER32(20), 'h','o','l','d','e','r','2',':',':','b','p','r','o','p','2','n','a','m','e',0,
+      SER32(5), 1,2,3,4,5,  /* pad */0,0,0,
+    /* dataholder 2 */
+    SER32(8), 'h','o','l','d','e','r','3',0,
+    SER32(0),
+    SER32(0)
+};
+
+CU_Test (ddsi_security_msg, serializer)
+{
+  nn_participant_generic_message_t msg_in;
+  nn_participant_generic_message_t msg_ser;
+  unsigned char *data = NULL;
+  dds_return_t ret;
+  size_t len;
+  bool equal;
+
+  /* Create the message (normally with various arguments). */
+  nn_participant_generic_message_init(
+              &msg_in,
+              &test_msg_in.message_identity.source_guid,
+               test_msg_in.message_identity.sequence_number,
+              &test_msg_in.destinaton_participant_guid,
+              &test_msg_in.destination_endpoint_guid,
+              &test_msg_in.source_endpoint_guid,
+               test_msg_in.message_class_id,
+              &test_msg_in.message_data,
+              &test_msg_in.related_message_identity);
+
+  /* Check creation result. */
+  equal = plist_equal_generic(&msg_in, &test_msg_in, pserop_participant_generic_message);
+  CU_ASSERT_FATAL(equal == true);
+
+  /* Serialize the message. */
+  ret = nn_participant_generic_message_serialize(&msg_in, &data, &len);
+  CU_ASSERT_FATAL (ret == DDS_RETCODE_OK);
+  CU_ASSERT_PTR_NOT_NULL_FATAL(data);
+  CU_ASSERT(len > 0);
+
+  /* Check serialization result. */
+  size_t cmpsize = (len < sizeof(test_msg_ser)) ? len : sizeof(test_msg_ser);
+  if (memcmp (data, test_msg_ser, cmpsize) != 0)
+  {
+    printf ("memcmp(%d)\n", (int)cmpsize);
+    for (size_t k = 0; k < cmpsize; k++)
+      printf ("  %3zu  %02x  %02x (%c) %s\n", k, data[k], test_msg_ser[k],
+              ((test_msg_ser[k] >= '0') && (test_msg_ser[k] <= 'z')) ? test_msg_ser[k] : ' ',
+              (data[k] == test_msg_ser[k]) ? "" : "<--");
+    CU_ASSERT (!(bool)"memcmp");
+  }
+  CU_ASSERT_FATAL (len == sizeof(test_msg_ser));
+
+  /* Deserialize the message. */
+  ret = nn_participant_generic_message_deseralize(&msg_ser, data, len, false);
+  CU_ASSERT_FATAL (ret == DDS_RETCODE_OK);
+
+  /* Check deserialization result. */
+  equal = plist_equal_generic(&msg_ser, &test_msg_out, pserop_participant_generic_message);
+  CU_ASSERT_FATAL(equal == true);
+
+  /* Cleanup. */
+  nn_participant_generic_message_deinit(&msg_in);
+  nn_participant_generic_message_deinit(&msg_ser);
+  ddsrt_free(data);
+}

From 7f59a46ff823a94207d39af2e7b0d112033b71e4 Mon Sep 17 00:00:00 2001
From: dennis-adlink <45659984+dennis-adlink@users.noreply.github.com>
Date: Tue, 29 Oct 2019 16:56:12 +0100
Subject: [PATCH 072/238] Add PropertyPolicy to QoS API for Security settings
 (#278)

* Add PropertyPolicy to QoS API for Security settings

This commit adds the public API for PropertyQosPolicy including
tests. This policy can be used to set the parameters for the DDS security
implementation, as an alternative for using the xml configuration.
Tests are also inlcuded for setting security properties and conflict
resolving when both security configuration and qos properties are present.
Finally, the pubsub tool is updated so that is handles this qos correctly.

Signed-off-by: Dennis Potman <dennis.potman@adlinktech.com>

* Init binary_value.props to fix failing qos merge and moved init code in qset_prop functions

Signed-off-by: Dennis Potman <dennis.potman@adlinktech.com>

* Add additional test and some validation improvements based on review comments

Signed-off-by: Dennis Potman <dennis.potman@adlinktech.com>

* Refactoring of qos property

Refactored the qos property handling based on review comments. Setting
and unsettings functions are simplified and now use helper functions
for lookup, property initialisation is simplified. Added an additional
check for required security properties when creating participant using
security settings from qos, and added a test-case for this code.

Signed-off-by: Dennis Potman <dennis.potman@adlinktech.com>

* Check for qos flag before getting property index from qos

Signed-off-by: Dennis Potman <dennis.potman@adlinktech.com>

* Participant creation should fail on inconsistent security qos properties, and some minor code improvements in property qos api functions

Signed-off-by: Dennis Potman <dennis.potman@adlinktech.com>

* Update log message in test security_config_qos

Signed-off-by: Dennis Potman <dennis.potman@adlinktech.com>

* Fixed unused label compiler error in q_entity.c when security is disabled

Signed-off-by: Dennis Potman <dennis.potman@adlinktech.com>

* Refactored qprop functions with macros to avoid code duplicate code

Signed-off-by: Dennis Potman <dennis.potman@adlinktech.com>
---
 .../ddsc/include/dds/ddsc/dds_public_qos.h    | 134 ++++++++
 .../include/dds/ddsc/dds_public_qosdefs.h     |   3 +-
 src/core/ddsc/src/dds__qos.h                  |   7 +-
 src/core/ddsc/src/dds_qos.c                   | 167 +++++++++
 src/core/ddsc/tests/config.c                  | 324 ++++++++++++++++++
 src/core/ddsc/tests/qos.c                     | 188 +++++++++-
 src/core/ddsi/include/dds/ddsi/q_xqos.h       |  14 +-
 src/core/ddsi/src/q_entity.c                  |  45 ++-
 src/core/ddsi/src/q_plist.c                   |  80 +++--
 src/tools/pubsub/common.h                     |  11 +-
 src/tools/pubsub/pubsub.c                     |   1 +
 11 files changed, 927 insertions(+), 47 deletions(-)

diff --git a/src/core/ddsc/include/dds/ddsc/dds_public_qos.h b/src/core/ddsc/include/dds/ddsc/dds_public_qos.h
index 503a567..1705750 100644
--- a/src/core/ddsc/include/dds/ddsc/dds_public_qos.h
+++ b/src/core/ddsc/include/dds/ddsc/dds_public_qos.h
@@ -379,6 +379,72 @@ dds_qset_ignorelocal (
   dds_qos_t * __restrict qos,
   dds_ignorelocal_kind_t ignore);
 
+/**
+ * @brief Stores a property with the provided name and string value in a qos structure.
+ *
+ * In the case a property with the provided name already exists in the qos structure,
+ * the value for this entry is overwritten with the provided string value. If more than
+ * one property with the provided name exists, only the value of the first of these
+ * properties is updated.
+ *
+ * @param[in,out] qos - Pointer to a dds_qos_t structure that will store the property
+ * @param[in] name - Pointer to name of the property
+ * @param[in] value - Pointer to a (null-terminated) string that will be stored
+ */
+DDS_EXPORT void
+dds_qset_prop (
+  dds_qos_t * __restrict qos,
+  const char * name,
+  const char * value);
+
+/**
+ * @brief Removes the property with the provided name from a qos structure.
+ *
+ * In case more than one property exists with this name, only the first property
+ * is removed.
+ *
+ * @param[in,out] qos - Pointer to a dds_qos_t structure that contains the property
+ * @param[in] name - Pointer to name of the property
+ */
+DDS_EXPORT void
+dds_qunset_prop (
+  dds_qos_t * __restrict qos,
+  const char * name);
+
+/**
+ * @brief Stores the provided binary data as a property in a qos structure
+ *
+ * In the case a property with the provided name already exists in the qos structure,
+ * the value for this entry is overwritten with the provided data. If more than one
+ * property with the provided name exists, only the value of the first of these
+ * properties is updated.
+ *
+ * @param[in,out] qos - Pointer to a dds_qos_t structure that will store the property
+ * @param[in] name - Pointer to name of the property
+ * @param[in] value - Pointer to data to be stored in the property
+ * @param[in] sz - Size of the data
+ */
+DDS_EXPORT void
+dds_qset_bprop (
+  dds_qos_t * __restrict qos,
+  const char * name,
+  const void * value,
+  const size_t sz);
+
+/**
+ * @brief Removes the binary property with the provided name from a qos structure.
+ *
+ * In case more than one binary property exists with this name, only the first binary
+ * property is removed.
+ *
+ * @param[in,out] qos - Pointer to a dds_qos_t structure that contains the binary property
+ * @param[in] name - Pointer to name of the property
+ */
+DDS_EXPORT void
+dds_qunset_bprop (
+  dds_qos_t * __restrict qos,
+  const char * name);
+
 /**
  * @brief Get the userdata from a qos structure
  *
@@ -680,6 +746,74 @@ dds_qget_ignorelocal (
   const dds_qos_t * __restrict qos,
   dds_ignorelocal_kind_t *ignore);
 
+/**
+ * @brief Gets the names of the properties from a qos structure.
+ *
+ * @param[in,out] qos - Pointer to a dds_qos_t structure that contains properties
+ * @param[in,out] n - Pointer to number of property names that are returned (optional)
+ * @param[in,out] names - Pointer that will store the string(s) containing property name(s) (optional). This function will allocate the memory for the list of names and for the strings containing the names; the caller gets ownership of the allocated memory
+ *
+ * @returns - false iff any of the arguments is invalid or the qos is not present in the qos object
+ */
+DDS_EXPORT bool
+dds_qget_propnames (
+  const dds_qos_t * __restrict qos,
+  uint32_t * n,
+  char *** names);
+
+/**
+ * @brief Get the value of the property with the provided name from a qos structure.
+ *
+ * In case more than one property exists with this name, the value for the first
+ * property with this name will be returned.
+ *
+ * @param[in,out] qos - Pointer to a dds_qos_t structure that contains the property
+ * @param[in] name - Pointer to name of the property
+ * @param[in,out] value - Pointer to a string that will store the value of the property. The memory for storing the string value will be allocated by this function and the caller gets ownership of the allocated memory
+ *
+ * @returns - false iff any of the arguments is invalid, the qos is not present in the qos object or there was no property found with the provided name
+ */
+DDS_EXPORT bool
+dds_qget_prop (
+  const dds_qos_t * __restrict qos,
+  const char * name,
+  char ** value);
+
+/**
+ * @brief Gets the names of the binary properties from a qos structure.
+ *
+ * @param[in,out] qos - Pointer to a dds_qos_t structure that contains binary properties
+ * @param[in,out] n - Pointer to number of binary property names that are returned (optional)
+ * @param[in,out] names - Pointer that will store the string(s) containing binary property name(s) (optional). This function will allocate the memory for the list of names and for the strings containing the names; the caller gets ownership of the allocated memory
+ *
+ * @returns - false iff any of the arguments is invalid or the qos is not present in the qos object
+ */
+DDS_EXPORT bool
+dds_qget_bpropnames (
+  const dds_qos_t * __restrict qos,
+  uint32_t * n,
+  char *** names);
+
+/**
+ * @brief Get the value of the binary property with the provided name from a qos structure.
+ *
+ * In case more than one binary property exists with this name, the value for the first
+ * binary property with this name will be returned.
+ *
+ * @param[in,out] qos - Pointer to a dds_qos_t structure that contains the property
+ * @param[in] name - Pointer to name of the binary property
+ * @param[in,out] value - Pointer to a buffer that will store the value of the property. If sz = 0 then a NULL pointer. The memory for storing the value will be allocated by this function and the caller gets ownership of the allocated memory
+ * @param[in,out] sz - Pointer that will store the size of the returned buffer.
+ *
+ * @returns - false iff any of the arguments is invalid, the qos is not present in the qos object or there was no binary property found with the provided name
+ */
+DDS_EXPORT bool
+dds_qget_bprop (
+  const dds_qos_t * __restrict qos,
+  const char * name,
+  void ** value,
+  size_t * sz);
+
 #if defined (__cplusplus)
 }
 #endif
diff --git a/src/core/ddsc/include/dds/ddsc/dds_public_qosdefs.h b/src/core/ddsc/include/dds/ddsc/dds_public_qosdefs.h
index 810d471..a150b94 100644
--- a/src/core/ddsc/include/dds/ddsc/dds_public_qosdefs.h
+++ b/src/core/ddsc/include/dds/ddsc/dds_public_qosdefs.h
@@ -50,7 +50,8 @@ typedef enum dds_qos_policy_id {
   DDS_GROUPDATA_QOS_POLICY_ID,
   DDS_TRANSPORTPRIORITY_QOS_POLICY_ID,
   DDS_LIFESPAN_QOS_POLICY_ID,
-  DDS_DURABILITYSERVICE_QOS_POLICY_ID
+  DDS_DURABILITYSERVICE_QOS_POLICY_ID,
+  DDS_PROPERTY_QOS_POLICY_ID,
 } dds_qos_policy_id_t;
 
 /* QoS structure is opaque */
diff --git a/src/core/ddsc/src/dds__qos.h b/src/core/ddsc/src/dds__qos.h
index be21eb9..e79febc 100644
--- a/src/core/ddsc/src/dds__qos.h
+++ b/src/core/ddsc/src/dds__qos.h
@@ -25,7 +25,8 @@ extern "C" {
    QP_DESTINATION_ORDER | QP_HISTORY | QP_RESOURCE_LIMITS)
 
 #define DDS_PARTICIPANT_QOS_MASK                                        \
-  (QP_USER_DATA | QP_PRISMTECH_ENTITY_FACTORY | QP_CYCLONE_IGNORELOCAL)
+  (QP_USER_DATA | QP_PRISMTECH_ENTITY_FACTORY |                         \
+   QP_CYCLONE_IGNORELOCAL | QP_PROPERTY_LIST)
 
 #define DDS_PUBLISHER_QOS_MASK                                          \
   (QP_PARTITION | QP_PRESENTATION | QP_GROUP_DATA |                     \
@@ -36,7 +37,7 @@ extern "C" {
    QP_OWNERSHIP | QP_LIVELINESS | QP_TIME_BASED_FILTER |                \
    QP_RELIABILITY | QP_DESTINATION_ORDER | QP_HISTORY |                 \
    QP_RESOURCE_LIMITS | QP_PRISMTECH_READER_DATA_LIFECYCLE |            \
-   QP_CYCLONE_IGNORELOCAL)
+   QP_CYCLONE_IGNORELOCAL | QP_PROPERTY_LIST)
 
 #define DDS_SUBSCRIBER_QOS_MASK                                         \
   (QP_PARTITION | QP_PRESENTATION | QP_GROUP_DATA |                     \
@@ -48,7 +49,7 @@ extern "C" {
    QP_LIVELINESS | QP_RELIABILITY | QP_TRANSPORT_PRIORITY |             \
    QP_LIFESPAN | QP_DESTINATION_ORDER | QP_HISTORY |                    \
    QP_RESOURCE_LIMITS | QP_PRISMTECH_WRITER_DATA_LIFECYCLE |            \
-   QP_CYCLONE_IGNORELOCAL)
+   QP_CYCLONE_IGNORELOCAL | QP_PROPERTY_LIST)
 
 #if defined (__cplusplus)
 }
diff --git a/src/core/ddsc/src/dds_qos.c b/src/core/ddsc/src/dds_qos.c
index 68f12e6..1cebe53 100644
--- a/src/core/ddsc/src/dds_qos.c
+++ b/src/core/ddsc/src/dds_qos.c
@@ -335,6 +335,110 @@ void dds_qset_ignorelocal (dds_qos_t * __restrict qos, dds_ignorelocal_kind_t ig
   qos->present |= QP_CYCLONE_IGNORELOCAL;
 }
 
+static void dds_qprop_init (dds_qos_t * qos)
+{
+  if (!(qos->present & QP_PROPERTY_LIST))
+  {
+    qos->property.value.n = 0;
+    qos->property.value.props = NULL;
+    qos->property.binary_value.n = 0;
+    qos->property.binary_value.props = NULL;
+    qos->present |= QP_PROPERTY_LIST;
+  }
+}
+
+#define DDS_QPROP_GET_INDEX(prop_type_, prop_field_) \
+static bool dds_q##prop_type_##_get_index (const dds_qos_t * qos, const char * name, uint32_t * index) \
+{ \
+  if (qos == NULL || name == NULL || index == NULL || !(qos->present & QP_PROPERTY_LIST)) \
+    return false; \
+  for (uint32_t i = 0; i < qos->property.prop_field_.n; i++) \
+  { \
+    if (strcmp (qos->property.prop_field_.props[i].name, name) == 0) \
+    { \
+      *index = i; \
+      return true; \
+    } \
+  } \
+  return false; \
+}
+DDS_QPROP_GET_INDEX (prop, value)
+DDS_QPROP_GET_INDEX (bprop, binary_value)
+
+#define DDS_QUNSET_PROP(prop_type_, prop_field_, value_field_) \
+void dds_qunset_##prop_type_ (dds_qos_t * __restrict qos, const char * name) \
+{ \
+  uint32_t i; \
+  if (qos == NULL || !(qos->present & QP_PROPERTY_LIST) || qos->property.prop_field_.n == 0 || name == NULL) \
+    return; \
+  if (dds_q##prop_type_##_get_index (qos, name, &i)) \
+  { \
+    dds_free (qos->property.prop_field_.props[i].name); \
+    dds_free (qos->property.prop_field_.props[i].value_field_); \
+    if (qos->property.prop_field_.n > 1) \
+    { \
+      if (i < (qos->property.prop_field_.n - 1)) \
+        memmove (qos->property.prop_field_.props + i, qos->property.prop_field_.props + i + 1, \
+          (qos->property.prop_field_.n - i - 1) * sizeof (*qos->property.prop_field_.props)); \
+      qos->property.prop_field_.props = dds_realloc (qos->property.prop_field_.props, \
+        (qos->property.prop_field_.n - 1) * sizeof (*qos->property.prop_field_.props)); \
+    } \
+    else \
+    { \
+      dds_free (qos->property.prop_field_.props); \
+      qos->property.prop_field_.props = NULL; \
+    } \
+    qos->property.prop_field_.n--; \
+  } \
+}
+DDS_QUNSET_PROP (prop, value, value)
+DDS_QUNSET_PROP (bprop, binary_value, value.value)
+
+void dds_qset_prop (dds_qos_t * __restrict qos, const char * name, const char * value)
+{
+  uint32_t i;
+  if (qos == NULL || name == NULL || value == NULL)
+    return;
+
+  dds_qprop_init (qos);
+  if (dds_qprop_get_index (qos, name, &i))
+  {
+    dds_free (qos->property.value.props[i].value);
+    qos->property.value.props[i].value = dds_string_dup (value);
+  }
+  else
+  {
+    qos->property.value.props = dds_realloc (qos->property.value.props,
+      (qos->property.value.n + 1) * sizeof (*qos->property.value.props));
+    qos->property.value.props[qos->property.value.n].propagate = 0;
+    qos->property.value.props[qos->property.value.n].name = dds_string_dup (name);
+    qos->property.value.props[qos->property.value.n].value = dds_string_dup (value);
+    qos->property.value.n++;
+  }
+}
+
+void dds_qset_bprop (dds_qos_t * __restrict qos, const char * name, const void * value, const size_t sz)
+{
+  uint32_t i;
+  if (qos == NULL || name == NULL || (value == NULL && sz > 0))
+    return;
+
+  dds_qprop_init (qos);
+  if (dds_qbprop_get_index (qos, name, &i))
+  {
+    dds_qos_data_copy_in (&qos->property.binary_value.props[i].value, value, sz, true);
+  }
+  else
+  {
+    qos->property.binary_value.props = dds_realloc (qos->property.binary_value.props,
+      (qos->property.binary_value.n + 1) * sizeof (*qos->property.binary_value.props));
+    qos->property.binary_value.props[qos->property.binary_value.n].propagate = 0;
+    qos->property.binary_value.props[qos->property.binary_value.n].name = dds_string_dup (name);
+    dds_qos_data_copy_in (&qos->property.binary_value.props[qos->property.binary_value.n].value, value, sz, false);
+    qos->property.binary_value.n++;
+  }
+}
+
 bool dds_qget_userdata (const dds_qos_t * __restrict qos, void **value, size_t *sz)
 {
   if (qos == NULL || !(qos->present & QP_USER_DATA))
@@ -565,3 +669,66 @@ bool dds_qget_ignorelocal (const dds_qos_t * __restrict qos, dds_ignorelocal_kin
     *ignore = qos->ignorelocal.value;
   return true;
 }
+
+#define DDS_QGET_PROPNAMES(prop_type_, prop_field_) \
+bool dds_qget_##prop_type_##names (const dds_qos_t * __restrict qos, uint32_t * n, char *** names) \
+{ \
+  bool props; \
+  if (qos == NULL || (n == NULL && names == NULL)) \
+    return false; \
+  props = (qos->present & QP_PROPERTY_LIST) && qos->property.prop_field_.n > 0; \
+  if (n != NULL) \
+    *n = props ? qos->property.prop_field_.n : 0; \
+  if (names != NULL) \
+  { \
+    if (!props) \
+      *names = NULL; \
+    else \
+    { \
+      *names = dds_alloc (sizeof (char *) * qos->property.prop_field_.n); \
+      for (uint32_t i = 0; i < qos->property.prop_field_.n; i++) \
+        (*names)[i] = dds_string_dup (qos->property.prop_field_.props[i].name); \
+    } \
+  } \
+  return props; \
+}
+DDS_QGET_PROPNAMES (prop, value)
+DDS_QGET_PROPNAMES (bprop, binary_value)
+
+bool dds_qget_prop (const dds_qos_t * __restrict qos, const char * name, char ** value)
+{
+  uint32_t i;
+  bool found;
+
+  if (qos == NULL || name == NULL)
+    return false;
+
+  found = dds_qprop_get_index (qos, name, &i);
+  if (value != NULL)
+    *value = found ? dds_string_dup (qos->property.value.props[i].value) : NULL;
+  return found;
+}
+
+bool dds_qget_bprop (const dds_qos_t * __restrict qos, const char * name, void ** value, size_t * sz)
+{
+  uint32_t i;
+  bool found;
+
+  if (qos == NULL || name == NULL || (sz == NULL && value != NULL))
+    return false;
+
+  found = dds_qbprop_get_index (qos, name, &i);
+  if (found)
+  {
+    if (value != NULL || sz != NULL)
+      dds_qos_data_copy_out (&qos->property.binary_value.props[i].value, value, sz);
+  }
+  else
+  {
+    if (value != NULL)
+      *value = NULL;
+    if (sz != NULL)
+      *sz = 0;
+  }
+  return found;
+}
diff --git a/src/core/ddsc/tests/config.c b/src/core/ddsc/tests/config.c
index 248cc5c..b64241e 100644
--- a/src/core/ddsc/tests/config.c
+++ b/src/core/ddsc/tests/config.c
@@ -20,6 +20,7 @@
 #include "dds/ddsrt/environ.h"
 #include "dds/ddsrt/heap.h"
 #include "dds/ddsi/q_misc.h"
+#include "dds/ddsi/q_xqos.h"
 
 #define FORCE_ENV
 
@@ -500,3 +501,326 @@ CU_Test(ddsc_config, security_deprecated, .init = ddsrt_init, .fini = ddsrt_fini
     CU_ASSERT_FATAL(found == 0x1fffff);
 #endif
 }
+
+CU_Test(ddsc_config, security_qos, .init = ddsrt_init, .fini = ddsrt_fini)
+{
+    /* Expected traces when creating participant with the security elements. */
+    const char *log_expected[] = {
+#ifdef DDSI_INCLUDE_SECURITY
+      /* The config should have been parsed into the participant QoS. */
+      "PARTICIPANT * QOS={*property_list={value={"
+        "{dds.sec.auth.identity_ca,testtext_IdentityCA_testtext,0},"
+        "{dds.sec.auth.private_key,testtext_PrivateKey_testtext,0},"
+        "{dds.sec.auth.identity_certificate,testtext_IdentityCertificate_testtext,0},"
+        "{dds.sec.access.permissions_ca,file:Permissions_CA.pem,0},"
+        "{dds.sec.access.governance,file:Governance.p7s,0},"
+        "{dds.sec.access.permissions,file:Permissions.p7s,0},"
+        "{dds.sec.auth.password,testtext_Password_testtext,0},"
+        "{dds.sec.auth.trusted_ca_dir,file:/test/dir,0}"
+        "}binary_value={}}*}*",
+#endif
+      NULL
+    };
+
+    dds_entity_t participant;
+    dds_qos_t * qos;
+
+    /* Set up the trace sinks to detect the config parsing. */
+    dds_set_log_mask(DDS_LC_FATAL|DDS_LC_ERROR|DDS_LC_WARNING|DDS_LC_CONFIG);
+    dds_set_log_sink(&logger, (void*)log_expected);
+    dds_set_trace_sink(&logger, (void*)log_expected);
+
+    /* Create the qos */
+    CU_ASSERT_FATAL ((qos = dds_create_qos()) != NULL);
+    dds_qset_prop (qos, "dds.sec.auth.identity_ca", "testtext_IdentityCA_testtext");
+    dds_qset_prop (qos, "dds.sec.auth.private_key", "testtext_PrivateKey_testtext");
+    dds_qset_prop (qos, "dds.sec.auth.identity_certificate", "testtext_IdentityCertificate_testtext");
+    dds_qset_prop (qos, "dds.sec.access.permissions_ca", "file:Permissions_CA.pem");
+    dds_qset_prop (qos, "dds.sec.access.governance", "file:Governance.p7s");
+    dds_qset_prop (qos, "dds.sec.access.permissions", "file:Permissions.p7s");
+    dds_qset_prop (qos, "dds.sec.auth.password", "testtext_Password_testtext");
+    dds_qset_prop (qos, "dds.sec.auth.trusted_ca_dir", "file:/test/dir");
+
+    /* Create participant with security config in qos. */
+    found = 0;
+    ddsrt_setenv(URI_VARIABLE, "<Tracing><Verbosity>finest</></>");
+    CU_ASSERT_FATAL ((participant = dds_create_participant(DDS_DOMAIN_DEFAULT, qos, NULL)) > 0);
+    ddsrt_setenv(URI_VARIABLE, "");
+    dds_delete(participant);
+    dds_delete_qos(qos);
+
+    /* All traces should have been provided. */
+#ifndef DDSI_INCLUDE_SECURITY
+    CU_ASSERT_FATAL(found == 0);
+#else
+    CU_ASSERT_FATAL(found == 0x1);
+#endif
+}
+
+CU_Test(ddsc_config, security_qos_props, .init = ddsrt_init, .fini = ddsrt_fini)
+{
+    /* Expected traces when creating participant with the security elements. */
+    const char *log_expected[] = {
+#ifdef DDSI_INCLUDE_SECURITY
+      /* The config should have been parsed into the participant QoS. */
+      "PARTICIPANT * QOS={*property_list={value={"
+        "{test.prop1,testtext_value1_testtext,0},"
+        "{dds.sec.auth.identity_ca,testtext_IdentityCA_testtext,0},"
+        "{dds.sec.auth.private_key,testtext_PrivateKey_testtext,0},"
+        "{dds.sec.auth.identity_certificate,testtext_IdentityCertificate_testtext,0},"
+        "{dds.sec.access.permissions_ca,file:Permissions_CA.pem,0},"
+        "{dds.sec.access.governance,file:Governance.p7s,0},"
+        "{dds.sec.access.permissions,file:Permissions.p7s,0},"
+        "{dds.sec.auth.password,testtext_Password_testtext,0},"
+        "{dds.sec.auth.trusted_ca_dir,file:/test/dir,0},"
+        "{test.prop2,testtext_value2_testtext,0}}"
+        "binary_value={{test.bprop1,(3,*),0}}}*}*",
+#endif
+      NULL
+    };
+
+    dds_entity_t participant;
+    dds_qos_t * qos;
+
+    /* Set up the trace sinks to detect the config parsing. */
+    dds_set_log_mask(DDS_LC_FATAL|DDS_LC_ERROR|DDS_LC_WARNING|DDS_LC_CONFIG);
+    dds_set_log_sink(&logger, (void*)log_expected);
+    dds_set_trace_sink(&logger, (void*)log_expected);
+
+    /* Create the qos */
+    unsigned char bvalue[3] = { 0x01, 0x02, 0x03 };
+    CU_ASSERT_FATAL ((qos = dds_create_qos()) != NULL);
+    dds_qset_prop (qos, "test.prop1", "testtext_value1_testtext");
+    dds_qset_prop (qos, "dds.sec.auth.identity_ca", "testtext_IdentityCA_testtext");
+    dds_qset_prop (qos, "dds.sec.auth.private_key", "testtext_PrivateKey_testtext");
+    dds_qset_prop (qos, "dds.sec.auth.identity_certificate", "testtext_IdentityCertificate_testtext");
+    dds_qset_prop (qos, "dds.sec.access.permissions_ca", "file:Permissions_CA.pem");
+    dds_qset_prop (qos, "dds.sec.access.governance", "file:Governance.p7s");
+    dds_qset_prop (qos, "dds.sec.access.permissions", "file:Permissions.p7s");
+    dds_qset_prop (qos, "dds.sec.auth.password", "testtext_Password_testtext");
+    dds_qset_prop (qos, "dds.sec.auth.trusted_ca_dir", "file:/test/dir");
+    dds_qset_prop (qos, "test.prop2", "testtext_value2_testtext");
+    dds_qset_bprop (qos, "test.bprop1", bvalue, 3);
+
+    /* Create participant with security config in qos. */
+    found = 0;
+    ddsrt_setenv(URI_VARIABLE, "<Tracing><Verbosity>finest</></>");
+    CU_ASSERT_FATAL ((participant = dds_create_participant(DDS_DOMAIN_DEFAULT, qos, NULL)) > 0);
+    ddsrt_setenv(URI_VARIABLE, "");
+    dds_delete(participant);
+    dds_delete_qos(qos);
+
+    /* All traces should have been provided. */
+#ifndef DDSI_INCLUDE_SECURITY
+    CU_ASSERT_FATAL(found == 0);
+#else
+    CU_ASSERT_FATAL(found == 0x1);
+#endif
+}
+
+CU_Test(ddsc_config, security_config_qos, .init = ddsrt_init, .fini = ddsrt_fini)
+{
+    /* Expect qos settings used when creating participant with config security elements and qos. */
+    const char *log_expected[] = {
+#ifndef DDSI_INCLUDE_SECURITY
+      "config: //CycloneDDS/Domain: DDSSecurity: unknown element*",
+#else
+      /* The security settings from qos properties should have been parsed into the participant QoS. */
+      "new_participant(*): using security settings from QoS, ignoring security configuration*",
+      "PARTICIPANT * QOS={*property_list={value={"
+        "{dds.sec.auth.identity_ca,testtext_QOS_IdentityCA_testtext,0},"
+        "{dds.sec.auth.private_key,testtext_QOS_PrivateKey_testtext,0},"
+        "{dds.sec.auth.identity_certificate,testtext_QOS_IdentityCertificate_testtext,0},"
+        "{dds.sec.access.permissions_ca,file:QOS_Permissions_CA.pem,0},"
+        "{dds.sec.access.governance,file:QOS_Governance.p7s,0},"
+        "{dds.sec.access.permissions,file:QOS_Permissions.p7s,0}"
+        "}binary_value={}}*}*",
+#endif
+      NULL
+    };
+
+    const char *sec_config =
+      "<Tracing><Verbosity>finest</></>"
+      "<DDSSecurity>"
+        "<Authentication>"
+          "<IdentityCertificate>testtext_IdentityCertificate_testtext</IdentityCertificate>"
+          "<IdentityCA>testtext_IdentityCA_testtext</IdentityCA>"
+          "<PrivateKey>testtext_PrivateKey_testtext</PrivateKey>"
+        "</Authentication>"
+        "<AccessControl>"
+          "<Governance>file:Governance.p7s</Governance>"
+          "<PermissionsCA>file:Permissions_CA.pem</PermissionsCA>"
+          "<Permissions>file:Permissions.p7s</Permissions>"
+        "</AccessControl>"
+      "</DDSSecurity>";
+
+    dds_entity_t participant;
+    dds_qos_t * qos;
+
+    CU_ASSERT_FATAL ((qos = dds_create_qos()) != NULL);
+    dds_qset_prop (qos, "dds.sec.auth.identity_ca", "testtext_QOS_IdentityCA_testtext");
+    dds_qset_prop (qos, "dds.sec.auth.private_key", "testtext_QOS_PrivateKey_testtext");
+    dds_qset_prop (qos, "dds.sec.auth.identity_certificate", "testtext_QOS_IdentityCertificate_testtext");
+    dds_qset_prop (qos, "dds.sec.access.permissions_ca", "file:QOS_Permissions_CA.pem");
+    dds_qset_prop (qos, "dds.sec.access.governance", "file:QOS_Governance.p7s");
+    dds_qset_prop (qos, "dds.sec.access.permissions", "file:QOS_Permissions.p7s");
+
+    /* Set up the trace sinks to detect the config parsing. */
+    dds_set_log_mask(DDS_LC_FATAL|DDS_LC_ERROR|DDS_LC_WARNING|DDS_LC_CONFIG);
+    dds_set_log_sink(&logger, (void*)log_expected);
+    dds_set_trace_sink(&logger, (void*)log_expected);
+
+    /* Create participant with security elements. */
+    found = 0;
+    ddsrt_setenv(URI_VARIABLE, sec_config);
+    participant = dds_create_participant(DDS_DOMAIN_DEFAULT, qos, NULL);
+    ddsrt_setenv(URI_VARIABLE, "");
+    dds_delete(participant);
+    dds_delete_qos(qos);
+
+    /* All traces should have been provided. */
+#ifndef DDSI_INCLUDE_SECURITY
+    CU_ASSERT_FATAL(found == 0x1);
+#else
+    CU_ASSERT_FATAL(found == 0x3);
+#endif
+}
+
+CU_Test(ddsc_config, security_other_prop, .init = ddsrt_init, .fini = ddsrt_fini)
+{
+    /* Expect config used when creating participant with config security elements and
+     * qos containing only non-security properties. */
+    const char *log_expected[] = {
+#ifndef DDSI_INCLUDE_SECURITY
+      "config: //CycloneDDS/Domain: DDSSecurity: unknown element*",
+#else
+      /* The security settings from config should have been parsed into the participant QoS. */
+      "PARTICIPANT * QOS={*property_list={value={"
+        "{test.dds.sec.prop1,testtext_value1_testtext,0},"
+        "{dds.sec.auth.identity_ca,testtext_IdentityCA_testtext,0},"
+        "{dds.sec.auth.private_key,testtext_PrivateKey_testtext,0},"
+        "{dds.sec.auth.identity_certificate,testtext_IdentityCertificate_testtext,0},"
+        "{dds.sec.access.permissions_ca,file:Permissions_CA.pem,0},"
+        "{dds.sec.access.governance,file:Governance.p7s,0},"
+        "{dds.sec.access.permissions,file:Permissions.p7s,0}"
+        "}binary_value={}}*}*",
+#endif
+      NULL
+    };
+
+    const char *sec_config =
+      "<Tracing><Verbosity>finest</></>"
+      "<DDSSecurity>"
+        "<Authentication>"
+          "<IdentityCertificate>testtext_IdentityCertificate_testtext</IdentityCertificate>"
+          "<IdentityCA>testtext_IdentityCA_testtext</IdentityCA>"
+          "<PrivateKey>testtext_PrivateKey_testtext</PrivateKey>"
+        "</Authentication>"
+        "<AccessControl>"
+          "<Governance>file:Governance.p7s</Governance>"
+          "<PermissionsCA>file:Permissions_CA.pem</PermissionsCA>"
+          "<Permissions>file:Permissions.p7s</Permissions>"
+        "</AccessControl>"
+      "</DDSSecurity>";
+
+    dds_entity_t participant;
+    dds_qos_t * qos;
+
+    CU_ASSERT_FATAL ((qos = dds_create_qos()) != NULL);
+    dds_qset_prop (qos, "test.dds.sec.prop1", "testtext_value1_testtext");
+
+    /* Set up the trace sinks to detect the config parsing. */
+    dds_set_log_mask(DDS_LC_FATAL|DDS_LC_ERROR|DDS_LC_WARNING|DDS_LC_CONFIG);
+    dds_set_log_sink(&logger, (void*)log_expected);
+    dds_set_trace_sink(&logger, (void*)log_expected);
+
+    /* Create participant with security elements. */
+    found = 0;
+    ddsrt_setenv(URI_VARIABLE, sec_config);
+    participant = dds_create_participant(DDS_DOMAIN_DEFAULT, qos, NULL);
+    ddsrt_setenv(URI_VARIABLE, "");
+    dds_delete(participant);
+    dds_delete_qos(qos);
+
+    /* All traces should have been provided. */
+#ifndef DDSI_INCLUDE_SECURITY
+    CU_ASSERT_FATAL(found == 0x1);
+#else
+    CU_ASSERT_FATAL(found == 0x1);
+#endif
+}
+
+CU_Test(ddsc_config, security_qos_invalid, .init = ddsrt_init, .fini = ddsrt_fini)
+{
+    /* Expected traces when creating participant with the security elements. */
+    const char *log_expected[] = {
+#ifndef DDSI_INCLUDE_SECURITY
+      "config: //CycloneDDS/Domain: DDSSecurity: unknown element*",
+#else
+      /* The config should have been parsed into the participant QoS. */
+      "PARTICIPANT * QOS={*property_list={value={"
+        "{dds.sec.auth.identity_ca,testtext_IdentityCA_testtext,0},"
+        "{dds.sec.auth.private_key,testtext_PrivateKey_testtext,0},"
+        "{dds.sec.auth.identity_certificate,testtext_IdentityCertificate_testtext,0},"
+        "{dds.sec.access.permissions_ca,file:Permissions_CA.pem,0},"
+        "{dds.sec.access.governance,file:Governance.p7s,0},"
+        "{dds.sec.access.permissions,file:Permissions.p7s,0}"
+        "}binary_value={}}*}*",
+      "new_participant(*): required security property "DDS_SEC_PROP_AUTH_IDENTITY_CA" missing in Property QoS*",
+      "new_participant(*): required security property "DDS_SEC_PROP_AUTH_PRIV_KEY" missing in Property QoS*",
+      "new_participant(*): required security property "DDS_SEC_PROP_AUTH_IDENTITY_CERT" missing in Property QoS*",
+      "new_participant(*): required security property "DDS_SEC_PROP_ACCESS_PERMISSIONS_CA" missing in Property QoS*",
+      "new_participant(*): required security property "DDS_SEC_PROP_ACCESS_GOVERNANCE" missing in Property QoS*",
+      "new_participant(*): required security property "DDS_SEC_PROP_ACCESS_PERMISSIONS" missing in Property QoS*",
+#endif
+      NULL
+    };
+
+    const char *sec_config =
+      "<Tracing><Verbosity>finest</></>"
+      "<DDSSecurity>"
+        "<Authentication>"
+          "<IdentityCertificate>testtext_IdentityCertificate_testtext</IdentityCertificate>"
+          "<IdentityCA>testtext_IdentityCA_testtext</IdentityCA>"
+          "<PrivateKey>testtext_PrivateKey_testtext</PrivateKey>"
+        "</Authentication>"
+        "<AccessControl>"
+          "<Governance>file:Governance.p7s</Governance>"
+          "<PermissionsCA>file:Permissions_CA.pem</PermissionsCA>"
+          "<Permissions>file:Permissions.p7s</Permissions>"
+        "</AccessControl>"
+      "</DDSSecurity>";
+
+    dds_entity_t participant;
+    dds_qos_t * qos;
+
+    /* Set up the trace sinks to detect the config parsing. */
+    dds_set_log_mask(DDS_LC_FATAL|DDS_LC_ERROR|DDS_LC_WARNING|DDS_LC_CONFIG);
+    dds_set_log_sink(&logger, (void*)log_expected);
+    dds_set_trace_sink(&logger, (void*)log_expected);
+
+    /* Create the qos */
+    CU_ASSERT_FATAL ((qos = dds_create_qos()) != NULL);
+    dds_qset_prop (qos, "dds.sec.dummy", "testtext_dummy_testtext");
+
+    /* Create participant with security config in qos. */
+    found = 0;
+    ddsrt_setenv(URI_VARIABLE, sec_config);
+    participant = dds_create_participant(DDS_DOMAIN_DEFAULT, qos, NULL);
+    dds_delete_qos(qos);
+#ifdef DDSI_INCLUDE_SECURITY
+    CU_ASSERT_EQUAL_FATAL (participant, DDS_RETCODE_ERROR);
+#else
+    dds_delete(participant);
+#endif
+    ddsrt_setenv(URI_VARIABLE, "");
+
+    /* All traces should have been provided. */
+#ifndef DDSI_INCLUDE_SECURITY
+    CU_ASSERT_FATAL(found == 0x01);
+#else
+    CU_ASSERT_FATAL(found == 0x7e);
+#endif
+    dds_set_log_sink(NULL, NULL);
+    dds_set_trace_sink(NULL, NULL);
+}
\ No newline at end of file
diff --git a/src/core/ddsc/tests/qos.c b/src/core/ddsc/tests/qos.c
index 88fe4e6..3e6e644 100644
--- a/src/core/ddsc/tests/qos.c
+++ b/src/core/ddsc/tests/qos.c
@@ -146,7 +146,10 @@ static const char* c_userdata  = "user_key";
 static const char* c_topicdata = "topic_key";
 static const char* c_groupdata = "group_key";
 static const char* c_partitions[] = {"Partition1", "Partition2"};
-
+static const char* c_property_names[] = {"prop1", "prop2", "prop3"};
+static const char* c_property_values[] = {"val1", "val2", "val3"};
+static const char* c_bproperty_names[] = {"bprop1", "bprop2", "bprop3"};
+static const unsigned char c_bproperty_values[3][3] = {{0x0, 0x1, 0x2}, {0x2, 0x3, 0x4}, {0x5, 0x6, 0x7}};
 
 
 /****************************************************************************
@@ -646,3 +649,186 @@ CU_Test(ddsc_qos, durability_service, .init=qos_init, .fini=qos_fini)
     CU_ASSERT_EQUAL_FATAL(p.max_samples_per_instance, g_pol_durability_service.max_samples_per_instance);
 }
 
+CU_Test(ddsc_qos, property, .init=qos_init, .fini=qos_fini)
+{
+    char * value = NULL;
+    char ** names = NULL;
+    uint32_t cnt = 0;
+
+    /* NULLs shouldn't crash and be a noops. */
+    CU_ASSERT_FATAL (!dds_qget_prop (g_qos, NULL, NULL));
+    CU_ASSERT_FATAL (!dds_qget_prop (g_qos, c_property_names[0], NULL));
+    CU_ASSERT_FATAL (!dds_qget_prop (g_qos, NULL, &value));
+    CU_ASSERT_FATAL (!dds_qget_prop (NULL, c_property_names[0], &value));
+
+    dds_qset_prop (g_qos, NULL, NULL);
+    dds_qset_prop (g_qos, NULL, c_property_values[0]);
+    dds_qset_prop (NULL, c_property_names[0], c_property_values[0]);
+
+    /* Set null value should not succeed, setting empty string should */
+    dds_qset_prop (g_qos, c_property_names[0], NULL);
+    CU_ASSERT_FATAL (!dds_qget_prop (g_qos, c_property_names[0], &value));
+    dds_qset_prop (g_qos, c_property_names[0], "");
+    CU_ASSERT_FATAL (dds_qget_prop (g_qos, c_property_names[0], &value));
+    CU_ASSERT_STRING_EQUAL_FATAL (value, "");
+    dds_free (value);
+
+    /* Getting after setting, should yield the original input. */
+    dds_qset_prop (g_qos, c_property_names[0], c_property_values[0]);
+    CU_ASSERT_FATAL (dds_qget_prop (g_qos, c_property_names[0], &value));
+    CU_ASSERT_STRING_EQUAL_FATAL (value, c_property_values[0]);
+    dds_free (value);
+
+    /* Overwrite value for existing property (and reset value) */
+    dds_qset_prop (g_qos, c_property_names[0], c_property_values[1]);
+    CU_ASSERT_FATAL (dds_qget_prop (g_qos, c_property_names[0], &value));
+    CU_ASSERT_STRING_EQUAL_FATAL (value, c_property_values[1]);
+    dds_free (value);
+    dds_qset_prop (g_qos, c_property_names[0], c_property_values[0]);
+
+    /* Set 2nd prop and get length */
+    dds_qset_prop (g_qos, c_property_names[1], c_property_values[1]);
+    CU_ASSERT_FATAL (dds_qget_propnames (g_qos, &cnt, NULL));
+    CU_ASSERT_EQUAL_FATAL (cnt, 2);
+
+    /* Set another property and get list of property names */
+    dds_qset_prop (g_qos, c_property_names[2], c_property_values[2]);
+    CU_ASSERT_FATAL (dds_qget_propnames (g_qos, &cnt, &names));
+    CU_ASSERT_EQUAL_FATAL (cnt, 3);
+    for (uint32_t i = 0; i < cnt; i++)
+    {
+        CU_ASSERT_STRING_EQUAL_FATAL (names[i], c_property_names[i]);
+        dds_free (names[i]);
+    }
+    dds_free (names);
+
+    /* Unset a property and check if removed */
+    dds_qunset_prop (g_qos, c_property_names[1]);
+    CU_ASSERT_FATAL (!dds_qget_prop (g_qos, c_property_names[1], &value));
+    CU_ASSERT_FATAL (dds_qget_propnames (g_qos, &cnt, NULL));
+    CU_ASSERT_EQUAL_FATAL (cnt, 2);
+    CU_ASSERT_FATAL(dds_qget_prop (g_qos, c_property_names[0], &value));
+    CU_ASSERT_STRING_EQUAL_FATAL (value, c_property_values[0]);
+    dds_free (value);
+    CU_ASSERT_FATAL (dds_qget_prop (g_qos, c_property_names[2], &value));
+    CU_ASSERT_STRING_EQUAL_FATAL (value, c_property_values[2]);
+    dds_free (value);
+    dds_qunset_prop (g_qos, c_property_names[0]);
+    dds_qunset_prop (g_qos, c_property_names[2]);
+    CU_ASSERT_FATAL (!dds_qget_propnames (g_qos, &cnt, NULL));
+}
+
+CU_Test(ddsc_qos, bproperty, .init=qos_init, .fini=qos_fini)
+{
+    void * bvalue = NULL;
+    size_t size = 0;
+    char ** names = NULL;
+    uint32_t cnt = 0;
+
+    /* NULLs shouldn't crash and be a noops. */
+    CU_ASSERT_FATAL (!dds_qget_bprop (g_qos, NULL, NULL, NULL));
+    CU_ASSERT_FATAL (!dds_qget_bprop (g_qos, c_bproperty_names[0], NULL, NULL));
+    CU_ASSERT_FATAL (!dds_qget_bprop (g_qos, NULL, &bvalue, &size));
+    CU_ASSERT_FATAL (!dds_qget_bprop (NULL, c_bproperty_names[0], &bvalue, &size));
+
+    dds_qset_bprop (g_qos, NULL, NULL, 0);
+    dds_qset_bprop (g_qos, NULL, &c_bproperty_values[0], 0);
+    dds_qset_bprop (NULL, c_bproperty_names[0], c_bproperty_values[0], 0);
+
+    /* Set null value should succeed */
+    dds_qset_bprop (g_qos, c_bproperty_names[0], NULL, 0);
+    CU_ASSERT_FATAL (dds_qget_bprop (g_qos, c_bproperty_names[0], &bvalue, &size));
+    CU_ASSERT_EQUAL_FATAL (bvalue, NULL);
+    CU_ASSERT_EQUAL_FATAL (size, 0);
+
+    /* Getting after setting, should yield the original input. */
+    dds_qset_bprop (g_qos, c_bproperty_names[0], c_bproperty_values[0], 3);
+    CU_ASSERT_FATAL(dds_qget_bprop (g_qos, c_bproperty_names[0], &bvalue, &size));
+    CU_ASSERT_FATAL (bvalue != NULL);
+    CU_ASSERT_EQUAL_FATAL (size, 3);
+    CU_ASSERT_EQUAL_FATAL (memcmp (bvalue, c_bproperty_values[0], size), 0);
+    dds_free (bvalue);
+
+    /* Overwrite value for existing binary property (and reset value) */
+    dds_qset_bprop (g_qos, c_bproperty_names[0], c_bproperty_values[1], 3);
+    CU_ASSERT_FATAL (dds_qget_bprop (g_qos, c_bproperty_names[0], &bvalue, &size));
+    CU_ASSERT_FATAL (bvalue != NULL);
+    CU_ASSERT_EQUAL_FATAL (size, 3);
+    CU_ASSERT_EQUAL_FATAL (memcmp (bvalue, c_bproperty_values[1], size), 0);
+    dds_free (bvalue);
+    dds_qset_bprop (g_qos, c_bproperty_names[0], &c_bproperty_values[0], 3);
+
+    /* Set 2nd binary prop and get length */
+    dds_qset_bprop (g_qos, c_bproperty_names[1], &c_bproperty_values[1], 3);
+    CU_ASSERT_FATAL (dds_qget_bpropnames (g_qos, &cnt, NULL));
+    CU_ASSERT_EQUAL_FATAL (cnt, 2);
+
+    /* Set another binary property and get list of property names */
+    dds_qset_bprop (g_qos, c_bproperty_names[2], &c_bproperty_values[2], 3);
+    CU_ASSERT_FATAL (dds_qget_bpropnames (g_qos, &cnt, &names));
+    CU_ASSERT_EQUAL_FATAL (cnt, 3);
+    for (uint32_t i = 0; i < cnt; i++)
+    {
+        CU_ASSERT_STRING_EQUAL_FATAL (names[i], c_bproperty_names[i]);
+        dds_free (names[i]);
+    }
+    dds_free (names);
+
+    /* Unset a binary property and check if removed */
+    dds_qunset_bprop (g_qos, c_bproperty_names[1]);
+    CU_ASSERT_FATAL (!dds_qget_bprop (g_qos, c_bproperty_names[1], &bvalue, &size));
+    CU_ASSERT_FATAL (dds_qget_bpropnames (g_qos, &cnt, NULL));
+    CU_ASSERT_EQUAL_FATAL (cnt, 2);
+    CU_ASSERT_FATAL (dds_qget_bprop (g_qos, c_bproperty_names[0], &bvalue, &size));
+    CU_ASSERT_FATAL (bvalue != NULL);
+    CU_ASSERT_EQUAL_FATAL (size, 3);
+    CU_ASSERT_EQUAL_FATAL (memcmp (bvalue, c_bproperty_values[0], size), 0);
+    dds_free (bvalue);
+    CU_ASSERT_FATAL (dds_qget_bprop (g_qos, c_bproperty_names[2], &bvalue, &size));
+    CU_ASSERT_FATAL (bvalue != NULL);
+    CU_ASSERT_EQUAL_FATAL (size, 3);
+    CU_ASSERT_EQUAL_FATAL (memcmp (bvalue, c_bproperty_values[2], size), 0);
+    dds_free (bvalue);
+    dds_qunset_bprop (g_qos, c_bproperty_names[0]);
+    dds_qunset_bprop (g_qos, c_bproperty_names[2]);
+    CU_ASSERT_FATAL (!dds_qget_bpropnames (g_qos, &cnt, NULL));
+}
+
+CU_Test(ddsc_qos, property_mixed, .init=qos_init, .fini=qos_fini)
+{
+    char * value = NULL;
+    void * bvalue = NULL;
+    size_t size = 0;
+    uint32_t cnt = 0;
+
+    /* Set property and binary property with same name */
+    dds_qset_prop (g_qos, c_property_names[0], c_property_values[0]);
+    dds_qset_bprop (g_qos, c_property_names[0], c_bproperty_values[0], 3);
+
+    /* Check property values and count */
+    CU_ASSERT_FATAL (dds_qget_bprop (g_qos, c_property_names[0], &bvalue, &size));
+    CU_ASSERT_FATAL (bvalue != NULL);
+    CU_ASSERT_EQUAL_FATAL (size, 3);
+    CU_ASSERT_EQUAL_FATAL (memcmp (bvalue, c_bproperty_values[0], size), 0);
+    dds_free (bvalue);
+    CU_ASSERT_FATAL (dds_qget_prop (g_qos, c_property_names[0], &value));
+    CU_ASSERT_STRING_EQUAL_FATAL (value, c_property_values[0]);
+    dds_free (value);
+
+    CU_ASSERT_FATAL (dds_qget_propnames (g_qos, &cnt, NULL));
+    CU_ASSERT_EQUAL_FATAL (cnt, 1);
+    CU_ASSERT_FATAL (dds_qget_bpropnames (g_qos, &cnt, NULL));
+    CU_ASSERT_EQUAL_FATAL (cnt, 1);
+
+    /* Unset and check */
+    dds_qunset_bprop (g_qos, c_property_names[0]);
+    CU_ASSERT_FATAL (!dds_qget_bprop (g_qos, c_property_names[0], &bvalue, &size));
+    CU_ASSERT_FATAL (dds_qget_prop (g_qos, c_property_names[0], &value));
+    CU_ASSERT_STRING_EQUAL_FATAL (value, c_property_values[0]);
+    dds_free (value);
+
+    dds_qunset_prop (g_qos, c_property_names[0]);
+    CU_ASSERT_FATAL (!dds_qget_prop (g_qos, c_property_names[0], &value));
+    CU_ASSERT_FATAL (!dds_qget_propnames (g_qos, &cnt, NULL));
+    CU_ASSERT_FATAL (!dds_qget_bpropnames (g_qos, &cnt, NULL));
+}
diff --git a/src/core/ddsi/include/dds/ddsi/q_xqos.h b/src/core/ddsi/include/dds/ddsi/q_xqos.h
index 30d8260..d77a21d 100644
--- a/src/core/ddsi/include/dds/ddsi/q_xqos.h
+++ b/src/core/ddsi/include/dds/ddsi/q_xqos.h
@@ -321,9 +321,21 @@ DDS_EXPORT uint64_t nn_xqos_delta (const dds_qos_t *a, const dds_qos_t *b, uint6
 DDS_EXPORT void nn_xqos_addtomsg (struct nn_xmsg *m, const dds_qos_t *xqos, uint64_t wanted);
 DDS_EXPORT void nn_log_xqos (uint32_t cat, const struct ddsrt_log_cfg *logcfg, const dds_qos_t *xqos);
 DDS_EXPORT dds_qos_t *nn_xqos_dup (const dds_qos_t *src);
+DDS_EXPORT bool nn_xqos_has_prop (const dds_qos_t *xqos, const char *pname, bool startswith);
+
 #ifdef DDSI_INCLUDE_SECURITY
+
+#define DDS_SEC_PROP_AUTH_IDENTITY_CA "dds.sec.auth.identity_ca"
+#define DDS_SEC_PROP_AUTH_PRIV_KEY "dds.sec.auth.private_key"
+#define DDS_SEC_PROP_AUTH_IDENTITY_CERT "dds.sec.auth.identity_certificate"
+#define DDS_SEC_PROP_AUTH_PASSWORD "dds.sec.auth.password"
+#define DDS_SEC_PROP_ACCESS_PERMISSIONS_CA "dds.sec.access.permissions_ca"
+#define DDS_SEC_PROP_ACCESS_GOVERNANCE "dds.sec.access.governance"
+#define DDS_SEC_PROP_ACCESS_PERMISSIONS "dds.sec.access.permissions"
+#define DDS_SEC_PROP_ACCESS_TRUSTED_CA_DIR "dds.sec.auth.trusted_ca_dir"
+
 struct omg_security_configuration_type;
-DDS_EXPORT void nn_xqos_mergein_security_config (dds_qos_t *xqos, const struct omg_security_configuration_type *cfg);
+DDS_EXPORT bool nn_xqos_mergein_security_config (dds_qos_t *xqos, const struct omg_security_configuration_type *cfg);
 #endif
 
 #if defined (__cplusplus)
diff --git a/src/core/ddsi/src/q_entity.c b/src/core/ddsi/src/q_entity.c
index c959539..d2a4fed 100644
--- a/src/core/ddsi/src/q_entity.c
+++ b/src/core/ddsi/src/q_entity.c
@@ -465,6 +465,7 @@ dds_return_t new_participant_guid (const ddsi_guid_t *ppguid, struct q_globals *
 {
   struct participant *pp;
   ddsi_guid_t subguid, group_guid;
+  dds_return_t ret = DDS_RETCODE_OK;
 
   /* no reserved bits may be set */
   assert ((flags & ~(RTPS_PF_NO_BUILTIN_READERS | RTPS_PF_NO_BUILTIN_WRITERS | RTPS_PF_PRIVILEGED_PP | RTPS_PF_IS_DDSI2_PP | RTPS_PF_ONLY_LOCAL)) == 0);
@@ -499,7 +500,8 @@ dds_return_t new_participant_guid (const ddsi_guid_t *ppguid, struct q_globals *
     {
       ddsrt_mutex_unlock (&gv->participant_set_lock);
       GVERROR ("new_participant("PGUIDFMT", %x) failed: max participants reached\n", PGUID (*ppguid), flags);
-      return DDS_RETCODE_OUT_OF_RESOURCES;
+      ret = DDS_RETCODE_OUT_OF_RESOURCES;
+      goto new_pp_err;
     }
   }
 
@@ -524,7 +526,29 @@ dds_return_t new_participant_guid (const ddsi_guid_t *ppguid, struct q_globals *
   {
     /* For security, configuration can be provided through the configuration.
      * However, the specification (and the plugins) expect it to be in the QoS. */
-    nn_xqos_mergein_security_config(&(pp->plist->qos), &(gv->config.omg_security_configuration->cfg));
+    if (!nn_xqos_mergein_security_config(&pp->plist->qos, &gv->config.omg_security_configuration->cfg))
+    {
+      char *req[] = { DDS_SEC_PROP_AUTH_IDENTITY_CA,
+                      DDS_SEC_PROP_AUTH_PRIV_KEY,
+                      DDS_SEC_PROP_AUTH_IDENTITY_CERT,
+                      DDS_SEC_PROP_ACCESS_PERMISSIONS_CA,
+                      DDS_SEC_PROP_ACCESS_GOVERNANCE,
+                      DDS_SEC_PROP_ACCESS_PERMISSIONS };
+
+      GVLOGDISC ("new_participant("PGUIDFMT"): using security settings from QoS, ignoring security configuration\n", PGUID (*ppguid));
+
+      /* check if all required security properties exist in qos */
+      for (size_t i = 0; i < sizeof(req) / sizeof(req[0]); i++)
+      {
+        if (!nn_xqos_has_prop (&pp->plist->qos, req[i], false))
+        {
+          GVERROR ("new_participant("PGUIDFMT"): required security property %s missing in Property QoS\n", PGUID (*ppguid), req[i]);
+          ret = DDS_RETCODE_PRECONDITION_NOT_MET;
+        }
+      }
+      if (ret != DDS_RETCODE_OK)
+        goto new_pp_err_secprop;
+    }
   }
 #endif
 
@@ -723,7 +747,22 @@ dds_return_t new_participant_guid (const ddsi_guid_t *ppguid, struct q_globals *
     tsched.v = (pp->lease_duration == T_NEVER) ? T_NEVER : 0;
     pp->pmd_update_xevent = qxev_pmd_update (gv->xevents, tsched, &pp->e.guid);
   }
-  return 0;
+  return ret;
+
+#ifdef DDSI_INCLUDE_SECURITY
+new_pp_err_secprop:
+  nn_plist_fini (pp->plist);
+  ddsrt_free (pp->plist);
+  inverse_uint32_set_fini (&pp->avail_entityids.x);
+  ddsrt_mutex_destroy (&pp->refc_lock);
+  entity_common_fini (&pp->e);
+  ddsrt_free (pp);
+  ddsrt_mutex_lock (&gv->participant_set_lock);
+  gv->nparticipants--;
+  ddsrt_mutex_unlock (&gv->participant_set_lock);
+#endif
+new_pp_err:
+  return ret;
 }
 
 dds_return_t new_participant (ddsi_guid_t *p_ppguid, struct q_globals *gv, unsigned flags, const nn_plist_t *plist)
diff --git a/src/core/ddsi/src/q_plist.c b/src/core/ddsi/src/q_plist.c
index 3196b3e..d6def9e 100644
--- a/src/core/ddsi/src/q_plist.c
+++ b/src/core/ddsi/src/q_plist.c
@@ -27,6 +27,7 @@
 #include "dds/ddsi/q_plist.h"
 #include "dds/ddsi/q_time.h"
 #include "dds/ddsi/q_xmsg.h"
+#include "dds/ddsi/q_xqos.h"
 #include "dds/ddsi/ddsi_vendor.h"
 #include "dds/ddsi/ddsi_udp.h" /* nn_mc4gen_address_t */
 
@@ -2887,6 +2888,21 @@ dds_qos_t * nn_xqos_dup (const dds_qos_t *src)
   return dst;
 }
 
+bool nn_xqos_has_prop (const dds_qos_t *xqos, const char *pname, bool startswith)
+{
+  if (!(xqos->present & QP_PROPERTY_LIST))
+    return false;
+
+  for (uint32_t i = 0; i < xqos->property.value.n; i++)
+  {
+    if (startswith && (strncmp (xqos->property.value.props[i].name, pname, strlen (pname)) == 0))
+      return true;
+    else if (!startswith && (strcmp (xqos->property.value.props[i].name, pname) == 0))
+      return true;
+  }
+  return false;
+}
+
 #ifdef DDSI_INCLUDE_SECURITY
 static void fill_property(dds_property_t *prop, const char *name, const char *value)
 {
@@ -2895,44 +2911,42 @@ static void fill_property(dds_property_t *prop, const char *name, const char *va
   prop->propagate = false;
 }
 
-void nn_xqos_mergein_security_config (dds_qos_t *xqos, const struct omg_security_configuration_type *cfg)
+/**
+ * Add DDS Security configuration to the QoS as a Property policy used by the security
+ * plugins to get their proper settings. If security properties are already present in
+ * the QoS, the settings from configuration are ignored.
+ */
+bool nn_xqos_mergein_security_config (dds_qos_t *xqos, const struct omg_security_configuration_type *cfg)
 {
-  if (cfg)
+  assert(cfg != NULL);
+
+  if (!(xqos->present & QP_PROPERTY_LIST))
   {
-    /* Add DDS Security configuration to the QoS as a Property policy,
-     * used by the security plugins to get their proper settings. */
-    dds_property_t *properties;
-    uint32_t idx = 0;
-
-    /* No property should be present yet. */
-    assert(!(xqos->present & QP_PROPERTY_LIST));
-
-    /* Prepare properties. */
-    properties = ddsrt_malloc(8 /* max */ * sizeof (dds_property_t));
-
-    /* Fill properties. */
-    fill_property(&(properties[idx++]), "dds.sec.auth.identity_ca", cfg->authentication_properties.identity_ca);
-    fill_property(&(properties[idx++]), "dds.sec.auth.private_key", cfg->authentication_properties.private_key);
-    fill_property(&(properties[idx++]), "dds.sec.auth.identity_certificate", cfg->authentication_properties.identity_certificate);
-    fill_property(&(properties[idx++]), "dds.sec.access.permissions_ca", cfg->access_control_properties.permissions_ca);
-    fill_property(&(properties[idx++]), "dds.sec.access.governance", cfg->access_control_properties.governance);
-    fill_property(&(properties[idx++]), "dds.sec.access.permissions", cfg->access_control_properties.permissions);
-    if (cfg->authentication_properties.password && (strlen(cfg->authentication_properties.password) != 0))
-    {
-      fill_property(&(properties[idx++]), "dds.sec.auth.password", cfg->authentication_properties.password);
-    }
-    if (cfg->authentication_properties.trusted_ca_dir && (strlen(cfg->authentication_properties.trusted_ca_dir) != 0))
-    {
-      fill_property(&(properties[idx++]), "dds.sec.auth.trusted_ca_dir", cfg->authentication_properties.trusted_ca_dir);
-    }
-
-    /* Add properties. */
-    xqos->present |= QP_PROPERTY_LIST;
-    xqos->property.value.n = idx;
-    xqos->property.value.props = properties;
+    xqos->property.value.n = 0;
+    xqos->property.value.props = NULL;
     xqos->property.binary_value.n = 0;
     xqos->property.binary_value.props = NULL;
+    xqos->present |= QP_PROPERTY_LIST;
   }
+
+  /* check for existing security properties (name starts with dds.sec. conform DDS Security spec 7.2.4.1)
+   * and return if any is found */
+  if (nn_xqos_has_prop (xqos, "dds.sec.", true))
+    return false;
+
+  /* no security properties exist in qos: fill QoS properties with values from configuration */
+  xqos->property.value.props = ddsrt_realloc (xqos->property.value.props, xqos->property.value.n + 8 /* max */ * sizeof (dds_property_t));
+  fill_property(&(xqos->property.value.props[xqos->property.value.n++]), DDS_SEC_PROP_AUTH_IDENTITY_CA, cfg->authentication_properties.identity_ca);
+  fill_property(&(xqos->property.value.props[xqos->property.value.n++]), DDS_SEC_PROP_AUTH_PRIV_KEY, cfg->authentication_properties.private_key);
+  fill_property(&(xqos->property.value.props[xqos->property.value.n++]), DDS_SEC_PROP_AUTH_IDENTITY_CERT, cfg->authentication_properties.identity_certificate);
+  fill_property(&(xqos->property.value.props[xqos->property.value.n++]), DDS_SEC_PROP_ACCESS_PERMISSIONS_CA, cfg->access_control_properties.permissions_ca);
+  fill_property(&(xqos->property.value.props[xqos->property.value.n++]), DDS_SEC_PROP_ACCESS_GOVERNANCE, cfg->access_control_properties.governance);
+  fill_property(&(xqos->property.value.props[xqos->property.value.n++]), DDS_SEC_PROP_ACCESS_PERMISSIONS, cfg->access_control_properties.permissions);
+  if (cfg->authentication_properties.password && (strlen(cfg->authentication_properties.password) != 0))
+    fill_property(&(xqos->property.value.props[xqos->property.value.n++]), DDS_SEC_PROP_AUTH_PASSWORD, cfg->authentication_properties.password);
+  if (cfg->authentication_properties.trusted_ca_dir && (strlen(cfg->authentication_properties.trusted_ca_dir) != 0))
+    fill_property(&(xqos->property.value.props[xqos->property.value.n++]), DDS_SEC_PROP_ACCESS_TRUSTED_CA_DIR, cfg->authentication_properties.trusted_ca_dir);
+  return true;
 }
 #endif /* DDSI_INCLUDE_SECURITY */
 
diff --git a/src/tools/pubsub/common.h b/src/tools/pubsub/common.h
index 036e7b7..8854ec5 100644
--- a/src/tools/pubsub/common.h
+++ b/src/tools/pubsub/common.h
@@ -42,12 +42,13 @@
 #define DDS_READERLIFESPAN_QOS_POLICY_NAME                      "ReaderLifespan"
 #define DDS_SHARE_QOS_POLICY_NAME                               "Share"
 #define DDS_SCHEDULING_QOS_POLICY_NAME                          "Scheduling"
+#define DDS_PROPERTY_QOS_POLICY_NAME                            "Property"
 
-#define DDS_SUBSCRIPTIONKEY_QOS_POLICY_ID                       23
-#define DDS_VIEWKEY_QOS_POLICY_ID                               24
-#define DDS_READERLIFESPAN_QOS_POLICY_ID                        25
-#define DDS_SHARE_QOS_POLICY_ID                                 26
-#define DDS_SCHEDULING_QOS_POLICY_ID                            27
+#define DDS_SUBSCRIPTIONKEY_QOS_POLICY_ID                       24
+#define DDS_VIEWKEY_QOS_POLICY_ID                               25
+#define DDS_READERLIFESPAN_QOS_POLICY_ID                        26
+#define DDS_SHARE_QOS_POLICY_ID                                 27
+#define DDS_SCHEDULING_QOS_POLICY_ID                            28
 
 extern dds_entity_t dp;
 extern const dds_topic_descriptor_t *ts_KeyedSeq;
diff --git a/src/tools/pubsub/pubsub.c b/src/tools/pubsub/pubsub.c
index b810d24..caf1c63 100644
--- a/src/tools/pubsub/pubsub.c
+++ b/src/tools/pubsub/pubsub.c
@@ -1051,6 +1051,7 @@ static const char *policystr(uint32_t id) {
     case DDS_READERLIFESPAN_QOS_POLICY_ID: return DDS_READERLIFESPAN_QOS_POLICY_NAME;
     case DDS_SHARE_QOS_POLICY_ID: return DDS_SHARE_QOS_POLICY_NAME;
     case DDS_SCHEDULING_QOS_POLICY_ID: return DDS_SCHEDULING_QOS_POLICY_NAME;
+    case DDS_PROPERTY_QOS_POLICY_ID: return DDS_PROPERTY_QOS_POLICY_NAME;
     default: return "?";
     }
 }

From d0035cfdbd67f048515e027ea3ff4ac43d6eda18 Mon Sep 17 00:00:00 2001
From: Martin Bremmer <martin.bremmer@adlinktech.com>
Date: Wed, 23 Oct 2019 17:52:18 +0200
Subject: [PATCH 073/238] Protected discovery preparation.

Signed-off-by: Martin Bremmer <martin.bremmer@adlinktech.com>
---
 src/core/ddsi/CMakeLists.txt                  |   2 +
 .../ddsi/include/dds/ddsi/ddsi_security_omg.h | 152 +++++++
 src/core/ddsi/include/dds/ddsi/q_globals.h    |   4 +
 src/core/ddsi/include/dds/ddsi/q_plist.h      |   3 +
 src/core/ddsi/include/dds/ddsi/q_protocol.h   |  13 +
 src/core/ddsi/include/dds/ddsi/q_rtps.h       |  13 +
 src/core/ddsi/src/ddsi_security_omg.c         | 148 +++++++
 src/core/ddsi/src/q_ddsi_discovery.c          | 114 ++++-
 src/core/ddsi/src/q_entity.c                  | 410 +++++++++++++-----
 src/core/ddsi/src/q_init.c                    |  14 +
 src/core/ddsi/src/q_receive.c                 |   9 +-
 src/core/ddsi/src/q_transmit.c                |   4 +-
 12 files changed, 764 insertions(+), 122 deletions(-)
 create mode 100644 src/core/ddsi/include/dds/ddsi/ddsi_security_omg.h
 create mode 100644 src/core/ddsi/src/ddsi_security_omg.c

diff --git a/src/core/ddsi/CMakeLists.txt b/src/core/ddsi/CMakeLists.txt
index ccb6a25..fb8785f 100644
--- a/src/core/ddsi/CMakeLists.txt
+++ b/src/core/ddsi/CMakeLists.txt
@@ -18,6 +18,7 @@ PREPEND(srcs_ddsi "${CMAKE_CURRENT_LIST_DIR}/src"
     ddsi_raweth.c
     ddsi_ipaddr.c
     ddsi_mcgroup.c
+    ddsi_security_omg.c
     ddsi_serdata.c
     ddsi_serdata_default.c
     ddsi_sertopic.c
@@ -70,6 +71,7 @@ PREPEND(hdrs_private_ddsi "${CMAKE_CURRENT_LIST_DIR}/include/dds/ddsi"
     ddsi_ipaddr.h
     ddsi_mcgroup.h
     ddsi_plist_generic.h
+    ddsi_security_omg.h
     ddsi_serdata.h
     ddsi_sertopic.h
     ddsi_serdata_default.h
diff --git a/src/core/ddsi/include/dds/ddsi/ddsi_security_omg.h b/src/core/ddsi/include/dds/ddsi/ddsi_security_omg.h
new file mode 100644
index 0000000..298370f
--- /dev/null
+++ b/src/core/ddsi/include/dds/ddsi/ddsi_security_omg.h
@@ -0,0 +1,152 @@
+/*
+ * Copyright(c) 2006 to 2018 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+#ifndef DDSI_OMG_SECURITY_H
+#define DDSI_OMG_SECURITY_H
+
+#include "dds/ddsi/q_entity.h"
+#include "dds/ddsi/q_plist.h"
+#include "dds/ddsi/q_globals.h"
+
+#if defined (__cplusplus)
+extern "C" {
+#endif
+
+#ifdef DDSI_INCLUDE_SECURITY
+
+/**
+ * @brief Check if security is enabled for the participant.
+ *
+ * @param[in] pp  Participant to check if it is secure.
+ *
+ * @returns bool
+ * @retval true   Participant is secure
+ * @retval false  Participant is not secure
+ */
+bool q_omg_participant_is_secure(const struct participant *pp);
+
+/**
+ * @brief Get security info flags of the given writer.
+ *
+ * @param[in]  wr    Writer to get the security info from.
+ * @param[out] info  The security info.
+ *
+ * @returns bool
+ * @retval true   Security info set.
+ * @retval false  Security info not set (probably unsecure writer).
+ */
+bool q_omg_get_writer_security_info(const struct writer *wr, nn_security_info_t *info);
+
+/**
+ * @brief Get security info flags of the given reader.
+ *
+ * @param[in]  rd    Reader to get the security info from.
+ * @param[out] info  The security info.
+ *
+ * @returns bool
+ * @retval true   Security info set.
+ * @retval false  Security info not set (probably unsecure reader).
+ */
+bool q_omg_get_reader_security_info(const struct reader *rd, nn_security_info_t *info);
+
+/**
+ * @brief Return the builtin writer id for this readers' discovery.
+ *
+ * Return builtin entity id of the writer to use for the subscription
+ * discovery information.
+ * Depending on whether the discovery is protected or not (for the
+ * given reader), either the default writer or protected writer needs
+ * to be used.
+ *
+ * @param[in] rd Reader to determine the subscription writer from.
+ *
+ * @returns unsigned
+ * @retval NN_ENTITYID_SEDP_BUILTIN_SUBSCRIPTIONS_SECURE_WRITER
+ * @retval NN_ENTITYID_SEDP_BUILTIN_SUBSCRIPTIONS_WRITER
+ */
+unsigned determine_subscription_writer(const struct reader *rd);
+
+/**
+ * @brief Return the builtin writer id for this writers' discovery.
+ *
+ * Return builtin entity id of the writer to use for the publication
+ * discovery information.
+ * Depending on whether the discovery is protected or not (for the
+ * given writer), either the default writer or protected writer needs
+ * to be used.
+ *
+ * @param[in] wr Writer to determine the publication writer from.
+ *
+ * @returns unsigned
+ * @retval NN_ENTITYID_SEDP_BUILTIN_PUBLICATIONS_SECURE_WRITER
+ * @retval NN_ENTITYID_SEDP_BUILTIN_PUBLICATIONS_WRITER
+ */
+unsigned determine_publication_writer(const struct writer *wr);
+
+/**
+ * @brief Determine if the proxy participant is allowed to be deleted
+ *        by the given writer.
+ *
+ * If an proxy participant is authenticated, it is only allowed to
+ * to deleted when a dispose is received from the proper protected
+ * discovery writer.
+ *
+ * @param[in] gv           Used for tracing.
+ * @param[in] guid         Guid of the proxy participant to be deleted.
+ * @param[in] pwr_entityid Writer that send the dispose.
+ *
+ * @returns bool
+ * @retval true   The proxy participant may be deleted.
+ * @retval false  The proxy participant may not be deleted by this writer.
+ */
+bool allow_proxy_participant_deletion(struct q_globals * const gv, const struct ddsi_guid *guid, const ddsi_entityid_t pwr_entityid);
+
+#else /* DDSI_INCLUDE_SECURITY */
+
+#include "dds/ddsi/q_unused.h"
+
+inline bool
+q_omg_participant_is_secure(
+  UNUSED_ARG(const struct participant *pp))
+{
+  return false;
+}
+
+inline unsigned
+determine_subscription_writer(
+  UNUSED_ARG(const struct reader *rd))
+{
+  return NN_ENTITYID_SEDP_BUILTIN_SUBSCRIPTIONS_WRITER;
+}
+
+inline unsigned
+determine_publication_writer(
+  UNUSED_ARG(const struct writer *wr))
+{
+  return NN_ENTITYID_SEDP_BUILTIN_PUBLICATIONS_WRITER;
+}
+
+inline bool
+allow_proxy_participant_deletion(
+  UNUSED_ARG(struct q_globals * const gv),
+  UNUSED_ARG(const struct ddsi_guid *guid),
+  UNUSED_ARG(const ddsi_entityid_t pwr_entityid))
+{
+  return true;
+}
+
+#endif /* DDSI_INCLUDE_SECURITY */
+
+#if defined (__cplusplus)
+}
+#endif
+
+#endif /* DDSI_OMG_SECURITY_H */
diff --git a/src/core/ddsi/include/dds/ddsi/q_globals.h b/src/core/ddsi/include/dds/ddsi/q_globals.h
index c14b490..c5cff1a 100644
--- a/src/core/ddsi/include/dds/ddsi/q_globals.h
+++ b/src/core/ddsi/include/dds/ddsi/q_globals.h
@@ -237,6 +237,10 @@ struct q_globals {
   dds_qos_t spdp_endpoint_xqos;
   dds_qos_t builtin_endpoint_xqos_rd;
   dds_qos_t builtin_endpoint_xqos_wr;
+#ifdef DDSI_INCLUDE_SECURITY
+  dds_qos_t builtin_stateless_xqos_rd;
+  dds_qos_t builtin_stateless_xqos_wr;
+#endif
 
   /* SPDP packets get very special treatment (they're the only packets
      we accept from writers we don't know) and have their very own
diff --git a/src/core/ddsi/include/dds/ddsi/q_plist.h b/src/core/ddsi/include/dds/ddsi/q_plist.h
index 5f82529..561bdbf 100644
--- a/src/core/ddsi/include/dds/ddsi/q_plist.h
+++ b/src/core/ddsi/include/dds/ddsi/q_plist.h
@@ -172,6 +172,9 @@ typedef struct nn_security_info
 #define NN_PLUGIN_PARTICIPANT_SECURITY_ATTRIBUTES_FLAG_IS_RTPS_AUTHENTICATED           (1u <<  3)
 #define NN_PLUGIN_PARTICIPANT_SECURITY_ATTRIBUTES_FLAG_IS_DISCOVERY_AUTHENTICATED      (1u <<  4)
 #define NN_PLUGIN_PARTICIPANT_SECURITY_ATTRIBUTES_FLAG_IS_LIVELINESS_AUTHENTICATED     (1u <<  5)
+#else
+struct nn_security_info;
+typedef struct nn_security_info nn_security_info_t;
 #endif
 
 
diff --git a/src/core/ddsi/include/dds/ddsi/q_protocol.h b/src/core/ddsi/include/dds/ddsi/q_protocol.h
index 9ebf7c5..0fbbc64 100644
--- a/src/core/ddsi/include/dds/ddsi/q_protocol.h
+++ b/src/core/ddsi/include/dds/ddsi/q_protocol.h
@@ -89,6 +89,19 @@ typedef struct {
 #define NN_DISC_BUILTIN_ENDPOINT_TOPIC_ANNOUNCER (1u << 12)
 #define NN_DISC_BUILTIN_ENDPOINT_TOPIC_DETECTOR (1u << 13)
 
+/* Security extensions: */
+#define NN_BUILTIN_ENDPOINT_PUBLICATION_MESSAGE_SECURE_ANNOUNCER (1u<<16)
+#define NN_BUILTIN_ENDPOINT_PUBLICATION_MESSAGE_SECURE_DETECTOR (1u<<17)
+#define NN_BUILTIN_ENDPOINT_SUBSCRIPTION_MESSAGE_SECURE_ANNOUNCER (1u<<18)
+#define NN_BUILTIN_ENDPOINT_SUBSCRIPTION_MESSAGE_SECURE_DETECTOR (1u<<19)
+#define NN_BUILTIN_ENDPOINT_PARTICIPANT_MESSAGE_SECURE_ANNOUNCER (1u<<20)
+#define NN_BUILTIN_ENDPOINT_PARTICIPANT_MESSAGE_SECURE_DETECTOR (1u<<21)
+#define NN_BUILTIN_ENDPOINT_PARTICIPANT_STATELESS_MESSAGE_ANNOUNCER (1u<<22)
+#define NN_BUILTIN_ENDPOINT_PARTICIPANT_STATELESS_MESSAGE_DETECTOR (1u<<23)
+/* TODO: ENDPOINT_PARTICIPANT_VOLATILE */
+#define NN_DISC_BUILTIN_ENDPOINT_PARTICIPANT_SECURE_ANNOUNCER (1u << 26)
+#define NN_DISC_BUILTIN_ENDPOINT_PARTICIPANT_SECURE_DETECTOR (1u << 27)
+
 /* PrismTech extensions: */
 #define NN_DISC_BUILTIN_ENDPOINT_CM_PARTICIPANT_WRITER (1u << 0)
 #define NN_DISC_BUILTIN_ENDPOINT_CM_PARTICIPANT_READER (1u << 1)
diff --git a/src/core/ddsi/include/dds/ddsi/q_rtps.h b/src/core/ddsi/include/dds/ddsi/q_rtps.h
index dfe0d39..71382f4 100644
--- a/src/core/ddsi/include/dds/ddsi/q_rtps.h
+++ b/src/core/ddsi/include/dds/ddsi/q_rtps.h
@@ -44,6 +44,19 @@ typedef int64_t seqno_t;
 #define NN_ENTITYID_SPDP_BUILTIN_PARTICIPANT_READER 0x100c7
 #define NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_MESSAGE_WRITER 0x200c2
 #define NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_MESSAGE_READER 0x200c7
+
+#define NN_ENTITYID_SEDP_BUILTIN_PUBLICATIONS_SECURE_WRITER 0xff0003c2
+#define NN_ENTITYID_SEDP_BUILTIN_PUBLICATIONS_SECURE_READER 0xff0003c7
+#define NN_ENTITYID_SEDP_BUILTIN_SUBSCRIPTIONS_SECURE_WRITER 0xff0004c2
+#define NN_ENTITYID_SEDP_BUILTIN_SUBSCRIPTIONS_SECURE_READER 0xff0004c7
+#define NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_STATELESS_MESSAGE_WRITER 0x201c3
+#define NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_STATELESS_MESSAGE_READER 0x201c4
+#define NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_MESSAGE_SECURE_WRITER 0xff0200c2
+#define NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_MESSAGE_SECURE_READER 0xff0200c7
+/* TODO: ENDPOINT_PARTICIPANT_VOLATILE */
+#define NN_ENTITYID_SPDP_RELIABLE_BUILTIN_PARTICIPANT_SECURE_WRITER 0xff0101c2
+#define NN_ENTITYID_SPDP_RELIABLE_BUILTIN_PARTICIPANT_SECURE_READER 0xff0101c7
+
 #define NN_ENTITYID_SEDP_BUILTIN_CM_PARTICIPANT_WRITER 0x142
 #define NN_ENTITYID_SEDP_BUILTIN_CM_PARTICIPANT_READER 0x147
 #define NN_ENTITYID_SEDP_BUILTIN_CM_PUBLISHER_WRITER 0x242
diff --git a/src/core/ddsi/src/ddsi_security_omg.c b/src/core/ddsi/src/ddsi_security_omg.c
new file mode 100644
index 0000000..8e04eb3
--- /dev/null
+++ b/src/core/ddsi/src/ddsi_security_omg.c
@@ -0,0 +1,148 @@
+/*
+ * Copyright(c) 2006 to 2018 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+#ifdef DDSI_INCLUDE_SECURITY
+
+#include <string.h>
+
+#include "dds/ddsrt/misc.h"
+
+#include "dds/ddsi/q_unused.h"
+#include "dds/ddsi/ddsi_security_omg.h"
+
+bool
+q_omg_participant_is_secure(
+  const struct participant *pp)
+{
+  /* TODO: Register local participant. */
+  DDSRT_UNUSED_ARG(pp);
+  return false;
+}
+
+static bool
+q_omg_writer_is_discovery_protected(
+  const struct writer *wr)
+{
+  /* TODO: Register local writer. */
+  DDSRT_UNUSED_ARG(wr);
+  return false;
+}
+
+static bool
+q_omg_reader_is_discovery_protected(
+  const struct reader *rd)
+{
+  /* TODO: Register local reader. */
+  DDSRT_UNUSED_ARG(rd);
+  return false;
+}
+
+bool
+q_omg_get_writer_security_info(
+  const struct writer *wr,
+  nn_security_info_t *info)
+{
+  assert(wr);
+  assert(info);
+  /* TODO: Register local writer. */
+  DDSRT_UNUSED_ARG(wr);
+  info->plugin_security_attributes = 0;
+  info->security_attributes = 0;
+  return false;
+}
+
+bool
+q_omg_get_reader_security_info(
+  const struct reader *rd,
+  nn_security_info_t *info)
+{
+  assert(rd);
+  assert(info);
+  /* TODO: Register local reader. */
+  DDSRT_UNUSED_ARG(rd);
+  info->plugin_security_attributes = 0;
+  info->security_attributes = 0;
+  return false;
+}
+
+static bool
+q_omg_proxyparticipant_is_authenticated(
+  struct proxy_participant *proxypp)
+{
+  /* TODO: Handshake */
+  DDSRT_UNUSED_ARG(proxypp);
+  return false;
+}
+
+unsigned
+determine_subscription_writer(
+  const struct reader *rd)
+{
+  if (q_omg_reader_is_discovery_protected(rd))
+  {
+    return NN_ENTITYID_SEDP_BUILTIN_SUBSCRIPTIONS_SECURE_WRITER;
+  }
+  return NN_ENTITYID_SEDP_BUILTIN_SUBSCRIPTIONS_WRITER;
+}
+
+unsigned
+determine_publication_writer(
+  const struct writer *wr)
+{
+  if (q_omg_writer_is_discovery_protected(wr))
+  {
+    return NN_ENTITYID_SEDP_BUILTIN_PUBLICATIONS_SECURE_WRITER;
+  }
+  return NN_ENTITYID_SEDP_BUILTIN_PUBLICATIONS_WRITER;
+}
+
+bool
+allow_proxy_participant_deletion(
+  struct q_globals * const gv,
+  const struct ddsi_guid *guid,
+  const ddsi_entityid_t pwr_entityid)
+{
+  struct proxy_participant *proxypp;
+
+  assert(gv);
+  assert(guid);
+
+  /* Always allow deletion from a secure proxy writer. */
+  if (pwr_entityid.u == NN_ENTITYID_SPDP_RELIABLE_BUILTIN_PARTICIPANT_SECURE_WRITER)
+    return true;
+
+  /* Not from a secure proxy writer.
+   * Only allow deletion when proxy participant is not authenticated. */
+  proxypp = ephash_lookup_proxy_participant_guid(gv->guid_hash, guid);
+  if (!proxypp)
+  {
+    GVLOGDISC (" unknown");
+    return false;
+  }
+  return (!q_omg_proxyparticipant_is_authenticated(proxypp));
+}
+
+
+#else /* DDSI_INCLUDE_SECURITY */
+
+#include "dds/ddsi/ddsi_security_omg.h"
+
+extern inline bool q_omg_participant_is_secure(UNUSED_ARG(const struct participant *pp));
+
+extern inline unsigned determine_subscription_writer(UNUSED_ARG(const struct reader *rd));
+extern inline unsigned determine_publication_writer(UNUSED_ARG(const struct writer *wr));
+
+extern inline bool allow_proxy_participant_deletion(
+  UNUSED_ARG(struct q_globals * const gv),
+  UNUSED_ARG(const struct ddsi_guid *guid),
+  UNUSED_ARG(const ddsi_entityid_t pwr_entityid));
+
+#endif /* DDSI_INCLUDE_SECURITY */
diff --git a/src/core/ddsi/src/q_ddsi_discovery.c b/src/core/ddsi/src/q_ddsi_discovery.c
index 74d025a..d6f2137 100644
--- a/src/core/ddsi/src/q_ddsi_discovery.c
+++ b/src/core/ddsi/src/q_ddsi_discovery.c
@@ -43,6 +43,7 @@
 #include "dds/ddsi/q_lease.h"
 #include "dds/ddsi/ddsi_serdata_default.h"
 #include "dds/ddsi/q_feature_check.h"
+#include "dds/ddsi/ddsi_security_omg.h"
 
 static int get_locator (const struct q_globals *gv, nn_locator_t *loc, const nn_locators_t *locs, int uc_same_subnet)
 {
@@ -327,16 +328,18 @@ int spdp_write (struct participant *pp)
   return ret;
 }
 
-int spdp_dispose_unregister (struct participant *pp)
+static int spdp_dispose_unregister_with_wr (struct participant *pp, unsigned entityid)
 {
   struct nn_xmsg *mpayload;
   nn_plist_t ps;
   struct writer *wr;
   int ret;
 
-  if ((wr = get_builtin_writer (pp, NN_ENTITYID_SPDP_BUILTIN_PARTICIPANT_WRITER)) == NULL)
+  if ((wr = get_builtin_writer (pp, entityid)) == NULL)
   {
-    ETRACE (pp, "spdp_dispose_unregister("PGUIDFMT") - builtin participant writer not found\n", PGUID (pp->e.guid));
+    ETRACE (pp, "spdp_dispose_unregister("PGUIDFMT") - builtin participant %s writer not found\n",
+            PGUID (pp->e.guid),
+            entityid == NN_ENTITYID_SPDP_RELIABLE_BUILTIN_PARTICIPANT_SECURE_WRITER ? "secure" : "");
     return 0;
   }
 
@@ -353,6 +356,21 @@ int spdp_dispose_unregister (struct participant *pp)
   return ret;
 }
 
+int spdp_dispose_unregister (struct participant *pp)
+{
+  /*
+   * When disposing a participant, it should be announced on both the
+   * non-secure and secure writers.
+   * The receiver will decide from which writer it accepts the dispose.
+   */
+  int ret = spdp_dispose_unregister_with_wr(pp, NN_ENTITYID_SPDP_BUILTIN_PARTICIPANT_WRITER);
+  if ((ret > 0) && q_omg_participant_is_secure(pp))
+  {
+    ret = spdp_dispose_unregister_with_wr(pp, NN_ENTITYID_SPDP_RELIABLE_BUILTIN_PARTICIPANT_SECURE_WRITER);
+  }
+  return ret;
+}
+
 static unsigned pseudo_random_delay (const ddsi_guid_t *x, const ddsi_guid_t *y, nn_mtime_t tnow)
 {
   /* You know, an ordinary random generator would be even better, but
@@ -407,7 +425,7 @@ static void respond_to_spdp (const struct q_globals *gv, const ddsi_guid_t *dest
   ephash_enum_participant_fini (&est);
 }
 
-static int handle_SPDP_dead (const struct receiver_state *rst, nn_wctime_t timestamp, const nn_plist_t *datap, unsigned statusinfo)
+static int handle_SPDP_dead (const struct receiver_state *rst, ddsi_entityid_t pwr_entityid, nn_wctime_t timestamp, const nn_plist_t *datap, unsigned statusinfo)
 {
   struct q_globals * const gv = rst->gv;
   ddsi_guid_t guid;
@@ -419,13 +437,20 @@ static int handle_SPDP_dead (const struct receiver_state *rst, nn_wctime_t times
     guid = datap->participant_guid;
     GVLOGDISC (" %"PRIx32":%"PRIx32":%"PRIx32":%"PRIx32, PGUID (guid));
     assert (guid.entityid.u == NN_ENTITYID_PARTICIPANT);
-    if (delete_proxy_participant_by_guid (gv, &guid, timestamp, 0) < 0)
+    if (allow_proxy_participant_deletion(gv, &guid, pwr_entityid))
     {
-      GVLOGDISC (" unknown");
+      if (delete_proxy_participant_by_guid (gv, &guid, timestamp, 0) < 0)
+      {
+        GVLOGDISC (" unknown");
+      }
+      else
+      {
+        GVLOGDISC (" delete");
+      }
     }
     else
     {
-      GVLOGDISC (" delete");
+      GVLOGDISC (" not allowed");
     }
   }
   else
@@ -793,7 +818,7 @@ static int handle_SPDP_alive (const struct receiver_state *rst, seqno_t seq, nn_
   return 1;
 }
 
-static void handle_SPDP (const struct receiver_state *rst, seqno_t seq, nn_wctime_t timestamp, unsigned statusinfo, const void *vdata, uint32_t len)
+static void handle_SPDP (const struct receiver_state *rst, ddsi_entityid_t pwr_entityid, seqno_t seq, nn_wctime_t timestamp, unsigned statusinfo, const void *vdata, uint32_t len)
 {
   struct q_globals * const gv = rst->gv;
   const struct CDRHeader *data = vdata; /* built-ins not deserialized (yet) */
@@ -832,7 +857,7 @@ static void handle_SPDP (const struct receiver_state *rst, seqno_t seq, nn_wctim
       case NN_STATUSINFO_DISPOSE:
       case NN_STATUSINFO_UNREGISTER:
       case (NN_STATUSINFO_DISPOSE | NN_STATUSINFO_UNREGISTER):
-        interesting = handle_SPDP_dead (rst, timestamp, &decoded_data, statusinfo);
+        interesting = handle_SPDP_dead (rst, pwr_entityid, timestamp, &decoded_data, statusinfo);
         break;
     }
 
@@ -888,7 +913,7 @@ static int sedp_write_endpoint
 (
    struct writer *wr, int alive, const ddsi_guid_t *epguid,
    const struct entity_common *common, const struct endpoint_common *epcommon,
-   const dds_qos_t *xqos, struct addrset *as)
+   const dds_qos_t *xqos, struct addrset *as, nn_security_info_t *security)
 {
   struct q_globals * const gv = wr->e.gv;
   const dds_qos_t *defqos = is_writer_entityid (epguid->entityid) ? &gv->default_xqos_wr : &gv->default_xqos_rd;
@@ -908,6 +933,17 @@ static int sedp_write_endpoint
     ps.entity_name = common->name;
   }
 
+#ifdef DDSI_INCLUDE_SECURITY
+  if (security)
+  {
+    ps.present |= PP_ENDPOINT_SECURITY_INFO;
+    memcpy(&ps.endpoint_security_info, security, sizeof(nn_security_info_t));
+  }
+#else
+  (void)security;
+  assert(security == NULL);
+#endif
+
   if (!alive)
   {
     assert (xqos == NULL);
@@ -987,13 +1023,22 @@ int sedp_write_writer (struct writer *wr)
 {
   if ((!is_builtin_entityid(wr->e.guid.entityid, NN_VENDORID_ECLIPSE)) && (!wr->e.onlylocal))
   {
-    struct writer *sedp_wr = get_sedp_writer (wr->c.pp, NN_ENTITYID_SEDP_BUILTIN_PUBLICATIONS_WRITER);
+    unsigned entityid = determine_publication_writer(wr);
+    struct writer *sedp_wr = get_sedp_writer (wr->c.pp, entityid);
+    nn_security_info_t *security = NULL;
 #ifdef DDSI_INCLUDE_SSM
     struct addrset *as = wr->ssm_as;
 #else
     struct addrset *as = NULL;
 #endif
-    return sedp_write_endpoint (sedp_wr, 1, &wr->e.guid, &wr->e, &wr->c, wr->xqos, as);
+#ifdef DDSI_INCLUDE_SECURITY
+    nn_security_info_t tmp;
+    if (q_omg_get_writer_security_info(wr, &tmp))
+    {
+      security = &tmp;
+    }
+#endif
+    return sedp_write_endpoint (sedp_wr, 1, &wr->e.guid, &wr->e, &wr->c, wr->xqos, as, security);
   }
   return 0;
 }
@@ -1002,13 +1047,22 @@ int sedp_write_reader (struct reader *rd)
 {
   if ((!is_builtin_entityid (rd->e.guid.entityid, NN_VENDORID_ECLIPSE)) && (!rd->e.onlylocal))
   {
-    struct writer *sedp_wr = get_sedp_writer (rd->c.pp, NN_ENTITYID_SEDP_BUILTIN_SUBSCRIPTIONS_WRITER);
+    unsigned entityid = determine_subscription_writer(rd);
+    struct writer *sedp_wr = get_sedp_writer (rd->c.pp, entityid);
+    nn_security_info_t *security = NULL;
 #ifdef DDSI_INCLUDE_NETWORK_PARTITIONS
     struct addrset *as = rd->as;
 #else
     struct addrset *as = NULL;
 #endif
-    return sedp_write_endpoint (sedp_wr, 1, &rd->e.guid, &rd->e, &rd->c, rd->xqos, as);
+#ifdef DDSI_INCLUDE_SECURITY
+    nn_security_info_t tmp;
+    if (q_omg_get_reader_security_info(rd, &tmp))
+    {
+      security = &tmp;
+    }
+#endif
+    return sedp_write_endpoint (sedp_wr, 1, &rd->e.guid, &rd->e, &rd->c, rd->xqos, as, security);
   }
   return 0;
 }
@@ -1017,8 +1071,9 @@ int sedp_dispose_unregister_writer (struct writer *wr)
 {
   if ((!is_builtin_entityid(wr->e.guid.entityid, NN_VENDORID_ECLIPSE)) && (!wr->e.onlylocal))
   {
-    struct writer *sedp_wr = get_sedp_writer (wr->c.pp, NN_ENTITYID_SEDP_BUILTIN_PUBLICATIONS_WRITER);
-    return sedp_write_endpoint (sedp_wr, 0, &wr->e.guid, NULL, NULL, NULL, NULL);
+    unsigned entityid = determine_publication_writer(wr);
+    struct writer *sedp_wr = get_sedp_writer (wr->c.pp, entityid);
+    return sedp_write_endpoint (sedp_wr, 0, &wr->e.guid, NULL, NULL, NULL, NULL, NULL);
   }
   return 0;
 }
@@ -1027,8 +1082,9 @@ int sedp_dispose_unregister_reader (struct reader *rd)
 {
   if ((!is_builtin_entityid(rd->e.guid.entityid, NN_VENDORID_ECLIPSE)) && (!rd->e.onlylocal))
   {
-    struct writer *sedp_wr = get_sedp_writer (rd->c.pp, NN_ENTITYID_SEDP_BUILTIN_SUBSCRIPTIONS_WRITER);
-    return sedp_write_endpoint (sedp_wr, 0, &rd->e.guid, NULL, NULL, NULL, NULL);
+    unsigned entityid = determine_subscription_writer(rd);
+    struct writer *sedp_wr = get_sedp_writer (rd->c.pp, entityid);
+    return sedp_write_endpoint (sedp_wr, 0, &rd->e.guid, NULL, NULL, NULL, NULL, NULL);
   }
   return 0;
 }
@@ -1594,7 +1650,13 @@ int builtins_dqueue_handler (const struct nn_rsample_info *sampleinfo, const str
 
   pwr = sampleinfo->pwr;
   if (pwr == NULL)
-    assert (srcguid.entityid.u == NN_ENTITYID_SPDP_BUILTIN_PARTICIPANT_WRITER);
+  {
+    /* NULL with NN_ENTITYID_SPDP_BUILTIN_PARTICIPANT_WRITER is normal. It is possible that
+     * NN_ENTITYID_SPDP_RELIABLE_BUILTIN_PARTICIPANT_SECURE_WRITER has NULL as well if there
+     * is a security mismatch being handled. */
+    assert ((srcguid.entityid.u == NN_ENTITYID_SPDP_BUILTIN_PARTICIPANT_WRITER) ||
+            (srcguid.entityid.u == NN_ENTITYID_SPDP_RELIABLE_BUILTIN_PARTICIPANT_SECURE_WRITER));
+  }
   else
   {
     assert (is_builtin_entityid (pwr->e.guid.entityid, pwr->c.vendor));
@@ -1690,6 +1752,7 @@ int builtins_dqueue_handler (const struct nn_rsample_info *sampleinfo, const str
       {
         case NN_ENTITYID_SPDP_BUILTIN_PARTICIPANT_WRITER:
         case NN_ENTITYID_SEDP_BUILTIN_CM_PARTICIPANT_WRITER:
+        case NN_ENTITYID_SPDP_RELIABLE_BUILTIN_PARTICIPANT_SECURE_WRITER:
           pid = PID_PARTICIPANT_GUID;
           break;
         case NN_ENTITYID_SEDP_BUILTIN_CM_PUBLISHER_WRITER:
@@ -1698,6 +1761,8 @@ int builtins_dqueue_handler (const struct nn_rsample_info *sampleinfo, const str
           break;
         case NN_ENTITYID_SEDP_BUILTIN_PUBLICATIONS_WRITER:
         case NN_ENTITYID_SEDP_BUILTIN_SUBSCRIPTIONS_WRITER:
+        case NN_ENTITYID_SEDP_BUILTIN_PUBLICATIONS_SECURE_WRITER:
+        case NN_ENTITYID_SEDP_BUILTIN_SUBSCRIPTIONS_SECURE_WRITER:
           pid = PID_ENDPOINT_GUID;
           break;
         case NN_ENTITYID_SEDP_BUILTIN_TOPIC_WRITER:
@@ -1736,18 +1801,27 @@ int builtins_dqueue_handler (const struct nn_rsample_info *sampleinfo, const str
   switch (srcguid.entityid.u)
   {
     case NN_ENTITYID_SPDP_BUILTIN_PARTICIPANT_WRITER:
-      handle_SPDP (sampleinfo->rst, sampleinfo->seq, timestamp, statusinfo, datap, datasz);
+    case NN_ENTITYID_SPDP_RELIABLE_BUILTIN_PARTICIPANT_SECURE_WRITER:
+      handle_SPDP (sampleinfo->rst, srcguid.entityid, sampleinfo->seq, timestamp, statusinfo, datap, datasz);
       break;
     case NN_ENTITYID_SEDP_BUILTIN_PUBLICATIONS_WRITER:
     case NN_ENTITYID_SEDP_BUILTIN_SUBSCRIPTIONS_WRITER:
+    case NN_ENTITYID_SEDP_BUILTIN_PUBLICATIONS_SECURE_WRITER:
+    case NN_ENTITYID_SEDP_BUILTIN_SUBSCRIPTIONS_SECURE_WRITER:
       handle_SEDP (sampleinfo->rst, sampleinfo->seq, timestamp, statusinfo, datap, datasz);
       break;
     case NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_MESSAGE_WRITER:
+    case NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_MESSAGE_SECURE_WRITER:
       handle_PMD (sampleinfo->rst, timestamp, statusinfo, datap, datasz);
       break;
     case NN_ENTITYID_SEDP_BUILTIN_CM_PARTICIPANT_WRITER:
       handle_SEDP_CM (sampleinfo->rst, srcguid.entityid, timestamp, statusinfo, datap, datasz);
       break;
+#ifdef DDSI_INCLUDE_SECURITY
+    case NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_STATELESS_MESSAGE_WRITER:
+      /* TODO: Handshake */
+      break;
+#endif
     default:
       GVLOGDISC ("data(builtin, vendor %u.%u): "PGUIDFMT" #%"PRId64": not handled\n",
                  sampleinfo->rst->vendor.id[0], sampleinfo->rst->vendor.id[1],
diff --git a/src/core/ddsi/src/q_entity.c b/src/core/ddsi/src/q_entity.c
index d2a4fed..e4c020d 100644
--- a/src/core/ddsi/src/q_entity.c
+++ b/src/core/ddsi/src/q_entity.c
@@ -48,6 +48,7 @@
 #include "dds__whc.h"
 #include "dds/ddsi/ddsi_iid.h"
 #include "dds/ddsi/ddsi_tkmap.h"
+#include "dds/ddsi/ddsi_security_omg.h"
 
 struct deleted_participant {
   ddsrt_avl_node_t avlnode;
@@ -461,6 +462,76 @@ static void pp_release_entityid(struct participant *pp, ddsi_entityid_t id)
   ddsrt_mutex_unlock (&pp->e.lock);
 }
 
+static void force_as_disc_address(struct q_globals *gv, const ddsi_guid_t *subguid)
+{
+  struct writer *wr = ephash_lookup_writer_guid (gv->guid_hash, subguid);
+  assert (wr != NULL);
+  ddsrt_mutex_lock (&wr->e.lock);
+  unref_addrset (wr->as);
+  unref_addrset (wr->as_group);
+  wr->as = ref_addrset (gv->as_disc);
+  wr->as_group = ref_addrset (gv->as_disc_group);
+  ddsrt_mutex_unlock (&wr->e.lock);
+}
+
+#ifdef DDSI_INCLUDE_SECURITY
+static void add_security_builtin_endpoints(struct participant *pp, ddsi_guid_t *subguid, const ddsi_guid_t *group_guid, struct q_globals *gv, bool add_writers, bool add_readers)
+{
+  if (add_writers)
+  {
+    subguid->entityid = to_entityid (NN_ENTITYID_SPDP_RELIABLE_BUILTIN_PARTICIPANT_SECURE_WRITER);
+    new_writer_guid (NULL, subguid, group_guid, pp, NULL, &gv->builtin_endpoint_xqos_wr, whc_new(gv, 1, 1, 1), NULL, NULL);
+    /* But we need the as_disc address set for SPDP, because we need to
+       send it to everyone regardless of the existence of readers. */
+    force_as_disc_address(gv, subguid);
+    pp->bes |= NN_DISC_BUILTIN_ENDPOINT_PARTICIPANT_SECURE_ANNOUNCER;
+
+    subguid->entityid = to_entityid (NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_STATELESS_MESSAGE_WRITER);
+    new_writer_guid (NULL, subguid, group_guid, pp, NULL, &gv->builtin_stateless_xqos_wr, whc_new(gv, 0, 1, 1), NULL, NULL);
+    pp->bes |= NN_BUILTIN_ENDPOINT_PARTICIPANT_STATELESS_MESSAGE_ANNOUNCER;
+
+    subguid->entityid = to_entityid (NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_MESSAGE_SECURE_WRITER);
+    new_writer_guid (NULL, subguid, group_guid, pp, NULL, &gv->builtin_endpoint_xqos_wr, whc_new(gv, 1, 1, 1), NULL, NULL);
+    pp->bes |= NN_BUILTIN_ENDPOINT_PARTICIPANT_MESSAGE_SECURE_ANNOUNCER;
+
+    subguid->entityid = to_entityid (NN_ENTITYID_SEDP_BUILTIN_PUBLICATIONS_SECURE_WRITER);
+    new_writer_guid (NULL, subguid, group_guid, pp, NULL, &gv->builtin_endpoint_xqos_wr, whc_new(gv, 1, 1, 1), NULL, NULL);
+    pp->bes |= NN_BUILTIN_ENDPOINT_PUBLICATION_MESSAGE_SECURE_ANNOUNCER;
+
+    subguid->entityid = to_entityid (NN_ENTITYID_SEDP_BUILTIN_SUBSCRIPTIONS_SECURE_WRITER);
+    new_writer_guid (NULL, subguid, group_guid, pp, NULL, &gv->builtin_endpoint_xqos_wr, whc_new(gv, 1, 1, 1), NULL, NULL);
+    pp->bes |= NN_BUILTIN_ENDPOINT_SUBSCRIPTION_MESSAGE_SECURE_ANNOUNCER;
+  }
+
+  if (add_readers)
+  {
+    subguid->entityid = to_entityid (NN_ENTITYID_SEDP_BUILTIN_SUBSCRIPTIONS_SECURE_READER);
+    new_reader_guid (NULL, subguid, group_guid, pp, NULL, &gv->builtin_endpoint_xqos_rd, NULL, NULL, NULL);
+    pp->bes |= NN_BUILTIN_ENDPOINT_SUBSCRIPTION_MESSAGE_SECURE_DETECTOR;
+
+    subguid->entityid = to_entityid (NN_ENTITYID_SEDP_BUILTIN_PUBLICATIONS_SECURE_READER);
+    new_reader_guid (NULL, subguid, group_guid, pp, NULL, &gv->builtin_endpoint_xqos_rd, NULL, NULL, NULL);
+    pp->bes |= NN_BUILTIN_ENDPOINT_PUBLICATION_MESSAGE_SECURE_DETECTOR;
+  }
+
+  /*
+   * When security is enabled configure the associated necessary builtin readers independent of the
+   * besmode flag setting, because all participant do require authentication.
+   */
+  subguid->entityid = to_entityid (NN_ENTITYID_SPDP_RELIABLE_BUILTIN_PARTICIPANT_SECURE_READER);
+  new_reader_guid (NULL, subguid, group_guid, pp, NULL, &gv->builtin_endpoint_xqos_rd, NULL, NULL, NULL);
+  pp->bes |= NN_DISC_BUILTIN_ENDPOINT_PARTICIPANT_SECURE_DETECTOR;
+
+  subguid->entityid = to_entityid (NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_STATELESS_MESSAGE_READER);
+  new_reader_guid (NULL, subguid, group_guid, pp, NULL, &gv->builtin_stateless_xqos_rd, NULL, NULL, NULL);
+  pp->bes |= NN_BUILTIN_ENDPOINT_PARTICIPANT_STATELESS_MESSAGE_DETECTOR;
+
+  subguid->entityid = to_entityid (NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_MESSAGE_SECURE_READER);
+  new_reader_guid (NULL, subguid, group_guid, pp, NULL, &gv->builtin_endpoint_xqos_rd, NULL, NULL, NULL);
+  pp->bes |= NN_BUILTIN_ENDPOINT_PARTICIPANT_MESSAGE_SECURE_DETECTOR;
+}
+#endif
+
 dds_return_t new_participant_guid (const ddsi_guid_t *ppguid, struct q_globals *gv, unsigned flags, const nn_plist_t *plist)
 {
   struct participant *pp;
@@ -591,16 +662,7 @@ dds_return_t new_participant_guid (const ddsi_guid_t *ppguid, struct q_globals *
     new_writer_guid (NULL, &subguid, &group_guid, pp, NULL, &gv->spdp_endpoint_xqos, whc_new(gv, 1, 1, 1), LAST_WR_PARAMS);
     /* But we need the as_disc address set for SPDP, because we need to
        send it to everyone regardless of the existence of readers. */
-    {
-      struct writer *wr = ephash_lookup_writer_guid (gv->guid_hash, &subguid);
-      assert (wr != NULL);
-      ddsrt_mutex_lock (&wr->e.lock);
-      unref_addrset (wr->as);
-      unref_addrset (wr->as_group);
-      wr->as = ref_addrset (gv->as_disc);
-      wr->as_group = ref_addrset (gv->as_disc_group);
-      ddsrt_mutex_unlock (&wr->e.lock);
-    }
+    force_as_disc_address(gv, &subguid);
     pp->bes |= NN_DISC_BUILTIN_ENDPOINT_PARTICIPANT_ANNOUNCER;
   }
 
@@ -679,6 +741,14 @@ dds_return_t new_participant_guid (const ddsi_guid_t *ppguid, struct q_globals *
     pp->prismtech_bes |= NN_DISC_BUILTIN_ENDPOINT_CM_SUBSCRIBER_READER;
 
   }
+
+#ifdef DDSI_INCLUDE_SECURITY
+  if (q_omg_participant_is_secure(pp))
+  {
+    add_security_builtin_endpoints(pp, &subguid, &group_guid, gv, !(flags & RTPS_PF_NO_BUILTIN_WRITERS), !(flags & RTPS_PF_NO_BUILTIN_READERS));
+  }
+#endif
+
 #undef LAST_WR_PARAMS
 
   /* If the participant doesn't have the full set of builtin writers
@@ -830,6 +900,17 @@ static void unref_participant (struct participant *pp, const struct ddsi_guid *g
     NN_ENTITYID_SEDP_BUILTIN_PUBLICATIONS_READER,
     NN_ENTITYID_SEDP_BUILTIN_SUBSCRIPTIONS_READER,
     NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_MESSAGE_READER,
+    /* Security ones: */
+    NN_ENTITYID_SEDP_BUILTIN_PUBLICATIONS_SECURE_WRITER,
+    NN_ENTITYID_SEDP_BUILTIN_PUBLICATIONS_SECURE_READER,
+    NN_ENTITYID_SEDP_BUILTIN_SUBSCRIPTIONS_SECURE_WRITER,
+    NN_ENTITYID_SEDP_BUILTIN_SUBSCRIPTIONS_SECURE_READER,
+    NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_MESSAGE_SECURE_WRITER,
+    NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_MESSAGE_SECURE_READER,
+    NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_STATELESS_MESSAGE_WRITER,
+    NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_STATELESS_MESSAGE_READER,
+    NN_ENTITYID_SPDP_RELIABLE_BUILTIN_PARTICIPANT_SECURE_WRITER,
+    NN_ENTITYID_SPDP_RELIABLE_BUILTIN_PARTICIPANT_SECURE_READER,
     /* PrismTech ones: */
     NN_ENTITYID_SEDP_BUILTIN_CM_PARTICIPANT_WRITER,
     NN_ENTITYID_SEDP_BUILTIN_CM_PARTICIPANT_READER,
@@ -913,7 +994,7 @@ static void unref_participant (struct participant *pp, const struct ddsi_guid *g
           (pp->prismtech_bes & prismtech_builtin_writers_besmask) != prismtech_builtin_writers_besmask)
       {
         /* Participant doesn't have a full complement of built-in
-           writers, therefore, it relies on gv.privileged_pp, and
+           writers, therefore, it relies on gv->privileged_pp, and
            therefore we must decrement the reference count of that one.
 
            Why read it with the lock held, only to release it and use it
@@ -1002,9 +1083,15 @@ struct writer *get_builtin_writer (const struct participant *pp, unsigned entity
     case NN_ENTITYID_SEDP_BUILTIN_SUBSCRIPTIONS_WRITER:
       bes_mask = NN_DISC_BUILTIN_ENDPOINT_SUBSCRIPTION_ANNOUNCER;
       break;
+    case NN_ENTITYID_SEDP_BUILTIN_SUBSCRIPTIONS_SECURE_WRITER:
+      bes_mask = NN_BUILTIN_ENDPOINT_SUBSCRIPTION_MESSAGE_SECURE_ANNOUNCER;
+      break;
     case NN_ENTITYID_SEDP_BUILTIN_PUBLICATIONS_WRITER:
       bes_mask = NN_DISC_BUILTIN_ENDPOINT_PUBLICATION_ANNOUNCER;
       break;
+    case NN_ENTITYID_SEDP_BUILTIN_PUBLICATIONS_SECURE_WRITER:
+      bes_mask = NN_BUILTIN_ENDPOINT_PUBLICATION_MESSAGE_SECURE_ANNOUNCER;
+      break;
     case NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_MESSAGE_WRITER:
       bes_mask = NN_BUILTIN_ENDPOINT_PARTICIPANT_MESSAGE_DATA_WRITER;
       break;
@@ -1020,6 +1107,15 @@ struct writer *get_builtin_writer (const struct participant *pp, unsigned entity
     case NN_ENTITYID_SEDP_BUILTIN_TOPIC_WRITER:
       bes_mask = NN_DISC_BUILTIN_ENDPOINT_TOPIC_ANNOUNCER;
       break;
+    case NN_ENTITYID_SPDP_RELIABLE_BUILTIN_PARTICIPANT_SECURE_WRITER:
+      bes_mask = NN_DISC_BUILTIN_ENDPOINT_PARTICIPANT_SECURE_ANNOUNCER;
+      break;
+    case NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_STATELESS_MESSAGE_WRITER:
+      bes_mask = NN_BUILTIN_ENDPOINT_PARTICIPANT_STATELESS_MESSAGE_ANNOUNCER;
+      break;
+    case NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_MESSAGE_SECURE_WRITER:
+      bes_mask = NN_BUILTIN_ENDPOINT_PARTICIPANT_MESSAGE_SECURE_ANNOUNCER;
+      break;
     default:
       DDS_FATAL ("get_builtin_writer called with entityid %x\n", entityid);
       return NULL;
@@ -1385,7 +1481,7 @@ void rebuild_or_clear_writer_addrsets (struct q_globals *gv, int rebuild)
     else
     {
       /* SPDP writers have no matched readers, instead they all use the same address space,
-         gv.as_disc. Keep as_disc unchanged, and instead make the participants point to the
+         gv->as_disc. Keep as_disc unchanged, and instead make the participants point to the
          empty one. */
       unref_addrset(wr->as);
       if (rebuild)
@@ -2112,6 +2208,13 @@ static ddsi_entityid_t builtin_entityid_match (ddsi_entityid_t x)
       res.u = NN_ENTITYID_UNKNOWN;
       break;
 
+    case NN_ENTITYID_SPDP_RELIABLE_BUILTIN_PARTICIPANT_SECURE_WRITER:
+      res.u = NN_ENTITYID_SPDP_RELIABLE_BUILTIN_PARTICIPANT_SECURE_READER;
+      break;
+    case NN_ENTITYID_SPDP_RELIABLE_BUILTIN_PARTICIPANT_SECURE_READER:
+      res.u = NN_ENTITYID_SPDP_RELIABLE_BUILTIN_PARTICIPANT_SECURE_WRITER;
+      break;
+
     case NN_ENTITYID_SEDP_BUILTIN_CM_PARTICIPANT_READER:
       res.u = NN_ENTITYID_SEDP_BUILTIN_CM_PARTICIPANT_WRITER;
       break;
@@ -2130,6 +2233,30 @@ static ddsi_entityid_t builtin_entityid_match (ddsi_entityid_t x)
     case NN_ENTITYID_SEDP_BUILTIN_CM_SUBSCRIBER_WRITER:
       res.u = NN_ENTITYID_SEDP_BUILTIN_CM_SUBSCRIBER_READER;
       break;
+    case NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_STATELESS_MESSAGE_WRITER:
+      res.u = NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_STATELESS_MESSAGE_READER;
+      break;
+    case NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_STATELESS_MESSAGE_READER:
+      res.u = NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_STATELESS_MESSAGE_WRITER;
+      break;
+    case NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_MESSAGE_SECURE_WRITER:
+      res.u = NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_MESSAGE_SECURE_READER;
+      break;
+    case NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_MESSAGE_SECURE_READER:
+      res.u = NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_MESSAGE_SECURE_WRITER;
+      break;
+    case NN_ENTITYID_SEDP_BUILTIN_PUBLICATIONS_SECURE_WRITER:
+      res.u = NN_ENTITYID_SEDP_BUILTIN_PUBLICATIONS_SECURE_READER;
+      break;
+    case NN_ENTITYID_SEDP_BUILTIN_PUBLICATIONS_SECURE_READER:
+      res.u = NN_ENTITYID_SEDP_BUILTIN_PUBLICATIONS_SECURE_WRITER;
+      break;
+    case NN_ENTITYID_SEDP_BUILTIN_SUBSCRIPTIONS_SECURE_WRITER:
+      res.u = NN_ENTITYID_SEDP_BUILTIN_SUBSCRIPTIONS_SECURE_READER;
+      break;
+    case NN_ENTITYID_SEDP_BUILTIN_SUBSCRIPTIONS_SECURE_READER:
+      res.u = NN_ENTITYID_SEDP_BUILTIN_SUBSCRIPTIONS_SECURE_WRITER;
+      break;
 
     default:
       assert (0);
@@ -2815,7 +2942,8 @@ static void new_writer_guid_common_init (struct writer *wr, const struct ddsi_se
   if (is_builtin_entityid (wr->e.guid.entityid, NN_VENDORID_ECLIPSE))
   {
     assert (wr->xqos->history.kind == DDS_HISTORY_KEEP_LAST);
-    assert (wr->xqos->durability.kind == DDS_DURABILITY_TRANSIENT_LOCAL);
+    assert (wr->xqos->durability.kind == DDS_DURABILITY_TRANSIENT_LOCAL ||
+            wr->e.guid.entityid.u == NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_STATELESS_MESSAGE_WRITER);
   }
   wr->handle_as_transient_local = (wr->xqos->durability.kind == DDS_DURABILITY_TRANSIENT_LOCAL);
   wr->include_keyhash =
@@ -3614,6 +3742,158 @@ void proxy_participant_reassign_lease (struct proxy_participant *proxypp, struct
   ddsrt_mutex_unlock (&proxypp->e.lock);
 }
 
+struct bestab {
+  unsigned besflag;
+  unsigned prismtech_besflag;
+  unsigned entityid;
+};
+
+static void create_proxy_builtin_endpoints(
+  struct q_globals *gv,
+  const struct bestab *bestab,
+  int nbes,
+  const struct ddsi_guid *ppguid,
+  struct proxy_participant *proxypp,
+  nn_wctime_t timestamp,
+  dds_qos_t *xqos_wr,
+  dds_qos_t *xqos_rd)
+{
+  nn_plist_t plist_rd, plist_wr;
+  int i;
+  /* Note: no entity name or group GUID supplied, but that shouldn't
+   * matter, as these are internal to DDSI and don't use group
+   * coherency
+   */
+  nn_plist_init_empty (&plist_wr);
+  nn_plist_init_empty (&plist_rd);
+  nn_xqos_copy (&plist_wr.qos, xqos_wr);
+  nn_xqos_copy (&plist_rd.qos, xqos_rd);
+  for (i = 0; i < nbes; i++)
+  {
+    const struct bestab *te = &bestab[i];
+    if ((proxypp->bes & te->besflag) || (proxypp->prismtech_bes & te->prismtech_besflag))
+    {
+      ddsi_guid_t guid1;
+      guid1.prefix = proxypp->e.guid.prefix;
+      guid1.entityid.u = te->entityid;
+      assert (is_builtin_entityid (guid1.entityid, proxypp->vendor));
+      if (is_writer_entityid (guid1.entityid))
+      {
+        new_proxy_writer (gv, ppguid, &guid1, proxypp->as_meta, &plist_wr, gv->builtins_dqueue, gv->xevents, timestamp, 0);
+      }
+      else
+      {
+#ifdef DDSI_INCLUDE_SSM
+        const int ssm = addrset_contains_ssm (gv, proxypp->as_meta);
+#else
+        const int ssm = 0;
+#endif
+        new_proxy_reader (gv, ppguid, &guid1, proxypp->as_meta, &plist_rd, timestamp, 0, ssm);
+      }
+    }
+  }
+  nn_plist_fini (&plist_wr);
+  nn_plist_fini (&plist_rd);
+}
+
+
+static void add_proxy_builtin_endpoints(
+  struct q_globals *gv,
+  const struct ddsi_guid *ppguid,
+  struct proxy_participant *proxypp,
+  nn_wctime_t timestamp)
+{
+  /* Add proxy endpoints based on the advertised (& possibly augmented
+     ...) built-in endpoint set. */
+#define PT_TE(ap_, a_, bp_, b_) { 0, NN_##ap_##BUILTIN_ENDPOINT_##a_, NN_ENTITYID_##bp_##_BUILTIN_##b_ }
+#define TE(ap_, a_, bp_, b_) { NN_##ap_##BUILTIN_ENDPOINT_##a_, 0, NN_ENTITYID_##bp_##_BUILTIN_##b_ }
+#define LTE(a_, bp_, b_) { NN_##BUILTIN_ENDPOINT_##a_, 0, NN_ENTITYID_##bp_##_BUILTIN_##b_ }
+
+  /* 'Default' proxy endpoints. */
+  static const struct bestab bestab_default[] = {
+#if 0
+    /* SPDP gets special treatment => no need for proxy
+       writers/readers */
+    TE (DISC_, PARTICIPANT_ANNOUNCER, SPDP, PARTICIPANT_WRITER),
+#endif
+    TE (DISC_, PARTICIPANT_DETECTOR, SPDP, PARTICIPANT_READER),
+    TE (DISC_, PUBLICATION_ANNOUNCER, SEDP, PUBLICATIONS_WRITER),
+    TE (DISC_, PUBLICATION_DETECTOR, SEDP, PUBLICATIONS_READER),
+    TE (DISC_, SUBSCRIPTION_ANNOUNCER, SEDP, SUBSCRIPTIONS_WRITER),
+    TE (DISC_, SUBSCRIPTION_DETECTOR, SEDP, SUBSCRIPTIONS_READER),
+    LTE (PARTICIPANT_MESSAGE_DATA_WRITER, P2P, PARTICIPANT_MESSAGE_WRITER),
+    LTE (PARTICIPANT_MESSAGE_DATA_READER, P2P, PARTICIPANT_MESSAGE_READER),
+    TE (DISC_, TOPIC_ANNOUNCER, SEDP, TOPIC_WRITER),
+    TE (DISC_, TOPIC_DETECTOR, SEDP, TOPIC_READER),
+    PT_TE (DISC_, CM_PARTICIPANT_READER, SEDP, CM_PARTICIPANT_READER),
+    PT_TE (DISC_, CM_PARTICIPANT_WRITER, SEDP, CM_PARTICIPANT_WRITER),
+    PT_TE (DISC_, CM_PUBLISHER_READER, SEDP, CM_PUBLISHER_READER),
+    PT_TE (DISC_, CM_PUBLISHER_WRITER, SEDP, CM_PUBLISHER_WRITER),
+    PT_TE (DISC_, CM_SUBSCRIBER_READER, SEDP, CM_SUBSCRIBER_READER),
+    PT_TE (DISC_, CM_SUBSCRIBER_WRITER, SEDP, CM_SUBSCRIBER_WRITER)
+  };
+  create_proxy_builtin_endpoints(gv,
+                                 bestab_default,
+                                 (int)(sizeof (bestab_default) / sizeof (*bestab_default)),
+                                 ppguid,
+                                 proxypp,
+                                 timestamp,
+                                 &gv->builtin_endpoint_xqos_wr,
+                                 &gv->builtin_endpoint_xqos_rd);
+
+#ifdef DDSI_INCLUDE_SECURITY
+  /* Security 'default' proxy endpoints. */
+  static const struct bestab bestab_security[] = {
+    LTE (PUBLICATION_MESSAGE_SECURE_ANNOUNCER, SEDP, PUBLICATIONS_SECURE_WRITER),
+    LTE (PUBLICATION_MESSAGE_SECURE_DETECTOR, SEDP, PUBLICATIONS_SECURE_READER),
+    LTE (SUBSCRIPTION_MESSAGE_SECURE_ANNOUNCER, SEDP, SUBSCRIPTIONS_SECURE_WRITER),
+    LTE (SUBSCRIPTION_MESSAGE_SECURE_DETECTOR, SEDP, SUBSCRIPTIONS_SECURE_READER),
+    LTE (PARTICIPANT_MESSAGE_SECURE_ANNOUNCER, P2P, PARTICIPANT_MESSAGE_SECURE_WRITER),
+    LTE (PARTICIPANT_MESSAGE_SECURE_DETECTOR, P2P, PARTICIPANT_MESSAGE_SECURE_READER),
+    TE (DISC_, PARTICIPANT_SECURE_ANNOUNCER, SPDP_RELIABLE, PARTICIPANT_SECURE_WRITER),
+    TE (DISC_, PARTICIPANT_SECURE_DETECTOR, SPDP_RELIABLE, PARTICIPANT_SECURE_READER)
+  };
+  create_proxy_builtin_endpoints(gv,
+                                 bestab_security,
+                                 (int)(sizeof (bestab_security) / sizeof (*bestab_security)),
+                                 ppguid,
+                                 proxypp,
+                                 timestamp,
+                                 &gv->builtin_endpoint_xqos_wr,
+                                 &gv->builtin_endpoint_xqos_rd);
+
+  /* Security 'stateless' proxy endpoints. */
+  static const struct bestab bestab_stateless[] = {
+    LTE (PARTICIPANT_STATELESS_MESSAGE_ANNOUNCER, P2P, PARTICIPANT_STATELESS_MESSAGE_WRITER),
+    LTE (PARTICIPANT_STATELESS_MESSAGE_DETECTOR, P2P, PARTICIPANT_STATELESS_MESSAGE_READER)
+  };
+  create_proxy_builtin_endpoints(gv,
+                                 bestab_stateless,
+                                 (int)(sizeof (bestab_stateless) / sizeof (*bestab_stateless)),
+                                 ppguid,
+                                 proxypp,
+                                 timestamp,
+                                 &gv->builtin_stateless_xqos_wr,
+                                 &gv->builtin_stateless_xqos_rd);
+#endif
+
+  /* Register lease, but be careful not to accidentally re-register
+     DDSI2's lease, as we may have become dependent on DDSI2 any time
+     after ephash_insert_proxy_participant_guid even if
+     privileged_pp_guid was NULL originally */
+  ddsrt_mutex_lock (&proxypp->e.lock);
+
+  if (proxypp->owns_lease)
+    lease_register (ddsrt_atomic_ldvoidp (&proxypp->lease));
+
+  builtintopic_write (gv->builtin_topic_interface, &proxypp->e, timestamp, true);
+  ddsrt_mutex_unlock (&proxypp->e.lock);
+
+#undef PT_TE
+#undef TE
+#undef LTE
+}
+
 void new_proxy_participant
 (
   struct q_globals *gv,
@@ -3720,89 +4000,8 @@ void new_proxy_participant
      new_proxy_{writer,reader} to work */
   ephash_insert_proxy_participant_guid (gv->guid_hash, proxypp);
 
-  /* Add proxy endpoints based on the advertised (& possibly augmented
-     ...) built-in endpoint set. */
-  {
-#define PT_TE(ap_, a_, bp_, b_) { 0, NN_##ap_##BUILTIN_ENDPOINT_##a_, NN_ENTITYID_##bp_##_BUILTIN_##b_ }
-#define TE(ap_, a_, bp_, b_) { NN_##ap_##BUILTIN_ENDPOINT_##a_, 0, NN_ENTITYID_##bp_##_BUILTIN_##b_ }
-#define LTE(a_, bp_, b_) { NN_##BUILTIN_ENDPOINT_##a_, 0, NN_ENTITYID_##bp_##_BUILTIN_##b_ }
-    static const struct bestab {
-      unsigned besflag;
-      unsigned prismtech_besflag;
-      unsigned entityid;
-    } bestab[] = {
-#if 0
-      /* SPDP gets special treatment => no need for proxy
-         writers/readers */
-      TE (DISC_, PARTICIPANT_ANNOUNCER, SPDP, PARTICIPANT_WRITER),
-#endif
-      TE (DISC_, PARTICIPANT_DETECTOR, SPDP, PARTICIPANT_READER),
-      TE (DISC_, PUBLICATION_ANNOUNCER, SEDP, PUBLICATIONS_WRITER),
-      TE (DISC_, PUBLICATION_DETECTOR, SEDP, PUBLICATIONS_READER),
-      TE (DISC_, SUBSCRIPTION_ANNOUNCER, SEDP, SUBSCRIPTIONS_WRITER),
-      TE (DISC_, SUBSCRIPTION_DETECTOR, SEDP, SUBSCRIPTIONS_READER),
-      LTE (PARTICIPANT_MESSAGE_DATA_WRITER, P2P, PARTICIPANT_MESSAGE_WRITER),
-      LTE (PARTICIPANT_MESSAGE_DATA_READER, P2P, PARTICIPANT_MESSAGE_READER),
-      TE (DISC_, TOPIC_ANNOUNCER, SEDP, TOPIC_WRITER),
-      TE (DISC_, TOPIC_DETECTOR, SEDP, TOPIC_READER),
-      PT_TE (DISC_, CM_PARTICIPANT_READER, SEDP, CM_PARTICIPANT_READER),
-      PT_TE (DISC_, CM_PARTICIPANT_WRITER, SEDP, CM_PARTICIPANT_WRITER),
-      PT_TE (DISC_, CM_PUBLISHER_READER, SEDP, CM_PUBLISHER_READER),
-      PT_TE (DISC_, CM_PUBLISHER_WRITER, SEDP, CM_PUBLISHER_WRITER),
-      PT_TE (DISC_, CM_SUBSCRIBER_READER, SEDP, CM_SUBSCRIBER_READER),
-      PT_TE (DISC_, CM_SUBSCRIBER_WRITER, SEDP, CM_SUBSCRIBER_WRITER)
-    };
-#undef PT_TE
-#undef TE
-#undef LTE
-    nn_plist_t plist_rd, plist_wr;
-    int i;
-    /* Note: no entity name or group GUID supplied, but that shouldn't
-       matter, as these are internal to DDSI and don't use group
-       coherency */
-    nn_plist_init_empty (&plist_wr);
-    nn_plist_init_empty (&plist_rd);
-    nn_xqos_copy (&plist_wr.qos, &gv->builtin_endpoint_xqos_wr);
-    nn_xqos_copy (&plist_rd.qos, &gv->builtin_endpoint_xqos_rd);
-    for (i = 0; i < (int) (sizeof (bestab) / sizeof (*bestab)); i++)
-    {
-      const struct bestab *te = &bestab[i];
-      if ((proxypp->bes & te->besflag) || (proxypp->prismtech_bes & te->prismtech_besflag))
-      {
-        ddsi_guid_t guid1;
-        guid1.prefix = proxypp->e.guid.prefix;
-        guid1.entityid.u = te->entityid;
-        assert (is_builtin_entityid (guid1.entityid, proxypp->vendor));
-        if (is_writer_entityid (guid1.entityid))
-        {
-          new_proxy_writer (gv, ppguid, &guid1, proxypp->as_meta, &plist_wr, gv->builtins_dqueue, gv->xevents, timestamp, 0);
-        }
-        else
-        {
-#ifdef DDSI_INCLUDE_SSM
-          const int ssm = addrset_contains_ssm (gv, proxypp->as_meta);
-          new_proxy_reader (gv, ppguid, &guid1, proxypp->as_meta, &plist_rd, timestamp, 0, ssm);
-#else
-          new_proxy_reader (gv, ppguid, &guid1, proxypp->as_meta, &plist_rd, timestamp, 0);
-#endif
-        }
-      }
-    }
-    nn_plist_fini (&plist_wr);
-    nn_plist_fini (&plist_rd);
-  }
-
-  /* Register lease, but be careful not to accidentally re-register
-     DDSI2's lease, as we may have become dependent on DDSI2 any time
-     after ephash_insert_proxy_participant_guid even if
-     privileged_pp_guid was NULL originally */
-  ddsrt_mutex_lock (&proxypp->e.lock);
-
-  if (proxypp->owns_lease)
-    lease_register (ddsrt_atomic_ldvoidp (&proxypp->lease));
-
-  builtintopic_write (gv->builtin_topic_interface, &proxypp->e, timestamp, true);
-  ddsrt_mutex_unlock (&proxypp->e.lock);
+  /* TODO: Do security checks on the proxy participant. Either add the endpoints or delete the proxy. */
+  add_proxy_builtin_endpoints(gv, ppguid, proxypp, timestamp);
 }
 
 int update_proxy_participant_plist_locked (struct proxy_participant *proxypp, seqno_t seq, const struct nn_plist *datap, enum update_proxy_participant_source source, nn_wctime_t timestamp)
@@ -4104,12 +4303,27 @@ static void proxy_endpoint_common_fini (struct entity_common *e, struct proxy_en
 
 /* PROXY-WRITER ----------------------------------------------------- */
 
+static enum nn_reorder_mode
+get_proxy_writer_reorder_mode(const ddsi_entityid_t pwr_entityid, int isreliable)
+{
+  if (isreliable)
+  {
+    return NN_REORDER_MODE_NORMAL;
+  }
+  if (pwr_entityid.u == NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_STATELESS_MESSAGE_WRITER)
+  {
+    return NN_REORDER_MODE_ALWAYS_DELIVER;
+  }
+  return NN_REORDER_MODE_MONOTONICALLY_INCREASING;
+}
+
 int new_proxy_writer (struct q_globals *gv, const struct ddsi_guid *ppguid, const struct ddsi_guid *guid, struct addrset *as, const nn_plist_t *plist, struct nn_dqueue *dqueue, struct xeventq *evq, nn_wctime_t timestamp, seqno_t seq)
 {
   struct proxy_participant *proxypp;
   struct proxy_writer *pwr;
   int isreliable;
   nn_mtime_t tnow = now_mt ();
+  enum nn_reorder_mode reorder_mode;
 
   assert (is_writer_entityid (guid->entityid));
   assert (ephash_lookup_proxy_writer_guid (gv->guid_hash, guid) == NULL);
@@ -4168,13 +4382,13 @@ int new_proxy_writer (struct q_globals *gv, const struct ddsi_guid *ppguid, cons
   if (isreliable)
   {
     pwr->defrag = nn_defrag_new (&gv->logconfig, NN_DEFRAG_DROP_LATEST, gv->config.defrag_reliable_maxsamples);
-    pwr->reorder = nn_reorder_new (&gv->logconfig, NN_REORDER_MODE_NORMAL, gv->config.primary_reorder_maxsamples, gv->config.late_ack_mode);
   }
   else
   {
     pwr->defrag = nn_defrag_new (&gv->logconfig, NN_DEFRAG_DROP_OLDEST, gv->config.defrag_unreliable_maxsamples);
-    pwr->reorder = nn_reorder_new (&gv->logconfig, NN_REORDER_MODE_MONOTONICALLY_INCREASING, gv->config.primary_reorder_maxsamples, gv->config.late_ack_mode);
   }
+  reorder_mode = get_proxy_writer_reorder_mode(pwr->e.guid.entityid, isreliable);
+  pwr->reorder = nn_reorder_new (&gv->logconfig, reorder_mode, gv->config.primary_reorder_maxsamples, gv->config.late_ack_mode);
   pwr->dqueue = dqueue;
   pwr->evq = evq;
   pwr->ddsi2direct_cb = 0;
diff --git a/src/core/ddsi/src/q_init.c b/src/core/ddsi/src/q_init.c
index f2bb0d9..0e2442a 100644
--- a/src/core/ddsi/src/q_init.c
+++ b/src/core/ddsi/src/q_init.c
@@ -1013,6 +1013,12 @@ int rtps_init (struct q_globals *gv)
   gv->spdp_endpoint_xqos.durability.kind = DDS_DURABILITY_TRANSIENT_LOCAL;
   make_builtin_endpoint_xqos (&gv->builtin_endpoint_xqos_rd, &gv->default_xqos_rd);
   make_builtin_endpoint_xqos (&gv->builtin_endpoint_xqos_wr, &gv->default_xqos_wr);
+#ifdef DDSI_INCLUDE_SECURITY
+  nn_xqos_copy (&gv->builtin_stateless_xqos_rd, &gv->default_xqos_rd);
+  nn_xqos_copy (&gv->builtin_stateless_xqos_wr, &gv->default_xqos_wr);
+  gv->builtin_stateless_xqos_wr.reliability.kind = DDS_RELIABILITY_BEST_EFFORT;
+  gv->builtin_stateless_xqos_wr.durability.kind = DDS_DURABILITY_VOLATILE;
+#endif
 
   make_special_topics (gv);
 
@@ -1329,6 +1335,10 @@ err_unicast_sockets:
   ddsrt_cond_destroy (&gv->participant_set_cond);
   ddsrt_mutex_destroy (&gv->participant_set_lock);
   free_special_topics (gv);
+#ifdef DDSI_INCLUDE_SECURITY
+  nn_xqos_fini (&gv->builtin_stateless_xqos_wr);
+  nn_xqos_fini (&gv->builtin_stateless_xqos_rd);
+#endif
   nn_xqos_fini (&gv->builtin_endpoint_xqos_wr);
   nn_xqos_fini (&gv->builtin_endpoint_xqos_rd);
   nn_xqos_fini (&gv->spdp_endpoint_xqos);
@@ -1657,6 +1667,10 @@ void rtps_fini (struct q_globals *gv)
   ddsrt_cond_destroy (&gv->participant_set_cond);
   free_special_topics (gv);
 
+#ifdef DDSI_INCLUDE_SECURITY
+  nn_xqos_fini (&gv->builtin_stateless_xqos_wr);
+  nn_xqos_fini (&gv->builtin_stateless_xqos_rd);
+#endif
   nn_xqos_fini (&gv->builtin_endpoint_xqos_wr);
   nn_xqos_fini (&gv->builtin_endpoint_xqos_rd);
   nn_xqos_fini (&gv->spdp_endpoint_xqos);
diff --git a/src/core/ddsi/src/q_receive.c b/src/core/ddsi/src/q_receive.c
index ada45a0..352c611 100644
--- a/src/core/ddsi/src/q_receive.c
+++ b/src/core/ddsi/src/q_receive.c
@@ -2305,7 +2305,8 @@ static void drop_oversize (struct receiver_state *rst, struct nn_rmsg *rmsg, con
     /* No proxy writer means nothing really gets done with, unless it
        is SPDP.  SPDP is periodic, so oversize discovery packets would
        cause periodic warnings. */
-    if (msg->writerId.u == NN_ENTITYID_SPDP_BUILTIN_PARTICIPANT_WRITER)
+    if ((msg->writerId.u == NN_ENTITYID_SPDP_BUILTIN_PARTICIPANT_WRITER) ||
+        (msg->writerId.u == NN_ENTITYID_SPDP_RELIABLE_BUILTIN_PARTICIPANT_SECURE_WRITER))
     {
       DDS_CWARNING (&rst->gv->logconfig, "dropping oversize (%"PRIu32" > %"PRIu32") SPDP sample %"PRId64" from remote writer "PGUIDFMT"\n",
                     sampleinfo->size, rst->gv->config.max_sample_size, sampleinfo->seq,
@@ -2374,7 +2375,8 @@ static int handle_Data (struct receiver_state *rst, nn_etime_t tnow, struct nn_r
     }
     rdata = nn_rdata_new (rmsg, 0, sampleinfo->size, submsg_offset, payload_offset);
 
-    if (msg->x.writerId.u == NN_ENTITYID_SPDP_BUILTIN_PARTICIPANT_WRITER)
+    if ((msg->x.writerId.u == NN_ENTITYID_SPDP_BUILTIN_PARTICIPANT_WRITER) ||
+        (msg->x.writerId.u == NN_ENTITYID_SPDP_RELIABLE_BUILTIN_PARTICIPANT_SECURE_WRITER))
       /* SPDP needs special treatment: there are no proxy writers for it
          and we accept data from unknown sources */
     {
@@ -2409,7 +2411,8 @@ static int handle_DataFrag (struct receiver_state *rst, nn_etime_t tnow, struct
     struct nn_rdata *rdata;
     unsigned submsg_offset, payload_offset;
     uint32_t begin, endp1;
-    if (msg->x.writerId.u == NN_ENTITYID_SPDP_BUILTIN_PARTICIPANT_WRITER)
+    if ((msg->x.writerId.u == NN_ENTITYID_SPDP_BUILTIN_PARTICIPANT_WRITER) ||
+        (msg->x.writerId.u == NN_ENTITYID_SPDP_RELIABLE_BUILTIN_PARTICIPANT_SECURE_WRITER))
     {
       DDS_CWARNING (&rst->gv->logconfig, "DATAFRAG("PGUIDFMT" #%"PRId64" -> "PGUIDFMT") - fragmented builtin data not yet supported\n",
                     PGUIDPREFIX (rst->src_guid_prefix), msg->x.writerId.u, fromSN (msg->x.writerSN),
diff --git a/src/core/ddsi/src/q_transmit.c b/src/core/ddsi/src/q_transmit.c
index 0a99fc9..b0061fe 100644
--- a/src/core/ddsi/src/q_transmit.c
+++ b/src/core/ddsi/src/q_transmit.c
@@ -884,7 +884,9 @@ static int insert_sample_in_whc (struct writer *wr, seqno_t seq, struct nn_plist
     res = 1;
 
 #ifndef NDEBUG
-  if (wr->e.guid.entityid.u == NN_ENTITYID_SPDP_BUILTIN_PARTICIPANT_WRITER && !is_local_orphan_endpoint (&wr->e))
+  if (((wr->e.guid.entityid.u == NN_ENTITYID_SPDP_BUILTIN_PARTICIPANT_WRITER) ||
+       (wr->e.guid.entityid.u == NN_ENTITYID_SPDP_RELIABLE_BUILTIN_PARTICIPANT_SECURE_WRITER)) &&
+       !is_local_orphan_endpoint (&wr->e))
   {
     struct whc_state whcst;
     whc_get_state(wr->whc, &whcst);

From 2c1d3010d09a149ed7d1dbd65f3b8f8fd2446b23 Mon Sep 17 00:00:00 2001
From: Kurtulus Oksuztepe <kurtulus.oksuztepe@adlinktech.com>
Date: Wed, 30 Oct 2019 11:41:00 +0100
Subject: [PATCH 074/238] Builtin authentication plugin for DDS Security
 Builtin authentication plugin of DDS Security implementation was added. This
 plugin is the first implementation and it also contains the functions that
 are used initially in the secure communication sequence.

The builtin authentication plugin implements authentication using a trusted Certificate Authority (CA). It performs mutual authentication between discovered participants using the RSA or ECDSA Digital Signature Algorithms and establishes a shared secret using Diffie-Hellman (DH) or Elliptic Curve Diffie-Hellman (ECDH) Key Agreement Methods.

DDS Security core component is introduced with this commit. DDSI and other builtin plugins will also use the security core.

Like all builtin plugins, dds security authentication plugin is a shared library for providing dynamic library loading on runtime. So that, dds participants can use different plugin implementations with different configurations.

Authentication plugin uses ddsrt functions. ddsrt is not expected to be a shared library and statically adding ddsrt objects to authentication library produces linkage errors in windows. So, dynamically linking authentication plugin to ddc library is decided. Another decision should be taken for the platforms that are not supporting dynamic libraries later.

Signed-off-by: Kurtulus Oksuztepe <kurtulus.oksuztepe@adlinktech.com>
---
 cmake/Modules/CUnit.cmake                     |    7 +-
 src/CMakeLists.txt                            |    2 +-
 src/core/CMakeLists.txt                       |    2 +-
 src/ddsrt/include/dds/ddsrt/time.h            |    3 +
 src/ddsrt/src/dynlib/posix/dynlib.c           |   94 +-
 src/ddsrt/src/dynlib/windows/dynlib.c         |    3 +-
 src/security/CMakeLists.txt                   |   21 +
 src/security/api/CMakeLists.txt               |    6 +-
 .../include/dds/security/dds_security_api.h   |    2 +-
 .../dds_security_api_access_control.h         |    2 +-
 .../dds_security_api_authentication.h         |    2 +-
 .../security/dds_security_api_cryptography.h  |    2 +-
 .../dds/security/dds_security_api_defs.h      |    2 +-
 .../dds/security/dds_security_api_err.h       |   10 +-
 .../dds/security/dds_security_api_types.h     |    4 +-
 src/security/builtin_plugins/CMakeLists.txt   |   19 +
 .../authentication/CMakeLists.txt             |   65 +
 .../authentication/src/auth_utils.c           | 1379 +++++++
 .../authentication/src/auth_utils.h           |  238 ++
 .../authentication/src/authentication.c       | 3513 +++++++++++++++++
 .../authentication/src/authentication.h       |  146 +
 .../builtin_plugins/tests/CMakeLists.txt      |   51 +
 .../tests/common/src/handshake_helper.c       |  579 +++
 .../tests/common/src/handshake_helper.h       |   90 +
 .../builtin_plugins/tests/common/src/loader.c |  222 ++
 .../builtin_plugins/tests/common/src/loader.h |   34 +
 .../builtin_plugins/tests/config_env.h.in     |   17 +
 ...thenticated_peer_credential_token_utests.c | 1648 ++++++++
 .../etc/trusted_ca_dir/identity_ca            |   22 +
 .../etc/trusted_ca_dir/remote_identity_ca.crt |   25 +
 .../etc/trusted_ca_dir/root_CA_RSA.crt        |   28 +
 .../not_matching_trusted_ca.crt               |   25 +
 .../src/process_handshake_utests.c            | 2447 ++++++++++++
 .../etc/trusted_ca_dir/identity_ca            |   27 +
 .../etc/trusted_ca_dir/remote_ca.crt          |   25 +
 .../etc/trusted_ca_dir/root_CA_RSA.crt        |   28 +
 .../validate_begin_handshake_reply_utests.c   | 2125 ++++++++++
 .../validate_begin_handshake_request_utests.c |  828 ++++
 .../etc/Alice_Test_2.crt                      |   25 +
 .../etc/Bob_Chain_Test.crt                    |   25 +
 .../etc/Identity_CA_Test2.crt                 |   25 +
 .../etc/Identity_CA_Test_With_Chain.crt       |   25 +
 .../validate_local_identity/etc/alice.pem     |   27 +
 .../tests/validate_local_identity/etc/bob.pem |   27 +
 .../etc/ec_identity_ca                        |   14 +
 .../etc/ec_identity_certificate               |   50 +
 .../etc/ec_identity_certificate_unsupported   |   14 +
 .../etc/ec_private_key                        |    5 +
 .../etc/ec_private_key_unsupported            |    5 +
 .../etc/ec_private_key_w_password             |    8 +
 .../validate_local_identity/etc/identity_ca   |   27 +
 .../etc/identity_ca_private_key               |   27 +
 .../etc/identity_certificate                  |   25 +
 .../etc/identity_certificate_1024key          |   17 +
 .../etc/invalid_identity_ca                   |   22 +
 .../etc/invalid_identity_certificate          |   20 +
 .../etc/invalid_private_key                   |   27 +
 .../etc/new/CHAM-577.crt                      |   25 +
 .../etc/new/identity_ca                       |   27 +
 .../etc/new/identity_ca_private_key           |   27 +
 .../etc/new/identity_certificate              |   25 +
 .../etc/new/private_key                       |   27 +
 .../etc/old/Alice_Test_2.crt                  |   25 +
 .../etc/old/Bob_Chain_Test.crt                |   25 +
 .../etc/old/Identity_CA_Test2.crt             |   25 +
 .../etc/old/Identity_CA_Test_With_Chain.crt   |   25 +
 .../validate_local_identity/etc/old/alice.pem |   27 +
 .../validate_local_identity/etc/old/bob.pem   |   27 +
 .../etc/old/ec_identity_ca                    |   14 +
 .../etc/old/ec_identity_certificate           |   50 +
 .../old/ec_identity_certificate_unsupported   |   14 +
 .../etc/old/ec_private_key                    |    5 +
 .../etc/old/ec_private_key_unsupported        |    5 +
 .../etc/old/ec_private_key_w_password         |    8 +
 .../etc/old/identity_ca                       |   22 +
 .../etc/old/identity_certificate              |   20 +
 .../etc/old/identity_certificate_1024key      |   17 +
 .../etc/old/invalid_identity_ca               |   22 +
 .../etc/old/invalid_identity_certificate      |   20 +
 .../etc/old/invalid_private_key               |   27 +
 .../etc/old/private_key                       |   27 +
 .../etc/old/private_key_1024                  |   15 +
 .../etc/old/private_key_not_matching          |   48 +
 .../etc/old/private_key_w_password            |   30 +
 .../validate_local_identity/etc/old/remote    |   20 +
 .../etc/old/unrelated_identity_ca             |   22 +
 .../validate_local_identity/etc/private_key   |   27 +
 .../etc/private_key_1024                      |   15 +
 .../etc/private_key_not_matching              |   48 +
 .../etc/private_key_w_password                |   30 +
 .../etc/trusted_ca_dir/identity_ca            |   27 +
 .../etc/trusted_ca_dir/root_CA_RSA.crt        |   28 +
 .../not_matching_trusted_ca.crt               |   25 +
 .../etc/unrelated_identity_ca                 |   22 +
 .../tests/validate_local_identity/src/ca.crt  |   22 +
 .../tests/validate_local_identity/src/id.crt  |   20 +
 .../validate_local_identity/src/priv.pem      |   27 +
 .../tests/validate_local_identity/src/remote  |   20 +
 .../src/unrelated_identity_ca                 |   22 +
 .../src/validate_local_identity_utests.c      | 2109 ++++++++++
 .../src/validate_remote_identity_utests.c     | 1140 ++++++
 src/security/core/CMakeLists.txt              |   57 +
 .../security/core/dds_security_serialize.h    |  106 +
 .../dds/security/core/dds_security_types.h    |   69 +
 .../dds/security/core/dds_security_utils.h    |  391 ++
 .../include/dds/security/core/shared_secret.h |   40 +
 .../core/src/dds_security_serialize.c         |  813 ++++
 src/security/core/src/dds_security_utils.c    | 1134 ++++++
 src/security/core/src/shared_secret.c         |   43 +
 109 files changed, 20998 insertions(+), 66 deletions(-)
 create mode 100644 src/security/CMakeLists.txt
 create mode 100644 src/security/builtin_plugins/CMakeLists.txt
 create mode 100644 src/security/builtin_plugins/authentication/CMakeLists.txt
 create mode 100644 src/security/builtin_plugins/authentication/src/auth_utils.c
 create mode 100644 src/security/builtin_plugins/authentication/src/auth_utils.h
 create mode 100644 src/security/builtin_plugins/authentication/src/authentication.c
 create mode 100644 src/security/builtin_plugins/authentication/src/authentication.h
 create mode 100644 src/security/builtin_plugins/tests/CMakeLists.txt
 create mode 100644 src/security/builtin_plugins/tests/common/src/handshake_helper.c
 create mode 100644 src/security/builtin_plugins/tests/common/src/handshake_helper.h
 create mode 100644 src/security/builtin_plugins/tests/common/src/loader.c
 create mode 100644 src/security/builtin_plugins/tests/common/src/loader.h
 create mode 100644 src/security/builtin_plugins/tests/config_env.h.in
 create mode 100644 src/security/builtin_plugins/tests/get_authenticated_peer_credential_token/src/get_authenticated_peer_credential_token_utests.c
 create mode 100644 src/security/builtin_plugins/tests/process_handshake/etc/trusted_ca_dir/identity_ca
 create mode 100644 src/security/builtin_plugins/tests/process_handshake/etc/trusted_ca_dir/remote_identity_ca.crt
 create mode 100644 src/security/builtin_plugins/tests/process_handshake/etc/trusted_ca_dir/root_CA_RSA.crt
 create mode 100644 src/security/builtin_plugins/tests/process_handshake/etc/trusted_ca_dir_not_matching/not_matching_trusted_ca.crt
 create mode 100644 src/security/builtin_plugins/tests/process_handshake/src/process_handshake_utests.c
 create mode 100644 src/security/builtin_plugins/tests/validate_begin_handshake_reply/etc/trusted_ca_dir/identity_ca
 create mode 100644 src/security/builtin_plugins/tests/validate_begin_handshake_reply/etc/trusted_ca_dir/remote_ca.crt
 create mode 100644 src/security/builtin_plugins/tests/validate_begin_handshake_reply/etc/trusted_ca_dir/root_CA_RSA.crt
 create mode 100644 src/security/builtin_plugins/tests/validate_begin_handshake_reply/src/validate_begin_handshake_reply_utests.c
 create mode 100644 src/security/builtin_plugins/tests/validate_begin_handshake_request/src/validate_begin_handshake_request_utests.c
 create mode 100644 src/security/builtin_plugins/tests/validate_local_identity/etc/Alice_Test_2.crt
 create mode 100644 src/security/builtin_plugins/tests/validate_local_identity/etc/Bob_Chain_Test.crt
 create mode 100644 src/security/builtin_plugins/tests/validate_local_identity/etc/Identity_CA_Test2.crt
 create mode 100644 src/security/builtin_plugins/tests/validate_local_identity/etc/Identity_CA_Test_With_Chain.crt
 create mode 100644 src/security/builtin_plugins/tests/validate_local_identity/etc/alice.pem
 create mode 100644 src/security/builtin_plugins/tests/validate_local_identity/etc/bob.pem
 create mode 100644 src/security/builtin_plugins/tests/validate_local_identity/etc/ec_identity_ca
 create mode 100644 src/security/builtin_plugins/tests/validate_local_identity/etc/ec_identity_certificate
 create mode 100644 src/security/builtin_plugins/tests/validate_local_identity/etc/ec_identity_certificate_unsupported
 create mode 100644 src/security/builtin_plugins/tests/validate_local_identity/etc/ec_private_key
 create mode 100644 src/security/builtin_plugins/tests/validate_local_identity/etc/ec_private_key_unsupported
 create mode 100644 src/security/builtin_plugins/tests/validate_local_identity/etc/ec_private_key_w_password
 create mode 100644 src/security/builtin_plugins/tests/validate_local_identity/etc/identity_ca
 create mode 100644 src/security/builtin_plugins/tests/validate_local_identity/etc/identity_ca_private_key
 create mode 100644 src/security/builtin_plugins/tests/validate_local_identity/etc/identity_certificate
 create mode 100644 src/security/builtin_plugins/tests/validate_local_identity/etc/identity_certificate_1024key
 create mode 100644 src/security/builtin_plugins/tests/validate_local_identity/etc/invalid_identity_ca
 create mode 100644 src/security/builtin_plugins/tests/validate_local_identity/etc/invalid_identity_certificate
 create mode 100644 src/security/builtin_plugins/tests/validate_local_identity/etc/invalid_private_key
 create mode 100644 src/security/builtin_plugins/tests/validate_local_identity/etc/new/CHAM-577.crt
 create mode 100644 src/security/builtin_plugins/tests/validate_local_identity/etc/new/identity_ca
 create mode 100644 src/security/builtin_plugins/tests/validate_local_identity/etc/new/identity_ca_private_key
 create mode 100644 src/security/builtin_plugins/tests/validate_local_identity/etc/new/identity_certificate
 create mode 100644 src/security/builtin_plugins/tests/validate_local_identity/etc/new/private_key
 create mode 100644 src/security/builtin_plugins/tests/validate_local_identity/etc/old/Alice_Test_2.crt
 create mode 100644 src/security/builtin_plugins/tests/validate_local_identity/etc/old/Bob_Chain_Test.crt
 create mode 100644 src/security/builtin_plugins/tests/validate_local_identity/etc/old/Identity_CA_Test2.crt
 create mode 100644 src/security/builtin_plugins/tests/validate_local_identity/etc/old/Identity_CA_Test_With_Chain.crt
 create mode 100644 src/security/builtin_plugins/tests/validate_local_identity/etc/old/alice.pem
 create mode 100644 src/security/builtin_plugins/tests/validate_local_identity/etc/old/bob.pem
 create mode 100644 src/security/builtin_plugins/tests/validate_local_identity/etc/old/ec_identity_ca
 create mode 100644 src/security/builtin_plugins/tests/validate_local_identity/etc/old/ec_identity_certificate
 create mode 100644 src/security/builtin_plugins/tests/validate_local_identity/etc/old/ec_identity_certificate_unsupported
 create mode 100644 src/security/builtin_plugins/tests/validate_local_identity/etc/old/ec_private_key
 create mode 100644 src/security/builtin_plugins/tests/validate_local_identity/etc/old/ec_private_key_unsupported
 create mode 100644 src/security/builtin_plugins/tests/validate_local_identity/etc/old/ec_private_key_w_password
 create mode 100644 src/security/builtin_plugins/tests/validate_local_identity/etc/old/identity_ca
 create mode 100644 src/security/builtin_plugins/tests/validate_local_identity/etc/old/identity_certificate
 create mode 100644 src/security/builtin_plugins/tests/validate_local_identity/etc/old/identity_certificate_1024key
 create mode 100644 src/security/builtin_plugins/tests/validate_local_identity/etc/old/invalid_identity_ca
 create mode 100644 src/security/builtin_plugins/tests/validate_local_identity/etc/old/invalid_identity_certificate
 create mode 100644 src/security/builtin_plugins/tests/validate_local_identity/etc/old/invalid_private_key
 create mode 100644 src/security/builtin_plugins/tests/validate_local_identity/etc/old/private_key
 create mode 100644 src/security/builtin_plugins/tests/validate_local_identity/etc/old/private_key_1024
 create mode 100644 src/security/builtin_plugins/tests/validate_local_identity/etc/old/private_key_not_matching
 create mode 100644 src/security/builtin_plugins/tests/validate_local_identity/etc/old/private_key_w_password
 create mode 100644 src/security/builtin_plugins/tests/validate_local_identity/etc/old/remote
 create mode 100644 src/security/builtin_plugins/tests/validate_local_identity/etc/old/unrelated_identity_ca
 create mode 100644 src/security/builtin_plugins/tests/validate_local_identity/etc/private_key
 create mode 100644 src/security/builtin_plugins/tests/validate_local_identity/etc/private_key_1024
 create mode 100644 src/security/builtin_plugins/tests/validate_local_identity/etc/private_key_not_matching
 create mode 100644 src/security/builtin_plugins/tests/validate_local_identity/etc/private_key_w_password
 create mode 100644 src/security/builtin_plugins/tests/validate_local_identity/etc/trusted_ca_dir/identity_ca
 create mode 100644 src/security/builtin_plugins/tests/validate_local_identity/etc/trusted_ca_dir/root_CA_RSA.crt
 create mode 100644 src/security/builtin_plugins/tests/validate_local_identity/etc/trusted_ca_dir_not_matching/not_matching_trusted_ca.crt
 create mode 100644 src/security/builtin_plugins/tests/validate_local_identity/etc/unrelated_identity_ca
 create mode 100644 src/security/builtin_plugins/tests/validate_local_identity/src/ca.crt
 create mode 100644 src/security/builtin_plugins/tests/validate_local_identity/src/id.crt
 create mode 100644 src/security/builtin_plugins/tests/validate_local_identity/src/priv.pem
 create mode 100644 src/security/builtin_plugins/tests/validate_local_identity/src/remote
 create mode 100644 src/security/builtin_plugins/tests/validate_local_identity/src/unrelated_identity_ca
 create mode 100644 src/security/builtin_plugins/tests/validate_local_identity/src/validate_local_identity_utests.c
 create mode 100644 src/security/builtin_plugins/tests/validate_remote_identity/src/validate_remote_identity_utests.c
 create mode 100644 src/security/core/CMakeLists.txt
 create mode 100644 src/security/core/include/dds/security/core/dds_security_serialize.h
 create mode 100644 src/security/core/include/dds/security/core/dds_security_types.h
 create mode 100644 src/security/core/include/dds/security/core/dds_security_utils.h
 create mode 100644 src/security/core/include/dds/security/core/shared_secret.h
 create mode 100644 src/security/core/src/dds_security_serialize.c
 create mode 100644 src/security/core/src/dds_security_utils.c
 create mode 100644 src/security/core/src/shared_secret.c

diff --git a/cmake/Modules/CUnit.cmake b/cmake/Modules/CUnit.cmake
index ac63690..1f118b6 100644
--- a/cmake/Modules/CUnit.cmake
+++ b/cmake/Modules/CUnit.cmake
@@ -281,12 +281,17 @@ function(add_cunit_executable TARGET)
           set_property(
             TEST ${ctest}
             PROPERTY ENVIRONMENT
-              "DYLD_LIBRARY_PATH=${CUNIT_LIBRARY_DIR}:$ENV{DYLD_LIBRARY_PATH}")
+              "DYLD_LIBRARY_PATH=${CUNIT_LIBRARY_DIR}:${CMAKE_LIBRARY_OUTPUT_DIRECTORY}:$ENV{DYLD_LIBRARY_PATH}")
         elseif(WIN32 AND ${CUNIT_LIBRARY_TYPE} STREQUAL "SHARED_LIBRARY")
           set_property(
             TEST ${ctest}
             PROPERTY ENVIRONMENT
               "PATH=${CUNIT_LIBRARY_DIR};$ENV{PATH}")
+        else()
+          set_property(
+            TEST ${ctest}
+            PROPERTY ENVIRONMENT
+              "LD_LIBRARY_PATH=${CMAKE_LIBRARY_OUTPUT_DIRECTORY}:$ENV{LD_LIBRARY_PATH}")
         endif()
       endforeach()
 
diff --git a/src/CMakeLists.txt b/src/CMakeLists.txt
index 16179d9..c72721e 100644
--- a/src/CMakeLists.txt
+++ b/src/CMakeLists.txt
@@ -23,7 +23,7 @@ add_subdirectory(ddsrt)
 if(BUILD_IDLC)
   add_subdirectory(idlc)
 endif()
-add_subdirectory(security/api)
+add_subdirectory(security)
 add_subdirectory(core)
 add_subdirectory(tools)
 if(BUILD_TESTING AND HAVE_MULTI_PROCESS AND BUILD_IDLC)
diff --git a/src/core/CMakeLists.txt b/src/core/CMakeLists.txt
index e83acdc..6eb9b91 100644
--- a/src/core/CMakeLists.txt
+++ b/src/core/CMakeLists.txt
@@ -59,7 +59,7 @@ if(NOT ENABLE_SECURITY)
   message(STATUS "Building without OMG DDS Security support")
 else()
   add_definitions(-DDDSI_INCLUDE_SECURITY)
-  target_link_libraries(ddsc PRIVATE security_api)
+  target_link_libraries(ddsc PRIVATE security_core)
   target_include_directories(
     ddsc PUBLIC
     $<BUILD_INTERFACE:$<TARGET_PROPERTY:security_api,INTERFACE_INCLUDE_DIRECTORIES>>)
diff --git a/src/ddsrt/include/dds/ddsrt/time.h b/src/ddsrt/include/dds/ddsrt/time.h
index a474fb4..fb22669 100644
--- a/src/ddsrt/include/dds/ddsrt/time.h
+++ b/src/ddsrt/include/dds/ddsrt/time.h
@@ -59,6 +59,9 @@ typedef int64_t dds_duration_t;
 /** @name Infinite timeout for relative time */
 #define DDS_INFINITY ((dds_duration_t) INT64_MAX)
 
+/** @name Invalid time value for assigning to time output when something goes wrong */
+#define DDS_TIME_INVALID ((dds_time_t) INT64_MIN)
+
 /** @name Macro definition for time conversion to nanoseconds
   @{**/
 #define DDS_SECS(n) ((n) * DDS_NSECS_IN_SEC)
diff --git a/src/ddsrt/src/dynlib/posix/dynlib.c b/src/ddsrt/src/dynlib/posix/dynlib.c
index ec97397..4ee6bb7 100644
--- a/src/ddsrt/src/dynlib/posix/dynlib.c
+++ b/src/ddsrt/src/dynlib/posix/dynlib.c
@@ -18,78 +18,78 @@
 #include "dds/ddsrt/io.h"
 
 dds_return_t ddsrt_dlopen(const char *name, bool translate,
-		ddsrt_dynlib_t *handle) {
-	dds_return_t retcode = DDS_RETCODE_OK;
+    ddsrt_dynlib_t *handle) {
+  dds_return_t retcode = DDS_RETCODE_OK;
 
-	assert( handle );
-	*handle = NULL;
+  assert( handle );
+  *handle = NULL;
 
-	if ((translate) && (strrchr(name, '/') == NULL )) {
-		/* Add lib and suffix to the name and try to open. */
+  if ((translate) && (strrchr(name, '/') == NULL )) {
+    /* Add lib and suffix to the name and try to open. */
 #if __APPLE__
-		static const char suffix[] = ".dylib";
+    static const char suffix[] = ".dylib";
 #else
-		static const char suffix[] = ".so";
+    static const char suffix[] = ".so";
 #endif
-		char* libName;
-		ddsrt_asprintf( &libName, "lib%s%s", name, suffix);
-		*handle = dlopen(libName, RTLD_GLOBAL | RTLD_NOW);
-		ddsrt_free(libName);
-	}
+    char* libName;
+    ddsrt_asprintf( &libName, "lib%s%s", name, suffix);
+    *handle = dlopen(libName, RTLD_GLOBAL | RTLD_NOW);
+    ddsrt_free(libName);
+  }
 
-	if (*handle == NULL ) {
-		/* name contains a path,
-		 * (auto)translate is disabled or
-		 * dlopen on translated name failed. */
-		*handle = dlopen(name, RTLD_GLOBAL | RTLD_NOW);
-	}
+  if (*handle == NULL ) {
+    /* name contains a path,
+     * (auto)translate is disabled or
+     * dlopen on translated name failed. */
+    *handle = dlopen(name, RTLD_GLOBAL | RTLD_NOW);
+  }
 
-	if (*handle != NULL) {
-		retcode = DDS_RETCODE_OK;
-	} else {
-		retcode = DDS_RETCODE_ERROR;
-	}
+  if (*handle != NULL) {
+    retcode = DDS_RETCODE_OK;
+  } else {
+    retcode = DDS_RETCODE_ERROR;
+  }
 
-	return retcode;
+  return retcode;
 }
 
 dds_return_t ddsrt_dlclose(ddsrt_dynlib_t handle) {
 
-	assert ( handle );
-	return (dlclose(handle) == 0) ? DDS_RETCODE_OK : DDS_RETCODE_ERROR;
+  assert ( handle );
+  return (dlclose(handle) == 0) ? DDS_RETCODE_OK : DDS_RETCODE_ERROR;
 
 }
 
 dds_return_t ddsrt_dlsym(ddsrt_dynlib_t handle, const char *symbol,
-		void **address) {
-	dds_return_t retcode = DDS_RETCODE_OK;
+    void **address) {
+  dds_return_t retcode = DDS_RETCODE_OK;
 
-	assert( handle );
-	assert( address );
-	assert( symbol );
+  assert( handle );
+  assert( address );
+  assert( symbol );
 
-	*address = dlsym(handle, symbol);
-	if (*address == NULL) {
-		retcode = DDS_RETCODE_ERROR;
-	}
+  *address = dlsym(handle, symbol);
+  if (*address == NULL) {
+    retcode = DDS_RETCODE_ERROR;
+  }
 
-	return retcode;
+  return retcode;
 }
 
 dds_return_t ddsrt_dlerror(char *buf, size_t buflen) {
 
-	const char *err;
-	dds_return_t retcode = DDS_RETCODE_OK;
+  const char *err;
+  dds_return_t retcode = DDS_RETCODE_OK;
 
-	assert (buf );
+  assert (buf );
 
-	err = dlerror();
-	if (err == NULL) {
-		retcode = DDS_RETCODE_NOT_FOUND;
-	} else {
-		snprintf(buf, buflen, "%s", err);
-	}
+  err = dlerror();
+  if (err == NULL) {
+    retcode = DDS_RETCODE_NOT_FOUND;
+  } else {
+    snprintf(buf, buflen, "%s", err);
+  }
 
-	return retcode;
+  return retcode;
 }
 
diff --git a/src/ddsrt/src/dynlib/windows/dynlib.c b/src/ddsrt/src/dynlib/windows/dynlib.c
index 9a8eb46..7b48240 100644
--- a/src/ddsrt/src/dynlib/windows/dynlib.c
+++ b/src/ddsrt/src/dynlib/windows/dynlib.c
@@ -86,7 +86,8 @@ dds_return_t ddsrt_dlerror(char *buf, size_t buflen) {
     if ( err == 0 ) {
         retcode = DDS_RETCODE_NOT_FOUND;
     } else {
-        retcode = ddsrt_strerror_r(err, buf, buflen);
+        ddsrt_strerror_r(err, buf, buflen);
+        SetLastError(0);
     }
 
     return retcode;
diff --git a/src/security/CMakeLists.txt b/src/security/CMakeLists.txt
new file mode 100644
index 0000000..2d67ac3
--- /dev/null
+++ b/src/security/CMakeLists.txt
@@ -0,0 +1,21 @@
+#
+# Copyright(c) 2006 to 2019 ADLINK Technology Limited and others
+#
+# This program and the accompanying materials are made available under the
+# terms of the Eclipse Public License v. 2.0 which is available at
+# http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+# v. 1.0 which is available at
+# http://www.eclipse.org/org/documents/edl-v10.php.
+#
+# SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+#
+cmake_minimum_required(VERSION 3.7)
+
+if( ENABLE_SECURITY )
+    add_subdirectory(api)
+    add_subdirectory(core)
+
+  if ( ENABLE_SSL)
+    add_subdirectory(builtin_plugins)
+  endif()
+endif()
\ No newline at end of file
diff --git a/src/security/api/CMakeLists.txt b/src/security/api/CMakeLists.txt
index 63caf64..02586c6 100644
--- a/src/security/api/CMakeLists.txt
+++ b/src/security/api/CMakeLists.txt
@@ -1,5 +1,5 @@
 #
-# Copyright(c) 2006 to 2018 ADLINK Technology Limited and others
+# Copyright(c) 2006 to 2019 ADLINK Technology Limited and others
 #
 # This program and the accompanying materials are made available under the
 # terms of the Eclipse Public License v. 2.0 which is available at
@@ -15,7 +15,9 @@ add_library(security_api INTERFACE)
 
 target_include_directories(
   security_api INTERFACE
-    "$<BUILD_INTERFACE:${CMAKE_CURRENT_SOURCE_DIR}/include>")
+    "$<BUILD_INTERFACE:${CMAKE_CURRENT_SOURCE_DIR}/include>"
+    "$<BUILD_INTERFACE:${CMAKE_CURRENT_BINARY_DIR}/include>"
+)
 
 install(
   DIRECTORY "${CMAKE_CURRENT_LIST_DIR}/include/"
diff --git a/src/security/api/include/dds/security/dds_security_api.h b/src/security/api/include/dds/security/dds_security_api.h
index 1304201..ba29184 100644
--- a/src/security/api/include/dds/security/dds_security_api.h
+++ b/src/security/api/include/dds/security/dds_security_api.h
@@ -1,5 +1,5 @@
 /*
- * Copyright(c) 2006 to 2018 ADLINK Technology Limited and others
+ * Copyright(c) 2006 to 2019 ADLINK Technology Limited and others
  *
  * This program and the accompanying materials are made available under the
  * terms of the Eclipse Public License v. 2.0 which is available at
diff --git a/src/security/api/include/dds/security/dds_security_api_access_control.h b/src/security/api/include/dds/security/dds_security_api_access_control.h
index 00ca926..8b908b5 100644
--- a/src/security/api/include/dds/security/dds_security_api_access_control.h
+++ b/src/security/api/include/dds/security/dds_security_api_access_control.h
@@ -1,5 +1,5 @@
 /*
- * Copyright(c) 2006 to 2018 ADLINK Technology Limited and others
+ * Copyright(c) 2006 to 2019 ADLINK Technology Limited and others
  *
  * This program and the accompanying materials are made available under the
  * terms of the Eclipse Public License v. 2.0 which is available at
diff --git a/src/security/api/include/dds/security/dds_security_api_authentication.h b/src/security/api/include/dds/security/dds_security_api_authentication.h
index ebcfa15..4913985 100644
--- a/src/security/api/include/dds/security/dds_security_api_authentication.h
+++ b/src/security/api/include/dds/security/dds_security_api_authentication.h
@@ -1,5 +1,5 @@
 /*
- * Copyright(c) 2006 to 2018 ADLINK Technology Limited and others
+ * Copyright(c) 2006 to 2019 ADLINK Technology Limited and others
  *
  * This program and the accompanying materials are made available under the
  * terms of the Eclipse Public License v. 2.0 which is available at
diff --git a/src/security/api/include/dds/security/dds_security_api_cryptography.h b/src/security/api/include/dds/security/dds_security_api_cryptography.h
index f082477..5203d3d 100644
--- a/src/security/api/include/dds/security/dds_security_api_cryptography.h
+++ b/src/security/api/include/dds/security/dds_security_api_cryptography.h
@@ -1,5 +1,5 @@
 /*
- * Copyright(c) 2006 to 2018 ADLINK Technology Limited and others
+ * Copyright(c) 2006 to 2019 ADLINK Technology Limited and others
  *
  * This program and the accompanying materials are made available under the
  * terms of the Eclipse Public License v. 2.0 which is available at
diff --git a/src/security/api/include/dds/security/dds_security_api_defs.h b/src/security/api/include/dds/security/dds_security_api_defs.h
index 82baa98..a0e6739 100644
--- a/src/security/api/include/dds/security/dds_security_api_defs.h
+++ b/src/security/api/include/dds/security/dds_security_api_defs.h
@@ -1,5 +1,5 @@
 /*
- * Copyright(c) 2006 to 2018 ADLINK Technology Limited and others
+ * Copyright(c) 2006 to 2019 ADLINK Technology Limited and others
  *
  * This program and the accompanying materials are made available under the
  * terms of the Eclipse Public License v. 2.0 which is available at
diff --git a/src/security/api/include/dds/security/dds_security_api_err.h b/src/security/api/include/dds/security/dds_security_api_err.h
index 8795a44..f4e8904 100644
--- a/src/security/api/include/dds/security/dds_security_api_err.h
+++ b/src/security/api/include/dds/security/dds_security_api_err.h
@@ -1,5 +1,5 @@
 /*
- * Copyright(c) 2006 to 2018 ADLINK Technology Limited and others
+ * Copyright(c) 2006 to 2019 ADLINK Technology Limited and others
  *
  * This program and the accompanying materials are made available under the
  * terms of the Eclipse Public License v. 2.0 which is available at
@@ -47,13 +47,13 @@ extern "C" {
 #define DDS_SECURITY_ERR_INVALID_TRUSTED_CA_DIR_MESSAGE "Can not open trusted CA directory"
 #define DDS_SECURITY_ERR_CA_NOT_TRUSTED_CODE 121
 #define DDS_SECURITY_ERR_CA_NOT_TRUSTED_MESSAGE "Identity CA is not trusted"
-#define DDS_SECURITY_ERR_CERT_STARTDATE_INVALID_CODE 122
-#define DDS_SECURITY_ERR_CERT_STARTDATE_INVALID_MESSAGE "Certificate start date is in the future"
+#define DDS_SECURITY_ERR_CERT_STARTDATE_IN_FUTURE_CODE 122
+#define DDS_SECURITY_ERR_CERT_STARTDATE_IN_FUTURE_MESSAGE "Certificate start date is in the future"
 #define DDS_SECURITY_ERR_CERT_EXPIRED_CODE 123
 #define DDS_SECURITY_ERR_CERT_EXPIRED_MESSAGE "Certificate expired"
 #define DDS_SECURITY_ERR_INVALID_CRYPTO_RECEIVER_SIGN_CODE 124
-#define DDS_SECURITY_ERR_CERT_AUTHENTICATION_ALGO_KIND_UNKNOWN_CODE 125
-#define DDS_SECURITY_ERR_CERT_AUTHENTICATION_ALGO_KIND_UNKNOWN_MESSAGE "Certificate authentication algorithm unknown"
+#define DDS_SECURITY_ERR_CERT_AUTH_ALGO_KIND_UNKNOWN_CODE 125
+#define DDS_SECURITY_ERR_CERT_AUTH_ALGO_KIND_UNKNOWN_MESSAGE "Certificate authentication algorithm unknown"
 #define DDS_SECURITY_ERR_ALLOCATION_FAILED_CODE 126
 #define DDS_SECURITY_ERR_ALLOCATION_FAILED_MESSAGE "Failed to allocate internal structure"
 #define DDS_SECURITY_ERR_INVALID_SMIME_DOCUMENT_CODE 127
diff --git a/src/security/api/include/dds/security/dds_security_api_types.h b/src/security/api/include/dds/security/dds_security_api_types.h
index 4e669b4..2957251 100644
--- a/src/security/api/include/dds/security/dds_security_api_types.h
+++ b/src/security/api/include/dds/security/dds_security_api_types.h
@@ -1,5 +1,5 @@
 /*
- * Copyright(c) 2006 to 2018 ADLINK Technology Limited and others
+ * Copyright(c) 2006 to 2019 ADLINK Technology Limited and others
  *
  * This program and the accompanying materials are made available under the
  * terms of the Eclipse Public License v. 2.0 which is available at
@@ -20,8 +20,6 @@
 extern "C" {
 #endif
 
-
-
 /**************************************************************************
  *                                                                        *
  * Primitive types.                                                       *
diff --git a/src/security/builtin_plugins/CMakeLists.txt b/src/security/builtin_plugins/CMakeLists.txt
new file mode 100644
index 0000000..69e5aed
--- /dev/null
+++ b/src/security/builtin_plugins/CMakeLists.txt
@@ -0,0 +1,19 @@
+#
+# Copyright(c) 2006 to 2019 ADLINK Technology Limited and others
+#
+# This program and the accompanying materials are made available under the
+# terms of the Eclipse Public License v. 2.0 which is available at
+# http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+# v. 1.0 which is available at
+# http://www.eclipse.org/org/documents/edl-v10.php.
+#
+# SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+#
+cmake_minimum_required(VERSION 3.7)
+
+add_subdirectory("${CMAKE_CURRENT_LIST_DIR}/authentication")
+
+# TODO: improve test inclusion.
+if((BUILD_TESTING) AND ((NOT DEFINED MSVC_VERSION) OR (MSVC_VERSION GREATER "1800")))
+  add_subdirectory("${CMAKE_CURRENT_LIST_DIR}/tests")
+endif()
\ No newline at end of file
diff --git a/src/security/builtin_plugins/authentication/CMakeLists.txt b/src/security/builtin_plugins/authentication/CMakeLists.txt
new file mode 100644
index 0000000..f5f46a4
--- /dev/null
+++ b/src/security/builtin_plugins/authentication/CMakeLists.txt
@@ -0,0 +1,65 @@
+#
+# Copyright(c) 2006 to 2019 ADLINK Technology Limited and others
+#
+# This program and the accompanying materials are made available under the
+# terms of the Eclipse Public License v. 2.0 which is available at
+# http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+# v. 1.0 which is available at
+# http://www.eclipse.org/org/documents/edl-v10.php.
+#
+# SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+#
+include (GenerateExportHeader)
+
+PREPEND(srcs_authentication "${CMAKE_CURRENT_LIST_DIR}/src"
+    authentication.c
+    auth_utils.c
+)
+ 
+PREPEND(hdrs_private_authentication "${CMAKE_CURRENT_LIST_DIR}/src"
+    auth_defs.h
+    authentication.h
+    auth_utils.h
+    dds_security_core_if.h
+)
+
+add_library(dds_security_auth SHARED "")
+
+generate_export_header(
+        dds_security_auth
+        BASE_NAME SECURITY
+        EXPORT_FILE_NAME "${CMAKE_CURRENT_BINARY_DIR}/include/dds/security/export.h"
+)
+
+
+
+find_package(OpenSSL )
+
+add_definitions(-DDDSI_INCLUDE_SSL)
+
+target_link_libraries(dds_security_auth PUBLIC ddsc)
+target_link_libraries(dds_security_auth PUBLIC OpenSSL::SSL)
+
+target_sources(dds_security_auth
+    PRIVATE
+        ${srcs_authentication}
+
+)
+
+target_include_directories(dds_security_auth
+    PUBLIC
+        "$<BUILD_INTERFACE:$<TARGET_PROPERTY:security_api,INTERFACE_INCLUDE_DIRECTORIES>>"
+        "$<BUILD_INTERFACE:$<TARGET_PROPERTY:security_core,INTERFACE_INCLUDE_DIRECTORIES>>"
+        "$<BUILD_INTERFACE:$<TARGET_PROPERTY:ddsrt,INTERFACE_INCLUDE_DIRECTORIES>>"
+        "$<BUILD_INTERFACE:${CMAKE_CURRENT_BINARY_DIR}/include>"
+)
+
+install(
+  TARGETS 
+  EXPORT "${CMAKE_PROJECT_NAME}"
+  RUNTIME DESTINATION "${CMAKE_INSTALL_BINDIR}" COMPONENT lib
+  LIBRARY DESTINATION "${CMAKE_INSTALL_LIBDIR}" COMPONENT lib
+  ARCHIVE DESTINATION "${CMAKE_INSTALL_LIBDIR}" COMPONENT lib
+)
+
+
diff --git a/src/security/builtin_plugins/authentication/src/auth_utils.c b/src/security/builtin_plugins/authentication/src/auth_utils.c
new file mode 100644
index 0000000..57d5a3a
--- /dev/null
+++ b/src/security/builtin_plugins/authentication/src/auth_utils.c
@@ -0,0 +1,1379 @@
+/*
+ * Copyright(c) 2006 to 2019 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+
+#include <openssl/bn.h>
+#include <openssl/asn1.h>
+#include <openssl/x509.h>
+#include <openssl/x509_vfy.h>
+#include <openssl/pem.h>
+#include <openssl/bio.h>
+#include <openssl/err.h>
+#include <openssl/evp.h>
+#if OPENSSL_VERSION_NUMBER >= 0x1000200fL
+#define AUTH_INCLUDE_EC
+#include <openssl/ec.h>
+#if OPENSSL_VERSION_NUMBER >= 0x10100000L
+#define AUTH_INCLUDE_DH_ACCESSORS
+#endif
+#else
+#error "OpenSSL version is not supported"
+#endif
+#include <openssl/rand.h>
+#include "dds/ddsrt/time.h"
+#include "dds/ddsrt/heap.h"
+#include "dds/security/dds_security_api_defs.h"
+#include "dds/security/core/dds_security_utils.h"
+#include <assert.h>
+
+
+/* There is a problem when compiling on windows w.r.t. X509_NAME.
+ * The windows api already defines the type X509_NAME which
+ * conficts with some openssl versions. The workaround is to
+ * undef the openssl X509_NAME
+ */
+#ifdef _WIN32
+#undef X509_NAME
+#endif
+
+#include "dds/ddsrt/heap.h"
+#include "dds/ddsrt/atomics.h"
+#include "dds/ddsrt/string.h"
+#include "dds/security/core/dds_security_utils.h"
+#include <string.h>
+#include "auth_utils.h"
+
+
+#define MAX_TRUSTED_CA 100
+
+char *
+get_openssl_error_message(
+        void)
+{
+    BIO *bio = BIO_new(BIO_s_mem());
+    char *msg;
+    char *buf = NULL;
+    size_t len; /*BIO_get_mem_data requires long int */
+
+    if (bio) {
+        ERR_print_errors(bio);
+        len = (size_t)BIO_get_mem_data (bio, &buf);
+        msg = ddsrt_malloc(len + 1);
+        memcpy(msg, buf, len);
+        msg[len] = '\0';
+        BIO_free(bio);
+    } else {
+        msg = ddsrt_strdup("BIO_new failed");
+    }
+
+    return msg;
+}
+
+char *
+get_certificate_subject_name(
+        const X509 *cert,
+        DDS_Security_SecurityException *ex)
+{
+    X509_NAME *name;
+    char *subject = NULL;
+    char *subject_openssl = NULL;
+
+    assert(cert);
+
+    name = X509_get_subject_name(cert);
+    if (!name) {
+        goto err_get_subject;
+    }
+    
+    subject_openssl = X509_NAME_oneline( name, NULL, 0 );
+    subject = ddsrt_strdup( subject_openssl );
+    OPENSSL_free( subject_openssl );
+
+    return subject;
+
+err_get_subject:
+    DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "X509_get_subject_name failed : ");
+    return NULL;
+}
+
+dds_time_t
+get_certificate_expiry(
+    const X509 *cert)
+{
+    dds_time_t expiry = DDS_TIME_INVALID;
+    ASN1_TIME *asn1;
+
+    assert(cert);
+
+    asn1 = X509_get_notAfter(cert);
+    if (asn1 != NULL) {
+        int days;
+        int seconds;
+        if (ASN1_TIME_diff(&days, &seconds, NULL, asn1) == 1 ) {
+            static const dds_duration_t secs_in_day = 86400;
+            const dds_time_t now = dds_time();
+            const int64_t max_valid_days_to_wait = (INT64_MAX - now) / DDS_NSECS_IN_SEC / secs_in_day;
+
+            if ( days < max_valid_days_to_wait ){
+                dds_duration_t delta = ((dds_duration_t)seconds + ((dds_duration_t)days * secs_in_day)) * DDS_NSECS_IN_SEC;
+                expiry = now + delta;
+            } else {
+                return DDS_NEVER;
+            }
+        }
+    }
+
+    return expiry;
+}
+
+DDS_Security_ValidationResult_t
+get_subject_name_DER_encoded(
+        const X509 *cert,
+        unsigned char **buffer,
+        size_t *size,
+        DDS_Security_SecurityException *ex)
+{
+    unsigned char *tmp = NULL;
+    DDS_Security_ValidationResult_t result = DDS_SECURITY_VALIDATION_FAILED;
+    int32_t sz;
+    X509_NAME *name;
+
+    assert(cert);
+    assert(buffer);
+    assert(size);
+
+    *size = 0;
+
+    name = X509_get_subject_name((X509 *)cert);
+    if (name) {
+        sz = i2d_X509_NAME(name, &tmp);
+        if (sz > 0) {
+            *size = (size_t)sz;
+            *buffer = ddsrt_malloc(*size);
+            memcpy(*buffer, tmp, *size);
+            OPENSSL_free(tmp);
+            result = DDS_SECURITY_VALIDATION_OK;
+        } else if (sz < 0) {
+            DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "i2d_X509_NAME failed : ");
+        }
+    } else {
+        DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "X509_get_subject_name failed : ");
+    }
+
+    return result;
+}
+
+
+static DDS_Security_ValidationResult_t
+check_key_type_and_size(
+    EVP_PKEY *key,
+    int isPrivate,
+    DDS_Security_SecurityException *ex)
+{
+    DDS_Security_ValidationResult_t result = DDS_SECURITY_VALIDATION_OK;
+    const char *sub = isPrivate ? "private key" : "certificate";
+
+    assert(key);
+
+    switch (EVP_PKEY_id(key)) {
+    case EVP_PKEY_RSA:
+        if (EVP_PKEY_bits(key) != 2048) {
+            result = DDS_SECURITY_VALIDATION_FAILED;
+            DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result, "RSA %s has unsupported key size (%d)", sub, EVP_PKEY_bits(key));
+        } else if (isPrivate) {
+            RSA *rsaKey = EVP_PKEY_get1_RSA(key);
+            if (rsaKey) {
+                if (RSA_check_key(rsaKey) != 1) {
+                    result = DDS_SECURITY_VALIDATION_FAILED;
+                    DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result, "RSA key not correct : ");
+                }
+            }
+            RSA_free(rsaKey);
+        }
+        break;
+    case EVP_PKEY_EC:
+        if (EVP_PKEY_bits(key) != 256) {
+            result = DDS_SECURITY_VALIDATION_FAILED;
+            DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result, "EC %s has unsupported key size (%d)", sub, EVP_PKEY_bits(key));
+        } else {
+            EC_KEY *ecKey = EVP_PKEY_get1_EC_KEY(key);
+            if (ecKey) {
+                if (EC_KEY_check_key(ecKey) != 1) {
+                    result = DDS_SECURITY_VALIDATION_FAILED;
+                    DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result, "EC key not correct : ");
+                }
+            }
+            EC_KEY_free(ecKey);
+        }
+        break;
+    default:
+        result = DDS_SECURITY_VALIDATION_FAILED;
+        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result, "%s has not supported type", sub);
+        break;
+    }
+
+    return result;
+}
+
+static DDS_Security_ValidationResult_t
+check_certificate_type_and_size(
+    X509 *cert,
+    DDS_Security_SecurityException *ex)
+{
+    EVP_PKEY *pkey;
+    DDS_Security_ValidationResult_t result = DDS_SECURITY_VALIDATION_OK;
+
+    assert(cert);
+
+    pkey = X509_get_pubkey(cert);
+    if (pkey) {
+        result = check_key_type_and_size(pkey, false, ex);
+    } else {
+        result = DDS_SECURITY_VALIDATION_FAILED;
+        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result, "X509_get_pubkey failed");
+    }
+    EVP_PKEY_free(pkey);
+
+    return result;
+}
+
+DDS_Security_ValidationResult_t
+check_certificate_expiry(
+    const X509 *cert,
+    DDS_Security_SecurityException *ex)
+{
+    DDS_Security_ValidationResult_t result = DDS_SECURITY_VALIDATION_OK;
+
+    assert(cert);
+
+    if( X509_cmp_current_time(X509_get_notBefore( cert )) == 0 ){
+        result = DDS_SECURITY_VALIDATION_FAILED;
+        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_CERT_STARTDATE_IN_FUTURE_CODE, (int)result, DDS_SECURITY_ERR_CERT_STARTDATE_IN_FUTURE_MESSAGE);
+
+    }
+    if( X509_cmp_current_time(X509_get_notAfter( cert )) == 0 ){
+        result = DDS_SECURITY_VALIDATION_FAILED;
+        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_CERT_EXPIRED_CODE, (int)result, DDS_SECURITY_ERR_CERT_EXPIRED_MESSAGE);
+
+    }
+
+    return result;
+}
+
+
+DDS_Security_ValidationResult_t
+load_X509_certificate_from_data(
+        const char *data,
+        int len,
+        X509 **x509Cert,
+        DDS_Security_SecurityException *ex)
+{
+    DDS_Security_ValidationResult_t result = DDS_SECURITY_VALIDATION_OK;
+    BIO *bio;
+
+    assert(data);
+    assert(len >= 0);
+    assert(x509Cert);
+
+    /* load certificate in buffer */
+    bio = BIO_new_mem_buf((void *) data, len);
+    if (!bio) {
+        result = DDS_SECURITY_VALIDATION_FAILED;
+        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result, "BIO_new_mem_buf failed");
+        goto err_bio_alloc;
+    }
+
+    *x509Cert = PEM_read_bio_X509(bio, NULL, NULL, NULL);
+    if (!(*x509Cert)) {
+        result = DDS_SECURITY_VALIDATION_FAILED;
+        DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result, "Failed to parse certificate: ");
+        goto err_cert_read;
+    }
+
+    /* check authentication algorithm */
+    if( get_auhentication_algo_kind( *x509Cert ) == AUTH_ALGO_KIND_UNKNOWN ){
+        result = DDS_SECURITY_VALIDATION_FAILED;
+        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_CERT_AUTH_ALGO_KIND_UNKNOWN_CODE, (int)result,
+                        DDS_SECURITY_ERR_CERT_AUTH_ALGO_KIND_UNKNOWN_MESSAGE);
+		    X509_free(*x509Cert);
+        goto err_cert_read;
+    }
+
+err_cert_read:
+    BIO_free(bio);
+err_bio_alloc:
+    return result;
+}
+
+
+
+DDS_Security_ValidationResult_t
+load_X509_certificate_from_file(
+        const char *filename,
+        X509 **x509Cert,
+        DDS_Security_SecurityException *ex)
+{
+    DDS_Security_ValidationResult_t result = DDS_SECURITY_VALIDATION_OK;
+    FILE *file_ptr;
+
+    assert(filename);
+    assert(x509Cert);
+
+    /*check the file*/
+  DDSRT_WARNING_MSVC_OFF(4996);
+    file_ptr = fopen( filename, "r");
+  DDSRT_WARNING_MSVC_ON(4996);
+
+    if( file_ptr == NULL ){
+        result = DDS_SECURITY_VALIDATION_FAILED;
+        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_FILE_PATH_CODE, (int)result, DDS_SECURITY_ERR_INVALID_FILE_PATH_MESSAGE, filename);
+        goto err_invalid_path;
+    }
+
+    /*load certificate from file*/
+    *x509Cert = PEM_read_X509(file_ptr,NULL,NULL,NULL);
+    if (!(*x509Cert)) {
+        result = DDS_SECURITY_VALIDATION_FAILED;
+        DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result, "Failed to parse certificate: ");
+        goto err_invalid_content;
+    }
+
+    /* check authentication algorithm */
+    if( get_auhentication_algo_kind( *x509Cert ) == AUTH_ALGO_KIND_UNKNOWN ){
+        result = DDS_SECURITY_VALIDATION_FAILED;
+        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_CERT_AUTH_ALGO_KIND_UNKNOWN_CODE, (int)result,
+                        DDS_SECURITY_ERR_CERT_AUTH_ALGO_KIND_UNKNOWN_MESSAGE);
+		    X509_free(*x509Cert);
+        goto err_invalid_content;
+    }
+
+
+err_invalid_content:
+    (void)fclose( file_ptr );
+err_invalid_path:
+
+    return result;
+}
+
+static DDS_Security_ValidationResult_t
+load_private_key_from_data(
+        const char *data,
+        const char *password,
+        EVP_PKEY **privateKey,
+        DDS_Security_SecurityException *ex)
+{
+    DDS_Security_ValidationResult_t result = DDS_SECURITY_VALIDATION_OK;
+    BIO *bio;
+    const char *pw = (password ? password : "");
+
+    assert(data);
+    assert(privateKey);
+
+    /* load certificate in buffer */
+    bio = BIO_new_mem_buf((void *) data, -1);
+    if (!bio) {
+        result = DDS_SECURITY_VALIDATION_FAILED;
+        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result, "BIO_new_mem_buf failed");
+        goto err_bio_alloc;
+    }
+
+    *privateKey = PEM_read_bio_PrivateKey(bio, NULL, NULL, (void *)pw);
+    if (!(*privateKey)) {
+        result = DDS_SECURITY_VALIDATION_FAILED;
+        DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result, "Failed to parse private key: ");
+        goto err_key_read;
+    }
+
+err_key_read:
+    BIO_free(bio);
+err_bio_alloc:
+    return result;
+}
+
+
+static DDS_Security_ValidationResult_t
+load_private_key_from_file(
+        const char *filepath,
+        const char *password,
+        EVP_PKEY **privateKey,
+        DDS_Security_SecurityException *ex)
+{
+    DDS_Security_ValidationResult_t result = DDS_SECURITY_VALIDATION_OK;
+    const char *pw = (password ? password : "");
+    FILE *file_ptr;
+
+    assert(filepath);
+    assert(privateKey);
+
+    /*check the file*/
+  DDSRT_WARNING_MSVC_OFF(4996);
+    file_ptr = fopen( filepath, "r");
+  DDSRT_WARNING_MSVC_ON(4996);
+
+    if( file_ptr == NULL ){
+        result = DDS_SECURITY_VALIDATION_FAILED;
+        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_FILE_PATH_CODE, (int)result, DDS_SECURITY_ERR_INVALID_FILE_PATH_MESSAGE, filepath);
+        goto err_invalid_path;
+    }
+
+    /*load private key from file*/
+    *privateKey = PEM_read_PrivateKey(file_ptr, NULL, NULL, (void *)pw);
+    if (!(*privateKey)) {
+        result = DDS_SECURITY_VALIDATION_FAILED;
+        DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result, "Failed to parse certificate: ");
+        goto err_invalid_content;
+    }
+
+err_invalid_content:
+    (void)fclose( file_ptr );
+err_invalid_path:
+
+    return result;
+}
+
+
+/*
+ * Gets the URI string (as referred in DDS Security spec) and returns the URI type
+ * data: data part of the URI. Typically It contains different format according to URI type.
+ */
+AuthConfItemPrefix_t
+get_conf_item_type(
+        const char *str,
+        char **data)
+{
+    AuthConfItemPrefix_t kind = AUTH_CONF_ITEM_PREFIX_UNKNOWN;
+    const char *AUTH_CONF_FILE_PREFIX    = "file:";
+    const char *AUTH_CONF_DATA_PREFIX   = "data:,";
+    const char *AUTH_CONF_PKCS11_PREFIX = "pkcs11:";
+    size_t AUTH_CONF_FILE_PREFIX_LEN    = strlen(AUTH_CONF_FILE_PREFIX);
+    size_t AUTH_CONF_DATA_PREFIX_LEN   = strlen(AUTH_CONF_DATA_PREFIX);
+    size_t AUTH_CONF_PKCS11_PREFIX_LEN = strlen(AUTH_CONF_PKCS11_PREFIX);
+    char *ptr;
+
+    assert(str);
+    assert(data);
+
+    ptr = ddssec_strchrs(str, " \t", false);
+
+    if (strncmp(ptr, AUTH_CONF_FILE_PREFIX, AUTH_CONF_FILE_PREFIX_LEN) == 0) {
+        const char *DOUBLE_SLASH   = "//";
+        size_t DOUBLE_SLASH_LEN = 2;
+        if (strncmp(&(ptr[AUTH_CONF_FILE_PREFIX_LEN]), DOUBLE_SLASH, DOUBLE_SLASH_LEN) == 0) {
+            *data = ddsrt_strdup(&(ptr[AUTH_CONF_FILE_PREFIX_LEN + DOUBLE_SLASH_LEN]));
+        } else {
+            *data = ddsrt_strdup(&(ptr[AUTH_CONF_FILE_PREFIX_LEN]));
+        }
+        kind = AUTH_CONF_ITEM_PREFIX_FILE;
+    } else if (strncmp(ptr, AUTH_CONF_DATA_PREFIX, AUTH_CONF_DATA_PREFIX_LEN) == 0) {
+        kind = AUTH_CONF_ITEM_PREFIX_DATA;
+        *data = ddsrt_strdup(&(ptr[AUTH_CONF_DATA_PREFIX_LEN]));
+    } else if (strncmp(ptr, AUTH_CONF_PKCS11_PREFIX, AUTH_CONF_PKCS11_PREFIX_LEN) == 0) {
+        kind = AUTH_CONF_ITEM_PREFIX_PKCS11;
+        *data = ddsrt_strdup(&(ptr[AUTH_CONF_PKCS11_PREFIX_LEN]));
+    }
+
+    return kind;
+}
+
+DDS_Security_ValidationResult_t
+load_X509_certificate(
+        const char *data,
+        X509 **x509Cert,
+        DDS_Security_SecurityException *ex)
+{
+    DDS_Security_ValidationResult_t result = DDS_SECURITY_VALIDATION_OK;
+    char *contents = NULL;
+
+    assert(data);
+    assert(x509Cert);
+
+    switch (get_conf_item_type(data, &contents)) {
+    case AUTH_CONF_ITEM_PREFIX_FILE:
+        result = load_X509_certificate_from_file(contents, x509Cert, ex);
+        break;
+    case AUTH_CONF_ITEM_PREFIX_DATA:
+        result = load_X509_certificate_from_data(contents, (int)strlen(contents), x509Cert, ex);
+        break;
+    case AUTH_CONF_ITEM_PREFIX_PKCS11:
+        result = DDS_SECURITY_VALIDATION_FAILED;
+        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result, "Certificate pkcs11 format currently not supported:\n%s", data);
+        break;
+    default:
+        result = DDS_SECURITY_VALIDATION_FAILED;
+        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result, "Specified certificate has wrong format:\n%s", data);
+        break;
+    }
+    ddsrt_free(contents);
+
+    if (result == DDS_SECURITY_VALIDATION_OK) {
+        if ( check_certificate_type_and_size(*x509Cert, ex) != DDS_SECURITY_VALIDATION_OK ||
+             check_certificate_expiry(*x509Cert, ex) != DDS_SECURITY_VALIDATION_OK
+                        ) {
+            result = DDS_SECURITY_VALIDATION_FAILED;
+            X509_free(*x509Cert);
+        }
+    }
+    return result;
+}
+
+DDS_Security_ValidationResult_t
+load_X509_private_key(
+        const char *data,
+        const char *password,
+        EVP_PKEY **privateKey,
+        DDS_Security_SecurityException *ex)
+{
+    DDS_Security_ValidationResult_t result = DDS_SECURITY_VALIDATION_OK;
+    char *contents = NULL;
+
+    assert(data);
+    assert(privateKey);
+
+    switch (get_conf_item_type(data, &contents)) {
+    case AUTH_CONF_ITEM_PREFIX_FILE:
+        result = load_private_key_from_file(contents, password, privateKey, ex);
+        break;
+    case AUTH_CONF_ITEM_PREFIX_DATA:
+        result = load_private_key_from_data(contents, password, privateKey, ex);
+        break;
+    case AUTH_CONF_ITEM_PREFIX_PKCS11:
+        result = DDS_SECURITY_VALIDATION_FAILED;
+        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result, "PrivateKey pkcs11 format currently not supported:\n%s", data);
+        break;
+    default:
+        result = DDS_SECURITY_VALIDATION_FAILED;
+        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result, "Specified PrivateKey has wrong format:\n%s", data);
+        break;
+    }
+    ddsrt_free(contents);
+
+    if (result == DDS_SECURITY_VALIDATION_OK) {
+        if ((result = check_key_type_and_size(*privateKey, true, ex)) != DDS_SECURITY_VALIDATION_OK) {
+            EVP_PKEY_free(*privateKey);
+        }
+    }
+
+    return result;
+}
+
+DDS_Security_ValidationResult_t
+verify_certificate(
+        X509 *identityCert,
+        X509 *identityCa,
+        DDS_Security_SecurityException *ex)
+{
+    DDS_Security_ValidationResult_t result = DDS_SECURITY_VALIDATION_OK;
+    int r;
+    X509_STORE *store;
+    X509_STORE_CTX *ctx;
+
+
+
+    assert(identityCert);
+    assert(identityCa);
+
+    /* Currently only a self signed indentiyCa is supported */
+    /* Verification of against a certificate chain is not yet supported */
+    /* Verification of the certificate expiry using a CRL is not yet supported */
+
+    store = X509_STORE_new();
+
+
+    if (!store) {
+        DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result, "X509_STORE_new failed : ");
+        goto err_store_new;
+    }
+
+    if (X509_STORE_add_cert(store, identityCa) != 1) {
+        DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result, "X509_STORE_add_cert failed : ");
+        goto err_add_cert;
+    }
+
+    ctx = X509_STORE_CTX_new();
+    if (!ctx) {
+         DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result, "X509_STORE_CTX_new failed : ");
+         goto err_ctx_new;
+    }
+
+    if (X509_STORE_CTX_init(ctx, store, identityCert, NULL) != 1) {
+        DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result, "X509_STORE_CTX_init failed : ");
+        goto err_ctx_init;
+    }
+
+    r = X509_verify_cert(ctx);
+    if (r != 1) {
+        const char *msg = X509_verify_cert_error_string(X509_STORE_CTX_get_error(ctx));
+        char *subject = NULL;
+
+        result = DDS_SECURITY_VALIDATION_FAILED;
+        subject = get_certificate_subject_name(identityCert, NULL);
+        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result,
+                "Certificate not valid: error: %s subject: %s", msg, subject ? subject : "not found");
+        ddsrt_free(subject);
+    }
+
+err_ctx_init:
+    X509_STORE_CTX_free(ctx);
+err_ctx_new:
+err_add_cert:
+    X509_STORE_free(store);
+err_store_new:
+    return result;
+}
+
+AuthenticationAlgoKind_t
+get_auhentication_algo_kind(
+        X509 *cert)
+{
+    AuthenticationAlgoKind_t kind = AUTH_ALGO_KIND_UNKNOWN;
+    EVP_PKEY *pkey;
+
+    assert(cert);
+
+    pkey = X509_get_pubkey(cert);
+
+    if (pkey) {
+        switch (EVP_PKEY_id(pkey)) {
+        case EVP_PKEY_RSA:
+             if (EVP_PKEY_bits(pkey) == 2048) {
+                 kind = AUTH_ALGO_KIND_RSA_2048;
+             }
+        break;
+        case EVP_PKEY_EC:
+            if (EVP_PKEY_bits(pkey) == 256) {
+                kind = AUTH_ALGO_KIND_EC_PRIME256V1;
+            }
+            break;
+        default:
+        break;
+        }
+        EVP_PKEY_free(pkey);
+    }
+
+    return kind;
+}
+
+AuthenticationChallenge *
+generate_challenge(
+        DDS_Security_SecurityException *ex)
+{
+    AuthenticationChallenge *result;
+
+    result = ddsrt_malloc(sizeof(*result));
+    if (RAND_bytes(result->value, sizeof(result->value)) < 0 ) {
+
+        DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED,
+                "Failed to generate a 256 bit random number ");
+        ddsrt_free(result);
+        result = NULL;
+    }
+
+    return result;
+}
+
+DDS_Security_ValidationResult_t
+get_certificate_contents(
+        X509 *cert,
+        unsigned char **data,
+        uint32_t *size,
+        DDS_Security_SecurityException *ex)
+{
+    DDS_Security_ValidationResult_t result = DDS_SECURITY_VALIDATION_OK;
+    BIO *bio = NULL;
+    size_t sz;
+    char *ptr;
+
+    if ((bio = BIO_new(BIO_s_mem())) == NULL) {
+        result = DDS_SECURITY_VALIDATION_FAILED;
+        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE,  (int)result, "BIO_new_mem_buf failed");
+    } else if (!PEM_write_bio_X509(bio, cert)) {
+        result = DDS_SECURITY_VALIDATION_FAILED;
+        DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE,  (int)result, "PEM_write_bio_X509 failed: ");
+    } else {
+        sz = (size_t)BIO_get_mem_data(bio, &ptr);
+        *data = ddsrt_malloc(sz +1);
+        memcpy(*data, ptr, sz);
+        (*data)[sz] = '\0';
+        *size = (uint32_t)sz;
+    }
+
+    if (bio) BIO_free(bio);
+
+    return result;
+}
+
+static DDS_Security_ValidationResult_t
+get_rsa_dh_parameters(
+    EVP_PKEY **params,
+    DDS_Security_SecurityException *ex)
+{
+    DDS_Security_ValidationResult_t result = DDS_SECURITY_VALIDATION_OK;
+    DH *dh = NULL;
+
+    *params = NULL;
+
+    if ((*params = EVP_PKEY_new()) == NULL) {
+        result = DDS_SECURITY_VALIDATION_FAILED;
+        DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE,  (int)result,
+                "Failed to allocate DH generation parameters: ");
+    } else if ((dh = DH_get_2048_256()) == NULL) {
+        result = DDS_SECURITY_VALIDATION_FAILED;
+        DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE,  (int)result,
+                "Failed to allocate DH parameter using DH_get_2048_256: ");
+    } else if (EVP_PKEY_set1_DH(*params, dh) <= 0) {
+        result = DDS_SECURITY_VALIDATION_FAILED;
+        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE,  (int)result,
+                "Failed to set DH generation parameters using EVP_PKEY_set1_DH: ");
+        EVP_PKEY_free(*params);
+    }
+
+    if (dh) DH_free(dh);
+
+    return result;
+}
+
+static DDS_Security_ValidationResult_t
+get_ec_dh_parameters(
+    EVP_PKEY **params,
+    DDS_Security_SecurityException *ex)
+{
+    DDS_Security_ValidationResult_t result = DDS_SECURITY_VALIDATION_OK;
+    EVP_PKEY_CTX *pctx = NULL;
+
+    if ((pctx = EVP_PKEY_CTX_new_id(EVP_PKEY_EC, NULL)) == NULL) {
+        result = DDS_SECURITY_VALIDATION_FAILED;
+        DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE,  (int)result,
+                "Failed to allocate DH parameter context: ");
+    } else if (EVP_PKEY_paramgen_init(pctx) <= 0) {
+        result = DDS_SECURITY_VALIDATION_FAILED;
+        DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE,  (int)result,
+                "Failed to initialize DH generation context: ");
+    } else if (EVP_PKEY_CTX_set_ec_paramgen_curve_nid(pctx, NID_X9_62_prime256v1) <= 0) {
+        result = DDS_SECURITY_VALIDATION_FAILED;
+        DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE,  (int)result,
+                "Failed to set DH generation parameter generation method: ");
+    } else if (EVP_PKEY_paramgen(pctx, params) <= 0) {
+        char *msg = get_openssl_error_message();
+        result = DDS_SECURITY_VALIDATION_FAILED;
+        DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE,  (int)result,
+                "Failed to generate DH parameters: ");
+        ddsrt_free(msg);
+    }
+
+    if (pctx) EVP_PKEY_CTX_free(pctx);
+
+    return result;
+}
+
+
+DDS_Security_ValidationResult_t
+generate_dh_keys(
+    EVP_PKEY **dhkey,
+    AuthenticationAlgoKind_t authKind,
+    DDS_Security_SecurityException *ex)
+{
+    DDS_Security_ValidationResult_t result = DDS_SECURITY_VALIDATION_FAILED;
+    EVP_PKEY *params = NULL;
+    EVP_PKEY_CTX *kctx = NULL;
+
+    *dhkey = NULL;
+
+    switch(authKind) {
+    case AUTH_ALGO_KIND_RSA_2048:
+        result = get_rsa_dh_parameters(&params, ex);
+        break;
+    case AUTH_ALGO_KIND_EC_PRIME256V1:
+        result = get_ec_dh_parameters(&params, ex);
+        break;
+    default:
+        assert(0);
+        break;
+    }
+
+    if (result != DDS_SECURITY_VALIDATION_OK) {
+        return result;
+    } else if ((kctx = EVP_PKEY_CTX_new(params, NULL)) == NULL) {
+        result = DDS_SECURITY_VALIDATION_FAILED;
+        DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE,  (int)result,
+                "Failed to allocate DH generation context: ");
+    } else if (EVP_PKEY_keygen_init(kctx) <= 0) {
+        result = DDS_SECURITY_VALIDATION_FAILED;
+        DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE,  (int)result,
+                "Failed to initialize DH generation context: ");
+    } else if (EVP_PKEY_keygen(kctx, dhkey) <= 0) {
+        result = DDS_SECURITY_VALIDATION_FAILED;
+        DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE,  (int)result,
+                "Failed to generate DH key pair: ");
+    }
+
+    if (kctx) EVP_PKEY_CTX_free(kctx);
+    if (params) EVP_PKEY_free(params);
+
+    return result;
+}
+
+static const BIGNUM *
+dh_get_public_key(
+    DH *dhkey)
+{
+#ifdef AUTH_INCLUDE_DH_ACCESSORS
+    const BIGNUM *pubkey, *privkey;
+    DH_get0_key(dhkey, &pubkey, &privkey);
+    return pubkey;
+#else
+    return dhkey->pub_key;
+#endif
+}
+
+static int
+dh_set_public_key(
+    DH *dhkey,
+    BIGNUM *pubkey)
+{
+#ifdef AUTH_INCLUDE_DH_ACCESSORS
+    return DH_set0_key(dhkey, pubkey, NULL);
+#else
+    dhkey->pub_key = pubkey;
+#endif
+    return 1;
+}
+
+static DDS_Security_ValidationResult_t
+dh_public_key_to_oct_modp(
+    EVP_PKEY *pkey,
+    unsigned char **buffer,
+    uint32_t *length,
+    DDS_Security_SecurityException *ex)
+{
+    DDS_Security_ValidationResult_t result = DDS_SECURITY_VALIDATION_OK;
+    DH *dhkey;
+    ASN1_INTEGER *asn1int;
+
+    *buffer = NULL;
+
+    dhkey = EVP_PKEY_get1_DH(pkey);
+    if (!dhkey) {
+        result = DDS_SECURITY_VALIDATION_FAILED;
+        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result, "Failed to get DH key from PKEY: ");
+        goto fail_get_dhkey;
+    }
+
+    asn1int = BN_to_ASN1_INTEGER(dh_get_public_key(dhkey), NULL);
+    if (!asn1int) {
+        result = DDS_SECURITY_VALIDATION_FAILED;
+        DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result, "Failed to convert DH key to ASN1 integer: ");
+        goto fail_get_asn1int;
+    }
+
+    *length = (uint32_t) i2d_ASN1_INTEGER(asn1int, buffer);
+
+    ASN1_INTEGER_free(asn1int);
+
+fail_get_asn1int:
+    DH_free(dhkey);
+fail_get_dhkey:
+    return result;
+}
+
+static DDS_Security_ValidationResult_t
+dh_public_key_to_oct_ecdh(
+    EVP_PKEY *pkey,
+    unsigned char **buffer,
+    uint32_t *length,
+    DDS_Security_SecurityException *ex)
+{
+    DDS_Security_ValidationResult_t result = DDS_SECURITY_VALIDATION_OK;
+    EC_KEY *eckey;
+    const EC_GROUP *group;
+    const EC_POINT *point;
+    size_t sz;
+
+    eckey = EVP_PKEY_get1_EC_KEY(pkey);
+    if (!eckey) {
+        result = DDS_SECURITY_VALIDATION_FAILED;
+        DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result, "Failed to get EC key from PKEY: ");
+        goto fail_get_eckey;
+    }
+
+    point = EC_KEY_get0_public_key(eckey);
+    if (!point) {
+        result = DDS_SECURITY_VALIDATION_FAILED;
+        DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result, "Failed to get public key from ECKEY: ");
+        goto fail_get_point;
+    }
+
+    group = EC_KEY_get0_group(eckey);
+    if (!group) {
+        result = DDS_SECURITY_VALIDATION_FAILED;
+        DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result, "Failed to get group from ECKEY: ");
+        goto fail_get_group;
+    }
+
+    sz = EC_POINT_point2oct(group, point, POINT_CONVERSION_UNCOMPRESSED, NULL, 0, NULL);
+    if (sz == 0) {
+        result = DDS_SECURITY_VALIDATION_FAILED;
+        DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result, "Failed to serialize public EC key: ");
+        goto fail_point2oct1;
+    }
+
+    *buffer = ddsrt_malloc(sz);
+
+    *length = (uint32_t)EC_POINT_point2oct(group, point, POINT_CONVERSION_UNCOMPRESSED, *buffer, sz, NULL);
+    if (*length == 0) {
+        result = DDS_SECURITY_VALIDATION_FAILED;
+        DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result, "Failed to serialize public EC key: ");
+        goto fail_point2oct2;
+    }
+
+    EC_KEY_free(eckey);
+
+    return result;
+
+fail_point2oct2:
+    ddsrt_free(*buffer);
+fail_point2oct1:
+fail_get_group:
+fail_get_point:
+fail_get_eckey:
+    EC_KEY_free(eckey);
+    return result;
+}
+
+DDS_Security_ValidationResult_t
+dh_public_key_to_oct(
+    EVP_PKEY *pkey,
+    AuthenticationAlgoKind_t algo,
+    unsigned char **buffer,
+    uint32_t *length,
+    DDS_Security_SecurityException *ex)
+{
+    DDS_Security_ValidationResult_t result = DDS_SECURITY_VALIDATION_OK;
+
+    assert(pkey);
+    assert(buffer);
+    assert(length);
+
+    switch (algo) {
+    case AUTH_ALGO_KIND_RSA_2048:
+        result = dh_public_key_to_oct_modp(pkey, buffer, length, ex);
+        break;
+    case AUTH_ALGO_KIND_EC_PRIME256V1:
+        result = dh_public_key_to_oct_ecdh(pkey, buffer, length, ex);
+        break;
+    default:
+        assert(0);
+        result = DDS_SECURITY_VALIDATION_FAILED;
+        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result, "Invalid key algorithm specified");
+        break;
+    }
+
+    return result;
+}
+
+static DDS_Security_ValidationResult_t
+dh_oct_to_public_key_modp(
+    EVP_PKEY **pkey,
+    const unsigned char *keystr,
+    uint32_t size,
+    DDS_Security_SecurityException *ex)
+{
+    DDS_Security_ValidationResult_t result = DDS_SECURITY_VALIDATION_OK;
+    DH *dhkey;
+    ASN1_INTEGER *asn1int;
+    BIGNUM *pubkey;
+
+    *pkey = EVP_PKEY_new();
+    if (!(*pkey)) {
+        result = DDS_SECURITY_VALIDATION_FAILED;
+        DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result, "Failed to convert octet sequence to ASN1 integer: ");
+        goto fail_alloc_pkey;
+    }
+
+    asn1int = d2i_ASN1_INTEGER(NULL, (const unsigned char **)&keystr, size);
+    if (!asn1int) {
+        result = DDS_SECURITY_VALIDATION_FAILED;
+        DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result, "Failed to convert octet sequence to ASN1 integer: ");
+        goto fail_get_asn1int;
+    }
+
+    pubkey = ASN1_INTEGER_to_BN(asn1int, NULL);
+    if (!pubkey) {
+        result = DDS_SECURITY_VALIDATION_FAILED;
+        DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result, "Failed to convert ASN1 integer to BIGNUM: ");
+        goto fail_get_pubkey;
+    }
+
+    dhkey = DH_get_2048_256();
+
+    if (dh_set_public_key(dhkey, pubkey) == 0) {
+        result = DDS_SECURITY_VALIDATION_FAILED;
+        DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result, "Failed to set DH public key: ");
+    } else if (EVP_PKEY_set1_DH(*pkey, dhkey) == 0) {
+        result = DDS_SECURITY_VALIDATION_FAILED;
+        DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result, "Failed to convert DH to PKEY: ");
+    }
+
+    ASN1_INTEGER_free(asn1int);
+    DH_free(dhkey);
+
+    return result;
+
+fail_get_pubkey:
+    ASN1_INTEGER_free(asn1int);
+fail_get_asn1int:
+    EVP_PKEY_free(*pkey);
+fail_alloc_pkey:
+    return result;
+}
+
+static DDS_Security_ValidationResult_t
+dh_oct_to_public_key_ecdh(
+    EVP_PKEY **pkey,
+    const unsigned char *keystr,
+    uint32_t size,
+    DDS_Security_SecurityException *ex)
+{
+    DDS_Security_ValidationResult_t result = DDS_SECURITY_VALIDATION_OK;
+    EC_KEY *eckey;
+    EC_GROUP *group;
+    EC_POINT *point;
+
+    group = EC_GROUP_new_by_curve_name(NID_X9_62_prime256v1);
+    if (!group) {
+        result = DDS_SECURITY_VALIDATION_FAILED;
+        DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result, "Failed to allocate EC group: ");
+        goto fail_alloc_group;
+    }
+
+    point = EC_POINT_new(group);
+    if (!point) {
+        result = DDS_SECURITY_VALIDATION_FAILED;
+        DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result, "Failed to allocate EC point: ");
+        goto fail_alloc_point;
+    }
+
+
+    if (EC_POINT_oct2point(group, point, keystr, size, NULL) != 1) {
+        result = DDS_SECURITY_VALIDATION_FAILED;
+        DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result, "Failed to deserialize EC public key to EC point: ");
+        goto fail_oct2point;
+    }
+
+    eckey = EC_KEY_new();
+    if (!eckey) {
+        result = DDS_SECURITY_VALIDATION_FAILED;
+        DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result, "Failed to allocate EC KEY: ");
+        goto fail_alloc_eckey;
+    }
+
+    if (EC_KEY_set_group(eckey, group) != 1) {
+        result = DDS_SECURITY_VALIDATION_FAILED;
+        DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result, "Failed to convert octet sequence to ASN1 integer: ");
+        goto fail_eckey_set_group;
+    }
+
+    if (EC_KEY_set_public_key(eckey, point) != 1) {
+        result = DDS_SECURITY_VALIDATION_FAILED;
+        DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result, "Failed to set EC public key: ");
+        goto fail_eckey_set_pubkey;
+    }
+
+    *pkey = EVP_PKEY_new();
+    if (!(*pkey)) {
+        result = DDS_SECURITY_VALIDATION_FAILED;
+        DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result, "Failed to allocate EVP key: ");
+        goto fail_alloc_pkey;
+    }
+
+    if (EVP_PKEY_set1_EC_KEY(*pkey, eckey) != 1) {
+        result = DDS_SECURITY_VALIDATION_FAILED;
+        DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result, "Failed to set EVP key to EC public key: ");
+        goto fail_pkey_set_eckey;
+    }
+
+    EC_KEY_free(eckey);
+    EC_POINT_free(point);
+    EC_GROUP_free(group);
+
+    return result;
+
+fail_pkey_set_eckey:
+    EVP_PKEY_free(*pkey);
+fail_alloc_pkey:
+fail_eckey_set_pubkey:
+fail_eckey_set_group:
+    EC_KEY_free(eckey);
+fail_alloc_eckey:
+fail_oct2point:
+    EC_POINT_free(point);
+fail_alloc_point:
+    EC_GROUP_free(group);
+fail_alloc_group:
+    return result;
+}
+
+DDS_Security_ValidationResult_t
+dh_oct_to_public_key(
+    EVP_PKEY **data,
+    AuthenticationAlgoKind_t algo,
+    const unsigned char *str,
+    uint32_t size,
+    DDS_Security_SecurityException *ex)
+{
+    DDS_Security_ValidationResult_t result = DDS_SECURITY_VALIDATION_OK;
+
+    assert(data);
+    assert(str);
+
+    switch (algo) {
+    case AUTH_ALGO_KIND_RSA_2048:
+        result = dh_oct_to_public_key_modp(data, str, size, ex);
+        break;
+    case AUTH_ALGO_KIND_EC_PRIME256V1:
+        result = dh_oct_to_public_key_ecdh(data, str, size, ex);
+        break;
+    default:
+        assert(0);
+        result = DDS_SECURITY_VALIDATION_FAILED;
+        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result, "Invalid key algorithm specified");
+        break;
+    }
+
+    return result;
+}
+
+/*
+ * Allocates and return a NULL terminated string from given char array with the given size.
+ */
+char *
+string_from_data(
+    const unsigned char *data,
+    uint32_t size)
+{
+    char *str = NULL;
+
+    if (size > 0 && data) {
+        str = ddsrt_malloc(size+1);
+        memcpy(str, data, size);
+        str[size] = '\0';
+    }
+
+    return str;
+}
+
+void
+free_ca_list_contents( X509Seq *ca_list)
+{
+    unsigned i;
+    if( ca_list->buffer != NULL && ca_list->length > 0){
+        for (i = 0; i < ca_list->length; ++i) {
+            X509_free(ca_list->buffer[i]);
+        }
+        ddsrt_free ( ca_list->buffer );
+    }
+    ca_list->buffer = NULL;
+    ca_list->length = 0;
+}
+
+DDS_Security_ValidationResult_t
+get_trusted_ca_list ( const char* trusted_ca_dir,
+                X509Seq *ca_list,
+                DDS_Security_SecurityException *ex){
+
+
+    DDS_Security_ValidationResult_t loading_result = DDS_RETCODE_OK;
+    DDSRT_UNUSED_ARG( ca_list );
+    DDSRT_UNUSED_ARG( trusted_ca_dir );
+    DDSRT_UNUSED_ARG( ex );
+/* TODO: Trusted CA directory tracing function should be ported */
+/* TODO: MAX_TRUSTED_CA limitation will be removed */
+#ifdef TRUSTED_CA_LIST_IMPLEMENTED
+
+    os_result        r;
+    os_dirHandle     d_descr;
+    struct os_dirent d_entry;
+    struct os_stat_s status;
+    char *full_file_path;
+    char *trusted_ca_dir_normalized;
+
+    X509 *ca_buffer_array[MAX_TRUSTED_CA]; /*max trusted CA size */
+    unsigned ca_buffer_array_size=0;
+    unsigned i;
+    trusted_ca_dir_normalized  = os_fileNormalize(trusted_ca_dir);
+
+    r = os_opendir(trusted_ca_dir_normalized, &d_descr);
+    ddsrt_free ( trusted_ca_dir_normalized );
+
+    if (r == os_resultSuccess && ca_buffer_array_size < MAX_TRUSTED_CA) { /* accessable */
+        r = os_readdir(d_descr, &d_entry);
+        while (r == os_resultSuccess) {
+            full_file_path = (char*) ddsrt_malloc(strlen(trusted_ca_dir) + strlen(os_fileSep()) + strlen(d_entry.d_name) + strlen(os_fileSep()) + 1 );
+            ddsrt_strcpy(full_file_path, trusted_ca_dir);
+            ddsrt_strcat(full_file_path, os_fileSep());
+            ddsrt_strcat(full_file_path, d_entry.d_name);
+
+            if (os_stat (full_file_path, &status) == os_resultSuccess) { /* accessable */
+                if ((strcmp(d_entry.d_name, ".") != 0) &&
+                    (strcmp(d_entry.d_name, "..") != 0)) {
+                    char * filename = os_fileNormalize(full_file_path);
+
+                    if(filename){
+                        X509 *identityCA;
+                        loading_result = load_X509_certificate_from_file( filename, &identityCA, ex);
+
+                        ddsrt_free(filename);
+
+                        if( loading_result == DDS_SECURITY_VALIDATION_OK ){
+                            ca_buffer_array[ca_buffer_array_size] = identityCA;
+                            ca_buffer_array_size++;
+
+                        }
+                    }
+                }
+            }
+            r = os_readdir(d_descr, &d_entry);
+
+            ddsrt_free(full_file_path);
+        }
+
+        os_closedir (d_descr);
+
+        /* deallocate given ca_list if it is not NULL */
+        free_ca_list_contents(ca_list);
+
+        /*copy CAs to out parameter as HASH*/
+        if( ca_buffer_array_size > 0 ){
+            ca_list->_buffer = ddsrt_malloc( ca_buffer_array_size * sizeof(X509 * ) );
+            for (i = 0; i < ca_buffer_array_size; ++i) {
+                ca_list->_buffer[i] = ca_buffer_array[i];
+
+            }
+
+        }
+        ca_list->_length = ca_buffer_array_size;
+
+        return DDS_SECURITY_VALIDATION_OK;
+
+    }
+    else{
+        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_TRUSTED_CA_DIR_CODE, 0, DDS_SECURITY_ERR_INVALID_TRUSTED_CA_DIR_MESSAGE);
+        return DDS_SECURITY_VALIDATION_FAILED;
+    }
+#endif
+
+    return loading_result;
+}
+
+DDS_Security_ValidationResult_t
+create_asymmetrical_signature(
+        EVP_PKEY *pkey,
+        const unsigned char *data,
+        const size_t dataLen,
+        unsigned char **signature,
+        size_t *signatureLen,
+        DDS_Security_SecurityException *ex)
+{
+    DDS_Security_ValidationResult_t result = DDS_SECURITY_VALIDATION_OK;
+    EVP_MD_CTX *mdctx = NULL;
+    EVP_PKEY_CTX *kctx = NULL;
+
+    if (!(mdctx = EVP_MD_CTX_create())) {
+        result = DDS_SECURITY_VALIDATION_FAILED;
+        DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result, "Failed to create signing context: ");
+        goto err_create_ctx;
+    }
+
+    if (EVP_DigestSignInit(mdctx, &kctx, EVP_sha256(), NULL, pkey) != 1) {
+        result = DDS_SECURITY_VALIDATION_FAILED;
+        DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result, "Failed to initialize signing context: ");
+        goto err_sign;
+    }
+
+    if (EVP_PKEY_CTX_set_rsa_padding(kctx, RSA_PKCS1_PSS_PADDING) < 1) {
+        result = DDS_SECURITY_VALIDATION_FAILED;
+        DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result, "Failed to initialize signing context: ");
+        goto err_sign;
+    }
+
+    if (EVP_DigestSignUpdate(mdctx, data, dataLen) != 1) {
+        result = DDS_SECURITY_VALIDATION_FAILED;
+        DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result, "Failed to update signing context: ");
+        goto err_sign;
+    }
+
+    if (EVP_DigestSignFinal(mdctx, NULL, signatureLen) != 1) {
+        result = DDS_SECURITY_VALIDATION_FAILED;
+        DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result, "Failed to finalize signing context: ");
+        goto err_sign;
+    }
+
+    *signature = ddsrt_malloc(sizeof(unsigned char) * (*signatureLen));
+    assert(*signature != NULL);
+    if (EVP_DigestSignFinal(mdctx, *signature, signatureLen) != 1) {
+        result = DDS_SECURITY_VALIDATION_FAILED;
+        DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result, "Failed to finalize signing context: ");
+        ddsrt_free(*signature);
+    }
+
+err_sign:
+    EVP_MD_CTX_destroy(mdctx);
+err_create_ctx:
+    return result;
+}
+
+DDS_Security_ValidationResult_t
+validate_asymmetrical_signature(
+        EVP_PKEY *pkey,
+        const unsigned char *data,
+        const size_t dataLen,
+        const unsigned char *signature,
+        const size_t signatureLen,
+        DDS_Security_SecurityException *ex)
+{
+    DDS_Security_ValidationResult_t result = DDS_SECURITY_VALIDATION_OK;
+    EVP_MD_CTX *mdctx = NULL;
+    EVP_PKEY_CTX *kctx = NULL;
+
+    if (!(mdctx = EVP_MD_CTX_create())) {
+        result = DDS_SECURITY_VALIDATION_FAILED;
+        DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result, "Failed to create verify context: ");
+        goto err_create_ctx;
+    }
+
+    if (EVP_DigestVerifyInit(mdctx, &kctx, EVP_sha256(), NULL, pkey) != 1) {
+        result = DDS_SECURITY_VALIDATION_FAILED;
+        DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result, "Failed to initialize verify context: ");
+        goto err_verify;
+    }
+
+    if (EVP_PKEY_CTX_set_rsa_padding(kctx, RSA_PKCS1_PSS_PADDING) < 1) {
+         result = DDS_SECURITY_VALIDATION_FAILED;
+         DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result, "Failed to initialize signing context: ");
+         goto err_verify;
+     }
+
+    if (EVP_DigestVerifyUpdate(mdctx, data, dataLen) != 1) {
+        result = DDS_SECURITY_VALIDATION_FAILED;
+        DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result, "Failed to update verify context: ");
+        goto err_verify;
+    }
+
+    if (EVP_DigestVerifyFinal(mdctx, signature, signatureLen) != 1) {
+        result = DDS_SECURITY_VALIDATION_FAILED;
+        DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result, "Failed to finalize verify context: ");
+        goto err_verify;
+    }
+
+err_verify:
+    EVP_MD_CTX_destroy(mdctx);
+err_create_ctx:
+    return result;
+}
diff --git a/src/security/builtin_plugins/authentication/src/auth_utils.h b/src/security/builtin_plugins/authentication/src/auth_utils.h
new file mode 100644
index 0000000..f9db31d
--- /dev/null
+++ b/src/security/builtin_plugins/authentication/src/auth_utils.h
@@ -0,0 +1,238 @@
+/*
+ * Copyright(c) 2006 to 2019 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+
+#ifndef AUTH_UTILS_H
+#define AUTH_UTILS_H
+
+#include "dds/security/dds_security_api.h"
+#include "dds/ddsrt/time.h"
+
+#define DDS_AUTH_PLUGIN_CONTEXT "Authentication"
+
+typedef enum {
+    AUTH_ALGO_KIND_UNKNOWN,
+    AUTH_ALGO_KIND_RSA_2048,
+    AUTH_ALGO_KIND_EC_PRIME256V1
+} AuthenticationAlgoKind_t;
+
+typedef enum {
+    AUTH_CONF_ITEM_PREFIX_UNKNOWN,
+    AUTH_CONF_ITEM_PREFIX_FILE,
+    AUTH_CONF_ITEM_PREFIX_DATA,
+    AUTH_CONF_ITEM_PREFIX_PKCS11
+} AuthConfItemPrefix_t;
+
+
+typedef struct AuthenticationChallenge {
+    unsigned char value[DDS_SECURITY_AUTHENTICATION_CHALLENGE_SIZE];
+} AuthenticationChallenge;
+
+typedef struct {
+    uint32_t length;
+    X509 **buffer;
+} X509Seq;
+
+typedef unsigned char HashValue_t[SHA256_DIGEST_LENGTH];
+/*typedef struct HashValue {
+    unsigned char value[SHA256_DIGEST_LENGTH];
+} HashValue_t;
+*/
+
+/* Return a string that contains an openssl error description
+ * When a openssl function returns an error this function can be
+ * used to retrieve a descriptive error string.
+ * Note that the returned string should be freed.
+ */
+char *
+get_openssl_error_message(
+        void);
+
+/* Return the subject name of contained in a X509 certificate
+ * Note that the returned string should be freed.
+ */
+char*
+get_certificate_subject_name(
+        const X509 *cert,
+        DDS_Security_SecurityException *ex);
+
+/* Return the expiry date of contained in a X509 certificate
+ *
+ */
+dds_time_t
+get_certificate_expiry(
+    const X509 *cert);
+
+/* Return the subject name of a X509 certificate DER
+ * encoded. The DER encoded subject name is returned in
+ * the provided buffer. The length of the allocated
+ * buffer is returned
+ *
+ * return length of allocated buffer or -1 on error
+ */
+DDS_Security_ValidationResult_t
+get_subject_name_DER_encoded(
+        const X509 *cert,
+        unsigned char **buffer,
+        size_t *size,
+        DDS_Security_SecurityException *ex);
+
+
+/* Load a X509 certificate for the provided data.
+ *
+ * data     : certificate in PEM format
+ * x509Cert : the openssl X509 return value
+ */
+DDS_Security_ValidationResult_t
+load_X509_certificate_from_data(
+        const char *data,
+        int len,
+        X509 **x509Cert,
+        DDS_Security_SecurityException *ex);
+
+
+/* Load a X509 certificate for the provided data.
+ *
+ * data     : URI of the certificate. URI format is defined in DDS Security spec 9.3.1
+
+ * x509Cert : the openssl X509 return value
+ */
+DDS_Security_ValidationResult_t
+load_X509_certificate(
+        const char *data,
+        X509 **x509Cert,
+        DDS_Security_SecurityException *ex);
+
+
+/* Load a X509 certificate for the provided file.
+ *
+ * filename : path of the file that contains PEM formatted certificate
+ * x509Cert : the openssl X509 return value
+ */
+DDS_Security_ValidationResult_t
+load_X509_certificate_from_file(
+        const char *filename,
+        X509 **x509Cert,
+        DDS_Security_SecurityException *ex);
+
+/* Load a Private Key for the provided data.
+ *
+ * data       : URI of the private key. URI format is defined in DDS Security spec 9.3.1
+ * privateKey : the openssl EVP_PKEY return value
+ */
+DDS_Security_ValidationResult_t
+load_X509_private_key(
+        const char *data,
+        const char *password,
+        EVP_PKEY **privateKey,
+        DDS_Security_SecurityException *ex);
+
+
+/* Validate an identity certificate against the identityCA
+ * The provided identity certificate is checked if it is
+ * signed by the identity corresponding to the identityCA.
+ *
+ * Note: Currently only a self signed CA is supported
+ *       The function does not yet check a CLR or ocsp
+ *       for expiry of identity certificate.
+ */
+DDS_Security_ValidationResult_t
+verify_certificate(
+        X509 *identityCert,
+        X509 *identityCa,
+        DDS_Security_SecurityException *ex);
+
+DDS_Security_ValidationResult_t
+check_certificate_expiry(
+    const X509 *cert,
+    DDS_Security_SecurityException *ex);
+
+AuthenticationAlgoKind_t
+get_auhentication_algo_kind(
+        X509 *cert);
+
+AuthenticationChallenge *
+generate_challenge(
+        DDS_Security_SecurityException *ex);
+
+DDS_Security_ValidationResult_t
+get_certificate_contents(
+        X509 *cert,
+        unsigned char **data,
+        uint32_t *size,
+        DDS_Security_SecurityException *ex);
+
+DDS_Security_ValidationResult_t
+generate_dh_keys(
+    EVP_PKEY **dhkey,
+    AuthenticationAlgoKind_t authKind,
+    DDS_Security_SecurityException *ex);
+
+DDS_Security_ValidationResult_t
+dh_public_key_to_oct(
+    EVP_PKEY *pkey,
+    AuthenticationAlgoKind_t algo,
+    unsigned char **buffer,
+    uint32_t *length,
+    DDS_Security_SecurityException *ex);
+
+DDS_Security_ValidationResult_t
+dh_oct_to_public_key(
+    EVP_PKEY **data,
+    AuthenticationAlgoKind_t algo,
+    const unsigned char *str,
+    uint32_t size,
+    DDS_Security_SecurityException *ex);
+
+
+AuthConfItemPrefix_t
+get_conf_item_type(
+        const char *str,
+        char **data);
+
+/*
+ * Frees the contents of theCA list.
+ */
+void
+free_ca_list_contents(
+     X509Seq *ca_list);
+
+DDS_Security_ValidationResult_t
+get_trusted_ca_list (
+    const char* trusted_ca_dir,
+    X509Seq *ca_list,
+    DDS_Security_SecurityException *ex);
+
+char *
+string_from_data(
+    const unsigned char *data,
+    uint32_t size);
+
+
+DDS_Security_ValidationResult_t
+create_asymmetrical_signature(
+        EVP_PKEY *pkey,
+        const unsigned char *data,
+        const size_t dataLen,
+        unsigned char **signature,
+        size_t *signatureLen,
+        DDS_Security_SecurityException *ex);
+
+DDS_Security_ValidationResult_t
+validate_asymmetrical_signature(
+        EVP_PKEY *pkey,
+        const unsigned char *data,
+        const size_t dataLen,
+        const unsigned char *signature,
+        const size_t signatureLen,
+        DDS_Security_SecurityException *ex);
+
+#endif /* AUTH_UTILS_H */
diff --git a/src/security/builtin_plugins/authentication/src/authentication.c b/src/security/builtin_plugins/authentication/src/authentication.c
new file mode 100644
index 0000000..eb4117f
--- /dev/null
+++ b/src/security/builtin_plugins/authentication/src/authentication.c
@@ -0,0 +1,3513 @@
+/*
+ * Copyright(c) 2006 to 2019 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+
+
+#include <openssl/bn.h>
+#include <openssl/asn1.h>
+#include <openssl/x509.h>
+#include <openssl/x509_vfy.h>
+#include <openssl/pem.h>
+#include <openssl/bio.h>
+#include <openssl/err.h>
+#include <openssl/evp.h>
+#include "authentication.h"
+#include "dds/ddsrt/heap.h"
+#include "dds/security/dds_security_api.h"
+
+
+#if OPENSLL_VERSION_NUMBER >= 0x10002000L
+#define AUTH_INCLUDE_EC
+#include <openssl/ec.h>
+#endif
+#include <openssl/rand.h>
+
+/* There is a problem when compiling on windows w.r.t. X509_NAME.
+ * The windows api already defines the type X509_NAME which
+ * conficts with some openssl versions. The workaround is to
+ * undef the openssl X509_NAME
+ */
+#ifdef _WIN32
+#undef X509_NAME
+#endif
+
+#include "dds/security/dds_security_api.h"
+#include "dds/security/dds_security_api_types.h"
+#include "dds/ddsrt/atomics.h"
+#include "stdbool.h"
+#include <string.h>
+#include "dds/ddsrt/string.h"
+#include "dds/ddsrt/sync.h"
+#include "dds/ddsrt/hopscotch.h"
+
+#include "dds/security/core/shared_secret.h"
+#include "dds/security/core/dds_security_utils.h"
+#include "dds/security/core/dds_security_serialize.h"
+#include "auth_utils.h"
+#include <assert.h>
+
+#ifndef EVP_PKEY_id
+#define EVP_PKEY_id(k) ((k)->type)
+#endif
+
+#if OPENSSL_VERSION_NUMBER >= 0x10000000L && OPENSSL_VERSION_NUMBER < 0x10100000L
+#define REMOVE_THREAD_STATE()     ERR_remove_thread_state(NULL);
+#elif OPENSSL_VERSION_NUMBER < 0x10000000L
+#define REMOVE_THREAD_STATE()     ERR_remove_state(0);
+#else
+#define REMOVE_THREAD_STATE()
+#endif
+
+
+#define HANDSHAKE_SIGNATURE_CONTENT_SIZE 6
+
+static const char * AUTH_PROTOCOL_CLASS                 = "DDS:Auth:PKI-DH";
+static const unsigned AUTH_PROTOCOL_VERSION_MAJOR       = 1;
+static const unsigned AUTH_PROTOCOL_VERSION_MINOR       = 0;
+
+static const char * AUTH_REQUEST_TOKEN_CLASS_ID         = "DDS:Auth:PKI-DH:1.0+AuthReq";
+static const char * AUTH_REQUEST_TOKEN_FUTURE_PROP_NAME = "future_challenge";
+
+static const char * PROPERTY_IDENTITY_CA                = "dds.sec.auth.identity_ca";
+static const char * PROPERTY_PRIVATE_KEY                = "dds.sec.auth.private_key";
+static const char * PROPERTY_PASSWORD                   = "dds.sec.auth.password";
+static const char * PROPERTY_IDENTITY_CERT              = "dds.sec.auth.identity_certificate";
+static const char * PROPERTY_TRUSTED_CA_DIR             = "dds.sec.auth.trusted_ca_dir";
+
+static const char * PROPERTY_CERT_SUBJECT_NAME          = "dds.cert.sn";
+static const char * PROPERTY_CERT_ALGORITHM             = "dds.cert.algo";
+static const char * PROPERTY_CA_SUBJECT_NAME            = "dds.ca.sn";
+static const char * PROPERTY_CA_ALGORITHM               = "dds.ca.aglo";
+
+static const char * AUTH_HANDSHAKE_REQUEST_TOKEN_ID     = "DDS:Auth:PKI-DH:1.0+Req";
+static const char * AUTH_HANDSHAKE_REPLY_TOKEN_ID       = "DDS:Auth:PKI-DH:1.0+Reply";
+
+static const char * AUTH_HANDSHAKE_FINAL_TOKEN_ID       = "DDS:Auth:PKI-DH:1.0+Final";
+
+static const char * AUTH_DSIG_ALGO_RSA_2048_SHA256_IDENT   = "RSASSA-PSS-SHA256";
+static const char * AUTH_DSIG_ALGO_ECDSA_SHA256_IDENT      = "ECDSA-SHA256";
+static const char * AUTH_KAGREE_ALGO_RSA_2048_SHA256_IDENT = "DH+MODP-2048-256";
+static const char * AUTH_KAGREE_ALGO_ECDH_PRIME256V1_IDENT = "ECDH+prime256v1-CEUM";
+
+
+static const char * ACCESS_PERMISSIONS_CREDENTIAL_TOKEN_ID = "DDS:Access:PermissionsCredential";
+static const char * ACCESS_PROPERTY_PERMISSION_DOCUMENT    = "dds.perm.cert";
+
+
+/**
+ * Implementation structure for storing encapsulated members of the instance
+ * while giving only the interface definition to user
+ */
+
+typedef enum {
+    SECURITY_OBJECT_KIND_UNKNOWN,
+    SECURITY_OBJECT_KIND_LOCAL_IDENTITY,
+    SECURITY_OBJECT_KIND_REMOTE_IDENTITY,
+    SECURITY_OBJECT_KIND_IDENTITY_RELATION,
+    SECURITY_OBJECT_KIND_HANDSHAKE
+} SecurityObjectKind_t;
+
+typedef enum {
+  CREATEDREQUEST,
+  CREATEDREPLY
+
+} CreatedHandshakeStep_t;
+
+typedef struct SecurityObject SecurityObject;
+
+typedef void (*SecurityObjectDestructor)(SecurityObject *obj);
+
+struct SecurityObject {
+    int64_t handle;
+    SecurityObjectKind_t kind;
+    SecurityObjectDestructor destructor;
+};
+
+
+#ifndef NDEBUG
+#define CHECK_OBJECT_KIND(o,k) assert(security_object_valid((SecurityObject *)(o), k))
+#else
+#define CHECK_OBJECT_KIND(o,k)
+#endif
+
+#define SECURITY_OBJECT(o)            ((SecurityObject *)(o))
+#define SECURITY_OBJECT_HANDLE(o)     (SECURITY_OBJECT(o)->handle)
+#define IDENTITY_HANDLE(o)            ((DDS_Security_IdentityHandle) SECURITY_OBJECT_HANDLE(o))
+#define HANDSHAKE_HANDLE(o)           ((DDS_Security_HandshakeHandle) SECURITY_OBJECT_HANDLE(o))
+
+#define SECURITY_OBJECT_VALID(o,k)    security_object_valid((SecurityObject *)(o), k)
+
+
+typedef struct LocalIdentityInfo {
+    SecurityObject _parent;
+    DDS_Security_DomainId domainId;
+    DDS_Security_GUID_t candidateGUID;
+    DDS_Security_GUID_t adjustedGUID;
+    X509 *identityCert;
+    X509 *identityCA;
+    EVP_PKEY *privateKey;
+    DDS_Security_OctetSeq pdata;
+    AuthenticationAlgoKind_t dsignAlgoKind;
+    AuthenticationAlgoKind_t kagreeAlgoKind;
+    char *permissionsDocument;
+} LocalIdentityInfo;
+
+typedef struct RemoteIdentityInfo {
+    SecurityObject _parent;
+    DDS_Security_GUID_t guid;
+    X509 *identityCert;
+    AuthenticationAlgoKind_t dsignAlgoKind;
+    AuthenticationAlgoKind_t kagreeAlgoKind;
+    DDS_Security_IdentityToken *remoteIdentityToken;
+    DDS_Security_OctetSeq pdata;
+    char *permissionsDocument;
+    struct ddsrt_hh *linkHash; /* contains the IdentityRelation objects */
+} RemoteIdentityInfo;
+
+
+/* This structure contains the relation between a local and a remote identity
+ * The handle for this object is the same as the handle of the associated
+ * local identity object. The IdentityRelation object will be stored with the
+ * remote identity.
+ */
+typedef struct IdentityRelation {
+    SecurityObject _parent;
+    LocalIdentityInfo *localIdentity;
+    RemoteIdentityInfo *remoteIdentity;
+    AuthenticationChallenge *lchallenge;
+    AuthenticationChallenge *rchallenge;
+} IdentityRelation;
+
+typedef struct HandshakeInfo {
+    SecurityObject _parent;
+    IdentityRelation *relation;
+    HashValue_t hash_c1;
+    HashValue_t hash_c2;
+    EVP_PKEY *ldh;
+    EVP_PKEY *rdh;
+    DDS_Security_SharedSecretHandleImpl *shared_secret_handle_impl;
+    CreatedHandshakeStep_t created_in;
+} HandshakeInfo;
+
+typedef struct dds_security_authentication_impl {
+    dds_security_authentication base;
+    int id; //sample internal member
+    ddsrt_mutex_t lock;
+    struct ddsrt_hh *objectHash;
+    struct ddsrt_hh *remoteGuidHash;
+    struct ut_timed_dispatcher_t *timed_callbacks;
+    X509Seq trustedCAList;
+
+
+
+} dds_security_authentication_impl;
+
+/* data type for timer dispatcher */
+typedef struct {
+    dds_security_authentication_impl *auth;
+    DDS_Security_IdentityHandle hdl;
+} validity_cb_info;
+
+
+static bool
+security_object_valid(
+    SecurityObject *obj,
+    SecurityObjectKind_t kind)
+{
+    if (!obj) return false;
+    if (obj->kind != kind) return false;
+    if (kind == SECURITY_OBJECT_KIND_IDENTITY_RELATION) {
+        IdentityRelation *relation = (IdentityRelation *)obj;
+        if (!relation->localIdentity || !relation->remoteIdentity || (ddsrt_address)obj->handle != (ddsrt_address)relation->localIdentity) {
+            return false;
+        }
+    } else if ((ddsrt_address)obj->handle != (ddsrt_address)obj) {
+        return false;
+    }
+    return true;
+}
+
+static uint32_t
+security_object_hash (
+    const void *obj)
+{
+    const SecurityObject *object = obj;
+#define UINT64_CONST(x, y, z) (((uint64_t) (x) * 1000000 + (y)) * 1000000 + (z))
+    const uint64_t c = UINT64_CONST (16292676, 669999, 574021);
+#undef UINT64_CONST
+    const uint32_t x = (uint32_t) object->handle;
+    return (unsigned) ((x * c) >> 32);
+}
+
+static int
+security_object_equal (
+    const void *ha,
+    const void *hb)
+{
+    const SecurityObject *la = ha;
+    const SecurityObject *lb = hb;
+
+    return la->handle == lb->handle;
+}
+
+static SecurityObject *
+security_object_find(
+    const struct ddsrt_hh *hh,
+    int64_t handle)
+{
+    struct SecurityObject template;
+
+    template.handle = handle;
+
+    return (SecurityObject *) ddsrt_hh_lookup(hh, &template);;
+}
+
+static void
+security_object_init(
+    SecurityObject *obj,
+    SecurityObjectKind_t kind,
+    SecurityObjectDestructor destructor)
+{
+    assert(obj);
+
+    obj->kind = kind;
+    obj->handle = (int64_t)(ddsrt_address)obj;
+    obj->destructor = destructor;
+}
+
+static void
+security_object_deinit(
+    SecurityObject *obj)
+
+{
+    assert(obj);
+    obj->handle = DDS_SECURITY_HANDLE_NIL;
+    obj->kind = SECURITY_OBJECT_KIND_UNKNOWN;
+    obj->destructor = NULL;
+}
+
+static void
+security_object_free(
+    SecurityObject *obj)
+{
+    assert(obj);
+    if (obj && obj->destructor) {
+        obj->destructor(obj);
+    }
+}
+
+static void
+localIdentityInfoFree(
+    SecurityObject *obj);
+
+
+
+static LocalIdentityInfo *
+localIdentityInfoNew(
+        DDS_Security_DomainId domainId,
+        X509 *identityCert,
+        X509 *identityCa,
+        EVP_PKEY *privateKey,
+        const DDS_Security_GUID_t *candidate_participant_guid,
+        const DDS_Security_GUID_t *adjusted_participant_guid)
+{
+    LocalIdentityInfo *identity = NULL;
+
+    assert(identityCert);
+    assert(identityCa);
+    assert(privateKey);
+    assert(candidate_participant_guid);
+    assert(adjusted_participant_guid);
+    assert(sizeof(DDS_Security_IdentityHandle) == 8);
+
+    identity = ddsrt_malloc(sizeof(*identity));
+    memset(identity, 0, sizeof(*identity));
+
+    security_object_init((SecurityObject *)identity, SECURITY_OBJECT_KIND_LOCAL_IDENTITY, localIdentityInfoFree);
+
+
+
+
+    identity->domainId = domainId;
+    identity->identityCert = identityCert;
+    identity->identityCA = identityCa;
+    identity->privateKey = privateKey;
+    identity->permissionsDocument = NULL;
+    identity->dsignAlgoKind = get_auhentication_algo_kind(identityCert);
+    identity->kagreeAlgoKind = AUTH_ALGO_KIND_EC_PRIME256V1;
+
+    memcpy(&identity->candidateGUID, candidate_participant_guid, sizeof(DDS_Security_GUID_t));
+    memcpy(&identity->adjustedGUID, adjusted_participant_guid, sizeof(DDS_Security_GUID_t));
+
+    return identity;
+}
+
+static void
+localIdentityInfoFree(
+    SecurityObject *obj)
+{
+    LocalIdentityInfo *identity = (LocalIdentityInfo *)obj;
+
+    CHECK_OBJECT_KIND(obj, SECURITY_OBJECT_KIND_LOCAL_IDENTITY);
+
+    if (identity) {
+        if (identity->identityCert) {
+            X509_free(identity->identityCert);
+        }
+        if (identity->identityCA) {
+            X509_free(identity->identityCA);
+        }
+        if (identity->privateKey) {
+            EVP_PKEY_free(identity->privateKey);
+        }
+        ddsrt_free(identity->pdata._buffer);
+        ddsrt_free(identity->permissionsDocument);
+        security_object_deinit((SecurityObject *)identity);
+        ddsrt_free(identity);
+    }
+}
+
+static uint32_t
+remote_guid_hash (
+        const void *obj)
+{
+    const RemoteIdentityInfo *identity = obj;
+    uint32_t tmp[4];
+
+    memcpy(tmp, &identity->guid, sizeof(tmp));
+
+    return (tmp[0]^tmp[1]^tmp[2]^tmp[3]);
+}
+
+static int
+remote_guid_equal (
+        const void *ha,
+        const void *hb)
+{
+    const RemoteIdentityInfo *la = ha;
+    const RemoteIdentityInfo *lb = hb;
+
+    return memcmp(&la->guid, &lb->guid, sizeof(la->guid)) == 0;
+}
+
+static RemoteIdentityInfo *
+find_remote_identity_by_guid(
+        const struct ddsrt_hh *hh,
+        const DDS_Security_GUID_t *guid)
+{
+    struct RemoteIdentityInfo template;
+
+    memcpy(&template.guid, guid, sizeof(*guid));
+
+    return (RemoteIdentityInfo *) ddsrt_hh_lookup(hh, &template);
+}
+
+static void
+remoteIdentityInfoFree(
+    SecurityObject *obj);
+
+static RemoteIdentityInfo *
+remoteIdentityInfoNew(
+        const DDS_Security_GUID_t *guid,
+        const DDS_Security_IdentityToken *remote_identity_token)
+{
+    RemoteIdentityInfo *identity = NULL;
+
+    assert(guid);
+    assert(remote_identity_token);
+
+    identity = ddsrt_malloc(sizeof(*identity));
+    memset(identity, 0, sizeof(*identity));
+
+    security_object_init((SecurityObject *)identity, SECURITY_OBJECT_KIND_REMOTE_IDENTITY, remoteIdentityInfoFree);
+
+    memcpy(&identity->guid, guid, sizeof(DDS_Security_GUID_t));
+    identity->remoteIdentityToken = DDS_Security_DataHolder_alloc();
+    DDS_Security_DataHolder_copy(identity->remoteIdentityToken, remote_identity_token);
+    identity->identityCert = NULL;
+    identity->dsignAlgoKind = AUTH_ALGO_KIND_UNKNOWN;
+    identity->kagreeAlgoKind = AUTH_ALGO_KIND_UNKNOWN;
+    identity->permissionsDocument = ddsrt_strdup("");
+    identity->linkHash = ddsrt_hh_new(32, security_object_hash, security_object_equal);
+
+    return identity;
+}
+
+static void
+remoteIdentityInfoFree(
+    SecurityObject *obj)
+{
+    RemoteIdentityInfo *identity = (RemoteIdentityInfo *)obj;
+
+    CHECK_OBJECT_KIND(obj, SECURITY_OBJECT_KIND_REMOTE_IDENTITY);
+
+    if (identity) {
+        if (identity->identityCert) {
+            X509_free(identity->identityCert);
+        }
+        DDS_Security_DataHolder_free(identity->remoteIdentityToken);
+
+        ddsrt_hh_free(identity->linkHash);
+
+        ddsrt_free(identity->pdata._buffer);
+        ddsrt_free(identity->permissionsDocument);
+        security_object_deinit((SecurityObject *)identity);
+        ddsrt_free(identity);
+    }
+}
+
+static void
+identityRelationFree(
+    SecurityObject *obj);
+
+/* The IdentityRelation provides the association between a local and a remote
+ * identity. This object manages the challenges which are created for
+ * each association between a local and a remote identity.
+ * The lchallenge is the challenge associated with the local identity and
+ * may be set when a future challenge is communicated with the auth_request_message_token.
+ * The rchallenge is the challenge received from the remote identity it may be set when
+ * an auth_request_message_token is received from the remote identity,
+ */
+static IdentityRelation *
+identityRelationNew(
+    LocalIdentityInfo *localIdentity,
+    RemoteIdentityInfo *remoteIdentity,
+    AuthenticationChallenge *lchallenge,
+    AuthenticationChallenge *rchallenge)
+{
+    IdentityRelation *relation;
+
+    assert(localIdentity);
+    assert(remoteIdentity);
+
+    relation = ddsrt_malloc(sizeof(*relation));
+    memset(relation, 0, sizeof(*relation));
+
+    security_object_init((SecurityObject *)relation, SECURITY_OBJECT_KIND_IDENTITY_RELATION, identityRelationFree);
+    relation->_parent.handle = SECURITY_OBJECT_HANDLE(localIdentity);
+
+    relation->localIdentity = localIdentity;
+    relation->remoteIdentity = remoteIdentity;
+    relation->lchallenge = lchallenge;
+    relation->rchallenge = rchallenge;
+
+    return relation;
+}
+
+static void
+identityRelationFree(
+    SecurityObject *obj)
+{
+    IdentityRelation *relation = (IdentityRelation *)obj;
+
+    CHECK_OBJECT_KIND(obj, SECURITY_OBJECT_KIND_IDENTITY_RELATION);
+
+    if (relation) {
+        ddsrt_free(relation->lchallenge);
+        ddsrt_free(relation->rchallenge);
+        security_object_deinit((SecurityObject *)relation);
+        ddsrt_free(relation);
+    }
+}
+
+static void
+handshakeInfoFree(
+    SecurityObject *obj);
+
+static HandshakeInfo *
+handshakeInfoNew(
+    LocalIdentityInfo *localIdentity,
+    RemoteIdentityInfo *remoteIdentity,
+    IdentityRelation *relation)
+{
+    HandshakeInfo *handshake;
+
+    assert(localIdentity);
+    assert(remoteIdentity);
+
+    DDSRT_UNUSED_ARG(localIdentity);
+    DDSRT_UNUSED_ARG(remoteIdentity);
+    handshake = ddsrt_malloc(sizeof(*handshake));
+    memset(handshake, 0, sizeof(*handshake));
+
+    security_object_init((SecurityObject *)handshake, SECURITY_OBJECT_KIND_HANDSHAKE, handshakeInfoFree);
+
+    handshake->relation = relation;
+    handshake->shared_secret_handle_impl = NULL;
+
+    return handshake;
+}
+
+static void
+handshakeInfoFree(
+    SecurityObject *obj)
+{
+    HandshakeInfo *handshake = (HandshakeInfo *)obj;
+
+    CHECK_OBJECT_KIND(obj, SECURITY_OBJECT_KIND_HANDSHAKE);
+
+    if (handshake) {
+        if (handshake->ldh) {
+            EVP_PKEY_free(handshake->ldh);
+        }
+        if (handshake->rdh) {
+            EVP_PKEY_free(handshake->rdh);
+        }
+        if(handshake->shared_secret_handle_impl) {
+            ddsrt_free( handshake->shared_secret_handle_impl->shared_secret);
+            ddsrt_free( handshake->shared_secret_handle_impl );
+        }
+        security_object_deinit((SecurityObject *)handshake);
+        ddsrt_free(handshake);
+    }
+}
+
+static IdentityRelation *
+find_identity_relation(
+    const RemoteIdentityInfo *remote,
+    int64_t lid)
+{
+    return (IdentityRelation *)security_object_find(remote->linkHash, lid);
+}
+
+static void
+remove_identity_relation(
+    RemoteIdentityInfo *remote,
+    IdentityRelation *relation)
+{
+    (void)ddsrt_hh_remove(remote->linkHash, relation);
+    security_object_free((SecurityObject *) relation);
+}
+
+static HandshakeInfo *
+find_handshake(
+    const dds_security_authentication_impl *auth,
+    int64_t localId,
+    int64_t remoteId)
+{
+    struct ddsrt_hh_iter it;
+    SecurityObject *obj;
+    IdentityRelation *relation;
+    HandshakeInfo *found = NULL;
+
+    for (obj = ddsrt_hh_iter_first(auth->objectHash, &it); obj && !found; obj = ddsrt_hh_iter_next(&it)) {
+        if (obj->kind == SECURITY_OBJECT_KIND_HANDSHAKE) {
+            relation = ((HandshakeInfo *)obj)->relation;
+            assert(relation);
+            if ((SECURITY_OBJECT_HANDLE(relation->localIdentity) == localId) &&
+                (SECURITY_OBJECT_HANDLE(relation->remoteIdentity) == remoteId)) {
+                found = (HandshakeInfo *)obj;
+            }
+        }
+    }
+
+    return found;
+}
+
+static char *
+get_authentication_class_id(
+    void)
+{
+    char *classId;
+    size_t sz;
+
+    sz = strlen(AUTH_PROTOCOL_CLASS) + 5;
+
+    classId = ddsrt_malloc(sz);
+    snprintf(classId, sz, "%s:%1u.%1u", AUTH_PROTOCOL_CLASS, AUTH_PROTOCOL_VERSION_MAJOR, AUTH_PROTOCOL_VERSION_MINOR);
+
+    return classId;
+}
+
+static const char *
+get_authentication_algo(
+        AuthenticationAlgoKind_t kind)
+{
+    const char *result;
+    switch (kind) {
+    case AUTH_ALGO_KIND_RSA_2048:
+        result = "RSA-2048";
+        break;
+    case AUTH_ALGO_KIND_EC_PRIME256V1:
+        result = "EC-prime256v1";
+        break;
+    default:
+        assert(0);
+        result = "";
+        break;
+    }
+
+    return result;
+}
+
+static const char *
+get_dsign_algo(
+        AuthenticationAlgoKind_t kind)
+{
+    const char *result;
+    switch (kind) {
+    case AUTH_ALGO_KIND_RSA_2048:
+        result = AUTH_DSIG_ALGO_RSA_2048_SHA256_IDENT;
+        break;
+    case AUTH_ALGO_KIND_EC_PRIME256V1:
+        result = AUTH_DSIG_ALGO_ECDSA_SHA256_IDENT;
+        break;
+    default:
+        assert(0);
+        result = "";
+        break;
+    }
+
+    return result;
+}
+
+static const char *
+get_kagree_algo(
+        AuthenticationAlgoKind_t kind)
+{
+    const char *result;
+    switch (kind) {
+    case AUTH_ALGO_KIND_RSA_2048:
+        result = AUTH_KAGREE_ALGO_RSA_2048_SHA256_IDENT;
+        break;
+    case AUTH_ALGO_KIND_EC_PRIME256V1:
+        result = AUTH_KAGREE_ALGO_ECDH_PRIME256V1_IDENT;
+        break;
+    default:
+        assert(0);
+        result = "";
+        break;
+    }
+
+    return result;
+}
+
+static AuthenticationAlgoKind_t
+get_dsign_algo_from_string(
+    const char *name)
+{
+    AuthenticationAlgoKind_t algoKind = AUTH_ALGO_KIND_UNKNOWN;
+
+    if (name) {
+        if (strcmp(AUTH_DSIG_ALGO_RSA_2048_SHA256_IDENT, name) == 0) {
+            algoKind = AUTH_ALGO_KIND_RSA_2048;
+        } else if (strcmp(AUTH_DSIG_ALGO_ECDSA_SHA256_IDENT, name) == 0) {
+            algoKind = AUTH_ALGO_KIND_EC_PRIME256V1;
+        }
+    }
+
+    return algoKind;
+}
+
+static AuthenticationAlgoKind_t
+get_kagree_algo_from_string(
+    const char *name)
+{
+    AuthenticationAlgoKind_t algoKind = AUTH_ALGO_KIND_UNKNOWN;
+
+    if (name) {
+        if (strcmp(AUTH_KAGREE_ALGO_RSA_2048_SHA256_IDENT, name) == 0) {
+            algoKind = AUTH_ALGO_KIND_RSA_2048;
+        } else if (strcmp(AUTH_KAGREE_ALGO_ECDH_PRIME256V1_IDENT, name) == 0) {
+            algoKind = AUTH_ALGO_KIND_EC_PRIME256V1;
+        }
+    }
+
+    return algoKind;
+}
+
+static void
+free_binary_properties(
+    DDS_Security_BinaryProperty_t *seq,
+    uint32_t length)
+{
+    uint32_t i;
+
+    for (i = 0; i < length; i++) {
+        ddsrt_free(seq[i].name);
+        ddsrt_free(seq[i].value._buffer);
+    }
+    ddsrt_free(seq);
+}
+
+static void
+get_hash_binary_property_seq(
+    const DDS_Security_BinaryPropertySeq *seq,
+    unsigned char hash[SHA256_DIGEST_LENGTH])
+{
+    DDS_Security_Serializer serializer;
+    unsigned char *buffer;
+    size_t size;
+
+    serializer = DDS_Security_Serializer_new(4096, 4096);
+
+    DDS_Security_Serialize_BinaryPropertySeq(serializer, seq);
+    DDS_Security_Serializer_buffer(serializer, &buffer, &size);
+    SHA256(buffer, size, hash);
+    ddsrt_free(buffer);
+    DDS_Security_Serializer_free(serializer);
+}
+
+static DDS_Security_ValidationResult_t
+create_signature(
+    EVP_PKEY *pkey,
+    const DDS_Security_BinaryProperty_t **binary_properties,
+    const uint32_t binary_properties_length,
+    unsigned char **signature,
+    size_t *signatureLen,
+    DDS_Security_SecurityException *ex)
+{
+    DDS_Security_ValidationResult_t result;
+    DDS_Security_Serializer serializer;
+    unsigned char *buffer;
+    size_t size;
+
+    serializer = DDS_Security_Serializer_new(4096, 4096);
+
+    DDS_Security_Serialize_BinaryPropertyArray(serializer,binary_properties, binary_properties_length);
+    DDS_Security_Serializer_buffer(serializer, &buffer, &size);
+
+    result = create_asymmetrical_signature(pkey, buffer, size, signature, signatureLen, ex);
+    ddsrt_free(buffer);
+    DDS_Security_Serializer_free(serializer);
+
+    return result;
+}
+
+static DDS_Security_ValidationResult_t
+validate_signature(
+    EVP_PKEY *pkey,
+    const DDS_Security_BinaryProperty_t **properties,
+    const uint32_t properties_length,
+    unsigned char *signature,
+    size_t signatureLen,
+    DDS_Security_SecurityException *ex)
+{
+    DDS_Security_ValidationResult_t result;
+    DDS_Security_Serializer serializer;
+    unsigned char *buffer;
+    size_t size;
+
+    serializer = DDS_Security_Serializer_new(4096, 4096);
+
+    DDS_Security_Serialize_BinaryPropertyArray(serializer, properties, properties_length);
+    DDS_Security_Serializer_buffer(serializer, &buffer, &size);
+
+    result = validate_asymmetrical_signature(pkey, buffer, size, signature, signatureLen, ex);
+    ddsrt_free(buffer);
+    DDS_Security_Serializer_free(serializer);
+
+    return result;
+}
+
+static DDS_Security_ValidationResult_t
+compute_hash_value(
+    HashValue_t value,
+    const DDS_Security_BinaryProperty_t **properties,
+    const uint32_t properties_length,
+    DDS_Security_SecurityException *ex)
+{
+    DDS_Security_ValidationResult_t result = DDS_SECURITY_VALIDATION_OK;
+    DDS_Security_Serializer serializer;
+    unsigned char *buffer;
+    size_t size;
+
+    DDSRT_UNUSED_ARG(ex);
+
+    serializer = DDS_Security_Serializer_new(4096, 4096);
+
+    DDS_Security_Serialize_BinaryPropertyArray(serializer, properties, properties_length);
+    DDS_Security_Serializer_buffer(serializer, &buffer, &size);
+    SHA256(buffer, size, value);
+    ddsrt_free(buffer);
+    DDS_Security_Serializer_free(serializer);
+
+    return result;
+}
+
+static DDS_Security_BinaryProperty_t *
+hash_value_to_binary_property(
+    const char *name,
+    HashValue_t hash)
+{
+    DDS_Security_BinaryProperty_t *bp = DDS_Security_BinaryProperty_alloc();
+
+    DDS_Security_BinaryProperty_set_by_value(bp, name, hash, sizeof(HashValue_t));
+
+    return bp;
+}
+
+
+/* Will be enabled after timed callback feature implementation */
+#if TIMED_CALLBACK_IMPLEMENTED
+
+static void
+validity_callback(struct ut_timed_dispatcher_t *d,
+                  ut_timed_cb_kind kind,
+                  void *listener,
+                  void *arg)
+{
+    validity_cb_info *info = arg;
+
+    assert(d);
+    assert(arg);
+
+    if (kind == UT_TIMED_CB_KIND_TIMEOUT) {
+        assert(listener);
+        dds_security_authentication_listener *auth_listener = (dds_security_authentication_listener*)listener;
+        if (auth_listener->on_revoke_identity) {
+            auth_listener->on_revoke_identity(auth_listener,
+                                               (dds_security_authentication*)info->auth,
+                                               info->hdl);
+
+        }
+    }
+    ddsrt_free(arg);
+}
+
+#endif
+
+static void
+add_validity_end_trigger(dds_security_authentication_impl *auth,
+                         const DDS_Security_IdentityHandle identity_handle,
+                         dds_time_t end)
+{
+    DDSRT_UNUSED_ARG( auth );
+    DDSRT_UNUSED_ARG( identity_handle );
+    DDSRT_UNUSED_ARG( end );
+    /* Will be enabled after timed call back feature implementation */
+    /*
+    validity_cb_info *arg = ddsrt_malloc(sizeof(validity_cb_info));
+    arg->auth = auth;
+    arg->hdl = identity_handle;
+    ut_timed_dispatcher_add(auth->timed_callbacks,
+                            validity_callback,
+                            end,
+                            (void*)arg);
+                            */
+}
+
+
+
+#define ADJUSTED_GUID_PREFIX_FLAG 0x80
+
+static DDS_Security_ValidationResult_t
+get_adjusted_participant_guid(
+        X509 *cert,
+        const DDS_Security_GUID_t *candidate,
+        DDS_Security_GUID_t *adjusted,
+        DDS_Security_SecurityException *ex)
+{
+    DDS_Security_ValidationResult_t result = DDS_SECURITY_VALIDATION_FAILED;
+    unsigned char high[SHA256_DIGEST_LENGTH], low[SHA256_DIGEST_LENGTH];
+    unsigned char *subject = NULL;
+    size_t size=0;
+
+    assert(cert);
+    assert(candidate);
+    assert(adjusted);
+
+    result = get_subject_name_DER_encoded(cert, &subject, &size, ex);
+    if ( result == DDS_SECURITY_VALIDATION_OK ) {
+      DDS_Security_octet hb = ADJUSTED_GUID_PREFIX_FLAG;
+      int i;
+
+      SHA256(subject, size, high);
+      SHA256(&candidate->prefix[0], sizeof(DDS_Security_GuidPrefix_t), low);
+
+      adjusted->entityId = candidate->entityId;
+      for (i = 0; i < 6; i++) {
+        adjusted->prefix[i] = hb | high[i] >> 1;
+        hb = (DDS_Security_octet) (high[i] << 7);
+      }
+      for (i = 0; i < 6; i++) {
+        adjusted->prefix[i + 6] = low[i];
+      }
+      ddsrt_free(subject);
+    }
+
+    return result;
+}
+#undef ADJUSTED_GUID_PREFIX_FLAG
+
+DDS_Security_ValidationResult_t
+validate_local_identity(
+        dds_security_authentication *instance,
+        DDS_Security_IdentityHandle *local_identity_handle,
+        DDS_Security_GUID_t *adjusted_participant_guid,
+        const DDS_Security_DomainId domain_id,
+        const DDS_Security_Qos *participant_qos,
+        const DDS_Security_GUID_t *candidate_participant_guid,
+        DDS_Security_SecurityException *ex)
+{
+    DDS_Security_ValidationResult_t result = DDS_SECURITY_VALIDATION_OK;
+    dds_security_authentication_impl *implementation = (dds_security_authentication_impl *) instance;
+    LocalIdentityInfo *identity;
+    char *identityCertPEM;
+    char *identityCaPEM;
+    char *privateKeyPEM;
+    char *password;
+    X509 *identityCert;
+    X509 *identityCA;
+    EVP_PKEY *privateKey;
+    char *trusted_ca_dir;
+    unsigned i;
+    dds_time_t certExpiry = DDS_TIME_INVALID;
+
+    /* validate provided arguments */
+    if (!instance || !local_identity_handle || !adjusted_participant_guid || !participant_qos || !candidate_participant_guid) {
+        result = DDS_SECURITY_VALIDATION_FAILED;
+        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result, "validate_local_identity: Invalid parameter provided");
+        goto err_bad_param;
+    }
+
+    implementation->id = 2;
+
+    identityCertPEM = DDS_Security_Property_get_value(&participant_qos->property.value, PROPERTY_IDENTITY_CERT);
+    if (!identityCertPEM) {
+        result = DDS_SECURITY_VALIDATION_FAILED;
+        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result, "validate_local_identity: missing property '%s'", PROPERTY_IDENTITY_CERT);
+        goto err_no_identity_cert;
+    }
+
+    identityCaPEM = DDS_Security_Property_get_value(&participant_qos->property.value, PROPERTY_IDENTITY_CA);
+    if (!identityCaPEM) {
+        result = DDS_SECURITY_VALIDATION_FAILED;
+        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result, "validate_local_identity: missing property '%s'", PROPERTY_IDENTITY_CA);
+        goto err_no_identity_ca;
+    }
+
+    privateKeyPEM = DDS_Security_Property_get_value(&participant_qos->property.value, PROPERTY_PRIVATE_KEY);
+    if (!privateKeyPEM) {
+        result = DDS_SECURITY_VALIDATION_FAILED;
+        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result, "validate_local_identity: missing property '%s'", PROPERTY_PRIVATE_KEY);
+        goto err_no_private_key;
+    }
+
+    password = DDS_Security_Property_get_value(&participant_qos->property.value, PROPERTY_PASSWORD);
+
+
+    trusted_ca_dir = DDS_Security_Property_get_value(&participant_qos->property.value, PROPERTY_TRUSTED_CA_DIR);
+
+    if( trusted_ca_dir ){
+        result = get_trusted_ca_list(trusted_ca_dir, &(implementation->trustedCAList), ex );
+        if (result != DDS_SECURITY_VALIDATION_OK) {
+            goto err_inv_trusted_ca_dir;
+        }
+    }
+
+
+    result = load_X509_certificate(identityCaPEM, &identityCA, ex);
+    if (result != DDS_SECURITY_VALIDATION_OK) {
+        goto err_inv_identity_ca;
+    }
+
+
+    /*check for  CA if listed in trusted CA files*/
+    if( implementation->trustedCAList.length != 0 ){
+        const EVP_MD *digest = EVP_get_digestbyname("sha1");
+        uint32_t size;
+        unsigned char hash_buffer[20];
+        unsigned char hash_buffer_trusted[20];
+        result = DDS_SECURITY_VALIDATION_FAILED;
+        X509_digest(identityCA, digest, hash_buffer, &size);
+        for (i = 0; i < implementation->trustedCAList.length; ++i) {
+            X509_digest(implementation->trustedCAList.buffer[i], digest, hash_buffer_trusted, &size);
+            if( memcmp( hash_buffer_trusted, hash_buffer,20 ) == 0){
+                result = DDS_SECURITY_VALIDATION_OK;
+                break;
+            }
+        }
+
+        if (result != DDS_SECURITY_VALIDATION_OK) { /*not trusted*/
+            DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_CA_NOT_TRUSTED_CODE, (int)result, DDS_SECURITY_ERR_CA_NOT_TRUSTED_MESSAGE);
+            goto err_identity_ca_not_trusted;
+        }
+    }
+    result = load_X509_certificate(identityCertPEM, &identityCert, ex);
+    if (result != DDS_SECURITY_VALIDATION_OK) {
+        goto err_inv_identity_cert;
+    }
+
+    result = load_X509_private_key(privateKeyPEM, password, &privateKey, ex);
+    if (result != DDS_SECURITY_VALIDATION_OK) {
+        goto err_inv_private_key;
+    }
+
+    result = verify_certificate(identityCert, identityCA, ex);
+    if (result != DDS_SECURITY_VALIDATION_OK) {
+        goto err_verification_failed;
+    }
+
+    result = get_adjusted_participant_guid(identityCert, candidate_participant_guid, adjusted_participant_guid, ex);
+    if (result != DDS_SECURITY_VALIDATION_OK) {
+        goto err_adj_guid_failed;
+    }
+
+    ddsrt_free(password);
+    ddsrt_free(privateKeyPEM);
+    ddsrt_free(identityCaPEM);
+    ddsrt_free(identityCertPEM);
+    ddsrt_free(trusted_ca_dir);
+
+    identity = localIdentityInfoNew(domain_id, identityCert, identityCA, privateKey, candidate_participant_guid, adjusted_participant_guid);
+
+    *local_identity_handle = IDENTITY_HANDLE(identity);
+
+    /* setup expiry listener */
+    certExpiry = get_certificate_expiry( identityCert );
+
+    if( certExpiry == DDS_TIME_INVALID ){
+      DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result, "Expiry date of the certificate is invalid");
+      goto err_verification_failed;
+    } else if ( certExpiry != DDS_NEVER ){
+      add_validity_end_trigger( implementation,
+                                *local_identity_handle,
+                                certExpiry);
+    }
+
+
+    ddsrt_mutex_lock(&implementation->lock);
+    (void)ddsrt_hh_add(implementation->objectHash, identity);
+
+    ddsrt_mutex_unlock(&implementation->lock);
+
+    return result;
+
+err_adj_guid_failed:
+err_verification_failed:
+    EVP_PKEY_free(privateKey);
+err_inv_private_key:
+    X509_free(identityCert);
+err_inv_identity_cert:
+err_identity_ca_not_trusted:
+    X509_free(identityCA);
+err_inv_identity_ca:
+err_inv_trusted_ca_dir:
+    ddsrt_free(password);
+    ddsrt_free(privateKeyPEM);
+    ddsrt_free(trusted_ca_dir);
+err_no_private_key:
+    ddsrt_free(identityCaPEM);
+err_no_identity_ca:
+    ddsrt_free(identityCertPEM);
+err_no_identity_cert:
+err_bad_param:
+    return DDS_SECURITY_VALIDATION_FAILED;
+}
+
+DDS_Security_boolean
+get_identity_token(dds_security_authentication *instance,
+        DDS_Security_IdentityToken *identity_token,
+        const DDS_Security_IdentityHandle handle,
+        DDS_Security_SecurityException *ex)
+{
+    dds_security_authentication_impl *impl = (dds_security_authentication_impl *) instance;
+    SecurityObject *obj;
+    LocalIdentityInfo *identity;
+    char *snCert, *snCA;
+
+    memset(identity_token, 0, sizeof(*identity_token));
+
+    /* validate provided arguments */
+    if (!instance || !identity_token) {
+        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "get_identity_token: Invalid parameter provided");
+        goto err_bad_param;
+    }
+
+    ddsrt_mutex_lock(&impl->lock);
+
+    obj = security_object_find(impl->objectHash, handle);
+    if (!obj || !security_object_valid(obj, SECURITY_OBJECT_KIND_LOCAL_IDENTITY)) {
+        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "get_identity_token: Invalid handle provided");
+        goto err_inv_handle;
+    }
+    identity = (LocalIdentityInfo *)obj;
+
+    snCert = get_certificate_subject_name(identity->identityCert, ex);
+
+    if (!snCert) {
+        goto err_sn_cert;
+    }
+
+    snCA = get_certificate_subject_name(identity->identityCA, ex);
+    if (!snCA) {
+        goto err_sn_ca;
+    }
+
+    identity_token->class_id = get_authentication_class_id();
+    identity_token->properties._length = 4;
+    identity_token->properties._buffer = DDS_Security_PropertySeq_allocbuf(4);
+
+    identity_token->properties._buffer[0].name = ddsrt_strdup(PROPERTY_CERT_SUBJECT_NAME);
+    identity_token->properties._buffer[0].value = snCert;
+
+    identity_token->properties._buffer[1].name = ddsrt_strdup(PROPERTY_CERT_ALGORITHM);
+    identity_token->properties._buffer[1].value = ddsrt_strdup(get_authentication_algo(get_auhentication_algo_kind(identity->identityCert)));
+
+    identity_token->properties._buffer[2].name = ddsrt_strdup(PROPERTY_CA_SUBJECT_NAME);
+    identity_token->properties._buffer[2].value = snCA;
+
+    identity_token->properties._buffer[3].name = ddsrt_strdup(PROPERTY_CA_ALGORITHM);
+    identity_token->properties._buffer[3].value = ddsrt_strdup(get_authentication_algo(get_auhentication_algo_kind(identity->identityCA)));
+
+    ddsrt_mutex_unlock(&impl->lock);
+
+    return true;
+
+err_sn_ca:
+    ddsrt_free(snCert);
+err_sn_cert:
+err_inv_handle:
+    ddsrt_mutex_unlock(&impl->lock);
+err_bad_param:
+    return false;
+}
+
+DDS_Security_boolean get_identity_status_token(
+        dds_security_authentication *instance,
+        DDS_Security_IdentityStatusToken *identity_status_token,
+        const DDS_Security_IdentityHandle handle,
+        DDS_Security_SecurityException *ex)
+{
+    DDSRT_UNUSED_ARG(identity_status_token);
+    DDSRT_UNUSED_ARG(handle);
+    DDSRT_UNUSED_ARG(ex);
+    DDSRT_UNUSED_ARG(instance);
+
+    return true;
+}
+
+DDS_Security_boolean
+set_permissions_credential_and_token(
+        dds_security_authentication *instance,
+        const DDS_Security_IdentityHandle handle,
+        const DDS_Security_PermissionsCredentialToken *permissions_credential,
+        const DDS_Security_PermissionsToken *permissions_token,
+        DDS_Security_SecurityException *ex)
+{
+    dds_security_authentication_impl *impl = (dds_security_authentication_impl *) instance;
+    LocalIdentityInfo *identity;
+
+    /* validate provided arguments */
+    if ((!instance)                         ||
+        (handle == DDS_SECURITY_HANDLE_NIL) ||
+        (!permissions_credential)           ||
+        (!permissions_token)                ){
+        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT,
+                DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "get_identity_token: Invalid parameter provided");
+        return false;
+    }
+
+    if (!permissions_credential->class_id ||
+        (strcmp(permissions_credential->class_id, ACCESS_PERMISSIONS_CREDENTIAL_TOKEN_ID) != 0)) {
+        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT,
+                DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "get_identity_token: Invalid parameter provided");
+        return false;
+    }
+
+    if ((permissions_credential->properties._length == 0) ||
+        (permissions_credential->properties._buffer[0].name == NULL) ||
+        (strcmp(permissions_credential->properties._buffer[0].name, ACCESS_PROPERTY_PERMISSION_DOCUMENT) != 0)) {
+        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT,
+                DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "get_identity_token: Invalid parameter provided");
+        return false;
+    }
+
+    ddsrt_mutex_lock(&impl->lock);
+
+    identity = (LocalIdentityInfo *)security_object_find(impl->objectHash, handle);
+    if (!identity || !SECURITY_OBJECT_VALID(identity, SECURITY_OBJECT_KIND_LOCAL_IDENTITY)) {
+        ddsrt_mutex_unlock(&impl->lock);
+        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "get_identity_token: Invalid handle provided");
+        return false;
+    }
+
+    if (permissions_credential->properties._buffer[0].value) {
+        identity->permissionsDocument = ddsrt_strdup(permissions_credential->properties._buffer[0].value);
+    } else {
+        identity->permissionsDocument = ddsrt_strdup("");
+    }
+
+    ddsrt_mutex_unlock(&impl->lock);
+
+    return true;
+}
+
+
+static DDS_Security_ValidationResult_t
+validate_remote_identity_token(
+    const LocalIdentityInfo *localIdent,
+    const DDS_Security_IdentityToken *token,
+    DDS_Security_SecurityException *ex)
+{
+    DDS_Security_ValidationResult_t result = DDS_SECURITY_VALIDATION_OK;
+
+    DDSRT_UNUSED_ARG(localIdent);
+
+    if (token->class_id) {
+        size_t sz = strlen(AUTH_PROTOCOL_CLASS);
+
+        if (strncmp(AUTH_PROTOCOL_CLASS, token->class_id, sz) == 0) {
+            char *ptr = &token->class_id[sz];
+            char postfix[2];
+            unsigned major, minor;
+
+      DDSRT_WARNING_MSVC_OFF(4996);
+            if (sscanf(ptr, ":%u.%u%1s", &major, &minor, postfix) == 2) {
+      DDSRT_WARNING_MSVC_ON(4996);
+                if (major == AUTH_PROTOCOL_VERSION_MAJOR) {
+                } else {
+                    result = DDS_SECURITY_VALIDATION_FAILED;
+                    DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result, "remote identity token: version %u.%u not supported", major, minor);
+                }
+            } else {
+                result = DDS_SECURITY_VALIDATION_FAILED;
+                DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE,  (int)result, "remote identity token: class_id has wrong format");
+            }
+        } else {
+            result = DDS_SECURITY_VALIDATION_FAILED;
+            DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result, "remote identity token: class_id='%s' not supported", token->class_id);
+        }
+    } else {
+        result = DDS_SECURITY_VALIDATION_FAILED;
+        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result, "remote identity token: class_id is empty");
+    }
+
+    return result;
+}
+
+static DDS_Security_ValidationResult_t
+validate_auth_request_token(
+        const DDS_Security_IdentityToken *token,
+        AuthenticationChallenge **challenge,
+        DDS_Security_SecurityException *ex)
+{
+    uint32_t index;
+    int found = 0;
+
+    assert(token);
+
+    if (!token->class_id) {
+        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED,
+                "AuthRequestMessageToken invalid: missing class_id");
+        goto err_inv_token;
+    }
+
+    if (strncmp(token->class_id, AUTH_REQUEST_TOKEN_CLASS_ID, strlen(AUTH_REQUEST_TOKEN_CLASS_ID)) != 0) {
+        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED,
+                "AuthRequestMessageToken invalid: class_id '%s' is invalid", token->class_id);
+        goto err_inv_token;
+    }
+
+    if (!token->binary_properties._buffer) {
+        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE,  DDS_SECURITY_VALIDATION_FAILED,
+                "AuthRequestMessageToken invalid: properties are missing");
+        goto err_inv_token;
+    }
+
+    for (index = 0; index < token->binary_properties._length; index++) {
+        size_t len = strlen(AUTH_REQUEST_TOKEN_FUTURE_PROP_NAME);
+        if (token->binary_properties._buffer[index].name &&
+            (strncmp(token->binary_properties._buffer[index].name, AUTH_REQUEST_TOKEN_FUTURE_PROP_NAME, len) == 0)) {
+            found = 1;
+            break;
+        }
+    }
+
+    if (!found) {
+        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED,
+                 "AuthRequestMessageToken invalid: future_challenge not found");
+        goto err_inv_token;
+    }
+
+    if (token->binary_properties._buffer[index].value._length != sizeof(AuthenticationChallenge)) {
+        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED,
+                       "AuthRequestMessageToken invalid: future_challenge invalid size");
+        goto err_inv_token;
+    }
+
+    if (!token->binary_properties._buffer[index].value._buffer) {
+        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED,
+                       "AuthRequestMessageToken invalid: future_challenge invalid size");
+        goto err_inv_token;
+    }
+
+    if (challenge) {
+        *challenge = ddsrt_malloc(sizeof(AuthenticationChallenge));
+        memcpy(*challenge, &token->binary_properties._buffer[index].value._buffer[0], sizeof(AuthenticationChallenge));
+    }
+
+    return DDS_SECURITY_VALIDATION_OK;
+
+err_inv_token:
+    return DDS_SECURITY_VALIDATION_FAILED;
+}
+
+static void
+fill_auth_request_token(
+    DDS_Security_AuthRequestMessageToken *token,
+    AuthenticationChallenge *challenge)
+{
+    uint32_t len = sizeof(challenge->value);
+
+    DDS_Security_DataHolder_deinit(token);
+
+    token->class_id = ddsrt_strdup(AUTH_REQUEST_TOKEN_CLASS_ID);
+    token->binary_properties._length = 1;
+    token->binary_properties._buffer = DDS_Security_BinaryPropertySeq_allocbuf(1);
+    token->binary_properties._buffer->name = ddsrt_strdup(AUTH_REQUEST_TOKEN_FUTURE_PROP_NAME);
+
+    token->binary_properties._buffer->value._length = len;
+    token->binary_properties._buffer->value._buffer = ddsrt_malloc(len);
+    memcpy(token->binary_properties._buffer->value._buffer, challenge->value, len);
+}
+
+DDS_Security_ValidationResult_t
+validate_remote_identity(
+        dds_security_authentication *instance,
+        DDS_Security_IdentityHandle *remote_identity_handle,
+        DDS_Security_AuthRequestMessageToken *local_auth_request_token,
+        const DDS_Security_AuthRequestMessageToken *remote_auth_request_token,
+        const DDS_Security_IdentityHandle local_identity_handle,
+        const DDS_Security_IdentityToken *remote_identity_token,
+        const DDS_Security_GUID_t *remote_participant_guid,
+        DDS_Security_SecurityException *ex)
+{
+    DDS_Security_ValidationResult_t result = DDS_SECURITY_VALIDATION_OK;
+    dds_security_authentication_impl *impl = (dds_security_authentication_impl *) instance;
+    SecurityObject *obj;
+    LocalIdentityInfo *localIdent;
+    RemoteIdentityInfo *remoteIdent;
+    IdentityRelation *relation;
+    AuthenticationChallenge *lchallenge = NULL, *rchallenge = NULL;
+    int r;
+
+    /* validate provided arguments */
+    if (!instance || !remote_identity_handle || !local_auth_request_token || !remote_identity_token || !remote_participant_guid) {
+        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "validate_remote_identity: Invalid parameter provided");
+        goto err_bad_param;
+    }
+
+    ddsrt_mutex_lock(&impl->lock);
+
+    obj = security_object_find(impl->objectHash, local_identity_handle);
+    if (!obj || !security_object_valid(obj, SECURITY_OBJECT_KIND_LOCAL_IDENTITY)) {
+        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "validate_remote_identity: Invalid handle provided");
+        goto err_inv_handle;
+    }
+    localIdent = (LocalIdentityInfo *) obj;
+
+    /* Check if the provided remote_identity_token is compatible */
+    result = validate_remote_identity_token(localIdent, remote_identity_token, ex);
+    if (result != DDS_SECURITY_VALIDATION_OK) {
+        goto err_remote_identity_token;
+    }
+
+    /* When the remote_auth_request_token is not null, check if it's contents is valid and
+     * set the futureChallenge from the data contained in the remote_auth_request_token.
+     */
+    if (remote_auth_request_token) {
+        result  = validate_auth_request_token(remote_auth_request_token, &rchallenge, ex);
+        if (result != DDS_SECURITY_VALIDATION_OK) {
+            goto err_inv_auth_req_token;
+        }
+    }
+
+    if ((lchallenge = generate_challenge(ex)) == NULL) {
+        goto err_alloc_challenge;
+    }
+
+    /* The validate_remote_identity will also create a handshake structure which contains the
+     * relation between an local an remote identity. This handshake structure is inserted in
+     * the remote identity structure.
+     */
+
+    /* Check if the remote identity has already been validated by a previous validation request. */
+    remoteIdent = find_remote_identity_by_guid(impl->remoteGuidHash, remote_participant_guid);
+    if (!remoteIdent) {
+        remoteIdent = remoteIdentityInfoNew(remote_participant_guid, remote_identity_token);
+        (void)ddsrt_hh_add(impl->objectHash, remoteIdent);
+        (void)ddsrt_hh_add(impl->remoteGuidHash, remoteIdent);
+        relation = identityRelationNew(localIdent, remoteIdent, lchallenge, rchallenge);
+        (void)ddsrt_hh_add(remoteIdent->linkHash, relation);
+    } else {
+        /* When the remote identity has already been validated before,
+           check if the remote identity token matches with the existing one
+         */
+        if (!DDS_Security_DataHolder_equal(remoteIdent->remoteIdentityToken, remote_identity_token)) {
+            result = DDS_SECURITY_VALIDATION_FAILED;
+            DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result,
+                    "validate_remote_identity: remote_identity_token does not match with previously received one");
+            goto err_inv_duplicate;
+        }
+
+        relation = find_identity_relation(remoteIdent, SECURITY_OBJECT_HANDLE(localIdent));
+        if (!relation) {
+            relation = identityRelationNew(localIdent, remoteIdent, lchallenge, rchallenge);
+            r = ddsrt_hh_add(remoteIdent->linkHash, relation);
+            assert(r);
+            (void)r;
+        } else {
+            if (remote_auth_request_token) {
+                assert(rchallenge);
+                ddsrt_free(relation->rchallenge);
+                relation->rchallenge = rchallenge;
+            }
+            ddsrt_free(lchallenge);
+        }
+    }
+
+    ddsrt_mutex_unlock(&impl->lock);
+
+    if (!remote_auth_request_token) {
+        /* Create local_auth_request_token with contents set to the challenge */
+        fill_auth_request_token(local_auth_request_token, relation->lchallenge);
+    } else {
+        /* Set local_auth_request token to TokenNil */
+        DDS_Security_set_token_nil(local_auth_request_token);
+    }
+
+    *remote_identity_handle = IDENTITY_HANDLE(remoteIdent);;
+
+    if (memcmp(&localIdent->adjustedGUID, &remoteIdent->guid, sizeof(DDS_Security_GUID_t)) < 0) {
+        result = DDS_SECURITY_VALIDATION_PENDING_HANDSHAKE_REQUEST;
+    } else {
+        result = DDS_SECURITY_VALIDATION_PENDING_HANDSHAKE_MESSAGE;
+    }
+
+    return result;
+
+err_inv_duplicate:
+    ddsrt_free(lchallenge);
+err_alloc_challenge:
+    ddsrt_free(rchallenge);
+err_inv_auth_req_token:
+err_remote_identity_token:
+err_inv_handle:
+    ddsrt_mutex_unlock(&impl->lock);
+err_bad_param:
+    return DDS_SECURITY_VALIDATION_FAILED;
+}
+
+DDS_Security_ValidationResult_t
+begin_handshake_request(
+        dds_security_authentication *instance,
+        DDS_Security_HandshakeHandle *handshake_handle,
+        DDS_Security_HandshakeMessageToken *handshake_message,
+        const DDS_Security_IdentityHandle initiator_identity_handle,
+        const DDS_Security_IdentityHandle replier_identity_handle,
+        const DDS_Security_OctetSeq *serialized_local_participant_data,
+        DDS_Security_SecurityException *ex)
+{
+    DDS_Security_ValidationResult_t result = DDS_SECURITY_VALIDATION_OK;
+    dds_security_authentication_impl *impl = (dds_security_authentication_impl *) instance;
+    HandshakeInfo *handshake = NULL;
+    IdentityRelation *relation = NULL;
+    SecurityObject *obj;
+    LocalIdentityInfo *localIdent;
+    RemoteIdentityInfo *remoteIdent;
+    EVP_PKEY *dhkey;
+    DDS_Security_BinaryProperty_t *tokens;
+    DDS_Security_BinaryProperty_t *c_id;
+    DDS_Security_BinaryProperty_t *c_perm;
+    DDS_Security_BinaryProperty_t *c_pdata;
+    DDS_Security_BinaryProperty_t *c_dsign_algo;
+    DDS_Security_BinaryProperty_t *c_kagree_algo;
+    DDS_Security_BinaryProperty_t *hash_c1;
+    DDS_Security_BinaryProperty_t *dh1;
+    DDS_Security_BinaryProperty_t *challenge;
+    unsigned char *certData;
+    unsigned char *dhPubKeyData = NULL;
+    uint32_t certDataSize, dhPubKeyDataSize;
+    int created = 0;
+
+    /* validate provided arguments */
+    if (!instance || !handshake_handle || !handshake_message || !serialized_local_participant_data) {
+        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED,
+                "begin_handshake_request: Invalid parameter provided");
+        goto err_bad_param;
+    }
+
+    ddsrt_mutex_lock(&impl->lock);
+
+    obj = security_object_find(impl->objectHash, initiator_identity_handle);
+    if (!obj || !security_object_valid(obj, SECURITY_OBJECT_KIND_LOCAL_IDENTITY)) {
+        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED,
+                "begin_handshake_request: Invalid initiator_identity_handle provided");
+        goto err_inv_handle;
+    }
+    localIdent = (LocalIdentityInfo *) obj;
+
+    obj = security_object_find(impl->objectHash, replier_identity_handle);
+    if (!obj || !security_object_valid(obj, SECURITY_OBJECT_KIND_REMOTE_IDENTITY)) {
+        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED,
+                "begin_handshake_request: Invalid replier_identity_handle provided");
+        goto err_inv_handle;
+    }
+    remoteIdent = (RemoteIdentityInfo *)obj;
+
+    result = get_certificate_contents(localIdent->identityCert, &certData, &certDataSize, ex);
+    if (result != DDS_SECURITY_VALIDATION_OK) {
+        goto err_alloc_cid;
+    }
+
+    handshake = find_handshake(impl, SECURITY_OBJECT_HANDLE(localIdent), SECURITY_OBJECT_HANDLE(remoteIdent));
+    if (!handshake) {
+        relation = find_identity_relation(remoteIdent, SECURITY_OBJECT_HANDLE(localIdent));
+        assert(relation);
+        handshake = handshakeInfoNew(localIdent, remoteIdent, relation);
+        handshake->created_in = CREATEDREQUEST;
+        (void)ddsrt_hh_add(impl->objectHash, handshake);
+        created = 1;
+    } else {
+        relation = handshake->relation;
+        assert(relation);
+    }
+
+    if (!handshake->ldh) {
+        result = generate_dh_keys(&dhkey, localIdent->kagreeAlgoKind, ex);
+        if (result != DDS_SECURITY_VALIDATION_OK) {
+            goto err_gen_dh_keys;
+        }
+
+        handshake->ldh = dhkey;
+    }
+
+    result = dh_public_key_to_oct(handshake->ldh, localIdent->kagreeAlgoKind, &dhPubKeyData, &dhPubKeyDataSize, ex);
+    if (result != DDS_SECURITY_VALIDATION_OK) {
+        goto err_get_public_key;
+    }
+
+    if (localIdent->pdata._length == 0) {
+        DDS_Security_OctetSeq_copy(&localIdent->pdata, serialized_local_participant_data);
+    }
+
+    tokens = DDS_Security_BinaryPropertySeq_allocbuf(8);
+    c_id = &tokens[0];
+    c_perm = &tokens[1];
+    c_pdata = &tokens[2];
+    c_dsign_algo = &tokens[3];
+    c_kagree_algo = &tokens[4];
+    hash_c1 = &tokens[5];
+    dh1 = &tokens[6];
+    challenge = &tokens[7];
+
+    /* Store the Identity Certificate associated with the local identify in c.id property */
+    DDS_Security_BinaryProperty_set_by_ref(c_id, "c.id", certData, certDataSize);
+
+    /* Store the permission document in the c.perm property */
+    if (localIdent->permissionsDocument) {
+        DDS_Security_BinaryProperty_set_by_string(c_perm, "c.perm", localIdent->permissionsDocument);
+    } else {
+      DDS_Security_BinaryProperty_set_by_string(c_perm, "c.perm", "");
+    }
+
+    /* Store the provided local_participant_data in the c.pdata property */
+    DDS_Security_BinaryProperty_set_by_value(c_pdata, "c.pdata", serialized_local_participant_data->_buffer, serialized_local_participant_data->_length);
+
+    /* Set the used signing algorithm descriptor in c.dsign_algo */
+    DDS_Security_BinaryProperty_set_by_string(c_dsign_algo, "c.dsign_algo", get_dsign_algo(localIdent->dsignAlgoKind));
+
+    /* Set the used key algorithm descriptor in c.kagree_algo */
+    DDS_Security_BinaryProperty_set_by_string(c_kagree_algo, "c.kagree_algo", get_kagree_algo(localIdent->kagreeAlgoKind));
+
+    /* Calculate the hash_c1 */
+    {
+        DDS_Security_BinaryPropertySeq bseq;
+
+        bseq._length = 5;
+        bseq._buffer = tokens;
+
+        get_hash_binary_property_seq(&bseq, handshake->hash_c1);
+        DDS_Security_BinaryProperty_set_by_value(hash_c1, "hash_c1", handshake->hash_c1, sizeof(HashValue_t));
+    }
+
+    /* Set the DH public key associated with the local participant in dh1 property */
+    assert(dhPubKeyData);
+    assert(dhPubKeyDataSize < 1200);
+    DDS_Security_BinaryProperty_set_by_ref(dh1, "dh1", dhPubKeyData, dhPubKeyDataSize);
+
+    /* Set the challenge in challenge1 property */
+    DDS_Security_BinaryProperty_set_by_value(challenge, "challenge1", relation->lchallenge->value, sizeof(AuthenticationChallenge));
+
+    (void)ddsrt_hh_add(impl->objectHash, handshake);
+
+    ddsrt_mutex_unlock(&impl->lock);
+
+    handshake_message->class_id = ddsrt_strdup(AUTH_HANDSHAKE_REQUEST_TOKEN_ID);
+    handshake_message->properties._length  = 0;
+    handshake_message->properties._buffer  = NULL;
+    handshake_message->binary_properties._length = 8;
+    handshake_message->binary_properties._buffer = tokens;
+    *handshake_handle = HANDSHAKE_HANDLE(handshake);
+
+    return DDS_SECURITY_VALIDATION_PENDING_HANDSHAKE_MESSAGE;
+
+err_get_public_key:
+err_gen_dh_keys:
+    if (created) {
+        (void)ddsrt_hh_remove(impl->objectHash, handshake);
+        security_object_free((SecurityObject *)handshake);
+    }
+err_alloc_cid:
+    ddsrt_free(certData);
+err_inv_handle:
+    ddsrt_mutex_unlock(&impl->lock);
+err_bad_param:
+    return DDS_SECURITY_VALIDATION_FAILED;
+}
+
+static DDS_Security_ValidationResult_t
+validate_pdata(
+    const DDS_Security_OctetSeq *seq,
+    X509 *cert,
+    DDS_Security_SecurityException *ex)
+{
+    DDS_Security_ValidationResult_t result = DDS_SECURITY_VALIDATION_OK;
+    DDS_Security_Deserializer deserializer;
+    DDS_Security_ParticipantBuiltinTopicData *pdata;
+    DDS_Security_GUID_t cguid, aguid;
+
+    deserializer = DDS_Security_Deserializer_new(seq->_buffer, seq->_length);
+    if (!deserializer) {
+        result = DDS_SECURITY_VALIDATION_FAILED;
+        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result,
+                "begin_handshake_reply: c.pdata invalid encoding");
+        goto err_invalid_data;
+    }
+
+    pdata = DDS_Security_ParticipantBuiltinTopicData_alloc();
+
+    if (!DDD_Security_Deserialize_ParticipantBuiltinTopicData(deserializer, pdata, ex)) {
+        result = DDS_SECURITY_VALIDATION_FAILED;
+        goto err_incorrect_data;
+    }
+
+    memset(&cguid, 0, sizeof(DDS_Security_GUID_t));
+    result = get_adjusted_participant_guid(cert, &cguid, &aguid, ex);
+    if (result == DDS_SECURITY_VALIDATION_OK) {
+        DDS_Security_BuiltinTopicKey_t key;
+        DDD_Security_BuiltinTopicKeyBE(key, pdata->key);
+        if (memcmp(key, aguid.prefix, 6) != 0) {
+            result = DDS_SECURITY_VALIDATION_FAILED;
+              DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result,
+                      "begin_handshake_reply: c.pdata contains incorrect participant guid");
+        }
+    }
+
+err_incorrect_data:
+    DDS_Security_ParticipantBuiltinTopicData_free(pdata);
+    DDS_Security_Deserializer_free(deserializer);
+err_invalid_data:
+    return result;
+}
+
+static DDS_Security_ValidationResult_t
+validate_handshake_request_token(
+    const DDS_Security_HandshakeMessageToken *token,
+    HandshakeInfo *handshake,
+    X509Seq *trusted_ca_list,
+    DDS_Security_SecurityException *ex)
+{
+    DDS_Security_ValidationResult_t result = DDS_SECURITY_VALIDATION_OK;
+    IdentityRelation *relation = handshake->relation;
+    X509 *identityCert;
+    const DDS_Security_BinaryProperty_t *c_id;
+    const DDS_Security_BinaryProperty_t *c_perm;
+    const DDS_Security_BinaryProperty_t *c_pdata;
+    const DDS_Security_BinaryProperty_t *c_dsign_algo;
+    const DDS_Security_BinaryProperty_t *c_kagree_algo;
+    const DDS_Security_BinaryProperty_t *dh1;
+    const DDS_Security_BinaryProperty_t *challenge;
+    const DDS_Security_BinaryProperty_t *hash_c1;
+    EVP_PKEY *pdhkey = NULL;
+    AuthenticationAlgoKind_t dsignAlgoKind;
+    AuthenticationAlgoKind_t kagreeAlgoKind;
+    unsigned i;
+
+    assert(relation);
+
+    /* Check class_id */
+    if (!token->class_id ||
+        (strncmp(AUTH_HANDSHAKE_REQUEST_TOKEN_ID, token->class_id, strlen(AUTH_HANDSHAKE_REQUEST_TOKEN_ID)) != 0)) {
+        result = DDS_SECURITY_VALIDATION_FAILED;
+        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result,
+                "begin_handshake_reply: HandshakeMessageToken incorrect class_id: %s (expected %s)", token->class_id ? token->class_id: "NULL", AUTH_HANDSHAKE_REQUEST_TOKEN_ID);
+        goto err_inv_class_id;
+    }
+
+    /* Check presents of mandatory properties
+     * - c.id
+     * - c.perm
+     * - c.pdata
+     * - c.dsign_algo
+     * - c.kagree_algo
+     * - dh1
+     * - challenge1
+     */
+    c_id = DDS_Security_DataHolder_find_binary_property(token, "c.id");
+    if (!c_id || (c_id->value._length == 0) || (c_id->value._buffer == NULL)) {
+        result = DDS_SECURITY_VALIDATION_FAILED;
+        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result,
+                "begin_handshake_reply: HandshakeMessageToken property c.id missing");
+        goto err_no_c_id;
+    }
+
+    result = load_X509_certificate_from_data((char*)c_id->value._buffer, (int)c_id->value._length, &identityCert, ex);
+    if (result != DDS_SECURITY_VALIDATION_OK) {
+        goto err_identity_cert_load;
+    }
+
+    if( trusted_ca_list->length == 0 ){ //no trusted set. check with local CA
+        result = verify_certificate(identityCert, relation->localIdentity->identityCA, ex);
+    }
+    else{
+        /* Make sure we have a clean exception, in case it was uninitialized. */
+        DDS_Security_Exception_clean(ex);
+        for (i = 0; i < trusted_ca_list->length; ++i) {
+            /* We'll only return the exception of the last one, if it failed. */
+            DDS_Security_Exception_reset(ex);
+            result = verify_certificate(identityCert, trusted_ca_list->buffer[i], ex);
+            if (result == DDS_SECURITY_VALIDATION_OK) {
+                break;
+            }
+        }
+    }
+
+    if (result != DDS_SECURITY_VALIDATION_OK) {
+        goto err_inv_identity_cert;
+    }
+
+    result = check_certificate_expiry( identityCert, ex);
+    if (result != DDS_SECURITY_VALIDATION_OK) {
+        goto err_inv_identity_cert;
+    }
+
+    c_perm = DDS_Security_DataHolder_find_binary_property(token, "c.perm");
+    if (!c_perm) {
+        result = DDS_SECURITY_VALIDATION_FAILED;
+        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result,
+                "begin_handshake_reply: HandshakeMessageToken property c.perm missing");
+        goto err_no_c_perm;
+    }
+
+    if (c_perm->value._length > 0) {
+        ddsrt_free(relation->remoteIdentity->permissionsDocument);
+        relation->remoteIdentity->permissionsDocument = string_from_data(c_perm->value._buffer, c_perm->value._length);
+    }
+
+    c_pdata = DDS_Security_DataHolder_find_binary_property(token, "c.pdata");
+    if (!c_pdata) {
+        result = DDS_SECURITY_VALIDATION_FAILED;
+        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result,
+                "begin_handshake_reply: HandshakeMessageToken property c.pdata missing");
+        goto err_no_c_pdata;
+    }
+
+    result = validate_pdata(&c_pdata->value, identityCert, ex);
+    if (result != DDS_SECURITY_VALIDATION_OK) {
+        goto err_inv_pdata;
+    }
+
+    c_dsign_algo = DDS_Security_DataHolder_find_binary_property(token, "c.dsign_algo");
+    if (!c_dsign_algo) {
+        result = DDS_SECURITY_VALIDATION_FAILED;
+        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result,
+                "begin_handshake_reply: HandshakeMessageToken property c.dsign_algo missing");
+        goto err_no_c_dsign_algo;
+    }
+
+    dsignAlgoKind = get_dsign_algo_from_string((const char *)c_dsign_algo->value._buffer);
+    if (dsignAlgoKind == AUTH_ALGO_KIND_UNKNOWN) {
+        result = DDS_SECURITY_VALIDATION_FAILED;
+        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result,
+                "begin_handshake_reply: HandshakeMessageToken property c.dsign_algo not supported");
+        goto err_no_c_dsign_algo;
+    }
+
+    c_kagree_algo = DDS_Security_DataHolder_find_binary_property(token, "c.kagree_algo");
+    if (!c_kagree_algo) {
+        result = DDS_SECURITY_VALIDATION_FAILED;
+        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result,
+                "begin_handshake_reply: HandshakeMessageToken property c.kagree_algo missing");
+        goto err_no_c_kagree_algo;
+    }
+
+    kagreeAlgoKind = get_kagree_algo_from_string((const char *)c_kagree_algo->value._buffer);
+    if (kagreeAlgoKind == AUTH_ALGO_KIND_UNKNOWN) {
+        result = DDS_SECURITY_VALIDATION_FAILED;
+        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result,
+                "begin_handshake_reply: HandshakeMessageToken property c.kagree_algo not support");
+        goto err_no_c_kagree_algo;
+    }
+
+    dh1 = DDS_Security_DataHolder_find_binary_property(token, "dh1");
+    if (!dh1 || dh1->value._length == 0 || dh1->value._buffer == NULL) {
+        result = DDS_SECURITY_VALIDATION_FAILED;
+        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result,
+                "begin_handshake_reply: HandshakeMessageToken property dh1 missing");
+        goto err_no_dh;
+    }
+
+    result = dh_oct_to_public_key(&pdhkey, kagreeAlgoKind, dh1->value._buffer, dh1->value._length, ex);
+    if (result != DDS_SECURITY_VALIDATION_OK) {
+        goto err_no_dh;
+    }
+
+    challenge = DDS_Security_DataHolder_find_binary_property(token, "challenge1");
+    if (!challenge) {
+        result = DDS_SECURITY_VALIDATION_FAILED;
+        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result,
+                "begin_handshake_reply: HandshakeMessageToken property challenge1 missing");
+        goto err_no_challenge;
+    }
+
+    if (challenge->value._length != sizeof(AuthenticationChallenge) || challenge->value._buffer == NULL) {
+        result = DDS_SECURITY_VALIDATION_FAILED;
+        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result,
+                "begin_handshake_reply: HandshakeMessageToken property challenge1 invalid");
+        goto err_no_challenge;
+    }
+
+    /* When validate_remote_identity was provided with a remote_auth_request_token
+     * then the future_challenge in the remote identity was set and the challenge1
+     * property of the handshake_request_token should be the same as the
+     * future_challenge stored in the remote identity.
+     */
+    if (relation->rchallenge) {
+        if (memcmp(relation->rchallenge->value, challenge->value._buffer, sizeof(AuthenticationChallenge)) != 0) {
+            result = DDS_SECURITY_VALIDATION_FAILED;
+             DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result,
+                     "begin_handshake_reply: HandshakeMessageToken property challenge1 does not match future_challenge");
+             goto err_no_challenge;
+        }
+    } else {
+        if (challenge->value._length == sizeof(relation->rchallenge->value)) {
+            relation->rchallenge = ddsrt_malloc(sizeof(AuthenticationChallenge));
+            memcpy(relation->rchallenge, challenge->value._buffer, challenge->value._length);
+        } else {
+            result = DDS_SECURITY_VALIDATION_FAILED;
+            DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result,
+                    "begin_handshake_reply: HandshakeMessageToken property challenge1 invalid (incorrect size)");
+            goto err_no_challenge;
+        }
+    }
+
+    /* Compute the hash_c1 value */
+    {
+        const DDS_Security_BinaryProperty_t * binary_properties[5];
+
+        binary_properties[0] = c_id;
+        binary_properties[1] = c_perm;
+        binary_properties[2] = c_pdata;
+        binary_properties[3] = c_dsign_algo;
+        binary_properties[4] = c_kagree_algo;
+
+        (void)compute_hash_value(&handshake->hash_c1[0], binary_properties, 5, NULL);
+    }
+
+    hash_c1 = DDS_Security_DataHolder_find_binary_property(token, "hash_c1");
+    if (hash_c1) {
+        if ((hash_c1->value._length == sizeof(HashValue_t)) &&
+            (memcmp(hash_c1->value._buffer, &handshake->hash_c1, sizeof(HashValue_t)) == 0)) {
+        } else {
+            result = DDS_SECURITY_VALIDATION_FAILED;
+            DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result,
+                    "begin_handshake_reply: HandshakeMessageToken property hash_c1 invalid (incorrect size)");
+            goto err_inv_hash_c1;
+        }
+    }
+
+    if (!relation->remoteIdentity->identityCert) {
+        relation->remoteIdentity->identityCert = identityCert;
+    } else {
+        X509_free(relation->remoteIdentity->identityCert);
+        relation->remoteIdentity->identityCert = identityCert;
+    }
+
+    relation->remoteIdentity->dsignAlgoKind = dsignAlgoKind;
+    relation->remoteIdentity->kagreeAlgoKind = kagreeAlgoKind;
+
+    DDS_Security_OctetSeq_copy(&relation->remoteIdentity->pdata, &c_pdata->value);
+
+    handshake->rdh = pdhkey;
+
+    return result;
+
+err_inv_hash_c1:
+err_no_challenge:
+    EVP_PKEY_free(pdhkey);
+err_no_dh:
+err_no_c_kagree_algo:
+err_no_c_dsign_algo:
+err_inv_pdata:
+err_no_c_pdata:
+err_no_c_perm:
+err_inv_identity_cert:
+    X509_free(identityCert);
+err_identity_cert_load:
+err_no_c_id:
+err_inv_class_id:
+    return result;
+}
+
+
+static DDS_Security_ValidationResult_t
+validate_handshake_reply_token(
+    const DDS_Security_HandshakeMessageToken *token,
+    HandshakeInfo *handshake,
+    EVP_PKEY **pdhkey,
+    X509Seq *trusted_ca_list,
+    DDS_Security_SecurityException *ex)
+{
+    DDS_Security_ValidationResult_t result = DDS_SECURITY_VALIDATION_OK;
+    IdentityRelation *relation = handshake->relation;
+    X509 *identityCert;
+    EVP_PKEY *public_key;
+    const DDS_Security_BinaryProperty_t *c_id;
+    const DDS_Security_BinaryProperty_t *c_perm;
+    const DDS_Security_BinaryProperty_t *c_pdata;
+    const DDS_Security_BinaryProperty_t *c_dsign_algo;
+    const DDS_Security_BinaryProperty_t *c_kagree_algo;
+    const DDS_Security_BinaryProperty_t *dh1;
+    const DDS_Security_BinaryProperty_t *dh2;
+    const DDS_Security_BinaryProperty_t *hash_c1;
+    const DDS_Security_BinaryProperty_t *hash_c2;
+    const DDS_Security_BinaryProperty_t *challenge1;
+    const DDS_Security_BinaryProperty_t *challenge2;
+    const DDS_Security_BinaryProperty_t *signature;
+    AuthenticationAlgoKind_t dsignAlgoKind;
+    AuthenticationAlgoKind_t kagreeAlgoKind;
+
+    unsigned i;
+
+    assert(relation);
+
+    /* Check class_id */
+    if (!token->class_id ||
+        (strncmp(AUTH_HANDSHAKE_REPLY_TOKEN_ID, token->class_id, strlen(AUTH_HANDSHAKE_REPLY_TOKEN_ID)) != 0)) {
+        result = DDS_SECURITY_VALIDATION_FAILED;
+        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result,
+                "process_handshake: HandshakeMessageToken incorrect class_id: %s (expected %s)", token->class_id ? token->class_id: "NULL", AUTH_HANDSHAKE_REPLY_TOKEN_ID);
+        goto err_inv_class_id;
+    }
+
+    /* Check presents of mandatory properties
+     * - c.id
+     * - c.perm
+     * - c.pdata
+     * - c.dsign_algo
+     * - c.kagree_algo
+     * - challenge1
+     * - dh2
+     * - challenge2
+     * - signature
+     */
+    c_id = DDS_Security_DataHolder_find_binary_property(token, "c.id");
+    if (!c_id || (c_id->value._length == 0) || (c_id->value._buffer == NULL)) {
+        result = DDS_SECURITY_VALIDATION_FAILED;
+        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result,
+                "process_handshake: HandshakeMessageToken property c.id missing");
+        goto err_no_c_id;
+    }
+
+    /* Verify Identity Certificate */
+    result = load_X509_certificate_from_data((char*)c_id->value._buffer, (int)c_id->value._length, &identityCert, ex);
+    if (result != DDS_SECURITY_VALIDATION_OK ) {
+        goto err_identity_cert_load;
+    }
+
+    if( trusted_ca_list->length == 0 ){ //no trusted set. check with local CA
+        result = verify_certificate(identityCert, relation->localIdentity->identityCA, ex);
+    }
+    else{
+        /* Make sure we have a clean exception, in case it was uninitialized. */
+        DDS_Security_Exception_clean(ex);
+        for (i = 0; i < trusted_ca_list->length; ++i) {
+            /* We'll only return the exception of the last one, if it failed. */
+            DDS_Security_Exception_reset(ex);
+            result = verify_certificate(identityCert, trusted_ca_list->buffer[i], ex);
+            if (result == DDS_SECURITY_VALIDATION_OK) {
+                break;
+            }
+        }
+    }
+
+    if (result != DDS_SECURITY_VALIDATION_OK) {
+        goto err_inv_identity_cert;
+    }
+
+    result = check_certificate_expiry( identityCert, ex);
+    if (result != DDS_SECURITY_VALIDATION_OK) {
+        goto err_inv_identity_cert;
+    }
+
+    c_perm = DDS_Security_DataHolder_find_binary_property(token, "c.perm");
+    if (!c_perm) {
+        result = DDS_SECURITY_VALIDATION_FAILED;
+        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result,
+                "process_handshake: HandshakeMessageToken property c.perm missing");
+        goto err_no_c_perm;
+    }
+
+    if (c_perm->value._length > 0) {
+        ddsrt_free(relation->remoteIdentity->permissionsDocument);
+        relation->remoteIdentity->permissionsDocument = string_from_data(c_perm->value._buffer, c_perm->value._length);
+    }
+
+    c_pdata = DDS_Security_DataHolder_find_binary_property(token, "c.pdata");
+    if (!c_pdata) {
+        result = DDS_SECURITY_VALIDATION_FAILED;
+        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result,
+                "process_handshake: HandshakeMessageToken property c.pdata missing");
+        goto err_no_c_pdata;
+    }
+
+    result = validate_pdata(&c_pdata->value, identityCert, ex);
+    if (result != DDS_SECURITY_VALIDATION_OK) {
+        goto err_inv_pdata;
+    }
+
+    c_dsign_algo = DDS_Security_DataHolder_find_binary_property(token, "c.dsign_algo");
+    if (!c_dsign_algo) {
+        result = DDS_SECURITY_VALIDATION_FAILED;
+        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result,
+                "process_handshake: HandshakeMessageToken property c.dsign_algo missing");
+        goto err_no_c_dsign_algo;
+    }
+
+    dsignAlgoKind = get_dsign_algo_from_string((const char *)c_dsign_algo->value._buffer);
+    if (dsignAlgoKind == AUTH_ALGO_KIND_UNKNOWN) {
+        result = DDS_SECURITY_VALIDATION_FAILED;
+        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result,
+                "process_handshake: HandshakeMessageToken property c.dsign_algo not supported");
+        goto err_no_c_dsign_algo;
+    }
+
+    c_kagree_algo = DDS_Security_DataHolder_find_binary_property(token, "c.kagree_algo");
+    if (!c_kagree_algo) {
+        result = DDS_SECURITY_VALIDATION_FAILED;
+        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result,
+                "process_handshake: HandshakeMessageToken property c.kagree_algo missing");
+        goto err_no_c_kagree_algo;
+    }
+
+    kagreeAlgoKind = get_kagree_algo_from_string((const char *)c_kagree_algo->value._buffer);
+    if (kagreeAlgoKind == AUTH_ALGO_KIND_UNKNOWN) {
+        result = DDS_SECURITY_VALIDATION_FAILED;
+        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result,
+                "process_handshake: HandshakeMessageToken property c.kagree_algo not support");
+        goto err_no_c_kagree_algo;
+    }
+
+    /* dh1 is optional  */
+    dh1 = DDS_Security_DataHolder_find_binary_property(token, "dh1");
+    DDSRT_UNUSED_ARG(dh1); /*print it for integration purposes */
+
+    dh2 = DDS_Security_DataHolder_find_binary_property(token, "dh2");
+    if (!dh2 || dh2->value._length == 0 || dh2->value._buffer == NULL) {
+        result = DDS_SECURITY_VALIDATION_FAILED;
+        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result,
+                "process_handshake: HandshakeMessageToken property dh2 missing");
+        goto err_no_dh;
+    }
+
+    hash_c1 = DDS_Security_DataHolder_find_binary_property(token, "hash_c1");
+    if (hash_c1) {
+        if ((hash_c1->value._length == sizeof(HashValue_t)) &&
+                (memcmp(hash_c1->value._buffer, handshake->hash_c1, sizeof(HashValue_t)) == 0)) {
+        } else {
+            result = DDS_SECURITY_VALIDATION_FAILED;
+            DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result,
+                    "begin_handshake_reply: HandshakeMessageToken property hash_c1 invalid");
+            goto err_inv_hash_c1;
+        }
+    }
+
+    /* Compute the hash_c2 value */
+    {
+        const DDS_Security_BinaryProperty_t * binary_properties[5];
+
+        binary_properties[0] = c_id;
+        binary_properties[1] = c_perm;
+        binary_properties[2] = c_pdata;
+        binary_properties[3] = c_dsign_algo;
+        binary_properties[4] = c_kagree_algo;
+
+        (void)compute_hash_value(&handshake->hash_c2[0], binary_properties, 5, NULL);
+    }
+
+    hash_c2 = DDS_Security_DataHolder_find_binary_property(token, "hash_c2");
+    if (hash_c2) {
+        if ((hash_c2->value._length == sizeof(HashValue_t)) &&
+            (memcmp(hash_c2->value._buffer, handshake->hash_c2, sizeof(HashValue_t)) == 0)) {
+        } else {
+            result = DDS_SECURITY_VALIDATION_FAILED;
+            DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result,
+                    "begin_handshake_reply: HandshakeMessageToken property hash_c2 invalid");
+            goto err_inv_hash_c2;
+        }
+    }
+
+    signature = DDS_Security_DataHolder_find_binary_property(token, "signature");
+    if (!signature || signature->value._length == 0 || signature->value._buffer == NULL) {
+        result = DDS_SECURITY_VALIDATION_FAILED;
+        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result,
+                "process_handshake: HandshakeMessageToken property signature missing");
+        goto err_no_signature;
+    }
+
+    *pdhkey = NULL;
+    result = dh_oct_to_public_key(pdhkey, kagreeAlgoKind, dh2->value._buffer, dh2->value._length, ex);
+    if (result != DDS_SECURITY_VALIDATION_OK) {
+        goto err_inv_dh;
+    }
+
+    challenge1 = DDS_Security_DataHolder_find_binary_property(token, "challenge1");
+    if (!challenge1) {
+        result = DDS_SECURITY_VALIDATION_FAILED;
+        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result,
+                "process_handshake: HandshakeMessageToken property challenge1 missing");
+        goto err_no_challenge;
+    }
+
+    if (challenge1->value._length != sizeof(AuthenticationChallenge) || challenge1->value._buffer == NULL) {
+        result = DDS_SECURITY_VALIDATION_FAILED;
+        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result,
+                "process_handshake: HandshakeMessageToken property challenge1 invalid");
+        goto err_no_challenge;
+    }
+
+
+    challenge2 = DDS_Security_DataHolder_find_binary_property(token, "challenge2");
+    if (!challenge2) {
+        result = DDS_SECURITY_VALIDATION_FAILED;
+        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result,
+                "process_handshake: HandshakeMessageToken property challenge2 missing");
+        goto err_no_challenge;
+    }
+
+    if (challenge2->value._length != sizeof(AuthenticationChallenge) || challenge2->value._buffer == NULL) {
+        result = DDS_SECURITY_VALIDATION_FAILED;
+        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result,
+                "process_handshake: HandshakeMessageToken property challenge2 invalid");
+        goto err_no_challenge;
+    }
+    /* When validate_remote_identity was provided with a remote_auth_request_token
+     * then the future_challenge in the remote identity was set and the challenge2
+     * property of the handshake_reply_token should be the same as the
+     * future_challenge stored in the remote identity.
+     */
+
+
+
+    if (relation->rchallenge) {
+        if (memcmp(relation->rchallenge->value, challenge2->value._buffer, sizeof(AuthenticationChallenge)) != 0) {
+            result = DDS_SECURITY_VALIDATION_FAILED;
+             DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result,
+                     "process_handshake: HandshakeMessageToken property challenge2 does not match future_challenge");
+             goto err_no_challenge;
+        }
+    } else {
+        if (challenge2->value._length == sizeof(relation->rchallenge->value)) {
+            relation->rchallenge = ddsrt_malloc(sizeof(AuthenticationChallenge));
+            memcpy(relation->rchallenge, challenge2->value._buffer, challenge2->value._length);
+        } else {
+            result = DDS_SECURITY_VALIDATION_FAILED;
+              DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result,
+                      "process_handshake: HandshakeMessageToken property challenge2 invalid (incorrect size)");
+              goto err_no_challenge;
+        }
+    }
+
+
+    if (relation->lchallenge) {
+        if (memcmp(relation->lchallenge->value, challenge1->value._buffer, sizeof(AuthenticationChallenge)) != 0) {
+            result = DDS_SECURITY_VALIDATION_FAILED;
+            DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result,
+                 "process_handshake: HandshakeMessageToken property challenge1 does not match future_challenge");
+            goto err_no_challenge;
+        }
+    } else {
+        result = DDS_SECURITY_VALIDATION_FAILED;
+        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result,
+             "process_handshake: No future challenge exists for this token");
+        goto err_no_challenge;
+    }
+
+
+    /* TODO: check if an identity certificate was already associated with the remote identity and
+     * when that is the case both should be the same
+     */
+    if (!relation->remoteIdentity->identityCert) {
+        relation->remoteIdentity->identityCert = identityCert;
+    } else {
+        X509_free(relation->remoteIdentity->identityCert);
+        relation->remoteIdentity->identityCert = identityCert;
+    }
+
+    relation->remoteIdentity->dsignAlgoKind = dsignAlgoKind;
+    relation->remoteIdentity->kagreeAlgoKind = kagreeAlgoKind;
+
+
+    public_key = X509_get_pubkey(relation->remoteIdentity->identityCert);
+    if (public_key) {
+        /*prepare properties*/
+        const DDS_Security_BinaryProperty_t *properties[HANDSHAKE_SIGNATURE_CONTENT_SIZE];
+        DDS_Security_BinaryProperty_t *hash_c1_val = hash_value_to_binary_property("hash_c1", handshake->hash_c1);
+        DDS_Security_BinaryProperty_t *hash_c2_val = hash_value_to_binary_property("hash_c2", handshake->hash_c2);
+
+        properties[0] = hash_c2_val;
+        properties[1] = challenge2;
+        properties[2] = dh2;
+        properties[3] = challenge1;
+        properties[4] = dh1;
+        properties[5] = hash_c1_val;
+
+        result = validate_signature(public_key,properties, HANDSHAKE_SIGNATURE_CONTENT_SIZE, signature->value._buffer,signature->value._length, ex);
+
+        EVP_PKEY_free(public_key);
+        DDS_Security_BinaryProperty_free(hash_c1_val);
+        DDS_Security_BinaryProperty_free(hash_c2_val);
+
+        if( result != DDS_SECURITY_VALIDATION_OK) {
+            goto err_inv_signature;
+        }
+    } else {
+        result = DDS_SECURITY_VALIDATION_FAILED;
+        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result, "X509_get_pubkey failed");
+        goto err_inv_identity_cert;
+    }
+
+
+    DDS_Security_OctetSeq_copy(&relation->remoteIdentity->pdata, &c_pdata->value);
+
+    return result;
+
+err_inv_signature:
+err_no_challenge:
+err_inv_dh:
+err_no_signature:
+err_inv_hash_c2:
+err_inv_hash_c1:
+err_no_dh:
+err_no_c_kagree_algo:
+err_no_c_dsign_algo:
+err_inv_pdata:
+err_no_c_pdata:
+err_no_c_perm:
+err_inv_identity_cert:
+    X509_free(identityCert);
+err_identity_cert_load:
+err_no_c_id:
+err_inv_class_id:
+    return result;
+}
+
+
+static DDS_Security_ValidationResult_t
+validate_handshake_final_token(
+    const DDS_Security_HandshakeMessageToken *token,
+    HandshakeInfo *handshake,
+    DDS_Security_SecurityException *ex)
+{
+    DDS_Security_ValidationResult_t result = DDS_SECURITY_VALIDATION_OK;
+    IdentityRelation *relation = handshake->relation;
+    const DDS_Security_BinaryProperty_t *dh1;
+    const DDS_Security_BinaryProperty_t *dh2;
+    const DDS_Security_BinaryProperty_t *hash_c1;
+    const DDS_Security_BinaryProperty_t *hash_c2;
+    const DDS_Security_BinaryProperty_t *challenge1;
+    const DDS_Security_BinaryProperty_t *challenge2;
+    const DDS_Security_BinaryProperty_t *signature;
+    EVP_PKEY *public_key;
+
+    assert(relation);
+
+    /* Check class_id */
+    if (!token->class_id ||
+        (strncmp(AUTH_HANDSHAKE_FINAL_TOKEN_ID, token->class_id, strlen(AUTH_HANDSHAKE_FINAL_TOKEN_ID)) != 0)) {
+        result = DDS_SECURITY_VALIDATION_FAILED;
+        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result,
+                "process_handshake: HandshakeMessageToken incorrect class_id: %s (expected %s)", token->class_id ? token->class_id: "NULL", AUTH_HANDSHAKE_FINAL_TOKEN_ID);
+        goto err_inv_class_id;
+    }
+
+    /* Check presents of mandatory properties
+     * - challenge1
+     * - challenge2
+     * - signature
+     */
+
+
+    /* dh1 is optional  */
+    dh1 = DDS_Security_DataHolder_find_binary_property(token, "dh1");
+
+    DDSRT_UNUSED_ARG(dh1); /*print it for integration purposes */
+
+    /* dh2 is optional  */
+    dh2 = DDS_Security_DataHolder_find_binary_property(token, "dh2");
+    DDSRT_UNUSED_ARG(dh2); /*print it for integration purposes */
+
+    /* hash_c1 is optional  */
+    hash_c1 = DDS_Security_DataHolder_find_binary_property(token, "hash_c1");
+    if (hash_c1) {
+        if ((hash_c1->value._length == sizeof(HashValue_t)) &&
+                (memcmp(hash_c1->value._buffer, handshake->hash_c1, sizeof(HashValue_t)) == 0)) {
+        } else {
+            result = DDS_SECURITY_VALIDATION_FAILED;
+            DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result,
+                    "begin_handshake_reply: HandshakeMessageToken property hash_c1 invalid");
+            goto err_inv_hash_c1;
+        }
+    }
+
+    /* hash_c2 is optional  */
+    hash_c2 = DDS_Security_DataHolder_find_binary_property(token, "hash_c2");
+    if (hash_c2) {
+        if ((hash_c2->value._length == sizeof(HashValue_t)) &&
+            (memcmp(hash_c2->value._buffer, handshake->hash_c2, sizeof(HashValue_t)) == 0)) {
+        } else {
+            result = DDS_SECURITY_VALIDATION_FAILED;
+            DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result,
+                    "begin_handshake_reply: HandshakeMessageToken property hash_c2 invalid");
+            goto err_inv_hash_c2;
+        }
+    }
+
+    challenge1 = DDS_Security_DataHolder_find_binary_property(token, "challenge1");
+    if (!challenge1) {
+        result = DDS_SECURITY_VALIDATION_FAILED;
+        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result,
+                "process_handshake: HandshakeMessageToken property challenge1 missing");
+        goto err_no_challenge;
+    }
+
+    if (challenge1->value._length != sizeof(AuthenticationChallenge) || challenge1->value._buffer == NULL) {
+        result = DDS_SECURITY_VALIDATION_FAILED;
+        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result,
+                "process_handshake: HandshakeMessageToken property challenge1 invalid");
+        goto err_no_challenge;
+    }
+
+
+    challenge2 = DDS_Security_DataHolder_find_binary_property(token, "challenge2");
+    if (!challenge2) {
+        result = DDS_SECURITY_VALIDATION_FAILED;
+        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result,
+                "process_handshake: HandshakeMessageToken property challenge2 missing");
+        goto err_no_challenge;
+    }
+
+    if (challenge2->value._length != sizeof(AuthenticationChallenge) || challenge2->value._buffer == NULL) {
+        result = DDS_SECURITY_VALIDATION_FAILED;
+        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result,
+                "process_handshake: HandshakeMessageToken property challenge2 invalid");
+        goto err_no_challenge;
+    }
+
+    /* When validate_remote_identity was provided with a remote_auth_request_token
+     * then the future_challenge in the remote identity was set and the challenge1
+     * property of the handshake_reply_token should be the same as the
+     * future_challenge stored in the remote identity.
+     */
+
+
+
+    if (relation->rchallenge) {
+        if (memcmp(relation->rchallenge->value, challenge1->value._buffer, sizeof(AuthenticationChallenge)) != 0) {
+            result = DDS_SECURITY_VALIDATION_FAILED;
+             DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result,
+                     "process_handshake: HandshakeMessageToken property challenge1 does not match future_challenge");
+             goto err_no_challenge;
+        }
+    } else {
+        result = DDS_SECURITY_VALIDATION_FAILED;
+        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result,
+             "process_handshake: No challenge exists to check challenge1 in the token.");
+        goto err_no_challenge;
+    }
+
+    if (relation->lchallenge) {
+        if (memcmp(relation->lchallenge->value, challenge2->value._buffer, sizeof(AuthenticationChallenge)) != 0) {
+            result = DDS_SECURITY_VALIDATION_FAILED;
+             DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result,
+                     "process_handshake: HandshakeMessageToken property challenge2 does not match future_challenge");
+             goto err_no_challenge;
+        }
+    } else {
+        result = DDS_SECURITY_VALIDATION_FAILED;
+        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result,
+             "process_handshake: No challenge exists to check challenge2 in the token.");
+        goto err_no_challenge;
+    }
+
+    signature = DDS_Security_DataHolder_find_binary_property(token, "signature");
+    if (!signature) {
+        result = DDS_SECURITY_VALIDATION_FAILED;
+        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result,
+                "process_handshake: HandshakeMessageToken property signature missing");
+        goto err_no_challenge;
+    }
+
+    /* Validate signature */
+    public_key = X509_get_pubkey(relation->remoteIdentity->identityCert);
+    if (public_key) {
+        /*prepare properties*/
+        const DDS_Security_BinaryProperty_t *properties[HANDSHAKE_SIGNATURE_CONTENT_SIZE];
+        DDS_Security_BinaryProperty_t *hash_c1_val = hash_value_to_binary_property("hash_c1", handshake->hash_c1);
+        DDS_Security_BinaryProperty_t *hash_c2_val = hash_value_to_binary_property("hash_c2", handshake->hash_c2);
+
+        properties[0] = hash_c1_val;
+        properties[1] = challenge1;
+        properties[2] = dh1;
+        properties[3] = challenge2;
+        properties[4] = dh2;
+        properties[5] = hash_c2_val;
+
+        result = validate_signature(public_key,properties, HANDSHAKE_SIGNATURE_CONTENT_SIZE ,signature->value._buffer,signature->value._length,ex );
+
+        EVP_PKEY_free(public_key);
+        DDS_Security_BinaryProperty_free(hash_c1_val);
+        DDS_Security_BinaryProperty_free(hash_c2_val);
+
+        if (result != DDS_SECURITY_VALIDATION_OK) {
+            goto err_inv_signature;
+        }
+    } else {
+        result = DDS_SECURITY_VALIDATION_FAILED;
+        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result, "X509_get_pubkey failed");
+        goto err_inv_identity_cert;
+    }
+
+err_inv_hash_c2:
+err_inv_hash_c1:
+err_no_challenge:
+err_inv_class_id:
+err_inv_identity_cert:
+err_inv_signature:
+    return result;
+}
+
+DDS_Security_ValidationResult_t
+begin_handshake_reply(
+        dds_security_authentication *instance,
+        DDS_Security_HandshakeHandle *handshake_handle,
+        DDS_Security_HandshakeMessageToken *handshake_message_out,
+        const DDS_Security_HandshakeMessageToken *handshake_message_in,
+        const DDS_Security_IdentityHandle initiator_identity_handle,
+        const DDS_Security_IdentityHandle replier_identity_handle,
+        const DDS_Security_OctetSeq *serialized_local_participant_data,
+        DDS_Security_SecurityException *ex)
+{
+    DDS_Security_ValidationResult_t result = DDS_SECURITY_VALIDATION_OK;
+    dds_security_authentication_impl *impl = (dds_security_authentication_impl *) instance;
+    HandshakeInfo *handshake = NULL;
+    IdentityRelation *relation = NULL;
+    SecurityObject *obj;
+    LocalIdentityInfo *localIdent;
+    RemoteIdentityInfo *remoteIdent;
+    EVP_PKEY *dhkeyLocal = NULL;
+    DDS_Security_BinaryProperty_t *tokens;
+    DDS_Security_BinaryProperty_t *c_id;
+    DDS_Security_BinaryProperty_t *c_perm;
+    DDS_Security_BinaryProperty_t *c_pdata;
+    DDS_Security_BinaryProperty_t *c_dsign_algo;
+    DDS_Security_BinaryProperty_t *c_kagree_algo;
+    DDS_Security_BinaryProperty_t *hash_c1;
+    const DDS_Security_BinaryProperty_t *hash_c1_ref;
+    DDS_Security_BinaryProperty_t *hash_c2;
+    DDS_Security_BinaryProperty_t *dh1;
+    const DDS_Security_BinaryProperty_t *dh1_ref;
+    DDS_Security_BinaryProperty_t *dh2;
+    DDS_Security_BinaryProperty_t *challenge1;
+    DDS_Security_BinaryProperty_t *challenge2;
+    DDS_Security_BinaryProperty_t *signature;
+    unsigned char *certData;
+    unsigned char *dhPubKeyData;
+    uint32_t certDataSize, dhPubKeyDataSize;
+    uint32_t tokenSize, idx;
+    int created = 0;
+
+    /* validate provided arguments */
+    if (!instance || !handshake_handle || !handshake_message_out || !handshake_message_in || !serialized_local_participant_data) {
+        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED,
+                "begin_handshake_reply: Invalid parameter provided");
+        goto err_bad_param;
+    }
+
+    if ((serialized_local_participant_data->_length == 0) || (serialized_local_participant_data->_buffer == NULL)) {
+        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED,
+                "begin_handshake_reply: Invalid parameter provided");
+        goto err_bad_param;
+    }
+
+    ddsrt_mutex_lock(&impl->lock);
+
+    obj = security_object_find(impl->objectHash, replier_identity_handle);
+    if (!obj || !security_object_valid(obj, SECURITY_OBJECT_KIND_LOCAL_IDENTITY)) {
+        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED,
+                "begin_handshake_reply: Invalid replier_identity_handle provided");
+        goto err_inv_handle;
+    }
+    localIdent = (LocalIdentityInfo *) obj;
+
+    obj = security_object_find(impl->objectHash, initiator_identity_handle);
+    if (!obj || !security_object_valid(obj, SECURITY_OBJECT_KIND_REMOTE_IDENTITY)) {
+        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED,
+                "begin_handshake_reply: Invalid initiator_identity_handle provided");
+        goto err_inv_handle;
+    }
+    remoteIdent = (RemoteIdentityInfo *)obj;
+
+    handshake = find_handshake(impl, SECURITY_OBJECT_HANDLE(localIdent), SECURITY_OBJECT_HANDLE(remoteIdent));
+    if (!handshake) {
+        relation = find_identity_relation(remoteIdent, SECURITY_OBJECT_HANDLE(localIdent));
+        assert(relation);
+        handshake = handshakeInfoNew(localIdent, remoteIdent, relation);
+        handshake->created_in = CREATEDREPLY;
+        (void)ddsrt_hh_add(impl->objectHash, handshake);
+        created = 1;
+    } else {
+        relation = handshake->relation;
+        assert(relation);
+    }
+
+    result = validate_handshake_request_token(handshake_message_in, handshake, &(impl->trustedCAList), ex);
+    if (result != DDS_SECURITY_VALIDATION_OK) {
+        goto err_inv_token;
+    }
+
+    result = get_certificate_contents(localIdent->identityCert, &certData, &certDataSize, ex);
+    if (result != DDS_SECURITY_VALIDATION_OK) {
+        goto err_alloc_cid;
+    }
+
+    if (!handshake->ldh) {
+        result = generate_dh_keys(&dhkeyLocal, remoteIdent->kagreeAlgoKind, ex);
+        if (result != DDS_SECURITY_VALIDATION_OK) {
+            goto err_gen_dh_keys;
+        }
+
+        handshake->ldh = dhkeyLocal;
+        EVP_PKEY_copy_parameters(handshake->rdh, handshake->ldh);
+    }
+
+    result = dh_public_key_to_oct(handshake->ldh, remoteIdent->kagreeAlgoKind, &dhPubKeyData, &dhPubKeyDataSize, ex);
+    if (result != DDS_SECURITY_VALIDATION_OK) {
+        goto err_get_public_key;
+    }
+
+    if (localIdent->pdata._length == 0) {
+        DDS_Security_OctetSeq_copy(&localIdent->pdata, serialized_local_participant_data);
+    }
+
+    hash_c1_ref = DDS_Security_DataHolder_find_binary_property(handshake_message_in, "hash_c1");
+    tokenSize = hash_c1_ref ? 12 : 11;
+
+    tokens = DDS_Security_BinaryPropertySeq_allocbuf(tokenSize);
+    idx = 0;
+    c_id = &tokens[idx++];
+    c_perm = &tokens[idx++];
+    c_pdata = &tokens[idx++];
+    c_dsign_algo = &tokens[idx++];
+    c_kagree_algo = &tokens[idx++];
+    signature = &tokens[idx++];
+    hash_c2 = &tokens[idx++];
+    challenge2 = &tokens[idx++];
+    dh2 = &tokens[idx++];
+    challenge1 = &tokens[idx++];
+    dh1 = &tokens[idx++];
+    hash_c1 = hash_c1_ref ? &tokens[idx++] : NULL;
+
+    /* Store the Identity Certificate associated with the local identify in c.id property */
+    DDS_Security_BinaryProperty_set_by_ref(c_id, "c.id", certData, certDataSize);
+    certData = NULL;
+
+    /* Store the permission document in the c.perm property */
+    if (localIdent->permissionsDocument) {
+        DDS_Security_BinaryProperty_set_by_string(c_perm, "c.perm", localIdent->permissionsDocument);
+    } else {
+        DDS_Security_BinaryProperty_set_by_string(c_perm, "c.perm", "");
+    }
+
+    /* Store the provided local_participant_data in the c.pdata property */
+    DDS_Security_BinaryProperty_set_by_value(c_pdata, "c.pdata", serialized_local_participant_data->_buffer, serialized_local_participant_data->_length);
+
+    /* Set the used signing algorithm descriptor in c.dsign_algo */
+    DDS_Security_BinaryProperty_set_by_string(c_dsign_algo, "c.dsign_algo", get_dsign_algo(localIdent->dsignAlgoKind));
+
+    /* Set the used key algorithm descriptor in c.kagree_algo */
+    DDS_Security_BinaryProperty_set_by_string(c_kagree_algo, "c.kagree_algo", get_kagree_algo(remoteIdent->kagreeAlgoKind));
+
+    /* Calculate the hash_c2 */
+    {
+        DDS_Security_BinaryPropertySeq bseq;
+
+        bseq._length = 5;
+        bseq._buffer = tokens;
+
+        get_hash_binary_property_seq(&bseq, handshake->hash_c2);
+        DDS_Security_BinaryProperty_set_by_value(hash_c2, "hash_c2", handshake->hash_c2, sizeof(HashValue_t));
+    }
+
+    /* Set the DH public key associated with the local participant in dh2 property */
+    DDS_Security_BinaryProperty_set_by_ref(dh2, "dh2", dhPubKeyData, dhPubKeyDataSize);
+
+    /* Set the DH public key associated with the local participant in hash_c1 property */
+    if (hash_c1) {
+        DDS_Security_BinaryProperty_set_by_value(hash_c1, "hash_c1", hash_c1_ref->value._buffer, hash_c1_ref->value._length);
+    }
+
+    /* Set the DH public key associated with the local participant in dh1 property */
+    if (dh1) {
+        dh1_ref = DDS_Security_DataHolder_find_binary_property(handshake_message_in, "dh1");
+        if (dh1_ref) {
+            DDS_Security_BinaryProperty_set_by_value(dh1, "dh1", dh1_ref->value._buffer, dh1_ref->value._length);
+        }
+    }
+
+    /* Set the challenge in challenge1 property */
+    assert(relation->rchallenge);
+    DDS_Security_BinaryProperty_set_by_value(challenge1, "challenge1", relation->rchallenge->value, sizeof(AuthenticationChallenge));
+
+    /* Set the challenge in challenge2 property */
+    assert(relation->lchallenge);
+
+    DDS_Security_BinaryProperty_set_by_value(challenge2, "challenge2", relation->lchallenge->value, sizeof(AuthenticationChallenge));
+
+    /* Calculate the signature */
+    {
+        unsigned char *sign;
+        size_t signlen;
+        const DDS_Security_BinaryProperty_t * binary_properties[ HANDSHAKE_SIGNATURE_CONTENT_SIZE ];
+        DDS_Security_BinaryProperty_t *hash_c1_val = hash_value_to_binary_property("hash_c1", handshake->hash_c1);
+        DDS_Security_BinaryProperty_t *hash_c2_val = hash_value_to_binary_property("hash_c2", handshake->hash_c2);
+
+        binary_properties[0] = hash_c2_val;
+        binary_properties[1] = challenge2;
+        binary_properties[2] = dh2;
+        binary_properties[3] = challenge1;
+        binary_properties[4] = dh1;
+        binary_properties[5] = hash_c1_val;
+
+        result = create_signature(localIdent->privateKey, binary_properties, HANDSHAKE_SIGNATURE_CONTENT_SIZE , &sign, &signlen, ex);
+
+        DDS_Security_BinaryProperty_free(hash_c1_val);
+        DDS_Security_BinaryProperty_free(hash_c2_val);
+
+        if (result != DDS_SECURITY_VALIDATION_OK) {
+            goto err_signature;
+        }
+        DDS_Security_BinaryProperty_set_by_ref(signature, "signature", sign, (uint32_t)signlen);
+    }
+
+    (void)ddsrt_hh_add(impl->objectHash, handshake);
+
+    handshake_message_out->class_id = ddsrt_strdup(AUTH_HANDSHAKE_REPLY_TOKEN_ID);
+    handshake_message_out->binary_properties._length = tokenSize;
+    handshake_message_out->binary_properties._buffer = tokens;
+
+    ddsrt_mutex_unlock(&impl->lock);
+
+
+    *handshake_handle = HANDSHAKE_HANDLE(handshake);
+
+    if (result == DDS_SECURITY_VALIDATION_OK) {
+        result = DDS_SECURITY_VALIDATION_PENDING_HANDSHAKE_MESSAGE;
+    }
+
+    return result;
+
+err_signature:
+    free_binary_properties(tokens, tokenSize);
+err_get_public_key:
+err_gen_dh_keys:
+    ddsrt_free(certData);
+err_alloc_cid:
+err_inv_token:
+    if (created) {
+        (void)ddsrt_hh_remove(impl->objectHash, handshake);
+        security_object_free((SecurityObject *)handshake);
+    }
+err_inv_handle:
+    ddsrt_mutex_unlock(&impl->lock);
+err_bad_param:
+    return DDS_SECURITY_VALIDATION_FAILED;
+}
+
+
+static bool
+generate_shared_secret(
+    const HandshakeInfo *handshake,
+    unsigned char **shared_secret,
+    DDS_Security_long *length,
+    DDS_Security_SecurityException *ex)
+{
+    bool result = false;
+    EVP_PKEY_CTX *ctx;
+    size_t skeylen;
+    unsigned char *secret = NULL;
+
+    *shared_secret = NULL;
+
+    ctx = EVP_PKEY_CTX_new( handshake->ldh, NULL /* no engine */);
+    if (!ctx)
+    {
+        DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED,
+                        "process_handshake: Shared secret failed to create context: ");
+        goto fail_ctx_new;
+    }
+
+    if (EVP_PKEY_derive_init(ctx) <= 0)
+    {
+      DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED,
+                        "process_handshake: Shared secret failed to initialize context: ");
+        goto fail_derive;
+    }
+    if (EVP_PKEY_derive_set_peer(ctx, handshake->rdh) <= 0)
+    {
+      DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED,
+                        "process_handshake: Shared secret failed to set peer key: ");
+        goto fail_derive;
+    }
+
+    /* Determine buffer length */
+    if (EVP_PKEY_derive(ctx, NULL, &skeylen) <= 0)
+    {
+      DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED,
+                        "process_handshake:  Shared secret failed to determine key length: ");
+        goto fail_derive;
+    }
+
+    secret = ddsrt_malloc(skeylen);
+    if (EVP_PKEY_derive(ctx, secret, &skeylen) <= 0)
+    {
+      DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED,
+                "process_handshake: Could not compute the shared secret: ");
+        goto fail_derive;
+    }
+
+    *shared_secret = ddsrt_malloc(SHA256_DIGEST_LENGTH);
+    *length = SHA256_DIGEST_LENGTH;
+
+    SHA256(secret, skeylen, *shared_secret);
+
+    result = true;
+
+fail_derive:
+    ddsrt_free(secret);
+    EVP_PKEY_CTX_free(ctx);
+fail_ctx_new:
+    return result;
+}
+
+
+
+
+DDS_Security_ValidationResult_t
+process_handshake(
+        dds_security_authentication *instance,
+        DDS_Security_HandshakeMessageToken *handshake_message_out,
+        const DDS_Security_HandshakeMessageToken *handshake_message_in,
+        const DDS_Security_HandshakeHandle handshake_handle,
+        DDS_Security_SecurityException *ex)
+{
+    DDS_Security_ValidationResult_t result = DDS_SECURITY_VALIDATION_OK;
+    dds_security_authentication_impl *impl = (dds_security_authentication_impl *) instance;
+    HandshakeInfo *handshake = NULL;
+    IdentityRelation *relation = NULL;
+    SecurityObject *obj;
+    EVP_PKEY *dhkeyRemote = NULL;
+    DDS_Security_BinaryProperty_t *tokens = NULL;
+    DDS_Security_BinaryProperty_t *hash_c1 = NULL;
+    const DDS_Security_BinaryProperty_t *hash_c1_ref;
+    const DDS_Security_BinaryProperty_t *hash_c2_ref;
+    const DDS_Security_BinaryProperty_t *challenge1_ref;
+    const DDS_Security_BinaryProperty_t *challenge2_ref;
+    const DDS_Security_BinaryProperty_t *dh1_ref;
+    const DDS_Security_BinaryProperty_t *dh2_ref;
+    DDS_Security_BinaryProperty_t *hash_c2 = NULL;
+    DDS_Security_BinaryProperty_t *dh1;
+    DDS_Security_BinaryProperty_t *dh2;
+    DDS_Security_BinaryProperty_t *challenge1;
+    DDS_Security_BinaryProperty_t *challenge2;
+    DDS_Security_BinaryProperty_t *signature;
+    uint32_t tokenSize=0, idx;
+    DDS_Security_octet * challenge1_ref_for_shared_secret, *challenge2_ref_for_shared_secret;
+
+    /* validate provided arguments */
+    if (!instance || !handshake_handle || !handshake_message_out || !handshake_message_in) {
+        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT,
+        DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED,
+                        "process_handshake: Invalid parameter provided");
+        goto err_bad_param;
+    }
+
+    memset(handshake_message_out, 0, sizeof(DDS_Security_HandshakeMessageToken));
+
+    ddsrt_mutex_lock(&impl->lock);
+
+    obj = security_object_find(impl->objectHash, handshake_handle);
+    if (!obj || !security_object_valid(obj, SECURITY_OBJECT_KIND_HANDSHAKE)) {
+        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT,
+        DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED,
+                        "process_handshake: Invalid replier_identity_handle provided");
+        goto err_inv_handle;
+    }
+    handshake = (HandshakeInfo *) obj;
+    relation = handshake->relation;
+    assert(relation);
+
+    /* check if the handle created by a handshake_request or handshake_reply */
+
+    switch (handshake->created_in) {
+    case CREATEDREQUEST:
+        /* The source of the handshake_handle is a begin_handshake_request function
+         * So, handshake_message_in should have been came from a remote begin_handshake_reply function
+         */
+        /* Verify Message Token contents according to Spec 9.3.2.5.2 (Reply Message)  */
+        result = validate_handshake_reply_token(handshake_message_in, handshake, &dhkeyRemote, &(impl->trustedCAList), ex);
+        if (result != DDS_SECURITY_VALIDATION_OK) {
+            goto err_inv_token;
+        }
+
+        /*set received remote DH (dh2) */
+        handshake->rdh = dhkeyRemote;
+
+        EVP_PKEY_copy_parameters(handshake->rdh, handshake->ldh);
+
+        /* Prepare HandshakeFinalMessageToken */
+
+        /* Get references from message_in */
+        hash_c1_ref = DDS_Security_DataHolder_find_binary_property(handshake_message_in, "hash_c1");
+        hash_c2_ref = DDS_Security_DataHolder_find_binary_property(handshake_message_in, "hash_c2");
+        dh1_ref = DDS_Security_DataHolder_find_binary_property(handshake_message_in, "dh1");
+        dh2_ref = DDS_Security_DataHolder_find_binary_property(handshake_message_in, "dh2");
+        challenge1_ref = DDS_Security_DataHolder_find_binary_property(handshake_message_in,
+                        "challenge1");
+        challenge2_ref = DDS_Security_DataHolder_find_binary_property(handshake_message_in,
+                        "challenge2");
+
+        tokenSize = 3; /* challenge1, challenge2 and signature are already exist */
+        if (hash_c1_ref)
+            tokenSize++;
+        if (hash_c2_ref)
+            tokenSize++;
+        if (dh1_ref)
+            tokenSize++;
+        if (dh2_ref)
+            tokenSize++;
+
+        tokens = DDS_Security_BinaryPropertySeq_allocbuf(tokenSize);
+        idx = 0;
+        signature = &tokens[idx++];
+        hash_c2 = hash_c2_ref ? &tokens[idx++] : NULL;
+        challenge2 = &tokens[idx++];
+        dh2 = dh2_ref ? &tokens[idx++] : NULL;
+        challenge1 = &tokens[idx++];
+        dh1 = dh1_ref ? &tokens[idx++] : NULL;
+        hash_c1 = hash_c1_ref ? &tokens[idx++] : NULL;
+
+        if (hash_c1) {
+            DDS_Security_BinaryProperty_set_by_value(hash_c1, "hash_c1", hash_c1_ref->value._buffer,
+                            hash_c1_ref->value._length);
+        }
+        if (hash_c2) {
+            DDS_Security_BinaryProperty_set_by_value(hash_c2, "hash_c2", hash_c2_ref->value._buffer,
+                            hash_c2_ref->value._length);
+        }
+        if (dh1) {
+            DDS_Security_BinaryProperty_set_by_value(dh1, "dh1", dh1_ref->value._buffer,
+                            dh1_ref->value._length);
+        }
+        if (dh2) {
+            DDS_Security_BinaryProperty_set_by_value(dh2, "dh2", dh2_ref->value._buffer,
+                            dh2_ref->value._length);
+        }
+        assert(relation->lchallenge);
+        if (challenge1 && challenge1_ref) {
+            DDS_Security_BinaryProperty_set_by_value(challenge1, "challenge1", challenge1_ref->value._buffer,
+                            challenge1_ref->value._length);
+        }
+        assert(relation->rchallenge);
+        if (challenge2 && challenge2_ref) {
+            DDS_Security_BinaryProperty_set_by_value(challenge2, "challenge2", challenge2_ref->value._buffer,
+                            challenge2_ref->value._length);
+        }
+
+
+        /* Calculate the signature */
+        {
+           const DDS_Security_BinaryProperty_t * binary_properties[ HANDSHAKE_SIGNATURE_CONTENT_SIZE ];
+           DDS_Security_BinaryProperty_t *hash_c1_val = hash_value_to_binary_property("hash_c1", handshake->hash_c1);
+           DDS_Security_BinaryProperty_t *hash_c2_val = hash_value_to_binary_property("hash_c2", handshake->hash_c2);
+           unsigned char *sign;
+           size_t signlen;
+
+           binary_properties[0] = hash_c1_val;
+           binary_properties[1] = challenge1;
+           binary_properties[2] = dh1;
+           binary_properties[3] = challenge2;
+           binary_properties[4] = dh2;
+           binary_properties[5] = hash_c2_val;
+
+           result = create_signature(relation->localIdentity->privateKey, binary_properties, HANDSHAKE_SIGNATURE_CONTENT_SIZE, &sign, &signlen, ex);
+
+           DDS_Security_BinaryProperty_free(hash_c1_val);
+           DDS_Security_BinaryProperty_free(hash_c2_val);
+
+           if (result != DDS_SECURITY_VALIDATION_OK) {
+               goto err_signature;
+           }
+
+           DDS_Security_BinaryProperty_set_by_ref(signature, "signature", sign, (uint32_t)signlen);
+        }
+
+        handshake_message_out->class_id = ddsrt_strdup(AUTH_HANDSHAKE_FINAL_TOKEN_ID);
+        handshake_message_out->binary_properties._length = tokenSize;
+        handshake_message_out->binary_properties._buffer = tokens;
+
+        challenge1_ref_for_shared_secret = (DDS_Security_octet*)(handshake->relation->lchallenge);
+        challenge2_ref_for_shared_secret = (DDS_Security_octet*)(handshake->relation->rchallenge);
+
+        result =  DDS_SECURITY_VALIDATION_OK_FINAL_MESSAGE;
+
+        break;
+    case CREATEDREPLY:
+        /* The source of the handshake_handle is a begin_handshake_reply function
+         * So, handshake_message_in should have been came from a remote process_handshake function
+         */
+
+        /* Verify Message Token contents according to Spec 9.3.2.5.3 (Final Message)   */
+        result = validate_handshake_final_token(handshake_message_in, handshake, ex);
+        if (result != DDS_SECURITY_VALIDATION_OK) {
+            goto err_inv_token;
+        }
+
+
+        challenge2_ref_for_shared_secret = (DDS_Security_octet*)(handshake->relation->lchallenge);
+        challenge1_ref_for_shared_secret = (DDS_Security_octet*)(handshake->relation->rchallenge);
+
+        result =  DDS_SECURITY_VALIDATION_OK;
+
+        break;
+    default:
+        ddsrt_mutex_unlock(&impl->lock);
+        goto err_bad_param;
+    }
+
+    /* Compute shared secret */
+    {
+        DDS_Security_long shared_secret_length;
+        unsigned char *shared_secret;
+
+        if (!generate_shared_secret(handshake, &shared_secret, &shared_secret_length, ex)) {
+            goto err_openssl;
+        }
+
+        handshake->shared_secret_handle_impl = ddsrt_malloc( sizeof(DDS_Security_SharedSecretHandleImpl));
+        handshake->shared_secret_handle_impl->shared_secret = shared_secret;
+        handshake->shared_secret_handle_impl->shared_secret_size = shared_secret_length;
+
+        /* put references to challenge1 and challenge2 into shared secret object */
+        memcpy( handshake->shared_secret_handle_impl->challenge1, challenge1_ref_for_shared_secret, DDS_SECURITY_AUTHENTICATION_CHALLENGE_SIZE);
+        memcpy( handshake->shared_secret_handle_impl->challenge2, challenge2_ref_for_shared_secret, DDS_SECURITY_AUTHENTICATION_CHALLENGE_SIZE);
+    }
+
+    { /* setup expiry listener */
+        dds_time_t certExpiry = get_certificate_expiry( handshake->relation->remoteIdentity->identityCert );
+
+        if( certExpiry == DDS_TIME_INVALID ){
+          DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result, "Expiry date of the certificate is invalid");
+          goto err_invalid_expiry;
+        } else if( certExpiry != DDS_NEVER ){
+            add_validity_end_trigger( impl,
+                            IDENTITY_HANDLE( handshake->relation->remoteIdentity ),
+                            certExpiry);
+        }
+
+    }
+
+    ddsrt_mutex_unlock(&impl->lock);
+
+    return result;
+
+err_invalid_expiry:
+    ddsrt_free( handshake->shared_secret_handle_impl->shared_secret );
+    ddsrt_free( handshake->shared_secret_handle_impl );
+err_openssl:
+err_signature:
+    if (handshake_message_out->class_id) {
+        DDS_Security_DataHolder_deinit(handshake_message_out);
+    }
+err_inv_token:
+err_inv_handle:
+    ddsrt_mutex_unlock(&impl->lock);
+err_bad_param:
+    return DDS_SECURITY_VALIDATION_FAILED;
+}
+
+DDS_Security_SharedSecretHandle get_shared_secret(
+        dds_security_authentication *instance,
+        const DDS_Security_HandshakeHandle handshake_handle,
+        DDS_Security_SecurityException *ex)
+{
+
+    dds_security_authentication_impl *impl = (dds_security_authentication_impl *) instance;
+    SecurityObject *obj;
+
+    /* validate provided arguments */
+    if (!instance || !handshake_handle) {
+       DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "return_handshake_handle: Invalid parameter provided");
+       goto err_bad_param;
+    }
+
+    ddsrt_mutex_lock(&impl->lock);
+    obj = security_object_find(impl->objectHash, handshake_handle);
+    if (!obj || !security_object_valid(obj, SECURITY_OBJECT_KIND_HANDSHAKE)) {
+       DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "return_handshake_handle: Invalid handle provided");
+       goto err_invalid_handle;
+    }
+
+    ddsrt_mutex_unlock(&impl->lock);
+    return (DDS_Security_SharedSecretHandle)(ddsrt_address)((HandshakeInfo*)obj)->shared_secret_handle_impl;
+
+
+    err_invalid_handle:
+        ddsrt_mutex_unlock(&impl->lock);
+    err_bad_param:
+    return DDS_SECURITY_HANDLE_NIL;
+}
+
+DDS_Security_boolean
+get_authenticated_peer_credential_token(
+        dds_security_authentication *instance,
+        DDS_Security_AuthenticatedPeerCredentialToken *peer_credential_token,
+        const DDS_Security_HandshakeHandle handshake_handle,
+        DDS_Security_SecurityException *ex)
+{
+    dds_security_authentication_impl *impl = (dds_security_authentication_impl *) instance;
+    HandshakeInfo *handshake = NULL;
+    X509 *identity_cert;
+    char *permissions_doc;
+    unsigned char *cert_data;
+    uint32_t cert_data_size;
+
+    /* validate provided arguments */
+    if (!instance || !handshake_handle || !peer_credential_token) {
+        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT,
+                DDS_SECURITY_ERR_INVALID_PARAMETER_CODE, 0,
+                DDS_SECURITY_ERR_INVALID_PARAMETER_MESSAGE);
+        return false;
+    }
+
+    ddsrt_mutex_lock(&impl->lock);
+
+    handshake = (HandshakeInfo *) security_object_find(impl->objectHash, handshake_handle);
+    if (!handshake || !SECURITY_OBJECT_VALID(handshake, SECURITY_OBJECT_KIND_HANDSHAKE)) {
+        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT,
+                DDS_SECURITY_ERR_INVALID_PARAMETER_CODE, 0,
+                DDS_SECURITY_ERR_INVALID_PARAMETER_MESSAGE);
+        goto err_inv_handle;
+    }
+
+    identity_cert = handshake->relation->remoteIdentity->identityCert;
+    if (!identity_cert) {
+         DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT,
+                 DDS_SECURITY_ERR_OPERATION_NOT_PERMITTED_CODE, 0,
+                 DDS_SECURITY_ERR_OPERATION_NOT_PERMITTED_MESSAGE);
+         goto err_missing_attr;
+     }
+
+    permissions_doc = handshake->relation->remoteIdentity->permissionsDocument;
+    if (!permissions_doc) {
+        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT,
+                DDS_SECURITY_ERR_MISSING_REMOTE_PERMISSIONS_DOCUMENT_CODE, 0,
+                DDS_SECURITY_ERR_MISSING_REMOTE_PERMISSIONS_DOCUMENT_MESSAGE);
+        goto err_missing_attr;
+    }
+
+    if (get_certificate_contents(identity_cert, &cert_data, &cert_data_size, ex) != DDS_SECURITY_VALIDATION_OK) {
+        goto err_alloc_cid;
+    }
+
+    memset(peer_credential_token, 0, sizeof(*peer_credential_token));
+
+    peer_credential_token->class_id = get_authentication_class_id();
+
+    peer_credential_token->properties._length = 2;
+    peer_credential_token->properties._buffer = DDS_Security_PropertySeq_allocbuf(peer_credential_token->properties._length);
+
+    peer_credential_token->properties._buffer[0].name = ddsrt_strdup("c.id");
+    peer_credential_token->properties._buffer[0].value = (char *)cert_data;
+    peer_credential_token->properties._buffer[0].propagate = false;
+
+    peer_credential_token->properties._buffer[1].name = ddsrt_strdup("c.perm");
+    peer_credential_token->properties._buffer[1].value = ddsrt_strdup(permissions_doc);
+    peer_credential_token->properties._buffer[1].propagate = false;
+
+    ddsrt_mutex_unlock(&impl->lock);
+
+    return true;
+
+err_alloc_cid:
+err_missing_attr:
+err_inv_handle:
+    ddsrt_mutex_unlock(&impl->lock);
+    return false;
+}
+
+DDS_Security_boolean set_listener(dds_security_authentication *instance,
+        const dds_security_authentication_listener *listener,
+        DDS_Security_SecurityException *ex)
+{
+    dds_security_authentication_impl *auth = (dds_security_authentication_impl*)instance;
+
+    DDSRT_UNUSED_ARG(auth);
+    DDSRT_UNUSED_ARG(listener);
+    DDSRT_UNUSED_ARG(ex);
+
+    /* Will be enabled after timed call back feature implementation */
+#if TIMED_CALLBACK_IMPLEMENTED
+    if (listener) {
+        ut_timed_dispatcher_enable(auth->timed_callbacks, (void*)listener);
+    } else {
+        ut_timed_dispatcher_disable(auth->timed_callbacks);
+    }
+#endif
+    return true;
+}
+
+DDS_Security_boolean return_identity_token(dds_security_authentication *instance,
+        const DDS_Security_IdentityToken *token,
+        DDS_Security_SecurityException *ex)
+{
+    DDSRT_UNUSED_ARG(token);
+    DDSRT_UNUSED_ARG(ex);
+    DDSRT_UNUSED_ARG(instance);
+
+    return true;
+}
+
+DDS_Security_boolean return_identity_status_token(
+        dds_security_authentication *instance,
+        const DDS_Security_IdentityStatusToken *token,
+        DDS_Security_SecurityException *ex)
+{
+    DDSRT_UNUSED_ARG(token);
+    DDSRT_UNUSED_ARG(ex);
+    DDSRT_UNUSED_ARG(instance);
+
+    return true;
+}
+
+DDS_Security_boolean return_authenticated_peer_credential_token(
+        dds_security_authentication *instance,
+        const DDS_Security_AuthenticatedPeerCredentialToken *peer_credential_token,
+        DDS_Security_SecurityException *ex)
+{
+    if ((!instance) || (!peer_credential_token)) {
+        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_PARAMETER_CODE, 0, DDS_SECURITY_ERR_INVALID_PARAMETER_MESSAGE);
+        return false;
+    }
+
+    DDS_Security_DataHolder_deinit((DDS_Security_DataHolder *)peer_credential_token);
+
+    return true;
+}
+
+DDS_Security_boolean
+return_handshake_handle(dds_security_authentication *instance,
+        const DDS_Security_HandshakeHandle handshake_handle,
+        DDS_Security_SecurityException *ex)
+{
+    dds_security_authentication_impl *impl = (dds_security_authentication_impl *) instance;
+    SecurityObject *obj;
+    HandshakeInfo *handshake;
+
+    /* validate provided arguments */
+    if (!instance || !handshake_handle) {
+        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "return_handshake_handle: Invalid parameter provided");
+        goto err_bad_param;
+    }
+
+    ddsrt_mutex_lock(&impl->lock);
+    obj = security_object_find(impl->objectHash, handshake_handle);
+    if (!obj || !security_object_valid(obj, SECURITY_OBJECT_KIND_HANDSHAKE)) {
+        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "return_handshake_handle: Invalid handle provided");
+        goto err_invalid_handle;
+    }
+    handshake = (HandshakeInfo *)obj;
+
+    assert(handshake->relation);
+
+    (void)ddsrt_hh_remove(impl->objectHash, obj);
+    security_object_free((SecurityObject *)handshake);
+
+    ddsrt_mutex_unlock(&impl->lock);
+
+    return true;
+
+err_invalid_handle:
+    ddsrt_mutex_unlock(&impl->lock);
+err_bad_param:
+    return false;
+}
+
+
+static void
+invalidate_local_related_objects(
+     dds_security_authentication_impl *impl,
+     LocalIdentityInfo *localIdent)
+{
+    struct ddsrt_hh_iter it;
+    SecurityObject *obj;
+
+    for (obj = ddsrt_hh_iter_first(impl->objectHash, &it); obj != NULL; obj = ddsrt_hh_iter_next(&it)) {
+        if (obj->kind == SECURITY_OBJECT_KIND_REMOTE_IDENTITY) {
+            RemoteIdentityInfo *remoteIdent = (RemoteIdentityInfo *)obj;
+            IdentityRelation *relation;
+            HandshakeInfo *handshake;
+
+            handshake = find_handshake(impl, SECURITY_OBJECT_HANDLE(localIdent), SECURITY_OBJECT_HANDLE(remoteIdent));
+            if (handshake) {
+                (void)ddsrt_hh_remove(impl->objectHash, handshake);
+                security_object_free((SecurityObject *) handshake);
+            }
+
+            relation = find_identity_relation(remoteIdent, SECURITY_OBJECT_HANDLE(localIdent));
+            if (relation) {
+                remove_identity_relation(remoteIdent, relation);
+            }
+        }
+    }
+}
+
+static void
+invalidate_remote_related_objects(
+    dds_security_authentication_impl *impl,
+    RemoteIdentityInfo *remoteIdentity)
+{
+    struct ddsrt_hh_iter it;
+    IdentityRelation *relation;
+    HandshakeInfo *handshake;
+
+    for (relation = ddsrt_hh_iter_first(remoteIdentity->linkHash, &it); relation != NULL; relation = ddsrt_hh_iter_next(&it)) {
+        handshake = find_handshake(impl, SECURITY_OBJECT_HANDLE(relation->localIdentity), SECURITY_OBJECT_HANDLE(remoteIdentity));
+        if (handshake) {
+            (void)ddsrt_hh_remove(impl->objectHash, handshake);
+            security_object_free((SecurityObject *) handshake);
+        }
+
+        (void)ddsrt_hh_remove(remoteIdentity->linkHash, relation);
+        security_object_free((SecurityObject *) relation);
+    }
+}
+
+DDS_Security_boolean
+return_identity_handle(
+        dds_security_authentication *instance,
+        const DDS_Security_IdentityHandle identity_handle,
+        DDS_Security_SecurityException *ex)
+{
+    DDS_Security_boolean result = true;
+    dds_security_authentication_impl *impl = (dds_security_authentication_impl *) instance;
+    SecurityObject *obj;
+    LocalIdentityInfo *localIdent;
+    RemoteIdentityInfo *remoteIdent;
+
+    /* validate provided arguments */
+    if (!instance || !identity_handle) {
+        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "return_identity_handle: Invalid parameter provided");
+        goto err_bad_param;
+    }
+
+    /* Currently the implementation of the handle does not provide information
+     * about the kind of handle. In this case a valid handle could refer to a
+     * LocalIdentityObject or a RemoteIdentityObject
+     */
+
+    ddsrt_mutex_lock(&impl->lock);
+
+    obj = security_object_find(impl->objectHash, identity_handle);
+    if (!obj) {
+        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "return_identity_handle: Invalid handle provided");
+        goto err_invalid_handle;
+    }
+
+    switch (obj->kind) {
+    case SECURITY_OBJECT_KIND_LOCAL_IDENTITY:
+        localIdent = (LocalIdentityInfo *) obj;
+        invalidate_local_related_objects(impl, localIdent);
+        (void)ddsrt_hh_remove(impl->objectHash, obj);
+        security_object_free(obj);
+        break;
+    case SECURITY_OBJECT_KIND_REMOTE_IDENTITY:
+        remoteIdent = (RemoteIdentityInfo *) obj;
+        invalidate_remote_related_objects(impl, remoteIdent);
+        (void)ddsrt_hh_remove(impl->remoteGuidHash, remoteIdent);
+        (void)ddsrt_hh_remove(impl->objectHash, obj);
+        security_object_free(obj);
+        break;
+    default:
+        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "return_identity_handle: Invalid handle provided");
+        result = false;
+        break;
+    }
+
+    ddsrt_mutex_unlock(&impl->lock);
+
+    return result;
+
+err_invalid_handle:
+    ddsrt_mutex_unlock(&impl->lock);
+err_bad_param:
+    return false;
+}
+
+DDS_Security_boolean return_sharedsecret_handle(
+        dds_security_authentication *instance,
+        const DDS_Security_SharedSecretHandle sharedsecret_handle,
+        DDS_Security_SecurityException *ex)
+{
+    DDSRT_UNUSED_ARG(sharedsecret_handle);
+    DDSRT_UNUSED_ARG(ex);
+    DDSRT_UNUSED_ARG(instance);
+
+    return true;
+}
+
+int32_t init_authentication( const char *argument, void **context)
+{
+
+    dds_security_authentication_impl *authentication;
+
+    DDSRT_UNUSED_ARG(argument);
+
+    /* allocate implementation wrapper */
+    authentication = (dds_security_authentication_impl*) ddsrt_malloc(
+      sizeof(dds_security_authentication_impl));
+    memset(authentication, 0, sizeof(dds_security_authentication_impl));
+
+    /* assign dispatcher to be notified when a validity date ends */
+    /* Disable it until timed callback is ready */
+    /*authentication->timed_callbacks = ut_timed_dispatcher_new(); */
+
+    /* assign the interface functions */
+    authentication->base.validate_local_identity = &validate_local_identity;
+
+    authentication->base.get_identity_token = &get_identity_token;
+
+    authentication->base.get_identity_status_token = &get_identity_status_token;
+
+    authentication->base.set_permissions_credential_and_token =
+            &set_permissions_credential_and_token;
+
+    authentication->base.validate_remote_identity = &validate_remote_identity;
+
+    authentication->base.begin_handshake_request = &begin_handshake_request;
+
+    authentication->base.begin_handshake_reply = &begin_handshake_reply;
+
+    authentication->base.process_handshake = &process_handshake;
+
+    authentication->base.get_shared_secret = &get_shared_secret;
+
+    authentication->base.get_authenticated_peer_credential_token =
+            &get_authenticated_peer_credential_token;
+
+    authentication->base.set_listener = &set_listener;
+
+    authentication->base.return_identity_token = &return_identity_token;
+
+    authentication->base.return_identity_status_token =
+            &return_identity_status_token;
+
+    authentication->base.return_authenticated_peer_credential_token =
+            &return_authenticated_peer_credential_token;
+
+    authentication->base.return_handshake_handle = &return_handshake_handle;
+
+    authentication->base.return_identity_handle = &return_identity_handle;
+
+    authentication->base.return_sharedsecret_handle = &return_sharedsecret_handle;
+
+    //prepare implementation wrapper
+    authentication->id = 1;
+
+    ddsrt_mutex_init(&authentication->lock);
+
+    authentication->objectHash = ddsrt_hh_new(32, security_object_hash, security_object_equal);
+    authentication->remoteGuidHash = ddsrt_hh_new(32, remote_guid_hash, remote_guid_equal);
+
+    memset( &authentication->trustedCAList, 0, sizeof(X509Seq));
+
+
+    /* Initialize openssl */
+    OpenSSL_add_all_algorithms();
+    OpenSSL_add_all_ciphers();
+    OpenSSL_add_all_digests();
+    ERR_load_BIO_strings();
+    ERR_load_crypto_strings();
+
+    //return the instance
+    *context = authentication;
+    return 0;
+
+/*    we can not get ddsrt_mutex_init result. So ignore the lines below */
+#if MUTEX_INIT_RESULT_IMPLEMENTED
+err_mutex_failed:
+    ddsrt_free(authentication);
+    return -1;
+#endif
+}
+
+int32_t finalize_authentication(void *instance)
+{
+    dds_security_authentication_impl *authentication = instance;
+
+    if( authentication ){
+        ddsrt_mutex_lock(&authentication->lock);
+
+        /* Will be enabled after timed call back feature implementation */
+        /* ut_timed_dispatcher_free(authentication->timed_callbacks); */
+        if (authentication->remoteGuidHash) {
+            ddsrt_hh_free(authentication->remoteGuidHash);
+        }
+
+        if (authentication->objectHash) {
+            struct ddsrt_hh_iter it;
+            SecurityObject *obj;
+            for (obj = ddsrt_hh_iter_first(authentication->objectHash, &it); obj != NULL; obj = ddsrt_hh_iter_next(&it)) {
+                security_object_free(obj);
+            }
+            ddsrt_hh_free(authentication->objectHash);
+        }
+
+        free_ca_list_contents(&(authentication->trustedCAList));
+
+        ddsrt_mutex_unlock(&authentication->lock);
+
+        ddsrt_mutex_destroy(&authentication->lock);
+
+        ddsrt_free((dds_security_authentication_impl*) instance);
+    }
+
+    RAND_cleanup();
+    EVP_cleanup();
+    CRYPTO_cleanup_all_ex_data();
+    REMOVE_THREAD_STATE();
+    ERR_free_strings();
+
+    return 0;
+}
diff --git a/src/security/builtin_plugins/authentication/src/authentication.h b/src/security/builtin_plugins/authentication/src/authentication.h
new file mode 100644
index 0000000..dcbcfd6
--- /dev/null
+++ b/src/security/builtin_plugins/authentication/src/authentication.h
@@ -0,0 +1,146 @@
+/*
+ * Copyright(c) 2006 to 2019 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+
+
+#ifndef SECURITY_BUILTIN_PLUGINS_AUTHENTICATION_H_
+#define SECURITY_BUILTIN_PLUGINS_AUTHENTICATION_H_
+
+#include "dds/ddsrt/atomics.h"
+#include "dds/security/dds_security_api.h"
+#include "dds/security/export.h"
+
+SECURITY_EXPORT int32_t
+init_authentication(const char *argument, void **context);
+
+SECURITY_EXPORT int32_t
+finalize_authentication(void *context);
+
+
+
+
+DDS_Security_ValidationResult_t
+validate_local_identity(
+        dds_security_authentication *instance,
+        DDS_Security_IdentityHandle *local_identity_handle,
+        DDS_Security_GUID_t *adjusted_participant_guid,
+        const DDS_Security_DomainId domain_id,
+        const DDS_Security_Qos *participant_qos,
+        const DDS_Security_GUID_t *candidate_participant_guid,
+
+        DDS_Security_SecurityException *ex);
+DDS_Security_boolean
+get_identity_token(dds_security_authentication *instance,
+                   DDS_Security_IdentityToken *identity_token,
+                   const DDS_Security_IdentityHandle handle,
+                   DDS_Security_SecurityException *ex);
+DDS_Security_boolean
+set_permissions_credential_and_token(
+        dds_security_authentication *instance,
+        const DDS_Security_IdentityHandle handle,
+        const DDS_Security_PermissionsCredentialToken *permissions_credential,
+        const DDS_Security_PermissionsToken *permissions_token,
+        DDS_Security_SecurityException *ex);
+
+DDS_Security_ValidationResult_t
+validate_remote_identity(
+        dds_security_authentication *instance,
+        DDS_Security_IdentityHandle *remote_identity_handle,
+        DDS_Security_AuthRequestMessageToken *local_auth_request_token,
+        const DDS_Security_AuthRequestMessageToken *remote_auth_request_token,
+        const DDS_Security_IdentityHandle local_identity_handle,
+        const DDS_Security_IdentityToken *remote_identity_token,
+        const DDS_Security_GUID_t *remote_participant_guid,
+        DDS_Security_SecurityException *ex);
+
+DDS_Security_ValidationResult_t
+begin_handshake_request(
+        dds_security_authentication *instance,
+        DDS_Security_HandshakeHandle *handshake_handle,
+        DDS_Security_HandshakeMessageToken *handshake_message,
+        const DDS_Security_IdentityHandle initiator_identity_handle,
+        const DDS_Security_IdentityHandle replier_identity_handle,
+        const DDS_Security_OctetSeq *serialized_local_participant_data,
+        DDS_Security_SecurityException *ex);
+
+DDS_Security_ValidationResult_t
+begin_handshake_reply(
+        dds_security_authentication *instance,
+        DDS_Security_HandshakeHandle *handshake_handle,
+        DDS_Security_HandshakeMessageToken *handshake_message_out,
+        const DDS_Security_HandshakeMessageToken *handshake_message_in,
+        const DDS_Security_IdentityHandle initiator_identity_handle,
+        const DDS_Security_IdentityHandle replier_identity_handle,
+        const DDS_Security_OctetSeq *serialized_local_participant_data,
+        DDS_Security_SecurityException *ex);
+
+DDS_Security_ValidationResult_t
+process_handshake(
+        dds_security_authentication *instance,
+        DDS_Security_HandshakeMessageToken *handshake_message_out,
+        const DDS_Security_HandshakeMessageToken *handshake_message_in,
+        const DDS_Security_HandshakeHandle handshake_handle,
+        DDS_Security_SecurityException *ex);
+
+DDS_Security_SharedSecretHandle get_shared_secret(
+        dds_security_authentication *instance,
+        const DDS_Security_HandshakeHandle handshake_handle,
+        DDS_Security_SecurityException *ex);
+
+DDS_Security_boolean
+get_authenticated_peer_credential_token(
+        dds_security_authentication *instance,
+        DDS_Security_AuthenticatedPeerCredentialToken *peer_credential_token,
+        const DDS_Security_HandshakeHandle handshake_handle,
+        DDS_Security_SecurityException *ex);
+
+
+DDS_Security_boolean get_identity_status_token(
+        dds_security_authentication *instance,
+        DDS_Security_IdentityStatusToken *identity_status_token,
+        const DDS_Security_IdentityHandle handle,
+        DDS_Security_SecurityException *ex);
+
+DDS_Security_boolean set_listener(dds_security_authentication *instance,
+                                  const dds_security_authentication_listener *listener,
+                                  DDS_Security_SecurityException *ex);
+
+DDS_Security_boolean return_identity_token(dds_security_authentication *instance,
+                                           const DDS_Security_IdentityToken *token,
+                                           DDS_Security_SecurityException *ex);
+
+DDS_Security_boolean return_identity_status_token(
+        dds_security_authentication *instance,
+        const DDS_Security_IdentityStatusToken *token,
+        DDS_Security_SecurityException *ex);
+
+DDS_Security_boolean return_authenticated_peer_credential_token(
+        dds_security_authentication *instance,
+        const DDS_Security_AuthenticatedPeerCredentialToken *peer_credential_token,
+        DDS_Security_SecurityException *ex);
+
+DDS_Security_boolean
+return_handshake_handle(dds_security_authentication *instance,
+                        const DDS_Security_HandshakeHandle handshake_handle,
+                        DDS_Security_SecurityException *ex);
+DDS_Security_boolean
+return_identity_handle(
+        dds_security_authentication *instance,
+        const DDS_Security_IdentityHandle identity_handle,
+        DDS_Security_SecurityException *ex);
+
+DDS_Security_boolean return_sharedsecret_handle(
+        dds_security_authentication *instance,
+        const DDS_Security_SharedSecretHandle sharedsecret_handle,
+        DDS_Security_SecurityException *ex);
+
+
+#endif /* SECURITY_BUILTIN_PLUGINS_AUTHENTICATION_H_ */
diff --git a/src/security/builtin_plugins/tests/CMakeLists.txt b/src/security/builtin_plugins/tests/CMakeLists.txt
new file mode 100644
index 0000000..7290ca4
--- /dev/null
+++ b/src/security/builtin_plugins/tests/CMakeLists.txt
@@ -0,0 +1,51 @@
+ #
+# Copyright(c) 2006 to 2019 ADLINK Technology Limited and others
+#
+# This program and the accompanying materials are made available under the
+# terms of the Eclipse Public License v. 2.0 which is available at
+# http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+# v. 1.0 which is available at
+# http://www.eclipse.org/org/documents/edl-v10.php.
+#
+# SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+#
+include(CUnit)
+
+set(security_auth_test_sources
+    "validate_begin_handshake_reply/src/validate_begin_handshake_reply_utests.c"
+    "get_authenticated_peer_credential_token/src/get_authenticated_peer_credential_token_utests.c"
+    "validate_local_identity/src/validate_local_identity_utests.c"
+    "validate_remote_identity/src/validate_remote_identity_utests.c"
+    "validate_begin_handshake_request/src/validate_begin_handshake_request_utests.c"
+    "process_handshake/src/process_handshake_utests.c"
+    "common/src/handshake_helper.c"
+    "common/src/loader.c")
+
+add_cunit_executable(cunit_security_plugins ${security_auth_test_sources})
+target_include_directories(
+  cunit_security_plugins PRIVATE
+  "$<BUILD_INTERFACE:${CMAKE_BINARY_DIR}/src/include/>"
+       "$<BUILD_INTERFACE:$<TARGET_PROPERTY:security_api,INTERFACE_INCLUDE_DIRECTORIES>>"
+        "$<BUILD_INTERFACE:$<TARGET_PROPERTY:security_core,INTERFACE_INCLUDE_DIRECTORIES>>"
+        "$<BUILD_INTERFACE:$<TARGET_PROPERTY:ddsrt,INTERFACE_INCLUDE_DIRECTORIES>>"
+        "$<BUILD_INTERFACE:${CMAKE_CURRENT_LIST_DIR}>"
+        "$<BUILD_INTERFACE:${CMAKE_CURRENT_BINARY_DIR}>"
+ )
+
+
+target_link_libraries(cunit_security_plugins PRIVATE ddsc security_api)
+
+
+find_package(OpenSSL )
+if(OPENSSL_FOUND)
+  target_link_libraries(cunit_security_plugins PRIVATE OpenSSL::SSL)
+
+else()
+  message(FATAL_ERROR "To build without openssl support, set DDSC_ENABLE_OPENSSL to OFF")
+endif()
+
+set(CUnit_builtin_plugins_tests_dir "${CMAKE_CURRENT_LIST_DIR}")
+
+configure_file("config_env.h.in" "config_env.h")
+
+
diff --git a/src/security/builtin_plugins/tests/common/src/handshake_helper.c b/src/security/builtin_plugins/tests/common/src/handshake_helper.c
new file mode 100644
index 0000000..2ff63bd
--- /dev/null
+++ b/src/security/builtin_plugins/tests/common/src/handshake_helper.c
@@ -0,0 +1,579 @@
+/*
+ * Copyright(c) 2006 to 2019 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+#include "handshake_helper.h"
+#include "dds/security/core/dds_security_serialize.h"
+#include "dds/ddsrt/string.h"
+#include "dds/ddsrt/heap.h"
+#include <stdio.h>
+#include <string.h>
+#include "dds/ddsrt/environ.h"
+#include "CUnit/CUnit.h"
+#include "CUnit/Test.h"
+#include "assert.h"
+#include "dds/ddsrt/misc.h"
+#include "dds/security/core/shared_secret.h"
+
+#if OPENSSL_VERSION_NUMBER >= 0x1000200fL
+#define AUTH_INCLUDE_EC
+#include <openssl/ec.h>
+#include <dds/security/core/dds_security_utils.h>
+
+#if OPENSSL_VERSION_NUMBER >= 0x10100000L
+#define AUTH_INCLUDE_DH_ACCESSORS
+#endif
+#else
+#error "version not found"
+#endif
+
+
+const BIGNUM *
+dh_get_public_key(
+     DH *dhkey)
+{
+#ifdef AUTH_INCLUDE_DH_ACCESSORS
+    const BIGNUM *pubkey, *privkey;
+    DH_get0_key(dhkey, &pubkey, &privkey);
+    return pubkey;
+#else
+    return dhkey->pub_key;
+#endif
+}
+
+int
+dh_set_public_key(
+     DH *dhkey,
+     BIGNUM *pubkey)
+{
+#ifdef AUTH_INCLUDE_DH_ACCESSORS
+    return DH_set0_key(dhkey, pubkey, NULL);
+#else
+    dhkey->pub_key = pubkey;
+#endif
+    return 1;
+}
+
+
+/* for DEBUG purposes */
+void print_binary_test( char* name, unsigned char *value, uint32_t size){
+    uint32_t i;
+    printf("%s: ",name );
+    for( i=0; i<  size; i++)
+    {
+        printf("%x",value[i]);
+    }
+    printf("\n");
+}
+
+DDS_Security_BinaryProperty_t *
+print_binary_properties_test(
+    DDS_Security_DataHolder *token)
+{
+    DDS_Security_BinaryProperty_t *result = NULL;
+    uint32_t i;
+    for (i = 0; i < token->binary_properties._length && !result; i++) {
+        print_binary_test( token->binary_properties._buffer[i].name, token->binary_properties._buffer[i].value._buffer, token->binary_properties._buffer[i].value._length);
+    }
+
+    return result;
+}
+
+DDS_Security_ValidationResult_t
+create_signature_for_test(
+    EVP_PKEY *pkey,
+    const DDS_Security_BinaryProperty_t **binary_properties,
+    const uint32_t binary_properties_length,
+    unsigned char **signature,
+    size_t *signatureLen,
+    DDS_Security_SecurityException *ex)
+{
+    DDS_Security_ValidationResult_t result;
+    DDS_Security_Serializer serializer;
+    unsigned char *buffer;
+    size_t size;
+
+    serializer = DDS_Security_Serializer_new(4096, 4096);
+
+    DDS_Security_Serialize_BinaryPropertyArray(serializer,binary_properties, binary_properties_length);
+    DDS_Security_Serializer_buffer(serializer, &buffer, &size);
+
+    result = create_asymmetrical_signature_for_test(pkey, buffer, size, signature, signatureLen, ex);
+
+    ddsrt_free(buffer);
+    DDS_Security_Serializer_free(serializer);
+
+    return result;
+}
+
+#if( AC_TESTS_IMPLEMENTED )
+static DDS_Security_ValidationResult_t
+screate_asymmetrical_signature_for_test(
+     EVP_PKEY *pkey,
+     void *data,
+     size_t dataLen,
+     unsigned char **signature,
+     size_t *signatureLen,
+     DDS_Security_SecurityException *ex)
+{
+    DDS_Security_ValidationResult_t result = DDS_SECURITY_VALIDATION_OK;
+    EVP_MD_CTX *mdctx = NULL;
+    EVP_PKEY_CTX *kctx = NULL;
+
+    if (!(mdctx = EVP_MD_CTX_create())) {
+        char *msg = get_openssl_error_message_for_test();
+        result = DDS_SECURITY_VALIDATION_FAILED;
+        DDS_Security_Exception_set(ex, "Authentication", DDS_SECURITY_ERR_UNDEFINED_CODE, result, "Failed to create signing context: %s", msg);
+        ddsrt_free(msg);
+        goto err_create_ctx;
+    }
+
+    if (EVP_DigestSignInit(mdctx, &kctx, EVP_sha256(), NULL, pkey) != 1) {
+        char *msg = get_openssl_error_message_for_test();
+        result = DDS_SECURITY_VALIDATION_FAILED;
+        DDS_Security_Exception_set(ex, "Authentication", DDS_SECURITY_ERR_UNDEFINED_CODE, result, "Failed to initialize signing context: %s", msg);
+        ddsrt_free(msg);
+        goto err_sign;
+    }
+
+    if (EVP_PKEY_CTX_set_rsa_padding(kctx, RSA_PKCS1_PSS_PADDING) < 1) {
+        char *msg = get_openssl_error_message_for_test();
+        result = DDS_SECURITY_VALIDATION_FAILED;
+        DDS_Security_Exception_set(ex, "Authentication", DDS_SECURITY_ERR_UNDEFINED_CODE, result, "Failed to initialize signing context: %s", msg);
+        ddsrt_free(msg);
+        goto err_sign;
+    }
+
+    if (EVP_DigestSignUpdate(mdctx, data, dataLen) != 1) {
+        char *msg = get_openssl_error_message_for_test();
+        result = DDS_SECURITY_VALIDATION_FAILED;
+        DDS_Security_Exception_set(ex, "Authentication", DDS_SECURITY_ERR_UNDEFINED_CODE, result, "Failed to update signing context: %s", msg);
+        ddsrt_free(msg);
+        goto err_sign;
+    }
+
+    if (EVP_DigestSignFinal(mdctx, NULL, signatureLen) != 1) {
+        char *msg = get_openssl_error_message_for_test();
+        result = DDS_SECURITY_VALIDATION_FAILED;
+        DDS_Security_Exception_set(ex, "Authentication", DDS_SECURITY_ERR_UNDEFINED_CODE, result, "Failed to finalize signing context: %s", msg);
+        ddsrt_free(msg);
+        goto err_sign;
+    }
+
+    //*signature = ddsrt_malloc(sizeof(unsigned char) * (*signatureLen));
+    *signature = OPENSSL_malloc(*signatureLen);
+    if (EVP_DigestSignFinal(mdctx, *signature, signatureLen) != 1) {
+        char *msg = get_openssl_error_message_for_test();
+        result = DDS_SECURITY_VALIDATION_FAILED;
+        DDS_Security_Exception_set(ex, "Authentication", DDS_SECURITY_ERR_UNDEFINED_CODE, result, "Failed to finalize signing context: %s", msg);
+        ddsrt_free(msg);
+        ddsrt_free(signature);
+    }
+
+err_sign:
+    EVP_MD_CTX_destroy(mdctx);
+err_create_ctx:
+    return result;
+}
+#endif
+
+
+char *
+get_openssl_error_message_for_test(
+        void)
+{
+    BIO *bio = BIO_new(BIO_s_mem());
+    char *msg;
+    char *buf = NULL;
+    size_t len;
+
+    if (bio) {
+        ERR_print_errors(bio);
+        len = (size_t)BIO_get_mem_data (bio, &buf);
+        msg = ddsrt_malloc(len + 1);
+        memset(msg, 0, len+1);
+        memcpy(msg, buf, len);
+        BIO_free(bio);
+    } else {
+        msg = ddsrt_strdup("BIO_new failed");
+    }
+
+    return msg;
+}
+
+DDS_Security_ValidationResult_t
+validate_asymmetrical_signature_for_test(
+    EVP_PKEY *pkey,
+    void *data,
+    size_t dataLen,
+    unsigned char *signature,
+    size_t signatureLen,
+    DDS_Security_SecurityException *ex)
+{
+    DDS_Security_ValidationResult_t result = DDS_SECURITY_VALIDATION_OK;
+    EVP_MD_CTX *mdctx = NULL;
+
+    if (!(mdctx = EVP_MD_CTX_create())) {
+        char *msg = get_openssl_error_message_for_test();
+        result = DDS_SECURITY_VALIDATION_FAILED;
+        DDS_Security_Exception_set(ex, "Authentication", DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result, "Failed to create verify context: %s", msg);
+        ddsrt_free(msg);
+        goto err_create_ctx;
+    }
+
+    if (EVP_DigestVerifyInit(mdctx, NULL, EVP_sha256(), NULL, pkey) != 1) {
+        char *msg = get_openssl_error_message_for_test();
+        result = DDS_SECURITY_VALIDATION_FAILED;
+        DDS_Security_Exception_set(ex, "Authentication", DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result, "Failed to initialize verify context: %s", msg);
+        ddsrt_free(msg);
+        goto err_verify;
+    }
+
+    if (EVP_DigestVerifyUpdate(mdctx, data, dataLen) != 1) {
+        char *msg = get_openssl_error_message_for_test();
+        result = DDS_SECURITY_VALIDATION_FAILED;
+        DDS_Security_Exception_set(ex, "Authentication", DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result, "Failed to update verify context: %s", msg);
+        ddsrt_free(msg);
+        goto err_verify;
+    }
+
+    if (EVP_DigestVerifyFinal(mdctx, signature, signatureLen) != 1) {
+        char *msg = get_openssl_error_message_for_test();
+        result = DDS_SECURITY_VALIDATION_FAILED;
+        DDS_Security_Exception_set(ex, "Authentication", DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result, "Failed to finalize verify context: %s", msg);
+        ddsrt_free(msg);
+        goto err_verify;
+    }
+
+err_verify:
+    EVP_MD_CTX_destroy(mdctx);
+err_create_ctx:
+    return result;
+}
+
+DDS_Security_ValidationResult_t
+get_public_key(
+    EVP_PKEY *pkey,
+    unsigned char **buffer,
+    size_t *length,
+    DDS_Security_SecurityException *ex)
+{
+    DDS_Security_ValidationResult_t result = DDS_SECURITY_VALIDATION_OK;
+    BIO *bio = NULL;
+    char *ptr = NULL;
+    size_t sz;
+
+    assert(pkey);
+    assert(buffer);
+
+    *length = 0;
+
+    bio = BIO_new(BIO_s_mem());
+
+    if ( bio == NULL) {
+      result = DDS_SECURITY_VALIDATION_FAILED;
+      DDS_Security_Exception_set(ex, "Authentication", DDS_SECURITY_ERR_UNDEFINED_CODE,  (int)result, "Failed to get public key: BIO_new_mem_buf failed");
+    } else if (!PEM_write_bio_PUBKEY(bio, pkey)) {
+      char *msg = get_openssl_error_message_for_test();
+      result = DDS_SECURITY_VALIDATION_FAILED;
+      DDS_Security_Exception_set(ex, "Authentication", DDS_SECURITY_ERR_UNDEFINED_CODE,  (int)result, "Failed to get public key: PEM_write_bio_PUBKEY failed: %s", msg);
+      ddsrt_free(msg);
+    } else {
+      sz = (size_t)BIO_get_mem_data(bio, &ptr);
+      *buffer = ddsrt_malloc(sz +1);
+      memcpy(*buffer, ptr, sz);
+      *length = sz;
+    }
+
+    if (bio) BIO_free(bio);
+
+    return result;
+}
+
+static EVP_PKEY *
+modp_data_to_pubkey(
+    const unsigned char *data,
+    uint32_t size)
+{
+    EVP_PKEY *pkey= NULL;
+    DH *dhkey = NULL;
+    ASN1_INTEGER *asni;
+    BIGNUM *bn = NULL;
+
+    if (!(asni = d2i_ASN1_INTEGER(NULL, &data, size))) {
+        char *msg = get_openssl_error_message_for_test();
+        printf("Failed to decode DH public key: %s", msg);
+        ddsrt_free(msg);
+        goto fail_asni;
+    }
+
+    if (!(bn = ASN1_INTEGER_to_BN(asni, NULL))) {
+        char *msg = get_openssl_error_message_for_test();
+        printf("Failed to convert to BIGNU<: %s", msg);
+        ddsrt_free(msg);
+        goto fail_bn;
+    }
+
+    if (!(dhkey = DH_get_2048_256())) {
+        char *msg = get_openssl_error_message_for_test();
+        printf("Failed to allocate dhkey: %s", msg);
+        ddsrt_free(msg);
+        goto fail_dhkey;
+    }
+
+    dh_set_public_key(dhkey,bn);
+
+    if (!(pkey = EVP_PKEY_new())) {
+        char *msg = get_openssl_error_message_for_test();
+        printf("Failed to allocate pkey: %s", msg);
+        ddsrt_free(msg);
+        goto fail_pkey;
+    }
+
+    if (!EVP_PKEY_set1_DH(pkey, dhkey)) {
+        char *msg = get_openssl_error_message_for_test();
+        printf("Failed to set public key: %s", msg);
+        ddsrt_free(msg);
+        EVP_PKEY_free(pkey);
+        pkey = NULL;
+    }
+
+    ASN1_INTEGER_free(asni);
+    DH_free(dhkey);
+
+    return pkey;
+
+fail_pkey:
+    DH_free(dhkey);
+fail_dhkey:
+    BN_free(bn);
+fail_bn:
+    ASN1_INTEGER_free(asni);
+fail_asni:
+    return NULL;
+}
+
+static EVP_PKEY *
+ecdh_data_to_pubkey(
+    const unsigned char *data,
+    uint32_t size)
+{
+    EVP_PKEY *pkey = NULL;
+    EC_KEY *eckey = NULL;
+    EC_GROUP *group = NULL;
+    EC_POINT *point = NULL;
+
+    if (!(group = EC_GROUP_new_by_curve_name(NID_X9_62_prime256v1))) {
+        char *msg = get_openssl_error_message_for_test();
+        printf("Failed to allocate EC group: %s", msg);
+        ddsrt_free(msg);
+    } else if (!(point = EC_POINT_new(group))) {
+        char *msg = get_openssl_error_message_for_test();
+        printf("Failed to allocate EC point: %s", msg);
+        ddsrt_free(msg);
+    } else if (EC_POINT_oct2point(group, point, data, size, NULL) != 1) {
+        char *msg = get_openssl_error_message_for_test();
+        printf("Failed to deserialize EC public key to EC point: %s", msg);
+        ddsrt_free(msg);
+    } else if (!(eckey = EC_KEY_new())) {
+        char *msg = get_openssl_error_message_for_test();
+        printf("Failed to allocate EC KEY: %s", msg);
+        ddsrt_free(msg);
+    } else if (EC_KEY_set_group(eckey, group) != 1) {
+        char *msg = get_openssl_error_message_for_test();
+        printf("Failed to convert octet sequence to ASN1 integer: %s", msg);
+        ddsrt_free(msg);
+    } else if (EC_KEY_set_public_key(eckey, point) != 1) {
+        char *msg = get_openssl_error_message_for_test();
+        printf("Failed to set EC public key: %s", msg);
+        ddsrt_free(msg);
+    } else if (!(pkey = EVP_PKEY_new())) {
+        char *msg = get_openssl_error_message_for_test();
+        printf("Failed to allocate EVP key: %s", msg);
+        ddsrt_free(msg);
+    } else if (EVP_PKEY_set1_EC_KEY(pkey, eckey) != 1) {
+        char *msg = get_openssl_error_message_for_test();
+        printf("Failed to set EVP key to EC public key: %s", msg);
+        ddsrt_free(msg);
+        EVP_PKEY_free(pkey);
+        pkey = NULL;
+    }
+
+    if (eckey) EC_KEY_free(eckey);
+    if (point) EC_POINT_free(point);
+    if (group) EC_GROUP_free(group);
+
+    return pkey;
+}
+
+int
+check_shared_secret(
+    dds_security_authentication *auth,
+    int use_ecdh,
+    const DDS_Security_BinaryProperty_t *dh_remote,
+    EVP_PKEY *dh_local_private,
+
+    DDS_Security_HandshakeHandle handshake_handle)
+
+{
+/* calculate shared secret with the other side */
+    EVP_PKEY_CTX *ctx = NULL;
+    size_t skeylen;
+    EVP_PKEY *dh_remote_public = NULL;
+    DDS_Security_SharedSecretHandle shared_secret_local_handle;
+    DDS_Security_SecurityException exception;
+    DDS_Security_octet *shared_secret_local;
+    DDS_Security_octet shared_secret_remote[SHA256_DIGEST_LENGTH];
+    DDS_Security_octet *secret;
+    int result;
+
+    if (use_ecdh) {
+        dh_remote_public = ecdh_data_to_pubkey(dh_remote->value._buffer, dh_remote->value._length);
+    } else {
+        dh_remote_public = modp_data_to_pubkey(dh_remote->value._buffer, dh_remote->value._length);
+    }
+
+    if (!dh_remote_public) {
+        CU_FAIL("Coud not decode DH public key");
+    }
+
+    ctx = EVP_PKEY_CTX_new(dh_local_private, NULL /* no engine */);
+    if (!ctx)
+    {
+           /* Error occurred */
+        CU_FAIL("Coud not allocate CTX");
+    }
+
+    if (EVP_PKEY_derive_init(ctx) <= 0)
+    {
+           /* Error */
+        CU_FAIL("Coud not init");
+    }
+    result = EVP_PKEY_derive_set_peer(ctx, dh_remote_public) ;
+    if (result<= 0)
+    {
+           /* Error */
+        char *msg = get_openssl_error_message_for_test();
+        printf("DH remote public: %s\n",dh_remote->value._buffer);
+        printf("SSL Error: %s\n", msg);
+        ddsrt_free(msg);
+        CU_FAIL("Could not set peer");
+    }
+
+    /* Determine buffer length */
+    result = EVP_PKEY_derive(ctx, NULL, &skeylen);
+    if (result <= 0)
+    {
+           /* Error */
+        CU_FAIL("Could not set derive");
+    }
+
+    secret = ddsrt_malloc(skeylen+1);
+
+    if (EVP_PKEY_derive(ctx, secret, &skeylen) <= 0)
+    {
+           /* Error */
+        CU_FAIL("Could not set derive");
+    }
+
+    SHA256(secret, skeylen, shared_secret_remote);
+
+    ddsrt_free(secret);
+
+    /* get the secret handle */
+    shared_secret_local_handle = auth->get_shared_secret( auth, handshake_handle, &exception);
+
+    /* convert handle to object */
+    shared_secret_local = ((DDS_Security_SharedSecretHandleImpl *)(shared_secret_local_handle))->shared_secret;
+    /*compare with remote. They should be same */
+
+    if (ctx) {
+        EVP_PKEY_CTX_free(ctx);
+    }
+
+    if (dh_remote_public) {
+        EVP_PKEY_free(dh_remote_public);
+    }
+
+    return memcmp(shared_secret_local, shared_secret_remote, SHA256_DIGEST_LENGTH);
+}
+
+
+
+DDS_Security_ValidationResult_t
+create_asymmetrical_signature_for_test(
+        EVP_PKEY *pkey,
+        void *data,
+        size_t dataLen,
+        unsigned char **signature,
+        size_t *signatureLen,
+        DDS_Security_SecurityException *ex)
+{
+    DDS_Security_ValidationResult_t result = DDS_SECURITY_VALIDATION_OK;
+    EVP_MD_CTX *mdctx = NULL;
+    EVP_PKEY_CTX *kctx = NULL;
+
+    if (!(mdctx = EVP_MD_CTX_create())) {
+        char *msg = get_openssl_error_message_for_test();
+        result = DDS_SECURITY_VALIDATION_FAILED;
+        DDS_Security_Exception_set(ex, "Authentication", DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result, "Failed to create signing context: %s", msg);
+        ddsrt_free(msg);
+        goto err_create_ctx;
+    }
+
+    if (EVP_DigestSignInit(mdctx, &kctx, EVP_sha256(), NULL, pkey) != 1) {
+        char *msg = get_openssl_error_message_for_test();
+        result = DDS_SECURITY_VALIDATION_FAILED;
+        DDS_Security_Exception_set(ex, "Authentication", DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result, "Failed to initialize signing context: %s", msg);
+        ddsrt_free(msg);
+        goto err_sign;
+    }
+
+    if (EVP_PKEY_CTX_set_rsa_padding(kctx, RSA_PKCS1_PSS_PADDING) < 1) {
+        char *msg = get_openssl_error_message_for_test();
+        result = DDS_SECURITY_VALIDATION_FAILED;
+        DDS_Security_Exception_set(ex, "Authentication", DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result, "Failed to initialize signing context: %s", msg);
+        ddsrt_free(msg);
+        goto err_sign;
+    }
+
+    if (EVP_DigestSignUpdate(mdctx, data, dataLen) != 1) {
+        char *msg = get_openssl_error_message_for_test();
+        result = DDS_SECURITY_VALIDATION_FAILED;
+        DDS_Security_Exception_set(ex, "Authentication", DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result, "Failed to update signing context: %s", msg);
+        ddsrt_free(msg);
+        goto err_sign;
+    }
+
+    if (EVP_DigestSignFinal(mdctx, NULL, signatureLen) != 1) {
+        char *msg = get_openssl_error_message_for_test();
+        result = DDS_SECURITY_VALIDATION_FAILED;
+        DDS_Security_Exception_set(ex, "Authentication", DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result, "Failed to finalize signing context: %s", msg);
+        ddsrt_free(msg);
+        goto err_sign;
+    }
+
+    //*signature = os_malloc(sizeof(unsigned char) * (*signatureLen));
+    *signature = OPENSSL_malloc(*signatureLen);
+    if (EVP_DigestSignFinal(mdctx, *signature, signatureLen) != 1) {
+        char *msg = get_openssl_error_message_for_test();
+        result = DDS_SECURITY_VALIDATION_FAILED;
+        DDS_Security_Exception_set(ex, "Authentication", DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result, "Failed to finalize signing context: %s", msg);
+        ddsrt_free(msg);
+        ddsrt_free(signature);
+    }
+
+    err_sign:
+    EVP_MD_CTX_destroy(mdctx);
+    err_create_ctx:
+    return result;
+}
+
+
diff --git a/src/security/builtin_plugins/tests/common/src/handshake_helper.h b/src/security/builtin_plugins/tests/common/src/handshake_helper.h
new file mode 100644
index 0000000..b6e2e38
--- /dev/null
+++ b/src/security/builtin_plugins/tests/common/src/handshake_helper.h
@@ -0,0 +1,90 @@
+/*
+ * Copyright(c) 2006 to 2019 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+
+#ifndef DDS_SECURITY_BUITIN_TEST_HANDSHAKE_HELPER_H
+#define DDS_SECURITY_BUITIN_TEST_HANDSHAKE_HELPER_H
+
+#include "dds/security/dds_security_api.h"
+#include "dds/security/core/dds_security_serialize.h"
+
+#include <openssl/bn.h>
+#include <openssl/asn1.h>
+#include <openssl/x509.h>
+#include <openssl/x509_vfy.h>
+#include <openssl/pem.h>
+#include <openssl/bio.h>
+#include <openssl/err.h>
+#include <openssl/evp.h>
+
+const BIGNUM *
+dh_get_public_key(
+     DH *dhkey);
+
+int
+dh_set_public_key(
+    DH *dhkey,
+    BIGNUM *pubkey);
+
+DDS_Security_ValidationResult_t
+create_signature_for_test(
+    EVP_PKEY *pkey,
+    const DDS_Security_BinaryProperty_t **binary_properties,
+    const uint32_t binary_properties_length,
+    unsigned char **signature,
+    size_t *signatureLen,
+    DDS_Security_SecurityException *ex);
+
+DDS_Security_ValidationResult_t
+create_asymmetrical_signature_for_test(
+     EVP_PKEY *pkey,
+     void *data,
+     size_t dataLen,
+     unsigned char **signature,
+     size_t *signatureLen,
+     DDS_Security_SecurityException *ex);
+
+char *
+get_openssl_error_message_for_test(
+        void);
+
+DDS_Security_ValidationResult_t
+validate_asymmetrical_signature_for_test(
+    EVP_PKEY *pkey,
+    void *data,
+    size_t dataLen,
+    unsigned char *signature,
+    size_t signatureLen,
+    DDS_Security_SecurityException *ex);
+
+DDS_Security_ValidationResult_t
+get_public_key(
+     EVP_PKEY *pkey,
+     unsigned char **buffer,
+     size_t *length,
+    DDS_Security_SecurityException *ex);
+
+/* for DEBUG purposes */
+void print_binary_test( char* name, unsigned char *value, uint32_t size);
+
+DDS_Security_BinaryProperty_t *
+print_binary_properties_test(
+    DDS_Security_DataHolder *token);
+
+int
+check_shared_secret(
+    dds_security_authentication *auth,
+    int use_ecdh,
+    const DDS_Security_BinaryProperty_t *dh_remote,
+    EVP_PKEY *dh_local_private,
+    DDS_Security_HandshakeHandle handshake_handle);
+
+#endif
\ No newline at end of file
diff --git a/src/security/builtin_plugins/tests/common/src/loader.c b/src/security/builtin_plugins/tests/common/src/loader.c
new file mode 100644
index 0000000..c6584f2
--- /dev/null
+++ b/src/security/builtin_plugins/tests/common/src/loader.c
@@ -0,0 +1,222 @@
+/*
+ * Copyright(c) 2006 to 2019 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+
+#include <CUnit/Test.h>
+#include <dds/ddsrt/misc.h>
+#include "loader.h"
+#include "dds/ddsrt/dynlib.h"
+#include "dds/ddsrt/heap.h"
+#include "dds/ddsrt/string.h"
+#include "sys/stat.h"
+#include "assert.h"
+#include "stdio.h"
+#include "string.h"
+#include "dds/security/core/dds_security_utils.h"
+
+struct plugin_info {
+    void *context;
+    ddsrt_dynlib_t lib_handle;
+    plugin_init func_init;
+    plugin_finalize func_fini;
+};
+
+struct plugins_hdl {
+    struct plugin_info plugin_ac;
+    struct plugin_info plugin_auth;
+    struct plugin_info plugin_crypto;
+};
+
+static void*
+load_plugin(
+        struct plugin_info *info,
+        const char *name_lib,
+        const char *name_init,
+        const char *name_fini)
+{
+    dds_return_t result;
+    void *plugin = NULL;
+    assert(info);
+
+    result = ddsrt_dlopen(name_lib, true, &info->lib_handle);
+    if (result == DDS_RETCODE_OK && info->lib_handle) {
+
+        result = ddsrt_dlsym(info->lib_handle, name_init, (void **)&info->func_init);
+        if( result != DDS_RETCODE_OK || info->func_init == NULL) {
+      char buf[200];
+      ddsrt_dlerror(buf, 200);
+           printf("ERROR: could not init %s\n. Invalid init function: %s: %s", name_lib, name_init, buf);
+           return plugin;
+        }
+
+        result = ddsrt_dlsym(info->lib_handle, name_fini, (void **)&info->func_fini);
+        if( result != DDS_RETCODE_OK || info->func_fini == NULL ) {
+           printf("ERROR: could not init %s\n. Invalid fini function: %s", name_lib, name_fini);
+           return plugin;
+        }
+
+        char * init_parameters = "";
+        (void)info->func_init(init_parameters, &plugin);
+        if (plugin) {
+            info->context = plugin;
+        } else {
+            printf("ERROR: could not init %s\n", name_lib);
+        }
+    } else {
+      char buffer[300];
+      ddsrt_dlerror(buffer,300);
+        printf("ERROR: could not load %s. %s\n", name_lib, buffer);
+    }
+    return plugin;
+}
+
+struct plugins_hdl*
+load_plugins(
+        dds_security_access_control **ac,
+        dds_security_authentication **auth,
+        dds_security_cryptography   **crypto)
+{
+    struct plugins_hdl *plugins = ddsrt_malloc(sizeof(struct plugins_hdl));
+    assert(plugins);
+    memset(plugins, 0, sizeof(struct plugins_hdl));
+    if (ac) {
+        *ac = load_plugin(&(plugins->plugin_ac),
+                          "dds_security_ac",
+                          "init_access_control",
+                          "finalize_access_control");
+        if (!(*ac)) {
+            goto err;
+        }
+    }
+    if (auth) {
+        *auth = load_plugin(&(plugins->plugin_auth),
+                            //"dds_security_auth",
+                            "dds_security_auth",
+                            "init_authentication",
+                            "finalize_authentication");
+        if (!(*auth)) {
+            goto err;
+        }
+    }
+    if (crypto) {
+        *crypto = load_plugin(&(plugins->plugin_crypto),
+                              "dds_security_crypto",
+                              "init_crypto",
+                              "finalize_crypto");
+        if (!(*crypto)) {
+            goto err;
+        }
+    }
+    return plugins;
+
+err:
+    unload_plugins(plugins);
+    return NULL;
+}
+
+static void
+unload_plugin(
+        struct plugin_info *info)
+{
+    dds_return_t result;
+    assert(info);
+
+    if (info->lib_handle) {
+        if (info->func_fini && info->context) {
+            info->func_fini(info->context);
+        }
+        result = ddsrt_dlclose( info->lib_handle );
+        if ( result != 0 ){
+          printf( "Error occured while closing the library\n");
+        }
+    }
+}
+
+void
+unload_plugins(
+        struct plugins_hdl *plugins)
+{
+    assert (plugins);
+    unload_plugin(&(plugins->plugin_ac));
+    unload_plugin(&(plugins->plugin_auth));
+    unload_plugin(&(plugins->plugin_crypto));
+    ddsrt_free(plugins);
+}
+
+static size_t
+regular_file_size(
+         const char *filename)
+{
+    size_t sz = 0;
+    /* Provided? */
+    if (filename) {
+        /* Accessible? */
+#if _WIN32
+        struct _stat stat_info;
+        int ret = _stat( filename, &stat_info );
+#else
+        struct stat stat_info;
+        int ret = stat( filename, &stat_info );
+#endif
+        if ( ret == 0 ) {
+            /* Regular? */
+#ifdef WIN32
+      if (stat_info.st_mode & _S_IFREG) {
+#else
+      if (S_ISREG(stat_info.st_mode)) {
+#endif
+                /* Yes, so get the size. */
+                sz = ( size_t ) stat_info.st_size;
+            }
+        }
+    }
+    return sz;
+}
+
+char *
+load_file_contents(
+    const char *filename)
+{
+    char *document = NULL;
+    char *fname;
+    size_t sz, r;
+    FILE *fp;
+
+    assert(filename);
+
+    /* Get portable file name. */
+    fname = DDS_Security_normalize_file( filename );
+    if (fname) {
+        /* Get size if it is a accessible regular file (no dir or link). */
+        sz = regular_file_size(fname);
+        if (sz > 0) {
+            /* Open the actual file. */
+            DDSRT_WARNING_MSVC_OFF(4996);
+            fp = fopen(fname, "r");
+            DDSRT_WARNING_MSVC_ON(4996);
+            if (fp) {
+                /* Read the content. */
+                document = ddsrt_malloc(sz + 1);
+                r = fread(document, 1, sz, fp);
+                if (r == 0) {
+                    ddsrt_free(document);
+                    document = NULL;
+                } else {
+                    document[r] = '\0';
+                }
+                (void)fclose(fp);
+            }
+        }
+        ddsrt_free(fname);
+    }
+
+    return document;
+}
diff --git a/src/security/builtin_plugins/tests/common/src/loader.h b/src/security/builtin_plugins/tests/common/src/loader.h
new file mode 100644
index 0000000..305ac53
--- /dev/null
+++ b/src/security/builtin_plugins/tests/common/src/loader.h
@@ -0,0 +1,34 @@
+/*
+ * Copyright(c) 2006 to 2019 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+
+#ifndef _DBT_SECURITY_PLUGINS_LOADER_H_
+#define _DBT_SECURITY_PLUGINS_LOADER_H_
+
+#include "dds/security/dds_security_api.h"
+
+struct plugins_hdl;
+
+struct plugins_hdl*
+load_plugins(
+        dds_security_access_control **ac,
+        dds_security_authentication **auth,
+        dds_security_cryptography   **crypto);
+
+void
+unload_plugins(
+        struct plugins_hdl *plugins);
+
+char*
+load_file_contents(
+        const char *filename);
+
+#endif
diff --git a/src/security/builtin_plugins/tests/config_env.h.in b/src/security/builtin_plugins/tests/config_env.h.in
new file mode 100644
index 0000000..3f2b23a
--- /dev/null
+++ b/src/security/builtin_plugins/tests/config_env.h.in
@@ -0,0 +1,17 @@
+/*
+ * Copyright(c) 2006 to 2019 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+#ifndef CONFIG_ENV_H
+#define CONFIG_ENV_H
+
+#define CONFIG_ENV_TESTS_DIR           "@CUnit_builtin_plugins_tests_dir@"
+
+#endif /* CONFIG_ENV_H */
diff --git a/src/security/builtin_plugins/tests/get_authenticated_peer_credential_token/src/get_authenticated_peer_credential_token_utests.c b/src/security/builtin_plugins/tests/get_authenticated_peer_credential_token/src/get_authenticated_peer_credential_token_utests.c
new file mode 100644
index 0000000..12216c5
--- /dev/null
+++ b/src/security/builtin_plugins/tests/get_authenticated_peer_credential_token/src/get_authenticated_peer_credential_token_utests.c
@@ -0,0 +1,1648 @@
+/*
+ * Copyright(c) 2006 to 2019 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+
+/* CUnit includes. */
+
+#include "CUnit/CUnit.h"
+#include "CUnit/Test.h"
+#include "assert.h"
+/* Test helper includes. */
+#include "common/src/loader.h"
+#include "common/src/handshake_helper.h"
+
+#include "dds/security/dds_security_api.h"
+#include <openssl/opensslv.h>
+#include <openssl/sha.h>
+#include <openssl/x509.h>
+#include <openssl/pem.h>
+
+#include "dds/ddsrt/string.h"
+#include "dds/ddsrt/heap.h"
+#include <stdio.h>
+#include <string.h>
+#include "dds/ddsrt/environ.h"
+
+#include "dds/ddsrt/misc.h"
+#include "dds/ddsrt/endian.h"
+#include "dds/security/core/dds_security_serialize.h"
+#include "dds/security/dds_security_api.h"
+#include "dds/security/core/dds_security_utils.h"
+
+#define HANDSHAKE_SIGNATURE_SIZE 6
+
+#if DDSRT_ENDIAN == DDSRT_LITTLE_ENDIAN
+static unsigned bswap4u (unsigned x)
+{
+  return (x >> 24) | ((x >> 8) & 0xff00) | ((x << 8) & 0xff0000) | (x << 24);
+}
+#define toBE4u(x) bswap4u (x)
+#define fromBE4u(x) bswap4u (x)
+#else
+#define toBE4u(x) (x)
+#define fromBE4u(x) (x)
+#endif
+
+
+static const char * AUTH_PROTOCOL_CLASS_ID          = "DDS:Auth:PKI-DH:1.0";
+static const char * PERM_ACCESS_CLASS_ID            = "DDS:Access:Permissions:1.0";
+
+static const char * PROPERTY_IDENTITY_CA            = "dds.sec.auth.identity_ca";
+static const char * PROPERTY_PRIVATE_KEY            = "dds.sec.auth.private_key";
+static const char * PROPERTY_IDENTITY_CERT          = "dds.sec.auth.identity_certificate";
+
+static const char * PROPERTY_CERT_SUBJECT_NAME      = "dds.cert.sn";
+static const char * PROPERTY_CERT_ALGORITHM         = "dds.cert.algo";
+static const char * PROPERTY_CA_SUBJECT_NAME        = "dds.ca.sn";
+static const char * PROPERTY_CA_ALGORITHM           = "dds.ca.aglo";
+
+static const char * PROPERTY_PERM_CA_SUBJECT_NAME   = "ds.perm_ca.sn";
+
+static const char * SUBJECT_NAME_IDENTITY_CERT      = "CN=CHAM-574 client,O=Some Company,ST=Some-State,C=NL";
+static const char * SUBJECT_NAME_IDENTITY_CA        = "CN=CHAM-574 authority,O=Some Company,ST=Some-State,C=NL";
+
+static const char * RSA_2048_ALGORITHM_NAME         = "RSA-2048";
+
+static const char * AUTH_REQUEST_TOKEN_CLASS_ID         = "DDS:Auth:PKI-DH:1.0+AuthReq";
+static const char * AUTH_REQUEST_TOKEN_FUTURE_PROP_NAME = "future_challenge";
+
+static const char * AUTH_HANDSHAKE_REQUEST_TOKEN_CLASS_ID = "DDS:Auth:PKI-DH:1.0+Req";
+static const char * AUTH_HANDSHAKE_REPLY_TOKEN_CLASS_ID   = "DDS:Auth:PKI-DH:1.0+Reply";
+static const char * AUTH_HANDSHAKE_FINAL_TOKEN_CLASS_ID   = "DDS:Auth:PKI-DH:1.0+Final";
+
+static const char * PERMISSIONS_DOCUMENT                  = "permissions_document";
+
+typedef enum {
+    HANDSHAKE_REQUEST,
+    HANDSHAKE_REPLY,
+    HANDSHAKE_FINAL
+} HandshakeStep_t;
+
+
+struct octet_seq {
+    unsigned char  *data;
+    uint32_t  length;
+};
+
+static const char * AUTH_DSIGN_ALGO_RSA_NAME   = "RSASSA-PSS-SHA256";
+static const char * AUTH_KAGREE_ALGO_RSA_NAME  = "DH+MODP-2048-256";
+static const char * AUTH_KAGREE_ALGO_ECDH_NAME = "ECDH+prime256v1-CEUM";
+
+
+
+static const char *identity_certificate =
+
+"data:,-----BEGIN CERTIFICATE-----\n"
+"MIIDYDCCAkigAwIBAgIBBDANBgkqhkiG9w0BAQsFADByMQswCQYDVQQGEwJOTDEL\n"
+"MAkGA1UECBMCT1YxEzARBgNVBAoTCkFETGluayBJU1QxGTAXBgNVBAMTEElkZW50\n"
+"aXR5IENBIFRlc3QxJjAkBgkqhkiG9w0BCQEWF2luZm9AaXN0LmFkbGlua3RlY2gu\n"
+"Y29tMB4XDTE4MDMxMjAwMDAwMFoXDTI3MDMxMTIzNTk1OVowdTELMAkGA1UEBhMC\n"
+"TkwxCzAJBgNVBAgTAk9WMRAwDgYDVQQKEwdBRExpbmsgMREwDwYDVQQLEwhJU1Qg\n"
+"VGVzdDETMBEGA1UEAxMKQWxpY2UgVGVzdDEfMB0GCSqGSIb3DQEJARYQYWxpY2VA\n"
+"YWRsaW5rLmlzdDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBANBW+tEZ\n"
+"Baw7EQCEXyzH9n7IkZ8PQIKe8hG1LAOGYOF/oUYQZJO/HxbWoC4rFqOC20+A6is6\n"
+"kFwr1Zzp/Wurk9CrFXo5Nomi6ActH6LUM57nYqN68w6U38z/XkQxVY/ESZ5dySfD\n"
+"9Q1C8R+zdE8gwbimdYmwX7ioz336nghM2CoAHPDRthQeJupl8x4V7isOltr9CGx8\n"
+"+imJXbGr39OK6u87cNLeu23sUkOIC0lSRMIqIQK3oJtHS70J2qecXdqp9MhE7Xky\n"
+"/GPlI8ptQ1gJ8A3cAOvtI9mtMJMszs2EKWTLfeTcmfJHKKhKjvCgDdh3Jan4x5YP\n"
+"Yg7HG6H+ceOUkMMCAwEAATANBgkqhkiG9w0BAQsFAAOCAQEAkvuqZzyJ3Nu4/Eo5\n"
+"kD0nVgYGBUl7cspu+636q39zPSrxLEDMUWz+u8oXLpyGcgiZ8lZulPTV8dmOn+3C\n"
+"Vg55c5C+gbnbX3MDyb3wB17296RmxYf6YNul4sFOmj6+g2i+Dw9WH0PBCVKbA84F\n"
+"jR3Gx2Pfoifor3DvT0YFSsjNIRt090u4dQglbIb6cWEafC7O24t5jFhGPvJ7L9SE\n"
+"gB0Drh/HmKTVuaqaRkoOKkKaKuWoXsszK1ZFda1DHommnR5LpYPsDRQ2fVM4EuBF\n"
+"By03727uneuG8HLuNcLEV9H0i7LxtyfFkyCPUQvWG5jehb7xPOz/Ml26NAwwjlTJ\n"
+"xEEFrw==\n"
+"-----END CERTIFICATE-----\n";
+
+
+static const char *identity_ca =
+"data:,-----BEGIN CERTIFICATE-----\n"
+"MIIEKTCCAxGgAwIBAgIBATANBgkqhkiG9w0BAQsFADByMQswCQYDVQQGEwJOTDEL\n"
+"MAkGA1UECBMCT1YxEzARBgNVBAoTCkFETGluayBJU1QxGTAXBgNVBAMTEElkZW50\n"
+"aXR5IENBIFRlc3QxJjAkBgkqhkiG9w0BCQEWF2luZm9AaXN0LmFkbGlua3RlY2gu\n"
+"Y29tMB4XDTE4MDMxMjAwMDAwMFoXDTI3MDMxMTIzNTk1OVowcjELMAkGA1UEBhMC\n"
+"TkwxCzAJBgNVBAgTAk9WMRMwEQYDVQQKEwpBRExpbmsgSVNUMRkwFwYDVQQDExBJ\n"
+"ZGVudGl0eSBDQSBUZXN0MSYwJAYJKoZIhvcNAQkBFhdpbmZvQGlzdC5hZGxpbmt0\n"
+"ZWNoLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBANa/ENFfGVXg\n"
+"bPLTzBdDfiZQcp5dWZ//Pb8ErFOJu8uosVHFv8t69dgjHgNHB4OsjmjnR7GfKUZT\n"
+"0cMvWJnjsC7DDlBwFET9rj4k40n96bbVCH9I7+tNhsoqzc6Eu+5h4sk7VfNGTM2Z\n"
+"SyCd4GiSZRuA44rRbhXI7/LDpr4hY5J9ZDo5AM9ZyoLAoh774H3CZWD67S35XvUs\n"
+"72dzE6uKG/vxBbvZ7eW2GLO6ewa9UxlnLVMPfJdpkp/xYXwwcPW2+2YXCge1ujxs\n"
+"tjrOQJ5HUySh6DkE/kZpx8zwYWm9AaCrsvCIX1thsqgvKy+U5v1FS1L58eGc6s//\n"
+"9yMgNhU29R0CAwEAAaOByTCBxjAMBgNVHRMEBTADAQH/MB0GA1UdDgQWBBRNVUJN\n"
+"FzhJPReYT4QSx6dK53CXCTAfBgNVHSMEGDAWgBRNVUJNFzhJPReYT4QSx6dK53CX\n"
+"CTAPBgNVHQ8BAf8EBQMDB/+AMGUGA1UdJQEB/wRbMFkGCCsGAQUFBwMBBggrBgEF\n"
+"BQcDAgYIKwYBBQUHAwMGCCsGAQUFBwMEBggrBgEFBQcDCAYIKwYBBQUHAwkGCCsG\n"
+"AQUFBwMNBggrBgEFBQcDDgYHKwYBBQIDBTANBgkqhkiG9w0BAQsFAAOCAQEAcOLF\n"
+"ZYdJguj0uxeXB8v3xnUr1AWz9+gwg0URdfNLU2KvF2lsb/uznv6168b3/FcPgezN\n"
+"Ihl9GqB+RvGwgXS/1UelCGbQiIUdsNxk246P4uOGPIyW32RoJcYPWZcpY+cw11tQ\n"
+"NOnk994Y5/8ad1DmcxVLLqq5kwpXGWQufV1zOONq8B+mCvcVAmM4vkyF/de56Lwa\n"
+"sAMpk1p77uhaDnuq2lIR4q3QHX2wGctFid5Q375DRscFQteY01r/dtwBBrMn0wuL\n"
+"AMNx9ZGD+zAoOUaslpIlEQ+keAxk3jgGMWFMxF81YfhEnXzevSQXWpyek86XUyFL\n"
+"O9IAQi5pa15gXjSbUg==\n"
+"-----END CERTIFICATE-----\n";
+
+static const char *REMOTE_IDENTITY_CERTIFICATE =
+"-----BEGIN CERTIFICATE-----\n"
+"MIIDcDCCAligAwIBAgIBBTANBgkqhkiG9w0BAQsFADByMQswCQYDVQQGEwJOTDEL\n"
+"MAkGA1UECBMCT1YxEzARBgNVBAoTCkFETGluayBJU1QxGTAXBgNVBAMTEElkZW50\n"
+"aXR5IENBIFRlc3QxJjAkBgkqhkiG9w0BCQEWF2luZm9AaXN0LmFkbGlua3RlY2gu\n"
+"Y29tMB4XDTE4MDMxMjAwMDAwMFoXDTI3MDMxMTIzNTk1OVowcDELMAkGA1UEBhMC\n"
+"TkwxCzAJBgNVBAgTAk9WMQ8wDQYDVQQKEwZBRExpbmsxETAPBgNVBAsTCElTVCBU\n"
+"ZXN0MREwDwYDVQQDEwhCb2IgVGVzdDEdMBsGCSqGSIb3DQEJARYOYm9iQGFkbGlu\n"
+"ay5pc3QwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDB5vqhuWnwhxXZ\n"
+"qffPmfjzge7w91oX4ISlboIfBXp3sLj2mqLSsYhgBNJAn/Fl1OZeFw0d4gVibBgx\n"
+"5Zdcjsi+ClvYK8H534iTJfNriMyhg4kSWxZF1Tixfw3FS7LqjKEY5ZNPfp5a4P+8\n"
+"UveorYJusrnlv1DiF6aPhJQh8J62J6bhx62DNLO7dZbN0BUsnWtyDcfi5DOjf2/r\n"
+"3lSRfecn3uBr1QYRaS5FrV+MSoGcjI3M75mei1TTUp7YT4ZWRR5rKUMql605xsms\n"
+"d6sqJaKofYmw7wCuaVJ86pb/w8srdddKt21xUeQNMKn49H6raezMOE3U5BUMtZ+P\n"
+"2OBLk/CPAgMBAAGjEzARMA8GA1UdDwEB/wQFAwMH/4AwDQYJKoZIhvcNAQELBQAD\n"
+"ggEBAJV71Ckf1zsks5mJXqdUb8bTVHg4hN32pwjCL5c6W2XHAv+YHwE/fN3C1VIY\n"
+"bC8zjUC9dCOyC2AvOQyZQ1eC/WoK6FlXjHVX2upL4lXQ9WL9ztt1mgdRrhvUPuUn\n"
+"aBE8VgNU0t4jl93xMIaU8hB0kQsV+kdcN0cWbrF3mT4s9njRvopJ8hS2UE60V2wA\n"
+"ceUOazH+QGPh1k0jkynrTlVR9GrpebQwZ2UFeinVO0km17IAyQkz+OmPc4jQLJMl\n"
+"CmkbmMwowdLMKC6r/HyE87dN7NvFnRM5iByJklRwN7WDYZrl72HoUOlgTZ7PjW2G\n"
+"jTxK8xXtDCXC/3CNpe0YFnOga8g=\n"
+"-----END CERTIFICATE-----\n";
+
+
+static const char *private_key =
+
+"data:,-----BEGIN RSA PRIVATE KEY-----\n"
+"MIIEowIBAAKCAQEA0Fb60RkFrDsRAIRfLMf2fsiRnw9Agp7yEbUsA4Zg4X+hRhBk\n"
+"k78fFtagLisWo4LbT4DqKzqQXCvVnOn9a6uT0KsVejk2iaLoBy0fotQznudio3rz\n"
+"DpTfzP9eRDFVj8RJnl3JJ8P1DULxH7N0TyDBuKZ1ibBfuKjPffqeCEzYKgAc8NG2\n"
+"FB4m6mXzHhXuKw6W2v0IbHz6KYldsavf04rq7ztw0t67bexSQ4gLSVJEwiohAreg\n"
+"m0dLvQnap5xd2qn0yETteTL8Y+Ujym1DWAnwDdwA6+0j2a0wkyzOzYQpZMt95NyZ\n"
+"8kcoqEqO8KAN2HclqfjHlg9iDscbof5x45SQwwIDAQABAoIBAG0dYPeqd0IhHWJ7\n"
+"8azufbchLMN1pX/D51xG2uptssfnpHuhkkufSZUYi4QipRS2ME6PYhWJ8pmTi6lH\n"
+"E6cUkbI0KGd/F4U2gPdhNrR9Fxwea5bbifkVF7Gx/ZkRjZJiZ3w9+mCNTQbJDKhh\n"
+"wITAzzT6WYznhvqbzzBX1fTa6kv0GAQtX7aHKM+XIwkhX2gzU5TU80bvH8aMrT05\n"
+"tAMGQqkUeRnpo0yucBl4VmTZzd/+X/d2UyXR0my15jE5iH5o+p+E6qTRE9D+MGUd\n"
+"MQ6Ftj0Untqy1lcog1ZLL6zPlnwcD4jgY5VCYDgvabnrSwymOJapPLsAEdWdq+U5\n"
+"ec44BMECgYEA/+3qPUrd4XxA517qO3fCGBvf2Gkr7w5ZDeATOTHGuD8QZeK0nxPl\n"
+"CWhRjdgkqo0fyf1cjczL5XgYayo+YxkO1Z4RUU+8lJAHlVx9izOQo+MTQfkwH4BK\n"
+"LYlHxMoHJwAOXXoE+dmBaDh5xT0mDUGU750r763L6EFovE4qRBn9hxkCgYEA0GWz\n"
+"rpOPNxb419WxG9npoQYdCZ5IbmEOGDH3ReggVzWHmW8sqtkqTZm5srcyDpqAc1Gu\n"
+"paUveMblEBbU+NFJjLWOfwB5PCp8jsrqRgCQSxolShiVkc3Vu3oyzMus9PDge1eo\n"
+"9mwVGO7ojQKWRu/WVAakENPaAjeyyhv4dqSNnjsCgYEAlwe8yszqoY1k8+U0T0G+\n"
+"HeIdOCXgkmOiNCj+zyrLvaEhuS6PLq1b5TBVqGJcSPWdQ+MrglbQIKu9pUg5ptt7\n"
+"wJ5WU+i9PeK9Ruxc/g/BFKYFkFJQjtZzb+nqm3wpul8zGwDN/O/ZiTqCyd3rHbmM\n"
+"/dZ/viKPCZHIEBAEq0m3LskCgYBndzcAo+5k8ZjWwBfQth5SfhCIp/daJgGzbYtR\n"
+"P/BenAsY2KOap3tjT8Fsw5usuHSxzIojX6H0Gvu7Qzq11mLn43Q+BeQrRQTWeFRc\n"
+"MQdy4iZFZXNNEp7dF8yE9VKHwdgSJPGUdxD6chMvf2tRCN6mlS171VLV6wVvZvez\n"
+"H/vX5QKBgD2Dq/NHpjCpAsECP9awmNF5Akn5WJbRGmegwXIih2mOtgtYYDeuQyxY\n"
+"ZCrdJFfIUjUVPagshEmUklKhkYMYpzy2PQDVtaVcm6UNFroxT5h+J+KDs1LN1H8G\n"
+"LsASrzyAg8EpRulwXEfLrWKiu9DKv8bMEgO4Ovgz8zTKJZIFhcac\n"
+"-----END RSA PRIVATE KEY-----\n";
+
+
+static char *remote_private_key =
+"-----BEGIN RSA PRIVATE KEY-----\n"
+"MIIEowIBAAKCAQEAweb6oblp8IcV2an3z5n484Hu8PdaF+CEpW6CHwV6d7C49pqi\n"
+"0rGIYATSQJ/xZdTmXhcNHeIFYmwYMeWXXI7Ivgpb2CvB+d+IkyXza4jMoYOJElsW\n"
+"RdU4sX8NxUuy6oyhGOWTT36eWuD/vFL3qK2CbrK55b9Q4hemj4SUIfCetiem4cet\n"
+"gzSzu3WWzdAVLJ1rcg3H4uQzo39v695UkX3nJ97ga9UGEWkuRa1fjEqBnIyNzO+Z\n"
+"notU01Ke2E+GVkUeaylDKpetOcbJrHerKiWiqH2JsO8ArmlSfOqW/8PLK3XXSrdt\n"
+"cVHkDTCp+PR+q2nszDhN1OQVDLWfj9jgS5PwjwIDAQABAoIBAHfgWhED9VgL29le\n"
+"uGMzmPLK4LM+6Qcb+kXghTeyhl1a928WeRVzRpG+SVJEz9QaBHYlICnaY2PO2kJ2\n"
+"49YIPFkpRFDn9JuLs/7tFonj4Eb2cBbWE3YG9W7e0t+oBiv1117yB9m8uSAMPG7s\n"
+"iEpTQvE3M7CzT8kHwCS4XXCCN0z7LqKyZ1heScjdfhV3D2TnFFjdtQ/9KfQa3hIc\n"
+"6ftbpi4EKbfasspyqfrJ/cqjHzse9iEXLOZJhs+atBAKe/uJ4Hc3LRPbX4MPniAp\n"
+"JJrldXFK9p+HILlbXvu+5n+DSGbZmT1x9a/E9suGyoJiASDH2Ax4yCVTi+v8C1R2\n"
+"aKdU1LkCgYEA/3dFuM6zIHwiJ0GKT0gtJL6J3m+i51SNcRIm8deXt6HULMpUNajj\n"
+"vZ1bgQm/h+uRBlPV3swkaVxvPTIabOTY4gmCBSzvVCSIAKHVc/+5Nkl9KruwSq4G\n"
+"tctmXZ7ymMDi+6QGCJTJkAx6jptXyrzC00HOjXOwyQ+iDipqgr3A8FsCgYEAwk7B\n"
+"2/hi569EIHFRT6nz/JMqQVPZ/MJDKoKhffTbnjQ5OAzpiVN6cyThMM1iVJEBFNhx\n"
+"OEacy60Qj0TtR1oYrQSRSLm58TTxiuB4Pohbmg3iU+kSM/eTq/ups/Ul1oCs2eAb\n"
+"POfweD3c4d4i7sN8bUNQXehiE4MOlK9TYQy39t0CgYAJht0mwy6S644qgJsz0bE9\n"
+"SY3Cqc8daV3M9axWIIAb7QEImpMBXUcA7zlWWpK18ub5oW68XEiPVU8grRmnLfGY\n"
+"nFoo70ANlz8rJt3a8ZJqn9r3GQC+CDdf2DH9E8xgPfE5CSjgcQwDPzPi1ZA0k02A\n"
+"q1eUltfk55xXguVt8r2bOQKBgQC7+kldr1yv20VDRZ1uPnMGRLE6Zg6bkqw78gid\n"
+"vEbDNK6uZP+BlTr/LgyVk/yu52Fucz6FPPrvqEw+7mXHA4ifya1r+BHFIn0S57os\n"
+"dOp5jTkKCI9NqxQ3683vhRjH/dA7L63qLFDdYqvP74FID+LOKbMURn6rdbyjZ0J4\n"
+"vz8yGQKBgHIzcKlQosRxf+KptOPMGRs30L9PnH+sNmTo2SmEzAGkBkt1msGRh/2l\n"
+"uT3hOEhUXL9knRyXwQSXgrIwr9QwI5rGS5FAgX26TgBtPBDs2NuyyhhS5yxsiEPT\n"
+"BR+EjQFW9dzRkpRJgvsG4DcNAhFn7fQqFNcWXgFWuBXmGNkdtEGR\n"
+"-----END RSA PRIVATE KEY-----";
+
+
+
+static struct plugins_hdl *g_plugins = NULL;
+static dds_security_authentication *g_auth = NULL;
+
+static DDS_Security_IdentityHandle g_local_identity_handle = DDS_SECURITY_HANDLE_NIL;
+static DDS_Security_IdentityHandle g_remote_identity_handle = DDS_SECURITY_HANDLE_NIL;
+static DDS_Security_AuthRequestMessageToken g_remote_auth_request_token = DDS_SECURITY_TOKEN_INIT;
+static const DDS_Security_BinaryProperty_t *g_challenge1_predefined_glb = NULL;
+static const DDS_Security_BinaryProperty_t *g_challenge2_predefined_glb = NULL;
+static DDS_Security_OctetSeq g_serialized_participant_data = DDS_SECURITY_SEQUENCE_INIT;
+static DDS_Security_ParticipantBuiltinTopicData *g_local_participant_data = NULL;
+
+static DDS_Security_ParticipantBuiltinTopicData *g_remote_participant_data1 = NULL;
+static DDS_Security_ParticipantBuiltinTopicData *g_remote_participant_data2 = NULL;
+static DDS_Security_GUID_t g_candidate_participant_guid;
+static DDS_Security_GUID_t g_remote_participant_guid1;
+static DDS_Security_GUID_t g_remote_participant_guid2;
+
+static EVP_PKEY *g_dh_modp_key = NULL;
+static EVP_PKEY *g_dh_ecdh_key = NULL;
+static struct octet_seq g_dh_modp_pub_key = {NULL, 0};
+static struct octet_seq g_dh_ecdh_pub_key = {NULL, 0};
+
+
+static void
+octet_seq_init(
+    struct octet_seq *seq,
+    unsigned char *data,
+    uint32_t size)
+{
+    seq->data = ddsrt_malloc(size);
+    memcpy(seq->data, data, size);
+    seq->length = size;
+}
+
+static void
+octet_seq_deinit(
+    struct octet_seq *seq)
+{
+    ddsrt_free(seq->data);
+}
+
+static void
+serializer_participant_data(
+    DDS_Security_ParticipantBuiltinTopicData *pdata,
+    unsigned char **buffer,
+    size_t *size);
+
+static void
+dds_security_property_init(
+    DDS_Security_PropertySeq *seq,
+    DDS_Security_unsigned_long size)
+{
+    seq->_length = size;
+    seq->_maximum = size;
+    seq->_buffer = ddsrt_malloc(size * sizeof(DDS_Security_Property_t));
+    memset(seq->_buffer, 0, size * sizeof(DDS_Security_Property_t));
+}
+
+static void
+dds_security_property_deinit(
+    DDS_Security_PropertySeq *seq)
+{
+    uint32_t i;
+
+    for (i = 0; i < seq->_length; i++) {
+        ddsrt_free(seq->_buffer[i].name);
+        ddsrt_free(seq->_buffer[i].value);
+    }
+    ddsrt_free(seq->_buffer);
+}
+
+static void
+reset_exception(
+    DDS_Security_SecurityException *ex)
+{
+    ex->minor_code = 0;
+    ex->code = 0;
+    ddsrt_free(ex->message);
+    ex->message = NULL;
+}
+
+static void
+initialize_identity_token(
+    DDS_Security_IdentityToken *token,
+    const char *certAlgo,
+    const char *caAlgo)
+{
+    memset(token, 0, sizeof(*token));
+
+    token->class_id = ddsrt_strdup(AUTH_PROTOCOL_CLASS_ID);
+    token->properties._maximum = 4;
+    token->properties._length  = 4;
+    token->properties._buffer = DDS_Security_PropertySeq_allocbuf(4);
+
+    token->properties._buffer[0].name = ddsrt_strdup(PROPERTY_CERT_SUBJECT_NAME);
+    token->properties._buffer[0].value = ddsrt_strdup(SUBJECT_NAME_IDENTITY_CERT);
+    token->properties._buffer[0].propagate = true;
+
+    token->properties._buffer[1].name = ddsrt_strdup(PROPERTY_CERT_ALGORITHM);
+    token->properties._buffer[1].value = ddsrt_strdup(certAlgo);
+    token->properties._buffer[1].propagate = true;
+
+    token->properties._buffer[2].name = ddsrt_strdup(PROPERTY_CA_SUBJECT_NAME);
+    token->properties._buffer[2].value = ddsrt_strdup(SUBJECT_NAME_IDENTITY_CA);
+    token->properties._buffer[2].propagate = true;
+
+    token->properties._buffer[3].name = ddsrt_strdup(PROPERTY_CA_ALGORITHM);
+    token->properties._buffer[3].value = ddsrt_strdup(caAlgo);
+    token->properties._buffer[3].propagate = true;
+}
+
+static void
+initialize_permissions_token(
+    DDS_Security_PermissionsToken *token,
+    const char *caAlgo)
+{
+    token->class_id = ddsrt_strdup(PERM_ACCESS_CLASS_ID);
+    token->properties._length = 2;
+    token->properties._maximum = 2;
+    token->properties._buffer = DDS_Security_PropertySeq_allocbuf(4);
+    token->properties._buffer[0].name = ddsrt_strdup(PROPERTY_CERT_SUBJECT_NAME);
+    token->properties._buffer[0].value = ddsrt_strdup(SUBJECT_NAME_IDENTITY_CA);
+    token->properties._buffer[1].name = ddsrt_strdup(PROPERTY_PERM_CA_SUBJECT_NAME);
+    token->properties._buffer[1].value = ddsrt_strdup(caAlgo);
+}
+
+
+
+static void
+fill_auth_request_token(
+    DDS_Security_AuthRequestMessageToken *token)
+{
+    uint32_t i;
+    size_t len = 32;
+    unsigned char *challenge;
+
+    challenge = ddsrt_malloc(len);
+
+    for (i = 0; i < len; i++) {
+        challenge[i] = (unsigned char)(0xFF - i);
+    }
+
+    memset(token, 0, sizeof(*token));
+
+    token->class_id = ddsrt_strdup(AUTH_REQUEST_TOKEN_CLASS_ID);
+    token->binary_properties._maximum = 1;
+    token->binary_properties._length = 1;
+    token->binary_properties._buffer = DDS_Security_BinaryPropertySeq_allocbuf(1);
+    token->binary_properties._buffer->name = ddsrt_strdup(AUTH_REQUEST_TOKEN_FUTURE_PROP_NAME);
+
+    token->binary_properties._buffer->value._maximum = (DDS_Security_unsigned_long) len;
+    token->binary_properties._buffer->value._length = (DDS_Security_unsigned_long) len;
+    token->binary_properties._buffer->value._buffer = challenge;
+}
+
+
+static DDS_Security_BinaryProperty_t *
+find_binary_property(
+    DDS_Security_DataHolder *token,
+    const char *name)
+{
+    DDS_Security_BinaryProperty_t *result = NULL;
+    uint32_t i;
+
+    for (i = 0; i < token->binary_properties._length && !result; i++) {
+        if (token->binary_properties._buffer[i].name && (strcmp(token->binary_properties._buffer[i].name, name) == 0)) {
+            result = &token->binary_properties._buffer[i];
+        }
+    }
+
+    return result;
+}
+
+
+static DDS_Security_Property_t *
+find_property(
+    DDS_Security_DataHolder *token,
+    const char *name)
+{
+    DDS_Security_Property_t *result = NULL;
+    uint32_t i;
+
+    for (i = 0; i < token->properties._length && !result; i++) {
+        if (token->properties._buffer[i].name && (strcmp(token->properties._buffer[i].name, name) == 0)) {
+            result = &token->properties._buffer[i];
+        }
+    }
+
+    return result;
+}
+
+static void
+deinitialize_identity_token(
+    DDS_Security_IdentityToken *token)
+{
+    DDS_Security_DataHolder_deinit(token);
+}
+
+
+static int
+validate_local_identity(void)
+{
+    int res = 0;
+    DDS_Security_ValidationResult_t result;
+    DDS_Security_DomainId domain_id = 0;
+    DDS_Security_Qos participant_qos;
+    DDS_Security_SecurityException exception = {NULL, 0, 0};
+    DDS_Security_GUID_t local_participant_guid;
+    DDS_Security_GuidPrefix_t prefix = {0xb0, 0xb1, 0xb2, 0xb3, 0xb4, 0xb5, 0xb6, 0xb7, 0xb8, 0xb9, 0xba, 0xbb};
+    DDS_Security_EntityId_t entityId = {{0xb0,0xb1,0xb2},0x1};
+    unsigned char *sdata;
+    size_t sz;
+
+    memset(&local_participant_guid, 0, sizeof(local_participant_guid));
+    memcpy(&g_candidate_participant_guid.prefix, &prefix, sizeof(prefix));
+    memcpy(&g_candidate_participant_guid.entityId, &entityId, sizeof(entityId));
+
+    memset(&participant_qos, 0, sizeof(participant_qos));
+    dds_security_property_init(&participant_qos.property.value, 3);
+    participant_qos.property.value._buffer[0].name = ddsrt_strdup(PROPERTY_IDENTITY_CERT);
+    participant_qos.property.value._buffer[0].value = ddsrt_strdup(identity_certificate);
+    participant_qos.property.value._buffer[1].name = ddsrt_strdup(PROPERTY_IDENTITY_CA);
+    participant_qos.property.value._buffer[1].value = ddsrt_strdup(identity_ca);
+    participant_qos.property.value._buffer[2].name = ddsrt_strdup(PROPERTY_PRIVATE_KEY);
+    participant_qos.property.value._buffer[2].value = ddsrt_strdup(private_key);
+
+    /* Now call the function. */
+    result = g_auth->validate_local_identity(
+                            g_auth,
+                            &g_local_identity_handle,
+                            &local_participant_guid,
+                            domain_id,
+                            &participant_qos,
+                            &g_candidate_participant_guid,
+                            &exception);
+
+    if (result != DDS_SECURITY_VALIDATION_OK) {
+        res = -1;
+        printf("validate_local_identity_failed: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+
+    dds_security_property_deinit(&participant_qos.property.value);
+    reset_exception(&exception);
+
+    g_local_participant_data = DDS_Security_ParticipantBuiltinTopicData_alloc();
+    memcpy(&g_local_participant_data->key[0], &local_participant_guid, 12);
+    /* convert from big-endian format to native format */
+    g_local_participant_data->key[0] = fromBE4u(g_local_participant_data->key[0]);
+    g_local_participant_data->key[1] = fromBE4u(g_local_participant_data->key[1]);
+    g_local_participant_data->key[2] = fromBE4u(g_local_participant_data->key[2]);
+
+    initialize_identity_token(&g_local_participant_data->identity_token, RSA_2048_ALGORITHM_NAME, RSA_2048_ALGORITHM_NAME);
+    initialize_permissions_token(&g_local_participant_data->permissions_token, RSA_2048_ALGORITHM_NAME);
+
+    g_local_participant_data->security_info.participant_security_attributes = 0x01;
+    g_local_participant_data->security_info.plugin_participant_security_attributes = 0x02;
+
+    serializer_participant_data(g_local_participant_data, &sdata, &sz);
+
+    g_serialized_participant_data._length = g_serialized_participant_data._maximum = (DDS_Security_unsigned_long) sz;
+    g_serialized_participant_data._buffer = sdata;
+
+    return res;
+}
+
+static void
+release_local_identity(void)
+{
+    DDS_Security_SecurityException exception = {NULL, 0, 0};
+    DDS_Security_boolean success;
+
+    if (g_local_identity_handle != DDS_SECURITY_HANDLE_NIL) {
+        success = g_auth->return_identity_handle(g_auth, g_local_identity_handle, &exception);
+        if (!success) {
+            printf("return_identity_handle failed: %s\n", exception.message ? exception.message : "Error message missing");
+        }
+        reset_exception(&exception);
+    }
+
+    DDS_Security_OctetSeq_deinit(&g_serialized_participant_data);
+
+    if (g_local_participant_data) {
+       DDS_Security_ParticipantBuiltinTopicData_free(g_local_participant_data);
+    }
+}
+
+static X509 *
+load_certificate(
+   const char *data)
+{
+    X509 *cert = NULL;
+    BIO *bio;
+
+    bio = BIO_new_mem_buf((void *) data, -1);
+    if (!bio) {
+        return NULL;
+    }
+
+    cert = PEM_read_bio_X509(bio, NULL, NULL, NULL);
+
+    BIO_free(bio);
+
+    return cert;
+}
+
+static int
+get_adjusted_participant_guid(
+    X509 *cert,
+    const DDS_Security_GUID_t *candidate,
+    DDS_Security_GUID_t *adjusted)
+{
+    int result = 0;
+    unsigned char high[SHA256_DIGEST_LENGTH], low[SHA256_DIGEST_LENGTH];
+    unsigned char *subject;
+    DDS_Security_octet hb = 0x80;
+    X509_NAME *name;
+    unsigned char *tmp = NULL;
+    int32_t i, size;
+
+    name = X509_get_subject_name(cert);
+    size = i2d_X509_NAME(name, &tmp);
+    if (size > 0) {
+        subject = ddsrt_malloc((size_t) size);
+        memcpy(subject, tmp, (size_t)size);
+        OPENSSL_free(tmp);
+
+        SHA256(subject, (size_t)size, high);
+        SHA256(&candidate->prefix[0], sizeof(DDS_Security_GuidPrefix_t), low);
+
+        adjusted->entityId = candidate->entityId;
+        for (i = 0; i < 6; i++) {
+            adjusted->prefix[i] = hb | high[i]>>1;
+            hb = (unsigned char)( high[i]<<7 );
+        }
+        for (i = 0; i < 6; i++) {
+            adjusted->prefix[i+6] = low[i];
+        }
+        ddsrt_free(subject);
+        result = 1;
+    }
+
+    return result;
+}
+
+static int
+create_dh_key_modp_2048(
+    EVP_PKEY **pkey)
+{
+    int r = 0;
+    EVP_PKEY *params = NULL;
+    EVP_PKEY_CTX *kctx = NULL;
+    DH *dh = NULL;
+
+    *pkey = NULL;
+
+    if ((params = EVP_PKEY_new()) == NULL) {
+        char *msg = get_openssl_error_message_for_test();
+        printf("Failed to allocate EVP_PKEY: %s", msg);
+        ddsrt_free(msg);
+        r = -1;
+    } else if ((dh = DH_get_2048_256()) == NULL) {
+        char *msg = get_openssl_error_message_for_test();
+        printf("Failed to allocate DH parameter: %s", msg);
+        ddsrt_free(msg);
+        r = -1;
+    } else if (EVP_PKEY_set1_DH(params, dh) <= 0) {
+        char *msg = get_openssl_error_message_for_test();
+        printf("Failed to set DH parameter to MODP_2048_256: %s", msg);
+        ddsrt_free(msg);
+        r = -1;
+    } else if ((kctx = EVP_PKEY_CTX_new(params, NULL)) == NULL) {
+        char *msg = get_openssl_error_message_for_test();
+        printf("Failed to allocate KEY context %s", msg);
+        ddsrt_free(msg);
+        r = -1;
+    } else if (EVP_PKEY_keygen_init(kctx) <= 0) {
+        char *msg = get_openssl_error_message_for_test();
+        printf("Failed to initialize KEY context: %s", msg);
+        ddsrt_free(msg);
+        r = -1;
+    } else if (EVP_PKEY_keygen(kctx, pkey) <= 0) {
+        char *msg = get_openssl_error_message_for_test();
+        printf("Failed to generate :MODP_2048_256 keys %s", msg);
+        ddsrt_free(msg);
+        r = -1;
+    }
+
+    if (params) EVP_PKEY_free(params);
+    if (kctx) EVP_PKEY_CTX_free(kctx);
+    if (dh) DH_free(dh);
+
+    return r;
+}
+
+static int
+get_dh_public_key_modp_2048(
+    EVP_PKEY *pkey,
+    struct octet_seq *pubkey)
+{
+    int r = 0;
+    DH *dhkey;
+    unsigned char *buffer = NULL;
+    uint32_t size;
+    ASN1_INTEGER *asn1int;
+
+    dhkey = EVP_PKEY_get1_DH(pkey);
+    if (!dhkey) {
+        char *msg = get_openssl_error_message_for_test();
+        printf("Failed to get DH key from PKEY: %s", msg);
+        ddsrt_free(msg);
+        r = -1;
+        goto fail_get_dhkey;
+    }
+
+    asn1int = BN_to_ASN1_INTEGER( dh_get_public_key(dhkey) , NULL);
+    if (!asn1int) {
+        char *msg = get_openssl_error_message_for_test();
+        printf("Failed to convert DH key to ASN1 integer: %s", msg);
+        ddsrt_free(msg);
+        r = -1;
+        goto fail_get_pubkey;
+    }
+
+    size = (uint32_t)i2d_ASN1_INTEGER(asn1int, &buffer);
+    octet_seq_init(pubkey, buffer, size);
+
+    ASN1_INTEGER_free(asn1int);
+    OPENSSL_free(buffer);
+
+fail_get_pubkey:
+    DH_free(dhkey);
+fail_get_dhkey:
+    return r;
+}
+
+static int
+create_dh_key_ecdh(
+    EVP_PKEY **pkey)
+{
+    int r = 0;
+    EVP_PKEY *params = NULL;
+    EVP_PKEY_CTX *pctx = NULL;
+    EVP_PKEY_CTX *kctx = NULL;
+
+    *pkey = NULL;
+
+    if ((pctx = EVP_PKEY_CTX_new_id(EVP_PKEY_EC, NULL)) == NULL) {
+        char *msg = get_openssl_error_message_for_test();
+        printf("Failed to allocate DH parameter context: %s", msg);
+        ddsrt_free(msg);
+        r = -1;
+    } else if (EVP_PKEY_paramgen_init(pctx) <= 0) {
+        char *msg = get_openssl_error_message_for_test();
+        printf("Failed to initialize DH generation context: %s", msg);
+        ddsrt_free(msg);
+        r = -1;
+    } else if (EVP_PKEY_CTX_set_ec_paramgen_curve_nid(pctx, NID_X9_62_prime256v1) <= 0) {
+        char *msg = get_openssl_error_message_for_test();
+        printf("Failed to set DH generation parameter generation method: %s", msg);
+        ddsrt_free(msg);
+        r = -1;
+    } else if (EVP_PKEY_paramgen(pctx, &params) <= 0) {
+        char *msg = get_openssl_error_message_for_test();
+        printf("Failed to generate DH parameters: %s", msg);
+        ddsrt_free(msg);
+        r = -1;
+    } else if ((kctx = EVP_PKEY_CTX_new(params, NULL)) == NULL) {
+        char *msg = get_openssl_error_message_for_test();
+        printf("Failed to allocate KEY context %s", msg);
+        ddsrt_free(msg);
+        r = -1;
+    } else if (EVP_PKEY_keygen_init(kctx) <= 0) {
+        char *msg = get_openssl_error_message_for_test();
+        printf("Failed to initialize KEY context: %s", msg);
+        ddsrt_free(msg);
+        r = -1;
+    } else if (EVP_PKEY_keygen(kctx, pkey) <= 0) {
+        char *msg = get_openssl_error_message_for_test();
+        printf("Failed to generate :MODP_2048_256 keys %s", msg);
+        ddsrt_free(msg);
+        r = -1;
+    }
+
+    if (kctx) EVP_PKEY_CTX_free(kctx);
+    if (params) EVP_PKEY_free(params);
+    if (pctx) EVP_PKEY_CTX_free(pctx);
+
+    return r;
+}
+
+static int
+get_dh_public_key_ecdh(
+    EVP_PKEY *pkey,
+    struct octet_seq *pubkey)
+{
+    int r = 0;
+    EC_KEY *eckey = NULL;
+    const EC_GROUP *group = NULL;
+    const EC_POINT *point = NULL;
+    size_t sz;
+
+    if (!(eckey = EVP_PKEY_get1_EC_KEY(pkey))) {
+        char *msg = get_openssl_error_message_for_test();
+        printf("Failed to get EC key from PKEY: %s", msg);
+        ddsrt_free(msg);
+        r = -1;
+    } else if (!(point = EC_KEY_get0_public_key(eckey))) {
+        char *msg = get_openssl_error_message_for_test();
+        printf("Failed to get public key from ECKEY: %s", msg);
+        ddsrt_free(msg);
+        r = -1;
+    } else if (!(group = EC_KEY_get0_group(eckey))) {
+        char *msg = get_openssl_error_message_for_test();
+        printf("Failed to get group from ECKEY: %s", msg);
+        ddsrt_free(msg);
+        r = -1;
+    } else if ((sz = EC_POINT_point2oct(group, point, POINT_CONVERSION_COMPRESSED, NULL, 0, NULL)) != 0) {
+        pubkey->data = ddsrt_malloc(sz);
+        pubkey->length = (uint32_t) EC_POINT_point2oct(group, point, POINT_CONVERSION_COMPRESSED, pubkey->data, sz, NULL);
+        if (pubkey->length == 0) {
+            char *msg = get_openssl_error_message_for_test();
+            printf("Failed to serialize public EC key: %s", msg);
+            ddsrt_free(msg);
+            octet_seq_deinit(pubkey);
+            r = -1;
+        }
+    } else {
+        char *msg = get_openssl_error_message_for_test();
+        printf("Failed to serialize public EC key: %s", msg);
+        ddsrt_free(msg);
+        r = -1;
+    }
+
+    if (eckey) EC_KEY_free(eckey);
+
+    return r;
+}
+
+static int
+validate_remote_identities (const char *remote_id_certificate)
+{
+    int res = 0;
+    DDS_Security_ValidationResult_t result;
+    DDS_Security_IdentityToken remote_identity_token;
+    static DDS_Security_AuthRequestMessageToken local_auth_request_token = DDS_SECURITY_TOKEN_INIT;
+    DDS_Security_GUID_t guid1;
+    DDS_Security_GUID_t guid2;
+    DDS_Security_SecurityException exception = {NULL, 0, 0};
+    DDS_Security_GuidPrefix_t prefix1 = {0xa0, 0xa1, 0xa2, 0xa3, 0xa4, 0xa5, 0xa6, 0xa7, 0xa8, 0xa9, 0xaa, 0xab};
+    DDS_Security_GuidPrefix_t prefix2 = {0xc0, 0xc1, 0xc2, 0xc3, 0xc4, 0xc5, 0xc6, 0xc7, 0xc8, 0xc9, 0xca, 0xcb};
+    DDS_Security_EntityId_t entityId = {{0xb0,0xb1,0xb2},0x1};
+    X509 *cert;
+
+    memcpy(&guid1.prefix, &prefix1, sizeof(prefix1));
+    memcpy(&guid1.entityId, &entityId, sizeof(entityId));
+    memcpy(&guid2.prefix, &prefix2, sizeof(prefix2));
+    memcpy(&guid2.entityId, &entityId, sizeof(entityId));
+
+    if (g_local_identity_handle == DDS_SECURITY_HANDLE_NIL) {
+        return -1;
+    }
+
+    cert = load_certificate(remote_id_certificate);
+    if (!cert) {
+        return -1;
+    }
+
+    if (!get_adjusted_participant_guid(cert, &guid1, &g_remote_participant_guid1)) {
+        X509_free(cert);
+        return -1;
+    }
+
+    if (!get_adjusted_participant_guid(cert, &guid2, &g_remote_participant_guid2)) {
+        X509_free(cert);
+        return -1;
+    }
+
+    X509_free(cert);
+
+    initialize_identity_token(&remote_identity_token, RSA_2048_ALGORITHM_NAME, RSA_2048_ALGORITHM_NAME);
+
+    reset_exception(&exception);
+
+    fill_auth_request_token(&g_remote_auth_request_token);
+
+    result = g_auth->validate_remote_identity(
+                g_auth,
+                &g_remote_identity_handle,
+                &local_auth_request_token,
+                &g_remote_auth_request_token,
+                g_local_identity_handle,
+                &remote_identity_token,
+                &g_remote_participant_guid2,
+                &exception);
+
+    if ((result != DDS_SECURITY_VALIDATION_PENDING_HANDSHAKE_REQUEST) &&
+            (result != DDS_SECURITY_VALIDATION_PENDING_HANDSHAKE_MESSAGE)) {
+        printf("validate_remote_identity_failed: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+
+    reset_exception(&exception);
+
+    deinitialize_identity_token(&remote_identity_token);
+    DDS_Security_DataHolder_deinit(&local_auth_request_token);
+
+    g_remote_participant_data1 = DDS_Security_ParticipantBuiltinTopicData_alloc();
+    memcpy(&g_remote_participant_data1->key[0], &g_remote_participant_guid1, 12);
+    g_remote_participant_data1->key[0] = fromBE4u(g_remote_participant_data1->key[0]);
+    g_remote_participant_data1->key[1] = fromBE4u(g_remote_participant_data1->key[1]);
+    g_remote_participant_data1->key[2] = fromBE4u(g_remote_participant_data1->key[2]);
+
+    initialize_identity_token(&g_remote_participant_data1->identity_token, RSA_2048_ALGORITHM_NAME, RSA_2048_ALGORITHM_NAME);
+    initialize_permissions_token(&g_remote_participant_data1->permissions_token, RSA_2048_ALGORITHM_NAME);
+
+    g_remote_participant_data1->security_info.participant_security_attributes = 0x01;
+    g_remote_participant_data1->security_info.plugin_participant_security_attributes = 0x02;
+
+    g_remote_participant_data2 = DDS_Security_ParticipantBuiltinTopicData_alloc();
+    memcpy(&g_remote_participant_data2->key[0], &g_remote_participant_guid2, 12);
+    g_remote_participant_data2->key[0] = fromBE4u(g_remote_participant_data2->key[0]);
+    g_remote_participant_data2->key[1] = fromBE4u(g_remote_participant_data2->key[1]);
+    g_remote_participant_data2->key[2] = fromBE4u(g_remote_participant_data2->key[2]);
+
+    initialize_identity_token(&g_remote_participant_data2->identity_token, RSA_2048_ALGORITHM_NAME, RSA_2048_ALGORITHM_NAME);
+    initialize_permissions_token(&g_remote_participant_data2->permissions_token, RSA_2048_ALGORITHM_NAME);
+
+    g_remote_participant_data2->security_info.participant_security_attributes = 0x01;
+    g_remote_participant_data2->security_info.plugin_participant_security_attributes = 0x02;
+
+    g_remote_participant_data2->security_info.participant_security_attributes = 0x01;
+    g_remote_participant_data2->security_info.plugin_participant_security_attributes = 0x02;
+
+    g_challenge1_predefined_glb = find_binary_property(&g_remote_auth_request_token, AUTH_REQUEST_TOKEN_FUTURE_PROP_NAME);
+    g_challenge2_predefined_glb = g_challenge1_predefined_glb;
+
+    return res;
+}
+
+static void
+release_remote_identities(void)
+{
+    DDS_Security_SecurityException exception = {NULL, 0, 0};
+    DDS_Security_boolean success;
+
+    if (g_remote_identity_handle != DDS_SECURITY_HANDLE_NIL) {
+        success = g_auth->return_identity_handle(g_auth, g_remote_identity_handle, &exception);
+        if (!success) {
+            printf("return_identity_handle failed: %s\n", exception.message ? exception.message : "Error message missing");
+        }
+        reset_exception(&exception);
+    }
+
+    DDS_Security_DataHolder_deinit(&g_remote_auth_request_token);
+
+    DDS_Security_ParticipantBuiltinTopicData_free(g_remote_participant_data1);
+    DDS_Security_ParticipantBuiltinTopicData_free(g_remote_participant_data2);
+}
+
+CU_Init(ddssec_builtin_get_authenticated_peer_credential)
+{
+    int result = 0;
+
+    /* Only need the authentication plugin. */
+    g_plugins = load_plugins(NULL   /* Access Control */,
+                             &g_auth  /* Authentication */,
+                             NULL   /* Cryptograpy    */);
+    if (g_plugins) {
+        result = validate_local_identity();
+        if (result >= 0) {
+            result = validate_remote_identities( REMOTE_IDENTITY_CERTIFICATE );
+        }
+        if (result >= 0) {
+            result = create_dh_key_modp_2048(&g_dh_modp_key);
+        }
+        if (result >= 0) {
+            result = get_dh_public_key_modp_2048(g_dh_modp_key, &g_dh_modp_pub_key);
+        }
+        if (result >= 0) {
+            result = create_dh_key_ecdh(&g_dh_ecdh_key);
+        }
+        if (result >= 0) {
+            result = get_dh_public_key_ecdh(g_dh_ecdh_key, &g_dh_ecdh_pub_key);
+        }
+    } else {
+        result = -1;
+    }
+
+
+    return result;
+}
+
+CU_Clean(ddssec_builtin_get_authenticated_peer_credential)
+{
+    release_local_identity();
+    release_remote_identities();
+    unload_plugins(g_plugins);
+    octet_seq_deinit(&g_dh_modp_pub_key);
+    octet_seq_deinit(&g_dh_ecdh_pub_key);
+    if (g_dh_modp_key) {
+        EVP_PKEY_free(g_dh_modp_key);
+    }
+    if (g_dh_ecdh_key) {
+        EVP_PKEY_free(g_dh_ecdh_key);
+    }
+    return 0;
+}
+
+static void
+serializer_participant_data(
+    DDS_Security_ParticipantBuiltinTopicData *pdata,
+    unsigned char **buffer,
+    size_t *size)
+{
+    DDS_Security_Serializer serializer;
+    serializer = DDS_Security_Serializer_new(1024, 1024);
+
+    DDD_Security_Serialize_ParticipantBuiltinTopicData(serializer, pdata);
+    DDS_Security_Serializer_buffer(serializer, buffer,  size);
+    DDS_Security_Serializer_free(serializer);
+}
+
+
+static void
+set_binary_property_value(
+     DDS_Security_BinaryProperty_t *bp,
+     const char *name,
+     const unsigned char *data,
+     size_t length)
+{
+    assert(bp);
+    assert(name);
+    assert(data);
+
+    bp->name = ddsrt_strdup(name);
+    bp->value._maximum = bp->value._length = (DDS_Security_unsigned_long) length;
+    if (length) {
+        bp->value._buffer = ddsrt_malloc(length);
+        memcpy(bp->value._buffer, data, length);
+    } else {
+        bp->value._buffer = NULL;
+    }
+}
+
+static void
+set_binary_property_string(
+     DDS_Security_BinaryProperty_t *bp,
+     const char *name,
+     const char *data)
+{
+    uint32_t length;
+
+    assert(bp);
+    assert(name);
+    assert(data);
+
+    length = (uint32_t)strlen(data) + 1;
+    set_binary_property_value(bp, name, (const unsigned char *)data, length);
+}
+
+static void
+fill_handshake_message_token(
+    DDS_Security_HandshakeMessageToken *token,
+    DDS_Security_ParticipantBuiltinTopicData *pdata,
+    const char *certificate,
+    const char *dsign,
+    const char *kagree,
+    const struct octet_seq *diffie_hellman1,
+    const unsigned char *challengeData,
+    unsigned int challengeDataSize,
+    const struct octet_seq *diffie_hellman2,
+    const unsigned char *challengeData2,
+    unsigned int challengeDataSize2,
+    const DDS_Security_BinaryProperty_t *hash1_from_request,
+    const DDS_Security_BinaryProperty_t *hash2_from_reply,
+    HandshakeStep_t step)
+{
+    DDS_Security_BinaryProperty_t *tokens;
+    DDS_Security_BinaryProperty_t *c_id;
+    DDS_Security_BinaryProperty_t *c_perm;
+    DDS_Security_BinaryProperty_t *c_pdata;
+    DDS_Security_BinaryProperty_t *c_dsign_algo;
+    DDS_Security_BinaryProperty_t *c_kagree_algo;
+    DDS_Security_BinaryProperty_t *hash_c1;
+    DDS_Security_BinaryProperty_t *hash_c2;
+    DDS_Security_BinaryProperty_t *dh1;
+    DDS_Security_BinaryProperty_t *dh2;
+    DDS_Security_BinaryProperty_t *challenge1;
+    DDS_Security_BinaryProperty_t *challenge2;
+    DDS_Security_BinaryProperty_t *signature;
+    DDS_Security_SecurityException exception = {NULL, 0, 0};
+    unsigned idx;
+    unsigned char *serialized_local_participant_data;
+    size_t serialized_local_participant_data_size;
+    /*unsigned hash[32];*/
+
+    switch( step )
+    {
+
+    case HANDSHAKE_REQUEST:
+       tokens = DDS_Security_BinaryPropertySeq_allocbuf(8);
+       c_id = &tokens[0];
+       c_perm = &tokens[1];
+       c_pdata = &tokens[2];
+       c_dsign_algo = &tokens[3];
+       c_kagree_algo = &tokens[4];
+       hash_c1 = &tokens[5];
+       dh1 = &tokens[6];
+       challenge1 = &tokens[7];
+
+        serializer_participant_data(pdata, &serialized_local_participant_data, &serialized_local_participant_data_size);
+
+       /* Store the Identity Certificate associated with the local identify in c.id property */
+       if (certificate) {
+           set_binary_property_string(c_id, "c.id", certificate);
+       } else {
+           set_binary_property_string(c_id, "c.idx", "rubbish");
+       }
+
+       /* Store the permission document in the c.perm property */
+       set_binary_property_string(c_perm, "c.perm", PERMISSIONS_DOCUMENT);
+
+       /* Store the provided g_local_participant_data in the c.pdata property */
+       set_binary_property_value(c_pdata, "c.pdata", serialized_local_participant_data, serialized_local_participant_data_size);
+       ddsrt_free(serialized_local_participant_data);
+
+       /* Set the used signing algorithm descriptor in c.dsign_algo */
+       if (dsign) {
+           set_binary_property_string(c_dsign_algo, "c.dsign_algo", dsign);
+       } else {
+           set_binary_property_string(c_dsign_algo, "c.dsign_algox", "rubbish");
+       }
+
+       /* Set the used key algorithm descriptor in c.kagree_algo */
+       if (kagree) {
+           set_binary_property_string(c_kagree_algo, "c.kagree_algo", kagree);
+       } else {
+           set_binary_property_string(c_kagree_algo, "c.kagree_algox", "rubbish");
+       }
+
+       /* Calculate the hash_c1 */
+       {
+           DDS_Security_BinaryPropertySeq bseq;
+           DDS_Security_Serializer serializer;
+           unsigned char hash1_sentrequest_arr[32];
+           unsigned char *buffer;
+           size_t size;
+
+           bseq._length = bseq._maximum = 5;
+           bseq._buffer = tokens;
+
+           serializer = DDS_Security_Serializer_new(1024, 1024);
+
+           DDS_Security_Serialize_BinaryPropertySeq(serializer, &bseq);
+           DDS_Security_Serializer_buffer(serializer, &buffer, &size);
+           SHA256(buffer, size, hash1_sentrequest_arr);
+           ddsrt_free(buffer);
+           DDS_Security_Serializer_free(serializer);
+
+           set_binary_property_value(hash_c1, "hash_c1", hash1_sentrequest_arr, sizeof(hash1_sentrequest_arr));
+       }
+
+       /* Set the DH public key associated with the local participant in dh1 property */
+       if (diffie_hellman1) {
+           set_binary_property_value(dh1, "dh1", diffie_hellman1->data, diffie_hellman1->length);
+       } else {
+           set_binary_property_string(dh1, "dh1x", "rubbish");
+       }
+
+       /* Set the challenge in challenge1 property */
+       if (challengeData) {
+           set_binary_property_value(challenge1, "challenge1", challengeData, challengeDataSize);
+       } else {
+           set_binary_property_value(challenge1, "challenge1x", g_challenge1_predefined_glb->value._buffer, g_challenge1_predefined_glb->value._length);
+       }
+
+       token->class_id = ddsrt_strdup(AUTH_HANDSHAKE_REQUEST_TOKEN_CLASS_ID);
+       token->binary_properties._length = token->binary_properties._maximum = 8;
+       token->binary_properties._buffer = tokens;
+       break;
+
+    case HANDSHAKE_REPLY:
+        tokens = DDS_Security_BinaryPropertySeq_allocbuf(12);
+        idx = 0;
+        c_id = &tokens[idx++];
+        c_perm = &tokens[idx++];
+        c_pdata = &tokens[idx++];
+        c_dsign_algo = &tokens[idx++];
+        c_kagree_algo = &tokens[idx++];
+        hash_c2 = &tokens[idx++];
+        challenge2 = &tokens[idx++];
+        dh2 = &tokens[idx++];
+        challenge1 = &tokens[idx++];
+        dh1 = &tokens[idx++];
+        hash_c1 = &tokens[idx++] ;
+        signature = &tokens[idx++];
+
+        serializer_participant_data(pdata, &serialized_local_participant_data, &serialized_local_participant_data_size);
+
+        /* Store the Identity Certificate associated with the local identify in c.id property */
+        if (certificate) {
+           set_binary_property_string(c_id, "c.id", certificate);
+        } else {
+           set_binary_property_string(c_id, "c.idx", "rubbish");
+        }
+
+        /* Store the permission document in the c.perm property */
+        set_binary_property_string(c_perm, "c.perm", PERMISSIONS_DOCUMENT);
+
+        /* Store the provided g_local_participant_data in the c.pdata property */
+        set_binary_property_value(c_pdata, "c.pdata", serialized_local_participant_data, serialized_local_participant_data_size);
+        ddsrt_free(serialized_local_participant_data);
+
+        /* Set the used signing algorithm descriptor in c.dsign_algo */
+        if (dsign) {
+           set_binary_property_string(c_dsign_algo, "c.dsign_algo", dsign);
+        } else {
+           set_binary_property_string(c_dsign_algo, "c.dsign_algox", "rubbish");
+        }
+
+        /* Set the used key algorithm descriptor in c.kagree_algo */
+        if (kagree) {
+           set_binary_property_string(c_kagree_algo, "c.kagree_algo", kagree);
+        } else {
+           set_binary_property_string(c_kagree_algo, "c.kagree_algox", "rubbish");
+        }
+
+        CU_ASSERT(hash1_from_request != NULL);
+
+        set_binary_property_value(hash_c1, "hash_c1", hash1_from_request->value._buffer, hash1_from_request->value._length);
+
+        /* Calculate the hash_c2 */
+        {
+           DDS_Security_BinaryPropertySeq bseq;
+           DDS_Security_Serializer serializer;
+           unsigned char hash2_sentreply_arr[32];
+           unsigned char *buffer;
+           size_t size;
+
+           bseq._length = bseq._maximum = 5;
+           bseq._buffer = tokens;
+
+           serializer = DDS_Security_Serializer_new(1024, 1024);
+
+           DDS_Security_Serialize_BinaryPropertySeq(serializer, &bseq);
+           DDS_Security_Serializer_buffer(serializer, &buffer, &size);
+           SHA256(buffer, size, hash2_sentreply_arr);
+
+           ddsrt_free(buffer);
+           DDS_Security_Serializer_free(serializer);
+
+           set_binary_property_value(hash_c2, "hash_c2", hash2_sentreply_arr, sizeof(hash2_sentreply_arr));
+        }
+
+        /* Set the challenge in challenge1 property */
+        if (challengeData) {
+          set_binary_property_value(challenge1, "challenge1", challengeData, challengeDataSize);
+        } else {
+          set_binary_property_value(challenge1, "challenge1x", challenge2->value._buffer, challenge2->value._length);
+        }
+
+        /* Set the challenge in challenge2 property */
+        if (challengeData2) {
+           set_binary_property_value(challenge2, "challenge2", challengeData2, challengeDataSize2);
+        } else {
+           set_binary_property_value(challenge2, "challenge2x", challenge2->value._buffer, challenge2->value._length);
+        }
+
+
+        /* Set the DH public key associated with the local participant in dh1 property */
+        if (diffie_hellman1) {
+          set_binary_property_value(dh1, "dh1", diffie_hellman1->data, diffie_hellman1->length);
+        } else {
+          set_binary_property_string(dh1, "dh1x", "rubbish");
+        }
+
+        /* Set the DH public key associated with the local participant in dh2 property */
+        if (diffie_hellman2) {
+          set_binary_property_value(dh2, "dh2", diffie_hellman2->data, diffie_hellman2->length);
+        } else {
+          set_binary_property_string(dh2, "dh2x", "rubbish");
+        }
+
+        /* Calculate the signature */
+        {
+            BIO *bio;
+            EVP_PKEY *private_key_x509;
+            unsigned char *sign;
+            size_t signlen;
+
+            const DDS_Security_BinaryProperty_t * binary_properties[ HANDSHAKE_SIGNATURE_SIZE ];
+
+            /* load certificate in buffer */
+            bio = BIO_new_mem_buf((const char *) remote_private_key, -1);
+            assert( bio );
+            private_key_x509 = PEM_read_bio_PrivateKey(bio, NULL, NULL, NULL);
+            assert (private_key_x509 );
+
+            binary_properties[0] = hash_c2;
+            binary_properties[1] = challenge2;
+            binary_properties[2] = dh2;
+            binary_properties[3] = challenge1;
+            binary_properties[4] = dh1;
+            binary_properties[5] = hash_c1;
+
+            if (create_signature_for_test(private_key_x509, binary_properties, HANDSHAKE_SIGNATURE_SIZE , &sign, &signlen, &exception) != DDS_SECURITY_VALIDATION_OK)
+            {
+                printf("Exception: %s\n", exception.message);
+            }
+            set_binary_property_value(signature, "signature", sign, signlen);
+
+            ddsrt_free(sign);
+            BIO_free(bio);
+            EVP_PKEY_free(private_key_x509);
+        }
+
+        token->class_id = ddsrt_strdup(AUTH_HANDSHAKE_REPLY_TOKEN_CLASS_ID);
+        token->binary_properties._length = token->binary_properties._maximum = 12;
+        token->binary_properties._buffer = tokens;
+        break;
+
+    case HANDSHAKE_FINAL:
+        tokens = DDS_Security_BinaryPropertySeq_allocbuf(7);
+        idx = 0;
+        signature = &tokens[idx++];
+        hash_c1 = &tokens[idx++];
+        challenge1 = &tokens[idx++];
+        dh1 = &tokens[idx++];
+        challenge2 = &tokens[idx++];
+        dh2 = &tokens[idx++];
+        hash_c2 = &tokens[idx++];
+
+        CU_ASSERT(hash1_from_request != NULL);
+        CU_ASSERT(hash2_from_reply != NULL);
+
+        set_binary_property_value(hash_c1, "hash_c1", hash1_from_request->value._buffer, hash1_from_request->value._length);
+        set_binary_property_value(hash_c2, "hash_c2", hash2_from_reply->value._buffer, hash2_from_reply->value._length);
+
+        printf("process: %s\n", hash_c1->name);
+
+        /* Set the challenge in challenge1 property */
+        if (challengeData) {
+          set_binary_property_value(challenge1, "challenge1", challengeData, challengeDataSize);
+        } else {
+          set_binary_property_value(challenge1, "challenge1x", challenge2->value._buffer, challenge2->value._length);
+        }
+
+        /* Set the challenge in challenge2 property */
+        if (challengeData2) {
+           set_binary_property_value(challenge2, "challenge2", challengeData2, challengeDataSize2);
+        } else {
+           set_binary_property_value(challenge2, "challenge2x", challenge2->value._buffer, challenge2->value._length);
+        }
+
+
+        /* Set the DH public key associated with the local participant in dh1 property */
+        if (diffie_hellman1) {
+          set_binary_property_value(dh1, "dh1", diffie_hellman1->data, diffie_hellman1->length);
+        } else {
+          set_binary_property_string(dh1, "dh1x", "rubbish");
+        }
+
+        /* Set the DH public key associated with the local participant in dh2 property */
+        if (diffie_hellman2) {
+          set_binary_property_value(dh2, "dh2", diffie_hellman2->data, diffie_hellman2->length);
+        } else {
+          set_binary_property_string(dh2, "dh2x", "rubbish");
+        }
+
+        /* Calculate the signature */
+        {
+            BIO *bio;
+            EVP_PKEY *private_key_x509;
+            unsigned char *sign;
+            size_t signlen;
+            const DDS_Security_BinaryProperty_t * binary_properties[ HANDSHAKE_SIGNATURE_SIZE ];
+
+            /* load certificate in buffer */
+            bio = BIO_new_mem_buf((const char *) remote_private_key, -1);
+            assert( bio );
+            private_key_x509 = PEM_read_bio_PrivateKey(bio, NULL, NULL, NULL);
+            assert (private_key_x509 );
+
+            binary_properties[0] = hash_c1;
+            binary_properties[1] = challenge1;
+            binary_properties[2] = dh1;
+            binary_properties[3] = challenge2;
+            binary_properties[4] = dh2;
+            binary_properties[5] = hash_c2;
+
+            if (create_signature_for_test(private_key_x509, binary_properties, HANDSHAKE_SIGNATURE_SIZE, &sign, &signlen, &exception) != DDS_SECURITY_VALIDATION_OK)
+            {
+                printf("Exception: %s\n", exception.message);
+            }
+            set_binary_property_value(signature, "signature", sign, signlen);
+
+            ddsrt_free(sign);
+            BIO_free(bio);
+            EVP_PKEY_free(private_key_x509);
+        }
+        token->class_id = ddsrt_strdup(AUTH_HANDSHAKE_FINAL_TOKEN_CLASS_ID);
+        token->binary_properties._length = token->binary_properties._maximum = 7;
+        token->binary_properties._buffer = tokens;
+        break;
+    }
+}
+
+static void
+fill_handshake_message_token_default(
+    DDS_Security_HandshakeMessageToken *token,
+    DDS_Security_ParticipantBuiltinTopicData *pdata,
+    const unsigned char *challengeData,
+    unsigned int challengeDataSize)
+{
+    fill_handshake_message_token(
+            token, pdata, REMOTE_IDENTITY_CERTIFICATE,
+            AUTH_DSIGN_ALGO_RSA_NAME, AUTH_KAGREE_ALGO_RSA_NAME,
+            &g_dh_modp_pub_key, challengeData, challengeDataSize, NULL, NULL, 0, NULL, NULL, HANDSHAKE_REQUEST);
+}
+
+static void
+handshake_message_deinit(
+    DDS_Security_HandshakeMessageToken *token)
+{
+    DDS_Security_DataHolder_deinit(token);
+}
+
+CU_Test(ddssec_builtin_get_authenticated_peer_credential,token_after_request )
+{
+    DDS_Security_ValidationResult_t result;
+    DDS_Security_HandshakeHandle handshake_handle;
+    DDS_Security_HandshakeMessageToken handshake_reply_token_in = DDS_SECURITY_TOKEN_INIT;
+    DDS_Security_HandshakeMessageToken handshake_token_out = DDS_SECURITY_TOKEN_INIT;
+    DDS_Security_AuthenticatedPeerCredentialToken credential_token = DDS_SECURITY_TOKEN_INIT;
+    DDS_Security_SecurityException exception = {NULL, 0, 0};
+    DDS_Security_boolean success;
+    const DDS_Security_BinaryProperty_t *hash1_sentrequest;
+    const DDS_Security_BinaryProperty_t *dh1;
+    const DDS_Security_BinaryProperty_t *challenge1_glb;
+    const DDS_Security_Property_t *c_id;
+    const DDS_Security_Property_t *c_perm;
+    struct octet_seq dh1_pub_key;
+
+    CU_ASSERT_FATAL (g_auth != NULL);
+    CU_ASSERT_FATAL (g_local_identity_handle != DDS_SECURITY_HANDLE_NIL);
+    CU_ASSERT_FATAL (g_remote_identity_handle != DDS_SECURITY_HANDLE_NIL);
+    CU_ASSERT_FATAL (g_auth->begin_handshake_request != NULL);
+    CU_ASSERT_FATAL (g_auth->process_handshake != NULL);
+
+    /* simulate request */
+    result = g_auth->begin_handshake_request(
+                    g_auth,
+                    &handshake_handle,
+                    &handshake_token_out,
+                    g_local_identity_handle,
+                    g_remote_identity_handle,
+                    &g_serialized_participant_data,
+                    &exception);
+
+    CU_ASSERT_FATAL(result == DDS_SECURITY_VALIDATION_PENDING_HANDSHAKE_MESSAGE);
+
+    /* mock reply */
+    dh1 = find_binary_property(&handshake_token_out, "dh1");
+    dh1_pub_key.data = dh1->value._buffer;
+    dh1_pub_key.length = dh1->value._length;
+    challenge1_glb = find_binary_property(&handshake_token_out, "challenge1");
+    hash1_sentrequest = find_binary_property(&handshake_token_out, "hash_c1");
+    fill_handshake_message_token(
+                    &handshake_reply_token_in,
+                    g_remote_participant_data2,
+                    REMOTE_IDENTITY_CERTIFICATE,
+                    AUTH_DSIGN_ALGO_RSA_NAME,
+                    AUTH_KAGREE_ALGO_ECDH_NAME,
+                    &dh1_pub_key,
+                    challenge1_glb->value._buffer,
+                    challenge1_glb->value._length,
+                    &g_dh_ecdh_pub_key,
+                    g_challenge2_predefined_glb->value._buffer,
+                    g_challenge2_predefined_glb->value._length,
+                    hash1_sentrequest,
+                    NULL,
+                    HANDSHAKE_REPLY);
+    handshake_message_deinit(&handshake_token_out);
+
+    /* simulate process */
+    result = g_auth->process_handshake(
+                        g_auth,
+                        &handshake_token_out,
+                        &handshake_reply_token_in,
+                        handshake_handle,
+                        &exception);
+    CU_ASSERT_FATAL(result == DDS_SECURITY_VALIDATION_OK_FINAL_MESSAGE);
+
+    /*
+     * Actual test.
+     */
+    success = g_auth->get_authenticated_peer_credential_token(
+                        g_auth,
+                        &credential_token,
+                        handshake_handle,
+                        &exception);
+
+    CU_ASSERT_TRUE (success);
+
+    CU_ASSERT_FATAL(credential_token.class_id != NULL);
+    CU_ASSERT(strcmp(credential_token.class_id, AUTH_PROTOCOL_CLASS_ID) == 0);
+    CU_ASSERT(credential_token.properties._length == 2);
+    CU_ASSERT(credential_token.binary_properties._length == 0);
+
+    c_id = find_property(&credential_token, "c.id");
+    CU_ASSERT_FATAL(c_id != NULL);
+    CU_ASSERT_FATAL(c_id->value != NULL);
+    //printf("c_id->value: %s\n", c_id->value);
+    CU_ASSERT(strcmp(c_id->value, REMOTE_IDENTITY_CERTIFICATE) == 0);
+
+    c_perm = find_property(&credential_token, "c.perm");
+    CU_ASSERT_FATAL(c_perm != NULL);
+    CU_ASSERT_FATAL(c_perm->value != NULL);
+    //printf("c_perm->value: %s\n", c_perm->value);
+    CU_ASSERT(strcmp(c_perm->value, PERMISSIONS_DOCUMENT) == 0);
+
+    success = g_auth->return_authenticated_peer_credential_token(g_auth, &credential_token, &exception);
+    CU_ASSERT_TRUE (success);
+    CU_ASSERT(credential_token.class_id == NULL);
+    CU_ASSERT(credential_token.properties._buffer == NULL);
+    CU_ASSERT(credential_token.properties._maximum == 0);
+    CU_ASSERT(credential_token.properties._length == 0);
+    CU_ASSERT(credential_token.binary_properties._buffer == NULL);
+    CU_ASSERT(credential_token.binary_properties._maximum == 0);
+    CU_ASSERT(credential_token.binary_properties._length == 0);
+
+    success = g_auth->return_handshake_handle(g_auth, handshake_handle, &exception);
+    CU_ASSERT_TRUE (success);
+
+    reset_exception(&exception);
+
+    handshake_message_deinit(&handshake_reply_token_in);
+    handshake_message_deinit(&handshake_token_out);
+}
+
+CU_Test(ddssec_builtin_get_authenticated_peer_credential,token_after_reply )
+{
+    DDS_Security_ValidationResult_t result;
+    DDS_Security_HandshakeHandle handshake_handle;
+    DDS_Security_HandshakeMessageToken handshake_token_in = DDS_SECURITY_TOKEN_INIT;
+    DDS_Security_HandshakeMessageToken handshake_final_token_in = DDS_SECURITY_TOKEN_INIT;
+    DDS_Security_HandshakeMessageToken handshake_token_out = DDS_SECURITY_TOKEN_INIT;
+    DDS_Security_HandshakeMessageToken handshake_final_token_out = DDS_SECURITY_TOKEN_INIT;
+    DDS_Security_SecurityException exception = {NULL, 0, 0};
+    DDS_Security_AuthenticatedPeerCredentialToken credential_token = DDS_SECURITY_TOKEN_INIT;
+    DDS_Security_boolean success;
+    const DDS_Security_BinaryProperty_t *hash1_sentrequest;
+    const DDS_Security_BinaryProperty_t *hash2_sentreply;
+    const DDS_Security_BinaryProperty_t *challenge2_glb;
+    const DDS_Security_BinaryProperty_t *dh2;
+    const DDS_Security_Property_t *c_id;
+    const DDS_Security_Property_t *c_perm;
+    struct octet_seq dh2_pub_key;
+
+    CU_ASSERT_FATAL (g_auth->process_handshake != NULL);
+
+    CU_ASSERT_FATAL (g_auth != NULL);
+    CU_ASSERT_FATAL (g_local_identity_handle != DDS_SECURITY_HANDLE_NIL);
+    CU_ASSERT_FATAL (g_remote_identity_handle != DDS_SECURITY_HANDLE_NIL);
+    CU_ASSERT_FATAL (g_auth->begin_handshake_reply != NULL);
+
+    /* simulate reply */
+    fill_handshake_message_token_default(
+                    &handshake_token_in,
+                    g_remote_participant_data1,
+                    g_challenge1_predefined_glb->value._buffer,
+                    g_challenge1_predefined_glb->value._length);
+
+    result = g_auth->begin_handshake_reply(
+                    g_auth,
+                    &handshake_handle,
+                    &handshake_token_out,
+                    &handshake_token_in,
+                    g_remote_identity_handle,
+                    g_local_identity_handle,
+                    &g_serialized_participant_data,
+                    &exception);
+
+    CU_ASSERT_FATAL(result == DDS_SECURITY_VALIDATION_PENDING_HANDSHAKE_MESSAGE);
+
+    /* mock final */
+    dh2 = find_binary_property(&handshake_token_out, "dh2");
+    dh2_pub_key.data = dh2->value._buffer;
+    dh2_pub_key.length = dh2->value._length;
+    challenge2_glb = find_binary_property(&handshake_token_out, "challenge2");
+    hash1_sentrequest = find_binary_property(&handshake_token_out, "hash_c1");
+    hash2_sentreply = find_binary_property(&handshake_token_out, "hash_c2");
+    fill_handshake_message_token(
+                &handshake_final_token_in,
+                NULL,
+                REMOTE_IDENTITY_CERTIFICATE,
+                AUTH_DSIGN_ALGO_RSA_NAME,
+                AUTH_KAGREE_ALGO_ECDH_NAME,
+                &g_dh_modp_pub_key,
+                g_challenge1_predefined_glb->value._buffer,
+                g_challenge1_predefined_glb->value._length,
+                &dh2_pub_key,
+                challenge2_glb->value._buffer,
+                challenge2_glb->value._length,
+                hash1_sentrequest,
+                hash2_sentreply,
+                HANDSHAKE_FINAL);
+
+    /* simulate process */
+    result = g_auth->process_handshake(
+                        g_auth,
+                        &handshake_final_token_out,
+                        &handshake_final_token_in,
+                        handshake_handle,
+                        &exception);
+
+    CU_ASSERT_FATAL(result == DDS_SECURITY_VALIDATION_OK);
+
+    /*
+     * Actual test.
+     */
+    success = g_auth->get_authenticated_peer_credential_token(
+                        g_auth,
+                        &credential_token,
+                        handshake_handle,
+                        &exception);
+
+    CU_ASSERT_TRUE (success);
+
+    CU_ASSERT_FATAL(credential_token.class_id != NULL);
+    CU_ASSERT(strcmp(credential_token.class_id, AUTH_PROTOCOL_CLASS_ID) == 0);
+    CU_ASSERT(credential_token.properties._length == 2);
+    CU_ASSERT(credential_token.binary_properties._length == 0);
+
+    c_id = find_property(&credential_token, "c.id");
+    CU_ASSERT_FATAL(c_id != NULL);
+    CU_ASSERT_FATAL(c_id->value != NULL);
+    //printf("c_id->value: %s\n", c_id->value);
+    CU_ASSERT(strcmp(c_id->value, REMOTE_IDENTITY_CERTIFICATE) == 0);
+
+    c_perm = find_property(&credential_token, "c.perm");
+    CU_ASSERT_FATAL(c_perm != NULL);
+    CU_ASSERT_FATAL(c_perm->value != NULL);
+    //printf("c_perm->value: %s\n", c_perm->value);
+    CU_ASSERT(strcmp(c_perm->value, PERMISSIONS_DOCUMENT) == 0);
+
+
+    success = g_auth->return_authenticated_peer_credential_token(g_auth, &credential_token, &exception);
+    CU_ASSERT_TRUE (success);
+    CU_ASSERT(credential_token.class_id == NULL);
+    CU_ASSERT(credential_token.properties._buffer == NULL);
+    CU_ASSERT(credential_token.properties._maximum == 0);
+    CU_ASSERT(credential_token.properties._length == 0);
+    CU_ASSERT(credential_token.binary_properties._buffer == NULL);
+    CU_ASSERT(credential_token.binary_properties._maximum == 0);
+    CU_ASSERT(credential_token.binary_properties._length == 0);
+
+    success = g_auth->return_handshake_handle(g_auth, handshake_handle, &exception);
+    CU_ASSERT_TRUE (success);
+
+    reset_exception(&exception);
+
+    handshake_message_deinit(&handshake_token_in);
+    handshake_message_deinit(&handshake_token_out);
+    handshake_message_deinit(&handshake_final_token_in);
+    handshake_message_deinit(&handshake_final_token_out);
+}
+
+CU_Test(ddssec_builtin_get_authenticated_peer_credential,token_invalid_arguments )
+{
+    DDS_Security_SecurityException exception = {NULL, 0, 0};
+    DDS_Security_AuthenticatedPeerCredentialToken credential_token = DDS_SECURITY_TOKEN_INIT;
+    DDS_Security_HandshakeHandle invalid_handle = 3;
+    DDS_Security_boolean success;
+
+    success = g_auth->get_authenticated_peer_credential_token(g_auth, &credential_token, invalid_handle, &exception);
+    CU_ASSERT_FALSE (success);
+    CU_ASSERT(exception.code != 0);
+    CU_ASSERT(exception.message != NULL);
+    reset_exception(&exception);
+
+    success = g_auth->get_authenticated_peer_credential_token(NULL, &credential_token, invalid_handle, &exception);
+    CU_ASSERT_FALSE (success);
+    CU_ASSERT(exception.code != 0);
+    CU_ASSERT(exception.message != NULL);
+    reset_exception(&exception);
+
+    success = g_auth->get_authenticated_peer_credential_token(g_auth, NULL, invalid_handle, &exception);
+    CU_ASSERT_FALSE (success);
+    CU_ASSERT(exception.code != 0);
+    CU_ASSERT(exception.message != NULL);
+    reset_exception(&exception);
+
+    success = g_auth->get_authenticated_peer_credential_token(g_auth, &credential_token, 0, &exception);
+    CU_ASSERT_FALSE (success);
+    CU_ASSERT(exception.code != 0);
+    CU_ASSERT(exception.message != NULL);
+    reset_exception(&exception);
+
+    success = g_auth->return_authenticated_peer_credential_token(NULL, &credential_token, &exception);
+    CU_ASSERT_FALSE (success);
+    CU_ASSERT(exception.code != 0);
+    CU_ASSERT(exception.message != NULL);
+    reset_exception(&exception);
+
+    success = g_auth->return_authenticated_peer_credential_token(g_auth, NULL, &exception);
+    CU_ASSERT_FALSE (success);
+    CU_ASSERT(exception.code != 0);
+    CU_ASSERT(exception.message != NULL);
+    reset_exception(&exception);
+}
diff --git a/src/security/builtin_plugins/tests/process_handshake/etc/trusted_ca_dir/identity_ca b/src/security/builtin_plugins/tests/process_handshake/etc/trusted_ca_dir/identity_ca
new file mode 100644
index 0000000..f003d92
--- /dev/null
+++ b/src/security/builtin_plugins/tests/process_handshake/etc/trusted_ca_dir/identity_ca
@@ -0,0 +1,22 @@
+-----BEGIN CERTIFICATE-----
+MIIDkTCCAnmgAwIBAgIJAJvGJOEKNct1MA0GCSqGSIb3DQEBCwUAMF8xCzAJBgNV
+BAYTAk5MMRMwEQYDVQQIDApTb21lLVN0YXRlMSEwHwYDVQQKDBhJbnRlcm5ldCBX
+aWRnaXRzIFB0eSBMdGQxGDAWBgNVBAMMD0NIQU01MDAgcm9vdCBjYTAeFw0xODAy
+MTIxNTA1MDVaFw0yMDEyMDIxNTA1MDVaMF8xCzAJBgNVBAYTAk5MMRMwEQYDVQQI
+DApTb21lLVN0YXRlMSEwHwYDVQQKDBhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQx
+GDAWBgNVBAMMD0NIQU01MDAgcm9vdCBjYTCCASIwDQYJKoZIhvcNAQEBBQADggEP
+ADCCAQoCggEBAM/dCO4QAcCduw0NMqShDpTvGT6DClTFAJE8ZfuPCHKqNkicRbyj
+sVXfF35Sdo6K92Ksz4G7i1RqJU2n8c7hg2EFUza0lIGgmTHV/DvFBcbAa0PpvdKS
+XoPtSNDh65/GO1R7oeSFRzapqsLMPUwOWi46dYvRnPabxs21xHxn56JeuG74bad5
+PMTBvA2SiiTYPBlHGJS78GPo3BPMjL0MzPoMmumO8NSVYI+MEDY1lC4KkyZVKqtV
+nIfaO/7adcM19xOAfAHkwhLGBC/bVAEqelev+GH/42xjNv532nM4/JVtBns+msR5
+DAYdtr6i82b7zhU1+lOOihv4lmQHoSnTya8CAwEAAaNQME4wHQYDVR0OBBYEFFYr
+0CpiwxgFcZnW6IQEhxGv/vwiMB8GA1UdIwQYMBaAFFYr0CpiwxgFcZnW6IQEhxGv
+/vwiMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAKbBt0ht72fdtxwm
+Kr0pOsKyDW0Rd5Ca5aDK4qAhDL0AD5+O6ShGYCnFNDGk3J5Yzawp8VoKrhDZZyUt
+z2b0jNucVapAvPMA4066QxeIfvFmWcS73l7vjjeUoKWmNNGWprTg3RLsacTorKuY
+ZRL7wsThfrhvg4B/OOIWKp5MEwIrUfnQzUca8getF2eyTt6QcMtE29AW5+01QTzj
+fxZgzkmJFYBE2K/TLMDBDd+bz/8XnmPrJ01VUntXiXenTGTcIbJerB6GYQojjvhy
+ZrOeuHTON1ndFiQkpeZA67ByZjkKVoJG3I8fwBjzcLE7u/QAQptVPjJXXcSpL7fA
+a1tOvqw=
+-----END CERTIFICATE-----
diff --git a/src/security/builtin_plugins/tests/process_handshake/etc/trusted_ca_dir/remote_identity_ca.crt b/src/security/builtin_plugins/tests/process_handshake/etc/trusted_ca_dir/remote_identity_ca.crt
new file mode 100644
index 0000000..6b096a0
--- /dev/null
+++ b/src/security/builtin_plugins/tests/process_handshake/etc/trusted_ca_dir/remote_identity_ca.crt
@@ -0,0 +1,25 @@
+-----BEGIN CERTIFICATE-----
+MIIEKTCCAxGgAwIBAgIBATANBgkqhkiG9w0BAQsFADByMQswCQYDVQQGEwJOTDEL
+MAkGA1UECBMCT1YxEzARBgNVBAoTCkFETGluayBJU1QxGTAXBgNVBAMTEElkZW50
+aXR5IENBIFRlc3QxJjAkBgkqhkiG9w0BCQEWF2luZm9AaXN0LmFkbGlua3RlY2gu
+Y29tMB4XDTE4MDMxMjAwMDAwMFoXDTI3MDMxMTIzNTk1OVowcjELMAkGA1UEBhMC
+TkwxCzAJBgNVBAgTAk9WMRMwEQYDVQQKEwpBRExpbmsgSVNUMRkwFwYDVQQDExBJ
+ZGVudGl0eSBDQSBUZXN0MSYwJAYJKoZIhvcNAQkBFhdpbmZvQGlzdC5hZGxpbmt0
+ZWNoLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBANa/ENFfGVXg
+bPLTzBdDfiZQcp5dWZ//Pb8ErFOJu8uosVHFv8t69dgjHgNHB4OsjmjnR7GfKUZT
+0cMvWJnjsC7DDlBwFET9rj4k40n96bbVCH9I7+tNhsoqzc6Eu+5h4sk7VfNGTM2Z
+SyCd4GiSZRuA44rRbhXI7/LDpr4hY5J9ZDo5AM9ZyoLAoh774H3CZWD67S35XvUs
+72dzE6uKG/vxBbvZ7eW2GLO6ewa9UxlnLVMPfJdpkp/xYXwwcPW2+2YXCge1ujxs
+tjrOQJ5HUySh6DkE/kZpx8zwYWm9AaCrsvCIX1thsqgvKy+U5v1FS1L58eGc6s//
+9yMgNhU29R0CAwEAAaOByTCBxjAMBgNVHRMEBTADAQH/MB0GA1UdDgQWBBRNVUJN
+FzhJPReYT4QSx6dK53CXCTAfBgNVHSMEGDAWgBRNVUJNFzhJPReYT4QSx6dK53CX
+CTAPBgNVHQ8BAf8EBQMDB/+AMGUGA1UdJQEB/wRbMFkGCCsGAQUFBwMBBggrBgEF
+BQcDAgYIKwYBBQUHAwMGCCsGAQUFBwMEBggrBgEFBQcDCAYIKwYBBQUHAwkGCCsG
+AQUFBwMNBggrBgEFBQcDDgYHKwYBBQIDBTANBgkqhkiG9w0BAQsFAAOCAQEAcOLF
+ZYdJguj0uxeXB8v3xnUr1AWz9+gwg0URdfNLU2KvF2lsb/uznv6168b3/FcPgezN
+Ihl9GqB+RvGwgXS/1UelCGbQiIUdsNxk246P4uOGPIyW32RoJcYPWZcpY+cw11tQ
+NOnk994Y5/8ad1DmcxVLLqq5kwpXGWQufV1zOONq8B+mCvcVAmM4vkyF/de56Lwa
+sAMpk1p77uhaDnuq2lIR4q3QHX2wGctFid5Q375DRscFQteY01r/dtwBBrMn0wuL
+AMNx9ZGD+zAoOUaslpIlEQ+keAxk3jgGMWFMxF81YfhEnXzevSQXWpyek86XUyFL
+O9IAQi5pa15gXjSbUg==
+-----END CERTIFICATE-----
diff --git a/src/security/builtin_plugins/tests/process_handshake/etc/trusted_ca_dir/root_CA_RSA.crt b/src/security/builtin_plugins/tests/process_handshake/etc/trusted_ca_dir/root_CA_RSA.crt
new file mode 100644
index 0000000..61346df
--- /dev/null
+++ b/src/security/builtin_plugins/tests/process_handshake/etc/trusted_ca_dir/root_CA_RSA.crt
@@ -0,0 +1,28 @@
+-----BEGIN CERTIFICATE-----
+MIIEtjCCA56gAwIBAgIBATANBgkqhkiG9w0BAQsFADByMQswCQYDVQQGEwJOTDEL
+MAkGA1UECBMCT1YxEzARBgNVBAoTCkFETGluayBJU1QxGTAXBgNVBAMTEElkZW50
+aXR5IENBIFRlc3QxJjAkBgkqhkiG9w0BCQEWF2luZm9AaXN0LmFkbGlua3RlY2gu
+Y29tMB4XDTE4MDYxMTAwMDAwMFoXDTI3MDYxMDIzNTk1OVowcjELMAkGA1UEBhMC
+TkwxCzAJBgNVBAgTAk9WMRMwEQYDVQQKEwpBRExpbmsgSVNUMRkwFwYDVQQDExBJ
+ZGVudGl0eSBDQSBUZXN0MSYwJAYJKoZIhvcNAQkBFhdpbmZvQGlzdC5hZGxpbmt0
+ZWNoLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBANRf3XKmM6O+
+WoYPNpOAdkGKKZHLJ8ZuPxVVBMX6oJAlcOmkhLzfkHSA+gl/OWaMOXIEtN512gyL
+YszBf1RImwVzRjJFwIxzGzVQ68jYNj+qBbsOt+IG+hs3wgVCLFkCh+J7hXUgvk8A
+eRM/SRrI42dQfcgKUAMNi4/iX6Vs+FV9pHB63L4PiLA9hfUE25sH6EsIC7icvGDJ
+6cGG94glVSHDI1NtXfsNHY+NGY/jYKtQZklqU3lew5I60aJIsea+Wk6PJiz4hyXv
+XVVmrcNeG1g4OEFgiSXZC2XknDw8t9+ELprGNvuJvTFxwPMAgLeF4IhEQC9dQY2W
+BRwUxtZBzukCAwEAAaOCAVUwggFRMAwGA1UdEwQFMAMBAf8wHQYDVR0OBBYEFER4
+R6N3MQ1Wl7gn+R8wwHloDCVZMB8GA1UdIwQYMBaAFER4R6N3MQ1Wl7gn+R8wwHlo
+DCVZMA8GA1UdDwEB/wQFAwMH/4Awge8GA1UdJQEB/wSB5DCB4QYIKwYBBQUHAwEG
+CCsGAQUFBwMCBggrBgEFBQcDAwYIKwYBBQUHAwQGCCsGAQUFBwMIBgorBgEEAYI3
+AgEVBgorBgEEAYI3AgEWBgorBgEEAYI3CgMBBgorBgEEAYI3CgMDBgorBgEEAYI3
+CgMEBglghkgBhvhCBAEGCysGAQQBgjcKAwQBBggrBgEFBQcDBQYIKwYBBQUHAwYG
+CCsGAQUFBwMHBggrBgEFBQgCAgYKKwYBBAGCNxQCAgYIKwYBBQUHAwkGCCsGAQUF
+BwMNBggrBgEFBQcDDgYHKwYBBQIDBTANBgkqhkiG9w0BAQsFAAOCAQEAwXuEWDG3
+aAyL+DsGr0B4YMLjHtx6FjzkJOpTtXQhkrtSMpD3Xytl7Wfz8lyWuTnbrk8F4gWO
+IkJR/NdMGW27SmeYU0z7QAGRDwtHX6kqqizQbCwf4F6P/2QftcLp1VrlsIlb0gyx
+gLjpGmn5TT7gj+ahW0iIRglOwhzCvkNu6agYpdGwVirSyLShy/Hq303DZSbVuktz
+5/PmZKpufnoGqURNnJqbV4TQipE0FiDmp2o+gVgJ+DVRhiCdfk68Xp7+TlmxCDfZ
+C3qb18qrwAZ4AL3T9/RlzfkXh4ME9V6wqa5Y6j7Vwx5Ef2OHL+mnMnoNSXDLRh6j
+45ky66su5dROpA==
+-----END CERTIFICATE-----
diff --git a/src/security/builtin_plugins/tests/process_handshake/etc/trusted_ca_dir_not_matching/not_matching_trusted_ca.crt b/src/security/builtin_plugins/tests/process_handshake/etc/trusted_ca_dir_not_matching/not_matching_trusted_ca.crt
new file mode 100644
index 0000000..35506b8
--- /dev/null
+++ b/src/security/builtin_plugins/tests/process_handshake/etc/trusted_ca_dir_not_matching/not_matching_trusted_ca.crt
@@ -0,0 +1,25 @@
+-----BEGIN CERTIFICATE-----
+MIIENDCCAxygAwIBAgIBAjANBgkqhkiG9w0BAQsFADByMQswCQYDVQQGEwJOTDEL
+MAkGA1UECBMCT1YxEzARBgNVBAoTCkFETGluayBJU1QxGTAXBgNVBAMTEElkZW50
+aXR5IENBIFRlc3QxJjAkBgkqhkiG9w0BCQEWF2luZm9AaXN0LmFkbGlua3RlY2gu
+Y29tMB4XDTE4MDYxMzAwMDAwMFoXDTI3MDYxMDIzNTk1OVowfTELMAkGA1UEBhMC
+TkwxCzAJBgNVBAgTAk9WMRMwEQYDVQQKEwpBRExpbmsgSVNUMSQwIgYDVQQDExtJ
+ZGVudGl0eSBDQSBUZXN0IFdpdGggQ2hhaW4xJjAkBgkqhkiG9w0BCQEWF2luZm9A
+aXN0LmFkbGlua3RlY2guY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKC
+AQEA1r8Q0V8ZVeBs8tPMF0N+JlBynl1Zn/89vwSsU4m7y6ixUcW/y3r12CMeA0cH
+g6yOaOdHsZ8pRlPRwy9YmeOwLsMOUHAURP2uPiTjSf3pttUIf0jv602GyirNzoS7
+7mHiyTtV80ZMzZlLIJ3gaJJlG4DjitFuFcjv8sOmviFjkn1kOjkAz1nKgsCiHvvg
+fcJlYPrtLfle9SzvZ3MTq4ob+/EFu9nt5bYYs7p7Br1TGWctUw98l2mSn/FhfDBw
+9bb7ZhcKB7W6PGy2Os5AnkdTJKHoOQT+RmnHzPBhab0BoKuy8IhfW2GyqC8rL5Tm
+/UVLUvnx4Zzqz//3IyA2FTb1HQIDAQABo4HJMIHGMAwGA1UdEwQFMAMBAf8wHQYD
+VR0OBBYEFE1VQk0XOEk9F5hPhBLHp0rncJcJMB8GA1UdIwQYMBaAFER4R6N3MQ1W
+l7gn+R8wwHloDCVZMA8GA1UdDwEB/wQFAwMH/4AwZQYDVR0lAQH/BFswWQYIKwYB
+BQUHAwEGCCsGAQUFBwMCBggrBgEFBQcDAwYIKwYBBQUHAwQGCCsGAQUFBwMIBggr
+BgEFBQcDCQYIKwYBBQUHAw0GCCsGAQUFBwMOBgcrBgEFAgMFMA0GCSqGSIb3DQEB
+CwUAA4IBAQCbl7ed4p66G6WquxO7ceZFvYKn3kDErjCfXHcqHxBnA2xTpoZCGj95
+Qpirqo6N4UcLX5sn3CmgyVk0dYvlti/53FJgZ9XQDNxBuEYWPkY7vO+Uo0WdYpGz
+ZDNIUQpiPMA7bHvwKldTIs77xxtnw9kbBU2k0xQyb2tdZNfD5YqSI1MeUtpEpNFW
+sbC8+mQ3clzWpjF8eHH1fFSAmlJ+z1Uqmtt2FK0vRz+MQcpydwvpMnfqGdcwhGPQ
+X4HZreLObjBA8KUEkUB3+rZXuELBgkk/c8/jRZl7QF5jJDLQCCLg7KoYBKN2GuTt
+/dzeSnP7VZm/nTL8wpCvKgSOwOGgklf2
+-----END CERTIFICATE-----
diff --git a/src/security/builtin_plugins/tests/process_handshake/src/process_handshake_utests.c b/src/security/builtin_plugins/tests/process_handshake/src/process_handshake_utests.c
new file mode 100644
index 0000000..e717e54
--- /dev/null
+++ b/src/security/builtin_plugins/tests/process_handshake/src/process_handshake_utests.c
@@ -0,0 +1,2447 @@
+
+
+/* CUnit includes. */
+#include "common/src/handshake_helper.h"
+
+/* Test helper includes. */
+#include "common/src/loader.h"
+
+/* Private header include */
+#include "dds/security/dds_security_api.h"
+#include "dds/security/core/dds_security_serialize.h"
+#include "dds/security/core/dds_security_utils.h"
+#include "dds/security/dds_security_api.h"
+#include "dds/ddsrt/heap.h"
+#include "dds/ddsrt/string.h"
+#include "dds/ddsrt/endian.h"
+#include <stdio.h>
+#include <string.h>
+#include "dds/ddsrt/environ.h"
+#include "CUnit/CUnit.h"
+#include "CUnit/Test.h"
+#include "assert.h"
+
+#include <openssl/opensslv.h>
+#include <openssl/sha.h>
+#include <openssl/x509.h>
+#include <openssl/pem.h>
+#include <config_env.h>
+
+
+#include "dds/security/core/dds_security_serialize.h"
+#include "dds/security/dds_security_api.h"
+#include "dds/security/core/dds_security_utils.h"
+
+#define HANDSHAKE_SIGNATURE_SIZE 6
+
+#if DDSRT_ENDIAN == DDSRT_LITTLE_ENDIAN
+static  unsigned bswap4u (unsigned x)
+{
+  return (x >> 24) | ((x >> 8) & 0xff00) | ((x << 8) & 0xff0000) | (x << 24);
+}
+#define toBE4u(x) bswap4u (x)
+#define fromBE4u(x) bswap4u (x)
+#else
+#define toBE4u(x) (x)
+#define fromBE4u(x) (x)
+#endif
+
+
+static const char * AUTH_PROTOCOL_CLASS_ID          = "DDS:Auth:PKI-DH:1.0";
+static const char * PERM_ACCESS_CLASS_ID            = "DDS:Access:Permissions:1.0";
+
+static const char * PROPERTY_IDENTITY_CA            = "dds.sec.auth.identity_ca";
+static const char * PROPERTY_PRIVATE_KEY            = "dds.sec.auth.private_key";
+static const char * PROPERTY_IDENTITY_CERT          = "dds.sec.auth.identity_certificate";
+static const char * PROPERTY_TRUSTED_CA_DIR          = "dds.sec.auth.trusted_ca_dir";
+
+static const char * PROPERTY_CERT_SUBJECT_NAME      = "dds.cert.sn";
+static const char * PROPERTY_CERT_ALGORITHM         = "dds.cert.algo";
+static const char * PROPERTY_CA_SUBJECT_NAME        = "dds.ca.sn";
+static const char * PROPERTY_CA_ALGORITHM           = "dds.ca.aglo";
+
+static const char * PROPERTY_PERM_CA_SUBJECT_NAME   = "ds.perm_ca.sn";
+
+static const char * SUBJECT_NAME_IDENTITY_CERT      = "CN=CHAM-574 client,O=Some Company,ST=Some-State,C=NL";
+static const char * SUBJECT_NAME_IDENTITY_CA        = "CN=CHAM-574 authority,O=Some Company,ST=Some-State,C=NL";
+
+static const char * RSA_2048_ALGORITHM_NAME         = "RSA-2048";
+
+static const char * AUTH_REQUEST_TOKEN_CLASS_ID         = "DDS:Auth:PKI-DH:1.0+AuthReq";
+static const char * AUTH_REQUEST_TOKEN_FUTURE_PROP_NAME = "future_challenge";
+
+static const char * AUTH_HANDSHAKE_REQUEST_TOKEN_CLASS_ID = "DDS:Auth:PKI-DH:1.0+Req";
+static const char * AUTH_HANDSHAKE_REPLY_TOKEN_CLASS_ID   = "DDS:Auth:PKI-DH:1.0+Reply";
+static const char * AUTH_HANDSHAKE_FINAL_TOKEN_CLASS_ID   = "DDS:Auth:PKI-DH:1.0+Final";
+
+typedef enum {
+    HANDSHAKE_REQUEST,
+    HANDSHAKE_REPLY,
+    HANDSHAKE_FINAL
+} HandshakeStep_t;
+
+
+struct octet_seq {
+    unsigned char  *data;
+    uint32_t  length;
+};
+
+static const char * AUTH_DSIGN_ALGO_RSA_NAME   = "RSASSA-PSS-SHA256";
+static const char * AUTH_KAGREE_ALGO_RSA_NAME  = "DH+MODP-2048-256";
+static const char * AUTH_KAGREE_ALGO_ECDH_NAME = "ECDH+prime256v1-CEUM";
+
+
+
+static const char *identity_certificate =
+
+"data:,-----BEGIN CERTIFICATE-----\n"
+"MIIDYDCCAkigAwIBAgIBBDANBgkqhkiG9w0BAQsFADByMQswCQYDVQQGEwJOTDEL\n"
+"MAkGA1UECBMCT1YxEzARBgNVBAoTCkFETGluayBJU1QxGTAXBgNVBAMTEElkZW50\n"
+"aXR5IENBIFRlc3QxJjAkBgkqhkiG9w0BCQEWF2luZm9AaXN0LmFkbGlua3RlY2gu\n"
+"Y29tMB4XDTE4MDMxMjAwMDAwMFoXDTI3MDMxMTIzNTk1OVowdTELMAkGA1UEBhMC\n"
+"TkwxCzAJBgNVBAgTAk9WMRAwDgYDVQQKEwdBRExpbmsgMREwDwYDVQQLEwhJU1Qg\n"
+"VGVzdDETMBEGA1UEAxMKQWxpY2UgVGVzdDEfMB0GCSqGSIb3DQEJARYQYWxpY2VA\n"
+"YWRsaW5rLmlzdDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBANBW+tEZ\n"
+"Baw7EQCEXyzH9n7IkZ8PQIKe8hG1LAOGYOF/oUYQZJO/HxbWoC4rFqOC20+A6is6\n"
+"kFwr1Zzp/Wurk9CrFXo5Nomi6ActH6LUM57nYqN68w6U38z/XkQxVY/ESZ5dySfD\n"
+"9Q1C8R+zdE8gwbimdYmwX7ioz336nghM2CoAHPDRthQeJupl8x4V7isOltr9CGx8\n"
+"+imJXbGr39OK6u87cNLeu23sUkOIC0lSRMIqIQK3oJtHS70J2qecXdqp9MhE7Xky\n"
+"/GPlI8ptQ1gJ8A3cAOvtI9mtMJMszs2EKWTLfeTcmfJHKKhKjvCgDdh3Jan4x5YP\n"
+"Yg7HG6H+ceOUkMMCAwEAATANBgkqhkiG9w0BAQsFAAOCAQEAkvuqZzyJ3Nu4/Eo5\n"
+"kD0nVgYGBUl7cspu+636q39zPSrxLEDMUWz+u8oXLpyGcgiZ8lZulPTV8dmOn+3C\n"
+"Vg55c5C+gbnbX3MDyb3wB17296RmxYf6YNul4sFOmj6+g2i+Dw9WH0PBCVKbA84F\n"
+"jR3Gx2Pfoifor3DvT0YFSsjNIRt090u4dQglbIb6cWEafC7O24t5jFhGPvJ7L9SE\n"
+"gB0Drh/HmKTVuaqaRkoOKkKaKuWoXsszK1ZFda1DHommnR5LpYPsDRQ2fVM4EuBF\n"
+"By03727uneuG8HLuNcLEV9H0i7LxtyfFkyCPUQvWG5jehb7xPOz/Ml26NAwwjlTJ\n"
+"xEEFrw==\n"
+"-----END CERTIFICATE-----\n";
+
+
+static const char *identity_ca =
+"data:,-----BEGIN CERTIFICATE-----\n"
+"MIIEKTCCAxGgAwIBAgIBATANBgkqhkiG9w0BAQsFADByMQswCQYDVQQGEwJOTDEL\n"
+"MAkGA1UECBMCT1YxEzARBgNVBAoTCkFETGluayBJU1QxGTAXBgNVBAMTEElkZW50\n"
+"aXR5IENBIFRlc3QxJjAkBgkqhkiG9w0BCQEWF2luZm9AaXN0LmFkbGlua3RlY2gu\n"
+"Y29tMB4XDTE4MDMxMjAwMDAwMFoXDTI3MDMxMTIzNTk1OVowcjELMAkGA1UEBhMC\n"
+"TkwxCzAJBgNVBAgTAk9WMRMwEQYDVQQKEwpBRExpbmsgSVNUMRkwFwYDVQQDExBJ\n"
+"ZGVudGl0eSBDQSBUZXN0MSYwJAYJKoZIhvcNAQkBFhdpbmZvQGlzdC5hZGxpbmt0\n"
+"ZWNoLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBANa/ENFfGVXg\n"
+"bPLTzBdDfiZQcp5dWZ//Pb8ErFOJu8uosVHFv8t69dgjHgNHB4OsjmjnR7GfKUZT\n"
+"0cMvWJnjsC7DDlBwFET9rj4k40n96bbVCH9I7+tNhsoqzc6Eu+5h4sk7VfNGTM2Z\n"
+"SyCd4GiSZRuA44rRbhXI7/LDpr4hY5J9ZDo5AM9ZyoLAoh774H3CZWD67S35XvUs\n"
+"72dzE6uKG/vxBbvZ7eW2GLO6ewa9UxlnLVMPfJdpkp/xYXwwcPW2+2YXCge1ujxs\n"
+"tjrOQJ5HUySh6DkE/kZpx8zwYWm9AaCrsvCIX1thsqgvKy+U5v1FS1L58eGc6s//\n"
+"9yMgNhU29R0CAwEAAaOByTCBxjAMBgNVHRMEBTADAQH/MB0GA1UdDgQWBBRNVUJN\n"
+"FzhJPReYT4QSx6dK53CXCTAfBgNVHSMEGDAWgBRNVUJNFzhJPReYT4QSx6dK53CX\n"
+"CTAPBgNVHQ8BAf8EBQMDB/+AMGUGA1UdJQEB/wRbMFkGCCsGAQUFBwMBBggrBgEF\n"
+"BQcDAgYIKwYBBQUHAwMGCCsGAQUFBwMEBggrBgEFBQcDCAYIKwYBBQUHAwkGCCsG\n"
+"AQUFBwMNBggrBgEFBQcDDgYHKwYBBQIDBTANBgkqhkiG9w0BAQsFAAOCAQEAcOLF\n"
+"ZYdJguj0uxeXB8v3xnUr1AWz9+gwg0URdfNLU2KvF2lsb/uznv6168b3/FcPgezN\n"
+"Ihl9GqB+RvGwgXS/1UelCGbQiIUdsNxk246P4uOGPIyW32RoJcYPWZcpY+cw11tQ\n"
+"NOnk994Y5/8ad1DmcxVLLqq5kwpXGWQufV1zOONq8B+mCvcVAmM4vkyF/de56Lwa\n"
+"sAMpk1p77uhaDnuq2lIR4q3QHX2wGctFid5Q375DRscFQteY01r/dtwBBrMn0wuL\n"
+"AMNx9ZGD+zAoOUaslpIlEQ+keAxk3jgGMWFMxF81YfhEnXzevSQXWpyek86XUyFL\n"
+"O9IAQi5pa15gXjSbUg==\n"
+"-----END CERTIFICATE-----\n";
+
+static const char *remote_identity_certificate =
+"-----BEGIN CERTIFICATE-----\n"
+"MIIDcDCCAligAwIBAgIBBTANBgkqhkiG9w0BAQsFADByMQswCQYDVQQGEwJOTDEL\n"
+"MAkGA1UECBMCT1YxEzARBgNVBAoTCkFETGluayBJU1QxGTAXBgNVBAMTEElkZW50\n"
+"aXR5IENBIFRlc3QxJjAkBgkqhkiG9w0BCQEWF2luZm9AaXN0LmFkbGlua3RlY2gu\n"
+"Y29tMB4XDTE4MDMxMjAwMDAwMFoXDTI3MDMxMTIzNTk1OVowcDELMAkGA1UEBhMC\n"
+"TkwxCzAJBgNVBAgTAk9WMQ8wDQYDVQQKEwZBRExpbmsxETAPBgNVBAsTCElTVCBU\n"
+"ZXN0MREwDwYDVQQDEwhCb2IgVGVzdDEdMBsGCSqGSIb3DQEJARYOYm9iQGFkbGlu\n"
+"ay5pc3QwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDB5vqhuWnwhxXZ\n"
+"qffPmfjzge7w91oX4ISlboIfBXp3sLj2mqLSsYhgBNJAn/Fl1OZeFw0d4gVibBgx\n"
+"5Zdcjsi+ClvYK8H534iTJfNriMyhg4kSWxZF1Tixfw3FS7LqjKEY5ZNPfp5a4P+8\n"
+"UveorYJusrnlv1DiF6aPhJQh8J62J6bhx62DNLO7dZbN0BUsnWtyDcfi5DOjf2/r\n"
+"3lSRfecn3uBr1QYRaS5FrV+MSoGcjI3M75mei1TTUp7YT4ZWRR5rKUMql605xsms\n"
+"d6sqJaKofYmw7wCuaVJ86pb/w8srdddKt21xUeQNMKn49H6raezMOE3U5BUMtZ+P\n"
+"2OBLk/CPAgMBAAGjEzARMA8GA1UdDwEB/wQFAwMH/4AwDQYJKoZIhvcNAQELBQAD\n"
+"ggEBAJV71Ckf1zsks5mJXqdUb8bTVHg4hN32pwjCL5c6W2XHAv+YHwE/fN3C1VIY\n"
+"bC8zjUC9dCOyC2AvOQyZQ1eC/WoK6FlXjHVX2upL4lXQ9WL9ztt1mgdRrhvUPuUn\n"
+"aBE8VgNU0t4jl93xMIaU8hB0kQsV+kdcN0cWbrF3mT4s9njRvopJ8hS2UE60V2wA\n"
+"ceUOazH+QGPh1k0jkynrTlVR9GrpebQwZ2UFeinVO0km17IAyQkz+OmPc4jQLJMl\n"
+"CmkbmMwowdLMKC6r/HyE87dN7NvFnRM5iByJklRwN7WDYZrl72HoUOlgTZ7PjW2G\n"
+"jTxK8xXtDCXC/3CNpe0YFnOga8g=\n"
+"-----END CERTIFICATE-----\n";
+
+
+static const char *private_key =
+
+"data:,-----BEGIN RSA PRIVATE KEY-----\n"
+"MIIEowIBAAKCAQEA0Fb60RkFrDsRAIRfLMf2fsiRnw9Agp7yEbUsA4Zg4X+hRhBk\n"
+"k78fFtagLisWo4LbT4DqKzqQXCvVnOn9a6uT0KsVejk2iaLoBy0fotQznudio3rz\n"
+"DpTfzP9eRDFVj8RJnl3JJ8P1DULxH7N0TyDBuKZ1ibBfuKjPffqeCEzYKgAc8NG2\n"
+"FB4m6mXzHhXuKw6W2v0IbHz6KYldsavf04rq7ztw0t67bexSQ4gLSVJEwiohAreg\n"
+"m0dLvQnap5xd2qn0yETteTL8Y+Ujym1DWAnwDdwA6+0j2a0wkyzOzYQpZMt95NyZ\n"
+"8kcoqEqO8KAN2HclqfjHlg9iDscbof5x45SQwwIDAQABAoIBAG0dYPeqd0IhHWJ7\n"
+"8azufbchLMN1pX/D51xG2uptssfnpHuhkkufSZUYi4QipRS2ME6PYhWJ8pmTi6lH\n"
+"E6cUkbI0KGd/F4U2gPdhNrR9Fxwea5bbifkVF7Gx/ZkRjZJiZ3w9+mCNTQbJDKhh\n"
+"wITAzzT6WYznhvqbzzBX1fTa6kv0GAQtX7aHKM+XIwkhX2gzU5TU80bvH8aMrT05\n"
+"tAMGQqkUeRnpo0yucBl4VmTZzd/+X/d2UyXR0my15jE5iH5o+p+E6qTRE9D+MGUd\n"
+"MQ6Ftj0Untqy1lcog1ZLL6zPlnwcD4jgY5VCYDgvabnrSwymOJapPLsAEdWdq+U5\n"
+"ec44BMECgYEA/+3qPUrd4XxA517qO3fCGBvf2Gkr7w5ZDeATOTHGuD8QZeK0nxPl\n"
+"CWhRjdgkqo0fyf1cjczL5XgYayo+YxkO1Z4RUU+8lJAHlVx9izOQo+MTQfkwH4BK\n"
+"LYlHxMoHJwAOXXoE+dmBaDh5xT0mDUGU750r763L6EFovE4qRBn9hxkCgYEA0GWz\n"
+"rpOPNxb419WxG9npoQYdCZ5IbmEOGDH3ReggVzWHmW8sqtkqTZm5srcyDpqAc1Gu\n"
+"paUveMblEBbU+NFJjLWOfwB5PCp8jsrqRgCQSxolShiVkc3Vu3oyzMus9PDge1eo\n"
+"9mwVGO7ojQKWRu/WVAakENPaAjeyyhv4dqSNnjsCgYEAlwe8yszqoY1k8+U0T0G+\n"
+"HeIdOCXgkmOiNCj+zyrLvaEhuS6PLq1b5TBVqGJcSPWdQ+MrglbQIKu9pUg5ptt7\n"
+"wJ5WU+i9PeK9Ruxc/g/BFKYFkFJQjtZzb+nqm3wpul8zGwDN/O/ZiTqCyd3rHbmM\n"
+"/dZ/viKPCZHIEBAEq0m3LskCgYBndzcAo+5k8ZjWwBfQth5SfhCIp/daJgGzbYtR\n"
+"P/BenAsY2KOap3tjT8Fsw5usuHSxzIojX6H0Gvu7Qzq11mLn43Q+BeQrRQTWeFRc\n"
+"MQdy4iZFZXNNEp7dF8yE9VKHwdgSJPGUdxD6chMvf2tRCN6mlS171VLV6wVvZvez\n"
+"H/vX5QKBgD2Dq/NHpjCpAsECP9awmNF5Akn5WJbRGmegwXIih2mOtgtYYDeuQyxY\n"
+"ZCrdJFfIUjUVPagshEmUklKhkYMYpzy2PQDVtaVcm6UNFroxT5h+J+KDs1LN1H8G\n"
+"LsASrzyAg8EpRulwXEfLrWKiu9DKv8bMEgO4Ovgz8zTKJZIFhcac\n"
+"-----END RSA PRIVATE KEY-----\n";
+
+
+static char *remote_private_key =
+"-----BEGIN RSA PRIVATE KEY-----\n"
+"MIIEowIBAAKCAQEAweb6oblp8IcV2an3z5n484Hu8PdaF+CEpW6CHwV6d7C49pqi\n"
+"0rGIYATSQJ/xZdTmXhcNHeIFYmwYMeWXXI7Ivgpb2CvB+d+IkyXza4jMoYOJElsW\n"
+"RdU4sX8NxUuy6oyhGOWTT36eWuD/vFL3qK2CbrK55b9Q4hemj4SUIfCetiem4cet\n"
+"gzSzu3WWzdAVLJ1rcg3H4uQzo39v695UkX3nJ97ga9UGEWkuRa1fjEqBnIyNzO+Z\n"
+"notU01Ke2E+GVkUeaylDKpetOcbJrHerKiWiqH2JsO8ArmlSfOqW/8PLK3XXSrdt\n"
+"cVHkDTCp+PR+q2nszDhN1OQVDLWfj9jgS5PwjwIDAQABAoIBAHfgWhED9VgL29le\n"
+"uGMzmPLK4LM+6Qcb+kXghTeyhl1a928WeRVzRpG+SVJEz9QaBHYlICnaY2PO2kJ2\n"
+"49YIPFkpRFDn9JuLs/7tFonj4Eb2cBbWE3YG9W7e0t+oBiv1117yB9m8uSAMPG7s\n"
+"iEpTQvE3M7CzT8kHwCS4XXCCN0z7LqKyZ1heScjdfhV3D2TnFFjdtQ/9KfQa3hIc\n"
+"6ftbpi4EKbfasspyqfrJ/cqjHzse9iEXLOZJhs+atBAKe/uJ4Hc3LRPbX4MPniAp\n"
+"JJrldXFK9p+HILlbXvu+5n+DSGbZmT1x9a/E9suGyoJiASDH2Ax4yCVTi+v8C1R2\n"
+"aKdU1LkCgYEA/3dFuM6zIHwiJ0GKT0gtJL6J3m+i51SNcRIm8deXt6HULMpUNajj\n"
+"vZ1bgQm/h+uRBlPV3swkaVxvPTIabOTY4gmCBSzvVCSIAKHVc/+5Nkl9KruwSq4G\n"
+"tctmXZ7ymMDi+6QGCJTJkAx6jptXyrzC00HOjXOwyQ+iDipqgr3A8FsCgYEAwk7B\n"
+"2/hi569EIHFRT6nz/JMqQVPZ/MJDKoKhffTbnjQ5OAzpiVN6cyThMM1iVJEBFNhx\n"
+"OEacy60Qj0TtR1oYrQSRSLm58TTxiuB4Pohbmg3iU+kSM/eTq/ups/Ul1oCs2eAb\n"
+"POfweD3c4d4i7sN8bUNQXehiE4MOlK9TYQy39t0CgYAJht0mwy6S644qgJsz0bE9\n"
+"SY3Cqc8daV3M9axWIIAb7QEImpMBXUcA7zlWWpK18ub5oW68XEiPVU8grRmnLfGY\n"
+"nFoo70ANlz8rJt3a8ZJqn9r3GQC+CDdf2DH9E8xgPfE5CSjgcQwDPzPi1ZA0k02A\n"
+"q1eUltfk55xXguVt8r2bOQKBgQC7+kldr1yv20VDRZ1uPnMGRLE6Zg6bkqw78gid\n"
+"vEbDNK6uZP+BlTr/LgyVk/yu52Fucz6FPPrvqEw+7mXHA4ifya1r+BHFIn0S57os\n"
+"dOp5jTkKCI9NqxQ3683vhRjH/dA7L63qLFDdYqvP74FID+LOKbMURn6rdbyjZ0J4\n"
+"vz8yGQKBgHIzcKlQosRxf+KptOPMGRs30L9PnH+sNmTo2SmEzAGkBkt1msGRh/2l\n"
+"uT3hOEhUXL9knRyXwQSXgrIwr9QwI5rGS5FAgX26TgBtPBDs2NuyyhhS5yxsiEPT\n"
+"BR+EjQFW9dzRkpRJgvsG4DcNAhFn7fQqFNcWXgFWuBXmGNkdtEGR\n"
+"-----END RSA PRIVATE KEY-----";
+
+static const char *unrelated_identity =
+        "data:,-----BEGIN CERTIFICATE-----\n"
+        "MIIDpDCCAoygAwIBAgIJALE5lRKfYHAaMA0GCSqGSIb3DQEBCwUAMF8xCzAJBgNV\n"
+        "BAYTAk5MMRMwEQYDVQQIDApPdmVyaWpzc2VsMRAwDgYDVQQHDAdIZW5nZWxvMQ8w\n"
+        "DQYDVQQKDAZBRExJTksxGDAWBgNVBAMMD0NIQU01MDAgUm9vdCBDQTAeFw0xODAy\n"
+        "MDkxNjIwNDNaFw0zODAyMDQxNjIwNDNaMF8xCzAJBgNVBAYTAk5MMRMwEQYDVQQI\n"
+        "DApPdmVyaWpzc2VsMRAwDgYDVQQHDAdIZW5nZWxvMQ8wDQYDVQQKDAZBRExJTksx\n"
+        "GDAWBgNVBAMMD0NIQU01MDAgUm9vdCBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEP\n"
+        "ADCCAQoCggEBAN9/NbpJDHQYHh3cEByRxnHffxEe9Sapn08Ty5xYO8LDJ4V7vU32\n"
+        "/7291fITiHaovOoCRHAbKTaTtqJO56aGY45HON6KIqxljLQJJVGW/Nf2PNSHmFix\n"
+        "6D6bsoSOTPyKYqBNT6lB7NMn4QBTcsiE61El8p9WLQZHoYQJK5Psf7wkBqGBz8he\n"
+        "bcDWXFn7kIgnsaLrh77w2wi/y0MqpPwyeRInoZfYknzVNdxCPgq7csBYDoMgOgkV\n"
+        "G60ECXojHKz1HI4n0V8L8lZluSSVRNR0xvPFgBqO7b+Re7xb6iO9TNsFeoiMMNyp\n"
+        "EwM99CqPO0RRrAPiC7IDgcNGjxhne9EJFGsCAwEAAaNjMGEwHQYDVR0OBBYEFCst\n"
+        "gj5Ecm3HU/N7wxJluFo5+6XUMB8GA1UdIwQYMBaAFCstgj5Ecm3HU/N7wxJluFo5\n"
+        "+6XUMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgGGMA0GCSqGSIb3DQEB\n"
+        "CwUAA4IBAQCWibvYuPLpoNcsUdHbE7SnBbEQnDfBxBZN8xeWHwwAPEB+8eHhmIdZ\n"
+        "xDtCN61xr5QR+KzlEYFwKyHMp9GN3OPU1RndJrzaXz2ddAZVkBIvnQZ4JvFd+sBC\n"
+        "QQgEvL8GcwZPxnad/TRylM4ON3Kh0X9vfyrmWEoHephiE1LcENaFqcYr9xg3DJNh\n"
+        "XSrigMGZJ7IOHkvgaoneICOcYI42ZHS0fnt1G+01VKJXm3ndi5NL25GnOmlvV6yV\n"
+        "+1vcmdQc6YS8K8vHmrH4lX9iPfsOak6WSzzsXdqgpvyxtGJggcFaDTtmbWCAkJj0\n"
+        "B7DMeaVlLClGQaKZZ7aexEx9se+IyLn2\n"
+        "-----END CERTIFICATE-----\n";
+
+
+static const char *remote_identity_trusted =
+                "-----BEGIN CERTIFICATE-----\n"
+                "MIIDcDCCAligAwIBAgIBBTANBgkqhkiG9w0BAQsFADByMQswCQYDVQQGEwJOTDEL\n"
+                "MAkGA1UECBMCT1YxEzARBgNVBAoTCkFETGluayBJU1QxGTAXBgNVBAMTEElkZW50\n"
+                "aXR5IENBIFRlc3QxJjAkBgkqhkiG9w0BCQEWF2luZm9AaXN0LmFkbGlua3RlY2gu\n"
+                "Y29tMB4XDTE4MDMxMjAwMDAwMFoXDTI3MDMxMTIzNTk1OVowcDELMAkGA1UEBhMC\n"
+                "TkwxCzAJBgNVBAgTAk9WMQ8wDQYDVQQKEwZBRExpbmsxETAPBgNVBAsTCElTVCBU\n"
+                "ZXN0MREwDwYDVQQDEwhCb2IgVGVzdDEdMBsGCSqGSIb3DQEJARYOYm9iQGFkbGlu\n"
+                "ay5pc3QwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDB5vqhuWnwhxXZ\n"
+                "qffPmfjzge7w91oX4ISlboIfBXp3sLj2mqLSsYhgBNJAn/Fl1OZeFw0d4gVibBgx\n"
+                "5Zdcjsi+ClvYK8H534iTJfNriMyhg4kSWxZF1Tixfw3FS7LqjKEY5ZNPfp5a4P+8\n"
+                "UveorYJusrnlv1DiF6aPhJQh8J62J6bhx62DNLO7dZbN0BUsnWtyDcfi5DOjf2/r\n"
+                "3lSRfecn3uBr1QYRaS5FrV+MSoGcjI3M75mei1TTUp7YT4ZWRR5rKUMql605xsms\n"
+                "d6sqJaKofYmw7wCuaVJ86pb/w8srdddKt21xUeQNMKn49H6raezMOE3U5BUMtZ+P\n"
+                "2OBLk/CPAgMBAAGjEzARMA8GA1UdDwEB/wQFAwMH/4AwDQYJKoZIhvcNAQELBQAD\n"
+                "ggEBAJV71Ckf1zsks5mJXqdUb8bTVHg4hN32pwjCL5c6W2XHAv+YHwE/fN3C1VIY\n"
+                "bC8zjUC9dCOyC2AvOQyZQ1eC/WoK6FlXjHVX2upL4lXQ9WL9ztt1mgdRrhvUPuUn\n"
+                "aBE8VgNU0t4jl93xMIaU8hB0kQsV+kdcN0cWbrF3mT4s9njRvopJ8hS2UE60V2wA\n"
+                "ceUOazH+QGPh1k0jkynrTlVR9GrpebQwZ2UFeinVO0km17IAyQkz+OmPc4jQLJMl\n"
+                "CmkbmMwowdLMKC6r/HyE87dN7NvFnRM5iByJklRwN7WDYZrl72HoUOlgTZ7PjW2G\n"
+                "jTxK8xXtDCXC/3CNpe0YFnOga8g=\n"
+                "-----END CERTIFICATE-----\n";
+
+static const char *remote_identity_untrusted =
+                "-----BEGIN CERTIFICATE-----\n"
+                "MIIELTCCAxWgAwIBAgIBATANBgkqhkiG9w0BAQsFADB0MQswCQYDVQQGEwJOTDEL\n"
+                "MAkGA1UECBMCT1YxEzARBgNVBAoTCkFETGluayBJU1QxGzAZBgNVBAMTEkJvYiBU\n"
+                "ZXN0IFVudHJ1c3RlZDEmMCQGCSqGSIb3DQEJARYXaW5mb0Bpc3QuYWRsaW5rdGVj\n"
+                "aC5jb20wHhcNMTgwNjIwMDAwMDAwWhcNMjcwNjE5MjM1OTU5WjB0MQswCQYDVQQG\n"
+                "EwJOTDELMAkGA1UECBMCT1YxEzARBgNVBAoTCkFETGluayBJU1QxGzAZBgNVBAMT\n"
+                "EkJvYiBUZXN0IFVudHJ1c3RlZDEmMCQGCSqGSIb3DQEJARYXaW5mb0Bpc3QuYWRs\n"
+                "aW5rdGVjaC5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDB5vqh\n"
+                "uWnwhxXZqffPmfjzge7w91oX4ISlboIfBXp3sLj2mqLSsYhgBNJAn/Fl1OZeFw0d\n"
+                "4gVibBgx5Zdcjsi+ClvYK8H534iTJfNriMyhg4kSWxZF1Tixfw3FS7LqjKEY5ZNP\n"
+                "fp5a4P+8UveorYJusrnlv1DiF6aPhJQh8J62J6bhx62DNLO7dZbN0BUsnWtyDcfi\n"
+                "5DOjf2/r3lSRfecn3uBr1QYRaS5FrV+MSoGcjI3M75mei1TTUp7YT4ZWRR5rKUMq\n"
+                "l605xsmsd6sqJaKofYmw7wCuaVJ86pb/w8srdddKt21xUeQNMKn49H6raezMOE3U\n"
+                "5BUMtZ+P2OBLk/CPAgMBAAGjgckwgcYwDAYDVR0TBAUwAwEB/zAdBgNVHQ4EFgQU\n"
+                "QpxLPHT5o/GQRwdBw2scINXnWlUwHwYDVR0jBBgwFoAUQpxLPHT5o/GQRwdBw2sc\n"
+                "INXnWlUwDwYDVR0PAQH/BAUDAwf/gDBlBgNVHSUBAf8EWzBZBggrBgEFBQcDAQYI\n"
+                "KwYBBQUHAwIGCCsGAQUFBwMDBggrBgEFBQcDBAYIKwYBBQUHAwgGCCsGAQUFBwMJ\n"
+                "BggrBgEFBQcDDQYIKwYBBQUHAw4GBysGAQUCAwUwDQYJKoZIhvcNAQELBQADggEB\n"
+                "ABcyab7F7OAsjUSW0YWkVRX1SUMkW25xLLs8koXhHrdnBqgnmOur0xO72/fmTTX9\n"
+                "KnCUmQj+dAOmmZrAaIZzqLtMyp4ibHZPfOBwmM0MFnyuwyEnCEYvjPN3FTB0HEgS\n"
+                "vCoFH1001LVi4oC1mEMxYaNW4/5Tgl+DTqGF+tctJe3hvbxh+Uu5M0320VAvASjt\n"
+                "cJ0me6Ug1FJJ60tgXgZ+M/8V6AXhrQGNgN6WkPMFbbLi5IyEld186QPeLdZ8vCtz\n"
+                "StjIV9HZGR1XLotlXarbjVtjxavZJjtwiySeYkAgG7Zjy7LalPSJiIdAD3R/ny+S\n"
+                "9kXDKiw/HgYxb8xiy9gdlSc=\n"
+                "-----END CERTIFICATE-----\n";
+
+
+static const char *remote_identity_trusted_expired =
+                "-----BEGIN CERTIFICATE-----\n"
+                "MIIEKTCCAxGgAwIBAgIBBjANBgkqhkiG9w0BAQsFADByMQswCQYDVQQGEwJOTDEL\n"
+                "MAkGA1UECBMCT1YxEzARBgNVBAoTCkFETGluayBJU1QxGTAXBgNVBAMTEElkZW50\n"
+                "aXR5IENBIFRlc3QxJjAkBgkqhkiG9w0BCQEWF2luZm9AaXN0LmFkbGlua3RlY2gu\n"
+                "Y29tMB4XDTE4MDMwMTAwMDAwMFoXDTE4MDQyMzIzNTk1OVowcjELMAkGA1UEBhMC\n"
+                "TkwxCzAJBgNVBAgTAk9WMRMwEQYDVQQKEwpBRExpbmsgSVNUMRkwFwYDVQQDExBC\n"
+                "b2IgVGVzdCBFeHBpcmVkMSYwJAYJKoZIhvcNAQkBFhdpbmZvQGlzdC5hZGxpbmt0\n"
+                "ZWNoLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMHm+qG5afCH\n"
+                "Fdmp98+Z+POB7vD3WhfghKVugh8FenewuPaaotKxiGAE0kCf8WXU5l4XDR3iBWJs\n"
+                "GDHll1yOyL4KW9grwfnfiJMl82uIzKGDiRJbFkXVOLF/DcVLsuqMoRjlk09+nlrg\n"
+                "/7xS96itgm6yueW/UOIXpo+ElCHwnrYnpuHHrYM0s7t1ls3QFSyda3INx+LkM6N/\n"
+                "b+veVJF95yfe4GvVBhFpLkWtX4xKgZyMjczvmZ6LVNNSnthPhlZFHmspQyqXrTnG\n"
+                "yax3qyoloqh9ibDvAK5pUnzqlv/Dyyt110q3bXFR5A0wqfj0fqtp7Mw4TdTkFQy1\n"
+                "n4/Y4EuT8I8CAwEAAaOByTCBxjAMBgNVHRMEBTADAQH/MB0GA1UdDgQWBBRCnEs8\n"
+                "dPmj8ZBHB0HDaxwg1edaVTAfBgNVHSMEGDAWgBRNVUJNFzhJPReYT4QSx6dK53CX\n"
+                "CTAPBgNVHQ8BAf8EBQMDB/+AMGUGA1UdJQEB/wRbMFkGCCsGAQUFBwMBBggrBgEF\n"
+                "BQcDAgYIKwYBBQUHAwMGCCsGAQUFBwMEBggrBgEFBQcDCAYIKwYBBQUHAwkGCCsG\n"
+                "AQUFBwMNBggrBgEFBQcDDgYHKwYBBQIDBTANBgkqhkiG9w0BAQsFAAOCAQEAdY5n\n"
+                "5ElOhpHq/YPWUs68t8HNIhqfokqjLZAgzNyU5QFppb9tPpmFCugerfjlScNwp5HB\n"
+                "X6/WjK4runDrgzXfmrBogR4Kscb1KJSm8KAmnzXVUNr1iyASlHxI7241kYdQvTH2\n"
+                "LL6b0kjsD5lKAnNh4id0SDHfy/CKg5d7dUxxO1mX48jUiIZtmFqgjej8tFLHy/w/\n"
+                "usI5ErlI0qzI6lkoRxPCEWLbXWeBDm3/smHeDbYa/+Lw4Bid8U1+ZSAuC1CT7a7F\n"
+                "O3gAjPUL0jzRztp5Yj3dYPV8YyJHLEKr75IXNedV9YKhT4f6kTS3UEjMTqYbYsix\n"
+                "MtqgY283RjsExzjNvw==\n"
+                "-----END CERTIFICATE-----\n";
+
+static struct plugins_hdl *plugins = NULL;
+static dds_security_authentication *auth = NULL;
+static DDS_Security_IdentityHandle local_identity_handle = DDS_SECURITY_HANDLE_NIL;
+static DDS_Security_IdentityHandle remote_identity_handle1 = DDS_SECURITY_HANDLE_NIL;
+static DDS_Security_IdentityHandle remote_identity_handle2 = DDS_SECURITY_HANDLE_NIL;
+static DDS_Security_AuthRequestMessageToken g_local_auth_request_token = DDS_SECURITY_TOKEN_INIT;
+static DDS_Security_AuthRequestMessageToken g_remote_auth_request_token = DDS_SECURITY_TOKEN_INIT;
+static const DDS_Security_BinaryProperty_t *challenge1_predefined_glb = NULL;
+static const DDS_Security_BinaryProperty_t *challenge2_predefined_glb = NULL;
+static DDS_Security_OctetSeq serialized_participant_data = DDS_SECURITY_SEQUENCE_INIT;
+static DDS_Security_ParticipantBuiltinTopicData *remote_participant_data1 = NULL;
+static DDS_Security_ParticipantBuiltinTopicData *remote_participant_data2 = NULL;
+static DDS_Security_ParticipantBuiltinTopicData *remote_participant_data3 = NULL;
+static DDS_Security_GUID_t candidate_participant_guid;
+static DDS_Security_GUID_t remote_participant_guid1;
+static DDS_Security_GUID_t remote_participant_guid2;
+
+static EVP_PKEY *dh_modp_key = NULL;
+static EVP_PKEY *dh_ecdh_key = NULL;
+static struct octet_seq dh_modp_pub_key = {NULL, 0};
+static struct octet_seq dh_ecdh_pub_key = {NULL, 0};
+static struct octet_seq invalid_dh_pub_key = {NULL, 0};
+
+
+static void
+octet_seq_init(
+    struct octet_seq *seq,
+    unsigned char *data,
+    uint32_t size)
+{
+    seq->data = ddsrt_malloc(size);
+    memcpy(seq->data, data, size);
+    seq->length = size;
+}
+
+static void
+octet_seq_deinit(
+    struct octet_seq *seq)
+{
+    ddsrt_free(seq->data);
+}
+
+static void
+serializer_participant_data(
+    DDS_Security_ParticipantBuiltinTopicData *pdata,
+    unsigned char **buffer,
+    size_t *size);
+
+static void
+dds_security_property_init(
+    DDS_Security_PropertySeq *seq,
+    DDS_Security_unsigned_long size)
+{
+    seq->_length = size;
+    seq->_maximum = size;
+    seq->_buffer = ddsrt_malloc(size * sizeof(DDS_Security_Property_t));
+    memset(seq->_buffer, 0, size * sizeof(DDS_Security_Property_t));
+}
+
+static void
+dds_security_property_deinit(
+    DDS_Security_PropertySeq *seq)
+{
+    uint32_t i;
+
+    for (i = 0; i < seq->_length; i++) {
+        ddsrt_free(seq->_buffer[i].name);
+        ddsrt_free(seq->_buffer[i].value);
+    }
+    ddsrt_free(seq->_buffer);
+}
+
+static void
+reset_exception(
+    DDS_Security_SecurityException *ex)
+{
+    ex->minor_code = 0;
+    ex->code = 0;
+    ddsrt_free(ex->message);
+    ex->message = NULL;
+}
+
+static void
+initialize_identity_token(
+    DDS_Security_IdentityToken *token,
+    const char *certAlgo,
+    const char *caAlgo)
+{
+    memset(token, 0, sizeof(*token));
+
+    token->class_id = ddsrt_strdup(AUTH_PROTOCOL_CLASS_ID);
+    token->properties._maximum = 4;
+    token->properties._length  = 4;
+    token->properties._buffer = DDS_Security_PropertySeq_allocbuf(4);
+
+    token->properties._buffer[0].name = ddsrt_strdup(PROPERTY_CERT_SUBJECT_NAME);
+    token->properties._buffer[0].value = ddsrt_strdup(SUBJECT_NAME_IDENTITY_CERT);
+    token->properties._buffer[0].propagate = true;
+
+    token->properties._buffer[1].name = ddsrt_strdup(PROPERTY_CERT_ALGORITHM);
+    token->properties._buffer[1].value = ddsrt_strdup(certAlgo);
+    token->properties._buffer[1].propagate = true;
+
+    token->properties._buffer[2].name = ddsrt_strdup(PROPERTY_CA_SUBJECT_NAME);
+    token->properties._buffer[2].value = ddsrt_strdup(SUBJECT_NAME_IDENTITY_CA);
+    token->properties._buffer[2].propagate = true;
+
+    token->properties._buffer[3].name = ddsrt_strdup(PROPERTY_CA_ALGORITHM);
+    token->properties._buffer[3].value = ddsrt_strdup(caAlgo);
+    token->properties._buffer[3].propagate = true;
+}
+
+static void
+initialize_permissions_token(
+    DDS_Security_PermissionsToken *token,
+    const char *caAlgo)
+{
+    token->class_id = ddsrt_strdup(PERM_ACCESS_CLASS_ID);
+    token->properties._length = 2;
+    token->properties._maximum = 2;
+    token->properties._buffer = DDS_Security_PropertySeq_allocbuf(4);
+    token->properties._buffer[0].name = ddsrt_strdup(PROPERTY_CERT_SUBJECT_NAME);
+    token->properties._buffer[0].value = ddsrt_strdup(SUBJECT_NAME_IDENTITY_CA);
+    token->properties._buffer[1].name = ddsrt_strdup(PROPERTY_PERM_CA_SUBJECT_NAME);
+    token->properties._buffer[1].value = ddsrt_strdup(caAlgo);
+}
+
+
+
+static void
+fill_auth_request_token(
+    DDS_Security_AuthRequestMessageToken *token)
+{
+    uint32_t i;
+    uint32_t len = 32;
+    unsigned char *challenge;
+
+    challenge = ddsrt_malloc(len);
+
+    for (i = 0; i < len; i++) {
+        challenge[i] = (unsigned char)(0xFF - i);
+    }
+
+    memset(token, 0, sizeof(*token));
+
+    token->class_id = ddsrt_strdup(AUTH_REQUEST_TOKEN_CLASS_ID);
+    token->binary_properties._maximum = 1;
+    token->binary_properties._length = 1;
+    token->binary_properties._buffer = DDS_Security_BinaryPropertySeq_allocbuf(1);
+    token->binary_properties._buffer->name = ddsrt_strdup(AUTH_REQUEST_TOKEN_FUTURE_PROP_NAME);
+
+    token->binary_properties._buffer->value._maximum = len;
+    token->binary_properties._buffer->value._length = len;
+    token->binary_properties._buffer->value._buffer = challenge;
+}
+
+
+static DDS_Security_BinaryProperty_t *
+find_binary_property(
+    DDS_Security_DataHolder *token,
+    const char *name)
+{
+    DDS_Security_BinaryProperty_t *result = NULL;
+    uint32_t i;
+
+    for (i = 0; i < token->binary_properties._length && !result; i++) {
+        if (token->binary_properties._buffer[i].name && (strcmp(token->binary_properties._buffer[i].name, name) == 0)) {
+            result = &token->binary_properties._buffer[i];
+        }
+    }
+
+    return result;
+}
+
+static void
+deinitialize_identity_token(
+    DDS_Security_IdentityToken *token)
+{
+    DDS_Security_DataHolder_deinit(token);
+}
+
+static int
+validate_local_identity(const char* trusted_ca_dir)
+{
+    int res = 0;
+    DDS_Security_ValidationResult_t result;
+    DDS_Security_DomainId domain_id = 0;
+    DDS_Security_Qos participant_qos;
+    DDS_Security_SecurityException exception = {NULL, 0, 0};
+    DDS_Security_GUID_t local_participant_guid;
+    DDS_Security_GuidPrefix_t prefix = {0xb0, 0xb1, 0xb2, 0xb3, 0xb4, 0xb5, 0xb6, 0xb7, 0xb8, 0xb9, 0xba, 0xbb};
+    DDS_Security_EntityId_t entityId = {{0xb0,0xb1,0xb2},0x1};
+    DDS_Security_ParticipantBuiltinTopicData *local_participant_data;
+    unsigned char *sdata;
+    size_t size;
+
+    memset(&local_participant_guid, 0, sizeof(local_participant_guid));
+    memcpy(&candidate_participant_guid.prefix, &prefix, sizeof(prefix));
+    memcpy(&candidate_participant_guid.entityId, &entityId, sizeof(entityId));
+
+    memset(&participant_qos, 0, sizeof(participant_qos));
+    if( trusted_ca_dir != NULL){
+        char trusted_ca_dir_path[1024];
+        dds_security_property_init(&participant_qos.property.value, 4);
+#ifdef WIN32
+    snprintf(trusted_ca_dir_path, 1024, "%s\\testsuite\\dbt\\security_plugin\\tests\\validate_begin_handshake_reply\\etc\\%s", CONFIG_ENV_TESTS_DIR,trusted_ca_dir);
+#else
+    snprintf(trusted_ca_dir_path, 1024, "%s/validate_begin_handshake_reply/etc/%s", CONFIG_ENV_TESTS_DIR, trusted_ca_dir);
+#endif
+        participant_qos.property.value._buffer[3].name = ddsrt_strdup(PROPERTY_TRUSTED_CA_DIR);
+        participant_qos.property.value._buffer[3].value = ddsrt_strdup(trusted_ca_dir_path);
+    }
+    else{
+        dds_security_property_init(&participant_qos.property.value, 3);
+    }
+    participant_qos.property.value._buffer[0].name = ddsrt_strdup(PROPERTY_IDENTITY_CERT);
+    participant_qos.property.value._buffer[0].value = ddsrt_strdup(identity_certificate);
+    participant_qos.property.value._buffer[1].name = ddsrt_strdup(PROPERTY_IDENTITY_CA);
+    participant_qos.property.value._buffer[1].value = ddsrt_strdup(identity_ca);
+    participant_qos.property.value._buffer[2].name = ddsrt_strdup(PROPERTY_PRIVATE_KEY);
+    participant_qos.property.value._buffer[2].value = ddsrt_strdup(private_key);
+
+    /* Now call the function. */
+    result = auth->validate_local_identity(
+                            auth,
+                            &local_identity_handle,
+                            &local_participant_guid,
+                            domain_id,
+                            &participant_qos,
+                            &candidate_participant_guid,
+                            &exception);
+
+    if (result != DDS_SECURITY_VALIDATION_OK) {
+        res = -1;
+        printf("validate_local_identity_failed: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+
+    dds_security_property_deinit(&participant_qos.property.value);
+    reset_exception(&exception);
+
+    local_participant_data = DDS_Security_ParticipantBuiltinTopicData_alloc();
+    memcpy(&local_participant_data->key[0], &local_participant_guid, 12);
+    /* convert from big-endian format to native format */
+    local_participant_data->key[0] = fromBE4u(local_participant_data->key[0]);
+    local_participant_data->key[1] = fromBE4u(local_participant_data->key[1]);
+    local_participant_data->key[2] = fromBE4u(local_participant_data->key[2]);
+
+    initialize_identity_token(&local_participant_data->identity_token, RSA_2048_ALGORITHM_NAME, RSA_2048_ALGORITHM_NAME);
+    initialize_permissions_token(&local_participant_data->permissions_token, RSA_2048_ALGORITHM_NAME);
+
+    local_participant_data->security_info.participant_security_attributes = 0x01;
+    local_participant_data->security_info.plugin_participant_security_attributes = 0x02;
+
+    serializer_participant_data(local_participant_data, &sdata, &size);
+
+    serialized_participant_data._length = serialized_participant_data._maximum = (DDS_Security_unsigned_long) size;
+    serialized_participant_data._buffer = sdata;
+
+    DDS_Security_ParticipantBuiltinTopicData_free(local_participant_data);
+
+    return res;
+}
+
+static void
+release_local_identity(void)
+{
+    DDS_Security_SecurityException exception = {NULL, 0, 0};
+    DDS_Security_boolean success;
+
+    if (local_identity_handle != DDS_SECURITY_HANDLE_NIL) {
+        success = auth->return_identity_handle(auth, local_identity_handle, &exception);
+        if (!success) {
+            printf("return_identity_handle failed: %s\n", exception.message ? exception.message : "Error message missing");
+        }
+        reset_exception(&exception);
+    }
+
+    DDS_Security_OctetSeq_deinit(&serialized_participant_data);
+}
+
+static X509 *
+load_certificate(
+   const char *data)
+{
+    X509 *cert = NULL;
+    BIO *bio;
+
+    bio = BIO_new_mem_buf((void *) data, -1);
+    if (!bio) {
+        return NULL;
+    }
+
+    cert = PEM_read_bio_X509(bio, NULL, NULL, NULL);
+
+    BIO_free(bio);
+
+    return cert;
+}
+
+static int
+get_adjusted_participant_guid(
+    X509 *cert,
+    const DDS_Security_GUID_t *candidate,
+    DDS_Security_GUID_t *adjusted)
+{
+    int result = 0;
+    unsigned char high[SHA256_DIGEST_LENGTH], low[SHA256_DIGEST_LENGTH];
+    unsigned char *subject;
+    DDS_Security_octet hb = 0x80;
+    X509_NAME *name;
+    unsigned char *tmp = NULL;
+    int i, sz;
+
+    name = X509_get_subject_name(cert);
+    sz = i2d_X509_NAME(name, &tmp);
+    if (sz > 0) {
+        subject = ddsrt_malloc( (size_t)sz);
+        memcpy(subject, tmp,  (size_t)sz);
+        OPENSSL_free(tmp);
+
+        SHA256(subject,  (size_t)sz, high);
+        SHA256(&candidate->prefix[0], sizeof(DDS_Security_GuidPrefix_t), low);
+
+        adjusted->entityId = candidate->entityId;
+        for (i = 0; i < 6; i++) {
+            adjusted->prefix[i] = hb | high[i]>>1;
+            hb = (DDS_Security_octet)(high[i]<<7);
+        }
+        for (i = 0; i < 6; i++) {
+            adjusted->prefix[i+6] = low[i];
+        }
+        ddsrt_free(subject);
+        result = 1;
+    }
+
+    return result;
+}
+
+static int
+create_dh_key_modp_2048(
+    EVP_PKEY **pkey)
+{
+    int r = 0;
+    EVP_PKEY *params = NULL;
+    EVP_PKEY_CTX *kctx = NULL;
+    DH *dh = NULL;
+
+    *pkey = NULL;
+
+    if ((params = EVP_PKEY_new()) == NULL) {
+        char *msg = get_openssl_error_message_for_test();
+        printf("Failed to allocate EVP_PKEY: %s", msg);
+        ddsrt_free(msg);
+        r = -1;
+    } else if ((dh = DH_get_2048_256()) == NULL) {
+        char *msg = get_openssl_error_message_for_test();
+        printf("Failed to allocate DH parameter: %s", msg);
+        ddsrt_free(msg);
+        r = -1;
+    } else if (EVP_PKEY_set1_DH(params, dh) <= 0) {
+        char *msg = get_openssl_error_message_for_test();
+        printf("Failed to set DH parameter to MODP_2048_256: %s", msg);
+        ddsrt_free(msg);
+        r = -1;
+    } else if ((kctx = EVP_PKEY_CTX_new(params, NULL)) == NULL) {
+        char *msg = get_openssl_error_message_for_test();
+        printf("Failed to allocate KEY context %s", msg);
+        ddsrt_free(msg);
+        r = -1;
+    } else if (EVP_PKEY_keygen_init(kctx) <= 0) {
+        char *msg = get_openssl_error_message_for_test();
+        printf("Failed to initialize KEY context: %s", msg);
+        ddsrt_free(msg);
+        r = -1;
+    } else if (EVP_PKEY_keygen(kctx, pkey) <= 0) {
+        char *msg = get_openssl_error_message_for_test();
+        printf("Failed to generate :MODP_2048_256 keys %s", msg);
+        ddsrt_free(msg);
+        r = -1;
+    }
+
+    if (params) EVP_PKEY_free(params);
+    if (kctx) EVP_PKEY_CTX_free(kctx);
+    if (dh) DH_free(dh);
+
+    return r;
+}
+
+static int
+get_dh_public_key_modp_2048(
+    EVP_PKEY *pkey,
+    struct octet_seq *pubkey)
+{
+    int r = 0;
+    DH *dhkey;
+    unsigned char *buffer = NULL;
+    uint32_t size;
+    ASN1_INTEGER *asn1int;
+
+    dhkey = EVP_PKEY_get1_DH(pkey);
+    if (!dhkey) {
+        char *msg = get_openssl_error_message_for_test();
+        printf("Failed to get DH key from PKEY: %s", msg);
+        ddsrt_free(msg);
+        r = -1;
+        goto fail_get_dhkey;
+    }
+
+    asn1int = BN_to_ASN1_INTEGER( dh_get_public_key(dhkey) , NULL);
+    if (!asn1int) {
+        char *msg = get_openssl_error_message_for_test();
+        printf("Failed to convert DH key to ASN1 integer: %s", msg);
+        ddsrt_free(msg);
+        r = -1;
+        goto fail_get_pubkey;
+    }
+
+    size = (uint32_t) i2d_ASN1_INTEGER(asn1int, &buffer);
+    octet_seq_init(pubkey, buffer, size);
+
+    ASN1_INTEGER_free(asn1int);
+    OPENSSL_free(buffer);
+
+fail_get_pubkey:
+    DH_free(dhkey);
+fail_get_dhkey:
+    return r;
+}
+
+static int
+create_dh_key_ecdh(
+    EVP_PKEY **pkey)
+{
+    int r = 0;
+    EVP_PKEY *params = NULL;
+    EVP_PKEY_CTX *pctx = NULL;
+    EVP_PKEY_CTX *kctx = NULL;
+
+    *pkey = NULL;
+
+    if ((pctx = EVP_PKEY_CTX_new_id(EVP_PKEY_EC, NULL)) == NULL) {
+        char *msg = get_openssl_error_message_for_test();
+        printf("Failed to allocate DH parameter context: %s", msg);
+        ddsrt_free(msg);
+        r = -1;
+    } else if (EVP_PKEY_paramgen_init(pctx) <= 0) {
+        char *msg = get_openssl_error_message_for_test();
+        printf("Failed to initialize DH generation context: %s", msg);
+        ddsrt_free(msg);
+        r = -1;
+    } else if (EVP_PKEY_CTX_set_ec_paramgen_curve_nid(pctx, NID_X9_62_prime256v1) <= 0) {
+        char *msg = get_openssl_error_message_for_test();
+        printf("Failed to set DH generation parameter generation method: %s", msg);
+        ddsrt_free(msg);
+        r = -1;
+    } else if (EVP_PKEY_paramgen(pctx, &params) <= 0) {
+        char *msg = get_openssl_error_message_for_test();
+        printf("Failed to generate DH parameters: %s", msg);
+        ddsrt_free(msg);
+        r = -1;
+    } else if ((kctx = EVP_PKEY_CTX_new(params, NULL)) == NULL) {
+        char *msg = get_openssl_error_message_for_test();
+        printf("Failed to allocate KEY context %s", msg);
+        ddsrt_free(msg);
+        r = -1;
+    } else if (EVP_PKEY_keygen_init(kctx) <= 0) {
+        char *msg = get_openssl_error_message_for_test();
+        printf("Failed to initialize KEY context: %s", msg);
+        ddsrt_free(msg);
+        r = -1;
+    } else if (EVP_PKEY_keygen(kctx, pkey) <= 0) {
+        char *msg = get_openssl_error_message_for_test();
+        printf("Failed to generate :MODP_2048_256 keys %s", msg);
+        ddsrt_free(msg);
+        r = -1;
+    }
+
+    if (kctx) EVP_PKEY_CTX_free(kctx);
+    if (params) EVP_PKEY_free(params);
+    if (pctx) EVP_PKEY_CTX_free(pctx);
+
+    return r;
+}
+
+static int
+get_dh_public_key_ecdh(
+    EVP_PKEY *pkey,
+    struct octet_seq *pubkey)
+{
+    int r = 0;
+    EC_KEY *eckey = NULL;
+    const EC_GROUP *group = NULL;
+    const EC_POINT *point = NULL;
+    size_t sz;
+
+    if (!(eckey = EVP_PKEY_get1_EC_KEY(pkey))) {
+        char *msg = get_openssl_error_message_for_test();
+        printf("Failed to get EC key from PKEY: %s", msg);
+        ddsrt_free(msg);
+        r = -1;
+    } else if (!(point = EC_KEY_get0_public_key(eckey))) {
+        char *msg = get_openssl_error_message_for_test();
+        printf("Failed to get public key from ECKEY: %s", msg);
+        ddsrt_free(msg);
+        r = -1;
+    } else if (!(group = EC_KEY_get0_group(eckey))) {
+        char *msg = get_openssl_error_message_for_test();
+        printf("Failed to get group from ECKEY: %s", msg);
+        ddsrt_free(msg);
+        r = -1;
+    } else if ((sz = EC_POINT_point2oct(group, point, POINT_CONVERSION_COMPRESSED, NULL, 0, NULL)) != 0) {
+        pubkey->data = ddsrt_malloc(sz);
+        pubkey->length = (uint32_t) EC_POINT_point2oct(group, point, POINT_CONVERSION_COMPRESSED, pubkey->data, sz, NULL);
+        if (pubkey->length == 0) {
+            char *msg = get_openssl_error_message_for_test();
+            printf("Failed to serialize public EC key: %s", msg);
+            ddsrt_free(msg);
+            octet_seq_deinit(pubkey);
+            r = -1;
+        }
+    } else {
+        char *msg = get_openssl_error_message_for_test();
+        printf("Failed to serialize public EC key: %s", msg);
+        ddsrt_free(msg);
+        r = -1;
+    }
+
+    if (eckey) EC_KEY_free(eckey);
+
+    return r;
+}
+
+static int
+validate_remote_identities (const char *remote_id_certificate)
+{
+    int res = 0;
+    DDS_Security_ValidationResult_t result;
+    DDS_Security_IdentityToken remote_identity_token;
+    static DDS_Security_AuthRequestMessageToken local_auth_request_token = DDS_SECURITY_TOKEN_INIT;
+    DDS_Security_GUID_t guid1;
+    DDS_Security_GUID_t guid2;
+    DDS_Security_SecurityException exception = {NULL, 0, 0};
+    DDS_Security_GuidPrefix_t prefix1 = {0xa0, 0xa1, 0xa2, 0xa3, 0xa4, 0xa5, 0xa6, 0xa7, 0xa8, 0xa9, 0xaa, 0xab};
+    DDS_Security_GuidPrefix_t prefix2 = {0xc0, 0xc1, 0xc2, 0xc3, 0xc4, 0xc5, 0xc6, 0xc7, 0xc8, 0xc9, 0xca, 0xcb};
+    DDS_Security_EntityId_t entityId = {{0xb0,0xb1,0xb2},0x1};
+    X509 *cert;
+
+    memcpy(&guid1.prefix, &prefix1, sizeof(prefix1));
+    memcpy(&guid1.entityId, &entityId, sizeof(entityId));
+    memcpy(&guid2.prefix, &prefix2, sizeof(prefix2));
+    memcpy(&guid2.entityId, &entityId, sizeof(entityId));
+
+    if (local_identity_handle == DDS_SECURITY_HANDLE_NIL) {
+        return -1;
+    }
+
+    cert = load_certificate(remote_id_certificate);
+    if (!cert) {
+        return -1;
+    }
+
+    if (!get_adjusted_participant_guid(cert, &guid1, &remote_participant_guid1)) {
+        X509_free(cert);
+        return -1;
+    }
+
+    if (!get_adjusted_participant_guid(cert, &guid2, &remote_participant_guid2)) {
+        X509_free(cert);
+        return -1;
+    }
+
+    X509_free(cert);
+
+    initialize_identity_token(&remote_identity_token, RSA_2048_ALGORITHM_NAME, RSA_2048_ALGORITHM_NAME);
+
+    result = auth->validate_remote_identity(
+                auth,
+                &remote_identity_handle1,
+                &g_local_auth_request_token,
+                NULL,
+                local_identity_handle,
+                &remote_identity_token,
+                &remote_participant_guid1,
+                &exception);
+
+    if ((result != DDS_SECURITY_VALIDATION_PENDING_HANDSHAKE_REQUEST) &&
+        (result != DDS_SECURITY_VALIDATION_PENDING_HANDSHAKE_MESSAGE)) {
+        printf("validate_remote_identity_failed: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+
+    reset_exception(&exception);
+
+    fill_auth_request_token(&g_remote_auth_request_token);
+
+    result = auth->validate_remote_identity(
+                auth,
+                &remote_identity_handle2,
+                &local_auth_request_token,
+                &g_remote_auth_request_token,
+                local_identity_handle,
+                &remote_identity_token,
+                &remote_participant_guid2,
+                &exception);
+
+    if ((result != DDS_SECURITY_VALIDATION_PENDING_HANDSHAKE_REQUEST) &&
+            (result != DDS_SECURITY_VALIDATION_PENDING_HANDSHAKE_MESSAGE)) {
+        printf("validate_remote_identity_failed: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+
+    reset_exception(&exception);
+
+    deinitialize_identity_token(&remote_identity_token);
+    DDS_Security_DataHolder_deinit(&local_auth_request_token);
+
+    remote_participant_data1 = DDS_Security_ParticipantBuiltinTopicData_alloc();
+    memcpy(&remote_participant_data1->key[0], &remote_participant_guid1, 12);
+    remote_participant_data1->key[0] = fromBE4u(remote_participant_data1->key[0]);
+    remote_participant_data1->key[1] = fromBE4u(remote_participant_data1->key[1]);
+    remote_participant_data1->key[2] = fromBE4u(remote_participant_data1->key[2]);
+
+    initialize_identity_token(&remote_participant_data1->identity_token, RSA_2048_ALGORITHM_NAME, RSA_2048_ALGORITHM_NAME);
+    initialize_permissions_token(&remote_participant_data1->permissions_token, RSA_2048_ALGORITHM_NAME);
+
+    remote_participant_data1->security_info.participant_security_attributes = 0x01;
+    remote_participant_data1->security_info.plugin_participant_security_attributes = 0x02;
+
+    remote_participant_data2 = DDS_Security_ParticipantBuiltinTopicData_alloc();
+    memcpy(&remote_participant_data2->key[0], &remote_participant_guid2, 12);
+    remote_participant_data2->key[0] = fromBE4u(remote_participant_data2->key[0]);
+    remote_participant_data2->key[1] = fromBE4u(remote_participant_data2->key[1]);
+    remote_participant_data2->key[2] = fromBE4u(remote_participant_data2->key[2]);
+
+    initialize_identity_token(&remote_participant_data2->identity_token, RSA_2048_ALGORITHM_NAME, RSA_2048_ALGORITHM_NAME);
+    initialize_permissions_token(&remote_participant_data2->permissions_token, RSA_2048_ALGORITHM_NAME);
+
+    remote_participant_data2->security_info.participant_security_attributes = 0x01;
+    remote_participant_data2->security_info.plugin_participant_security_attributes = 0x02;
+
+    remote_participant_data3 = DDS_Security_ParticipantBuiltinTopicData_alloc();
+    memcpy(&remote_participant_data3->key[0], &candidate_participant_guid, 12);
+
+    initialize_identity_token(&remote_participant_data3->identity_token, RSA_2048_ALGORITHM_NAME, RSA_2048_ALGORITHM_NAME);
+    initialize_permissions_token(&remote_participant_data3->permissions_token, RSA_2048_ALGORITHM_NAME);
+
+    remote_participant_data2->security_info.participant_security_attributes = 0x01;
+    remote_participant_data2->security_info.plugin_participant_security_attributes = 0x02;
+
+    challenge1_predefined_glb = find_binary_property(&g_remote_auth_request_token, AUTH_REQUEST_TOKEN_FUTURE_PROP_NAME);
+    challenge2_predefined_glb = challenge1_predefined_glb;
+
+    return res;
+}
+
+static void
+release_remote_identities(void)
+{
+    DDS_Security_SecurityException exception = {NULL, 0, 0};
+    DDS_Security_boolean success;
+
+    if (remote_identity_handle1 != DDS_SECURITY_HANDLE_NIL) {
+        success = auth->return_identity_handle(auth, remote_identity_handle1, &exception);
+        if (!success) {
+            printf("return_identity_handle failed: %s\n", exception.message ? exception.message : "Error message missing");
+        }
+        reset_exception(&exception);
+    }
+    if (remote_identity_handle2 != DDS_SECURITY_HANDLE_NIL) {
+        success = auth->return_identity_handle(auth, remote_identity_handle2, &exception);
+        if (!success) {
+            printf("return_identity_handle failed: %s\n", exception.message ? exception.message : "Error message missing");
+        }
+        reset_exception(&exception);
+    }
+
+    DDS_Security_DataHolder_deinit(&g_local_auth_request_token);
+    DDS_Security_DataHolder_deinit(&g_remote_auth_request_token);
+
+    DDS_Security_ParticipantBuiltinTopicData_free(remote_participant_data1);
+    DDS_Security_ParticipantBuiltinTopicData_free(remote_participant_data2);
+    DDS_Security_ParticipantBuiltinTopicData_free(remote_participant_data3);
+}
+
+CU_Init(ddssec_builtin_process_handshake)
+{
+    int result = 0;
+
+    /* Only need the authentication plugin. */
+    plugins = load_plugins(NULL   /* Access Control */,
+                           &auth  /* Authentication */,
+                           NULL   /* Cryptograpy    */);
+    if (plugins) {
+        result = validate_local_identity( NULL );
+        if (result >= 0) {
+            result = validate_remote_identities( remote_identity_certificate );
+        }
+        if (result >= 0) {
+            result = create_dh_key_modp_2048(&dh_modp_key);
+        }
+        if (result >= 0) {
+            result = get_dh_public_key_modp_2048(dh_modp_key, &dh_modp_pub_key);
+        }
+        if (result >= 0) {
+            result = create_dh_key_ecdh(&dh_ecdh_key);
+        }
+        if (result >= 0) {
+            result = get_dh_public_key_ecdh(dh_ecdh_key, &dh_ecdh_pub_key);
+        }
+        if (result >= 0) {
+            octet_seq_init(&invalid_dh_pub_key, dh_modp_pub_key.data, dh_modp_pub_key.length);
+            invalid_dh_pub_key.data[0] = 0x08;
+        }
+    } else {
+        result = -1;
+    }
+
+
+    return result;
+}
+
+CU_Clean(ddssec_builtin_process_handshake)
+{
+    release_local_identity();
+    release_remote_identities();
+    unload_plugins(plugins);
+    octet_seq_deinit(&dh_modp_pub_key);
+    octet_seq_deinit(&dh_ecdh_pub_key);
+    octet_seq_deinit(&invalid_dh_pub_key);
+    if (dh_modp_key) {
+        EVP_PKEY_free(dh_modp_key);
+    }
+    if (dh_ecdh_key) {
+        EVP_PKEY_free(dh_ecdh_key);
+    }
+    return 0;
+}
+
+static bool
+compare_octet_seq(
+    const DDS_Security_OctetSeq *seq1,
+    const DDS_Security_OctetSeq *seq2)
+{
+    int r;
+    if (seq1 && seq2) {
+        r = (int)(seq2->_length - seq1->_length);
+        if (r == 0) {
+            r = memcmp(seq1->_buffer, seq2->_buffer, seq1->_length);
+        }
+    } else if (seq1 == seq2) {
+        r = 0;
+    } else {
+        r = (seq2 > seq1) ? 1 : -1;
+    }
+    return r;
+}
+
+static void
+serializer_participant_data(
+    DDS_Security_ParticipantBuiltinTopicData *pdata,
+    unsigned char **buffer,
+    size_t *size)
+{
+    DDS_Security_Serializer serializer;
+    serializer = DDS_Security_Serializer_new(1024, 1024);
+
+    DDD_Security_Serialize_ParticipantBuiltinTopicData(serializer, pdata);
+    DDS_Security_Serializer_buffer(serializer, buffer, size);
+    DDS_Security_Serializer_free(serializer);
+}
+
+
+static void
+set_binary_property_value(
+     DDS_Security_BinaryProperty_t *bp,
+     const char *name,
+     const unsigned char *data,
+     uint32_t length)
+{
+    assert(bp);
+    assert(name);
+    assert(data);
+
+    bp->name = ddsrt_strdup(name);
+    bp->value._maximum = bp->value._length = length;
+    if (length) {
+        bp->value._buffer = ddsrt_malloc(length);
+        memcpy(bp->value._buffer, data, length);
+    } else {
+        bp->value._buffer = NULL;
+    }
+}
+
+static void
+set_binary_property_string(
+     DDS_Security_BinaryProperty_t *bp,
+     const char *name,
+     const char *data)
+{
+    uint32_t length;
+
+    assert(bp);
+    assert(name);
+    assert(data);
+
+    length = (uint32_t)strlen(data) + 1;
+    set_binary_property_value(bp, name, (const unsigned char *)data, length);
+}
+
+static void
+fill_handshake_message_token(
+    DDS_Security_HandshakeMessageToken *token,
+    DDS_Security_ParticipantBuiltinTopicData *pdata,
+    const char *certificate,
+    const char *dsign,
+    const char *kagree,
+    const struct octet_seq *diffie_hellman1,
+    const unsigned char *challengeData,
+    unsigned int challengeDataSize,
+    const struct octet_seq *diffie_hellman2,
+    const unsigned char *challengeData2,
+    unsigned int challengeDataSize2,
+    const DDS_Security_BinaryProperty_t *hash1_from_request,
+    const DDS_Security_BinaryProperty_t *hash2_from_reply,
+    HandshakeStep_t step)
+{
+    DDS_Security_BinaryProperty_t *tokens;
+    DDS_Security_BinaryProperty_t *c_id;
+    DDS_Security_BinaryProperty_t *c_perm;
+    DDS_Security_BinaryProperty_t *c_pdata;
+    DDS_Security_BinaryProperty_t *c_dsign_algo;
+    DDS_Security_BinaryProperty_t *c_kagree_algo;
+    DDS_Security_BinaryProperty_t *hash_c1;
+    DDS_Security_BinaryProperty_t *hash_c2;
+    DDS_Security_BinaryProperty_t *dh1;
+    DDS_Security_BinaryProperty_t *dh2;
+    DDS_Security_BinaryProperty_t *challenge1;
+    DDS_Security_BinaryProperty_t *challenge2;
+    DDS_Security_BinaryProperty_t *signature;
+    DDS_Security_SecurityException exception = {NULL, 0, 0};
+    unsigned idx;
+    unsigned char *serialized_local_participant_data;
+    size_t serialized_local_participant_data_size;
+    /*unsigned hash[32];*/
+
+    switch( step )
+    {
+
+    case HANDSHAKE_REQUEST:
+       tokens = DDS_Security_BinaryPropertySeq_allocbuf(8);
+       c_id = &tokens[0];
+       c_perm = &tokens[1];
+       c_pdata = &tokens[2];
+       c_dsign_algo = &tokens[3];
+       c_kagree_algo = &tokens[4];
+       hash_c1 = &tokens[5];
+       dh1 = &tokens[6];
+       challenge1 = &tokens[7];
+
+        serializer_participant_data(pdata, &serialized_local_participant_data, &serialized_local_participant_data_size);
+
+       /* Store the Identity Certificate associated with the local identify in c.id property */
+       if (certificate) {
+           set_binary_property_string(c_id, "c.id", certificate);
+       } else {
+           set_binary_property_string(c_id, "c.idx", "rubbish");
+       }
+
+       /* Store the permission document in the c.perm property */
+       set_binary_property_string(c_perm, "c.perm", "permissions_document");
+
+       /* Store the provided local_participant_data in the c.pdata property */
+       set_binary_property_value(c_pdata, "c.pdata", serialized_local_participant_data, (uint32_t)serialized_local_participant_data_size);
+       ddsrt_free(serialized_local_participant_data);
+
+       /* Set the used signing algorithm descriptor in c.dsign_algo */
+       if (dsign) {
+           set_binary_property_string(c_dsign_algo, "c.dsign_algo", dsign);
+       } else {
+           set_binary_property_string(c_dsign_algo, "c.dsign_algox", "rubbish");
+       }
+
+       /* Set the used key algorithm descriptor in c.kagree_algo */
+       if (kagree) {
+           set_binary_property_string(c_kagree_algo, "c.kagree_algo", kagree);
+       } else {
+           set_binary_property_string(c_kagree_algo, "c.kagree_algox", "rubbish");
+       }
+
+       /* Calculate the hash_c1 */
+       {
+           DDS_Security_BinaryPropertySeq bseq;
+           DDS_Security_Serializer serializer;
+           unsigned char hash1_sentrequest_arr[32];
+           unsigned char *buffer;
+           size_t size;
+
+           bseq._length = bseq._maximum = 5;
+           bseq._buffer = tokens;
+
+           serializer = DDS_Security_Serializer_new(1024, 1024);
+
+           DDS_Security_Serialize_BinaryPropertySeq(serializer, &bseq);
+           DDS_Security_Serializer_buffer(serializer, &buffer, &size);
+           SHA256(buffer, size, hash1_sentrequest_arr);
+           ddsrt_free(buffer);
+           DDS_Security_Serializer_free(serializer);
+
+           set_binary_property_value(hash_c1, "hash_c1", hash1_sentrequest_arr, sizeof(hash1_sentrequest_arr));
+       }
+
+       /* Set the DH public key associated with the local participant in dh1 property */
+       if (diffie_hellman1) {
+           set_binary_property_value(dh1, "dh1", diffie_hellman1->data, diffie_hellman1->length);
+       } else {
+           set_binary_property_string(dh1, "dh1x", "rubbish");
+       }
+
+       /* Set the challenge in challenge1 property */
+       if (challengeData) {
+           set_binary_property_value(challenge1, "challenge1", challengeData, challengeDataSize);
+       } else {
+           set_binary_property_value(challenge1, "challenge1x", challenge1_predefined_glb->value._buffer, challenge1_predefined_glb->value._length);
+       }
+
+       token->class_id = ddsrt_strdup(AUTH_HANDSHAKE_REQUEST_TOKEN_CLASS_ID);
+       token->binary_properties._length = token->binary_properties._maximum = 8;
+       token->binary_properties._buffer = tokens;
+       break;
+
+    case HANDSHAKE_REPLY:
+        tokens = DDS_Security_BinaryPropertySeq_allocbuf(12);
+        idx = 0;
+        c_id = &tokens[idx++];
+        c_perm = &tokens[idx++];
+        c_pdata = &tokens[idx++];
+        c_dsign_algo = &tokens[idx++];
+        c_kagree_algo = &tokens[idx++];
+        hash_c2 = &tokens[idx++];
+        challenge2 = &tokens[idx++];
+        dh2 = &tokens[idx++];
+        challenge1 = &tokens[idx++];
+        dh1 = &tokens[idx++];
+        hash_c1 = &tokens[idx++] ;
+        signature = &tokens[idx++];
+
+        serializer_participant_data(pdata, &serialized_local_participant_data, &serialized_local_participant_data_size);
+
+        /* Store the Identity Certificate associated with the local identify in c.id property */
+        if (certificate) {
+           set_binary_property_string(c_id, "c.id", certificate);
+        } else {
+           set_binary_property_string(c_id, "c.idx", "rubbish");
+        }
+
+        /* Store the permission document in the c.perm property */
+        set_binary_property_string(c_perm, "c.perm", "permissions_document");
+
+        /* Store the provided local_participant_data in the c.pdata property */
+        set_binary_property_value(c_pdata, "c.pdata", serialized_local_participant_data, (uint32_t )serialized_local_participant_data_size);
+        ddsrt_free(serialized_local_participant_data);
+
+        /* Set the used signing algorithm descriptor in c.dsign_algo */
+        if (dsign) {
+           set_binary_property_string(c_dsign_algo, "c.dsign_algo", dsign);
+        } else {
+           set_binary_property_string(c_dsign_algo, "c.dsign_algox", "rubbish");
+        }
+
+        /* Set the used key algorithm descriptor in c.kagree_algo */
+        if (kagree) {
+           set_binary_property_string(c_kagree_algo, "c.kagree_algo", kagree);
+        } else {
+           set_binary_property_string(c_kagree_algo, "c.kagree_algox", "rubbish");
+        }
+
+        CU_ASSERT(hash1_from_request != NULL);
+
+        set_binary_property_value(hash_c1, "hash_c1", hash1_from_request->value._buffer, hash1_from_request->value._length);
+
+        /* Calculate the hash_c2 */
+        {
+           DDS_Security_BinaryPropertySeq bseq;
+           DDS_Security_Serializer serializer;
+           unsigned char hash2_sentreply_arr[32];
+           unsigned char *buffer;
+           size_t size;
+
+           bseq._length = bseq._maximum = 5;
+           bseq._buffer = tokens;
+
+           serializer = DDS_Security_Serializer_new(1024, 1024);
+
+           DDS_Security_Serialize_BinaryPropertySeq(serializer, &bseq);
+           DDS_Security_Serializer_buffer(serializer, &buffer, &size);
+           SHA256(buffer, size, hash2_sentreply_arr);
+
+           ddsrt_free(buffer);
+           DDS_Security_Serializer_free(serializer);
+
+           set_binary_property_value(hash_c2, "hash_c2", hash2_sentreply_arr, sizeof(hash2_sentreply_arr));
+        }
+
+        /* Set the challenge in challenge1 property */
+        if (challengeData) {
+          set_binary_property_value(challenge1, "challenge1", challengeData, challengeDataSize);
+        } else {
+          set_binary_property_value(challenge1, "challenge1x", challenge2->value._buffer, challenge2->value._length);
+        }
+
+        /* Set the challenge in challenge2 property */
+        if (challengeData2) {
+           set_binary_property_value(challenge2, "challenge2", challengeData2, challengeDataSize2);
+        } else {
+           set_binary_property_value(challenge2, "challenge2x", challenge2->value._buffer, challenge2->value._length);
+        }
+
+
+        /* Set the DH public key associated with the local participant in dh1 property */
+        if (diffie_hellman1) {
+          set_binary_property_value(dh1, "dh1", diffie_hellman1->data, diffie_hellman1->length);
+        } else {
+          set_binary_property_string(dh1, "dh1x", "rubbish");
+        }
+
+        /* Set the DH public key associated with the local participant in dh2 property */
+        if (diffie_hellman2) {
+          set_binary_property_value(dh2, "dh2", diffie_hellman2->data, diffie_hellman2->length);
+        } else {
+          set_binary_property_string(dh2, "dh2x", "rubbish");
+        }
+
+        /* Calculate the signature */
+        {
+            BIO *bio;
+            EVP_PKEY *private_key_x509;
+            unsigned char *sign;
+            size_t signlen;
+
+            const DDS_Security_BinaryProperty_t * binary_properties[ HANDSHAKE_SIGNATURE_SIZE ];
+
+            /* load certificate in buffer */
+            bio = BIO_new_mem_buf((const char *) remote_private_key, -1);
+            assert( bio );
+            private_key_x509 = PEM_read_bio_PrivateKey(bio, NULL, NULL, NULL);
+            assert (private_key_x509 );
+
+            binary_properties[0] = hash_c2;
+            binary_properties[1] = challenge2;
+            binary_properties[2] = dh2;
+            binary_properties[3] = challenge1;
+            binary_properties[4] = dh1;
+            binary_properties[5] = hash_c1;
+
+            if (create_signature_for_test(private_key_x509, binary_properties, HANDSHAKE_SIGNATURE_SIZE , &sign, &signlen, &exception) != DDS_SECURITY_VALIDATION_OK)
+            {
+                printf("Exception: %s\n", exception.message);
+            }
+            set_binary_property_value(signature, "signature", sign, (uint32_t ) signlen);
+
+            ddsrt_free(sign);
+            EVP_PKEY_free(private_key_x509);
+            BIO_free(bio);
+        }
+
+        token->class_id = ddsrt_strdup(AUTH_HANDSHAKE_REPLY_TOKEN_CLASS_ID);
+        token->binary_properties._length = token->binary_properties._maximum = 12;
+        token->binary_properties._buffer = tokens;
+        break;
+
+    case HANDSHAKE_FINAL:
+        tokens = DDS_Security_BinaryPropertySeq_allocbuf(7);
+        idx = 0;
+        signature = &tokens[idx++];
+        hash_c1 = &tokens[idx++];
+        challenge1 = &tokens[idx++];
+        dh1 = &tokens[idx++];
+        challenge2 = &tokens[idx++];
+        dh2 = &tokens[idx++];
+        hash_c2 = &tokens[idx++];
+
+        CU_ASSERT(hash1_from_request != NULL);
+        CU_ASSERT(hash2_from_reply != NULL);
+
+        set_binary_property_value(hash_c1, "hash_c1", hash1_from_request->value._buffer, hash1_from_request->value._length);
+        set_binary_property_value(hash_c2, "hash_c2", hash2_from_reply->value._buffer, hash2_from_reply->value._length);
+
+        printf("process: %s\n", hash_c1->name);
+
+        /* Set the challenge in challenge1 property */
+        if (challengeData) {
+          set_binary_property_value(challenge1, "challenge1", challengeData, challengeDataSize);
+        } else {
+          set_binary_property_value(challenge1, "challenge1x", challenge2->value._buffer, challenge2->value._length);
+        }
+
+        /* Set the challenge in challenge2 property */
+        if (challengeData2) {
+           set_binary_property_value(challenge2, "challenge2", challengeData2, challengeDataSize2);
+        } else {
+           set_binary_property_value(challenge2, "challenge2x", challenge2->value._buffer, challenge2->value._length);
+        }
+
+
+        /* Set the DH public key associated with the local participant in dh1 property */
+        if (diffie_hellman1) {
+          set_binary_property_value(dh1, "dh1", diffie_hellman1->data, diffie_hellman1->length);
+        } else {
+          set_binary_property_string(dh1, "dh1x", "rubbish");
+        }
+
+        /* Set the DH public key associated with the local participant in dh2 property */
+        if (diffie_hellman2) {
+          set_binary_property_value(dh2, "dh2", diffie_hellman2->data, diffie_hellman2->length);
+        } else {
+          set_binary_property_string(dh2, "dh2x", "rubbish");
+        }
+
+        /* Calculate the signature */
+        {
+            BIO *bio;
+            EVP_PKEY *private_key_x509;
+            unsigned char *sign;
+            size_t signlen;
+            const DDS_Security_BinaryProperty_t * binary_properties[ HANDSHAKE_SIGNATURE_SIZE ];
+
+            /* load certificate in buffer */
+            bio = BIO_new_mem_buf((const char *) remote_private_key, -1);
+            assert( bio );
+            private_key_x509 = PEM_read_bio_PrivateKey(bio, NULL, NULL, NULL);
+            assert (private_key_x509 );
+
+            binary_properties[0] = hash_c1;
+            binary_properties[1] = challenge1;
+            binary_properties[2] = dh1;
+            binary_properties[3] = challenge2;
+            binary_properties[4] = dh2;
+            binary_properties[5] = hash_c2;
+
+            if (create_signature_for_test(private_key_x509, binary_properties, HANDSHAKE_SIGNATURE_SIZE, &sign, &signlen, &exception) != DDS_SECURITY_VALIDATION_OK)
+            {
+                printf("Exception: %s\n", exception.message);
+            }
+            set_binary_property_value(signature, "signature", sign, (uint32_t) signlen);
+
+            ddsrt_free(sign);
+            EVP_PKEY_free(private_key_x509);
+            BIO_free(bio);
+        }
+        token->class_id = ddsrt_strdup(AUTH_HANDSHAKE_FINAL_TOKEN_CLASS_ID);
+        token->binary_properties._length = token->binary_properties._maximum = 7;
+        token->binary_properties._buffer = tokens;
+        break;
+    }
+}
+
+static void
+fill_handshake_message_token_default(
+    DDS_Security_HandshakeMessageToken *token,
+    DDS_Security_ParticipantBuiltinTopicData *pdata,
+    const unsigned char *challengeData,
+    unsigned int challengeDataSize)
+{
+    fill_handshake_message_token(
+            token, pdata, remote_identity_certificate,
+            AUTH_DSIGN_ALGO_RSA_NAME, AUTH_KAGREE_ALGO_RSA_NAME,
+            &dh_modp_pub_key, challengeData, challengeDataSize, NULL, NULL, 0, NULL, NULL, HANDSHAKE_REQUEST);
+}
+
+static void
+handshake_message_deinit(
+    DDS_Security_HandshakeMessageToken *token)
+{
+    DDS_Security_DataHolder_deinit(token);
+}
+
+static bool
+validate_handshake_token(
+    DDS_Security_HandshakeMessageToken *token,
+    const DDS_Security_OctetSeq *challenge1,
+    const DDS_Security_OctetSeq *challenge2,
+    HandshakeStep_t token_type)
+{
+    const DDS_Security_BinaryProperty_t *property;
+    const char * class_id;
+
+    switch (token_type)
+    {
+    case HANDSHAKE_REQUEST:
+        class_id = AUTH_HANDSHAKE_REQUEST_TOKEN_CLASS_ID;
+        break;
+    case HANDSHAKE_REPLY:
+        class_id = AUTH_HANDSHAKE_REPLY_TOKEN_CLASS_ID;
+        break;
+    case HANDSHAKE_FINAL:
+        class_id = AUTH_HANDSHAKE_FINAL_TOKEN_CLASS_ID;
+        break;
+    default:
+        class_id = NULL;
+        CU_FAIL("HandshakeMessageToken invalid token type");
+    }
+
+    if (!token->class_id || strcmp(token->class_id, class_id) != 0) {
+        CU_FAIL("HandshakeMessageToken incorrect class_id");
+    } else if ((property = find_binary_property(token, "hash_c2")) == NULL) {
+         CU_FAIL("HandshakeMessageToken incorrect property 'hash_c2' not found");
+    } else if ((property = find_binary_property(token, "dh2")) == NULL) {
+        CU_FAIL("HandshakeMessageToken incorrect property 'dh2' not found");
+    } else if ((property = find_binary_property(token, "hash_c1")) == NULL) {
+        CU_FAIL("HandshakeMessageToken incorrect property 'hash_c1' not found");
+    } else if ((property = find_binary_property(token, "dh1")) == NULL) {
+        CU_FAIL("HandshakeMessageToken incorrect property 'dh1' not found");
+    } else if ((property = find_binary_property(token, "challenge1")) == NULL) {
+        CU_FAIL("HandshakeMessageToken incorrect property 'challenge1' not found");
+    } else if (challenge1 && compare_octet_seq(challenge1, &property->value) != 0) {
+        CU_FAIL("HandshakeMessageToken incorrect property 'challenge1' incorrect value");
+    } else if ((property = find_binary_property(token, "challenge2")) == NULL) {
+        CU_FAIL("HandshakeMessageToken incorrect property 'challenge2' not found");
+    } else if (challenge2 && compare_octet_seq(challenge2, &property->value) != 0) {
+        CU_FAIL("HandshakeMessageToken incorrect property 'challenge2' incorrect value");
+    } else {
+        return true;
+    }
+
+    return false;
+}
+
+CU_Test(ddssec_builtin_process_handshake,happy_day_after_request )
+{
+    DDS_Security_ValidationResult_t result;
+    DDS_Security_HandshakeHandle handshake_handle;
+    DDS_Security_HandshakeMessageToken handshake_token_in = DDS_SECURITY_TOKEN_INIT;
+    DDS_Security_HandshakeMessageToken handshake_reply_token_in = DDS_SECURITY_TOKEN_INIT;
+    DDS_Security_HandshakeMessageToken handshake_token_out = DDS_SECURITY_TOKEN_INIT;
+    DDS_Security_HandshakeMessageToken handshake_reply_token_out = DDS_SECURITY_TOKEN_INIT;
+    DDS_Security_SecurityException exception = {NULL, 0, 0};
+    DDS_Security_boolean success;
+    const DDS_Security_BinaryProperty_t *hash1_sentrequest;
+    const DDS_Security_BinaryProperty_t *dh1;
+    const DDS_Security_BinaryProperty_t *challenge1_glb;
+    struct octet_seq dh1_pub_key;
+
+    CU_ASSERT_FATAL (auth != NULL);
+    CU_ASSERT_FATAL (local_identity_handle != DDS_SECURITY_HANDLE_NIL);
+    CU_ASSERT_FATAL (remote_identity_handle1 != DDS_SECURITY_HANDLE_NIL);
+    CU_ASSERT_FATAL (remote_identity_handle2 != DDS_SECURITY_HANDLE_NIL);
+    CU_ASSERT_FATAL (auth->begin_handshake_request != NULL);
+    CU_ASSERT_FATAL (auth->process_handshake != NULL);
+
+    result = auth->begin_handshake_request(
+                    auth,
+                    &handshake_handle,
+                    &handshake_token_out,
+                    local_identity_handle,
+                    remote_identity_handle2,
+                    &serialized_participant_data,
+                    &exception);
+
+    if (result != DDS_SECURITY_VALIDATION_PENDING_HANDSHAKE_MESSAGE) {
+        printf("begin_handshake_request failed: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+
+    /* get challenge 1 from the message */
+    challenge1_glb = find_binary_property(&handshake_token_out, "challenge1");
+
+    /*Get DH1 value */
+    dh1 = find_binary_property(&handshake_token_out, "dh1");
+
+    hash1_sentrequest = find_binary_property(&handshake_token_out, "hash_c1");
+
+    CU_ASSERT_FATAL(dh1 != NULL);
+    CU_ASSERT_FATAL(dh1->value._length > 0);
+    CU_ASSERT_FATAL(dh1->value._buffer != NULL);
+
+    dh1_pub_key.data = dh1->value._buffer;
+    dh1_pub_key.length = dh1->value._length;
+
+    /* prepare reply */
+    fill_handshake_message_token(
+        &handshake_reply_token_in, remote_participant_data2, remote_identity_certificate,
+        AUTH_DSIGN_ALGO_RSA_NAME, AUTH_KAGREE_ALGO_ECDH_NAME,
+        &dh1_pub_key, challenge1_glb->value._buffer, challenge1_glb->value._length,
+        &dh_ecdh_pub_key, challenge2_predefined_glb->value._buffer, challenge2_predefined_glb->value._length, hash1_sentrequest, NULL, HANDSHAKE_REPLY);
+
+    reset_exception(&exception);
+
+    result = auth->process_handshake(
+                        auth,
+                        &handshake_reply_token_out,
+                        &handshake_reply_token_in,
+                        handshake_handle,
+                        &exception);
+
+    CU_ASSERT_FATAL(result == DDS_SECURITY_VALIDATION_OK_FINAL_MESSAGE);
+    CU_ASSERT(handshake_handle != DDS_SECURITY_HANDLE_NIL);
+    CU_ASSERT(validate_handshake_token(&handshake_reply_token_out, &challenge1_glb->value, &challenge2_predefined_glb->value, HANDSHAKE_FINAL));
+
+    CU_ASSERT( check_shared_secret(auth, 1, dh1, dh_ecdh_key, handshake_handle)== 0);
+
+    success= auth->return_handshake_handle(auth, handshake_handle, &exception);
+    CU_ASSERT_TRUE (success);
+
+    reset_exception(&exception);
+
+    handshake_message_deinit(&handshake_token_in);
+    handshake_message_deinit(&handshake_token_out);
+    handshake_message_deinit(&handshake_reply_token_in);
+    handshake_message_deinit(&handshake_reply_token_out);
+}
+
+CU_Test(ddssec_builtin_process_handshake,happy_day_after_reply )
+{
+    DDS_Security_ValidationResult_t result;
+    DDS_Security_HandshakeHandle handshake_handle;
+    DDS_Security_HandshakeMessageToken handshake_token_in = DDS_SECURITY_TOKEN_INIT;
+    DDS_Security_HandshakeMessageToken handshake_final_token_in = DDS_SECURITY_TOKEN_INIT;
+    DDS_Security_HandshakeMessageToken handshake_token_out = DDS_SECURITY_TOKEN_INIT;
+    DDS_Security_HandshakeMessageToken handshake_final_token_out = DDS_SECURITY_TOKEN_INIT;
+    DDS_Security_SecurityException exception = {NULL, 0, 0};
+    DDS_Security_boolean success;
+    const DDS_Security_BinaryProperty_t *hash1_sentrequest;
+    const DDS_Security_BinaryProperty_t *hash2_sentreply;
+    const DDS_Security_BinaryProperty_t *challenge2_glb;
+    const DDS_Security_BinaryProperty_t *dh2;
+    struct octet_seq dh2_pub_key;
+
+    CU_ASSERT_FATAL (auth->process_handshake != NULL);
+
+    CU_ASSERT_FATAL (auth != NULL);
+    CU_ASSERT_FATAL (local_identity_handle != DDS_SECURITY_HANDLE_NIL);
+    CU_ASSERT_FATAL (remote_identity_handle1 != DDS_SECURITY_HANDLE_NIL);
+    CU_ASSERT_FATAL (remote_identity_handle2 != DDS_SECURITY_HANDLE_NIL);
+    CU_ASSERT_FATAL (auth->begin_handshake_reply != NULL);
+
+    fill_handshake_message_token_default(&handshake_token_in, remote_participant_data1, challenge1_predefined_glb->value._buffer, challenge1_predefined_glb->value._length);
+
+    result = auth->begin_handshake_reply(
+                    auth,
+                    &handshake_handle,
+                    &handshake_token_out,
+                    &handshake_token_in,
+                    remote_identity_handle2,
+                    local_identity_handle,
+                    &serialized_participant_data,
+                    &exception);
+
+    if (result != DDS_SECURITY_VALIDATION_PENDING_HANDSHAKE_MESSAGE) {
+        printf("begin_handshake_reply failed: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+
+    CU_ASSERT_FATAL(result == DDS_SECURITY_VALIDATION_PENDING_HANDSHAKE_MESSAGE);
+    CU_ASSERT(handshake_handle != DDS_SECURITY_HANDLE_NIL);
+    CU_ASSERT(validate_handshake_token(&handshake_token_out, &challenge1_predefined_glb->value, NULL, HANDSHAKE_REPLY));
+
+    hash1_sentrequest = find_binary_property(&handshake_token_out, "hash_c1");
+    hash2_sentreply = find_binary_property(&handshake_token_out, "hash_c2");
+
+    /*Get DH2 value */
+    dh2 = find_binary_property(&handshake_token_out, "dh2");
+
+    /* get challenge 2 from the message */
+    challenge2_glb = find_binary_property(&handshake_token_out, "challenge2");
+
+    reset_exception(&exception);
+
+    /* prepare final */
+    dh2_pub_key.data = dh2->value._buffer;
+    dh2_pub_key.length = dh2->value._length;
+
+    fill_handshake_message_token(
+                &handshake_final_token_in, NULL, remote_identity_certificate,
+                AUTH_DSIGN_ALGO_RSA_NAME, AUTH_KAGREE_ALGO_ECDH_NAME,
+                &dh_modp_pub_key, challenge1_predefined_glb->value._buffer, challenge1_predefined_glb->value._length,
+                &dh2_pub_key, challenge2_glb->value._buffer, challenge2_glb->value._length, hash1_sentrequest, hash2_sentreply, HANDSHAKE_FINAL);
+
+    result = auth->process_handshake(
+                        auth,
+                        &handshake_final_token_out,
+                        &handshake_final_token_in,
+                        handshake_handle,
+                        &exception);
+
+
+    CU_ASSERT_FATAL(result == DDS_SECURITY_VALIDATION_OK);
+
+    CU_ASSERT( check_shared_secret(auth, 0, dh2, dh_modp_key, handshake_handle)== 0);
+
+    success= auth->return_handshake_handle(auth, handshake_handle, &exception);
+    CU_ASSERT_TRUE (success);
+
+    if (!success) {
+        printf("return_handshake_handle failed: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+    reset_exception(&exception);
+
+    handshake_message_deinit(&handshake_token_in);
+    handshake_message_deinit(&handshake_token_out);
+    handshake_message_deinit(&handshake_final_token_in);
+    handshake_message_deinit(&handshake_final_token_out);
+}
+
+CU_Test(ddssec_builtin_process_handshake,invalid_arguments )
+{
+
+    DDS_Security_ValidationResult_t result;
+    DDS_Security_HandshakeHandle handshake_handle;
+    DDS_Security_HandshakeMessageToken handshake_token_in = DDS_SECURITY_TOKEN_INIT;
+    DDS_Security_HandshakeMessageToken handshake_final_token_in = DDS_SECURITY_TOKEN_INIT;
+    DDS_Security_HandshakeMessageToken handshake_token_out = DDS_SECURITY_TOKEN_INIT;
+    DDS_Security_SecurityException exception = {NULL, 0, 0};
+    const DDS_Security_BinaryProperty_t *hash1_sentrequest;
+    const DDS_Security_BinaryProperty_t *hash2_sentreply;
+    const DDS_Security_BinaryProperty_t *challenge2_glb;
+    const DDS_Security_BinaryProperty_t *dh2;
+    struct octet_seq dh2_pub_key;
+    DDS_Security_boolean success;
+
+    CU_ASSERT_FATAL (auth->process_handshake != NULL);
+
+    CU_ASSERT_FATAL (auth != NULL);
+    CU_ASSERT_FATAL (local_identity_handle != DDS_SECURITY_HANDLE_NIL);
+    CU_ASSERT_FATAL (remote_identity_handle1 != DDS_SECURITY_HANDLE_NIL);
+    CU_ASSERT_FATAL (remote_identity_handle2 != DDS_SECURITY_HANDLE_NIL);
+    CU_ASSERT_FATAL (auth->begin_handshake_reply != NULL);
+
+    fill_handshake_message_token_default(&handshake_token_in, remote_participant_data1, challenge1_predefined_glb->value._buffer, challenge1_predefined_glb->value._length);
+
+    result = auth->begin_handshake_reply(
+                    auth,
+                    &handshake_handle,
+                    &handshake_token_out,
+                    &handshake_token_in,
+                    remote_identity_handle2,
+                    local_identity_handle,
+                    &serialized_participant_data,
+                    &exception);
+
+    if (result != DDS_SECURITY_VALIDATION_PENDING_HANDSHAKE_MESSAGE) {
+        printf("begin_handshake_reply failed: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+
+    CU_ASSERT_FATAL(result == DDS_SECURITY_VALIDATION_PENDING_HANDSHAKE_MESSAGE);
+    CU_ASSERT(handshake_handle != DDS_SECURITY_HANDLE_NIL);
+    CU_ASSERT(validate_handshake_token(&handshake_token_out, &challenge1_predefined_glb->value, NULL, HANDSHAKE_REPLY));
+
+    /*Get DH2 value */
+    dh2 = find_binary_property(&handshake_token_out, "dh2");
+
+    hash1_sentrequest = find_binary_property(&handshake_token_out, "hash_c1");
+    hash2_sentreply = find_binary_property(&handshake_token_out, "hash_c2");
+
+    /* get challenge 2 from the message */
+    challenge2_glb = find_binary_property(&handshake_token_out, "challenge2");
+
+    reset_exception(&exception);
+
+    /* prepare final */
+    dh2_pub_key.data = dh2->value._buffer;
+    dh2_pub_key.length = dh2->value._length;
+
+    fill_handshake_message_token(
+                &handshake_final_token_in, NULL, remote_identity_certificate,
+                AUTH_DSIGN_ALGO_RSA_NAME, AUTH_KAGREE_ALGO_RSA_NAME,
+                &dh_modp_pub_key, challenge1_predefined_glb->value._buffer, challenge1_predefined_glb->value._length,
+                &dh2_pub_key, challenge2_glb->value._buffer, challenge2_glb->value._length,
+                hash1_sentrequest, hash2_sentreply, HANDSHAKE_FINAL);
+
+
+    result = auth->process_handshake(
+                        auth,
+                        NULL,
+                        &handshake_final_token_in,
+                        handshake_handle,
+                        &exception);
+
+    CU_ASSERT (result == DDS_SECURITY_VALIDATION_FAILED);
+    CU_ASSERT (exception.minor_code != 0);
+    CU_ASSERT (exception.message != NULL);
+    reset_exception(&exception);
+
+    result = auth->process_handshake(
+                        auth,
+                        &handshake_token_out,
+                        NULL,
+                        handshake_handle,
+                        &exception);
+
+    CU_ASSERT (result == DDS_SECURITY_VALIDATION_FAILED);
+    CU_ASSERT (exception.minor_code != 0);
+    CU_ASSERT (exception.message != NULL);
+    reset_exception(&exception);
+
+    result = auth->process_handshake(
+                        auth,
+                        &handshake_token_out,
+                        &handshake_final_token_in,
+                        0,
+                        &exception);
+
+    CU_ASSERT (result == DDS_SECURITY_VALIDATION_FAILED);
+    CU_ASSERT (exception.minor_code != 0);
+    CU_ASSERT (exception.message != NULL);
+    reset_exception(&exception);
+
+    success= auth->return_handshake_handle(auth, handshake_handle, &exception);
+    CU_ASSERT_TRUE (success);
+
+    handshake_message_deinit(&handshake_token_in);
+    handshake_message_deinit(&handshake_token_out);
+    handshake_message_deinit(&handshake_final_token_in);
+}
+
+
+CU_Test(ddssec_builtin_process_handshake,invalid_certificate )
+{
+    DDS_Security_ValidationResult_t result;
+    DDS_Security_HandshakeHandle handshake_handle;
+    DDS_Security_HandshakeMessageToken handshake_token_in = DDS_SECURITY_TOKEN_INIT;
+    DDS_Security_HandshakeMessageToken handshake_reply_token_in = DDS_SECURITY_TOKEN_INIT;
+    DDS_Security_HandshakeMessageToken handshake_token_out = DDS_SECURITY_TOKEN_INIT;
+    DDS_Security_HandshakeMessageToken handshake_reply_token_out = DDS_SECURITY_TOKEN_INIT;
+    DDS_Security_SecurityException exception = {NULL, 0, 0};
+    const DDS_Security_BinaryProperty_t *hash1_sentrequest;
+    const DDS_Security_BinaryProperty_t *challenge1_glb;
+    const DDS_Security_BinaryProperty_t *dh1;
+    struct octet_seq dh1_pub_key;
+    DDS_Security_boolean success;
+
+    CU_ASSERT_FATAL (auth != NULL);
+    CU_ASSERT_FATAL (local_identity_handle != DDS_SECURITY_HANDLE_NIL);
+    CU_ASSERT_FATAL (remote_identity_handle1 != DDS_SECURITY_HANDLE_NIL);
+    CU_ASSERT_FATAL (remote_identity_handle2 != DDS_SECURITY_HANDLE_NIL);
+    CU_ASSERT_FATAL (auth->begin_handshake_request != NULL);
+    CU_ASSERT_FATAL (auth->process_handshake != NULL);
+
+    result = auth->begin_handshake_request(
+                   auth,
+                   &handshake_handle,
+                   &handshake_token_out,
+                   local_identity_handle,
+                   remote_identity_handle2,
+                   &serialized_participant_data,
+                   &exception);
+
+    if (result != DDS_SECURITY_VALIDATION_PENDING_HANDSHAKE_MESSAGE) {
+       printf("begin_handshake_request failed: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+
+    CU_ASSERT_FATAL(result == DDS_SECURITY_VALIDATION_PENDING_HANDSHAKE_MESSAGE);
+
+    /* get challenge 1 from the message */
+    challenge1_glb = find_binary_property(&handshake_token_out, "challenge1");
+
+    /*Get DH1 value */
+    dh1 = find_binary_property(&handshake_token_out, "dh1");
+
+    hash1_sentrequest = find_binary_property(&handshake_token_out, "hash_c1");
+
+    CU_ASSERT_FATAL(dh1 != NULL);
+    CU_ASSERT_FATAL(dh1->value._length > 0);
+    CU_ASSERT_FATAL(dh1->value._buffer != NULL);
+
+    /* prepare reply */
+    dh1_pub_key.data = dh1->value._buffer;
+    dh1_pub_key.length = dh1->value._length;
+
+    fill_handshake_message_token(
+       &handshake_reply_token_in, remote_participant_data2, unrelated_identity,
+       AUTH_DSIGN_ALGO_RSA_NAME, AUTH_KAGREE_ALGO_ECDH_NAME,
+       &dh1_pub_key, challenge1_glb->value._buffer, challenge1_glb->value._length,
+       &dh_ecdh_pub_key, challenge2_predefined_glb->value._buffer, challenge2_predefined_glb->value._length,
+       hash1_sentrequest, NULL, HANDSHAKE_REPLY);
+
+    reset_exception(&exception);
+
+    result = auth->process_handshake(
+                       auth,
+                       &handshake_reply_token_out,
+                       &handshake_reply_token_in,
+                       handshake_handle,
+                       &exception);
+
+    CU_ASSERT_FATAL(result == DDS_SECURITY_VALIDATION_FAILED);
+    CU_ASSERT (exception.code != 0);
+    CU_ASSERT (exception.message != NULL);
+
+    reset_exception(&exception);
+
+    success= auth->return_handshake_handle(auth, handshake_handle, &exception);
+    CU_ASSERT_TRUE (success);
+
+    reset_exception(&exception);
+
+    handshake_message_deinit(&handshake_token_in);
+    handshake_message_deinit(&handshake_token_out);
+    handshake_message_deinit(&handshake_reply_token_in);
+}
+
+CU_Test(ddssec_builtin_process_handshake,invalid_dsign_algo )
+{
+    DDS_Security_ValidationResult_t result;
+    DDS_Security_HandshakeHandle handshake_handle;
+    DDS_Security_HandshakeMessageToken handshake_token_in = DDS_SECURITY_TOKEN_INIT;
+    DDS_Security_HandshakeMessageToken handshake_reply_token_in = DDS_SECURITY_TOKEN_INIT;
+    DDS_Security_HandshakeMessageToken handshake_token_out = DDS_SECURITY_TOKEN_INIT;
+    DDS_Security_HandshakeMessageToken handshake_reply_token_out = DDS_SECURITY_TOKEN_INIT;
+    DDS_Security_SecurityException exception = {NULL, 0, 0};
+    const DDS_Security_BinaryProperty_t *hash1_sentrequest;
+    const DDS_Security_BinaryProperty_t *challenge1_glb;
+    const DDS_Security_BinaryProperty_t *dh1;
+    struct octet_seq dh1_pub_key;
+
+    CU_ASSERT_FATAL (auth != NULL);
+    CU_ASSERT_FATAL (local_identity_handle != DDS_SECURITY_HANDLE_NIL);
+    CU_ASSERT_FATAL (remote_identity_handle1 != DDS_SECURITY_HANDLE_NIL);
+    CU_ASSERT_FATAL (remote_identity_handle2 != DDS_SECURITY_HANDLE_NIL);
+    CU_ASSERT_FATAL (auth->begin_handshake_request != NULL);
+    CU_ASSERT_FATAL (auth->process_handshake != NULL);
+
+    result = auth->begin_handshake_request(
+                   auth,
+                   &handshake_handle,
+                   &handshake_token_out,
+                   local_identity_handle,
+                   remote_identity_handle2,
+                   &serialized_participant_data,
+                   &exception);
+
+    if (result != DDS_SECURITY_VALIDATION_PENDING_HANDSHAKE_MESSAGE) {
+       printf("begin_handshake_request failed: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+
+    CU_ASSERT_FATAL(result == DDS_SECURITY_VALIDATION_PENDING_HANDSHAKE_MESSAGE);
+
+    /* get challenge 1 from the message */
+    challenge1_glb = find_binary_property(&handshake_token_out, "challenge1");
+
+    /*Get DH1 value */
+    dh1 = find_binary_property(&handshake_token_out, "dh1");
+
+    hash1_sentrequest = find_binary_property(&handshake_token_out, "hash_c1");
+
+    CU_ASSERT_FATAL(dh1 != NULL);
+    CU_ASSERT_FATAL(dh1->value._length > 0);
+    CU_ASSERT_FATAL(dh1->value._buffer != NULL);
+
+    /* prepare reply */
+    dh1_pub_key.data = dh1->value._buffer;
+    dh1_pub_key.length = dh1->value._length;
+
+    fill_handshake_message_token(
+       &handshake_reply_token_in, remote_participant_data2, remote_identity_certificate,
+       "RSASSA-PSS-SHA128", AUTH_KAGREE_ALGO_RSA_NAME,
+       &dh1_pub_key, challenge1_glb->value._buffer, challenge1_glb->value._length,
+       &dh_modp_pub_key, challenge2_predefined_glb->value._buffer, challenge2_predefined_glb->value._length,
+       hash1_sentrequest, NULL, HANDSHAKE_REPLY);
+
+    reset_exception(&exception);
+
+    result = auth->process_handshake(
+                       auth,
+                       &handshake_reply_token_out,
+                       &handshake_reply_token_in,
+                       handshake_handle,
+                       &exception);
+
+    CU_ASSERT_FATAL(result == DDS_SECURITY_VALIDATION_FAILED);
+    CU_ASSERT (exception.code != 0);
+    CU_ASSERT (exception.message != NULL);
+
+    reset_exception(&exception);
+    handshake_message_deinit(&handshake_token_in);
+    handshake_message_deinit(&handshake_token_out);
+    handshake_message_deinit(&handshake_reply_token_in);
+}
+
+CU_Test(ddssec_builtin_process_handshake,invalid_kagree_algo )
+{
+    DDS_Security_ValidationResult_t result;
+    DDS_Security_HandshakeHandle handshake_handle;
+    DDS_Security_HandshakeMessageToken handshake_token_in = DDS_SECURITY_TOKEN_INIT;
+    DDS_Security_HandshakeMessageToken handshake_reply_token_in = DDS_SECURITY_TOKEN_INIT;
+    DDS_Security_HandshakeMessageToken handshake_token_out = DDS_SECURITY_TOKEN_INIT;
+    DDS_Security_HandshakeMessageToken handshake_reply_token_out = DDS_SECURITY_TOKEN_INIT;
+    DDS_Security_SecurityException exception = {NULL, 0, 0};
+    const DDS_Security_BinaryProperty_t *hash1_sentrequest;
+    const DDS_Security_BinaryProperty_t *challenge1_glb;
+    const DDS_Security_BinaryProperty_t *dh1;
+    struct octet_seq dh1_pub_key;
+
+    CU_ASSERT_FATAL (auth != NULL);
+    CU_ASSERT_FATAL (local_identity_handle != DDS_SECURITY_HANDLE_NIL);
+    CU_ASSERT_FATAL (remote_identity_handle1 != DDS_SECURITY_HANDLE_NIL);
+    CU_ASSERT_FATAL (remote_identity_handle2 != DDS_SECURITY_HANDLE_NIL);
+    CU_ASSERT_FATAL (auth->begin_handshake_request != NULL);
+    CU_ASSERT_FATAL (auth->process_handshake != NULL);
+
+    result = auth->begin_handshake_request(
+                   auth,
+                   &handshake_handle,
+                   &handshake_token_out,
+                   local_identity_handle,
+                   remote_identity_handle2,
+                   &serialized_participant_data,
+                   &exception);
+
+    if (result != DDS_SECURITY_VALIDATION_PENDING_HANDSHAKE_MESSAGE) {
+       printf("begin_handshake_request failed: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+
+    CU_ASSERT_FATAL(result == DDS_SECURITY_VALIDATION_PENDING_HANDSHAKE_MESSAGE);
+
+    /* get challenge 1 from the message */
+    challenge1_glb = find_binary_property(&handshake_token_out, "challenge1");
+
+    /*Get DH1 value */
+    dh1 = find_binary_property(&handshake_token_out, "dh1");
+
+    hash1_sentrequest = find_binary_property(&handshake_token_out, "hash_c1");
+
+    CU_ASSERT_FATAL(dh1 != NULL);
+    CU_ASSERT_FATAL(dh1->value._length > 0);
+    CU_ASSERT_FATAL(dh1->value._buffer != NULL);
+
+    /* prepare reply */
+    dh1_pub_key.data = dh1->value._buffer;
+    dh1_pub_key.length = dh1->value._length;
+
+    fill_handshake_message_token(
+       &handshake_reply_token_in, remote_participant_data2, remote_identity_certificate,
+       AUTH_DSIGN_ALGO_RSA_NAME, "DH+MODP-2048-128",
+       &dh1_pub_key, challenge1_glb->value._buffer, challenge1_glb->value._length,
+       &dh_modp_pub_key,  challenge2_predefined_glb->value._buffer, challenge2_predefined_glb->value._length,
+       hash1_sentrequest, NULL, HANDSHAKE_REPLY);
+
+    reset_exception(&exception);
+
+    result = auth->process_handshake(
+                       auth,
+                       &handshake_reply_token_out,
+                       &handshake_reply_token_in,
+                       handshake_handle,
+                       &exception);
+
+    CU_ASSERT_FATAL(result == DDS_SECURITY_VALIDATION_FAILED);
+    CU_ASSERT (exception.code != 0);
+    CU_ASSERT (exception.message != NULL);
+
+    reset_exception(&exception);
+    handshake_message_deinit(&handshake_token_in);
+    handshake_message_deinit(&handshake_token_out);
+    handshake_message_deinit(&handshake_reply_token_in);
+}
+
+CU_Test(ddssec_builtin_process_handshake,invalid_diffie_hellman )
+{
+    DDS_Security_ValidationResult_t result;
+    DDS_Security_HandshakeHandle handshake_handle;
+    DDS_Security_HandshakeMessageToken handshake_token_in = DDS_SECURITY_TOKEN_INIT;
+    DDS_Security_HandshakeMessageToken handshake_reply_token_in = DDS_SECURITY_TOKEN_INIT;
+    DDS_Security_HandshakeMessageToken handshake_token_out = DDS_SECURITY_TOKEN_INIT;
+    DDS_Security_HandshakeMessageToken handshake_reply_token_out = DDS_SECURITY_TOKEN_INIT;
+    DDS_Security_SecurityException exception = {NULL, 0, 0};
+    const DDS_Security_BinaryProperty_t *hash1_sentrequest;
+    const DDS_Security_BinaryProperty_t *challenge1_glb;
+    const DDS_Security_BinaryProperty_t *dh1;
+
+    CU_ASSERT_FATAL (auth != NULL);
+    CU_ASSERT_FATAL (local_identity_handle != DDS_SECURITY_HANDLE_NIL);
+    CU_ASSERT_FATAL (remote_identity_handle1 != DDS_SECURITY_HANDLE_NIL);
+    CU_ASSERT_FATAL (remote_identity_handle2 != DDS_SECURITY_HANDLE_NIL);
+    CU_ASSERT_FATAL (auth->begin_handshake_request != NULL);
+    CU_ASSERT_FATAL (auth->process_handshake != NULL);
+
+    result = auth->begin_handshake_request(
+                   auth,
+                   &handshake_handle,
+                   &handshake_token_out,
+                   local_identity_handle,
+                   remote_identity_handle2,
+                   &serialized_participant_data,
+                   &exception);
+
+    if (result != DDS_SECURITY_VALIDATION_PENDING_HANDSHAKE_MESSAGE) {
+       printf("begin_handshake_request failed: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+
+    CU_ASSERT_FATAL(result == DDS_SECURITY_VALIDATION_PENDING_HANDSHAKE_MESSAGE);
+
+    /* get challenge 1 from the message */
+    challenge1_glb = find_binary_property(&handshake_token_out, "challenge1");
+
+    /*Get DH1 value */
+    dh1 = find_binary_property(&handshake_token_out, "dh1");
+
+    hash1_sentrequest = find_binary_property(&handshake_token_out, "hash_c1");
+
+    CU_ASSERT_FATAL(dh1 != NULL);
+    CU_ASSERT_FATAL(dh1->value._length > 0);
+    CU_ASSERT_FATAL(dh1->value._buffer != NULL);
+
+    /* prepare reply */
+    fill_handshake_message_token(
+       &handshake_reply_token_in, remote_participant_data2, remote_identity_certificate,
+       AUTH_DSIGN_ALGO_RSA_NAME, AUTH_KAGREE_ALGO_RSA_NAME,
+       &invalid_dh_pub_key, challenge1_glb->value._buffer, challenge1_glb->value._length,
+       &dh_modp_pub_key, challenge2_predefined_glb->value._buffer, challenge2_predefined_glb->value._length,
+       hash1_sentrequest, NULL, HANDSHAKE_REPLY);
+
+    reset_exception(&exception);
+
+    result = auth->process_handshake(
+                       auth,
+                       &handshake_reply_token_out,
+                       &handshake_reply_token_in,
+                       handshake_handle,
+                       &exception);
+
+    CU_ASSERT_FATAL(result == DDS_SECURITY_VALIDATION_FAILED);
+    CU_ASSERT (exception.code != 0);
+    CU_ASSERT (exception.message != NULL);
+
+    reset_exception(&exception);
+    handshake_message_deinit(&handshake_token_in);
+    handshake_message_deinit(&handshake_token_out);
+    handshake_message_deinit(&handshake_reply_token_in);
+}
+
+
+CU_Test(ddssec_builtin_process_handshake,return_handle)
+{
+    DDS_Security_ValidationResult_t result;
+    DDS_Security_HandshakeHandle handshake_handle;
+    DDS_Security_HandshakeMessageToken handshake_token_in = DDS_SECURITY_TOKEN_INIT;
+    DDS_Security_HandshakeMessageToken handshake_token_out = DDS_SECURITY_TOKEN_INIT;
+    DDS_Security_SecurityException exception = {NULL, 0, 0};
+    DDS_Security_boolean success;
+
+    CU_ASSERT_FATAL (auth != NULL);
+    CU_ASSERT_FATAL (local_identity_handle != DDS_SECURITY_HANDLE_NIL);
+    CU_ASSERT_FATAL (remote_identity_handle1 != DDS_SECURITY_HANDLE_NIL);
+    CU_ASSERT_FATAL (remote_identity_handle2 != DDS_SECURITY_HANDLE_NIL);
+    CU_ASSERT_FATAL (auth->begin_handshake_reply != NULL);
+
+    fill_handshake_message_token_default(&handshake_token_in, remote_participant_data1, challenge1_predefined_glb->value._buffer, challenge1_predefined_glb->value._length);
+
+    result = auth->begin_handshake_reply(
+                    auth,
+                    &handshake_handle,
+                    &handshake_token_out,
+                    &handshake_token_in,
+                    remote_identity_handle1,
+                    local_identity_handle,
+                    &serialized_participant_data,
+                    &exception);
+
+    if (result != DDS_SECURITY_VALIDATION_PENDING_HANDSHAKE_MESSAGE) {
+        printf("begin_handshake_request failed: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+
+    CU_ASSERT_FATAL (result == DDS_SECURITY_VALIDATION_PENDING_HANDSHAKE_MESSAGE);
+    CU_ASSERT (handshake_handle != DDS_SECURITY_HANDLE_NIL);
+
+    reset_exception(&exception);
+
+    success = auth->return_handshake_handle(auth, handshake_handle, &exception);
+    CU_ASSERT_TRUE (success);
+
+    if (!success) {
+        printf("return_handshake_handle failed: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+    reset_exception(&exception);
+
+    success = auth->return_handshake_handle(auth, handshake_handle, &exception);
+    CU_ASSERT_FALSE (success);
+    CU_ASSERT (exception.minor_code != 0);
+    CU_ASSERT (exception.message != NULL);
+
+    if (!success) {
+        printf("return_handshake_handle failed: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+    reset_exception(&exception);
+
+    handshake_message_deinit(&handshake_token_in);
+    handshake_message_deinit(&handshake_token_out);
+}
+
+
+CU_Test(ddssec_builtin_process_handshake,extended_certificate_check )
+{
+    DDS_Security_ValidationResult_t result;
+    DDS_Security_HandshakeHandle handshake_handle;
+    DDS_Security_HandshakeMessageToken handshake_token_in = DDS_SECURITY_TOKEN_INIT;
+    DDS_Security_HandshakeMessageToken handshake_reply_token_in = DDS_SECURITY_TOKEN_INIT;
+    DDS_Security_HandshakeMessageToken handshake_token_out = DDS_SECURITY_TOKEN_INIT;
+    DDS_Security_HandshakeMessageToken handshake_reply_token_out = DDS_SECURITY_TOKEN_INIT;
+    DDS_Security_SecurityException exception = {NULL, 0, 0};
+    DDS_Security_boolean success;
+    const DDS_Security_BinaryProperty_t *hash1_sentrequest;
+    const DDS_Security_BinaryProperty_t *dh1;
+    const DDS_Security_BinaryProperty_t *challenge1_glb;
+    struct octet_seq dh1_pub_key;
+
+    release_local_identity();
+    release_remote_identities();
+
+    CU_ASSERT_FATAL( !validate_local_identity("trusted_ca_dir") );
+    CU_ASSERT_FATAL( !validate_remote_identities( remote_identity_trusted ) );
+
+    CU_ASSERT_FATAL (auth != NULL);
+    CU_ASSERT_FATAL (local_identity_handle != DDS_SECURITY_HANDLE_NIL);
+    CU_ASSERT_FATAL (remote_identity_handle1 != DDS_SECURITY_HANDLE_NIL);
+    CU_ASSERT_FATAL (remote_identity_handle2 != DDS_SECURITY_HANDLE_NIL);
+    CU_ASSERT_FATAL (auth->begin_handshake_request != NULL);
+    CU_ASSERT_FATAL (auth->process_handshake != NULL);
+
+    result = auth->begin_handshake_request(
+                    auth,
+                    &handshake_handle,
+                    &handshake_token_out,
+                    local_identity_handle,
+                    remote_identity_handle2,
+                    &serialized_participant_data,
+                    &exception);
+
+    if (result != DDS_SECURITY_VALIDATION_PENDING_HANDSHAKE_MESSAGE) {
+        printf("begin_handshake_request failed: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+
+    /* get challenge 1 from the message */
+    challenge1_glb = find_binary_property(&handshake_token_out, "challenge1");
+
+    /*Get DH1 value */
+    dh1 = find_binary_property(&handshake_token_out, "dh1");
+
+    hash1_sentrequest = find_binary_property(&handshake_token_out, "hash_c1");
+
+    CU_ASSERT_FATAL(dh1 != NULL);
+    CU_ASSERT_FATAL(dh1->value._length > 0);
+    CU_ASSERT_FATAL(dh1->value._buffer != NULL);
+
+    dh1_pub_key.data = dh1->value._buffer;
+    dh1_pub_key.length = dh1->value._length;
+
+    /* prepare reply */
+    fill_handshake_message_token(
+        &handshake_reply_token_in, remote_participant_data2, remote_identity_trusted,
+        AUTH_DSIGN_ALGO_RSA_NAME, AUTH_KAGREE_ALGO_ECDH_NAME,
+        &dh1_pub_key, challenge1_glb->value._buffer, challenge1_glb->value._length,
+        &dh_ecdh_pub_key, challenge2_predefined_glb->value._buffer, challenge2_predefined_glb->value._length, hash1_sentrequest, NULL, HANDSHAKE_REPLY);
+
+    reset_exception(&exception);
+
+    result = auth->process_handshake(
+                        auth,
+                        &handshake_reply_token_out,
+                        &handshake_reply_token_in,
+                        handshake_handle,
+                        &exception);
+
+    CU_ASSERT_FATAL(result == DDS_SECURITY_VALIDATION_OK_FINAL_MESSAGE);
+    CU_ASSERT(handshake_handle != DDS_SECURITY_HANDLE_NIL);
+    CU_ASSERT(validate_handshake_token(&handshake_reply_token_out, &challenge1_glb->value, &challenge2_predefined_glb->value, HANDSHAKE_FINAL));
+
+    CU_ASSERT( check_shared_secret(auth, 1, dh1, dh_ecdh_key, handshake_handle)== 0);
+
+    success= auth->return_handshake_handle(auth, handshake_handle, &exception);
+    CU_ASSERT_TRUE (success);
+
+    reset_exception(&exception);
+
+    handshake_message_deinit(&handshake_token_in);
+    handshake_message_deinit(&handshake_token_out);
+    handshake_message_deinit(&handshake_reply_token_in);
+    handshake_message_deinit(&handshake_reply_token_out);
+
+
+    release_local_identity();
+    release_remote_identities();
+
+    CU_ASSERT_FATAL( !validate_local_identity("trusted_ca_dir") );
+    CU_ASSERT_FATAL( !validate_remote_identities( remote_identity_trusted_expired ) );
+
+    CU_ASSERT_FATAL (auth != NULL);
+    CU_ASSERT_FATAL (local_identity_handle != DDS_SECURITY_HANDLE_NIL);
+    CU_ASSERT_FATAL (remote_identity_handle1 != DDS_SECURITY_HANDLE_NIL);
+    CU_ASSERT_FATAL (remote_identity_handle2 != DDS_SECURITY_HANDLE_NIL);
+    CU_ASSERT_FATAL (auth->begin_handshake_request != NULL);
+    CU_ASSERT_FATAL (auth->process_handshake != NULL);
+
+    result = auth->begin_handshake_request(
+                    auth,
+                    &handshake_handle,
+                    &handshake_token_out,
+                    local_identity_handle,
+                    remote_identity_handle2,
+                    &serialized_participant_data,
+                    &exception);
+
+    if (result != DDS_SECURITY_VALIDATION_PENDING_HANDSHAKE_MESSAGE) {
+        printf("begin_handshake_request failed: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+
+    /* get challenge 1 from the message */
+    challenge1_glb = find_binary_property(&handshake_token_out, "challenge1");
+
+    /*Get DH1 value */
+    dh1 = find_binary_property(&handshake_token_out, "dh1");
+
+    hash1_sentrequest = find_binary_property(&handshake_token_out, "hash_c1");
+
+    CU_ASSERT_FATAL(dh1 != NULL);
+    CU_ASSERT_FATAL(dh1->value._length > 0);
+    CU_ASSERT_FATAL(dh1->value._buffer != NULL);
+
+    dh1_pub_key.data = dh1->value._buffer;
+    dh1_pub_key.length = dh1->value._length;
+
+    /* prepare reply */
+    fill_handshake_message_token(
+        &handshake_reply_token_in, remote_participant_data2, remote_identity_trusted_expired,
+        AUTH_DSIGN_ALGO_RSA_NAME, AUTH_KAGREE_ALGO_ECDH_NAME,
+        &dh1_pub_key, challenge1_glb->value._buffer, challenge1_glb->value._length,
+        &dh_ecdh_pub_key, challenge2_predefined_glb->value._buffer, challenge2_predefined_glb->value._length, hash1_sentrequest, NULL, HANDSHAKE_REPLY);
+
+    reset_exception(&exception);
+
+    result = auth->process_handshake(
+                        auth,
+                        &handshake_reply_token_out,
+                        &handshake_reply_token_in,
+                        handshake_handle,
+                        &exception);
+
+    CU_ASSERT_FATAL(result == DDS_SECURITY_VALIDATION_FAILED);
+
+    reset_exception(&exception);
+
+
+    handshake_message_deinit(&handshake_token_in);
+    handshake_message_deinit(&handshake_token_out);
+    handshake_message_deinit(&handshake_reply_token_in);
+    handshake_message_deinit(&handshake_reply_token_out);
+
+
+
+    release_local_identity();
+    release_remote_identities();
+
+    CU_ASSERT_FATAL( !validate_local_identity("trusted_ca_dir") );
+    CU_ASSERT_FATAL( !validate_remote_identities( remote_identity_untrusted ) );
+
+    CU_ASSERT_FATAL (auth != NULL);
+    CU_ASSERT_FATAL (local_identity_handle != DDS_SECURITY_HANDLE_NIL);
+    CU_ASSERT_FATAL (remote_identity_handle1 != DDS_SECURITY_HANDLE_NIL);
+    CU_ASSERT_FATAL (remote_identity_handle2 != DDS_SECURITY_HANDLE_NIL);
+    CU_ASSERT_FATAL (auth->begin_handshake_request != NULL);
+    CU_ASSERT_FATAL (auth->process_handshake != NULL);
+
+    result = auth->begin_handshake_request(
+                    auth,
+                    &handshake_handle,
+                    &handshake_token_out,
+                    local_identity_handle,
+                    remote_identity_handle2,
+                    &serialized_participant_data,
+                    &exception);
+
+    if (result != DDS_SECURITY_VALIDATION_PENDING_HANDSHAKE_MESSAGE) {
+        printf("begin_handshake_request failed: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+
+    /* get challenge 1 from the message */
+    challenge1_glb = find_binary_property(&handshake_token_out, "challenge1");
+
+    /*Get DH1 value */
+    dh1 = find_binary_property(&handshake_token_out, "dh1");
+
+    hash1_sentrequest = find_binary_property(&handshake_token_out, "hash_c1");
+
+    CU_ASSERT_FATAL(dh1 != NULL);
+    CU_ASSERT_FATAL(dh1->value._length > 0);
+    CU_ASSERT_FATAL(dh1->value._buffer != NULL);
+
+    dh1_pub_key.data = dh1->value._buffer;
+    dh1_pub_key.length = dh1->value._length;
+
+    /* prepare reply */
+    fill_handshake_message_token(
+        &handshake_reply_token_in, remote_participant_data2, remote_identity_untrusted,
+        AUTH_DSIGN_ALGO_RSA_NAME, AUTH_KAGREE_ALGO_ECDH_NAME,
+        &dh1_pub_key, challenge1_glb->value._buffer, challenge1_glb->value._length,
+        &dh_ecdh_pub_key, challenge2_predefined_glb->value._buffer, challenge2_predefined_glb->value._length, hash1_sentrequest, NULL, HANDSHAKE_REPLY);
+
+    reset_exception(&exception);
+
+    result = auth->process_handshake(
+                        auth,
+                        &handshake_reply_token_out,
+                        &handshake_reply_token_in,
+                        handshake_handle,
+                        &exception);
+
+    CU_ASSERT_FATAL(result == DDS_SECURITY_VALIDATION_FAILED);
+    CU_ASSERT_FATAL(exception.code != 0);
+
+
+    reset_exception(&exception);
+
+
+    handshake_message_deinit(&handshake_token_in);
+    handshake_message_deinit(&handshake_token_out);
+    handshake_message_deinit(&handshake_reply_token_in);
+    handshake_message_deinit(&handshake_reply_token_out);
+
+}
diff --git a/src/security/builtin_plugins/tests/validate_begin_handshake_reply/etc/trusted_ca_dir/identity_ca b/src/security/builtin_plugins/tests/validate_begin_handshake_reply/etc/trusted_ca_dir/identity_ca
new file mode 100644
index 0000000..7e2675c
--- /dev/null
+++ b/src/security/builtin_plugins/tests/validate_begin_handshake_reply/etc/trusted_ca_dir/identity_ca
@@ -0,0 +1,27 @@
+-----BEGIN CERTIFICATE-----
+MIIEmTCCA4GgAwIBAgIIZ5gEIUFhO5wwDQYJKoZIhvcNAQELBQAwXzELMAkGA1UE
+BhMCTkwxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdp
+ZGdpdHMgUHR5IEx0ZDEYMBYGA1UEAxMPQ0hBTTUwMCByb290IGNhMCAXDTE4MDIx
+MjE1MDUwMFoYDzIyMjIwMjIyMjIyMjAwWjBfMQswCQYDVQQGEwJOTDETMBEGA1UE
+CBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRk
+MRgwFgYDVQQDEw9DSEFNNTAwIHJvb3QgY2EwggEiMA0GCSqGSIb3DQEBAQUAA4IB
+DwAwggEKAoIBAQC6Fa3TheL+UrdZCp9GhU/2WbneP2t/avUa3muwDttPxeI2XU9k
+ZjBR95mAXme4SPXHk5+YDN319AqIje3oKhzky/ngvKH2GkoJKYxWnuDBfMEHdViz
+2Q9/xso2ZvH50ukwWa0pfx2/EVV1wRxeQcRd/UVfq3KTJizG0M88mOYvGEAw3LFf
+zef7k1aCuOofQmBvLukUudcYpMzfyHFp7lQqU4CcrrR5RtmfiUfrWfdGLea2iPDB
+pJgN8ESOMwEHtOTEBDclYnH9L4t7CHQz+fXXS5IWFsDK9fCMQjnxDsDVeNrNzTYL
+FaZrMg9S6IUQCEsQWsnq5weS8omOpVLUm9klAgMBAAGjggFVMIIBUTAMBgNVHRME
+BTADAQH/MB0GA1UdDgQWBBQg2FZB/j8uWDVnJhjwXkX278znSTAfBgNVHSMEGDAW
+gBQg2FZB/j8uWDVnJhjwXkX278znSTAPBgNVHQ8BAf8EBQMDB/+AMIHvBgNVHSUB
+Af8EgeQwgeEGCCsGAQUFBwMBBggrBgEFBQcDAgYIKwYBBQUHAwMGCCsGAQUFBwME
+BggrBgEFBQcDCAYKKwYBBAGCNwIBFQYKKwYBBAGCNwIBFgYKKwYBBAGCNwoDAQYK
+KwYBBAGCNwoDAwYKKwYBBAGCNwoDBAYJYIZIAYb4QgQBBgsrBgEEAYI3CgMEAQYI
+KwYBBQUHAwUGCCsGAQUFBwMGBggrBgEFBQcDBwYIKwYBBQUIAgIGCisGAQQBgjcU
+AgIGCCsGAQUFBwMJBggrBgEFBQcDDQYIKwYBBQUHAw4GBysGAQUCAwUwDQYJKoZI
+hvcNAQELBQADggEBAKHmwejWRwGE1wf1k2rG8SNRV/neGsZ6Qfqf6co3TpR/Wi1s
+iZDvSeT/rbqNBS7z34xnG88NIUwu00y78e8Mfon31ZZbK4Uo7fla9/D3ukdJqPQC
+LKdbKJjR2kH+KCukY/1rghjJ8/X+t2egBit0LCOdsFCl07Sfksb9kpGUIZSFcYYm
+geqhjhoNwxazzHiw+QWHC5HG9248JIizBmy1aymNWuMnPudhjHAnPcsIlqMVNq3t
+Rv9ap7S8JeCxHVRPJvJeCwXWvW3dW/v3xH52Yn/fqRblN1w9Fxz5NhopKx0gj/Jd
+sw2N4Fk4gaOWEolFpa0bwNw8nAx7moehZpowzfw=
+-----END CERTIFICATE-----
diff --git a/src/security/builtin_plugins/tests/validate_begin_handshake_reply/etc/trusted_ca_dir/remote_ca.crt b/src/security/builtin_plugins/tests/validate_begin_handshake_reply/etc/trusted_ca_dir/remote_ca.crt
new file mode 100644
index 0000000..6b096a0
--- /dev/null
+++ b/src/security/builtin_plugins/tests/validate_begin_handshake_reply/etc/trusted_ca_dir/remote_ca.crt
@@ -0,0 +1,25 @@
+-----BEGIN CERTIFICATE-----
+MIIEKTCCAxGgAwIBAgIBATANBgkqhkiG9w0BAQsFADByMQswCQYDVQQGEwJOTDEL
+MAkGA1UECBMCT1YxEzARBgNVBAoTCkFETGluayBJU1QxGTAXBgNVBAMTEElkZW50
+aXR5IENBIFRlc3QxJjAkBgkqhkiG9w0BCQEWF2luZm9AaXN0LmFkbGlua3RlY2gu
+Y29tMB4XDTE4MDMxMjAwMDAwMFoXDTI3MDMxMTIzNTk1OVowcjELMAkGA1UEBhMC
+TkwxCzAJBgNVBAgTAk9WMRMwEQYDVQQKEwpBRExpbmsgSVNUMRkwFwYDVQQDExBJ
+ZGVudGl0eSBDQSBUZXN0MSYwJAYJKoZIhvcNAQkBFhdpbmZvQGlzdC5hZGxpbmt0
+ZWNoLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBANa/ENFfGVXg
+bPLTzBdDfiZQcp5dWZ//Pb8ErFOJu8uosVHFv8t69dgjHgNHB4OsjmjnR7GfKUZT
+0cMvWJnjsC7DDlBwFET9rj4k40n96bbVCH9I7+tNhsoqzc6Eu+5h4sk7VfNGTM2Z
+SyCd4GiSZRuA44rRbhXI7/LDpr4hY5J9ZDo5AM9ZyoLAoh774H3CZWD67S35XvUs
+72dzE6uKG/vxBbvZ7eW2GLO6ewa9UxlnLVMPfJdpkp/xYXwwcPW2+2YXCge1ujxs
+tjrOQJ5HUySh6DkE/kZpx8zwYWm9AaCrsvCIX1thsqgvKy+U5v1FS1L58eGc6s//
+9yMgNhU29R0CAwEAAaOByTCBxjAMBgNVHRMEBTADAQH/MB0GA1UdDgQWBBRNVUJN
+FzhJPReYT4QSx6dK53CXCTAfBgNVHSMEGDAWgBRNVUJNFzhJPReYT4QSx6dK53CX
+CTAPBgNVHQ8BAf8EBQMDB/+AMGUGA1UdJQEB/wRbMFkGCCsGAQUFBwMBBggrBgEF
+BQcDAgYIKwYBBQUHAwMGCCsGAQUFBwMEBggrBgEFBQcDCAYIKwYBBQUHAwkGCCsG
+AQUFBwMNBggrBgEFBQcDDgYHKwYBBQIDBTANBgkqhkiG9w0BAQsFAAOCAQEAcOLF
+ZYdJguj0uxeXB8v3xnUr1AWz9+gwg0URdfNLU2KvF2lsb/uznv6168b3/FcPgezN
+Ihl9GqB+RvGwgXS/1UelCGbQiIUdsNxk246P4uOGPIyW32RoJcYPWZcpY+cw11tQ
+NOnk994Y5/8ad1DmcxVLLqq5kwpXGWQufV1zOONq8B+mCvcVAmM4vkyF/de56Lwa
+sAMpk1p77uhaDnuq2lIR4q3QHX2wGctFid5Q375DRscFQteY01r/dtwBBrMn0wuL
+AMNx9ZGD+zAoOUaslpIlEQ+keAxk3jgGMWFMxF81YfhEnXzevSQXWpyek86XUyFL
+O9IAQi5pa15gXjSbUg==
+-----END CERTIFICATE-----
diff --git a/src/security/builtin_plugins/tests/validate_begin_handshake_reply/etc/trusted_ca_dir/root_CA_RSA.crt b/src/security/builtin_plugins/tests/validate_begin_handshake_reply/etc/trusted_ca_dir/root_CA_RSA.crt
new file mode 100644
index 0000000..61346df
--- /dev/null
+++ b/src/security/builtin_plugins/tests/validate_begin_handshake_reply/etc/trusted_ca_dir/root_CA_RSA.crt
@@ -0,0 +1,28 @@
+-----BEGIN CERTIFICATE-----
+MIIEtjCCA56gAwIBAgIBATANBgkqhkiG9w0BAQsFADByMQswCQYDVQQGEwJOTDEL
+MAkGA1UECBMCT1YxEzARBgNVBAoTCkFETGluayBJU1QxGTAXBgNVBAMTEElkZW50
+aXR5IENBIFRlc3QxJjAkBgkqhkiG9w0BCQEWF2luZm9AaXN0LmFkbGlua3RlY2gu
+Y29tMB4XDTE4MDYxMTAwMDAwMFoXDTI3MDYxMDIzNTk1OVowcjELMAkGA1UEBhMC
+TkwxCzAJBgNVBAgTAk9WMRMwEQYDVQQKEwpBRExpbmsgSVNUMRkwFwYDVQQDExBJ
+ZGVudGl0eSBDQSBUZXN0MSYwJAYJKoZIhvcNAQkBFhdpbmZvQGlzdC5hZGxpbmt0
+ZWNoLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBANRf3XKmM6O+
+WoYPNpOAdkGKKZHLJ8ZuPxVVBMX6oJAlcOmkhLzfkHSA+gl/OWaMOXIEtN512gyL
+YszBf1RImwVzRjJFwIxzGzVQ68jYNj+qBbsOt+IG+hs3wgVCLFkCh+J7hXUgvk8A
+eRM/SRrI42dQfcgKUAMNi4/iX6Vs+FV9pHB63L4PiLA9hfUE25sH6EsIC7icvGDJ
+6cGG94glVSHDI1NtXfsNHY+NGY/jYKtQZklqU3lew5I60aJIsea+Wk6PJiz4hyXv
+XVVmrcNeG1g4OEFgiSXZC2XknDw8t9+ELprGNvuJvTFxwPMAgLeF4IhEQC9dQY2W
+BRwUxtZBzukCAwEAAaOCAVUwggFRMAwGA1UdEwQFMAMBAf8wHQYDVR0OBBYEFER4
+R6N3MQ1Wl7gn+R8wwHloDCVZMB8GA1UdIwQYMBaAFER4R6N3MQ1Wl7gn+R8wwHlo
+DCVZMA8GA1UdDwEB/wQFAwMH/4Awge8GA1UdJQEB/wSB5DCB4QYIKwYBBQUHAwEG
+CCsGAQUFBwMCBggrBgEFBQcDAwYIKwYBBQUHAwQGCCsGAQUFBwMIBgorBgEEAYI3
+AgEVBgorBgEEAYI3AgEWBgorBgEEAYI3CgMBBgorBgEEAYI3CgMDBgorBgEEAYI3
+CgMEBglghkgBhvhCBAEGCysGAQQBgjcKAwQBBggrBgEFBQcDBQYIKwYBBQUHAwYG
+CCsGAQUFBwMHBggrBgEFBQgCAgYKKwYBBAGCNxQCAgYIKwYBBQUHAwkGCCsGAQUF
+BwMNBggrBgEFBQcDDgYHKwYBBQIDBTANBgkqhkiG9w0BAQsFAAOCAQEAwXuEWDG3
+aAyL+DsGr0B4YMLjHtx6FjzkJOpTtXQhkrtSMpD3Xytl7Wfz8lyWuTnbrk8F4gWO
+IkJR/NdMGW27SmeYU0z7QAGRDwtHX6kqqizQbCwf4F6P/2QftcLp1VrlsIlb0gyx
+gLjpGmn5TT7gj+ahW0iIRglOwhzCvkNu6agYpdGwVirSyLShy/Hq303DZSbVuktz
+5/PmZKpufnoGqURNnJqbV4TQipE0FiDmp2o+gVgJ+DVRhiCdfk68Xp7+TlmxCDfZ
+C3qb18qrwAZ4AL3T9/RlzfkXh4ME9V6wqa5Y6j7Vwx5Ef2OHL+mnMnoNSXDLRh6j
+45ky66su5dROpA==
+-----END CERTIFICATE-----
diff --git a/src/security/builtin_plugins/tests/validate_begin_handshake_reply/src/validate_begin_handshake_reply_utests.c b/src/security/builtin_plugins/tests/validate_begin_handshake_reply/src/validate_begin_handshake_reply_utests.c
new file mode 100644
index 0000000..3b2907e
--- /dev/null
+++ b/src/security/builtin_plugins/tests/validate_begin_handshake_reply/src/validate_begin_handshake_reply_utests.c
@@ -0,0 +1,2125 @@
+
+
+
+
+/* CUnit includes. */
+
+
+/* Test helper includes. */
+#include "common/src/loader.h"
+#include "config_env.h"
+
+/* Private header include */
+#include <openssl/opensslv.h>
+#include <openssl/sha.h>
+#include <openssl/x509.h>
+#include <openssl/pem.h>
+#include <openssl/asn1.h>
+#include <openssl/err.h>
+
+#include "dds/security/dds_security_api.h"
+#include "dds/security/core/dds_security_serialize.h"
+#include "dds/security/core/dds_security_utils.h"
+#include "dds/security/dds_security_api.h"
+#include "dds/ddsrt/heap.h"
+#include "dds/ddsrt/string.h"
+#include <stdio.h>
+#include <string.h>
+#include "dds/ddsrt/environ.h"
+#include "dds/ddsrt/endian.h"
+#include "CUnit/CUnit.h"
+#include "CUnit/Test.h"
+#include "assert.h"
+
+
+#if DDSRT_ENDIAN == DDSRT_LITTLE_ENDIAN
+unsigned bswap4u (unsigned x);
+unsigned bswap4u (unsigned x)
+{
+  return (x >> 24) | ((x >> 8) & 0xff00) | ((x << 8) & 0xff0000) | (x << 24);
+}
+#define toBE4u(x) bswap4u (x)
+#define fromBE4u(x) bswap4u (x)
+#else
+#define toBE4u(x) (x)
+#define fromBE4u(x) (x)
+#endif
+
+
+static const char * AUTH_PROTOCOL_CLASS_ID          = "DDS:Auth:PKI-DH:1.0";
+static const char * PERM_ACCESS_CLASS_ID            = "DDS:Access:Permissions:1.0";
+
+static const char * PROPERTY_IDENTITY_CA            = "dds.sec.auth.identity_ca";
+static const char * PROPERTY_PRIVATE_KEY            = "dds.sec.auth.private_key";
+static const char * PROPERTY_IDENTITY_CERT          = "dds.sec.auth.identity_certificate";
+static const char * PROPERTY_TRUSTED_CA_DIR          = "dds.sec.auth.trusted_ca_dir";
+
+static const char * PROPERTY_CERT_SUBJECT_NAME      = "dds.cert.sn";
+static const char * PROPERTY_CERT_ALGORITHM         = "dds.cert.algo";
+static const char * PROPERTY_CA_SUBJECT_NAME        = "dds.ca.sn";
+static const char * PROPERTY_CA_ALGORITHM           = "dds.ca.aglo";
+
+static const char * PROPERTY_PERM_CA_SUBJECT_NAME   = "ds.perm_ca.sn";
+
+static const char * SUBJECT_NAME_IDENTITY_CERT      = "CN=CHAM-574 client,O=Some Company,ST=Some-State,C=NL";
+static const char * SUBJECT_NAME_IDENTITY_CA        = "CN=CHAM-574 authority,O=Some Company,ST=Some-State,C=NL";
+
+static const char * RSA_2048_ALGORITHM_NAME         = "RSA-2048";
+
+static const char * AUTH_REQUEST_TOKEN_CLASS_ID         = "DDS:Auth:PKI-DH:1.0+AuthReq";
+static const char * AUTH_REQUEST_TOKEN_FUTURE_PROP_NAME = "future_challenge";
+
+static const char * AUTH_HANDSHAKE_REQUEST_TOKEN_CLASS_ID = "DDS:Auth:PKI-DH:1.0+Req";
+static const char * AUTH_HANDSHAKE_REPLY_TOKEN_CLASS_ID   = "DDS:Auth:PKI-DH:1.0+Reply";
+
+
+static const char * AUTH_DSIGN_ALGO_RSA_NAME  = "RSASSA-PSS-SHA256";
+static const char * AUTH_KAGREE_ALGO_RSA_NAME = "DH+MODP-2048-256";
+
+static unsigned char *dh_pubkey_modp_2048_value          = NULL;
+static unsigned char *invalid_dh_pubkey_modp_2048_value  = NULL;
+static size_t  dh_pubkey_modp_2048_length         = 0;
+
+static const char *identity_certificate =
+        "data:,-----BEGIN CERTIFICATE-----\n"
+        "MIIEQTCCAymgAwIBAgIINpuaAAnrQZIwDQYJKoZIhvcNAQELBQAwXzELMAkGA1UE\n"
+        "BhMCTkwxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdp\n"
+        "ZGdpdHMgUHR5IEx0ZDEYMBYGA1UEAxMPQ0hBTTUwMCByb290IGNhMCAXDTE3MDIy\n"
+        "MjIyMjIwMFoYDzIyMjIwMjIyMjIyMjAwWjBcMQswCQYDVQQGEwJOTDETMBEGA1UE\n"
+        "CBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRk\n"
+        "MRUwEwYDVQQDEwxDSEFNNTAwIGNlcnQwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAw\n"
+        "ggEKAoIBAQDCpVhivH/wBIyu74rvQncnSZqKyspN6CvD1pmV9wft5PHhVt9jV79v\n"
+        "gSub5LADoRHAgFdv9duYgBr17Ob6uRrIY4B18CcrCjhQcC4gjx8y2jl9PeYm+qYD\n"
+        "3o44FYBrBq0QCnrQgKsb/qX9Z+Mw/VUiw65x68W876LEHQQoEgT4kxSuagwBoVRk\n"
+        "ePD6fYAKmT4XS3x+O0v+rHESTcsKF6yMadgp7h3eH1b8kJTzSx8JV9Zzq++mxjox\n"
+        "qhbBVP5nDze2hhSIeCkCvSrx7efkgKS4AQXa5/Z44GiAu1TfXXUqdic9rxwD0edn\n"
+        "ajNElnZe7sjok/0yuqvH+2hSqpNva/zpAgMBAAGjggEAMIH9MAwGA1UdDwQFAwMH\n"
+        "/4AwgewGA1UdJQSB5DCB4QYIKwYBBQUHAwEGCCsGAQUFBwMCBggrBgEFBQcDAwYI\n"
+        "KwYBBQUHAwQGCCsGAQUFBwMIBgorBgEEAYI3AgEVBgorBgEEAYI3AgEWBgorBgEE\n"
+        "AYI3CgMBBgorBgEEAYI3CgMDBgorBgEEAYI3CgMEBglghkgBhvhCBAEGCysGAQQB\n"
+        "gjcKAwQBBggrBgEFBQcDBQYIKwYBBQUHAwYGCCsGAQUFBwMHBggrBgEFBQgCAgYK\n"
+        "KwYBBAGCNxQCAgYIKwYBBQUHAwkGCCsGAQUFBwMNBggrBgEFBQcDDgYHKwYBBQID\n"
+        "BTANBgkqhkiG9w0BAQsFAAOCAQEAawdHy0Xw7nTK2ltp91Ion6fJ7hqYuj///zr7\n"
+        "Adt6uonpDh/xl3esuwcFimIJrJrHujnGkL0nLddRCikmnzuBMNDWS6yq0/Ckl/YG\n"
+        "yjNr44dlX24wo+MVAgkj3/8CyWDZ3a8kBg9QT3bs2SqbjmhTrXN1DRyf9S5vJysE\n"
+        "I7V1gTN66BeKL64hOrAlRVrEu8Ds6TWL6Q/YH+61ViZkoLTeSaPjH4nknaFr4C35\n"
+        "iji0JhkyfRHRRVPHFnaj25AkxOrSV64qVKoTMjDl5fji5iMGtjm6iJ7q05ml/qDl\n"
+        "nLotHXemZNvYhbwUmRzbt4Dls9EMH4VRbP85I94nM5TAvtHVNA==\n"
+        "-----END CERTIFICATE-----\n";
+
+
+static const char *remote_identity_certificate =
+        "-----BEGIN CERTIFICATE-----\n"
+        "MIIEPTCCAyWgAwIBAgIIRmtzSKaI+rowDQYJKoZIhvcNAQELBQAwXzELMAkGA1UE\n"
+        "BhMCTkwxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdp\n"
+        "ZGdpdHMgUHR5IEx0ZDEYMBYGA1UEAxMPQ0hBTTUwMCByb290IGNhMCAXDTE4MDMy\n"
+        "MzEyMDEwMFoYDzIyMjIwMjIyMjIyMjAwWjBYMQswCQYDVQQGEwJOTDETMBEGA1UE\n"
+        "CBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRk\n"
+        "MREwDwYDVQQDEwhDSEFNLTU3NzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoC\n"
+        "ggEBAMKlWGK8f/AEjK7viu9CdydJmorKyk3oK8PWmZX3B+3k8eFW32NXv2+BK5vk\n"
+        "sAOhEcCAV2/125iAGvXs5vq5GshjgHXwJysKOFBwLiCPHzLaOX095ib6pgPejjgV\n"
+        "gGsGrRAKetCAqxv+pf1n4zD9VSLDrnHrxbzvosQdBCgSBPiTFK5qDAGhVGR48Pp9\n"
+        "gAqZPhdLfH47S/6scRJNywoXrIxp2CnuHd4fVvyQlPNLHwlX1nOr76bGOjGqFsFU\n"
+        "/mcPN7aGFIh4KQK9KvHt5+SApLgBBdrn9njgaIC7VN9ddSp2Jz2vHAPR52dqM0SW\n"
+        "dl7uyOiT/TK6q8f7aFKqk29r/OkCAwEAAaOCAQAwgf0wDAYDVR0PBAUDAwf/gDCB\n"
+        "7AYDVR0lBIHkMIHhBggrBgEFBQcDAQYIKwYBBQUHAwIGCCsGAQUFBwMDBggrBgEF\n"
+        "BQcDBAYIKwYBBQUHAwgGCisGAQQBgjcCARUGCisGAQQBgjcCARYGCisGAQQBgjcK\n"
+        "AwEGCisGAQQBgjcKAwMGCisGAQQBgjcKAwQGCWCGSAGG+EIEAQYLKwYBBAGCNwoD\n"
+        "BAEGCCsGAQUFBwMFBggrBgEFBQcDBgYIKwYBBQUHAwcGCCsGAQUFCAICBgorBgEE\n"
+        "AYI3FAICBggrBgEFBQcDCQYIKwYBBQUHAw0GCCsGAQUFBwMOBgcrBgEFAgMFMA0G\n"
+        "CSqGSIb3DQEBCwUAA4IBAQAniERWU9f/ijm9t8xuyOujEKDJl0Ded4El9mM5UYPR\n"
+        "ZSnabPNKQjABBS4sVISIYVwfQxGkPgK0MeMBKqs/kWsZ4rp8h5hlZvxFX8H148mo\n"
+        "3apNgdc/VylDBW5Ltbrypn/dZh9hFZE8Y/Uvo9HPksVEkjYuFN5v7e8/mwxTcrZ1\n"
+        "BAZrTlDTiCR046NN1lUs/7oUaNCruFV7AU6RbGYnSzM6plPJHMRa9nzNeO0uPaHK\n"
+        "kNPe+/UGpMi7cpF9w0M5Z1wW+Nq45bBRejFLQkHSjOEeGL2zi7T1HFAHZQydd6Wo\n"
+        "zYffGTmyHqIjNArbOWEMYN6s1nqsQS+ifolr0MtfeHad\n"
+        "-----END CERTIFICATE-----\n";
+
+static const char *identity_ca =
+        "data:,-----BEGIN CERTIFICATE-----\n"
+        "MIIEmTCCA4GgAwIBAgIIZ5gEIUFhO5wwDQYJKoZIhvcNAQELBQAwXzELMAkGA1UE\n"
+        "BhMCTkwxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdp\n"
+        "ZGdpdHMgUHR5IEx0ZDEYMBYGA1UEAxMPQ0hBTTUwMCByb290IGNhMCAXDTE4MDIx\n"
+        "MjE1MDUwMFoYDzIyMjIwMjIyMjIyMjAwWjBfMQswCQYDVQQGEwJOTDETMBEGA1UE\n"
+        "CBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRk\n"
+        "MRgwFgYDVQQDEw9DSEFNNTAwIHJvb3QgY2EwggEiMA0GCSqGSIb3DQEBAQUAA4IB\n"
+        "DwAwggEKAoIBAQC6Fa3TheL+UrdZCp9GhU/2WbneP2t/avUa3muwDttPxeI2XU9k\n"
+        "ZjBR95mAXme4SPXHk5+YDN319AqIje3oKhzky/ngvKH2GkoJKYxWnuDBfMEHdViz\n"
+        "2Q9/xso2ZvH50ukwWa0pfx2/EVV1wRxeQcRd/UVfq3KTJizG0M88mOYvGEAw3LFf\n"
+        "zef7k1aCuOofQmBvLukUudcYpMzfyHFp7lQqU4CcrrR5RtmfiUfrWfdGLea2iPDB\n"
+        "pJgN8ESOMwEHtOTEBDclYnH9L4t7CHQz+fXXS5IWFsDK9fCMQjnxDsDVeNrNzTYL\n"
+        "FaZrMg9S6IUQCEsQWsnq5weS8omOpVLUm9klAgMBAAGjggFVMIIBUTAMBgNVHRME\n"
+        "BTADAQH/MB0GA1UdDgQWBBQg2FZB/j8uWDVnJhjwXkX278znSTAfBgNVHSMEGDAW\n"
+        "gBQg2FZB/j8uWDVnJhjwXkX278znSTAPBgNVHQ8BAf8EBQMDB/+AMIHvBgNVHSUB\n"
+        "Af8EgeQwgeEGCCsGAQUFBwMBBggrBgEFBQcDAgYIKwYBBQUHAwMGCCsGAQUFBwME\n"
+        "BggrBgEFBQcDCAYKKwYBBAGCNwIBFQYKKwYBBAGCNwIBFgYKKwYBBAGCNwoDAQYK\n"
+        "KwYBBAGCNwoDAwYKKwYBBAGCNwoDBAYJYIZIAYb4QgQBBgsrBgEEAYI3CgMEAQYI\n"
+        "KwYBBQUHAwUGCCsGAQUFBwMGBggrBgEFBQcDBwYIKwYBBQUIAgIGCisGAQQBgjcU\n"
+        "AgIGCCsGAQUFBwMJBggrBgEFBQcDDQYIKwYBBQUHAw4GBysGAQUCAwUwDQYJKoZI\n"
+        "hvcNAQELBQADggEBAKHmwejWRwGE1wf1k2rG8SNRV/neGsZ6Qfqf6co3TpR/Wi1s\n"
+        "iZDvSeT/rbqNBS7z34xnG88NIUwu00y78e8Mfon31ZZbK4Uo7fla9/D3ukdJqPQC\n"
+        "LKdbKJjR2kH+KCukY/1rghjJ8/X+t2egBit0LCOdsFCl07Sfksb9kpGUIZSFcYYm\n"
+        "geqhjhoNwxazzHiw+QWHC5HG9248JIizBmy1aymNWuMnPudhjHAnPcsIlqMVNq3t\n"
+        "Rv9ap7S8JeCxHVRPJvJeCwXWvW3dW/v3xH52Yn/fqRblN1w9Fxz5NhopKx0gj/Jd\n"
+        "sw2N4Fk4gaOWEolFpa0bwNw8nAx7moehZpowzfw=\n"
+        "-----END CERTIFICATE-----\n";
+
+
+static const char *private_key =
+        "data:,-----BEGIN RSA PRIVATE KEY-----\n"
+        "MIIEogIBAAKCAQEAwqVYYrx/8ASMru+K70J3J0maisrKTegrw9aZlfcH7eTx4Vbf\n"
+        "Y1e/b4Erm+SwA6ERwIBXb/XbmIAa9ezm+rkayGOAdfAnKwo4UHAuII8fMto5fT3m\n"
+        "JvqmA96OOBWAawatEAp60ICrG/6l/WfjMP1VIsOucevFvO+ixB0EKBIE+JMUrmoM\n"
+        "AaFUZHjw+n2ACpk+F0t8fjtL/qxxEk3LChesjGnYKe4d3h9W/JCU80sfCVfWc6vv\n"
+        "psY6MaoWwVT+Zw83toYUiHgpAr0q8e3n5ICkuAEF2uf2eOBogLtU3111KnYnPa8c\n"
+        "A9HnZ2ozRJZ2Xu7I6JP9Mrqrx/toUqqTb2v86QIDAQABAoIBAC1q32DKkx+yMBFx\n"
+        "m32QiLUGG6VfBC2BixS7MkMnzRXZYgcuehl4FBc0kLRjfB6cqsO8LqrVN1QyMBhK\n"
+        "GutN3c38SbE7RChqzhEW2+yE+Mao3Nk4ZEecHLiyaYT0n25ZtHAVwep823BAzwJ+\n"
+        "BykbM45VEpNKbG1VjSktjBa9faNyZiZAEJEjVyla+6R8N4kHV52LbZcLjvJv3IQ2\n"
+        "iPYRrmMyI5C23qTni0vy7yJbAXBo3CqgSlwie9FARBWT7Puu7F4mF1O1c/SnTysw\n"
+        "Tm3e5FzgfHipQbnRVn0w4rDprPMKmPxMnvf/Wkw0zVgNadp1Tc1I6Yj525DEQ07i\n"
+        "2gIn/gECgYEA4jNnY1u2Eu7x3pAQF3dRO0x35boVtuq9iwQk7q+uaZaK4RJRr+0Y\n"
+        "T68S3bPnfer6SHvcxtST89Bvs/j/Ky4SOaX037UYjFh6T7OIzPl+MzO1yb+VOBT6\n"
+        "D6FVGEJGp8ZAITU1OfJPeTYViUeEC8tHFGoKUCk50FbB6jOf1oKtv/ECgYEA3EnB\n"
+        "Y7kSbJJaUuj9ciFUL/pAno86Cim3VjegK1wKgEiyDb610bhoMErovPwfVJbtcttG\n"
+        "eKJNuwizkRcVbj+vpjDvqqaP5eMxLl6/Nd4haPMJYzGo88Z8NJpwFRNF2KEWjOpQ\n"
+        "2NEvoCeRtVulCJyka2Tpljzw8cOXkxhPOe2UhHkCgYBo3entj0QO7QXm56T+LAvV\n"
+        "0PK45xdQEO3EuCwjGAFk5C0IgUSrqeCeeIzniZMltj1IQ1wsNbtNynEu3530t8wt\n"
+        "O7oVyFBUKGSz9IjUdkpClJOPr6kPMfJoMqRPtdIpz+hFPPSrI6IikKdVWHloOlp+\n"
+        "pVaYqTQrWT1XRY2xli3VEQKBgGySmZN6Cx+h/oywswIGdUT0VdcQhq2to+QFpJba\n"
+        "VX6m1cM6hMip2Ag9U3qZ1SNPBBdBBfm9HQybHE3dj713/C2wHuAAGhpXIM1W+20k\n"
+        "X1knuC/AsSH9aQhQOf/ZMOq1crTfZBuI9q0782/sjGmzMsKPySU4QhUWruVb7OiD\n"
+        "NVkZAoGAEvihW7G+8/iOE40vGHyBqUeopAAWLciTAUIEwM/Oi3BYfNWNTWF/FWNc\n"
+        "nMvCZPYigY8C1vO+1iT2Frtd3CIU+f01Q3fJNJoRLlEiKLNZUJRF48OKUqjKSmsi\n"
+        "w6pucFO40z05YW7utApj4L82rZnOS0pd1tUI1yexqvj0i4ThJfk=\n"
+        "-----END RSA PRIVATE KEY-----\n";
+
+
+static const char *diffie_hellman_pubkey =
+        "-----BEGIN PUBLIC KEY-----\n"
+        "MIICJDCCARcGCSqGSIb3DQEDATCCAQgCggEBAJxLLigSIC7JjO/kdQ7LT1v0FPvM\n"
+        "Cq4hZrg6cX1IKzinaJJai3CcWpjMxoJ+jDBh2iekZavJli9qa400FC94UchqsE8s\n"
+        "I68LRbSkocvSWHOyayGrn04XLvhZPwulZFfEZ0xmg+vcTt2xS5IvX0qC1nrMpVu9\n"
+        "d9A93n+PZqRWJcJThoApChRT0lVp6CC9dn7oVnIPWyGfUZH9UOzXrx8Rq6wKnWPs\n"
+        "G0Igaia4uLDIqGKJ1Nr2HmLY8exKcK539X38I2NokzQrwhKdBlIXF5yYGhH+ib0U\n"
+        "yrdbK1kJBiaXh2CMMPQ7skXZDeQ/ixgTI/cXwaMC3ddE+7l/GTHo/azJawsCAQID\n"
+        "ggEFAAKCAQB3SB4wP5voPc5YcUpFiJXXlQe7DQxfzo5Mq1A/e8Raw/qzCkJMkcoT\n"
+        "v656vj4s7PbmzWLDLs0mAD7lU4U+HSnhuBmP46aIZVZORZqQmhzn073iqPiRN8eC\n"
+        "XPXgsMc8sgpbOoUGo89nuMGaucu2i4ZpLdJTkoFfC6wE2wZg11mr/hfX7+KmKSSp\n"
+        "V/+h6wROt824MijsuDjxHgZJWuM1jqzFq5skMJ84uwBF5LG3A6sTFnobBQXily5H\n"
+        "vYh/wWf+lRxeoNRW6B0t7xukZ+a71gg2Fxtm1f3RkLh4IcWfuYAcn5R9Hvgvx7Ex\n"
+        "DrqVRGbTZZa7fgtiQjj7HF6Cg/btOz2T\n"
+        "-----END PUBLIC KEY-----\n";
+
+static const char *unrelated_identity =
+        "data:,-----BEGIN CERTIFICATE-----\n"
+        "MIIDpDCCAoygAwIBAgIJALE5lRKfYHAaMA0GCSqGSIb3DQEBCwUAMF8xCzAJBgNV\n"
+        "BAYTAk5MMRMwEQYDVQQIDApPdmVyaWpzc2VsMRAwDgYDVQQHDAdIZW5nZWxvMQ8w\n"
+        "DQYDVQQKDAZBRExJTksxGDAWBgNVBAMMD0NIQU01MDAgUm9vdCBDQTAeFw0xODAy\n"
+        "MDkxNjIwNDNaFw0zODAyMDQxNjIwNDNaMF8xCzAJBgNVBAYTAk5MMRMwEQYDVQQI\n"
+        "DApPdmVyaWpzc2VsMRAwDgYDVQQHDAdIZW5nZWxvMQ8wDQYDVQQKDAZBRExJTksx\n"
+        "GDAWBgNVBAMMD0NIQU01MDAgUm9vdCBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEP\n"
+        "ADCCAQoCggEBAN9/NbpJDHQYHh3cEByRxnHffxEe9Sapn08Ty5xYO8LDJ4V7vU32\n"
+        "/7291fITiHaovOoCRHAbKTaTtqJO56aGY45HON6KIqxljLQJJVGW/Nf2PNSHmFix\n"
+        "6D6bsoSOTPyKYqBNT6lB7NMn4QBTcsiE61El8p9WLQZHoYQJK5Psf7wkBqGBz8he\n"
+        "bcDWXFn7kIgnsaLrh77w2wi/y0MqpPwyeRInoZfYknzVNdxCPgq7csBYDoMgOgkV\n"
+        "G60ECXojHKz1HI4n0V8L8lZluSSVRNR0xvPFgBqO7b+Re7xb6iO9TNsFeoiMMNyp\n"
+        "EwM99CqPO0RRrAPiC7IDgcNGjxhne9EJFGsCAwEAAaNjMGEwHQYDVR0OBBYEFCst\n"
+        "gj5Ecm3HU/N7wxJluFo5+6XUMB8GA1UdIwQYMBaAFCstgj5Ecm3HU/N7wxJluFo5\n"
+        "+6XUMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgGGMA0GCSqGSIb3DQEB\n"
+        "CwUAA4IBAQCWibvYuPLpoNcsUdHbE7SnBbEQnDfBxBZN8xeWHwwAPEB+8eHhmIdZ\n"
+        "xDtCN61xr5QR+KzlEYFwKyHMp9GN3OPU1RndJrzaXz2ddAZVkBIvnQZ4JvFd+sBC\n"
+        "QQgEvL8GcwZPxnad/TRylM4ON3Kh0X9vfyrmWEoHephiE1LcENaFqcYr9xg3DJNh\n"
+        "XSrigMGZJ7IOHkvgaoneICOcYI42ZHS0fnt1G+01VKJXm3ndi5NL25GnOmlvV6yV\n"
+        "+1vcmdQc6YS8K8vHmrH4lX9iPfsOak6WSzzsXdqgpvyxtGJggcFaDTtmbWCAkJj0\n"
+        "B7DMeaVlLClGQaKZZ7aexEx9se+IyLn2\n"
+        "-----END CERTIFICATE-----\n";
+
+#ifdef TRUSTED_CA_DIR_IMPLEMENTED
+static const char *remote_identity_trusted =
+                "-----BEGIN CERTIFICATE-----\n"
+                "MIIDcDCCAligAwIBAgIBBTANBgkqhkiG9w0BAQsFADByMQswCQYDVQQGEwJOTDEL\n"
+                "MAkGA1UECBMCT1YxEzARBgNVBAoTCkFETGluayBJU1QxGTAXBgNVBAMTEElkZW50\n"
+                "aXR5IENBIFRlc3QxJjAkBgkqhkiG9w0BCQEWF2luZm9AaXN0LmFkbGlua3RlY2gu\n"
+                "Y29tMB4XDTE4MDMxMjAwMDAwMFoXDTI3MDMxMTIzNTk1OVowcDELMAkGA1UEBhMC\n"
+                "TkwxCzAJBgNVBAgTAk9WMQ8wDQYDVQQKEwZBRExpbmsxETAPBgNVBAsTCElTVCBU\n"
+                "ZXN0MREwDwYDVQQDEwhCb2IgVGVzdDEdMBsGCSqGSIb3DQEJARYOYm9iQGFkbGlu\n"
+                "ay5pc3QwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDB5vqhuWnwhxXZ\n"
+                "qffPmfjzge7w91oX4ISlboIfBXp3sLj2mqLSsYhgBNJAn/Fl1OZeFw0d4gVibBgx\n"
+                "5Zdcjsi+ClvYK8H534iTJfNriMyhg4kSWxZF1Tixfw3FS7LqjKEY5ZNPfp5a4P+8\n"
+                "UveorYJusrnlv1DiF6aPhJQh8J62J6bhx62DNLO7dZbN0BUsnWtyDcfi5DOjf2/r\n"
+                "3lSRfecn3uBr1QYRaS5FrV+MSoGcjI3M75mei1TTUp7YT4ZWRR5rKUMql605xsms\n"
+                "d6sqJaKofYmw7wCuaVJ86pb/w8srdddKt21xUeQNMKn49H6raezMOE3U5BUMtZ+P\n"
+                "2OBLk/CPAgMBAAGjEzARMA8GA1UdDwEB/wQFAwMH/4AwDQYJKoZIhvcNAQELBQAD\n"
+                "ggEBAJV71Ckf1zsks5mJXqdUb8bTVHg4hN32pwjCL5c6W2XHAv+YHwE/fN3C1VIY\n"
+                "bC8zjUC9dCOyC2AvOQyZQ1eC/WoK6FlXjHVX2upL4lXQ9WL9ztt1mgdRrhvUPuUn\n"
+                "aBE8VgNU0t4jl93xMIaU8hB0kQsV+kdcN0cWbrF3mT4s9njRvopJ8hS2UE60V2wA\n"
+                "ceUOazH+QGPh1k0jkynrTlVR9GrpebQwZ2UFeinVO0km17IAyQkz+OmPc4jQLJMl\n"
+                "CmkbmMwowdLMKC6r/HyE87dN7NvFnRM5iByJklRwN7WDYZrl72HoUOlgTZ7PjW2G\n"
+                "jTxK8xXtDCXC/3CNpe0YFnOga8g=\n"
+                "-----END CERTIFICATE-----\n";
+
+static const char *remote_identity_untrusted =
+                "-----BEGIN CERTIFICATE-----\n"
+                "MIIELTCCAxWgAwIBAgIBATANBgkqhkiG9w0BAQsFADB0MQswCQYDVQQGEwJOTDEL\n"
+                "MAkGA1UECBMCT1YxEzARBgNVBAoTCkFETGluayBJU1QxGzAZBgNVBAMTEkJvYiBU\n"
+                "ZXN0IFVudHJ1c3RlZDEmMCQGCSqGSIb3DQEJARYXaW5mb0Bpc3QuYWRsaW5rdGVj\n"
+                "aC5jb20wHhcNMTgwNjIwMDAwMDAwWhcNMjcwNjE5MjM1OTU5WjB0MQswCQYDVQQG\n"
+                "EwJOTDELMAkGA1UECBMCT1YxEzARBgNVBAoTCkFETGluayBJU1QxGzAZBgNVBAMT\n"
+                "EkJvYiBUZXN0IFVudHJ1c3RlZDEmMCQGCSqGSIb3DQEJARYXaW5mb0Bpc3QuYWRs\n"
+                "aW5rdGVjaC5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDB5vqh\n"
+                "uWnwhxXZqffPmfjzge7w91oX4ISlboIfBXp3sLj2mqLSsYhgBNJAn/Fl1OZeFw0d\n"
+                "4gVibBgx5Zdcjsi+ClvYK8H534iTJfNriMyhg4kSWxZF1Tixfw3FS7LqjKEY5ZNP\n"
+                "fp5a4P+8UveorYJusrnlv1DiF6aPhJQh8J62J6bhx62DNLO7dZbN0BUsnWtyDcfi\n"
+                "5DOjf2/r3lSRfecn3uBr1QYRaS5FrV+MSoGcjI3M75mei1TTUp7YT4ZWRR5rKUMq\n"
+                "l605xsmsd6sqJaKofYmw7wCuaVJ86pb/w8srdddKt21xUeQNMKn49H6raezMOE3U\n"
+                "5BUMtZ+P2OBLk/CPAgMBAAGjgckwgcYwDAYDVR0TBAUwAwEB/zAdBgNVHQ4EFgQU\n"
+                "QpxLPHT5o/GQRwdBw2scINXnWlUwHwYDVR0jBBgwFoAUQpxLPHT5o/GQRwdBw2sc\n"
+                "INXnWlUwDwYDVR0PAQH/BAUDAwf/gDBlBgNVHSUBAf8EWzBZBggrBgEFBQcDAQYI\n"
+                "KwYBBQUHAwIGCCsGAQUFBwMDBggrBgEFBQcDBAYIKwYBBQUHAwgGCCsGAQUFBwMJ\n"
+                "BggrBgEFBQcDDQYIKwYBBQUHAw4GBysGAQUCAwUwDQYJKoZIhvcNAQELBQADggEB\n"
+                "ABcyab7F7OAsjUSW0YWkVRX1SUMkW25xLLs8koXhHrdnBqgnmOur0xO72/fmTTX9\n"
+                "KnCUmQj+dAOmmZrAaIZzqLtMyp4ibHZPfOBwmM0MFnyuwyEnCEYvjPN3FTB0HEgS\n"
+                "vCoFH1001LVi4oC1mEMxYaNW4/5Tgl+DTqGF+tctJe3hvbxh+Uu5M0320VAvASjt\n"
+                "cJ0me6Ug1FJJ60tgXgZ+M/8V6AXhrQGNgN6WkPMFbbLi5IyEld186QPeLdZ8vCtz\n"
+                "StjIV9HZGR1XLotlXarbjVtjxavZJjtwiySeYkAgG7Zjy7LalPSJiIdAD3R/ny+S\n"
+                "9kXDKiw/HgYxb8xiy9gdlSc=\n"
+                "-----END CERTIFICATE-----\n";
+
+static const char *remote_identity_trusted_expired =
+                "-----BEGIN CERTIFICATE-----\n"
+                "MIIEKTCCAxGgAwIBAgIBBjANBgkqhkiG9w0BAQsFADByMQswCQYDVQQGEwJOTDEL\n"
+                "MAkGA1UECBMCT1YxEzARBgNVBAoTCkFETGluayBJU1QxGTAXBgNVBAMTEElkZW50\n"
+                "aXR5IENBIFRlc3QxJjAkBgkqhkiG9w0BCQEWF2luZm9AaXN0LmFkbGlua3RlY2gu\n"
+                "Y29tMB4XDTE4MDMwMTAwMDAwMFoXDTE4MDQyMzIzNTk1OVowcjELMAkGA1UEBhMC\n"
+                "TkwxCzAJBgNVBAgTAk9WMRMwEQYDVQQKEwpBRExpbmsgSVNUMRkwFwYDVQQDExBC\n"
+                "b2IgVGVzdCBFeHBpcmVkMSYwJAYJKoZIhvcNAQkBFhdpbmZvQGlzdC5hZGxpbmt0\n"
+                "ZWNoLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMHm+qG5afCH\n"
+                "Fdmp98+Z+POB7vD3WhfghKVugh8FenewuPaaotKxiGAE0kCf8WXU5l4XDR3iBWJs\n"
+                "GDHll1yOyL4KW9grwfnfiJMl82uIzKGDiRJbFkXVOLF/DcVLsuqMoRjlk09+nlrg\n"
+                "/7xS96itgm6yueW/UOIXpo+ElCHwnrYnpuHHrYM0s7t1ls3QFSyda3INx+LkM6N/\n"
+                "b+veVJF95yfe4GvVBhFpLkWtX4xKgZyMjczvmZ6LVNNSnthPhlZFHmspQyqXrTnG\n"
+                "yax3qyoloqh9ibDvAK5pUnzqlv/Dyyt110q3bXFR5A0wqfj0fqtp7Mw4TdTkFQy1\n"
+                "n4/Y4EuT8I8CAwEAAaOByTCBxjAMBgNVHRMEBTADAQH/MB0GA1UdDgQWBBRCnEs8\n"
+                "dPmj8ZBHB0HDaxwg1edaVTAfBgNVHSMEGDAWgBRNVUJNFzhJPReYT4QSx6dK53CX\n"
+                "CTAPBgNVHQ8BAf8EBQMDB/+AMGUGA1UdJQEB/wRbMFkGCCsGAQUFBwMBBggrBgEF\n"
+                "BQcDAgYIKwYBBQUHAwMGCCsGAQUFBwMEBggrBgEFBQcDCAYIKwYBBQUHAwkGCCsG\n"
+                "AQUFBwMNBggrBgEFBQcDDgYHKwYBBQIDBTANBgkqhkiG9w0BAQsFAAOCAQEAdY5n\n"
+                "5ElOhpHq/YPWUs68t8HNIhqfokqjLZAgzNyU5QFppb9tPpmFCugerfjlScNwp5HB\n"
+                "X6/WjK4runDrgzXfmrBogR4Kscb1KJSm8KAmnzXVUNr1iyASlHxI7241kYdQvTH2\n"
+                "LL6b0kjsD5lKAnNh4id0SDHfy/CKg5d7dUxxO1mX48jUiIZtmFqgjej8tFLHy/w/\n"
+                "usI5ErlI0qzI6lkoRxPCEWLbXWeBDm3/smHeDbYa/+Lw4Bid8U1+ZSAuC1CT7a7F\n"
+                "O3gAjPUL0jzRztp5Yj3dYPV8YyJHLEKr75IXNedV9YKhT4f6kTS3UEjMTqYbYsix\n"
+                "MtqgY283RjsExzjNvw==\n"
+                "-----END CERTIFICATE-----\n";
+#endif
+
+static struct plugins_hdl *plugins = NULL;
+static dds_security_authentication *auth = NULL;
+static DDS_Security_IdentityHandle local_identity_handle = DDS_SECURITY_HANDLE_NIL;
+static DDS_Security_IdentityHandle remote_identity_handle1 = DDS_SECURITY_HANDLE_NIL;
+static DDS_Security_IdentityHandle remote_identity_handle2 = DDS_SECURITY_HANDLE_NIL;
+static DDS_Security_AuthRequestMessageToken g_local_auth_request_token = DDS_SECURITY_TOKEN_INIT;
+static DDS_Security_AuthRequestMessageToken g_remote_auth_request_token = DDS_SECURITY_TOKEN_INIT;
+static const DDS_Security_BinaryProperty_t *challenge1 = NULL;
+static const DDS_Security_BinaryProperty_t *challenge2 = NULL;
+static DDS_Security_OctetSeq serialized_participant_data = DDS_SECURITY_SEQUENCE_INIT;
+static DDS_Security_ParticipantBuiltinTopicData *remote_participant_data1 = NULL;
+static DDS_Security_ParticipantBuiltinTopicData *remote_participant_data2 = NULL;
+static DDS_Security_ParticipantBuiltinTopicData *remote_participant_data3 = NULL;
+static DDS_Security_GUID_t candidate_participant_guid;
+static DDS_Security_GUID_t remote_participant_guid1;
+static DDS_Security_GUID_t remote_participant_guid2;
+static bool future_challenge_done = false;
+
+
+#if OPENSSL_VERSION_NUMBER >= 0x1000200fL
+#define AUTH_INCLUDE_EC
+#include <openssl/ec.h>
+#if OPENSSL_VERSION_NUMBER >= 0x10100000L
+#define AUTH_INCLUDE_DH_ACCESSORS
+#endif
+#else
+#error "version not found"
+#endif
+
+
+static const BIGNUM *
+dh_get_public_key(
+    DH *dhkey)
+{
+#ifdef AUTH_INCLUDE_DH_ACCESSORS
+    const BIGNUM *pubkey, *privkey;
+    DH_get0_key(dhkey, &pubkey, &privkey);
+    return pubkey;
+#else
+    return dhkey->pub_key;
+#endif
+}
+
+
+static void
+serializer_participant_data(
+    DDS_Security_ParticipantBuiltinTopicData *pdata,
+    unsigned char **buffer,
+    size_t *size);
+
+static void
+dds_security_property_init(
+    DDS_Security_PropertySeq *seq,
+    DDS_Security_unsigned_long size)
+{
+    seq->_length = size;
+    seq->_maximum = size;
+    seq->_buffer = ddsrt_malloc(size * sizeof(DDS_Security_Property_t));
+    memset(seq->_buffer, 0, size * sizeof(DDS_Security_Property_t));
+}
+
+static void
+dds_security_property_deinit(
+    DDS_Security_PropertySeq *seq)
+{
+    uint32_t i;
+
+    for (i = 0; i < seq->_length; i++) {
+        ddsrt_free(seq->_buffer[i].name);
+        ddsrt_free(seq->_buffer[i].value);
+    }
+    ddsrt_free(seq->_buffer);
+}
+
+static void
+reset_exception(
+    DDS_Security_SecurityException *ex)
+{
+    ex->code = 0;
+    ex->minor_code = 0;
+    ddsrt_free(ex->message);
+    ex->message = NULL;
+}
+
+static char *
+get_openssl_error(
+        void)
+{
+    BIO *bio = BIO_new(BIO_s_mem());
+    char *msg;
+    char *buf = NULL;
+    size_t len;
+
+    if (bio) {
+        ERR_print_errors(bio);
+        len = (size_t) BIO_get_mem_data (bio, &buf);
+        msg = (char *) ddsrt_malloc(len + 1);
+        memset(msg, 0, len+1);
+        memcpy(msg, buf, len);
+        BIO_free(bio);
+    } else {
+        msg = ddsrt_strdup("BIO_new failed");
+    }
+
+    return msg;
+}
+
+static void
+initialize_identity_token(
+    DDS_Security_IdentityToken *token,
+    const char *certAlgo,
+    const char *caAlgo)
+{
+    memset(token, 0, sizeof(*token));
+
+    token->class_id = ddsrt_strdup(AUTH_PROTOCOL_CLASS_ID);
+    token->properties._maximum = 4;
+    token->properties._length  = 4;
+    token->properties._buffer = DDS_Security_PropertySeq_allocbuf(4);
+
+    token->properties._buffer[0].name = ddsrt_strdup(PROPERTY_CERT_SUBJECT_NAME);
+    token->properties._buffer[0].value = ddsrt_strdup(SUBJECT_NAME_IDENTITY_CERT);
+    token->properties._buffer[0].propagate = true;
+
+    token->properties._buffer[1].name = ddsrt_strdup(PROPERTY_CERT_ALGORITHM);
+    token->properties._buffer[1].value = ddsrt_strdup(certAlgo);
+    token->properties._buffer[1].propagate = true;
+
+    token->properties._buffer[2].name = ddsrt_strdup(PROPERTY_CA_SUBJECT_NAME);
+    token->properties._buffer[2].value = ddsrt_strdup(SUBJECT_NAME_IDENTITY_CA);
+    token->properties._buffer[2].propagate = true;
+
+    token->properties._buffer[3].name = ddsrt_strdup(PROPERTY_CA_ALGORITHM);
+    token->properties._buffer[3].value = ddsrt_strdup(caAlgo);
+    token->properties._buffer[3].propagate = true;
+}
+
+static void
+initialize_permissions_token(
+    DDS_Security_PermissionsToken *token,
+    const char *caAlgo)
+{
+    token->class_id = ddsrt_strdup(PERM_ACCESS_CLASS_ID);
+    token->properties._length = 2;
+    token->properties._maximum = 2;
+    token->properties._buffer = DDS_Security_PropertySeq_allocbuf(4);
+    token->properties._buffer[0].name = ddsrt_strdup(PROPERTY_CERT_SUBJECT_NAME);
+    token->properties._buffer[0].value = ddsrt_strdup(SUBJECT_NAME_IDENTITY_CA);
+    token->properties._buffer[1].name = ddsrt_strdup(PROPERTY_PERM_CA_SUBJECT_NAME);
+    token->properties._buffer[1].value = ddsrt_strdup(caAlgo);
+}
+
+
+
+static void
+fill_auth_request_token(
+     DDS_Security_AuthRequestMessageToken *token)
+{
+    uint32_t i;
+    uint32_t len = 32;
+    unsigned char *challenge;
+
+    challenge = ddsrt_malloc(len);
+
+    for (i = 0; i < len; i++) {
+        challenge[i] = (unsigned char)(0xFF - i);
+    }
+
+    memset(token, 0, sizeof(*token));
+
+    token->class_id = ddsrt_strdup(AUTH_REQUEST_TOKEN_CLASS_ID);
+    token->binary_properties._maximum = 1;
+    token->binary_properties._length = 1;
+    token->binary_properties._buffer = DDS_Security_BinaryPropertySeq_allocbuf(1);
+    token->binary_properties._buffer->name = ddsrt_strdup(AUTH_REQUEST_TOKEN_FUTURE_PROP_NAME);
+
+    token->binary_properties._buffer->value._maximum = len;
+    token->binary_properties._buffer->value._length = len;
+    token->binary_properties._buffer->value._buffer = challenge;
+}
+
+static DDS_Security_BinaryProperty_t *
+find_binary_property(
+    DDS_Security_DataHolder *token,
+    const char *name)
+{
+    DDS_Security_BinaryProperty_t *result = NULL;
+    uint32_t i;
+
+    for (i = 0; i < token->binary_properties._length && !result; i++) {
+        if (token->binary_properties._buffer[i].name && (strcmp(token->binary_properties._buffer[i].name, name) == 0)) {
+            result = &token->binary_properties._buffer[i];
+        }
+    }
+
+    return result;
+}
+
+
+static void
+deinitialize_identity_token(
+    DDS_Security_IdentityToken *token)
+{
+    DDS_Security_DataHolder_deinit(token);
+}
+
+static int
+validate_local_identity(const char* trusted_ca_dir)
+{
+    int res = 0;
+    DDS_Security_ValidationResult_t result;
+    DDS_Security_DomainId domain_id = 0;
+    DDS_Security_Qos participant_qos;
+    DDS_Security_SecurityException exception = {NULL, 0, 0};
+    DDS_Security_GUID_t local_participant_guid;
+    DDS_Security_GuidPrefix_t prefix = {0xb0, 0xb1, 0xb2, 0xb3, 0xb4, 0xb5, 0xb6, 0xb7, 0xb8, 0xb9, 0xba, 0xbb};
+    DDS_Security_EntityId_t entityId = {{0xb0,0xb1,0xb2},0x1};
+    DDS_Security_ParticipantBuiltinTopicData *local_participant_data;
+    unsigned char *sdata;
+    size_t sz;
+
+    memset(&local_participant_guid, 0, sizeof(local_participant_guid));
+    memcpy(&candidate_participant_guid.prefix, &prefix, sizeof(prefix));
+    memcpy(&candidate_participant_guid.entityId, &entityId, sizeof(entityId));
+
+    memset(&participant_qos, 0, sizeof(participant_qos));
+    if( trusted_ca_dir != NULL){
+        char trusted_ca_dir_path[1024];
+        dds_security_property_init(&participant_qos.property.value, 4);
+#ifdef WIN32
+    snprintf(trusted_ca_dir_path, 1024, "%s\\validate_begin_handshake_reply\\etc\\%s", CONFIG_ENV_TESTS_DIR,trusted_ca_dir);
+#else
+    snprintf(trusted_ca_dir_path, 1024, "%s/validate_begin_handshake_reply/etc/%s", CONFIG_ENV_TESTS_DIR, trusted_ca_dir);
+#endif
+        participant_qos.property.value._buffer[3].name = ddsrt_strdup(PROPERTY_TRUSTED_CA_DIR);
+        participant_qos.property.value._buffer[3].value = ddsrt_strdup(trusted_ca_dir_path);
+    }
+    else{
+        dds_security_property_init(&participant_qos.property.value, 3);
+    }
+    participant_qos.property.value._buffer[0].name = ddsrt_strdup(PROPERTY_IDENTITY_CERT);
+    participant_qos.property.value._buffer[0].value = ddsrt_strdup(identity_certificate);
+    participant_qos.property.value._buffer[1].name = ddsrt_strdup(PROPERTY_IDENTITY_CA);
+    participant_qos.property.value._buffer[1].value = ddsrt_strdup(identity_ca);
+    participant_qos.property.value._buffer[2].name = ddsrt_strdup(PROPERTY_PRIVATE_KEY);
+    participant_qos.property.value._buffer[2].value = ddsrt_strdup(private_key);
+
+    /* Now call the function. */
+    result = auth->validate_local_identity(
+                            auth,
+                            &local_identity_handle,
+                            &local_participant_guid,
+                            domain_id,
+                            &participant_qos,
+                            &candidate_participant_guid,
+                            &exception);
+
+    if (result != DDS_SECURITY_VALIDATION_OK) {
+        res = -1;
+        printf("validate_local_identity_failed: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+
+    dds_security_property_deinit(&participant_qos.property.value);
+    reset_exception(&exception);
+
+    local_participant_data = DDS_Security_ParticipantBuiltinTopicData_alloc();
+    memcpy(&local_participant_data->key[0], &local_participant_guid, 12);
+    /* convert from big-endian format to native format */
+    local_participant_data->key[0] = fromBE4u(local_participant_data->key[0]);
+    local_participant_data->key[1] = fromBE4u(local_participant_data->key[1]);
+    local_participant_data->key[2] = fromBE4u(local_participant_data->key[2]);
+
+    initialize_identity_token(&local_participant_data->identity_token, RSA_2048_ALGORITHM_NAME, RSA_2048_ALGORITHM_NAME);
+    initialize_permissions_token(&local_participant_data->permissions_token, RSA_2048_ALGORITHM_NAME);
+
+    local_participant_data->security_info.participant_security_attributes = 0x01;
+    local_participant_data->security_info.plugin_participant_security_attributes = 0x02;
+
+    serializer_participant_data(local_participant_data, &sdata, &sz);
+
+    serialized_participant_data._length = serialized_participant_data._maximum = (uint32_t) sz;
+    serialized_participant_data._buffer = sdata;
+
+    DDS_Security_ParticipantBuiltinTopicData_free(local_participant_data);
+
+    return res;
+}
+
+static void
+release_local_identity(void)
+{
+    DDS_Security_SecurityException exception = {NULL, 0, 0};
+    DDS_Security_boolean success;
+
+    if (local_identity_handle != DDS_SECURITY_HANDLE_NIL) {
+        success = auth->return_identity_handle(auth, local_identity_handle, &exception);
+        if (!success) {
+            printf("return_identity_handle failed: %s\n", exception.message ? exception.message : "Error message missing");
+        }
+        reset_exception(&exception);
+        local_identity_handle = DDS_SECURITY_HANDLE_NIL;
+    }
+    DDS_Security_OctetSeq_deinit(&serialized_participant_data);
+}
+
+
+static X509 *
+load_certificate(
+   const char *data)
+{
+    X509 *cert = NULL;
+    BIO *bio;
+
+    bio = BIO_new_mem_buf((void *) data, -1);
+    if (!bio) {
+        return NULL;
+    }
+
+    cert = PEM_read_bio_X509(bio, NULL, NULL, NULL);
+
+    BIO_free(bio);
+
+    return cert;
+}
+
+static int
+get_adjusted_participant_guid(
+    X509 *cert,
+    const DDS_Security_GUID_t *candidate,
+    DDS_Security_GUID_t *adjusted)
+{
+    int result = 0;
+    unsigned char high[SHA256_DIGEST_LENGTH], low[SHA256_DIGEST_LENGTH];
+    unsigned char *subject;
+    DDS_Security_octet hb = 0x80;
+    X509_NAME *name;
+    unsigned char *tmp = NULL;
+    int i;
+    size_t sz;
+
+    name = X509_get_subject_name(cert);
+    sz = (size_t) i2d_X509_NAME(name, &tmp);
+    if (sz > 0) {
+        subject = ddsrt_malloc( sz);
+        memcpy(subject, tmp, sz);
+        OPENSSL_free(tmp);
+
+        SHA256(subject, sz, high);
+        SHA256(&candidate->prefix[0], sizeof(DDS_Security_GuidPrefix_t), low);
+
+        adjusted->entityId = candidate->entityId;
+        for (i = 0; i < 6; i++) {
+            adjusted->prefix[i] = hb | high[i]>>1;
+            hb = (unsigned char) ( high[i]<<7 );
+        }
+        for (i = 0; i < 6; i++) {
+            adjusted->prefix[i+6] = low[i];
+        }
+        ddsrt_free(subject);
+        result = 1;
+    }
+
+    return result;
+}
+
+static int
+set_dh_public_key(
+    const char *keystr,
+    unsigned char **pubkey,
+    size_t *size)
+{
+    int r = 0;
+    BIO *bio = NULL;
+    EVP_PKEY *pkey;
+    DH *dhkey;
+    unsigned char *buffer = NULL;
+    ASN1_INTEGER *asn1int;
+
+    *pubkey = NULL;
+
+
+    /* load certificate in buffer */
+    bio = BIO_new_mem_buf((void *) keystr, -1);
+    if (!bio) {
+        char *msg = get_openssl_error();
+        r = -1;
+        printf("BIO_new_mem_buf failed: %s", msg);
+        ddsrt_free(msg);
+        goto fail_alloc_bio;
+    }
+
+    pkey = PEM_read_bio_PUBKEY(bio, NULL, NULL, NULL);
+    if (!pkey) {
+        char *msg = get_openssl_error();
+        r = -1;
+        printf("Failed to read public key: %s", msg);
+        ddsrt_free(msg);
+        goto fail_key_read;
+    }
+
+    dhkey = EVP_PKEY_get1_DH(pkey);
+    if (!dhkey) {
+        char *msg = get_openssl_error();
+        r = -1;
+        printf("Failed to get DH key from PKEY: %s", msg);
+        ddsrt_free(msg);
+        goto fail_get_dhkey;
+    }
+
+    asn1int = BN_to_ASN1_INTEGER(dh_get_public_key(dhkey), NULL);
+
+    if (!asn1int) {
+        char *msg = get_openssl_error();
+        r = -1;
+        printf("Failed to convert DH key to ASN1 integer: %s", msg);
+        ddsrt_free(msg);
+        goto fail_get_pubkey;
+    }
+
+    *size = (size_t)i2d_ASN1_INTEGER(asn1int, &buffer);
+
+    *pubkey = ddsrt_malloc(*size);
+    memcpy(*pubkey, buffer, *size);
+    ddsrt_free(buffer);
+
+    ASN1_INTEGER_free(asn1int);
+
+fail_get_pubkey:
+    DH_free(dhkey);
+fail_get_dhkey:
+    EVP_PKEY_free(pkey);
+fail_key_read:
+    BIO_free(bio);
+fail_alloc_bio:
+    return r;
+}
+
+
+static int
+set_dh_keys(void)
+{
+    int r;
+
+    r =  set_dh_public_key(diffie_hellman_pubkey, &dh_pubkey_modp_2048_value, &dh_pubkey_modp_2048_length);
+    if (r) {
+        invalid_dh_pubkey_modp_2048_value = ddsrt_malloc(dh_pubkey_modp_2048_length);
+        memcpy(invalid_dh_pubkey_modp_2048_value, dh_pubkey_modp_2048_value, dh_pubkey_modp_2048_length);
+        invalid_dh_pubkey_modp_2048_value[0] = 0x8;
+    }
+    return r;
+}
+
+
+static int
+validate_remote_identities (const char *remote_id_certificate)
+{
+    int res = 0;
+    DDS_Security_ValidationResult_t result;
+    DDS_Security_IdentityToken remote_identity_token;
+    static DDS_Security_AuthRequestMessageToken local_auth_request_token = DDS_SECURITY_TOKEN_INIT;
+    DDS_Security_GUID_t guid1;
+    DDS_Security_GUID_t guid2;
+    DDS_Security_SecurityException exception = {NULL, 0, 0};
+    DDS_Security_GuidPrefix_t prefix1 = {0xa0, 0xa1, 0xa2, 0xa3, 0xa4, 0xa5, 0xa6, 0xa7, 0xa8, 0xa9, 0xaa, 0xab};
+    DDS_Security_GuidPrefix_t prefix2 = {0xc0, 0xc1, 0xc2, 0xc3, 0xc4, 0xc5, 0xc6, 0xc7, 0xc8, 0xc9, 0xca, 0xcb};
+    DDS_Security_EntityId_t entityId = {{0xb0,0xb1,0xb2},0x1};
+    X509 *cert;
+
+    memcpy(&guid1.prefix, &prefix1, sizeof(prefix1));
+    memcpy(&guid1.entityId, &entityId, sizeof(entityId));
+    memcpy(&guid2.prefix, &prefix2, sizeof(prefix2));
+    memcpy(&guid2.entityId, &entityId, sizeof(entityId));
+
+    if (local_identity_handle == DDS_SECURITY_HANDLE_NIL) {
+        return -1;
+    }
+
+    cert = load_certificate(remote_id_certificate);
+    if (!cert) {
+        return -1;
+    }
+
+    if (!get_adjusted_participant_guid(cert, &guid1, &remote_participant_guid1)) {
+        X509_free(cert);
+        return -1;
+    }
+
+    if (!get_adjusted_participant_guid(cert, &guid2, &remote_participant_guid2)) {
+        X509_free(cert);
+        return -1;
+    }
+
+    X509_free(cert);
+
+    initialize_identity_token(&remote_identity_token, RSA_2048_ALGORITHM_NAME, RSA_2048_ALGORITHM_NAME);
+
+    result = auth->validate_remote_identity(
+                auth,
+                &remote_identity_handle1,
+                &g_local_auth_request_token,
+                NULL,
+                local_identity_handle,
+                &remote_identity_token,
+                &remote_participant_guid1,
+                &exception);
+
+    if ((result != DDS_SECURITY_VALIDATION_PENDING_HANDSHAKE_REQUEST) &&
+        (result != DDS_SECURITY_VALIDATION_PENDING_HANDSHAKE_MESSAGE)) {
+        res = -1;
+        printf("validate_remote_identity_failed: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+
+    reset_exception(&exception);
+
+    fill_auth_request_token(&g_remote_auth_request_token);
+
+    result = auth->validate_remote_identity(
+                auth,
+                &remote_identity_handle2,
+                &local_auth_request_token,
+                &g_remote_auth_request_token,
+                local_identity_handle,
+                &remote_identity_token,
+                &remote_participant_guid2,
+                &exception);
+
+    if ((result != DDS_SECURITY_VALIDATION_PENDING_HANDSHAKE_REQUEST) &&
+        (result != DDS_SECURITY_VALIDATION_PENDING_HANDSHAKE_MESSAGE)) {
+        res = -1;
+        printf("validate_remote_identity_failed: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+
+    reset_exception(&exception);
+
+    deinitialize_identity_token(&remote_identity_token);
+    DDS_Security_DataHolder_deinit(&local_auth_request_token);
+
+    remote_participant_data1 = DDS_Security_ParticipantBuiltinTopicData_alloc();
+    memcpy(&remote_participant_data1->key[0], &remote_participant_guid1, 12);
+    remote_participant_data1->key[0] = fromBE4u(remote_participant_data1->key[0]);
+    remote_participant_data1->key[1] = fromBE4u(remote_participant_data1->key[1]);
+    remote_participant_data1->key[2] = fromBE4u(remote_participant_data1->key[2]);
+
+
+    initialize_identity_token(&remote_participant_data1->identity_token, RSA_2048_ALGORITHM_NAME, RSA_2048_ALGORITHM_NAME);
+    initialize_permissions_token(&remote_participant_data1->permissions_token, RSA_2048_ALGORITHM_NAME);
+
+    remote_participant_data1->security_info.participant_security_attributes = 0x01;
+    remote_participant_data1->security_info.plugin_participant_security_attributes = 0x02;
+
+    remote_participant_data2 = DDS_Security_ParticipantBuiltinTopicData_alloc();
+    memcpy(&remote_participant_data2->key[0], &remote_participant_guid2, 12);
+    remote_participant_data2->key[0] = fromBE4u(remote_participant_data2->key[0]);
+    remote_participant_data2->key[1] = fromBE4u(remote_participant_data2->key[1]);
+    remote_participant_data2->key[2] = fromBE4u(remote_participant_data2->key[2]);
+
+    initialize_identity_token(&remote_participant_data2->identity_token, RSA_2048_ALGORITHM_NAME, RSA_2048_ALGORITHM_NAME);
+    initialize_permissions_token(&remote_participant_data2->permissions_token, RSA_2048_ALGORITHM_NAME);
+
+    remote_participant_data2->security_info.participant_security_attributes = 0x01;
+    remote_participant_data2->security_info.plugin_participant_security_attributes = 0x02;
+
+    remote_participant_data3 = DDS_Security_ParticipantBuiltinTopicData_alloc();
+    memcpy(&remote_participant_data3->key[0], &candidate_participant_guid, 12);
+
+    initialize_identity_token(&remote_participant_data3->identity_token, RSA_2048_ALGORITHM_NAME, RSA_2048_ALGORITHM_NAME);
+    initialize_permissions_token(&remote_participant_data3->permissions_token, RSA_2048_ALGORITHM_NAME);
+
+    remote_participant_data2->security_info.participant_security_attributes = 0x01;
+    remote_participant_data2->security_info.plugin_participant_security_attributes = 0x02;
+
+    challenge1 = find_binary_property(&g_local_auth_request_token, AUTH_REQUEST_TOKEN_FUTURE_PROP_NAME);
+    challenge2 = find_binary_property(&g_remote_auth_request_token, AUTH_REQUEST_TOKEN_FUTURE_PROP_NAME);
+
+    return res;
+}
+
+static void
+release_remote_identities(void)
+{
+    DDS_Security_SecurityException exception = {NULL, 0, 0};
+    DDS_Security_boolean success;
+
+    if (remote_identity_handle1 != DDS_SECURITY_HANDLE_NIL) {
+        success = auth->return_identity_handle(auth, remote_identity_handle1, &exception);
+        if (!success) {
+            printf("return_identity_handle failed: %s\n", exception.message ? exception.message : "Error message missing");
+        }
+        reset_exception(&exception);
+        remote_identity_handle1 = DDS_SECURITY_HANDLE_NIL;
+    }
+    if (remote_identity_handle2 != DDS_SECURITY_HANDLE_NIL) {
+        success = auth->return_identity_handle(auth, remote_identity_handle2, &exception);
+        if (!success) {
+            printf("return_identity_handle failed: %s\n", exception.message ? exception.message : "Error message missing");
+        }
+        reset_exception(&exception);
+        remote_identity_handle2 = DDS_SECURITY_HANDLE_NIL;
+    }
+
+    DDS_Security_DataHolder_deinit(&g_local_auth_request_token);
+    DDS_Security_DataHolder_deinit(&g_remote_auth_request_token);
+
+    DDS_Security_ParticipantBuiltinTopicData_free(remote_participant_data1);
+    DDS_Security_ParticipantBuiltinTopicData_free(remote_participant_data2);
+    DDS_Security_ParticipantBuiltinTopicData_free(remote_participant_data3);
+    remote_participant_data1 = NULL;
+    remote_participant_data2 = NULL;
+    remote_participant_data3 = NULL;
+}
+
+static void init_testcase(void)
+{
+
+    int res = 0;
+    /* Only need the authentication plugin. */
+    plugins = load_plugins(NULL   /* Access Control */,
+                           &auth  /* Authentication */,
+                           NULL   /* Cryptograpy    */);
+
+    if (plugins) {
+        res = validate_local_identity( NULL );
+        if (res == 0) {
+            res = validate_remote_identities( remote_identity_certificate );
+        }
+        if (res == 0){
+            res = set_dh_keys();
+        }
+    } else {
+        res = -1;
+    }
+
+    CU_ASSERT_FATAL( res == 0 );
+}
+
+static void fini_testcase(void)
+{
+    release_local_identity();
+    release_remote_identities();
+    unload_plugins(plugins);
+    ddsrt_free(invalid_dh_pubkey_modp_2048_value);
+    ddsrt_free(dh_pubkey_modp_2048_value);
+
+}
+
+
+
+
+static bool
+compare_octet_seq(
+    const DDS_Security_OctetSeq *seq1,
+    const DDS_Security_OctetSeq *seq2)
+{
+    int r;
+    if (seq1 && seq2) {
+        r = (int)(seq2->_length - seq1->_length);
+        if (r == 0) {
+            r = memcmp(seq1->_buffer, seq2->_buffer, seq1->_length);
+        }
+    } else if (seq1 == seq2) {
+        r = 0;
+    } else {
+        r = (seq2 > seq1) ? 1 : -1;
+    }
+    return r;
+}
+
+static bool
+valid_c_id_property(
+    const char *certificate,
+    const DDS_Security_OctetSeq *value)
+{
+    if (value->_length == 0) {
+        CU_FAIL("c.id has no value");
+        return false;
+    }
+    if (strncmp(certificate, (const char *)value->_buffer, value->_length) != 0) {
+        return false;
+    }
+    return true;
+}
+
+static bool
+valid_string_value(
+    const char *expected,
+    const DDS_Security_OctetSeq *value)
+{
+    size_t len = strlen(expected) + 1;
+
+    if (strncmp(expected, (const char *)value->_buffer, len) != 0) {
+        return false;
+    }
+
+    return true;
+}
+
+static void
+serializer_participant_data(
+    DDS_Security_ParticipantBuiltinTopicData *pdata,
+    unsigned char **buffer,
+    size_t *size)
+{
+    DDS_Security_Serializer serializer;
+    serializer = DDS_Security_Serializer_new(1024, 1024);
+
+    DDD_Security_Serialize_ParticipantBuiltinTopicData(serializer, pdata);
+    DDS_Security_Serializer_buffer(serializer, buffer, size);
+    DDS_Security_Serializer_free(serializer);
+}
+
+
+static void
+set_binary_property_value(
+     DDS_Security_BinaryProperty_t *bp,
+     const char *name,
+     const unsigned char *data,
+     size_t length)
+{
+    assert(bp);
+    assert(name);
+    assert(data);
+
+    bp->name = ddsrt_strdup(name);
+    bp->value._maximum = bp->value._length = (DDS_Security_unsigned_long) length;
+    if (length) {
+        bp->value._buffer = ddsrt_malloc(length);
+        memcpy(bp->value._buffer, data, length);
+    } else {
+        bp->value._buffer = NULL;
+    }
+}
+
+static void
+set_binary_property_string(
+     DDS_Security_BinaryProperty_t *bp,
+     const char *name,
+     const char *data)
+{
+    size_t length;
+
+    assert(bp);
+    assert(name);
+    assert(data);
+
+    length = strlen(data) + 1;
+    set_binary_property_value(bp, name, (const unsigned char *)data, length);
+}
+
+static void
+fill_handshake_message_token(
+    DDS_Security_HandshakeMessageToken *token,
+    DDS_Security_ParticipantBuiltinTopicData *pdata,
+    const char *certificate,
+    const char *dsign,
+    const char *kagree,
+    const unsigned char *diffie_hellman,
+    const size_t diffie_hellman_size,
+    const unsigned char *challengeData,
+    size_t challengeDataSize)
+{
+    DDS_Security_BinaryProperty_t *tokens;
+    DDS_Security_BinaryProperty_t *c_id;
+    DDS_Security_BinaryProperty_t *c_perm;
+    DDS_Security_BinaryProperty_t *c_pdata;
+    DDS_Security_BinaryProperty_t *c_dsign_algo;
+    DDS_Security_BinaryProperty_t *c_kagree_algo;
+    DDS_Security_BinaryProperty_t *hash_c1;
+    DDS_Security_BinaryProperty_t *dh1;
+    DDS_Security_BinaryProperty_t *challenge;
+    unsigned char *serialized_local_participant_data;
+    size_t serialized_local_participant_data_size;
+    unsigned char hash[32];
+
+    serializer_participant_data(pdata, &serialized_local_participant_data, &serialized_local_participant_data_size);
+
+    tokens = DDS_Security_BinaryPropertySeq_allocbuf(8);
+    c_id = &tokens[0];
+    c_perm = &tokens[1];
+    c_pdata = &tokens[2];
+    c_dsign_algo = &tokens[3];
+    c_kagree_algo = &tokens[4];
+    hash_c1 = &tokens[5];
+    dh1 = &tokens[6];
+    challenge = &tokens[7];
+
+    /* Store the Identity Certificate associated with the local identify in c.id property */
+    if (certificate) {
+        set_binary_property_string(c_id, "c.id", certificate);
+    } else {
+        set_binary_property_string(c_id, "c.idx", "rubbish");
+    }
+
+    /* Store the permission document in the c.perm property */
+    set_binary_property_string(c_perm, "c.perm", "permissions_document");
+
+    /* Store the provided local_participant_data in the c.pdata property */
+    set_binary_property_value(c_pdata, "c.pdata", serialized_local_participant_data, serialized_local_participant_data_size);
+
+    /* Set the used signing algorithm descriptor in c.dsign_algo */
+    if (dsign) {
+        set_binary_property_string(c_dsign_algo, "c.dsign_algo", dsign);
+    } else {
+        set_binary_property_string(c_dsign_algo, "c.dsign_algox", "rubbish");
+    }
+
+    /* Set the used key algorithm descriptor in c.kagree_algo */
+    if (kagree) {
+        set_binary_property_string(c_kagree_algo, "c.kagree_algo", kagree);
+    } else {
+        set_binary_property_string(c_kagree_algo, "c.kagree_algox", "rubbish");
+    }
+
+    /* Calculate the hash_c1 */
+    {
+        DDS_Security_BinaryPropertySeq bseq;
+        DDS_Security_Serializer serializer;
+        unsigned char *buffer;
+        size_t size;
+
+        bseq._length = bseq._maximum = 5;
+        bseq._buffer = tokens;
+
+        serializer = DDS_Security_Serializer_new(1024, 1024);
+
+        DDS_Security_Serialize_BinaryPropertySeq(serializer, &bseq);
+        DDS_Security_Serializer_buffer(serializer, &buffer, &size);
+        SHA256(buffer, size, (unsigned char *)&hash);
+        ddsrt_free(buffer);
+        DDS_Security_Serializer_free(serializer);
+
+        set_binary_property_value(hash_c1, "hash_c1", (const unsigned char *) &hash, sizeof(hash));
+    }
+
+    /* Set the DH public key associated with the local participant in dh1 property */
+    if (diffie_hellman) {
+        set_binary_property_value(dh1, "dh1", diffie_hellman, diffie_hellman_size);
+    } else {
+        set_binary_property_string(dh1, "dh1x", "rubbish");
+    }
+
+    /* Set the challenge in challenge1 property */
+    if (challengeData) {
+        set_binary_property_value(challenge, "challenge1", challengeData, challengeDataSize);
+    } else {
+        set_binary_property_value(challenge, "challenge1x", challenge2->value._buffer, challenge2->value._length);
+    }
+
+    token->class_id = ddsrt_strdup(AUTH_HANDSHAKE_REQUEST_TOKEN_CLASS_ID);
+    token->binary_properties._length = token->binary_properties._maximum = 8;
+    token->binary_properties._buffer = tokens;
+
+    ddsrt_free(serialized_local_participant_data);
+}
+
+static void
+fill_handshake_message_token_default(
+    DDS_Security_HandshakeMessageToken *token,
+    DDS_Security_ParticipantBuiltinTopicData *pdata,
+    const unsigned char *challengeData,
+    unsigned int challengeDataSize)
+{
+    fill_handshake_message_token(
+            token, pdata, remote_identity_certificate,
+            AUTH_DSIGN_ALGO_RSA_NAME, AUTH_KAGREE_ALGO_RSA_NAME,
+            dh_pubkey_modp_2048_value, dh_pubkey_modp_2048_length, challengeData, challengeDataSize);
+}
+
+static void
+handshake_message_deinit(
+    DDS_Security_HandshakeMessageToken *token)
+{
+    DDS_Security_DataHolder_deinit(token);
+}
+
+static bool
+validate_handshake_token(
+    DDS_Security_HandshakeMessageToken *token,
+    const DDS_Security_OctetSeq *challenge_1,
+    const DDS_Security_OctetSeq *challenge_2)
+{
+    const DDS_Security_BinaryProperty_t *property;
+
+    if (!token->class_id || strcmp(token->class_id, AUTH_HANDSHAKE_REPLY_TOKEN_CLASS_ID) != 0) {
+        CU_FAIL("HandshakeMessageToken incorrect class_id");
+    } else if ((property = find_binary_property(token, "c.id")) == NULL) {
+        CU_FAIL("HandshakeMessageToken incorrect property 'c.id' not found");
+    } else if (!valid_c_id_property(&identity_certificate[6], &property->value)) {
+        CU_FAIL("HandshakeMessageToken incorrect property 'c.id' value is invalid");
+    } else if ((property = find_binary_property(token, "c.pdata")) == NULL) {
+        CU_FAIL("HandshakeMessageToken incorrect property 'c.pdata' not found");
+    } else if ((property = find_binary_property(token, "c.dsign_algo")) == NULL) {
+        CU_FAIL("HandshakeMessageToken incorrect property 'c.dsign_algo' not found");
+    } else if (!valid_string_value(AUTH_DSIGN_ALGO_RSA_NAME, &property->value)) {
+        CU_FAIL("HandshakeMessageToken incorrect property 'c.dsign_algo' incorrect value");
+    } else if ((property = find_binary_property(token, "c.kagree_algo")) == NULL) {
+        CU_FAIL("HandshakeMessageToken incorrect property 'c.kagree_algo' not found");
+    } else if (!valid_string_value(AUTH_KAGREE_ALGO_RSA_NAME, &property->value)) {
+        CU_FAIL("HandshakeMessageToken incorrect property 'c.kagree_algo' incorrect value");
+    } else if ((property = find_binary_property(token, "hash_c2")) == NULL) {
+         CU_FAIL("HandshakeMessageToken incorrect property 'hash_c2' not found");
+    } else if ((property = find_binary_property(token, "dh2")) == NULL) {
+        CU_FAIL("HandshakeMessageToken incorrect property 'dh2' not found");
+    } else if ((property = find_binary_property(token, "hash_c1")) == NULL) {
+        CU_FAIL("HandshakeMessageToken incorrect property 'hash_c1' not found");
+    } else if ((property = find_binary_property(token, "dh1")) == NULL) {
+        CU_FAIL("HandshakeMessageToken incorrect property 'dh1' not found");
+    } else if ((property = find_binary_property(token, "challenge1")) == NULL) {
+        CU_FAIL("HandshakeMessageToken incorrect property 'challenge1' not found");
+    } else if (challenge_1 && compare_octet_seq(challenge_1, &property->value) != 0) {
+        CU_FAIL("HandshakeMessageToken incorrect property 'challenge1' incorrect value");
+    } else if ((property = find_binary_property(token, "challenge2")) == NULL) {
+        CU_FAIL("HandshakeMessageToken incorrect property 'challenge2' not found");
+    } else if (challenge_2 && compare_octet_seq(challenge_2, &property->value) != 0) {
+        CU_FAIL("HandshakeMessageToken incorrect property 'challenge2' incorrect value");
+    } else {
+        return true;
+    }
+
+    return false;
+}
+
+CU_Test(ddssec_builtin_validate_begin_handshake_reply, happy_day,  .init = init_testcase, .fini = fini_testcase)
+{
+    DDS_Security_ValidationResult_t result;
+    DDS_Security_HandshakeHandle handshake_handle;
+    DDS_Security_HandshakeMessageToken handshake_token_in = DDS_SECURITY_TOKEN_INIT;
+    DDS_Security_HandshakeMessageToken handshake_token_out = DDS_SECURITY_TOKEN_INIT;
+    DDS_Security_SecurityException exception = {NULL, 0, 0};
+    DDS_Security_boolean success;
+
+    CU_ASSERT_FATAL (auth != NULL);
+    CU_ASSERT_FATAL (local_identity_handle != DDS_SECURITY_HANDLE_NIL);
+    CU_ASSERT_FATAL (remote_identity_handle1 != DDS_SECURITY_HANDLE_NIL);
+    CU_ASSERT_FATAL (remote_identity_handle2 != DDS_SECURITY_HANDLE_NIL);
+    CU_ASSERT_FATAL (auth->begin_handshake_reply != NULL);
+
+
+    fill_handshake_message_token_default(&handshake_token_in, remote_participant_data1, challenge2->value._buffer, challenge2->value._length);
+
+    result = auth->begin_handshake_reply(
+                    auth,
+                    &handshake_handle,
+                    &handshake_token_out,
+                    &handshake_token_in,
+                    remote_identity_handle2,
+                    local_identity_handle,
+                    &serialized_participant_data,
+                    &exception);
+
+    if (result != DDS_SECURITY_VALIDATION_PENDING_HANDSHAKE_MESSAGE) {
+        printf("begin_handshake_reply failed: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+
+    CU_ASSERT_FATAL(result == DDS_SECURITY_VALIDATION_PENDING_HANDSHAKE_MESSAGE);
+    CU_ASSERT(handshake_handle != DDS_SECURITY_HANDLE_NIL);
+    CU_ASSERT(validate_handshake_token(&handshake_token_out, &challenge2->value, NULL));
+
+    reset_exception(&exception);
+
+    success= auth->return_handshake_handle(auth, handshake_handle, &exception);
+    CU_ASSERT_TRUE (success);
+
+    if (!success) {
+        printf("return_handshake_handle failed: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+    reset_exception(&exception);
+
+    handshake_message_deinit(&handshake_token_in);
+    handshake_message_deinit(&handshake_token_out);
+}
+
+CU_Test(ddssec_builtin_validate_begin_handshake_reply,future_challenge,  .init = init_testcase, .fini = fini_testcase)
+
+{
+    DDS_Security_ValidationResult_t result;
+    DDS_Security_HandshakeHandle handshake_handle;
+    DDS_Security_HandshakeMessageToken handshake_token_in = DDS_SECURITY_TOKEN_INIT;
+    DDS_Security_HandshakeMessageToken handshake_token_out = DDS_SECURITY_TOKEN_INIT;
+    DDS_Security_SecurityException exception = {NULL, 0, 0};
+    DDS_Security_boolean success;
+
+    CU_ASSERT_FATAL (auth != NULL);
+    CU_ASSERT_FATAL (local_identity_handle != DDS_SECURITY_HANDLE_NIL);
+    CU_ASSERT_FATAL (remote_identity_handle1 != DDS_SECURITY_HANDLE_NIL);
+    CU_ASSERT_FATAL (remote_identity_handle2 != DDS_SECURITY_HANDLE_NIL);
+    CU_ASSERT_FATAL (auth->begin_handshake_reply != NULL);
+
+    fill_handshake_message_token_default(&handshake_token_in, remote_participant_data2, challenge2->value._buffer, challenge2->value._length);
+
+    result = auth->begin_handshake_reply(
+                    auth,
+                    &handshake_handle,
+                    &handshake_token_out,
+                    &handshake_token_in,
+                    remote_identity_handle1,
+                    local_identity_handle,
+                    &serialized_participant_data,
+                    &exception);
+
+    if (result != DDS_SECURITY_VALIDATION_PENDING_HANDSHAKE_MESSAGE) {
+        printf("begin_handshake_reply failed: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+
+    CU_ASSERT_FATAL(result == DDS_SECURITY_VALIDATION_PENDING_HANDSHAKE_MESSAGE);
+    CU_ASSERT(handshake_handle != DDS_SECURITY_HANDLE_NIL);
+    CU_ASSERT(validate_handshake_token(&handshake_token_out, &challenge2->value, &challenge1->value));
+
+    reset_exception(&exception);
+
+    success= auth->return_handshake_handle(auth, handshake_handle, &exception);
+    CU_ASSERT_TRUE (success);
+
+    if (!success) {
+        printf("return_handshake_handle failed: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+    reset_exception(&exception);
+
+    handshake_message_deinit(&handshake_token_in);
+    handshake_message_deinit(&handshake_token_out);
+
+    future_challenge_done = true;
+}
+
+
+CU_Test(ddssec_builtin_validate_begin_handshake_reply,invalid_arguments,  .init = init_testcase, .fini = fini_testcase)
+{
+    DDS_Security_ValidationResult_t result;
+    DDS_Security_HandshakeHandle handshake_handle;
+    DDS_Security_HandshakeMessageToken handshake_token_in = DDS_SECURITY_TOKEN_INIT;
+    DDS_Security_HandshakeMessageToken handshake_token_out = DDS_SECURITY_TOKEN_INIT;
+    DDS_Security_SecurityException exception = {NULL, 0, 0};
+    DDS_Security_OctetSeq serdata = DDS_SECURITY_SEQUENCE_INIT;
+
+    CU_ASSERT_FATAL (auth != NULL);
+    CU_ASSERT_FATAL (local_identity_handle != DDS_SECURITY_HANDLE_NIL);
+    CU_ASSERT_FATAL (remote_identity_handle1 != DDS_SECURITY_HANDLE_NIL);
+    CU_ASSERT_FATAL (remote_identity_handle2 != DDS_SECURITY_HANDLE_NIL);
+    CU_ASSERT_FATAL (auth->begin_handshake_reply != NULL);
+
+    fill_handshake_message_token_default(&handshake_token_in, remote_participant_data1, challenge1->value._buffer, challenge1->value._length);
+
+    result = auth->begin_handshake_reply(
+                       auth,
+                       NULL,
+                       &handshake_token_out,
+                       &handshake_token_in,
+                       remote_identity_handle1,
+                       local_identity_handle,
+                       &serialized_participant_data,
+                       &exception);
+
+    if (result != DDS_SECURITY_VALIDATION_OK) {
+        printf("begin_handshake_reply failed: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+    CU_ASSERT (result == DDS_SECURITY_VALIDATION_FAILED);
+    CU_ASSERT (exception.minor_code != 0);
+    CU_ASSERT (exception.message != NULL);
+    reset_exception(&exception);
+
+    result = auth->begin_handshake_reply(
+                     auth,
+                     &handshake_handle,
+                     NULL,
+                     &handshake_token_in,
+                     remote_identity_handle1,
+                     local_identity_handle,
+                     &serialized_participant_data,
+                     &exception);
+
+    if (result != DDS_SECURITY_VALIDATION_OK) {
+        printf("begin_handshake_reply failed: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+    CU_ASSERT (result == DDS_SECURITY_VALIDATION_FAILED);
+    CU_ASSERT (exception.minor_code != 0);
+    CU_ASSERT (exception.message != NULL);
+    reset_exception(&exception);
+
+    result = auth->begin_handshake_reply(
+                     auth,
+                     &handshake_handle,
+                     &handshake_token_out,
+                     NULL,
+                     remote_identity_handle1,
+                     local_identity_handle,
+                     &serialized_participant_data,
+                     &exception);
+
+    if (result != DDS_SECURITY_VALIDATION_OK) {
+        printf("begin_handshake_reply failed: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+    CU_ASSERT (result == DDS_SECURITY_VALIDATION_FAILED);
+    CU_ASSERT (exception.minor_code != 0);
+    CU_ASSERT (exception.message != NULL);
+    reset_exception(&exception);
+
+    result = auth->begin_handshake_reply(
+                     auth,
+                     &handshake_handle,
+                     &handshake_token_out,
+                     &handshake_token_in,
+                     0,
+                     local_identity_handle,
+                     &serialized_participant_data,
+                     &exception);
+
+     if (result != DDS_SECURITY_VALIDATION_OK) {
+         printf("begin_handshake_reply failed: %s\n", exception.message ? exception.message : "Error message missing");
+     }
+     CU_ASSERT (result == DDS_SECURITY_VALIDATION_FAILED);
+     CU_ASSERT (exception.minor_code != 0);
+     CU_ASSERT (exception.message != NULL);
+     reset_exception(&exception);
+
+     result = auth->begin_handshake_reply(
+                      auth,
+                      &handshake_handle,
+                      &handshake_token_out,
+                      &handshake_token_in,
+                      remote_identity_handle1,
+                      0,
+                      &serialized_participant_data,
+                      &exception);
+
+     if (result != DDS_SECURITY_VALIDATION_OK) {
+         printf("begin_handshake_reply failed: %s\n", exception.message ? exception.message : "Error message missing");
+     }
+     CU_ASSERT (result == DDS_SECURITY_VALIDATION_FAILED);
+     CU_ASSERT (exception.minor_code != 0);
+     CU_ASSERT (exception.message != NULL);
+     reset_exception(&exception);
+
+     result = auth->begin_handshake_reply(
+                     auth,
+                     &handshake_handle,
+                     &handshake_token_out,
+                     &handshake_token_in,
+                     remote_identity_handle1,
+                     local_identity_handle,
+                     NULL,
+                     &exception);
+
+     if (result != DDS_SECURITY_VALIDATION_OK) {
+         printf("begin_handshake_reply failed: %s\n", exception.message ? exception.message : "Error message missing");
+     }
+     CU_ASSERT (result == DDS_SECURITY_VALIDATION_FAILED);
+     CU_ASSERT (exception.minor_code != 0);
+     CU_ASSERT (exception.message != NULL);
+     reset_exception(&exception);
+
+     result = auth->begin_handshake_reply(
+                     auth,
+                     &handshake_handle,
+                     &handshake_token_out,
+                     &handshake_token_in,
+                     remote_identity_handle1,
+                     local_identity_handle,
+                     &serdata,
+                     &exception);
+
+     if (result != DDS_SECURITY_VALIDATION_OK) {
+         printf("begin_handshake_reply failed: %s\n", exception.message ? exception.message : "Error message missing");
+     }
+     CU_ASSERT (result == DDS_SECURITY_VALIDATION_FAILED);
+     CU_ASSERT (exception.minor_code != 0);
+     CU_ASSERT (exception.message != NULL);
+     reset_exception(&exception);
+
+     handshake_message_deinit(&handshake_token_in);
+}
+
+
+CU_Test(ddssec_builtin_validate_begin_handshake_reply,invalid_certificate,  .init = init_testcase, .fini = fini_testcase)
+{
+    DDS_Security_ValidationResult_t result;
+    DDS_Security_HandshakeHandle handshake_handle;
+    DDS_Security_HandshakeMessageToken handshake_token_in = DDS_SECURITY_TOKEN_INIT;
+    DDS_Security_HandshakeMessageToken handshake_token_out = DDS_SECURITY_TOKEN_INIT;
+    DDS_Security_SecurityException exception = {NULL, 0, 0};
+
+    CU_ASSERT_FATAL (auth != NULL);
+    CU_ASSERT_FATAL (local_identity_handle != DDS_SECURITY_HANDLE_NIL);
+    CU_ASSERT_FATAL (remote_identity_handle1 != DDS_SECURITY_HANDLE_NIL);
+    CU_ASSERT_FATAL (remote_identity_handle2 != DDS_SECURITY_HANDLE_NIL);
+    CU_ASSERT_FATAL (auth->begin_handshake_reply != NULL);
+
+    fill_handshake_message_token(
+            &handshake_token_in, remote_participant_data1, unrelated_identity,
+            AUTH_DSIGN_ALGO_RSA_NAME, AUTH_KAGREE_ALGO_RSA_NAME,
+            dh_pubkey_modp_2048_value, dh_pubkey_modp_2048_length, challenge2->value._buffer, challenge2->value._length);
+
+    result = auth->begin_handshake_reply(
+                    auth,
+                    &handshake_handle,
+                    &handshake_token_out,
+                    &handshake_token_in,
+                    remote_identity_handle2,
+                    local_identity_handle,
+                    &serialized_participant_data,
+                    &exception);
+
+    if (result == DDS_SECURITY_VALIDATION_OK) {
+        printf("begin_handshake_reply failed: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+
+    CU_ASSERT_FATAL(result != DDS_SECURITY_VALIDATION_OK);
+    CU_ASSERT (exception.minor_code != 0);
+    CU_ASSERT (exception.message != NULL);
+
+    reset_exception(&exception);
+    handshake_message_deinit(&handshake_token_in);
+
+    fill_handshake_message_token(
+             &handshake_token_in, remote_participant_data1, NULL,
+             AUTH_DSIGN_ALGO_RSA_NAME, AUTH_KAGREE_ALGO_RSA_NAME,
+             dh_pubkey_modp_2048_value, dh_pubkey_modp_2048_length, challenge2->value._buffer, challenge2->value._length);
+
+    result = auth->begin_handshake_reply(
+                    auth,
+                    &handshake_handle,
+                    &handshake_token_out,
+                    &handshake_token_in,
+                    remote_identity_handle2,
+                    local_identity_handle,
+                    &serialized_participant_data,
+                    &exception);
+
+    if (result == DDS_SECURITY_VALIDATION_OK) {
+        printf("begin_handshake_reply failed: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+
+    CU_ASSERT_FATAL(result != DDS_SECURITY_VALIDATION_OK);
+    CU_ASSERT (exception.minor_code != 0);
+    CU_ASSERT (exception.message != NULL);
+
+    reset_exception(&exception);
+
+    handshake_message_deinit(&handshake_token_in);
+}
+
+CU_Test(ddssec_builtin_validate_begin_handshake_reply,invalid_participant_data ,  .init = init_testcase, .fini = fini_testcase)
+{
+    DDS_Security_ValidationResult_t result;
+    DDS_Security_HandshakeHandle handshake_handle;
+    DDS_Security_HandshakeMessageToken handshake_token_in = DDS_SECURITY_TOKEN_INIT;
+    DDS_Security_HandshakeMessageToken handshake_token_out = DDS_SECURITY_TOKEN_INIT;
+    DDS_Security_SecurityException exception = {NULL, 0, 0};
+    DDS_Security_BinaryProperty_t *property;
+
+    CU_ASSERT_FATAL (auth != NULL);
+    CU_ASSERT_FATAL (local_identity_handle != DDS_SECURITY_HANDLE_NIL);
+    CU_ASSERT_FATAL (remote_identity_handle1 != DDS_SECURITY_HANDLE_NIL);
+    CU_ASSERT_FATAL (remote_identity_handle2 != DDS_SECURITY_HANDLE_NIL);
+    CU_ASSERT_FATAL (auth->begin_handshake_reply != NULL);
+
+    fill_handshake_message_token(
+            &handshake_token_in, remote_participant_data3, remote_identity_certificate,
+            AUTH_DSIGN_ALGO_RSA_NAME, AUTH_KAGREE_ALGO_RSA_NAME,
+            dh_pubkey_modp_2048_value, dh_pubkey_modp_2048_length, challenge2->value._buffer, challenge2->value._length);
+
+    result = auth->begin_handshake_reply(
+                    auth,
+                    &handshake_handle,
+                    &handshake_token_out,
+                    &handshake_token_in,
+                    remote_identity_handle2,
+                    local_identity_handle,
+                    &serialized_participant_data,
+                    &exception);
+
+    if (result == DDS_SECURITY_VALIDATION_OK) {
+        printf("begin_handshake_reply failed: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+
+    CU_ASSERT_FATAL(result != DDS_SECURITY_VALIDATION_OK);
+    CU_ASSERT (exception.minor_code != 0);
+    CU_ASSERT (exception.message != NULL);
+
+    reset_exception(&exception);
+
+    handshake_message_deinit(&handshake_token_in);
+
+    fill_handshake_message_token(
+            &handshake_token_in, remote_participant_data1, remote_identity_certificate,
+            AUTH_DSIGN_ALGO_RSA_NAME, AUTH_KAGREE_ALGO_RSA_NAME,
+            dh_pubkey_modp_2048_value, dh_pubkey_modp_2048_length, challenge2->value._buffer, challenge2->value._length);
+
+    property = find_binary_property(&handshake_token_in, "c.pdata");
+    CU_ASSERT_FATAL(property != NULL);
+
+    ddsrt_free(property->name);
+    property->name = ddsrt_strdup("c.pdatax");
+
+    result = auth->begin_handshake_reply(
+                    auth,
+                    &handshake_handle,
+                    &handshake_token_out,
+                    &handshake_token_in,
+                    remote_identity_handle2,
+                    local_identity_handle,
+                    &serialized_participant_data,
+                    &exception);
+
+    if (result == DDS_SECURITY_VALIDATION_OK) {
+        printf("begin_handshake_reply failed: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+
+    CU_ASSERT_FATAL(result != DDS_SECURITY_VALIDATION_OK);
+    CU_ASSERT (exception.minor_code != 0);
+    CU_ASSERT (exception.message != NULL);
+
+    reset_exception(&exception);
+
+    handshake_message_deinit(&handshake_token_in);
+}
+
+
+CU_Test(ddssec_builtin_validate_begin_handshake_reply,invalid_dsign_algo ,  .init = init_testcase, .fini = fini_testcase)
+{
+    DDS_Security_ValidationResult_t result;
+    DDS_Security_HandshakeHandle handshake_handle;
+    DDS_Security_HandshakeMessageToken handshake_token_in = DDS_SECURITY_TOKEN_INIT;
+    DDS_Security_HandshakeMessageToken handshake_token_out = DDS_SECURITY_TOKEN_INIT;
+    DDS_Security_SecurityException exception = {NULL, 0, 0};
+
+    CU_ASSERT_FATAL (auth != NULL);
+    CU_ASSERT_FATAL (local_identity_handle != DDS_SECURITY_HANDLE_NIL);
+    CU_ASSERT_FATAL (remote_identity_handle1 != DDS_SECURITY_HANDLE_NIL);
+    CU_ASSERT_FATAL (remote_identity_handle2 != DDS_SECURITY_HANDLE_NIL);
+    CU_ASSERT_FATAL (auth->begin_handshake_reply != NULL);
+
+    fill_handshake_message_token(
+            &handshake_token_in, remote_participant_data1, remote_identity_certificate,
+            "RSASSA-PSS-SHA128", AUTH_KAGREE_ALGO_RSA_NAME,
+            dh_pubkey_modp_2048_value, dh_pubkey_modp_2048_length, challenge2->value._buffer, challenge2->value._length);
+
+    result = auth->begin_handshake_reply(
+                    auth,
+                    &handshake_handle,
+                    &handshake_token_out,
+                    &handshake_token_in,
+                    remote_identity_handle2,
+                    local_identity_handle,
+                    &serialized_participant_data,
+                    &exception);
+
+    if (result == DDS_SECURITY_VALIDATION_OK) {
+        printf("begin_handshake_reply failed: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+
+    CU_ASSERT_FATAL(result != DDS_SECURITY_VALIDATION_OK);
+    CU_ASSERT (exception.minor_code != 0);
+    CU_ASSERT (exception.message != NULL);
+
+    reset_exception(&exception);
+
+    handshake_message_deinit(&handshake_token_in);
+
+    fill_handshake_message_token(
+             &handshake_token_in, remote_participant_data1, remote_identity_certificate,
+             NULL, AUTH_KAGREE_ALGO_RSA_NAME,
+             dh_pubkey_modp_2048_value, dh_pubkey_modp_2048_length, challenge2->value._buffer, challenge2->value._length);
+
+     result = auth->begin_handshake_reply(
+                     auth,
+                     &handshake_handle,
+                     &handshake_token_out,
+                     &handshake_token_in,
+                     remote_identity_handle2,
+                     local_identity_handle,
+                     &serialized_participant_data,
+                     &exception);
+
+     if (result == DDS_SECURITY_VALIDATION_OK) {
+         printf("begin_handshake_reply failed: %s\n", exception.message ? exception.message : "Error message missing");
+     }
+
+     CU_ASSERT_FATAL(result != DDS_SECURITY_VALIDATION_OK);
+     CU_ASSERT (exception.minor_code != 0);
+     CU_ASSERT (exception.message != NULL);
+
+     reset_exception(&exception);
+
+     handshake_message_deinit(&handshake_token_in);
+}
+
+CU_Test(ddssec_builtin_validate_begin_handshake_reply,invalid_kagree_algo ,  .init = init_testcase, .fini = fini_testcase)
+{
+    DDS_Security_ValidationResult_t result;
+    DDS_Security_HandshakeHandle handshake_handle;
+    DDS_Security_HandshakeMessageToken handshake_token_in = DDS_SECURITY_TOKEN_INIT;
+    DDS_Security_HandshakeMessageToken handshake_token_out = DDS_SECURITY_TOKEN_INIT;
+    DDS_Security_SecurityException exception = {NULL, 0, 0};
+
+    CU_ASSERT_FATAL (auth != NULL);
+    CU_ASSERT_FATAL (local_identity_handle != DDS_SECURITY_HANDLE_NIL);
+    CU_ASSERT_FATAL (remote_identity_handle1 != DDS_SECURITY_HANDLE_NIL);
+    CU_ASSERT_FATAL (remote_identity_handle2 != DDS_SECURITY_HANDLE_NIL);
+    CU_ASSERT_FATAL (auth->begin_handshake_reply != NULL);
+
+    fill_handshake_message_token(
+            &handshake_token_in, remote_participant_data1, remote_identity_certificate,
+            AUTH_DSIGN_ALGO_RSA_NAME, "DH+MODP-2048-128",
+            dh_pubkey_modp_2048_value, dh_pubkey_modp_2048_length, challenge2->value._buffer, challenge2->value._length);
+
+    result = auth->begin_handshake_reply(
+                    auth,
+                    &handshake_handle,
+                    &handshake_token_out,
+                    &handshake_token_in,
+                    remote_identity_handle2,
+                    local_identity_handle,
+                    &serialized_participant_data,
+                    &exception);
+
+    if (result == DDS_SECURITY_VALIDATION_OK) {
+        printf("begin_handshake_reply failed: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+
+    CU_ASSERT_FATAL(result != DDS_SECURITY_VALIDATION_OK);
+    CU_ASSERT (exception.minor_code != 0);
+    CU_ASSERT (exception.message != NULL);
+
+    reset_exception(&exception);
+
+    handshake_message_deinit(&handshake_token_in);
+
+    fill_handshake_message_token(
+             &handshake_token_in, remote_participant_data1, remote_identity_certificate,
+             AUTH_DSIGN_ALGO_RSA_NAME, NULL,
+             dh_pubkey_modp_2048_value, dh_pubkey_modp_2048_length, challenge2->value._buffer, challenge2->value._length);
+
+     result = auth->begin_handshake_reply(
+                     auth,
+                     &handshake_handle,
+                     &handshake_token_out,
+                     &handshake_token_in,
+                     remote_identity_handle2,
+                     local_identity_handle,
+                     &serialized_participant_data,
+                     &exception);
+
+     if (result == DDS_SECURITY_VALIDATION_OK) {
+         printf("begin_handshake_reply failed: %s\n", exception.message ? exception.message : "Error message missing");
+     }
+
+     CU_ASSERT_FATAL(result != DDS_SECURITY_VALIDATION_OK);
+     CU_ASSERT (exception.minor_code != 0);
+     CU_ASSERT (exception.message != NULL);
+
+     reset_exception(&exception);
+
+     handshake_message_deinit(&handshake_token_in);
+}
+
+CU_Test(ddssec_builtin_validate_begin_handshake_reply,invalid_diffie_hellman ,  .init = init_testcase, .fini = fini_testcase)
+{
+    DDS_Security_ValidationResult_t result;
+    DDS_Security_HandshakeHandle handshake_handle;
+    DDS_Security_HandshakeMessageToken handshake_token_in = DDS_SECURITY_TOKEN_INIT;
+    DDS_Security_HandshakeMessageToken handshake_token_out = DDS_SECURITY_TOKEN_INIT;
+    DDS_Security_SecurityException exception = {NULL, 0, 0};
+
+    CU_ASSERT_FATAL (auth != NULL);
+    CU_ASSERT_FATAL (local_identity_handle != DDS_SECURITY_HANDLE_NIL);
+    CU_ASSERT_FATAL (remote_identity_handle1 != DDS_SECURITY_HANDLE_NIL);
+    CU_ASSERT_FATAL (remote_identity_handle2 != DDS_SECURITY_HANDLE_NIL);
+    CU_ASSERT_FATAL (auth->begin_handshake_reply != NULL);
+
+    fill_handshake_message_token(
+            &handshake_token_in, remote_participant_data1, remote_identity_certificate,
+            AUTH_DSIGN_ALGO_RSA_NAME, AUTH_KAGREE_ALGO_RSA_NAME,
+            invalid_dh_pubkey_modp_2048_value, dh_pubkey_modp_2048_length, challenge2->value._buffer, challenge2->value._length);
+
+    result = auth->begin_handshake_reply(
+                    auth,
+                    &handshake_handle,
+                    &handshake_token_out,
+                    &handshake_token_in,
+                    remote_identity_handle2,
+                    local_identity_handle,
+                    &serialized_participant_data,
+                    &exception);
+
+    if (result == DDS_SECURITY_VALIDATION_OK) {
+        printf("begin_handshake_reply failed: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+
+    CU_ASSERT_FATAL(result != DDS_SECURITY_VALIDATION_OK);
+    CU_ASSERT (exception.minor_code != 0);
+    CU_ASSERT (exception.message != NULL);
+
+    reset_exception(&exception);
+
+    handshake_message_deinit(&handshake_token_in);
+
+    fill_handshake_message_token(
+             &handshake_token_in, remote_participant_data1, remote_identity_certificate,
+             AUTH_DSIGN_ALGO_RSA_NAME, AUTH_KAGREE_ALGO_RSA_NAME,
+             NULL, 0, challenge2->value._buffer, challenge2->value._length);
+
+     result = auth->begin_handshake_reply(
+                     auth,
+                     &handshake_handle,
+                     &handshake_token_out,
+                     &handshake_token_in,
+                     remote_identity_handle2,
+                     local_identity_handle,
+                     &serialized_participant_data,
+                     &exception);
+
+     if (result == DDS_SECURITY_VALIDATION_OK) {
+         printf("begin_handshake_reply failed: %s\n", exception.message ? exception.message : "Error message missing");
+     }
+
+     CU_ASSERT_FATAL(result != DDS_SECURITY_VALIDATION_OK);
+     CU_ASSERT (exception.minor_code != 0);
+     CU_ASSERT (exception.message != NULL);
+
+     reset_exception(&exception);
+
+     handshake_message_deinit(&handshake_token_in);
+}
+
+CU_Test(ddssec_builtin_validate_begin_handshake_reply,invalid_challenge ,  .init = init_testcase, .fini = fini_testcase)
+{
+    DDS_Security_ValidationResult_t result;
+    DDS_Security_HandshakeHandle handshake_handle;
+    DDS_Security_HandshakeMessageToken handshake_token_in = DDS_SECURITY_TOKEN_INIT;
+    DDS_Security_HandshakeMessageToken handshake_token_out = DDS_SECURITY_TOKEN_INIT;
+    DDS_Security_SecurityException exception = {NULL, 0, 0};
+
+    CU_ASSERT_FATAL (auth != NULL);
+    CU_ASSERT_FATAL (local_identity_handle != DDS_SECURITY_HANDLE_NIL);
+    CU_ASSERT_FATAL (remote_identity_handle1 != DDS_SECURITY_HANDLE_NIL);
+    CU_ASSERT_FATAL (remote_identity_handle2 != DDS_SECURITY_HANDLE_NIL);
+    CU_ASSERT_FATAL (auth->begin_handshake_reply != NULL);
+
+  fill_handshake_message_token_default(&handshake_token_in, remote_participant_data2, challenge2->value._buffer, challenge2->value._length);
+
+  result = auth->begin_handshake_reply(
+    auth,
+    &handshake_handle,
+    &handshake_token_out,
+    &handshake_token_in,
+    remote_identity_handle1,
+    local_identity_handle,
+    &serialized_participant_data,
+    &exception);
+
+    handshake_message_deinit(&handshake_token_in);
+    handshake_message_deinit(&handshake_token_out);
+
+
+    fill_handshake_message_token(
+            &handshake_token_in, remote_participant_data1, remote_identity_certificate,
+            AUTH_DSIGN_ALGO_RSA_NAME, AUTH_KAGREE_ALGO_RSA_NAME,
+            dh_pubkey_modp_2048_value, dh_pubkey_modp_2048_length, challenge1->value._buffer, challenge1->value._length);
+
+    result = auth->begin_handshake_reply(
+                    auth,
+                    &handshake_handle,
+                    &handshake_token_out,
+                    &handshake_token_in,
+                    remote_identity_handle1,
+                    local_identity_handle,
+                    &serialized_participant_data,
+                    &exception);
+
+    if (result == DDS_SECURITY_VALIDATION_OK) {
+        printf("begin_handshake_reply failed: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+
+    CU_ASSERT_FATAL(result != DDS_SECURITY_VALIDATION_OK);
+    CU_ASSERT (exception.minor_code != 0);
+    CU_ASSERT (exception.message != NULL);
+
+    reset_exception(&exception);
+
+    handshake_message_deinit(&handshake_token_in);
+
+    fill_handshake_message_token(
+             &handshake_token_in, remote_participant_data1, remote_identity_certificate,
+             AUTH_DSIGN_ALGO_RSA_NAME, AUTH_KAGREE_ALGO_RSA_NAME,
+             dh_pubkey_modp_2048_value, dh_pubkey_modp_2048_length, NULL, 0);
+
+     result = auth->begin_handshake_reply(
+                     auth,
+                     &handshake_handle,
+                     &handshake_token_out,
+                     &handshake_token_in,
+                     remote_identity_handle1,
+                     local_identity_handle,
+                     &serialized_participant_data,
+                     &exception);
+
+     if (result == DDS_SECURITY_VALIDATION_OK) {
+         printf("begin_handshake_reply failed: %s\n", exception.message ? exception.message : "Error message missing");
+     }
+
+     CU_ASSERT_FATAL(result != DDS_SECURITY_VALIDATION_OK);
+     CU_ASSERT (exception.minor_code != 0);
+     CU_ASSERT (exception.message != NULL);
+
+
+     reset_exception(&exception);
+
+     handshake_message_deinit(&handshake_token_in);
+}
+
+
+CU_Test(ddssec_builtin_validate_begin_handshake_reply,return_handle,  .init = init_testcase, .fini = fini_testcase)
+{
+    DDS_Security_ValidationResult_t result;
+    DDS_Security_HandshakeHandle handshake_handle;
+    DDS_Security_HandshakeMessageToken handshake_token_in = DDS_SECURITY_TOKEN_INIT;
+    DDS_Security_HandshakeMessageToken handshake_token_out = DDS_SECURITY_TOKEN_INIT;
+    DDS_Security_SecurityException exception = {NULL, 0, 0};
+    DDS_Security_boolean success;
+
+    CU_ASSERT_FATAL (auth != NULL);
+    CU_ASSERT_FATAL (local_identity_handle != DDS_SECURITY_HANDLE_NIL);
+    CU_ASSERT_FATAL (remote_identity_handle1 != DDS_SECURITY_HANDLE_NIL);
+    CU_ASSERT_FATAL (remote_identity_handle2 != DDS_SECURITY_HANDLE_NIL);
+    CU_ASSERT_FATAL (auth->begin_handshake_reply != NULL);
+
+    fill_handshake_message_token_default(&handshake_token_in, remote_participant_data1, challenge2->value._buffer, challenge2->value._length);
+
+    result = auth->begin_handshake_reply(
+                    auth,
+                    &handshake_handle,
+                    &handshake_token_out,
+                    &handshake_token_in,
+                    remote_identity_handle1,
+                    local_identity_handle,
+                    &serialized_participant_data,
+                    &exception);
+
+    if (result != DDS_SECURITY_VALIDATION_PENDING_HANDSHAKE_MESSAGE) {
+        printf("begin_handshake_reply failed: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+
+    CU_ASSERT_FATAL (result == DDS_SECURITY_VALIDATION_PENDING_HANDSHAKE_MESSAGE);
+    CU_ASSERT (handshake_handle != DDS_SECURITY_HANDLE_NIL);
+
+    reset_exception(&exception);
+
+    success = auth->return_handshake_handle(auth, handshake_handle, &exception);
+    CU_ASSERT_TRUE (success);
+
+    if (!success) {
+        printf("return_handshake_handle failed: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+    reset_exception(&exception);
+
+    success = auth->return_handshake_handle(auth, handshake_handle, &exception);
+    CU_ASSERT ( success == false );
+    CU_ASSERT (exception.minor_code != 0);
+    CU_ASSERT (exception.message != NULL);
+
+    if (!success) {
+        printf("return_handshake_handle failed: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+    reset_exception(&exception);
+
+    handshake_message_deinit(&handshake_token_in);
+    handshake_message_deinit(&handshake_token_out);
+
+}
+
+/*TODO: test is waiting for Trusted CA parsing function */
+
+#if(0)
+CU _ Test(validate_begin_handshake_reply,extended_certificate_check )
+{
+    DDS_Security_ValidationResult_t result;
+    DDS_Security_HandshakeHandle handshake_handle;
+    DDS_Security_HandshakeMessageToken handshake_token_in = DDS_SECURITY_TOKEN_INIT;
+    DDS_Security_HandshakeMessageToken handshake_token_out = DDS_SECURITY_TOKEN_INIT;
+    DDS_Security_SecurityException exception = {NULL, 0, 0};
+    DDS_Security_boolean success;
+
+    release_local_identity();
+    release_remote_identities();
+
+    CU_ASSERT_FATAL( !validate_local_identity("trusted_ca_dir") );
+    CU_ASSERT_FATAL( !validate_remote_identities( remote_identity_trusted ) );
+
+    CU_ASSERT_FATAL (auth != NULL);
+    CU_ASSERT_FATAL (local_identity_handle != DDS_SECURITY_HANDLE_NIL);
+    CU_ASSERT_FATAL (remote_identity_handle1 != DDS_SECURITY_HANDLE_NIL);
+    CU_ASSERT_FATAL (remote_identity_handle2 != DDS_SECURITY_HANDLE_NIL);
+    CU_ASSERT_FATAL (auth->begin_handshake_reply != NULL);
+
+
+    fill_handshake_message_token(
+                    &handshake_token_in, remote_participant_data1, remote_identity_trusted,
+                AUTH_DSIGN_ALGO_RSA_NAME, AUTH_KAGREE_ALGO_RSA_NAME,
+                dh_pubkey_modp_2048_value, dh_pubkey_modp_2048_length, challenge2->value._buffer, challenge2->value._length);
+
+    result = auth->begin_handshake_reply(
+                    auth,
+                    &handshake_handle,
+                    &handshake_token_out,
+                    &handshake_token_in,
+                    remote_identity_handle2,
+                    local_identity_handle,
+                    &serialized_participant_data,
+                    &exception);
+
+    if (result != DDS_SECURITY_VALIDATION_PENDING_HANDSHAKE_MESSAGE) {
+        printf("begin_handshake_reply failed: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+
+    CU_ASSERT_FATAL(result == DDS_SECURITY_VALIDATION_PENDING_HANDSHAKE_MESSAGE);
+    CU_ASSERT(handshake_handle != DDS_SECURITY_HANDLE_NIL);
+    CU_ASSERT(validate_handshake_token(&handshake_token_out, &challenge2->value, NULL));
+
+    reset_exception(&exception);
+
+    success= auth->return_handshake_handle(auth, handshake_handle, &exception);
+    CU_ASSERT_TRUE (success);
+
+    if (!success) {
+        printf("return_handshake_handle failed: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+    reset_exception(&exception);
+
+    handshake_message_deinit(&handshake_token_in);
+    handshake_message_deinit(&handshake_token_out);
+
+    release_local_identity();
+    release_remote_identities();
+
+    CU_ASSERT_FATAL( !validate_local_identity("trusted_ca_dir") );
+    CU_ASSERT_FATAL( !validate_remote_identities( remote_identity_untrusted ) );
+
+    CU_ASSERT_FATAL (auth != NULL);
+    CU_ASSERT_FATAL (local_identity_handle != DDS_SECURITY_HANDLE_NIL);
+    CU_ASSERT_FATAL (remote_identity_handle1 != DDS_SECURITY_HANDLE_NIL);
+    CU_ASSERT_FATAL (remote_identity_handle2 != DDS_SECURITY_HANDLE_NIL);
+    CU_ASSERT_FATAL (auth->begin_handshake_reply != NULL);
+
+
+    fill_handshake_message_token(
+                    &handshake_token_in, remote_participant_data1, remote_identity_untrusted,
+                AUTH_DSIGN_ALGO_RSA_NAME, AUTH_KAGREE_ALGO_RSA_NAME,
+                dh_pubkey_modp_2048_value, dh_pubkey_modp_2048_length, challenge2->value._buffer, challenge2->value._length);
+
+    result = auth->begin_handshake_reply(
+                    auth,
+                    &handshake_handle,
+                    &handshake_token_out,
+                    &handshake_token_in,
+                    remote_identity_handle2,
+                    local_identity_handle,
+                    &serialized_participant_data,
+                    &exception);
+
+    CU_ASSERT_FATAL(result == DDS_SECURITY_VALIDATION_FAILED);
+    CU_ASSERT_FATAL( exception.code != 0 );
+
+    reset_exception(&exception);
+
+    auth->return_handshake_handle(auth, handshake_handle, &exception);
+    handshake_message_deinit(&handshake_token_in);
+    handshake_message_deinit(&handshake_token_out);
+    reset_exception(&exception);
+
+
+    release_local_identity();
+    release_remote_identities();
+
+    CU_ASSERT_FATAL( !validate_local_identity("trusted_ca_dir") );
+    CU_ASSERT_FATAL( !validate_remote_identities( remote_identity_trusted_expired ) );
+
+    CU_ASSERT_FATAL (auth != NULL);
+    CU_ASSERT_FATAL (local_identity_handle != DDS_SECURITY_HANDLE_NIL);
+    CU_ASSERT_FATAL (remote_identity_handle1 != DDS_SECURITY_HANDLE_NIL);
+    CU_ASSERT_FATAL (remote_identity_handle2 != DDS_SECURITY_HANDLE_NIL);
+    CU_ASSERT_FATAL (auth->begin_handshake_reply != NULL);
+
+
+    fill_handshake_message_token(
+                    &handshake_token_in, remote_participant_data1, remote_identity_trusted_expired,
+                AUTH_DSIGN_ALGO_RSA_NAME, AUTH_KAGREE_ALGO_RSA_NAME,
+                dh_pubkey_modp_2048_value, dh_pubkey_modp_2048_length, challenge2->value._buffer, challenge2->value._length);
+
+    result = auth->begin_handshake_reply(
+                    auth,
+                    &handshake_handle,
+                    &handshake_token_out,
+                    &handshake_token_in,
+                    remote_identity_handle2,
+                    local_identity_handle,
+                    &serialized_participant_data,
+                    &exception);
+
+    CU_ASSERT_FATAL(result == DDS_SECURITY_VALIDATION_FAILED);
+    CU_ASSERT_FATAL( exception.code != 0 );
+
+    reset_exception(&exception);
+
+
+    auth->return_handshake_handle(auth, handshake_handle, &exception);
+    handshake_message_deinit(&handshake_token_in);
+    handshake_message_deinit(&handshake_token_out);
+    reset_exception(&exception);
+}
+#endif
diff --git a/src/security/builtin_plugins/tests/validate_begin_handshake_request/src/validate_begin_handshake_request_utests.c b/src/security/builtin_plugins/tests/validate_begin_handshake_request/src/validate_begin_handshake_request_utests.c
new file mode 100644
index 0000000..5137565
--- /dev/null
+++ b/src/security/builtin_plugins/tests/validate_begin_handshake_request/src/validate_begin_handshake_request_utests.c
@@ -0,0 +1,828 @@
+
+
+
+
+/* CUnit includes. */
+#include "dds/security/dds_security_api.h"
+#include "dds/security/core/dds_security_serialize.h"
+#include "dds/security/core/dds_security_utils.h"
+#include "dds/security/dds_security_api.h"
+#include "dds/ddsrt/heap.h"
+#include "dds/ddsrt/string.h"
+#include <stdio.h>
+#include <string.h>
+#include "dds/ddsrt/environ.h"
+#include "CUnit/CUnit.h"
+#include "CUnit/Test.h"
+#include "assert.h"
+
+
+/* Test helper includes. */
+#include "common/src/loader.h"
+
+/* Private header include */
+
+#include <openssl/opensslv.h>
+
+static const char * AUTH_PROTOCOL_CLASS_ID          = "DDS:Auth:PKI-DH:1.0";
+
+static const char * PROPERTY_IDENTITY_CA            = "dds.sec.auth.identity_ca";
+static const char * PROPERTY_PRIVATE_KEY            = "dds.sec.auth.private_key";
+static const char * PROPERTY_IDENTITY_CERT          = "dds.sec.auth.identity_certificate";
+
+static const char * PROPERTY_CERT_SUBJECT_NAME      = "dds.cert.sn";
+static const char * PROPERTY_CERT_ALGORITHM         = "dds.cert.algo";
+static const char * PROPERTY_CA_SUBJECT_NAME        = "dds.ca.sn";
+static const char * PROPERTY_CA_ALGORITHM           = "dds.ca.aglo";
+
+static const char * SUBJECT_NAME_IDENTITY_CERT      = "CN=CHAM-574 client,O=Some Company,ST=Some-State,C=NL";
+static const char * SUBJECT_NAME_IDENTITY_CA        = "CN=CHAM-574 authority,O=Some Company,ST=Some-State,C=NL";
+
+static const char * RSA_2048_ALGORITHM_NAME         = "RSA-2048";
+
+static const char * AUTH_REQUEST_TOKEN_CLASS_ID         = "DDS:Auth:PKI-DH:1.0+AuthReq";
+static const char * AUTH_REQUEST_TOKEN_FUTURE_PROP_NAME = "future_challenge";
+
+static const char * AUTH_HANDSHAKE_REQUEST_TOKEN_CLASS_ID = "DDS:Auth:PKI-DH:1.0+Req";
+
+static const char * AUTH_DSIGN_ALGO_RSA_NAME   = "RSASSA-PSS-SHA256";
+static const char * AUTH_KAGREE_ALGO_ECDH_NAME = "ECDH+prime256v1-CEUM";
+/* static const char * AUTH_KAGREE_ALGO_RSA_NAME  = "DH+MODP-2048-256"; */
+
+
+
+static const char *identity_certificate =
+        "data:,-----BEGIN CERTIFICATE-----\n"
+        "MIIEQTCCAymgAwIBAgIINpuaAAnrQZIwDQYJKoZIhvcNAQELBQAwXzELMAkGA1UE\n"
+        "BhMCTkwxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdp\n"
+        "ZGdpdHMgUHR5IEx0ZDEYMBYGA1UEAxMPQ0hBTTUwMCByb290IGNhMCAXDTE3MDIy\n"
+        "MjIyMjIwMFoYDzIyMjIwMjIyMjIyMjAwWjBcMQswCQYDVQQGEwJOTDETMBEGA1UE\n"
+        "CBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRk\n"
+        "MRUwEwYDVQQDEwxDSEFNNTAwIGNlcnQwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAw\n"
+        "ggEKAoIBAQDCpVhivH/wBIyu74rvQncnSZqKyspN6CvD1pmV9wft5PHhVt9jV79v\n"
+        "gSub5LADoRHAgFdv9duYgBr17Ob6uRrIY4B18CcrCjhQcC4gjx8y2jl9PeYm+qYD\n"
+        "3o44FYBrBq0QCnrQgKsb/qX9Z+Mw/VUiw65x68W876LEHQQoEgT4kxSuagwBoVRk\n"
+        "ePD6fYAKmT4XS3x+O0v+rHESTcsKF6yMadgp7h3eH1b8kJTzSx8JV9Zzq++mxjox\n"
+        "qhbBVP5nDze2hhSIeCkCvSrx7efkgKS4AQXa5/Z44GiAu1TfXXUqdic9rxwD0edn\n"
+        "ajNElnZe7sjok/0yuqvH+2hSqpNva/zpAgMBAAGjggEAMIH9MAwGA1UdDwQFAwMH\n"
+        "/4AwgewGA1UdJQSB5DCB4QYIKwYBBQUHAwEGCCsGAQUFBwMCBggrBgEFBQcDAwYI\n"
+        "KwYBBQUHAwQGCCsGAQUFBwMIBgorBgEEAYI3AgEVBgorBgEEAYI3AgEWBgorBgEE\n"
+        "AYI3CgMBBgorBgEEAYI3CgMDBgorBgEEAYI3CgMEBglghkgBhvhCBAEGCysGAQQB\n"
+        "gjcKAwQBBggrBgEFBQcDBQYIKwYBBQUHAwYGCCsGAQUFBwMHBggrBgEFBQgCAgYK\n"
+        "KwYBBAGCNxQCAgYIKwYBBQUHAwkGCCsGAQUFBwMNBggrBgEFBQcDDgYHKwYBBQID\n"
+        "BTANBgkqhkiG9w0BAQsFAAOCAQEAawdHy0Xw7nTK2ltp91Ion6fJ7hqYuj///zr7\n"
+        "Adt6uonpDh/xl3esuwcFimIJrJrHujnGkL0nLddRCikmnzuBMNDWS6yq0/Ckl/YG\n"
+        "yjNr44dlX24wo+MVAgkj3/8CyWDZ3a8kBg9QT3bs2SqbjmhTrXN1DRyf9S5vJysE\n"
+        "I7V1gTN66BeKL64hOrAlRVrEu8Ds6TWL6Q/YH+61ViZkoLTeSaPjH4nknaFr4C35\n"
+        "iji0JhkyfRHRRVPHFnaj25AkxOrSV64qVKoTMjDl5fji5iMGtjm6iJ7q05ml/qDl\n"
+        "nLotHXemZNvYhbwUmRzbt4Dls9EMH4VRbP85I94nM5TAvtHVNA==\n"
+        "-----END CERTIFICATE-----\n";
+
+
+static const char *identity_ca =
+        "data:,-----BEGIN CERTIFICATE-----\n"
+        "MIIEmTCCA4GgAwIBAgIIZ5gEIUFhO5wwDQYJKoZIhvcNAQELBQAwXzELMAkGA1UE\n"
+        "BhMCTkwxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdp\n"
+        "ZGdpdHMgUHR5IEx0ZDEYMBYGA1UEAxMPQ0hBTTUwMCByb290IGNhMCAXDTE4MDIx\n"
+        "MjE1MDUwMFoYDzIyMjIwMjIyMjIyMjAwWjBfMQswCQYDVQQGEwJOTDETMBEGA1UE\n"
+        "CBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRk\n"
+        "MRgwFgYDVQQDEw9DSEFNNTAwIHJvb3QgY2EwggEiMA0GCSqGSIb3DQEBAQUAA4IB\n"
+        "DwAwggEKAoIBAQC6Fa3TheL+UrdZCp9GhU/2WbneP2t/avUa3muwDttPxeI2XU9k\n"
+        "ZjBR95mAXme4SPXHk5+YDN319AqIje3oKhzky/ngvKH2GkoJKYxWnuDBfMEHdViz\n"
+        "2Q9/xso2ZvH50ukwWa0pfx2/EVV1wRxeQcRd/UVfq3KTJizG0M88mOYvGEAw3LFf\n"
+        "zef7k1aCuOofQmBvLukUudcYpMzfyHFp7lQqU4CcrrR5RtmfiUfrWfdGLea2iPDB\n"
+        "pJgN8ESOMwEHtOTEBDclYnH9L4t7CHQz+fXXS5IWFsDK9fCMQjnxDsDVeNrNzTYL\n"
+        "FaZrMg9S6IUQCEsQWsnq5weS8omOpVLUm9klAgMBAAGjggFVMIIBUTAMBgNVHRME\n"
+        "BTADAQH/MB0GA1UdDgQWBBQg2FZB/j8uWDVnJhjwXkX278znSTAfBgNVHSMEGDAW\n"
+        "gBQg2FZB/j8uWDVnJhjwXkX278znSTAPBgNVHQ8BAf8EBQMDB/+AMIHvBgNVHSUB\n"
+        "Af8EgeQwgeEGCCsGAQUFBwMBBggrBgEFBQcDAgYIKwYBBQUHAwMGCCsGAQUFBwME\n"
+        "BggrBgEFBQcDCAYKKwYBBAGCNwIBFQYKKwYBBAGCNwIBFgYKKwYBBAGCNwoDAQYK\n"
+        "KwYBBAGCNwoDAwYKKwYBBAGCNwoDBAYJYIZIAYb4QgQBBgsrBgEEAYI3CgMEAQYI\n"
+        "KwYBBQUHAwUGCCsGAQUFBwMGBggrBgEFBQcDBwYIKwYBBQUIAgIGCisGAQQBgjcU\n"
+        "AgIGCCsGAQUFBwMJBggrBgEFBQcDDQYIKwYBBQUHAw4GBysGAQUCAwUwDQYJKoZI\n"
+        "hvcNAQELBQADggEBAKHmwejWRwGE1wf1k2rG8SNRV/neGsZ6Qfqf6co3TpR/Wi1s\n"
+        "iZDvSeT/rbqNBS7z34xnG88NIUwu00y78e8Mfon31ZZbK4Uo7fla9/D3ukdJqPQC\n"
+        "LKdbKJjR2kH+KCukY/1rghjJ8/X+t2egBit0LCOdsFCl07Sfksb9kpGUIZSFcYYm\n"
+        "geqhjhoNwxazzHiw+QWHC5HG9248JIizBmy1aymNWuMnPudhjHAnPcsIlqMVNq3t\n"
+        "Rv9ap7S8JeCxHVRPJvJeCwXWvW3dW/v3xH52Yn/fqRblN1w9Fxz5NhopKx0gj/Jd\n"
+        "sw2N4Fk4gaOWEolFpa0bwNw8nAx7moehZpowzfw=\n"
+        "-----END CERTIFICATE-----\n";
+
+
+static const char *private_key =
+        "data:,-----BEGIN RSA PRIVATE KEY-----\n"
+        "MIIEogIBAAKCAQEAwqVYYrx/8ASMru+K70J3J0maisrKTegrw9aZlfcH7eTx4Vbf\n"
+        "Y1e/b4Erm+SwA6ERwIBXb/XbmIAa9ezm+rkayGOAdfAnKwo4UHAuII8fMto5fT3m\n"
+        "JvqmA96OOBWAawatEAp60ICrG/6l/WfjMP1VIsOucevFvO+ixB0EKBIE+JMUrmoM\n"
+        "AaFUZHjw+n2ACpk+F0t8fjtL/qxxEk3LChesjGnYKe4d3h9W/JCU80sfCVfWc6vv\n"
+        "psY6MaoWwVT+Zw83toYUiHgpAr0q8e3n5ICkuAEF2uf2eOBogLtU3111KnYnPa8c\n"
+        "A9HnZ2ozRJZ2Xu7I6JP9Mrqrx/toUqqTb2v86QIDAQABAoIBAC1q32DKkx+yMBFx\n"
+        "m32QiLUGG6VfBC2BixS7MkMnzRXZYgcuehl4FBc0kLRjfB6cqsO8LqrVN1QyMBhK\n"
+        "GutN3c38SbE7RChqzhEW2+yE+Mao3Nk4ZEecHLiyaYT0n25ZtHAVwep823BAzwJ+\n"
+        "BykbM45VEpNKbG1VjSktjBa9faNyZiZAEJEjVyla+6R8N4kHV52LbZcLjvJv3IQ2\n"
+        "iPYRrmMyI5C23qTni0vy7yJbAXBo3CqgSlwie9FARBWT7Puu7F4mF1O1c/SnTysw\n"
+        "Tm3e5FzgfHipQbnRVn0w4rDprPMKmPxMnvf/Wkw0zVgNadp1Tc1I6Yj525DEQ07i\n"
+        "2gIn/gECgYEA4jNnY1u2Eu7x3pAQF3dRO0x35boVtuq9iwQk7q+uaZaK4RJRr+0Y\n"
+        "T68S3bPnfer6SHvcxtST89Bvs/j/Ky4SOaX037UYjFh6T7OIzPl+MzO1yb+VOBT6\n"
+        "D6FVGEJGp8ZAITU1OfJPeTYViUeEC8tHFGoKUCk50FbB6jOf1oKtv/ECgYEA3EnB\n"
+        "Y7kSbJJaUuj9ciFUL/pAno86Cim3VjegK1wKgEiyDb610bhoMErovPwfVJbtcttG\n"
+        "eKJNuwizkRcVbj+vpjDvqqaP5eMxLl6/Nd4haPMJYzGo88Z8NJpwFRNF2KEWjOpQ\n"
+        "2NEvoCeRtVulCJyka2Tpljzw8cOXkxhPOe2UhHkCgYBo3entj0QO7QXm56T+LAvV\n"
+        "0PK45xdQEO3EuCwjGAFk5C0IgUSrqeCeeIzniZMltj1IQ1wsNbtNynEu3530t8wt\n"
+        "O7oVyFBUKGSz9IjUdkpClJOPr6kPMfJoMqRPtdIpz+hFPPSrI6IikKdVWHloOlp+\n"
+        "pVaYqTQrWT1XRY2xli3VEQKBgGySmZN6Cx+h/oywswIGdUT0VdcQhq2to+QFpJba\n"
+        "VX6m1cM6hMip2Ag9U3qZ1SNPBBdBBfm9HQybHE3dj713/C2wHuAAGhpXIM1W+20k\n"
+        "X1knuC/AsSH9aQhQOf/ZMOq1crTfZBuI9q0782/sjGmzMsKPySU4QhUWruVb7OiD\n"
+        "NVkZAoGAEvihW7G+8/iOE40vGHyBqUeopAAWLciTAUIEwM/Oi3BYfNWNTWF/FWNc\n"
+        "nMvCZPYigY8C1vO+1iT2Frtd3CIU+f01Q3fJNJoRLlEiKLNZUJRF48OKUqjKSmsi\n"
+        "w6pucFO40z05YW7utApj4L82rZnOS0pd1tUI1yexqvj0i4ThJfk=\n"
+        "-----END RSA PRIVATE KEY-----\n";
+
+
+
+static struct plugins_hdl *plugins = NULL;
+static dds_security_authentication *auth = NULL;
+static DDS_Security_IdentityHandle local_identity_handle = DDS_SECURITY_HANDLE_NIL;
+static DDS_Security_IdentityHandle remote_identity_handle1 = DDS_SECURITY_HANDLE_NIL;
+static DDS_Security_IdentityHandle remote_identity_handle2 = DDS_SECURITY_HANDLE_NIL;
+static DDS_Security_AuthRequestMessageToken g_local_auth_request_token = DDS_SECURITY_TOKEN_INIT;
+static DDS_Security_AuthRequestMessageToken g_remote_auth_request_token = DDS_SECURITY_TOKEN_INIT;
+static const DDS_Security_BinaryProperty_t *challenge1 = NULL;
+static const DDS_Security_BinaryProperty_t *challenge2 = NULL;
+
+
+static void
+dds_security_property_init(
+    DDS_Security_PropertySeq *seq,
+    DDS_Security_unsigned_long size)
+{
+    seq->_length = size;
+    seq->_maximum = size;
+    seq->_buffer = ddsrt_malloc(size * sizeof(DDS_Security_Property_t));
+    memset(seq->_buffer, 0, size * sizeof(DDS_Security_Property_t));
+}
+
+static void
+dds_security_property_deinit(
+    DDS_Security_PropertySeq *seq)
+{
+    uint32_t  i;
+
+    for (i = 0; i < seq->_length; i++) {
+        ddsrt_free(seq->_buffer[i].name);
+        ddsrt_free(seq->_buffer[i].value);
+    }
+    ddsrt_free(seq->_buffer);
+}
+
+static void
+reset_exception(
+    DDS_Security_SecurityException *ex)
+{
+    ex->minor_code = 0;
+    ex->code = 0;
+    ddsrt_free(ex->message);
+    ex->message = NULL;
+}
+
+static void
+initialize_identity_token(
+    DDS_Security_IdentityToken *token,
+    const char *certAlgo,
+    const char *caAlgo)
+{
+    memset(token, 0, sizeof(*token));
+
+    token->class_id = ddsrt_strdup(AUTH_PROTOCOL_CLASS_ID);
+    token->properties._maximum = 4;
+    token->properties._length  = 4;
+    token->properties._buffer = DDS_Security_PropertySeq_allocbuf(4);
+
+    token->properties._buffer[0].name = ddsrt_strdup(PROPERTY_CERT_SUBJECT_NAME);
+    token->properties._buffer[0].value = ddsrt_strdup(SUBJECT_NAME_IDENTITY_CERT);
+    token->properties._buffer[0].propagate = true;
+
+    token->properties._buffer[1].name = ddsrt_strdup(PROPERTY_CERT_ALGORITHM);
+    token->properties._buffer[1].value = ddsrt_strdup(certAlgo);
+    token->properties._buffer[1].propagate = true;
+
+    token->properties._buffer[2].name = ddsrt_strdup(PROPERTY_CA_SUBJECT_NAME);
+    token->properties._buffer[2].value = ddsrt_strdup(SUBJECT_NAME_IDENTITY_CA);
+    token->properties._buffer[2].propagate = true;
+
+    token->properties._buffer[3].name = ddsrt_strdup(PROPERTY_CA_ALGORITHM);
+    token->properties._buffer[3].value = ddsrt_strdup(caAlgo);
+    token->properties._buffer[3].propagate = true;
+}
+
+static void
+fill_auth_request_token(
+     DDS_Security_AuthRequestMessageToken *token)
+{
+    uint32_t i;
+    uint32_t len = 32;
+    unsigned char *challenge;
+
+    challenge = ddsrt_malloc(len);
+
+    for (i = 0; i < len; i++) {
+        challenge[i] = (unsigned char)(0xFF - i);
+    }
+
+    memset(token, 0, sizeof(*token));
+
+    token->class_id = ddsrt_strdup(AUTH_REQUEST_TOKEN_CLASS_ID);
+    token->binary_properties._maximum = 1;
+    token->binary_properties._length = 1;
+    token->binary_properties._buffer = DDS_Security_BinaryPropertySeq_allocbuf(1);
+    token->binary_properties._buffer->name = ddsrt_strdup(AUTH_REQUEST_TOKEN_FUTURE_PROP_NAME);
+
+    token->binary_properties._buffer->value._maximum = len;
+    token->binary_properties._buffer->value._length = len;
+    token->binary_properties._buffer->value._buffer = challenge;
+}
+
+static const DDS_Security_BinaryProperty_t *
+find_binary_property(
+    DDS_Security_DataHolder *token,
+    const char *name)
+{
+    const DDS_Security_BinaryProperty_t *result = NULL;
+    uint32_t i;
+
+    for (i = 0; i < token->binary_properties._length && !result; i++) {
+        if (token->binary_properties._buffer[i].name && (strcmp(token->binary_properties._buffer[i].name, name) == 0)) {
+            result = &token->binary_properties._buffer[i];
+        }
+    }
+
+    return result;
+}
+
+
+static void
+deinitialize_identity_token(
+    DDS_Security_IdentityToken *token)
+{
+    DDS_Security_DataHolder_deinit(token);
+}
+
+static int
+validate_local_identity(void)
+{
+    int res = 0;
+    DDS_Security_ValidationResult_t result;
+    DDS_Security_DomainId domain_id = 0;
+    DDS_Security_Qos participant_qos;
+    DDS_Security_GUID_t candidate_participant_guid;
+    DDS_Security_SecurityException exception = {NULL, 0, 0};
+    DDS_Security_GUID_t local_participant_guid;
+    DDS_Security_GuidPrefix_t prefix = {0xb0, 0xb1, 0xb2, 0xb3, 0xb4, 0xb5, 0xb6, 0xb7, 0xb8, 0xb9, 0xba, 0xbb};
+    DDS_Security_EntityId_t entityId = {{0xb0,0xb1,0xb2},0x1};
+
+    memset(&local_participant_guid, 0, sizeof(local_participant_guid));
+    memcpy(&candidate_participant_guid.prefix, &prefix, sizeof(prefix));
+    memcpy(&candidate_participant_guid.entityId, &entityId, sizeof(entityId));
+
+    memset(&participant_qos, 0, sizeof(participant_qos));
+    dds_security_property_init(&participant_qos.property.value, 3);
+    participant_qos.property.value._buffer[0].name = ddsrt_strdup(PROPERTY_IDENTITY_CERT);
+    participant_qos.property.value._buffer[0].value = ddsrt_strdup(identity_certificate);
+    participant_qos.property.value._buffer[1].name = ddsrt_strdup(PROPERTY_IDENTITY_CA);
+    participant_qos.property.value._buffer[1].value = ddsrt_strdup(identity_ca);
+    participant_qos.property.value._buffer[2].name = ddsrt_strdup(PROPERTY_PRIVATE_KEY);
+    participant_qos.property.value._buffer[2].value = ddsrt_strdup(private_key);
+
+    /* Now call the function. */
+    result = auth->validate_local_identity(
+                            auth,
+                            &local_identity_handle,
+                            &local_participant_guid,
+                            domain_id,
+                            &participant_qos,
+                            &candidate_participant_guid,
+                            &exception);
+
+    if (result != DDS_SECURITY_VALIDATION_OK) {
+        res = -1;
+        printf("validate_local_identity_failed: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+
+    dds_security_property_deinit(&participant_qos.property.value);
+    reset_exception(&exception);
+
+    return res;
+}
+
+static void
+release_local_identity(void)
+{
+    DDS_Security_SecurityException exception = {NULL, 0, 0};
+    DDS_Security_boolean success;
+
+    if (local_identity_handle != DDS_SECURITY_HANDLE_NIL) {
+        success = auth->return_identity_handle(auth, local_identity_handle, &exception);
+        if (!success) {
+            printf("return_identity_handle failed: %s\n", exception.message ? exception.message : "Error message missing");
+        }
+        reset_exception(&exception);
+    }
+}
+
+static int
+validate_remote_identities (void)
+{
+    int res = 0;
+    DDS_Security_ValidationResult_t result;
+    DDS_Security_IdentityToken remote_identity_token;
+    static DDS_Security_AuthRequestMessageToken local_auth_request_token = DDS_SECURITY_TOKEN_INIT;
+    DDS_Security_GUID_t remote_participant_guid1;
+    DDS_Security_GUID_t remote_participant_guid2;
+    DDS_Security_SecurityException exception = {NULL, 0, 0};
+    DDS_Security_GuidPrefix_t prefix1 = {0xa0, 0xa1, 0xa2, 0xa3, 0xa4, 0xa5, 0xa6, 0xa7, 0xa8, 0xa9, 0xaa, 0xab};
+    DDS_Security_GuidPrefix_t prefix2 = {0xc0, 0xc1, 0xc2, 0xc3, 0xc4, 0xc5, 0xc6, 0xc7, 0xc8, 0xc9, 0xca, 0xcb};
+    DDS_Security_EntityId_t entityId = {{0xb0,0xb1,0xb2},0x1};
+
+    memcpy(&remote_participant_guid1.prefix, &prefix1, sizeof(prefix1));
+    memcpy(&remote_participant_guid1.entityId, &entityId, sizeof(entityId));
+    memcpy(&remote_participant_guid2.prefix, &prefix2, sizeof(prefix2));
+    memcpy(&remote_participant_guid2.entityId, &entityId, sizeof(entityId));
+
+    if (local_identity_handle == DDS_SECURITY_HANDLE_NIL) {
+        return -1;
+    }
+
+    initialize_identity_token(&remote_identity_token, RSA_2048_ALGORITHM_NAME, RSA_2048_ALGORITHM_NAME);
+
+    result = auth->validate_remote_identity(
+                auth,
+                &remote_identity_handle1,
+                &g_local_auth_request_token,
+                NULL,
+                local_identity_handle,
+                &remote_identity_token,
+                &remote_participant_guid1,
+                &exception);
+
+    if ((result != DDS_SECURITY_VALIDATION_PENDING_HANDSHAKE_REQUEST) &&
+        (result != DDS_SECURITY_VALIDATION_PENDING_HANDSHAKE_MESSAGE)) {
+        printf("validate_remote_identity_failed: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+
+    reset_exception(&exception);
+
+    fill_auth_request_token(&g_remote_auth_request_token);
+
+    result = auth->validate_remote_identity(
+                auth,
+                &remote_identity_handle2,
+                &local_auth_request_token,
+                &g_remote_auth_request_token,
+                local_identity_handle,
+                &remote_identity_token,
+                &remote_participant_guid2,
+                &exception);
+
+    if ((result != DDS_SECURITY_VALIDATION_PENDING_HANDSHAKE_REQUEST) &&
+            (result != DDS_SECURITY_VALIDATION_PENDING_HANDSHAKE_MESSAGE)) {
+        printf("validate_remote_identity_failed: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+
+    reset_exception(&exception);
+
+    deinitialize_identity_token(&remote_identity_token);
+    DDS_Security_DataHolder_deinit(&local_auth_request_token);
+
+    challenge1 = find_binary_property(&g_local_auth_request_token, AUTH_REQUEST_TOKEN_FUTURE_PROP_NAME);
+    challenge2 = find_binary_property(&g_remote_auth_request_token, AUTH_REQUEST_TOKEN_FUTURE_PROP_NAME);
+
+    return res;
+}
+
+static void
+release_remote_identities(void)
+{
+    DDS_Security_SecurityException exception = {NULL, 0, 0};
+    DDS_Security_boolean success;
+
+    if (remote_identity_handle1 != DDS_SECURITY_HANDLE_NIL) {
+        success = auth->return_identity_handle(auth, remote_identity_handle1, &exception);
+        if (!success) {
+            printf("return_identity_handle failed: %s\n", exception.message ? exception.message : "Error message missing");
+        }
+        reset_exception(&exception);
+    }
+    if (remote_identity_handle2 != DDS_SECURITY_HANDLE_NIL) {
+        success = auth->return_identity_handle(auth, remote_identity_handle2, &exception);
+        if (!success) {
+            printf("return_identity_handle failed: %s\n", exception.message ? exception.message : "Error message missing");
+        }
+        reset_exception(&exception);
+    }
+
+    DDS_Security_DataHolder_deinit(&g_local_auth_request_token);
+    DDS_Security_DataHolder_deinit(&g_remote_auth_request_token);
+}
+
+static void
+fill_local_participant_data(
+    DDS_Security_OctetSeq *pdata,
+    uint32_t length)
+{
+    uint32_t i;
+
+    pdata->_length = pdata->_maximum = length;
+    pdata->_buffer = ddsrt_malloc(length);
+
+    for (i = 0; i < length; i++) {
+        pdata->_buffer[i] = (unsigned char)(i % 256);
+    }
+}
+
+static void
+release_local_participant_data(
+    DDS_Security_OctetSeq *pdata)
+{
+    if (pdata) {
+        ddsrt_free(pdata->_buffer);
+    }
+}
+
+CU_Init(ddssec_builtin_validate_begin_handshake_request)
+{
+    int res = 0;
+
+    /* Only need the authentication plugin. */
+    plugins = load_plugins(NULL   /* Access Control */,
+                           &auth  /* Authentication */,
+                           NULL   /* Cryptograpy    */);
+    if (plugins) {
+        res = validate_local_identity();
+        if (res >= 0) {
+            res = validate_remote_identities();
+        }
+    } else {
+        res = -1;
+    }
+
+    return res;
+}
+
+CU_Clean(ddssec_builtin_validate_begin_handshake_request)
+{
+    release_local_identity();
+    release_remote_identities();
+    unload_plugins(plugins);
+    return 0;
+}
+
+static bool
+compare_octet_seq(
+    const DDS_Security_OctetSeq *seq1,
+    const DDS_Security_OctetSeq *seq2)
+{
+    int r;
+    if (seq1 && seq2) {
+        r = (int)(seq2->_length - seq1->_length);
+        if (r == 0) {
+            r = memcmp(seq1->_buffer, seq2->_buffer, seq1->_length);
+        }
+    } else if (seq1 == seq2) {
+        r = 0;
+    } else {
+        r = (seq2 > seq1) ? 1 : -1;
+    }
+    return r;
+}
+
+static bool
+valid_c_id_property(
+    const char *certificate,
+    const DDS_Security_OctetSeq *value)
+{
+    if (value->_length == 0) {
+        CU_FAIL("c.id has no value");
+        return false;
+    }
+    if (strncmp(certificate, (const char *)value->_buffer, value->_length) != 0) {
+        return false;
+    }
+    return true;
+}
+
+static bool
+valid_string_value(
+    const char *expected,
+    const DDS_Security_OctetSeq *value)
+{
+    size_t len = strlen(expected) + 1;
+
+    if (strncmp(expected, (const char *)value->_buffer, len) != 0) {
+        return false;
+    }
+
+    return true;
+}
+
+
+
+static bool
+validate_handshake_token(
+    DDS_Security_HandshakeMessageToken *token,
+    const DDS_Security_OctetSeq *challenge)
+{
+    const DDS_Security_BinaryProperty_t *property;
+
+    if (!token->class_id || strcmp(token->class_id, AUTH_HANDSHAKE_REQUEST_TOKEN_CLASS_ID) != 0) {
+        CU_FAIL("HandshakeMessageToken incorrect class_id");
+    } else if ((property = find_binary_property(token, "c.id")) == NULL) {
+        CU_FAIL("HandshakeMessageToken incorrect property 'c.id' not found");
+    } else if (!valid_c_id_property(&identity_certificate[6], &property->value)) {
+        CU_FAIL("HandshakeMessageToken incorrect property 'c.id' value is invalid");
+    } else if ((property = find_binary_property(token, "c.pdata")) == NULL) {
+        CU_FAIL("HandshakeMessageToken incorrect property 'c.pdata' not found");
+    } else if ((property = find_binary_property(token, "c.dsign_algo")) == NULL) {
+        CU_FAIL("HandshakeMessageToken incorrect property 'c.dsign_algo' not found");
+    } else if (!valid_string_value(AUTH_DSIGN_ALGO_RSA_NAME, &property->value)) {
+        CU_FAIL("HandshakeMessageToken incorrect property 'c.dsign_algo' incorrect value");
+    } else if ((property = find_binary_property(token, "c.kagree_algo")) == NULL) {
+        CU_FAIL("HandshakeMessageToken incorrect property 'c.kagree_algo' not found");
+    } else if (!valid_string_value(AUTH_KAGREE_ALGO_ECDH_NAME, &property->value)) {
+        CU_FAIL("HandshakeMessageToken incorrect property 'c.kagree_algo' incorrect value");
+    } else if ((property = find_binary_property(token, "hash_c1")) == NULL) {
+        CU_FAIL("HandshakeMessageToken incorrect property 'hash_c1' not found");
+    } else if ((property = find_binary_property(token, "dh1")) == NULL) {
+        CU_FAIL("HandshakeMessageToken incorrect property 'dh1' not found");
+    } else if ((property = find_binary_property(token, "challenge1")) == NULL) {
+        CU_FAIL("HandshakeMessageToken incorrect property 'challenge1' not found");
+    } else if (challenge && compare_octet_seq(challenge, &property->value) != 0) {
+        CU_FAIL("HandshakeMessageToken incorrect property 'challenge1' incorrect value");
+    } else {
+        return true;
+    }
+
+    return false;
+}
+
+
+
+CU_Test(ddssec_builtin_validate_begin_handshake_request,happy_day_challenge)
+{
+    DDS_Security_ValidationResult_t result;
+    DDS_Security_HandshakeHandle handshake_handle;
+    DDS_Security_HandshakeMessageToken handshake_token;
+    DDS_Security_SecurityException exception = {NULL, 0, 0};
+    DDS_Security_OctetSeq local_participant_data;
+    DDS_Security_boolean success;
+
+    CU_ASSERT_FATAL (auth != NULL);
+    CU_ASSERT_FATAL (local_identity_handle != DDS_SECURITY_HANDLE_NIL);
+    CU_ASSERT_FATAL (remote_identity_handle1 != DDS_SECURITY_HANDLE_NIL);
+    CU_ASSERT_FATAL (remote_identity_handle2 != DDS_SECURITY_HANDLE_NIL);
+    CU_ASSERT_FATAL (auth->begin_handshake_request != NULL);
+
+    fill_local_participant_data(&local_participant_data, 82);
+
+    result = auth->begin_handshake_request(
+                    auth,
+                    &handshake_handle,
+                    &handshake_token,
+                    local_identity_handle,
+                    remote_identity_handle2,
+                    &local_participant_data,
+                    &exception);
+
+    if (result != DDS_SECURITY_VALIDATION_PENDING_HANDSHAKE_MESSAGE) {
+        printf("begin_handshake_request failed: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+
+    CU_ASSERT_FATAL(result == DDS_SECURITY_VALIDATION_PENDING_HANDSHAKE_MESSAGE);
+    CU_ASSERT(handshake_handle != DDS_SECURITY_HANDLE_NIL);
+    CU_ASSERT(validate_handshake_token(&handshake_token, NULL));
+
+    reset_exception(&exception);
+
+    release_local_participant_data(&local_participant_data);
+
+    success= auth->return_handshake_handle(auth, handshake_handle, &exception);
+    CU_ASSERT_TRUE (success);
+
+    if (!success) {
+        printf("return_handshake_handle failed: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+    reset_exception(&exception);
+
+    DDS_Security_DataHolder_deinit(&handshake_token);
+}
+
+CU_Test(ddssec_builtin_validate_begin_handshake_request,happy_day_future_challenge)
+{
+    DDS_Security_ValidationResult_t result;
+    DDS_Security_HandshakeHandle handshake_handle;
+    DDS_Security_HandshakeMessageToken handshake_token;
+    DDS_Security_SecurityException exception = {NULL, 0, 0};
+    DDS_Security_OctetSeq local_participant_data;
+    DDS_Security_boolean success;
+
+    CU_ASSERT_FATAL (auth != NULL);
+    CU_ASSERT_FATAL (local_identity_handle != DDS_SECURITY_HANDLE_NIL);
+    CU_ASSERT_FATAL (remote_identity_handle1 != DDS_SECURITY_HANDLE_NIL);
+    CU_ASSERT_FATAL (remote_identity_handle2 != DDS_SECURITY_HANDLE_NIL);
+    CU_ASSERT_FATAL (auth->begin_handshake_request != NULL);
+
+    fill_local_participant_data(&local_participant_data, 82);
+
+    result = auth->begin_handshake_request(
+                    auth,
+                    &handshake_handle,
+                    &handshake_token,
+                    local_identity_handle,
+                    remote_identity_handle1,
+                    &local_participant_data,
+                    &exception);
+
+    if (result != DDS_SECURITY_VALIDATION_PENDING_HANDSHAKE_MESSAGE) {
+        printf("begin_handshake_request failed: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+
+    CU_ASSERT_FATAL(result == DDS_SECURITY_VALIDATION_PENDING_HANDSHAKE_MESSAGE);
+    CU_ASSERT(handshake_handle != DDS_SECURITY_HANDLE_NIL);
+    CU_ASSERT(validate_handshake_token(&handshake_token, &challenge1->value));
+
+    reset_exception(&exception);
+
+    release_local_participant_data(&local_participant_data);
+
+    success = auth->return_handshake_handle(auth, handshake_handle, &exception);
+    CU_ASSERT_TRUE (success);
+
+    if (!success) {
+        printf("return_handshake_handle failed: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+    reset_exception(&exception);
+
+    DDS_Security_DataHolder_deinit(&handshake_token);
+}
+
+
+CU_Test(ddssec_builtin_validate_begin_handshake_request,invalid_arguments)
+{
+    DDS_Security_ValidationResult_t result;
+    DDS_Security_HandshakeHandle handshake_handle;
+    DDS_Security_HandshakeMessageToken handshake_token;
+    DDS_Security_SecurityException exception = {NULL, 0, 0};
+    DDS_Security_OctetSeq local_participant_data;
+
+    CU_ASSERT_FATAL (auth != NULL);
+    CU_ASSERT_FATAL (local_identity_handle != DDS_SECURITY_HANDLE_NIL);
+    CU_ASSERT_FATAL (remote_identity_handle1 != DDS_SECURITY_HANDLE_NIL);
+    CU_ASSERT_FATAL (remote_identity_handle2 != DDS_SECURITY_HANDLE_NIL);
+    CU_ASSERT_FATAL (auth->begin_handshake_request != NULL);
+
+    fill_local_participant_data(&local_participant_data, 82);
+
+    result = auth->begin_handshake_request(
+                    auth,
+                    NULL,
+                    &handshake_token,
+                    local_identity_handle,
+                    remote_identity_handle1,
+                    &local_participant_data,
+                    &exception);
+
+    if (result != DDS_SECURITY_VALIDATION_OK) {
+        printf("validate_local_identity_failed: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+    CU_ASSERT (result == DDS_SECURITY_VALIDATION_FAILED);
+    CU_ASSERT (exception.minor_code != 0);
+    CU_ASSERT (exception.message != NULL);
+    reset_exception(&exception);
+
+    result = auth->begin_handshake_request(
+                    auth,
+                    &handshake_handle,
+                    NULL,
+                    local_identity_handle,
+                    remote_identity_handle1,
+                    &local_participant_data,
+                    &exception);
+
+    if (result != DDS_SECURITY_VALIDATION_OK) {
+        printf("validate_local_identity_failed: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+    CU_ASSERT (result == DDS_SECURITY_VALIDATION_FAILED);
+    CU_ASSERT (exception.minor_code != 0);
+    CU_ASSERT (exception.message != NULL);
+    reset_exception(&exception);
+
+    result = auth->begin_handshake_request(
+                    auth,
+                    &handshake_handle,
+                    &handshake_token,
+                    0x1234598,
+                    remote_identity_handle1,
+                    &local_participant_data,
+                    &exception);
+
+    if (result != DDS_SECURITY_VALIDATION_OK) {
+        printf("validate_local_identity_failed: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+    CU_ASSERT (result == DDS_SECURITY_VALIDATION_FAILED);
+    CU_ASSERT (exception.minor_code != 0);
+    CU_ASSERT (exception.message != NULL);
+    reset_exception(&exception);
+
+    result = auth->begin_handshake_request(
+                     auth,
+                     &handshake_handle,
+                     &handshake_token,
+                     local_identity_handle,
+                     0x1234598,
+                     &local_participant_data,
+                     &exception);
+
+     if (result != DDS_SECURITY_VALIDATION_OK) {
+         printf("validate_local_identity_failed: %s\n", exception.message ? exception.message : "Error message missing");
+     }
+     CU_ASSERT (result == DDS_SECURITY_VALIDATION_FAILED);
+     CU_ASSERT (exception.minor_code != 0);
+     CU_ASSERT (exception.message != NULL);
+     reset_exception(&exception);
+
+     result = auth->begin_handshake_request(
+                     auth,
+                     &handshake_handle,
+                     &handshake_token,
+                     local_identity_handle,
+                     remote_identity_handle1,
+                     NULL,
+                     &exception);
+
+     if (result != DDS_SECURITY_VALIDATION_OK) {
+         printf("validate_local_identity_failed: %s\n", exception.message ? exception.message : "Error message missing");
+     }
+     CU_ASSERT (result == DDS_SECURITY_VALIDATION_FAILED);
+     CU_ASSERT (exception.minor_code != 0);
+     CU_ASSERT (exception.message != NULL);
+     reset_exception(&exception);
+
+     release_local_participant_data(&local_participant_data);
+}
+
+CU_Test(ddssec_builtin_validate_begin_handshake_request,return_handle)
+{
+    DDS_Security_ValidationResult_t result;
+    DDS_Security_HandshakeHandle handshake_handle;
+    DDS_Security_HandshakeMessageToken handshake_token;
+    DDS_Security_SecurityException exception = {NULL, 0, 0};
+    DDS_Security_OctetSeq local_participant_data;
+    DDS_Security_boolean success;
+
+    CU_ASSERT_FATAL (auth != NULL);
+    CU_ASSERT_FATAL (local_identity_handle != DDS_SECURITY_HANDLE_NIL);
+    CU_ASSERT_FATAL (remote_identity_handle1 != DDS_SECURITY_HANDLE_NIL);
+    CU_ASSERT_FATAL (remote_identity_handle2 != DDS_SECURITY_HANDLE_NIL);
+    CU_ASSERT_FATAL (auth->begin_handshake_request != NULL);
+
+    fill_local_participant_data(&local_participant_data, 82);
+
+    result = auth->begin_handshake_request(
+                    auth,
+                    &handshake_handle,
+                    &handshake_token,
+                    local_identity_handle,
+                    remote_identity_handle2,
+                    &local_participant_data,
+                    &exception);
+
+    if (result != DDS_SECURITY_VALIDATION_PENDING_HANDSHAKE_MESSAGE) {
+        printf("begin_handshake_request failed: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+
+    CU_ASSERT_FATAL (result == DDS_SECURITY_VALIDATION_PENDING_HANDSHAKE_MESSAGE);
+    CU_ASSERT (handshake_handle != DDS_SECURITY_HANDLE_NIL);
+
+    reset_exception(&exception);
+
+    release_local_participant_data(&local_participant_data);
+
+    success = auth->return_handshake_handle(auth, handshake_handle, &exception);
+    CU_ASSERT_TRUE (success);
+
+    if (!success) {
+        printf("return_handshake_handle failed: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+    reset_exception(&exception);
+
+    success = auth->return_handshake_handle(auth, handshake_handle, &exception);
+    CU_ASSERT_FALSE (success);
+    CU_ASSERT (exception.minor_code != 0);
+    CU_ASSERT (exception.message != NULL);
+
+    if (!success) {
+        printf("return_handshake_handle failed: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+    reset_exception(&exception);
+
+    DDS_Security_DataHolder_deinit(&handshake_token);
+}
diff --git a/src/security/builtin_plugins/tests/validate_local_identity/etc/Alice_Test_2.crt b/src/security/builtin_plugins/tests/validate_local_identity/etc/Alice_Test_2.crt
new file mode 100644
index 0000000..f5f77eb
--- /dev/null
+++ b/src/security/builtin_plugins/tests/validate_local_identity/etc/Alice_Test_2.crt
@@ -0,0 +1,25 @@
+-----BEGIN CERTIFICATE-----
+MIIEJTCCAw2gAwIBAgIBFzANBgkqhkiG9w0BAQsFADBzMQswCQYDVQQGEwJOTDEL
+MAkGA1UECBMCT1YxEzARBgNVBAoTCkFETGluayBJU1QxGjAYBgNVBAMTEUlkZW50
+aXR5IENBIFRlc3QyMSYwJAYJKoZIhvcNAQkBFhdpbmZvQGlzdC5hZGxpbmt0ZWNo
+LmNvbTAeFw0xODA3MjAwMDAwMDBaFw0yNzA3MTkyMzU5NTlaMG0xCzAJBgNVBAYT
+Ak5MMQswCQYDVQQIEwJPVjETMBEGA1UEChMKQURMaW5rIElTVDEUMBIGA1UEAxML
+QWxpY2UgVGVzdDIxJjAkBgkqhkiG9w0BCQEWF2luZm9AaXN0LmFkbGlua3RlY2gu
+Y29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA0Fb60RkFrDsRAIRf
+LMf2fsiRnw9Agp7yEbUsA4Zg4X+hRhBkk78fFtagLisWo4LbT4DqKzqQXCvVnOn9
+a6uT0KsVejk2iaLoBy0fotQznudio3rzDpTfzP9eRDFVj8RJnl3JJ8P1DULxH7N0
+TyDBuKZ1ibBfuKjPffqeCEzYKgAc8NG2FB4m6mXzHhXuKw6W2v0IbHz6KYldsavf
+04rq7ztw0t67bexSQ4gLSVJEwiohAregm0dLvQnap5xd2qn0yETteTL8Y+Ujym1D
+WAnwDdwA6+0j2a0wkyzOzYQpZMt95NyZ8kcoqEqO8KAN2HclqfjHlg9iDscbof5x
+45SQwwIDAQABo4HJMIHGMAwGA1UdEwQFMAMBAf8wHQYDVR0OBBYEFL66FT0vnlFE
++PKrtV+KhJoLsCOWMB8GA1UdIwQYMBaAFIFGyWkPWvNkBD2SCYj9H+NfnlOLMA8G
+A1UdDwEB/wQFAwMH/4AwZQYDVR0lAQH/BFswWQYIKwYBBQUHAwEGCCsGAQUFBwMC
+BggrBgEFBQcDAwYIKwYBBQUHAwQGCCsGAQUFBwMIBggrBgEFBQcDCQYIKwYBBQUH
+Aw0GCCsGAQUFBwMOBgcrBgEFAgMFMA0GCSqGSIb3DQEBCwUAA4IBAQCsBINpBXSp
+Xe3f5MMObeUXE2VhWZWIjMdDQRFDDjq6u1YR7rbffsCReiCX5zviU2dtVV8VN3MQ
+k7wp8qEDKwP1ToMIwZGwT4Hfwei1eueJ1vuotgiGe0Gm3otXlGsb0C5otnsu63MM
+OeFgkpZde3VpIqK9EmhgjWOD8TXc8Me7zBlYSEIaXkkwP0jAKRf5vFgz0WfE5ITx
+SDKUO0OrcN789flO/OKLAHZ4cqNcxNPkMz7h9VBSgRRRk115HEa8Fe46nl1YpwRG
+0urHlyAKoUV+J+I3Qy4+SwIDwix978hgGN3bKVyv9q0yAQRzpZ54EJOj4C7lNEpB
+roGVpY4yYP/B
+-----END CERTIFICATE-----
diff --git a/src/security/builtin_plugins/tests/validate_local_identity/etc/Bob_Chain_Test.crt b/src/security/builtin_plugins/tests/validate_local_identity/etc/Bob_Chain_Test.crt
new file mode 100644
index 0000000..e980af3
--- /dev/null
+++ b/src/security/builtin_plugins/tests/validate_local_identity/etc/Bob_Chain_Test.crt
@@ -0,0 +1,25 @@
+-----BEGIN CERTIFICATE-----
+MIIEJDCCAwygAwIBAgIBAzANBgkqhkiG9w0BAQsFADB9MQswCQYDVQQGEwJOTDEL
+MAkGA1UECBMCT1YxEzARBgNVBAoTCkFETGluayBJU1QxJDAiBgNVBAMTG0lkZW50
+aXR5IENBIFRlc3QgV2l0aCBDaGFpbjEmMCQGCSqGSIb3DQEJARYXaW5mb0Bpc3Qu
+YWRsaW5rdGVjaC5jb20wHhcNMTgwNjEzMDAwMDAwWhcNMjcwNjEwMjM1OTU5WjBw
+MQswCQYDVQQGEwJOTDELMAkGA1UECBMCT1YxEzARBgNVBAoTCkFETGluayBJU1Qx
+FzAVBgNVBAMTDkJvYiBDaGFpbiBUZXN0MSYwJAYJKoZIhvcNAQkBFhdpbmZvQGlz
+dC5hZGxpbmt0ZWNoLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEB
+AMHm+qG5afCHFdmp98+Z+POB7vD3WhfghKVugh8FenewuPaaotKxiGAE0kCf8WXU
+5l4XDR3iBWJsGDHll1yOyL4KW9grwfnfiJMl82uIzKGDiRJbFkXVOLF/DcVLsuqM
+oRjlk09+nlrg/7xS96itgm6yueW/UOIXpo+ElCHwnrYnpuHHrYM0s7t1ls3QFSyd
+a3INx+LkM6N/b+veVJF95yfe4GvVBhFpLkWtX4xKgZyMjczvmZ6LVNNSnthPhlZF
+HmspQyqXrTnGyax3qyoloqh9ibDvAK5pUnzqlv/Dyyt110q3bXFR5A0wqfj0fqtp
+7Mw4TdTkFQy1n4/Y4EuT8I8CAwEAAaOBuzCBuDAdBgNVHQ4EFgQUQpxLPHT5o/GQ
+RwdBw2scINXnWlUwHwYDVR0jBBgwFoAUTVVCTRc4ST0XmE+EEsenSudwlwkwDwYD
+VR0PAQH/BAUDAwf/gDBlBgNVHSUBAf8EWzBZBggrBgEFBQcDAQYIKwYBBQUHAwIG
+CCsGAQUFBwMDBggrBgEFBQcDBAYIKwYBBQUHAwgGCCsGAQUFBwMJBggrBgEFBQcD
+DQYIKwYBBQUHAw4GBysGAQUCAwUwDQYJKoZIhvcNAQELBQADggEBAJwd60WigqbB
+/6CT0ekvXZdvIV5IaIKiy6KYU0/0ebPVXn0YKp9LQTE6lYCr6hZUcEjBfkFBZhAy
+KJJOb2sUXAnYqnX/mIipiNb7oHsCHxVCKAwEcmxsS3tGl2CXgpKL8EQQFKJgSrC/
+uzhf2QESQ0T5Mgni1jXXGf6SAwFAjk+mAM9bMdrtLOX39e5aKrgpZOHmdFke+m/K
+upxP/M0/omTNNQaSfWDmfDvpdsRD9+mFG12Kzgpue2jut1qeICvSmcQsu2OBYG/Q
+ZXMx8e8azoX0KB+njf826UcVgDkDmfwN9taOU2lFsmZAvYhpIslNwtH/Htu3zJWO
+vQxyIh+kxFQ=
+-----END CERTIFICATE-----
diff --git a/src/security/builtin_plugins/tests/validate_local_identity/etc/Identity_CA_Test2.crt b/src/security/builtin_plugins/tests/validate_local_identity/etc/Identity_CA_Test2.crt
new file mode 100644
index 0000000..592eea3
--- /dev/null
+++ b/src/security/builtin_plugins/tests/validate_local_identity/etc/Identity_CA_Test2.crt
@@ -0,0 +1,25 @@
+-----BEGIN CERTIFICATE-----
+MIIEKzCCAxOgAwIBAgIBFjANBgkqhkiG9w0BAQsFADBzMQswCQYDVQQGEwJOTDEL
+MAkGA1UECBMCT1YxEzARBgNVBAoTCkFETGluayBJU1QxGjAYBgNVBAMTEUlkZW50
+aXR5IENBIFRlc3QyMSYwJAYJKoZIhvcNAQkBFhdpbmZvQGlzdC5hZGxpbmt0ZWNo
+LmNvbTAeFw0xODA3MjAwMDAwMDBaFw0yNzA3MTkyMzU5NTlaMHMxCzAJBgNVBAYT
+Ak5MMQswCQYDVQQIEwJPVjETMBEGA1UEChMKQURMaW5rIElTVDEaMBgGA1UEAxMR
+SWRlbnRpdHkgQ0EgVGVzdDIxJjAkBgkqhkiG9w0BCQEWF2luZm9AaXN0LmFkbGlu
+a3RlY2guY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAyIweDOdB
+xotexcDiUdbIdDLu9A6/KSpkxUJnYb2iRhBonmCNFvErEokso/Dga6QT3rg83UCg
+GMJBSJSZhq/j+eZweHoXS8Ccet/aF2iNj5A5Uhn476M3zMg+rCoos2yKlpZLOz1x
+QjrRJfeOoBHvkHkxBeupnnQPx4oAro7zoXMIO83NKLwCROC/kGq1ktW8fbKa5THQ
+z0QfZG3zAeD93N+dTAqA+jkCfzbrQepF243Tu4cLaGwVALZ/8cZ7sky8+OOmKnBU
+P9r+U/4L62DVJYnYkTGnYEwqXcM1b8/JHasmKEaHXgAu/UI5i/SZfRPZUyC1ERSv
+tX6k7sBxZZSPLQIDAQABo4HJMIHGMAwGA1UdEwQFMAMBAf8wHQYDVR0OBBYEFIFG
+yWkPWvNkBD2SCYj9H+NfnlOLMB8GA1UdIwQYMBaAFIFGyWkPWvNkBD2SCYj9H+Nf
+nlOLMA8GA1UdDwEB/wQFAwMH/4AwZQYDVR0lAQH/BFswWQYIKwYBBQUHAwEGCCsG
+AQUFBwMCBggrBgEFBQcDAwYIKwYBBQUHAwQGCCsGAQUFBwMIBggrBgEFBQcDCQYI
+KwYBBQUHAw0GCCsGAQUFBwMOBgcrBgEFAgMFMA0GCSqGSIb3DQEBCwUAA4IBAQCK
+SkemYQIvsslkMc8PNHSk2om4xk7hUXkatAZPN9dvRravu3PJqMWxpQ0TWbddrkBL
+he7/ARC2G9vVUwQl2b8K1Rjt/nZ3j+NPvhCDzcPyxjornyN8IG1NJQVH18fTxR23
+6PvDBE0H2trA3WJgKo6Wlxo6CHWts8ulFWWXBE1nNQw30hU49FDsFn3nz6Gry4ti
+/ouAvbz+UXSsT9R+zkci3A394sEsOCZSStgAnXsejU45pCt6OtCGaLfDvEPp21az
+OEjuIaj6Kbd+MHeLyPoe+d1Bkl39OnAUEJ8q2HdwvIg2ZqP6h0agm5gpZo/ALDWn
+9P3owIGVsHFGkYqhHc+K
+-----END CERTIFICATE-----
diff --git a/src/security/builtin_plugins/tests/validate_local_identity/etc/Identity_CA_Test_With_Chain.crt b/src/security/builtin_plugins/tests/validate_local_identity/etc/Identity_CA_Test_With_Chain.crt
new file mode 100644
index 0000000..35506b8
--- /dev/null
+++ b/src/security/builtin_plugins/tests/validate_local_identity/etc/Identity_CA_Test_With_Chain.crt
@@ -0,0 +1,25 @@
+-----BEGIN CERTIFICATE-----
+MIIENDCCAxygAwIBAgIBAjANBgkqhkiG9w0BAQsFADByMQswCQYDVQQGEwJOTDEL
+MAkGA1UECBMCT1YxEzARBgNVBAoTCkFETGluayBJU1QxGTAXBgNVBAMTEElkZW50
+aXR5IENBIFRlc3QxJjAkBgkqhkiG9w0BCQEWF2luZm9AaXN0LmFkbGlua3RlY2gu
+Y29tMB4XDTE4MDYxMzAwMDAwMFoXDTI3MDYxMDIzNTk1OVowfTELMAkGA1UEBhMC
+TkwxCzAJBgNVBAgTAk9WMRMwEQYDVQQKEwpBRExpbmsgSVNUMSQwIgYDVQQDExtJ
+ZGVudGl0eSBDQSBUZXN0IFdpdGggQ2hhaW4xJjAkBgkqhkiG9w0BCQEWF2luZm9A
+aXN0LmFkbGlua3RlY2guY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKC
+AQEA1r8Q0V8ZVeBs8tPMF0N+JlBynl1Zn/89vwSsU4m7y6ixUcW/y3r12CMeA0cH
+g6yOaOdHsZ8pRlPRwy9YmeOwLsMOUHAURP2uPiTjSf3pttUIf0jv602GyirNzoS7
+7mHiyTtV80ZMzZlLIJ3gaJJlG4DjitFuFcjv8sOmviFjkn1kOjkAz1nKgsCiHvvg
+fcJlYPrtLfle9SzvZ3MTq4ob+/EFu9nt5bYYs7p7Br1TGWctUw98l2mSn/FhfDBw
+9bb7ZhcKB7W6PGy2Os5AnkdTJKHoOQT+RmnHzPBhab0BoKuy8IhfW2GyqC8rL5Tm
+/UVLUvnx4Zzqz//3IyA2FTb1HQIDAQABo4HJMIHGMAwGA1UdEwQFMAMBAf8wHQYD
+VR0OBBYEFE1VQk0XOEk9F5hPhBLHp0rncJcJMB8GA1UdIwQYMBaAFER4R6N3MQ1W
+l7gn+R8wwHloDCVZMA8GA1UdDwEB/wQFAwMH/4AwZQYDVR0lAQH/BFswWQYIKwYB
+BQUHAwEGCCsGAQUFBwMCBggrBgEFBQcDAwYIKwYBBQUHAwQGCCsGAQUFBwMIBggr
+BgEFBQcDCQYIKwYBBQUHAw0GCCsGAQUFBwMOBgcrBgEFAgMFMA0GCSqGSIb3DQEB
+CwUAA4IBAQCbl7ed4p66G6WquxO7ceZFvYKn3kDErjCfXHcqHxBnA2xTpoZCGj95
+Qpirqo6N4UcLX5sn3CmgyVk0dYvlti/53FJgZ9XQDNxBuEYWPkY7vO+Uo0WdYpGz
+ZDNIUQpiPMA7bHvwKldTIs77xxtnw9kbBU2k0xQyb2tdZNfD5YqSI1MeUtpEpNFW
+sbC8+mQ3clzWpjF8eHH1fFSAmlJ+z1Uqmtt2FK0vRz+MQcpydwvpMnfqGdcwhGPQ
+X4HZreLObjBA8KUEkUB3+rZXuELBgkk/c8/jRZl7QF5jJDLQCCLg7KoYBKN2GuTt
+/dzeSnP7VZm/nTL8wpCvKgSOwOGgklf2
+-----END CERTIFICATE-----
diff --git a/src/security/builtin_plugins/tests/validate_local_identity/etc/alice.pem b/src/security/builtin_plugins/tests/validate_local_identity/etc/alice.pem
new file mode 100644
index 0000000..07a5977
--- /dev/null
+++ b/src/security/builtin_plugins/tests/validate_local_identity/etc/alice.pem
@@ -0,0 +1,27 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIIEowIBAAKCAQEA0Fb60RkFrDsRAIRfLMf2fsiRnw9Agp7yEbUsA4Zg4X+hRhBk
+k78fFtagLisWo4LbT4DqKzqQXCvVnOn9a6uT0KsVejk2iaLoBy0fotQznudio3rz
+DpTfzP9eRDFVj8RJnl3JJ8P1DULxH7N0TyDBuKZ1ibBfuKjPffqeCEzYKgAc8NG2
+FB4m6mXzHhXuKw6W2v0IbHz6KYldsavf04rq7ztw0t67bexSQ4gLSVJEwiohAreg
+m0dLvQnap5xd2qn0yETteTL8Y+Ujym1DWAnwDdwA6+0j2a0wkyzOzYQpZMt95NyZ
+8kcoqEqO8KAN2HclqfjHlg9iDscbof5x45SQwwIDAQABAoIBAG0dYPeqd0IhHWJ7
+8azufbchLMN1pX/D51xG2uptssfnpHuhkkufSZUYi4QipRS2ME6PYhWJ8pmTi6lH
+E6cUkbI0KGd/F4U2gPdhNrR9Fxwea5bbifkVF7Gx/ZkRjZJiZ3w9+mCNTQbJDKhh
+wITAzzT6WYznhvqbzzBX1fTa6kv0GAQtX7aHKM+XIwkhX2gzU5TU80bvH8aMrT05
+tAMGQqkUeRnpo0yucBl4VmTZzd/+X/d2UyXR0my15jE5iH5o+p+E6qTRE9D+MGUd
+MQ6Ftj0Untqy1lcog1ZLL6zPlnwcD4jgY5VCYDgvabnrSwymOJapPLsAEdWdq+U5
+ec44BMECgYEA/+3qPUrd4XxA517qO3fCGBvf2Gkr7w5ZDeATOTHGuD8QZeK0nxPl
+CWhRjdgkqo0fyf1cjczL5XgYayo+YxkO1Z4RUU+8lJAHlVx9izOQo+MTQfkwH4BK
+LYlHxMoHJwAOXXoE+dmBaDh5xT0mDUGU750r763L6EFovE4qRBn9hxkCgYEA0GWz
+rpOPNxb419WxG9npoQYdCZ5IbmEOGDH3ReggVzWHmW8sqtkqTZm5srcyDpqAc1Gu
+paUveMblEBbU+NFJjLWOfwB5PCp8jsrqRgCQSxolShiVkc3Vu3oyzMus9PDge1eo
+9mwVGO7ojQKWRu/WVAakENPaAjeyyhv4dqSNnjsCgYEAlwe8yszqoY1k8+U0T0G+
+HeIdOCXgkmOiNCj+zyrLvaEhuS6PLq1b5TBVqGJcSPWdQ+MrglbQIKu9pUg5ptt7
+wJ5WU+i9PeK9Ruxc/g/BFKYFkFJQjtZzb+nqm3wpul8zGwDN/O/ZiTqCyd3rHbmM
+/dZ/viKPCZHIEBAEq0m3LskCgYBndzcAo+5k8ZjWwBfQth5SfhCIp/daJgGzbYtR
+P/BenAsY2KOap3tjT8Fsw5usuHSxzIojX6H0Gvu7Qzq11mLn43Q+BeQrRQTWeFRc
+MQdy4iZFZXNNEp7dF8yE9VKHwdgSJPGUdxD6chMvf2tRCN6mlS171VLV6wVvZvez
+H/vX5QKBgD2Dq/NHpjCpAsECP9awmNF5Akn5WJbRGmegwXIih2mOtgtYYDeuQyxY
+ZCrdJFfIUjUVPagshEmUklKhkYMYpzy2PQDVtaVcm6UNFroxT5h+J+KDs1LN1H8G
+LsASrzyAg8EpRulwXEfLrWKiu9DKv8bMEgO4Ovgz8zTKJZIFhcac
+-----END RSA PRIVATE KEY-----
diff --git a/src/security/builtin_plugins/tests/validate_local_identity/etc/bob.pem b/src/security/builtin_plugins/tests/validate_local_identity/etc/bob.pem
new file mode 100644
index 0000000..cf62cc3
--- /dev/null
+++ b/src/security/builtin_plugins/tests/validate_local_identity/etc/bob.pem
@@ -0,0 +1,27 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIIEowIBAAKCAQEAweb6oblp8IcV2an3z5n484Hu8PdaF+CEpW6CHwV6d7C49pqi
+0rGIYATSQJ/xZdTmXhcNHeIFYmwYMeWXXI7Ivgpb2CvB+d+IkyXza4jMoYOJElsW
+RdU4sX8NxUuy6oyhGOWTT36eWuD/vFL3qK2CbrK55b9Q4hemj4SUIfCetiem4cet
+gzSzu3WWzdAVLJ1rcg3H4uQzo39v695UkX3nJ97ga9UGEWkuRa1fjEqBnIyNzO+Z
+notU01Ke2E+GVkUeaylDKpetOcbJrHerKiWiqH2JsO8ArmlSfOqW/8PLK3XXSrdt
+cVHkDTCp+PR+q2nszDhN1OQVDLWfj9jgS5PwjwIDAQABAoIBAHfgWhED9VgL29le
+uGMzmPLK4LM+6Qcb+kXghTeyhl1a928WeRVzRpG+SVJEz9QaBHYlICnaY2PO2kJ2
+49YIPFkpRFDn9JuLs/7tFonj4Eb2cBbWE3YG9W7e0t+oBiv1117yB9m8uSAMPG7s
+iEpTQvE3M7CzT8kHwCS4XXCCN0z7LqKyZ1heScjdfhV3D2TnFFjdtQ/9KfQa3hIc
+6ftbpi4EKbfasspyqfrJ/cqjHzse9iEXLOZJhs+atBAKe/uJ4Hc3LRPbX4MPniAp
+JJrldXFK9p+HILlbXvu+5n+DSGbZmT1x9a/E9suGyoJiASDH2Ax4yCVTi+v8C1R2
+aKdU1LkCgYEA/3dFuM6zIHwiJ0GKT0gtJL6J3m+i51SNcRIm8deXt6HULMpUNajj
+vZ1bgQm/h+uRBlPV3swkaVxvPTIabOTY4gmCBSzvVCSIAKHVc/+5Nkl9KruwSq4G
+tctmXZ7ymMDi+6QGCJTJkAx6jptXyrzC00HOjXOwyQ+iDipqgr3A8FsCgYEAwk7B
+2/hi569EIHFRT6nz/JMqQVPZ/MJDKoKhffTbnjQ5OAzpiVN6cyThMM1iVJEBFNhx
+OEacy60Qj0TtR1oYrQSRSLm58TTxiuB4Pohbmg3iU+kSM/eTq/ups/Ul1oCs2eAb
+POfweD3c4d4i7sN8bUNQXehiE4MOlK9TYQy39t0CgYAJht0mwy6S644qgJsz0bE9
+SY3Cqc8daV3M9axWIIAb7QEImpMBXUcA7zlWWpK18ub5oW68XEiPVU8grRmnLfGY
+nFoo70ANlz8rJt3a8ZJqn9r3GQC+CDdf2DH9E8xgPfE5CSjgcQwDPzPi1ZA0k02A
+q1eUltfk55xXguVt8r2bOQKBgQC7+kldr1yv20VDRZ1uPnMGRLE6Zg6bkqw78gid
+vEbDNK6uZP+BlTr/LgyVk/yu52Fucz6FPPrvqEw+7mXHA4ifya1r+BHFIn0S57os
+dOp5jTkKCI9NqxQ3683vhRjH/dA7L63qLFDdYqvP74FID+LOKbMURn6rdbyjZ0J4
+vz8yGQKBgHIzcKlQosRxf+KptOPMGRs30L9PnH+sNmTo2SmEzAGkBkt1msGRh/2l
+uT3hOEhUXL9knRyXwQSXgrIwr9QwI5rGS5FAgX26TgBtPBDs2NuyyhhS5yxsiEPT
+BR+EjQFW9dzRkpRJgvsG4DcNAhFn7fQqFNcWXgFWuBXmGNkdtEGR
+-----END RSA PRIVATE KEY-----
diff --git a/src/security/builtin_plugins/tests/validate_local_identity/etc/ec_identity_ca b/src/security/builtin_plugins/tests/validate_local_identity/etc/ec_identity_ca
new file mode 100644
index 0000000..cfd24b6
--- /dev/null
+++ b/src/security/builtin_plugins/tests/validate_local_identity/etc/ec_identity_ca
@@ -0,0 +1,14 @@
+-----BEGIN CERTIFICATE-----
+MIICEDCCAbegAwIBAgIJAPOifu8ejrRRMAoGCCqGSM49BAMCMGUxCzAJBgNVBAYT
+Ak5MMRMwEQYDVQQIDApTb21lLVN0YXRlMR8wHQYDVQQKDBZBRExJTksgVGVjaG5v
+bG9neSBCLlYuMSAwHgYDVQQDDBdDSEFNXzU3MCBDQSBjZXJ0aWZpY2F0ZTAeFw0x
+OTAyMTgxMDQwMTZaFw00NjA3MDYxMDQwMTZaMGUxCzAJBgNVBAYTAk5MMRMwEQYD
+VQQIDApTb21lLVN0YXRlMR8wHQYDVQQKDBZBRExJTksgVGVjaG5vbG9neSBCLlYu
+MSAwHgYDVQQDDBdDSEFNXzU3MCBDQSBjZXJ0aWZpY2F0ZTBZMBMGByqGSM49AgEG
+CCqGSM49AwEHA0IABMXCYXBHEryADoYXMEE0Jw9aHlA7p3KVFzuypxuez0n7rKoX
+k9kanNtrw5o2X4WSWKM7zkH4I6AU7xSAQgJN+8GjUDBOMB0GA1UdDgQWBBR1Llq9
+zrRrTJLSvUJykksncZ+HsDAfBgNVHSMEGDAWgBR1Llq9zrRrTJLSvUJykksncZ+H
+sDAMBgNVHRMEBTADAQH/MAoGCCqGSM49BAMCA0cAMEQCIHKRM3VeB2F7z3nJT752
+gY5mNdj91ulmNX84TXA7UHNKAiA2ytpsV4OKURHkjyn1gnW48JDKtHGZF6/tMNvX
+VrDITA==
+-----END CERTIFICATE-----
diff --git a/src/security/builtin_plugins/tests/validate_local_identity/etc/ec_identity_certificate b/src/security/builtin_plugins/tests/validate_local_identity/etc/ec_identity_certificate
new file mode 100644
index 0000000..5c29b6e
--- /dev/null
+++ b/src/security/builtin_plugins/tests/validate_local_identity/etc/ec_identity_certificate
@@ -0,0 +1,50 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 4096 (0x1000)
+    Signature Algorithm: ecdsa-with-SHA256
+        Issuer: C=NL, ST=Some-State, O=ADLINK Technology B.V., CN=CHAM_570 CA certificate
+        Validity
+            Not Before: Feb 18 10:52:41 2019 GMT
+            Not After : Jul  6 10:52:41 2046 GMT
+        Subject: C=NL, ST=Some-State, O=ADLINK Technology B.V., CN=CHAM_570 Identity certificate
+        Subject Public Key Info:
+            Public Key Algorithm: id-ecPublicKey
+                Public-Key: (256 bit)
+                pub: 
+                    04:9d:b5:7b:f5:fe:63:da:24:e4:0c:26:c5:32:55:
+                    55:b3:7f:7a:60:ea:0d:56:2c:0a:85:e0:5b:85:5a:
+                    01:1b:69:fc:23:79:98:33:d6:60:d5:d9:ab:1e:1d:
+                    7a:1e:c2:5f:ad:30:9b:73:45:40:39:d9:07:f7:59:
+                    8d:44:f6:6b:e3
+                ASN1 OID: prime256v1
+                NIST CURVE: P-256
+        X509v3 extensions:
+            X509v3 Basic Constraints: 
+                CA:false
+            Netscape Comment: 
+                OpenSSL Generated Certificate
+            X509v3 Subject Key Identifier: 
+                C6:68:7E:D7:20:B3:51:4B:D4:50:54:26:12:86:BE:9B:EA:55:A1:EA
+            X509v3 Authority Key Identifier: 
+                keyid:75:2E:5A:BD:CE:B4:6B:4C:92:D2:BD:42:72:92:4B:27:71:9F:87:B0
+
+    Signature Algorithm: ecdsa-with-SHA256
+         30:45:02:21:00:b2:a7:be:fb:0b:d4:e2:87:b0:2c:c9:b8:fa:
+         10:b0:18:4b:dc:6a:bc:58:55:e8:22:46:93:d8:b1:5b:50:17:
+         77:02:20:2a:cf:42:10:fc:7e:02:39:37:44:4a:cf:9b:a3:9a:
+         55:cb:15:2d:12:86:06:7e:d4:b8:24:7a:57:13:48:b5:69
+-----BEGIN CERTIFICATE-----
+MIICOzCCAeGgAwIBAgICEAAwCgYIKoZIzj0EAwIwZTELMAkGA1UEBhMCTkwxEzAR
+BgNVBAgMClNvbWUtU3RhdGUxHzAdBgNVBAoMFkFETElOSyBUZWNobm9sb2d5IEIu
+Vi4xIDAeBgNVBAMMF0NIQU1fNTcwIENBIGNlcnRpZmljYXRlMB4XDTE5MDIxODEw
+NTI0MVoXDTQ2MDcwNjEwNTI0MVowazELMAkGA1UEBhMCTkwxEzARBgNVBAgMClNv
+bWUtU3RhdGUxHzAdBgNVBAoMFkFETElOSyBUZWNobm9sb2d5IEIuVi4xJjAkBgNV
+BAMMHUNIQU1fNTcwIElkZW50aXR5IGNlcnRpZmljYXRlMFkwEwYHKoZIzj0CAQYI
+KoZIzj0DAQcDQgAEnbV79f5j2iTkDCbFMlVVs396YOoNViwKheBbhVoBG2n8I3mY
+M9Zg1dmrHh16HsJfrTCbc0VAOdkH91mNRPZr46N7MHkwCQYDVR0TBAIwADAsBglg
+hkgBhvhCAQ0EHxYdT3BlblNTTCBHZW5lcmF0ZWQgQ2VydGlmaWNhdGUwHQYDVR0O
+BBYEFMZoftcgs1FL1FBUJhKGvpvqVaHqMB8GA1UdIwQYMBaAFHUuWr3OtGtMktK9
+QnKSSydxn4ewMAoGCCqGSM49BAMCA0gAMEUCIQCyp777C9Tih7Asybj6ELAYS9xq
+vFhV6CJGk9ixW1AXdwIgKs9CEPx+Ajk3RErPm6OaVcsVLRKGBn7UuCR6VxNItWk=
+-----END CERTIFICATE-----
diff --git a/src/security/builtin_plugins/tests/validate_local_identity/etc/ec_identity_certificate_unsupported b/src/security/builtin_plugins/tests/validate_local_identity/etc/ec_identity_certificate_unsupported
new file mode 100644
index 0000000..220abcf
--- /dev/null
+++ b/src/security/builtin_plugins/tests/validate_local_identity/etc/ec_identity_certificate_unsupported
@@ -0,0 +1,14 @@
+-----BEGIN CERTIFICATE-----
+MIICFTCCAbygAwIBAgICEAEwCgYIKoZIzj0EAwIwWjELMAkGA1UEBhMCTkwxEzAR
+BgNVBAgMClNvbWUtU3RhdGUxITAfBgNVBAoMGEludGVybmV0IFdpZGdpdHMgUHR5
+IEx0ZDETMBEGA1UEAwwKQ0hBTTUwMF9DQTAeFw0xODAyMTkxMDMyMjRaFw0xOTAy
+MTkxMDMyMjRaMGExCzAJBgNVBAYTAk5MMRMwEQYDVQQIDApTb21lLVN0YXRlMSEw
+HwYDVQQKDBhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQxGjAYBgNVBAMMEUNIQU01
+NjkgdW5zdXAga2V5MEkwEwYHKoZIzj0CAQYIKoZIzj0DAQIDMgAEKt3HYPnDlEOS
+zYqTzT2patyreLHN2Jty22KXwjaNAjgrwujdPr+MW38DsyBF5Yn9o3sweTAJBgNV
+HRMEAjAAMCwGCWCGSAGG+EIBDQQfFh1PcGVuU1NMIEdlbmVyYXRlZCBDZXJ0aWZp
+Y2F0ZTAdBgNVHQ4EFgQUG9MuQz3W/AKA98AyOKhI2af9I+0wHwYDVR0jBBgwFoAU
+ACsYsaEsZfjfRVrj0IBmcsncVyMwCgYIKoZIzj0EAwIDRwAwRAIgfhisahVmgghI
+GaaQavdKHpM/OTVODZPzYjky6Am+z08CIBidnuuznXrZtr78oy/tAES/7Lz8P5Iw
+Q1y5Vo8CdXQQ
+-----END CERTIFICATE-----
diff --git a/src/security/builtin_plugins/tests/validate_local_identity/etc/ec_private_key b/src/security/builtin_plugins/tests/validate_local_identity/etc/ec_private_key
new file mode 100644
index 0000000..214e2dd
--- /dev/null
+++ b/src/security/builtin_plugins/tests/validate_local_identity/etc/ec_private_key
@@ -0,0 +1,5 @@
+-----BEGIN PRIVATE KEY-----
+MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQgP3SnBXzcCc0uUEiG
+0CPNdcV0hBewOnVoh4d9q9E5U5ihRANCAASdtXv1/mPaJOQMJsUyVVWzf3pg6g1W
+LAqF4FuFWgEbafwjeZgz1mDV2aseHXoewl+tMJtzRUA52Qf3WY1E9mvj
+-----END PRIVATE KEY-----
diff --git a/src/security/builtin_plugins/tests/validate_local_identity/etc/ec_private_key_unsupported b/src/security/builtin_plugins/tests/validate_local_identity/etc/ec_private_key_unsupported
new file mode 100644
index 0000000..421d9a3
--- /dev/null
+++ b/src/security/builtin_plugins/tests/validate_local_identity/etc/ec_private_key_unsupported
@@ -0,0 +1,5 @@
+-----BEGIN PRIVATE KEY-----
+MG8CAQAwEwYHKoZIzj0CAQYIKoZIzj0DAQIEVTBTAgEBBBh8p6kwBS7jT86ctN33
+Vs4vosHh7upPZBWhNAMyAAQq3cdg+cOUQ5LNipPNPalq3Kt4sc3Ym3LbYpfCNo0C
+OCvC6N0+v4xbfwOzIEXlif0=
+-----END PRIVATE KEY-----
diff --git a/src/security/builtin_plugins/tests/validate_local_identity/etc/ec_private_key_w_password b/src/security/builtin_plugins/tests/validate_local_identity/etc/ec_private_key_w_password
new file mode 100644
index 0000000..f1f6e13
--- /dev/null
+++ b/src/security/builtin_plugins/tests/validate_local_identity/etc/ec_private_key_w_password
@@ -0,0 +1,8 @@
+-----BEGIN EC PRIVATE KEY-----
+Proc-Type: 4,ENCRYPTED
+DEK-Info: AES-256-CBC,11055B75D406068EB1FF850646228EA9
+
+GUnwN8e2gvUkopN3ak+2dK1dSTSKSJguers3h5C+qQDq57By933ijCCjUTu2LY/F
+ERH6m8UD6H5ij/QDsXLx6tH/dFQ7An+Zao3eD2N2zquGED/OfTQJFv3gBKs4RUtg
+66dfuv9mNSXt7Rnu9uBNtodm5JGifczdmIPHn0mNY2g=
+-----END EC PRIVATE KEY-----
diff --git a/src/security/builtin_plugins/tests/validate_local_identity/etc/identity_ca b/src/security/builtin_plugins/tests/validate_local_identity/etc/identity_ca
new file mode 100644
index 0000000..7e2675c
--- /dev/null
+++ b/src/security/builtin_plugins/tests/validate_local_identity/etc/identity_ca
@@ -0,0 +1,27 @@
+-----BEGIN CERTIFICATE-----
+MIIEmTCCA4GgAwIBAgIIZ5gEIUFhO5wwDQYJKoZIhvcNAQELBQAwXzELMAkGA1UE
+BhMCTkwxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdp
+ZGdpdHMgUHR5IEx0ZDEYMBYGA1UEAxMPQ0hBTTUwMCByb290IGNhMCAXDTE4MDIx
+MjE1MDUwMFoYDzIyMjIwMjIyMjIyMjAwWjBfMQswCQYDVQQGEwJOTDETMBEGA1UE
+CBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRk
+MRgwFgYDVQQDEw9DSEFNNTAwIHJvb3QgY2EwggEiMA0GCSqGSIb3DQEBAQUAA4IB
+DwAwggEKAoIBAQC6Fa3TheL+UrdZCp9GhU/2WbneP2t/avUa3muwDttPxeI2XU9k
+ZjBR95mAXme4SPXHk5+YDN319AqIje3oKhzky/ngvKH2GkoJKYxWnuDBfMEHdViz
+2Q9/xso2ZvH50ukwWa0pfx2/EVV1wRxeQcRd/UVfq3KTJizG0M88mOYvGEAw3LFf
+zef7k1aCuOofQmBvLukUudcYpMzfyHFp7lQqU4CcrrR5RtmfiUfrWfdGLea2iPDB
+pJgN8ESOMwEHtOTEBDclYnH9L4t7CHQz+fXXS5IWFsDK9fCMQjnxDsDVeNrNzTYL
+FaZrMg9S6IUQCEsQWsnq5weS8omOpVLUm9klAgMBAAGjggFVMIIBUTAMBgNVHRME
+BTADAQH/MB0GA1UdDgQWBBQg2FZB/j8uWDVnJhjwXkX278znSTAfBgNVHSMEGDAW
+gBQg2FZB/j8uWDVnJhjwXkX278znSTAPBgNVHQ8BAf8EBQMDB/+AMIHvBgNVHSUB
+Af8EgeQwgeEGCCsGAQUFBwMBBggrBgEFBQcDAgYIKwYBBQUHAwMGCCsGAQUFBwME
+BggrBgEFBQcDCAYKKwYBBAGCNwIBFQYKKwYBBAGCNwIBFgYKKwYBBAGCNwoDAQYK
+KwYBBAGCNwoDAwYKKwYBBAGCNwoDBAYJYIZIAYb4QgQBBgsrBgEEAYI3CgMEAQYI
+KwYBBQUHAwUGCCsGAQUFBwMGBggrBgEFBQcDBwYIKwYBBQUIAgIGCisGAQQBgjcU
+AgIGCCsGAQUFBwMJBggrBgEFBQcDDQYIKwYBBQUHAw4GBysGAQUCAwUwDQYJKoZI
+hvcNAQELBQADggEBAKHmwejWRwGE1wf1k2rG8SNRV/neGsZ6Qfqf6co3TpR/Wi1s
+iZDvSeT/rbqNBS7z34xnG88NIUwu00y78e8Mfon31ZZbK4Uo7fla9/D3ukdJqPQC
+LKdbKJjR2kH+KCukY/1rghjJ8/X+t2egBit0LCOdsFCl07Sfksb9kpGUIZSFcYYm
+geqhjhoNwxazzHiw+QWHC5HG9248JIizBmy1aymNWuMnPudhjHAnPcsIlqMVNq3t
+Rv9ap7S8JeCxHVRPJvJeCwXWvW3dW/v3xH52Yn/fqRblN1w9Fxz5NhopKx0gj/Jd
+sw2N4Fk4gaOWEolFpa0bwNw8nAx7moehZpowzfw=
+-----END CERTIFICATE-----
diff --git a/src/security/builtin_plugins/tests/validate_local_identity/etc/identity_ca_private_key b/src/security/builtin_plugins/tests/validate_local_identity/etc/identity_ca_private_key
new file mode 100644
index 0000000..eb4f6fc
--- /dev/null
+++ b/src/security/builtin_plugins/tests/validate_local_identity/etc/identity_ca_private_key
@@ -0,0 +1,27 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIIEowIBAAKCAQEAuhWt04Xi/lK3WQqfRoVP9lm53j9rf2r1Gt5rsA7bT8XiNl1P
+ZGYwUfeZgF5nuEj1x5OfmAzd9fQKiI3t6Coc5Mv54Lyh9hpKCSmMVp7gwXzBB3VY
+s9kPf8bKNmbx+dLpMFmtKX8dvxFVdcEcXkHEXf1FX6tykyYsxtDPPJjmLxhAMNyx
+X83n+5NWgrjqH0Jgby7pFLnXGKTM38hxae5UKlOAnK60eUbZn4lH61n3Ri3mtojw
+waSYDfBEjjMBB7TkxAQ3JWJx/S+Lewh0M/n110uSFhbAyvXwjEI58Q7A1Xjazc02
+CxWmazIPUuiFEAhLEFrJ6ucHkvKJjqVS1JvZJQIDAQABAoIBAFktMHtw60J0A3fB
+dmkGVDa78y4F+I88g6/XrYXW6NUHAQyKlRSJQFjXrpFtLImNNXPqVA47BFftFusw
+ETY0kFo5QkuoOnnFSXuwlJeiVhWDosHfQ54UxK+4ZYnCte3CXIwWPbzoNSoutWTU
+IbMuE1vzlz5s3GCWZ9jzkoz4vT8NrkucEQ2sxvAVWk2//SoQljN+b4BLDdsWl3Bq
+l+9JR2EzROXrPH5voYUZV17LbnCOmU+6ucxlGu704oqLJBxtNyYKsSEh4KMo4lX4
+bOZVSct3LXifj5BQmF9vbi5FiJqFGtoY4iBw0IUq05CJ4nsQuW1ZLucXaw1tBRKn
+S1l/C0ECgYEA9zWVLQtWGrOZ7we7dTbF5ghZ541NjR9NmBFET5lNRU5yDG0poRdh
+WD2qioGJigV6ZaEoXny0jFqqqqPM5S/sDRtoicK+XlFuhURw0CZCAsisjVhCDGXU
++FJRbR+As7NFvb/9itvNE+PD4p39UXObePzM9JnlHSP7Ml0KdJqcQHUCgYEAwLOp
+Sp9k0CbFy/lQCSBbBiiu6ol/OxSzOBuZsFIbV8ILcn8v5NWdrcArssJBMdLTIaHN
+nrTxKOOAzFnPW6DeRmWM/NnwizB/a6uo34q6ywmXmgFSQPX86XTVZCdD96nNik0C
+KaEY2SqJxrnYstVApWRJAwy7T2jxJEj0aEZBH/ECgYEAmYyTuyXWdsFl9N2lp1m9
+NHOtfDD9oZF2/eSDvLlpEIp4NpW7jM7b7RZojp2FU9CxRN0EGSR2dNOAPHt/sj/A
+7CdBGIh4/FayQl7Pf8qzp80DuMvAQrkhvphK8W/m3jeVMxZEovKCAD+yFVmy1dvs
+DwtfNvM8J4yI47B85Q5/zV0CgYArxGKN/VfjYvsH0e9Ys02ZP4JC6MnJ/HCcLMCi
+aHOnYf5BmhuhqNbwULZcGny+OTkU6XAPPN+NPubRAxDyqb3yVTxJbaKRqok2Rj3L
+z/GPDfWt1+D7uiMgTxXscnKgfKOfZtA37kv7fwrd5PYP4BmXtwhSNgERDy+94wgH
+6vT9sQKBgBqsTsdDmBmKLQM/JzQC2AeQo0/ZFZIXdsiCShMbo2XALlaxZDYDu1it
+M/zkpmWmHncrBnnW3h6ME1ZZj2HGTowDuJvQqR7cZW5jWY3uLpOnEAGeOoKPhfOP
+IW2pVPZXq3Zl1yn86oG7C7poPRq0PRu+q2HtHP6/M0NgtGBx8F9M
+-----END RSA PRIVATE KEY-----
diff --git a/src/security/builtin_plugins/tests/validate_local_identity/etc/identity_certificate b/src/security/builtin_plugins/tests/validate_local_identity/etc/identity_certificate
new file mode 100644
index 0000000..6d3379d
--- /dev/null
+++ b/src/security/builtin_plugins/tests/validate_local_identity/etc/identity_certificate
@@ -0,0 +1,25 @@
+-----BEGIN CERTIFICATE-----
+MIIEQTCCAymgAwIBAgIINpuaAAnrQZIwDQYJKoZIhvcNAQELBQAwXzELMAkGA1UE
+BhMCTkwxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdp
+ZGdpdHMgUHR5IEx0ZDEYMBYGA1UEAxMPQ0hBTTUwMCByb290IGNhMCAXDTE3MDIy
+MjIyMjIwMFoYDzIyMjIwMjIyMjIyMjAwWjBcMQswCQYDVQQGEwJOTDETMBEGA1UE
+CBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRk
+MRUwEwYDVQQDEwxDSEFNNTAwIGNlcnQwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAw
+ggEKAoIBAQDCpVhivH/wBIyu74rvQncnSZqKyspN6CvD1pmV9wft5PHhVt9jV79v
+gSub5LADoRHAgFdv9duYgBr17Ob6uRrIY4B18CcrCjhQcC4gjx8y2jl9PeYm+qYD
+3o44FYBrBq0QCnrQgKsb/qX9Z+Mw/VUiw65x68W876LEHQQoEgT4kxSuagwBoVRk
+ePD6fYAKmT4XS3x+O0v+rHESTcsKF6yMadgp7h3eH1b8kJTzSx8JV9Zzq++mxjox
+qhbBVP5nDze2hhSIeCkCvSrx7efkgKS4AQXa5/Z44GiAu1TfXXUqdic9rxwD0edn
+ajNElnZe7sjok/0yuqvH+2hSqpNva/zpAgMBAAGjggEAMIH9MAwGA1UdDwQFAwMH
+/4AwgewGA1UdJQSB5DCB4QYIKwYBBQUHAwEGCCsGAQUFBwMCBggrBgEFBQcDAwYI
+KwYBBQUHAwQGCCsGAQUFBwMIBgorBgEEAYI3AgEVBgorBgEEAYI3AgEWBgorBgEE
+AYI3CgMBBgorBgEEAYI3CgMDBgorBgEEAYI3CgMEBglghkgBhvhCBAEGCysGAQQB
+gjcKAwQBBggrBgEFBQcDBQYIKwYBBQUHAwYGCCsGAQUFBwMHBggrBgEFBQgCAgYK
+KwYBBAGCNxQCAgYIKwYBBQUHAwkGCCsGAQUFBwMNBggrBgEFBQcDDgYHKwYBBQID
+BTANBgkqhkiG9w0BAQsFAAOCAQEAawdHy0Xw7nTK2ltp91Ion6fJ7hqYuj///zr7
+Adt6uonpDh/xl3esuwcFimIJrJrHujnGkL0nLddRCikmnzuBMNDWS6yq0/Ckl/YG
+yjNr44dlX24wo+MVAgkj3/8CyWDZ3a8kBg9QT3bs2SqbjmhTrXN1DRyf9S5vJysE
+I7V1gTN66BeKL64hOrAlRVrEu8Ds6TWL6Q/YH+61ViZkoLTeSaPjH4nknaFr4C35
+iji0JhkyfRHRRVPHFnaj25AkxOrSV64qVKoTMjDl5fji5iMGtjm6iJ7q05ml/qDl
+nLotHXemZNvYhbwUmRzbt4Dls9EMH4VRbP85I94nM5TAvtHVNA==
+-----END CERTIFICATE-----
diff --git a/src/security/builtin_plugins/tests/validate_local_identity/etc/identity_certificate_1024key b/src/security/builtin_plugins/tests/validate_local_identity/etc/identity_certificate_1024key
new file mode 100644
index 0000000..9384833
--- /dev/null
+++ b/src/security/builtin_plugins/tests/validate_local_identity/etc/identity_certificate_1024key
@@ -0,0 +1,17 @@
+-----BEGIN CERTIFICATE-----
+MIICrjCCAZYCCQDn8i4K9c4ErjANBgkqhkiG9w0BAQsFADBfMQswCQYDVQQGEwJO
+TDETMBEGA1UECAwKU29tZS1TdGF0ZTEhMB8GA1UECgwYSW50ZXJuZXQgV2lkZ2l0
+cyBQdHkgTHRkMRgwFgYDVQQDDA9DSEFNNTAwIHJvb3QgY2EwHhcNMTgwMjE2MTAy
+MzM2WhcNMjMwODA5MTAyMzM2WjBXMQswCQYDVQQGEwJOTDETMBEGA1UECAwKU29t
+ZS1TdGF0ZTEhMB8GA1UECgwYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMRAwDgYD
+VQQDDAdDSEFNNTY5MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDS5w0h8L70
+hkreKchVbTzfz4CrBLY4iADNSqPx9uW7DxjeHyLbKT2eRViY/xPuPXQmfRim01QM
+sZWKvFr6k9WMsJ6ItNtCyKS/beONqvXOddIu+4IhNzEGs5v4pTJAOzraoZcVmXnf
+Mr9G/baMYfMG47JR5HaSHDI5esa2STHt4wIDAQABMA0GCSqGSIb3DQEBCwUAA4IB
+AQBdZ2ijHYH8TkOGBqzsNwnNwPaDb/NA0vAO9T5kSOm8HA8vKHnNza+DeUJN+5P/
+P4fLK7UZqpQN32MpvXL0068g99RLjAzAsEVn+0FTyc08r9p/KO/dxxdMKeET7Cpv
+rMpu3W0A/EJptCQsTEZI0iqts7T2qQVXzoDlnUwEt3xdmKYJ9jbEq1UUCeexD3nP
+LB+JtUtfGevVzIoBjHv0qA3ePA24jDUlx5bxFeoIDC4tEewvUG5ZekftsRdNe3fk
+3LkwyK+4NN1ZCa2+S5SOAfjZA2o6qXiq/le0vWRgl7AHEgDr6w7xoRsw4K5dQ+0R
+eKtsBC4XO1GqrNYdKuJb1MhI
+-----END CERTIFICATE-----
diff --git a/src/security/builtin_plugins/tests/validate_local_identity/etc/invalid_identity_ca b/src/security/builtin_plugins/tests/validate_local_identity/etc/invalid_identity_ca
new file mode 100644
index 0000000..b7b7678
--- /dev/null
+++ b/src/security/builtin_plugins/tests/validate_local_identity/etc/invalid_identity_ca
@@ -0,0 +1,22 @@
+-----BEGIN CERTIFICATE-----
+MIIDljCCAn6gAwIBAgICEAAwDQYJKoZIhvcNAQELBQAwXzELMAkGA1UEBhMCTkwx
+EzARBgNVBAgMCk92ZXJpanNzZWwxEDAOBgNVBAcMB0hlbmdlbG8xDzANBgNVBAoM
+BkFETElOSzEYMBYGA1UEAwwPQ0hBTTUwMCBSb290IENBMB4XDTE4MDIwOTE2Mjky
+MVoXDTI4MDIwNzE2MjkyMVowVTELMAkGA1UEBhMCTkwxEzARBgNVBAgMCk92ZXJp
+anNzZWwxDzANBgNVBAoMBkFETElOSzEgMB4GA1UEAwwXQ0hBTTUwMCBJbnRlcm1l
+ZGlhdGUgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCwucuU/L6N
+iYxYJ7tyzcdzwXwYbr4GynZE4u2Sd7hcXrQGxTotm9BEhOZWscSGvH+UJSp0Vrb4
+3zDppiJ76ys6PeSBw1PpxdO97fO+eAE5DoXRj0a9lmnjbsV6waZ2GxgYQNVmKqbI
+uPDfW+jsmRcTO94s05GWQshHeiqxuEUAv3/Qe2vOhulrg4YDcXrIDWK93cr1EmRX
+Eq3Ck+Fjwtk5wAk3TANv2XQkVfS80jYAurL8J+XC2kyYB7e8KO92zqlfVXXMC3NI
+YDcq86bAI4NNMjVE2zIVheMLoOEXaV7KUTYfEQABZl76aWLDxjED9kf371tcrZzJ
+6xZ1M/rPGNblAgMBAAGjZjBkMB0GA1UdDgQWBBQngrlZqhQptCR4p04zqHamYUx7
+RTAfBgNVHSMEGDAWgBQrLYI+RHJtx1Pze8MSZbhaOful1DASBgNVHRMBAf8ECDAG
+AQH/AgEAMA4GA1UdDwEB/wQEAwIBhjANBgkqhkiG9w0BAQsFAAOCAQEAfMmiQ0tv
+o3K3xwSS621tsfkijUTx920hAe1XYY2XKrG7a/MJBhStex5A3AfqPOY9UMihkBl9
+3hgxOaddX9SAf2eLk2JLhqxZi1U/GVzT5h10AKLA5WUXIK4UGz3JRqhEm7V39t/N
+G0LCdpWOZueezkfO6eGcAvOKthdd32a3zbn+rzzDHdsjzxhEEv8d8x1Xf4xH2dgk
+HlpmpvXMfG/1aCzIpWGEPdkB7WR694GiCmh7hnFBiY+h1GFj2l5dThd51QqAlncM
+u+NmlPCrFZL0ulwRFeo80KOwDpxkqgavDlP9irdWqM9VHybjGu0xFHCeElz9M6od
+ym/MCh4ax7jDxg==
+-----END CERTIFICATE-----
diff --git a/src/security/builtin_plugins/tests/validate_local_identity/etc/invalid_identity_certificate b/src/security/builtin_plugins/tests/validate_local_identity/etc/invalid_identity_certificate
new file mode 100644
index 0000000..453f1fd
--- /dev/null
+++ b/src/security/builtin_plugins/tests/validate_local_identity/etc/invalid_identity_certificate
@@ -0,0 +1,20 @@
+-----BEGIN CERTIFICATE-----
+MIIDNzCCAh8CCQDn8i4K9c4ErDANBgkqhkiG9w0BAQsFADBfMQswCQYDVQQGEwJO
+TDETMBEGA1UECAwKU29tZS1TdGF0ZTEhMB8GA1UECgwYSW50ZXJuZXQgV2lkZ2l0
+cyBQdHkgTHRkMRgwFgYDVTQDDA9DSEFNNTAwIHJvb3QgY2EwHhcNMTgwMjEyMTUw
+NjUxWhcNMTkwNjI3MTUwNjUxWjBcMQswCQYDVQQGEwJOTDETMBEGA1UECAwKU29t
+ZS1TdGF0ZTEhMB8GA1UECgwYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMRUwEwYD
+VQQDDAxDSEFNNTAwIGNlcnQwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB
+AQDRnnNnV3PZrbZwjxk+dkQcO3pK3wMvoDNAHPPiTfXRV2KjLHxsuK7wV+GPHmXo
+97bot6vBxNQN7hfxoDLL+KBO9s3V+8OX6lOrF7hQ6+6/p9EgRoyNGo21eIzGwc2M
+aJAKjImNMbM7FDTvhk3u+VTTJtlnKvJM1tgncbEZwRLri/2MEC5XS/O5FQT4AXPr
+A6bRcGMqCVYtQ0ci6wd18PegA/rSmGSRf/TOd4jZXkxfHD+YOkHcxxz9sX4KnyOg
+XZm8jDdBc7rxiDep8kIjL06VszJeoQrxjuf8cNZtbol/7ECS5aM2YOx7t0Dc/629
+V2Q5waRVBV5xVCJ0BzUh8rIFAgMBAAEwDQYJKoZIhvcNAQELBQADggEBAGlkxYLr
+ZI/XNjDC6RFfSFRoDc+Xpcg+GsJKKbw2+btZvAD8z7ofL01yGru9oi6u2Yy/ZDKT
+liZ+gtsD8uVyRkS2skq7BvPzvoYErLmSqwlrcCbeX8uHiN7C76ll9PFtSjnwPD//
+UaNyZM5dJB2eBh4/prclix+RR/FWQzkPqEVLwMcFBmnPZ0mvR2tncjpZq476Qyl9
+3jcmfms9qBfBPPjCdXqGEDgsTd2PpYRD2WDj/Ctl4rV7B2jnByullLUYIWGu0rYt
+988waU5i8ie4t/TorBBLqQo/NO9jSXfEqcAnILPnv1QZanKzAAxSg7+FgFrsn359
+ihiEkx9zFUnPrdA=
+-----END CERTIFICATE-----
diff --git a/src/security/builtin_plugins/tests/validate_local_identity/etc/invalid_private_key b/src/security/builtin_plugins/tests/validate_local_identity/etc/invalid_private_key
new file mode 100644
index 0000000..2672622
--- /dev/null
+++ b/src/security/builtin_plugins/tests/validate_local_identity/etc/invalid_private_key
@@ -0,0 +1,27 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIIEowIBAAKCAQEA0Z5zZ1dz2a22cI8ZPnZEHDt6St8DL6AzQBzz4k310Vdioyx8
+bLiu8Ffhjx5l6Pe26LerwcTUDe4X8aAyy/igTvbN1fvDl+pTqxe4UOvuv6fRIEaM
+jRqNtXiMxsHNjGiQCoyJjTGzOxQ074ZN7vlU0ybZZyryTNbYJ3GxGcES64v9jBAu
+V0vzuRUE+AFz6wOm0XBjKglWLUNHIusHdfD3oAP60phkkX/0zneI2V5MXxw/mDpB
+3Mcc/bF+Cp8joF2ZvIw3QXO68Yg3qfJCIy9OlbMyXqEK8Y7n/HDWbW6Jf+xAkuWj
+NmDse7dA3P+tvVdkOcGkVQVecVQidAc1IfKyBQIDAQABAoIBAEddUpzUQTTS11Hq
+5gVF7lpORYxH8KW+PLSPJtjdAduLjKAQ++tn1OcuhDRdfQSbkUIZhfgqMqerb6tr
+ht+6fZlknR9E34pQ1LtjD/U83cOSNrhuTFudtrEZoZPpVzl+P8vXnNzdFs/+SSdi
+6hV5/U8F4u4kyOkwG9cR9eF2wiI+oQ/RBKCXUo3OVs9K27A/OkKsb7coL7yBsgBj
+lzorS9a/DyHT2eiMKjwCZFyG4A66EkLi6t9JLJ8oTkI2WskXYeVEAbEXE57RWm44
+2OgTgfsgYgf2ftXq93KD17FN1m77dqp7EPAhjGnRHNq7+0Ykr1EO1nbDfqHG4gS+4o
+lfP8iwECgYEA58da0R34l93yQnK0mAtoobwvsOjADnBVhBg9L4s2eDs8liUjf0zt
+7hcMdUJaa7iMuNf3qGtnZtRURc3kSOE429Or7fCAYUr/AaA7+2ekPG1vjMb50tVv
+se5rwb1hvgMYe2L5ktJJAg+RcmqpY+ncJ+hP/vWwZRxUKvXba50qqEkCgYEA54ZE
+mJfSueGM/63xlhP71CM4OWtTqkQGp2OmgTOsBI5q/GUXr8vMR8sCEMHAc6HyXzmL
+x/RnAoa/vTX58rXBk0QjfO9esIHa452697EIaJu5w8skCLDv2e/f+Jg7o/IDyUZs
+5lqhiEuH9Qc3sx2nhnSYXMZWqwh8OchI7dCSE90CgYEAzrJ1JhpxUJYI7wM2VIWQ
+GPQnH8BhTj8VtEidgCHJQK2rGUcjgepMIVECtiunUXtyW4GWBedKfmSKhvnXRLs9
+pqT9JaOeCaYFBiEsfMZvqUY4e/YSYtge1PIHvO40FWzTT23zneDUZPcXQY8nYsfy
+otBFTt0yIumBkhJRTIYLvakCgYA+CcttvBj6OAcJJ/n5RgeP05QoRqsXj7zcs6YV
+LtxkKClg0lHjiE+H2U0HYnOISJfijk/3V3UWxzavo7wDHlLtfC+qNZYA4/rcTRKh
+dm2TYk8HuPJB5e+PTWiNe3VXu+zpzRY3L4fjNqIKtVFmjIasT6fYDEmC8PYgoZtx
+JhdOfQKBgCD/bDkc+VI6lwQtoQQKiSfQjKGe+6Cw9K/obzWO0uJwBvZrGLXF8tTc
+MOPIv9OILt7DYxpMXAiHv8HtzH5CFVrZ/nj63Soka/j2yvUdBDrGhyIbsc4pDu+
+lCFa0ZiT/u5vRAiOkM6GuStH4HxnW9LtwBtiYXtfU7IPExJiAlsq
+-----END RSA PRIVATE KEY-----
diff --git a/src/security/builtin_plugins/tests/validate_local_identity/etc/new/CHAM-577.crt b/src/security/builtin_plugins/tests/validate_local_identity/etc/new/CHAM-577.crt
new file mode 100644
index 0000000..3b30c97
--- /dev/null
+++ b/src/security/builtin_plugins/tests/validate_local_identity/etc/new/CHAM-577.crt
@@ -0,0 +1,25 @@
+-----BEGIN CERTIFICATE-----
+MIIEPTCCAyWgAwIBAgIIRmtzSKaI+rowDQYJKoZIhvcNAQELBQAwXzELMAkGA1UE
+BhMCTkwxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdp
+ZGdpdHMgUHR5IEx0ZDEYMBYGA1UEAxMPQ0hBTTUwMCByb290IGNhMCAXDTE4MDMy
+MzEyMDEwMFoYDzIyMjIwMjIyMjIyMjAwWjBYMQswCQYDVQQGEwJOTDETMBEGA1UE
+CBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRk
+MREwDwYDVQQDEwhDSEFNLTU3NzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoC
+ggEBAMKlWGK8f/AEjK7viu9CdydJmorKyk3oK8PWmZX3B+3k8eFW32NXv2+BK5vk
+sAOhEcCAV2/125iAGvXs5vq5GshjgHXwJysKOFBwLiCPHzLaOX095ib6pgPejjgV
+gGsGrRAKetCAqxv+pf1n4zD9VSLDrnHrxbzvosQdBCgSBPiTFK5qDAGhVGR48Pp9
+gAqZPhdLfH47S/6scRJNywoXrIxp2CnuHd4fVvyQlPNLHwlX1nOr76bGOjGqFsFU
+/mcPN7aGFIh4KQK9KvHt5+SApLgBBdrn9njgaIC7VN9ddSp2Jz2vHAPR52dqM0SW
+dl7uyOiT/TK6q8f7aFKqk29r/OkCAwEAAaOCAQAwgf0wDAYDVR0PBAUDAwf/gDCB
+7AYDVR0lBIHkMIHhBggrBgEFBQcDAQYIKwYBBQUHAwIGCCsGAQUFBwMDBggrBgEF
+BQcDBAYIKwYBBQUHAwgGCisGAQQBgjcCARUGCisGAQQBgjcCARYGCisGAQQBgjcK
+AwEGCisGAQQBgjcKAwMGCisGAQQBgjcKAwQGCWCGSAGG+EIEAQYLKwYBBAGCNwoD
+BAEGCCsGAQUFBwMFBggrBgEFBQcDBgYIKwYBBQUHAwcGCCsGAQUFCAICBgorBgEE
+AYI3FAICBggrBgEFBQcDCQYIKwYBBQUHAw0GCCsGAQUFBwMOBgcrBgEFAgMFMA0G
+CSqGSIb3DQEBCwUAA4IBAQAniERWU9f/ijm9t8xuyOujEKDJl0Ded4El9mM5UYPR
+ZSnabPNKQjABBS4sVISIYVwfQxGkPgK0MeMBKqs/kWsZ4rp8h5hlZvxFX8H148mo
+3apNgdc/VylDBW5Ltbrypn/dZh9hFZE8Y/Uvo9HPksVEkjYuFN5v7e8/mwxTcrZ1
+BAZrTlDTiCR046NN1lUs/7oUaNCruFV7AU6RbGYnSzM6plPJHMRa9nzNeO0uPaHK
+kNPe+/UGpMi7cpF9w0M5Z1wW+Nq45bBRejFLQkHSjOEeGL2zi7T1HFAHZQydd6Wo
+zYffGTmyHqIjNArbOWEMYN6s1nqsQS+ifolr0MtfeHad
+-----END CERTIFICATE-----
diff --git a/src/security/builtin_plugins/tests/validate_local_identity/etc/new/identity_ca b/src/security/builtin_plugins/tests/validate_local_identity/etc/new/identity_ca
new file mode 100644
index 0000000..7e2675c
--- /dev/null
+++ b/src/security/builtin_plugins/tests/validate_local_identity/etc/new/identity_ca
@@ -0,0 +1,27 @@
+-----BEGIN CERTIFICATE-----
+MIIEmTCCA4GgAwIBAgIIZ5gEIUFhO5wwDQYJKoZIhvcNAQELBQAwXzELMAkGA1UE
+BhMCTkwxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdp
+ZGdpdHMgUHR5IEx0ZDEYMBYGA1UEAxMPQ0hBTTUwMCByb290IGNhMCAXDTE4MDIx
+MjE1MDUwMFoYDzIyMjIwMjIyMjIyMjAwWjBfMQswCQYDVQQGEwJOTDETMBEGA1UE
+CBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRk
+MRgwFgYDVQQDEw9DSEFNNTAwIHJvb3QgY2EwggEiMA0GCSqGSIb3DQEBAQUAA4IB
+DwAwggEKAoIBAQC6Fa3TheL+UrdZCp9GhU/2WbneP2t/avUa3muwDttPxeI2XU9k
+ZjBR95mAXme4SPXHk5+YDN319AqIje3oKhzky/ngvKH2GkoJKYxWnuDBfMEHdViz
+2Q9/xso2ZvH50ukwWa0pfx2/EVV1wRxeQcRd/UVfq3KTJizG0M88mOYvGEAw3LFf
+zef7k1aCuOofQmBvLukUudcYpMzfyHFp7lQqU4CcrrR5RtmfiUfrWfdGLea2iPDB
+pJgN8ESOMwEHtOTEBDclYnH9L4t7CHQz+fXXS5IWFsDK9fCMQjnxDsDVeNrNzTYL
+FaZrMg9S6IUQCEsQWsnq5weS8omOpVLUm9klAgMBAAGjggFVMIIBUTAMBgNVHRME
+BTADAQH/MB0GA1UdDgQWBBQg2FZB/j8uWDVnJhjwXkX278znSTAfBgNVHSMEGDAW
+gBQg2FZB/j8uWDVnJhjwXkX278znSTAPBgNVHQ8BAf8EBQMDB/+AMIHvBgNVHSUB
+Af8EgeQwgeEGCCsGAQUFBwMBBggrBgEFBQcDAgYIKwYBBQUHAwMGCCsGAQUFBwME
+BggrBgEFBQcDCAYKKwYBBAGCNwIBFQYKKwYBBAGCNwIBFgYKKwYBBAGCNwoDAQYK
+KwYBBAGCNwoDAwYKKwYBBAGCNwoDBAYJYIZIAYb4QgQBBgsrBgEEAYI3CgMEAQYI
+KwYBBQUHAwUGCCsGAQUFBwMGBggrBgEFBQcDBwYIKwYBBQUIAgIGCisGAQQBgjcU
+AgIGCCsGAQUFBwMJBggrBgEFBQcDDQYIKwYBBQUHAw4GBysGAQUCAwUwDQYJKoZI
+hvcNAQELBQADggEBAKHmwejWRwGE1wf1k2rG8SNRV/neGsZ6Qfqf6co3TpR/Wi1s
+iZDvSeT/rbqNBS7z34xnG88NIUwu00y78e8Mfon31ZZbK4Uo7fla9/D3ukdJqPQC
+LKdbKJjR2kH+KCukY/1rghjJ8/X+t2egBit0LCOdsFCl07Sfksb9kpGUIZSFcYYm
+geqhjhoNwxazzHiw+QWHC5HG9248JIizBmy1aymNWuMnPudhjHAnPcsIlqMVNq3t
+Rv9ap7S8JeCxHVRPJvJeCwXWvW3dW/v3xH52Yn/fqRblN1w9Fxz5NhopKx0gj/Jd
+sw2N4Fk4gaOWEolFpa0bwNw8nAx7moehZpowzfw=
+-----END CERTIFICATE-----
diff --git a/src/security/builtin_plugins/tests/validate_local_identity/etc/new/identity_ca_private_key b/src/security/builtin_plugins/tests/validate_local_identity/etc/new/identity_ca_private_key
new file mode 100644
index 0000000..eb4f6fc
--- /dev/null
+++ b/src/security/builtin_plugins/tests/validate_local_identity/etc/new/identity_ca_private_key
@@ -0,0 +1,27 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIIEowIBAAKCAQEAuhWt04Xi/lK3WQqfRoVP9lm53j9rf2r1Gt5rsA7bT8XiNl1P
+ZGYwUfeZgF5nuEj1x5OfmAzd9fQKiI3t6Coc5Mv54Lyh9hpKCSmMVp7gwXzBB3VY
+s9kPf8bKNmbx+dLpMFmtKX8dvxFVdcEcXkHEXf1FX6tykyYsxtDPPJjmLxhAMNyx
+X83n+5NWgrjqH0Jgby7pFLnXGKTM38hxae5UKlOAnK60eUbZn4lH61n3Ri3mtojw
+waSYDfBEjjMBB7TkxAQ3JWJx/S+Lewh0M/n110uSFhbAyvXwjEI58Q7A1Xjazc02
+CxWmazIPUuiFEAhLEFrJ6ucHkvKJjqVS1JvZJQIDAQABAoIBAFktMHtw60J0A3fB
+dmkGVDa78y4F+I88g6/XrYXW6NUHAQyKlRSJQFjXrpFtLImNNXPqVA47BFftFusw
+ETY0kFo5QkuoOnnFSXuwlJeiVhWDosHfQ54UxK+4ZYnCte3CXIwWPbzoNSoutWTU
+IbMuE1vzlz5s3GCWZ9jzkoz4vT8NrkucEQ2sxvAVWk2//SoQljN+b4BLDdsWl3Bq
+l+9JR2EzROXrPH5voYUZV17LbnCOmU+6ucxlGu704oqLJBxtNyYKsSEh4KMo4lX4
+bOZVSct3LXifj5BQmF9vbi5FiJqFGtoY4iBw0IUq05CJ4nsQuW1ZLucXaw1tBRKn
+S1l/C0ECgYEA9zWVLQtWGrOZ7we7dTbF5ghZ541NjR9NmBFET5lNRU5yDG0poRdh
+WD2qioGJigV6ZaEoXny0jFqqqqPM5S/sDRtoicK+XlFuhURw0CZCAsisjVhCDGXU
++FJRbR+As7NFvb/9itvNE+PD4p39UXObePzM9JnlHSP7Ml0KdJqcQHUCgYEAwLOp
+Sp9k0CbFy/lQCSBbBiiu6ol/OxSzOBuZsFIbV8ILcn8v5NWdrcArssJBMdLTIaHN
+nrTxKOOAzFnPW6DeRmWM/NnwizB/a6uo34q6ywmXmgFSQPX86XTVZCdD96nNik0C
+KaEY2SqJxrnYstVApWRJAwy7T2jxJEj0aEZBH/ECgYEAmYyTuyXWdsFl9N2lp1m9
+NHOtfDD9oZF2/eSDvLlpEIp4NpW7jM7b7RZojp2FU9CxRN0EGSR2dNOAPHt/sj/A
+7CdBGIh4/FayQl7Pf8qzp80DuMvAQrkhvphK8W/m3jeVMxZEovKCAD+yFVmy1dvs
+DwtfNvM8J4yI47B85Q5/zV0CgYArxGKN/VfjYvsH0e9Ys02ZP4JC6MnJ/HCcLMCi
+aHOnYf5BmhuhqNbwULZcGny+OTkU6XAPPN+NPubRAxDyqb3yVTxJbaKRqok2Rj3L
+z/GPDfWt1+D7uiMgTxXscnKgfKOfZtA37kv7fwrd5PYP4BmXtwhSNgERDy+94wgH
+6vT9sQKBgBqsTsdDmBmKLQM/JzQC2AeQo0/ZFZIXdsiCShMbo2XALlaxZDYDu1it
+M/zkpmWmHncrBnnW3h6ME1ZZj2HGTowDuJvQqR7cZW5jWY3uLpOnEAGeOoKPhfOP
+IW2pVPZXq3Zl1yn86oG7C7poPRq0PRu+q2HtHP6/M0NgtGBx8F9M
+-----END RSA PRIVATE KEY-----
diff --git a/src/security/builtin_plugins/tests/validate_local_identity/etc/new/identity_certificate b/src/security/builtin_plugins/tests/validate_local_identity/etc/new/identity_certificate
new file mode 100644
index 0000000..6d3379d
--- /dev/null
+++ b/src/security/builtin_plugins/tests/validate_local_identity/etc/new/identity_certificate
@@ -0,0 +1,25 @@
+-----BEGIN CERTIFICATE-----
+MIIEQTCCAymgAwIBAgIINpuaAAnrQZIwDQYJKoZIhvcNAQELBQAwXzELMAkGA1UE
+BhMCTkwxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdp
+ZGdpdHMgUHR5IEx0ZDEYMBYGA1UEAxMPQ0hBTTUwMCByb290IGNhMCAXDTE3MDIy
+MjIyMjIwMFoYDzIyMjIwMjIyMjIyMjAwWjBcMQswCQYDVQQGEwJOTDETMBEGA1UE
+CBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRk
+MRUwEwYDVQQDEwxDSEFNNTAwIGNlcnQwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAw
+ggEKAoIBAQDCpVhivH/wBIyu74rvQncnSZqKyspN6CvD1pmV9wft5PHhVt9jV79v
+gSub5LADoRHAgFdv9duYgBr17Ob6uRrIY4B18CcrCjhQcC4gjx8y2jl9PeYm+qYD
+3o44FYBrBq0QCnrQgKsb/qX9Z+Mw/VUiw65x68W876LEHQQoEgT4kxSuagwBoVRk
+ePD6fYAKmT4XS3x+O0v+rHESTcsKF6yMadgp7h3eH1b8kJTzSx8JV9Zzq++mxjox
+qhbBVP5nDze2hhSIeCkCvSrx7efkgKS4AQXa5/Z44GiAu1TfXXUqdic9rxwD0edn
+ajNElnZe7sjok/0yuqvH+2hSqpNva/zpAgMBAAGjggEAMIH9MAwGA1UdDwQFAwMH
+/4AwgewGA1UdJQSB5DCB4QYIKwYBBQUHAwEGCCsGAQUFBwMCBggrBgEFBQcDAwYI
+KwYBBQUHAwQGCCsGAQUFBwMIBgorBgEEAYI3AgEVBgorBgEEAYI3AgEWBgorBgEE
+AYI3CgMBBgorBgEEAYI3CgMDBgorBgEEAYI3CgMEBglghkgBhvhCBAEGCysGAQQB
+gjcKAwQBBggrBgEFBQcDBQYIKwYBBQUHAwYGCCsGAQUFBwMHBggrBgEFBQgCAgYK
+KwYBBAGCNxQCAgYIKwYBBQUHAwkGCCsGAQUFBwMNBggrBgEFBQcDDgYHKwYBBQID
+BTANBgkqhkiG9w0BAQsFAAOCAQEAawdHy0Xw7nTK2ltp91Ion6fJ7hqYuj///zr7
+Adt6uonpDh/xl3esuwcFimIJrJrHujnGkL0nLddRCikmnzuBMNDWS6yq0/Ckl/YG
+yjNr44dlX24wo+MVAgkj3/8CyWDZ3a8kBg9QT3bs2SqbjmhTrXN1DRyf9S5vJysE
+I7V1gTN66BeKL64hOrAlRVrEu8Ds6TWL6Q/YH+61ViZkoLTeSaPjH4nknaFr4C35
+iji0JhkyfRHRRVPHFnaj25AkxOrSV64qVKoTMjDl5fji5iMGtjm6iJ7q05ml/qDl
+nLotHXemZNvYhbwUmRzbt4Dls9EMH4VRbP85I94nM5TAvtHVNA==
+-----END CERTIFICATE-----
diff --git a/src/security/builtin_plugins/tests/validate_local_identity/etc/new/private_key b/src/security/builtin_plugins/tests/validate_local_identity/etc/new/private_key
new file mode 100644
index 0000000..06f57d1
--- /dev/null
+++ b/src/security/builtin_plugins/tests/validate_local_identity/etc/new/private_key
@@ -0,0 +1,27 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIIEogIBAAKCAQEAwqVYYrx/8ASMru+K70J3J0maisrKTegrw9aZlfcH7eTx4Vbf
+Y1e/b4Erm+SwA6ERwIBXb/XbmIAa9ezm+rkayGOAdfAnKwo4UHAuII8fMto5fT3m
+JvqmA96OOBWAawatEAp60ICrG/6l/WfjMP1VIsOucevFvO+ixB0EKBIE+JMUrmoM
+AaFUZHjw+n2ACpk+F0t8fjtL/qxxEk3LChesjGnYKe4d3h9W/JCU80sfCVfWc6vv
+psY6MaoWwVT+Zw83toYUiHgpAr0q8e3n5ICkuAEF2uf2eOBogLtU3111KnYnPa8c
+A9HnZ2ozRJZ2Xu7I6JP9Mrqrx/toUqqTb2v86QIDAQABAoIBAC1q32DKkx+yMBFx
+m32QiLUGG6VfBC2BixS7MkMnzRXZYgcuehl4FBc0kLRjfB6cqsO8LqrVN1QyMBhK
+GutN3c38SbE7RChqzhEW2+yE+Mao3Nk4ZEecHLiyaYT0n25ZtHAVwep823BAzwJ+
+BykbM45VEpNKbG1VjSktjBa9faNyZiZAEJEjVyla+6R8N4kHV52LbZcLjvJv3IQ2
+iPYRrmMyI5C23qTni0vy7yJbAXBo3CqgSlwie9FARBWT7Puu7F4mF1O1c/SnTysw
+Tm3e5FzgfHipQbnRVn0w4rDprPMKmPxMnvf/Wkw0zVgNadp1Tc1I6Yj525DEQ07i
+2gIn/gECgYEA4jNnY1u2Eu7x3pAQF3dRO0x35boVtuq9iwQk7q+uaZaK4RJRr+0Y
+T68S3bPnfer6SHvcxtST89Bvs/j/Ky4SOaX037UYjFh6T7OIzPl+MzO1yb+VOBT6
+D6FVGEJGp8ZAITU1OfJPeTYViUeEC8tHFGoKUCk50FbB6jOf1oKtv/ECgYEA3EnB
+Y7kSbJJaUuj9ciFUL/pAno86Cim3VjegK1wKgEiyDb610bhoMErovPwfVJbtcttG
+eKJNuwizkRcVbj+vpjDvqqaP5eMxLl6/Nd4haPMJYzGo88Z8NJpwFRNF2KEWjOpQ
+2NEvoCeRtVulCJyka2Tpljzw8cOXkxhPOe2UhHkCgYBo3entj0QO7QXm56T+LAvV
+0PK45xdQEO3EuCwjGAFk5C0IgUSrqeCeeIzniZMltj1IQ1wsNbtNynEu3530t8wt
+O7oVyFBUKGSz9IjUdkpClJOPr6kPMfJoMqRPtdIpz+hFPPSrI6IikKdVWHloOlp+
+pVaYqTQrWT1XRY2xli3VEQKBgGySmZN6Cx+h/oywswIGdUT0VdcQhq2to+QFpJba
+VX6m1cM6hMip2Ag9U3qZ1SNPBBdBBfm9HQybHE3dj713/C2wHuAAGhpXIM1W+20k
+X1knuC/AsSH9aQhQOf/ZMOq1crTfZBuI9q0782/sjGmzMsKPySU4QhUWruVb7OiD
+NVkZAoGAEvihW7G+8/iOE40vGHyBqUeopAAWLciTAUIEwM/Oi3BYfNWNTWF/FWNc
+nMvCZPYigY8C1vO+1iT2Frtd3CIU+f01Q3fJNJoRLlEiKLNZUJRF48OKUqjKSmsi
+w6pucFO40z05YW7utApj4L82rZnOS0pd1tUI1yexqvj0i4ThJfk=
+-----END RSA PRIVATE KEY-----
diff --git a/src/security/builtin_plugins/tests/validate_local_identity/etc/old/Alice_Test_2.crt b/src/security/builtin_plugins/tests/validate_local_identity/etc/old/Alice_Test_2.crt
new file mode 100644
index 0000000..f5f77eb
--- /dev/null
+++ b/src/security/builtin_plugins/tests/validate_local_identity/etc/old/Alice_Test_2.crt
@@ -0,0 +1,25 @@
+-----BEGIN CERTIFICATE-----
+MIIEJTCCAw2gAwIBAgIBFzANBgkqhkiG9w0BAQsFADBzMQswCQYDVQQGEwJOTDEL
+MAkGA1UECBMCT1YxEzARBgNVBAoTCkFETGluayBJU1QxGjAYBgNVBAMTEUlkZW50
+aXR5IENBIFRlc3QyMSYwJAYJKoZIhvcNAQkBFhdpbmZvQGlzdC5hZGxpbmt0ZWNo
+LmNvbTAeFw0xODA3MjAwMDAwMDBaFw0yNzA3MTkyMzU5NTlaMG0xCzAJBgNVBAYT
+Ak5MMQswCQYDVQQIEwJPVjETMBEGA1UEChMKQURMaW5rIElTVDEUMBIGA1UEAxML
+QWxpY2UgVGVzdDIxJjAkBgkqhkiG9w0BCQEWF2luZm9AaXN0LmFkbGlua3RlY2gu
+Y29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA0Fb60RkFrDsRAIRf
+LMf2fsiRnw9Agp7yEbUsA4Zg4X+hRhBkk78fFtagLisWo4LbT4DqKzqQXCvVnOn9
+a6uT0KsVejk2iaLoBy0fotQznudio3rzDpTfzP9eRDFVj8RJnl3JJ8P1DULxH7N0
+TyDBuKZ1ibBfuKjPffqeCEzYKgAc8NG2FB4m6mXzHhXuKw6W2v0IbHz6KYldsavf
+04rq7ztw0t67bexSQ4gLSVJEwiohAregm0dLvQnap5xd2qn0yETteTL8Y+Ujym1D
+WAnwDdwA6+0j2a0wkyzOzYQpZMt95NyZ8kcoqEqO8KAN2HclqfjHlg9iDscbof5x
+45SQwwIDAQABo4HJMIHGMAwGA1UdEwQFMAMBAf8wHQYDVR0OBBYEFL66FT0vnlFE
++PKrtV+KhJoLsCOWMB8GA1UdIwQYMBaAFIFGyWkPWvNkBD2SCYj9H+NfnlOLMA8G
+A1UdDwEB/wQFAwMH/4AwZQYDVR0lAQH/BFswWQYIKwYBBQUHAwEGCCsGAQUFBwMC
+BggrBgEFBQcDAwYIKwYBBQUHAwQGCCsGAQUFBwMIBggrBgEFBQcDCQYIKwYBBQUH
+Aw0GCCsGAQUFBwMOBgcrBgEFAgMFMA0GCSqGSIb3DQEBCwUAA4IBAQCsBINpBXSp
+Xe3f5MMObeUXE2VhWZWIjMdDQRFDDjq6u1YR7rbffsCReiCX5zviU2dtVV8VN3MQ
+k7wp8qEDKwP1ToMIwZGwT4Hfwei1eueJ1vuotgiGe0Gm3otXlGsb0C5otnsu63MM
+OeFgkpZde3VpIqK9EmhgjWOD8TXc8Me7zBlYSEIaXkkwP0jAKRf5vFgz0WfE5ITx
+SDKUO0OrcN789flO/OKLAHZ4cqNcxNPkMz7h9VBSgRRRk115HEa8Fe46nl1YpwRG
+0urHlyAKoUV+J+I3Qy4+SwIDwix978hgGN3bKVyv9q0yAQRzpZ54EJOj4C7lNEpB
+roGVpY4yYP/B
+-----END CERTIFICATE-----
diff --git a/src/security/builtin_plugins/tests/validate_local_identity/etc/old/Bob_Chain_Test.crt b/src/security/builtin_plugins/tests/validate_local_identity/etc/old/Bob_Chain_Test.crt
new file mode 100644
index 0000000..e980af3
--- /dev/null
+++ b/src/security/builtin_plugins/tests/validate_local_identity/etc/old/Bob_Chain_Test.crt
@@ -0,0 +1,25 @@
+-----BEGIN CERTIFICATE-----
+MIIEJDCCAwygAwIBAgIBAzANBgkqhkiG9w0BAQsFADB9MQswCQYDVQQGEwJOTDEL
+MAkGA1UECBMCT1YxEzARBgNVBAoTCkFETGluayBJU1QxJDAiBgNVBAMTG0lkZW50
+aXR5IENBIFRlc3QgV2l0aCBDaGFpbjEmMCQGCSqGSIb3DQEJARYXaW5mb0Bpc3Qu
+YWRsaW5rdGVjaC5jb20wHhcNMTgwNjEzMDAwMDAwWhcNMjcwNjEwMjM1OTU5WjBw
+MQswCQYDVQQGEwJOTDELMAkGA1UECBMCT1YxEzARBgNVBAoTCkFETGluayBJU1Qx
+FzAVBgNVBAMTDkJvYiBDaGFpbiBUZXN0MSYwJAYJKoZIhvcNAQkBFhdpbmZvQGlz
+dC5hZGxpbmt0ZWNoLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEB
+AMHm+qG5afCHFdmp98+Z+POB7vD3WhfghKVugh8FenewuPaaotKxiGAE0kCf8WXU
+5l4XDR3iBWJsGDHll1yOyL4KW9grwfnfiJMl82uIzKGDiRJbFkXVOLF/DcVLsuqM
+oRjlk09+nlrg/7xS96itgm6yueW/UOIXpo+ElCHwnrYnpuHHrYM0s7t1ls3QFSyd
+a3INx+LkM6N/b+veVJF95yfe4GvVBhFpLkWtX4xKgZyMjczvmZ6LVNNSnthPhlZF
+HmspQyqXrTnGyax3qyoloqh9ibDvAK5pUnzqlv/Dyyt110q3bXFR5A0wqfj0fqtp
+7Mw4TdTkFQy1n4/Y4EuT8I8CAwEAAaOBuzCBuDAdBgNVHQ4EFgQUQpxLPHT5o/GQ
+RwdBw2scINXnWlUwHwYDVR0jBBgwFoAUTVVCTRc4ST0XmE+EEsenSudwlwkwDwYD
+VR0PAQH/BAUDAwf/gDBlBgNVHSUBAf8EWzBZBggrBgEFBQcDAQYIKwYBBQUHAwIG
+CCsGAQUFBwMDBggrBgEFBQcDBAYIKwYBBQUHAwgGCCsGAQUFBwMJBggrBgEFBQcD
+DQYIKwYBBQUHAw4GBysGAQUCAwUwDQYJKoZIhvcNAQELBQADggEBAJwd60WigqbB
+/6CT0ekvXZdvIV5IaIKiy6KYU0/0ebPVXn0YKp9LQTE6lYCr6hZUcEjBfkFBZhAy
+KJJOb2sUXAnYqnX/mIipiNb7oHsCHxVCKAwEcmxsS3tGl2CXgpKL8EQQFKJgSrC/
+uzhf2QESQ0T5Mgni1jXXGf6SAwFAjk+mAM9bMdrtLOX39e5aKrgpZOHmdFke+m/K
+upxP/M0/omTNNQaSfWDmfDvpdsRD9+mFG12Kzgpue2jut1qeICvSmcQsu2OBYG/Q
+ZXMx8e8azoX0KB+njf826UcVgDkDmfwN9taOU2lFsmZAvYhpIslNwtH/Htu3zJWO
+vQxyIh+kxFQ=
+-----END CERTIFICATE-----
diff --git a/src/security/builtin_plugins/tests/validate_local_identity/etc/old/Identity_CA_Test2.crt b/src/security/builtin_plugins/tests/validate_local_identity/etc/old/Identity_CA_Test2.crt
new file mode 100644
index 0000000..592eea3
--- /dev/null
+++ b/src/security/builtin_plugins/tests/validate_local_identity/etc/old/Identity_CA_Test2.crt
@@ -0,0 +1,25 @@
+-----BEGIN CERTIFICATE-----
+MIIEKzCCAxOgAwIBAgIBFjANBgkqhkiG9w0BAQsFADBzMQswCQYDVQQGEwJOTDEL
+MAkGA1UECBMCT1YxEzARBgNVBAoTCkFETGluayBJU1QxGjAYBgNVBAMTEUlkZW50
+aXR5IENBIFRlc3QyMSYwJAYJKoZIhvcNAQkBFhdpbmZvQGlzdC5hZGxpbmt0ZWNo
+LmNvbTAeFw0xODA3MjAwMDAwMDBaFw0yNzA3MTkyMzU5NTlaMHMxCzAJBgNVBAYT
+Ak5MMQswCQYDVQQIEwJPVjETMBEGA1UEChMKQURMaW5rIElTVDEaMBgGA1UEAxMR
+SWRlbnRpdHkgQ0EgVGVzdDIxJjAkBgkqhkiG9w0BCQEWF2luZm9AaXN0LmFkbGlu
+a3RlY2guY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAyIweDOdB
+xotexcDiUdbIdDLu9A6/KSpkxUJnYb2iRhBonmCNFvErEokso/Dga6QT3rg83UCg
+GMJBSJSZhq/j+eZweHoXS8Ccet/aF2iNj5A5Uhn476M3zMg+rCoos2yKlpZLOz1x
+QjrRJfeOoBHvkHkxBeupnnQPx4oAro7zoXMIO83NKLwCROC/kGq1ktW8fbKa5THQ
+z0QfZG3zAeD93N+dTAqA+jkCfzbrQepF243Tu4cLaGwVALZ/8cZ7sky8+OOmKnBU
+P9r+U/4L62DVJYnYkTGnYEwqXcM1b8/JHasmKEaHXgAu/UI5i/SZfRPZUyC1ERSv
+tX6k7sBxZZSPLQIDAQABo4HJMIHGMAwGA1UdEwQFMAMBAf8wHQYDVR0OBBYEFIFG
+yWkPWvNkBD2SCYj9H+NfnlOLMB8GA1UdIwQYMBaAFIFGyWkPWvNkBD2SCYj9H+Nf
+nlOLMA8GA1UdDwEB/wQFAwMH/4AwZQYDVR0lAQH/BFswWQYIKwYBBQUHAwEGCCsG
+AQUFBwMCBggrBgEFBQcDAwYIKwYBBQUHAwQGCCsGAQUFBwMIBggrBgEFBQcDCQYI
+KwYBBQUHAw0GCCsGAQUFBwMOBgcrBgEFAgMFMA0GCSqGSIb3DQEBCwUAA4IBAQCK
+SkemYQIvsslkMc8PNHSk2om4xk7hUXkatAZPN9dvRravu3PJqMWxpQ0TWbddrkBL
+he7/ARC2G9vVUwQl2b8K1Rjt/nZ3j+NPvhCDzcPyxjornyN8IG1NJQVH18fTxR23
+6PvDBE0H2trA3WJgKo6Wlxo6CHWts8ulFWWXBE1nNQw30hU49FDsFn3nz6Gry4ti
+/ouAvbz+UXSsT9R+zkci3A394sEsOCZSStgAnXsejU45pCt6OtCGaLfDvEPp21az
+OEjuIaj6Kbd+MHeLyPoe+d1Bkl39OnAUEJ8q2HdwvIg2ZqP6h0agm5gpZo/ALDWn
+9P3owIGVsHFGkYqhHc+K
+-----END CERTIFICATE-----
diff --git a/src/security/builtin_plugins/tests/validate_local_identity/etc/old/Identity_CA_Test_With_Chain.crt b/src/security/builtin_plugins/tests/validate_local_identity/etc/old/Identity_CA_Test_With_Chain.crt
new file mode 100644
index 0000000..35506b8
--- /dev/null
+++ b/src/security/builtin_plugins/tests/validate_local_identity/etc/old/Identity_CA_Test_With_Chain.crt
@@ -0,0 +1,25 @@
+-----BEGIN CERTIFICATE-----
+MIIENDCCAxygAwIBAgIBAjANBgkqhkiG9w0BAQsFADByMQswCQYDVQQGEwJOTDEL
+MAkGA1UECBMCT1YxEzARBgNVBAoTCkFETGluayBJU1QxGTAXBgNVBAMTEElkZW50
+aXR5IENBIFRlc3QxJjAkBgkqhkiG9w0BCQEWF2luZm9AaXN0LmFkbGlua3RlY2gu
+Y29tMB4XDTE4MDYxMzAwMDAwMFoXDTI3MDYxMDIzNTk1OVowfTELMAkGA1UEBhMC
+TkwxCzAJBgNVBAgTAk9WMRMwEQYDVQQKEwpBRExpbmsgSVNUMSQwIgYDVQQDExtJ
+ZGVudGl0eSBDQSBUZXN0IFdpdGggQ2hhaW4xJjAkBgkqhkiG9w0BCQEWF2luZm9A
+aXN0LmFkbGlua3RlY2guY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKC
+AQEA1r8Q0V8ZVeBs8tPMF0N+JlBynl1Zn/89vwSsU4m7y6ixUcW/y3r12CMeA0cH
+g6yOaOdHsZ8pRlPRwy9YmeOwLsMOUHAURP2uPiTjSf3pttUIf0jv602GyirNzoS7
+7mHiyTtV80ZMzZlLIJ3gaJJlG4DjitFuFcjv8sOmviFjkn1kOjkAz1nKgsCiHvvg
+fcJlYPrtLfle9SzvZ3MTq4ob+/EFu9nt5bYYs7p7Br1TGWctUw98l2mSn/FhfDBw
+9bb7ZhcKB7W6PGy2Os5AnkdTJKHoOQT+RmnHzPBhab0BoKuy8IhfW2GyqC8rL5Tm
+/UVLUvnx4Zzqz//3IyA2FTb1HQIDAQABo4HJMIHGMAwGA1UdEwQFMAMBAf8wHQYD
+VR0OBBYEFE1VQk0XOEk9F5hPhBLHp0rncJcJMB8GA1UdIwQYMBaAFER4R6N3MQ1W
+l7gn+R8wwHloDCVZMA8GA1UdDwEB/wQFAwMH/4AwZQYDVR0lAQH/BFswWQYIKwYB
+BQUHAwEGCCsGAQUFBwMCBggrBgEFBQcDAwYIKwYBBQUHAwQGCCsGAQUFBwMIBggr
+BgEFBQcDCQYIKwYBBQUHAw0GCCsGAQUFBwMOBgcrBgEFAgMFMA0GCSqGSIb3DQEB
+CwUAA4IBAQCbl7ed4p66G6WquxO7ceZFvYKn3kDErjCfXHcqHxBnA2xTpoZCGj95
+Qpirqo6N4UcLX5sn3CmgyVk0dYvlti/53FJgZ9XQDNxBuEYWPkY7vO+Uo0WdYpGz
+ZDNIUQpiPMA7bHvwKldTIs77xxtnw9kbBU2k0xQyb2tdZNfD5YqSI1MeUtpEpNFW
+sbC8+mQ3clzWpjF8eHH1fFSAmlJ+z1Uqmtt2FK0vRz+MQcpydwvpMnfqGdcwhGPQ
+X4HZreLObjBA8KUEkUB3+rZXuELBgkk/c8/jRZl7QF5jJDLQCCLg7KoYBKN2GuTt
+/dzeSnP7VZm/nTL8wpCvKgSOwOGgklf2
+-----END CERTIFICATE-----
diff --git a/src/security/builtin_plugins/tests/validate_local_identity/etc/old/alice.pem b/src/security/builtin_plugins/tests/validate_local_identity/etc/old/alice.pem
new file mode 100644
index 0000000..07a5977
--- /dev/null
+++ b/src/security/builtin_plugins/tests/validate_local_identity/etc/old/alice.pem
@@ -0,0 +1,27 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIIEowIBAAKCAQEA0Fb60RkFrDsRAIRfLMf2fsiRnw9Agp7yEbUsA4Zg4X+hRhBk
+k78fFtagLisWo4LbT4DqKzqQXCvVnOn9a6uT0KsVejk2iaLoBy0fotQznudio3rz
+DpTfzP9eRDFVj8RJnl3JJ8P1DULxH7N0TyDBuKZ1ibBfuKjPffqeCEzYKgAc8NG2
+FB4m6mXzHhXuKw6W2v0IbHz6KYldsavf04rq7ztw0t67bexSQ4gLSVJEwiohAreg
+m0dLvQnap5xd2qn0yETteTL8Y+Ujym1DWAnwDdwA6+0j2a0wkyzOzYQpZMt95NyZ
+8kcoqEqO8KAN2HclqfjHlg9iDscbof5x45SQwwIDAQABAoIBAG0dYPeqd0IhHWJ7
+8azufbchLMN1pX/D51xG2uptssfnpHuhkkufSZUYi4QipRS2ME6PYhWJ8pmTi6lH
+E6cUkbI0KGd/F4U2gPdhNrR9Fxwea5bbifkVF7Gx/ZkRjZJiZ3w9+mCNTQbJDKhh
+wITAzzT6WYznhvqbzzBX1fTa6kv0GAQtX7aHKM+XIwkhX2gzU5TU80bvH8aMrT05
+tAMGQqkUeRnpo0yucBl4VmTZzd/+X/d2UyXR0my15jE5iH5o+p+E6qTRE9D+MGUd
+MQ6Ftj0Untqy1lcog1ZLL6zPlnwcD4jgY5VCYDgvabnrSwymOJapPLsAEdWdq+U5
+ec44BMECgYEA/+3qPUrd4XxA517qO3fCGBvf2Gkr7w5ZDeATOTHGuD8QZeK0nxPl
+CWhRjdgkqo0fyf1cjczL5XgYayo+YxkO1Z4RUU+8lJAHlVx9izOQo+MTQfkwH4BK
+LYlHxMoHJwAOXXoE+dmBaDh5xT0mDUGU750r763L6EFovE4qRBn9hxkCgYEA0GWz
+rpOPNxb419WxG9npoQYdCZ5IbmEOGDH3ReggVzWHmW8sqtkqTZm5srcyDpqAc1Gu
+paUveMblEBbU+NFJjLWOfwB5PCp8jsrqRgCQSxolShiVkc3Vu3oyzMus9PDge1eo
+9mwVGO7ojQKWRu/WVAakENPaAjeyyhv4dqSNnjsCgYEAlwe8yszqoY1k8+U0T0G+
+HeIdOCXgkmOiNCj+zyrLvaEhuS6PLq1b5TBVqGJcSPWdQ+MrglbQIKu9pUg5ptt7
+wJ5WU+i9PeK9Ruxc/g/BFKYFkFJQjtZzb+nqm3wpul8zGwDN/O/ZiTqCyd3rHbmM
+/dZ/viKPCZHIEBAEq0m3LskCgYBndzcAo+5k8ZjWwBfQth5SfhCIp/daJgGzbYtR
+P/BenAsY2KOap3tjT8Fsw5usuHSxzIojX6H0Gvu7Qzq11mLn43Q+BeQrRQTWeFRc
+MQdy4iZFZXNNEp7dF8yE9VKHwdgSJPGUdxD6chMvf2tRCN6mlS171VLV6wVvZvez
+H/vX5QKBgD2Dq/NHpjCpAsECP9awmNF5Akn5WJbRGmegwXIih2mOtgtYYDeuQyxY
+ZCrdJFfIUjUVPagshEmUklKhkYMYpzy2PQDVtaVcm6UNFroxT5h+J+KDs1LN1H8G
+LsASrzyAg8EpRulwXEfLrWKiu9DKv8bMEgO4Ovgz8zTKJZIFhcac
+-----END RSA PRIVATE KEY-----
diff --git a/src/security/builtin_plugins/tests/validate_local_identity/etc/old/bob.pem b/src/security/builtin_plugins/tests/validate_local_identity/etc/old/bob.pem
new file mode 100644
index 0000000..cf62cc3
--- /dev/null
+++ b/src/security/builtin_plugins/tests/validate_local_identity/etc/old/bob.pem
@@ -0,0 +1,27 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIIEowIBAAKCAQEAweb6oblp8IcV2an3z5n484Hu8PdaF+CEpW6CHwV6d7C49pqi
+0rGIYATSQJ/xZdTmXhcNHeIFYmwYMeWXXI7Ivgpb2CvB+d+IkyXza4jMoYOJElsW
+RdU4sX8NxUuy6oyhGOWTT36eWuD/vFL3qK2CbrK55b9Q4hemj4SUIfCetiem4cet
+gzSzu3WWzdAVLJ1rcg3H4uQzo39v695UkX3nJ97ga9UGEWkuRa1fjEqBnIyNzO+Z
+notU01Ke2E+GVkUeaylDKpetOcbJrHerKiWiqH2JsO8ArmlSfOqW/8PLK3XXSrdt
+cVHkDTCp+PR+q2nszDhN1OQVDLWfj9jgS5PwjwIDAQABAoIBAHfgWhED9VgL29le
+uGMzmPLK4LM+6Qcb+kXghTeyhl1a928WeRVzRpG+SVJEz9QaBHYlICnaY2PO2kJ2
+49YIPFkpRFDn9JuLs/7tFonj4Eb2cBbWE3YG9W7e0t+oBiv1117yB9m8uSAMPG7s
+iEpTQvE3M7CzT8kHwCS4XXCCN0z7LqKyZ1heScjdfhV3D2TnFFjdtQ/9KfQa3hIc
+6ftbpi4EKbfasspyqfrJ/cqjHzse9iEXLOZJhs+atBAKe/uJ4Hc3LRPbX4MPniAp
+JJrldXFK9p+HILlbXvu+5n+DSGbZmT1x9a/E9suGyoJiASDH2Ax4yCVTi+v8C1R2
+aKdU1LkCgYEA/3dFuM6zIHwiJ0GKT0gtJL6J3m+i51SNcRIm8deXt6HULMpUNajj
+vZ1bgQm/h+uRBlPV3swkaVxvPTIabOTY4gmCBSzvVCSIAKHVc/+5Nkl9KruwSq4G
+tctmXZ7ymMDi+6QGCJTJkAx6jptXyrzC00HOjXOwyQ+iDipqgr3A8FsCgYEAwk7B
+2/hi569EIHFRT6nz/JMqQVPZ/MJDKoKhffTbnjQ5OAzpiVN6cyThMM1iVJEBFNhx
+OEacy60Qj0TtR1oYrQSRSLm58TTxiuB4Pohbmg3iU+kSM/eTq/ups/Ul1oCs2eAb
+POfweD3c4d4i7sN8bUNQXehiE4MOlK9TYQy39t0CgYAJht0mwy6S644qgJsz0bE9
+SY3Cqc8daV3M9axWIIAb7QEImpMBXUcA7zlWWpK18ub5oW68XEiPVU8grRmnLfGY
+nFoo70ANlz8rJt3a8ZJqn9r3GQC+CDdf2DH9E8xgPfE5CSjgcQwDPzPi1ZA0k02A
+q1eUltfk55xXguVt8r2bOQKBgQC7+kldr1yv20VDRZ1uPnMGRLE6Zg6bkqw78gid
+vEbDNK6uZP+BlTr/LgyVk/yu52Fucz6FPPrvqEw+7mXHA4ifya1r+BHFIn0S57os
+dOp5jTkKCI9NqxQ3683vhRjH/dA7L63qLFDdYqvP74FID+LOKbMURn6rdbyjZ0J4
+vz8yGQKBgHIzcKlQosRxf+KptOPMGRs30L9PnH+sNmTo2SmEzAGkBkt1msGRh/2l
+uT3hOEhUXL9knRyXwQSXgrIwr9QwI5rGS5FAgX26TgBtPBDs2NuyyhhS5yxsiEPT
+BR+EjQFW9dzRkpRJgvsG4DcNAhFn7fQqFNcWXgFWuBXmGNkdtEGR
+-----END RSA PRIVATE KEY-----
diff --git a/src/security/builtin_plugins/tests/validate_local_identity/etc/old/ec_identity_ca b/src/security/builtin_plugins/tests/validate_local_identity/etc/old/ec_identity_ca
new file mode 100644
index 0000000..cfd24b6
--- /dev/null
+++ b/src/security/builtin_plugins/tests/validate_local_identity/etc/old/ec_identity_ca
@@ -0,0 +1,14 @@
+-----BEGIN CERTIFICATE-----
+MIICEDCCAbegAwIBAgIJAPOifu8ejrRRMAoGCCqGSM49BAMCMGUxCzAJBgNVBAYT
+Ak5MMRMwEQYDVQQIDApTb21lLVN0YXRlMR8wHQYDVQQKDBZBRExJTksgVGVjaG5v
+bG9neSBCLlYuMSAwHgYDVQQDDBdDSEFNXzU3MCBDQSBjZXJ0aWZpY2F0ZTAeFw0x
+OTAyMTgxMDQwMTZaFw00NjA3MDYxMDQwMTZaMGUxCzAJBgNVBAYTAk5MMRMwEQYD
+VQQIDApTb21lLVN0YXRlMR8wHQYDVQQKDBZBRExJTksgVGVjaG5vbG9neSBCLlYu
+MSAwHgYDVQQDDBdDSEFNXzU3MCBDQSBjZXJ0aWZpY2F0ZTBZMBMGByqGSM49AgEG
+CCqGSM49AwEHA0IABMXCYXBHEryADoYXMEE0Jw9aHlA7p3KVFzuypxuez0n7rKoX
+k9kanNtrw5o2X4WSWKM7zkH4I6AU7xSAQgJN+8GjUDBOMB0GA1UdDgQWBBR1Llq9
+zrRrTJLSvUJykksncZ+HsDAfBgNVHSMEGDAWgBR1Llq9zrRrTJLSvUJykksncZ+H
+sDAMBgNVHRMEBTADAQH/MAoGCCqGSM49BAMCA0cAMEQCIHKRM3VeB2F7z3nJT752
+gY5mNdj91ulmNX84TXA7UHNKAiA2ytpsV4OKURHkjyn1gnW48JDKtHGZF6/tMNvX
+VrDITA==
+-----END CERTIFICATE-----
diff --git a/src/security/builtin_plugins/tests/validate_local_identity/etc/old/ec_identity_certificate b/src/security/builtin_plugins/tests/validate_local_identity/etc/old/ec_identity_certificate
new file mode 100644
index 0000000..5c29b6e
--- /dev/null
+++ b/src/security/builtin_plugins/tests/validate_local_identity/etc/old/ec_identity_certificate
@@ -0,0 +1,50 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 4096 (0x1000)
+    Signature Algorithm: ecdsa-with-SHA256
+        Issuer: C=NL, ST=Some-State, O=ADLINK Technology B.V., CN=CHAM_570 CA certificate
+        Validity
+            Not Before: Feb 18 10:52:41 2019 GMT
+            Not After : Jul  6 10:52:41 2046 GMT
+        Subject: C=NL, ST=Some-State, O=ADLINK Technology B.V., CN=CHAM_570 Identity certificate
+        Subject Public Key Info:
+            Public Key Algorithm: id-ecPublicKey
+                Public-Key: (256 bit)
+                pub: 
+                    04:9d:b5:7b:f5:fe:63:da:24:e4:0c:26:c5:32:55:
+                    55:b3:7f:7a:60:ea:0d:56:2c:0a:85:e0:5b:85:5a:
+                    01:1b:69:fc:23:79:98:33:d6:60:d5:d9:ab:1e:1d:
+                    7a:1e:c2:5f:ad:30:9b:73:45:40:39:d9:07:f7:59:
+                    8d:44:f6:6b:e3
+                ASN1 OID: prime256v1
+                NIST CURVE: P-256
+        X509v3 extensions:
+            X509v3 Basic Constraints: 
+                CA:false
+            Netscape Comment: 
+                OpenSSL Generated Certificate
+            X509v3 Subject Key Identifier: 
+                C6:68:7E:D7:20:B3:51:4B:D4:50:54:26:12:86:BE:9B:EA:55:A1:EA
+            X509v3 Authority Key Identifier: 
+                keyid:75:2E:5A:BD:CE:B4:6B:4C:92:D2:BD:42:72:92:4B:27:71:9F:87:B0
+
+    Signature Algorithm: ecdsa-with-SHA256
+         30:45:02:21:00:b2:a7:be:fb:0b:d4:e2:87:b0:2c:c9:b8:fa:
+         10:b0:18:4b:dc:6a:bc:58:55:e8:22:46:93:d8:b1:5b:50:17:
+         77:02:20:2a:cf:42:10:fc:7e:02:39:37:44:4a:cf:9b:a3:9a:
+         55:cb:15:2d:12:86:06:7e:d4:b8:24:7a:57:13:48:b5:69
+-----BEGIN CERTIFICATE-----
+MIICOzCCAeGgAwIBAgICEAAwCgYIKoZIzj0EAwIwZTELMAkGA1UEBhMCTkwxEzAR
+BgNVBAgMClNvbWUtU3RhdGUxHzAdBgNVBAoMFkFETElOSyBUZWNobm9sb2d5IEIu
+Vi4xIDAeBgNVBAMMF0NIQU1fNTcwIENBIGNlcnRpZmljYXRlMB4XDTE5MDIxODEw
+NTI0MVoXDTQ2MDcwNjEwNTI0MVowazELMAkGA1UEBhMCTkwxEzARBgNVBAgMClNv
+bWUtU3RhdGUxHzAdBgNVBAoMFkFETElOSyBUZWNobm9sb2d5IEIuVi4xJjAkBgNV
+BAMMHUNIQU1fNTcwIElkZW50aXR5IGNlcnRpZmljYXRlMFkwEwYHKoZIzj0CAQYI
+KoZIzj0DAQcDQgAEnbV79f5j2iTkDCbFMlVVs396YOoNViwKheBbhVoBG2n8I3mY
+M9Zg1dmrHh16HsJfrTCbc0VAOdkH91mNRPZr46N7MHkwCQYDVR0TBAIwADAsBglg
+hkgBhvhCAQ0EHxYdT3BlblNTTCBHZW5lcmF0ZWQgQ2VydGlmaWNhdGUwHQYDVR0O
+BBYEFMZoftcgs1FL1FBUJhKGvpvqVaHqMB8GA1UdIwQYMBaAFHUuWr3OtGtMktK9
+QnKSSydxn4ewMAoGCCqGSM49BAMCA0gAMEUCIQCyp777C9Tih7Asybj6ELAYS9xq
+vFhV6CJGk9ixW1AXdwIgKs9CEPx+Ajk3RErPm6OaVcsVLRKGBn7UuCR6VxNItWk=
+-----END CERTIFICATE-----
diff --git a/src/security/builtin_plugins/tests/validate_local_identity/etc/old/ec_identity_certificate_unsupported b/src/security/builtin_plugins/tests/validate_local_identity/etc/old/ec_identity_certificate_unsupported
new file mode 100644
index 0000000..220abcf
--- /dev/null
+++ b/src/security/builtin_plugins/tests/validate_local_identity/etc/old/ec_identity_certificate_unsupported
@@ -0,0 +1,14 @@
+-----BEGIN CERTIFICATE-----
+MIICFTCCAbygAwIBAgICEAEwCgYIKoZIzj0EAwIwWjELMAkGA1UEBhMCTkwxEzAR
+BgNVBAgMClNvbWUtU3RhdGUxITAfBgNVBAoMGEludGVybmV0IFdpZGdpdHMgUHR5
+IEx0ZDETMBEGA1UEAwwKQ0hBTTUwMF9DQTAeFw0xODAyMTkxMDMyMjRaFw0xOTAy
+MTkxMDMyMjRaMGExCzAJBgNVBAYTAk5MMRMwEQYDVQQIDApTb21lLVN0YXRlMSEw
+HwYDVQQKDBhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQxGjAYBgNVBAMMEUNIQU01
+NjkgdW5zdXAga2V5MEkwEwYHKoZIzj0CAQYIKoZIzj0DAQIDMgAEKt3HYPnDlEOS
+zYqTzT2patyreLHN2Jty22KXwjaNAjgrwujdPr+MW38DsyBF5Yn9o3sweTAJBgNV
+HRMEAjAAMCwGCWCGSAGG+EIBDQQfFh1PcGVuU1NMIEdlbmVyYXRlZCBDZXJ0aWZp
+Y2F0ZTAdBgNVHQ4EFgQUG9MuQz3W/AKA98AyOKhI2af9I+0wHwYDVR0jBBgwFoAU
+ACsYsaEsZfjfRVrj0IBmcsncVyMwCgYIKoZIzj0EAwIDRwAwRAIgfhisahVmgghI
+GaaQavdKHpM/OTVODZPzYjky6Am+z08CIBidnuuznXrZtr78oy/tAES/7Lz8P5Iw
+Q1y5Vo8CdXQQ
+-----END CERTIFICATE-----
diff --git a/src/security/builtin_plugins/tests/validate_local_identity/etc/old/ec_private_key b/src/security/builtin_plugins/tests/validate_local_identity/etc/old/ec_private_key
new file mode 100644
index 0000000..214e2dd
--- /dev/null
+++ b/src/security/builtin_plugins/tests/validate_local_identity/etc/old/ec_private_key
@@ -0,0 +1,5 @@
+-----BEGIN PRIVATE KEY-----
+MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQgP3SnBXzcCc0uUEiG
+0CPNdcV0hBewOnVoh4d9q9E5U5ihRANCAASdtXv1/mPaJOQMJsUyVVWzf3pg6g1W
+LAqF4FuFWgEbafwjeZgz1mDV2aseHXoewl+tMJtzRUA52Qf3WY1E9mvj
+-----END PRIVATE KEY-----
diff --git a/src/security/builtin_plugins/tests/validate_local_identity/etc/old/ec_private_key_unsupported b/src/security/builtin_plugins/tests/validate_local_identity/etc/old/ec_private_key_unsupported
new file mode 100644
index 0000000..421d9a3
--- /dev/null
+++ b/src/security/builtin_plugins/tests/validate_local_identity/etc/old/ec_private_key_unsupported
@@ -0,0 +1,5 @@
+-----BEGIN PRIVATE KEY-----
+MG8CAQAwEwYHKoZIzj0CAQYIKoZIzj0DAQIEVTBTAgEBBBh8p6kwBS7jT86ctN33
+Vs4vosHh7upPZBWhNAMyAAQq3cdg+cOUQ5LNipPNPalq3Kt4sc3Ym3LbYpfCNo0C
+OCvC6N0+v4xbfwOzIEXlif0=
+-----END PRIVATE KEY-----
diff --git a/src/security/builtin_plugins/tests/validate_local_identity/etc/old/ec_private_key_w_password b/src/security/builtin_plugins/tests/validate_local_identity/etc/old/ec_private_key_w_password
new file mode 100644
index 0000000..f1f6e13
--- /dev/null
+++ b/src/security/builtin_plugins/tests/validate_local_identity/etc/old/ec_private_key_w_password
@@ -0,0 +1,8 @@
+-----BEGIN EC PRIVATE KEY-----
+Proc-Type: 4,ENCRYPTED
+DEK-Info: AES-256-CBC,11055B75D406068EB1FF850646228EA9
+
+GUnwN8e2gvUkopN3ak+2dK1dSTSKSJguers3h5C+qQDq57By933ijCCjUTu2LY/F
+ERH6m8UD6H5ij/QDsXLx6tH/dFQ7An+Zao3eD2N2zquGED/OfTQJFv3gBKs4RUtg
+66dfuv9mNSXt7Rnu9uBNtodm5JGifczdmIPHn0mNY2g=
+-----END EC PRIVATE KEY-----
diff --git a/src/security/builtin_plugins/tests/validate_local_identity/etc/old/identity_ca b/src/security/builtin_plugins/tests/validate_local_identity/etc/old/identity_ca
new file mode 100644
index 0000000..f003d92
--- /dev/null
+++ b/src/security/builtin_plugins/tests/validate_local_identity/etc/old/identity_ca
@@ -0,0 +1,22 @@
+-----BEGIN CERTIFICATE-----
+MIIDkTCCAnmgAwIBAgIJAJvGJOEKNct1MA0GCSqGSIb3DQEBCwUAMF8xCzAJBgNV
+BAYTAk5MMRMwEQYDVQQIDApTb21lLVN0YXRlMSEwHwYDVQQKDBhJbnRlcm5ldCBX
+aWRnaXRzIFB0eSBMdGQxGDAWBgNVBAMMD0NIQU01MDAgcm9vdCBjYTAeFw0xODAy
+MTIxNTA1MDVaFw0yMDEyMDIxNTA1MDVaMF8xCzAJBgNVBAYTAk5MMRMwEQYDVQQI
+DApTb21lLVN0YXRlMSEwHwYDVQQKDBhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQx
+GDAWBgNVBAMMD0NIQU01MDAgcm9vdCBjYTCCASIwDQYJKoZIhvcNAQEBBQADggEP
+ADCCAQoCggEBAM/dCO4QAcCduw0NMqShDpTvGT6DClTFAJE8ZfuPCHKqNkicRbyj
+sVXfF35Sdo6K92Ksz4G7i1RqJU2n8c7hg2EFUza0lIGgmTHV/DvFBcbAa0PpvdKS
+XoPtSNDh65/GO1R7oeSFRzapqsLMPUwOWi46dYvRnPabxs21xHxn56JeuG74bad5
+PMTBvA2SiiTYPBlHGJS78GPo3BPMjL0MzPoMmumO8NSVYI+MEDY1lC4KkyZVKqtV
+nIfaO/7adcM19xOAfAHkwhLGBC/bVAEqelev+GH/42xjNv532nM4/JVtBns+msR5
+DAYdtr6i82b7zhU1+lOOihv4lmQHoSnTya8CAwEAAaNQME4wHQYDVR0OBBYEFFYr
+0CpiwxgFcZnW6IQEhxGv/vwiMB8GA1UdIwQYMBaAFFYr0CpiwxgFcZnW6IQEhxGv
+/vwiMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAKbBt0ht72fdtxwm
+Kr0pOsKyDW0Rd5Ca5aDK4qAhDL0AD5+O6ShGYCnFNDGk3J5Yzawp8VoKrhDZZyUt
+z2b0jNucVapAvPMA4066QxeIfvFmWcS73l7vjjeUoKWmNNGWprTg3RLsacTorKuY
+ZRL7wsThfrhvg4B/OOIWKp5MEwIrUfnQzUca8getF2eyTt6QcMtE29AW5+01QTzj
+fxZgzkmJFYBE2K/TLMDBDd+bz/8XnmPrJ01VUntXiXenTGTcIbJerB6GYQojjvhy
+ZrOeuHTON1ndFiQkpeZA67ByZjkKVoJG3I8fwBjzcLE7u/QAQptVPjJXXcSpL7fA
+a1tOvqw=
+-----END CERTIFICATE-----
diff --git a/src/security/builtin_plugins/tests/validate_local_identity/etc/old/identity_certificate b/src/security/builtin_plugins/tests/validate_local_identity/etc/old/identity_certificate
new file mode 100644
index 0000000..7c03aae
--- /dev/null
+++ b/src/security/builtin_plugins/tests/validate_local_identity/etc/old/identity_certificate
@@ -0,0 +1,20 @@
+-----BEGIN CERTIFICATE-----
+MIIDNzCCAh8CCQDn8i4K9c4ErDANBgkqhkiG9w0BAQsFADBfMQswCQYDVQQGEwJO
+TDETMBEGA1UECAwKU29tZS1TdGF0ZTEhMB8GA1UECgwYSW50ZXJuZXQgV2lkZ2l0
+cyBQdHkgTHRkMRgwFgYDVQQDDA9DSEFNNTAwIHJvb3QgY2EwHhcNMTgwMjEyMTUw
+NjUxWhcNMTkwNjI3MTUwNjUxWjBcMQswCQYDVQQGEwJOTDETMBEGA1UECAwKU29t
+ZS1TdGF0ZTEhMB8GA1UECgwYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMRUwEwYD
+VQQDDAxDSEFNNTAwIGNlcnQwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB
+AQDRnnNnV3PZrbZwjxk+dkQcO3pK3wMvoDNAHPPiTfXRV2KjLHxsuK7wV+GPHmXo
+97bot6vBxNQN7hfxoDLL+KBO9s3V+8OX6lOrF7hQ6+6/p9EgRoyNGo21eIzGwc2M
+aJAKjImNMbM7FDTvhk3u+VTTJtlnKvJM1tgncbEZwRLri/2MEC5XS/O5FQT4AXPr
+A6bRcGMqCVYtQ0ci6wd18PegA/rSmGSRf/TOd4jZXkxfHD+YOkHcxxz9sX4KnyOg
+XZm8jDdBc7rxiDep8kIjL06VszJeoQrxjuf8cNZtbol/7ECS5aM2YOx7t0Dc/629
+V2Q5waRVBV5xVCJ0BzUh8rIFAgMBAAEwDQYJKoZIhvcNAQELBQADggEBAGlkxYLr
+ZI/XNjDC6RFfSFRoDc+Xpcg+GsJKKbw2+btZvAD8z7ofL01yGru9oi6u2Yy/ZDKT
+liZ+gtsD8uVyRkS2skq7BvPzvoYErLmSqwlrcCbeX8uHiN7C76ll9PFtSjnwPD//
+UaNyZM5dJB2eBh4/prclix+RR/FWQzkPqEVLwMcFBmnPZ0mvR2tncjpZq476Qyl9
+3jcmfms9qBfBPPjCdXqGEDgsTd2PpYRD2WDj/Ctl4rV7B2jnByullLUYIWGu0rYt
+988waU5i8ie4t/TorBBLqQo/NO9jSXfEqcAnILPnv1QZanKzAAxSg7+FgFrsn359
+ihiEkx9zFUnPrdA=
+-----END CERTIFICATE-----
\ No newline at end of file
diff --git a/src/security/builtin_plugins/tests/validate_local_identity/etc/old/identity_certificate_1024key b/src/security/builtin_plugins/tests/validate_local_identity/etc/old/identity_certificate_1024key
new file mode 100644
index 0000000..9384833
--- /dev/null
+++ b/src/security/builtin_plugins/tests/validate_local_identity/etc/old/identity_certificate_1024key
@@ -0,0 +1,17 @@
+-----BEGIN CERTIFICATE-----
+MIICrjCCAZYCCQDn8i4K9c4ErjANBgkqhkiG9w0BAQsFADBfMQswCQYDVQQGEwJO
+TDETMBEGA1UECAwKU29tZS1TdGF0ZTEhMB8GA1UECgwYSW50ZXJuZXQgV2lkZ2l0
+cyBQdHkgTHRkMRgwFgYDVQQDDA9DSEFNNTAwIHJvb3QgY2EwHhcNMTgwMjE2MTAy
+MzM2WhcNMjMwODA5MTAyMzM2WjBXMQswCQYDVQQGEwJOTDETMBEGA1UECAwKU29t
+ZS1TdGF0ZTEhMB8GA1UECgwYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMRAwDgYD
+VQQDDAdDSEFNNTY5MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDS5w0h8L70
+hkreKchVbTzfz4CrBLY4iADNSqPx9uW7DxjeHyLbKT2eRViY/xPuPXQmfRim01QM
+sZWKvFr6k9WMsJ6ItNtCyKS/beONqvXOddIu+4IhNzEGs5v4pTJAOzraoZcVmXnf
+Mr9G/baMYfMG47JR5HaSHDI5esa2STHt4wIDAQABMA0GCSqGSIb3DQEBCwUAA4IB
+AQBdZ2ijHYH8TkOGBqzsNwnNwPaDb/NA0vAO9T5kSOm8HA8vKHnNza+DeUJN+5P/
+P4fLK7UZqpQN32MpvXL0068g99RLjAzAsEVn+0FTyc08r9p/KO/dxxdMKeET7Cpv
+rMpu3W0A/EJptCQsTEZI0iqts7T2qQVXzoDlnUwEt3xdmKYJ9jbEq1UUCeexD3nP
+LB+JtUtfGevVzIoBjHv0qA3ePA24jDUlx5bxFeoIDC4tEewvUG5ZekftsRdNe3fk
+3LkwyK+4NN1ZCa2+S5SOAfjZA2o6qXiq/le0vWRgl7AHEgDr6w7xoRsw4K5dQ+0R
+eKtsBC4XO1GqrNYdKuJb1MhI
+-----END CERTIFICATE-----
diff --git a/src/security/builtin_plugins/tests/validate_local_identity/etc/old/invalid_identity_ca b/src/security/builtin_plugins/tests/validate_local_identity/etc/old/invalid_identity_ca
new file mode 100644
index 0000000..b7b7678
--- /dev/null
+++ b/src/security/builtin_plugins/tests/validate_local_identity/etc/old/invalid_identity_ca
@@ -0,0 +1,22 @@
+-----BEGIN CERTIFICATE-----
+MIIDljCCAn6gAwIBAgICEAAwDQYJKoZIhvcNAQELBQAwXzELMAkGA1UEBhMCTkwx
+EzARBgNVBAgMCk92ZXJpanNzZWwxEDAOBgNVBAcMB0hlbmdlbG8xDzANBgNVBAoM
+BkFETElOSzEYMBYGA1UEAwwPQ0hBTTUwMCBSb290IENBMB4XDTE4MDIwOTE2Mjky
+MVoXDTI4MDIwNzE2MjkyMVowVTELMAkGA1UEBhMCTkwxEzARBgNVBAgMCk92ZXJp
+anNzZWwxDzANBgNVBAoMBkFETElOSzEgMB4GA1UEAwwXQ0hBTTUwMCBJbnRlcm1l
+ZGlhdGUgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCwucuU/L6N
+iYxYJ7tyzcdzwXwYbr4GynZE4u2Sd7hcXrQGxTotm9BEhOZWscSGvH+UJSp0Vrb4
+3zDppiJ76ys6PeSBw1PpxdO97fO+eAE5DoXRj0a9lmnjbsV6waZ2GxgYQNVmKqbI
+uPDfW+jsmRcTO94s05GWQshHeiqxuEUAv3/Qe2vOhulrg4YDcXrIDWK93cr1EmRX
+Eq3Ck+Fjwtk5wAk3TANv2XQkVfS80jYAurL8J+XC2kyYB7e8KO92zqlfVXXMC3NI
+YDcq86bAI4NNMjVE2zIVheMLoOEXaV7KUTYfEQABZl76aWLDxjED9kf371tcrZzJ
+6xZ1M/rPGNblAgMBAAGjZjBkMB0GA1UdDgQWBBQngrlZqhQptCR4p04zqHamYUx7
+RTAfBgNVHSMEGDAWgBQrLYI+RHJtx1Pze8MSZbhaOful1DASBgNVHRMBAf8ECDAG
+AQH/AgEAMA4GA1UdDwEB/wQEAwIBhjANBgkqhkiG9w0BAQsFAAOCAQEAfMmiQ0tv
+o3K3xwSS621tsfkijUTx920hAe1XYY2XKrG7a/MJBhStex5A3AfqPOY9UMihkBl9
+3hgxOaddX9SAf2eLk2JLhqxZi1U/GVzT5h10AKLA5WUXIK4UGz3JRqhEm7V39t/N
+G0LCdpWOZueezkfO6eGcAvOKthdd32a3zbn+rzzDHdsjzxhEEv8d8x1Xf4xH2dgk
+HlpmpvXMfG/1aCzIpWGEPdkB7WR694GiCmh7hnFBiY+h1GFj2l5dThd51QqAlncM
+u+NmlPCrFZL0ulwRFeo80KOwDpxkqgavDlP9irdWqM9VHybjGu0xFHCeElz9M6od
+ym/MCh4ax7jDxg==
+-----END CERTIFICATE-----
diff --git a/src/security/builtin_plugins/tests/validate_local_identity/etc/old/invalid_identity_certificate b/src/security/builtin_plugins/tests/validate_local_identity/etc/old/invalid_identity_certificate
new file mode 100644
index 0000000..453f1fd
--- /dev/null
+++ b/src/security/builtin_plugins/tests/validate_local_identity/etc/old/invalid_identity_certificate
@@ -0,0 +1,20 @@
+-----BEGIN CERTIFICATE-----
+MIIDNzCCAh8CCQDn8i4K9c4ErDANBgkqhkiG9w0BAQsFADBfMQswCQYDVQQGEwJO
+TDETMBEGA1UECAwKU29tZS1TdGF0ZTEhMB8GA1UECgwYSW50ZXJuZXQgV2lkZ2l0
+cyBQdHkgTHRkMRgwFgYDVTQDDA9DSEFNNTAwIHJvb3QgY2EwHhcNMTgwMjEyMTUw
+NjUxWhcNMTkwNjI3MTUwNjUxWjBcMQswCQYDVQQGEwJOTDETMBEGA1UECAwKU29t
+ZS1TdGF0ZTEhMB8GA1UECgwYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMRUwEwYD
+VQQDDAxDSEFNNTAwIGNlcnQwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB
+AQDRnnNnV3PZrbZwjxk+dkQcO3pK3wMvoDNAHPPiTfXRV2KjLHxsuK7wV+GPHmXo
+97bot6vBxNQN7hfxoDLL+KBO9s3V+8OX6lOrF7hQ6+6/p9EgRoyNGo21eIzGwc2M
+aJAKjImNMbM7FDTvhk3u+VTTJtlnKvJM1tgncbEZwRLri/2MEC5XS/O5FQT4AXPr
+A6bRcGMqCVYtQ0ci6wd18PegA/rSmGSRf/TOd4jZXkxfHD+YOkHcxxz9sX4KnyOg
+XZm8jDdBc7rxiDep8kIjL06VszJeoQrxjuf8cNZtbol/7ECS5aM2YOx7t0Dc/629
+V2Q5waRVBV5xVCJ0BzUh8rIFAgMBAAEwDQYJKoZIhvcNAQELBQADggEBAGlkxYLr
+ZI/XNjDC6RFfSFRoDc+Xpcg+GsJKKbw2+btZvAD8z7ofL01yGru9oi6u2Yy/ZDKT
+liZ+gtsD8uVyRkS2skq7BvPzvoYErLmSqwlrcCbeX8uHiN7C76ll9PFtSjnwPD//
+UaNyZM5dJB2eBh4/prclix+RR/FWQzkPqEVLwMcFBmnPZ0mvR2tncjpZq476Qyl9
+3jcmfms9qBfBPPjCdXqGEDgsTd2PpYRD2WDj/Ctl4rV7B2jnByullLUYIWGu0rYt
+988waU5i8ie4t/TorBBLqQo/NO9jSXfEqcAnILPnv1QZanKzAAxSg7+FgFrsn359
+ihiEkx9zFUnPrdA=
+-----END CERTIFICATE-----
diff --git a/src/security/builtin_plugins/tests/validate_local_identity/etc/old/invalid_private_key b/src/security/builtin_plugins/tests/validate_local_identity/etc/old/invalid_private_key
new file mode 100644
index 0000000..2672622
--- /dev/null
+++ b/src/security/builtin_plugins/tests/validate_local_identity/etc/old/invalid_private_key
@@ -0,0 +1,27 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIIEowIBAAKCAQEA0Z5zZ1dz2a22cI8ZPnZEHDt6St8DL6AzQBzz4k310Vdioyx8
+bLiu8Ffhjx5l6Pe26LerwcTUDe4X8aAyy/igTvbN1fvDl+pTqxe4UOvuv6fRIEaM
+jRqNtXiMxsHNjGiQCoyJjTGzOxQ074ZN7vlU0ybZZyryTNbYJ3GxGcES64v9jBAu
+V0vzuRUE+AFz6wOm0XBjKglWLUNHIusHdfD3oAP60phkkX/0zneI2V5MXxw/mDpB
+3Mcc/bF+Cp8joF2ZvIw3QXO68Yg3qfJCIy9OlbMyXqEK8Y7n/HDWbW6Jf+xAkuWj
+NmDse7dA3P+tvVdkOcGkVQVecVQidAc1IfKyBQIDAQABAoIBAEddUpzUQTTS11Hq
+5gVF7lpORYxH8KW+PLSPJtjdAduLjKAQ++tn1OcuhDRdfQSbkUIZhfgqMqerb6tr
+ht+6fZlknR9E34pQ1LtjD/U83cOSNrhuTFudtrEZoZPpVzl+P8vXnNzdFs/+SSdi
+6hV5/U8F4u4kyOkwG9cR9eF2wiI+oQ/RBKCXUo3OVs9K27A/OkKsb7coL7yBsgBj
+lzorS9a/DyHT2eiMKjwCZFyG4A66EkLi6t9JLJ8oTkI2WskXYeVEAbEXE57RWm44
+2OgTgfsgYgf2ftXq93KD17FN1m77dqp7EPAhjGnRHNq7+0Ykr1EO1nbDfqHG4gS+4o
+lfP8iwECgYEA58da0R34l93yQnK0mAtoobwvsOjADnBVhBg9L4s2eDs8liUjf0zt
+7hcMdUJaa7iMuNf3qGtnZtRURc3kSOE429Or7fCAYUr/AaA7+2ekPG1vjMb50tVv
+se5rwb1hvgMYe2L5ktJJAg+RcmqpY+ncJ+hP/vWwZRxUKvXba50qqEkCgYEA54ZE
+mJfSueGM/63xlhP71CM4OWtTqkQGp2OmgTOsBI5q/GUXr8vMR8sCEMHAc6HyXzmL
+x/RnAoa/vTX58rXBk0QjfO9esIHa452697EIaJu5w8skCLDv2e/f+Jg7o/IDyUZs
+5lqhiEuH9Qc3sx2nhnSYXMZWqwh8OchI7dCSE90CgYEAzrJ1JhpxUJYI7wM2VIWQ
+GPQnH8BhTj8VtEidgCHJQK2rGUcjgepMIVECtiunUXtyW4GWBedKfmSKhvnXRLs9
+pqT9JaOeCaYFBiEsfMZvqUY4e/YSYtge1PIHvO40FWzTT23zneDUZPcXQY8nYsfy
+otBFTt0yIumBkhJRTIYLvakCgYA+CcttvBj6OAcJJ/n5RgeP05QoRqsXj7zcs6YV
+LtxkKClg0lHjiE+H2U0HYnOISJfijk/3V3UWxzavo7wDHlLtfC+qNZYA4/rcTRKh
+dm2TYk8HuPJB5e+PTWiNe3VXu+zpzRY3L4fjNqIKtVFmjIasT6fYDEmC8PYgoZtx
+JhdOfQKBgCD/bDkc+VI6lwQtoQQKiSfQjKGe+6Cw9K/obzWO0uJwBvZrGLXF8tTc
+MOPIv9OILt7DYxpMXAiHv8HtzH5CFVrZ/nj63Soka/j2yvUdBDrGhyIbsc4pDu+
+lCFa0ZiT/u5vRAiOkM6GuStH4HxnW9LtwBtiYXtfU7IPExJiAlsq
+-----END RSA PRIVATE KEY-----
diff --git a/src/security/builtin_plugins/tests/validate_local_identity/etc/old/private_key b/src/security/builtin_plugins/tests/validate_local_identity/etc/old/private_key
new file mode 100644
index 0000000..e21560b
--- /dev/null
+++ b/src/security/builtin_plugins/tests/validate_local_identity/etc/old/private_key
@@ -0,0 +1,27 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIIEowIBAAKCAQEA0Z5zZ1dz2a22cI8ZPnZEHDt6St8DL6AzQBzz4k310Vdioyx8
+bLiu8Ffhjx5l6Pe26LerwcTUDe4X8aAyy/igTvbN1fvDl+pTqxe4UOvuv6fRIEaM
+jRqNtXiMxsHNjGiQCoyJjTGzOxQ074ZN7vlU0ybZZyryTNbYJ3GxGcES64v9jBAu
+V0vzuRUE+AFz6wOm0XBjKglWLUNHIusHdfD3oAP60phkkX/0zneI2V5MXxw/mDpB
+3Mcc/bF+Cp8joF2ZvIw3QXO68Yg3qfJCIy9OlbMyXqEK8Y7n/HDWbW6Jf+xAkuWj
+NmDse7dA3P+tvVdkOcGkVQVecVQidAc1IfKyBQIDAQABAoIBAEddUpzUQTTS11Hq
+5gVF7lpORYxH8KW+PLSPJtjdAduLjKFQ++tn1OcuhDRdfQSbkUIZhfgqMqerb6tr
+ht+6fZlknR9E34pQ1LtjD/U83cOSNrhuTFudtrEZoZPpVzl+P8vXnNzdFs/+SSdi
+6hV5/U8F4u4kyOkwG9cR9eF2wiI+oQ/RBKCXUo3OVs9K27A/OkKsb7coL7yBsgBj
+lzorS9a/DyHT2eiMKjwCZFyG4A66EkLi6t9JLJ8oTkI2WskXYeVEAbEXE57RWm44
+2OgTI/Yc2yrtXq93KD17FN1m77dqp7EPAhjGnRHNq7+0Ykr1EO1nbDfqHG4gS+4o
+lfP8iwECgYEA58da0R34l93yQnK0mAtoobwvsOjADnBVhBg9L4s2eDs8liUjf0zt
+7hcMdUJaa7iMuNf3qGtnZtRURc3kSOE429Or7fCAYUr/AaA7+2ekPG1vjMb50tVv
+se5rwb1hvgMYe2L5ktJJAg+RcmqpY+ncJ+hP/vWwZRxUKvXba50qqEkCgYEA54ZE
+mJfSueGM/63xlhP71CM4OWtTqkQGp2OmgTOsBI5q/GUXr8vMR8sCEMHAc6HyXzmL
+x/RnAoa/vTX58rXBk0QjfO9esIHa452697EIaJu5w8skCLDv2e/f+Jg7o/IDyUZs
+5lqhiEuH9Qc3sx2nhnSYXMZWqwh8OchI7dCSE90CgYEAzrJ1JhpxUJYI7wM2VIWQ
+GPQnH8BhTj8VtEidgCHJQK2rGUcjgepMIVECtiunUXtyW4GWBedKfmSKhvnXRLs9
+pqT9JaOeCaYFBiEsfMZvq8f4e/YSYtge1PIHvO40FWzTT23zneDUZPcXQY8nYsfy
+otBFTt0yIumBkhJRTIYLvakCgYA+CcttvBj6OAcJJ/n5RgeP05QoRqsXj7zcs6YV
+LtxkKClg0lHjiE+H2U0HYnOISJfijk/3V3UWxzavo7wDHlLtfC+qNZYA4/rcTRKh
+dm2TYk8HuPJB5e+PTWiNe3VXu+zpzRY3L4fjNqIKtVFmjIasT6fYDEmC8PYgoZtx
+JhdOfQKBgCD/bDkc+VI6lwQtoQQKiSfQjKGe+6Cw9K/obzWO0uJwBvZrGLXF8tTc
+MOPIv9OILt7DYxpMXAiHv8HtzH5CFVrZ/nj63SRoka/j2yvUdBDrGhyIbsc4pDu+
+lCFa0ZiT/u5vRAiOkM6GuStH4HxnW9LtwBtiYXtfU7IPExJiAlsq
+-----END RSA PRIVATE KEY-----
diff --git a/src/security/builtin_plugins/tests/validate_local_identity/etc/old/private_key_1024 b/src/security/builtin_plugins/tests/validate_local_identity/etc/old/private_key_1024
new file mode 100644
index 0000000..709bcd6
--- /dev/null
+++ b/src/security/builtin_plugins/tests/validate_local_identity/etc/old/private_key_1024
@@ -0,0 +1,15 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIICXAIBAAKBgQDS5w0h8L70hkreKchVbTzfz4CrBLY4iADNSqPx9uW7DxjeHyLb
+KT2eRViY/xPuPXQmfRim01QMsZWKvFr6k9WMsJ6ItNtCyKS/beONqvXOddIu+4Ih
+NzEGs5v4pTJAOzraoZcVmXnfMr9G/baMYfMG47JR5HaSHDI5esa2STHt4wIDAQAB
+AoGAQi7LijkYU3fJCsql2Vj8X2eogwJphHf5eHLR296U3QyxyxKOR6Q7d+1fDjQN
+txeF2YYsND3hBFK+ENlm23eE7Z1tpWtnLNJ9OH84ZkPnqTnEcWsRddT/x9vKOPMz
+eK8QNetD3AP5qXsjpIpgep1diWYHCyhMTAFISzvdtC7pvFECQQD2zoqwRtF26lzg
+QPR02Z+L80R2VhpeLoqMIplT1bmlrPlDr/eIwvtu1eQFyGSASG2EFs1rucdJl7qu
+SrJ+eyv1AkEA2sIjy8+RCk1uH8kEwYaMJ3dccqnpcMCZ1b3GncKl+ICmDCYcpfd5
+rP5tX+GL3RVw370pUApJvrVTgOpAVHYjdwJAOYz8BhLdcS9BLQG4fy7n50h4pGd7
+io6ru/Wtb0EdIybskP4NaJSe8L9rhnWuCcPZ1b1DdWVCtURuQYoliRzLqQJBAJWO
+ZrSfKpS1jRVT89lu6ADPXLfTrBH2yvVS8ifG/HshUOQ7ZhidUWVQ6GvFoj46u1lr
+VIQxFGu6QeV/wQ09W08CQHGkrZgu/FpS2tNvYmKNDHOna+dW452N5N81u5sRP1A8
+x9pYC9xoOGE2E8v1ocMJDPoMe0yk1QSX9mjhhwYOy28=
+-----END RSA PRIVATE KEY-----
diff --git a/src/security/builtin_plugins/tests/validate_local_identity/etc/old/private_key_not_matching b/src/security/builtin_plugins/tests/validate_local_identity/etc/old/private_key_not_matching
new file mode 100644
index 0000000..735a9af
--- /dev/null
+++ b/src/security/builtin_plugins/tests/validate_local_identity/etc/old/private_key_not_matching
@@ -0,0 +1,48 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIIEpgIBAAKCAQEAz90I7hABwJ27DQ0ypKEOlO8ZPoMKVMUAkTxl+48Icqo2SJxF
+vKOxVd8XflJ2jor3YqzPgbuLVGolTafxzuGDYQVTNrSUgaCZMdX8O8UFxsBrQ+m9
+0pJeg+1I0OHrn8Y7VHuh5IVHNqmqwsw9TA5aLjp1i9Gc9pvGzbXEfGfnol64bvht
+p3k8xMG8DZKKJNg8GUcYlLvwY+jcE8yMvQzM+gya6Y7w1JVgj4wQNjWULgqTJlUq
+q1Wch9o7/tp1wzX3E4B8AeTCEsYEL9tUASp6V6/4Yf/jbGM2/nfaczj8lW0Gez6a
+xHkMBh22vqLzZvvOFTX6U46KG/iWZAehKdPJrwIDAQABAoIBAQDGvQsAsoU6aJSj
+Ee9NwD903nZAcoG6MvEr65eGQWdOWre0DNYQWmH/PGH2AVohR3Tn/1oXK/03JJWt
+/dkQeEVoyfKZ52Xl2mseXv3fF61CLk9gi2dWoWOEt6ZbMOZbyOiJCfvrxhIkjWwa
++7PPuBk5AePJXwy4LJCTtiq61418i2Bbl6JamytgxsiVK9kZXdN6JqEVYmweMpmR
+T1mzi7lssyttBIXwG8ajStUteIYLyi8d+UX4S08EyV0VGL0p5+F8xTY1jVX/t6Y0
+KbANJdjEab9mbndzbxprJlS08KBLgdnAO4w0nmINiaO2isXOLoV8SU3tTqHC3W7c
+CCSKJdGBAoGBAP9vCSP1AaEjYa6sfEUgThpCo7PhRuOMEDb+4ldv9O+hzXv5I8td
+gbDs1g3jyhb0yhW9uV9NsuKBtsmv1zYFswZDNbdr2S1VZPMpAx+SeLHQWy6HbU/t
+oHoOO+l8erFVvR2uqit5rBDzN6/lh4SoQzYE9JDAnXJp9W0rKAdtBSLRAoGBANBT
+AIErbPo4EuU13DaEa+EfoU4Abktyi+L8dpdoXMq6sHg3Mlhifr+ryoybrMMA3tmT
+6ekBCSVThF0/+HAFRAJthnyBgUd0D710JDHro47Mg37CxU+V8JYqZJGHUSfqng7/
+pM7LjM99VhigquH4PoDH4YpL8vnIeEMNmny4iER/AoGBAJj8k+jpUXSFkHfh7vwo
+AR9RUmLmRmL6/KsztbTQ5U6xBjV+XqXq90ZUU1A2Yk+lhXPIEkK2crGfJy9dFfTR
+LQxPLNkSyxyPzMqmgaxjOc6mEDap/hqlJDx2UgPh/kpAI+inOFyZnyj3wx6ixqv5
+a2frR996vdJNDCW6d1sbPLxBAoGBAMO66IN0UJy76Izw0Olr+4v10vFdmENM6T+o
+IqhZBq33P+yDN8sxJ5NgjhsT/Pruq3LT9XbVYUlvsbKHcx2U5PQ/AZejedqvokZH
+g+ZfVjnJz1ZfG1GOOBBu3jSZZdfSKRVAfhFJ0A/229ihxEwxmFAY/MCaYTzsbInb
+kyXRnz5zAoGBAIT9Fuk7zhfubYvkzIQ0kj/IxL3QohVRKcoGapDMSwNjTvxZdKxF
+WXkhhJT095QznHP1fhp90fBKlOdsReDWfZXMYtZTqo2+ezK8qb6xMlm+LE09y+Na
+f7pp1EPnIqyEX27B4aQ81M8tkCqbdlv3CdjFSusp6SsWTGTjr/5SAMDS
+-----END RSA PRIVATE KEY-----
+
+-----BEGIN CERTIFICATE-----
+MIIDNzCCAh8CCQDn8i4K9c4ErDANBgkqhkiG9w0BAQsFADBfMQswCQYDVQQGEwJO
+TDETMBEGA1UECAwKU29tZS1TdGF0ZTEhMB8GA1UECgwYSW50ZXJuZXQgV2lkZ2l0
+cyBQdHkgTHRkMRgwFgYDVQQDDA9DSEFNNTAwIHJvb3QgY2EwHhcNMTgwMjEyMTUw
+NjUxWhcNMTkwNjI3MTUwNjUxWjBcMQswCQYDVQQGEwJOTDETMBEGA1UECAwKU29t
+ZS1TdGF0ZTEhMB8GA1UECgwYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMRUwEwYD
+VQQDDAxDSEFNNTAwIGNlcnQwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB
+AQDRnnNnV3PZrbZwjxk+dkQcO3pK3wMvoDNAHPPiTfXRV2KjLHxsuK7wV+GPHmXo
+97bot6vBxNQN7hfxoDLL+KBO9s3V+8OX6lOrF7hQ6+6/p9EgRoyNGo21eIzGwc2M
+aJAKjImNMbM7FDTvhk3u+VTTJtlnKvJM1tgncbEZwRLri/2MEC5XS/O5FQT4AXPr
+A6bRcGMqCVYtQ0ci6wd18PegA/rSmGSRf/TOd4jZXkxfHD+YOkHcxxz9sX4KnyOg
+XZm8jDdBc7rxiDep8kIjL06VszJeoQrxjuf8cNZtbol/7ECS5aM2YOx7t0Dc/629
+V2Q5waRVBV5xVCJ0BzUh8rIFAgMBAAEwDQYJKoZIhvcNAQELBQADggEBAGlkxYLr
+ZI/XNjDC6RFfSFRoDc+Xpcg+GsJKKbw2+btZvAD8z7ofL01yGru9oi6u2Yy/ZDKT
+liZ+gtsD8uVyRkS2skq7BvPzvoYErLmSqwlrcCbeX8uHiN7C76ll9PFtSjnwPD//
+UaNyZM5dJB2eBh4/prclix+RR/FWQzkPqEVLwMcFBmnPZ0mvR2tncjpZq476Qyl9
+3jcmfms9qBfBPPjCdXqGEDgsTd2PpYRD2WDj/Ctl4rV7B2jnByullLUYIWGu0rYt
+988waU5i8ie4t/TorBBLqQo/NO9jSXfEqcAnILPnv1QZanKzAAxSg7+FgFrsn359
+ihiEkx9zFUnPrdA=
+-----END CERTIFICATE-----
diff --git a/src/security/builtin_plugins/tests/validate_local_identity/etc/old/private_key_w_password b/src/security/builtin_plugins/tests/validate_local_identity/etc/old/private_key_w_password
new file mode 100644
index 0000000..ba09dc0
--- /dev/null
+++ b/src/security/builtin_plugins/tests/validate_local_identity/etc/old/private_key_w_password
@@ -0,0 +1,30 @@
+-----BEGIN RSA PRIVATE KEY-----
+Proc-Type: 4,ENCRYPTED
+DEK-Info: AES-256-CBC,0C9C38C5678AECD200E024A9A5BC717A
+
+wbXYsR78o4DIaQbKsB4cwEFge79GMKbcMgIWK+9k86dPk09WZkj7JCSJXIxPLYOG
+tFZrw/z86cakEhf90a4Moa1cwByrcFB+bpWoEqsx/C4javWxXMENbmQ5x8gDpmzT
+qqLI7xnd2mYj7HcfE7eXi+Nub5w1tBxN0CWaxpR54ZVvfcPE6Od4SHGughdUN4AK
+OdVIq5YuzMhuTDJKy+kGOtjH8pBWvo8S12T2UQEuusx5WUbEJ6m+E80aN7M6gCA+
+XmNTt3PsV9PfZPL2Off/90gqTBdMhwn+sEVlqYG0TAnXZQEI8ZNtAGy77CFplqdT
+SmI3x8Sza7lchEMFhRiayX9pMBPUlwckVPrCoMQ4b4WkHYoGLO7dNVAA8Osud46+
+6MZKHStjdzwKz9MzWa7lXhXV+0sX5bcAzQexuE+wO8QQ/t5uwDmQHol0JVdRX8NB
+/Exk6aT7mWajFvukXVirpUGWnEK2W+O8/VBzVZ7z69EjZ09Pu4Y/+cbX12LGSwMb
+WVtnZY6BsrV++vikQuL3ByTBDPRHio2H8hThh1Kv8n5VEBUrk7tLUp3Z15cbfC6s
+LDHX6kB2OKmmdqLOOMo4lToZfnrVK/dzeXFbtNH1POpR4/e5Nk0SyZrWo+E/AqIv
+nLQ3fhLCPOB5rjAhuM8iXOwqn8HHNlv9j8mlgCcgwK7focYVc/IXARLOfFOjOA/s
+EqMRbb/eKsC930NHBZkhlqRJKCwA37AMvnOhN4R0VOq/40K+62IUK9E1643KyWs0
+vWk0rFY0OKorQXzI33lbBYZ5zHt8oxGNx3us+6jGP85iv8UEaO6FpgajEUn6Gzp/
+wyvr1C/B/Hfr6eTbt4C6Fi5fMfZgM6VEcJuaFZnoC9tWdhlNsY1pwtPghMM7yBwc
+1Ye0TxdF36exJWu1gXVTse1Vdc9i4QWpT2fbPQtcIgdtNk01K+2defie384IOnQQ
+O8/SRsrnLRLV3IDFh/VBJS1ZVm8Zmt10yGgRwtYHntMkIopoFRWcm9/Gh3iBFKKH
+OTVXxgKOUYk4qXG61N8k0M+TIdoOHZIha3Myis1tQVmA/b/4FRKPYgdrFijhXNLM
+wwMHQOS14xBF2KBgaak7dMUWhGrClw1hc3HmMXuM+OLvxy+f8MC3JP2U5AuCs472
+hc41KWxioqNMPVXZgVnHf3aEec+hBFceqYnlzG+E/Gagiufu8WMySaZgzXMRb5aV
+x2OVcakSKrTC5EKbLDlZ6+1NRJht7wdSefh0o/Crc9LzcFqBL0Qp3WCvyY8gDVkQ
+EGqoVYOE6Hz/NX5/17F1+5VuWT7nBWABHKFFriOoJ3VR9sZhp0HiMznZEF1AwVuZ
+xHtDWQemfBywEQG23qbr+o7mQASh1zki8b4fP1HQmbHhaJarjwGdiVNIgcF7s7Qk
+NYNcgsc1l0KuNHvredTnYwPhv3C08IBfjtd2H9u0A+AWl5RlR4GDfv2Jzbe/F8U+
+0gxj8D2XWHlkbHIXKVk6jxj64xyNE1xB0Sv7gsDWpkaK6aw/zdsyxqiji4mThcYE
+cRSl4y9CGZREaiyD8dk/uiqKfQ26c1gfOUDYS2fKjH5NKh4J80wQj0GvS6nHiDH4
+-----END RSA PRIVATE KEY-----
diff --git a/src/security/builtin_plugins/tests/validate_local_identity/etc/old/remote b/src/security/builtin_plugins/tests/validate_local_identity/etc/old/remote
new file mode 100644
index 0000000..195709a
--- /dev/null
+++ b/src/security/builtin_plugins/tests/validate_local_identity/etc/old/remote
@@ -0,0 +1,20 @@
+-----BEGIN CERTIFICATE-----
+MIIDMzCCAhsCCQDn8i4K9c4ErzANBgkqhkiG9w0BAQsFADBfMQswCQYDVQQGEwJO
+TDETMBEGA1UECAwKU29tZS1TdGF0ZTEhMB8GA1UECgwYSW50ZXJuZXQgV2lkZ2l0
+cyBQdHkgTHRkMRgwFgYDVQQDDA9DSEFNNTAwIHJvb3QgY2EwHhcNMTgwMzIzMTIw
+MTE5WhcNMjMxMDMxMTIwMTE5WjBYMQswCQYDVQQGEwJOTDETMBEGA1UECAwKU29t
+ZS1TdGF0ZTEhMB8GA1UECgwYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMREwDwYD
+VQQDDAhDSEFNLTU3NzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMcc
+IMlRp2EnOC/UIIOF2gm+wtsikv5CscDuyq9DA2QgS5TTKqivDAdOSUIcbVn8qb6/
+77viarmRXml3VHJdhR2abtY6xYKYF2SCFiyoNk6ITq+YBrCfmMh/bCYTD6c5vnl4
+SKomIArU1g1YAxHxHqZRX1oonldUdP4lqq+Qt6fllYFhHNAl5JjrrCuPpXmAW3pC
+z4b3HWP/6vnbOFFMYkwGprVoAljcnAG7C7zSjW2M3RN4xA/z6Lps8qrPFB2iAXaP
+ZnST1rkqctf2IDWVwloG0uJnqiigcIz6+hvf5VMU0ax+CrYqFGav/uwvPCiHcUkF
+3a/O3z+4xGHaBagfHukCAwEAATANBgkqhkiG9w0BAQsFAAOCAQEAXZlNPz6raCBp
+F+iyNWTGy27OyM/TZNE9QTPI28TQEmLfqCrRfq+uHhBQ3U9TgS3xX/f5b+BPHuaD
+N6vl/yECAQa+0r33EFdoe8rGa0Mr5VvADcqPmk/sp9K62fRcP4aCgliDi8g9G8q1
+XNgO/EA9HhFlFKPzLPFMhq7qqPOQWO/EddoxA/qCMGZtN+TAxqLKVB0lipJoSa0x
+XqtYvNWiaShPceSk4SAjAdpdhvxOpA/25uvFEISdt9zoqbs4eLUbi/9RFYaL8U4r
+E+FygZMi31N6PC/Q7/tJ4DG20K/V30Y1+ogvSfdJpWk9L/CJj0VrzqJTVaKBIFVV
+6PtqHPZiKA==
+-----END CERTIFICATE-----
\ No newline at end of file
diff --git a/src/security/builtin_plugins/tests/validate_local_identity/etc/old/unrelated_identity_ca b/src/security/builtin_plugins/tests/validate_local_identity/etc/old/unrelated_identity_ca
new file mode 100644
index 0000000..52cf047
--- /dev/null
+++ b/src/security/builtin_plugins/tests/validate_local_identity/etc/old/unrelated_identity_ca
@@ -0,0 +1,22 @@
+-----BEGIN CERTIFICATE-----
+MIIDpDCCAoygAwIBAgIJALE5lRKfYHAaMA0GCSqGSIb3DQEBCwUAMF8xCzAJBgNV
+BAYTAk5MMRMwEQYDVQQIDApPdmVyaWpzc2VsMRAwDgYDVQQHDAdIZW5nZWxvMQ8w
+DQYDVQQKDAZBRExJTksxGDAWBgNVBAMMD0NIQU01MDAgUm9vdCBDQTAeFw0xODAy
+MDkxNjIwNDNaFw0zODAyMDQxNjIwNDNaMF8xCzAJBgNVBAYTAk5MMRMwEQYDVQQI
+DApPdmVyaWpzc2VsMRAwDgYDVQQHDAdIZW5nZWxvMQ8wDQYDVQQKDAZBRExJTksx
+GDAWBgNVBAMMD0NIQU01MDAgUm9vdCBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEP
+ADCCAQoCggEBAN9/NbpJDHQYHh3cEByRxnHffxEe9Sapn08Ty5xYO8LDJ4V7vU32
+/7291fITiHaovOoCRHAbKTaTtqJO56aGY45HON6KIqxljLQJJVGW/Nf2PNSHmFix
+6D6bsoSOTPyKYqBNT6lB7NMn4QBTcsiE61El8p9WLQZHoYQJK5Psf7wkBqGBz8he
+bcDWXFn7kIgnsaLrh77w2wi/y0MqpPwyeRInoZfYknzVNdxCPgq7csBYDoMgOgkV
+G60ECXojHKz1HI4n0V8L8lZluSSVRNR0xvPFgBqO7b+Re7xb6iO9TNsFeoiMMNyp
+EwM99CqPO0RRrAPiC7IDgcNGjxhne9EJFGsCAwEAAaNjMGEwHQYDVR0OBBYEFCst
+gj5Ecm3HU/N7wxJluFo5+6XUMB8GA1UdIwQYMBaAFCstgj5Ecm3HU/N7wxJluFo5
++6XUMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgGGMA0GCSqGSIb3DQEB
+CwUAA4IBAQCWibvYuPLpoNcsUdHbE7SnBbEQnDfBxBZN8xeWHwwAPEB+8eHhmIdZ
+xDtCN61xr5QR+KzlEYFwKyHMp9GN3OPU1RndJrzaXz2ddAZVkBIvnQZ4JvFd+sBC
+QQgEvL8GcwZPxnad/TRylM4ON3Kh0X9vfyrmWEoHephiE1LcENaFqcYr9xg3DJNh
+XSrigMGZJ7IOHkvgaoneICOcYI42ZHS0fnt1G+01VKJXm3ndi5NL25GnOmlvV6yV
++1vcmdQc6YS8K8vHmrH4lX9iPfsOak6WSzzsXdqgpvyxtGJggcFaDTtmbWCAkJj0
+B7DMeaVlLClGQaKZZ7aexEx9se+IyLn2
+-----END CERTIFICATE-----
diff --git a/src/security/builtin_plugins/tests/validate_local_identity/etc/private_key b/src/security/builtin_plugins/tests/validate_local_identity/etc/private_key
new file mode 100644
index 0000000..06f57d1
--- /dev/null
+++ b/src/security/builtin_plugins/tests/validate_local_identity/etc/private_key
@@ -0,0 +1,27 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIIEogIBAAKCAQEAwqVYYrx/8ASMru+K70J3J0maisrKTegrw9aZlfcH7eTx4Vbf
+Y1e/b4Erm+SwA6ERwIBXb/XbmIAa9ezm+rkayGOAdfAnKwo4UHAuII8fMto5fT3m
+JvqmA96OOBWAawatEAp60ICrG/6l/WfjMP1VIsOucevFvO+ixB0EKBIE+JMUrmoM
+AaFUZHjw+n2ACpk+F0t8fjtL/qxxEk3LChesjGnYKe4d3h9W/JCU80sfCVfWc6vv
+psY6MaoWwVT+Zw83toYUiHgpAr0q8e3n5ICkuAEF2uf2eOBogLtU3111KnYnPa8c
+A9HnZ2ozRJZ2Xu7I6JP9Mrqrx/toUqqTb2v86QIDAQABAoIBAC1q32DKkx+yMBFx
+m32QiLUGG6VfBC2BixS7MkMnzRXZYgcuehl4FBc0kLRjfB6cqsO8LqrVN1QyMBhK
+GutN3c38SbE7RChqzhEW2+yE+Mao3Nk4ZEecHLiyaYT0n25ZtHAVwep823BAzwJ+
+BykbM45VEpNKbG1VjSktjBa9faNyZiZAEJEjVyla+6R8N4kHV52LbZcLjvJv3IQ2
+iPYRrmMyI5C23qTni0vy7yJbAXBo3CqgSlwie9FARBWT7Puu7F4mF1O1c/SnTysw
+Tm3e5FzgfHipQbnRVn0w4rDprPMKmPxMnvf/Wkw0zVgNadp1Tc1I6Yj525DEQ07i
+2gIn/gECgYEA4jNnY1u2Eu7x3pAQF3dRO0x35boVtuq9iwQk7q+uaZaK4RJRr+0Y
+T68S3bPnfer6SHvcxtST89Bvs/j/Ky4SOaX037UYjFh6T7OIzPl+MzO1yb+VOBT6
+D6FVGEJGp8ZAITU1OfJPeTYViUeEC8tHFGoKUCk50FbB6jOf1oKtv/ECgYEA3EnB
+Y7kSbJJaUuj9ciFUL/pAno86Cim3VjegK1wKgEiyDb610bhoMErovPwfVJbtcttG
+eKJNuwizkRcVbj+vpjDvqqaP5eMxLl6/Nd4haPMJYzGo88Z8NJpwFRNF2KEWjOpQ
+2NEvoCeRtVulCJyka2Tpljzw8cOXkxhPOe2UhHkCgYBo3entj0QO7QXm56T+LAvV
+0PK45xdQEO3EuCwjGAFk5C0IgUSrqeCeeIzniZMltj1IQ1wsNbtNynEu3530t8wt
+O7oVyFBUKGSz9IjUdkpClJOPr6kPMfJoMqRPtdIpz+hFPPSrI6IikKdVWHloOlp+
+pVaYqTQrWT1XRY2xli3VEQKBgGySmZN6Cx+h/oywswIGdUT0VdcQhq2to+QFpJba
+VX6m1cM6hMip2Ag9U3qZ1SNPBBdBBfm9HQybHE3dj713/C2wHuAAGhpXIM1W+20k
+X1knuC/AsSH9aQhQOf/ZMOq1crTfZBuI9q0782/sjGmzMsKPySU4QhUWruVb7OiD
+NVkZAoGAEvihW7G+8/iOE40vGHyBqUeopAAWLciTAUIEwM/Oi3BYfNWNTWF/FWNc
+nMvCZPYigY8C1vO+1iT2Frtd3CIU+f01Q3fJNJoRLlEiKLNZUJRF48OKUqjKSmsi
+w6pucFO40z05YW7utApj4L82rZnOS0pd1tUI1yexqvj0i4ThJfk=
+-----END RSA PRIVATE KEY-----
diff --git a/src/security/builtin_plugins/tests/validate_local_identity/etc/private_key_1024 b/src/security/builtin_plugins/tests/validate_local_identity/etc/private_key_1024
new file mode 100644
index 0000000..709bcd6
--- /dev/null
+++ b/src/security/builtin_plugins/tests/validate_local_identity/etc/private_key_1024
@@ -0,0 +1,15 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIICXAIBAAKBgQDS5w0h8L70hkreKchVbTzfz4CrBLY4iADNSqPx9uW7DxjeHyLb
+KT2eRViY/xPuPXQmfRim01QMsZWKvFr6k9WMsJ6ItNtCyKS/beONqvXOddIu+4Ih
+NzEGs5v4pTJAOzraoZcVmXnfMr9G/baMYfMG47JR5HaSHDI5esa2STHt4wIDAQAB
+AoGAQi7LijkYU3fJCsql2Vj8X2eogwJphHf5eHLR296U3QyxyxKOR6Q7d+1fDjQN
+txeF2YYsND3hBFK+ENlm23eE7Z1tpWtnLNJ9OH84ZkPnqTnEcWsRddT/x9vKOPMz
+eK8QNetD3AP5qXsjpIpgep1diWYHCyhMTAFISzvdtC7pvFECQQD2zoqwRtF26lzg
+QPR02Z+L80R2VhpeLoqMIplT1bmlrPlDr/eIwvtu1eQFyGSASG2EFs1rucdJl7qu
+SrJ+eyv1AkEA2sIjy8+RCk1uH8kEwYaMJ3dccqnpcMCZ1b3GncKl+ICmDCYcpfd5
+rP5tX+GL3RVw370pUApJvrVTgOpAVHYjdwJAOYz8BhLdcS9BLQG4fy7n50h4pGd7
+io6ru/Wtb0EdIybskP4NaJSe8L9rhnWuCcPZ1b1DdWVCtURuQYoliRzLqQJBAJWO
+ZrSfKpS1jRVT89lu6ADPXLfTrBH2yvVS8ifG/HshUOQ7ZhidUWVQ6GvFoj46u1lr
+VIQxFGu6QeV/wQ09W08CQHGkrZgu/FpS2tNvYmKNDHOna+dW452N5N81u5sRP1A8
+x9pYC9xoOGE2E8v1ocMJDPoMe0yk1QSX9mjhhwYOy28=
+-----END RSA PRIVATE KEY-----
diff --git a/src/security/builtin_plugins/tests/validate_local_identity/etc/private_key_not_matching b/src/security/builtin_plugins/tests/validate_local_identity/etc/private_key_not_matching
new file mode 100644
index 0000000..735a9af
--- /dev/null
+++ b/src/security/builtin_plugins/tests/validate_local_identity/etc/private_key_not_matching
@@ -0,0 +1,48 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIIEpgIBAAKCAQEAz90I7hABwJ27DQ0ypKEOlO8ZPoMKVMUAkTxl+48Icqo2SJxF
+vKOxVd8XflJ2jor3YqzPgbuLVGolTafxzuGDYQVTNrSUgaCZMdX8O8UFxsBrQ+m9
+0pJeg+1I0OHrn8Y7VHuh5IVHNqmqwsw9TA5aLjp1i9Gc9pvGzbXEfGfnol64bvht
+p3k8xMG8DZKKJNg8GUcYlLvwY+jcE8yMvQzM+gya6Y7w1JVgj4wQNjWULgqTJlUq
+q1Wch9o7/tp1wzX3E4B8AeTCEsYEL9tUASp6V6/4Yf/jbGM2/nfaczj8lW0Gez6a
+xHkMBh22vqLzZvvOFTX6U46KG/iWZAehKdPJrwIDAQABAoIBAQDGvQsAsoU6aJSj
+Ee9NwD903nZAcoG6MvEr65eGQWdOWre0DNYQWmH/PGH2AVohR3Tn/1oXK/03JJWt
+/dkQeEVoyfKZ52Xl2mseXv3fF61CLk9gi2dWoWOEt6ZbMOZbyOiJCfvrxhIkjWwa
++7PPuBk5AePJXwy4LJCTtiq61418i2Bbl6JamytgxsiVK9kZXdN6JqEVYmweMpmR
+T1mzi7lssyttBIXwG8ajStUteIYLyi8d+UX4S08EyV0VGL0p5+F8xTY1jVX/t6Y0
+KbANJdjEab9mbndzbxprJlS08KBLgdnAO4w0nmINiaO2isXOLoV8SU3tTqHC3W7c
+CCSKJdGBAoGBAP9vCSP1AaEjYa6sfEUgThpCo7PhRuOMEDb+4ldv9O+hzXv5I8td
+gbDs1g3jyhb0yhW9uV9NsuKBtsmv1zYFswZDNbdr2S1VZPMpAx+SeLHQWy6HbU/t
+oHoOO+l8erFVvR2uqit5rBDzN6/lh4SoQzYE9JDAnXJp9W0rKAdtBSLRAoGBANBT
+AIErbPo4EuU13DaEa+EfoU4Abktyi+L8dpdoXMq6sHg3Mlhifr+ryoybrMMA3tmT
+6ekBCSVThF0/+HAFRAJthnyBgUd0D710JDHro47Mg37CxU+V8JYqZJGHUSfqng7/
+pM7LjM99VhigquH4PoDH4YpL8vnIeEMNmny4iER/AoGBAJj8k+jpUXSFkHfh7vwo
+AR9RUmLmRmL6/KsztbTQ5U6xBjV+XqXq90ZUU1A2Yk+lhXPIEkK2crGfJy9dFfTR
+LQxPLNkSyxyPzMqmgaxjOc6mEDap/hqlJDx2UgPh/kpAI+inOFyZnyj3wx6ixqv5
+a2frR996vdJNDCW6d1sbPLxBAoGBAMO66IN0UJy76Izw0Olr+4v10vFdmENM6T+o
+IqhZBq33P+yDN8sxJ5NgjhsT/Pruq3LT9XbVYUlvsbKHcx2U5PQ/AZejedqvokZH
+g+ZfVjnJz1ZfG1GOOBBu3jSZZdfSKRVAfhFJ0A/229ihxEwxmFAY/MCaYTzsbInb
+kyXRnz5zAoGBAIT9Fuk7zhfubYvkzIQ0kj/IxL3QohVRKcoGapDMSwNjTvxZdKxF
+WXkhhJT095QznHP1fhp90fBKlOdsReDWfZXMYtZTqo2+ezK8qb6xMlm+LE09y+Na
+f7pp1EPnIqyEX27B4aQ81M8tkCqbdlv3CdjFSusp6SsWTGTjr/5SAMDS
+-----END RSA PRIVATE KEY-----
+
+-----BEGIN CERTIFICATE-----
+MIIDNzCCAh8CCQDn8i4K9c4ErDANBgkqhkiG9w0BAQsFADBfMQswCQYDVQQGEwJO
+TDETMBEGA1UECAwKU29tZS1TdGF0ZTEhMB8GA1UECgwYSW50ZXJuZXQgV2lkZ2l0
+cyBQdHkgTHRkMRgwFgYDVQQDDA9DSEFNNTAwIHJvb3QgY2EwHhcNMTgwMjEyMTUw
+NjUxWhcNMTkwNjI3MTUwNjUxWjBcMQswCQYDVQQGEwJOTDETMBEGA1UECAwKU29t
+ZS1TdGF0ZTEhMB8GA1UECgwYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMRUwEwYD
+VQQDDAxDSEFNNTAwIGNlcnQwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB
+AQDRnnNnV3PZrbZwjxk+dkQcO3pK3wMvoDNAHPPiTfXRV2KjLHxsuK7wV+GPHmXo
+97bot6vBxNQN7hfxoDLL+KBO9s3V+8OX6lOrF7hQ6+6/p9EgRoyNGo21eIzGwc2M
+aJAKjImNMbM7FDTvhk3u+VTTJtlnKvJM1tgncbEZwRLri/2MEC5XS/O5FQT4AXPr
+A6bRcGMqCVYtQ0ci6wd18PegA/rSmGSRf/TOd4jZXkxfHD+YOkHcxxz9sX4KnyOg
+XZm8jDdBc7rxiDep8kIjL06VszJeoQrxjuf8cNZtbol/7ECS5aM2YOx7t0Dc/629
+V2Q5waRVBV5xVCJ0BzUh8rIFAgMBAAEwDQYJKoZIhvcNAQELBQADggEBAGlkxYLr
+ZI/XNjDC6RFfSFRoDc+Xpcg+GsJKKbw2+btZvAD8z7ofL01yGru9oi6u2Yy/ZDKT
+liZ+gtsD8uVyRkS2skq7BvPzvoYErLmSqwlrcCbeX8uHiN7C76ll9PFtSjnwPD//
+UaNyZM5dJB2eBh4/prclix+RR/FWQzkPqEVLwMcFBmnPZ0mvR2tncjpZq476Qyl9
+3jcmfms9qBfBPPjCdXqGEDgsTd2PpYRD2WDj/Ctl4rV7B2jnByullLUYIWGu0rYt
+988waU5i8ie4t/TorBBLqQo/NO9jSXfEqcAnILPnv1QZanKzAAxSg7+FgFrsn359
+ihiEkx9zFUnPrdA=
+-----END CERTIFICATE-----
diff --git a/src/security/builtin_plugins/tests/validate_local_identity/etc/private_key_w_password b/src/security/builtin_plugins/tests/validate_local_identity/etc/private_key_w_password
new file mode 100644
index 0000000..ba09dc0
--- /dev/null
+++ b/src/security/builtin_plugins/tests/validate_local_identity/etc/private_key_w_password
@@ -0,0 +1,30 @@
+-----BEGIN RSA PRIVATE KEY-----
+Proc-Type: 4,ENCRYPTED
+DEK-Info: AES-256-CBC,0C9C38C5678AECD200E024A9A5BC717A
+
+wbXYsR78o4DIaQbKsB4cwEFge79GMKbcMgIWK+9k86dPk09WZkj7JCSJXIxPLYOG
+tFZrw/z86cakEhf90a4Moa1cwByrcFB+bpWoEqsx/C4javWxXMENbmQ5x8gDpmzT
+qqLI7xnd2mYj7HcfE7eXi+Nub5w1tBxN0CWaxpR54ZVvfcPE6Od4SHGughdUN4AK
+OdVIq5YuzMhuTDJKy+kGOtjH8pBWvo8S12T2UQEuusx5WUbEJ6m+E80aN7M6gCA+
+XmNTt3PsV9PfZPL2Off/90gqTBdMhwn+sEVlqYG0TAnXZQEI8ZNtAGy77CFplqdT
+SmI3x8Sza7lchEMFhRiayX9pMBPUlwckVPrCoMQ4b4WkHYoGLO7dNVAA8Osud46+
+6MZKHStjdzwKz9MzWa7lXhXV+0sX5bcAzQexuE+wO8QQ/t5uwDmQHol0JVdRX8NB
+/Exk6aT7mWajFvukXVirpUGWnEK2W+O8/VBzVZ7z69EjZ09Pu4Y/+cbX12LGSwMb
+WVtnZY6BsrV++vikQuL3ByTBDPRHio2H8hThh1Kv8n5VEBUrk7tLUp3Z15cbfC6s
+LDHX6kB2OKmmdqLOOMo4lToZfnrVK/dzeXFbtNH1POpR4/e5Nk0SyZrWo+E/AqIv
+nLQ3fhLCPOB5rjAhuM8iXOwqn8HHNlv9j8mlgCcgwK7focYVc/IXARLOfFOjOA/s
+EqMRbb/eKsC930NHBZkhlqRJKCwA37AMvnOhN4R0VOq/40K+62IUK9E1643KyWs0
+vWk0rFY0OKorQXzI33lbBYZ5zHt8oxGNx3us+6jGP85iv8UEaO6FpgajEUn6Gzp/
+wyvr1C/B/Hfr6eTbt4C6Fi5fMfZgM6VEcJuaFZnoC9tWdhlNsY1pwtPghMM7yBwc
+1Ye0TxdF36exJWu1gXVTse1Vdc9i4QWpT2fbPQtcIgdtNk01K+2defie384IOnQQ
+O8/SRsrnLRLV3IDFh/VBJS1ZVm8Zmt10yGgRwtYHntMkIopoFRWcm9/Gh3iBFKKH
+OTVXxgKOUYk4qXG61N8k0M+TIdoOHZIha3Myis1tQVmA/b/4FRKPYgdrFijhXNLM
+wwMHQOS14xBF2KBgaak7dMUWhGrClw1hc3HmMXuM+OLvxy+f8MC3JP2U5AuCs472
+hc41KWxioqNMPVXZgVnHf3aEec+hBFceqYnlzG+E/Gagiufu8WMySaZgzXMRb5aV
+x2OVcakSKrTC5EKbLDlZ6+1NRJht7wdSefh0o/Crc9LzcFqBL0Qp3WCvyY8gDVkQ
+EGqoVYOE6Hz/NX5/17F1+5VuWT7nBWABHKFFriOoJ3VR9sZhp0HiMznZEF1AwVuZ
+xHtDWQemfBywEQG23qbr+o7mQASh1zki8b4fP1HQmbHhaJarjwGdiVNIgcF7s7Qk
+NYNcgsc1l0KuNHvredTnYwPhv3C08IBfjtd2H9u0A+AWl5RlR4GDfv2Jzbe/F8U+
+0gxj8D2XWHlkbHIXKVk6jxj64xyNE1xB0Sv7gsDWpkaK6aw/zdsyxqiji4mThcYE
+cRSl4y9CGZREaiyD8dk/uiqKfQ26c1gfOUDYS2fKjH5NKh4J80wQj0GvS6nHiDH4
+-----END RSA PRIVATE KEY-----
diff --git a/src/security/builtin_plugins/tests/validate_local_identity/etc/trusted_ca_dir/identity_ca b/src/security/builtin_plugins/tests/validate_local_identity/etc/trusted_ca_dir/identity_ca
new file mode 100644
index 0000000..7e2675c
--- /dev/null
+++ b/src/security/builtin_plugins/tests/validate_local_identity/etc/trusted_ca_dir/identity_ca
@@ -0,0 +1,27 @@
+-----BEGIN CERTIFICATE-----
+MIIEmTCCA4GgAwIBAgIIZ5gEIUFhO5wwDQYJKoZIhvcNAQELBQAwXzELMAkGA1UE
+BhMCTkwxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdp
+ZGdpdHMgUHR5IEx0ZDEYMBYGA1UEAxMPQ0hBTTUwMCByb290IGNhMCAXDTE4MDIx
+MjE1MDUwMFoYDzIyMjIwMjIyMjIyMjAwWjBfMQswCQYDVQQGEwJOTDETMBEGA1UE
+CBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRk
+MRgwFgYDVQQDEw9DSEFNNTAwIHJvb3QgY2EwggEiMA0GCSqGSIb3DQEBAQUAA4IB
+DwAwggEKAoIBAQC6Fa3TheL+UrdZCp9GhU/2WbneP2t/avUa3muwDttPxeI2XU9k
+ZjBR95mAXme4SPXHk5+YDN319AqIje3oKhzky/ngvKH2GkoJKYxWnuDBfMEHdViz
+2Q9/xso2ZvH50ukwWa0pfx2/EVV1wRxeQcRd/UVfq3KTJizG0M88mOYvGEAw3LFf
+zef7k1aCuOofQmBvLukUudcYpMzfyHFp7lQqU4CcrrR5RtmfiUfrWfdGLea2iPDB
+pJgN8ESOMwEHtOTEBDclYnH9L4t7CHQz+fXXS5IWFsDK9fCMQjnxDsDVeNrNzTYL
+FaZrMg9S6IUQCEsQWsnq5weS8omOpVLUm9klAgMBAAGjggFVMIIBUTAMBgNVHRME
+BTADAQH/MB0GA1UdDgQWBBQg2FZB/j8uWDVnJhjwXkX278znSTAfBgNVHSMEGDAW
+gBQg2FZB/j8uWDVnJhjwXkX278znSTAPBgNVHQ8BAf8EBQMDB/+AMIHvBgNVHSUB
+Af8EgeQwgeEGCCsGAQUFBwMBBggrBgEFBQcDAgYIKwYBBQUHAwMGCCsGAQUFBwME
+BggrBgEFBQcDCAYKKwYBBAGCNwIBFQYKKwYBBAGCNwIBFgYKKwYBBAGCNwoDAQYK
+KwYBBAGCNwoDAwYKKwYBBAGCNwoDBAYJYIZIAYb4QgQBBgsrBgEEAYI3CgMEAQYI
+KwYBBQUHAwUGCCsGAQUFBwMGBggrBgEFBQcDBwYIKwYBBQUIAgIGCisGAQQBgjcU
+AgIGCCsGAQUFBwMJBggrBgEFBQcDDQYIKwYBBQUHAw4GBysGAQUCAwUwDQYJKoZI
+hvcNAQELBQADggEBAKHmwejWRwGE1wf1k2rG8SNRV/neGsZ6Qfqf6co3TpR/Wi1s
+iZDvSeT/rbqNBS7z34xnG88NIUwu00y78e8Mfon31ZZbK4Uo7fla9/D3ukdJqPQC
+LKdbKJjR2kH+KCukY/1rghjJ8/X+t2egBit0LCOdsFCl07Sfksb9kpGUIZSFcYYm
+geqhjhoNwxazzHiw+QWHC5HG9248JIizBmy1aymNWuMnPudhjHAnPcsIlqMVNq3t
+Rv9ap7S8JeCxHVRPJvJeCwXWvW3dW/v3xH52Yn/fqRblN1w9Fxz5NhopKx0gj/Jd
+sw2N4Fk4gaOWEolFpa0bwNw8nAx7moehZpowzfw=
+-----END CERTIFICATE-----
diff --git a/src/security/builtin_plugins/tests/validate_local_identity/etc/trusted_ca_dir/root_CA_RSA.crt b/src/security/builtin_plugins/tests/validate_local_identity/etc/trusted_ca_dir/root_CA_RSA.crt
new file mode 100644
index 0000000..61346df
--- /dev/null
+++ b/src/security/builtin_plugins/tests/validate_local_identity/etc/trusted_ca_dir/root_CA_RSA.crt
@@ -0,0 +1,28 @@
+-----BEGIN CERTIFICATE-----
+MIIEtjCCA56gAwIBAgIBATANBgkqhkiG9w0BAQsFADByMQswCQYDVQQGEwJOTDEL
+MAkGA1UECBMCT1YxEzARBgNVBAoTCkFETGluayBJU1QxGTAXBgNVBAMTEElkZW50
+aXR5IENBIFRlc3QxJjAkBgkqhkiG9w0BCQEWF2luZm9AaXN0LmFkbGlua3RlY2gu
+Y29tMB4XDTE4MDYxMTAwMDAwMFoXDTI3MDYxMDIzNTk1OVowcjELMAkGA1UEBhMC
+TkwxCzAJBgNVBAgTAk9WMRMwEQYDVQQKEwpBRExpbmsgSVNUMRkwFwYDVQQDExBJ
+ZGVudGl0eSBDQSBUZXN0MSYwJAYJKoZIhvcNAQkBFhdpbmZvQGlzdC5hZGxpbmt0
+ZWNoLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBANRf3XKmM6O+
+WoYPNpOAdkGKKZHLJ8ZuPxVVBMX6oJAlcOmkhLzfkHSA+gl/OWaMOXIEtN512gyL
+YszBf1RImwVzRjJFwIxzGzVQ68jYNj+qBbsOt+IG+hs3wgVCLFkCh+J7hXUgvk8A
+eRM/SRrI42dQfcgKUAMNi4/iX6Vs+FV9pHB63L4PiLA9hfUE25sH6EsIC7icvGDJ
+6cGG94glVSHDI1NtXfsNHY+NGY/jYKtQZklqU3lew5I60aJIsea+Wk6PJiz4hyXv
+XVVmrcNeG1g4OEFgiSXZC2XknDw8t9+ELprGNvuJvTFxwPMAgLeF4IhEQC9dQY2W
+BRwUxtZBzukCAwEAAaOCAVUwggFRMAwGA1UdEwQFMAMBAf8wHQYDVR0OBBYEFER4
+R6N3MQ1Wl7gn+R8wwHloDCVZMB8GA1UdIwQYMBaAFER4R6N3MQ1Wl7gn+R8wwHlo
+DCVZMA8GA1UdDwEB/wQFAwMH/4Awge8GA1UdJQEB/wSB5DCB4QYIKwYBBQUHAwEG
+CCsGAQUFBwMCBggrBgEFBQcDAwYIKwYBBQUHAwQGCCsGAQUFBwMIBgorBgEEAYI3
+AgEVBgorBgEEAYI3AgEWBgorBgEEAYI3CgMBBgorBgEEAYI3CgMDBgorBgEEAYI3
+CgMEBglghkgBhvhCBAEGCysGAQQBgjcKAwQBBggrBgEFBQcDBQYIKwYBBQUHAwYG
+CCsGAQUFBwMHBggrBgEFBQgCAgYKKwYBBAGCNxQCAgYIKwYBBQUHAwkGCCsGAQUF
+BwMNBggrBgEFBQcDDgYHKwYBBQIDBTANBgkqhkiG9w0BAQsFAAOCAQEAwXuEWDG3
+aAyL+DsGr0B4YMLjHtx6FjzkJOpTtXQhkrtSMpD3Xytl7Wfz8lyWuTnbrk8F4gWO
+IkJR/NdMGW27SmeYU0z7QAGRDwtHX6kqqizQbCwf4F6P/2QftcLp1VrlsIlb0gyx
+gLjpGmn5TT7gj+ahW0iIRglOwhzCvkNu6agYpdGwVirSyLShy/Hq303DZSbVuktz
+5/PmZKpufnoGqURNnJqbV4TQipE0FiDmp2o+gVgJ+DVRhiCdfk68Xp7+TlmxCDfZ
+C3qb18qrwAZ4AL3T9/RlzfkXh4ME9V6wqa5Y6j7Vwx5Ef2OHL+mnMnoNSXDLRh6j
+45ky66su5dROpA==
+-----END CERTIFICATE-----
diff --git a/src/security/builtin_plugins/tests/validate_local_identity/etc/trusted_ca_dir_not_matching/not_matching_trusted_ca.crt b/src/security/builtin_plugins/tests/validate_local_identity/etc/trusted_ca_dir_not_matching/not_matching_trusted_ca.crt
new file mode 100644
index 0000000..35506b8
--- /dev/null
+++ b/src/security/builtin_plugins/tests/validate_local_identity/etc/trusted_ca_dir_not_matching/not_matching_trusted_ca.crt
@@ -0,0 +1,25 @@
+-----BEGIN CERTIFICATE-----
+MIIENDCCAxygAwIBAgIBAjANBgkqhkiG9w0BAQsFADByMQswCQYDVQQGEwJOTDEL
+MAkGA1UECBMCT1YxEzARBgNVBAoTCkFETGluayBJU1QxGTAXBgNVBAMTEElkZW50
+aXR5IENBIFRlc3QxJjAkBgkqhkiG9w0BCQEWF2luZm9AaXN0LmFkbGlua3RlY2gu
+Y29tMB4XDTE4MDYxMzAwMDAwMFoXDTI3MDYxMDIzNTk1OVowfTELMAkGA1UEBhMC
+TkwxCzAJBgNVBAgTAk9WMRMwEQYDVQQKEwpBRExpbmsgSVNUMSQwIgYDVQQDExtJ
+ZGVudGl0eSBDQSBUZXN0IFdpdGggQ2hhaW4xJjAkBgkqhkiG9w0BCQEWF2luZm9A
+aXN0LmFkbGlua3RlY2guY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKC
+AQEA1r8Q0V8ZVeBs8tPMF0N+JlBynl1Zn/89vwSsU4m7y6ixUcW/y3r12CMeA0cH
+g6yOaOdHsZ8pRlPRwy9YmeOwLsMOUHAURP2uPiTjSf3pttUIf0jv602GyirNzoS7
+7mHiyTtV80ZMzZlLIJ3gaJJlG4DjitFuFcjv8sOmviFjkn1kOjkAz1nKgsCiHvvg
+fcJlYPrtLfle9SzvZ3MTq4ob+/EFu9nt5bYYs7p7Br1TGWctUw98l2mSn/FhfDBw
+9bb7ZhcKB7W6PGy2Os5AnkdTJKHoOQT+RmnHzPBhab0BoKuy8IhfW2GyqC8rL5Tm
+/UVLUvnx4Zzqz//3IyA2FTb1HQIDAQABo4HJMIHGMAwGA1UdEwQFMAMBAf8wHQYD
+VR0OBBYEFE1VQk0XOEk9F5hPhBLHp0rncJcJMB8GA1UdIwQYMBaAFER4R6N3MQ1W
+l7gn+R8wwHloDCVZMA8GA1UdDwEB/wQFAwMH/4AwZQYDVR0lAQH/BFswWQYIKwYB
+BQUHAwEGCCsGAQUFBwMCBggrBgEFBQcDAwYIKwYBBQUHAwQGCCsGAQUFBwMIBggr
+BgEFBQcDCQYIKwYBBQUHAw0GCCsGAQUFBwMOBgcrBgEFAgMFMA0GCSqGSIb3DQEB
+CwUAA4IBAQCbl7ed4p66G6WquxO7ceZFvYKn3kDErjCfXHcqHxBnA2xTpoZCGj95
+Qpirqo6N4UcLX5sn3CmgyVk0dYvlti/53FJgZ9XQDNxBuEYWPkY7vO+Uo0WdYpGz
+ZDNIUQpiPMA7bHvwKldTIs77xxtnw9kbBU2k0xQyb2tdZNfD5YqSI1MeUtpEpNFW
+sbC8+mQ3clzWpjF8eHH1fFSAmlJ+z1Uqmtt2FK0vRz+MQcpydwvpMnfqGdcwhGPQ
+X4HZreLObjBA8KUEkUB3+rZXuELBgkk/c8/jRZl7QF5jJDLQCCLg7KoYBKN2GuTt
+/dzeSnP7VZm/nTL8wpCvKgSOwOGgklf2
+-----END CERTIFICATE-----
diff --git a/src/security/builtin_plugins/tests/validate_local_identity/etc/unrelated_identity_ca b/src/security/builtin_plugins/tests/validate_local_identity/etc/unrelated_identity_ca
new file mode 100644
index 0000000..52cf047
--- /dev/null
+++ b/src/security/builtin_plugins/tests/validate_local_identity/etc/unrelated_identity_ca
@@ -0,0 +1,22 @@
+-----BEGIN CERTIFICATE-----
+MIIDpDCCAoygAwIBAgIJALE5lRKfYHAaMA0GCSqGSIb3DQEBCwUAMF8xCzAJBgNV
+BAYTAk5MMRMwEQYDVQQIDApPdmVyaWpzc2VsMRAwDgYDVQQHDAdIZW5nZWxvMQ8w
+DQYDVQQKDAZBRExJTksxGDAWBgNVBAMMD0NIQU01MDAgUm9vdCBDQTAeFw0xODAy
+MDkxNjIwNDNaFw0zODAyMDQxNjIwNDNaMF8xCzAJBgNVBAYTAk5MMRMwEQYDVQQI
+DApPdmVyaWpzc2VsMRAwDgYDVQQHDAdIZW5nZWxvMQ8wDQYDVQQKDAZBRExJTksx
+GDAWBgNVBAMMD0NIQU01MDAgUm9vdCBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEP
+ADCCAQoCggEBAN9/NbpJDHQYHh3cEByRxnHffxEe9Sapn08Ty5xYO8LDJ4V7vU32
+/7291fITiHaovOoCRHAbKTaTtqJO56aGY45HON6KIqxljLQJJVGW/Nf2PNSHmFix
+6D6bsoSOTPyKYqBNT6lB7NMn4QBTcsiE61El8p9WLQZHoYQJK5Psf7wkBqGBz8he
+bcDWXFn7kIgnsaLrh77w2wi/y0MqpPwyeRInoZfYknzVNdxCPgq7csBYDoMgOgkV
+G60ECXojHKz1HI4n0V8L8lZluSSVRNR0xvPFgBqO7b+Re7xb6iO9TNsFeoiMMNyp
+EwM99CqPO0RRrAPiC7IDgcNGjxhne9EJFGsCAwEAAaNjMGEwHQYDVR0OBBYEFCst
+gj5Ecm3HU/N7wxJluFo5+6XUMB8GA1UdIwQYMBaAFCstgj5Ecm3HU/N7wxJluFo5
++6XUMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgGGMA0GCSqGSIb3DQEB
+CwUAA4IBAQCWibvYuPLpoNcsUdHbE7SnBbEQnDfBxBZN8xeWHwwAPEB+8eHhmIdZ
+xDtCN61xr5QR+KzlEYFwKyHMp9GN3OPU1RndJrzaXz2ddAZVkBIvnQZ4JvFd+sBC
+QQgEvL8GcwZPxnad/TRylM4ON3Kh0X9vfyrmWEoHephiE1LcENaFqcYr9xg3DJNh
+XSrigMGZJ7IOHkvgaoneICOcYI42ZHS0fnt1G+01VKJXm3ndi5NL25GnOmlvV6yV
++1vcmdQc6YS8K8vHmrH4lX9iPfsOak6WSzzsXdqgpvyxtGJggcFaDTtmbWCAkJj0
+B7DMeaVlLClGQaKZZ7aexEx9se+IyLn2
+-----END CERTIFICATE-----
diff --git a/src/security/builtin_plugins/tests/validate_local_identity/src/ca.crt b/src/security/builtin_plugins/tests/validate_local_identity/src/ca.crt
new file mode 100644
index 0000000..426d312
--- /dev/null
+++ b/src/security/builtin_plugins/tests/validate_local_identity/src/ca.crt
@@ -0,0 +1,22 @@
+-----BEGIN CERTIFICATE-----
+MIIDkTCCAnmgAwIBAgIJAJvGJOEKNct1MA0GCSqGSIb3DQEBCwUAMF8xCzAJBgNV
+BAYTAk5MMRMwEQYDVQQIDApTb21lLVN0YXRlMSEwHwYDVQQKDBhJbnRlcm5ldCBX
+aWRnaXRzIFB0eSBMdGQxGDAWBgNVBAMMD0NIQU01MDAgcm9vdCBjYTAeFw0xODAy
+MTIxNTA1MDVaFw0yMDEyMDIxNTA1MDVaMF8xCzAJBgNVBAYTAk5MMRMwEQYDVQQI
+DApTb21lLVN0YXRlMSEwHwYDVQQKDBhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQx
+GDAWBgNVBAMMD0NIQU01MDAgcm9vdCBjYTCCASIwDQYJKoZIhvcNAQEBBQADggEP
+ADCCAQoCggEBAM/dCO4QAcCduw0NMqShDpTvGT6DClTFAJE8ZfuPCHKqNkicRbyj
+sVXfF35Sdo6K92Ksz4G7i1RqJU2n8c7hg2EFUza0lIGgmTHV/DvFBcbAa0PpvdKS
+XoPtSNDh65/GO1R7oeSFRzapqsLMPUwOWi46dYvRnPabxs21xHxn56JeuG74bad5
+PMTBvA2SiiTYPBlHGJS78GPo3BPMjL0MzPoMmumO8NSVYI+MEDY1lC4KkyZVKqtV
+nIfaO/7adcM19xOAfAHkwhLGBC/bVAEqelev+GH/42xjNv532nM4/JVtBns+msR5
+DAYdtr6i82b7zhU1+lOOihv4lmQHoSnTya8CAwEAAaNQME4wHQYDVR0OBBYEFFYr
+0CpiwxgFcZnW6IQEhxGv/vwiMB8GA1UdIwQYMBaAFFYr0CpiwxgFcZnW6IQEhxGv
+/vwiMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAKbBt0ht72fdtxwm
+Kr0pOsKyDW0Rd5Ca5aDK4qAhDL0AD5+O6ShGYCnFNDGk3J5Yzawp8VoKrhDZZyUt
+z2b0jNucVapAvPMA4066QxeIfvFmWcS73l7vjjeUoKWmNNGWprTg3RLsacTorKuY
+ZRL7wsThfrhvg4B/OOIWKp5MEwIrUfnQzUca8getF2eyTt6QcMtE29AW5+01QTzj
+fxZgzkmJFYBE2K/TLMDBDd+bz/8XnmPrJ01VUntXiXenTGTcIbJerB6GYQojjvhy
+ZrOeuHTON1ndFiQkpeZA67ByZjkKVoJG3I8fwBjzcLE7u/QAQptVPjJXXcSpL7fA
+a1tOvqw=
+-----END CERTIFICATE-----
\ No newline at end of file
diff --git a/src/security/builtin_plugins/tests/validate_local_identity/src/id.crt b/src/security/builtin_plugins/tests/validate_local_identity/src/id.crt
new file mode 100644
index 0000000..7c03aae
--- /dev/null
+++ b/src/security/builtin_plugins/tests/validate_local_identity/src/id.crt
@@ -0,0 +1,20 @@
+-----BEGIN CERTIFICATE-----
+MIIDNzCCAh8CCQDn8i4K9c4ErDANBgkqhkiG9w0BAQsFADBfMQswCQYDVQQGEwJO
+TDETMBEGA1UECAwKU29tZS1TdGF0ZTEhMB8GA1UECgwYSW50ZXJuZXQgV2lkZ2l0
+cyBQdHkgTHRkMRgwFgYDVQQDDA9DSEFNNTAwIHJvb3QgY2EwHhcNMTgwMjEyMTUw
+NjUxWhcNMTkwNjI3MTUwNjUxWjBcMQswCQYDVQQGEwJOTDETMBEGA1UECAwKU29t
+ZS1TdGF0ZTEhMB8GA1UECgwYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMRUwEwYD
+VQQDDAxDSEFNNTAwIGNlcnQwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB
+AQDRnnNnV3PZrbZwjxk+dkQcO3pK3wMvoDNAHPPiTfXRV2KjLHxsuK7wV+GPHmXo
+97bot6vBxNQN7hfxoDLL+KBO9s3V+8OX6lOrF7hQ6+6/p9EgRoyNGo21eIzGwc2M
+aJAKjImNMbM7FDTvhk3u+VTTJtlnKvJM1tgncbEZwRLri/2MEC5XS/O5FQT4AXPr
+A6bRcGMqCVYtQ0ci6wd18PegA/rSmGSRf/TOd4jZXkxfHD+YOkHcxxz9sX4KnyOg
+XZm8jDdBc7rxiDep8kIjL06VszJeoQrxjuf8cNZtbol/7ECS5aM2YOx7t0Dc/629
+V2Q5waRVBV5xVCJ0BzUh8rIFAgMBAAEwDQYJKoZIhvcNAQELBQADggEBAGlkxYLr
+ZI/XNjDC6RFfSFRoDc+Xpcg+GsJKKbw2+btZvAD8z7ofL01yGru9oi6u2Yy/ZDKT
+liZ+gtsD8uVyRkS2skq7BvPzvoYErLmSqwlrcCbeX8uHiN7C76ll9PFtSjnwPD//
+UaNyZM5dJB2eBh4/prclix+RR/FWQzkPqEVLwMcFBmnPZ0mvR2tncjpZq476Qyl9
+3jcmfms9qBfBPPjCdXqGEDgsTd2PpYRD2WDj/Ctl4rV7B2jnByullLUYIWGu0rYt
+988waU5i8ie4t/TorBBLqQo/NO9jSXfEqcAnILPnv1QZanKzAAxSg7+FgFrsn359
+ihiEkx9zFUnPrdA=
+-----END CERTIFICATE-----
\ No newline at end of file
diff --git a/src/security/builtin_plugins/tests/validate_local_identity/src/priv.pem b/src/security/builtin_plugins/tests/validate_local_identity/src/priv.pem
new file mode 100644
index 0000000..b560f66
--- /dev/null
+++ b/src/security/builtin_plugins/tests/validate_local_identity/src/priv.pem
@@ -0,0 +1,27 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIIEowIBAAKCAQEA0Z5zZ1dz2a22cI8ZPnZEHDt6St8DL6AzQBzz4k310Vdioyx8
+bLiu8Ffhjx5l6Pe26LerwcTUDe4X8aAyy/igTvbN1fvDl+pTqxe4UOvuv6fRIEaM
+jRqNtXiMxsHNjGiQCoyJjTGzOxQ074ZN7vlU0ybZZyryTNbYJ3GxGcES64v9jBAu
+V0vzuRUE+AFz6wOm0XBjKglWLUNHIusHdfD3oAP60phkkX/0zneI2V5MXxw/mDpB
+3Mcc/bF+Cp8joF2ZvIw3QXO68Yg3qfJCIy9OlbMyXqEK8Y7n/HDWbW6Jf+xAkuWj
+NmDse7dA3P+tvVdkOcGkVQVecVQidAc1IfKyBQIDAQABAoIBAEddUpzUQTTS11Hq
+5gVF7lpORYxH8KW+PLSPJtjdAduLjKFQ++tn1OcuhDRdfQSbkUIZhfgqMqerb6tr
+ht+6fZlknR9E34pQ1LtjD/U83cOSNrhuTFudtrEZoZPpVzl+P8vXnNzdFs/+SSdi
+6hV5/U8F4u4kyOkwG9cR9eF2wiI+oQ/RBKCXUo3OVs9K27A/OkKsb7coL7yBsgBj
+lzorS9a/DyHT2eiMKjwCZFyG4A66EkLi6t9JLJ8oTkI2WskXYeVEAbEXE57RWm44
+2OgTI/Yc2yrtXq93KD17FN1m77dqp7EPAhjGnRHNq7+0Ykr1EO1nbDfqHG4gS+4o
+lfP8iwECgYEA58da0R34l93yQnK0mAtoobwvsOjADnBVhBg9L4s2eDs8liUjf0zt
+7hcMdUJaa7iMuNf3qGtnZtRURc3kSOE429Or7fCAYUr/AaA7+2ekPG1vjMb50tVv
+se5rwb1hvgMYe2L5ktJJAg+RcmqpY+ncJ+hP/vWwZRxUKvXba50qqEkCgYEA54ZE
+mJfSueGM/63xlhP71CM4OWtTqkQGp2OmgTOsBI5q/GUXr8vMR8sCEMHAc6HyXzmL
+x/RnAoa/vTX58rXBk0QjfO9esIHa452697EIaJu5w8skCLDv2e/f+Jg7o/IDyUZs
+5lqhiEuH9Qc3sx2nhnSYXMZWqwh8OchI7dCSE90CgYEAzrJ1JhpxUJYI7wM2VIWQ
+GPQnH8BhTj8VtEidgCHJQK2rGUcjgepMIVECtiunUXtyW4GWBedKfmSKhvnXRLs9
+pqT9JaOeCaYFBiEsfMZvq8f4e/YSYtge1PIHvO40FWzTT23zneDUZPcXQY8nYsfy
+otBFTt0yIumBkhJRTIYLvakCgYA+CcttvBj6OAcJJ/n5RgeP05QoRqsXj7zcs6YV
+LtxkKClg0lHjiE+H2U0HYnOISJfijk/3V3UWxzavo7wDHlLtfC+qNZYA4/rcTRKh
+dm2TYk8HuPJB5e+PTWiNe3VXu+zpzRY3L4fjNqIKtVFmjIasT6fYDEmC8PYgoZtx
+JhdOfQKBgCD/bDkc+VI6lwQtoQQKiSfQjKGe+6Cw9K/obzWO0uJwBvZrGLXF8tTc
+MOPIv9OILt7DYxpMXAiHv8HtzH5CFVrZ/nj63SRoka/j2yvUdBDrGhyIbsc4pDu+
+lCFa0ZiT/u5vRAiOkM6GuStH4HxnW9LtwBtiYXtfU7IPExJiAlsq
+-----END RSA PRIVATE KEY-----
\ No newline at end of file
diff --git a/src/security/builtin_plugins/tests/validate_local_identity/src/remote b/src/security/builtin_plugins/tests/validate_local_identity/src/remote
new file mode 100644
index 0000000..195709a
--- /dev/null
+++ b/src/security/builtin_plugins/tests/validate_local_identity/src/remote
@@ -0,0 +1,20 @@
+-----BEGIN CERTIFICATE-----
+MIIDMzCCAhsCCQDn8i4K9c4ErzANBgkqhkiG9w0BAQsFADBfMQswCQYDVQQGEwJO
+TDETMBEGA1UECAwKU29tZS1TdGF0ZTEhMB8GA1UECgwYSW50ZXJuZXQgV2lkZ2l0
+cyBQdHkgTHRkMRgwFgYDVQQDDA9DSEFNNTAwIHJvb3QgY2EwHhcNMTgwMzIzMTIw
+MTE5WhcNMjMxMDMxMTIwMTE5WjBYMQswCQYDVQQGEwJOTDETMBEGA1UECAwKU29t
+ZS1TdGF0ZTEhMB8GA1UECgwYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMREwDwYD
+VQQDDAhDSEFNLTU3NzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMcc
+IMlRp2EnOC/UIIOF2gm+wtsikv5CscDuyq9DA2QgS5TTKqivDAdOSUIcbVn8qb6/
+77viarmRXml3VHJdhR2abtY6xYKYF2SCFiyoNk6ITq+YBrCfmMh/bCYTD6c5vnl4
+SKomIArU1g1YAxHxHqZRX1oonldUdP4lqq+Qt6fllYFhHNAl5JjrrCuPpXmAW3pC
+z4b3HWP/6vnbOFFMYkwGprVoAljcnAG7C7zSjW2M3RN4xA/z6Lps8qrPFB2iAXaP
+ZnST1rkqctf2IDWVwloG0uJnqiigcIz6+hvf5VMU0ax+CrYqFGav/uwvPCiHcUkF
+3a/O3z+4xGHaBagfHukCAwEAATANBgkqhkiG9w0BAQsFAAOCAQEAXZlNPz6raCBp
+F+iyNWTGy27OyM/TZNE9QTPI28TQEmLfqCrRfq+uHhBQ3U9TgS3xX/f5b+BPHuaD
+N6vl/yECAQa+0r33EFdoe8rGa0Mr5VvADcqPmk/sp9K62fRcP4aCgliDi8g9G8q1
+XNgO/EA9HhFlFKPzLPFMhq7qqPOQWO/EddoxA/qCMGZtN+TAxqLKVB0lipJoSa0x
+XqtYvNWiaShPceSk4SAjAdpdhvxOpA/25uvFEISdt9zoqbs4eLUbi/9RFYaL8U4r
+E+FygZMi31N6PC/Q7/tJ4DG20K/V30Y1+ogvSfdJpWk9L/CJj0VrzqJTVaKBIFVV
+6PtqHPZiKA==
+-----END CERTIFICATE-----
\ No newline at end of file
diff --git a/src/security/builtin_plugins/tests/validate_local_identity/src/unrelated_identity_ca b/src/security/builtin_plugins/tests/validate_local_identity/src/unrelated_identity_ca
new file mode 100644
index 0000000..f2bec0c
--- /dev/null
+++ b/src/security/builtin_plugins/tests/validate_local_identity/src/unrelated_identity_ca
@@ -0,0 +1,22 @@
+-----BEGIN CERTIFICATE-----
+MIIDpDCCAoygAwIBAgIJALE5lRKfYHAaMA0GCSqGSIb3DQEBCwUAMF8xCzAJBgNV
+BAYTAk5MMRMwEQYDVQQIDApPdmVyaWpzc2VsMRAwDgYDVQQHDAdIZW5nZWxvMQ8w
+DQYDVQQKDAZBRExJTksxGDAWBgNVBAMMD0NIQU01MDAgUm9vdCBDQTAeFw0xODAy
+MDkxNjIwNDNaFw0zODAyMDQxNjIwNDNaMF8xCzAJBgNVBAYTAk5MMRMwEQYDVQQI
+DApPdmVyaWpzc2VsMRAwDgYDVQQHDAdIZW5nZWxvMQ8wDQYDVQQKDAZBRExJTksx
+GDAWBgNVBAMMD0NIQU01MDAgUm9vdCBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEP
+ADCCAQoCggEBAN9/NbpJDHQYHh3cEByRxnHffxEe9Sapn08Ty5xYO8LDJ4V7vU32
+/7291fITiHaovOoCRHAbKTaTtqJO56aGY45HON6KIqxljLQJJVGW/Nf2PNSHmFix
+6D6bsoSOTPyKYqBNT6lB7NMn4QBTcsiE61El8p9WLQZHoYQJK5Psf7wkBqGBz8he
+bcDWXFn7kIgnsaLrh77w2wi/y0MqpPwyeRInoZfYknzVNdxCPgq7csBYDoMgOgkV
+G60ECXojHKz1HI4n0V8L8lZluSSVRNR0xvPFgBqO7b+Re7xb6iO9TNsFeoiMMNyp
+EwM99CqPO0RRrAPiC7IDgcNGjxhne9EJFGsCAwEAAaNjMGEwHQYDVR0OBBYEFCst
+gj5Ecm3HU/N7wxJluFo5+6XUMB8GA1UdIwQYMBaAFCstgj5Ecm3HU/N7wxJluFo5
++6XUMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgGGMA0GCSqGSIb3DQEB
+CwUAA4IBAQCWibvYuPLpoNcsUdHbE7SnBbEQnDfBxBZN8xeWHwwAPEB+8eHhmIdZ
+xDtCN61xr5QR+KzlEYFwKyHMp9GN3OPU1RndJrzaXz2ddAZVkBIvnQZ4JvFd+sBC
+QQgEvL8GcwZPxnad/TRylM4ON3Kh0X9vfyrmWEoHephiE1LcENaFqcYr9xg3DJNh
+XSrigMGZJ7IOHkvgaoneICOcYI42ZHS0fnt1G+01VKJXm3ndi5NL25GnOmlvV6yV
++1vcmdQc6YS8K8vHmrH4lX9iPfsOak6WSzzsXdqgpvyxtGJggcFaDTtmbWCAkJj0
+B7DMeaVlLClGQaKZZ7aexEx9se+IyLn2
+-----END CERTIFICATE-----
\ No newline at end of file
diff --git a/src/security/builtin_plugins/tests/validate_local_identity/src/validate_local_identity_utests.c b/src/security/builtin_plugins/tests/validate_local_identity/src/validate_local_identity_utests.c
new file mode 100644
index 0000000..b4c7067
--- /dev/null
+++ b/src/security/builtin_plugins/tests/validate_local_identity/src/validate_local_identity_utests.c
@@ -0,0 +1,2109 @@
+/** @file qos_utests.c
+ *  @brief Unit tests for qos APIs
+ *
+ */
+/* CUnit includes. */
+#include <stdio.h>
+#include <string.h>
+#include "dds/ddsrt/environ.h"
+#include "CUnit/CUnit.h"
+#include "CUnit/Test.h"
+#include "assert.h"
+
+
+/* Test helper includes. */
+#include "common/src/loader.h"
+
+
+#include "dds/security/dds_security_api.h"
+#include <openssl/opensslv.h>
+#include <dds/ddsrt/heap.h>
+#include <dds/ddsrt/string.h>
+#include <config_env.h>
+
+static const char * PROPERTY_IDENTITY_CA                = "dds.sec.auth.identity_ca";
+static const char * PROPERTY_PRIVATE_KEY                = "dds.sec.auth.private_key";
+static const char * PROPERTY_PASSWORD                   = "dds.sec.auth.password";
+static const char * PROPERTY_IDENTITY_CERT              = "dds.sec.auth.identity_certificate";
+static const char * PROPERTY_TRUSTED_CA_DIR              = "dds.sec.auth.trusted_ca_dir";
+
+static const char *identity_certificate_filename = "identity_certificate";
+static const char *identity_certificate =
+        "data:,-----BEGIN CERTIFICATE-----\n"
+        "MIIEQTCCAymgAwIBAgIINpuaAAnrQZIwDQYJKoZIhvcNAQELBQAwXzELMAkGA1UE\n"
+        "BhMCTkwxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdp\n"
+        "ZGdpdHMgUHR5IEx0ZDEYMBYGA1UEAxMPQ0hBTTUwMCByb290IGNhMCAXDTE3MDIy\n"
+        "MjIyMjIwMFoYDzIyMjIwMjIyMjIyMjAwWjBcMQswCQYDVQQGEwJOTDETMBEGA1UE\n"
+        "CBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRk\n"
+        "MRUwEwYDVQQDEwxDSEFNNTAwIGNlcnQwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAw\n"
+        "ggEKAoIBAQDCpVhivH/wBIyu74rvQncnSZqKyspN6CvD1pmV9wft5PHhVt9jV79v\n"
+        "gSub5LADoRHAgFdv9duYgBr17Ob6uRrIY4B18CcrCjhQcC4gjx8y2jl9PeYm+qYD\n"
+        "3o44FYBrBq0QCnrQgKsb/qX9Z+Mw/VUiw65x68W876LEHQQoEgT4kxSuagwBoVRk\n"
+        "ePD6fYAKmT4XS3x+O0v+rHESTcsKF6yMadgp7h3eH1b8kJTzSx8JV9Zzq++mxjox\n"
+        "qhbBVP5nDze2hhSIeCkCvSrx7efkgKS4AQXa5/Z44GiAu1TfXXUqdic9rxwD0edn\n"
+        "ajNElnZe7sjok/0yuqvH+2hSqpNva/zpAgMBAAGjggEAMIH9MAwGA1UdDwQFAwMH\n"
+        "/4AwgewGA1UdJQSB5DCB4QYIKwYBBQUHAwEGCCsGAQUFBwMCBggrBgEFBQcDAwYI\n"
+        "KwYBBQUHAwQGCCsGAQUFBwMIBgorBgEEAYI3AgEVBgorBgEEAYI3AgEWBgorBgEE\n"
+        "AYI3CgMBBgorBgEEAYI3CgMDBgorBgEEAYI3CgMEBglghkgBhvhCBAEGCysGAQQB\n"
+        "gjcKAwQBBggrBgEFBQcDBQYIKwYBBQUHAwYGCCsGAQUFBwMHBggrBgEFBQgCAgYK\n"
+        "KwYBBAGCNxQCAgYIKwYBBQUHAwkGCCsGAQUFBwMNBggrBgEFBQcDDgYHKwYBBQID\n"
+        "BTANBgkqhkiG9w0BAQsFAAOCAQEAawdHy0Xw7nTK2ltp91Ion6fJ7hqYuj///zr7\n"
+        "Adt6uonpDh/xl3esuwcFimIJrJrHujnGkL0nLddRCikmnzuBMNDWS6yq0/Ckl/YG\n"
+        "yjNr44dlX24wo+MVAgkj3/8CyWDZ3a8kBg9QT3bs2SqbjmhTrXN1DRyf9S5vJysE\n"
+        "I7V1gTN66BeKL64hOrAlRVrEu8Ds6TWL6Q/YH+61ViZkoLTeSaPjH4nknaFr4C35\n"
+        "iji0JhkyfRHRRVPHFnaj25AkxOrSV64qVKoTMjDl5fji5iMGtjm6iJ7q05ml/qDl\n"
+        "nLotHXemZNvYhbwUmRzbt4Dls9EMH4VRbP85I94nM5TAvtHVNA==\n"
+        "-----END CERTIFICATE-----\n";
+
+static const char *identity_ca_filename = "identity_ca";
+static const char *identity_ca =
+        "data:,-----BEGIN CERTIFICATE-----\n"
+        "MIIEmTCCA4GgAwIBAgIIZ5gEIUFhO5wwDQYJKoZIhvcNAQELBQAwXzELMAkGA1UE\n"
+        "BhMCTkwxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdp\n"
+        "ZGdpdHMgUHR5IEx0ZDEYMBYGA1UEAxMPQ0hBTTUwMCByb290IGNhMCAXDTE4MDIx\n"
+        "MjE1MDUwMFoYDzIyMjIwMjIyMjIyMjAwWjBfMQswCQYDVQQGEwJOTDETMBEGA1UE\n"
+        "CBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRk\n"
+        "MRgwFgYDVQQDEw9DSEFNNTAwIHJvb3QgY2EwggEiMA0GCSqGSIb3DQEBAQUAA4IB\n"
+        "DwAwggEKAoIBAQC6Fa3TheL+UrdZCp9GhU/2WbneP2t/avUa3muwDttPxeI2XU9k\n"
+        "ZjBR95mAXme4SPXHk5+YDN319AqIje3oKhzky/ngvKH2GkoJKYxWnuDBfMEHdViz\n"
+        "2Q9/xso2ZvH50ukwWa0pfx2/EVV1wRxeQcRd/UVfq3KTJizG0M88mOYvGEAw3LFf\n"
+        "zef7k1aCuOofQmBvLukUudcYpMzfyHFp7lQqU4CcrrR5RtmfiUfrWfdGLea2iPDB\n"
+        "pJgN8ESOMwEHtOTEBDclYnH9L4t7CHQz+fXXS5IWFsDK9fCMQjnxDsDVeNrNzTYL\n"
+        "FaZrMg9S6IUQCEsQWsnq5weS8omOpVLUm9klAgMBAAGjggFVMIIBUTAMBgNVHRME\n"
+        "BTADAQH/MB0GA1UdDgQWBBQg2FZB/j8uWDVnJhjwXkX278znSTAfBgNVHSMEGDAW\n"
+        "gBQg2FZB/j8uWDVnJhjwXkX278znSTAPBgNVHQ8BAf8EBQMDB/+AMIHvBgNVHSUB\n"
+        "Af8EgeQwgeEGCCsGAQUFBwMBBggrBgEFBQcDAgYIKwYBBQUHAwMGCCsGAQUFBwME\n"
+        "BggrBgEFBQcDCAYKKwYBBAGCNwIBFQYKKwYBBAGCNwIBFgYKKwYBBAGCNwoDAQYK\n"
+        "KwYBBAGCNwoDAwYKKwYBBAGCNwoDBAYJYIZIAYb4QgQBBgsrBgEEAYI3CgMEAQYI\n"
+        "KwYBBQUHAwUGCCsGAQUFBwMGBggrBgEFBQcDBwYIKwYBBQUIAgIGCisGAQQBgjcU\n"
+        "AgIGCCsGAQUFBwMJBggrBgEFBQcDDQYIKwYBBQUHAw4GBysGAQUCAwUwDQYJKoZI\n"
+        "hvcNAQELBQADggEBAKHmwejWRwGE1wf1k2rG8SNRV/neGsZ6Qfqf6co3TpR/Wi1s\n"
+        "iZDvSeT/rbqNBS7z34xnG88NIUwu00y78e8Mfon31ZZbK4Uo7fla9/D3ukdJqPQC\n"
+        "LKdbKJjR2kH+KCukY/1rghjJ8/X+t2egBit0LCOdsFCl07Sfksb9kpGUIZSFcYYm\n"
+        "geqhjhoNwxazzHiw+QWHC5HG9248JIizBmy1aymNWuMnPudhjHAnPcsIlqMVNq3t\n"
+        "Rv9ap7S8JeCxHVRPJvJeCwXWvW3dW/v3xH52Yn/fqRblN1w9Fxz5NhopKx0gj/Jd\n"
+        "sw2N4Fk4gaOWEolFpa0bwNw8nAx7moehZpowzfw=\n"
+        "-----END CERTIFICATE-----\n";
+
+static const char *private_key_filename = "private_key";
+static const char *private_key_pem =
+        "data:,-----BEGIN RSA PRIVATE KEY-----\n"
+        "MIIEogIBAAKCAQEAwqVYYrx/8ASMru+K70J3J0maisrKTegrw9aZlfcH7eTx4Vbf\n"
+        "Y1e/b4Erm+SwA6ERwIBXb/XbmIAa9ezm+rkayGOAdfAnKwo4UHAuII8fMto5fT3m\n"
+        "JvqmA96OOBWAawatEAp60ICrG/6l/WfjMP1VIsOucevFvO+ixB0EKBIE+JMUrmoM\n"
+        "AaFUZHjw+n2ACpk+F0t8fjtL/qxxEk3LChesjGnYKe4d3h9W/JCU80sfCVfWc6vv\n"
+        "psY6MaoWwVT+Zw83toYUiHgpAr0q8e3n5ICkuAEF2uf2eOBogLtU3111KnYnPa8c\n"
+        "A9HnZ2ozRJZ2Xu7I6JP9Mrqrx/toUqqTb2v86QIDAQABAoIBAC1q32DKkx+yMBFx\n"
+        "m32QiLUGG6VfBC2BixS7MkMnzRXZYgcuehl4FBc0kLRjfB6cqsO8LqrVN1QyMBhK\n"
+        "GutN3c38SbE7RChqzhEW2+yE+Mao3Nk4ZEecHLiyaYT0n25ZtHAVwep823BAzwJ+\n"
+        "BykbM45VEpNKbG1VjSktjBa9faNyZiZAEJEjVyla+6R8N4kHV52LbZcLjvJv3IQ2\n"
+        "iPYRrmMyI5C23qTni0vy7yJbAXBo3CqgSlwie9FARBWT7Puu7F4mF1O1c/SnTysw\n"
+        "Tm3e5FzgfHipQbnRVn0w4rDprPMKmPxMnvf/Wkw0zVgNadp1Tc1I6Yj525DEQ07i\n"
+        "2gIn/gECgYEA4jNnY1u2Eu7x3pAQF3dRO0x35boVtuq9iwQk7q+uaZaK4RJRr+0Y\n"
+        "T68S3bPnfer6SHvcxtST89Bvs/j/Ky4SOaX037UYjFh6T7OIzPl+MzO1yb+VOBT6\n"
+        "D6FVGEJGp8ZAITU1OfJPeTYViUeEC8tHFGoKUCk50FbB6jOf1oKtv/ECgYEA3EnB\n"
+        "Y7kSbJJaUuj9ciFUL/pAno86Cim3VjegK1wKgEiyDb610bhoMErovPwfVJbtcttG\n"
+        "eKJNuwizkRcVbj+vpjDvqqaP5eMxLl6/Nd4haPMJYzGo88Z8NJpwFRNF2KEWjOpQ\n"
+        "2NEvoCeRtVulCJyka2Tpljzw8cOXkxhPOe2UhHkCgYBo3entj0QO7QXm56T+LAvV\n"
+        "0PK45xdQEO3EuCwjGAFk5C0IgUSrqeCeeIzniZMltj1IQ1wsNbtNynEu3530t8wt\n"
+        "O7oVyFBUKGSz9IjUdkpClJOPr6kPMfJoMqRPtdIpz+hFPPSrI6IikKdVWHloOlp+\n"
+        "pVaYqTQrWT1XRY2xli3VEQKBgGySmZN6Cx+h/oywswIGdUT0VdcQhq2to+QFpJba\n"
+        "VX6m1cM6hMip2Ag9U3qZ1SNPBBdBBfm9HQybHE3dj713/C2wHuAAGhpXIM1W+20k\n"
+        "X1knuC/AsSH9aQhQOf/ZMOq1crTfZBuI9q0782/sjGmzMsKPySU4QhUWruVb7OiD\n"
+        "NVkZAoGAEvihW7G+8/iOE40vGHyBqUeopAAWLciTAUIEwM/Oi3BYfNWNTWF/FWNc\n"
+        "nMvCZPYigY8C1vO+1iT2Frtd3CIU+f01Q3fJNJoRLlEiKLNZUJRF48OKUqjKSmsi\n"
+        "w6pucFO40z05YW7utApj4L82rZnOS0pd1tUI1yexqvj0i4ThJfk=\n"
+        "-----END RSA PRIVATE KEY-----\n";
+
+static const char *unrelated_identity_ca_filename = "unrelated_identity_ca";
+static const char *unrelated_identity_ca =
+        "data:,-----BEGIN CERTIFICATE-----\n"
+        "MIIDpDCCAoygAwIBAgIJALE5lRKfYHAaMA0GCSqGSIb3DQEBCwUAMF8xCzAJBgNV\n"
+        "BAYTAk5MMRMwEQYDVQQIDApPdmVyaWpzc2VsMRAwDgYDVQQHDAdIZW5nZWxvMQ8w\n"
+        "DQYDVQQKDAZBRExJTksxGDAWBgNVBAMMD0NIQU01MDAgUm9vdCBDQTAeFw0xODAy\n"
+        "MDkxNjIwNDNaFw0zODAyMDQxNjIwNDNaMF8xCzAJBgNVBAYTAk5MMRMwEQYDVQQI\n"
+        "DApPdmVyaWpzc2VsMRAwDgYDVQQHDAdIZW5nZWxvMQ8wDQYDVQQKDAZBRExJTksx\n"
+        "GDAWBgNVBAMMD0NIQU01MDAgUm9vdCBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEP\n"
+        "ADCCAQoCggEBAN9/NbpJDHQYHh3cEByRxnHffxEe9Sapn08Ty5xYO8LDJ4V7vU32\n"
+        "/7291fITiHaovOoCRHAbKTaTtqJO56aGY45HON6KIqxljLQJJVGW/Nf2PNSHmFix\n"
+        "6D6bsoSOTPyKYqBNT6lB7NMn4QBTcsiE61El8p9WLQZHoYQJK5Psf7wkBqGBz8he\n"
+        "bcDWXFn7kIgnsaLrh77w2wi/y0MqpPwyeRInoZfYknzVNdxCPgq7csBYDoMgOgkV\n"
+        "G60ECXojHKz1HI4n0V8L8lZluSSVRNR0xvPFgBqO7b+Re7xb6iO9TNsFeoiMMNyp\n"
+        "EwM99CqPO0RRrAPiC7IDgcNGjxhne9EJFGsCAwEAAaNjMGEwHQYDVR0OBBYEFCst\n"
+        "gj5Ecm3HU/N7wxJluFo5+6XUMB8GA1UdIwQYMBaAFCstgj5Ecm3HU/N7wxJluFo5\n"
+        "+6XUMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgGGMA0GCSqGSIb3DQEB\n"
+        "CwUAA4IBAQCWibvYuPLpoNcsUdHbE7SnBbEQnDfBxBZN8xeWHwwAPEB+8eHhmIdZ\n"
+        "xDtCN61xr5QR+KzlEYFwKyHMp9GN3OPU1RndJrzaXz2ddAZVkBIvnQZ4JvFd+sBC\n"
+        "QQgEvL8GcwZPxnad/TRylM4ON3Kh0X9vfyrmWEoHephiE1LcENaFqcYr9xg3DJNh\n"
+        "XSrigMGZJ7IOHkvgaoneICOcYI42ZHS0fnt1G+01VKJXm3ndi5NL25GnOmlvV6yV\n"
+        "+1vcmdQc6YS8K8vHmrH4lX9iPfsOak6WSzzsXdqgpvyxtGJggcFaDTtmbWCAkJj0\n"
+        "B7DMeaVlLClGQaKZZ7aexEx9se+IyLn2\n"
+        "-----END CERTIFICATE-----\n";
+
+static const char *invalid_identity_certificate_filename = "invalid_identity_certificate";
+static const char *invalid_identity_certificate =
+        "data:,-----BEGIN CERTIFICATE-----\n"
+        "MIIDNzCCAh8CCQDn8i4K9c4ErDANBgkqhkiG9w0BAQsFADBfMQswCQYDVQQGEwJO\n"
+        "TDETMBEGA1UECAwKU29tZS1TdGF0ZTEhMB8GA1UECgwYSW50ZXJuZXQgV2lkZ2l0\n"
+        "cyBQdHkgTHRkMRgwFgYDVTQDDA9DSEFNNTAwIHJvb3QgY2EwHhcNMTgwMjEyMTUw\n"
+        "NjUxWhcNMTkwNjI3MTUwNjUxWjBcMQswCQYDVQQGEwJOTDETMBEGA1UECAwKU29t\n"
+        "ZS1TdGF0ZTEhMB8GA1UECgwYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMRUwEwYD\n"
+        "VQQDDAxDSEFNNTAwIGNlcnQwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB\n"
+        "AQDRnnNnV3PZrbZwjxk+dkQcO3pK3wMvoDNAHPPiTfXRV2KjLHxsuK7wV+GPHmXo\n"
+        "97bot6vBxNQN7hfxoDLL+KBO9s3V+8OX6lOrF7hQ6+6/p9EgRoyNGo21eIzGwc2M\n"
+        "aJAKjImNMbM7FDTvhk3u+VTTJtlnKvJM1tgncbEZwRLri/2MEC5XS/O5FQT4AXPr\n"
+        "A6bRcGMqCVYtQ0ci6wd18PegA/rSmGSRf/TOd4jZXkxfHD+YOkHcxxz9sX4KnyOg\n"
+        "XZm8jDdBc7rxiDep8kIjL06VszJeoQrxjuf8cNZtbol/7ECS5aM2YOx7t0Dc/629\n"
+        "V2Q5waRVBV5xVCJ0BzUh8rIFAgMBAAEwDQYJKoZIhvcNAQELBQADggEBAGlkxYLr\n"
+        "ZI/XNjDC6RFfSFRoDc+Xpcg+GsJKKbw2+btZvAD8z7ofL01yGru9oi6u2Yy/ZDKT\n"
+        "liZ+gtsD8uVyRkS2skq7BvPzvoYErLmSqwlrcCbeX8uHiN7C76ll9PFtSjnwPD//\n"
+        "UaNyZM5dJB2eBh4/prclix+RR/FWQzkPqEVLwMcFBmnPZ0mvR2tncjpZq476Qyl9\n"
+        "3jcmfms9qBfBPPjCdXqGEDgsTd2PpYRD2WDj/Ctl4rV7B2jnByullLUYIWGu0rYt\n"
+        "988waU5i8ie4t/TorBBLqQo/NO9jSXfEqcAnILPnv1QZanKzAAxSg7+FgFrsn359\n"
+        "ihiEkx9zFUnPrdA=\n"
+        "-----END CERTIFICATE-----\n";
+
+static const char *invalid_identity_ca_filename = "invalid_identity_ca";
+static const char *invalid_identity_ca =
+        "data:,-----BEGIN CERTIFICATE-----\n"
+        "MIIDljCCAn6gAwIBAgICEAAwDQYJKoZIhvcNAQELBQAwXzELMAkGA1UEBhMCTkwx\n"
+        "EzARBgNVBAgMCk92ZXJpanNzZWwxEDAOBgNVBAcMB0hlbmdlbG8xDzANBgNVBAoM\n"
+        "BkFETElOSzEYMBYGA1UEAwwPQ0hBTTUwMCBSb290IENBMB4XDTE4MDIwOTE2Mjky\n"
+        "MVoXDTI4MDIwNzE2MjkyMVowVTELMAkGA1UEBhMCTkwxEzARBgNVBAgMCk92ZXJp\n"
+        "anNzZWwxDzANBgNVBAoMBkFETElOSzEgMB4GA1UEAwwXQ0hBTTUwMCBJbnRlcm1l\n"
+        "ZGlhdGUgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCwucuU/L6N\n"
+        "iYxYJ7tyzcdzwXwYbr4GynZE4u2Sd7hcXrQGxTotm9BEhOZWscSGvH+UJSp0Vrb4\n"
+        "3zDppiJ76ys6PeSBw1PpxdO97fO+eAE5DoXRj0a9lmnjbsV6waZ2GxgYQNVmKqbI\n"
+        "uPDfW+jsmRcTO94s05GWQshHeiqxuEUAv3/Qe2vOhulrg4YDcXrIDWK93cr1EmRX\n"
+        "Eq3Ck+Fjwtk5wAk3TANv2XQkVfS80jYAurL8J+XC2kyYB7e8KO92zqlfVXXMC3NI\n"
+        "YDcq86bAI4NNMjVE2zIVheMLoOEXaV7KUTYfEQABZl76aWLDxjED9kf371tcrZzJ\n"
+        "6xZ1M/rPGNblAgMBAAGjZjBkMB0GA1UdDgQWBBQngrlZqhQptCR4p04zqHamYUx7\n"
+        "RTAfBgNVHSMEGDAWgBQrLYI+RHJtx1Pze8MSZbhaOful1DASBgNVHRMBAf8ECDAG\n"
+        "AQH/AgEAMA4GA1UdDwEB/wQEAwIBhjANBgkqhkiG9w0BAQsFAAOCAQEAfMmiQ0tv\n"
+        "o3K3xwSS621tsfkijUTx920hAe1XYY2XKrG7a/MJBhStex5A3AfqPOY9UMihkBl9\n"
+        "3hgxOaddX9SAf2eLk2JLhqxZi1U/GVzT5h10AKLA5WUXIK4UGz3JRqhEm7V39t/N\n"
+        "G0LCdpWOZueezkfO6eGcAvOKthdd32a3zbn+rzzDHdsjzxhEEv8d8x1Xf4xH2dgk\n"
+        "HlpmpvXMfG/1aCzIpWGEPdkB7WR694GiCmh7hnFBiY+h1GFj2l5dThd51QqAlncM\n"
+        "u+NmlPCrFZL0ulwRFeo80KOwDpxkqgavDlP9irdWqM9VHybjGu0xFHCeElz9M6od\n"
+        "ym/MCh4ax7jDxg==\n"
+        "-----END CERTIFICATE-----\n";
+
+static const char *identity_certificate_1024key =
+        "-----BEGIN CERTIFICATE-----\n"
+        "MIICrjCCAZYCCQDn8i4K9c4ErjANBgkqhkiG9w0BAQsFADBfMQswCQYDVQQGEwJO\n"
+        "TDETMBEGA1UECAwKU29tZS1TdGF0ZTEhMB8GA1UECgwYSW50ZXJuZXQgV2lkZ2l0\n"
+        "cyBQdHkgTHRkMRgwFgYDVQQDDA9DSEFNNTAwIHJvb3QgY2EwHhcNMTgwMjE2MTAy\n"
+        "MzM2WhcNMjMwODA5MTAyMzM2WjBXMQswCQYDVQQGEwJOTDETMBEGA1UECAwKU29t\n"
+        "ZS1TdGF0ZTEhMB8GA1UECgwYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMRAwDgYD\n"
+        "VQQDDAdDSEFNNTY5MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDS5w0h8L70\n"
+        "hkreKchVbTzfz4CrBLY4iADNSqPx9uW7DxjeHyLbKT2eRViY/xPuPXQmfRim01QM\n"
+        "sZWKvFr6k9WMsJ6ItNtCyKS/beONqvXOddIu+4IhNzEGs5v4pTJAOzraoZcVmXnf\n"
+        "Mr9G/baMYfMG47JR5HaSHDI5esa2STHt4wIDAQABMA0GCSqGSIb3DQEBCwUAA4IB\n"
+        "AQBdZ2ijHYH8TkOGBqzsNwnNwPaDb/NA0vAO9T5kSOm8HA8vKHnNza+DeUJN+5P/\n"
+        "P4fLK7UZqpQN32MpvXL0068g99RLjAzAsEVn+0FTyc08r9p/KO/dxxdMKeET7Cpv\n"
+        "rMpu3W0A/EJptCQsTEZI0iqts7T2qQVXzoDlnUwEt3xdmKYJ9jbEq1UUCeexD3nP\n"
+        "LB+JtUtfGevVzIoBjHv0qA3ePA24jDUlx5bxFeoIDC4tEewvUG5ZekftsRdNe3fk\n"
+        "3LkwyK+4NN1ZCa2+S5SOAfjZA2o6qXiq/le0vWRgl7AHEgDr6w7xoRsw4K5dQ+0R\n"
+        "eKtsBC4XO1GqrNYdKuJb1MhI\n"
+        "-----END CERTIFICATE-----\n";
+
+static const char *invalid_private_key_filename = "invalid_private_key";
+static const char *invalid_private_key =
+        "data:,-----BEGIN RSA PRIVATE KEY-----\n"
+        "MIIEowIBAAKCAQEA0Z5zZ1dz2a22cI8ZPnZEHDt6St8DL6AzQBzz4k310Vdioyx8\n"
+        "bLiu8Ffhjx5l6Pe26LerwcTUDe4X8aAyy/igTvbN1fvDl+pTqxe4UOvuv6fRIEaM\n"
+        "jRqNtXiMxsHNjGiQCoyJjTGzOxQ074ZN7vlU0ybZZyryTNbYJ3GxGcES64v9jBAu\n"
+        "V0vzuRUE+AFz6wOm0XBjKglWLUNHIusHdfD3oAP60phkkX/0zneI2V5MXxw/mDpB\n"
+        "3Mcc/bF+Cp8joF2ZvIw3QXO68Yg3qfJCIy9OlbMyXqEK8Y7n/HDWbW6Jf+xAkuWj\n"
+        "NmDse7dA3P+tvVdkOcGkVQVecVQidAc1IfKyBQIDAQABAoIBAEddUpzUQTTS11Hq\n"
+        "5gVF7lpORYxH8KW+PLSPJtjdAduLjKAQ++tn1OcuhDRdfQSbkUIZhfgqMqerb6tr\n"
+        "ht+6fZlknR9E34pQ1LtjD/U83cOSNrhuTFudtrEZoZPpVzl+P8vXnNzdFs/+SSdi\n"
+        "6hV5/U8F4u4kyOkwG9cR9eF2wiI+oQ/RBKCXUo3OVs9K27A/OkKsb7coL7yBsgBj\n"
+        "lzorS9a/DyHT2eiMKjwCZFyG4A66EkLi6t9JLJ8oTkI2WskXYeVEAbEXE57RWm44\n"
+        "2OgTgfsgYgf2ftXq93KD17FN1m77dqp7EPAhjGnRHNq7+0Ykr1EO1nbDfqHG4gS+4o\n"
+        "lfP8iwECgYEA58da0R34l93yQnK0mAtoobwvsOjADnBVhBg9L4s2eDs8liUjf0zt\n"
+        "7hcMdUJaa7iMuNf3qGtnZtRURc3kSOE429Or7fCAYUr/AaA7+2ekPG1vjMb50tVv\n"
+        "se5rwb1hvgMYe2L5ktJJAg+RcmqpY+ncJ+hP/vWwZRxUKvXba50qqEkCgYEA54ZE\n"
+        "mJfSueGM/63xlhP71CM4OWtTqkQGp2OmgTOsBI5q/GUXr8vMR8sCEMHAc6HyXzmL\n"
+        "x/RnAoa/vTX58rXBk0QjfO9esIHa452697EIaJu5w8skCLDv2e/f+Jg7o/IDyUZs\n"
+        "5lqhiEuH9Qc3sx2nhnSYXMZWqwh8OchI7dCSE90CgYEAzrJ1JhpxUJYI7wM2VIWQ\n"
+        "GPQnH8BhTj8VtEidgCHJQK2rGUcjgepMIVECtiunUXtyW4GWBedKfmSKhvnXRLs9\n"
+        "pqT9JaOeCaYFBiEsfMZvqUY4e/YSYtge1PIHvO40FWzTT23zneDUZPcXQY8nYsfy\n"
+        "otBFTt0yIumBkhJRTIYLvakCgYA+CcttvBj6OAcJJ/n5RgeP05QoRqsXj7zcs6YV\n"
+        "LtxkKClg0lHjiE+H2U0HYnOISJfijk/3V3UWxzavo7wDHlLtfC+qNZYA4/rcTRKh\n"
+        "dm2TYk8HuPJB5e+PTWiNe3VXu+zpzRY3L4fjNqIKtVFmjIasT6fYDEmC8PYgoZtx\n"
+        "JhdOfQKBgCD/bDkc+VI6lwQtoQQKiSfQjKGe+6Cw9K/obzWO0uJwBvZrGLXF8tTc\n"
+        "MOPIv9OILt7DYxpMXAiHv8HtzH5CFVrZ/nj63Soka/j2yvUdBDrGhyIbsc4pDu+\n"
+        "lCFa0ZiT/u5vRAiOkM6GuStH4HxnW9LtwBtiYXtfU7IPExJiAlsq\n"
+        "-----END RSA PRIVATE KEY-----\n";
+
+static const char *private_key_1024 =
+        "data:,-----BEGIN RSA PRIVATE KEY-----\n"
+        "MIICXAIBAAKBgQDS5w0h8L70hkreKchVbTzfz4CrBLY4iADNSqPx9uW7DxjeHyLb\n"
+        "KT2eRViY/xPuPXQmfRim01QMsZWKvFr6k9WMsJ6ItNtCyKS/beONqvXOddIu+4Ih\n"
+        "NzEGs5v4pTJAOzraoZcVmXnfMr9G/baMYfMG47JR5HaSHDI5esa2STHt4wIDAQAB\n"
+        "AoGAQi7LijkYU3fJCsql2Vj8X2eogwJphHf5eHLR296U3QyxyxKOR6Q7d+1fDjQN\n"
+        "txeF2YYsND3hBFK+ENlm23eE7Z1tpWtnLNJ9OH84ZkPnqTnEcWsRddT/x9vKOPMz\n"
+        "eK8QNetD3AP5qXsjpIpgep1diWYHCyhMTAFISzvdtC7pvFECQQD2zoqwRtF26lzg\n"
+        "QPR02Z+L80R2VhpeLoqMIplT1bmlrPlDr/eIwvtu1eQFyGSASG2EFs1rucdJl7qu\n"
+        "SrJ+eyv1AkEA2sIjy8+RCk1uH8kEwYaMJ3dccqnpcMCZ1b3GncKl+ICmDCYcpfd5\n"
+        "rP5tX+GL3RVw370pUApJvrVTgOpAVHYjdwJAOYz8BhLdcS9BLQG4fy7n50h4pGd7\n"
+        "io6ru/Wtb0EdIybskP4NaJSe8L9rhnWuCcPZ1b1DdWVCtURuQYoliRzLqQJBAJWO\n"
+        "ZrSfKpS1jRVT89lu6ADPXLfTrBH2yvVS8ifG/HshUOQ7ZhidUWVQ6GvFoj46u1lr\n"
+        "VIQxFGu6QeV/wQ09W08CQHGkrZgu/FpS2tNvYmKNDHOna+dW452N5N81u5sRP1A8\n"
+        "x9pYC9xoOGE2E8v1ocMJDPoMe0yk1QSX9mjhhwYOy28=\n"
+        "-----END RSA PRIVATE KEY-----\n";
+
+static const char *private_key_w_password_filename = "private_key_w_password";
+static const char *private_key_w_password =
+        "data:,-----BEGIN RSA PRIVATE KEY-----\n"
+        "Proc-Type: 4,ENCRYPTED\n"
+        "DEK-Info: AES-256-CBC,0C9C38C5678AECD200E024A9A5BC717A\n"
+        "\n"
+        "wbXYsR78o4DIaQbKsB4cwEFge79GMKbcMgIWK+9k86dPk09WZkj7JCSJXIxPLYOG\n"
+        "tFZrw/z86cakEhf90a4Moa1cwByrcFB+bpWoEqsx/C4javWxXMENbmQ5x8gDpmzT\n"
+        "qqLI7xnd2mYj7HcfE7eXi+Nub5w1tBxN0CWaxpR54ZVvfcPE6Od4SHGughdUN4AK\n"
+        "OdVIq5YuzMhuTDJKy+kGOtjH8pBWvo8S12T2UQEuusx5WUbEJ6m+E80aN7M6gCA+\n"
+        "XmNTt3PsV9PfZPL2Off/90gqTBdMhwn+sEVlqYG0TAnXZQEI8ZNtAGy77CFplqdT\n"
+        "SmI3x8Sza7lchEMFhRiayX9pMBPUlwckVPrCoMQ4b4WkHYoGLO7dNVAA8Osud46+\n"
+        "6MZKHStjdzwKz9MzWa7lXhXV+0sX5bcAzQexuE+wO8QQ/t5uwDmQHol0JVdRX8NB\n"
+        "/Exk6aT7mWajFvukXVirpUGWnEK2W+O8/VBzVZ7z69EjZ09Pu4Y/+cbX12LGSwMb\n"
+        "WVtnZY6BsrV++vikQuL3ByTBDPRHio2H8hThh1Kv8n5VEBUrk7tLUp3Z15cbfC6s\n"
+        "LDHX6kB2OKmmdqLOOMo4lToZfnrVK/dzeXFbtNH1POpR4/e5Nk0SyZrWo+E/AqIv\n"
+        "nLQ3fhLCPOB5rjAhuM8iXOwqn8HHNlv9j8mlgCcgwK7focYVc/IXARLOfFOjOA/s\n"
+        "EqMRbb/eKsC930NHBZkhlqRJKCwA37AMvnOhN4R0VOq/40K+62IUK9E1643KyWs0\n"
+        "vWk0rFY0OKorQXzI33lbBYZ5zHt8oxGNx3us+6jGP85iv8UEaO6FpgajEUn6Gzp/\n"
+        "wyvr1C/B/Hfr6eTbt4C6Fi5fMfZgM6VEcJuaFZnoC9tWdhlNsY1pwtPghMM7yBwc\n"
+        "1Ye0TxdF36exJWu1gXVTse1Vdc9i4QWpT2fbPQtcIgdtNk01K+2defie384IOnQQ\n"
+        "O8/SRsrnLRLV3IDFh/VBJS1ZVm8Zmt10yGgRwtYHntMkIopoFRWcm9/Gh3iBFKKH\n"
+        "OTVXxgKOUYk4qXG61N8k0M+TIdoOHZIha3Myis1tQVmA/b/4FRKPYgdrFijhXNLM\n"
+        "wwMHQOS14xBF2KBgaak7dMUWhGrClw1hc3HmMXuM+OLvxy+f8MC3JP2U5AuCs472\n"
+        "hc41KWxioqNMPVXZgVnHf3aEec+hBFceqYnlzG+E/Gagiufu8WMySaZgzXMRb5aV\n"
+        "x2OVcakSKrTC5EKbLDlZ6+1NRJht7wdSefh0o/Crc9LzcFqBL0Qp3WCvyY8gDVkQ\n"
+        "EGqoVYOE6Hz/NX5/17F1+5VuWT7nBWABHKFFriOoJ3VR9sZhp0HiMznZEF1AwVuZ\n"
+        "xHtDWQemfBywEQG23qbr+o7mQASh1zki8b4fP1HQmbHhaJarjwGdiVNIgcF7s7Qk\n"
+        "NYNcgsc1l0KuNHvredTnYwPhv3C08IBfjtd2H9u0A+AWl5RlR4GDfv2Jzbe/F8U+\n"
+        "0gxj8D2XWHlkbHIXKVk6jxj64xyNE1xB0Sv7gsDWpkaK6aw/zdsyxqiji4mThcYE\n"
+        "cRSl4y9CGZREaiyD8dk/uiqKfQ26c1gfOUDYS2fKjH5NKh4J80wQj0GvS6nHiDH4\n"
+        "-----END RSA PRIVATE KEY-----\n";
+
+static const char *private_key_password ="CHAM569";
+
+const char *ec_identity_certificate_filename = "ec_identity_certificate";
+const char *ec_identity_certificate =
+        "data:,-----BEGIN CERTIFICATE-----\n"
+  "MIICOzCCAeGgAwIBAgICEAAwCgYIKoZIzj0EAwIwZTELMAkGA1UEBhMCTkwxEzAR\n"
+  "BgNVBAgMClNvbWUtU3RhdGUxHzAdBgNVBAoMFkFETElOSyBUZWNobm9sb2d5IEIu\n"
+  "Vi4xIDAeBgNVBAMMF0NIQU1fNTcwIENBIGNlcnRpZmljYXRlMB4XDTE5MDIxODEw\n"
+  "NTI0MVoXDTQ2MDcwNjEwNTI0MVowazELMAkGA1UEBhMCTkwxEzARBgNVBAgMClNv\n"
+  "bWUtU3RhdGUxHzAdBgNVBAoMFkFETElOSyBUZWNobm9sb2d5IEIuVi4xJjAkBgNV\n"
+  "BAMMHUNIQU1fNTcwIElkZW50aXR5IGNlcnRpZmljYXRlMFkwEwYHKoZIzj0CAQYI\n"
+  "KoZIzj0DAQcDQgAEnbV79f5j2iTkDCbFMlVVs396YOoNViwKheBbhVoBG2n8I3mY\n"
+  "M9Zg1dmrHh16HsJfrTCbc0VAOdkH91mNRPZr46N7MHkwCQYDVR0TBAIwADAsBglg\n"
+  "hkgBhvhCAQ0EHxYdT3BlblNTTCBHZW5lcmF0ZWQgQ2VydGlmaWNhdGUwHQYDVR0O\n"
+  "BBYEFMZoftcgs1FL1FBUJhKGvpvqVaHqMB8GA1UdIwQYMBaAFHUuWr3OtGtMktK9\n"
+  "QnKSSydxn4ewMAoGCCqGSM49BAMCA0gAMEUCIQCyp777C9Tih7Asybj6ELAYS9xq\n"
+  "vFhV6CJGk9ixW1AXdwIgKs9CEPx+Ajk3RErPm6OaVcsVLRKGBn7UuCR6VxNItWk=\n"
+        "-----END CERTIFICATE-----\n";
+
+const char *ec_private_key_filename = "ec_private_key";
+const char *ec_private_key =
+        "data:,-----BEGIN PRIVATE KEY-----\n"
+  "MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQgP3SnBXzcCc0uUEiG\n"
+  "0CPNdcV0hBewOnVoh4d9q9E5U5ihRANCAASdtXv1/mPaJOQMJsUyVVWzf3pg6g1W\n"
+  "LAqF4FuFWgEbafwjeZgz1mDV2aseHXoewl+tMJtzRUA52Qf3WY1E9mvj\n"
+        "-----END PRIVATE KEY-----\n";
+
+static const char *ec_password ="CHAM-570";
+
+const char *ec_private_key_w_password_filename = "ec_private_key_w_password";
+const char *ec_private_key_w_password =
+        "data:,-----BEGIN EC PRIVATE KEY-----\n"
+  "Proc-Type: 4,ENCRYPTED\n"
+  "DEK-Info: AES-256-CBC,11055B75D406068EB1FF850646228EA9\n"
+        "\n"
+  "GUnwN8e2gvUkopN3ak+2dK1dSTSKSJguers3h5C+qQDq57By933ijCCjUTu2LY/F\n"
+  "ERH6m8UD6H5ij/QDsXLx6tH/dFQ7An+Zao3eD2N2zquGED/OfTQJFv3gBKs4RUtg\n"
+  "66dfuv9mNSXt7Rnu9uBNtodm5JGifczdmIPHn0mNY2g=\n"
+        "-----END EC PRIVATE KEY-----";
+
+const char *ec_identity_ca_filename = "ec_identity_ca";
+const char *ec_identity_ca =
+        "data:,-----BEGIN CERTIFICATE-----\n"
+  "MIICEDCCAbegAwIBAgIJAPOifu8ejrRRMAoGCCqGSM49BAMCMGUxCzAJBgNVBAYT\n"
+  "Ak5MMRMwEQYDVQQIDApTb21lLVN0YXRlMR8wHQYDVQQKDBZBRExJTksgVGVjaG5v\n"
+  "bG9neSBCLlYuMSAwHgYDVQQDDBdDSEFNXzU3MCBDQSBjZXJ0aWZpY2F0ZTAeFw0x\n"
+  "OTAyMTgxMDQwMTZaFw00NjA3MDYxMDQwMTZaMGUxCzAJBgNVBAYTAk5MMRMwEQYD\n"
+  "VQQIDApTb21lLVN0YXRlMR8wHQYDVQQKDBZBRExJTksgVGVjaG5vbG9neSBCLlYu\n"
+  "MSAwHgYDVQQDDBdDSEFNXzU3MCBDQSBjZXJ0aWZpY2F0ZTBZMBMGByqGSM49AgEG\n"
+  "CCqGSM49AwEHA0IABMXCYXBHEryADoYXMEE0Jw9aHlA7p3KVFzuypxuez0n7rKoX\n"
+  "k9kanNtrw5o2X4WSWKM7zkH4I6AU7xSAQgJN+8GjUDBOMB0GA1UdDgQWBBR1Llq9\n"
+  "zrRrTJLSvUJykksncZ+HsDAfBgNVHSMEGDAWgBR1Llq9zrRrTJLSvUJykksncZ+H\n"
+  "sDAMBgNVHRMEBTADAQH/MAoGCCqGSM49BAMCA0cAMEQCIHKRM3VeB2F7z3nJT752\n"
+  "gY5mNdj91ulmNX84TXA7UHNKAiA2ytpsV4OKURHkjyn1gnW48JDKtHGZF6/tMNvX\n"
+  "VrDITA==\n"
+        "-----END CERTIFICATE-----\n";
+
+
+const char *ec_identity_certificate_unsupported_filename = "ec_identity_certificate_unsupported";
+const char *ec_identity_certificate_unsupported =
+        "data:,-----BEGIN CERTIFICATE-----\n"
+        "MIICFTCCAbygAwIBAgICEAEwCgYIKoZIzj0EAwIwWjELMAkGA1UEBhMCTkwxEzAR\n"
+        "BgNVBAgMClNvbWUtU3RhdGUxITAfBgNVBAoMGEludGVybmV0IFdpZGdpdHMgUHR5\n"
+        "IEx0ZDETMBEGA1UEAwwKQ0hBTTUwMF9DQTAeFw0xODAyMTkxMDMyMjRaFw0xOTAy\n"
+        "MTkxMDMyMjRaMGExCzAJBgNVBAYTAk5MMRMwEQYDVQQIDApTb21lLVN0YXRlMSEw\n"
+        "HwYDVQQKDBhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQxGjAYBgNVBAMMEUNIQU01\n"
+        "NjkgdW5zdXAga2V5MEkwEwYHKoZIzj0CAQYIKoZIzj0DAQIDMgAEKt3HYPnDlEOS\n"
+        "zYqTzT2patyreLHN2Jty22KXwjaNAjgrwujdPr+MW38DsyBF5Yn9o3sweTAJBgNV\n"
+        "HRMEAjAAMCwGCWCGSAGG+EIBDQQfFh1PcGVuU1NMIEdlbmVyYXRlZCBDZXJ0aWZp\n"
+        "Y2F0ZTAdBgNVHQ4EFgQUG9MuQz3W/AKA98AyOKhI2af9I+0wHwYDVR0jBBgwFoAU\n"
+        "ACsYsaEsZfjfRVrj0IBmcsncVyMwCgYIKoZIzj0EAwIDRwAwRAIgfhisahVmgghI\n"
+        "GaaQavdKHpM/OTVODZPzYjky6Am+z08CIBidnuuznXrZtr78oy/tAES/7Lz8P5Iw\n"
+        "Q1y5Vo8CdXQQ\n"
+        "-----END CERTIFICATE-----\n";
+
+const char *ec_private_key_unsupported_filename = "ec_private_key_unsupported";
+const char *ec_private_key_unsupported =
+        "data:,-----BEGIN PRIVATE KEY-----\n"
+        "MG8CAQAwEwYHKoZIzj0CAQYIKoZIzj0DAQIEVTBTAgEBBBh8p6kwBS7jT86ctN33\n"
+        "Vs4vosHh7upPZBWhNAMyAAQq3cdg+cOUQ5LNipPNPalq3Kt4sc3Ym3LbYpfCNo0C\n"
+        "OCvC6N0+v4xbfwOzIEXlif0=\n"
+        "-----END PRIVATE KEY-----\n";
+
+
+const char *private_key_not_matching_filename = "private_key_not_matching";
+const char *private_key_not_matching =
+        "data:,-----BEGIN RSA PRIVATE KEY-----\n"
+        "MIIEpgIBAAKCAQEAz90I7hABwJ27DQ0ypKEOlO8ZPoMKVMUAkTxl+48Icqo2SJxF\n"
+        "vKOxVd8XflJ2jor3YqzPgbuLVGolTafxzuGDYQVTNrSUgaCZMdX8O8UFxsBrQ+m9\n"
+        "0pJeg+1I0OHrn8Y7VHuh5IVHNqmqwsw9TA5aLjp1i9Gc9pvGzbXEfGfnol64bvht\n"
+        "p3k8xMG8DZKKJNg8GUcYlLvwY+jcE8yMvQzM+gya6Y7w1JVgj4wQNjWULgqTJlUq\n"
+        "q1Wch9o7/tp1wzX3E4B8AeTCEsYEL9tUASp6V6/4Yf/jbGM2/nfaczj8lW0Gez6a\n"
+        "xHkMBh22vqLzZvvOFTX6U46KG/iWZAehKdPJrwIDAQABAoIBAQDGvQsAsoU6aJSj\n"
+        "Ee9NwD903nZAcoG6MvEr65eGQWdOWre0DNYQWmH/PGH2AVohR3Tn/1oXK/03JJWt\n"
+        "/dkQeEVoyfKZ52Xl2mseXv3fF61CLk9gi2dWoWOEt6ZbMOZbyOiJCfvrxhIkjWwa\n"
+        "+7PPuBk5AePJXwy4LJCTtiq61418i2Bbl6JamytgxsiVK9kZXdN6JqEVYmweMpmR\n"
+        "T1mzi7lssyttBIXwG8ajStUteIYLyi8d+UX4S08EyV0VGL0p5+F8xTY1jVX/t6Y0\n"
+        "KbANJdjEab9mbndzbxprJlS08KBLgdnAO4w0nmINiaO2isXOLoV8SU3tTqHC3W7c\n"
+        "CCSKJdGBAoGBAP9vCSP1AaEjYa6sfEUgThpCo7PhRuOMEDb+4ldv9O+hzXv5I8td\n"
+        "gbDs1g3jyhb0yhW9uV9NsuKBtsmv1zYFswZDNbdr2S1VZPMpAx+SeLHQWy6HbU/t\n"
+        "oHoOO+l8erFVvR2uqit5rBDzN6/lh4SoQzYE9JDAnXJp9W0rKAdtBSLRAoGBANBT\n"
+        "AIErbPo4EuU13DaEa+EfoU4Abktyi+L8dpdoXMq6sHg3Mlhifr+ryoybrMMA3tmT\n"
+        "6ekBCSVThF0/+HAFRAJthnyBgUd0D710JDHro47Mg37CxU+V8JYqZJGHUSfqng7/\n"
+        "pM7LjM99VhigquH4PoDH4YpL8vnIeEMNmny4iER/AoGBAJj8k+jpUXSFkHfh7vwo\n"
+        "AR9RUmLmRmL6/KsztbTQ5U6xBjV+XqXq90ZUU1A2Yk+lhXPIEkK2crGfJy9dFfTR\n"
+        "LQxPLNkSyxyPzMqmgaxjOc6mEDap/hqlJDx2UgPh/kpAI+inOFyZnyj3wx6ixqv5\n"
+        "a2frR996vdJNDCW6d1sbPLxBAoGBAMO66IN0UJy76Izw0Olr+4v10vFdmENM6T+o\n"
+        "IqhZBq33P+yDN8sxJ5NgjhsT/Pruq3LT9XbVYUlvsbKHcx2U5PQ/AZejedqvokZH\n"
+        "g+ZfVjnJz1ZfG1GOOBBu3jSZZdfSKRVAfhFJ0A/229ihxEwxmFAY/MCaYTzsbInb\n"
+        "kyXRnz5zAoGBAIT9Fuk7zhfubYvkzIQ0kj/IxL3QohVRKcoGapDMSwNjTvxZdKxF\n"
+        "WXkhhJT095QznHP1fhp90fBKlOdsReDWfZXMYtZTqo2+ezK8qb6xMlm+LE09y+Na\n"
+        "f7pp1EPnIqyEX27B4aQ81M8tkCqbdlv3CdjFSusp6SsWTGTjr/5SAMDS\n"
+        "-----END RSA PRIVATE KEY-----\n";
+
+static struct plugins_hdl *plugins = NULL;
+static dds_security_authentication *auth = NULL;
+
+
+CU_Init(ddssec_builtin_validate_local_identity)
+{
+    /* Only need the authentication plugin. */
+    plugins = load_plugins(NULL   /* Access Control */,
+                           &auth  /* Authentication */,
+                           NULL   /* Cryptograpy    */);
+    return plugins ? 0 : -1;
+}
+
+
+CU_Clean(ddssec_builtin_validate_local_identity)
+{
+    unload_plugins(plugins);
+    return 0;
+}
+
+
+static void
+dds_security_property_init(
+    DDS_Security_PropertySeq *seq,
+    DDS_Security_unsigned_long size)
+{
+    seq->_length = size;
+    seq->_maximum = size;
+    seq->_buffer = ddsrt_malloc(size * sizeof(DDS_Security_Property_t));
+    memset(seq->_buffer, 0, size * sizeof(DDS_Security_Property_t));
+}
+
+static void
+dds_security_property_deinit(
+    DDS_Security_PropertySeq *seq)
+{
+    uint32_t i;
+
+    for (i = 0; i < seq->_length; i++) {
+        ddsrt_free(seq->_buffer[i].name);
+        ddsrt_free(seq->_buffer[i].value);
+    }
+    ddsrt_free(seq->_buffer);
+}
+
+static void
+print_guid(
+    const char *msg,
+    DDS_Security_GUID_t *guid)
+{
+    uint32_t i, j;
+
+    printf("%s=", msg);
+    for (i = 0; i < 3; i++) {
+        for (j = 0; j < 4; j++) {
+            printf("%02x", guid->prefix[i*4+j]);
+        }
+        printf(":");
+    }
+    for (i = 0; i < 3; i++) {
+        printf("%02x", guid->entityId.entityKey[i]);
+    }
+    printf(":%02x\n", guid->entityId.entityKind);
+}
+
+static void
+reset_exception(
+    DDS_Security_SecurityException *ex)
+{
+    ex->code = 0;
+    ex->minor_code = 0;
+    ddsrt_free(ex->message);
+    ex->message = NULL;
+}
+
+static void fill_participant_qos(DDS_Security_Qos *participant_qos,
+                bool is_file_certificate, const char *certificate,
+                bool is_file_ca, const char *ca,
+                bool is_file_private_key, const char *private_key,
+                const char* password,
+                const char* trusted_ca_dir){
+
+    char identity_cert_path[1024];
+    char identity_CA_path[1024];
+    char private_key_path[1024];
+    char trusted_ca_dir_path[1024];
+    unsigned size = 3;
+
+    password ? size++ : size;
+    trusted_ca_dir ? size++ : size;
+
+    memset(participant_qos, 0, sizeof(*participant_qos));
+    dds_security_property_init(&participant_qos->property.value, size);
+
+    participant_qos->property.value._buffer[0].name = ddsrt_strdup(PROPERTY_IDENTITY_CERT);
+    participant_qos->property.value._buffer[1].name = ddsrt_strdup(PROPERTY_IDENTITY_CA);
+    participant_qos->property.value._buffer[2].name = ddsrt_strdup(PROPERTY_PRIVATE_KEY);
+
+
+    if( is_file_certificate){
+#ifdef WIN32
+        snprintf(identity_cert_path, 1024, "file:%s\\validate_local_identity\\etc\\%s", CONFIG_ENV_TESTS_DIR, certificate);
+#else
+        snprintf(identity_cert_path, 1024, "file:%s/validate_local_identity/etc/%s", CONFIG_ENV_TESTS_DIR, certificate);
+#endif
+        participant_qos->property.value._buffer[0].value = ddsrt_strdup(identity_cert_path);
+    }
+    else{
+        participant_qos->property.value._buffer[0].value = ddsrt_strdup(certificate);
+    }
+
+    if( is_file_ca){
+#ifdef WIN32
+        snprintf(identity_CA_path, 1024, "file:%s\\validate_local_identity\\etc\\%s", CONFIG_ENV_TESTS_DIR,ca);
+#else
+        snprintf(identity_CA_path, 1024, "file:%s/validate_local_identity/etc/%s", CONFIG_ENV_TESTS_DIR,ca);
+#endif
+        participant_qos->property.value._buffer[1].value = ddsrt_strdup(identity_CA_path);
+    }
+    else {
+        participant_qos->property.value._buffer[1].value = ddsrt_strdup(ca);
+    }
+
+    if( is_file_private_key){
+      #ifdef WIN32
+        snprintf(private_key_path, 1024, "file:%s\\validate_local_identity\\etc\\%s", CONFIG_ENV_TESTS_DIR,private_key);
+      #else
+        snprintf(private_key_path, 1024, "file:%s/validate_local_identity/etc/%s", CONFIG_ENV_TESTS_DIR, private_key);
+      #endif
+        participant_qos->property.value._buffer[2].value = ddsrt_strdup(private_key_path);
+    }
+    else{
+        participant_qos->property.value._buffer[2].value = ddsrt_strdup(private_key);
+    }
+
+    if( password ){
+        participant_qos->property.value._buffer[3].name = ddsrt_strdup(PROPERTY_PASSWORD);
+        participant_qos->property.value._buffer[3].value = ddsrt_strdup(password);
+    }
+
+    if( trusted_ca_dir ){
+      #ifdef WIN32
+        snprintf(trusted_ca_dir_path, 1024, "%s\\validate_local_identity\\etc\\%s", CONFIG_ENV_TESTS_DIR,trusted_ca_dir);
+      #else
+        snprintf(trusted_ca_dir_path, 1024, "%s/validate_local_identity/etc/%s", CONFIG_ENV_TESTS_DIR, trusted_ca_dir);
+      #endif
+        participant_qos->property.value._buffer[size-1].name = ddsrt_strdup(PROPERTY_TRUSTED_CA_DIR);
+        participant_qos->property.value._buffer[size-1].value = ddsrt_strdup(trusted_ca_dir_path);
+    }
+
+
+}
+
+CU_Test(ddssec_builtin_validate_local_identity,happy_day)
+{
+    DDS_Security_ValidationResult_t result;
+    DDS_Security_IdentityHandle local_identity_handle = DDS_SECURITY_HANDLE_NIL;
+    DDS_Security_GUID_t adjusted_participant_guid;
+    DDS_Security_DomainId domain_id = 0;
+    DDS_Security_Qos participant_qos;
+    DDS_Security_GUID_t candidate_participant_guid;
+    DDS_Security_SecurityException exception = {NULL, 0, 0};
+    DDS_Security_GuidPrefix_t prefix = {0xf0, 0xf1, 0xf2, 0xf3, 0xf4, 0xf5, 0xf6, 0xf7, 0xf8, 0xf9, 0xfa, 0xfb};
+    DDS_Security_EntityId_t entityId = {{0xa0,0xa1,0xa2},0x1};
+    DDS_Security_boolean success;
+
+    /* Check if we actually have the validate_local_identity() function. */
+    CU_ASSERT_FATAL (auth != NULL);
+    CU_ASSERT_FATAL (auth->validate_local_identity != NULL);
+
+    memset(&adjusted_participant_guid, 0, sizeof(adjusted_participant_guid));
+    memcpy(&candidate_participant_guid.prefix, &prefix, sizeof(prefix));
+    memcpy(&candidate_participant_guid.entityId, &entityId, sizeof(entityId));
+
+    fill_participant_qos(&participant_qos, false, identity_certificate,
+                                           false, identity_ca,
+                                           false, private_key_pem,
+                                           NULL,
+                                           NULL);
+    /* Now call the function. */
+    result = auth->validate_local_identity(
+                            auth,
+                            &local_identity_handle,
+                            &adjusted_participant_guid,
+                            domain_id,
+                            &participant_qos,
+                            &candidate_participant_guid,
+                            &exception);
+
+    if (result != DDS_SECURITY_VALIDATION_OK) {
+        printf("validate_local_identity_failed: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+
+    /* We expected the validation to have succeeded. */
+    CU_ASSERT_FATAL (result == DDS_SECURITY_VALIDATION_OK);
+    CU_ASSERT (local_identity_handle != DDS_SECURITY_HANDLE_NIL);
+
+    print_guid("adjusted_participant_guid", &adjusted_participant_guid);
+    CU_ASSERT (memcmp(&adjusted_participant_guid.entityId, &entityId, sizeof(entityId)) == 0);
+
+    dds_security_property_deinit(&participant_qos.property.value);
+    reset_exception(&exception);
+
+    success = auth->return_identity_handle(auth, local_identity_handle, &exception);
+    CU_ASSERT_TRUE (success);
+
+    if (!success) {
+        printf("return_identity_handle failed: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+    reset_exception(&exception);
+
+    /* validate with file */
+    memset(&adjusted_participant_guid, 0, sizeof(adjusted_participant_guid));
+    memcpy(&candidate_participant_guid.prefix, &prefix, sizeof(prefix));
+    memcpy(&candidate_participant_guid.entityId, &entityId, sizeof(entityId));
+
+    fill_participant_qos(&participant_qos, true, identity_certificate_filename,
+                    true, identity_ca_filename,
+                    true, private_key_filename,
+                    NULL,
+                                           NULL);
+
+    /* Now call the function. */
+    result = auth->validate_local_identity(
+                            auth,
+                            &local_identity_handle,
+                            &adjusted_participant_guid,
+                            domain_id,
+                            &participant_qos,
+                            &candidate_participant_guid,
+                            &exception);
+
+    if (result != DDS_SECURITY_VALIDATION_OK) {
+        printf("validate_local_identity_failed: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+
+    /* We expected the validation to have succeeded. */
+    CU_ASSERT_FATAL (result == DDS_SECURITY_VALIDATION_OK);
+    CU_ASSERT (local_identity_handle != DDS_SECURITY_HANDLE_NIL);
+
+    print_guid("adjusted_participant_guid", &adjusted_participant_guid);
+    CU_ASSERT (memcmp(&adjusted_participant_guid.entityId, &entityId, sizeof(entityId)) == 0);
+
+    dds_security_property_deinit(&participant_qos.property.value);
+    reset_exception(&exception);
+
+    success = auth->return_identity_handle(auth, local_identity_handle, &exception);
+    CU_ASSERT_TRUE (success);
+
+    if (!success) {
+        printf("return_identity_handle failed: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+    reset_exception(&exception);
+
+
+
+
+}
+
+CU_Test(ddssec_builtin_validate_local_identity,invalid_certificate)
+{
+    DDS_Security_ValidationResult_t result;
+    DDS_Security_IdentityHandle local_identity_handle = DDS_SECURITY_HANDLE_NIL;
+    DDS_Security_GUID_t adjusted_participant_guid;
+    DDS_Security_DomainId domain_id = 0;
+    DDS_Security_Qos participant_qos;
+    DDS_Security_GUID_t candidate_participant_guid;
+    DDS_Security_SecurityException exception = {NULL, 0, 0};
+    DDS_Security_GuidPrefix_t prefix = {0xf0, 0xf1, 0xf2, 0xf3, 0xf4, 0xf5, 0xf6, 0xf7, 0xf8, 0xf9, 0xfa, 0xfb};
+    DDS_Security_EntityId_t entityId = {{0xa0,0xa1,0xa2},0x1};
+
+    /* Check if we actually have the validate_local_identity() function. */
+    CU_ASSERT_FATAL (auth != NULL);
+    CU_ASSERT_FATAL (auth->validate_local_identity != NULL);
+
+    memset(&adjusted_participant_guid, 0, sizeof(adjusted_participant_guid));
+    memcpy(&candidate_participant_guid.prefix, &prefix, sizeof(prefix));
+    memcpy(&candidate_participant_guid.entityId, &entityId, sizeof(entityId));
+
+    fill_participant_qos(&participant_qos, false, invalid_identity_certificate,
+                                           false, identity_ca,
+                                           false, private_key_pem,
+                                           NULL,
+                                           NULL);
+
+    /* Now call the function. */
+    result = auth->validate_local_identity(
+                            auth,
+                            &local_identity_handle,
+                            &adjusted_participant_guid,
+                            domain_id,
+                            &participant_qos,
+                            &candidate_participant_guid,
+                            &exception);
+
+    if (result != DDS_SECURITY_VALIDATION_OK) {
+        printf("validate_local_identity_failed: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+
+    /* We expected the validation to have succeeded. */
+    CU_ASSERT (result != DDS_SECURITY_VALIDATION_OK);
+    CU_ASSERT (exception.minor_code != 0);
+    CU_ASSERT (exception.message != NULL);
+
+    dds_security_property_deinit(&participant_qos.property.value);
+    reset_exception(&exception);
+
+    /* test with file */
+
+    memset(&adjusted_participant_guid, 0, sizeof(adjusted_participant_guid));
+    memcpy(&candidate_participant_guid.prefix, &prefix, sizeof(prefix));
+    memcpy(&candidate_participant_guid.entityId, &entityId, sizeof(entityId));
+
+    fill_participant_qos(&participant_qos, true, invalid_identity_certificate_filename,
+                                           false, identity_ca,
+                                           false, private_key_pem,
+                                           NULL,
+                                           NULL);
+
+    /* Now call the function. */
+    result = auth->validate_local_identity(
+                            auth,
+                            &local_identity_handle,
+                            &adjusted_participant_guid,
+                            domain_id,
+                            &participant_qos,
+                            &candidate_participant_guid,
+                            &exception);
+
+    if (result != DDS_SECURITY_VALIDATION_OK) {
+        printf("validate_local_identity_failed: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+
+    /* We expected the validation to have succeeded. */
+    CU_ASSERT (result != DDS_SECURITY_VALIDATION_OK);
+    CU_ASSERT (exception.minor_code != 0);
+    CU_ASSERT (exception.message != NULL);
+
+    dds_security_property_deinit(&participant_qos.property.value);
+    reset_exception(&exception);
+}
+
+
+CU_Test(ddssec_builtin_validate_local_identity,invalid_root)
+{
+    DDS_Security_ValidationResult_t result;
+    DDS_Security_IdentityHandle local_identity_handle = DDS_SECURITY_HANDLE_NIL;
+    DDS_Security_GUID_t adjusted_participant_guid;
+    DDS_Security_DomainId domain_id = 0;
+    DDS_Security_Qos participant_qos;
+    DDS_Security_GUID_t candidate_participant_guid;
+    DDS_Security_SecurityException exception = {NULL, 0, 0};
+    DDS_Security_GuidPrefix_t prefix = {0xf0, 0xf1, 0xf2, 0xf3, 0xf4, 0xf5, 0xf6, 0xf7, 0xf8, 0xf9, 0xfa, 0xfb};
+    DDS_Security_EntityId_t entityId = {{0xa0,0xa1,0xa2},0x1};
+
+    /* Check if we actually have the validate_local_identity() function. */
+    CU_ASSERT_FATAL (auth != NULL);
+    CU_ASSERT_FATAL (auth->validate_local_identity != NULL);
+
+    memset(&adjusted_participant_guid, 0, sizeof(adjusted_participant_guid));
+    memcpy(&candidate_participant_guid.prefix, &prefix, sizeof(prefix));
+    memcpy(&candidate_participant_guid.entityId, &entityId, sizeof(entityId));
+
+    fill_participant_qos(&participant_qos, false, identity_certificate,
+                                           false, invalid_identity_ca,
+                                           false, private_key_pem,
+                                           NULL,
+                                           NULL);
+    /* Now call the function. */
+    result = auth->validate_local_identity(
+                            auth,
+                            &local_identity_handle,
+                            &adjusted_participant_guid,
+                            domain_id,
+                            &participant_qos,
+                            &candidate_participant_guid,
+                            &exception);
+
+    if (result != DDS_SECURITY_VALIDATION_OK) {
+        printf("validate_local_identity_failed: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+
+    /* We expected the validation to have succeeded. */
+    CU_ASSERT (result != DDS_SECURITY_VALIDATION_OK);
+    CU_ASSERT (exception.minor_code != 0);
+    CU_ASSERT (exception.message != NULL);
+
+    dds_security_property_deinit(&participant_qos.property.value);
+    reset_exception(&exception);
+
+    /* test with file */
+    memset(&adjusted_participant_guid, 0, sizeof(adjusted_participant_guid));
+    memcpy(&candidate_participant_guid.prefix, &prefix, sizeof(prefix));
+    memcpy(&candidate_participant_guid.entityId, &entityId, sizeof(entityId));
+
+    fill_participant_qos(&participant_qos, false, identity_certificate,
+                                           true, invalid_identity_ca_filename,
+                                           false, private_key_pem,
+                                           NULL,
+                                           NULL);
+    /* Now call the function. */
+    result = auth->validate_local_identity(
+                            auth,
+                            &local_identity_handle,
+                            &adjusted_participant_guid,
+                            domain_id,
+                            &participant_qos,
+                            &candidate_participant_guid,
+                            &exception);
+
+    if (result != DDS_SECURITY_VALIDATION_OK) {
+        printf("validate_local_identity_failed: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+
+    /* We expected the validation to have succeeded. */
+    CU_ASSERT (result != DDS_SECURITY_VALIDATION_OK);
+    CU_ASSERT (exception.minor_code != 0);
+    CU_ASSERT (exception.message != NULL);
+
+    dds_security_property_deinit(&participant_qos.property.value);
+    reset_exception(&exception);
+}
+
+CU_Test(ddssec_builtin_validate_local_identity,invalid_chain)
+{
+    DDS_Security_ValidationResult_t result;
+    DDS_Security_IdentityHandle local_identity_handle = DDS_SECURITY_HANDLE_NIL;
+    DDS_Security_GUID_t adjusted_participant_guid;
+    DDS_Security_DomainId domain_id = 0;
+    DDS_Security_Qos participant_qos;
+    DDS_Security_GUID_t candidate_participant_guid;
+    DDS_Security_SecurityException exception = {NULL, 0, 0};
+    DDS_Security_GuidPrefix_t prefix = {0xf0, 0xf1, 0xf2, 0xf3, 0xf4, 0xf5, 0xf6, 0xf7, 0xf8, 0xf9, 0xfa, 0xfb};
+    DDS_Security_EntityId_t entityId = {{0xa0,0xa1,0xa2},0x1};
+
+    /* Check if we actually have the validate_local_identity() function. */
+    CU_ASSERT_FATAL (auth != NULL);
+    CU_ASSERT_FATAL (auth->validate_local_identity != NULL);
+
+    memset(&adjusted_participant_guid, 0, sizeof(adjusted_participant_guid));
+    memcpy(&candidate_participant_guid.prefix, &prefix, sizeof(prefix));
+    memcpy(&candidate_participant_guid.entityId, &entityId, sizeof(entityId));
+
+    fill_participant_qos(&participant_qos, false, identity_certificate,
+                                           false, unrelated_identity_ca,
+                                           false, private_key_pem,
+                                           NULL,
+                                           NULL);
+    /* Now call the function. */
+    result = auth->validate_local_identity(
+                            auth,
+                            &local_identity_handle,
+                            &adjusted_participant_guid,
+                            domain_id,
+                            &participant_qos,
+                            &candidate_participant_guid,
+                            &exception);
+
+    if (result != DDS_SECURITY_VALIDATION_OK) {
+        printf("validate_local_identity_failed: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+
+    /* We expected the validation to have succeeded. */
+    CU_ASSERT (result != DDS_SECURITY_VALIDATION_OK);
+    CU_ASSERT (exception.minor_code != 0);
+    CU_ASSERT (exception.message != NULL);
+
+    dds_security_property_deinit(&participant_qos.property.value);
+    reset_exception(&exception);
+
+    /* test with file input*/
+    memset(&adjusted_participant_guid, 0, sizeof(adjusted_participant_guid));
+    memcpy(&candidate_participant_guid.prefix, &prefix, sizeof(prefix));
+    memcpy(&candidate_participant_guid.entityId, &entityId, sizeof(entityId));
+
+    fill_participant_qos(&participant_qos, false, identity_certificate,
+                                           true, unrelated_identity_ca_filename,
+                                           false, private_key_pem,
+                                           NULL,
+                                           NULL);
+    /* Now call the function. */
+    result = auth->validate_local_identity(
+                            auth,
+                            &local_identity_handle,
+                            &adjusted_participant_guid,
+                            domain_id,
+                            &participant_qos,
+                            &candidate_participant_guid,
+                            &exception);
+
+    if (result != DDS_SECURITY_VALIDATION_OK) {
+        printf("validate_local_identity_failed: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+
+    /* We expected the validation to have succeeded. */
+    CU_ASSERT (result != DDS_SECURITY_VALIDATION_OK);
+    CU_ASSERT (exception.minor_code != 0);
+    CU_ASSERT (exception.message != NULL);
+
+    dds_security_property_deinit(&participant_qos.property.value);
+    reset_exception(&exception);
+
+
+}
+
+CU_Test(ddssec_builtin_validate_local_identity,certificate_key_to_small)
+{
+    DDS_Security_ValidationResult_t result;
+    DDS_Security_IdentityHandle local_identity_handle = DDS_SECURITY_HANDLE_NIL;
+    DDS_Security_GUID_t adjusted_participant_guid;
+    DDS_Security_DomainId domain_id = 0;
+    DDS_Security_Qos participant_qos;
+    DDS_Security_GUID_t candidate_participant_guid;
+    DDS_Security_SecurityException exception = {NULL, 0, 0};
+    DDS_Security_GuidPrefix_t prefix = {0xf0, 0xf1, 0xf2, 0xf3, 0xf4, 0xf5, 0xf6, 0xf7, 0xf8, 0xf9, 0xfa, 0xfb};
+    DDS_Security_EntityId_t entityId = {{0xa0,0xa1,0xa2},0x1};
+
+    /* Check if we actually have the validate_local_identity() function. */
+    CU_ASSERT_FATAL (auth != NULL);
+    CU_ASSERT_FATAL (auth->validate_local_identity != NULL);
+
+    memset(&adjusted_participant_guid, 0, sizeof(adjusted_participant_guid));
+    memcpy(&candidate_participant_guid.prefix, &prefix, sizeof(prefix));
+    memcpy(&candidate_participant_guid.entityId, &entityId, sizeof(entityId));
+
+    fill_participant_qos(&participant_qos, false, identity_certificate_1024key,
+                                           false, identity_ca,
+                                           false, private_key_pem,
+                                           NULL,
+                                           NULL);
+
+    /* Now call the function. */
+    result = auth->validate_local_identity(
+                            auth,
+                            &local_identity_handle,
+                            &adjusted_participant_guid,
+                            domain_id,
+                            &participant_qos,
+                            &candidate_participant_guid,
+                            &exception);
+
+    if (result != DDS_SECURITY_VALIDATION_OK) {
+        printf("validate_local_identity_failed: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+
+    /* We expected the validation to have succeeded. */
+    CU_ASSERT (result != DDS_SECURITY_VALIDATION_OK);
+    CU_ASSERT (exception.minor_code != 0);
+    CU_ASSERT (exception.message != NULL);
+
+    dds_security_property_deinit(&participant_qos.property.value);
+    reset_exception(&exception);
+}
+
+
+CU_Test(ddssec_builtin_validate_local_identity,invalid_private_key)
+{
+    DDS_Security_ValidationResult_t result;
+    DDS_Security_IdentityHandle local_identity_handle = DDS_SECURITY_HANDLE_NIL;
+    DDS_Security_GUID_t adjusted_participant_guid;
+    DDS_Security_DomainId domain_id = 0;
+    DDS_Security_Qos participant_qos;
+    DDS_Security_GUID_t candidate_participant_guid;
+    DDS_Security_SecurityException exception = {NULL, 0, 0};
+    DDS_Security_GuidPrefix_t prefix = {0xf0, 0xf1, 0xf2, 0xf3, 0xf4, 0xf5, 0xf6, 0xf7, 0xf8, 0xf9, 0xfa, 0xfb};
+    DDS_Security_EntityId_t entityId = {{0xa0,0xa1,0xa2},0x1};
+
+    /* Check if we actually have the validate_local_identity() function. */
+    CU_ASSERT_FATAL (auth != NULL);
+    CU_ASSERT_FATAL (auth->validate_local_identity != NULL);
+
+    memset(&adjusted_participant_guid, 0, sizeof(adjusted_participant_guid));
+    memcpy(&candidate_participant_guid.prefix, &prefix, sizeof(prefix));
+    memcpy(&candidate_participant_guid.entityId, &entityId, sizeof(entityId));
+
+    fill_participant_qos(&participant_qos, false, identity_certificate,
+                                           false, identity_ca,
+                                           false, invalid_private_key,
+                                           NULL,
+                                           NULL);
+    /* Now call the function. */
+    result = auth->validate_local_identity(
+                            auth,
+                            &local_identity_handle,
+                            &adjusted_participant_guid,
+                            domain_id,
+                            &participant_qos,
+                            &candidate_participant_guid,
+                            &exception);
+
+    if (result != DDS_SECURITY_VALIDATION_OK) {
+        printf("validate_local_identity_failed: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+
+    /* We expected the validation to have succeeded. */
+    CU_ASSERT (result != DDS_SECURITY_VALIDATION_OK);
+    CU_ASSERT (exception.minor_code != 0);
+    CU_ASSERT (exception.message != NULL);
+
+    dds_security_property_deinit(&participant_qos.property.value);
+    reset_exception(&exception);
+
+    /*test with file input */
+    memset(&adjusted_participant_guid, 0, sizeof(adjusted_participant_guid));
+    memcpy(&candidate_participant_guid.prefix, &prefix, sizeof(prefix));
+    memcpy(&candidate_participant_guid.entityId, &entityId, sizeof(entityId));
+
+    fill_participant_qos(&participant_qos, false, identity_certificate,
+                                           false, identity_ca,
+                                           true, invalid_private_key_filename,
+                                           NULL,
+                                           NULL);
+    /* Now call the function. */
+    result = auth->validate_local_identity(
+                            auth,
+                            &local_identity_handle,
+                            &adjusted_participant_guid,
+                            domain_id,
+                            &participant_qos,
+                            &candidate_participant_guid,
+                            &exception);
+
+    if (result != DDS_SECURITY_VALIDATION_OK) {
+        printf("validate_local_identity_failed: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+
+    /* We expected the validation to have succeeded. */
+    CU_ASSERT (result != DDS_SECURITY_VALIDATION_OK);
+    CU_ASSERT (exception.minor_code != 0);
+    CU_ASSERT (exception.message != NULL);
+
+    dds_security_property_deinit(&participant_qos.property.value);
+    reset_exception(&exception);
+}
+
+
+CU_Test(ddssec_builtin_validate_local_identity,private_key_to_small)
+{
+    DDS_Security_ValidationResult_t result;
+    DDS_Security_IdentityHandle local_identity_handle = DDS_SECURITY_HANDLE_NIL;
+    DDS_Security_GUID_t adjusted_participant_guid;
+    DDS_Security_DomainId domain_id = 0;
+    DDS_Security_Qos participant_qos;
+    DDS_Security_GUID_t candidate_participant_guid;
+    DDS_Security_SecurityException exception = {NULL, 0, 0};
+    DDS_Security_GuidPrefix_t prefix = {0xf0, 0xf1, 0xf2, 0xf3, 0xf4, 0xf5, 0xf6, 0xf7, 0xf8, 0xf9, 0xfa, 0xfb};
+    DDS_Security_EntityId_t entityId = {{0xa0,0xa1,0xa2},0x1};
+
+    /* Check if we actually have the validate_local_identity() function. */
+    CU_ASSERT_FATAL (auth != NULL);
+    CU_ASSERT_FATAL (auth->validate_local_identity != NULL);
+
+    memset(&adjusted_participant_guid, 0, sizeof(adjusted_participant_guid));
+    memcpy(&candidate_participant_guid.prefix, &prefix, sizeof(prefix));
+    memcpy(&candidate_participant_guid.entityId, &entityId, sizeof(entityId));
+
+    fill_participant_qos(&participant_qos, false, identity_certificate,
+                                           false, identity_ca,
+                                           false, private_key_1024,
+                                           NULL,
+                                           NULL);
+    /* Now call the function. */
+    result = auth->validate_local_identity(
+                            auth,
+                            &local_identity_handle,
+                            &adjusted_participant_guid,
+                            domain_id,
+                            &participant_qos,
+                            &candidate_participant_guid,
+                            &exception);
+
+    if (result != DDS_SECURITY_VALIDATION_OK) {
+        printf("validate_local_identity_failed: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+
+    /* We expected the validation to have succeeded. */
+    CU_ASSERT (result != DDS_SECURITY_VALIDATION_OK);
+    CU_ASSERT (exception.minor_code != 0);
+    CU_ASSERT (exception.message != NULL);
+
+    dds_security_property_deinit(&participant_qos.property.value);
+    reset_exception(&exception);
+}
+
+
+CU_Test(ddssec_builtin_validate_local_identity,missing_certificate_property)
+{
+    DDS_Security_ValidationResult_t result;
+    DDS_Security_IdentityHandle local_identity_handle = DDS_SECURITY_HANDLE_NIL;
+    DDS_Security_GUID_t adjusted_participant_guid;
+    DDS_Security_DomainId domain_id = 0;
+    DDS_Security_Qos participant_qos;
+    DDS_Security_GUID_t candidate_participant_guid;
+    DDS_Security_SecurityException exception = {NULL, 0, 0};
+    DDS_Security_GuidPrefix_t prefix = {0xf0, 0xf1, 0xf2, 0xf3, 0xf4, 0xf5, 0xf6, 0xf7, 0xf8, 0xf9, 0xfa, 0xfb};
+    DDS_Security_EntityId_t entityId = {{0xa0,0xa1,0xa2},0x1};
+
+    /* Check if we actually have the validate_local_identity() function. */
+    CU_ASSERT_FATAL (auth != NULL);
+    CU_ASSERT_FATAL (auth->validate_local_identity != NULL);
+
+    memset(&adjusted_participant_guid, 0, sizeof(adjusted_participant_guid));
+    memcpy(&candidate_participant_guid.prefix, &prefix, sizeof(prefix));
+    memcpy(&candidate_participant_guid.entityId, &entityId, sizeof(entityId));
+
+    memset(&participant_qos, 0, sizeof(participant_qos));
+    dds_security_property_init(&participant_qos.property.value, 3);
+    participant_qos.property.value._buffer[0].name = ddsrt_strdup("dds.sec.auth.identity_cert");
+    participant_qos.property.value._buffer[0].value = ddsrt_strdup(identity_certificate);
+    participant_qos.property.value._buffer[1].name = ddsrt_strdup(PROPERTY_IDENTITY_CA);
+    participant_qos.property.value._buffer[1].value = ddsrt_strdup(identity_ca);
+    participant_qos.property.value._buffer[2].name = ddsrt_strdup(PROPERTY_PRIVATE_KEY);
+    participant_qos.property.value._buffer[2].value = ddsrt_strdup(private_key_1024);
+
+    /* Now call the function. */
+    result = auth->validate_local_identity(
+                            auth,
+                            &local_identity_handle,
+                            &adjusted_participant_guid,
+                            domain_id,
+                            &participant_qos,
+                            &candidate_participant_guid,
+                            &exception);
+
+    if (result != DDS_SECURITY_VALIDATION_OK) {
+        printf("validate_local_identity_failed: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+
+    /* We expected the validation to have succeeded. */
+    CU_ASSERT (result != DDS_SECURITY_VALIDATION_OK);
+    CU_ASSERT (exception.minor_code != 0);
+    CU_ASSERT_FATAL (exception.message != NULL);
+    CU_ASSERT(strcmp(exception.message, "validate_local_identity: missing property 'dds.sec.auth.identity_certificate'") == 0);
+
+    dds_security_property_deinit(&participant_qos.property.value);
+    reset_exception(&exception);
+}
+
+
+CU_Test(ddssec_builtin_validate_local_identity,missing_ca_property)
+{
+    DDS_Security_ValidationResult_t result;
+
+    /* Dummy (even un-initialized) data for now. */
+    DDS_Security_IdentityHandle local_identity_handle = DDS_SECURITY_HANDLE_NIL;
+    DDS_Security_GUID_t adjusted_participant_guid;
+    DDS_Security_DomainId domain_id = 0;
+    DDS_Security_Qos participant_qos;
+    DDS_Security_GUID_t candidate_participant_guid;
+    DDS_Security_SecurityException exception = {NULL, 0, 0};
+    DDS_Security_GuidPrefix_t prefix = {0xf0, 0xf1, 0xf2, 0xf3, 0xf4, 0xf5, 0xf6, 0xf7, 0xf8, 0xf9, 0xfa, 0xfb};
+    DDS_Security_EntityId_t entityId = {{0xa0,0xa1,0xa2},0x1};
+
+    /* Check if we actually have the validate_local_identity() function. */
+    CU_ASSERT_FATAL (auth != NULL);
+    CU_ASSERT_FATAL (auth->validate_local_identity != NULL);
+
+    memset(&adjusted_participant_guid, 0, sizeof(adjusted_participant_guid));
+    memcpy(&candidate_participant_guid.prefix, &prefix, sizeof(prefix));
+    memcpy(&candidate_participant_guid.entityId, &entityId, sizeof(entityId));
+
+    memset(&participant_qos, 0, sizeof(participant_qos));
+    dds_security_property_init(&participant_qos.property.value, 3);
+    participant_qos.property.value._buffer[0].name = ddsrt_strdup(PROPERTY_IDENTITY_CERT);
+    participant_qos.property.value._buffer[0].value = ddsrt_strdup(identity_certificate);
+    participant_qos.property.value._buffer[1].name = ddsrt_strdup("dds.sec.auth.identit_ca");
+    participant_qos.property.value._buffer[1].value = ddsrt_strdup(identity_ca);
+    participant_qos.property.value._buffer[2].name = ddsrt_strdup(PROPERTY_PRIVATE_KEY);
+    participant_qos.property.value._buffer[2].value = ddsrt_strdup(private_key_1024);
+
+    /* Now call the function. */
+    result = auth->validate_local_identity(
+                            auth,
+                            &local_identity_handle,
+                            &adjusted_participant_guid,
+                            domain_id,
+                            &participant_qos,
+                            &candidate_participant_guid,
+                            &exception);
+
+    if (result != DDS_SECURITY_VALIDATION_OK) {
+        printf("validate_local_identity_failed: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+
+    /* We expected the validation to have succeeded. */
+    CU_ASSERT (result != DDS_SECURITY_VALIDATION_OK);
+    CU_ASSERT (exception.minor_code != 0);
+    CU_ASSERT_FATAL (exception.message != NULL);
+    CU_ASSERT(strcmp(exception.message, "validate_local_identity: missing property 'dds.sec.auth.identity_ca'") == 0);
+
+    dds_security_property_deinit(&participant_qos.property.value);
+    reset_exception(&exception);
+}
+
+CU_Test(ddssec_builtin_validate_local_identity,missing_private_key_property)
+{
+    DDS_Security_ValidationResult_t result;
+    DDS_Security_IdentityHandle local_identity_handle = DDS_SECURITY_HANDLE_NIL;
+    DDS_Security_GUID_t adjusted_participant_guid;
+    DDS_Security_DomainId domain_id = 0;
+    DDS_Security_Qos participant_qos;
+    DDS_Security_GUID_t candidate_participant_guid;
+    DDS_Security_SecurityException exception = {NULL, 0, 0};
+    DDS_Security_GuidPrefix_t prefix = {0xf0, 0xf1, 0xf2, 0xf3, 0xf4, 0xf5, 0xf6, 0xf7, 0xf8, 0xf9, 0xfa, 0xfb};
+    DDS_Security_EntityId_t entityId = {{0xa0,0xa1,0xa2},0x1};
+
+    /* Check if we actually have the validate_local_identity() function. */
+    CU_ASSERT_FATAL (auth != NULL);
+    CU_ASSERT_FATAL (auth->validate_local_identity != NULL);
+
+    memset(&adjusted_participant_guid, 0, sizeof(adjusted_participant_guid));
+    memcpy(&candidate_participant_guid.prefix, &prefix, sizeof(prefix));
+    memcpy(&candidate_participant_guid.entityId, &entityId, sizeof(entityId));
+
+    memset(&participant_qos, 0, sizeof(participant_qos));
+    dds_security_property_init(&participant_qos.property.value, 2);
+    participant_qos.property.value._buffer[0].name = ddsrt_strdup(PROPERTY_IDENTITY_CERT);
+    participant_qos.property.value._buffer[0].value = ddsrt_strdup(identity_certificate);
+    participant_qos.property.value._buffer[1].name = ddsrt_strdup(PROPERTY_IDENTITY_CA);
+    participant_qos.property.value._buffer[1].value = ddsrt_strdup(identity_ca);
+
+    /* Now call the function. */
+    result = auth->validate_local_identity(
+                            auth,
+                            &local_identity_handle,
+                            &adjusted_participant_guid,
+                            domain_id,
+                            &participant_qos,
+                            &candidate_participant_guid,
+                            &exception);
+
+    if (result != DDS_SECURITY_VALIDATION_OK) {
+        printf("validate_local_identity_failed: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+
+    /* We expected the validation to have succeeded. */
+    CU_ASSERT (result != DDS_SECURITY_VALIDATION_OK);
+    CU_ASSERT (exception.minor_code != 0);
+    CU_ASSERT_FATAL (exception.message != NULL);
+    CU_ASSERT(strcmp(exception.message, "validate_local_identity: missing property 'dds.sec.auth.private_key'") == 0);
+
+    dds_security_property_deinit(&participant_qos.property.value);
+    reset_exception(&exception);
+}
+
+CU_Test(ddssec_builtin_validate_local_identity,unsupported_certification_format)
+{
+    DDS_Security_ValidationResult_t result;
+    DDS_Security_IdentityHandle local_identity_handle = DDS_SECURITY_HANDLE_NIL;
+    DDS_Security_GUID_t adjusted_participant_guid;
+    DDS_Security_DomainId domain_id = 0;
+    DDS_Security_Qos participant_qos;
+    DDS_Security_GUID_t candidate_participant_guid;
+    DDS_Security_SecurityException exception = {NULL, 0, 0};
+    DDS_Security_GuidPrefix_t prefix = {0xf0, 0xf1, 0xf2, 0xf3, 0xf4, 0xf5, 0xf6, 0xf7, 0xf8, 0xf9, 0xfa, 0xfb};
+    DDS_Security_EntityId_t entityId = {{0xa0,0xa1,0xa2},0x1};
+    char *cert;
+    size_t len;
+
+    /* Check if we actually have the validate_local_identity() function. */
+    CU_ASSERT_FATAL (auth != NULL);
+    CU_ASSERT_FATAL (auth->validate_local_identity != NULL);
+
+    len = strlen("uri:") + strlen(&identity_certificate[6]) + 1;
+    cert = ddsrt_malloc(len);
+
+    snprintf(cert, len, "uri:%s", &identity_certificate[6]);
+
+    memset(&adjusted_participant_guid, 0, sizeof(adjusted_participant_guid));
+    memcpy(&candidate_participant_guid.prefix, &prefix, sizeof(prefix));
+    memcpy(&candidate_participant_guid.entityId, &entityId, sizeof(entityId));
+
+    fill_participant_qos(&participant_qos, false, cert,
+                                           false, identity_ca,
+                                           false, private_key_pem,
+                                           NULL, NULL);
+    /* Now call the function. */
+    result = auth->validate_local_identity(
+                            auth,
+                            &local_identity_handle,
+                            &adjusted_participant_guid,
+                            domain_id,
+                            &participant_qos,
+                            &candidate_participant_guid,
+                            &exception);
+
+    if (result != DDS_SECURITY_VALIDATION_OK) {
+        printf("validate_local_identity_failed: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+
+    /* We expected the validation to have succeeded. */
+    CU_ASSERT (result != DDS_SECURITY_VALIDATION_OK);
+    CU_ASSERT (exception.minor_code != 0);
+    CU_ASSERT (exception.message != NULL);
+
+    dds_security_property_deinit(&participant_qos.property.value);
+    reset_exception(&exception);
+
+    ddsrt_free(cert);
+}
+
+CU_Test(ddssec_builtin_validate_local_identity,encrypted_key)
+{
+    DDS_Security_ValidationResult_t result;
+    DDS_Security_IdentityHandle local_identity_handle = DDS_SECURITY_HANDLE_NIL;
+    DDS_Security_GUID_t adjusted_participant_guid;
+    DDS_Security_DomainId domain_id = 0;
+    DDS_Security_Qos participant_qos;
+    DDS_Security_GUID_t candidate_participant_guid;
+    DDS_Security_SecurityException exception = {NULL, 0, 0};
+    DDS_Security_GuidPrefix_t prefix = {0xf0, 0xf1, 0xf2, 0xf3, 0xf4, 0xf5, 0xf6, 0xf7, 0xf8, 0xf9, 0xfa, 0xfb};
+    DDS_Security_EntityId_t entityId = {{0xa0,0xa1,0xa2},0x1};
+
+    /* Check if we actually have the validate_local_identity() function. */
+    CU_ASSERT_FATAL (auth != NULL);
+    CU_ASSERT_FATAL (auth->validate_local_identity != NULL);
+
+    memset(&adjusted_participant_guid, 0, sizeof(adjusted_participant_guid));
+    memcpy(&candidate_participant_guid.prefix, &prefix, sizeof(prefix));
+    memcpy(&candidate_participant_guid.entityId, &entityId, sizeof(entityId));
+
+    fill_participant_qos(&participant_qos, false, identity_certificate,
+                                           false, identity_ca,
+                                           false, private_key_w_password,
+                                           private_key_password, NULL);
+    /* Now call the function. */
+    result = auth->validate_local_identity(
+                            auth,
+                            &local_identity_handle,
+                            &adjusted_participant_guid,
+                            domain_id,
+                            &participant_qos,
+                            &candidate_participant_guid,
+                            &exception);
+
+    if (result != DDS_SECURITY_VALIDATION_OK) {
+        printf("validate_local_identity_failed: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+
+    /* We expected the validation to have succeeded. */
+    CU_ASSERT (result == DDS_SECURITY_VALIDATION_OK);
+    CU_ASSERT (local_identity_handle != DDS_SECURITY_HANDLE_NIL);
+
+    print_guid("adjusted_participant_guid", &adjusted_participant_guid);
+    CU_ASSERT (memcmp(&adjusted_participant_guid.entityId, &entityId, sizeof(entityId)) == 0);
+
+    dds_security_property_deinit(&participant_qos.property.value);
+    reset_exception(&exception);
+
+    /* test with file  */
+    memset(&adjusted_participant_guid, 0, sizeof(adjusted_participant_guid));
+    memcpy(&candidate_participant_guid.prefix, &prefix, sizeof(prefix));
+    memcpy(&candidate_participant_guid.entityId, &entityId, sizeof(entityId));
+
+    fill_participant_qos(&participant_qos, false, identity_certificate,
+                                           false, identity_ca,
+                                           true, private_key_w_password_filename,
+                                           private_key_password, NULL);
+    /* Now call the function. */
+    result = auth->validate_local_identity(
+                            auth,
+                            &local_identity_handle,
+                            &adjusted_participant_guid,
+                            domain_id,
+                            &participant_qos,
+                            &candidate_participant_guid,
+                            &exception);
+
+    if (result != DDS_SECURITY_VALIDATION_OK) {
+        printf("validate_local_identity_failed: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+
+    /* We expected the validation to have succeeded. */
+    CU_ASSERT (result == DDS_SECURITY_VALIDATION_OK);
+    CU_ASSERT (local_identity_handle != DDS_SECURITY_HANDLE_NIL);
+
+    print_guid("adjusted_participant_guid", &adjusted_participant_guid);
+    CU_ASSERT (memcmp(&adjusted_participant_guid.entityId, &entityId, sizeof(entityId)) == 0);
+
+    dds_security_property_deinit(&participant_qos.property.value);
+    reset_exception(&exception);
+}
+
+CU_Test(ddssec_builtin_validate_local_identity,encrypted_key_no_password)
+{
+    DDS_Security_ValidationResult_t result;
+    DDS_Security_IdentityHandle local_identity_handle = DDS_SECURITY_HANDLE_NIL;
+    DDS_Security_GUID_t adjusted_participant_guid;
+    DDS_Security_DomainId domain_id = 0;
+    DDS_Security_Qos participant_qos;
+    DDS_Security_GUID_t candidate_participant_guid;
+    DDS_Security_SecurityException exception = {NULL, 0, 0};
+    DDS_Security_GuidPrefix_t prefix = {0xf0, 0xf1, 0xf2, 0xf3, 0xf4, 0xf5, 0xf6, 0xf7, 0xf8, 0xf9, 0xfa, 0xfb};
+    DDS_Security_EntityId_t entityId = {{0xa0,0xa1,0xa2},0x1};
+
+    /* Check if we actually have the validate_local_identity() function. */
+    CU_ASSERT_FATAL (auth != NULL);
+    CU_ASSERT_FATAL (auth->validate_local_identity != NULL);
+
+    memset(&adjusted_participant_guid, 0, sizeof(adjusted_participant_guid));
+    memcpy(&candidate_participant_guid.prefix, &prefix, sizeof(prefix));
+    memcpy(&candidate_participant_guid.entityId, &entityId, sizeof(entityId));
+
+    fill_participant_qos(&participant_qos, false, identity_certificate,
+                                           false, identity_ca,
+                                           false, private_key_w_password,
+                                           NULL,
+                                           NULL);
+    /* Now call the function. */
+    result = auth->validate_local_identity(
+                            auth,
+                            &local_identity_handle,
+                            &adjusted_participant_guid,
+                            domain_id,
+                            &participant_qos,
+                            &candidate_participant_guid,
+                            &exception);
+
+    /* We expected the validation to have succeeded. */
+    CU_ASSERT (result != DDS_SECURITY_VALIDATION_OK);
+    CU_ASSERT (exception.minor_code != 0);
+    CU_ASSERT (exception.message != NULL);
+
+    dds_security_property_deinit(&participant_qos.property.value);
+    reset_exception(&exception);
+
+    /*test with file */
+    memset(&adjusted_participant_guid, 0, sizeof(adjusted_participant_guid));
+    memcpy(&candidate_participant_guid.prefix, &prefix, sizeof(prefix));
+    memcpy(&candidate_participant_guid.entityId, &entityId, sizeof(entityId));
+
+    fill_participant_qos(&participant_qos, false, identity_certificate,
+                                           false, identity_ca,
+                                           true, private_key_w_password_filename,
+                                           NULL,
+                                           NULL);
+    /* Now call the function. */
+    result = auth->validate_local_identity(
+                            auth,
+                            &local_identity_handle,
+                            &adjusted_participant_guid,
+                            domain_id,
+                            &participant_qos,
+                            &candidate_participant_guid,
+                            &exception);
+
+    /* We expected the validation to have succeeded. */
+    CU_ASSERT (result != DDS_SECURITY_VALIDATION_OK);
+    CU_ASSERT (exception.minor_code != 0);
+    CU_ASSERT (exception.message != NULL);
+
+    dds_security_property_deinit(&participant_qos.property.value);
+    reset_exception(&exception);
+}
+
+CU_Test(ddssec_builtin_validate_local_identity,encrypted_key_invalid_password)
+{
+    DDS_Security_ValidationResult_t result;
+    DDS_Security_IdentityHandle local_identity_handle = DDS_SECURITY_HANDLE_NIL;
+    DDS_Security_GUID_t adjusted_participant_guid;
+    DDS_Security_DomainId domain_id = 0;
+    DDS_Security_Qos participant_qos;
+    DDS_Security_GUID_t candidate_participant_guid;
+    DDS_Security_SecurityException exception = {NULL, 0, 0};
+    DDS_Security_GuidPrefix_t prefix = {0xf0, 0xf1, 0xf2, 0xf3, 0xf4, 0xf5, 0xf6, 0xf7, 0xf8, 0xf9, 0xfa, 0xfb};
+    DDS_Security_EntityId_t entityId = {{0xa0,0xa1,0xa2},0x1};
+
+    /* Check if we actually have the validate_local_identity() function. */
+    CU_ASSERT_FATAL (auth != NULL);
+    CU_ASSERT_FATAL (auth->validate_local_identity != NULL);
+
+    memset(&adjusted_participant_guid, 0, sizeof(adjusted_participant_guid));
+    memcpy(&candidate_participant_guid.prefix, &prefix, sizeof(prefix));
+    memcpy(&candidate_participant_guid.entityId, &entityId, sizeof(entityId));
+
+    fill_participant_qos(&participant_qos, false, identity_certificate,
+                                           false, identity_ca,
+                                           false, private_key_w_password,
+                                           "invalid",
+                                           NULL);
+
+    /* Now call the function. */
+    result = auth->validate_local_identity(
+                            auth,
+                            &local_identity_handle,
+                            &adjusted_participant_guid,
+                            domain_id,
+                            &participant_qos,
+                            &candidate_participant_guid,
+                            &exception);
+
+    if (result != DDS_SECURITY_VALIDATION_OK) {
+        printf("validate_local_identity_failed: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+
+    /* We expected the validation to have succeeded. */
+    CU_ASSERT (result != DDS_SECURITY_VALIDATION_OK);
+    CU_ASSERT (exception.minor_code != 0);
+    CU_ASSERT (exception.message != NULL);
+
+    dds_security_property_deinit(&participant_qos.property.value);
+    reset_exception(&exception);
+
+    /*test with file */
+
+    memset(&adjusted_participant_guid, 0, sizeof(adjusted_participant_guid));
+    memcpy(&candidate_participant_guid.prefix, &prefix, sizeof(prefix));
+    memcpy(&candidate_participant_guid.entityId, &entityId, sizeof(entityId));
+
+    fill_participant_qos(&participant_qos, false, identity_certificate,
+                                           false, identity_ca,
+                                           true, private_key_w_password_filename,
+                                           "invalid",
+                                           NULL);
+
+    /* Now call the function. */
+    result = auth->validate_local_identity(
+                            auth,
+                            &local_identity_handle,
+                            &adjusted_participant_guid,
+                            domain_id,
+                            &participant_qos,
+                            &candidate_participant_guid,
+                            &exception);
+
+    if (result != DDS_SECURITY_VALIDATION_OK) {
+        printf("validate_local_identity_failed: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+
+    /* We expected the validation to have succeeded. */
+    CU_ASSERT (result != DDS_SECURITY_VALIDATION_OK);
+    CU_ASSERT (exception.minor_code != 0);
+    CU_ASSERT (exception.message != NULL);
+
+    dds_security_property_deinit(&participant_qos.property.value);
+    reset_exception(&exception);
+}
+
+CU_Test(ddssec_builtin_validate_local_identity,happy_day_eliptic)
+{
+    DDS_Security_ValidationResult_t result;
+    DDS_Security_IdentityHandle local_identity_handle = DDS_SECURITY_HANDLE_NIL;
+    DDS_Security_GUID_t adjusted_participant_guid;
+    DDS_Security_DomainId domain_id = 0;
+    DDS_Security_Qos participant_qos;
+    DDS_Security_GUID_t candidate_participant_guid;
+    DDS_Security_SecurityException exception = {NULL, 0, 0};
+    DDS_Security_GuidPrefix_t prefix = {0xf0, 0xf1, 0xf2, 0xf3, 0xf4, 0xf5, 0xf6, 0xf7, 0xf8, 0xf9, 0xfa, 0xfb};
+    DDS_Security_EntityId_t entityId = {{0xa0,0xa1,0xa2},0x1};
+    DDS_Security_boolean success;
+
+    /* Check if we actually have the validate_local_identity() function. */
+    CU_ASSERT_FATAL (auth != NULL);
+    CU_ASSERT_FATAL (auth->validate_local_identity != NULL);
+
+    memset(&adjusted_participant_guid, 0, sizeof(adjusted_participant_guid));
+    memcpy(&candidate_participant_guid.prefix, &prefix, sizeof(prefix));
+    memcpy(&candidate_participant_guid.entityId, &entityId, sizeof(entityId));
+
+    fill_participant_qos(&participant_qos, false, ec_identity_certificate,
+                                           false, ec_identity_ca,
+                                           false, ec_private_key,
+                                           NULL,
+                                           NULL);
+    /* Now call the function. */
+    result = auth->validate_local_identity(
+                            auth,
+                            &local_identity_handle,
+                            &adjusted_participant_guid,
+                            domain_id,
+                            &participant_qos,
+                            &candidate_participant_guid,
+                            &exception);
+
+    if (result != DDS_SECURITY_VALIDATION_OK) {
+        printf("validate_local_identity_failed: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+
+    /* We expected the validation to have succeeded. */
+    CU_ASSERT_FATAL (result == DDS_SECURITY_VALIDATION_OK);
+    CU_ASSERT (local_identity_handle != DDS_SECURITY_HANDLE_NIL);
+
+    print_guid("adjusted_participant_guid", &adjusted_participant_guid);
+    CU_ASSERT (memcmp(&adjusted_participant_guid.entityId, &entityId, sizeof(entityId)) == 0);
+
+    dds_security_property_deinit(&participant_qos.property.value);
+    reset_exception(&exception);
+
+    success = auth->return_identity_handle(auth, local_identity_handle, &exception);
+    CU_ASSERT_TRUE (success);
+
+    if (!success) {
+        printf("return_identity_handle failed: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+    reset_exception(&exception);
+
+    /* test with file */
+    memset(&adjusted_participant_guid, 0, sizeof(adjusted_participant_guid));
+    memcpy(&candidate_participant_guid.prefix, &prefix, sizeof(prefix));
+    memcpy(&candidate_participant_guid.entityId, &entityId, sizeof(entityId));
+
+    fill_participant_qos(&participant_qos, true, ec_identity_certificate_filename,
+                                           true, ec_identity_ca_filename,
+                                           true, ec_private_key_filename,
+                                           NULL,
+                                           NULL);
+    /* Now call the function. */
+    result = auth->validate_local_identity(
+                            auth,
+                            &local_identity_handle,
+                            &adjusted_participant_guid,
+                            domain_id,
+                            &participant_qos,
+                            &candidate_participant_guid,
+                            &exception);
+
+    if (result != DDS_SECURITY_VALIDATION_OK) {
+        printf("validate_local_identity_failed: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+
+    /* We expected the validation to have succeeded. */
+    CU_ASSERT_FATAL (result == DDS_SECURITY_VALIDATION_OK);
+    CU_ASSERT (local_identity_handle != DDS_SECURITY_HANDLE_NIL);
+
+    print_guid("adjusted_participant_guid", &adjusted_participant_guid);
+    CU_ASSERT (memcmp(&adjusted_participant_guid.entityId, &entityId, sizeof(entityId)) == 0);
+
+    dds_security_property_deinit(&participant_qos.property.value);
+    reset_exception(&exception);
+
+    success = auth->return_identity_handle(auth, local_identity_handle, &exception);
+    CU_ASSERT_TRUE (success);
+
+    if (!success) {
+        printf("return_identity_handle failed: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+    reset_exception(&exception);
+
+}
+
+
+CU_Test(ddssec_builtin_validate_local_identity,encrypted_ec_key)
+{
+    DDS_Security_ValidationResult_t result;
+    DDS_Security_IdentityHandle local_identity_handle = DDS_SECURITY_HANDLE_NIL;
+    DDS_Security_GUID_t adjusted_participant_guid;
+    DDS_Security_DomainId domain_id = 0;
+    DDS_Security_Qos participant_qos;
+    DDS_Security_GUID_t candidate_participant_guid;
+    DDS_Security_SecurityException exception = {NULL, 0, 0};
+    DDS_Security_GuidPrefix_t prefix = {0xf0, 0xf1, 0xf2, 0xf3, 0xf4, 0xf5, 0xf6, 0xf7, 0xf8, 0xf9, 0xfa, 0xfb};
+    DDS_Security_EntityId_t entityId = {{0xa0,0xa1,0xa2},0x1};
+
+    /* Check if we actually have the validate_local_identity() function. */
+    CU_ASSERT_FATAL (auth != NULL);
+    CU_ASSERT_FATAL (auth->validate_local_identity != NULL);
+
+    memset(&adjusted_participant_guid, 0, sizeof(adjusted_participant_guid));
+    memcpy(&candidate_participant_guid.prefix, &prefix, sizeof(prefix));
+    memcpy(&candidate_participant_guid.entityId, &entityId, sizeof(entityId));
+
+    fill_participant_qos(&participant_qos, false, ec_identity_certificate,
+                                           false, ec_identity_ca,
+                                           false, ec_private_key_w_password,
+                                           ec_password,
+                                           NULL);
+    /* Now call the function. */
+    result = auth->validate_local_identity(
+                            auth,
+                            &local_identity_handle,
+                            &adjusted_participant_guid,
+                            domain_id,
+                            &participant_qos,
+                            &candidate_participant_guid,
+                            &exception);
+
+    if (result != DDS_SECURITY_VALIDATION_OK) {
+        printf("validate_local_identity_failed: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+
+    /* We expected the validation to have succeeded. */
+    CU_ASSERT_FATAL (result == DDS_SECURITY_VALIDATION_OK);
+    CU_ASSERT_FATAL (local_identity_handle != DDS_SECURITY_HANDLE_NIL);
+
+    print_guid("adjusted_participant_guid", &adjusted_participant_guid);
+    CU_ASSERT_FATAL (memcmp(&adjusted_participant_guid.entityId, &entityId, sizeof(entityId)) == 0);
+
+    dds_security_property_deinit(&participant_qos.property.value);
+    reset_exception(&exception);
+
+    /* test with file  */
+    memset(&adjusted_participant_guid, 0, sizeof(adjusted_participant_guid));
+    memcpy(&candidate_participant_guid.prefix, &prefix, sizeof(prefix));
+    memcpy(&candidate_participant_guid.entityId, &entityId, sizeof(entityId));
+
+    fill_participant_qos(&participant_qos, false, ec_identity_certificate,
+                    false, ec_identity_ca,
+                    true, ec_private_key_w_password_filename,
+                    ec_password,
+                    NULL);
+    /* Now call the function. */
+    result = auth->validate_local_identity(
+                            auth,
+                            &local_identity_handle,
+                            &adjusted_participant_guid,
+                            domain_id,
+                            &participant_qos,
+                            &candidate_participant_guid,
+                            &exception);
+
+    if (result != DDS_SECURITY_VALIDATION_OK) {
+        printf("validate_local_identity_failed: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+
+    /* We expected the validation to have succeeded. */
+    CU_ASSERT (result == DDS_SECURITY_VALIDATION_OK);
+    CU_ASSERT (local_identity_handle != DDS_SECURITY_HANDLE_NIL);
+
+    CU_ASSERT (memcmp(&adjusted_participant_guid.entityId, &entityId, sizeof(entityId)) == 0);
+
+    dds_security_property_deinit(&participant_qos.property.value);
+    reset_exception(&exception);
+}
+
+CU_Test(ddssec_builtin_validate_local_identity,elliptic_unsupported_certificate)
+{
+    DDS_Security_ValidationResult_t result;
+    DDS_Security_IdentityHandle local_identity_handle = DDS_SECURITY_HANDLE_NIL;
+    DDS_Security_GUID_t adjusted_participant_guid;
+    DDS_Security_DomainId domain_id = 0;
+    DDS_Security_Qos participant_qos;
+    DDS_Security_GUID_t candidate_participant_guid;
+    DDS_Security_SecurityException exception = {NULL, 0, 0};
+    DDS_Security_GuidPrefix_t prefix = {0xf0, 0xf1, 0xf2, 0xf3, 0xf4, 0xf5, 0xf6, 0xf7, 0xf8, 0xf9, 0xfa, 0xfb};
+    DDS_Security_EntityId_t entityId = {{0xa0,0xa1,0xa2},0x1};
+
+    /* Check if we actually have the validate_local_identity() function. */
+    CU_ASSERT_FATAL (auth != NULL);
+    CU_ASSERT_FATAL (auth->validate_local_identity != NULL);
+
+    memset(&adjusted_participant_guid, 0, sizeof(adjusted_participant_guid));
+    memcpy(&candidate_participant_guid.prefix, &prefix, sizeof(prefix));
+    memcpy(&candidate_participant_guid.entityId, &entityId, sizeof(entityId));
+
+    memset(&participant_qos, 0, sizeof(participant_qos));
+    dds_security_property_init(&participant_qos.property.value, 3);
+    participant_qos.property.value._buffer[0].name = ddsrt_strdup(PROPERTY_IDENTITY_CERT);
+    participant_qos.property.value._buffer[0].value = ddsrt_strdup(ec_identity_certificate_unsupported);
+    participant_qos.property.value._buffer[1].name = ddsrt_strdup(PROPERTY_IDENTITY_CA);
+    participant_qos.property.value._buffer[1].value = ddsrt_strdup(ec_identity_ca);
+    participant_qos.property.value._buffer[2].name = ddsrt_strdup(PROPERTY_PRIVATE_KEY);
+    participant_qos.property.value._buffer[2].value = ddsrt_strdup(ec_private_key);
+
+    /* Now call the function. */
+    result = auth->validate_local_identity(
+                            auth,
+                            &local_identity_handle,
+                            &adjusted_participant_guid,
+                            domain_id,
+                            &participant_qos,
+                            &candidate_participant_guid,
+                            &exception);
+
+    if (result != DDS_SECURITY_VALIDATION_OK) {
+        printf("validate_local_identity_failed: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+
+    /* We expected the validation to have succeeded. */
+    CU_ASSERT (result != DDS_SECURITY_VALIDATION_OK);
+    CU_ASSERT (exception.minor_code != 0);
+    CU_ASSERT (exception.message != NULL);
+
+    dds_security_property_deinit(&participant_qos.property.value);
+    reset_exception(&exception);
+}
+
+CU_Test(ddssec_builtin_validate_local_identity,elliptic_unsupported_private_key)
+{
+    DDS_Security_ValidationResult_t result;
+    DDS_Security_IdentityHandle local_identity_handle = DDS_SECURITY_HANDLE_NIL;
+    DDS_Security_GUID_t adjusted_participant_guid;
+    DDS_Security_DomainId domain_id = 0;
+    DDS_Security_Qos participant_qos;
+    DDS_Security_GUID_t candidate_participant_guid;
+    DDS_Security_SecurityException exception = {NULL, 0, 0};
+    DDS_Security_GuidPrefix_t prefix = {0xf0, 0xf1, 0xf2, 0xf3, 0xf4, 0xf5, 0xf6, 0xf7, 0xf8, 0xf9, 0xfa, 0xfb};
+    DDS_Security_EntityId_t entityId = {{0xa0,0xa1,0xa2},0x1};
+
+    /* Check if we actually have the validate_local_identity() function. */
+    CU_ASSERT_FATAL (auth != NULL);
+    CU_ASSERT_FATAL (auth->validate_local_identity != NULL);
+
+    memset(&adjusted_participant_guid, 0, sizeof(adjusted_participant_guid));
+    memcpy(&candidate_participant_guid.prefix, &prefix, sizeof(prefix));
+    memcpy(&candidate_participant_guid.entityId, &entityId, sizeof(entityId));
+
+    memset(&participant_qos, 0, sizeof(participant_qos));
+    dds_security_property_init(&participant_qos.property.value, 3);
+    participant_qos.property.value._buffer[0].name = ddsrt_strdup(PROPERTY_IDENTITY_CERT);
+    participant_qos.property.value._buffer[0].value = ddsrt_strdup(ec_identity_certificate);
+    participant_qos.property.value._buffer[1].name = ddsrt_strdup(PROPERTY_IDENTITY_CA);
+    participant_qos.property.value._buffer[1].value = ddsrt_strdup(ec_identity_ca);
+    participant_qos.property.value._buffer[2].name = ddsrt_strdup(PROPERTY_PRIVATE_KEY);
+    participant_qos.property.value._buffer[2].value = ddsrt_strdup(ec_private_key_unsupported);
+
+    /* Now call the function. */
+    result = auth->validate_local_identity(
+                            auth,
+                            &local_identity_handle,
+                            &adjusted_participant_guid,
+                            domain_id,
+                            &participant_qos,
+                            &candidate_participant_guid,
+                            &exception);
+
+    if (result != DDS_SECURITY_VALIDATION_OK) {
+        printf("validate_local_identity_failed: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+
+    /* We expected the validation to have succeeded. */
+    CU_ASSERT (result != DDS_SECURITY_VALIDATION_OK);
+    CU_ASSERT (exception.minor_code != 0);
+    CU_ASSERT (exception.message != NULL);
+
+    dds_security_property_deinit(&participant_qos.property.value);
+    reset_exception(&exception);
+}
+
+CU_Test(ddssec_builtin_validate_local_identity,return_freed_handle)
+{
+    DDS_Security_ValidationResult_t result;
+    DDS_Security_IdentityHandle local_identity_handle = DDS_SECURITY_HANDLE_NIL;
+    DDS_Security_GUID_t adjusted_participant_guid;
+    DDS_Security_DomainId domain_id = 0;
+    DDS_Security_Qos participant_qos;
+    DDS_Security_GUID_t candidate_participant_guid;
+    DDS_Security_SecurityException exception = {NULL, 0, 0};
+    DDS_Security_GuidPrefix_t prefix = {0xf0, 0xf1, 0xf2, 0xf3, 0xf4, 0xf5, 0xf6, 0xf7, 0xf8, 0xf9, 0xfa, 0xfb};
+    DDS_Security_EntityId_t entityId = {{0xa0,0xa1,0xa2},0x1};
+    DDS_Security_boolean success;
+
+    /* Check if we actually have the validate_local_identity() function. */
+    CU_ASSERT_FATAL (auth != NULL);
+    CU_ASSERT_FATAL (auth->validate_local_identity != NULL);
+
+    memset(&adjusted_participant_guid, 0, sizeof(adjusted_participant_guid));
+    memcpy(&candidate_participant_guid.prefix, &prefix, sizeof(prefix));
+    memcpy(&candidate_participant_guid.entityId, &entityId, sizeof(entityId));
+
+    memset(&participant_qos, 0, sizeof(participant_qos));
+    dds_security_property_init(&participant_qos.property.value, 3);
+    participant_qos.property.value._buffer[0].name = ddsrt_strdup(PROPERTY_IDENTITY_CERT);
+    participant_qos.property.value._buffer[0].value = ddsrt_strdup(identity_certificate);
+    participant_qos.property.value._buffer[1].name = ddsrt_strdup(PROPERTY_IDENTITY_CA);
+    participant_qos.property.value._buffer[1].value = ddsrt_strdup(identity_ca);
+    participant_qos.property.value._buffer[2].name = ddsrt_strdup(PROPERTY_PRIVATE_KEY);
+    participant_qos.property.value._buffer[2].value = ddsrt_strdup(private_key_pem);
+
+    /* Now call the function. */
+    result = auth->validate_local_identity(
+                            auth,
+                            &local_identity_handle,
+                            &adjusted_participant_guid,
+                            domain_id,
+                            &participant_qos,
+                            &candidate_participant_guid,
+                            &exception);
+
+    if (result != DDS_SECURITY_VALIDATION_OK) {
+        printf("validate_local_identity_failed: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+
+    /* We expected the validation to have succeeded. */
+    CU_ASSERT_FATAL (result == DDS_SECURITY_VALIDATION_OK);
+    CU_ASSERT (local_identity_handle != DDS_SECURITY_HANDLE_NIL);
+
+    print_guid("adjusted_participant_guid", &adjusted_participant_guid);
+    CU_ASSERT (memcmp(&adjusted_participant_guid.entityId, &entityId, sizeof(entityId)) == 0);
+
+    dds_security_property_deinit(&participant_qos.property.value);
+    reset_exception(&exception);
+
+    success = auth->return_identity_handle(auth, local_identity_handle, &exception);
+    CU_ASSERT_FATAL (success);
+
+    if (!success) {
+        printf("return_identity_handle failed: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+    reset_exception(&exception);
+
+    success = auth->return_identity_handle(auth, local_identity_handle, &exception);
+    CU_ASSERT_FALSE (success);
+    CU_ASSERT (exception.minor_code != 0);
+    CU_ASSERT (exception.message != NULL);
+
+    if (!success) {
+        printf("return_identity_handle failed: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+    reset_exception(&exception);
+}
+
+
+CU_Test(ddssec_builtin_validate_local_identity,no_file)
+{
+    DDS_Security_ValidationResult_t result;
+    DDS_Security_IdentityHandle local_identity_handle = DDS_SECURITY_HANDLE_NIL;
+    DDS_Security_GUID_t adjusted_participant_guid;
+    DDS_Security_DomainId domain_id = 0;
+    DDS_Security_Qos participant_qos;
+    DDS_Security_GUID_t candidate_participant_guid;
+    DDS_Security_SecurityException exception = {NULL, 0, 0};
+    DDS_Security_GuidPrefix_t prefix = {0xf0, 0xf1, 0xf2, 0xf3, 0xf4, 0xf5, 0xf6, 0xf7, 0xf8, 0xf9, 0xfa, 0xfb};
+    DDS_Security_EntityId_t entityId = {{0xa0,0xa1,0xa2},0x1};
+
+    /* Check if we actually have the validate_local_identity() function. */
+    CU_ASSERT_FATAL (auth != NULL);
+    CU_ASSERT_FATAL (auth->validate_local_identity != NULL);
+
+    /* validate with file */
+    memset(&adjusted_participant_guid, 0, sizeof(adjusted_participant_guid));
+    memcpy(&candidate_participant_guid.prefix, &prefix, sizeof(prefix));
+    memcpy(&candidate_participant_guid.entityId, &entityId, sizeof(entityId));
+
+    fill_participant_qos(&participant_qos, true, identity_certificate_filename,
+                    false, identity_ca,
+                    true, "invalid_filename",
+                    NULL,
+                                           NULL);
+
+    /* Now call the function. */
+    result = auth->validate_local_identity(
+                            auth,
+                            &local_identity_handle,
+                            &adjusted_participant_guid,
+                            domain_id,
+                            &participant_qos,
+                            &candidate_participant_guid,
+                            &exception);
+
+    if (result != DDS_SECURITY_VALIDATION_OK) {
+        printf("validate_local_identity_failed: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+
+    /* We expected the validation to have succeeded. */
+    CU_ASSERT_FATAL (result != DDS_SECURITY_VALIDATION_OK);
+    CU_ASSERT_FATAL (local_identity_handle == DDS_SECURITY_HANDLE_NIL);
+
+    dds_security_property_deinit(&participant_qos.property.value);
+    reset_exception(&exception);
+
+    memset(&adjusted_participant_guid, 0, sizeof(adjusted_participant_guid));
+    memcpy(&candidate_participant_guid.prefix, &prefix, sizeof(prefix));
+    memcpy(&candidate_participant_guid.entityId, &entityId, sizeof(entityId));
+
+    fill_participant_qos(&participant_qos, true, identity_certificate_filename,
+                    true, "invalid_filename",
+                    true, private_key_filename,
+                    NULL,
+                                           NULL);
+
+    /* Now call the function. */
+    result = auth->validate_local_identity(
+                            auth,
+                            &local_identity_handle,
+                            &adjusted_participant_guid,
+                            domain_id,
+                            &participant_qos,
+                            &candidate_participant_guid,
+                            &exception);
+
+    if (result != DDS_SECURITY_VALIDATION_OK) {
+        printf("validate_local_identity_failed: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+
+    /* We expected the validation to have succeeded. */
+    CU_ASSERT_FATAL (result != DDS_SECURITY_VALIDATION_OK);
+    CU_ASSERT_FATAL (local_identity_handle == DDS_SECURITY_HANDLE_NIL);
+
+    dds_security_property_deinit(&participant_qos.property.value);
+    reset_exception(&exception);
+
+
+    memset(&adjusted_participant_guid, 0, sizeof(adjusted_participant_guid));
+    memcpy(&candidate_participant_guid.prefix, &prefix, sizeof(prefix));
+    memcpy(&candidate_participant_guid.entityId, &entityId, sizeof(entityId));
+
+    fill_participant_qos(&participant_qos, true, "invalid_filename",
+                    true, identity_ca_filename,
+                    false, private_key_pem,
+                    NULL,
+                                           NULL);
+
+    /* Now call the function. */
+    result = auth->validate_local_identity(
+                            auth,
+                            &local_identity_handle,
+                            &adjusted_participant_guid,
+                            domain_id,
+                            &participant_qos,
+                            &candidate_participant_guid,
+                            &exception);
+
+    if (result != DDS_SECURITY_VALIDATION_OK) {
+        printf("validate_local_identity_failed: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+
+    /* We expected the validation to have succeeded. */
+    CU_ASSERT_FATAL (result != DDS_SECURITY_VALIDATION_OK);
+    CU_ASSERT_FATAL (local_identity_handle == DDS_SECURITY_HANDLE_NIL);
+
+    dds_security_property_deinit(&participant_qos.property.value);
+    reset_exception(&exception);
+
+
+}
+
+/* TODO: Should be enabled after implementing trusted ca dir parsing*/
+#if(0)
+CU _ Test(validate_local_identity,with_extended_certificate_check)
+{
+    DDS_Security_ValidationResult_t result;
+    DDS_Security_IdentityHandle local_identity_handle = DDS_SECURITY_HANDLE_NIL;
+    DDS_Security_GUID_t adjusted_participant_guid;
+    DDS_Security_DomainId domain_id = 0;
+    DDS_Security_Qos participant_qos;
+    DDS_Security_GUID_t candidate_participant_guid;
+    DDS_Security_SecurityException exception = {NULL, 0, 0};
+    DDS_Security_GuidPrefix_t prefix = {0xf0, 0xf1, 0xf2, 0xf3, 0xf4, 0xf5, 0xf6, 0xf7, 0xf8, 0xf9, 0xfa, 0xfb};
+    DDS_Security_EntityId_t entityId = {{0xa0,0xa1,0xa2},0x1};
+    DDS_Security_boolean success;
+
+    /* Check if we actually have the validate_local_identity() function. */
+    CU_ASSERT_FATAL (auth != NULL);
+    CU_ASSERT_FATAL (auth->validate_local_identity != NULL);
+
+    memset(&adjusted_participant_guid, 0, sizeof(adjusted_participant_guid));
+    memcpy(&candidate_participant_guid.prefix, &prefix, sizeof(prefix));
+    memcpy(&candidate_participant_guid.entityId, &entityId, sizeof(entityId));
+
+    fill_participant_qos(&participant_qos, false, identity_certificate,
+                                           false, identity_ca,
+                                           false, private_key,
+                                           NULL,
+                                           "trusted_ca_dir");
+    /* Now call the function. */
+    result = auth->validate_local_identity(
+                            auth,
+                            &local_identity_handle,
+                            &adjusted_participant_guid,
+                            domain_id,
+                            &participant_qos,
+                            &candidate_participant_guid,
+                            &exception);
+
+    if (result != DDS_SECURITY_VALIDATION_OK) {
+        printf("validate_local_identity_failed: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+
+    /* We expected the validation to have succeeded. */
+    CU_ASSERT_FATAL (result == DDS_SECURITY_VALIDATION_OK);
+    CU_ASSERT (local_identity_handle != DDS_SECURITY_HANDLE_NIL);
+
+    print_guid("adjusted_participant_guid", &adjusted_participant_guid);
+    CU_ASSERT (memcmp(&adjusted_participant_guid.entityId, &entityId, sizeof(entityId)) == 0);
+
+    dds_security_property_deinit(&participant_qos.property.value);
+    reset_exception(&exception);
+
+    success = auth->return_identity_handle(auth, local_identity_handle, &exception);
+    CU_ASSERT_TRUE (success);
+
+    local_identity_handle = DDS_SECURITY_HANDLE_NIL;
+    reset_exception(&exception);
+
+    /* validate with file */
+    memset(&adjusted_participant_guid, 0, sizeof(adjusted_participant_guid));
+    memcpy(&candidate_participant_guid.prefix, &prefix, sizeof(prefix));
+    memcpy(&candidate_participant_guid.entityId, &entityId, sizeof(entityId));
+
+    fill_participant_qos(&participant_qos, true, identity_certificate_filename,
+                    true, identity_ca_filename,
+                    true, private_key_filename,
+                    NULL,
+                    "trusted_ca_dir_not_matching");
+
+    /* Now call the function. */
+    result = auth->validate_local_identity(
+                            auth,
+                            &local_identity_handle,
+                            &adjusted_participant_guid,
+                            domain_id,
+                            &participant_qos,
+                            &candidate_participant_guid,
+                            &exception);
+
+
+    /* We expected the validation to have succeeded. */
+    CU_ASSERT_FATAL (result != DDS_SECURITY_VALIDATION_OK);
+    CU_ASSERT (local_identity_handle == DDS_SECURITY_HANDLE_NIL);
+
+    dds_security_property_deinit(&participant_qos.property.value);
+    reset_exception(&exception);
+
+
+}
+#endif
\ No newline at end of file
diff --git a/src/security/builtin_plugins/tests/validate_remote_identity/src/validate_remote_identity_utests.c b/src/security/builtin_plugins/tests/validate_remote_identity/src/validate_remote_identity_utests.c
new file mode 100644
index 0000000..6cbb267
--- /dev/null
+++ b/src/security/builtin_plugins/tests/validate_remote_identity/src/validate_remote_identity_utests.c
@@ -0,0 +1,1140 @@
+
+#include "dds/security/dds_security_api.h"
+#include "dds/security/core/dds_security_serialize.h"
+#include "dds/security/core/dds_security_utils.h"
+#include "dds/security/dds_security_api.h"
+#include "dds/ddsrt/heap.h"
+#include "dds/ddsrt/string.h"
+#include <stdio.h>
+#include <string.h>
+#include "dds/ddsrt/environ.h"
+#include "CUnit/CUnit.h"
+#include "CUnit/Test.h"
+#include "assert.h"
+
+
+/* Test helper includes. */
+#include "common/src/loader.h"
+
+#include "dds/security/dds_security_api.h"
+#include "dds/security/core/dds_security_utils.h"
+
+static const char * AUTH_PROTOCOL_CLASS_ID          = "DDS:Auth:PKI-DH:1.0";
+
+static const char * PROPERTY_IDENTITY_CA            = "dds.sec.auth.identity_ca";
+static const char * PROPERTY_PRIVATE_KEY            = "dds.sec.auth.private_key";
+static const char * PROPERTY_IDENTITY_CERT          = "dds.sec.auth.identity_certificate";
+
+static const char * PROPERTY_CERT_SUBJECT_NAME      = "dds.cert.sn";
+static const char * PROPERTY_CERT_ALGORITHM         = "dds.cert.algo";
+static const char * PROPERTY_CA_SUBJECT_NAME        = "dds.ca.sn";
+static const char * PROPERTY_CA_ALGORITHM           = "dds.ca.aglo";
+
+static const char * SUBJECT_NAME_IDENTITY_CERT      = "CN=CHAM-574 client,O=Some Company,ST=Some-State,C=NL";
+static const char * SUBJECT_NAME_IDENTITY_CA        = "CN=CHAM-574 authority,O=Some Company,ST=Some-State,C=NL";
+
+static const char * SUBJECT_NAME_IDENTITY_CERT_2    = "CN=CHAM-574_1 client,O=Some Company,ST=Some-State,C=NL";
+static const char * SUBJECT_NAME_IDENTITY_CA_2      = "CN=CHAM-574_1 authority,O=Some Company,ST=Some-State,C=NL";
+
+
+static const char * RSA_2048_ALGORITHM_NAME         = "RSA-2048";
+//static const char * EC_PRIME256V1_ALGORITHM_NAME    = "EC-prime256v1";
+
+static const char * AUTH_REQUEST_TOKEN_CLASS_ID         = "DDS:Auth:PKI-DH:1.0+AuthReq";
+static const char * AUTH_REQUEST_TOKEN_FUTURE_PROP_NAME = "future_challenge";
+
+static const char *identity_certificate =
+        "data:,-----BEGIN CERTIFICATE-----\n"
+        "MIIEQTCCAymgAwIBAgIINpuaAAnrQZIwDQYJKoZIhvcNAQELBQAwXzELMAkGA1UE\n"
+        "BhMCTkwxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdp\n"
+        "ZGdpdHMgUHR5IEx0ZDEYMBYGA1UEAxMPQ0hBTTUwMCByb290IGNhMCAXDTE3MDIy\n"
+        "MjIyMjIwMFoYDzIyMjIwMjIyMjIyMjAwWjBcMQswCQYDVQQGEwJOTDETMBEGA1UE\n"
+        "CBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRk\n"
+        "MRUwEwYDVQQDEwxDSEFNNTAwIGNlcnQwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAw\n"
+        "ggEKAoIBAQDCpVhivH/wBIyu74rvQncnSZqKyspN6CvD1pmV9wft5PHhVt9jV79v\n"
+        "gSub5LADoRHAgFdv9duYgBr17Ob6uRrIY4B18CcrCjhQcC4gjx8y2jl9PeYm+qYD\n"
+        "3o44FYBrBq0QCnrQgKsb/qX9Z+Mw/VUiw65x68W876LEHQQoEgT4kxSuagwBoVRk\n"
+        "ePD6fYAKmT4XS3x+O0v+rHESTcsKF6yMadgp7h3eH1b8kJTzSx8JV9Zzq++mxjox\n"
+        "qhbBVP5nDze2hhSIeCkCvSrx7efkgKS4AQXa5/Z44GiAu1TfXXUqdic9rxwD0edn\n"
+        "ajNElnZe7sjok/0yuqvH+2hSqpNva/zpAgMBAAGjggEAMIH9MAwGA1UdDwQFAwMH\n"
+        "/4AwgewGA1UdJQSB5DCB4QYIKwYBBQUHAwEGCCsGAQUFBwMCBggrBgEFBQcDAwYI\n"
+        "KwYBBQUHAwQGCCsGAQUFBwMIBgorBgEEAYI3AgEVBgorBgEEAYI3AgEWBgorBgEE\n"
+        "AYI3CgMBBgorBgEEAYI3CgMDBgorBgEEAYI3CgMEBglghkgBhvhCBAEGCysGAQQB\n"
+        "gjcKAwQBBggrBgEFBQcDBQYIKwYBBQUHAwYGCCsGAQUFBwMHBggrBgEFBQgCAgYK\n"
+        "KwYBBAGCNxQCAgYIKwYBBQUHAwkGCCsGAQUFBwMNBggrBgEFBQcDDgYHKwYBBQID\n"
+        "BTANBgkqhkiG9w0BAQsFAAOCAQEAawdHy0Xw7nTK2ltp91Ion6fJ7hqYuj///zr7\n"
+        "Adt6uonpDh/xl3esuwcFimIJrJrHujnGkL0nLddRCikmnzuBMNDWS6yq0/Ckl/YG\n"
+        "yjNr44dlX24wo+MVAgkj3/8CyWDZ3a8kBg9QT3bs2SqbjmhTrXN1DRyf9S5vJysE\n"
+        "I7V1gTN66BeKL64hOrAlRVrEu8Ds6TWL6Q/YH+61ViZkoLTeSaPjH4nknaFr4C35\n"
+        "iji0JhkyfRHRRVPHFnaj25AkxOrSV64qVKoTMjDl5fji5iMGtjm6iJ7q05ml/qDl\n"
+        "nLotHXemZNvYhbwUmRzbt4Dls9EMH4VRbP85I94nM5TAvtHVNA==\n"
+        "-----END CERTIFICATE-----\n";
+
+
+static const char *identity_ca =
+        "data:,-----BEGIN CERTIFICATE-----\n"
+        "MIIEmTCCA4GgAwIBAgIIZ5gEIUFhO5wwDQYJKoZIhvcNAQELBQAwXzELMAkGA1UE\n"
+        "BhMCTkwxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdp\n"
+        "ZGdpdHMgUHR5IEx0ZDEYMBYGA1UEAxMPQ0hBTTUwMCByb290IGNhMCAXDTE4MDIx\n"
+        "MjE1MDUwMFoYDzIyMjIwMjIyMjIyMjAwWjBfMQswCQYDVQQGEwJOTDETMBEGA1UE\n"
+        "CBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRk\n"
+        "MRgwFgYDVQQDEw9DSEFNNTAwIHJvb3QgY2EwggEiMA0GCSqGSIb3DQEBAQUAA4IB\n"
+        "DwAwggEKAoIBAQC6Fa3TheL+UrdZCp9GhU/2WbneP2t/avUa3muwDttPxeI2XU9k\n"
+        "ZjBR95mAXme4SPXHk5+YDN319AqIje3oKhzky/ngvKH2GkoJKYxWnuDBfMEHdViz\n"
+        "2Q9/xso2ZvH50ukwWa0pfx2/EVV1wRxeQcRd/UVfq3KTJizG0M88mOYvGEAw3LFf\n"
+        "zef7k1aCuOofQmBvLukUudcYpMzfyHFp7lQqU4CcrrR5RtmfiUfrWfdGLea2iPDB\n"
+        "pJgN8ESOMwEHtOTEBDclYnH9L4t7CHQz+fXXS5IWFsDK9fCMQjnxDsDVeNrNzTYL\n"
+        "FaZrMg9S6IUQCEsQWsnq5weS8omOpVLUm9klAgMBAAGjggFVMIIBUTAMBgNVHRME\n"
+        "BTADAQH/MB0GA1UdDgQWBBQg2FZB/j8uWDVnJhjwXkX278znSTAfBgNVHSMEGDAW\n"
+        "gBQg2FZB/j8uWDVnJhjwXkX278znSTAPBgNVHQ8BAf8EBQMDB/+AMIHvBgNVHSUB\n"
+        "Af8EgeQwgeEGCCsGAQUFBwMBBggrBgEFBQcDAgYIKwYBBQUHAwMGCCsGAQUFBwME\n"
+        "BggrBgEFBQcDCAYKKwYBBAGCNwIBFQYKKwYBBAGCNwIBFgYKKwYBBAGCNwoDAQYK\n"
+        "KwYBBAGCNwoDAwYKKwYBBAGCNwoDBAYJYIZIAYb4QgQBBgsrBgEEAYI3CgMEAQYI\n"
+        "KwYBBQUHAwUGCCsGAQUFBwMGBggrBgEFBQcDBwYIKwYBBQUIAgIGCisGAQQBgjcU\n"
+        "AgIGCCsGAQUFBwMJBggrBgEFBQcDDQYIKwYBBQUHAw4GBysGAQUCAwUwDQYJKoZI\n"
+        "hvcNAQELBQADggEBAKHmwejWRwGE1wf1k2rG8SNRV/neGsZ6Qfqf6co3TpR/Wi1s\n"
+        "iZDvSeT/rbqNBS7z34xnG88NIUwu00y78e8Mfon31ZZbK4Uo7fla9/D3ukdJqPQC\n"
+        "LKdbKJjR2kH+KCukY/1rghjJ8/X+t2egBit0LCOdsFCl07Sfksb9kpGUIZSFcYYm\n"
+        "geqhjhoNwxazzHiw+QWHC5HG9248JIizBmy1aymNWuMnPudhjHAnPcsIlqMVNq3t\n"
+        "Rv9ap7S8JeCxHVRPJvJeCwXWvW3dW/v3xH52Yn/fqRblN1w9Fxz5NhopKx0gj/Jd\n"
+        "sw2N4Fk4gaOWEolFpa0bwNw8nAx7moehZpowzfw=\n"
+        "-----END CERTIFICATE-----\n";
+
+
+static const char *private_key =
+        "data:,-----BEGIN RSA PRIVATE KEY-----\n"
+        "MIIEogIBAAKCAQEAwqVYYrx/8ASMru+K70J3J0maisrKTegrw9aZlfcH7eTx4Vbf\n"
+        "Y1e/b4Erm+SwA6ERwIBXb/XbmIAa9ezm+rkayGOAdfAnKwo4UHAuII8fMto5fT3m\n"
+        "JvqmA96OOBWAawatEAp60ICrG/6l/WfjMP1VIsOucevFvO+ixB0EKBIE+JMUrmoM\n"
+        "AaFUZHjw+n2ACpk+F0t8fjtL/qxxEk3LChesjGnYKe4d3h9W/JCU80sfCVfWc6vv\n"
+        "psY6MaoWwVT+Zw83toYUiHgpAr0q8e3n5ICkuAEF2uf2eOBogLtU3111KnYnPa8c\n"
+        "A9HnZ2ozRJZ2Xu7I6JP9Mrqrx/toUqqTb2v86QIDAQABAoIBAC1q32DKkx+yMBFx\n"
+        "m32QiLUGG6VfBC2BixS7MkMnzRXZYgcuehl4FBc0kLRjfB6cqsO8LqrVN1QyMBhK\n"
+        "GutN3c38SbE7RChqzhEW2+yE+Mao3Nk4ZEecHLiyaYT0n25ZtHAVwep823BAzwJ+\n"
+        "BykbM45VEpNKbG1VjSktjBa9faNyZiZAEJEjVyla+6R8N4kHV52LbZcLjvJv3IQ2\n"
+        "iPYRrmMyI5C23qTni0vy7yJbAXBo3CqgSlwie9FARBWT7Puu7F4mF1O1c/SnTysw\n"
+        "Tm3e5FzgfHipQbnRVn0w4rDprPMKmPxMnvf/Wkw0zVgNadp1Tc1I6Yj525DEQ07i\n"
+        "2gIn/gECgYEA4jNnY1u2Eu7x3pAQF3dRO0x35boVtuq9iwQk7q+uaZaK4RJRr+0Y\n"
+        "T68S3bPnfer6SHvcxtST89Bvs/j/Ky4SOaX037UYjFh6T7OIzPl+MzO1yb+VOBT6\n"
+        "D6FVGEJGp8ZAITU1OfJPeTYViUeEC8tHFGoKUCk50FbB6jOf1oKtv/ECgYEA3EnB\n"
+        "Y7kSbJJaUuj9ciFUL/pAno86Cim3VjegK1wKgEiyDb610bhoMErovPwfVJbtcttG\n"
+        "eKJNuwizkRcVbj+vpjDvqqaP5eMxLl6/Nd4haPMJYzGo88Z8NJpwFRNF2KEWjOpQ\n"
+        "2NEvoCeRtVulCJyka2Tpljzw8cOXkxhPOe2UhHkCgYBo3entj0QO7QXm56T+LAvV\n"
+        "0PK45xdQEO3EuCwjGAFk5C0IgUSrqeCeeIzniZMltj1IQ1wsNbtNynEu3530t8wt\n"
+        "O7oVyFBUKGSz9IjUdkpClJOPr6kPMfJoMqRPtdIpz+hFPPSrI6IikKdVWHloOlp+\n"
+        "pVaYqTQrWT1XRY2xli3VEQKBgGySmZN6Cx+h/oywswIGdUT0VdcQhq2to+QFpJba\n"
+        "VX6m1cM6hMip2Ag9U3qZ1SNPBBdBBfm9HQybHE3dj713/C2wHuAAGhpXIM1W+20k\n"
+        "X1knuC/AsSH9aQhQOf/ZMOq1crTfZBuI9q0782/sjGmzMsKPySU4QhUWruVb7OiD\n"
+        "NVkZAoGAEvihW7G+8/iOE40vGHyBqUeopAAWLciTAUIEwM/Oi3BYfNWNTWF/FWNc\n"
+        "nMvCZPYigY8C1vO+1iT2Frtd3CIU+f01Q3fJNJoRLlEiKLNZUJRF48OKUqjKSmsi\n"
+        "w6pucFO40z05YW7utApj4L82rZnOS0pd1tUI1yexqvj0i4ThJfk=\n"
+        "-----END RSA PRIVATE KEY-----\n";
+
+
+
+
+
+static struct plugins_hdl *plugins = NULL;
+static dds_security_authentication *auth = NULL;
+static DDS_Security_IdentityHandle local_identity_handle = DDS_SECURITY_HANDLE_NIL;
+static DDS_Security_GUID_t local_participant_guid;
+
+static void
+dds_security_property_init(
+    DDS_Security_PropertySeq *seq,
+    DDS_Security_unsigned_long size)
+{
+    seq->_length = size;
+    seq->_maximum = size;
+    seq->_buffer = ddsrt_malloc(size * sizeof(DDS_Security_Property_t));
+    memset(seq->_buffer, 0, size * sizeof(DDS_Security_Property_t));
+}
+
+static void
+dds_security_property_deinit(
+    DDS_Security_PropertySeq *seq)
+{
+    uint32_t i;
+
+    for (i = 0; i < seq->_length; i++) {
+        ddsrt_free(seq->_buffer[i].name);
+        ddsrt_free(seq->_buffer[i].value);
+    }
+    ddsrt_free(seq->_buffer);
+}
+
+static void
+reset_exception(
+    DDS_Security_SecurityException *ex)
+{
+    ex->code = 0;
+    ex->minor_code = 0;
+    ddsrt_free(ex->message);
+    ex->message = NULL;
+}
+
+static void
+initialize_identity_token(
+    DDS_Security_IdentityToken *token,
+    const char *certAlgo,
+    const char *caAlgo)
+{
+    memset(token, 0, sizeof(*token));
+
+    token->class_id = ddsrt_strdup(AUTH_PROTOCOL_CLASS_ID);
+    token->properties._maximum = 4;
+    token->properties._length  = 4;
+    token->properties._buffer = DDS_Security_PropertySeq_allocbuf(4);
+
+    token->properties._buffer[0].name = ddsrt_strdup(PROPERTY_CERT_SUBJECT_NAME);
+    token->properties._buffer[0].value = ddsrt_strdup(SUBJECT_NAME_IDENTITY_CERT);
+    token->properties._buffer[0].propagate = true;
+
+    token->properties._buffer[1].name = ddsrt_strdup(PROPERTY_CERT_ALGORITHM);
+    token->properties._buffer[1].value = ddsrt_strdup(certAlgo);
+    token->properties._buffer[1].propagate = true;
+
+    token->properties._buffer[2].name = ddsrt_strdup(PROPERTY_CA_SUBJECT_NAME);
+    token->properties._buffer[2].value = ddsrt_strdup(SUBJECT_NAME_IDENTITY_CA);
+    token->properties._buffer[2].propagate = true;
+
+    token->properties._buffer[3].name = ddsrt_strdup(PROPERTY_CA_ALGORITHM);
+    token->properties._buffer[3].value = ddsrt_strdup(caAlgo);
+    token->properties._buffer[3].propagate = true;
+}
+
+static void
+initialize_identity_token_w_sn(
+    DDS_Security_IdentityToken *token,
+    const char *certSubjName,
+    const char *certAlgo,
+    const char *caSubjName,
+    const char *caAlgo)
+{
+    memset(token, 0, sizeof(*token));
+
+    token->class_id = ddsrt_strdup(AUTH_PROTOCOL_CLASS_ID);
+    token->properties._maximum = 4;
+    token->properties._length  = 4;
+    token->properties._buffer = DDS_Security_PropertySeq_allocbuf(4);
+
+    token->properties._buffer[0].name = ddsrt_strdup(PROPERTY_CERT_SUBJECT_NAME);
+    token->properties._buffer[0].value = ddsrt_strdup(certSubjName);
+    token->properties._buffer[0].propagate = true;
+
+    token->properties._buffer[1].name = ddsrt_strdup(PROPERTY_CERT_ALGORITHM);
+    token->properties._buffer[1].value = ddsrt_strdup(certAlgo);
+    token->properties._buffer[1].propagate = true;
+
+    token->properties._buffer[2].name = ddsrt_strdup(PROPERTY_CA_SUBJECT_NAME);
+    token->properties._buffer[2].value = ddsrt_strdup(caSubjName);
+    token->properties._buffer[2].propagate = true;
+
+    token->properties._buffer[3].name = ddsrt_strdup(PROPERTY_CA_ALGORITHM);
+    token->properties._buffer[3].value = ddsrt_strdup(caAlgo);
+    token->properties._buffer[3].propagate = true;
+}
+
+static void
+deinitialize_identity_token(
+    DDS_Security_IdentityToken *token)
+{
+    DDS_Security_DataHolder_deinit(token);
+}
+
+
+static int
+create_local_identity(void)
+{
+    int res = 0;
+    DDS_Security_ValidationResult_t result;
+    DDS_Security_DomainId domain_id = 0;
+    DDS_Security_Qos participant_qos;
+    DDS_Security_GUID_t candidate_participant_guid;
+    DDS_Security_SecurityException exception = {NULL, 0, 0};
+    DDS_Security_GuidPrefix_t prefix = {0xb0, 0xb1, 0xb2, 0xb3, 0xb4, 0xb5, 0xb6, 0xb7, 0xb8, 0xb9, 0xba, 0xbb};
+    DDS_Security_EntityId_t entityId = {{0xb0,0xb1,0xb2},0x1};
+
+    memset(&local_participant_guid, 0, sizeof(local_participant_guid));
+    memcpy(&candidate_participant_guid.prefix, &prefix, sizeof(prefix));
+    memcpy(&candidate_participant_guid.entityId, &entityId, sizeof(entityId));
+
+    memset(&participant_qos, 0, sizeof(participant_qos));
+    dds_security_property_init(&participant_qos.property.value, 3);
+    participant_qos.property.value._buffer[0].name = ddsrt_strdup(PROPERTY_IDENTITY_CERT);
+    participant_qos.property.value._buffer[0].value = ddsrt_strdup(identity_certificate);
+    participant_qos.property.value._buffer[1].name = ddsrt_strdup(PROPERTY_IDENTITY_CA);
+    participant_qos.property.value._buffer[1].value = ddsrt_strdup(identity_ca);
+    participant_qos.property.value._buffer[2].name = ddsrt_strdup(PROPERTY_PRIVATE_KEY);
+    participant_qos.property.value._buffer[2].value = ddsrt_strdup(private_key);
+
+    /* Now call the function. */
+    result = auth->validate_local_identity(
+                            auth,
+                            &local_identity_handle,
+                            &local_participant_guid,
+                            domain_id,
+                            &participant_qos,
+                            &candidate_participant_guid,
+                            &exception);
+
+    if (result != DDS_SECURITY_VALIDATION_OK) {
+        res = -1;
+        printf("validate_local_identity_failed: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+
+    dds_security_property_deinit(&participant_qos.property.value);
+    reset_exception(&exception);
+
+    return res;
+}
+
+static void
+clear_local_identity(void)
+{
+    DDS_Security_SecurityException exception = {NULL, 0, 0};
+    DDS_Security_boolean success;
+
+    if (local_identity_handle != DDS_SECURITY_HANDLE_NIL) {
+        success = auth->return_identity_handle(auth, local_identity_handle, &exception);
+        if (!success) {
+            printf("return_identity_handle failed: %s\n", exception.message ? exception.message : "Error message missing");
+        }
+        reset_exception(&exception);
+    }
+}
+
+static int
+check_auth_request_token(
+    DDS_Security_AuthRequestMessageToken *token,
+    int notNil)
+{
+    if (notNil) {
+        if (!token->class_id ||
+            (strcmp(token->class_id, AUTH_REQUEST_TOKEN_CLASS_ID) != 0)) {
+            printf("AuthRequestMessageToken has invalid class_id\n");
+            return 0;
+        }
+
+        if (token->binary_properties._length != 1 ||
+            token->binary_properties._buffer == NULL) {
+            printf("AuthRequestMessageToken has binary_properties\n");
+            return 0;
+        }
+
+        if (!token->binary_properties._buffer[0].name ||
+            (strcmp(token->binary_properties._buffer[0].name, AUTH_REQUEST_TOKEN_FUTURE_PROP_NAME) != 0)) {
+            printf("AuthRequestMessageToken has invalid property name\n");
+            return 0;
+        }
+
+        if (token->binary_properties._buffer[0].value._length != 32 ||
+            token->binary_properties._buffer[0].value._buffer == NULL) {
+            printf("AuthRequestMessageToken has invalid property value\n");
+            return 0;
+        }
+    } else {
+        if ((strlen(token->class_id) != 0)             ||
+            (token->properties._length != 0)           ||
+            (token->properties._maximum != 0)          ||
+            (token->binary_properties._buffer != NULL) ||
+            (token->binary_properties._length != 0)    ||
+            (token->binary_properties._maximum != 0)   ||
+            (token->binary_properties._buffer != NULL) ) {
+            printf("AuthRequestMessageToken is not a TokenNil\n");
+            return 0;
+        }
+    }
+    return 1;
+}
+
+static void
+fill_auth_request_token(
+     DDS_Security_AuthRequestMessageToken *token)
+{
+    uint32_t i;
+    uint32_t len = 32;
+    unsigned char *challenge;
+
+    challenge = ddsrt_malloc(len);
+
+    for (i = 0; i < len; i++) {
+        challenge[i] = (unsigned char)(0xFF - i);
+    }
+
+    memset(token, 0, sizeof(*token));
+
+    token->class_id = ddsrt_strdup(AUTH_REQUEST_TOKEN_CLASS_ID);
+    token->binary_properties._maximum = 1;
+    token->binary_properties._length = 1;
+    token->binary_properties._buffer = DDS_Security_BinaryPropertySeq_allocbuf(1);
+    token->binary_properties._buffer->name = ddsrt_strdup(AUTH_REQUEST_TOKEN_FUTURE_PROP_NAME);
+
+    token->binary_properties._buffer->value._maximum = len;
+    token->binary_properties._buffer->value._length = len;
+    token->binary_properties._buffer->value._buffer = challenge;
+}
+
+
+static void
+set_remote_participant_guid(
+    DDS_Security_GUID_t *guid,
+    int higher)
+{
+    int i;
+
+    memcpy(guid, &local_participant_guid, sizeof(*guid));
+
+    for (i = 0; i < 12; i++) {
+        int index = (i + 4) % 12;
+        if (higher) {
+            if (guid->prefix[index] < 0xFF) {
+                guid->prefix[index]++;
+                /*NOTE: It was giving warning ("unsigned char from ‘int’ may alter its value")  with below
+                guid->prefix[index] += 1;
+                 */
+                break;
+            }
+        } else {
+            if (guid->prefix[index] > 0) {
+                guid->prefix[index]--;
+                /*NOTE: It was giving warning ("unsigned char from ‘int’ may alter its value")  with below
+                guid->prefix[index] -= 1;
+                 */
+                break;
+            }
+        }
+    }
+}
+
+
+CU_Init(ddssec_builtin_validate_remote_identity)
+{
+    int res = 0;
+
+    /* Only need the authentication plugin. */
+    plugins = load_plugins(NULL   /* Access Control */,
+                           &auth  /* Authentication */,
+                           NULL   /* Cryptograpy    */);
+    if (plugins) {
+        res = create_local_identity();
+    } else {
+        res = -1;
+    }
+    return res;
+}
+
+CU_Clean(ddssec_builtin_validate_remote_identity)
+{
+    clear_local_identity();
+    unload_plugins(plugins);
+    return 0;
+}
+
+CU_Test(ddssec_builtin_validate_remote_identity,happy_day_nil_auth_req )
+{
+    DDS_Security_ValidationResult_t result;
+    DDS_Security_IdentityHandle remote_identity_handle = DDS_SECURITY_HANDLE_NIL;
+    DDS_Security_AuthRequestMessageToken local_auth_request_token = DDS_SECURITY_TOKEN_INIT;
+    DDS_Security_IdentityToken remote_identity_token;
+    DDS_Security_GUID_t remote_participant_guid;
+    DDS_Security_SecurityException exception = {NULL, 0, 0};
+
+    /* Check if we actually have validate_local_identity function. */
+    CU_ASSERT (auth != NULL);
+    CU_ASSERT (local_identity_handle != DDS_SECURITY_HANDLE_NIL);
+    CU_ASSERT (auth->validate_remote_identity != NULL);
+
+    if (local_identity_handle == DDS_SECURITY_HANDLE_NIL) {
+        return;
+    }
+
+    initialize_identity_token(&remote_identity_token, RSA_2048_ALGORITHM_NAME, RSA_2048_ALGORITHM_NAME);
+    set_remote_participant_guid(&remote_participant_guid, 1);
+
+    result = auth->validate_remote_identity(
+                auth,
+                &remote_identity_handle,
+                &local_auth_request_token,
+                NULL,
+                local_identity_handle,
+                &remote_identity_token,
+                &remote_participant_guid,
+                &exception);
+
+    if (result == DDS_SECURITY_VALIDATION_FAILED) {
+        printf("validate_local_identity_failed: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+
+    CU_ASSERT (result == DDS_SECURITY_VALIDATION_PENDING_HANDSHAKE_REQUEST);
+    if (result == DDS_SECURITY_VALIDATION_PENDING_HANDSHAKE_REQUEST) {
+        CU_ASSERT (remote_identity_handle != DDS_SECURITY_HANDLE_NIL);
+        CU_ASSERT (check_auth_request_token(&local_auth_request_token, 1));
+    }
+
+    reset_exception(&exception);
+    deinitialize_identity_token(&remote_identity_token);
+    DDS_Security_DataHolder_deinit(&local_auth_request_token);
+
+    if ((result == DDS_SECURITY_VALIDATION_PENDING_HANDSHAKE_REQUEST) ||
+        (result == DDS_SECURITY_VALIDATION_PENDING_HANDSHAKE_MESSAGE)) {
+         DDS_Security_boolean success = auth->return_identity_handle(auth, remote_identity_handle, &exception);
+         CU_ASSERT_TRUE (success);
+
+         if (!success) {
+             printf("return_identity_handle failed: %s\n", exception.message ? exception.message : "Error message missing");
+         }
+         reset_exception(&exception);
+     }
+}
+
+CU_Test(ddssec_builtin_validate_remote_identity,happy_day_with_auth_req )
+{
+    DDS_Security_ValidationResult_t result;
+    DDS_Security_IdentityHandle remote_identity_handle = DDS_SECURITY_HANDLE_NIL;
+    DDS_Security_AuthRequestMessageToken local_auth_request_token = DDS_SECURITY_TOKEN_INIT;
+    DDS_Security_AuthRequestMessageToken remote_auth_request_token;
+    DDS_Security_IdentityToken remote_identity_token;
+    DDS_Security_GUID_t remote_participant_guid;
+    DDS_Security_SecurityException exception = {NULL, 0, 0};
+    DDS_Security_boolean success;
+
+    /* Check if we actually have validate_local_identity function. */
+    CU_ASSERT_FATAL (auth != NULL);
+    CU_ASSERT_FATAL (local_identity_handle != DDS_SECURITY_HANDLE_NIL);
+    CU_ASSERT_FATAL (auth->validate_remote_identity != NULL);
+
+    initialize_identity_token(&remote_identity_token, RSA_2048_ALGORITHM_NAME, RSA_2048_ALGORITHM_NAME);
+    fill_auth_request_token(&remote_auth_request_token);
+    set_remote_participant_guid(&remote_participant_guid, 0);
+
+    result = auth->validate_remote_identity(
+                auth,
+                &remote_identity_handle,
+                &local_auth_request_token,
+                &remote_auth_request_token,
+                local_identity_handle,
+                &remote_identity_token,
+                &remote_participant_guid,
+                &exception);
+
+    if (result == DDS_SECURITY_VALIDATION_FAILED) {
+        printf("validate_local_identity_failed: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+
+    CU_ASSERT_FATAL (result == DDS_SECURITY_VALIDATION_PENDING_HANDSHAKE_MESSAGE);
+    CU_ASSERT (remote_identity_handle != DDS_SECURITY_HANDLE_NIL);
+    CU_ASSERT (check_auth_request_token(&local_auth_request_token, 0));
+
+    reset_exception(&exception);
+    deinitialize_identity_token(&remote_identity_token);
+    DDS_Security_DataHolder_deinit(&remote_auth_request_token);
+    DDS_Security_DataHolder_deinit(&local_auth_request_token);
+
+    success = auth->return_identity_handle(auth, remote_identity_handle, &exception);
+    CU_ASSERT_TRUE (success);
+
+    if (!success) {
+        printf("return_identity_handle failed: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+    reset_exception(&exception);
+}
+
+
+CU_Test(ddssec_builtin_validate_remote_identity,invalid_parameters )
+{
+    DDS_Security_ValidationResult_t result;
+    DDS_Security_IdentityHandle remote_identity_handle = DDS_SECURITY_HANDLE_NIL;
+    DDS_Security_AuthRequestMessageToken local_auth_request_token;
+    DDS_Security_AuthRequestMessageToken remote_auth_request_token;
+    DDS_Security_IdentityToken remote_identity_token;
+    DDS_Security_GUID_t remote_participant_guid;
+    DDS_Security_SecurityException exception = {NULL, 0, 0};
+
+    /* Check if we actually have validate_local_identity function. */
+    CU_ASSERT_FATAL (auth != NULL);
+    CU_ASSERT_FATAL (local_identity_handle != DDS_SECURITY_HANDLE_NIL);
+    CU_ASSERT_FATAL (auth->validate_remote_identity != NULL);
+
+    initialize_identity_token(&remote_identity_token, RSA_2048_ALGORITHM_NAME, RSA_2048_ALGORITHM_NAME);
+    fill_auth_request_token(&remote_auth_request_token);
+    set_remote_participant_guid(&remote_participant_guid, 1);
+
+    result = auth->validate_remote_identity(
+                NULL, &remote_identity_handle, &local_auth_request_token, &remote_auth_request_token,
+                local_identity_handle, &remote_identity_token, &remote_participant_guid, &exception);
+    if (result != DDS_SECURITY_VALIDATION_OK) {
+        printf("validate_local_identity_failed: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+    CU_ASSERT (result == DDS_SECURITY_VALIDATION_FAILED);
+    CU_ASSERT (exception.minor_code != 0);
+    CU_ASSERT (exception.message != NULL);
+    reset_exception(&exception);
+
+    result = auth->validate_remote_identity(
+                auth, NULL, &local_auth_request_token, &remote_auth_request_token,
+                local_identity_handle, &remote_identity_token, &remote_participant_guid, &exception);
+    if (result != DDS_SECURITY_VALIDATION_OK) {
+        printf("validate_local_identity_failed: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+    CU_ASSERT (result == DDS_SECURITY_VALIDATION_FAILED);
+    CU_ASSERT (exception.minor_code != 0);
+    CU_ASSERT (exception.message != NULL);
+    reset_exception(&exception);
+
+    result = auth->validate_remote_identity(
+                auth, &remote_identity_handle, NULL, &remote_auth_request_token,
+                local_identity_handle, &remote_identity_token, &remote_participant_guid, &exception);
+    if (result != DDS_SECURITY_VALIDATION_OK) {
+        printf("validate_local_identity_failed: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+    CU_ASSERT (result == DDS_SECURITY_VALIDATION_FAILED);
+    CU_ASSERT (exception.minor_code != 0);
+    CU_ASSERT (exception.message != NULL);
+    reset_exception(&exception);
+
+    result = auth->validate_remote_identity(
+                auth, &remote_identity_handle, &local_auth_request_token, &remote_auth_request_token,
+                local_identity_handle, NULL, &remote_participant_guid, &exception);
+    if (result != DDS_SECURITY_VALIDATION_OK) {
+        printf("validate_local_identity_failed: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+    CU_ASSERT (result == DDS_SECURITY_VALIDATION_FAILED);
+    CU_ASSERT (exception.minor_code != 0);
+    CU_ASSERT (exception.message != NULL);
+    reset_exception(&exception);
+
+    result = auth->validate_remote_identity(
+                auth, &remote_identity_handle, &local_auth_request_token, &remote_auth_request_token,
+                local_identity_handle, &remote_identity_token, NULL, &exception);
+    if (result != DDS_SECURITY_VALIDATION_OK) {
+        printf("validate_local_identity_failed: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+    CU_ASSERT (result == DDS_SECURITY_VALIDATION_FAILED);
+    CU_ASSERT (exception.minor_code != 0);
+    CU_ASSERT (exception.message != NULL);
+    reset_exception(&exception);
+
+    DDS_Security_DataHolder_deinit(&remote_auth_request_token);
+    deinitialize_identity_token(&remote_identity_token);
+}
+
+CU_Test(ddssec_builtin_validate_remote_identity,unknown_local_identity )
+{
+    DDS_Security_ValidationResult_t result;
+    DDS_Security_IdentityHandle unknown_identity_handle = 0x56;
+    DDS_Security_IdentityHandle remote_identity_handle = DDS_SECURITY_HANDLE_NIL;
+    DDS_Security_AuthRequestMessageToken local_auth_request_token;
+    DDS_Security_AuthRequestMessageToken remote_auth_request_token;
+    DDS_Security_IdentityToken remote_identity_token;
+    DDS_Security_GUID_t remote_participant_guid;
+    DDS_Security_SecurityException exception = {NULL, 0, 0};
+
+    /* Check if we actually have validate_local_identity function. */
+    CU_ASSERT_FATAL (auth != NULL);
+    CU_ASSERT_FATAL (local_identity_handle != DDS_SECURITY_HANDLE_NIL);
+    CU_ASSERT_FATAL (auth->validate_remote_identity != NULL);
+
+    initialize_identity_token(&remote_identity_token, RSA_2048_ALGORITHM_NAME, RSA_2048_ALGORITHM_NAME);
+    fill_auth_request_token(&remote_auth_request_token);
+    set_remote_participant_guid(&remote_participant_guid, 0);
+
+    result = auth->validate_remote_identity(
+                auth,
+                &remote_identity_handle,
+                &local_auth_request_token,
+                &remote_auth_request_token,
+                unknown_identity_handle,
+                &remote_identity_token,
+                &remote_participant_guid,
+                &exception);
+
+    if (result == DDS_SECURITY_VALIDATION_FAILED) {
+        printf("validate_remote_identity_failed: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+
+    CU_ASSERT (result == DDS_SECURITY_VALIDATION_FAILED);
+    CU_ASSERT (exception.minor_code != 0);
+    CU_ASSERT (exception.message != NULL);
+
+    reset_exception(&exception);
+    deinitialize_identity_token(&remote_identity_token);
+    DDS_Security_DataHolder_deinit(&remote_auth_request_token);
+}
+
+
+CU_Test(ddssec_builtin_validate_remote_identity,invalid_remote_identity_token )
+{
+    DDS_Security_ValidationResult_t result;
+    DDS_Security_IdentityHandle remote_identity_handle = DDS_SECURITY_HANDLE_NIL;
+    DDS_Security_AuthRequestMessageToken local_auth_request_token;
+    DDS_Security_AuthRequestMessageToken remote_auth_request_token;
+    DDS_Security_IdentityToken remote_identity_token;
+    DDS_Security_GUID_t remote_participant_guid;
+    DDS_Security_SecurityException exception = {NULL, 0, 0};
+
+    /* Check if we actually have validate_local_identity function. */
+    CU_ASSERT_FATAL (auth != NULL);
+    CU_ASSERT_FATAL (local_identity_handle != DDS_SECURITY_HANDLE_NIL);
+    CU_ASSERT_FATAL (auth->validate_remote_identity != NULL);
+
+    initialize_identity_token(&remote_identity_token, RSA_2048_ALGORITHM_NAME, RSA_2048_ALGORITHM_NAME);
+    fill_auth_request_token(&remote_auth_request_token);
+    set_remote_participant_guid(&remote_participant_guid, 0);
+
+    ddsrt_free(remote_identity_token.class_id);
+    remote_identity_token.class_id = ddsrt_strdup("DDS:Auth:PKI-PH:1.0");
+
+    result = auth->validate_remote_identity(
+                auth,
+                &remote_identity_handle,
+                &local_auth_request_token,
+                &remote_auth_request_token,
+                local_identity_handle,
+                &remote_identity_token,
+                &remote_participant_guid,
+                &exception);
+
+    if (result == DDS_SECURITY_VALIDATION_FAILED) {
+        printf("validate_local_identity_failed: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+
+    CU_ASSERT (result == DDS_SECURITY_VALIDATION_FAILED);
+    CU_ASSERT (exception.minor_code != 0);
+    CU_ASSERT (exception.message != NULL);
+
+    reset_exception(&exception);
+
+    ddsrt_free(remote_identity_token.class_id);
+    remote_identity_token.class_id = ddsrt_strdup("DDS:Auth:PKI-DH:2.0");
+
+    result = auth->validate_remote_identity(
+                auth,
+                &remote_identity_handle,
+                &local_auth_request_token,
+                &remote_auth_request_token,
+                local_identity_handle,
+                &remote_identity_token,
+                &remote_participant_guid,
+                &exception);
+
+    if (result == DDS_SECURITY_VALIDATION_FAILED) {
+        printf("validate_local_identity_failed: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+
+    CU_ASSERT (result == DDS_SECURITY_VALIDATION_FAILED);
+    CU_ASSERT (exception.minor_code != 0);
+    CU_ASSERT (exception.message != NULL);
+
+    reset_exception(&exception);
+
+    deinitialize_identity_token(&remote_identity_token);
+    DDS_Security_DataHolder_deinit(&remote_auth_request_token);
+}
+
+
+CU_Test(ddssec_builtin_validate_remote_identity,invalid_auth_req_token )
+{
+    DDS_Security_ValidationResult_t result;
+    DDS_Security_IdentityHandle remote_identity_handle = DDS_SECURITY_HANDLE_NIL;
+    DDS_Security_AuthRequestMessageToken local_auth_request_token;
+    DDS_Security_AuthRequestMessageToken remote_auth_request_token;
+    DDS_Security_IdentityToken remote_identity_token;
+    DDS_Security_GUID_t remote_participant_guid;
+    DDS_Security_SecurityException exception = {NULL, 0, 0};
+    unsigned char *futureChallenge;
+
+    /* Check if we actually have validate_local_identity function. */
+    CU_ASSERT_FATAL (auth != NULL);
+    CU_ASSERT_FATAL (local_identity_handle != DDS_SECURITY_HANDLE_NIL);
+    CU_ASSERT_FATAL (auth->validate_remote_identity != NULL);
+
+    initialize_identity_token(&remote_identity_token, RSA_2048_ALGORITHM_NAME, RSA_2048_ALGORITHM_NAME);
+    fill_auth_request_token(&remote_auth_request_token);
+    set_remote_participant_guid(&remote_participant_guid, 0);
+
+    /* check invalid class_id (empty) string for class_id */
+    ddsrt_free(remote_auth_request_token.class_id);
+    remote_auth_request_token.class_id = ddsrt_strdup("");
+
+    result = auth->validate_remote_identity(
+            auth,
+            &remote_identity_handle,
+            &local_auth_request_token,
+            &remote_auth_request_token,
+            local_identity_handle,
+            &remote_identity_token,
+            &remote_participant_guid,
+            &exception);
+
+    if (result == DDS_SECURITY_VALIDATION_FAILED) {
+        printf("validate_local_identity_failed: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+
+    CU_ASSERT (result == DDS_SECURITY_VALIDATION_FAILED);
+    CU_ASSERT (exception.minor_code != 0);
+    CU_ASSERT (exception.message != NULL);
+
+    reset_exception(&exception);
+
+    /* check invalid class_id (NULL) string for class_id */
+    ddsrt_free(remote_auth_request_token.class_id);
+    remote_auth_request_token.class_id = NULL;
+
+    result = auth->validate_remote_identity(
+            auth,
+            &remote_identity_handle,
+            &local_auth_request_token,
+            &remote_auth_request_token,
+            local_identity_handle,
+            &remote_identity_token,
+            &remote_participant_guid,
+            &exception);
+
+    if (result == DDS_SECURITY_VALIDATION_FAILED) {
+        printf("validate_local_identity_failed: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+
+    CU_ASSERT (result == DDS_SECURITY_VALIDATION_FAILED);
+    CU_ASSERT (exception.minor_code != 0);
+    CU_ASSERT (exception.message != NULL);
+
+    reset_exception(&exception);
+
+    /* check invalid class_id string for class_id */
+    remote_auth_request_token.class_id = ddsrt_strdup("DDS:Auth:PKI-DH:2.0+AuthReq");
+
+    result = auth->validate_remote_identity(
+            auth,
+            &remote_identity_handle,
+            &local_auth_request_token,
+            &remote_auth_request_token,
+            local_identity_handle,
+            &remote_identity_token,
+            &remote_participant_guid,
+            &exception);
+
+    if (result == DDS_SECURITY_VALIDATION_FAILED) {
+        printf("validate_local_identity_failed: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+
+    CU_ASSERT (result == DDS_SECURITY_VALIDATION_FAILED);
+    CU_ASSERT (exception.minor_code != 0);
+    CU_ASSERT (exception.message != NULL);
+
+    reset_exception(&exception);
+
+    /* check invalid property name (empty) for future_challenge */
+    ddsrt_free(remote_auth_request_token.class_id);
+    remote_auth_request_token.class_id = ddsrt_strdup(AUTH_REQUEST_TOKEN_CLASS_ID);
+    ddsrt_free(remote_auth_request_token.binary_properties._buffer[0].name);
+    remote_auth_request_token.binary_properties._buffer[0].name = ddsrt_strdup("");
+
+    result = auth->validate_remote_identity(
+            auth,
+            &remote_identity_handle,
+            &local_auth_request_token,
+            &remote_auth_request_token,
+            local_identity_handle,
+            &remote_identity_token,
+            &remote_participant_guid,
+            &exception);
+
+    if (result == DDS_SECURITY_VALIDATION_FAILED) {
+        printf("validate_local_identity_failed: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+
+    CU_ASSERT (result == DDS_SECURITY_VALIDATION_FAILED);
+    CU_ASSERT (exception.minor_code != 0);
+    CU_ASSERT (exception.message != NULL);
+
+    reset_exception(&exception);
+
+    /* check invalid property name (NULL) for future_challenge */
+    ddsrt_free(remote_auth_request_token.binary_properties._buffer[0].name);
+    remote_auth_request_token.binary_properties._buffer[0].name = NULL;
+
+    result = auth->validate_remote_identity(
+            auth,
+            &remote_identity_handle,
+            &local_auth_request_token,
+            &remote_auth_request_token,
+            local_identity_handle,
+            &remote_identity_token,
+            &remote_participant_guid,
+            &exception);
+
+    if (result == DDS_SECURITY_VALIDATION_FAILED) {
+        printf("validate_local_identity_failed: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+
+    CU_ASSERT (result == DDS_SECURITY_VALIDATION_FAILED);
+    CU_ASSERT (exception.minor_code != 0);
+    CU_ASSERT (exception.message != NULL);
+
+    reset_exception(&exception);
+
+    /* check invalid property name for future_challenge */
+    ddsrt_free(remote_auth_request_token.binary_properties._buffer[0].name);
+    remote_auth_request_token.binary_properties._buffer[0].name = ddsrt_strdup("challenge");
+
+    result = auth->validate_remote_identity(
+            auth,
+            &remote_identity_handle,
+            &local_auth_request_token,
+            &remote_auth_request_token,
+            local_identity_handle,
+            &remote_identity_token,
+            &remote_participant_guid,
+            &exception);
+
+    if (result == DDS_SECURITY_VALIDATION_FAILED) {
+        printf("validate_local_identity_failed: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+
+    CU_ASSERT (result == DDS_SECURITY_VALIDATION_FAILED);
+    CU_ASSERT (exception.minor_code != 0);
+    CU_ASSERT (exception.message != NULL);
+
+    reset_exception(&exception);
+
+    /* check missing future_challenge property*/
+    ddsrt_free(remote_auth_request_token.binary_properties._buffer[0].name);
+    remote_auth_request_token.binary_properties._buffer[0].name = ddsrt_strdup(AUTH_REQUEST_TOKEN_FUTURE_PROP_NAME);
+    futureChallenge = remote_auth_request_token.binary_properties._buffer[0].value._buffer;
+    remote_auth_request_token.binary_properties._buffer[0].value._buffer = NULL;
+    remote_auth_request_token.binary_properties._buffer[0].value._length = 0;
+    remote_auth_request_token.binary_properties._buffer[0].value._maximum = 0;
+
+    result = auth->validate_remote_identity(
+            auth,
+            &remote_identity_handle,
+            &local_auth_request_token,
+            &remote_auth_request_token,
+            local_identity_handle,
+            &remote_identity_token,
+            &remote_participant_guid,
+            &exception);
+
+    if (result == DDS_SECURITY_VALIDATION_FAILED) {
+        printf("validate_local_identity_failed: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+
+    CU_ASSERT (result == DDS_SECURITY_VALIDATION_FAILED);
+    CU_ASSERT (exception.minor_code != 0);
+    CU_ASSERT (exception.message != NULL);
+
+    reset_exception(&exception);
+
+    /* check incorrect future_challenge property, too small */
+    remote_auth_request_token.binary_properties._buffer[0].value._buffer = futureChallenge;
+    remote_auth_request_token.binary_properties._buffer[0].value._length = 16;
+    remote_auth_request_token.binary_properties._buffer[0].value._maximum = 32;
+
+    result = auth->validate_remote_identity(
+            auth,
+            &remote_identity_handle,
+            &local_auth_request_token,
+            &remote_auth_request_token,
+            local_identity_handle,
+            &remote_identity_token,
+            &remote_participant_guid,
+            &exception);
+
+    if (result == DDS_SECURITY_VALIDATION_FAILED) {
+        printf("validate_local_identity_failed: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+
+    CU_ASSERT (result == DDS_SECURITY_VALIDATION_FAILED);
+    CU_ASSERT (exception.minor_code != 0);
+    CU_ASSERT (exception.message != NULL);
+
+    reset_exception(&exception);
+
+    /* check incorrect future_challenge property: value is NULL */
+    remote_auth_request_token.binary_properties._buffer[0].value._buffer = NULL;
+    remote_auth_request_token.binary_properties._buffer[0].value._length = 32;
+    remote_auth_request_token.binary_properties._buffer[0].value._maximum = 32;
+
+    result = auth->validate_remote_identity(
+            auth,
+            &remote_identity_handle,
+            &local_auth_request_token,
+            &remote_auth_request_token,
+            local_identity_handle,
+            &remote_identity_token,
+            &remote_participant_guid,
+            &exception);
+
+    if (result == DDS_SECURITY_VALIDATION_FAILED) {
+        printf("validate_local_identity_failed: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+
+    CU_ASSERT (result == DDS_SECURITY_VALIDATION_FAILED);
+    CU_ASSERT (exception.minor_code != 0);
+    CU_ASSERT (exception.message != NULL);
+
+    reset_exception(&exception);
+
+    remote_auth_request_token.binary_properties._buffer[0].value._buffer = futureChallenge;
+
+    deinitialize_identity_token(&remote_identity_token);
+    DDS_Security_DataHolder_deinit(&remote_auth_request_token);
+}
+
+CU_Test(ddssec_builtin_validate_remote_identity,already_validated_same_token )
+{
+    DDS_Security_ValidationResult_t result;
+    DDS_Security_IdentityHandle remote_identity_handle = DDS_SECURITY_HANDLE_NIL;
+    DDS_Security_IdentityHandle remote_identity_handle2 = DDS_SECURITY_HANDLE_NIL;
+    DDS_Security_AuthRequestMessageToken local_auth_request_token = DDS_SECURITY_TOKEN_INIT;
+    DDS_Security_AuthRequestMessageToken remote_auth_request_token;
+    DDS_Security_IdentityToken remote_identity_token;
+    DDS_Security_GUID_t remote_participant_guid;
+    DDS_Security_SecurityException exception = {NULL, 0, 0};
+    DDS_Security_boolean success;
+
+    /* Check if we actually have validate_local_identity function. */
+    CU_ASSERT_FATAL (auth != NULL);
+    CU_ASSERT_FATAL (local_identity_handle != DDS_SECURITY_HANDLE_NIL);
+    CU_ASSERT_FATAL (auth->validate_remote_identity != NULL);
+
+    initialize_identity_token(&remote_identity_token, RSA_2048_ALGORITHM_NAME, RSA_2048_ALGORITHM_NAME);
+    fill_auth_request_token(&remote_auth_request_token);
+    set_remote_participant_guid(&remote_participant_guid, 0);
+
+    result = auth->validate_remote_identity(
+                auth,
+                &remote_identity_handle,
+                &local_auth_request_token,
+                &remote_auth_request_token,
+                local_identity_handle,
+                &remote_identity_token,
+                &remote_participant_guid,
+                &exception);
+
+    if (result == DDS_SECURITY_VALIDATION_FAILED) {
+        printf("validate_local_identity_failed: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+
+    CU_ASSERT_FATAL (result == DDS_SECURITY_VALIDATION_PENDING_HANDSHAKE_MESSAGE);
+    CU_ASSERT (remote_identity_handle != DDS_SECURITY_HANDLE_NIL);
+    CU_ASSERT (check_auth_request_token(&local_auth_request_token, 0));
+
+    reset_exception(&exception);
+
+    result = auth->validate_remote_identity(
+                auth,
+                &remote_identity_handle2,
+                &local_auth_request_token,
+                &remote_auth_request_token,
+                local_identity_handle,
+                &remote_identity_token,
+                &remote_participant_guid,
+                &exception);
+
+    if (result == DDS_SECURITY_VALIDATION_FAILED) {
+        printf("validate_local_identity_failed: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+
+    CU_ASSERT_FATAL (result == DDS_SECURITY_VALIDATION_PENDING_HANDSHAKE_MESSAGE);
+    CU_ASSERT (remote_identity_handle == remote_identity_handle2);
+    CU_ASSERT (check_auth_request_token(&local_auth_request_token, 0));
+
+    reset_exception(&exception);
+
+    deinitialize_identity_token(&remote_identity_token);
+    DDS_Security_DataHolder_deinit(&remote_auth_request_token);
+    DDS_Security_DataHolder_deinit(&local_auth_request_token);
+
+    success = auth->return_identity_handle(auth, remote_identity_handle, &exception);
+    CU_ASSERT_TRUE (success);
+
+    if (!success) {
+        printf("return_identity_handle failed: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+    reset_exception(&exception);
+}
+
+
+CU_Test(ddssec_builtin_validate_remote_identity,already_validated_different_token )
+{
+    DDS_Security_ValidationResult_t result;
+    DDS_Security_IdentityHandle remote_identity_handle = DDS_SECURITY_HANDLE_NIL;
+    DDS_Security_IdentityHandle remote_identity_handle2 = DDS_SECURITY_HANDLE_NIL;
+    DDS_Security_AuthRequestMessageToken local_auth_request_token = DDS_SECURITY_TOKEN_INIT;
+    DDS_Security_AuthRequestMessageToken remote_auth_request_token;
+    DDS_Security_IdentityToken remote_identity_token;
+    DDS_Security_IdentityToken remote_identity_token2;
+    DDS_Security_GUID_t remote_participant_guid;
+    DDS_Security_SecurityException exception = {NULL, 0, 0};
+    DDS_Security_boolean success;
+
+    /* Check if we actually have validate_local_identity function. */
+    CU_ASSERT_FATAL (auth != NULL);
+    CU_ASSERT_FATAL (local_identity_handle != DDS_SECURITY_HANDLE_NIL);
+    CU_ASSERT_FATAL (auth->validate_remote_identity != NULL);
+
+    initialize_identity_token(&remote_identity_token, RSA_2048_ALGORITHM_NAME, RSA_2048_ALGORITHM_NAME);
+    fill_auth_request_token(&remote_auth_request_token);
+    set_remote_participant_guid(&remote_participant_guid, 0);
+
+    result = auth->validate_remote_identity(
+                auth,
+                &remote_identity_handle,
+                &local_auth_request_token,
+                &remote_auth_request_token,
+                local_identity_handle,
+                &remote_identity_token,
+                &remote_participant_guid,
+                &exception);
+
+    if (result == DDS_SECURITY_VALIDATION_FAILED) {
+        printf("validate_local_identity_failed: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+
+    CU_ASSERT_FATAL (result == DDS_SECURITY_VALIDATION_PENDING_HANDSHAKE_MESSAGE);
+    CU_ASSERT_FATAL (remote_identity_handle != DDS_SECURITY_HANDLE_NIL);
+    CU_ASSERT (check_auth_request_token(&local_auth_request_token, 0));
+
+    reset_exception(&exception);
+
+    initialize_identity_token_w_sn(
+            &remote_identity_token2,
+            SUBJECT_NAME_IDENTITY_CERT_2, RSA_2048_ALGORITHM_NAME,
+            SUBJECT_NAME_IDENTITY_CA_2, RSA_2048_ALGORITHM_NAME);
+
+    result = auth->validate_remote_identity(
+                auth,
+                &remote_identity_handle2,
+                &local_auth_request_token,
+                &remote_auth_request_token,
+                local_identity_handle,
+                &remote_identity_token2,
+                &remote_participant_guid,
+                &exception);
+
+    if (result == DDS_SECURITY_VALIDATION_FAILED) {
+        printf("validate_local_identity_failed: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+
+    CU_ASSERT (result == DDS_SECURITY_VALIDATION_FAILED);
+    CU_ASSERT (exception.minor_code != 0);
+    CU_ASSERT (exception.message != NULL);
+
+    reset_exception(&exception);
+
+    deinitialize_identity_token(&remote_identity_token);
+    deinitialize_identity_token(&remote_identity_token2);
+    DDS_Security_DataHolder_deinit(&remote_auth_request_token);
+    DDS_Security_DataHolder_deinit(&local_auth_request_token);
+
+    success = auth->return_identity_handle(auth, remote_identity_handle, &exception);
+    CU_ASSERT_TRUE (success);
+
+    if (!success) {
+        printf("return_identity_handle failed: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+    reset_exception(&exception);
+}
+
diff --git a/src/security/core/CMakeLists.txt b/src/security/core/CMakeLists.txt
new file mode 100644
index 0000000..69a2ba5
--- /dev/null
+++ b/src/security/core/CMakeLists.txt
@@ -0,0 +1,57 @@
+#
+# Copyright(c) 2006 to 2019 ADLINK Technology Limited and others
+#
+# This program and the accompanying materials are made available under the
+# terms of the Eclipse Public License v. 2.0 which is available at
+# http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+# v. 1.0 which is available at
+# http://www.eclipse.org/org/documents/edl-v10.php.
+#
+# SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+#
+PREPEND(srcs_security_core "${CMAKE_CURRENT_LIST_DIR}/src"
+    dds_security_serialize.c
+    dds_security_utils.c
+    shared_secret.c
+)
+ 
+PREPEND(hdrs_public_security_core "${CMAKE_CURRENT_LIST_DIR}/include/security/core"
+    dds_security_core_if.h
+    dds_security_serialize.h
+    dds_security_types.h
+    dds_security_utils.h
+    shared_secret.h
+)
+
+set (CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} -fPIC" )
+set (CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -fPIC" )
+add_library(security_core INTERFACE)
+
+
+target_sources(security_core
+    INTERFACE
+        ${srcs_security_core}
+
+)
+
+target_include_directories(security_core
+    INTERFACE
+        "$<BUILD_INTERFACE:${CMAKE_CURRENT_LIST_DIR}/include>"
+        "$<BUILD_INTERFACE:${CMAKE_CURRENT_LIST_DIR}/../api/include>"
+        "$<BUILD_INTERFACE:$<TARGET_PROPERTY:ddsrt,INTERFACE_INCLUDE_DIRECTORIES>>"
+        "$<BUILD_INTERFACE:$<TARGET_PROPERTY:ddsc,INTERFACE_INCLUDE_DIRECTORIES>>"
+)
+#target_link_libraries(security_core PRIVATE ddsrt security_api)
+
+install(
+  DIRECTORY "${CMAKE_CURRENT_LIST_DIR}/include/dds/security/core/"
+  DESTINATION "${CMAKE_INSTALL_INCLUDEDIR}/dds/security/core/"
+  COMPONENT dev)
+
+#install(
+# TARGETS security_core
+# EXPORT "${CMAKE_PROJECT_NAME}"
+#  RUNTIME DESTINATION "${CMAKE_INSTALL_BINDIR}" COMPONENT lib
+#  LIBRARY DESTINATION "${CMAKE_INSTALL_LIBDIR}" COMPONENT lib
+#  ARCHIVE DESTINATION "${CMAKE_INSTALL_LIBDIR}" COMPONENT lib
+#)
diff --git a/src/security/core/include/dds/security/core/dds_security_serialize.h b/src/security/core/include/dds/security/core/dds_security_serialize.h
new file mode 100644
index 0000000..1454d9c
--- /dev/null
+++ b/src/security/core/include/dds/security/core/dds_security_serialize.h
@@ -0,0 +1,106 @@
+/*
+ * Copyright(c) 2006 to 2019 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+
+#ifndef DDS_SECURITY_CDR_SER_H
+#define DDS_SECURITY_CDR_SER_H
+
+#include "dds/export.h"
+#include "dds/security/dds_security_api.h"
+#include "dds/security/core/dds_security_types.h"
+#include "stddef.h"
+
+#if defined (__cplusplus)
+extern "C" {
+#endif
+
+
+
+typedef struct DDS_Security_Serializer *DDS_Security_Serializer;
+typedef struct DDS_Security_Deserializer *DDS_Security_Deserializer;
+
+
+DDS_EXPORT DDS_Security_Serializer
+DDS_Security_Serializer_new(
+     size_t size,
+     size_t increment);
+
+DDS_EXPORT void
+DDS_Security_Serializer_free(
+     DDS_Security_Serializer serializer);
+
+DDS_EXPORT void
+DDS_Security_Serializer_buffer(
+     DDS_Security_Serializer ser,
+     unsigned char **buffer,
+     size_t *size);
+
+DDS_EXPORT void
+DDS_Security_Serialize_PropertySeq(
+     DDS_Security_Serializer serializer,
+     const DDS_Security_PropertySeq *seq);
+
+DDS_EXPORT void
+DDS_Security_Serialize_BinaryPropertyArray(
+     DDS_Security_Serializer serializer,
+     const DDS_Security_BinaryProperty_t **properties,
+     const uint32_t length);
+
+DDS_EXPORT void
+DDS_Security_Serialize_BinaryPropertySeq(
+     DDS_Security_Serializer serializer,
+     const DDS_Security_BinaryPropertySeq *seq);
+
+DDS_EXPORT void
+DDS_Security_Serialize_DataHolderSeq(
+     DDS_Security_Serializer serializer,
+     const DDS_Security_DataHolderSeq *seq);
+
+DDS_EXPORT void
+DDD_Security_Serialize_ParticipantBuiltinTopicData(
+     DDS_Security_Serializer ser,
+     DDS_Security_ParticipantBuiltinTopicData *pdata);
+
+DDS_EXPORT void
+DDD_Security_Serialize_KeyMaterial_AES_GCM_GMAC(
+     DDS_Security_Serializer ser,
+     const DDS_Security_KeyMaterial_AES_GCM_GMAC *data);
+
+DDS_EXPORT DDS_Security_Deserializer
+DDS_Security_Deserializer_new(
+     const unsigned char *data,
+     size_t size);
+
+DDS_EXPORT void
+DDS_Security_Deserializer_free(
+     DDS_Security_Deserializer deserializer);
+
+DDS_EXPORT int
+DDD_Security_Deserialize_ParticipantBuiltinTopicData(
+     DDS_Security_Deserializer deserializer,
+     DDS_Security_ParticipantBuiltinTopicData *pdata,
+     DDS_Security_SecurityException *ex);
+
+DDS_EXPORT void
+DDD_Security_BuiltinTopicKeyBE(
+     DDS_Security_BuiltinTopicKey_t dst,
+     const  DDS_Security_BuiltinTopicKey_t src);
+
+DDS_EXPORT int
+DDD_Security_Deserialize_KeyMaterial_AES_GCM_GMAC(
+     DDS_Security_Deserializer dser,
+     DDS_Security_KeyMaterial_AES_GCM_GMAC *data);
+
+#if defined (__cplusplus)
+}
+#endif
+
+#endif /* DDS_SECURITY_CDR_SER_H */
diff --git a/src/security/core/include/dds/security/core/dds_security_types.h b/src/security/core/include/dds/security/core/dds_security_types.h
new file mode 100644
index 0000000..e9748a5
--- /dev/null
+++ b/src/security/core/include/dds/security/core/dds_security_types.h
@@ -0,0 +1,69 @@
+/*
+ * Copyright(c) 2006 to 2019 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+
+#ifndef DSS_SECURITY_PLUGIN_TYPES_H_
+#define DSS_SECURITY_PLUGIN_TYPES_H_
+
+#include "dds/security/dds_security_api_types.h"
+
+typedef DDS_Security_octet DDS_Security_CryptoTransformKind[4];
+typedef DDS_Security_octet DDS_Security_CryptoTransformKeyId[4];
+
+/* enumeration for CryptoTransformKind.
+ * ds_security_assign_CryptoTransformKind function should be used for assigning to CryptoTransformKind
+ */
+typedef enum
+{
+/* No encryption, no authentication tag */
+  CRYPTO_TRANSFORMATION_KIND_NONE = 0,
+ /* No encryption.
+ One AES128-GMAC authentication tag using the sender_key
+ Zero or more AES128-GMAC auth. tags with receiver specfic keys */
+  CRYPTO_TRANSFORMATION_KIND_AES128_GMAC = 1,
+ /* Authenticated Encryption using AES-128 in Galois Counter Mode
+ (GCM) using the sender key.
+ The authentication tag using the sender_key obtained from GCM
+ Zero or more AES128-GMAC auth. tags with receiver specfic keys */
+  CRYPTO_TRANSFORMATION_KIND_AES128_GCM = 2,
+ /* No encryption.
+ One AES256-GMAC authentication tag using the sender_key
+ Zero or more AES256-GMAC auth. tags with receiver specfic keys */
+  CRYPTO_TRANSFORMATION_KIND_AES256_GMAC = 3,
+ /* Authenticated Encryption using AES-256 in Galois Counter Mode
+ (GCM) using the sender key.
+ The authentication tag using the sender_key obtained from GCM
+ Zero or more AES256-GMAC auth. tags with receiver specfic keys */
+  CRYPTO_TRANSFORMATION_KIND_AES256_GCM = 4,
+
+  /* INVALID ENUM*/
+  CRYPTO_TRANSFORMATION_KIND_INVALID = 127,
+} DDS_Security_CryptoTransformKind_Enum;
+
+typedef struct DDS_Security_KeyMaterial_AES_GCM_GMAC {
+  DDS_Security_CryptoTransformKind transformation_kind;
+  DDS_Security_OctetSeq master_salt;         /*size shall be 32*/
+  DDS_Security_CryptoTransformKeyId sender_key_id;
+  DDS_Security_OctetSeq master_sender_key;   /*size shall be 32*/
+  DDS_Security_CryptoTransformKeyId receiver_specific_key_id;
+  DDS_Security_OctetSeq master_receiver_specific_key; /*size shall be 32*/
+} DDS_Security_KeyMaterial_AES_GCM_GMAC;
+
+struct CryptoTransformIdentifier {
+  DDS_Security_CryptoTransformKind transformation_kind;
+  DDS_Security_CryptoTransformKeyId transformation_key_id;
+};
+
+/** temporary address decleration until it is ready in ddsrt */
+typedef uintptr_t          ddsrt_address;   /* word length of the platform */
+
+
+#endif /* DSS_SECURITY_PLUGIN_TYPES_H_ */
diff --git a/src/security/core/include/dds/security/core/dds_security_utils.h b/src/security/core/include/dds/security/core/dds_security_utils.h
new file mode 100644
index 0000000..e2ade89
--- /dev/null
+++ b/src/security/core/include/dds/security/core/dds_security_utils.h
@@ -0,0 +1,391 @@
+/*
+ * Copyright(c) 2006 to 2019 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+
+#ifndef DSCMN_SECURITY_UTILS_H_
+#define DSCMN_SECURITY_UTILS_H_
+
+#include "dds/export.h"
+#include <stddef.h>
+#include <stdint.h>
+#include <stdbool.h>
+#include "dds/security/core/dds_security_types.h"
+#include "dds/security/dds_security_api.h"
+
+typedef DDS_Security_long_long DDS_Security_Handle;
+typedef DDS_Security_LongLongSeq DDS_Security_HandleSeq;
+
+#define DDS_SECURITY_SEQUENCE_INIT   {0, 0, NULL}
+#define DDS_SECURITY_TOKEN_INIT {NULL, DDS_SECURITY_SEQUENCE_INIT, DDS_SECURITY_SEQUENCE_INIT}
+
+
+typedef enum {
+    DDS_SECURITY_CONFIG_ITEM_PREFIX_UNKNOWN,
+    DDS_SECURITY_CONFIG_ITEM_PREFIX_FILE,
+    DDS_SECURITY_CONFIG_ITEM_PREFIX_DATA,
+    DDS_SECURITY_CONFIG_ITEM_PREFIX_PKCS11
+} DDS_Security_config_item_prefix_t;
+
+
+DDS_EXPORT DDS_Security_BinaryProperty_t *
+DDS_Security_BinaryProperty_alloc(
+        void);
+
+DDS_EXPORT void
+DDS_Security_BinaryProperty_deinit(
+        DDS_Security_BinaryProperty_t *p);
+
+DDS_EXPORT void
+DDS_Security_BinaryProperty_free(
+        DDS_Security_BinaryProperty_t *p);
+
+DDS_EXPORT void
+DDS_Security_BinaryProperty_copy(
+         DDS_Security_BinaryProperty_t *dst,
+         DDS_Security_BinaryProperty_t *src);
+
+DDS_EXPORT bool
+DDS_Security_BinaryProperty_equal(
+         DDS_Security_BinaryProperty_t *pa,
+         DDS_Security_BinaryProperty_t *pb);
+
+DDS_EXPORT void
+DDS_Security_BinaryProperty_set_by_value(
+         DDS_Security_BinaryProperty_t *bp,
+         const char *name,
+         const unsigned char *data,
+         uint32_t length);
+
+DDS_EXPORT void
+DDS_Security_BinaryProperty_set_by_string(
+         DDS_Security_BinaryProperty_t *bp,
+         const char *name,
+         const char *data);
+
+DDS_EXPORT void
+DDS_Security_BinaryProperty_set_by_ref(
+         DDS_Security_BinaryProperty_t *bp,
+         const char *name,
+         unsigned char *data,
+         uint32_t length);
+
+DDS_EXPORT DDS_Security_BinaryPropertySeq *
+DDS_Security_BinaryPropertySeq_alloc(
+        void);
+
+DDS_EXPORT DDS_Security_BinaryProperty_t *
+DDS_Security_BinaryPropertySeq_allocbuf(
+         DDS_Security_unsigned_long len);
+
+DDS_EXPORT void
+DDS_Security_BinaryPropertySeq_deinit(
+         DDS_Security_BinaryPropertySeq *seq);
+
+DDS_EXPORT void
+DDS_Security_BinaryPropertySeq_free(
+         DDS_Security_BinaryPropertySeq *seq);
+
+DDS_EXPORT DDS_Security_Property_t *
+DDS_Security_Property_alloc(
+        void);
+
+DDS_EXPORT void
+DDS_Security_Property_free(
+        DDS_Security_Property_t *p);
+
+DDS_EXPORT void
+DDS_Security_Property_deinit(
+        DDS_Security_Property_t *p);
+
+DDS_EXPORT void
+DDS_Security_Property_copy(
+         DDS_Security_Property_t *dst,
+         DDS_Security_Property_t *src);
+
+DDS_EXPORT bool
+DDS_Security_Property_equal(
+         DDS_Security_Property_t *pa,
+         DDS_Security_Property_t *pb);
+
+DDS_EXPORT char *
+DDS_Security_Property_get_value(
+         const DDS_Security_PropertySeq *properties,
+         const char *name);
+
+DDS_EXPORT DDS_Security_PropertySeq *
+DDS_Security_PropertySeq_alloc(
+        void);
+
+DDS_EXPORT DDS_Security_Property_t *
+DDS_Security_PropertySeq_allocbuf(
+         DDS_Security_unsigned_long len);
+
+DDS_EXPORT void
+DDS_Security_PropertySeq_freebuf(
+         DDS_Security_PropertySeq *seq);
+
+DDS_EXPORT void
+DDS_Security_PropertySeq_free(
+         DDS_Security_PropertySeq *seq);
+
+DDS_EXPORT void
+DDS_Security_PropertySeq_deinit(
+        DDS_Security_PropertySeq *seq);
+
+DDS_EXPORT const DDS_Security_Property_t *
+DDS_Security_PropertySeq_find_property (
+         const DDS_Security_PropertySeq *property_seq,
+         const char *name );
+
+DDS_EXPORT DDS_Security_DataHolder *
+DDS_Security_DataHolder_alloc(
+        void);
+
+DDS_EXPORT void
+DDS_Security_DataHolder_free(
+        DDS_Security_DataHolder *holder);
+
+DDS_EXPORT void
+DDS_Security_DataHolder_deinit(
+        DDS_Security_DataHolder *holder);
+
+DDS_EXPORT void
+DDS_Security_DataHolder_copy(
+         DDS_Security_DataHolder *dst,
+         const DDS_Security_DataHolder *src);
+
+DDS_EXPORT bool
+DDS_Security_DataHolder_equal(
+         const DDS_Security_DataHolder *psa,
+         const DDS_Security_DataHolder *psb);
+
+DDS_EXPORT const DDS_Security_Property_t *
+DDS_Security_DataHolder_find_property(
+         const DDS_Security_DataHolder *holder,
+         const char *name);
+
+DDS_EXPORT const DDS_Security_BinaryProperty_t *
+DDS_Security_DataHolder_find_binary_property(
+         const DDS_Security_DataHolder *holder,
+         const char *name);
+
+DDS_EXPORT DDS_Security_DataHolderSeq *
+DDS_Security_DataHolderSeq_alloc(
+        void);
+
+DDS_EXPORT DDS_Security_DataHolder *
+DDS_Security_DataHolderSeq_allocbuf(
+         DDS_Security_unsigned_long len);
+
+DDS_EXPORT void
+DDS_Security_DataHolderSeq_freebuf(
+         DDS_Security_DataHolderSeq *seq);
+
+DDS_EXPORT void
+DDS_Security_DataHolderSeq_free(
+         DDS_Security_DataHolderSeq *seq);
+
+DDS_EXPORT void
+DDS_Security_DataHolderSeq_deinit(
+         DDS_Security_DataHolderSeq *seq);
+
+DDS_EXPORT void
+DDS_Security_DataHolderSeq_copy(
+         DDS_Security_DataHolderSeq *dst,
+         const DDS_Security_DataHolderSeq *src);
+
+DDS_EXPORT DDS_Security_ParticipantBuiltinTopicData *
+DDS_Security_ParticipantBuiltinTopicData_alloc(
+        void);
+
+DDS_EXPORT void
+DDS_Security_ParticipantBuiltinTopicData_free(
+         DDS_Security_ParticipantBuiltinTopicData *data);
+
+DDS_EXPORT void
+DDS_Security_ParticipantBuiltinTopicData_deinit(
+         DDS_Security_ParticipantBuiltinTopicData *data);
+
+DDS_EXPORT DDS_Security_OctetSeq *
+DDS_Security_OctetSeq_alloc(
+        void);
+
+DDS_EXPORT DDS_Security_octet *
+DDS_Security_OctetSeq_allocbuf(
+         DDS_Security_unsigned_long len);
+
+DDS_EXPORT void
+DDS_Security_OctetSeq_freebuf(
+         DDS_Security_OctetSeq *seq);
+
+DDS_EXPORT void
+DDS_Security_OctetSeq_free(
+         DDS_Security_OctetSeq *seq);
+
+DDS_EXPORT void
+DDS_Security_OctetSeq_deinit(
+         DDS_Security_OctetSeq *seq);
+
+DDS_EXPORT void
+DDS_Security_OctetSeq_copy(
+         DDS_Security_OctetSeq *dst,
+         const DDS_Security_OctetSeq *src);
+
+DDS_EXPORT DDS_Security_HandleSeq *
+DDS_Security_HandleSeq_alloc(
+        void);
+
+DDS_EXPORT DDS_Security_long_long *
+DDS_Security_HandleSeq_allocbuf(
+         DDS_Security_unsigned_long length);
+
+DDS_EXPORT void
+DDS_Security_HandleSeq_freebuf(
+         DDS_Security_HandleSeq *seq);
+
+DDS_EXPORT void
+DDS_Security_HandleSeq_free(
+         DDS_Security_HandleSeq *seq);
+
+DDS_EXPORT void
+DDS_Security_HandleSeq_deinit(
+         DDS_Security_HandleSeq *seq);
+
+DDS_EXPORT void
+DDS_Security_Exception_set(
+         DDS_Security_SecurityException *ex,
+         const char *context,
+         int code,
+         int minor_code,
+         const char *fmt,
+        ...);
+
+
+#if DDSI_INCLUDE_SSL
+DDS_EXPORT void
+DDS_Security_Exception_set_with_openssl_error(
+         DDS_Security_SecurityException *ex,
+         const char *context,
+         int code,
+         int minor_code,
+         const char *fmt);
+
+#endif
+
+DDS_EXPORT void
+DDS_Security_Exception_reset(
+         DDS_Security_SecurityException *ex);
+
+DDS_EXPORT void
+DDS_Security_Exception_clean(
+         DDS_Security_SecurityException *ex);
+
+DDS_EXPORT void
+DDS_Security_PropertyQosPolicy_deinit(
+         DDS_Security_PropertyQosPolicy *policy);
+
+DDS_EXPORT void
+DDS_Security_PropertyQosPolicy_free(
+         DDS_Security_PropertyQosPolicy *policy);
+
+DDS_EXPORT void
+DDS_Security_set_token_nil(
+         DDS_Security_DataHolder *token);
+
+DDS_EXPORT void
+DDS_Security_KeyMaterial_AES_GCM_GMAC_deinit(
+         DDS_Security_KeyMaterial_AES_GCM_GMAC *key_material);
+
+DDS_EXPORT DDS_Security_CryptoTransformKind_Enum
+DDS_Security_basicprotectionkind2transformationkind(
+         const DDS_Security_PropertySeq *properties,
+         DDS_Security_BasicProtectionKind protection);
+
+DDS_EXPORT DDS_Security_CryptoTransformKind_Enum
+DDS_Security_protectionkind2transformationkind(
+         const DDS_Security_PropertySeq *properties,
+         DDS_Security_ProtectionKind protection);
+
+DDS_EXPORT DDS_Security_config_item_prefix_t
+DDS_Security_get_conf_item_type(
+         const char *str,
+         char **data);
+
+DDS_EXPORT char *
+DDS_Security_normalize_file(
+    const char *filepath);
+
+/**
+ * \brief Find first occurrence of character in null terminated string
+ *
+ * @param str String to search for given characters
+ * @param chrs Characters to search for in string
+ * @param inc true to find first character included in given characters,
+ *            false to find first character not included.
+ * @return Pointer to first occurrence of character in string, or NULL
+ */
+
+DDS_EXPORT char *
+ddssec_strchrs (
+        const char *str,
+        const char *chrs,
+        bool inc);
+
+
+#define DDS_Security_ParticipantCryptoTokenSeq_alloc() \
+                    (DDS_Security_ParticipantCryptoTokenSeq *)DDS_Security_DataHolderSeq_alloc())
+#define DDS_Security_ParticipantCryptoTokenSeq_freebuf(s) \
+                    DDS_Security_DataHolderSeq_freebuf((DDS_Security_DataHolderSeq *)(s))
+#define DDS_Security_ParticipantCryptoTokenSeq_free(s) \
+                    DDS_Security_DataHolderSeq_free((DDS_Security_DataHolderSeq *)(s))
+#define DDS_Security_ParticipantCryptoTokenSeq_deinit(s) \
+                    DDS_Security_DataHolderSeq_deinit((DDS_Security_DataHolderSeq *)(s))
+#define DDS_Security_ParticipantCryptoTokenSeq_copy(d,s) \
+                    DDS_Security_DataHolderSeq_copy((DDS_Security_DataHolderSeq *)(d), (const DDS_Security_DataHolderSeq *)(s))
+
+
+#define DDS_Security_ParticipantCryptoHandleSeq_alloc()     (DDS_Security_ParticipantCryptoHandleSeq*)DDS_Security_HandleSeq_alloc()
+#define DDS_Security_ParticipantCryptoHandleSeq_allocbuf(l) DDS_Security_HandleSeq_allocbuf(l)
+#define DDS_Security_ParticipantCryptoHandleSeq_freebuf(s)  DDS_Security_HandleSeq_freebuf((DDS_Security_HandleSeq*)s)
+#define DDS_Security_ParticipantCryptoHandleSeq_free(s)     DDS_Security_HandleSeq_free((DDS_Security_HandleSeq*)s)
+#define DDS_Security_ParticipantCryptoHandleSeq_deinit(s)   DDS_Security_HandleSeq_deinit((DDS_Security_HandleSeq*)s)
+
+#define DDS_Security_DatawriterCryptoHandleSeq_alloc()      (DDS_Security_DatawriterCryptoHandleSeq*)DDS_Security_HandleSeq_alloc()
+#define DDS_Security_DatawriterCryptoHandleSeq_allocbuf(l)  DDS_Security_HandleSeq_allocbuf(l)
+#define DDS_Security_DatawriterCryptoHandleSeq_freebuf(s)   DDS_Security_HandleSeq_freebuf((DDS_Security_HandleSeq*)s)
+#define DDS_Security_DatawriterCryptoHandleSeq_free(s)      DDS_Security_HandleSeq_free((DDS_Security_HandleSeq*)s)
+#define DDS_Security_DatawriterCryptoHandleSeq_deinit(s)    DDS_Security_HandleSeq_deinit((DDS_Security_HandleSeq*)s)
+
+#define DDS_Security_DatareaderCryptoHandleSeq_alloc()      (DDS_Security_DatareaderCryptoHandleSeq*)DDS_Security_HandleSeq_alloc()
+#define DDS_Security_DatareaderCryptoHandleSeq_allocbuf(l)  DDS_Security_HandleSeq_allocbuf(l)
+#define DDS_Security_DatareaderCryptoHandleSeq_freebuf(s)   DDS_Security_HandleSeq_freebuf((DDS_Security_HandleSeq*)s)
+#define DDS_Security_DatareaderCryptoHandleSeq_free(s)      DDS_Security_HandleSeq_free((DDS_Security_HandleSeq*)s)
+#define DDS_Security_DatareaderCryptoHandleSeq_deinit(s)    DDS_Security_HandleSeq_deinit((DDS_Security_HandleSeq*)s)
+
+#define DDS_Security_CryptoTokenSeq_alloc()     (DDS_Security_CryptoTokenSeq*)DDS_Security_DataHolderSeq_alloc()
+#define DDS_Security_CryptoTokenSeq_allocbuf(l) DDS_Security_DataHolderSeq_allocbuf(l)
+#define DDS_Security_CryptoTokenSeq_freebuf(s)  DDS_Security_DataHolderSeq_freebuf((DDS_Security_CryptoTokenSeq*)s)
+#define DDS_Security_CryptoTokenSeq_free(s)     DDS_Security_DataHolderSeq_free((DDS_Security_CryptoTokenSeq*)s)
+
+
+/* for DEBUG purposes */
+DDS_EXPORT void
+print_binary_debug(
+         char* name,
+         unsigned char *value,
+         uint32_t size);
+
+DDS_EXPORT void
+print_binary_properties_debug(
+         const DDS_Security_DataHolder *token);
+
+
+#endif /* DSCMN_SECURITY_UTILS_H_ */
diff --git a/src/security/core/include/dds/security/core/shared_secret.h b/src/security/core/include/dds/security/core/shared_secret.h
new file mode 100644
index 0000000..e0262d7
--- /dev/null
+++ b/src/security/core/include/dds/security/core/shared_secret.h
@@ -0,0 +1,40 @@
+/*
+ * Copyright(c) 2006 to 2019 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+
+
+#ifndef SRC_SECURITY_CORE_INCLUDE_SHARED_SECRET_HANDLE_H_
+#define SRC_SECURITY_CORE_INCLUDE_SHARED_SECRET_HANDLE_H_
+
+#include "dds/export.h"
+#include <stdint.h>
+#include "dds/security/dds_security_api.h"
+
+
+typedef struct DDS_Security_SharedSecretHandleImpl {
+
+    DDS_Security_octet* shared_secret;
+    DDS_Security_long shared_secret_size;
+    DDS_Security_octet challenge1[DDS_SECURITY_AUTHENTICATION_CHALLENGE_SIZE];
+    DDS_Security_octet challenge2[DDS_SECURITY_AUTHENTICATION_CHALLENGE_SIZE];
+
+} DDS_Security_SharedSecretHandleImpl;
+
+DDS_EXPORT const DDS_Security_octet* get_challenge1_from_secret_handle( DDS_Security_SharedSecretHandle handle);
+
+DDS_EXPORT const DDS_Security_octet* get_challenge2_from_secret_handle( DDS_Security_SharedSecretHandle handle );
+
+DDS_EXPORT const DDS_Security_octet* get_secret_from_secret_handle( DDS_Security_SharedSecretHandle handle );
+
+DDS_EXPORT int32_t get_secret_size_from_secret_handle( DDS_Security_SharedSecretHandle handle );
+
+#endif /* SRC_SECURITY_CORE_INCLUDE_SHARED_SECRET_H_ */
+
diff --git a/src/security/core/src/dds_security_serialize.c b/src/security/core/src/dds_security_serialize.c
new file mode 100644
index 0000000..afa9733
--- /dev/null
+++ b/src/security/core/src/dds_security_serialize.c
@@ -0,0 +1,813 @@
+/*
+ * Copyright(c) 2006 to 2019 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+
+
+#include <assert.h>
+#include <string.h>
+#include "dds/ddsrt/heap.h"
+#include "dds/ddsrt/atomics.h"
+#include "dds/ddsrt/string.h"
+
+#include "dds/security/core/dds_security_serialize.h"
+#include "dds/security/core/dds_security_utils.h"
+#include "dds/ddsrt/endian.h"
+#include "dds/ddsrt/bswap.h"
+
+
+#define BYTE_ORDER_BIG_ENDIAN                   0x02
+#define BYTE_ORDER_LITTLE_ENDIAN                0x03
+
+#define PID_PAD                                 0x0u
+#define PID_SENTINEL                            0x1u
+#define PID_USER_DATA                           0x2cu
+#define PID_TOPIC_NAME                          0x5u
+#define PID_TYPE_NAME                           0x7u
+#define PID_GROUP_DATA                          0x2du
+#define PID_TOPIC_DATA                          0x2eu
+#define PID_DURABILITY                          0x1du
+#define PID_DURABILITY_SERVICE                  0x1eu
+#define PID_DEADLINE                            0x23u
+#define PID_LATENCY_BUDGET                      0x27u
+#define PID_LIVELINESS                          0x1bu
+#define PID_RELIABILITY                         0x1au
+#define PID_LIFESPAN                            0x2bu
+#define PID_DESTINATION_ORDER                   0x25u
+#define PID_HISTORY                             0x40u
+#define PID_RESOURCE_LIMITS                     0x41u
+#define PID_OWNERSHIP                           0x1fu
+#define PID_OWNERSHIP_STRENGTH                  0x6u
+#define PID_PRESENTATION                        0x21u
+#define PID_PARTITION                           0x29u
+#define PID_TIME_BASED_FILTER                   0x4u
+#define PID_TRANSPORT_PRIORITY                  0x49u
+#define PID_PROTOCOL_VERSION                    0x15u
+#define PID_VENDORID                            0x16u
+#define PID_UNICAST_LOCATOR                     0x2fu
+#define PID_MULTICAST_LOCATOR                   0x30u
+#define PID_MULTICAST_IPADDRESS                 0x11u
+#define PID_DEFAULT_UNICAST_LOCATOR             0x31u
+#define PID_DEFAULT_MULTICAST_LOCATOR           0x48u
+#define PID_METATRAFFIC_UNICAST_LOCATOR         0x32u
+#define PID_METATRAFFIC_MULTICAST_LOCATOR       0x33u
+#define PID_DEFAULT_UNICAST_IPADDRESS           0xcu
+#define PID_DEFAULT_UNICAST_PORT                0xeu
+#define PID_METATRAFFIC_UNICAST_IPADDRESS       0x45u
+#define PID_METATRAFFIC_UNICAST_PORT            0xdu
+#define PID_METATRAFFIC_MULTICAST_IPADDRESS     0xbu
+#define PID_METATRAFFIC_MULTICAST_PORT          0x46u
+#define PID_EXPECTS_INLINE_QOS                  0x43u
+#define PID_PARTICIPANT_MANUAL_LIVELINESS_COUNT 0x34u
+#define PID_PARTICIPANT_BUILTIN_ENDPOINTS       0x44u
+#define PID_PARTICIPANT_LEASE_DURATION          0x2u
+#define PID_CONTENT_FILTER_PROPERTY             0x35u
+#define PID_PARTICIPANT_GUID                    0x50u
+#define PID_PARTICIPANT_ENTITYID                0x51u
+#define PID_GROUP_GUID                          0x52u
+#define PID_GROUP_ENTITYID                      0x53u
+#define PID_BUILTIN_ENDPOINT_SET                0x58u
+#define PID_PROPERTY_LIST                       0x59u
+#define PID_TYPE_MAX_SIZE_SERIALIZED            0x60u
+#define PID_ENTITY_NAME                         0x62u
+#define PID_KEYHASH                             0x70u
+#define PID_STATUSINFO                          0x71u
+#define PID_CONTENT_FILTER_INFO                 0x55u
+#define PID_COHERENT_SET                        0x56u
+#define PID_DIRECTED_WRITE                      0x57u
+#define PID_ORIGINAL_WRITER_INFO                0x61u
+#define PID_ENDPOINT_GUID                       0x5au
+
+/* Security related PID values. */
+#define PID_IDENTITY_TOKEN                      0x1001u
+#define PID_PERMISSIONS_TOKEN                   0x1002u
+#define PID_ENDPOINT_SECURITY_INFO              0x1004u
+#define PID_PARTICIPANT_SECURITY_INFO           0x1005u
+#define PID_IDENTITY_STATUS_TOKEN               0x1006u
+
+
+struct DDS_Security_Serializer {
+    unsigned char *buffer;
+    size_t size;
+    size_t offset;
+    size_t increment;
+    size_t marker;
+};
+
+struct DDS_Security_Deserializer {
+    const unsigned char *buffer;
+    const unsigned char *cursor;
+    size_t size;
+    size_t remain;
+};
+
+
+static size_t
+alignup_size (
+     size_t x,
+     size_t a)
+{
+    size_t m = a-1;
+    return (x+m) & ~m;
+}
+
+static size_t
+alignup_ptr(
+     const unsigned char *ptr,
+     size_t a)
+{
+    size_t m = (a - 1);
+    size_t x = (size_t) ptr;
+    return ((x+m) & ~m) - x;
+}
+
+DDS_Security_Serializer
+DDS_Security_Serializer_new(
+     size_t size,
+     size_t increment)
+{
+    DDS_Security_Serializer serializer;
+
+    serializer = ddsrt_malloc(sizeof(*serializer));
+    serializer->buffer = ddsrt_malloc(size);
+    serializer->size = size;
+    serializer->increment = increment;
+    serializer->offset = 0;
+
+    return serializer;
+}
+
+void
+DDS_Security_Serializer_free(
+     DDS_Security_Serializer ser)
+{
+    if (ser) {
+        ddsrt_free(ser->buffer);
+        ddsrt_free(ser);
+    }
+}
+
+void
+DDS_Security_Serializer_buffer(
+     DDS_Security_Serializer ser,
+     unsigned char **buffer,
+     size_t *size)
+{
+    assert(ser);
+    assert(buffer);
+    assert(size);
+
+    *buffer = ser->buffer;
+    *size = ser->offset;
+    ser->buffer = NULL;
+}
+
+static void
+serbuffer_adjust_size(
+    DDS_Security_Serializer ser,
+    size_t needed)
+{
+    if (ser->size - ser->offset < needed) {
+        ser->buffer = ddsrt_realloc(ser->buffer, ser->size + needed + ser->increment);
+        ser->size += needed + ser->increment;
+    }
+}
+
+static void
+serbuffer_align(
+     DDS_Security_Serializer ser,
+     size_t alignment)
+{
+    size_t offset, i;
+
+    offset = alignup_size(ser->offset, alignment);
+    serbuffer_adjust_size(ser, offset-ser->offset);
+    for (i = 0; i < offset - ser->offset; i++) {
+        ser->buffer[ser->offset+i] = 0;
+    }
+    ser->offset = offset;
+}
+
+static void
+DDS_Security_Serialize_mark_len(
+     DDS_Security_Serializer ser)
+{
+    serbuffer_align(ser, 2);
+    serbuffer_adjust_size(ser, 2);
+    ser->marker = ser->offset;
+    ser->offset += 2;
+}
+
+static void
+DDS_Security_Serialize_update_len(
+     DDS_Security_Serializer ser)
+{
+    unsigned short len;
+
+    len = (unsigned short)(ser->offset - ser->marker - sizeof(unsigned short));
+    *(unsigned short *)&(ser->buffer[ser->marker]) = ddsrt_toBE2u(len);
+}
+
+static void
+DDS_Security_Serialize_uint16(
+     DDS_Security_Serializer ser,
+     unsigned short value)
+{
+    serbuffer_align(ser, sizeof(unsigned short));
+    serbuffer_adjust_size(ser, sizeof(unsigned short));
+
+    *(unsigned short *)&(ser->buffer[ser->offset]) = ddsrt_toBE2u(value);
+    ser->offset += sizeof(unsigned short);
+}
+
+static void
+DDS_Security_Serialize_uint32_t(
+     DDS_Security_Serializer ser,
+     uint32_t value)
+{
+    serbuffer_align(ser, sizeof(uint32_t));
+    serbuffer_adjust_size(ser, sizeof(uint32_t));
+
+    *(uint32_t *)&(ser->buffer[ser->offset]) = ddsrt_toBE4u(value);
+    ser->offset += sizeof(uint32_t);
+}
+
+static void
+DDS_Security_Serialize_string(
+     DDS_Security_Serializer ser,
+     const char *str)
+{
+    size_t len;
+
+    len = strlen(str) + 1;
+
+    DDS_Security_Serialize_uint32_t(ser, (uint32_t)len);
+    serbuffer_adjust_size(ser, len );
+
+    memcpy(&(ser->buffer[ser->offset]), str, len);
+    ser->offset += len;
+    serbuffer_align(ser, sizeof(uint32_t));
+}
+
+static void
+DDS_Security_Serialize_Property(
+     DDS_Security_Serializer ser,
+     const DDS_Security_Property_t *property)
+{
+    DDS_Security_Serialize_string(ser, property->name);
+    DDS_Security_Serialize_string(ser, property->value);
+}
+
+static void
+DDS_Security_Serialize_OctetSeq(
+     DDS_Security_Serializer ser,
+     const DDS_Security_OctetSeq *seq)
+{
+     DDS_Security_Serialize_uint32_t(ser, seq->_length);
+     serbuffer_adjust_size(ser, seq->_length);
+     memcpy(&(ser->buffer[ser->offset]), seq->_buffer, seq->_length);
+     ser->offset += seq->_length;
+}
+
+static void
+DDS_Security_Serialize_BinaryProperty(
+     DDS_Security_Serializer ser,
+     const DDS_Security_BinaryProperty_t *property)
+{
+    DDS_Security_Serialize_string(ser, property->name);
+    DDS_Security_Serialize_OctetSeq(ser, &property->value);
+}
+
+void
+DDS_Security_Serialize_PropertySeq(
+     DDS_Security_Serializer ser,
+     const DDS_Security_PropertySeq *seq)
+{
+    uint32_t i;
+
+    DDS_Security_Serialize_uint32_t(ser, seq->_length);
+    for (i = 0; i < seq->_length; i++) {
+         DDS_Security_Serialize_Property(ser, &seq->_buffer[i]);
+    }
+}
+
+void
+DDS_Security_Serialize_BinaryPropertyArray(
+     DDS_Security_Serializer serializer,
+     const DDS_Security_BinaryProperty_t **properties,
+     const uint32_t propertyLength)
+{
+    uint32_t i;
+
+     DDS_Security_Serialize_uint32_t(serializer, propertyLength);
+     for (i = 0; i < propertyLength ; i++) {
+          DDS_Security_Serialize_BinaryProperty(serializer, properties[i]);
+     }
+}
+
+void
+DDS_Security_Serialize_BinaryPropertySeq(
+     DDS_Security_Serializer serializer,
+     const DDS_Security_BinaryPropertySeq *seq)
+{
+    uint32_t i;
+
+    DDS_Security_Serialize_uint32_t(serializer, seq->_length);
+    for (i = 0; i < seq->_length; i++) {
+         DDS_Security_Serialize_BinaryProperty(serializer, &seq->_buffer[i]);
+    }
+}
+
+
+static void
+DDS_Security_Serialize_DataHolder(
+     DDS_Security_Serializer ser,
+     const DDS_Security_DataHolder *holder)
+{
+    DDS_Security_Serialize_string(ser, holder->class_id);
+    DDS_Security_Serialize_PropertySeq(ser, &holder->properties);
+    DDS_Security_Serialize_BinaryPropertySeq(ser, &holder->binary_properties);
+}
+
+
+static void
+DDS_Security_Serialize_BuiltinTopicKey(
+     DDS_Security_Serializer ser,
+     DDS_Security_BuiltinTopicKey_t key)
+{
+    serbuffer_align(ser, sizeof(uint32_t));
+    DDS_Security_Serialize_uint16(ser, PID_PARTICIPANT_GUID);
+    DDS_Security_Serialize_uint16(ser, 16);
+    DDS_Security_Serialize_uint32_t(ser, key[0]);
+    DDS_Security_Serialize_uint32_t(ser, key[1]);
+    DDS_Security_Serialize_uint32_t(ser, key[2]);
+    /* 4 Bytes are expected for whatever reason (gid vs guid?). */
+    DDS_Security_Serialize_uint32_t(ser, 0);
+}
+
+static void
+DDS_Security_Serialize_UserDataQosPolicy(
+     DDS_Security_Serializer ser,
+     DDS_Security_OctetSeq *seq)
+{
+    if (seq->_length > 0) {
+        serbuffer_align(ser, sizeof(uint32_t));
+        DDS_Security_Serialize_uint16(ser, PID_USER_DATA);
+        DDS_Security_Serialize_uint16(ser, (unsigned short)seq->_length);
+        DDS_Security_Serialize_OctetSeq(ser, seq);
+    }
+}
+
+static void
+DDS_Security_Serialize_IdentityToken(
+     DDS_Security_Serializer ser,
+     DDS_Security_IdentityToken *token)
+{
+    serbuffer_align(ser, sizeof(uint32_t));
+    DDS_Security_Serialize_uint16(ser, PID_IDENTITY_TOKEN);
+    DDS_Security_Serialize_mark_len(ser);
+    DDS_Security_Serialize_DataHolder(ser, token);
+    DDS_Security_Serialize_update_len(ser);
+}
+
+static void
+DDS_Security_Serialize_PermissionsToken(
+     DDS_Security_Serializer ser,
+     DDS_Security_PermissionsToken *token)
+{
+    serbuffer_align(ser, sizeof(uint32_t));
+    DDS_Security_Serialize_uint16(ser, PID_PERMISSIONS_TOKEN);
+    DDS_Security_Serialize_mark_len(ser);
+    DDS_Security_Serialize_DataHolder(ser, token);
+    DDS_Security_Serialize_update_len(ser);
+}
+
+static void
+DDS_Security_Serialize_PropertyQosPolicy(
+     DDS_Security_Serializer ser,
+     DDS_Security_PropertyQosPolicy *policy)
+{
+    serbuffer_align(ser, sizeof(uint32_t));
+    DDS_Security_Serialize_uint16(ser, PID_PROPERTY_LIST);
+    DDS_Security_Serialize_mark_len(ser);
+    DDS_Security_Serialize_PropertySeq(ser, &policy->value);
+    DDS_Security_Serialize_BinaryPropertySeq(ser, &policy->binary_value);
+    DDS_Security_Serialize_update_len(ser);
+}
+
+static void
+DDS_Security_Serialize_ParticipantSecurityInfo(
+     DDS_Security_Serializer ser,
+     DDS_Security_ParticipantSecurityInfo *info)
+{
+    serbuffer_align(ser, sizeof(uint32_t));
+    DDS_Security_Serialize_uint16(ser, PID_PARTICIPANT_SECURITY_INFO);
+    DDS_Security_Serialize_uint16(ser, 8);
+    DDS_Security_Serialize_uint32_t(ser, info->participant_security_attributes);
+    DDS_Security_Serialize_uint32_t(ser, info->plugin_participant_security_attributes);
+}
+
+
+void
+DDD_Security_Serialize_ParticipantBuiltinTopicData(
+     DDS_Security_Serializer ser,
+     DDS_Security_ParticipantBuiltinTopicData *pdata)
+{
+    DDS_Security_Serialize_BuiltinTopicKey(ser, pdata->key);
+    DDS_Security_Serialize_UserDataQosPolicy(ser, &pdata->user_data.value);
+    DDS_Security_Serialize_IdentityToken(ser, &pdata->identity_token);
+    DDS_Security_Serialize_PermissionsToken(ser, &pdata->permissions_token);
+    DDS_Security_Serialize_PropertyQosPolicy(ser, &pdata->property);
+    DDS_Security_Serialize_ParticipantSecurityInfo(ser, &pdata->security_info);
+    serbuffer_align(ser, sizeof(uint32_t));
+    DDS_Security_Serialize_uint16(ser, PID_SENTINEL);
+    DDS_Security_Serialize_uint16(ser, 0);
+}
+
+static void
+DDD_Security_Serialize_OctetArray(
+     DDS_Security_Serializer ser,
+     const DDS_Security_octet *data,
+     uint32_t length)
+{
+    serbuffer_adjust_size(ser, length);
+    memcpy(&ser->buffer[ser->offset], data, length);
+    ser->offset += length;
+}
+
+void
+DDD_Security_Serialize_KeyMaterial_AES_GCM_GMAC(
+     DDS_Security_Serializer ser,
+     const DDS_Security_KeyMaterial_AES_GCM_GMAC *data)
+{
+    DDD_Security_Serialize_OctetArray(ser, data->transformation_kind, sizeof(data->transformation_kind));
+    DDS_Security_Serialize_OctetSeq(ser, &data->master_salt);
+    DDD_Security_Serialize_OctetArray(ser, data->sender_key_id, sizeof(data->sender_key_id));
+    DDS_Security_Serialize_OctetSeq(ser, &data->master_sender_key);
+    DDD_Security_Serialize_OctetArray(ser, data->receiver_specific_key_id, sizeof(data->receiver_specific_key_id));
+    DDS_Security_Serialize_OctetSeq(ser, &data->master_receiver_specific_key);
+}
+
+
+DDS_Security_Deserializer
+DDS_Security_Deserializer_new(
+     const unsigned char *data,
+     size_t size)
+{
+    DDS_Security_Deserializer deserializer;
+
+    deserializer = ddsrt_malloc(sizeof(*deserializer));
+
+    deserializer->buffer = data;
+    deserializer->cursor = data;
+    deserializer->size = size;
+    deserializer->remain = size;
+
+    return deserializer;
+}
+
+void
+DDS_Security_Deserializer_free(
+     DDS_Security_Deserializer dser)
+{
+    ddsrt_free(dser);
+}
+
+static void
+DDS_Security_Deserialize_align(
+     DDS_Security_Deserializer dser,
+     size_t size)
+{
+    size_t l = alignup_ptr(dser->cursor, size);
+
+    if (dser->remain >= l) {
+        dser->cursor += l;
+        dser->remain -= l;
+    } else {
+        dser->remain = 0;
+    }
+}
+
+static int
+DDS_Security_Deserialize_uint16(
+     DDS_Security_Deserializer dser,
+     unsigned short *value)
+{
+    size_t l = sizeof(unsigned short);
+
+    DDS_Security_Deserialize_align(dser, l);
+
+    if (dser->remain < l) {
+        return 0;
+    }
+    *value = ddsrt_fromBE2u(*(unsigned short *)dser->cursor);
+    dser->cursor += l;
+    dser->remain -= l;
+
+    return 1;
+}
+
+static int
+DDS_Security_Deserialize_uint32_t(
+     DDS_Security_Deserializer dser,
+     uint32_t *value)
+{
+    size_t l = sizeof(uint32_t);
+
+    DDS_Security_Deserialize_align(dser, l);
+
+    if (dser->remain < l) {
+        return 0;
+    }
+    *value = ddsrt_fromBE4u(*(uint32_t *)dser->cursor);
+    dser->cursor += l;
+    dser->remain -= l;
+
+    return 1;
+}
+
+static int
+DDS_Security_Deserialize_string(
+      DDS_Security_Deserializer dser,
+      char **value)
+{
+    uint32_t len;
+    size_t sz;
+
+    if (!DDS_Security_Deserialize_uint32_t(dser, &len)) {
+        return 0;
+    }
+
+    sz = (size_t)len;
+
+    if (dser->remain < sz) {
+        return 0;
+    }
+
+    if (sz > 0 && (dser->cursor[sz-1] == 0)) {
+       *value = ddsrt_strdup((char *)dser->cursor);
+       /* Consider padding */
+       sz = alignup_size(sz, sizeof(uint32_t));
+       dser->cursor += sz;
+       dser->remain -= sz;
+    } else {
+       *value = ddsrt_strdup("");
+    }
+    return 1;
+}
+
+static int
+DDS_Security_Deserialize_OctetArray(
+     DDS_Security_Deserializer dser,
+     unsigned char *arr,
+     uint32_t length)
+{
+    if (dser->remain < length) {
+        return 0;
+    }
+    memcpy(arr, dser->cursor, length);
+    dser->cursor += length;
+    dser->remain -= length;
+
+    return 1;
+}
+
+static int
+DDS_Security_Deserialize_OctetSeq(
+     DDS_Security_Deserializer dser,
+     DDS_Security_OctetSeq *seq)
+{
+    if (!DDS_Security_Deserialize_uint32_t(dser, &seq->_length)) {
+        return 0;
+    }
+
+    if (dser->remain < seq->_length) {
+        return 0;
+    }
+
+    if (seq->_length > 0) {
+        /* Consider padding */
+        size_t a_size = alignup_size(seq->_length, sizeof(uint32_t));
+        seq->_buffer = ddsrt_malloc(seq->_length);
+        memcpy(seq->_buffer, dser->cursor, seq->_length);
+        dser->cursor += a_size;
+        dser->remain -= a_size;
+    } else {
+        seq->_buffer = NULL;
+    }
+    return 1;
+}
+
+static int
+DDS_Security_Deserialize_Property(
+     DDS_Security_Deserializer dser,
+     DDS_Security_Property_t *property)
+{
+    return DDS_Security_Deserialize_string(dser, &property->name) &&
+           DDS_Security_Deserialize_string(dser, &property->value);
+}
+
+static int
+DDS_Security_Deserialize_BinaryProperty(
+     DDS_Security_Deserializer dser,
+     DDS_Security_BinaryProperty_t *property)
+{
+    return DDS_Security_Deserialize_string(dser, &property->name) &&
+           DDS_Security_Deserialize_OctetSeq(dser, &property->value);
+}
+
+static int
+DDS_Security_Deserialize_PropertySeq(
+     DDS_Security_Deserializer dser,
+     DDS_Security_PropertySeq *seq)
+{
+    int r = 1;
+    uint32_t i;
+
+    if (!DDS_Security_Deserialize_uint32_t(dser, &seq->_length)) {
+        return 0;
+    }
+
+    if (seq->_length > 0) {
+        seq->_buffer = DDS_Security_PropertySeq_allocbuf(seq->_length);
+        for (i = 0; i < seq->_length && r; i++) {
+            r = DDS_Security_Deserialize_Property(dser, &seq->_buffer[i]);
+        }
+    }
+
+    return r;
+}
+
+static int
+DDS_Security_Deserialize_BinaryPropertySeq(
+     DDS_Security_Deserializer dser,
+     DDS_Security_BinaryPropertySeq *seq)
+{
+    int r = 1;
+    uint32_t i;
+
+    if (!DDS_Security_Deserialize_uint32_t(dser, &seq->_length)) {
+        return 0;
+    }
+
+    if (seq->_length > 0) {
+        seq->_buffer = DDS_Security_BinaryPropertySeq_allocbuf(seq->_length);
+        for (i = 0; i < seq->_length && r; i++) {
+            r = DDS_Security_Deserialize_BinaryProperty(dser, &seq->_buffer[i]);
+        }
+    }
+
+    return r;
+}
+
+static int
+DDS_Security_Deserialize_DataHolder(
+      DDS_Security_Deserializer dser,
+      DDS_Security_DataHolder *holder)
+{
+    return DDS_Security_Deserialize_string(dser, &holder->class_id) &&
+           DDS_Security_Deserialize_PropertySeq(dser, &holder->properties) &&
+           DDS_Security_Deserialize_BinaryPropertySeq(dser, &holder->binary_properties);
+}
+
+
+static int
+DDS_Security_Deserialize_PropertyQosPolicy(
+     DDS_Security_Deserializer dser,
+     DDS_Security_PropertyQosPolicy *policy)
+{
+    return DDS_Security_Deserialize_PropertySeq(dser, &policy->value) &&
+           DDS_Security_Deserialize_BinaryPropertySeq(dser, &policy->binary_value);
+}
+
+static int
+DDS_Security_Deserialize_BuiltinTopicKey(
+     DDS_Security_Deserializer dser,
+     DDS_Security_BuiltinTopicKey_t key)
+{
+    int r;
+
+    r = DDS_Security_Deserialize_uint32_t(dser, (uint32_t *)&key[0]) &&
+        DDS_Security_Deserialize_uint32_t(dser, (uint32_t *)&key[1]) &&
+        DDS_Security_Deserialize_uint32_t(dser, (uint32_t *)&key[2]);
+
+    /* guid is 16 bytes, so skip the last 4 bytes */
+    dser->cursor += 4;
+    dser->remain -= 4;
+
+    return r;
+}
+
+static int
+DDS_Security_Deserialize_ParticipantSecurityInfo(
+    DDS_Security_Deserializer dser,
+    DDS_Security_ParticipantSecurityInfo *info)
+{
+    int r;
+
+    r =  DDS_Security_Deserialize_uint32_t(dser, &info->participant_security_attributes) &&
+         DDS_Security_Deserialize_uint32_t(dser, &info->plugin_participant_security_attributes);
+
+    return r;
+}
+
+int
+DDD_Security_Deserialize_ParticipantBuiltinTopicData(
+     DDS_Security_Deserializer dser,
+     DDS_Security_ParticipantBuiltinTopicData *pdata,
+     DDS_Security_SecurityException *ex)
+{
+    unsigned short len=0;
+    unsigned short pid=0;
+    int r, ready = 0;
+
+    do {
+        DDS_Security_Deserialize_align(dser, 4);
+        r = DDS_Security_Deserialize_uint16(dser, &pid) &&
+            DDS_Security_Deserialize_uint16(dser, &len);
+
+        if (r && (len <= dser->remain)) {
+            const unsigned char *next_cursor = dser->cursor + len;
+
+            switch (pid) {
+            case PID_PARTICIPANT_GUID:
+                r = DDS_Security_Deserialize_BuiltinTopicKey(dser, pdata->key);
+                break;
+            case PID_USER_DATA:
+                r = DDS_Security_Deserialize_OctetSeq(dser, &pdata->user_data.value);
+                break;
+            case PID_IDENTITY_TOKEN:
+                r = DDS_Security_Deserialize_DataHolder(dser, &pdata->identity_token);
+                break;
+            case PID_PERMISSIONS_TOKEN:
+                r = DDS_Security_Deserialize_DataHolder(dser, &pdata->permissions_token);
+                break;
+            case PID_PROPERTY_LIST:
+                r = DDS_Security_Deserialize_PropertyQosPolicy(dser, &pdata->property);
+                break;
+            case PID_PARTICIPANT_SECURITY_INFO:
+                r = DDS_Security_Deserialize_ParticipantSecurityInfo(dser, &pdata->security_info);
+                break;
+            case PID_SENTINEL:
+                ready = 1;
+                break;
+            default:
+                dser->cursor += len;
+                dser->remain -= len;
+                break;
+            }
+
+            if (r) {
+                if (dser->cursor != next_cursor) {
+                    DDS_Security_Exception_set(ex, "Deserialization", DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED,
+                            "Deserialize PID 0x%x failed: internal_size %d != external_size %d", pid, (int)len + (int)(dser->cursor - next_cursor), (int)len);
+                    r = 0;
+                }
+            } else {
+                DDS_Security_Exception_set(ex, "Deserialization", DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED,
+                        "Deserialize PID 0x%x failed: parsing failed", pid);
+            }
+        } else {
+            if (!r) {
+                DDS_Security_Exception_set(ex, "Deserialization", DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED,
+                        "Deserialize parameter header failed");
+            }
+        }
+    } while (r && !ready && dser->remain > 0);
+
+    return ready;
+}
+
+void
+DDD_Security_BuiltinTopicKeyBE(
+     DDS_Security_BuiltinTopicKey_t dst,
+     const  DDS_Security_BuiltinTopicKey_t src)
+{
+    dst[0] = ddsrt_toBE4u(src[0]);
+    dst[1] = ddsrt_toBE4u(src[1]);
+    dst[2] = ddsrt_toBE4u(src[2]);
+}
+
+int
+DDD_Security_Deserialize_KeyMaterial_AES_GCM_GMAC(
+     DDS_Security_Deserializer dser,
+     DDS_Security_KeyMaterial_AES_GCM_GMAC *data)
+{
+    int r = 0;
+
+    r = DDS_Security_Deserialize_OctetArray(dser, data->transformation_kind, sizeof(data->transformation_kind)) &&
+        DDS_Security_Deserialize_OctetSeq(dser, &data->master_salt) &&
+        DDS_Security_Deserialize_OctetArray(dser, data->sender_key_id, sizeof(data->sender_key_id)) &&
+        DDS_Security_Deserialize_OctetSeq(dser, &data->master_sender_key) &&
+        DDS_Security_Deserialize_OctetArray(dser, data->receiver_specific_key_id, sizeof(data->receiver_specific_key_id)) &&
+        DDS_Security_Deserialize_OctetSeq(dser, &data->master_receiver_specific_key);
+
+    return r;
+}
diff --git a/src/security/core/src/dds_security_utils.c b/src/security/core/src/dds_security_utils.c
new file mode 100644
index 0000000..8e417e6
--- /dev/null
+++ b/src/security/core/src/dds_security_utils.c
@@ -0,0 +1,1134 @@
+/*
+ * Copyright(c) 2006 to 2019 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+
+#include <assert.h>
+#include <string.h>
+#include <stdarg.h>
+#include <stdio.h>
+#include "dds/security/dds_security_api.h"
+#include "dds/security/core/dds_security_utils.h"
+#include "dds/ddsrt/heap.h"
+#include "stdlib.h"
+#include "stdarg.h"
+#include "dds/ddsrt/string.h"
+#include "dds/ddsrt/misc.h"
+
+#if DDSI_INCLUDE_SSL
+#include <openssl/bio.h>
+#include <openssl/err.h>
+#endif
+
+DDS_Security_BinaryProperty_t *
+DDS_Security_BinaryProperty_alloc (void)
+{
+  DDS_Security_BinaryProperty_t *property;
+
+  property = ddsrt_malloc(sizeof(DDS_Security_BinaryProperty_t));
+  memset(property, 0, sizeof(DDS_Security_BinaryProperty_t));
+  return property;
+}
+
+void
+DDS_Security_BinaryProperty_deinit(
+    DDS_Security_BinaryProperty_t *p)
+{
+    if (!p) {
+        return;
+    }
+
+    ddsrt_free(p->name);
+    ddsrt_free(p->value._buffer);
+}
+
+void
+DDS_Security_BinaryProperty_free(
+    DDS_Security_BinaryProperty_t *p)
+{
+    if (p) {
+        DDS_Security_BinaryProperty_deinit(p);
+        ddsrt_free(p);
+    }
+}
+
+void
+DDS_Security_BinaryProperty_copy(
+     DDS_Security_BinaryProperty_t *dst,
+     DDS_Security_BinaryProperty_t *src)
+{
+    dst->name = src->name ? ddsrt_strdup(src->name) : NULL;
+    dst->propagate = src->propagate;
+    dst->value._length = src->value._length;
+    dst->value._maximum = src->value._maximum;
+
+    if (src->value._buffer) {
+        dst->value._buffer = ddsrt_malloc(src->value._length);
+        memcpy(dst->value._buffer, src->value._buffer, src->value._length);
+    } else {
+        dst->value._buffer = NULL;
+    }
+}
+
+bool
+DDS_Security_BinaryProperty_equal(
+     DDS_Security_BinaryProperty_t *pa,
+     DDS_Security_BinaryProperty_t *pb)
+{
+    uint32_t i;
+
+    if (pa->name && pb->name) {
+        if (strcmp(pa->name, pb->name) != 0) {
+            return false;
+        }
+    } else if (pa->name || pb->name) {
+        return false;
+    }
+
+    if (pa->value._length != pb->value._length) {
+        return false;
+    }
+
+    for (i = 0; i < pa->value._length; i++) {
+        if (pa->value._buffer && pb->value._buffer) {
+            if (memcmp(pa->value._buffer, pb->value._buffer, pa->value._length) != 0) {
+                return false;
+            }
+        } else {
+            return false;
+        }
+    }
+
+    return true;
+}
+
+void
+DDS_Security_BinaryProperty_set_by_value(
+     DDS_Security_BinaryProperty_t *bp,
+     const char *name,
+     const unsigned char *data,
+     uint32_t length)
+{
+    assert(bp);
+    assert(name);
+    assert(data);
+
+    bp->name = ddsrt_strdup(name);
+    bp->value._length = length;
+    bp->value._maximum = length;
+    if (length) {
+        bp->value._buffer = ddsrt_malloc(length);
+        memcpy(bp->value._buffer, data, length);
+    } else {
+        bp->value._buffer = NULL;
+    }
+}
+
+void
+DDS_Security_BinaryProperty_set_by_string(
+     DDS_Security_BinaryProperty_t *bp,
+     const char *name,
+     const char *data)
+{
+    uint32_t length;
+
+    assert(bp);
+    assert(name);
+    assert(data);
+
+    length = (uint32_t) strlen(data) + 1;
+    DDS_Security_BinaryProperty_set_by_value(bp, name, (unsigned char *)data, length);
+}
+
+void
+DDS_Security_BinaryProperty_set_by_ref(
+     DDS_Security_BinaryProperty_t *bp,
+     const char *name,
+     unsigned char *data,
+     uint32_t length)
+{
+    assert(bp);
+    assert(name);
+    assert(data);
+    assert(length > 0);
+
+    bp->name = ddsrt_strdup(name);
+    bp->value._length = length;
+    bp->value._maximum = length;
+    bp->value._buffer = data;
+}
+
+DDS_Security_BinaryPropertySeq *
+DDS_Security_BinaryPropertySeq_alloc (void)
+{
+    DDS_Security_BinaryPropertySeq *seq;
+
+    seq = ddsrt_malloc(sizeof(DDS_Security_BinaryPropertySeq));
+    memset(seq, 0, sizeof(DDS_Security_BinaryPropertySeq));
+    return seq;
+}
+
+DDS_Security_BinaryProperty_t *
+DDS_Security_BinaryPropertySeq_allocbuf (
+     DDS_Security_unsigned_long len)
+{
+    DDS_Security_BinaryProperty_t *buffer;
+
+    buffer = ddsrt_malloc(len * sizeof(DDS_Security_BinaryProperty_t));
+    memset(buffer, 0, len * sizeof(DDS_Security_BinaryProperty_t));
+    return buffer;
+}
+
+void
+DDS_Security_BinaryPropertySeq_deinit(
+     DDS_Security_BinaryPropertySeq *seq)
+{
+    uint32_t i;
+
+    if (!seq) {
+        return;
+    }
+    for (i = 0; i < seq->_length; i++) {
+        ddsrt_free(seq->_buffer[i].name);
+        DDS_Security_OctetSeq_deinit(&seq->_buffer[i].value);
+    }
+}
+
+void
+DDS_Security_BinaryPropertySeq_free(
+     DDS_Security_BinaryPropertySeq *seq)
+{
+    DDS_Security_BinaryPropertySeq_deinit(seq);
+    ddsrt_free(seq);
+}
+
+
+DDS_Security_Property_t *
+DDS_Security_Property_alloc (void)
+{
+  DDS_Security_Property_t *property;
+
+  property = ddsrt_malloc(sizeof(DDS_Security_Property_t));
+  memset(property, 0, sizeof(DDS_Security_Property_t));
+  return property;
+}
+
+void
+DDS_Security_Property_free(
+    DDS_Security_Property_t *p)
+{
+    if (p) {
+        DDS_Security_Property_deinit(p);
+        ddsrt_free(p);
+    }
+}
+
+void
+DDS_Security_Property_deinit(
+    DDS_Security_Property_t *p)
+{
+    if (!p) {
+        return;
+    }
+
+    ddsrt_free(p->name);
+    ddsrt_free(p->value);
+}
+
+void
+DDS_Security_Property_copy(
+     DDS_Security_Property_t *dst,
+     DDS_Security_Property_t *src)
+{
+    dst->name = src->name ? ddsrt_strdup(src->name) : NULL;
+    dst->value = src->value ? ddsrt_strdup(src->value) : NULL;
+    dst->propagate = src->propagate;
+}
+
+bool
+DDS_Security_Property_equal(
+     DDS_Security_Property_t *pa,
+     DDS_Security_Property_t *pb)
+{
+    if (pa->name && pb->name) {
+        if (strcmp(pa->name, pb->name) != 0) {
+            return false;
+        }
+    } else if (pa->name || pb->name) {
+        return false;
+    }
+
+    if (pa->value && pb->value) {
+        if (strcmp(pa->value, pb->value) != 0) {
+            return false;
+        }
+    } else if (pa->value || pb->value) {
+        return false;
+    }
+
+    return true;
+}
+
+char *
+DDS_Security_Property_get_value(
+     const DDS_Security_PropertySeq *properties,
+     const char *name)
+{
+    uint32_t i;
+    char *value = NULL;
+
+    assert(properties);
+    assert(name);
+
+    for (i = 0; !value && (i < properties->_length); i++) {
+        if (properties->_buffer[i].name &&
+            (strcmp(name, properties->_buffer[i].name) == 0)) {
+            if (properties->_buffer[i].value) {
+                value = ddsrt_strdup(properties->_buffer[i].value);
+            }
+        }
+    }
+
+    return value;
+}
+
+DDS_Security_PropertySeq *
+DDS_Security_PropertySeq_alloc (void)
+{
+    DDS_Security_PropertySeq *seq;
+
+    seq = ddsrt_malloc(sizeof(DDS_Security_PropertySeq));
+    memset(seq, 0, sizeof(DDS_Security_PropertySeq));
+    return seq;
+}
+
+DDS_Security_Property_t *
+DDS_Security_PropertySeq_allocbuf (
+     DDS_Security_unsigned_long len)
+{
+    DDS_Security_Property_t *buffer;
+
+    buffer = ddsrt_malloc(len * sizeof(DDS_Security_Property_t));
+    memset(buffer, 0, len * sizeof(DDS_Security_Property_t));
+
+    return buffer;
+}
+
+void
+DDS_Security_PropertySeq_freebuf(
+     DDS_Security_PropertySeq *seq)
+{
+  uint32_t i;
+
+  if (seq) {
+    for (i = 0; i < seq->_length; i++) {
+      ddsrt_free(seq->_buffer[i].name);
+      ddsrt_free(seq->_buffer[i].value);
+    }
+    ddsrt_free(seq->_buffer);
+    seq->_length = 0;
+    seq->_maximum = 0;
+    seq->_buffer = NULL;
+  }
+}
+
+void
+DDS_Security_PropertySeq_free(
+     DDS_Security_PropertySeq *seq)
+{
+    DDS_Security_PropertySeq_deinit(seq);
+    ddsrt_free(seq);
+}
+
+void
+DDS_Security_PropertySeq_deinit(
+    DDS_Security_PropertySeq *seq)
+{
+    uint32_t i;
+
+    if (!seq) {
+        return;
+    }
+    for (i = 0; i < seq->_length; i++) {
+        ddsrt_free(seq->_buffer[i].name);
+        ddsrt_free(seq->_buffer[i].value);
+    }
+    ddsrt_free(seq->_buffer);
+}
+
+const DDS_Security_Property_t *
+DDS_Security_PropertySeq_find_property (
+     const DDS_Security_PropertySeq *property_seq,
+     const char *name )
+{
+
+    DDS_Security_Property_t *result = NULL;
+    unsigned i, len;
+
+    assert(property_seq);
+    assert(name);
+
+    len = (unsigned)strlen(name);
+    for (i = 0; !result && (i < property_seq->_length); i++) {
+        if (property_seq->_buffer[i].name &&
+            (strncmp(name, property_seq->_buffer[i].name, len+ 1) == 0)) {
+            result = &property_seq->_buffer[i];
+        }
+    }
+
+    return result;
+}
+
+DDS_Security_DataHolder *
+DDS_Security_DataHolder_alloc(void)
+{
+    DDS_Security_DataHolder *holder;
+    holder = ddsrt_malloc(sizeof(*holder));
+    memset(holder, 0, sizeof(*holder));
+    return holder;
+}
+
+void
+DDS_Security_DataHolder_free(
+    DDS_Security_DataHolder *holder)
+{
+    if (!holder) {
+        return;
+    }
+    DDS_Security_DataHolder_deinit(holder);
+    ddsrt_free(holder);
+}
+
+void
+DDS_Security_DataHolder_deinit(
+    DDS_Security_DataHolder *holder)
+{
+    uint32_t i;
+
+    if (!holder) {
+        return;
+    }
+
+    ddsrt_free(holder->class_id);
+
+    for (i = 0; i < holder->properties._length; i++) {
+        DDS_Security_Property_deinit(&holder->properties._buffer[i]);
+    }
+    ddsrt_free(holder->properties._buffer);
+
+    for (i = 0; i < holder->binary_properties._length; i++) {
+        DDS_Security_BinaryProperty_deinit(&holder->binary_properties._buffer[i]);
+    }
+    ddsrt_free(holder->binary_properties._buffer);
+
+    memset(holder, 0, sizeof(*holder));
+}
+
+void
+DDS_Security_DataHolder_copy(
+     DDS_Security_DataHolder *dst,
+     const DDS_Security_DataHolder *src)
+{
+    uint32_t i;
+
+    assert(dst);
+    assert(src);
+
+    if (src->class_id) {
+        dst->class_id = ddsrt_strdup(src->class_id);
+    } else {
+        dst->class_id = NULL;
+    }
+
+    dst->properties = src->properties;
+    if (src->properties._buffer) {
+        dst->properties._buffer = DDS_Security_PropertySeq_allocbuf(src->properties._length);
+        for (i = 0; i < src->properties._length; i++) {
+            DDS_Security_Property_copy(&dst->properties._buffer[i], &src->properties._buffer[i]);
+        }
+    }
+
+    dst->binary_properties = src->binary_properties;
+    if (src->binary_properties._buffer) {
+        dst->binary_properties._buffer = DDS_Security_BinaryPropertySeq_allocbuf(src->binary_properties._length);
+        for (i = 0; i < src->binary_properties._length; i++) {
+            DDS_Security_BinaryProperty_copy(&dst->binary_properties._buffer[i], &src->binary_properties._buffer[i]);
+        }
+    }
+}
+
+bool
+DDS_Security_DataHolder_equal(
+     const DDS_Security_DataHolder *psa,
+     const DDS_Security_DataHolder *psb)
+{
+    uint32_t i;
+
+    if (psa->class_id && psb->class_id) {
+        if (strcmp(psa->class_id, psb->class_id) != 0) {
+            return false;
+        }
+    } else if (psa->class_id || psb->class_id) {
+        return false;
+    }
+
+    for (i = 0; i < psa->properties._length; i++) {
+        if (!DDS_Security_Property_equal(&psa->properties._buffer[i], &psb->properties._buffer[i])) {
+            return false;
+        }
+    }
+
+    for (i = 0; i < psa->binary_properties._length; i++) {
+        if (!DDS_Security_BinaryProperty_equal(&psa->binary_properties._buffer[i], &psb->binary_properties._buffer[i])) {
+            return false;
+        }
+    }
+
+    return true;
+}
+
+
+const DDS_Security_Property_t *
+DDS_Security_DataHolder_find_property(
+     const DDS_Security_DataHolder *holder,
+     const char *name)
+{
+
+    assert(holder);
+    assert(name);
+
+    return DDS_Security_PropertySeq_find_property ( &(holder->properties), name );
+}
+
+const DDS_Security_BinaryProperty_t *
+DDS_Security_DataHolder_find_binary_property(
+     const DDS_Security_DataHolder *holder,
+     const char *name)
+{
+    DDS_Security_BinaryProperty_t *result = NULL;
+    unsigned i, len;
+
+    assert(holder);
+    assert(name);
+
+    len = (unsigned)strlen(name);
+
+    for (i = 0; !result && (i < holder->binary_properties._length); i++) {
+        if (holder->binary_properties._buffer[i].name &&
+           (strncmp(name, holder->binary_properties._buffer[i].name, len+1) == 0)) {
+            result = &holder->binary_properties._buffer[i];
+        }
+    }
+
+    return result;
+}
+
+DDS_Security_DataHolderSeq *
+DDS_Security_DataHolderSeq_alloc (void)
+{
+    DDS_Security_DataHolderSeq *holder;
+
+    holder = ddsrt_malloc(sizeof(DDS_Security_DataHolderSeq));
+    memset(holder, 0, sizeof(DDS_Security_DataHolderSeq));
+    return holder;
+}
+
+DDS_Security_DataHolder *
+DDS_Security_DataHolderSeq_allocbuf (
+     DDS_Security_unsigned_long len)
+{
+    DDS_Security_DataHolder *buffer;
+
+    buffer = ddsrt_malloc(len * sizeof(DDS_Security_DataHolder));
+    memset(buffer, 0, len * sizeof(DDS_Security_DataHolder));
+    return buffer;
+}
+
+void
+DDS_Security_DataHolderSeq_freebuf(
+     DDS_Security_DataHolderSeq *seq)
+{
+    uint32_t i;
+
+    if (seq) {
+        for (i = 0; i < seq->_length; i++) {
+            DDS_Security_DataHolder_deinit(&seq->_buffer[i]);
+        }
+        ddsrt_free(seq->_buffer);
+        seq->_buffer = NULL;
+        seq->_length = 0;
+        seq->_maximum = 0;
+    }
+}
+
+void
+DDS_Security_DataHolderSeq_free(
+     DDS_Security_DataHolderSeq *seq)
+{
+    if (seq) {
+        DDS_Security_DataHolderSeq_freebuf(seq);
+        ddsrt_free(seq);
+    }
+}
+
+void
+DDS_Security_DataHolderSeq_deinit(
+     DDS_Security_DataHolderSeq *seq)
+{
+    if (seq) {
+        DDS_Security_DataHolderSeq_freebuf(seq);
+    }
+}
+
+void
+DDS_Security_DataHolderSeq_copy(
+     DDS_Security_DataHolderSeq *dst,
+     const DDS_Security_DataHolderSeq *src)
+{
+    uint32_t i;
+
+    assert(dst);
+    assert(src);
+
+    *dst = *src;
+
+    if (src->_length) {
+        dst->_buffer = DDS_Security_DataHolderSeq_allocbuf(src->_length);
+    }
+
+    for (i = 0; i < src->_length; i++) {
+        DDS_Security_DataHolder_copy(&dst->_buffer[i], &src->_buffer[i]);
+    }
+}
+
+DDS_Security_ParticipantBuiltinTopicData *
+DDS_Security_ParticipantBuiltinTopicData_alloc(void)
+{
+    DDS_Security_ParticipantBuiltinTopicData *result;
+
+    result = ddsrt_malloc(sizeof(*result));
+    memset(result, 0, sizeof(*result));
+
+    return result;
+}
+
+void
+DDS_Security_ParticipantBuiltinTopicData_free(
+     DDS_Security_ParticipantBuiltinTopicData *data)
+{
+    DDS_Security_ParticipantBuiltinTopicData_deinit(data);
+    ddsrt_free(data);
+}
+
+void
+DDS_Security_ParticipantBuiltinTopicData_deinit(
+     DDS_Security_ParticipantBuiltinTopicData *data)
+{
+    if (!data) {
+        return;
+    }
+    DDS_Security_DataHolder_deinit(&data->identity_token);
+    DDS_Security_DataHolder_deinit(&data->permissions_token);
+    DDS_Security_PropertyQosPolicy_deinit(&data->property);
+    DDS_Security_OctetSeq_deinit(&data->user_data.value);
+}
+
+DDS_Security_OctetSeq *
+DDS_Security_OctetSeq_alloc (void)
+{
+  return (DDS_Security_OctetSeq *)ddsrt_malloc(sizeof(DDS_Security_OctetSeq ));
+}
+
+DDS_Security_octet *
+DDS_Security_OctetSeq_allocbuf (
+     DDS_Security_unsigned_long len)
+{
+  return (DDS_Security_octet*)ddsrt_malloc(sizeof(DDS_Security_octet)*len);
+}
+
+void
+DDS_Security_OctetSeq_freebuf(
+     DDS_Security_OctetSeq *seq)
+{
+    if (!seq) {
+        return;
+    }
+    ddsrt_free(seq->_buffer);
+    seq->_buffer = NULL;
+    seq->_length = 0;
+    seq->_maximum = 0;
+}
+
+void
+DDS_Security_OctetSeq_free(
+     DDS_Security_OctetSeq *seq)
+{
+    DDS_Security_OctetSeq_deinit(seq);
+    ddsrt_free(seq);
+}
+
+void
+DDS_Security_OctetSeq_deinit(
+     DDS_Security_OctetSeq *seq)
+{
+    DDS_Security_OctetSeq_freebuf(seq);
+}
+
+
+void
+DDS_Security_OctetSeq_copy(
+     DDS_Security_OctetSeq *dst,
+     const DDS_Security_OctetSeq *src)
+{
+    if (dst->_length > 0) {
+        DDS_Security_OctetSeq_deinit(dst);
+    }
+    dst->_length = src->_length;
+    dst->_maximum = src->_maximum;
+
+    if (src->_length) {
+        dst->_buffer = ddsrt_malloc(src->_length);
+        memcpy(dst->_buffer, src->_buffer, src->_length);
+    } else {
+        dst->_buffer = NULL;
+    }
+}
+
+DDS_Security_HandleSeq *
+DDS_Security_HandleSeq_alloc(void)
+{
+    DDS_Security_HandleSeq *seq;
+
+    seq = ddsrt_malloc(sizeof(*seq));
+    seq->_buffer = NULL;
+    seq->_length = 0;
+    seq->_maximum = 0;
+
+    return seq;
+}
+
+DDS_Security_long_long *
+DDS_Security_HandleSeq_allocbuf(
+     DDS_Security_unsigned_long length)
+{
+    DDS_Security_long_long *buffer;
+    buffer = ddsrt_malloc(length * sizeof(DDS_Security_long_long));
+    memset(buffer, 0, length * sizeof(DDS_Security_long_long));
+    return buffer;
+}
+
+void
+DDS_Security_HandleSeq_freebuf(
+     DDS_Security_HandleSeq *seq)
+{
+    if (!seq) {
+        return;
+    }
+    ddsrt_free(seq->_buffer);
+    seq->_maximum = 0;
+    seq->_length = 0;
+}
+
+void
+DDS_Security_HandleSeq_free(
+     DDS_Security_HandleSeq *seq)
+{
+    if (!seq) {
+        return;
+    }
+    DDS_Security_HandleSeq_freebuf(seq);
+    ddsrt_free(seq);
+}
+
+void
+DDS_Security_HandleSeq_deinit(
+     DDS_Security_HandleSeq *seq)
+{
+    if (!seq) {
+        return;
+    }
+    DDS_Security_HandleSeq_freebuf(seq);
+}
+
+
+
+
+void
+DDS_Security_Exception_set(
+     DDS_Security_SecurityException *ex,
+     const char *context,
+     int code,
+     int minor_code,
+     const char *fmt,
+    ...)
+{
+    int32_t ret;
+    size_t len;
+    char buf[1] = { '\0' };
+    char *str = NULL;
+    va_list args1, args2;
+
+    assert(context);
+    assert(fmt);
+    assert(ex);
+    DDSRT_UNUSED_ARG( context );
+
+    va_start(args1, fmt);
+    va_copy(args2, args1);
+
+    if ((ret = vsnprintf(buf, sizeof(buf), fmt, args1)) >= 0) {
+        len = (size_t)ret; /* +1 for null byte */
+        if ((str = ddsrt_malloc(len + 1)) == NULL) {
+            assert(false);
+        } else if ((ret = vsnprintf(str, len + 1, fmt, args2)) >= 0) {
+            assert((size_t) ret == len);
+        } else {
+            ddsrt_free(str);
+            str = NULL;
+        }
+    }
+
+    va_end(args1);
+    va_end(args2);
+
+    ex->message = str;
+    ex->code = code;
+    ex->minor_code = minor_code;
+}
+
+#if DDSI_INCLUDE_SSL
+DDS_EXPORT void
+DDS_Security_Exception_set_with_openssl_error(
+         DDS_Security_SecurityException *ex,
+         const char *context,
+         int code,
+         int minor_code,
+         const char *error_area
+        )
+{
+
+  BIO *bio;
+  char *buf = NULL;
+  char *str;
+  size_t len; /*BIO_get_mem_data requires long int */
+  assert(context);
+  assert(error_area);
+  assert(ex);
+  DDSRT_UNUSED_ARG( context );
+
+  bio = BIO_new(BIO_s_mem());
+
+  if (bio) {
+      size_t exception_msg_len;
+      ERR_print_errors(bio);
+      len = (size_t)BIO_get_mem_data (bio, &buf);
+      exception_msg_len = len + strlen(error_area) + 1;
+      str = ddsrt_malloc(  exception_msg_len );
+
+      ddsrt_strlcpy(str, error_area, exception_msg_len);
+      memcpy(str + strlen(error_area), buf, len );
+      str [ exception_msg_len -1 ] = '\0';
+      //snprintf( str, exception_msg_len, "%s%s", error_area, buf );
+
+      ex->message = str;
+      ex->code = code;
+      ex->minor_code = minor_code;
+
+      BIO_free(bio);
+
+  } else {
+      DDS_Security_Exception_set(ex, context, code,  minor_code, "BIO_new failed");
+  }
+
+}
+#endif
+
+void
+DDS_Security_Exception_reset(
+     DDS_Security_SecurityException *ex)
+{
+    if (ex) {
+        if (ex->message) {
+            ddsrt_free(ex->message);
+        }
+        DDS_Security_Exception_clean(ex);
+    }
+}
+
+void
+DDS_Security_Exception_clean(
+     DDS_Security_SecurityException *ex)
+{
+    if (ex) {
+        memset(ex, 0, sizeof(DDS_Security_SecurityException));
+    }
+}
+
+void
+DDS_Security_PropertyQosPolicy_deinit(
+     DDS_Security_PropertyQosPolicy *policy)
+{
+    if (!policy) {
+        return;
+    }
+    DDS_Security_PropertySeq_deinit(&policy->value);
+    DDS_Security_BinaryPropertySeq_deinit(&policy->binary_value);
+}
+
+void
+DDS_Security_PropertyQosPolicy_free(
+     DDS_Security_PropertyQosPolicy *policy)
+{
+    DDS_Security_PropertyQosPolicy_deinit(policy);
+    ddsrt_free(policy);
+}
+
+
+void
+DDS_Security_set_token_nil(
+     DDS_Security_DataHolder *token)
+{
+    DDS_Security_DataHolder_deinit(token);
+    memset(token, 0, sizeof(*token));
+    token->class_id = ddsrt_strdup("");
+}
+
+void
+DDS_Security_KeyMaterial_AES_GCM_GMAC_deinit(
+     DDS_Security_KeyMaterial_AES_GCM_GMAC *key_material)
+{
+    if (key_material) {
+        if (key_material->master_receiver_specific_key._buffer != NULL) {
+            ddsrt_free(key_material->master_receiver_specific_key._buffer);
+        }
+        if( key_material->master_salt._buffer != NULL){
+            ddsrt_free(key_material->master_salt._buffer);
+        }
+        if( key_material->master_sender_key._buffer != NULL){
+            ddsrt_free(key_material->master_sender_key._buffer);
+        }
+    }
+}
+
+
+DDS_Security_CryptoTransformKind_Enum
+DDS_Security_basicprotectionkind2transformationkind(
+     const DDS_Security_PropertySeq *properties, 
+     DDS_Security_BasicProtectionKind protection)
+{
+    int keysize=256;
+    const DDS_Security_Property_t *key_size_property = NULL;
+    if( properties != NULL ){
+        key_size_property = DDS_Security_PropertySeq_find_property(
+                    properties, "dds.sec.crypto.keysize");
+
+        if (key_size_property != NULL) {
+            if (strcmp(key_size_property->value, "128") == 0) {
+                keysize = 128;
+            }
+        }
+    }
+
+    switch (protection) {
+        case DDS_SECURITY_BASICPROTECTION_KIND_NONE:
+            return CRYPTO_TRANSFORMATION_KIND_NONE;
+        case DDS_SECURITY_BASICPROTECTION_KIND_SIGN:
+            if( keysize == 128 ){
+                return CRYPTO_TRANSFORMATION_KIND_AES128_GMAC;
+            } else{
+                return CRYPTO_TRANSFORMATION_KIND_AES256_GMAC;
+            }
+        case DDS_SECURITY_BASICPROTECTION_KIND_ENCRYPT:
+            if( keysize == 128 ){
+                return CRYPTO_TRANSFORMATION_KIND_AES128_GCM;
+            } else{
+                return CRYPTO_TRANSFORMATION_KIND_AES256_GCM;
+            }
+        default:
+            return CRYPTO_TRANSFORMATION_KIND_INVALID;
+    }
+}
+
+DDS_Security_CryptoTransformKind_Enum
+DDS_Security_protectionkind2transformationkind(
+     const DDS_Security_PropertySeq *properties,
+     DDS_Security_ProtectionKind protection)
+{
+    int keysize=256;
+    const DDS_Security_Property_t *key_size_property = NULL;
+    if( properties != NULL ){
+        key_size_property = DDS_Security_PropertySeq_find_property(
+                        properties, "dds.sec.crypto.keysize");
+        if (key_size_property != NULL) {
+            if (strcmp(key_size_property->value, "128") == 0) {
+                keysize = 128;
+            }
+        }
+    }
+
+    switch (protection) {
+        case DDS_SECURITY_PROTECTION_KIND_NONE:
+            return CRYPTO_TRANSFORMATION_KIND_NONE;
+        case DDS_SECURITY_PROTECTION_KIND_SIGN_WITH_ORIGIN_AUTHENTICATION:
+        case DDS_SECURITY_PROTECTION_KIND_SIGN:
+            if( keysize == 128 ){
+                return CRYPTO_TRANSFORMATION_KIND_AES128_GMAC;
+            } else{
+                return CRYPTO_TRANSFORMATION_KIND_AES256_GMAC;
+            }
+        case DDS_SECURITY_PROTECTION_KIND_ENCRYPT_WITH_ORIGIN_AUTHENTICATION:
+        case DDS_SECURITY_PROTECTION_KIND_ENCRYPT:
+            if( keysize == 128 ){
+                return CRYPTO_TRANSFORMATION_KIND_AES128_GCM;
+            } else {
+                return CRYPTO_TRANSFORMATION_KIND_AES256_GCM;
+            }
+        default:
+            return CRYPTO_TRANSFORMATION_KIND_INVALID;
+    }
+}
+
+/* for DEBUG purposes */
+void
+print_binary_debug(
+     char* name,
+     unsigned char *value,
+     uint32_t size)
+{
+    uint32_t i;
+    printf("%s: ",name );
+    for( i=0; i<  size; i++)
+    {
+        printf("%x",value[i]);
+    }
+    printf("\n");
+}
+
+void
+print_binary_properties_debug(
+     const DDS_Security_DataHolder *token)
+{
+    uint32_t i;
+    for (i = 0; i < token->binary_properties._length ; i++) {
+        print_binary_debug( token->binary_properties._buffer[i].name, token->binary_properties._buffer[i].value._buffer, token->binary_properties._buffer[i].value._length);
+    }
+
+}
+
+
+
+
+DDS_Security_config_item_prefix_t
+DDS_Security_get_conf_item_type(
+     const char *str,
+     char **data)
+{
+    DDS_Security_config_item_prefix_t kind = DDS_SECURITY_CONFIG_ITEM_PREFIX_UNKNOWN;
+    const char *CONFIG_FILE_PREFIX   = "file:";
+    const char *CONFIG_DATA_PREFIX   = "data:,";
+    const char *CONFIG_PKCS11_PREFIX = "pkcs11:";
+    size_t CONFIG_FILE_PREFIX_LEN   = strlen(CONFIG_FILE_PREFIX);
+    size_t CONFIG_DATA_PREFIX_LEN   = strlen(CONFIG_DATA_PREFIX);
+    size_t CONFIG_PKCS11_PREFIX_LEN = strlen(CONFIG_PKCS11_PREFIX);
+    char *ptr;
+
+    assert(str);
+    assert(data);
+    DDSRT_UNUSED_ARG(str);
+
+    ptr = ddssec_strchrs(str, " \t", false);
+
+    if (strncmp(ptr, CONFIG_FILE_PREFIX, CONFIG_FILE_PREFIX_LEN) == 0) {
+        const char *DOUBLE_SLASH   = "//";
+        size_t DOUBLE_SLASH_LEN = 2;
+        if (strncmp(&(ptr[CONFIG_FILE_PREFIX_LEN]), DOUBLE_SLASH, DOUBLE_SLASH_LEN) == 0) {
+            *data = ddsrt_strdup(&(ptr[CONFIG_FILE_PREFIX_LEN + DOUBLE_SLASH_LEN]));
+        } else {
+            *data = ddsrt_strdup(&(ptr[CONFIG_FILE_PREFIX_LEN]));
+        }
+        kind = DDS_SECURITY_CONFIG_ITEM_PREFIX_FILE;
+    } else if (strncmp(ptr, CONFIG_DATA_PREFIX, CONFIG_DATA_PREFIX_LEN) == 0) {
+        kind = DDS_SECURITY_CONFIG_ITEM_PREFIX_DATA;
+        *data = ddsrt_strdup(&(ptr[CONFIG_DATA_PREFIX_LEN]));
+    } else if (strncmp(ptr, CONFIG_PKCS11_PREFIX, CONFIG_PKCS11_PREFIX_LEN) == 0) {
+        kind = DDS_SECURITY_CONFIG_ITEM_PREFIX_PKCS11;
+        *data = ddsrt_strdup(&(ptr[CONFIG_PKCS11_PREFIX_LEN]));
+    }
+
+    return kind;
+}
+
+
+char *
+ddssec_strchrs (
+        const char *str,
+        const char *chrs,
+        bool inc)
+{
+    bool eq;
+    char *ptr = NULL;
+    size_t i, j;
+
+    assert (str != NULL);
+    assert (chrs != NULL);
+
+    for (i = 0; str[i] != '\0' && ptr == NULL; i++) {
+        for (j = 0, eq = false; chrs[j] != '\0' && eq == false; j++) {
+            if (str[i] == chrs[j]) {
+                eq = true;
+            }
+        }
+        if (eq == inc) {
+            ptr = (char *)str + i;
+        }
+    }
+
+    return ptr;
+}
+
+
+/* The result of os_fileNormalize should be freed with os_free */
+char *
+DDS_Security_normalize_file(
+    const char *filepath)
+{
+    char *norm;
+    const char *fpPtr;
+    char *normPtr;
+#if _WIN32
+  #define __FILESEPCHAR '\\'
+#else
+  #define __FILESEPCHAR '/'
+#endif
+    norm = NULL;
+    if ((filepath != NULL) && (*filepath != '\0')) {
+        norm = ddsrt_malloc(strlen(filepath) + 1);
+        /* replace any / or \ by OS_FILESEPCHAR */
+        fpPtr = (char *) filepath;
+        normPtr = norm;
+        while (*fpPtr != '\0') {
+            *normPtr = *fpPtr;
+            if ((*fpPtr == '/') || (*fpPtr == '\\')) {
+                *normPtr = __FILESEPCHAR;
+                normPtr++;
+            } else {
+                if (*fpPtr != '\"') {
+                    normPtr++;
+                }
+            }
+            fpPtr++;
+        }
+        *normPtr = '\0';
+    }
+#undef __FILESEPCHAR
+    return norm;
+
+}
+
diff --git a/src/security/core/src/shared_secret.c b/src/security/core/src/shared_secret.c
new file mode 100644
index 0000000..7b1de75
--- /dev/null
+++ b/src/security/core/src/shared_secret.c
@@ -0,0 +1,43 @@
+/*
+ * Copyright(c) 2006 to 2019 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+
+#include "dds/security/core/shared_secret.h"
+
+const DDS_Security_octet*
+get_challenge1_from_secret_handle(DDS_Security_SharedSecretHandle handle)
+{
+
+    DDS_Security_SharedSecretHandleImpl *secret = (DDS_Security_SharedSecretHandleImpl *)(uintptr_t)handle;
+    return secret->challenge1;
+}
+
+const DDS_Security_octet*
+get_challenge2_from_secret_handle(DDS_Security_SharedSecretHandle handle)
+{
+    DDS_Security_SharedSecretHandleImpl *secret = (DDS_Security_SharedSecretHandleImpl *)(uintptr_t)handle;
+    return secret->challenge2;
+}
+
+const DDS_Security_octet*
+get_secret_from_secret_handle(DDS_Security_SharedSecretHandle handle)
+{
+    DDS_Security_SharedSecretHandleImpl *secret = (DDS_Security_SharedSecretHandleImpl *)(uintptr_t)handle;
+    return secret->shared_secret;
+}
+
+
+int32_t
+get_secret_size_from_secret_handle( DDS_Security_SharedSecretHandle handle ){
+    DDS_Security_SharedSecretHandleImpl *secret = (DDS_Security_SharedSecretHandleImpl *)(uintptr_t)handle;
+    return secret->shared_secret_size;
+
+}

From e2afccf4a0c03552f1fa1788fe732c61d76f5028 Mon Sep 17 00:00:00 2001
From: Martin Bremmer <martin.bremmer@adlinktech.com>
Date: Mon, 11 Nov 2019 13:11:33 +0100
Subject: [PATCH 075/238] Fixed security build.

Signed-off-by: Martin Bremmer <martin.bremmer@adlinktech.com>
---
 src/CMakeLists.txt                                         | 7 +++++++
 src/core/CMakeLists.txt                                    | 5 +----
 src/security/builtin_plugins/authentication/CMakeLists.txt | 2 +-
 src/security/core/CMakeLists.txt                           | 2 +-
 4 files changed, 10 insertions(+), 6 deletions(-)

diff --git a/src/CMakeLists.txt b/src/CMakeLists.txt
index c72721e..b21ad73 100644
--- a/src/CMakeLists.txt
+++ b/src/CMakeLists.txt
@@ -16,6 +16,13 @@ if(NOT ${PROJECT_NAME} STREQUAL "CycloneDDS")
   message(FATAL_ERROR "Top-level CMakeLists.txt was moved to the top-level directory.  Please run cmake on ${dir} instead of ${CMAKE_CURRENT_LIST_DIR}")
 endif()
 
+
+# Support the OMG DDS Security within ddsc adds quite a bit of code.
+option(ENABLE_SECURITY "Enable OMG DDS Security support" ON)
+if(NOT ENABLE_SECURITY)
+  message(STATUS "Building without OMG DDS Security support")
+endif()
+
 add_subdirectory(ddsrt)
 
 # some of the tests in the core rely on preprocessing IDL, so idlc has to
diff --git a/src/core/CMakeLists.txt b/src/core/CMakeLists.txt
index 6eb9b91..38037f9 100644
--- a/src/core/CMakeLists.txt
+++ b/src/core/CMakeLists.txt
@@ -54,10 +54,7 @@ if(ENABLE_SSL)
 endif()
 
 # Support the OMG DDS Security within ddsc adds quite a bit of code.
-option(ENABLE_SECURITY "Enable OMG DDS Security support" ON)
-if(NOT ENABLE_SECURITY)
-  message(STATUS "Building without OMG DDS Security support")
-else()
+if(ENABLE_SECURITY)
   add_definitions(-DDDSI_INCLUDE_SECURITY)
   target_link_libraries(ddsc PRIVATE security_core)
   target_include_directories(
diff --git a/src/security/builtin_plugins/authentication/CMakeLists.txt b/src/security/builtin_plugins/authentication/CMakeLists.txt
index f5f46a4..9dc9b53 100644
--- a/src/security/builtin_plugins/authentication/CMakeLists.txt
+++ b/src/security/builtin_plugins/authentication/CMakeLists.txt
@@ -56,7 +56,7 @@ target_include_directories(dds_security_auth
 
 install(
   TARGETS 
-  EXPORT "${CMAKE_PROJECT_NAME}"
+  EXPORT "${PROJECT_NAME}"
   RUNTIME DESTINATION "${CMAKE_INSTALL_BINDIR}" COMPONENT lib
   LIBRARY DESTINATION "${CMAKE_INSTALL_LIBDIR}" COMPONENT lib
   ARCHIVE DESTINATION "${CMAKE_INSTALL_LIBDIR}" COMPONENT lib
diff --git a/src/security/core/CMakeLists.txt b/src/security/core/CMakeLists.txt
index 69a2ba5..231eb9e 100644
--- a/src/security/core/CMakeLists.txt
+++ b/src/security/core/CMakeLists.txt
@@ -50,7 +50,7 @@ install(
 
 #install(
 # TARGETS security_core
-# EXPORT "${CMAKE_PROJECT_NAME}"
+# EXPORT "${PROJECT_NAME}"
 #  RUNTIME DESTINATION "${CMAKE_INSTALL_BINDIR}" COMPONENT lib
 #  LIBRARY DESTINATION "${CMAKE_INSTALL_LIBDIR}" COMPONENT lib
 #  ARCHIVE DESTINATION "${CMAKE_INSTALL_LIBDIR}" COMPONENT lib

From 37c64e09655f7c7612e947950aec8777d8141db4 Mon Sep 17 00:00:00 2001
From: Dennis Potman <45659984+dennis-adlink@users.noreply.github.com>
Date: Wed, 4 Dec 2019 10:22:40 +0100
Subject: [PATCH 076/238] Add string functions used by security plugins to
 ddsrt (#334)

* String functions required by DDS Security Access Control plugin

The implementation for the DDS Security Access Control plugin
requires two additional string functions. This commit adds the
ddsrt_str_replace function (including tests) and exports the
existing function ddsrt_todigit.

Signed-off-by: Dennis Potman <dennis.potman@adlinktech.com>

* Suppress strcpy warnings in Windows builds for ddsrt_str_replace

Signed-off-by: Dennis Potman <dennis.potman@adlinktech.com>

* Minor nitpicks on ddsrt_str_replace

Signed-off-by: Erik Boasson <eb@ilities.com>
---
 src/ddsrt/include/dds/ddsrt/string.h | 19 +++++++++++++
 src/ddsrt/include/dds/ddsrt/strtol.h | 13 +++++++++
 src/ddsrt/src/string.c               | 40 ++++++++++++++++++++++++++++
 src/ddsrt/src/strtol.c               |  2 +-
 src/ddsrt/tests/string.c             | 24 +++++++++++++++++
 5 files changed, 97 insertions(+), 1 deletion(-)

diff --git a/src/ddsrt/include/dds/ddsrt/string.h b/src/ddsrt/include/dds/ddsrt/string.h
index 7fca58c..5c8d600 100644
--- a/src/ddsrt/include/dds/ddsrt/string.h
+++ b/src/ddsrt/include/dds/ddsrt/string.h
@@ -176,6 +176,25 @@ ddsrt_strerror_r(
     char *buf,
     size_t buflen);
 
+/**
+ * @brief Replace substring of null terminated string
+ *
+ * @param[in]   str     pointer to string
+ * @param[in]   srch    non-empty string to replace
+ * @param[in]   subst   string to substitute character "srch" with
+ * @param[in]   max     maximum number of times to replace search, or 0 for unlimited
+ *
+ * @returns Pointer to newly allocated string with max occurrences of srch replaced, or
+ * NULL on allocation failure or if srch is an empty string.
+ */
+DDS_EXPORT char *
+ddsrt_str_replace(
+    const char *str,
+    const char *srch,
+    const char *subst,
+    size_t max)
+ddsrt_nonnull_all;
+
 #if defined (__cplusplus)
 }
 #endif
diff --git a/src/ddsrt/include/dds/ddsrt/strtol.h b/src/ddsrt/include/dds/ddsrt/strtol.h
index c4cb059..07860c2 100644
--- a/src/ddsrt/include/dds/ddsrt/strtol.h
+++ b/src/ddsrt/include/dds/ddsrt/strtol.h
@@ -21,6 +21,19 @@
 extern "C" {
 #endif
 
+/**
+ * @brief Convert a character to an integer value
+ *
+ * Translates the numeric value of the provided character. For characters in range
+ * '0' to '9' the returned integer value is 0-9. For the range 'a' to 'z' and 'A'
+ * to 'Z', the numeric return value is 10-36.
+ *
+ * @param[in] chr   The character
+ *
+ * @returns The integer value for the character, or -1 in case @chr cannot be translated to a numeric value
+ */
+DDS_EXPORT int32_t ddsrt_todigit(const int chr);
+
 /**
  * @brief Convert a string to a long long integer.
  *
diff --git a/src/ddsrt/src/string.c b/src/ddsrt/src/string.c
index d048e5f..e625535 100644
--- a/src/ddsrt/src/string.c
+++ b/src/ddsrt/src/string.c
@@ -15,7 +15,9 @@
 #include <string.h>
 
 #include "dds/ddsrt/heap.h"
+#include "dds/ddsrt/misc.h"
 #include "dds/ddsrt/string.h"
+#include "dds/ddsrt/types.h"
 
 int
 ddsrt_strcasecmp(
@@ -162,3 +164,41 @@ ddsrt_strdup(
 
   return ddsrt_memdup(str, strlen(str) + 1);
 }
+
+char *
+ddsrt_str_replace(
+    const char *str,
+    const char *srch,
+    const char *subst,
+    size_t max)
+{
+  const size_t lsrch = strlen(srch);
+  if (lsrch == 0) /* empty search string is treated as failure */
+    return NULL;
+
+  const size_t lsubst = strlen(subst);
+  const size_t lstr = strlen(str);
+  const char *cur = str;
+  char *res;
+  size_t cnt;
+
+  if (max == 0)
+    max = SIZE_MAX;
+  for (cnt = 0; (cur = strstr(cur, srch)) != NULL && cnt < max; cnt++)
+    cur += lsrch;
+  if ((res = ddsrt_malloc(lstr + cnt * (lsubst - lsrch) + 1)) == NULL)
+    return NULL;
+  char *tmp = res;
+  cur = str;
+  while (cnt--)
+  {
+    const char *found = strstr(cur, srch);
+    const size_t skip = (size_t)(found - cur);
+    memcpy(tmp, cur, skip);
+    memcpy(tmp + skip, subst, lsubst);
+    tmp += skip + lsubst;
+    cur += skip + lsrch;
+  }
+  memcpy(tmp, cur, lstr - (size_t) (cur - str) + 1);
+  return res;
+}
diff --git a/src/ddsrt/src/strtol.c b/src/ddsrt/src/strtol.c
index 5269d96..f8d4223 100644
--- a/src/ddsrt/src/strtol.c
+++ b/src/ddsrt/src/strtol.c
@@ -16,7 +16,7 @@
 
 #include "dds/ddsrt/strtol.h"
 
-static int ddsrt_todigit(const int chr)
+int32_t ddsrt_todigit(const int chr)
 {
   if (chr >= '0' && chr <= '9') {
     return chr - '0';
diff --git a/src/ddsrt/tests/string.c b/src/ddsrt/tests/string.c
index eae2cc7..babe9af 100644
--- a/src/ddsrt/tests/string.c
+++ b/src/ddsrt/tests/string.c
@@ -12,6 +12,7 @@
 #include <string.h>
 
 #include "CUnit/Theory.h"
+#include "dds/ddsrt/heap.h"
 #include "dds/ddsrt/string.h"
 
 typedef enum { eq, lt, gt } eq_t;
@@ -67,3 +68,26 @@ CU_Theory((const char *s1, const char *s2, size_t n, eq_t e), ddsrt_strncasecmp,
   CU_ASSERT((e == eq && r == 0) || (e == lt && r < 0) || (e == gt && r > 0));
 }
 
+CU_TheoryDataPoints(ddsrt_str_replace, basic) = {
+  CU_DataPoints(const char *,  "",  "a", "aaa",  "aaa",   "aaa", "aaa",   "a", "aa",    "acaca", "aacaacaa", "aaa"),
+  CU_DataPoints(const char *, "a",   "",   "a",    "a",     "a",  "aa", "aaa",  "a",        "a",       "aa",   "a"),
+  CU_DataPoints(const char *, "b",  "b",   "b",   "bb",    "bb",   "b",   "b",  "b",       "bb",        "b",    ""),
+  CU_DataPoints(size_t,         0,    0,     0,      1,       2,     0,     0,   10,          0,          2,     0),
+  CU_DataPoints(const char *,  "", NULL, "bbb", "bbaa", "bbbba",  "ba",   "a", "bb", "bbcbbcbb",   "bcbcaa",    ""),
+};
+
+CU_Theory((const char *str, const char *srch, const char *subst, size_t max, const char * exp), ddsrt_str_replace, basic)
+{
+  char * r = ddsrt_str_replace(str, srch, subst, max);
+  if (exp != NULL)
+  {
+    CU_ASSERT_FATAL(r != NULL);
+    CU_ASSERT(strcmp(r, exp) == 0);
+    ddsrt_free(r);
+  }
+  else
+  {
+    CU_ASSERT_FATAL(r == NULL);
+  }
+}
+

From 30bd6e4c1c5e2c892965212d850a3c8aa9ab886d Mon Sep 17 00:00:00 2001
From: Dennis Potman <45659984+dennis-adlink@users.noreply.github.com>
Date: Thu, 5 Dec 2019 10:30:35 +0100
Subject: [PATCH 077/238] DDS Security built-in Cryptographic plugin (#306)

* DDS Security built-in Cryptographic plugin

This commit adds the built-in Cryptographic plugin that is part of the
DDS Security implementation for Cyclone.

The Cryptographic plugin defines the types and operations necessary
to support encryption, digest, message authentication codes, and key
exchange for DDS DomainParticipants, DataWriters and DDS DataReaders.

Similar to other builtin plugins, the DDS Security cryptographic plugin
is built as a shared library to allow dynamic library loading on runtime.
This enables DDS participants to use specific plugin implementations
with different configurations.

Although I think this initial version is a reasonable starting point to be
merged in the security branch, some parts of the code will need refactoring:

* crypto_key_factory.c: crypto_factory_get_endpoint_relation returns
arbitrary local-remote relation if no specific key for remote is found,
which will not work in Cyclone because participants can have different
security settings

* performance of encoding data can be improved by not copying
plain_rtps_message to a new buffer (to enable this, crypto_cipher_encrypt_data
should allow encrypting parts of a message)

* when decoding a message the message is split in several parts (header, body,
footer, etc) and for this memory is allocated which is probably not necessary.
Performance should be improved by removing these allocations and use pointers
to the data instead.

Signed-off-by: Dennis Potman <dennis.potman@adlinktech.com>

* WIP processing crypto plugin review comments

Signed-off-by: Dennis Potman <dennis.potman@adlinktech.com>

* WIP more refactoring based on review comments

Signed-off-by: Dennis Potman <dennis.potman@adlinktech.com>

* WIP fixing crypto plugin support for 128 bit key size

Signed-off-by: Dennis Potman <dennis.potman@adlinktech.com>

* WIP refactored master key storage to reduce memory usage when using 128 bit keys

Signed-off-by: Dennis Potman <dennis.potman@adlinktech.com>

* WIP fixing windows build linker issue

Signed-off-by: Dennis Potman <dennis.potman@adlinktech.com>

* WIP refactored crypto key types, avoid returning pointers to released ref-counted object

Signed-off-by: Dennis Potman <dennis.potman@adlinktech.com>

* Fixed bug in test decode_datareader_submessage.invalid_data

Signed-off-by: Dennis Potman <dennis.potman@adlinktech.com>

* Fixed issues from review: use correct constant for hashing and handle different src/dst keysize correctly

Signed-off-by: Dennis Potman <dennis.potman@adlinktech.com>
---
 .../dds/security/dds_security_api_defs.h      |   55 +-
 .../dds/security/dds_security_api_err.h       |    2 +
 src/security/builtin_plugins/CMakeLists.txt   |    1 +
 .../authentication/src/authentication.c       |    4 +-
 .../cryptographic/CMakeLists.txt              |   58 +
 .../cryptographic/src/crypto_cipher.c         |  258 ++
 .../cryptographic/src/crypto_cipher.h         |   99 +
 .../cryptographic/src/crypto_defs.h           |  114 +
 .../cryptographic/src/crypto_key_exchange.c   |  538 ++++
 .../cryptographic/src/crypto_key_exchange.h   |   27 +
 .../cryptographic/src/crypto_key_factory.c    | 1869 +++++++++++++
 .../cryptographic/src/crypto_key_factory.h    |  146 +
 .../cryptographic/src/crypto_objects.c        |  593 ++++
 .../cryptographic/src/crypto_objects.h        |  354 +++
 .../cryptographic/src/crypto_transform.c      | 2469 +++++++++++++++++
 .../cryptographic/src/crypto_transform.h      |   28 +
 .../cryptographic/src/crypto_utils.c          |  153 +
 .../cryptographic/src/crypto_utils.h          |   95 +
 .../cryptographic/src/cryptography.c          |   98 +
 .../cryptographic/src/cryptography.h          |   33 +
 .../builtin_plugins/tests/CMakeLists.txt      |   67 +-
 .../tests/common/src/crypto_helper.c          |  112 +
 .../tests/common/src/crypto_helper.h          |   38 +
 ...te_local_datareader_crypto_tokens_utests.c |  501 ++++
 ...te_local_datawriter_crypto_tokens_utests.c |  505 ++++
 ...e_local_participant_crypto_tokens_utests.c |  362 +++
 .../src/decode_datareader_submessage_utests.c | 1748 ++++++++++++
 .../src/decode_datawriter_submessage_utests.c | 1771 ++++++++++++
 .../src/decode_rtps_message_utests.c          | 1492 ++++++++++
 .../src/decode_serialized_payload_utests.c    | 1119 ++++++++
 .../src/encode_datareader_submessage_utests.c | 1275 +++++++++
 .../src/encode_datawriter_submessage_utests.c | 1348 +++++++++
 .../src/encode_rtps_message_utests.c          | 1322 +++++++++
 .../src/encode_serialized_payload_utests.c    |  786 ++++++
 ...thenticated_peer_credential_token_utests.c |   35 +-
 .../src/preprocess_secure_submsg_utests.c     |  930 +++++++
 .../src/process_handshake_utests.c            |   35 +-
 .../src/register_local_datareader_utests.c    |  311 +++
 .../src/register_local_datawriter_utests.c    |  333 +++
 .../src/register_local_participant_utests.c   |  154 +
 ...egister_matched_remote_datareader_utests.c |  392 +++
 ...egister_matched_remote_datawriter_utests.c |  376 +++
 ...gister_matched_remote_participant_utests.c |  229 ++
 ...t_remote_datareader_crypto_tokens_utests.c |  980 +++++++
 ...t_remote_datawriter_crypto_tokens_utests.c | 1029 +++++++
 ..._remote_participant_crypto_tokens_utests.c |  545 ++++
 .../validate_begin_handshake_reply_utests.c   |   37 +-
 .../security/core/dds_security_serialize.h    |   10 +-
 .../dds/security/core/dds_security_types.h    |    6 +-
 .../dds/security/core/dds_security_utils.h    |   40 +-
 .../include/dds/security/core/shared_secret.h |   29 +-
 .../core/src/dds_security_serialize.c         |   62 +-
 src/security/core/src/dds_security_utils.c    |   73 +-
 src/security/core/src/shared_secret.c         |   30 +-
 54 files changed, 24804 insertions(+), 272 deletions(-)
 create mode 100644 src/security/builtin_plugins/cryptographic/CMakeLists.txt
 create mode 100644 src/security/builtin_plugins/cryptographic/src/crypto_cipher.c
 create mode 100644 src/security/builtin_plugins/cryptographic/src/crypto_cipher.h
 create mode 100644 src/security/builtin_plugins/cryptographic/src/crypto_defs.h
 create mode 100644 src/security/builtin_plugins/cryptographic/src/crypto_key_exchange.c
 create mode 100644 src/security/builtin_plugins/cryptographic/src/crypto_key_exchange.h
 create mode 100644 src/security/builtin_plugins/cryptographic/src/crypto_key_factory.c
 create mode 100644 src/security/builtin_plugins/cryptographic/src/crypto_key_factory.h
 create mode 100644 src/security/builtin_plugins/cryptographic/src/crypto_objects.c
 create mode 100644 src/security/builtin_plugins/cryptographic/src/crypto_objects.h
 create mode 100644 src/security/builtin_plugins/cryptographic/src/crypto_transform.c
 create mode 100644 src/security/builtin_plugins/cryptographic/src/crypto_transform.h
 create mode 100644 src/security/builtin_plugins/cryptographic/src/crypto_utils.c
 create mode 100644 src/security/builtin_plugins/cryptographic/src/crypto_utils.h
 create mode 100644 src/security/builtin_plugins/cryptographic/src/cryptography.c
 create mode 100644 src/security/builtin_plugins/cryptographic/src/cryptography.h
 create mode 100644 src/security/builtin_plugins/tests/common/src/crypto_helper.c
 create mode 100644 src/security/builtin_plugins/tests/common/src/crypto_helper.h
 create mode 100644 src/security/builtin_plugins/tests/create_local_datareader_crypto_tokens/src/create_local_datareader_crypto_tokens_utests.c
 create mode 100644 src/security/builtin_plugins/tests/create_local_datawriter_crypto_tokens/src/create_local_datawriter_crypto_tokens_utests.c
 create mode 100644 src/security/builtin_plugins/tests/create_local_participant_crypto_tokens/src/create_local_participant_crypto_tokens_utests.c
 create mode 100644 src/security/builtin_plugins/tests/decode_datareader_submessage/src/decode_datareader_submessage_utests.c
 create mode 100644 src/security/builtin_plugins/tests/decode_datawriter_submessage/src/decode_datawriter_submessage_utests.c
 create mode 100644 src/security/builtin_plugins/tests/decode_rtps_message/src/decode_rtps_message_utests.c
 create mode 100644 src/security/builtin_plugins/tests/decode_serialized_payload/src/decode_serialized_payload_utests.c
 create mode 100644 src/security/builtin_plugins/tests/encode_datareader_submessage/src/encode_datareader_submessage_utests.c
 create mode 100644 src/security/builtin_plugins/tests/encode_datawriter_submessage/src/encode_datawriter_submessage_utests.c
 create mode 100644 src/security/builtin_plugins/tests/encode_rtps_message/src/encode_rtps_message_utests.c
 create mode 100644 src/security/builtin_plugins/tests/encode_serialized_payload/src/encode_serialized_payload_utests.c
 create mode 100644 src/security/builtin_plugins/tests/preprocess_secure_submsg/src/preprocess_secure_submsg_utests.c
 create mode 100644 src/security/builtin_plugins/tests/register_local_datareader/src/register_local_datareader_utests.c
 create mode 100644 src/security/builtin_plugins/tests/register_local_datawriter/src/register_local_datawriter_utests.c
 create mode 100644 src/security/builtin_plugins/tests/register_local_participant/src/register_local_participant_utests.c
 create mode 100644 src/security/builtin_plugins/tests/register_matched_remote_datareader/src/register_matched_remote_datareader_utests.c
 create mode 100644 src/security/builtin_plugins/tests/register_matched_remote_datawriter/src/register_matched_remote_datawriter_utests.c
 create mode 100644 src/security/builtin_plugins/tests/register_matched_remote_participant/src/register_matched_remote_participant_utests.c
 create mode 100644 src/security/builtin_plugins/tests/set_remote_datareader_crypto_tokens/src/set_remote_datareader_crypto_tokens_utests.c
 create mode 100644 src/security/builtin_plugins/tests/set_remote_datawriter_crypto_tokens/src/set_remote_datawriter_crypto_tokens_utests.c
 create mode 100644 src/security/builtin_plugins/tests/set_remote_participant_crypto_tokens/src/set_remote_participant_crypto_tokens_utests.c

diff --git a/src/security/api/include/dds/security/dds_security_api_defs.h b/src/security/api/include/dds/security/dds_security_api_defs.h
index a0e6739..d3d1705 100644
--- a/src/security/api/include/dds/security/dds_security_api_defs.h
+++ b/src/security/api/include/dds/security/dds_security_api_defs.h
@@ -37,7 +37,8 @@ typedef enum {
 
 #define DDS_SECURITY_HANDLE_NIL (0)
 
-
+#define DDS_SECURITY_SUCCESS (0)
+#define DDS_SECURITY_FAILED (-1)
 
 
 /**************************************************************************
@@ -45,30 +46,30 @@ typedef enum {
  * Attribute flags.                                                       *
  *                                                                        *
  **************************************************************************/
-#define DDS_SECURITY_PARTICIPANT_ATTRIBUTES_FLAG_IS_RTPS_PROTECTED                      (0x00000001      )
-#define DDS_SECURITY_PARTICIPANT_ATTRIBUTES_FLAG_IS_DISCOVERY_PROTECTED                 (0x00000001 <<  1)
-#define DDS_SECURITY_PARTICIPANT_ATTRIBUTES_FLAG_IS_LIVELINESS_PROTECTED                (0x00000001 <<  2)
-#define DDS_SECURITY_PARTICIPANT_ATTRIBUTES_FLAG_IS_VALID                               (0x00000001 << 31)
+#define DDS_SECURITY_PARTICIPANT_ATTRIBUTES_FLAG_IS_RTPS_PROTECTED                      (1u      )
+#define DDS_SECURITY_PARTICIPANT_ATTRIBUTES_FLAG_IS_DISCOVERY_PROTECTED                 (1u <<  1)
+#define DDS_SECURITY_PARTICIPANT_ATTRIBUTES_FLAG_IS_LIVELINESS_PROTECTED                (1u <<  2)
+#define DDS_SECURITY_PARTICIPANT_ATTRIBUTES_FLAG_IS_VALID                               (1u << 31)
 
-#define DDS_SECURITY_PLUGIN_PARTICIPANT_ATTRIBUTES_FLAG_IS_RTPS_ENCRYPTED               (0x00000001      )
-#define DDS_SECURITY_PLUGIN_PARTICIPANT_ATTRIBUTES_FLAG_IS_DISCOVERY_ENCRYPTED          (0x00000001 <<  1)
-#define DDS_SECURITY_PLUGIN_PARTICIPANT_ATTRIBUTES_FLAG_IS_LIVELINESS_ENCRYPTED         (0x00000001 <<  2)
-#define DDS_SECURITY_PLUGIN_PARTICIPANT_ATTRIBUTES_FLAG_IS_RTPS_AUTHENTICATED           (0x00000001 <<  3)
-#define DDS_SECURITY_PLUGIN_PARTICIPANT_ATTRIBUTES_FLAG_IS_DISCOVERY_AUTHENTICATED      (0x00000001 <<  4)
-#define DDS_SECURITY_PLUGIN_PARTICIPANT_ATTRIBUTES_FLAG_IS_LIVELINESS_AUTHENTICATED     (0x00000001 <<  5)
+#define DDS_SECURITY_PLUGIN_PARTICIPANT_ATTRIBUTES_FLAG_IS_RTPS_ENCRYPTED               (1u      )
+#define DDS_SECURITY_PLUGIN_PARTICIPANT_ATTRIBUTES_FLAG_IS_DISCOVERY_ENCRYPTED          (1u <<  1)
+#define DDS_SECURITY_PLUGIN_PARTICIPANT_ATTRIBUTES_FLAG_IS_LIVELINESS_ENCRYPTED         (1u <<  2)
+#define DDS_SECURITY_PLUGIN_PARTICIPANT_ATTRIBUTES_FLAG_IS_RTPS_AUTHENTICATED           (1u <<  3)
+#define DDS_SECURITY_PLUGIN_PARTICIPANT_ATTRIBUTES_FLAG_IS_DISCOVERY_AUTHENTICATED      (1u <<  4)
+#define DDS_SECURITY_PLUGIN_PARTICIPANT_ATTRIBUTES_FLAG_IS_LIVELINESS_AUTHENTICATED     (1u <<  5)
 
-#define DDS_SECURITY_ENDPOINT_ATTRIBUTES_FLAG_IS_READ_PROTECTED                         (0x00000001      )
-#define DDS_SECURITY_ENDPOINT_ATTRIBUTES_FLAG_IS_WRITE_PROTECTED                        (0x00000001 <<  1)
-#define DDS_SECURITY_ENDPOINT_ATTRIBUTES_FLAG_IS_DISCOVERY_PROTECTED                    (0x00000001 <<  2)
-#define DDS_SECURITY_ENDPOINT_ATTRIBUTES_FLAG_IS_SUBMESSAGE_PROTECTED                   (0x00000001 <<  3)
-#define DDS_SECURITY_ENDPOINT_ATTRIBUTES_FLAG_IS_PAYLOAD_PROTECTED                      (0x00000001 <<  4)
-#define DDS_SECURITY_ENDPOINT_ATTRIBUTES_FLAG_IS_KEY_PROTECTED                          (0x00000001 <<  5)
-#define DDS_SECURITY_ENDPOINT_ATTRIBUTES_FLAG_IS_LIVELINESS_PROTECTED                   (0x00000001 <<  6)
-#define DDS_SECURITY_ENDPOINT_ATTRIBUTES_FLAG_IS_VALID                                  (0x00000001 << 31)
+#define DDS_SECURITY_ENDPOINT_ATTRIBUTES_FLAG_IS_READ_PROTECTED                         (1u      )
+#define DDS_SECURITY_ENDPOINT_ATTRIBUTES_FLAG_IS_WRITE_PROTECTED                        (1u <<  1)
+#define DDS_SECURITY_ENDPOINT_ATTRIBUTES_FLAG_IS_DISCOVERY_PROTECTED                    (1u <<  2)
+#define DDS_SECURITY_ENDPOINT_ATTRIBUTES_FLAG_IS_SUBMESSAGE_PROTECTED                   (1u <<  3)
+#define DDS_SECURITY_ENDPOINT_ATTRIBUTES_FLAG_IS_PAYLOAD_PROTECTED                      (1u <<  4)
+#define DDS_SECURITY_ENDPOINT_ATTRIBUTES_FLAG_IS_KEY_PROTECTED                          (1u <<  5)
+#define DDS_SECURITY_ENDPOINT_ATTRIBUTES_FLAG_IS_LIVELINESS_PROTECTED                   (1u <<  6)
+#define DDS_SECURITY_ENDPOINT_ATTRIBUTES_FLAG_IS_VALID                                  (1u << 31)
 
-#define DDS_SECURITY_PLUGIN_ENDPOINT_ATTRIBUTES_FLAG_IS_SUBMESSAGE_ENCRYPTED            (0x00000001      )
-#define DDS_SECURITY_PLUGIN_ENDPOINT_ATTRIBUTES_FLAG_IS_PAYLOAD_ENCRYPTED               (0x00000001 <<  1)
-#define DDS_SECURITY_PLUGIN_ENDPOINT_ATTRIBUTES_FLAG_IS_SUBMESSAGE_ORIGIN_AUTHENTICATED (0x00000001 <<  2)
+#define DDS_SECURITY_PLUGIN_ENDPOINT_ATTRIBUTES_FLAG_IS_SUBMESSAGE_ENCRYPTED            (1u      )
+#define DDS_SECURITY_PLUGIN_ENDPOINT_ATTRIBUTES_FLAG_IS_PAYLOAD_ENCRYPTED               (1u <<  1)
+#define DDS_SECURITY_PLUGIN_ENDPOINT_ATTRIBUTES_FLAG_IS_SUBMESSAGE_ORIGIN_AUTHENTICATED (1u <<  2)
 
 
 
@@ -175,10 +176,12 @@ typedef enum {
  **************************************************************************/
 #define DDS_SECURITY_AUTHENTICATION_CHALLENGE_SIZE 32
 
-#define DDS_SECURITY_MASTER_SALT_SIZE 32
-#define DDS_SECURITY_MASTER_SENDER_KEY_SIZE 32
-#define DDS_SECURITY_MASTER_RECEIVER_SPECIFIC_KEY_SIZE 32
-
+#define DDS_SECURITY_MASTER_SALT_SIZE_128 16
+#define DDS_SECURITY_MASTER_SALT_SIZE_256 32
+#define DDS_SECURITY_MASTER_SENDER_KEY_SIZE_128 16
+#define DDS_SECURITY_MASTER_SENDER_KEY_SIZE_256 32
+#define DDS_SECURITY_MASTER_RECEIVER_SPECIFIC_KEY_SIZE_128 16
+#define DDS_SECURITY_MASTER_RECEIVER_SPECIFIC_KEY_SIZE_256 32
 
 
 #if defined (__cplusplus)
diff --git a/src/security/api/include/dds/security/dds_security_api_err.h b/src/security/api/include/dds/security/dds_security_api_err.h
index f4e8904..20ee24b 100644
--- a/src/security/api/include/dds/security/dds_security_api_err.h
+++ b/src/security/api/include/dds/security/dds_security_api_err.h
@@ -106,6 +106,8 @@ extern "C" {
 #define DDS_SECURITY_ERR_PERMISSIONS_OUT_OF_VALIDITY_DATE_MESSAGE "Permissions of subject (%s) outside validity date: %s - %s"
 #define DDS_SECURITY_ERR_URI_TYPE_NOT_SUPPORTED_CODE 151
 #define DDS_SECURITY_ERR_URI_TYPE_NOT_SUPPORTED_MESSAGE "Unsupported URI type: %s"
+#define DDS_SECURITY_ERR_INVALID_CRYPTO_DATA_NOT_ALIGNED_CODE 152
+#define DDS_SECURITY_ERR_INVALID_CRYPTO_DATA_NOT_ALIGNED_MESSAGE "The payload is not aligned at 4 bytes"
 
 #define DDS_SECURITY_ERR_UNDEFINED_CODE 200
 #define DDS_SECURITY_ERR_UNDEFINED_MESSAGE "Undefined Error Message"
diff --git a/src/security/builtin_plugins/CMakeLists.txt b/src/security/builtin_plugins/CMakeLists.txt
index 69e5aed..113d0b4 100644
--- a/src/security/builtin_plugins/CMakeLists.txt
+++ b/src/security/builtin_plugins/CMakeLists.txt
@@ -12,6 +12,7 @@
 cmake_minimum_required(VERSION 3.7)
 
 add_subdirectory("${CMAKE_CURRENT_LIST_DIR}/authentication")
+add_subdirectory("${CMAKE_CURRENT_LIST_DIR}/cryptographic")
 
 # TODO: improve test inclusion.
 if((BUILD_TESTING) AND ((NOT DEFINED MSVC_VERSION) OR (MSVC_VERSION GREATER "1800")))
diff --git a/src/security/builtin_plugins/authentication/src/authentication.c b/src/security/builtin_plugins/authentication/src/authentication.c
index eb4117f..c893254 100644
--- a/src/security/builtin_plugins/authentication/src/authentication.c
+++ b/src/security/builtin_plugins/authentication/src/authentication.c
@@ -1687,7 +1687,7 @@ validate_pdata(
 
     pdata = DDS_Security_ParticipantBuiltinTopicData_alloc();
 
-    if (!DDD_Security_Deserialize_ParticipantBuiltinTopicData(deserializer, pdata, ex)) {
+    if (!DDS_Security_Deserialize_ParticipantBuiltinTopicData(deserializer, pdata, ex)) {
         result = DDS_SECURITY_VALIDATION_FAILED;
         goto err_incorrect_data;
     }
@@ -1696,7 +1696,7 @@ validate_pdata(
     result = get_adjusted_participant_guid(cert, &cguid, &aguid, ex);
     if (result == DDS_SECURITY_VALIDATION_OK) {
         DDS_Security_BuiltinTopicKey_t key;
-        DDD_Security_BuiltinTopicKeyBE(key, pdata->key);
+        DDS_Security_BuiltinTopicKeyBE(key, pdata->key);
         if (memcmp(key, aguid.prefix, 6) != 0) {
             result = DDS_SECURITY_VALIDATION_FAILED;
               DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result,
diff --git a/src/security/builtin_plugins/cryptographic/CMakeLists.txt b/src/security/builtin_plugins/cryptographic/CMakeLists.txt
new file mode 100644
index 0000000..3be3010
--- /dev/null
+++ b/src/security/builtin_plugins/cryptographic/CMakeLists.txt
@@ -0,0 +1,58 @@
+#
+# Copyright(c) 2006 to 2019 ADLINK Technology Limited and others
+#
+# This program and the accompanying materials are made available under the
+# terms of the Eclipse Public License v. 2.0 which is available at
+# http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+# v. 1.0 which is available at
+# http://www.eclipse.org/org/documents/edl-v10.php.
+#
+# SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+#
+include (GenerateExportHeader)
+
+find_package(OpenSSL)
+
+PREPEND(srcs_cryptographic "${CMAKE_CURRENT_LIST_DIR}/src"
+    crypto_cipher.c
+    crypto_key_exchange
+    crypto_key_factory.c
+    crypto_objects.c
+    crypto_transform.c
+    crypto_utils.c
+    cryptography.c
+)
+
+add_library(dds_security_crypto SHARED "")
+
+generate_export_header(
+    dds_security_crypto
+        BASE_NAME SECURITY
+        EXPORT_FILE_NAME "${CMAKE_CURRENT_BINARY_DIR}/include/dds/security/export.h"
+)
+
+add_definitions(-DDDSI_INCLUDE_SSL)
+
+target_link_libraries(dds_security_crypto PUBLIC ddsc)
+target_link_libraries(dds_security_crypto PUBLIC OpenSSL::SSL)
+
+target_sources(dds_security_crypto
+    PRIVATE
+        ${srcs_cryptographic}
+)
+
+target_include_directories(dds_security_crypto
+    PUBLIC
+        "$<BUILD_INTERFACE:$<TARGET_PROPERTY:security_api,INTERFACE_INCLUDE_DIRECTORIES>>"
+        "$<BUILD_INTERFACE:$<TARGET_PROPERTY:security_core,INTERFACE_INCLUDE_DIRECTORIES>>"
+        "$<BUILD_INTERFACE:$<TARGET_PROPERTY:ddsrt,INTERFACE_INCLUDE_DIRECTORIES>>"
+        "$<BUILD_INTERFACE:${CMAKE_CURRENT_BINARY_DIR}/include>"
+)
+
+install(
+  TARGETS
+  EXPORT "${PROJECT_NAME}"
+  RUNTIME DESTINATION "${CMAKE_INSTALL_BINDIR}" COMPONENT lib
+  LIBRARY DESTINATION "${CMAKE_INSTALL_LIBDIR}" COMPONENT lib
+  ARCHIVE DESTINATION "${CMAKE_INSTALL_LIBDIR}" COMPONENT lib
+)
diff --git a/src/security/builtin_plugins/cryptographic/src/crypto_cipher.c b/src/security/builtin_plugins/cryptographic/src/crypto_cipher.c
new file mode 100644
index 0000000..80d79f3
--- /dev/null
+++ b/src/security/builtin_plugins/cryptographic/src/crypto_cipher.c
@@ -0,0 +1,258 @@
+/*
+ * Copyright(c) 2006 to 2019 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+#include <assert.h>
+#include <openssl/evp.h>
+#include <openssl/hmac.h>
+#include "dds/ddsrt/heap.h"
+#include "dds/ddsrt/types.h"
+#include "crypto_defs.h"
+#include "crypto_utils.h"
+#include "crypto_cipher.h"
+
+bool crypto_cipher_encrypt_data(
+  const crypto_session_key_t *session_key,
+  uint32_t key_size,
+  const unsigned char *iv,
+  const unsigned char *data,
+  uint32_t data_len,
+  const unsigned char *aad,
+  uint32_t aad_len,
+  unsigned char *encrypted,
+  uint32_t *encrypted_len,
+  crypto_hmac_t *tag,
+  DDS_Security_SecurityException *ex)
+{
+  EVP_CIPHER_CTX *ctx;
+  int len = 0;
+
+  /* create the cipher context */
+  ctx = EVP_CIPHER_CTX_new();
+  if (!ctx)
+  {
+    DDS_Security_Exception_set_with_openssl_error(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_CIPHER_ERROR, 0, "EVP_CIPHER_CTX_new failed: ");
+    goto fail_ctx_new;
+  }
+
+  /* initialize the cipher and set to AES GCM */
+  if (key_size == 128)
+  {
+    if (!EVP_EncryptInit_ex(ctx, EVP_aes_128_gcm(), NULL, NULL, NULL))
+    {
+      DDS_Security_Exception_set_with_openssl_error(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_CIPHER_ERROR, 0, "EVP_EncryptInit_ex to set aes_128_gcm failed: ");
+      goto fail_encrypt;
+    }
+  }
+  else if (key_size == 256)
+  {
+    if (!EVP_EncryptInit_ex(ctx, EVP_aes_256_gcm(), NULL, NULL, NULL))
+    {
+      DDS_Security_Exception_set_with_openssl_error(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_CIPHER_ERROR, 0, "EVP_EncryptInit_ex to set aes_256_gcm failed: ");
+      goto fail_encrypt;
+    }
+  }
+  else
+  {
+    assert(0);
+    DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_CIPHER_ERROR, 0, "EVP_EncryptInit_ex invalid key size: %u", key_size);
+    goto fail_encrypt;
+  }
+
+  /* Initialise key and IV */
+  if (!EVP_EncryptInit_ex(ctx, NULL, NULL, session_key->data, iv))
+  {
+    DDS_Security_Exception_set_with_openssl_error(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_CIPHER_ERROR, 0, "EVP_EncryptInit_ex failed: ");
+    goto fail_encrypt;
+  }
+
+  if (aad)
+  {
+    if (aad_len > INT_MAX)
+    {
+      DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_CIPHER_ERROR, 0, "EVP_EncryptUpdate to update aad failed: aad_len exceeds INT_MAX");
+      goto fail_encrypt;
+    }
+
+    /* Provide any AAD data */
+    if (!EVP_EncryptUpdate(ctx, NULL, &len, aad, (int) aad_len))
+    {
+      DDS_Security_Exception_set_with_openssl_error(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_CIPHER_ERROR, 0, "EVP_EncryptUpdate to update aad failed: %s");
+      goto fail_encrypt;
+    }
+  }
+
+  if (data)
+  {
+    if (data_len > INT_MAX)
+    {
+      DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_CIPHER_ERROR, 0, "EVP_EncryptUpdate to update data failed: data_len exceeds INT_MAX");
+      goto fail_encrypt;
+    }
+
+    /* encrypt the message */
+    if (!EVP_EncryptUpdate(ctx, encrypted, &len, data, (int) data_len))
+    {
+      DDS_Security_Exception_set_with_openssl_error(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_CIPHER_ERROR, 0, "EVP_EncryptUpdate update data failed: ");
+      goto fail_encrypt;
+    }
+    assert (len >= 0); /* conform openssl spec */
+    *encrypted_len = (uint32_t) len;
+  }
+
+  /* finalize the encryption */
+  if (data)
+  {
+    if (!EVP_EncryptFinal_ex(ctx, encrypted + len, &len))
+    {
+      DDS_Security_Exception_set_with_openssl_error(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_CIPHER_ERROR, 0, "EVP_EncryptFinal_ex to finalize encryption failed: ");
+      goto fail_encrypt;
+    }
+    assert (len >= 0); /* conform openssl spec */
+    *encrypted_len += (uint32_t) len;
+  }
+  else
+  {
+    unsigned char temp[32];
+    if (!EVP_EncryptFinal_ex(ctx, temp, &len))
+    {
+      DDS_Security_Exception_set_with_openssl_error(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_CIPHER_ERROR, 0, "EVP_EncryptFinal_ex to finalize aad failed: ");
+      goto fail_encrypt;
+    }
+  }
+
+  /* get the tag */
+  if (!EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_GCM_GET_TAG, CRYPTO_HMAC_SIZE, tag->data))
+  {
+    DDS_Security_Exception_set_with_openssl_error(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_CIPHER_ERROR, 0, "EVP_CIPHER_CTX_ctrl to get the tag failed: ");
+    goto fail_encrypt;
+  }
+
+  EVP_CIPHER_CTX_free(ctx);
+  return true;
+
+fail_encrypt:
+  EVP_CIPHER_CTX_free(ctx);
+fail_ctx_new:
+  return false;
+}
+
+bool crypto_cipher_decrypt_data(
+  const remote_session_info *session,
+  const unsigned char *iv,
+  const unsigned char *encrypted,
+  uint32_t encrypted_len,
+  const unsigned char *aad,
+  uint32_t aad_len,
+  unsigned char *data,
+  uint32_t *data_len,
+  crypto_hmac_t *tag,
+  DDS_Security_SecurityException *ex)
+{
+  EVP_CIPHER_CTX *ctx;
+  int len = 0;
+
+  /* create the cipher context */
+  ctx = EVP_CIPHER_CTX_new();
+  if (!ctx)
+  {
+    DDS_Security_Exception_set_with_openssl_error(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_CIPHER_ERROR, 0, "EVP_CIPHER_CTX_new failed: ");
+    goto fail_ctx_new;
+  }
+
+  /* initialize the cipher and set to AES GCM */
+  if (session->key_size == 128)
+  {
+    if (EVP_DecryptInit_ex(ctx, EVP_aes_128_gcm(), NULL, NULL, NULL) != 1)
+    {
+      DDS_Security_Exception_set_with_openssl_error(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_CIPHER_ERROR, 0, "EVP_DecryptInit_ex to set aes_128_gcm failed: ");
+      goto fail_decrypt;
+    }
+  }
+  else if (session->key_size == 256)
+  {
+    if (EVP_DecryptInit_ex(ctx, EVP_aes_256_gcm(), NULL, NULL, NULL) != 1)
+    {
+      DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_CIPHER_ERROR, 0, "EVP_DecryptInit_ex to set aes_256_gcm failed: ");
+      goto fail_decrypt;
+    }
+  }
+  else
+  {
+    assert(0);
+    DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_CIPHER_ERROR, 0, "Internal key_size is not correct: %u", session->key_size);
+    goto fail_decrypt;
+  }
+
+  /* Initialise key and IV */
+  if (EVP_DecryptInit_ex(ctx, NULL, NULL, session->key.data, iv) != 1)
+  {
+    DDS_Security_Exception_set_with_openssl_error(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_CIPHER_ERROR, 0, "EVP_DecryptInit_ex to set aes_256_gcm failed: %s");
+    goto fail_decrypt;
+  }
+
+  if (aad)
+  {
+    assert (aad_len <= INT32_MAX);
+    /* Provide any AAD data for signature */
+    if (EVP_DecryptUpdate(ctx, NULL, &len, aad, (int) aad_len) != 1)
+    {
+      DDS_Security_Exception_set_with_openssl_error(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_CIPHER_ERROR, 0, "EVP_DecryptUpdate to update aad failed: ");
+      goto fail_decrypt;
+    }
+  }
+
+  /* Set expected tag value. */
+  if (EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_GCM_SET_TAG, CRYPTO_HMAC_SIZE, tag->data) != 1)
+  {
+    DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_CIPHER_ERROR, 0, "EVP_CIPHER_CTX_ctrl to get tag failed: ");
+    goto fail_decrypt;
+  }
+
+  if (data)
+  {
+    /* decrypt the message */
+    if (EVP_DecryptUpdate(ctx, data, &len, encrypted, (int) encrypted_len) != 1)
+    {
+      DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_CIPHER_ERROR, 0, "EVP_DecryptUpdate update data failed: ");
+      goto fail_decrypt;
+    }
+    assert (len >= 0);
+    *data_len = (uint32_t)len;
+  }
+
+  if (data)
+  {
+    if (EVP_DecryptFinal_ex(ctx, data + len, &len) != 1)
+    {
+      DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_CIPHER_ERROR, 0, "EVP_DecryptFinal_ex to finalize decryption failed: ");
+      goto fail_decrypt;
+    }
+    assert (len >= 0);
+    *data_len += (uint32_t)len;
+  }
+  else
+  {
+    unsigned char temp[32];
+    if (EVP_DecryptFinal_ex(ctx, temp, &len) != 1)
+    {
+      DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_CIPHER_ERROR, 0, "EVP_DecryptFinal_ex to finalize signature check failed: ");
+      goto fail_decrypt;
+    }
+  }
+
+  EVP_CIPHER_CTX_free(ctx);
+  return true;
+
+fail_decrypt:
+  EVP_CIPHER_CTX_free(ctx);
+fail_ctx_new:
+  return false;
+}
diff --git a/src/security/builtin_plugins/cryptographic/src/crypto_cipher.h b/src/security/builtin_plugins/cryptographic/src/crypto_cipher.h
new file mode 100644
index 0000000..eb365b9
--- /dev/null
+++ b/src/security/builtin_plugins/cryptographic/src/crypto_cipher.h
@@ -0,0 +1,99 @@
+/*
+ * Copyright(c) 2006 to 2019 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+#ifndef CRYPTO_CIPHER_H
+#define CRYPTO_CIPHER_H
+
+#include "dds/ddsrt/types.h"
+#include "crypto_objects.h"
+
+/**
+ * @brief Encodes the provide data using the provided key
+ *
+ * This function encodes the provide data using the provided key, key_size
+ * and initialization_vector. It also computes the common_mac from the provided data.
+ * The data parameter contains the data that has to encoded. The aad parameter contains
+ * the data that is not encoded but is used in the computation of the common_mac
+ * On return the encrypted parameter contains the encoded data and the tag parameter
+ * the common mac.
+ * This function will be used either to encode the provided data in that case the
+ * data parameter should be set to the data to be encoded and the aad parameter should
+ * be NULL. Also the encrypted parameter should be set and contain a buffer large enough
+ * to contain the encoded data.
+ * This function is also used to only computer the common_mac. In that case the
+ * data parameter should be NULL and the aad parameter should point to the data on
+ * which the common_mac has to be computed. The encryped parameter is not relevant
+ * in this case.
+ *
+ * @param[in]     session_key   The session key used to encode the provided data
+ * @param[in]     key_size      The size of the session key (128 or 256 bit)
+ * @param[in]     iv            The init vector used by the encoding
+ * @param[in]     data          The data to be encoded
+ * @param[in]     data_len      The size of the data to be encoded
+ * @param[in]     aad           The additional data not be encoded but only used in the computation of the mac
+ * @param[in]     aad_len       The size of the additional data
+ * @param[in,out] encrypted     The buffer to hold on return the encoded data
+ * @param[in,out] encrypted_len The size of the encrypted data buffer
+ * @param[in,out] tag           Contains on return the mac value calculated over the provided data
+ * @param[in,out] ex            Security exception (optional)
+ */
+bool crypto_cipher_encrypt_data(
+    const crypto_session_key_t *session_key,
+    uint32_t key_size,
+    const unsigned char *iv,
+    const unsigned char *data,
+    uint32_t data_len,
+    const unsigned char *aad,
+    uint32_t aad_len,
+    unsigned char *encrypted,
+    uint32_t *encrypted_len,
+    crypto_hmac_t *tag,
+    DDS_Security_SecurityException *ex);
+
+/**
+ * @brief Decodes the provided data using the session key and key_size
+ *
+ * This function decodes the provided data using the session key and key_size provided
+ * by by the session parameter. The iv parameter contains the initialization_vector used
+ * by the decode operation which is the concatination of received session_id and init_vector_suffix.
+ * The function checks if the common_mac (tag parameter) is corresponds with the provided data.
+ * This function will be used either to decode the provided data in that case the
+ * encrypted parameter should be set to the data to be decoded and the aad parameter should
+ * be NULL. Also the data parameter should be set and contain a buffer large enough
+ * to contain the decoded data.
+ * This function is also used to only verify the common_mac. In that case the
+ * data and the encrypted parameter should be NULL and the aad parameter should point to
+ * the data for which the common_mac has to be verified.
+ *
+ * @param[in]     session       Contains the session key and key size used of the decoding
+ * @param[in]     iv            The init vector used by the decoding
+ * @param[in]     encrypted     The encoded data
+ * @param[in]     encrypted_len The size of the encoded data
+ * @param[in]     aad           The not encoded data used in the verification of the provided mac
+ * @param[in]     aad_len       The size of the additional data
+ * @param[in,out] data          The buffer to hold on return the decoded data
+ * @param[in,out] data_len      The size of the decoded data buffer
+ * @param[in,out] tag           The mac value which has to be verified
+ * @param[in,out] ex            Security exception (optional)
+ */
+bool crypto_cipher_decrypt_data(
+    const remote_session_info *session,
+    const unsigned char *iv,
+    const unsigned char *encrypted,
+    uint32_t encrypted_len,
+    const unsigned char *aad,
+    uint32_t aad_len,
+    unsigned char *data,
+    uint32_t *data_len,
+    crypto_hmac_t *tag,
+    DDS_Security_SecurityException *ex);
+
+#endif /* CRYPTO_CIPHER_H */
diff --git a/src/security/builtin_plugins/cryptographic/src/crypto_defs.h b/src/security/builtin_plugins/cryptographic/src/crypto_defs.h
new file mode 100644
index 0000000..a0fdf2a
--- /dev/null
+++ b/src/security/builtin_plugins/cryptographic/src/crypto_defs.h
@@ -0,0 +1,114 @@
+/*
+ * Copyright(c) 2006 to 2019 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+#ifndef CRYPTO_DEFS_H
+#define CRYPTO_DEFS_H
+
+#include "dds/security/dds_security_api.h"
+
+#define DDS_CRYPTO_PLUGIN_CONTEXT "Cryptographic"
+
+#define CRYPTO_HMAC_SIZE 16
+#define CRYPTO_KEY_SIZE_128 16
+#define CRYPTO_KEY_SIZE_256 32
+#define CRYPTO_KEY_SIZE_MAX CRYPTO_KEY_SIZE_256
+
+#define CRYPTO_SESSION_ID_SIZE 4
+#define CRYPTO_INIT_VECTOR_SUFFIX_SIZE 8
+#define CRYPTO_CIPHER_BLOCK_SIZE 16
+
+typedef enum SecureSubmsgKind_t
+{
+  SMID_SEC_BODY_KIND = 0x30,
+  SMID_SEC_PREFIX_KIND = 0x31,
+  SMID_SEC_POSTFIX_KIND = 0x32,
+  SMID_SRTPS_PREFIX_KIND = 0x33,
+  SMID_SRTPS_POSTFIX_KIND = 0x34,
+  SMID_SRTPS_INFO_SRC_KIND = 0x0c
+} SecureSubmsgKind_t;
+
+typedef struct crypto_session_key_t
+{
+  unsigned char data[CRYPTO_KEY_SIZE_MAX];
+} crypto_session_key_t;
+
+typedef struct crypto_hmac_t
+{
+  unsigned char data[CRYPTO_HMAC_SIZE];
+} crypto_hmac_t;
+
+typedef enum RTPS_Message_Type
+{
+  /** The Constant PAD. */
+  RTPS_Message_Type_PAD = 0x01,
+
+  /** The Constant ACKNACK. */
+  RTPS_Message_Type_ACKNACK = 0x06,
+
+  /** The Constant HEARTBEAT. */
+  RTPS_Message_Type_HEARTBEAT = 0x07,
+
+  /** The Constant GAP. */
+  RTPS_Message_Type_GAP = 0x08,
+
+  /** The Constant INFO_TS. */
+  RTPS_Message_Type_INFO_TS = 0x09,
+
+  /** The Constant INFO_SRC. */
+  RTPS_Message_Type_INFO_SRC = 0x0c,
+
+  /** The Constant INFO_REPLY_IP4. */
+  RTPS_Message_Type_INFO_REPLY_IP4 = 0x0d,
+
+  /** The Constant INFO_DST. */
+  RTPS_Message_Type_INFO_DST = 0x0e,
+
+  /** The Constant INFO_REPLY. */
+  RTPS_Message_Type_INFO_REPLY = 0x0f,
+
+  /** The Constant NACK_FRAG. */
+  RTPS_Message_Type_NACK_FRAG = 0x12,
+
+  /** The Constant HEARTBEAT_FRAG. */
+  RTPS_Message_Type_HEARTBEAT_FRAG = 0x13,
+
+  /** The Constant DATA. */
+  RTPS_Message_Type_DATA = 0x15,
+
+  /** The Constant DATA_FRAG. */
+  RTPS_Message_Type_DATA_FRAG = 0x16,
+
+  /** The Constant MSG_LENGTH. */
+  RTPS_Message_Type_MSG_LEN = 0x81,
+
+  /** The Constant MSG_ENTITY_ID. */
+  RTPS_Message_Type_MSG_ENTITY_ID = 0x82,
+
+  /** The Constant INFO_LASTHB. */
+  RTPS_Message_Type_INFO_LASTHB = 0x83,
+
+  /** The Constant SEC_PREFIX. */
+  RTPS_Message_Type_SEC_BODY = 0x30,
+
+  /** The Constant SEC_PREFIX. */
+  RTPS_Message_Type_SEC_PREFIX = 0x31,
+
+  /** The Constant SEC_POSTFIX. */
+  RTPS_Message_Type_SEC_POSTFIX = 0x32,
+
+  /** The Constant SRTPS_PREFIX. */
+  RTPS_Message_Type_SRTPS_PREFIX = 0x33,
+
+  /** The Constant SRTPS_POSTFIX. */
+  RTPS_Message_Type_SRTPS_POSTFIX = 0x34
+} RTPS_Message_Type;
+
+#endif /* CRYPTO_DEFS_H */
\ No newline at end of file
diff --git a/src/security/builtin_plugins/cryptographic/src/crypto_key_exchange.c b/src/security/builtin_plugins/cryptographic/src/crypto_key_exchange.c
new file mode 100644
index 0000000..f002ad7
--- /dev/null
+++ b/src/security/builtin_plugins/cryptographic/src/crypto_key_exchange.c
@@ -0,0 +1,538 @@
+/*
+ * Copyright(c) 2006 to 2019 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+#include <string.h>
+#include "dds/ddsrt/heap.h"
+#include "dds/ddsrt/string.h"
+#include "dds/ddsrt/types.h"
+#include "dds/security/dds_security_api.h"
+#include "dds/security/core/dds_security_utils.h"
+#include "dds/security/core/dds_security_serialize.h"
+#include "crypto_defs.h"
+#include "crypto_utils.h"
+#include "cryptography.h"
+#include "crypto_key_exchange.h"
+#include "crypto_key_factory.h"
+
+static const char *CRYPTO_TOKEN_CLASS_ID = "DDS:Crypto:AES_GCM_GMAC";
+static const char *CRYPTO_TOKEN_PROPERTY_NAME = "dds.cryp.keymat";
+
+/**
+ * Implementation structure for storing encapsulated members of the instance
+ * while giving only the interface definition to user
+ */
+
+typedef struct dds_security_crypto_key_exchange_impl
+{
+  dds_security_crypto_key_exchange base;
+  const dds_security_cryptography *crypto;
+} dds_security_crypto_key_exchange_impl;
+
+static bool check_crypto_tokens(const DDS_Security_DataHolderSeq *tokens)
+{
+  bool status = true;
+  uint32_t i;
+
+  if (tokens->_length == 0 || tokens->_buffer == NULL)
+    status = false;
+
+  for (i = 0; status && (i < tokens->_length); i++)
+  {
+    status = (tokens->_buffer[i].class_id != NULL) &&
+             (strcmp(CRYPTO_TOKEN_CLASS_ID, tokens->_buffer[i].class_id) == 0) &&
+             (tokens->_buffer[i].binary_properties._length == 1) &&
+             (tokens->_buffer[i].binary_properties._buffer != NULL) &&
+             (tokens->_buffer[i].binary_properties._buffer[0].name != NULL) &&
+             (strcmp(CRYPTO_TOKEN_PROPERTY_NAME, tokens->_buffer[i].binary_properties._buffer[0].name) == 0) &&
+             (tokens->_buffer[i].binary_properties._buffer[0].value._length > 0) &&
+             (tokens->_buffer[i].binary_properties._buffer[0].value._buffer != NULL);
+  }
+
+  return status;
+}
+
+static bool check_not_data_empty(const DDS_Security_OctetSeq *seq)
+{
+  uint32_t i;
+
+  for (i = 0; i < seq->_length; i++)
+  {
+    if (seq->_buffer[i] != 0)
+      return true;
+  }
+  return false;
+}
+
+static bool check_crypto_keymaterial(const DDS_Security_KeyMaterial_AES_GCM_GMAC *keymat)
+{
+  bool status;
+
+  uint32_t transform_kind = CRYPTO_TRANSFORM_KIND(keymat->transformation_kind);
+  uint32_t key_sz = CRYPTO_KEY_SIZE_BYTES(transform_kind);
+
+  status = (transform_kind >= CRYPTO_TRANSFORMATION_KIND_AES128_GMAC && transform_kind <= CRYPTO_TRANSFORMATION_KIND_AES256_GCM &&
+    keymat->master_salt._length == key_sz && keymat->master_salt._buffer != NULL && check_not_data_empty(&keymat->master_salt) &&
+    keymat->master_sender_key._length == key_sz && keymat->master_sender_key._buffer != NULL && check_not_data_empty(&keymat->master_sender_key));
+
+  if (status && CRYPTO_TRANSFORM_ID(keymat->receiver_specific_key_id))
+  {
+    status = (keymat->master_receiver_specific_key._length == key_sz &&
+      keymat->master_receiver_specific_key._buffer != NULL && check_not_data_empty(&keymat->master_receiver_specific_key));
+  }
+
+  return status;
+}
+
+// serialized_key_material
+// {
+//   uint32_t           transformation_kind
+//   uint32_t           master_salt_len
+//   uint8_t[SALT_SIZE] master_salt
+//   uint32_t           sender_key_id
+//   uint32_t           master_sender_key_len
+//   uint8_t[KEY_SIZE]  master_sender_key
+//   uint32_t           receiver_specific_key_id
+//   uint32_t           master_receiver_specific_key_len
+//   uint8_t[KEY_SIZE]  master_receiver_specific_key
+// }
+static void
+serialize_master_key_material(
+    const master_key_material *keymat,
+    uint8_t **buffer,
+    uint32_t *length)
+{
+  uint32_t *sd;
+  size_t i = 0;
+  uint32_t key_bytes = CRYPTO_KEY_SIZE_BYTES(keymat->transformation_kind);
+  size_t sz = 6 * sizeof (uint32_t) + 2 * key_bytes;
+  if (keymat->receiver_specific_key_id)
+    sz += key_bytes;
+  *buffer = ddsrt_malloc(sz);
+  *length = (uint32_t)sz;
+  sd = (uint32_t *)(*buffer);
+
+  sd[i++] = ddsrt_toBE4u(keymat->transformation_kind);
+  sd[i++] = ddsrt_toBE4u(key_bytes);
+  memcpy(&sd[i], keymat->master_salt, key_bytes);
+  i += key_bytes / sizeof (uint32_t);
+  sd[i++] = ddsrt_toBE4u(keymat->sender_key_id);
+  sd[i++] = ddsrt_toBE4u(key_bytes);
+  memcpy(&sd[i], keymat->master_sender_key, key_bytes);
+  i += key_bytes / sizeof (uint32_t);
+  sd[i++] = ddsrt_toBE4u(keymat->receiver_specific_key_id);
+  if (keymat->receiver_specific_key_id)
+  {
+    sd[i++] = ddsrt_toBE4u(key_bytes);
+    memcpy(&sd[i], keymat->master_receiver_specific_key, key_bytes);
+  }
+  else
+  {
+    sd[i++] = ddsrt_toBE4u(0);
+  }
+}
+
+
+/**
+ * Function implementations
+ */
+static DDS_Security_boolean
+create_local_participant_crypto_tokens(
+    dds_security_crypto_key_exchange *instance,
+    DDS_Security_ParticipantCryptoTokenSeq *tokens,
+    const DDS_Security_ParticipantCryptoHandle local_id,
+    const DDS_Security_ParticipantCryptoHandle remote_id,
+    DDS_Security_SecurityException *ex)
+{
+  dds_security_crypto_key_exchange_impl *impl = (dds_security_crypto_key_exchange_impl *)instance;
+  dds_security_crypto_key_factory *factory;
+  participant_key_material *pp_key_material;
+  uint8_t *buffer;
+  uint32_t length;
+
+  if (!instance || !tokens || local_id == 0 || remote_id == 0)
+  {
+    DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_CRYPTO_ARGUMENT_CODE, 0,
+        "create_local_participant_crypto_tokens: " DDS_SECURITY_ERR_INVALID_CRYPTO_ARGUMENT_MESSAGE);
+    goto fail_invalid_arg;
+  }
+
+  factory = cryptography_get_crypto_key_factory(impl->crypto);
+  if (!crypto_factory_get_participant_crypto_tokens(factory, local_id, remote_id, &pp_key_material, NULL, ex))
+    goto fail_invalid_arg;
+  serialize_master_key_material(pp_key_material->local_P2P_key_material, &buffer, &length);
+  CRYPTO_OBJECT_RELEASE(pp_key_material);
+
+  tokens->_buffer = DDS_Security_DataHolderSeq_allocbuf(1);
+  tokens->_length = tokens->_maximum = 1;
+  tokens->_buffer[0].class_id = ddsrt_strdup(CRYPTO_TOKEN_CLASS_ID);
+  tokens->_buffer[0].binary_properties._buffer = DDS_Security_BinaryPropertySeq_allocbuf(1);
+  tokens->_buffer[0].binary_properties._length = tokens->_buffer[0].binary_properties._maximum = 1;
+  tokens->_buffer[0].binary_properties._buffer[0].name = ddsrt_strdup(CRYPTO_TOKEN_PROPERTY_NAME);
+  tokens->_buffer[0].binary_properties._buffer[0].value._length =
+      tokens->_buffer[0].binary_properties._buffer[0].value._maximum = length;
+  tokens->_buffer[0].binary_properties._buffer[0].value._buffer = buffer;
+  return true;
+
+fail_invalid_arg:
+  return false;
+}
+
+static DDS_Security_boolean
+set_remote_participant_crypto_tokens(
+    dds_security_crypto_key_exchange *instance,
+    const DDS_Security_ParticipantCryptoHandle local_id,
+    const DDS_Security_ParticipantCryptoHandle remote_id,
+    const DDS_Security_ParticipantCryptoTokenSeq *tokens,
+    DDS_Security_SecurityException *ex)
+{
+  DDS_Security_boolean result = false;
+  dds_security_crypto_key_exchange_impl *impl = (dds_security_crypto_key_exchange_impl *)instance;
+  dds_security_crypto_key_factory *factory;
+  DDS_Security_KeyMaterial_AES_GCM_GMAC remote_key_mat;
+  const DDS_Security_OctetSeq *tdata;
+  DDS_Security_Deserializer deserializer;
+
+  if (!instance || !tokens || local_id == 0 || remote_id == 0)
+  {
+    DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_CRYPTO_ARGUMENT_CODE, 0,
+        "set_remote_participant_crypto_tokens: " DDS_SECURITY_ERR_INVALID_CRYPTO_ARGUMENT_MESSAGE);
+    return false;
+  }
+
+  if (!check_crypto_tokens(tokens))
+  {
+    DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_CRYPTO_ARGUMENT_CODE, 0,
+        "set_remote_participant_crypto_tokens: " DDS_SECURITY_ERR_INVALID_CRYPTO_ARGUMENT_MESSAGE);
+    return false;
+  }
+
+  tdata = &tokens->_buffer[0].binary_properties._buffer[0].value;
+
+  deserializer = DDS_Security_Deserializer_new(tdata->_buffer, tdata->_length);
+  if (!deserializer)
+  {
+    DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_CRYPTO_TOKEN_CODE, 0,
+        "set_remote_participant_crypto_tokens: " DDS_SECURITY_ERR_INVALID_CRYPTO_TOKEN_MESSAGE);
+    result = false;
+  }
+  else if (!DDS_Security_Deserialize_KeyMaterial_AES_GCM_GMAC(deserializer, &remote_key_mat))
+  {
+    DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_CRYPTO_TOKEN_CODE, 0,
+        "set_remote_participant_crypto_tokens: " DDS_SECURITY_ERR_INVALID_CRYPTO_TOKEN_MESSAGE);
+    result = false;
+  }
+  else if (!check_crypto_keymaterial(&remote_key_mat))
+  {
+    DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_CRYPTO_TOKEN_CODE, 0,
+        "set_remote_participant_crypto_tokens: " DDS_SECURITY_ERR_INVALID_CRYPTO_TOKEN_MESSAGE);
+    result = false;
+  }
+  else
+  {
+    factory = cryptography_get_crypto_key_factory(impl->crypto);
+    result = crypto_factory_set_participant_crypto_tokens(factory, local_id, remote_id, &remote_key_mat, ex);
+    DDS_Security_KeyMaterial_AES_GCM_GMAC_deinit(&remote_key_mat);
+  }
+
+  DDS_Security_Deserializer_free(deserializer);
+
+  return result;
+}
+
+static DDS_Security_boolean
+create_local_datawriter_crypto_tokens(
+    dds_security_crypto_key_exchange *instance,
+    DDS_Security_DatawriterCryptoTokenSeq *tokens,
+    const DDS_Security_DatawriterCryptoHandle local_writer_handle,
+    const DDS_Security_DatareaderCryptoHandle remote_reader_handle,
+    DDS_Security_SecurityException *ex)
+{
+  dds_security_crypto_key_exchange_impl *impl = (dds_security_crypto_key_exchange_impl *)instance;
+  dds_security_crypto_key_factory *factory;
+  master_key_material *key_mat[2];
+  uint32_t num_key_mat = 2;
+  uint32_t i;
+
+  if (!instance || !tokens || local_writer_handle == DDS_SECURITY_HANDLE_NIL || remote_reader_handle == DDS_SECURITY_HANDLE_NIL)
+  {
+    DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_CRYPTO_ARGUMENT_CODE, 0,
+        "create_local_datawriter_crypto_tokens: " DDS_SECURITY_ERR_INVALID_CRYPTO_ARGUMENT_MESSAGE);
+    return false;
+  }
+
+  factory = cryptography_get_crypto_key_factory(impl->crypto);
+
+  if (!crypto_factory_get_datawriter_crypto_tokens(factory, local_writer_handle, remote_reader_handle, key_mat, &num_key_mat, ex))
+    return false;
+
+  tokens->_length = tokens->_maximum = num_key_mat;
+  tokens->_buffer = (num_key_mat > 0) ? DDS_Security_DataHolderSeq_allocbuf(num_key_mat) : NULL;
+
+  for (i = 0; i < num_key_mat; i++)
+  {
+    uint8_t *buffer;
+    uint32_t length;
+
+    serialize_master_key_material(key_mat[i], &buffer, &length);
+
+    tokens->_buffer[i].class_id = ddsrt_strdup(CRYPTO_TOKEN_CLASS_ID);
+    tokens->_buffer[i].binary_properties._buffer = DDS_Security_BinaryPropertySeq_allocbuf(1);
+    tokens->_buffer[i].binary_properties._length = tokens->_buffer[0].binary_properties._maximum = 1;
+    tokens->_buffer[i].binary_properties._buffer[0].name = ddsrt_strdup(CRYPTO_TOKEN_PROPERTY_NAME);
+    tokens->_buffer[i].binary_properties._buffer[0].value._length =
+        tokens->_buffer[i].binary_properties._buffer[0].value._maximum = length;
+    tokens->_buffer[i].binary_properties._buffer[0].value._buffer = buffer;
+    CRYPTO_OBJECT_RELEASE(key_mat[i]);
+  }
+
+  return true;
+}
+
+static DDS_Security_boolean
+set_remote_datawriter_crypto_tokens(
+    dds_security_crypto_key_exchange *instance,
+    const DDS_Security_DatareaderCryptoHandle local_reader_handle,
+    const DDS_Security_DatawriterCryptoHandle remote_writer_handle,
+    const DDS_Security_DatawriterCryptoTokenSeq *tokens,
+    DDS_Security_SecurityException *ex)
+{
+  DDS_Security_boolean result = true;
+  dds_security_crypto_key_exchange_impl *impl = (dds_security_crypto_key_exchange_impl *)instance;
+  dds_security_crypto_key_factory *factory;
+  DDS_Security_KeyMaterial_AES_GCM_GMAC remote_key_mat[2];
+  uint32_t i;
+
+  if (!instance || !tokens || local_reader_handle == DDS_SECURITY_HANDLE_NIL || remote_writer_handle == DDS_SECURITY_HANDLE_NIL)
+  {
+    DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_CRYPTO_ARGUMENT_CODE, 0,
+        "set_remote_datawriter_crypto_tokens: " DDS_SECURITY_ERR_INVALID_CRYPTO_ARGUMENT_MESSAGE);
+    return false;
+  }
+
+  if (!check_crypto_tokens(tokens))
+  {
+    DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_CRYPTO_ARGUMENT_CODE, 0,
+        "set_remote_datawriter_crypto_tokens: " DDS_SECURITY_ERR_INVALID_CRYPTO_ARGUMENT_MESSAGE);
+    return false;
+  }
+
+  if (tokens->_length > 2)
+  {
+    DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_CRYPTO_ARGUMENT_CODE, 0,
+        "set_remote_datawriter_crypto_tokens: " DDS_SECURITY_ERR_INVALID_CRYPTO_ARGUMENT_MESSAGE);
+    return false;
+  }
+
+  for (i = 0; result && (i < tokens->_length); i++)
+  {
+    const DDS_Security_OctetSeq *tdata = &tokens->_buffer[i].binary_properties._buffer[0].value;
+    DDS_Security_Deserializer deserializer = DDS_Security_Deserializer_new(tdata->_buffer, tdata->_length);
+    if (!deserializer)
+    {
+      DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_CRYPTO_TOKEN_CODE, 0,
+          "set_remote_datawriter_crypto_tokens: " DDS_SECURITY_ERR_INVALID_CRYPTO_TOKEN_MESSAGE);
+      result = false;
+    }
+    else if (!DDS_Security_Deserialize_KeyMaterial_AES_GCM_GMAC(deserializer, &remote_key_mat[i]))
+    {
+      DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_CRYPTO_TOKEN_CODE, 0,
+          "set_remote_datawriter_crypto_tokens: " DDS_SECURITY_ERR_INVALID_CRYPTO_TOKEN_MESSAGE);
+      result = false;
+    }
+    else if (!check_crypto_keymaterial(&remote_key_mat[i]))
+    {
+      DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_CRYPTO_TOKEN_CODE, 0,
+          "set_remote_datawriter_crypto_tokens: " DDS_SECURITY_ERR_INVALID_CRYPTO_TOKEN_MESSAGE);
+      result = false;
+    }
+    DDS_Security_Deserializer_free(deserializer);
+  }
+
+  if (result)
+  {
+    factory = cryptography_get_crypto_key_factory(impl->crypto);
+    result = crypto_factory_set_datawriter_crypto_tokens(factory, local_reader_handle, remote_writer_handle, remote_key_mat, tokens->_length, ex);
+  }
+
+  for (i = 0; i < tokens->_length; i++)
+    DDS_Security_KeyMaterial_AES_GCM_GMAC_deinit(&remote_key_mat[i]);
+
+  return result;
+}
+
+static DDS_Security_boolean
+create_local_datareader_crypto_tokens(
+    dds_security_crypto_key_exchange *instance,
+    DDS_Security_DatareaderCryptoTokenSeq *tokens,
+    const DDS_Security_DatareaderCryptoHandle local_reader_handle,
+    const DDS_Security_DatawriterCryptoHandle remote_writer_handle,
+    DDS_Security_SecurityException *ex)
+{
+  dds_security_crypto_key_exchange_impl *impl = (dds_security_crypto_key_exchange_impl *)instance;
+  dds_security_crypto_key_factory *factory;
+  master_key_material *key_mat = NULL;
+  uint8_t *buffer;
+  uint32_t length;
+
+  if (!instance || !tokens || local_reader_handle == DDS_SECURITY_HANDLE_NIL || remote_writer_handle == DDS_SECURITY_HANDLE_NIL)
+  {
+    DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_CRYPTO_ARGUMENT_CODE, 0,
+        "create_local_datareader_crypto_tokens: " DDS_SECURITY_ERR_INVALID_CRYPTO_ARGUMENT_MESSAGE);
+    return false;
+  }
+
+  factory = cryptography_get_crypto_key_factory(impl->crypto);
+
+  if (!crypto_factory_get_datareader_crypto_tokens(factory, local_reader_handle, remote_writer_handle, &key_mat, ex))
+    return false;
+
+  if (key_mat != NULL)
+  { /* there may be no keymaterial according to configuration */
+
+    serialize_master_key_material(key_mat, &buffer, &length);
+
+    tokens->_buffer = DDS_Security_DataHolderSeq_allocbuf(1);
+    tokens->_length = tokens->_maximum = 1;
+
+    tokens->_buffer[0].class_id = ddsrt_strdup(CRYPTO_TOKEN_CLASS_ID);
+    tokens->_buffer[0].binary_properties._buffer = DDS_Security_BinaryPropertySeq_allocbuf(1);
+    tokens->_buffer[0].binary_properties._length = tokens->_buffer[0].binary_properties._maximum = 1;
+    tokens->_buffer[0].binary_properties._buffer[0].name = ddsrt_strdup(CRYPTO_TOKEN_PROPERTY_NAME);
+    tokens->_buffer[0].binary_properties._buffer[0].value._length =
+        tokens->_buffer[0].binary_properties._buffer[0].value._maximum = length;
+    tokens->_buffer[0].binary_properties._buffer[0].value._buffer = buffer;
+
+    CRYPTO_OBJECT_RELEASE(key_mat);
+  }
+  else
+  {
+    tokens->_buffer = NULL;
+    tokens->_length = 0;
+    tokens->_maximum = 0;
+  }
+
+  return true;
+}
+
+static DDS_Security_boolean
+set_remote_datareader_crypto_tokens(
+    dds_security_crypto_key_exchange *instance,
+    const DDS_Security_DatawriterCryptoHandle local_writer_handle,
+    const DDS_Security_DatareaderCryptoHandle remote_reader_handle,
+    const DDS_Security_DatareaderCryptoTokenSeq *tokens,
+    DDS_Security_SecurityException *ex)
+{
+  DDS_Security_boolean result = false;
+  dds_security_crypto_key_exchange_impl *impl = (dds_security_crypto_key_exchange_impl *)instance;
+  dds_security_crypto_key_factory *factory;
+  DDS_Security_KeyMaterial_AES_GCM_GMAC remote_key_mat;
+  const DDS_Security_OctetSeq *tdata;
+  DDS_Security_Deserializer deserializer;
+
+  if (!instance || !tokens || local_writer_handle == DDS_SECURITY_HANDLE_NIL || remote_reader_handle == DDS_SECURITY_HANDLE_NIL)
+  {
+    DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_CRYPTO_ARGUMENT_CODE, 0,
+        "set_remote_datareader_crypto_tokens: " DDS_SECURITY_ERR_INVALID_CRYPTO_ARGUMENT_MESSAGE);
+    return false;
+  }
+
+  if (!check_crypto_tokens(tokens))
+  {
+    DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_CRYPTO_ARGUMENT_CODE, 0,
+        "set_remote_datareader_crypto_tokens: " DDS_SECURITY_ERR_INVALID_CRYPTO_ARGUMENT_MESSAGE);
+    return false;
+  }
+
+  tdata = &tokens->_buffer[0].binary_properties._buffer[0].value;
+
+  deserializer = DDS_Security_Deserializer_new(tdata->_buffer, tdata->_length);
+  if (!deserializer)
+  {
+    DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_CRYPTO_TOKEN_CODE, 0,
+        "set_remote_datareader_crypto_tokens: " DDS_SECURITY_ERR_INVALID_CRYPTO_TOKEN_MESSAGE);
+    result = false;
+  }
+  else if (!DDS_Security_Deserialize_KeyMaterial_AES_GCM_GMAC(deserializer, &remote_key_mat))
+  {
+    DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_CRYPTO_TOKEN_CODE, 0,
+        "set_remote_datareader_crypto_tokens: " DDS_SECURITY_ERR_INVALID_CRYPTO_TOKEN_MESSAGE);
+    result = false;
+  }
+  else if (!check_crypto_keymaterial(&remote_key_mat))
+  {
+    DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_CRYPTO_TOKEN_CODE, 0,
+        "set_remote_datareader_crypto_tokens: " DDS_SECURITY_ERR_INVALID_CRYPTO_TOKEN_MESSAGE);
+    result = false;
+  }
+  else
+  {
+    factory = cryptography_get_crypto_key_factory(impl->crypto);
+    result = crypto_factory_set_datareader_crypto_tokens(factory, local_writer_handle, remote_reader_handle, &remote_key_mat, ex);
+  }
+
+  DDS_Security_KeyMaterial_AES_GCM_GMAC_deinit(&remote_key_mat);
+
+  DDS_Security_Deserializer_free(deserializer);
+
+  return result;
+}
+
+static DDS_Security_boolean
+return_crypto_tokens(
+    dds_security_crypto_key_exchange *instance,
+    DDS_Security_CryptoTokenSeq *tokens,
+    DDS_Security_SecurityException *ex)
+{
+  dds_security_crypto_key_exchange_impl *impl = (dds_security_crypto_key_exchange_impl *)instance;
+
+  if (!impl || !tokens)
+  {
+    DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_CRYPTO_ARGUMENT_CODE, 0,
+        "return_crypto_tokens: " DDS_SECURITY_ERR_INVALID_CRYPTO_ARGUMENT_MESSAGE);
+    goto fail_invalid_arg;
+  }
+
+  if (!check_crypto_tokens(tokens))
+  {
+    DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_CRYPTO_ARGUMENT_CODE, 0,
+        "set_remote_participant_crypto_tokens: " DDS_SECURITY_ERR_INVALID_CRYPTO_ARGUMENT_MESSAGE);
+    goto fail_invalid_arg;
+  }
+
+  DDS_Security_CryptoTokenSeq_freebuf(tokens);
+  memset(tokens, 0, sizeof(*tokens));
+  return true;
+
+fail_invalid_arg:
+  return false;
+}
+
+dds_security_crypto_key_exchange *
+dds_security_crypto_key_exchange__alloc(
+    const dds_security_cryptography *crypto)
+{
+  dds_security_crypto_key_exchange_impl *instance = ddsrt_malloc(sizeof(*instance));
+  instance->crypto = crypto;
+  instance->base.create_local_participant_crypto_tokens = &create_local_participant_crypto_tokens;
+  instance->base.set_remote_participant_crypto_tokens = &set_remote_participant_crypto_tokens;
+  instance->base.create_local_datawriter_crypto_tokens = &create_local_datawriter_crypto_tokens;
+  instance->base.set_remote_datawriter_crypto_tokens = &set_remote_datawriter_crypto_tokens;
+  instance->base.create_local_datareader_crypto_tokens = &create_local_datareader_crypto_tokens;
+  instance->base.set_remote_datareader_crypto_tokens = &set_remote_datareader_crypto_tokens;
+  instance->base.return_crypto_tokens = &return_crypto_tokens;
+  return (dds_security_crypto_key_exchange *)instance;
+}
+
+void dds_security_crypto_key_exchange__dealloc(
+    dds_security_crypto_key_exchange *instance)
+{
+  ddsrt_free(instance);
+}
diff --git a/src/security/builtin_plugins/cryptographic/src/crypto_key_exchange.h b/src/security/builtin_plugins/cryptographic/src/crypto_key_exchange.h
new file mode 100644
index 0000000..c1852b3
--- /dev/null
+++ b/src/security/builtin_plugins/cryptographic/src/crypto_key_exchange.h
@@ -0,0 +1,27 @@
+/*
+ * Copyright(c) 2006 to 2019 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+#ifndef CRYPTO_KEY_EXCHANGE_H
+#define CRYPTO_KEY_EXCHANGE_H
+
+#include "dds/security/dds_security_api.h"
+
+/**
+ * @brief Allocation function for implementer structure (with internal variables) transparently.
+ */
+dds_security_crypto_key_exchange *
+dds_security_crypto_key_exchange__alloc(
+    const dds_security_cryptography *crypto);
+
+void dds_security_crypto_key_exchange__dealloc(
+    dds_security_crypto_key_exchange *instance);
+
+#endif /* CRYPTO_KEY_EXCHANGE_H */
diff --git a/src/security/builtin_plugins/cryptographic/src/crypto_key_factory.c b/src/security/builtin_plugins/cryptographic/src/crypto_key_factory.c
new file mode 100644
index 0000000..833ca01
--- /dev/null
+++ b/src/security/builtin_plugins/cryptographic/src/crypto_key_factory.c
@@ -0,0 +1,1869 @@
+/*
+ * Copyright(c) 2006 to 2019 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+#include <assert.h>
+#include <string.h>
+#include <openssl/rand.h>
+#include <openssl/sha.h>
+#include <openssl/hmac.h>
+#include <openssl/bio.h>
+#include <openssl/err.h>
+#include "dds/ddsrt/atomics.h"
+#include "dds/ddsrt/heap.h"
+#include "dds/ddsrt/sync.h"
+#include "dds/ddsrt/types.h"
+#include "dds/security/dds_security_api.h"
+#include "dds/security/core/dds_security_utils.h"
+#include "dds/security/core/dds_security_serialize.h"
+#include "dds/security/core/shared_secret.h"
+#include "crypto_defs.h"
+#include "crypto_utils.h"
+#include "crypto_cipher.h"
+#include "crypto_key_factory.h"
+#include "crypto_objects.h"
+
+/**
+ * Implementation structure for storing encapsulated members of the instance
+ * while giving only the interface definition to user
+ */
+
+#define KXKEYCOOKIE "key exchange key"
+#define KXSALTCOOKIE "keyexchange salt"
+
+typedef struct dds_security_crypto_key_factory_impl
+{
+  dds_security_crypto_key_factory base;
+  const dds_security_cryptography *crypto;
+  ddsrt_mutex_t lock;
+  struct CryptoObjectTable *crypto_objects; /* table for storing CryptoHandle - ParticipantKeyMaterial pairs */
+  ddsrt_atomic_uint32_t next_key_id;
+} dds_security_crypto_key_factory_impl;
+
+static void
+crypto_token_copy(
+    master_key_material *dst,
+    const DDS_Security_KeyMaterial_AES_GCM_GMAC *src)
+{
+  DDS_Security_CryptoTransformKind_Enum src_transform_kind = CRYPTO_TRANSFORM_KIND(src->transformation_kind);
+
+  if (CRYPTO_TRANSFORM_HAS_KEYS(dst->transformation_kind))
+  {
+    ddsrt_free(dst->master_salt);
+    ddsrt_free(dst->master_sender_key);
+    ddsrt_free(dst->master_receiver_specific_key);
+  }
+  if (CRYPTO_TRANSFORM_HAS_KEYS(src_transform_kind))
+  {
+    uint32_t key_bytes = CRYPTO_KEY_SIZE_BYTES(src_transform_kind);
+    dst->master_salt = ddsrt_calloc(1, key_bytes);
+    dst->master_sender_key = ddsrt_calloc(1, key_bytes);
+    dst->master_receiver_specific_key = ddsrt_calloc(1, key_bytes);
+    memcpy(dst->master_salt, src->master_salt._buffer, key_bytes);
+    dst->sender_key_id = CRYPTO_TRANSFORM_ID(src->sender_key_id);
+    memcpy(dst->master_sender_key, src->master_sender_key._buffer, key_bytes);
+    dst->receiver_specific_key_id = CRYPTO_TRANSFORM_ID(src->receiver_specific_key_id);
+    if (dst->receiver_specific_key_id)
+      memcpy(dst->master_receiver_specific_key, src->master_receiver_specific_key._buffer, key_bytes);
+  }
+  dst->transformation_kind = src_transform_kind;
+};
+
+/* Compute KeyMaterial_AES_GCM_GMAC as described in DDS Security spec v1.1 section 9.5.2.1.2 (table 67 and table 68) */
+static bool
+calculate_kx_keys(
+    const DDS_Security_SharedSecretHandle shared_secret,
+    master_key_material *kx_key_material,
+    DDS_Security_SecurityException *ex)
+{
+  bool result = false;
+  const DDS_Security_octet *challenge1, *challenge2, *shared_secret_key;
+  unsigned char *kx_master_salt, *kx_master_sender_key;
+  size_t shared_secret_size = get_secret_size_from_secret_handle(shared_secret);
+  unsigned char hash[SHA256_DIGEST_LENGTH];
+  size_t concatenated_bytes1_size = DDS_SECURITY_AUTHENTICATION_CHALLENGE_SIZE * 2 + sizeof(KXSALTCOOKIE);
+  size_t concatenated_bytes2_size = DDS_SECURITY_AUTHENTICATION_CHALLENGE_SIZE * 2 + sizeof(KXKEYCOOKIE);
+  DDS_Security_octet *concatenated_bytes1, *concatenated_bytes2;
+
+  memset(ex, 0, sizeof(*ex));
+
+  if (shared_secret_size > UINT32_MAX)
+  {
+    DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, 0, "shared_secret_size > UINT32_MAX");
+    goto fail_kx;
+  }
+  concatenated_bytes1 = ddsrt_malloc(concatenated_bytes1_size);
+  concatenated_bytes2 = ddsrt_malloc(concatenated_bytes2_size);
+  challenge1 = get_challenge1_from_secret_handle(shared_secret);
+  challenge2 = get_challenge2_from_secret_handle(shared_secret);
+  shared_secret_key = get_secret_from_secret_handle(shared_secret);
+
+  /* master_salt */
+  memcpy(concatenated_bytes1, challenge1, DDS_SECURITY_AUTHENTICATION_CHALLENGE_SIZE);
+  memcpy(concatenated_bytes1 + DDS_SECURITY_AUTHENTICATION_CHALLENGE_SIZE, KXSALTCOOKIE, sizeof(KXSALTCOOKIE));
+  memcpy(concatenated_bytes1 + DDS_SECURITY_AUTHENTICATION_CHALLENGE_SIZE + sizeof(KXSALTCOOKIE), challenge2,
+         DDS_SECURITY_AUTHENTICATION_CHALLENGE_SIZE);
+
+  SHA256(concatenated_bytes1, concatenated_bytes1_size, hash);
+  if (!(kx_master_salt = crypto_hmac256(hash, SHA256_DIGEST_LENGTH, shared_secret_key, (uint32_t) shared_secret_size, ex)))
+    goto fail_kx_salt;
+
+  /* master_sender_key */
+  memcpy(concatenated_bytes2, challenge2, DDS_SECURITY_AUTHENTICATION_CHALLENGE_SIZE);
+  memcpy(concatenated_bytes2 + DDS_SECURITY_AUTHENTICATION_CHALLENGE_SIZE, KXKEYCOOKIE, sizeof(KXKEYCOOKIE));
+  memcpy(concatenated_bytes2 + DDS_SECURITY_AUTHENTICATION_CHALLENGE_SIZE + sizeof(KXKEYCOOKIE), challenge1,
+         DDS_SECURITY_AUTHENTICATION_CHALLENGE_SIZE);
+
+  SHA256(concatenated_bytes2, concatenated_bytes2_size, hash);
+  if (!(kx_master_sender_key = crypto_hmac256(hash, SHA256_DIGEST_LENGTH, shared_secret_key, (uint32_t) shared_secret_size, ex)))
+    goto fail_kx_key;
+
+  assert (kx_key_material->transformation_kind == CRYPTO_TRANSFORMATION_KIND_AES256_GCM); /* set in crypto_participant_key_material_new */
+  memcpy(kx_key_material->master_salt, kx_master_salt, CRYPTO_KEY_SIZE_256);
+  kx_key_material->sender_key_id = 0;
+  memcpy(kx_key_material->master_sender_key, kx_master_sender_key, CRYPTO_KEY_SIZE_256);
+  kx_key_material->receiver_specific_key_id = 0;
+
+  memset (kx_master_sender_key, 0, CRYPTO_KEY_SIZE_256);
+  ddsrt_free(kx_master_sender_key);
+  result = true;
+
+fail_kx_key:
+  memset (kx_master_salt, 0, CRYPTO_KEY_SIZE_256);
+  ddsrt_free(kx_master_salt);
+fail_kx_salt:
+  ddsrt_free(concatenated_bytes2);
+  ddsrt_free(concatenated_bytes1);
+fail_kx:
+  return result;
+}
+
+static uint32_t
+generate_key(
+    dds_security_crypto_key_factory_impl *implementation,
+    master_key_material *key_material,
+    DDS_Security_SecurityException *ex)
+{
+  assert (key_material->transformation_kind != CRYPTO_TRANSFORMATION_KIND_NONE);
+  if (RAND_bytes(key_material->master_salt, (int)CRYPTO_KEY_SIZE_BYTES(key_material->transformation_kind)) < 0)
+  {
+    DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_CANNOT_GENERATE_RANDOM_CODE, 0,
+        DDS_SECURITY_ERR_CANNOT_GENERATE_RANDOM_MESSAGE);
+    return DDS_SECURITY_ERR_CANNOT_GENERATE_RANDOM_CODE;
+  }
+  if (RAND_bytes(key_material->master_sender_key, (int)CRYPTO_KEY_SIZE_BYTES(key_material->transformation_kind)) < 0)
+  {
+    DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_CANNOT_GENERATE_RANDOM_CODE, 0,
+        DDS_SECURITY_ERR_CANNOT_GENERATE_RANDOM_MESSAGE);
+    return DDS_SECURITY_ERR_CANNOT_GENERATE_RANDOM_CODE;
+  }
+  key_material->sender_key_id = ddsrt_atomic_inc32_ov(&implementation->next_key_id);
+  return DDS_SECURITY_ERR_OK_CODE;
+}
+
+static DDS_Security_ProtectionKind
+attribute_to_rtps_protection_kind(
+    const DDS_Security_ParticipantSecurityAttributes *attributes)
+{
+  DDS_Security_ProtectionKind kind = DDS_SECURITY_PROTECTION_KIND_NONE;
+  assert(attributes);
+  if (attributes->is_rtps_protected)
+  {
+    if (attributes->plugin_participant_attributes & DDS_SECURITY_PLUGIN_PARTICIPANT_ATTRIBUTES_FLAG_IS_RTPS_ENCRYPTED)
+    {
+      if (attributes->plugin_participant_attributes & DDS_SECURITY_PLUGIN_PARTICIPANT_ATTRIBUTES_FLAG_IS_RTPS_AUTHENTICATED)
+        kind = DDS_SECURITY_PROTECTION_KIND_ENCRYPT_WITH_ORIGIN_AUTHENTICATION;
+      else
+        kind = DDS_SECURITY_PROTECTION_KIND_ENCRYPT;
+    }
+    else
+    {
+      if (attributes->plugin_participant_attributes & DDS_SECURITY_PLUGIN_PARTICIPANT_ATTRIBUTES_FLAG_IS_RTPS_AUTHENTICATED)
+        kind = DDS_SECURITY_PROTECTION_KIND_SIGN_WITH_ORIGIN_AUTHENTICATION;
+      else
+        kind = DDS_SECURITY_PROTECTION_KIND_SIGN;
+    }
+  }
+
+  return kind;
+}
+
+static DDS_Security_ProtectionKind
+attribute_to_meta_protection_kind(
+    const DDS_Security_EndpointSecurityAttributes *attributes)
+{
+  DDS_Security_ProtectionKind kind = DDS_SECURITY_PROTECTION_KIND_NONE;
+  assert(attributes);
+  if (attributes->is_submessage_protected)
+  {
+    if (attributes->plugin_endpoint_attributes & DDS_SECURITY_PLUGIN_ENDPOINT_ATTRIBUTES_FLAG_IS_SUBMESSAGE_ENCRYPTED)
+    {
+      if (attributes->plugin_endpoint_attributes & DDS_SECURITY_PLUGIN_ENDPOINT_ATTRIBUTES_FLAG_IS_SUBMESSAGE_ORIGIN_AUTHENTICATED)
+        kind = DDS_SECURITY_PROTECTION_KIND_ENCRYPT_WITH_ORIGIN_AUTHENTICATION;
+      else
+        kind = DDS_SECURITY_PROTECTION_KIND_ENCRYPT;
+    }
+    else
+    {
+      if (attributes->plugin_endpoint_attributes & DDS_SECURITY_PLUGIN_ENDPOINT_ATTRIBUTES_FLAG_IS_SUBMESSAGE_ORIGIN_AUTHENTICATED)
+        kind = DDS_SECURITY_PROTECTION_KIND_SIGN_WITH_ORIGIN_AUTHENTICATION;
+      else
+        kind = DDS_SECURITY_PROTECTION_KIND_SIGN;
+    }
+  }
+
+  return kind;
+}
+
+static DDS_Security_BasicProtectionKind
+attribute_to_data_protection_kind(
+    const DDS_Security_EndpointSecurityAttributes *attributes)
+{
+  DDS_Security_BasicProtectionKind kind = DDS_SECURITY_BASICPROTECTION_KIND_NONE;
+  assert(attributes);
+  if (attributes->is_payload_protected)
+  {
+    if (attributes->plugin_endpoint_attributes & DDS_SECURITY_PLUGIN_ENDPOINT_ATTRIBUTES_FLAG_IS_PAYLOAD_ENCRYPTED)
+      kind = DDS_SECURITY_BASICPROTECTION_KIND_ENCRYPT;
+    else
+      kind = DDS_SECURITY_BASICPROTECTION_KIND_SIGN;
+  }
+  return kind;
+}
+
+static void
+remove_relation_from_keymaterial(
+    const participant_key_material *key_material,
+    CryptoObject *local_crypto,
+    CryptoObject *remote_crypto)
+{
+  endpoint_relation *relation;
+  relation = crypto_endpoint_relation_find_by_crypto(key_material->endpoint_relations, local_crypto, remote_crypto);
+  if (relation)
+  {
+    crypto_object_table_remove_object(key_material->endpoint_relations, (CryptoObject *)relation);
+    CRYPTO_OBJECT_RELEASE(relation);
+  }
+}
+
+static void
+remove_remote_writer_relation(
+    dds_security_crypto_key_factory_impl *implementation,
+    remote_datawriter_crypto *remote_writer)
+{
+  local_datareader_crypto *local_reader;
+  remote_participant_crypto *remote_participant;
+  participant_key_material *key_material;
+
+  assert(remote_writer);
+  remote_participant = remote_writer->participant;
+  assert(remote_participant);
+  local_reader = (local_datareader_crypto *)crypto_object_table_find(implementation->crypto_objects, remote_writer->local_reader_handle);
+  if (local_reader)
+  {
+    key_material = (participant_key_material *)crypto_object_table_find(
+        remote_participant->key_material, CRYPTO_OBJECT_HANDLE(local_reader->participant));
+    if (key_material)
+    {
+      remove_relation_from_keymaterial(key_material, (CryptoObject *)local_reader, (CryptoObject *)remote_writer);
+      CRYPTO_OBJECT_RELEASE(key_material);
+    }
+    CRYPTO_OBJECT_RELEASE(local_reader);
+  }
+}
+
+static void
+remove_remote_reader_relation(
+    dds_security_crypto_key_factory_impl *implementation,
+    remote_datareader_crypto *remote_reader)
+{
+  local_datawriter_crypto *local_writer;
+  remote_participant_crypto *remote_participant;
+  participant_key_material *key_material;
+
+  assert(remote_reader);
+  remote_participant = remote_reader->participant;
+  assert(remote_participant);
+  local_writer = (local_datawriter_crypto *)crypto_object_table_find(implementation->crypto_objects, remote_reader->local_writer_handle);
+  if (local_writer)
+  {
+    key_material = (participant_key_material *)crypto_object_table_find(
+        remote_participant->key_material, CRYPTO_OBJECT_HANDLE(local_writer->participant));
+    if (key_material)
+    {
+      remove_relation_from_keymaterial(key_material, (CryptoObject *)local_writer, (CryptoObject *)remote_reader);
+      CRYPTO_OBJECT_RELEASE(key_material);
+    }
+    CRYPTO_OBJECT_RELEASE(local_writer);
+  }
+}
+
+/**
+ * Function implementations
+ */
+
+static DDS_Security_ParticipantCryptoHandle
+register_local_participant(
+    dds_security_crypto_key_factory *instance,
+    const DDS_Security_IdentityHandle participant_identity,
+    const DDS_Security_PermissionsHandle participant_permissions,
+    const DDS_Security_PropertySeq *participant_properties,
+    const DDS_Security_ParticipantSecurityAttributes *participant_security_attributes,
+    DDS_Security_SecurityException *ex)
+{
+  local_participant_crypto *participant_crypto;
+  dds_security_crypto_key_factory_impl *implementation = (dds_security_crypto_key_factory_impl *)instance;
+
+  if ((participant_identity == DDS_SECURITY_HANDLE_NIL) ||
+      (participant_permissions == DDS_SECURITY_HANDLE_NIL))
+  {
+    DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_IDENTITY_EMPTY_CODE, 0,
+        DDS_SECURITY_ERR_IDENTITY_EMPTY_MESSAGE);
+    goto err_invalid_argument;
+  }
+
+  /*init objects */
+  participant_crypto = crypto_local_participant_crypto__new(participant_identity);
+  participant_crypto->rtps_protection_kind = attribute_to_rtps_protection_kind(participant_security_attributes);
+  participant_crypto->key_material = crypto_master_key_material_new(
+    DDS_Security_protectionkind2transformationkind(participant_properties, participant_crypto->rtps_protection_kind));
+
+  /* No need to create session material if there is no protection for RTPS */
+  if (participant_crypto->key_material->transformation_kind != CRYPTO_TRANSFORMATION_KIND_NONE)
+  {
+    if (generate_key(implementation, participant_crypto->key_material, ex) != DDS_SECURITY_ERR_OK_CODE)
+      goto err_random_generation;
+    participant_crypto->session = crypto_session_key_material_new(participant_crypto->key_material);
+  }
+
+  crypto_object_table_insert(implementation->crypto_objects, (CryptoObject *)participant_crypto);
+  CRYPTO_OBJECT_RELEASE(participant_crypto);
+
+  return PARTICIPANT_CRYPTO_HANDLE(participant_crypto);
+
+  /* error cases*/
+err_random_generation:
+  CRYPTO_OBJECT_RELEASE(participant_crypto);
+err_invalid_argument:
+  return DDS_SECURITY_HANDLE_NIL;
+}
+
+struct resolve_remote_part_arg
+{
+  DDS_Security_IdentityHandle ident;
+  remote_participant_crypto *pprmte;
+};
+
+static int
+resolve_remote_participant_by_id(
+    CryptoObject *obj,
+    void *arg)
+{
+  struct resolve_remote_part_arg *info = arg;
+
+  remote_participant_crypto *pprmte;
+  if (obj->kind == CRYPTO_OBJECT_KIND_REMOTE_CRYPTO)
+  {
+    pprmte = (remote_participant_crypto *)obj;
+    if (pprmte->identity_handle == info->ident)
+    {
+      info->pprmte = (remote_participant_crypto *)CRYPTO_OBJECT_KEEP(pprmte);
+      return 0;
+    }
+  }
+
+  return 1;
+}
+
+static DDS_Security_ParticipantCryptoHandle
+register_matched_remote_participant(
+    dds_security_crypto_key_factory *instance,
+    const DDS_Security_ParticipantCryptoHandle local_participant_crypto_handle,
+    const DDS_Security_IdentityHandle remote_participant_identity,
+    const DDS_Security_PermissionsHandle remote_participant_permissions,
+    const DDS_Security_SharedSecretHandle shared_secret,
+    DDS_Security_SecurityException *ex)
+{
+  /* declarations */
+  dds_security_crypto_key_factory_impl *implementation = (dds_security_crypto_key_factory_impl *)instance;
+  remote_participant_crypto *participant_crypto;
+  local_participant_crypto *local_participant_crypto_ref;
+  DDS_Security_SecurityException exception;
+  participant_key_material *key_material;
+
+  if (local_participant_crypto_handle == DDS_SECURITY_HANDLE_NIL)
+  {
+    DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_PARTICIPANT_CRYPTO_HANDLE_EMPTY_CODE, 0,
+        DDS_SECURITY_ERR_PARTICIPANT_CRYPTO_HANDLE_EMPTY_MESSAGE);
+    goto err_invalid_argument;
+  }
+  else if (remote_participant_identity == DDS_SECURITY_HANDLE_NIL)
+  {
+    DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_IDENTITY_EMPTY_CODE, 0,
+        DDS_SECURITY_ERR_IDENTITY_EMPTY_MESSAGE);
+    goto err_invalid_argument;
+  }
+  else if (remote_participant_permissions == DDS_SECURITY_HANDLE_NIL)
+  {
+    DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_PERMISSION_HANDLE_EMPTY_CODE, 0,
+        DDS_SECURITY_ERR_PERMISSION_HANDLE_EMPTY_MESSAGE);
+    goto err_invalid_argument;
+  }
+
+  /* Check if local_participant_crypto_handle exists in the map */
+
+  local_participant_crypto_ref = (local_participant_crypto *)crypto_object_table_find(implementation->crypto_objects, local_participant_crypto_handle);
+  if (local_participant_crypto_ref == NULL)
+  {
+    DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_CODE, 0,
+        DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_MESSAGE);
+    goto err_invalid_argument;
+  }
+
+  /* find or create remote participant crypto structure */
+  {
+    struct resolve_remote_part_arg arg = {remote_participant_identity, NULL};
+    crypto_object_table_walk(implementation->crypto_objects, resolve_remote_participant_by_id, &arg);
+    if (arg.pprmte)
+    {
+      participant_crypto = arg.pprmte;
+    }
+    else
+    {
+      participant_crypto = crypto_remote_participant_crypto__new(remote_participant_identity);
+      crypto_object_table_insert(implementation->crypto_objects, (CryptoObject *)participant_crypto);
+    }
+  }
+
+  key_material = (participant_key_material *)crypto_object_table_find(participant_crypto->key_material, local_participant_crypto_ref->_parent.handle);
+
+  if (!key_material)
+  {
+    key_material = crypto_participant_key_material_new(local_participant_crypto_ref);
+
+    /* set remote participant keymaterial with local keymaterial values */
+    crypto_master_key_material_set(key_material->local_P2P_key_material, local_participant_crypto_ref->key_material);
+
+    if (!calculate_kx_keys(shared_secret, key_material->P2P_kx_key_material, &exception))
+      goto fail_calc_key;
+
+    key_material->P2P_writer_session = crypto_session_key_material_new(key_material->P2P_kx_key_material);
+    key_material->P2P_reader_session = crypto_session_key_material_new(key_material->P2P_kx_key_material);
+
+    /* if we do not have OriginAuthentication, receiver specific info remains empty/NULL */
+    if ((local_participant_crypto_ref->rtps_protection_kind == DDS_SECURITY_PROTECTION_KIND_ENCRYPT_WITH_ORIGIN_AUTHENTICATION) ||
+        (local_participant_crypto_ref->rtps_protection_kind == DDS_SECURITY_PROTECTION_KIND_SIGN_WITH_ORIGIN_AUTHENTICATION))
+    {
+      if (RAND_bytes(key_material->local_P2P_key_material->master_receiver_specific_key, (int)CRYPTO_KEY_SIZE_BYTES(key_material->local_P2P_key_material->transformation_kind)) < 0)
+      {
+        DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_CANNOT_GENERATE_RANDOM_CODE, 0,
+            DDS_SECURITY_ERR_CANNOT_GENERATE_RANDOM_MESSAGE);
+        goto err_random_generation;
+      }
+      key_material->local_P2P_key_material->receiver_specific_key_id = ddsrt_atomic_inc32_ov(&implementation->next_key_id);
+    }
+    participant_crypto->session = (session_key_material *)CRYPTO_OBJECT_KEEP(local_participant_crypto_ref->session);
+
+    crypto_object_table_insert(participant_crypto->key_material, (CryptoObject *)key_material);
+  }
+
+  participant_crypto->rtps_protection_kind = local_participant_crypto_ref->rtps_protection_kind; /* Same as local  */
+
+  CRYPTO_OBJECT_RELEASE(key_material);
+  CRYPTO_OBJECT_RELEASE(participant_crypto);
+  CRYPTO_OBJECT_RELEASE(local_participant_crypto_ref);
+
+  return PARTICIPANT_CRYPTO_HANDLE(participant_crypto);
+
+/* error cases*/
+err_random_generation:
+fail_calc_key:
+  CRYPTO_OBJECT_RELEASE(key_material);
+  CRYPTO_OBJECT_RELEASE(participant_crypto);
+  CRYPTO_OBJECT_RELEASE(local_participant_crypto_ref);
+err_invalid_argument:
+  return DDS_SECURITY_HANDLE_NIL;
+}
+
+static DDS_Security_DatawriterCryptoHandle
+register_local_datawriter(
+    dds_security_crypto_key_factory *instance,
+    const DDS_Security_ParticipantCryptoHandle participant_crypto_handle,
+    const DDS_Security_PropertySeq *datawriter_properties,
+    const DDS_Security_EndpointSecurityAttributes *datawriter_security_attributes,
+    DDS_Security_SecurityException *ex)
+{
+  local_participant_crypto *participant_crypto;
+  local_datawriter_crypto *writer_crypto;
+  bool is_builtin = false;
+  dds_security_crypto_key_factory_impl *implementation = (dds_security_crypto_key_factory_impl *)instance;
+  DDS_Security_ProtectionKind metadata_protection;
+  DDS_Security_BasicProtectionKind data_protection;
+
+  memset(ex, 0, sizeof(*ex));
+
+  if (participant_crypto_handle == DDS_SECURITY_HANDLE_NIL)
+  {
+    DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_CODE, 0,
+        DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_MESSAGE);
+    goto err_invalid_parameter;
+  }
+
+  participant_crypto = (local_participant_crypto *)crypto_object_table_find(implementation->crypto_objects, participant_crypto_handle);
+  if (!participant_crypto)
+  {
+    DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_CODE, 0,
+        DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_MESSAGE);
+    goto err_invalid_parameter;
+  }
+
+  if (datawriter_properties != NULL && datawriter_properties->_length > 0)
+  {
+    const DDS_Security_Property_t *property = DDS_Security_PropertySeq_find_property(
+        datawriter_properties, "dds.sec.builtin_endpoint_name");
+    if (property != NULL && strcmp(property->value, "BuiltinParticipantVolatileMessageSecureWriter") == 0)
+      is_builtin = true;
+  }
+
+  data_protection = attribute_to_data_protection_kind(datawriter_security_attributes);
+  metadata_protection = attribute_to_meta_protection_kind(datawriter_security_attributes);
+
+  writer_crypto = crypto_local_datawriter_crypto__new(participant_crypto, metadata_protection, data_protection);
+  writer_crypto->is_builtin_participant_volatile_message_secure_writer = is_builtin;
+
+  if (!is_builtin)
+  {
+    if (writer_crypto->metadata_protectionKind != DDS_SECURITY_PROTECTION_KIND_NONE)
+    {
+      writer_crypto->writer_key_material_message = crypto_master_key_material_new(
+        DDS_Security_protectionkind2transformationkind(datawriter_properties, metadata_protection));
+      if (generate_key(implementation, writer_crypto->writer_key_material_message, ex) != DDS_SECURITY_ERR_OK_CODE)
+        goto err_random_generation;
+      writer_crypto->writer_session_message = crypto_session_key_material_new(writer_crypto->writer_key_material_message);
+    }
+
+    if (writer_crypto->data_protectionKind != DDS_SECURITY_BASICPROTECTION_KIND_NONE)
+    {
+      writer_crypto->writer_key_material_payload = crypto_master_key_material_new(
+        DDS_Security_basicprotectionkind2transformationkind(datawriter_properties, data_protection));
+      if (generate_key(implementation, writer_crypto->writer_key_material_payload, ex) != DDS_SECURITY_ERR_OK_CODE)
+        goto err_random_generation;
+      writer_crypto->writer_session_payload = crypto_session_key_material_new(writer_crypto->writer_key_material_payload);
+    }
+  }
+
+  crypto_object_table_insert(implementation->crypto_objects, (CryptoObject *)writer_crypto);
+  CRYPTO_OBJECT_RELEASE(participant_crypto);
+  CRYPTO_OBJECT_RELEASE(writer_crypto);
+  return writer_crypto->_parent.handle;
+
+err_random_generation:
+  CRYPTO_OBJECT_RELEASE(participant_crypto);
+  CRYPTO_OBJECT_RELEASE(writer_crypto);
+err_invalid_parameter:
+  return DDS_SECURITY_HANDLE_NIL;
+}
+
+static DDS_Security_DatareaderCryptoHandle
+register_matched_remote_datareader(
+    dds_security_crypto_key_factory *instance,
+    const DDS_Security_DatawriterCryptoHandle local_datawriter_crypto_handle,
+    const DDS_Security_ParticipantCryptoHandle remote_participant_crypto_handle,
+    const DDS_Security_SharedSecretHandle shared_secret,
+    const DDS_Security_boolean relay_only, DDS_Security_SecurityException *ex)
+{
+  remote_datareader_crypto *reader_crypto;
+  dds_security_crypto_key_factory_impl *implementation = (dds_security_crypto_key_factory_impl *)instance;
+  local_datawriter_crypto *local_writer;
+  remote_participant_crypto *remote_participant;
+  DDS_Security_ProtectionKind metadata_protectionKind;
+  DDS_Security_BasicProtectionKind data_protectionKind;
+
+  memset(ex, 0, sizeof(*ex));
+
+  DDSRT_UNUSED_ARG(shared_secret);
+  DDSRT_UNUSED_ARG(relay_only);
+
+  if ((remote_participant_crypto_handle == DDS_SECURITY_HANDLE_NIL) ||
+      (local_datawriter_crypto_handle == DDS_SECURITY_HANDLE_NIL))
+  {
+    DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_CODE, 0,
+        DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_MESSAGE);
+    goto err_invalid_parameter;
+  }
+
+  remote_participant = (remote_participant_crypto *)crypto_object_table_find(implementation->crypto_objects, remote_participant_crypto_handle);
+  if (!remote_participant)
+  {
+    DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_CODE, 0,
+        DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_MESSAGE);
+    goto err_invalid_parameter;
+  }
+
+  local_writer = (local_datawriter_crypto *)crypto_object_table_find(implementation->crypto_objects, local_datawriter_crypto_handle);
+  if (!local_writer)
+  {
+    CRYPTO_OBJECT_RELEASE(remote_participant);
+    DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_CODE, 0,
+        DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_MESSAGE);
+    goto err_invalid_parameter;
+  }
+
+  data_protectionKind = local_writer->data_protectionKind;
+  metadata_protectionKind = local_writer->metadata_protectionKind;
+
+  reader_crypto = crypto_remote_datareader_crypto__new(remote_participant, metadata_protectionKind, data_protectionKind, local_datawriter_crypto_handle);
+
+  /* check if the writer is BuiltinParticipantVolatileMessageSecureWriter */
+  if (local_writer->is_builtin_participant_volatile_message_secure_writer)
+  {
+    participant_key_material *key_material;
+
+    key_material = (participant_key_material *)crypto_object_table_find(remote_participant->key_material, CRYPTO_OBJECT_HANDLE(local_writer->participant));
+    assert(key_material);
+
+    reader_crypto->reader2writer_key_material = (master_key_material *)CRYPTO_OBJECT_KEEP(key_material->P2P_kx_key_material);
+    reader_crypto->writer2reader_key_material_message = (master_key_material *)CRYPTO_OBJECT_KEEP(key_material->P2P_kx_key_material);
+    reader_crypto->writer_session = (session_key_material *)CRYPTO_OBJECT_KEEP(key_material->P2P_writer_session);
+    reader_crypto->is_builtin_participant_volatile_message_secure_reader = true;
+    CRYPTO_OBJECT_RELEASE(key_material);
+  }
+  else
+  {
+    if (local_writer->writer_key_material_message)
+    {
+      reader_crypto->writer2reader_key_material_message = crypto_master_key_material_new(CRYPTO_TRANSFORMATION_KIND_NONE);
+      crypto_master_key_material_set(reader_crypto->writer2reader_key_material_message, local_writer->writer_key_material_message);
+      if ((metadata_protectionKind == DDS_SECURITY_PROTECTION_KIND_ENCRYPT_WITH_ORIGIN_AUTHENTICATION) ||
+          (metadata_protectionKind == DDS_SECURITY_PROTECTION_KIND_SIGN_WITH_ORIGIN_AUTHENTICATION))
+      {
+        uint32_t key_bytes = CRYPTO_KEY_SIZE_BYTES(reader_crypto->writer2reader_key_material_message->transformation_kind);
+        if (RAND_bytes(reader_crypto->writer2reader_key_material_message->master_receiver_specific_key, (int)key_bytes) < 0)
+        {
+          DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_CANNOT_GENERATE_RANDOM_CODE, 0,
+              DDS_SECURITY_ERR_CANNOT_GENERATE_RANDOM_MESSAGE);
+          goto err_random_generation;
+        }
+        reader_crypto->writer2reader_key_material_message->receiver_specific_key_id = ddsrt_atomic_inc32_ov(&implementation->next_key_id);
+      }
+      reader_crypto->writer_session = (session_key_material *)CRYPTO_OBJECT_KEEP(local_writer->writer_session_message);
+    }
+
+    if (local_writer->writer_key_material_payload)
+    {
+      reader_crypto->writer2reader_key_material_payload = crypto_master_key_material_new(CRYPTO_TRANSFORMATION_KIND_NONE);
+      crypto_master_key_material_set(reader_crypto->writer2reader_key_material_payload, local_writer->writer_key_material_payload);
+    }
+  }
+
+  crypto_object_table_insert(implementation->crypto_objects, (CryptoObject *)reader_crypto);
+  CRYPTO_OBJECT_RELEASE(remote_participant);
+  CRYPTO_OBJECT_RELEASE(local_writer);
+  CRYPTO_OBJECT_RELEASE(reader_crypto);
+  return DATAREADER_CRYPTO_HANDLE(reader_crypto);
+
+err_random_generation:
+  CRYPTO_OBJECT_RELEASE(reader_crypto);
+  CRYPTO_OBJECT_RELEASE(remote_participant);
+  CRYPTO_OBJECT_RELEASE(local_writer);
+err_invalid_parameter:
+  return DDS_SECURITY_HANDLE_NIL;
+}
+
+static DDS_Security_DatareaderCryptoHandle
+register_local_datareader(
+    dds_security_crypto_key_factory *instance,
+    const DDS_Security_ParticipantCryptoHandle participant_crypto_handle,
+    const DDS_Security_PropertySeq *datareader_properties,
+    const DDS_Security_EndpointSecurityAttributes *datareader_security_attributes,
+    DDS_Security_SecurityException *ex)
+{
+  local_participant_crypto *participant_crypto;
+  local_datareader_crypto *reader_crypto;
+  bool is_builtin = false;
+  dds_security_crypto_key_factory_impl *implementation = (dds_security_crypto_key_factory_impl *)instance;
+  DDS_Security_ProtectionKind metadata_protection;
+  DDS_Security_BasicProtectionKind data_protection;
+
+  if (!instance || (participant_crypto_handle == DDS_SECURITY_HANDLE_NIL))
+  {
+    DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_CODE, 0,
+        DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_MESSAGE);
+    goto err_invalid_parameter;
+  }
+
+  participant_crypto = (local_participant_crypto *)crypto_object_table_find(implementation->crypto_objects, participant_crypto_handle);
+  if (!participant_crypto)
+  {
+    DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_CODE, 0,
+        DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_MESSAGE);
+    goto err_invalid_parameter;
+  }
+
+  if (datareader_properties != NULL && datareader_properties->_length > 0)
+  {
+    const DDS_Security_Property_t *property = DDS_Security_PropertySeq_find_property(
+        datareader_properties, "dds.sec.builtin_endpoint_name");
+    if (property != NULL && strcmp(property->value, "BuiltinParticipantVolatileMessageSecureReader") == 0)
+      is_builtin = true;
+  }
+
+  data_protection = attribute_to_data_protection_kind(datareader_security_attributes);
+  metadata_protection = attribute_to_meta_protection_kind(datareader_security_attributes);
+
+  reader_crypto = crypto_local_datareader_crypto__new(participant_crypto, metadata_protection, data_protection);
+  reader_crypto->is_builtin_participant_volatile_message_secure_reader = is_builtin;
+
+  if (!is_builtin)
+  {
+    if (reader_crypto->metadata_protectionKind != DDS_SECURITY_PROTECTION_KIND_NONE)
+    {
+      reader_crypto->reader_key_material = crypto_master_key_material_new(
+        DDS_Security_protectionkind2transformationkind(datareader_properties, metadata_protection));
+      if (generate_key(implementation, reader_crypto->reader_key_material, ex) != DDS_SECURITY_ERR_OK_CODE)
+        goto err_random_generation;
+      reader_crypto->reader_session = crypto_session_key_material_new(reader_crypto->reader_key_material);
+    }
+  }
+
+  crypto_object_table_insert(implementation->crypto_objects, (CryptoObject *)reader_crypto);
+  CRYPTO_OBJECT_RELEASE(participant_crypto);
+  CRYPTO_OBJECT_RELEASE(reader_crypto);
+  return DATAREADER_CRYPTO_HANDLE(reader_crypto);
+
+err_random_generation:
+  CRYPTO_OBJECT_RELEASE(participant_crypto);
+  CRYPTO_OBJECT_RELEASE(reader_crypto);
+err_invalid_parameter:
+  return DDS_SECURITY_HANDLE_NIL;
+}
+
+static DDS_Security_DatawriterCryptoHandle
+register_matched_remote_datawriter(
+    dds_security_crypto_key_factory *instance,
+    const DDS_Security_DatareaderCryptoHandle local_datareader_crypto_handle,
+    const DDS_Security_ParticipantCryptoHandle remote_participant_crypto_handle,
+    const DDS_Security_SharedSecretHandle shared_secret,
+    DDS_Security_SecurityException *ex)
+{
+  remote_datawriter_crypto *writer_crypto;
+  dds_security_crypto_key_factory_impl *implementation =
+      (dds_security_crypto_key_factory_impl *)instance;
+  local_datareader_crypto *local_reader;
+  remote_participant_crypto *remote_participant;
+
+  DDSRT_UNUSED_ARG(shared_secret);
+
+  if ((remote_participant_crypto_handle == DDS_SECURITY_HANDLE_NIL) ||
+      (local_datareader_crypto_handle == DDS_SECURITY_HANDLE_NIL))
+  {
+    DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_CODE, 0,
+        DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_MESSAGE);
+    goto err_invalid_parameter;
+  }
+
+  remote_participant = (remote_participant_crypto *)crypto_object_table_find(implementation->crypto_objects, remote_participant_crypto_handle);
+  if (!remote_participant)
+  {
+    DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_CODE, 0,
+        DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_MESSAGE);
+    goto err_invalid_parameter;
+  }
+
+  local_reader = (local_datareader_crypto *)crypto_object_table_find(implementation->crypto_objects, local_datareader_crypto_handle);
+  if (!local_reader)
+  {
+    CRYPTO_OBJECT_RELEASE(remote_participant);
+    DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_CODE, 0,
+        DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_MESSAGE);
+    goto err_invalid_parameter;
+  }
+
+  writer_crypto = crypto_remote_datawriter_crypto__new(remote_participant, local_reader->metadata_protectionKind,
+      local_reader->data_protectionKind, local_datareader_crypto_handle);
+
+  /* check if the writer is BuiltinParticipantVolatileMessageSecureWriter */
+  if (local_reader->is_builtin_participant_volatile_message_secure_reader)
+  {
+    participant_key_material *key_material;
+    endpoint_relation *relation;
+
+    key_material = (participant_key_material *)crypto_object_table_find(remote_participant->key_material, CRYPTO_OBJECT_HANDLE(local_reader->participant));
+    assert(key_material);
+
+    writer_crypto->reader2writer_key_material = (master_key_material *)CRYPTO_OBJECT_KEEP(key_material->P2P_kx_key_material);
+    writer_crypto->writer2reader_key_material[0] = (master_key_material *)CRYPTO_OBJECT_KEEP(key_material->P2P_kx_key_material);
+    writer_crypto->writer2reader_key_material[1] = (master_key_material *)CRYPTO_OBJECT_KEEP(key_material->P2P_kx_key_material);
+    writer_crypto->reader_session = (session_key_material *)CRYPTO_OBJECT_KEEP(key_material->P2P_reader_session);
+    writer_crypto->is_builtin_participant_volatile_message_secure_writer = true;
+
+    relation = crypto_endpoint_relation_new(DDS_SECURITY_DATAWRITER_SUBMESSAGE, 0, (CryptoObject *)local_reader, (CryptoObject *)writer_crypto);
+    crypto_object_table_insert(key_material->endpoint_relations, (CryptoObject *)relation);
+    CRYPTO_OBJECT_RELEASE(relation);
+    CRYPTO_OBJECT_RELEASE(key_material);
+  }
+  else if (local_reader->metadata_protectionKind != DDS_SECURITY_PROTECTION_KIND_NONE)
+  {
+    writer_crypto->reader2writer_key_material = crypto_master_key_material_new(CRYPTO_TRANSFORMATION_KIND_NONE);
+    crypto_master_key_material_set(writer_crypto->reader2writer_key_material, local_reader->reader_key_material);
+
+    if (local_reader->metadata_protectionKind == DDS_SECURITY_PROTECTION_KIND_ENCRYPT_WITH_ORIGIN_AUTHENTICATION
+        || local_reader->metadata_protectionKind == DDS_SECURITY_PROTECTION_KIND_SIGN_WITH_ORIGIN_AUTHENTICATION)
+    {
+      uint32_t key_bytes = CRYPTO_KEY_SIZE_BYTES(writer_crypto->reader2writer_key_material->transformation_kind);
+      if (RAND_bytes(writer_crypto->reader2writer_key_material->master_receiver_specific_key, (int)key_bytes) < 0)
+      {
+        DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT,
+                                   DDS_SECURITY_ERR_CANNOT_GENERATE_RANDOM_CODE, 0,
+                                   DDS_SECURITY_ERR_CANNOT_GENERATE_RANDOM_MESSAGE);
+        goto err_random_generation;
+      }
+      writer_crypto->reader2writer_key_material->receiver_specific_key_id = ddsrt_atomic_inc32_ov(&implementation->next_key_id);
+      writer_crypto->reader_session = (session_key_material *)CRYPTO_OBJECT_KEEP(local_reader->reader_session);
+    }
+  }
+  crypto_object_table_insert(implementation->crypto_objects, (CryptoObject *)writer_crypto);
+  CRYPTO_OBJECT_RELEASE(remote_participant);
+  CRYPTO_OBJECT_RELEASE(local_reader);
+  CRYPTO_OBJECT_RELEASE(writer_crypto);
+  return DATAREADER_CRYPTO_HANDLE(writer_crypto);
+
+err_random_generation:
+  CRYPTO_OBJECT_RELEASE(writer_crypto);
+  CRYPTO_OBJECT_RELEASE(remote_participant);
+  CRYPTO_OBJECT_RELEASE(local_reader);
+err_invalid_parameter:
+  return DDS_SECURITY_HANDLE_NIL;
+}
+
+static DDS_Security_boolean
+unregister_participant(
+    dds_security_crypto_key_factory *instance,
+    const DDS_Security_ParticipantCryptoHandle participant_crypto_handle,
+    DDS_Security_SecurityException *ex)
+{
+  DDS_Security_boolean result = false;
+  CryptoObject *obj;
+  dds_security_crypto_key_factory_impl *implementation = (dds_security_crypto_key_factory_impl *)instance;
+
+  if ((obj = crypto_object_table_find(implementation->crypto_objects, participant_crypto_handle)) != NULL)
+  {
+    if ((obj->kind == CRYPTO_OBJECT_KIND_LOCAL_CRYPTO) || (obj->kind == CRYPTO_OBJECT_KIND_REMOTE_CRYPTO))
+    {
+      crypto_object_table_remove_object(implementation->crypto_objects, obj);
+      result = true;
+    }
+    else
+    {
+      DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_CODE, 0,
+          DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_MESSAGE);
+    }
+    CRYPTO_OBJECT_RELEASE(obj);
+  }
+  else
+  {
+    DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_CODE, 0,
+        DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_MESSAGE);
+  }
+
+  return result;
+}
+
+static DDS_Security_boolean
+unregister_datawriter(
+    dds_security_crypto_key_factory *instance,
+    const DDS_Security_DatawriterCryptoHandle datawriter_crypto_handle,
+    DDS_Security_SecurityException *ex)
+{
+  dds_security_crypto_key_factory_impl *implementation = (dds_security_crypto_key_factory_impl *)instance;
+  DDS_Security_boolean result = false;
+  CryptoObject *obj;
+
+  /* check if the handle is applicable*/
+  if ((obj = crypto_object_table_find(implementation->crypto_objects, datawriter_crypto_handle)) != NULL)
+  {
+    if ((obj->kind == CRYPTO_OBJECT_KIND_LOCAL_WRITER_CRYPTO) || (obj->kind == CRYPTO_OBJECT_KIND_REMOTE_WRITER_CRYPTO))
+    {
+      if (obj->kind == CRYPTO_OBJECT_KIND_REMOTE_WRITER_CRYPTO)
+        remove_remote_writer_relation(implementation, (remote_datawriter_crypto *)obj);
+      crypto_object_table_remove_object(implementation->crypto_objects, obj);
+      result = true;
+    }
+    else
+    {
+      DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_CODE, 0,
+          DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_MESSAGE);
+    }
+    CRYPTO_OBJECT_RELEASE(obj);
+  }
+  else
+  {
+    DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_CODE, 0,
+        DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_MESSAGE);
+  }
+
+  return result;
+}
+
+static DDS_Security_boolean
+unregister_datareader(
+    dds_security_crypto_key_factory *instance,
+    const DDS_Security_DatareaderCryptoHandle datareader_crypto_handle,
+    DDS_Security_SecurityException *ex)
+{
+  dds_security_crypto_key_factory_impl *implementation = (dds_security_crypto_key_factory_impl *)instance;
+  DDS_Security_boolean result = false;
+  CryptoObject *obj;
+
+  /* check if the handle is applicable*/
+  if ((obj = crypto_object_table_find(implementation->crypto_objects, datareader_crypto_handle)) != NULL)
+  {
+    if ((obj->kind == CRYPTO_OBJECT_KIND_LOCAL_READER_CRYPTO) || (obj->kind == CRYPTO_OBJECT_KIND_REMOTE_READER_CRYPTO))
+    {
+      if (obj->kind == CRYPTO_OBJECT_KIND_REMOTE_READER_CRYPTO)
+        remove_remote_reader_relation(implementation, (remote_datareader_crypto *)obj);
+      crypto_object_table_remove_object(implementation->crypto_objects, obj);
+      result = true;
+    }
+    else
+    {
+      DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_CODE, 0,
+          DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_MESSAGE);
+    }
+    CRYPTO_OBJECT_RELEASE(obj);
+  }
+  else
+  {
+    DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_CODE, 0,
+        DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_MESSAGE);
+  }
+
+  return result;
+}
+
+dds_security_crypto_key_factory *
+dds_security_crypto_key_factory__alloc(
+    const dds_security_cryptography *crypto)
+{
+  dds_security_crypto_key_factory_impl *instance = ddsrt_malloc(sizeof(*instance));
+
+  ddsrt_mutex_init(&instance->lock);
+
+  instance->crypto = crypto;
+  instance->base.register_local_participant = &register_local_participant;
+  instance->base.register_matched_remote_participant = &register_matched_remote_participant;
+  instance->base.register_local_datawriter = &register_local_datawriter;
+  instance->base.register_matched_remote_datareader = &register_matched_remote_datareader;
+  instance->base.register_local_datareader = &register_local_datareader;
+  instance->base.register_matched_remote_datawriter = &register_matched_remote_datawriter;
+  instance->base.unregister_participant = &unregister_participant;
+  instance->base.unregister_datawriter = &unregister_datawriter;
+  instance->base.unregister_datareader = &unregister_datareader;
+
+  /* init implementation specific members */
+  instance->crypto_objects = crypto_object_table_new(NULL, NULL, NULL);
+
+  ddsrt_atomic_st32 (&instance->next_key_id, 1);
+
+  return (dds_security_crypto_key_factory *)instance;
+}
+
+void dds_security_crypto_key_factory__dealloc(dds_security_crypto_key_factory *instance)
+{
+  dds_security_crypto_key_factory_impl *implementation = (dds_security_crypto_key_factory_impl *)instance;
+  ddsrt_mutex_destroy (&implementation->lock);
+  crypto_object_table_free(implementation->crypto_objects);
+  ddsrt_free(implementation);
+}
+
+bool
+crypto_factory_get_participant_crypto_tokens(
+    const dds_security_crypto_key_factory *factory,
+    DDS_Security_ParticipantCryptoHandle local_id,
+    DDS_Security_ParticipantCryptoHandle remote_id,
+    participant_key_material **pp_key_material,
+    DDS_Security_ProtectionKind *protection_kind,
+
+    DDS_Security_SecurityException *ex)
+{
+  assert (pp_key_material != NULL);
+  dds_security_crypto_key_factory_impl *impl = (dds_security_crypto_key_factory_impl *)factory;
+  remote_participant_crypto *remote_crypto = (remote_participant_crypto *)crypto_object_table_find(impl->crypto_objects, remote_id);
+  bool result = false;
+  if (!remote_crypto)
+  {
+    DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_CODE, 0,
+        DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_MESSAGE);
+    goto err_no_remote;
+  }
+  else if (!CRYPTO_OBJECT_VALID(remote_crypto, CRYPTO_OBJECT_KIND_REMOTE_CRYPTO))
+  {
+    DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_CODE, 0,
+        DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_MESSAGE);
+    goto err_remote;
+  }
+
+  if (!(*pp_key_material = (participant_key_material *)crypto_object_table_find(remote_crypto->key_material, local_id)))
+  {
+    DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_CODE, 0,
+        DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_MESSAGE);
+    goto err_remote;
+  }
+  if (protection_kind != NULL)
+    *protection_kind = remote_crypto->rtps_protection_kind;
+  result = true;
+
+err_remote:
+  CRYPTO_OBJECT_RELEASE(remote_crypto);
+err_no_remote:
+  return result;
+}
+
+bool
+crypto_factory_set_participant_crypto_tokens(
+    const dds_security_crypto_key_factory *factory,
+    const DDS_Security_ParticipantCryptoHandle local_id,
+    const DDS_Security_ParticipantCryptoHandle remote_id,
+    const DDS_Security_KeyMaterial_AES_GCM_GMAC *remote_key_mat,
+    DDS_Security_SecurityException *ex)
+{
+  dds_security_crypto_key_factory_impl *impl = (dds_security_crypto_key_factory_impl *)factory;
+  remote_participant_crypto *remote_crypto;
+  participant_key_material *key_material;
+  bool result = false;
+
+  remote_crypto = (remote_participant_crypto *)crypto_object_table_find(impl->crypto_objects, remote_id);
+  if (!remote_crypto)
+  {
+    DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_CODE, 0,
+        DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_MESSAGE);
+    goto err_no_remote;
+  }
+  else if (!CRYPTO_OBJECT_VALID(remote_crypto, CRYPTO_OBJECT_KIND_REMOTE_CRYPTO))
+  {
+    DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_CODE, 0,
+        DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_MESSAGE);
+    goto err_inv_remote;
+  }
+
+  key_material = (participant_key_material *)crypto_object_table_find(remote_crypto->key_material, local_id);
+  if (key_material)
+  {
+    if (!key_material->remote_key_material)
+      key_material->remote_key_material = crypto_master_key_material_new(CRYPTO_TRANSFORMATION_KIND_NONE);
+    crypto_token_copy(key_material->remote_key_material, remote_key_mat);
+    CRYPTO_OBJECT_RELEASE(key_material);
+  }
+  else
+  {
+    DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_CODE, 0,
+        DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_MESSAGE);
+    goto err_inv_remote;
+  }
+  result = true;
+
+err_inv_remote:
+  CRYPTO_OBJECT_RELEASE(remote_crypto);
+err_no_remote:
+  return result;
+}
+
+bool
+crypto_factory_get_datawriter_crypto_tokens(
+    const dds_security_crypto_key_factory *factory,
+    DDS_Security_DatawriterCryptoHandle local_writer_handle,
+    DDS_Security_DatareaderCryptoHandle remote_reader_handle,
+    master_key_material **key_mat,
+    uint32_t *num_key_mat,
+    DDS_Security_SecurityException *ex)
+{
+  dds_security_crypto_key_factory_impl *impl = (dds_security_crypto_key_factory_impl *)factory;
+  remote_datareader_crypto *remote_reader_crypto;
+  uint32_t index = 0;
+  bool result = false;
+
+  assert(factory);
+  assert(local_writer_handle != DDS_SECURITY_HANDLE_NIL);
+  assert(remote_reader_handle != DDS_SECURITY_HANDLE_NIL);
+  assert(key_mat);
+  assert(num_key_mat);
+  assert((*num_key_mat) == 2);
+
+  remote_reader_crypto = (remote_datareader_crypto *)crypto_object_table_find(impl->crypto_objects, remote_reader_handle);
+  if (!remote_reader_crypto)
+  {
+    DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_CODE, 0,
+        DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_MESSAGE);
+    goto err_no_remote;
+  }
+  else if (!CRYPTO_OBJECT_VALID(remote_reader_crypto, CRYPTO_OBJECT_KIND_REMOTE_READER_CRYPTO))
+  {
+    DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_CODE, 0,
+        DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_MESSAGE);
+    goto err_inv_remote;
+  }
+
+  if (remote_reader_crypto->local_writer_handle != local_writer_handle)
+  {
+    DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_CODE, 0,
+        DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_MESSAGE);
+    goto err_inv_remote;
+  }
+
+  if (remote_reader_crypto->writer2reader_key_material_message)
+    key_mat[index++] = (master_key_material *)CRYPTO_OBJECT_KEEP(remote_reader_crypto->writer2reader_key_material_message);
+
+  if (remote_reader_crypto->writer2reader_key_material_payload)
+    key_mat[index++] = (master_key_material *)CRYPTO_OBJECT_KEEP(remote_reader_crypto->writer2reader_key_material_payload);
+
+  *num_key_mat = index;
+  result = true;
+
+err_inv_remote:
+  CRYPTO_OBJECT_RELEASE(remote_reader_crypto);
+err_no_remote:
+  return result;
+}
+
+bool
+crypto_factory_set_datawriter_crypto_tokens(
+    const dds_security_crypto_key_factory *factory,
+    const DDS_Security_DatawriterCryptoHandle local_reader_handle,
+    const DDS_Security_DatareaderCryptoHandle remote_writer_handle,
+    const DDS_Security_KeyMaterial_AES_GCM_GMAC *key_mat,
+    const uint32_t num_key_mat,
+    DDS_Security_SecurityException *ex)
+{
+  dds_security_crypto_key_factory_impl *impl = (dds_security_crypto_key_factory_impl *)factory;
+  bool result = false;
+  remote_datawriter_crypto *remote_writer_crypto;
+  local_datareader_crypto *local_reader_crypto;
+  master_key_material *writer_master_key[2] = {NULL, NULL};
+  participant_key_material *keys;
+  endpoint_relation *relation;
+  uint32_t key_id, i;
+
+  remote_writer_crypto = (remote_datawriter_crypto *)crypto_object_table_find(impl->crypto_objects, remote_writer_handle);
+  if (!remote_writer_crypto)
+  {
+    DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_CODE, 0,
+        DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_MESSAGE);
+    goto err_no_remote;
+  }
+  else if (!CRYPTO_OBJECT_VALID(remote_writer_crypto, CRYPTO_OBJECT_KIND_REMOTE_WRITER_CRYPTO))
+  {
+    DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_CODE, 0,
+        DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_MESSAGE);
+    goto err_inv_remote;
+  }
+
+  local_reader_crypto = (local_datareader_crypto *)crypto_object_table_find(impl->crypto_objects, local_reader_handle);
+  if (!local_reader_crypto)
+  {
+    DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_CODE, 0,
+        DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_MESSAGE);
+    goto err_inv_local;
+  }
+  else if (!CRYPTO_OBJECT_VALID(local_reader_crypto, CRYPTO_OBJECT_KIND_LOCAL_READER_CRYPTO))
+  {
+    DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_CODE, 0,
+        DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_MESSAGE);
+    goto err_inv_local;
+  }
+
+  if (remote_writer_crypto->local_reader_handle != local_reader_handle)
+  {
+    DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_CODE, 0,
+        DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_MESSAGE);
+    goto err_inv_local;
+  }
+
+  for (i = 0; i < num_key_mat; i++)
+  {
+    writer_master_key[i] = crypto_master_key_material_new(CRYPTO_TRANSFORMATION_KIND_NONE);
+    crypto_token_copy(writer_master_key[i], &key_mat[i]);
+  }
+
+  remove_remote_writer_relation(impl, remote_writer_crypto);
+  CRYPTO_OBJECT_RELEASE(remote_writer_crypto->writer2reader_key_material[0]);
+  CRYPTO_OBJECT_RELEASE(remote_writer_crypto->writer2reader_key_material[1]);
+
+  remote_writer_crypto->writer2reader_key_material[0] = writer_master_key[0];
+  if (writer_master_key[1])
+    remote_writer_crypto->writer2reader_key_material[1] = writer_master_key[1];
+  else
+    remote_writer_crypto->writer2reader_key_material[1] = (master_key_material *)CRYPTO_OBJECT_KEEP(writer_master_key[0]);
+
+  keys = (participant_key_material *)crypto_object_table_find(
+      remote_writer_crypto->participant->key_material, CRYPTO_OBJECT_HANDLE(local_reader_crypto->participant));
+  assert(keys);
+
+  key_id = remote_writer_crypto->writer2reader_key_material[0]->sender_key_id;
+
+  relation = crypto_endpoint_relation_new(DDS_SECURITY_DATAWRITER_SUBMESSAGE, key_id, (CryptoObject *)local_reader_crypto, (CryptoObject *)remote_writer_crypto);
+  crypto_object_table_insert(keys->endpoint_relations, (CryptoObject *)relation);
+  CRYPTO_OBJECT_RELEASE(relation);
+  CRYPTO_OBJECT_RELEASE(keys);
+  result = true;
+
+err_inv_local:
+  CRYPTO_OBJECT_RELEASE(local_reader_crypto);
+err_inv_remote:
+  CRYPTO_OBJECT_RELEASE(remote_writer_crypto);
+err_no_remote:
+  return result;
+}
+
+bool
+crypto_factory_get_datareader_crypto_tokens(
+    const dds_security_crypto_key_factory *factory,
+    DDS_Security_DatawriterCryptoHandle local_reader_handle,
+    DDS_Security_DatareaderCryptoHandle remote_writer_handle,
+    master_key_material **key_mat,
+    DDS_Security_SecurityException *ex)
+{
+  dds_security_crypto_key_factory_impl *impl = (dds_security_crypto_key_factory_impl *)factory;
+  remote_datawriter_crypto *remote_writer_crypto;
+  bool result = false;
+
+  assert(factory);
+  assert(local_reader_handle != DDS_SECURITY_HANDLE_NIL);
+  assert(remote_writer_handle != DDS_SECURITY_HANDLE_NIL);
+  assert(key_mat);
+
+  remote_writer_crypto = (remote_datawriter_crypto *)crypto_object_table_find(impl->crypto_objects, remote_writer_handle);
+  if (!remote_writer_crypto)
+  {
+    DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_CODE, 0,
+        DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_MESSAGE);
+    goto err_no_remote;
+  }
+  else if (!CRYPTO_OBJECT_VALID(remote_writer_crypto, CRYPTO_OBJECT_KIND_REMOTE_WRITER_CRYPTO))
+  {
+    DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_CODE, 0,
+        DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_MESSAGE);
+    goto err_inv_remote;
+  }
+
+  if (remote_writer_crypto->local_reader_handle != local_reader_handle)
+  {
+    DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_CODE, 0,
+        DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_MESSAGE);
+    goto err_inv_remote;
+  }
+
+  if (remote_writer_crypto->reader2writer_key_material)
+    *key_mat = (master_key_material *)CRYPTO_OBJECT_KEEP(remote_writer_crypto->reader2writer_key_material);
+  else
+    *key_mat = NULL; /* there is no key material to return, because of no encryption for submessages in AccessControl */
+  result = true;
+
+err_inv_remote:
+  CRYPTO_OBJECT_RELEASE(remote_writer_crypto);
+err_no_remote:
+  return result;
+}
+
+bool
+crypto_factory_set_datareader_crypto_tokens(
+    const dds_security_crypto_key_factory *factory,
+    const DDS_Security_DatawriterCryptoHandle local_writer_handle,
+    const DDS_Security_DatareaderCryptoHandle remote_reader_handle,
+    const DDS_Security_KeyMaterial_AES_GCM_GMAC *key_mat,
+    DDS_Security_SecurityException *ex)
+{
+  dds_security_crypto_key_factory_impl *impl = (dds_security_crypto_key_factory_impl *)factory;
+  bool result = false;
+  remote_datareader_crypto *remote_reader_crypto;
+  local_datawriter_crypto *local_writer_crypto;
+  participant_key_material *keys;
+  endpoint_relation *relation;
+  uint32_t key_id;
+
+  remote_reader_crypto = (remote_datareader_crypto *)crypto_object_table_find(impl->crypto_objects, remote_reader_handle);
+  if (!remote_reader_crypto)
+  {
+    DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_CODE, 0,
+        DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_MESSAGE);
+    goto err_inv_remote;
+  }
+  else if (!CRYPTO_OBJECT_VALID(remote_reader_crypto, CRYPTO_OBJECT_KIND_REMOTE_READER_CRYPTO))
+  {
+    DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_CODE, 0,
+        DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_MESSAGE);
+    goto err_inv_remote;
+  }
+
+  local_writer_crypto = (local_datawriter_crypto *)crypto_object_table_find(impl->crypto_objects, local_writer_handle);
+  if (!local_writer_crypto)
+  {
+    DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_CODE, 0,
+        DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_MESSAGE);
+    goto err_inv_local;
+  }
+  else if (!CRYPTO_OBJECT_VALID(local_writer_crypto, CRYPTO_OBJECT_KIND_LOCAL_WRITER_CRYPTO))
+  {
+    DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_CODE, 0,
+        DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_MESSAGE);
+    goto err_inv_local;
+  }
+
+  if (remote_reader_crypto->local_writer_handle != local_writer_handle)
+  {
+    DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_CODE, 0,
+        DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_MESSAGE);
+    goto err_inv_local;
+  }
+
+  remove_remote_reader_relation(impl, remote_reader_crypto);
+  CRYPTO_OBJECT_RELEASE(remote_reader_crypto->reader2writer_key_material);
+
+  remote_reader_crypto->reader2writer_key_material = crypto_master_key_material_new(CRYPTO_TRANSFORMATION_KIND_NONE);
+  crypto_token_copy(remote_reader_crypto->reader2writer_key_material, key_mat);
+
+  keys = (participant_key_material *)crypto_object_table_find(
+      remote_reader_crypto->participant->key_material, CRYPTO_OBJECT_HANDLE(local_writer_crypto->participant));
+  assert(keys);
+
+  key_id = remote_reader_crypto->reader2writer_key_material->sender_key_id;
+
+  relation = crypto_endpoint_relation_new(DDS_SECURITY_DATAREADER_SUBMESSAGE, key_id, (CryptoObject *)local_writer_crypto, (CryptoObject *)remote_reader_crypto);
+  crypto_object_table_insert(keys->endpoint_relations, (CryptoObject *)relation);
+  CRYPTO_OBJECT_RELEASE(relation);
+  CRYPTO_OBJECT_RELEASE(keys);
+  result = true;
+
+err_inv_local:
+  CRYPTO_OBJECT_RELEASE(local_writer_crypto);
+err_inv_remote:
+  CRYPTO_OBJECT_RELEASE(remote_reader_crypto);
+
+  return result;
+}
+
+static bool
+get_local_volatile_sec_writer_key_material(
+    dds_security_crypto_key_factory_impl *factory,
+    const DDS_Security_DatareaderCryptoHandle reader_id,
+    session_key_material **session_key,
+    DDS_Security_ProtectionKind *protection_kind,
+    DDS_Security_SecurityException *ex)
+{
+  bool result = false;
+  remote_datareader_crypto *reader_crypto;
+
+  reader_crypto = (remote_datareader_crypto *)crypto_object_table_find(factory->crypto_objects, reader_id);
+  if (!reader_crypto)
+  {
+    DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_CODE, 0,
+        DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_MESSAGE " %"PRIx64, reader_id);
+    goto err_no_crypto;
+  }
+  else if (!CRYPTO_OBJECT_VALID(reader_crypto, CRYPTO_OBJECT_KIND_REMOTE_READER_CRYPTO))
+  {
+    DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_CODE, 0,
+        DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_MESSAGE);
+    goto err_inv_crypto;
+  }
+
+  *session_key = (session_key_material *)CRYPTO_OBJECT_KEEP(reader_crypto->writer_session);
+  *protection_kind = reader_crypto->metadata_protectionKind;
+  result = true;
+
+err_inv_crypto:
+  CRYPTO_OBJECT_RELEASE(reader_crypto);
+err_no_crypto:
+  return result;
+}
+
+static bool
+get_local_volatile_sec_reader_key_material(
+    dds_security_crypto_key_factory_impl *factory,
+    const DDS_Security_DatawriterCryptoHandle writer_id,
+    session_key_material **session_key,
+    DDS_Security_ProtectionKind *protection_kind,
+    DDS_Security_SecurityException *ex)
+{
+  bool result = false;
+  remote_datawriter_crypto *writer_crypto;
+
+  writer_crypto = (remote_datawriter_crypto *)crypto_object_table_find(factory->crypto_objects, writer_id);
+  if (!writer_crypto)
+  {
+    DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_CODE, 0,
+        DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_MESSAGE);
+    goto err_no_crypto;
+  }
+  else if (!CRYPTO_OBJECT_VALID(writer_crypto, CRYPTO_OBJECT_KIND_REMOTE_WRITER_CRYPTO))
+  {
+    DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_CODE, 0,
+        DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_MESSAGE " %"PRIx64, writer_id);
+    goto err_inv_crypto;
+  }
+
+  *session_key = (session_key_material *)CRYPTO_OBJECT_KEEP(writer_crypto->reader_session);
+  *protection_kind = writer_crypto->metadata_protectionKind;
+  result = true;
+
+err_inv_crypto:
+  CRYPTO_OBJECT_RELEASE(writer_crypto);
+err_no_crypto:
+  return result;
+}
+
+bool
+crypto_factory_get_local_participant_data_key_material(
+    const dds_security_crypto_key_factory *factory,
+    const DDS_Security_ParticipantCryptoHandle local_id,
+    session_key_material **session_key,
+    DDS_Security_ProtectionKind *protection_kind,
+    DDS_Security_SecurityException *ex)
+{
+  dds_security_crypto_key_factory_impl *impl = (dds_security_crypto_key_factory_impl *)factory;
+  local_participant_crypto *participant_crypto;
+  bool result = false;
+
+  participant_crypto = (local_participant_crypto *)crypto_object_table_find(impl->crypto_objects, local_id);
+  if (!(participant_crypto))
+  {
+    DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_CODE, 0,
+        DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_MESSAGE);
+    goto err_no_crypto;
+  }
+  else if (!CRYPTO_OBJECT_VALID(participant_crypto, CRYPTO_OBJECT_KIND_LOCAL_CRYPTO))
+  {
+    DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_CODE, 0,
+        DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_MESSAGE);
+    goto err_inv_crypto;
+  }
+
+  *session_key = (session_key_material *)CRYPTO_OBJECT_KEEP(participant_crypto->session);
+  *protection_kind = participant_crypto->rtps_protection_kind;
+  result = true;
+
+err_inv_crypto:
+  CRYPTO_OBJECT_RELEASE(CRYPTO_OBJECT(participant_crypto));
+err_no_crypto:
+  return result;
+}
+
+bool
+crypto_factory_get_writer_key_material(
+    const dds_security_crypto_key_factory *factory,
+    const DDS_Security_DatawriterCryptoHandle writer_id,
+    const DDS_Security_DatareaderCryptoHandle reader_id,
+    bool payload,
+    session_key_material **session_key,
+    DDS_Security_ProtectionKind *protection_kind,
+    DDS_Security_SecurityException *ex)
+{
+  dds_security_crypto_key_factory_impl *impl = (dds_security_crypto_key_factory_impl *)factory;
+  local_datawriter_crypto *writer_crypto = NULL;
+  bool result = false;
+
+  writer_crypto = (local_datawriter_crypto *)crypto_object_table_find(impl->crypto_objects, writer_id);
+  if (!writer_crypto)
+  {
+    DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_CODE, 0,
+        DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_MESSAGE " %"PRIx64, writer_id);
+    goto err_remote;
+  }
+  if (!CRYPTO_OBJECT_VALID(writer_crypto, CRYPTO_OBJECT_KIND_LOCAL_WRITER_CRYPTO))
+  {
+    DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_CODE, 0,
+        DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_MESSAGE);
+    goto err_inv_remote;
+  }
+  if (!writer_crypto->is_builtin_participant_volatile_message_secure_writer)
+  {
+    if (payload)
+      *session_key = (session_key_material *)CRYPTO_OBJECT_KEEP(writer_crypto->writer_session_payload);
+    else
+      *session_key = (session_key_material *)CRYPTO_OBJECT_KEEP(writer_crypto->writer_session_message);
+
+    if (protection_kind)
+      *protection_kind = writer_crypto->metadata_protectionKind;
+    result = true;
+  }
+  else if (!payload)
+  {
+    result = get_local_volatile_sec_writer_key_material(impl, reader_id, session_key, protection_kind, ex);
+  }
+  else
+  {
+    DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_CODE, 0,
+        DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_MESSAGE);
+  }
+
+err_inv_remote:
+  CRYPTO_OBJECT_RELEASE(writer_crypto);
+err_remote:
+  return result;
+}
+
+bool
+crypto_factory_get_reader_key_material(
+    const dds_security_crypto_key_factory *factory,
+    const DDS_Security_DatareaderCryptoHandle reader_id,
+    const DDS_Security_DatawriterCryptoHandle writer_id,
+    session_key_material **session_key,
+    DDS_Security_ProtectionKind *protection_kind,
+    DDS_Security_SecurityException *ex)
+{
+  dds_security_crypto_key_factory_impl *impl = (dds_security_crypto_key_factory_impl *)factory;
+  local_datareader_crypto *reader_crypto;
+  bool result = false;
+
+  reader_crypto = (local_datareader_crypto *)crypto_object_table_find(impl->crypto_objects, reader_id);
+  if (!reader_crypto)
+  {
+    DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_CODE, 0,
+        DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_MESSAGE " %"PRIx64, reader_id);
+    goto err_no_crypto;
+  }
+  else if (!CRYPTO_OBJECT_VALID(reader_crypto, CRYPTO_OBJECT_KIND_LOCAL_READER_CRYPTO))
+  {
+    DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_CODE, 0,
+        DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_MESSAGE);
+    goto err_inv_crypto;
+  }
+  else if (!reader_crypto->is_builtin_participant_volatile_message_secure_reader)
+  {
+    *session_key = (session_key_material *)CRYPTO_OBJECT_KEEP(reader_crypto->reader_session);
+    if (protection_kind)
+      *protection_kind = reader_crypto->metadata_protectionKind;
+    result = true;
+  }
+  else
+  {
+    result = get_local_volatile_sec_reader_key_material(impl, writer_id, session_key, protection_kind, ex);
+  }
+
+err_inv_crypto:
+  CRYPTO_OBJECT_RELEASE(reader_crypto);
+err_no_crypto:
+  return result;
+}
+
+bool
+crypto_factory_get_remote_writer_key_material(
+    const dds_security_crypto_key_factory *factory,
+    const DDS_Security_DatareaderCryptoHandle reader_id,
+    const DDS_Security_DatawriterCryptoHandle writer_id,
+    uint32_t key_id,
+    master_key_material **master_key,
+    DDS_Security_ProtectionKind *protection_kind,
+    DDS_Security_BasicProtectionKind *basic_protection_kind,
+    DDS_Security_SecurityException *ex)
+{
+  dds_security_crypto_key_factory_impl *impl = (dds_security_crypto_key_factory_impl *)factory;
+  remote_datawriter_crypto *writer_crypto;
+  bool result = false;
+
+  writer_crypto = (remote_datawriter_crypto *)crypto_object_table_find(impl->crypto_objects, writer_id);
+  if (!writer_crypto)
+  {
+    DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_CODE, 0,
+        DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_MESSAGE);
+    goto err_no_crypto;
+  }
+  if (!CRYPTO_OBJECT_VALID(writer_crypto, CRYPTO_OBJECT_KIND_REMOTE_WRITER_CRYPTO))
+  {
+    DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_CODE, 0,
+        DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_MESSAGE);
+    goto err_inv_crypto;
+  }
+  if (writer_crypto->local_reader_handle != reader_id)
+  {
+    DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_CODE, 0,
+        DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_MESSAGE);
+    goto err_inv_crypto;
+  }
+
+  if (writer_crypto->writer2reader_key_material[0]->sender_key_id == key_id)
+  {
+    *master_key = (master_key_material *)CRYPTO_OBJECT_KEEP(writer_crypto->writer2reader_key_material[0]);
+  }
+  else if (writer_crypto->writer2reader_key_material[1]->sender_key_id == key_id)
+  {
+    *master_key = (master_key_material *)CRYPTO_OBJECT_KEEP(writer_crypto->writer2reader_key_material[1]);
+  }
+  else
+  {
+    DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT,
+                                DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_CODE, 0,
+                                DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_MESSAGE);
+    goto err_inv_crypto;
+  }
+  if (protection_kind)
+    *protection_kind = writer_crypto->metadata_protectionKind;
+  if (basic_protection_kind)
+    *basic_protection_kind = writer_crypto->data_protectionKind;
+  result = true;
+
+err_inv_crypto:
+  CRYPTO_OBJECT_RELEASE(writer_crypto);
+err_no_crypto:
+  return result;
+}
+
+bool
+crypto_factory_get_remote_reader_key_material(
+    const dds_security_crypto_key_factory *factory,
+    const DDS_Security_DatawriterCryptoHandle writer_id,
+    const DDS_Security_DatareaderCryptoHandle reader_id,
+    uint32_t key_id,
+    master_key_material **master_key,
+    DDS_Security_ProtectionKind *protection_kind,
+    DDS_Security_SecurityException *ex)
+{
+  dds_security_crypto_key_factory_impl *impl = (dds_security_crypto_key_factory_impl *)factory;
+  remote_datareader_crypto *reader_crypto;
+  bool result = false;
+
+  reader_crypto = (remote_datareader_crypto *)crypto_object_table_find(impl->crypto_objects, reader_id);
+  if (!reader_crypto)
+  {
+    DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT,
+                               DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_CODE, 0,
+                               DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_MESSAGE);
+    goto err_no_crypto;
+  }
+  if (!CRYPTO_OBJECT_VALID(reader_crypto, CRYPTO_OBJECT_KIND_REMOTE_READER_CRYPTO))
+  {
+    CRYPTO_OBJECT_RELEASE(reader_crypto);
+    DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT,
+                               DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_CODE, 0,
+                               DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_MESSAGE);
+    goto err_inv_crypto;
+  }
+  if (reader_crypto->local_writer_handle != writer_id)
+  {
+    DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT,
+                               DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_CODE, 0,
+                               DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_MESSAGE);
+    goto err_inv_crypto;
+  }
+  if (reader_crypto->reader2writer_key_material->sender_key_id == key_id)
+  {
+    *master_key = (master_key_material *)CRYPTO_OBJECT_KEEP(reader_crypto->reader2writer_key_material);
+  }
+  else
+  {
+    DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT,
+                                DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_CODE, 0,
+                                DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_MESSAGE);
+    goto err_inv_crypto;
+  }
+  if (protection_kind)
+    *protection_kind = reader_crypto->metadata_protectionKind;
+  result = true;
+
+err_inv_crypto:
+  CRYPTO_OBJECT_RELEASE(reader_crypto);
+err_no_crypto:
+  return result;
+}
+
+bool
+crypto_factory_get_remote_writer_sign_key_material(
+    const dds_security_crypto_key_factory *factory,
+    const DDS_Security_DatareaderCryptoHandle writer_id,
+    master_key_material **key_material,
+    session_key_material **session_key,
+    DDS_Security_ProtectionKind *protection_kind,
+    DDS_Security_SecurityException *ex)
+{
+  dds_security_crypto_key_factory_impl *impl = (dds_security_crypto_key_factory_impl *)factory;
+  remote_datawriter_crypto *writer_crypto;
+  bool result = false;
+
+  assert(key_material);
+  assert(session_key);
+  assert(protection_kind);
+
+  writer_crypto = (remote_datawriter_crypto *)crypto_object_table_find(impl->crypto_objects, writer_id);
+  if (!writer_crypto)
+  {
+    DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT,
+                               DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_CODE, 0,
+                               DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_MESSAGE);
+    goto err_no_crypto;
+  }
+  else if (!CRYPTO_OBJECT_VALID(writer_crypto, CRYPTO_OBJECT_KIND_REMOTE_WRITER_CRYPTO))
+  {
+    DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT,
+                               DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_CODE, 0,
+                               DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_MESSAGE);
+    goto err_inv_crypto;
+  }
+
+  *key_material = (master_key_material *)CRYPTO_OBJECT_KEEP(writer_crypto->reader2writer_key_material);
+  *session_key = (session_key_material *)CRYPTO_OBJECT_KEEP(writer_crypto->reader_session);
+  *protection_kind = writer_crypto->metadata_protectionKind;
+  result = true;
+
+err_inv_crypto:
+  CRYPTO_OBJECT_RELEASE(writer_crypto);
+err_no_crypto:
+  return result;
+}
+
+bool
+crypto_factory_get_remote_reader_sign_key_material(
+    const dds_security_crypto_key_factory *factory,
+    const DDS_Security_DatareaderCryptoHandle reader_id,
+    master_key_material **key_material,
+    session_key_material **session_key,
+    DDS_Security_ProtectionKind *protection_kind,
+    DDS_Security_SecurityException *ex)
+{
+  dds_security_crypto_key_factory_impl *impl = (dds_security_crypto_key_factory_impl *)factory;
+  remote_datareader_crypto *reader_crypto;
+  bool result = false;
+
+  assert(key_material);
+  assert(session_key);
+  assert(protection_kind);
+
+  reader_crypto = (remote_datareader_crypto *)crypto_object_table_find(impl->crypto_objects, reader_id);
+  if (!reader_crypto)
+  {
+    DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT,
+                               DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_CODE, 0,
+                               DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_MESSAGE);
+    goto err_no_crypto;
+  }
+  else if (!CRYPTO_OBJECT_VALID(reader_crypto, CRYPTO_OBJECT_KIND_REMOTE_READER_CRYPTO))
+  {
+    DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT,
+                               DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_CODE, 0,
+                               DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_MESSAGE);
+    goto err_inv_crypto;
+  }
+
+  *key_material = (master_key_material *)CRYPTO_OBJECT_KEEP(reader_crypto->writer2reader_key_material_message);
+  *session_key = (session_key_material *)CRYPTO_OBJECT_KEEP(reader_crypto->writer_session);
+  *protection_kind = reader_crypto->metadata_protectionKind;
+  result = true;
+
+err_inv_crypto:
+  CRYPTO_OBJECT_RELEASE(reader_crypto);
+err_no_crypto:
+  return result;
+}
+
+struct collect_remote_participant_keys_args
+{
+  uint32_t key_id;
+  endpoint_relation *relation;
+};
+
+/* Currently only collecting the first only */
+static int
+collect_remote_participant_keys(
+    CryptoObject *obj,
+    void *arg)
+{
+  participant_key_material *keys = (participant_key_material *)obj;
+  struct collect_remote_participant_keys_args *info = arg;
+
+  info->relation = crypto_endpoint_relation_find_by_key(keys->endpoint_relations, info->key_id);
+  return (info->relation) ? 0 : 1;
+}
+
+bool
+crypto_factory_get_endpoint_relation(
+    const dds_security_crypto_key_factory *factory,
+    DDS_Security_ParticipantCryptoHandle local_participant_handle,
+    DDS_Security_ParticipantCryptoHandle remote_participant_handle,
+    uint32_t key_id,
+    DDS_Security_Handle *remote_handle,
+    DDS_Security_Handle *local_handle,
+    DDS_Security_SecureSubmessageCategory_t *category,
+    DDS_Security_SecurityException *ex)
+{
+  bool result = false;
+  dds_security_crypto_key_factory_impl *impl = (dds_security_crypto_key_factory_impl *)factory;
+  remote_participant_crypto *remote_pp_crypto;
+  local_participant_crypto *local_pp_crypto = NULL;
+  participant_key_material *keys = NULL;
+  endpoint_relation *relation = NULL;
+
+  remote_pp_crypto = (remote_participant_crypto *)crypto_object_table_find(impl->crypto_objects, remote_participant_handle);
+  if (!remote_pp_crypto)
+  {
+    DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT,
+                               DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_CODE, 0,
+                               DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_MESSAGE);
+    goto invalid_handle;
+  }
+  else if (!CRYPTO_OBJECT_VALID(remote_pp_crypto, CRYPTO_OBJECT_KIND_REMOTE_CRYPTO))
+  {
+    DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT,
+                               DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_CODE, 0,
+                               DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_MESSAGE);
+    goto invalid_handle;
+  }
+
+  if (local_participant_handle != DDS_SECURITY_HANDLE_NIL)
+  {
+    local_pp_crypto = (local_participant_crypto *)crypto_object_table_find(impl->crypto_objects, local_participant_handle);
+    if (!local_pp_crypto)
+    {
+      DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT,
+                                 DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_CODE, 0,
+                                 DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_MESSAGE);
+      goto invalid_handle;
+    }
+    else if (!CRYPTO_OBJECT_VALID(local_pp_crypto, CRYPTO_OBJECT_KIND_LOCAL_CRYPTO))
+    {
+      DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT,
+                                 DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_CODE, 0,
+                                 DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_MESSAGE);
+      goto invalid_handle;
+    }
+    keys = (participant_key_material *)crypto_object_table_find(remote_pp_crypto->key_material, local_participant_handle);
+  }
+
+  if (keys)
+  {
+    relation = crypto_endpoint_relation_find_by_key(keys->endpoint_relations, key_id);
+    CRYPTO_OBJECT_RELEASE(keys);
+  }
+  else
+  {
+    struct collect_remote_participant_keys_args args = {key_id, NULL};
+    /* FIXME: Returning arbitrary local-remote relation will not work in Cyclone,
+     * because participants can have different security settings */
+    crypto_object_table_walk(remote_pp_crypto->key_material, collect_remote_participant_keys, &args);
+    relation = args.relation;
+  }
+
+  if (!relation)
+  {
+    DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT,
+                               DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_CODE, 0,
+                               DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_MESSAGE " key_id=%u", key_id);
+    goto invalid_handle;
+  }
+
+  *category = relation->kind;
+  *remote_handle = CRYPTO_OBJECT_HANDLE(relation->remote_crypto);
+  *local_handle = CRYPTO_OBJECT_HANDLE(relation->local_crypto);
+  result = true;
+
+invalid_handle:
+  CRYPTO_OBJECT_RELEASE(relation);
+  CRYPTO_OBJECT_RELEASE(local_pp_crypto);
+  CRYPTO_OBJECT_RELEASE(remote_pp_crypto);
+
+  return result;
+}
diff --git a/src/security/builtin_plugins/cryptographic/src/crypto_key_factory.h b/src/security/builtin_plugins/cryptographic/src/crypto_key_factory.h
new file mode 100644
index 0000000..5818b37
--- /dev/null
+++ b/src/security/builtin_plugins/cryptographic/src/crypto_key_factory.h
@@ -0,0 +1,146 @@
+/*
+ * Copyright(c) 2006 to 2019 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+#ifndef CRYPTO_KEY_FACTORY_H
+#define CRYPTO_KEY_FACTORY_H
+
+#include "dds/security/dds_security_api.h"
+#include "crypto_objects.h"
+
+/**
+ * @brief Allocation function for implementer structure (with internal variables) transparently.
+ */
+dds_security_crypto_key_factory *
+dds_security_crypto_key_factory__alloc(
+    const dds_security_cryptography *crypto);
+
+void dds_security_crypto_key_factory__dealloc(
+    dds_security_crypto_key_factory *instance);
+
+int generate_key_pairs(
+    char **private_key,
+    char **public_key);
+
+bool crypto_factory_get_participant_crypto_tokens(
+    const dds_security_crypto_key_factory *factory,
+    DDS_Security_ParticipantCryptoHandle local_id,
+    DDS_Security_ParticipantCryptoHandle remote_id,
+    participant_key_material **pp_key_material,
+    DDS_Security_ProtectionKind *protection_kind,
+    DDS_Security_SecurityException *ex);
+
+bool crypto_factory_set_participant_crypto_tokens(
+    const dds_security_crypto_key_factory *factory,
+    const DDS_Security_ParticipantCryptoHandle local_id,
+    const DDS_Security_ParticipantCryptoHandle remote_id,
+    const DDS_Security_KeyMaterial_AES_GCM_GMAC *remote_key_mat,
+    DDS_Security_SecurityException *ex);
+
+bool crypto_factory_get_datawriter_crypto_tokens(
+    const dds_security_crypto_key_factory *factory,
+    DDS_Security_DatawriterCryptoHandle local_writer_handle,
+    DDS_Security_DatareaderCryptoHandle remote_reader_handle,
+    master_key_material **key_mat,
+    uint32_t *num_key_mat,
+    DDS_Security_SecurityException *ex);
+
+bool crypto_factory_set_datawriter_crypto_tokens(
+    const dds_security_crypto_key_factory *factory,
+    const DDS_Security_DatawriterCryptoHandle local_reader_handle,
+    const DDS_Security_DatareaderCryptoHandle remote_writer_handle,
+    const DDS_Security_KeyMaterial_AES_GCM_GMAC *key_mat,
+    const uint32_t num_key_mat,
+    DDS_Security_SecurityException *ex);
+
+bool crypto_factory_get_datareader_crypto_tokens(
+    const dds_security_crypto_key_factory *factory,
+    DDS_Security_DatawriterCryptoHandle local_reader_handle,
+    DDS_Security_DatareaderCryptoHandle remote_writer_handle,
+    master_key_material **key_mat,
+    DDS_Security_SecurityException *ex);
+
+bool crypto_factory_set_datareader_crypto_tokens(
+    const dds_security_crypto_key_factory *factory,
+    const DDS_Security_DatawriterCryptoHandle local_writer_handle,
+    const DDS_Security_DatareaderCryptoHandle remote_reader_handle,
+    const DDS_Security_KeyMaterial_AES_GCM_GMAC *key_mat,
+    DDS_Security_SecurityException *ex);
+
+bool crypto_factory_get_writer_key_material(
+    const dds_security_crypto_key_factory *factory,
+    const DDS_Security_DatawriterCryptoHandle writer_id,
+    const DDS_Security_DatareaderCryptoHandle reader_id,
+    bool payload,
+    session_key_material **session_key,
+    DDS_Security_ProtectionKind *protection_kind,
+    DDS_Security_SecurityException *ex);
+
+bool crypto_factory_get_reader_key_material(
+    const dds_security_crypto_key_factory *factory,
+    const DDS_Security_DatareaderCryptoHandle reader_id,
+    const DDS_Security_DatawriterCryptoHandle writer_id,
+    session_key_material **session_key,
+    DDS_Security_ProtectionKind *protection_kind,
+    DDS_Security_SecurityException *ex);
+
+bool crypto_factory_get_remote_writer_key_material(
+    const dds_security_crypto_key_factory *factory,
+    const DDS_Security_DatareaderCryptoHandle reader_id,
+    const DDS_Security_DatawriterCryptoHandle writer_id,
+    uint32_t key_id,
+    master_key_material **master_key,
+    DDS_Security_ProtectionKind *protection_kind,
+    DDS_Security_BasicProtectionKind *basic_protection_kind,
+    DDS_Security_SecurityException *ex);
+
+bool crypto_factory_get_local_participant_data_key_material(
+    const dds_security_crypto_key_factory *factory,
+    const DDS_Security_ParticipantCryptoHandle local_id,
+    session_key_material **session_key,
+    DDS_Security_ProtectionKind *protection_kind,
+    DDS_Security_SecurityException *ex);
+
+bool crypto_factory_get_remote_reader_key_material(
+    const dds_security_crypto_key_factory *factory,
+    const DDS_Security_DatawriterCryptoHandle writer_id,
+    const DDS_Security_DatareaderCryptoHandle reader_id,
+    uint32_t key_id,
+    master_key_material **master_key,
+    DDS_Security_ProtectionKind *protection_kind,
+    DDS_Security_SecurityException *ex);
+
+bool crypto_factory_get_remote_writer_sign_key_material(
+    const dds_security_crypto_key_factory *factory,
+    const DDS_Security_DatareaderCryptoHandle writer_id,
+    master_key_material **key_material,
+    session_key_material **session_key,
+    DDS_Security_ProtectionKind *protection_kind,
+    DDS_Security_SecurityException *ex);
+
+bool crypto_factory_get_remote_reader_sign_key_material(
+    const dds_security_crypto_key_factory *factory,
+    const DDS_Security_DatareaderCryptoHandle reader_id,
+    master_key_material **key_material,
+    session_key_material **session_key,
+    DDS_Security_ProtectionKind *protection_kind,
+    DDS_Security_SecurityException *ex);
+
+bool crypto_factory_get_endpoint_relation(
+    const dds_security_crypto_key_factory *factory,
+    DDS_Security_ParticipantCryptoHandle local_participant_handle,
+    DDS_Security_ParticipantCryptoHandle remote_participant_handle,
+    uint32_t key_id,
+    DDS_Security_Handle *remote_handle,
+    DDS_Security_Handle *local_handle,
+    DDS_Security_SecureSubmessageCategory_t *category,
+    DDS_Security_SecurityException *ex);
+
+#endif /* CRYPTO_KEY_FACTORY_H */
diff --git a/src/security/builtin_plugins/cryptographic/src/crypto_objects.c b/src/security/builtin_plugins/cryptographic/src/crypto_objects.c
new file mode 100644
index 0000000..8fa9a06
--- /dev/null
+++ b/src/security/builtin_plugins/cryptographic/src/crypto_objects.c
@@ -0,0 +1,593 @@
+/*
+ * Copyright(c) 2006 to 2019 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+#include <assert.h>
+#include <string.h>
+#include "dds/ddsrt/heap.h"
+#include "dds/ddsrt/hopscotch.h"
+#include "dds/ddsrt/types.h"
+#include "crypto_objects.h"
+#include "crypto_utils.h"
+
+bool crypto_object_valid(CryptoObject *obj, CryptoObjectKind_t kind)
+{
+  return (obj && obj->kind == kind && obj->handle == (int64_t)(uintptr_t)obj);
+}
+
+static uint32_t crypto_object_hash(const void *obj)
+{
+  const CryptoObject *object = obj;
+  const uint64_t c = UINT64_C (16292676669999574021);
+  const uint32_t x = (uint32_t)object->handle;
+  return (uint32_t)((x * c) >> 32);
+}
+
+static int crypto_object_equal(const void *ha, const void *hb)
+{
+  const CryptoObject *la = ha;
+  const CryptoObject *lb = hb;
+  return la->handle == lb->handle;
+}
+
+void crypto_object_init(CryptoObject *obj, CryptoObjectKind_t kind, CryptoObjectDestructor destructor)
+{
+  assert(obj);
+  obj->kind = kind;
+  obj->handle = (int64_t)(uintptr_t)obj;
+  obj->destructor = destructor;
+  ddsrt_atomic_st32 (&obj->refcount, 1);
+}
+
+static void crypto_object_deinit(CryptoObject *obj)
+{
+  assert(obj);
+  obj->handle = DDS_SECURITY_HANDLE_NIL;
+  obj->kind = CRYPTO_OBJECT_KIND_UNKNOWN;
+  obj->destructor = NULL;
+}
+
+void crypto_object_free(CryptoObject *obj)
+{
+  if (obj && obj->destructor)
+    obj->destructor(obj);
+}
+
+CryptoObject * crypto_object_keep(CryptoObject *obj)
+{
+  if (obj)
+    ddsrt_atomic_inc32(&obj->refcount);
+  return obj;
+}
+
+void crypto_object_release(CryptoObject *obj)
+{
+  if (obj && ddsrt_atomic_dec32_nv(&obj->refcount) == 0)
+    crypto_object_free(obj);
+}
+
+static uint32_t participant_key_material_hash(const void *obj)
+{
+  const participant_key_material *object = obj;
+  return (uint32_t)object->pp_local_handle;
+}
+
+static int participant_key_material_equal(const void *ha, const void *hb)
+{
+  const participant_key_material *la = ha;
+  const participant_key_material *lb = hb;
+  return la->pp_local_handle == lb->pp_local_handle;
+}
+
+static CryptoObject * participant_key_material_find(const struct CryptoObjectTable *table, const void *arg)
+{
+  struct participant_key_material template;
+  template.pp_local_handle = *(int64_t *)arg;
+  return crypto_object_table_find_by_template(table, &template);
+}
+
+CryptoObject * crypto_object_table_find_by_template(const struct CryptoObjectTable *table, const void *template)
+{
+  return (CryptoObject *)ddsrt_hh_lookup(table->htab, template);
+}
+
+static CryptoObject * default_crypto_table_find(const struct CryptoObjectTable *table, const void *arg)
+{
+  struct CryptoObject template;
+  template.handle = *(int64_t *)arg;
+  return crypto_object_table_find_by_template(table, &template);
+}
+
+struct CryptoObjectTable * crypto_object_table_new(CryptoObjectHashFunction hashfnc, CryptoObjectEqualFunction equalfnc, CryptoObjectFindFunction findfnc)
+{
+  struct CryptoObjectTable *table;
+  if (!hashfnc)
+    hashfnc = crypto_object_hash;
+  if (!equalfnc)
+    equalfnc = crypto_object_equal;
+  table = ddsrt_malloc(sizeof(*table));
+  table->htab = ddsrt_hh_new(32, hashfnc, equalfnc);
+  ddsrt_mutex_init(&table->lock);
+  table->findfnc = findfnc ? findfnc : default_crypto_table_find;
+  return table;
+}
+
+void crypto_object_table_free(struct CryptoObjectTable *table)
+{
+  struct ddsrt_hh_iter it;
+  CryptoObject *obj;
+
+  if (!table)
+    return;
+
+  ddsrt_mutex_lock(&table->lock);
+  for (obj = ddsrt_hh_iter_first(table->htab, &it); obj; obj = ddsrt_hh_iter_next(&it))
+  {
+    ddsrt_hh_remove(table->htab, obj);
+    crypto_object_release(obj);
+  }
+  ddsrt_hh_free(table->htab);
+  ddsrt_mutex_unlock(&table->lock);
+  ddsrt_mutex_destroy(&table->lock);
+  ddsrt_free(table);
+}
+
+CryptoObject * crypto_object_table_insert(struct CryptoObjectTable *table, CryptoObject *object)
+{
+  CryptoObject *cur;
+
+  assert(table);
+  assert(object);
+
+  ddsrt_mutex_lock(&table->lock);
+  if (!(cur = crypto_object_keep (table->findfnc(table, &object->handle))))
+    ddsrt_hh_add(table->htab, crypto_object_keep(object));
+  else
+    crypto_object_release(cur);
+  ddsrt_mutex_unlock(&table->lock);
+
+  return cur;
+}
+
+void crypto_object_table_remove_object(struct CryptoObjectTable *table, CryptoObject *object)
+{
+  assert (table);
+  assert (object);
+
+  ddsrt_mutex_lock (&table->lock);
+  ddsrt_hh_remove (table->htab, object);
+  ddsrt_mutex_unlock (&table->lock);
+
+  crypto_object_release (object);
+}
+
+CryptoObject * crypto_object_table_remove(struct CryptoObjectTable *table, int64_t handle)
+{
+  CryptoObject *object;
+  assert (table);
+  ddsrt_mutex_lock (&table->lock);
+  if ((object = crypto_object_keep (table->findfnc(table, &handle))))
+  {
+    ddsrt_hh_remove (table->htab, object);
+    crypto_object_release (object);
+  }
+  ddsrt_mutex_unlock (&table->lock);
+
+  return object;
+}
+
+CryptoObject * crypto_object_table_find(struct CryptoObjectTable *table, int64_t handle)
+{
+  CryptoObject *object;
+  assert (table);
+  ddsrt_mutex_lock (&table->lock);
+  object = crypto_object_keep (table->findfnc(table, &handle));
+  ddsrt_mutex_unlock (&table->lock);
+
+  return object;
+}
+
+void crypto_object_table_walk(struct CryptoObjectTable *table, CryptoObjectTableCallback callback, void *arg)
+{
+  struct ddsrt_hh_iter it;
+  CryptoObject *obj;
+  int r = 1;
+
+  assert(table);
+  assert(callback);
+  ddsrt_mutex_lock (&table->lock);
+  for (obj = ddsrt_hh_iter_first (table->htab, &it); r && obj; obj = ddsrt_hh_iter_next (&it))
+    r = callback(obj, arg);
+  ddsrt_mutex_unlock(&table->lock);
+}
+
+static void master_key_material__free(CryptoObject *obj)
+{
+  master_key_material *keymat = (master_key_material *)obj;
+  if (obj)
+  {
+    CHECK_CRYPTO_OBJECT_KIND(obj, CRYPTO_OBJECT_KIND_KEY_MATERIAL);
+    if (CRYPTO_TRANSFORM_HAS_KEYS(keymat->transformation_kind))
+    {
+      ddsrt_free (keymat->master_salt);
+      ddsrt_free (keymat->master_sender_key);
+      ddsrt_free (keymat->master_receiver_specific_key);
+    }
+    crypto_object_deinit ((CryptoObject *)keymat);
+    memset (keymat, 0, sizeof (*keymat));
+    ddsrt_free (keymat);
+  }
+}
+
+master_key_material * crypto_master_key_material_new(DDS_Security_CryptoTransformKind_Enum transform_kind)
+{
+  master_key_material *keymat = ddsrt_calloc (1, sizeof(*keymat));
+  crypto_object_init((CryptoObject *)keymat, CRYPTO_OBJECT_KIND_KEY_MATERIAL, master_key_material__free);
+  keymat->transformation_kind = transform_kind;
+  if (CRYPTO_TRANSFORM_HAS_KEYS(transform_kind))
+  {
+    uint32_t key_bytes = CRYPTO_KEY_SIZE_BYTES(keymat->transformation_kind);
+    keymat->master_salt = ddsrt_calloc(1, key_bytes);
+    keymat->master_sender_key = ddsrt_calloc(1, key_bytes);
+    keymat->master_receiver_specific_key = ddsrt_calloc(1, key_bytes);
+  }
+  return keymat;
+}
+
+void crypto_master_key_material_set(master_key_material *dst, const master_key_material *src)
+{
+  if (CRYPTO_TRANSFORM_HAS_KEYS(dst->transformation_kind) && !CRYPTO_TRANSFORM_HAS_KEYS(src->transformation_kind))
+  {
+    ddsrt_free(dst->master_salt);
+    ddsrt_free(dst->master_sender_key);
+    ddsrt_free(dst->master_receiver_specific_key);
+  }
+  else if (CRYPTO_TRANSFORM_HAS_KEYS(src->transformation_kind))
+  {
+    uint32_t key_bytes = CRYPTO_KEY_SIZE_BYTES(src->transformation_kind);
+    if (!CRYPTO_TRANSFORM_HAS_KEYS(dst->transformation_kind))
+    {
+      dst->master_salt = ddsrt_calloc(1, key_bytes);
+      dst->master_sender_key = ddsrt_calloc(1, key_bytes);
+      dst->master_receiver_specific_key = ddsrt_calloc(1, key_bytes);
+    }
+    memcpy (dst->master_salt, src->master_salt, key_bytes);
+    dst->sender_key_id = src->sender_key_id;
+    memcpy (dst->master_sender_key, src->master_sender_key, key_bytes);
+    /* Fixme: set the receiver specific key? */
+    dst->receiver_specific_key_id = 0;
+  }
+  dst->transformation_kind = src->transformation_kind;
+}
+
+static bool generate_session_key(session_key_material *session, DDS_Security_SecurityException *ex)
+{
+  session->id++;
+  session->block_counter = 0;
+  return crypto_calculate_session_key(&session->key, session->id, session->master_key_material->master_salt, session->master_key_material->master_sender_key, session->master_key_material->transformation_kind, ex);
+}
+
+static void session_key_material__free(CryptoObject *obj)
+{
+  session_key_material *session = (session_key_material *)obj;
+  if (obj)
+  {
+    CHECK_CRYPTO_OBJECT_KIND(obj, CRYPTO_OBJECT_KIND_SESSION_KEY_MATERIAL);
+    CRYPTO_OBJECT_RELEASE(session->master_key_material);
+    crypto_object_deinit((CryptoObject *)session);
+    memset (session, 0, sizeof (*session));
+    ddsrt_free(session);
+  }
+}
+
+session_key_material * crypto_session_key_material_new(master_key_material *master_key)
+{
+  session_key_material *session = ddsrt_malloc(sizeof(*session));
+  crypto_object_init((CryptoObject *)session, CRYPTO_OBJECT_KIND_SESSION_KEY_MATERIAL, session_key_material__free);
+  memset (session->key.data, 0, CRYPTO_KEY_SIZE_MAX);
+  session->block_size = CRYPTO_CIPHER_BLOCK_SIZE;
+  session->key_size = crypto_get_key_size(master_key->transformation_kind);
+  session->id = crypto_get_random_uint32();
+  session->init_vector_suffix = crypto_get_random_uint64();
+  session->max_blocks_per_session = INT64_MAX; /* FIXME: should be a config parameter */
+  session->block_counter = session->max_blocks_per_session;
+  session->master_key_material = (master_key_material *)CRYPTO_OBJECT_KEEP(master_key);
+
+  return session;
+}
+
+bool crypto_session_key_material_update(session_key_material *session, uint32_t size, DDS_Security_SecurityException *ex)
+{
+  if (session->block_counter + (size / session->block_size) >= session->max_blocks_per_session)
+    return generate_session_key(session, ex);
+  return true;
+}
+
+static void local_participant_crypto__free(CryptoObject *obj)
+{
+  local_participant_crypto *participant_crypto = (local_participant_crypto *)obj;
+  if (participant_crypto)
+  {
+    CHECK_CRYPTO_OBJECT_KIND (obj, CRYPTO_OBJECT_KIND_LOCAL_CRYPTO);
+    CRYPTO_OBJECT_RELEASE (participant_crypto->session);
+    CRYPTO_OBJECT_RELEASE (participant_crypto->key_material);
+    crypto_object_deinit ((CryptoObject *)participant_crypto);
+    ddsrt_free (participant_crypto);
+  }
+}
+
+local_participant_crypto * crypto_local_participant_crypto__new(DDS_Security_IdentityHandle participant_identity)
+{
+  assert (participant_identity);
+  assert (sizeof(DDS_Security_ParticipantCryptoHandle) == 8);
+  local_participant_crypto *participant_crypto = ddsrt_calloc (1, sizeof(*participant_crypto));
+  participant_crypto->identity_handle = participant_identity;
+  crypto_object_init ((CryptoObject *)participant_crypto, CRYPTO_OBJECT_KIND_LOCAL_CRYPTO, local_participant_crypto__free);
+  return participant_crypto;
+}
+
+static void remote_participant_crypto__free(CryptoObject *obj)
+{
+  remote_participant_crypto *participant_crypto = (remote_participant_crypto *)obj;
+
+  CHECK_CRYPTO_OBJECT_KIND (obj, CRYPTO_OBJECT_KIND_REMOTE_CRYPTO);
+  if (participant_crypto)
+  {
+    CRYPTO_OBJECT_RELEASE (participant_crypto->session);
+    crypto_object_table_free (participant_crypto->key_material);
+    crypto_object_deinit ((CryptoObject *)participant_crypto);
+    ddsrt_free(participant_crypto);
+  }
+}
+
+remote_participant_crypto * crypto_remote_participant_crypto__new(DDS_Security_IdentityHandle participant_identity)
+{
+  assert (participant_identity);
+  remote_participant_crypto *participant_crypto = ddsrt_calloc (1, sizeof(*participant_crypto));
+  crypto_object_init ((CryptoObject *)participant_crypto, CRYPTO_OBJECT_KIND_REMOTE_CRYPTO, remote_participant_crypto__free);
+  participant_crypto->identity_handle = participant_identity;
+  participant_crypto->key_material = crypto_object_table_new (participant_key_material_hash, participant_key_material_equal, participant_key_material_find);
+
+  return participant_crypto;
+}
+
+
+static void participant_key_material_free(CryptoObject *obj)
+{
+  participant_key_material *keymaterial = (participant_key_material *)obj;
+  CHECK_CRYPTO_OBJECT_KIND(obj, CRYPTO_OBJECT_KIND_PARTICIPANT_KEY_MATERIAL);
+  if (keymaterial)
+  {
+    CRYPTO_OBJECT_RELEASE(keymaterial->P2P_writer_session);
+    CRYPTO_OBJECT_RELEASE(keymaterial->P2P_reader_session);
+    CRYPTO_OBJECT_RELEASE(keymaterial->P2P_kx_key_material);
+    CRYPTO_OBJECT_RELEASE(keymaterial->local_P2P_key_material);
+    CRYPTO_OBJECT_RELEASE(keymaterial->remote_key_material);
+    crypto_object_table_free(keymaterial->endpoint_relations);
+    crypto_object_deinit((CryptoObject *)keymaterial);
+    ddsrt_free(keymaterial);
+  }
+}
+
+participant_key_material * crypto_participant_key_material_new(const local_participant_crypto *pplocal)
+{
+  participant_key_material *keymaterial = ddsrt_calloc(1, sizeof(*keymaterial));
+  crypto_object_init((CryptoObject *)keymaterial, CRYPTO_OBJECT_KIND_PARTICIPANT_KEY_MATERIAL, participant_key_material_free);
+  keymaterial->pp_local_handle = pplocal->_parent.handle;
+  keymaterial->endpoint_relations = crypto_object_table_new(NULL, NULL, NULL);
+  keymaterial->local_P2P_key_material = crypto_master_key_material_new(CRYPTO_TRANSFORMATION_KIND_NONE);
+  keymaterial->P2P_kx_key_material = crypto_master_key_material_new(CRYPTO_TRANSFORMATION_KIND_AES256_GCM); /* as defined in table 67 of the DDS Security spec v1.1 */
+
+  return keymaterial;
+}
+
+static void endpoint_relation_free(CryptoObject *obj)
+{
+  endpoint_relation *relation = (endpoint_relation *)obj;
+  if (relation)
+  {
+    CRYPTO_OBJECT_RELEASE(relation->local_crypto);
+    CRYPTO_OBJECT_RELEASE(relation->remote_crypto);
+    crypto_object_deinit((CryptoObject *)relation);
+    ddsrt_free(relation);
+  }
+}
+
+endpoint_relation * crypto_endpoint_relation_new(DDS_Security_SecureSubmessageCategory_t kind,
+    uint32_t key_id, CryptoObject *local_crypto, CryptoObject *remote_crypto)
+{
+  endpoint_relation *relation = ddsrt_malloc(sizeof(*relation));
+  crypto_object_init((CryptoObject *)relation, CRYPTO_OBJECT_KIND_ENDPOINT_RELATION, endpoint_relation_free);
+
+  relation->kind = kind;
+  relation->key_id = key_id;
+  relation->local_crypto = CRYPTO_OBJECT_KEEP(local_crypto);
+  relation->remote_crypto = CRYPTO_OBJECT_KEEP(remote_crypto);
+
+  return relation;
+}
+
+static void local_datawriter_crypto__free(CryptoObject *obj)
+{
+  local_datawriter_crypto *datawriter_crypto = (local_datawriter_crypto *)obj;
+
+  if (obj)
+  {
+    CHECK_CRYPTO_OBJECT_KIND(obj, CRYPTO_OBJECT_KIND_LOCAL_WRITER_CRYPTO);
+    CRYPTO_OBJECT_RELEASE(datawriter_crypto->writer_session_message);
+    CRYPTO_OBJECT_RELEASE(datawriter_crypto->writer_session_payload);
+    CRYPTO_OBJECT_RELEASE(datawriter_crypto->writer_key_material_message);
+    CRYPTO_OBJECT_RELEASE(datawriter_crypto->writer_key_material_payload);
+    CRYPTO_OBJECT_RELEASE(datawriter_crypto->participant);
+    crypto_object_deinit((CryptoObject *)datawriter_crypto);
+    ddsrt_free(datawriter_crypto);
+  }
+}
+
+local_datawriter_crypto * crypto_local_datawriter_crypto__new(const local_participant_crypto *participant,
+    DDS_Security_ProtectionKind meta_protection, DDS_Security_BasicProtectionKind data_protection)
+{
+  local_datawriter_crypto *writer_crypto = ddsrt_calloc(1, sizeof(*writer_crypto));
+  crypto_object_init((CryptoObject *)writer_crypto, CRYPTO_OBJECT_KIND_LOCAL_WRITER_CRYPTO, local_datawriter_crypto__free);
+  writer_crypto->participant = (local_participant_crypto *)CRYPTO_OBJECT_KEEP(participant);
+  writer_crypto->metadata_protectionKind = meta_protection;
+  writer_crypto->data_protectionKind = data_protection;
+  writer_crypto->is_builtin_participant_volatile_message_secure_writer = false;
+
+  return writer_crypto;
+}
+
+
+static void remote_datawriter_crypto__free(CryptoObject *obj)
+{
+  remote_datawriter_crypto *datawriter_crypto = (remote_datawriter_crypto *)obj;
+  if (datawriter_crypto)
+  {
+    CHECK_CRYPTO_OBJECT_KIND(obj, CRYPTO_OBJECT_KIND_REMOTE_WRITER_CRYPTO);
+    CRYPTO_OBJECT_RELEASE(datawriter_crypto->reader_session);
+    CRYPTO_OBJECT_RELEASE(datawriter_crypto->reader2writer_key_material);
+    CRYPTO_OBJECT_RELEASE(datawriter_crypto->writer2reader_key_material[0]);
+    CRYPTO_OBJECT_RELEASE(datawriter_crypto->writer2reader_key_material[1]);
+    CRYPTO_OBJECT_RELEASE(datawriter_crypto->participant);
+    crypto_object_deinit((CryptoObject *)datawriter_crypto);
+    ddsrt_free(datawriter_crypto);
+  }
+}
+
+remote_datawriter_crypto * crypto_remote_datawriter_crypto__new(const remote_participant_crypto *participant,
+    DDS_Security_ProtectionKind meta_protection, DDS_Security_BasicProtectionKind data_protection, DDS_Security_DatareaderCryptoHandle local_reader_handle)
+{
+  remote_datawriter_crypto *writer_crypto = ddsrt_calloc(1, sizeof(*writer_crypto));
+  crypto_object_init((CryptoObject *)writer_crypto, CRYPTO_OBJECT_KIND_REMOTE_WRITER_CRYPTO, remote_datawriter_crypto__free);
+  writer_crypto->participant = (remote_participant_crypto *)CRYPTO_OBJECT_KEEP(participant);
+  writer_crypto->metadata_protectionKind = meta_protection;
+  writer_crypto->data_protectionKind = data_protection;
+  writer_crypto->local_reader_handle = local_reader_handle;
+  writer_crypto->is_builtin_participant_volatile_message_secure_writer = false;
+
+  return writer_crypto;
+}
+
+
+static void local_datareader_crypto__free(CryptoObject *obj)
+{
+  local_datareader_crypto *datareader_crypto = (local_datareader_crypto *)obj;
+  if (datareader_crypto)
+  {
+    CHECK_CRYPTO_OBJECT_KIND(obj, CRYPTO_OBJECT_KIND_LOCAL_READER_CRYPTO);
+    CRYPTO_OBJECT_RELEASE(datareader_crypto->reader_session);
+    CRYPTO_OBJECT_RELEASE(datareader_crypto->reader_key_material);
+    CRYPTO_OBJECT_RELEASE(datareader_crypto->participant);
+    crypto_object_deinit((CryptoObject *)datareader_crypto);
+    ddsrt_free(datareader_crypto);
+  }
+}
+
+local_datareader_crypto * crypto_local_datareader_crypto__new(const local_participant_crypto *participant,
+    DDS_Security_ProtectionKind meta_protection, DDS_Security_BasicProtectionKind data_protection)
+{
+  local_datareader_crypto *reader_crypto = ddsrt_calloc(1, sizeof(*reader_crypto));
+  crypto_object_init((CryptoObject *)reader_crypto, CRYPTO_OBJECT_KIND_LOCAL_READER_CRYPTO, local_datareader_crypto__free);
+  reader_crypto->participant = (local_participant_crypto *)CRYPTO_OBJECT_KEEP(participant);
+  reader_crypto->metadata_protectionKind = meta_protection;
+  reader_crypto->data_protectionKind = data_protection;
+  reader_crypto->is_builtin_participant_volatile_message_secure_reader = false;
+
+  return reader_crypto;
+}
+
+
+static void remote_datareader_crypto__free(CryptoObject *obj)
+{
+  remote_datareader_crypto *datareader_crypto = (remote_datareader_crypto *)obj;
+  if (datareader_crypto)
+  {
+    CHECK_CRYPTO_OBJECT_KIND(obj, CRYPTO_OBJECT_KIND_REMOTE_READER_CRYPTO);
+    CRYPTO_OBJECT_RELEASE(datareader_crypto->writer_session);
+    CRYPTO_OBJECT_RELEASE(datareader_crypto->reader2writer_key_material);
+    CRYPTO_OBJECT_RELEASE(datareader_crypto->writer2reader_key_material_message);
+    CRYPTO_OBJECT_RELEASE(datareader_crypto->writer2reader_key_material_payload);
+    CRYPTO_OBJECT_RELEASE(datareader_crypto->participant);
+    crypto_object_deinit((CryptoObject *)datareader_crypto);
+    ddsrt_free(datareader_crypto);
+  }
+}
+
+remote_datareader_crypto *crypto_remote_datareader_crypto__new(const remote_participant_crypto *participant, DDS_Security_ProtectionKind metadata_protectionKind,
+    DDS_Security_BasicProtectionKind data_protectionKind, DDS_Security_DatawriterCryptoHandle local_writer_handle)
+{
+  remote_datareader_crypto *reader_crypto = ddsrt_calloc(1, sizeof(*reader_crypto));
+  crypto_object_init((CryptoObject *)reader_crypto, CRYPTO_OBJECT_KIND_REMOTE_READER_CRYPTO, remote_datareader_crypto__free);
+  reader_crypto->participant = (remote_participant_crypto *)CRYPTO_OBJECT_KEEP(participant);
+  reader_crypto->metadata_protectionKind = metadata_protectionKind;
+  reader_crypto->data_protectionKind = data_protectionKind;
+  reader_crypto->local_writer_handle = local_writer_handle;
+  reader_crypto->is_builtin_participant_volatile_message_secure_reader = false;
+
+  return reader_crypto;
+}
+
+
+typedef struct endpoint_relation_find_arg
+{
+  CryptoObject *found;
+  CryptoObject *local_crypto;
+  CryptoObject *remote_crypto;
+  uint32_t key_id;
+} endpoint_relation_find_arg;
+
+static int endpoint_relation_cmp_key(CryptoObject *obj, void *arg)
+{
+  const endpoint_relation *rel = (const endpoint_relation *)obj;
+  endpoint_relation_find_arg *find_arg = (endpoint_relation_find_arg *)arg;
+
+  if (rel->key_id == find_arg->key_id)
+  {
+    find_arg->found = crypto_object_keep(obj);
+    return 0;
+  }
+  return 1;
+}
+
+static int endpoint_relation_cmp_crypto(CryptoObject *obj, void *arg)
+{
+  const endpoint_relation *rel = (const endpoint_relation *)obj;
+  endpoint_relation_find_arg *find_arg = (endpoint_relation_find_arg *)arg;
+
+  if ((rel->local_crypto == find_arg->local_crypto) &&
+      (rel->remote_crypto == find_arg->remote_crypto))
+  {
+    find_arg->found = crypto_object_keep(obj);
+    return 0;
+  }
+  return 1;
+}
+
+endpoint_relation * crypto_endpoint_relation_find_by_key(struct CryptoObjectTable *table, uint32_t key_id)
+{
+  endpoint_relation_find_arg find_arg;
+  find_arg.found = NULL;
+  find_arg.key_id = key_id;
+  find_arg.local_crypto = NULL;
+  find_arg.remote_crypto = NULL;
+  crypto_object_table_walk(table, endpoint_relation_cmp_key, &find_arg);
+  return (endpoint_relation *)(find_arg.found);
+}
+
+endpoint_relation * crypto_endpoint_relation_find_by_crypto(struct CryptoObjectTable *table, CryptoObject *local_crypto, CryptoObject *remote_crypto)
+{
+  endpoint_relation_find_arg find_arg;
+  find_arg.found = NULL;
+  find_arg.key_id = 0;
+  find_arg.local_crypto = local_crypto;
+  find_arg.remote_crypto = remote_crypto;
+  crypto_object_table_walk(table, endpoint_relation_cmp_crypto, &find_arg);
+  return (endpoint_relation *)(find_arg.found);
+}
diff --git a/src/security/builtin_plugins/cryptographic/src/crypto_objects.h b/src/security/builtin_plugins/cryptographic/src/crypto_objects.h
new file mode 100644
index 0000000..3edb6a4
--- /dev/null
+++ b/src/security/builtin_plugins/cryptographic/src/crypto_objects.h
@@ -0,0 +1,354 @@
+/*
+ * Copyright(c) 2006 to 2019 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+#ifndef CRYPTO_OBJECTS_H
+#define CRYPTO_OBJECTS_H
+
+#include <openssl/rand.h>
+#include "dds/ddsrt/atomics.h"
+#include "dds/ddsrt/sync.h"
+#include "dds/ddsrt/types.h"
+#include "dds/security/dds_security_api.h"
+#include "dds/security/core/dds_security_utils.h"
+#include "crypto_defs.h"
+
+#ifndef NDEBUG
+#define CHECK_CRYPTO_OBJECT_KIND(o, k) assert(crypto_object_valid((CryptoObject *)(o), k))
+#else
+#define CHECK_CRYPTO_OBJECT_KIND(o, k)
+#endif
+
+#define CRYPTO_OBJECT(o) ((CryptoObject *)(o))
+#define CRYPTO_OBJECT_HANDLE(o) (CRYPTO_OBJECT(o)->handle)
+#define PARTICIPANT_CRYPTO_HANDLE(o) ((DDS_Security_ParticipantCryptoHandle)CRYPTO_OBJECT_HANDLE(o))
+#define DATAWRITER_CRYPTO_HANDLE(o) ((DDS_Security_DatawriterCryptoHandle)CRYPTO_OBJECT_HANDLE(o))
+#define DATAREADER_CRYPTO_HANDLE(o) ((DDS_Security_DatareaderCryptoHandle)CRYPTO_OBJECT_HANDLE(o))
+
+#define CRYPTO_OBJECT_KEEP(o) crypto_object_keep((CryptoObject *)(o))
+#define CRYPTO_OBJECT_RELEASE(o) crypto_object_release((CryptoObject *)(o))
+#define CRYPTO_OBJECT_VALID(o, k) crypto_object_valid((CryptoObject *)(o), k)
+
+#define CRYPTO_TRANSFORM_HAS_KEYS(k) ((k) != CRYPTO_TRANSFORMATION_KIND_NONE && (k) != CRYPTO_TRANSFORMATION_KIND_INVALID)
+
+typedef DDS_Security_ParticipantCryptoHandle DDS_Security_LocalParticipantCryptoHandle;
+typedef DDS_Security_ParticipantCryptoHandle DDS_Security_RemoteParticipantCryptoHandle;
+
+typedef enum
+{
+  CRYPTO_OBJECT_KIND_UNKNOWN,
+  CRYPTO_OBJECT_KIND_LOCAL_CRYPTO,
+  CRYPTO_OBJECT_KIND_REMOTE_CRYPTO,
+  CRYPTO_OBJECT_KIND_LOCAL_WRITER_CRYPTO,
+  CRYPTO_OBJECT_KIND_REMOTE_WRITER_CRYPTO,
+  CRYPTO_OBJECT_KIND_LOCAL_READER_CRYPTO,
+  CRYPTO_OBJECT_KIND_REMOTE_READER_CRYPTO,
+  CRYPTO_OBJECT_KIND_KEY_MATERIAL,
+  CRYPTO_OBJECT_KIND_SESSION_KEY_MATERIAL,
+  CRYPTO_OBJECT_KIND_PARTICIPANT_KEY_MATERIAL,
+  CRYPTO_OBJECT_KIND_ENDPOINT_RELATION
+} CryptoObjectKind_t;
+
+typedef struct CryptoObject CryptoObject;
+typedef void (*CryptoObjectDestructor)(CryptoObject *obj);
+
+struct CryptoObject
+{
+  int64_t handle;
+  ddsrt_atomic_uint32_t refcount;
+  CryptoObjectKind_t kind;
+  CryptoObjectDestructor destructor;
+};
+
+struct local_datawriter_crypto;
+struct local_datareader_crypto;
+struct remote_datawriter_crypto;
+struct remote_datareader_crypto;
+
+typedef struct master_key_material
+{
+  CryptoObject _parent;
+  DDS_Security_CryptoTransformKind_Enum transformation_kind;
+  unsigned char *master_salt;
+  uint32_t sender_key_id;
+  unsigned char *master_sender_key;
+  uint32_t receiver_specific_key_id;
+  unsigned char *master_receiver_specific_key;
+} master_key_material;
+
+typedef struct session_key_material
+{
+  CryptoObject _parent;
+  uint32_t id;
+  crypto_session_key_t key;
+  uint32_t key_size;
+  uint32_t block_size;
+  uint64_t block_counter;
+  uint64_t max_blocks_per_session;
+  uint64_t init_vector_suffix;
+  master_key_material *master_key_material;
+} session_key_material;
+
+typedef struct remote_session_info
+{
+  uint32_t key_size;
+  uint32_t id;
+  crypto_session_key_t key;
+} remote_session_info;
+
+typedef struct endpoint_relation
+{
+  CryptoObject _parent;
+  DDS_Security_SecureSubmessageCategory_t kind;
+  uint32_t key_id;
+  CryptoObject *local_crypto;
+  CryptoObject *remote_crypto;
+} endpoint_relation;
+
+typedef struct local_participant_crypto
+{
+  CryptoObject _parent;
+  master_key_material *key_material;
+  DDS_Security_IdentityHandle identity_handle;
+  session_key_material *session;
+  DDS_Security_ProtectionKind rtps_protection_kind;
+} local_participant_crypto;
+
+typedef struct participant_key_material
+{
+  CryptoObject _parent;
+  DDS_Security_ParticipantCryptoHandle pp_local_handle;
+  master_key_material *remote_key_material;
+  master_key_material *local_P2P_key_material;
+  master_key_material *P2P_kx_key_material;
+  session_key_material *P2P_writer_session;
+  session_key_material *P2P_reader_session;
+  struct CryptoObjectTable *endpoint_relations;
+} participant_key_material;
+
+typedef struct remote_participant_crypto
+{
+  CryptoObject _parent;
+  DDS_Security_GUID_t remoteGuid;
+  DDS_Security_IdentityHandle identity_handle;
+  struct CryptoObjectTable *key_material;
+  session_key_material *session;
+  DDS_Security_ProtectionKind rtps_protection_kind;
+} remote_participant_crypto;
+
+typedef struct local_datawriter_crypto
+{
+  CryptoObject _parent;
+  local_participant_crypto *participant;
+  master_key_material *writer_key_material_message;
+  master_key_material *writer_key_material_payload;
+  session_key_material *writer_session_message;
+  session_key_material *writer_session_payload;
+  DDS_Security_ProtectionKind metadata_protectionKind;
+  DDS_Security_BasicProtectionKind data_protectionKind;
+  bool is_builtin_participant_volatile_message_secure_writer;
+} local_datawriter_crypto;
+
+typedef struct remote_datawriter_crypto
+{
+  CryptoObject _parent;
+  remote_participant_crypto *participant;
+  DDS_Security_ProtectionKind metadata_protectionKind;
+  DDS_Security_BasicProtectionKind data_protectionKind;
+  master_key_material *reader2writer_key_material;
+  master_key_material *writer2reader_key_material[2];
+  session_key_material *reader_session; /* reference to the session key used by the reader */
+  DDS_Security_DatareaderCryptoHandle local_reader_handle;
+  bool is_builtin_participant_volatile_message_secure_writer;
+} remote_datawriter_crypto;
+
+typedef struct local_datareader_crypto
+{
+  CryptoObject _parent;
+  local_participant_crypto *participant;
+  master_key_material *reader_key_material;
+  session_key_material *reader_session;
+  DDS_Security_ProtectionKind metadata_protectionKind;
+  DDS_Security_BasicProtectionKind data_protectionKind;
+  bool is_builtin_participant_volatile_message_secure_reader;
+} local_datareader_crypto;
+
+typedef struct remote_datareader_crypto
+{
+  CryptoObject _parent;
+  remote_participant_crypto *participant;
+  DDS_Security_ProtectionKind metadata_protectionKind;
+  DDS_Security_BasicProtectionKind data_protectionKind;
+  master_key_material *reader2writer_key_material;
+  master_key_material *writer2reader_key_material_message;
+  master_key_material *writer2reader_key_material_payload;
+  session_key_material *writer_session; /* reference to the session key used by the writer */
+  DDS_Security_DatawriterCryptoHandle local_writer_handle;
+  bool is_builtin_participant_volatile_message_secure_reader;
+} remote_datareader_crypto;
+
+master_key_material *
+crypto_master_key_material_new(DDS_Security_CryptoTransformKind_Enum transform_kind);
+
+void crypto_master_key_material_set(
+    master_key_material *dst,
+    const master_key_material *src);
+
+session_key_material *
+crypto_session_key_material_new(
+    master_key_material *master_key);
+
+bool crypto_session_key_material_update(
+    session_key_material *session,
+    uint32_t size,
+    DDS_Security_SecurityException *ex);
+
+local_participant_crypto *
+crypto_local_participant_crypto__new(
+    DDS_Security_IdentityHandle participant_identity);
+
+remote_participant_crypto *
+crypto_remote_participant_crypto__new(
+    DDS_Security_IdentityHandle participant_identity);
+
+void crypto_object_init(
+    CryptoObject *obj,
+    CryptoObjectKind_t kind,
+    CryptoObjectDestructor destructor);
+
+endpoint_relation *
+crypto_endpoint_relation_new(
+    DDS_Security_SecureSubmessageCategory_t kind,
+    uint32_t key_id,
+    CryptoObject *local_crypto,
+    CryptoObject *remote_crypto);
+
+endpoint_relation *
+crypto_endpoint_relation_find_by_key(
+    struct CryptoObjectTable *table,
+    uint32_t key_id);
+
+endpoint_relation *
+crypto_endpoint_relation_find_by_crypto(
+    struct CryptoObjectTable *table,
+    CryptoObject *local_crypto,
+    CryptoObject *remote_crypto);
+
+bool endpoint_relation_get_locals(
+    const endpoint_relation *relation,
+    const local_participant_crypto *participant,
+    DDS_Security_HandleSeq *list);
+
+local_datawriter_crypto *
+crypto_local_datawriter_crypto__new(
+    const local_participant_crypto *participant,
+    DDS_Security_ProtectionKind meta_protection,
+    DDS_Security_BasicProtectionKind data_protection);
+
+remote_datareader_crypto *
+crypto_remote_datareader_crypto__new(
+    const remote_participant_crypto *participant,
+    DDS_Security_ProtectionKind metadata_protectionKind,
+    DDS_Security_BasicProtectionKind data_protectionKind,
+    DDS_Security_DatawriterCryptoHandle local_writer_handle);
+
+local_datareader_crypto *
+crypto_local_datareader_crypto__new(
+    const local_participant_crypto *participant,
+    DDS_Security_ProtectionKind meta_protection,
+    DDS_Security_BasicProtectionKind data_protection);
+
+remote_datawriter_crypto *
+crypto_remote_datawriter_crypto__new(
+    const remote_participant_crypto *participant,
+    DDS_Security_ProtectionKind meta_protection,
+    DDS_Security_BasicProtectionKind data_protection,
+    DDS_Security_DatareaderCryptoHandle local_reader_handle);
+
+CryptoObject *
+crypto_object_keep(
+    CryptoObject *obj);
+
+void crypto_object_release(
+    CryptoObject *obj);
+
+bool crypto_object_valid(
+    CryptoObject *obj,
+    CryptoObjectKind_t kind);
+
+void crypto_object_free(
+    CryptoObject *obj);
+
+local_participant_crypto *
+crypto_local_participant_crypto__new(
+    DDS_Security_IdentityHandle participant_identity);
+
+remote_participant_crypto *
+crypto_remote_participant_crypto__new(
+    DDS_Security_IdentityHandle participant_identity);
+
+participant_key_material *
+crypto_participant_key_material_new(
+    const local_participant_crypto *pplocal);
+
+struct CryptoObjectTable;
+
+typedef uint32_t (*CryptoObjectHashFunction)(const void *obj);
+typedef int (*CryptoObjectEqualFunction)(const void *ha, const void *hb);
+typedef CryptoObject *(*CryptoObjectFindFunction)(const struct CryptoObjectTable *table, const void *arg);
+
+struct CryptoObjectTable *
+crypto_object_table_new(
+    CryptoObjectHashFunction hashfnc,
+    CryptoObjectEqualFunction equalfnc,
+    CryptoObjectFindFunction findfnc);
+
+void crypto_object_table_free(
+    struct CryptoObjectTable *table);
+
+CryptoObject *
+crypto_object_table_insert(
+    struct CryptoObjectTable *table,
+    CryptoObject *object);
+
+void crypto_object_table_remove_object(
+    struct CryptoObjectTable *table,
+    CryptoObject *object);
+
+CryptoObject *
+crypto_object_table_remove(
+    struct CryptoObjectTable *table,
+    int64_t handle);
+
+CryptoObject *
+crypto_object_table_find_by_template(
+    const struct CryptoObjectTable *table,
+    const void *template);
+
+CryptoObject *
+crypto_object_table_find(
+    struct CryptoObjectTable *table,
+    int64_t handle);
+
+typedef int (*CryptoObjectTableCallback)(CryptoObject *obj, void *arg);
+
+struct CryptoObjectTable
+{
+  struct ddsrt_hh *htab;
+  ddsrt_mutex_t lock;
+  CryptoObjectFindFunction findfnc;
+};
+
+void crypto_object_table_walk(
+    struct CryptoObjectTable *table,
+    CryptoObjectTableCallback callback,
+    void *arg);
+
+#endif /* CRYPTO_OBJECTS_H */
diff --git a/src/security/builtin_plugins/cryptographic/src/crypto_transform.c b/src/security/builtin_plugins/cryptographic/src/crypto_transform.c
new file mode 100644
index 0000000..f27ea24
--- /dev/null
+++ b/src/security/builtin_plugins/cryptographic/src/crypto_transform.c
@@ -0,0 +1,2469 @@
+/*
+ * Copyright(c) 2006 to 2019 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+#include <assert.h>
+#include <stdint.h>
+#include <string.h>
+#include <openssl/err.h>
+#include <openssl/evp.h>
+#include "dds/ddsrt/bswap.h"
+#include "dds/ddsrt/endian.h"
+#include "dds/ddsrt/heap.h"
+#include "dds/ddsrt/types.h"
+#include "dds/security/dds_security_api.h"
+#include "dds/security/core/dds_security_utils.h"
+#include "cryptography.h"
+#include "crypto_cipher.h"
+#include "crypto_defs.h"
+#include "crypto_key_factory.h"
+#include "crypto_objects.h"
+#include "crypto_transform.h"
+#include "crypto_utils.h"
+
+#define CRYPTO_ENCRYPTION_MAX_PADDING 32
+#define CRYPTO_FOOTER_BASIC_SIZE (CRYPTO_HMAC_SIZE + sizeof(uint32_t))
+#define INFO_SRC_SIZE 24
+#define INFO_SRC_HDR_SIZE 8
+#define RTPS_HEADER_SIZE 20
+
+#if OPENSSL_VERSION_NUMBER >= 0x10000000L && OPENSSL_VERSION_NUMBER < 0x10100000L
+#define REMOVE_THREAD_STATE() ERR_remove_thread_state(NULL);
+#elif OPENSSL_VERSION_NUMBER < 0x10000000L
+#define REMOVE_THREAD_STATE() ERR_remove_state(0);
+#else
+#define REMOVE_THREAD_STATE()
+#endif
+
+struct submsg_header
+{
+  unsigned char id;
+  unsigned char flags;
+  uint16_t length;
+};
+
+struct crypto_header
+{
+  struct CryptoTransformIdentifier transform_identifier;
+  unsigned char session_id[CRYPTO_SESSION_ID_SIZE];
+  unsigned char init_vector_suffix[CRYPTO_INIT_VECTOR_SUFFIX_SIZE];
+};
+
+struct crypto_contents
+{
+  uint32_t _length;
+  unsigned char _data[1];
+};
+
+struct crypto_contents_ref
+{
+  uint32_t _length;
+  unsigned char *_data;
+};
+
+struct receiver_specific_mac
+{
+  DDS_Security_CryptoTransformKeyId receiver_mac_key_id;
+  crypto_hmac_t receiver_mac;
+};
+
+struct receiver_specific_mac_seq
+{
+  uint32_t _length;
+  struct receiver_specific_mac _buffer[1];
+};
+
+struct crypto_footer
+{
+  crypto_hmac_t common_mac;
+  struct receiver_specific_mac_seq receiver_specific_macs;
+};
+
+struct encrypted_data
+{
+  uint32_t length;
+  unsigned char data[1];
+};
+
+/*
+const DDS_octet INFO_SRC_HDR[] =
+   {
+         RTPS_Message_Type_INFO_SRC,
+         0x00, // BIG ENDIAN
+         0x14,
+         0x00,
+         0x00,
+         0x00,
+         0x00,
+         0x00
+   };
+*/
+
+
+/**
+ * Implementation structure for storing encapsulated members of the instance
+ * while giving only the interface definition to user
+ */
+typedef struct dds_security_crypto_transform_impl
+{
+  dds_security_crypto_transform base;
+  const dds_security_cryptography *crypto;
+} dds_security_crypto_transform_impl;
+
+static bool
+is_encryption_required(
+    uint32_t transform_kind)
+{
+  return ((transform_kind == CRYPTO_TRANSFORMATION_KIND_AES256_GCM) ||
+          (transform_kind == CRYPTO_TRANSFORMATION_KIND_AES128_GCM));
+}
+
+static bool
+is_authentication_required(
+    uint32_t transform_kind)
+{
+  return ((transform_kind == CRYPTO_TRANSFORMATION_KIND_AES256_GMAC) ||
+          (transform_kind == CRYPTO_TRANSFORMATION_KIND_AES128_GMAC));
+}
+
+static bool
+is_encryption_expected(
+    DDS_Security_ProtectionKind protection_kind)
+{
+  return ((protection_kind == DDS_SECURITY_PROTECTION_KIND_ENCRYPT) ||
+          (protection_kind == DDS_SECURITY_PROTECTION_KIND_ENCRYPT_WITH_ORIGIN_AUTHENTICATION));
+}
+
+static bool
+is_authentication_expected(
+    DDS_Security_ProtectionKind protection_kind)
+{
+  return ((protection_kind == DDS_SECURITY_PROTECTION_KIND_SIGN) ||
+          (protection_kind == DDS_SECURITY_PROTECTION_KIND_SIGN_WITH_ORIGIN_AUTHENTICATION));
+}
+
+static bool
+has_origin_authentication(
+    DDS_Security_ProtectionKind kind)
+{
+  return ((kind == DDS_SECURITY_PROTECTION_KIND_SIGN_WITH_ORIGIN_AUTHENTICATION) || (kind == DDS_SECURITY_PROTECTION_KIND_ENCRYPT_WITH_ORIGIN_AUTHENTICATION));
+}
+
+static inline bool
+crypto_buffer_read_uint32(
+    uint32_t *value,
+    unsigned char **ptr,
+    uint32_t *remain)
+{
+  if ((*remain) < sizeof(uint32_t))
+    return false;
+
+  *value = ddsrt_fromBE4u(*(uint32_t *)(*ptr));
+  (*ptr) += sizeof(uint32_t);
+  (*remain) -= (uint32_t)sizeof(uint32_t);
+
+  return true;
+}
+
+static inline bool
+crypto_buffer_read_bytes(
+    unsigned char *bytes,
+    uint32_t num,
+    unsigned char **ptr,
+    uint32_t *remain)
+{
+  if ((*remain) < num)
+    return false;
+  memcpy(bytes, *ptr, num);
+  (*ptr) += num;
+  (*remain) -= num;
+
+  return true;
+}
+
+
+/**
+ * Increase the length of the submessage
+ * When the buffer does not contain enough memory the
+ * buffer is reallocated with the increased size.
+ * The function returns the submessage which may
+ * be reallocated in memory.
+ */
+static struct submsg_header *
+append_submessage(
+    DDS_Security_OctetSeq *seq,
+    struct submsg_header *msg,
+    size_t size)
+{
+  assert ((size_t)msg->length + size <= UINT16_MAX);
+  if (size + seq->_length > seq->_maximum)
+  {
+    size_t l = seq->_length + size;
+    unsigned char *ptr = seq->_buffer;
+    size_t offset = (size_t)(((unsigned char *)msg) - ptr);
+
+    seq->_buffer = ddsrt_realloc(ptr, l);
+    seq->_maximum = (DDS_Security_unsigned_long)l;
+    msg = (struct submsg_header *)&seq->_buffer[offset];
+  }
+  seq->_length += (uint32_t)size;
+  msg->length = (uint16_t)(msg->length + size);
+
+  return msg;
+}
+
+/**
+ * Add a new submessage to the tail of the supplied buffer.
+ * When the supplied buffer does not contain enough memory
+ * it will be reallocated.
+ * The buffer's maximum indicated the total size of the
+ * buffer. The buffer's length indicates the used size.
+ *
+ * @param[in] seq   Buffer
+ * @param[in] id    Submessage id
+ * @param[in] flags Indicates big or little endian
+ * @param[in] size  The octetToNextSubmessage
+ */
+static struct submsg_header *
+add_submessage(
+    DDS_Security_OctetSeq *seq,
+    unsigned char id,
+    unsigned char flags,
+    size_t size)
+{
+  struct submsg_header *msg;
+  size_t len = sizeof(struct submsg_header) + size;
+  assert (size <= UINT16_MAX);
+
+  if (len + seq->_length > seq->_maximum)
+  {
+    size_t l = len + seq->_length;
+    unsigned char *ptr = seq->_buffer;
+    seq->_buffer = ddsrt_realloc (ptr, l);
+    seq->_maximum = (DDS_Security_unsigned_long)l;
+  }
+
+  msg = (struct submsg_header *)&seq->_buffer[seq->_length];
+  msg->id = id;
+  msg->flags = flags;
+  msg->length = (uint16_t)size;
+  seq->_length += (uint32_t)len;
+
+  return msg;
+}
+
+/**
+ * @brief Adds info_src content after info_src header and returns next available location
+ */
+static bool
+add_info_src(
+    DDS_Security_OctetSeq *seq,
+    unsigned char *rtps_header,
+    unsigned char flags)
+{
+  struct submsg_header *info_src_hdr = add_submessage(seq, SMID_SRTPS_INFO_SRC_KIND,
+    flags, INFO_SRC_SIZE - sizeof(struct submsg_header));
+  unsigned char *ptr = (unsigned char *)(info_src_hdr + 1);
+  memset(ptr, 0, 4); /* skip unused bytes */
+  memcpy(ptr + 4, rtps_header + 4, INFO_SRC_SIZE - sizeof(struct submsg_header) - 4);
+  return true;
+}
+
+static bool
+read_rtps_header(
+    DDS_Security_OctetSeq *rtps_header,
+    unsigned char **ptr,
+    uint32_t *remain)
+{
+  if ((*remain) > RTPS_HEADER_SIZE)
+  {
+    rtps_header->_buffer = *ptr;
+    rtps_header->_length = rtps_header->_maximum = RTPS_HEADER_SIZE;
+    (*ptr) += RTPS_HEADER_SIZE;
+    (*remain) -= RTPS_HEADER_SIZE;
+    return true;
+  }
+
+  return false;
+}
+
+/**
+ * Initialize the remote session info which is used
+ * to decode a received message. It will calculate the
+ * session key from the received crypto_header.
+ *
+ * @param[in,out] info                The remote session information which is determined by this function
+ * @param[in]     header              The received crypto_header
+ * @param[in]     master_salt         The master_salt associated with the remote entity
+ * @param[in]     master_key          The master_key associated with the remote entity
+ * @param[in]     transformation_kind The transformation kind (to determine key and salt size)
+ * @param[in,out] ex                  Security exception
+ */
+static bool
+initialize_remote_session_info(
+    remote_session_info *info,
+    struct crypto_header *header,
+    const unsigned char *master_salt,
+    const unsigned char *master_key,
+    DDS_Security_CryptoTransformKind_Enum transformation_kind,
+    DDS_Security_SecurityException *ex)
+{
+  info->key_size = crypto_get_key_size (transformation_kind);
+  info->id = CRYPTO_TRANSFORM_ID(header->session_id);
+  return crypto_calculate_session_key(&info->key, info->id, master_salt, master_key, transformation_kind, ex);
+}
+
+static bool transform_kind_valid(DDS_Security_CryptoTransformKind_Enum kind)
+{
+  return ((kind == CRYPTO_TRANSFORMATION_KIND_AES128_GMAC) ||
+          (kind == CRYPTO_TRANSFORMATION_KIND_AES128_GCM) ||
+          (kind == CRYPTO_TRANSFORMATION_KIND_AES256_GMAC) ||
+          (kind == CRYPTO_TRANSFORMATION_KIND_AES256_GCM));
+}
+
+/**
+ * @brief Read the crypto_header from the received data buffer
+ *
+ * @param[in]     header  The returned crypto_header
+ * @param[in,out] ptr     Current read pointer in the received buffer
+ * @param[in,out] remain  Remaining size in the received buffer
+ */
+static bool
+read_crypto_header(
+    struct crypto_header *header,
+    unsigned char **ptr,
+    uint32_t *remain)
+{
+  return crypto_buffer_read_bytes((unsigned char *)header, sizeof(*header), ptr, remain);
+}
+
+/**
+ * @brief Read the payload from the received data buffer
+ *
+ * @param[in,out] contents  The returned payload
+ * @param[in]     ptr       Current read pointer in the received buffer
+ * @param[in]     size      Remaining size in the received buffer
+ */
+static DDS_Security_boolean
+read_crypto_contents(
+    struct crypto_contents_ref *contents,
+    unsigned char *ptr,
+    uint32_t size)
+{
+  bool result = false;
+
+  if (crypto_buffer_read_uint32(&contents->_length, &ptr, &size))
+  {
+    contents->_data = ptr;
+    if (size == contents->_length)
+      result = true;
+  }
+  return result;
+}
+
+/**
+ * Read the crypto_footer from the received data buffer
+ * The size of the footer depends on the number of
+ * receiver specific macs present in the message.
+ *
+ * @param[in,out] footer  The returned crypto_footer
+ * @param[in,out] ptr     Current read pointer in the received buffer
+ * @param[in,out] remain  Remaining size in the received buffer
+ */
+static bool
+read_crypto_footer(
+    struct crypto_footer **footer,
+    unsigned char **ptr,
+    uint32_t *remain)
+{
+  uint32_t len;
+  size_t sz;
+  struct crypto_footer *ft;
+  crypto_hmac_t common_mac;
+
+  if (!crypto_buffer_read_bytes(common_mac.data, CRYPTO_HMAC_SIZE, ptr, remain) ||
+      !crypto_buffer_read_uint32(&len, ptr, remain))
+    return false;
+
+  if (len > (*remain))
+    return false;
+
+  sz = CRYPTO_HMAC_SIZE + sizeof(uint32_t) + len * sizeof(struct receiver_specific_mac);
+  ft = ddsrt_malloc(sz);
+
+  memcpy(ft->common_mac.data, common_mac.data, CRYPTO_HMAC_SIZE);
+  ft->receiver_specific_macs._length = len;
+
+  if (len > 0)
+  {
+    sz = len * sizeof(struct receiver_specific_mac);
+    if (!crypto_buffer_read_bytes((unsigned char *)&ft->receiver_specific_macs._buffer[0], (uint32_t)sz, ptr, remain))
+    {
+      ddsrt_free(ft);
+      *footer = NULL;
+      return false;
+    }
+  }
+
+  *footer = ft;
+  return true;
+}
+
+/**
+ * @brief Read the submessage header from the received data buffer
+ *
+ * @param[in,out] submsg  The returned submessage header
+ * @param[in,out] ptr     Current read pointer in the received buffer
+ * @param[in,out] remain  Remaining size in the received buffer
+ */
+static bool
+read_submsg_header(
+    struct submsg_header *submsg,
+    unsigned char **ptr,
+    uint32_t *remain)
+{
+  int swap;
+  bool result = crypto_buffer_read_bytes((unsigned char *)submsg, sizeof(*submsg), ptr, remain);
+  if (result)
+  {
+    if ((submsg->flags & 0x01) == 0)
+      swap = (DDSRT_ENDIAN == DDSRT_LITTLE_ENDIAN);
+    else
+      swap = (DDSRT_ENDIAN != DDSRT_LITTLE_ENDIAN);
+    submsg->length = swap ? ddsrt_bswap2u(submsg->length) : submsg->length;
+    if ((uint32_t)(submsg->length) > (*remain))
+      result = false;
+  }
+
+  return result;
+}
+
+/**
+ * @brief Used by the decode_serialized_payload function to split the received message in the composed components:
+ *
+ * @param[in]     payload     The received serialized payload
+ * @param[in]     header      The crypto_header contained in the payload
+ * @param[in,out] payload_ptr The actual payload (either encoded or plain)
+ * @param[in,out] payload_len Length of the payload
+ * @param[in,out] footer      The crypto_footer contained in the payload
+ */
+static bool
+split_encoded_serialized_payload(
+    const DDS_Security_OctetSeq *payload,
+    struct crypto_header *header,
+    unsigned char **payload_ptr,
+    uint32_t *payload_len,
+    struct crypto_footer **footer)
+{
+  /* For data, the footer is always the same length. */
+  const uint32_t footer_len = CRYPTO_HMAC_SIZE + sizeof(uint32_t);
+  unsigned char *ptr = payload->_buffer;
+  uint32_t remain = payload->_length;
+
+  /* Get header. */
+  if (read_crypto_header(header, &ptr, &remain))
+  {
+    if (remain >= footer_len)
+    {
+      /* Get contents. */
+      *payload_ptr = ptr;
+      *payload_len = remain - footer_len;
+      /* Get footer. */
+      ptr = (*payload_ptr) + (*payload_len);
+      remain = footer_len;
+      if (read_crypto_footer(footer, &ptr, &remain))
+        return true;
+    }
+  }
+
+  return false;
+}
+
+/**
+ * @brief Read the SEC_PREFIX submessage from a received message
+ *
+ * @param[in,out] prefix    The contents of the SEC_PREFIX submessage header
+ * @param[in,out] header    The crypto_header contained in the SEC_PREFIX submessage
+ * @param[in,out] ptr       Current read pointer in the received buffer
+ * @param[in,out] remain    Remaining size in the received buffer
+ * @param[in]     expected  Expected submessage kind
+ */
+static bool
+read_prefix_submessage(
+    struct submsg_header *prefix,
+    struct crypto_header *header,
+    unsigned char **ptr,
+    uint32_t *remain,
+    enum SecureSubmsgKind_t expected)
+{
+  uint32_t datalen;
+
+  if (!read_submsg_header(prefix, ptr, remain))
+    return false;
+
+  if (prefix->id != expected)
+    return false;
+
+  datalen = prefix->length;
+  if (datalen != sizeof(struct crypto_header))
+    return false;
+
+  if (!read_crypto_header(header, ptr, remain))
+    return false;
+
+  return true;
+}
+
+/**
+ * @brief Read the SEC_POSTFIX submessage from a received message
+ *
+ * @param[in,out] postfix   The contents of the SEC_POSTFIX submessage header
+ * @param[in,out] footer    The crypto_footer contained in the SEC_POSTFIX submessage
+ * @param[in,out] ptr       Current read pointer in the received buffer
+ * @param[in,out] remain    Remaining size in the received buffer
+ * @param[in]     expected  Expected submessage kind
+ */
+static bool
+read_postfix_submessage(
+    struct submsg_header *postfix,
+    struct crypto_footer **footer,
+    unsigned char **ptr,
+    uint32_t *remain,
+    enum SecureSubmsgKind_t expected)
+{
+  uint32_t datalen;
+  size_t sz;
+
+  if (!read_submsg_header(postfix, ptr, remain))
+    return false;
+
+  if (postfix->id != expected)
+    return false;
+
+  datalen = postfix->length;
+
+  if (!read_crypto_footer(footer, ptr, remain))
+    return false;
+
+  sz = CRYPTO_FOOTER_BASIC_SIZE + (*footer)->receiver_specific_macs._length * sizeof(struct receiver_specific_mac);
+
+  if (datalen != sz)
+  {
+    ddsrt_free(*footer);
+    *footer = NULL;
+    return false;
+  }
+
+  return true;
+}
+
+/**
+ * Read the body submessage from a received message
+ * The message received may be encoded or not. When encoded
+ * a SEC_BODY submessage is present otherwise the original
+ * submessage is present. When a SEC_BODY submessage is present
+ * the contents will be set to the contents of the SEC_BODY otherwise
+ * the contents will be set to the submessage itself.
+ *
+ * @param[in,out] body      The contents of the body submessage header
+ * @param[in,out] contents  The contents of the SEC_BODY submessage or the submessage itself
+ * @param[in,out] ptr       Current read pointer in the received buffer
+ * @param[in,out] remain    Remaining size in the received buffer
+ */
+static bool
+read_body_submessage(
+    struct submsg_header *body,
+    struct crypto_contents_ref *contents,
+    unsigned char **ptr,
+    uint32_t *remain)
+{
+  uint32_t datalen;
+  struct encrypted_data *encrypted;
+
+  contents->_data = *ptr;
+
+  if (!read_submsg_header(body, ptr, remain))
+    return false;
+
+  datalen = body->length;
+  if (body->id == SMID_SEC_BODY_KIND)
+  {
+    encrypted = (struct encrypted_data *)*ptr;
+    contents->_length = ddsrt_fromBE4u(encrypted->length);
+    contents->_data = encrypted->data;
+    if (contents->_length > datalen)
+      return false;
+  }
+  else
+  {
+    contents->_length = datalen + (uint32_t)sizeof(struct submsg_header);
+  }
+
+  if ((*remain) < datalen)
+    return false;
+
+  (*ptr) += datalen;
+  (*remain) -= datalen;
+
+  return true;
+}
+
+/**
+ * body is invalid if not encrypted
+ * info_src is invalid if encrypted
+ */
+static bool
+read_rtps_body(
+    struct submsg_header *body,
+    struct crypto_contents_ref *contents,
+    DDS_Security_CryptoTransformKind_Enum transformation_kind,
+    unsigned char **ptr,
+    uint32_t *remain)
+{
+  uint32_t datalen;
+  struct submsg_header submessage_header;
+
+  if (is_encryption_required(transformation_kind))
+  { /*read sec body */
+    if (!read_body_submessage(body, contents, ptr, remain) || body->id != SMID_SEC_BODY_KIND)
+      return false;
+  }
+  else
+  {
+    unsigned char *body_start_with_info = *ptr;
+    bool arrived_to_postfix = false;
+
+    if (!read_submsg_header(&submessage_header, ptr, remain) || submessage_header.id != SMID_SRTPS_INFO_SRC_KIND)
+      return false;
+
+    (*ptr) += submessage_header.length;
+    (*remain) -= submessage_header.length;
+
+    while (*remain > sizeof(struct submsg_header) && !arrived_to_postfix)
+    {
+      if (!read_submsg_header(&submessage_header, ptr, remain))
+        return false;
+
+      if (submessage_header.id != SMID_SRTPS_POSTFIX_KIND)
+      {
+        (*ptr) += submessage_header.length;
+        (*remain) -= submessage_header.length;
+      }
+      else
+      {
+        /*revert last read*/
+        (*ptr) -= sizeof(struct submsg_header);
+        (*remain) += (uint32_t)sizeof(struct submsg_header);
+        arrived_to_postfix = true;
+      }
+    }
+
+    if (!arrived_to_postfix)
+      return false;
+
+    datalen = (uint32_t)(*ptr - body_start_with_info); /* rtps submessage + info_src + body data*/
+    contents->_data = body_start_with_info;
+    contents->_length = datalen;
+  }
+
+  return true;
+}
+
+/**
+ * @brief Split a received message is the various components
+ *
+ * @param[in]     data      Buffer containing the received message
+ * @param[in]     prefix    The SEC_PREFIX submessage header
+ * @param[in]     body      The body submessage, either SEC_BODY or the not encoded submessage
+ * @param[in]     postfix   The SEC_POSTFIX submessage header
+ * @param[in]     header    Crypto_header contained in the SEC_PREFIX submessage
+ * @param[in]     contents  Crypto contents
+ * @param[in,out] footer    Crypto_footer contained in the SEC_POSTFIX submessage
+ */
+static bool
+split_encoded_submessage(
+    const DDS_Security_OctetSeq *data,
+    struct submsg_header *prefix,
+    struct submsg_header *body,
+    struct submsg_header *postfix,
+    struct crypto_header *header,
+    struct crypto_contents_ref *contents,
+    struct crypto_footer **footer)
+{
+  unsigned char *ptr = data->_buffer;
+  uint32_t remain = data->_length;
+  *footer = NULL;
+
+  return (read_prefix_submessage(prefix, header, &ptr, &remain, SMID_SEC_PREFIX_KIND) &&
+      read_body_submessage(body, contents, &ptr, &remain) &&
+      read_postfix_submessage(postfix, footer, &ptr, &remain, SMID_SEC_POSTFIX_KIND));
+}
+
+static bool
+split_encoded_rtps_message(
+    const DDS_Security_OctetSeq *data,
+    DDS_Security_OctetSeq *rtps_header,
+    struct submsg_header *prefix,
+    struct submsg_header *body,
+    struct submsg_header *postfix,
+    struct crypto_header *header,
+    struct crypto_contents_ref *contents,
+    struct crypto_footer **footer)
+{
+  unsigned char *ptr = data->_buffer;
+  uint32_t remain = data->_length;
+  uint32_t transform_kind;
+  *footer = NULL;
+  if (rtps_header->_buffer)
+    return false;
+  if (!read_rtps_header(rtps_header, &ptr, &remain))
+    return false;
+  if (!read_prefix_submessage(prefix, header, &ptr, &remain, SMID_SRTPS_PREFIX_KIND))
+    return false;
+
+  transform_kind = CRYPTO_TRANSFORM_KIND(header->transform_identifier.transformation_kind);
+
+  if (!read_rtps_body(body, contents, transform_kind, &ptr, &remain))
+    return false;
+  if (!read_postfix_submessage(postfix, footer, &ptr, &remain, SMID_SRTPS_POSTFIX_KIND))
+    return false;
+
+  return true;
+}
+
+/**
+ * @brief Initialize the crypto_header
+ */
+static void
+set_crypto_header(
+    struct crypto_header *header,
+    uint32_t transform_kind,
+    uint32_t transform_id,
+    uint32_t session_id,
+    uint64_t init_vector_suffx)
+{
+  struct
+  {
+    uint32_t tkind;
+    uint32_t tid;
+    uint32_t sid;
+    uint32_t ivh;
+    uint32_t ivl;
+  } s;
+  uint64_t ivs = ddsrt_toBE8u(init_vector_suffx);
+
+  s.tkind = ddsrt_toBE4u(transform_kind);
+  s.tid = ddsrt_toBE4u(transform_id);
+  s.sid = ddsrt_toBE4u(session_id);
+  s.ivh = (uint32_t)(ivs >> 32);
+  s.ivl = (uint32_t)ivs;
+
+  memcpy(header, &s, sizeof(*header));
+}
+
+/*
+ * Function implementations
+ */
+
+static DDS_Security_boolean
+encode_serialized_payload(
+    dds_security_crypto_transform *instance,
+    DDS_Security_OctetSeq *encoded_buffer,
+    DDS_Security_OctetSeq *extra_inline_qos,
+    const DDS_Security_OctetSeq *plain_buffer,
+    const DDS_Security_DatawriterCryptoHandle writer_id,
+    DDS_Security_SecurityException *ex)
+{
+  dds_security_crypto_transform_impl *impl = (dds_security_crypto_transform_impl *)instance;
+  dds_security_crypto_key_factory *factory;
+  session_key_material *session;
+  struct crypto_header *header;
+  struct crypto_contents *contents = NULL;
+  struct crypto_footer *footer;
+  unsigned char *buffer;
+  unsigned char *payload;
+  crypto_hmac_t hmac;
+  uint32_t payload_len;
+  uint32_t transform_kind, transform_id;
+  size_t size, offset;
+
+  DDSRT_UNUSED_ARG(extra_inline_qos);
+
+  memset(hmac.data, 0, sizeof(crypto_hmac_t));
+
+  if (!instance || !encoded_buffer || !plain_buffer || plain_buffer->_length == 0 || writer_id == 0)
+  {
+    DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_CRYPTO_ARGUMENT_CODE, 0,
+        "encode_serialized_payload: " DDS_SECURITY_ERR_INVALID_CRYPTO_ARGUMENT_MESSAGE);
+    goto fail_inv_arg;
+  }
+
+  /* check if the payload is aligned on a 4 byte boundary */
+  if ((plain_buffer->_length % 4) != 0)
+  {
+    DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_CRYPTO_DATA_NOT_ALIGNED_CODE, 0,
+        "encode_serialized_payload: " DDS_SECURITY_ERR_INVALID_CRYPTO_DATA_NOT_ALIGNED_MESSAGE);
+    goto fail_inv_arg;
+  }
+
+  /* Retrieve key material from sending_datawriter_crypto from factory */
+  factory = cryptography_get_crypto_key_factory(impl->crypto);
+  if (!crypto_factory_get_writer_key_material(factory, writer_id, 0, true, &session, NULL, ex))
+    goto fail_inv_arg;
+
+  if (!session)
+  {
+    DDS_Security_OctetSeq_copy(encoded_buffer, plain_buffer);
+    return true;
+  }
+
+  transform_kind = session->master_key_material->transformation_kind;
+  transform_id = session->master_key_material->sender_key_id;
+
+  if (!is_encryption_required(transform_kind) && !is_authentication_required(transform_kind))
+  {
+    DDS_Security_OctetSeq_copy(encoded_buffer, plain_buffer);
+    CRYPTO_OBJECT_RELEASE(session);
+    return true;
+  }
+
+  /* update sessionKey when needed */
+  if (!crypto_session_key_material_update(session, plain_buffer->_length, ex))
+    goto fail_update_key;
+
+  /* increment init_vector_suffix */
+  session->init_vector_suffix++;
+
+  /*
+     * allocate buffer for encoded data, size includes:
+     * - CryptoHeader
+     * if (encrypted) {
+     *   - CryptoContents : size of the data + cypher block_size + 1
+     * } else {
+     *   - Plain payload
+     * }
+     * - CryptoFooter
+     * See spec: 9.5.3.3.4.4 Result from encode_serialized_payload
+     * Make sure to allocate enough memory for both options.
+     */
+  size = sizeof(*header) + sizeof(*contents) + sizeof(*footer) + plain_buffer->_length + session->block_size + 1;
+  buffer = ddsrt_malloc(size);
+  header = (struct crypto_header *)buffer;
+  payload = &buffer[sizeof(*header)];
+
+  /* create CryptoHeader */
+  set_crypto_header(header, transform_kind, transform_id, session->id, session->init_vector_suffix);
+
+  /* if the transformation_kind indicates encryption then encrypt the buffer */
+  payload_len = 0;
+  if (is_encryption_required(transform_kind))
+  {
+    contents = (struct crypto_contents *)payload;
+    if (!crypto_cipher_encrypt_data(&session->key, session->key_size, header->session_id, plain_buffer->_buffer, plain_buffer->_length, NULL, 0, contents->_data, &payload_len, &hmac, ex))
+      goto fail_encrypt;
+    contents->_length = ddsrt_toBE4u(payload_len);
+    payload_len += (uint32_t)sizeof(uint32_t);
+  }
+  else if (is_authentication_required(transform_kind))
+  {
+    /* the transformation_kind indicates only indicates authentication the determine HMAC */
+    if (!crypto_cipher_encrypt_data(&session->key, session->key_size, header->session_id, NULL, 0, plain_buffer->_buffer, plain_buffer->_length, NULL, NULL, &hmac, ex))
+      goto fail_encrypt;
+    memcpy(payload, plain_buffer->_buffer, plain_buffer->_length);
+    payload_len = plain_buffer->_length;
+  }
+  else
+  {
+    DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_CRYPTO_ARGUMENT_CODE, 0,
+        "encode_serialized_payload: unknown transform_kind %d", (int)transform_kind);
+    goto fail_encrypt;
+  }
+
+  /* create CryptoFooter */
+  offset = sizeof(*header) + payload_len;
+  footer = (struct crypto_footer *)(buffer + offset);
+  memset(footer, 0, sizeof(*footer));
+  memcpy(footer->common_mac.data, hmac.data, CRYPTO_HMAC_SIZE);
+
+  size = offset + CRYPTO_HMAC_SIZE + sizeof(uint32_t);
+
+  encoded_buffer->_length = encoded_buffer->_maximum = (uint32_t)size;
+  encoded_buffer->_buffer = buffer;
+
+  CRYPTO_OBJECT_RELEASE(session);
+
+  return true;
+
+fail_encrypt:
+  ddsrt_free(buffer);
+fail_update_key:
+  CRYPTO_OBJECT_RELEASE(session);
+fail_inv_arg:
+  return false;
+}
+
+static bool
+add_reader_specific_mac(
+    DDS_Security_OctetSeq *data,
+    struct submsg_header *postfix,
+    master_key_material *key_material,
+    session_key_material *session,
+    DDS_Security_ProtectionKind protection_kind,
+    DDS_Security_SecurityException *ex)
+{
+  bool result = true;
+  struct submsg_header *prefix;
+  struct crypto_header *header;
+  struct crypto_footer *footer;
+  crypto_session_key_t key;
+  crypto_hmac_t hmac;
+
+  if (has_origin_authentication(protection_kind))
+  {
+    uint32_t index;
+
+    postfix = append_submessage(data, postfix, sizeof(struct receiver_specific_mac));
+    /* determine header crypto header because the append operation may have changed the buffer location */
+    prefix = (struct submsg_header *)data->_buffer;
+    header = (struct crypto_header *)(prefix + 1);
+    footer = (struct crypto_footer *)(postfix + 1);
+    index = ddsrt_fromBE4u(footer->receiver_specific_macs._length);
+
+    if (!crypto_calculate_receiver_specific_key(&key, session->id, key_material->master_salt, key_material->master_receiver_specific_key, key_material->transformation_kind, ex) ||
+        !crypto_cipher_encrypt_data(&key, session->key_size, header->session_id, NULL, 0, footer->common_mac.data, CRYPTO_HMAC_SIZE, NULL, NULL, &hmac, ex))
+    {
+      result = false;
+    }
+    else
+    {
+      uint32_t key_id = ddsrt_toBE4u(key_material->receiver_specific_key_id);
+      memcpy(footer->receiver_specific_macs._buffer[index].receiver_mac.data, hmac.data, CRYPTO_HMAC_SIZE);
+      memcpy(footer->receiver_specific_macs._buffer[index].receiver_mac_key_id, &key_id, sizeof(key_id));
+      footer->receiver_specific_macs._length = ddsrt_toBE4u(++index);
+    }
+  }
+
+  return result;
+}
+
+static bool
+add_crypto_reader_specific_mac(
+    dds_security_crypto_key_factory *factory,
+    DDS_Security_OctetSeq *data,
+    DDS_Security_DatareaderCryptoHandle reader_crypto,
+    struct submsg_header *postfix,
+    DDS_Security_SecurityException *ex)
+{
+  bool result = true;
+  master_key_material *key_material = NULL;
+  session_key_material *session = NULL;
+  DDS_Security_ProtectionKind protection_kind;
+
+  if (!crypto_factory_get_remote_reader_sign_key_material(factory, reader_crypto, &key_material, &session, &protection_kind, ex))
+    return false;
+
+  result = add_reader_specific_mac(data, postfix, key_material, session, protection_kind, ex);
+
+  CRYPTO_OBJECT_RELEASE(session);
+  CRYPTO_OBJECT_RELEASE(key_material);
+
+  return result;
+}
+
+static bool
+add_receiver_specific_mac(
+    dds_security_crypto_key_factory *factory,
+    DDS_Security_OctetSeq *data,
+    DDS_Security_DatareaderCryptoHandle sending_participant_crypto,
+    DDS_Security_DatareaderCryptoHandle receiving_participant_crypto,
+    struct submsg_header *postfix,
+    DDS_Security_SecurityException *ex)
+{
+  bool result = true;
+  session_key_material *session = NULL;
+  struct submsg_header *prefix;
+  struct crypto_header *header;
+  struct crypto_footer *footer;
+  DDS_Security_ProtectionKind local_protection_kind;
+  DDS_Security_ProtectionKind remote_protection_kind;
+  crypto_session_key_t key;
+  crypto_hmac_t hmac;
+  participant_key_material *pp_key_material;
+
+  /* get local crypto and session*/
+  if (!crypto_factory_get_local_participant_data_key_material(factory, sending_participant_crypto, &session, &local_protection_kind, ex))
+    return false;
+
+  /* get remote crypto tokens */
+  if (!crypto_factory_get_participant_crypto_tokens(factory, sending_participant_crypto, receiving_participant_crypto, &pp_key_material, &remote_protection_kind, ex))
+  {
+    CRYPTO_OBJECT_RELEASE(session);
+    return false;
+  }
+
+  if (has_origin_authentication(remote_protection_kind))
+  {
+    uint32_t index;
+
+    postfix = append_submessage(data, postfix, sizeof(struct receiver_specific_mac));
+    /* determine header crypto header because the append operation may have changed the buffer location */
+    prefix = (struct submsg_header *)(data->_buffer + RTPS_HEADER_SIZE);
+    header = (struct crypto_header *)(prefix + 1);
+    footer = (struct crypto_footer *)(postfix + 1);
+    index = ddsrt_fromBE4u(footer->receiver_specific_macs._length);
+
+    if (!crypto_calculate_receiver_specific_key(&key, session->id, pp_key_material->local_P2P_key_material->master_salt,
+            pp_key_material->local_P2P_key_material->master_receiver_specific_key, pp_key_material->local_P2P_key_material->transformation_kind, ex) ||
+        !crypto_cipher_encrypt_data(&key, session->key_size, header->session_id, NULL, 0, footer->common_mac.data, CRYPTO_HMAC_SIZE, NULL, NULL, &hmac, ex))
+    {
+      result = false;
+    }
+    else
+    {
+      uint32_t key_id = ddsrt_toBE4u(pp_key_material->local_P2P_key_material->receiver_specific_key_id);
+      memcpy(footer->receiver_specific_macs._buffer[index].receiver_mac.data, hmac.data, CRYPTO_HMAC_SIZE);
+      memcpy(footer->receiver_specific_macs._buffer[index].receiver_mac_key_id, &key_id, sizeof(key_id));
+      footer->receiver_specific_macs._length = ddsrt_toBE4u(++index);
+    }
+  }
+  CRYPTO_OBJECT_RELEASE(pp_key_material);
+  CRYPTO_OBJECT_RELEASE(session);
+  return result;
+}
+
+static DDS_Security_boolean
+encode_datawriter_submessage_sign (
+    dds_security_crypto_key_factory *factory,
+    DDS_Security_OctetSeq *encoded_submsg,
+    const DDS_Security_DatareaderCryptoHandleSeq *reader_crypto_list,
+    int32_t *index,
+    DDS_Security_SecurityException *ex
+)
+{
+  DDS_Security_boolean result;
+  struct submsg_header *prefix = (struct submsg_header *)encoded_submsg->_buffer;
+  struct submsg_header *body = (struct submsg_header *)(((unsigned char *)prefix) + prefix->length + sizeof(struct submsg_header));
+  struct submsg_header *postfix = (struct submsg_header *)(((unsigned char *)body) + body->length + sizeof(struct submsg_header));
+
+  result = add_crypto_reader_specific_mac(factory, encoded_submsg, reader_crypto_list->_buffer[*index], postfix, ex);
+  if (result)
+    (*index)++;
+
+  return result;
+}
+
+static DDS_Security_boolean
+encode_datawriter_submessage_encrypt (
+    dds_security_crypto_key_factory *factory,
+    DDS_Security_OctetSeq *encoded_submsg,
+    const DDS_Security_OctetSeq *plain_submsg,
+    const DDS_Security_DatawriterCryptoHandle writer_crypto,
+    const DDS_Security_DatareaderCryptoHandleSeq *reader_crypto_list,
+    int32_t *index,
+    DDS_Security_SecurityException *ex
+)
+{
+  DDS_Security_DatareaderCryptoHandle reader_crypto = 0;
+  DDS_Security_OctetSeq data;
+  session_key_material *session = NULL;
+  DDS_Security_ProtectionKind protection_kind;
+  unsigned char flags;
+  unsigned char *contents;
+  crypto_hmac_t hmac;
+  uint32_t payload_len;
+  size_t size;
+  struct submsg_header *prefix;
+  struct crypto_header *header;
+  struct submsg_header *postfix;
+  struct submsg_header *body;
+  struct crypto_footer *footer;
+  uint32_t transform_kind, transform_id;
+  DDS_Security_boolean result = false;
+
+  if (reader_crypto_list->_length > 0)
+    reader_crypto = reader_crypto_list->_buffer[0];
+
+  if (!crypto_factory_get_writer_key_material(factory, writer_crypto, reader_crypto, false, &session, &protection_kind, ex))
+    goto enc_dw_submsg_fail_keymat;
+
+  /* Determine the size of the buffer
+        * When no encryption
+        * - submsg header SEC_PREFIX
+        * - crypto header
+        * - size of the plain_submsg
+        * - submsg header SEC_POSTFIX
+        * - crypto footer based on the size of the receiving_datareader_crypto_list
+        * When encryption is required:
+        * - submsg header SEC_PREFIX
+        * - crypto header
+        * - submsg header SEC_BODY
+        * - estimated size of the encoded submessage (size of the plain_submsg + some extra for possible padding
+        * - submsg header SEC_POSTFIX
+        * - crypto footer based on the size of the receiving_datareader_crypto_list
+        */
+
+  size = 2 * sizeof(struct submsg_header) + sizeof(struct crypto_header) + sizeof(struct crypto_footer) + ALIGN4(plain_submsg->_length);
+  size += reader_crypto_list->_length * CRYPTO_HMAC_SIZE;
+  /* assure that the buffer contains enough memory to accommodate the encrypted payload */
+  if (is_encryption_required(session->master_key_material->transformation_kind))
+    size += sizeof(struct submsg_header) + sizeof(uint32_t) + CRYPTO_ENCRYPTION_MAX_PADDING;
+
+  flags = (DDSRT_ENDIAN == DDSRT_LITTLE_ENDIAN) ? 0x01 : 0x00;
+
+  /* allocate a buffer to store the encoded submessage */
+  data._buffer = ddsrt_malloc(size);
+  data._length = 0;
+  data._maximum = (uint32_t)size;
+
+  /* Set the SEC_PREFIX and associated CryptoHeader */
+  prefix = add_submessage(&data, SMID_SEC_PREFIX_KIND, flags, sizeof(struct crypto_header));
+  header = (struct crypto_header *)(prefix + 1);
+  contents = (unsigned char *)(header + 1);
+
+  /* update sessionKey when needed */
+  if (!crypto_session_key_material_update(session, plain_submsg->_length, ex))
+    goto enc_dw_submsg_fail;
+
+  /* increment init_vector_suffix */
+  session->init_vector_suffix++;
+
+  transform_kind = session->master_key_material->transformation_kind;
+  transform_id = session->master_key_material->sender_key_id;
+
+  set_crypto_header(header, transform_kind, transform_id, session->id, session->init_vector_suffix);
+
+  if (is_encryption_required(transform_kind))
+  {
+    struct encrypted_data *encrypted;
+    size_t submsg_len = plain_submsg->_length + sizeof(uint32_t);
+    if (submsg_len > UINT16_MAX)
+      goto enc_dw_submsg_fail;
+
+    /* add SEC_BODY submessage */
+    body = add_submessage(&data, SMID_SEC_BODY_KIND, flags, submsg_len);
+    encrypted = (struct encrypted_data *)(body + 1);
+    contents = encrypted->data;
+
+    /* encrypt submessage */
+    if (!crypto_cipher_encrypt_data(&session->key, session->key_size, header->session_id, plain_submsg->_buffer, plain_submsg->_length, NULL, 0, contents, &payload_len, &hmac, ex))
+      goto enc_dw_submsg_fail;
+
+    /* adjust the length of the body submessage when needed */
+    encrypted->length = ddsrt_toBE4u(payload_len);
+    if (payload_len + sizeof(encrypted->length) > plain_submsg->_length)
+    {
+      size_t inc = payload_len + sizeof(encrypted->length) - plain_submsg->_length;
+      body->length = (uint16_t)(body->length + inc);
+      data._length += (uint32_t)inc;
+    }
+  }
+  else if (is_authentication_required(transform_kind))
+  {
+    /* the transformation_kind indicates only indicates authentication the determine HMAC */
+    if (!crypto_cipher_encrypt_data(&session->key, session->key_size, header->session_id, NULL, 0, plain_submsg->_buffer, plain_submsg->_length, NULL, NULL, &hmac, ex))
+      goto enc_dw_submsg_fail;
+
+    /* copy submessage */
+    body = (struct submsg_header *)contents;
+    memcpy(contents, plain_submsg->_buffer, plain_submsg->_length);
+    payload_len = plain_submsg->_length;
+    data._length += payload_len;
+  }
+  else
+  {
+    goto enc_dw_submsg_fail;
+  }
+
+  postfix = add_submessage(&data, SMID_SEC_POSTFIX_KIND, flags, CRYPTO_FOOTER_BASIC_SIZE);
+  footer = (struct crypto_footer *)(postfix + 1);
+
+  /* Set initial SEC_POSTFIX and CryptoFooter containing the common_mac
+    * Note that the length of the postfix may increase when reader specific macs are added */
+  memcpy(footer->common_mac.data, hmac.data, CRYPTO_HMAC_SIZE);
+  footer->receiver_specific_macs._length = 0;
+
+  *encoded_submsg = data;
+  if (has_origin_authentication(protection_kind))
+  {
+    if (reader_crypto_list->_length != 0)
+    {
+      if (!add_crypto_reader_specific_mac(factory, encoded_submsg, reader_crypto_list->_buffer[0], postfix, ex))
+        goto enc_dw_submsg_fail;
+      (*index)++;
+    }
+  }
+  else
+  {
+    *index = (int32_t) reader_crypto_list->_length;
+  }
+  result = true;
+
+enc_dw_submsg_fail:
+  CRYPTO_OBJECT_RELEASE(session);
+  if (!result)
+  {
+    ddsrt_free(data._buffer);
+    encoded_submsg->_buffer = NULL;
+    encoded_submsg->_length = 0;
+    encoded_submsg->_maximum = 0;
+  }
+enc_dw_submsg_fail_keymat:
+  return result;
+}
+
+static DDS_Security_boolean
+encode_datawriter_submessage(
+    dds_security_crypto_transform *instance,
+    DDS_Security_OctetSeq *encoded_submsg,
+    const DDS_Security_OctetSeq *plain_submsg,
+    const DDS_Security_DatawriterCryptoHandle writer_crypto,
+    const DDS_Security_DatareaderCryptoHandleSeq *reader_crypto_list,
+    int32_t *index,
+    DDS_Security_SecurityException *ex)
+{
+  dds_security_crypto_transform_impl *impl = (dds_security_crypto_transform_impl *)instance;
+  dds_security_crypto_key_factory *factory;
+  DDS_Security_boolean result = false;
+
+  /* check arguments */
+  if (!instance || !encoded_submsg || (writer_crypto == 0) || !reader_crypto_list ||
+      (reader_crypto_list->_length == 0) || (reader_crypto_list->_length > INT32_MAX) ||
+      !index || ((*index) >= (int32_t)reader_crypto_list->_length))
+  {
+    DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_CRYPTO_ARGUMENT_CODE, 0,
+        "encode_datawriter_submessage: " DDS_SECURITY_ERR_INVALID_CRYPTO_ARGUMENT_MESSAGE);
+    goto enc_dw_submsg_inv_args;
+  }
+
+  if (*index == 0)
+  {
+    if (!plain_submsg || (plain_submsg->_length == 0))
+    {
+      DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_CRYPTO_ARGUMENT_CODE, 0,
+          "encode_datawriter_submessage: " DDS_SECURITY_ERR_INVALID_CRYPTO_ARGUMENT_MESSAGE);
+      goto enc_dw_submsg_inv_args;
+    }
+  }
+  else
+  {
+    if (encoded_submsg->_length == 0)
+    {
+      DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_CRYPTO_ARGUMENT_CODE, 0,
+          "encode_datawriter_submessage: " DDS_SECURITY_ERR_INVALID_CRYPTO_ARGUMENT_MESSAGE);
+      goto enc_dw_submsg_inv_args;
+    }
+  }
+
+  factory = cryptography_get_crypto_key_factory(impl->crypto);
+
+  if (*index == 0)
+  {
+    /* When the index is 0 then retrieve the key material of the writer */
+    result = encode_datawriter_submessage_encrypt (factory, encoded_submsg, plain_submsg,
+        writer_crypto, reader_crypto_list, index, ex);
+  }
+  else
+  {
+    /* When the index is not 0 then add a signature for the specific reader */
+    result = encode_datawriter_submessage_sign (factory, encoded_submsg, reader_crypto_list, index, ex);
+  }
+
+enc_dw_submsg_inv_args:
+  return result;
+}
+
+static bool
+add_writer_specific_mac(
+    dds_security_crypto_key_factory *factory,
+    DDS_Security_OctetSeq *data,
+    DDS_Security_DatawriterCryptoHandle writer_crypto,
+    struct submsg_header *postfix,
+    DDS_Security_SecurityException *ex)
+{
+  bool result = true;
+  master_key_material *key_material = NULL;
+  session_key_material *session = NULL;
+  DDS_Security_ProtectionKind protection_kind;
+
+  if (!crypto_factory_get_remote_writer_sign_key_material(factory, writer_crypto, &key_material, &session, &protection_kind, ex))
+    return false;
+
+  result = add_reader_specific_mac(data, postfix, key_material, session, protection_kind, ex);
+
+  CRYPTO_OBJECT_RELEASE(session);
+  CRYPTO_OBJECT_RELEASE(key_material);
+
+  return result;
+}
+
+static DDS_Security_boolean
+encode_datareader_submessage(
+    dds_security_crypto_transform *instance,
+    DDS_Security_OctetSeq *encoded_submsg,
+    const DDS_Security_OctetSeq *plain_submsg,
+    const DDS_Security_DatareaderCryptoHandle reader_crypto,
+    const DDS_Security_DatawriterCryptoHandleSeq *writer_crypto_list,
+    DDS_Security_SecurityException *ex)
+{
+  dds_security_crypto_transform_impl *impl = (dds_security_crypto_transform_impl *)instance;
+  dds_security_crypto_key_factory *factory;
+  DDS_Security_DatawriterCryptoHandle writer_crypto = 0;
+  DDS_Security_OctetSeq data;
+  struct submsg_header *prefix;
+  struct crypto_header *header;
+  struct submsg_header *postfix;
+  struct submsg_header *body;
+  struct crypto_footer *footer;
+  session_key_material *session = NULL;
+  DDS_Security_ProtectionKind protection_kind;
+  unsigned char flags;
+  unsigned char *contents;
+  crypto_hmac_t hmac;
+  uint32_t payload_len;
+  size_t size;
+  DDS_Security_boolean result = false;
+  uint32_t transform_kind, transform_id;
+
+  /* check arguments */
+  if (!instance || !encoded_submsg || (reader_crypto == 0) ||
+      !plain_submsg || (plain_submsg->_length == 0) ||
+      !writer_crypto_list || (writer_crypto_list->_length == 0))
+  {
+    DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_CRYPTO_ARGUMENT_CODE, 0,
+        "encode_datawriter_submessage: " DDS_SECURITY_ERR_INVALID_CRYPTO_ARGUMENT_MESSAGE);
+    goto enc_dr_submsg_inv_args;
+  }
+
+  factory = cryptography_get_crypto_key_factory(impl->crypto);
+
+  if (writer_crypto_list->_length > 0)
+    writer_crypto = writer_crypto_list->_buffer[0];
+
+  if (!crypto_factory_get_reader_key_material(factory, reader_crypto, writer_crypto, &session, &protection_kind, ex))
+    goto enc_dr_submsg_fail_keymat;
+
+  /* Determine the size of the buffer
+     * When no encryption
+     * - submsg header SEC_PREFIX
+     * - crypto header
+     * - size of the plain_submsg
+     * - submsg header SEC_POSTFIX
+     * - crypto footer based on the size of the receiving_datareader_crypto_list
+     * When encryption is required:
+     * - submsg header SEC_PREFIX
+     * - crypto header
+     * - submsg header SEC_BODY
+     * - estimated size of the encoded submessage (size of the plain_submsg + some extra for possible padding
+     * - submsg header SEC_POSTFIX
+     * - crypto footer based on the size of the receiving_datareader_crypto_list
+     */
+
+  size = 2 * sizeof(struct submsg_header) + sizeof(struct crypto_header) + sizeof(struct crypto_footer) + ALIGN4(plain_submsg->_length);
+  size += writer_crypto_list->_length * CRYPTO_HMAC_SIZE;
+  /* assure that the buffer contains enough memory to accommodate the encrypted payload */
+  if (is_encryption_required(session->master_key_material->transformation_kind))
+    size += sizeof(struct submsg_header) + sizeof(uint32_t) + CRYPTO_ENCRYPTION_MAX_PADDING;
+
+  flags = (DDSRT_ENDIAN == DDSRT_LITTLE_ENDIAN) ? 0x01 : 0x00;
+
+  /* allocate a buffer to store the encoded submessage */
+  data._buffer = ddsrt_malloc(size);
+  data._length = 0;
+  data._maximum = (uint32_t)size;
+
+  /* Set the SEC_PREFIX and associated CryptoHeader */
+
+  prefix = add_submessage(&data, SMID_SEC_PREFIX_KIND, flags, sizeof(struct crypto_header));
+  header = (struct crypto_header *)(prefix + 1);
+  contents = (unsigned char *)(header + 1);
+
+  /* update sessionKey when needed */
+  if (!crypto_session_key_material_update(session, plain_submsg->_length, ex))
+    goto enc_dr_submsg_fail;
+
+  /* increment init_vector_suffix */
+  session->init_vector_suffix++;
+
+  transform_kind = session->master_key_material->transformation_kind;
+  transform_id = session->master_key_material->sender_key_id;
+
+  set_crypto_header(header, transform_kind, transform_id, session->id, session->init_vector_suffix);
+
+  if (is_encryption_required(transform_kind))
+  {
+    struct encrypted_data *encrypted;
+    size_t submsg_len = plain_submsg->_length + sizeof (uint32_t);
+    if (submsg_len > UINT16_MAX)
+      goto enc_dr_submsg_fail;
+
+    /* add SEC_BODY submessage */
+    body = add_submessage(&data, SMID_SEC_BODY_KIND, flags, submsg_len);
+    encrypted = (struct encrypted_data *)(body + 1);
+    contents = encrypted->data;
+
+    /* encrypt submessage */
+    if (!crypto_cipher_encrypt_data(&session->key, session->key_size, header->session_id, plain_submsg->_buffer, plain_submsg->_length, NULL, 0, contents, &payload_len, &hmac, ex))
+      goto enc_dr_submsg_fail;
+
+    /* adjust the length of the body submessage when needed */
+    encrypted->length = ddsrt_toBE4u(payload_len);
+    if (payload_len + sizeof(encrypted->length) > plain_submsg->_length)
+    {
+      size_t inc = payload_len + sizeof(encrypted->length) - plain_submsg->_length;
+      body->length = (uint16_t)(body->length + inc);
+      data._length += (uint32_t)inc;
+    }
+  }
+  else if (is_authentication_required(transform_kind))
+  {
+    /* the transformation_kind indicates only indicates authentication the determine HMAC */
+    if (!crypto_cipher_encrypt_data(&session->key, session->key_size, header->session_id, NULL, 0, plain_submsg->_buffer, plain_submsg->_length, NULL, NULL, &hmac, ex))
+      goto enc_dr_submsg_fail;
+
+    /* copy submessage */
+    body = (struct submsg_header *)contents;
+    memcpy(contents, plain_submsg->_buffer, plain_submsg->_length);
+    payload_len = plain_submsg->_length;
+    data._length += payload_len;
+  }
+  else
+  {
+    goto enc_dr_submsg_fail;
+  }
+
+  postfix = add_submessage(&data, SMID_SEC_POSTFIX_KIND, flags, CRYPTO_FOOTER_BASIC_SIZE);
+  footer = (struct crypto_footer *)(postfix + 1);
+
+  /* Set initial SEC_POSTFIX and CryptoFooter containing the common_mac
+    * Note that the length of the postfix may increase when writer specific macs are added */
+  memcpy(footer->common_mac.data, hmac.data, CRYPTO_HMAC_SIZE);
+  footer->receiver_specific_macs._length = 0;
+
+  if (has_origin_authentication(protection_kind))
+  {
+    for (uint32_t i = 0; i < writer_crypto_list->_length; i++)
+    {
+      if (!add_writer_specific_mac(factory, &data, writer_crypto_list->_buffer[i], postfix, ex))
+        goto enc_dr_submsg_fail;
+    }
+  }
+  *encoded_submsg = data;
+  result = true;
+
+enc_dr_submsg_fail:
+  CRYPTO_OBJECT_RELEASE(session);
+  if (!result)
+  {
+    ddsrt_free(data._buffer);
+    encoded_submsg->_buffer = NULL;
+    encoded_submsg->_maximum = 0;
+    encoded_submsg->_length = 0;
+  }
+enc_dr_submsg_fail_keymat:
+enc_dr_submsg_inv_args:
+  return result;
+}
+
+static DDS_Security_boolean
+check_reader_specific_mac(
+    struct crypto_header *header,
+    struct crypto_footer *footer,
+    master_key_material *key_material,
+    const char *context,
+    DDS_Security_SecurityException *ex)
+{
+  uint32_t session_id;
+  crypto_session_key_t key;
+  crypto_hmac_t *href = NULL;
+  crypto_hmac_t hmac;
+  uint32_t i;
+
+  if (key_material->receiver_specific_key_id == 0)
+  {
+    DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_CRYPTO_RECEIVER_SIGN_CODE, 0,
+        "%s: don't have receiver key material to check specific mac", context);
+    return false;
+  }
+
+  session_id = CRYPTO_TRANSFORM_ID(header->session_id);
+  for (i = 0; !href && (i < footer->receiver_specific_macs._length); i++)
+  {
+    uint32_t id = CRYPTO_TRANSFORM_ID(footer->receiver_specific_macs._buffer[i].receiver_mac_key_id);
+
+    if (id == key_material->receiver_specific_key_id)
+      href = &footer->receiver_specific_macs._buffer[i].receiver_mac;
+  }
+
+  if (!href)
+  {
+    DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_CRYPTO_RECEIVER_SIGN_CODE, 0,
+        "%s: message does not contain receiver specific mac", context);
+    return false;
+  }
+
+  if (!crypto_calculate_receiver_specific_key(&key, session_id, key_material->master_salt, key_material->master_receiver_specific_key, key_material->transformation_kind, ex))
+  {
+    DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_CRYPTO_RECEIVER_SIGN_CODE, 0,
+        "%s: failed to calculate receiver specific session key", context);
+    return false;
+  }
+
+  if (!crypto_cipher_encrypt_data(&key, crypto_get_key_size(key_material->transformation_kind), header->session_id, NULL, 0, footer->common_mac.data, CRYPTO_HMAC_SIZE, NULL, NULL, &hmac, ex))
+  {
+    DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_CRYPTO_RECEIVER_SIGN_CODE, 0,
+        "%s: failed to calculate receiver specific hmac", context);
+    return false;
+  }
+
+  if (memcmp(hmac.data, href->data, CRYPTO_HMAC_SIZE) != 0)
+  {
+    DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_CRYPTO_RECEIVER_SIGN_CODE, 0,
+        "%s: message does not contain a valid receiver specific mac", context);
+    return false;
+  }
+  return true;
+}
+
+static DDS_Security_boolean encode_rtps_message_sign (
+    dds_security_crypto_key_factory *factory,
+    DDS_Security_OctetSeq *encoded_rtps_message,
+    const DDS_Security_ParticipantCryptoHandle sending_participant_crypto,
+    int32_t *receiving_participant_crypto_list_index,
+    DDS_Security_ParticipantCryptoHandle remote_id,
+    DDS_Security_SecurityException *ex
+)
+{
+  size_t length_to_postfix, remaining = encoded_rtps_message->_length;
+  unsigned char *ptr;
+  DDS_Security_boolean result;
+  struct submsg_header *prefix = (struct submsg_header *)(encoded_rtps_message->_buffer + RTPS_HEADER_SIZE);
+  struct crypto_header *header = (struct crypto_header *)(prefix + 1);
+  struct submsg_header *submessage_header = (struct submsg_header *)(header + 1);
+  struct submsg_header *postfix = (struct submsg_header *)(((unsigned char *)submessage_header) + submessage_header->length + sizeof(struct submsg_header));
+
+  if (submessage_header->id == SMID_SRTPS_INFO_SRC_KIND) /* not encrypted */
+  {
+    /* skip INFO_SRC_HDR to RTPS submessage header */
+    ptr = ((unsigned char *)submessage_header + sizeof(struct submsg_header) + submessage_header->length);
+    remaining = (size_t) (encoded_rtps_message->_buffer + encoded_rtps_message->_length - ptr);
+    /* There may be multiple RTPS submessages until postfix */
+    while (remaining - sizeof(struct submsg_header) > 0)
+    {
+      submessage_header = (struct submsg_header *)ptr;
+      length_to_postfix = submessage_header->length + sizeof(struct submsg_header);
+      postfix = (struct submsg_header *)(((unsigned char *)submessage_header) + length_to_postfix);
+      if (postfix->id == SMID_SRTPS_POSTFIX_KIND)
+        break;
+      remaining -= length_to_postfix;
+      ptr += length_to_postfix;
+    }
+  }
+
+  result = add_receiver_specific_mac(factory, encoded_rtps_message, sending_participant_crypto, remote_id, postfix, ex);
+  if (result)
+    (*receiving_participant_crypto_list_index)++;
+
+  return result;
+}
+
+static DDS_Security_boolean encode_rtps_message_encrypt (
+    dds_security_crypto_key_factory *factory,
+    DDS_Security_OctetSeq *encoded_rtps_message,
+    const DDS_Security_OctetSeq *plain_rtps_message,
+    const DDS_Security_ParticipantCryptoHandle sending_participant_crypto,
+    const DDS_Security_ParticipantCryptoHandleSeq *receiving_participant_crypto_list,
+    int32_t *receiving_participant_crypto_list_index,
+    DDS_Security_ParticipantCryptoHandle remote_id,
+    DDS_Security_SecurityException *ex
+)
+{
+  session_key_material *session = NULL;
+  DDS_Security_ProtectionKind protection_kind;
+  DDS_Security_OctetSeq data;
+  DDS_Security_OctetSeq secure_body_plain;
+  struct submsg_header *prefix;
+  struct crypto_header *header;
+  struct submsg_header *postfix;
+  struct submsg_header *body;
+  struct crypto_footer *footer;
+  DDS_Security_boolean result = false;
+  unsigned char *contents;
+  crypto_hmac_t hmac;
+  uint32_t payload_len;
+  size_t size;
+  uint32_t transform_kind, transform_id;
+  unsigned char flags = (DDSRT_ENDIAN == DDSRT_LITTLE_ENDIAN) ? 0x01 : 0x00;
+  unsigned char *rtps_body = plain_rtps_message->_buffer + RTPS_HEADER_SIZE;
+  unsigned rtps_body_size = plain_rtps_message->_length - RTPS_HEADER_SIZE;
+  unsigned secure_body_plain_size = rtps_body_size + INFO_SRC_SIZE;
+
+  /* get local crypto and session*/
+  if (!crypto_factory_get_local_participant_data_key_material(factory, sending_participant_crypto, &session, &protection_kind, ex))
+    goto enc_rtps_inv_keymat;
+
+  secure_body_plain._buffer = ddsrt_malloc(secure_body_plain_size);
+  secure_body_plain._maximum = secure_body_plain_size;
+  secure_body_plain._length = 0;
+
+  /* info_src and body */
+  if (!add_info_src(&secure_body_plain, plain_rtps_message->_buffer, flags))
+  {
+    DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_CRYPTO_ARGUMENT_CODE, 0,
+        "encode_rtps_message: " DDS_SECURITY_ERR_INVALID_CRYPTO_ARGUMENT_MESSAGE);
+    goto enc_rtps_fail;
+  }
+  memcpy(secure_body_plain._buffer + secure_body_plain._length, rtps_body, rtps_body_size); /* rtps message body */
+  secure_body_plain._length += rtps_body_size;
+
+  /* Determine the size of the buffer
+        * When no encryption
+        * - rtps header
+        * - submsg header SEC_PREFIX
+        * - crypto header
+        * - INFO_SRC (24)
+        * - size of the plain_rtps body
+        * - submsg header SEC_POSTFIX
+        * - crypto footer based on the size of the receiving_participant_crypto_list
+        * When encryption is required:
+        * - rtps header
+        * - submsg header SEC_PREFIX
+        * - crypto header
+        * - submsg header SEC_BODY
+        * - INFO_SRC (24)
+        * - estimated size of the encoded submessage (size of the plain_rtps_message + some extra for possible padding
+        * - submsg header SEC_POSTFIX
+        * - crypto footer based on the size of the receiving_participant_crypto_list
+        */
+
+  size = RTPS_HEADER_SIZE; /* RTPS Header */
+  size += 2 * sizeof(struct submsg_header) + sizeof(struct crypto_header) + sizeof(struct crypto_footer) + ALIGN4(plain_rtps_message->_length);
+  size += receiving_participant_crypto_list->_length * CRYPTO_HMAC_SIZE;
+  size += sizeof(struct submsg_header) + RTPS_HEADER_SIZE; /* INFO_SRC */
+
+  if (is_encryption_required(session->master_key_material->transformation_kind))
+    size += sizeof(struct submsg_header) + sizeof(uint32_t);
+
+  /* allocate a buffer to store the encoded message */
+  data._buffer = ddsrt_malloc(size);
+  data._length = 0;
+  data._maximum = (uint32_t)size;
+
+  /* Add RTPS header */
+  memcpy(data._buffer, plain_rtps_message->_buffer, RTPS_HEADER_SIZE);
+  data._length += RTPS_HEADER_SIZE;
+
+  /* Set the SEC_PREFIX and associated CryptoHeader */
+  prefix = add_submessage(&data, SMID_SRTPS_PREFIX_KIND, flags, sizeof(struct crypto_header));
+  header = (struct crypto_header *)(prefix + 1);
+  contents = (unsigned char *)(header + 1);
+
+  /* update sessionKey when needed */
+  if (!crypto_session_key_material_update(session, secure_body_plain_size, ex))
+    goto enc_rtps_fail_data;
+
+  /* increment init_vector_suffix */
+  session->init_vector_suffix++;
+
+  transform_kind = session->master_key_material->transformation_kind;
+  transform_id = session->master_key_material->sender_key_id;
+  set_crypto_header(header, transform_kind, transform_id, session->id, session->init_vector_suffix);
+
+  if (is_encryption_required(transform_kind))
+  {
+    struct encrypted_data *encrypted;
+    size_t submsg_len = secure_body_plain_size + sizeof (uint32_t);
+    if (submsg_len > UINT16_MAX)
+      goto enc_rtps_fail_data;
+
+    /* add SEC_BODY submessage */
+    body = add_submessage(&data, SMID_SEC_BODY_KIND, flags, submsg_len);
+    encrypted = (struct encrypted_data *)(body + 1);
+    contents = encrypted->data;
+
+    /* encrypt message */
+    /* FIXME: improve performance by not copying plain_rtps_message to a new buffer (crypto_cipher_encrypt_data should allow encrypting parts of a message) */
+    if (!crypto_cipher_encrypt_data(&session->key, session->key_size, header->session_id, secure_body_plain._buffer, secure_body_plain_size, NULL, 0, contents, &payload_len, &hmac, ex))
+      goto enc_rtps_fail_data;
+
+    encrypted->length = ddsrt_toBE4u(payload_len);
+    if (payload_len + sizeof(encrypted->length) > secure_body_plain_size)
+    {
+      size_t inc = payload_len + sizeof(encrypted->length) - secure_body_plain_size;
+      body->length = (uint16_t)(body->length + inc);
+      data._length += (uint32_t)inc;
+    }
+  }
+  else if (is_authentication_required(transform_kind))
+  {
+    /* the transformation_kind indicates only indicates authentication the determine HMAC */
+    if (!crypto_cipher_encrypt_data(&session->key, session->key_size, header->session_id, NULL, 0, secure_body_plain._buffer, secure_body_plain_size, NULL, NULL, &hmac, ex))
+      goto enc_rtps_fail_data;
+
+    /* copy submessage */
+    memcpy(contents, secure_body_plain._buffer, secure_body_plain_size);
+    payload_len = secure_body_plain_size;
+    data._length += payload_len;
+  }
+  else
+  {
+    goto enc_rtps_fail_data;
+  }
+
+  postfix = add_submessage(&data, SMID_SRTPS_POSTFIX_KIND, flags, CRYPTO_FOOTER_BASIC_SIZE);
+  footer = (struct crypto_footer *)(postfix + 1);
+
+  /* Set initial SEC_POSTFIX and CryptoFooter containing the common_mac
+    * Note that the length of the postfix may increase when reader specific macs are added */
+  memcpy(footer->common_mac.data, hmac.data, CRYPTO_HMAC_SIZE);
+  footer->receiver_specific_macs._length = 0;
+  *encoded_rtps_message = data;
+  if (has_origin_authentication(protection_kind))
+  {
+    if (receiving_participant_crypto_list->_length != 0)
+    {
+      if (!add_receiver_specific_mac(factory, encoded_rtps_message, sending_participant_crypto, remote_id, postfix, ex))
+        goto enc_rtps_fail_data;
+      (*receiving_participant_crypto_list_index)++;
+    }
+  }
+  else
+  {
+    *receiving_participant_crypto_list_index = (int32_t) receiving_participant_crypto_list->_length;
+  }
+  result = true;
+
+enc_rtps_fail_data:
+  if (!result)
+  {
+    ddsrt_free(data._buffer);
+    encoded_rtps_message->_buffer = NULL;
+    encoded_rtps_message->_length = 0;
+    encoded_rtps_message->_maximum = 0;
+  }
+enc_rtps_fail:
+  CRYPTO_OBJECT_RELEASE(session);
+  ddsrt_free(secure_body_plain._buffer);
+enc_rtps_inv_keymat:
+  return result;
+}
+
+static DDS_Security_boolean
+encode_rtps_message(dds_security_crypto_transform *instance,
+                    DDS_Security_OctetSeq *encoded_rtps_message,
+                    const DDS_Security_OctetSeq *plain_rtps_message,
+                    const DDS_Security_ParticipantCryptoHandle sending_participant_crypto,
+                    const DDS_Security_ParticipantCryptoHandleSeq *receiving_participant_crypto_list,
+                    int32_t *receiving_participant_crypto_list_index,
+                    DDS_Security_SecurityException *ex)
+{
+  dds_security_crypto_transform_impl *impl = (dds_security_crypto_transform_impl *)instance;
+  dds_security_crypto_key_factory *factory;
+  DDS_Security_ParticipantCryptoHandle remote_id;
+  DDS_Security_boolean result = false;
+
+  /* check arguments */
+  if (!instance || !encoded_rtps_message || sending_participant_crypto == 0 || !receiving_participant_crypto_list ||
+      !receiving_participant_crypto_list_index || receiving_participant_crypto_list->_length == 0 ||
+      (*receiving_participant_crypto_list_index) > (int32_t)receiving_participant_crypto_list->_length ||
+      receiving_participant_crypto_list->_length > INT32_MAX)
+  {
+    DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_CRYPTO_ARGUMENT_CODE, 0,
+        "encode_rtps_message: " DDS_SECURITY_ERR_INVALID_CRYPTO_ARGUMENT_MESSAGE);
+    goto enc_rtps_inv_arg;
+  }
+
+  if (*receiving_participant_crypto_list_index == 0)
+  {
+    if (!plain_rtps_message || plain_rtps_message->_length == 0 || !plain_rtps_message->_buffer)
+    {
+      DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_CRYPTO_ARGUMENT_CODE, 0,
+          "encode_rtps_message: " DDS_SECURITY_ERR_INVALID_CRYPTO_ARGUMENT_MESSAGE);
+      goto enc_rtps_inv_arg;
+    }
+  }
+  else
+  {
+    if (encoded_rtps_message->_length == 0)
+    {
+      DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_CRYPTO_ARGUMENT_CODE, 0,
+          "encode_rtps_message: " DDS_SECURITY_ERR_INVALID_CRYPTO_ARGUMENT_MESSAGE);
+      goto enc_rtps_inv_arg;
+    }
+  }
+
+  factory = cryptography_get_crypto_key_factory(impl->crypto);
+
+  /* get remote participant handle */
+  remote_id = receiving_participant_crypto_list->_buffer[*receiving_participant_crypto_list_index];
+
+  /* When the receiving_participant_crypto_list_index is 0 then retrieve the key material of the writer */
+  if (*receiving_participant_crypto_list_index == 0)
+  {
+    result = encode_rtps_message_encrypt (factory, encoded_rtps_message, plain_rtps_message, sending_participant_crypto,
+        receiving_participant_crypto_list, receiving_participant_crypto_list_index, remote_id, ex);
+  }
+  else
+  {
+    /* When the receiving_participant_crypto_list_index is not 0 then add a signature for the specific reader */
+    result = encode_rtps_message_sign (factory, encoded_rtps_message, sending_participant_crypto,
+        receiving_participant_crypto_list_index, remote_id, ex);
+  }
+
+enc_rtps_inv_arg:
+  return result;
+}
+
+
+
+static DDS_Security_boolean
+decode_rtps_message(dds_security_crypto_transform *instance,
+                    DDS_Security_OctetSeq *plain_buffer,
+                    const DDS_Security_OctetSeq *encoded_buffer,
+                    const DDS_Security_ParticipantCryptoHandle receiving_participant_crypto,
+                    const DDS_Security_ParticipantCryptoHandle sending_participant_crypto,
+                    DDS_Security_SecurityException *ex)
+{
+  dds_security_crypto_transform_impl *impl = (dds_security_crypto_transform_impl *)instance;
+  dds_security_crypto_key_factory *factory;
+  uint32_t transform_kind;
+  remote_session_info remote_session;
+  DDS_Security_OctetSeq rtps_header;
+  struct submsg_header prefix;
+  struct crypto_header header;
+  struct submsg_header postfix;
+  struct submsg_header body;
+  struct crypto_footer *footer;
+  struct crypto_contents_ref contents = {0, NULL};
+  unsigned char *decoded_body;
+  uint32_t decoded_body_size;
+  static const char *context = "decode_rtps_message";
+  participant_key_material *pp_key_material;
+  DDS_Security_ProtectionKind remote_protection_kind;
+  bool result = false;
+
+  /* FIXME: when decoding a message the message is split in several parts (header, body, footer, etc) and for this
+   * memory is allocated which is probably not necessary. Performance should be improved by removing these allocations
+   * and use pointer to the data instead. */
+
+  /* check arguments */
+  if (!instance || !encoded_buffer || sending_participant_crypto == 0 || receiving_participant_crypto == 0 ||
+      encoded_buffer->_length == 0 || !encoded_buffer->_buffer || !plain_buffer)
+  {
+    DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_CRYPTO_ARGUMENT_CODE, 0,
+        "decode_rtps_message: " DDS_SECURITY_ERR_INVALID_CRYPTO_ARGUMENT_MESSAGE);
+    goto fail_invalid_input;
+  }
+
+  factory = cryptography_get_crypto_key_factory(impl->crypto);
+
+  memset(&rtps_header, 0, sizeof(DDS_Security_OctetSeq));
+
+  /* split the encoded submessage in the corresponding parts */
+  if (!split_encoded_rtps_message(encoded_buffer, &rtps_header, &prefix, &body, &postfix, &header, &contents, &footer))
+  {
+    DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_CRYPTO_ARGUMENT_CODE, 0,
+        "decode_rtps_message: invalid message");
+    goto fail_invalid_input;
+  }
+
+  transform_kind = CRYPTO_TRANSFORM_KIND(header.transform_identifier.transformation_kind);
+
+  /* Retrieve key material from sending_participant_crypto and  receiving_participant_crypto from factory */
+  if (!crypto_factory_get_participant_crypto_tokens(factory, receiving_participant_crypto, sending_participant_crypto, &pp_key_material, &remote_protection_kind, ex))
+    goto fail_tokens;
+
+  if (!pp_key_material->remote_key_material)
+    goto fail_remote_keys_not_ready;
+
+  if (has_origin_authentication(remote_protection_kind))
+  { /* default governance value */
+    if (!check_reader_specific_mac(&header, footer, pp_key_material->remote_key_material, context, ex))
+      goto fail_reader_mac;
+  }
+
+  /* calculate the session key */
+  decoded_body = DDS_Security_OctetSeq_allocbuf(contents._length);
+  if (!initialize_remote_session_info(&remote_session, &header, pp_key_material->remote_key_material->master_salt,
+        pp_key_material->remote_key_material->master_sender_key, pp_key_material->remote_key_material->transformation_kind, ex))
+  {
+    DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_CRYPTO_ARGUMENT_CODE, 0,
+        "decode_rtps_message: " DDS_SECURITY_ERR_INVALID_CRYPTO_ARGUMENT_MESSAGE);
+    goto fail_decrypt;
+  }
+
+  if (is_encryption_required(transform_kind))
+  {
+    if (!is_encryption_expected(remote_protection_kind))
+    {
+      DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_CRYPTO_ARGUMENT_CODE, 0,
+          "decode_rtps_submessage: message is encrypted, which is unexpected");
+      goto fail_decrypt;
+    }
+
+    /* When the CryptoHeader indicates that encryption is performed then decrypt the submessage body */
+    /* check if the body is a SEC_BODY submessage */
+    if (body.id != SMID_SEC_BODY_KIND)
+    {
+      DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_CRYPTO_ARGUMENT_CODE, 0,
+          "decode_rtps_submessage: " DDS_SECURITY_ERR_INVALID_CRYPTO_ARGUMENT_MESSAGE);
+      goto fail_decrypt;
+    }
+
+    if (!crypto_cipher_decrypt_data(&remote_session, header.session_id, contents._data, contents._length, NULL, 0,
+                                    decoded_body, &decoded_body_size, &footer->common_mac, ex))
+    {
+      goto fail_decrypt;
+    }
+  }
+  else if (is_authentication_required(transform_kind))
+  {
+    if (!is_authentication_expected(remote_protection_kind))
+    {
+      DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_CRYPTO_ARGUMENT_CODE, 0,
+          "decode_rtps_message: message is signed, which is unexpected");
+      goto fail_decrypt;
+    }
+    /* When the CryptoHeader indicates that authentication is performed then calculate the HMAC */
+    if (!crypto_cipher_decrypt_data(&remote_session, header.session_id, NULL, 0, contents._data, contents._length, NULL, 0, &footer->common_mac, ex))
+      goto fail_decrypt;
+    decoded_body_size = contents._length;
+    memcpy(decoded_body, contents._data, contents._length);
+  }
+  else
+  {
+    DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_CRYPTO_TRANSFORMATION_CODE, 0,
+        "decode_rtps_message: " DDS_SECURITY_ERR_INVALID_CRYPTO_TRANSFORMATION_MESSAGE);
+    goto fail_decrypt;
+  }
+
+  plain_buffer->_buffer = DDS_Security_OctetSeq_allocbuf(decoded_body_size - 4); /* INFO_SRC removed, "RTPS" prefix added */
+  plain_buffer->_length = plain_buffer->_maximum = decoded_body_size - 4;        /* INFO_SRC removed, "RTPS" prefix added */
+  memcpy(plain_buffer->_buffer, "RTPS", 4);                                      /* ADD RTPS */
+  memcpy(plain_buffer->_buffer + 4, decoded_body + 8, decoded_body_size - 8);    /* remove INFO_SRC */
+  result = true;
+
+fail_decrypt:
+  ddsrt_free(decoded_body);
+fail_remote_keys_not_ready:
+fail_reader_mac:
+  CRYPTO_OBJECT_RELEASE(pp_key_material);
+fail_tokens:
+  ddsrt_free(footer);
+fail_invalid_input:
+  return result;
+}
+
+static DDS_Security_boolean
+preprocess_secure_submsg(
+    dds_security_crypto_transform *instance,
+    DDS_Security_DatawriterCryptoHandle *datawriter_crypto,
+    DDS_Security_DatareaderCryptoHandle *datareader_crypto,
+    DDS_Security_SecureSubmessageCategory_t *secure_submessage_category,
+    const DDS_Security_OctetSeq *encoded_rtps_submessage,
+    const DDS_Security_ParticipantCryptoHandle receiving_participant_crypto,
+    const DDS_Security_ParticipantCryptoHandle sending_participant_crypto,
+    DDS_Security_SecurityException *ex)
+{
+  dds_security_crypto_transform_impl *impl = (dds_security_crypto_transform_impl *)instance;
+  dds_security_crypto_key_factory *factory;
+  DDS_Security_Handle remote_handle;
+  DDS_Security_Handle local_handle;
+  DDS_Security_boolean result;
+  struct submsg_header submsg;
+  struct crypto_header cheader;
+  uint32_t transform_kind, key_id;
+  unsigned char *pdata;
+  uint32_t remain;
+
+  if (!instance || !datawriter_crypto || !datareader_crypto || sending_participant_crypto == 0 ||
+      !secure_submessage_category || !encoded_rtps_submessage || encoded_rtps_submessage->_length == 0)
+  {
+    DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_CRYPTO_ARGUMENT_CODE, 0,
+        "preprocess_secure_submsg: " DDS_SECURITY_ERR_INVALID_CRYPTO_ARGUMENT_MESSAGE);
+    return false;
+  }
+
+  factory = cryptography_get_crypto_key_factory(impl->crypto);
+
+  pdata = encoded_rtps_submessage->_buffer;
+  remain = encoded_rtps_submessage->_length;
+
+  if (!read_submsg_header(&submsg, &pdata, &remain))
+  {
+    DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_CRYPTO_ARGUMENT_CODE, 0,
+        "preprocess_secure_submsg: " DDS_SECURITY_ERR_INVALID_CRYPTO_ARGUMENT_MESSAGE);
+    return false;
+  }
+
+  if (submsg.id != SMID_SEC_PREFIX_KIND)
+  {
+    DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_CRYPTO_ARGUMENT_CODE, 0,
+        "preprocess_secure_submsg: " DDS_SECURITY_ERR_INVALID_CRYPTO_ARGUMENT_MESSAGE);
+    return false;
+  }
+
+  if (!read_crypto_header(&cheader, &pdata, &remain))
+  {
+    DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_CRYPTO_ARGUMENT_CODE, 0,
+        "preprocess_secure_submsg: " DDS_SECURITY_ERR_INVALID_CRYPTO_ARGUMENT_MESSAGE);
+    return false;
+  }
+
+  transform_kind = CRYPTO_TRANSFORM_KIND(cheader.transform_identifier.transformation_kind);
+  key_id = CRYPTO_TRANSFORM_ID(cheader.transform_identifier.transformation_key_id);
+
+  if (!transform_kind_valid(transform_kind))
+  {
+    DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_CRYPTO_ARGUMENT_CODE, 0,
+        "preprocess_secure_submsg: " DDS_SECURITY_ERR_INVALID_CRYPTO_ARGUMENT_MESSAGE);
+    return false;
+  }
+
+  /* Lookup the end point information associated with the transform id */
+  result = crypto_factory_get_endpoint_relation(
+      factory, receiving_participant_crypto, sending_participant_crypto,
+      key_id, &remote_handle, &local_handle, secure_submessage_category, ex);
+
+  if (result)
+  {
+    if (*secure_submessage_category == DDS_SECURITY_DATAWRITER_SUBMESSAGE)
+    {
+      *datawriter_crypto = (DDS_Security_DatawriterCryptoHandle)remote_handle;
+      *datareader_crypto = (DDS_Security_DatareaderCryptoHandle)local_handle;
+    }
+    else
+    {
+      *datareader_crypto = (DDS_Security_DatareaderCryptoHandle)remote_handle;
+      *datawriter_crypto = (DDS_Security_DatawriterCryptoHandle)local_handle;
+    }
+  }
+
+  return result;
+}
+
+static DDS_Security_boolean
+decode_datawriter_submessage(
+    dds_security_crypto_transform *instance,
+    DDS_Security_OctetSeq *plain_submsg,
+    const DDS_Security_OctetSeq *encoded_submsg,
+    const DDS_Security_DatareaderCryptoHandle reader_crypto,
+    const DDS_Security_DatawriterCryptoHandle writer_crypto,
+    DDS_Security_SecurityException *ex)
+{
+  dds_security_crypto_transform_impl *impl = (dds_security_crypto_transform_impl *)instance;
+  static const char *context = "decode_datawriter_submessage";
+  dds_security_crypto_key_factory *factory;
+  uint32_t transform_kind, transform_id;
+  master_key_material *writer_master_key;
+  DDS_Security_ProtectionKind protection_kind;
+  remote_session_info remote_session;
+  struct submsg_header prefix;
+  struct crypto_header header;
+  struct submsg_header postfix;
+  struct submsg_header body;
+  struct crypto_footer *footer;
+  struct crypto_contents_ref contents;
+
+  /* check arguments */
+  if (!instance || writer_crypto == 0 || reader_crypto == 0 || !encoded_submsg ||
+      encoded_submsg->_length == 0 || !encoded_submsg->_buffer || !plain_submsg)
+  {
+    DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_CRYPTO_ARGUMENT_CODE, 0,
+        "decode_datawriter_submessage: " DDS_SECURITY_ERR_INVALID_CRYPTO_ARGUMENT_MESSAGE);
+    return false;
+  }
+
+  memset(plain_submsg, 0, sizeof(*plain_submsg));
+
+  factory = cryptography_get_crypto_key_factory(impl->crypto);
+
+  /* split the encoded submessage in the corresponding parts */
+  if (!split_encoded_submessage(encoded_submsg, &prefix, &body, &postfix, &header, &contents, &footer))
+  {
+    DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_CRYPTO_ARGUMENT_CODE, 0,
+        "decode_datawriter_submessage: " DDS_SECURITY_ERR_INVALID_CRYPTO_ARGUMENT_MESSAGE);
+    return false;
+  }
+
+  transform_kind = CRYPTO_TRANSFORM_KIND(header.transform_identifier.transformation_kind);
+  transform_id = CRYPTO_TRANSFORM_ID(header.transform_identifier.transformation_key_id);
+
+  /* Retrieve key material from sending_datawriter_crypto from factory */
+  if (!crypto_factory_get_remote_writer_key_material(factory, reader_crypto, writer_crypto, transform_id, &writer_master_key, &protection_kind, NULL, ex))
+    goto fail_invalid_arg;
+
+  if (has_origin_authentication(protection_kind))
+  {
+    if (!check_reader_specific_mac(&header, footer, writer_master_key, context, ex))
+      goto fail_reader_mac;
+  }
+
+  /* calculate the session key */
+  if (!initialize_remote_session_info(&remote_session, &header, writer_master_key->master_salt, writer_master_key->master_sender_key, writer_master_key->transformation_kind, ex))
+    goto fail_decrypt;
+
+  if (is_encryption_required(transform_kind))
+  {
+    if (!is_encryption_expected(protection_kind))
+    {
+      DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_CRYPTO_ARGUMENT_CODE, 0,
+          "decode_datawriter_submessage: submessage is encrypted, which is unexpected (%d vs %d)",
+          (int)transform_kind, (int)protection_kind);
+      goto fail_decrypt;
+    }
+    /* When the CryptoHeader indicates that encryption is performed then decrypt the submessage body */
+    /* check if the body is a SEC_BODY submessage */
+    if (body.id != SMID_SEC_BODY_KIND)
+    {
+      DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_CRYPTO_ARGUMENT_CODE, 0,
+          "decode_datawriter_submessage: " DDS_SECURITY_ERR_INVALID_CRYPTO_ARGUMENT_MESSAGE);
+      goto fail_decrypt;
+    }
+
+    plain_submsg->_buffer = DDS_Security_OctetSeq_allocbuf(contents._length);
+    plain_submsg->_length = plain_submsg->_maximum = contents._length;
+    if (!crypto_cipher_decrypt_data(&remote_session, header.session_id, contents._data, contents._length, NULL, 0,
+                                    plain_submsg->_buffer, &plain_submsg->_length, &footer->common_mac, ex))
+    {
+      goto fail_decrypt;
+    }
+  }
+  else if (is_authentication_required(transform_kind))
+  {
+    if (!is_authentication_expected(protection_kind))
+    {
+      DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_CRYPTO_ARGUMENT_CODE, 0,
+          "decode_datawriter_submessage: submessage is signed, which is unexpected");
+      goto fail_decrypt;
+    }
+    /* When the CryptoHeader indicates that authentication is performed then calculate the HMAC */
+    if (!crypto_cipher_decrypt_data(&remote_session, header.session_id, NULL, 0, contents._data, contents._length, NULL, 0, &footer->common_mac, ex))
+      goto fail_decrypt;
+    plain_submsg->_buffer = DDS_Security_OctetSeq_allocbuf(contents._length);
+    plain_submsg->_length = plain_submsg->_maximum = contents._length;
+    memcpy(plain_submsg->_buffer, contents._data, contents._length);
+  }
+  else
+  {
+    DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_CRYPTO_TRANSFORMATION_CODE, 0,
+        "decode_serialized_payload: " DDS_SECURITY_ERR_INVALID_CRYPTO_TRANSFORMATION_MESSAGE);
+    goto fail_decrypt;
+  }
+
+  ddsrt_free(footer);
+  CRYPTO_OBJECT_RELEASE(writer_master_key);
+  return true;
+
+
+fail_decrypt:
+  DDS_Security_OctetSeq_deinit(plain_submsg);
+fail_reader_mac:
+  CRYPTO_OBJECT_RELEASE(writer_master_key);
+fail_invalid_arg:
+  ddsrt_free(footer);
+  return false;
+}
+
+static DDS_Security_boolean
+decode_datareader_submessage(
+    dds_security_crypto_transform *instance,
+    DDS_Security_OctetSeq *plain_submsg,
+    const DDS_Security_OctetSeq *encoded_submsg,
+    const DDS_Security_DatawriterCryptoHandle writer_crypto,
+    const DDS_Security_DatareaderCryptoHandle reader_crypto,
+    DDS_Security_SecurityException *ex)
+{
+  dds_security_crypto_transform_impl *impl = (dds_security_crypto_transform_impl *)instance;
+  static const char *context = "decode_datareader_submessage";
+  dds_security_crypto_key_factory *factory;
+  uint32_t transform_kind, transform_id;
+  master_key_material *reader_master_key;
+  DDS_Security_ProtectionKind protection_kind;
+  remote_session_info remote_session;
+  struct submsg_header prefix;
+  struct crypto_header header;
+  struct submsg_header postfix;
+  struct submsg_header body;
+  struct crypto_footer *footer;
+  struct crypto_contents_ref contents;
+
+  /* check arguments */
+  if (!instance || writer_crypto == 0 || reader_crypto == 0 || !encoded_submsg ||
+      encoded_submsg->_length == 0 || !encoded_submsg->_buffer || !plain_submsg)
+  {
+    DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_CRYPTO_ARGUMENT_CODE, 0,
+        "decode_datareader_submessage: " DDS_SECURITY_ERR_INVALID_CRYPTO_ARGUMENT_MESSAGE);
+    return false;
+  }
+
+  memset(plain_submsg, 0, sizeof(*plain_submsg));
+
+  factory = cryptography_get_crypto_key_factory(impl->crypto);
+
+  /* split the encoded submessage in the corresponding parts */
+  if (!split_encoded_submessage(encoded_submsg, &prefix, &body, &postfix, &header, &contents, &footer))
+  {
+    DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_CRYPTO_ARGUMENT_CODE, 0,
+        "decode_datareader_submessage: " DDS_SECURITY_ERR_INVALID_CRYPTO_ARGUMENT_MESSAGE);
+    return false;
+  }
+
+  transform_kind = CRYPTO_TRANSFORM_KIND(header.transform_identifier.transformation_kind);
+  transform_id = CRYPTO_TRANSFORM_ID(header.transform_identifier.transformation_key_id);
+
+  /* Retrieve key material from sending_datareader_crypto from factory */
+  if (!crypto_factory_get_remote_reader_key_material(factory, writer_crypto, reader_crypto, transform_id, &reader_master_key, &protection_kind, ex))
+    goto fail_invalid_arg;
+
+  if (has_origin_authentication(protection_kind))
+  {
+    if (!check_reader_specific_mac(&header, footer, reader_master_key, context, ex))
+      goto fail_reader_mac;
+  }
+
+  /* calculate the session key */
+  if (!initialize_remote_session_info(&remote_session, &header, reader_master_key->master_salt, reader_master_key->master_sender_key, reader_master_key->transformation_kind, ex))
+    goto fail_decrypt;
+
+  if (is_encryption_required(transform_kind))
+  {
+    if (!is_encryption_expected(protection_kind))
+    {
+      DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_CRYPTO_ARGUMENT_CODE, 0,
+          "decode_datareader_submessage: submessage is encrypted, which is unexpected");
+      goto fail_decrypt;
+    }
+    /* When the CryptoHeader indicates that encryption is performed then decrypt the submessage body */
+    /* check if the body is a SEC_BODY submessage */
+    if (body.id != SMID_SEC_BODY_KIND)
+    {
+      DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_CRYPTO_ARGUMENT_CODE, 0,
+          "decode_datareader_submessage: " DDS_SECURITY_ERR_INVALID_CRYPTO_ARGUMENT_MESSAGE);
+      goto fail_decrypt;
+    }
+
+    plain_submsg->_buffer = DDS_Security_OctetSeq_allocbuf(contents._length);
+    plain_submsg->_length = plain_submsg->_maximum = contents._length;
+    if (!crypto_cipher_decrypt_data(&remote_session, header.session_id, contents._data, contents._length, NULL, 0,
+                                    plain_submsg->_buffer, &plain_submsg->_length, &footer->common_mac, ex))
+    {
+      goto fail_decrypt;
+    }
+  }
+  else if (is_authentication_required(transform_kind))
+  {
+    if (!is_authentication_expected(protection_kind))
+    {
+      DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_CRYPTO_ARGUMENT_CODE, 0,
+          "decode_datareader_submessage: submessage is signed, which is unexpected");
+      goto fail_decrypt;
+    }
+    /* When the CryptoHeader indicates that authentication is performed then calculate the HMAC */
+    if (!crypto_cipher_decrypt_data(&remote_session, header.session_id, NULL, 0, contents._data, contents._length, NULL, 0, &footer->common_mac, ex))
+      goto fail_decrypt;
+    plain_submsg->_buffer = DDS_Security_OctetSeq_allocbuf(contents._length);
+    plain_submsg->_length = plain_submsg->_maximum = contents._length;
+    memcpy(plain_submsg->_buffer, contents._data, contents._length);
+  }
+  else
+  {
+    DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT,
+                               DDS_SECURITY_ERR_INVALID_CRYPTO_TRANSFORMATION_CODE, 0,
+                               "decode_datareader_submessage: " DDS_SECURITY_ERR_INVALID_CRYPTO_TRANSFORMATION_MESSAGE);
+    goto fail_decrypt;
+  }
+  ddsrt_free(footer);
+  CRYPTO_OBJECT_RELEASE(reader_master_key);
+  return true;
+
+fail_decrypt:
+  DDS_Security_OctetSeq_deinit(plain_submsg);
+fail_reader_mac:
+  CRYPTO_OBJECT_RELEASE(reader_master_key);
+fail_invalid_arg:
+  ddsrt_free(footer);
+  return false;
+}
+
+static DDS_Security_boolean
+decode_serialized_payload(
+    dds_security_crypto_transform *instance,
+    DDS_Security_OctetSeq *plain_buffer,
+    const DDS_Security_OctetSeq *encoded_buffer,
+    const DDS_Security_OctetSeq *inline_qos,
+    const DDS_Security_DatareaderCryptoHandle reader_id,
+    const DDS_Security_DatawriterCryptoHandle writer_id,
+    DDS_Security_SecurityException *ex)
+{
+  dds_security_crypto_transform_impl *impl = (dds_security_crypto_transform_impl *)instance;
+  dds_security_crypto_key_factory *factory;
+  DDS_Security_BasicProtectionKind basic_protection_kind;
+  master_key_material *writer_master_key;
+  remote_session_info remote_session;
+  uint32_t transform_kind, transform_id;
+  struct crypto_header header;
+  unsigned char *payload_ptr;
+  uint32_t payload_len;
+  struct crypto_footer *footer = NULL;
+
+  DDSRT_UNUSED_ARG(inline_qos);
+
+  if (!instance || !encoded_buffer || !plain_buffer || reader_id == 0 || writer_id == 0)
+  {
+    DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_CRYPTO_ARGUMENT_CODE, 0,
+        "decode_serialized_payload: " DDS_SECURITY_ERR_INVALID_CRYPTO_ARGUMENT_MESSAGE);
+    goto fail_inv_arg;
+  }
+
+  if ((plain_buffer->_buffer != NULL) || (plain_buffer->_length != 0))
+  {
+    DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_CRYPTO_ARGUMENT_CODE, 0,
+        "decode_serialized_payload: given plain_buffer not empty");
+    goto fail_inv_arg;
+  }
+
+  /* Retrieve key material from sending_datawriter_crypto from factory */
+  factory = cryptography_get_crypto_key_factory(impl->crypto);
+
+  /* determine CryptoHeader, CryptoContent and CryptoFooter*/
+  if (!split_encoded_serialized_payload(encoded_buffer, &header, &payload_ptr, &payload_len, &footer))
+  {
+    DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_CRYPTO_ARGUMENT_CODE, 0,
+        "decode_serialized_payload: Invalid syntax of encoded payload");
+    goto fail_split;
+  }
+
+  if (footer->receiver_specific_macs._length != 0)
+  {
+    DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_CRYPTO_ARGUMENT_CODE, 0,
+        "decode_serialized_payload: Received specific_macs");
+    goto fail_prepare;
+  }
+
+  transform_kind = CRYPTO_TRANSFORM_KIND(header.transform_identifier.transformation_kind);
+  transform_id = CRYPTO_TRANSFORM_ID(header.transform_identifier.transformation_key_id);
+
+  if (!crypto_factory_get_remote_writer_key_material(factory, reader_id, writer_id, transform_id, &writer_master_key, NULL, &basic_protection_kind, ex))
+    goto fail_prepare;
+
+  /* calculate the session key */
+  if (!initialize_remote_session_info(&remote_session, &header, writer_master_key->master_salt, writer_master_key->master_sender_key, writer_master_key->transformation_kind, ex))
+    goto fail_decrypt;
+
+  /*
+     * Depending on encryption, the payload part between Header and Footer is
+     * either CryptoContent or the original plain payload.
+     * See spec: 9.5.3.3.4.4 Result from encode_serialized_payload
+     */
+  if (is_encryption_required(transform_kind))
+  {
+    struct crypto_contents_ref contents;
+    /* Is encryption expected? */
+    if (basic_protection_kind != DDS_SECURITY_BASICPROTECTION_KIND_ENCRYPT)
+    {
+      DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_CRYPTO_ARGUMENT_CODE, 0,
+          "decode_serialized_payload: payload is encrypted, which is unexpected");
+      goto fail_decrypt;
+    }
+    /* When encrypted, the content payload starts with a length: update contents. */
+    if (read_crypto_contents(&contents, payload_ptr, payload_len))
+    {
+      /* When the CryptoHeader indicates that encryption is performed then decrypt the payload */
+      plain_buffer->_buffer = DDS_Security_OctetSeq_allocbuf(contents._length);
+      plain_buffer->_length = plain_buffer->_maximum = contents._length;
+      if (!crypto_cipher_decrypt_data(&remote_session, header.session_id, contents._data, contents._length, NULL, 0, plain_buffer->_buffer, &plain_buffer->_length, &footer->common_mac, ex))
+      {
+        goto fail_decrypt;
+      }
+    }
+    else
+    {
+      DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_CRYPTO_TRANSFORMATION_CODE, 0,
+          "decode_serialized_payload: invalid payload format");
+      goto fail_decrypt;
+    }
+  }
+  else if (is_authentication_required(transform_kind))
+  {
+    /* Is signing expected? */
+    if (basic_protection_kind != DDS_SECURITY_BASICPROTECTION_KIND_SIGN)
+    {
+      DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_CRYPTO_ARGUMENT_CODE, 0,
+          "decode_serialized_payload: payload is signed, which is unexpected");
+      goto fail_decrypt;
+    }
+    /* When the CryptoHeader indicates that authentication is performed then calculate the HMAC */
+    if (!crypto_cipher_decrypt_data(&remote_session, header.session_id, NULL, 0, payload_ptr, payload_len, NULL, 0, &footer->common_mac, ex))
+    {
+      goto fail_decrypt;
+    }
+    plain_buffer->_buffer = DDS_Security_OctetSeq_allocbuf(payload_len);
+    plain_buffer->_length = plain_buffer->_maximum = payload_len;
+    memcpy(plain_buffer->_buffer, payload_ptr, payload_len);
+  }
+  else
+  {
+    DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_CRYPTO_TRANSFORMATION_CODE, 0,
+        "decode_serialized_payload: " DDS_SECURITY_ERR_INVALID_CRYPTO_TRANSFORMATION_MESSAGE);
+    goto fail_decrypt;
+  }
+  ddsrt_free(footer);
+  CRYPTO_OBJECT_RELEASE(writer_master_key);
+  return true;
+
+fail_decrypt:
+  DDS_Security_OctetSeq_deinit(plain_buffer);
+  CRYPTO_OBJECT_RELEASE(writer_master_key);
+fail_prepare:
+  ddsrt_free(footer);
+fail_split:
+fail_inv_arg:
+  return false;
+}
+
+dds_security_crypto_transform *
+dds_security_crypto_transform__alloc(
+    const dds_security_cryptography *crypto)
+{
+  dds_security_crypto_transform_impl *instance;
+  instance = (dds_security_crypto_transform_impl *)ddsrt_malloc(
+      sizeof(dds_security_crypto_transform_impl));
+
+  instance->crypto = crypto;
+  instance->base.encode_datawriter_submessage = &encode_datawriter_submessage;
+  instance->base.encode_datareader_submessage = &encode_datareader_submessage;
+  instance->base.encode_rtps_message = &encode_rtps_message;
+  instance->base.encode_serialized_payload = &encode_serialized_payload;
+  instance->base.decode_rtps_message = &decode_rtps_message;
+  instance->base.preprocess_secure_submsg = &preprocess_secure_submsg;
+  instance->base.decode_datawriter_submessage = &decode_datawriter_submessage;
+  instance->base.decode_datareader_submessage = &decode_datareader_submessage;
+  instance->base.decode_serialized_payload = &decode_serialized_payload;
+
+  OpenSSL_add_all_algorithms();
+  OpenSSL_add_all_ciphers();
+  OpenSSL_add_all_digests();
+  ERR_load_BIO_strings();
+  ERR_load_crypto_strings();
+
+  return (dds_security_crypto_transform *)instance;
+}
+
+void dds_security_crypto_transform__dealloc(
+    dds_security_crypto_transform *instance)
+{
+  RAND_cleanup();
+  EVP_cleanup();
+  CRYPTO_cleanup_all_ex_data();
+  REMOVE_THREAD_STATE();
+  ERR_free_strings();
+
+  ddsrt_free((dds_security_crypto_transform_impl *)instance);
+}
diff --git a/src/security/builtin_plugins/cryptographic/src/crypto_transform.h b/src/security/builtin_plugins/cryptographic/src/crypto_transform.h
new file mode 100644
index 0000000..7a73075
--- /dev/null
+++ b/src/security/builtin_plugins/cryptographic/src/crypto_transform.h
@@ -0,0 +1,28 @@
+/*
+ * Copyright(c) 2006 to 2019 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+#ifndef CRYPTO_TRANSFORM_H
+#define CRYPTO_TRANSFORM_H
+
+#include "dds/security/dds_security_api.h"
+
+/**
+ * @brief Allocation function for implementer structure (with internal variables) transparently.
+ */
+dds_security_crypto_transform *
+dds_security_crypto_transform__alloc(
+    const dds_security_cryptography *crypto);
+
+void
+dds_security_crypto_transform__dealloc(
+    dds_security_crypto_transform *instance);
+
+#endif /* CRYPTO_TRANSFORM_H */
diff --git a/src/security/builtin_plugins/cryptographic/src/crypto_utils.c b/src/security/builtin_plugins/cryptographic/src/crypto_utils.c
new file mode 100644
index 0000000..36e9f75
--- /dev/null
+++ b/src/security/builtin_plugins/cryptographic/src/crypto_utils.c
@@ -0,0 +1,153 @@
+/*
+ * Copyright(c) 2006 to 2019 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+#include <assert.h>
+#include <string.h>
+#include <openssl/bio.h>
+#include <openssl/err.h>
+#include <openssl/hmac.h>
+#include <openssl/rand.h>
+#include "dds/ddsrt/bswap.h"
+#include "dds/ddsrt/heap.h"
+#include "dds/ddsrt/string.h"
+#include "dds/ddsrt/types.h"
+#include "dds/security/dds_security_api.h"
+#include "dds/security/core/dds_security_utils.h"
+#include "crypto_defs.h"
+#include "crypto_utils.h"
+
+char *crypto_openssl_error_message(void)
+{
+  BIO *bio = BIO_new(BIO_s_mem());
+  char *msg;
+  char *buf = NULL;
+  size_t len;
+
+  if (!bio)
+    return ddsrt_strdup ("BIO_new failed");
+
+  ERR_print_errors(bio);
+  len = (size_t) BIO_get_mem_data(bio, &buf);
+  msg = ddsrt_malloc(len + 1);
+  memset(msg, 0, len + 1);
+  memcpy(msg, buf, len);
+  BIO_free(bio);
+  return msg;
+}
+
+static bool
+crypto_calculate_key_impl(
+    const char *prefix,
+    crypto_session_key_t *session_key,
+    uint32_t session_id,
+    const unsigned char *master_salt,
+    const unsigned char *master_key,
+    DDS_Security_CryptoTransformKind_Enum transformation_kind,
+    DDS_Security_SecurityException *ex)
+{
+  uint32_t key_bytes = CRYPTO_KEY_SIZE_BYTES(transformation_kind);
+  uint32_t id = ddsrt_toBE4u(session_id);
+  size_t sz = strlen(prefix) + key_bytes + sizeof(id);
+  unsigned char *buffer = ddsrt_malloc (sz);
+  unsigned char md[EVP_MAX_MD_SIZE];
+
+  memcpy(buffer, prefix, strlen(prefix));
+  memcpy(&buffer[strlen(prefix)], master_salt, key_bytes);
+  memcpy(&buffer[strlen(prefix) + key_bytes], &id, sizeof(id));
+  if (HMAC(EVP_sha256(), master_key, (int)key_bytes, buffer, sz, md, NULL) == NULL)
+  {
+    DDS_Security_Exception_set_with_openssl_error(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_CIPHER_ERROR, 0, "HMAC failed: ");
+    ddsrt_free (buffer);
+    return false;
+  }
+  memcpy (session_key->data, md, key_bytes);
+  ddsrt_free (buffer);
+  return true;
+}
+
+bool
+crypto_calculate_session_key(
+    crypto_session_key_t *session_key,
+    uint32_t session_id,
+    const unsigned char *master_salt,
+    const unsigned char *master_key,
+    DDS_Security_CryptoTransformKind_Enum transformation_kind,
+    DDS_Security_SecurityException *ex)
+{
+  return crypto_calculate_key_impl("SessionKey", session_key, session_id, master_salt, master_key, transformation_kind, ex);
+}
+
+bool
+crypto_calculate_receiver_specific_key(
+    crypto_session_key_t *session_key,
+    uint32_t session_id,
+    const unsigned char *master_salt,
+    const unsigned char *master_key,
+    DDS_Security_CryptoTransformKind_Enum transformation_kind,
+    DDS_Security_SecurityException *ex)
+{
+  return crypto_calculate_key_impl("SessionReceiverKey", session_key, session_id, master_salt, master_key, transformation_kind, ex);
+}
+
+uint32_t
+crypto_get_key_size(
+    DDS_Security_CryptoTransformKind_Enum kind)
+{
+  switch (kind)
+  {
+  case CRYPTO_TRANSFORMATION_KIND_AES128_GMAC:
+  case CRYPTO_TRANSFORMATION_KIND_AES128_GCM:
+    return 128;
+  case CRYPTO_TRANSFORMATION_KIND_AES256_GMAC:
+  case CRYPTO_TRANSFORMATION_KIND_AES256_GCM:
+    return 256;
+  default:
+    return 0;
+  }
+}
+
+uint32_t
+crypto_get_random_uint32(void)
+{
+  uint32_t val;
+  RAND_bytes((unsigned char *)&val, sizeof(uint32_t));
+  return val;
+}
+
+uint64_t
+crypto_get_random_uint64(void)
+{
+  uint64_t val;
+  RAND_bytes((unsigned char *)&val, sizeof(uint64_t));
+  return val;
+}
+
+unsigned char *
+crypto_hmac256(
+    const unsigned char *key,
+    uint32_t key_size,
+    const unsigned char *data,
+    uint32_t data_size,
+    DDS_Security_SecurityException *ex)
+{
+  unsigned char md[EVP_MAX_MD_SIZE];
+  unsigned char *result;
+
+  assert (key_size <= INT32_MAX);
+  if (HMAC(EVP_sha256(), key, (int) key_size, data, data_size, md, NULL) == NULL)
+  {
+    DDS_Security_Exception_set_with_openssl_error(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, 0, "Failed to init hashing context: ");
+    return NULL;
+  }
+  result = ddsrt_malloc(key_size);
+  memcpy (result, md, key_size);
+  return result;
+}
diff --git a/src/security/builtin_plugins/cryptographic/src/crypto_utils.h b/src/security/builtin_plugins/cryptographic/src/crypto_utils.h
new file mode 100644
index 0000000..b9ef5b9
--- /dev/null
+++ b/src/security/builtin_plugins/cryptographic/src/crypto_utils.h
@@ -0,0 +1,95 @@
+/*
+ * Copyright(c) 2006 to 2019 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+#ifndef CRYPTO_UTILS_H
+#define CRYPTO_UTILS_H
+
+#include "dds/ddsrt/bswap.h"
+#include "dds/ddsrt/endian.h"
+#include "dds/ddsrt/types.h"
+#include "dds/security/export.h"
+#include "dds/security/dds_security_api.h"
+#include "dds/security/core/dds_security_types.h"
+#include "crypto_defs.h"
+
+#define CRYPTO_TRANSFORM_KIND(k) ddsrt_fromBE4u((*(uint32_t *)&((k)[0])))
+#define CRYPTO_TRANSFORM_ID(k) ddsrt_fromBE4u((*(uint32_t *)&((k)[0])))
+#define CRYPTO_KEY_SIZE_BYTES(kind) (crypto_get_key_size(kind) >> 3)
+
+#define ALIGN4(x) (((x) + 3) & (uint32_t)(-4))
+
+struct init_vector_suffix
+{
+  uint32_t high;
+  uint32_t low;
+};
+
+/**
+ * Return a string that contains an openssl error description
+ * When a openssl function returns an error this function can be
+ * used to retrieve a descriptive error string.
+ * Note that the returned string should be freed.
+ */
+char *crypto_openssl_error_message(void);
+
+/**
+ * @param[in,out] session_key           Session key
+ * @param[in]     session_id            Session Id
+ * @param[in]     master_salt           Master salt
+ * @param[in]     master_key            Master key
+ * @param[in]     transformation_kind   Transformation kind
+ * @param[in,out] ex                    Security exception
+ */
+SECURITY_EXPORT bool crypto_calculate_session_key(
+    crypto_session_key_t *session_key,
+    uint32_t session_id,
+    const unsigned char *master_salt,
+    const unsigned char *master_key,
+    DDS_Security_CryptoTransformKind_Enum transformation_kind,
+    DDS_Security_SecurityException *ex);
+
+/**
+ * @param[in,out] session_key           Session key
+ * @param[in]     session_id            Session Id
+ * @param[in]     master_salt           Master salt
+ * @param[in]     master_key            Master key
+ * @param[in]     transformation_kind   Transformation kind
+ * @param[in,out] ex                    Security exception
+ */
+SECURITY_EXPORT bool crypto_calculate_receiver_specific_key(
+    crypto_session_key_t *session_key,
+    uint32_t session_id,
+    const unsigned char *master_salt,
+    const unsigned char *master_key,
+    DDS_Security_CryptoTransformKind_Enum transformation_kind,
+    DDS_Security_SecurityException *ex);
+
+SECURITY_EXPORT uint32_t crypto_get_key_size(DDS_Security_CryptoTransformKind_Enum kind);
+SECURITY_EXPORT uint32_t crypto_get_random_uint32(void);
+SECURITY_EXPORT uint64_t crypto_get_random_uint64(void);
+
+/**
+ * @brief Compute a HMAC256 on the provided data.
+ *
+ * @param[in]     key       The key used to compute the HMAC256 result
+ * @param[in]     key_size  The size of the key (128 or 256 bits)
+ * @param[in]     data      The data on which the HMAC is computed
+ * @param[in]     data_size The size of the data
+ * @param[in,out] ex        Security exception
+ */
+SECURITY_EXPORT unsigned char *crypto_hmac256(
+    const unsigned char *key,
+    uint32_t key_size,
+    const unsigned char *data,
+    uint32_t data_size,
+    DDS_Security_SecurityException *ex);
+
+#endif /* CRYPTO_UTILS_H */
diff --git a/src/security/builtin_plugins/cryptographic/src/cryptography.c b/src/security/builtin_plugins/cryptographic/src/cryptography.c
new file mode 100644
index 0000000..a8aee67
--- /dev/null
+++ b/src/security/builtin_plugins/cryptographic/src/cryptography.c
@@ -0,0 +1,98 @@
+/*
+ * Copyright(c) 2006 to 2019 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+#include "dds/ddsrt/heap.h"
+#include "dds/ddsrt/types.h"
+#include "dds/security/dds_security_api.h"
+#include "cryptography.h"
+#include "crypto_key_exchange.h"
+#include "crypto_key_factory.h"
+#include "crypto_transform.h"
+
+/**
+ * Implementation structure for storing encapsulated members of the instance
+ * while giving only the interface definition to user
+ */
+
+typedef struct dds_security_cryptography_impl {
+  dds_security_cryptography base;
+} dds_security_cryptography_impl;
+
+dds_security_crypto_key_factory *cryptography_get_crypto_key_factory (const struct dds_security_cryptography *crypto)
+{
+  const dds_security_cryptography_impl *instance = (dds_security_cryptography_impl *) crypto;
+  return instance->base.crypto_key_factory;
+}
+
+dds_security_crypto_key_exchange *cryptography_get_crypto_key_exchange (const struct dds_security_cryptography *crypto)
+{
+  const dds_security_cryptography_impl *instance = (dds_security_cryptography_impl *) crypto;
+  return instance->base.crypto_key_exchange;
+}
+
+dds_security_crypto_transform *cryptography_get_crypto_transform (const struct dds_security_cryptography *crypto)
+{
+  const dds_security_cryptography_impl *instance = (dds_security_cryptography_impl *) crypto;
+  return instance->base.crypto_transform;
+}
+
+
+int init_crypto (const char *argument, void **context)
+{
+  dds_security_cryptography_impl *cryptography;
+  dds_security_crypto_key_exchange *crypto_key_exchange;
+  dds_security_crypto_key_factory *crypto_key_factory;
+  dds_security_crypto_transform *crypto_transform;
+
+  DDSRT_UNUSED_ARG (argument);
+
+  /* allocate new instance */
+  cryptography = ddsrt_malloc (sizeof(*cryptography));
+
+  /* assign the sub components */
+  crypto_key_exchange = dds_security_crypto_key_exchange__alloc ((dds_security_cryptography *)cryptography);
+  if (!crypto_key_exchange) goto err_exchange;
+
+  crypto_key_factory = dds_security_crypto_key_factory__alloc ((dds_security_cryptography *)cryptography);
+  if (!crypto_key_factory) goto err_factory;
+
+  crypto_transform = dds_security_crypto_transform__alloc ((dds_security_cryptography *)cryptography);
+  if (!crypto_transform) goto err_transform;
+
+  cryptography->base.crypto_key_exchange = crypto_key_exchange;
+  cryptography->base.crypto_key_factory = crypto_key_factory;
+  cryptography->base.crypto_transform = crypto_transform;
+
+  /* return the instance */
+  *context = cryptography;
+  return DDS_SECURITY_SUCCESS;
+
+err_transform:
+  dds_security_crypto_key_factory__dealloc (crypto_key_factory);
+err_factory:
+  dds_security_crypto_key_exchange__dealloc (crypto_key_exchange);
+err_exchange:
+  ddsrt_free (cryptography);
+  *context = NULL;
+  return DDS_SECURITY_FAILED;
+}
+
+int finalize_crypto (void *instance)
+{
+  dds_security_cryptography_impl* instance_impl = (dds_security_cryptography_impl*) instance;
+  /* deallocate components */
+  dds_security_crypto_key_exchange__dealloc (instance_impl->base.crypto_key_exchange);
+  dds_security_crypto_key_factory__dealloc (instance_impl->base.crypto_key_factory);
+  dds_security_crypto_transform__dealloc (instance_impl->base.crypto_transform);
+  /* deallocate cryptography */
+  ddsrt_free (instance_impl);
+  return DDS_SECURITY_SUCCESS;
+}
diff --git a/src/security/builtin_plugins/cryptographic/src/cryptography.h b/src/security/builtin_plugins/cryptographic/src/cryptography.h
new file mode 100644
index 0000000..eb114d4
--- /dev/null
+++ b/src/security/builtin_plugins/cryptographic/src/cryptography.h
@@ -0,0 +1,33 @@
+/*
+ * Copyright(c) 2006 to 2019 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+#ifndef CRYPTOGRAPHY_H
+#define CRYPTOGRAPHY_H
+
+#include "dds/security/dds_security_api.h"
+#include "dds/security/export.h"
+
+SECURITY_EXPORT int init_crypto(const char *argument, void **context);
+SECURITY_EXPORT int finalize_crypto(void *instance);
+
+dds_security_crypto_key_factory *
+cryptography_get_crypto_key_factory(
+    const dds_security_cryptography *crypto);
+
+dds_security_crypto_key_exchange *
+cryptography_get_crypto_key_exchange(
+    const dds_security_cryptography *crypto);
+
+dds_security_crypto_transform *
+cryptography_get_crypto_transform(
+    const dds_security_cryptography *crypto);
+
+#endif /* CRYPTOGRAPHY_H */
diff --git a/src/security/builtin_plugins/tests/CMakeLists.txt b/src/security/builtin_plugins/tests/CMakeLists.txt
index 7290ca4..226255f 100644
--- a/src/security/builtin_plugins/tests/CMakeLists.txt
+++ b/src/security/builtin_plugins/tests/CMakeLists.txt
@@ -10,42 +10,63 @@
 # SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
 #
 include(CUnit)
+find_package(OpenSSL)
 
 set(security_auth_test_sources
-    "validate_begin_handshake_reply/src/validate_begin_handshake_reply_utests.c"
+    "common/src/loader.c"
+    "common/src/handshake_helper.c"
     "get_authenticated_peer_credential_token/src/get_authenticated_peer_credential_token_utests.c"
+    "process_handshake/src/process_handshake_utests.c"
+    "validate_begin_handshake_reply/src/validate_begin_handshake_reply_utests.c"
+    "validate_begin_handshake_request/src/validate_begin_handshake_request_utests.c"
     "validate_local_identity/src/validate_local_identity_utests.c"
     "validate_remote_identity/src/validate_remote_identity_utests.c"
-    "validate_begin_handshake_request/src/validate_begin_handshake_request_utests.c"
-    "process_handshake/src/process_handshake_utests.c"
-    "common/src/handshake_helper.c"
-    "common/src/loader.c")
+)
 
-add_cunit_executable(cunit_security_plugins ${security_auth_test_sources})
-target_include_directories(
-  cunit_security_plugins PRIVATE
-  "$<BUILD_INTERFACE:${CMAKE_BINARY_DIR}/src/include/>"
-       "$<BUILD_INTERFACE:$<TARGET_PROPERTY:security_api,INTERFACE_INCLUDE_DIRECTORIES>>"
-        "$<BUILD_INTERFACE:$<TARGET_PROPERTY:security_core,INTERFACE_INCLUDE_DIRECTORIES>>"
-        "$<BUILD_INTERFACE:$<TARGET_PROPERTY:ddsrt,INTERFACE_INCLUDE_DIRECTORIES>>"
-        "$<BUILD_INTERFACE:${CMAKE_CURRENT_LIST_DIR}>"
-        "$<BUILD_INTERFACE:${CMAKE_CURRENT_BINARY_DIR}>"
- )
+set(security_crypto_test_sources
+    "common/src/crypto_helper.c"
+    "create_local_datareader_crypto_tokens/src/create_local_datareader_crypto_tokens_utests.c"
+    "create_local_datawriter_crypto_tokens/src/create_local_datawriter_crypto_tokens_utests.c"
+    "create_local_participant_crypto_tokens/src/create_local_participant_crypto_tokens_utests.c"
+    "decode_datareader_submessage/src/decode_datareader_submessage_utests.c"
+    "decode_datawriter_submessage/src/decode_datawriter_submessage_utests.c"
+    "decode_rtps_message/src/decode_rtps_message_utests.c"
+    "decode_serialized_payload/src/decode_serialized_payload_utests.c"
+    "encode_datareader_submessage/src/encode_datareader_submessage_utests.c"
+    "encode_datawriter_submessage/src/encode_datawriter_submessage_utests.c"
+    "encode_rtps_message/src/encode_rtps_message_utests.c"
+    "encode_serialized_payload/src/encode_serialized_payload_utests.c"
+    "preprocess_secure_submsg/src/preprocess_secure_submsg_utests.c"
+    "register_local_datareader/src/register_local_datareader_utests.c"
+    "register_local_datawriter/src/register_local_datawriter_utests.c"
+    "register_local_participant/src/register_local_participant_utests.c"
+    "register_matched_remote_datareader/src/register_matched_remote_datareader_utests.c"
+    "register_matched_remote_datawriter/src/register_matched_remote_datawriter_utests.c"
+    "register_matched_remote_participant/src/register_matched_remote_participant_utests.c"
+    "set_remote_datareader_crypto_tokens/src/set_remote_datareader_crypto_tokens_utests.c"
+    "set_remote_datawriter_crypto_tokens/src/set_remote_datawriter_crypto_tokens_utests.c"
+    "set_remote_participant_crypto_tokens/src/set_remote_participant_crypto_tokens_utests.c"
+)
 
-
-target_link_libraries(cunit_security_plugins PRIVATE ddsc security_api)
-
-
-find_package(OpenSSL )
+add_cunit_executable(cunit_security_plugins ${security_auth_test_sources} ${security_crypto_test_sources})
 if(OPENSSL_FOUND)
   target_link_libraries(cunit_security_plugins PRIVATE OpenSSL::SSL)
-
 else()
   message(FATAL_ERROR "To build without openssl support, set DDSC_ENABLE_OPENSSL to OFF")
 endif()
 
+target_include_directories(
+  cunit_security_plugins PRIVATE
+      "$<BUILD_INTERFACE:${CMAKE_CURRENT_LIST_DIR}/../cryptographic/src/>"
+      "$<BUILD_INTERFACE:$<TARGET_PROPERTY:security_api,INTERFACE_INCLUDE_DIRECTORIES>>"
+      "$<BUILD_INTERFACE:$<TARGET_PROPERTY:security_core,INTERFACE_INCLUDE_DIRECTORIES>>"
+      "$<BUILD_INTERFACE:$<TARGET_PROPERTY:ddsrt,INTERFACE_INCLUDE_DIRECTORIES>>"
+      "$<BUILD_INTERFACE:${CMAKE_CURRENT_LIST_DIR}>"
+      "$<BUILD_INTERFACE:${CMAKE_CURRENT_BINARY_DIR}>"
+)
+
+target_link_libraries(cunit_security_plugins PRIVATE ddsc security_api dds_security_crypto)
+
 set(CUnit_builtin_plugins_tests_dir "${CMAKE_CURRENT_LIST_DIR}")
 
 configure_file("config_env.h.in" "config_env.h")
-
-
diff --git a/src/security/builtin_plugins/tests/common/src/crypto_helper.c b/src/security/builtin_plugins/tests/common/src/crypto_helper.c
new file mode 100644
index 0000000..8497f80
--- /dev/null
+++ b/src/security/builtin_plugins/tests/common/src/crypto_helper.c
@@ -0,0 +1,112 @@
+/*
+ * Copyright(c) 2006 to 2019 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+#include <assert.h>
+#include <openssl/evp.h>
+#include <openssl/hmac.h>
+#include <openssl/bio.h>
+#include <openssl/err.h>
+
+#include "dds/ddsrt/bswap.h"
+#include "dds/ddsrt/endian.h"
+#include "dds/ddsrt/heap.h"
+#include "dds/ddsrt/string.h"
+#include "dds/ddsrt/types.h"
+#include "dds/ddsrt/environ.h"
+#include "dds/security/dds_security_api.h"
+#include "dds/security/core/dds_security_serialize.h"
+#include "dds/security/core/dds_security_utils.h"
+#include "dds/security/core/shared_secret.h"
+#include "CUnit/CUnit.h"
+#include "CUnit/Test.h"
+#include "crypto_helper.h"
+#include "crypto_utils.h"
+
+
+static bool
+crypto_calculate_session_key_impl_test(
+    const char *prefix,
+    crypto_session_key_t *session_key,
+    uint32_t session_id,
+    const unsigned char *master_salt,
+    const unsigned char *master_key,
+    DDS_Security_CryptoTransformKind_Enum transformation_kind)
+{
+  bool result = true;
+  uint32_t key_bytes = CRYPTO_KEY_SIZE_BYTES(transformation_kind);
+  uint32_t id = ddsrt_toBE4u(session_id);
+  size_t sz = strlen(prefix) + key_bytes + sizeof(id);
+  unsigned char *buffer = ddsrt_malloc (sz);
+  memcpy(buffer, prefix, strlen(prefix));
+  memcpy(&buffer[strlen(prefix)], master_salt, key_bytes);
+  memcpy(&buffer[strlen(prefix) + key_bytes], &id, sizeof(id));
+  if (HMAC(EVP_sha256(), master_key, (int)key_bytes, buffer, sz, session_key->data, NULL) == NULL)
+  {
+    ERR_print_errors_fp(stderr);
+    result = false;
+  }
+  ddsrt_free (buffer);
+  return result;
+}
+
+bool
+crypto_calculate_session_key_test(
+    crypto_session_key_t *session_key,
+    uint32_t session_id,
+    const unsigned char *master_salt,
+    const unsigned char *master_key,
+    DDS_Security_CryptoTransformKind_Enum transformation_kind)
+{
+  return crypto_calculate_session_key_impl_test ("SessionKey", session_key, session_id, master_salt, master_key, transformation_kind);
+}
+
+bool calculate_receiver_specific_key_test(
+    crypto_session_key_t *session_key,
+    uint32_t session_id,
+    const unsigned char *master_salt,
+    const unsigned char *master_key,
+    DDS_Security_CryptoTransformKind_Enum transformation_kind)
+{
+  return crypto_calculate_session_key_impl_test ("SessionReceiverKey", session_key, session_id, master_salt, master_key, transformation_kind);
+}
+
+int master_salt_not_empty(master_key_material *keymat)
+{
+  uint32_t key_bytes = CRYPTO_KEY_SIZE_BYTES(keymat->transformation_kind);
+  for (uint32_t i = 0; i < key_bytes; i++)
+  {
+    if (keymat->master_salt[i])
+      return 1;
+  }
+  return 0;
+}
+
+int master_key_not_empty(master_key_material *keymat)
+{
+  uint32_t key_bytes = CRYPTO_KEY_SIZE_BYTES(keymat->transformation_kind);
+  for (uint32_t i = 0; i < key_bytes; i++)
+  {
+    if (keymat->master_sender_key[i])
+      return 1;
+  }
+  return 0;
+}
+
+int master_receiver_specific_key_not_empty(master_key_material *keymat)
+{
+  uint32_t key_bytes = CRYPTO_KEY_SIZE_BYTES(keymat->transformation_kind);
+  for (uint32_t i = 0; i < key_bytes; i++)
+  {
+    if (keymat->master_receiver_specific_key[i])
+      return 1;
+  }
+  return 0;
+}
diff --git a/src/security/builtin_plugins/tests/common/src/crypto_helper.h b/src/security/builtin_plugins/tests/common/src/crypto_helper.h
new file mode 100644
index 0000000..ad64fcb
--- /dev/null
+++ b/src/security/builtin_plugins/tests/common/src/crypto_helper.h
@@ -0,0 +1,38 @@
+/*
+ * Copyright(c) 2006 to 2019 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+#ifndef DDS_SECURITY_BUITIN_TEST_CRYPTO_HELPER_H
+#define DDS_SECURITY_BUITIN_TEST_CRYPTO_HELPER_H
+
+#include "dds/ddsrt/types.h"
+#include "dds/security/dds_security_api.h"
+#include "crypto_objects.h"
+
+bool
+crypto_calculate_session_key_test(
+    crypto_session_key_t *session_key,
+    uint32_t session_id,
+    const unsigned char *master_salt,
+    const unsigned char *master_key,
+    DDS_Security_CryptoTransformKind_Enum transformation_kind);
+
+bool calculate_receiver_specific_key_test(
+    crypto_session_key_t *session_key,
+    uint32_t session_id,
+    const unsigned char *master_salt,
+    const unsigned char *master_key,
+    DDS_Security_CryptoTransformKind_Enum transformation_kind);
+
+int master_salt_not_empty(master_key_material *keymat);
+int master_key_not_empty(master_key_material *keymat);
+int master_receiver_specific_key_not_empty(master_key_material *keymat);
+
+#endif /* DDS_SECURITY_BUITIN_TEST_CRYPTO_HELPER_H */
\ No newline at end of file
diff --git a/src/security/builtin_plugins/tests/create_local_datareader_crypto_tokens/src/create_local_datareader_crypto_tokens_utests.c b/src/security/builtin_plugins/tests/create_local_datareader_crypto_tokens/src/create_local_datareader_crypto_tokens_utests.c
new file mode 100644
index 0000000..be6a188
--- /dev/null
+++ b/src/security/builtin_plugins/tests/create_local_datareader_crypto_tokens/src/create_local_datareader_crypto_tokens_utests.c
@@ -0,0 +1,501 @@
+/*
+ * Copyright(c) 2006 to 2019 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+#include <openssl/evp.h>
+#include <openssl/hmac.h>
+#include <openssl/bio.h>
+#include <openssl/err.h>
+
+#include "dds/ddsrt/heap.h"
+#include "dds/ddsrt/string.h"
+#include "dds/ddsrt/types.h"
+#include "dds/ddsrt/environ.h"
+#include "dds/security/dds_security_api.h"
+#include "dds/security/core/dds_security_serialize.h"
+#include "dds/security/core/dds_security_utils.h"
+#include "dds/security/core/shared_secret.h"
+#include "CUnit/CUnit.h"
+#include "CUnit/Test.h"
+#include "common/src/loader.h"
+#include "crypto_objects.h"
+
+#define TEST_SHARED_SECRET_SIZE 32
+
+#define CRYPTO_TRANSFORM_KIND(k) (*(uint32_t *)&((k)[0]))
+#define CRYPTO_TRANSFORM_ID(k) (*(uint32_t *)&((k)[0]))
+
+static const char *CRYPTO_TOKEN_CLASS_ID = "DDS:Crypto:AES_GCM_GMAC";
+static const char *CRYPTO_TOKEN_PROPERTY_NAME = "dds.cryp.keymat";
+
+static struct plugins_hdl *plugins = NULL;
+static dds_security_cryptography *crypto = NULL;
+
+static DDS_Security_IdentityHandle local_participant_identity = 1;
+static DDS_Security_IdentityHandle remote_participant_identity = 2;
+
+static DDS_Security_ParticipantCryptoHandle local_particpant_crypto = 0;
+static DDS_Security_ParticipantCryptoHandle remote_particpant_crypto = 0;
+static DDS_Security_DatawriterCryptoHandle local_reader_crypto = 0;
+static DDS_Security_DatareaderCryptoHandle remote_writer_crypto = 0;
+
+static DDS_Security_SharedSecretHandleImpl *shared_secret_handle_impl = NULL;
+static DDS_Security_SharedSecretHandle shared_secret_handle;
+
+static void allocate_shared_secret(void)
+{
+  int32_t i;
+
+  shared_secret_handle_impl = ddsrt_malloc(sizeof(DDS_Security_SharedSecretHandleImpl));
+
+  shared_secret_handle_impl->shared_secret = ddsrt_malloc(TEST_SHARED_SECRET_SIZE * sizeof(unsigned char));
+  shared_secret_handle_impl->shared_secret_size = TEST_SHARED_SECRET_SIZE;
+
+  for (i = 0; i < shared_secret_handle_impl->shared_secret_size; i++)
+  {
+    shared_secret_handle_impl->shared_secret[i] = (unsigned char)(i % 20);
+  }
+  for (i = 0; i < 32; i++)
+  {
+    shared_secret_handle_impl->challenge1[i] = (unsigned char)(i % 15);
+    shared_secret_handle_impl->challenge2[i] = (unsigned char)(i % 12);
+  }
+
+  shared_secret_handle = (DDS_Security_SharedSecretHandle)shared_secret_handle_impl;
+}
+
+static void deallocate_shared_secret(void)
+{
+  ddsrt_free(shared_secret_handle_impl->shared_secret);
+  ddsrt_free(shared_secret_handle_impl);
+}
+
+static void prepare_endpoint_security_attributes(DDS_Security_EndpointSecurityAttributes *attributes)
+{
+  memset(attributes, 0, sizeof(DDS_Security_EndpointSecurityAttributes));
+  attributes->is_discovery_protected = true;
+  attributes->is_submessage_protected = true;
+
+  attributes->plugin_endpoint_attributes |= DDS_SECURITY_PLUGIN_ENDPOINT_ATTRIBUTES_FLAG_IS_SUBMESSAGE_ENCRYPTED;
+}
+
+static void prepare_participant_security_attributes(DDS_Security_ParticipantSecurityAttributes *attributes)
+{
+  memset(attributes, 0, sizeof(DDS_Security_ParticipantSecurityAttributes));
+  attributes->allow_unauthenticated_participants = false;
+  attributes->is_access_protected = false;
+  attributes->is_discovery_protected = false;
+  attributes->is_liveliness_protected = false;
+  attributes->is_rtps_protected = true;
+  attributes->plugin_participant_attributes = DDS_SECURITY_PARTICIPANT_ATTRIBUTES_FLAG_IS_VALID;
+  attributes->plugin_participant_attributes |= DDS_SECURITY_PLUGIN_PARTICIPANT_ATTRIBUTES_FLAG_IS_RTPS_ENCRYPTED;
+}
+
+static int register_local_participant(void)
+{
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  DDS_Security_PermissionsHandle participant_permissions = 3; //valid dummy value
+  DDS_Security_PropertySeq participant_properties;
+  DDS_Security_ParticipantSecurityAttributes participant_security_attributes;
+
+  memset(&participant_properties, 0, sizeof(participant_properties));
+  prepare_participant_security_attributes(&participant_security_attributes);
+
+  local_particpant_crypto =
+      crypto->crypto_key_factory->register_local_participant(
+          crypto->crypto_key_factory,
+          local_participant_identity,
+          participant_permissions,
+          &participant_properties,
+          &participant_security_attributes,
+          &exception);
+
+  if (local_particpant_crypto == 0)
+  {
+    printf("register_local_participant: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+
+  return local_particpant_crypto ? 0 : -1;
+}
+
+static int register_remote_participant(void)
+{
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  DDS_Security_PermissionsHandle remote_participant_permissions = 5;
+
+  remote_particpant_crypto =
+      crypto->crypto_key_factory->register_matched_remote_participant(
+          crypto->crypto_key_factory,
+          local_particpant_crypto,
+          remote_participant_identity,
+          remote_participant_permissions,
+          shared_secret_handle,
+          &exception);
+
+  if (remote_particpant_crypto == 0)
+  {
+    printf("register_matched_remote_participant: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+
+  return remote_particpant_crypto ? 0 : -1;
+}
+
+static int register_local_datareader(void)
+{
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  DDS_Security_PropertySeq datareader_properties;
+  DDS_Security_EndpointSecurityAttributes datareader_security_attributes;
+
+  memset(&datareader_properties, 0, sizeof(datareader_properties));
+
+  prepare_endpoint_security_attributes(&datareader_security_attributes);
+
+  local_reader_crypto =
+      crypto->crypto_key_factory->register_local_datareader(
+          crypto->crypto_key_factory,
+          local_particpant_crypto,
+          &datareader_properties,
+          &datareader_security_attributes,
+          &exception);
+
+  if (local_reader_crypto == 0)
+  {
+    printf("register_local_datawriter: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+
+  return local_reader_crypto ? 0 : -1;
+}
+
+static int register_remote_datawriter(void)
+{
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+
+  remote_writer_crypto =
+      crypto->crypto_key_factory->register_matched_remote_datawriter(
+          crypto->crypto_key_factory,
+          local_reader_crypto,
+          remote_particpant_crypto,
+          shared_secret_handle,
+          &exception);
+
+  if (remote_writer_crypto == 0)
+  {
+    printf("register_matched_remote_datareader: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+
+  return remote_writer_crypto ? 0 : -1;
+}
+
+static void reset_exception(DDS_Security_SecurityException *ex)
+{
+  ex->code = 0;
+  ex->minor_code = 0;
+  ddsrt_free(ex->message);
+  ex->message = NULL;
+}
+
+static void suite_create_local_datareader_crypto_tokens_init(void)
+{
+  allocate_shared_secret();
+  CU_ASSERT_FATAL ((plugins = load_plugins(
+                      NULL    /* Access Control */,
+                      NULL    /* Authentication */,
+                      &crypto /* Cryptograpy    */)) != NULL);
+  CU_ASSERT_EQUAL_FATAL (register_local_participant(), 0);
+  CU_ASSERT_EQUAL_FATAL (register_remote_participant(), 0);
+  CU_ASSERT_EQUAL_FATAL (register_local_datareader(), 0);
+  CU_ASSERT_EQUAL_FATAL (register_remote_datawriter(), 0);
+}
+
+static void suite_create_local_datareader_crypto_tokens_fini(void)
+{
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+
+  if (remote_writer_crypto)
+  {
+    crypto->crypto_key_factory->unregister_datawriter(crypto->crypto_key_factory, remote_writer_crypto, &exception);
+    reset_exception(&exception);
+  }
+  if (local_reader_crypto)
+  {
+    crypto->crypto_key_factory->unregister_datareader(crypto->crypto_key_factory, local_reader_crypto, &exception);
+    reset_exception(&exception);
+  }
+  if (remote_particpant_crypto)
+  {
+    crypto->crypto_key_factory->unregister_participant(crypto->crypto_key_factory, remote_particpant_crypto, &exception);
+    reset_exception(&exception);
+  }
+  if (local_particpant_crypto)
+  {
+    crypto->crypto_key_factory->unregister_datareader(crypto->crypto_key_factory, local_particpant_crypto, &exception);
+    reset_exception(&exception);
+  }
+  deallocate_shared_secret();
+  unload_plugins(plugins);
+}
+
+static bool data_not_empty(unsigned char *data, uint32_t length)
+{
+  uint32_t i;
+  for (i = 0; i < length; i++)
+  {
+    if (data[i])
+      return true;
+  }
+  return false;
+}
+
+static bool check_key_material(DDS_Security_OctetSeq *data)
+{
+  bool status = true;
+  DDS_Security_Deserializer deserializer;
+  DDS_Security_KeyMaterial_AES_GCM_GMAC key_mat;
+
+  deserializer = DDS_Security_Deserializer_new(data->_buffer, data->_length);
+  if (DDS_Security_Deserialize_KeyMaterial_AES_GCM_GMAC(deserializer, &key_mat))
+  {
+    if (CRYPTO_TRANSFORM_KIND(key_mat.transformation_kind) == CRYPTO_TRANSFORMATION_KIND_AES256_GCM)
+    {
+      printf("check_key_material: incorrect transformation_kind\n");
+      status = false;
+    }
+    else if (CRYPTO_TRANSFORM_ID(key_mat.sender_key_id) == 0)
+    {
+      printf("check_key_material: incorrect sender_key_id\n");
+      status = false;
+    }
+    else if (key_mat.master_salt._length != DDS_SECURITY_MASTER_SALT_SIZE_256)
+    {
+      printf("check_key_material: incorrect master_salt\n");
+      status = false;
+    }
+    else if (!key_mat.master_salt._buffer)
+    {
+      printf("check_key_material: incorrect master_salt\n");
+      status = false;
+    }
+    else if (!data_not_empty(key_mat.master_salt._buffer, key_mat.master_salt._length))
+    {
+      printf("check_key_material: incorrect master_salt\n");
+      status = false;
+    }
+    else if (key_mat.master_sender_key._length != DDS_SECURITY_MASTER_SENDER_KEY_SIZE_256)
+    {
+      printf("check_key_material: incorrect master_sender_key\n");
+      status = false;
+    }
+    else if (!key_mat.master_salt._buffer)
+    {
+      printf("check_key_material: incorrect master_sender_key\n");
+      status = false;
+    }
+    else if (!data_not_empty(key_mat.master_sender_key._buffer, key_mat.master_sender_key._length))
+    {
+      printf("check_key_material: incorrect master_sender_key\n");
+      status = false;
+    }
+  }
+  else
+  {
+    status = false;
+  }
+
+  DDS_Security_Deserializer_free(deserializer);
+  DDS_Security_KeyMaterial_AES_GCM_GMAC_deinit(&key_mat);
+
+  return status;
+}
+
+static bool check_token_validity(const DDS_Security_DatawriterCryptoTokenSeq *tokens)
+{
+  bool status = true;
+  uint32_t i;
+
+  if (tokens->_length != 1 || tokens->_buffer == NULL)
+  {
+    status = false;
+  }
+
+  for (i = 0; status && (i < tokens->_length); i++)
+  {
+    status = (tokens->_buffer[i].class_id != NULL) &&
+             (strcmp(CRYPTO_TOKEN_CLASS_ID, tokens->_buffer[i].class_id) == 0) &&
+             (tokens->_buffer[i].binary_properties._length == 1) &&
+             (tokens->_buffer[i].binary_properties._buffer != NULL) &&
+             (tokens->_buffer[i].binary_properties._buffer[0].name != NULL) &&
+             (strcmp(CRYPTO_TOKEN_PROPERTY_NAME, tokens->_buffer[i].binary_properties._buffer[0].name) == 0) &&
+             (tokens->_buffer[i].binary_properties._buffer[0].value._length > 0) &&
+             (tokens->_buffer[i].binary_properties._buffer[0].value._buffer != NULL);
+
+    if (status)
+    {
+      status = check_key_material(&tokens->_buffer[i].binary_properties._buffer[0].value);
+    }
+  }
+
+  return status;
+}
+
+CU_Test(ddssec_builtin_create_local_datareader_crypto_tokens, happy_day, .init = suite_create_local_datareader_crypto_tokens_init, .fini = suite_create_local_datareader_crypto_tokens_fini)
+{
+  DDS_Security_boolean result;
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  DDS_Security_DatawriterCryptoTokenSeq tokens;
+
+  CU_ASSERT_FATAL(crypto != NULL);
+  CU_ASSERT_FATAL(crypto->crypto_key_exchange != NULL);
+  CU_ASSERT_FATAL(crypto->crypto_key_exchange->create_local_datareader_crypto_tokens != NULL);
+
+  memset(&tokens, 0, sizeof(tokens));
+
+  /* Now call the function. */
+  result = crypto->crypto_key_exchange->create_local_datareader_crypto_tokens(
+      crypto->crypto_key_exchange,
+      &tokens,
+      local_reader_crypto,
+      remote_writer_crypto,
+      &exception);
+
+  if (!result)
+  {
+    printf("create_local_datareader_crypto_tokens: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+
+  CU_ASSERT_FATAL(result);
+  CU_ASSERT(exception.code == 0);
+  CU_ASSERT(exception.message == NULL);
+
+  reset_exception(&exception);
+
+  CU_ASSERT(check_token_validity(&tokens));
+
+  result = crypto->crypto_key_exchange->return_crypto_tokens(crypto->crypto_key_exchange, &tokens, &exception);
+
+  if (!result)
+  {
+    printf("return_crypto_tokens: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+
+  CU_ASSERT_FATAL(result);
+  CU_ASSERT(exception.code == 0);
+  CU_ASSERT(exception.message == NULL);
+
+  reset_exception(&exception);
+}
+
+CU_Test(ddssec_builtin_create_local_datareader_crypto_tokens, invalid_args, .init = suite_create_local_datareader_crypto_tokens_init, .fini = suite_create_local_datareader_crypto_tokens_fini)
+{
+  DDS_Security_boolean result;
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  DDS_Security_DatawriterCryptoTokenSeq tokens;
+
+  /* Check if we actually have the validate_local_identity() function. */
+  CU_ASSERT_FATAL(crypto != NULL);
+  CU_ASSERT_FATAL(crypto->crypto_key_exchange != NULL);
+  CU_ASSERT_FATAL(crypto->crypto_key_exchange->create_local_datareader_crypto_tokens != NULL);
+
+  memset(&tokens, 0, sizeof(tokens));
+
+  /* invalid token seq = NULL */
+  result = crypto->crypto_key_exchange->create_local_datareader_crypto_tokens(
+      crypto->crypto_key_exchange,
+      NULL,
+      local_reader_crypto,
+      remote_writer_crypto,
+      &exception);
+
+  if (!result)
+  {
+    printf("create_local_datareader_crypto_tokens: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+
+  CU_ASSERT(!result);
+  CU_ASSERT(exception.code != 0);
+  CU_ASSERT(exception.message != NULL);
+
+  reset_exception(&exception);
+
+  /* invalid local_crypto_handle = DDS_SECURITY_HANDLE_NIL */
+  result = crypto->crypto_key_exchange->create_local_datawriter_crypto_tokens(
+      crypto->crypto_key_exchange,
+      &tokens,
+      0,
+      remote_writer_crypto,
+      &exception);
+
+  if (!result)
+  {
+    printf("create_local_datawriter_crypto_tokens: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+
+  CU_ASSERT(!result);
+  CU_ASSERT(exception.code != 0);
+  CU_ASSERT(exception.message != NULL);
+
+  reset_exception(&exception);
+
+  /* invalid remote_crypto_handle = DDS_SECURITY_HANDLE_NIL */
+  result = crypto->crypto_key_exchange->create_local_datareader_crypto_tokens(
+      crypto->crypto_key_exchange,
+      &tokens,
+      local_reader_crypto,
+      0,
+      &exception);
+
+  if (!result)
+  {
+    printf("create_local_datareader_crypto_tokens: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+
+  CU_ASSERT(!result);
+  CU_ASSERT(exception.code != 0);
+  CU_ASSERT(exception.message != NULL);
+
+  reset_exception(&exception);
+
+  /* invalid local_crypto_handle = 1 */
+  result = crypto->crypto_key_exchange->create_local_datareader_crypto_tokens(
+      crypto->crypto_key_exchange,
+      &tokens,
+      1,
+      remote_writer_crypto,
+      &exception);
+
+  if (!result)
+  {
+    printf("create_local_datareader_crypto_tokens: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+
+  CU_ASSERT(!result);
+  CU_ASSERT(exception.code != 0);
+  CU_ASSERT(exception.message != NULL);
+
+  reset_exception(&exception);
+
+  /* invalid remote_crypto_handle = 1 */
+  result = crypto->crypto_key_exchange->create_local_datareader_crypto_tokens(
+      crypto->crypto_key_exchange,
+      &tokens,
+      local_reader_crypto,
+      1,
+      &exception);
+
+  if (!result)
+  {
+    printf("create_local_datareader_crypto_tokens: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+
+  CU_ASSERT(!result);
+  CU_ASSERT(exception.code != 0);
+  CU_ASSERT(exception.message != NULL);
+
+  reset_exception(&exception);
+}
diff --git a/src/security/builtin_plugins/tests/create_local_datawriter_crypto_tokens/src/create_local_datawriter_crypto_tokens_utests.c b/src/security/builtin_plugins/tests/create_local_datawriter_crypto_tokens/src/create_local_datawriter_crypto_tokens_utests.c
new file mode 100644
index 0000000..0913528
--- /dev/null
+++ b/src/security/builtin_plugins/tests/create_local_datawriter_crypto_tokens/src/create_local_datawriter_crypto_tokens_utests.c
@@ -0,0 +1,505 @@
+/*
+ * Copyright(c) 2006 to 2019 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+#include <openssl/evp.h>
+#include <openssl/hmac.h>
+#include <openssl/bio.h>
+#include <openssl/err.h>
+
+#include "dds/ddsrt/heap.h"
+#include "dds/ddsrt/string.h"
+#include "dds/ddsrt/types.h"
+#include "dds/ddsrt/environ.h"
+#include "dds/security/dds_security_api.h"
+#include "dds/security/core/dds_security_serialize.h"
+#include "dds/security/core/dds_security_utils.h"
+#include "dds/security/core/shared_secret.h"
+#include "CUnit/CUnit.h"
+#include "CUnit/Test.h"
+#include "common/src/loader.h"
+#include "crypto_objects.h"
+
+#define TEST_SHARED_SECRET_SIZE 32
+
+#define CRYPTO_TRANSFORM_KIND(k) (*(uint32_t *)&((k)[0]))
+#define CRYPTO_TRANSFORM_ID(k) (*(uint32_t *)&((k)[0]))
+
+static const char *CRYPTO_TOKEN_CLASS_ID = "DDS:Crypto:AES_GCM_GMAC";
+static const char *CRYPTO_TOKEN_PROPERTY_NAME = "dds.cryp.keymat";
+
+static struct plugins_hdl *plugins = NULL;
+static dds_security_cryptography *crypto = NULL;
+
+static DDS_Security_IdentityHandle local_participant_identity = 1;
+static DDS_Security_IdentityHandle remote_participant_identity = 2;
+
+static DDS_Security_ParticipantCryptoHandle local_particpant_crypto = 0;
+static DDS_Security_ParticipantCryptoHandle remote_particpant_crypto = 0;
+static DDS_Security_DatawriterCryptoHandle local_writer_crypto = 0;
+static DDS_Security_DatareaderCryptoHandle remote_reader_crypto = 0;
+
+static DDS_Security_SharedSecretHandleImpl *shared_secret_handle_impl = NULL;
+static DDS_Security_SharedSecretHandle shared_secret_handle;
+
+static void allocate_shared_secret(void)
+{
+  int32_t i;
+
+  shared_secret_handle_impl = ddsrt_malloc(sizeof(DDS_Security_SharedSecretHandleImpl));
+
+  shared_secret_handle_impl->shared_secret = ddsrt_malloc(TEST_SHARED_SECRET_SIZE * sizeof(unsigned char));
+  shared_secret_handle_impl->shared_secret_size = TEST_SHARED_SECRET_SIZE;
+
+  for (i = 0; i < shared_secret_handle_impl->shared_secret_size; i++)
+  {
+    shared_secret_handle_impl->shared_secret[i] = (unsigned char)(i % 20);
+  }
+
+  for (i = 0; i < 32; i++)
+  {
+    shared_secret_handle_impl->challenge1[i] = (unsigned char)(i % 15);
+    shared_secret_handle_impl->challenge2[i] = (unsigned char)(i % 12);
+  }
+
+  shared_secret_handle = (DDS_Security_SharedSecretHandle)shared_secret_handle_impl;
+}
+
+static void deallocate_shared_secret(void)
+{
+  ddsrt_free(shared_secret_handle_impl->shared_secret);
+  ddsrt_free(shared_secret_handle_impl);
+}
+
+static void prepare_participant_security_attributes(DDS_Security_ParticipantSecurityAttributes *attributes)
+{
+  memset(attributes, 0, sizeof(DDS_Security_ParticipantSecurityAttributes));
+  attributes->allow_unauthenticated_participants = false;
+  attributes->is_access_protected = false;
+  attributes->is_discovery_protected = false;
+  attributes->is_liveliness_protected = false;
+  attributes->is_rtps_protected = true;
+  attributes->plugin_participant_attributes = DDS_SECURITY_PARTICIPANT_ATTRIBUTES_FLAG_IS_VALID;
+  attributes->plugin_participant_attributes |= DDS_SECURITY_PLUGIN_PARTICIPANT_ATTRIBUTES_FLAG_IS_RTPS_ENCRYPTED;
+}
+
+static int register_local_participant(void)
+{
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  DDS_Security_PermissionsHandle participant_permissions = 3; //valid dummy value
+  DDS_Security_PropertySeq participant_properties;
+  DDS_Security_ParticipantSecurityAttributes participant_security_attributes;
+
+  memset(&participant_properties, 0, sizeof(participant_properties));
+  prepare_participant_security_attributes(&participant_security_attributes);
+
+  local_particpant_crypto =
+      crypto->crypto_key_factory->register_local_participant(
+          crypto->crypto_key_factory,
+          local_participant_identity,
+          participant_permissions,
+          &participant_properties,
+          &participant_security_attributes,
+          &exception);
+
+  if (local_particpant_crypto == 0)
+  {
+    printf("register_local_participant: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+
+  return local_particpant_crypto ? 0 : -1;
+}
+
+static int register_remote_participant(void)
+{
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  DDS_Security_PermissionsHandle remote_participant_permissions = 5;
+
+  remote_particpant_crypto =
+      crypto->crypto_key_factory->register_matched_remote_participant(
+          crypto->crypto_key_factory,
+          local_particpant_crypto,
+          remote_participant_identity,
+          remote_participant_permissions,
+          shared_secret_handle,
+          &exception);
+
+  if (remote_particpant_crypto == 0)
+  {
+    printf("register_matched_remote_participant: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+
+  return remote_particpant_crypto ? 0 : -1;
+}
+
+static void prepare_endpoint_security_attributes(DDS_Security_EndpointSecurityAttributes *attributes)
+{
+  memset(attributes, 0, sizeof(DDS_Security_EndpointSecurityAttributes));
+  attributes->is_discovery_protected = true;
+  attributes->is_submessage_protected = true;
+
+  attributes->plugin_endpoint_attributes |= DDS_SECURITY_PLUGIN_ENDPOINT_ATTRIBUTES_FLAG_IS_SUBMESSAGE_ENCRYPTED;
+}
+
+static int register_local_datawriter(void)
+{
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  DDS_Security_PropertySeq datawriter_properties;
+  DDS_Security_EndpointSecurityAttributes datawriter_security_attributes;
+
+  memset(&datawriter_properties, 0, sizeof(datawriter_properties));
+  prepare_endpoint_security_attributes(&datawriter_security_attributes);
+  datawriter_security_attributes.is_payload_protected = true;
+  datawriter_security_attributes.plugin_endpoint_attributes |= DDS_SECURITY_PLUGIN_ENDPOINT_ATTRIBUTES_FLAG_IS_PAYLOAD_ENCRYPTED;
+
+  local_writer_crypto =
+      crypto->crypto_key_factory->register_local_datawriter(
+          crypto->crypto_key_factory,
+          local_particpant_crypto,
+          &datawriter_properties,
+          &datawriter_security_attributes,
+          &exception);
+
+  if (local_writer_crypto == 0)
+  {
+    printf("register_local_datawriter: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+
+  return local_writer_crypto ? 0 : -1;
+}
+
+static int register_remote_datareader(void)
+{
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+
+  remote_reader_crypto =
+      crypto->crypto_key_factory->register_matched_remote_datareader(
+          crypto->crypto_key_factory,
+          local_writer_crypto,
+          remote_particpant_crypto,
+          shared_secret_handle,
+          true,
+          &exception);
+
+  if (remote_reader_crypto == 0)
+  {
+    printf("register_matched_remote_datareader: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+
+  return remote_reader_crypto ? 0 : -1;
+}
+
+static void reset_exception(DDS_Security_SecurityException *ex)
+{
+  ex->code = 0;
+  ex->minor_code = 0;
+  ddsrt_free(ex->message);
+  ex->message = NULL;
+}
+
+static void suite_create_local_datawriter_crypto_tokens_init(void)
+{
+  allocate_shared_secret();
+  CU_ASSERT_FATAL ((plugins = load_plugins(
+                      NULL    /* Access Control */,
+                      NULL    /* Authentication */,
+                      &crypto /* Cryptograpy    */)) != NULL);
+  CU_ASSERT_EQUAL_FATAL (register_local_participant(), 0);
+  CU_ASSERT_EQUAL_FATAL (register_remote_participant(), 0);
+  CU_ASSERT_EQUAL_FATAL (register_local_datawriter(), 0);
+  CU_ASSERT_EQUAL_FATAL (register_remote_datareader(), 0);
+}
+
+static void suite_create_local_datawriter_crypto_tokens_fini(void)
+{
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+
+  if (remote_reader_crypto)
+  {
+    crypto->crypto_key_factory->unregister_datareader(crypto->crypto_key_factory, remote_reader_crypto, &exception);
+    reset_exception(&exception);
+  }
+  if (local_writer_crypto)
+  {
+    crypto->crypto_key_factory->unregister_datawriter(crypto->crypto_key_factory, local_writer_crypto, &exception);
+    reset_exception(&exception);
+  }
+  if (remote_particpant_crypto)
+  {
+    crypto->crypto_key_factory->unregister_participant(crypto->crypto_key_factory, remote_particpant_crypto, &exception);
+    reset_exception(&exception);
+  }
+  if (local_particpant_crypto)
+  {
+    crypto->crypto_key_factory->unregister_datareader(crypto->crypto_key_factory, local_particpant_crypto, &exception);
+    reset_exception(&exception);
+  }
+  deallocate_shared_secret();
+  unload_plugins(plugins);
+}
+
+static bool data_not_empty(unsigned char *data, uint32_t length)
+{
+  uint32_t i;
+  for (i = 0; i < length; i++)
+  {
+    if (data[i])
+      return true;
+  }
+  return false;
+}
+
+static bool check_key_material(DDS_Security_OctetSeq *data)
+{
+  bool status = true;
+  DDS_Security_Deserializer deserializer;
+  DDS_Security_KeyMaterial_AES_GCM_GMAC key_mat;
+
+  deserializer = DDS_Security_Deserializer_new(data->_buffer, data->_length);
+  if (DDS_Security_Deserialize_KeyMaterial_AES_GCM_GMAC(deserializer, &key_mat))
+  {
+    if (CRYPTO_TRANSFORM_KIND(key_mat.transformation_kind) == CRYPTO_TRANSFORMATION_KIND_AES256_GCM)
+    {
+      printf("check_key_material: incorrect transformation_kind\n");
+      status = false;
+    }
+    else if (CRYPTO_TRANSFORM_ID(key_mat.sender_key_id) == 0)
+    {
+      printf("check_key_material: incorrect sender_key_id\n");
+      status = false;
+    }
+    else if (key_mat.master_salt._length != DDS_SECURITY_MASTER_SALT_SIZE_256)
+    {
+      printf("check_key_material: incorrect master_salt\n");
+      status = false;
+    }
+    else if (!key_mat.master_salt._buffer)
+    {
+      printf("check_key_material: incorrect master_salt\n");
+      status = false;
+    }
+    else if (!data_not_empty(key_mat.master_salt._buffer, key_mat.master_salt._length))
+    {
+      printf("check_key_material: incorrect master_salt\n");
+      status = false;
+    }
+    else if (key_mat.master_sender_key._length != DDS_SECURITY_MASTER_SENDER_KEY_SIZE_256)
+    {
+      printf("check_key_material: incorrect master_sender_key\n");
+      status = false;
+    }
+    else if (!key_mat.master_salt._buffer)
+    {
+      printf("check_key_material: incorrect master_sender_key\n");
+      status = false;
+    }
+    else if (!data_not_empty(key_mat.master_sender_key._buffer, key_mat.master_sender_key._length))
+    {
+      printf("check_key_material: incorrect master_sender_key\n");
+      status = false;
+    }
+  }
+  else
+  {
+    status = false;
+  }
+
+  DDS_Security_Deserializer_free(deserializer);
+  DDS_Security_KeyMaterial_AES_GCM_GMAC_deinit(&key_mat);
+
+  return status;
+}
+
+static bool check_token_validity(const DDS_Security_DatawriterCryptoTokenSeq *tokens)
+{
+  bool status = true;
+  uint32_t i;
+
+  if (tokens->_length != 2 || tokens->_buffer == NULL)
+  {
+    status = false;
+  }
+
+  for (i = 0; status && (i < tokens->_length); i++)
+  {
+    status = (tokens->_buffer[i].class_id != NULL) &&
+             (strcmp(CRYPTO_TOKEN_CLASS_ID, tokens->_buffer[i].class_id) == 0) &&
+             (tokens->_buffer[i].binary_properties._length == 1) &&
+             (tokens->_buffer[i].binary_properties._buffer != NULL) &&
+             (tokens->_buffer[i].binary_properties._buffer[0].name != NULL) &&
+             (strcmp(CRYPTO_TOKEN_PROPERTY_NAME, tokens->_buffer[i].binary_properties._buffer[0].name) == 0) &&
+             (tokens->_buffer[i].binary_properties._buffer[0].value._length > 0) &&
+             (tokens->_buffer[i].binary_properties._buffer[0].value._buffer != NULL);
+
+    if (status)
+    {
+      status = check_key_material(&tokens->_buffer[i].binary_properties._buffer[0].value);
+    }
+  }
+
+  return status;
+}
+
+CU_Test(ddssec_builtin_create_local_datawriter_crypto_tokens, happy_day, .init = suite_create_local_datawriter_crypto_tokens_init, .fini = suite_create_local_datawriter_crypto_tokens_fini)
+{
+  DDS_Security_boolean result;
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  DDS_Security_DatawriterCryptoTokenSeq tokens;
+
+  CU_ASSERT_FATAL(crypto != NULL);
+  CU_ASSERT_FATAL(crypto->crypto_key_exchange != NULL);
+  CU_ASSERT_FATAL(crypto->crypto_key_exchange->create_local_datawriter_crypto_tokens != NULL);
+
+  memset(&tokens, 0, sizeof(tokens));
+
+  /* Now call the function. */
+  result = crypto->crypto_key_exchange->create_local_datawriter_crypto_tokens(
+      crypto->crypto_key_exchange,
+      &tokens,
+      local_writer_crypto,
+      remote_reader_crypto,
+      &exception);
+
+  if (!result)
+  {
+    printf("create_local_datawriter_crypto_tokens: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+
+  CU_ASSERT_FATAL(result);
+  CU_ASSERT(exception.code == 0);
+  CU_ASSERT(exception.message == NULL);
+
+  reset_exception(&exception);
+
+  CU_ASSERT(check_token_validity(&tokens));
+
+  result = crypto->crypto_key_exchange->return_crypto_tokens(crypto->crypto_key_exchange, &tokens, &exception);
+
+  if (!result)
+  {
+    printf("return_crypto_tokens: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+
+  CU_ASSERT_FATAL(result);
+  CU_ASSERT(exception.code == 0);
+  CU_ASSERT(exception.message == NULL);
+
+  reset_exception(&exception);
+}
+
+CU_Test(ddssec_builtin_create_local_datawriter_crypto_tokens, invalid_args, .init = suite_create_local_datawriter_crypto_tokens_init, .fini = suite_create_local_datawriter_crypto_tokens_fini)
+{
+  DDS_Security_boolean result;
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  DDS_Security_DatawriterCryptoTokenSeq tokens;
+
+  /* Check if we actually have the validate_local_identity() function. */
+  CU_ASSERT_FATAL(crypto != NULL);
+  CU_ASSERT_FATAL(crypto->crypto_key_exchange != NULL);
+  CU_ASSERT_FATAL(crypto->crypto_key_exchange->create_local_datawriter_crypto_tokens != NULL);
+
+  memset(&tokens, 0, sizeof(tokens));
+
+  /* invalid token seq = NULL */
+  result = crypto->crypto_key_exchange->create_local_datawriter_crypto_tokens(
+      crypto->crypto_key_exchange,
+      NULL,
+      local_writer_crypto,
+      remote_reader_crypto,
+      &exception);
+
+  if (!result)
+  {
+    printf("create_local_datawriter_crypto_tokens: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+
+  CU_ASSERT(!result);
+  CU_ASSERT(exception.code != 0);
+  CU_ASSERT(exception.message != NULL);
+
+  reset_exception(&exception);
+
+  /* invalid local_crypto_handle = DDS_SECURITY_HANDLE_NIL */
+  result = crypto->crypto_key_exchange->create_local_datawriter_crypto_tokens(
+      crypto->crypto_key_exchange,
+      &tokens,
+      0,
+      remote_reader_crypto,
+      &exception);
+
+  if (!result)
+  {
+    printf("create_local_datawriter_crypto_tokens: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+
+  CU_ASSERT(!result);
+  CU_ASSERT(exception.code != 0);
+  CU_ASSERT(exception.message != NULL);
+
+  reset_exception(&exception);
+
+  /* invalid remote_crypto_handle = DDS_SECURITY_HANDLE_NIL */
+  result = crypto->crypto_key_exchange->create_local_datawriter_crypto_tokens(
+      crypto->crypto_key_exchange,
+      &tokens,
+      local_writer_crypto,
+      0,
+      &exception);
+
+  if (!result)
+  {
+    printf("create_local_datawriter_crypto_tokens: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+
+  CU_ASSERT(!result);
+  CU_ASSERT(exception.code != 0);
+  CU_ASSERT(exception.message != NULL);
+
+  reset_exception(&exception);
+
+  /* invalid local_crypto_handle = 1 */
+  result = crypto->crypto_key_exchange->create_local_datawriter_crypto_tokens(
+      crypto->crypto_key_exchange,
+      &tokens,
+      1,
+      remote_reader_crypto,
+      &exception);
+
+  if (!result)
+  {
+    printf("create_local_datawriter_crypto_tokens: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+
+  CU_ASSERT(!result);
+  CU_ASSERT(exception.code != 0);
+  CU_ASSERT(exception.message != NULL);
+
+  reset_exception(&exception);
+
+  /* invalid remote_crypto_handle = 1 */
+  result = crypto->crypto_key_exchange->create_local_datawriter_crypto_tokens(
+      crypto->crypto_key_exchange,
+      &tokens,
+      local_writer_crypto,
+      1,
+      &exception);
+
+  if (!result)
+  {
+    printf("create_local_datawriter_crypto_tokens: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+
+  CU_ASSERT(!result);
+  CU_ASSERT(exception.code != 0);
+  CU_ASSERT(exception.message != NULL);
+
+  reset_exception(&exception);
+}
+
diff --git a/src/security/builtin_plugins/tests/create_local_participant_crypto_tokens/src/create_local_participant_crypto_tokens_utests.c b/src/security/builtin_plugins/tests/create_local_participant_crypto_tokens/src/create_local_participant_crypto_tokens_utests.c
new file mode 100644
index 0000000..d568d58
--- /dev/null
+++ b/src/security/builtin_plugins/tests/create_local_participant_crypto_tokens/src/create_local_participant_crypto_tokens_utests.c
@@ -0,0 +1,362 @@
+/*
+ * Copyright(c) 2006 to 2019 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+#include <openssl/evp.h>
+#include <openssl/hmac.h>
+#include <openssl/bio.h>
+#include <openssl/err.h>
+
+#include "dds/ddsrt/heap.h"
+#include "dds/ddsrt/string.h"
+#include "dds/ddsrt/types.h"
+#include "dds/ddsrt/environ.h"
+#include "dds/security/dds_security_api.h"
+#include "dds/security/core/dds_security_serialize.h"
+#include "dds/security/core/dds_security_utils.h"
+#include "dds/security/core/shared_secret.h"
+#include "CUnit/CUnit.h"
+#include "CUnit/Test.h"
+#include "common/src/loader.h"
+#include "crypto_objects.h"
+
+#define TEST_SHARED_SECRET_SIZE 32
+
+static const char *CRYPTO_TOKEN_CLASS_ID = "DDS:Crypto:AES_GCM_GMAC";
+static const char *CRYPTO_TOKEN_PROPERTY_NAME = "dds.cryp.keymat";
+
+static struct plugins_hdl *plugins = NULL;
+static dds_security_cryptography *crypto = NULL;
+
+static DDS_Security_ParticipantCryptoHandle local_crypto_handle = DDS_SECURITY_HANDLE_NIL;
+static DDS_Security_ParticipantCryptoHandle remote_crypto_handle = DDS_SECURITY_HANDLE_NIL;
+static DDS_Security_SharedSecretHandleImpl *shared_secret_handle_impl = NULL;
+static DDS_Security_SharedSecretHandle shared_secret_handle = DDS_SECURITY_HANDLE_NIL;
+
+static void allocate_shared_secret(void)
+{
+  int32_t i;
+
+  shared_secret_handle_impl = ddsrt_malloc(sizeof(DDS_Security_SharedSecretHandleImpl));
+
+  shared_secret_handle_impl->shared_secret = ddsrt_malloc(TEST_SHARED_SECRET_SIZE * sizeof(DDS_Security_octet));
+  shared_secret_handle_impl->shared_secret_size = TEST_SHARED_SECRET_SIZE;
+
+  for (i = 0; i < shared_secret_handle_impl->shared_secret_size; i++)
+  {
+    shared_secret_handle_impl->shared_secret[i] = (unsigned char)(i % 20);
+  }
+
+  for (i = 0; i < 32; i++)
+  {
+    shared_secret_handle_impl->challenge1[i] = (unsigned char)(i % 15);
+    shared_secret_handle_impl->challenge2[i] = (unsigned char)(i % 12);
+  }
+
+  shared_secret_handle = (DDS_Security_SharedSecretHandle)shared_secret_handle_impl;
+}
+
+static void deallocate_shared_secret(void)
+{
+  ddsrt_free(shared_secret_handle_impl->shared_secret);
+  ddsrt_free(shared_secret_handle_impl);
+}
+
+static void prepare_participant_security_attributes(DDS_Security_ParticipantSecurityAttributes *attributes)
+{
+  memset(attributes, 0, sizeof(DDS_Security_ParticipantSecurityAttributes));
+  attributes->allow_unauthenticated_participants = false;
+  attributes->is_access_protected = false;
+  attributes->is_discovery_protected = false;
+  attributes->is_liveliness_protected = false;
+  attributes->is_rtps_protected = true;
+  attributes->plugin_participant_attributes = DDS_SECURITY_PARTICIPANT_ATTRIBUTES_FLAG_IS_VALID;
+  attributes->plugin_participant_attributes |= DDS_SECURITY_PLUGIN_PARTICIPANT_ATTRIBUTES_FLAG_IS_RTPS_ENCRYPTED;
+}
+
+static int register_participants(void)
+{
+  int r = 0;
+  DDS_Security_IdentityHandle participant_identity = 5; /* valid dummy value */
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  DDS_Security_PermissionsHandle participant_permissions = 3;        /* valid but dummy value */
+  DDS_Security_PermissionsHandle remote_participant_permissions = 5; /*valid dummy value */
+  DDS_Security_PropertySeq participant_properties;
+  DDS_Security_ParticipantSecurityAttributes participant_security_attributes;
+
+  memset(&exception, 0, sizeof(DDS_Security_SecurityException));
+  memset(&participant_properties, 0, sizeof(participant_properties));
+  prepare_participant_security_attributes(&participant_security_attributes);
+
+  local_crypto_handle =
+      crypto->crypto_key_factory->register_local_participant(
+          crypto->crypto_key_factory,
+          participant_identity,
+          participant_permissions,
+          &participant_properties,
+          &participant_security_attributes,
+          &exception);
+
+  if (local_crypto_handle == DDS_SECURITY_HANDLE_NIL)
+  {
+    r = -1;
+    printf("register_local_participant: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+
+  if (r == 0)
+  {
+    remote_crypto_handle =
+        crypto->crypto_key_factory->register_matched_remote_participant(
+            crypto->crypto_key_factory,
+            local_crypto_handle,
+            participant_identity,
+            remote_participant_permissions,
+            shared_secret_handle,
+            &exception);
+    if (remote_crypto_handle == DDS_SECURITY_HANDLE_NIL)
+    {
+      r = -1;
+      printf("register_matched_remote_participant: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+  }
+
+  return r;
+}
+
+static void unregister_participants(void)
+{
+  DDS_Security_boolean status;
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+
+  if (local_crypto_handle)
+  {
+    status = crypto->crypto_key_factory->unregister_participant(crypto->crypto_key_factory, local_crypto_handle, &exception);
+    if (!status)
+    {
+      printf("unregister_participant: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+  }
+
+  if (remote_crypto_handle)
+  {
+    status = crypto->crypto_key_factory->unregister_participant(crypto->crypto_key_factory, remote_crypto_handle, &exception);
+    if (!status)
+    {
+      printf("unregister_participant: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+  }
+}
+
+static void suite_create_local_participant_crypto_tokens_init(void)
+{
+  CU_ASSERT_FATAL ((plugins = load_plugins(
+                      NULL    /* Access Control */,
+                      NULL    /* Authentication */,
+                      &crypto /* Cryptograpy    */)) != NULL);
+  allocate_shared_secret();
+  CU_ASSERT_EQUAL_FATAL (register_participants(), 0);
+}
+
+static void suite_create_local_participant_crypto_tokens_fini(void)
+{
+  unregister_participants();
+  deallocate_shared_secret();
+  unload_plugins(plugins);
+}
+
+static void reset_exception(DDS_Security_SecurityException *ex)
+{
+  ex->code = 0;
+  ex->minor_code = 0;
+  ddsrt_free(ex->message);
+  ex->message = NULL;
+}
+
+static DDS_Security_boolean check_token_validity(const DDS_Security_ParticipantCryptoTokenSeq *tokens)
+{
+  DDS_Security_boolean status = true;
+  uint32_t i;
+
+  if (tokens->_length == 0 || tokens->_buffer == NULL)
+  {
+    status = false;
+  }
+
+  for (i = 0; status && (i < tokens->_length); i++)
+  {
+    status = (tokens->_buffer[i].class_id != NULL) &&
+             (strcmp(CRYPTO_TOKEN_CLASS_ID, tokens->_buffer[i].class_id) == 0) &&
+             (tokens->_buffer[i].binary_properties._length == 1) &&
+             (tokens->_buffer[i].binary_properties._buffer != NULL) &&
+             (tokens->_buffer[i].binary_properties._buffer[0].name != NULL) &&
+             (strcmp(CRYPTO_TOKEN_PROPERTY_NAME, tokens->_buffer[i].binary_properties._buffer[0].name) == 0) &&
+             (tokens->_buffer[i].binary_properties._buffer[0].value._length > 0) &&
+             (tokens->_buffer[i].binary_properties._buffer[0].value._buffer != NULL);
+  }
+
+  return status;
+}
+
+CU_Test(ddssec_builtin_create_local_participant_crypto_tokens, happy_day, .init = suite_create_local_participant_crypto_tokens_init, .fini = suite_create_local_participant_crypto_tokens_fini)
+{
+  DDS_Security_boolean result;
+
+  /* Dummy (even un-initialized) data for now. */
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  DDS_Security_ParticipantCryptoTokenSeq tokens;
+
+  /* Check if we actually have the validate_local_identity() function. */
+  CU_ASSERT_FATAL(crypto != NULL);
+  CU_ASSERT_FATAL(crypto->crypto_key_exchange != NULL);
+  CU_ASSERT_FATAL(crypto->crypto_key_exchange->create_local_participant_crypto_tokens != NULL);
+
+  memset(&exception, 0, sizeof(DDS_Security_SecurityException));
+  memset(&tokens, 0, sizeof(tokens));
+
+  /* Now call the function. */
+  result = crypto->crypto_key_exchange->create_local_participant_crypto_tokens(
+      crypto->crypto_key_exchange,
+      &tokens,
+      local_crypto_handle,
+      remote_crypto_handle,
+      &exception);
+  if (!result)
+  {
+    printf("create_local_participant_crypto_tokens: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+
+  CU_ASSERT_FATAL(result);
+  CU_ASSERT(exception.code == 0);
+  CU_ASSERT(exception.message == NULL);
+
+  reset_exception(&exception);
+
+  CU_ASSERT(check_token_validity(&tokens));
+
+  result = crypto->crypto_key_exchange->return_crypto_tokens(crypto->crypto_key_exchange, &tokens, &exception);
+
+  if (!result)
+  {
+    printf("return_crypto_tokens: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+
+  CU_ASSERT_FATAL(result);
+  CU_ASSERT(exception.code == 0);
+  CU_ASSERT(exception.message == NULL);
+
+  reset_exception(&exception);
+}
+
+CU_Test(ddssec_builtin_create_local_participant_crypto_tokens, invalid_args, .init = suite_create_local_participant_crypto_tokens_init, .fini = suite_create_local_participant_crypto_tokens_fini)
+{
+  DDS_Security_boolean result;
+
+  /* Dummy (even un-initialized) data for now. */
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  DDS_Security_ParticipantCryptoTokenSeq tokens;
+
+  /* Check if we actually have the validate_local_identity() function. */
+  CU_ASSERT_FATAL(crypto != NULL);
+  CU_ASSERT_FATAL(crypto->crypto_key_exchange != NULL);
+  CU_ASSERT_FATAL(crypto->crypto_key_exchange->create_local_participant_crypto_tokens != NULL);
+
+  memset(&exception, 0, sizeof(DDS_Security_SecurityException));
+  memset(&tokens, 0, sizeof(tokens));
+
+  /* invalid token seq = NULL */
+  result = crypto->crypto_key_exchange->create_local_participant_crypto_tokens(
+      crypto->crypto_key_exchange,
+      NULL,
+      local_crypto_handle,
+      remote_crypto_handle,
+      &exception);
+  if (!result)
+  {
+    printf("create_local_participant_crypto_tokens: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+
+  CU_ASSERT(!result);
+  CU_ASSERT(exception.code != 0);
+  CU_ASSERT(exception.message != NULL);
+
+  reset_exception(&exception);
+
+  /* invalid local_crypto_handle = DDS_SECURITY_HANDLE_NIL */
+  result = crypto->crypto_key_exchange->create_local_participant_crypto_tokens(
+      crypto->crypto_key_exchange,
+      &tokens,
+      0,
+      remote_crypto_handle,
+      &exception);
+  if (!result)
+  {
+    printf("create_local_participant_crypto_tokens: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+
+  CU_ASSERT(!result);
+  CU_ASSERT(exception.code != 0);
+  CU_ASSERT(exception.message != NULL);
+
+  reset_exception(&exception);
+
+  /* invalid remote_crypto_handle = DDS_SECURITY_HANDLE_NIL */
+  result = crypto->crypto_key_exchange->create_local_participant_crypto_tokens(
+      crypto->crypto_key_exchange,
+      &tokens,
+      local_crypto_handle,
+      0,
+      &exception);
+  if (!result)
+  {
+    printf("create_local_participant_crypto_tokens: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+
+  CU_ASSERT(!result);
+  CU_ASSERT(exception.code != 0);
+  CU_ASSERT(exception.message != NULL);
+
+  reset_exception(&exception);
+
+  /* invalid local_crypto_handle = 1 */
+  result = crypto->crypto_key_exchange->create_local_participant_crypto_tokens(
+      crypto->crypto_key_exchange,
+      &tokens,
+      1,
+      remote_crypto_handle,
+      &exception);
+  if (!result)
+  {
+    printf("create_local_participant_crypto_tokens: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+
+  CU_ASSERT(!result);
+  CU_ASSERT(exception.code != 0);
+  CU_ASSERT(exception.message != NULL);
+
+  reset_exception(&exception);
+
+  /* invalid remote_crypto_handle = 1 */
+  result = crypto->crypto_key_exchange->create_local_participant_crypto_tokens(
+      crypto->crypto_key_exchange,
+      &tokens,
+      local_crypto_handle,
+      1,
+      &exception);
+  if (!result)
+  {
+    printf("create_local_participant_crypto_tokens: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+
+  CU_ASSERT(!result);
+  CU_ASSERT(exception.code != 0);
+  CU_ASSERT(exception.message != NULL);
+
+  reset_exception(&exception);
+}
diff --git a/src/security/builtin_plugins/tests/decode_datareader_submessage/src/decode_datareader_submessage_utests.c b/src/security/builtin_plugins/tests/decode_datareader_submessage/src/decode_datareader_submessage_utests.c
new file mode 100644
index 0000000..2dab5df
--- /dev/null
+++ b/src/security/builtin_plugins/tests/decode_datareader_submessage/src/decode_datareader_submessage_utests.c
@@ -0,0 +1,1748 @@
+/*
+ * Copyright(c) 2006 to 2019 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+#include <assert.h>
+#include <openssl/evp.h>
+#include <openssl/hmac.h>
+#include <openssl/bio.h>
+#include <openssl/err.h>
+
+#include "dds/ddsrt/bswap.h"
+#include "dds/ddsrt/heap.h"
+#include "dds/ddsrt/string.h"
+#include "dds/ddsrt/types.h"
+#include "dds/ddsrt/environ.h"
+#include "dds/security/dds_security_api.h"
+#include "dds/security/core/dds_security_serialize.h"
+#include "dds/security/core/dds_security_utils.h"
+#include "dds/security/core/shared_secret.h"
+#include "CUnit/CUnit.h"
+#include "CUnit/Test.h"
+#include "common/src/loader.h"
+#include "crypto_objects.h"
+
+#define TEST_SHARED_SECRET_SIZE 32
+
+static struct plugins_hdl *plugins = NULL;
+static dds_security_cryptography *crypto = NULL;
+
+static DDS_Security_IdentityHandle local_participant_identity = 1;
+static DDS_Security_IdentityHandle remote_participant_identity = 2;
+
+static DDS_Security_ParticipantCryptoHandle local_participant_handle = DDS_SECURITY_HANDLE_NIL;
+static DDS_Security_ParticipantCryptoHandle remote_participant_handle = DDS_SECURITY_HANDLE_NIL;
+
+static DDS_Security_SharedSecretHandleImpl *shared_secret_handle_impl = NULL;
+static DDS_Security_SharedSecretHandle shared_secret_handle;
+
+struct submsg_header
+{
+  unsigned char id;
+  unsigned char flags;
+  uint16_t length;
+};
+
+struct crypto_header
+{
+  struct CryptoTransformIdentifier transform_identifier;
+  unsigned char session_id[4];
+  unsigned char init_vector_suffix[8];
+};
+
+struct crypto_footer
+{
+  unsigned char common_mac[16];
+  unsigned char length[4];
+};
+
+struct receiver_specific_mac
+{
+  DDS_Security_CryptoTransformKeyId receiver_mac_key_id;
+  unsigned char receiver_mac[CRYPTO_HMAC_SIZE];
+};
+
+struct seq_number
+{
+  int high;
+  unsigned low;
+};
+
+struct heartbeat
+{
+  struct submsg_header smhdr;
+  uint32_t readerId;
+  uint32_t writerId;
+  struct seq_number firstSN;
+  struct seq_number lastSN;
+  int count;
+};
+
+static struct heartbeat heartbeat;
+
+static void reset_exception(DDS_Security_SecurityException *ex)
+{
+  ex->code = 0;
+  ex->minor_code = 0;
+  ddsrt_free(ex->message);
+  ex->message = NULL;
+}
+
+static void allocate_shared_secret(void)
+{
+  int32_t i;
+
+  shared_secret_handle_impl = ddsrt_malloc(sizeof(DDS_Security_SharedSecretHandleImpl));
+
+  shared_secret_handle_impl->shared_secret = ddsrt_malloc(TEST_SHARED_SECRET_SIZE * sizeof(unsigned char));
+  shared_secret_handle_impl->shared_secret_size = TEST_SHARED_SECRET_SIZE;
+
+  for (i = 0; i < shared_secret_handle_impl->shared_secret_size; i++)
+  {
+    shared_secret_handle_impl->shared_secret[i] = (unsigned char)(i % 20);
+  }
+
+  for (i = 0; i < 32; i++)
+  {
+    shared_secret_handle_impl->challenge1[i] = (unsigned char)(i % 15);
+    shared_secret_handle_impl->challenge2[i] = (unsigned char)(i % 12);
+  }
+
+  shared_secret_handle = (DDS_Security_SharedSecretHandle)shared_secret_handle_impl;
+}
+
+static void deallocate_shared_secret(void)
+{
+  ddsrt_free(shared_secret_handle_impl->shared_secret);
+  ddsrt_free(shared_secret_handle_impl);
+}
+
+static void initialize_heartbeat(void)
+{
+  heartbeat.smhdr.id = 0x07;
+  heartbeat.smhdr.flags = 1;
+  heartbeat.smhdr.length = sizeof(heartbeat) - sizeof(struct submsg_header);
+  heartbeat.readerId = 0xA1B2C3D4;
+  heartbeat.writerId = 0xE5F6A7B0;
+  heartbeat.firstSN.high = 0;
+  heartbeat.firstSN.low = 1;
+  heartbeat.lastSN.high = 20;
+  heartbeat.lastSN.low = 500;
+  heartbeat.count = 1021;
+}
+
+static int register_local_participant(void)
+{
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  DDS_Security_PermissionsHandle participant_permissions = 3; //valid dummy value
+  DDS_Security_PropertySeq participant_properties;
+  DDS_Security_ParticipantSecurityAttributes participant_security_attributes;
+
+  memset(&participant_properties, 0, sizeof(participant_properties));
+  memset(&participant_security_attributes, 0, sizeof(participant_security_attributes));
+
+  local_participant_handle =
+      crypto->crypto_key_factory->register_local_participant(
+          crypto->crypto_key_factory,
+          local_participant_identity,
+          participant_permissions,
+          &participant_properties,
+          &participant_security_attributes,
+          &exception);
+
+  if (local_participant_handle == DDS_SECURITY_HANDLE_NIL)
+  {
+    printf("register_local_participant: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+
+  return local_participant_handle ? 0 : -1;
+}
+
+static void unregister_local_participant(void)
+{
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  if (local_participant_handle)
+  {
+    crypto->crypto_key_factory->unregister_participant(crypto->crypto_key_factory, local_participant_handle, &exception);
+    local_participant_handle = DDS_SECURITY_HANDLE_NIL;
+    reset_exception(&exception);
+  }
+}
+
+static int register_remote_participant(void)
+{
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  DDS_Security_PermissionsHandle remote_participant_permissions = 5;
+
+  remote_participant_handle =
+      crypto->crypto_key_factory->register_matched_remote_participant(
+          crypto->crypto_key_factory,
+          local_participant_handle,
+          remote_participant_identity,
+          remote_participant_permissions,
+          shared_secret_handle,
+          &exception);
+
+  if (remote_participant_handle == DDS_SECURITY_HANDLE_NIL)
+  {
+    printf("register_matched_remote_participant: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+
+  return remote_participant_handle ? 0 : -1;
+}
+
+static void unregister_remote_participant(void)
+{
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  if (remote_participant_handle)
+  {
+    crypto->crypto_key_factory->unregister_participant(crypto->crypto_key_factory, remote_participant_handle, &exception);
+    remote_participant_handle = DDS_SECURITY_HANDLE_NIL;
+    reset_exception(&exception);
+  }
+}
+
+static void prepare_endpoint_security_attributes_and_properties(DDS_Security_EndpointSecurityAttributes *attributes,
+                                                                DDS_Security_PropertySeq *properties,
+                                                                DDS_Security_CryptoTransformKind_Enum transformation_kind,
+                                                                bool is_origin_authenticated)
+{
+  memset(attributes, 0, sizeof(DDS_Security_EndpointSecurityAttributes));
+
+  attributes->is_discovery_protected = true;
+
+  if (properties != NULL)
+  {
+    memset(properties, 0, sizeof(DDS_Security_PropertySeq));
+    properties->_maximum = properties->_length = 1;
+    properties->_buffer = ddsrt_malloc(sizeof(DDS_Security_Property_t));
+
+    properties->_buffer[0].name = ddsrt_strdup("dds.sec.crypto.keysize");
+
+    if (transformation_kind == CRYPTO_TRANSFORMATION_KIND_AES128_GCM || transformation_kind == CRYPTO_TRANSFORMATION_KIND_AES128_GMAC)
+    {
+      properties->_buffer[0].value = ddsrt_strdup("128");
+    }
+    else
+    {
+      properties->_buffer[0].value = ddsrt_strdup("256");
+    }
+  }
+
+  switch (transformation_kind)
+  {
+  case CRYPTO_TRANSFORMATION_KIND_AES128_GCM:
+  case CRYPTO_TRANSFORMATION_KIND_AES256_GCM:
+    attributes->is_submessage_protected = true;
+    attributes->plugin_endpoint_attributes |= DDS_SECURITY_PLUGIN_ENDPOINT_ATTRIBUTES_FLAG_IS_SUBMESSAGE_ENCRYPTED;
+    if (is_origin_authenticated)
+    {
+      attributes->plugin_endpoint_attributes |= DDS_SECURITY_PLUGIN_ENDPOINT_ATTRIBUTES_FLAG_IS_SUBMESSAGE_ORIGIN_AUTHENTICATED;
+    }
+    break;
+
+  case CRYPTO_TRANSFORMATION_KIND_AES256_GMAC:
+  case CRYPTO_TRANSFORMATION_KIND_AES128_GMAC:
+    attributes->is_submessage_protected = true;
+    if (is_origin_authenticated)
+    {
+      attributes->plugin_endpoint_attributes |= DDS_SECURITY_PLUGIN_ENDPOINT_ATTRIBUTES_FLAG_IS_SUBMESSAGE_ORIGIN_AUTHENTICATED;
+    }
+    break;
+
+  default:
+    assert(0);
+    break;
+  }
+}
+
+static DDS_Security_DatawriterCryptoHandle register_local_datawriter(DDS_Security_EndpointSecurityAttributes *datawriter_security_attributes, DDS_Security_PropertySeq *datawriter_properties)
+{
+  DDS_Security_DatawriterCryptoHandle writer_crypto;
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+
+  writer_crypto =
+      crypto->crypto_key_factory->register_local_datawriter(
+          crypto->crypto_key_factory,
+          local_participant_handle,
+          datawriter_properties,
+          datawriter_security_attributes,
+          &exception);
+
+  if (writer_crypto == 0)
+  {
+    printf("register_local_datawriter: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+
+  return writer_crypto;
+}
+
+static DDS_Security_DatawriterCryptoHandle register_remote_datawriter(DDS_Security_DatareaderCryptoHandle reader_crypto)
+{
+  DDS_Security_DatawriterCryptoHandle writer_crypto;
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+
+  writer_crypto =
+      crypto->crypto_key_factory->register_matched_remote_datawriter(
+          crypto->crypto_key_factory,
+          reader_crypto,
+          remote_participant_handle,
+          shared_secret_handle,
+          &exception);
+
+  if (writer_crypto == 0)
+  {
+    printf("register_matched_remote_datareader: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+
+  return writer_crypto;
+}
+
+static void unregister_datawriter(DDS_Security_DatawriterCryptoHandle writer_crypto)
+{
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  if (writer_crypto)
+  {
+    crypto->crypto_key_factory->unregister_datawriter(crypto->crypto_key_factory, writer_crypto, &exception);
+    reset_exception(&exception);
+  }
+}
+
+static DDS_Security_DatareaderCryptoHandle register_local_datareader(DDS_Security_EndpointSecurityAttributes *datareader_security_attributes, DDS_Security_PropertySeq *datareader_properties)
+{
+  DDS_Security_DatareaderCryptoHandle reader_crypto;
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+
+  reader_crypto =
+      crypto->crypto_key_factory->register_local_datareader(
+          crypto->crypto_key_factory,
+          local_participant_handle,
+          datareader_properties,
+          datareader_security_attributes,
+          &exception);
+
+  if (reader_crypto == 0)
+  {
+    printf("register_local_datawriter: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+
+  return reader_crypto;
+}
+
+static DDS_Security_DatareaderCryptoHandle register_remote_datareader(DDS_Security_DatawriterCryptoHandle writer_crypto)
+{
+  DDS_Security_DatareaderCryptoHandle reader_crypto;
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  DDS_Security_PropertySeq datawriter_properties;
+
+  memset(&datawriter_properties, 0, sizeof(datawriter_properties));
+
+  reader_crypto =
+      crypto->crypto_key_factory->register_matched_remote_datareader(
+          crypto->crypto_key_factory,
+          writer_crypto,
+          remote_participant_handle,
+          shared_secret_handle,
+          true,
+          &exception);
+
+  if (reader_crypto == 0)
+  {
+    printf("register_matched_remote_datareader: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+
+  return reader_crypto;
+}
+
+static void unregister_datareader(DDS_Security_DatareaderCryptoHandle reader_crypto)
+{
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  if (reader_crypto)
+  {
+    crypto->crypto_key_factory->unregister_datareader(crypto->crypto_key_factory, reader_crypto, &exception);
+    reset_exception(&exception);
+  }
+}
+
+static bool set_remote_datareader_tokens(
+    DDS_Security_DatareaderCryptoHandle nodeA_local_reader_crypto,
+    DDS_Security_DatawriterCryptoHandle nodeA_remote_writer_crypto,
+    DDS_Security_DatawriterCryptoHandle nodeB_local_writer_crypto,
+    DDS_Security_DatareaderCryptoHandle nodeB_remote_reader_crypto)
+{
+  DDS_Security_boolean result;
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  DDS_Security_DatareaderCryptoTokenSeq tokens;
+
+  memset(&tokens, 0, sizeof(tokens));
+
+  /* Now call the function. */
+  result = crypto->crypto_key_exchange->create_local_datareader_crypto_tokens(
+      crypto->crypto_key_exchange,
+      &tokens,
+      nodeA_local_reader_crypto,
+      nodeA_remote_writer_crypto,
+      &exception);
+
+  if (result)
+  {
+    result = crypto->crypto_key_exchange->set_remote_datareader_crypto_tokens(
+        crypto->crypto_key_exchange,
+        nodeB_local_writer_crypto,
+        nodeB_remote_reader_crypto,
+        &tokens,
+        &exception);
+  }
+
+  DDS_Security_DataHolderSeq_deinit(&tokens);
+
+  if (result)
+  {
+    result = crypto->crypto_key_exchange->create_local_datawriter_crypto_tokens(
+        crypto->crypto_key_exchange,
+        &tokens,
+        nodeB_local_writer_crypto,
+        nodeB_remote_reader_crypto,
+        &exception);
+  }
+
+  if (result)
+  {
+    result = crypto->crypto_key_exchange->set_remote_datawriter_crypto_tokens(
+        crypto->crypto_key_exchange,
+        nodeA_local_reader_crypto,
+        nodeA_remote_writer_crypto,
+        &tokens,
+        &exception);
+  }
+
+  DDS_Security_DataHolderSeq_deinit(&tokens);
+
+  return (bool)result;
+}
+
+static void suite_decode_datareader_submessage_init(void)
+{
+  allocate_shared_secret();
+  initialize_heartbeat();
+
+  CU_ASSERT_FATAL ((plugins = load_plugins(
+                      NULL    /* Access Control */,
+                      NULL    /* Authentication */,
+                      &crypto /* Cryptograpy    */)) != NULL);
+
+  CU_ASSERT_EQUAL_FATAL (register_local_participant(), 0);
+  CU_ASSERT_EQUAL_FATAL (register_remote_participant(), 0);
+}
+
+static void suite_decode_datareader_submessage_fini(void)
+{
+  unregister_local_participant();
+  unregister_remote_participant();
+  deallocate_shared_secret();
+  unload_plugins(plugins);
+}
+
+static void initialize_data_submessage(DDS_Security_OctetSeq *submsg)
+{
+  uint32_t length = sizeof(struct heartbeat);
+  unsigned char *buffer;
+
+  buffer = ddsrt_malloc(length);
+
+  memcpy(buffer, &heartbeat, length);
+
+  submsg->_length = submsg->_maximum = length;
+  submsg->_buffer = buffer;
+}
+
+static void set_submsg_header(struct submsg_header *submsg, unsigned char id, unsigned char flags, uint16_t length)
+{
+  submsg->id = id;
+  submsg->flags = flags;
+  submsg->length = length;
+}
+
+static struct submsg_header * get_submsg(unsigned char *data, int num)
+{
+  struct submsg_header *submsg;
+  int i;
+
+  submsg = (struct submsg_header *)data;
+  for (i = 0; i < num - 1; i++)
+  {
+    uint32_t hlen = submsg->length;
+    data += sizeof(struct submsg_header) + hlen;
+    submsg = (struct submsg_header *)data;
+  }
+
+  return submsg;
+}
+
+static struct crypto_header * get_crypto_header(unsigned char *data)
+{
+  return (struct crypto_header *)(data + sizeof(struct submsg_header));
+}
+
+static struct crypto_footer * get_crypto_footer(unsigned char *data)
+{
+  struct submsg_header *submsg;
+  submsg = get_submsg(data, 3);
+  return (struct crypto_footer *)(submsg + 1);
+}
+
+static void decode_datareader_submessage_not_signed(
+    DDS_Security_CryptoTransformKind_Enum transformation_kind)
+{
+  DDS_Security_boolean result;
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  DDS_Security_DatareaderCryptoHandle nodeA_local_reader_crypto;
+  DDS_Security_DatawriterCryptoHandle nodeB_local_writer_crypto;
+  DDS_Security_DatareaderCryptoHandle nodeB_remote_reader_crypto;
+  DDS_Security_DatawriterCryptoHandle nodeA_remote_writer_crypto;
+  DDS_Security_DatawriterCryptoHandleSeq writer_list;
+  DDS_Security_OctetSeq plain_buffer;
+  DDS_Security_OctetSeq encoded_buffer;
+  DDS_Security_OctetSeq decoded_buffer;
+  DDS_Security_EndpointSecurityAttributes datawriter_security_attributes;
+  DDS_Security_PropertySeq datawriter_properties;
+  DDS_Security_EndpointSecurityAttributes datareader_security_attributes;
+  DDS_Security_PropertySeq datareader_properties;
+
+  CU_ASSERT_FATAL(crypto != NULL);
+  CU_ASSERT_FATAL(crypto->crypto_transform != NULL);
+  CU_ASSERT_FATAL(crypto->crypto_transform->encode_datareader_submessage != NULL);
+  CU_ASSERT_FATAL(crypto->crypto_transform->decode_datareader_submessage != NULL);
+
+  initialize_data_submessage(&plain_buffer);
+
+  prepare_endpoint_security_attributes_and_properties(&datareader_security_attributes, &datareader_properties, transformation_kind, false);
+  prepare_endpoint_security_attributes_and_properties(&datawriter_security_attributes, &datawriter_properties, transformation_kind, false);
+
+  nodeA_local_reader_crypto = register_local_datareader(&datareader_security_attributes, &datareader_properties);
+  CU_ASSERT_FATAL(nodeA_local_reader_crypto != 0);
+
+  nodeB_local_writer_crypto = register_local_datawriter(&datawriter_security_attributes, &datawriter_properties);
+  CU_ASSERT_FATAL(nodeB_local_writer_crypto != 0);
+
+  nodeA_remote_writer_crypto = register_remote_datawriter(nodeA_local_reader_crypto);
+  CU_ASSERT_FATAL(nodeA_remote_writer_crypto != 0);
+
+  nodeB_remote_reader_crypto = register_remote_datareader(nodeB_local_writer_crypto);
+  CU_ASSERT_FATAL(nodeB_remote_reader_crypto != 0);
+
+  result = set_remote_datareader_tokens(nodeA_local_reader_crypto, nodeA_remote_writer_crypto, nodeB_local_writer_crypto, nodeB_remote_reader_crypto);
+  CU_ASSERT_FATAL(result);
+
+  writer_list._length = writer_list._maximum = 1;
+  writer_list._buffer = DDS_Security_DatawriterCryptoHandleSeq_allocbuf(1);
+  writer_list._buffer[0] = nodeA_remote_writer_crypto;
+
+  /* Encrypt the datawriter submessage. */
+  result = crypto->crypto_transform->encode_datareader_submessage(
+      crypto->crypto_transform,
+      &encoded_buffer,
+      &plain_buffer,
+      nodeA_local_reader_crypto,
+      &writer_list,
+      &exception);
+
+  if (!result)
+  {
+    printf("encode_datareader_submessage: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+
+  CU_ASSERT_FATAL(result);
+  CU_ASSERT(exception.code == 0);
+  CU_ASSERT(exception.message == NULL);
+
+  reset_exception(&exception);
+
+  /* Decrypt the datareader submessage */
+  result = crypto->crypto_transform->decode_datareader_submessage(
+      crypto->crypto_transform,
+      &decoded_buffer,
+      &encoded_buffer,
+      nodeB_local_writer_crypto,
+      nodeB_remote_reader_crypto,
+      &exception);
+
+  if (!result)
+  {
+    printf("decode_datareader_submessage: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+
+  CU_ASSERT(exception.code == 0);
+  CU_ASSERT(exception.message == NULL);
+  if (exception.message)
+  {
+    printf("Decoding failed: %s\n", exception.message);
+  }
+  CU_ASSERT_FATAL(result);
+  CU_ASSERT_FATAL(decoded_buffer._length == plain_buffer._length);
+
+  reset_exception(&exception);
+
+  if (memcmp(decoded_buffer._buffer, plain_buffer._buffer, plain_buffer._length) != 0)
+  {
+    CU_FAIL("decode submessage is not equal to original");
+  }
+
+  unregister_datawriter(nodeA_remote_writer_crypto);
+  unregister_datareader(nodeB_remote_reader_crypto);
+  unregister_datareader(nodeA_local_reader_crypto);
+  unregister_datawriter(nodeB_local_writer_crypto);
+
+  DDS_Security_DatareaderCryptoHandleSeq_deinit(&writer_list);
+
+  DDS_Security_OctetSeq_deinit(&plain_buffer);
+  DDS_Security_OctetSeq_deinit(&encoded_buffer);
+  DDS_Security_OctetSeq_deinit(&decoded_buffer);
+
+  DDS_Security_PropertySeq_deinit(&datareader_properties);
+  DDS_Security_PropertySeq_deinit(&datawriter_properties);
+}
+
+CU_Test(ddssec_builtin_decode_datareader_submessage, encoded_256, .init = suite_decode_datareader_submessage_init, .fini = suite_decode_datareader_submessage_fini)
+{
+  decode_datareader_submessage_not_signed(CRYPTO_TRANSFORMATION_KIND_AES256_GCM);
+}
+
+CU_Test(ddssec_builtin_decode_datareader_submessage, encoded_128, .init = suite_decode_datareader_submessage_init, .fini = suite_decode_datareader_submessage_fini)
+{
+  decode_datareader_submessage_not_signed(CRYPTO_TRANSFORMATION_KIND_AES128_GCM);
+}
+
+CU_Test(ddssec_builtin_decode_datareader_submessage, not_encoded_256, .init = suite_decode_datareader_submessage_init, .fini = suite_decode_datareader_submessage_fini)
+{
+  decode_datareader_submessage_not_signed(CRYPTO_TRANSFORMATION_KIND_AES256_GMAC);
+}
+
+CU_Test(ddssec_builtin_decode_datareader_submessage, not_encoded_128, .init = suite_decode_datareader_submessage_init, .fini = suite_decode_datareader_submessage_fini)
+{
+  decode_datareader_submessage_not_signed(CRYPTO_TRANSFORMATION_KIND_AES128_GMAC);
+}
+
+static void decode_datareader_submessage_signed(
+    DDS_Security_CryptoTransformKind_Enum transformation_kind)
+{
+  const uint32_t LIST_SIZE = 4u;
+  DDS_Security_boolean result;
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  DDS_Security_DatareaderCryptoHandle local_reader_crypto;
+  DDS_Security_DatawriterCryptoHandleSeq local_writer_list;
+  DDS_Security_DatareaderCryptoHandleSeq remote_reader_list;
+  DDS_Security_DatawriterCryptoHandleSeq remote_writer_list;
+  DDS_Security_OctetSeq plain_buffer = {0, 0, NULL};
+  DDS_Security_OctetSeq encoded_buffer = {0, 0, NULL};
+  DDS_Security_OctetSeq decoded_buffer = {0, 0, NULL};
+  uint32_t i;
+  DDS_Security_EndpointSecurityAttributes datawriter_security_attributes;
+  DDS_Security_PropertySeq datawriter_properties;
+  DDS_Security_EndpointSecurityAttributes datareader_security_attributes;
+  DDS_Security_PropertySeq datareader_properties;
+
+  CU_ASSERT_FATAL(crypto != NULL);
+  CU_ASSERT_FATAL(crypto->crypto_transform != NULL);
+  CU_ASSERT_FATAL(crypto->crypto_transform->encode_datareader_submessage != NULL);
+  CU_ASSERT_FATAL(crypto->crypto_transform->decode_datareader_submessage != NULL);
+
+  initialize_data_submessage(&plain_buffer);
+
+  prepare_endpoint_security_attributes_and_properties(&datareader_security_attributes, &datareader_properties, transformation_kind, true);
+  prepare_endpoint_security_attributes_and_properties(&datawriter_security_attributes, &datawriter_properties, transformation_kind, true);
+
+  local_reader_crypto = register_local_datareader(&datareader_security_attributes, &datareader_properties);
+  CU_ASSERT_FATAL(local_reader_crypto != 0);
+
+  local_writer_list._length = local_writer_list._maximum = LIST_SIZE;
+  local_writer_list._buffer = DDS_Security_DatawriterCryptoHandleSeq_allocbuf(LIST_SIZE);
+
+  remote_reader_list._length = remote_reader_list._maximum = LIST_SIZE;
+  remote_reader_list._buffer = DDS_Security_DatareaderCryptoHandleSeq_allocbuf(LIST_SIZE);
+
+  remote_writer_list._length = remote_writer_list._maximum = LIST_SIZE;
+  remote_writer_list._buffer = DDS_Security_DatawriterCryptoHandleSeq_allocbuf(LIST_SIZE);
+
+  for (i = 0; i < LIST_SIZE; i++)
+  {
+    DDS_Security_DatawriterCryptoHandle local_writer_crypto;
+    DDS_Security_DatareaderCryptoHandle remote_reader_crypto;
+    DDS_Security_DatawriterCryptoHandle remote_writer_crypto;
+
+    local_writer_crypto = register_local_datawriter(&datawriter_security_attributes, &datawriter_properties);
+    CU_ASSERT_FATAL(local_writer_crypto != 0);
+
+    remote_writer_crypto = register_remote_datawriter(local_reader_crypto);
+    CU_ASSERT_FATAL(remote_writer_crypto != 0);
+
+    remote_reader_crypto = register_remote_datareader(local_writer_crypto);
+    CU_ASSERT_FATAL(remote_reader_crypto != 0);
+
+    result = set_remote_datareader_tokens(local_reader_crypto, remote_writer_crypto, local_writer_crypto, remote_reader_crypto);
+    CU_ASSERT_FATAL(result);
+
+    local_writer_list._buffer[i] = local_writer_crypto;
+    remote_reader_list._buffer[i] = remote_reader_crypto;
+    remote_writer_list._buffer[i] = remote_writer_crypto;
+  }
+
+  /* Encrypt the datareader submessage. */
+  result = crypto->crypto_transform->encode_datareader_submessage(
+      crypto->crypto_transform,
+      &encoded_buffer,
+      &plain_buffer,
+      local_reader_crypto,
+      &remote_writer_list,
+      &exception);
+
+  if (!result)
+  {
+    printf("encode_datareader_submessage: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+
+  CU_ASSERT_FATAL(result);
+  CU_ASSERT(exception.code == 0);
+  CU_ASSERT(exception.message == NULL);
+
+  reset_exception(&exception);
+
+  /* Decrypt the datareader submessage */
+  for (i = 0; i < LIST_SIZE; i++)
+  {
+    result = crypto->crypto_transform->decode_datareader_submessage(
+        crypto->crypto_transform,
+        &decoded_buffer,
+        &encoded_buffer,
+        local_writer_list._buffer[i],
+        remote_reader_list._buffer[i],
+        &exception);
+
+    if (!result)
+    {
+      printf("decode_datareader_submessage: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+
+    CU_ASSERT_FATAL(result);
+    CU_ASSERT(exception.code == 0);
+    CU_ASSERT(exception.message == NULL);
+    CU_ASSERT_FATAL(decoded_buffer._length == plain_buffer._length);
+
+    if (memcmp(decoded_buffer._buffer, plain_buffer._buffer, plain_buffer._length) != 0)
+    {
+      CU_FAIL("decode submessage is not equal to original");
+    }
+
+    reset_exception(&exception);
+    DDS_Security_OctetSeq_deinit(&decoded_buffer);
+  }
+
+  for (i = 0; i < LIST_SIZE; i++)
+  {
+    unregister_datareader(remote_reader_list._buffer[i]);
+    unregister_datawriter(remote_writer_list._buffer[i]);
+    unregister_datawriter(local_writer_list._buffer[i]);
+    local_writer_list._buffer[i] = 0;
+    remote_reader_list._buffer[i] = 0;
+    remote_writer_list._buffer[i] = 0;
+  }
+  unregister_datareader(local_reader_crypto);
+
+  DDS_Security_DatareaderCryptoHandleSeq_deinit(&local_writer_list);
+  DDS_Security_DatareaderCryptoHandleSeq_deinit(&remote_reader_list);
+  DDS_Security_DatawriterCryptoHandleSeq_deinit(&remote_writer_list);
+
+  DDS_Security_OctetSeq_deinit(&plain_buffer);
+  DDS_Security_OctetSeq_deinit(&encoded_buffer);
+
+  DDS_Security_PropertySeq_deinit(&datareader_properties);
+  DDS_Security_PropertySeq_deinit(&datawriter_properties);
+}
+
+CU_Test(ddssec_builtin_decode_datareader_submessage, signed_256, .init = suite_decode_datareader_submessage_init, .fini = suite_decode_datareader_submessage_fini)
+{
+  decode_datareader_submessage_signed(CRYPTO_TRANSFORMATION_KIND_AES256_GCM);
+}
+
+CU_Test(ddssec_builtin_decode_datareader_submessage, signed_128, .init = suite_decode_datareader_submessage_init, .fini = suite_decode_datareader_submessage_fini)
+{
+  decode_datareader_submessage_signed(CRYPTO_TRANSFORMATION_KIND_AES128_GCM);
+}
+
+CU_Test(ddssec_builtin_decode_datareader_submessage, only_signed_256, .init = suite_decode_datareader_submessage_init, .fini = suite_decode_datareader_submessage_fini)
+{
+  decode_datareader_submessage_signed(CRYPTO_TRANSFORMATION_KIND_AES256_GMAC);
+}
+
+CU_Test(ddssec_builtin_decode_datareader_submessage, only_signed_128, .init = suite_decode_datareader_submessage_init, .fini = suite_decode_datareader_submessage_fini)
+{
+  decode_datareader_submessage_signed(CRYPTO_TRANSFORMATION_KIND_AES128_GMAC);
+}
+
+CU_Test(ddssec_builtin_decode_datareader_submessage, invalid_args, .init = suite_decode_datareader_submessage_init, .fini = suite_decode_datareader_submessage_fini)
+{
+  DDS_Security_boolean result;
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  DDS_Security_DatareaderCryptoHandle local_reader_crypto;
+  DDS_Security_DatawriterCryptoHandle local_writer_crypto;
+  DDS_Security_DatareaderCryptoHandle remote_reader_crypto;
+  DDS_Security_DatawriterCryptoHandle remote_writer_crypto;
+  DDS_Security_DatawriterCryptoHandleSeq writer_list;
+  DDS_Security_OctetSeq plain_buffer = {0, 0, NULL};
+  DDS_Security_OctetSeq empty_buffer = {0, 0, NULL};
+  DDS_Security_OctetSeq encoded_buffer = {0, 0, NULL};
+  DDS_Security_OctetSeq decoded_buffer = {0, 0, NULL};
+  DDS_Security_EndpointSecurityAttributes datawriter_security_attributes;
+  DDS_Security_PropertySeq datawriter_properties;
+  DDS_Security_EndpointSecurityAttributes datareader_security_attributes;
+  DDS_Security_PropertySeq datareader_properties;
+
+  CU_ASSERT_FATAL(crypto != NULL);
+  CU_ASSERT_FATAL(crypto->crypto_transform != NULL);
+  CU_ASSERT_FATAL(crypto->crypto_transform->encode_datareader_submessage != NULL);
+  CU_ASSERT_FATAL(crypto->crypto_transform->decode_datareader_submessage != NULL);
+
+  initialize_data_submessage(&plain_buffer);
+
+  prepare_endpoint_security_attributes_and_properties(&datareader_security_attributes, &datareader_properties, CRYPTO_TRANSFORMATION_KIND_AES256_GMAC, false);
+  prepare_endpoint_security_attributes_and_properties(&datawriter_security_attributes, &datawriter_properties, CRYPTO_TRANSFORMATION_KIND_AES256_GMAC, false);
+
+  memset(&empty_buffer, 0, sizeof(empty_buffer));
+
+  local_reader_crypto = register_local_datareader(&datareader_security_attributes, &datareader_properties);
+  CU_ASSERT_FATAL(local_reader_crypto != 0);
+
+  local_writer_crypto = register_local_datawriter(&datawriter_security_attributes, &datawriter_properties);
+  CU_ASSERT_FATAL(local_writer_crypto != 0);
+
+  remote_writer_crypto = register_remote_datawriter(local_reader_crypto);
+  CU_ASSERT_FATAL(remote_writer_crypto != 0);
+
+  remote_reader_crypto = register_remote_datareader(local_writer_crypto);
+  CU_ASSERT_FATAL(remote_reader_crypto != 0);
+
+  result = set_remote_datareader_tokens(local_reader_crypto, remote_writer_crypto, local_writer_crypto, remote_reader_crypto);
+  CU_ASSERT_FATAL(result);
+
+  writer_list._length = writer_list._maximum = 1;
+  writer_list._buffer = DDS_Security_DatawriterCryptoHandleSeq_allocbuf(1);
+  writer_list._buffer[0] = remote_writer_crypto;
+
+  /* Encrypt the datawriter submessage. */
+  result = crypto->crypto_transform->encode_datareader_submessage(
+      crypto->crypto_transform,
+      &encoded_buffer,
+      &plain_buffer,
+      local_reader_crypto,
+      &writer_list,
+      &exception);
+
+  if (!result)
+  {
+    printf("encode_datareader_submessage: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+
+  CU_ASSERT_FATAL(result);
+  CU_ASSERT(exception.code == 0);
+  CU_ASSERT(exception.message == NULL);
+
+  reset_exception(&exception);
+
+  /* decoded buffer NULL */
+  result = crypto->crypto_transform->decode_datareader_submessage(
+      crypto->crypto_transform,
+      NULL,
+      &encoded_buffer,
+      local_writer_crypto,
+      remote_reader_crypto,
+      &exception);
+
+  if (!result)
+  {
+    printf("decode_datareader_submessage: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+
+  CU_ASSERT(!result);
+  CU_ASSERT(exception.code != 0);
+  CU_ASSERT(exception.message != NULL);
+
+  reset_exception(&exception);
+
+  /* encoded buffer NULL */
+  result = crypto->crypto_transform->decode_datareader_submessage(
+      crypto->crypto_transform,
+      &decoded_buffer,
+      NULL,
+      local_writer_crypto,
+      remote_reader_crypto,
+      &exception);
+
+  if (!result)
+  {
+    printf("decode_datareader_submessage: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+
+  CU_ASSERT(!result);
+  CU_ASSERT(exception.code != 0);
+  CU_ASSERT(exception.message != NULL);
+
+  reset_exception(&exception);
+
+  /* empty encoded buffer */
+  result = crypto->crypto_transform->decode_datareader_submessage(
+      crypto->crypto_transform,
+      &decoded_buffer,
+      &empty_buffer,
+      local_writer_crypto,
+      remote_reader_crypto,
+      &exception);
+
+  if (!result)
+  {
+    printf("decode_datareader_submessage: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+
+  CU_ASSERT(!result);
+  CU_ASSERT(exception.code != 0);
+  CU_ASSERT(exception.message != NULL);
+
+  reset_exception(&exception);
+
+  /* local writer crypto 0 */
+  result = crypto->crypto_transform->decode_datareader_submessage(
+      crypto->crypto_transform,
+      &decoded_buffer,
+      &encoded_buffer,
+      0,
+      remote_reader_crypto,
+      &exception);
+
+  if (!result)
+  {
+    printf("decode_datareader_submessage: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+
+  CU_ASSERT(!result);
+  CU_ASSERT(exception.code != 0);
+  CU_ASSERT(exception.message != NULL);
+
+  reset_exception(&exception);
+
+  /* local writer crypto unknown */
+  result = crypto->crypto_transform->decode_datareader_submessage(
+      crypto->crypto_transform,
+      &decoded_buffer,
+      &encoded_buffer,
+      1,
+      remote_reader_crypto,
+      &exception);
+
+  if (!result)
+  {
+    printf("decode_datareader_submessage: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+
+  CU_ASSERT(!result);
+  CU_ASSERT(exception.code != 0);
+  CU_ASSERT(exception.message != NULL);
+
+  reset_exception(&exception);
+
+  /* remote reader crypto 0 */
+  result = crypto->crypto_transform->decode_datareader_submessage(
+      crypto->crypto_transform,
+      &decoded_buffer,
+      &encoded_buffer,
+      local_writer_crypto,
+      0,
+      &exception);
+
+  if (!result)
+  {
+    printf("decode_datareader_submessage: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+
+  CU_ASSERT(!result);
+  CU_ASSERT(exception.code != 0);
+  CU_ASSERT(exception.message != NULL);
+
+  reset_exception(&exception);
+
+  /* remote reader crypto unknown */
+  result = crypto->crypto_transform->decode_datareader_submessage(
+      crypto->crypto_transform,
+      &decoded_buffer,
+      &encoded_buffer,
+      local_writer_crypto,
+      1,
+      &exception);
+
+  if (!result)
+  {
+    printf("decode_datareader_submessage: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+
+  CU_ASSERT(!result);
+  CU_ASSERT(exception.code != 0);
+  CU_ASSERT(exception.message != NULL);
+
+  unregister_datawriter(writer_list._buffer[0]);
+  writer_list._buffer[0] = 0;
+  unregister_datareader(remote_reader_crypto);
+  unregister_datareader(local_reader_crypto);
+  unregister_datawriter(local_writer_crypto);
+
+  reset_exception(&exception);
+
+  DDS_Security_DatareaderCryptoHandleSeq_deinit(&writer_list);
+
+  DDS_Security_OctetSeq_deinit(&plain_buffer);
+  DDS_Security_OctetSeq_deinit(&empty_buffer);
+  DDS_Security_OctetSeq_deinit(&encoded_buffer);
+  DDS_Security_OctetSeq_deinit(&decoded_buffer);
+
+  DDS_Security_PropertySeq_deinit(&datareader_properties);
+  DDS_Security_PropertySeq_deinit(&datawriter_properties);
+}
+
+CU_Test(ddssec_builtin_decode_datareader_submessage, invalid_data, .init = suite_decode_datareader_submessage_init, .fini = suite_decode_datareader_submessage_fini)
+{
+  DDS_Security_boolean result;
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  DDS_Security_DatareaderCryptoHandle local_reader_crypto;
+  DDS_Security_DatawriterCryptoHandle local_writer_crypto;
+  DDS_Security_DatareaderCryptoHandle remote_reader_crypto;
+  DDS_Security_DatawriterCryptoHandle remote_writer_crypto;
+  DDS_Security_DatawriterCryptoHandleSeq writer_list;
+  DDS_Security_OctetSeq plain_buffer = {0, 0, NULL};
+  DDS_Security_OctetSeq encoded_buffer = {0, 0, NULL};
+  DDS_Security_OctetSeq decoded_buffer = {0, 0, NULL};
+  DDS_Security_OctetSeq corrupt_buffer = {0, 0, NULL};
+  DDS_Security_EndpointSecurityAttributes datawriter_security_attributes;
+  DDS_Security_PropertySeq datawriter_properties;
+  DDS_Security_EndpointSecurityAttributes datareader_security_attributes;
+  DDS_Security_PropertySeq datareader_properties;
+
+  CU_ASSERT_FATAL(crypto != NULL);
+  CU_ASSERT_FATAL(crypto->crypto_transform != NULL);
+  CU_ASSERT_FATAL(crypto->crypto_transform->encode_datareader_submessage != NULL);
+  CU_ASSERT_FATAL(crypto->crypto_transform->decode_datareader_submessage != NULL);
+
+  initialize_data_submessage(&plain_buffer);
+
+  prepare_endpoint_security_attributes_and_properties(&datareader_security_attributes, &datareader_properties, CRYPTO_TRANSFORMATION_KIND_AES256_GCM, true);
+  prepare_endpoint_security_attributes_and_properties(&datawriter_security_attributes, &datawriter_properties, CRYPTO_TRANSFORMATION_KIND_AES256_GCM, true);
+
+  local_reader_crypto = register_local_datareader(&datareader_security_attributes, &datareader_properties);
+  CU_ASSERT_FATAL(local_reader_crypto != 0);
+
+  local_writer_crypto = register_local_datawriter(&datawriter_security_attributes, &datawriter_properties);
+  CU_ASSERT_FATAL(local_writer_crypto != 0);
+
+  remote_writer_crypto = register_remote_datawriter(local_reader_crypto);
+  CU_ASSERT_FATAL(remote_writer_crypto != 0);
+
+  remote_reader_crypto = register_remote_datareader(local_writer_crypto);
+  CU_ASSERT_FATAL(remote_reader_crypto != 0);
+
+  result = set_remote_datareader_tokens(local_reader_crypto, remote_writer_crypto, local_writer_crypto, remote_reader_crypto);
+  CU_ASSERT_FATAL(result);
+
+  writer_list._length = writer_list._maximum = 1;
+  writer_list._buffer = DDS_Security_DatawriterCryptoHandleSeq_allocbuf(1);
+  writer_list._buffer[0] = remote_writer_crypto;
+
+  /* Encrypt the datareader submessage. */
+  result = crypto->crypto_transform->encode_datareader_submessage(
+      crypto->crypto_transform,
+      &encoded_buffer,
+      &plain_buffer,
+      local_reader_crypto,
+      &writer_list,
+      &exception);
+
+  if (!result)
+  {
+    printf("encode_datareader_submessage: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+
+  CU_ASSERT_FATAL(result);
+  CU_ASSERT(exception.code == 0);
+  CU_ASSERT(exception.message == NULL);
+
+  reset_exception(&exception);
+
+  /* Incorrect prefix id */
+  {
+    struct submsg_header *prefix;
+
+    memset(&corrupt_buffer, 0, sizeof(corrupt_buffer));
+    DDS_Security_OctetSeq_copy(&corrupt_buffer, &encoded_buffer);
+
+    prefix = get_submsg(corrupt_buffer._buffer, 1);
+
+    set_submsg_header(prefix, 0x15, prefix->flags, prefix->length);
+
+    result = crypto->crypto_transform->decode_datareader_submessage(
+        crypto->crypto_transform,
+        &decoded_buffer,
+        &corrupt_buffer,
+        local_writer_crypto,
+        remote_reader_crypto,
+        &exception);
+
+    if (!result)
+    {
+      printf("decode_datareader_submessage: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+
+    CU_ASSERT(!result);
+    CU_ASSERT(exception.code != 0);
+    CU_ASSERT(exception.message != NULL);
+
+    reset_exception(&exception);
+
+    DDS_Security_OctetSeq_deinit(&corrupt_buffer);
+  }
+
+  /* Incorrect prefix length */
+  {
+    struct submsg_header *prefix;
+
+    memset(&corrupt_buffer, 0, sizeof(corrupt_buffer));
+    DDS_Security_OctetSeq_copy(&corrupt_buffer, &encoded_buffer);
+
+    prefix = get_submsg(corrupt_buffer._buffer, 1);
+
+    set_submsg_header(prefix, prefix->id, 0, prefix->length);
+
+    result = crypto->crypto_transform->decode_datareader_submessage(
+        crypto->crypto_transform,
+        &decoded_buffer,
+        &corrupt_buffer,
+        local_writer_crypto,
+        remote_reader_crypto,
+        &exception);
+
+    if (!result)
+    {
+      printf("decode_datareader_submessage: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+
+    CU_ASSERT(!result);
+    CU_ASSERT(exception.code != 0);
+    CU_ASSERT(exception.message != NULL);
+
+    reset_exception(&exception);
+
+    DDS_Security_OctetSeq_deinit(&corrupt_buffer);
+  }
+
+  /* Incorrect body id */
+  {
+    struct submsg_header *body;
+
+    memset(&corrupt_buffer, 0, sizeof(corrupt_buffer));
+    DDS_Security_OctetSeq_copy(&corrupt_buffer, &encoded_buffer);
+
+    body = get_submsg(corrupt_buffer._buffer, 2);
+
+    set_submsg_header(body, 0x15, body->flags, body->length);
+
+    result = crypto->crypto_transform->decode_datareader_submessage(
+        crypto->crypto_transform,
+        &decoded_buffer,
+        &corrupt_buffer,
+        local_writer_crypto,
+        remote_reader_crypto,
+        &exception);
+
+    if (!result)
+    {
+      printf("decode_datareader_submessage: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+
+    CU_ASSERT(!result);
+    CU_ASSERT(exception.code != 0);
+    CU_ASSERT(exception.message != NULL);
+
+    reset_exception(&exception);
+
+    DDS_Security_OctetSeq_deinit(&corrupt_buffer);
+  }
+
+  /* Incorrect body length */
+  {
+    struct submsg_header *body;
+
+    memset(&corrupt_buffer, 0, sizeof(corrupt_buffer));
+    DDS_Security_OctetSeq_copy(&corrupt_buffer, &encoded_buffer);
+
+    body = get_submsg(corrupt_buffer._buffer, 2);
+
+    set_submsg_header(body, body->id, body->flags, 1000);
+
+    result = crypto->crypto_transform->decode_datareader_submessage(
+        crypto->crypto_transform,
+        &decoded_buffer,
+        &corrupt_buffer,
+        local_writer_crypto,
+        remote_reader_crypto,
+        &exception);
+
+    if (!result)
+    {
+      printf("decode_datareader_submessage: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+
+    CU_ASSERT(!result);
+    CU_ASSERT(exception.code != 0);
+    CU_ASSERT(exception.message != NULL);
+
+    reset_exception(&exception);
+
+    DDS_Security_OctetSeq_deinit(&corrupt_buffer);
+  }
+
+  /* Incorrect postfix id */
+  {
+    struct submsg_header *postfix;
+
+    memset(&corrupt_buffer, 0, sizeof(corrupt_buffer));
+    DDS_Security_OctetSeq_copy(&corrupt_buffer, &encoded_buffer);
+
+    postfix = get_submsg(corrupt_buffer._buffer, 3);
+
+    set_submsg_header(postfix, 0x15, postfix->flags, postfix->length);
+
+    result = crypto->crypto_transform->decode_datareader_submessage(
+        crypto->crypto_transform,
+        &decoded_buffer,
+        &corrupt_buffer,
+        local_writer_crypto,
+        remote_reader_crypto,
+        &exception);
+
+    if (!result)
+    {
+      printf("decode_datareader_submessage: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+
+    CU_ASSERT(!result);
+    CU_ASSERT(exception.code != 0);
+    CU_ASSERT(exception.message != NULL);
+
+    reset_exception(&exception);
+
+    DDS_Security_OctetSeq_deinit(&corrupt_buffer);
+  }
+
+  /* Incorrect postfix length */
+  {
+    struct submsg_header *postfix;
+
+    memset(&corrupt_buffer, 0, sizeof(corrupt_buffer));
+    DDS_Security_OctetSeq_copy(&corrupt_buffer, &encoded_buffer);
+
+    postfix = get_submsg(corrupt_buffer._buffer, 3);
+
+    set_submsg_header(postfix, postfix->id, postfix->flags, 1000);
+
+    result = crypto->crypto_transform->decode_datareader_submessage(
+        crypto->crypto_transform,
+        &decoded_buffer,
+        &corrupt_buffer,
+        local_writer_crypto,
+        remote_reader_crypto,
+        &exception);
+
+    if (!result)
+    {
+      printf("decode_datareader_submessage: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+
+    CU_ASSERT(!result);
+    CU_ASSERT(exception.code != 0);
+    CU_ASSERT(exception.message != NULL);
+
+    reset_exception(&exception);
+
+    DDS_Security_OctetSeq_deinit(&corrupt_buffer);
+  }
+
+  /* Incorrect postfix length */
+  {
+    struct submsg_header *postfix;
+
+    memset(&corrupt_buffer, 0, sizeof(corrupt_buffer));
+    DDS_Security_OctetSeq_copy(&corrupt_buffer, &encoded_buffer);
+
+    postfix = get_submsg(corrupt_buffer._buffer, 3);
+
+    set_submsg_header(postfix, postfix->id, postfix->flags, (uint16_t)(postfix->length - 20));
+
+    result = crypto->crypto_transform->decode_datareader_submessage(
+        crypto->crypto_transform,
+        &decoded_buffer,
+        &corrupt_buffer,
+        local_writer_crypto,
+        remote_reader_crypto,
+        &exception);
+
+    if (!result)
+    {
+      printf("decode_datareader_submessage: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+
+    CU_ASSERT(!result);
+    CU_ASSERT(exception.code != 0);
+    CU_ASSERT(exception.message != NULL);
+
+    reset_exception(&exception);
+
+    DDS_Security_OctetSeq_deinit(&corrupt_buffer);
+  }
+
+  /* incorrect transformation kind */
+  {
+    struct crypto_header *header;
+
+    memset(&corrupt_buffer, 0, sizeof(corrupt_buffer));
+    DDS_Security_OctetSeq_copy(&corrupt_buffer, &encoded_buffer);
+
+    header = get_crypto_header(corrupt_buffer._buffer);
+    header->transform_identifier.transformation_kind[3] = CRYPTO_TRANSFORMATION_KIND_AES256_GMAC;
+
+    result = crypto->crypto_transform->decode_datareader_submessage(
+        crypto->crypto_transform,
+        &decoded_buffer,
+        &corrupt_buffer,
+        local_writer_crypto,
+        remote_reader_crypto,
+        &exception);
+
+    if (!result)
+    {
+      printf("decode_datareader_submessage: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+
+    CU_ASSERT(!result);
+    CU_ASSERT(exception.code != 0);
+    CU_ASSERT(exception.message != NULL);
+
+    reset_exception(&exception);
+
+    DDS_Security_OctetSeq_deinit(&corrupt_buffer);
+  }
+
+  /* incorrect session id */
+  {
+    struct crypto_header *header;
+
+    memset(&corrupt_buffer, 0, sizeof(corrupt_buffer));
+    DDS_Security_OctetSeq_copy(&corrupt_buffer, &encoded_buffer);
+
+    header = get_crypto_header(corrupt_buffer._buffer);
+    header->session_id[0] = (unsigned char)(header->session_id[0] + 1);
+
+    result = crypto->crypto_transform->decode_datareader_submessage(
+        crypto->crypto_transform,
+        &decoded_buffer,
+        &corrupt_buffer,
+        local_writer_crypto,
+        remote_reader_crypto,
+        &exception);
+
+    if (!result)
+    {
+      printf("decode_datareader_submessage: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+
+    CU_ASSERT(!result);
+    CU_ASSERT(exception.code != 0);
+    CU_ASSERT(exception.message != NULL);
+
+    reset_exception(&exception);
+
+    DDS_Security_OctetSeq_deinit(&corrupt_buffer);
+  }
+
+  /* incorrect init vector suffix */
+  {
+    struct crypto_header *header;
+
+    memset(&corrupt_buffer, 0, sizeof(corrupt_buffer));
+    DDS_Security_OctetSeq_copy(&corrupt_buffer, &encoded_buffer);
+
+    header = get_crypto_header(corrupt_buffer._buffer);
+    header->init_vector_suffix[0] = (unsigned char)(header->init_vector_suffix[0] + 1);
+
+    result = crypto->crypto_transform->decode_datareader_submessage(
+        crypto->crypto_transform,
+        &decoded_buffer,
+        &corrupt_buffer,
+        local_writer_crypto,
+        remote_reader_crypto,
+        &exception);
+
+    if (!result)
+    {
+      printf("decode_datareader_submessage: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+
+    CU_ASSERT(!result);
+    CU_ASSERT(exception.code != 0);
+    CU_ASSERT(exception.message != NULL);
+
+    reset_exception(&exception);
+
+    DDS_Security_OctetSeq_deinit(&corrupt_buffer);
+  }
+
+  /* incorrect encoded data */
+  {
+    struct submsg_header *body;
+    unsigned char *data;
+
+    memset(&corrupt_buffer, 0, sizeof(corrupt_buffer));
+    DDS_Security_OctetSeq_copy(&corrupt_buffer, &encoded_buffer);
+
+    body = get_submsg(corrupt_buffer._buffer, 2);
+    data = (unsigned char *)(body + 1);
+    data[0] = (unsigned char)(data[0] + 1);
+
+    result = crypto->crypto_transform->decode_datareader_submessage(
+        crypto->crypto_transform,
+        &decoded_buffer,
+        &corrupt_buffer,
+        local_writer_crypto,
+        remote_reader_crypto,
+        &exception);
+
+    if (!result)
+    {
+      printf("decode_datareader_submessage: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+
+    CU_ASSERT(!result);
+    CU_ASSERT(exception.code != 0);
+    CU_ASSERT(exception.message != NULL);
+
+    reset_exception(&exception);
+
+    DDS_Security_OctetSeq_deinit(&corrupt_buffer);
+  }
+
+  /* footer incorrect common mac */
+  {
+    struct crypto_footer *footer;
+
+    memset(&corrupt_buffer, 0, sizeof(corrupt_buffer));
+    DDS_Security_OctetSeq_copy(&corrupt_buffer, &encoded_buffer);
+
+    footer = get_crypto_footer(corrupt_buffer._buffer);
+    footer->common_mac[0]++;
+
+    result = crypto->crypto_transform->decode_datareader_submessage(
+        crypto->crypto_transform,
+        &decoded_buffer,
+        &corrupt_buffer,
+        local_writer_crypto,
+        remote_reader_crypto,
+        &exception);
+
+    if (!result)
+    {
+      printf("decode_datareader_submessage: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+
+    CU_ASSERT(!result);
+    CU_ASSERT(exception.code != 0);
+    CU_ASSERT(exception.message != NULL);
+
+    reset_exception(&exception);
+
+    DDS_Security_OctetSeq_deinit(&corrupt_buffer);
+  }
+
+  /* footer missing reader_specific mac  */
+  {
+    struct crypto_footer *footer;
+    uint32_t len;
+
+    memset(&corrupt_buffer, 0, sizeof(corrupt_buffer));
+    DDS_Security_OctetSeq_copy(&corrupt_buffer, &encoded_buffer);
+
+    footer = get_crypto_footer(corrupt_buffer._buffer);
+    len = ddsrt_bswap4u(*(uint32_t *)footer->length);
+    CU_ASSERT(len == 1);
+    memset(footer->length, 0, 4);
+
+    result = crypto->crypto_transform->decode_datareader_submessage(
+        crypto->crypto_transform,
+        &decoded_buffer,
+        &corrupt_buffer,
+        local_writer_crypto,
+        remote_reader_crypto,
+        &exception);
+
+    if (!result)
+    {
+      printf("decode_datareader_submessage: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+
+    CU_ASSERT(!result);
+    CU_ASSERT(exception.code != 0);
+    CU_ASSERT(exception.message != NULL);
+
+    reset_exception(&exception);
+
+    DDS_Security_OctetSeq_deinit(&corrupt_buffer);
+  }
+
+  /* footer incorrect reader_specific mac id  */
+  {
+    struct crypto_footer *footer;
+    struct receiver_specific_mac *rmac;
+    uint32_t len;
+
+    memset(&corrupt_buffer, 0, sizeof(corrupt_buffer));
+    DDS_Security_OctetSeq_copy(&corrupt_buffer, &encoded_buffer);
+
+    footer = get_crypto_footer(corrupt_buffer._buffer);
+    len = ddsrt_bswap4u(*(uint32_t *)footer->length);
+    CU_ASSERT(len == 1);
+
+    rmac = (struct receiver_specific_mac *)(footer + 1);
+    rmac->receiver_mac_key_id[0] = (unsigned char)(rmac->receiver_mac_key_id[0] + 1);
+
+    result = crypto->crypto_transform->decode_datareader_submessage(
+        crypto->crypto_transform,
+        &decoded_buffer,
+        &corrupt_buffer,
+        local_writer_crypto,
+        remote_reader_crypto,
+        &exception);
+
+    if (!result)
+    {
+      printf("decode_datareader_submessage: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+
+    CU_ASSERT(!result);
+    CU_ASSERT(exception.code != 0);
+    CU_ASSERT(exception.message != NULL);
+
+    reset_exception(&exception);
+
+    DDS_Security_OctetSeq_deinit(&corrupt_buffer);
+  }
+
+  /* footer incorrect reader_specific mac   */
+  {
+    struct crypto_footer *footer;
+    struct receiver_specific_mac *rmac;
+    uint32_t len;
+
+    memset(&corrupt_buffer, 0, sizeof(corrupt_buffer));
+    DDS_Security_OctetSeq_copy(&corrupt_buffer, &encoded_buffer);
+
+    footer = get_crypto_footer(corrupt_buffer._buffer);
+    len = ddsrt_bswap4u(*(uint32_t *)footer->length);
+    CU_ASSERT(len == 1);
+
+    rmac = (struct receiver_specific_mac *)(footer + 1);
+    rmac->receiver_mac[0] = (unsigned char)(rmac->receiver_mac[0] + 1);
+
+    result = crypto->crypto_transform->decode_datareader_submessage(
+        crypto->crypto_transform,
+        &decoded_buffer,
+        &corrupt_buffer,
+        local_writer_crypto,
+        remote_reader_crypto,
+        &exception);
+
+    if (!result)
+    {
+      printf("decode_datareader_submessage: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+
+    CU_ASSERT(!result);
+    CU_ASSERT(exception.code != 0);
+    CU_ASSERT(exception.message != NULL);
+
+    reset_exception(&exception);
+
+    DDS_Security_OctetSeq_deinit(&corrupt_buffer);
+  }
+
+  unregister_datawriter(writer_list._buffer[0]);
+  writer_list._buffer[0] = 0;
+  unregister_datareader(remote_reader_crypto);
+  unregister_datareader(local_reader_crypto);
+  unregister_datawriter(local_writer_crypto);
+
+  reset_exception(&exception);
+
+  DDS_Security_DatareaderCryptoHandleSeq_deinit(&writer_list);
+
+  DDS_Security_OctetSeq_deinit(&plain_buffer);
+  DDS_Security_OctetSeq_deinit(&corrupt_buffer);
+  DDS_Security_OctetSeq_deinit(&encoded_buffer);
+  DDS_Security_OctetSeq_deinit(&decoded_buffer);
+
+  DDS_Security_PropertySeq_deinit(&datareader_properties);
+  DDS_Security_PropertySeq_deinit(&datawriter_properties);
+}
+
+CU_Test(ddssec_builtin_decode_datareader_submessage, volatile_sec, .init = suite_decode_datareader_submessage_init, .fini = suite_decode_datareader_submessage_fini)
+{
+  DDS_Security_boolean result;
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  DDS_Security_DatareaderCryptoHandle local_reader_crypto;
+  DDS_Security_DatawriterCryptoHandle local_writer_crypto;
+  DDS_Security_DatareaderCryptoHandle remote_reader_crypto;
+  DDS_Security_DatawriterCryptoHandle remote_writer_crypto;
+  DDS_Security_DatawriterCryptoHandleSeq writer_list;
+  DDS_Security_EndpointSecurityAttributes datawriter_security_attributes;
+  DDS_Security_PropertySeq datawriter_properties;
+  DDS_Security_EndpointSecurityAttributes datareader_security_attributes;
+  DDS_Security_PropertySeq datareader_properties;
+  DDS_Security_OctetSeq plain_buffer = {0, 0, NULL};
+  DDS_Security_OctetSeq encoded_buffer = {0, 0, NULL};
+  DDS_Security_OctetSeq decoded_buffer = {0, 0, NULL};
+
+  CU_ASSERT_FATAL(crypto != NULL);
+  CU_ASSERT_FATAL(crypto->crypto_transform != NULL);
+  CU_ASSERT_FATAL(crypto->crypto_transform->encode_datareader_submessage != NULL);
+  CU_ASSERT_FATAL(crypto->crypto_transform->decode_datareader_submessage != NULL);
+
+  initialize_data_submessage(&plain_buffer);
+
+  prepare_endpoint_security_attributes_and_properties(&datareader_security_attributes, NULL, CRYPTO_TRANSFORMATION_KIND_AES256_GCM, false);
+  prepare_endpoint_security_attributes_and_properties(&datawriter_security_attributes, NULL, CRYPTO_TRANSFORMATION_KIND_AES256_GCM, false);
+
+  datareader_properties._length = datareader_properties._maximum = 1;
+  datareader_properties._buffer = DDS_Security_PropertySeq_allocbuf(1);
+  datareader_properties._buffer[0].name = ddsrt_strdup("dds.sec.builtin_endpoint_name");
+  datareader_properties._buffer[0].value = ddsrt_strdup("BuiltinParticipantVolatileMessageSecureReader");
+  datareader_properties._buffer[0].propagate = false;
+
+  datawriter_properties._length = datawriter_properties._maximum = 1;
+  datawriter_properties._buffer = DDS_Security_PropertySeq_allocbuf(1);
+  datawriter_properties._buffer[0].name = ddsrt_strdup("dds.sec.builtin_endpoint_name");
+  datawriter_properties._buffer[0].value = ddsrt_strdup("BuiltinParticipantVolatileMessageSecureWriter");
+  datawriter_properties._buffer[0].propagate = false;
+
+  local_writer_crypto =
+      crypto->crypto_key_factory->register_local_datawriter(
+          crypto->crypto_key_factory,
+          local_participant_handle,
+          &datawriter_properties,
+          &datawriter_security_attributes,
+          &exception);
+  CU_ASSERT_FATAL(local_writer_crypto != 0);
+
+  local_reader_crypto =
+      crypto->crypto_key_factory->register_local_datareader(
+          crypto->crypto_key_factory,
+          local_participant_handle,
+          &datareader_properties,
+          &datareader_security_attributes,
+          &exception);
+  CU_ASSERT_FATAL(local_reader_crypto != 0);
+
+  remote_writer_crypto =
+      crypto->crypto_key_factory->register_matched_remote_datawriter(
+          crypto->crypto_key_factory,
+          local_reader_crypto,
+          remote_participant_handle,
+          shared_secret_handle,
+          &exception);
+  CU_ASSERT_FATAL(remote_writer_crypto != 0);
+
+  remote_reader_crypto =
+      crypto->crypto_key_factory->register_matched_remote_datareader(
+          crypto->crypto_key_factory,
+          local_writer_crypto,
+          remote_participant_handle,
+          shared_secret_handle,
+          true,
+          &exception);
+  CU_ASSERT_FATAL(remote_reader_crypto != 0);
+
+  writer_list._length = writer_list._maximum = 1;
+  writer_list._buffer = DDS_Security_DatawriterCryptoHandleSeq_allocbuf(1);
+  writer_list._buffer[0] = remote_writer_crypto;
+
+  /* Encrypt the datawriter submessage. */
+  result = crypto->crypto_transform->encode_datareader_submessage(
+      crypto->crypto_transform,
+      &encoded_buffer,
+      &plain_buffer,
+      local_reader_crypto,
+      &writer_list,
+      &exception);
+
+  if (!result)
+  {
+    printf("encode_datareader_submessage: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+
+  CU_ASSERT_FATAL(result);
+  CU_ASSERT(exception.code == 0);
+  CU_ASSERT(exception.message == NULL);
+
+  reset_exception(&exception);
+
+  /* Decrypt the datareader submessage */
+  result = crypto->crypto_transform->decode_datareader_submessage(
+      crypto->crypto_transform,
+      &decoded_buffer,
+      &encoded_buffer,
+      local_writer_crypto,
+      remote_reader_crypto,
+      &exception);
+
+  if (!result)
+  {
+    printf("decode_datareader_submessage: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+
+  CU_ASSERT_FATAL(result);
+  CU_ASSERT(exception.code == 0);
+  CU_ASSERT(exception.message == NULL);
+  CU_ASSERT_FATAL(decoded_buffer._length == plain_buffer._length);
+
+  reset_exception(&exception);
+
+  if (memcmp(decoded_buffer._buffer, plain_buffer._buffer, plain_buffer._length) != 0)
+  {
+    CU_FAIL("decode submessage is not equal to original");
+  }
+
+  unregister_datawriter(writer_list._buffer[0]);
+  writer_list._buffer[0] = 0;
+  unregister_datareader(remote_reader_crypto);
+  unregister_datareader(local_reader_crypto);
+  unregister_datawriter(local_writer_crypto);
+
+  reset_exception(&exception);
+
+  DDS_Security_DatareaderCryptoHandleSeq_deinit(&writer_list);
+
+  DDS_Security_OctetSeq_deinit(&plain_buffer);
+  DDS_Security_OctetSeq_deinit(&encoded_buffer);
+  DDS_Security_OctetSeq_deinit(&decoded_buffer);
+
+  DDS_Security_PropertySeq_deinit(&datawriter_properties);
+  DDS_Security_PropertySeq_deinit(&datareader_properties);
+}
+
diff --git a/src/security/builtin_plugins/tests/decode_datawriter_submessage/src/decode_datawriter_submessage_utests.c b/src/security/builtin_plugins/tests/decode_datawriter_submessage/src/decode_datawriter_submessage_utests.c
new file mode 100644
index 0000000..0e700ca
--- /dev/null
+++ b/src/security/builtin_plugins/tests/decode_datawriter_submessage/src/decode_datawriter_submessage_utests.c
@@ -0,0 +1,1771 @@
+/*
+ * Copyright(c) 2006 to 2019 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+#include <assert.h>
+#include <openssl/evp.h>
+#include <openssl/hmac.h>
+#include <openssl/bio.h>
+#include <openssl/err.h>
+
+#include "dds/ddsrt/bswap.h"
+#include "dds/ddsrt/heap.h"
+#include "dds/ddsrt/string.h"
+#include "dds/ddsrt/endian.h"
+#include "dds/ddsrt/types.h"
+#include "dds/ddsrt/environ.h"
+#include "dds/security/dds_security_api.h"
+#include "dds/security/core/dds_security_serialize.h"
+#include "dds/security/core/dds_security_utils.h"
+#include "dds/security/core/shared_secret.h"
+#include "CUnit/CUnit.h"
+#include "CUnit/Test.h"
+#include "common/src/loader.h"
+#include "crypto_objects.h"
+
+#define TEST_SHARED_SECRET_SIZE 32
+
+static struct plugins_hdl *plugins = NULL;
+static dds_security_cryptography *crypto = NULL;
+
+static DDS_Security_IdentityHandle local_participant_identity = 1;
+static DDS_Security_IdentityHandle remote_participant_identity = 2;
+
+static DDS_Security_ParticipantCryptoHandle local_participant_handle = DDS_SECURITY_HANDLE_NIL;
+static DDS_Security_ParticipantCryptoHandle remote_participant_handle = DDS_SECURITY_HANDLE_NIL;
+
+static DDS_Security_SharedSecretHandleImpl *shared_secret_handle_impl = NULL;
+static DDS_Security_SharedSecretHandle shared_secret_handle;
+
+static const char *sample_test_data =
+    "ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789abcdefghijklmnopqrstuvwxyz"
+    "ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789abcdefghijklmnopqrstuvwxyz"
+    "ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789abcdefghijklmnopqrstuvwxyz"
+    "ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789abcdefghijklmnopqrstuvwxy";
+
+struct submsg_header
+{
+  unsigned char id;
+  unsigned char flags;
+  uint16_t length;
+};
+
+struct crypto_header
+{
+  struct CryptoTransformIdentifier transform_identifier;
+  unsigned char session_id[4];
+  unsigned char init_vector_suffix[8];
+};
+
+struct crypto_footer
+{
+  unsigned char common_mac[16];
+  unsigned char length[4];
+};
+
+struct receiver_specific_mac
+{
+  DDS_Security_CryptoTransformKeyId receiver_mac_key_id;
+  unsigned char receiver_mac[CRYPTO_HMAC_SIZE];
+};
+
+static void reset_exception(DDS_Security_SecurityException *ex)
+{
+  ex->code = 0;
+  ex->minor_code = 0;
+  ddsrt_free(ex->message);
+  ex->message = NULL;
+}
+
+static void allocate_shared_secret(void)
+{
+  int32_t i;
+
+  shared_secret_handle_impl = ddsrt_malloc(sizeof(DDS_Security_SharedSecretHandleImpl));
+
+  shared_secret_handle_impl->shared_secret = ddsrt_malloc(TEST_SHARED_SECRET_SIZE * sizeof(unsigned char));
+  shared_secret_handle_impl->shared_secret_size = TEST_SHARED_SECRET_SIZE;
+
+  for (i = 0; i < shared_secret_handle_impl->shared_secret_size; i++)
+  {
+    shared_secret_handle_impl->shared_secret[i] = (unsigned char)(i % 20);
+  }
+
+  for (i = 0; i < 32; i++)
+  {
+    shared_secret_handle_impl->challenge1[i] = (unsigned char)(i % 15);
+    shared_secret_handle_impl->challenge2[i] = (unsigned char)(i % 12);
+  }
+
+  shared_secret_handle = (DDS_Security_SharedSecretHandle)shared_secret_handle_impl;
+}
+
+static void deallocate_shared_secret(void)
+{
+  ddsrt_free(shared_secret_handle_impl->shared_secret);
+  ddsrt_free(shared_secret_handle_impl);
+}
+
+static int register_local_participant(void)
+{
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  DDS_Security_PermissionsHandle participant_permissions = 3; //valid dummy value
+  DDS_Security_PropertySeq participant_properties;
+  DDS_Security_ParticipantSecurityAttributes participant_security_attributes;
+
+  memset(&participant_properties, 0, sizeof(participant_properties));
+  memset(&participant_security_attributes, 0, sizeof(participant_security_attributes));
+
+  local_participant_handle =
+      crypto->crypto_key_factory->register_local_participant(
+          crypto->crypto_key_factory,
+          local_participant_identity,
+          participant_permissions,
+          &participant_properties,
+          &participant_security_attributes,
+          &exception);
+
+  if (local_participant_handle == DDS_SECURITY_HANDLE_NIL)
+  {
+    printf("register_local_participant: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+
+  return local_participant_handle ? 0 : -1;
+}
+
+static void prepare_endpoint_security_attributes_and_properties(DDS_Security_EndpointSecurityAttributes *attributes,
+                                                                DDS_Security_PropertySeq *properties,
+                                                                DDS_Security_CryptoTransformKind_Enum transformation_kind,
+                                                                bool is_origin_authenticated)
+{
+  memset(attributes, 0, sizeof(DDS_Security_EndpointSecurityAttributes));
+
+  attributes->is_discovery_protected = true;
+
+  if (properties != NULL)
+  {
+    memset(properties, 0, sizeof(DDS_Security_PropertySeq));
+    properties->_maximum = properties->_length = 1;
+    properties->_buffer = ddsrt_malloc(sizeof(DDS_Security_Property_t));
+
+    properties->_buffer[0].name = ddsrt_strdup("dds.sec.crypto.keysize");
+
+    if (transformation_kind == CRYPTO_TRANSFORMATION_KIND_AES128_GCM || transformation_kind == CRYPTO_TRANSFORMATION_KIND_AES128_GMAC)
+    {
+      properties->_buffer[0].value = ddsrt_strdup("128");
+    }
+    else
+    {
+      properties->_buffer[0].value = ddsrt_strdup("256");
+    }
+  }
+
+  switch (transformation_kind)
+  {
+  case CRYPTO_TRANSFORMATION_KIND_AES128_GCM:
+  case CRYPTO_TRANSFORMATION_KIND_AES256_GCM:
+    attributes->is_submessage_protected = true;
+    attributes->plugin_endpoint_attributes |= DDS_SECURITY_PLUGIN_ENDPOINT_ATTRIBUTES_FLAG_IS_SUBMESSAGE_ENCRYPTED;
+    if (is_origin_authenticated)
+    {
+      attributes->plugin_endpoint_attributes |= DDS_SECURITY_PLUGIN_ENDPOINT_ATTRIBUTES_FLAG_IS_SUBMESSAGE_ORIGIN_AUTHENTICATED;
+    }
+    break;
+
+  case CRYPTO_TRANSFORMATION_KIND_AES256_GMAC:
+  case CRYPTO_TRANSFORMATION_KIND_AES128_GMAC:
+    attributes->is_submessage_protected = true;
+    if (is_origin_authenticated)
+    {
+      attributes->plugin_endpoint_attributes |= DDS_SECURITY_PLUGIN_ENDPOINT_ATTRIBUTES_FLAG_IS_SUBMESSAGE_ORIGIN_AUTHENTICATED;
+    }
+    break;
+
+  default:
+    assert(0);
+    break;
+  }
+}
+
+static void unregister_local_participant(void)
+{
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  if (local_participant_handle)
+  {
+    crypto->crypto_key_factory->unregister_participant(crypto->crypto_key_factory, local_participant_handle, &exception);
+    reset_exception(&exception);
+  }
+}
+
+static int register_remote_participant(void)
+{
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  DDS_Security_PermissionsHandle remote_participant_permissions = 5;
+
+  remote_participant_handle =
+      crypto->crypto_key_factory->register_matched_remote_participant(
+          crypto->crypto_key_factory,
+          local_participant_handle,
+          remote_participant_identity,
+          remote_participant_permissions,
+          shared_secret_handle,
+          &exception);
+
+  if (remote_participant_handle == DDS_SECURITY_HANDLE_NIL)
+  {
+    printf("register_matched_remote_participant: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+
+  return remote_participant_handle ? 0 : -1;
+}
+
+static void unregister_remote_participant(void)
+{
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  if (remote_participant_handle)
+  {
+    crypto->crypto_key_factory->unregister_participant(crypto->crypto_key_factory, remote_participant_handle, &exception);
+    reset_exception(&exception);
+  }
+}
+
+static DDS_Security_DatawriterCryptoHandle register_local_datawriter(DDS_Security_EndpointSecurityAttributes *attributes, DDS_Security_PropertySeq *properties)
+{
+  DDS_Security_DatawriterCryptoHandle writer_crypto;
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+
+  writer_crypto =
+      crypto->crypto_key_factory->register_local_datawriter(
+          crypto->crypto_key_factory,
+          local_participant_handle,
+          properties,
+          attributes,
+          &exception);
+
+  if (writer_crypto == 0)
+  {
+    printf("register_local_datawriter: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+
+  return writer_crypto;
+}
+
+static DDS_Security_DatawriterCryptoHandle register_remote_datawriter(DDS_Security_DatareaderCryptoHandle reader_crypto)
+{
+  DDS_Security_DatawriterCryptoHandle writer_crypto;
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+
+  writer_crypto =
+      crypto->crypto_key_factory->register_matched_remote_datawriter(
+          crypto->crypto_key_factory,
+          reader_crypto,
+          remote_participant_handle,
+          shared_secret_handle,
+          &exception);
+
+  if (writer_crypto == 0)
+  {
+    printf("register_matched_remote_datareader: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+
+  return writer_crypto;
+}
+
+static void unregister_datawriter(DDS_Security_DatawriterCryptoHandle writer_crypto)
+{
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  if (writer_crypto)
+  {
+    crypto->crypto_key_factory->unregister_datawriter(crypto->crypto_key_factory, writer_crypto, &exception);
+    reset_exception(&exception);
+  }
+}
+
+static DDS_Security_DatareaderCryptoHandle register_local_datareader(DDS_Security_EndpointSecurityAttributes *attributes, DDS_Security_PropertySeq *properties)
+{
+  DDS_Security_DatareaderCryptoHandle reader_crypto;
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+
+  reader_crypto =
+      crypto->crypto_key_factory->register_local_datareader(
+          crypto->crypto_key_factory,
+          local_participant_handle,
+          properties,
+          attributes,
+          &exception);
+
+  if (reader_crypto == 0)
+  {
+    printf("register_local_datawriter: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+
+  return reader_crypto;
+}
+
+static DDS_Security_DatareaderCryptoHandle register_remote_datareader(DDS_Security_DatawriterCryptoHandle writer_crypto)
+{
+  DDS_Security_DatareaderCryptoHandle reader_crypto;
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  DDS_Security_PropertySeq datawriter_properties;
+
+  memset(&datawriter_properties, 0, sizeof(datawriter_properties));
+
+  reader_crypto =
+      crypto->crypto_key_factory->register_matched_remote_datareader(
+          crypto->crypto_key_factory,
+          writer_crypto,
+          remote_participant_handle,
+          shared_secret_handle,
+          true,
+          &exception);
+
+  if (reader_crypto == 0)
+  {
+    printf("register_matched_remote_datareader: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+
+  return reader_crypto;
+}
+
+static void unregister_datareader(DDS_Security_DatareaderCryptoHandle reader_crypto)
+{
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  if (reader_crypto)
+  {
+    crypto->crypto_key_factory->unregister_datareader(crypto->crypto_key_factory, reader_crypto, &exception);
+    reset_exception(&exception);
+  }
+}
+
+static bool set_remote_datawriter_tokens(
+    DDS_Security_DatawriterCryptoHandle nodeA_local_writer_crypto,
+    DDS_Security_DatareaderCryptoHandle nodeA_remote_reader_crypto,
+    DDS_Security_DatareaderCryptoHandle nodeB_local_reader_crypto,
+    DDS_Security_DatawriterCryptoHandle nodeB_remote_writer_crypto)
+{
+  DDS_Security_boolean result;
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  DDS_Security_DatawriterCryptoTokenSeq tokens;
+
+  memset(&tokens, 0, sizeof(tokens));
+
+  /* Now call the function. */
+  result = crypto->crypto_key_exchange->create_local_datawriter_crypto_tokens(
+      crypto->crypto_key_exchange,
+      &tokens,
+      nodeA_local_writer_crypto,
+      nodeA_remote_reader_crypto,
+      &exception);
+
+  if (result)
+  {
+    result = crypto->crypto_key_exchange->set_remote_datawriter_crypto_tokens(
+        crypto->crypto_key_exchange,
+        nodeB_local_reader_crypto,
+        nodeB_remote_writer_crypto,
+        &tokens,
+        &exception);
+  }
+
+  DDS_Security_DataHolderSeq_deinit(&tokens);
+
+  if (result)
+  {
+    result = crypto->crypto_key_exchange->create_local_datareader_crypto_tokens(
+        crypto->crypto_key_exchange,
+        &tokens,
+        nodeB_local_reader_crypto,
+        nodeB_remote_writer_crypto,
+        &exception);
+  }
+
+  if (result)
+  {
+    result = crypto->crypto_key_exchange->set_remote_datareader_crypto_tokens(
+        crypto->crypto_key_exchange,
+        nodeA_local_writer_crypto,
+        nodeA_remote_reader_crypto,
+        &tokens,
+        &exception);
+  }
+
+  DDS_Security_DataHolderSeq_deinit(&tokens);
+
+  return (bool)result;
+}
+
+static void suite_decode_datawriter_submessage_init(void)
+{
+  allocate_shared_secret();
+
+  CU_ASSERT_FATAL ((plugins = load_plugins(
+                      NULL    /* Access Control */,
+                      NULL    /* Authentication */,
+                      &crypto /* Cryptograpy    */)) != NULL);
+
+  CU_ASSERT_EQUAL_FATAL (register_local_participant(), 0);
+  CU_ASSERT_EQUAL_FATAL (register_remote_participant(), 0);
+}
+
+static void suite_decode_datawriter_submessage_fini(void)
+{
+  unregister_local_participant();
+  unregister_remote_participant();
+  deallocate_shared_secret();
+  unload_plugins(plugins);
+}
+
+static void initialize_data_submessage(DDS_Security_OctetSeq *submsg, bool be)
+{
+  size_t length = strlen(sample_test_data) + 1;
+  struct submsg_header *header;
+  int swap;
+  unsigned char *buffer, *ptr;
+
+  if (be)
+    swap = (DDSRT_ENDIAN == DDSRT_LITTLE_ENDIAN);
+  else
+    swap = (DDSRT_ENDIAN != DDSRT_LITTLE_ENDIAN);
+
+  buffer = ddsrt_malloc(length + sizeof(struct submsg_header));
+  header = (struct submsg_header *)buffer;
+  header->id = 0x15;
+  header->flags = be ? 0x00 : 0x01;
+  header->length = swap ? ddsrt_bswap2u((uint16_t)length) : (uint16_t)length;
+  ptr = (unsigned char *)(header + 1);
+
+  memcpy((char *)ptr, sample_test_data, length);
+
+  submsg->_length = submsg->_maximum = (uint32_t)(length + sizeof(struct submsg_header));
+  submsg->_buffer = buffer;
+}
+
+static void set_submsg_header(struct submsg_header *submsg, unsigned char id, unsigned char flags, uint16_t length)
+{
+  submsg->id = id;
+  submsg->flags = flags;
+  submsg->length = length;
+}
+
+static struct submsg_header * get_submsg(unsigned char *data, int num)
+{
+  struct submsg_header *submsg;
+  int i;
+
+  submsg = (struct submsg_header *)data;
+  for (i = 0; i < num - 1; i++)
+  {
+    uint32_t hlen = submsg->length;
+    data += sizeof(struct submsg_header) + hlen;
+    submsg = (struct submsg_header *)data;
+  }
+
+  return submsg;
+}
+
+static struct crypto_header * get_crypto_header(unsigned char *data)
+{
+  return (struct crypto_header *)(data + sizeof(struct submsg_header));
+}
+
+static struct crypto_footer * get_crypto_footer(unsigned char *data)
+{
+  struct submsg_header *submsg;
+  submsg = get_submsg(data, 3);
+  return (struct crypto_footer *)(submsg + 1);
+}
+
+static void decode_datawriter_submessage_not_signed(DDS_Security_CryptoTransformKind_Enum transformation_kind)
+{
+  DDS_Security_boolean result;
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  DDS_Security_DatawriterCryptoHandle local_writer_crypto;
+  DDS_Security_DatareaderCryptoHandle local_reader_crypto;
+  DDS_Security_DatawriterCryptoHandle remote_writer_crypto;
+  DDS_Security_DatareaderCryptoHandle remote_reader_crypto;
+  DDS_Security_DatareaderCryptoHandleSeq reader_list;
+  DDS_Security_OctetSeq plain_buffer = {0, 0, NULL};
+  DDS_Security_OctetSeq encoded_buffer = {0, 0, NULL};
+  DDS_Security_OctetSeq decoded_buffer = {0, 0, NULL};
+  int32_t index;
+  DDS_Security_EndpointSecurityAttributes datawriter_security_attributes;
+  DDS_Security_PropertySeq datawriter_properties;
+  DDS_Security_EndpointSecurityAttributes datareader_security_attributes;
+  DDS_Security_PropertySeq datareader_properties;
+
+  CU_ASSERT_FATAL(crypto != NULL);
+  CU_ASSERT_FATAL(crypto->crypto_transform != NULL);
+  CU_ASSERT_FATAL(crypto->crypto_transform->encode_datawriter_submessage != NULL);
+  CU_ASSERT_FATAL(crypto->crypto_transform->decode_datawriter_submessage != NULL);
+
+  prepare_endpoint_security_attributes_and_properties(&datareader_security_attributes, &datareader_properties, transformation_kind, false);
+  prepare_endpoint_security_attributes_and_properties(&datawriter_security_attributes, &datawriter_properties, transformation_kind, false);
+
+  initialize_data_submessage(&plain_buffer, false);
+
+  local_writer_crypto = register_local_datawriter(&datawriter_security_attributes, &datawriter_properties);
+  CU_ASSERT_FATAL(local_writer_crypto != 0);
+
+  local_reader_crypto = register_local_datareader(&datareader_security_attributes, &datareader_properties);
+  CU_ASSERT_FATAL(local_reader_crypto != 0);
+
+  remote_reader_crypto = register_remote_datareader(local_writer_crypto);
+  CU_ASSERT_FATAL(remote_reader_crypto != 0);
+
+  remote_writer_crypto = register_remote_datawriter(local_reader_crypto);
+  CU_ASSERT_FATAL(remote_writer_crypto != 0);
+
+  result = set_remote_datawriter_tokens(local_writer_crypto, remote_reader_crypto, local_reader_crypto, remote_writer_crypto);
+  CU_ASSERT_FATAL(result);
+
+  reader_list._length = reader_list._maximum = 1;
+  reader_list._buffer = DDS_Security_DatareaderCryptoHandleSeq_allocbuf(1);
+  reader_list._buffer[0] = remote_reader_crypto;
+  index = 0;
+
+  /* Encrypt the datawriter submessage. */
+  result = crypto->crypto_transform->encode_datawriter_submessage(
+      crypto->crypto_transform,
+      &encoded_buffer,
+      &plain_buffer,
+      local_writer_crypto,
+      &reader_list,
+      &index,
+      &exception);
+
+  if (!result)
+  {
+    printf("encode_datawriter_submessage: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+
+  CU_ASSERT_FATAL(result);
+  CU_ASSERT(exception.code == 0);
+  CU_ASSERT(exception.message == NULL);
+
+  reset_exception(&exception);
+
+  /* Decrypt the datawriter submessage */
+  result = crypto->crypto_transform->decode_datawriter_submessage(
+      crypto->crypto_transform,
+      &decoded_buffer,
+      &encoded_buffer,
+      local_reader_crypto,
+      remote_writer_crypto,
+      &exception);
+
+  if (!result)
+  {
+    printf("decode_datawriter_submessage: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+
+  CU_ASSERT_FATAL(result);
+  CU_ASSERT(exception.code == 0);
+  CU_ASSERT(exception.message == NULL);
+  CU_ASSERT_FATAL(decoded_buffer._length == plain_buffer._length);
+
+  reset_exception(&exception);
+
+  if (memcmp(decoded_buffer._buffer, plain_buffer._buffer, plain_buffer._length) != 0)
+  {
+    CU_FAIL("decode submessage is not equal to original");
+  }
+
+  unregister_datareader(reader_list._buffer[0]);
+  reader_list._buffer[0] = 0;
+
+  unregister_datawriter(remote_writer_crypto);
+  unregister_datareader(local_reader_crypto);
+  unregister_datawriter(local_writer_crypto);
+
+  DDS_Security_DatareaderCryptoHandleSeq_deinit(&reader_list);
+
+  DDS_Security_OctetSeq_deinit(&plain_buffer);
+  DDS_Security_OctetSeq_deinit(&encoded_buffer);
+  DDS_Security_OctetSeq_deinit(&decoded_buffer);
+  DDS_Security_PropertySeq_deinit(&datareader_properties);
+  DDS_Security_PropertySeq_deinit(&datawriter_properties);
+}
+
+CU_Test(ddssec_builtin_decode_datawriter_submessage, encoded_256, .init = suite_decode_datawriter_submessage_init, .fini = suite_decode_datawriter_submessage_fini)
+{
+  decode_datawriter_submessage_not_signed(CRYPTO_TRANSFORMATION_KIND_AES256_GCM);
+}
+
+CU_Test(ddssec_builtin_decode_datawriter_submessage, encoded_128, .init = suite_decode_datawriter_submessage_init, .fini = suite_decode_datawriter_submessage_fini)
+{
+  decode_datawriter_submessage_not_signed(CRYPTO_TRANSFORMATION_KIND_AES128_GCM);
+}
+
+CU_Test(ddssec_builtin_decode_datawriter_submessage, not_encoded_256, .init = suite_decode_datawriter_submessage_init, .fini = suite_decode_datawriter_submessage_fini)
+{
+  decode_datawriter_submessage_not_signed(CRYPTO_TRANSFORMATION_KIND_AES256_GMAC);
+}
+
+CU_Test(ddssec_builtin_decode_datawriter_submessage, not_encoded_128, .init = suite_decode_datawriter_submessage_init, .fini = suite_decode_datawriter_submessage_fini)
+{
+  decode_datawriter_submessage_not_signed(CRYPTO_TRANSFORMATION_KIND_AES128_GMAC);
+}
+
+static void decode_datawriter_submessage_signed(DDS_Security_CryptoTransformKind_Enum transformation_kind)
+{
+  const uint32_t LIST_SIZE = 4u;
+  DDS_Security_boolean result;
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  DDS_Security_DatawriterCryptoHandle local_writer_crypto;
+  DDS_Security_DatareaderCryptoHandleSeq local_reader_list;
+  DDS_Security_DatawriterCryptoHandleSeq remote_writer_list;
+  DDS_Security_DatareaderCryptoHandleSeq remote_reader_list;
+  DDS_Security_OctetSeq plain_buffer = {0, 0, NULL};
+  DDS_Security_OctetSeq encoded_buffer = {0, 0, NULL};
+  DDS_Security_OctetSeq decoded_buffer = {0, 0, NULL};
+  DDS_Security_OctetSeq *buffer;
+  int32_t index;
+  uint32_t i;
+  DDS_Security_EndpointSecurityAttributes datawriter_security_attributes;
+  DDS_Security_PropertySeq datawriter_properties;
+  DDS_Security_EndpointSecurityAttributes datareader_security_attributes;
+  DDS_Security_PropertySeq datareader_properties;
+
+  CU_ASSERT_FATAL(crypto != NULL);
+  CU_ASSERT_FATAL(crypto->crypto_transform != NULL);
+  CU_ASSERT_FATAL(crypto->crypto_transform->encode_datawriter_submessage != NULL);
+  CU_ASSERT_FATAL(crypto->crypto_transform->decode_datawriter_submessage != NULL);
+
+  prepare_endpoint_security_attributes_and_properties(&datareader_security_attributes, &datareader_properties, transformation_kind, true);
+  prepare_endpoint_security_attributes_and_properties(&datawriter_security_attributes, &datawriter_properties, transformation_kind, true);
+
+  initialize_data_submessage(&plain_buffer, false);
+
+  local_writer_crypto = register_local_datawriter(&datawriter_security_attributes, &datawriter_properties);
+  CU_ASSERT_FATAL(local_writer_crypto != 0);
+
+  local_reader_list._length = local_reader_list._maximum = LIST_SIZE;
+  local_reader_list._buffer = DDS_Security_DatareaderCryptoHandleSeq_allocbuf(LIST_SIZE);
+
+  remote_writer_list._length = remote_writer_list._maximum = LIST_SIZE;
+  remote_writer_list._buffer = DDS_Security_DatawriterCryptoHandleSeq_allocbuf(LIST_SIZE);
+
+  remote_reader_list._length = remote_reader_list._maximum = LIST_SIZE;
+  remote_reader_list._buffer = DDS_Security_DatareaderCryptoHandleSeq_allocbuf(LIST_SIZE);
+
+  for (i = 0; i < LIST_SIZE; i++)
+  {
+    DDS_Security_DatareaderCryptoHandle local_reader_crypto;
+    DDS_Security_DatawriterCryptoHandle remote_writer_crypto;
+    DDS_Security_DatareaderCryptoHandle remote_reader_crypto;
+
+    local_reader_crypto = register_local_datareader(&datareader_security_attributes, &datareader_properties);
+    CU_ASSERT_FATAL(local_reader_crypto != 0);
+
+    remote_reader_crypto = register_remote_datareader(local_writer_crypto);
+    CU_ASSERT_FATAL(remote_reader_crypto != 0);
+
+    remote_writer_crypto = register_remote_datawriter(local_reader_crypto);
+    CU_ASSERT_FATAL(remote_writer_crypto != 0);
+
+    result = set_remote_datawriter_tokens(local_writer_crypto, remote_reader_crypto, local_reader_crypto, remote_writer_crypto);
+    CU_ASSERT_FATAL(result);
+
+    local_reader_list._buffer[i] = local_reader_crypto;
+    remote_writer_list._buffer[i] = remote_writer_crypto;
+    remote_reader_list._buffer[i] = remote_reader_crypto;
+  }
+
+  index = 0;
+
+  /* Encrypt the datawriter submessage. */
+  buffer = &plain_buffer;
+  while ((uint32_t)index != LIST_SIZE)
+  {
+    result = crypto->crypto_transform->encode_datawriter_submessage(
+        crypto->crypto_transform,
+        &encoded_buffer,
+        buffer,
+        local_writer_crypto,
+        &remote_reader_list,
+        &index,
+        &exception);
+
+    if (!result)
+    {
+      printf("encode_datawriter_submessage: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+
+    CU_ASSERT_FATAL(result);
+    CU_ASSERT(exception.code == 0);
+    CU_ASSERT(exception.message == NULL);
+
+    reset_exception(&exception);
+    buffer = NULL;
+  }
+
+  /* Decrypt the datawriter submessage */
+
+  for (i = 0; i < LIST_SIZE; i++)
+  {
+    result = crypto->crypto_transform->decode_datawriter_submessage(
+        crypto->crypto_transform,
+        &decoded_buffer,
+        &encoded_buffer,
+        local_reader_list._buffer[i],
+        remote_writer_list._buffer[i],
+        &exception);
+
+    if (!result)
+    {
+      printf("decode_datawriter_submessage: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+
+    CU_ASSERT_FATAL(result);
+    CU_ASSERT(exception.code == 0);
+    CU_ASSERT(exception.message == NULL);
+    CU_ASSERT_FATAL(decoded_buffer._length == plain_buffer._length);
+
+    if (memcmp(decoded_buffer._buffer, plain_buffer._buffer, plain_buffer._length) != 0)
+    {
+      CU_FAIL("decode submessage is not equal to original");
+    }
+
+    reset_exception(&exception);
+    DDS_Security_OctetSeq_deinit(&decoded_buffer);
+  }
+
+  for (i = 0; i < LIST_SIZE; i++)
+  {
+    unregister_datareader(remote_reader_list._buffer[i]);
+    unregister_datawriter(remote_writer_list._buffer[i]);
+    unregister_datareader(local_reader_list._buffer[i]);
+    local_reader_list._buffer[i] = 0;
+    remote_reader_list._buffer[i] = 0;
+    remote_writer_list._buffer[i] = 0;
+  }
+  unregister_datawriter(local_writer_crypto);
+
+  DDS_Security_DatareaderCryptoHandleSeq_deinit(&local_reader_list);
+  DDS_Security_DatareaderCryptoHandleSeq_deinit(&remote_reader_list);
+  DDS_Security_DatawriterCryptoHandleSeq_deinit(&remote_writer_list);
+
+  DDS_Security_OctetSeq_deinit(&plain_buffer);
+  DDS_Security_OctetSeq_deinit(&encoded_buffer);
+
+  DDS_Security_PropertySeq_deinit(&datareader_properties);
+  DDS_Security_PropertySeq_deinit(&datawriter_properties);
+}
+
+CU_Test(ddssec_builtin_decode_datawriter_submessage, signed_256, .init = suite_decode_datawriter_submessage_init, .fini = suite_decode_datawriter_submessage_fini)
+{
+  decode_datawriter_submessage_signed(CRYPTO_TRANSFORMATION_KIND_AES256_GCM);
+}
+
+CU_Test(ddssec_builtin_decode_datawriter_submessage, signed_128, .init = suite_decode_datawriter_submessage_init, .fini = suite_decode_datawriter_submessage_fini)
+{
+  decode_datawriter_submessage_signed(CRYPTO_TRANSFORMATION_KIND_AES128_GCM);
+}
+
+CU_Test(ddssec_builtin_decode_datawriter_submessage, only_signed_256, .init = suite_decode_datawriter_submessage_init, .fini = suite_decode_datawriter_submessage_fini)
+{
+  decode_datawriter_submessage_signed(CRYPTO_TRANSFORMATION_KIND_AES256_GMAC);
+}
+
+CU_Test(ddssec_builtin_decode_datawriter_submessage, only_signed_128, .init = suite_decode_datawriter_submessage_init, .fini = suite_decode_datawriter_submessage_fini)
+{
+  decode_datawriter_submessage_signed(CRYPTO_TRANSFORMATION_KIND_AES128_GMAC);
+}
+
+CU_Test(ddssec_builtin_decode_datawriter_submessage, invalid_args, .init = suite_decode_datawriter_submessage_init, .fini = suite_decode_datawriter_submessage_fini)
+{
+  DDS_Security_boolean result;
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  DDS_Security_DatawriterCryptoHandle local_writer_crypto;
+  DDS_Security_DatareaderCryptoHandle local_reader_crypto;
+  DDS_Security_DatawriterCryptoHandle remote_writer_crypto;
+  DDS_Security_DatareaderCryptoHandle remote_reader_crypto;
+  DDS_Security_DatareaderCryptoHandleSeq reader_list;
+  DDS_Security_OctetSeq plain_buffer = {0, 0, NULL};
+  DDS_Security_OctetSeq empty_buffer = {0, 0, NULL};
+  DDS_Security_OctetSeq encoded_buffer = {0, 0, NULL};
+  DDS_Security_OctetSeq decoded_buffer = {0, 0, NULL};
+  int32_t index;
+  DDS_Security_EndpointSecurityAttributes datawriter_security_attributes;
+  DDS_Security_PropertySeq datawriter_properties;
+  DDS_Security_EndpointSecurityAttributes datareader_security_attributes;
+  DDS_Security_PropertySeq datareader_properties;
+
+  CU_ASSERT_FATAL(crypto != NULL);
+  CU_ASSERT_FATAL(crypto->crypto_transform != NULL);
+  CU_ASSERT_FATAL(crypto->crypto_transform->encode_datawriter_submessage != NULL);
+  CU_ASSERT_FATAL(crypto->crypto_transform->decode_datawriter_submessage != NULL);
+
+  prepare_endpoint_security_attributes_and_properties(&datareader_security_attributes, &datareader_properties, CRYPTO_TRANSFORMATION_KIND_AES256_GCM, true);
+  prepare_endpoint_security_attributes_and_properties(&datawriter_security_attributes, &datawriter_properties, CRYPTO_TRANSFORMATION_KIND_AES256_GCM, true);
+
+  initialize_data_submessage(&plain_buffer, false);
+
+  memset(&empty_buffer, 0, sizeof(empty_buffer));
+
+  local_writer_crypto = register_local_datawriter(&datawriter_security_attributes, &datawriter_properties);
+  CU_ASSERT_FATAL(local_writer_crypto != 0);
+
+  local_reader_crypto = register_local_datareader(&datareader_security_attributes, &datareader_properties);
+  CU_ASSERT_FATAL(local_reader_crypto != 0);
+
+  remote_reader_crypto = register_remote_datareader(local_writer_crypto);
+  CU_ASSERT_FATAL(remote_reader_crypto != 0);
+
+  remote_writer_crypto = register_remote_datawriter(local_reader_crypto);
+  CU_ASSERT_FATAL(remote_writer_crypto != 0);
+
+  result = set_remote_datawriter_tokens(local_writer_crypto, remote_reader_crypto, local_reader_crypto, remote_writer_crypto);
+  CU_ASSERT_FATAL(result);
+
+  reader_list._length = reader_list._maximum = 1;
+  reader_list._buffer = DDS_Security_DatareaderCryptoHandleSeq_allocbuf(1);
+  reader_list._buffer[0] = remote_reader_crypto;
+  index = 0;
+
+  /* Encrypt the datawriter submessage. */
+  result = crypto->crypto_transform->encode_datawriter_submessage(
+      crypto->crypto_transform,
+      &encoded_buffer,
+      &plain_buffer,
+      local_writer_crypto,
+      &reader_list,
+      &index,
+      &exception);
+
+  if (!result)
+  {
+    printf("encode_datawriter_submessage: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+
+  CU_ASSERT_FATAL(result);
+  CU_ASSERT(exception.code == 0);
+  CU_ASSERT(exception.message == NULL);
+
+  reset_exception(&exception);
+
+#if 0
+    /*  */
+    result = crypto->crypto_transform->decode_datawriter_submessage(
+            crypto->crypto_transform,
+            &decoded_buffer,
+            &encoded_buffer,
+            local_reader_crypto,
+            remote_writer_crypto,
+            &exception);
+
+    if (!result) {
+        printf("decode_datawriter_submessage: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+
+    CU_ASSERT(!result);
+    CU_ASSERT(exception.code != 0);
+    CU_ASSERT(exception.message != NULL);
+
+    reset_exception(&exception);
+#endif
+
+  /* decoded buffer NULL */
+  result = crypto->crypto_transform->decode_datawriter_submessage(
+      crypto->crypto_transform,
+      NULL,
+      &encoded_buffer,
+      local_reader_crypto,
+      remote_writer_crypto,
+      &exception);
+
+  if (!result)
+  {
+    printf("decode_datawriter_submessage: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+
+  CU_ASSERT(!result);
+  CU_ASSERT(exception.code != 0);
+  CU_ASSERT(exception.message != NULL);
+
+  reset_exception(&exception);
+
+  /* encoded buffer NULL */
+  result = crypto->crypto_transform->decode_datawriter_submessage(
+      crypto->crypto_transform,
+      &decoded_buffer,
+      NULL,
+      local_reader_crypto,
+      remote_writer_crypto,
+      &exception);
+
+  if (!result)
+  {
+    printf("decode_datawriter_submessage: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+
+  CU_ASSERT(!result);
+  CU_ASSERT(exception.code != 0);
+  CU_ASSERT(exception.message != NULL);
+
+  reset_exception(&exception);
+
+  /* empty encoded buffer */
+  result = crypto->crypto_transform->decode_datawriter_submessage(
+      crypto->crypto_transform,
+      &decoded_buffer,
+      &empty_buffer,
+      local_reader_crypto,
+      remote_writer_crypto,
+      &exception);
+
+  if (!result)
+  {
+    printf("decode_datawriter_submessage: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+
+  CU_ASSERT(!result);
+  CU_ASSERT(exception.code != 0);
+  CU_ASSERT(exception.message != NULL);
+
+  reset_exception(&exception);
+
+  /* local reader crypto 0 */
+  result = crypto->crypto_transform->decode_datawriter_submessage(
+      crypto->crypto_transform,
+      &decoded_buffer,
+      &encoded_buffer,
+      0,
+      remote_writer_crypto,
+      &exception);
+
+  if (!result)
+  {
+    printf("decode_datawriter_submessage: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+
+  CU_ASSERT(!result);
+  CU_ASSERT(exception.code != 0);
+  CU_ASSERT(exception.message != NULL);
+
+  reset_exception(&exception);
+
+  /* local reader crypto unknown */
+  result = crypto->crypto_transform->decode_datawriter_submessage(
+      crypto->crypto_transform,
+      &decoded_buffer,
+      &encoded_buffer,
+      1,
+      remote_writer_crypto,
+      &exception);
+
+  if (!result)
+  {
+    printf("decode_datawriter_submessage: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+
+  CU_ASSERT(!result);
+  CU_ASSERT(exception.code != 0);
+  CU_ASSERT(exception.message != NULL);
+
+  reset_exception(&exception);
+
+  /* remote writer crypto 0 */
+  result = crypto->crypto_transform->decode_datawriter_submessage(
+      crypto->crypto_transform,
+      &decoded_buffer,
+      &encoded_buffer,
+      local_reader_crypto,
+      0,
+      &exception);
+
+  if (!result)
+  {
+    printf("decode_datawriter_submessage: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+
+  CU_ASSERT(!result);
+  CU_ASSERT(exception.code != 0);
+  CU_ASSERT(exception.message != NULL);
+
+  reset_exception(&exception);
+
+  /* remote writer crypto unknown */
+  result = crypto->crypto_transform->decode_datawriter_submessage(
+      crypto->crypto_transform,
+      &decoded_buffer,
+      &encoded_buffer,
+      local_reader_crypto,
+      1,
+      &exception);
+
+  if (!result)
+  {
+    printf("decode_datawriter_submessage: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+
+  CU_ASSERT(!result);
+  CU_ASSERT(exception.code != 0);
+  CU_ASSERT(exception.message != NULL);
+
+  unregister_datareader(reader_list._buffer[0]);
+  reader_list._buffer[0] = 0;
+  unregister_datawriter(remote_writer_crypto);
+  unregister_datareader(local_reader_crypto);
+  unregister_datawriter(local_writer_crypto);
+
+  reset_exception(&exception);
+
+  DDS_Security_DatareaderCryptoHandleSeq_deinit(&reader_list);
+
+  DDS_Security_OctetSeq_deinit(&plain_buffer);
+  DDS_Security_OctetSeq_deinit(&empty_buffer);
+  DDS_Security_OctetSeq_deinit(&encoded_buffer);
+  DDS_Security_OctetSeq_deinit(&decoded_buffer);
+
+  DDS_Security_PropertySeq_deinit(&datareader_properties);
+  DDS_Security_PropertySeq_deinit(&datawriter_properties);
+}
+
+CU_Test(ddssec_builtin_decode_datawriter_submessage, invalid_data, .init = suite_decode_datawriter_submessage_init, .fini = suite_decode_datawriter_submessage_fini)
+{
+  DDS_Security_boolean result;
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  DDS_Security_DatawriterCryptoHandle local_writer_crypto;
+  DDS_Security_DatareaderCryptoHandle local_reader_crypto;
+  DDS_Security_DatawriterCryptoHandle remote_writer_crypto;
+  DDS_Security_DatareaderCryptoHandle remote_reader_crypto;
+  DDS_Security_DatareaderCryptoHandleSeq reader_list;
+  DDS_Security_OctetSeq plain_buffer = {0, 0, NULL};
+  DDS_Security_OctetSeq encoded_buffer = {0, 0, NULL};
+  DDS_Security_OctetSeq decoded_buffer = {0, 0, NULL};
+  DDS_Security_OctetSeq corrupt_buffer = {0, 0, NULL};
+  int32_t index;
+  DDS_Security_EndpointSecurityAttributes datawriter_security_attributes;
+  DDS_Security_PropertySeq datawriter_properties;
+  DDS_Security_EndpointSecurityAttributes datareader_security_attributes;
+  DDS_Security_PropertySeq datareader_properties;
+
+  CU_ASSERT_FATAL(crypto != NULL);
+  CU_ASSERT_FATAL(crypto->crypto_transform != NULL);
+  CU_ASSERT_FATAL(crypto->crypto_transform->encode_datawriter_submessage != NULL);
+  CU_ASSERT_FATAL(crypto->crypto_transform->decode_datawriter_submessage != NULL);
+
+  prepare_endpoint_security_attributes_and_properties(&datareader_security_attributes, &datareader_properties, CRYPTO_TRANSFORMATION_KIND_AES256_GCM, true);
+  prepare_endpoint_security_attributes_and_properties(&datawriter_security_attributes, &datawriter_properties, CRYPTO_TRANSFORMATION_KIND_AES256_GCM, true);
+
+  initialize_data_submessage(&plain_buffer, false);
+
+  local_writer_crypto = register_local_datawriter(&datawriter_security_attributes, &datawriter_properties);
+  CU_ASSERT_FATAL(local_writer_crypto != 0);
+
+  local_reader_crypto = register_local_datareader(&datareader_security_attributes, &datareader_properties);
+  CU_ASSERT_FATAL(local_reader_crypto != 0);
+
+  remote_reader_crypto = register_remote_datareader(local_writer_crypto);
+  CU_ASSERT_FATAL(remote_reader_crypto != 0);
+
+  remote_writer_crypto = register_remote_datawriter(local_reader_crypto);
+  CU_ASSERT_FATAL(remote_writer_crypto != 0);
+
+  result = set_remote_datawriter_tokens(local_writer_crypto, remote_reader_crypto, local_reader_crypto, remote_writer_crypto);
+  CU_ASSERT_FATAL(result);
+
+  reader_list._length = reader_list._maximum = 1;
+  reader_list._buffer = DDS_Security_DatareaderCryptoHandleSeq_allocbuf(1);
+  reader_list._buffer[0] = remote_reader_crypto;
+  index = 0;
+
+  /* Encrypt the datawriter submessage. */
+  result = crypto->crypto_transform->encode_datawriter_submessage(
+      crypto->crypto_transform,
+      &encoded_buffer,
+      &plain_buffer,
+      local_writer_crypto,
+      &reader_list,
+      &index,
+      &exception);
+
+  if (!result)
+  {
+    printf("encode_datawriter_submessage: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+
+  CU_ASSERT_FATAL(result);
+  CU_ASSERT(exception.code == 0);
+  CU_ASSERT(exception.message == NULL);
+
+  reset_exception(&exception);
+
+  /* Incorrect prefix id */
+  {
+    struct submsg_header *prefix;
+
+    memset(&corrupt_buffer, 0, sizeof(corrupt_buffer));
+    DDS_Security_OctetSeq_copy(&corrupt_buffer, &encoded_buffer);
+
+    prefix = get_submsg(corrupt_buffer._buffer, 1);
+
+    set_submsg_header(prefix, 0x15, prefix->flags, prefix->length);
+
+    result = crypto->crypto_transform->decode_datawriter_submessage(
+        crypto->crypto_transform,
+        &decoded_buffer,
+        &corrupt_buffer,
+        local_reader_crypto,
+        remote_writer_crypto,
+        &exception);
+
+    if (!result)
+    {
+      printf("decode_datawriter_submessage: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+
+    CU_ASSERT(!result);
+    CU_ASSERT(exception.code != 0);
+    CU_ASSERT(exception.message != NULL);
+
+    reset_exception(&exception);
+
+    DDS_Security_OctetSeq_deinit(&corrupt_buffer);
+  }
+
+  /* Incorrect prefix length */
+  {
+    struct submsg_header *prefix;
+
+    memset(&corrupt_buffer, 0, sizeof(corrupt_buffer));
+    DDS_Security_OctetSeq_copy(&corrupt_buffer, &encoded_buffer);
+
+    prefix = get_submsg(corrupt_buffer._buffer, 1);
+
+    set_submsg_header(prefix, prefix->id, 0, prefix->length);
+
+    result = crypto->crypto_transform->decode_datawriter_submessage(
+        crypto->crypto_transform,
+        &decoded_buffer,
+        &corrupt_buffer,
+        local_reader_crypto,
+        remote_writer_crypto,
+        &exception);
+
+    if (!result)
+    {
+      printf("decode_datawriter_submessage: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+
+    CU_ASSERT(!result);
+    CU_ASSERT(exception.code != 0);
+    CU_ASSERT(exception.message != NULL);
+
+    reset_exception(&exception);
+
+    DDS_Security_OctetSeq_deinit(&corrupt_buffer);
+  }
+
+  /* Incorrect body id */
+  {
+    struct submsg_header *body;
+
+    memset(&corrupt_buffer, 0, sizeof(corrupt_buffer));
+    DDS_Security_OctetSeq_copy(&corrupt_buffer, &encoded_buffer);
+
+    body = get_submsg(corrupt_buffer._buffer, 2);
+
+    set_submsg_header(body, 0x15, body->flags, body->length);
+
+    result = crypto->crypto_transform->decode_datawriter_submessage(
+        crypto->crypto_transform,
+        &decoded_buffer,
+        &corrupt_buffer,
+        local_reader_crypto,
+        remote_writer_crypto,
+        &exception);
+
+    if (!result)
+    {
+      printf("decode_datawriter_submessage: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+
+    CU_ASSERT(!result);
+    CU_ASSERT(exception.code != 0);
+    CU_ASSERT(exception.message != NULL);
+
+    reset_exception(&exception);
+
+    DDS_Security_OctetSeq_deinit(&corrupt_buffer);
+  }
+
+  /* Incorrect body length */
+  {
+    struct submsg_header *body;
+
+    memset(&corrupt_buffer, 0, sizeof(corrupt_buffer));
+    DDS_Security_OctetSeq_copy(&corrupt_buffer, &encoded_buffer);
+
+    body = get_submsg(corrupt_buffer._buffer, 2);
+
+    set_submsg_header(body, body->id, body->flags, 1000);
+
+    result = crypto->crypto_transform->decode_datawriter_submessage(
+        crypto->crypto_transform,
+        &decoded_buffer,
+        &corrupt_buffer,
+        local_reader_crypto,
+        remote_writer_crypto,
+        &exception);
+
+    if (!result)
+    {
+      printf("decode_datawriter_submessage: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+
+    CU_ASSERT(!result);
+    CU_ASSERT(exception.code != 0);
+    CU_ASSERT(exception.message != NULL);
+
+    reset_exception(&exception);
+
+    DDS_Security_OctetSeq_deinit(&corrupt_buffer);
+  }
+
+  /* Incorrect postfix id */
+  {
+    struct submsg_header *postfix;
+
+    memset(&corrupt_buffer, 0, sizeof(corrupt_buffer));
+    DDS_Security_OctetSeq_copy(&corrupt_buffer, &encoded_buffer);
+
+    postfix = get_submsg(corrupt_buffer._buffer, 3);
+
+    set_submsg_header(postfix, 0x15, postfix->flags, postfix->length);
+
+    result = crypto->crypto_transform->decode_datawriter_submessage(
+        crypto->crypto_transform,
+        &decoded_buffer,
+        &corrupt_buffer,
+        local_reader_crypto,
+        remote_writer_crypto,
+        &exception);
+
+    if (!result)
+    {
+      printf("decode_datawriter_submessage: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+
+    CU_ASSERT(!result);
+    CU_ASSERT(exception.code != 0);
+    CU_ASSERT(exception.message != NULL);
+
+    reset_exception(&exception);
+
+    DDS_Security_OctetSeq_deinit(&corrupt_buffer);
+  }
+
+  /* Incorrect postfix length */
+  {
+    struct submsg_header *postfix;
+
+    memset(&corrupt_buffer, 0, sizeof(corrupt_buffer));
+    DDS_Security_OctetSeq_copy(&corrupt_buffer, &encoded_buffer);
+
+    postfix = get_submsg(corrupt_buffer._buffer, 3);
+
+    set_submsg_header(postfix, postfix->id, postfix->flags, 1000);
+
+    result = crypto->crypto_transform->decode_datawriter_submessage(
+        crypto->crypto_transform,
+        &decoded_buffer,
+        &corrupt_buffer,
+        local_reader_crypto,
+        remote_writer_crypto,
+        &exception);
+
+    if (!result)
+    {
+      printf("decode_datawriter_submessage: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+
+    CU_ASSERT(!result);
+    CU_ASSERT(exception.code != 0);
+    CU_ASSERT(exception.message != NULL);
+
+    reset_exception(&exception);
+
+    DDS_Security_OctetSeq_deinit(&corrupt_buffer);
+  }
+
+  /* Incorrect postfix length */
+  {
+    struct submsg_header *postfix;
+
+    memset(&corrupt_buffer, 0, sizeof(corrupt_buffer));
+    DDS_Security_OctetSeq_copy(&corrupt_buffer, &encoded_buffer);
+
+    postfix = get_submsg(corrupt_buffer._buffer, 3);
+
+    set_submsg_header(postfix, postfix->id, postfix->flags, (uint16_t)(postfix->length - 20));
+
+    result = crypto->crypto_transform->decode_datawriter_submessage(
+        crypto->crypto_transform,
+        &decoded_buffer,
+        &corrupt_buffer,
+        local_reader_crypto,
+        remote_writer_crypto,
+        &exception);
+
+    if (!result)
+    {
+      printf("decode_datawriter_submessage: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+
+    CU_ASSERT(!result);
+    CU_ASSERT(exception.code != 0);
+    CU_ASSERT(exception.message != NULL);
+
+    reset_exception(&exception);
+
+    DDS_Security_OctetSeq_deinit(&corrupt_buffer);
+  }
+
+  /* incorrect transformation kind */
+  {
+    struct crypto_header *header;
+
+    memset(&corrupt_buffer, 0, sizeof(corrupt_buffer));
+    DDS_Security_OctetSeq_copy(&corrupt_buffer, &encoded_buffer);
+
+    header = get_crypto_header(corrupt_buffer._buffer);
+    header->transform_identifier.transformation_kind[3] = CRYPTO_TRANSFORMATION_KIND_AES256_GMAC;
+
+    result = crypto->crypto_transform->decode_datawriter_submessage(
+        crypto->crypto_transform,
+        &decoded_buffer,
+        &corrupt_buffer,
+        local_reader_crypto,
+        remote_writer_crypto,
+        &exception);
+
+    if (!result)
+    {
+      printf("decode_datawriter_submessage: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+
+    CU_ASSERT(!result);
+    CU_ASSERT(exception.code != 0);
+    CU_ASSERT(exception.message != NULL);
+
+    reset_exception(&exception);
+
+    DDS_Security_OctetSeq_deinit(&corrupt_buffer);
+  }
+
+  /* incorrect session id */
+  {
+    struct crypto_header *header;
+
+    memset(&corrupt_buffer, 0, sizeof(corrupt_buffer));
+    DDS_Security_OctetSeq_copy(&corrupt_buffer, &encoded_buffer);
+
+    header = get_crypto_header(corrupt_buffer._buffer);
+    header->session_id[0] = (unsigned char)(header->session_id[0] + 1);
+
+    result = crypto->crypto_transform->decode_datawriter_submessage(
+        crypto->crypto_transform,
+        &decoded_buffer,
+        &corrupt_buffer,
+        local_reader_crypto,
+        remote_writer_crypto,
+        &exception);
+
+    if (!result)
+    {
+      printf("decode_datawriter_submessage: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+
+    CU_ASSERT(!result);
+    CU_ASSERT(exception.code != 0);
+    CU_ASSERT(exception.message != NULL);
+
+    reset_exception(&exception);
+
+    DDS_Security_OctetSeq_deinit(&corrupt_buffer);
+  }
+
+  /* incorrect init vector suffix */
+  {
+    struct crypto_header *header;
+
+    memset(&corrupt_buffer, 0, sizeof(corrupt_buffer));
+    DDS_Security_OctetSeq_copy(&corrupt_buffer, &encoded_buffer);
+
+    header = get_crypto_header(corrupt_buffer._buffer);
+    header->init_vector_suffix[0] = (unsigned char)(header->init_vector_suffix[0] + 1);
+
+    result = crypto->crypto_transform->decode_datawriter_submessage(
+        crypto->crypto_transform,
+        &decoded_buffer,
+        &corrupt_buffer,
+        local_reader_crypto,
+        remote_writer_crypto,
+        &exception);
+
+    if (!result)
+    {
+      printf("decode_datawriter_submessage: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+
+    CU_ASSERT(!result);
+    CU_ASSERT(exception.code != 0);
+    CU_ASSERT(exception.message != NULL);
+
+    reset_exception(&exception);
+
+    DDS_Security_OctetSeq_deinit(&corrupt_buffer);
+  }
+
+  /* incorrect encoded data */
+  {
+    struct submsg_header *body;
+    unsigned char *data;
+
+    memset(&corrupt_buffer, 0, sizeof(corrupt_buffer));
+    DDS_Security_OctetSeq_copy(&corrupt_buffer, &encoded_buffer);
+
+    body = get_submsg(corrupt_buffer._buffer, 2);
+    data = (unsigned char *)(body + 1);
+    data[0] = (unsigned char)(data[0] + 1);
+
+    result = crypto->crypto_transform->decode_datawriter_submessage(
+        crypto->crypto_transform,
+        &decoded_buffer,
+        &corrupt_buffer,
+        local_reader_crypto,
+        remote_writer_crypto,
+        &exception);
+
+    if (!result)
+    {
+      printf("decode_datawriter_submessage: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+
+    CU_ASSERT(!result);
+    CU_ASSERT(exception.code != 0);
+    CU_ASSERT(exception.message != NULL);
+
+    reset_exception(&exception);
+
+    DDS_Security_OctetSeq_deinit(&corrupt_buffer);
+  }
+
+  /* footer incorrect common mac */
+  {
+    struct crypto_footer *footer;
+
+    memset(&corrupt_buffer, 0, sizeof(corrupt_buffer));
+    DDS_Security_OctetSeq_copy(&corrupt_buffer, &encoded_buffer);
+
+    footer = get_crypto_footer(corrupt_buffer._buffer);
+    footer->common_mac[0] = (unsigned char)(footer->common_mac[0] + 1);
+
+    result = crypto->crypto_transform->decode_datawriter_submessage(
+        crypto->crypto_transform,
+        &decoded_buffer,
+        &corrupt_buffer,
+        local_reader_crypto,
+        remote_writer_crypto,
+        &exception);
+
+    if (!result)
+    {
+      printf("decode_datawriter_submessage: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+
+    CU_ASSERT(!result);
+    CU_ASSERT(exception.code != 0);
+    CU_ASSERT(exception.message != NULL);
+
+    reset_exception(&exception);
+
+    DDS_Security_OctetSeq_deinit(&corrupt_buffer);
+  }
+
+  /* footer missing reader_specific mac  */
+  {
+    struct crypto_footer *footer;
+    uint32_t len;
+
+    memset(&corrupt_buffer, 0, sizeof(corrupt_buffer));
+    DDS_Security_OctetSeq_copy(&corrupt_buffer, &encoded_buffer);
+
+    footer = get_crypto_footer(corrupt_buffer._buffer);
+    len = ddsrt_bswap4u(*(uint32_t *)footer->length);
+    CU_ASSERT(len == 1);
+    memset(footer->length, 0, 4);
+
+    result = crypto->crypto_transform->decode_datawriter_submessage(
+        crypto->crypto_transform,
+        &decoded_buffer,
+        &corrupt_buffer,
+        local_reader_crypto,
+        remote_writer_crypto,
+        &exception);
+
+    if (!result)
+    {
+      printf("decode_datawriter_submessage: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+
+    CU_ASSERT(!result);
+    CU_ASSERT(exception.code != 0);
+    CU_ASSERT(exception.message != NULL);
+
+    reset_exception(&exception);
+
+    DDS_Security_OctetSeq_deinit(&corrupt_buffer);
+  }
+
+  /* footer incorrect reader_specific mac id  */
+  {
+    struct crypto_footer *footer;
+    struct receiver_specific_mac *rmac;
+    uint32_t len;
+
+    memset(&corrupt_buffer, 0, sizeof(corrupt_buffer));
+    DDS_Security_OctetSeq_copy(&corrupt_buffer, &encoded_buffer);
+
+    footer = get_crypto_footer(corrupt_buffer._buffer);
+    len = ddsrt_bswap4u(*(uint32_t *)footer->length);
+    CU_ASSERT(len == 1);
+
+    rmac = (struct receiver_specific_mac *)(footer + 1);
+    rmac->receiver_mac_key_id[0] = (unsigned char)(rmac->receiver_mac_key_id[0] + 1);
+
+    result = crypto->crypto_transform->decode_datawriter_submessage(
+        crypto->crypto_transform,
+        &decoded_buffer,
+        &corrupt_buffer,
+        local_reader_crypto,
+        remote_writer_crypto,
+        &exception);
+
+    if (!result)
+    {
+      printf("decode_datawriter_submessage: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+
+    CU_ASSERT(!result);
+    CU_ASSERT(exception.code != 0);
+    CU_ASSERT(exception.message != NULL);
+
+    reset_exception(&exception);
+
+    DDS_Security_OctetSeq_deinit(&corrupt_buffer);
+  }
+
+  /* footer incorrect reader_specific mac   */
+  {
+    struct crypto_footer *footer;
+    struct receiver_specific_mac *rmac;
+    uint32_t len;
+
+    memset(&corrupt_buffer, 0, sizeof(corrupt_buffer));
+    DDS_Security_OctetSeq_copy(&corrupt_buffer, &encoded_buffer);
+
+    footer = get_crypto_footer(corrupt_buffer._buffer);
+    len = ddsrt_bswap4u(*(uint32_t *)footer->length);
+    CU_ASSERT(len == 1);
+
+    rmac = (struct receiver_specific_mac *)(footer + 1);
+    rmac->receiver_mac[0] = (unsigned char)(rmac->receiver_mac[0] + 1);
+
+    result = crypto->crypto_transform->decode_datawriter_submessage(
+        crypto->crypto_transform,
+        &decoded_buffer,
+        &corrupt_buffer,
+        local_reader_crypto,
+        remote_writer_crypto,
+        &exception);
+
+    if (!result)
+    {
+      printf("decode_datawriter_submessage: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+
+    CU_ASSERT(!result);
+    CU_ASSERT(exception.code != 0);
+    CU_ASSERT(exception.message != NULL);
+
+    reset_exception(&exception);
+
+    DDS_Security_OctetSeq_deinit(&corrupt_buffer);
+  }
+
+  unregister_datareader(reader_list._buffer[0]);
+  reader_list._buffer[0] = 0;
+  unregister_datawriter(remote_writer_crypto);
+  unregister_datareader(local_reader_crypto);
+  unregister_datawriter(local_writer_crypto);
+
+  reset_exception(&exception);
+
+  DDS_Security_DatareaderCryptoHandleSeq_deinit(&reader_list);
+
+  DDS_Security_OctetSeq_deinit(&plain_buffer);
+  DDS_Security_OctetSeq_deinit(&corrupt_buffer);
+  DDS_Security_OctetSeq_deinit(&encoded_buffer);
+  DDS_Security_OctetSeq_deinit(&decoded_buffer);
+
+  DDS_Security_PropertySeq_deinit(&datareader_properties);
+  DDS_Security_PropertySeq_deinit(&datawriter_properties);
+}
+
+CU_Test(ddssec_builtin_decode_datawriter_submessage, volatile_sec, .init = suite_decode_datawriter_submessage_init, .fini = suite_decode_datawriter_submessage_fini)
+{
+  DDS_Security_boolean result;
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  DDS_Security_DatawriterCryptoHandle local_writer_crypto;
+  DDS_Security_DatareaderCryptoHandle local_reader_crypto;
+  DDS_Security_DatawriterCryptoHandle remote_writer_crypto;
+  DDS_Security_DatareaderCryptoHandle remote_reader_crypto;
+  DDS_Security_DatareaderCryptoHandleSeq reader_list;
+  DDS_Security_OctetSeq plain_buffer = {0, 0, NULL};
+  DDS_Security_OctetSeq encoded_buffer = {0, 0, NULL};
+  DDS_Security_OctetSeq decoded_buffer = {0, 0, NULL};
+  int32_t index;
+  DDS_Security_EndpointSecurityAttributes datawriter_security_attributes;
+  DDS_Security_PropertySeq datawriter_properties;
+  DDS_Security_EndpointSecurityAttributes datareader_security_attributes;
+  DDS_Security_PropertySeq datareader_properties;
+
+  CU_ASSERT_FATAL(crypto != NULL);
+  CU_ASSERT_FATAL(crypto->crypto_transform != NULL);
+  CU_ASSERT_FATAL(crypto->crypto_transform->encode_datawriter_submessage != NULL);
+  CU_ASSERT_FATAL(crypto->crypto_transform->decode_datawriter_submessage != NULL);
+
+  prepare_endpoint_security_attributes_and_properties(&datareader_security_attributes, NULL, CRYPTO_TRANSFORMATION_KIND_AES256_GCM, false);
+  prepare_endpoint_security_attributes_and_properties(&datawriter_security_attributes, NULL, CRYPTO_TRANSFORMATION_KIND_AES256_GCM, false);
+
+  initialize_data_submessage(&plain_buffer, false);
+
+  datareader_properties._length = datareader_properties._maximum = 1;
+  datareader_properties._buffer = DDS_Security_PropertySeq_allocbuf(1);
+  datareader_properties._buffer[0].name = ddsrt_strdup("dds.sec.builtin_endpoint_name");
+  datareader_properties._buffer[0].value = ddsrt_strdup("BuiltinParticipantVolatileMessageSecureReader");
+  datareader_properties._buffer[0].propagate = false;
+
+  datawriter_properties._length = datawriter_properties._maximum = 1;
+  datawriter_properties._buffer = DDS_Security_PropertySeq_allocbuf(1);
+  datawriter_properties._buffer[0].name = ddsrt_strdup("dds.sec.builtin_endpoint_name");
+  datawriter_properties._buffer[0].value = ddsrt_strdup("BuiltinParticipantVolatileMessageSecureWriter");
+  datawriter_properties._buffer[0].propagate = false;
+
+  local_writer_crypto =
+      crypto->crypto_key_factory->register_local_datawriter(
+          crypto->crypto_key_factory,
+          local_participant_handle,
+          &datawriter_properties,
+          &datawriter_security_attributes,
+          &exception);
+  CU_ASSERT_FATAL(local_writer_crypto != 0);
+
+  local_reader_crypto =
+      crypto->crypto_key_factory->register_local_datareader(
+          crypto->crypto_key_factory,
+          local_participant_handle,
+          &datareader_properties,
+          &datareader_security_attributes,
+          &exception);
+  CU_ASSERT_FATAL(local_reader_crypto != 0);
+
+  remote_writer_crypto =
+      crypto->crypto_key_factory->register_matched_remote_datawriter(
+          crypto->crypto_key_factory,
+          local_reader_crypto,
+          remote_participant_handle,
+          shared_secret_handle,
+          &exception);
+  CU_ASSERT_FATAL(remote_writer_crypto != 0);
+
+  remote_reader_crypto =
+      crypto->crypto_key_factory->register_matched_remote_datareader(
+          crypto->crypto_key_factory,
+          local_writer_crypto,
+          remote_participant_handle,
+          shared_secret_handle,
+          true,
+          &exception);
+  CU_ASSERT_FATAL(remote_reader_crypto != 0);
+
+  reader_list._length = reader_list._maximum = 1;
+  reader_list._buffer = DDS_Security_DatareaderCryptoHandleSeq_allocbuf(1);
+  reader_list._buffer[0] = remote_reader_crypto;
+  index = 0;
+
+  /* Encrypt the datawriter submessage. */
+  result = crypto->crypto_transform->encode_datawriter_submessage(
+      crypto->crypto_transform,
+      &encoded_buffer,
+      &plain_buffer,
+      local_writer_crypto,
+      &reader_list,
+      &index,
+      &exception);
+
+  if (!result)
+  {
+    printf("encode_datawriter_submessage: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+
+  CU_ASSERT_FATAL(result);
+  CU_ASSERT(exception.code == 0);
+  CU_ASSERT(exception.message == NULL);
+
+  reset_exception(&exception);
+
+  /* Decrypt the datawriter submessage */
+  result = crypto->crypto_transform->decode_datawriter_submessage(
+      crypto->crypto_transform,
+      &decoded_buffer,
+      &encoded_buffer,
+      local_reader_crypto,
+      remote_writer_crypto,
+      &exception);
+
+  if (!result)
+  {
+    printf("decode_datawriter_submessage: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+
+  CU_ASSERT_FATAL(result);
+  CU_ASSERT(exception.code == 0);
+  CU_ASSERT(exception.message == NULL);
+  CU_ASSERT_FATAL(decoded_buffer._length == plain_buffer._length);
+
+  reset_exception(&exception);
+
+  if (memcmp(decoded_buffer._buffer, plain_buffer._buffer, plain_buffer._length) != 0)
+  {
+    CU_FAIL("decode submessage is not equal to original");
+  }
+
+  unregister_datareader(reader_list._buffer[0]);
+  reader_list._buffer[0] = 0;
+  unregister_datawriter(remote_writer_crypto);
+  unregister_datareader(local_reader_crypto);
+  unregister_datawriter(local_writer_crypto);
+
+  reset_exception(&exception);
+
+  DDS_Security_DatareaderCryptoHandleSeq_deinit(&reader_list);
+
+  DDS_Security_OctetSeq_deinit(&plain_buffer);
+  DDS_Security_OctetSeq_deinit(&encoded_buffer);
+  DDS_Security_OctetSeq_deinit(&decoded_buffer);
+
+  DDS_Security_PropertySeq_deinit(&datawriter_properties);
+  DDS_Security_PropertySeq_deinit(&datareader_properties);
+}
+
diff --git a/src/security/builtin_plugins/tests/decode_rtps_message/src/decode_rtps_message_utests.c b/src/security/builtin_plugins/tests/decode_rtps_message/src/decode_rtps_message_utests.c
new file mode 100644
index 0000000..ea8a576
--- /dev/null
+++ b/src/security/builtin_plugins/tests/decode_rtps_message/src/decode_rtps_message_utests.c
@@ -0,0 +1,1492 @@
+/*
+ * Copyright(c) 2006 to 2019 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+#include <assert.h>
+#include <openssl/evp.h>
+#include <openssl/hmac.h>
+#include <openssl/bio.h>
+#include <openssl/err.h>
+
+#include "dds/ddsrt/bswap.h"
+#include "dds/ddsrt/endian.h"
+#include "dds/ddsrt/heap.h"
+#include "dds/ddsrt/string.h"
+#include "dds/ddsrt/types.h"
+#include "dds/ddsrt/environ.h"
+#include "dds/security/dds_security_api.h"
+#include "dds/security/core/dds_security_serialize.h"
+#include "dds/security/core/dds_security_utils.h"
+#include "dds/security/core/shared_secret.h"
+#include "CUnit/CUnit.h"
+#include "CUnit/Test.h"
+#include "common/src/loader.h"
+#include "crypto_objects.h"
+
+#define TEST_SHARED_SECRET_SIZE 32
+
+static struct plugins_hdl *plugins = NULL;
+static dds_security_cryptography *crypto = NULL;
+
+static DDS_Security_IdentityHandle local_participantA_identity = 1;
+static DDS_Security_IdentityHandle local_participantB_identity = 2;
+static DDS_Security_IdentityHandle remote_identities[] = {2, 3, 4, 5};
+
+static DDS_Security_ParticipantCryptoHandle local_participantA_crypto = 0;
+static DDS_Security_ParticipantCryptoHandle local_participantB_crypto = 0;
+static DDS_Security_ParticipantCryptoHandle remote_particpantA_crypto;
+static DDS_Security_ParticipantCryptoHandle remote_cryptos[4];
+
+static DDS_Security_SharedSecretHandleImpl *shared_secret_handle_impl = NULL;
+static DDS_Security_SharedSecretHandle shared_secret_handle;
+
+static const char *sample_test_data =
+    "ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789abcdefghijklmnopqrstuvwxyz"
+    "ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789abcdefghijklmnopqrstuvwxyz"
+    "ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789abcdefghijklmnopqrstuvwxyz"
+    "ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789abcdefghijklmnopqrstuvwxy";
+
+static const char *RTPS_HEADER = "RTPS abcdefghijklmno";
+
+struct submsg_header
+{
+  unsigned char id;
+  unsigned char flags;
+  uint16_t length;
+};
+
+struct crypto_header
+{
+  struct CryptoTransformIdentifier transform_identifier;
+  unsigned char session_id[4];
+  unsigned char init_vector_suffix[8];
+};
+
+struct crypto_footer
+{
+  unsigned char common_mac[16];
+  unsigned char length[4];
+};
+
+struct receiver_specific_mac
+{
+  DDS_Security_CryptoTransformKeyId receiver_mac_key_id;
+  unsigned char receiver_mac[CRYPTO_HMAC_SIZE];
+};
+
+static void reset_exception(DDS_Security_SecurityException *ex)
+{
+  ex->code = 0;
+  ex->minor_code = 0;
+  ddsrt_free(ex->message);
+  ex->message = NULL;
+}
+
+static void allocate_shared_secret(void)
+{
+  int32_t i;
+
+  shared_secret_handle_impl = ddsrt_malloc(sizeof(DDS_Security_SharedSecretHandleImpl));
+
+  shared_secret_handle_impl->shared_secret = ddsrt_malloc(TEST_SHARED_SECRET_SIZE * sizeof(unsigned char));
+  shared_secret_handle_impl->shared_secret_size = TEST_SHARED_SECRET_SIZE;
+
+  for (i = 0; i < shared_secret_handle_impl->shared_secret_size; i++)
+  {
+    shared_secret_handle_impl->shared_secret[i] = (unsigned char)(i % 20);
+  }
+
+  for (i = 0; i < 32; i++)
+  {
+    shared_secret_handle_impl->challenge1[i] = (unsigned char)(i % 15);
+    shared_secret_handle_impl->challenge2[i] = (unsigned char)(i % 12);
+  }
+
+  shared_secret_handle = (DDS_Security_SharedSecretHandle)shared_secret_handle_impl;
+}
+
+static void deallocate_shared_secret(void)
+{
+  ddsrt_free(shared_secret_handle_impl->shared_secret);
+  ddsrt_free(shared_secret_handle_impl);
+}
+
+static void print_octets(const char *msg, const unsigned char *data, uint32_t sz)
+{
+  uint32_t i;
+  printf("%s: ", msg);
+  for (i = 0; i < sz; i++)
+  {
+    printf("%02x", data[i]);
+  }
+  printf("\n");
+}
+
+static void prepare_participant_security_attributes_and_properties(DDS_Security_ParticipantSecurityAttributes *attributes,
+                                                                   DDS_Security_PropertySeq *properties,
+                                                                   DDS_Security_CryptoTransformKind_Enum transformation_kind,
+                                                                   bool is_origin_authenticated)
+{
+  memset(attributes, 0, sizeof(DDS_Security_EndpointSecurityAttributes));
+
+  attributes->is_discovery_protected = true;
+
+  if (properties != NULL)
+  {
+    memset(properties, 0, sizeof(DDS_Security_PropertySeq));
+    properties->_maximum = properties->_length = 1;
+    properties->_buffer = ddsrt_malloc(sizeof(DDS_Security_Property_t));
+
+    properties->_buffer[0].name = ddsrt_strdup("dds.sec.crypto.keysize");
+
+    if (transformation_kind == CRYPTO_TRANSFORMATION_KIND_AES128_GCM || transformation_kind == CRYPTO_TRANSFORMATION_KIND_AES128_GMAC)
+    {
+      properties->_buffer[0].value = ddsrt_strdup("128");
+    }
+    else
+    {
+      properties->_buffer[0].value = ddsrt_strdup("256");
+    }
+  }
+
+  switch (transformation_kind)
+  {
+  case CRYPTO_TRANSFORMATION_KIND_AES128_GCM:
+  case CRYPTO_TRANSFORMATION_KIND_AES256_GCM:
+    attributes->plugin_participant_attributes = DDS_SECURITY_PARTICIPANT_ATTRIBUTES_FLAG_IS_VALID;
+    attributes->is_rtps_protected = true;
+    attributes->plugin_participant_attributes |= DDS_SECURITY_PLUGIN_PARTICIPANT_ATTRIBUTES_FLAG_IS_RTPS_ENCRYPTED;
+    if (is_origin_authenticated)
+    {
+      attributes->plugin_participant_attributes |= DDS_SECURITY_PLUGIN_PARTICIPANT_ATTRIBUTES_FLAG_IS_RTPS_AUTHENTICATED;
+    }
+    break;
+
+  case CRYPTO_TRANSFORMATION_KIND_AES256_GMAC:
+  case CRYPTO_TRANSFORMATION_KIND_AES128_GMAC:
+    attributes->plugin_participant_attributes = DDS_SECURITY_PARTICIPANT_ATTRIBUTES_FLAG_IS_VALID;
+    attributes->is_rtps_protected = true;
+    if (is_origin_authenticated)
+    {
+      attributes->plugin_participant_attributes |= DDS_SECURITY_PLUGIN_PARTICIPANT_ATTRIBUTES_FLAG_IS_RTPS_AUTHENTICATED;
+    }
+    break;
+
+  default:
+    assert(0);
+    break;
+  }
+}
+
+static int register_local_participants(DDS_Security_ParticipantSecurityAttributes *participant_security_attributes, DDS_Security_PropertySeq *participant_properties)
+{
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  DDS_Security_PermissionsHandle participant_permissions = 3; //valid dummy value
+
+  local_participantA_crypto =
+      crypto->crypto_key_factory->register_local_participant(
+          crypto->crypto_key_factory,
+          local_participantA_identity,
+          participant_permissions,
+          participant_properties,
+          participant_security_attributes,
+          &exception);
+
+  if (local_participantA_crypto == 0)
+  {
+    printf("register_local_participant: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+
+  local_participantB_crypto =
+      crypto->crypto_key_factory->register_local_participant(
+          crypto->crypto_key_factory,
+          local_participantB_identity,
+          participant_permissions,
+          participant_properties,
+          participant_security_attributes,
+          &exception);
+
+  if (local_participantA_crypto == 0 || local_participantB_crypto == 0)
+  {
+    printf("register_local_participant: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+
+  return local_participantA_crypto && local_participantB_crypto ? 0 : -1;
+}
+
+static void unregister_local_participants(void)
+{
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  if (local_participantA_crypto)
+  {
+    crypto->crypto_key_factory->unregister_participant(crypto->crypto_key_factory, local_participantA_crypto, &exception);
+    reset_exception(&exception);
+  }
+  if (local_participantB_crypto)
+  {
+    crypto->crypto_key_factory->unregister_participant(crypto->crypto_key_factory, local_participantB_crypto, &exception);
+    reset_exception(&exception);
+  }
+}
+
+static int register_remote_participants(DDS_Security_ParticipantCryptoHandle local_id,
+                             DDS_Security_IdentityHandle remote_ids[4],
+                             DDS_Security_ParticipantCryptoHandle participant_cryptos[4])
+{
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  DDS_Security_PermissionsHandle remote_participant_permissions = 5;
+
+  unsigned i;
+  int result = 0;
+
+  for (i = 0; i < 4; ++i)
+  {
+    participant_cryptos[i] =
+        crypto->crypto_key_factory->register_matched_remote_participant(
+            crypto->crypto_key_factory,
+            local_id,
+            remote_ids[i],
+            remote_participant_permissions,
+            shared_secret_handle,
+            &exception);
+
+    if (participant_cryptos[i] == 0)
+    {
+      printf("register_matched_remote_participant: %s\n", exception.message ? exception.message : "Error message missing");
+      result = 1;
+      break;
+    }
+  }
+
+  return result;
+}
+
+static void unregister_remote_participants(void)
+{
+  unsigned i;
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  for (i = 0; i < 4; ++i)
+  {
+    if (remote_cryptos[i])
+    {
+      crypto->crypto_key_factory->unregister_participant(crypto->crypto_key_factory, remote_cryptos[i], &exception);
+      reset_exception(&exception);
+    }
+  }
+}
+
+static int register_remote_participant_for_participantB(
+    DDS_Security_ParticipantCryptoHandle local_id,
+    DDS_Security_IdentityHandle remote_identity,
+    DDS_Security_ParticipantCryptoHandle *remote_participant_crypto)
+{
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  DDS_Security_PermissionsHandle remote_participant_permissions = 5;
+
+  int result = 0;
+
+  *remote_participant_crypto = crypto->crypto_key_factory->register_matched_remote_participant(
+      crypto->crypto_key_factory, local_id, remote_identity,
+      remote_participant_permissions, shared_secret_handle, &exception);
+
+  if (*remote_participant_crypto == 0)
+  {
+    printf("register_matched_remote_participant: %s\n",
+           exception.message ? exception.message : "Error message missing");
+    result = 1;
+  }
+
+  return result;
+}
+
+static void unregister_remote_participant_of_participantB(DDS_Security_ParticipantCryptoHandle remote_participant_crypto)
+{
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  if (remote_participant_crypto)
+  {
+    crypto->crypto_key_factory->unregister_participant(crypto->crypto_key_factory, remote_participant_crypto, &exception);
+    reset_exception(&exception);
+  }
+}
+
+static void set_protection_kind(DDS_Security_ParticipantCryptoHandle participant_crypto, DDS_Security_ProtectionKind protection_kind)
+{
+  local_participant_crypto *paricipant_crypto_impl = (local_participant_crypto *)participant_crypto;
+
+  paricipant_crypto_impl->rtps_protection_kind = protection_kind;
+}
+
+static bool set_remote_participant_tokens(
+    DDS_Security_ParticipantCryptoHandle local_participantA_crypto_handle,
+    DDS_Security_ParticipantCryptoHandle remote_participantB_crypto_handle,
+    DDS_Security_ParticipantCryptoHandle local_participantB_crypto_handle,
+    DDS_Security_ParticipantCryptoHandle remote_participantA_crypto_handle)
+{
+  DDS_Security_boolean result;
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  DDS_Security_DatawriterCryptoTokenSeq tokens;
+
+  memset(&tokens, 0, sizeof(tokens));
+
+  /* Now call the function. */
+
+  result = crypto->crypto_key_exchange->create_local_participant_crypto_tokens(
+      crypto->crypto_key_exchange,
+      &tokens,
+      local_participantA_crypto_handle,
+      remote_participantB_crypto_handle,
+      &exception);
+
+  if (result)
+  {
+    result = crypto->crypto_key_exchange->set_remote_participant_crypto_tokens(
+        crypto->crypto_key_exchange,
+        local_participantB_crypto_handle,
+        remote_participantA_crypto_handle,
+        &tokens,
+        &exception);
+  }
+
+  DDS_Security_DataHolderSeq_deinit(&tokens);
+
+  return (bool)result;
+}
+
+static session_key_material * get_local_participant_session(DDS_Security_ParticipantCryptoHandle participant_crypto)
+{
+  local_participant_crypto *participant_crypto_impl = (local_participant_crypto *)participant_crypto;
+  return participant_crypto_impl->session;
+}
+
+static void suite_decode_rtps_message_init(void)
+{
+  allocate_shared_secret();
+
+  CU_ASSERT_FATAL ((plugins = load_plugins(
+                      NULL    /* Access Control */,
+                      NULL    /* Authentication */,
+                      &crypto /* Cryptograpy    */)) != NULL);
+}
+
+static void suite_decode_rtps_message_fini(void)
+{
+  deallocate_shared_secret();
+  unload_plugins(plugins);
+}
+
+static void initialize_rtps_message(DDS_Security_OctetSeq *submsg, bool be)
+{
+  size_t length = strlen(sample_test_data) + 1;
+  struct submsg_header *header;
+  int swap;
+  unsigned char *buffer, *ptr;
+
+  if (be)
+    swap = (DDSRT_ENDIAN == DDSRT_LITTLE_ENDIAN);
+  else
+    swap = (DDSRT_ENDIAN != DDSRT_LITTLE_ENDIAN);
+
+  buffer = ddsrt_malloc(length + 20 + sizeof(struct submsg_header));
+  memcpy(buffer, RTPS_HEADER, 20);
+
+  header = (struct submsg_header *)(buffer + 20);
+  header->id = 0x15;
+  header->flags = be ? 0x00 : 0x01;
+  header->length = swap ? ddsrt_bswap2u((uint16_t)length) : (uint16_t)length;
+
+  ptr = (unsigned char *)(header + 1);
+  memcpy((char *)ptr, sample_test_data, length);
+
+  submsg->_length = submsg->_maximum = (uint32_t)(20 + length + sizeof(struct submsg_header));
+  submsg->_buffer = buffer;
+}
+
+static void set_submsg_header(struct submsg_header *submsg, unsigned char id, unsigned char flags, uint16_t length)
+{
+  submsg->id = id;
+  submsg->flags = flags;
+  submsg->length = length;
+}
+
+static struct submsg_header * get_submsg(unsigned char *data, int num)
+{
+  struct submsg_header *submsg;
+  int i;
+
+  submsg = (struct submsg_header *)data;
+  for (i = 0; i < num - 1; i++)
+  {
+    uint32_t hlen = submsg->length;
+    data += sizeof(struct submsg_header) + hlen;
+    submsg = (struct submsg_header *)data;
+  }
+
+  return submsg;
+}
+
+static struct crypto_header * get_crypto_header(unsigned char *data)
+{
+  return (struct crypto_header *)(data + sizeof(struct submsg_header));
+}
+
+static struct crypto_footer * get_crypto_footer(unsigned char *data)
+{
+  struct submsg_header *submsg;
+  submsg = get_submsg(data + 20, 3);
+  return (struct crypto_footer *)(submsg + 1);
+}
+
+static void decode_rtps_message_not_authenticated(DDS_Security_CryptoTransformKind_Enum transformation_kind, uint32_t key_size)
+{
+  DDS_Security_boolean result;
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  DDS_Security_DatareaderCryptoHandleSeq reader_list;
+  session_key_material *session_keys;
+  DDS_Security_OctetSeq plain_buffer;
+  DDS_Security_OctetSeq encoded_buffer;
+  DDS_Security_OctetSeq decoded_buffer;
+  int32_t index;
+  DDS_Security_ParticipantSecurityAttributes attributes;
+  DDS_Security_PropertySeq properties;
+
+  CU_ASSERT_FATAL(crypto != NULL);
+  CU_ASSERT_FATAL(crypto->crypto_transform != NULL);
+  CU_ASSERT_FATAL(crypto->crypto_transform->encode_rtps_message != NULL);
+  CU_ASSERT_FATAL(crypto->crypto_transform->decode_rtps_message != NULL);
+
+  prepare_participant_security_attributes_and_properties(&attributes, &properties, transformation_kind, true);
+  register_local_participants(&attributes, &properties);
+
+  initialize_rtps_message(&plain_buffer, false);
+
+  session_keys = get_local_participant_session(local_participantA_crypto);
+  session_keys->master_key_material->transformation_kind = transformation_kind;
+  session_keys->key_size = key_size;
+
+  register_remote_participants(local_participantA_crypto, remote_identities, remote_cryptos);
+
+  /* Now remote participant cypto is in remote_cryptos[0] */
+
+  register_remote_participant_for_participantB(local_participantB_crypto, local_participantA_identity, &remote_particpantA_crypto);
+
+  result = set_remote_participant_tokens(local_participantA_crypto, remote_cryptos[0], local_participantB_crypto, remote_particpantA_crypto);
+  CU_ASSERT_FATAL(result);
+
+  reader_list._length = reader_list._maximum = 1;
+  reader_list._buffer = DDS_Security_ParticipantCryptoHandleSeq_allocbuf(1);
+  reader_list._buffer[0] = remote_cryptos[0];
+  index = 0;
+
+  /* Encrypt the datawriter submessage. */
+  result = crypto->crypto_transform->encode_rtps_message(
+      crypto->crypto_transform,
+      &encoded_buffer,
+      &plain_buffer,
+      local_participantA_crypto,
+      &reader_list,
+      &index,
+      &exception);
+
+  if (!result)
+  {
+    printf("encode_rtps_message: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+
+  CU_ASSERT_FATAL(result);
+  CU_ASSERT(exception.code == 0);
+  CU_ASSERT(exception.message == NULL);
+
+  reset_exception(&exception);
+
+  /* Decrypt the datawriter submessage */
+  result = crypto->crypto_transform->decode_rtps_message(
+      crypto->crypto_transform,
+      &decoded_buffer,
+      &encoded_buffer,
+      local_participantB_crypto,
+      remote_particpantA_crypto,
+      &exception);
+
+  if (!result)
+  {
+    printf("decode_rtps_message: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+
+  CU_ASSERT_FATAL(result);
+  CU_ASSERT(exception.code == 0);
+  CU_ASSERT(exception.message == NULL);
+  CU_ASSERT_FATAL(decoded_buffer._length == plain_buffer._length);
+
+  reset_exception(&exception);
+
+  if (memcmp(decoded_buffer._buffer, plain_buffer._buffer, plain_buffer._length) != 0)
+  {
+    CU_FAIL("decode submessage is not equal to original");
+    print_octets("decoded_buffer", decoded_buffer._buffer, plain_buffer._length);
+    print_octets("plain_buffer", plain_buffer._buffer, plain_buffer._length);
+  }
+
+  unregister_remote_participant_of_participantB(remote_particpantA_crypto);
+  unregister_remote_participants();
+  reset_exception(&exception);
+
+  DDS_Security_OctetSeq_deinit((&plain_buffer));
+  DDS_Security_OctetSeq_deinit((&decoded_buffer));
+  DDS_Security_OctetSeq_deinit((&encoded_buffer));
+  DDS_Security_DatareaderCryptoHandleSeq_deinit(&reader_list);
+  DDS_Security_PropertySeq_deinit(&properties);
+
+  unregister_local_participants();
+}
+
+CU_Test(ddssec_builtin_decode_rtps_message, encoded_256, .init = suite_decode_rtps_message_init, .fini = suite_decode_rtps_message_fini)
+{
+  decode_rtps_message_not_authenticated(CRYPTO_TRANSFORMATION_KIND_AES256_GCM, 256);
+}
+
+CU_Test(ddssec_builtin_decode_rtps_message, encoded_128, .init = suite_decode_rtps_message_init, .fini = suite_decode_rtps_message_fini)
+{
+  decode_rtps_message_not_authenticated(CRYPTO_TRANSFORMATION_KIND_AES128_GCM, 128);
+}
+
+CU_Test(ddssec_builtin_decode_rtps_message, not_encrypted_256, .init = suite_decode_rtps_message_init, .fini = suite_decode_rtps_message_fini)
+{
+  decode_rtps_message_not_authenticated(CRYPTO_TRANSFORMATION_KIND_AES256_GMAC, 256);
+}
+
+CU_Test(ddssec_builtin_decode_rtps_message, not_encrypted_128, .init = suite_decode_rtps_message_init, .fini = suite_decode_rtps_message_fini)
+{
+  decode_rtps_message_not_authenticated(CRYPTO_TRANSFORMATION_KIND_AES128_GMAC, 128);
+}
+
+static void decode_rtps_message_authenticated(DDS_Security_CryptoTransformKind_Enum transformation_kind, uint32_t key_size, DDS_Security_ProtectionKind protection_kind)
+{
+  DDS_Security_boolean result;
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  DDS_Security_ParticipantCryptoHandleSeq remote_reader_list;
+  session_key_material *session_keys;
+  DDS_Security_OctetSeq plain_buffer = {0, 0, NULL};
+  DDS_Security_OctetSeq encoded_buffer = {0, 0, NULL};
+  DDS_Security_OctetSeq decoded_buffer = {0, 0, NULL};
+  DDS_Security_OctetSeq *buffer;
+  DDS_Security_ParticipantSecurityAttributes attributes;
+  DDS_Security_PropertySeq properties;
+  int i, index;
+
+  CU_ASSERT_FATAL(crypto != NULL);
+  CU_ASSERT_FATAL(crypto->crypto_transform != NULL);
+  CU_ASSERT_FATAL(crypto->crypto_transform->encode_rtps_message != NULL);
+  CU_ASSERT_FATAL(crypto->crypto_transform->decode_rtps_message != NULL);
+
+  prepare_participant_security_attributes_and_properties(&attributes, &properties, transformation_kind, true);
+  register_local_participants(&attributes, &properties);
+
+  initialize_rtps_message(&plain_buffer, false);
+
+  session_keys = get_local_participant_session(local_participantA_crypto);
+  session_keys->master_key_material->transformation_kind = transformation_kind;
+  session_keys->key_size = key_size;
+
+  set_protection_kind(local_participantA_crypto, protection_kind);
+
+  register_remote_participants(local_participantA_crypto, remote_identities, remote_cryptos);
+
+  set_protection_kind(local_participantB_crypto, protection_kind);
+
+  register_remote_participant_for_participantB(local_participantB_crypto, local_participantA_identity, &remote_particpantA_crypto);
+
+  result = set_remote_participant_tokens(local_participantA_crypto, remote_cryptos[0], local_participantB_crypto, remote_particpantA_crypto);
+  CU_ASSERT_FATAL(result);
+
+  remote_reader_list._length = remote_reader_list._maximum = 4;
+  remote_reader_list._buffer = DDS_Security_ParticipantCryptoHandleSeq_allocbuf(4);
+
+  for (i = 0; i < 4; i++)
+  {
+    remote_reader_list._buffer[i] = remote_cryptos[i];
+  }
+
+  index = 0;
+
+  /* Encrypt the datawriter submessage. */
+  buffer = &plain_buffer;
+  while (index != 4)
+  {
+    result = crypto->crypto_transform->encode_rtps_message(
+        crypto->crypto_transform,
+        &encoded_buffer,
+        buffer,
+        local_participantA_crypto,
+        &remote_reader_list,
+        &index,
+        &exception);
+
+    if (!result)
+    {
+      printf("encode_rtps_message: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+
+    CU_ASSERT_FATAL(result);
+    CU_ASSERT(exception.code == 0);
+    CU_ASSERT(exception.message == NULL);
+
+    reset_exception(&exception);
+    buffer = NULL;
+  }
+
+  /* Decrypt the datawriter submessage */
+
+  for (i = 0; i < 4; i++)
+  {
+    result = crypto->crypto_transform->decode_rtps_message(
+        crypto->crypto_transform,
+        &decoded_buffer,
+        &encoded_buffer,
+        local_participantB_crypto,
+        remote_particpantA_crypto,
+        &exception);
+
+    if (!result)
+    {
+      printf("decode_rtps_message: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+
+    CU_ASSERT_FATAL(result);
+    CU_ASSERT(exception.code == 0);
+    CU_ASSERT(exception.message == NULL);
+    CU_ASSERT_FATAL(decoded_buffer._length == plain_buffer._length);
+
+    if (memcmp(decoded_buffer._buffer, plain_buffer._buffer, plain_buffer._length) != 0)
+    {
+      CU_FAIL("decode submessage is not equal to original");
+      print_octets("decoded_buffer", decoded_buffer._buffer, plain_buffer._length);
+      print_octets("plain_buffer", plain_buffer._buffer, plain_buffer._length);
+    }
+
+    reset_exception(&exception);
+    DDS_Security_OctetSeq_deinit((&decoded_buffer));
+  }
+
+  unregister_remote_participant_of_participantB(remote_particpantA_crypto);
+  unregister_remote_participants();
+  reset_exception(&exception);
+
+  DDS_Security_PropertySeq_deinit(&properties);
+  DDS_Security_OctetSeq_deinit((&plain_buffer));
+  DDS_Security_OctetSeq_deinit((&encoded_buffer));
+  DDS_Security_DatareaderCryptoHandleSeq_deinit(&remote_reader_list);
+}
+
+CU_Test(ddssec_builtin_decode_rtps_message, authenticated_256, .init = suite_decode_rtps_message_init, .fini = suite_decode_rtps_message_fini)
+{
+  decode_rtps_message_authenticated(CRYPTO_TRANSFORMATION_KIND_AES256_GCM, 256, DDS_SECURITY_PROTECTION_KIND_ENCRYPT_WITH_ORIGIN_AUTHENTICATION);
+}
+
+CU_Test(ddssec_builtin_decode_rtps_message, authenticated_128, .init = suite_decode_rtps_message_init, .fini = suite_decode_rtps_message_fini)
+{
+  decode_rtps_message_authenticated(CRYPTO_TRANSFORMATION_KIND_AES128_GCM, 128, DDS_SECURITY_PROTECTION_KIND_ENCRYPT_WITH_ORIGIN_AUTHENTICATION);
+}
+
+CU_Test(ddssec_builtin_decode_rtps_message, only_authenticated_256, .init = suite_decode_rtps_message_init, .fini = suite_decode_rtps_message_fini)
+{
+  decode_rtps_message_authenticated(CRYPTO_TRANSFORMATION_KIND_AES256_GMAC, 256, DDS_SECURITY_PROTECTION_KIND_SIGN_WITH_ORIGIN_AUTHENTICATION);
+}
+
+CU_Test(ddssec_builtin_decode_rtps_message, only_authenticated_128, .init = suite_decode_rtps_message_init, .fini = suite_decode_rtps_message_fini)
+{
+  decode_rtps_message_authenticated(CRYPTO_TRANSFORMATION_KIND_AES128_GMAC, 128, DDS_SECURITY_PROTECTION_KIND_SIGN_WITH_ORIGIN_AUTHENTICATION);
+}
+
+CU_Test(ddssec_builtin_decode_rtps_message, invalid_args, .init = suite_decode_rtps_message_init, .fini = suite_decode_rtps_message_fini)
+{
+  DDS_Security_boolean result;
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  DDS_Security_DatareaderCryptoHandleSeq reader_list;
+  DDS_Security_OctetSeq plain_buffer = {0, 0, NULL};
+  DDS_Security_OctetSeq empty_buffer = {0, 0, NULL};
+  DDS_Security_OctetSeq encoded_buffer = {0, 0, NULL};
+  DDS_Security_OctetSeq decoded_buffer = {0, 0, NULL};
+  int32_t index;
+  DDS_Security_ParticipantSecurityAttributes attributes;
+  DDS_Security_PropertySeq properties;
+
+  CU_ASSERT_FATAL(crypto != NULL);
+  CU_ASSERT_FATAL(crypto->crypto_transform != NULL);
+  CU_ASSERT_FATAL(crypto->crypto_transform->encode_rtps_message != NULL);
+  CU_ASSERT_FATAL(crypto->crypto_transform->decode_rtps_message != NULL);
+
+  prepare_participant_security_attributes_and_properties(&attributes, &properties, CRYPTO_TRANSFORMATION_KIND_AES256_GMAC, false);
+  register_local_participants(&attributes, &properties);
+
+  initialize_rtps_message(&plain_buffer, false);
+
+  register_remote_participants(local_participantA_crypto, remote_identities, remote_cryptos);
+
+  /* Now remote participant cypto is in remote_cryptos[0] */
+
+  register_remote_participant_for_participantB(local_participantB_crypto, local_participantA_identity, &remote_particpantA_crypto);
+
+  result = set_remote_participant_tokens(local_participantA_crypto, remote_cryptos[0], local_participantB_crypto, remote_particpantA_crypto);
+  CU_ASSERT_FATAL(result);
+
+  reader_list._length = reader_list._maximum = 1;
+  reader_list._buffer = DDS_Security_ParticipantCryptoHandleSeq_allocbuf(1);
+  reader_list._buffer[0] = remote_cryptos[0];
+  index = 0;
+
+  /* Encrypt */
+  result = crypto->crypto_transform->encode_rtps_message(
+      crypto->crypto_transform,
+      &encoded_buffer,
+      &plain_buffer,
+      local_participantA_crypto,
+      &reader_list,
+      &index,
+      &exception);
+
+  if (!result)
+  {
+    printf("encode_rtps_message: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+
+  CU_ASSERT_FATAL(result);
+  CU_ASSERT(exception.code == 0);
+  CU_ASSERT(exception.message == NULL);
+
+  reset_exception(&exception);
+
+  /* decoded buffer NULL */
+  result = crypto->crypto_transform->decode_rtps_message(
+      crypto->crypto_transform,
+      NULL,
+      &encoded_buffer,
+      local_participantB_crypto,
+      remote_particpantA_crypto,
+      &exception);
+
+  if (!result)
+  {
+    printf("decode_rtps_message: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+
+  CU_ASSERT(!result);
+  CU_ASSERT(exception.code != 0);
+  CU_ASSERT(exception.message != NULL);
+
+  reset_exception(&exception);
+
+  /* encoded buffer NULL */
+  result = crypto->crypto_transform->decode_rtps_message(
+      crypto->crypto_transform,
+      &decoded_buffer,
+      NULL,
+      local_participantB_crypto,
+      remote_particpantA_crypto,
+      &exception);
+
+  if (!result)
+  {
+    printf("decode_rtps_message: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+
+  CU_ASSERT(!result);
+  CU_ASSERT(exception.code != 0);
+  CU_ASSERT(exception.message != NULL);
+
+  reset_exception(&exception);
+
+  /* empty encoded buffer */
+  result = crypto->crypto_transform->decode_rtps_message(
+      crypto->crypto_transform,
+      &decoded_buffer,
+      &empty_buffer,
+      local_participantB_crypto,
+      remote_particpantA_crypto,
+      &exception);
+
+  if (!result)
+  {
+    printf("decode_rtps_message: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+
+  CU_ASSERT(!result);
+  CU_ASSERT(exception.code != 0);
+  CU_ASSERT(exception.message != NULL);
+
+  reset_exception(&exception);
+
+  /* local reader crypto 0 */
+  result = crypto->crypto_transform->decode_rtps_message(
+      crypto->crypto_transform,
+      &decoded_buffer,
+      &encoded_buffer,
+      0,
+      remote_particpantA_crypto,
+      &exception);
+
+  if (!result)
+  {
+    printf("decode_rtps_message: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+
+  CU_ASSERT(!result);
+  CU_ASSERT(exception.code != 0);
+  CU_ASSERT(exception.message != NULL);
+
+  reset_exception(&exception);
+
+  /* local reader crypto unknown */
+  result = crypto->crypto_transform->decode_rtps_message(
+      crypto->crypto_transform,
+      &decoded_buffer,
+      &encoded_buffer,
+      1,
+      remote_particpantA_crypto,
+      &exception);
+
+  if (!result)
+  {
+    printf("decode_rtps_message: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+
+  CU_ASSERT(!result);
+  CU_ASSERT(exception.code != 0);
+  CU_ASSERT(exception.message != NULL);
+
+  reset_exception(&exception);
+
+  /* remote writer crypto 0 */
+  result = crypto->crypto_transform->decode_rtps_message(
+      crypto->crypto_transform,
+      &decoded_buffer,
+      &encoded_buffer,
+      local_participantB_crypto,
+      0,
+      &exception);
+
+  if (!result)
+  {
+    printf("decode_rtps_message: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+
+  CU_ASSERT(!result);
+  CU_ASSERT(exception.code != 0);
+  CU_ASSERT(exception.message != NULL);
+
+  reset_exception(&exception);
+
+  /* remote writer crypto unknown */
+  result = crypto->crypto_transform->decode_rtps_message(
+      crypto->crypto_transform,
+      &decoded_buffer,
+      &encoded_buffer,
+      local_participantB_crypto,
+      1,
+      &exception);
+
+  if (!result)
+  {
+    printf("decode_rtps_message: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+
+  CU_ASSERT(!result);
+  CU_ASSERT(exception.code != 0);
+  CU_ASSERT(exception.message != NULL);
+
+  unregister_remote_participant_of_participantB(remote_particpantA_crypto);
+  unregister_remote_participants();
+  reset_exception(&exception);
+
+  DDS_Security_OctetSeq_deinit((&plain_buffer));
+  DDS_Security_OctetSeq_deinit((&encoded_buffer));
+  DDS_Security_DatareaderCryptoHandleSeq_deinit(&reader_list);
+  DDS_Security_PropertySeq_deinit(&properties);
+  unregister_local_participants();
+}
+
+CU_Test(ddssec_builtin_decode_rtps_message, invalid_data, .init = suite_decode_rtps_message_init, .fini = suite_decode_rtps_message_fini)
+{
+  DDS_Security_boolean result;
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  DDS_Security_DatareaderCryptoHandleSeq reader_list;
+  DDS_Security_OctetSeq plain_buffer = {0, 0, NULL};
+  DDS_Security_OctetSeq encoded_buffer = {0, 0, NULL};
+  DDS_Security_OctetSeq decoded_buffer = {0, 0, NULL};
+  DDS_Security_OctetSeq corrupt_buffer = {0, 0, NULL};
+  session_key_material *session_keys;
+  int32_t index;
+  DDS_Security_ParticipantSecurityAttributes attributes;
+  DDS_Security_PropertySeq properties;
+
+  CU_ASSERT_FATAL(crypto != NULL);
+  CU_ASSERT_FATAL(crypto->crypto_transform != NULL);
+  CU_ASSERT_FATAL(crypto->crypto_transform->encode_rtps_message != NULL);
+  CU_ASSERT_FATAL(crypto->crypto_transform->decode_rtps_message != NULL);
+
+  prepare_participant_security_attributes_and_properties(&attributes, &properties, CRYPTO_TRANSFORMATION_KIND_AES256_GMAC, false);
+  register_local_participants(&attributes, &properties);
+  initialize_rtps_message(&plain_buffer, false);
+
+  session_keys = get_local_participant_session(local_participantA_crypto);
+  session_keys->master_key_material->transformation_kind = CRYPTO_TRANSFORMATION_KIND_AES256_GCM;
+  session_keys->key_size = 256;
+
+  set_protection_kind(local_participantA_crypto, DDS_SECURITY_PROTECTION_KIND_ENCRYPT_WITH_ORIGIN_AUTHENTICATION);
+
+  register_remote_participants(local_participantA_crypto, remote_identities, remote_cryptos);
+
+  set_protection_kind(local_participantB_crypto, DDS_SECURITY_PROTECTION_KIND_ENCRYPT_WITH_ORIGIN_AUTHENTICATION);
+
+  register_remote_participant_for_participantB(local_participantB_crypto, local_participantA_identity, &remote_particpantA_crypto);
+
+  result = set_remote_participant_tokens(local_participantA_crypto, remote_cryptos[0], local_participantB_crypto, remote_particpantA_crypto);
+  CU_ASSERT_FATAL(result);
+
+  reader_list._length = reader_list._maximum = 1;
+  reader_list._buffer = DDS_Security_ParticipantCryptoHandleSeq_allocbuf(1);
+  reader_list._buffer[0] = remote_cryptos[0];
+  index = 0;
+
+  /* Encrypt the datawriter submessage. */
+  result = crypto->crypto_transform->encode_rtps_message(
+      crypto->crypto_transform,
+      &encoded_buffer,
+      &plain_buffer,
+      local_participantA_crypto,
+      &reader_list,
+      &index,
+      &exception);
+
+  if (!result)
+  {
+    printf("encode_rtps_message: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+
+  CU_ASSERT_FATAL(result);
+  CU_ASSERT(exception.code == 0);
+  CU_ASSERT(exception.message == NULL);
+
+  reset_exception(&exception);
+
+  /* Incorrect prefix id */
+  {
+    struct submsg_header *prefix;
+
+    memset(&corrupt_buffer, 0, sizeof(corrupt_buffer));
+    DDS_Security_OctetSeq_copy(&corrupt_buffer, &encoded_buffer);
+
+    prefix = get_submsg(corrupt_buffer._buffer + 20, 1);
+
+    set_submsg_header(prefix, 0x15, prefix->flags, prefix->length);
+
+    result = crypto->crypto_transform->decode_rtps_message(
+        crypto->crypto_transform,
+        &decoded_buffer,
+        &corrupt_buffer,
+        local_participantB_crypto,
+        remote_particpantA_crypto,
+        &exception);
+
+    if (!result)
+    {
+      printf("decode_rtps_message: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+
+    CU_ASSERT(!result);
+    CU_ASSERT(exception.code != 0);
+    CU_ASSERT(exception.message != NULL);
+
+    reset_exception(&exception);
+
+    DDS_Security_OctetSeq_deinit(&corrupt_buffer);
+  }
+
+  /* Incorrect prefix length */
+  {
+    struct submsg_header *prefix;
+
+    memset(&corrupt_buffer, 0, sizeof(corrupt_buffer));
+    DDS_Security_OctetSeq_copy(&corrupt_buffer, &encoded_buffer);
+
+    prefix = get_submsg(corrupt_buffer._buffer + 20, 1);
+
+    set_submsg_header(prefix, prefix->id, 0, prefix->length);
+
+    result = crypto->crypto_transform->decode_rtps_message(
+        crypto->crypto_transform,
+        &decoded_buffer,
+        &corrupt_buffer,
+        local_participantB_crypto,
+        remote_particpantA_crypto,
+        &exception);
+
+    if (!result)
+    {
+      printf("decode_rtps_message: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+
+    CU_ASSERT(!result);
+    CU_ASSERT(exception.code != 0);
+    CU_ASSERT(exception.message != NULL);
+
+    reset_exception(&exception);
+
+    DDS_Security_OctetSeq_deinit(&corrupt_buffer);
+  }
+
+  /* Incorrect body id */
+  {
+    struct submsg_header *body;
+
+    memset(&corrupt_buffer, 0, sizeof(corrupt_buffer));
+    DDS_Security_OctetSeq_copy(&corrupt_buffer, &encoded_buffer);
+
+    body = get_submsg(corrupt_buffer._buffer + 20, 2);
+
+    set_submsg_header(body, 0x15, body->flags, body->length);
+
+    result = crypto->crypto_transform->decode_rtps_message(
+        crypto->crypto_transform,
+        &decoded_buffer,
+        &corrupt_buffer,
+        local_participantB_crypto,
+        remote_particpantA_crypto,
+        &exception);
+
+    if (!result)
+    {
+      printf("decode_rtps_message: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+
+    CU_ASSERT(!result);
+    CU_ASSERT(exception.code != 0);
+    CU_ASSERT(exception.message != NULL);
+
+    reset_exception(&exception);
+
+    DDS_Security_OctetSeq_deinit(&corrupt_buffer);
+  }
+
+  /* Incorrect body length */
+  {
+    struct submsg_header *body;
+
+    memset(&corrupt_buffer, 0, sizeof(corrupt_buffer));
+    DDS_Security_OctetSeq_copy(&corrupt_buffer, &encoded_buffer);
+
+    body = get_submsg(corrupt_buffer._buffer + 20, 2);
+
+    set_submsg_header(body, body->id, body->flags, 1000);
+
+    result = crypto->crypto_transform->decode_rtps_message(
+        crypto->crypto_transform,
+        &decoded_buffer,
+        &corrupt_buffer,
+        local_participantB_crypto,
+        remote_particpantA_crypto,
+        &exception);
+
+    if (!result)
+    {
+      printf("decode_rtps_message: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+
+    CU_ASSERT(!result);
+    CU_ASSERT(exception.code != 0);
+    CU_ASSERT(exception.message != NULL);
+
+    reset_exception(&exception);
+
+    DDS_Security_OctetSeq_deinit(&corrupt_buffer);
+  }
+
+  /* Incorrect postfix id */
+  {
+    struct submsg_header *postfix;
+
+    memset(&corrupt_buffer, 0, sizeof(corrupt_buffer));
+    DDS_Security_OctetSeq_copy(&corrupt_buffer, &encoded_buffer);
+
+    postfix = get_submsg(corrupt_buffer._buffer + 20, 3);
+
+    set_submsg_header(postfix, 0x15, postfix->flags, postfix->length);
+
+    result = crypto->crypto_transform->decode_rtps_message(
+        crypto->crypto_transform,
+        &decoded_buffer,
+        &corrupt_buffer,
+        local_participantB_crypto,
+        remote_particpantA_crypto,
+        &exception);
+
+    if (!result)
+    {
+      printf("decode_rtps_message: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+
+    CU_ASSERT(!result);
+    CU_ASSERT(exception.code != 0);
+    CU_ASSERT(exception.message != NULL);
+
+    reset_exception(&exception);
+
+    DDS_Security_OctetSeq_deinit(&corrupt_buffer);
+  }
+
+  /* Incorrect postfix length */
+  {
+    struct submsg_header *postfix;
+
+    memset(&corrupt_buffer, 0, sizeof(corrupt_buffer));
+    DDS_Security_OctetSeq_copy(&corrupt_buffer, &encoded_buffer);
+
+    postfix = get_submsg(corrupt_buffer._buffer + 20, 3);
+
+    set_submsg_header(postfix, postfix->id, postfix->flags, 1000);
+
+    result = crypto->crypto_transform->decode_rtps_message(
+        crypto->crypto_transform,
+        &decoded_buffer,
+        &corrupt_buffer,
+        local_participantB_crypto,
+        remote_particpantA_crypto,
+        &exception);
+
+    if (!result)
+    {
+      printf("decode_rtps_message: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+
+    CU_ASSERT(!result);
+    CU_ASSERT(exception.code != 0);
+    CU_ASSERT(exception.message != NULL);
+
+    reset_exception(&exception);
+
+    DDS_Security_OctetSeq_deinit(&corrupt_buffer);
+  }
+
+  /* Incorrect postfix length */
+  {
+    struct submsg_header *postfix;
+
+    memset(&corrupt_buffer, 0, sizeof(corrupt_buffer));
+    DDS_Security_OctetSeq_copy(&corrupt_buffer, &encoded_buffer);
+
+    postfix = get_submsg(corrupt_buffer._buffer + 20, 3);
+
+    set_submsg_header(postfix, postfix->id, postfix->flags, (uint16_t)(postfix->length - 20));
+
+    result = crypto->crypto_transform->decode_rtps_message(
+        crypto->crypto_transform,
+        &decoded_buffer,
+        &corrupt_buffer,
+        local_participantB_crypto,
+        remote_particpantA_crypto,
+        &exception);
+
+    if (!result)
+    {
+      printf("decode_rtps_message: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+
+    CU_ASSERT(!result);
+    CU_ASSERT(exception.code != 0);
+    CU_ASSERT(exception.message != NULL);
+
+    reset_exception(&exception);
+
+    DDS_Security_OctetSeq_deinit(&corrupt_buffer);
+  }
+
+  /* incorrect transformation kind */
+  {
+    struct crypto_header *header;
+
+    memset(&corrupt_buffer, 0, sizeof(corrupt_buffer));
+    DDS_Security_OctetSeq_copy(&corrupt_buffer, &encoded_buffer);
+
+    header = get_crypto_header(corrupt_buffer._buffer + 20);
+    header->transform_identifier.transformation_kind[3] = CRYPTO_TRANSFORMATION_KIND_AES256_GMAC;
+
+    result = crypto->crypto_transform->decode_rtps_message(
+        crypto->crypto_transform,
+        &decoded_buffer,
+        &corrupt_buffer,
+        local_participantB_crypto,
+        remote_particpantA_crypto,
+        &exception);
+
+    if (!result)
+    {
+      printf("decode_rtps_message: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+
+    CU_ASSERT(!result);
+    CU_ASSERT(exception.code != 0);
+    CU_ASSERT(exception.message != NULL);
+
+    reset_exception(&exception);
+
+    DDS_Security_OctetSeq_deinit(&corrupt_buffer);
+  }
+
+  /* incorrect session id */
+  {
+    struct crypto_header *header;
+
+    memset(&corrupt_buffer, 0, sizeof(corrupt_buffer));
+    DDS_Security_OctetSeq_copy(&corrupt_buffer, &encoded_buffer);
+
+    header = get_crypto_header(corrupt_buffer._buffer + 20);
+    header->session_id[0] = (unsigned char)(header->session_id[0] + 1);
+
+    result = crypto->crypto_transform->decode_rtps_message(
+        crypto->crypto_transform,
+        &decoded_buffer,
+        &corrupt_buffer,
+        local_participantB_crypto,
+        remote_particpantA_crypto,
+        &exception);
+
+    if (!result)
+    {
+      printf("decode_rtps_message: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+
+    CU_ASSERT(!result);
+    CU_ASSERT(exception.code != 0);
+    CU_ASSERT(exception.message != NULL);
+
+    reset_exception(&exception);
+
+    DDS_Security_OctetSeq_deinit(&corrupt_buffer);
+  }
+
+  /* incorrect init vector suffix */
+  {
+    struct crypto_header *header;
+
+    memset(&corrupt_buffer, 0, sizeof(corrupt_buffer));
+    DDS_Security_OctetSeq_copy(&corrupt_buffer, &encoded_buffer);
+
+    header = get_crypto_header(corrupt_buffer._buffer + 20);
+    header->init_vector_suffix[0] = (unsigned char)(header->init_vector_suffix[0] + 1);
+
+    result = crypto->crypto_transform->decode_rtps_message(
+        crypto->crypto_transform,
+        &decoded_buffer,
+        &corrupt_buffer,
+        local_participantB_crypto,
+        remote_particpantA_crypto,
+        &exception);
+
+    if (!result)
+    {
+      printf("decode_rtps_message: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+
+    CU_ASSERT(!result);
+    CU_ASSERT(exception.code != 0);
+    CU_ASSERT(exception.message != NULL);
+
+    reset_exception(&exception);
+
+    DDS_Security_OctetSeq_deinit(&corrupt_buffer);
+  }
+
+  /* incorrect encoded data */
+  {
+    struct submsg_header *body;
+    unsigned char *data;
+
+    memset(&corrupt_buffer, 0, sizeof(corrupt_buffer));
+    DDS_Security_OctetSeq_copy(&corrupt_buffer, &encoded_buffer);
+
+    body = get_submsg(corrupt_buffer._buffer + 20, 2);
+    data = (unsigned char *)(body + 1);
+    data[0] = (unsigned char)(data[0] + 1);
+
+    result = crypto->crypto_transform->decode_rtps_message(
+        crypto->crypto_transform,
+        &decoded_buffer,
+        &corrupt_buffer,
+        local_participantB_crypto,
+        remote_particpantA_crypto,
+        &exception);
+
+    if (!result)
+    {
+      printf("decode_rtps_message: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+
+    CU_ASSERT(!result);
+    CU_ASSERT(exception.code != 0);
+    CU_ASSERT(exception.message != NULL);
+
+    reset_exception(&exception);
+
+    DDS_Security_OctetSeq_deinit(&corrupt_buffer);
+  }
+
+  /* footer incorrect common mac */
+  {
+    struct crypto_footer *footer;
+
+    memset(&corrupt_buffer, 0, sizeof(corrupt_buffer));
+    DDS_Security_OctetSeq_copy(&corrupt_buffer, &encoded_buffer);
+
+    footer = get_crypto_footer(corrupt_buffer._buffer);
+    footer->common_mac[0] = (unsigned char)(footer->common_mac[0] + 1);
+
+    result = crypto->crypto_transform->decode_rtps_message(
+        crypto->crypto_transform,
+        &decoded_buffer,
+        &corrupt_buffer,
+        local_participantB_crypto,
+        remote_particpantA_crypto,
+        &exception);
+
+    if (!result)
+    {
+      printf("decode_rtps_message: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+
+    CU_ASSERT(!result);
+    CU_ASSERT(exception.code != 0);
+    CU_ASSERT(exception.message != NULL);
+
+    reset_exception(&exception);
+
+    DDS_Security_OctetSeq_deinit(&corrupt_buffer);
+  }
+
+  /* footer missing reader_specific mac  */
+  {
+    struct crypto_footer *footer;
+    uint32_t len;
+
+    memset(&corrupt_buffer, 0, sizeof(corrupt_buffer));
+    DDS_Security_OctetSeq_copy(&corrupt_buffer, &encoded_buffer);
+
+    footer = get_crypto_footer(corrupt_buffer._buffer);
+    len = ddsrt_bswap4u(*(uint32_t *)footer->length);
+    CU_ASSERT(len == 1);
+    memset(footer->length, 0, 4);
+
+    result = crypto->crypto_transform->decode_rtps_message(
+        crypto->crypto_transform,
+        &decoded_buffer,
+        &corrupt_buffer,
+        local_participantB_crypto,
+        remote_particpantA_crypto,
+        &exception);
+
+    if (!result)
+    {
+      printf("decode_rtps_message: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+
+    CU_ASSERT(!result);
+    CU_ASSERT(exception.code != 0);
+    CU_ASSERT(exception.message != NULL);
+
+    reset_exception(&exception);
+
+    DDS_Security_OctetSeq_deinit(&corrupt_buffer);
+  }
+
+#if 0
+    /* footer incorrect reader_specific mac id  */
+    {
+        struct crypto_footer *footer;
+        struct receiver_specific_mac *rmac;
+        uint32_t len;
+
+        memset(&corrupt_buffer, 0, sizeof(corrupt_buffer));
+        DDS_Security_OctetSeq_copy(&corrupt_buffer, &encoded_buffer);
+
+        footer = get_crypto_footer(corrupt_buffer._buffer);
+        len = ddsrt_bswap4u(*(uint32_t *)footer->length);
+        CU_ASSERT(len == 1);
+
+        rmac = (struct receiver_specific_mac *)(footer + 1);
+        rmac->receiver_mac_key_id[0] += 1;
+
+        result = crypto->crypto_transform->decode_rtps_message(
+                crypto->crypto_transform,
+                &decoded_buffer,
+                &corrupt_buffer,
+                local_participantB_crypto,
+                remote_particpantA_crypto,
+                &exception);
+
+        if (!result) {
+            printf("decode_rtps_message: %s\n", exception.message ? exception.message : "Error message missing");
+        }
+
+        CU_ASSERT(!result);
+        CU_ASSERT(exception.code != 0);
+        CU_ASSERT(exception.message != NULL);
+
+        reset_exception(&exception);
+
+        DDS_Security_OctetSeq_deinit(&corrupt_buffer);
+    }
+
+    /* footer incorrect reader_specific mac   */
+    {
+        struct crypto_footer *footer;
+        struct receiver_specific_mac *rmac;
+        uint32_t len;
+
+        memset(&corrupt_buffer, 0, sizeof(corrupt_buffer));
+        DDS_Security_OctetSeq_copy(&corrupt_buffer, &encoded_buffer);
+
+        footer = get_crypto_footer(corrupt_buffer._buffer);
+        len = ddsrt_bswap4u(*(uint32_t *)footer->length);
+        CU_ASSERT(len == 1);
+
+        rmac = (struct receiver_specific_mac *)(footer + 1);
+        rmac->receiver_mac[0] += 1;
+
+        result = crypto->crypto_transform->decode_rtps_message(
+                crypto->crypto_transform,
+                &decoded_buffer,
+                &corrupt_buffer,
+                local_participantB_crypto,
+                remote_particpantA_crypto,
+                &exception);
+
+        if (!result) {
+            printf("decode_rtps_message: %s\n", exception.message ? exception.message : "Error message missing");
+        }
+
+        CU_ASSERT(!result);
+        CU_ASSERT(exception.code != 0);
+        CU_ASSERT(exception.message != NULL);
+
+        reset_exception(&exception);
+
+        DDS_Security_OctetSeq_deinit(&corrupt_buffer);
+    }
+#endif
+
+  unregister_remote_participant_of_participantB(remote_particpantA_crypto);
+  unregister_remote_participants();
+  reset_exception(&exception);
+
+  DDS_Security_OctetSeq_deinit((&plain_buffer));
+  DDS_Security_OctetSeq_deinit((&encoded_buffer));
+  DDS_Security_DatareaderCryptoHandleSeq_deinit(&reader_list);
+  DDS_Security_PropertySeq_deinit(&properties);
+  unregister_local_participants();
+}
+
diff --git a/src/security/builtin_plugins/tests/decode_serialized_payload/src/decode_serialized_payload_utests.c b/src/security/builtin_plugins/tests/decode_serialized_payload/src/decode_serialized_payload_utests.c
new file mode 100644
index 0000000..91d7e55
--- /dev/null
+++ b/src/security/builtin_plugins/tests/decode_serialized_payload/src/decode_serialized_payload_utests.c
@@ -0,0 +1,1119 @@
+/*
+ * Copyright(c) 2006 to 2019 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+#include <openssl/evp.h>
+#include <openssl/hmac.h>
+#include <openssl/bio.h>
+#include <openssl/err.h>
+
+#include "dds/ddsrt/bswap.h"
+#include "dds/ddsrt/heap.h"
+#include "dds/ddsrt/string.h"
+#include "dds/ddsrt/types.h"
+#include "dds/ddsrt/environ.h"
+#include "dds/security/dds_security_api.h"
+#include "dds/security/core/dds_security_serialize.h"
+#include "dds/security/core/dds_security_utils.h"
+#include "dds/security/core/shared_secret.h"
+#include "CUnit/CUnit.h"
+#include "CUnit/Test.h"
+#include "common/src/loader.h"
+#include "crypto_objects.h"
+
+#define TEST_SHARED_SECRET_SIZE 32
+
+static struct plugins_hdl *plugins = NULL;
+static dds_security_cryptography *crypto = NULL;
+
+static DDS_Security_IdentityHandle local_participant_identity = 1;
+static DDS_Security_IdentityHandle remote_participant_identity = 2;
+
+static DDS_Security_ParticipantCryptoHandle local_participant_handle = DDS_SECURITY_HANDLE_NIL;
+static DDS_Security_ParticipantCryptoHandle remote_participant_handle = DDS_SECURITY_HANDLE_NIL;
+
+static DDS_Security_SharedSecretHandle shared_secret_handle = DDS_SECURITY_HANDLE_NIL;
+
+static const char *sample_test_data =
+    "ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789abcdefghijklmnopqrstuvwxyz"
+    "ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789abcdefghijklmnopqrstuvwxyz"
+    "ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789abcdefghijklmnopqrstuvwxyz"
+    "ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789abcdefghijklmnopqrstuvwxy";
+
+struct crypto_header
+{
+  struct CryptoTransformIdentifier transform_identifier;
+  unsigned char session_id[4];
+  unsigned char init_vector_suffix[8];
+};
+
+struct crypto_footer
+{
+  unsigned char common_mac[16];
+  unsigned char length[4];
+};
+
+static void reset_exception(DDS_Security_SecurityException *ex)
+{
+  ex->code = 0;
+  ex->minor_code = 0;
+  ddsrt_free(ex->message);
+  ex->message = NULL;
+}
+
+static void allocate_shared_secret(void)
+{
+  DDS_Security_SharedSecretHandleImpl *shared_secret_handle_impl;
+  int32_t i;
+
+  shared_secret_handle_impl = ddsrt_malloc(sizeof(DDS_Security_SharedSecretHandleImpl));
+
+  shared_secret_handle_impl->shared_secret = ddsrt_malloc(TEST_SHARED_SECRET_SIZE * sizeof(unsigned char));
+  shared_secret_handle_impl->shared_secret_size = TEST_SHARED_SECRET_SIZE;
+
+  for (i = 0; i < shared_secret_handle_impl->shared_secret_size; i++)
+  {
+    shared_secret_handle_impl->shared_secret[i] = (unsigned char)(i % 20);
+  }
+
+  for (i = 0; i < 32; i++)
+  {
+    shared_secret_handle_impl->challenge1[i] = (unsigned char)(i % 15);
+    shared_secret_handle_impl->challenge2[i] = (unsigned char)(i % 12);
+  }
+
+  shared_secret_handle = (DDS_Security_SharedSecretHandle)shared_secret_handle_impl;
+}
+
+static void deallocate_shared_secret(void)
+{
+  DDS_Security_SharedSecretHandleImpl *shared_secret_handle_impl = (DDS_Security_SharedSecretHandleImpl *)shared_secret_handle;
+  ddsrt_free(shared_secret_handle_impl->shared_secret);
+  ddsrt_free(shared_secret_handle_impl);
+}
+
+static void prepare_participant_security_attributes(DDS_Security_ParticipantSecurityAttributes *attributes)
+{
+  memset(attributes, 0, sizeof(DDS_Security_ParticipantSecurityAttributes));
+  attributes->allow_unauthenticated_participants = false;
+  attributes->is_access_protected = false;
+  attributes->is_discovery_protected = false;
+  attributes->is_liveliness_protected = false;
+  attributes->is_rtps_protected = true;
+  attributes->plugin_participant_attributes = DDS_SECURITY_PARTICIPANT_ATTRIBUTES_FLAG_IS_VALID;
+  attributes->plugin_participant_attributes |= DDS_SECURITY_PLUGIN_PARTICIPANT_ATTRIBUTES_FLAG_IS_RTPS_ENCRYPTED;
+}
+
+static int register_local_participant(void)
+{
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  DDS_Security_PermissionsHandle participant_permissions = 3; //valid dummy value
+  DDS_Security_PropertySeq participant_properties;
+  DDS_Security_ParticipantSecurityAttributes participant_security_attributes;
+
+  memset(&participant_properties, 0, sizeof(participant_properties));
+  prepare_participant_security_attributes(&participant_security_attributes);
+
+  local_participant_handle =
+      crypto->crypto_key_factory->register_local_participant(
+          crypto->crypto_key_factory,
+          local_participant_identity,
+          participant_permissions,
+          &participant_properties,
+          &participant_security_attributes,
+          &exception);
+
+  if (local_participant_handle == DDS_SECURITY_HANDLE_NIL)
+  {
+    printf("register_local_participant: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+
+  return local_participant_handle ? 0 : -1;
+}
+
+static void unregister_local_participant(void)
+{
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  if (local_participant_handle)
+  {
+    crypto->crypto_key_factory->unregister_participant(crypto->crypto_key_factory, local_participant_handle, &exception);
+    reset_exception(&exception);
+  }
+}
+
+static int register_remote_participant(void)
+{
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  DDS_Security_PermissionsHandle remote_participant_permissions = 5;
+
+  remote_participant_handle =
+      crypto->crypto_key_factory->register_matched_remote_participant(
+          crypto->crypto_key_factory,
+          local_participant_handle,
+          remote_participant_identity,
+          remote_participant_permissions,
+          shared_secret_handle,
+          &exception);
+
+  if (remote_participant_handle == DDS_SECURITY_HANDLE_NIL)
+  {
+    printf("register_matched_remote_participant: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+
+  return remote_participant_handle ? 0 : -1;
+}
+
+static void unregister_remote_participant(void)
+{
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  if (remote_participant_handle)
+  {
+    crypto->crypto_key_factory->unregister_participant(crypto->crypto_key_factory, remote_participant_handle, &exception);
+    reset_exception(&exception);
+  }
+}
+
+static void prepare_endpoint_security_attributes(DDS_Security_EndpointSecurityAttributes *attributes)
+{
+  memset(attributes, 0, sizeof(DDS_Security_EndpointSecurityAttributes));
+  attributes->is_discovery_protected = true;
+  attributes->is_submessage_protected = true;
+
+  attributes->plugin_endpoint_attributes |= DDS_SECURITY_PLUGIN_ENDPOINT_ATTRIBUTES_FLAG_IS_SUBMESSAGE_ENCRYPTED;
+}
+
+static DDS_Security_DatawriterCryptoHandle register_local_datawriter(bool encrypted)
+{
+  DDS_Security_DatawriterCryptoHandle writer_crypto;
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  DDS_Security_PropertySeq datawriter_properties;
+  DDS_Security_EndpointSecurityAttributes datawriter_security_attributes;
+
+  memset(&datawriter_properties, 0, sizeof(datawriter_properties));
+  prepare_endpoint_security_attributes(&datawriter_security_attributes);
+
+  datawriter_security_attributes.is_payload_protected = true;
+  if (encrypted)
+  {
+    datawriter_security_attributes.plugin_endpoint_attributes |= DDS_SECURITY_PLUGIN_ENDPOINT_ATTRIBUTES_FLAG_IS_PAYLOAD_ENCRYPTED;
+  }
+
+  writer_crypto =
+      crypto->crypto_key_factory->register_local_datawriter(
+          crypto->crypto_key_factory,
+          local_participant_handle,
+          &datawriter_properties,
+          &datawriter_security_attributes,
+          &exception);
+
+  if (writer_crypto == 0)
+  {
+    printf("register_local_datawriter: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+
+  return writer_crypto;
+}
+
+static DDS_Security_DatawriterCryptoHandle register_remote_datawriter(DDS_Security_DatareaderCryptoHandle reader_crypto)
+{
+  DDS_Security_DatawriterCryptoHandle writer_crypto;
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+
+  writer_crypto =
+      crypto->crypto_key_factory->register_matched_remote_datawriter(
+          crypto->crypto_key_factory,
+          reader_crypto,
+          remote_participant_handle,
+          shared_secret_handle,
+          &exception);
+
+  if (writer_crypto == 0)
+  {
+    printf("register_matched_remote_datareader: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+
+  return writer_crypto;
+}
+
+static void unregister_datawriter(DDS_Security_DatawriterCryptoHandle writer_crypto)
+{
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  if (writer_crypto)
+  {
+    crypto->crypto_key_factory->unregister_datawriter(crypto->crypto_key_factory, writer_crypto, &exception);
+    reset_exception(&exception);
+  }
+}
+
+static DDS_Security_DatareaderCryptoHandle register_local_datareader(bool encrypted)
+{
+  DDS_Security_DatareaderCryptoHandle reader_crypto;
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  DDS_Security_PropertySeq datareader_properties;
+  DDS_Security_EndpointSecurityAttributes datareader_security_attributes;
+
+  memset(&datareader_properties, 0, sizeof(datareader_properties));
+  memset(&datareader_security_attributes, 0, sizeof(datareader_security_attributes));
+  datareader_security_attributes.is_payload_protected = true;
+  if (encrypted)
+  {
+    datareader_security_attributes.plugin_endpoint_attributes |= DDS_SECURITY_PLUGIN_ENDPOINT_ATTRIBUTES_FLAG_IS_PAYLOAD_ENCRYPTED;
+  }
+
+  reader_crypto =
+      crypto->crypto_key_factory->register_local_datareader(
+          crypto->crypto_key_factory,
+          local_participant_handle,
+          &datareader_properties,
+          &datareader_security_attributes,
+          &exception);
+
+  if (reader_crypto == 0)
+  {
+    printf("register_local_datawriter: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+
+  return reader_crypto;
+}
+
+static DDS_Security_DatareaderCryptoHandle register_remote_datareader(DDS_Security_DatawriterCryptoHandle writer_crypto)
+{
+  DDS_Security_DatareaderCryptoHandle reader_crypto;
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  DDS_Security_PropertySeq datawriter_properties;
+
+  memset(&datawriter_properties, 0, sizeof(datawriter_properties));
+
+  reader_crypto =
+      crypto->crypto_key_factory->register_matched_remote_datareader(
+          crypto->crypto_key_factory,
+          writer_crypto,
+          remote_participant_handle,
+          shared_secret_handle,
+          true,
+          &exception);
+
+  if (reader_crypto == 0)
+  {
+    printf("register_matched_remote_datareader: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+
+  return reader_crypto;
+}
+
+static void unregister_datareader(DDS_Security_DatareaderCryptoHandle reader_crypto)
+{
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  if (reader_crypto)
+  {
+    crypto->crypto_key_factory->unregister_datareader(crypto->crypto_key_factory, reader_crypto, &exception);
+    reset_exception(&exception);
+  }
+}
+
+static bool
+set_remote_datawriter_tokens(
+    DDS_Security_DatawriterCryptoHandle local_writer_crypto,
+    DDS_Security_DatareaderCryptoHandle remote_reader_crypto,
+    DDS_Security_DatareaderCryptoHandle local_reader_crypto,
+    DDS_Security_DatawriterCryptoHandle remote_writer_crypto)
+{
+  DDS_Security_boolean result;
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  DDS_Security_DatawriterCryptoTokenSeq tokens;
+
+  memset(&tokens, 0, sizeof(tokens));
+
+  /* Now call the function. */
+  result = crypto->crypto_key_exchange->create_local_datawriter_crypto_tokens(
+      crypto->crypto_key_exchange,
+      &tokens,
+      local_writer_crypto,
+      remote_reader_crypto,
+      &exception);
+
+  if (result)
+  {
+    result = crypto->crypto_key_exchange->set_remote_datawriter_crypto_tokens(
+        crypto->crypto_key_exchange,
+        local_reader_crypto,
+        remote_writer_crypto,
+        &tokens,
+        &exception);
+
+    (void)crypto->crypto_key_exchange->return_crypto_tokens(
+        crypto->crypto_key_exchange,
+        &tokens,
+        &exception);
+  }
+
+  return (bool)result;
+}
+
+static session_key_material * get_datawriter_session(DDS_Security_DatawriterCryptoHandle writer_crypto)
+{
+  local_datawriter_crypto *writer_crypto_impl = (local_datawriter_crypto *)writer_crypto;
+
+  return writer_crypto_impl->writer_session_message;
+}
+
+static bool check_writer_protection_kind(DDS_Security_DatawriterCryptoHandle writer_crypto, DDS_Security_BasicProtectionKind protection_kind)
+{
+  local_datawriter_crypto *writer_crypto_impl = (local_datawriter_crypto *)writer_crypto;
+  return (writer_crypto_impl->data_protectionKind == protection_kind);
+}
+
+static uint32_t get_transformation_kind(uint32_t key_size, bool encoded)
+{
+  uint32_t kind = CRYPTO_TRANSFORMATION_KIND_INVALID;
+  if (key_size == 128)
+  {
+    kind = encoded ? CRYPTO_TRANSFORMATION_KIND_AES128_GCM : CRYPTO_TRANSFORMATION_KIND_AES128_GMAC;
+  }
+  else if (key_size == 256)
+  {
+    kind = encoded ? CRYPTO_TRANSFORMATION_KIND_AES256_GCM : CRYPTO_TRANSFORMATION_KIND_AES256_GMAC;
+  }
+  CU_ASSERT_FATAL(kind != CRYPTO_TRANSFORMATION_KIND_INVALID);
+  return kind;
+}
+
+static void suite_decode_serialized_payload_init(void)
+{
+  allocate_shared_secret();
+
+  CU_ASSERT_FATAL ((plugins = load_plugins(
+                      NULL    /* Access Control */,
+                      NULL    /* Authentication */,
+                      &crypto /* Cryptograpy    */)) != NULL);
+  CU_ASSERT_EQUAL_FATAL (register_local_participant(), 0);
+  CU_ASSERT_EQUAL_FATAL (register_remote_participant(), 0);
+}
+
+static void suite_decode_serialized_payload_fini(void)
+{
+  unregister_remote_participant();
+  unregister_local_participant();
+  unload_plugins(plugins);
+  deallocate_shared_secret();
+}
+
+static bool split_encoded_data(unsigned char *data, size_t size, struct crypto_header **header, unsigned char **contents, uint32_t *length, struct crypto_footer **footer)
+{
+  unsigned char *ptr;
+
+  if (size < sizeof(struct crypto_header) + 4)
+    return false;
+
+  *header = (struct crypto_header *)data;
+  ptr = data + sizeof(struct crypto_header);
+  *length = ddsrt_fromBE4u(*(uint32_t *)ptr);
+
+  size -= sizeof(struct crypto_header) + 4;
+
+  /* remain should contain the ecrypted data + the footer (common_mac (16) + length (4)) */
+  if (size < (*length) + 20)
+    return false;
+
+  ptr += 4;
+  *contents = ptr;
+  ptr += *length;
+
+  /* The length is the length of the encrypted data and the common_mac of the footer
+     * For the serialized payload the footer consists of the common_mac and the length
+     * of the receiver_specific_mac which is set to 0
+     */
+  *footer = (struct crypto_footer *)ptr;
+
+  return true;
+}
+
+static void decode_serialized_payload_check(uint32_t key_size, bool encrypted)
+{
+  DDS_Security_boolean result;
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  DDS_Security_DatawriterCryptoHandle local_writer_crypto;
+  DDS_Security_DatareaderCryptoHandle local_reader_crypto;
+  DDS_Security_DatawriterCryptoHandle remote_writer_crypto;
+  DDS_Security_DatareaderCryptoHandle remote_reader_crypto;
+  DDS_Security_OctetSeq encoded_buffer = {0, 0, NULL};
+  DDS_Security_OctetSeq decoded_buffer = {0, 0, NULL};
+  DDS_Security_OctetSeq extra_inline_qos;
+  DDS_Security_OctetSeq plain_buffer;
+  session_key_material *session_keys;
+  size_t length;
+
+  CU_ASSERT_FATAL(crypto != NULL);
+  CU_ASSERT_FATAL(crypto->crypto_transform != NULL);
+  CU_ASSERT_FATAL(crypto->crypto_transform->encode_serialized_payload != NULL);
+  CU_ASSERT_FATAL(crypto->crypto_transform->decode_serialized_payload != NULL);
+
+  memset(&extra_inline_qos, 0, sizeof(extra_inline_qos));
+
+  length = strlen(sample_test_data) + 1;
+  plain_buffer._length = plain_buffer._maximum = (uint32_t) length;
+  plain_buffer._buffer = DDS_Security_OctetSeq_allocbuf((uint32_t)length);
+  memcpy((char *)plain_buffer._buffer, sample_test_data, length);
+
+  local_writer_crypto = register_local_datawriter(encrypted);
+  CU_ASSERT_FATAL(local_writer_crypto != 0);
+  CU_ASSERT(check_writer_protection_kind(local_writer_crypto, encrypted ? DDS_SECURITY_BASICPROTECTION_KIND_ENCRYPT : DDS_SECURITY_BASICPROTECTION_KIND_SIGN));
+
+  session_keys = get_datawriter_session(local_writer_crypto);
+  session_keys->master_key_material->transformation_kind = get_transformation_kind(key_size, encrypted);
+  session_keys->key_size = key_size;
+
+  local_reader_crypto = register_local_datareader(encrypted);
+  CU_ASSERT_FATAL(local_reader_crypto != 0);
+
+  remote_reader_crypto = register_remote_datareader(local_writer_crypto);
+  CU_ASSERT_FATAL(remote_reader_crypto != 0);
+
+  remote_writer_crypto = register_remote_datawriter(local_reader_crypto);
+  CU_ASSERT_FATAL(remote_writer_crypto != 0);
+
+  result = set_remote_datawriter_tokens(local_writer_crypto, remote_reader_crypto, local_reader_crypto, remote_writer_crypto);
+  CU_ASSERT_FATAL(result);
+
+  /* Encrypt the data. */
+  result = crypto->crypto_transform->encode_serialized_payload(
+      crypto->crypto_transform,
+      &encoded_buffer,
+      &extra_inline_qos,
+      &plain_buffer,
+      local_writer_crypto,
+      &exception);
+
+  if (!result)
+  {
+    printf("encode_serialized_payload: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+
+  CU_ASSERT_FATAL(result);
+  CU_ASSERT(exception.code == 0);
+  CU_ASSERT(exception.message == NULL);
+
+  reset_exception(&exception);
+
+  /* Decrypt the data */
+  result = crypto->crypto_transform->decode_serialized_payload(
+      crypto->crypto_transform,
+      &decoded_buffer,
+      &encoded_buffer,
+      &extra_inline_qos,
+      local_reader_crypto,
+      remote_writer_crypto,
+      &exception);
+
+  if (!result)
+  {
+    printf("decode_serialized_payload: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+
+  CU_ASSERT_FATAL(result);
+  CU_ASSERT(exception.code == 0);
+  CU_ASSERT(exception.message == NULL);
+
+  unregister_datareader(remote_reader_crypto);
+  unregister_datawriter(remote_writer_crypto);
+  unregister_datareader(local_reader_crypto);
+  unregister_datawriter(local_writer_crypto);
+
+  DDS_Security_OctetSeq_deinit(&encoded_buffer);
+  DDS_Security_OctetSeq_deinit(&decoded_buffer);
+  DDS_Security_OctetSeq_deinit(&plain_buffer);
+
+  reset_exception(&exception);
+}
+
+CU_Test(ddssec_builtin_decode_serialized_payload, decrypt_128, .init = suite_decode_serialized_payload_init, .fini = suite_decode_serialized_payload_fini)
+{
+  decode_serialized_payload_check(128, true);
+}
+
+CU_Test(ddssec_builtin_decode_serialized_payload, decrypt_256, .init = suite_decode_serialized_payload_init, .fini = suite_decode_serialized_payload_fini)
+{
+  decode_serialized_payload_check(256, true);
+}
+
+CU_Test(ddssec_builtin_decode_serialized_payload, signcheck_128, .init = suite_decode_serialized_payload_init, .fini = suite_decode_serialized_payload_fini)
+{
+  decode_serialized_payload_check(128, false);
+}
+
+CU_Test(ddssec_builtin_decode_serialized_payload, signcheck_256, .init = suite_decode_serialized_payload_init, .fini = suite_decode_serialized_payload_fini)
+{
+  decode_serialized_payload_check(256, false);
+}
+
+CU_Test(ddssec_builtin_decode_serialized_payload, invalid_args, .init = suite_decode_serialized_payload_init, .fini = suite_decode_serialized_payload_fini)
+{
+  DDS_Security_boolean result;
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  DDS_Security_DatawriterCryptoHandle local_writer_crypto;
+  DDS_Security_DatareaderCryptoHandle local_reader_crypto;
+  DDS_Security_DatawriterCryptoHandle remote_writer_crypto;
+  DDS_Security_DatareaderCryptoHandle remote_reader_crypto;
+  DDS_Security_OctetSeq encoded_buffer = {0, 0, NULL};
+  DDS_Security_OctetSeq decoded_buffer = {0, 0, NULL};
+  DDS_Security_OctetSeq extra_inline_qos;
+  DDS_Security_OctetSeq plain_buffer;
+  DDS_Security_OctetSeq empty_buffer;
+  session_key_material *session_keys;
+  size_t length;
+
+  CU_ASSERT_FATAL(crypto != NULL);
+  CU_ASSERT_FATAL(crypto->crypto_transform != NULL);
+  CU_ASSERT_FATAL(crypto->crypto_transform->encode_serialized_payload != NULL);
+
+  memset(&extra_inline_qos, 0, sizeof(extra_inline_qos));
+  memset(&empty_buffer, 0, sizeof(empty_buffer));
+
+  length = strlen(sample_test_data) + 1;
+  plain_buffer._length = plain_buffer._maximum = (uint32_t)length;
+  plain_buffer._buffer = DDS_Security_OctetSeq_allocbuf((uint32_t)length);
+  memcpy((char *)plain_buffer._buffer, sample_test_data, length);
+
+  local_writer_crypto = register_local_datawriter(true);
+  CU_ASSERT_FATAL(local_writer_crypto != 0);
+
+  session_keys = get_datawriter_session(local_writer_crypto);
+  session_keys->master_key_material->transformation_kind = CRYPTO_TRANSFORMATION_KIND_AES256_GCM;
+  session_keys->key_size = 256;
+
+  local_reader_crypto = register_local_datareader(true);
+  CU_ASSERT_FATAL(local_reader_crypto != 0);
+
+  remote_reader_crypto = register_remote_datareader(local_writer_crypto);
+  CU_ASSERT_FATAL(remote_reader_crypto != 0);
+
+  remote_writer_crypto = register_remote_datawriter(local_reader_crypto);
+  CU_ASSERT_FATAL(remote_writer_crypto != 0);
+
+  result = set_remote_datawriter_tokens(local_writer_crypto, remote_reader_crypto, local_reader_crypto, remote_writer_crypto);
+  CU_ASSERT_FATAL(result);
+
+  /* encrypt the data */
+  result = crypto->crypto_transform->encode_serialized_payload(
+      crypto->crypto_transform,
+      &encoded_buffer,
+      &extra_inline_qos,
+      &plain_buffer,
+      local_writer_crypto,
+      &exception);
+
+  if (!result)
+  {
+    printf("encode_serialized_payload: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+
+  CU_ASSERT_FATAL(result);
+  CU_ASSERT(exception.code == 0);
+  CU_ASSERT(exception.message == NULL);
+
+  reset_exception(&exception);
+
+  /* no decoded data buffer specified */
+  result = crypto->crypto_transform->decode_serialized_payload(
+      crypto->crypto_transform,
+      NULL,
+      &encoded_buffer,
+      &extra_inline_qos,
+      local_reader_crypto,
+      remote_writer_crypto,
+      &exception);
+
+  if (!result)
+  {
+    printf("decode_serialized_payload: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+
+  CU_ASSERT(!result);
+  CU_ASSERT(exception.code != 0);
+  CU_ASSERT(exception.message != NULL);
+
+  reset_exception(&exception);
+
+  /* no encrypted data buffer specified */
+  result = crypto->crypto_transform->decode_serialized_payload(
+      crypto->crypto_transform,
+      &decoded_buffer,
+      NULL,
+      &extra_inline_qos,
+      local_reader_crypto,
+      remote_writer_crypto,
+      &exception);
+
+  if (!result)
+  {
+    printf("decode_serialized_payload: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+
+  CU_ASSERT(!result);
+  CU_ASSERT(exception.code != 0);
+  CU_ASSERT(exception.message != NULL);
+
+  reset_exception(&exception);
+
+  /* empty encrypted data buffer specified */
+  result = crypto->crypto_transform->decode_serialized_payload(
+      crypto->crypto_transform,
+      &decoded_buffer,
+      &empty_buffer,
+      &extra_inline_qos,
+      local_reader_crypto,
+      remote_writer_crypto,
+      &exception);
+
+  if (!result)
+  {
+    printf("decode_serialized_payload: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+
+  CU_ASSERT(!result);
+  CU_ASSERT(exception.code != 0);
+  CU_ASSERT(exception.message != NULL);
+
+  reset_exception(&exception);
+
+  /* unknown local reader crypto handle specified */
+  result = crypto->crypto_transform->decode_serialized_payload(
+      crypto->crypto_transform,
+      &decoded_buffer,
+      &encoded_buffer,
+      &extra_inline_qos,
+      0,
+      remote_writer_crypto,
+      &exception);
+
+  if (!result)
+  {
+    printf("decode_serialized_payload: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+
+  CU_ASSERT(!result);
+  CU_ASSERT(exception.code != 0);
+  CU_ASSERT(exception.message != NULL);
+
+  reset_exception(&exception);
+
+  /* invalid local reader crypto handle specified */
+  result = crypto->crypto_transform->decode_serialized_payload(
+      crypto->crypto_transform,
+      &decoded_buffer,
+      &encoded_buffer,
+      &extra_inline_qos,
+      remote_writer_crypto,
+      remote_writer_crypto,
+      &exception);
+
+  if (!result)
+  {
+    printf("decode_serialized_payload: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+
+  CU_ASSERT(!result);
+  CU_ASSERT(exception.code != 0);
+  CU_ASSERT(exception.message != NULL);
+
+  reset_exception(&exception);
+
+  /* unknown remote writer crypto handle specified */
+  result = crypto->crypto_transform->decode_serialized_payload(
+      crypto->crypto_transform,
+      &decoded_buffer,
+      &encoded_buffer,
+      &extra_inline_qos,
+      local_reader_crypto,
+      0,
+      &exception);
+
+  if (!result)
+  {
+    printf("decode_serialized_payload: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+
+  CU_ASSERT(!result);
+  CU_ASSERT(exception.code != 0);
+  CU_ASSERT(exception.message != NULL);
+
+  reset_exception(&exception);
+
+  /* invalid remote writer crypto handle specified */
+  result = crypto->crypto_transform->decode_serialized_payload(
+      crypto->crypto_transform,
+      &decoded_buffer,
+      &encoded_buffer,
+      &extra_inline_qos,
+      local_reader_crypto,
+      local_reader_crypto,
+      &exception);
+
+  if (!result)
+  {
+    printf("decode_serialized_payload: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+
+  CU_ASSERT(!result);
+  CU_ASSERT(exception.code != 0);
+  CU_ASSERT(exception.message != NULL);
+
+  unregister_datareader(remote_reader_crypto);
+  unregister_datawriter(remote_writer_crypto);
+  unregister_datareader(local_reader_crypto);
+  unregister_datawriter(local_writer_crypto);
+
+  DDS_Security_OctetSeq_deinit(&encoded_buffer);
+  DDS_Security_OctetSeq_deinit(&plain_buffer);
+
+  reset_exception(&exception);
+}
+
+CU_Test(ddssec_builtin_decode_serialized_payload, invalid_data, .init = suite_decode_serialized_payload_init, .fini = suite_decode_serialized_payload_fini)
+{
+  DDS_Security_boolean result;
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  DDS_Security_DatawriterCryptoHandle local_writer_crypto;
+  DDS_Security_DatareaderCryptoHandle local_reader_crypto;
+  DDS_Security_DatawriterCryptoHandle remote_writer_crypto;
+  DDS_Security_DatareaderCryptoHandle remote_reader_crypto;
+  DDS_Security_OctetSeq encoded_buffer = {0, 0, NULL};
+  DDS_Security_OctetSeq decoded_buffer = {0, 0, NULL};
+  DDS_Security_OctetSeq extra_inline_qos;
+  DDS_Security_OctetSeq plain_buffer;
+  session_key_material *session_keys;
+  size_t length;
+  struct crypto_header *header = NULL;
+  struct crypto_footer *footer = NULL;
+  unsigned char *contents = NULL;
+
+  CU_ASSERT_FATAL(crypto != NULL);
+  CU_ASSERT_FATAL(crypto->crypto_transform != NULL);
+  CU_ASSERT_FATAL(crypto->crypto_transform->encode_serialized_payload != NULL);
+
+  memset(&extra_inline_qos, 0, sizeof(extra_inline_qos));
+
+  length = strlen(sample_test_data) + 1;
+  plain_buffer._length = plain_buffer._maximum = (uint32_t) length;
+  plain_buffer._buffer = DDS_Security_OctetSeq_allocbuf((uint32_t) length);
+  memcpy((char *)plain_buffer._buffer, sample_test_data, length);
+
+  local_writer_crypto = register_local_datawriter(true);
+  CU_ASSERT_FATAL(local_writer_crypto != 0);
+
+  session_keys = get_datawriter_session(local_writer_crypto);
+  session_keys->master_key_material->transformation_kind = CRYPTO_TRANSFORMATION_KIND_AES256_GCM;
+  session_keys->key_size = 256;
+
+  local_reader_crypto = register_local_datareader(true);
+  CU_ASSERT_FATAL(local_reader_crypto != 0);
+
+  remote_reader_crypto = register_remote_datareader(local_writer_crypto);
+  CU_ASSERT_FATAL(remote_reader_crypto != 0);
+
+  remote_writer_crypto = register_remote_datawriter(local_reader_crypto);
+  CU_ASSERT_FATAL(remote_writer_crypto != 0);
+
+  result = set_remote_datawriter_tokens(local_writer_crypto, remote_reader_crypto, local_reader_crypto, remote_writer_crypto);
+  CU_ASSERT_FATAL(result);
+
+  /* Encrypt the data. */
+  result = crypto->crypto_transform->encode_serialized_payload(
+      crypto->crypto_transform,
+      &encoded_buffer,
+      &extra_inline_qos,
+      &plain_buffer,
+      local_writer_crypto,
+      &exception);
+
+  if (!result)
+  {
+    printf("encode_serialized_payload: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+
+  CU_ASSERT_FATAL(result);
+  CU_ASSERT(exception.code == 0);
+  CU_ASSERT(exception.message == NULL);
+
+  reset_exception(&exception);
+
+  result = split_encoded_data(encoded_buffer._buffer, encoded_buffer._length, &header, &contents, (uint32_t *) &length, &footer);
+  CU_ASSERT_FATAL(result);
+
+  /* use incorrect transformation kind */
+  {
+    DDS_Security_CryptoTransformKind_Enum kind = header->transform_identifier.transformation_kind[3];
+    header->transform_identifier.transformation_kind[3] = CRYPTO_TRANSFORMATION_KIND_AES256_GMAC;
+    result = crypto->crypto_transform->decode_serialized_payload(
+        crypto->crypto_transform,
+        &decoded_buffer,
+        &encoded_buffer,
+        &extra_inline_qos,
+        local_reader_crypto,
+        remote_writer_crypto,
+        &exception);
+
+    if (!result)
+    {
+      printf("decode_serialized_payload: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+
+    CU_ASSERT(!result);
+    CU_ASSERT(exception.code != 0);
+    CU_ASSERT(exception.message != NULL);
+
+    reset_exception(&exception);
+
+    header->transform_identifier.transformation_kind[3] = (unsigned char) kind;
+  }
+
+  /* use incorrect transformation key id */
+  {
+    unsigned char key[4];
+    uint32_t val = (uint32_t) rand();
+
+    memcpy(key, header->transform_identifier.transformation_key_id, 4);
+    memcpy(header->transform_identifier.transformation_key_id, &val, 4);
+
+    result = crypto->crypto_transform->decode_serialized_payload(
+        crypto->crypto_transform,
+        &decoded_buffer,
+        &encoded_buffer,
+        &extra_inline_qos,
+        local_reader_crypto,
+        remote_writer_crypto,
+        &exception);
+
+    if (!result)
+    {
+      printf("decode_serialized_payload: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+
+    CU_ASSERT(!result);
+    CU_ASSERT(exception.code != 0);
+    CU_ASSERT(exception.message != NULL);
+
+    reset_exception(&exception);
+
+    memcpy(header->transform_identifier.transformation_key_id, key, 4);
+  }
+
+  /* use incorrect session id*/
+  {
+    unsigned char sid[4];
+    uint32_t val = (uint32_t) rand();
+
+    memcpy(sid, header->session_id, 4);
+    memcpy(header->session_id, &val, 4);
+
+    result = crypto->crypto_transform->decode_serialized_payload(
+        crypto->crypto_transform,
+        &decoded_buffer,
+        &encoded_buffer,
+        &extra_inline_qos,
+        local_reader_crypto,
+        remote_writer_crypto,
+        &exception);
+
+    if (!result)
+    {
+      printf("decode_serialized_payload: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+
+    CU_ASSERT(!result);
+    CU_ASSERT(exception.code != 0);
+    CU_ASSERT(exception.message != NULL);
+
+    reset_exception(&exception);
+
+    memcpy(header->session_id, sid, 4);
+  }
+
+  /* use incorrect init vector suffix*/
+  {
+    unsigned char iv[8];
+    struct
+    {
+      uint32_t h;
+      uint32_t l;
+    } val;
+
+    val.h = (uint32_t) rand();
+    val.l = (uint32_t) rand();
+
+    memcpy(iv, header->init_vector_suffix, 8);
+    memcpy(header->init_vector_suffix, &val, 8);
+
+    result = crypto->crypto_transform->decode_serialized_payload(
+        crypto->crypto_transform,
+        &decoded_buffer,
+        &encoded_buffer,
+        &extra_inline_qos,
+        local_reader_crypto,
+        remote_writer_crypto,
+        &exception);
+
+    if (!result)
+    {
+      printf("decode_serialized_payload: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+
+    CU_ASSERT(!result);
+    CU_ASSERT(exception.code != 0);
+    CU_ASSERT(exception.message != NULL);
+
+    reset_exception(&exception);
+
+    memcpy(header->init_vector_suffix, iv, 8);
+  }
+
+  /* use incorrect data length */
+  {
+    uint32_t saved, len;
+    unsigned char *ptr;
+
+    ptr = encoded_buffer._buffer + sizeof(struct crypto_header);
+
+    memcpy(&saved, ptr, 4);
+
+    len = ddsrt_toBE4u(saved);
+    len += 4;
+    len = ddsrt_fromBE4u(len);
+
+    memcpy(ptr, &len, 4);
+
+    result = crypto->crypto_transform->decode_serialized_payload(
+        crypto->crypto_transform,
+        &decoded_buffer,
+        &encoded_buffer,
+        &extra_inline_qos,
+        local_reader_crypto,
+        remote_writer_crypto,
+        &exception);
+
+    if (!result)
+    {
+      printf("decode_serialized_payload: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+
+    CU_ASSERT(!result);
+    CU_ASSERT(exception.code != 0);
+    CU_ASSERT(exception.message != NULL);
+
+    reset_exception(&exception);
+
+    memcpy(ptr, &saved, 4);
+  }
+
+  /* use incorrect data */
+  {
+    unsigned char saved[10];
+    unsigned char *ptr;
+
+    ptr = contents + 20;
+
+    memcpy(&saved, ptr, 10);
+    memset(ptr, 0xFF, 10);
+
+    result = crypto->crypto_transform->decode_serialized_payload(
+        crypto->crypto_transform,
+        &decoded_buffer,
+        &encoded_buffer,
+        &extra_inline_qos,
+        local_reader_crypto,
+        remote_writer_crypto,
+        &exception);
+
+    if (!result)
+    {
+      printf("decode_serialized_payload: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+
+    CU_ASSERT(!result);
+    CU_ASSERT(exception.code != 0);
+    CU_ASSERT(exception.message != NULL);
+
+    reset_exception(&exception);
+
+    memcpy(ptr, &saved, 10);
+  }
+
+  /* use incorrect hmac */
+  {
+    unsigned char hmac[16];
+    uint32_t i, j;
+
+    memcpy(hmac, footer->common_mac, 16);
+    for (i = 0, j = 15; i < 8; ++i, --j)
+    {
+      unsigned char c = footer->common_mac[j];
+      footer->common_mac[j] = footer->common_mac[i];
+      footer->common_mac[i] = c;
+    }
+
+    result = crypto->crypto_transform->decode_serialized_payload(
+        crypto->crypto_transform,
+        &decoded_buffer,
+        &encoded_buffer,
+        &extra_inline_qos,
+        local_reader_crypto,
+        remote_writer_crypto,
+        &exception);
+
+    if (!result)
+    {
+      printf("decode_serialized_payload: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+
+    CU_ASSERT(!result);
+    CU_ASSERT(exception.code != 0);
+    CU_ASSERT(exception.message != NULL);
+
+    reset_exception(&exception);
+
+    memcpy(footer->common_mac, &hmac, 16);
+  }
+
+  /* use incorrect footer*/
+  {
+    footer->length[0] = 1;
+
+    result = crypto->crypto_transform->decode_serialized_payload(
+        crypto->crypto_transform,
+        &decoded_buffer,
+        &encoded_buffer,
+        &extra_inline_qos,
+        local_reader_crypto,
+        remote_writer_crypto,
+        &exception);
+
+    if (!result)
+    {
+      printf("decode_serialized_payload: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+
+    CU_ASSERT(!result);
+    CU_ASSERT(exception.code != 0);
+    CU_ASSERT(exception.message != NULL);
+
+    reset_exception(&exception);
+
+    footer->length[0] = 0;
+  }
+
+  unregister_datareader(remote_reader_crypto);
+  unregister_datawriter(remote_writer_crypto);
+  unregister_datareader(local_reader_crypto);
+  unregister_datawriter(local_writer_crypto);
+
+  DDS_Security_OctetSeq_deinit(&encoded_buffer);
+  DDS_Security_OctetSeq_deinit(&plain_buffer);
+}
+
diff --git a/src/security/builtin_plugins/tests/encode_datareader_submessage/src/encode_datareader_submessage_utests.c b/src/security/builtin_plugins/tests/encode_datareader_submessage/src/encode_datareader_submessage_utests.c
new file mode 100644
index 0000000..2513a39
--- /dev/null
+++ b/src/security/builtin_plugins/tests/encode_datareader_submessage/src/encode_datareader_submessage_utests.c
@@ -0,0 +1,1275 @@
+/*
+ * Copyright(c) 2006 to 2019 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+#include <assert.h>
+#include <openssl/evp.h>
+#include <openssl/hmac.h>
+#include <openssl/bio.h>
+#include <openssl/err.h>
+
+#include "dds/ddsrt/bswap.h"
+#include "dds/ddsrt/endian.h"
+#include "dds/ddsrt/heap.h"
+#include "dds/ddsrt/string.h"
+#include "dds/ddsrt/types.h"
+#include "dds/ddsrt/environ.h"
+#include "dds/security/dds_security_api.h"
+#include "dds/security/core/dds_security_serialize.h"
+#include "dds/security/core/dds_security_utils.h"
+#include "dds/security/core/shared_secret.h"
+#include "CUnit/CUnit.h"
+#include "CUnit/Test.h"
+#include "common/src/loader.h"
+#include "common/src/crypto_helper.h"
+#include "crypto_objects.h"
+#include "crypto_utils.h"
+
+#define TEST_SHARED_SECRET_SIZE 32
+
+static struct plugins_hdl *plugins = NULL;
+static dds_security_cryptography *crypto = NULL;
+
+static DDS_Security_IdentityHandle local_participant_identity = 1;
+static DDS_Security_IdentityHandle remote_participant_identity = 2;
+
+static DDS_Security_ParticipantCryptoHandle local_participant_handle = DDS_SECURITY_HANDLE_NIL;
+static DDS_Security_ParticipantCryptoHandle remote_participant_handle = DDS_SECURITY_HANDLE_NIL;
+
+static DDS_Security_SharedSecretHandleImpl *shared_secret_handle_impl = NULL;
+static DDS_Security_SharedSecretHandle shared_secret_handle;
+
+struct submsg_header
+{
+  unsigned char id;
+  unsigned char flags;
+  uint16_t length;
+};
+
+struct crypto_header
+{
+  struct CryptoTransformIdentifier transform_identifier;
+  unsigned char session_id[4];
+  unsigned char init_vector_suffix[8];
+};
+
+struct crypto_footer
+{
+  unsigned char common_mac[16];
+  uint32_t length;
+};
+
+struct receiver_specific_mac
+{
+  DDS_Security_CryptoTransformKeyId receiver_mac_key_id;
+  unsigned char receiver_mac[CRYPTO_HMAC_SIZE];
+};
+
+struct encrypted_data
+{
+  uint32_t length;
+  unsigned char data[1];
+};
+
+struct seq_number
+{
+  int high;
+  unsigned low;
+};
+
+struct heartbeat
+{
+  struct submsg_header smhdr;
+  uint32_t readerId;
+  uint32_t writerId;
+  struct seq_number firstSN;
+  struct seq_number lastSN;
+  int count;
+};
+
+static struct heartbeat heartbeat;
+
+static void reset_exception(DDS_Security_SecurityException *ex)
+{
+  ex->code = 0;
+  ex->minor_code = 0;
+  ddsrt_free(ex->message);
+  ex->message = NULL;
+}
+
+static void allocate_shared_secret(void)
+{
+  int32_t i;
+
+  shared_secret_handle_impl = ddsrt_malloc(sizeof(DDS_Security_SharedSecretHandleImpl));
+
+  shared_secret_handle_impl->shared_secret = ddsrt_malloc(TEST_SHARED_SECRET_SIZE * sizeof(unsigned char));
+  shared_secret_handle_impl->shared_secret_size = TEST_SHARED_SECRET_SIZE;
+
+  for (i = 0; i < shared_secret_handle_impl->shared_secret_size; i++)
+  {
+    shared_secret_handle_impl->shared_secret[i] = (unsigned char)(i % 20);
+  }
+
+  for (i = 0; i < 32; i++)
+  {
+    shared_secret_handle_impl->challenge1[i] = (unsigned char)(i % 15);
+    shared_secret_handle_impl->challenge2[i] = (unsigned char)(i % 12);
+  }
+
+  shared_secret_handle = (DDS_Security_SharedSecretHandle)shared_secret_handle_impl;
+}
+
+static void deallocate_shared_secret(void)
+{
+  ddsrt_free(shared_secret_handle_impl->shared_secret);
+  ddsrt_free(shared_secret_handle_impl);
+}
+
+static void initialize_heartbeat(void)
+{
+  heartbeat.smhdr.id = 0x07;
+  heartbeat.smhdr.flags = 1;
+  heartbeat.smhdr.length = sizeof(heartbeat) - sizeof(struct submsg_header);
+  heartbeat.readerId = 0xA1B2C3D4;
+  heartbeat.writerId = 0xE5F6A7B0;
+  heartbeat.firstSN.high = 0;
+  heartbeat.firstSN.low = 1;
+  heartbeat.lastSN.high = 20;
+  heartbeat.lastSN.low = 500;
+  heartbeat.count = 1021;
+}
+
+static int register_local_participant(void)
+{
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  DDS_Security_PermissionsHandle participant_permissions = 3; //valid dummy value
+  DDS_Security_PropertySeq participant_properties;
+  DDS_Security_ParticipantSecurityAttributes participant_security_attributes;
+
+  memset(&participant_properties, 0, sizeof(participant_properties));
+  memset(&participant_security_attributes, 0, sizeof(participant_security_attributes));
+
+  local_participant_handle =
+      crypto->crypto_key_factory->register_local_participant(
+          crypto->crypto_key_factory,
+          local_participant_identity,
+          participant_permissions,
+          &participant_properties,
+          &participant_security_attributes,
+          &exception);
+
+  if (local_participant_handle == DDS_SECURITY_HANDLE_NIL)
+  {
+    printf("register_local_participant: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+
+  return local_participant_handle ? 0 : -1;
+}
+
+static void unregister_local_participant(void)
+{
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  if (local_participant_handle)
+  {
+    crypto->crypto_key_factory->unregister_participant(crypto->crypto_key_factory, local_participant_handle, &exception);
+    reset_exception(&exception);
+  }
+}
+
+static int register_remote_participant(void)
+{
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  DDS_Security_PermissionsHandle remote_participant_permissions = 5;
+
+  remote_participant_handle =
+      crypto->crypto_key_factory->register_matched_remote_participant(
+          crypto->crypto_key_factory,
+          local_participant_handle,
+          remote_participant_identity,
+          remote_participant_permissions,
+          shared_secret_handle,
+          &exception);
+
+  if (remote_participant_handle == DDS_SECURITY_HANDLE_NIL)
+  {
+    printf("register_matched_remote_participant: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+
+  return remote_participant_handle ? 0 : -1;
+}
+
+static void unregister_remote_participant(void)
+{
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  if (remote_participant_handle)
+  {
+    crypto->crypto_key_factory->unregister_participant(crypto->crypto_key_factory, remote_participant_handle, &exception);
+    reset_exception(&exception);
+  }
+}
+
+static DDS_Security_DatareaderCryptoHandle register_local_datareader(DDS_Security_EndpointSecurityAttributes *datareader_security_attributes, DDS_Security_PropertySeq *datareader_properties)
+{
+  DDS_Security_DatareaderCryptoHandle reader_crypto;
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+
+  reader_crypto =
+      crypto->crypto_key_factory->register_local_datareader(
+          crypto->crypto_key_factory,
+          local_participant_handle,
+          datareader_properties,
+          datareader_security_attributes,
+          &exception);
+
+  if (reader_crypto == 0)
+  {
+    printf("register_local_datawriter: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+
+  return reader_crypto;
+}
+
+static void unregister_datareader(DDS_Security_DatareaderCryptoHandle reader_crypto)
+{
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  if (reader_crypto)
+  {
+    crypto->crypto_key_factory->unregister_datareader(crypto->crypto_key_factory, reader_crypto, &exception);
+    reset_exception(&exception);
+  }
+}
+
+static DDS_Security_DatawriterCryptoHandle register_remote_datawriter(DDS_Security_DatareaderCryptoHandle reader_crypto)
+{
+  DDS_Security_DatawriterCryptoHandle writer_crypto;
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+
+  writer_crypto =
+      crypto->crypto_key_factory->register_matched_remote_datawriter(
+          crypto->crypto_key_factory,
+          reader_crypto,
+          remote_participant_handle,
+          shared_secret_handle,
+          &exception);
+
+  if (writer_crypto == 0)
+  {
+    printf("register_matched_remote_datareader: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+
+  return writer_crypto;
+}
+
+static void unregister_datawriter(DDS_Security_DatawriterCryptoHandle writer_crypto)
+{
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  if (writer_crypto)
+  {
+    crypto->crypto_key_factory->unregister_datawriter(crypto->crypto_key_factory, writer_crypto, &exception);
+    reset_exception(&exception);
+  }
+}
+
+static bool read_prefix(unsigned char **ptr, uint32_t *remain)
+{
+  struct submsg_header *prefix;
+  uint32_t hlen;
+  int swap;
+
+  if (*remain < sizeof(struct submsg_header))
+  {
+    printf("check_encoded_data: prefix missing\n");
+    return false;
+  }
+
+  prefix = (struct submsg_header *)(*ptr);
+
+  if (prefix->id != SMID_SEC_PREFIX_KIND)
+  {
+    printf("check_encoded_data: prefix incorrect smid 0x%x02\n", prefix->id);
+    return false;
+  }
+
+  if (prefix->flags & 0x01)
+    swap = (DDSRT_ENDIAN != DDSRT_LITTLE_ENDIAN);
+  else
+    swap = (DDSRT_ENDIAN == DDSRT_LITTLE_ENDIAN);
+
+  hlen = swap ? ddsrt_bswap2u(prefix->length) : prefix->length;
+
+  if (hlen != sizeof(struct crypto_header))
+  {
+    printf("check_encoded_data: crypto_header missing\n");
+    return false;
+  }
+
+  *ptr += sizeof(struct submsg_header);
+  *remain -= (uint32_t)sizeof(struct submsg_header);
+
+  return true;
+}
+
+static bool read_header(struct crypto_header **header, unsigned char **ptr, uint32_t *remain)
+{
+  if (*remain < sizeof(struct crypto_header))
+  {
+    printf("check_encoded_data: crypto_header too short\n");
+    return false;
+  }
+
+  *header = ddsrt_malloc(sizeof(struct crypto_header));
+  memcpy(*header, *ptr, sizeof(struct crypto_header));
+
+  *ptr += sizeof(struct crypto_header);
+  *remain -= (uint32_t)sizeof(struct crypto_header);
+
+  return true;
+}
+
+static bool read_body(DDS_Security_OctetSeq *contents, bool encrypted, unsigned char **ptr, uint32_t *remain)
+{
+  struct submsg_header *body;
+  uint32_t hlen, clen;
+  int swap;
+
+  if (*remain < sizeof(struct submsg_header))
+  {
+    return false;
+  }
+
+  body = (struct submsg_header *)(*ptr);
+
+  if (body->flags & 0x01)
+    swap = (DDSRT_ENDIAN != DDSRT_LITTLE_ENDIAN);
+  else
+    swap = (DDSRT_ENDIAN == DDSRT_LITTLE_ENDIAN);
+
+  hlen = swap ? ddsrt_bswap2u(body->length) : body->length;
+
+  if (encrypted)
+  {
+    struct encrypted_data *enc;
+
+    if (body->id != SMID_SEC_BODY_KIND)
+    {
+      printf("check_encoded_data: submessage SEC_BODY missing\n");
+      return false;
+    }
+    enc = (struct encrypted_data *)(body + 1);
+    clen = ddsrt_fromBE4u(enc->length);
+
+    contents->_length = contents->_maximum = clen;
+    contents->_buffer = &enc->data[0];
+  }
+  else
+  {
+    if (body->id == SMID_SEC_BODY_KIND)
+    {
+      printf("check_encoded_data: submessage SEC_BODY not expected\n");
+      return false;
+    }
+    clen = swap ? ddsrt_bswap2u(body->length) : body->length;
+    clen += (uint32_t)sizeof(struct submsg_header);
+
+    contents->_length = contents->_maximum = clen;
+    contents->_buffer = *ptr;
+  }
+  *ptr += sizeof(struct submsg_header) + hlen;
+  *remain -= (uint32_t)sizeof(struct submsg_header) + hlen;
+
+  return true;
+}
+
+static bool read_postfix(unsigned char **ptr, uint32_t *remain)
+{
+  struct submsg_header *postfix;
+
+  if (*remain < sizeof(struct submsg_header))
+  {
+    printf("check_encoded_data: postfix missing\n");
+    return false;
+  }
+
+  postfix = (struct submsg_header *)(*ptr);
+
+  if (postfix->id != SMID_SEC_POSTFIX_KIND)
+  {
+    printf("check_encoded_data: postfix invalid smid\n");
+    return false;
+  }
+
+  *ptr += sizeof(struct submsg_header);
+  *remain -= (uint32_t)sizeof(struct submsg_header);
+
+  return true;
+}
+
+static bool read_footer(struct crypto_footer **footer, unsigned char **ptr, uint32_t *remain)
+{
+  if (*remain < CRYPTO_HMAC_SIZE + sizeof(uint32_t))
+  {
+    printf("check_encoded_data: crypto_footer incorrect size\n");
+    return false;
+  }
+
+  *footer = ddsrt_malloc(*remain);
+  memcpy(*footer, *ptr, *remain);
+
+  /* length of reader specific macs is in BIG-ENDIAN format */
+  (*footer)->length = ddsrt_fromBE4u((*footer)->length);
+
+  return true;
+}
+
+static bool check_encoded_data(DDS_Security_OctetSeq *data, bool encrypted, struct crypto_header **header, struct crypto_footer **footer, DDS_Security_OctetSeq *contents)
+{
+  bool result = true;
+  unsigned char *ptr = data->_buffer;
+  uint32_t remain = data->_length;
+
+  result = read_prefix(&ptr, &remain);
+  if (result)
+    result = read_header(header, &ptr, &remain);
+  if (result)
+    result = read_body(contents, encrypted, &ptr, &remain);
+  if (result)
+    result = read_postfix(&ptr, &remain);
+  if (result)
+    result = read_footer(footer, &ptr, &remain);
+
+  return result;
+}
+
+static bool cipher_sign_data(const unsigned char *session_key, uint32_t key_size, const unsigned char *iv, const unsigned char *data, uint32_t data_len, unsigned char *tag)
+{
+  EVP_CIPHER_CTX *ctx;
+  unsigned char temp[32];
+  int len;
+
+  /* create the cipher context */
+  ctx = EVP_CIPHER_CTX_new();
+  if (!ctx)
+  {
+    ERR_print_errors_fp(stderr);
+    goto fail_ctx_new;
+  }
+
+  /* initialize the cipher and set to AES GCM */
+  if (key_size == 128)
+  {
+    if (!EVP_EncryptInit_ex(ctx, EVP_aes_128_gcm(), NULL, NULL, NULL))
+    {
+      ERR_print_errors_fp(stderr);
+      goto fail_encrypt;
+    }
+  }
+  else if (key_size == 256)
+  {
+    if (!EVP_EncryptInit_ex(ctx, EVP_aes_256_gcm(), NULL, NULL, NULL))
+    {
+      ERR_print_errors_fp(stderr);
+      goto fail_encrypt;
+    }
+  }
+
+  /* Initialise key and IV */
+  if (!EVP_EncryptInit_ex(ctx, NULL, NULL, session_key, iv))
+  {
+    ERR_print_errors_fp(stderr);
+    goto fail_encrypt;
+  }
+
+  if (!EVP_EncryptUpdate(ctx, NULL, &len, data, (int) data_len))
+  {
+    ERR_print_errors_fp(stderr);
+    goto fail_encrypt;
+  }
+
+  if (!EVP_EncryptFinal_ex(ctx, temp, &len))
+  {
+    ERR_print_errors_fp(stderr);
+    goto fail_encrypt;
+  }
+
+  /* get the tag */
+  if (!EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_GCM_GET_TAG, CRYPTO_HMAC_SIZE, tag))
+  {
+    ERR_print_errors_fp(stderr);
+    goto fail_encrypt;
+  }
+
+  /* clean up */
+  EVP_CIPHER_CTX_free(ctx);
+
+  return true;
+
+fail_encrypt:
+  EVP_CIPHER_CTX_free(ctx);
+fail_ctx_new:
+  return false;
+}
+
+static bool crypto_decrypt_data(uint32_t session_id, unsigned char *iv, DDS_Security_CryptoTransformKind transformation_kind, master_key_material *key_material, DDS_Security_OctetSeq *encrypted, DDS_Security_OctetSeq *decoded, unsigned char *tag)
+{
+  bool result = true;
+  EVP_CIPHER_CTX *ctx;
+  crypto_session_key_t session_key;
+  uint32_t key_size = crypto_get_key_size(CRYPTO_TRANSFORM_KIND(transformation_kind));
+  int len = 0;
+
+  if (!crypto_calculate_session_key_test(&session_key, session_id, key_material->master_salt, key_material->master_sender_key, key_material->transformation_kind))
+    return false;
+
+  /* create the cipher context */
+  ctx = EVP_CIPHER_CTX_new();
+  if (ctx)
+  {
+    if (key_size == 128)
+    {
+      if (!EVP_DecryptInit_ex(ctx, EVP_aes_128_gcm(), NULL, NULL, NULL))
+      {
+        ERR_print_errors_fp(stderr);
+        result = false;
+      }
+    }
+    else if (key_size == 256)
+    {
+      if (!EVP_DecryptInit_ex(ctx, EVP_aes_256_gcm(), NULL, NULL, NULL))
+      {
+        ERR_print_errors_fp(stderr);
+        result = false;
+      }
+    }
+  }
+
+  if (result)
+  {
+    if (!EVP_DecryptInit_ex(ctx, NULL, NULL, session_key.data, iv))
+    {
+      ERR_print_errors_fp(stderr);
+      result = false;
+    }
+  }
+
+  if (result)
+  {
+    if (decoded)
+    {
+      if (EVP_DecryptUpdate(ctx, decoded->_buffer, &len, encrypted->_buffer, (int) encrypted->_length))
+      {
+        decoded->_length = (uint32_t) len;
+      }
+      else
+      {
+        ERR_print_errors_fp(stderr);
+        result = false;
+      }
+    }
+    else
+    {
+      if (!EVP_DecryptUpdate(ctx, NULL, &len, encrypted->_buffer, (int) encrypted->_length))
+      {
+        ERR_print_errors_fp(stderr);
+        result = false;
+      }
+    }
+  }
+
+  if (result)
+  {
+    if (!EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_GCM_SET_TAG, CRYPTO_HMAC_SIZE, tag))
+    {
+      ERR_print_errors_fp(stderr);
+      result = false;
+    }
+  }
+
+  if (result)
+  {
+    if (decoded)
+    {
+      if (EVP_DecryptFinal_ex(ctx, decoded->_buffer + len, &len))
+      {
+        decoded->_length += (uint32_t) len;
+      }
+      else
+      {
+        ERR_print_errors_fp(stderr);
+        result = false;
+      }
+    }
+    else
+    {
+      unsigned char temp[32];
+      if (!EVP_DecryptFinal_ex(ctx, temp, &len))
+      {
+        ERR_print_errors_fp(stderr);
+        result = false;
+      }
+    }
+  }
+
+  if (ctx)
+    EVP_CIPHER_CTX_free(ctx);
+
+  return result;
+}
+
+static void prepare_endpoint_security_attributes_and_properties(DDS_Security_EndpointSecurityAttributes *attributes,
+                                                                DDS_Security_PropertySeq *properties,
+                                                                uint32_t transformation_kind,
+                                                                bool is_origin_authenticated)
+{
+  memset(attributes, 0, sizeof(DDS_Security_EndpointSecurityAttributes));
+  memset(properties, 0, sizeof(DDS_Security_PropertySeq));
+
+  attributes->is_discovery_protected = true;
+
+  properties->_maximum = properties->_length = 1;
+  properties->_buffer = ddsrt_malloc(sizeof(DDS_Security_Property_t));
+
+  properties->_buffer[0].name = ddsrt_strdup("dds.sec.crypto.keysize");
+  if (transformation_kind == CRYPTO_TRANSFORMATION_KIND_AES128_GCM || transformation_kind == CRYPTO_TRANSFORMATION_KIND_AES128_GMAC)
+  {
+    properties->_buffer[0].value = ddsrt_strdup("128");
+  }
+  else
+  {
+    properties->_buffer[0].value = ddsrt_strdup("256");
+  }
+
+  switch (transformation_kind)
+  {
+  case CRYPTO_TRANSFORMATION_KIND_AES128_GCM:
+  case CRYPTO_TRANSFORMATION_KIND_AES256_GCM:
+    attributes->is_submessage_protected = true;
+    attributes->plugin_endpoint_attributes |= DDS_SECURITY_PLUGIN_ENDPOINT_ATTRIBUTES_FLAG_IS_SUBMESSAGE_ENCRYPTED;
+    if (is_origin_authenticated)
+    {
+      attributes->plugin_endpoint_attributes |= DDS_SECURITY_PLUGIN_ENDPOINT_ATTRIBUTES_FLAG_IS_SUBMESSAGE_ORIGIN_AUTHENTICATED;
+    }
+    break;
+
+  case CRYPTO_TRANSFORMATION_KIND_AES256_GMAC:
+  case CRYPTO_TRANSFORMATION_KIND_AES128_GMAC:
+    attributes->is_submessage_protected = true;
+    if (is_origin_authenticated)
+    {
+      attributes->plugin_endpoint_attributes |= DDS_SECURITY_PLUGIN_ENDPOINT_ATTRIBUTES_FLAG_IS_SUBMESSAGE_ORIGIN_AUTHENTICATED;
+    }
+    break;
+
+  default:
+    assert(0);
+    break;
+  }
+}
+
+static session_key_material * get_datareader_session(DDS_Security_DatareaderCryptoHandle reader_crypto)
+{
+  local_datareader_crypto *reader_crypto_impl = (local_datareader_crypto *)reader_crypto;
+  return reader_crypto_impl->reader_session;
+}
+
+static master_key_material * get_datawriter_key_material(DDS_Security_DatawriterCryptoHandle writer_crypto)
+{
+  remote_datawriter_crypto *writer_crypto_impl = (remote_datawriter_crypto *)writer_crypto;
+  return writer_crypto_impl->reader2writer_key_material;
+}
+
+static void initialize_data_submessage(DDS_Security_OctetSeq *submsg)
+{
+  uint32_t length = sizeof(struct heartbeat);
+  unsigned char *buffer;
+
+  buffer = ddsrt_malloc(length);
+
+  memcpy(buffer, &heartbeat, length);
+
+  submsg->_length = submsg->_maximum = length;
+  submsg->_buffer = buffer;
+}
+
+static bool check_writer_sign(DDS_Security_DatareaderCryptoHandle writer_crypto, uint32_t session_id, uint32_t key_id, uint32_t key_size, unsigned char *init_vector, unsigned char *common_mac, unsigned char *hmac)
+{
+  master_key_material *keymat;
+  crypto_session_key_t key;
+  unsigned char md[CRYPTO_HMAC_SIZE];
+
+  keymat = get_datawriter_key_material(writer_crypto);
+  if (key_id != keymat->receiver_specific_key_id)
+  {
+    printf("check_writer_sign: key_id does not match\n");
+    return false;
+  }
+  else if (!calculate_receiver_specific_key_test(&key, session_id, keymat->master_salt, keymat->master_receiver_specific_key, keymat->transformation_kind))
+  {
+    printf("check_writer_sign: calculate key failed\n");
+    return false;
+  }
+  else if (!cipher_sign_data(key.data, key_size, init_vector, common_mac, CRYPTO_HMAC_SIZE, md))
+  {
+    return false;
+  }
+  else if (memcmp(hmac, md, CRYPTO_HMAC_SIZE) != 0)
+  {
+    printf("check_writer_sign: hmac incorrect\n");
+    return false;
+  }
+
+  return true;
+}
+
+static bool check_writer_signing(DDS_Security_DatareaderCryptoHandleSeq *list, struct crypto_footer *footer, uint32_t session_id, unsigned char *init_vector, uint32_t key_size)
+{
+  struct receiver_specific_mac *rmac;
+  uint32_t key_id;
+  uint32_t i;
+
+  if (footer->length != list->_length)
+  {
+    return false;
+  }
+
+  rmac = (struct receiver_specific_mac *)(footer + 1);
+
+  for (i = 0; i < list->_length; i++)
+  {
+    key_id = ddsrt_bswap4u(*(uint32_t *)rmac[i].receiver_mac_key_id);
+    if (!check_writer_sign(list->_buffer[i], session_id, key_id, key_size, init_vector, footer->common_mac, rmac[i].receiver_mac))
+    {
+      return false;
+    }
+  }
+
+  return true;
+}
+
+static void suite_encode_datareader_submessage_init(void)
+{
+  allocate_shared_secret();
+  initialize_heartbeat();
+  CU_ASSERT_FATAL ((plugins = load_plugins(
+                      NULL    /* Access Control */,
+                      NULL    /* Authentication */,
+                      &crypto /* Cryptograpy    */)) != NULL);
+  CU_ASSERT_EQUAL_FATAL (register_local_participant(), 0);
+  CU_ASSERT_EQUAL_FATAL (register_remote_participant(), 0);
+}
+
+static void suite_encode_datareader_submessage_fini(void)
+{
+  unregister_remote_participant();
+  unregister_local_participant();
+  deallocate_shared_secret();
+  unload_plugins(plugins);
+}
+
+static void encode_datareader_submessage_not_signed(uint32_t transformation_kind)
+{
+  DDS_Security_boolean result;
+  DDS_Security_DatareaderCryptoHandle reader_crypto;
+  DDS_Security_DatawriterCryptoHandle writer_crypto;
+  DDS_Security_DatawriterCryptoHandleSeq writer_list;
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  DDS_Security_OctetSeq plain_buffer;
+  DDS_Security_OctetSeq encoded_buffer;
+  DDS_Security_OctetSeq decoded_buffer;
+  DDS_Security_OctetSeq data;
+  session_key_material *session_keys;
+  struct crypto_header *header = NULL;
+  struct crypto_footer *footer = NULL;
+  uint32_t session_id;
+  DDS_Security_PropertySeq datareader_properties;
+  DDS_Security_EndpointSecurityAttributes datareader_security_attributes;
+  bool is_encrypted;
+
+  CU_ASSERT_FATAL(crypto != NULL);
+  CU_ASSERT_FATAL(crypto->crypto_transform != NULL);
+  CU_ASSERT_FATAL(crypto->crypto_transform->encode_datareader_submessage != NULL);
+
+  is_encrypted = (transformation_kind == CRYPTO_TRANSFORMATION_KIND_AES128_GCM || transformation_kind == CRYPTO_TRANSFORMATION_KIND_AES256_GCM);
+
+  prepare_endpoint_security_attributes_and_properties(&datareader_security_attributes, &datareader_properties, transformation_kind, false);
+
+  initialize_data_submessage(&plain_buffer);
+
+  reader_crypto = register_local_datareader(&datareader_security_attributes, &datareader_properties);
+  CU_ASSERT_FATAL(reader_crypto != 0);
+
+  session_keys = get_datareader_session(reader_crypto);
+
+  writer_crypto = register_remote_datawriter(reader_crypto);
+  CU_ASSERT_FATAL(writer_crypto != 0);
+
+  writer_list._length = writer_list._maximum = 1;
+  writer_list._buffer = DDS_Security_DatareaderCryptoHandleSeq_allocbuf(1);
+  writer_list._buffer[0] = writer_crypto;
+
+  /* Now call the function. */
+  result = crypto->crypto_transform->encode_datareader_submessage(
+      crypto->crypto_transform,
+      &encoded_buffer,
+      &plain_buffer,
+      reader_crypto,
+      &writer_list,
+      &exception);
+
+  if (!result)
+  {
+    printf("encode_datareader_submessage: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+
+  CU_ASSERT_FATAL(result);
+  CU_ASSERT(exception.code == 0);
+  CU_ASSERT(exception.message == NULL);
+
+  reset_exception(&exception);
+
+  result = check_encoded_data(&encoded_buffer, is_encrypted, &header, &footer, &data);
+  CU_ASSERT_FATAL(result);
+
+  CU_ASSERT(header->transform_identifier.transformation_kind[3] == transformation_kind);
+
+  session_id = ddsrt_bswap4u(*(uint32_t *)header->session_id);
+
+  if (is_encrypted)
+  {
+    decoded_buffer._buffer = ddsrt_malloc(plain_buffer._length);
+    decoded_buffer._length = 0;
+    decoded_buffer._maximum = plain_buffer._length;
+
+    result = crypto_decrypt_data(session_id, &header->session_id[0], header->transform_identifier.transformation_kind,
+                                 session_keys->master_key_material, &data, &decoded_buffer, footer->common_mac);
+
+    if (!result)
+    {
+      printf("Decode failed\n");
+    }
+
+    CU_ASSERT_FATAL(result);
+
+    CU_ASSERT(memcmp(plain_buffer._buffer, decoded_buffer._buffer, plain_buffer._length) == 0);
+
+    DDS_Security_OctetSeq_deinit((&decoded_buffer));
+  }
+  else
+  {
+    result = crypto_decrypt_data(session_id, &header->session_id[0], header->transform_identifier.transformation_kind,
+                                 session_keys->master_key_material, &data, NULL, footer->common_mac);
+    if (!result)
+    {
+      printf("Decode failed\n");
+    }
+
+    CU_ASSERT_FATAL(result);
+
+    CU_ASSERT(memcmp(plain_buffer._buffer, data._buffer, plain_buffer._length) == 0);
+  }
+
+  unregister_datawriter(writer_list._buffer[0]);
+  writer_list._buffer[0] = 0;
+
+  unregister_datareader(reader_crypto);
+
+  DDS_Security_OctetSeq_deinit((&plain_buffer));
+  DDS_Security_OctetSeq_deinit((&encoded_buffer));
+  DDS_Security_DatawriterCryptoHandleSeq_deinit(&writer_list);
+
+  ddsrt_free(footer);
+  ddsrt_free(header);
+
+  DDS_Security_PropertySeq_deinit(&datareader_properties);
+}
+
+CU_Test(ddssec_builtin_encode_datareader_submessage, encode_256, .init = suite_encode_datareader_submessage_init, .fini = suite_encode_datareader_submessage_fini)
+{
+  encode_datareader_submessage_not_signed(CRYPTO_TRANSFORMATION_KIND_AES256_GCM);
+}
+
+CU_Test(ddssec_builtin_encode_datareader_submessage, encode_128, .init = suite_encode_datareader_submessage_init, .fini = suite_encode_datareader_submessage_fini)
+{
+  encode_datareader_submessage_not_signed(CRYPTO_TRANSFORMATION_KIND_AES128_GCM);
+}
+
+CU_Test(ddssec_builtin_encode_datareader_submessage, no_encode_256, .init = suite_encode_datareader_submessage_init, .fini = suite_encode_datareader_submessage_fini)
+{
+  encode_datareader_submessage_not_signed(CRYPTO_TRANSFORMATION_KIND_AES256_GMAC);
+}
+
+CU_Test(ddssec_builtin_encode_datareader_submessage, no_encode_128, .init = suite_encode_datareader_submessage_init, .fini = suite_encode_datareader_submessage_fini)
+{
+  encode_datareader_submessage_not_signed(CRYPTO_TRANSFORMATION_KIND_AES128_GMAC);
+}
+
+static void encode_datareader_submessage_sign(uint32_t transformation_kind)
+{
+  const uint32_t WRITERS_CNT = 4u;
+  DDS_Security_boolean result;
+  DDS_Security_DatareaderCryptoHandle reader_crypto;
+  DDS_Security_DatawriterCryptoHandle writer_crypto;
+  DDS_Security_DatawriterCryptoHandleSeq writer_list;
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  DDS_Security_OctetSeq plain_buffer;
+  DDS_Security_OctetSeq encoded_buffer;
+  DDS_Security_OctetSeq decoded_buffer;
+  DDS_Security_OctetSeq data;
+  DDS_Security_OctetSeq *buffer;
+  session_key_material *session_keys;
+  struct crypto_header *header = NULL;
+  struct crypto_footer *footer = NULL;
+  uint32_t session_id;
+  uint32_t i;
+  DDS_Security_PropertySeq datareader_properties;
+  DDS_Security_EndpointSecurityAttributes datareader_security_attributes;
+  bool is_encrypted;
+
+  CU_ASSERT_FATAL(crypto != NULL);
+  CU_ASSERT_FATAL(crypto->crypto_transform != NULL);
+  CU_ASSERT_FATAL(crypto->crypto_transform->encode_datareader_submessage != NULL);
+
+  if (transformation_kind == CRYPTO_TRANSFORMATION_KIND_AES128_GCM || transformation_kind == CRYPTO_TRANSFORMATION_KIND_AES256_GCM)
+  {
+    is_encrypted = true;
+  }
+  else
+  {
+    is_encrypted = false;
+  }
+
+  prepare_endpoint_security_attributes_and_properties(&datareader_security_attributes, &datareader_properties, transformation_kind, true);
+
+  initialize_data_submessage(&plain_buffer);
+
+  reader_crypto = register_local_datareader(&datareader_security_attributes, &datareader_properties);
+  CU_ASSERT_FATAL(reader_crypto != 0);
+
+  session_keys = get_datareader_session(reader_crypto);
+
+  writer_list._length = writer_list._maximum = WRITERS_CNT;
+  writer_list._buffer = DDS_Security_DatareaderCryptoHandleSeq_allocbuf(4);
+  for (i = 0; i < WRITERS_CNT; i++)
+  {
+    writer_crypto = register_remote_datawriter(reader_crypto);
+    CU_ASSERT_FATAL(writer_crypto != 0);
+    writer_list._buffer[i] = writer_crypto;
+  }
+
+  /* Now call the function. */
+
+  buffer = &plain_buffer;
+  result = crypto->crypto_transform->encode_datareader_submessage(
+      crypto->crypto_transform,
+      &encoded_buffer,
+      buffer,
+      reader_crypto,
+      &writer_list,
+      &exception);
+
+  if (!result)
+  {
+    printf("writer_crypto: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+
+  CU_ASSERT_FATAL(result);
+  CU_ASSERT(exception.code == 0);
+  CU_ASSERT(exception.message == NULL);
+
+  reset_exception(&exception);
+  buffer = NULL;
+
+  result = check_encoded_data(&encoded_buffer, is_encrypted, &header, &footer, &data);
+  CU_ASSERT_FATAL(result);
+
+  CU_ASSERT(header->transform_identifier.transformation_kind[3] == transformation_kind);
+
+  session_id = ddsrt_bswap4u(*(uint32_t *)header->session_id);
+
+  if (is_encrypted)
+  {
+    decoded_buffer._buffer = ddsrt_malloc(plain_buffer._length);
+    decoded_buffer._length = 0;
+    decoded_buffer._maximum = plain_buffer._length;
+
+    result = crypto_decrypt_data(session_id, &header->session_id[0], header->transform_identifier.transformation_kind,
+                                 session_keys->master_key_material, &data, &decoded_buffer, footer->common_mac);
+    if (!result)
+    {
+      printf("Decode failed\n");
+    }
+
+    CU_ASSERT_FATAL(result);
+
+    CU_ASSERT(memcmp(plain_buffer._buffer, decoded_buffer._buffer, plain_buffer._length) == 0);
+
+    DDS_Security_OctetSeq_deinit((&decoded_buffer));
+  }
+  else
+  {
+    result = crypto_decrypt_data(session_id, header->session_id, header->transform_identifier.transformation_kind,
+                                 session_keys->master_key_material, &data, NULL, footer->common_mac);
+
+    if (!result)
+    {
+      printf("Decode failed\n");
+    }
+
+    CU_ASSERT_FATAL(result);
+    CU_ASSERT(memcmp(plain_buffer._buffer, data._buffer, plain_buffer._length) == 0);
+  }
+
+  printf("num hmacs = %u\n", footer->length);
+
+  CU_ASSERT(check_writer_signing(&writer_list, footer, session_id, header->session_id, session_keys->key_size));
+
+  for (i = 0; i < WRITERS_CNT; i++)
+  {
+    unregister_datawriter(writer_list._buffer[i]);
+    writer_list._buffer[i] = 0;
+  }
+
+  unregister_datareader(reader_crypto);
+
+  DDS_Security_OctetSeq_deinit((&plain_buffer));
+  DDS_Security_OctetSeq_deinit((&encoded_buffer));
+  DDS_Security_DatareaderCryptoHandleSeq_deinit(&writer_list);
+
+  ddsrt_free(footer);
+  ddsrt_free(header);
+
+  DDS_Security_PropertySeq_deinit(&datareader_properties);
+}
+
+CU_Test(ddssec_builtin_encode_datareader_submessage, encode_sign_256, .init = suite_encode_datareader_submessage_init, .fini = suite_encode_datareader_submessage_fini)
+{
+  encode_datareader_submessage_sign(CRYPTO_TRANSFORMATION_KIND_AES256_GCM);
+}
+
+CU_Test(ddssec_builtin_encode_datareader_submessage, encode_sign_128, .init = suite_encode_datareader_submessage_init, .fini = suite_encode_datareader_submessage_fini)
+{
+  encode_datareader_submessage_sign(CRYPTO_TRANSFORMATION_KIND_AES128_GCM);
+}
+
+CU_Test(ddssec_builtin_encode_datareader_submessage, no_encode_sign_256, .init = suite_encode_datareader_submessage_init, .fini = suite_encode_datareader_submessage_fini)
+{
+  encode_datareader_submessage_sign(CRYPTO_TRANSFORMATION_KIND_AES256_GMAC);
+}
+
+CU_Test(ddssec_builtin_encode_datareader_submessage, no_encode_sign_128, .init = suite_encode_datareader_submessage_init, .fini = suite_encode_datareader_submessage_fini)
+{
+  encode_datareader_submessage_sign(CRYPTO_TRANSFORMATION_KIND_AES128_GMAC);
+}
+
+CU_Test(ddssec_builtin_encode_datareader_submessage, invalid_args, .init = suite_encode_datareader_submessage_init, .fini = suite_encode_datareader_submessage_fini)
+{
+  DDS_Security_boolean result;
+  DDS_Security_DatawriterCryptoHandle reader_crypto;
+  DDS_Security_DatareaderCryptoHandle writer_crypto;
+  DDS_Security_DatareaderCryptoHandleSeq writer_list;
+  DDS_Security_DatareaderCryptoHandleSeq empty_writer_list;
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  DDS_Security_OctetSeq plain_buffer;
+  DDS_Security_OctetSeq encoded_buffer;
+  DDS_Security_PropertySeq datareader_properties;
+  DDS_Security_EndpointSecurityAttributes datareader_security_attributes;
+
+  CU_ASSERT_FATAL(crypto != NULL);
+  CU_ASSERT_FATAL(crypto->crypto_transform != NULL);
+  CU_ASSERT_FATAL(crypto->crypto_transform->encode_datareader_submessage != NULL);
+
+  prepare_endpoint_security_attributes_and_properties(&datareader_security_attributes, &datareader_properties, CRYPTO_TRANSFORMATION_KIND_AES256_GCM, true);
+
+  initialize_data_submessage(&plain_buffer);
+
+  memset(&empty_writer_list, 0, sizeof(empty_writer_list));
+
+  reader_crypto = register_local_datareader(&datareader_security_attributes, &datareader_properties);
+  CU_ASSERT_FATAL(reader_crypto != 0);
+
+  writer_crypto = register_remote_datawriter(reader_crypto);
+  CU_ASSERT_FATAL(writer_crypto != 0);
+
+  writer_list._length = writer_list._maximum = 1;
+  writer_list._buffer = DDS_Security_DatareaderCryptoHandleSeq_allocbuf(1);
+  writer_list._buffer[0] = writer_crypto;
+
+  /* encoded_buffer NULL */
+  result = crypto->crypto_transform->encode_datareader_submessage(
+      crypto->crypto_transform,
+      NULL,
+      &plain_buffer,
+      reader_crypto,
+      &writer_list,
+      &exception);
+
+  if (!result)
+  {
+    printf("encode_datareader_submessage: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+
+  CU_ASSERT(!result);
+  CU_ASSERT(exception.code != 0);
+  CU_ASSERT(exception.message != NULL);
+
+  reset_exception(&exception);
+
+  /* plain_buffer NULL */
+  result = crypto->crypto_transform->encode_datareader_submessage(
+      crypto->crypto_transform,
+      &encoded_buffer,
+      NULL,
+      writer_crypto,
+      &writer_list,
+      &exception);
+
+  if (!result)
+  {
+    printf("encode_datareader_submessage: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+
+  CU_ASSERT(!result);
+  CU_ASSERT(exception.code != 0);
+  CU_ASSERT(exception.message != NULL);
+
+  reset_exception(&exception);
+
+  /* writer crypto 0 */
+  result = crypto->crypto_transform->encode_datareader_submessage(
+      crypto->crypto_transform,
+      &encoded_buffer,
+      &plain_buffer,
+      0,
+      &writer_list,
+      &exception);
+
+  if (!result)
+  {
+    printf("encode_datareader_submessage: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+
+  CU_ASSERT(!result);
+  CU_ASSERT(exception.code != 0);
+  CU_ASSERT(exception.message != NULL);
+
+  reset_exception(&exception);
+
+  /* writer crypto unknown */
+  result = crypto->crypto_transform->encode_datareader_submessage(
+      crypto->crypto_transform,
+      &encoded_buffer,
+      &plain_buffer,
+      1,
+      &writer_list,
+      &exception);
+
+  if (!result)
+  {
+    printf("encode_datareader_submessage: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+
+  CU_ASSERT(!result);
+  CU_ASSERT(exception.code != 0);
+  CU_ASSERT(exception.message != NULL);
+
+  reset_exception(&exception);
+
+  /* reader crypto list NULL*/
+  result = crypto->crypto_transform->encode_datareader_submessage(
+      crypto->crypto_transform,
+      &encoded_buffer,
+      &plain_buffer,
+      writer_crypto,
+      NULL,
+      &exception);
+
+  if (!result)
+  {
+    printf("encode_datareader_submessage: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+
+  CU_ASSERT(!result);
+  CU_ASSERT(exception.code != 0);
+  CU_ASSERT(exception.message != NULL);
+
+  reset_exception(&exception);
+
+  /* empty reader crypto list */
+  result = crypto->crypto_transform->encode_datareader_submessage(
+      crypto->crypto_transform,
+      &encoded_buffer,
+      &plain_buffer,
+      writer_crypto,
+      &empty_writer_list,
+      &exception);
+
+  if (!result)
+  {
+    printf("encode_datareader_submessage: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+
+  CU_ASSERT(!result);
+  CU_ASSERT(exception.code != 0);
+  CU_ASSERT(exception.message != NULL);
+
+  reset_exception(&exception);
+
+  /* writer crypto list with invalid writer crypto */
+  writer_list._buffer[0] = 0;
+  result = crypto->crypto_transform->encode_datareader_submessage(
+      crypto->crypto_transform,
+      &encoded_buffer,
+      &plain_buffer,
+      writer_crypto,
+      &writer_list,
+      &exception);
+
+  if (!result)
+  {
+    printf("encode_datareader_submessage: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+
+  CU_ASSERT(!result);
+  CU_ASSERT(exception.code != 0);
+  CU_ASSERT(exception.message != NULL);
+
+  reset_exception(&exception);
+
+  /* writer crypto list with unknown writer crypto*/
+  writer_list._buffer[0] = 1;
+  result = crypto->crypto_transform->encode_datareader_submessage(
+      crypto->crypto_transform,
+      &encoded_buffer,
+      &plain_buffer,
+      writer_crypto,
+      &writer_list,
+      &exception);
+
+  if (!result)
+  {
+    printf("encode_datareader_submessage: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+
+  unregister_datawriter(writer_list._buffer[0]);
+  writer_list._buffer[0] = 0;
+
+  unregister_datareader(reader_crypto);
+
+  CU_ASSERT(!result);
+  CU_ASSERT(exception.code != 0);
+  CU_ASSERT(exception.message != NULL);
+
+  reset_exception(&exception);
+
+  DDS_Security_OctetSeq_deinit((&plain_buffer));
+  DDS_Security_DatawriterCryptoHandleSeq_deinit(&writer_list);
+  DDS_Security_PropertySeq_deinit(&datareader_properties);
+}
+
diff --git a/src/security/builtin_plugins/tests/encode_datawriter_submessage/src/encode_datawriter_submessage_utests.c b/src/security/builtin_plugins/tests/encode_datawriter_submessage/src/encode_datawriter_submessage_utests.c
new file mode 100644
index 0000000..e4c7428
--- /dev/null
+++ b/src/security/builtin_plugins/tests/encode_datawriter_submessage/src/encode_datawriter_submessage_utests.c
@@ -0,0 +1,1348 @@
+/*
+ * Copyright(c) 2006 to 2019 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+#include <assert.h>
+#include <openssl/evp.h>
+#include <openssl/hmac.h>
+#include <openssl/bio.h>
+#include <openssl/err.h>
+
+#include "dds/ddsrt/bswap.h"
+#include "dds/ddsrt/endian.h"
+#include "dds/ddsrt/heap.h"
+#include "dds/ddsrt/string.h"
+#include "dds/ddsrt/types.h"
+#include "dds/ddsrt/environ.h"
+#include "dds/security/dds_security_api.h"
+#include "dds/security/core/dds_security_serialize.h"
+#include "dds/security/core/dds_security_utils.h"
+#include "dds/security/core/shared_secret.h"
+#include "CUnit/CUnit.h"
+#include "CUnit/Test.h"
+#include "common/src/loader.h"
+#include "common/src/crypto_helper.h"
+#include "crypto_objects.h"
+#include "crypto_utils.h"
+
+#define TEST_SHARED_SECRET_SIZE 32
+
+static struct plugins_hdl *plugins = NULL;
+static dds_security_cryptography *crypto = NULL;
+
+static DDS_Security_IdentityHandle local_participant_identity = 1;
+static DDS_Security_IdentityHandle remote_participant_identity = 2;
+
+static DDS_Security_ParticipantCryptoHandle local_particpant_crypto = 0;
+static DDS_Security_ParticipantCryptoHandle remote_particpant_crypto = 0;
+
+static DDS_Security_SharedSecretHandleImpl *shared_secret_handle_impl = NULL;
+static DDS_Security_SharedSecretHandle shared_secret_handle;
+
+static const char *sample_test_data =
+    "ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789abcdefghijklmnopqrstuvwxyz"
+    "ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789abcdefghijklmnopqrstuvwxyz"
+    "ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789abcdefghijklmnopqrstuvwxyz"
+    "ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789abcdefghijklmnopqrstuvwxy";
+
+struct submsg_header
+{
+  unsigned char id;
+  unsigned char flags;
+  uint16_t length;
+};
+
+struct crypto_header
+{
+  struct CryptoTransformIdentifier transform_identifier;
+  unsigned char session_id[4];
+  unsigned char init_vector_suffix[8];
+};
+
+struct crypto_footer
+{
+  unsigned char common_mac[16];
+  uint32_t length;
+};
+
+struct receiver_specific_mac
+{
+  DDS_Security_CryptoTransformKeyId receiver_mac_key_id;
+  unsigned char receiver_mac[CRYPTO_HMAC_SIZE];
+};
+
+struct encrypted_data
+{
+  uint32_t length;
+  unsigned char data[1];
+};
+
+static void reset_exception(DDS_Security_SecurityException *ex)
+{
+  ex->code = 0;
+  ex->minor_code = 0;
+  ddsrt_free(ex->message);
+  ex->message = NULL;
+}
+
+static void allocate_shared_secret(void)
+{
+  int32_t i;
+
+  shared_secret_handle_impl = ddsrt_malloc(sizeof(DDS_Security_SharedSecretHandleImpl));
+
+  shared_secret_handle_impl->shared_secret = ddsrt_malloc(TEST_SHARED_SECRET_SIZE * sizeof(unsigned char));
+  shared_secret_handle_impl->shared_secret_size = TEST_SHARED_SECRET_SIZE;
+
+  for (i = 0; i < shared_secret_handle_impl->shared_secret_size; i++)
+  {
+    shared_secret_handle_impl->shared_secret[i] = (unsigned char)(i % 20);
+  }
+
+  for (i = 0; i < 32; i++)
+  {
+    shared_secret_handle_impl->challenge1[i] = (unsigned char)(i % 15);
+    shared_secret_handle_impl->challenge2[i] = (unsigned char)(i % 12);
+  }
+
+  shared_secret_handle = (DDS_Security_SharedSecretHandle)shared_secret_handle_impl;
+}
+
+static void deallocate_shared_secret(void)
+{
+  ddsrt_free(shared_secret_handle_impl->shared_secret);
+  ddsrt_free(shared_secret_handle_impl);
+}
+
+static int register_local_participant(void)
+{
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  DDS_Security_PermissionsHandle participant_permissions = 3; //valid dummy value
+  DDS_Security_PropertySeq participant_properties;
+  DDS_Security_ParticipantSecurityAttributes participant_security_attributes;
+
+  memset(&participant_properties, 0, sizeof(participant_properties));
+  memset(&participant_security_attributes, 0, sizeof(participant_security_attributes));
+
+  local_particpant_crypto =
+      crypto->crypto_key_factory->register_local_participant(
+          crypto->crypto_key_factory,
+          local_participant_identity,
+          participant_permissions,
+          &participant_properties,
+          &participant_security_attributes,
+          &exception);
+
+  if (local_particpant_crypto == 0)
+  {
+    printf("register_local_participant: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+
+  return local_particpant_crypto ? 0 : -1;
+}
+
+static void unregister_local_participant(void)
+{
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  if (local_particpant_crypto)
+  {
+    crypto->crypto_key_factory->unregister_participant(crypto->crypto_key_factory, local_particpant_crypto, &exception);
+    reset_exception(&exception);
+  }
+}
+
+static int register_remote_participant(void)
+{
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  DDS_Security_PermissionsHandle remote_participant_permissions = 5;
+
+  remote_particpant_crypto =
+      crypto->crypto_key_factory->register_matched_remote_participant(
+          crypto->crypto_key_factory,
+          local_particpant_crypto,
+          remote_participant_identity,
+          remote_participant_permissions,
+          shared_secret_handle,
+          &exception);
+
+  if (remote_particpant_crypto == 0)
+  {
+    printf("register_matched_remote_participant: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+
+  return remote_particpant_crypto ? 0 : -1;
+}
+
+static void prepare_endpoint_security_attributes_and_properties(DDS_Security_EndpointSecurityAttributes *attributes,
+                                                                DDS_Security_PropertySeq *properties,
+                                                                DDS_Security_CryptoTransformKind_Enum transformation_kind,
+                                                                bool is_origin_authenticated)
+{
+  memset(attributes, 0, sizeof(DDS_Security_EndpointSecurityAttributes));
+  memset(properties, 0, sizeof(DDS_Security_PropertySeq));
+
+  attributes->is_discovery_protected = true;
+
+  properties->_maximum = properties->_length = 1;
+  properties->_buffer = ddsrt_malloc(sizeof(DDS_Security_Property_t));
+
+  properties->_buffer[0].name = ddsrt_strdup("dds.sec.crypto.keysize");
+  if (transformation_kind == CRYPTO_TRANSFORMATION_KIND_AES128_GCM || transformation_kind == CRYPTO_TRANSFORMATION_KIND_AES128_GMAC)
+  {
+    properties->_buffer[0].value = ddsrt_strdup("128");
+  }
+  else
+  {
+    properties->_buffer[0].value = ddsrt_strdup("256");
+  }
+
+  switch (transformation_kind)
+  {
+  case CRYPTO_TRANSFORMATION_KIND_AES128_GCM:
+  case CRYPTO_TRANSFORMATION_KIND_AES256_GCM:
+    attributes->is_submessage_protected = true;
+    attributes->plugin_endpoint_attributes |= DDS_SECURITY_PLUGIN_ENDPOINT_ATTRIBUTES_FLAG_IS_SUBMESSAGE_ENCRYPTED;
+    if (is_origin_authenticated)
+    {
+      attributes->plugin_endpoint_attributes |= DDS_SECURITY_PLUGIN_ENDPOINT_ATTRIBUTES_FLAG_IS_SUBMESSAGE_ORIGIN_AUTHENTICATED;
+    }
+    break;
+
+  case CRYPTO_TRANSFORMATION_KIND_AES256_GMAC:
+  case CRYPTO_TRANSFORMATION_KIND_AES128_GMAC:
+    attributes->is_submessage_protected = true;
+    if (is_origin_authenticated)
+    {
+      attributes->plugin_endpoint_attributes |= DDS_SECURITY_PLUGIN_ENDPOINT_ATTRIBUTES_FLAG_IS_SUBMESSAGE_ORIGIN_AUTHENTICATED;
+    }
+    break;
+
+  default:
+    assert(0);
+    break;
+  }
+}
+
+static void unregister_remote_participant(void)
+{
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  if (remote_particpant_crypto)
+  {
+    crypto->crypto_key_factory->unregister_participant(crypto->crypto_key_factory, remote_particpant_crypto, &exception);
+    reset_exception(&exception);
+  }
+}
+
+static DDS_Security_DatawriterCryptoHandle register_local_datawriter(DDS_Security_EndpointSecurityAttributes *datawriter_security_attributes, DDS_Security_PropertySeq *datawriter_properties)
+{
+  DDS_Security_DatawriterCryptoHandle writer_crypto;
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+
+  writer_crypto =
+      crypto->crypto_key_factory->register_local_datawriter(
+          crypto->crypto_key_factory,
+          local_particpant_crypto,
+          datawriter_properties,
+          datawriter_security_attributes,
+          &exception);
+
+  if (writer_crypto == 0)
+  {
+    printf("register_local_datawriter: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+
+  return writer_crypto;
+}
+
+static void unregister_datawriter(DDS_Security_DatawriterCryptoHandle writer_crypto)
+{
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  if (writer_crypto)
+  {
+    crypto->crypto_key_factory->unregister_datawriter(crypto->crypto_key_factory, writer_crypto, &exception);
+    reset_exception(&exception);
+  }
+}
+
+static DDS_Security_DatareaderCryptoHandle register_remote_datareader(DDS_Security_DatawriterCryptoHandle writer_crypto)
+{
+  DDS_Security_DatareaderCryptoHandle reader_crypto;
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  DDS_Security_PropertySeq datawriter_properties;
+
+  memset(&datawriter_properties, 0, sizeof(datawriter_properties));
+
+  reader_crypto =
+      crypto->crypto_key_factory->register_matched_remote_datareader(
+          crypto->crypto_key_factory,
+          writer_crypto,
+          remote_particpant_crypto,
+          shared_secret_handle,
+          true,
+          &exception);
+
+  if (reader_crypto == 0)
+  {
+    printf("register_matched_remote_datareader: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+
+  return reader_crypto;
+}
+
+static void unregister_datareader(DDS_Security_DatareaderCryptoHandle reader_crypto)
+{
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  if (reader_crypto)
+  {
+    crypto->crypto_key_factory->unregister_datareader(crypto->crypto_key_factory, reader_crypto, &exception);
+    reset_exception(&exception);
+  }
+}
+
+static bool read_prefix(unsigned char **ptr, uint32_t *remain)
+{
+  struct submsg_header *prefix;
+  uint32_t hlen;
+  int swap;
+
+  if (*remain < sizeof(struct submsg_header))
+  {
+    printf("check_encoded_data: prefix missing\n");
+    return false;
+  }
+
+  prefix = (struct submsg_header *)(*ptr);
+
+  if (prefix->id != SMID_SEC_PREFIX_KIND)
+  {
+    printf("check_encoded_data: prefix incorrect smid 0x%x02\n", prefix->id);
+    return false;
+  }
+
+  if (prefix->flags & 0x01)
+    swap = (DDSRT_ENDIAN != DDSRT_LITTLE_ENDIAN);
+  else
+    swap = (DDSRT_ENDIAN == DDSRT_LITTLE_ENDIAN);
+
+  hlen = swap ? ddsrt_bswap2u(prefix->length) : prefix->length;
+
+  if (hlen != sizeof(struct crypto_header))
+  {
+    printf("check_encoded_data: crypto_header missing\n");
+    return false;
+  }
+
+  *ptr += sizeof(struct submsg_header);
+  *remain -= (uint32_t)sizeof(struct submsg_header);
+
+  return true;
+}
+
+static bool read_header(struct crypto_header **header, unsigned char **ptr, uint32_t *remain)
+{
+  if (*remain < sizeof(struct crypto_header))
+  {
+    printf("check_encoded_data: crypto_header too short\n");
+    return false;
+  }
+
+  *header = ddsrt_malloc(sizeof(struct crypto_header));
+  memcpy(*header, *ptr, sizeof(struct crypto_header));
+
+  *ptr += sizeof(struct crypto_header);
+  *remain -= (uint32_t)sizeof(struct crypto_header);
+
+  return true;
+}
+
+static bool read_body(DDS_Security_OctetSeq *contents, bool encrypted, unsigned char **ptr, uint32_t *remain)
+{
+  struct submsg_header *body;
+  uint32_t hlen, clen;
+  int swap;
+
+  if (*remain < sizeof(struct submsg_header))
+  {
+    return false;
+  }
+
+  body = (struct submsg_header *)(*ptr);
+
+  if (body->flags & 0x01)
+    swap = (DDSRT_ENDIAN != DDSRT_LITTLE_ENDIAN);
+  else
+    swap = (DDSRT_ENDIAN == DDSRT_LITTLE_ENDIAN);
+
+  hlen = swap ? ddsrt_bswap2u(body->length) : body->length;
+
+  if (encrypted)
+  {
+    struct encrypted_data *enc;
+
+    if (body->id != SMID_SEC_BODY_KIND)
+    {
+      printf("check_encoded_data: submessage SEC_BODY missing\n");
+      return false;
+    }
+    enc = (struct encrypted_data *)(body + 1);
+    clen = ddsrt_fromBE4u(enc->length);
+
+    contents->_length = contents->_maximum = clen;
+    contents->_buffer = &enc->data[0];
+  }
+  else
+  {
+    if (body->id == SMID_SEC_BODY_KIND)
+    {
+      printf("check_encoded_data: submessage SEC_BODY not expected\n");
+      return false;
+    }
+    clen = swap ? ddsrt_bswap2u(body->length) : body->length;
+    clen += (uint32_t)sizeof(struct submsg_header);
+
+    contents->_length = contents->_maximum = clen;
+    contents->_buffer = *ptr;
+  }
+  *ptr += sizeof(struct submsg_header) + hlen;
+  *remain -= (uint32_t)sizeof(struct submsg_header) + hlen;
+
+  return true;
+}
+
+static bool read_postfix(unsigned char **ptr,uint32_t *remain)
+{
+  struct submsg_header *postfix;
+
+  if (*remain < sizeof(struct submsg_header))
+  {
+    printf("check_encoded_data: postfix missing\n");
+    return false;
+  }
+
+  postfix = (struct submsg_header *)(*ptr);
+
+  if (postfix->id != SMID_SEC_POSTFIX_KIND)
+  {
+    printf("check_encoded_data: postfix invalid smid\n");
+    return false;
+  }
+
+  *ptr += sizeof(struct submsg_header);
+  *remain -= (uint32_t)sizeof(struct submsg_header);
+
+  return true;
+}
+
+static bool read_footer(struct crypto_footer **footer, unsigned char **ptr, uint32_t *remain)
+{
+  if (*remain < CRYPTO_HMAC_SIZE + sizeof(uint32_t))
+  {
+    printf("check_encoded_data: crypto_footer incorrect size\n");
+    return false;
+  }
+
+  *footer = ddsrt_malloc(*remain);
+  memcpy(*footer, *ptr, *remain);
+
+  /* length of reader specific macs is in BIG-ENDIAN format */
+  (*footer)->length = ddsrt_fromBE4u((*footer)->length);
+
+  return true;
+}
+
+static bool check_encoded_data(DDS_Security_OctetSeq *data, bool encrypted, struct crypto_header **header, struct crypto_footer **footer, DDS_Security_OctetSeq *contents)
+{
+  bool result = true;
+  unsigned char *ptr = data->_buffer;
+  uint32_t remain = data->_length;
+
+  result = read_prefix(&ptr, &remain);
+  if (result)
+    result = read_header(header, &ptr, &remain);
+  if (result)
+    result = read_body(contents, encrypted, &ptr, &remain);
+  if (result)
+    result = read_postfix(&ptr, &remain);
+  if (result)
+    result = read_footer(footer, &ptr, &remain);
+
+  return result;
+}
+
+static bool cipher_sign_data(const unsigned char *session_key, uint32_t key_size, const unsigned char *iv, const unsigned char *data, uint32_t data_len, unsigned char *tag)
+{
+  EVP_CIPHER_CTX *ctx;
+  unsigned char temp[32];
+  int len;
+
+  /* create the cipher context */
+  ctx = EVP_CIPHER_CTX_new();
+  if (!ctx)
+  {
+    ERR_print_errors_fp(stderr);
+    goto fail_ctx_new;
+  }
+
+  /* initialize the cipher and set to AES GCM */
+  if (key_size == 128)
+  {
+    if (!EVP_EncryptInit_ex(ctx, EVP_aes_128_gcm(), NULL, NULL, NULL))
+    {
+      ERR_print_errors_fp(stderr);
+      goto fail_encrypt;
+    }
+  }
+  else if (key_size == 256)
+  {
+    if (!EVP_EncryptInit_ex(ctx, EVP_aes_256_gcm(), NULL, NULL, NULL))
+    {
+      ERR_print_errors_fp(stderr);
+      goto fail_encrypt;
+    }
+  }
+
+  /* Initialise key and IV */
+  if (!EVP_EncryptInit_ex(ctx, NULL, NULL, session_key, iv))
+  {
+    ERR_print_errors_fp(stderr);
+    goto fail_encrypt;
+  }
+
+  if (!EVP_EncryptUpdate(ctx, NULL, &len, data, (int)data_len))
+  {
+    ERR_print_errors_fp(stderr);
+    goto fail_encrypt;
+  }
+
+  if (!EVP_EncryptFinal_ex(ctx, temp, &len))
+  {
+    ERR_print_errors_fp(stderr);
+    goto fail_encrypt;
+  }
+
+  /* get the tag */
+  if (!EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_GCM_GET_TAG, CRYPTO_HMAC_SIZE, tag))
+  {
+    ERR_print_errors_fp(stderr);
+    goto fail_encrypt;
+  }
+
+  /* clean up */
+  EVP_CIPHER_CTX_free(ctx);
+
+  return true;
+
+fail_encrypt:
+  EVP_CIPHER_CTX_free(ctx);
+fail_ctx_new:
+  return false;
+}
+
+static bool crypto_decrypt_data(uint32_t session_id, unsigned char *iv, DDS_Security_CryptoTransformKind transformation_kind, master_key_material *key_material, DDS_Security_OctetSeq *encrypted, DDS_Security_OctetSeq *decoded, unsigned char *tag)
+{
+  bool result = true;
+  EVP_CIPHER_CTX *ctx;
+  crypto_session_key_t session_key;
+  uint32_t key_size = crypto_get_key_size(CRYPTO_TRANSFORM_KIND(transformation_kind));
+  int len = 0;
+
+  if (!crypto_calculate_session_key_test(&session_key, session_id, key_material->master_salt, key_material->master_sender_key, key_material->transformation_kind))
+    return false;
+
+  /* create the cipher context */
+  ctx = EVP_CIPHER_CTX_new();
+  if (ctx)
+  {
+    if (key_size == 128)
+    {
+      if (!EVP_DecryptInit_ex(ctx, EVP_aes_128_gcm(), NULL, NULL, NULL))
+      {
+        ERR_print_errors_fp(stderr);
+        result = false;
+      }
+    }
+    else if (key_size == 256)
+    {
+      if (!EVP_DecryptInit_ex(ctx, EVP_aes_256_gcm(), NULL, NULL, NULL))
+      {
+        ERR_print_errors_fp(stderr);
+        result = false;
+      }
+    }
+  }
+
+  if (result)
+  {
+    if (!EVP_DecryptInit_ex(ctx, NULL, NULL, session_key.data, iv))
+    {
+      ERR_print_errors_fp(stderr);
+      result = false;
+    }
+  }
+
+  if (result)
+  {
+    if (decoded)
+    {
+      if (EVP_DecryptUpdate(ctx, decoded->_buffer, &len, encrypted->_buffer, (int)encrypted->_length))
+      {
+        decoded->_length = (uint32_t) len;
+      }
+      else
+      {
+        ERR_print_errors_fp(stderr);
+        result = false;
+      }
+    }
+    else
+    {
+      if (!EVP_DecryptUpdate(ctx, NULL, &len, encrypted->_buffer, (int) encrypted->_length))
+      {
+        ERR_print_errors_fp(stderr);
+        result = false;
+      }
+    }
+  }
+
+  if (result)
+  {
+    if (!EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_GCM_SET_TAG, CRYPTO_HMAC_SIZE, tag))
+    {
+      ERR_print_errors_fp(stderr);
+      result = false;
+    }
+  }
+
+  if (result)
+  {
+    if (decoded)
+    {
+      if (EVP_DecryptFinal_ex(ctx, decoded->_buffer + len, &len))
+      {
+        decoded->_length += (uint32_t) len;
+      }
+      else
+      {
+        ERR_print_errors_fp(stderr);
+        result = false;
+      }
+    }
+    else
+    {
+      unsigned char temp[32];
+      if (!EVP_DecryptFinal_ex(ctx, temp, &len))
+      {
+        ERR_print_errors_fp(stderr);
+        result = false;
+      }
+    }
+  }
+
+  if (ctx)
+    EVP_CIPHER_CTX_free(ctx);
+
+  return result;
+}
+
+static session_key_material * get_datawriter_session(DDS_Security_DatawriterCryptoHandle writer_crypto)
+{
+  local_datawriter_crypto *writer_crypto_impl = (local_datawriter_crypto *)writer_crypto;
+  return writer_crypto_impl->writer_session_message;
+}
+
+static master_key_material * get_datareader_key_material(DDS_Security_DatareaderCryptoHandle reader_crypto)
+{
+  remote_datareader_crypto *reader_crypto_impl = (remote_datareader_crypto *)reader_crypto;
+  return reader_crypto_impl->writer2reader_key_material_message;
+}
+
+static void initialize_data_submessage(DDS_Security_OctetSeq *submsg, bool be)
+{
+  size_t length = strlen(sample_test_data) + 1;
+  struct submsg_header *header;
+  int swap;
+  unsigned char *buffer, *ptr;
+
+  if (be)
+    swap = (DDSRT_ENDIAN == DDSRT_LITTLE_ENDIAN);
+  else
+    swap = (DDSRT_ENDIAN != DDSRT_LITTLE_ENDIAN);
+
+  buffer = ddsrt_malloc(length + sizeof(struct submsg_header));
+  header = (struct submsg_header *)buffer;
+  header->id = 0x15;
+  header->flags = be ? 0x00 : 0x01;
+  header->length = swap ? ddsrt_bswap2u((uint16_t)length) : (uint16_t)length;
+  ptr = (unsigned char *)(header + 1);
+
+  memcpy((char *)ptr, sample_test_data, length);
+
+  submsg->_length = submsg->_maximum = (uint32_t)(length + sizeof(struct submsg_header));
+  submsg->_buffer = buffer;
+}
+
+static bool check_reader_sign(
+    DDS_Security_DatareaderCryptoHandle reader_crypto,
+    uint32_t session_id,
+    uint32_t key_id,
+    uint32_t key_size,
+    unsigned char *init_vector,
+    unsigned char *common_mac,
+    unsigned char *hmac)
+{
+  master_key_material *keymat;
+  crypto_session_key_t key;
+  unsigned char md[CRYPTO_HMAC_SIZE];
+
+  keymat = get_datareader_key_material(reader_crypto);
+
+  if (key_id != keymat->receiver_specific_key_id)
+  {
+    printf("check_reader_sign: key_id does not match\n");
+    return false;
+  }
+  else if (!calculate_receiver_specific_key_test(&key, session_id, keymat->master_salt, keymat->master_receiver_specific_key, keymat->transformation_kind))
+  {
+    printf("check_reader_sign: calculate key failed\n");
+    return false;
+  }
+  else if (!cipher_sign_data(key.data, key_size, init_vector, common_mac, CRYPTO_HMAC_SIZE, md))
+  {
+    return false;
+  }
+  else if (memcmp(hmac, md, CRYPTO_HMAC_SIZE) != 0)
+  {
+    printf("check_reader_sign: hmac incorrect\n");
+    return false;
+  }
+
+  return true;
+}
+
+static bool check_reader_signing(DDS_Security_DatareaderCryptoHandleSeq *list, struct crypto_footer *footer, uint32_t session_id, unsigned char *init_vector, uint32_t key_size)
+{
+  struct receiver_specific_mac *rmac;
+  uint32_t key_id;
+  uint32_t i;
+
+  if (footer->length != list->_length)
+  {
+    return false;
+  }
+
+  rmac = (struct receiver_specific_mac *)(footer + 1);
+
+  for (i = 0; i < list->_length; i++)
+  {
+    key_id = ddsrt_bswap4u(*(uint32_t *)rmac[i].receiver_mac_key_id);
+    if (!check_reader_sign(list->_buffer[i], session_id, key_id, key_size, init_vector, footer->common_mac, rmac[i].receiver_mac))
+    {
+      return false;
+    }
+  }
+
+  return true;
+}
+
+static void suite_encode_datawriter_submessage_init(void)
+{
+  allocate_shared_secret();
+  CU_ASSERT_FATAL ((plugins = load_plugins(
+                      NULL    /* Access Control */,
+                      NULL    /* Authentication */,
+                      &crypto /* Cryptograpy    */)) != NULL);
+  CU_ASSERT_EQUAL_FATAL (register_local_participant(), 0);
+  CU_ASSERT_EQUAL_FATAL (register_remote_participant(), 0);
+}
+
+static void suite_encode_datawriter_submessage_fini(void)
+{
+  unregister_remote_participant();
+  unregister_local_participant();
+  deallocate_shared_secret();
+  unload_plugins(plugins);
+}
+
+static void encode_datawriter_submessage_not_signed(DDS_Security_CryptoTransformKind_Enum transformation_kind)
+{
+  DDS_Security_boolean result;
+  DDS_Security_DatawriterCryptoHandle writer_crypto;
+  DDS_Security_DatareaderCryptoHandle reader_crypto;
+  DDS_Security_DatareaderCryptoHandleSeq reader_list;
+  int32_t index;
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  DDS_Security_OctetSeq plain_buffer;
+  DDS_Security_OctetSeq encoded_buffer;
+  DDS_Security_OctetSeq decoded_buffer;
+  DDS_Security_OctetSeq data;
+
+  session_key_material *session_keys;
+  struct crypto_header *header = NULL;
+  struct crypto_footer *footer = NULL;
+  uint32_t session_id;
+  DDS_Security_PropertySeq datawriter_properties;
+  DDS_Security_EndpointSecurityAttributes datawriter_security_attributes;
+  bool is_encrypted;
+
+  CU_ASSERT_FATAL(crypto != NULL);
+  CU_ASSERT_FATAL(crypto->crypto_transform != NULL);
+  CU_ASSERT_FATAL(crypto->crypto_transform->encode_datawriter_submessage != NULL);
+
+  if (transformation_kind == CRYPTO_TRANSFORMATION_KIND_AES128_GCM || transformation_kind == CRYPTO_TRANSFORMATION_KIND_AES256_GCM)
+  {
+    is_encrypted = true;
+  }
+  else
+  {
+    is_encrypted = false;
+  }
+
+  prepare_endpoint_security_attributes_and_properties(&datawriter_security_attributes, &datawriter_properties, transformation_kind, false);
+
+  initialize_data_submessage(&plain_buffer, false);
+
+  writer_crypto = register_local_datawriter(&datawriter_security_attributes, &datawriter_properties);
+  CU_ASSERT_FATAL(writer_crypto != 0);
+
+  session_keys = get_datawriter_session(writer_crypto);
+
+  reader_crypto = register_remote_datareader(writer_crypto);
+  CU_ASSERT_FATAL(reader_crypto != 0);
+
+  reader_list._length = reader_list._maximum = 1;
+  reader_list._buffer = DDS_Security_DatareaderCryptoHandleSeq_allocbuf(1);
+  reader_list._buffer[0] = reader_crypto;
+  index = 0;
+
+  /* Now call the function. */
+  result = crypto->crypto_transform->encode_datawriter_submessage(
+      crypto->crypto_transform,
+      &encoded_buffer,
+      &plain_buffer,
+      writer_crypto,
+      &reader_list,
+      &index,
+      &exception);
+
+  if (!result)
+  {
+    printf("encode_datawriter_submessage: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+
+  CU_ASSERT_FATAL(result);
+  CU_ASSERT(exception.code == 0);
+  CU_ASSERT(exception.message == NULL);
+
+  reset_exception(&exception);
+
+  result = check_encoded_data(&encoded_buffer, is_encrypted, &header, &footer, &data);
+  CU_ASSERT_FATAL(result);
+
+  CU_ASSERT(header->transform_identifier.transformation_kind[3] == transformation_kind);
+
+  session_id = ddsrt_bswap4u(*(uint32_t *)header->session_id);
+
+  if (is_encrypted)
+  {
+    decoded_buffer._buffer = ddsrt_malloc(plain_buffer._length);
+    decoded_buffer._length = 0;
+    decoded_buffer._maximum = plain_buffer._length;
+
+    result = crypto_decrypt_data(session_id, &header->session_id[0], header->transform_identifier.transformation_kind,
+                                 session_keys->master_key_material, &data, &decoded_buffer, footer->common_mac);
+
+    if (!result)
+    {
+      printf("Decode failed\n");
+    }
+
+    CU_ASSERT_FATAL(result);
+
+    CU_ASSERT(memcmp(plain_buffer._buffer, decoded_buffer._buffer, plain_buffer._length) == 0);
+
+    DDS_Security_OctetSeq_deinit((&decoded_buffer));
+  }
+  else
+  {
+    result = crypto_decrypt_data(session_id, &header->session_id[0], header->transform_identifier.transformation_kind,
+                                 session_keys->master_key_material, &data, NULL, footer->common_mac);
+    if (!result)
+    {
+      printf("Decode failed\n");
+    }
+
+    CU_ASSERT_FATAL(result);
+
+    CU_ASSERT(memcmp(plain_buffer._buffer, data._buffer, plain_buffer._length) == 0);
+  }
+
+  unregister_datareader(reader_list._buffer[0]);
+  reader_list._buffer[0] = 0;
+
+  unregister_datawriter(writer_crypto);
+
+  DDS_Security_OctetSeq_deinit((&plain_buffer));
+  DDS_Security_OctetSeq_deinit((&encoded_buffer));
+  DDS_Security_DatareaderCryptoHandleSeq_deinit(&reader_list);
+
+  ddsrt_free(datawriter_properties._buffer[0].name);
+  ddsrt_free(datawriter_properties._buffer[0].value);
+  ddsrt_free(datawriter_properties._buffer);
+  ddsrt_free(footer);
+  ddsrt_free(header);
+}
+
+CU_Test(ddssec_builtin_encode_datawriter_submessage, encode_256, .init = suite_encode_datawriter_submessage_init, .fini = suite_encode_datawriter_submessage_fini)
+{
+  encode_datawriter_submessage_not_signed(CRYPTO_TRANSFORMATION_KIND_AES256_GCM);
+}
+
+CU_Test(ddssec_builtin_encode_datawriter_submessage, encode_128, .init = suite_encode_datawriter_submessage_init, .fini = suite_encode_datawriter_submessage_fini)
+{
+  encode_datawriter_submessage_not_signed(CRYPTO_TRANSFORMATION_KIND_AES128_GCM);
+}
+
+CU_Test(ddssec_builtin_encode_datawriter_submessage, no_encode_256, .init = suite_encode_datawriter_submessage_init, .fini = suite_encode_datawriter_submessage_fini)
+{
+  encode_datawriter_submessage_not_signed(CRYPTO_TRANSFORMATION_KIND_AES256_GMAC);
+}
+
+CU_Test(ddssec_builtin_encode_datawriter_submessage, no_encode_128, .init = suite_encode_datawriter_submessage_init, .fini = suite_encode_datawriter_submessage_fini)
+{
+  encode_datawriter_submessage_not_signed(CRYPTO_TRANSFORMATION_KIND_AES128_GMAC);
+}
+
+static void encode_datawriter_submessage_sign(DDS_Security_CryptoTransformKind_Enum transformation_kind)
+{
+  const uint32_t READERS_CNT = 4u;
+  DDS_Security_boolean result;
+  DDS_Security_DatawriterCryptoHandle writer_crypto;
+  DDS_Security_DatareaderCryptoHandle reader_crypto;
+  DDS_Security_DatareaderCryptoHandleSeq reader_list;
+  int32_t index;
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  DDS_Security_OctetSeq plain_buffer;
+  DDS_Security_OctetSeq encoded_buffer;
+  DDS_Security_OctetSeq decoded_buffer;
+  DDS_Security_OctetSeq data;
+  DDS_Security_OctetSeq *buffer;
+  session_key_material *session_keys;
+  struct crypto_header *header = NULL;
+  struct crypto_footer *footer = NULL;
+  uint32_t session_id;
+  uint32_t i;
+  DDS_Security_PropertySeq datawriter_properties;
+  DDS_Security_EndpointSecurityAttributes datawriter_security_attributes;
+  bool is_encrypted;
+
+  CU_ASSERT_FATAL(crypto != NULL);
+  CU_ASSERT_FATAL(crypto->crypto_transform != NULL);
+  CU_ASSERT_FATAL(crypto->crypto_transform->encode_datawriter_submessage != NULL);
+
+  if (transformation_kind == CRYPTO_TRANSFORMATION_KIND_AES128_GCM || transformation_kind == CRYPTO_TRANSFORMATION_KIND_AES256_GCM)
+  {
+    is_encrypted = true;
+  }
+  else
+  {
+    is_encrypted = false;
+  }
+
+  prepare_endpoint_security_attributes_and_properties(&datawriter_security_attributes, &datawriter_properties, transformation_kind, true);
+
+  initialize_data_submessage(&plain_buffer, false);
+
+  writer_crypto = register_local_datawriter(&datawriter_security_attributes, &datawriter_properties);
+  CU_ASSERT_FATAL(writer_crypto != 0);
+
+  session_keys = get_datawriter_session(writer_crypto);
+
+  reader_list._length = reader_list._maximum = READERS_CNT;
+  reader_list._buffer = DDS_Security_DatareaderCryptoHandleSeq_allocbuf(4);
+  for (i = 0; i < READERS_CNT; i++)
+  {
+    reader_crypto = register_remote_datareader(writer_crypto);
+    CU_ASSERT_FATAL(reader_crypto != 0);
+    reader_list._buffer[i] = reader_crypto;
+  }
+  index = 0;
+
+  /* Now call the function. */
+
+  buffer = &plain_buffer;
+  while (index != (int32_t)READERS_CNT)
+  {
+    result = crypto->crypto_transform->encode_datawriter_submessage(
+        crypto->crypto_transform,
+        &encoded_buffer,
+        buffer,
+        writer_crypto,
+        &reader_list,
+        &index,
+        &exception);
+
+    if (!result)
+    {
+      printf("encode_datawriter_submessage: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+
+    CU_ASSERT_FATAL(result);
+    CU_ASSERT(exception.code == 0);
+    CU_ASSERT(exception.message == NULL);
+
+    reset_exception(&exception);
+    buffer = NULL;
+  }
+
+  result = check_encoded_data(&encoded_buffer, is_encrypted, &header, &footer, &data);
+  CU_ASSERT_FATAL(result);
+
+  CU_ASSERT(header->transform_identifier.transformation_kind[3] == transformation_kind);
+
+  session_id = ddsrt_bswap4u(*(uint32_t *)header->session_id);
+
+  if (is_encrypted)
+  {
+    decoded_buffer._buffer = ddsrt_malloc(plain_buffer._length);
+    decoded_buffer._length = 0;
+    decoded_buffer._maximum = plain_buffer._length;
+
+    result = crypto_decrypt_data(session_id, &header->session_id[0], header->transform_identifier.transformation_kind,
+                                 session_keys->master_key_material, &data, &decoded_buffer, footer->common_mac);
+    if (!result)
+    {
+      printf("Decode failed\n");
+    }
+
+    CU_ASSERT_FATAL(result);
+
+    CU_ASSERT(memcmp(plain_buffer._buffer, decoded_buffer._buffer, plain_buffer._length) == 0);
+
+    DDS_Security_OctetSeq_deinit((&decoded_buffer));
+  }
+  else
+  {
+    result = crypto_decrypt_data(session_id, header->session_id, header->transform_identifier.transformation_kind,
+                                 session_keys->master_key_material, &data, NULL, footer->common_mac);
+
+    if (!result)
+    {
+      printf("Decode failed\n");
+    }
+
+    CU_ASSERT_FATAL(result);
+    CU_ASSERT(memcmp(plain_buffer._buffer, data._buffer, plain_buffer._length) == 0);
+  }
+
+  printf("num hmacs = %u\n", footer->length);
+
+  CU_ASSERT(check_reader_signing(&reader_list, footer, session_id, header->session_id, session_keys->key_size));
+
+  for (i = 0; i < READERS_CNT; i++)
+  {
+    unregister_datareader(reader_list._buffer[i]);
+    reader_list._buffer[i] = 0;
+  }
+
+  unregister_datawriter(writer_crypto);
+
+  DDS_Security_OctetSeq_deinit((&plain_buffer));
+  DDS_Security_OctetSeq_deinit((&encoded_buffer));
+  DDS_Security_DatareaderCryptoHandleSeq_deinit(&reader_list);
+
+  ddsrt_free(datawriter_properties._buffer[0].name);
+  ddsrt_free(datawriter_properties._buffer[0].value);
+  ddsrt_free(datawriter_properties._buffer);
+  ddsrt_free(footer);
+  ddsrt_free(header);
+}
+
+CU_Test(ddssec_builtin_encode_datawriter_submessage, encode_sign_256, .init = suite_encode_datawriter_submessage_init, .fini = suite_encode_datawriter_submessage_fini)
+{
+  encode_datawriter_submessage_sign(CRYPTO_TRANSFORMATION_KIND_AES256_GCM);
+}
+
+CU_Test(ddssec_builtin_encode_datawriter_submessage, encode_sign_128, .init = suite_encode_datawriter_submessage_init, .fini = suite_encode_datawriter_submessage_fini)
+{
+  encode_datawriter_submessage_sign(CRYPTO_TRANSFORMATION_KIND_AES128_GCM);
+}
+
+CU_Test(ddssec_builtin_encode_datawriter_submessage, no_encode_sign_256, .init = suite_encode_datawriter_submessage_init, .fini = suite_encode_datawriter_submessage_fini)
+{
+  encode_datawriter_submessage_sign(CRYPTO_TRANSFORMATION_KIND_AES256_GMAC);
+}
+
+CU_Test(ddssec_builtin_encode_datawriter_submessage, no_encode_sign_128, .init = suite_encode_datawriter_submessage_init, .fini = suite_encode_datawriter_submessage_fini)
+{
+  encode_datawriter_submessage_sign(CRYPTO_TRANSFORMATION_KIND_AES128_GMAC);
+}
+
+CU_Test(ddssec_builtin_encode_datawriter_submessage, invalid_args, .init = suite_encode_datawriter_submessage_init, .fini = suite_encode_datawriter_submessage_fini)
+{
+  DDS_Security_boolean result;
+  DDS_Security_DatawriterCryptoHandle writer_crypto;
+  DDS_Security_DatareaderCryptoHandle reader_crypto;
+  DDS_Security_DatareaderCryptoHandleSeq reader_list;
+  DDS_Security_DatareaderCryptoHandleSeq empty_reader_list;
+  int32_t index;
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  DDS_Security_OctetSeq plain_buffer;
+  DDS_Security_OctetSeq encoded_buffer;
+  DDS_Security_PropertySeq datawriter_properties;
+  DDS_Security_EndpointSecurityAttributes datawriter_security_attributes;
+
+  CU_ASSERT_FATAL(crypto != NULL);
+  CU_ASSERT_FATAL(crypto->crypto_transform != NULL);
+  CU_ASSERT_FATAL(crypto->crypto_transform->encode_datawriter_submessage != NULL);
+
+  prepare_endpoint_security_attributes_and_properties(&datawriter_security_attributes, &datawriter_properties, CRYPTO_TRANSFORMATION_KIND_AES256_GCM, true);
+
+  initialize_data_submessage(&plain_buffer, false);
+  memset(&empty_reader_list, 0, sizeof(empty_reader_list));
+
+  writer_crypto = register_local_datawriter(&datawriter_security_attributes, &datawriter_properties);
+  CU_ASSERT_FATAL(writer_crypto != 0);
+
+  //set_protection_kind(writer_crypto, DDS_SECURITY_PROTECTION_KIND_ENCRYPT_WITH_ORIGIN_AUTHENTICATION);
+
+  reader_crypto = register_remote_datareader(writer_crypto);
+  CU_ASSERT_FATAL(reader_crypto != 0);
+
+  reader_list._length = reader_list._maximum = 1;
+  reader_list._buffer = DDS_Security_DatareaderCryptoHandleSeq_allocbuf(1);
+  reader_list._buffer[0] = reader_crypto;
+  index = 0;
+
+  /* encoded_buffer NULL */
+  result = crypto->crypto_transform->encode_datawriter_submessage(
+      crypto->crypto_transform,
+      NULL,
+      &plain_buffer,
+      writer_crypto,
+      &reader_list,
+      &index,
+      &exception);
+
+  if (!result)
+  {
+    printf("encode_datawriter_submessage: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+
+  CU_ASSERT(!result);
+  CU_ASSERT(exception.code != 0);
+  CU_ASSERT(exception.message != NULL);
+
+  reset_exception(&exception);
+
+  /* plain_buffer NULL */
+  result = crypto->crypto_transform->encode_datawriter_submessage(
+      crypto->crypto_transform,
+      &encoded_buffer,
+      NULL,
+      writer_crypto,
+      &reader_list,
+      &index,
+      &exception);
+
+  if (!result)
+  {
+    printf("encode_datawriter_submessage: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+
+  CU_ASSERT(!result);
+  CU_ASSERT(exception.code != 0);
+  CU_ASSERT(exception.message != NULL);
+
+  reset_exception(&exception);
+
+  /* writer crypto 0 */
+  result = crypto->crypto_transform->encode_datawriter_submessage(
+      crypto->crypto_transform,
+      &encoded_buffer,
+      &plain_buffer,
+      0,
+      &reader_list,
+      &index,
+      &exception);
+
+  if (!result)
+  {
+    printf("encode_datawriter_submessage: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+
+  CU_ASSERT(!result);
+  CU_ASSERT(exception.code != 0);
+  CU_ASSERT(exception.message != NULL);
+
+  reset_exception(&exception);
+
+  /* writer crypto unknown */
+  result = crypto->crypto_transform->encode_datawriter_submessage(
+      crypto->crypto_transform,
+      &encoded_buffer,
+      &plain_buffer,
+      1,
+      &reader_list,
+      &index,
+      &exception);
+
+  if (!result)
+  {
+    printf("encode_datawriter_submessage: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+
+  CU_ASSERT(!result);
+  CU_ASSERT(exception.code != 0);
+  CU_ASSERT(exception.message != NULL);
+
+  reset_exception(&exception);
+
+  /* reader crypto list NULL*/
+  result = crypto->crypto_transform->encode_datawriter_submessage(
+      crypto->crypto_transform,
+      &encoded_buffer,
+      &plain_buffer,
+      writer_crypto,
+      NULL,
+      &index,
+      &exception);
+
+  if (!result)
+  {
+    printf("encode_datawriter_submessage: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+
+  CU_ASSERT(!result);
+  CU_ASSERT(exception.code != 0);
+  CU_ASSERT(exception.message != NULL);
+
+  reset_exception(&exception);
+
+  /* empty reader crypto list */
+  result = crypto->crypto_transform->encode_datawriter_submessage(
+      crypto->crypto_transform,
+      &encoded_buffer,
+      &plain_buffer,
+      writer_crypto,
+      &empty_reader_list,
+      &index,
+      &exception);
+
+  if (!result)
+  {
+    printf("encode_datawriter_submessage: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+
+  CU_ASSERT(!result);
+  CU_ASSERT(exception.code != 0);
+  CU_ASSERT(exception.message != NULL);
+
+  reset_exception(&exception);
+
+  /* reader crypto list with invalid reader crypto */
+  reader_list._buffer[0] = 0;
+  result = crypto->crypto_transform->encode_datawriter_submessage(
+      crypto->crypto_transform,
+      &encoded_buffer,
+      &plain_buffer,
+      writer_crypto,
+      &reader_list,
+      &index,
+      &exception);
+
+  if (!result)
+  {
+    printf("encode_datawriter_submessage: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+
+  CU_ASSERT(!result);
+  CU_ASSERT(exception.code != 0);
+  CU_ASSERT(exception.message != NULL);
+
+  reset_exception(&exception);
+
+  /* reader crypto list with unknown reader crypto*/
+  reader_list._buffer[0] = 1;
+  result = crypto->crypto_transform->encode_datawriter_submessage(
+      crypto->crypto_transform,
+      &encoded_buffer,
+      &plain_buffer,
+      writer_crypto,
+      &reader_list,
+      &index,
+      &exception);
+
+  if (!result)
+  {
+    printf("encode_datawriter_submessage: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+
+  CU_ASSERT(!result);
+  CU_ASSERT(exception.code != 0);
+  CU_ASSERT(exception.message != NULL);
+
+  reset_exception(&exception);
+  reader_list._buffer[0] = reader_crypto;
+
+  /* index NULL*/
+  result = crypto->crypto_transform->encode_datawriter_submessage(
+      crypto->crypto_transform,
+      &encoded_buffer,
+      &plain_buffer,
+      writer_crypto,
+      &reader_list,
+      NULL,
+      &exception);
+
+  if (!result)
+  {
+    printf("encode_datawriter_submessage: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+
+  CU_ASSERT(!result);
+  CU_ASSERT(exception.code != 0);
+  CU_ASSERT(exception.message != NULL);
+
+  reset_exception(&exception);
+
+  /* invalid index */
+  index = 2;
+  result = crypto->crypto_transform->encode_datawriter_submessage(
+      crypto->crypto_transform,
+      &encoded_buffer,
+      &plain_buffer,
+      writer_crypto,
+      &reader_list,
+      &index,
+      &exception);
+
+  if (!result)
+  {
+    printf("encode_datawriter_submessage: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+
+  unregister_datareader(reader_list._buffer[0]);
+  reader_list._buffer[0] = 0;
+
+  unregister_datawriter(writer_crypto);
+
+  CU_ASSERT(!result);
+  CU_ASSERT(exception.code != 0);
+  CU_ASSERT(exception.message != NULL);
+
+  reset_exception(&exception);
+
+  ddsrt_free(datawriter_properties._buffer[0].name);
+  ddsrt_free(datawriter_properties._buffer[0].value);
+  ddsrt_free(datawriter_properties._buffer);
+  DDS_Security_OctetSeq_deinit((&plain_buffer));
+  DDS_Security_DatareaderCryptoHandleSeq_deinit(&reader_list);
+}
+
diff --git a/src/security/builtin_plugins/tests/encode_rtps_message/src/encode_rtps_message_utests.c b/src/security/builtin_plugins/tests/encode_rtps_message/src/encode_rtps_message_utests.c
new file mode 100644
index 0000000..d65a0c7
--- /dev/null
+++ b/src/security/builtin_plugins/tests/encode_rtps_message/src/encode_rtps_message_utests.c
@@ -0,0 +1,1322 @@
+/*
+ * Copyright(c) 2006 to 2019 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+#include <assert.h>
+#include <openssl/evp.h>
+#include <openssl/hmac.h>
+#include <openssl/bio.h>
+#include <openssl/err.h>
+
+#include "dds/ddsrt/bswap.h"
+#include "dds/ddsrt/heap.h"
+#include "dds/ddsrt/string.h"
+#include "dds/ddsrt/types.h"
+#include "dds/ddsrt/environ.h"
+#include "dds/security/dds_security_api.h"
+#include "dds/security/core/dds_security_serialize.h"
+#include "dds/security/core/dds_security_utils.h"
+#include "dds/security/core/shared_secret.h"
+#include "CUnit/CUnit.h"
+#include "CUnit/Test.h"
+#include "common/src/loader.h"
+#include "common/src/crypto_helper.h"
+#include "crypto_objects.h"
+#include "crypto_utils.h"
+
+#define TEST_SHARED_SECRET_SIZE 32
+
+static struct plugins_hdl *plugins = NULL;
+static dds_security_cryptography *crypto = NULL;
+
+static DDS_Security_IdentityHandle local_participant_identity = 1;
+static DDS_Security_IdentityHandle remote_participant_identities[] = {2, 3, 4, 5};
+
+static DDS_Security_ParticipantCryptoHandle local_particpant_crypto = 0;
+static DDS_Security_ParticipantCryptoHandle remote_particpant_cryptos[4];
+
+static DDS_Security_SharedSecretHandleImpl *shared_secret_handle_impl = NULL;
+static DDS_Security_SharedSecretHandle shared_secret_handle;
+
+static const char *sample_test_data =
+    "ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789abcdefghijklmnopqrstuvwxyz"
+    "ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789abcdefghijklmnopqrstuvwxyz"
+    "ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789abcdefghijklmnopqrstuvwxyz"
+    "ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789abcdefghijklmnopqrstuvwxy";
+
+static const char *RTPS_HEADER = "RTPS abcdefghijklmno";
+
+struct submsg_header
+{
+  unsigned char id;
+  unsigned char flags;
+  uint16_t length;
+};
+
+struct crypto_header
+{
+  struct CryptoTransformIdentifier transform_identifier;
+  unsigned char session_id[4];
+  unsigned char init_vector_suffix[8];
+};
+
+struct crypto_footer
+{
+  unsigned char common_mac[16];
+  uint32_t length;
+};
+
+struct receiver_specific_mac
+{
+  DDS_Security_CryptoTransformKeyId receiver_mac_key_id;
+  unsigned char receiver_mac[CRYPTO_HMAC_SIZE];
+};
+
+static void reset_exception(DDS_Security_SecurityException *ex)
+{
+  ex->code = 0;
+  ex->minor_code = 0;
+  ddsrt_free(ex->message);
+  ex->message = NULL;
+}
+
+static void allocate_shared_secret(void)
+{
+  int32_t i;
+
+  shared_secret_handle_impl = ddsrt_malloc(sizeof(DDS_Security_SharedSecretHandleImpl));
+
+  shared_secret_handle_impl->shared_secret = ddsrt_malloc(TEST_SHARED_SECRET_SIZE * sizeof(unsigned char));
+  shared_secret_handle_impl->shared_secret_size = TEST_SHARED_SECRET_SIZE;
+
+  for (i = 0; i < shared_secret_handle_impl->shared_secret_size; i++)
+  {
+    shared_secret_handle_impl->shared_secret[i] = (unsigned char)(i % 20);
+  }
+
+  for (i = 0; i < 32; i++)
+  {
+    shared_secret_handle_impl->challenge1[i] = (unsigned char)(i % 15);
+    shared_secret_handle_impl->challenge2[i] = (unsigned char)(i % 12);
+  }
+
+  shared_secret_handle = (DDS_Security_SharedSecretHandle)shared_secret_handle_impl;
+}
+
+static void deallocate_shared_secret(void)
+{
+  ddsrt_free(shared_secret_handle_impl->shared_secret);
+  ddsrt_free(shared_secret_handle_impl);
+}
+
+static void print_octets(const char *msg, const unsigned char *data, uint32_t sz)
+{
+  uint32_t i;
+  printf("%s: ", msg);
+  for (i = 0; i < sz; i++)
+  {
+    printf("%02x", data[i]);
+  }
+  printf("\n");
+}
+
+static int register_local_participant(DDS_Security_ParticipantSecurityAttributes *participant_security_attributes, DDS_Security_PropertySeq *participant_properties)
+{
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  DDS_Security_PermissionsHandle participant_permissions = 2; /* dummy but valid */
+
+  local_particpant_crypto =
+      crypto->crypto_key_factory->register_local_participant(
+          crypto->crypto_key_factory,
+          local_participant_identity,
+          participant_permissions,
+          participant_properties,
+          participant_security_attributes,
+          &exception);
+
+  if (local_particpant_crypto == 0)
+  {
+    printf("register_local_participant: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+
+  return local_particpant_crypto ? 0 : -1;
+}
+
+static void unregister_local_participant(void)
+{
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  if (local_particpant_crypto)
+  {
+    crypto->crypto_key_factory->unregister_participant(crypto->crypto_key_factory, local_particpant_crypto, &exception);
+    reset_exception(&exception);
+  }
+}
+
+static int register_remote_participants(void)
+{
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  DDS_Security_PermissionsHandle remote_participant_permissions = 5;
+
+  unsigned i;
+  int result = 0;
+
+  for (i = 0; i < 4; ++i)
+  {
+    remote_particpant_cryptos[i] =
+        crypto->crypto_key_factory->register_matched_remote_participant(
+            crypto->crypto_key_factory,
+            local_particpant_crypto,
+            remote_participant_identities[i],
+            remote_participant_permissions,
+            shared_secret_handle,
+            &exception);
+
+    if (remote_particpant_cryptos[i] == 0)
+    {
+      printf("register_matched_remote_participant: %s\n", exception.message ? exception.message : "Error message missing");
+      result = 1;
+      break;
+    }
+  }
+
+  return result;
+}
+
+static void
+unregister_remote_participants(void)
+{
+  unsigned i;
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  for (i = 0; i < 4; ++i)
+  {
+    if (remote_particpant_cryptos[i])
+    {
+      crypto->crypto_key_factory->unregister_participant(crypto->crypto_key_factory, remote_particpant_cryptos[i], &exception);
+      reset_exception(&exception);
+    }
+  }
+}
+
+static bool check_encoded_data(DDS_Security_OctetSeq *data, bool encrypted, struct crypto_header **header, struct crypto_footer **footer, DDS_Security_OctetSeq *contents)
+{
+  struct submsg_header *prefix;
+  struct submsg_header *postfix;
+  struct submsg_header *body;
+  unsigned char *ptr = data->_buffer;
+  uint32_t remain = data->_length;
+  uint32_t hlen, clen, dlen;
+  int swap;
+
+  if (remain < 20)
+  {
+    printf("check_encoded_data: RTPS header missing\n");
+    goto fail_prefix;
+  }
+
+  /* rtps header first */
+  if (memcmp(ptr, RTPS_HEADER, strlen(RTPS_HEADER)) != 0)
+  {
+    printf("check_encoded_data: RTPS header invalid\n");
+    goto fail_prefix;
+  }
+
+  if (remain < sizeof(struct submsg_header))
+  {
+    printf("check_encoded_data: prefix missing\n");
+    goto fail_prefix;
+  }
+
+  remain -= 20; /* rtps header */
+  ptr += 20;
+
+  prefix = (struct submsg_header *)ptr;
+
+  if (prefix->id != SMID_SRTPS_PREFIX_KIND)
+  {
+    printf("check_encoded_data: prefix incorrect smid 0x%x02\n", prefix->id);
+    goto fail_prefix;
+  }
+
+  if (prefix->flags & 0x01)
+    swap = (DDSRT_ENDIAN != DDSRT_LITTLE_ENDIAN);
+  else
+    swap = (DDSRT_ENDIAN == DDSRT_LITTLE_ENDIAN);
+
+  hlen = swap ? ddsrt_bswap2u(prefix->length) : prefix->length;
+
+  if (hlen != sizeof(struct crypto_header))
+  {
+    printf("check_encoded_data: crypto_header missing\n");
+    goto fail_prefix;
+  }
+
+  ptr += sizeof(struct submsg_header);
+  remain -= (uint32_t)sizeof(struct submsg_header);
+
+  if (remain < sizeof(struct crypto_header))
+  {
+    printf("check_encoded_data: crypto_header too short\n");
+    goto fail_prefix;
+  }
+
+  *header = ddsrt_malloc(sizeof(struct crypto_header));
+  memcpy(*header, ptr, sizeof(struct crypto_header));
+
+  ptr += sizeof(struct crypto_header);
+  remain -= (uint32_t)sizeof(struct crypto_header);
+
+  if (remain < sizeof(struct submsg_header))
+  {
+    goto fail_body;
+  }
+
+  if (encrypted)
+  {
+    body = (struct submsg_header *)ptr;
+    if (body->id != SMID_SEC_BODY_KIND)
+    {
+      printf("check_encoded_data: submessage SEC_BODY missing\n");
+      goto fail_body;
+    }
+    ptr += sizeof(struct submsg_header);
+    remain -= (uint32_t)sizeof(struct submsg_header);
+
+    dlen = ddsrt_fromBE4u(*(uint32_t *)ptr);
+
+    clen = swap ? ddsrt_bswap2u(body->length) : body->length;
+    if (dlen > clen)
+    {
+      printf("check_encoded_data: encrypted body length incorrect\n");
+      goto fail_body;
+    }
+
+    ptr += sizeof(uint32_t);
+    remain -= (uint32_t)sizeof(uint32_t);
+
+    contents->_length = contents->_maximum = dlen;
+    contents->_buffer = ptr;
+
+    ptr += clen - sizeof(uint32_t);
+  }
+  else
+  {
+    body = (struct submsg_header *)(ptr + 24); /* header after info_src */
+    if (body->id == SMID_SEC_BODY_KIND)
+    {
+      printf("check_encoded_data: submessage SEC_BODY not expected\n");
+      goto fail_body;
+    }
+    clen = swap ? ddsrt_bswap2u(body->length) : body->length;
+    clen += (uint32_t)sizeof(struct submsg_header) + 24;
+
+    contents->_length = contents->_maximum = clen;
+    contents->_buffer = ptr;
+
+    ptr += clen;
+  }
+
+  if (clen > remain)
+  {
+    printf("check_encoded_data: payload invalid size\n");
+    goto fail_body;
+  }
+
+  remain -= contents->_length;
+
+  if (remain < sizeof(struct submsg_header))
+  {
+    printf("check_encoded_data: postfix missing\n");
+    goto fail_postfix;
+  }
+
+  postfix = (struct submsg_header *)ptr;
+
+  if (postfix->id != SMID_SRTPS_POSTFIX_KIND)
+  {
+    printf("check_encoded_data: postfix invalid smid\n");
+    goto fail_postfix;
+  }
+
+  ptr += sizeof(struct submsg_header);
+  remain -= (uint32_t)sizeof(struct submsg_header);
+
+  if (remain < CRYPTO_HMAC_SIZE + sizeof(uint32_t))
+  {
+    printf("check_encoded_data: crypto_footer incorrect size\n");
+    goto fail_postfix;
+  }
+
+  *footer = ddsrt_malloc(remain);
+  memcpy(*footer, ptr, remain);
+
+  /* length of reader specific macs is in BIG-ENDIAN format */
+  (*footer)->length = ddsrt_fromBE4u((*footer)->length);
+
+  return true;
+
+fail_postfix:
+fail_body:
+  ddsrt_free(*header);
+fail_prefix:
+  return false;
+}
+
+static bool
+cipher_sign_data(
+    const unsigned char *session_key,
+    uint32_t key_size,
+    const unsigned char *iv,
+    const unsigned char *data,
+    uint32_t data_len,
+    unsigned char *tag)
+{
+  EVP_CIPHER_CTX *ctx;
+  unsigned char temp[32];
+  int len;
+
+  /* create the cipher context */
+  ctx = EVP_CIPHER_CTX_new();
+  if (!ctx)
+  {
+    ERR_print_errors_fp(stderr);
+    goto fail_ctx_new;
+  }
+
+  /* initialize the cipher and set to AES GCM */
+  if (key_size == 128)
+  {
+    if (!EVP_EncryptInit_ex(ctx, EVP_aes_128_gcm(), NULL, NULL, NULL))
+    {
+      ERR_print_errors_fp(stderr);
+      goto fail_encrypt;
+    }
+  }
+  else if (key_size == 256)
+  {
+    if (!EVP_EncryptInit_ex(ctx, EVP_aes_256_gcm(), NULL, NULL, NULL))
+    {
+      ERR_print_errors_fp(stderr);
+      goto fail_encrypt;
+    }
+  }
+
+  /* Initialise key and IV */
+  if (!EVP_EncryptInit_ex(ctx, NULL, NULL, session_key, iv))
+  {
+    ERR_print_errors_fp(stderr);
+    goto fail_encrypt;
+  }
+
+  if (!EVP_EncryptUpdate(ctx, NULL, &len, data, (int) data_len))
+  {
+    ERR_print_errors_fp(stderr);
+    goto fail_encrypt;
+  }
+
+  if (!EVP_EncryptFinal_ex(ctx, temp, &len))
+  {
+    ERR_print_errors_fp(stderr);
+    goto fail_encrypt;
+  }
+
+  /* get the tag */
+  if (!EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_GCM_GET_TAG, CRYPTO_HMAC_SIZE, tag))
+  {
+    ERR_print_errors_fp(stderr);
+    goto fail_encrypt;
+  }
+
+  /* clean up */
+  EVP_CIPHER_CTX_free(ctx);
+
+  return true;
+
+fail_encrypt:
+  EVP_CIPHER_CTX_free(ctx);
+fail_ctx_new:
+  return false;
+}
+
+static bool
+crypto_decrypt_data(
+    uint32_t session_id,
+    unsigned char *iv,
+    DDS_Security_CryptoTransformKind transformation_kind,
+    master_key_material *key_material,
+    DDS_Security_OctetSeq *encrypted,
+    DDS_Security_OctetSeq *decoded,
+    unsigned char *tag)
+{
+  bool result = true;
+  EVP_CIPHER_CTX *ctx;
+  crypto_session_key_t session_key;
+  uint32_t key_size = crypto_get_key_size(CRYPTO_TRANSFORM_KIND(transformation_kind));
+  int len = 0;
+
+  if (!crypto_calculate_session_key_test(&session_key, session_id, key_material->master_salt, key_material->master_sender_key, key_material->transformation_kind))
+    return false;
+
+  printf("SessionId: %08x\n", session_id);
+  print_octets("SessionKey", (const unsigned char *)session_key.data, key_size >> 3);
+
+  /* create the cipher context */
+  ctx = EVP_CIPHER_CTX_new();
+  if (ctx)
+  {
+    if (key_size == 128)
+    {
+      if (!EVP_DecryptInit_ex(ctx, EVP_aes_128_gcm(), NULL, NULL, NULL))
+      {
+        ERR_print_errors_fp(stderr);
+        result = false;
+      }
+    }
+    else if (key_size == 256)
+    {
+      if (!EVP_DecryptInit_ex(ctx, EVP_aes_256_gcm(), NULL, NULL, NULL))
+      {
+        ERR_print_errors_fp(stderr);
+        result = false;
+      }
+    }
+  }
+
+  if (result)
+  {
+    if (!EVP_DecryptInit_ex(ctx, NULL, NULL, session_key.data, iv))
+    {
+      ERR_print_errors_fp(stderr);
+      result = false;
+    }
+  }
+
+  if (result)
+  {
+    if (decoded)
+    {
+      if (EVP_DecryptUpdate(ctx, decoded->_buffer, &len, encrypted->_buffer, (int) encrypted->_length))
+      {
+        decoded->_length = (uint32_t) len;
+      }
+      else
+      {
+        ERR_print_errors_fp(stderr);
+        result = false;
+      }
+    }
+    else
+    {
+      if (!EVP_DecryptUpdate(ctx, NULL, &len, encrypted->_buffer, (int) encrypted->_length))
+      {
+        ERR_print_errors_fp(stderr);
+        result = false;
+      }
+    }
+  }
+
+  if (result)
+  {
+    if (!EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_GCM_SET_TAG, CRYPTO_HMAC_SIZE, tag))
+    {
+      ERR_print_errors_fp(stderr);
+      result = false;
+    }
+  }
+
+  if (result)
+  {
+    if (decoded)
+    {
+      if (EVP_DecryptFinal_ex(ctx, decoded->_buffer + len, &len))
+      {
+        decoded->_length += (uint32_t) len;
+      }
+      else
+      {
+        ERR_print_errors_fp(stderr);
+        result = false;
+      }
+    }
+    else
+    {
+      unsigned char temp[32];
+      if (!EVP_DecryptFinal_ex(ctx, temp, &len))
+      {
+        ERR_print_errors_fp(stderr);
+        result = false;
+      }
+    }
+  }
+
+  if (ctx)
+    EVP_CIPHER_CTX_free(ctx);
+
+  return result;
+}
+
+static session_key_material * get_local_participant_session(DDS_Security_ParticipantCryptoHandle participant_crypto)
+{
+  local_participant_crypto *participant_crypto_impl = (local_participant_crypto *)participant_crypto;
+  return participant_crypto_impl->session;
+}
+
+static participant_key_material * keymaterial_table_find(struct CryptoObjectTable *table, uint64_t handle)
+{
+  CryptoObject *object;
+  assert(table);
+
+  ddsrt_mutex_lock(&table->lock);
+  object = table->findfnc(table, &handle);
+  ddsrt_mutex_unlock(&table->lock);
+
+  return (participant_key_material *)object;
+}
+
+static master_key_material * get_remote_participant_key_material(DDS_Security_ParticipantCryptoHandle participant_crypto)
+{
+  participant_key_material *key_material;
+  remote_participant_crypto *participant_crypto_impl = (remote_participant_crypto *)participant_crypto;
+
+  key_material = (participant_key_material *)keymaterial_table_find(participant_crypto_impl->key_material, (uint64_t) local_particpant_crypto);
+  if (!key_material)
+  {
+    return NULL;
+  }
+  else
+  {
+    return key_material->local_P2P_key_material;
+  }
+}
+
+static void set_protection_kind(DDS_Security_ParticipantCryptoHandle participant_crypto, DDS_Security_ProtectionKind protection_kind)
+{
+  local_participant_crypto *paricipant_crypto_impl = (local_participant_crypto *)participant_crypto;
+  paricipant_crypto_impl->rtps_protection_kind = protection_kind;
+}
+
+static void set_remote_participant_protection_kind(DDS_Security_ParticipantCryptoHandle participant_crypto, DDS_Security_ProtectionKind protection_kind)
+{
+  remote_participant_crypto *paricipant_crypto_impl = (remote_participant_crypto *)participant_crypto;
+  paricipant_crypto_impl->rtps_protection_kind = protection_kind;
+}
+
+static void initialize_rtps_message(DDS_Security_OctetSeq *submsg, bool be)
+{
+  size_t length = strlen(sample_test_data) + 1;
+  struct submsg_header *header;
+  int swap;
+  unsigned char *buffer, *ptr;
+
+  if (be)
+    swap = (DDSRT_ENDIAN == DDSRT_LITTLE_ENDIAN);
+  else
+    swap = (DDSRT_ENDIAN != DDSRT_LITTLE_ENDIAN);
+
+  buffer = ddsrt_malloc(length + 20 + sizeof(struct submsg_header));
+  memcpy(buffer, RTPS_HEADER, 20);
+
+  header = (struct submsg_header *)(buffer + 20);
+  header->id = 0x15;
+  header->flags = be ? 0x00 : 0x01;
+  header->length = swap ? ddsrt_bswap2u((uint16_t) length) : (uint16_t) length;
+
+  ptr = (unsigned char *)(header + 1);
+  memcpy((char *)ptr, sample_test_data, length);
+
+  submsg->_length = submsg->_maximum = (uint32_t) (20 + length + sizeof(struct submsg_header));
+  submsg->_buffer = buffer;
+}
+
+static bool check_sign(DDS_Security_ParticipantCryptoHandle participant_crypto, uint32_t session_id, uint32_t key_id, uint32_t key_size, unsigned char *init_vector, unsigned char *common_mac, unsigned char *hmac)
+{
+  master_key_material *keymat;
+  crypto_session_key_t key;
+  unsigned char md[CRYPTO_HMAC_SIZE];
+
+  memset(md, 0, CRYPTO_HMAC_SIZE);
+
+  keymat = get_remote_participant_key_material(participant_crypto);
+  if (key_id != keymat->receiver_specific_key_id)
+  {
+    printf("check_sign: key_id(%d) does not match key_mat(%d)\n", (int)key_id, (int)keymat->receiver_specific_key_id);
+    return false;
+  }
+  else if (!calculate_receiver_specific_key_test(&key, session_id, keymat->master_salt, keymat->master_receiver_specific_key, keymat->transformation_kind))
+  {
+    printf("check_sign: calculate key failed\n");
+    return false;
+  }
+  else if (!cipher_sign_data(key.data, key_size, init_vector, common_mac, CRYPTO_HMAC_SIZE, md))
+  {
+    return false;
+  }
+  else if (memcmp(hmac, md, CRYPTO_HMAC_SIZE) != 0)
+  {
+    printf("check_sign: hmac incorrect\n");
+
+    //print_octets("Reader Specific Key:", key, CRYPTO_KEY_SIZE);
+    //print_octets("Common:", common_mac, CRYPTO_HMAC_SIZE);
+    //print_octets("Hmac:", hmac, CRYPTO_HMAC_SIZE);
+    //print_octets("MD:", md, CRYPTO_HMAC_SIZE);
+    return false;
+  }
+
+  return true;
+}
+
+static bool check_signing(
+    DDS_Security_ParticipantCryptoHandleSeq *list,
+    struct crypto_footer *footer,
+    uint32_t session_id,
+    unsigned char *init_vector,
+    uint32_t key_size)
+{
+  struct receiver_specific_mac *rmac;
+  uint32_t key_id;
+  uint32_t i;
+
+  if (footer->length != list->_length)
+  {
+    return false;
+  }
+
+  rmac = (struct receiver_specific_mac *)(footer + 1);
+
+  for (i = 0; i < list->_length; i++)
+  {
+    key_id = ddsrt_bswap4u(*(uint32_t *)rmac[i].receiver_mac_key_id);
+    if (!check_sign(list->_buffer[i], session_id, key_id, key_size, init_vector, footer->common_mac, rmac[i].receiver_mac))
+    {
+      return false;
+    }
+  }
+
+  return true;
+}
+
+static void suite_encode_rtps_message_init(void)
+{
+  allocate_shared_secret();
+  CU_ASSERT_FATAL ((plugins = load_plugins(
+                      NULL    /* Access Control */,
+                      NULL    /* Authentication */,
+                      &crypto /* Cryptograpy    */)) != NULL);
+}
+
+static void suite_encode_rtps_message_fini(void)
+{
+  deallocate_shared_secret();
+  unload_plugins(plugins);
+}
+
+static void prepare_participant_security_attributes_and_properties(
+    DDS_Security_ParticipantSecurityAttributes *attributes,
+    DDS_Security_PropertySeq *properties,
+    DDS_Security_CryptoTransformKind_Enum transformation_kind,
+    bool is_origin_authenticated)
+{
+  memset(attributes, 0, sizeof(DDS_Security_ParticipantSecurityAttributes));
+  memset(properties, 0, sizeof(DDS_Security_PropertySeq));
+
+  attributes->allow_unauthenticated_participants = false;
+  attributes->is_access_protected = false;
+  attributes->is_discovery_protected = false;
+  attributes->is_liveliness_protected = false;
+
+  properties->_maximum = properties->_length = 1;
+  properties->_buffer = ddsrt_malloc(sizeof(DDS_Security_Property_t));
+
+  properties->_buffer[0].name = ddsrt_strdup("dds.sec.crypto.keysize");
+  if (transformation_kind == CRYPTO_TRANSFORMATION_KIND_AES128_GCM || transformation_kind == CRYPTO_TRANSFORMATION_KIND_AES128_GMAC)
+  {
+    properties->_buffer[0].value = ddsrt_strdup("128");
+  }
+  else
+  {
+    properties->_buffer[0].value = ddsrt_strdup("256");
+  }
+
+  switch (transformation_kind)
+  {
+  case CRYPTO_TRANSFORMATION_KIND_AES128_GCM:
+  case CRYPTO_TRANSFORMATION_KIND_AES256_GCM:
+    attributes->is_rtps_protected = true;
+    attributes->plugin_participant_attributes = DDS_SECURITY_PARTICIPANT_ATTRIBUTES_FLAG_IS_VALID;
+    attributes->plugin_participant_attributes |= DDS_SECURITY_PLUGIN_PARTICIPANT_ATTRIBUTES_FLAG_IS_RTPS_ENCRYPTED;
+    if (is_origin_authenticated)
+    {
+      attributes->plugin_participant_attributes |= DDS_SECURITY_PLUGIN_PARTICIPANT_ATTRIBUTES_FLAG_IS_RTPS_AUTHENTICATED;
+    }
+    break;
+
+  case CRYPTO_TRANSFORMATION_KIND_AES256_GMAC:
+  case CRYPTO_TRANSFORMATION_KIND_AES128_GMAC:
+    attributes->is_rtps_protected = true;
+    if (is_origin_authenticated)
+    {
+      attributes->plugin_participant_attributes = DDS_SECURITY_PARTICIPANT_ATTRIBUTES_FLAG_IS_VALID;
+      attributes->plugin_participant_attributes |= DDS_SECURITY_PLUGIN_PARTICIPANT_ATTRIBUTES_FLAG_IS_RTPS_AUTHENTICATED;
+    }
+    break;
+
+  default:
+    assert(0);
+    break;
+  }
+}
+
+static void encode_rtps_message_not_authenticated(DDS_Security_CryptoTransformKind_Enum transformation_kind, uint32_t key_size, bool encrypted)
+{
+  DDS_Security_boolean result;
+  DDS_Security_DatareaderCryptoHandleSeq reader_list;
+  int32_t index;
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  DDS_Security_OctetSeq plain_buffer;
+  DDS_Security_OctetSeq encoded_buffer;
+  DDS_Security_OctetSeq decoded_buffer;
+  DDS_Security_OctetSeq data;
+  session_key_material *session_keys;
+  struct crypto_header *header = NULL;
+  struct crypto_footer *footer = NULL;
+  uint32_t session_id;
+  DDS_Security_ParticipantSecurityAttributes attributes;
+  DDS_Security_PropertySeq properties;
+
+  CU_ASSERT_FATAL(crypto != NULL);
+  CU_ASSERT_FATAL(crypto->crypto_transform != NULL);
+  CU_ASSERT_FATAL(crypto->crypto_transform->encode_rtps_message != NULL);
+
+  prepare_participant_security_attributes_and_properties(&attributes, &properties, transformation_kind, false);
+
+  register_local_participant(&attributes, &properties);
+
+  initialize_rtps_message(&plain_buffer, false);
+
+  session_keys = get_local_participant_session(local_particpant_crypto);
+
+  session_keys->master_key_material->transformation_kind = transformation_kind;
+  session_keys->key_size = key_size;
+
+  reader_list._length = reader_list._maximum = 1;
+  reader_list._buffer = DDS_Security_ParticipantCryptoHandleSeq_allocbuf(1);
+  reader_list._buffer[0] = remote_particpant_cryptos[0];
+  index = 0;
+
+  /* Now call the function. */
+  result = crypto->crypto_transform->encode_rtps_message(
+      crypto->crypto_transform,
+      &encoded_buffer,
+      &plain_buffer,
+      local_particpant_crypto,
+      &reader_list,
+      &index,
+      &exception);
+
+  if (!result)
+  {
+    printf("encode_rtps_message: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+
+  CU_ASSERT_FATAL(result);
+  CU_ASSERT(exception.code == 0);
+  CU_ASSERT(exception.message == NULL);
+
+  reset_exception(&exception);
+
+  result = check_encoded_data(&encoded_buffer, encrypted, &header, &footer, &data);
+  CU_ASSERT_FATAL(result);
+
+  CU_ASSERT(header->transform_identifier.transformation_kind[3] == transformation_kind);
+
+  session_id = ddsrt_bswap4u(*(uint32_t *)header->session_id);
+
+  if (encrypted)
+  {
+    decoded_buffer._buffer = ddsrt_malloc(plain_buffer._length + 24); /* info_src is added */
+    decoded_buffer._length = 0;
+    decoded_buffer._maximum = plain_buffer._length + 24; /* info_src is added */
+
+    result = crypto_decrypt_data(session_id, &header->session_id[0], header->transform_identifier.transformation_kind,
+                                 session_keys->master_key_material, &data, &decoded_buffer, footer->common_mac);
+
+    if (!result)
+    {
+      printf("Decode failed\n");
+    }
+
+    CU_ASSERT_FATAL(result);
+
+    //print_octets( "PLAIN RTPS:",plain_buffer._buffer+4, plain_buffer._length-4);
+    //print_octets( "DECODED RTPS:",decoded_buffer._buffer+8, decoded_buffer._length-8);
+
+    CU_ASSERT_FATAL(memcmp(plain_buffer._buffer + 4, decoded_buffer._buffer + 8, plain_buffer._length - 4) == 0);
+
+    DDS_Security_OctetSeq_deinit((&decoded_buffer));
+  }
+  else
+  {
+    result = crypto_decrypt_data(session_id, &header->session_id[0], header->transform_identifier.transformation_kind,
+                                 session_keys->master_key_material, &data, NULL, footer->common_mac);
+    if (!result)
+    {
+      printf("Decode failed\n");
+    }
+
+    CU_ASSERT_FATAL(result);
+
+    CU_ASSERT_FATAL(memcmp(plain_buffer._buffer + 4, data._buffer + 8, plain_buffer._length - 4) == 0);
+  }
+
+  DDS_Security_OctetSeq_deinit((&plain_buffer));
+  DDS_Security_OctetSeq_deinit((&encoded_buffer));
+  DDS_Security_DatareaderCryptoHandleSeq_deinit(&reader_list);
+
+  ddsrt_free(footer);
+  ddsrt_free(header);
+
+  DDS_Security_PropertySeq_deinit(&properties);
+  unregister_local_participant();
+}
+
+CU_Test(ddssec_builtin_encode_rtps_message, encrypt_256, .init = suite_encode_rtps_message_init, .fini = suite_encode_rtps_message_fini)
+{
+  encode_rtps_message_not_authenticated(CRYPTO_TRANSFORMATION_KIND_AES256_GCM, 256, true);
+}
+
+CU_Test(ddssec_builtin_encode_rtps_message, encrypt_128, .init = suite_encode_rtps_message_init, .fini = suite_encode_rtps_message_fini)
+{
+  encode_rtps_message_not_authenticated(CRYPTO_TRANSFORMATION_KIND_AES128_GCM, 128, true);
+}
+
+CU_Test(ddssec_builtin_encode_rtps_message, no_encrypt_256, .init = suite_encode_rtps_message_init, .fini = suite_encode_rtps_message_fini)
+{
+  encode_rtps_message_not_authenticated(CRYPTO_TRANSFORMATION_KIND_AES256_GMAC, 256, false);
+}
+
+CU_Test(ddssec_builtin_encode_rtps_message, no_encrypt_128, .init = suite_encode_rtps_message_init, .fini = suite_encode_rtps_message_fini)
+{
+  encode_rtps_message_not_authenticated(CRYPTO_TRANSFORMATION_KIND_AES128_GMAC, 128, false);
+}
+
+static void encode_rtps_message_sign(DDS_Security_CryptoTransformKind_Enum transformation_kind, uint32_t key_size, DDS_Security_ProtectionKind protection_kind, bool encoded)
+{
+  DDS_Security_boolean result;
+  DDS_Security_DatareaderCryptoHandleSeq reader_list;
+  int32_t index;
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  DDS_Security_OctetSeq plain_buffer;
+  DDS_Security_OctetSeq encoded_buffer;
+  DDS_Security_OctetSeq decoded_buffer;
+  DDS_Security_OctetSeq data;
+  DDS_Security_OctetSeq *buffer;
+  session_key_material *session_keys;
+  DDS_Security_ParticipantSecurityAttributes attributes;
+  DDS_Security_PropertySeq properties;
+  struct crypto_header *header = NULL;
+  struct crypto_footer *footer = NULL;
+  uint32_t session_id;
+  int i;
+
+  CU_ASSERT_FATAL(crypto != NULL);
+  CU_ASSERT_FATAL(crypto->crypto_transform != NULL);
+  CU_ASSERT_FATAL(crypto->crypto_transform->encode_rtps_message != NULL);
+
+  prepare_participant_security_attributes_and_properties(&attributes, &properties, transformation_kind, true);
+
+  register_local_participant(&attributes, &properties);
+
+  initialize_rtps_message(&plain_buffer, false);
+
+  CU_ASSERT_FATAL(local_particpant_crypto != 0);
+
+  session_keys = get_local_participant_session(local_particpant_crypto);
+  session_keys->master_key_material->transformation_kind = transformation_kind;
+  session_keys->key_size = key_size;
+  set_protection_kind(local_particpant_crypto, protection_kind);
+
+  register_remote_participants();
+
+  reader_list._length = reader_list._maximum = 4;
+  reader_list._buffer = DDS_Security_ParticipantCryptoHandleSeq_allocbuf(4);
+  for (i = 0; i < 4; i++)
+  {
+    set_remote_participant_protection_kind(remote_particpant_cryptos[i], protection_kind);
+    reader_list._buffer[i] = remote_particpant_cryptos[i];
+  }
+  index = 0;
+
+  /* Now call the function. */
+
+  buffer = &plain_buffer;
+  while (index != 4)
+  {
+    result = crypto->crypto_transform->encode_rtps_message(
+        crypto->crypto_transform,
+        &encoded_buffer,
+        buffer,
+        local_particpant_crypto,
+        &reader_list,
+        &index,
+        &exception);
+
+    if (!result)
+    {
+      printf("encode_rtps_message: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+
+    CU_ASSERT_FATAL(result);
+    CU_ASSERT(exception.code == 0);
+    CU_ASSERT(exception.message == NULL);
+
+    reset_exception(&exception);
+    buffer = NULL;
+  }
+
+  result = check_encoded_data(&encoded_buffer, encoded, &header, &footer, &data);
+  CU_ASSERT_FATAL(result);
+
+  CU_ASSERT(header->transform_identifier.transformation_kind[3] == transformation_kind);
+
+  session_id = ddsrt_bswap4u(*(uint32_t *)header->session_id);
+
+  if (encoded)
+  {
+    decoded_buffer._buffer = ddsrt_malloc(plain_buffer._length + 24); /* info_src is added */
+    decoded_buffer._length = 0;
+    decoded_buffer._maximum = plain_buffer._length + 24; /* info_src is added */
+
+    result = crypto_decrypt_data(session_id, &header->session_id[0], header->transform_identifier.transformation_kind,
+                                 session_keys->master_key_material, &data, &decoded_buffer, footer->common_mac);
+    if (!result)
+    {
+      printf("Decode failed\n");
+    }
+
+    CU_ASSERT_FATAL(result);
+
+    /*TODO: this should consider INFO_SRC */
+    CU_ASSERT(memcmp(plain_buffer._buffer + 4, decoded_buffer._buffer + 8, plain_buffer._length - 4) == 0);
+
+    DDS_Security_OctetSeq_deinit((&decoded_buffer));
+  }
+  else
+  {
+    result = crypto_decrypt_data(session_id, header->session_id, header->transform_identifier.transformation_kind,
+                                 session_keys->master_key_material, &data, NULL, footer->common_mac);
+
+    if (!result)
+    {
+      printf("Decode failed\n");
+    }
+
+    CU_ASSERT_FATAL(result);
+    CU_ASSERT(memcmp(plain_buffer._buffer + 4, data._buffer + 8, plain_buffer._length - 4) == 0);
+  }
+
+  printf("num hmacs = %u\n", footer->length);
+
+  CU_ASSERT(check_signing(&reader_list, footer, session_id, header->session_id, session_keys->key_size));
+
+  unregister_remote_participants();
+
+  DDS_Security_OctetSeq_deinit((&plain_buffer));
+  DDS_Security_OctetSeq_deinit((&encoded_buffer));
+  DDS_Security_DatareaderCryptoHandleSeq_deinit(&reader_list);
+  DDS_Security_PropertySeq_deinit(&properties);
+
+  ddsrt_free(footer);
+  ddsrt_free(header);
+
+  unregister_local_participant();
+}
+
+CU_Test(ddssec_builtin_encode_rtps_message, encrypt_sign_256, .init = suite_encode_rtps_message_init, .fini = suite_encode_rtps_message_fini)
+{
+  encode_rtps_message_sign(CRYPTO_TRANSFORMATION_KIND_AES256_GCM, 256, DDS_SECURITY_PROTECTION_KIND_ENCRYPT_WITH_ORIGIN_AUTHENTICATION, true);
+}
+
+CU_Test(ddssec_builtin_encode_rtps_message, encrypt_sign_128, .init = suite_encode_rtps_message_init, .fini = suite_encode_rtps_message_fini)
+{
+  encode_rtps_message_sign(CRYPTO_TRANSFORMATION_KIND_AES128_GCM, 128, DDS_SECURITY_PROTECTION_KIND_ENCRYPT_WITH_ORIGIN_AUTHENTICATION, true);
+}
+
+CU_Test(ddssec_builtin_encode_rtps_message, no_encrypt_sign_256, .init = suite_encode_rtps_message_init, .fini = suite_encode_rtps_message_fini)
+{
+  encode_rtps_message_sign(CRYPTO_TRANSFORMATION_KIND_AES256_GMAC, 256, DDS_SECURITY_PROTECTION_KIND_SIGN_WITH_ORIGIN_AUTHENTICATION, false);
+}
+
+CU_Test(ddssec_builtin_encode_rtps_message, no_encrypt_sign_128, .init = suite_encode_rtps_message_init, .fini = suite_encode_rtps_message_fini)
+{
+  encode_rtps_message_sign(CRYPTO_TRANSFORMATION_KIND_AES128_GMAC, 128, DDS_SECURITY_PROTECTION_KIND_SIGN_WITH_ORIGIN_AUTHENTICATION, false);
+}
+
+CU_Test(ddssec_builtin_encode_rtps_message, invalid_args, .init = suite_encode_rtps_message_init, .fini = suite_encode_rtps_message_fini)
+{
+  DDS_Security_boolean result;
+  DDS_Security_ParticipantCryptoHandleSeq reader_list;
+  DDS_Security_ParticipantCryptoHandleSeq empty_reader_list;
+  int32_t index;
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  DDS_Security_OctetSeq plain_buffer;
+  DDS_Security_OctetSeq encoded_buffer;
+  DDS_Security_ParticipantSecurityAttributes attributes;
+  DDS_Security_PropertySeq properties;
+  unsigned i;
+
+  CU_ASSERT_FATAL(crypto != NULL);
+  CU_ASSERT_FATAL(crypto->crypto_transform != NULL);
+  CU_ASSERT_FATAL(crypto->crypto_transform->encode_rtps_message != NULL);
+
+  prepare_participant_security_attributes_and_properties(&attributes, &properties, CRYPTO_TRANSFORMATION_KIND_AES256_GCM, true);
+
+  register_local_participant(&attributes, &properties);
+
+  initialize_rtps_message(&plain_buffer, false);
+  memset(&empty_reader_list, 0, sizeof(empty_reader_list));
+
+  CU_ASSERT_FATAL(local_particpant_crypto != 0);
+
+  register_remote_participants();
+  for (i = 0; i < 4; i++)
+  {
+    set_remote_participant_protection_kind(remote_particpant_cryptos[i], DDS_SECURITY_PROTECTION_KIND_ENCRYPT_WITH_ORIGIN_AUTHENTICATION);
+  }
+
+  CU_ASSERT_FATAL(remote_particpant_cryptos[0] != 0);
+
+  reader_list._length = reader_list._maximum = 1;
+  reader_list._buffer = DDS_Security_ParticipantCryptoHandleSeq_allocbuf(1);
+  reader_list._buffer[0] = remote_particpant_cryptos[0];
+  index = 0;
+
+  /* encoded_buffer NULL */
+  result = crypto->crypto_transform->encode_rtps_message(
+      crypto->crypto_transform,
+      NULL,
+      &plain_buffer,
+      local_particpant_crypto,
+      &reader_list,
+      &index,
+      &exception);
+
+  if (!result)
+  {
+    printf("encode_rtps_message: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+
+  CU_ASSERT(!result);
+  CU_ASSERT(exception.code != 0);
+  CU_ASSERT(exception.message != NULL);
+
+  reset_exception(&exception);
+
+  /* plain_buffer NULL */
+  result = crypto->crypto_transform->encode_rtps_message(
+      crypto->crypto_transform,
+      &encoded_buffer,
+      NULL,
+      local_particpant_crypto,
+      &reader_list,
+      &index,
+      &exception);
+
+  if (!result)
+  {
+    printf("encode_rtps_message: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+
+  CU_ASSERT(!result);
+  CU_ASSERT(exception.code != 0);
+  CU_ASSERT(exception.message != NULL);
+
+  reset_exception(&exception);
+
+  /* writer crypto 0 */
+  result = crypto->crypto_transform->encode_rtps_message(
+      crypto->crypto_transform,
+      &encoded_buffer,
+      &plain_buffer,
+      0,
+      &reader_list,
+      &index,
+      &exception);
+
+  if (!result)
+  {
+    printf("encode_rtps_message: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+
+  CU_ASSERT(!result);
+  CU_ASSERT(exception.code != 0);
+  CU_ASSERT(exception.message != NULL);
+
+  reset_exception(&exception);
+
+  /* writer crypto unknown */
+  result = crypto->crypto_transform->encode_rtps_message(
+      crypto->crypto_transform,
+      &encoded_buffer,
+      &plain_buffer,
+      1,
+      &reader_list,
+      &index,
+      &exception);
+
+  if (!result)
+  {
+    printf("encode_rtps_message: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+
+  CU_ASSERT(!result);
+  CU_ASSERT(exception.code != 0);
+  CU_ASSERT(exception.message != NULL);
+
+  reset_exception(&exception);
+
+  /* reader crypto list NULL*/
+  result = crypto->crypto_transform->encode_rtps_message(
+      crypto->crypto_transform,
+      &encoded_buffer,
+      &plain_buffer,
+      local_particpant_crypto,
+      NULL,
+      &index,
+      &exception);
+
+  if (!result)
+  {
+    printf("encode_rtps_message: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+
+  CU_ASSERT(!result);
+  CU_ASSERT(exception.code != 0);
+  CU_ASSERT(exception.message != NULL);
+
+  reset_exception(&exception);
+
+  /* empty reader crypto list */
+  result = crypto->crypto_transform->encode_rtps_message(
+      crypto->crypto_transform,
+      &encoded_buffer,
+      &plain_buffer,
+      local_particpant_crypto,
+      &empty_reader_list,
+      &index,
+      &exception);
+
+  if (!result)
+  {
+    printf("encode_rtps_message: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+
+  CU_ASSERT(!result);
+  CU_ASSERT(exception.code != 0);
+  CU_ASSERT(exception.message != NULL);
+
+  reset_exception(&exception);
+
+  /* reader crypto list with invalid reader crypto */
+  reader_list._buffer[0] = 0;
+  result = crypto->crypto_transform->encode_rtps_message(
+      crypto->crypto_transform,
+      &encoded_buffer,
+      &plain_buffer,
+      local_particpant_crypto,
+      &reader_list,
+      &index,
+      &exception);
+
+  if (!result)
+  {
+    printf("encode_rtps_message: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+
+  CU_ASSERT(!result);
+  CU_ASSERT(exception.code != 0);
+  CU_ASSERT(exception.message != NULL);
+
+  reset_exception(&exception);
+
+  /* reader crypto list with unknown reader crypto*/
+  reader_list._buffer[0] = 1;
+  result = crypto->crypto_transform->encode_rtps_message(
+      crypto->crypto_transform,
+      &encoded_buffer,
+      &plain_buffer,
+      local_particpant_crypto,
+      &reader_list,
+      &index,
+      &exception);
+
+  if (!result)
+  {
+    printf("encode_rtps_message: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+
+  CU_ASSERT(!result);
+  CU_ASSERT(exception.code != 0);
+  CU_ASSERT(exception.message != NULL);
+
+  reset_exception(&exception);
+
+  reader_list._buffer[0] = local_particpant_crypto;
+
+  /* index NULL*/
+  result = crypto->crypto_transform->encode_rtps_message(
+      crypto->crypto_transform,
+      &encoded_buffer,
+      &plain_buffer,
+      local_particpant_crypto,
+      &reader_list,
+      NULL,
+      &exception);
+
+  if (!result)
+  {
+    printf("encode_rtps_message: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+
+  CU_ASSERT(!result);
+  CU_ASSERT(exception.code != 0);
+  CU_ASSERT(exception.message != NULL);
+
+  reset_exception(&exception);
+
+  /* invalid index */
+  index = 2;
+  result = crypto->crypto_transform->encode_rtps_message(
+      crypto->crypto_transform,
+      &encoded_buffer,
+      &plain_buffer,
+      local_particpant_crypto,
+      &reader_list,
+      &index,
+      &exception);
+
+  if (!result)
+  {
+    printf("encode_rtps_message: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+
+  CU_ASSERT(!result);
+  CU_ASSERT(exception.code != 0);
+  CU_ASSERT(exception.message != NULL);
+
+  unregister_remote_participants();
+
+  reset_exception(&exception);
+
+  DDS_Security_OctetSeq_deinit((&plain_buffer));
+  DDS_Security_DatareaderCryptoHandleSeq_deinit(&reader_list);
+  DDS_Security_PropertySeq_deinit(&properties);
+
+  unregister_local_participant();
+}
+
diff --git a/src/security/builtin_plugins/tests/encode_serialized_payload/src/encode_serialized_payload_utests.c b/src/security/builtin_plugins/tests/encode_serialized_payload/src/encode_serialized_payload_utests.c
new file mode 100644
index 0000000..f477ea3
--- /dev/null
+++ b/src/security/builtin_plugins/tests/encode_serialized_payload/src/encode_serialized_payload_utests.c
@@ -0,0 +1,786 @@
+/*
+ * Copyright(c) 2006 to 2019 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+#include <assert.h>
+#include <openssl/evp.h>
+#include <openssl/hmac.h>
+#include <openssl/bio.h>
+#include <openssl/err.h>
+
+#include "dds/ddsrt/bswap.h"
+#include "dds/ddsrt/heap.h"
+#include "dds/ddsrt/string.h"
+#include "dds/ddsrt/types.h"
+#include "dds/ddsrt/environ.h"
+#include "dds/security/dds_security_api.h"
+#include "dds/security/core/dds_security_serialize.h"
+#include "dds/security/core/dds_security_utils.h"
+#include "dds/security/core/shared_secret.h"
+#include "CUnit/CUnit.h"
+#include "CUnit/Test.h"
+#include "common/src/loader.h"
+#include "common/src/crypto_helper.h"
+#include "crypto_objects.h"
+#include "crypto_utils.h"
+
+#define TEST_SHARED_SECRET_SIZE 32
+
+static struct plugins_hdl *plugins = NULL;
+static dds_security_cryptography *crypto = NULL;
+
+static DDS_Security_IdentityHandle g_local_participant_identity = 1;
+static DDS_Security_IdentityHandle g_remote_participant_identity = 2;
+
+static DDS_Security_ParticipantCryptoHandle g_local_participant_crypto = 0;
+static DDS_Security_ParticipantCryptoHandle g_remote_participant_crypto = 0;
+
+static DDS_Security_SharedSecretHandle g_shared_secret_handle = DDS_SECURITY_HANDLE_NIL;
+
+static const char *SAMPLE_TEST_DATA =
+    "ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789abcdefghijklmnopqrstuvwxyz"
+    "ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789abcdefghijklmnopqrstuvwxyz"
+    "ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789abcdefghijklmnopqrstuvwxyz"
+    "ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789abcdefghijklmnopqrstuvwxy";
+
+struct crypto_header
+{
+  struct CryptoTransformIdentifier transform_identifier;
+  unsigned char session_id[4];
+  unsigned char init_vector_suffix[8];
+};
+
+struct crypto_footer
+{
+  unsigned char common_mac[16];
+  uint32_t length;
+};
+
+static void reset_exception(DDS_Security_SecurityException *ex)
+{
+  ex->code = 0;
+  ex->minor_code = 0;
+  ddsrt_free(ex->message);
+  ex->message = NULL;
+}
+
+static void allocate_shared_secret(void)
+{
+  DDS_Security_SharedSecretHandleImpl *shared_secret_handle_impl;
+  int32_t i;
+
+  shared_secret_handle_impl = ddsrt_malloc(sizeof(DDS_Security_SharedSecretHandleImpl));
+
+  shared_secret_handle_impl->shared_secret = ddsrt_malloc(TEST_SHARED_SECRET_SIZE * sizeof(unsigned char));
+  shared_secret_handle_impl->shared_secret_size = TEST_SHARED_SECRET_SIZE;
+
+  for (i = 0; i < shared_secret_handle_impl->shared_secret_size; i++)
+  {
+    shared_secret_handle_impl->shared_secret[i] = (unsigned char)(i % 20);
+  }
+
+  for (i = 0; i < 32; i++)
+  {
+    shared_secret_handle_impl->challenge1[i] = (unsigned char)(i % 15);
+    shared_secret_handle_impl->challenge2[i] = (unsigned char)(i % 12);
+  }
+
+  g_shared_secret_handle = (DDS_Security_SharedSecretHandle)shared_secret_handle_impl;
+}
+
+static void deallocate_shared_secret(void)
+{
+  DDS_Security_SharedSecretHandleImpl *shared_secret_handle_impl = (DDS_Security_SharedSecretHandleImpl *)g_shared_secret_handle;
+  ddsrt_free(shared_secret_handle_impl->shared_secret);
+  ddsrt_free(shared_secret_handle_impl);
+}
+
+static void prepare_participant_security_attributes(DDS_Security_ParticipantSecurityAttributes *attributes)
+{
+  memset(attributes, 0, sizeof(DDS_Security_ParticipantSecurityAttributes));
+  attributes->allow_unauthenticated_participants = false;
+  attributes->is_access_protected = false;
+  attributes->is_discovery_protected = false;
+  attributes->is_liveliness_protected = false;
+  attributes->is_rtps_protected = true;
+  attributes->plugin_participant_attributes = DDS_SECURITY_PARTICIPANT_ATTRIBUTES_FLAG_IS_VALID;
+  attributes->plugin_participant_attributes |= DDS_SECURITY_PLUGIN_PARTICIPANT_ATTRIBUTES_FLAG_IS_RTPS_ENCRYPTED;
+}
+
+static int register_local_participant(void)
+{
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  DDS_Security_PermissionsHandle participant_permissions = 3; //valid dummy value
+  DDS_Security_PropertySeq participant_properties;
+  DDS_Security_ParticipantSecurityAttributes participant_security_attributes;
+
+  memset(&participant_properties, 0, sizeof(participant_properties));
+  prepare_participant_security_attributes(&participant_security_attributes);
+
+  g_local_participant_crypto =
+      crypto->crypto_key_factory->register_local_participant(
+          crypto->crypto_key_factory,
+          g_local_participant_identity,
+          participant_permissions,
+          &participant_properties,
+          &participant_security_attributes,
+          &exception);
+
+  if (g_local_participant_crypto == 0)
+  {
+    printf("[ERROR] register_local_participant: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+
+  return g_local_participant_crypto ? 0 : -1;
+}
+
+static void unregister_local_participant(void)
+{
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  if (g_local_participant_crypto)
+  {
+    crypto->crypto_key_factory->unregister_participant(crypto->crypto_key_factory, g_local_participant_crypto, &exception);
+    reset_exception(&exception);
+  }
+}
+
+static int register_remote_participant(void)
+{
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  DDS_Security_PermissionsHandle remote_participant_permissions = 5;
+
+  g_remote_participant_crypto =
+      crypto->crypto_key_factory->register_matched_remote_participant(
+          crypto->crypto_key_factory,
+          g_local_participant_crypto,
+          g_remote_participant_identity,
+          remote_participant_permissions,
+          g_shared_secret_handle,
+          &exception);
+
+  if (g_remote_participant_crypto == 0)
+  {
+    printf("[ERROR] register_matched_remote_participant: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+
+  return g_remote_participant_crypto ? 0 : -1;
+}
+
+static void unregister_remote_participant(void)
+{
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  if (g_remote_participant_crypto)
+  {
+    crypto->crypto_key_factory->unregister_participant(crypto->crypto_key_factory, g_remote_participant_crypto, &exception);
+    reset_exception(&exception);
+  }
+}
+
+static DDS_Security_DatawriterCryptoHandle register_local_datawriter(bool encrypted)
+{
+  DDS_Security_DatawriterCryptoHandle writer_crypto;
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  DDS_Security_PropertySeq datawriter_properties;
+  DDS_Security_EndpointSecurityAttributes datawriter_security_attributes;
+
+  memset(&datawriter_properties, 0, sizeof(datawriter_properties));
+  memset(&datawriter_security_attributes, 0, sizeof(datawriter_security_attributes));
+  datawriter_security_attributes.is_payload_protected = true;
+  if (encrypted)
+  {
+    datawriter_security_attributes.plugin_endpoint_attributes |= DDS_SECURITY_PLUGIN_ENDPOINT_ATTRIBUTES_FLAG_IS_PAYLOAD_ENCRYPTED;
+  }
+
+  writer_crypto =
+      crypto->crypto_key_factory->register_local_datawriter(
+          crypto->crypto_key_factory,
+          g_local_participant_crypto,
+          &datawriter_properties,
+          &datawriter_security_attributes,
+          &exception);
+
+  if (writer_crypto == 0)
+  {
+    printf("[ERROR] register_local_datawriter: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+
+  return writer_crypto;
+}
+
+static void unregister_local_datawriter(DDS_Security_DatawriterCryptoHandle writer_crypto)
+{
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  if (writer_crypto)
+  {
+    crypto->crypto_key_factory->unregister_datawriter(crypto->crypto_key_factory, writer_crypto, &exception);
+    reset_exception(&exception);
+  }
+}
+
+static DDS_Security_DatareaderCryptoHandle register_remote_datareader(DDS_Security_DatawriterCryptoHandle writer_crypto)
+{
+  DDS_Security_DatareaderCryptoHandle reader_crypto;
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  DDS_Security_PropertySeq datawriter_properties;
+
+  memset(&datawriter_properties, 0, sizeof(datawriter_properties));
+
+  reader_crypto =
+      crypto->crypto_key_factory->register_matched_remote_datareader(
+          crypto->crypto_key_factory,
+          writer_crypto,
+          g_remote_participant_crypto,
+          g_shared_secret_handle,
+          true,
+          &exception);
+
+  if (reader_crypto == 0)
+  {
+    printf("[ERROR] register_matched_remote_datareader: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+
+  return reader_crypto;
+}
+
+static void unregister_remote_datareader(DDS_Security_DatareaderCryptoHandle reader_crypto)
+{
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  if (reader_crypto)
+  {
+    crypto->crypto_key_factory->unregister_datareader(crypto->crypto_key_factory, reader_crypto, &exception);
+    reset_exception(&exception);
+  }
+}
+
+static bool split_encoded_data(unsigned char *data, uint32_t size, struct crypto_header **header, DDS_Security_OctetSeq *payload, struct crypto_footer **footer, bool encrypted)
+{
+  /* The length is the length of the encrypted data and the common_mac of the footer
+     * For the serialized payload the footer consists of the common_mac and the length
+     * of the receiver_specific_mac which is set to 0 */
+  static const uint32_t FOOTER_SIZE = 20;
+  unsigned char *header_ptr;
+  unsigned char *payload_ptr;
+  unsigned char *footer_ptr;
+  uint32_t payload_size;
+
+  if (size < (sizeof(struct crypto_header) + FOOTER_SIZE))
+  {
+    return false;
+  }
+
+  header_ptr = data;
+  payload_ptr = data + sizeof(struct crypto_header);
+  footer_ptr = data + size - FOOTER_SIZE;
+
+  /* Get header. */
+  *header = (struct crypto_header *)header_ptr;
+
+  /* Get payload */
+  payload_size = (uint32_t)(footer_ptr - payload_ptr);
+  if (encrypted)
+  {
+    /* CryptoContent starts with 4 bytes length. */
+    if (payload_size < 4)
+    {
+      return false;
+    }
+    payload->_length = ddsrt_fromBE4u(*(uint32_t *)payload_ptr);
+    payload->_buffer = payload_ptr + 4;
+    if ((payload_size - 4) != payload->_length)
+    {
+      return false;
+    }
+  }
+  else
+  {
+    /* Just the clear payload */
+    payload->_length = payload_size;
+    payload->_buffer = payload_ptr;
+  }
+  payload->_maximum = payload->_length;
+
+  /* Get footer. */
+  *footer = (struct crypto_footer *)footer_ptr;
+
+  return true;
+}
+
+static bool crypto_decrypt_data(uint32_t session_id, unsigned char *iv, DDS_Security_CryptoTransformKind transformation_kind, master_key_material *key_material, DDS_Security_OctetSeq *encrypted, DDS_Security_OctetSeq *decoded, unsigned char *tag)
+{
+  bool result = true;
+  EVP_CIPHER_CTX *ctx;
+  crypto_session_key_t session_key;
+  uint32_t key_size = crypto_get_key_size(CRYPTO_TRANSFORM_KIND(transformation_kind));
+  int len = 0;
+
+  if (!crypto_calculate_session_key_test(&session_key, session_id, key_material->master_salt, key_material->master_sender_key, key_material->transformation_kind))
+  {
+    printf("[ERROR] (%d) crypto_decrypt_data: could not calculate session key!\n", __LINE__);
+    return false;
+  }
+
+  /* create the cipher context */
+  ctx = EVP_CIPHER_CTX_new();
+  if (ctx)
+  {
+    if (key_size == 128)
+    {
+      if (!EVP_DecryptInit_ex(ctx, EVP_aes_128_gcm(), NULL, NULL, NULL))
+      {
+        printf("[ERROR] (%d) crypto_decrypt_data: could not get init CIPHER_CTX (128)\n", __LINE__);
+        ERR_print_errors_fp(stderr);
+        result = false;
+      }
+    }
+    else if (key_size == 256)
+    {
+      if (!EVP_DecryptInit_ex(ctx, EVP_aes_256_gcm(), NULL, NULL, NULL))
+      {
+        printf("[ERROR] (%d) crypto_decrypt_data: could not get init CIPHER_CTX (256)\n", __LINE__);
+        ERR_print_errors_fp(stderr);
+        result = false;
+      }
+    }
+    else
+    {
+      printf("[ERROR] (%d) crypto_decrypt_data: could not determine keysize\n", __LINE__);
+      result = false;
+    }
+  }
+  else
+  {
+    printf("[ERROR] (%d) crypto_decrypt_data: could not get new CIPHER_CTX\n", __LINE__);
+    result = false;
+  }
+
+  if (result)
+  {
+    if (!EVP_DecryptInit_ex(ctx, NULL, NULL, session_key.data, iv))
+    {
+      printf("[ERROR] (%d) crypto_decrypt_data: could not init Decrypt\n", __LINE__);
+      ERR_print_errors_fp(stderr);
+      result = false;
+    }
+  }
+
+  if (result)
+  {
+    if (decoded)
+    {
+      if (EVP_DecryptUpdate(ctx, decoded->_buffer, &len, encrypted->_buffer, (int) encrypted->_length))
+      {
+        decoded->_length = (uint32_t) len;
+      }
+      else
+      {
+        printf("[ERROR] (%d) crypto_decrypt_data: could not update Decrypt (decoded)\n", __LINE__);
+        ERR_print_errors_fp(stderr);
+        result = false;
+      }
+    }
+    else
+    {
+      if (!EVP_DecryptUpdate(ctx, NULL, &len, encrypted->_buffer, (int) encrypted->_length))
+      {
+        printf("[ERROR] (%d) crypto_decrypt_data: could not update Decrypt (!decoded)\n", __LINE__);
+        ERR_print_errors_fp(stderr);
+        result = false;
+      }
+    }
+  }
+
+  if (result)
+  {
+    if (!EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_GCM_SET_TAG, CRYPTO_HMAC_SIZE, tag))
+    {
+      printf("[ERROR] (%d) crypto_decrypt_data: could not ctrl CIPHER_CTX\n", __LINE__);
+      ERR_print_errors_fp(stderr);
+      result = false;
+    }
+  }
+
+  if (result)
+  {
+    if (decoded)
+    {
+      if (EVP_DecryptFinal_ex(ctx, decoded->_buffer + len, &len))
+      {
+        decoded->_length += (uint32_t) len;
+      }
+      else
+      {
+        printf("[ERROR] (%d) crypto_decrypt_data: could not finalize Decrypt (decoded)\n", __LINE__);
+        ERR_print_errors_fp(stderr);
+        result = false;
+      }
+    }
+    else
+    {
+      unsigned char temp[32];
+      if (!EVP_DecryptFinal_ex(ctx, temp, &len))
+      {
+        printf("[ERROR] (%d) crypto_decrypt_data: could not finalize Decrypt (!decoded)\n", __LINE__);
+        ERR_print_errors_fp(stderr);
+        result = false;
+      }
+    }
+  }
+
+  if (ctx)
+    EVP_CIPHER_CTX_free(ctx);
+
+  return result;
+}
+
+static session_key_material * get_datawriter_session(DDS_Security_DatawriterCryptoHandle writer_crypto)
+{
+  local_datawriter_crypto *writer_crypto_impl = (local_datawriter_crypto *)writer_crypto;
+  return writer_crypto_impl->writer_session_payload;
+}
+
+static bool check_protection_kind(DDS_Security_DatawriterCryptoHandle writer_crypto, DDS_Security_BasicProtectionKind protection_kind)
+{
+  local_datawriter_crypto *writer_crypto_impl = (local_datawriter_crypto *)writer_crypto;
+  return (writer_crypto_impl->data_protectionKind == protection_kind);
+}
+
+static void suite_encode_serialized_payload_init(void)
+{
+  allocate_shared_secret();
+  CU_ASSERT_FATAL ((plugins = load_plugins(
+                      NULL    /* Access Control */,
+                      NULL    /* Authentication */,
+                      &crypto /* Cryptograpy    */)) != NULL);
+  CU_ASSERT_EQUAL_FATAL (register_local_participant(), 0);
+  CU_ASSERT_EQUAL_FATAL (register_remote_participant(), 0);
+}
+
+static void suite_encode_serialized_payload_fini(void)
+{
+  unregister_remote_participant();
+  unregister_local_participant();
+  unload_plugins(plugins);
+  deallocate_shared_secret();
+}
+
+static uint32_t get_transformation_kind(uint32_t key_size, bool encrypted)
+{
+  uint32_t kind = CRYPTO_TRANSFORMATION_KIND_INVALID;
+  if (key_size == 128)
+  {
+    kind = encrypted ? CRYPTO_TRANSFORMATION_KIND_AES128_GCM : CRYPTO_TRANSFORMATION_KIND_AES128_GMAC;
+  }
+  else if (key_size == 256)
+  {
+    kind = encrypted ? CRYPTO_TRANSFORMATION_KIND_AES256_GCM : CRYPTO_TRANSFORMATION_KIND_AES256_GMAC;
+  }
+  CU_ASSERT_FATAL(kind != CRYPTO_TRANSFORMATION_KIND_INVALID);
+  return kind;
+}
+
+static bool seq_equal(DDS_Security_OctetSeq *seq1, DDS_Security_OctetSeq *seq2)
+{
+  bool ok = false;
+  if (seq1->_length == seq2->_length)
+  {
+    if (memcmp(seq1->_buffer, seq2->_buffer, seq1->_length) == 0)
+    {
+      ok = true;
+    }
+  }
+  return ok;
+}
+
+static bool check_payload_signed(DDS_Security_OctetSeq *payload, DDS_Security_OctetSeq *plain_buffer)
+{
+  /* When only signed, the payload should not have changed. */
+  return seq_equal(payload, plain_buffer);
+}
+
+static bool check_payload_encrypted(DDS_Security_OctetSeq *payload, DDS_Security_OctetSeq *plain_buffer)
+{
+  bool ok = false;
+  /* When encrypted, the payload should differ from the original data. */
+  if (payload->_length >= plain_buffer->_length)
+  {
+    if (memcmp(payload->_buffer, plain_buffer->_buffer, plain_buffer->_length) != 0)
+    {
+      ok = true;
+    }
+  }
+  return ok;
+}
+
+static bool check_payload_encoded(DDS_Security_OctetSeq *payload, DDS_Security_OctetSeq *plain_buffer, bool encrypted)
+{
+  bool ok;
+  if (encrypted)
+  {
+    ok = check_payload_encrypted(payload, plain_buffer);
+  }
+  else
+  {
+    ok = check_payload_signed(payload, plain_buffer);
+  }
+  return ok;
+}
+
+static bool check_payload_decoded(DDS_Security_OctetSeq *payload, DDS_Security_OctetSeq *plain_buffer)
+{
+  /* After decoding, the payload should match the orignal. */
+  return seq_equal(payload, plain_buffer);
+}
+
+static void encode_serialized_payload_check(uint32_t key_size, bool encrypted)
+{
+  DDS_Security_boolean result;
+  DDS_Security_DatawriterCryptoHandle writer_crypto;
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  DDS_Security_OctetSeq encoded_buffer = {0, 0, NULL};
+  DDS_Security_OctetSeq extra_inline_qos;
+  DDS_Security_OctetSeq encoded_payload;
+  DDS_Security_OctetSeq plain_buffer;
+  session_key_material *session_keys;
+  struct crypto_header *header = NULL;
+  struct crypto_footer *footer = NULL;
+  uint32_t session_id;
+  size_t length;
+
+  CU_ASSERT_FATAL(crypto != NULL);
+  CU_ASSERT_FATAL(crypto->crypto_transform != NULL);
+  CU_ASSERT_FATAL(crypto->crypto_transform->encode_serialized_payload != NULL);
+
+  memset(&extra_inline_qos, 0, sizeof(extra_inline_qos));
+
+  length = strlen(SAMPLE_TEST_DATA) + 1;
+  plain_buffer._length = plain_buffer._maximum = (uint32_t) length;
+  plain_buffer._buffer = DDS_Security_OctetSeq_allocbuf((uint32_t) length);
+  memcpy((char *)plain_buffer._buffer, SAMPLE_TEST_DATA, length);
+
+  writer_crypto = register_local_datawriter(encrypted);
+  CU_ASSERT_FATAL(writer_crypto != 0);
+  CU_ASSERT(check_protection_kind(writer_crypto, encrypted ? DDS_SECURITY_BASICPROTECTION_KIND_ENCRYPT : DDS_SECURITY_BASICPROTECTION_KIND_SIGN));
+
+  session_keys = get_datawriter_session(writer_crypto);
+  session_keys->master_key_material->transformation_kind = get_transformation_kind(key_size, encrypted);
+  session_keys->key_size = key_size;
+
+  /* Now call the function. */
+  result = crypto->crypto_transform->encode_serialized_payload(
+      crypto->crypto_transform,
+      &encoded_buffer,
+      &extra_inline_qos,
+      &plain_buffer,
+      writer_crypto,
+      &exception);
+
+  if (!result)
+  {
+    printf("[ERROR] encode_serialized_payload: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+  CU_ASSERT_FATAL(result);
+  CU_ASSERT(exception.code == 0);
+  CU_ASSERT(exception.message == NULL);
+  reset_exception(&exception);
+
+  result = split_encoded_data(encoded_buffer._buffer, encoded_buffer._length, &header, &encoded_payload, &footer, encrypted);
+  CU_ASSERT_FATAL(result == true);
+  CU_ASSERT(check_payload_encoded(&encoded_payload, &plain_buffer, encrypted));
+
+  session_id = ddsrt_fromBE4u(*(uint32_t *)header->session_id);
+
+  if (encrypted)
+  {
+    DDS_Security_OctetSeq decoded_buffer;
+    decoded_buffer._buffer = ddsrt_malloc(length);
+    decoded_buffer._length = (uint32_t) length;
+    decoded_buffer._maximum = (uint32_t) length;
+    result = crypto_decrypt_data(session_id, &header->session_id[0], header->transform_identifier.transformation_kind, session_keys->master_key_material, &encoded_payload, &decoded_buffer, footer->common_mac);
+    if (!result)
+    {
+      printf("[ERROR] Decryption failed\n");
+    }
+    CU_ASSERT_FATAL(result);
+    CU_ASSERT(check_payload_decoded(&decoded_buffer, &plain_buffer));
+    DDS_Security_OctetSeq_deinit(&decoded_buffer);
+  }
+  else
+  {
+    result = crypto_decrypt_data(session_id, &header->session_id[0], header->transform_identifier.transformation_kind, session_keys->master_key_material, &encoded_payload, NULL, footer->common_mac);
+    if (!result)
+    {
+      printf("[ERROR] Signature check failed\n");
+    }
+    CU_ASSERT_FATAL(result);
+  }
+
+  DDS_Security_OctetSeq_deinit(&encoded_buffer);
+  DDS_Security_OctetSeq_deinit(&plain_buffer);
+
+  unregister_local_datawriter(writer_crypto);
+}
+
+CU_Test(ddssec_builtin_encode_serialized_payload, encrypt_128, .init = suite_encode_serialized_payload_init, .fini = suite_encode_serialized_payload_fini)
+{
+  encode_serialized_payload_check(128, true);
+}
+
+CU_Test(ddssec_builtin_encode_serialized_payload, encrypt_256, .init = suite_encode_serialized_payload_init, .fini = suite_encode_serialized_payload_fini)
+{
+  encode_serialized_payload_check(256, true);
+}
+
+CU_Test(ddssec_builtin_encode_serialized_payload, sign_128, .init = suite_encode_serialized_payload_init, .fini = suite_encode_serialized_payload_fini)
+{
+  encode_serialized_payload_check(128, false);
+}
+
+CU_Test(ddssec_builtin_encode_serialized_payload, sign_256, .init = suite_encode_serialized_payload_init, .fini = suite_encode_serialized_payload_fini)
+{
+  encode_serialized_payload_check(256, false);
+}
+
+CU_Test(ddssec_builtin_encode_serialized_payload, invalid_args, .init = suite_encode_serialized_payload_init, .fini = suite_encode_serialized_payload_fini)
+{
+  DDS_Security_boolean result;
+  DDS_Security_DatawriterCryptoHandle writer_crypto;
+  DDS_Security_DatareaderCryptoHandle reader_crypto;
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  DDS_Security_OctetSeq encoded_buffer = {0, 0, NULL};
+  DDS_Security_OctetSeq extra_inline_qos;
+  DDS_Security_OctetSeq plain_buffer;
+  DDS_Security_OctetSeq empty_buffer;
+  size_t length;
+
+  CU_ASSERT_FATAL(crypto != NULL);
+  CU_ASSERT_FATAL(crypto->crypto_transform != NULL);
+  CU_ASSERT_FATAL(crypto->crypto_transform->encode_serialized_payload != NULL);
+
+  writer_crypto = register_local_datawriter(true);
+  CU_ASSERT_FATAL(writer_crypto != 0);
+
+  reader_crypto = register_remote_datareader(writer_crypto);
+  CU_ASSERT_FATAL(reader_crypto != 0);
+
+  memset(&extra_inline_qos, 0, sizeof(extra_inline_qos));
+  memset(&empty_buffer, 0, sizeof(empty_buffer));
+
+  length = strlen(SAMPLE_TEST_DATA) + 1;
+  plain_buffer._length = plain_buffer._maximum = (uint32_t) length;
+  plain_buffer._buffer = DDS_Security_OctetSeq_allocbuf((uint32_t) length);
+  memcpy((char *)plain_buffer._buffer, SAMPLE_TEST_DATA, length);
+
+  /* no encoded data specified */
+  result = crypto->crypto_transform->encode_serialized_payload(
+      crypto->crypto_transform,
+      NULL,
+      &extra_inline_qos,
+      &plain_buffer,
+      writer_crypto,
+      &exception);
+
+  if (!result)
+  {
+    printf("encode_serialized_payload: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+
+  CU_ASSERT(!result);
+  CU_ASSERT(exception.code != 0);
+  CU_ASSERT(exception.message != NULL);
+
+  reset_exception(&exception);
+
+  /* no plain data specified */
+  result = crypto->crypto_transform->encode_serialized_payload(
+      crypto->crypto_transform,
+      &encoded_buffer,
+      &extra_inline_qos,
+      NULL,
+      writer_crypto,
+      &exception);
+
+  if (!result)
+  {
+    printf("encode_serialized_payload: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+
+  CU_ASSERT(!result);
+  CU_ASSERT(exception.code != 0);
+  CU_ASSERT(exception.message != NULL);
+
+  reset_exception(&exception);
+  unregister_local_datawriter(writer_crypto);
+
+  /* empty plain data specified */
+  result = crypto->crypto_transform->encode_serialized_payload(
+      crypto->crypto_transform,
+      &encoded_buffer,
+      &extra_inline_qos,
+      &empty_buffer,
+      writer_crypto,
+      &exception);
+
+  if (!result)
+  {
+    printf("encode_serialized_payload: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+
+  CU_ASSERT(!result);
+  CU_ASSERT(exception.code != 0);
+  CU_ASSERT(exception.message != NULL);
+
+  reset_exception(&exception);
+
+  /* unknown writer crypto handle specified */
+  result = crypto->crypto_transform->encode_serialized_payload(
+      crypto->crypto_transform,
+      &encoded_buffer,
+      &extra_inline_qos,
+      &plain_buffer,
+      0,
+      &exception);
+
+  if (!result)
+  {
+    printf("encode_serialized_payload: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+
+  CU_ASSERT(!result);
+  CU_ASSERT(exception.code != 0);
+  CU_ASSERT(exception.message != NULL);
+
+  reset_exception(&exception);
+
+  /* incorrect writer crypto handle specified */
+  result = crypto->crypto_transform->encode_serialized_payload(
+      crypto->crypto_transform,
+      &encoded_buffer,
+      &extra_inline_qos,
+      &plain_buffer,
+      reader_crypto,
+      &exception);
+
+  if (!result)
+  {
+    printf("encode_serialized_payload: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+
+  CU_ASSERT(!result);
+  CU_ASSERT(exception.code != 0);
+  CU_ASSERT(exception.message != NULL);
+
+  reset_exception(&exception);
+
+  unregister_remote_datareader(reader_crypto);
+  unregister_local_datawriter(writer_crypto);
+
+  DDS_Security_OctetSeq_deinit(&plain_buffer);
+}
+
diff --git a/src/security/builtin_plugins/tests/get_authenticated_peer_credential_token/src/get_authenticated_peer_credential_token_utests.c b/src/security/builtin_plugins/tests/get_authenticated_peer_credential_token/src/get_authenticated_peer_credential_token_utests.c
index 12216c5..160ae83 100644
--- a/src/security/builtin_plugins/tests/get_authenticated_peer_credential_token/src/get_authenticated_peer_credential_token_utests.c
+++ b/src/security/builtin_plugins/tests/get_authenticated_peer_credential_token/src/get_authenticated_peer_credential_token_utests.c
@@ -31,27 +31,14 @@
 #include <string.h>
 #include "dds/ddsrt/environ.h"
 
+#include "dds/ddsrt/bswap.h"
 #include "dds/ddsrt/misc.h"
-#include "dds/ddsrt/endian.h"
 #include "dds/security/core/dds_security_serialize.h"
 #include "dds/security/dds_security_api.h"
 #include "dds/security/core/dds_security_utils.h"
 
 #define HANDSHAKE_SIGNATURE_SIZE 6
 
-#if DDSRT_ENDIAN == DDSRT_LITTLE_ENDIAN
-static unsigned bswap4u (unsigned x)
-{
-  return (x >> 24) | ((x >> 8) & 0xff00) | ((x << 8) & 0xff0000) | (x << 24);
-}
-#define toBE4u(x) bswap4u (x)
-#define fromBE4u(x) bswap4u (x)
-#else
-#define toBE4u(x) (x)
-#define fromBE4u(x) (x)
-#endif
-
-
 static const char * AUTH_PROTOCOL_CLASS_ID          = "DDS:Auth:PKI-DH:1.0";
 static const char * PERM_ACCESS_CLASS_ID            = "DDS:Access:Permissions:1.0";
 
@@ -483,9 +470,9 @@ validate_local_identity(void)
     g_local_participant_data = DDS_Security_ParticipantBuiltinTopicData_alloc();
     memcpy(&g_local_participant_data->key[0], &local_participant_guid, 12);
     /* convert from big-endian format to native format */
-    g_local_participant_data->key[0] = fromBE4u(g_local_participant_data->key[0]);
-    g_local_participant_data->key[1] = fromBE4u(g_local_participant_data->key[1]);
-    g_local_participant_data->key[2] = fromBE4u(g_local_participant_data->key[2]);
+    g_local_participant_data->key[0] = ddsrt_fromBE4u(g_local_participant_data->key[0]);
+    g_local_participant_data->key[1] = ddsrt_fromBE4u(g_local_participant_data->key[1]);
+    g_local_participant_data->key[2] = ddsrt_fromBE4u(g_local_participant_data->key[2]);
 
     initialize_identity_token(&g_local_participant_data->identity_token, RSA_2048_ALGORITHM_NAME, RSA_2048_ALGORITHM_NAME);
     initialize_permissions_token(&g_local_participant_data->permissions_token, RSA_2048_ALGORITHM_NAME);
@@ -843,9 +830,9 @@ validate_remote_identities (const char *remote_id_certificate)
 
     g_remote_participant_data1 = DDS_Security_ParticipantBuiltinTopicData_alloc();
     memcpy(&g_remote_participant_data1->key[0], &g_remote_participant_guid1, 12);
-    g_remote_participant_data1->key[0] = fromBE4u(g_remote_participant_data1->key[0]);
-    g_remote_participant_data1->key[1] = fromBE4u(g_remote_participant_data1->key[1]);
-    g_remote_participant_data1->key[2] = fromBE4u(g_remote_participant_data1->key[2]);
+    g_remote_participant_data1->key[0] = ddsrt_fromBE4u(g_remote_participant_data1->key[0]);
+    g_remote_participant_data1->key[1] = ddsrt_fromBE4u(g_remote_participant_data1->key[1]);
+    g_remote_participant_data1->key[2] = ddsrt_fromBE4u(g_remote_participant_data1->key[2]);
 
     initialize_identity_token(&g_remote_participant_data1->identity_token, RSA_2048_ALGORITHM_NAME, RSA_2048_ALGORITHM_NAME);
     initialize_permissions_token(&g_remote_participant_data1->permissions_token, RSA_2048_ALGORITHM_NAME);
@@ -855,9 +842,9 @@ validate_remote_identities (const char *remote_id_certificate)
 
     g_remote_participant_data2 = DDS_Security_ParticipantBuiltinTopicData_alloc();
     memcpy(&g_remote_participant_data2->key[0], &g_remote_participant_guid2, 12);
-    g_remote_participant_data2->key[0] = fromBE4u(g_remote_participant_data2->key[0]);
-    g_remote_participant_data2->key[1] = fromBE4u(g_remote_participant_data2->key[1]);
-    g_remote_participant_data2->key[2] = fromBE4u(g_remote_participant_data2->key[2]);
+    g_remote_participant_data2->key[0] = ddsrt_fromBE4u(g_remote_participant_data2->key[0]);
+    g_remote_participant_data2->key[1] = ddsrt_fromBE4u(g_remote_participant_data2->key[1]);
+    g_remote_participant_data2->key[2] = ddsrt_fromBE4u(g_remote_participant_data2->key[2]);
 
     initialize_identity_token(&g_remote_participant_data2->identity_token, RSA_2048_ALGORITHM_NAME, RSA_2048_ALGORITHM_NAME);
     initialize_permissions_token(&g_remote_participant_data2->permissions_token, RSA_2048_ALGORITHM_NAME);
@@ -952,7 +939,7 @@ serializer_participant_data(
     DDS_Security_Serializer serializer;
     serializer = DDS_Security_Serializer_new(1024, 1024);
 
-    DDD_Security_Serialize_ParticipantBuiltinTopicData(serializer, pdata);
+    DDS_Security_Serialize_ParticipantBuiltinTopicData(serializer, pdata);
     DDS_Security_Serializer_buffer(serializer, buffer,  size);
     DDS_Security_Serializer_free(serializer);
 }
diff --git a/src/security/builtin_plugins/tests/preprocess_secure_submsg/src/preprocess_secure_submsg_utests.c b/src/security/builtin_plugins/tests/preprocess_secure_submsg/src/preprocess_secure_submsg_utests.c
new file mode 100644
index 0000000..f469a09
--- /dev/null
+++ b/src/security/builtin_plugins/tests/preprocess_secure_submsg/src/preprocess_secure_submsg_utests.c
@@ -0,0 +1,930 @@
+/*
+ * Copyright(c) 2006 to 2019 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+#include <openssl/evp.h>
+#include <openssl/hmac.h>
+#include <openssl/bio.h>
+#include <openssl/err.h>
+
+#include "dds/ddsrt/bswap.h"
+#include "dds/ddsrt/heap.h"
+#include "dds/ddsrt/string.h"
+#include "dds/ddsrt/types.h"
+#include "dds/ddsrt/environ.h"
+#include "dds/security/dds_security_api.h"
+#include "dds/security/core/dds_security_serialize.h"
+#include "dds/security/core/dds_security_utils.h"
+#include "dds/security/core/shared_secret.h"
+#include "CUnit/CUnit.h"
+#include "CUnit/Test.h"
+#include "common/src/loader.h"
+#include "crypto_objects.h"
+
+#define TEST_SHARED_SECRET_SIZE 32
+
+#define VALID_SMID_SEC_PREFIX       0x31
+#define INVALID_SMID_SEC_PREFIX     0x15
+
+
+typedef struct SubMessageHeader {
+    unsigned char kind;
+    unsigned char flags;
+    uint16_t octetsToNextSubMsg;
+} SubMessageHeader;
+
+typedef struct CryptoHeader {
+    DDS_Security_CryptoTransformKind transform_id;
+    DDS_Security_CryptoTransformKeyId key_id;
+    unsigned char session_id[4];
+    unsigned char initVectorSuffix[8];
+} CryptoHeader;
+
+static struct plugins_hdl *plugins = NULL;
+static dds_security_cryptography *crypto = NULL;
+
+static DDS_Security_IdentityHandle local_participant_identity  = 1;
+static DDS_Security_IdentityHandle remote_participant_identity = 2;
+
+static DDS_Security_ParticipantCryptoHandle local_participant_handle = DDS_SECURITY_HANDLE_NIL;
+static DDS_Security_ParticipantCryptoHandle remote_participant_handle = DDS_SECURITY_HANDLE_NIL;
+
+static DDS_Security_DatawriterCryptoHandle  local_writer_crypto  = 0;
+static DDS_Security_DatawriterCryptoHandle  remote_writer_crypto = 0;
+static DDS_Security_DatareaderCryptoHandle  local_reader_crypto  = 0;
+static DDS_Security_DatareaderCryptoHandle  remote_reader_crypto = 0;
+
+static DDS_Security_SharedSecretHandleImpl *shared_secret_handle_impl = NULL;
+static DDS_Security_SharedSecretHandle shared_secret_handle;
+
+static DDS_Security_KeyMaterial_AES_GCM_GMAC writer_key_message;
+static DDS_Security_KeyMaterial_AES_GCM_GMAC writer_key_payload;
+static DDS_Security_KeyMaterial_AES_GCM_GMAC reader_key_message;
+
+static void allocate_shared_secret(void)
+{
+    int32_t i;
+
+    shared_secret_handle_impl = ddsrt_malloc (sizeof(DDS_Security_SharedSecretHandleImpl));
+
+    shared_secret_handle_impl->shared_secret = ddsrt_malloc (TEST_SHARED_SECRET_SIZE * sizeof(unsigned char));
+    shared_secret_handle_impl->shared_secret_size = TEST_SHARED_SECRET_SIZE;
+
+    for (i = 0; i < shared_secret_handle_impl->shared_secret_size; i++)
+    {
+        shared_secret_handle_impl->shared_secret[i] = (unsigned char)(i % 20);
+    }
+    for (i = 0; i < 32; i++)
+    {
+        shared_secret_handle_impl->challenge1[i] = (unsigned char)(i % 15);
+        shared_secret_handle_impl->challenge2[i] = (unsigned char)(i % 12);
+    }
+
+    shared_secret_handle = (DDS_Security_SharedSecretHandle) shared_secret_handle_impl;
+}
+
+static void deallocate_shared_secret(void)
+{
+    ddsrt_free(shared_secret_handle_impl->shared_secret);
+    ddsrt_free(shared_secret_handle_impl);
+}
+
+static int register_local_participant(void)
+{
+    DDS_Security_SecurityException exception = {NULL, 0, 0};
+    DDS_Security_PermissionsHandle participant_permissions = 3; //valid dummy value
+    DDS_Security_PropertySeq participant_properties;
+    DDS_Security_ParticipantSecurityAttributes participant_security_attributes;
+
+    memset(&participant_properties, 0, sizeof(participant_properties));
+    memset(&participant_security_attributes, 0, sizeof(participant_security_attributes));
+
+    local_participant_handle =
+            crypto->crypto_key_factory->register_local_participant(
+                    crypto->crypto_key_factory,
+                    local_participant_identity,
+                    participant_permissions,
+                    &participant_properties,
+                    &participant_security_attributes,
+                    &exception);
+
+     if (local_participant_handle == DDS_SECURITY_HANDLE_NIL) {
+         printf("register_local_participant: %s\n", exception.message ? exception.message : "Error message missing");
+     }
+
+     return local_participant_handle ? 0 : -1;
+}
+
+static int register_remote_participant(void)
+{
+    DDS_Security_SecurityException exception = {NULL, 0, 0};
+    DDS_Security_PermissionsHandle remote_participant_permissions = 5;
+
+    remote_participant_handle =
+            crypto->crypto_key_factory->register_matched_remote_participant(
+                    crypto->crypto_key_factory,
+                    local_participant_handle,
+                    remote_participant_identity,
+                    remote_participant_permissions,
+                    shared_secret_handle,
+                    &exception);
+
+     if (remote_participant_handle == DDS_SECURITY_HANDLE_NIL) {
+         printf("register_matched_remote_participant: %s\n", exception.message ? exception.message : "Error message missing");
+     }
+
+     return remote_participant_handle ? 0 : -1;
+}
+
+static void prepare_endpoint_security_attributes( DDS_Security_EndpointSecurityAttributes *attributes){
+    memset( attributes, 0 , sizeof(DDS_Security_EndpointSecurityAttributes));
+    attributes->is_discovery_protected = true;
+    attributes->is_submessage_protected = true;
+
+    attributes->plugin_endpoint_attributes |= DDS_SECURITY_PLUGIN_ENDPOINT_ATTRIBUTES_FLAG_IS_SUBMESSAGE_ENCRYPTED;
+
+}
+
+static int register_local_datareader(void)
+{
+    DDS_Security_SecurityException exception = {NULL, 0, 0};
+    DDS_Security_PropertySeq datareader_properties;
+    DDS_Security_EndpointSecurityAttributes datareader_security_attributes;
+
+    memset(&datareader_properties, 0, sizeof(datareader_properties));
+    prepare_endpoint_security_attributes( &datareader_security_attributes );
+
+    local_reader_crypto =
+            crypto->crypto_key_factory->register_local_datareader(
+                                        crypto->crypto_key_factory,
+                                        local_participant_handle,
+                                        &datareader_properties,
+                                        &datareader_security_attributes,
+                                        &exception);
+
+
+    if (local_reader_crypto == 0)
+        printf("register_local_datawriter: %s\n", exception.message ? exception.message : "Error message missing");
+
+    return local_reader_crypto ? 0 : -1;
+}
+
+static int register_remote_datareader(void)
+{
+    DDS_Security_SecurityException exception = {NULL, 0, 0};
+    DDS_Security_PropertySeq datawriter_properties;
+
+    memset (&datawriter_properties, 0, sizeof(datawriter_properties));
+    remote_reader_crypto =
+            crypto->crypto_key_factory->register_matched_remote_datareader(
+                    crypto->crypto_key_factory,
+                    local_writer_crypto,
+                    remote_participant_handle,
+                    shared_secret_handle,
+                    true,
+                    &exception);
+
+    if (remote_reader_crypto == 0)
+        printf("register_matched_remote_datareader: %s\n", exception.message ? exception.message : "Error message missing");
+
+    return remote_reader_crypto ? 0 : -1;
+}
+
+static int register_local_datawriter(void)
+{
+    DDS_Security_SecurityException exception = {NULL, 0, 0};
+    DDS_Security_PropertySeq datawriter_properties;
+    DDS_Security_EndpointSecurityAttributes datawriter_security_attributes;
+
+    memset(&datawriter_properties, 0, sizeof(datawriter_properties));
+    prepare_endpoint_security_attributes( &datawriter_security_attributes );
+
+    local_writer_crypto =
+            crypto->crypto_key_factory->register_local_datawriter(
+                    crypto->crypto_key_factory,
+                    local_participant_handle,
+                    &datawriter_properties,
+                    &datawriter_security_attributes,
+                    &exception);
+
+
+    if (local_writer_crypto == 0)
+        printf("register_local_datawriter: %s\n", exception.message ? exception.message : "Error message missing");
+
+    return local_writer_crypto ? 0 : -1;
+}
+
+static int register_remote_datawriter(void)
+{
+    DDS_Security_SecurityException exception = {NULL, 0, 0};
+
+    remote_writer_crypto =
+            crypto->crypto_key_factory->register_matched_remote_datawriter(
+                                        crypto->crypto_key_factory,
+                                        local_reader_crypto,
+                                        remote_participant_handle,
+                                        shared_secret_handle,
+                                        &exception);
+
+    if (remote_writer_crypto == 0)
+        printf("register_matched_remote_datareader: %s\n", exception.message ? exception.message : "Error message missing");
+
+    return remote_writer_crypto ? 0 : -1;
+}
+
+static DDS_Security_boolean retrieve_datawriter_keys(DDS_Security_DatawriterCryptoTokenSeq *tokens)
+{
+    DDS_Security_boolean result = true;
+    DDS_Security_Deserializer deserializer;
+    DDS_Security_KeyMaterial_AES_GCM_GMAC *key_mat = &writer_key_message;
+    uint32_t i;
+
+    for (i = 0; result && (i < tokens->_length); i++) {
+        const DDS_Security_OctetSeq *tdata = &tokens->_buffer[i].binary_properties._buffer[0].value;
+
+        deserializer = DDS_Security_Deserializer_new(tdata->_buffer, tdata->_length);
+
+        if (!deserializer)
+            result = false;
+        else if (!DDS_Security_Deserialize_KeyMaterial_AES_GCM_GMAC(deserializer, key_mat))
+            result = false;
+
+        DDS_Security_Deserializer_free(deserializer);
+        key_mat = &writer_key_payload;
+    }
+
+    return result;
+}
+
+static DDS_Security_boolean retrieve_datareader_keys(DDS_Security_DatareaderCryptoTokenSeq *tokens)
+{
+    DDS_Security_boolean result = true;
+    const DDS_Security_OctetSeq *tdata = &tokens->_buffer[0].binary_properties._buffer[0].value;
+    DDS_Security_Deserializer deserializer;
+    DDS_Security_KeyMaterial_AES_GCM_GMAC *key_mat = &reader_key_message;
+
+    deserializer = DDS_Security_Deserializer_new(tdata->_buffer, tdata->_length);
+
+    if (!deserializer)
+        result = false;
+    else if (!DDS_Security_Deserialize_KeyMaterial_AES_GCM_GMAC(deserializer, key_mat))
+        result = false;
+    DDS_Security_Deserializer_free(deserializer);
+
+    return result;
+}
+
+static int set_remote_datawriter_tokens(void)
+{
+    DDS_Security_boolean result;
+    DDS_Security_SecurityException exception = {NULL, 0, 0};
+    DDS_Security_DatawriterCryptoTokenSeq tokens;
+
+    memset(&tokens, 0, sizeof(tokens));
+
+    /* Now call the function. */
+    result = crypto->crypto_key_exchange->create_local_datawriter_crypto_tokens(
+                crypto->crypto_key_exchange,
+                &tokens,
+                local_writer_crypto,
+                remote_reader_crypto,
+                &exception);
+
+    if (result)
+        result = retrieve_datawriter_keys(&tokens);
+
+    if (result) {
+        result = crypto->crypto_key_exchange->set_remote_datawriter_crypto_tokens(
+                crypto->crypto_key_exchange,
+                local_reader_crypto,
+                remote_writer_crypto,
+                &tokens,
+                &exception);
+    }
+
+    DDS_Security_DataHolderSeq_deinit((DDS_Security_DataHolderSeq*)&tokens);
+
+    return result ? 0 : -1;
+}
+
+static int set_remote_datareader_tokens(void)
+{
+    DDS_Security_boolean result;
+    DDS_Security_SecurityException exception = {NULL, 0, 0};
+    DDS_Security_DatareaderCryptoTokenSeq tokens;
+
+    memset(&tokens, 0, sizeof(tokens));
+
+    /* Now call the function. */
+    result = crypto->crypto_key_exchange->create_local_datareader_crypto_tokens(
+                crypto->crypto_key_exchange,
+                &tokens,
+                local_reader_crypto,
+                remote_writer_crypto,
+                &exception);
+
+    if (result)
+        result = retrieve_datareader_keys(&tokens);
+    if (result) {
+        result = crypto->crypto_key_exchange->set_remote_datareader_crypto_tokens(
+                crypto->crypto_key_exchange,
+                local_writer_crypto,
+                remote_reader_crypto,
+                &tokens,
+                &exception);
+    }
+
+    DDS_Security_DataHolderSeq_deinit((DDS_Security_DataHolderSeq*)&tokens);
+
+    return result ? 0 : -1;
+}
+
+static void reset_exception(DDS_Security_SecurityException *ex)
+{
+    ex->code = 0;
+    ex->minor_code = 0;
+    ddsrt_free(ex->message);
+    ex->message = NULL;
+}
+
+
+static void suite_preprocess_secure_submsg_init (void)
+{
+    allocate_shared_secret();
+    memset(&writer_key_message, 0, sizeof(DDS_Security_KeyMaterial_AES_GCM_GMAC));
+    memset(&writer_key_payload, 0, sizeof(DDS_Security_KeyMaterial_AES_GCM_GMAC));
+    memset(&reader_key_message, 0, sizeof(DDS_Security_KeyMaterial_AES_GCM_GMAC));
+
+    CU_ASSERT_FATAL ((plugins = load_plugins(
+                            NULL      /* Access Control */,
+                            NULL      /* Authentication */,
+                            &crypto   /* Cryptography   */)) != NULL);
+    CU_ASSERT_EQUAL_FATAL (register_local_participant(), 0);
+    CU_ASSERT_EQUAL_FATAL (register_remote_participant(), 0);
+    CU_ASSERT_EQUAL_FATAL (register_local_datawriter(), 0);
+    CU_ASSERT_EQUAL_FATAL (register_local_datareader(), 0);
+    CU_ASSERT_EQUAL_FATAL (register_remote_datareader(), 0);
+    CU_ASSERT_EQUAL_FATAL (register_remote_datawriter(), 0);
+    CU_ASSERT_EQUAL_FATAL (set_remote_datawriter_tokens(), 0);
+    CU_ASSERT_EQUAL_FATAL (set_remote_datareader_tokens(), 0);
+}
+
+static void suite_preprocess_secure_submsg_fini (void)
+{
+    DDS_Security_SecurityException exception = {NULL, 0, 0};
+
+    if (remote_writer_crypto) {
+        crypto->crypto_key_factory->unregister_datawriter(crypto->crypto_key_factory, remote_writer_crypto, &exception);
+        reset_exception(&exception);
+    }
+    if (remote_reader_crypto) {
+        crypto->crypto_key_factory->unregister_datareader(crypto->crypto_key_factory, remote_reader_crypto, &exception);
+        reset_exception(&exception);
+    }
+    if (local_reader_crypto) {
+        crypto->crypto_key_factory->unregister_datareader(crypto->crypto_key_factory, local_reader_crypto, &exception);
+        reset_exception(&exception);
+    }
+    if (local_writer_crypto) {
+        crypto->crypto_key_factory->unregister_datawriter(crypto->crypto_key_factory, local_writer_crypto, &exception);
+        reset_exception(&exception);
+    }
+    if (remote_participant_handle) {
+        crypto->crypto_key_factory->unregister_participant(crypto->crypto_key_factory, remote_participant_handle, &exception);
+        reset_exception(&exception);
+    }
+    if (local_participant_handle) {
+        crypto->crypto_key_factory->unregister_datareader(crypto->crypto_key_factory, local_participant_handle, &exception);
+        reset_exception(&exception);
+    }
+
+    DDS_Security_KeyMaterial_AES_GCM_GMAC_deinit(&reader_key_message);
+    DDS_Security_KeyMaterial_AES_GCM_GMAC_deinit(&writer_key_message);
+    deallocate_shared_secret();
+    unload_plugins(plugins);
+}
+
+static void create_encoded_submsg(DDS_Security_OctetSeq *msg, DDS_Security_CryptoTransformKeyId key_id, DDS_Security_CryptoTransformKind transform_kind, unsigned char msg_id, bool be)
+{
+    unsigned char *buffer;
+    uint32_t length = sizeof(SubMessageHeader) + sizeof(CryptoHeader) + 200;
+    SubMessageHeader *submsg;
+    CryptoHeader *crpthdr;
+    int swap = be ? (DDSRT_ENDIAN == DDSRT_LITTLE_ENDIAN) : (DDSRT_ENDIAN != DDSRT_LITTLE_ENDIAN);
+
+    buffer = ddsrt_malloc(length);
+    submsg = (SubMessageHeader *) buffer;
+    crpthdr = (CryptoHeader *) (submsg + 1);
+
+    submsg->kind = msg_id;
+    submsg->flags = be ? 0 : 1;
+    submsg->octetsToNextSubMsg = swap ? ddsrt_bswap2u((uint16_t)(length - 24)) : (uint16_t)(length - 24);
+
+    memcpy(crpthdr->key_id, key_id, 4);
+    memcpy(crpthdr->transform_id, transform_kind, 4);
+
+    msg->_buffer = buffer;
+    msg->_length = msg->_maximum = length;
+}
+
+static void clear_encoded_submsg(DDS_Security_OctetSeq *msg)
+{
+    if (msg) {
+        ddsrt_free(msg->_buffer);
+        memset(msg, 0, sizeof(*msg));
+    }
+}
+
+
+CU_Test(ddssec_builtin_preprocess_secure_submsg, writer_happy_day, .init = suite_preprocess_secure_submsg_init, .fini = suite_preprocess_secure_submsg_fini)
+{
+    DDS_Security_boolean result;
+    DDS_Security_SecurityException exception = {NULL, 0, 0};
+    DDS_Security_DatawriterCryptoHandle writer_crypto;
+    DDS_Security_DatareaderCryptoHandle reader_crypto;
+    DDS_Security_SecureSubmessageCategory_t category;
+    DDS_Security_OctetSeq message;
+
+    CU_ASSERT_FATAL (crypto != NULL);
+    CU_ASSERT_FATAL (crypto->crypto_transform != NULL);
+    CU_ASSERT_FATAL (crypto->crypto_transform->preprocess_secure_submsg != NULL);
+
+    create_encoded_submsg(&message, writer_key_message.sender_key_id, writer_key_message.transformation_kind, VALID_SMID_SEC_PREFIX, false);
+
+    result = crypto->crypto_transform->preprocess_secure_submsg(
+                crypto->crypto_transform,
+                &writer_crypto,
+                &reader_crypto,
+                &category,
+                &message,
+                local_participant_handle,
+                remote_participant_handle,
+                &exception);
+
+    if (!result)
+        printf("preprocess_secure_submsg: %s\n", exception.message ? exception.message : "Error message missing");
+
+    CU_ASSERT_FATAL(result);
+    CU_ASSERT(exception.code == 0);
+    CU_ASSERT(exception.message == NULL);
+    CU_ASSERT(writer_crypto == remote_writer_crypto);
+    CU_ASSERT(reader_crypto == local_reader_crypto);
+    CU_ASSERT(category == DDS_SECURITY_DATAWRITER_SUBMESSAGE);
+
+    reset_exception(&exception);
+
+    clear_encoded_submsg(&message);
+
+    create_encoded_submsg(&message, writer_key_message.sender_key_id, writer_key_message.transformation_kind, VALID_SMID_SEC_PREFIX, true);
+
+    result = crypto->crypto_transform->preprocess_secure_submsg(
+                crypto->crypto_transform,
+                &writer_crypto,
+                &reader_crypto,
+                &category,
+                &message,
+                local_participant_handle,
+                remote_participant_handle,
+                &exception);
+
+    if (!result)
+        printf("preprocess_secure_submsg: %s\n", exception.message ? exception.message : "Error message missing");
+
+    CU_ASSERT_FATAL(result);
+    CU_ASSERT(exception.code == 0);
+    CU_ASSERT(exception.message == NULL);
+    CU_ASSERT(writer_crypto == remote_writer_crypto);
+    CU_ASSERT(reader_crypto == local_reader_crypto);
+    CU_ASSERT(category == DDS_SECURITY_DATAWRITER_SUBMESSAGE);
+
+    reset_exception(&exception);
+
+    clear_encoded_submsg(&message);
+}
+
+CU_Test(ddssec_builtin_preprocess_secure_submsg, reader_happy_day, .init = suite_preprocess_secure_submsg_init, .fini = suite_preprocess_secure_submsg_fini)
+{
+    DDS_Security_boolean result;
+    DDS_Security_SecurityException exception = {NULL, 0, 0};
+    DDS_Security_DatawriterCryptoHandle writer_crypto;
+    DDS_Security_DatareaderCryptoHandle reader_crypto;
+    DDS_Security_SecureSubmessageCategory_t category;
+    DDS_Security_OctetSeq message;
+
+    CU_ASSERT_FATAL (crypto != NULL);
+    CU_ASSERT_FATAL (crypto ->crypto_transform!= NULL);
+    CU_ASSERT_FATAL (crypto ->crypto_transform->preprocess_secure_submsg != NULL);
+
+    create_encoded_submsg(&message, reader_key_message.sender_key_id, reader_key_message.transformation_kind, VALID_SMID_SEC_PREFIX, false);
+
+    result = crypto->crypto_transform->preprocess_secure_submsg(
+                crypto->crypto_transform,
+                &writer_crypto,
+                &reader_crypto,
+                &category,
+                &message,
+                local_participant_handle,
+                remote_participant_handle,
+                &exception);
+
+    if (!result)
+        printf("preprocess_secure_submsg: %s\n", exception.message ? exception.message : "Error message missing");
+
+    CU_ASSERT_FATAL(result);
+    CU_ASSERT(exception.code == 0);
+    CU_ASSERT(exception.message == NULL);
+    CU_ASSERT(writer_crypto == local_writer_crypto);
+    CU_ASSERT(reader_crypto == remote_reader_crypto);
+    CU_ASSERT(category == DDS_SECURITY_DATAREADER_SUBMESSAGE);
+
+    reset_exception(&exception);
+    clear_encoded_submsg(&message);
+    create_encoded_submsg(&message, reader_key_message.sender_key_id, reader_key_message.transformation_kind, VALID_SMID_SEC_PREFIX, true);
+    result = crypto->crypto_transform->preprocess_secure_submsg(
+                crypto->crypto_transform,
+                &writer_crypto,
+                &reader_crypto,
+                &category,
+                &message,
+                local_participant_handle,
+                remote_participant_handle,
+                &exception);
+
+    if (!result)
+        printf("preprocess_secure_submsg: %s\n", exception.message ? exception.message : "Error message missing");
+
+    CU_ASSERT_FATAL(result);
+    CU_ASSERT(exception.code == 0);
+    CU_ASSERT(exception.message == NULL);
+    CU_ASSERT(writer_crypto == local_writer_crypto);
+    CU_ASSERT(reader_crypto == remote_reader_crypto);
+    CU_ASSERT(category == DDS_SECURITY_DATAREADER_SUBMESSAGE);
+
+    reset_exception(&exception);
+    clear_encoded_submsg(&message);
+}
+
+
+CU_Test(ddssec_builtin_preprocess_secure_submsg, invalid_args, .init = suite_preprocess_secure_submsg_init, .fini = suite_preprocess_secure_submsg_fini)
+{
+    DDS_Security_boolean result;
+    DDS_Security_SecurityException exception = {NULL, 0, 0};
+    DDS_Security_DatawriterCryptoHandle writer_crypto;
+    DDS_Security_DatareaderCryptoHandle reader_crypto;
+    DDS_Security_SecureSubmessageCategory_t category;
+    DDS_Security_OctetSeq message;
+
+    CU_ASSERT_FATAL (crypto != NULL);
+    CU_ASSERT_FATAL (crypto ->crypto_transform!= NULL);
+    CU_ASSERT_FATAL (crypto ->crypto_transform->preprocess_secure_submsg != NULL);
+
+    create_encoded_submsg(&message, writer_key_message.sender_key_id, reader_key_message.transformation_kind, VALID_SMID_SEC_PREFIX, false);
+
+    /* writer handle = NULL. */
+    result = crypto->crypto_transform->preprocess_secure_submsg(
+            crypto->crypto_transform,
+            NULL,
+            &reader_crypto,
+            &category,
+            &message,
+            local_participant_handle,
+            remote_participant_handle,
+            &exception);
+
+    if (!result)
+        printf("preprocess_secure_submsg: %s\n", exception.message ? exception.message : "Error message missing");
+
+    CU_ASSERT(!result);
+    CU_ASSERT(exception.code != 0);
+    CU_ASSERT(exception.message != NULL);
+    reset_exception(&exception);
+
+    /* reader handle = NULL. */
+    result = crypto->crypto_transform->preprocess_secure_submsg(
+                crypto->crypto_transform,
+                &writer_crypto,
+                NULL,
+                &category,
+                &message,
+                local_participant_handle,
+                remote_participant_handle,
+                &exception);
+
+    if (!result)
+        printf("preprocess_secure_submsg: %s\n", exception.message ? exception.message : "Error message missing");
+
+    CU_ASSERT(!result);
+    CU_ASSERT(exception.code != 0);
+    CU_ASSERT(exception.message != NULL);
+    reset_exception(&exception);
+
+    /* category = NULL */
+    result = crypto->crypto_transform->preprocess_secure_submsg(
+            crypto->crypto_transform,
+            &writer_crypto,
+            &reader_crypto,
+            NULL,
+            &message,
+            local_participant_handle,
+            remote_participant_handle,
+            &exception);
+
+    if (!result)
+        printf("preprocess_secure_submsg: %s\n", exception.message ? exception.message : "Error message missing");
+
+    CU_ASSERT(!result);
+    CU_ASSERT(exception.code != 0);
+    CU_ASSERT(exception.message != NULL);
+    reset_exception(&exception);
+
+    /* message = NULL */
+    result = crypto->crypto_transform->preprocess_secure_submsg(
+            crypto->crypto_transform,
+            &writer_crypto,
+            &reader_crypto,
+            &category,
+            NULL,
+            local_participant_handle,
+            remote_participant_handle,
+            &exception);
+
+    if (!result)
+        printf("preprocess_secure_submsg: %s\n", exception.message ? exception.message : "Error message missing");
+
+    CU_ASSERT(!result);
+    CU_ASSERT(exception.code != 0);
+    CU_ASSERT(exception.message != NULL);
+    reset_exception(&exception);
+
+    /* unknown local_participant_handle */
+    result = crypto->crypto_transform->preprocess_secure_submsg(
+            crypto->crypto_transform,
+            &writer_crypto,
+            &reader_crypto,
+            &category,
+            &message,
+            1,
+            remote_participant_handle,
+            &exception);
+
+    if (!result)
+        printf("preprocess_secure_submsg: %s\n", exception.message ? exception.message : "Error message missing");
+
+    CU_ASSERT(!result);
+    CU_ASSERT(exception.code != 0);
+    CU_ASSERT(exception.message != NULL);
+    reset_exception(&exception);
+
+    /* remote_participant_handle = DDS_SECURITY_HANDLE_NIL */
+    result = crypto->crypto_transform->preprocess_secure_submsg(
+            crypto->crypto_transform,
+            &writer_crypto,
+            &reader_crypto,
+            &category,
+            &message,
+            local_participant_handle,
+            0,
+            &exception);
+
+    if (!result)
+        printf("preprocess_secure_submsg: %s\n", exception.message ? exception.message : "Error message missing");
+
+    CU_ASSERT(!result);
+    CU_ASSERT(exception.code != 0);
+    CU_ASSERT(exception.message != NULL);
+    reset_exception(&exception);
+
+    /* unknown remote_participant_handle  */
+    result = crypto->crypto_transform->preprocess_secure_submsg(
+            crypto->crypto_transform,
+            &writer_crypto,
+            &reader_crypto,
+            &category,
+            &message,
+            local_participant_handle,
+            1,
+            &exception);
+
+    if (!result)
+        printf("preprocess_secure_submsg: %s\n", exception.message ? exception.message : "Error message missing");
+
+    CU_ASSERT(!result);
+    CU_ASSERT(exception.code != 0);
+    CU_ASSERT(exception.message != NULL);
+    reset_exception(&exception);
+    clear_encoded_submsg(&message);
+}
+
+
+CU_Test(ddssec_builtin_preprocess_secure_submsg, invalid_message, .init = suite_preprocess_secure_submsg_init, .fini = suite_preprocess_secure_submsg_fini)
+{
+    DDS_Security_boolean result;
+    DDS_Security_SecurityException exception = {NULL, 0, 0};
+    DDS_Security_DatawriterCryptoHandle writer_crypto;
+    DDS_Security_DatareaderCryptoHandle reader_crypto;
+    DDS_Security_SecureSubmessageCategory_t category;
+    DDS_Security_OctetSeq message;
+
+    CU_ASSERT_FATAL (crypto != NULL);
+    CU_ASSERT_FATAL (crypto ->crypto_transform!= NULL);
+    CU_ASSERT_FATAL (crypto ->crypto_transform->preprocess_secure_submsg != NULL);
+
+    /* unknown key id */
+    create_encoded_submsg(&message, writer_key_payload.sender_key_id, writer_key_payload.transformation_kind, VALID_SMID_SEC_PREFIX, false);
+    result = crypto->crypto_transform->preprocess_secure_submsg(
+            crypto->crypto_transform,
+            &writer_crypto,
+            &reader_crypto,
+            &category,
+            &message,
+            local_participant_handle,
+            remote_participant_handle,
+            &exception);
+
+    if (!result)
+        printf("preprocess_secure_submsg: %s\n", exception.message ? exception.message : "Error message missing");
+
+    CU_ASSERT(!result);
+    CU_ASSERT(exception.code != 0);
+    CU_ASSERT(exception.message != NULL);
+    reset_exception(&exception);
+    clear_encoded_submsg(&message);
+
+    /* invalid transformation kind */
+    {
+        DDS_Security_CryptoTransformKind kind = {5, 1, 3, 6};
+
+        create_encoded_submsg(&message, writer_key_message.sender_key_id, kind, VALID_SMID_SEC_PREFIX, false);
+
+        result = crypto->crypto_transform->preprocess_secure_submsg(
+                crypto->crypto_transform,
+                &writer_crypto,
+                &reader_crypto,
+                &category,
+                &message,
+                local_participant_handle,
+                remote_participant_handle,
+                &exception);
+
+        if (!result)
+            printf("preprocess_secure_submsg: %s\n", exception.message ? exception.message : "Error message missing");
+
+        CU_ASSERT(!result);
+        CU_ASSERT(exception.code != 0);
+        CU_ASSERT(exception.message != NULL);
+        reset_exception(&exception);
+        clear_encoded_submsg(&message);
+    }
+
+    /* not expected submessage id */
+    {
+        DDS_Security_CryptoTransformKind kind = {5, 1, 3, 6};
+        create_encoded_submsg(&message, writer_key_message.sender_key_id, kind, INVALID_SMID_SEC_PREFIX, false);
+        result = crypto->crypto_transform->preprocess_secure_submsg(
+                crypto->crypto_transform,
+                &writer_crypto,
+                &reader_crypto,
+                &category,
+                &message,
+                local_participant_handle,
+                remote_participant_handle,
+                &exception);
+
+        if (!result)
+            printf("preprocess_secure_submsg: %s\n", exception.message ? exception.message : "Error message missing");
+
+        CU_ASSERT(!result);
+        CU_ASSERT(exception.code != 0);
+        CU_ASSERT(exception.message != NULL);
+        reset_exception(&exception);
+        clear_encoded_submsg(&message);
+    }
+}
+
+
+CU_Test(ddssec_builtin_preprocess_secure_submsg, volatile_secure, .init = suite_preprocess_secure_submsg_init, .fini = suite_preprocess_secure_submsg_fini)
+{
+    DDS_Security_boolean result;
+    DDS_Security_SecurityException exception = {NULL, 0, 0};
+    DDS_Security_DatareaderCryptoHandle local_reader_crypto_vol;
+    DDS_Security_DatawriterCryptoHandle local_writer_crypto_vol;
+    DDS_Security_DatareaderCryptoHandle remote_reader_crypto_vol;
+    DDS_Security_DatawriterCryptoHandle remote_writer_crypto_vol;
+    DDS_Security_PropertySeq datareader_properties;
+    DDS_Security_EndpointSecurityAttributes datareader_security_attributes;
+    DDS_Security_PropertySeq datawriter_properties;
+    DDS_Security_EndpointSecurityAttributes datawriter_security_attributes;
+    DDS_Security_DatawriterCryptoHandle writer_crypto;
+    DDS_Security_DatareaderCryptoHandle reader_crypto;
+    DDS_Security_SecureSubmessageCategory_t category;
+    DDS_Security_CryptoTransformKeyId key_id = {0, 0, 0, 0};
+    DDS_Security_OctetSeq message;
+
+    CU_ASSERT_FATAL (crypto != NULL);
+    CU_ASSERT_FATAL (crypto->crypto_transform != NULL);
+    CU_ASSERT_FATAL (crypto->crypto_transform->preprocess_secure_submsg != NULL);
+
+    datareader_properties._length = datareader_properties._maximum = 1;
+    datareader_properties._buffer = DDS_Security_PropertySeq_allocbuf(1);
+    datareader_properties._buffer[0].name = ddsrt_strdup("dds.sec.builtin_endpoint_name");
+    datareader_properties._buffer[0].value = ddsrt_strdup("BuiltinParticipantVolatileMessageSecureReader");
+    datareader_properties._buffer[0].propagate = false;
+
+    prepare_endpoint_security_attributes( &datareader_security_attributes );
+    prepare_endpoint_security_attributes( &datawriter_security_attributes );
+
+    datawriter_properties._length = datawriter_properties._maximum = 1;
+    datawriter_properties._buffer = DDS_Security_PropertySeq_allocbuf(1);
+    datawriter_properties._buffer[0].name = ddsrt_strdup("dds.sec.builtin_endpoint_name");
+    datawriter_properties._buffer[0].value = ddsrt_strdup("BuiltinParticipantVolatileMessageSecureWriter");
+    datawriter_properties._buffer[0].propagate = false;
+
+    local_writer_crypto_vol =
+            crypto->crypto_key_factory->register_local_datawriter(
+                    crypto->crypto_key_factory,
+                    local_participant_handle,
+                    &datawriter_properties,
+                    &datawriter_security_attributes,
+                    &exception);
+    CU_ASSERT_FATAL(local_writer_crypto_vol != 0);
+
+    local_reader_crypto_vol =
+            crypto->crypto_key_factory->register_local_datareader(
+                    crypto->crypto_key_factory,
+                    local_participant_handle,
+                    &datareader_properties,
+                    &datareader_security_attributes,
+                    &exception);
+    CU_ASSERT_FATAL(local_reader_crypto_vol != 0);
+
+    remote_writer_crypto_vol =
+            crypto->crypto_key_factory->register_matched_remote_datawriter(
+                    crypto->crypto_key_factory,
+                    local_reader_crypto_vol,
+                    remote_participant_handle,
+                    shared_secret_handle,
+                    &exception);
+    CU_ASSERT_FATAL(remote_writer_crypto_vol != 0);
+
+    remote_reader_crypto_vol =
+            crypto->crypto_key_factory->register_matched_remote_datareader(
+                    crypto->crypto_key_factory,
+                    local_writer_crypto_vol,
+                    remote_participant_handle,
+                    shared_secret_handle,
+                    true,
+                    &exception);
+    CU_ASSERT_FATAL(remote_reader_crypto_vol != 0);
+
+    create_encoded_submsg(&message, key_id, reader_key_message.transformation_kind, VALID_SMID_SEC_PREFIX, false);
+
+    result = crypto->crypto_transform->preprocess_secure_submsg(
+                crypto->crypto_transform,
+                &writer_crypto,
+                &reader_crypto,
+                &category,
+                &message,
+                local_participant_handle,
+                remote_participant_handle,
+                &exception);
+
+    if (!result)
+        printf("preprocess_secure_submsg: %s\n", exception.message ? exception.message : "Error message missing");
+
+    CU_ASSERT_FATAL(result);
+    CU_ASSERT(exception.code == 0);
+    CU_ASSERT(exception.message == NULL);
+    CU_ASSERT(((remote_datawriter_crypto *)writer_crypto)->is_builtin_participant_volatile_message_secure_writer);
+    CU_ASSERT(((local_datareader_crypto *)reader_crypto)->is_builtin_participant_volatile_message_secure_reader);
+    CU_ASSERT(category == DDS_SECURITY_DATAWRITER_SUBMESSAGE);
+
+    reset_exception(&exception);
+
+    if (remote_writer_crypto_vol) {
+        crypto->crypto_key_factory->unregister_datawriter(crypto->crypto_key_factory, remote_writer_crypto_vol, &exception);
+        reset_exception(&exception);
+    }
+    if (remote_reader_crypto_vol) {
+        crypto->crypto_key_factory->unregister_datareader(crypto->crypto_key_factory, remote_reader_crypto_vol, &exception);
+        reset_exception(&exception);
+    }
+    if (local_reader_crypto_vol) {
+        crypto->crypto_key_factory->unregister_datareader(crypto->crypto_key_factory, local_reader_crypto_vol, &exception);
+        reset_exception(&exception);
+    }
+    if (local_writer_crypto_vol) {
+        crypto->crypto_key_factory->unregister_datawriter(crypto->crypto_key_factory, local_writer_crypto_vol, &exception);
+        reset_exception(&exception);
+    }
+
+    clear_encoded_submsg(&message);
+    DDS_Security_PropertySeq_deinit(&datareader_properties);
+    DDS_Security_PropertySeq_deinit(&datawriter_properties);
+}
diff --git a/src/security/builtin_plugins/tests/process_handshake/src/process_handshake_utests.c b/src/security/builtin_plugins/tests/process_handshake/src/process_handshake_utests.c
index e717e54..9eaf2d1 100644
--- a/src/security/builtin_plugins/tests/process_handshake/src/process_handshake_utests.c
+++ b/src/security/builtin_plugins/tests/process_handshake/src/process_handshake_utests.c
@@ -11,9 +11,9 @@
 #include "dds/security/core/dds_security_serialize.h"
 #include "dds/security/core/dds_security_utils.h"
 #include "dds/security/dds_security_api.h"
+#include "dds/ddsrt/bswap.h"
 #include "dds/ddsrt/heap.h"
 #include "dds/ddsrt/string.h"
-#include "dds/ddsrt/endian.h"
 #include <stdio.h>
 #include <string.h>
 #include "dds/ddsrt/environ.h"
@@ -34,19 +34,6 @@
 
 #define HANDSHAKE_SIGNATURE_SIZE 6
 
-#if DDSRT_ENDIAN == DDSRT_LITTLE_ENDIAN
-static  unsigned bswap4u (unsigned x)
-{
-  return (x >> 24) | ((x >> 8) & 0xff00) | ((x << 8) & 0xff0000) | (x << 24);
-}
-#define toBE4u(x) bswap4u (x)
-#define fromBE4u(x) bswap4u (x)
-#else
-#define toBE4u(x) (x)
-#define fromBE4u(x) (x)
-#endif
-
-
 static const char * AUTH_PROTOCOL_CLASS_ID          = "DDS:Auth:PKI-DH:1.0";
 static const char * PERM_ACCESS_CLASS_ID            = "DDS:Access:Permissions:1.0";
 
@@ -574,9 +561,9 @@ validate_local_identity(const char* trusted_ca_dir)
     local_participant_data = DDS_Security_ParticipantBuiltinTopicData_alloc();
     memcpy(&local_participant_data->key[0], &local_participant_guid, 12);
     /* convert from big-endian format to native format */
-    local_participant_data->key[0] = fromBE4u(local_participant_data->key[0]);
-    local_participant_data->key[1] = fromBE4u(local_participant_data->key[1]);
-    local_participant_data->key[2] = fromBE4u(local_participant_data->key[2]);
+    local_participant_data->key[0] = ddsrt_fromBE4u(local_participant_data->key[0]);
+    local_participant_data->key[1] = ddsrt_fromBE4u(local_participant_data->key[1]);
+    local_participant_data->key[2] = ddsrt_fromBE4u(local_participant_data->key[2]);
 
     initialize_identity_token(&local_participant_data->identity_token, RSA_2048_ALGORITHM_NAME, RSA_2048_ALGORITHM_NAME);
     initialize_permissions_token(&local_participant_data->permissions_token, RSA_2048_ALGORITHM_NAME);
@@ -947,9 +934,9 @@ validate_remote_identities (const char *remote_id_certificate)
 
     remote_participant_data1 = DDS_Security_ParticipantBuiltinTopicData_alloc();
     memcpy(&remote_participant_data1->key[0], &remote_participant_guid1, 12);
-    remote_participant_data1->key[0] = fromBE4u(remote_participant_data1->key[0]);
-    remote_participant_data1->key[1] = fromBE4u(remote_participant_data1->key[1]);
-    remote_participant_data1->key[2] = fromBE4u(remote_participant_data1->key[2]);
+    remote_participant_data1->key[0] = ddsrt_fromBE4u(remote_participant_data1->key[0]);
+    remote_participant_data1->key[1] = ddsrt_fromBE4u(remote_participant_data1->key[1]);
+    remote_participant_data1->key[2] = ddsrt_fromBE4u(remote_participant_data1->key[2]);
 
     initialize_identity_token(&remote_participant_data1->identity_token, RSA_2048_ALGORITHM_NAME, RSA_2048_ALGORITHM_NAME);
     initialize_permissions_token(&remote_participant_data1->permissions_token, RSA_2048_ALGORITHM_NAME);
@@ -959,9 +946,9 @@ validate_remote_identities (const char *remote_id_certificate)
 
     remote_participant_data2 = DDS_Security_ParticipantBuiltinTopicData_alloc();
     memcpy(&remote_participant_data2->key[0], &remote_participant_guid2, 12);
-    remote_participant_data2->key[0] = fromBE4u(remote_participant_data2->key[0]);
-    remote_participant_data2->key[1] = fromBE4u(remote_participant_data2->key[1]);
-    remote_participant_data2->key[2] = fromBE4u(remote_participant_data2->key[2]);
+    remote_participant_data2->key[0] = ddsrt_fromBE4u(remote_participant_data2->key[0]);
+    remote_participant_data2->key[1] = ddsrt_fromBE4u(remote_participant_data2->key[1]);
+    remote_participant_data2->key[2] = ddsrt_fromBE4u(remote_participant_data2->key[2]);
 
     initialize_identity_token(&remote_participant_data2->identity_token, RSA_2048_ALGORITHM_NAME, RSA_2048_ALGORITHM_NAME);
     initialize_permissions_token(&remote_participant_data2->permissions_token, RSA_2048_ALGORITHM_NAME);
@@ -1095,7 +1082,7 @@ serializer_participant_data(
     DDS_Security_Serializer serializer;
     serializer = DDS_Security_Serializer_new(1024, 1024);
 
-    DDD_Security_Serialize_ParticipantBuiltinTopicData(serializer, pdata);
+    DDS_Security_Serialize_ParticipantBuiltinTopicData(serializer, pdata);
     DDS_Security_Serializer_buffer(serializer, buffer, size);
     DDS_Security_Serializer_free(serializer);
 }
diff --git a/src/security/builtin_plugins/tests/register_local_datareader/src/register_local_datareader_utests.c b/src/security/builtin_plugins/tests/register_local_datareader/src/register_local_datareader_utests.c
new file mode 100644
index 0000000..327ddb7
--- /dev/null
+++ b/src/security/builtin_plugins/tests/register_local_datareader/src/register_local_datareader_utests.c
@@ -0,0 +1,311 @@
+/*
+ * Copyright(c) 2006 to 2019 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+#include <openssl/evp.h>
+#include <openssl/hmac.h>
+#include <openssl/bio.h>
+#include <openssl/err.h>
+
+#include "dds/ddsrt/heap.h"
+#include "dds/ddsrt/string.h"
+#include "dds/ddsrt/types.h"
+#include "dds/ddsrt/environ.h"
+#include "dds/security/dds_security_api.h"
+#include "dds/security/core/dds_security_serialize.h"
+#include "dds/security/core/dds_security_utils.h"
+#include "dds/security/core/shared_secret.h"
+#include "CUnit/CUnit.h"
+#include "CUnit/Test.h"
+#include "common/src/loader.h"
+#include "common/src/crypto_helper.h"
+#include "crypto_objects.h"
+
+#if OPENSLL_VERSION_NUMBER >= 0x10002000L
+#define AUTH_INCLUDE_EC
+#endif
+
+#define TEST_SHARED_SECRET_SIZE 32
+
+static struct plugins_hdl *plugins = NULL;
+static DDS_Security_SharedSecretHandle shared_secret_handle = DDS_SECURITY_HANDLE_NIL;
+static dds_security_cryptography *crypto = NULL;
+static DDS_Security_ParticipantCryptoHandle local_participant_crypto_handle = DDS_SECURITY_HANDLE_NIL;
+static DDS_Security_ParticipantCryptoHandle remote_participant_crypto_handle = DDS_SECURITY_HANDLE_NIL;
+
+static void prepare_participant_security_attributes(DDS_Security_ParticipantSecurityAttributes *attributes)
+{
+  memset(attributes, 0, sizeof(DDS_Security_ParticipantSecurityAttributes));
+  attributes->allow_unauthenticated_participants = false;
+  attributes->is_access_protected = false;
+  attributes->is_discovery_protected = false;
+  attributes->is_liveliness_protected = false;
+  attributes->is_rtps_protected = true;
+  attributes->plugin_participant_attributes = DDS_SECURITY_PARTICIPANT_ATTRIBUTES_FLAG_IS_VALID;
+  attributes->plugin_participant_attributes |= DDS_SECURITY_PLUGIN_PARTICIPANT_ATTRIBUTES_FLAG_IS_RTPS_ENCRYPTED;
+}
+
+static void suite_register_local_datareader_init(void)
+{
+  DDS_Security_IdentityHandle participant_identity = 5; //valid dummy value
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  DDS_Security_PropertySeq participant_properties;
+  DDS_Security_PermissionsHandle remote_participant_permissions = 5; //valid dummy value
+  DDS_Security_SharedSecretHandleImpl *shared_secret_handle_impl;
+  DDS_Security_PermissionsHandle participant_permissions = 3; //valid dummy value
+  DDS_Security_ParticipantSecurityAttributes participant_security_attributes;
+
+  /* Only need the crypto plugin. */
+  CU_ASSERT_FATAL((plugins = load_plugins(
+                       NULL /* Access Control */,
+                       NULL /* Authentication */,
+                       &crypto /* Cryptograpy    */)) != NULL);
+
+  /* prepare test shared secret handle */
+  shared_secret_handle_impl = ddsrt_malloc(sizeof(DDS_Security_SharedSecretHandleImpl));
+  shared_secret_handle_impl->shared_secret = ddsrt_malloc(TEST_SHARED_SECRET_SIZE * sizeof(DDS_Security_octet));
+  shared_secret_handle_impl->shared_secret_size = TEST_SHARED_SECRET_SIZE;
+  for (int i = 0; i < shared_secret_handle_impl->shared_secret_size; i++)
+  {
+    shared_secret_handle_impl->shared_secret[i] = (unsigned char)(i % 20);
+  }
+  for (int i = 0; i < 32; i++)
+  {
+    shared_secret_handle_impl->challenge1[i] = (unsigned char)(i % 15);
+    shared_secret_handle_impl->challenge2[i] = (unsigned char)(i % 12);
+  }
+  shared_secret_handle = (DDS_Security_SharedSecretHandle)shared_secret_handle_impl;
+
+  /* Check if we actually have the validate_local_identity() function. */
+  CU_ASSERT_FATAL(crypto != NULL && crypto->crypto_key_factory != NULL && crypto->crypto_key_factory->register_local_participant != NULL);
+  memset(&exception, 0, sizeof(DDS_Security_SecurityException));
+  memset(&participant_properties, 0, sizeof(participant_properties));
+  prepare_participant_security_attributes(&participant_security_attributes);
+  CU_ASSERT_FATAL((local_participant_crypto_handle = crypto->crypto_key_factory->register_local_participant(
+                       crypto->crypto_key_factory,
+                       participant_identity,
+                       participant_permissions,
+                       &participant_properties,
+                       &participant_security_attributes,
+                       &exception)) != DDS_SECURITY_HANDLE_NIL)
+
+  /* Now call the function. */
+  remote_participant_crypto_handle = crypto->crypto_key_factory->register_matched_remote_participant(
+      crypto->crypto_key_factory,
+      local_participant_crypto_handle,
+      participant_identity,
+      remote_participant_permissions,
+      shared_secret_handle,
+      &exception);
+}
+
+static void suite_register_local_datareader_fini(void)
+{
+  DDS_Security_SharedSecretHandleImpl *shared_secret_handle_impl = (DDS_Security_SharedSecretHandleImpl *)shared_secret_handle;
+  unload_plugins(plugins);
+  ddsrt_free(shared_secret_handle_impl->shared_secret);
+  ddsrt_free(shared_secret_handle_impl);
+  shared_secret_handle = DDS_SECURITY_HANDLE_NIL;
+  crypto = NULL;
+  local_participant_crypto_handle = DDS_SECURITY_HANDLE_NIL;
+  remote_participant_crypto_handle = DDS_SECURITY_HANDLE_NIL;
+}
+
+static void reset_exception(DDS_Security_SecurityException *ex)
+{
+  ex->code = 0;
+  ex->minor_code = 0;
+  ddsrt_free(ex->message);
+  ex->message = NULL;
+}
+
+static void prepare_endpoint_security_attributes(DDS_Security_EndpointSecurityAttributes *attributes)
+{
+  memset(attributes, 0, sizeof(DDS_Security_EndpointSecurityAttributes));
+  attributes->is_discovery_protected = true;
+  attributes->is_submessage_protected = true;
+
+  attributes->plugin_endpoint_attributes |= DDS_SECURITY_PLUGIN_ENDPOINT_ATTRIBUTES_FLAG_IS_SUBMESSAGE_ENCRYPTED;
+}
+
+CU_Test(ddssec_builtin_register_local_datareader, happy_day, .init = suite_register_local_datareader_init, .fini = suite_register_local_datareader_fini)
+{
+  DDS_Security_DatareaderCryptoHandle result;
+
+  /* Dummy (even un-initialized) data for now. */
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  DDS_Security_PropertySeq datareader_properties;
+  DDS_Security_EndpointSecurityAttributes datareader_security_attributes;
+  local_datareader_crypto *reader_crypto;
+
+  /* Check if we actually have the function. */
+  CU_ASSERT_FATAL(crypto != NULL);
+  CU_ASSERT_FATAL(crypto->crypto_key_factory != NULL);
+  CU_ASSERT_FATAL(crypto->crypto_key_factory->register_local_datareader != NULL);
+
+  memset(&exception, 0, sizeof(DDS_Security_SecurityException));
+  memset(&datareader_properties, 0, sizeof(datareader_properties));
+
+  prepare_endpoint_security_attributes(&datareader_security_attributes);
+
+  /* Now call the function. */
+
+  result = crypto->crypto_key_factory->register_local_datareader(
+      crypto->crypto_key_factory,
+      local_participant_crypto_handle,
+      &datareader_properties,
+      &datareader_security_attributes,
+      &exception);
+
+  /* A valid handle to be returned */
+  CU_ASSERT(result != 0);
+
+  CU_ASSERT(exception.code == DDS_SECURITY_ERR_OK_CODE);
+
+  /* NOTE: It would be better to check if the keys have been generated but there is no interface to get them from handle */
+  reader_crypto = (local_datareader_crypto *)result;
+
+  CU_ASSERT_FATAL(reader_crypto->reader_key_material != NULL);
+  CU_ASSERT(master_salt_not_empty(reader_crypto->reader_key_material));
+  CU_ASSERT(master_key_not_empty(reader_crypto->reader_key_material));
+  CU_ASSERT(reader_crypto->metadata_protectionKind == DDS_SECURITY_PROTECTION_KIND_ENCRYPT);
+
+  reset_exception(&exception);
+}
+
+CU_Test(ddssec_builtin_register_local_datareader, builtin_endpoint, .init = suite_register_local_datareader_init, .fini = suite_register_local_datareader_fini)
+{
+  DDS_Security_DatareaderCryptoHandle result;
+
+  /* Dummy (even un-initialized) data for now. */
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  DDS_Security_PropertySeq datareader_properties;
+  DDS_Security_EndpointSecurityAttributes datareader_security_attributes;
+  local_datareader_crypto *reader_crypto;
+
+  memset(&exception, 0, sizeof(DDS_Security_SecurityException));
+  memset(&datareader_properties, 0, sizeof(datareader_properties));
+
+  /* Check if we actually have the function. */
+  CU_ASSERT_FATAL(crypto != NULL);
+  CU_ASSERT_FATAL(crypto->crypto_key_factory != NULL);
+  CU_ASSERT_FATAL(crypto->crypto_key_factory->register_local_datareader != NULL);
+
+  datareader_properties._buffer = DDS_Security_PropertySeq_allocbuf(1);
+  datareader_properties._length = datareader_properties._maximum = 1;
+
+  datareader_properties._buffer[0].name = ddsrt_strdup("dds.sec.builtin_endpoint_name");
+  datareader_properties._buffer[0].value = ddsrt_strdup("BuiltinSecureEndpointName");
+
+  prepare_endpoint_security_attributes(&datareader_security_attributes);
+
+  /* Now call the function. */
+  result = crypto->crypto_key_factory->register_local_datareader(
+      crypto->crypto_key_factory,
+      local_participant_crypto_handle,
+      &datareader_properties,
+      &datareader_security_attributes,
+      &exception);
+
+  if (exception.code != 0)
+    printf("register_local_datareader: %s\n", exception.message ? exception.message : "Error message missing");
+
+  /* A valid handle to be returned */
+  CU_ASSERT(result != 0);
+  CU_ASSERT(exception.code == DDS_SECURITY_ERR_OK_CODE);
+
+  /* NOTE: It would be better to check if the keys have been generated but there is no interface to get them from handle */
+  reader_crypto = (local_datareader_crypto *)result;
+  CU_ASSERT_FATAL(reader_crypto->reader_key_material != NULL);
+  CU_ASSERT(master_salt_not_empty(reader_crypto->reader_key_material));
+  CU_ASSERT(master_key_not_empty(reader_crypto->reader_key_material));
+  CU_ASSERT(reader_crypto->metadata_protectionKind == DDS_SECURITY_PROTECTION_KIND_ENCRYPT);
+  CU_ASSERT(reader_crypto->is_builtin_participant_volatile_message_secure_reader == false);
+
+  DDS_Security_PropertySeq_deinit(&datareader_properties);
+  reset_exception(&exception);
+}
+
+CU_Test(ddssec_builtin_register_local_datareader, special_endpoint_name, .init = suite_register_local_datareader_init, .fini = suite_register_local_datareader_fini)
+{
+  DDS_Security_DatareaderCryptoHandle result;
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  DDS_Security_PropertySeq datareader_properties;
+  DDS_Security_EndpointSecurityAttributes datareader_security_attributes;
+
+  memset(&exception, 0, sizeof(DDS_Security_SecurityException));
+  memset(&datareader_properties, 0, sizeof(datareader_properties));
+
+  /* Check if we actually have the function. */
+  CU_ASSERT_FATAL(crypto != NULL);
+  CU_ASSERT_FATAL(crypto->crypto_key_factory != NULL);
+  CU_ASSERT_FATAL(crypto->crypto_key_factory->register_local_datareader != NULL);
+
+  /*set special endpoint name*/
+  datareader_properties._buffer = DDS_Security_PropertySeq_allocbuf(1);
+  datareader_properties._length = datareader_properties._maximum = 1;
+  datareader_properties._buffer[0].name = ddsrt_strdup("dds.sec.builtin_endpoint_name");
+  datareader_properties._buffer[0].value = ddsrt_strdup("BuiltinParticipantVolatileMessageSecureReader");
+
+  prepare_endpoint_security_attributes(&datareader_security_attributes);
+
+  /* Now call the function. */
+  result = crypto->crypto_key_factory->register_local_datareader(
+      crypto->crypto_key_factory,
+      local_participant_crypto_handle,
+      &datareader_properties,
+      &datareader_security_attributes,
+      &exception);
+
+  if (exception.code != 0)
+    printf("register_local_datareader: %s\n", exception.message ? exception.message : "Error message missing");
+
+  /* A valid handle to be returned */
+  CU_ASSERT(result != 0);
+  CU_ASSERT(exception.code == DDS_SECURITY_ERR_OK_CODE);
+  CU_ASSERT_FATAL(((local_datareader_crypto *)result)->is_builtin_participant_volatile_message_secure_reader);
+  reset_exception(&exception);
+  DDS_Security_PropertySeq_deinit(&datareader_properties);
+}
+
+CU_Test(ddssec_builtin_register_local_datareader, invalid_participant, .init = suite_register_local_datareader_init, .fini = suite_register_local_datareader_fini)
+{
+  DDS_Security_DatareaderCryptoHandle result;
+
+  /* Dummy (even un-initialized) data for now. */
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  DDS_Security_PropertySeq datareader_properties;
+  DDS_Security_EndpointSecurityAttributes datareader_security_attributes;
+
+  /* Check if we actually have the function. */
+  CU_ASSERT_FATAL(crypto != NULL);
+  CU_ASSERT_FATAL(crypto->crypto_key_factory != NULL);
+  CU_ASSERT_FATAL(crypto->crypto_key_factory->register_local_datareader != NULL);
+
+  memset(&exception, 0, sizeof(DDS_Security_SecurityException));
+  memset(&datareader_properties, 0, sizeof(datareader_properties));
+
+  prepare_endpoint_security_attributes(&datareader_security_attributes);
+
+  /* Now call the function. */
+  result = crypto->crypto_key_factory->register_local_datareader(
+      crypto->crypto_key_factory,
+      8, /*non existing handle*/
+      &datareader_properties,
+      &datareader_security_attributes,
+      &exception);
+
+  /* Invalid handle should be returned */
+  CU_ASSERT(result == 0);
+  CU_ASSERT_FATAL(exception.code == DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_CODE);
+  CU_ASSERT_NSTRING_EQUAL_FATAL(exception.message, DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_MESSAGE, sizeof(DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_MESSAGE));
+  reset_exception(&exception);
+}
+
diff --git a/src/security/builtin_plugins/tests/register_local_datawriter/src/register_local_datawriter_utests.c b/src/security/builtin_plugins/tests/register_local_datawriter/src/register_local_datawriter_utests.c
new file mode 100644
index 0000000..c6d1adc
--- /dev/null
+++ b/src/security/builtin_plugins/tests/register_local_datawriter/src/register_local_datawriter_utests.c
@@ -0,0 +1,333 @@
+/*
+ * Copyright(c) 2006 to 2019 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+#include <openssl/evp.h>
+#include <openssl/hmac.h>
+#include <openssl/bio.h>
+#include <openssl/err.h>
+
+#include "dds/ddsrt/heap.h"
+#include "dds/ddsrt/string.h"
+#include "dds/ddsrt/types.h"
+#include "dds/ddsrt/environ.h"
+#include "dds/security/dds_security_api.h"
+#include "dds/security/core/dds_security_serialize.h"
+#include "dds/security/core/dds_security_utils.h"
+#include "dds/security/core/shared_secret.h"
+#include "CUnit/CUnit.h"
+#include "CUnit/Test.h"
+#include "common/src/loader.h"
+#include "common/src/crypto_helper.h"
+#include "crypto_objects.h"
+
+#if OPENSLL_VERSION_NUMBER >= 0x10002000L
+#define AUTH_INCLUDE_EC
+#endif
+
+#define TEST_SHARED_SECRET_SIZE 32
+
+static struct plugins_hdl *plugins = NULL;
+static DDS_Security_SharedSecretHandle shared_secret_handle = DDS_SECURITY_HANDLE_NIL;
+static dds_security_cryptography *crypto = NULL;
+static DDS_Security_ParticipantCryptoHandle local_participant_crypto_handle = DDS_SECURITY_HANDLE_NIL;
+static DDS_Security_ParticipantCryptoHandle remote_participant_crypto_handle = DDS_SECURITY_HANDLE_NIL;
+
+static void prepare_participant_security_attributes(DDS_Security_ParticipantSecurityAttributes *attributes)
+{
+  memset(attributes, 0, sizeof(DDS_Security_ParticipantSecurityAttributes));
+  attributes->allow_unauthenticated_participants = false;
+  attributes->is_access_protected = false;
+  attributes->is_discovery_protected = false;
+  attributes->is_liveliness_protected = false;
+  attributes->is_rtps_protected = true;
+  attributes->plugin_participant_attributes = DDS_SECURITY_PARTICIPANT_ATTRIBUTES_FLAG_IS_VALID;
+  attributes->plugin_participant_attributes |= DDS_SECURITY_PLUGIN_PARTICIPANT_ATTRIBUTES_FLAG_IS_RTPS_ENCRYPTED;
+}
+
+static void suite_register_local_datawriter_init(void)
+{
+  DDS_Security_IdentityHandle participant_identity = 5; //valid dummy value
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  DDS_Security_PropertySeq participant_properties;
+  DDS_Security_PermissionsHandle remote_participant_permissions = 5; //valid dummy value
+  DDS_Security_SharedSecretHandleImpl *shared_secret_handle_impl;
+  DDS_Security_PermissionsHandle participant_permissions = 3; //valid dummy value
+  DDS_Security_ParticipantSecurityAttributes participant_security_attributes;
+
+  CU_ASSERT_FATAL ((plugins = load_plugins(
+                        NULL    /* Access Control */,
+                        NULL    /* Authentication */,
+                        &crypto /* Cryptograpy    */)) != NULL);
+
+  /* prepare test shared secret handle */
+  shared_secret_handle_impl = ddsrt_malloc(sizeof(DDS_Security_SharedSecretHandleImpl));
+  shared_secret_handle_impl->shared_secret = ddsrt_malloc(TEST_SHARED_SECRET_SIZE * sizeof(DDS_Security_octet));
+  shared_secret_handle_impl->shared_secret_size = TEST_SHARED_SECRET_SIZE;
+  for (int i = 0; i < shared_secret_handle_impl->shared_secret_size; i++)
+  {
+    shared_secret_handle_impl->shared_secret[i] = (unsigned char)(i % 20);
+  }
+  for (int i = 0; i < 32; i++)
+  {
+    shared_secret_handle_impl->challenge1[i] = (unsigned char)(i % 15);
+    shared_secret_handle_impl->challenge2[i] = (unsigned char)(i % 12);
+  }
+  shared_secret_handle = (DDS_Security_SharedSecretHandle)shared_secret_handle_impl;
+
+  /* Check if we actually have the validate_local_identity() function. */
+  CU_ASSERT_FATAL (crypto != NULL && crypto->crypto_key_factory != NULL && crypto->crypto_key_factory->register_local_participant != NULL);
+
+  memset(&exception, 0, sizeof(DDS_Security_SecurityException));
+  memset(&participant_properties, 0, sizeof(participant_properties));
+  prepare_participant_security_attributes(&participant_security_attributes);
+  local_participant_crypto_handle = crypto->crypto_key_factory->register_local_participant(
+      crypto->crypto_key_factory,
+      participant_identity,
+      participant_permissions,
+      &participant_properties,
+      &participant_security_attributes,
+      &exception);
+  CU_ASSERT_FATAL (local_participant_crypto_handle != DDS_SECURITY_HANDLE_NIL);
+
+  /* Now call the function. */
+  remote_participant_crypto_handle = crypto->crypto_key_factory->register_matched_remote_participant(
+      crypto->crypto_key_factory,
+      local_participant_crypto_handle,
+      participant_identity,
+      remote_participant_permissions,
+      shared_secret_handle,
+      &exception);
+  CU_ASSERT_FATAL (remote_participant_crypto_handle != DDS_SECURITY_HANDLE_NIL);
+  ddsrt_free(shared_secret_handle_impl->shared_secret);
+  ddsrt_free(shared_secret_handle_impl);
+}
+
+static void suite_register_local_datawriter_fini(void)
+{
+  unload_plugins(plugins);
+  shared_secret_handle = DDS_SECURITY_HANDLE_NIL;
+  crypto = NULL;
+  local_participant_crypto_handle = DDS_SECURITY_HANDLE_NIL;
+  remote_participant_crypto_handle = DDS_SECURITY_HANDLE_NIL;
+}
+
+static void reset_exception(DDS_Security_SecurityException *ex)
+{
+  ex->code = 0;
+  ex->minor_code = 0;
+  ddsrt_free(ex->message);
+  ex->message = NULL;
+}
+
+static void prepare_endpoint_security_attributes(DDS_Security_EndpointSecurityAttributes *attributes)
+{
+  memset(attributes, 0, sizeof(DDS_Security_EndpointSecurityAttributes));
+  attributes->is_discovery_protected = true;
+  attributes->is_submessage_protected = true;
+
+  attributes->plugin_endpoint_attributes |= DDS_SECURITY_PLUGIN_ENDPOINT_ATTRIBUTES_FLAG_IS_SUBMESSAGE_ENCRYPTED;
+}
+
+CU_Test(ddssec_builtin_register_local_datawriter, happy_day, .init = suite_register_local_datawriter_init, .fini = suite_register_local_datawriter_fini)
+{
+  DDS_Security_DatawriterCryptoHandle result;
+
+  /* Dummy (even un-initialized) data for now. */
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  DDS_Security_PropertySeq datawriter_properties;
+  DDS_Security_EndpointSecurityAttributes datawriter_security_attributes;
+  local_datawriter_crypto *writer_crypto;
+
+  /* Check if we actually have the function. */
+  CU_ASSERT_FATAL(crypto != NULL);
+  CU_ASSERT_FATAL(crypto->crypto_key_factory != NULL);
+  CU_ASSERT_FATAL(crypto->crypto_key_factory->register_local_datawriter != NULL);
+
+  memset(&exception, 0, sizeof(DDS_Security_SecurityException));
+  memset(&datawriter_properties, 0, sizeof(datawriter_properties));
+  prepare_endpoint_security_attributes(&datawriter_security_attributes);
+
+  datawriter_security_attributes.is_payload_protected = true;
+  datawriter_security_attributes.plugin_endpoint_attributes |= DDS_SECURITY_PLUGIN_ENDPOINT_ATTRIBUTES_FLAG_IS_PAYLOAD_ENCRYPTED;
+
+  /* Now call the function. */
+  result = crypto->crypto_key_factory->register_local_datawriter(
+      crypto->crypto_key_factory,
+      local_participant_crypto_handle,
+      &datawriter_properties,
+      &datawriter_security_attributes,
+      &exception);
+
+  if (exception.code != 0)
+    printf("register_local_datawriter: %s\n", exception.message ? exception.message : "Error message missing");
+
+  /* A valid handle to be returned */
+  CU_ASSERT(result != 0);
+  CU_ASSERT(exception.code == DDS_SECURITY_ERR_OK_CODE);
+
+  /* NOTE: It would be better to check if the keys have been generated but there is no interface to get them from handle */
+  writer_crypto = (local_datawriter_crypto *)result;
+
+  CU_ASSERT_FATAL(writer_crypto->writer_key_material_message != NULL);
+  CU_ASSERT_FATAL(writer_crypto->writer_key_material_payload != NULL);
+
+  CU_ASSERT(master_salt_not_empty(writer_crypto->writer_key_material_message));
+  CU_ASSERT(master_key_not_empty(writer_crypto->writer_key_material_message));
+
+  CU_ASSERT(master_salt_not_empty(writer_crypto->writer_key_material_payload));
+  CU_ASSERT(master_key_not_empty(writer_crypto->writer_key_material_payload));
+
+  CU_ASSERT(writer_crypto->metadata_protectionKind == DDS_SECURITY_PROTECTION_KIND_ENCRYPT);
+  CU_ASSERT(writer_crypto->data_protectionKind == DDS_SECURITY_BASICPROTECTION_KIND_ENCRYPT);
+
+  reset_exception(&exception);
+}
+
+CU_Test(ddssec_builtin_register_local_datawriter, builtin_endpoint, .init = suite_register_local_datawriter_init, .fini = suite_register_local_datawriter_fini)
+{
+  DDS_Security_DatawriterCryptoHandle result;
+
+  /* Dummy (even un-initialized) data for now. */
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  DDS_Security_PropertySeq datawriter_properties;
+  DDS_Security_EndpointSecurityAttributes datawriter_security_attributes;
+  local_datawriter_crypto *writer_crypto;
+
+  memset(&exception, 0, sizeof(DDS_Security_SecurityException));
+  memset(&datawriter_properties, 0, sizeof(datawriter_properties));
+
+  prepare_endpoint_security_attributes(&datawriter_security_attributes);
+  datawriter_security_attributes.is_payload_protected = true;
+  datawriter_security_attributes.plugin_endpoint_attributes |= DDS_SECURITY_PLUGIN_ENDPOINT_ATTRIBUTES_FLAG_IS_PAYLOAD_ENCRYPTED;
+
+  /* Check if we actually have the function. */
+  CU_ASSERT_FATAL(crypto != NULL);
+  CU_ASSERT_FATAL(crypto->crypto_key_factory != NULL);
+  CU_ASSERT_FATAL(crypto->crypto_key_factory->register_local_datawriter != NULL);
+
+  datawriter_properties._buffer = DDS_Security_PropertySeq_allocbuf(1);
+  datawriter_properties._length = datawriter_properties._maximum = 1;
+  datawriter_properties._buffer[0].name = ddsrt_strdup("dds.sec.builtin_endpoint_name");
+  datawriter_properties._buffer[0].value = ddsrt_strdup("BuiltinSecureEndpointName");
+
+  /* Now call the function. */
+  result = crypto->crypto_key_factory->register_local_datawriter(
+      crypto->crypto_key_factory,
+      local_participant_crypto_handle,
+      &datawriter_properties,
+      &datawriter_security_attributes,
+      &exception);
+
+  if (exception.code != 0)
+    printf("register_local_datawriter: %s\n", exception.message ? exception.message : "Error message missing");
+
+  /* A valid handle to be returned */
+  CU_ASSERT(result != 0);
+  CU_ASSERT(exception.code == DDS_SECURITY_ERR_OK_CODE);
+
+  /* NOTE: It would be better to check if the keys have been generated but there is no interface to get them from handle */
+  writer_crypto = (local_datawriter_crypto *)result;
+
+  CU_ASSERT_FATAL(writer_crypto->writer_key_material_message != NULL);
+  CU_ASSERT_FATAL(writer_crypto->writer_key_material_payload != NULL);
+
+  CU_ASSERT(master_salt_not_empty(writer_crypto->writer_key_material_message));
+  CU_ASSERT(master_key_not_empty(writer_crypto->writer_key_material_message));
+
+  CU_ASSERT(master_salt_not_empty(writer_crypto->writer_key_material_payload));
+  CU_ASSERT(master_key_not_empty(writer_crypto->writer_key_material_payload));
+
+  CU_ASSERT_FATAL(writer_crypto->metadata_protectionKind == DDS_SECURITY_PROTECTION_KIND_ENCRYPT);
+  CU_ASSERT_FATAL(writer_crypto->data_protectionKind == DDS_SECURITY_BASICPROTECTION_KIND_ENCRYPT);
+  CU_ASSERT_FATAL(writer_crypto->is_builtin_participant_volatile_message_secure_writer == false);
+
+  reset_exception(&exception);
+  DDS_Security_PropertySeq_deinit(&datawriter_properties);
+}
+
+CU_Test(ddssec_builtin_register_local_datawriter, special_endpoint_name, .init = suite_register_local_datawriter_init, .fini = suite_register_local_datawriter_fini)
+{
+  DDS_Security_DatawriterCryptoHandle result;
+
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  DDS_Security_PropertySeq datawriter_properties;
+  DDS_Security_EndpointSecurityAttributes datawriter_security_attributes;
+
+  memset(&exception, 0, sizeof(DDS_Security_SecurityException));
+  memset(&datawriter_properties, 0, sizeof(datawriter_properties));
+  memset(&datawriter_security_attributes, 0, sizeof(datawriter_security_attributes));
+  prepare_endpoint_security_attributes(&datawriter_security_attributes);
+
+  /* Check if we actually have the function. */
+  CU_ASSERT_FATAL(crypto != NULL);
+  CU_ASSERT_FATAL(crypto->crypto_key_factory != NULL);
+  CU_ASSERT_FATAL(crypto->crypto_key_factory->register_local_datawriter != NULL);
+
+  /*set special endpoint name*/
+  datawriter_properties._buffer = DDS_Security_PropertySeq_allocbuf(1);
+  datawriter_properties._length = datawriter_properties._maximum = 1;
+  datawriter_properties._buffer[0].name = ddsrt_strdup("dds.sec.builtin_endpoint_name");
+  datawriter_properties._buffer[0].value = ddsrt_strdup("BuiltinParticipantVolatileMessageSecureWriter");
+
+  /* Now call the function. */
+  result = crypto->crypto_key_factory->register_local_datawriter(
+      crypto->crypto_key_factory,
+      local_participant_crypto_handle,
+      &datawriter_properties,
+      &datawriter_security_attributes,
+      &exception);
+
+  if (exception.code != 0)
+    printf("register_local_datawriter: %s\n", exception.message ? exception.message : "Error message missing");
+
+  /* A valid handle to be returned */
+  CU_ASSERT(result != 0);
+  CU_ASSERT(exception.code == DDS_SECURITY_ERR_OK_CODE);
+  CU_ASSERT_FATAL(((local_datawriter_crypto *)result)->is_builtin_participant_volatile_message_secure_writer);
+
+  reset_exception(&exception);
+  DDS_Security_PropertySeq_deinit(&datawriter_properties);
+}
+
+CU_Test(ddssec_builtin_register_local_datawriter, invalid_participant, .init = suite_register_local_datawriter_init, .fini = suite_register_local_datawriter_fini)
+{
+  DDS_Security_DatawriterCryptoHandle result;
+
+  /* Dummy (even un-initialized) data for now. */
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  DDS_Security_PropertySeq datawriter_properties;
+  DDS_Security_EndpointSecurityAttributes datawriter_security_attributes;
+
+  /* Check if we actually have the function. */
+  CU_ASSERT_FATAL(crypto != NULL);
+  CU_ASSERT_FATAL(crypto->crypto_key_factory != NULL);
+  CU_ASSERT_FATAL(crypto->crypto_key_factory->register_local_datawriter != NULL);
+
+  memset(&exception, 0, sizeof(DDS_Security_SecurityException));
+  memset(&datawriter_properties, 0, sizeof(datawriter_properties));
+  prepare_endpoint_security_attributes(&datawriter_security_attributes);
+
+  /* Now call the function. */
+  result = crypto->crypto_key_factory->register_local_datawriter(
+      crypto->crypto_key_factory,
+      8, /*non existing handle*/
+      &datawriter_properties,
+      &datawriter_security_attributes,
+      &exception);
+
+  /* Invalid handle should be returned */
+  CU_ASSERT(result == 0);
+
+  CU_ASSERT_FATAL(exception.code == DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_CODE);
+  CU_ASSERT_NSTRING_EQUAL_FATAL(exception.message, DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_MESSAGE, sizeof(DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_MESSAGE));
+
+  reset_exception(&exception);
+}
diff --git a/src/security/builtin_plugins/tests/register_local_participant/src/register_local_participant_utests.c b/src/security/builtin_plugins/tests/register_local_participant/src/register_local_participant_utests.c
new file mode 100644
index 0000000..967cf67
--- /dev/null
+++ b/src/security/builtin_plugins/tests/register_local_participant/src/register_local_participant_utests.c
@@ -0,0 +1,154 @@
+/*
+ * Copyright(c) 2006 to 2019 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+#include <openssl/evp.h>
+#include <openssl/hmac.h>
+#include <openssl/bio.h>
+#include <openssl/err.h>
+
+#include "dds/ddsrt/heap.h"
+#include "dds/ddsrt/string.h"
+#include "dds/ddsrt/types.h"
+#include "dds/ddsrt/environ.h"
+#include "dds/security/dds_security_api.h"
+#include "dds/security/core/dds_security_serialize.h"
+#include "dds/security/core/dds_security_utils.h"
+#include "dds/security/core/shared_secret.h"
+#include "CUnit/CUnit.h"
+#include "CUnit/Test.h"
+#include "common/src/loader.h"
+#include "crypto_objects.h"
+
+#if OPENSLL_VERSION_NUMBER >= 0x10002000L
+#define AUTH_INCLUDE_EC
+#endif
+
+static struct plugins_hdl *plugins = NULL;
+static dds_security_cryptography *crypto = NULL;
+
+static void suite_register_local_participant_init(void)
+{
+  CU_ASSERT_FATAL ((plugins = load_plugins(
+                      NULL    /* Access Control */,
+                      NULL    /* Authentication */,
+                      &crypto /* Cryptograpy    */)) != NULL);
+}
+
+static void suite_register_local_participant_fini(void)
+{
+  unload_plugins(plugins);
+}
+
+static void reset_exception(DDS_Security_SecurityException *ex)
+{
+  ex->code = 0;
+  ex->minor_code = 0;
+  ddsrt_free(ex->message);
+  ex->message = NULL;
+}
+
+static void prepare_participant_security_attributes(DDS_Security_ParticipantSecurityAttributes *attributes)
+{
+  memset(attributes, 0, sizeof(DDS_Security_ParticipantSecurityAttributes));
+  attributes->allow_unauthenticated_participants = false;
+  attributes->is_access_protected = false;
+  attributes->is_discovery_protected = false;
+  attributes->is_liveliness_protected = false;
+  attributes->is_rtps_protected = true;
+  attributes->plugin_participant_attributes = DDS_SECURITY_PARTICIPANT_ATTRIBUTES_FLAG_IS_VALID;
+  attributes->plugin_participant_attributes |= DDS_SECURITY_PLUGIN_PARTICIPANT_ATTRIBUTES_FLAG_IS_RTPS_ENCRYPTED;
+}
+
+CU_Test(ddssec_builtin_register_local_participant, happy_day, .init = suite_register_local_participant_init, .fini = suite_register_local_participant_fini)
+{
+  DDS_Security_ParticipantCryptoHandle hdl;
+
+  /* Dummy (even un-initialized) data for now. */
+  DDS_Security_IdentityHandle participant_identity = 5; //valid dummy value
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  DDS_Security_PermissionsHandle participant_permissions = 2; /*dummy but valid */
+  DDS_Security_PropertySeq participant_properties;
+  DDS_Security_ParticipantSecurityAttributes participant_security_attributes;
+
+  /* Check if we actually have the validate_local_identity() function. */
+  CU_ASSERT_FATAL(crypto != NULL);
+  CU_ASSERT_FATAL(crypto->crypto_key_factory != NULL);
+  CU_ASSERT_FATAL(crypto->crypto_key_factory->register_local_participant != NULL);
+
+  memset(&exception, 0, sizeof(DDS_Security_SecurityException));
+  memset(&participant_properties, 0, sizeof(participant_properties));
+
+  prepare_participant_security_attributes(&participant_security_attributes);
+
+  /* Now call the function. */
+  hdl = crypto->crypto_key_factory->register_local_participant(
+      crypto->crypto_key_factory,
+      participant_identity,
+      participant_permissions,
+      &participant_properties,
+      &participant_security_attributes,
+      &exception);
+
+  if (exception.code != 0)
+    printf("register_local_participant: %s\n", exception.message ? exception.message : "Error message missing");
+
+  /* A valid handle to be returned */
+  CU_ASSERT(hdl != DDS_SECURITY_HANDLE_NIL);
+  CU_ASSERT(exception.code == DDS_SECURITY_ERR_OK_CODE);
+
+  reset_exception(&exception);
+
+  (void)crypto->crypto_key_factory->unregister_participant(
+      crypto->crypto_key_factory,
+      hdl,
+      &exception);
+  reset_exception(&exception);
+}
+
+CU_Test(ddssec_builtin_register_local_participant, empty_identity, .init = suite_register_local_participant_init, .fini = suite_register_local_participant_fini)
+{
+  DDS_Security_ParticipantCryptoHandle result;
+
+  /* Dummy (even un-initialized) data for now. */
+  DDS_Security_IdentityHandle participant_identity = 0; //empty identity
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+
+  DDS_Security_PermissionsHandle participant_permissions = 2; /*dummy but valid */
+  DDS_Security_PropertySeq participant_properties;
+  DDS_Security_ParticipantSecurityAttributes participant_security_attributes;
+
+  /* Check if we actually have the validate_local_identity() function. */
+  CU_ASSERT_FATAL(crypto != NULL);
+  CU_ASSERT_FATAL(crypto->crypto_key_factory != NULL);
+  CU_ASSERT_FATAL(crypto->crypto_key_factory->register_local_participant != NULL);
+
+  memset(&exception, 0, sizeof(DDS_Security_SecurityException));
+  memset(&participant_properties, 0, sizeof(participant_properties));
+  prepare_participant_security_attributes(&participant_security_attributes);
+
+  /* Now call the function. */
+  result = crypto->crypto_key_factory->register_local_participant(
+      crypto->crypto_key_factory,
+      participant_identity,
+      participant_permissions,
+      &participant_properties,
+      &participant_security_attributes,
+      &exception);
+  if (exception.code != 0)
+    printf("register_local_participant: %s\n", exception.message ? exception.message : "Error message missing");
+
+  CU_ASSERT(exception.code == DDS_SECURITY_ERR_IDENTITY_EMPTY_CODE);
+  CU_ASSERT(!strcmp(exception.message, DDS_SECURITY_ERR_IDENTITY_EMPTY_MESSAGE));
+  CU_ASSERT(result == 0);
+
+  reset_exception(&exception);
+}
+
diff --git a/src/security/builtin_plugins/tests/register_matched_remote_datareader/src/register_matched_remote_datareader_utests.c b/src/security/builtin_plugins/tests/register_matched_remote_datareader/src/register_matched_remote_datareader_utests.c
new file mode 100644
index 0000000..6c6d6ff
--- /dev/null
+++ b/src/security/builtin_plugins/tests/register_matched_remote_datareader/src/register_matched_remote_datareader_utests.c
@@ -0,0 +1,392 @@
+/*
+ * Copyright(c) 2006 to 2019 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+#include <openssl/evp.h>
+#include <openssl/hmac.h>
+#include <openssl/bio.h>
+#include <openssl/err.h>
+
+#include "dds/ddsrt/heap.h"
+#include "dds/ddsrt/string.h"
+#include "dds/ddsrt/types.h"
+#include "dds/ddsrt/environ.h"
+#include "dds/security/dds_security_api.h"
+#include "dds/security/core/dds_security_serialize.h"
+#include "dds/security/core/dds_security_utils.h"
+#include "dds/security/core/shared_secret.h"
+#include "CUnit/CUnit.h"
+#include "CUnit/Test.h"
+#include "common/src/loader.h"
+#include "common/src/crypto_helper.h"
+#include "crypto_objects.h"
+
+#if OPENSLL_VERSION_NUMBER >= 0x10002000L
+#define AUTH_INCLUDE_EC
+#endif
+
+#define TEST_SHARED_SECRET_SIZE 32
+
+static struct plugins_hdl *plugins = NULL;
+static DDS_Security_SharedSecretHandle shared_secret_handle = DDS_SECURITY_HANDLE_NIL;
+static dds_security_cryptography *crypto = NULL;
+static DDS_Security_ParticipantCryptoHandle local_participant_crypto_handle = DDS_SECURITY_HANDLE_NIL;
+static DDS_Security_ParticipantCryptoHandle remote_participant_crypto_handle = DDS_SECURITY_HANDLE_NIL;
+static DDS_Security_DatawriterCryptoHandle local_writer_handle = DDS_SECURITY_HANDLE_NIL;
+
+static void prepare_participant_security_attributes(DDS_Security_ParticipantSecurityAttributes *attributes)
+{
+  memset(attributes, 0, sizeof(DDS_Security_ParticipantSecurityAttributes));
+  attributes->allow_unauthenticated_participants = false;
+  attributes->is_access_protected = false;
+  attributes->is_discovery_protected = false;
+  attributes->is_liveliness_protected = false;
+  attributes->is_rtps_protected = true;
+  attributes->plugin_participant_attributes = DDS_SECURITY_PARTICIPANT_ATTRIBUTES_FLAG_IS_VALID;
+  attributes->plugin_participant_attributes |= DDS_SECURITY_PLUGIN_PARTICIPANT_ATTRIBUTES_FLAG_IS_RTPS_ENCRYPTED;
+}
+
+static void prepare_endpoint_security_attributes(DDS_Security_EndpointSecurityAttributes *attributes)
+{
+  memset(attributes, 0, sizeof(DDS_Security_EndpointSecurityAttributes));
+  attributes->is_discovery_protected = true;
+  attributes->is_submessage_protected = true;
+
+  attributes->plugin_endpoint_attributes |= DDS_SECURITY_PLUGIN_ENDPOINT_ATTRIBUTES_FLAG_IS_SUBMESSAGE_ENCRYPTED;
+}
+
+static void register_local_regular()
+{
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  DDS_Security_PropertySeq datawriter_properties;
+  DDS_Security_EndpointSecurityAttributes datawriter_security_attributes;
+
+  memset(&datawriter_properties, 0, sizeof(datawriter_properties));
+
+  prepare_endpoint_security_attributes(&datawriter_security_attributes);
+  datawriter_security_attributes.is_payload_protected = true;
+  datawriter_security_attributes.plugin_endpoint_attributes |= DDS_SECURITY_PLUGIN_ENDPOINT_ATTRIBUTES_FLAG_IS_PAYLOAD_ENCRYPTED;
+
+  /* Now call the function. */
+
+  local_writer_handle = crypto->crypto_key_factory->register_local_datawriter(
+      crypto->crypto_key_factory,
+      local_participant_crypto_handle,
+      &datawriter_properties,
+      &datawriter_security_attributes,
+      &exception);
+}
+
+static void suite_register_matched_remote_datareader_init(void)
+{
+  DDS_Security_IdentityHandle participant_identity = 5; //valid dummy value
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  DDS_Security_PropertySeq participant_properties;
+  DDS_Security_PermissionsHandle remote_participant_permissions = 5; //valid dummy value
+  DDS_Security_SharedSecretHandleImpl *shared_secret_handle_impl;
+  DDS_Security_PermissionsHandle participant_permissions = 3; //valid dummy value
+  DDS_Security_ParticipantSecurityAttributes participant_security_attributes;
+
+  CU_ASSERT_FATAL ((plugins = load_plugins(
+                      NULL    /* Access Control */,
+                      NULL    /* Authentication */,
+                      &crypto /* Cryptograpy    */)) != NULL);
+  /* prepare test shared secret handle */
+  shared_secret_handle_impl = ddsrt_malloc(sizeof(DDS_Security_SharedSecretHandleImpl));
+  shared_secret_handle_impl->shared_secret = ddsrt_malloc(TEST_SHARED_SECRET_SIZE * sizeof(DDS_Security_octet));
+  shared_secret_handle_impl->shared_secret_size = TEST_SHARED_SECRET_SIZE;
+  for (int i = 0; i < shared_secret_handle_impl->shared_secret_size; i++)
+  {
+    shared_secret_handle_impl->shared_secret[i] = (unsigned char)(i % 20);
+  }
+
+  for (int i = 0; i < 32; i++)
+  {
+    shared_secret_handle_impl->challenge1[i] = (unsigned char)(i % 15);
+    shared_secret_handle_impl->challenge2[i] = (unsigned char)(i % 12);
+  }
+  shared_secret_handle = (DDS_Security_SharedSecretHandle)shared_secret_handle_impl;
+
+  /* Check if we actually have the validate_local_identity() function. */
+  CU_ASSERT_FATAL (crypto != NULL && crypto->crypto_key_factory != NULL && crypto->crypto_key_factory->register_local_participant != NULL);
+  memset(&exception, 0, sizeof(DDS_Security_SecurityException));
+  memset(&participant_properties, 0, sizeof(participant_properties));
+  prepare_participant_security_attributes(&participant_security_attributes);
+
+  local_participant_crypto_handle = crypto->crypto_key_factory->register_local_participant(
+      crypto->crypto_key_factory,
+      participant_identity,
+      participant_permissions,
+      &participant_properties,
+      &participant_security_attributes,
+      &exception);
+
+  CU_ASSERT_FATAL (local_participant_crypto_handle != DDS_SECURITY_HANDLE_NIL);
+
+  /* Now call the function. */
+  remote_participant_crypto_handle = crypto->crypto_key_factory->register_matched_remote_participant(
+      crypto->crypto_key_factory,
+      local_participant_crypto_handle,
+      participant_identity,
+      remote_participant_permissions,
+      shared_secret_handle,
+      &exception);
+
+  CU_ASSERT_FATAL (remote_participant_crypto_handle != DDS_SECURITY_HANDLE_NIL);
+  ddsrt_free(shared_secret_handle_impl->shared_secret);
+  ddsrt_free(shared_secret_handle_impl);
+}
+
+static void suite_register_matched_remote_datareader_fini(void)
+{
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  (void)crypto->crypto_key_factory->unregister_participant(
+      crypto->crypto_key_factory,
+      remote_participant_crypto_handle,
+      &exception);
+  (void)crypto->crypto_key_factory->unregister_participant(
+      crypto->crypto_key_factory,
+      local_participant_crypto_handle,
+      &exception);
+  unload_plugins(plugins);
+  shared_secret_handle = DDS_SECURITY_HANDLE_NIL;
+  crypto = NULL;
+  local_participant_crypto_handle = DDS_SECURITY_HANDLE_NIL;
+  remote_participant_crypto_handle = DDS_SECURITY_HANDLE_NIL;
+}
+
+static void reset_exception(DDS_Security_SecurityException *ex)
+{
+  ex->code = 0;
+  ex->minor_code = 0;
+  ddsrt_free(ex->message);
+  ex->message = NULL;
+}
+
+CU_Test(ddssec_builtin_register_remote_datareader, happy_day, .init = suite_register_matched_remote_datareader_init, .fini = suite_register_matched_remote_datareader_fini)
+{
+  DDS_Security_DatawriterCryptoHandle result;
+  bool unregister_result = false;
+
+  /* Dummy (even un-initialized) data for now. */
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  remote_datareader_crypto *reader_crypto;
+
+  /* Check if we actually have the function. */
+  CU_ASSERT_FATAL(crypto != NULL);
+  CU_ASSERT_FATAL(crypto->crypto_key_factory != NULL);
+  CU_ASSERT_FATAL(crypto->crypto_key_factory->register_matched_remote_datareader != NULL);
+
+  register_local_regular();
+
+  /* Now call the function. */
+
+  result = crypto->crypto_key_factory->register_matched_remote_datareader(
+      crypto->crypto_key_factory,
+      local_writer_handle,
+      remote_participant_crypto_handle,
+      shared_secret_handle,
+      true,
+      &exception);
+
+  if (exception.code != 0)
+    printf("register_remote_datareader: %s\n", exception.message ? exception.message : "Error message missing");
+
+  /* A valid handle to be returned */
+  CU_ASSERT(result != 0);
+  CU_ASSERT(exception.code == DDS_SECURITY_ERR_OK_CODE);
+
+  /* NOTE: It would be better to check if the keys have been generated but there is no interface to get them from handle */
+  reader_crypto = (remote_datareader_crypto *)result;
+  CU_ASSERT_FATAL(reader_crypto->writer2reader_key_material_message != NULL);
+  CU_ASSERT_FATAL(reader_crypto->writer2reader_key_material_payload != NULL);
+  CU_ASSERT(master_salt_not_empty(reader_crypto->writer2reader_key_material_message));
+  CU_ASSERT(master_key_not_empty(reader_crypto->writer2reader_key_material_message));
+  CU_ASSERT(master_salt_not_empty(reader_crypto->writer2reader_key_material_payload));
+  CU_ASSERT(master_key_not_empty(reader_crypto->writer2reader_key_material_payload));
+  CU_ASSERT_FATAL(reader_crypto->metadata_protectionKind == DDS_SECURITY_PROTECTION_KIND_ENCRYPT);
+  reset_exception(&exception);
+
+  unregister_result = crypto->crypto_key_factory->unregister_datareader(crypto->crypto_key_factory, result, &exception);
+  CU_ASSERT_FATAL(unregister_result);
+}
+
+/* test if function returns volatile secure reader crypto if the writer is volatile secure*/
+CU_Test(ddssec_builtin_register_remote_datareader, volatile_secure, .init = suite_register_matched_remote_datareader_init, .fini = suite_register_matched_remote_datareader_fini)
+{
+  DDS_Security_DatawriterCryptoHandle result;
+  DDS_Security_DatawriterCryptoHandle local_volatile_secure_writer;
+  DDS_Security_PropertySeq datawriter_properties;
+  DDS_Security_EndpointSecurityAttributes datawriter_security_attributes;
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+
+  memset(&datawriter_properties, 0, sizeof(datawriter_properties));
+
+  prepare_endpoint_security_attributes(&datawriter_security_attributes);
+
+  datawriter_security_attributes.is_discovery_protected = true;
+  datawriter_security_attributes.is_submessage_protected = true;
+
+  datawriter_properties._length = datawriter_properties._maximum = 1;
+  datawriter_properties._buffer = DDS_Security_PropertySeq_allocbuf(1);
+  datawriter_properties._buffer[0].name = ddsrt_strdup("dds.sec.builtin_endpoint_name");
+  datawriter_properties._buffer[0].value = ddsrt_strdup("BuiltinParticipantVolatileMessageSecureWriter");
+  datawriter_properties._buffer[0].propagate = false;
+
+  /* Check if we actually have the function. */
+  CU_ASSERT_FATAL(crypto != NULL);
+  CU_ASSERT_FATAL(crypto->crypto_key_factory != NULL);
+  CU_ASSERT_FATAL(crypto->crypto_key_factory->register_local_datawriter != NULL);
+  CU_ASSERT_FATAL(crypto->crypto_key_factory->register_matched_remote_datareader != NULL);
+
+  local_volatile_secure_writer =
+      crypto->crypto_key_factory->register_local_datawriter(
+          crypto->crypto_key_factory,
+          local_participant_crypto_handle,
+          &datawriter_properties,
+          &datawriter_security_attributes,
+          &exception);
+
+  /* Now call the function. */
+  result = crypto->crypto_key_factory->register_matched_remote_datareader(
+      crypto->crypto_key_factory,
+      local_volatile_secure_writer,
+      remote_participant_crypto_handle,
+      shared_secret_handle,
+      true,
+      &exception);
+
+  /* A valid handle to be returned */
+  CU_ASSERT_FATAL(result != 0);
+  CU_ASSERT_FATAL(((remote_datareader_crypto *)result)->is_builtin_participant_volatile_message_secure_reader);
+  CU_ASSERT_FATAL(exception.code == DDS_SECURITY_ERR_OK_CODE);
+  reset_exception(&exception);
+
+  crypto->crypto_key_factory->unregister_datareader(crypto->crypto_key_factory, result, &exception);
+  crypto->crypto_key_factory->unregister_datawriter(crypto->crypto_key_factory, local_volatile_secure_writer, &exception);
+  DDS_Security_PropertySeq_deinit(&datawriter_properties);
+}
+
+CU_Test(ddssec_builtin_register_remote_datareader, with_origin_authentication, .init = suite_register_matched_remote_datareader_init, .fini = suite_register_matched_remote_datareader_fini)
+{
+  DDS_Security_DatawriterCryptoHandle result;
+  bool unregister_result = false;
+  local_datawriter_crypto *writer_crypto;
+
+  /* Dummy (even un-initialized) data for now. */
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  remote_datareader_crypto *reader_crypto;
+
+  /* Check if we actually have the function. */
+  CU_ASSERT_FATAL(crypto != NULL);
+  CU_ASSERT_FATAL(crypto->crypto_key_factory != NULL);
+  CU_ASSERT_FATAL(crypto->crypto_key_factory->register_matched_remote_datareader != NULL);
+  register_local_regular();
+
+  /*set writer protection kind */
+  writer_crypto = (local_datawriter_crypto *)local_writer_handle;
+  writer_crypto->metadata_protectionKind = DDS_SECURITY_PROTECTION_KIND_ENCRYPT_WITH_ORIGIN_AUTHENTICATION;
+  writer_crypto = (local_datawriter_crypto *)local_writer_handle;
+
+  /* Now call the function. */
+  result = crypto->crypto_key_factory->register_matched_remote_datareader(
+      crypto->crypto_key_factory,
+      local_writer_handle,
+      remote_participant_crypto_handle,
+      shared_secret_handle,
+      true,
+      &exception);
+
+  if (exception.code != 0)
+    printf("register_remote_datareader: %s\n", exception.message ? exception.message : "Error message missing");
+
+  /* A valid handle to be returned */
+  CU_ASSERT(result != 0);
+  CU_ASSERT(exception.code == DDS_SECURITY_ERR_OK_CODE);
+
+  /* NOTE: It would be better to check if the keys have been generated but there is no interface to get them from handle */
+  reader_crypto = (remote_datareader_crypto *)result;
+  CU_ASSERT_FATAL(reader_crypto->writer2reader_key_material_message != NULL);
+  CU_ASSERT_FATAL(reader_crypto->writer2reader_key_material_payload != NULL);
+  CU_ASSERT(master_salt_not_empty(reader_crypto->writer2reader_key_material_message));
+  CU_ASSERT(master_key_not_empty(reader_crypto->writer2reader_key_material_message));
+  CU_ASSERT(master_salt_not_empty(reader_crypto->writer2reader_key_material_payload));
+  CU_ASSERT(master_key_not_empty(reader_crypto->writer2reader_key_material_payload));
+  CU_ASSERT_FATAL(reader_crypto->metadata_protectionKind == DDS_SECURITY_PROTECTION_KIND_ENCRYPT_WITH_ORIGIN_AUTHENTICATION);
+  reset_exception(&exception);
+
+  /* test to unregister with local writer*/
+  unregister_result = crypto->crypto_key_factory->unregister_datawriter(crypto->crypto_key_factory, local_writer_handle, &exception);
+  CU_ASSERT_FATAL(unregister_result);
+
+  unregister_result = crypto->crypto_key_factory->unregister_datawriter(crypto->crypto_key_factory, result, &exception);
+  CU_ASSERT_FATAL(!unregister_result);
+
+  reset_exception(&exception);
+}
+
+/* test invalid parameter*/
+CU_Test(ddssec_builtin_register_remote_datareader, invalid_participant, .init = suite_register_matched_remote_datareader_init, .fini = suite_register_matched_remote_datareader_fini)
+{
+  DDS_Security_DatawriterCryptoHandle result;
+
+  /* Dummy (even un-initialized) data for now. */
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+
+  /* Check if we actually have the function. */
+  CU_ASSERT_FATAL(crypto != NULL);
+  CU_ASSERT_FATAL(crypto->crypto_key_factory != NULL);
+  CU_ASSERT_FATAL(crypto->crypto_key_factory->register_matched_remote_datareader != NULL);
+
+  register_local_regular();
+
+  /* Now call the function. */
+  result = crypto->crypto_key_factory->register_matched_remote_datareader(
+      crypto->crypto_key_factory,
+      local_writer_handle,
+      0,
+      shared_secret_handle,
+      true,
+      &exception);
+
+  /* A valid handle to be returned */
+  CU_ASSERT_FATAL(result == 0);
+  CU_ASSERT_FATAL(exception.code == DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_CODE);
+  reset_exception(&exception);
+}
+
+/* test invalid parameter*/
+CU_Test(ddssec_builtin_register_remote_datareader, invalid_writer_properties, .init = suite_register_matched_remote_datareader_init, .fini = suite_register_matched_remote_datareader_fini)
+{
+  DDS_Security_DatawriterCryptoHandle result;
+
+  /* Dummy (even un-initialized) data for now. */
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+
+  /* Check if we actually have the function. */
+  CU_ASSERT_FATAL(crypto != NULL);
+  CU_ASSERT_FATAL(crypto->crypto_key_factory != NULL);
+  CU_ASSERT_FATAL(crypto->crypto_key_factory->register_matched_remote_datareader != NULL);
+  register_local_regular();
+
+  /* Now call the function. */
+  result = crypto->crypto_key_factory->register_matched_remote_datareader(
+      crypto->crypto_key_factory,
+      0,
+      remote_participant_crypto_handle,
+      shared_secret_handle,
+      true,
+      &exception);
+
+  /* A valid handle to be returned */
+  CU_ASSERT_FATAL(result == 0);
+  CU_ASSERT_FATAL(exception.code == DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_CODE);
+  reset_exception(&exception);
+}
diff --git a/src/security/builtin_plugins/tests/register_matched_remote_datawriter/src/register_matched_remote_datawriter_utests.c b/src/security/builtin_plugins/tests/register_matched_remote_datawriter/src/register_matched_remote_datawriter_utests.c
new file mode 100644
index 0000000..635c018
--- /dev/null
+++ b/src/security/builtin_plugins/tests/register_matched_remote_datawriter/src/register_matched_remote_datawriter_utests.c
@@ -0,0 +1,376 @@
+/*
+ * Copyright(c) 2006 to 2019 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+#include <openssl/evp.h>
+#include <openssl/hmac.h>
+#include <openssl/bio.h>
+#include <openssl/err.h>
+
+#include "dds/ddsrt/heap.h"
+#include "dds/ddsrt/string.h"
+#include "dds/ddsrt/types.h"
+#include "dds/ddsrt/environ.h"
+#include "dds/security/dds_security_api.h"
+#include "dds/security/core/dds_security_serialize.h"
+#include "dds/security/core/dds_security_utils.h"
+#include "dds/security/core/shared_secret.h"
+#include "CUnit/CUnit.h"
+#include "CUnit/Test.h"
+#include "common/src/loader.h"
+#include "common/src/crypto_helper.h"
+#include "crypto_objects.h"
+
+#if OPENSLL_VERSION_NUMBER >= 0x10002000L
+#define AUTH_INCLUDE_EC
+#endif
+
+#define TEST_SHARED_SECRET_SIZE 32
+
+static struct plugins_hdl *plugins = NULL;
+static DDS_Security_SharedSecretHandle shared_secret_handle = DDS_SECURITY_HANDLE_NIL;
+static dds_security_cryptography *crypto = NULL;
+static DDS_Security_ParticipantCryptoHandle local_participant_crypto_handle = DDS_SECURITY_HANDLE_NIL;
+static DDS_Security_ParticipantCryptoHandle remote_participant_crypto_handle = DDS_SECURITY_HANDLE_NIL;
+static DDS_Security_DatareaderCryptoHandle local_reader_handle = DDS_SECURITY_HANDLE_NIL;
+
+static void prepare_participant_security_attributes(DDS_Security_ParticipantSecurityAttributes *attributes)
+{
+  memset(attributes, 0, sizeof(DDS_Security_ParticipantSecurityAttributes));
+  attributes->allow_unauthenticated_participants = false;
+  attributes->is_access_protected = false;
+  attributes->is_discovery_protected = false;
+  attributes->is_liveliness_protected = false;
+  attributes->is_rtps_protected = true;
+  attributes->plugin_participant_attributes = DDS_SECURITY_PARTICIPANT_ATTRIBUTES_FLAG_IS_VALID;
+  attributes->plugin_participant_attributes |= DDS_SECURITY_PLUGIN_PARTICIPANT_ATTRIBUTES_FLAG_IS_RTPS_ENCRYPTED;
+}
+
+static void prepare_endpoint_security_attributes(DDS_Security_EndpointSecurityAttributes *attributes)
+{
+  memset(attributes, 0, sizeof(DDS_Security_EndpointSecurityAttributes));
+  attributes->is_discovery_protected = true;
+  attributes->is_submessage_protected = true;
+
+  attributes->plugin_endpoint_attributes |= DDS_SECURITY_PLUGIN_ENDPOINT_ATTRIBUTES_FLAG_IS_SUBMESSAGE_ENCRYPTED;
+}
+
+static void register_local_regular()
+{
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  DDS_Security_PropertySeq datareader_properties;
+  DDS_Security_EndpointSecurityAttributes datareader_security_attributes;
+
+  memset(&datareader_properties, 0, sizeof(datareader_properties));
+
+  prepare_endpoint_security_attributes(&datareader_security_attributes);
+
+  /* Now call the function. */
+
+  local_reader_handle = crypto->crypto_key_factory->register_local_datareader(
+      crypto->crypto_key_factory,
+      local_participant_crypto_handle,
+      &datareader_properties,
+      &datareader_security_attributes,
+      &exception);
+}
+
+static void suite_register_matched_remote_datawriter_init(void)
+{
+  DDS_Security_IdentityHandle participant_identity = 5; //valid dummy value
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  DDS_Security_PropertySeq participant_properties;
+  DDS_Security_PermissionsHandle remote_participant_permissions = 5; //valid dummy value
+  DDS_Security_SharedSecretHandleImpl *shared_secret_handle_impl;
+  DDS_Security_PermissionsHandle participant_permissions = 3; //valid dummy value
+  DDS_Security_ParticipantSecurityAttributes participant_security_attributes;
+
+  CU_ASSERT_FATAL ((plugins = load_plugins(
+                      NULL    /* Access Control */,
+                      NULL    /* Authentication */,
+                      &crypto /* Cryptograpy    */)) != NULL);
+
+  /* prepare test shared secret handle */
+  shared_secret_handle_impl = ddsrt_malloc(sizeof(DDS_Security_SharedSecretHandleImpl));
+  shared_secret_handle_impl->shared_secret = ddsrt_malloc(TEST_SHARED_SECRET_SIZE * sizeof(DDS_Security_octet));
+  shared_secret_handle_impl->shared_secret_size = TEST_SHARED_SECRET_SIZE;
+  for (int i = 0; i < shared_secret_handle_impl->shared_secret_size; i++)
+  {
+    shared_secret_handle_impl->shared_secret[i] = (unsigned char)(i % 20);
+  }
+  for (int i = 0; i < 32; i++)
+  {
+    shared_secret_handle_impl->challenge1[i] = (unsigned char)(i % 15);
+    shared_secret_handle_impl->challenge2[i] = (unsigned char)(i % 12);
+  }
+  shared_secret_handle = (DDS_Security_SharedSecretHandle)shared_secret_handle_impl;
+
+  /* Check if we actually have the validate_local_identity() function. */
+  CU_ASSERT_FATAL (crypto != NULL && crypto->crypto_key_factory != NULL && crypto->crypto_key_factory->register_local_participant != NULL)
+  memset(&exception, 0, sizeof(DDS_Security_SecurityException));
+  memset(&participant_properties, 0, sizeof(participant_properties));
+
+  prepare_participant_security_attributes(&participant_security_attributes);
+  local_participant_crypto_handle = crypto->crypto_key_factory->register_local_participant(
+      crypto->crypto_key_factory,
+      participant_identity,
+      participant_permissions,
+      &participant_properties,
+      &participant_security_attributes,
+      &exception);
+
+  CU_ASSERT_FATAL (local_participant_crypto_handle != DDS_SECURITY_HANDLE_NIL);
+
+  /* Now call the function. */
+  remote_participant_crypto_handle = crypto->crypto_key_factory->register_matched_remote_participant(
+      crypto->crypto_key_factory,
+      local_participant_crypto_handle,
+      participant_identity,
+      remote_participant_permissions,
+      shared_secret_handle,
+      &exception);
+
+  CU_ASSERT_FATAL (remote_participant_crypto_handle != DDS_SECURITY_HANDLE_NIL);
+}
+
+static void suite_register_matched_remote_datawriter_fini(void)
+{
+  DDS_Security_SharedSecretHandleImpl *shared_secret_handle_impl = (DDS_Security_SharedSecretHandleImpl *)shared_secret_handle;
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+
+  CU_ASSERT_EQUAL_FATAL (crypto->crypto_key_factory->unregister_participant(
+      crypto->crypto_key_factory,
+      remote_participant_crypto_handle,
+      &exception), true);
+
+  CU_ASSERT_EQUAL_FATAL (crypto->crypto_key_factory->unregister_participant(
+      crypto->crypto_key_factory,
+      local_participant_crypto_handle,
+      &exception), true);
+
+  unload_plugins(plugins);
+  ddsrt_free(shared_secret_handle_impl->shared_secret);
+  ddsrt_free(shared_secret_handle_impl);
+  shared_secret_handle = DDS_SECURITY_HANDLE_NIL;
+  crypto = NULL;
+  local_participant_crypto_handle = DDS_SECURITY_HANDLE_NIL;
+  remote_participant_crypto_handle = DDS_SECURITY_HANDLE_NIL;
+}
+
+static void reset_exception(DDS_Security_SecurityException *ex)
+{
+  ex->code = 0;
+  ex->minor_code = 0;
+  ddsrt_free(ex->message);
+  ex->message = NULL;
+}
+
+
+CU_Test(ddssec_builtin_register_remote_datawriter, happy_day, .init = suite_register_matched_remote_datawriter_init, .fini = suite_register_matched_remote_datawriter_fini)
+{
+  DDS_Security_DatareaderCryptoHandle result;
+  bool unregister_result = false;
+
+  /* Dummy (even un-initialized) data for now. */
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  remote_datawriter_crypto *writer_crypto;
+
+  /* Check if we actually have the function. */
+  CU_ASSERT_FATAL(crypto != NULL);
+  CU_ASSERT_FATAL(crypto->crypto_key_factory != NULL);
+  CU_ASSERT_FATAL(crypto->crypto_key_factory->register_matched_remote_datawriter != NULL);
+  register_local_regular();
+
+  /* Now call the function. */
+  result = crypto->crypto_key_factory->register_matched_remote_datawriter(
+      crypto->crypto_key_factory,
+      local_reader_handle,
+      remote_participant_crypto_handle,
+      shared_secret_handle,
+      &exception);
+
+  /* A valid handle to be returned */
+  CU_ASSERT_FATAL(result != 0);
+  CU_ASSERT_FATAL(exception.code == DDS_SECURITY_ERR_OK_CODE);
+
+  /* NOTE: It would be better to check if the keys have been generated but there is no interface to get them from handle */
+  writer_crypto = (remote_datawriter_crypto *)result;
+  CU_ASSERT_FATAL(writer_crypto->reader2writer_key_material != NULL);
+  CU_ASSERT(master_salt_not_empty(writer_crypto->reader2writer_key_material));
+  CU_ASSERT(master_key_not_empty(writer_crypto->reader2writer_key_material));
+  CU_ASSERT_FATAL(writer_crypto->reader2writer_key_material->receiver_specific_key_id == 0);
+  reset_exception(&exception);
+
+  unregister_result = crypto->crypto_key_factory->unregister_datawriter(crypto->crypto_key_factory, result, &exception);
+  CU_ASSERT_FATAL(unregister_result);
+}
+
+/* test if function returns volatile secure writer crypto if the reader is volatile secure*/
+CU_Test(ddssec_builtin_register_remote_datawriter, volatile_secure, .init = suite_register_matched_remote_datawriter_init, .fini = suite_register_matched_remote_datawriter_fini)
+{
+  DDS_Security_DatareaderCryptoHandle result;
+  DDS_Security_DatareaderCryptoHandle local_volatile_secure_reader;
+  DDS_Security_PropertySeq datareader_properties;
+  DDS_Security_EndpointSecurityAttributes datareader_security_attributes;
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+
+  /* Check if we actually have the function. */
+  CU_ASSERT_FATAL(crypto != NULL);
+  CU_ASSERT_FATAL(crypto->crypto_key_factory != NULL);
+  CU_ASSERT_FATAL(crypto->crypto_key_factory->register_matched_remote_datawriter != NULL);
+
+  datareader_properties._length = datareader_properties._maximum = 1;
+  datareader_properties._buffer = DDS_Security_PropertySeq_allocbuf(1);
+  datareader_properties._buffer[0].name = ddsrt_strdup("dds.sec.builtin_endpoint_name");
+  datareader_properties._buffer[0].value = ddsrt_strdup("BuiltinParticipantVolatileMessageSecureReader");
+  datareader_properties._buffer[0].propagate = false;
+  memset(&datareader_security_attributes, 0, sizeof(datareader_security_attributes));
+
+  datareader_security_attributes.is_discovery_protected = true;
+  datareader_security_attributes.is_submessage_protected = true;
+
+  local_volatile_secure_reader =
+      crypto->crypto_key_factory->register_local_datareader(
+          crypto->crypto_key_factory,
+          local_participant_crypto_handle,
+          &datareader_properties,
+          &datareader_security_attributes,
+          &exception);
+
+  /* Now call the function. */
+  result = crypto->crypto_key_factory->register_matched_remote_datawriter(
+      crypto->crypto_key_factory,
+      local_volatile_secure_reader,
+      remote_participant_crypto_handle,
+      shared_secret_handle,
+      &exception);
+
+  /* A valid handle to be returned */
+  CU_ASSERT_FATAL(result != 0);
+  CU_ASSERT_FATAL(((remote_datawriter_crypto *)result)->is_builtin_participant_volatile_message_secure_writer);
+  CU_ASSERT_FATAL(exception.code == DDS_SECURITY_ERR_OK_CODE);
+  reset_exception(&exception);
+
+  crypto->crypto_key_factory->unregister_datawriter(crypto->crypto_key_factory, result, &exception);
+  crypto->crypto_key_factory->unregister_datareader(crypto->crypto_key_factory, local_volatile_secure_reader, &exception);
+  DDS_Security_PropertySeq_deinit(&datareader_properties);
+}
+
+CU_Test(ddssec_builtin_register_remote_datawriter, with_origin_authentication, .init = suite_register_matched_remote_datawriter_init, .fini = suite_register_matched_remote_datawriter_fini)
+{
+  DDS_Security_DatareaderCryptoHandle result;
+  bool unregister_result = false;
+  local_datareader_crypto *reader_crypto;
+
+  /* Dummy (even un-initialized) data for now. */
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  remote_datawriter_crypto *writer_crypto;
+
+  /* Check if we actually have the function. */
+  CU_ASSERT_FATAL(crypto != NULL);
+  CU_ASSERT_FATAL(crypto->crypto_key_factory != NULL);
+  CU_ASSERT_FATAL(crypto->crypto_key_factory->register_matched_remote_datawriter != NULL);
+  register_local_regular();
+
+  /*set reader protection kind */
+  reader_crypto = (local_datareader_crypto *)local_reader_handle;
+  reader_crypto->metadata_protectionKind = DDS_SECURITY_PROTECTION_KIND_ENCRYPT_WITH_ORIGIN_AUTHENTICATION;
+  reader_crypto = (local_datareader_crypto *)local_reader_handle;
+  /* Now call the function. */
+
+  result = crypto->crypto_key_factory->register_matched_remote_datawriter(
+      crypto->crypto_key_factory,
+      local_reader_handle,
+      remote_participant_crypto_handle,
+      shared_secret_handle,
+      &exception);
+
+  if (exception.code != 0)
+    printf("register_remote_datawriter: %s\n", exception.message ? exception.message : "Error message missing");
+
+  /* A valid handle to be returned */
+  CU_ASSERT(result != 0);
+  CU_ASSERT(exception.code == DDS_SECURITY_ERR_OK_CODE);
+
+  /* NOTE: It would be better to check if the keys have been generated but there is no interface to get them from handle */
+  writer_crypto = (remote_datawriter_crypto *)result;
+  CU_ASSERT_FATAL(writer_crypto->reader2writer_key_material != NULL);
+  CU_ASSERT(master_salt_not_empty(writer_crypto->reader2writer_key_material));
+  CU_ASSERT(master_key_not_empty(writer_crypto->reader2writer_key_material));
+  CU_ASSERT_FATAL(writer_crypto->reader2writer_key_material->receiver_specific_key_id != 0);
+  CU_ASSERT(master_receiver_specific_key_not_empty(writer_crypto->reader2writer_key_material));
+  reset_exception(&exception);
+
+  /*test unregister the local pair*/
+  unregister_result = crypto->crypto_key_factory->unregister_datareader(crypto->crypto_key_factory, local_reader_handle, &exception);
+  CU_ASSERT_FATAL(unregister_result);
+
+  /* unregister remote should give error*/
+  unregister_result = crypto->crypto_key_factory->unregister_datareader(crypto->crypto_key_factory, result, &exception);
+  CU_ASSERT_FATAL(!unregister_result);
+  reset_exception(&exception);
+}
+
+/* test invalid parameter*/
+CU_Test(ddssec_builtin_register_remote_datawriter, invalid_participant, .init = suite_register_matched_remote_datawriter_init, .fini = suite_register_matched_remote_datawriter_fini)
+{
+  DDS_Security_DatareaderCryptoHandle result;
+
+  /* Dummy (even un-initialized) data for now. */
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+
+  /* Check if we actually have the function. */
+  CU_ASSERT_FATAL(crypto != NULL);
+  CU_ASSERT_FATAL(crypto->crypto_key_factory != NULL);
+  CU_ASSERT_FATAL(crypto->crypto_key_factory->register_matched_remote_datawriter != NULL);
+  register_local_regular();
+
+  /* Now call the function. */
+  result = crypto->crypto_key_factory->register_matched_remote_datawriter(
+      crypto->crypto_key_factory,
+      local_reader_handle,
+      0,
+      shared_secret_handle,
+      &exception);
+
+  /* A valid handle to be returned */
+  CU_ASSERT_FATAL(result == 0);
+  CU_ASSERT_FATAL(exception.code == DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_CODE);
+  reset_exception(&exception);
+}
+
+/* test invalid parameter */
+CU_Test(ddssec_builtin_register_remote_datawriter, invalid_writer_properties, .init = suite_register_matched_remote_datawriter_init, .fini = suite_register_matched_remote_datawriter_fini)
+{
+  DDS_Security_DatareaderCryptoHandle result;
+
+  /* Dummy (even un-initialized) data for now. */
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+
+  /* Check if we actually have the function. */
+  CU_ASSERT_FATAL(crypto != NULL);
+  CU_ASSERT_FATAL(crypto->crypto_key_factory != NULL);
+  CU_ASSERT_FATAL(crypto->crypto_key_factory->register_matched_remote_datawriter != NULL);
+  register_local_regular();
+
+  /* Now call the function. */
+  result = crypto->crypto_key_factory->register_matched_remote_datawriter(
+      crypto->crypto_key_factory,
+      0,
+      remote_participant_crypto_handle,
+      shared_secret_handle,
+      &exception);
+
+  /* A valid handle to be returned */
+  CU_ASSERT_FATAL(result == 0);
+  CU_ASSERT_FATAL(exception.code == DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_CODE);
+  reset_exception(&exception);
+}
+
diff --git a/src/security/builtin_plugins/tests/register_matched_remote_participant/src/register_matched_remote_participant_utests.c b/src/security/builtin_plugins/tests/register_matched_remote_participant/src/register_matched_remote_participant_utests.c
new file mode 100644
index 0000000..2402697
--- /dev/null
+++ b/src/security/builtin_plugins/tests/register_matched_remote_participant/src/register_matched_remote_participant_utests.c
@@ -0,0 +1,229 @@
+/*
+ * Copyright(c) 2006 to 2019 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+#include <openssl/evp.h>
+#include <openssl/hmac.h>
+#include <openssl/bio.h>
+#include <openssl/err.h>
+
+#include "dds/ddsrt/heap.h"
+#include "dds/ddsrt/string.h"
+#include "dds/ddsrt/types.h"
+#include "dds/ddsrt/environ.h"
+#include "dds/security/dds_security_api.h"
+#include "dds/security/core/dds_security_serialize.h"
+#include "dds/security/core/dds_security_utils.h"
+#include "dds/security/core/shared_secret.h"
+#include "CUnit/CUnit.h"
+#include "CUnit/Test.h"
+#include "common/src/loader.h"
+#include "crypto_objects.h"
+
+#if OPENSLL_VERSION_NUMBER >= 0x10002000L
+#define AUTH_INCLUDE_EC
+#endif
+
+#define TEST_SHARED_SECRET_SIZE 32
+
+static struct plugins_hdl *plugins = NULL;
+static dds_security_cryptography *crypto = NULL;
+
+static void suite_register_matched_remote_participant_init(void)
+{
+    CU_ASSERT_FATAL ((plugins = load_plugins(
+                        NULL      /* Access Control */,
+                        NULL      /* Authentication */,
+                        &crypto   /* Cryptograpy    */)) != NULL);
+}
+
+static void suite_register_matched_remote_participant_fini(void)
+{
+  unload_plugins(plugins);
+}
+
+static void reset_exception(DDS_Security_SecurityException *ex)
+{
+  ex->code = 0;
+  ex->minor_code = 0;
+  ddsrt_free(ex->message);
+  ex->message = NULL;
+}
+
+static void prepare_participant_security_attributes(DDS_Security_ParticipantSecurityAttributes *attributes)
+{
+  memset(attributes, 0, sizeof(DDS_Security_ParticipantSecurityAttributes));
+  attributes->allow_unauthenticated_participants = false;
+  attributes->is_access_protected = false;
+  attributes->is_discovery_protected = false;
+  attributes->is_liveliness_protected = false;
+  attributes->is_rtps_protected = true;
+  attributes->plugin_participant_attributes = DDS_SECURITY_PARTICIPANT_ATTRIBUTES_FLAG_IS_VALID;
+  attributes->plugin_participant_attributes |= DDS_SECURITY_PLUGIN_PARTICIPANT_ATTRIBUTES_FLAG_IS_RTPS_ENCRYPTED;
+}
+
+CU_Test(ddssec_builtin_register_remote_participant, happy_day, .init = suite_register_matched_remote_participant_init, .fini = suite_register_matched_remote_participant_fini)
+{
+  DDS_Security_ParticipantCryptoHandle local_crypto_handle;
+  DDS_Security_ParticipantCryptoHandle remote_crypto_handle;
+
+  /* Dummy (even un-initialized) data for now. */
+  DDS_Security_IdentityHandle participant_identity = 5; //valid dummy value
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  DDS_Security_PropertySeq participant_properties;
+  DDS_Security_PermissionsHandle remote_participant_permissions = 5; /*valid dummy value */
+  DDS_Security_SharedSecretHandle shared_secret_handle;
+  DDS_Security_SharedSecretHandleImpl *shared_secret_handle_impl;
+  DDS_Security_PermissionsHandle participant_permissions = 2; /*valid but dummy value */
+  DDS_Security_ParticipantSecurityAttributes participant_security_attributes;
+
+  /* prepare test shared secret handle */
+  shared_secret_handle_impl = ddsrt_malloc(sizeof(DDS_Security_SharedSecretHandleImpl));
+  shared_secret_handle_impl->shared_secret = ddsrt_malloc(TEST_SHARED_SECRET_SIZE * sizeof(DDS_Security_octet));
+  shared_secret_handle_impl->shared_secret_size = TEST_SHARED_SECRET_SIZE;
+  for (int i = 0; i < shared_secret_handle_impl->shared_secret_size; i++)
+  {
+    shared_secret_handle_impl->shared_secret[i] = (unsigned char)(i % 20);
+  }
+  for (int i = 0; i < 32; i++)
+  {
+    shared_secret_handle_impl->challenge1[i] = (unsigned char)(i % 15);
+    shared_secret_handle_impl->challenge2[i] = (unsigned char)(i % 12);
+  }
+  shared_secret_handle = (DDS_Security_SharedSecretHandle)shared_secret_handle_impl;
+
+  /* Check if we actually have the validate_local_identity() function. */
+  CU_ASSERT_FATAL(crypto != NULL);
+  CU_ASSERT_FATAL(crypto->crypto_key_factory != NULL);
+  CU_ASSERT_FATAL(crypto->crypto_key_factory->register_local_participant != NULL);
+
+  memset(&exception, 0, sizeof(DDS_Security_SecurityException));
+  memset(&participant_properties, 0, sizeof(participant_properties));
+
+  prepare_participant_security_attributes(&participant_security_attributes);
+  local_crypto_handle = crypto->crypto_key_factory->register_local_participant(
+      crypto->crypto_key_factory,
+      participant_identity,
+      participant_permissions,
+      &participant_properties,
+      &participant_security_attributes,
+      &exception);
+
+  CU_ASSERT_FATAL(local_crypto_handle != DDS_SECURITY_HANDLE_NIL);
+
+  /* Now call the function. */
+  remote_crypto_handle = crypto->crypto_key_factory->register_matched_remote_participant(
+      crypto->crypto_key_factory,
+      local_crypto_handle,
+      participant_identity,
+      remote_participant_permissions,
+      shared_secret_handle,
+      &exception);
+
+  if (exception.code != 0)
+    printf("register_matched_remote_participant: %s\n", exception.message ? exception.message : "Error message missing");
+
+  /* A valid handle to be returned */
+  CU_ASSERT(remote_crypto_handle != DDS_SECURITY_HANDLE_NIL);
+  CU_ASSERT(exception.code == DDS_SECURITY_ERR_OK_CODE);
+  reset_exception(&exception);
+
+  (void)crypto->crypto_key_factory->unregister_participant(
+      crypto->crypto_key_factory,
+      remote_crypto_handle,
+      &exception);
+  reset_exception(&exception);
+
+  (void)crypto->crypto_key_factory->unregister_participant(
+      crypto->crypto_key_factory,
+      local_crypto_handle,
+      &exception);
+  reset_exception(&exception);
+
+  ddsrt_free(shared_secret_handle_impl->shared_secret);
+  ddsrt_free(shared_secret_handle_impl);
+}
+
+CU_Test(ddssec_builtin_register_remote_participant, empty_identity, .init = suite_register_matched_remote_participant_init, .fini = suite_register_matched_remote_participant_fini)
+{
+  DDS_Security_ParticipantCryptoHandle local_crypto_handle;
+  DDS_Security_ParticipantCryptoHandle remote_crypto_handle;
+
+  /* Dummy (even un-initialized) data for now. */
+  DDS_Security_IdentityHandle participant_identity = 5;              //empty identity
+  DDS_Security_IdentityHandle remote_participant_identity_empty = 0; //empty identity
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+
+  DDS_Security_PermissionsHandle participant_permissions = 2; /*valid but dummy value */
+  DDS_Security_PropertySeq participant_properties;
+  DDS_Security_ParticipantSecurityAttributes participant_security_attributes;
+  DDS_Security_SharedSecretHandle shared_secret_handle;
+  DDS_Security_SharedSecretHandleImpl *shared_secret_handle_impl;
+  DDS_Security_PermissionsHandle remote_participant_permissions = 5; //valid dummy value
+
+  shared_secret_handle_impl = ddsrt_malloc(sizeof(DDS_Security_SharedSecretHandleImpl));
+  shared_secret_handle_impl->shared_secret = ddsrt_malloc(TEST_SHARED_SECRET_SIZE * sizeof(DDS_Security_octet));
+  shared_secret_handle_impl->shared_secret_size = TEST_SHARED_SECRET_SIZE;
+  for (int i = 0; i < shared_secret_handle_impl->shared_secret_size; i++)
+  {
+    shared_secret_handle_impl->shared_secret[i] = (unsigned char)(i % 20);
+  }
+  for (int i = 0; i < 32; i++)
+  {
+    shared_secret_handle_impl->challenge1[i] = (unsigned char)(i % 15);
+    shared_secret_handle_impl->challenge2[i] = (unsigned char)(i % 12);
+  }
+  shared_secret_handle = (DDS_Security_SharedSecretHandle)shared_secret_handle_impl;
+
+  /* Check if we actually have the validate_local_identity() function. */
+  CU_ASSERT_FATAL(crypto != NULL);
+  CU_ASSERT_FATAL(crypto->crypto_key_factory != NULL);
+  CU_ASSERT_FATAL(crypto->crypto_key_factory->register_local_participant != NULL);
+
+  memset(&exception, 0, sizeof(DDS_Security_SecurityException));
+  memset(&participant_properties, 0, sizeof(participant_properties));
+
+  prepare_participant_security_attributes(&participant_security_attributes);
+
+  /* Now call the function. */
+  local_crypto_handle = crypto->crypto_key_factory->register_local_participant(
+      crypto->crypto_key_factory,
+      participant_identity,
+      participant_permissions,
+      &participant_properties,
+      &participant_security_attributes,
+      &exception);
+
+  remote_crypto_handle = crypto->crypto_key_factory->register_matched_remote_participant(
+      crypto->crypto_key_factory,
+      local_crypto_handle,
+      remote_participant_identity_empty,
+      remote_participant_permissions,
+      shared_secret_handle,
+      &exception);
+
+  if (exception.code != 0)
+    printf("register_matched_remote_participant: %s\n", exception.message ? exception.message : "Error message missing");
+
+  CU_ASSERT(remote_crypto_handle == DDS_SECURITY_HANDLE_NIL);
+  CU_ASSERT(exception.code == DDS_SECURITY_ERR_IDENTITY_EMPTY_CODE);
+  CU_ASSERT(!strcmp(exception.message, DDS_SECURITY_ERR_IDENTITY_EMPTY_MESSAGE));
+  reset_exception(&exception);
+
+  (void)crypto->crypto_key_factory->unregister_participant(
+      crypto->crypto_key_factory,
+      local_crypto_handle,
+      &exception);
+  reset_exception(&exception);
+
+  ddsrt_free(shared_secret_handle_impl->shared_secret);
+  ddsrt_free(shared_secret_handle_impl);
+}
+
diff --git a/src/security/builtin_plugins/tests/set_remote_datareader_crypto_tokens/src/set_remote_datareader_crypto_tokens_utests.c b/src/security/builtin_plugins/tests/set_remote_datareader_crypto_tokens/src/set_remote_datareader_crypto_tokens_utests.c
new file mode 100644
index 0000000..c8297bb
--- /dev/null
+++ b/src/security/builtin_plugins/tests/set_remote_datareader_crypto_tokens/src/set_remote_datareader_crypto_tokens_utests.c
@@ -0,0 +1,980 @@
+/*
+ * Copyright(c) 2006 to 2019 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+#include <openssl/evp.h>
+#include <openssl/hmac.h>
+#include <openssl/bio.h>
+#include <openssl/err.h>
+
+#include "dds/ddsrt/heap.h"
+#include "dds/ddsrt/string.h"
+#include "dds/ddsrt/types.h"
+#include "dds/ddsrt/environ.h"
+#include "dds/security/dds_security_api.h"
+#include "dds/security/core/dds_security_serialize.h"
+#include "dds/security/core/dds_security_utils.h"
+#include "dds/security/core/shared_secret.h"
+#include "CUnit/CUnit.h"
+#include "CUnit/Test.h"
+#include "common/src/loader.h"
+#include "crypto_objects.h"
+
+#define TEST_SHARED_SECRET_SIZE 32
+#define CRYPTO_TRANSFORM_KIND(k) (*(uint32_t *)&((k)[0]))
+#define CRYPTO_TRANSFORM_ID(k) (*(uint32_t *)&((k)[0]))
+
+static const char *CRYPTO_TOKEN_CLASS_ID = "DDS:Crypto:AES_GCM_GMAC";
+static const char *CRYPTO_TOKEN_PROPERTY_NAME = "dds.cryp.keymat";
+
+static struct plugins_hdl *plugins = NULL;
+static dds_security_cryptography *crypto = NULL;
+
+static DDS_Security_IdentityHandle local_participant_identity = 1;
+static DDS_Security_IdentityHandle remote_participant_identity = 2;
+
+static DDS_Security_ParticipantCryptoHandle local_particpant_crypto = 0;
+static DDS_Security_ParticipantCryptoHandle remote_particpant_crypto = 0;
+static DDS_Security_DatawriterCryptoHandle remote_reader_crypto = 0;
+static DDS_Security_DatareaderCryptoHandle local_writer_crypto = 0;
+
+static DDS_Security_SharedSecretHandleImpl *shared_secret_handle_impl = NULL;
+static DDS_Security_SharedSecretHandle shared_secret_handle;
+
+static void allocate_shared_secret(void)
+{
+  shared_secret_handle_impl = ddsrt_malloc(sizeof(DDS_Security_SharedSecretHandleImpl));
+
+  shared_secret_handle_impl->shared_secret = ddsrt_malloc(TEST_SHARED_SECRET_SIZE * sizeof(unsigned char));
+  shared_secret_handle_impl->shared_secret_size = TEST_SHARED_SECRET_SIZE;
+
+  for (int i = 0; i < shared_secret_handle_impl->shared_secret_size; i++)
+  {
+    shared_secret_handle_impl->shared_secret[i] = (unsigned char)(i % 20);
+  }
+  for (int i = 0; i < 32; i++)
+  {
+    shared_secret_handle_impl->challenge1[i] = (unsigned char)(i % 15);
+    shared_secret_handle_impl->challenge2[i] = (unsigned char)(i % 12);
+  }
+
+  shared_secret_handle = (DDS_Security_SharedSecretHandle)shared_secret_handle_impl;
+}
+
+static void
+deallocate_shared_secret(void)
+{
+  ddsrt_free(shared_secret_handle_impl->shared_secret);
+  ddsrt_free(shared_secret_handle_impl);
+}
+
+static void prepare_participant_security_attributes(DDS_Security_ParticipantSecurityAttributes *attributes)
+{
+  memset(attributes, 0, sizeof(DDS_Security_ParticipantSecurityAttributes));
+  attributes->allow_unauthenticated_participants = false;
+  attributes->is_access_protected = false;
+  attributes->is_discovery_protected = false;
+  attributes->is_liveliness_protected = false;
+  attributes->is_rtps_protected = true;
+  attributes->plugin_participant_attributes = DDS_SECURITY_PARTICIPANT_ATTRIBUTES_FLAG_IS_VALID;
+  attributes->plugin_participant_attributes |= DDS_SECURITY_PLUGIN_PARTICIPANT_ATTRIBUTES_FLAG_IS_RTPS_ENCRYPTED;
+}
+
+static int
+register_local_participant(void)
+{
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  DDS_Security_PermissionsHandle participant_permissions = 3; //valid dummy value
+  DDS_Security_PropertySeq participant_properties;
+  DDS_Security_ParticipantSecurityAttributes participant_security_attributes;
+
+  memset(&participant_properties, 0, sizeof(participant_properties));
+  prepare_participant_security_attributes(&participant_security_attributes);
+
+  local_particpant_crypto =
+      crypto->crypto_key_factory->register_local_participant(
+          crypto->crypto_key_factory,
+          local_participant_identity,
+          participant_permissions,
+          &participant_properties,
+          &participant_security_attributes,
+          &exception);
+
+  if (local_particpant_crypto == 0)
+  {
+    printf("register_local_participant: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+
+  return local_particpant_crypto ? 0 : -1;
+}
+
+static int
+register_remote_participant(void)
+{
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  DDS_Security_PermissionsHandle remote_participant_permissions = 5;
+
+  remote_particpant_crypto =
+      crypto->crypto_key_factory->register_matched_remote_participant(
+          crypto->crypto_key_factory,
+          local_particpant_crypto,
+          remote_participant_identity,
+          remote_participant_permissions,
+          shared_secret_handle,
+          &exception);
+
+  if (remote_particpant_crypto == 0)
+  {
+    printf("register_matched_remote_participant: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+
+  return remote_particpant_crypto ? 0 : -1;
+}
+
+static int
+register_local_datawriter(void)
+{
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  DDS_Security_PropertySeq datawriter_properties;
+  DDS_Security_EndpointSecurityAttributes datawriter_security_attributes;
+
+  memset(&datawriter_properties, 0, sizeof(datawriter_properties));
+  memset(&datawriter_security_attributes, 0, sizeof(DDS_Security_EndpointSecurityAttributes));
+
+  datawriter_security_attributes.is_discovery_protected = true;
+
+  local_writer_crypto =
+      crypto->crypto_key_factory->register_local_datawriter(
+          crypto->crypto_key_factory,
+          local_particpant_crypto,
+          &datawriter_properties,
+          &datawriter_security_attributes,
+          &exception);
+
+  if (local_writer_crypto == 0)
+  {
+    printf("register_local_datawriter: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+
+  return local_writer_crypto ? 0 : -1;
+}
+
+static int
+register_remote_datareader(void)
+{
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+
+  remote_reader_crypto =
+      crypto->crypto_key_factory->register_matched_remote_datareader(
+          crypto->crypto_key_factory,
+          local_writer_crypto,
+          remote_particpant_crypto,
+          shared_secret_handle,
+          true,
+          &exception);
+
+  if (remote_reader_crypto == 0)
+  {
+    printf("register_matched_remote_datareader: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+
+  return remote_reader_crypto ? 0 : -1;
+}
+
+static void
+reset_exception(
+    DDS_Security_SecurityException *ex)
+{
+  ex->code = 0;
+  ex->minor_code = 0;
+  ddsrt_free(ex->message);
+  ex->message = NULL;
+}
+
+static void suite_set_remote_datareader_crypto_tokens_init(void)
+{
+  allocate_shared_secret();
+  CU_ASSERT_FATAL ((plugins = load_plugins(
+                      NULL    /* Access Control */,
+                      NULL    /* Authentication */,
+                      &crypto /* Cryptograpy    */)) != NULL);
+  CU_ASSERT_EQUAL_FATAL (register_local_participant(), 0);
+  CU_ASSERT_EQUAL_FATAL (register_remote_participant(), 0);
+  CU_ASSERT_EQUAL_FATAL (register_local_datawriter(), 0);
+  CU_ASSERT_EQUAL_FATAL (register_remote_datareader(), 0);
+}
+
+static void suite_set_remote_datareader_crypto_tokens_fini(void)
+{
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+
+  if (remote_reader_crypto)
+  {
+    crypto->crypto_key_factory->unregister_datareader(crypto->crypto_key_factory, remote_reader_crypto, &exception);
+    reset_exception(&exception);
+  }
+  if (local_writer_crypto)
+  {
+    crypto->crypto_key_factory->unregister_datawriter(crypto->crypto_key_factory, local_writer_crypto, &exception);
+    reset_exception(&exception);
+  }
+  if (remote_particpant_crypto)
+  {
+    crypto->crypto_key_factory->unregister_participant(crypto->crypto_key_factory, remote_particpant_crypto, &exception);
+    reset_exception(&exception);
+  }
+  if (local_particpant_crypto)
+  {
+    crypto->crypto_key_factory->unregister_datareader(crypto->crypto_key_factory, local_particpant_crypto, &exception);
+    reset_exception(&exception);
+  }
+  deallocate_shared_secret();
+  unload_plugins(plugins);
+}
+
+static void create_key_material(DDS_Security_OctetSeq *seq, bool include_specific_key)
+{
+  DDS_Security_KeyMaterial_AES_GCM_GMAC keymat;
+  DDS_Security_Serializer serializer;
+  unsigned char *buffer;
+  size_t length;
+
+  memset(&keymat, 0, sizeof(keymat));
+
+  keymat.transformation_kind[3] = CRYPTO_TRANSFORMATION_KIND_AES256_GCM;
+  RAND_bytes(keymat.sender_key_id, 4);
+
+  keymat.master_salt._length = keymat.master_salt._maximum = DDS_SECURITY_MASTER_SALT_SIZE_256;
+  keymat.master_salt._buffer = DDS_Security_OctetSeq_allocbuf(DDS_SECURITY_MASTER_SALT_SIZE_256);
+  RAND_bytes(keymat.master_salt._buffer, DDS_SECURITY_MASTER_SALT_SIZE_256);
+
+  keymat.master_sender_key._length = keymat.master_sender_key._maximum = DDS_SECURITY_MASTER_SENDER_KEY_SIZE_256;
+  keymat.master_sender_key._buffer = DDS_Security_OctetSeq_allocbuf(DDS_SECURITY_MASTER_SENDER_KEY_SIZE_256);
+  RAND_bytes(keymat.master_sender_key._buffer, DDS_SECURITY_MASTER_SENDER_KEY_SIZE_256);
+
+  if (include_specific_key)
+  {
+    RAND_bytes(keymat.receiver_specific_key_id, 4);
+    keymat.master_receiver_specific_key._length = keymat.master_receiver_specific_key._maximum = DDS_SECURITY_MASTER_RECEIVER_SPECIFIC_KEY_SIZE_256;
+    keymat.master_receiver_specific_key._buffer = DDS_Security_OctetSeq_allocbuf(DDS_SECURITY_MASTER_RECEIVER_SPECIFIC_KEY_SIZE_256);
+    RAND_bytes(keymat.master_receiver_specific_key._buffer, DDS_SECURITY_MASTER_RECEIVER_SPECIFIC_KEY_SIZE_256);
+  }
+
+  serializer = DDS_Security_Serializer_new(256, 256);
+  DDS_Security_Serialize_KeyMaterial_AES_GCM_GMAC(serializer, &keymat);
+  DDS_Security_Serializer_buffer(serializer, &buffer, &length);
+  DDS_Security_Serializer_free(serializer);
+
+  DDS_Security_KeyMaterial_AES_GCM_GMAC_deinit(&keymat);
+
+  seq->_length = seq->_maximum = (uint32_t)length;
+  seq->_buffer = buffer;
+}
+
+static void init_key_material(DDS_Security_KeyMaterial_AES_GCM_GMAC *keymat, bool include_specific_key)
+{
+  memset(keymat, 0, sizeof(*keymat));
+
+  keymat->transformation_kind[3] = CRYPTO_TRANSFORMATION_KIND_AES256_GCM;
+  RAND_bytes(keymat->sender_key_id, 4);
+
+  keymat->master_salt._length = keymat->master_salt._maximum = DDS_SECURITY_MASTER_SALT_SIZE_256;
+  keymat->master_salt._buffer = DDS_Security_OctetSeq_allocbuf(DDS_SECURITY_MASTER_SALT_SIZE_256);
+  RAND_bytes(keymat->master_salt._buffer, DDS_SECURITY_MASTER_SALT_SIZE_256);
+
+  keymat->master_sender_key._length = keymat->master_sender_key._maximum = DDS_SECURITY_MASTER_SENDER_KEY_SIZE_256;
+  keymat->master_sender_key._buffer = DDS_Security_OctetSeq_allocbuf(DDS_SECURITY_MASTER_SENDER_KEY_SIZE_256);
+  RAND_bytes(keymat->master_sender_key._buffer, DDS_SECURITY_MASTER_SENDER_KEY_SIZE_256);
+
+  if (include_specific_key)
+  {
+    RAND_bytes(keymat->receiver_specific_key_id, 4);
+    keymat->master_receiver_specific_key._length = keymat->master_receiver_specific_key._maximum = DDS_SECURITY_MASTER_RECEIVER_SPECIFIC_KEY_SIZE_256;
+    keymat->master_receiver_specific_key._buffer = DDS_Security_OctetSeq_allocbuf(DDS_SECURITY_MASTER_RECEIVER_SPECIFIC_KEY_SIZE_256);
+    RAND_bytes(keymat->master_receiver_specific_key._buffer, DDS_SECURITY_MASTER_RECEIVER_SPECIFIC_KEY_SIZE_256);
+  }
+}
+
+static void deinit_key_material(DDS_Security_KeyMaterial_AES_GCM_GMAC *keymat)
+{
+  ddsrt_free(keymat->master_salt._buffer);
+  ddsrt_free(keymat->master_sender_key._buffer);
+  ddsrt_free(keymat->master_receiver_specific_key._buffer);
+}
+
+static void create_reader_tokens(DDS_Security_DatawriterCryptoTokenSeq *tokens)
+{
+  tokens->_length = tokens->_maximum = 1;
+  tokens->_buffer = DDS_Security_DataHolderSeq_allocbuf(1);
+  tokens->_buffer[0].class_id = ddsrt_strdup(CRYPTO_TOKEN_CLASS_ID);
+  tokens->_buffer[0].binary_properties._length = 1;
+  tokens->_buffer[0].binary_properties._maximum = 1;
+  tokens->_buffer[0].binary_properties._buffer = DDS_Security_BinaryPropertySeq_allocbuf(1);
+  tokens->_buffer[0].binary_properties._buffer[0].name = ddsrt_strdup(CRYPTO_TOKEN_PROPERTY_NAME);
+  create_key_material(&tokens->_buffer[0].binary_properties._buffer[0].value, false);
+}
+
+static void create_reader_tokens_no_key_material(DDS_Security_DatawriterCryptoTokenSeq *tokens)
+{
+  tokens->_length = tokens->_maximum = 1;
+  tokens->_buffer = DDS_Security_DataHolderSeq_allocbuf(1);
+  tokens->_buffer[0].class_id = ddsrt_strdup(CRYPTO_TOKEN_CLASS_ID);
+  tokens->_buffer[0].binary_properties._length = 1;
+  tokens->_buffer[0].binary_properties._maximum = 1;
+  tokens->_buffer[0].binary_properties._buffer = DDS_Security_BinaryPropertySeq_allocbuf(1);
+  tokens->_buffer[0].binary_properties._buffer[0].name = ddsrt_strdup(CRYPTO_TOKEN_PROPERTY_NAME);
+}
+
+static void serialize_key_material(DDS_Security_OctetSeq *seq, DDS_Security_KeyMaterial_AES_GCM_GMAC *keymat)
+{
+  DDS_Security_Serializer serializer;
+  unsigned char *buffer;
+  size_t length;
+
+  serializer = DDS_Security_Serializer_new(256, 256);
+  DDS_Security_Serialize_KeyMaterial_AES_GCM_GMAC(serializer, keymat);
+  DDS_Security_Serializer_buffer(serializer, &buffer, &length);
+  DDS_Security_Serializer_free(serializer);
+
+  seq->_length = seq->_maximum = (uint32_t) length;
+  seq->_buffer = buffer;
+}
+
+CU_Test(ddssec_builtin_set_remote_datareader_crypto_tokens, happy_day, .init = suite_set_remote_datareader_crypto_tokens_init, .fini = suite_set_remote_datareader_crypto_tokens_fini)
+{
+  DDS_Security_boolean result;
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  DDS_Security_DatawriterCryptoTokenSeq tokens;
+
+  CU_ASSERT_FATAL(crypto != NULL);
+  CU_ASSERT_FATAL(crypto->crypto_key_exchange != NULL);
+  CU_ASSERT_FATAL(crypto->crypto_key_exchange->set_remote_datareader_crypto_tokens != NULL);
+
+  memset(&tokens, 0, sizeof(tokens));
+
+  create_reader_tokens(&tokens);
+
+  /* Now call the function. */
+  result = crypto->crypto_key_exchange->set_remote_datareader_crypto_tokens(
+      crypto->crypto_key_exchange,
+      local_writer_crypto,
+      remote_reader_crypto,
+      &tokens,
+      &exception);
+
+  if (!result)
+    printf("set_remote_datareader_crypto_tokens: %s\n", exception.message ? exception.message : "Error message missing");
+
+  DDS_Security_DataHolderSeq_deinit(&tokens);
+
+  CU_ASSERT_FATAL(result);
+  CU_ASSERT(exception.code == 0);
+  CU_ASSERT(exception.message == NULL);
+
+  reset_exception(&exception);
+}
+
+CU_Test(ddssec_builtin_set_remote_datareader_crypto_tokens, single_token, .init = suite_set_remote_datareader_crypto_tokens_init, .fini = suite_set_remote_datareader_crypto_tokens_fini)
+{
+  DDS_Security_boolean result;
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  DDS_Security_DatawriterCryptoTokenSeq tokens;
+
+  CU_ASSERT_FATAL(crypto != NULL);
+  CU_ASSERT_FATAL(crypto->crypto_key_exchange != NULL);
+  CU_ASSERT_FATAL(crypto->crypto_key_exchange->set_remote_datareader_crypto_tokens != NULL);
+  memset(&tokens, 0, sizeof(tokens));
+  create_reader_tokens(&tokens);
+
+  /* Now call the function. */
+  result = crypto->crypto_key_exchange->set_remote_datareader_crypto_tokens(
+      crypto->crypto_key_exchange,
+      local_writer_crypto,
+      remote_reader_crypto,
+      &tokens,
+      &exception);
+
+  if (!result)
+    printf("set_remote_datareader_crypto_tokens: %s\n", exception.message ? exception.message : "Error message missing");
+
+  DDS_Security_DataHolderSeq_deinit(&tokens);
+
+  CU_ASSERT_FATAL(result);
+  CU_ASSERT(exception.code == 0);
+  CU_ASSERT(exception.message == NULL);
+
+  reset_exception(&exception);
+}
+
+CU_Test(ddssec_builtin_set_remote_datareader_crypto_tokens, invalid_args, .init = suite_set_remote_datareader_crypto_tokens_init, .fini = suite_set_remote_datareader_crypto_tokens_fini)
+{
+  DDS_Security_boolean result;
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  DDS_Security_DatawriterCryptoTokenSeq tokens;
+
+  /* Check if we actually have the validate_local_identity() function. */
+  CU_ASSERT_FATAL(crypto != NULL);
+  CU_ASSERT_FATAL(crypto->crypto_key_exchange != NULL);
+  CU_ASSERT_FATAL(crypto->crypto_key_exchange->set_remote_datareader_crypto_tokens != NULL);
+
+  memset(&tokens, 0, sizeof(tokens));
+
+  create_reader_tokens(&tokens);
+
+  /* invalid token seq = NULL */
+  result = crypto->crypto_key_exchange->set_remote_datareader_crypto_tokens(
+      crypto->crypto_key_exchange,
+      local_writer_crypto,
+      remote_reader_crypto,
+      NULL,
+      &exception);
+
+  if (!result)
+    printf("set_remote_datareader_crypto_tokens: %s\n", exception.message ? exception.message : "Error message missing");
+
+  CU_ASSERT(!result);
+  CU_ASSERT(exception.code != 0);
+  CU_ASSERT(exception.message != NULL);
+
+  reset_exception(&exception);
+
+  /* invalid local_crypto_handle = DDS_SECURITY_HANDLE_NIL */
+  result = crypto->crypto_key_exchange->set_remote_datareader_crypto_tokens(
+      crypto->crypto_key_exchange,
+      0,
+      remote_reader_crypto,
+      &tokens,
+      &exception);
+
+  if (!result)
+    printf("set_remote_datareader_crypto_tokens: %s\n", exception.message ? exception.message : "Error message missing");
+
+  CU_ASSERT(!result);
+  CU_ASSERT(exception.code != 0);
+  CU_ASSERT(exception.message != NULL);
+  reset_exception(&exception);
+
+  /* invalid remote_crypto_handle = DDS_SECURITY_HANDLE_NIL */
+  result = crypto->crypto_key_exchange->set_remote_datareader_crypto_tokens(
+      crypto->crypto_key_exchange,
+      local_writer_crypto,
+      0,
+      &tokens,
+      &exception);
+
+  if (!result)
+    printf("set_remote_datareader_crypto_tokens: %s\n", exception.message ? exception.message : "Error message missing");
+
+  CU_ASSERT(!result);
+  CU_ASSERT(exception.code != 0);
+  CU_ASSERT(exception.message != NULL);
+  reset_exception(&exception);
+
+  /* invalid local_crypto_handle = 1 */
+  result = crypto->crypto_key_exchange->set_remote_datareader_crypto_tokens(
+      crypto->crypto_key_exchange,
+      1,
+      remote_reader_crypto,
+      &tokens,
+      &exception);
+
+  if (!result)
+    printf("set_remote_datawriter_crypto_tokens: %s\n", exception.message ? exception.message : "Error message missing");
+
+  CU_ASSERT(!result);
+  CU_ASSERT(exception.code != 0);
+  CU_ASSERT(exception.message != NULL);
+  reset_exception(&exception);
+
+  /* invalid remote_crypto_handle = 1 */
+  result = crypto->crypto_key_exchange->set_remote_datareader_crypto_tokens(
+      crypto->crypto_key_exchange,
+      local_writer_crypto,
+      1,
+      &tokens,
+      &exception);
+
+  if (!result)
+    printf("set_remote_datareader_crypto_tokens: %s\n", exception.message ? exception.message : "Error message missing");
+
+  CU_ASSERT(!result);
+  CU_ASSERT(exception.code != 0);
+  CU_ASSERT(exception.message != NULL);
+  reset_exception(&exception);
+
+  DDS_Security_DataHolderSeq_deinit(&tokens);
+}
+
+CU_Test(ddssec_builtin_set_remote_datareader_crypto_tokens, invalid_tokens, .init = suite_set_remote_datareader_crypto_tokens_init, .fini = suite_set_remote_datareader_crypto_tokens_fini)
+{
+  DDS_Security_boolean result;
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  DDS_Security_DatawriterCryptoTokenSeq tokens;
+  DDS_Security_DatawriterCryptoTokenSeq empty_tokens;
+
+  CU_ASSERT_FATAL(crypto != NULL);
+  CU_ASSERT_FATAL(crypto->crypto_key_exchange != NULL);
+  CU_ASSERT_FATAL(crypto->crypto_key_exchange->set_remote_datareader_crypto_tokens != NULL);
+
+  memset(&tokens, 0, sizeof(tokens));
+  memset(&empty_tokens, 0, sizeof(empty_tokens));
+  create_reader_tokens(&tokens);
+
+  /* empty token sequence */
+  {
+    result = crypto->crypto_key_exchange->set_remote_datareader_crypto_tokens(
+        crypto->crypto_key_exchange,
+        local_writer_crypto,
+        remote_reader_crypto,
+        &empty_tokens,
+        &exception);
+
+    if (!result)
+      printf("set_remote_datareader_crypto_tokens: %s\n", exception.message ? exception.message : "Error message missing");
+
+    CU_ASSERT(!result);
+    CU_ASSERT(exception.code != 0);
+    CU_ASSERT(exception.message != NULL);
+    reset_exception(&exception);
+  }
+
+  /* DDS_Security_DatawriterCryptoTokenSeq with empty token */
+  {
+    empty_tokens._length = 1;
+    empty_tokens._buffer = DDS_Security_DataHolderSeq_allocbuf(1);
+    result = crypto->crypto_key_exchange->set_remote_datareader_crypto_tokens(
+        crypto->crypto_key_exchange,
+        local_writer_crypto,
+        remote_reader_crypto,
+        &empty_tokens,
+        &exception);
+
+    if (!result)
+      printf("set_remote_datareader_crypto_tokens: %s\n", exception.message ? exception.message : "Error message missing");
+
+    CU_ASSERT(!result);
+    CU_ASSERT(exception.code != 0);
+    CU_ASSERT(exception.message != NULL);
+    reset_exception(&exception);
+    DDS_Security_DataHolderSeq_deinit(&empty_tokens);
+  }
+
+  /* invalid token class id */
+  {
+    ddsrt_free(tokens._buffer[0].class_id);
+    tokens._buffer[0].class_id = ddsrt_strdup("invalid class");
+    result = crypto->crypto_key_exchange->set_remote_datareader_crypto_tokens(
+        crypto->crypto_key_exchange,
+        local_writer_crypto,
+        remote_reader_crypto,
+        &tokens,
+        &exception);
+
+    if (!result)
+      printf("set_remote_datareader_crypto_tokens: %s\n", exception.message ? exception.message : "Error message missing");
+
+    CU_ASSERT(!result);
+    CU_ASSERT(exception.code != 0);
+    CU_ASSERT(exception.message != NULL);
+    reset_exception(&exception);
+    ddsrt_free(tokens._buffer[0].class_id);
+    tokens._buffer[0].class_id = ddsrt_strdup(CRYPTO_TOKEN_CLASS_ID);
+  }
+
+  /* no key material, binary_property missing */
+  {
+    tokens._buffer[0].binary_properties._length = 0;
+    result = crypto->crypto_key_exchange->set_remote_datareader_crypto_tokens(
+        crypto->crypto_key_exchange,
+        local_writer_crypto,
+        remote_reader_crypto,
+        &tokens,
+        &exception);
+
+    if (!result)
+      printf("set_remote_datareader_crypto_tokens: %s\n", exception.message ? exception.message : "Error message missing");
+
+    CU_ASSERT(!result);
+    CU_ASSERT(exception.code != 0);
+    CU_ASSERT(exception.message != NULL);
+    reset_exception(&exception);
+    tokens._buffer[0].binary_properties._length = 1;
+  }
+
+  /* no key material, property is empty */
+  {
+    DDS_Security_BinaryProperty_t *saved_buffer = tokens._buffer[0].binary_properties._buffer;
+    tokens._buffer[0].binary_properties._buffer = DDS_Security_BinaryPropertySeq_allocbuf(1);
+
+    result = crypto->crypto_key_exchange->set_remote_datareader_crypto_tokens(
+        crypto->crypto_key_exchange,
+        local_writer_crypto,
+        remote_reader_crypto,
+        &tokens,
+        &exception);
+
+    if (!result)
+      printf("set_remote_datareader_crypto_tokens: %s\n", exception.message ? exception.message : "Error message missing");
+
+    CU_ASSERT(!result);
+    CU_ASSERT(exception.code != 0);
+    CU_ASSERT(exception.message != NULL);
+    reset_exception(&exception);
+    ddsrt_free(tokens._buffer[0].binary_properties._buffer);
+    tokens._buffer[0].binary_properties._buffer = saved_buffer;
+  }
+
+  /* invalid property name */
+  {
+    ddsrt_free(tokens._buffer[0].binary_properties._buffer[0].name);
+    tokens._buffer[0].binary_properties._buffer[0].name = ddsrt_strdup("invalid_key_mat_name");
+
+    result = crypto->crypto_key_exchange->set_remote_datareader_crypto_tokens(
+        crypto->crypto_key_exchange,
+        local_writer_crypto,
+        remote_reader_crypto,
+        &tokens,
+        &exception);
+
+    if (!result)
+      printf("set_remote_datareader_crypto_tokens: %s\n", exception.message ? exception.message : "Error message missing");
+
+    CU_ASSERT(!result);
+    CU_ASSERT(exception.code != 0);
+    CU_ASSERT(exception.message != NULL);
+    reset_exception(&exception);
+    ddsrt_free(tokens._buffer[0].binary_properties._buffer[0].name);
+    tokens._buffer[0].binary_properties._buffer[0].name = ddsrt_strdup(CRYPTO_TOKEN_PROPERTY_NAME);
+  }
+
+  DDS_Security_DataHolderSeq_deinit(&tokens);
+}
+
+CU_Test(ddssec_builtin_set_remote_datareader_crypto_tokens, invalid_key_material, .init = suite_set_remote_datareader_crypto_tokens_init, .fini = suite_set_remote_datareader_crypto_tokens_fini)
+{
+  DDS_Security_boolean result;
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  DDS_Security_DatawriterCryptoTokenSeq tokens;
+  DDS_Security_KeyMaterial_AES_GCM_GMAC keymat;
+
+  CU_ASSERT_FATAL(crypto != NULL);
+  CU_ASSERT_FATAL(crypto->crypto_key_exchange != NULL);
+  CU_ASSERT_FATAL(crypto->crypto_key_exchange->set_remote_datareader_crypto_tokens != NULL);
+
+  memset(&tokens, 0, sizeof(tokens));
+
+  create_reader_tokens_no_key_material(&tokens);
+
+  /* empty key material */
+  {
+    result = crypto->crypto_key_exchange->set_remote_datareader_crypto_tokens(
+        crypto->crypto_key_exchange,
+        local_writer_crypto,
+        remote_reader_crypto,
+        &tokens,
+        &exception);
+
+    if (!result)
+      printf("set_remote_datareader_crypto_tokens: %s\n", exception.message ? exception.message : "Error message missing");
+
+    CU_ASSERT(!result);
+    CU_ASSERT(exception.code != 0);
+    CU_ASSERT(exception.message != NULL);
+    reset_exception(&exception);
+  }
+
+  /* invalid transform kind */
+  {
+    init_key_material(&keymat, false);
+    keymat.transformation_kind[2] = 1;
+    serialize_key_material(&tokens._buffer[0].binary_properties._buffer[0].value, &keymat);
+
+    result = crypto->crypto_key_exchange->set_remote_datareader_crypto_tokens(
+        crypto->crypto_key_exchange,
+        local_writer_crypto,
+        remote_reader_crypto,
+        &tokens,
+        &exception);
+
+    if (!result)
+      printf("set_remote_datareader_crypto_tokens: %s\n", exception.message ? exception.message : "Error message missing");
+
+    CU_ASSERT(!result);
+    CU_ASSERT(exception.code != 0);
+    CU_ASSERT(exception.message != NULL);
+    reset_exception(&exception);
+    DDS_Security_OctetSeq_deinit(&tokens._buffer[0].binary_properties._buffer[0].value);
+    deinit_key_material(&keymat);
+  }
+
+  /* no master salt */
+  {
+    init_key_material(&keymat, false);
+
+    DDS_Security_OctetSeq_deinit(&keymat.master_salt);
+    keymat.master_salt._buffer = NULL;
+    keymat.master_salt._length = keymat.master_salt._maximum = 0;
+    serialize_key_material(&tokens._buffer[0].binary_properties._buffer[0].value, &keymat);
+
+    result = crypto->crypto_key_exchange->set_remote_datareader_crypto_tokens(
+        crypto->crypto_key_exchange,
+        local_writer_crypto,
+        remote_reader_crypto,
+        &tokens,
+        &exception);
+
+    if (!result)
+      printf("set_remote_datareader_crypto_tokens: %s\n", exception.message ? exception.message : "Error message missing");
+
+    CU_ASSERT(!result);
+    CU_ASSERT(exception.code != 0);
+    CU_ASSERT(exception.message != NULL);
+    reset_exception(&exception);
+    DDS_Security_OctetSeq_deinit(&tokens._buffer[0].binary_properties._buffer[0].value);
+    deinit_key_material(&keymat);
+  }
+
+  /* empty master salt */
+  {
+    init_key_material(&keymat, false);
+
+    memset(keymat.master_salt._buffer, 0, keymat.master_salt._length);
+    serialize_key_material(&tokens._buffer[0].binary_properties._buffer[0].value, &keymat);
+
+    result = crypto->crypto_key_exchange->set_remote_datareader_crypto_tokens(
+        crypto->crypto_key_exchange,
+        local_writer_crypto,
+        remote_reader_crypto,
+        &tokens,
+        &exception);
+
+    if (!result)
+      printf("set_remote_datareader_crypto_tokens: %s\n", exception.message ? exception.message : "Error message missing");
+
+    CU_ASSERT(!result);
+    CU_ASSERT(exception.code != 0);
+    CU_ASSERT(exception.message != NULL);
+    reset_exception(&exception);
+    DDS_Security_OctetSeq_deinit(&tokens._buffer[0].binary_properties._buffer[0].value);
+    deinit_key_material(&keymat);
+  }
+
+  /* incorrect master salt */
+  {
+    init_key_material(&keymat, false);
+
+    keymat.master_salt._length = 16;
+    serialize_key_material(&tokens._buffer[0].binary_properties._buffer[0].value, &keymat);
+
+    result = crypto->crypto_key_exchange->set_remote_datareader_crypto_tokens(
+        crypto->crypto_key_exchange,
+        local_writer_crypto,
+        remote_reader_crypto,
+        &tokens,
+        &exception);
+
+    if (!result)
+      printf("set_remote_datareader_crypto_tokens: %s\n", exception.message ? exception.message : "Error message missing");
+
+    CU_ASSERT(!result);
+    CU_ASSERT(exception.code != 0);
+    CU_ASSERT(exception.message != NULL);
+    reset_exception(&exception);
+    DDS_Security_OctetSeq_deinit(&tokens._buffer[0].binary_properties._buffer[0].value);
+    deinit_key_material(&keymat);
+  }
+
+  /* no master sender key */
+  {
+    init_key_material(&keymat, false);
+
+    DDS_Security_OctetSeq_deinit(&keymat.master_sender_key);
+
+    keymat.master_sender_key._buffer = NULL;
+    keymat.master_sender_key._length = keymat.master_sender_key._maximum = 0;
+    serialize_key_material(&tokens._buffer[0].binary_properties._buffer[0].value, &keymat);
+
+    result = crypto->crypto_key_exchange->set_remote_datareader_crypto_tokens(
+        crypto->crypto_key_exchange,
+        local_writer_crypto,
+        remote_reader_crypto,
+        &tokens,
+        &exception);
+
+    if (!result)
+      printf("set_remote_datareader_crypto_tokens: %s\n", exception.message ? exception.message : "Error message missing");
+
+    CU_ASSERT(!result);
+    CU_ASSERT(exception.code != 0);
+    CU_ASSERT(exception.message != NULL);
+    reset_exception(&exception);
+    DDS_Security_OctetSeq_deinit(&tokens._buffer[0].binary_properties._buffer[0].value);
+    deinit_key_material(&keymat);
+  }
+
+  /* empty master sender key */
+  {
+    init_key_material(&keymat, false);
+
+    memset(keymat.master_sender_key._buffer, 0, keymat.master_sender_key._length);
+    serialize_key_material(&tokens._buffer[0].binary_properties._buffer[0].value, &keymat);
+
+    result = crypto->crypto_key_exchange->set_remote_datareader_crypto_tokens(
+        crypto->crypto_key_exchange,
+        local_writer_crypto,
+        remote_reader_crypto,
+        &tokens,
+        &exception);
+
+    if (!result)
+      printf("set_remote_datareader_crypto_tokens: %s\n", exception.message ? exception.message : "Error message missing");
+
+    CU_ASSERT(!result);
+    CU_ASSERT(exception.code != 0);
+    CU_ASSERT(exception.message != NULL);
+    reset_exception(&exception);
+    DDS_Security_OctetSeq_deinit(&tokens._buffer[0].binary_properties._buffer[0].value);
+    deinit_key_material(&keymat);
+  }
+
+  /* incorrect master sender key */
+  {
+    init_key_material(&keymat, false);
+
+    memset(keymat.master_sender_key._buffer, 0, keymat.master_sender_key._length);
+    keymat.master_sender_key._length = 16;
+    serialize_key_material(&tokens._buffer[0].binary_properties._buffer[0].value, &keymat);
+
+    result = crypto->crypto_key_exchange->set_remote_datareader_crypto_tokens(
+        crypto->crypto_key_exchange,
+        local_writer_crypto,
+        remote_reader_crypto,
+        &tokens,
+        &exception);
+
+    if (!result)
+      printf("set_remote_datareader_crypto_tokens: %s\n", exception.message ? exception.message : "Error message missing");
+
+    CU_ASSERT(!result);
+    CU_ASSERT(exception.code != 0);
+    CU_ASSERT(exception.message != NULL);
+    reset_exception(&exception);
+    DDS_Security_OctetSeq_deinit(&tokens._buffer[0].binary_properties._buffer[0].value);
+    deinit_key_material(&keymat);
+  }
+
+  /* no master receiver specific key */
+  {
+    init_key_material(&keymat, true);
+
+    DDS_Security_OctetSeq_deinit(&keymat.master_receiver_specific_key);
+
+    keymat.master_receiver_specific_key._buffer = NULL;
+    keymat.master_receiver_specific_key._length = keymat.master_receiver_specific_key._maximum = 0;
+    serialize_key_material(&tokens._buffer[0].binary_properties._buffer[0].value, &keymat);
+
+    result = crypto->crypto_key_exchange->set_remote_datareader_crypto_tokens(
+        crypto->crypto_key_exchange,
+        local_writer_crypto,
+        remote_reader_crypto,
+        &tokens,
+        &exception);
+
+    if (!result)
+      printf("set_remote_datareader_crypto_tokens: %s\n", exception.message ? exception.message : "Error message missing");
+
+    CU_ASSERT(!result);
+    CU_ASSERT(exception.code != 0);
+    CU_ASSERT(exception.message != NULL);
+    reset_exception(&exception);
+    DDS_Security_OctetSeq_deinit(&tokens._buffer[0].binary_properties._buffer[0].value);
+    deinit_key_material(&keymat);
+  }
+
+  /* nempty master receiver specific key */
+  {
+    init_key_material(&keymat, true);
+
+    memset(keymat.master_receiver_specific_key._buffer, 0, keymat.master_receiver_specific_key._length);
+    serialize_key_material(&tokens._buffer[0].binary_properties._buffer[0].value, &keymat);
+
+    result = crypto->crypto_key_exchange->set_remote_datareader_crypto_tokens(
+        crypto->crypto_key_exchange,
+        local_writer_crypto,
+        remote_reader_crypto,
+        &tokens,
+        &exception);
+
+    if (!result)
+      printf("set_remote_datareader_crypto_tokens: %s\n", exception.message ? exception.message : "Error message missing");
+
+    CU_ASSERT(!result);
+    CU_ASSERT(exception.code != 0);
+    CU_ASSERT(exception.message != NULL);
+    reset_exception(&exception);
+    DDS_Security_OctetSeq_deinit(&tokens._buffer[0].binary_properties._buffer[0].value);
+    deinit_key_material(&keymat);
+  }
+
+  /* incorrect master receiver specific key */
+  {
+    init_key_material(&keymat, true);
+
+    memset(keymat.master_receiver_specific_key._buffer, 0, keymat.master_receiver_specific_key._length);
+    keymat.master_receiver_specific_key._length = 16;
+    serialize_key_material(&tokens._buffer[0].binary_properties._buffer[0].value, &keymat);
+
+    result = crypto->crypto_key_exchange->set_remote_datareader_crypto_tokens(
+        crypto->crypto_key_exchange,
+        local_writer_crypto,
+        remote_reader_crypto,
+        &tokens,
+        &exception);
+
+    if (!result)
+      printf("set_remote_datareader_crypto_tokens: %s\n", exception.message ? exception.message : "Error message missing");
+
+    CU_ASSERT(!result);
+    CU_ASSERT(exception.code != 0);
+    CU_ASSERT(exception.message != NULL);
+    reset_exception(&exception);
+    DDS_Security_OctetSeq_deinit(&tokens._buffer[0].binary_properties._buffer[0].value);
+    deinit_key_material(&keymat);
+  }
+
+  /*  invalid key material */
+  {
+    init_key_material(&keymat, true);
+
+    memset(keymat.master_receiver_specific_key._buffer, 0, keymat.master_receiver_specific_key._length);
+    serialize_key_material(&tokens._buffer[0].binary_properties._buffer[0].value, &keymat);
+
+    RAND_bytes(tokens._buffer[0].binary_properties._buffer[0].value._buffer, (int) tokens._buffer[0].binary_properties._buffer[0].value._length);
+
+    result = crypto->crypto_key_exchange->set_remote_datareader_crypto_tokens(
+        crypto->crypto_key_exchange,
+        local_writer_crypto,
+        remote_reader_crypto,
+        &tokens,
+        &exception);
+
+    if (!result)
+      printf("set_remote_datareader_crypto_tokens: %s\n", exception.message ? exception.message : "Error message missing");
+
+    CU_ASSERT(!result);
+    CU_ASSERT(exception.code != 0);
+    CU_ASSERT(exception.message != NULL);
+    reset_exception(&exception);
+    DDS_Security_OctetSeq_deinit(&tokens._buffer[0].binary_properties._buffer[0].value);
+    deinit_key_material(&keymat);
+  }
+
+  DDS_Security_DataHolderSeq_deinit(&tokens);
+}
diff --git a/src/security/builtin_plugins/tests/set_remote_datawriter_crypto_tokens/src/set_remote_datawriter_crypto_tokens_utests.c b/src/security/builtin_plugins/tests/set_remote_datawriter_crypto_tokens/src/set_remote_datawriter_crypto_tokens_utests.c
new file mode 100644
index 0000000..90c8112
--- /dev/null
+++ b/src/security/builtin_plugins/tests/set_remote_datawriter_crypto_tokens/src/set_remote_datawriter_crypto_tokens_utests.c
@@ -0,0 +1,1029 @@
+/*
+ * Copyright(c) 2006 to 2019 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+#include <openssl/evp.h>
+#include <openssl/hmac.h>
+#include <openssl/bio.h>
+#include <openssl/err.h>
+
+#include "dds/ddsrt/heap.h"
+#include "dds/ddsrt/string.h"
+#include "dds/ddsrt/types.h"
+#include "dds/ddsrt/environ.h"
+#include "dds/security/dds_security_api.h"
+#include "dds/security/core/dds_security_serialize.h"
+#include "dds/security/core/dds_security_utils.h"
+#include "dds/security/core/shared_secret.h"
+#include "CUnit/CUnit.h"
+#include "CUnit/Test.h"
+#include "common/src/loader.h"
+#include "crypto_objects.h"
+
+#define TEST_SHARED_SECRET_SIZE 32
+#define CRYPTO_TRANSFORM_KIND(k) (*(uint32_t *)&((k)[0]))
+#define CRYPTO_TRANSFORM_ID(k) (*(uint32_t *)&((k)[0]))
+
+static const char *CRYPTO_TOKEN_CLASS_ID = "DDS:Crypto:AES_GCM_GMAC";
+static const char *CRYPTO_TOKEN_PROPERTY_NAME = "dds.cryp.keymat";
+
+static struct plugins_hdl *plugins = NULL;
+static dds_security_cryptography *crypto = NULL;
+
+static DDS_Security_IdentityHandle local_participant_identity = 1;
+static DDS_Security_IdentityHandle remote_participant_identity = 2;
+
+static DDS_Security_ParticipantCryptoHandle local_particpant_crypto = 0;
+static DDS_Security_ParticipantCryptoHandle remote_particpant_crypto = 0;
+static DDS_Security_DatawriterCryptoHandle remote_writer_crypto = 0;
+static DDS_Security_DatareaderCryptoHandle local_reader_crypto = 0;
+
+static DDS_Security_SharedSecretHandleImpl *shared_secret_handle_impl = NULL;
+static DDS_Security_SharedSecretHandle shared_secret_handle;
+
+static void allocate_shared_secret(void)
+{
+  shared_secret_handle_impl = ddsrt_malloc(sizeof(DDS_Security_SharedSecretHandleImpl));
+  shared_secret_handle_impl->shared_secret = ddsrt_malloc(TEST_SHARED_SECRET_SIZE * sizeof(unsigned char));
+  shared_secret_handle_impl->shared_secret_size = TEST_SHARED_SECRET_SIZE;
+  for (int i = 0; i < shared_secret_handle_impl->shared_secret_size; i++)
+  {
+    shared_secret_handle_impl->shared_secret[i] = (unsigned char)(i % 20);
+  }
+  for (int i = 0; i < 32; i++)
+  {
+    shared_secret_handle_impl->challenge1[i] = (unsigned char)(i % 15);
+    shared_secret_handle_impl->challenge2[i] = (unsigned char)(i % 12);
+  }
+  shared_secret_handle = (DDS_Security_SharedSecretHandle)shared_secret_handle_impl;
+}
+
+static void deallocate_shared_secret(void)
+{
+  ddsrt_free(shared_secret_handle_impl->shared_secret);
+  ddsrt_free(shared_secret_handle_impl);
+}
+
+static void prepare_participant_security_attributes(DDS_Security_ParticipantSecurityAttributes *attributes)
+{
+  memset(attributes, 0, sizeof(DDS_Security_ParticipantSecurityAttributes));
+  attributes->allow_unauthenticated_participants = false;
+  attributes->is_access_protected = false;
+  attributes->is_discovery_protected = false;
+  attributes->is_liveliness_protected = false;
+  attributes->is_rtps_protected = true;
+  attributes->plugin_participant_attributes = DDS_SECURITY_PARTICIPANT_ATTRIBUTES_FLAG_IS_VALID;
+  attributes->plugin_participant_attributes |= DDS_SECURITY_PLUGIN_PARTICIPANT_ATTRIBUTES_FLAG_IS_RTPS_ENCRYPTED;
+}
+
+static int register_local_participant(void)
+{
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  DDS_Security_PermissionsHandle participant_permissions = 3; //valid dummy value
+  DDS_Security_PropertySeq participant_properties;
+  DDS_Security_ParticipantSecurityAttributes participant_security_attributes;
+
+  memset(&participant_properties, 0, sizeof(participant_properties));
+  prepare_participant_security_attributes(&participant_security_attributes);
+
+  local_particpant_crypto =
+      crypto->crypto_key_factory->register_local_participant(
+          crypto->crypto_key_factory,
+          local_participant_identity,
+          participant_permissions,
+          &participant_properties,
+          &participant_security_attributes,
+          &exception);
+
+  if (local_particpant_crypto == 0)
+  {
+    printf("register_local_participant: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+
+  return local_particpant_crypto ? 0 : -1;
+}
+
+static int register_remote_participant(void)
+{
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  DDS_Security_PermissionsHandle remote_participant_permissions = 5;
+
+  remote_particpant_crypto =
+      crypto->crypto_key_factory->register_matched_remote_participant(
+          crypto->crypto_key_factory,
+          local_particpant_crypto,
+          remote_participant_identity,
+          remote_participant_permissions,
+          shared_secret_handle,
+          &exception);
+
+  if (remote_particpant_crypto == 0)
+  {
+    printf("register_matched_remote_participant: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+
+  return remote_particpant_crypto ? 0 : -1;
+}
+
+static int register_local_datareader(void)
+{
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  DDS_Security_PropertySeq datareader_properties;
+  DDS_Security_EndpointSecurityAttributes datareader_security_attributes;
+
+  memset(&datareader_properties, 0, sizeof(datareader_properties));
+  memset(&datareader_security_attributes, 0, sizeof(datareader_security_attributes));
+  datareader_security_attributes.is_discovery_protected = true;
+
+  local_reader_crypto =
+      crypto->crypto_key_factory->register_local_datareader(
+          crypto->crypto_key_factory,
+          local_particpant_crypto,
+          &datareader_properties,
+          &datareader_security_attributes,
+          &exception);
+
+  if (local_reader_crypto == 0)
+  {
+    printf("register_local_datareader: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+
+  return local_reader_crypto ? 0 : -1;
+}
+
+static int register_remote_datawriter(void)
+{
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+
+  remote_writer_crypto =
+      crypto->crypto_key_factory->register_matched_remote_datawriter(
+          crypto->crypto_key_factory,
+          local_reader_crypto,
+          remote_particpant_crypto,
+          shared_secret_handle,
+          &exception);
+
+  if (remote_writer_crypto == 0)
+  {
+    printf("register_matched_remote_datawriter: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+
+  return remote_writer_crypto ? 0 : -1;
+}
+
+static void reset_exception(DDS_Security_SecurityException *ex)
+{
+  ex->code = 0;
+  ex->minor_code = 0;
+  ddsrt_free(ex->message);
+  ex->message = NULL;
+}
+
+static void suite_set_remote_datawriter_crypto_tokens_init(void)
+{
+  allocate_shared_secret();
+  CU_ASSERT_FATAL ((plugins = load_plugins(
+                      NULL    /* Access Control */,
+                      NULL    /* Authentication */,
+                      &crypto /* Cryptograpy    */)) != NULL);
+  CU_ASSERT_EQUAL_FATAL (register_local_participant(), 0);
+  CU_ASSERT_EQUAL_FATAL (register_remote_participant(), 0);
+  CU_ASSERT_EQUAL_FATAL (register_local_datareader(), 0);
+  CU_ASSERT_EQUAL_FATAL (register_remote_datawriter(), 0);
+}
+
+static void suite_set_remote_datawriter_crypto_tokens_fini(void)
+{
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+
+  if (remote_writer_crypto)
+  {
+    crypto->crypto_key_factory->unregister_datawriter(crypto->crypto_key_factory, remote_writer_crypto, &exception);
+    reset_exception(&exception);
+  }
+  if (local_reader_crypto)
+  {
+    crypto->crypto_key_factory->unregister_datareader(crypto->crypto_key_factory, local_reader_crypto, &exception);
+    reset_exception(&exception);
+  }
+  if (remote_particpant_crypto)
+  {
+    crypto->crypto_key_factory->unregister_participant(crypto->crypto_key_factory, remote_particpant_crypto, &exception);
+    reset_exception(&exception);
+  }
+  if (local_particpant_crypto)
+  {
+    crypto->crypto_key_factory->unregister_datareader(crypto->crypto_key_factory, local_particpant_crypto, &exception);
+    reset_exception(&exception);
+  }
+  deallocate_shared_secret();
+  unload_plugins(plugins);
+}
+
+static void create_key_material(DDS_Security_OctetSeq *seq, bool include_specific_key)
+{
+  DDS_Security_KeyMaterial_AES_GCM_GMAC keymat;
+  DDS_Security_Serializer serializer;
+  unsigned char *buffer;
+  size_t length;
+
+  memset(&keymat, 0, sizeof(keymat));
+
+  keymat.transformation_kind[3] = CRYPTO_TRANSFORMATION_KIND_AES256_GCM;
+  RAND_bytes(keymat.sender_key_id, 4);
+
+  keymat.master_salt._length = keymat.master_salt._maximum = DDS_SECURITY_MASTER_SALT_SIZE_256;
+  keymat.master_salt._buffer = DDS_Security_OctetSeq_allocbuf(DDS_SECURITY_MASTER_SALT_SIZE_256);
+  RAND_bytes(keymat.master_salt._buffer, DDS_SECURITY_MASTER_SALT_SIZE_256);
+
+  keymat.master_sender_key._length = keymat.master_sender_key._maximum = DDS_SECURITY_MASTER_SENDER_KEY_SIZE_256;
+  keymat.master_sender_key._buffer = DDS_Security_OctetSeq_allocbuf(DDS_SECURITY_MASTER_SENDER_KEY_SIZE_256);
+  RAND_bytes(keymat.master_sender_key._buffer, DDS_SECURITY_MASTER_SENDER_KEY_SIZE_256);
+
+  if (include_specific_key)
+  {
+    RAND_bytes(keymat.receiver_specific_key_id, 4);
+    keymat.master_receiver_specific_key._length = keymat.master_receiver_specific_key._maximum = DDS_SECURITY_MASTER_RECEIVER_SPECIFIC_KEY_SIZE_256;
+    keymat.master_receiver_specific_key._buffer = DDS_Security_OctetSeq_allocbuf(DDS_SECURITY_MASTER_RECEIVER_SPECIFIC_KEY_SIZE_256);
+    RAND_bytes(keymat.master_receiver_specific_key._buffer, DDS_SECURITY_MASTER_RECEIVER_SPECIFIC_KEY_SIZE_256);
+  }
+
+  serializer = DDS_Security_Serializer_new(256, 256);
+  DDS_Security_Serialize_KeyMaterial_AES_GCM_GMAC(serializer, &keymat);
+  DDS_Security_Serializer_buffer(serializer, &buffer, &length);
+  DDS_Security_Serializer_free(serializer);
+
+  DDS_Security_KeyMaterial_AES_GCM_GMAC_deinit(&keymat);
+
+  seq->_length = seq->_maximum = (uint32_t) length;
+  seq->_buffer = buffer;
+}
+
+static void init_key_material(DDS_Security_KeyMaterial_AES_GCM_GMAC *keymat, bool include_specific_key)
+{
+  memset(keymat, 0, sizeof(*keymat));
+
+  keymat->transformation_kind[3] = CRYPTO_TRANSFORMATION_KIND_AES256_GCM;
+  RAND_bytes(keymat->sender_key_id, 4);
+
+  keymat->master_salt._length = keymat->master_salt._maximum = DDS_SECURITY_MASTER_SALT_SIZE_256;
+  keymat->master_salt._buffer = DDS_Security_OctetSeq_allocbuf(DDS_SECURITY_MASTER_SALT_SIZE_256);
+  RAND_bytes(keymat->master_salt._buffer, DDS_SECURITY_MASTER_SALT_SIZE_256);
+
+  keymat->master_sender_key._length = keymat->master_sender_key._maximum = DDS_SECURITY_MASTER_SENDER_KEY_SIZE_256;
+  keymat->master_sender_key._buffer = DDS_Security_OctetSeq_allocbuf(DDS_SECURITY_MASTER_SENDER_KEY_SIZE_256);
+  RAND_bytes(keymat->master_sender_key._buffer, DDS_SECURITY_MASTER_SENDER_KEY_SIZE_256);
+
+  if (include_specific_key)
+  {
+    RAND_bytes(keymat->receiver_specific_key_id, 4);
+    keymat->master_receiver_specific_key._length = keymat->master_receiver_specific_key._maximum = DDS_SECURITY_MASTER_RECEIVER_SPECIFIC_KEY_SIZE_256;
+    keymat->master_receiver_specific_key._buffer = DDS_Security_OctetSeq_allocbuf(DDS_SECURITY_MASTER_RECEIVER_SPECIFIC_KEY_SIZE_256);
+    RAND_bytes(keymat->master_receiver_specific_key._buffer, DDS_SECURITY_MASTER_RECEIVER_SPECIFIC_KEY_SIZE_256);
+  }
+}
+
+static void deinit_key_material(DDS_Security_KeyMaterial_AES_GCM_GMAC *keymat)
+{
+  ddsrt_free(keymat->master_salt._buffer);
+  ddsrt_free(keymat->master_sender_key._buffer);
+  ddsrt_free(keymat->master_receiver_specific_key._buffer);
+}
+
+static void create_writer_tokens(DDS_Security_DatawriterCryptoTokenSeq *tokens, uint32_t num)
+{
+  tokens->_length = tokens->_maximum = num;
+  tokens->_buffer = DDS_Security_DataHolderSeq_allocbuf(num);
+  for (uint32_t i = 0; i < num; i++)
+  {
+    tokens->_buffer[i].class_id = ddsrt_strdup(CRYPTO_TOKEN_CLASS_ID);
+    tokens->_buffer[i].binary_properties._length = 1;
+    tokens->_buffer[i].binary_properties._maximum = 1;
+    tokens->_buffer[i].binary_properties._buffer = DDS_Security_BinaryPropertySeq_allocbuf(1);
+    tokens->_buffer[i].binary_properties._buffer[0].name = ddsrt_strdup(CRYPTO_TOKEN_PROPERTY_NAME);
+    create_key_material(&tokens->_buffer[i].binary_properties._buffer[0].value, false);
+  }
+}
+
+static void create_writer_tokens_no_key_material(DDS_Security_DatawriterCryptoTokenSeq *tokens, uint32_t num)
+{
+  tokens->_length = tokens->_maximum = num;
+  tokens->_buffer = DDS_Security_DataHolderSeq_allocbuf(num);
+  for (uint32_t i = 0; i < num; i++)
+  {
+    tokens->_buffer[i].class_id = ddsrt_strdup(CRYPTO_TOKEN_CLASS_ID);
+    tokens->_buffer[i].binary_properties._length = 1;
+    tokens->_buffer[i].binary_properties._maximum = 1;
+    tokens->_buffer[i].binary_properties._buffer = DDS_Security_BinaryPropertySeq_allocbuf(1);
+    tokens->_buffer[i].binary_properties._buffer[0].name = ddsrt_strdup(CRYPTO_TOKEN_PROPERTY_NAME);
+  }
+}
+
+static void serialize_key_material(DDS_Security_OctetSeq *seq, DDS_Security_KeyMaterial_AES_GCM_GMAC *keymat)
+{
+  DDS_Security_Serializer serializer;
+  unsigned char *buffer;
+  size_t length;
+
+  serializer = DDS_Security_Serializer_new(256, 256);
+  DDS_Security_Serialize_KeyMaterial_AES_GCM_GMAC(serializer, keymat);
+  DDS_Security_Serializer_buffer(serializer, &buffer, &length);
+  DDS_Security_Serializer_free(serializer);
+
+  seq->_length = seq->_maximum = (uint32_t) length;
+  seq->_buffer = buffer;
+}
+
+CU_Test(ddssec_builtin_set_remote_datawriter_crypto_tokens, happy_day, .init = suite_set_remote_datawriter_crypto_tokens_init, .fini = suite_set_remote_datawriter_crypto_tokens_fini)
+{
+  DDS_Security_boolean result;
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  DDS_Security_DatawriterCryptoTokenSeq tokens;
+
+  CU_ASSERT_FATAL(crypto != NULL);
+  CU_ASSERT_FATAL(crypto->crypto_key_exchange != NULL);
+  CU_ASSERT_FATAL(crypto->crypto_key_exchange->set_remote_datawriter_crypto_tokens != NULL);
+
+  memset(&tokens, 0, sizeof(tokens));
+
+  create_writer_tokens(&tokens, 2);
+
+  /* Now call the function. */
+  result = crypto->crypto_key_exchange->set_remote_datawriter_crypto_tokens(
+      crypto->crypto_key_exchange,
+      local_reader_crypto,
+      remote_writer_crypto,
+      &tokens,
+      &exception);
+
+  if (!result)
+    printf("set_remote_datawriter_crypto_tokens: %s\n", exception.message ? exception.message : "Error message missing");
+
+  DDS_Security_DataHolderSeq_deinit(&tokens);
+  CU_ASSERT_FATAL(result);
+  CU_ASSERT(exception.code == 0);
+  CU_ASSERT(exception.message == NULL);
+  reset_exception(&exception);
+}
+
+CU_Test(ddssec_builtin_set_remote_datawriter_crypto_tokens, single_token, .init = suite_set_remote_datawriter_crypto_tokens_init, .fini = suite_set_remote_datawriter_crypto_tokens_fini)
+{
+  DDS_Security_boolean result;
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  DDS_Security_DatawriterCryptoTokenSeq tokens;
+
+  CU_ASSERT_FATAL(crypto != NULL);
+  CU_ASSERT_FATAL(crypto->crypto_key_exchange != NULL);
+  CU_ASSERT_FATAL(crypto->crypto_key_exchange->set_remote_datawriter_crypto_tokens != NULL);
+  memset(&tokens, 0, sizeof(tokens));
+  create_writer_tokens(&tokens, 1);
+
+  /* Now call the function. */
+  result = crypto->crypto_key_exchange->set_remote_datawriter_crypto_tokens(
+      crypto->crypto_key_exchange,
+      local_reader_crypto,
+      remote_writer_crypto,
+      &tokens,
+      &exception);
+
+  if (!result)
+    printf("set_remote_datawriter_crypto_tokens: %s\n", exception.message ? exception.message : "Error message missing");
+
+  DDS_Security_DataHolderSeq_deinit(&tokens);
+  CU_ASSERT_FATAL(result);
+  CU_ASSERT(exception.code == 0);
+  CU_ASSERT(exception.message == NULL);
+  reset_exception(&exception);
+}
+
+CU_Test(ddssec_builtin_set_remote_datawriter_crypto_tokens, invalid_args, .init = suite_set_remote_datawriter_crypto_tokens_init, .fini = suite_set_remote_datawriter_crypto_tokens_fini)
+{
+  DDS_Security_boolean result;
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  DDS_Security_DatawriterCryptoTokenSeq tokens;
+
+  /* Check if we actually have the validate_local_identity() function. */
+  CU_ASSERT_FATAL(crypto != NULL);
+  CU_ASSERT_FATAL(crypto->crypto_key_exchange != NULL);
+  CU_ASSERT_FATAL(crypto->crypto_key_exchange->create_local_datawriter_crypto_tokens != NULL);
+  memset(&tokens, 0, sizeof(tokens));
+  create_writer_tokens(&tokens, 2);
+
+  /* invalid token seq = NULL */
+  result = crypto->crypto_key_exchange->set_remote_datawriter_crypto_tokens(
+      crypto->crypto_key_exchange,
+      local_reader_crypto,
+      remote_writer_crypto,
+      NULL,
+      &exception);
+
+  if (!result)
+    printf("set_remote_datawriter_crypto_tokens: %s\n", exception.message ? exception.message : "Error message missing");
+
+  CU_ASSERT(!result);
+  CU_ASSERT(exception.code != 0);
+  CU_ASSERT(exception.message != NULL);
+  reset_exception(&exception);
+
+  /* invalid local_crypto_handle = DDS_SECURITY_HANDLE_NIL */
+  result = crypto->crypto_key_exchange->set_remote_datawriter_crypto_tokens(
+      crypto->crypto_key_exchange,
+      0,
+      remote_writer_crypto,
+      &tokens,
+      &exception);
+
+  if (!result)
+    printf("set_remote_datawriter_crypto_tokens: %s\n", exception.message ? exception.message : "Error message missing");
+
+  CU_ASSERT(!result);
+  CU_ASSERT(exception.code != 0);
+  CU_ASSERT(exception.message != NULL);
+  reset_exception(&exception);
+
+  /* invalid remote_crypto_handle = DDS_SECURITY_HANDLE_NIL */
+  result = crypto->crypto_key_exchange->set_remote_datawriter_crypto_tokens(
+      crypto->crypto_key_exchange,
+      local_reader_crypto,
+      0,
+      &tokens,
+      &exception);
+
+  if (!result)
+    printf("set_remote_datawriter_crypto_tokens: %s\n", exception.message ? exception.message : "Error message missing");
+
+  CU_ASSERT(!result);
+  CU_ASSERT(exception.code != 0);
+  CU_ASSERT(exception.message != NULL);
+  reset_exception(&exception);
+
+  /* invalid local_crypto_handle = 1 */
+  result = crypto->crypto_key_exchange->set_remote_datawriter_crypto_tokens(
+      crypto->crypto_key_exchange,
+      1,
+      remote_writer_crypto,
+      &tokens,
+      &exception);
+
+  if (!result)
+    printf("set_remote_datawriter_crypto_tokens: %s\n", exception.message ? exception.message : "Error message missing");
+
+  CU_ASSERT(!result);
+  CU_ASSERT(exception.code != 0);
+  CU_ASSERT(exception.message != NULL);
+  reset_exception(&exception);
+
+  /* invalid remote_crypto_handle = 1 */
+  result = crypto->crypto_key_exchange->set_remote_datawriter_crypto_tokens(
+      crypto->crypto_key_exchange,
+      local_reader_crypto,
+      1,
+      &tokens,
+      &exception);
+
+  if (!result)
+    printf("set_remote_datawriter_crypto_tokens: %s\n", exception.message ? exception.message : "Error message missing");
+
+  CU_ASSERT(!result);
+  CU_ASSERT(exception.code != 0);
+  CU_ASSERT(exception.message != NULL);
+  reset_exception(&exception);
+  DDS_Security_DataHolderSeq_deinit(&tokens);
+}
+
+CU_Test(ddssec_builtin_set_remote_datawriter_crypto_tokens, invalid_tokens, .init = suite_set_remote_datawriter_crypto_tokens_init, .fini = suite_set_remote_datawriter_crypto_tokens_fini)
+{
+  DDS_Security_boolean result;
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  DDS_Security_DatawriterCryptoTokenSeq tokens;
+  DDS_Security_DatawriterCryptoTokenSeq empty_tokens;
+
+  CU_ASSERT_FATAL(crypto != NULL);
+  CU_ASSERT_FATAL(crypto->crypto_key_exchange != NULL);
+  CU_ASSERT_FATAL(crypto->crypto_key_exchange->set_remote_datawriter_crypto_tokens != NULL);
+
+  memset(&tokens, 0, sizeof(tokens));
+  memset(&empty_tokens, 0, sizeof(empty_tokens));
+  create_writer_tokens(&tokens, 2);
+
+  /* empty token sequence */
+  {
+    result = crypto->crypto_key_exchange->set_remote_datawriter_crypto_tokens(
+        crypto->crypto_key_exchange,
+        local_reader_crypto,
+        remote_writer_crypto,
+        &empty_tokens,
+        &exception);
+
+    if (!result)
+      printf("set_remote_datawriter_crypto_tokens: %s\n", exception.message ? exception.message : "Error message missing");
+
+    CU_ASSERT(!result);
+    CU_ASSERT(exception.code != 0);
+    CU_ASSERT(exception.message != NULL);
+    reset_exception(&exception);
+  }
+
+  /* DDS_Security_DatawriterCryptoTokenSeq with empty token */
+  {
+    empty_tokens._length = 1;
+    empty_tokens._buffer = DDS_Security_DataHolderSeq_allocbuf(1);
+    result = crypto->crypto_key_exchange->set_remote_datawriter_crypto_tokens(
+        crypto->crypto_key_exchange,
+        local_reader_crypto,
+        remote_writer_crypto,
+        &empty_tokens,
+        &exception);
+
+    if (!result)
+      printf("set_remote_datawriter_crypto_tokens: %s\n", exception.message ? exception.message : "Error message missing");
+
+    CU_ASSERT(!result);
+    CU_ASSERT(exception.code != 0);
+    CU_ASSERT(exception.message != NULL);
+    reset_exception(&exception);
+    DDS_Security_DataHolderSeq_deinit(&empty_tokens);
+  }
+
+  /* invalid token class id */
+  {
+    ddsrt_free(tokens._buffer[0].class_id);
+    tokens._buffer[0].class_id = ddsrt_strdup("invalid class");
+    result = crypto->crypto_key_exchange->set_remote_datawriter_crypto_tokens(
+        crypto->crypto_key_exchange,
+        local_reader_crypto,
+        remote_writer_crypto,
+        &tokens,
+        &exception);
+
+    if (!result)
+      printf("set_remote_datawriter_crypto_tokens: %s\n", exception.message ? exception.message : "Error message missing");
+
+    CU_ASSERT(!result);
+    CU_ASSERT(exception.code != 0);
+    CU_ASSERT(exception.message != NULL);
+    reset_exception(&exception);
+  }
+
+  /* invalid token class id */
+  {
+    ddsrt_free(tokens._buffer[0].class_id);
+    tokens._buffer[0].class_id = ddsrt_strdup(CRYPTO_TOKEN_CLASS_ID);
+    ddsrt_free(tokens._buffer[1].class_id);
+    tokens._buffer[1].class_id = ddsrt_strdup("invalid class");
+    result = crypto->crypto_key_exchange->set_remote_datawriter_crypto_tokens(
+        crypto->crypto_key_exchange,
+        local_reader_crypto,
+        remote_writer_crypto,
+        &tokens,
+        &exception);
+
+    if (!result)
+      printf("set_remote_datawriter_crypto_tokens: %s\n", exception.message ? exception.message : "Error message missing");
+
+    CU_ASSERT(!result);
+    CU_ASSERT(exception.code != 0);
+    CU_ASSERT(exception.message != NULL);
+    reset_exception(&exception);
+    ddsrt_free(tokens._buffer[1].class_id);
+    tokens._buffer[1].class_id = ddsrt_strdup(CRYPTO_TOKEN_CLASS_ID);
+  }
+
+  /* no key material, binary_property missing */
+  {
+    tokens._buffer[0].binary_properties._length = 0;
+    result = crypto->crypto_key_exchange->set_remote_datawriter_crypto_tokens(
+        crypto->crypto_key_exchange,
+        local_reader_crypto,
+        remote_writer_crypto,
+        &tokens,
+        &exception);
+
+    if (!result)
+      printf("set_remote_datawriter_crypto_tokens: %s\n", exception.message ? exception.message : "Error message missing");
+
+    CU_ASSERT(!result);
+    CU_ASSERT(exception.code != 0);
+    CU_ASSERT(exception.message != NULL);
+    reset_exception(&exception);
+    tokens._buffer[0].binary_properties._length = 1;
+  }
+
+  /* no key material, binary_property missing */
+  {
+    tokens._buffer[1].binary_properties._length = 0;
+    result = crypto->crypto_key_exchange->set_remote_datawriter_crypto_tokens(
+        crypto->crypto_key_exchange,
+        local_reader_crypto,
+        remote_writer_crypto,
+        &tokens,
+        &exception);
+
+    if (!result)
+      printf("set_remote_datawriter_crypto_tokens: %s\n", exception.message ? exception.message : "Error message missing");
+
+    CU_ASSERT(!result);
+    CU_ASSERT(exception.code != 0);
+    CU_ASSERT(exception.message != NULL);
+    reset_exception(&exception);
+    tokens._buffer[1].binary_properties._length = 1;
+  }
+
+  /* no key material, property is empty */
+  {
+    DDS_Security_BinaryProperty_t *saved_buffer = tokens._buffer[0].binary_properties._buffer;
+    tokens._buffer[0].binary_properties._buffer = DDS_Security_BinaryPropertySeq_allocbuf(1);
+
+    result = crypto->crypto_key_exchange->set_remote_datawriter_crypto_tokens(
+        crypto->crypto_key_exchange,
+        local_reader_crypto,
+        remote_writer_crypto,
+        &tokens,
+        &exception);
+
+    if (!result)
+      printf("set_remote_datawriter_crypto_tokens: %s\n", exception.message ? exception.message : "Error message missing");
+
+    CU_ASSERT(!result);
+    CU_ASSERT(exception.code != 0);
+    CU_ASSERT(exception.message != NULL);
+    reset_exception(&exception);
+    ddsrt_free(tokens._buffer[0].binary_properties._buffer);
+    tokens._buffer[0].binary_properties._buffer = saved_buffer;
+  }
+
+  /* invalid property name */
+  {
+    ddsrt_free(tokens._buffer[0].binary_properties._buffer[0].name);
+    tokens._buffer[0].binary_properties._buffer[0].name = ddsrt_strdup("invalid_key_mat_name");
+
+    result = crypto->crypto_key_exchange->set_remote_datawriter_crypto_tokens(
+        crypto->crypto_key_exchange,
+        local_reader_crypto,
+        remote_writer_crypto,
+        &tokens,
+        &exception);
+
+    if (!result)
+      printf("set_remote_datawriter_crypto_tokens: %s\n", exception.message ? exception.message : "Error message missing");
+
+    CU_ASSERT(!result);
+    CU_ASSERT(exception.code != 0);
+    CU_ASSERT(exception.message != NULL);
+    reset_exception(&exception);
+    ddsrt_free(tokens._buffer[0].binary_properties._buffer[0].name);
+    tokens._buffer[0].binary_properties._buffer[0].name = ddsrt_strdup(CRYPTO_TOKEN_PROPERTY_NAME);
+  }
+
+  /* invalid property name */
+  {
+    ddsrt_free(tokens._buffer[1].binary_properties._buffer[0].name);
+    tokens._buffer[1].binary_properties._buffer[0].name = ddsrt_strdup("invalid_key_mat_name");
+
+    result = crypto->crypto_key_exchange->set_remote_datawriter_crypto_tokens(
+        crypto->crypto_key_exchange,
+        local_reader_crypto,
+        remote_writer_crypto,
+        &tokens,
+        &exception);
+
+    if (!result)
+      printf("set_remote_datawriter_crypto_tokens: %s\n", exception.message ? exception.message : "Error message missing");
+
+    CU_ASSERT(!result);
+    CU_ASSERT(exception.code != 0);
+    CU_ASSERT(exception.message != NULL);
+    reset_exception(&exception);
+    ddsrt_free(tokens._buffer[1].binary_properties._buffer[0].name);
+    tokens._buffer[1].binary_properties._buffer[0].name = ddsrt_strdup(CRYPTO_TOKEN_PROPERTY_NAME);
+  }
+
+  DDS_Security_DataHolderSeq_deinit(&tokens);
+}
+
+CU_Test(ddssec_builtin_set_remote_datawriter_crypto_tokens, invalid_key_material, .init = suite_set_remote_datawriter_crypto_tokens_init, .fini = suite_set_remote_datawriter_crypto_tokens_fini)
+{
+  DDS_Security_boolean result;
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  DDS_Security_DatawriterCryptoTokenSeq tokens;
+  DDS_Security_KeyMaterial_AES_GCM_GMAC keymat;
+
+  CU_ASSERT_FATAL(crypto != NULL);
+  CU_ASSERT_FATAL(crypto->crypto_key_exchange != NULL);
+  CU_ASSERT_FATAL(crypto->crypto_key_exchange->set_remote_datawriter_crypto_tokens != NULL);
+  memset(&tokens, 0, sizeof(tokens));
+  create_writer_tokens_no_key_material(&tokens, 1);
+
+  /* empty key material */
+  {
+    result = crypto->crypto_key_exchange->set_remote_datawriter_crypto_tokens(
+        crypto->crypto_key_exchange,
+        local_reader_crypto,
+        remote_writer_crypto,
+        &tokens,
+        &exception);
+
+    if (!result)
+      printf("set_remote_datawriter_crypto_tokens: %s\n", exception.message ? exception.message : "Error message missing");
+
+    CU_ASSERT(!result);
+    CU_ASSERT(exception.code != 0);
+    CU_ASSERT(exception.message != NULL);
+    reset_exception(&exception);
+  }
+
+  /* invalid transform kind */
+  {
+    init_key_material(&keymat, false);
+    keymat.transformation_kind[2] = 1;
+    serialize_key_material(&tokens._buffer[0].binary_properties._buffer[0].value, &keymat);
+
+    result = crypto->crypto_key_exchange->set_remote_datawriter_crypto_tokens(
+        crypto->crypto_key_exchange,
+        local_reader_crypto,
+        remote_writer_crypto,
+        &tokens,
+        &exception);
+
+    if (!result)
+      printf("set_remote_datawriter_crypto_tokens: %s\n", exception.message ? exception.message : "Error message missing");
+
+    CU_ASSERT(!result);
+    CU_ASSERT(exception.code != 0);
+    CU_ASSERT(exception.message != NULL);
+    reset_exception(&exception);
+    DDS_Security_OctetSeq_deinit(&tokens._buffer[0].binary_properties._buffer[0].value);
+    deinit_key_material(&keymat);
+  }
+
+  /* no master salt */
+  {
+    init_key_material(&keymat, false);
+
+    DDS_Security_OctetSeq_deinit(&keymat.master_salt);
+    keymat.master_salt._buffer = NULL;
+    keymat.master_salt._length = keymat.master_salt._maximum = 0;
+    serialize_key_material(&tokens._buffer[0].binary_properties._buffer[0].value, &keymat);
+
+    result = crypto->crypto_key_exchange->set_remote_datawriter_crypto_tokens(
+        crypto->crypto_key_exchange,
+        local_reader_crypto,
+        remote_writer_crypto,
+        &tokens,
+        &exception);
+
+    if (!result)
+      printf("set_remote_datawriter_crypto_tokens: %s\n", exception.message ? exception.message : "Error message missing");
+
+    CU_ASSERT(!result);
+    CU_ASSERT(exception.code != 0);
+    CU_ASSERT(exception.message != NULL);
+    reset_exception(&exception);
+    DDS_Security_OctetSeq_deinit(&tokens._buffer[0].binary_properties._buffer[0].value);
+    deinit_key_material(&keymat);
+  }
+
+  /* empty master salt */
+  {
+    init_key_material(&keymat, false);
+
+    memset(keymat.master_salt._buffer, 0, keymat.master_salt._length);
+    serialize_key_material(&tokens._buffer[0].binary_properties._buffer[0].value, &keymat);
+
+    result = crypto->crypto_key_exchange->set_remote_datawriter_crypto_tokens(
+        crypto->crypto_key_exchange,
+        local_reader_crypto,
+        remote_writer_crypto,
+        &tokens,
+        &exception);
+
+    if (!result)
+      printf("set_remote_datawriter_crypto_tokens: %s\n", exception.message ? exception.message : "Error message missing");
+
+    CU_ASSERT(!result);
+    CU_ASSERT(exception.code != 0);
+    CU_ASSERT(exception.message != NULL);
+    reset_exception(&exception);
+    DDS_Security_OctetSeq_deinit(&tokens._buffer[0].binary_properties._buffer[0].value);
+    deinit_key_material(&keymat);
+  }
+
+  /* incorrect master salt */
+  {
+    init_key_material(&keymat, false);
+
+    keymat.master_salt._length = 16;
+    serialize_key_material(&tokens._buffer[0].binary_properties._buffer[0].value, &keymat);
+
+    result = crypto->crypto_key_exchange->set_remote_datawriter_crypto_tokens(
+        crypto->crypto_key_exchange,
+        local_reader_crypto,
+        remote_writer_crypto,
+        &tokens,
+        &exception);
+
+    if (!result)
+      printf("set_remote_datawriter_crypto_tokens: %s\n", exception.message ? exception.message : "Error message missing");
+
+    CU_ASSERT(!result);
+    CU_ASSERT(exception.code != 0);
+    CU_ASSERT(exception.message != NULL);
+    reset_exception(&exception);
+    DDS_Security_OctetSeq_deinit(&tokens._buffer[0].binary_properties._buffer[0].value);
+    deinit_key_material(&keymat);
+  }
+
+  /* no master sender key */
+  {
+    init_key_material(&keymat, false);
+
+    DDS_Security_OctetSeq_deinit(&keymat.master_sender_key);
+
+    keymat.master_sender_key._buffer = NULL;
+    keymat.master_sender_key._length = keymat.master_sender_key._maximum = 0;
+    serialize_key_material(&tokens._buffer[0].binary_properties._buffer[0].value, &keymat);
+
+    result = crypto->crypto_key_exchange->set_remote_datawriter_crypto_tokens(
+        crypto->crypto_key_exchange,
+        local_reader_crypto,
+        remote_writer_crypto,
+        &tokens,
+        &exception);
+
+    if (!result)
+      printf("set_remote_datawriter_crypto_tokens: %s\n", exception.message ? exception.message : "Error message missing");
+
+    CU_ASSERT(!result);
+    CU_ASSERT(exception.code != 0);
+    CU_ASSERT(exception.message != NULL);
+    reset_exception(&exception);
+    DDS_Security_OctetSeq_deinit(&tokens._buffer[0].binary_properties._buffer[0].value);
+    deinit_key_material(&keymat);
+  }
+
+  /* empty master sender key */
+  {
+    init_key_material(&keymat, false);
+
+    memset(keymat.master_sender_key._buffer, 0, keymat.master_sender_key._length);
+    serialize_key_material(&tokens._buffer[0].binary_properties._buffer[0].value, &keymat);
+
+    result = crypto->crypto_key_exchange->set_remote_datawriter_crypto_tokens(
+        crypto->crypto_key_exchange,
+        local_reader_crypto,
+        remote_writer_crypto,
+        &tokens,
+        &exception);
+
+    if (!result)
+      printf("set_remote_datawriter_crypto_tokens: %s\n", exception.message ? exception.message : "Error message missing");
+
+    CU_ASSERT(!result);
+    CU_ASSERT(exception.code != 0);
+    CU_ASSERT(exception.message != NULL);
+    reset_exception(&exception);
+    DDS_Security_OctetSeq_deinit(&tokens._buffer[0].binary_properties._buffer[0].value);
+    deinit_key_material(&keymat);
+  }
+
+  /* incorrect master sender key */
+  {
+    init_key_material(&keymat, false);
+
+    memset(keymat.master_sender_key._buffer, 0, keymat.master_sender_key._length);
+    keymat.master_sender_key._length = 16;
+    serialize_key_material(&tokens._buffer[0].binary_properties._buffer[0].value, &keymat);
+
+    result = crypto->crypto_key_exchange->set_remote_datawriter_crypto_tokens(
+        crypto->crypto_key_exchange,
+        local_reader_crypto,
+        remote_writer_crypto,
+        &tokens,
+        &exception);
+
+    if (!result)
+      printf("set_remote_datawriter_crypto_tokens: %s\n", exception.message ? exception.message : "Error message missing");
+
+    CU_ASSERT(!result);
+    CU_ASSERT(exception.code != 0);
+    CU_ASSERT(exception.message != NULL);
+    reset_exception(&exception);
+    DDS_Security_OctetSeq_deinit(&tokens._buffer[0].binary_properties._buffer[0].value);
+    deinit_key_material(&keymat);
+  }
+
+  /* no master receiver specific key */
+  {
+    init_key_material(&keymat, true);
+
+    DDS_Security_OctetSeq_deinit(&keymat.master_receiver_specific_key);
+
+    keymat.master_receiver_specific_key._buffer = NULL;
+    keymat.master_receiver_specific_key._length = keymat.master_receiver_specific_key._maximum = 0;
+    serialize_key_material(&tokens._buffer[0].binary_properties._buffer[0].value, &keymat);
+
+    result = crypto->crypto_key_exchange->set_remote_datawriter_crypto_tokens(
+        crypto->crypto_key_exchange,
+        local_reader_crypto,
+        remote_writer_crypto,
+        &tokens,
+        &exception);
+
+    if (!result)
+      printf("set_remote_datawriter_crypto_tokens: %s\n", exception.message ? exception.message : "Error message missing");
+
+    CU_ASSERT(!result);
+    CU_ASSERT(exception.code != 0);
+    CU_ASSERT(exception.message != NULL);
+    reset_exception(&exception);
+    DDS_Security_OctetSeq_deinit(&tokens._buffer[0].binary_properties._buffer[0].value);
+    deinit_key_material(&keymat);
+  }
+
+  /* nempty master receiver specific key */
+  {
+    init_key_material(&keymat, true);
+
+    memset(keymat.master_receiver_specific_key._buffer, 0, keymat.master_receiver_specific_key._length);
+    serialize_key_material(&tokens._buffer[0].binary_properties._buffer[0].value, &keymat);
+
+    result = crypto->crypto_key_exchange->set_remote_datawriter_crypto_tokens(
+        crypto->crypto_key_exchange,
+        local_reader_crypto,
+        remote_writer_crypto,
+        &tokens,
+        &exception);
+
+    if (!result)
+      printf("set_remote_datawriter_crypto_tokens: %s\n", exception.message ? exception.message : "Error message missing");
+
+    CU_ASSERT(!result);
+    CU_ASSERT(exception.code != 0);
+    CU_ASSERT(exception.message != NULL);
+    reset_exception(&exception);
+    DDS_Security_OctetSeq_deinit(&tokens._buffer[0].binary_properties._buffer[0].value);
+    deinit_key_material(&keymat);
+  }
+
+  /* incorrect master receiver specific key */
+  {
+    init_key_material(&keymat, true);
+
+    memset(keymat.master_receiver_specific_key._buffer, 0, keymat.master_receiver_specific_key._length);
+    keymat.master_receiver_specific_key._length = 16;
+    serialize_key_material(&tokens._buffer[0].binary_properties._buffer[0].value, &keymat);
+
+    result = crypto->crypto_key_exchange->set_remote_datawriter_crypto_tokens(
+        crypto->crypto_key_exchange,
+        local_reader_crypto,
+        remote_writer_crypto,
+        &tokens,
+        &exception);
+
+    if (!result)
+      printf("set_remote_datawriter_crypto_tokens: %s\n", exception.message ? exception.message : "Error message missing");
+
+    CU_ASSERT(!result);
+    CU_ASSERT(exception.code != 0);
+    CU_ASSERT(exception.message != NULL);
+    reset_exception(&exception);
+    DDS_Security_OctetSeq_deinit(&tokens._buffer[0].binary_properties._buffer[0].value);
+    deinit_key_material(&keymat);
+  }
+
+  /*  invalid key material */
+  {
+    init_key_material(&keymat, true);
+
+    memset(keymat.master_receiver_specific_key._buffer, 0, keymat.master_receiver_specific_key._length);
+    serialize_key_material(&tokens._buffer[0].binary_properties._buffer[0].value, &keymat);
+
+    RAND_bytes(tokens._buffer[0].binary_properties._buffer[0].value._buffer, (int) tokens._buffer[0].binary_properties._buffer[0].value._length);
+
+    result = crypto->crypto_key_exchange->set_remote_datawriter_crypto_tokens(
+        crypto->crypto_key_exchange,
+        local_reader_crypto,
+        remote_writer_crypto,
+        &tokens,
+        &exception);
+
+    if (!result)
+      printf("set_remote_datawriter_crypto_tokens: %s\n", exception.message ? exception.message : "Error message missing");
+
+    CU_ASSERT(!result);
+    CU_ASSERT(exception.code != 0);
+    CU_ASSERT(exception.message != NULL);
+    reset_exception(&exception);
+    DDS_Security_OctetSeq_deinit(&tokens._buffer[0].binary_properties._buffer[0].value);
+    deinit_key_material(&keymat);
+  }
+
+  DDS_Security_DataHolderSeq_deinit(&tokens);
+}
diff --git a/src/security/builtin_plugins/tests/set_remote_participant_crypto_tokens/src/set_remote_participant_crypto_tokens_utests.c b/src/security/builtin_plugins/tests/set_remote_participant_crypto_tokens/src/set_remote_participant_crypto_tokens_utests.c
new file mode 100644
index 0000000..433b8fc
--- /dev/null
+++ b/src/security/builtin_plugins/tests/set_remote_participant_crypto_tokens/src/set_remote_participant_crypto_tokens_utests.c
@@ -0,0 +1,545 @@
+/*
+ * Copyright(c) 2006 to 2019 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+#include <openssl/evp.h>
+#include <openssl/hmac.h>
+#include <openssl/bio.h>
+#include <openssl/err.h>
+
+#include "dds/ddsrt/heap.h"
+#include "dds/ddsrt/string.h"
+#include "dds/ddsrt/types.h"
+#include "dds/ddsrt/environ.h"
+#include "dds/security/dds_security_api.h"
+#include "dds/security/core/dds_security_serialize.h"
+#include "dds/security/core/dds_security_utils.h"
+#include "dds/security/core/shared_secret.h"
+#include "CUnit/CUnit.h"
+#include "CUnit/Test.h"
+#include "common/src/loader.h"
+#include "crypto_objects.h"
+
+#define TEST_SHARED_SECRET_SIZE 32
+
+static const char *CRYPTO_TOKEN_CLASS_ID = "DDS:Crypto:AES_GCM_GMA";
+static const char *CRYPTO_TOKEN_PROPERTY_NAME = "dds.cryp.keymat";
+
+static struct plugins_hdl *plugins = NULL;
+static dds_security_cryptography *crypto = NULL;
+
+static DDS_Security_IdentityHandle local_participant_identity = 1;
+static DDS_Security_IdentityHandle remote_participant_identity = 2;
+
+static DDS_Security_ParticipantCryptoHandle local_crypto_handle = DDS_SECURITY_HANDLE_NIL;
+static DDS_Security_ParticipantCryptoHandle remote_crypto_handle = DDS_SECURITY_HANDLE_NIL;
+
+static DDS_Security_SharedSecretHandleImpl *shared_secret_handle_impl = NULL;
+static DDS_Security_SharedSecretHandle shared_secret_handle = DDS_SECURITY_HANDLE_NIL;
+static DDS_Security_ParticipantCryptoTokenSeq tokens;
+
+static void allocate_shared_secret(void)
+{
+  shared_secret_handle_impl = ddsrt_malloc(sizeof(DDS_Security_SharedSecretHandleImpl));
+
+  shared_secret_handle_impl->shared_secret = ddsrt_malloc(TEST_SHARED_SECRET_SIZE * sizeof(unsigned char));
+  shared_secret_handle_impl->shared_secret_size = TEST_SHARED_SECRET_SIZE;
+  for (int i = 0; i < shared_secret_handle_impl->shared_secret_size; i++)
+  {
+    shared_secret_handle_impl->shared_secret[i] = (unsigned char)(i % 20);
+  }
+  for (int i = 0; i < 32; i++)
+  {
+    shared_secret_handle_impl->challenge1[i] = (unsigned char)(i % 15);
+    shared_secret_handle_impl->challenge2[i] = (unsigned char)(i % 12);
+  }
+  shared_secret_handle = (DDS_Security_SharedSecretHandle)shared_secret_handle_impl;
+}
+
+static void deallocate_shared_secret(void)
+{
+  ddsrt_free(shared_secret_handle_impl->shared_secret);
+  ddsrt_free(shared_secret_handle_impl);
+}
+
+static void prepare_participant_security_attributes(DDS_Security_ParticipantSecurityAttributes *attributes)
+{
+  memset(attributes, 0, sizeof(DDS_Security_ParticipantSecurityAttributes));
+  attributes->allow_unauthenticated_participants = false;
+  attributes->is_access_protected = false;
+  attributes->is_discovery_protected = false;
+  attributes->is_liveliness_protected = false;
+  attributes->is_rtps_protected = true;
+  attributes->plugin_participant_attributes = DDS_SECURITY_PARTICIPANT_ATTRIBUTES_FLAG_IS_VALID;
+  attributes->plugin_participant_attributes |= DDS_SECURITY_PLUGIN_PARTICIPANT_ATTRIBUTES_FLAG_IS_RTPS_ENCRYPTED;
+}
+
+static int register_local_participant(void)
+{
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  DDS_Security_PermissionsHandle participant_permissions = 3; //valid dummy value
+  DDS_Security_PropertySeq participant_properties;
+  DDS_Security_ParticipantSecurityAttributes participant_security_attributes;
+
+  memset(&participant_properties, 0, sizeof(participant_properties));
+  memset(&tokens, 0, sizeof(tokens));
+
+  prepare_participant_security_attributes(&participant_security_attributes);
+
+  local_crypto_handle =
+      crypto->crypto_key_factory->register_local_participant(
+          crypto->crypto_key_factory,
+          local_participant_identity,
+          participant_permissions,
+          &participant_properties,
+          &participant_security_attributes,
+          &exception);
+
+  if (local_crypto_handle == DDS_SECURITY_HANDLE_NIL)
+    printf("register_local_participant: %s\n", exception.message ? exception.message : "Error message missing");
+
+  return local_crypto_handle ? 0 : -1;
+}
+
+static int register_remote_participant(void)
+{
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  DDS_Security_PermissionsHandle remote_participant_permissions = 5;
+
+  remote_crypto_handle =
+      crypto->crypto_key_factory->register_matched_remote_participant(
+          crypto->crypto_key_factory,
+          local_crypto_handle,
+          remote_participant_identity,
+          remote_participant_permissions,
+          shared_secret_handle,
+          &exception);
+
+  if (remote_crypto_handle == DDS_SECURITY_HANDLE_NIL)
+    printf("register_matched_remote_participant: %s\n", exception.message ? exception.message : "Error message missing");
+
+  return remote_crypto_handle ? 0 : -1;
+}
+
+static int create_crypto_tokens(void)
+{
+  DDS_Security_boolean status;
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  status = crypto->crypto_key_exchange->create_local_participant_crypto_tokens(
+      crypto->crypto_key_exchange,
+      &tokens,
+      local_crypto_handle,
+      remote_crypto_handle,
+      &exception);
+  if (!status)
+    printf("register_matched_remote_participant: %s\n", exception.message ? exception.message : "Error message missing");
+
+  return status ? 0 : -1;
+}
+
+static void unregister_participants(void)
+{
+  DDS_Security_boolean status;
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+
+  if (tokens._length != 0)
+  {
+    status = crypto->crypto_key_exchange->return_crypto_tokens(crypto->crypto_key_exchange, &tokens, &exception);
+    if (!status)
+      printf("return_crypto_tokens: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+
+  if (local_crypto_handle)
+  {
+    status = crypto->crypto_key_factory->unregister_participant(crypto->crypto_key_factory, local_crypto_handle, &exception);
+    if (!status)
+      printf("unregister_participant: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+
+  if (remote_crypto_handle)
+  {
+    status = crypto->crypto_key_factory->unregister_participant(crypto->crypto_key_factory, remote_crypto_handle, &exception);
+    if (!status)
+      printf("unregister_participant: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+}
+
+static void suite_set_remote_participant_crypto_tokens_init(void)
+{
+  allocate_shared_secret();
+
+  CU_ASSERT_FATAL ((plugins = load_plugins(
+                      NULL    /* Access Control */,
+                      NULL    /* Authentication */,
+                      &crypto /* Cryptograpy    */)) != NULL);
+  CU_ASSERT_EQUAL_FATAL (register_local_participant(), 0);
+  CU_ASSERT_EQUAL_FATAL (register_remote_participant(), 0);
+  CU_ASSERT_EQUAL_FATAL (create_crypto_tokens(), 0);
+}
+
+static void suite_set_remote_participant_crypto_tokens_fini(void)
+{
+  unregister_participants();
+  deallocate_shared_secret();
+  unload_plugins(plugins);
+}
+
+static void reset_exception(DDS_Security_SecurityException *ex)
+{
+  ex->code = 0;
+  ex->minor_code = 0;
+  ddsrt_free(ex->message);
+  ex->message = NULL;
+}
+
+CU_Test(ddssec_builtin_set_remote_participant_crypto_tokens, happy_day, .init = suite_set_remote_participant_crypto_tokens_init, .fini = suite_set_remote_participant_crypto_tokens_fini)
+{
+  DDS_Security_boolean result;
+
+  /* Dummy (even un-initialized) data for now. */
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+
+  /* Check if we actually have the validate_local_identity() function. */
+  CU_ASSERT_FATAL(crypto != NULL);
+  CU_ASSERT_FATAL(crypto->crypto_key_exchange != NULL);
+  CU_ASSERT_FATAL(crypto->crypto_key_exchange->set_remote_participant_crypto_tokens != NULL);
+
+  memset(&exception, 0, sizeof(DDS_Security_SecurityException));
+
+  /* Now call the function. */
+  result = crypto->crypto_key_exchange->set_remote_participant_crypto_tokens(
+      crypto->crypto_key_exchange,
+      local_crypto_handle,
+      remote_crypto_handle,
+      &tokens,
+      &exception);
+  if (!result)
+    printf("set_local_participant_crypto_tokens: %s\n", exception.message ? exception.message : "Error message missing");
+
+  CU_ASSERT_FATAL(result);
+  CU_ASSERT(exception.code == 0);
+  CU_ASSERT(exception.message == NULL);
+  reset_exception(&exception);
+}
+
+CU_Test(ddssec_builtin_set_remote_participant_crypto_tokens, invalid_args, .init = suite_set_remote_participant_crypto_tokens_init, .fini = suite_set_remote_participant_crypto_tokens_fini)
+{
+  DDS_Security_boolean result;
+
+  /* Dummy (even un-initialized) data for now. */
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  DDS_Security_PropertySeq participant_properties;
+
+  /* Check if we actually have the validate_local_identity() function. */
+  CU_ASSERT_FATAL(crypto != NULL);
+  CU_ASSERT_FATAL(crypto->crypto_key_exchange != NULL);
+  CU_ASSERT_FATAL(crypto->crypto_key_exchange->create_local_participant_crypto_tokens != NULL);
+
+  memset(&exception, 0, sizeof(DDS_Security_SecurityException));
+  memset(&participant_properties, 0, sizeof(participant_properties));
+
+  /* invalid token seq = NULL */
+  result = crypto->crypto_key_exchange->set_remote_participant_crypto_tokens(
+      crypto->crypto_key_exchange,
+      local_crypto_handle,
+      remote_crypto_handle,
+      NULL,
+      &exception);
+  if (!result)
+    printf("set_local_participant_crypto_tokens: %s\n", exception.message ? exception.message : "Error message missing");
+
+  CU_ASSERT(!result);
+  CU_ASSERT(exception.code != 0);
+  CU_ASSERT(exception.message != NULL);
+  reset_exception(&exception);
+
+  /* invalid local_crypto_handle = DDS_SECURITY_HANDLE_NIL */
+  result = crypto->crypto_key_exchange->set_remote_participant_crypto_tokens(
+      crypto->crypto_key_exchange,
+      0,
+      remote_crypto_handle,
+      &tokens,
+      &exception);
+  if (!result)
+    printf("set_remote_participant_crypto_tokens: %s\n", exception.message ? exception.message : "Error message missing");
+
+  CU_ASSERT(!result);
+  CU_ASSERT(exception.code != 0);
+  CU_ASSERT(exception.message != NULL);
+  reset_exception(&exception);
+
+  /* invalid remote_crypto_handle = DDS_SECURITY_HANDLE_NIL */
+  result = crypto->crypto_key_exchange->set_remote_participant_crypto_tokens(
+      crypto->crypto_key_exchange,
+      local_crypto_handle,
+      0,
+      &tokens,
+      &exception);
+  if (!result)
+    printf("set_remote_participant_crypto_tokens: %s\n", exception.message ? exception.message : "Error message missing");
+
+  CU_ASSERT(!result);
+  CU_ASSERT(exception.code != 0);
+  CU_ASSERT(exception.message != NULL);
+  reset_exception(&exception);
+
+  /* invalid local_crypto_handle = 1 */
+  result = crypto->crypto_key_exchange->set_remote_participant_crypto_tokens(
+      crypto->crypto_key_exchange,
+      1,
+      remote_crypto_handle,
+      &tokens,
+      &exception);
+  if (!result)
+    printf("set_remote_participant_crypto_tokens: %s\n", exception.message ? exception.message : "Error message missing");
+
+  CU_ASSERT(!result);
+  CU_ASSERT(exception.code != 0);
+  CU_ASSERT(exception.message != NULL);
+  reset_exception(&exception);
+
+  /* invalid remote_crypto_handle = 1 */
+  result = crypto->crypto_key_exchange->set_remote_participant_crypto_tokens(
+      crypto->crypto_key_exchange,
+      local_crypto_handle,
+      1,
+      &tokens,
+      &exception);
+  if (!result)
+    printf("set_remote_participant_crypto_tokens: %s\n", exception.message ? exception.message : "Error message missing");
+
+  CU_ASSERT(!result);
+  CU_ASSERT(exception.code != 0);
+  CU_ASSERT(exception.message != NULL);
+  reset_exception(&exception);
+}
+
+CU_Test(ddssec_builtin_set_remote_participant_crypto_tokens, invalid_tokens, .init = suite_set_remote_participant_crypto_tokens_init, .fini = suite_set_remote_participant_crypto_tokens_fini)
+{
+  DDS_Security_boolean result;
+
+  /* Dummy (even un-initialized) data for now. */
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  DDS_Security_PropertySeq participant_properties;
+  DDS_Security_ParticipantCryptoTokenSeq invalid_tokens;
+  DDS_Security_KeyMaterial_AES_GCM_GMAC keymat;
+
+  /* Check if we actually have the validate_local_identity() function. */
+  CU_ASSERT_FATAL(crypto != NULL);
+  CU_ASSERT_FATAL(crypto->crypto_key_exchange != NULL);
+  CU_ASSERT_FATAL(crypto->crypto_key_exchange->create_local_participant_crypto_tokens != NULL);
+
+  memset(&exception, 0, sizeof(DDS_Security_SecurityException));
+  memset(&participant_properties, 0, sizeof(participant_properties));
+  memset(&keymat, 0, sizeof(keymat));
+
+  memset(&invalid_tokens, 0, sizeof(invalid_tokens));
+
+  /* empty token sequence */
+  result = crypto->crypto_key_exchange->set_remote_participant_crypto_tokens(
+      crypto->crypto_key_exchange,
+      local_crypto_handle,
+      remote_crypto_handle,
+      &invalid_tokens,
+      &exception);
+  if (!result)
+    printf("set_local_participant_crypto_tokens: %s\n", exception.message ? exception.message : "Error message missing");
+
+  CU_ASSERT(!result);
+  CU_ASSERT(exception.code != 0);
+  CU_ASSERT(exception.message != NULL);
+  reset_exception(&exception);
+
+  /* DDS_Security_ParticipantCryptoTokenSeq with empty token */
+  invalid_tokens._length = 1;
+  invalid_tokens._buffer = DDS_Security_DataHolderSeq_allocbuf(1);
+  result = crypto->crypto_key_exchange->set_remote_participant_crypto_tokens(
+      crypto->crypto_key_exchange,
+      local_crypto_handle,
+      remote_crypto_handle,
+      &invalid_tokens,
+      &exception);
+  if (!result)
+    printf("set_local_participant_crypto_tokens: %s\n", exception.message ? exception.message : "Error message missing");
+
+  CU_ASSERT(!result);
+  CU_ASSERT(exception.code != 0);
+  CU_ASSERT(exception.message != NULL);
+  reset_exception(&exception);
+
+  /* invalid token class id */
+  invalid_tokens._buffer[0].class_id = ddsrt_strdup("invalid class");
+  result = crypto->crypto_key_exchange->set_remote_participant_crypto_tokens(
+      crypto->crypto_key_exchange,
+      local_crypto_handle,
+      remote_crypto_handle,
+      &invalid_tokens,
+      &exception);
+  if (!result)
+    printf("set_local_participant_crypto_tokens: %s\n", exception.message ? exception.message : "Error message missing");
+
+  CU_ASSERT(!result);
+  CU_ASSERT(exception.code != 0);
+  CU_ASSERT(exception.message != NULL);
+  ddsrt_free(invalid_tokens._buffer[0].class_id);
+  reset_exception(&exception);
+
+  /* no key material, binary_property missing */
+  invalid_tokens._buffer[0].class_id = ddsrt_strdup(CRYPTO_TOKEN_CLASS_ID);
+  result = crypto->crypto_key_exchange->set_remote_participant_crypto_tokens(
+      crypto->crypto_key_exchange,
+      local_crypto_handle,
+      remote_crypto_handle,
+      &invalid_tokens,
+      &exception);
+  if (!result)
+    printf("set_local_participant_crypto_tokens: %s\n", exception.message ? exception.message : "Error message missing");
+
+  CU_ASSERT(!result);
+  CU_ASSERT(exception.code != 0);
+  CU_ASSERT(exception.message != NULL);
+  reset_exception(&exception);
+
+  /* no key material, property is empty */
+  invalid_tokens._buffer[0].binary_properties._length = 1;
+  invalid_tokens._buffer[0].binary_properties._buffer = DDS_Security_BinaryPropertySeq_allocbuf(1);
+  result = crypto->crypto_key_exchange->set_remote_participant_crypto_tokens(
+      crypto->crypto_key_exchange,
+      local_crypto_handle,
+      remote_crypto_handle,
+      &invalid_tokens,
+      &exception);
+  if (!result)
+    printf("set_local_participant_crypto_tokens: %s\n", exception.message ? exception.message : "Error message missing");
+
+  CU_ASSERT(!result);
+  CU_ASSERT(exception.code != 0);
+  CU_ASSERT(exception.message != NULL);
+  reset_exception(&exception);
+
+  /* invalid property name */
+  invalid_tokens._buffer[0].binary_properties._buffer[0].name = ddsrt_strdup("invalid_key_mat_name");
+  result = crypto->crypto_key_exchange->set_remote_participant_crypto_tokens(
+      crypto->crypto_key_exchange,
+      local_crypto_handle,
+      remote_crypto_handle,
+      &invalid_tokens,
+      &exception);
+  if (!result)
+    printf("set_local_participant_crypto_tokens: %s\n", exception.message ? exception.message : "Error message missing");
+
+  CU_ASSERT(!result);
+  CU_ASSERT(exception.code != 0);
+  CU_ASSERT(exception.message != NULL);
+  ddsrt_free(invalid_tokens._buffer[0].binary_properties._buffer[0].name);
+  reset_exception(&exception);
+
+  /* invalid property name */
+  invalid_tokens._buffer[0].binary_properties._buffer[0].name = ddsrt_strdup(CRYPTO_TOKEN_PROPERTY_NAME);
+  result = crypto->crypto_key_exchange->set_remote_participant_crypto_tokens(
+      crypto->crypto_key_exchange,
+      local_crypto_handle,
+      remote_crypto_handle,
+      &invalid_tokens,
+      &exception);
+  if (!result)
+    printf("set_local_participant_crypto_tokens: %s\n", exception.message ? exception.message : "Error message missing");
+
+  CU_ASSERT(!result);
+  CU_ASSERT(exception.code != 0);
+  CU_ASSERT(exception.message != NULL);
+  reset_exception(&exception);
+
+  /* empty key material */
+  invalid_tokens._buffer[0].binary_properties._buffer[0].value._length = 1;
+  invalid_tokens._buffer[0].binary_properties._buffer[0].value._maximum = 1;
+  invalid_tokens._buffer[0].binary_properties._buffer[0].value._buffer = (unsigned char *)&keymat;
+  result = crypto->crypto_key_exchange->set_remote_participant_crypto_tokens(
+      crypto->crypto_key_exchange,
+      local_crypto_handle,
+      remote_crypto_handle,
+      &invalid_tokens,
+      &exception);
+  if (!result)
+    printf("set_local_participant_crypto_tokens: %s\n", exception.message ? exception.message : "Error message missing");
+
+  CU_ASSERT(!result);
+  CU_ASSERT(exception.code != 0);
+  CU_ASSERT(exception.message != NULL);
+  reset_exception(&exception);
+
+  keymat.transformation_kind[3] = 5;
+
+  /* invalid CryptoTransformKind */
+  invalid_tokens._buffer[0].binary_properties._buffer[0].value._length = 1;
+  invalid_tokens._buffer[0].binary_properties._buffer[0].value._maximum = 1;
+  invalid_tokens._buffer[0].binary_properties._buffer[0].value._buffer = (unsigned char *)&keymat;
+  result = crypto->crypto_key_exchange->set_remote_participant_crypto_tokens(
+      crypto->crypto_key_exchange,
+      local_crypto_handle,
+      remote_crypto_handle,
+      &invalid_tokens,
+      &exception);
+  if (!result)
+    printf("set_local_participant_crypto_tokens: %s\n", exception.message ? exception.message : "Error message missing");
+
+  CU_ASSERT(!result);
+  CU_ASSERT(exception.code != 0);
+  CU_ASSERT(exception.message != NULL);
+  reset_exception(&exception);
+
+  keymat.transformation_kind[3] = 2;
+  keymat.master_salt._length = 16;
+  keymat.master_salt._buffer = DDS_Security_OctetSeq_allocbuf(32);
+
+  /* invalid master salt */
+  invalid_tokens._buffer[0].binary_properties._buffer[0].value._length = 1;
+  invalid_tokens._buffer[0].binary_properties._buffer[0].value._maximum = 1;
+  invalid_tokens._buffer[0].binary_properties._buffer[0].value._buffer = (unsigned char *)&keymat;
+  result = crypto->crypto_key_exchange->set_remote_participant_crypto_tokens(
+      crypto->crypto_key_exchange,
+      local_crypto_handle,
+      remote_crypto_handle,
+      &invalid_tokens,
+      &exception);
+  if (!result)
+    printf("set_local_participant_crypto_tokens: %s\n", exception.message ? exception.message : "Error message missing");
+
+  CU_ASSERT(!result);
+  CU_ASSERT(exception.code != 0);
+  CU_ASSERT(exception.message != NULL);
+  reset_exception(&exception);
+
+  keymat.master_salt._length = 32;
+
+  /* invalid master salt */
+  invalid_tokens._buffer[0].binary_properties._buffer[0].value._length = 1;
+  invalid_tokens._buffer[0].binary_properties._buffer[0].value._maximum = 1;
+  invalid_tokens._buffer[0].binary_properties._buffer[0].value._buffer = (unsigned char *)&keymat;
+  result = crypto->crypto_key_exchange->set_remote_participant_crypto_tokens(
+      crypto->crypto_key_exchange,
+      local_crypto_handle,
+      remote_crypto_handle,
+      &invalid_tokens,
+      &exception);
+  if (!result)
+    printf("set_local_participant_crypto_tokens: %s\n", exception.message ? exception.message : "Error message missing");
+
+  CU_ASSERT(!result);
+  CU_ASSERT(exception.code != 0);
+  CU_ASSERT(exception.message != NULL);
+  reset_exception(&exception);
+
+  invalid_tokens._buffer[0].binary_properties._buffer[0].value._length = 0;
+  invalid_tokens._buffer[0].binary_properties._buffer[0].value._maximum = 0;
+  invalid_tokens._buffer[0].binary_properties._buffer[0].value._buffer = NULL;
+  DDS_Security_ParticipantCryptoTokenSeq_deinit(&invalid_tokens);
+  DDS_Security_OctetSeq_deinit(&keymat.master_salt);
+}
diff --git a/src/security/builtin_plugins/tests/validate_begin_handshake_reply/src/validate_begin_handshake_reply_utests.c b/src/security/builtin_plugins/tests/validate_begin_handshake_reply/src/validate_begin_handshake_reply_utests.c
index 3b2907e..b3871db 100644
--- a/src/security/builtin_plugins/tests/validate_begin_handshake_reply/src/validate_begin_handshake_reply_utests.c
+++ b/src/security/builtin_plugins/tests/validate_begin_handshake_reply/src/validate_begin_handshake_reply_utests.c
@@ -25,27 +25,12 @@
 #include "dds/ddsrt/string.h"
 #include <stdio.h>
 #include <string.h>
+#include "dds/ddsrt/bswap.h"
 #include "dds/ddsrt/environ.h"
-#include "dds/ddsrt/endian.h"
 #include "CUnit/CUnit.h"
 #include "CUnit/Test.h"
 #include "assert.h"
 
-
-#if DDSRT_ENDIAN == DDSRT_LITTLE_ENDIAN
-unsigned bswap4u (unsigned x);
-unsigned bswap4u (unsigned x)
-{
-  return (x >> 24) | ((x >> 8) & 0xff00) | ((x << 8) & 0xff0000) | (x << 24);
-}
-#define toBE4u(x) bswap4u (x)
-#define fromBE4u(x) bswap4u (x)
-#else
-#define toBE4u(x) (x)
-#define fromBE4u(x) (x)
-#endif
-
-
 static const char * AUTH_PROTOCOL_CLASS_ID          = "DDS:Auth:PKI-DH:1.0";
 static const char * PERM_ACCESS_CLASS_ID            = "DDS:Access:Permissions:1.0";
 
@@ -582,9 +567,9 @@ validate_local_identity(const char* trusted_ca_dir)
     local_participant_data = DDS_Security_ParticipantBuiltinTopicData_alloc();
     memcpy(&local_participant_data->key[0], &local_participant_guid, 12);
     /* convert from big-endian format to native format */
-    local_participant_data->key[0] = fromBE4u(local_participant_data->key[0]);
-    local_participant_data->key[1] = fromBE4u(local_participant_data->key[1]);
-    local_participant_data->key[2] = fromBE4u(local_participant_data->key[2]);
+    local_participant_data->key[0] = ddsrt_fromBE4u(local_participant_data->key[0]);
+    local_participant_data->key[1] = ddsrt_fromBE4u(local_participant_data->key[1]);
+    local_participant_data->key[2] = ddsrt_fromBE4u(local_participant_data->key[2]);
 
     initialize_identity_token(&local_participant_data->identity_token, RSA_2048_ALGORITHM_NAME, RSA_2048_ALGORITHM_NAME);
     initialize_permissions_token(&local_participant_data->permissions_token, RSA_2048_ALGORITHM_NAME);
@@ -853,9 +838,9 @@ validate_remote_identities (const char *remote_id_certificate)
 
     remote_participant_data1 = DDS_Security_ParticipantBuiltinTopicData_alloc();
     memcpy(&remote_participant_data1->key[0], &remote_participant_guid1, 12);
-    remote_participant_data1->key[0] = fromBE4u(remote_participant_data1->key[0]);
-    remote_participant_data1->key[1] = fromBE4u(remote_participant_data1->key[1]);
-    remote_participant_data1->key[2] = fromBE4u(remote_participant_data1->key[2]);
+    remote_participant_data1->key[0] = ddsrt_fromBE4u(remote_participant_data1->key[0]);
+    remote_participant_data1->key[1] = ddsrt_fromBE4u(remote_participant_data1->key[1]);
+    remote_participant_data1->key[2] = ddsrt_fromBE4u(remote_participant_data1->key[2]);
 
 
     initialize_identity_token(&remote_participant_data1->identity_token, RSA_2048_ALGORITHM_NAME, RSA_2048_ALGORITHM_NAME);
@@ -866,9 +851,9 @@ validate_remote_identities (const char *remote_id_certificate)
 
     remote_participant_data2 = DDS_Security_ParticipantBuiltinTopicData_alloc();
     memcpy(&remote_participant_data2->key[0], &remote_participant_guid2, 12);
-    remote_participant_data2->key[0] = fromBE4u(remote_participant_data2->key[0]);
-    remote_participant_data2->key[1] = fromBE4u(remote_participant_data2->key[1]);
-    remote_participant_data2->key[2] = fromBE4u(remote_participant_data2->key[2]);
+    remote_participant_data2->key[0] = ddsrt_fromBE4u(remote_participant_data2->key[0]);
+    remote_participant_data2->key[1] = ddsrt_fromBE4u(remote_participant_data2->key[1]);
+    remote_participant_data2->key[2] = ddsrt_fromBE4u(remote_participant_data2->key[2]);
 
     initialize_identity_token(&remote_participant_data2->identity_token, RSA_2048_ALGORITHM_NAME, RSA_2048_ALGORITHM_NAME);
     initialize_permissions_token(&remote_participant_data2->permissions_token, RSA_2048_ALGORITHM_NAME);
@@ -1019,7 +1004,7 @@ serializer_participant_data(
     DDS_Security_Serializer serializer;
     serializer = DDS_Security_Serializer_new(1024, 1024);
 
-    DDD_Security_Serialize_ParticipantBuiltinTopicData(serializer, pdata);
+    DDS_Security_Serialize_ParticipantBuiltinTopicData(serializer, pdata);
     DDS_Security_Serializer_buffer(serializer, buffer, size);
     DDS_Security_Serializer_free(serializer);
 }
diff --git a/src/security/core/include/dds/security/core/dds_security_serialize.h b/src/security/core/include/dds/security/core/dds_security_serialize.h
index 1454d9c..f6a0251 100644
--- a/src/security/core/include/dds/security/core/dds_security_serialize.h
+++ b/src/security/core/include/dds/security/core/dds_security_serialize.h
@@ -65,12 +65,12 @@ DDS_Security_Serialize_DataHolderSeq(
      const DDS_Security_DataHolderSeq *seq);
 
 DDS_EXPORT void
-DDD_Security_Serialize_ParticipantBuiltinTopicData(
+DDS_Security_Serialize_ParticipantBuiltinTopicData(
      DDS_Security_Serializer ser,
      DDS_Security_ParticipantBuiltinTopicData *pdata);
 
 DDS_EXPORT void
-DDD_Security_Serialize_KeyMaterial_AES_GCM_GMAC(
+DDS_Security_Serialize_KeyMaterial_AES_GCM_GMAC(
      DDS_Security_Serializer ser,
      const DDS_Security_KeyMaterial_AES_GCM_GMAC *data);
 
@@ -84,18 +84,18 @@ DDS_Security_Deserializer_free(
      DDS_Security_Deserializer deserializer);
 
 DDS_EXPORT int
-DDD_Security_Deserialize_ParticipantBuiltinTopicData(
+DDS_Security_Deserialize_ParticipantBuiltinTopicData(
      DDS_Security_Deserializer deserializer,
      DDS_Security_ParticipantBuiltinTopicData *pdata,
      DDS_Security_SecurityException *ex);
 
 DDS_EXPORT void
-DDD_Security_BuiltinTopicKeyBE(
+DDS_Security_BuiltinTopicKeyBE(
      DDS_Security_BuiltinTopicKey_t dst,
      const  DDS_Security_BuiltinTopicKey_t src);
 
 DDS_EXPORT int
-DDD_Security_Deserialize_KeyMaterial_AES_GCM_GMAC(
+DDS_Security_Deserialize_KeyMaterial_AES_GCM_GMAC(
      DDS_Security_Deserializer dser,
      DDS_Security_KeyMaterial_AES_GCM_GMAC *data);
 
diff --git a/src/security/core/include/dds/security/core/dds_security_types.h b/src/security/core/include/dds/security/core/dds_security_types.h
index e9748a5..953220f 100644
--- a/src/security/core/include/dds/security/core/dds_security_types.h
+++ b/src/security/core/include/dds/security/core/dds_security_types.h
@@ -50,11 +50,11 @@ typedef enum
 
 typedef struct DDS_Security_KeyMaterial_AES_GCM_GMAC {
   DDS_Security_CryptoTransformKind transformation_kind;
-  DDS_Security_OctetSeq master_salt;         /*size shall be 32*/
+  DDS_Security_OctetSeq master_salt;         /*size shall be 16 or 32*/
   DDS_Security_CryptoTransformKeyId sender_key_id;
-  DDS_Security_OctetSeq master_sender_key;   /*size shall be 32*/
+  DDS_Security_OctetSeq master_sender_key;   /*size shall be 16 or 32*/
   DDS_Security_CryptoTransformKeyId receiver_specific_key_id;
-  DDS_Security_OctetSeq master_receiver_specific_key; /*size shall be 32*/
+  DDS_Security_OctetSeq master_receiver_specific_key; /*size shall be 0, 16 or 32*/
 } DDS_Security_KeyMaterial_AES_GCM_GMAC;
 
 struct CryptoTransformIdentifier {
diff --git a/src/security/core/include/dds/security/core/dds_security_utils.h b/src/security/core/include/dds/security/core/dds_security_utils.h
index e2ade89..fe975d6 100644
--- a/src/security/core/include/dds/security/core/dds_security_utils.h
+++ b/src/security/core/include/dds/security/core/dds_security_utils.h
@@ -341,39 +341,39 @@ ddssec_strchrs (
 
 
 #define DDS_Security_ParticipantCryptoTokenSeq_alloc() \
-                    (DDS_Security_ParticipantCryptoTokenSeq *)DDS_Security_DataHolderSeq_alloc())
+                    DDS_Security_DataHolderSeq_alloc())
 #define DDS_Security_ParticipantCryptoTokenSeq_freebuf(s) \
-                    DDS_Security_DataHolderSeq_freebuf((DDS_Security_DataHolderSeq *)(s))
+                    DDS_Security_DataHolderSeq_freebuf(s)
 #define DDS_Security_ParticipantCryptoTokenSeq_free(s) \
-                    DDS_Security_DataHolderSeq_free((DDS_Security_DataHolderSeq *)(s))
+                    DDS_Security_DataHolderSeq_free(s)
 #define DDS_Security_ParticipantCryptoTokenSeq_deinit(s) \
-                    DDS_Security_DataHolderSeq_deinit((DDS_Security_DataHolderSeq *)(s))
+                    DDS_Security_DataHolderSeq_deinit(s)
 #define DDS_Security_ParticipantCryptoTokenSeq_copy(d,s) \
-                    DDS_Security_DataHolderSeq_copy((DDS_Security_DataHolderSeq *)(d), (const DDS_Security_DataHolderSeq *)(s))
+                    DDS_Security_DataHolderSeq_copy((d), (s))
 
 
-#define DDS_Security_ParticipantCryptoHandleSeq_alloc()     (DDS_Security_ParticipantCryptoHandleSeq*)DDS_Security_HandleSeq_alloc()
+#define DDS_Security_ParticipantCryptoHandleSeq_alloc()     DDS_Security_HandleSeq_alloc()
 #define DDS_Security_ParticipantCryptoHandleSeq_allocbuf(l) DDS_Security_HandleSeq_allocbuf(l)
-#define DDS_Security_ParticipantCryptoHandleSeq_freebuf(s)  DDS_Security_HandleSeq_freebuf((DDS_Security_HandleSeq*)s)
-#define DDS_Security_ParticipantCryptoHandleSeq_free(s)     DDS_Security_HandleSeq_free((DDS_Security_HandleSeq*)s)
-#define DDS_Security_ParticipantCryptoHandleSeq_deinit(s)   DDS_Security_HandleSeq_deinit((DDS_Security_HandleSeq*)s)
+#define DDS_Security_ParticipantCryptoHandleSeq_freebuf(s)  DDS_Security_HandleSeq_freebuf(s)
+#define DDS_Security_ParticipantCryptoHandleSeq_free(s)     DDS_Security_HandleSeq_free(s)
+#define DDS_Security_ParticipantCryptoHandleSeq_deinit(s)   DDS_Security_HandleSeq_deinit(s)
 
-#define DDS_Security_DatawriterCryptoHandleSeq_alloc()      (DDS_Security_DatawriterCryptoHandleSeq*)DDS_Security_HandleSeq_alloc()
+#define DDS_Security_DatawriterCryptoHandleSeq_alloc()      DDS_Security_HandleSeq_alloc()
 #define DDS_Security_DatawriterCryptoHandleSeq_allocbuf(l)  DDS_Security_HandleSeq_allocbuf(l)
-#define DDS_Security_DatawriterCryptoHandleSeq_freebuf(s)   DDS_Security_HandleSeq_freebuf((DDS_Security_HandleSeq*)s)
-#define DDS_Security_DatawriterCryptoHandleSeq_free(s)      DDS_Security_HandleSeq_free((DDS_Security_HandleSeq*)s)
-#define DDS_Security_DatawriterCryptoHandleSeq_deinit(s)    DDS_Security_HandleSeq_deinit((DDS_Security_HandleSeq*)s)
+#define DDS_Security_DatawriterCryptoHandleSeq_freebuf(s)   DDS_Security_HandleSeq_freebuf(s)
+#define DDS_Security_DatawriterCryptoHandleSeq_free(s)      DDS_Security_HandleSeq_free(s)
+#define DDS_Security_DatawriterCryptoHandleSeq_deinit(s)    DDS_Security_HandleSeq_deinit(s)
 
-#define DDS_Security_DatareaderCryptoHandleSeq_alloc()      (DDS_Security_DatareaderCryptoHandleSeq*)DDS_Security_HandleSeq_alloc()
+#define DDS_Security_DatareaderCryptoHandleSeq_alloc()      DDS_Security_HandleSeq_alloc()
 #define DDS_Security_DatareaderCryptoHandleSeq_allocbuf(l)  DDS_Security_HandleSeq_allocbuf(l)
-#define DDS_Security_DatareaderCryptoHandleSeq_freebuf(s)   DDS_Security_HandleSeq_freebuf((DDS_Security_HandleSeq*)s)
-#define DDS_Security_DatareaderCryptoHandleSeq_free(s)      DDS_Security_HandleSeq_free((DDS_Security_HandleSeq*)s)
-#define DDS_Security_DatareaderCryptoHandleSeq_deinit(s)    DDS_Security_HandleSeq_deinit((DDS_Security_HandleSeq*)s)
+#define DDS_Security_DatareaderCryptoHandleSeq_freebuf(s)   DDS_Security_HandleSeq_freebuf(s)
+#define DDS_Security_DatareaderCryptoHandleSeq_free(s)      DDS_Security_HandleSeq_free(s)
+#define DDS_Security_DatareaderCryptoHandleSeq_deinit(s)    DDS_Security_HandleSeq_deinit(s)
 
-#define DDS_Security_CryptoTokenSeq_alloc()     (DDS_Security_CryptoTokenSeq*)DDS_Security_DataHolderSeq_alloc()
+#define DDS_Security_CryptoTokenSeq_alloc()     DDS_Security_DataHolderSeq_alloc()
 #define DDS_Security_CryptoTokenSeq_allocbuf(l) DDS_Security_DataHolderSeq_allocbuf(l)
-#define DDS_Security_CryptoTokenSeq_freebuf(s)  DDS_Security_DataHolderSeq_freebuf((DDS_Security_CryptoTokenSeq*)s)
-#define DDS_Security_CryptoTokenSeq_free(s)     DDS_Security_DataHolderSeq_free((DDS_Security_CryptoTokenSeq*)s)
+#define DDS_Security_CryptoTokenSeq_freebuf(s)  DDS_Security_DataHolderSeq_freebuf(s)
+#define DDS_Security_CryptoTokenSeq_free(s)     DDS_Security_DataHolderSeq_free(s)
 
 
 /* for DEBUG purposes */
diff --git a/src/security/core/include/dds/security/core/shared_secret.h b/src/security/core/include/dds/security/core/shared_secret.h
index e0262d7..e0302e9 100644
--- a/src/security/core/include/dds/security/core/shared_secret.h
+++ b/src/security/core/include/dds/security/core/shared_secret.h
@@ -9,32 +9,25 @@
  *
  * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
  */
-
-
 #ifndef SRC_SECURITY_CORE_INCLUDE_SHARED_SECRET_HANDLE_H_
 #define SRC_SECURITY_CORE_INCLUDE_SHARED_SECRET_HANDLE_H_
 
-#include "dds/export.h"
+#include <stddef.h>
 #include <stdint.h>
+
+#include "dds/export.h"
 #include "dds/security/dds_security_api.h"
 
-
 typedef struct DDS_Security_SharedSecretHandleImpl {
-
-    DDS_Security_octet* shared_secret;
-    DDS_Security_long shared_secret_size;
-    DDS_Security_octet challenge1[DDS_SECURITY_AUTHENTICATION_CHALLENGE_SIZE];
-    DDS_Security_octet challenge2[DDS_SECURITY_AUTHENTICATION_CHALLENGE_SIZE];
-
+  DDS_Security_octet* shared_secret;
+  DDS_Security_long shared_secret_size;
+  DDS_Security_octet challenge1[DDS_SECURITY_AUTHENTICATION_CHALLENGE_SIZE];
+  DDS_Security_octet challenge2[DDS_SECURITY_AUTHENTICATION_CHALLENGE_SIZE];
 } DDS_Security_SharedSecretHandleImpl;
 
-DDS_EXPORT const DDS_Security_octet* get_challenge1_from_secret_handle( DDS_Security_SharedSecretHandle handle);
-
-DDS_EXPORT const DDS_Security_octet* get_challenge2_from_secret_handle( DDS_Security_SharedSecretHandle handle );
-
-DDS_EXPORT const DDS_Security_octet* get_secret_from_secret_handle( DDS_Security_SharedSecretHandle handle );
-
-DDS_EXPORT int32_t get_secret_size_from_secret_handle( DDS_Security_SharedSecretHandle handle );
+DDS_EXPORT const DDS_Security_octet* get_challenge1_from_secret_handle (DDS_Security_SharedSecretHandle handle);
+DDS_EXPORT const DDS_Security_octet* get_challenge2_from_secret_handle (DDS_Security_SharedSecretHandle handle);
+DDS_EXPORT const DDS_Security_octet* get_secret_from_secret_handle (DDS_Security_SharedSecretHandle handle);
+DDS_EXPORT size_t get_secret_size_from_secret_handle (DDS_Security_SharedSecretHandle handle);
 
 #endif /* SRC_SECURITY_CORE_INCLUDE_SHARED_SECRET_H_ */
-
diff --git a/src/security/core/src/dds_security_serialize.c b/src/security/core/src/dds_security_serialize.c
index afa9733..d5a37d4 100644
--- a/src/security/core/src/dds_security_serialize.c
+++ b/src/security/core/src/dds_security_serialize.c
@@ -13,6 +13,7 @@
 
 #include <assert.h>
 #include <string.h>
+#include "dds/ddsrt/bswap.h"
 #include "dds/ddsrt/heap.h"
 #include "dds/ddsrt/atomics.h"
 #include "dds/ddsrt/string.h"
@@ -92,7 +93,6 @@
 #define PID_PARTICIPANT_SECURITY_INFO           0x1005u
 #define PID_IDENTITY_STATUS_TOKEN               0x1006u
 
-
 struct DDS_Security_Serializer {
     unsigned char *buffer;
     size_t size;
@@ -211,7 +211,7 @@ DDS_Security_Serialize_update_len(
 {
     unsigned short len;
 
-    len = (unsigned short)(ser->offset - ser->marker - sizeof(unsigned short));
+    len = (unsigned short)(ser->offset - ser->marker - sizeof(len));
     *(unsigned short *)&(ser->buffer[ser->marker]) = ddsrt_toBE2u(len);
 }
 
@@ -220,11 +220,11 @@ DDS_Security_Serialize_uint16(
      DDS_Security_Serializer ser,
      unsigned short value)
 {
-    serbuffer_align(ser, sizeof(unsigned short));
-    serbuffer_adjust_size(ser, sizeof(unsigned short));
+    serbuffer_align(ser, sizeof(value));
+    serbuffer_adjust_size(ser, sizeof(value));
 
     *(unsigned short *)&(ser->buffer[ser->offset]) = ddsrt_toBE2u(value);
-    ser->offset += sizeof(unsigned short);
+    ser->offset += sizeof(value);
 }
 
 static void
@@ -232,11 +232,11 @@ DDS_Security_Serialize_uint32_t(
      DDS_Security_Serializer ser,
      uint32_t value)
 {
-    serbuffer_align(ser, sizeof(uint32_t));
-    serbuffer_adjust_size(ser, sizeof(uint32_t));
+    serbuffer_align(ser, sizeof(value));
+    serbuffer_adjust_size(ser, sizeof(value));
 
     *(uint32_t *)&(ser->buffer[ser->offset]) = ddsrt_toBE4u(value);
-    ser->offset += sizeof(uint32_t);
+    ser->offset += sizeof(value);
 }
 
 static void
@@ -244,12 +244,10 @@ DDS_Security_Serialize_string(
      DDS_Security_Serializer ser,
      const char *str)
 {
-    size_t len;
-
-    len = strlen(str) + 1;
+    size_t len = strlen(str) + 1;
 
     DDS_Security_Serialize_uint32_t(ser, (uint32_t)len);
-    serbuffer_adjust_size(ser, len );
+    serbuffer_adjust_size(ser, len);
 
     memcpy(&(ser->buffer[ser->offset]), str, len);
     ser->offset += len;
@@ -416,7 +414,7 @@ DDS_Security_Serialize_ParticipantSecurityInfo(
 
 
 void
-DDD_Security_Serialize_ParticipantBuiltinTopicData(
+DDS_Security_Serialize_ParticipantBuiltinTopicData(
      DDS_Security_Serializer ser,
      DDS_Security_ParticipantBuiltinTopicData *pdata)
 {
@@ -432,7 +430,7 @@ DDD_Security_Serialize_ParticipantBuiltinTopicData(
 }
 
 static void
-DDD_Security_Serialize_OctetArray(
+DDS_Security_Serialize_OctetArray(
      DDS_Security_Serializer ser,
      const DDS_Security_octet *data,
      uint32_t length)
@@ -443,15 +441,15 @@ DDD_Security_Serialize_OctetArray(
 }
 
 void
-DDD_Security_Serialize_KeyMaterial_AES_GCM_GMAC(
+DDS_Security_Serialize_KeyMaterial_AES_GCM_GMAC(
      DDS_Security_Serializer ser,
      const DDS_Security_KeyMaterial_AES_GCM_GMAC *data)
 {
-    DDD_Security_Serialize_OctetArray(ser, data->transformation_kind, sizeof(data->transformation_kind));
+    DDS_Security_Serialize_OctetArray(ser, data->transformation_kind, sizeof(data->transformation_kind));
     DDS_Security_Serialize_OctetSeq(ser, &data->master_salt);
-    DDD_Security_Serialize_OctetArray(ser, data->sender_key_id, sizeof(data->sender_key_id));
+    DDS_Security_Serialize_OctetArray(ser, data->sender_key_id, sizeof(data->sender_key_id));
     DDS_Security_Serialize_OctetSeq(ser, &data->master_sender_key);
-    DDD_Security_Serialize_OctetArray(ser, data->receiver_specific_key_id, sizeof(data->receiver_specific_key_id));
+    DDS_Security_Serialize_OctetArray(ser, data->receiver_specific_key_id, sizeof(data->receiver_specific_key_id));
     DDS_Security_Serialize_OctetSeq(ser, &data->master_receiver_specific_key);
 }
 
@@ -500,7 +498,7 @@ DDS_Security_Deserialize_uint16(
      DDS_Security_Deserializer dser,
      unsigned short *value)
 {
-    size_t l = sizeof(unsigned short);
+    size_t l = sizeof(*value);
 
     DDS_Security_Deserialize_align(dser, l);
 
@@ -519,7 +517,7 @@ DDS_Security_Deserialize_uint32_t(
      DDS_Security_Deserializer dser,
      uint32_t *value)
 {
-    size_t l = sizeof(uint32_t);
+    size_t l = sizeof(*value);
 
     DDS_Security_Deserialize_align(dser, l);
 
@@ -692,9 +690,7 @@ DDS_Security_Deserialize_BuiltinTopicKey(
      DDS_Security_Deserializer dser,
      DDS_Security_BuiltinTopicKey_t key)
 {
-    int r;
-
-    r = DDS_Security_Deserialize_uint32_t(dser, (uint32_t *)&key[0]) &&
+    int r = DDS_Security_Deserialize_uint32_t(dser, (uint32_t *)&key[0]) &&
         DDS_Security_Deserialize_uint32_t(dser, (uint32_t *)&key[1]) &&
         DDS_Security_Deserialize_uint32_t(dser, (uint32_t *)&key[2]);
 
@@ -710,16 +706,12 @@ DDS_Security_Deserialize_ParticipantSecurityInfo(
     DDS_Security_Deserializer dser,
     DDS_Security_ParticipantSecurityInfo *info)
 {
-    int r;
-
-    r =  DDS_Security_Deserialize_uint32_t(dser, &info->participant_security_attributes) &&
+    return DDS_Security_Deserialize_uint32_t(dser, &info->participant_security_attributes) &&
          DDS_Security_Deserialize_uint32_t(dser, &info->plugin_participant_security_attributes);
-
-    return r;
 }
 
 int
-DDD_Security_Deserialize_ParticipantBuiltinTopicData(
+DDS_Security_Deserialize_ParticipantBuiltinTopicData(
      DDS_Security_Deserializer dser,
      DDS_Security_ParticipantBuiltinTopicData *pdata,
      DDS_Security_SecurityException *ex)
@@ -786,7 +778,7 @@ DDD_Security_Deserialize_ParticipantBuiltinTopicData(
 }
 
 void
-DDD_Security_BuiltinTopicKeyBE(
+DDS_Security_BuiltinTopicKeyBE(
      DDS_Security_BuiltinTopicKey_t dst,
      const  DDS_Security_BuiltinTopicKey_t src)
 {
@@ -796,18 +788,16 @@ DDD_Security_BuiltinTopicKeyBE(
 }
 
 int
-DDD_Security_Deserialize_KeyMaterial_AES_GCM_GMAC(
+DDS_Security_Deserialize_KeyMaterial_AES_GCM_GMAC(
      DDS_Security_Deserializer dser,
      DDS_Security_KeyMaterial_AES_GCM_GMAC *data)
 {
-    int r = 0;
-
-    r = DDS_Security_Deserialize_OctetArray(dser, data->transformation_kind, sizeof(data->transformation_kind)) &&
+    memset(data, 0, sizeof(*data));
+    return
+        DDS_Security_Deserialize_OctetArray(dser, data->transformation_kind, sizeof(data->transformation_kind)) &&
         DDS_Security_Deserialize_OctetSeq(dser, &data->master_salt) &&
         DDS_Security_Deserialize_OctetArray(dser, data->sender_key_id, sizeof(data->sender_key_id)) &&
         DDS_Security_Deserialize_OctetSeq(dser, &data->master_sender_key) &&
         DDS_Security_Deserialize_OctetArray(dser, data->receiver_specific_key_id, sizeof(data->receiver_specific_key_id)) &&
         DDS_Security_Deserialize_OctetSeq(dser, &data->master_receiver_specific_key);
-
-    return r;
 }
diff --git a/src/security/core/src/dds_security_utils.c b/src/security/core/src/dds_security_utils.c
index 8e417e6..665e587 100644
--- a/src/security/core/src/dds_security_utils.c
+++ b/src/security/core/src/dds_security_utils.c
@@ -46,6 +46,7 @@ DDS_Security_BinaryProperty_deinit(
     }
 
     ddsrt_free(p->name);
+    memset (p->value._buffer, 0, p->value._length); /* because key material can be stored in binary property */
     ddsrt_free(p->value._buffer);
 }
 
@@ -906,51 +907,45 @@ DDS_Security_KeyMaterial_AES_GCM_GMAC_deinit(
 {
     if (key_material) {
         if (key_material->master_receiver_specific_key._buffer != NULL) {
+            memset (key_material->master_receiver_specific_key._buffer, 0, key_material->master_receiver_specific_key._length);
             ddsrt_free(key_material->master_receiver_specific_key._buffer);
         }
         if( key_material->master_salt._buffer != NULL){
+            memset (key_material->master_salt._buffer, 0, key_material->master_salt._length);
             ddsrt_free(key_material->master_salt._buffer);
         }
         if( key_material->master_sender_key._buffer != NULL){
+            memset (key_material->master_sender_key._buffer, 0, key_material->master_sender_key._length);
             ddsrt_free(key_material->master_sender_key._buffer);
         }
     }
 }
 
+static uint32_t DDS_Security_getKeySize (const DDS_Security_PropertySeq *properties)
+{
+    const DDS_Security_Property_t *key_size_property;
+    if (properties != NULL)
+    {
+        key_size_property = DDS_Security_PropertySeq_find_property (properties, "dds.sec.crypto.keysize");
+        if (key_size_property != NULL && !strcmp(key_size_property->value, "128"))
+            return 128;
+    }
+    return 256;
+}
 
 DDS_Security_CryptoTransformKind_Enum
 DDS_Security_basicprotectionkind2transformationkind(
-     const DDS_Security_PropertySeq *properties, 
+     const DDS_Security_PropertySeq *properties,
      DDS_Security_BasicProtectionKind protection)
 {
-    int keysize=256;
-    const DDS_Security_Property_t *key_size_property = NULL;
-    if( properties != NULL ){
-        key_size_property = DDS_Security_PropertySeq_find_property(
-                    properties, "dds.sec.crypto.keysize");
-
-        if (key_size_property != NULL) {
-            if (strcmp(key_size_property->value, "128") == 0) {
-                keysize = 128;
-            }
-        }
-    }
-
+    uint32_t keysize = DDS_Security_getKeySize (properties);
     switch (protection) {
         case DDS_SECURITY_BASICPROTECTION_KIND_NONE:
             return CRYPTO_TRANSFORMATION_KIND_NONE;
         case DDS_SECURITY_BASICPROTECTION_KIND_SIGN:
-            if( keysize == 128 ){
-                return CRYPTO_TRANSFORMATION_KIND_AES128_GMAC;
-            } else{
-                return CRYPTO_TRANSFORMATION_KIND_AES256_GMAC;
-            }
+            return (keysize == 128) ? CRYPTO_TRANSFORMATION_KIND_AES128_GMAC : CRYPTO_TRANSFORMATION_KIND_AES256_GMAC;
         case DDS_SECURITY_BASICPROTECTION_KIND_ENCRYPT:
-            if( keysize == 128 ){
-                return CRYPTO_TRANSFORMATION_KIND_AES128_GCM;
-            } else{
-                return CRYPTO_TRANSFORMATION_KIND_AES256_GCM;
-            }
+            return (keysize == 128) ? CRYPTO_TRANSFORMATION_KIND_AES128_GCM : CRYPTO_TRANSFORMATION_KIND_AES256_GCM;
         default:
             return CRYPTO_TRANSFORMATION_KIND_INVALID;
     }
@@ -961,41 +956,22 @@ DDS_Security_protectionkind2transformationkind(
      const DDS_Security_PropertySeq *properties,
      DDS_Security_ProtectionKind protection)
 {
-    int keysize=256;
-    const DDS_Security_Property_t *key_size_property = NULL;
-    if( properties != NULL ){
-        key_size_property = DDS_Security_PropertySeq_find_property(
-                        properties, "dds.sec.crypto.keysize");
-        if (key_size_property != NULL) {
-            if (strcmp(key_size_property->value, "128") == 0) {
-                keysize = 128;
-            }
-        }
-    }
-
+    uint32_t keysize = DDS_Security_getKeySize (properties);
     switch (protection) {
         case DDS_SECURITY_PROTECTION_KIND_NONE:
             return CRYPTO_TRANSFORMATION_KIND_NONE;
         case DDS_SECURITY_PROTECTION_KIND_SIGN_WITH_ORIGIN_AUTHENTICATION:
         case DDS_SECURITY_PROTECTION_KIND_SIGN:
-            if( keysize == 128 ){
-                return CRYPTO_TRANSFORMATION_KIND_AES128_GMAC;
-            } else{
-                return CRYPTO_TRANSFORMATION_KIND_AES256_GMAC;
-            }
+            return (keysize == 128) ? CRYPTO_TRANSFORMATION_KIND_AES128_GMAC : CRYPTO_TRANSFORMATION_KIND_AES256_GMAC;
         case DDS_SECURITY_PROTECTION_KIND_ENCRYPT_WITH_ORIGIN_AUTHENTICATION:
         case DDS_SECURITY_PROTECTION_KIND_ENCRYPT:
-            if( keysize == 128 ){
-                return CRYPTO_TRANSFORMATION_KIND_AES128_GCM;
-            } else {
-                return CRYPTO_TRANSFORMATION_KIND_AES256_GCM;
-            }
+            return (keysize == 128) ? CRYPTO_TRANSFORMATION_KIND_AES128_GCM : CRYPTO_TRANSFORMATION_KIND_AES256_GCM;
         default:
             return CRYPTO_TRANSFORMATION_KIND_INVALID;
     }
 }
 
-/* for DEBUG purposes */
+#ifndef NDEBUG
 void
 print_binary_debug(
      char* name,
@@ -1021,8 +997,7 @@ print_binary_properties_debug(
     }
 
 }
-
-
+#endif
 
 
 DDS_Security_config_item_prefix_t
diff --git a/src/security/core/src/shared_secret.c b/src/security/core/src/shared_secret.c
index 7b1de75..2446906 100644
--- a/src/security/core/src/shared_secret.c
+++ b/src/security/core/src/shared_secret.c
@@ -13,31 +13,29 @@
 #include "dds/security/core/shared_secret.h"
 
 const DDS_Security_octet*
-get_challenge1_from_secret_handle(DDS_Security_SharedSecretHandle handle)
+get_challenge1_from_secret_handle (DDS_Security_SharedSecretHandle handle)
 {
-
-    DDS_Security_SharedSecretHandleImpl *secret = (DDS_Security_SharedSecretHandleImpl *)(uintptr_t)handle;
-    return secret->challenge1;
+  DDS_Security_SharedSecretHandleImpl *secret = (DDS_Security_SharedSecretHandleImpl *)(uintptr_t)handle;
+  return secret->challenge1;
 }
 
 const DDS_Security_octet*
-get_challenge2_from_secret_handle(DDS_Security_SharedSecretHandle handle)
+get_challenge2_from_secret_handle (DDS_Security_SharedSecretHandle handle)
 {
-    DDS_Security_SharedSecretHandleImpl *secret = (DDS_Security_SharedSecretHandleImpl *)(uintptr_t)handle;
-    return secret->challenge2;
+  DDS_Security_SharedSecretHandleImpl *secret = (DDS_Security_SharedSecretHandleImpl *)(uintptr_t)handle;
+  return secret->challenge2;
 }
 
 const DDS_Security_octet*
-get_secret_from_secret_handle(DDS_Security_SharedSecretHandle handle)
+get_secret_from_secret_handle (DDS_Security_SharedSecretHandle handle)
 {
-    DDS_Security_SharedSecretHandleImpl *secret = (DDS_Security_SharedSecretHandleImpl *)(uintptr_t)handle;
-    return secret->shared_secret;
+  DDS_Security_SharedSecretHandleImpl *secret = (DDS_Security_SharedSecretHandleImpl *)(uintptr_t)handle;
+  return secret->shared_secret;
 }
 
-
-int32_t
-get_secret_size_from_secret_handle( DDS_Security_SharedSecretHandle handle ){
-    DDS_Security_SharedSecretHandleImpl *secret = (DDS_Security_SharedSecretHandleImpl *)(uintptr_t)handle;
-    return secret->shared_secret_size;
-
+size_t
+get_secret_size_from_secret_handle (DDS_Security_SharedSecretHandle handle)
+{
+  DDS_Security_SharedSecretHandleImpl *secret = (DDS_Security_SharedSecretHandleImpl *)(uintptr_t)handle;
+  return (size_t) secret->shared_secret_size;
 }

From 66c0d8788619bc8c29ef2bfac1b81a689140219c Mon Sep 17 00:00:00 2001
From: martinbremmer <37294015+martinbremmer@users.noreply.github.com>
Date: Fri, 6 Dec 2019 16:50:31 +0100
Subject: [PATCH 078/238] Encoding preparations (#329)

* Payload encoding/decoding preparations.

Signed-off-by: Martin Bremmer <martin.bremmer@adlinktech.com>

* Sub-message encoding/decoding preparations.

Signed-off-by: Martin Bremmer <martin.bremmer@adlinktech.com>

* RTPS message encoding/decoding preparations.

Signed-off-by: Martin Bremmer <martin.bremmer@adlinktech.com>

* Removed redundant destination acquiring.

Signed-off-by: Martin Bremmer <martin.bremmer@adlinktech.com>

* Refactored secure writing of RTPS messages slightly.

Signed-off-by: Martin Bremmer <martin.bremmer@adlinktech.com>
---
 .../ddsi/include/dds/ddsi/ddsi_security_omg.h |  493 ++++++-
 src/core/ddsi/include/dds/ddsi/q_entity.h     |    7 +
 src/core/ddsi/include/dds/ddsi/q_protocol.h   |    6 +
 src/core/ddsi/include/dds/ddsi/q_radmin.h     |    7 +-
 src/core/ddsi/include/dds/ddsi/q_xevent.h     |    4 +-
 src/core/ddsi/include/dds/ddsi/q_xmsg.h       |   15 +-
 src/core/ddsi/src/ddsi_security_omg.c         | 1128 ++++++++++++++++-
 src/core/ddsi/src/q_ddsi_discovery.c          |   12 +-
 src/core/ddsi/src/q_entity.c                  |   19 +-
 src/core/ddsi/src/q_receive.c                 |  253 +++-
 src/core/ddsi/src/q_transmit.c                |   41 +-
 src/core/ddsi/src/q_xevent.c                  |   46 +-
 src/core/ddsi/src/q_xmsg.c                    |  224 +++-
 13 files changed, 2134 insertions(+), 121 deletions(-)

diff --git a/src/core/ddsi/include/dds/ddsi/ddsi_security_omg.h b/src/core/ddsi/include/dds/ddsi/ddsi_security_omg.h
index 298370f..316954d 100644
--- a/src/core/ddsi/include/dds/ddsi/ddsi_security_omg.h
+++ b/src/core/ddsi/include/dds/ddsi/ddsi_security_omg.h
@@ -12,16 +12,40 @@
 #ifndef DDSI_OMG_SECURITY_H
 #define DDSI_OMG_SECURITY_H
 
-#include "dds/ddsi/q_entity.h"
 #include "dds/ddsi/q_plist.h"
+#include "dds/ddsi/q_entity.h"
 #include "dds/ddsi/q_globals.h"
+#include "dds/ddsi/q_radmin.h"
+#include "dds/ddsi/q_xmsg.h"
 
 #if defined (__cplusplus)
 extern "C" {
 #endif
 
+typedef enum {
+  NN_RTPS_MSG_STATE_ERROR,
+  NN_RTPS_MSG_STATE_PLAIN,
+  NN_RTPS_MSG_STATE_ENCODED
+} nn_rtps_msg_state_t;
+
 #ifdef DDSI_INCLUDE_SECURITY
 
+typedef struct nn_msg_sec_info {
+  int64_t src_pp_handle;
+  int64_t dst_pp_handle;
+  bool use_rtps_encoding;
+} nn_msg_sec_info_t;
+
+
+/**
+ * @brief Check if any participant has security enabled.
+ *
+ * @returns bool
+ * @retval true   Some participant is secure
+ * @retval false  No participant is not secure
+ */
+bool q_omg_security_enabled(void);
+
 /**
  * @brief Check if security is enabled for the participant.
  *
@@ -33,6 +57,26 @@ extern "C" {
  */
 bool q_omg_participant_is_secure(const struct participant *pp);
 
+/**
+ * @brief Get the security handle of the given local participant.
+ *
+ * @param[in] pp  Participant to check if it is secure.
+ *
+ * @returns int64_t
+ * @retval Local participant security handle
+ */
+int64_t q_omg_security_get_local_participant_handle(struct participant *pp);
+
+/**
+ * @brief Get the security handle of the given remote participant.
+ *
+ * @param[in] proxypp  Participant to check if it is secure.
+ *
+ * @returns int64_t
+ * @retval Remote participant security handle
+ */
+int64_t q_omg_security_get_remote_participant_handle(struct proxy_participant *proxypp);
+
 /**
  * @brief Get security info flags of the given writer.
  *
@@ -107,12 +151,355 @@ unsigned determine_publication_writer(const struct writer *wr);
  * @retval true   The proxy participant may be deleted.
  * @retval false  The proxy participant may not be deleted by this writer.
  */
-bool allow_proxy_participant_deletion(struct q_globals * const gv, const struct ddsi_guid *guid, const ddsi_entityid_t pwr_entityid);
+bool
+is_proxy_participant_deletion_allowed(
+  struct q_globals * const gv,
+  const struct ddsi_guid *guid,
+  const ddsi_entityid_t pwr_entityid);
+
+/**
+ * @brief Determine if the messages, related to the given remote
+ * entity, are RTPS protected or not.
+ *
+ * @param[in] proxy_pp  Related proxy participant.
+ * @param[in] entityid  ID of the entity to check.
+ *
+ * @returns bool
+ * @retval true   The entity messages are RTPS protected.
+ * @retval false  The entity messages are not RTPS protected.
+ */
+bool
+q_omg_security_is_remote_rtps_protected(
+  struct proxy_participant *proxy_pp,
+  ddsi_entityid_t entityid);
+
+/**
+ * @brief Determine if the messages, related to the given local
+ * entity, are RTPS protected or not.
+ *
+ * @param[in] pp        Related participant.
+ * @param[in] entityid  ID of the entity to check.
+ *
+ * @returns bool
+ * @retval true   The entity messages are RTPS protected.
+ * @retval false  The entity messages are not RTPS protected.
+ */
+bool
+q_omg_security_is_local_rtps_protected(
+  struct participant *pp,
+  ddsi_entityid_t entityid);
+
+/**
+ * @brief Set security information, depending on plist, into the given
+ * proxy participant.
+ *
+ * @param[in] proxypp  Proxy participant to set security info on.
+ * @param[in] plist    Paramater list, possibly contains security info.
+ */
+void
+set_proxy_participant_security_info(
+  struct proxy_participant *proxypp,
+  const nn_plist_t *plist);
+
+/**
+ * @brief Set security information, depending on plist and proxy participant,
+ * into the given proxy reader.
+ *
+ * @param[in] prd      Proxy reader to set security info on.
+ * @param[in] plist    Paramater list, possibly contains security info.
+ */
+void
+set_proxy_reader_security_info(
+  struct proxy_reader *prd,
+  const nn_plist_t *plist);
+
+/**
+ * @brief Set security information, depending on plist and proxy participant,
+ * into the given proxy writer.
+ *
+ * @param[in] pwr      Proxy writer to set security info on.
+ * @param[in] plist    Paramater list, possibly contains security info.
+ */
+void
+set_proxy_writer_security_info(
+  struct proxy_writer *pwr,
+  const nn_plist_t *plist);
+
+/**
+ * @brief Encode RTPS message.
+ *
+ * @param[in]     src_handle  Security handle of data source.
+ * @param[in]     src_guid    GUID of the entity data source.
+ * @param[in]     src_buf     Original RTPS message.
+ * @param[in]     src_len     Original RTPS message size.
+ * @param[out]    dst_buf     Encoded RTPS message.
+ * @param[out]    dst_len     Encoded RTPS message size.
+ * @param[in]     dst_handle  Security handle of data destination.
+ *
+ * @returns bool
+ * @retval true   Encoding succeeded.
+ * @retval false  Encoding failed.
+ */
+bool
+q_omg_security_encode_rtps_message(
+  int64_t                 src_handle,
+  ddsi_guid_t            *src_guid,
+  const unsigned char    *src_buf,
+  const unsigned int      src_len,
+  unsigned char        **dst_buf,
+  unsigned int          *dst_len,
+  int64_t                dst_handle);
+
+/**
+ * @brief Encode payload when necessary.
+ *
+ * When encoding is necessary, *buf will be allocated and the vec contents
+ * will change to point to that buffer.
+ * It is expected that the vec contents is always aliased.
+ *
+ * If no encoding is necessary, nothing changes.
+ *
+ * encoding(    not needed) -> return( true), vec(untouched), buf(NULL)
+ * encoding(needed&success) -> return( true), vec( buf(new))
+ * encoding(needed&failure) -> return(false), vec(untouched), buf(NULL)
+ *
+ * @param[in]     wr   Writer that writes the payload.
+ * @param[in,out] vec  An iovec that contains the payload.
+ * @param[out]    buf  Buffer to contain the encoded payload.
+ *
+ * @returns bool
+ * @retval true   Encoding succeeded or not necessary. Either way, vec
+ *                contains the payload that should be send.
+ * @retval false  Encoding was necessary, but failed.
+ */
+bool
+encode_payload(
+  struct writer *wr,
+  ddsrt_iovec_t *vec,
+  unsigned char **buf);
+
+/**
+ * @brief Decode the payload of a Data submessage.
+ *
+ * When decoding is necessary, the payloadp memory will be replaced
+ * by the decoded payload. This means that the original submessage
+ * now contains payload that can be deserialized.
+ *
+ * If no decoding is necessary, nothing changes.
+ *
+ * @param[in]     gv          Global information.
+ * @param[in]     sampleinfo  Sample information.
+ * @param[in,out] payloadp    Pointer to payload memory.
+ * @param[in]     payloadsz   Size of payload.
+ * @param[in,out] submsg_len  Size of submessage.
+ *
+ * @returns bool
+ * @retval true   Decoding succeeded or not necessary. Either way, payloadp
+ *                contains the data that should be deserialized.
+ * @retval false  Decoding was necessary, but failed.
+ */
+bool
+decode_Data(
+  const struct q_globals *gv,
+  struct nn_rsample_info *sampleinfo,
+  unsigned char *payloadp,
+  uint32_t payloadsz,
+  size_t *submsg_len);
+
+/**
+ * @brief Decode the payload of a DataFrag submessage.
+ *
+ * When decoding is necessary, the payloadp memory will be replaced
+ * by the decoded payload. This means that the original submessage
+ * now contains payload that can be deserialized.
+ *
+ * If no decoding is necessary, nothing changes.
+ *
+ * @param[in]     gv          Global information.
+ * @param[in]     sampleinfo  Sample information.
+ * @param[in,out] payloadp    Pointer to payload memory.
+ * @param[in]     payloadsz   Size of payload.
+ * @param[in,out] submsg_len  Size of submessage.
+ *
+ * @returns bool
+ * @retval true   Decoding succeeded or not necessary. Either way, payloadp
+ *                contains the data that should be deserialized.
+ * @retval false  Decoding was necessary, but failed.
+ */
+bool
+decode_DataFrag(
+  const struct q_globals *gv,
+  struct nn_rsample_info *sampleinfo,
+  unsigned char *payloadp,
+  uint32_t payloadsz,
+  size_t *submsg_len);
+
+/**
+ * @brief Encode datareader submessage when necessary.
+ *
+ * When encoding is necessary, the original submessage will be replaced
+ * by a new encoded submessage.
+ * If the encoding fails, the original submessage will be removed.
+ *
+ * If no encoding is necessary, nothing changes.
+ *
+ * @param[in,out] msg       Complete message.
+ * @param[in,out] sm_marker Submessage location within message.
+ * @param[in]     pwr       Writer for which the message is intended.
+ * @param[in]     rd_guid   Origin reader guid.
+ */
+void
+encode_datareader_submsg(
+  struct nn_xmsg *msg,
+  struct nn_xmsg_marker sm_marker,
+  struct proxy_writer *pwr,
+  const struct ddsi_guid *rd_guid);
+
+/**
+ * @brief Encode datawriter submessage when necessary.
+ *
+ * When encoding is necessary, the original submessage will be replaced
+ * by a new encoded submessage.
+ * If the encoding fails, the original submessage will be removed.
+ *
+ * If no encoding is necessary, nothing changes.
+ *
+ * @param[in,out] msg       Complete message.
+ * @param[in,out] sm_marker Submessage location within message.
+ * @param[in]     wr        Origin writer guid.
+ */
+void
+encode_datawriter_submsg(
+  struct nn_xmsg *msg,
+  struct nn_xmsg_marker sm_marker,
+  struct writer *wr);
+
+/**
+ * @brief Check if given submessage is properly decoded.
+ *
+ * When decoding is necessary, it should be checked if a plain submessage was
+ * actually decoded. Otherwise data can be injected just by inserting a plain
+ * submessage directly.
+ *
+ * @param[in] e         Entity information.
+ * @param[in] c         Proxy endpoint information.
+ * @param[in] proxypp   Related proxy participant.
+ * @param[in] rst       Receiver information.
+ * @param[in] prev_smid Previously handled submessage ID.
+ *
+ * @returns bool
+ * @retval true   Decoding succeeded or was not necessary.
+ * @retval false  Decoding was necessary, but not detected.
+ */
+bool
+validate_msg_decoding(
+  const struct entity_common *e,
+  const struct proxy_endpoint_common *c,
+  struct proxy_participant *proxypp,
+  struct receiver_state *rst,
+  SubmessageKind_t prev_smid);
+
+/**
+ * @brief Decode not only SecPrefix, but also the SecBody and SecPostfix
+ * sub-messages.
+ *
+ * When encrypted, the original SecBody will be replaced by the decrypted
+ * submessage. Then the normal sequence can continue as if there was no
+ * encrypted data.
+ *
+ * @param[in]     rst         Receiver information.
+ * @param[in,out] submsg      Pointer to SecPrefix/(SecBody|Submsg)/SecPostfix.
+ * @param[in]     submsg_size Size of SecPrefix submessage.
+ * @param[in]     msg_end     End of the complete message.
+ * @param[in]     src_prefix  Prefix of the source entity.
+ * @param[in]     dst_prefix  Prefix of the destination entity.
+ * @param[in]     byteswap    Do the bytes need swapping?
+ *
+ * @returns int
+ * @retval >= 0   Decoding succeeded.
+ * @retval <  0   Decoding failed.
+ */
+int
+decode_SecPrefix(
+  struct receiver_state *rst,
+  unsigned char *submsg,
+  size_t submsg_size,
+  unsigned char * const msg_end,
+  const ddsi_guid_prefix_t * const src_prefix,
+  const ddsi_guid_prefix_t * const dst_prefix,
+  int byteswap);
+
+/**
+ * @brief Decode the RTPS message.
+ *
+ * When encrypted, the original buffers and information will be replaced
+ * by the decrypted RTPS message. Then the normal sequence can continue
+ * as if there was no encrypted data.
+ *
+ * @param[in]     ts1         Thread information.
+ * @param[in]     gv          Global information.
+ * @param[in,out] rmsg        Message information.
+ * @param[in,out] hdr         Message header.
+ * @param[in,out] buff        Message buffer.
+ * @param[in,out] sz          Message size.
+ * @param[in]     rbpool      Buffers pool.
+ * @param[in]     isstream    Is message a stream variant?
+ *
+ * @returns nn_rtps_msg_state_t
+ * @retval NN_RTPS_MSG_STATE_PLAIN    No decoding was necessary.
+ * @retval NN_RTPS_MSG_STATE_ENCODED  Decoding succeeded.
+ * @retval NN_RTPS_MSG_STATE_ERROR    Decoding failed.
+ */
+nn_rtps_msg_state_t
+decode_rtps_message(
+  struct thread_state1 * const ts1,
+  struct q_globals *gv,
+  struct nn_rmsg **rmsg,
+  Header_t **hdr,
+  unsigned char **buff,
+  ssize_t *sz,
+  struct nn_rbufpool *rbpool,
+  bool isstream);
+
+/**
+ * @brief Send the RTPS message securely.
+ *
+ * @param[in]     conn          Connection to use.
+ * @param[in]     dst           Possible destination information.
+ * @param[in]     niov          Number of io vectors.
+ * @param[in]     iov           Array of io vectors.
+ * @param[in]     flags         Connection write flags.
+ * @param[in,out] msg_len       Submessage containing length.
+ * @param[in]     dst_one       Is there only one specific destination?
+ * @param[in]     sec_info      Security information for handles.
+ * @param[in]     conn_write_cb Function to call to do the actual writing.
+ *
+ * @returns ssize_t
+ * @retval negative/zero    Something went wrong.
+ * @retval positive         Secure writing succeeded.
+ */
+ssize_t
+secure_conn_write(
+    ddsi_tran_conn_t conn,
+    const nn_locator_t *dst,
+    size_t niov,
+    const ddsrt_iovec_t *iov,
+    uint32_t flags,
+    MsgLen_t *msg_len,
+    bool dst_one,
+    nn_msg_sec_info_t *sec_info,
+    ddsi_tran_write_fn_t conn_write_cb);
 
 #else /* DDSI_INCLUDE_SECURITY */
 
 #include "dds/ddsi/q_unused.h"
 
+inline bool
+q_omg_security_enabled(void)
+{
+  return false;
+}
+
 inline bool
 q_omg_participant_is_secure(
   UNUSED_ARG(const struct participant *pp))
@@ -135,7 +522,7 @@ determine_publication_writer(
 }
 
 inline bool
-allow_proxy_participant_deletion(
+is_proxy_participant_deletion_allowed(
   UNUSED_ARG(struct q_globals * const gv),
   UNUSED_ARG(const struct ddsi_guid *guid),
   UNUSED_ARG(const ddsi_entityid_t pwr_entityid))
@@ -143,6 +530,106 @@ allow_proxy_participant_deletion(
   return true;
 }
 
+inline void
+set_proxy_participant_security_info(
+  UNUSED_ARG(struct proxy_participant *prd),
+  UNUSED_ARG(const nn_plist_t *plist))
+{
+}
+
+inline void
+set_proxy_reader_security_info(
+  UNUSED_ARG(struct proxy_reader *prd),
+  UNUSED_ARG(const nn_plist_t *plist))
+{
+}
+
+inline void
+set_proxy_writer_security_info(
+  UNUSED_ARG(struct proxy_writer *pwr),
+  UNUSED_ARG(const nn_plist_t *plist))
+{
+}
+
+
+inline bool
+decode_Data(
+  UNUSED_ARG(const struct q_globals *gv),
+  UNUSED_ARG(struct nn_rsample_info *sampleinfo),
+  UNUSED_ARG(unsigned char *payloadp),
+  UNUSED_ARG(uint32_t payloadsz),
+  UNUSED_ARG(size_t *submsg_len))
+{
+  return true;
+}
+
+inline bool
+decode_DataFrag(
+  UNUSED_ARG(const struct q_globals *gv),
+  UNUSED_ARG(struct nn_rsample_info *sampleinfo),
+  UNUSED_ARG(unsigned char *payloadp),
+  UNUSED_ARG(uint32_t payloadsz),
+  UNUSED_ARG(size_t *submsg_len))
+{
+  return true;
+}
+
+inline void
+encode_datareader_submsg(
+  UNUSED_ARG(struct nn_xmsg *msg),
+  UNUSED_ARG(struct nn_xmsg_marker sm_marker),
+  UNUSED_ARG(struct proxy_writer *pwr),
+  UNUSED_ARG(const struct ddsi_guid *rd_guid))
+{
+}
+
+inline void
+encode_datawriter_submsg(
+  UNUSED_ARG(struct nn_xmsg *msg),
+  UNUSED_ARG(struct nn_xmsg_marker sm_marker),
+  UNUSED_ARG(struct writer *wr))
+{
+}
+
+inline bool
+validate_msg_decoding(
+  UNUSED_ARG(const struct entity_common *e),
+  UNUSED_ARG(const struct proxy_endpoint_common *c),
+  UNUSED_ARG(struct proxy_participant *proxypp),
+  UNUSED_ARG(struct receiver_state *rst),
+  UNUSED_ARG(SubmessageKind_t prev_smid))
+{
+  return true;
+}
+
+inline int
+decode_SecPrefix(
+  UNUSED_ARG(struct receiver_state *rst),
+  UNUSED_ARG(unsigned char *submsg),
+  UNUSED_ARG(size_t submsg_size),
+  UNUSED_ARG(unsigned char * const msg_end),
+  UNUSED_ARG(const ddsi_guid_prefix_t * const src_prefix),
+  UNUSED_ARG(const ddsi_guid_prefix_t * const dst_prefix),
+  UNUSED_ARG(int byteswap))
+{
+  /* Just let the parsing ignore the security sub-messages. */
+  return true;
+}
+
+inline nn_rtps_msg_state_t
+decode_rtps_message(
+  UNUSED_ARG(struct thread_state1 * const ts1),
+  UNUSED_ARG(struct q_globals *gv),
+  UNUSED_ARG(struct nn_rmsg **rmsg),
+  UNUSED_ARG(Header_t **hdr),
+  UNUSED_ARG(unsigned char **buff),
+  UNUSED_ARG(ssize_t *sz),
+  UNUSED_ARG(struct nn_rbufpool *rbpool),
+  UNUSED_ARG(bool isstream))
+{
+  return NN_RTPS_MSG_STATE_PLAIN;
+}
+
 #endif /* DDSI_INCLUDE_SECURITY */
 
 #if defined (__cplusplus)
diff --git a/src/core/ddsi/include/dds/ddsi/q_entity.h b/src/core/ddsi/include/dds/ddsi/q_entity.h
index a694140..d782994 100644
--- a/src/core/ddsi/include/dds/ddsi/q_entity.h
+++ b/src/core/ddsi/include/dds/ddsi/q_entity.h
@@ -16,6 +16,7 @@
 #include "dds/ddsrt/avl.h"
 #include "dds/ddsrt/sync.h"
 #include "dds/ddsi/q_rtps.h"
+#include "dds/ddsi/q_plist.h"
 #include "dds/ddsi/q_protocol.h"
 #include "dds/ddsi/q_lat_estim.h"
 #include "dds/ddsi/q_ephash.h"
@@ -314,6 +315,9 @@ struct proxy_participant
   unsigned proxypp_have_spdp: 1;
   unsigned proxypp_have_cm: 1;
   unsigned owns_lease: 1;
+#ifdef DDSI_INCLUDE_SECURITY
+  nn_security_info_t security_info;
+#endif
 };
 
 /* Representing proxy subscriber & publishers as "groups": until DDSI2
@@ -341,6 +345,9 @@ struct proxy_endpoint_common
   ddsi_guid_t group_guid; /* 0:0:0:0 if not available */
   nn_vendorid_t vendor; /* cached from proxypp->vendor */
   seqno_t seq; /* sequence number of most recent SEDP message */
+#ifdef DDSI_INCLUDE_SECURITY
+  nn_security_info_t security_info;
+#endif
 };
 
 struct proxy_writer {
diff --git a/src/core/ddsi/include/dds/ddsi/q_protocol.h b/src/core/ddsi/include/dds/ddsi/q_protocol.h
index 0fbbc64..3e58cb6 100644
--- a/src/core/ddsi/include/dds/ddsi/q_protocol.h
+++ b/src/core/ddsi/include/dds/ddsi/q_protocol.h
@@ -162,6 +162,12 @@ typedef enum SubmessageKind {
   SMID_HEARTBEAT_FRAG = 0x13,
   SMID_DATA = 0x15,
   SMID_DATA_FRAG = 0x16,
+  /* security-specific sub messages */
+  SMID_SEC_BODY = 0x30,
+  SMID_SEC_PREFIX = 0x31,
+  SMID_SEC_POSTFIX = 0x32,
+  SMID_SRTPS_PREFIX = 0x33,
+  SMID_SRTPS_POSTFIX = 0x34,
   /* vendor-specific sub messages (0x80 .. 0xff) */
   SMID_PT_INFO_CONTAINER = 0x80,
   SMID_PT_MSG_LEN = 0x81,
diff --git a/src/core/ddsi/include/dds/ddsi/q_radmin.h b/src/core/ddsi/include/dds/ddsi/q_radmin.h
index 61814bf..862d1ee 100644
--- a/src/core/ddsi/include/dds/ddsi/q_radmin.h
+++ b/src/core/ddsi/include/dds/ddsi/q_radmin.h
@@ -102,10 +102,11 @@ struct nn_rmsg {
 #define NN_RMSG_PAYLOADOFF(m, o) (NN_RMSG_PAYLOAD (m) + (o))
 
 struct receiver_state {
-  ddsi_guid_prefix_t src_guid_prefix;       /* 12 */
-  ddsi_guid_prefix_t dst_guid_prefix;       /* 12 */
+  ddsi_guid_prefix_t src_guid_prefix;     /* 12 */
+  ddsi_guid_prefix_t dst_guid_prefix;     /* 12 */
   struct addrset *reply_locators;         /* 4/8 */
-  int forme;                              /* 4 */
+  uint32_t forme:1;                       /* 4 */
+  uint32_t rtps_encoded:1;                /* - */
   nn_vendorid_t vendor;                   /* 2 */
   nn_protocol_version_t protocol_version; /* 2 => 44/48 */
   ddsi_tran_conn_t conn;                  /* Connection for request */
diff --git a/src/core/ddsi/include/dds/ddsi/q_xevent.h b/src/core/ddsi/include/dds/ddsi/q_xevent.h
index ab25b3e..c6b9794 100644
--- a/src/core/ddsi/include/dds/ddsi/q_xevent.h
+++ b/src/core/ddsi/include/dds/ddsi/q_xevent.h
@@ -46,8 +46,8 @@ DDS_EXPORT dds_return_t xeventq_start (struct xeventq *evq, const char *name); /
 DDS_EXPORT void xeventq_stop (struct xeventq *evq);
 
 DDS_EXPORT void qxev_msg (struct xeventq *evq, struct nn_xmsg *msg);
-DDS_EXPORT void qxev_pwr_entityid (struct proxy_writer * pwr, ddsi_guid_prefix_t * id);
-DDS_EXPORT void qxev_prd_entityid (struct proxy_reader * prd, ddsi_guid_prefix_t * id);
+DDS_EXPORT void qxev_pwr_entityid (struct proxy_writer * pwr, const ddsi_guid_t *guid);
+DDS_EXPORT void qxev_prd_entityid (struct proxy_reader * prd, const ddsi_guid_t *guid);
 
 /* Returns 1 if queued, 0 otherwise (no point in returning the
    event, you can't do anything with it anyway) */
diff --git a/src/core/ddsi/include/dds/ddsi/q_xmsg.h b/src/core/ddsi/include/dds/ddsi/q_xmsg.h
index 78463a7..24f32b0 100644
--- a/src/core/ddsi/include/dds/ddsi/q_xmsg.h
+++ b/src/core/ddsi/include/dds/ddsi/q_xmsg.h
@@ -26,6 +26,8 @@ struct ddsi_serdata;
 struct addrset;
 struct proxy_reader;
 struct proxy_writer;
+struct writer;
+struct participant;
 
 struct nn_prismtech_participant_version_info;
 struct nn_xmsgpool;
@@ -54,10 +56,11 @@ void nn_xmsgpool_free (struct nn_xmsgpool *pool);
 /* To allocate a new xmsg from the pool; if expected_size is NOT
    exceeded, no reallocs will be performed, else the address of the
    xmsg may change because of reallocing when appending to it. */
-struct nn_xmsg *nn_xmsg_new (struct nn_xmsgpool *pool, const ddsi_guid_prefix_t *src_guid_prefix, size_t expected_size, enum nn_xmsg_kind kind);
+struct nn_xmsg *nn_xmsg_new (struct nn_xmsgpool *pool, const ddsi_guid_t *src_guid, struct participant *pp, size_t expected_size, enum nn_xmsg_kind kind);
 
 /* For sending to a particular destination (participant) */
-void nn_xmsg_setdst1 (struct nn_xmsg *m, const ddsi_guid_prefix_t *gp, const nn_locator_t *addr);
+void nn_xmsg_setdst1 (struct q_globals *gv, struct nn_xmsg *m, const ddsi_guid_prefix_t *gp, const nn_locator_t *addr);
+bool nn_xmsg_getdst1prefix (struct nn_xmsg *m, ddsi_guid_prefix_t *gp);
 
 /* For sending to a particular proxy reader; this is a convenience
    routine that extracts a suitable address from the proxy reader's
@@ -114,7 +117,13 @@ void nn_xmsg_guid_seq_fragid (const struct nn_xmsg *m, ddsi_guid_t *wrguid, seqn
 void *nn_xmsg_submsg_from_marker (struct nn_xmsg *msg, struct nn_xmsg_marker marker);
 void *nn_xmsg_append (struct nn_xmsg *m, struct nn_xmsg_marker *marker, size_t sz);
 void nn_xmsg_shrink (struct nn_xmsg *m, struct nn_xmsg_marker marker, size_t sz);
-void nn_xmsg_serdata (struct nn_xmsg *m, struct ddsi_serdata *serdata, size_t off, size_t len);
+void nn_xmsg_serdata (struct nn_xmsg *m, struct ddsi_serdata *serdata, size_t off, size_t len, struct writer *wr);
+#ifdef DDSI_INCLUDE_SECURITY
+size_t nn_xmsg_submsg_size (struct nn_xmsg *msg, struct nn_xmsg_marker marker);
+void nn_xmsg_submsg_remove (struct nn_xmsg *msg, struct nn_xmsg_marker sm_marker);
+void nn_xmsg_submsg_replace (struct nn_xmsg *msg, struct nn_xmsg_marker sm_marker, unsigned char *new_submsg, size_t new_len);
+void nn_xmsg_submsg_append_refd_payload (struct nn_xmsg *msg, struct nn_xmsg_marker sm_marker);
+#endif
 void nn_xmsg_submsg_setnext (struct nn_xmsg *msg, struct nn_xmsg_marker marker);
 void nn_xmsg_submsg_init (struct nn_xmsg *msg, struct nn_xmsg_marker marker, SubmessageKind_t smkind);
 void nn_xmsg_add_timestamp (struct nn_xmsg *m, nn_wctime_t t);
diff --git a/src/core/ddsi/src/ddsi_security_omg.c b/src/core/ddsi/src/ddsi_security_omg.c
index 8e04eb3..b471fb7 100644
--- a/src/core/ddsi/src/ddsi_security_omg.c
+++ b/src/core/ddsi/src/ddsi_security_omg.c
@@ -14,9 +14,73 @@
 #include <string.h>
 
 #include "dds/ddsrt/misc.h"
+#include "dds/ddsrt/heap.h"
+#include "dds/ddsrt/bswap.h"
+#include "dds/ddsrt/string.h"
+#include "dds/ddsrt/process.h"
 
+#include "dds/ddsi/q_bswap.h"
 #include "dds/ddsi/q_unused.h"
+#include "dds/ddsi/q_radmin.h"
 #include "dds/ddsi/ddsi_security_omg.h"
+#include "dds/ddsi/ddsi_sertopic.h"
+
+
+
+static bool
+q_omg_writer_is_payload_protected(
+  const struct writer *wr);
+
+
+
+static bool endpoint_is_DCPSParticipantSecure(const ddsi_guid_t *guid)
+{
+  return ((guid->entityid.u == NN_ENTITYID_SPDP_RELIABLE_BUILTIN_PARTICIPANT_SECURE_WRITER) ||
+          (guid->entityid.u == NN_ENTITYID_SPDP_RELIABLE_BUILTIN_PARTICIPANT_SECURE_READER) );
+}
+
+static bool endpoint_is_DCPSPublicationsSecure(const ddsi_guid_t *guid)
+{
+  return ((guid->entityid.u == NN_ENTITYID_SEDP_BUILTIN_PUBLICATIONS_SECURE_WRITER) ||
+          (guid->entityid.u == NN_ENTITYID_SEDP_BUILTIN_PUBLICATIONS_SECURE_READER) );
+}
+
+static bool endpoint_is_DCPSSubscriptionsSecure(const ddsi_guid_t *guid)
+{
+  return ((guid->entityid.u == NN_ENTITYID_SEDP_BUILTIN_SUBSCRIPTIONS_SECURE_WRITER) ||
+          (guid->entityid.u == NN_ENTITYID_SEDP_BUILTIN_SUBSCRIPTIONS_SECURE_READER) );
+}
+
+static bool endpoint_is_DCPSParticipantStatelessMessage(const ddsi_guid_t *guid)
+{
+  return ((guid->entityid.u == NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_STATELESS_MESSAGE_WRITER) ||
+          (guid->entityid.u == NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_STATELESS_MESSAGE_READER) );
+}
+
+static bool endpoint_is_DCPSParticipantMessageSecure(const ddsi_guid_t *guid)
+{
+  return ((guid->entityid.u == NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_MESSAGE_SECURE_WRITER) ||
+          (guid->entityid.u == NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_MESSAGE_SECURE_READER) );
+}
+
+static bool endpoint_is_DCPSParticipantVolatileMessageSecure(const ddsi_guid_t *guid)
+{
+#if 1
+  /* TODO: volatile endpoint. */
+  DDSRT_UNUSED_ARG(guid);
+  return false;
+#else
+  return ((guid->entityid.u == NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_VOLATILE_SECURE_WRITER) ||
+          (guid->entityid.u == NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_VOLATILE_SECURE_READER) );
+#endif
+}
+
+
+bool
+q_omg_security_enabled(void)
+{
+  return false;
+}
 
 bool
 q_omg_participant_is_secure(
@@ -54,9 +118,18 @@ q_omg_get_writer_security_info(
   assert(info);
   /* TODO: Register local writer. */
   DDSRT_UNUSED_ARG(wr);
+
   info->plugin_security_attributes = 0;
-  info->security_attributes = 0;
-  return false;
+  if (q_omg_writer_is_payload_protected(wr))
+  {
+    info->security_attributes = NN_ENDPOINT_SECURITY_ATTRIBUTES_FLAG_IS_VALID|
+                                NN_ENDPOINT_SECURITY_ATTRIBUTES_FLAG_IS_PAYLOAD_PROTECTED;
+  }
+  else
+  {
+    info->security_attributes = 0;
+  }
+  return true;
 }
 
 bool
@@ -75,11 +148,29 @@ q_omg_get_reader_security_info(
 
 static bool
 q_omg_proxyparticipant_is_authenticated(
+  const struct proxy_participant *proxy_pp)
+{
+  /* TODO: Handshake */
+  DDSRT_UNUSED_ARG(proxy_pp);
+  return false;
+}
+
+int64_t
+q_omg_security_get_local_participant_handle(
+  struct participant *pp)
+{
+  /* TODO: Local registration */
+  DDSRT_UNUSED_ARG(pp);
+  return 0;
+}
+
+int64_t
+q_omg_security_get_remote_participant_handle(
   struct proxy_participant *proxypp)
 {
   /* TODO: Handshake */
   DDSRT_UNUSED_ARG(proxypp);
-  return false;
+  return 0;
 }
 
 unsigned
@@ -105,7 +196,7 @@ determine_publication_writer(
 }
 
 bool
-allow_proxy_participant_deletion(
+is_proxy_participant_deletion_allowed(
   struct q_globals * const gv,
   const struct ddsi_guid *guid,
   const ddsi_entityid_t pwr_entityid)
@@ -130,19 +221,1040 @@ allow_proxy_participant_deletion(
   return (!q_omg_proxyparticipant_is_authenticated(proxypp));
 }
 
+bool
+q_omg_security_is_remote_rtps_protected(
+  struct proxy_participant *proxy_pp,
+  ddsi_entityid_t entityid)
+{
+  /* TODO: Handshake */
+  DDSRT_UNUSED_ARG(proxy_pp);
+  DDSRT_UNUSED_ARG(entityid);
+  return false;
+}
+
+bool
+q_omg_security_is_local_rtps_protected(
+  struct participant *pp,
+  ddsi_entityid_t entityid)
+{
+  /* TODO: Handshake */
+  DDSRT_UNUSED_ARG(pp);
+  DDSRT_UNUSED_ARG(entityid);
+  return false;
+}
+
+void
+set_proxy_participant_security_info(
+  struct proxy_participant *proxypp,
+  const nn_plist_t *plist)
+{
+  assert(proxypp);
+  assert(plist);
+  if (plist->present & PP_PARTICIPANT_SECURITY_INFO) {
+    proxypp->security_info.security_attributes = plist->participant_security_info.security_attributes;
+    proxypp->security_info.plugin_security_attributes = plist->participant_security_info.plugin_security_attributes;
+  } else {
+    proxypp->security_info.security_attributes = 0;
+    proxypp->security_info.plugin_security_attributes = 0;
+  }
+}
+
+static void
+q_omg_get_proxy_endpoint_security_info(
+  const struct entity_common *entity,
+  nn_security_info_t *proxypp_sec_info,
+  const nn_plist_t *plist,
+  nn_security_info_t *info)
+{
+  bool proxypp_info_available;
+
+  proxypp_info_available = (proxypp_sec_info->security_attributes != 0) ||
+                           (proxypp_sec_info->plugin_security_attributes != 0);
+
+  /*
+   * If Security info is present, use that.
+   * Otherwise, use the specified values for the secure builtin endpoints.
+   *      (Table 20 – EndpointSecurityAttributes for all "Builtin Security Endpoints")
+   * Otherwise, reset.
+   */
+  if (plist->present & PP_ENDPOINT_SECURITY_INFO)
+  {
+    info->security_attributes = plist->endpoint_security_info.security_attributes;
+    info->plugin_security_attributes = plist->endpoint_security_info.plugin_security_attributes;
+  }
+  else if (endpoint_is_DCPSParticipantSecure(&(entity->guid)) ||
+           endpoint_is_DCPSPublicationsSecure(&(entity->guid)) ||
+           endpoint_is_DCPSSubscriptionsSecure(&(entity->guid)) )
+  {
+    info->plugin_security_attributes = NN_ENDPOINT_SECURITY_ATTRIBUTES_FLAG_IS_VALID;
+    info->security_attributes = NN_ENDPOINT_SECURITY_ATTRIBUTES_FLAG_IS_VALID;
+    if (proxypp_info_available)
+    {
+      if (proxypp_sec_info->security_attributes & NN_PARTICIPANT_SECURITY_ATTRIBUTES_FLAG_IS_DISCOVERY_PROTECTED)
+      {
+        info->security_attributes |= NN_ENDPOINT_SECURITY_ATTRIBUTES_FLAG_IS_SUBMESSAGE_PROTECTED;
+      }
+      if (proxypp_sec_info->plugin_security_attributes & NN_PLUGIN_PARTICIPANT_SECURITY_ATTRIBUTES_FLAG_IS_DISCOVERY_ENCRYPTED)
+      {
+        info->plugin_security_attributes |= NN_PLUGIN_ENDPOINT_SECURITY_ATTRIBUTES_FLAG_IS_SUBMESSAGE_ENCRYPTED;
+      }
+      if (proxypp_sec_info->plugin_security_attributes & NN_PLUGIN_PARTICIPANT_SECURITY_ATTRIBUTES_FLAG_IS_DISCOVERY_AUTHENTICATED)
+      {
+        info->plugin_security_attributes |= NN_PLUGIN_ENDPOINT_SECURITY_ATTRIBUTES_FLAG_IS_SUBMESSAGE_ORIGIN_AUTHENTICATED;
+      }
+    }
+    else
+    {
+      /* No participant info: assume hardcoded OpenSplice V6.10.0 values. */
+      info->security_attributes |= NN_ENDPOINT_SECURITY_ATTRIBUTES_FLAG_IS_SUBMESSAGE_PROTECTED;
+      info->plugin_security_attributes |= NN_PLUGIN_ENDPOINT_SECURITY_ATTRIBUTES_FLAG_IS_SUBMESSAGE_ENCRYPTED;
+    }
+  }
+  else if (endpoint_is_DCPSParticipantMessageSecure(&(entity->guid)))
+  {
+    info->plugin_security_attributes = NN_ENDPOINT_SECURITY_ATTRIBUTES_FLAG_IS_VALID;
+    info->security_attributes = NN_ENDPOINT_SECURITY_ATTRIBUTES_FLAG_IS_VALID;
+    if (proxypp_info_available)
+    {
+      if (proxypp_sec_info->security_attributes & NN_PARTICIPANT_SECURITY_ATTRIBUTES_FLAG_IS_LIVELINESS_PROTECTED)
+      {
+        info->security_attributes |= NN_ENDPOINT_SECURITY_ATTRIBUTES_FLAG_IS_SUBMESSAGE_PROTECTED;
+      }
+      if (proxypp_sec_info->plugin_security_attributes & NN_PLUGIN_PARTICIPANT_SECURITY_ATTRIBUTES_FLAG_IS_LIVELINESS_ENCRYPTED)
+      {
+        info->plugin_security_attributes |= NN_PLUGIN_ENDPOINT_SECURITY_ATTRIBUTES_FLAG_IS_SUBMESSAGE_ENCRYPTED;
+      }
+      if (proxypp_sec_info->plugin_security_attributes & NN_PLUGIN_PARTICIPANT_SECURITY_ATTRIBUTES_FLAG_IS_LIVELINESS_AUTHENTICATED)
+      {
+        info->plugin_security_attributes |= NN_PLUGIN_ENDPOINT_SECURITY_ATTRIBUTES_FLAG_IS_SUBMESSAGE_ORIGIN_AUTHENTICATED;
+      }
+    }
+    else
+    {
+      /* No participant info: assume hardcoded OpenSplice V6.10.0 values. */
+      info->security_attributes |= NN_ENDPOINT_SECURITY_ATTRIBUTES_FLAG_IS_SUBMESSAGE_PROTECTED;
+      info->plugin_security_attributes |= NN_PLUGIN_ENDPOINT_SECURITY_ATTRIBUTES_FLAG_IS_SUBMESSAGE_ENCRYPTED;
+    }
+  }
+  else if (endpoint_is_DCPSParticipantStatelessMessage(&(entity->guid)))
+  {
+    info->security_attributes = NN_ENDPOINT_SECURITY_ATTRIBUTES_FLAG_IS_VALID;
+    info->plugin_security_attributes = 0;
+  }
+  else if (endpoint_is_DCPSParticipantVolatileMessageSecure(&(entity->guid)))
+  {
+    info->security_attributes = NN_ENDPOINT_SECURITY_ATTRIBUTES_FLAG_IS_VALID |
+                                NN_ENDPOINT_SECURITY_ATTRIBUTES_FLAG_IS_SUBMESSAGE_PROTECTED;
+    info->plugin_security_attributes = 0;
+  }
+  else
+  {
+    info->security_attributes = 0;
+    info->plugin_security_attributes = 0;
+  }
+}
+
+void
+set_proxy_reader_security_info(
+  struct proxy_reader *prd,
+  const nn_plist_t *plist)
+{
+  assert(prd);
+  q_omg_get_proxy_endpoint_security_info(&(prd->e),
+                                         &(prd->c.proxypp->security_info),
+                                         plist,
+                                         &(prd->c.security_info));
+}
+
+void
+set_proxy_writer_security_info(
+  struct proxy_writer *pwr,
+  const nn_plist_t *plist)
+{
+  assert(pwr);
+  q_omg_get_proxy_endpoint_security_info(&(pwr->e),
+                                         &(pwr->c.proxypp->security_info),
+                                         plist,
+                                         &(pwr->c.security_info));
+}
+
+
+static bool
+q_omg_security_encode_datareader_submessage(
+  struct reader            *rd,
+  const ddsi_guid_prefix_t *dst_prefix,
+  const unsigned char      *src_buf,
+  const unsigned int        src_len,
+  unsigned char           **dst_buf,
+  unsigned int             *dst_len)
+{
+  /* TODO: Use proper keys to actually encode (need key-exchange). */
+  DDSRT_UNUSED_ARG(rd);
+  DDSRT_UNUSED_ARG(dst_prefix);
+  DDSRT_UNUSED_ARG(src_buf);
+  DDSRT_UNUSED_ARG(src_len);
+  DDSRT_UNUSED_ARG(dst_buf);
+  DDSRT_UNUSED_ARG(dst_len);
+  return false;
+}
+
+static bool
+q_omg_security_encode_datawriter_submessage(
+  struct writer            *wr,
+  const ddsi_guid_prefix_t *dst_prefix,
+  const unsigned char      *src_buf,
+  const unsigned int        src_len,
+  unsigned char           **dst_buf,
+  unsigned int             *dst_len)
+{
+  /* TODO: Use proper keys to actually encode (need key-exchange). */
+  DDSRT_UNUSED_ARG(wr);
+  DDSRT_UNUSED_ARG(dst_prefix);
+  DDSRT_UNUSED_ARG(src_buf);
+  DDSRT_UNUSED_ARG(src_len);
+  DDSRT_UNUSED_ARG(dst_buf);
+  DDSRT_UNUSED_ARG(dst_len);
+  return false;
+}
+
+static bool
+q_omg_security_decode_submessage(
+  const ddsi_guid_prefix_t* const src_prefix,
+  const ddsi_guid_prefix_t* const dst_prefix,
+  const unsigned char   *src_buf,
+  const unsigned int     src_len,
+  unsigned char        **dst_buf,
+  unsigned int          *dst_len)
+{
+  /* TODO: Use proper keys to actually decode (need key-exchange). */
+  DDSRT_UNUSED_ARG(src_prefix);
+  DDSRT_UNUSED_ARG(dst_prefix);
+  DDSRT_UNUSED_ARG(src_buf);
+  DDSRT_UNUSED_ARG(src_len);
+  DDSRT_UNUSED_ARG(dst_buf);
+  DDSRT_UNUSED_ARG(dst_len);
+  return false;
+}
+
+static bool
+q_omg_security_encode_serialized_payload(
+  const struct writer *wr,
+  const unsigned char *src_buf,
+  const unsigned int   src_len,
+  unsigned char     **dst_buf,
+  unsigned int       *dst_len)
+{
+  /* TODO: Use proper keys to actually encode (need key-exchange). */
+  DDSRT_UNUSED_ARG(wr);
+  DDSRT_UNUSED_ARG(src_buf);
+  DDSRT_UNUSED_ARG(src_len);
+  DDSRT_UNUSED_ARG(dst_buf);
+  DDSRT_UNUSED_ARG(dst_len);
+  return false;
+}
+
+static bool
+q_omg_security_decode_serialized_payload(
+  struct proxy_writer *pwr,
+  const unsigned char *src_buf,
+  const unsigned int   src_len,
+  unsigned char     **dst_buf,
+  unsigned int       *dst_len)
+{
+  /* TODO: Use proper keys to actually decode (need key-exchange). */
+  DDSRT_UNUSED_ARG(pwr);
+  DDSRT_UNUSED_ARG(src_buf);
+  DDSRT_UNUSED_ARG(src_len);
+  DDSRT_UNUSED_ARG(dst_buf);
+  DDSRT_UNUSED_ARG(dst_len);
+  return false;
+}
+
+bool
+q_omg_security_encode_rtps_message(
+  int64_t                 src_handle,
+  ddsi_guid_t            *src_guid,
+  const unsigned char    *src_buf,
+  const unsigned int      src_len,
+  unsigned char        **dst_buf,
+  unsigned int          *dst_len,
+  int64_t                dst_handle)
+{
+  /* TODO: Use proper keys to actually encode (need key-exchange). */
+  DDSRT_UNUSED_ARG(src_handle);
+  DDSRT_UNUSED_ARG(src_guid);
+  DDSRT_UNUSED_ARG(src_buf);
+  DDSRT_UNUSED_ARG(src_len);
+  DDSRT_UNUSED_ARG(dst_buf);
+  DDSRT_UNUSED_ARG(dst_len);
+  DDSRT_UNUSED_ARG(dst_handle);
+  return false;
+}
+
+static bool
+q_omg_security_decode_rtps_message(
+  struct proxy_participant *proxypp,
+  const unsigned char      *src_buf,
+  const unsigned int        src_len,
+  unsigned char          **dst_buf,
+  unsigned int            *dst_len)
+{
+  /* TODO: Use proper keys to actually decode (need key-exchange). */
+  DDSRT_UNUSED_ARG(proxypp);
+  DDSRT_UNUSED_ARG(src_buf);
+  DDSRT_UNUSED_ARG(src_len);
+  DDSRT_UNUSED_ARG(dst_buf);
+  DDSRT_UNUSED_ARG(dst_len);
+  return false;
+}
+
+static bool
+q_omg_writer_is_payload_protected(
+  const struct writer *wr)
+{
+  /* TODO: Local registration. */
+  DDSRT_UNUSED_ARG(wr);
+  return false;
+}
+
+static bool
+q_omg_writer_is_submessage_protected(
+  struct writer *wr)
+{
+  /* TODO: Local registration. */
+  DDSRT_UNUSED_ARG(wr);
+  return false;
+}
+
+static bool
+q_omg_reader_is_submessage_protected(
+  struct reader *rd)
+{
+  /* TODO: Local registration. */
+  DDSRT_UNUSED_ARG(rd);
+  return false;
+}
+
+bool
+encode_payload(
+  struct writer *wr,
+  ddsrt_iovec_t *vec,
+  unsigned char **buf)
+{
+  bool ok = true;
+  *buf = NULL;
+  if (q_omg_writer_is_payload_protected(wr))
+  {
+    /* Encrypt the data. */
+    unsigned char *enc_buf;
+    unsigned int   enc_len;
+    ok = q_omg_security_encode_serialized_payload(
+                    wr,
+                    vec->iov_base,
+                    (unsigned int)vec->iov_len,
+                    &enc_buf,
+                    &enc_len);
+    if (ok)
+    {
+      /* Replace the iov buffer, which should always be aliased. */
+      vec->iov_base = (char *)enc_buf;
+      vec->iov_len = enc_len;
+      /* Remember the pointer to be able to free the memory. */
+      *buf = enc_buf;
+    }
+  }
+  return ok;
+}
+
+
+static bool
+decode_payload(
+  const struct q_globals *gv,
+  struct nn_rsample_info *sampleinfo,
+  unsigned char *payloadp,
+  uint32_t *payloadsz,
+  size_t *submsg_len)
+{
+  bool ok = true;
+
+  assert(payloadp);
+  assert(payloadsz);
+  assert(*payloadsz);
+  assert(submsg_len);
+  assert(sampleinfo);
+
+  if (sampleinfo->pwr == NULL)
+  {
+    /* No specified proxy writer means no encoding. */
+    return true;
+  }
+
+  /* Only decode when the attributes tell us so. */
+  if ((sampleinfo->pwr->c.security_info.security_attributes & NN_ENDPOINT_SECURITY_ATTRIBUTES_FLAG_IS_PAYLOAD_PROTECTED)
+                                                           == NN_ENDPOINT_SECURITY_ATTRIBUTES_FLAG_IS_PAYLOAD_PROTECTED)
+  {
+    unsigned char *dst_buf = NULL;
+    unsigned int   dst_len = 0;
+
+    /* Decrypt the payload. */
+    if (q_omg_security_decode_serialized_payload(sampleinfo->pwr, payloadp, *payloadsz, &dst_buf, &dst_len))
+    {
+      /* Expect result to always fit into the original buffer. */
+      assert(*payloadsz >= dst_len);
+
+      /* Reduce submessage and payload lengths. */
+      *submsg_len -= (*payloadsz - dst_len);
+      *payloadsz   = dst_len;
+
+      /* Replace the encrypted payload with the decrypted. */
+      memcpy(payloadp, dst_buf, dst_len);
+      ddsrt_free(dst_buf);
+    }
+    else
+    {
+      GVWARNING("decode_payload: failed to decrypt data from "PGUIDFMT"", PGUID (sampleinfo->pwr->e.guid));
+      ok = false;
+    }
+  }
+
+  return ok;
+}
+
+bool
+decode_Data(
+  const struct q_globals *gv,
+  struct nn_rsample_info *sampleinfo,
+  unsigned char *payloadp,
+  uint32_t payloadsz,
+  size_t *submsg_len)
+{
+  int ok = true;
+  /* Only decode when there's actual data. */
+  if (payloadp && (payloadsz > 0))
+  {
+    ok = decode_payload(gv, sampleinfo, payloadp, &payloadsz, submsg_len);
+    if (ok)
+    {
+      /* It's possible that the payload size (and thus the sample size) has been reduced. */
+      sampleinfo->size = payloadsz;
+    }
+  }
+  return ok;
+}
+
+bool
+decode_DataFrag(
+  const struct q_globals *gv,
+  struct nn_rsample_info *sampleinfo,
+  unsigned char *payloadp,
+  uint32_t payloadsz,
+  size_t *submsg_len)
+{
+  int ok = true;
+  /* Only decode when there's actual data. */
+  if (payloadp && (payloadsz > 0))
+  {
+    ok = decode_payload(gv, sampleinfo, payloadp, &payloadsz, submsg_len);
+    /* Do not touch the sampleinfo->size in contradiction to decode_Data() (it has been calculated differently). */
+  }
+  return ok;
+}
+
+
+void
+encode_datareader_submsg(
+  struct nn_xmsg *msg,
+  struct nn_xmsg_marker sm_marker,
+  struct proxy_writer *pwr,
+  const struct ddsi_guid *rd_guid)
+{
+  /* Only encode when needed. */
+  if (q_omg_security_enabled())
+  {
+    struct reader *rd = ephash_lookup_reader_guid(pwr->e.gv->guid_hash, rd_guid);
+    if (rd)
+    {
+      if (q_omg_reader_is_submessage_protected(rd))
+      {
+        unsigned char *src_buf;
+        unsigned int   src_len;
+        unsigned char *dst_buf;
+        unsigned int   dst_len;
+
+        /* Make one blob of the current sub-message by appending the serialized payload. */
+        nn_xmsg_submsg_append_refd_payload(msg, sm_marker);
+
+        /* Get the sub-message buffer. */
+        src_buf = (unsigned char*)nn_xmsg_submsg_from_marker(msg, sm_marker);
+        src_len = (unsigned int)nn_xmsg_submsg_size(msg, sm_marker);
+
+        /* Do the actual encryption. */
+        if (q_omg_security_encode_datareader_submessage(rd, &(pwr->e.guid.prefix), src_buf, src_len, &dst_buf, &dst_len))
+        {
+          /* Replace the old sub-message with the new encoded one(s). */
+          nn_xmsg_submsg_replace(msg, sm_marker, dst_buf, dst_len);
+          ddsrt_free(dst_buf);
+        }
+        else
+        {
+          /* The sub-message should have been encoded, which failed.
+           * Remove it to prevent it from being send. */
+          nn_xmsg_submsg_remove(msg, sm_marker);
+        }
+      }
+    }
+  }
+}
+
+
+void
+encode_datawriter_submsg(
+  struct nn_xmsg *msg,
+  struct nn_xmsg_marker sm_marker,
+  struct writer *wr)
+{
+  /* Only encode when needed. */
+  if (q_omg_security_enabled())
+  {
+    if (q_omg_writer_is_submessage_protected(wr))
+    {
+      unsigned char *src_buf;
+      unsigned int   src_len;
+      unsigned char *dst_buf;
+      unsigned int   dst_len;
+      ddsi_guid_prefix_t dst_guid_prefix;
+      ddsi_guid_prefix_t *dst = NULL;
+
+      /* Make one blob of the current sub-message by appending the serialized payload. */
+      nn_xmsg_submsg_append_refd_payload(msg, sm_marker);
+
+      /* Get the sub-message buffer. */
+      src_buf = (unsigned char*)nn_xmsg_submsg_from_marker(msg, sm_marker);
+      src_len = (unsigned int)nn_xmsg_submsg_size(msg, sm_marker);
+
+      if (nn_xmsg_getdst1prefix(msg, &dst_guid_prefix))
+      {
+        dst = &dst_guid_prefix;
+      }
+
+      /* Do the actual encryption. */
+      if (q_omg_security_encode_datawriter_submessage(wr, dst, src_buf, src_len, &dst_buf, &dst_len))
+      {
+        /* Replace the old sub-message with the new encoded one(s). */
+        nn_xmsg_submsg_replace(msg, sm_marker, dst_buf, dst_len);
+        ddsrt_free(dst_buf);
+      }
+      else
+      {
+        /* The sub-message should have been encoded, which failed.
+         * Remove it to prevent it from being send. */
+        nn_xmsg_submsg_remove(msg, sm_marker);
+      }
+    }
+  }
+}
+
+
+
+bool
+validate_msg_decoding(
+  const struct entity_common *e,
+  const struct proxy_endpoint_common *c,
+  struct proxy_participant *proxypp,
+  struct receiver_state *rst,
+  SubmessageKind_t prev_smid)
+{
+  assert(e);
+  assert(c);
+  assert(proxypp);
+  assert(rst);
+
+  /* If this endpoint is expected to have submessages protected, it means that the
+   * previous submessage id (prev_smid) has to be SMID_SEC_PREFIX. That caused the
+   * protected submessage to be copied into the current RTPS message as a clear
+   * submessage, which we are currently handling.
+   * However, we have to check if the prev_smid is actually SMID_SEC_PREFIX, otherwise
+   * a rascal can inject data as just a clear submessage. */
+  if ((c->security_info.security_attributes & NN_ENDPOINT_SECURITY_ATTRIBUTES_FLAG_IS_SUBMESSAGE_PROTECTED)
+                                           == NN_ENDPOINT_SECURITY_ATTRIBUTES_FLAG_IS_SUBMESSAGE_PROTECTED)
+  {
+    if (prev_smid != SMID_SEC_PREFIX)
+    {
+      return false;
+    }
+  }
+
+  /* At this point, we should also check if the complete RTPS message was encoded when
+   * that is expected. */
+  if (q_omg_security_is_remote_rtps_protected(proxypp, e->guid.entityid) && !rst->rtps_encoded)
+  {
+    return 0;
+  }
+
+  return true;
+}
+
+static int
+validate_submsg(struct q_globals *gv, unsigned char smid, unsigned char *submsg, unsigned char * const end, int byteswap)
+{
+  int result = -1;
+  if ((submsg + RTPS_SUBMESSAGE_HEADER_SIZE) <= end)
+  {
+    SubmessageHeader_t *hdr = (SubmessageHeader_t*)submsg;
+    if ((smid == 0 /* don't care */) || (hdr->submessageId == smid))
+    {
+      unsigned short size = hdr->octetsToNextHeader;
+      if (byteswap)
+      {
+         size = ddsrt_bswap2u(size);
+      }
+      result = (int)size + (int)RTPS_SUBMESSAGE_HEADER_SIZE;
+      if ((submsg + result) > end)
+      {
+        result = -1;
+      }
+    }
+    else
+    {
+      GVWARNING("Unexpected submsg 0x%02x (0x%02x expected)", hdr->submessageId, smid);
+    }
+  }
+  else
+  {
+    GVWARNING("Submsg 0x%02x does not fit message", smid);
+  }
+  return result;
+}
+
+
+static int
+padding_submsg(struct q_globals *gv, unsigned char *start, unsigned char *end, int byteswap)
+{
+  SubmessageHeader_t *padding = (SubmessageHeader_t*)start;
+  size_t size = (size_t)(end - start);
+  int result = -1;
+
+  assert(start <= end);
+
+  if (size > sizeof(SubmessageHeader_t))
+  {
+    result = (int)size;
+    padding->submessageId = SMID_PAD;
+    padding->flags = (byteswap ? !(DDSRT_ENDIAN == DDSRT_LITTLE_ENDIAN) : (DDSRT_ENDIAN == DDSRT_LITTLE_ENDIAN));
+    padding->octetsToNextHeader = (unsigned short)(size - sizeof(SubmessageHeader_t));
+    if (byteswap)
+    {
+      padding->octetsToNextHeader = ddsrt_bswap2u(padding->octetsToNextHeader);
+    }
+  }
+  else
+  {
+    GVWARNING("Padding submessage doesn't fit");
+  }
+  return result;
+}
+
+int
+decode_SecPrefix(
+  struct receiver_state *rst,
+  unsigned char *submsg,
+  size_t submsg_size,
+  unsigned char * const msg_end,
+  const ddsi_guid_prefix_t * const src_prefix,
+  const ddsi_guid_prefix_t * const dst_prefix,
+  int byteswap)
+{
+  int result = -1;
+  int totalsize = (int)submsg_size;
+  unsigned char *body_submsg;
+  unsigned char *prefix_submsg;
+  unsigned char *postfix_submsg;
+  SubmessageHeader_t *hdr = (SubmessageHeader_t*)submsg;
+  uint8_t flags = hdr->flags;
+
+  if (byteswap)
+  {
+    if ((DDSRT_ENDIAN == DDSRT_LITTLE_ENDIAN))
+      hdr->flags |= 0x01;
+    else
+      hdr->flags &= 0xFE;
+  }
+
+  /* First sub-message is the SEC_PREFIX. */
+  prefix_submsg = submsg;
+
+  /* Next sub-message is SEC_BODY when encrypted or the original submessage when only signed. */
+  body_submsg = submsg + submsg_size;
+  result = validate_submsg(rst->gv, 0 /* don't care smid */, body_submsg, msg_end, byteswap);
+  if (result > 0)
+  {
+    totalsize += result;
+
+    /* Third sub-message should be the SEC_POSTFIX. */
+    postfix_submsg = submsg + totalsize;
+    result = validate_submsg(rst->gv, SMID_SEC_POSTFIX, postfix_submsg, msg_end, byteswap);
+    if (result > 0)
+    {
+      bool decoded;
+      unsigned char *dst_buf;
+      unsigned int   dst_len;
+
+      totalsize += result;
+
+      /* Decode all three submessages. */
+      decoded = q_omg_security_decode_submessage(src_prefix, dst_prefix, submsg, (unsigned int)totalsize, &dst_buf, &dst_len);
+      if (decoded && dst_buf)
+      {
+        /*
+         * The 'normal' submessage sequence handling will continue after the
+         * given security SEC_PREFIX.
+         */
+        if (*body_submsg == SMID_SEC_BODY)
+        {
+          /*
+           * Copy the decoded buffer into the original message, replacing (part
+           * of) SEC_BODY.
+           *
+           * By replacing the SEC_BODY with the decoded submessage, everything
+           * can continue as if there was never an encoded submessage.
+           */
+          assert((int)dst_len <= ((int)totalsize - (int)submsg_size));
+          memcpy(body_submsg, dst_buf, dst_len);
+
+          /* Remainder of SEC_BODY & SEC_POSTFIX should be padded to keep the submsg sequence going. */
+          result = padding_submsg(rst->gv, body_submsg + dst_len, prefix_submsg + totalsize, byteswap);
+        }
+        else
+        {
+          /*
+           * When only signed, then the submessage is already available and
+           * SMID_SEC_POSTFIX will be ignored.
+           * So, we don't really have to do anything.
+           */
+        }
+        ddsrt_free(dst_buf);
+      }
+      else
+      {
+        /*
+         * Decoding or signing failed.
+         *
+         * Replace the security submessages with padding. This also removes a plain
+         * submessage when a signature check failed.
+         */
+        result = padding_submsg(rst->gv, body_submsg, prefix_submsg + totalsize, byteswap);
+      }
+    }
+  }
+  /* Restore flags. */
+  hdr->flags = flags;
+  return result;
+}
+
+static nn_rtps_msg_state_t
+check_rtps_message_is_secure(
+    struct q_globals *gv,
+    Header_t *hdr,
+    unsigned char *buff,
+    bool isstream,
+    struct proxy_participant **proxypp)
+{
+  nn_rtps_msg_state_t ret = NN_RTPS_MSG_STATE_ERROR;
+
+  SubmessageHeader_t *submsg;
+  uint32_t offset = RTPS_MESSAGE_HEADER_SIZE + (isstream ? sizeof(MsgLen_t) : 0);
+
+  submsg = (SubmessageHeader_t *)(buff + offset);
+  if (submsg->submessageId == SMID_SRTPS_PREFIX)
+  {
+    ddsi_guid_t guid;
+
+    guid.prefix = hdr->guid_prefix;
+    guid.entityid.u = NN_ENTITYID_PARTICIPANT;
+
+    GVTRACE(" from "PGUIDFMT, PGUID(guid));
+
+    *proxypp = ephash_lookup_proxy_participant_guid(gv->guid_hash, &guid);
+    if (*proxypp)
+    {
+      if (q_omg_proxyparticipant_is_authenticated(*proxypp))
+      {
+        ret = NN_RTPS_MSG_STATE_ENCODED;
+      }
+      else
+      {
+        GVTRACE ("received encoded rtps message from unauthenticated participant");
+      }
+    }
+    else
+    {
+      GVTRACE ("received encoded rtps message from unknown participant");
+    }
+    GVTRACE("\n");
+  }
+  else
+  {
+    ret = NN_RTPS_MSG_STATE_PLAIN;
+  }
+
+  return ret;
+}
+
+nn_rtps_msg_state_t
+decode_rtps_message(
+  struct thread_state1 * const ts1,
+  struct q_globals *gv,
+  struct nn_rmsg **rmsg,
+  Header_t **hdr,
+  unsigned char **buff,
+  ssize_t *sz,
+  struct nn_rbufpool *rbpool,
+  bool isstream)
+{
+  nn_rtps_msg_state_t ret = NN_RTPS_MSG_STATE_ERROR;
+  struct proxy_participant *proxypp = NULL;
+  unsigned char *dstbuf;
+  unsigned char *srcbuf;
+  uint32_t srclen, dstlen;
+  bool decoded;
+
+  /* Currently the decode_rtps_message returns a new allocated buffer.
+   * This could be optimized by providing a pre-allocated nn_rmsg buffer to
+   * copy the decoded rtps message in.
+   */
+  thread_state_awake_fixed_domain (ts1);
+  ret = check_rtps_message_is_secure(gv, *hdr, *buff, isstream, &proxypp);
+  if (ret == NN_RTPS_MSG_STATE_ENCODED)
+  {
+    if (isstream)
+    {
+      /* Remove MsgLen Submessage which was only needed for a stream to determine the end of the message */
+      srcbuf = *buff + sizeof(MsgLen_t);
+      srclen = (uint32_t)((size_t)(*sz) - sizeof(MsgLen_t));
+      memmove(srcbuf, *buff, RTPS_MESSAGE_HEADER_SIZE);
+    }
+    else
+    {
+      srcbuf = *buff;
+      srclen = (uint32_t)*sz;
+    }
+
+    decoded = q_omg_security_decode_rtps_message(proxypp, srcbuf, srclen, &dstbuf, &dstlen);
+    if (decoded)
+    {
+      nn_rmsg_commit (*rmsg);
+      *rmsg = nn_rmsg_new (rbpool);
+
+      *buff = (unsigned char *) NN_RMSG_PAYLOAD (*rmsg);
+
+      memcpy(*buff, dstbuf, dstlen);
+      nn_rmsg_setsize (*rmsg, dstlen);
+
+      ddsrt_free(dstbuf);
+
+      *hdr = (Header_t*) *buff;
+      (*hdr)->guid_prefix = nn_ntoh_guid_prefix ((*hdr)->guid_prefix);
+      *sz = (ssize_t)dstlen;
+    } else {
+      ret = NN_RTPS_MSG_STATE_ERROR;
+    }
+  }
+  thread_state_asleep (ts1);
+  return ret;
+}
+
+ssize_t
+secure_conn_write(
+    ddsi_tran_conn_t conn,
+    const nn_locator_t *dst,
+    size_t niov,
+    const ddsrt_iovec_t *iov,
+    uint32_t flags,
+    MsgLen_t *msg_len,
+    bool dst_one,
+    nn_msg_sec_info_t *sec_info,
+    ddsi_tran_write_fn_t conn_write_cb)
+{
+  ssize_t ret = -1;
+
+  unsigned i;
+  Header_t *hdr;
+  ddsi_guid_t guid;
+  unsigned char stbuf[2048];
+  unsigned char *srcbuf;
+  unsigned char *dstbuf = NULL;
+  uint32_t srclen, dstlen;
+  int64_t dst_handle = 0;
+
+  assert(iov);
+  assert(conn);
+  assert(msg_len);
+  assert(sec_info);
+  assert(niov > 0);
+  assert(conn_write_cb);
+
+  if (dst_one)
+  {
+    dst_handle = sec_info->dst_pp_handle;
+    if (dst_handle == 0) {
+      return -1;
+    }
+  }
+
+  hdr = (Header_t *)iov[0].iov_base;
+  guid.prefix = nn_ntoh_guid_prefix(hdr->guid_prefix);
+  guid.entityid.u = NN_ENTITYID_PARTICIPANT;
+
+  /* first determine the size of the message, then select the
+   *  on-stack buffer or allocate one on the heap ...
+   */
+  srclen = 0;
+  for (i = 0; i < (unsigned)niov; i++)
+  {
+    /* Do not copy MsgLen submessage in case of a stream connection */
+    if ((i != 1) || !conn->m_stream)
+      srclen += (uint32_t) iov[i].iov_len;
+  }
+  if (srclen <= sizeof (stbuf))
+  {
+    srcbuf = stbuf;
+  }
+  else
+  {
+    srcbuf = ddsrt_malloc (srclen);
+  }
+
+  /* ... then copy data into buffer */
+  srclen = 0;
+  for (i = 0; i < (unsigned)niov; i++)
+  {
+    if ((i != 1) || !conn->m_stream)
+    {
+      memcpy(srcbuf + srclen, iov[i].iov_base, iov[i].iov_len);
+      srclen += (uint32_t) iov[i].iov_len;
+    }
+  }
+
+  if (q_omg_security_encode_rtps_message(sec_info->src_pp_handle, &guid, srcbuf, srclen, &dstbuf, &dstlen, dst_handle))
+  {
+    ddsrt_iovec_t tmp_iov[3];
+    size_t tmp_niov;
+
+    if (conn->m_stream)
+    {
+      /* Add MsgLen submessage after Header */
+      msg_len->length = dstlen + (uint32_t)sizeof(*msg_len);
+
+      tmp_iov[0].iov_base = dstbuf;
+      tmp_iov[0].iov_len = RTPS_MESSAGE_HEADER_SIZE;
+      tmp_iov[1].iov_base = (void*) msg_len;
+      tmp_iov[1].iov_len = sizeof (*msg_len);
+      tmp_iov[2].iov_base = dstbuf + RTPS_MESSAGE_HEADER_SIZE;
+      tmp_iov[2].iov_len = dstlen - RTPS_MESSAGE_HEADER_SIZE;
+      tmp_niov = 3;
+    }
+    else
+    {
+      msg_len->length = dstlen;
+
+      tmp_iov[0].iov_base = dstbuf;
+      tmp_iov[0].iov_len = dstlen;
+      tmp_niov = 1;
+    }
+    ret = conn_write_cb (conn, dst, tmp_niov, tmp_iov, flags);
+  }
+
+  if (srcbuf != stbuf)
+  {
+    ddsrt_free (srcbuf);
+  }
+
+  ddsrt_free(dstbuf);
+
+  return ret;
+}
 
 #else /* DDSI_INCLUDE_SECURITY */
 
 #include "dds/ddsi/ddsi_security_omg.h"
 
-extern inline bool q_omg_participant_is_secure(UNUSED_ARG(const struct participant *pp));
+extern inline bool q_omg_security_enabled(void);
 
-extern inline unsigned determine_subscription_writer(UNUSED_ARG(const struct reader *rd));
-extern inline unsigned determine_publication_writer(UNUSED_ARG(const struct writer *wr));
+extern inline bool q_omg_participant_is_secure(
+  UNUSED_ARG(const struct participant *pp));
 
-extern inline bool allow_proxy_participant_deletion(
+extern inline unsigned determine_subscription_writer(
+  UNUSED_ARG(const struct reader *rd));
+
+extern inline unsigned determine_publication_writer(
+  UNUSED_ARG(const struct writer *wr));
+
+extern inline bool is_proxy_participant_deletion_allowed(
   UNUSED_ARG(struct q_globals * const gv),
   UNUSED_ARG(const struct ddsi_guid *guid),
   UNUSED_ARG(const ddsi_entityid_t pwr_entityid));
 
+extern inline void set_proxy_participant_security_info(
+  UNUSED_ARG(struct proxy_participant *prd),
+  UNUSED_ARG(const nn_plist_t *plist));
+
+extern inline void set_proxy_reader_security_info(
+  UNUSED_ARG(struct proxy_reader *prd),
+  UNUSED_ARG(const nn_plist_t *plist));
+
+extern inline void set_proxy_writer_security_info(
+  UNUSED_ARG(struct proxy_writer *pwr),
+  UNUSED_ARG(const nn_plist_t *plist));
+
+extern inline bool decode_Data(
+  UNUSED_ARG(const struct q_globals *gv),
+  UNUSED_ARG(struct nn_rsample_info *sampleinfo),
+  UNUSED_ARG(unsigned char *payloadp),
+  UNUSED_ARG(uint32_t payloadsz),
+  UNUSED_ARG(size_t *submsg_len));
+
+extern inline bool decode_DataFrag(
+  UNUSED_ARG(const struct q_globals *gv),
+  UNUSED_ARG(struct nn_rsample_info *sampleinfo),
+  UNUSED_ARG(unsigned char *payloadp),
+  UNUSED_ARG(uint32_t payloadsz),
+  UNUSED_ARG(size_t *submsg_len));
+
+extern inline void encode_datareader_submsg(
+  UNUSED_ARG(struct nn_xmsg *msg),
+  UNUSED_ARG(struct nn_xmsg_marker sm_marker),
+  UNUSED_ARG(struct proxy_writer *pwr),
+  UNUSED_ARG(const struct ddsi_guid *rd_guid));
+
+extern inline void encode_datawriter_submsg(
+  UNUSED_ARG(struct nn_xmsg *msg),
+  UNUSED_ARG(struct nn_xmsg_marker sm_marker),
+  UNUSED_ARG(struct writer *wr));
+
+extern inline bool validate_msg_decoding(
+  UNUSED_ARG(const struct entity_common *e),
+  UNUSED_ARG(const struct proxy_endpoint_common *c),
+  UNUSED_ARG(struct proxy_participant *proxypp),
+  UNUSED_ARG(struct receiver_state *rst),
+  UNUSED_ARG(SubmessageKind_t prev_smid));
+
+extern inline int decode_SecPrefix(
+  UNUSED_ARG(struct receiver_state *rst),
+  UNUSED_ARG(unsigned char *submsg),
+  UNUSED_ARG(size_t submsg_size),
+  UNUSED_ARG(unsigned char * const msg_end),
+  UNUSED_ARG(const ddsi_guid_prefix_t * const src_prefix),
+  UNUSED_ARG(const ddsi_guid_prefix_t * const dst_prefix),
+  UNUSED_ARG(int byteswap));
+
+extern inline nn_rtps_msg_state_t decode_rtps_message(
+  UNUSED_ARG(struct thread_state1 * const ts1),
+  UNUSED_ARG(struct q_globals *gv),
+  UNUSED_ARG(struct nn_rmsg **rmsg),
+  UNUSED_ARG(Header_t **hdr),
+  UNUSED_ARG(unsigned char **buff),
+  UNUSED_ARG(ssize_t *sz),
+  UNUSED_ARG(struct nn_rbufpool *rbpool),
+  UNUSED_ARG(bool isstream));
+
 #endif /* DDSI_INCLUDE_SECURITY */
diff --git a/src/core/ddsi/src/q_ddsi_discovery.c b/src/core/ddsi/src/q_ddsi_discovery.c
index d6f2137..11022af 100644
--- a/src/core/ddsi/src/q_ddsi_discovery.c
+++ b/src/core/ddsi/src/q_ddsi_discovery.c
@@ -213,7 +213,7 @@ int spdp_write (struct participant *pp)
      terribly important, the msg will grow as needed, address space is
      essentially meaningless because we only use the message to
      construct the payload. */
-  mpayload = nn_xmsg_new (pp->e.gv->xmsgpool, &pp->e.guid.prefix, 0, NN_XMSG_KIND_DATA);
+  mpayload = nn_xmsg_new (pp->e.gv->xmsgpool, &pp->e.guid, NULL, 0, NN_XMSG_KIND_DATA);
 
   nn_plist_init_empty (&ps);
   ps.present |= PP_PARTICIPANT_GUID | PP_BUILTIN_ENDPOINT_SET |
@@ -343,7 +343,7 @@ static int spdp_dispose_unregister_with_wr (struct participant *pp, unsigned ent
     return 0;
   }
 
-  mpayload = nn_xmsg_new (pp->e.gv->xmsgpool, &pp->e.guid.prefix, 0, NN_XMSG_KIND_DATA);
+  mpayload = nn_xmsg_new (pp->e.gv->xmsgpool, &pp->e.guid, NULL, 0, NN_XMSG_KIND_DATA);
   nn_plist_init_empty (&ps);
   ps.present |= PP_PARTICIPANT_GUID;
   ps.participant_guid = pp->e.guid;
@@ -437,7 +437,7 @@ static int handle_SPDP_dead (const struct receiver_state *rst, ddsi_entityid_t p
     guid = datap->participant_guid;
     GVLOGDISC (" %"PRIx32":%"PRIx32":%"PRIx32":%"PRIx32, PGUID (guid));
     assert (guid.entityid.u == NN_ENTITYID_PARTICIPANT);
-    if (allow_proxy_participant_deletion(gv, &guid, pwr_entityid))
+    if (is_proxy_participant_deletion_allowed(gv, &guid, pwr_entityid))
     {
       if (delete_proxy_participant_by_guid (gv, &guid, timestamp, 0) < 0)
       {
@@ -999,7 +999,7 @@ static int sedp_write_endpoint
      the QoS and other settings. So the header fields aren't really
      important, except that they need to be set to reasonable things
      or it'll crash */
-  mpayload = nn_xmsg_new (gv->xmsgpool, &wr->e.guid.prefix, 0, NN_XMSG_KIND_DATA);
+  mpayload = nn_xmsg_new (gv->xmsgpool, &wr->e.guid, NULL, 0, NN_XMSG_KIND_DATA);
   nn_plist_addtomsg (mpayload, &ps, ~(uint64_t)0, ~(uint64_t)0);
   if (xqos) nn_xqos_addtomsg (mpayload, xqos, qosdiff);
   nn_xmsg_addpar_sentinel (mpayload);
@@ -1467,7 +1467,7 @@ int sedp_write_topic (struct participant *pp, const struct nn_plist *datap)
 
   sedp_wr = get_sedp_writer (pp, NN_ENTITYID_SEDP_BUILTIN_TOPIC_WRITER);
 
-  mpayload = nn_xmsg_new (sedp_wr->e.gv->xmsgpool, &sedp_wr->e.guid.prefix, 0, NN_XMSG_KIND_DATA);
+  mpayload = nn_xmsg_new (sedp_wr->e.gv->xmsgpool, &sedp_wr->e.guid, NULL, 0, NN_XMSG_KIND_DATA);
   delta = nn_xqos_delta (&datap->qos, &sedp_wr->e.gv->default_xqos_tp, ~(uint64_t)0);
   if (sedp_wr->e.gv->config.explicitly_publish_qos_set_to_default)
     delta |= ~QP_UNRECOGNIZED_INCOMPATIBLE_MASK;
@@ -1505,7 +1505,7 @@ int sedp_write_cm_participant (struct participant *pp, int alive)
    the QoS and other settings. So the header fields aren't really
    important, except that they need to be set to reasonable things
    or it'll crash */
-  mpayload = nn_xmsg_new (sedp_wr->e.gv->xmsgpool, &sedp_wr->e.guid.prefix, 0, NN_XMSG_KIND_DATA);
+  mpayload = nn_xmsg_new (sedp_wr->e.gv->xmsgpool, &sedp_wr->e.guid, NULL, 0, NN_XMSG_KIND_DATA);
   nn_plist_init_empty (&ps);
   ps.present = PP_PARTICIPANT_GUID;
   ps.participant_guid = pp->e.guid;
diff --git a/src/core/ddsi/src/q_entity.c b/src/core/ddsi/src/q_entity.c
index e4c020d..89de419 100644
--- a/src/core/ddsi/src/q_entity.c
+++ b/src/core/ddsi/src/q_entity.c
@@ -2119,7 +2119,7 @@ static void proxy_writer_add_connection (struct proxy_writer *pwr, struct reader
   ddsrt_avl_insert_ipath (&pwr_readers_treedef, &pwr->readers, m, &path);
   local_reader_ary_insert(&pwr->rdary, rd);
   ddsrt_mutex_unlock (&pwr->e.lock);
-  qxev_pwr_entityid (pwr, &rd->e.guid.prefix);
+  qxev_pwr_entityid (pwr, &rd->e.guid);
 
   ELOGDISC (pwr, "\n");
 
@@ -2163,7 +2163,7 @@ static void proxy_reader_add_connection (struct proxy_reader *prd, struct writer
               PGUID (wr->e.guid), PGUID (prd->e.guid));
     ddsrt_avl_insert_ipath (&prd_writers_treedef, &prd->writers, m, &path);
     ddsrt_mutex_unlock (&prd->e.lock);
-    qxev_prd_entityid (prd, &wr->e.guid.prefix);
+    qxev_prd_entityid (prd, &wr->e.guid);
   }
 }
 
@@ -3974,6 +3974,8 @@ void new_proxy_participant
   nn_xqos_mergein_missing (&proxypp->plist->qos, &gv->default_plist_pp.qos, ~(uint64_t)0);
   ddsrt_avl_init (&proxypp_groups_treedef, &proxypp->groups);
 
+  set_proxy_participant_security_info(proxypp, plist);
+
   if (custom_flags & CF_INC_KERNEL_SEQUENCE_NUMBERS)
     proxypp->kernel_sequence_numbers = 1;
   else
@@ -4289,6 +4291,11 @@ static void proxy_endpoint_common_init (struct entity_common *e, struct proxy_en
   else
     memset (&c->group_guid, 0, sizeof (c->group_guid));
 
+#ifdef DDSI_INCLUDE_SECURITY
+  c->security_info.security_attributes = 0;
+  c->security_info.plugin_security_attributes = 0;
+#endif
+
   ref_proxy_participant (proxypp, c);
 }
 
@@ -4394,6 +4401,8 @@ int new_proxy_writer (struct q_globals *gv, const struct ddsi_guid *ppguid, cons
   pwr->ddsi2direct_cb = 0;
   pwr->ddsi2direct_cbarg = 0;
 
+  set_proxy_writer_security_info(pwr, plist);
+
   local_reader_ary_init (&pwr->rdary);
 
   /* locking the entity prevents matching while the built-in topic hasn't been published yet */
@@ -4437,7 +4446,7 @@ void update_proxy_writer (struct proxy_writer *pwr, seqno_t seq, struct addrset
         rd = ephash_lookup_reader_guid (pwr->e.gv->guid_hash, &m->rd_guid);
         if (rd)
         {
-          qxev_pwr_entityid (pwr, &rd->e.guid.prefix);
+          qxev_pwr_entityid (pwr, &rd->e.guid);
         }
         m = ddsrt_avl_iter_next (&iter);
       }
@@ -4494,7 +4503,7 @@ void update_proxy_reader (struct proxy_reader *prd, seqno_t seq, struct addrset
           ddsrt_mutex_lock (&wr->e.lock);
           rebuild_writer_addrset (wr);
           ddsrt_mutex_unlock (&wr->e.lock);
-          qxev_prd_entityid (prd, &wr->e.guid.prefix);
+          qxev_prd_entityid (prd, &wr->e.guid);
         }
         wrguid = guid_next;
         ddsrt_mutex_lock (&prd->e.lock);
@@ -4582,6 +4591,8 @@ int new_proxy_reader (struct q_globals *gv, const struct ddsi_guid *ppguid, cons
 #endif
   prd->is_fict_trans_reader = 0;
 
+  set_proxy_reader_security_info(prd, plist);
+
   ddsrt_avl_init (&prd_writers_treedef, &prd->writers);
 
   /* locking the entity prevents matching while the built-in topic hasn't been published yet */
diff --git a/src/core/ddsi/src/q_receive.c b/src/core/ddsi/src/q_receive.c
index eec9837..22a7543 100644
--- a/src/core/ddsi/src/q_receive.c
+++ b/src/core/ddsi/src/q_receive.c
@@ -53,6 +53,7 @@
 #include "dds/ddsi/ddsi_mcgroup.h"
 #include "dds/ddsi/ddsi_serdata.h"
 #include "dds/ddsi/ddsi_serdata_default.h" /* FIXME: get rid of this */
+#include "dds/ddsi/ddsi_security_omg.h"
 
 #include "dds/ddsi/sysdeps.h"
 #include "dds__whc.h"
@@ -278,7 +279,34 @@ static void set_sampleinfo_proxy_writer (struct nn_rsample_info *sampleinfo, dds
   sampleinfo->pwr = pwr;
 }
 
-static int valid_Data (const struct receiver_state *rst, struct nn_rmsg *rmsg, Data_t *msg, size_t size, int byteswap, struct nn_rsample_info *sampleinfo, unsigned char **payloadp)
+static int set_sampleinfo_bswap (struct nn_rsample_info *sampleinfo, struct CDRHeader *hdr)
+{
+  if (hdr)
+  {
+    switch (hdr->identifier)
+    {
+      case CDR_BE:
+      case PL_CDR_BE:
+      {
+        sampleinfo->bswap = (DDSRT_ENDIAN == DDSRT_LITTLE_ENDIAN) ? 1 : 0;
+        break;
+      }
+      case CDR_LE:
+      case PL_CDR_LE:
+      {
+        sampleinfo->bswap = (DDSRT_ENDIAN == DDSRT_LITTLE_ENDIAN) ? 0 : 1;
+        break;
+      }
+      default:
+      {
+        return 0;
+      }
+    }
+  }
+  return 1;
+}
+
+static int valid_Data (const struct receiver_state *rst, struct nn_rmsg *rmsg, Data_t *msg, size_t size, int byteswap, struct nn_rsample_info *sampleinfo, unsigned char **payloadp, uint32_t *payloadsz)
 {
   /* on success: sampleinfo->{seq,rst,statusinfo,pt_wr_info_zoff,bswap,complex_qos} all set */
   ddsi_guid_t pwr_guid;
@@ -354,6 +382,7 @@ static int valid_Data (const struct receiver_state *rst, struct nn_rmsg *rmsg, D
   {
     /*TRACE (("no payload\n"));*/
     *payloadp = NULL;
+    *payloadsz = 0;
     sampleinfo->size = 0;
   }
   else if ((size_t) ((char *) ptr + 4 - (char *) msg) > size)
@@ -363,35 +392,16 @@ static int valid_Data (const struct receiver_state *rst, struct nn_rmsg *rmsg, D
   }
   else
   {
-    struct CDRHeader *hdr;
     sampleinfo->size = (uint32_t) ((char *) msg + size - (char *) ptr);
+    *payloadsz = sampleinfo->size;
     *payloadp = ptr;
-    hdr = (struct CDRHeader *) ptr;
-    switch (hdr->identifier)
-    {
-      case CDR_BE:
-      case PL_CDR_BE:
-      {
-        sampleinfo->bswap = (DDSRT_ENDIAN == DDSRT_LITTLE_ENDIAN ? 1 : 0);
-        break;
-      }
-      case CDR_LE:
-      case PL_CDR_LE:
-      {
-        sampleinfo->bswap = (DDSRT_ENDIAN == DDSRT_LITTLE_ENDIAN ? 0 : 1);
-        break;
-      }
-      default:
-        return 0;
-    }
   }
   return 1;
 }
 
-static int valid_DataFrag (const struct receiver_state *rst, struct nn_rmsg *rmsg, DataFrag_t *msg, size_t size, int byteswap, struct nn_rsample_info *sampleinfo, unsigned char **payloadp)
+static int valid_DataFrag (const struct receiver_state *rst, struct nn_rmsg *rmsg, DataFrag_t *msg, size_t size, int byteswap, struct nn_rsample_info *sampleinfo, unsigned char **payloadp, uint32_t *payloadsz)
 {
   /* on success: sampleinfo->{rst,statusinfo,pt_wr_info_zoff,bswap,complex_qos} all set */
-  uint32_t payloadsz;
   ddsi_guid_t pwr_guid;
   unsigned char *ptr;
 
@@ -473,18 +483,17 @@ static int valid_DataFrag (const struct receiver_state *rst, struct nn_rmsg *rms
   }
 
   *payloadp = ptr;
-  payloadsz = (uint32_t) ((char *) msg + size - (char *) ptr);
-  if ((uint32_t) msg->fragmentsInSubmessage * msg->fragmentSize <= payloadsz)
+  *payloadsz = (uint32_t) ((char *) msg + size - (char *) ptr);
+  if ((uint32_t) msg->fragmentsInSubmessage * msg->fragmentSize <= (*payloadsz))
     ; /* all spec'd fragments fit in payload */
-  else if ((uint32_t) (msg->fragmentsInSubmessage - 1) * msg->fragmentSize >= payloadsz)
+  else if ((uint32_t) (msg->fragmentsInSubmessage - 1) * msg->fragmentSize >= (*payloadsz))
     return 0; /* I can live with a short final fragment, but _only_ the final one */
-  else if ((uint32_t) (msg->fragmentStartingNum - 1) * msg->fragmentSize + payloadsz >= msg->sampleSize)
+  else if ((uint32_t) (msg->fragmentStartingNum - 1) * msg->fragmentSize + (*payloadsz) >= msg->sampleSize)
     ; /* final fragment is long enough to cover rest of sample */
   else
     return 0;
   if (msg->fragmentStartingNum == 1)
   {
-    struct CDRHeader *hdr = (struct CDRHeader *) ptr;
     if ((size_t) ((char *) ptr + 4 - (char *) msg) > size)
     {
       /* no space for the header -- technically, allowing small
@@ -492,23 +501,6 @@ static int valid_DataFrag (const struct receiver_state *rst, struct nn_rmsg *rms
          prefer this */
       return 0;
     }
-    switch (hdr->identifier)
-    {
-      case CDR_BE:
-      case PL_CDR_BE:
-      {
-        sampleinfo->bswap = (DDSRT_ENDIAN == DDSRT_LITTLE_ENDIAN ? 1 : 0);
-        break;
-      }
-      case CDR_LE:
-      case PL_CDR_LE:
-      {
-        sampleinfo->bswap = (DDSRT_ENDIAN == DDSRT_LITTLE_ENDIAN ? 0 : 1);
-        break;
-      }
-      default:
-        return 0;
-    }
   }
   return 1;
 }
@@ -527,6 +519,7 @@ static int add_Gap (struct nn_xmsg *msg, struct writer *wr, struct proxy_reader
   gap->gapList.numbits = numbits;
   memcpy (gap->bits, bits, NN_SEQUENCE_NUMBER_SET_BITS_SIZE (numbits));
   nn_xmsg_submsg_setnext (msg, sm_marker);
+  encode_datawriter_submsg(msg, sm_marker, wr);
   return 0;
 }
 
@@ -537,7 +530,7 @@ static void force_heartbeat_to_peer (struct writer *wr, const struct whc_state *
   ASSERT_MUTEX_HELD (&wr->e.lock);
   assert (wr->reliable);
 
-  m = nn_xmsg_new (wr->e.gv->xmsgpool, &wr->e.guid.prefix, 0, NN_XMSG_KIND_CONTROL);
+  m = nn_xmsg_new (wr->e.gv->xmsgpool, &wr->e.guid, wr->c.pp, 0, NN_XMSG_KIND_CONTROL);
   if (nn_xmsg_setdstPRD (m, prd) < 0)
   {
     /* If we don't have an address, give up immediately */
@@ -610,7 +603,7 @@ static int accept_ack_or_hb_w_timeout (nn_count_t new_count, nn_count_t *exp_cou
   return 1;
 }
 
-static int handle_AckNack (struct receiver_state *rst, nn_etime_t tnow, const AckNack_t *msg, nn_wctime_t timestamp)
+static int handle_AckNack (struct receiver_state *rst, nn_etime_t tnow, const AckNack_t *msg, nn_wctime_t timestamp, SubmessageKind_t prev_smid)
 {
   struct proxy_reader *prd;
   struct wr_prd_match *rn;
@@ -666,6 +659,12 @@ static int handle_AckNack (struct receiver_state *rst, nn_etime_t tnow, const Ac
     return 1;
   }
 
+  if (!validate_msg_decoding(&(prd->e), &(prd->c), prd->c.proxypp, rst, prev_smid))
+  {
+    RSTTRACE (" "PGUIDFMT" -> "PGUIDFMT" clear submsg from protected src)", PGUID (src), PGUID (dst));
+    return 1;
+  }
+
   /* liveliness is still only implemented partially (with all set to AUTOMATIC, BY_PARTICIPANT, &c.), so we simply renew the proxy participant's lease. */
   lease_renew (ddsrt_atomic_ldvoidp (&prd->c.proxypp->lease), tnow);
 
@@ -934,7 +933,7 @@ static int handle_AckNack (struct receiver_state *rst, nn_etime_t tnow, const Ac
     RSTTRACE (" XGAP%"PRId64"..%"PRId64"/%u:", gapstart, gapend, gapnumbits);
     for (uint32_t i = 0; i < gapnumbits; i++)
       RSTTRACE ("%c", nn_bitset_isset (gapnumbits, gapbits, i) ? '1' : '0');
-    m = nn_xmsg_new (rst->gv->xmsgpool, &wr->e.guid.prefix, 0, NN_XMSG_KIND_CONTROL);
+    m = nn_xmsg_new (rst->gv->xmsgpool, &wr->e.guid, wr->c.pp, 0, NN_XMSG_KIND_CONTROL);
 #ifdef DDSI_INCLUDE_NETWORK_PARTITIONS
     nn_xmsg_setencoderid (m, wr->partition_id);
 #endif
@@ -1094,7 +1093,7 @@ static void handle_Heartbeat_helper (struct pwr_rd_match * const wn, struct hand
   }
 }
 
-static int handle_Heartbeat (struct receiver_state *rst, nn_etime_t tnow, struct nn_rmsg *rmsg, const Heartbeat_t *msg, nn_wctime_t timestamp)
+static int handle_Heartbeat (struct receiver_state *rst, nn_etime_t tnow, struct nn_rmsg *rmsg, const Heartbeat_t *msg, nn_wctime_t timestamp, SubmessageKind_t prev_smid)
 {
   /* We now cheat: and process the heartbeat for _all_ readers,
      always, regardless of the destination address in the Heartbeat
@@ -1132,6 +1131,12 @@ static int handle_Heartbeat (struct receiver_state *rst, nn_etime_t tnow, struct
     return 1;
   }
 
+  if (!validate_msg_decoding(&(pwr->e), &(pwr->c), pwr->c.proxypp, rst, prev_smid))
+  {
+    RSTTRACE (" "PGUIDFMT" -> "PGUIDFMT" clear submsg from protected src)", PGUID (src), PGUID (dst));
+    return 1;
+  }
+
   /* liveliness is still only implemented partially (with all set to AUTOMATIC,
      BY_PARTICIPANT, &c.), so we simply renew the proxy participant's lease. */
   lease_renew (ddsrt_atomic_ldvoidp (&pwr->c.proxypp->lease), tnow);
@@ -1244,7 +1249,7 @@ static int handle_Heartbeat (struct receiver_state *rst, nn_etime_t tnow, struct
   return 1;
 }
 
-static int handle_HeartbeatFrag (struct receiver_state *rst, UNUSED_ARG(nn_etime_t tnow), const HeartbeatFrag_t *msg)
+static int handle_HeartbeatFrag (struct receiver_state *rst, UNUSED_ARG(nn_etime_t tnow), const HeartbeatFrag_t *msg, SubmessageKind_t prev_smid)
 {
   const seqno_t seq = fromSN (msg->writerSN);
   const nn_fragment_number_t fragnum = msg->lastFragmentNum - 1; /* we do 0-based */
@@ -1269,6 +1274,12 @@ static int handle_HeartbeatFrag (struct receiver_state *rst, UNUSED_ARG(nn_etime
     return 1;
   }
 
+  if (!validate_msg_decoding(&(pwr->e), &(pwr->c), pwr->c.proxypp, rst, prev_smid))
+  {
+    RSTTRACE (" "PGUIDFMT" -> "PGUIDFMT" clear submsg from protected src)", PGUID (src), PGUID (dst));
+    return 1;
+  }
+
   /* liveliness is still only implemented partially (with all set to AUTOMATIC, BY_PARTICIPANT, &c.), so we simply renew the proxy participant's lease. */
   lease_renew (ddsrt_atomic_ldvoidp (&pwr->c.proxypp->lease), tnow);
 
@@ -1355,7 +1366,7 @@ static int handle_HeartbeatFrag (struct receiver_state *rst, UNUSED_ARG(nn_etime
   return 1;
 }
 
-static int handle_NackFrag (struct receiver_state *rst, nn_etime_t tnow, const NackFrag_t *msg)
+static int handle_NackFrag (struct receiver_state *rst, nn_etime_t tnow, const NackFrag_t *msg, SubmessageKind_t prev_smid)
 {
   struct proxy_reader *prd;
   struct wr_prd_match *rn;
@@ -1396,6 +1407,12 @@ static int handle_NackFrag (struct receiver_state *rst, nn_etime_t tnow, const N
     return 1;
   }
 
+  if (!validate_msg_decoding(&(prd->e), &(prd->c), prd->c.proxypp, rst, prev_smid))
+  {
+    RSTTRACE (" "PGUIDFMT" -> "PGUIDFMT" clear submsg from protected src)", PGUID (src), PGUID (dst));
+    return 1;
+  }
+
   /* liveliness is still only implemented partially (with all set to AUTOMATIC, BY_PARTICIPANT, &c.), so we simply renew the proxy participant's lease. */
   lease_renew (ddsrt_atomic_ldvoidp (&prd->c.proxypp->lease), tnow);
 
@@ -1446,7 +1463,7 @@ static int handle_NackFrag (struct receiver_state *rst, nn_etime_t tnow, const N
     static uint32_t zero = 0;
     struct nn_xmsg *m;
     RSTTRACE (" msg not available: scheduling Gap\n");
-    m = nn_xmsg_new (rst->gv->xmsgpool, &wr->e.guid.prefix, 0, NN_XMSG_KIND_CONTROL);
+    m = nn_xmsg_new (rst->gv->xmsgpool, &wr->e.guid, wr->c.pp, 0, NN_XMSG_KIND_CONTROL);
 #ifdef DDSI_INCLUDE_NETWORK_PARTITIONS
     nn_xmsg_setencoderid (m, wr->partition_id);
 #endif
@@ -1590,7 +1607,7 @@ static int handle_one_gap (struct proxy_writer *pwr, struct pwr_rd_match *wn, se
   return gap_was_valuable;
 }
 
-static int handle_Gap (struct receiver_state *rst, nn_etime_t tnow, struct nn_rmsg *rmsg, const Gap_t *msg)
+static int handle_Gap (struct receiver_state *rst, nn_etime_t tnow, struct nn_rmsg *rmsg, const Gap_t *msg, SubmessageKind_t prev_smid)
 {
   /* Option 1: Process the Gap for the proxy writer and all
      out-of-sync readers: what do I care which reader is being
@@ -1643,6 +1660,12 @@ static int handle_Gap (struct receiver_state *rst, nn_etime_t tnow, struct nn_rm
     return 1;
   }
 
+  if (!validate_msg_decoding(&(pwr->e), &(pwr->c), pwr->c.proxypp, rst, prev_smid))
+  {
+    RSTTRACE (" "PGUIDFMT" -> "PGUIDFMT" clear submsg from protected src)", PGUID (src), PGUID (dst));
+    return 1;
+  }
+
   /* liveliness is still only implemented partially (with all set to AUTOMATIC, BY_PARTICIPANT, &c.), so we simply renew the proxy participant's lease. */
   lease_renew (ddsrt_atomic_ldvoidp (&pwr->c.proxypp->lease), tnow);
 
@@ -2346,7 +2369,7 @@ static void drop_oversize (struct receiver_state *rst, struct nn_rmsg *rmsg, con
   }
 }
 
-static int handle_Data (struct receiver_state *rst, nn_etime_t tnow, struct nn_rmsg *rmsg, const Data_t *msg, size_t size, struct nn_rsample_info *sampleinfo, unsigned char *datap, struct nn_dqueue **deferred_wakeup)
+static int handle_Data (struct receiver_state *rst, nn_etime_t tnow, struct nn_rmsg *rmsg, const Data_t *msg, size_t size, struct nn_rsample_info *sampleinfo, unsigned char *datap, struct nn_dqueue **deferred_wakeup, SubmessageKind_t prev_smid)
 {
   RSTTRACE ("DATA("PGUIDFMT" -> "PGUIDFMT" #%"PRId64,
             PGUIDPREFIX (rst->src_guid_prefix), msg->x.writerId.u,
@@ -2358,6 +2381,15 @@ static int handle_Data (struct receiver_state *rst, nn_etime_t tnow, struct nn_r
     return 1;
   }
 
+  if (sampleinfo->pwr)
+  {
+    if (!validate_msg_decoding(&(sampleinfo->pwr->e), &(sampleinfo->pwr->c), sampleinfo->pwr->c.proxypp, rst, prev_smid))
+    {
+      RSTTRACE (" clear submsg from protected src "PGUIDFMT")", PGUID (sampleinfo->pwr->e.guid));
+      return 1;
+    }
+  }
+
   if (sampleinfo->size > rst->gv->config.max_sample_size)
     drop_oversize (rst, rmsg, &msg->x, sampleinfo);
   else
@@ -2391,7 +2423,7 @@ static int handle_Data (struct receiver_state *rst, nn_etime_t tnow, struct nn_r
   return 1;
 }
 
-static int handle_DataFrag (struct receiver_state *rst, nn_etime_t tnow, struct nn_rmsg *rmsg, const DataFrag_t *msg, size_t size, struct nn_rsample_info *sampleinfo, unsigned char *datap, struct nn_dqueue **deferred_wakeup)
+static int handle_DataFrag (struct receiver_state *rst, nn_etime_t tnow, struct nn_rmsg *rmsg, const DataFrag_t *msg, size_t size, struct nn_rsample_info *sampleinfo, unsigned char *datap, struct nn_dqueue **deferred_wakeup, SubmessageKind_t prev_smid)
 {
   RSTTRACE ("DATAFRAG("PGUIDFMT" -> "PGUIDFMT" #%"PRId64"/[%u..%u]",
             PGUIDPREFIX (rst->src_guid_prefix), msg->x.writerId.u,
@@ -2404,6 +2436,15 @@ static int handle_DataFrag (struct receiver_state *rst, nn_etime_t tnow, struct
     return 1;
   }
 
+  if (sampleinfo->pwr)
+  {
+    if (!validate_msg_decoding(&(sampleinfo->pwr->e), &(sampleinfo->pwr->c), sampleinfo->pwr->c.proxypp, rst, prev_smid))
+    {
+      RSTTRACE (" clear submsg from protected src "PGUIDFMT")", PGUID (sampleinfo->pwr->e.guid));
+      return 1;
+    }
+  }
+
   if (sampleinfo->size > rst->gv->config.max_sample_size)
     drop_oversize (rst, rmsg, &msg->x, sampleinfo);
   else
@@ -2606,7 +2647,8 @@ static int handle_submsg_sequence
   unsigned char * const msg /* NOT const - we may byteswap it */,
   const size_t len,
   unsigned char * submsg /* aliases somewhere in msg */,
-  struct nn_rmsg * const rmsg
+  struct nn_rmsg * const rmsg,
+  bool rtps_encoded /* indicate if the message was rtps encoded */
 )
 {
   const char *state;
@@ -2618,6 +2660,7 @@ static int handle_submsg_sequence
   size_t submsg_size = 0;
   unsigned char * end = msg + len;
   struct nn_dqueue *deferred_wakeup = NULL;
+  SubmessageKind_t prev_smid = SMID_PAD;
 
   /* Receiver state is dynamically allocated with lifetime bound to
      the message.  Updates cause a new copy to be created if the
@@ -2639,6 +2682,7 @@ static int handle_submsg_sequence
      false at any time. That's ok: it's real purpose is to filter out
      discovery data accidentally sent by Cloud */
   rst->forme = 1;
+  rst->rtps_encoded = rtps_encoded;
   rst->vendor = hdr->vendorid;
   rst->protocol_version = hdr->version;
   rst->srcloc = *srcloc;
@@ -2700,14 +2744,14 @@ static int handle_submsg_sequence
         state = "parse:acknack";
         if (!valid_AckNack (rst, &sm->acknack, submsg_size, byteswap))
           goto malformed;
-        handle_AckNack (rst, tnowE, &sm->acknack, ts_for_latmeas ? timestamp : NN_WCTIME_INVALID);
+        handle_AckNack (rst, tnowE, &sm->acknack, ts_for_latmeas ? timestamp : NN_WCTIME_INVALID, prev_smid);
         ts_for_latmeas = 0;
         break;
       case SMID_HEARTBEAT:
         state = "parse:heartbeat";
         if (!valid_Heartbeat (&sm->heartbeat, submsg_size, byteswap))
           goto malformed;
-        handle_Heartbeat (rst, tnowE, rmsg, &sm->heartbeat, ts_for_latmeas ? timestamp : NN_WCTIME_INVALID);
+        handle_Heartbeat (rst, tnowE, rmsg, &sm->heartbeat, ts_for_latmeas ? timestamp : NN_WCTIME_INVALID, prev_smid);
         ts_for_latmeas = 0;
         break;
       case SMID_GAP:
@@ -2719,7 +2763,7 @@ static int handle_submsg_sequence
            rst after inserting the gap in the admin. */
         if (!valid_Gap (&sm->gap, submsg_size, byteswap))
           goto malformed;
-        handle_Gap (rst, tnowE, rmsg, &sm->gap);
+        handle_Gap (rst, tnowE, rmsg, &sm->gap, prev_smid);
         ts_for_latmeas = 0;
         break;
       case SMID_INFO_TS:
@@ -2763,27 +2807,37 @@ static int handle_submsg_sequence
         state = "parse:nackfrag";
         if (!valid_NackFrag (&sm->nackfrag, submsg_size, byteswap))
           goto malformed;
-        handle_NackFrag (rst, tnowE, &sm->nackfrag);
+        handle_NackFrag (rst, tnowE, &sm->nackfrag, prev_smid);
         ts_for_latmeas = 0;
         break;
       case SMID_HEARTBEAT_FRAG:
         state = "parse:heartbeatfrag";
         if (!valid_HeartbeatFrag (&sm->heartbeatfrag, submsg_size, byteswap))
           goto malformed;
-        handle_HeartbeatFrag (rst, tnowE, &sm->heartbeatfrag);
+        handle_HeartbeatFrag (rst, tnowE, &sm->heartbeatfrag, prev_smid);
         ts_for_latmeas = 0;
         break;
       case SMID_DATA_FRAG:
         state = "parse:datafrag";
         {
           struct nn_rsample_info sampleinfo;
+          uint32_t datasz = 0;
           unsigned char *datap;
+          size_t submsg_len = submsg_size;
           /* valid_DataFrag does not validate the payload */
-          if (!valid_DataFrag (rst, rmsg, &sm->datafrag, submsg_size, byteswap, &sampleinfo, &datap))
+          if (!valid_DataFrag (rst, rmsg, &sm->datafrag, submsg_size, byteswap, &sampleinfo, &datap, &datasz))
             goto malformed;
+          /* This only decodes the payload when needed (possibly reducing the submsg size). */
+          if (!decode_DataFrag (rst->gv, &sampleinfo, datap, datasz, &submsg_len))
+            goto malformed;
+          /* Set the sample bswap according to the payload info (only first fragment has proper header). */
+          if (sm->datafrag.fragmentStartingNum == 1) {
+            if (!set_sampleinfo_bswap(&sampleinfo, (struct CDRHeader *)datap))
+              goto malformed;
+          }
           sampleinfo.timestamp = timestamp;
           sampleinfo.reception_timestamp = tnowWC;
-          handle_DataFrag (rst, tnowE, rmsg, &sm->datafrag, submsg_size, &sampleinfo, datap, &deferred_wakeup);
+          handle_DataFrag (rst, tnowE, rmsg, &sm->datafrag, submsg_len, &sampleinfo, datap, &deferred_wakeup, prev_smid);
           rst_live = 1;
           ts_for_latmeas = 0;
         }
@@ -2793,12 +2847,20 @@ static int handle_submsg_sequence
         {
           struct nn_rsample_info sampleinfo;
           unsigned char *datap;
+          uint32_t datasz = 0;
+          size_t submsg_len = submsg_size;
           /* valid_Data does not validate the payload */
-          if (!valid_Data (rst, rmsg, &sm->data, submsg_size, byteswap, &sampleinfo, &datap))
+          if (!valid_Data (rst, rmsg, &sm->data, submsg_size, byteswap, &sampleinfo, &datap, &datasz))
+            goto malformed;
+          /* This only decodes the payload when needed (possibly reducing the submsg size). */
+          if (!decode_Data (rst->gv, &sampleinfo, datap, datasz, &submsg_len))
+            goto malformed;
+          /* Set the sample bswap according to the payload info. */
+          if (!set_sampleinfo_bswap(&sampleinfo, (struct CDRHeader *)datap))
             goto malformed;
           sampleinfo.timestamp = timestamp;
           sampleinfo.reception_timestamp = tnowWC;
-          handle_Data (rst, tnowE, rmsg, &sm->data, submsg_size, &sampleinfo, datap, &deferred_wakeup);
+          handle_Data (rst, tnowE, rmsg, &sm->data, submsg_len, &sampleinfo, datap, &deferred_wakeup, prev_smid);
           rst_live = 1;
           ts_for_latmeas = 0;
         }
@@ -2819,6 +2881,38 @@ static int handle_submsg_sequence
         GVTRACE ("ENTITY_ID");
         break;
       }
+      case SMID_SEC_PREFIX:
+        state = "parse:sec_prefix";
+        {
+          GVTRACE ("SEC_PREFIX");
+          if (decode_SecPrefix(rst, submsg, submsg_size, end, &rst->src_guid_prefix, &rst->dst_guid_prefix, byteswap) < 0)
+            goto malformed;
+        }
+        break;
+      case SMID_SEC_BODY:
+        {
+          /* Ignore: because it should have been handled by SMID_SEC_PREFIX. */
+          GVTRACE ("SEC_BODY");
+        }
+        break;
+      case SMID_SEC_POSTFIX:
+        {
+          /* Ignore: because it should have been handled by SMID_SEC_PREFIX. */
+          GVTRACE ("SEC_POSTFIX");
+        }
+        break;
+      case SMID_SRTPS_PREFIX:
+        {
+          /* Ignore: it should already have been handled. */
+          GVTRACE ("SRTPS_PREFIX");
+        }
+        break;
+      case SMID_SRTPS_POSTFIX:
+        {
+          /* Ignore: it should already have been handled. */
+          GVTRACE ("SRTPS_POSTFIX");
+        }
+        break;
       default:
         state = "parse:undefined";
         GVTRACE ("UNDEFINED(%x)", sm->smhdr.submessageId);
@@ -2849,6 +2943,7 @@ static int handle_submsg_sequence
         ts_for_latmeas = 0;
         break;
     }
+    prev_smid = state_smkind;
     submsg += submsg_size;
     GVTRACE ("\n");
   }
@@ -2985,8 +3080,36 @@ static bool do_packet (struct thread_state1 * const ts1, struct q_globals *gv, d
         GVTRACE ("HDR(%"PRIx32":%"PRIx32":%"PRIx32" vendor %d.%d) len %lu from %s\n",
                  PGUIDPREFIX (hdr->guid_prefix), hdr->vendorid.id[0], hdr->vendorid.id[1], (unsigned long) sz, addrstr);
       }
+      nn_rtps_msg_state_t res = decode_rtps_message(ts1,
+                                                    gv,
+                                                    &rmsg,
+                                                    &hdr,
+                                                    &buff,
+                                                    &sz,
+                                                    rbpool,
+                                                    conn->m_stream);
 
-      handle_submsg_sequence (ts1, gv, conn, &srcloc, now (), now_et (), &hdr->guid_prefix, guidprefix, buff, (size_t) sz, buff + RTPS_MESSAGE_HEADER_SIZE, rmsg);
+      if (res != NN_RTPS_MSG_STATE_ERROR)
+      {
+        handle_submsg_sequence (ts1,
+                                gv,
+                                conn,
+                                &srcloc,
+                                now (),
+                                now_et (),
+                                &hdr->guid_prefix,
+                                guidprefix,
+                                buff,
+                                (size_t) sz,
+                                buff + RTPS_MESSAGE_HEADER_SIZE,
+                                rmsg,
+                                res == NN_RTPS_MSG_STATE_ENCODED);
+      }
+      else
+      {
+        /* drop message */
+        sz = 1;
+      }
     }
   }
   nn_rmsg_commit (rmsg);
diff --git a/src/core/ddsi/src/q_transmit.c b/src/core/ddsi/src/q_transmit.c
index b0061fe..cec9693 100644
--- a/src/core/ddsi/src/q_transmit.c
+++ b/src/core/ddsi/src/q_transmit.c
@@ -34,6 +34,7 @@
 #include "dds/ddsi/ddsi_tkmap.h"
 #include "dds/ddsi/ddsi_serdata.h"
 #include "dds/ddsi/ddsi_sertopic.h"
+#include "dds/ddsi/ddsi_security_omg.h"
 
 #include "dds/ddsi/sysdeps.h"
 #include "dds__whc.h"
@@ -140,7 +141,7 @@ struct nn_xmsg *writer_hbcontrol_create_heartbeat (struct writer *wr, const stru
   assert (wr->reliable);
   assert (hbansreq >= 0);
 
-  if ((msg = nn_xmsg_new (gv->xmsgpool, &wr->e.guid.prefix, sizeof (InfoTS_t) + sizeof (Heartbeat_t), NN_XMSG_KIND_CONTROL)) == NULL)
+  if ((msg = nn_xmsg_new (gv->xmsgpool, &wr->e.guid, wr->c.pp, sizeof (InfoTS_t) + sizeof (Heartbeat_t), NN_XMSG_KIND_CONTROL)) == NULL)
     /* out of memory at worst slows down traffic */
     return NULL;
 
@@ -218,6 +219,13 @@ struct nn_xmsg *writer_hbcontrol_create_heartbeat (struct writer *wr, const stru
     add_Heartbeat (msg, wr, whcst, hbansreq, prd_guid->entityid, issync);
   }
 
+  /* It is possible that the encoding removed the submessage(s). */
+  if (nn_xmsg_size(msg) == 0)
+  {
+    nn_xmsg_free (msg);
+    msg = NULL;
+  }
+
   writer_hbcontrol_note_hb (wr, tnow, hbansreq);
   return msg;
 }
@@ -379,6 +387,7 @@ void add_Heartbeat (struct nn_xmsg *msg, struct writer *wr, const struct whc_sta
   hb->count = ++wr->hbcount;
 
   nn_xmsg_submsg_setnext (msg, sm_marker);
+  encode_datawriter_submsg(msg, sm_marker, wr);
 }
 
 static dds_return_t create_fragment_message_simple (struct writer *wr, seqno_t seq, struct ddsi_serdata *serdata, struct nn_xmsg **pmsg)
@@ -411,7 +420,7 @@ static dds_return_t create_fragment_message_simple (struct writer *wr, seqno_t s
   ASSERT_MUTEX_HELD (&wr->e.lock);
 
   /* INFO_TS: 12 bytes, Data_t: 24 bytes, expected inline QoS: 32 => should be single chunk */
-  if ((*pmsg = nn_xmsg_new (gv->xmsgpool, &wr->e.guid.prefix, sizeof (InfoTimestamp_t) + sizeof (Data_t) + expected_inline_qos_size, NN_XMSG_KIND_DATA)) == NULL)
+  if ((*pmsg = nn_xmsg_new (gv->xmsgpool, &wr->e.guid, wr->c.pp, sizeof (InfoTimestamp_t) + sizeof (Data_t) + expected_inline_qos_size, NN_XMSG_KIND_DATA)) == NULL)
     return DDS_RETCODE_OUT_OF_RESOURCES;
 
 #ifdef DDSI_INCLUDE_NETWORK_PARTITIONS
@@ -448,9 +457,9 @@ static dds_return_t create_fragment_message_simple (struct writer *wr, seqno_t s
 
 #if TEST_KEYHASH
   if (serdata->kind != SDK_KEY || !wr->include_keyhash)
-    nn_xmsg_serdata (*pmsg, serdata, 0, ddsi_serdata_size (serdata));
+    nn_xmsg_serdata (*pmsg, serdata, 0, ddsi_serdata_size (serdata), wr);
 #else
-  nn_xmsg_serdata (*pmsg, serdata, 0, ddsi_serdata_size (serdata));
+  nn_xmsg_serdata (*pmsg, serdata, 0, ddsi_serdata_size (serdata), wr);
 #endif
   nn_xmsg_submsg_setnext (*pmsg, sm_marker);
   return 0;
@@ -497,7 +506,7 @@ dds_return_t create_fragment_message (struct writer *wr, seqno_t seq, const stru
   fragging = (gv->config.fragment_size < size);
 
   /* INFO_TS: 12 bytes, DataFrag_t: 36 bytes, expected inline QoS: 32 => should be single chunk */
-  if ((*pmsg = nn_xmsg_new (gv->xmsgpool, &wr->e.guid.prefix, sizeof (InfoTimestamp_t) + sizeof (DataFrag_t) + expected_inline_qos_size, xmsg_kind)) == NULL)
+  if ((*pmsg = nn_xmsg_new (gv->xmsgpool, &wr->e.guid, wr->c.pp, sizeof (InfoTimestamp_t) + sizeof (DataFrag_t) + expected_inline_qos_size, xmsg_kind)) == NULL)
     return DDS_RETCODE_OUT_OF_RESOURCES;
 
 #ifdef DDSI_INCLUDE_NETWORK_PARTITIONS
@@ -618,7 +627,7 @@ dds_return_t create_fragment_message (struct writer *wr, seqno_t seq, const stru
     }
   }
 
-  nn_xmsg_serdata (*pmsg, serdata, fragstart, fraglen);
+  nn_xmsg_serdata (*pmsg, serdata, fragstart, fraglen, wr);
   nn_xmsg_submsg_setnext (*pmsg, sm_marker);
 #if 0
   GVTRACE ("queue data%s "PGUIDFMT" #%lld/%u[%u..%u)\n",
@@ -626,6 +635,15 @@ dds_return_t create_fragment_message (struct writer *wr, seqno_t seq, const stru
            seq, fragnum+1, fragstart, fragstart + fraglen);
 #endif
 
+  encode_datawriter_submsg(*pmsg, sm_marker, wr);
+
+  /* It is possible that the encoding removed the submessage.
+   * If there is no content, free the message. */
+  if (nn_xmsg_size(*pmsg) == 0) {
+      nn_xmsg_free (*pmsg);
+      *pmsg = NULL;
+  }
+
   return ret;
 }
 
@@ -635,7 +653,7 @@ static void create_HeartbeatFrag (struct writer *wr, seqno_t seq, unsigned fragn
   struct nn_xmsg_marker sm_marker;
   HeartbeatFrag_t *hbf;
   ASSERT_MUTEX_HELD (&wr->e.lock);
-  if ((*pmsg = nn_xmsg_new (gv->xmsgpool, &wr->e.guid.prefix, sizeof (HeartbeatFrag_t), NN_XMSG_KIND_CONTROL)) == NULL)
+  if ((*pmsg = nn_xmsg_new (gv->xmsgpool, &wr->e.guid, wr->c.pp, sizeof (HeartbeatFrag_t), NN_XMSG_KIND_CONTROL)) == NULL)
     return; /* ignore out-of-memory: HeartbeatFrag is only advisory anyway */
 #ifdef DDSI_INCLUDE_NETWORK_PARTITIONS
   nn_xmsg_setencoderid (*pmsg, wr->partition_id);
@@ -664,6 +682,15 @@ static void create_HeartbeatFrag (struct writer *wr, seqno_t seq, unsigned fragn
   hbf->count = ++wr->hbfragcount;
 
   nn_xmsg_submsg_setnext (*pmsg, sm_marker);
+  encode_datawriter_submsg(*pmsg, sm_marker, wr);
+
+  /* It is possible that the encoding removed the submessage.
+   * If there is no content, free the message. */
+  if (nn_xmsg_size(*pmsg) == 0)
+  {
+    nn_xmsg_free(*pmsg);
+    *pmsg = NULL;
+  }
 }
 
 #if 0
diff --git a/src/core/ddsi/src/q_xevent.c b/src/core/ddsi/src/q_xevent.c
index 775b2f4..548508b 100644
--- a/src/core/ddsi/src/q_xevent.c
+++ b/src/core/ddsi/src/q_xevent.c
@@ -39,6 +39,7 @@
 #include "dds/ddsi/q_xmsg.h"
 #include "dds/ddsi/ddsi_serdata.h"
 #include "dds/ddsi/ddsi_serdata_default.h"
+#include "dds/ddsi/ddsi_security_omg.h"
 #include "dds/ddsi/ddsi_tkmap.h"
 #include "dds__whc.h"
 
@@ -182,7 +183,7 @@ static void trace_msg (struct xeventq *evq, const char *func, const struct nn_xm
 {
   if (dds_get_log_mask() & DDS_LC_TRACE)
   {
-    nn_guid_t wrguid;
+    ddsi_guid_t wrguid;
     seqno_t wrseq;
     nn_fragment_number_t wrfragid;
     nn_xmsg_guid_seq_fragid (m, &wrguid, &wrseq, &wrfragid);
@@ -805,6 +806,9 @@ static void add_AckNack (struct nn_xmsg *msg, struct proxy_writer *pwr, struct p
             base, an->readerSNState.numbits);
     for (uint32_t ui = 0; ui != an->readerSNState.numbits; ui++)
       ETRACE (pwr, "%c", nn_bitset_isset (numbits, an->bits, ui) ? '1' : '0');
+
+    /* Encode the sub-message when needed. */
+    encode_datareader_submsg(msg, sm_marker, pwr, &rwn->rd_guid);
   }
 
   if (nackfrag_numbits > 0)
@@ -835,12 +839,15 @@ static void add_AckNack (struct nn_xmsg *msg, struct proxy_writer *pwr, struct p
       for (uint32_t ui = 0; ui != nf->fragmentNumberState.numbits; ui++)
         ETRACE (pwr, "%c", nn_bitset_isset (nf->fragmentNumberState.numbits, nf->bits, ui) ? '1' : '0');
     }
+
+    /* Encode the sub-message when needed. */
+    encode_datareader_submsg(msg, sm_marker, pwr, &rwn->rd_guid);
   }
 
   ETRACE (pwr, "\n");
 }
 
-static void handle_xevk_acknack (UNUSED_ARG (struct nn_xpack *xp), struct xevent *ev, nn_mtime_t tnow)
+static void handle_xevk_acknack (struct nn_xpack *xp, struct xevent *ev, nn_mtime_t tnow)
 {
   /* FIXME: ought to keep track of which NACKs are being generated in
      response to a Heartbeat.  There is no point in having multiple
@@ -872,9 +879,18 @@ static void handle_xevk_acknack (UNUSED_ARG (struct nn_xpack *xp), struct xevent
   if (addrset_any_uc (pwr->c.as, &loc) || addrset_any_mc (pwr->c.as, &loc))
   {
     seqno_t nack_seq;
-    if ((msg = nn_xmsg_new (gv->xmsgpool, &ev->u.acknack.rd_guid.prefix, ACKNACK_SIZE_MAX, NN_XMSG_KIND_CONTROL)) == NULL)
+
+    struct participant *pp = NULL;
+    if (q_omg_security_enabled())
+    {
+      struct reader *rd = ephash_lookup_reader_guid(pwr->e.gv->guid_hash, &ev->u.acknack.rd_guid);
+      if (rd)
+        pp = rd->c.pp;
+    }
+
+    if ((msg = nn_xmsg_new (gv->xmsgpool, &ev->u.acknack.rd_guid, pp, ACKNACK_SIZE_MAX, NN_XMSG_KIND_CONTROL)) == NULL)
       goto outofmem;
-    nn_xmsg_setdst1 (msg, &ev->u.acknack.pwr_guid.prefix, &loc);
+    nn_xmsg_setdst1 (gv, msg, &ev->u.acknack.pwr_guid.prefix, &loc);
     if (gv->config.meas_hb_to_ack_latency && rwn->hb_timestamp.v)
     {
       /* If HB->ACK latency measurement is enabled, and we have a
@@ -886,7 +902,13 @@ static void handle_xevk_acknack (UNUSED_ARG (struct nn_xpack *xp), struct xevent
       rwn->hb_timestamp.v = 0;
     }
     add_AckNack (msg, pwr, rwn, &nack_seq);
-    if (nack_seq)
+    if (nn_xmsg_size(msg) == 0)
+    {
+      /* No AckNack added. */
+      nn_xmsg_free(msg);
+      msg = NULL;
+    }
+    else if (nack_seq)
     {
       rwn->t_last_nack = tnow;
       rwn->seq_last_nack = nack_seq;
@@ -948,7 +970,7 @@ static bool resend_spdp_sample_by_guid_key (struct writer *wr, const ddsi_guid_t
   nn_plist_init_empty (&ps);
   ps.present |= PP_PARTICIPANT_GUID;
   ps.participant_guid = *guid;
-  struct nn_xmsg *mpayload = nn_xmsg_new (gv->xmsgpool, &guid->prefix, 0, NN_XMSG_KIND_DATA);
+  struct nn_xmsg *mpayload = nn_xmsg_new (gv->xmsgpool, guid, wr->c.pp, 0, NN_XMSG_KIND_DATA);
   nn_plist_addtomsg (mpayload, &ps, ~(uint64_t)0, ~(uint64_t)0);
   nn_xmsg_addpar_sentinel (mpayload);
   nn_plist_fini (&ps);
@@ -1387,7 +1409,7 @@ void qxev_msg (struct xeventq *evq, struct nn_xmsg *msg)
   ddsrt_mutex_unlock (&evq->lock);
 }
 
-void qxev_prd_entityid (struct proxy_reader *prd, ddsi_guid_prefix_t *id)
+void qxev_prd_entityid (struct proxy_reader *prd, const ddsi_guid_t *guid)
 {
   struct q_globals * const gv = prd->e.gv;
   struct nn_xmsg *msg;
@@ -1397,10 +1419,10 @@ void qxev_prd_entityid (struct proxy_reader *prd, ddsi_guid_prefix_t *id)
 
   if (! gv->xevents->tev_conn->m_connless)
   {
-    msg = nn_xmsg_new (gv->xmsgpool, id, sizeof (EntityId_t), NN_XMSG_KIND_CONTROL);
+    msg = nn_xmsg_new (gv->xmsgpool, guid, NULL, sizeof (EntityId_t), NN_XMSG_KIND_CONTROL);
     if (nn_xmsg_setdstPRD (msg, prd) == 0)
     {
-      GVTRACE ("  qxev_prd_entityid (%"PRIx32":%"PRIx32":%"PRIx32")\n", PGUIDPREFIX (*id));
+      GVTRACE ("  qxev_prd_entityid (%"PRIx32":%"PRIx32":%"PRIx32")\n", PGUIDPREFIX (guid->prefix));
       nn_xmsg_add_entityid (msg);
       ddsrt_mutex_lock (&gv->xevents->lock);
       ev = qxev_common_nt (gv->xevents, XEVK_ENTITYID);
@@ -1415,7 +1437,7 @@ void qxev_prd_entityid (struct proxy_reader *prd, ddsi_guid_prefix_t *id)
   }
 }
 
-void qxev_pwr_entityid (struct proxy_writer *pwr, ddsi_guid_prefix_t *id)
+void qxev_pwr_entityid (struct proxy_writer *pwr, const ddsi_guid_t *guid)
 {
   struct q_globals * const gv = pwr->e.gv;
   struct nn_xmsg *msg;
@@ -1425,10 +1447,10 @@ void qxev_pwr_entityid (struct proxy_writer *pwr, ddsi_guid_prefix_t *id)
 
   if (! pwr->evq->tev_conn->m_connless)
   {
-    msg = nn_xmsg_new (gv->xmsgpool, id, sizeof (EntityId_t), NN_XMSG_KIND_CONTROL);
+    msg = nn_xmsg_new (gv->xmsgpool, guid, NULL, sizeof (EntityId_t), NN_XMSG_KIND_CONTROL);
     if (nn_xmsg_setdstPWR (msg, pwr) == 0)
     {
-      GVTRACE ("  qxev_pwr_entityid (%"PRIx32":%"PRIx32":%"PRIx32")\n", PGUIDPREFIX (*id));
+      GVTRACE ("  qxev_pwr_entityid (%"PRIx32":%"PRIx32":%"PRIx32")\n", PGUIDPREFIX (guid->prefix));
       nn_xmsg_add_entityid (msg);
       ddsrt_mutex_lock (&pwr->evq->lock);
       ev = qxev_common_nt (pwr->evq, XEVK_ENTITYID);
diff --git a/src/core/ddsi/src/q_xmsg.c b/src/core/ddsi/src/q_xmsg.c
index 5e704a3..4c73e77 100644
--- a/src/core/ddsi/src/q_xmsg.c
+++ b/src/core/ddsi/src/q_xmsg.c
@@ -41,6 +41,7 @@
 #include "dds/ddsi/q_ephash.h"
 #include "dds/ddsi/q_freelist.h"
 #include "dds/ddsi/ddsi_serdata_default.h"
+#include "dds/ddsi/ddsi_security_omg.h"
 
 #define NN_XMSG_MAX_ALIGN 8
 #define NN_XMSG_CHUNK_SIZE 128
@@ -72,6 +73,11 @@ struct nn_xmsg {
   int have_params;
   struct ddsi_serdata *refd_payload;
   ddsrt_iovec_t refd_payload_iov;
+#ifdef DDSI_INCLUDE_SECURITY
+  /* Used as pointer to contain encoded payload to which iov can alias. */
+  unsigned char *refd_payload_encoded;
+  nn_msg_sec_info_t sec_info;
+#endif
   int64_t maxdelay;
 #ifdef DDSI_INCLUDE_NETWORK_PARTITIONS
   uint32_t encoderid;
@@ -223,6 +229,9 @@ struct nn_xpack
 #ifdef DDSI_INCLUDE_NETWORK_PARTITIONS
   uint32_t encoderId;
 #endif /* DDSI_INCLUDE_NETWORK_PARTITIONS */
+#ifdef DDSI_INCLUDE_SECURITY
+  nn_msg_sec_info_t sec_info;
+#endif
 };
 
 static size_t align4u (size_t x)
@@ -283,6 +292,12 @@ static void nn_xmsg_reinit (struct nn_xmsg *m, enum nn_xmsg_kind kind)
   m->dstmode = NN_XMSG_DST_UNSET;
   m->kind = kind;
   m->maxdelay = 0;
+#ifdef DDSI_INCLUDE_SECURITY
+  m->refd_payload_encoded = NULL;
+  m->sec_info.use_rtps_encoding = 0;
+  m->sec_info.src_pp_handle = 0;
+  m->sec_info.dst_pp_handle = 0;
+#endif
 #ifdef DDSI_INCLUDE_NETWORK_PARTITIONS
   m->encoderid = 0;
 #endif
@@ -322,14 +337,29 @@ static struct nn_xmsg *nn_xmsg_allocnew (struct nn_xmsgpool *pool, size_t expect
   return m;
 }
 
-struct nn_xmsg *nn_xmsg_new (struct nn_xmsgpool *pool, const ddsi_guid_prefix_t *src_guid_prefix, size_t expected_size, enum nn_xmsg_kind kind)
+struct nn_xmsg *nn_xmsg_new (struct nn_xmsgpool *pool, const ddsi_guid_t *src_guid, struct participant *pp, size_t expected_size, enum nn_xmsg_kind kind)
 {
   struct nn_xmsg *m;
   if ((m = nn_freelist_pop (&pool->freelist)) != NULL)
     nn_xmsg_reinit (m, kind);
   else if ((m = nn_xmsg_allocnew (pool, expected_size, kind)) == NULL)
     return NULL;
-  m->data->src.guid_prefix = nn_hton_guid_prefix (*src_guid_prefix);
+  m->data->src.guid_prefix = nn_hton_guid_prefix (src_guid->prefix);
+
+#ifdef DDSI_INCLUDE_SECURITY
+  m->sec_info.use_rtps_encoding = 0;
+  if (pp && q_omg_participant_is_secure(pp))
+  {
+    if (q_omg_security_is_local_rtps_protected(pp, src_guid->entityid))
+    {
+      m->sec_info.use_rtps_encoding = 1;
+      m->sec_info.src_pp_handle = q_omg_security_get_local_participant_handle(pp);
+    }
+  }
+#else
+  DDSRT_UNUSED_ARG(pp);
+#endif
+
   return m;
 }
 
@@ -344,6 +374,9 @@ void nn_xmsg_free (struct nn_xmsg *m)
   struct nn_xmsgpool *pool = m->pool;
   if (m->refd_payload)
     ddsi_serdata_to_ser_unref (m->refd_payload, &m->refd_payload_iov);
+#ifdef DDSI_INCLUDE_SECURITY
+  ddsrt_free(m->refd_payload_encoded);
+#endif
   if (m->dstmode == NN_XMSG_DST_ALL)
   {
     unref_addrset (m->dstaddr.all.as);
@@ -385,6 +418,13 @@ static int submsg_is_compatible (const struct nn_xmsg *msg, SubmessageKind_t smk
         case SMID_DATA: case SMID_DATA_FRAG:
           /* but data is strictly verboten */
           return 0;
+        case SMID_SEC_BODY:
+        case SMID_SEC_PREFIX:
+        case SMID_SEC_POSTFIX:
+        case SMID_SRTPS_PREFIX:
+        case SMID_SRTPS_POSTFIX:
+          /* and the security sm are basically data. */
+          return 0;
       }
       assert (0);
       break;
@@ -406,6 +446,13 @@ static int submsg_is_compatible (const struct nn_xmsg *msg, SubmessageKind_t smk
              won't work for initial transmits, but those currently
              don't allow a readerId */
           return msg->kindspecific.data.readerId_off == 0;
+        case SMID_SEC_BODY:
+        case SMID_SEC_PREFIX:
+        case SMID_SEC_POSTFIX:
+        case SMID_SRTPS_PREFIX:
+        case SMID_SRTPS_POSTFIX:
+          /* Just do the same as 'normal' data sm. */
+          return msg->kindspecific.data.readerId_off == 0;
         case SMID_ACKNACK:
         case SMID_HEARTBEAT:
         case SMID_GAP:
@@ -494,6 +541,80 @@ void nn_xmsg_submsg_setnext (struct nn_xmsg *msg, struct nn_xmsg_marker marker)
     ((unsigned)(msg->data->payload + msg->sz + plsize - (char *) hdr) - RTPS_SUBMESSAGE_HEADER_SIZE);
 }
 
+#ifdef DDSI_INCLUDE_SECURITY
+
+size_t nn_xmsg_submsg_size (struct nn_xmsg *msg, struct nn_xmsg_marker marker)
+{
+  SubmessageHeader_t *hdr = (SubmessageHeader_t*)nn_xmsg_submsg_from_marker(msg, marker);
+  return align4u(hdr->octetsToNextHeader + sizeof(SubmessageHeader_t));
+}
+
+void nn_xmsg_submsg_remove(struct nn_xmsg *msg, struct nn_xmsg_marker sm_marker)
+{
+  /* Just reset the message size to the start of the current sub-message. */
+  msg->sz = sm_marker.offset;
+}
+
+void nn_xmsg_submsg_replace(struct nn_xmsg *msg, struct nn_xmsg_marker sm_marker, unsigned char *new_submsg, size_t new_len)
+{
+  /* Size of current sub-message. */
+  size_t old_len = msg->sz - sm_marker.offset;
+
+  /* Adjust the message size to the new sub-message. */
+  if (old_len < new_len)
+  {
+    nn_xmsg_append(msg, NULL, new_len - old_len);
+  }
+  else if (old_len > new_len)
+  {
+    nn_xmsg_shrink(msg, sm_marker, new_len);
+  }
+
+  /* Just a sanity check: assert(msg_end == submsg_end) */
+  assert((msg->data->payload + msg->sz) == (msg->data->payload + sm_marker.offset + new_len));
+
+  /* Replace the sub-message. */
+  memcpy(msg->data->payload + sm_marker.offset, new_submsg, new_len);
+}
+
+void nn_xmsg_submsg_append_refd_payload(struct nn_xmsg *msg, struct nn_xmsg_marker sm_marker)
+{
+  DDSRT_UNUSED_ARG(sm_marker);
+  /*
+   * Normally, the refd payload pointer is moved around until it is added to
+   * the iov of the socket. This reduces the amount of allocations and copies.
+   *
+   * However, in a few cases (like security), the sub-message should be one
+   * complete blob.
+   * Appending the payload will just do that.
+   */
+  if (msg->refd_payload)
+  {
+    void *dst;
+
+    /* Get payload information. */
+    char  *payload_ptr = msg->refd_payload_iov.iov_base;
+    size_t payload_len = msg->refd_payload_iov.iov_len;
+
+    /* Make space for the payload (dst points to the start of the appended space). */
+    dst = nn_xmsg_append(msg, NULL, payload_len);
+
+    /* Copy the payload into the submessage. */
+    memcpy(dst, payload_ptr, payload_len);
+
+    /* No need to remember the payload now. */
+    ddsi_serdata_unref(msg->refd_payload);
+    msg->refd_payload = NULL;
+    if (msg->refd_payload_encoded)
+    {
+      ddsrt_free(msg->refd_payload_encoded);
+      msg->refd_payload_encoded = NULL;
+    }
+  }
+}
+
+#endif /* DDSI_INCLUDE_SECURITY */
+
 void *nn_xmsg_submsg_from_marker (struct nn_xmsg *msg, struct nn_xmsg_marker marker)
 {
   return msg->data->payload + marker.offset;
@@ -560,22 +681,66 @@ void nn_xmsg_add_entityid (struct nn_xmsg * m)
   nn_xmsg_submsg_setnext (m, sm);
 }
 
-void nn_xmsg_serdata (struct nn_xmsg *m, struct ddsi_serdata *serdata, size_t off, size_t len)
+void nn_xmsg_serdata (struct nn_xmsg *m, struct ddsi_serdata *serdata, size_t off, size_t len, struct writer *wr)
 {
   if (serdata->kind != SDK_EMPTY)
   {
     size_t len4 = align4u (len);
     assert (m->refd_payload == NULL);
     m->refd_payload = ddsi_serdata_to_ser_ref (serdata, off, len4, &m->refd_payload_iov);
+
+#ifdef DDSI_INCLUDE_SECURITY
+    assert (m->refd_payload_encoded == NULL);
+    /* When encoding is necessary, m->refd_payload_encoded will be allocated
+     * and m->refd_payload_iov contents will change to point to that buffer.
+     * If no encoding is necessary, nothing changes. */
+    if (!encode_payload(wr, &(m->refd_payload_iov), &(m->refd_payload_encoded)))
+    {
+      DDS_CWARNING (&wr->e.gv->logconfig, "nn_xmsg_serdata: failed to encrypt data for "PGUIDFMT"", PGUID (wr->e.guid));
+      ddsi_serdata_to_ser_unref (m->refd_payload, &m->refd_payload_iov);
+      assert (m->refd_payload_encoded == NULL);
+      m->refd_payload_iov.iov_base = NULL;
+      m->refd_payload_iov.iov_len = 0;
+      m->refd_payload = NULL;
+    }
+#else
+    DDSRT_UNUSED_ARG(wr);
+#endif
   }
 }
 
-void nn_xmsg_setdst1 (struct nn_xmsg *m, const ddsi_guid_prefix_t *gp, const nn_locator_t *loc)
+void nn_xmsg_setdst1 (struct q_globals *gv, struct nn_xmsg *m, const ddsi_guid_prefix_t *gp, const nn_locator_t *loc)
 {
   assert (m->dstmode == NN_XMSG_DST_UNSET);
   m->dstmode = NN_XMSG_DST_ONE;
   m->dstaddr.one.loc = *loc;
   m->data->dst.guid_prefix = nn_hton_guid_prefix (*gp);
+#ifdef DDSI_INCLUDE_SECURITY
+  if (m->sec_info.use_rtps_encoding && !m->sec_info.dst_pp_handle)
+  {
+    struct proxy_participant *proxypp;
+    ddsi_guid_t guid;
+
+    guid.prefix = *gp;
+    guid.entityid.u = NN_ENTITYID_PARTICIPANT;
+
+    proxypp = ephash_lookup_proxy_participant_guid(gv->guid_hash, &guid);
+    if (proxypp)
+      m->sec_info.dst_pp_handle = q_omg_security_get_remote_participant_handle(proxypp);
+  }
+#else
+    DDSRT_UNUSED_ARG(gv);
+#endif
+}
+
+bool nn_xmsg_getdst1prefix (struct nn_xmsg *m, ddsi_guid_prefix_t *gp)
+{
+  if (m->dstmode == NN_XMSG_DST_ONE)
+  {
+    *gp = nn_hton_guid_prefix(m->data->dst.guid_prefix);
+    return true;
+  }
+  return false;
 }
 
 dds_return_t nn_xmsg_setdstPRD (struct nn_xmsg *m, const struct proxy_reader *prd)
@@ -583,7 +748,7 @@ dds_return_t nn_xmsg_setdstPRD (struct nn_xmsg *m, const struct proxy_reader *pr
   nn_locator_t loc;
   if (addrset_any_uc (prd->c.as, &loc) || addrset_any_mc (prd->c.as, &loc))
   {
-    nn_xmsg_setdst1 (m, &prd->e.guid.prefix, &loc);
+    nn_xmsg_setdst1 (prd->e.gv, m, &prd->e.guid.prefix, &loc);
     return 0;
   }
   else
@@ -598,7 +763,7 @@ dds_return_t nn_xmsg_setdstPWR (struct nn_xmsg *m, const struct proxy_writer *pw
   nn_locator_t loc;
   if (addrset_any_uc (pwr->c.as, &loc) || addrset_any_mc (pwr->c.as, &loc))
   {
-    nn_xmsg_setdst1 (m, &pwr->e.guid.prefix, &loc);
+    nn_xmsg_setdst1 (pwr->e.gv, m, &pwr->e.guid.prefix, &loc);
     return 0;
   }
   DDS_CWARNING (&pwr->e.gv->logconfig, "nn_xmsg_setdstPRD: no address for "PGUIDFMT, PGUID (pwr->e.guid));
@@ -953,6 +1118,9 @@ static void nn_xpack_reinit (struct nn_xpack *xp)
   xp->msg_len.length = 0;
   xp->included_msgs.latest = NULL;
   xp->maxdelay = T_NEVER;
+#ifdef DDSI_INCLUDE_SECURITY
+  xp->sec_info.use_rtps_encoding = 0;
+#endif
 #ifdef DDSI_INCLUDE_NETWORK_PARTITIONS
   xp->encoderId = 0;
 #endif
@@ -1012,6 +1180,34 @@ void nn_xpack_free (struct nn_xpack *xp)
   ddsrt_free (xp);
 }
 
+static ssize_t nn_xpack_send_rtps(struct nn_xpack * xp, const nn_locator_t *loc)
+{
+  ssize_t ret = -1;
+
+#ifdef DDSI_INCLUDE_SECURITY
+  /* Only encode when needed. */
+  if (xp->sec_info.use_rtps_encoding)
+  {
+    ret = secure_conn_write(
+                      xp->conn,
+                      loc,
+                      xp->niov,
+                      xp->iov,
+                      xp->call_flags,
+                      &(xp->msg_len),
+                      (xp->dstmode == NN_XMSG_DST_ONE),
+                      &(xp->sec_info),
+                      ddsi_conn_write);
+  }
+  else
+#endif /* DDSI_INCLUDE_SECURITY */
+  {
+    ret = ddsi_conn_write (xp->conn, loc, xp->niov, xp->iov, xp->call_flags);
+  }
+
+  return ret;
+}
+
 static ssize_t nn_xpack_send1 (const nn_locator_t *loc, void * varg)
 {
   struct nn_xpack *xp = varg;
@@ -1038,14 +1234,17 @@ static ssize_t nn_xpack_send1 (const nn_locator_t *loc, void * varg)
 
   if (!gv->mute)
   {
-    nbytes = ddsi_conn_write (xp->conn, loc, xp->niov, xp->iov, xp->call_flags);
+    nbytes = nn_xpack_send_rtps(xp, loc);
+
 #ifndef NDEBUG
     {
       size_t i, len;
       for (i = 0, len = 0; i < xp->niov; i++) {
         len += xp->iov[i].iov_len;
       }
-      assert (nbytes == -1 || (size_t) nbytes == len);
+      /* Possible number of bytes written can be larger
+       * due to security. */
+      assert (nbytes == -1 || (size_t) nbytes >= len);
     }
 #endif
   }
@@ -1338,6 +1537,12 @@ static int nn_xpack_mayaddmsg (const struct nn_xpack *xp, const struct nn_xmsg *
     return 0;
 #endif
 
+#ifdef DDSI_INCLUDE_SECURITY
+  /* Don't mix up encoded and plain rtps messages */
+  if (xp->sec_info.use_rtps_encoding != m->sec_info.use_rtps_encoding)
+    return 0;
+#endif
+
   return addressing_info_eq_onesidederr (xp, m);
 }
 
@@ -1431,6 +1636,9 @@ int nn_xpack_addmsg (struct nn_xpack *xp, struct nn_xmsg *m, const uint32_t flag
       niov++;
     }
 
+#ifdef DDSI_INCLUDE_SECURITY
+    xp->sec_info = m->sec_info;
+#endif
 #ifdef DDSI_INCLUDE_NETWORK_PARTITIONS
     xp->encoderId = m->encoderid;
 #endif

From f2f0205f25d0a8e88627d9b0dc4b53cd052ecee5 Mon Sep 17 00:00:00 2001
From: MarcelJordense <37329887+MarcelJordense@users.noreply.github.com>
Date: Thu, 12 Dec 2019 15:54:19 +0100
Subject: [PATCH 079/238] Added volatile security endpoints. (#310)

* Added volatile security endpoints.

Signed-off-by: Marcel Jordense <marcel.jordense@adlinktech.com>

* Fix review issues with volatile security endpoints

Signed-off-by: Marcel Jordense <marcel.jordense@adlinktech.com>

* Update sending point-2-point heartbeats

Signed-off-by: Marcel Jordense <marcel.jordense@adlinktech.com>

* Fix infinite loop when sending p2p heartbeats

Signed-off-by: Marcel Jordense <marcel.jordense@adlinktech.com>
---
 docs/dev/volatile_msg_secure.md               | 131 +++++
 .../ddsi/include/dds/ddsi/ddsi_security_msg.h |  22 +-
 src/core/ddsi/include/dds/ddsi/q_entity.h     |   9 +
 src/core/ddsi/include/dds/ddsi/q_globals.h    |   2 +
 src/core/ddsi/include/dds/ddsi/q_hbcontrol.h  |   5 +
 src/core/ddsi/include/dds/ddsi/q_misc.h       |   2 +
 src/core/ddsi/include/dds/ddsi/q_protocol.h   |   3 +-
 src/core/ddsi/include/dds/ddsi/q_radmin.h     |   2 +
 src/core/ddsi/include/dds/ddsi/q_receive.h    |  14 +
 src/core/ddsi/include/dds/ddsi/q_rtps.h       |   3 +-
 src/core/ddsi/include/dds/ddsi/q_transmit.h   |   1 +
 src/core/ddsi/src/ddsi_security_msg.c         | 111 +++-
 src/core/ddsi/src/ddsi_security_omg.c         |   3 +
 src/core/ddsi/src/q_ddsi_discovery.c          |   3 +
 src/core/ddsi/src/q_entity.c                  | 102 +++-
 src/core/ddsi/src/q_init.c                    |  34 ++
 src/core/ddsi/src/q_misc.c                    |  10 +
 src/core/ddsi/src/q_radmin.c                  |  27 +
 src/core/ddsi/src/q_receive.c                 | 489 +++++++++++-------
 src/core/ddsi/src/q_transmit.c                | 106 +++-
 src/core/ddsi/src/q_xevent.c                  | 106 +++-
 src/core/ddsi/src/q_xmsg.c                    |   5 -
 src/core/ddsi/tests/security_msg.c            |  30 +-
 23 files changed, 1002 insertions(+), 218 deletions(-)
 create mode 100644 docs/dev/volatile_msg_secure.md

diff --git a/docs/dev/volatile_msg_secure.md b/docs/dev/volatile_msg_secure.md
new file mode 100644
index 0000000..d784387
--- /dev/null
+++ b/docs/dev/volatile_msg_secure.md
@@ -0,0 +1,131 @@
+# ParticipantVolatileMessageSecure Handling
+
+## Short Introduction
+
+It is expected to have some knowledge of DDSI builtin (security) endpoints.
+
+```cpp
+#define NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_VOLATILE_SECURE_WRITER 0xff0202c3
+#define NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_VOLATILE_SECURE_READER 0xff0202c4
+```
+These builtin endpoints have caused about the biggest code change in ddsi, regarding security.
+
+Chapters 7.4.4.3 and 7.4.4.4 in the DDS Security specification indicates the main issue why these builtin endpoints are different from all the others and somewhat more complex.
+
+> 7.4.4.3 Contents of the ParticipantVolatileMessageSecure
+> The ParticipantVolatileMessageSecure is intended as a holder of secure information that
+> is sent point-to-point from a DomainParticipant to another.
+>
+> [...]
+>
+> 7.4.4.4 Destination of the ParticipantVolatileMessageSecure
+>
+> If the destination_participant_guid member is not set to GUID_UNKNOWN, the message written is
+> intended only for the BuiltinParticipantVolatileMessageSecureReader belonging to the
+> DomainParticipant with a matching Participant Key.
+>
+> This is equivalent to saying that the BuiltinParticipantVolatileMessageSecureReader has an implied
+> content filter with the logical expression:
+>
+> “destination_participant_guid == GUID_UNKNOWN
+> || destination_participant_guid==BuiltinParticipantVolatileMessageSecureReader.participant.guid”
+>
+> Implementations of the specification can use this content filter or some other mechanism as long as the
+> resulting behavior is equivalent to having this filter.
+>
+> [...]
+
+The "point-to-point" and "content filter" remarks makes everything more elaborate.
+
+
+## Complexity
+
+It would be nice to be able to use the ```dds_set_topic_filter()``` functionality for these endpoints. However, that only works on the reader history cache (rhc), which is only available for ddsc entities and not for ddsi builtin entities. And it's the builtin entities that are being used.
+
+The ```dds_set_topic_filter()``` basically simulates that the sample was inserted into the rhc (but didn't insert it), which causes the rest of ddsi (regarding heartbeat, acknacks, gaps, etc) to work as normal while the sample just isn't provided to the reader.
+
+Unfortunately, the builtin volatile endpoints can not use that same simple sequence (just handle the sample but ignore it right at the end). Problem is, the sample is encoded. It can only decode samples that are intended for that reader. This would mean that it is best for the reader to only receive 'owned' samples that it can actually decode.
+
+This has all kinds of affects regarding the heartbeat, acknacks, gaps, etc. Basically, every writer/reader combination should have information regarding gaps and sequence numbers between them, while normally such information about proxies are combined.
+
+
+## Implementation Overview
+
+This only depicts an overview. Some details will have been omitted.
+
+
+### Writing
+
+The function ```write_crypto_exchange_message()``` takes care of generating the right sample information and pass it on to ```write_sample_p2p_wrlock_held()```.
+
+A proxy reader can now have a filter callback function (```proxy_reader::filter```). This indicates (on the writer side) if a sample will be accepted by the actual reader or not. This could be made more generic for proper 'writer side' content filter implementation. However, now it'll only be used by ParticipantVolatileMessageSecure and the filter is hardcoded to ```volatile_secure_data_filter()```.
+
+So, if ```write_sample_p2p_wrlock_held()``` is called with a proxy reader with a filter, it will get 'send/acked sequences' information between the writer and proxy reader. This is used to determine if gap information has to be send alongside the sample.
+
+Then, ```write_sample_p2p_wrlock_held()``` will enqueue the sample.
+
+Just before the submessage is added to the rtps message and send, it is encoded (todo).
+
+
+### Reading
+
+First things first, the submessage is decoded when the rtps message is received (todo).
+
+It is received on a builtin reader, so the builtin queue is used and ```builtins_dqueue_handler()``` is called. That will forward the sample to the token exchange functionality, ignoring every sample that isn't related to the related participant (todo).
+
+
+### Gaps on reader side
+
+The reader remembers the last_seq it knows from every connected proxy writer (```pwr_rd_match::last_seq```).
+This is updated when handling heartbeats, gaps and regular messages and used to check if there are gaps.
+Normally, the ```last_seq``` of a specific writer is used here. But when the reader knows that the writer uses a 'writer side content filter' (```proxy_writer::uses_filter```), it'll use the the ```last_seq``` that is related to the actual reader/writer match.
+It is used to generate the AckNack (which contains gap information) response to the writer.
+
+
+### Gaps on writer side
+
+The writer remembers which sample sequence it send the last to a specific reader through ```wr_prd_match::lst_seq```.
+This is used to determine if a reader has received all relevant samples (through handling of acknack).
+It is also used to determine the gap information that is added to samples to a specific reader when necessary.
+
+
+### Heartbeats
+
+A writer is triggered to send heartbeats once in a while. Normally, that is broadcasted. But, for the volatile secure writer, it has to be send to each reader specifically. The heartbeat submessage that is send to each reader individually is encoded with a reader specific key. This key is generated from the shared secret which was determined during the authentication phase.
+ 
+When a writer should send heartbeats, ```handle_xevk_heartbeat()``` is called. For the volatile secure writer, the control is immediately submitted to ```send_heartbeat_to_all_readers()```. This will add heartbeat submessages to an rtps message for every reader it deems necessary.
+
+
+### Reorder
+
+Normally received samples are placed in the reorder administration of the proxy_writer. However in this case the writer applies a content filter which is specific for each destinated reader. In that case the common reorder administration in the proxy_writer can not be used and the reader specific reorder administration must be used to handle the gap's which will be reader specific.
+
+</br>
+</br>
+</br>
+=================================================</br>
+Notes</br>
+=================================================</br>
+
+### Trying to put the security participant volatile endpoint implementation into context.
+
+The following elements are added to the data structures:
+
+* struct wr_prd_match::lst_seq     : Highest seq send to this reader used when filter is applied
+* struct pwr_rd_match::last_seq    : Reader specific last received sequence number from the writer.
+* struct proxy_writer::uses_filter : Indicates that a content-filter is active
+* struct proxy_reader::filter      : The filter to apply for this specific reader
+
+Functions added:
+
+* writer_hbcontrol_p2p : This function creates a heartbeat destined for a specific reader. The volatile secure writer will use an submessage encoding which uses a distinct key for each reader. Therefor a reader specific heartbeat is needed. 
+* nn_defrag_prune : When a volatile secure reader is deleted then the defragmentation administration could still contain messages destined for this reader. This function removes these messages from the defragmentation administration. 
+* volatile_secure_data_filter : The filter applied to the secure volatile messages which filters on the destination participant guid.
+* write_sample_p2p_wrlock_held : This function writes a message to a particular reader.
+
+The use of the content-filter for the volatile secure writer implies that for each destination reader which message from the writer history cache is valid and had to be sent.
+For messages that do not match this filter a GAP message should be sent to the reader. Each time a message is sent to a specific reader a possible gap message is added.
+For the volatile secure writer the sequence number of the last message send to a particular reader is maintained in ```wr_prd_match::lst_seq'''. It is used to determine if a
+HEARTBEAT has to send to this particular reader or that the reader has acknowledged all messages. At the reader side the sequence number of the last received message is
+maintained in ```pwr_rd_match::last_seq'''. It is used to determine the contents of the ACKNACK message as response to a received HEARTBEAT.
+When an ACKNACK (handle_AckNack) is received it is determined which samples should be resent related to the applied filter and for which sequence numbers a GAP message should be sent.
diff --git a/src/core/ddsi/include/dds/ddsi/ddsi_security_msg.h b/src/core/ddsi/include/dds/ddsi/ddsi_security_msg.h
index a92eb8c..2db227c 100644
--- a/src/core/ddsi/include/dds/ddsi/ddsi_security_msg.h
+++ b/src/core/ddsi/include/dds/ddsi/ddsi_security_msg.h
@@ -21,6 +21,11 @@
 extern "C" {
 #endif
 
+struct participant;
+struct writer;
+struct proxy_reader;
+struct ddsi_serdata;
+
 #define GMCLASSID_SECURITY_AUTH_REQUEST       "dds.sec.auth_request"
 #define GMCLASSID_SECURITY_AUTH_HANDSHAKE     "dds.sec.auth"
 
@@ -32,7 +37,7 @@ typedef struct nn_message_identity {
 typedef struct nn_participant_generic_message {
   nn_message_identity_t message_identity;
   nn_message_identity_t related_message_identity;
-  ddsi_guid_t destinaton_participant_guid;
+  ddsi_guid_t destination_participant_guid;
   ddsi_guid_t destination_endpoint_guid;
   ddsi_guid_t source_endpoint_guid;
   const char *message_class_id;
@@ -84,6 +89,21 @@ nn_participant_generic_message_serialize(
 
 DDS_EXPORT extern const enum pserop pserop_participant_generic_message[];
 
+DDS_EXPORT int
+write_crypto_exchange_message(
+   const struct participant *pp,
+   const ddsi_guid_t *dst_pguid,
+   const ddsi_guid_t *src_eguid,
+   const ddsi_guid_t *dst_eguid,
+   const char *classid,
+   const nn_dataholderseq_t *tokens);
+
+DDS_EXPORT int
+volatile_secure_data_filter(
+   struct writer *wr,
+   struct proxy_reader *prd,
+   struct ddsi_serdata *serdata);
+
 #if defined (__cplusplus)
 }
 #endif
diff --git a/src/core/ddsi/include/dds/ddsi/q_entity.h b/src/core/ddsi/include/dds/ddsi/q_entity.h
index d782994..46117c7 100644
--- a/src/core/ddsi/include/dds/ddsi/q_entity.h
+++ b/src/core/ddsi/include/dds/ddsi/q_entity.h
@@ -23,6 +23,7 @@
 #include "dds/ddsi/q_hbcontrol.h"
 #include "dds/ddsi/q_feature_check.h"
 #include "dds/ddsi/q_inverse_uint32_set.h"
+#include "dds/ddsi/ddsi_serdata_default.h"
 
 #include "dds/ddsi/ddsi_tran.h"
 
@@ -92,6 +93,7 @@ struct wr_prd_match {
   seqno_t min_seq; /* smallest ack'd seq nr in subtree */
   seqno_t max_seq; /* sort-of highest ack'd seq nr in subtree (see augment function) */
   seqno_t seq; /* highest acknowledged seq nr */
+  seqno_t last_seq; /* highest seq send to this reader used when filter is applied */
   int32_t num_reliable_readers_where_seq_equals_max;
   ddsi_guid_t arbitrary_unacked_reader;
   nn_count_t next_acknack; /* next acceptable acknack sequence number */
@@ -119,8 +121,10 @@ struct pwr_rd_match {
   nn_etime_t t_heartbeat_accepted; /* (local) time a heartbeat was last accepted */
   nn_mtime_t t_last_nack; /* (local) time we last sent a NACK */  /* FIXME: probably elapsed time is better */
   seqno_t seq_last_nack; /* last seq for which we requested a retransmit */
+  seqno_t last_seq; /* last known sequence number from this writer */
   struct xevent *acknack_xevent; /* entry in xevent queue for sending acknacks */
   enum pwr_rd_match_syncstate in_sync; /* whether in sync with the proxy writer */
+  unsigned filtered:1;
   union {
     struct {
       seqno_t end_of_tl_seq; /* when seq >= end_of_tl_seq, it's in sync, =0 when not tl */
@@ -364,6 +368,7 @@ struct proxy_writer {
   unsigned deliver_synchronously: 1; /* iff 1, delivery happens straight from receive thread for non-historical data; else through delivery queue "dqueue" */
   unsigned have_seen_heartbeat: 1; /* iff 1, we have received at least on heartbeat from this proxy writer */
   unsigned local_matching_inprogress: 1; /* iff 1, we are still busy matching local readers; this is so we don't deliver incoming data to some but not all readers initially */
+  unsigned filtered: 1; /* iff 1, builtin proxy writer uses content filter, which affects heartbeats and gaps. */
 #ifdef DDSI_INCLUDE_SSM
   unsigned supports_ssm: 1; /* iff 1, this proxy writer supports SSM */
 #endif
@@ -376,6 +381,9 @@ struct proxy_writer {
   void *ddsi2direct_cbarg;
 };
 
+
+typedef int (*filter_fn_t)(struct writer *wr, struct proxy_reader *prd, struct ddsi_serdata *serdata);
+
 struct proxy_reader {
   struct entity_common e;
   struct proxy_endpoint_common c;
@@ -385,6 +393,7 @@ struct proxy_reader {
   unsigned favours_ssm: 1; /* iff 1, this proxy reader favours SSM when available */
 #endif
   ddsrt_avl_tree_t writers; /* matching LOCAL writers */
+  filter_fn_t filter;
 };
 
 extern const ddsrt_avl_treedef_t wr_readers_treedef;
diff --git a/src/core/ddsi/include/dds/ddsi/q_globals.h b/src/core/ddsi/include/dds/ddsi/q_globals.h
index c5cff1a..079e7df 100644
--- a/src/core/ddsi/include/dds/ddsi/q_globals.h
+++ b/src/core/ddsi/include/dds/ddsi/q_globals.h
@@ -238,6 +238,8 @@ struct q_globals {
   dds_qos_t builtin_endpoint_xqos_rd;
   dds_qos_t builtin_endpoint_xqos_wr;
 #ifdef DDSI_INCLUDE_SECURITY
+  dds_qos_t builtin_volatile_xqos_rd;
+  dds_qos_t builtin_volatile_xqos_wr;
   dds_qos_t builtin_stateless_xqos_rd;
   dds_qos_t builtin_stateless_xqos_wr;
 #endif
diff --git a/src/core/ddsi/include/dds/ddsi/q_hbcontrol.h b/src/core/ddsi/include/dds/ddsi/q_hbcontrol.h
index ca6a56f..b79dbf8 100644
--- a/src/core/ddsi/include/dds/ddsi/q_hbcontrol.h
+++ b/src/core/ddsi/include/dds/ddsi/q_hbcontrol.h
@@ -36,6 +36,11 @@ struct nn_xmsg *writer_hbcontrol_piggyback (struct writer *wr, const struct whc_
 int writer_hbcontrol_must_send (const struct writer *wr, const struct whc_state *whcst, nn_mtime_t tnow);
 struct nn_xmsg *writer_hbcontrol_create_heartbeat (struct writer *wr, const struct whc_state *whcst, nn_mtime_t tnow, int hbansreq, int issync);
 
+#ifdef DDSI_INCLUDE_SECURITY
+struct nn_xmsg *writer_hbcontrol_p2p(struct writer *wr, const struct whc_state *whcst, int hbansreq, struct proxy_reader *prd);
+#endif
+
+
 #if defined (__cplusplus)
 }
 #endif
diff --git a/src/core/ddsi/include/dds/ddsi/q_misc.h b/src/core/ddsi/include/dds/ddsi/q_misc.h
index 569f342..13ffade 100644
--- a/src/core/ddsi/include/dds/ddsi/q_misc.h
+++ b/src/core/ddsi/include/dds/ddsi/q_misc.h
@@ -35,6 +35,8 @@ unsigned char normalize_data_datafrag_flags (const SubmessageHeader_t *smhdr);
 int WildcardOverlap(char * p1, char * p2);
 #endif
 
+DDS_EXPORT int guid_prefix_eq (const ddsi_guid_prefix_t *a, const ddsi_guid_prefix_t *b);
+DDS_EXPORT int guid_eq (const struct ddsi_guid *a, const struct ddsi_guid *b);
 DDS_EXPORT int ddsi2_patmatch (const char *pat, const char *str);
 
 uint32_t crc32_calc (const void *buf, size_t length);
diff --git a/src/core/ddsi/include/dds/ddsi/q_protocol.h b/src/core/ddsi/include/dds/ddsi/q_protocol.h
index 3e58cb6..2fa13bf 100644
--- a/src/core/ddsi/include/dds/ddsi/q_protocol.h
+++ b/src/core/ddsi/include/dds/ddsi/q_protocol.h
@@ -98,7 +98,8 @@ typedef struct {
 #define NN_BUILTIN_ENDPOINT_PARTICIPANT_MESSAGE_SECURE_DETECTOR (1u<<21)
 #define NN_BUILTIN_ENDPOINT_PARTICIPANT_STATELESS_MESSAGE_ANNOUNCER (1u<<22)
 #define NN_BUILTIN_ENDPOINT_PARTICIPANT_STATELESS_MESSAGE_DETECTOR (1u<<23)
-/* TODO: ENDPOINT_PARTICIPANT_VOLATILE */
+#define NN_BUILTIN_ENDPOINT_PARTICIPANT_VOLATILE_SECURE_ANNOUNCER (1u<<24)
+#define NN_BUILTIN_ENDPOINT_PARTICIPANT_VOLATILE_SECURE_DETECTOR (1u<<25)
 #define NN_DISC_BUILTIN_ENDPOINT_PARTICIPANT_SECURE_ANNOUNCER (1u << 26)
 #define NN_DISC_BUILTIN_ENDPOINT_PARTICIPANT_SECURE_DETECTOR (1u << 27)
 
diff --git a/src/core/ddsi/include/dds/ddsi/q_radmin.h b/src/core/ddsi/include/dds/ddsi/q_radmin.h
index 862d1ee..b165afe 100644
--- a/src/core/ddsi/include/dds/ddsi/q_radmin.h
+++ b/src/core/ddsi/include/dds/ddsi/q_radmin.h
@@ -219,6 +219,7 @@ void nn_defrag_free (struct nn_defrag *defrag);
 struct nn_rsample *nn_defrag_rsample (struct nn_defrag *defrag, struct nn_rdata *rdata, const struct nn_rsample_info *sampleinfo);
 void nn_defrag_notegap (struct nn_defrag *defrag, seqno_t min, seqno_t maxp1);
 int nn_defrag_nackmap (struct nn_defrag *defrag, seqno_t seq, uint32_t maxfragnum, struct nn_fragment_number_set_header *map, uint32_t *mapbits, uint32_t maxsz);
+void nn_defrag_prune (struct nn_defrag *defrag, ddsi_guid_prefix_t *dst, seqno_t min);
 
 struct nn_reorder *nn_reorder_new (const struct ddsrt_log_cfg *logcfg, enum nn_reorder_mode mode, uint32_t max_samples, bool late_ack_mode);
 void nn_reorder_free (struct nn_reorder *r);
@@ -229,6 +230,7 @@ nn_reorder_result_t nn_reorder_gap (struct nn_rsample_chain *sc, struct nn_reord
 int nn_reorder_wantsample (struct nn_reorder *reorder, seqno_t seq);
 unsigned nn_reorder_nackmap (struct nn_reorder *reorder, seqno_t base, seqno_t maxseq, struct nn_sequence_number_set_header *map, uint32_t *mapbits, uint32_t maxsz, int notail);
 seqno_t nn_reorder_next_seq (const struct nn_reorder *reorder);
+void nn_reorder_set_next_seq (struct nn_reorder *reorder, seqno_t seq);
 
 struct nn_dqueue *nn_dqueue_new (const char *name, const struct q_globals *gv, uint32_t max_samples, nn_dqueue_handler_t handler, void *arg);
 void nn_dqueue_free (struct nn_dqueue *q);
diff --git a/src/core/ddsi/include/dds/ddsi/q_receive.h b/src/core/ddsi/include/dds/ddsi/q_receive.h
index e165bea..0c8650d 100644
--- a/src/core/ddsi/include/dds/ddsi/q_receive.h
+++ b/src/core/ddsi/include/dds/ddsi/q_receive.h
@@ -21,11 +21,25 @@ struct nn_rsample_info;
 struct nn_rdata;
 struct ddsi_tran_listener;
 struct recv_thread_arg;
+struct writer;
+struct proxy_reader;
+
+struct nn_gap_info {
+  int64_t gapstart;
+  int64_t gapend;
+  unsigned gapnumbits;
+  unsigned gapbits[256 / 32];
+};
+
+void nn_gap_info_init(struct nn_gap_info *gi);
+void nn_gap_info_update(struct q_globals *gv, struct nn_gap_info *gi, int64_t seqnr);
+struct nn_xmsg * nn_gap_info_create_gap(struct writer *wr, struct proxy_reader *prd, struct nn_gap_info *gi);
 
 void trigger_recv_threads (const struct q_globals *gv);
 uint32_t recv_thread (void *vrecv_thread_arg);
 uint32_t listen_thread (struct ddsi_tran_listener * listener);
 int user_dqueue_handler (const struct nn_rsample_info *sampleinfo, const struct nn_rdata *fragchain, const ddsi_guid_t *rdguid, void *qarg);
+int add_Gap (struct nn_xmsg *msg, struct writer *wr, struct proxy_reader *prd, seqno_t start, seqno_t base, uint32_t numbits, const uint32_t *bits);
 
 #if defined (__cplusplus)
 }
diff --git a/src/core/ddsi/include/dds/ddsi/q_rtps.h b/src/core/ddsi/include/dds/ddsi/q_rtps.h
index 71382f4..448639c 100644
--- a/src/core/ddsi/include/dds/ddsi/q_rtps.h
+++ b/src/core/ddsi/include/dds/ddsi/q_rtps.h
@@ -53,7 +53,8 @@ typedef int64_t seqno_t;
 #define NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_STATELESS_MESSAGE_READER 0x201c4
 #define NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_MESSAGE_SECURE_WRITER 0xff0200c2
 #define NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_MESSAGE_SECURE_READER 0xff0200c7
-/* TODO: ENDPOINT_PARTICIPANT_VOLATILE */
+#define NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_VOLATILE_SECURE_WRITER 0xff0202c3
+#define NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_VOLATILE_SECURE_READER 0xff0202c4
 #define NN_ENTITYID_SPDP_RELIABLE_BUILTIN_PARTICIPANT_SECURE_WRITER 0xff0101c2
 #define NN_ENTITYID_SPDP_RELIABLE_BUILTIN_PARTICIPANT_SECURE_READER 0xff0101c7
 
diff --git a/src/core/ddsi/include/dds/ddsi/q_transmit.h b/src/core/ddsi/include/dds/ddsi/q_transmit.h
index c7899e6..9120f7e 100644
--- a/src/core/ddsi/include/dds/ddsi/q_transmit.h
+++ b/src/core/ddsi/include/dds/ddsi/q_transmit.h
@@ -43,6 +43,7 @@ int write_sample_nogc_notk (struct thread_state1 * const ts1, struct nn_xpack *x
 dds_return_t create_fragment_message (struct writer *wr, seqno_t seq, const struct nn_plist *plist, struct ddsi_serdata *serdata, unsigned fragnum, struct proxy_reader *prd,struct nn_xmsg **msg, int isnew);
 int enqueue_sample_wrlock_held (struct writer *wr, seqno_t seq, const struct nn_plist *plist, struct ddsi_serdata *serdata, struct proxy_reader *prd, int isnew);
 void add_Heartbeat (struct nn_xmsg *msg, struct writer *wr, const struct whc_state *whcst, int hbansreq, ddsi_entityid_t dst, int issync);
+int write_sample_p2p_wrlock_held(struct writer *wr, seqno_t seq, struct nn_plist *plist, struct ddsi_serdata *serdata, struct ddsi_tkmap_instance *tk, struct proxy_reader *prd);
 
 #if defined (__cplusplus)
 }
diff --git a/src/core/ddsi/src/ddsi_security_msg.c b/src/core/ddsi/src/ddsi_security_msg.c
index afed603..8a93845 100644
--- a/src/core/ddsi/src/ddsi_security_msg.c
+++ b/src/core/ddsi/src/ddsi_security_msg.c
@@ -11,9 +11,15 @@
  */
 #include <stddef.h>
 #include <string.h>
+#include "dds/ddsrt/md5.h"
 #include "dds/ddsrt/heap.h"
 #include "dds/ddsrt/string.h"
+#include "dds/ddsi/q_plist.h"
 #include "dds/ddsi/q_bswap.h"
+#include "dds/ddsi/q_entity.h"
+#include "dds/ddsi/q_transmit.h"
+#include "dds/ddsi/q_misc.h"
+#include "dds/ddsi/ddsi_tkmap.h"
 #include "dds/ddsi/ddsi_security_msg.h"
 #include "dds/ddsi/ddsi_plist_generic.h"
 
@@ -22,7 +28,7 @@ const enum pserop pserop_participant_generic_message[] =
   /* nn_participant_generic_message */
   XG, Xl,              /* nn_message_identity_t message_identity         */
   XG, Xl,              /* nn_message_identity_t related_message_identity */
-  XG,                  /* ddsi_guid_t destinaton_participant_guid        */
+  XG,                  /* ddsi_guid_t destination_participant_guid       */
   XG,                  /* ddsi_guid_t destination_endpoint_guid          */
   XG,                  /* ddsi_guid_t source_endpoint_guid               */
   XS,                  /* char* message_class_id                         */
@@ -106,7 +112,7 @@ nn_participant_generic_message_init(
   }
 
   if (dstpguid)
-    msg->destinaton_participant_guid = *dstpguid;
+    msg->destination_participant_guid = *dstpguid;
 
   if (dsteguid)
     msg->destination_endpoint_guid = *dsteguid;
@@ -147,3 +153,104 @@ nn_participant_generic_message_deseralize(
   assert(sizeof(nn_participant_generic_message_t) == plist_memsize_generic(pserop_participant_generic_message));
   return plist_deser_generic (msg, data, len, bswap, pserop_participant_generic_message);
 }
+
+int
+write_crypto_exchange_message(
+   const struct participant *pp,
+   const ddsi_guid_t *dst_pguid,
+   const ddsi_guid_t *src_eguid,
+   const ddsi_guid_t *dst_eguid,
+   const char *classid,
+   const nn_dataholderseq_t *tokens)
+{
+  struct q_globals * const gv = pp->e.gv;
+  struct nn_participant_generic_message pmg;
+  struct ddsi_tkmap_instance *tk;
+  struct ddsi_serdata *serdata;
+  struct proxy_reader *prd;
+  ddsi_guid_t prd_guid;
+  unsigned char *data;
+  size_t len;
+  struct writer *wr;
+  seqno_t seq;
+  int r;
+
+  if ((wr = get_builtin_writer (pp, NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_VOLATILE_SECURE_WRITER)) == NULL)
+  {
+    GVLOG (DDS_LC_DISCOVERY, "write_crypto_exchange_message("PGUIDFMT") - builtin volatile secure writer not found\n", PGUID (pp->e.guid));
+    return -1;
+  }
+
+  prd_guid.prefix = dst_pguid->prefix;
+  prd_guid.entityid.u = NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_VOLATILE_SECURE_READER;
+  if ((prd = ephash_lookup_proxy_reader_guid (gv->guid_hash, &prd_guid)) == NULL)
+  {
+    return -1;
+  }
+
+  GVLOG (DDS_LC_DISCOVERY, "send crypto tokens("PGUIDFMT" --> "PGUIDFMT")\n", PGUID (wr->e.guid), PGUID (prd_guid));
+
+  ddsrt_mutex_lock (&wr->e.lock);
+  seq = ++wr->seq;
+
+  /* Get serialized message. */
+  nn_participant_generic_message_init(&pmg, &wr->e.guid, seq, dst_pguid, dst_eguid, src_eguid, classid, tokens, NULL);
+  nn_participant_generic_message_serialize(&pmg, &data, &len);
+
+  /* Get the key value. */
+  ddsrt_md5_state_t md5st;
+  ddsrt_md5_byte_t digest[16];
+  ddsrt_md5_init (&md5st);
+  ddsrt_md5_append (&md5st, (const ddsrt_md5_byte_t *)data, sizeof (nn_message_identity_t));
+  ddsrt_md5_finish (&md5st, digest);
+
+  /* Write the sample. */
+  struct ddsi_rawcdr_sample raw = {
+    .blob = data,
+    .size = len,
+    .key = digest,
+    .keysize = 16
+  };
+  serdata = ddsi_serdata_from_sample (gv->rawcdr_topic, SDK_DATA, &raw);
+  tk = ddsi_tkmap_lookup_instance_ref (gv->m_tkmap, serdata);
+  r = write_sample_p2p_wrlock_held(wr, seq, NULL, serdata, tk, prd);
+  ddsi_tkmap_instance_unref (gv->m_tkmap, tk);
+  ddsi_serdata_unref (serdata);
+
+  nn_participant_generic_message_deinit(&pmg);
+
+  ddsrt_mutex_unlock (&wr->e.lock);
+
+  return r;
+}
+
+int volatile_secure_data_filter(struct writer *wr, struct proxy_reader *prd, struct ddsi_serdata *serdata)
+{
+  static const size_t guid_offset = offsetof(nn_participant_generic_message_t, destination_participant_guid);
+  ddsrt_iovec_t guid_ref = { .iov_len=0, .iov_base=NULL };
+  ddsi_guid_t *msg_guid;
+  ddsi_guid_t pp_guid;
+  int pass;
+
+  DDSRT_UNUSED_ARG(wr);
+
+  assert(wr);
+  assert(prd);
+  assert(serdata);
+
+  (void)ddsi_serdata_to_ser_ref(serdata, guid_offset, sizeof(ddsi_guid_t), &guid_ref);
+  assert(guid_ref.iov_len == sizeof(ddsi_guid_t));
+  assert(guid_ref.iov_base);
+  msg_guid = (ddsi_guid_t*)guid_ref.iov_base;
+
+  pass = is_null_guid(msg_guid);
+  if (!pass)
+  {
+    pp_guid = nn_hton_guid(prd->c.proxypp->e.guid);
+    pass = guid_eq(msg_guid, &pp_guid);
+  }
+
+  ddsi_serdata_to_ser_unref(serdata, &guid_ref);
+
+  return pass;
+}
diff --git a/src/core/ddsi/src/ddsi_security_omg.c b/src/core/ddsi/src/ddsi_security_omg.c
index b471fb7..ccaccf3 100644
--- a/src/core/ddsi/src/ddsi_security_omg.c
+++ b/src/core/ddsi/src/ddsi_security_omg.c
@@ -206,6 +206,9 @@ is_proxy_participant_deletion_allowed(
   assert(gv);
   assert(guid);
 
+  /* TODO: Check if the proxy writer guid prefix matches that of the proxy
+   *       participant. Deletion is not allowed when they're not equal. */
+
   /* Always allow deletion from a secure proxy writer. */
   if (pwr_entityid.u == NN_ENTITYID_SPDP_RELIABLE_BUILTIN_PARTICIPANT_SECURE_WRITER)
     return true;
diff --git a/src/core/ddsi/src/q_ddsi_discovery.c b/src/core/ddsi/src/q_ddsi_discovery.c
index 11022af..2e3b1d1 100644
--- a/src/core/ddsi/src/q_ddsi_discovery.c
+++ b/src/core/ddsi/src/q_ddsi_discovery.c
@@ -1821,6 +1821,9 @@ int builtins_dqueue_handler (const struct nn_rsample_info *sampleinfo, const str
     case NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_STATELESS_MESSAGE_WRITER:
       /* TODO: Handshake */
       break;
+    case NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_VOLATILE_SECURE_WRITER:
+      /* TODO: Key exchange */
+      break;
 #endif
     default:
       GVLOGDISC ("data(builtin, vendor %u.%u): "PGUIDFMT" #%"PRId64": not handled\n",
diff --git a/src/core/ddsi/src/q_entity.c b/src/core/ddsi/src/q_entity.c
index 89de419..0fbacb6 100644
--- a/src/core/ddsi/src/q_entity.c
+++ b/src/core/ddsi/src/q_entity.c
@@ -31,6 +31,7 @@
 #include "dds/ddsi/q_qosmatch.h"
 #include "dds/ddsi/q_ephash.h"
 #include "dds/ddsi/q_globals.h"
+#include "dds/ddsi/q_bswap.h"
 #include "dds/ddsi/q_addrset.h"
 #include "dds/ddsi/q_xevent.h" /* qxev_spdp, &c. */
 #include "dds/ddsi/q_ddsi_discovery.h" /* spdp_write, &c. */
@@ -50,6 +51,10 @@
 #include "dds/ddsi/ddsi_tkmap.h"
 #include "dds/ddsi/ddsi_security_omg.h"
 
+#ifdef DDSI_INCLUDE_SECURITY
+#include "dds/ddsi/ddsi_security_msg.h"
+#endif
+
 struct deleted_participant {
   ddsrt_avl_node_t avlnode;
   ddsi_guid_t guid;
@@ -490,6 +495,10 @@ static void add_security_builtin_endpoints(struct participant *pp, ddsi_guid_t *
     new_writer_guid (NULL, subguid, group_guid, pp, NULL, &gv->builtin_stateless_xqos_wr, whc_new(gv, 0, 1, 1), NULL, NULL);
     pp->bes |= NN_BUILTIN_ENDPOINT_PARTICIPANT_STATELESS_MESSAGE_ANNOUNCER;
 
+    subguid->entityid = to_entityid (NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_VOLATILE_SECURE_WRITER);
+    new_writer_guid (NULL, subguid, group_guid, pp, NULL, &gv->builtin_volatile_xqos_wr, whc_new(gv, 0, 0, 0), NULL, NULL);
+    pp->bes |= NN_BUILTIN_ENDPOINT_PARTICIPANT_VOLATILE_SECURE_ANNOUNCER;
+
     subguid->entityid = to_entityid (NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_MESSAGE_SECURE_WRITER);
     new_writer_guid (NULL, subguid, group_guid, pp, NULL, &gv->builtin_endpoint_xqos_wr, whc_new(gv, 1, 1, 1), NULL, NULL);
     pp->bes |= NN_BUILTIN_ENDPOINT_PARTICIPANT_MESSAGE_SECURE_ANNOUNCER;
@@ -522,6 +531,10 @@ static void add_security_builtin_endpoints(struct participant *pp, ddsi_guid_t *
   new_reader_guid (NULL, subguid, group_guid, pp, NULL, &gv->builtin_endpoint_xqos_rd, NULL, NULL, NULL);
   pp->bes |= NN_DISC_BUILTIN_ENDPOINT_PARTICIPANT_SECURE_DETECTOR;
 
+  subguid->entityid = to_entityid (NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_VOLATILE_SECURE_READER);
+  new_reader_guid (NULL, subguid, group_guid, pp, NULL, &gv->builtin_volatile_xqos_rd, NULL, NULL, NULL);
+  pp->bes |= NN_BUILTIN_ENDPOINT_PARTICIPANT_VOLATILE_SECURE_DETECTOR;
+
   subguid->entityid = to_entityid (NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_STATELESS_MESSAGE_READER);
   new_reader_guid (NULL, subguid, group_guid, pp, NULL, &gv->builtin_stateless_xqos_rd, NULL, NULL, NULL);
   pp->bes |= NN_BUILTIN_ENDPOINT_PARTICIPANT_STATELESS_MESSAGE_DETECTOR;
@@ -911,6 +924,8 @@ static void unref_participant (struct participant *pp, const struct ddsi_guid *g
     NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_STATELESS_MESSAGE_READER,
     NN_ENTITYID_SPDP_RELIABLE_BUILTIN_PARTICIPANT_SECURE_WRITER,
     NN_ENTITYID_SPDP_RELIABLE_BUILTIN_PARTICIPANT_SECURE_READER,
+    NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_VOLATILE_SECURE_WRITER,
+    NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_VOLATILE_SECURE_READER,
     /* PrismTech ones: */
     NN_ENTITYID_SEDP_BUILTIN_CM_PARTICIPANT_WRITER,
     NN_ENTITYID_SEDP_BUILTIN_CM_PARTICIPANT_READER,
@@ -1113,6 +1128,9 @@ struct writer *get_builtin_writer (const struct participant *pp, unsigned entity
     case NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_STATELESS_MESSAGE_WRITER:
       bes_mask = NN_BUILTIN_ENDPOINT_PARTICIPANT_STATELESS_MESSAGE_ANNOUNCER;
       break;
+    case NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_VOLATILE_SECURE_WRITER:
+      bes_mask = NN_BUILTIN_ENDPOINT_PARTICIPANT_VOLATILE_SECURE_ANNOUNCER;
+      break;
     case NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_MESSAGE_SECURE_WRITER:
       bes_mask = NN_BUILTIN_ENDPOINT_PARTICIPANT_MESSAGE_SECURE_ANNOUNCER;
       break;
@@ -1729,9 +1747,12 @@ static void proxy_writer_drop_connection (const struct ddsi_guid *pwr_guid, stru
       local_reader_ary_remove (&pwr->rdary, rd);
     }
     ddsrt_mutex_unlock (&pwr->e.lock);
-    if (m != NULL)
+    if (m)
     {
       update_reader_init_acknack_count (&rd->e.gv->logconfig, rd->e.gv->guid_hash, &rd->e.guid, m->count);
+      if (m->filtered)
+        nn_defrag_prune(pwr->defrag, &m->rd_guid.prefix, m->last_seq);
+
     }
     free_pwr_rd_match (m);
   }
@@ -1796,6 +1817,7 @@ static void writer_add_connection (struct writer *wr, struct proxy_reader *prd)
     m->seq = MAX_SEQ_NUMBER;
   else
     m->seq = wr->seq;
+  m->last_seq = m->seq;
   if (ddsrt_avl_lookup_ipath (&wr_readers_treedef, &wr->readers, &prd->e.guid, &path))
   {
     ELOGDISC (wr, "  writer_add_connection(wr "PGUIDFMT" prd "PGUIDFMT") - already connected\n",
@@ -2044,6 +2066,8 @@ static void proxy_writer_add_connection (struct proxy_writer *pwr, struct reader
   m->t_heartbeat_accepted.v = 0;
   m->t_last_nack.v = 0;
   m->seq_last_nack = 0;
+  m->last_seq = 0;
+  m->filtered = 0;
 
   /* These can change as a consequence of handling data and/or
      discovery activities. The safe way of dealing with them is to
@@ -2104,9 +2128,16 @@ static void proxy_writer_add_connection (struct proxy_writer *pwr, struct reader
      difference in practice.) */
   if (rd->reliable)
   {
+    uint32_t secondary_reorder_maxsamples = pwr->e.gv->config.secondary_reorder_maxsamples;
+
+    if (rd->e.guid.entityid.u == NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_VOLATILE_SECURE_READER)
+    {
+      secondary_reorder_maxsamples = pwr->e.gv->config.primary_reorder_maxsamples;
+      m->filtered = 1;
+    }
     m->acknack_xevent = qxev_acknack (pwr->evq, add_duration_to_mtime (tnow, pwr->e.gv->config.preemptive_ack_delay), &pwr->e.guid, &rd->e.guid);
     m->u.not_in_sync.reorder =
-      nn_reorder_new (&pwr->e.gv->logconfig, NN_REORDER_MODE_NORMAL, pwr->e.gv->config.secondary_reorder_maxsamples, pwr->e.gv->config.late_ack_mode);
+      nn_reorder_new (&pwr->e.gv->logconfig, NN_REORDER_MODE_NORMAL, secondary_reorder_maxsamples, pwr->e.gv->config.late_ack_mode);
     pwr->n_reliable_readers++;
   }
   else
@@ -2142,6 +2173,9 @@ already_matched:
   return;
 }
 
+
+
+
 static void proxy_reader_add_connection (struct proxy_reader *prd, struct writer *wr)
 {
   struct prd_wr_match *m = ddsrt_malloc (sizeof (*m));
@@ -2239,6 +2273,12 @@ static ddsi_entityid_t builtin_entityid_match (ddsi_entityid_t x)
     case NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_STATELESS_MESSAGE_READER:
       res.u = NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_STATELESS_MESSAGE_WRITER;
       break;
+    case NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_VOLATILE_SECURE_WRITER:
+      res.u = NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_VOLATILE_SECURE_READER;
+      break;
+    case NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_VOLATILE_SECURE_READER:
+      res.u = NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_VOLATILE_SECURE_WRITER;
+      break;
     case NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_MESSAGE_SECURE_WRITER:
       res.u = NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_MESSAGE_SECURE_READER;
       break;
@@ -2939,11 +2979,12 @@ static void new_writer_guid_common_init (struct writer *wr, const struct ddsi_se
   assert (wr->xqos->present & QP_RELIABILITY);
   wr->reliable = (wr->xqos->reliability.kind != DDS_RELIABILITY_BEST_EFFORT);
   assert (wr->xqos->present & QP_DURABILITY);
-  if (is_builtin_entityid (wr->e.guid.entityid, NN_VENDORID_ECLIPSE))
+  if (is_builtin_entityid (wr->e.guid.entityid, NN_VENDORID_ECLIPSE) &&
+      (wr->e.guid.entityid.u != NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_VOLATILE_SECURE_WRITER))
   {
     assert (wr->xqos->history.kind == DDS_HISTORY_KEEP_LAST);
-    assert (wr->xqos->durability.kind == DDS_DURABILITY_TRANSIENT_LOCAL ||
-            wr->e.guid.entityid.u == NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_STATELESS_MESSAGE_WRITER);
+    assert ((wr->xqos->durability.kind == DDS_DURABILITY_TRANSIENT_LOCAL) ||
+            (wr->e.guid.entityid.u == NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_STATELESS_MESSAGE_WRITER));
   }
   wr->handle_as_transient_local = (wr->xqos->durability.kind == DDS_DURABILITY_TRANSIENT_LOCAL);
   wr->include_keyhash =
@@ -3053,7 +3094,9 @@ static void new_writer_guid_common_init (struct writer *wr, const struct ddsi_se
     wr->whc_low = wr->e.gv->config.whc_lowwater_mark;
     wr->whc_high = wr->e.gv->config.whc_init_highwater_mark.value;
   }
-  assert (!is_builtin_entityid(wr->e.guid.entityid, NN_VENDORID_ECLIPSE) || (wr->whc_low == wr->whc_high && wr->whc_low == INT32_MAX));
+  assert (!(wr->e.guid.entityid.u == NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_VOLATILE_SECURE_WRITER)
+          ||
+           (wr->whc_low == wr->whc_high && wr->whc_low == INT32_MAX));
 
   /* Connection admin */
   ddsrt_avl_init (&wr_readers_treedef, &wr->readers);
@@ -3505,7 +3548,15 @@ static dds_return_t new_reader_guid
   assert (rd->xqos->present & QP_RELIABILITY);
   rd->reliable = (rd->xqos->reliability.kind != DDS_RELIABILITY_BEST_EFFORT);
   assert (rd->xqos->present & QP_DURABILITY);
-  rd->handle_as_transient_local = (rd->xqos->durability.kind == DDS_DURABILITY_TRANSIENT_LOCAL);
+  /* The builtin volatile secure writer applies a filter which is used to send the secure
+   * crypto token only to the destination reader for which the crypto tokens are applicable.
+   * Thus the builtin volatile secure reader will receive gaps in the sequence numbers of
+   * the messages received. Therefore the out-of-order list of the proxy writer cannot be
+   * used for this reader and reader specific out-of-order list must be used which is
+   * used for handling transient local data.
+   */
+  rd->handle_as_transient_local = (rd->xqos->durability.kind == DDS_DURABILITY_TRANSIENT_LOCAL) ||
+                                  (rd->e.guid.entityid.u == NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_VOLATILE_SECURE_READER);
   rd->topic = ddsi_sertopic_ref (topic);
   rd->ddsi2direct_cb = 0;
   rd->ddsi2direct_cbarg = 0;
@@ -3862,6 +3913,20 @@ static void add_proxy_builtin_endpoints(
                                  &gv->builtin_endpoint_xqos_wr,
                                  &gv->builtin_endpoint_xqos_rd);
 
+  /* Security 'volatile' proxy endpoints. */
+  static const struct bestab bestab_volatile[] = {
+    LTE (PARTICIPANT_VOLATILE_SECURE_ANNOUNCER, P2P, PARTICIPANT_VOLATILE_SECURE_WRITER),
+    LTE (PARTICIPANT_VOLATILE_SECURE_DETECTOR, P2P, PARTICIPANT_VOLATILE_SECURE_READER)
+  };
+  create_proxy_builtin_endpoints(gv,
+                                 bestab_volatile,
+                                 (int)(sizeof (bestab_volatile) / sizeof (*bestab_volatile)),
+                                 ppguid,
+                                 proxypp,
+                                 timestamp,
+                                 &gv->builtin_volatile_xqos_wr,
+                                 &gv->builtin_volatile_xqos_rd);
+
   /* Security 'stateless' proxy endpoints. */
   static const struct bestab bestab_stateless[] = {
     LTE (PARTICIPANT_STATELESS_MESSAGE_ANNOUNCER, P2P, PARTICIPANT_STATELESS_MESSAGE_WRITER),
@@ -4351,6 +4416,7 @@ int new_proxy_writer (struct q_globals *gv, const struct ddsi_guid *ppguid, cons
   pwr->last_fragnum = ~0u;
   pwr->nackfragcount = 0;
   pwr->last_fragnum_reset = 0;
+  pwr->filtered = 0;
   ddsrt_atomic_st32 (&pwr->next_deliv_seq_lowword, 1);
   if (is_builtin_entityid (pwr->e.guid.entityid, pwr->c.vendor)) {
     /* The DDSI built-in proxy writers always deliver
@@ -4396,6 +4462,19 @@ int new_proxy_writer (struct q_globals *gv, const struct ddsi_guid *ppguid, cons
   }
   reorder_mode = get_proxy_writer_reorder_mode(pwr->e.guid.entityid, isreliable);
   pwr->reorder = nn_reorder_new (&gv->logconfig, reorder_mode, gv->config.primary_reorder_maxsamples, gv->config.late_ack_mode);
+
+  if (pwr->e.guid.entityid.u == NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_VOLATILE_SECURE_WRITER)
+  {
+    /* for the builtin_volatile_secure proxy writer which uses a content filter set the next expected
+     * sequence number of the reorder administration to the maximum sequence number to ensure that effectively
+     * the reorder administration of the builtin_volatile_secure proxy writer is not used and because the corresponding
+     * reader is always considered out of sync the reorder administration of the corresponding reader will be used
+     * instead.
+     */
+    nn_reorder_set_next_seq(pwr->reorder, MAX_SEQ_NUMBER);
+    pwr->filtered = 1;
+  }
+
   pwr->dqueue = dqueue;
   pwr->evq = evq;
   pwr->ddsi2direct_cb = 0;
@@ -4595,6 +4674,15 @@ int new_proxy_reader (struct q_globals *gv, const struct ddsi_guid *ppguid, cons
 
   ddsrt_avl_init (&prd_writers_treedef, &prd->writers);
 
+#ifdef DDSI_INCLUDE_SECURITY
+  if (prd->e.guid.entityid.u == NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_VOLATILE_SECURE_READER)
+    prd->filter = volatile_secure_data_filter;
+  else
+    prd->filter = NULL;
+#else
+  prd->filter = NULL;
+#endif
+
   /* locking the entity prevents matching while the built-in topic hasn't been published yet */
   ddsrt_mutex_lock (&prd->e.lock);
   ephash_insert_proxy_reader_guid (gv->guid_hash, prd);
diff --git a/src/core/ddsi/src/q_init.c b/src/core/ddsi/src/q_init.c
index 2d880ac..5429094 100644
--- a/src/core/ddsi/src/q_init.c
+++ b/src/core/ddsi/src/q_init.c
@@ -140,6 +140,29 @@ static void make_builtin_endpoint_xqos (dds_qos_t *q, const dds_qos_t *template)
   q->durability.kind = DDS_DURABILITY_TRANSIENT_LOCAL;
 }
 
+#ifdef DDSI_INCLUDE_SECURITY
+static void make_builtin_volatile_endpoint_xqos (dds_qos_t *q, const dds_qos_t *template)
+{
+  nn_xqos_copy (q, template);
+  q->reliability.kind = DDS_RELIABILITY_RELIABLE;
+  q->reliability.max_blocking_time = 100 * T_MILLISECOND;
+  q->durability.kind = DDS_DURABILITY_VOLATILE;
+  q->history.kind = DDS_HISTORY_KEEP_ALL;
+}
+
+static void add_property_to_xqos(dds_qos_t *q, const char *name, const char *value)
+{
+  assert(!(q->present & QP_PROPERTY_LIST));
+  q->present |= QP_PROPERTY_LIST;
+  q->property.value.n = 1;
+  q->property.value.props = ddsrt_malloc(sizeof(dds_property_t));
+  q->property.binary_value.n = 0;
+  q->property.binary_value.props = NULL;
+  q->property.value.props[0].name = ddsrt_strdup(name);
+  q->property.value.props[0].value = ddsrt_strdup(value);
+}
+#endif
+
 static int set_recvips (struct q_globals *gv)
 {
   gv->recvips = NULL;
@@ -1014,10 +1037,17 @@ int rtps_init (struct q_globals *gv)
   make_builtin_endpoint_xqos (&gv->builtin_endpoint_xqos_rd, &gv->default_xqos_rd);
   make_builtin_endpoint_xqos (&gv->builtin_endpoint_xqos_wr, &gv->default_xqos_wr);
 #ifdef DDSI_INCLUDE_SECURITY
+  make_builtin_volatile_endpoint_xqos(&gv->builtin_volatile_xqos_rd, &gv->default_xqos_rd);
+  make_builtin_volatile_endpoint_xqos(&gv->builtin_volatile_xqos_wr, &gv->default_xqos_wr);
   nn_xqos_copy (&gv->builtin_stateless_xqos_rd, &gv->default_xqos_rd);
   nn_xqos_copy (&gv->builtin_stateless_xqos_wr, &gv->default_xqos_wr);
   gv->builtin_stateless_xqos_wr.reliability.kind = DDS_RELIABILITY_BEST_EFFORT;
   gv->builtin_stateless_xqos_wr.durability.kind = DDS_DURABILITY_VOLATILE;
+
+  /* Setting these properties allows the CryptoKeyFactory to recognize
+   * the entities (see DDS Security spec chapter 8.8.8.1). */
+  add_property_to_xqos(&gv->builtin_volatile_xqos_rd, "dds.sec.builtin_endpoint_name", "BuiltinParticipantVolatileMessageSecureReader");
+  add_property_to_xqos(&gv->builtin_volatile_xqos_wr, "dds.sec.builtin_endpoint_name", "BuiltinParticipantVolatileMessageSecureWriter");
 #endif
 
   make_special_topics (gv);
@@ -1338,6 +1368,8 @@ err_unicast_sockets:
 #ifdef DDSI_INCLUDE_SECURITY
   nn_xqos_fini (&gv->builtin_stateless_xqos_wr);
   nn_xqos_fini (&gv->builtin_stateless_xqos_rd);
+  nn_xqos_fini (&gv->builtin_volatile_xqos_wr);
+  nn_xqos_fini (&gv->builtin_volatile_xqos_rd);
 #endif
   nn_xqos_fini (&gv->builtin_endpoint_xqos_wr);
   nn_xqos_fini (&gv->builtin_endpoint_xqos_rd);
@@ -1670,6 +1702,8 @@ void rtps_fini (struct q_globals *gv)
 #ifdef DDSI_INCLUDE_SECURITY
   nn_xqos_fini (&gv->builtin_stateless_xqos_wr);
   nn_xqos_fini (&gv->builtin_stateless_xqos_rd);
+  nn_xqos_fini (&gv->builtin_volatile_xqos_wr);
+  nn_xqos_fini (&gv->builtin_volatile_xqos_rd);
 #endif
   nn_xqos_fini (&gv->builtin_endpoint_xqos_wr);
   nn_xqos_fini (&gv->builtin_endpoint_xqos_rd);
diff --git a/src/core/ddsi/src/q_misc.c b/src/core/ddsi/src/q_misc.c
index 8569c01..1e4e7b5 100644
--- a/src/core/ddsi/src/q_misc.c
+++ b/src/core/ddsi/src/q_misc.c
@@ -42,6 +42,16 @@ int WildcardOverlap(char * p1, char * p2)
 }
 #endif
 
+int guid_prefix_eq (const ddsi_guid_prefix_t *a, const ddsi_guid_prefix_t *b)
+{
+  return a->u[0] == b->u[0] && a->u[1] == b->u[1] && a->u[2] == b->u[2];
+}
+
+int guid_eq (const struct ddsi_guid *a, const struct ddsi_guid *b)
+{
+  return guid_prefix_eq(&a->prefix, &b->prefix) && (a->entityid.u == b->entityid.u);
+}
+
 int ddsi2_patmatch (const char *pat, const char *str)
 {
   while (*pat)
diff --git a/src/core/ddsi/src/q_radmin.c b/src/core/ddsi/src/q_radmin.c
index d553510..f7de87c 100644
--- a/src/core/ddsi/src/q_radmin.c
+++ b/src/core/ddsi/src/q_radmin.c
@@ -1545,6 +1545,28 @@ int nn_defrag_nackmap (struct nn_defrag *defrag, seqno_t seq, uint32_t maxfragnu
   return (int) map->numbits;
 }
 
+/* There is only one defrag per proxy writer. However for the Volatile Secure writer a filter
+ * is applied to filter on the destination participant. Note that there will be one
+ * builtin Volatile Secure reader for each local participant. When this local participant
+ * is deleted the defrag buffer may still contain fragments for the associated reader.
+ * The nn_defrag_prune is used to remove these fragments and should only be used when
+ * the Volatile Secure reader is deleted.
+ */
+void nn_defrag_prune (struct nn_defrag *defrag, ddsi_guid_prefix_t *dst, seqno_t min)
+{
+  struct nn_rsample *s = ddsrt_avl_lookup_succ_eq (&defrag_sampletree_treedef, &defrag->sampletree, &min);
+  while (s)
+  {
+    struct nn_rsample *s1 = ddsrt_avl_find_succ (&defrag_sampletree_treedef, &defrag->sampletree, s);
+    if (guid_prefix_eq(&s->u.defrag.sampleinfo->rst->dst_guid_prefix, dst))
+    {
+      defrag_rsample_drop (defrag, s);
+    }
+    s = s1;
+  }
+  defrag->max_sample = ddsrt_avl_find_max (&defrag_sampletree_treedef, &defrag->sampletree);
+}
+
 /* REORDER -------------------------------------------------------------
 
    The reorder index tracks out-of-order messages as non-overlapping,
@@ -2366,6 +2388,11 @@ seqno_t nn_reorder_next_seq (const struct nn_reorder *reorder)
   return reorder->next_seq;
 }
 
+void nn_reorder_set_next_seq (struct nn_reorder *reorder, seqno_t seq)
+{
+  reorder->next_seq = seq;
+}
+
 /* DQUEUE -------------------------------------------------------------- */
 
 struct nn_dqueue {
diff --git a/src/core/ddsi/src/q_receive.c b/src/core/ddsi/src/q_receive.c
index 22a7543..667fdbe 100644
--- a/src/core/ddsi/src/q_receive.c
+++ b/src/core/ddsi/src/q_receive.c
@@ -79,6 +79,11 @@ static void deliver_user_data_synchronously (struct nn_rsample_chain *sc, const
 
 static void maybe_set_reader_in_sync (struct proxy_writer *pwr, struct pwr_rd_match *wn, seqno_t last_deliv_seq)
 {
+  if (wn->filtered)
+  {
+    wn->in_sync = PRMSS_OUT_OF_SYNC;
+    return;
+  }
   switch (wn->in_sync)
   {
     case PRMSS_SYNC:
@@ -505,7 +510,7 @@ static int valid_DataFrag (const struct receiver_state *rst, struct nn_rmsg *rms
   return 1;
 }
 
-static int add_Gap (struct nn_xmsg *msg, struct writer *wr, struct proxy_reader *prd, seqno_t start, seqno_t base, uint32_t numbits, const uint32_t *bits)
+int add_Gap (struct nn_xmsg *msg, struct writer *wr, struct proxy_reader *prd, seqno_t start, seqno_t base, uint32_t numbits, const uint32_t *bits)
 {
   struct nn_xmsg_marker sm_marker;
   Gap_t *gap;
@@ -603,6 +608,82 @@ static int accept_ack_or_hb_w_timeout (nn_count_t new_count, nn_count_t *exp_cou
   return 1;
 }
 
+void nn_gap_info_init(struct nn_gap_info *gi)
+{
+  gi->gapstart = -1;
+  gi->gapend = -1;
+  gi->gapnumbits = 0;
+  memset(gi->gapbits, 0, sizeof(gi->gapbits));
+}
+
+void nn_gap_info_update(struct q_globals *gv, struct nn_gap_info *gi, int64_t seqnr)
+{
+  if (gi->gapstart == -1)
+  {
+    GVTRACE (" M%"PRId64, seqnr);
+    gi->gapstart = seqnr;
+    gi->gapend = gi->gapstart + 1;
+  }
+  else if (seqnr == gi->gapend)
+  {
+    GVTRACE (" M%"PRId64, seqnr);
+    gi->gapend = seqnr + 1;
+  }
+  else if (seqnr - gi->gapend < 256)
+  {
+    unsigned idx = (unsigned) (seqnr - gi->gapend);
+    GVTRACE (" M%"PRId64, seqnr);
+    gi->gapnumbits = idx + 1;
+    nn_bitset_set (gi->gapnumbits, gi->gapbits, idx);
+  }
+}
+
+struct nn_xmsg * nn_gap_info_create_gap(struct writer *wr, struct proxy_reader *prd, struct nn_gap_info *gi)
+{
+  struct nn_xmsg *m;
+
+  if (gi->gapstart <= 0)
+    return NULL;
+
+  if (gi->gapnumbits == 0)
+  {
+    /* Avoid sending an invalid bitset */
+    gi->gapnumbits = 1;
+    nn_bitset_set (gi->gapnumbits, gi->gapbits, 0);
+    gi->gapend--;
+  }
+
+  m = nn_xmsg_new (wr->e.gv->xmsgpool, &wr->e.guid, wr->c.pp, 0, NN_XMSG_KIND_CONTROL);
+
+#ifdef DDSI_INCLUDE_NETWORK_PARTITIONS
+  nn_xmsg_setencoderid (m, wr->partition_id);
+#endif
+
+  if (nn_xmsg_setdstPRD (m, prd) < 0)
+  {
+    nn_xmsg_free (m);
+    m = NULL;
+  }
+  else
+  {
+    add_Gap (m, wr, prd, gi->gapstart, gi->gapend, gi->gapnumbits, gi->gapbits);
+    if (nn_xmsg_size(m) == 0)
+    {
+      nn_xmsg_free (m);
+      m = NULL;
+    }
+    else
+    {
+      unsigned i;
+      ETRACE (wr, " FXGAP%"PRId64"..%"PRId64"/%d:", gi->gapstart, gi->gapend, gi->gapnumbits);
+      for (i = 0; i < gi->gapnumbits; i++)
+        ETRACE (wr, "%c", nn_bitset_isset (gi->gapnumbits, gi->gapbits, i) ? '1' : '0');
+    }
+  }
+
+  return m;
+}
+
 static int handle_AckNack (struct receiver_state *rst, nn_etime_t tnow, const AckNack_t *msg, nn_wctime_t timestamp, SubmessageKind_t prev_smid)
 {
   struct proxy_reader *prd;
@@ -611,10 +692,9 @@ static int handle_AckNack (struct receiver_state *rst, nn_etime_t tnow, const Ac
   ddsi_guid_t src, dst;
   seqno_t seqbase;
   seqno_t seq_xmit;
+  seqno_t max_seq_available;
   nn_count_t *countp;
-  seqno_t gapstart = -1, gapend = -1;
-  unsigned gapnumbits = 0;
-  uint32_t gapbits[256 / 32];
+  struct nn_gap_info gi;
   int accelerate_rexmit = 0;
   int is_pure_ack;
   int is_pure_nonhist_ack;
@@ -626,7 +706,6 @@ static int handle_AckNack (struct receiver_state *rst, nn_etime_t tnow, const Ac
   struct whc_node *deferred_free_list = NULL;
   struct whc_state whcst;
   int hb_sent_in_response = 0;
-  memset (gapbits, 0, sizeof (gapbits));
   countp = (nn_count_t *) ((char *) msg + offsetof (AckNack_t, bits) + NN_SEQUENCE_NUMBER_SET_BITS_SIZE (msg->readerSNState.numbits));
   src.prefix = rst->src_guid_prefix;
   src.entityid = msg->readerId;
@@ -836,6 +915,7 @@ static int handle_AckNack (struct receiver_state *rst, nn_etime_t tnow, const Ac
      a future request'll fix it. */
   enqueued = 1;
   seq_xmit = writer_read_seq_xmit (wr);
+  nn_gap_info_init(&gi);
   const bool gap_for_already_acked = vendor_is_eclipse (rst->vendor) && prd->c.xqos->durability.kind == DDS_DURABILITY_VOLATILE && seqbase <= rn->seq;
   const seqno_t min_seq_to_rexmit = gap_for_already_acked ? rn->seq + 1 : 0;
   for (uint32_t i = 0; i < numbits && seqbase + i <= seq_xmit && enqueued; i++)
@@ -853,7 +933,7 @@ static int handle_AckNack (struct receiver_state *rst, nn_etime_t tnow, const Ac
         if (!wr->retransmitting && sample.unacked)
           writer_set_retransmitting (wr);
 
-        if (rst->gv->config.retransmit_merging != REXMIT_MERGE_NEVER && rn->assumed_in_sync)
+        if (rst->gv->config.retransmit_merging != REXMIT_MERGE_NEVER && rn->assumed_in_sync && !prd->filter)
         {
           /* send retransmit to all receivers, but skip if recently done */
           nn_mtime_t tstamp = now_mt ();
@@ -875,77 +955,54 @@ static int handle_AckNack (struct receiver_state *rst, nn_etime_t tnow, const Ac
         }
         else
         {
-          /* no merging, send directed retransmit */
-          RSTTRACE (" RX%"PRId64"", seqbase + i);
-          enqueued = (enqueue_sample_wrlock_held (wr, seq, sample.plist, sample.serdata, prd, 0) >= 0);
-          if (enqueued)
+          /* Is this a volatile reader with a filter?
+           * If so, call the filter to see if we should re-arrange the sequence gap when needed. */
+          if (prd->filter && !prd->filter (wr, prd, sample.serdata))
+            nn_gap_info_update (rst->gv, &gi, seqbase + i);
+          else
           {
-            max_seq_in_reply = seqbase + i;
-            msgs_sent++;
-            sample.rexmit_count++;
+            /* no merging, send directed retransmit */
+            RSTTRACE (" RX%"PRId64"", seqbase + i);
+            enqueued = (enqueue_sample_wrlock_held (wr, seq, sample.plist, sample.serdata, prd, 0) >= 0);
+            if (enqueued)
+            {
+              max_seq_in_reply = seqbase + i;
+              msgs_sent++;
+              sample.rexmit_count++;
+            }
           }
         }
-
         whc_return_sample(wr->whc, &sample, true);
       }
-      else if (gapstart == -1)
+      else
       {
-        RSTTRACE (" M%"PRId64, seqbase + i);
-        gapstart = seqbase + i;
-        gapend = gapstart + 1;
-        msgs_lost++;
-      }
-      else if (seqbase + i == gapend)
-      {
-        RSTTRACE (" M%"PRId64, seqbase + i);
-        gapend = seqbase + i + 1;
-        msgs_lost++;
-      }
-      else if (seqbase + i - gapend < 256)
-      {
-        uint32_t idx = (uint32_t) (seqbase + i - gapend);
-        RSTTRACE (" M%"PRId64, seqbase + i);
-        gapnumbits = idx + 1;
-        nn_bitset_set (gapnumbits, gapbits, idx);
+        nn_gap_info_update (rst->gv, &gi, seqbase + i);
         msgs_lost++;
       }
     }
   }
+
   if (!enqueued)
     RSTTRACE (" rexmit-limit-hit");
   /* Generate a Gap message if some of the sequence is missing */
-  if (gapstart > 0)
+  if (gi.gapstart > 0)
   {
-    struct nn_xmsg *m;
-    if (gapend == seqbase + msg->readerSNState.numbits)
+    struct nn_xmsg *gap;
+
+    if (gi.gapend == seqbase + msg->readerSNState.numbits)
+      gi.gapend = grow_gap_to_next_seq (wr, gi.gapend);
+
+    if (gi.gapend-1 + gi.gapnumbits > max_seq_in_reply)
+      max_seq_in_reply = gi.gapend-1 + gi.gapnumbits;
+
+    gap = nn_gap_info_create_gap (wr, prd, &gi);
+    if (gap)
     {
-      /* We automatically grow a gap as far as we can -- can't
-         retransmit those messages anyway, so no need for round-trip
-         to the remote reader. */
-      gapend = grow_gap_to_next_seq (wr, gapend);
+      qxev_msg (wr->evq, gap);
+      msgs_sent++;
     }
-    /* The non-bitmap part of a gap message says everything <=
-       gapend-1 is no more (so the maximum sequence number it informs
-       the peer of is gapend-1); each bit adds one sequence number to
-       that. */
-    if (gapend-1 + gapnumbits > max_seq_in_reply)
-      max_seq_in_reply = gapend-1 + gapnumbits;
-    RSTTRACE (" XGAP%"PRId64"..%"PRId64"/%u:", gapstart, gapend, gapnumbits);
-    for (uint32_t i = 0; i < gapnumbits; i++)
-      RSTTRACE ("%c", nn_bitset_isset (gapnumbits, gapbits, i) ? '1' : '0');
-    m = nn_xmsg_new (rst->gv->xmsgpool, &wr->e.guid, wr->c.pp, 0, NN_XMSG_KIND_CONTROL);
-#ifdef DDSI_INCLUDE_NETWORK_PARTITIONS
-    nn_xmsg_setencoderid (m, wr->partition_id);
-#endif
-    if (nn_xmsg_setdstPRD (m, prd) < 0)
-      nn_xmsg_free (m);
-    else
-    {
-      add_Gap (m, wr, prd, gapstart, gapend, gapnumbits, gapbits);
-      qxev_msg (wr->evq, m);
-    }
-    msgs_sent++;
   }
+
   wr->rexmit_count += msgs_sent;
   wr->rexmit_lost_count += msgs_lost;
   /* If rexmits and/or a gap message were sent, and if the last
@@ -953,7 +1010,8 @@ static int handle_AckNack (struct receiver_state *rst, nn_etime_t tnow, const Ac
      less than the last sequence number transmitted by the writer,
      tell the peer to acknowledge quickly. Not sure if that helps, but
      it might ... [NB writer->seq is the last msg sent so far] */
-  if (msgs_sent && max_seq_in_reply < seq_xmit)
+  max_seq_available = (prd->filter ? rn->last_seq : seq_xmit);
+  if (msgs_sent && max_seq_in_reply < max_seq_available)
   {
     RSTTRACE (" rexmit#%"PRIu32" maxseq:%"PRId64"<%"PRId64"<=%"PRId64"", msgs_sent, max_seq_in_reply, seq_xmit, wr->seq);
     force_heartbeat_to_peer (wr, &whcst, prd, 1);
@@ -1039,7 +1097,7 @@ static void handle_Heartbeat_helper (struct pwr_rd_match * const wn, struct hand
   struct receiver_state * const rst = arg->rst;
   Heartbeat_t const * const msg = arg->msg;
   struct proxy_writer * const pwr = arg->pwr;
-  seqno_t refseq;
+  seqno_t refseq, last_seq;
 
   ASSERT_MUTEX_HELD (&pwr->e.lock);
 
@@ -1053,7 +1111,7 @@ static void handle_Heartbeat_helper (struct pwr_rd_match * const wn, struct hand
   /* Reference sequence number for determining whether or not to
      Ack/Nack unfortunately depends on whether the reader is in
      sync. */
-  if (wn->in_sync != PRMSS_OUT_OF_SYNC)
+  if (wn->in_sync != PRMSS_OUT_OF_SYNC && !wn->filtered)
     refseq = nn_reorder_next_seq (pwr->reorder) - 1;
   else
     refseq = nn_reorder_next_seq (wn->u.not_in_sync.reorder) - 1;
@@ -1070,7 +1128,12 @@ static void handle_Heartbeat_helper (struct pwr_rd_match * const wn, struct hand
   {
     nn_mtime_t tsched;
     tsched.v = T_NEVER;
-    if (pwr->last_seq > refseq)
+
+    if (wn->filtered)
+      last_seq = wn->last_seq;
+    else
+      last_seq = pwr->last_seq;
+    if (last_seq > refseq)
     {
       RSTTRACE ("/NAK");
       if (arg->tnow_mt.v >= wn->t_last_nack.v + rst->gv->config.nack_delay || refseq >= wn->seq_last_nack)
@@ -1195,44 +1258,73 @@ static int handle_Heartbeat (struct receiver_state *rst, nn_etime_t tnow, struct
     int refc_adjust = 0;
     nn_reorder_result_t res;
     gap = nn_rdata_newgap (rmsg);
-    if ((res = nn_reorder_gap (&sc, pwr->reorder, gap, 1, firstseq, &refc_adjust)) > 0)
+    int filtered = 0;
+
+    if (pwr->filtered && !is_null_guid(&dst))
     {
-      if (pwr->deliver_synchronously)
-        deliver_user_data_synchronously (&sc, NULL);
-      else
-        nn_dqueue_enqueue (pwr->dqueue, &sc, res);
-    }
-    for (wn = ddsrt_avl_find_min (&pwr_readers_treedef, &pwr->readers); wn; wn = ddsrt_avl_find_succ (&pwr_readers_treedef, &pwr->readers, wn))
-      if (wn->in_sync != PRMSS_SYNC)
+      for (wn = ddsrt_avl_find_min (&pwr_readers_treedef, &pwr->readers); wn; wn = ddsrt_avl_find_succ (&pwr_readers_treedef, &pwr->readers, wn))
       {
-        seqno_t last_deliv_seq = 0;
-        switch (wn->in_sync)
+        if (guid_eq(&wn->rd_guid, &dst))
         {
-          case PRMSS_SYNC:
-            assert(0);
-            break;
-          case PRMSS_TLCATCHUP:
-            last_deliv_seq = nn_reorder_next_seq (pwr->reorder) - 1;
-            break;
-          case PRMSS_OUT_OF_SYNC: {
+          if (wn->filtered)
+          {
             struct nn_reorder *ro = wn->u.not_in_sync.reorder;
             if ((res = nn_reorder_gap (&sc, ro, gap, 1, firstseq, &refc_adjust)) > 0)
+              nn_dqueue_enqueue1 (pwr->dqueue, &wn->rd_guid, &sc, res);
+            if (fromSN (msg->lastSN) > wn->last_seq)
             {
-              if (pwr->deliver_synchronously)
-                deliver_user_data_synchronously (&sc, &wn->rd_guid);
-              else
-                nn_dqueue_enqueue1 (pwr->dqueue, &wn->rd_guid, &sc, res);
+              wn->last_seq = fromSN (msg->lastSN);
             }
-            last_deliv_seq = nn_reorder_next_seq (wn->u.not_in_sync.reorder) - 1;
+            filtered = 1;
           }
+          break;
         }
-        if (wn->u.not_in_sync.end_of_tl_seq == MAX_SEQ_NUMBER)
-        {
-          wn->u.not_in_sync.end_of_tl_seq = fromSN (msg->lastSN);
-          RSTTRACE (" end-of-tl-seq(rd "PGUIDFMT" #%"PRId64")", PGUID(wn->rd_guid), wn->u.not_in_sync.end_of_tl_seq);
-        }
-        maybe_set_reader_in_sync (pwr, wn, last_deliv_seq);
       }
+    }
+
+    if (!filtered)
+    {
+      if ((res = nn_reorder_gap (&sc, pwr->reorder, gap, 1, firstseq, &refc_adjust)) > 0)
+      {
+        if (pwr->deliver_synchronously)
+          deliver_user_data_synchronously (&sc, NULL);
+        else
+          nn_dqueue_enqueue (pwr->dqueue, &sc, res);
+      }
+      for (wn = ddsrt_avl_find_min (&pwr_readers_treedef, &pwr->readers); wn; wn = ddsrt_avl_find_succ (&pwr_readers_treedef, &pwr->readers, wn))
+      {
+        if (wn->in_sync != PRMSS_SYNC)
+        {
+          seqno_t last_deliv_seq = 0;
+          switch (wn->in_sync)
+          {
+            case PRMSS_SYNC:
+              assert(0);
+              break;
+            case PRMSS_TLCATCHUP:
+              last_deliv_seq = nn_reorder_next_seq (pwr->reorder) - 1;
+              break;
+            case PRMSS_OUT_OF_SYNC: {
+              struct nn_reorder *ro = wn->u.not_in_sync.reorder;
+              if ((res = nn_reorder_gap (&sc, ro, gap, 1, firstseq, &refc_adjust)) > 0)
+              {
+                if (pwr->deliver_synchronously)
+                  deliver_user_data_synchronously (&sc, &wn->rd_guid);
+                else
+                  nn_dqueue_enqueue1 (pwr->dqueue, &wn->rd_guid, &sc, res);
+              }
+              last_deliv_seq = nn_reorder_next_seq (wn->u.not_in_sync.reorder) - 1;
+            }
+          }
+          if (wn->u.not_in_sync.end_of_tl_seq == MAX_SEQ_NUMBER)
+          {
+            wn->u.not_in_sync.end_of_tl_seq = fromSN (msg->lastSN);
+            RSTTRACE (" end-of-tl-seq(rd "PGUIDFMT" #%"PRId64")", PGUID(wn->rd_guid), wn->u.not_in_sync.end_of_tl_seq);
+          }
+          maybe_set_reader_in_sync (pwr, wn, last_deliv_seq);
+        }
+      }
+    }
     nn_fragchain_adjust_refcount (gap, refc_adjust);
   }
 
@@ -1552,7 +1644,8 @@ static int handle_one_gap (struct proxy_writer *pwr, struct pwr_rd_match *wn, se
 
   /* Clean up the defrag admin: no fragments of a missing sample will
      be arriving in the future */
-  nn_defrag_notegap (pwr->defrag, a, b);
+  if (!(wn && wn->filtered))
+     nn_defrag_notegap (pwr->defrag, a, b);
 
   /* Primary reorder: the gap message may cause some samples to become
      deliverable. */
@@ -1733,6 +1826,14 @@ static int handle_Gap (struct receiver_state *rst, nn_etime_t tnow, struct nn_rm
     pwr->last_fragnum = ~0u;
     pwr->last_fragnum_reset = 0;
   }
+
+  if (wn && wn->filtered)
+  {
+    if (listbase + last_included_rel > wn->last_seq)
+    {
+      wn->last_seq = listbase + last_included_rel;
+    }
+  }
   RSTTRACE (")");
   ddsrt_mutex_unlock (&pwr->e.lock);
   return 1;
@@ -2193,105 +2294,135 @@ static void handle_regular (struct receiver_state *rst, nn_etime_t tnow, struct
     int refc_adjust = 0;
     struct nn_rsample_chain sc;
     struct nn_rdata *fragchain = nn_rsample_fragchain (rsample);
-    nn_reorder_result_t rres;
+    nn_reorder_result_t rres, rres2;
+    struct pwr_rd_match *wn;
+    int filtered = 0;
 
-    rres = nn_reorder_rsample (&sc, pwr->reorder, rsample, &refc_adjust, 0); // nn_dqueue_is_full (pwr->dqueue));
-
-    if (rres == NN_REORDER_ACCEPT && pwr->n_reliable_readers == 0)
+    if (pwr->filtered && !is_null_guid(&dst))
     {
-      /* If no reliable readers but the reorder buffer accepted the
-         sample, it must be a reliable proxy writer with only
-         unreliable readers.  "Inserting" a Gap [1, sampleinfo->seq)
-         will force delivery of this sample, and not cause the gap to
-         be added to the reorder admin. */
-      int gap_refc_adjust = 0;
-      rres = nn_reorder_gap (&sc, pwr->reorder, rdata, 1, sampleinfo->seq, &gap_refc_adjust);
-      assert (rres > 0);
-      assert (gap_refc_adjust == 0);
-    }
-
-    if (rres > 0)
-    {
-      /* Enqueue or deliver with pwr->e.lock held: to ensure no other
-         receive thread's data gets interleaved -- arguably delivery
-         needn't be exactly in-order, which would allow us to do this
-         without pwr->e.lock held. */
-      if (pwr->deliver_synchronously)
+      for (wn = ddsrt_avl_find_min (&pwr_readers_treedef, &pwr->readers); wn != NULL; wn = ddsrt_avl_find_succ (&pwr_readers_treedef, &pwr->readers, wn))
       {
-        /* FIXME: just in case the synchronous delivery runs into a delay caused
-           by the current mishandling of resource limits */
-        if (*deferred_wakeup)
-          dd_dqueue_enqueue_trigger (*deferred_wakeup);
-        deliver_user_data_synchronously (&sc, NULL);
-      }
-      else
-      {
-        if (nn_dqueue_enqueue_deferred_wakeup (pwr->dqueue, &sc, rres))
+        if (guid_eq(&wn->rd_guid, &dst))
         {
-          if (*deferred_wakeup && *deferred_wakeup != pwr->dqueue)
-            dd_dqueue_enqueue_trigger (*deferred_wakeup);
-          *deferred_wakeup = pwr->dqueue;
+          if (wn->filtered)
+          {
+            rres2 = nn_reorder_rsample (&sc, wn->u.not_in_sync.reorder, rsample, &refc_adjust, nn_dqueue_is_full (pwr->dqueue));
+            if (sampleinfo->seq > wn->last_seq)
+            {
+              wn->last_seq = sampleinfo->seq;
+            }
+            if (rres2 > 0)
+            {
+              if (!pwr->deliver_synchronously)
+                nn_dqueue_enqueue (pwr->dqueue, &sc, rres2);
+              else
+                deliver_user_data_synchronously (&sc, &wn->rd_guid);
+            }
+            filtered = 1;
+          }
+          break;
         }
       }
     }
 
-    if (pwr->n_readers_out_of_sync > 0)
+    if (!filtered)
     {
-      /* Those readers catching up with TL but in sync with the proxy
-         writer may have become in sync with the proxy writer and the
-         writer; those catching up with TL all by themselves go through
-         the "TOO_OLD" path below. */
-      ddsrt_avl_iter_t it;
-      struct pwr_rd_match *wn;
-      struct nn_rsample *rsample_dup = NULL;
-      int reuse_rsample_dup = 0;
-      for (wn = ddsrt_avl_iter_first (&pwr_readers_treedef, &pwr->readers, &it); wn != NULL; wn = ddsrt_avl_iter_next (&it))
+      rres = nn_reorder_rsample (&sc, pwr->reorder, rsample, &refc_adjust, 0); // nn_dqueue_is_full (pwr->dqueue));
+
+      if (rres == NN_REORDER_ACCEPT && pwr->n_reliable_readers == 0)
       {
-        nn_reorder_result_t rres2;
-        if (wn->in_sync == PRMSS_SYNC)
-          continue;
-        /* only need to get a copy of the first sample, because that's the one
-           that triggered delivery */
-        if (!reuse_rsample_dup)
-          rsample_dup = nn_reorder_rsample_dup_first (rmsg, rsample);
-        rres2 = nn_reorder_rsample (&sc, wn->u.not_in_sync.reorder, rsample_dup, &refc_adjust, nn_dqueue_is_full (pwr->dqueue));
-        switch (rres2)
+        /* If no reliable readers but the reorder buffer accepted the
+           sample, it must be a reliable proxy writer with only
+           unreliable readers.  "Inserting" a Gap [1, sampleinfo->seq)
+           will force delivery of this sample, and not cause the gap to
+           be added to the reorder admin. */
+        int gap_refc_adjust = 0;
+        rres = nn_reorder_gap (&sc, pwr->reorder, rdata, 1, sampleinfo->seq, &gap_refc_adjust);
+        assert (rres > 0);
+        assert (gap_refc_adjust == 0);
+      }
+
+      if (rres > 0)
+      {
+        /* Enqueue or deliver with pwr->e.lock held: to ensure no other
+           receive thread's data gets interleaved -- arguably delivery
+           needn't be exactly in-order, which would allow us to do this
+           without pwr->e.lock held. */
+        if (pwr->deliver_synchronously)
         {
-          case NN_REORDER_TOO_OLD:
-          case NN_REORDER_REJECT:
-            reuse_rsample_dup = 1;
-            break;
-          case NN_REORDER_ACCEPT:
-            reuse_rsample_dup = 0;
-            break;
-          default:
-            assert (rres2 > 0);
-            /* note: can't deliver to a reader, only to a group */
-            maybe_set_reader_in_sync (pwr, wn, sampleinfo->seq);
-            reuse_rsample_dup = 0;
-            /* No need to deliver old data to out-of-sync readers
-               synchronously -- ordering guarantees don't change
-               as fresh data will be delivered anyway and hence
-               the old data will never be guaranteed to arrive
-               in-order, and those few microseconds can't hurt in
-               catching up on transient-local data.  See also
-               NN_REORDER_DELIVER case in outer switch. */
-            if (pwr->deliver_synchronously)
-            {
-              /* FIXME: just in case the synchronous delivery runs into a delay caused
-                 by the current mishandling of resource limits */
-              deliver_user_data_synchronously (&sc, &wn->rd_guid);
-            }
-            else
-            {
-              if (*deferred_wakeup && *deferred_wakeup != pwr->dqueue)
+          /* FIXME: just in case the synchronous delivery runs into a delay caused
+             by the current mishandling of resource limits */
+          if (*deferred_wakeup)
+            dd_dqueue_enqueue_trigger (*deferred_wakeup);
+          deliver_user_data_synchronously (&sc, NULL);
+        }
+        else
+        {
+          if (nn_dqueue_enqueue_deferred_wakeup (pwr->dqueue, &sc, rres))
+          {
+            if (*deferred_wakeup && *deferred_wakeup != pwr->dqueue)
+              dd_dqueue_enqueue_trigger (*deferred_wakeup);
+            *deferred_wakeup = pwr->dqueue;
+          }
+        }
+      }
+
+      if (pwr->n_readers_out_of_sync > 0)
+      {
+        /* Those readers catching up with TL but in sync with the proxy
+           writer may have become in sync with the proxy writer and the
+           writer; those catching up with TL all by themselves go through
+           the "TOO_OLD" path below. */
+        ddsrt_avl_iter_t it;
+        struct nn_rsample *rsample_dup = NULL;
+        int reuse_rsample_dup = 0;
+        for (wn = ddsrt_avl_iter_first (&pwr_readers_treedef, &pwr->readers, &it); wn != NULL; wn = ddsrt_avl_iter_next (&it))
+        {
+          if (wn->in_sync == PRMSS_SYNC)
+            continue;
+          /* only need to get a copy of the first sample, because that's the one
+             that triggered delivery */
+          if (!reuse_rsample_dup)
+            rsample_dup = nn_reorder_rsample_dup_first (rmsg, rsample);
+          rres2 = nn_reorder_rsample (&sc, wn->u.not_in_sync.reorder, rsample_dup, &refc_adjust, nn_dqueue_is_full (pwr->dqueue));
+          switch (rres2)
+          {
+            case NN_REORDER_TOO_OLD:
+            case NN_REORDER_REJECT:
+              reuse_rsample_dup = 1;
+              break;
+            case NN_REORDER_ACCEPT:
+              reuse_rsample_dup = 0;
+              break;
+            default:
+              assert (rres2 > 0);
+              /* note: can't deliver to a reader, only to a group */
+              maybe_set_reader_in_sync (pwr, wn, sampleinfo->seq);
+              reuse_rsample_dup = 0;
+              /* No need to deliver old data to out-of-sync readers
+                 synchronously -- ordering guarantees don't change
+                 as fresh data will be delivered anyway and hence
+                 the old data will never be guaranteed to arrive
+                 in-order, and those few microseconds can't hurt in
+                 catching up on transient-local data.  See also
+                 NN_REORDER_DELIVER case in outer switch. */
+              if (pwr->deliver_synchronously)
               {
-                dd_dqueue_enqueue_trigger (*deferred_wakeup);
-                *deferred_wakeup = NULL;
+                /* FIXME: just in case the synchronous delivery runs into a delay caused
+                   by the current mishandling of resource limits */
+                deliver_user_data_synchronously (&sc, &wn->rd_guid);
               }
-              nn_dqueue_enqueue1 (pwr->dqueue, &wn->rd_guid, &sc, rres2);
-            }
-            break;
+              else
+              {
+                if (*deferred_wakeup && *deferred_wakeup != pwr->dqueue)
+                {
+                  dd_dqueue_enqueue_trigger (*deferred_wakeup);
+                  *deferred_wakeup = NULL;
+                }
+                nn_dqueue_enqueue1 (pwr->dqueue, &wn->rd_guid, &sc, rres2);
+              }
+              break;
+          }
         }
       }
     }
diff --git a/src/core/ddsi/src/q_transmit.c b/src/core/ddsi/src/q_transmit.c
index cec9693..6b7a891 100644
--- a/src/core/ddsi/src/q_transmit.c
+++ b/src/core/ddsi/src/q_transmit.c
@@ -10,6 +10,7 @@
  * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
  */
 #include <assert.h>
+#include <string.h>
 #include <math.h>
 
 #include "dds/ddsrt/heap.h"
@@ -31,6 +32,7 @@
 #include "dds/ddsi/q_entity.h"
 #include "dds/ddsi/q_unused.h"
 #include "dds/ddsi/q_hbcontrol.h"
+#include "dds/ddsi/q_receive.h"
 #include "dds/ddsi/ddsi_tkmap.h"
 #include "dds/ddsi/ddsi_serdata.h"
 #include "dds/ddsi/ddsi_sertopic.h"
@@ -104,8 +106,8 @@ int64_t writer_hbcontrol_intv (const struct writer *wr, const struct whc_state *
 
 void writer_hbcontrol_note_asyncwrite (struct writer *wr, nn_mtime_t tnow)
 {
-  struct q_globals const * const gv = wr->e.gv;
   struct hbcontrol * const hbc = &wr->hbcontrol;
+  struct q_globals const * const gv = wr->e.gv;
   nn_mtime_t tnext;
 
   /* Reset number of heartbeats since last write: that means the
@@ -315,12 +317,53 @@ struct nn_xmsg *writer_hbcontrol_piggyback (struct writer *wr, const struct whc_
             (hbc->tsched.v == T_NEVER) ? INFINITY : (double) (hbc->tsched.v - tnow.v) / 1e9,
             ddsrt_avl_is_empty (&wr->readers) ? -1 : root_rdmatch (wr)->min_seq,
             ddsrt_avl_is_empty (&wr->readers) || root_rdmatch (wr)->all_have_replied_to_hb ? "" : "!",
-            whcst->max_seq, writer_read_seq_xmit (wr));
+            whcst->max_seq, writer_read_seq_xmit(wr));
   }
 
   return msg;
 }
 
+#ifdef DDSI_INCLUDE_SECURITY
+struct nn_xmsg *writer_hbcontrol_p2p(struct writer *wr, const struct whc_state *whcst, int hbansreq, struct proxy_reader *prd)
+{
+  struct q_globals const * const gv = wr->e.gv;
+  struct nn_xmsg *msg;
+
+  ASSERT_MUTEX_HELD (&wr->e.lock);
+  assert (wr->reliable);
+
+  if ((msg = nn_xmsg_new (gv->xmsgpool, &wr->e.guid, wr->c.pp, sizeof (InfoTS_t) + sizeof (Heartbeat_t), NN_XMSG_KIND_CONTROL)) == NULL)
+    return NULL;
+
+  ETRACE (wr, "writer_hbcontrol_p2p: wr "PGUIDFMT" unicasting to prd "PGUIDFMT" ", PGUID (wr->e.guid), PGUID (prd->e.guid));
+  ETRACE (wr, "(rel-prd %d seq-eq-max %d seq %"PRId64" maxseq %"PRId64")\n",
+      wr->num_reliable_readers,
+      ddsrt_avl_is_empty (&wr->readers) ? -1 : root_rdmatch (wr)->num_reliable_readers_where_seq_equals_max,
+      wr->seq,
+      ddsrt_avl_is_empty (&wr->readers) ? (int64_t) -1 : root_rdmatch (wr)->max_seq);
+
+  /* set the destination explicitly to the unicast destination and the fourth
+     param of add_Heartbeat needs to be the guid of the reader */
+  if (nn_xmsg_setdstPRD (msg, prd) < 0)
+  {
+    nn_xmsg_free (msg);
+    return NULL;
+  }
+#ifdef DDSI_INCLUDE_NETWORK_PARTITIONS
+  nn_xmsg_setencoderid (msg, wr->partition_id);
+#endif
+  add_Heartbeat (msg, wr, whcst, hbansreq, prd->e.guid.entityid, 1);
+
+  if (nn_xmsg_size(msg) == 0)
+  {
+    nn_xmsg_free (msg);
+    msg = NULL;
+  }
+
+  return msg;
+}
+#endif
+
 void add_Heartbeat (struct nn_xmsg *msg, struct writer *wr, const struct whc_state *whcst, int hbansreq, ddsi_entityid_t dst, int issync)
 {
   struct q_globals const * const gv = wr->e.gv;
@@ -1051,6 +1094,65 @@ static int maybe_grow_whc (struct writer *wr)
   return 0;
 }
 
+int write_sample_p2p_wrlock_held(struct writer *wr, seqno_t seq, struct nn_plist *plist, struct ddsi_serdata *serdata, struct ddsi_tkmap_instance *tk, struct proxy_reader *prd)
+{
+  struct q_globals * const gv = wr->e.gv;
+  int r;
+  nn_mtime_t tnow;
+  int rexmit = 1;
+  struct wr_prd_match *wprd = NULL;
+  seqno_t gseq;
+  struct nn_xmsg *gap = NULL;
+
+  tnow = now_mt ();
+  serdata->twrite = tnow;
+  serdata->timestamp = now();
+
+  if (prd->filter)
+  {
+    if ((wprd = ddsrt_avl_lookup (&wr_readers_treedef, &wr->readers, &prd->e.guid)) != NULL)
+    {
+      rexmit = prd->filter(wr, prd, serdata);
+      /* determine if gap has to added */
+      if (rexmit)
+      {
+        struct nn_gap_info gi;
+
+        GVLOG (DDS_LC_DISCOVERY, "send filtered "PGUIDFMT" last_seq=%"PRIu64" seq=%"PRIu64"\n", PGUID (wr->e.guid), wprd->seq, seq);
+
+        nn_gap_info_init(&gi);
+        for (gseq = wprd->seq + 1; gseq < seq; gseq++)
+        {
+          struct whc_borrowed_sample sample;
+          if (whc_borrow_sample (wr->whc, seq, &sample))
+          {
+            if (prd->filter(wr, prd, sample.serdata) == 0)
+            {
+              nn_gap_info_update(wr->e.gv, &gi, gseq);
+            }
+            whc_return_sample (wr->whc, &sample, false);
+          }
+        }
+        gap = nn_gap_info_create_gap(wr, prd, &gi);
+      }
+      wprd->last_seq = seq;
+    }
+  }
+
+  if ((r = insert_sample_in_whc (wr, seq, plist, serdata, tk)) >= 0)
+  {
+    enqueue_sample_wrlock_held (wr, seq, plist, serdata, prd, 1);
+
+    if (gap)
+      qxev_msg (wr->evq, gap);
+
+    if (wr->heartbeat_xevent)
+      writer_hbcontrol_note_asyncwrite(wr, tnow);
+  }
+
+  return r;
+}
+
 static int write_sample_eot (struct thread_state1 * const ts1, struct nn_xpack *xp, struct writer *wr, struct nn_plist *plist, struct ddsi_serdata *serdata, struct ddsi_tkmap_instance *tk, int end_of_txn, int gc_allowed)
 {
   struct q_globals const * const gv = wr->e.gv;
diff --git a/src/core/ddsi/src/q_xevent.c b/src/core/ddsi/src/q_xevent.c
index 548508b..77a580f 100644
--- a/src/core/ddsi/src/q_xevent.c
+++ b/src/core/ddsi/src/q_xevent.c
@@ -579,6 +579,89 @@ static void handle_xevk_entityid (struct nn_xpack *xp, struct xevent_nt *ev)
   nn_xpack_addmsg (xp, ev->u.entityid.msg, 0);
 }
 
+#ifdef DDSI_INCLUDE_SECURITY
+static void send_heartbeat_to_all_readers(struct nn_xpack *xp, struct xevent *ev, struct writer *wr, nn_mtime_t tnow)
+{
+  struct whc_state whcst;
+  nn_mtime_t t_next;
+  int hbansreq = 0;
+  unsigned count = 0;
+
+  ddsrt_mutex_lock (&wr->e.lock);
+
+  whc_get_state(wr->whc, &whcst);
+
+  if (!writer_must_have_hb_scheduled (wr, &whcst))
+  {
+    hbansreq = 1; /* just for trace */
+    t_next.v = T_NEVER;
+  }
+  else if (!writer_hbcontrol_must_send (wr, &whcst, tnow))
+  {
+    hbansreq = 1; /* just for trace */
+    t_next.v = tnow.v + writer_hbcontrol_intv (wr, &whcst, tnow);
+  }
+  else
+  {
+    struct wr_prd_match *m;
+    struct ddsi_guid last_guid = { .prefix = {.u = {0,0,0}}, .entityid = {0} };
+
+    hbansreq = writer_hbcontrol_ack_required (wr, &whcst, tnow);
+    t_next.v = tnow.v + writer_hbcontrol_intv (wr, &whcst, tnow);
+
+    while ((m = ddsrt_avl_lookup_succ (&wr_readers_treedef, &wr->readers, &last_guid)) != NULL)
+    {
+      last_guid = m->prd_guid;
+      if (m->seq < m->last_seq)
+      {
+        struct proxy_reader *prd;
+
+        prd = ephash_lookup_proxy_reader_guid(wr->e.gv->guid_hash, &m->prd_guid);
+        if (prd)
+        {
+          ETRACE (wr, " heartbeat(wr "PGUIDFMT" rd "PGUIDFMT" %s) send, resched in %g s (min-ack %"PRId64", avail-seq %"PRId64")\n",
+              PGUID (wr->e.guid),
+              PGUID (m->prd_guid),
+              hbansreq ? "" : " final",
+              (double)(t_next.v - tnow.v) / 1e9,
+              m->seq,
+              m->last_seq);
+
+          struct nn_xmsg *msg = writer_hbcontrol_p2p(wr, &whcst, hbansreq, prd);
+          if (msg != NULL)
+          {
+            ddsrt_mutex_unlock (&wr->e.lock);
+            nn_xpack_addmsg (xp, msg, 0);
+            ddsrt_mutex_lock (&wr->e.lock);
+          }
+          count++;
+        }
+      }
+
+    }
+  }
+
+  resched_xevent_if_earlier (ev, t_next);
+  wr->hbcontrol.tsched = t_next;
+
+  if (count == 0)
+  {
+    (void)resched_xevent_if_earlier (ev, t_next);
+    ETRACE (wr, "heartbeat(wr "PGUIDFMT") suppressed, resched in %g s (min-ack %"PRId64"%s, avail-seq %"PRId64", xmit %"PRId64")\n",
+        PGUID (wr->e.guid),
+        (t_next.v == T_NEVER) ? INFINITY : (double)(t_next.v - tnow.v) / 1e9,
+        ddsrt_avl_is_empty (&wr->readers) ? (int64_t) -1 : ((struct wr_prd_match *) ddsrt_avl_root (&wr_readers_treedef, &wr->readers))->min_seq,
+        ddsrt_avl_is_empty (&wr->readers) || ((struct wr_prd_match *) ddsrt_avl_root (&wr_readers_treedef, &wr->readers))->all_have_replied_to_hb ? "" : "!",
+        whcst.max_seq,
+        writer_read_seq_xmit(wr));
+  }
+
+  ddsrt_mutex_unlock (&wr->e.lock);
+}
+
+
+#endif
+
 static void handle_xevk_heartbeat (struct nn_xpack *xp, struct xevent *ev, nn_mtime_t tnow /* monotonic */)
 {
   struct q_globals const * const gv = ev->evq->gv;
@@ -594,6 +677,14 @@ static void handle_xevk_heartbeat (struct nn_xpack *xp, struct xevent *ev, nn_mt
     return;
   }
 
+#ifdef DDSI_INCLUDE_SECURITY
+  if (wr->e.guid.entityid.u == NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_VOLATILE_SECURE_WRITER)
+  {
+    send_heartbeat_to_all_readers(xp, ev, wr, tnow);
+    return;
+  }
+#endif
+
   ddsrt_mutex_lock (&wr->e.lock);
   assert (wr->reliable);
   whc_get_state(wr->whc, &whcst);
@@ -701,7 +792,7 @@ static void add_AckNack (struct nn_xmsg *msg, struct proxy_writer *pwr, struct p
   AckNack_t *an;
   struct nn_xmsg_marker sm_marker;
   uint32_t i, numbits;
-  seqno_t base;
+  seqno_t base, last_seq;
 
   DDSRT_STATIC_ASSERT ((NN_FRAGMENT_NUMBER_SET_MAX_BITS % 32) == 0);
   struct {
@@ -716,7 +807,7 @@ static void add_AckNack (struct nn_xmsg *msg, struct proxy_writer *pwr, struct p
 
   /* if in sync, look at proxy writer status, else look at
      proxy-writer--reader match status */
-  if (rwn->in_sync != PRMSS_OUT_OF_SYNC)
+  if (rwn->in_sync != PRMSS_OUT_OF_SYNC && !rwn->filtered)
   {
     reorder = pwr->reorder;
     if (!pwr->e.gv->config.late_ack_mode)
@@ -734,6 +825,11 @@ static void add_AckNack (struct nn_xmsg *msg, struct proxy_writer *pwr, struct p
     bitmap_base = nn_reorder_next_seq (reorder);
   }
 
+  if (rwn->filtered)
+    last_seq = rwn->last_seq;
+  else
+    last_seq = pwr->last_seq;
+
   an = nn_xmsg_append (msg, &sm_marker, ACKNACK_SIZE_MAX);
   nn_xmsg_submsg_init (msg, sm_marker, SMID_ACKNACK);
   an->readerId = nn_hton_entityid (rwn->rd_guid.entityid);
@@ -741,7 +837,7 @@ static void add_AckNack (struct nn_xmsg *msg, struct proxy_writer *pwr, struct p
 
   /* Make bitmap; note that we've made sure to have room for the
      maximum bitmap size. */
-  numbits = nn_reorder_nackmap (reorder, bitmap_base, pwr->last_seq, &an->readerSNState, an->bits, max_numbits, notail);
+  numbits = nn_reorder_nackmap (reorder, bitmap_base, last_seq, &an->readerSNState, an->bits, max_numbits, notail);
   base = fromSN (an->readerSNState.bitmap_base);
 
   /* Scan through bitmap, cutting it off at the first missing sample
@@ -754,7 +850,7 @@ static void add_AckNack (struct nn_xmsg *msg, struct proxy_writer *pwr, struct p
     nackfrag_seq = base + i;
     if (!nn_bitset_isset (numbits, an->bits, i))
       continue;
-    if (nackfrag_seq == pwr->last_seq)
+    if (nackfrag_seq == last_seq)
       fragnum = pwr->last_fragnum;
     else
       fragnum = UINT32_MAX;
@@ -778,7 +874,7 @@ static void add_AckNack (struct nn_xmsg *msg, struct proxy_writer *pwr, struct p
   *nack_seq = (numbits > 0) ? base + numbits : 0;
   if (!pwr->have_seen_heartbeat) {
     /* We must have seen a heartbeat for us to consider setting FINAL */
-  } else if (*nack_seq && base + numbits <= pwr->last_seq) {
+  } else if (*nack_seq && base + numbits <= last_seq) {
     /* If it's a NACK and it doesn't cover samples all the way up to
        the highest known sequence number, there's some reason to expect
        we may to do another round.  For which we need a Heartbeat.
diff --git a/src/core/ddsi/src/q_xmsg.c b/src/core/ddsi/src/q_xmsg.c
index 4c73e77..07ca8d0 100644
--- a/src/core/ddsi/src/q_xmsg.c
+++ b/src/core/ddsi/src/q_xmsg.c
@@ -1546,11 +1546,6 @@ static int nn_xpack_mayaddmsg (const struct nn_xpack *xp, const struct nn_xmsg *
   return addressing_info_eq_onesidederr (xp, m);
 }
 
-static int guid_prefix_eq (const ddsi_guid_prefix_t *a, const ddsi_guid_prefix_t *b)
-{
-  return a->u[0] == b->u[0] && a->u[1] == b->u[1] && a->u[2] == b->u[2];
-}
-
 int nn_xpack_addmsg (struct nn_xpack *xp, struct nn_xmsg *m, const uint32_t flags)
 {
   /* Returns > 0 if pack got sent out before adding m */
diff --git a/src/core/ddsi/tests/security_msg.c b/src/core/ddsi/tests/security_msg.c
index ed389ab..87bd734 100644
--- a/src/core/ddsi/tests/security_msg.c
+++ b/src/core/ddsi/tests/security_msg.c
@@ -18,13 +18,13 @@
 
 static nn_participant_generic_message_t test_msg_in =
 {
-  .message_identity            = { {{.u={1,2,3}},{4}}, 5 },
-  .related_message_identity    = { {{.u={5,4,3}},{2}}, 1 },
-  .destinaton_participant_guid = {  {.u={2,3,4}},{5}     },
-  .destination_endpoint_guid   = {  {.u={3,4,5}},{6}     },
-  .source_endpoint_guid        = {  {.u={4,5,6}},{7}     },
-  .message_class_id            = "testing message",
-  .message_data                = {
+  .message_identity             = { {{.u={1,2,3}},{4}}, 5 },
+  .related_message_identity     = { {{.u={5,4,3}},{2}}, 1 },
+  .destination_participant_guid = {  {.u={2,3,4}},{5}     },
+  .destination_endpoint_guid    = {  {.u={3,4,5}},{6}     },
+  .source_endpoint_guid         = {  {.u={4,5,6}},{7}     },
+  .message_class_id             = "testing message",
+  .message_data                 = {
      .n = 4,
      .tags = (nn_dataholder_t[]) {
        {
@@ -146,13 +146,13 @@ static nn_participant_generic_message_t test_msg_in =
 /* Same as test_msg_in, excluding the non-propagated properties. */
 static nn_participant_generic_message_t test_msg_out =
 {
-  .message_identity            = { {{.u={1,2,3}},{4}}, 5 },
-  .related_message_identity    = { {{.u={5,4,3}},{2}}, 1 },
-  .destinaton_participant_guid = {  {.u={2,3,4}},{5}     },
-  .destination_endpoint_guid   = {  {.u={3,4,5}},{6}     },
-  .source_endpoint_guid        = {  {.u={4,5,6}},{7}     },
-  .message_class_id            = "testing message",
-  .message_data                = {
+  .message_identity             = { {{.u={1,2,3}},{4}}, 5 },
+  .related_message_identity     = { {{.u={5,4,3}},{2}}, 1 },
+  .destination_participant_guid = {  {.u={2,3,4}},{5}     },
+  .destination_endpoint_guid    = {  {.u={3,4,5}},{6}     },
+  .source_endpoint_guid         = {  {.u={4,5,6}},{7}     },
+  .message_class_id             = "testing message",
+  .message_data                 = {
      .n = 4,
      .tags = (nn_dataholder_t[]) {
        {
@@ -283,7 +283,7 @@ CU_Test (ddsi_security_msg, serializer)
               &msg_in,
               &test_msg_in.message_identity.source_guid,
                test_msg_in.message_identity.sequence_number,
-              &test_msg_in.destinaton_participant_guid,
+              &test_msg_in.destination_participant_guid,
               &test_msg_in.destination_endpoint_guid,
               &test_msg_in.source_endpoint_guid,
                test_msg_in.message_class_id,

From 91111af0eaf27dec0dcac71e86377be3a6af358c Mon Sep 17 00:00:00 2001
From: Martin Bremmer <martin.bremmer@adlinktech.com>
Date: Fri, 13 Dec 2019 14:29:30 +0100
Subject: [PATCH 080/238] Force md5 keyhash when needed.

Signed-off-by: Martin Bremmer <martin.bremmer@adlinktech.com>
---
 src/core/ddsc/src/dds_serdata_builtintopic.c  |  3 +-
 src/core/ddsc/src/dds_stream.c                |  5 +++
 src/core/ddsi/include/dds/ddsi/ddsi_serdata.h | 11 +++++
 .../include/dds/ddsi/ddsi_serdata_default.h   |  1 +
 src/core/ddsi/include/dds/ddsi/q_entity.h     |  1 +
 src/core/ddsi/include/dds/ddsi/q_xmsg.h       |  2 +-
 src/core/ddsi/src/ddsi_serdata.c              |  1 +
 src/core/ddsi/src/ddsi_serdata_default.c      | 44 +++++++++++++++++--
 src/core/ddsi/src/q_entity.c                  |  1 +
 src/core/ddsi/src/q_transmit.c                |  4 +-
 src/core/ddsi/src/q_xmsg.c                    |  5 +--
 11 files changed, 67 insertions(+), 11 deletions(-)

diff --git a/src/core/ddsc/src/dds_serdata_builtintopic.c b/src/core/ddsc/src/dds_serdata_builtintopic.c
index 4bedb15..a12331b 100644
--- a/src/core/ddsc/src/dds_serdata_builtintopic.c
+++ b/src/core/ddsc/src/dds_serdata_builtintopic.c
@@ -295,5 +295,6 @@ const struct ddsi_serdata_ops ddsi_serdata_ops_builtintopic = {
   .to_ser_unref = serdata_builtin_to_ser_unref,
   .to_topicless = serdata_builtin_to_topicless,
   .topicless_to_sample = serdata_builtin_topicless_to_sample,
-  .print = serdata_builtin_topic_print
+  .print = serdata_builtin_topic_print,
+  .get_keyhash = 0
 };
diff --git a/src/core/ddsc/src/dds_stream.c b/src/core/ddsc/src/dds_stream.c
index e020735..4896120 100644
--- a/src/core/ddsc/src/dds_stream.c
+++ b/src/core/ddsc/src/dds_stream.c
@@ -1579,7 +1579,10 @@ void dds_stream_extract_keyhash (dds_istream_t * __restrict is, dds_keyhash_t *
   const dds_topic_descriptor_t *desc = topic->type;
   kh->m_set = 1;
   if (desc->m_nkeys == 0)
+  {
     kh->m_iskey = 1;
+    kh->m_keysize = 0;
+  }
   else if (desc->m_flagset & DDS_TOPIC_FIXED_KEY)
   {
     dds_ostreamBE_t os;
@@ -1592,12 +1595,14 @@ void dds_stream_extract_keyhash (dds_istream_t * __restrict is, dds_keyhash_t *
     else
       dds_stream_extract_keyBE_from_data (is, &os, topic);
     assert (os.x.m_index <= 16);
+    kh->m_keysize = (unsigned)os.x.m_index & 0x1f;
   }
   else
   {
     dds_ostreamBE_t os;
     ddsrt_md5_state_t md5st;
     kh->m_iskey = 0;
+    kh->m_keysize = 16;
     dds_ostreamBE_init (&os, 0);
     if (just_key)
       dds_stream_extract_keyBE_from_key (is, &os, topic);
diff --git a/src/core/ddsi/include/dds/ddsi/ddsi_serdata.h b/src/core/ddsi/include/dds/ddsi/ddsi_serdata.h
index 4d9b64b..61a57e8 100644
--- a/src/core/ddsi/include/dds/ddsi/ddsi_serdata.h
+++ b/src/core/ddsi/include/dds/ddsi/ddsi_serdata.h
@@ -132,6 +132,11 @@ typedef bool (*ddsi_serdata_eqkey_t) (const struct ddsi_serdata *a, const struct
      returning bufsize-1) if it had to truncate) */
 typedef size_t (*ddsi_serdata_print_t) (const struct ddsi_sertopic *topic, const struct ddsi_serdata *d, char *buf, size_t size);
 
+/* Add keyhash (from serdata) to buffer (forcing md5 when necessary).
+   - key needs to be set within serdata (can already be md5)
+   - buf needs to be at least 16 bytes large */
+typedef void (*ddsi_serdata_get_keyhash_t) (const struct ddsi_serdata *d, struct nn_keyhash *buf, bool force_md5);
+
 struct ddsi_serdata_ops {
   ddsi_serdata_eqkey_t eqkey;
   ddsi_serdata_size_t get_size;
@@ -146,9 +151,11 @@ struct ddsi_serdata_ops {
   ddsi_serdata_topicless_to_sample_t topicless_to_sample;
   ddsi_serdata_free_t free;
   ddsi_serdata_print_t print;
+  ddsi_serdata_get_keyhash_t get_keyhash;
 };
 
 #define DDSI_SERDATA_HAS_PRINT 1
+#define DDSI_SERDATA_HAS_ADD_KEYHASH 1
 
 DDS_EXPORT void ddsi_serdata_init (struct ddsi_serdata *d, const struct ddsi_sertopic *tp, enum ddsi_serdata_kind kind);
 
@@ -221,6 +228,10 @@ DDS_EXPORT inline bool ddsi_serdata_print_topicless (const struct ddsi_sertopic
   }
 }
 
+DDS_EXPORT inline void ddsi_serdata_get_keyhash (const struct ddsi_serdata *d, struct nn_keyhash *buf, bool force_md5) {
+  d->ops->get_keyhash (d, buf, force_md5);
+}
+
 #if defined (__cplusplus)
 }
 #endif
diff --git a/src/core/ddsi/include/dds/ddsi/ddsi_serdata_default.h b/src/core/ddsi/include/dds/ddsi/ddsi_serdata_default.h
index ae582ff..daa8a7b 100644
--- a/src/core/ddsi/include/dds/ddsi/ddsi_serdata_default.h
+++ b/src/core/ddsi/include/dds/ddsi/ddsi_serdata_default.h
@@ -47,6 +47,7 @@ typedef struct dds_keyhash {
   unsigned char m_hash [16]; /* Key hash value. Also possibly key. Suitably aligned for accessing as uint32_t's */
   unsigned m_set : 1;        /* has it been initialised? */
   unsigned m_iskey : 1;      /* m_hash is key value */
+  unsigned m_keysize : 5;    /* size of the key within the hash buffer */
 } dds_keyhash_t;
 
 /* Debug builds may want to keep some additional state */
diff --git a/src/core/ddsi/include/dds/ddsi/q_entity.h b/src/core/ddsi/include/dds/ddsi/q_entity.h
index 77545d4..b7225fc 100644
--- a/src/core/ddsi/include/dds/ddsi/q_entity.h
+++ b/src/core/ddsi/include/dds/ddsi/q_entity.h
@@ -251,6 +251,7 @@ struct writer
   unsigned reliable: 1; /* iff 1, writer is reliable <=> heartbeat_xevent != NULL */
   unsigned handle_as_transient_local: 1; /* controls whether data is retained in WHC */
   unsigned include_keyhash: 1; /* iff 1, this writer includes a keyhash; keyless topics => include_keyhash = 0 */
+  unsigned force_md5_keyhash: 1; /* iff 1, when keyhash has to be hashed, no matter the size */
   unsigned retransmitting: 1; /* iff 1, this writer is currently retransmitting */
 #ifdef DDSI_INCLUDE_SSM
   unsigned supports_ssm: 1;
diff --git a/src/core/ddsi/include/dds/ddsi/q_xmsg.h b/src/core/ddsi/include/dds/ddsi/q_xmsg.h
index 24f32b0..eb99196 100644
--- a/src/core/ddsi/include/dds/ddsi/q_xmsg.h
+++ b/src/core/ddsi/include/dds/ddsi/q_xmsg.h
@@ -129,7 +129,7 @@ void nn_xmsg_submsg_init (struct nn_xmsg *msg, struct nn_xmsg_marker marker, Sub
 void nn_xmsg_add_timestamp (struct nn_xmsg *m, nn_wctime_t t);
 void nn_xmsg_add_entityid (struct nn_xmsg * m);
 void *nn_xmsg_addpar (struct nn_xmsg *m, nn_parameterid_t pid, size_t len);
-void nn_xmsg_addpar_keyhash (struct nn_xmsg *m, const struct ddsi_serdata *serdata);
+void nn_xmsg_addpar_keyhash (struct nn_xmsg *m, const struct ddsi_serdata *serdata, bool force_md5);
 void nn_xmsg_addpar_statusinfo (struct nn_xmsg *m, unsigned statusinfo);
 void nn_xmsg_addpar_sentinel (struct nn_xmsg *m);
 int nn_xmsg_addpar_sentinel_ifparam (struct nn_xmsg *m);
diff --git a/src/core/ddsi/src/ddsi_serdata.c b/src/core/ddsi/src/ddsi_serdata.c
index 68caae0..33d9584 100644
--- a/src/core/ddsi/src/ddsi_serdata.c
+++ b/src/core/ddsi/src/ddsi_serdata.c
@@ -47,3 +47,4 @@ extern inline bool ddsi_serdata_topicless_to_sample (const struct ddsi_sertopic
 extern inline bool ddsi_serdata_eqkey (const struct ddsi_serdata *a, const struct ddsi_serdata *b);
 extern inline bool ddsi_serdata_print (const struct ddsi_serdata *d, char *buf, size_t size);
 extern inline bool ddsi_serdata_print_topicless (const struct ddsi_sertopic *topic, const struct ddsi_serdata *d, char *buf, size_t size);
+extern inline void ddsi_serdata_get_keyhash (const struct ddsi_serdata *d, struct nn_keyhash *buf, bool force_md5);
diff --git a/src/core/ddsi/src/ddsi_serdata_default.c b/src/core/ddsi/src/ddsi_serdata_default.c
index 666e0d3..34f88e9 100644
--- a/src/core/ddsi/src/ddsi_serdata_default.c
+++ b/src/core/ddsi/src/ddsi_serdata_default.c
@@ -231,6 +231,7 @@ static void serdata_default_init(struct ddsi_serdata_default *d, const struct dd
   memset (d->keyhash.m_hash, 0, sizeof (d->keyhash.m_hash));
   d->keyhash.m_set = 0;
   d->keyhash.m_iskey = 0;
+  d->keyhash.m_keysize = 0;
 }
 
 static struct ddsi_serdata_default *serdata_default_allocnew (struct serdatapool *serpool, uint32_t init_size)
@@ -355,6 +356,7 @@ static struct ddsi_serdata *ddsi_serdata_from_keyhash_cdr (const struct ddsi_ser
     memcpy (d->keyhash.m_hash, keyhash->value, sizeof (d->keyhash.m_hash));
     d->keyhash.m_set = 1;
     d->keyhash.m_iskey = 1;
+    d->keyhash.m_keysize = sizeof (d->keyhash.m_hash);
     return fix_serdata_default(d, tp->c.serdata_basehash);
   }
 }
@@ -368,6 +370,7 @@ static struct ddsi_serdata *ddsi_serdata_from_keyhash_cdr_nokey (const struct dd
   (void)keyhash;
   d->keyhash.m_set = 1;
   d->keyhash.m_iskey = 1;
+  d->keyhash.m_keysize = 0;
   return fix_serdata_default_nokey(d, tp->c.serdata_basehash);
 }
 
@@ -376,11 +379,15 @@ static void gen_keyhash_from_sample (const struct ddsi_sertopic_default *topic,
   const struct dds_topic_descriptor *desc = (const struct dds_topic_descriptor *) topic->type;
   kh->m_set = 1;
   if (desc->m_nkeys == 0)
+  {
     kh->m_iskey = 1;
+    kh->m_keysize = 0;
+  }
   else if (desc->m_flagset & DDS_TOPIC_FIXED_KEY)
   {
     dds_ostreamBE_t os;
     kh->m_iskey = 1;
+    kh->m_keysize = sizeof(kh->m_hash);
     dds_ostreamBE_init (&os, 0);
     os.x.m_buffer = kh->m_hash;
     os.x.m_size = 16;
@@ -391,6 +398,7 @@ static void gen_keyhash_from_sample (const struct ddsi_sertopic_default *topic,
     dds_ostreamBE_t os;
     ddsrt_md5_state_t md5st;
     kh->m_iskey = 0;
+    kh->m_keysize = sizeof(kh->m_hash);
     dds_ostreamBE_init (&os, 64);
     dds_stream_write_keyBE (&os, sample, topic);
     ddsrt_md5_init (&md5st);
@@ -461,6 +469,7 @@ static struct ddsi_serdata *serdata_default_from_sample_plist (const struct ddsi
     case PID_GROUP_GUID:
       d->keyhash.m_set = 1;
       d->keyhash.m_iskey = 1;
+      d->keyhash.m_keysize = sizeof(d->keyhash.m_hash);
       memcpy (d->keyhash.m_hash, rawkey, 16);
 #ifndef NDEBUG
       keysize = 16;
@@ -477,6 +486,7 @@ static struct ddsi_serdata *serdata_default_from_sample_plist (const struct ddsi
       topic_name_sz_BE = ddsrt_toBE4u (topic_name_sz);
       d->keyhash.m_set = 1;
       d->keyhash.m_iskey = 0;
+      d->keyhash.m_keysize = sizeof(d->keyhash.m_hash);
       ddsrt_md5_init (&md5st);
       ddsrt_md5_append (&md5st, (const ddsrt_md5_byte_t *) &topic_name_sz_BE, sizeof (topic_name_sz_BE));
       ddsrt_md5_append (&md5st, (const ddsrt_md5_byte_t *) topic_name, topic_name_sz);
@@ -512,10 +522,14 @@ static struct ddsi_serdata *serdata_default_from_sample_rawcdr (const struct dds
   d->keyhash.m_set = 1;
   d->keyhash.m_iskey = 1;
   if (sample->keysize == 0)
+  {
+    d->keyhash.m_keysize = 0;
     return fix_serdata_default_nokey (d, tp->c.serdata_basehash);
+  }
   else
   {
     memcpy (&d->keyhash.m_hash, sample->key, sample->keysize);
+    d->keyhash.m_keysize = (unsigned)sample->keysize & 0x1f;
     return fix_serdata_default (d, tp->c.serdata_basehash);
   }
 }
@@ -656,6 +670,24 @@ static size_t serdata_default_print_raw (const struct ddsi_sertopic *sertopic_co
   return (size_t) snprintf (buf, size, "(blob)");
 }
 
+static void serdata_default_get_keyhash (const struct ddsi_serdata *serdata_common, struct nn_keyhash *buf, bool force_md5)
+{
+  const struct ddsi_serdata_default *d = (const struct ddsi_serdata_default *)serdata_common;
+  assert(buf);
+  assert(d->keyhash.m_set);
+  if (force_md5 && d->keyhash.m_iskey /* m_iskey == !md5 */)
+  {
+    ddsrt_md5_state_t md5st;
+    ddsrt_md5_init  (&md5st);
+    ddsrt_md5_append(&md5st, (ddsrt_md5_byte_t*)(d->keyhash.m_hash), d->keyhash.m_keysize);
+    ddsrt_md5_finish(&md5st, (ddsrt_md5_byte_t*)(buf->value));
+  }
+  else
+  {
+    memcpy (buf->value, d->keyhash.m_hash, 16);
+  }
+}
+
 const struct ddsi_serdata_ops ddsi_serdata_ops_cdr = {
   .get_size = serdata_default_get_size,
   .eqkey = serdata_default_eqkey,
@@ -669,7 +701,8 @@ const struct ddsi_serdata_ops ddsi_serdata_ops_cdr = {
   .to_ser_unref = serdata_default_to_ser_unref,
   .to_topicless = serdata_default_to_topicless,
   .topicless_to_sample = serdata_default_topicless_to_sample_cdr,
-  .print = serdata_default_print_cdr
+  .print = serdata_default_print_cdr,
+  .get_keyhash = serdata_default_get_keyhash
 };
 
 const struct ddsi_serdata_ops ddsi_serdata_ops_cdr_nokey = {
@@ -685,7 +718,8 @@ const struct ddsi_serdata_ops ddsi_serdata_ops_cdr_nokey = {
   .to_ser_unref = serdata_default_to_ser_unref,
   .to_topicless = serdata_default_to_topicless,
   .topicless_to_sample = serdata_default_topicless_to_sample_cdr_nokey,
-  .print = serdata_default_print_cdr
+  .print = serdata_default_print_cdr,
+  .get_keyhash = serdata_default_get_keyhash
 };
 
 const struct ddsi_serdata_ops ddsi_serdata_ops_plist = {
@@ -701,7 +735,8 @@ const struct ddsi_serdata_ops ddsi_serdata_ops_plist = {
   .to_ser_unref = serdata_default_to_ser_unref,
   .to_topicless = serdata_default_to_topicless,
   .topicless_to_sample = 0,
-  .print = serdata_default_print_plist
+  .print = serdata_default_print_plist,
+  .get_keyhash = serdata_default_get_keyhash
 };
 
 const struct ddsi_serdata_ops ddsi_serdata_ops_rawcdr = {
@@ -717,5 +752,6 @@ const struct ddsi_serdata_ops ddsi_serdata_ops_rawcdr = {
   .to_ser_unref = serdata_default_to_ser_unref,
   .to_topicless = serdata_default_to_topicless,
   .topicless_to_sample = 0,
-  .print = serdata_default_print_raw
+  .print = serdata_default_print_raw,
+  .get_keyhash = serdata_default_get_keyhash
 };
diff --git a/src/core/ddsi/src/q_entity.c b/src/core/ddsi/src/q_entity.c
index 3a5b98a..3806294 100644
--- a/src/core/ddsi/src/q_entity.c
+++ b/src/core/ddsi/src/q_entity.c
@@ -3063,6 +3063,7 @@ static void new_writer_guid_common_init (struct writer *wr, const struct ddsi_se
   wr->throttle_tracing = 0;
   wr->rexmit_count = 0;
   wr->rexmit_lost_count = 0;
+  wr->force_md5_keyhash = 0;
 
   wr->status_cb = status_cb;
   wr->status_cb_entity = status_entity;
diff --git a/src/core/ddsi/src/q_transmit.c b/src/core/ddsi/src/q_transmit.c
index 032b638..7e08483 100644
--- a/src/core/ddsi/src/q_transmit.c
+++ b/src/core/ddsi/src/q_transmit.c
@@ -492,7 +492,7 @@ static dds_return_t create_fragment_message_simple (struct writer *wr, seqno_t s
 
   /* Adding parameters means potential reallocing, so sm, ddcmn now likely become invalid */
   if (wr->include_keyhash)
-    nn_xmsg_addpar_keyhash (*pmsg, serdata);
+    nn_xmsg_addpar_keyhash (*pmsg, serdata, wr->force_md5_keyhash);
   if (serdata->statusinfo)
     nn_xmsg_addpar_statusinfo (*pmsg, serdata->statusinfo);
   if (nn_xmsg_addpar_sentinel_ifparam (*pmsg) > 0)
@@ -659,7 +659,7 @@ dds_return_t create_fragment_message (struct writer *wr, seqno_t seq, const stru
     /* Adding parameters means potential reallocing, so sm, ddcmn now likely become invalid */
     if (wr->include_keyhash)
     {
-      nn_xmsg_addpar_keyhash (*pmsg, serdata);
+      nn_xmsg_addpar_keyhash (*pmsg, serdata, wr->force_md5_keyhash);
     }
     if (serdata->statusinfo)
     {
diff --git a/src/core/ddsi/src/q_xmsg.c b/src/core/ddsi/src/q_xmsg.c
index b8cbbb6..b0aad86 100644
--- a/src/core/ddsi/src/q_xmsg.c
+++ b/src/core/ddsi/src/q_xmsg.c
@@ -938,13 +938,12 @@ void *nn_xmsg_addpar (struct nn_xmsg *m, nn_parameterid_t pid, size_t len)
   return p;
 }
 
-void nn_xmsg_addpar_keyhash (struct nn_xmsg *m, const struct ddsi_serdata *serdata)
+void nn_xmsg_addpar_keyhash (struct nn_xmsg *m, const struct ddsi_serdata *serdata, bool force_md5)
 {
   if (serdata->kind != SDK_EMPTY)
   {
-    const struct ddsi_serdata_default *serdata_def = (const struct ddsi_serdata_default *)serdata;
     char *p = nn_xmsg_addpar (m, PID_KEYHASH, 16);
-    memcpy (p, serdata_def->keyhash.m_hash, 16);
+    ddsi_serdata_get_keyhash(serdata, (struct nn_keyhash*)p, force_md5);
   }
 }
 

From 514bf752766a61507e15a8e77e5374d1325f236a Mon Sep 17 00:00:00 2001
From: Martin Bremmer <martin.bremmer@adlinktech.com>
Date: Mon, 16 Dec 2019 15:59:42 +0100
Subject: [PATCH 081/238] Added some security documentation.

Signed-off-by: Martin Bremmer <martin.bremmer@adlinktech.com>
---
 docs/dev/dds_security_effort.md               | 406 +++++++++++
 .../dds_security_configuration_overview.png   | Bin 0 -> 47873 bytes
 .../pictures/dds_security_overview.png        | Bin 0 -> 49342 bytes
 docs/manual/_static/pictures/pki_overview.png | Bin 0 -> 72469 bytes
 .../pictures/rtps_message_structure.png       | Bin 0 -> 14897 bytes
 docs/manual/security.rst                      | 646 ++++++++++++++++++
 6 files changed, 1052 insertions(+)
 create mode 100644 docs/dev/dds_security_effort.md
 create mode 100644 docs/manual/_static/pictures/dds_security_configuration_overview.png
 create mode 100644 docs/manual/_static/pictures/dds_security_overview.png
 create mode 100644 docs/manual/_static/pictures/pki_overview.png
 create mode 100644 docs/manual/_static/pictures/rtps_message_structure.png
 create mode 100644 docs/manual/security.rst

diff --git a/docs/dev/dds_security_effort.md b/docs/dev/dds_security_effort.md
new file mode 100644
index 0000000..d554749
--- /dev/null
+++ b/docs/dev/dds_security_effort.md
@@ -0,0 +1,406 @@
+# DDS Security effort
+
+ADLink has decided to donate their Vortex OpenSplice DDS Security
+implementation to the Cyclone DDS project. However, that will not be a simple
+code drop.
+
+This document catches all the work that is foreseen to port Vortex OpenSplice
+DDS Security to Cyclone DDS.
+
+This document can be removed when DDS Security has been implemented.
+
+**Table of contents**
+- [Definition of done](#done)
+- [Footprint](#footprint)
+- [Multi process testing (done)](#testing)
+- [Runtime library loading (done)](#loading)
+- [Hopscotch utility (done)](#hopscotch)
+- [FSM utility (in progress)](#fsm)
+- [Port DDS Security plugin API (done)](#port-api)
+- [De-Serializing messages in DDSI (done)](#deserializing)
+- [De-Serializing security message parameters in DDSI (done)](#deserializing_plist)
+- [Port DDS Security builtin plugins (in progress)](#port-plugins)
+- [Port DDSI DDS Security (in progress)](#port-ddsi)
+- [Move configuration (in progress)](#Move-configuration)
+- [Failure handling](#failures)
+- [Multiple configurations](#multiple-configurations)
+- [Example](#example)
+- [QosProvider](#qosprovider)
+- [Data Tags (optional)](#datatags)
+
+
+## Definition of done<a name="done" />
+
+When this document tells that a certain aspect is 'done', it means that it
+has been accepted into the security branch of the cyclonedds repository
+(https://github.com/eclipse-cyclonedds/cyclonedds/tree/security).
+
+However, it is possible that various parts need some rework before the security
+branch can be merged into the cyclonedds master branch.
+
+
+## Footprint<a name="footprint" />
+
+A non-functional requirement is that cyclonedds should be buildable without
+the DDS Security support in it. That will reduce the footprint (and possibly
+improve performance) for applications that don't need security.
+
+For that, the ENABLE_SECURITY build option is introduced that translates into
+the DDSI_INCLUDE_SECURITY compile switch. However, the usage of that switch
+should not explode. That'll reduce the maintainability.
+
+For instance, the usage of the switch can be minimized by using functions that
+will reduce to an inline function that just returns a hardcode value when
+security is not included (otherwise they'll do some certain task).
+The compiler can use these inline functions to do clever stuff regarding
+footprint and performance.
+
+There can be other solutions to decrease security footprint without impeding
+on the maintainability of the code by inserting the switch too much.
+
+
+## Multi process testing (done)<a name="testing" />
+
+To properly test DDS Security, multi process testing will be necessary.
+This is not yet available in Cyclone DDS.
+See the [Multi Process Testing](multi_process_testing.md) document for
+more information.
+
+
+## Runtime library loading (done)<a name="loading" />
+
+The ddsi component needs to be able to load DDS Security plugins at runtime.
+These plugins are provided as libraries.<br>
+Loading libraries at runtime is currently not possible in Cyclone DDS.
+
+
+## Hopscotch utility (done)<a name="hopscotch" />
+
+This hash table is used by the Security plugins.<br>
+Both versions on OpenSplice and Cyclone are equivalent.<br>
+No additional effort is expected.
+
+
+## FSM utility (in progress)<a name="fsm" />
+
+The Finite State Machine utility has been introduced in OpenSplice to support
+the handshake of DDS Security.<br>
+This has to be ported to Cyclone.
+
+However, it already has some technical dept, which should be removed before
+adding it to Cyclone. This means that a refactor should happen as part of the
+porting.
+
+The related DBTs should also be ported to Cyclone unit tests.
+
+It was decided to just port the FSM at the moment. The refactor will take place
+when trying to get the security branch into master.
+
+
+## Port DDS Security plugin API (done)<a name="port-api" />
+
+The DDS Security plugin API are just a few header files. The ddsi component
+uses that to link against. The implementation of the API is done in the
+individual plugins. The plugins are [loaded at runtime](#loading) (when
+configured).
+
+This means that ddsi can be DDS Security prepared (after building against this
+API) without there being actual DDS Security plugins.
+
+It seems to be just a code drop of a number of header files.<br>
+Maybe add some CMake module for both ddsi and the plugins to easily link
+against?
+
+
+## De-Serializing messages in DDSI (done)<a name="deserializing" />
+
+DDSI needs to be able to (de)serialize a few Security messages. In OpenSplice,
+some functionality of the database is used. This is unavailable in Cyclone.
+
+What is available is a serializer that uses marshaling operations (see, for
+for instance, m_ops in the dds_topic_descriptor struct).
+
+The (de)serializing of the Security messages should be supported by supplying
+the m_ops sequences, message structs (if not yet available) and some
+convenience functions using both.
+
+
+## De-Serializing security message parameters in DDSI (done)<a name="deserializing_plist" />
+
+DDSI needs to be able to (de)serialize a few message parameters that have
+been introduced by the DDS Security spec.
+
+
+## Port DDS Security builtin plugins (in progress)<a name="port-plugins" />
+
+No major changes between the DDS Security plugins in OpenSplice and Cyclone
+are expected.
+
+The DDS Security plugins require OpenSSL. Cyclone DDS already uses OpenSSL.
+However, it expects (or at least it's preferred to have) version 1.1 or newer,
+while the OpenSplice Security plugins are build against 1.0.2. There are some
+API changes between the two versions. This will take some porting effort.
+
+The build system should be ported from makefiles to cmake files.
+
+There are security_plugin DBTs in OpenSplice. These tests are base on cunit,
+which is also used in Cyclone. However, it is used slightly different. A small
+porting effort is expected (i.e. let it work with cmake and runner generation).
+
+This means some additional effort, compared to just a code drop. But it is not
+expected to be major.
+
+- Authentication plugin (done).
+- Access Control plugin (in progress).
+- Cryptography plugin (done).
+
+There are a few sub-features that can be implemented separately.
+- Check/handle expiry dates (in progress).
+- Trusted directory support.
+- etc?
+
+
+## Port DDSI DDS Security (in progress)<a name="port-ddsi" />
+
+There is already quite a bit of difference between the DDSI codebases in
+OpenSplice and Cyclone. So, the copy/merge of the DDSI Security code from
+OpenSplice to Cyclone will not be trivial.
+
+Most parts of the merging will not be trivial, but should be quite
+straightforward nonetheless. Things that are noticed to be somewhat different
+between the DDSI code bases that could impact the merging work:
+- Entity matching is slightly different.
+- The q_entity.c has a lot of differences that can obfuscate the differences
+  related to DDS Security.
+- Unacked messages logic has changed a bit. Does that impact gaps?
+- (De)serializing, of course
+  (see also [De-Serializing in DDSI](#deserializing)).
+- Writer history cache is different, which can impact the builtin volatile
+  Security endpoints.
+- Unknown unknowns.
+
+The buildsystem has to be upgraded.<br>
+- A few files are added which are easy to add to cmake.<br>
+- There's a new dependency on the [DDS Security API](#port-api), which is done.
+
+Then, of course, there are the tests<br>
+First of all, [Multi Process Testing](#testing) should be available, which now
+it is.<br>
+When that's the case, then the OpenSplice tests business
+logic have to be ported from scripts and applications to that new framework.
+That porting shouldn't be that hard. However, it will probably take a while.
+
+The DDSI Port doesn't have to be a big bang. It can be split up into various
+different pull requests. Examples are
+- Extend configuration XML parsing with the security configuration (done).
+- Extend nn_qos with security related policies. Fill them with values from the
+  configuration when applicable (done).
+- Add DDS Security endpoints that are non-volatile (done).
+- Add DDS Security endpoint that is volatile. This change has more impact than
+  all the non-volatile endpoints combined (done).
+- Handshake (in progress).
+- Payload (en)(de)coding (DDSI support: done. Wrapper: todo).
+- Submsg (en)(de)coding (DDSI support: done. Wrapper: todo).
+- RTPSmsg (en)(de)coding (DDSI support: done. Wrapper: todo).
+- Etc
+
+
+
+## Move configuration (in progress)<a name="Move-configuration" />
+
+After the port, the DDS Security configuration is still (partly) done through
+the overall configuration XML file (rest is coming from the permissions and
+governance files).<br>
+However, according to the specification, the configuration should happen by
+means of the Participant QoS.
+
+The ddsc dds_qos_t is mapped on the ddsi xqos. The ddsi xqos already has the
+necessary policy (after the [port](#port-ddsi)), namely the property_policy.
+This means that the ddsc qos itself is automatically prepared.<br>
+However, getting and setting policies are done through getter and setter
+functions in ddsc.<br>
+This means we have to add these functions for the security configuration values.
+
+The ddsc policy getter and setter functions use (arrays of) primitive types as
+arguments. The configuration of Security is given by means of the property
+policy, which isn't a primitive. To keep in line with the QoS API, we could add
+something like:
+```cpp
+typedef struct dds_properties_t; /* opaque type in API, but mapped to
+                                    nn_property_qospolicy_t internally */
+dds_properties_t *dds_properties_create();
+void dds_properties_delete(dds_properties_t *);
+void dds_properties_merge(dds_properties_t *, dds_properties_t *);
+void dds_properties_add_property(dds_properties_t *, char *name, char *value);
+void dds_properties_add_binaryproperty(dds_properties_t *, char *name,
+                                       uchar *value, int valuelength);
+void dds_qset_properties(dds_qos_t*, dds_properties_t *);
+void dds_qget_properties(dds_qos_t*, dds_properties_t **);
+```
+But this is very preliminary and is still up for debate.
+
+After moving the Security configuration to the participant QoS, it's possible
+to have different configurations within a single application if you have
+multiple participants. However, ddsi only supports one Security configuration
+for now. That doesn't change by changing where that configuration comes
+from.<br>
+To solve this, it is expected that creation of a participant with a different
+configuration will force a failure for now.
+Until [Multiple Configurations](#multiple-configurations) is implemented.
+
+After the ddsc API has been extended, we can decide on what to do with the
+configuration through XML.
+- Keep it. It seems usable: no need to change applications when changing (or
+  adding) Security settings. However, conflicts between XML and QoS
+  configuration could cause problems. Simplest seems to be to only allow QoS
+  security configuration when it's not configured in XML already.
+- Remove it. No conflict resolving needed.
+
+All the Security tests depend on providing (different) configurations through
+XML. Depending on if we keep or remove the XML configuration option, a lot of
+tests have to be updated, or a few added (that test security configuration
+through QoS).
+
+For the loading of the plugin libraries, properties with specific names have to
+be added to the property policy to know the location and names of the plugins.
+As inspiration, fastrtps can be used:
+https://github.com/ros2/rmw_fastrtps/blob/master/rmw_fastrtps_shared_cpp/src/rmw_node.cpp#L296
+
+
+## Failure handling<a name="failures" />
+
+Currently, when an local action is tried that isn't allowed by DDS Security
+(like creating a participant when it's not permitted), DDSI is shut down.<br>
+Mainly because in OpenSplice it's quite hard to get a failure state from DDSI
+to the application.
+
+In Cyclone, however, ddsc::dds_create_participant() results in a direct call to
+ddsi::new_participant(). This means that if creation of an entity (or
+participant in this example) fails due to security issues in ddsi, we can fail
+the actual ddsc API call with a proper error result (there's already the
+DDS_RETCODE_NOT_ALLOWED_BY_SECURITY in the ddsc API (not used)).
+
+Maybe we have to do some additional cleanup when a failure is encountered.
+
+Some tests probably have to be adjusted for the new behaviour.
+
+
+## Multiple configurations<a name="multiple-configurations" />
+
+Currently (because it's done through the overall XML configuration), only one
+DDS Security configuration could be supported. Because of this fact, at various
+locations, shortcuts could be made in both DDSI and plugins.<br>
+However, because the configuration is coming from participants now (see
+[Move Configuration](#Move-configuration), we should be able to support
+multiple different DDS Security configurations.
+
+Until now, the creation of a second participant with a different configuration
+would force a failure (again, see [Move Configuration](#Move-configuration)).
+
+It is expected that the plugin loading still happens through the configuration
+XML (see [Move Configuration](#Move-configuration)). This means that DDSI doesn't have to support
+multiple sets of plugins. Just the one set, provided at initialization. This
+means that DDSI shouldn't have to be changed to support this.
+
+So, it's the plugins need to be able to support multiple configurations.
+
+The Cryptography plugin doesn't seem to care about global DDS Security
+configurations. It has basically configurations per participant/topic/
+endpoints, which already works. So, this plugin doesn't have to be upgraded.
+
+The Authentication plugin does have global DDS Security configurations. Main
+function related to that is validate_local_identity(). This function already
+creates a new local identity every time it is called. So, this plugin doesn't
+have to be upgraded either.
+
+That leaves the Access Control plugin.<br>
+The main function related to configuration is validate_local_permissions().
+This function creates access rights depending on Permissions and Governance
+files. Currently, there's only one local 'rights' structure that is linked
+directly to the plugin (see also the ACCESS_CONTROL_USE_ONE_PERMISSION compile
+switch).<br>
+This has to change.<br>
+The local rights structure needs to be coupled to a participant. This also
+means that we have to search for it instead of having direct access when
+entering the plugin.<br>
+The remote rights can be used as example. That is basically a list of rights/
+permissions with the remote identity handle as key.
+
+Tests have to be added to make sure that a setup with different Security
+configurations works.
+
+
+## Example<a name="example" />
+
+A Security example has to be added.
+
+
+## QosProvider<a name="qosprovider" />
+
+The Participant QoS now contains Security related information. This means that
+the QosProvider has to be upgraded to support that.
+
+
+## Data Tags (optional)<a name="datatags" />
+
+The specification is somewhat fuzzy about the data tags.
+
+The following is a summary (still elaborate) of how it seems to work:
+
+The permissions document can contain the <data_tags> tag on publish and
+subscribe level. It's related to the data samples, but don't have to be related
+to the keys of those samples.<br>
+The QoS of a writer/reader can also have data tags by means of the
+DataTagQosPolicy. A writer/reader can only be created when the data_tags in the
+QoS matches those in the permissions document. This check should happen on both
+the local and remote level.
+
+This creation check is the only thing that DDS Security actually does with the
+data tags. They are only authenticated by DDS Security, but not interpreted
+further.<br>
+This is only a minor security addition, because the publisher can still publish
+data that doesn't match the data tags because DDS doesn't interpret the data
+nor compares it with the data tags.
+
+What it can be used for is a kind of custom access control scheme on the
+application level.<br>
+An application that consumes data can see if a publisher is allowed to publish
+that sample by comparing the data within the sample with the data tag(s)
+associated with that publisher. As said, this comparison is not done on the DDS
+level, but has to be done within the application itself.
+
+That leaves the question, how does the application get the tags associated with
+the related writer?<br>
+In other words; the application gets a sample. It has to know from which writer
+it originated and it has to have access to the data tag(s) of that writer.
+The dds_sample_info_t contains the dds_instance_handle_t publication_handle,
+which is unique to the writer (locally).<br>
+That dds_instance_handle_t can be used to get the right
+DDS_Security_PublicationBuiltinTopicDataSecure sample for the related secure
+builtin reader [**note1**].<br>
+DDS_Security_PublicationBuiltinTopicDataSecure contains QoS information
+regarding that writer, including the DataTagQosPolicy. The remote
+DDS_Security_PublicationBuiltinTopicDataSecure contents have been authenticated
+by DDS Security and the data tags can be trusted.<br>
+The application can check the sample data against the data_tags within that
+QoS.
+
+Things to do:
+- Add DataTagQosPolicy to the ddsc API and the related QoSses.
+- Add DDS_Security_PublicationBuiltinTopicDataSecure data type to the ddsc API
+  (better yet, all secure builtin types).
+- Add the related builtin reader to the ddsc99 API (better yet, all secure
+  builtin readers).
+- Add test regarding the secure builtin readers and data.
+- Add data tag comparisons between QoS and permission documents during local
+  and remote entity creation.
+- Add data tag remote/local (mis)match tests.
+
+Especially because of the lack of access to builtin secure readers, supporting
+data tags doesn't seem feasible in the near future. Also, it's optional in the
+specification.
+
+**note1**
+That DDS_Security_PublicationBuiltinTopicDataSecure reader is not yet available
+within the ddsc API, nor is the related data type. Don't know how much work it
+would be to add them to that API.
diff --git a/docs/manual/_static/pictures/dds_security_configuration_overview.png b/docs/manual/_static/pictures/dds_security_configuration_overview.png
new file mode 100644
index 0000000000000000000000000000000000000000..24df7537f84b9d820b13c14da01e5e3e66d21cc6
GIT binary patch
literal 47873
zcmaI81yq#X_cja&0;1BO(jlOTl)%uSq#z~TNT&=#4ULGTgn-l#k|N!mf;31;cMRQK
zerNP~e*fS1f7ko2#d@B#ROUYSKKtx_?d!VE1Su&<-?{bR78)Ab9a$L(6*ROPNHjEb
zH=LW`Pu$}l;h>?>qRC2#tGeoMCgBc~v>hE6&V3LU<K?;al(5;qNG6m}>*K9RNjkB#
zDsh~WpnD&20|Vcs1WDb-u%ag-)OzNF5p03MQYD6|b>kgpAjZ3|KCO2mcZ6cRU#+v%
zn7bvdCBxS#!_O6*M)D2RT#kmEHh$4z-=&1m$}@^#{GUHq4E8u}@aD17H$=4P|NBP?
zlckTJK*k62pPy7r+`9Ai-2GN!#g4Da=^4-cZ{5c*@YwUe{ot8QLCyMO%Zaj_w_I-<
zuPUaX?NnT5J@<0d^AmP9@Zjh+JHPT1^K`3K$k_D}mfjV-!e>iSB^Co|eh@d?0IlP`
zBth=Yp5J}s?ct)=n&&4wg*IPxDhsBZM)e%lbF#Z)H1u<>FODbQ#?I8c%k?JkjO?7&
z&PK27%~$64C}McwDj_Z&{<!>~H&nvJoN9%SWo2r4_;y~N9hk2E{F2Nm@u=?=p*~Jn
z1!R<9x7lp0$Y`+CT=8Mo_l)OdtfBRFpE37keHMgL%CyLFBhdc&X_XKwv`IS^+^Ktw
zE3bnS|IXuVf7xoeP9^iD!%qE4*TYy{dV&OLDks(W7#NI43pqePczK8QTjjKK;^hK)
zV+8zQ#k6Y(eiVF(%Zx}>H+&_yH(Rvz4)1Bl&jHra39})EvV4O^FDrld!3^1WQr*(q
zW5(`St1U_Uz5xZZ4ZngI_IWLSial*OeKQW0oAtDmrp)&Iyeo#an;~2%tw-!)eIz&A
zX0+}DKFw2np<SQ#M)VsuO|ECYDl_n3Y?g9wNr=+%=j$$3Zco?d&c5QcbDp;Ue&_K{
z<*XO$YGON$w{E%hM49FO@N31+Am(HixzA4?8S{x4u97<8xRu`dO5?dboZ{>rNluM1
zq0>xlz&ZW+$!AO=IS{I1y%*pACq<el&|f<)-m32k`pv7?V++0On}bE!N-@~WH;W)d
zYRik?{@z9fudo?Ud%ucI@!np=n9h(TmacSW>r=)q2)Os5=>v|$I~hu0w=(T`9*y*J
ziw|+OQ&q(!wnJI39`~OgZN$9NURvX_8ZF4*7q^+nojdny87nsCUS9LCo58Hu;BU=<
z*V_$+-sk3ex}C`PRy~dQ?3+em!S%&w9lOq|K<luM?2C@xe5$Qs9fF?ga*g6w7roc;
zgI>PU2`q|%MmxK$Bmt+#2hCEowUge`qIDPBwS(o>8l%_GCUZqOARh}08?Uu-FG1W@
z_AahZ8Vi4P7U<P3)t}5nF@!;$KUUBCDnd=WHQQ()a<R$Hf4Td8L^Ocf?Q3OXK(!35
zI5<+o!}p*0|9hr<Fy9gE(my`3$|8dk)N79|@Ue*%2aCLE#VJQpc0R&Cj!JwtFjcy}
zQjymNFE#6p7IT7qkxDw2#vHl{qbbuG#bd8iGTW)7Aimf+_10^M<sFAR!d+%PD{oT^
zX*ym!6U^gS^z%R4Yc6XJfk<n;_;5Qil0o`g%*x(kJD&RZt8FvSmEf9Q;Y2;Jw(7}%
zd+xVu%SSJ(-h_#V7AlHfsouOx$<j{ko;R`R)h~SV^^Jkondy;>htgS}OGCQ)N#qP1
zNp;qY??t=IbvoyVZ}R=ao%Nkl9E?IgnyXdmuJ7nH@QCZ9Lhl@?X0`$q|8~`4^a;)&
z#oIbM@9TpUwR+|x$4?W+;bq3{cjE<|zNzMGt9g=CZI*No&o*A}%N>2et(Z$0QV@J~
zMTPxlKE+|V3#&R4{wjzl6~aCcW?m}$Z+Qw1@re>FC9ibeI^SaId!+#*7<$^jVwFb&
zEx6Ikk1M{l9p+YMUG3aB>TE`goJi6+$%{%XtCyZKS&~H5dSd=u(5=n4rkG0$i!tHD
zzsbHp*+RNyH(gV{|3IunZz4$ovcJ~oUff*>5e22I+oO(ihh^yF%%);#{oEFBL(8@;
zpKY_1pu{uXlg5kb9Wx1@3dy;*nwFwS1Z;TLXm<AcnD1zI?8DD$nEBD{WQFZ(8k{hZ
zbBpG0*E`<7-H%STCM)rTaA=qI#ErJ6s@HdNH3~m}xI@uZjZ9_*N3^af7X!D^I1k~_
z^$5f39*vAnrCp5Z)tch^3-tA?vwrV_>$~_k(Q275N%>dejE4hmWi31ugX-6Lc7Kli
zx0FTGqH|9OO!>Z2wx|tBWF2(FIvbFtVJmgmCK;g8tS|Vr@w6ztDe*Z$ZgU0O%B@Dr
z7rfBBvFp0cQw#e1F2N2dTMR)O(7UxMp2u4LLu?$0oj*R-!sW)C&q$GWtjH|BcU#3q
zA+X9lwI`L^4W1WExrGfXxmz*>yVj!xYTka<4cCx8@Wjq4=;CkyhKG!gIp*NSP9wWs
zjiWLRDedqc6vuMD#ee-qZ@hW(quxZm{!sVmt1;v79DIy&s}YsSM`axWm1vkE>c0tf
z-aUeY^At78To(90=Sde=Y{_n_N_m$noRk-bv3``iWjHkN<MXLw=|uPHBQJ-g{t6`J
zk(m6rd)-m7PSuS5!(-MyCouut?2{~aLL|Xy)<#ve=#2h&W&G(l>~1Y>aFh0q?`TDW
zdmmj!1pb?8vSP342|9bHIi9?V8mt;_(T3G?BWCr<Bk0@l&3)Fs$ui3*BVW#pjrMy@
zT_yJomAJbqkW-WfX96Nm^TQu(7Po)90$psm==<H*ta~!{YXP~Uy6eR|)H-Mp*H=5<
za_wPMF^04C?k+#-z1IdaA1626H%EN=0h?{`RP*wvY7Q1wU!N!S@s3+y7K2iY8vpvQ
z)~<ysX0a$qk!v%?9rC`u(ED<cW~7_%eg9jp1B#;)P>E!yy-tmmiSS$|tP84FXh%)C
zUsgK11PBV~*U@#o8pusgwdQjeHcE!sNtuj3-I`b)d$e9n=FK84z5T=6T!()YeQM6_
zqd<{W;8neX`{cBG-xkjNIK6kRq|?dz9YcNm#Nt`49rP0lp4p|$^z!uSa|WNz0ZY><
zYE1>@@yPZNy_#^2W5+V*&3G3)oPcnAg@MZ>Y_ja@vPn}Z>&kX=8j3w)v6RN6UpiKz
zBF8-pW*9`rD~o4-!Uvj`?J#WI$cw$6W?nQ80x^$Uj2@27>g0K2#x$aJ&T*H-sgRTY
zP>ug|?g*c^7=avDheL|2mFk-`l1p|Orrn=q!QorJJm}XT%sHYSMwOuwtC7b?B_Ute
zaFk-gO+r>ZhC2luh&#x{*iS}!#4!d4PFE7&s&dpTikwM!%D<Nr9!%h|9)3iqIZ$ZO
z*l>RDJtn!kYlB!(rNsa}F)Mn1^Y2TfXuQS6fM)Eq3QOP6Y=8~=zj#8-7sqgxMS@Sg
zp}6K_*_*aoPEtHmFXx{Nn0ApIx#US0_3xfEoCuc-gsu+A%DIsq)*bZ0oRSn0dNU2f
zx5+(8bRLz(+djFAK`@U~7hrLs8Q*v~D5v(lsCOZlwLr<ccDDs@B+^f2_hmCTiQVC;
zVUXH|%1aVt=J2Eq>%WTtanZzWS?8VN-AfzK)nHe<iOJu}r_W26x7LhJqv|a^Y>LVB
zz5Ah;IsG44XwU3}e2g(dH?JjV)Pi|5aIl_RsNTFA!K8rrN<aNQ1V=}G7rpo%aT}cT
z`0=E~zesZ~5l!NBbG&q<x<hk$VBk}6cnQEckH2yCacmD|hd-u}=GeP!JR1l96P;5g
zpY%=pAHouXB5rR+sMfA8b~I*WU3q`6Yc#4flMh{bWI;}ZpShyrLWoayzvG)ObwqaA
z61w9;Td|07Bg8x~wJU5ML2Ah^ra#=i-%@I@_(CuGA;UM`v<HjvA4~oBrlbrX=LLU{
zAwusLa9mZ2wlz;jL6=lb97BAe<65wn`dikc$dTWN*`jLt@`1eJF7IhB=dg1uxZ2>4
zYl5VhlA5^th0@hkq{6B5sc+w*;FYiGEDOgBeus9PX**UVzO_Ro>Qz?;iXF>Do0Nn!
znsRor!Abe3KCwjDuQhYgi+G2SRzmGS3B3l7v(?9@vVQ?97PC*26TvpfZ%(MpsDXFA
zAt|*^q<s(Vby9`|G&y4?l`V%6%_z*1L(|^~><9~`Z#R3RuG`@%9q1bD2*SK-L(I81
z*WuomFZ8{yoSX{y=n)L%cGKFDI6sv2M)h3unm3Kx{yxl~*=I`*qCn(6Nf>xH#7ai=
ztW!}nqHjo1R8PQVJFhR0T_O#_j_LGE>lx-;SJ;8Y9#&Woh|(^m)$mukjbHhTXW#sH
zg2&jJ8omP<#09I<JlUSc+Wtte3<=&`O%D&7zN!AVA}LW~&IMsNUk}Q$=eRPAO}u{w
z-#0m%$M^oKFy0}Z2I<E({iR%niGus;CXS4qX|^mBQW%fud{Q~&VxOu>i*b@N`-)!9
z<L^(w`g1H+VJkh6rTrqc5Q;AKzdelv(S)jOP6dJr8=561K_$$6hN&b-tR0635oQ>g
zJnc~YDdXf7{fw<P3A6$$oK^qAS@|`l-J?;1?lQ|ERY(1*2gjS^uX%8OhkvabW9|Dl
zch6|i*tP2QtQLQKv{HD!NrZV<c(0Y1f!lXMh%5TZR}$PZtC5#vPc)T+UzsP$(iUU7
z8ZcE@J3RO>=QXwyaM*&!&f?M%!rq`spg1Qud#2F05%2p?liC+I97vPg2S=#un_BL$
zu78>PiCvCvwZqr-M}05m7uzxw<|1C)jl6+<H(KCkMG7X7q|b?IS`9-sXNt#u(B=7P
zqdGeTrvuhb<+4=w;r>7Ho7NI@yLLz9$mndsx{$P09QPATpP$kq596*kCJP3HM1~fQ
zT4bT3O$dQKGA-n(ino5fTX`_C&&VEF2h*&pw#+{V_bH}6e3|s@Am#UySbet~2ltai
zmcA<@V=p2O93@P9NQBrv&TfOeeu_m1!PlKOa)W4q%W_if{v9%vLNV=4bikCPHe^@3
z#aq4igF-lo@dZ>rG~L&>ivm5^r|yfHB;#B>+KycR*Zog>S0}Tv+T~U`H3YAIf0BDT
ze+#bPQA+e@AoXP=h=V}WgpP(^uRCUgp2d_aOM;YL<(!Dn#vnn@*%El5-wIxgtN})7
z=?O~0yDJx*gdqShS|}v({vBO?FtZd>o+b&pWI@;sX^PhAnZ*c|mZ*AGGC!g1bho%r
zgvCu&!?F)IMis*Z*1xt;Nc{V&0JBrOt<tRxW%rAdL6?QZlO$dbO8d~$dU{HQgrtDq
zzC78}Fz|fXc(wI*8Pu$P@8!J6f3{jh%5bG8p3C~zlje3CZe>Jv9)qP_35X$MuBgQw
zTp!eLhuuKzoCAc@spx(Fy88Nj<3NYsn&Iy>?i)>n%IZAL;^%HB+ewz_ZSa?ZQD)43
zVmZM+wc9mvc8yoZTuDB(il8-RI2chqvxv}j8c`c8vwS^Ebp&?iwBdR&T=X+*VV%l{
zyHsvUNresP--JLaJDg0rbk8;W-I!dirTc+3(Ez5@m`5vpf;+0b=5nYZUf=}Y6UW*0
zO7pi1fL<+es>7q7*FCkqDzrs%*1H`&Rz1p#{r5fP=Dy>LMlXg5hAjw{3(I^bmP}QZ
zL~G^$^ymp)&#dQ(UiH~ZqG!lPQBuMy#72o<;B}Gn+D6jmffasR^>2Nak&8jmoH>ol
zy>Rbn-y7IB*?lxV{R>(tC45+slq8G<@4#E5F+;b@p6h|<bFtP7;P(j>D1CXSZMid3
zU;FHz8JYilHN88~-P3cqD`q)Tnp#=7+;wlkPrdyr55Zt{2r|P2{0*1oAY=K$U38D{
zclf^U4`dfvU!5O0G-HvQNCgy-+cpKC9B)l#%0@A*pKKJ=J~bvDD+AL&=tsL_x}BWt
z<Zm`&)y|$r>m#oljoPS^alZ%P$6`~viuDPf=vJ>~C6ZKH4rR$s*EmUrc=pOxvbF9i
zY-MJ;8LXs#Z#Y|_s6L*sUIu5d3r;C7vS~#14{;IUi~%98f72Gct_K3SRWEyi_Ywrs
zCkis^&8^W_8gu|4F{`+c+o6THNT5<x^W><@#;;d))yrf@g6m@?rXd#4Lc!T^$SlC1
zM6>pUqetnK!`#lBnx=ka8%1|o$j_jZB<rC2R0oUYOBNsB^C3syyvJn{DDb??QP8EN
z|B_;&(6)Hv2J=w<^v8BEM@J){^9tT_D_ttySE*+|@U4;#r|#m;^13=d`x@r-57ZKq
zC1|Rhd6bQK4%H{B@0I!?g<ADcG7PiS$5nFB9jqMoT7KaHbET_J*#zs3c<Y~G_NVk9
z>!>C=Ut6)TVUHVKACzj-A1xq)2J}$vksoglko}?-G}V*Iu*wnJQV|_QqI1HTO>*&_
za}pBWZzra=YCbUiCrcm%Vu#MImJZ8^?|zui30Tw!=gJ%kI1}7+K-9n#uc()Hl3yDH
z<3`gaS(v)5Y90&|{F!it{@mNc2Tj_CzuqnU_%3MZZpWLC6orq5#h-3jq{j;H*&U59
z2vOjd-ex}eP4GfkEf$=C`x?wfmv4leHpe&%9&0}R7geEEXi!7!=g?$9R4^HozR}Zu
zh44*(uP;DIv-KTyRbL1C{BG~6)(fu|uq#9)E>JRHZ%q^%2WU%H>P^%K!lHN7Q^2??
z&DpB@`}#^PagNErDo1sv8*+YM*~I&}G^Mk}A8(N*+4MgzeGf&^QOeL_`l^tkd$m^2
zbbl1Hv3HSf`BpkAj8qPRWuNcy@j(m1KMakIvm#FgCHN=C!2sHxKH!iKRxnl2p9=|K
zes}jNvf@OzRY`FKm7_lfWN`!_?#DJcdbQ4!ZKd-6VFrU?VdzAGA5iD8aDlRUq$hCG
z^Ws?TqGZcrD^McL`*?eL<6b_Mxred0%hO8d3rc9!0)0FZkvK3>zEKI+y}!=Mkn#dy
zD0()W^Lj*UF>nC{0x3Yo77OWDr`a5JUvesQW~NT@zJ@cE2o`+N5lm`HgLf5^{JR3*
zD%?77bRNraY4j~J_3noxfVCWa6&!Ko9DV+5U0~r!KiLWNS6c~;c+N9Ekr4KuS%5L1
zNshffLjfZVqNtGa^AibCDh|$!<#F{4L{Jwy08iiQx^Q@lWjSX3@^!yH!%p|EFqh}K
zBWdB>W@-OjgL`uSAxJx3q8)5UKY9&9uOLHv8+0>{LsvH3))$~lLkbK$k75L@0q>eW
ze`{gnpK~pSk&I(AULxtdJtYg>4kF`@^ua?9M!S25NQN4HCU*XOsnGi>*CF5id@cJs
zX>0C(SPc)tRGnIO-5z-iQ(Vw_CH{8a+oR0CPuoQ^K-YBuzY)M1s1fyVwLGO4gKp!I
zb4Q`I@wcPlGA5z5!3W&~kN?8~#9>~8>7*Mlw19WJi${d>0yMMR!uoO;djxZy_whA8
zzx)@!6X5#-BC!L&O5@-I*WHp~6*|y19}D+7X9a=QWna(Zuq3kvm|cYPgysKwU0wTT
zto_>As{+^7Gie%6MnGqfNz?!~vfl(Gcd{7c!`BBZy_w>EH)S~koLw2k2<He%N+ZRn
zad#VTW7mS}$py-mC7@`l-o0r^IPmK6(GvP|(!^$PXjLva+bN^Gpx1y|>;TP;9zgD1
ziaN++0sA>0$JL+W3L<AqkYMw8PQp~2K-?!G4}A#$NciBxoEE06Q)DRq2FcKOF@GNW
zPv971#lGEWF?yHGWBpm1js1gag9jXp-XX()=)RZmn#k5-<XenekSPG)GI#&%*aB$v
z<eQ#?n?>JSNJ+krAWn>Zy6FFI+^v^rA!QfGTT!4X3Qe;jK_OGT3a%C=LeYbm0@uCK
z9vB}V@O;80W@4PV;yz=vq{EeXVF&=zAQ;B9Dr~f#VU<Kn5YE-5eBDmv{F_9C1aVxZ
z!9B^sI!ubm2z_W+y_tnrwZk%(%s2J?$78H63qj0XUjnEfpnp3JcHM2p*28P>f+PEq
zh^ws#X(Amz3)#<!@vPK1Zzc5I{AoqR!iDiVTOsD5+-DS<ADm}ua~J6ejyEdLecv$J
z1G-NJ^vO)c6p=Mjr2RwvQnOe0jlxLHt8Qe_nGz$5Xx#fJ%dMHm1UsX3F$A4ABLF?y
z4Vq?@H6t5?FA=>`zBbQz6*PU$m@Ud11MsFbHWOvCUSQt7XoRe=LU!73$F=><Tax!^
z7=DWx(Pq5~nHmU11Vq_+XC?`K3{Xg|Hw&TbraB1k-xss7YPsq$ox!VHt532_h~v1;
z!$N69_09Sa@is3ksc=d7eY>C5$^)dtW;<EIw*UFZXdTF}99w}=UDzv+7|bW}2VP?K
zb)kPy3+({rjMs&24v-m2ILp!Je|)6SSgCqeh0Zt~Gfhca0ofTXOqsAQ0=S6FFF-o)
z;kka-y?};|f%Je-YGLhZ-H#M}3IX$FpD<Mv(A<0YY{qC^KPV(T3u+NE@&1+bT6(1~
zDY1jQkAEj%Q&(T%&zXvF#mFH=R#Zuvj6ZwGe9?G)ZXGY;Su=+aOmc12c5@@W;sw;N
zR+&Yl>NizcvZuOn)Qgsna5Eyrx<9j-_9qK>eYXHYhNCI|cmQBxGjC-CKpx1-BTk~m
zSl3F{K)R_Gq=%5Re}1g?%|2N{<77aah~*x7-P_HHa=H4qx9@XFSpCYoAI}Ey$DE9V
zT9FgA!A&f#NSBU36}#-{i?@o@F|M^T{JJbQwfmb03k*u33zYS(a8Xg?Bf!ZiH-Da+
zzll$1Gi&&V8Ysk6&(r)ObW}tex|J7rhfMN$D8l<{!@!}3vt0=xjsDEy{<uCDfyr&w
z)zeRD#NnEFFB3-pncZ&qz9B`fQuJNyg(=~{TA##m8cWrY7CVCc`$TJhwj7%aJ`zsG
zB>emGz)I)f1-@|fqYtb|qreYUyrXhIYIhoP1-gYEhe_x8qxH%CJ$kyhD3uA&%wZDP
z6+Jv}nd;qP<Na{aWa{^<?&(q=O#u0`r`n_f{`JdGXpZAGP8%6+N9(?mqJY@&?Y{hj
zVW{KYNRY22WGMIQysghXmW&UQ&XXKQfAZmP;=GsxVnXCWzo<dcgNWfJ(;4}1TSeU=
zSBR7Jo#yMS3%L+7Hq7=dF4Sv^sbUu0L6s6NFg<?_R$aDV7E(dX;2m(urk9-^AiF2Z
zt-DEj7=G2k%oP5Hd=nGJ0(O7on_=k}xv)u7h9~hwP2dzB!)C%Ou#2t2MjmZ*hJR+2
zWAIgB_8EEumY<1{BNflmm!7ef{-iMK5T)w?vEb9mtaqdQn$VkGY#XzOe@?cHFnZyE
znF_`Fh*#gmz_DSjdcH~XJFEe+u0hnOBqre?Y+x_pyfsmd|Aq(DU;gXU#Y|8pu&<<`
z`l(-*oj!elL*8tyWv6@w69=O)Tev2xQhTxX-<1O`gZnL6YZGP6d2z~tm!ohXL-1~2
z>z|ognb_XFLFi-(_KuAwJH@M}Cy}pEz8vS;dG$-cH#L`R2`IG_JN!w1KjTMw=;s|U
zoV&IrNH_FI{XIB|O{wC3OTVuge=|!{!%en(u=?g*W}XyPW2^0qqTc0@whjJ_QtK9O
zL{l^7CK6BLtkCO-6@Z=W&B;nd%Sv9`iRfy3&`!8KPVF@ifFpQd>BVdr7ZjL|%GYiW
z^c6yDtaUMUIn)CmG20Kl;>%$vrV?<Jk(7JalPGJYNpJzq@{V}$!R~D>4BQAGZuBb;
zPRTPs&gXHZK!4od@AtlbJvVXvgW|2sXn~%vQ3mAX{iAbvaVAU6Jup~xfDyC%9ynfU
zJ2apF%-U`8Xf$rn3TMFVz8>mH1v~TL-Y|HZdAEoKAxcsGR~U?Q3TXYYAx~>$ByCZY
zFq1K;$s^;-H*VgJKygzq;|yG;osyMQ5biA`o>{3;&z^{@HjV1L=Z7i_y<s~Sc@y-v
zeRR?hn9ayPXKfh+r@<9p1%Yke&I(RJ331Z_mU|an%Y0YCqMuRjz1CAbm+6Ni-_#EL
zBNwK~3s$)T;xmleW`AG1EI&44qAn)W`(4C{+He*r3|93#nXO0_BV_OM6LU=vAM6bf
zAHykEQjq#~7%K;+eF*;es}+JZob%&x^OUo&wdc^}ME58BEeeAdCp#L_d7hwEnQkr;
zS{FN#<Ds(DcbNEea`u{um{~#fcLt|_5+C05N)gC@{9k?~$mXiO$Kc;gVIq>*wKLvM
z*QgcL?Z1Sd&IiEAO_l%w?9W=$W5jH!xj&*|ki+7$LXC}DGEMQ{C6i&WY7~(42!;dc
z#VV1ctxl`shqRF>((|{l40Jo?ej#|TT`Ahh11x%~87n_*{LcVn!C93gSo(z1gL#cf
zK!D$IwBKI^!nfp)rv2q^z*OmB`Yy!%Lp7j19U#|tHTotl!Sj~v)^k;`?vqhJuQvYU
zK+tZs;$H#<{K>1O2eNtpdI1u7d$rdl-!`(jOhE&{#I=%omC3RLv{*G(3oqg{k;Ocd
zXuV21y~bE(`rklMd8{b3_dfIi&&$WEUn7cfck&@!d*5;k9F`M5=8jj{oK3Cw-^3nG
zolW-GmsPy*_d9%DaeR?KYZqdv2+lP(Vq+v1=`IA{x-p#$j*`T7-GRb=0Y{6OA2jD{
z(=M}WPB+(fI6j<vHn`@5EKK2L-rElaoo+5I>ou6NmjUsLuR2s=J81%#4bv{LZ@x+&
zYH*}yLMi!GI3hK2R3t&)y7x^;Umk-oA_*-F9e{*bL&5$Cx)&Lsze|`AXja-Kc>vt%
zaD9d($BO;hYWu~|eun)vT$H_^z(l9QrV~dNCkjm4oj}?xz2#Vl@q^u$Hm(0H6%>ij
z@VU<6D52k4=PG#d>qY0=tMS(AGiBz$B>nL;o1X8k_{S7zz1EFY%iL}7v64&u9pu?U
zxlJ&vFoV9256t{WgBe4LUi-vnGbat?Ri6Qe`_;nNYyrFm^t@pgbht<n&-0Gef%Hs;
zB!QeeRZF$=bv~H4<k6lQyI#|&te@^JW`eN@tAgeJ2tJL7uKo5pz@H0(_g-;n+ZT~q
zk|Pl(c-$p*4MH0+jo^J_w3a^@O4k7TqdV^~;W>7rvC{=$Gh-6%YGesg$tUm9h4uj3
zfD_?pT<$&#e(r{AZ0*t~xnZ(sLIx=ub^6}@XOht&hOgNhPSXr0Z;`<d*UPlX_BUeW
z*~;Vv_vX<}zv#o-UVF!hjTg1+OIB!j*^1{(ejIvV<e;CU^04}3#+}=g%4t{`d+*s~
z_&LGV#K&Cz1jIz<*+%#clu+!zE;9d~m@ApkZmVq;N@erYIgKX5o+eSBz$|6mYcO}@
z`~mY0USdk;WFF0P@(L8L|K>H_fBM#ydTeW8Q8oOJfq-hwKfNy5Z9S*QwFXEx%geC_
zPY>vB!B|%A4t;MXLDq=c%g2rL=5=f|4Ba-Q5wRIx#I_Z`sCYa36q)3r|Klml!w{<u
zr~~WTQGDm=?kC&9eg)XPmb@&LV3sl!;*nRpr}x<|YC24pnoB{Eqp+V`R8ce-CR#?{
zQ)}3ap#{)smPB4z3n|r?6Td8!?zJA_&b=2{p8Blb0NW@GO^(~FXV;4m28L$|g}ME1
z_E>6RHyMD^8Q2A1VZE_y=3jBmVatkkhW5c5InoFEyGy;!TpYT~+oIX}=p<0wxURKw
zUz%h{^ltS|!v&Y!miDUki4G1ypv=(GJq+<eOaOjINABD=wM57DP187~;Iqq<NWAVq
zqjNx!Ol>#V;!sS@!z`sAhigMIcVq+%0D&~JQ$&0`MvYa&Y{X2ozs{R(S7!dNF{Owu
znO3RXmLPhi{qB{^)<VG~zIc#x{Bc6^or$|_Hc6-K1`WDFJZyc?JLg#5qnA$Z%8e^&
z;|)Lqx*uy<Ib!54Ik9B=%edf8;-YMbPWE}T;z<ZKGm~iL@#+=<FgsY3R-3kL${i?_
zw^i$Sdw>HOzmITT_bP?2;^VKJjsY6!f#Sw!VZRMK$8QRnCq3?+z&x?Dyy|}SMS7N@
zsK2{vf4_DAz++E^dS40Q{*V;f07|P&mO_$tmMV^;5T^CWw}$~#&YGzY4BXZp^2GIm
z{)h49(2-DgoPx)SaZI}jzyl>$jNN<h1o@a|RbKAWo^HD|=IUM$KHCgr2xF;P$<{-_
zX4rco4lnjME7lQm2y1jKbhBWdJoPvI@I+qQE*$+*A)!LVah^Hs1#g>d#Z@=TAffPj
zIPQ!Vr&oB?uAn!oTR{Ec-sO0$OW`xiK?yjQ5h>Z5o+omnmcg*f<3t*=rjcIBnLhK%
zHWK7{x_=bXFYLZy#V85Vj$zC;oNs1rT8OLUs8O%+`llbM?Idwij&Rm)A5fC7-o==C
zP!7<%-W<DG0pV*8AE(KJU^Byn60eNI+4#coJQzDyRNjW^@j>mp?)kksPi~f`sdSFh
zzoDP3>6OBs+$H3*JM&21G9|-zYOQCmss`g}iu?d^lSVrkn>I@!HWTP}EySqV?}=WG
zYJO<+^A=?`SKN2VVe7(r^&eElV-x-GS%YwgncwV%9PIsBMeBfEQ2?Hr?UEpvJ086R
zTODN*M#M4^Qs5^dDx})^2<yhs$Qa2hP&wiCS|92I?q7t?cZH9*xUx0Bz_dF6<EqQ;
zpUaGW<@P0dNL%RVSBS)|E~dVt^}3XB!Yu2usE``1&s$EZlV;dh&n|lG8rk~FSu4FT
z;wGsP6N_pHKjw4XHzS>yR7d>P<r~m#raoKr?O_@>ybsgaE4&1ycJA)zHbc};6&7^e
zU&c+U%7@>E)x8f2Ay_$EIF>+mRX0{Y9h{o=IQV#L>BGoq6*2RgD~|DqN6UNMDPwAU
zeZWvO;2OqcX%y<0*o<?{j%Mv)Y|aY-p*PdGJ<RgiY;12EEf~Bm*7s$&+&$sWFfC`I
zC{4oh>9*b&$N?X0d5UenX7ZL10kl9bqg>9df^@-VVd_y!&FcU$6LD91?PCBQ*l;`o
z>vvt5e52SrE(;Lugv!TV)%7aY1qi_)t+H<YwWGyOf|IW5FbTW;{*}&oHN*yIIR4XJ
zH+unP+CYfQLe368jtk5NPKw+$<PgSb0iSVSL!VkqKZRYtYY+}3m7l?M>`Yden_57K
zDdgV0On466j*Y9l%-1egF$jtWkmA#eRLvbZo0R5jrM$Y{WMM)6rUMgM&Olh|LS0HW
z`hoYzDICtL*9NV2h6bb#u_DKIa!+Cw7vp9MZMTh%N{~~bm~Zi{Jg;mkr?ZZA1gSDt
zNG$F;3&faCteGxP>0kK^yX_QE1yMB4!{4jH0tEw|%3eut9n<$sPlSur0=%xc5?Euy
zinP1j5=MdztM%GYQ-_I)itw(g?Nl8jCZQOct{5u;H1#QZg|`E=_}lOCE#8Gtjgm_s
zkP|R!b;NgnYU4XJ-iP(8j?vl`!blP%r%*tM>8D>7MdWwHJ!ZUrdzKrt3z@Oq@*qJf
zD+yKI7LD=}A}dk_7&B3<cqaCbM~E4lyxlllxME2l`JkckDYEXjfxcG?_Ax)wtjvNt
z?HEW%g%v+nn?lS~q1-j_3X3f}(~XUCR`z#S>#K`yBvnB$DkX*5=Rgm}d@O;eubi}9
zrljw+$$eesY8y~*W&1fuNWZoESfVK1ePeY_!ERWAu+53YEvm6zdQ!G$VoP#%9sjn4
zUzkML?>;iP-pT7Ri!HM&=Q3w^8<UGMG<RTWSQ?^1@7as)&J+xURKf+00t_mhOKFs-
zMW%X^1o?=k@FzJgrL6mT3hIQQS0V;NF`dFleU40a#p3!_#&Yb1sz*^1>JyR}mUI!v
z7ep5wgj2-q)xd>SHdjT?MA&CNE{%Q$Ie2t<&_ps&7cL7FKZwZpBN@tm@|yC1ji^@r
zUReQAJ>vFP@ig69c(^3&zGc&~DPHF}n=|z~SpLtSt0HNxcLUZ>zkq?_tE*s_c{ij`
z8F4|$_1OJOGWNtnYThy5zISDQqY+}!n1{(u(K#B$=}#I}yMh<b0JWcy9>C6dwl)T_
z>$=qJ)0Rnf#m!i5@Yt?KV!FSab>9(oDq8`XlWtuSk@%la#=b9Q38%)iq$s2V<H8eP
zNHRMK(tm4c%nB(dZ)4F-Lit~7&6ti2<PZc3arq80>pX*0sM0Q!_iR3Z=Bary+-%QT
z>OI?HofMSX1oChTPLOe@4vgcp@t6y)4N3^+(!v)yZLx7bafC?;+Fz~ZyfFjxg#E*a
z!i)Wl!bUR81BpYkjH8Xw+>XjWBI>HN=qG@=^{%Kcez<H+WcEF<1Ln&-W*Esq(cGV>
zcpx|61g*UKF93|S!+;7I03(MmlWsm(xt9QMSR$9`=Tb5v7JUryZ8=1Dh<C%)u?{~F
z*0|qLNIzWI$woK?JFX2%UQrF$LO-w{2LjL3_<n5TCHNC%TWEtoAC>4vUTJG6lWtwv
z!6;XsH3?E&N+$v-9^vMC2TV_Egn@s9z8LtwgFe?F!NEiM;(e19L?3G{zjEdiYeCg>
zT-yxbsnox6@BH+zYx)ua>r;NCBPwd%oA8jmZucD}7%!|I>SCLJhsL5v>M`UM8T)`q
zS?IxoHh4s22V4M$2lcXZ{$e1Zf?@1SujBq~ciErqrdDJ-KFcy=JH6xn)=vtHr+;GD
zyip)&a=qMCK;==Nk0e+B{Gs;E{p#_|eqzb97Xf!;s05wA!pxw_xwFw9b7xCl(ur=%
zg_Z*vM>T1~eZn$3$IKf5juQBR8UI2c!xFF#s5f$E2B0B%f)8lZV-6e%tWbO0g!eaZ
z^gECprRM$A<3&b(b-%AK-lcQz4)!~8pjWvrm{zIhYpVc<VUB8!$~tEo^mW$#mkq7e
z)o(0=jSE@hwd0HnIo@*<>BbZrjO|47*&QuvahP-v+~;>NStV5uhIzYS?Z|o84So`o
zT|gW(R4PZkho|)4c<b4w3+Cr*+}1shFOZX2{CHLl{zjlc?4#y+pj1AOR&|Sg!(q&W
zmm8?r{L(sjF-x8mZ_GAC21mb&oPmHWET}~|U89fgy;D;jP!l^*PG%9CJHRrHH8$AT
z{IL4%Y{U8qAQ^K=w*gPCDp|Mv^NSx~7zGYaDD0}l=YsP#eC(-#BzBudq^{@MfRFBO
zq5=@8xGGj-j@m-VbN7O+jfPNSrP22fB~Baa@U_fX-L2=7G~Sm`IAB+}Sdm4!z%5wf
zu>5juy4K}~{_X~lOCMlV*#XmU2@I*wMu2;?VEk?+xG{b-8@?%FDY(<kV#$=9#~29f
zyJ&8I@nywR1pnR1{X#}`q7DVxFeF|Zyh%AA)*AEHMCDt9CL-7SIF!y~MuXqfSOKAG
z_t>`;>;O^g@B6mFFg7t@Xk(pdqZp?}nD@j*LZJbPobSKA7NHa#DKrp$s1gb2y1Vze
z%|a*SZWF$(EoV?f$zLL&kH-8kjovZ^+B4Q$ZMRPK+~CaH^3nYD`=h|r)C8DfV~aBZ
zQ+40Hw{g+!N*t}ZttZC4)GLuy<oR6s`=_IaXfg+<L0!%>vC5J1>iqs>U@}X;kAIeY
zvKQui!UJ#>(6SQ#B>MqcJ!Z2{tW(x1j-ezG##7rM`c#|nczU9f4q`>2NG;M|zrFv_
z%QL~Gaep8W%PLzTDLQbZv6)9V#1^<k?Y3BQ!K7j(gmMJ|5fT2god)JVW!dvZAIB}w
zCG=H&T6j3ROjaOp8$#<l+iZIhpKSf+J=vZ_3_0Vs8L<PM?<-kD&+}jq@_`fYhLtO+
zj}JQE;}S<_69an_m|7&!4xSh4*AG8pQ)UW=r99iCzg`Gor*>2WT7qh{0cG<IzAZpV
zTs*0+D%}AN<mzYMfLlSC+nnweCCwFtG6W7rvtUfMRa2q$ks&AabYszCw-Vnr@RzoP
zl2_6$P#*Q9h#CNeV10G4ppEBxtHPn6jelyj7xTnD&pvTsqVSKfY-}hbC`PqDVz&u=
z^aVQ;6{*degN}t~#W5$DG}>#OIxJv>5*@oI+f^qDG>4-|QW(ZRZ(s<p>3SKt>w6Sk
z>G|`06+#H^a9_h&;)dNonm+=*5-;-d@mAhgN~80ZwpNwBQGETmz0-Fq(}d&H*O*ly
z2fD0Cg~;w+()H8@UF<i0-LBv+0KS7|K%1R=Upa*bY8t3&Ps}fyT-HFOKgo`PT^LJM
z#2kP@moHb&%Tm-x0$4?mI4tiW$U2%{&Bsf1;Za=cqlJYF?>YYAYv=N-p^H*Ez>lIT
z`ON_=6VUT61-GuVh~L9OCNHBzt#Fk%HDZ+B-h<#T4Hc6naluJ1V+=-ff!fu4FrS2l
zE#~hk-+ZH2TW&p1ZL&;B*1Y9$ez;~;So2!wMy18pioOG^zp~nUhHMm2LkdrRy8k#z
zhD8U7IZo*5aW`Y%%G<8p;vXGd)W78>p{KpgBkH{0aQK2%7>-8=fUUHk$St0o{&;R_
zxXOHzAFyZnV73sUY}2Y@Gk}}<z_y;c@u*LjzHRg%h?w~^;U~aJ(P{Ju@58z)04c%c
ztG%n@c{HMty%NWRT6LH~&({Te<MwtoD*oxvUj@^ZrTK^#!|P3U0@{KSLKt~#jT^>4
z>o&hvOm{drI<l>7%{ocIYi+IwF}BLL1}~O-ee4AmYQvfe((|pw3m67Z)`p~MZ`0Nk
z7vi2JrIin5Ud?6W?Q}=rue{e!ev8VFWM8GPaBpC~8cdhQCzU7eKYRA0Iw)IO^D&@S
z$uV5XzYmOSb~FnbQMOPzgVA#B4j~-)^p}BktAFVS^+C$jra5(?8806ONRagvP&=bL
zQH)YIKN1mj%Yp>Gb2Cd9efE<jPkwMPP%FR6Fy$gVLcr<TJM^YQdLk-(jUn@ypkF*J
zuSYrDd@vmdEyhbSgOf(;;IQR^d*!UPTB2?6f|=9C+4)=khGqhEjv^RMoc_#3fOF>}
zW>mjltVeq%h@MufK0~9{h;+IxYJ~5s?8Awvh$XVH;P1nZY!i@Ir(cUqQ1xaG*tt1(
zQEnfU?^NEaYDhgtrS0ITXH{ViIPlcA=>*jBG?fd0w?~yW9Y;ozZ=i#Sq3NOoA}BNq
z8k3jDB1<p$uc{^&sw9B0P~SL~69@b;TsOhoZJc|dDh9gv!<1|Op1|&_7il;$FW3iu
zsQmc^_y6lBcp2ORN%0U|X3@{Oyh|m}A<LY!lp})h3vGHRFfX9{mT8h&q8ddL3B`n4
z<NzXtCCa7A2VJYX()&a;GF;y4?3_j5R~`v^@q+0*BS9btx7Zkww{im#xA6!%bHexj
za{ov}0ESZg!~}5d`>Wf%4g`Zd_B)xo)F{}4WMWt~K7-3CazM{4`E|NgIs2`2cz)mi
zebb|=zPmz(lQ)d+`ffiIk9(1t7z8-UYQF<;!DsPDt_-aLMjiWNhE7$<Ro{0bwj&)H
zq^Ec5)qg(?1ZlI9HmU<yCZ7Pkqifg)#~V`cNJqQcA+v73i#7g9NBG93$)w+GeO|I)
ze!`-5Ff9B=bC(n$K`2Eby)OhP(xFjy^Idnj@B@l@Wjqll^~CrsqwZ@xvM8-!jS(pB
z#k23^=~0s0<ubc>BrrwfXx|mw<oM(B>0k(V%o|bk0@fwdqbbV~#KP1ft$hdhd<0b?
zqi+@P(uIcD7<J!4eLh6S(`yAfw!$omyyB?uv_{EVv{b<7A$<HgLiT~AyB@BzzNo=e
z5|d?gr0vm^?ca|}h2Y-}*7yYEb0q|l(3v{-mH<9B52pocv4r?tqdIFnlK;I}1$zCH
zh>Pjm6{fz@{N&pFgx3gnN=!hni|@T8>R><*J`if@GgcEv&Zjcn%nv_k;9C$sb7M`a
zM$z1~Nq^R(6DQj$cj(lptUuk#pRicwmi*6R>^pt|AfN?g_FW9uhhWQ>fc7pG_KXng
zLwtbWGg^7DDi|^TcRrUjV6Xn45Vk1LkGEFF%1-feCqi7bh5IY46rkHs0*HzA@YhKB
zI1cd#yf*jh2=qbR3GVwYcgM<serPgYVj3CK`R<cA?WWLXC8^QIVqHp-t7e1OMbz1!
z@ZI^dT$M4|)?Qnx5qEw8;5P}N<qMbQ*680-g9);?Rkw@JMcB?Y`J$Y2Ye19Reg0?R
zCYXT9dJOJEMJlIDNvbp9y}apLbWk*_{vO0cq^)|Ev;FU-GqB9t?~^i=KfZ3_yPWPG
zu&i$7Z-uD0J8}L09|0PON~4$Oc!Q_=e;$EyUjnW$8vI}C?;}`Nj6~Uj(nR_$wp-KZ
zHnK(I|2XXi#e5c~jM*hQgCJD#@7C+7%gqwjO~Rva+IbYxgf-k9uC@sikv3-q{iR0K
zTz#ND{0OIE=Qi&<j7Zc18@E7jKW-W;3uydIAdo}VnjP?DXlD;3NWdA*hOp1Eeg6jH
zr6PlRO131YZ2IGiK+@9lmEJ@-zngc2w3fiLE(C7D99;TGl64#1xdx@PJVue<pDAjY
z_b0OnyB$Uhq)W>I*IOniLdgZjDDKK0v#8wzTnicmSTFvWC6PZIf(U950FPA#k9DC|
zSKfPdn3@Si$y9T|wNfo@sQilln2@ywb;C^#c#AWEH#Yf+Ln*V)9N*B$-}mg4p^4wu
zOTix!GM@$-U+6u~=YTF_jCri~$sdp0t>N>1@FthUsCo_z=+e7Jus^!_NjQg^#*%w-
z;5QIk5@b%zfW;G#pW>)W+DbFR_;G!6b@Nmw;4altMwG(7#mB%z;qfqeZok%LE5(9Y
zVTyH5<A#j`3$oI`8aCs5u?A!i3&=R{UE1JJg`;%mU|{X)h-5I`TWA9}1WCOlPHu&r
z$)vX88gd!}RnUslup@#_1<12wf#9JM6w8c6NXCyVko@Gy_T0Zud2@hZn>~W_hN4~q
z>>H6dYL}uxxY+9;-YfCu8Nifbb)f~Ws<~oX(QjKl5XV@fD*~4Z%0JqHy8QT;YOV9u
z8_wi~DTZHPnbxYNCx23AkHBCflyHY~=FuJMVtC)@opT|IAEBtQi(v%OM(n`pznw#N
z1o2b8p1R#f5Uc?G?FljMXtz@jm<q)(6fmDQUOJFke*?uW@<tluB=FfcS;oF54(i0T
zl0WOd8eV?*7DVR_@xfo)6=MJ@I$zfp>kKrZcQuYtfEJ*WPuy{qxFG85xWHcX;#a;7
z^GL2nco`cBk{T+-DckOu5!{{yE_9-|)&09Vf;OSeY&zxPcKB?PD~U(_p*a{4G9^RE
z1~cWz*~jApP+<}x{FfyK4_bcII4Tc5Q5Kw*y374;0E55Df5dt0bJ)dNXmb4_efV&;
zG@k5NvhFDIe42r`e;lNf`S-ZL)?Hdc%za@+31u4ORZ9pgFF`Sm!`Hos7)m~bL&QRj
z0qH9L%RQFJP)I_z3C+i3&!ZGYl+Aak9XjZ~NqIUxxOU%P>f8rH`L{+Ih`kt9jyf>W
z=6&`D;XkVOItlEBRe+;2&S3^dDgX>*FnvAxiT{)?&$0K*8%|0Ue+}kyJc0+PT=Oyi
z%RvY);0p%zB=E@1xbM`<+pY{)I+JKn=6skf%`7@zsuB6WZmta|x>0m}#Vqgq@&9}F
zfrZzTn0-2?Zzz4WpuqH@7<+m7|M4k*N;iHyhX*Y7x{(rECv=gM0tZ<d9Q&6w2w!}-
z%J_!n%fd><_R6(-fiAx^p5H_|UbmAcI6nU-c8|1_#Cs}!hm0rsb(-H)bLjENpB_Sa
zN`W?W`tWCosoXfw41<R_!GxZpRhl(RA15k_+7L`sC#n=DjV`PleAIX4@Wu<o?l-9J
zcg)V*zPgi^+D%*1eEGySm-u?_-jd5pqsf$wbKS-ZnuhVh4i``5$#8Dfi^DaBbm{QV
z0#553yYj<6TGY5z1e(Qf{B6Jmj+?jd(Jr=!$AY;sQZ16G<3xzC3{;Aln}$jaGcU6t
zC*473e+o+~L@^%XBJg|}nC)Z0HHg9DldC0s!JOrqnd|A__H6E0`iRm@-Q)N9qJ0~5
zJ<JLS766+9OCNj&ntp^|6G|UL)k~CLN{#T(gEB-!4<I!iir2Kqao=f2kJ<!w+V}Q#
z-&c|+0*Qpc2NmF&a`(+Z-Kd1uoL=fJM@RaNRoKM=QDyCY$B}mmHX&K2z}_NK@J1cf
z-71{_K3%!DKI_n87$Jol&9HOA53YZ+FfXTjP_p-XwG$lxSVqG9mt>)C51y5s*r9f?
z{V-Z@<+W9u7{77;=IY&cajmfV#%yC_nZ>~K8ppMTvj?cm4GeDrPDqn~{4J-CjXJUD
zBCKbECs<IpkA3n6V06P}K1+jleuhDUlnOshdiLEpYxew7%7Aa{fM|K7P?!X1B<*u>
zq{)-QVT5rK*X|da`3YQ5>W*cP1s4=LOH8{x47%|?y`tT$LsmL@fm*8w-F6A(6a^)u
z1{7{)83edIsnHe7p0Z6CL$GnOGs_OHZFFniD40w9F#Hb^c_5$pkx_{Y01+~CjSJFl
zqeo+4h4^xZ-lIrhEjZY}T#8bB3AzpU2gQVEvcOc(l}C#*h*bkuy9qGDs{m4dH8rT?
zUj=^u_BUWXw;l)fi&z8@KD*Qp8vP#l@zTvPb=9sUSYzsN^e*{_BvSqN6?rw2f@8^n
z<W$P3f`bWmg;8X>a6)rE|FeI+0DB;n=v`*u*|(_#o>^fgcYhZ?0=GIIQ`FgqL@AP(
z2EZGt#M5<Z+vg7fU3TkcrGjhVT-B4TUCg;#fr)C_!KAER;LbdG!<<kw;6dZDOSQ0Y
zNqB%`v2DEm48?#fQb?a6PW(jhcl9y81bV+P@xI(^e~DPQVowwc2Ow}Ol0_mwE7nWe
zdN3ns3S1LkH%R~{sc%o_-m!U|(ti29BK<yLp$_;n`4jIsO**J+V&4BL4Y4C>zmmFY
z?qH{Wjku`iUB6Tg%}ni&wXp@P+1L<(Akp|Dr?gQNtlZ`)o)zu6@oW^nz|DvIZgtgh
zP?lL1bX*m5Ho&Tq-pP(+j4%YKo_LC%PQJSmHK?bRI_M?<-^%I%8vC})%43H2Z9s<|
z?mF^3nU2*;;>BWmr~LeDvio+m1F-GjhP5W~+9nVctlVPi;?+RVt=BqjWT|HYQ8|CT
ziI*zR(QdXu4-j}l0O{qTZkEKK7sqkFoe??;*C*uBxKI{Re{}S?M(_7RTL{*>d#rJq
zYtjh<PFD95_xOq|z@6Y*WtJfaHmtK*1TXF@9M|YI0{-qce$*Eo{^N-5&+HV~%rht?
z0xGn|)9NK69%^8X%s!VrNvX!zG^-qMbarn!4A-en2)O?Go-=JDU$3@eU%lz2z$gB@
zJ;#aE4-&LM0>@P5j(bHLg$dSrqHfQgG=Z_G;Kw7P>yMnKZZF4-M-MMohjXGz_+_pD
zw;W%0x)5Tz&4wt-sDD%E>QyB?_)Y|H)(mk5Gad)8;8#bZ+z;vKIjGZCNwVfJQQrv>
z#jHr?AvuamjAhsGECaB-&&m>cKZ$(;^Nzg34rV3WpNVs~q08B{0eO|$e*>og?`ah+
zL$ocQ18k(14CyMmIaOUs<dBsbK>PD){fZTnYkY2h%_eAtTDanD+ph=%!*2{_D{3@~
zKYP)UDpL2Ny1IOE=a0j~TMzZ64{ADegS*#QgpMt^%wPBA1ta^(kOTqeZ%?PmbZY9q
zPIl_+rL6t(`iFaqiG6qN%He(OVT#{{j%_dLX($XlYBBxtc1M;X9l3hBukP}`O~hMx
z{$(3b{j55N-s#hJ&Ok@(y+7)ieH^DlaCxX$;qZ#A!sSH;)Uaaq$%}C4v={8jTq6%&
zUQZ%TMNf@AK5C6GqNxQ@F7y?zrgoOyfdwI%E4xL1RwSY5;(@U24nUMirXOV`nG2Ew
zc7_3Z=?2bxZY*DR-3g$6ukQLIzr0V4@}ibECS_DA`BQU7frK6A)q7G$vjR6PELtbE
z4GaaEBS}#fM+-I$n|kkz<D`2?V`5r68B*JDVfOfOc|B4$go4f0X%gHvWje(%{AG;C
z!WP=Araj~ZTjl{1QpqSu-08IJ(nOk0Y*g>VnPZQiw$C?l4qkkycX)eHA(_2mWoO`{
z)NkhURPfc_TDG?hbo=-{M|-M1&xuNS6r|mCU{YYJHD8!)`bUm%GLKGe<0}!P^~wuy
z%WZ-G;cV2i9`AX7aubk@@t<k!wZQN)GAhaR8?)#Y+JG(LJt^iYPd$&lwrf1rpQJ`i
zR~Yd<R<fz9Ab+0pJzc3wx%Ogft)p2!XwoMvn~tP&Ez_yJi-Rn)!adPvWV7lWaf12J
zkZp~(%0Gq9WW7q{N+UT+WIeP?)863=pyk%+OgfI8Jgylx@shVELfU8lSbwzsUXXXH
z^JvDqGMrukTsR*qZR79aA=XXYi)>jktZdJlltq}APCBx?SSkLzhO&;@B=X<1We>4g
zY?4J-E5Fsx7QM9KgI{J<YK>uxSuX3kQ^vLEjOG_siay24Nm&qD;m;t5dUpK8Pzl_u
zEDRNEH*C3v)l|7}IOc^dcJnhmd>u#QbvnN;9x5zrDXXk-ZfVKA#ps)Xx^8eteaj30
zM#HI3_G)y<E86}Wb*=b+*<dZEj`&2#FAQ9}!Q%!SK5^??Op{c)Ct6RTVIFRZb&~-%
z_@KsxKv;(1m`C{;K<y@%ObWpcU&zc?jLym;1V;j5V3laj<F1o4M0N{8lkKG0UL#wb
z%j0v$d#!bi(?T4Vd5BucZoYQBnUUV#0e1w*{I+VgB@vUHls&xTiyC;Rv`4QI?LrhJ
zZ$3#y*>lr>^-0?05CIZY29QqPH4zG#<v*bd+yw$bZmJu>$_h1X=@NY5$}+gT83Vq6
zfo&y{*mh5x>B@r5&=SCMUQ|!vXM*fx=Nd$D?O=OSkL8Y^x9RV+Rh(?C*LS+ow2G|i
z*i}oiL8`DKyDMUKLbL@9KVLz`b~4*KaB7iLvX^vdRAEXKA|6!&HN7E_QTNYBx7Z{~
z>oumzMlJi#P>S{G8qTgob~SRU)3_Pz>|(lqt@B8GgHr|vP^6tFX)vcIqHNi#UjH^>
z9re%#_w|$I5b3&smY5AglYB*bFG65jdxpogQP_T-(GM0l$4qJQ&!-)&@m~X8uLmac
zg~{?6o;aSpF{k7Uw3a$>Is9?3$%M*JSy9`qjC#fhCeVh4hIM9am+N+t)COTID5M}%
z)X&e?AILi$M8`;&*x_hBIxz8y-0a}NVWhKlyY~i~<LO&&?b<}m*5KUx{u7~){H<f+
z{At<C`9&YHwj$P8h%_~heAQO^^r<-*#qUGyq^w7eYb34PYk5UnX|bHFT^1L~ctnF^
zV0^W`*S#au*(~ee+ZF7V!53GIr;Q+qkf#vSx7|g08z?LbL-q-;s@{Mh1SPFUjj_)T
zPm47Az7M|*fgOl+It#t2Kw8EjLv*TzUb4;It}yz3^QehSZ|Vk_+F)#R%oVt(DnA`u
zz5T2*k!zAa%-M&$@kUdxa1KCT$$bx;zV&;da~j-p^cveDYkQ64oUWV83Mia$n@t*Z
zuEAQBY5D&M`wnod+rMvg6;gIe*}Gwc>=`l>8i>dyE3WLVVHL{e%BV<X?@ji+Q1+&{
zvJ$e_`~9i=e*e$&KF{$UhvPo(qw*W)`km)zeFt;ZZJTK{>TMZQv}x=l9_JMrp6Hmk
zW?=h;*Rst1x*p=DY+t^#`KAgIKF0U57m29S*+W~tkTK4@2#{fJ5WNf1@_1xjG|cFH
z%-7j$>CQix8h)c-@7spNwxxB<^K+G@ILSFN|H#u#t50DezOg%gWs_wC_T3+t9L%XV
z$Q7d7Qzx7nX)T(=ynnyFwRpK$JiQAnUd_hk+-~%0<l&oIA0KDNdf*BYV#j;}_$MbP
z)}LMmV5v}Y3me1h5c*9SBjq3K)7j@dnjJgv=-}v{>%@9W{iCnHAH*bd7#U<t#a>#K
z%+eYEj5^MZHKM@nO|a%`ta|54k=07DKHe~P&tglm+zFl<iL*ec(^aBI9u8|y%_i>$
z3#pBGLPuUJXei8u)G&B1XxEbLAPGC5fOh|=Q2LWRdul|&8<i#D&KN00rd3WfXlIbN
zLz?x~@8-k`>gDd{x3D%jGD)_9)6epm*2e8C*Y3E1Fg{B4<rt^=&vReb#fcqu&C8uX
zd+Yl&oYHPy^4<_{>eU#|B=+cGaGk*K&hpC9PU;O7Ywva6JGaj5v@~`v&Z6wc<iT}W
z%dD<=x5~1Qafv7Ge%|Bif0WBVO51Vni#L83kGUn4I)m>g)@^)Zi>9HU56bQVLd&yy
zPJ+2zsW6^%;SAq>84iD25Y*q2QMvi>Ezi!8;0W?!PCYax-p<96YHqa3t6b1#K%>ZR
z^a5|??^ljj9_5kPR^t*qdNz9!smupwf-CzSCcdv&C5dC^tJL-$7u25%M>%Ab`>uNb
z{2UwUCLJ1s8_BdFg`<oX6FJiN6-tWguMCWXsdFDhpLVdz*16hl1--ZR2=4@{Uxu6(
z#omptr9t?Few{B)_RgbsnyVEmUo+|bblNT7&1iC&`?xyg3TFrG4Fs4I8s;7q9C_W5
zEaIF@wOj2bcs#3L)&zqs6KoJInawxu=)GH9JujfN)^xmBK;(MAmw-Eu4LW$_)6ojI
zpC9xXjeU~s-s+O=&omO7)V6qyJYp9fo-uz<Z`M1TSRma~ax~4a_*p^#s<rnU=|QHg
z@ImN&$2X6P=SR><Zy8p_xFT-q!JrD+5{-^7axiEcyZQZFdqC&of|1FB2-FwFKMd=3
zqaSC8s4@t<#UkK+%kkz9szJ_aRv$=VoH+l(+4PCmH8UQEtfS=ef={Xvavq60*P%=p
z&zoGMEyN#sb6s)eiR9p1t252VtU8cz36(6axrlq5da2$)RBY#GHFC$&*5N0O+A#`!
zpXCt4^f0o`bfZ2K#&VPBNd-*ZGiJGG%>ZN_eKXo3R~sT8zn9V|#nDLJ4M9PB4)u$T
z=yQbYAAPbM&NZ3RZX10jxJva$I6=PbM*ie1qWJiA_3%YXPp_PBuZxM@eH4Eh#9;0P
zBK>yQA>*%J_Xw+qSg?hGMPXMjx47zx3Xi^AD@<$4*EIl{P+D^Bm9!AyeZ%q>9w&(`
z$}kD|3z&Ua-#fuM(C*vKvzFFYxM-fu%eUx6_3|!!BEP;<j^OuO-3>-pULjyK2F3ro
zc8Kn&%)lhreJitdFZc60mJQ!l_rO?2u?6m<cHe49bpk!@OvtMnF6++Vf@<&Pf#(V&
zCf`XXSDF47IfNkZlth1P>CNxT9;pI>BK<$dbPBToq%a{DE|$c(hl#FJCHx#v_ZJKl
z5$?=?qO)4=Xm{)!n&gSa{wPh%_6gmc=Ncd{u$>;H#tq)Vb_nQ=#-`kptryL51BLwU
zTuG00Y5|SptTyh=gt0VVPdmkQkp`xRj>U?!>UN9p9VogEzqTfHjMv4PE+RF?J&x0W
z0Mid<|L1%_(j$(483F^MKZ1p;QcvABDI=29S6Q%&w^iW*VOLv9*+o7N*rC?NHlsUO
zSv;rfNm7++OhO6I^$MJOMv<ME-FWGf#QrGsP0YM=-RSUq;wk{TL1Q@EpQ0{1;`J$|
z7L1sV?Jl04%t}<w662??yW~SzdmM5%F$s*~3nln7ilq4rC4~u!*rOD<vN1Rih*F`t
zep&$aDW)a8lEAY+Q<BqAI39)eq`O=!@*|A(ha5ecc~~T;v+v4Aow%)Nph;ePC)LwJ
zQ`Q={7gG|=^tCwI|E>pl&qroxyz<q`pkDOS<$HBY)d${d2Lr4&if~>Ug+_9c$q*iM
zWu?lbzj`-BcK4p5LT90HKlQMfir9YIy^_(9vFi?2$DVy9AUFHLH70hq*eZm^_~Gg^
z562`aFH=ZiQqj3uQWtFl?$z)fyQ!hfQK_ckmQnh($)rk;jSI3rX(mS(m)4sdL;6BJ
z2l9Twk&=r>DeYplUDBfNWPQubhv6`v1lctV!ED_6kf%-mLs%ZW*A^YV_jRVXA-hi$
zBBySpqt6`e6yY2FnO|D)c2|U>ZC6552P781F4wq?$I&Mder}@vPwB<WP%-r{e{@(}
z+&IxB%`a+py0V=mH|#=cb)$dp@axa3Y&-zH*iND+7glv+wkA44#t4Q)m8^q7Y}ND1
zJL+F@S?`<zk;XNnQiC-G-R;dBu2wVJ7S?3#^4#~Mq^KAP>s1p?EyyP*sB*QQJXAzI
zD*gjWl7H7ighDa|x`-@BIa8!*?91NHhK28E?)5G?vT1TkgaB&+HyXxB6O5Fy6BpBd
zfPGcIGm`z4j1KIn>L}G_)-W5RJ5N`u#1sDN9NvL`rG;*wAQ%XyC{#4BArH9xU%{SC
z;epSChOPP_Dl>p*XwQI&A>yXGD7%)3754(zQi|K-1UOB+5w|~NYN%VIDQ$%nWZskq
zG)8e90w2rBouZICfnet&Ub4uY$V0mK4GW*s+%4Ta)1VcN7yPMrFueLD8h5e{?p^bB
z23LKk$W$QL*1N0>h)hsP^xn4Gf*>J*qW)|{LkOCQD=T{U`F^mk;BQLXOIP5XLh_qL
zm&7+N;`SE4dBI7^e<K-=5T|i3J|kHr;BfRGMRKXYta;XI4_tsE@r0VeZBZ9v@DZ<E
z^A;|N7ZBoCb)@2#v^11?Pw?2nc&=g+E1cE*g%F}%=^|M{=iMRmqFcZ$h>biNNY)%w
zgqtL8FK@5bZG1=MsqiGY6U@MuF~)0rXeN8ej1WE_A}ofAY|n|l?FmMQ%lL*}vF?*6
zO^rP+0dCx*pO42*fvcDN(D!QuROAUc-obvyvCdIx%*Jb4keuovIWq`iioihM6cJUb
zQq4vDh0Eh0#6l7?=r_&<@C9&x09^&q1{i!>qq+4e9JxPua$+9(KUx^jBqt9&&j1g;
z{Lt(J8~HPMaK7KKyttvI_UhcE#Ti`<|AW7ww23;j7W(O<awJ{B^Y{hWc*LOcJ!`>y
z4{l;f#4#6R=&idbEqreTEz2`AKG`~!EPKQXoQ+T2+Uc)TkPF<Wxj}%BybK<<Ld?T4
z>5_ans955CMKq<9%~zS$ru2(X8p=&h?L*#CI`6re%hsuU1UX^`xyA~jv+p9lXXIn2
z7*-{m#1v!_W%AEb{*v|GNF~!bk8O1WXIpRp?{!WDw^t-kV8sqrvuO|!40MJ`h9e0m
zEzC7L{Gwj6sz^f}{!}2rRM=oq<q4*Le7{P-h$#bW!Gw<@&q@7DCZKfWsQ&#Wr5bVk
zVDwT(Yy^swg%5NzNWA8w#i6K2@J}dZ5G75XX$vLol?S&7GE#`)#(#e%!17({atFw1
zLJBa@1oXgw1)qhw82mjk(_dGvNyf`tR9$NE|NfT76M)e}a&8X3+ok+ZXYF{f?l}Nj
zX$fNPImi9}IVxV1uNai@_r>5zrhxrs;Jg=oj~`|J|8jurU!8>_QOA}48e}12BLYNl
znz5(z1ayQE1q1RU!v)ZA%CBW(%1uUmx_N>BYJpXffaktUi7<I$V)=+07qXkm@|v3C
z75<oq;S%*XAd1qvG2@?z9i<u;P(Cp#Jw1L3<v{R{HOm(z51#$w|F*C(XAYt=s&LH(
zGvW=mGa%5kxNxn85xn&S^X5m{@Ce|jpMv<BUetl1wyW+%oj(kHDty;DSc6pE=1%_c
z)6UM8F@c=vFl^_a_7o+SfS5qU!mbN4gGgROgXsV+#gF=>c@>a`qXo1zW}5E^@e}r6
z?E;-j@VU8V6AO$4GA!z7TIPXcPzkI7H22o?1hC+z%XGmVLsHkMak=-+QvU60GU?r%
zkw;&zAFn@c=&5<E8L|RDVc%J>Kum&6EMlWJZ;z#LxqT@K@|#dZ`rcd97swwWmKS^O
z2Dk4@x=jCcfv++$p7<@hn6|(f6J<RC_IlQvX=*Q3c}kxoD>2<6cxYx19J~$qs{7n^
zM4;2GD8M%UEJLqY9RfBPtm@8VSsPkv|7~0hkqpL!ot|J1jxaHqdc~B~#P#aQJ_q|>
z-YAd&U!c0+luH16`!CGCWbNRgi$VzYA<N)ZC5JpdWR@QO2ooUTlMAEe+Li6Qpq^#p
zq6~bEcc+6>Ew)B-CN~0lN#pK+`Bn@){BM^y3~xhG*iq2xaV~sK0E7R+cy&^^5)&^9
zBwp+!G?$uH?`1rJ7Ap9&Y2wYiT;B&w)Zx%vKuPUynjpEA-(eAszIj9P%FS_%DB2Xl
z3%(TFj}O@1M+Qm&ons)K$U|Q~<o%f(|4?<TOB^)+L@K3TpFkoWb|G4f+m^`2iv{kr
zf(d-qO$2S=PX$t6M<w9cN!1dBuFpZDf)x{%eGyceYJa&1f8h~9Ji|!@$i}Mm67!(1
zgKaS3wFv1kKU)U3?-aK!;J53|f0&=RLsjz|sEj)vKObfg>NIs98&)591Rkr_t`s>|
zBeQ6-V<74e+no`vehC1q;vK~^a<+Y^F5DuzNtgY{B-|{EXHf$myxCmzmrg{Q8ufvs
zdwiMnCNLlawp~jqM!2Q)*5%>*!q2z}ZLgw?E9_@QD>a<AZDU>|r?woSWp{Y1Ddf~P
zO-><tKjasZRRjr4KXo4txiTjs$SV8&w`xch5wZa?lR8U1CFkEl7!kAYJ30N7$#7~!
zId+ch96Wa7HXr$&jG?`hHr{t4ii{I=gi?Lq^)TN`qLCcan0T0&%>cf>rQ5$00+W-)
zcduO}`V+ED{2>oHXitU9fL8PSM)g4@l2ehZ_cBbBN1OEx<tNRkh&F?r4Sn=G$@iyQ
z)vFiZh>)p1?}uf@m7P391hQJrr#VVyplQ#=$h4Vj4}=ky4w>#}X@>~g4pIM@_tdE}
zusuo@Xu->Pq9WP~hu+qqEXd%>y7)b$4szmHy|#b9MD!4_)jo4dD45iYmTkfhnbfFH
zg@}I_B3M;{r<c%gxTHztyFp*^p8OX#V~Z_M2X043YKYc?-g{i}xM<U}N%E#P^cfEb
z83~tJCP&6fGlUMmd1Gox@&0Ixvk!>!t`}RP*=dZ|K<s|UPk5#?DLdVIBM$<vq8$|a
zdG5O#*95bU)V`d!I$e;LaGhvw{86d9V--*a)4(I&o{k^GFDfq{<dEE|G4mQJacK3b
za#<RSi!xum%ef&snr0FzdaYO7X|9LgZpq*d*60A?BC?9_&2)^bmA4!Hw5aXqs~*&u
z*u-<a`~#)Oq@G<m6aSn9LuFB*y75%9d)UingEgzJ_4(Img6EgNGW<SIKpLk<G;uz8
zzQ;M?XJF~}*rFzZk(9%fe4&CL5;yk{#dN~s-+()I9RZf?gL%V)))4XX#(A*XxHTl+
zSS)o1t%>7&W^wB&ZGC3M?p||`;ov?g17M0L0C}w>i(Rdf3>aMfAgXAw)1mx(#+}U9
zg>^=x$M5@ZhPS$<wwmp0S>e{xBX&1+Hug*GUW*tce#?uRhUxz<1PIp{Ik3lKkC3aS
z<@6rdFA3){eh(};e)&aU#@&%&GW7cZaa8`;+e}U@f^>qGk=4Fp`Po}>uOi+e^*7k-
zC?UHMognebl}u^6WN#wTdtr$`FmqQpJv_7uq(yolIatlBImx!ObgOr~iiVNoxAT!j
zb+Qdx53*A2rK93W2rf)hIx=+KIUYh0Hz{!D(*Cb!DZ)d{vdEZ=_6)YiyiF(SD6tx&
zMYeini5vydsNhH$kOQNxl5{Gixe`xQe%|FeYj10&x-r$4CCxG~+GMrg6>>yps~_!8
z)4T1?-3<HL?4fx<&N)%iJI2GYy2bnH3%?V##*BFRer&MqNXnDA<loyK#dDgdRIC1K
zy2?hxihaHQHetzmi;kppF8JHDsP^mK*U)8x$oeU23c?q{-==T1&-zhCe1?4D<U5HS
z_boQd_Y)FPYQ?VEhIiNMQ;x<MoOj--o!7=Bc+6Z+0L}4Tj+!8Y(cXwO`s5DVhOxzq
zn@B=*+1-$!VgMtvrbhNVMyP%Y29=d&d7Q$T8_xOq&Wr=K)xrOH&W2{NehZ>t^k?3p
z{8vkYjP|Zh6*<}w4(DrsUkiyGb>YZ|v<SUpWDFUJ)b7<@T~)%2!f<4X0nLyS__tNQ
zov*+1N~V@rEskFyn&;lfpXjtrqKUVB67_avvuT?bTD0=?_yo{}Lo{h=F|WUR&d-RZ
zk2~a5j>j@4gFR5(^`joS!7Bad-CtS59}mon+dQSeyct~IMqiB!NipzsI8GFBlvE%#
z)7+$L_>}2=ky~eBMr#dS6Nm4`aaBM`+L*;%eo7>3J3>y1JE9sCuxn8_)PK!^&pS18
z4fmZPOu|mHv$CX6+)Lrv4?%@^=Srcsm2VC9%;*@|+KD;)s~(_FjVgP}-A^!s?1aYK
zm|?>=*UjxB(r>=o)HkeiDlOgaPxRaiM03WhaMhO@Tz=@N*U5pkhkU-R243%%L9fER
zbH5R8E_yty|F{LR^OB~DoX%@~>IAd|I=Ks=w!frT^!%1F3m@dVp9&=F?7hm)yNa1T
zYc~|+a@2#T2=}1kwA(W3k-H(^e4ezF_+IpUWvkshFtpknmf6FtWq@e-d+|IQl)Cm~
z<FU<>^V75EoGU>=!kKE@@F1Y_sAjRik07~iuO%?EANMSa__|vENz$?tIxZnF;(4%B
zJN3tVV8iJV#jTGSNXC7?t9z7aHTLALPgWHAT;lMBbb95H8!{q#kIeN%ix*o8$%a0x
zc35Mo8ZCB4sUy81KJBDDFaD(Cn*A3Dt-XBT<2<$TbOn&mdG|m2UzMcN;RTh=5jZg}
zlahGieO7T`zR6=mJiJ@>2siX`8n<_?x>=mqWJh?lF2|dUsLauh;i9#7j|(M5=^1wl
zobsrJU1$d^A0(pdsws9ANj!H8xL!p(eKYlRhep|+y?1;136*;D`Lgraw{uUwM^QDc
zDg>d?YyB7{$3^9$dx^g7&eg5m0-dOTv;bG)tR{nb2RA>OE?pKX|LiPUXFs#Htt5bU
zIwkz_>zIW{XX&tLqFqEGZ2@-H@(SwJ=XYjH4gnno8yJ(`aq2;J5A2%TtbvsIfZ~V2
zJ)BFJbJpoNeGe?U;dqW=MuAt^_!`NJO6e|Aksr=!72{E!?-j4o37f4jNJ5_S7bJ7?
z_ukX=O*oXcwrx!sWOTA$(!5rbsU>C?A{sCg|240&bAYj5vsy~MZ+(Q{r*55Or_NER
z*eP(yruwbTYV)AY&zaIQ=GOM{SQ*@EO&fhwhQwgKXyY`!%LwzYiEcfPB-bfo_V1Io
zwQ`Lc)MOO*G+RL~q`HhmVXH=PT)$P94f}@nV6mUsAQEFNsI?10>l5nPl}sLU(jprh
z>^SAKIQZb$rM~spvNrA#be{W@z7oVW^#+VTK12IubL@A^y|M~vn%wWdk<~Hk&-y;J
zH$oHQ&fasP%eXFQ@$=GpjGm-J+)K551#4mZ6TASfolLVX6&<_{@jHv1E<2-ETGu=r
z6|8!9R!8-F1qFsL%1Vc~<2ep)3!e_r=jC6Q5+7wO;|1Ym!JLtgQf)}oe%Bjm&xtys
z?VgsXQRgVf;J%+lgo#raG7Cy2LO;NE9u-J1TwHG7uVdV2LhyWvQz))0F*!X7L-_im
zQe)R9`|Rwc1#mxXszn=mTGkluH}*Ote7bT(xPMsx1e!Z*V2RA`@?(NW_U~eTxsjj8
zR!~P<Pt$E&QGa&Tla<J^!tiRkICu2qYi-`h&zbZez)~M)TQKuc=x5MhK$mQre3lJs
z+Z`ssbz|7S>^Dn_v$gQiO48j0vo%TH3Ed!jWcwN^vSF)S%iBEDN>e;r%28f2f5UOh
zoR8t_8c&N5E)S7v{8{#y#9_*GzX%6p`i9q!`c`Tx;&(6ck_cz#uK?UQ<9~c?4P=j>
zLa~C97KKcW)rG(MWP=MugcStqR{*Z)eHk>6ccj}s$^S{7V-R|$vX6Ri-6w%($5puR
z;z7}An{D^3-<JU8zv{rSEb>O=fKg*_dR#(``-5U8ivF0xNTjUoq!XNo4%p$?UG@?=
z_ca5>a^{}jr6AObns4W0i6ddjWndghuXVQXC)kE$jgCMkuww@sWqAMPXOYOi$hWHH
z2_pSVyEAhVp(pxUB%C#Yk@a$Io+dtruSG*a^+zE^;X>1}b>J(e5PL)J*BNO!me7PR
zH}={gHs&E8w8Z4K21u>yIZs^;O7O!hH#p*NN+`*2ZVEETi1hn!7l1R}qiId0xUwws
zVBA2oSo@>qcqqMi<b;c(l?xRvEkw+pE8*f40GPC;qc~rshwI>*R5*{N8VL~0Y$gKK
zj)s;+C;+vh4s-P3cZiz1>7exsbc*e9N=%E$%?!zAfFz_R{<&a|CoB+{w?AstS;~!F
z+&r#c?+8QPw(oMm?++wt8pV&BQ%1P;ir6kd*xfa?$v+KkP_l2@p&-K)nvh47lS9m=
zp#k{T<8O+-+Ng6TEPlq!H8|OA_b;}cqW*iJl)GJ;#G1~(Zds?A59hlJ{^I-l5cSdm
z>9^_r8pHU3;B3*uc!&~?p7@d;6#tp#y1iz}2gD!(30a>O>J6MRZziZSU-K-^o=Zw=
z_{V8!>E%a^ylRPZMj}e<2E6KAdH6{tzh)vB_Oz|_r&0KTMsGaG`MU3v-Oq1mg&d;5
zq&j30oJpn(&(8l&`9synY+J#wwi&NsS^j4te%gf3hL23|G{z~7g@5y!&A##QL^tGt
z?%t~(VGE}u@ML)R?kx)+p!&Rx5l>iTT393~4=?(YLMs2IFAM;?RxOUjN4J7XwJ)j&
zX$GRX+b1u)4|5FqaxMDQb4atbA3<!OAGEU*DQBejm%}RW)$6l`^CMTzsI%lDei!)1
zZ$^C*FFsy^07h?%wb}k9M@roGiLSp}luK|Xcm?{Z7Qi-L3ad}lp258mqfhde;oJUH
zVs}*igfEj{Y@)Dz;*Y2;*x;)a+l}@}T`BH$e{XUVlp=So#m?98n~Oq0l1QX7%iu@t
zkq#!IEmr-rSC*@O_jMu_LiF8dQxUtQ{b|0_5HAMP_56Zhyc%RLA2Mwc?5}SKL>x9^
z9Ct_9ZS|=UspH7^OQR_*)^0IJozV5Ok2SM?rMpw<<g;_8zkhUVK|;;tw;$}rDs+#A
zBWAt_boFAbPhFiu5<fN^W-*--R2_aZJ7BkDE(%geaxc&0D*&L>uQf;ScJYkebu~0!
z(xaoj1<L3tdORCi;xjOkCmsR}5Qyx=fmSVX51EceA)W9F5BEjsy(BIW8*KUh?xXpr
z2S7Zq&}|j`$O17#T>S3~60HIaTS&bSrU2KbD|S3f=7M*qZLU3NIC$$>?3lwZ?Y-+t
z3#WwOk>Fl$FCpvm8*X&AIImgtwW49Wn~ZO;BHx~ibV2l`5*@x28D&4aU?3{^*`Mcl
zL(5>J#C$jp-_R?6_zFNiBq8_;98?2I64$!|M{~0~=?<CPn}q|#4Wgl<m#MJs&vqp4
zj5vLnqWd&Y^ycVGlb^!H_kK9M=6Mejh~H*_Z+0;My<-#P896mJNS@yfX&@bo!Ac@z
zFY+mj>_0|D9C;ibMJ4t9pgLu<^q<9OYe}(BM;-;v@erc0r8Lwj9C@4AL%IvSwfzPy
zSl9w5dCZwsEEa{Ha{g*Nc8L*}Jwz;2n|h}I1)y4)Uj!6jUQK^ib6Dq{64ZAdH0wTM
z5rnAkJQ>(Z(3WS3-(mi|awOUDctagzygs$nG_odR#X2z+fiRNiTcTYsnm+O*cfsh;
zvM{<+R9>*Y%o*K(3lpj(usU-=ad@B<ZBbUxB+}z*xKH*IDfR$63QBo%UhORX=RLZD
z#B32T{8|=H-&G)JfHep4mR^2-qA2A)@>(Q)v8Y>g*D%(?E&@sk`@^7*d^6IPJMIB+
zm6?A{${_iGIYfrWIDbb|;>t)%zTz%$E(|UZ|9EpNwq|FgdQ=c{^}(|FV&%(y7C$X^
zSh+r|OAKEpSpKtIF!)sGK4akkt)y;!iAt4~EcOnsn<YNpuPW*_3dqXS<#${8j)!t1
zCZ;CygR#}(f0QKny{rwQUpM}P7u`_X_!2G%aiU5l*{2%K=`WGuGUoHKBqqws{jED%
zD8&spH-Fd^PvB<rqeGpA&=V>SwQwly@d`q+z}9&Uk8|nwT(2si<}|u-T!B*%5O*n~
z2U4OV?}p`9S}|#S+?a+~xuXYkpggkr!7-#n;Kqy~!fUcf)V$k=uqe1r<S~5LbZ*@|
zHuQ-7t;{r$uwb^f^U4IN7YJ1H@&|wPkaIQcI5q^Inu{#}c7}MU6GX+o3<*S--$Ise
zp4W~u3oy3G@;Xuf8lnwVAOVc^BGpk%jAC%a)2Oq4TGaTdeN8s@+eDE=UZvnOE`_=S
z(_lVVF|_D5rffdqCyJhF{!2i(rN6ih&qOVbPp3Lm?qY8Ry5#TIQ$@n)&XZhXCrITW
zQ2Ag#*!P=~t8m8=LU10Kg~Or0=5-C2HBupAm>&|3!AP7XXg3mDf?#Sj0{=lca9oe4
z4&e*9OpQw{e?qG~aUZ#$$T20RlPDF)BLEZNG^g~I^4YQ{AZKJDnrLo^ETv{pjJ^X$
zM&858TKNG5R=Db`>&ZYb<$<T%YOJCZk=#0JJLdz)+QL9mz%z+bQ9!X(oU>#gj%3zY
z*qDZ7er}7`PSJ?c5~{Gg&)EQ&7I`?3zdwPP)t8Uh5;V^cH1H4{my0TVB_l%6;BA-)
zkkbmNY>4(dpuzvZ!x|C@*8ZM%@D%|$motS1-n)!fD4@^1XwNc}`~!Vba^Zmsi$KOA
zszEOK?<r-<id^q1fr3o(nWeVNCXGs9f(S`=89@C9UP_IlJBLJNBUy)#m+~dYsE$1K
zmlpJFIuTR+gTH<$%~QI+93Psh0v4PK)}5opPmdvR=iyJiB7o^qMVCrZL?`G(G~$J9
zFF@cGw_jf#EDfIj85;V^K7){i(esxq1O*oX(bFwwXO0Y_!yhF9cznSP23uYcKO_lY
z^(nxm1`qWt;U>OHum&Kq!dwRQD>5vikiM0!Aq$zU5k1B1j1@YBf1ic=2wcSYheA<G
zG75MtRz#a0CtyL-LwZM@AXOdjCuHJnM1!X!?QFyMmWbXvaR9st^e!eZ|BI3D6M>cF
zTf+$3gwp-LZc|#QFV&N&r+rq~PE8B`p&OI0<jgrCn{b#3Eg&M$;%yH&LCXSW;#ZtW
zp8RCLb&mdho^Y90a5>Ho!j`HZi9!5&^V;(>%n<kZN+s$7lFoc{l;P|R0%gua4@161
zn4tZbKIE>)yKgKZh0PG8mR7>`;g{~OQvdXs-x;`K6JC_UU&z^4n_%2~Co}S*wt5v*
zKoVVPX00@6^!)dI6t4MBRWyr5cKm5+B{Dyd=Cmg5|K_9>ceZhVo|gLWKg}gi7706g
z@i0{nncEAfoV964CyYFG@ecXn;`67+i5f%+|0z&H?OU@1^@z5hX45_2cwKPs{YAnl
z5vhHyw&kId``^KW{Ev(>1yp1D@YCGn&wMzpFaf4=O<YVi$Rad2at!``RTL0mHy+};
z1P}iN5aJx9^npQTS;oEcJL=MVzo#sz^$s0@$UBgqhtB^GIzS}02C1U71tIZjg8#lG
z+k}em6z1{czcbO8CC78i(F!n3wbXo_fA4GzvB(B$l`Tboo}BF&5=ww5X~2!QS3e*x
z_h%j>ivm*Ctkg@c?a!ZRsU!n4frLiR0)VcfC-Z+xPOV&re>q;S%XrvEGTl_J;Gji(
zV;8oa^ZfpOz;0-ruuyi@!@N{VE+Ya&52gR8TY+88_YaGRJSD_1Pe~lcF#q{Q7Jk=X
z_dkHc0G6dliGQC?iHRH<MP|U2;%~?7#?%<@ubdt%vQ5}sFRo_)Q#Ijm1`?^kCHce*
z{^1~4kg_z>z&Ei4OHgfsf4~%0Ua(itZ2e7Tb}M4icY=iZm}4i;KDqehZ#FXZDY)aC
zId!4G@u!T3k*^~IaPCM5o6`x9MSA<Cwt<^MU)H^Z2RwwNbQ;~e5D)tOR`KJ;KOCJr
zvZjbd!-));^$$)V_1yBT`*|o~5C^`L0kM2!4pORa+GBjj;Q5s(?(G)Nq(~&TeawA6
zv!b^pcwZH-))T(R4+<;JXhBkPDsV<xu*ex(k`Dh_Rmoq$8m#17fk6rS0Ss=?mu<*P
zegY0R??iB2uw^EmFwiS`n1W>C!0zq@t+1Vb`;}m165CZQUju8R7En_DkBK1zL3-`t
zjPs{|(whIQ+Zsc#XsebV3~mz<A(5gy6~C^Qf_*p@fO3k+W)|q8T}oHT+xU*8qau79
zspM~s>KG5~0lbS6d`=~C7L5=v5w-;@72;`(yV`vk_KHyuF>$%iJM7IVut+3ZU)B*_
z0#!W{r=fYPf&ZUT2<?|jub3YphbQYro>~h2&6dl-(cv=0l(CW?MMxZEPT5(rTEY_8
zVHw(0uJv(+nCVIpU((5ufmXYDE!L!A3$hzGbhV7~EFis^NKX)KuAD$zDH)wG&HOXy
zjzU2xgI_$!_*NXgy=6%Kx7QBs@cNL?hS*%_JQi|S+6?#kDNT^NZ>NI1U<_!1N<*pD
zl=(A}8W4`QMqM8e_w(^I^N>|oNOln49X}s=B|W3(p>hC-O)z=7S*?rf(No}OM3ccM
z24YC4G=q?MU8WO$AQ4pm)ola0p+><i`oj<o;07hLSk8w$eZuM+OEBYL1-y!K#l`YL
zV?E3U$PXqKa}m1dJ|rlYIMjYZ)*z-1=&P?I9tD*Xs8H#B*HgJ$kO+LSgj*2)QU=KY
zcEpO}(xdFsrdaNW3<JaZ?xUajx(}En4nyB9H8>e^qd(fE<|6I#&pMQ&#p+w>=lat4
zFa_K%XJh)d_C0n;<CJ$iE3ZoJXH1Q=?1#!;X04IuSHR$9?jEn0;n0Q502wQ!U|ol|
z#V1x4@;fMb(_<kp^7)8RmAuO-nGkh(A$=q@#y};Fm{lWViZ0e=VIbvBmqTc|I)u0y
z9SNT~TxS{JOM%1Z|Ad4NDab5S8nq#1dHly>bhxFLDpub?V&zkN6t_sA%;k{PgYmIa
zLPJe`w~8aiJqj|P`&YsP$zCaapS*kS=utJ|GYSoaAGFl`$>kY%%6}=kzLgnydclSG
zz7m^!4OhJHMIDJt49Cwn;VTHTTu>#Kr#|Y#amFM(bLmH^hn;|c%gk7u2X6WGg^Q*?
z)i!2tY_!`~d8sE|GjaJjGMgdWuh-xZaz%;=X}xe>VE4D??2Ckq38sU613T_Jz#j+8
z4B#9=+<}!ElmKhj{1n~qmvu<>Kn42G+<mVkc_7al-dP?g$Egy3>7om&HrRIr-}td|
z@-bAcM2tz}^UF}z=yfS%Wj?rn{?iFLCbB6y2^i`o1|ExrEP^A(-0ez}g@;dI08cQx
zD1J8)kHAP?hM+x_m@S-yKsKoj0(L&{ewE&ffE~djo|1Q!FWo3`$Zo_9k_kGHil04Z
zaG^!k*!4fX2p3AFT|Q3vi;esiikulbc8v(-#goe^Mpb<~+wel>d5D6+<TMOH(G@#z
zg1jXVvdg_QOEk52_#mF}`z=eXcVq7(9q6AR^HqrnjoM9YgT!Vi8~2q1ZHtwAyuya<
zPI7W`GKVrjaQE8Jd%)4foxhnTGQXW5Xk`pw=xL+bONdVD6AGA<2N2m{O8)uD^g~2e
zY=dmGPjZuBk*$-&Z~oy}Ap(QWY1o`}KxDN&l9pb?(LHuz3H`Iblsp0{R(PUf#_?fD
z;R-_lXQFE@RE`_~zgykl%M_T&)2HgoVGVLro`4Z81TpV?&`AOyI=_O1s$Zhx!kT<;
zy}EjpiFaxjtj|JF^;A!@m_?SNLTuo)*xWZrwYUOVUVI?^5C92@Zu*q4-H2rlJI(q>
zDM-tb8$CBO1wN^MNOB*GYJr3|bC{WQU>Zv5T6F#PLRby5Ejr+hLt3BZR6w$**L8Vm
zBk?rkr2W8ws4nAff0<;=CSQ}(mow)iz9=)<C!%Lli^tsCE*Vx;q<<}GxLb1hInHN)
zcgq}zsY$!<y+}_?T*VW$-riWU&#GJ>YTkmR^3cemGeI(m^$2JXg0fF+U~Ckr7bPV!
z%6^McJ{Gt-Sr;HaMjyAi35#e4>;yVMkLJZG$Azt4ATGv1NN`jdoLk)7CC#!jA@T1=
zGkixAU@gl^zfsz7H-|a&$7ATGSZL9s<$l_TqgMuxAePMwmYnMVc@XH+?@|V@PGmsr
z0G%9D=M)_ar7;C_EqouG>OZ=^YG}JSMLqv$!psn&0{yg0A?MH>cC(=_XZmZ0Lp&fS
zl<$Vv>^uJ^+Wy)QDGMxJK=r*MudzhIU-<|bel%gJ6vv=w8Pefg>Wte7LhsJZhz8gK
zeB>N_7K#Raav8sl8D=q5<X1w~flBVU*;{UKg1A)F1DVJVAM1-b3WjET;W$d=LQ)0^
zO9URt5EebX*p@G%Nce4Ut4Vr4H$5BPbT%a{r~~52YDa*YOXZz8g)}#LcnuufjSV0(
z8K=k7`uLwYy>bc5Ox}<Xsv)}t(!TQ7ISX)97iFQVJ<Fm)Vt9hOq8)0*P7$dP*%9L}
zfo4QgWD_{k<0(VGm{=(YDYv08QtjF<cxXwC7IR1lP8D6P7;?4}hw^VzYD`dVprue>
zujkn*T&(V?FjvU_2rl_S*aQWL(3XUA*Ah&%P#cf47exv6*rf7ynCHnZB&t5o^x4Px
z2nCQa3W0^J(>(&+T~!gX%BmPDqL;A<7)^S0X+!+MuYi8fu?jbRlf;l>)H!8>URK|w
z=g@9qFRyDdfamp#sctE2I46kIMT;v($b0iRhSurY?5FUf50+-UiY2jkG4uFoPt&Ec
zC2=s;T_gsEc=W}gnua1>2)&q%eh9i6f3awW?&=xq@1qhp%K(G36NQ&*tUF30ZHM29
z4ovBXxbhn4dRi{)Pd%pd5pgpOkQr+bbzgz<XlM=!X^3sV+T<8=<>2yIrk-#<U`z`V
zME`;o-YFt~L5t=Hk>Y-gs?VU&gd;;rFN;5WZUTKGy*wslAS&FATdPnedX>c;<P#5|
z<lQ~;i5ykbN86anwBbyB56@?77&(l`^@o<(6$v=~{>4VUt1Ekb7#uY4LZ6jqao3Cq
zoEdytP_=X($=~iV5x$WlFM4q$Tq2nG`}C6F4#F94Lw;Yi21dJ@QP<=d;3*m$6k()B
z#RADY?2`FD7qu}YRN3{G+Y+@^?0O#OJ4@BhqR#hYRSZK#V$|lmz4TQu!(Nj((SBWs
zJBrve?M~xEec{2rv^bJ7>&UcJzud&gcuaQkE}O7ko~g2?+lX-oy_vzjdd!t@SEOd3
z!r$BXuvdsK!T)nbH22)V)EVrF_ieH~r>pHBQ^}xnsDgBytCnR3=uonI#JUi8ks%5=
zecs8lL&<F~96LmxNYx`1J;RibpT346v6eqwk}3LL<i^xj`Gi*XaA$|mk+Vt~TuqQE
zY71MPn>?fz)%O;zCX?CaI$y#%?yG+r4Xehl)sA+!&6<*SDP#_+JSX218#xxfn;GTF
z>-a*uAbwcrwL#GJ$D{*XoKKwUW95U77QP+oCl=<5V#`q)34He?M&D7ng<G?*GPSDm
z`%rTK?N*j{9?3J-10<dhY?w7X^yUVLrtTwAYyI~u1)Gwc=RI0Wr7b15%N)meQ|D4d
zcohPxBYesHL>OAx2*_5Z`co#HXI52ehhV#;_xmN=<otS51brXR4ra&98s1-NBu%=t
zqR%}5hJnny&7uLLM{0ekop9?J3D=x_!aVhy_xXh+0bJ6NuSBkW+c$~(Erk1ARRD1c
z9^Mc=MRKnfYCm&Q?*XjLRlWnWZof$aDm^G{phF6cF-8aKZQ?XOjPeCjd*@peJ~4N7
z`zPyJmYrmv(A+#pe5+xGZ%V(F+d@@i<lOW)U3Jh(9%JH#5u#%vBOKEHw-~<<tLk`g
zOP<iW(bFGEIi_WJ9-py~CwMid-c^#=G+bstdYe|hhU2Bo6w$9zHT@WQV~wGPEkZ`m
z`wU*cyIE++f5etpgXYkxD_K?-gUEj$2QquXSMuOJ#k$vokn9D2dJ2^vyst~XCR+AZ
zw?xM&sn4EjLCG$IGf6aP-_*Jr#09aCyY+eSDz%pz6hVta3PI;MS)I=f=FfedM(@T!
z)tR&P?3^7R;`lzIGFQ0RMSORWTcbf>p^vABd-z$aX=VSNH}NqxCqKr#oF%r}y5}tM
zlKaNmcZs>-YM<(Sy#O`!Hp_<zOrWqE9SYdlEt2USj&BvpW+8XT{vPLdU4(6@6HEX0
zHQvy$ckgZOxUw>_ep~ImtW~s1<WMUOm1xnb+(wFl&?X#FVgY0l9iEz7G%`BZ$dGtC
zA!V<kS*HP=N+#}DXFIRwRXKWE=UQN@RG{}~AF-+0FrR^#hXWg`;VZMEWLJaw!+n9@
zWKgN)z^6=qj+fNdy2-xw6T17M)9@z=o-x=qgnasOE9%_3SF-fTD9d}Bl&lyoqYo78
zx09g2AJxZ;1V_40cu(o`IyjP8pT2yd+n{K(oBqvHamSn=UB=R#rIkIcG>S?OE)2hF
zElL(^B3bEnorY64gZo8IanVoO<s+|(jti)HHs49lQQWu11?9GpXBS<nMq4wMxZC=D
zl&f&6o=<g%4_NF~7$nc;QnYCl&E__As$z`m>eB0*GElqrWbkUA{YAaXPoa7~tnbNe
zii<x+u~o$;f3B`9Q5E#lP8$ApW9a?PF!$+jHQxzu>79|y;pwAp-A}!$Q5ROZZVnxr
zthZLGiISlsW7mWo<E?AHon~gcuiRZ|>bDR&hx6qyY<5nIn+LD*QpD^?burwGd|R3C
zo}dCgUn~`O+CpJjktJ1%@4?#Lw<!<f|Iq@Vv*g}YR=g-N451gVD2Wtt$(O7DH0=Dr
zJA$-G!(~|Imh<hG%7obgS4kv1-dwfsKJM{od?13xeM;Utzu2|c%h$)l*6#r)CTgXC
z2&Qf`JD$-6%`@(Uc&%L#A_mqKi>uQ%%;z2jJvOYpN6TAw@>lzO;rG;N3)iPb!&4)+
z^TS$GBOOw@7iJsB*T)Fmlw)?hmoFwHt}=ahJ4x&clC%^y8vvMEVJ>AnH`H3f`il_i
z5&Z_Qe;-IjJ9?n3k<bV=E-DB;dU<G-WGUl`P1_YpyGo$BST1u`$57&?7FVfoEXETJ
zNFreOT}Rtbq*l?Zl#cgQFy(_roX)*M&nR#PdO>d_=<Ud4t+VI*32v;^29~VkH+h$g
zMAJ>g1I8<&Y@>iFeVV4KOVs8KOz>-|E-D(MhSJyV6kbp2todbbtPfasw;{cJX@Ke`
ze^sS(UH25-RDUAM;Tz8)@dd2vV%FOx{Kkkxw%o<9Zci61*cM1cLzhm%!ckc>uPg)d
zf)uv<|K(MKMNU`gJPt)Uz!5AIDVnKYz<rn63r^CBA}%EPYpZs1RmbOMdx#YlGrkxk
zqL=-XAgBNv|3J5M{z?#&fdY3eQx>_SG<rr&5pRdRYh^`$DDlDKZ13XAafgj_!v?#x
zuGm6JZ>JzH%DcQ*^@_<hkj~uDJLB+k=5y1YH-kg9(sRB<G)1Yw)X4e*;o!%<PPE;I
z-)pWMnyHZxAJL^zkt$&>Y}+jHm>hxO;VbC>msf}v35yrlDxo^LBbC!18Dja$>2ne8
zj)h~uX4G0~-VEJ_$zG;cwT&O`EzDawW%udAkU%|W`%#7ggDernJ)N%=5Up_a+}c_D
z$*H2k_peQF^c9EEi}wL4@iFI`bnq1%JQ&T}^>~O{pTvwN<@M29mp8O=562tV%5zSV
z<jv@3Gxjt06Ojcd8ZLa9(%<;tb??I!oKb`55TEUkAg7TLIZXeVkr0o8D>zLzY=hK8
z1s|*Z6V_qd*_3UperL&vb`-0RapXaE89lyK%;17!@Qnj+_9V-CQI*{M+rzr`d;HHm
z%r>GQqMs;yla^PNp>qvF6LU7*aU;J*zEjlI&F!ow&RuPNS>k>T9!^lcA7q-C=TomT
zM|m^uS#0%195Gm=B()nHa%%j^r1yMiKDsi`*28V=>0|5<?!kuTbMiUZV?U!M>HAB~
z&LRa2Z&tj{q@Vh#iWy#StK_F(YvTxiu@7vC<LE_wbbj_%)pPG`JX9sBbDTSf%~*-g
z)n6ukojHn?T8hf)dQq+><T`yLhgH}=5dEQvq0@PIZ!=(Tp0;V@m?X}~!>>QWmxa7Z
zPPqm)*HIJ`XkFUscVpL=l^qPQ1MOdSm|83A+Kl2FJX%MaBttH}d2lmxT{Nt9pKrQ;
z8TNi;UyoEoqb`BUBk~Cp>Cm8s7K>U|og1ZwZ0_mj9T^p5zxy<tYYQApekJn47OqKv
zvZC*ms;%r%Pl-MS?FV#Az{dXA4q%@Shn3EZ^m1Mc0+L9@yqr=~GdjG=iECA4ttpKj
zaCG#C<zWxh8&4#_6G%pYFepewZ9CN3P`(B)K+Ke5KQ8t4!%farh&th@IU7&T4$g<*
zRmaAgbc~(T1D}zr<bf%21E|6EMq<5N3ItGbweYj^6~LZ88fRv}QMe|g2E^HBi0L&S
zGU2bbp80c)XOI5ZYcv}NRX)h2CnAHnFho@&B+GrbfbZ4Il69JH|8#&_Zen5tqNg@p
zd74PaB0LGyN@8}URN|jHR6wjoL|<D0rxOY+F*7!G-Q_MzJ%j3xm6=pgIn@^{W&k;R
z6dm7C<f*`<JXMjEg<TlPtpg#cIJQVn$*%sJ4#5Bq@s44!&EOXdeEZV?VZPl&-PDBc
zJ@@(er>g+)Ux*dBt$f(dY9}d#(r8ejbfU&p8<k6OP&lLo3VFSw;m83VSQ4M87@*L2
z$ihp2lPfM!kp`bl79$ra4JvQ!SRI^6J6L9*^m5n$x>K?r;dp029Uhv=P(C3dmH5eA
z;^J}n8ryNVkwB%7z^t4#EpB2Pf=XQNkn7V9Cz^lG-!B%7!q9ouCBtJ2dAwpAm~hc*
z@N1dFxfknG!r<X;(&>7hZ0E~rvy`967^Hj;G78%mMG*md-Q(7s1a#R9<ZcN<%*#iu
zj*Mrh73E|wf|vsUeawFr3M7ZdLGdps+3)Xq3n2jn4`|IRh)P^Nu<2_%pwVaKF}GDK
z>X(=4$Y`VQlHz+@EC7xY)DC^IAOjcEd;#zRn&XMeYer!^Om`w$VhIYey6k5`mFCv-
z$N~6R|E%qz{Eu;f6rPTEk?J?G?)=&MTlkFRJiX1917LK%?Xb`)L>}D4XulNy)XIq;
zxC$Q9SU5bz0RVxcx*B@-o~lC?0Oq)FiHeU<OtE6l3!pP%U~hm2EAP%=;=`}@YGp2R
z7y-~aH2Ej!_XTDOEc;J^P1y&^i;s=?9PAw%bCfs$*TKX61E>P>dYGwZ@?`+}n1Q>R
z$YnvPhy7+#wTBHDcjl}O>MzJ|njn)|FDhXPM_93AKds)sHb>BBPJHItf>O+zGZfLD
z%pZ~Ra5IoDeVGyVua^<+v=LVNU{{CG4kkeE+4fpFDqoprc#46djnpXqtAoo6Aph@Q
z_PvoPF-U9`L+(;MZ|e}s=j5dX$B$0u+5ydD4Q@Yvw)UJn9Pk2H<Ok0DrBj+Y{O$&#
z1KWU&DON~XfI8HeQm8)PUR<@7Y2zQ7a$6_q0CvG~kcWIKvsW=t9Hox2?)tXr8j4R5
z@;uOY{o&hYsC_6>O1i!@zI66MR<@#6H((KB{abD|lTY7^gr(PM8K@l&e?)n3<1caQ
z#-u^w5Q=)Nw9i5KWD9bREcTZf4=$56v)X@y^H;|!cGX~%SYFA-!l1xP*}EDT;3fjm
zM*}$Sdt{l}mS$`{Yko$EWD#PA(AD#meHd1KdVjia+O<Pac-!SRhyCF~mDrL}dkq0-
z5R9gX=$0O)&RPlpBo^i%)1=?A+Co_dUTe2Ga}#Mg0k-q78P0(2*QdoFqrZYr<k(V>
zRX3zbc6HdP&l$5?W`Hd>v+ke%f@W|cODnE8?Acj*vI5Lsy2?>5d1%TL0G1gtpG`SG
z-oDs_2}0@SlS?IMgUL4_;4Tg!1vDA}9DV@)AZpbp2TzG6V=j^xPw}V<8vLW4dMg|*
zjG_Uj{|=ULnJHp;Xx81cE$!cH)(w^Ln%+7R4D_PrJEv>z+}7bCZ=!&uhR!*!{Ri<6
z?#^(cP(ot)>wlKlp33@_Ka>OfmxWWq)?pu1_d`gk>G^^qJM1PqQVda4BCfxZk#y#i
zWRNk$BZjG{(+gSz9Je2x@wyb1qX7%5J}9SP)lY0oslSF`r$}R#A&oh_HVQpA!o&TB
z`LS(Z4t*5ez%x?MZz5uke%yzoNec)RXH;Ci6anbwdlbMw#>YtMEQRdH=>8iU$mAzN
z)N>aD0>1WQU0|EuZGBDJzg3b3bj%F!S)@;lL3U^kPNS#R4vath14j3uuv0ADf$##O
zZd&g3NU4Q&w%7K_&&u>4LB5c<Zkc`QbhKm0gcpKXJv`wDiNZY<P)SGq*Z~(=@G6&8
z-lc!(L>(fwdlKHiyA{>bh5DGLEJsRm^Pk>?uaT!4<l&sg8q5)`HTpfVDnaUat$`|M
zhWv*tDG{3Jw?yzN_!P!LxPcwS#UJwA5bW)C0#UM?jP*uE-*7NEFFW?nkY^(o_j?zD
z#&d<#$95<*rFGu{BtZ#Kzo9t>fkit2@X;$d*8fdvCucZp{IP52XvIv4FmEEdzzK3u
z&B4TsWtczY50kYBK*3N+3vk~oL>8qg(4!#*1zceF4Tvj1y=e}#g*i+P^)F1XgM_lx
z2J9#UBV?cvJ5uBV=$JvXbp{PpyP9<A+p;eE2?nlK@2_QpjcDt|*6wO2{awhk=ab&<
z4g)nhW<rIxeGPJI0yjoFtP_PDLf4H4Wk9Xa0rkz=kDk`Q4=bn6H;RrqU~9g}<5{-@
z;bDZpcJj&%%<Z26AiVz8zlbBc2DmXJknJz*b|VZ&tSd*Zq(WWZH3W=y-q)!mA?h3e
zAUdLuBTv$hLg}$czz12$$r7RG??<m=-ky+NDvjxv2%Dm_m4dpkaT0EMy4Bv5Rz2wy
zoZVZ_z`zj6<6(W_P~1ez2j<*nxxqpTYMfu$lhZGKh4G12p+F;JgiSy@%!QAt6L3<0
zC}9G%^=zFkn%mxH4ySQocy!Wj;L03qZ#zAHPG5m)%Gs?lX6(oa(!dA&{rJT49ZDH4
z@gl217}iEG3)p;XkoDWZXV2+thHgG$`Fz6$R|*v(Y^h=pDldn47%#gqv~;#;gIgqP
zgxMif{0R80w<ayG9F^`vj_FMB#VkJIaZfZUNcbaUR){1(B!E=jc<yN(@x4&chbC1S
z^VVgz-i3VGZX+j2#AP*c$F1W$c6DPnrvV;rmPy7TG1U7_6frwq_Ev@4YDuF+%AQ>Q
ziXtAd-rxC#scy8WXt1Kf85qs~NMq7_A4Q2H|L*P~xF}g%IkR3!jidF^8IXXf-UHm$
z4cq>1AVq!vC#+lUY)h$@auV)i2z%4Gj+AgAhfsrus+-SNWsB4=vSXPWC+TD4JUVT&
zOTEB|D3nA|gpe6~2x&JSU?Y2y*mKd^PyqHWnJGsz;$d^gQG?@8FkyKCXVFiBzty`k
z`ySmWD;&T6<Qs!<w?VMshw--zw|ldAArzGXS!?QLfj1)kcu7DQ#YN!wwb#Zn7=d{-
zEuQif4jJ=&++N7+eH4+)-KlW;9(AC9f~4K#JXbsSNaZaLl|6>$X7baw%d5!KmO(cI
zXa+6xWPFN6gD#T{Mfg(#({p*qxxUZ+ciZ|cy>^A$NtK21ztw@*?tsi9^SRznr_<{y
z7M4|a)8s}~3*YxF`8_}3pjkLiVsw`Gu)<+HNCL8H-S1$If-71V<SoqBs7-zIOvSH|
zFH`yYH9ZcB*xF*Hb{1-0PqUlv6{&qyo>B>#)T$;F5}bGnFPg0Tr;P0b5I<C;ZR)xW
zfx-S=C83oM4e_ticH``{el$a|h~gFuB@d56E#s1&CC#vp5Bg6R?p+E)K0Z@01{er$
zN5`FmXDFS0AS9>&&ybd$e>L{5?d8+Ay&M7xkEA4Q=zDZHT>r2hxh*NLeYC7#XzeI}
z@ae-r`2vmx{Ut|qydZ@U^{)KD(n|>LoncoEbtPK#VI9oX{(B{kCnQJyG;LZIQ~#av
zDkh=jvxiN41)BEm2HyM)_#fX}E{rcax!@epyEp)m5ra^vt6nWhYV`Nwuy9f9C+?Xy
z>AXKPdunTVdK0y(13p}AE`+8CypB`}@kKoVIYvdFWX<-?>rD166Tq2W0l5(G??K6p
z5fiBH8#5<$soyo>XzS-_C6Mg!he@u-LRLKbM6HVA^D{=Ud$!;yU&xcWT?r1|&>Fwu
z>x>XfDhOQCCwp4NX^RvS{mKbR&4RFf<3rqLNWGUMy|1G}R@U|V%EqBEvkhp|OsimF
zOhCSjJ_j2<!qU5wWURuUVAut3C%VnhuEIu`TIc?}ARSWPb&_uEoZ}eT-PHBSvTEof
z7t6x=kRfj*GE;`Y0TJ*#zR=cw(yt=W7fuyD6mcT*3oWHQ_sSxvU+B`2ljB5oIXIta
z>NrS&L`A@)@dWzw(bFPMo=_0e9F_|6srsO&Xgjs@*y?w$VsQM*oxRe#b<(l0Jr?JX
zO%}H7s!@9_)_dX%Uky?q<|Wei+E!k$hkW_@-PuM~(m}D42m6cmKGs0{{J==N|4z?O
z9s2M-ajxxymWRry;oOFjnC2<1#qBpmNz;eJf)1wfx8zoSv>X#J3!Z^apk`n-WQx#i
z_pf884uBvY-0}iYH8dQwTg9vwEU=i_5o?m`i+(gqIe|k^I7T$_2YjEz$1F`5X*z+Q
ztK;z;nId1h@`Sr}AI>iAkdsY!qhNq7(e&O1v@+dNQI8}rUhgGD?a3ZUJA{spNZ{-|
zZL)<Va77};3RQX@h{)hRnGnKgN#Oo6S^^NiDw1}Px1HQKSGv11eqaZ?+3Gl8dSZdR
z9b0Dmmj3CJ0QrN>y~vyD=OyHz<X;x-jKk1gFnH9U9`oyYNEW>Q*ui%m0P^|WfFmZG
zuuF5q!l$fzi;S@G)V`c(?4<|`@^1_WliT276E(qWg74YnZon$UlDtKf)0kD)eWtUT
zSg=zX#6GIa|MkgmueEd^^8fjzw_0vs=9fJW`hE6d&{a@X1-rLhGth|MLKGOUQtljf
z)V~`a%knX?j<LHZ^*&CzRKNZIc1`jfmgFJd$F4!_bRIyOhg$l+r#E*0-uzM_W%O>B
z$xafmU#I0IYD*V)CgX}EHz2d|vfQ&14o}48KO~BD6-|w&lNr<WD{qlc4z-;aHX|?s
zHj>nU_+*TGeF*nLUGOS!Ca2_G;KXv=)20(KR^WDrtUa*IU-(LscUZ~V$badxWDL<H
zktc4F;V3$o+E7eVP_2AE@XP1NgyLfcdY;B~2W{26A!u*dn9Nv6@5J3C<p=>DY7wJo
zx#6?h<P!^XHUSP2u|7M+K4`3oBkJ3622)Hq9JF7rR&O@&w!^0lGw(p^f2L`7YqbOV
z^`}0Wc&-FN6B3lQ3VSnA9Q^IMCP*5GLL$}}N2Z$WlBwf3iNs7$@N}0ln501UW9$|}
z<^tr<D>|McN4T14@6{$+4S{CJX;FL{17(cT;H-mnQ)2>e`FJTqr(h#LshY_B6%rhX
zy|gS?NC`RE`IPa6r1xfTkVH^NRTY2ap1JUWH*j;EYRN9+0;DcSA=5u<J;}@Ge_jA2
zg3zx13hkDinXaaYlCq#t*JHSFqOh`6?9$l0u=o=wk*G&<i#xe+L%04Ty<Mnd_cbD&
zMFkfURTn)pkAbsrr>In)84Ce}LiUwO18Z!h#AaC~RB(x)*)GnIPIl$-Sxp$HW0ksm
zjaiDB<MQB}1{^q9=roU$t%IV;`}wAPt-uqzZ=0~WrZWn4oM4X0na)73Js1aKwj<1E
z*JKr{TQyKjgD8t1Hq?gSMc^G<Gdp2iUbGp#xKN4MI2T$A6^~zZ@_`Tb&#wRZYve|W
z`*BN{H`^7X4W%&HqzZ-aKG}gFi`Qf>BdlX4#EdbrkHc+-hwTEKtQ~&d34Kx#qV#N{
z&x}b;C*<J=Jvb-7+<vIqNYjTVb>K<a&??ePF9m*b*f?PHo3K^(c>HPw#4NHf^fLP@
zlP=`H;G#0M348FO)Yhx8LBDiuQ1AT~yC+)pOu+nTsN-UaNH!K-a~HlZN=(N=zM-jM
zN?Xbv4nbChGb7i1Rcl4O$c_<F#_z$g?V&^?(LuvxRLcm>H}5Grk4x5J1&gAm!+bP4
z-NNgwb1LZ^c;b5Y7-F@i=oVKW@HTA4n69qqb4)gba1mTORWh5FaH8l|$ZGm6%(KEw
z%=So;`c8M4x2d|wB&vU|PTw$8vh0i2#&C7Ow3(qam<GmKR0eNa?b&T0xnS5lYIzps
zv*utSaJW^+4?AoAYsmnl9CHiL$!`Qm=QxG4gJ8rz`=S*Vg5A8rI#!$PS!ca(my9Nc
zNHU*t@JrSua9i6HJ|w$<O+E4C|5SA);85-VduU3MU9?!omP9DB49Sv2(q5Kv?Xt#X
zFWI_?tTC2JqLNE?W0$OD8D(cs))7XQP$d7)al7|-|2^~c)bnuWEZ=j^`*}a_`+lC+
zw|<>eYW`|u;&3{m0k3%b4Nk|!<pK9K;;cM1Hiu>8jBj?4%-E3gu||Na31&4t-1y0E
zo+eJ|d;7Y(aFG!1ymbMk%NBE)Ud4Qy>H-18O+S-<1;CA=j7TuMfit&07IUE;U_7TQ
zv)R3RUh6rtqkr7AQ`<eEP1JLlDVb8V1+fa@5$~IF(d%6fr7x<0><-0+`UIy7>+=ej
zK~l7*)-er7Xq5Zi9H8a9=503CKg4%u{qVBBa7>i!K3zSG6KT;LJND$YX~U`d!R1AR
z7B@-BeVOJ1!LN_a9ds)YpFX&fzuHfea=)LT3f0=#;!u(2|5Q!=lh47|GzE;t>*80I
z^O;mE1eeQPKre}rm%B?H9ee=w=(~LSaT9mW<jn9){>p>)np_%l?67JM9KRWY|2;(2
zJ9YSxvVd)00HkTQSN&R_eZZ%meuOZFJra9VoPgle0h%KO;ljqe7~*f?UW}b^Eb+M4
zKhAex)BB16io)F@&3~BL<n77G9o|~`)t|xe%=>Spj7W=ZD=%psKI08)7Tq}O$w-v8
z`g{eE*?<lZmBjROIsF`xA~F%`i7Eety4qe5_VJ5KbVuoGFC9{Xxf;`s%{<L?|5O7k
zWl({;>7(=*LC*Pi`Mq;njGJG@p0@j)@wPDmKsj?Y*GQ9n__C;80_YG|x%Sea0w{;7
zx&9DYB~oYsu+Dywj<|7nXefYGJMsb7x)Vg16g+O%fCakrn{}vZ<}x-D0tC2+Zpniq
zGyuAX`_shI-r0xa9lO4Vocj6fgImrqP+jH~T@{F0ViaVRC4CB7Ghq>FYmgRj<-IG=
za5~-^1k@0c4%{?8Qi|gh{FBvs=hOm{g`W8928SaJVMY3SdXx^-th`kCmU>-{1%%_*
zir*-H$2{KzV3AvOo51niQ<*#G=wrCsUqaUh&w^|TwKaVm6;&Fmt`7*g2~BEhyk<<y
zD2L(aGA=bgY@SV?HSqvaBMHcbzQi-i+0AlvRwX(bib~RDpXu??cWvwytYNj#Yz@>E
zT>G1Lr25@pR~JPT2a*LLYp~}HoHl22OT>ZT`USmM#jsX2=!IhfMqs{y?WU6EP|zbL
zujWxCb4fEs2GMu4Lo>lXnoT-4=ziunrqvBj=eCprZxW-vb9=)wA*INMxopnlZ*MsA
z+8aQ&HlRdpM%ne|B>e!q;{;Jwx4@Iq;M99mV<8d=12?#&x*K2J#7po4CSwYKQH>IC
z$(DR3KUMf7aoh&<<zScDfGEyB&4-Wj9wVpug~FmA$2%2RX9K)+B^=bWFeyAlA0(d7
zm$%y&?2T{;NTKCRg9{az2!R~VkQ@e`hz{Cqi~0=63E|#zu^+Uqf*nX1RJ7(GK|Xy4
z1loWh<h6z72SoT>ve{bvCgZO+&C3$5Aw2Lgp#%dE7jn~Yvy)w&8^y<C(Es6(o}S&X
z<6@k6gu)VcFtD6RIq5<+?mGTy#0bcgri0%=nMKy+$Sf+e<@ZA~qw`$+mQ$u+vX^s?
zLz~lOgsMa_ghTE34)r&kePI87M-AHUA+WRW+9(=vYn3WF9w-mQ7T0bp$o!@r@ZgY&
z;8d1XggQq<x!{AdA>w?qSp^B}Ab^uPcPByio3%Vc5)Dy{c7X<@3sP|KU{tw&^>O$|
zoInRWzw-{9^1J)Y>Fl+TH&j=FS8Fi9(UoKL%l(koJcu}|&$}<+cqG&z9}rF*w6-4w
znQF{_EEz+1P+KUwus#UcHA)1^_ZxOVAlehP+;7pp_MfmbyqHq=*qHG`H|N!q^dsW>
zlpvFA8Yso$h<;Cx+eRWDIPa~^HO&>#rh`ojV1~TgeE!31V87W+vdm_b19Ud#Z>c26
z3SHVmTUG%9^va(5;sHlEYg<9G?_q-s>dQ^)0o-54UaNztO3qC6IYMV0p&r}d&G9id
z$~Uj<9+pzao&EyG9NGZTe1^7vF)kR9_`&@xF3CT*Hjs@~lKcXzf3(L4A}0|nr!rrb
z@gc#jKcTgVSkdXns<r&P8_|+%!g!=22zUK_>gflb5_GI766EXwd`>u;p5q1tvL(Tk
zHVAXmtyS?l0AwRCIv1i8cH|)=g2oP~TK6WR8Z+-RL|>3`mA2rbjJ{nKXHaW!t-UPP
zSDPKG>D#02m}64j30B7X0sF7D0XwvDR(F3MyOCeZ{sAOfC-bUTlW!K=#Q^X545<Xi
zm6}~CPNhm)D$t>{m5B6urpGAWEy2)I<a8!o^|7jb_hG7BR$n{IA`z(w+EP_1j>8o_
z<@}D0tog+b&=InMQ7uh2{){X`$4q2y+7~@8Z1g+Xo3C9}k$h?{fN))lT`{zee~UZy
z5(Cp^VFMKEV1%yL=__+IkcZ=|y(Si29`ik~mb(?CFtFCzpHB%|k}n18yvpXo9WkcU
zhaz?+87_{cQTz*n`GjN)e)jL;%S57o4k$P#cHPgX)@;llX9bD6`Ok7!%{zb2OD^=o
z)QxQF&{yU5E2Y{^3C`k8E73xl51T~1zSQ($t=*<z+@MElGt|;5F?2qA2RKjrjdPO5
zHvB+g^kAB6LrT*XH_p1_+68(X8d5au5rHKnP>ojIUhJfTt%L0pU5>1dm+UY9amzpJ
zuzph|e+7(nJ;nYgTXx;>N{I3e<toj;D%CA?aKSGi4TR%YV+aQ()p;#%rLZiL8p~Nu
zc``YaYPN1-eT_{1P&q~0{09He*g2Q)v0Ez1&L7pZwwEQ(1IbNVIF#EZM6Sq%0huZh
zwF3^FZ&ycVHx?s#e!XfwR(HCn=OY_t6&?!CXCisOd^68lO_weerB^ijOO>S9jHU}N
zBGvPI$|X1&u&tGuHB|7Y#7A5nRvYd}w2S=(0TIsmt@Av$2-Um|vlZ|XQ65L@9k#j|
zf;}{Cn-cepeSez1Oy^cpLqz)yPBS*@e(^+N;q2S8o<K@?rT)?Qhtoj+^zhKliUy$2
z3mPfEdCBAT<)8#dc`ky7BfyRE56PFnOyYs=RS{s>YkiDhr97YU{kh^X+vh&_unw$>
zE&HB1hm6{f?v|Y+kq2ArkHQ4OV-{^767;Iq*7tfHQc~@${Ef7&77^QZM<jq2z!g=K
zdI!Rhx%HEqp~Jn$qBnc%ge7}^;VztxvihB{+r_FKhmDJRNOiN}TT!17Zx_}0^%dWb
zVqt#K@|&+T!<F(@L46o3ihkO+iK8|;hjBy~Hf~5c)YL~_hAib@b)GpBa%_=MHOWI}
zp!9^;f)R`P)3qW!jF1d_u!~*$`&7Hd7MHa0FRt0mVf;*q=noF>^;T@NK6pUKcci6i
zdz8;M++G19L4w?Rpy9MyY6%LQftlk@n(y+|K9|Fd<R0T6{YftjuZyx}I&17-o566A
zZgIMV`$ovObDKUEZzY9@)%=uI;%xBk$xu9_08h%?ZA;x6YJ%4VCdI|v87)iPYXA7@
zQg&kTyT@u8c8cE<?DM29xtqRf&Vx13hxv42Z$-Sr1-bsQsv*}Iak90yfAN7)s@E2V
zYs5)T-Iu&6R%-RLRVye}KTxrcSk+K&U}YP%B{+Uf$L-yw-zL(GHzuqhjgRe*RVoU>
z$Vx#&+*BM$EtBUfW^>bT+n8oTaP~$O_n$ZL{8~i4vULb?n-xiNXDap7%YCtv1-mi%
z5Wgrw0ZB+fH?2^W>Ws6geB;<r^OL^`P_a-AZ%6rc-)bzi;yjKfah<3)K(g!Mw_bcc
zelL`f{(YN(2XP&w4wOFYb?=4}#k>aOYbbGIphU@=+)tubUAcdWNLcQjR7K$F_9qE!
zAO^7ef@>|kk%d~Q@aY~0^GVNYkAc;hhd1~@-uGja_5QS#FCpJ?=$JVT39seJE9)aU
zdxRdJFR1<ndtAViZk(q?kRS1={Mk#);A1oTZYGixx2jVxg?*)X42q}h>Ps~^UnxrG
z`|pxHscsGBsW(0lt=h{Y81v+*r<)~W-{=M^ACR;om{nSvDprv>9;Nk#QXI%DB9S$@
z-O0=OV?P&0>kS?=%@E`l3#W#TT@S?J=Nq3mkXyYeOZ@-#YKDMBgXw0r`3%EU6Wd|w
z__qU6lI6P{g7NhmEEg}GBetsI20qeO?ag1_=afA<n}sx<#RHHWT;kp-WxXn^SEcoX
z?yGL9N}qeA+0V#jp=2dZ?wqZxCcU|GLnS!jI_c-7jSvcUv#><?eG*^tJPG@jyedsg
zfY9F6$HL@l#b?aQl*$nXwK>I}$~|eHh8mQ#vZkiu`S?8q-*iGZ%(HDZ$b;koq8CS6
zVehbH4xdMBA!q-eVFl3F=TUV48H&_(`uRTHk)KWCMJ0sgrvF^6azPa95Ol%!I5p}F
zxHj_<!bt@C2?$Se_JdewF6nHuH#Nd+-VH^pt|lgWqL~k~N3ik6^ELA&7FKymdGUNV
z{~~M<ZL>}eaQ}PGlGzeZ-LLrp*?mmzX83mbsY9Q>pE>WSYxH7k<IR=>Se38IFl}tW
zd>oqY@glKRwC?Wfob@^9MkRvnqOES~=1YVt7!qv@uGg1lbsH_E(W^zSwf05wtNNU{
z8|U?pyAy7VD^Vy?<`4)>V^G@rX?@UAnmG_tn+(kN@n!h-lpqFH?i?s$pS-;mgzcPE
zvb_&j<9RqZh$_~@|4HcspNJM}R&?}g4g_gFYk+XrMkL_iC763(o(|f@-t#!pg01Bj
z#PjaY@$O;Yi8wrp#5j{Gp;W@}McM_wEw4$xyRv5mN6}zrbAU!~Pq6V#<7K4X-UTU!
zg9l^M1_2!!7%toG0g%Cr;8^n;zRW6*um0|Gq8QQQ{=v7mHa~4S<(IHVSuzUlkS`P$
z7UGRM20y*1Puea6`v5@`Eg`aQ+dq6(P#!J#;VH1gwwvWFt{2Ylu#n+;HrHSC7uejm
zrnt=>F7MyP8;(p|a$1T4yJI*SBeF1+;*yM{OxOUxo&rw-dqP_}Y|oMYeDVod*jt6&
z<6yL7rkjjF^`;3o+yjNc%iP>tyOa`an!jfi=r@o~sRGi*FK-&k=z<2(!ijtslXU2B
zRPE43$dM01Lj;;Z5g5dGy!Ag?4sD+~D+P&*=!G1ipp&uY_kc7y(a(^weNFA?p*tNX
zgFNy6Q;9{R<fd@mlko-~LvS^&-Z<z2*{O#^YIm?=KRb$p6Zi;z$hA5CGWsiY<laGF
zS1t8;XxMphSsf1AuIHBJlmknn{l#u0txs^eX1;{$jD`qeLrr=(Kk^6_55|G>%&-4I
z+#R|Y|F)HPOC8&m(DdKM$_&oJyBvdZ83uN-efnbtzQ<W10Udj8yH8+Cbo~?PR=?OQ
zoVTEjuD*})&h&@3kP6yS47l}SN#PNABj;=n{5_y}J8b|GX`drD8!mCC)<bk&t-uXC
zcY$i6O8yB=G(d~PYbGmmuUI?WCJEbRNVK{;<7by|)&x@<XJ|6dTx%PI>m+yn^G6*4
zd1N>{X93UTX;*&H^9k`P|4$*6R7om&D-x|m4^Hjl5F{vvd=*D~#(6l-t6~ekHom4H
z`V`1AyIyW{4VklLO%I+C`TiGQfZcploWw<q8M89?7G~4IgjUH~`RWSV)8CcO5NlaF
zD>#g1(>?AvZ&GCSKK9PZ;9gk4B7wCqVE3y?K&0>|u10T6MdF#~@jxUP`9^x!CP7_(
zbWNIahJKP=z3v@k5~M)VM<NUbss;CVK~<m^a`L1Z|9JER@@(1wJGO!C$dY{ur3XTQ
z(Z(}6+Ja6P)cZmhOKH~q6P^Z%Ap(B=f>`kxaQckMz{J55Fe+-V=`Vno?U1xUEWv^!
z$)fw^zW9&|W!O{25P~$RsjC_INPDnen<oQ;gP*0^cff}1z-c{GTn;j3@(Q8{>Q&jL
zS|`U@S=Y<ioq7UCAW`KWMcg_L@kD^`8QQ>w*$xEqdEhJCK*!bDzjqK(!&%cqVIvRr
zt6eH5Mi0r%7<vrzK3qQHDV^QQ9Z(#G3dQppnP?<}N3-klZJX@oNGIlCC7aVcQbrSA
zm$l|RKyh$3t<{R|95Re>)=E>V!Mk@OleqeVR(>?|(SP8LFTk6kzD&o9`xu{}N0)`+
zY0q{kd-+n^lEw{(AX<5R<-tkM?+c@3rDAUY*i)yrmQS@q?xV%86|=1##6XM`RJ$hg
zplTTcaaUx2AMSIUfpXR>$3=ti{RzsGcMU5)zkt5>qO5{%e0E3(h<uiD8BRzWWc7m@
zw7#&avvv$#*l!;+4SH_}8<2n3D2zcIQB}0p46_KdeG~M|SSzST$B!p>3?@>i39QZ!
z&uR$>@-ngSRg5<0QfLVdHZFJ7x^!jsqdo<HQ%XALe-Lf}jxlcd6cVP;DMmlkP_CA_
z^;)%M`cGh%mFZ0ylz(kOiY%{e*oNQM#wQgER)%0~@5*R&{wi41xv<|BWTFlnZ(3CM
zeF8QxU!feZetyx$T*eMt5J;L0(=eaQbhaz~vKXHgb9&$Hu2sxYj<5$Zr_DnsmEPow
zFGDSzN@W5|`9Cu4E^2UxTGqpKPg-k&ub~GN&3i_dG4ryrfx2}1#nbET6;ZmVAIw7Q
zV067M#AQZs2w4&TdGV;+F{cje<o-^ek+x0Mf&t$_8ra;NAWHRDAJp=vB;&18f)8Ww
ze$N*!7Mc^RT``(MS|8|>Xrh$8yImD`3~tPXl{qipXOVaTT5S>hsulSj#=e!uAbt~5
zSzKxwj?a6x|IWRWEf1P`9Syf2d#?>5(nf>d&cfIRJ+CUM+?9KS^DyvyzHc)a@AITa
znkN<i?ac%a+dN6Jqs}q~7B*Acz^;Gyumu{k*U8bM6N$(k0{30PI(AXxFLwfl>k#IK
zxJQw;6PqhbR7omtbhLN(qz5i|68QCYf4Uue;&!>IYP334&WX6;R&+N4eaORN@<Xvr
zKVB=9HkO;d)Q<(-Z2w+g_5y!4?{a>s=;9FK$l~|%T5)pCeNZ`nywq*nppJ*?APnb?
zc=U$CZ}=On?gQs7Gc(Wb7Co}wA9GM+Zw;;PrdU*&xaNw}56yJabB~U*#l65%eL8C;
z>njO;gHX!wHRWo4&=#q*eg=&6M+I6V%a~GW$eYkvKs?-lI~SLUzF~M%4{i?hOIo@9
z=j=yfNEdSZ)9nv9fjO<HWsdD^%I*bD>h!+NO0UZWWL|Sxybn2s>pVx+t;Jb)wdrI$
z)GqEb&MO09<f_7w)`VL=s%2hrqAltPsIv3Q{l-}XoU9nK=(9sD3&!|)1))ISx@{9s
z>5!Y=#ZT$gie*z+m9G*c$PxbiLPusccYVB2EcXmuC`PW9BkGJQ@w^SupHLLZ8D_~O
zEStmksLibN-_&&JqbfX}Yx@%GG}2lm&3Pd9u7Osi3Gja%JcT8C-0mmyDy%$o+?1>g
z363+E2-+rfaSI7<%w%*nr@h-J=yY1aBS*a12(NpVI;rF-Nie4|-uv?5e{!WZP-t{G
z_7$4<2!a*^$1Ij3tOV&M=R}%2?W9KW2c$YqJf2E8t|^w^iT%hW?)$_+qfeM}bd1-{
zWC#?K24vQ1$&l)A5(X+ax3A|!7@XKtpA@G@M0htK5~7{xxhPuILryiqzP;&OBS$`B
zI2HrNLT@y`q3wRmr69{4H+fHJjFQ{%>&X~4!TFEv3~NIzNN(5>h&}?k3PU>V$T@mh
z5R4q)>_>A;Vycji+7h$R`ykIt60Xh!EmwY`6fy+?sf`VZ1ii?$7=PJ6G5+<C*`Nb@
zjHPuE>F@@Jc~Z$U(@ehgTwy&y?8OAH0Z6(l%(oU=()#=X=ktER9}lVkPd`n$a}y!8
zD`$PON>4SQ1D|}-)OgP>EuH=Y(kJEM>2Gjg-Lu<8=e?cp+^27(_+(uPS6mC8zc{sQ
zJr#+EjaKJ|y#Rze@bWKU#9tk>zotbW0ObANh$AaJ4`o(4(mK_T6;y++R43ZfGZe&@
zhuD8$)-O5(ugPaF-De@GmD9*CZ~wR`JAj*dBjr)Onk^+ue8+9o7WS`Oh#PXL1G}uB
z$(wbduEXhLj`(3|cwnTvkCojA6B*(SZgL9OuYNhi52hL3z8T-m8Qo1m%N@x2OM3{5
zFMD^&RqH5q4sHJ@-c_KbF~Q$_`vFfm$K2>GdU?;-TghhL#bVvnH5u#vfz|q<lqQEb
z(0{~O9&{vW=h0%$91_fTRln=Np10Er8r<P%Ig$m}g$k+27c7s%4A&821?Of;aw4RJ
zd?H=N{=ks6BPg6q&MUfR11l}Q=fpVfJoTxrZ(#Z=PKLbXE8RA4d^%+!?Szq=Q{(|G
zpi4f19?xUdJK+(vR;Oq3lEaHRVwIB$(u9-9h<UH)-#l)$*_Z^8*Z*pHu1Y8oj@eA!
ztQ#ybe9%YX{;*oT^os~--f>C1#+-GW^P(2kV|d6ndIl5W2y9-C-qTY`YaG->#qXP6
z?|+?P?xSF4M*7UZy4A$yd$3bicjL3gH!`B7wpY|NJezcyV-Z1ntd_sm^#$3msB=n=
zZ(p4{F*&{jksfY!3MJRM1)^@842wELdsMpCr*>yLdO4=dXT^TG-!cl}{#68?D1Hk`
zrhV+&NNW8x(mzYV8A}Kh9KJALplW~<dcAt^GL1bMyiQ0ui8*stiVidBUBv~J0WQTs
zFm3>s^XG?~H&ga}-GIfy7m2&~yxflLOoe#hr>3|~>QyrifejH=g6>3|Xo@2Q4DZea
zf5aSBsafUn$fJey@h4(mgD+uvrHV&7@FRdmF|vLD9}LH^5!9i)JiQXh2r5?3@}U!;
zY{38{cqHVB-s^qhL$Aw0$7aH2=ttQVcH_bBkm;rsuyaTS+i0+93^|;RGT>kzgdwUr
z4Vtx(8dkXAGGuvQ#ATqc5me|6Ki>6N*Jk8Ye=IXlOSX0rZ_!CAGjQyr=frR`<esj4
z!B2b5?TgHdExsClYbd)f!k&fW(w?tL{Xw%qq4>&3xAOOceIU$KjQF_g$H{e;W<Y(s
zDYs$P`&+09_{f7-N|(!a#jz)%W7tfAfP30`ZTLQJQcPZ1P`AT+#>`E^&YyD4-iLk<
zhQea3Q}j)F3DKH}-s*ZkHeqU!r^M6YQ9j12@ENyQ#lY-PT0i1`wjAEsDi-P$#T>5E
zUky*~lGv|&Vtec}2T}&QnrZ}fY6<FMPy!j4w$G|=t<NbS)C)XY-~5U@j_nW3d<?H{
zOCZ4pAm&cjBP)n}2Hxp|?2&A5Nc&fr7JEq==o#Ie>=T$@H2GeSVD%3r{Wwk*wnUO@
zaz=a4uY7H8n|q<9?JOazE$yprdgvgCg-q2rWvmT@uo|o7vX(ywu_nKd6X#jKyxcj4
zWj4Ml`lVdIYvX7;Y4D<4CpRDaIN`NvF3&S3YUF~EKqOTtN3k>`hK(=C>NaldlT&4x
z%)nsv(jQkaWcO>{-V9CgF2e2Ou_UBGh4Cv~RP!(hXg5U1iqKbKsYX?Gccg+#P(il^
zl<&L}9$`<F7NR*j>|d0XurO#Sl8S}*dVRWih*y{(xnw`LtMshQaNV~>*Gllbrx#4G
zn%jkR>b=7{a}_+)-6LgREhZcYcBRvkZcG?5dti2JpOdFbUTZMH-~#EL%e(2luF{*g
z)}CI!r+ZgO1P%)$F!*mSR<u5nj{r$<@f^sa1dT$8-Rd&2o|B&L9?W-3L~Q+xaS3d9
z7^V7#Ey7(-x#m_c!8zxk`laHNv=*4MN#6ab@G5tvj8h+x`iPXVDqiQ)jpf~w`+&Ro
z3eW;KR(0i`u8&pRHxscirtMo{8`hmw03n*y8tZF4#enBws660drVM*cD_$!R*lcq=
zduOF+4Yq}9#&v^1aCC}<3H-E?S4K664W?c(g;?ox%kJ%{QHxp`zoF?QUKbQ%iv60*
zJih`Uhse10z!aYw;!r*WZl2&b4;Mmq6XdDy(&jvHrKR1;_>->lSEc)i;y-t4FaHJ)
z{^(2EuoSNjYg@*h5xh0Vdv~rRbXAQC{-e?MCUfx!&Jktokfd+fQ>qEa`}U;c&F`Dk
zZgq+TwauM1wDEOw=TOYcnOpVFD~VL*I^=GNL5+1q3g%ajS5%j=#-Q_W=9PN1_Buy(
zxRt?tCb?TE%I&io)n&o&d*{W-?pt5hV^^^cRdw%5$F)54_!mxzgup}FZ9Omn0wcB6
z_ozG)vrUDHu+3BU&_5AFNiYp0^}Vxo#$Ve0m^7p3H(7xVfi|(CBu@7?xhN9Ni(KU|
zOh&O9pgcr!CyCxrk{<um=qUIbxLF}lK4O*ekN)BgC?YGjRzcL<6a*LLT#HAFi`tM{
zs2}vfmfi-LnR*6)vzEx;(MMq0Su@fHQ%-DKgpghbB6jZ7&rlVK)}u#aUcEmDFtkDJ
zk=uZu0%%Kr!?kJzu2DRTv2^HYsf{33H5rIlIPWii0%nS!j3-L$KGuOq?(YE)zklT_
z{L1AX(-R6|h!4mHsYgM!`9y0OGO{NAtcBu)FYgDm|DL2M6#Z{z$AA!=q9-+0diGkM
zVZ7QDBp#)fgYp9@m+h@~W{U>g<^2Am<GwS}L4heq&NF>^PhIvqs{RY4j{xw<ETq`o
z;b25sfk;=0_#cDKx%8ysFtnWJKL#71e8_jHDxYNGrTR{v($Ds9o$wQ6s2yfciyCD)
zkk${9A?3Y6E0rKyPPC=#qR@h52qm$Em>^rDQs?uB|8tt{>9-g*Qsvr$7}V~d;E%4h
LfmW`@AA$b|%wS(*

literal 0
HcmV?d00001

diff --git a/docs/manual/_static/pictures/dds_security_overview.png b/docs/manual/_static/pictures/dds_security_overview.png
new file mode 100644
index 0000000000000000000000000000000000000000..9951bf97541f8ded29da3a630fcdf31c97fb5e8c
GIT binary patch
literal 49342
zcmeFaWmJ`2+cpZg)CGcoNSC+-M7l&8L>D5ZASEpV(!D526+}u@Kw<$364KouEe+D$
z-QBR~1$w{tx1aYN-yYxCdyM_Vzd9~vo%4+2IL^6z9?41K;ZWdUU|`@$J-DZUfpOjw
z0|Rp$egXW8QcuBS42)|SQuoB4IA|@Rv2&=Eg3AN_yg1=-tY;WT7YN_q#H=KEg!`2h
z=hihH-><q?NJ|NdDC;pU<(|KP7vpheECG*<vG46yV(-Q8i9Pxx4i6H)AdVHp0sHB;
z^wCXte#m~L_&|9`G1q=5y}RMz`ZD?UaZCF0z{*aG@RnDNFDd(F4T47my>>mCRgwHQ
zS6Pj)FyUf4*dEwK469`xWY;h}(%^pN+zdjyqpvi#zHq`yh+<l{%RH;`J?60=8LG5K
zlGBZ%-8=g%e!#cO{JN@7y!cA!Rs~-ft8!n0UBdu>Ek+yrK`9+6uVneH7}1URmgQDE
zMiaOg1{Q(4STHP0fD%#ga9(ca>m9oy%h!0|1MokV_pT-LB??lpQhW(va37XNJjXcu
z0s|&M@Uy3ntm3EsJ*=w<a2WV27+@TaPT2a^g<MJFem{#h7*F%Fu2f^5{izph9^KFw
zg(jK;-0wPm!O5YKp>Hs!F26}3-@5o=?jqJ~39WJ%6&*BR46LmyFH-p?Psl2^(tP^*
znB<z-@I1uNzM_zb(JU3m`}KK>K1dfHV-@#%6n8OWtg0?BucUfGs_5~~v9E+&XUqRV
z?lCrxH&0-ANvc4TP;5kV>?`Nl|6pL9hx<J-)Ps>?^iQ%~O_0^nw0?CuF?jDa4uw*2
z)@OSDZ@=!q+E6QDT-X16^a|Vddp4)%<0cHucZ$_#GX`5}jD?=}mrG9w2wbCk?}<?)
zCmziCdp!g{iDsWzSRy%`DqzTSzZVaGf{anLy5;er{|N~Pk$B8SSeq^WH7?knVGvi^
zIw{F2-rl^@tMdx4vcz#C23o6_tWM=?Y~7Yf{`qa5*I>3B22Gz=M_=KiU|*P?30}T?
z4o*fVhBkXn2S0}u0DojC_>|@D8+Ssiq0T-kJl*H*^SG~Q3+Cfm2Y(;j@wJ##zMQ4~
zR}^YajP6mT>DSgI&h~ndsI8lF5uR5b5_~U_ScblW1N+b9{BN9oM1k!SM<IzJ%x5ko
z1wT7godEZ|;UDnZ`L<iIIAR&$c24F$AIYAL6#nBiRk%F($j!f=;OwJEe3)jX9)ub@
z56Q!{naL1iS1$bd=rZ<;1w1oBZ#cXVA3J77M8j6W>+Fo4$cU+1=)hD;IFu7QaB7VY
ztIwZVoV&XVR=<<PK#ObbJ-7!!8~3d<bAyXr<2@ZG(uqFOFP+$r0qwj}%133_`B-;<
zb58f8>}~SSsW+rra7kJh+g_stbS36RDgrryxwzeZY{p2A@wR?c`0k5yzlRYMhUIK|
z<!K75aWKP*5N#&Hflo~AN&8k))n{TzR*2PVJ<ettM+bI`!?R=6p3gX0hpTEk(x!#{
z=TtS3{Njt=hkAZG_KosCejmp}xUFIgn^sA|htHp3SV`D99Y-DVqSSo%HLPlg&vnR$
z^DsrC`i*ou6CWeIUK2(-)sWGiZQ^L47@yrXC5fWZf%+JYq);Sb<kDcX-x%;M`LX1K
z{)8#AuQcIL6>|RAIDMO}$3sVBdupE)L14U#raYV;JA*c@bkT_>=u{j;ft{T3+H!Yf
z_wT8F$F@}jw?(B?;KEGD)kMBw2faHhB^%>%ZxrQ)c@2W7=ia+5eetGwCn;f?+oe4A
zNm0&cDQl=29pLqu*F^cw>W_05;X{^Hc)EwXYin?y^Os0o&qO)1{bbW8civv?JNL$V
zA?;m?_V!lk&ahylUALOm;7ie0(&7((PoVb7Y`j<v+&l$$pDj~)$i#0@c|u9u<dO!t
z+lb2!p8c@nOpJiWF=Aq|U?N~`K~0$TB&6RZ+GQI%i`j9!+DErP$4Ga5vi_W8sgzKl
z$o`AZd=^@RH7Thz*%}*q(xv75^T|8t%MZxTHuU`mu%Wk+mJPv{TzR$dkgrSo3+XE4
z6$&q1=cKjY(K<FZsdD<~_ZdX!w!%a1TFrMR>DKy@XWsdAGGfyztealC{SLWGAF9En
zGd``SR$!?cITQ2h@;kSgI>N*CTu!~(L=oee=Y?>h-v<cBJAVtA(MZoQdmHxDF1o80
z(UpMq8<oq=>#WHNyL(&rC-U;%$x{9ZO~9S;w;oPUjSU<%1HQgrt4?XY?U*BoP?ec%
zs_yC@mlxjZe4k19&wVXrY?DR%6An5bFC!P9!wk=x804XD$*I$lgyxD)f7bKj_54=Q
zM4I6E7SYUjKeZ%^IKD4U&&RGqmd_uVaWz)~*XFkazV?XL!yM;{-{^j~Pnff`m@{&9
zZzh^{LAmf<cfU8S>uwC*6+~A@pUD#HroEG@#<3lzvv+b$kE))(F75Rp^#;ESXV+)e
z0&+=Y6-TMTpG&88t@Ph1avIIFped1Dp7a5S?F8$YIZcC0V6wDUjqKm3@I46q3Vu6O
z6m&_R!3Na$t}{uB#U3pF^g7IZ!L{(9E<-k2#AWnzPD*#kcB-VrWZfXJw~I~FT*wU5
zEBxy}5fce})o_|Lk~%nB0=3g`PnQGZ*+NdA=)z2rZWm}KP*<cTkq&)ptB1F=evFR&
zNEnIM9Nhmjb(nc|5pJI0E`@h`U>XFc=7`FSgC$*yX?IDOc>#{#js*;Vhl6h}bg8>J
zDl{mpQQvR0o4TT^Ydn18Ju&<=z(f93>>^gU(>VkgIUd1mH@qeK62mJhm(6x77RUD*
z+ZhEZcbZAv7t+g*-%3jSBn#6`=JiwuR>m1O8|+J6@s{e$WOTgGOa^U-_+Sm|7iL)o
z_tzi)dE;%)9E$k+CT4ve&U4>Fy;@zCZ8&F32w7T(f6`WkbTuxamQVr|*R>P!Y3M@J
zYx)Q^<ODZ=JJuJ_J<mp{O6OKA74dpzYhId(w2^yhoDnI>V7O&~v^<uo@nk)C(Ep&A
z`l)CwgFI`<TAUb-kz@w2o0#>hdWBhf^phizgo8R`A1F>8dBJtyYu*tq8XIAwU|8XZ
z-nghJVdw21kMZ?Q%#zxtjH&tDaMicNb4*;yBn1%;&?QxyUa;L8x6Cb|qHGtq{p`0d
z6^q${6(xcA>)bjr^!8~*fwZ6dpD@cI0V2YSfiNjQv1@H_2yt2d<Sf_POtAX*)%tZ|
zJK<$jYfsN3PAukYF2}~Fu{fUEwYweG(AC73<#}b{)d}=%@^&ajhFHnK%dJ8iG6@DH
zm;ZSD(6h0NUk_AIKds>5w72#=bMay^6sIvKEj%&oJk}IEX2$w(_IEPnE@lY+?-g|g
zT5bFOrBt1LtP4_ie<wljUxRSjmM4AX#;dzAb+9&@Ko2geKe0~&4q~65PBjtsi}UB$
z{#neUPp987Q(Qc{_J|&HQ-j`Y`u8+88BYV;VD$dY!-#X1f9@=X$5&Vp(<6RF!A<>r
zHAGBTX>Nhf#WNGaz!U{x>;f_)npc)0Ntr|Hm5$|~p(tceH<Xuxq@LFc!^yl!;RF0^
zaz9v32Qo!rC*#R5e>RSNcKgpq;rGry^1&<Q2?ZZ5_kSS&{SnUDNBT9!0TRrg!>gV<
z{rQLr$~F2?0gnlsXbHtyU2=NkaLzV8(dRUwNHg+CkxeG{`@c`zD-Rvr<dYK(asyW_
z7i;g|xdCJeAUDXSnKo?4seO4J2LFA8?rLYbf$3M+1rI9BO+TvBBpDpX18A{2ummk^
z#tD=26E~<Uq4WyM?|xhZ^ZsIH$Z`L!=MMs`S@OrH*)#ax_u;3LlPkR<SKEVAD<$w6
z`_DMyXXEI+dkw?%)8Y9iPn-g~&5g92lGd}io2p}qlz(y--7w(}XZexPq>LYdSnG@5
z76PT#(D_)-gD_O4%pv!SPUg?9;a)l2wF`<jZoqNr+@lE3|1q5;C~fi^?PMN%{xVf3
zGEU<2pHaxpQa9ZA2M-8-!2gww%899qg6LkxbDOafr`BNe-aqNo#j~YIv{b{vhF$o(
zVW+$N<nM<4wXnZe@~;p3>-7IdNdkBGzflsvNPp9czj@f-#PtkZ|C{LpAoy=-^tYD$
zTTA{ez5xaE7p;JZw!iSs|1a?{`)(GkKU#plN$lSw_HPpVH;Mg=@Bbx4{t_a88Kl3I
z+h30IG#a}9e?{tc|LXfK0Zn;xUx<J#=*MepqRQMJtxMl%h(?cM>cq&?STUDJtSe6m
z->I)(_+a1ZMwMD$YNsM;n|`Tdy^LOFZ8hZ?#{Xrh-&p}GaBF0`3wiI*iNVjqPb*ZV
zdrbzr?_813g|(Sc3|q=p1wXz>BxX2u^~+R(nF<?)lLSyOXl*U>E*mQctEF5K%QsTK
zkY-fCb;}OL&KpxI-%M5!D75~dU@32)@^EjXYP`l*I#bo{Xsc>>ZK7(ukzLz3(se$C
z*pHV%Ya*{U$l*J^yLrc|mkC9h-$RdnX}lLJie|-HwcV4MiP;O9n(0p46!xXb&5L$K
z&{!D%9!nOCC3@_z+t=z!67tkIDPz#OF__Dfltq<*KY)^t&5v5}HcRQ|uhPl>-pm}&
z%nLvMV{uH6oRct@T)vz2H1>uIkl3M)m=}~<wI<TsYJ6hkux4-LxfH~YH6(WSm3F#s
zi}32gv|p~(=#Evs(cKxc$2UnYMZJ%Cr)3yvg;WK~yQ;7EeJk?@%qjB*t)-iE&da3g
zT$NDjuQnMBzWa>J25f3Ly~lqnwG&#Zw%X}ZkC^3PcF?xYR`KGgAiuRNf4h*glZ1`f
zEgm^CS9RIys*)604=P|TXrf2177uTwtuAJ_dezZ5vn*y*UDnNRzRj%97V1+ct(~fq
zGBv?#ZbIdg@Dy5!#pz0}CZ4XOD{n#HRF>LTp!hg=>$_pPRZsc&y+@3gwh>+;8XcDU
zPv#f3jK!Rz!#O-#`DY?Cro&CVfZnc{=NzY}eZNt{YJhzSLc?L~&Dd0^_GKbQIoySm
zY`MA22qAZ6j&3ps{{afg@uU!pBD2=w#g4aie&j^c%@HaNoQ@C8bZuR_f)4Trtxfif
z27-O#MV%B4d&*l*&1zpI5<Y*!-8?CKp_A4o6!GIo9k0BWqC(xG)XrglE}<$|MT<N{
z%^=KSv3j;Ww(+r<rA0blWKRJl3%!COfmr?$U03tB<vrqGUwkmJX5$90zxXpq0*7Z(
zc5z35im<bPadFodyAF7a`ut+NQBm~z*fDE<|5I20+n%KCT2wTyyJMD1xjnTuuk;O9
z8<^8I0!$^GP0s7Fx};mFPdpIn0w;7evFlbqpOcjPK|Yl%tEgGAb^E5|$`d4qU7nUG
zv=;NDhPEspSR1PyipXw=o!{ytMBRwB97$Q>xeDD``w<uWg5{!xN+hM(RTNMqau|0e
zTH8|gsxy<BBsu@HgWtqbm93h(rLhLfr(PKUvl=e2nyvjc=<F6$yh3D8H!UJ@!L{B8
z?CnF7J>Fq>3&*f^BkS1qfCav~Y36-0K64FKRG)q$p}DFBFpqCb|CmPzR_@apPIY!{
z%af4Uq|?hDemsl*1&?p(Hu{+yRa%>>PW+TN7^CQ0i~0Aw13Gr#W|C8;dhQ^0o48wX
z2Q1269D0g}iEk7xeh5sjPaC~R<8Y0lVx6P#aAC^wU?mlZa%4(t&HNE-Poy!16k?Q<
z?-(r5L*9xf_b_Lv;eH2gsk0GG(U7#m@AQazZ?z{goo=6E&S0P;n3%d9Yk4hs1*wLm
zxDdWWs3wYh-LhaN+D&B8wnKIdXi9Me7c(S!O|zRD9-BWpT_HGz-xuJ&U*V86;<G^U
zXM>XYK9j*3WgjhBI>`7UzD~I|y#o9A9qeNZ{CFe!glf7ej0kcwbb_w*eJWax^d&$D
zs{4jm86JJKXxRAw?uaBGca9HM0^PKn=Dy`!jefaa|KbWz^(IkGUD)czseRh;U*41H
zkzsQ<aa#HDz9qPr^lt8RQjF-U9?_PS*uq5n;L=hC2+SvPxa@Cc)H6hEnhwgH8*-TN
z7hflIO-?U!N|>%H(_(O49;xirll;eywJ0h&`)YV5AZN&y_i)n~2h&y>EsNG%G>>m#
zt8G?bUpmm9@Y89&emE;Biqk5*Lxr@w9HPuYQKpo)MqwZ9_qmY<({>?S%w_BiX=S@4
zEj76RJ;8*1Ew(aBF?kWmq)5vJGJU^JIs3S)Uj&y6Cd9H+^ZIW!MF|U1v|LR@&-S@#
z9vml_8H!HqBNo3Arqp{0INzj)yktHyA;*aAY(m0^N3!Ul!5xu$nS*0*!a-B&#Ow|n
zq_EC?ywX}tLYjEahcViA%+Z|=2LmG_i{Cq&zjYiwb8WahY#8lwo62!A2+|qfdedbF
zOZHrBOC&YOx*edLt#a&EO(=Pfdp9W|YQ8=|$BbpE-|m-GSmwc(^pNO0O;HZ!2n5nn
z&2#F&xhuP;pfQ~c;lR+A4z7pmk)p8@MMY_WN@BKlLT~zx1-or0DRLDA3zF6Y%@T*T
z_u1}(;w8J|zEz&*FI84tq#aC}i|Ns4<9BudGRy!szPWX$Do6ifseZc9W$evl^PZ<B
zsTspg3pEq4{;)(ln>n8HtHFJ|_RE9flB_u-md~`JfUJ3pS$pr{Zu-f7`Zc5s3X)J;
zsbo^&Wj5SOeyu3SPhWOJyS3nXabUJ9xHGPIM%~Xn6AY6s^R8!9pWHI7TLijgT6>oK
z7Q1HNo@&>=b^>|PBU`G4cg$&TwOeaL4lfI>{t&l%D3mIAaZ>eL)n!2zD(A(_R{>t{
z3mD|1s1BkX#(mCh=-2F87Um6$ry?zD$AOTU;-{$krFx0=h5{*EO7ns-jO6Y}2DwNw
zdmG;`k)r+2?!+$zl+MO|Tpl6ZPxglP)~%g6#EcNSmt+fLPL9y_Iu|?nP5X<L&xZ&&
z`zR!3Up$c!M=vc=r)ZS)?}&y9dQN$3JF3=bAFqcNa7*L%-(vH~{q>N!hL$V8_nB`-
zzj3mi*<BSv!yx_~PbMx@gNW9IT>b0JC8AlCA-OOv`j=bD+Wz<ppU@Qv(XRW~BpiA)
z?fvl&Se*PpR}DqV{dCZ2^BNpro|!!-g8q1sE><x?4v*WQiR?}S>JCB`MIgG_CLz(%
z(Tv;Bbl4mbT`7q>1adXL@W^L_4VRyXDf&r;Eqst>BfrB&SHAFNNMo;;i%3;QiSsdi
zI&*pnSINoIN?>j7OBbNnZ)XWUF*IC*l()36Fq-N_71EYk_RN6B_A@s^5XiTu$${p0
z<%YSi@>evW5S8LsQ2GAWF{_hy?sms|N8W;xhAd5jI<$d1#;Z_(*l|5i-cID<+Qn+O
zJxX1XRp=q$JiEb@m@QlyVMm+1ebkC3WWi5*uPNgOZpl|V=JLJo#`bB80q<!a)VOQu
z`SVtq7cY@0YdKCWtJLY>gV^zA`HyEkN*T}(QDgXdP@s{VR%EO$Q7~&9H+id0Fw%Ls
z5E9dK3ULZRIfHny?bJe;TG$et2FzcSMXt8BX-fH{LT&Sk?NYaGOMXvO=73XV%>$%m
z9ua>lLbMg+79z714tpBBNXy|*WuOh<LV(xob6Ebwr?8((exqaE_=tj8>b|n*Z4r>s
znAtW{rBZ@*3;JI;b?8RQL61ubW(|iF4A~vstrpq|I{VT`N>fEIJu-B5H0-EJayhXv
zgq@7xyTQx%nk_0(17@W5Qw^MWN?Ok@GzKJt1>I^XKiVEp;djX@%<+^W5v%Y3euYD`
zi1)QS?@$B&@p{y)(5vs)X_!^srGrCs!*@Gc(7u=&M`o5av9+Lm;*>-zSD!l+bj}fx
zuWpm4=uxy%cHkwrQes08xCr+)pE2h3)K5q!>rB0naJ7EVaRc9|gRCMe;*Q`~I&Di*
zPR|W|-^KtNf{r`dCB}ZEhn$3aWn>lK%ySjcxjRXDnn^nQaW;G)?LbjHc7X0mN6PhB
zCpsOed?+j3jXv3nZV>WijB>axbhuj8*_UmASBx!gEH=N`L)##OUYbJ7k|vy4fT$3A
z`Qf^5pz!wFI-X7|kUC3`%_pY^7~;ClD@K1uypC#3B9>`oWaE$NDUgnrwV#2d%%a-A
z-d}rx!C$=9t#0A}gg!4*ukJFz@>b6d$O%9*2R^PJd-QjQ73UF3*-?MK;eyVF`0;+H
zcyp4;2S}qnprV(QpRD)<DabSTh6=*4UrvV^BDs5h1&qF29-^rD#aAvJK@Aq18D-l&
zoY0RF#{NF`%2p3#3JHX-piDuq`4-oAQmhc$;;9gIuZaLbHku`+n)~R~0YVwH%da16
z7M*=cgJE6GUrtZEG0czBG()@>G+)H((jjX>_Z{`{W;|bwH-UbS=*eE|HCnph^wiSr
z{xOis`(DT*!&}eS06Sytuv&3(g1>6Oyx7d)aIJ2_TzhZlL1?5Di(tj`p4W@dOe(*D
zEJx!{mh<DCx!anr_Ur6c5kU=*b_HX+msj{{F&gbS9p;b{K=xxjhKHYBl`Yv2hHoEv
z*EQ6#nA@73vCpyCa;%churDA7QLyEwLoVs3wilJxqvc!^OZXJ8#Wd8SxDY7-x;U1l
z*-LpAOEy|wwQ!mXYv*g0?0Kh7i7IzfoIEHr4)7vN6KkHX4~YBOw8-u<Cmm$JP=tMP
zuip~imok7!Qety^NgRr>Jp;4h{7=tJ2=9M2p%tf|;_-md)cj!qei6uGXk^gByJ`$o
zUB6Q89EuG?9vL#0+c^t(oEZ>p`ujj9*VR|Fem{V#2!7EZvN!p0Y=ZX0L5TehxA98(
z$?+<<Yj>h%nD1x2oK*9>Fvs4b7br{;=s<wjy`;T+7qsLEj;pS($c5&7+@{_Aaj|l(
zj+VBL*yd@=!%YVxkb?95Nx?I|4t)0?^}pSJ^SDx$Mka*MoqONThTQyEd4kuMuY5tJ
zjA7<N;|@h1)63m4Z*M3=9ff->dKmp;JK>pFeCyS1W22vdx*fIIzAVy0v&n$}^XGIC
zD0Iflv(cHUl46sAk)MSetxcItZuD%<Nz;@BjSveP{fe{f)%AV@W{n!PGh&X+ItF)Z
z{Kv~AKOH8mjlu^SS;d;FK7@m8@t{A9CrxTWVhhRD13D27juT5;bC;YbHMu1hYT<dx
zhK&a)LO(lf{8_)RLtdJ1Lym!&6;rw>6-v8ZOSgl)CGmGyE+^3@WecuAnRwYmuW<q}
zVhh+M)Lw;Lfbo0U<H^87?I_Q(z3B*VtBKm0;GpZOC=83dJ_D<nkDn{~Mqb(sGO?&U
zMyR^>hBEp$ew@~4?8XOYbSLWNrW)>?X+i|6Bd$LZ)Etg~sy27xp$7I!gO*5g`v>u5
zlT4c+C_44Jog8_)Xs1L-4{ao9y>g}1wiN*h2<EGzoA|a0p9Vj;K6UL!O?{mU90t8C
zMGK33z@tJPh_8%I`)28);h(~X8>gUra{KG0aT$ppAIy`X8m8lg&*LpvV)j;wLSARt
z32!Al<YK`Pl+dRYFTWFXKiNzWtr?Q0J?O3bI>sD&wIa*ep@vw+Z{||t$huW8l>Unl
zBqb6G4KC~Qt0>~)^ULp=XdgV?on#aZvo4hmOeL0?^KlY#2U&!l$5<pGs1Zq1%-QT(
zS7d6ZtIUK4)KIwj&JVQmePTYE`{0?U|EYd7yH5{^;j-hMDbeG#K!>st?-{$(3vw{g
z!q7MdSN&zCgv>zV+1VsHyW%1GXF;>=f|^pFf^#%j2T6u?NmUK0HWi*$-(E2YBKS_L
z@2^%^yqut%s6$SfKICUqMO|*Bm(N_uC5&Xv6UtQ-!8wZBDPeS#61mJeBh>Kt3TQpF
zf6slHRRe%CZ+U57^%SI9-H0;Aj#2j;H72ezExiFM<bZf6Z7O`RA8W6M=ru+kfu6x?
zz2U5EK6!8fcMmV~KfHTeC#7iqy8%frRLhwejA6%-0FUWQcvu8uNtI@;e6B!@Y5TR3
z#}ol-EV7Eb<7EfSmsB*Y?hCa(3UDKs;46-Uhh%$B@%9O`6uU$1Y%i`glD|p<ZA-)-
zhAxR7&B;$ZzLMpv*1{XIP_&TdTe~H&kfLZlb!odBCw_FbzR1yEkeuKGN*uVwsn}d=
zWXPdsQ>7ALXwgi5#)ay(FbsjYrWbJ}|5#Beho^97-#U{h|AAJ(hxgt=%fOLZdARL0
zYI}jMxN5}2e9>u?w@c;T=)VR69$7`YN#(Di-bc3{=OEnW8s_dcrl<Rj^7d$OFM{Q)
zVOl+N{dsO?67F5RQdZ1`a466R9dL>hlFBMijlPj-cj2QuaN;9boJR&s21^+$-bTSy
z+s(T0eHU_&&=DWYy>uA5fN85>PM!0oWCb>y+TAyDyq*6_2(|*M1so`mxIjapIW>P;
z86<0{PiIL2Yv=Uj^jsRE%R^+@p7b+xi3pr-ba*UXoLKM#*?Ld9>lQN+(vsxkqOog7
z#PC&n_D1^JTp?VEfDgN%#tN75eOhtjQq1TNP?3FR8=|-iHj>lx;-!X$BA$EG{<7!L
zpVXiJR{=*>A)A;D6^<E;S&d#@%Id6ahrOA46A5b|6op#Oe(|ooNFIN-gGt>%RxSh?
zaq50Lemb=F{^*;mL*=N%Sw#D~$!o$Cm$z>&f<8~5DIwiHIu=PO4cqqnx=^KpUr-Ec
z;8=c^8S0(!UpVokHe1%XAl>|cskevFxu3s2%w;p(bWPqd*YXsVVNJp0v}JIY6X2#u
zdh;)vEl9G<6GBXeo22>FWxFh>kKi=2=4+^eUdUY#F36g7``)%EH$s*>lx(L*6%AvV
zBSDZMdS^7BXm^GzkL=&P8m-otPKeA9+LZNchw8}Vpc8Eng4S3vfLFZ#u8O##8wE27
zIRy6+_h7l$g2!8Q)dT-^U$$YLIcTtFD~S+iCX;>n@8Wg9Rd#+_VdrrB)5Cj9@R*O*
zMQtFvW+s(&+hj9=?MUc4D*w>}D56;nXJ|o-a646q{47*@J-%TbH<<W17UxneG;d9Z
zFSEVy(;MeUIQTZ=d*uz5p>pE*q3oob!$Hc5^pf?51;_gfuU-y<K$F+0AbnrrNg3+o
zXs7OCRz2sXA+n09RL@AJk})sJ+ED#NP%tB+ST$zoXDAH?Nvg?2j&~;}<i?J6Mnp|B
zYe?qXay%d7t3H-Uw^DiSZR7{=DzXaXHz`#dfFj{MK=8Exvl2bnjt!a>-+_c%HBH^T
zkp5VPPVkNBMp)}>A0kE+J<TaBsp2a!QA>DcAfvTIIzB|eh#BN~>sOz;F8hs=a~o7M
zp1fmXu4uGarga$g;BeZU&DicY!T<4Tf@pHV!m&}^lL~vSPV|`bnBio}!tLPND8BIK
zqxW|$7E<#suM=|iZE+0dR$QQbt)!yKOVM0@yp>+1X+J~^wXoi}q-y)f5$;7+Y5ls|
zs*ak}yKt?RvI=BBSMi?db}s|Vd!doE4;&0Je(lz&gE>+}@uy}r++z4~YIw3NSmL%f
zfZ<)I$n^Nf@Sv1udo>)Ct&HPxV^EVZmGw`$%rRmW4MLiis}-tx7FqQSRjBRL8mbO0
z8&Y+;2ctbI^}mWNcY5i8lS%ati55ic9&WS-dZisQxPA*(z9pHYW5KC3b@LqvoB~v~
zZQ|!8lhOv7`9`ShaeT!OV`-0W(lEC>8J+J~Nc<KP#ce1zrkfy#rkIp(HvxV7R`wT3
zVc%~&>N)BTkInV2smK4NKa4*a`g&u!nYrZCy6d%-j~WDIKJLK>Jqx#t03_%*^+<mZ
z*hpvJP^#a{{Z-15UF6}g6_lv3yRP|Kx!2LUy==P>T(l{J9vX7`RYVS(FB<7@&wdWl
zXg-M%+1AQmM+-r@r%P#dJGK!D85>%0wRe~i93hWB793>j(PEEWgoOnD^l86lP!pnV
z&To0aDt+c5?=T`z=n6>vOYa;4B!lX?<R(-qmK{#9*P&aKw6jo(@iI(8sf(~^Q8(AI
z<BoXQWcrm#%#KV#SdK+o(#Ko_SZH$(PEVF&+sJK9TV->Xe|&2(C&&+cO~#{74rhKa
z5GS#>f{;?6cpBc{%M&XYk{U|O!)+yg{Mx~nMq2XW4&>%m=bEx@=1XIsgViZnMeTt{
zDBK0K13pyPK6^}GC;qeWhmr=@4roRv253R~YbZ_0EKmo&BKfmGAJux!^F5pOdPe-K
ziQI-QelwR1@%yE3JHp$m(_=YWtiL-Se=;Q>V8diCDxUwI>^ZoSZP1)`DcSdDisjPv
z=ivf3+*=x0!~Yi(L#^=8wXz4HD<jN{jD$Sp<~92qG6C>g8%;O4kd$7u5?eGQ-yFJT
zb|oWD&`&3Vg6>u^40s0=6CQ0CbRwz>AtMDNAQc#ka$fc+7XS7lb^J<|n%@X0r|y`7
z)Nf6r`8x`c(8A9Cd9EYD`x0BhwL{=I-+C1<7RlNfz3K1VQ=F<P$iwbTbsn&NCwZ}F
zd~r63(Y<9er9Zdxk1JTN1v#c%tdC5qb<QAYNWX&jY){{Gn@M;tjNuKZ#*WLAokJt#
zkB?J{PUpE`OebOj&9l4r#d!O=jS=h;2B(`gpeT0j^9>fE#D@e>F@eb0=?^25zT_<U
z&ytNvt@+l1jRxd6)(M#E?Fy$td?kFb*#yZZ#a%u!$STM(HsuYW2Cg-YZ0F_U&BYRb
zH_pQHpN}dR`)O;0foU6RKsXle#T<K?0c<nV-A4I=G!34k_Tn?Jqv%C~;T}J7-n4Ld
zBWkC5qJO(rFA!8Chho(3ew?VqUd#6Tq&5DxQdNd_9uI9Ki~q`a3_{6eM8V@<*TZn&
zszq+h5AtUeU+fj~dNvY#ycl0k<d$n-5LQ^S*#$?Uo;6<fIxQnKwE5Z9TF8lCsiLIv
zizk^H@I?<T3qYJ5cdXu%=C*j~W!D<b#aEjr{o~y-3G36VlcXZ+b6yM@$_2MQ==pKw
zfq5#PVqK?68zG_qmwbNl%O;OgNbC*slC|2^_CQyj%g}=zr}b=iFMv`E2k?l0naBFy
z#*r6VyT|hiieHZmLkZbkD8<EW%9Vm|A}y8T!V;LEGocAH-qVFSYYf3SP0n`+Y=P8?
zGC=fr_XR;?)q(5b1Z^F|`WEDBkJWK^R$k5suD$h1QcSok^jJ-cS->Klpi|f_eO-r2
z8&vpdM)<zW2RzTUZ(Z*%g3Em7pmS}VxP=shYDX28cgOQ@2sKWeNZYet&T|SP?~2qr
z05YTI-gBZ_U-q&)mY=HWys56V2=5H;)(a=q*9f(wUEkRLpggp(!$n%V4hn(gaL5fE
z6kZgPe2CUG-^y8WWAGbYaXUG%lI(}*u8bzG#!rnU5-Skw4zW&|?)y!KA|Gwp<X@Sb
z=T?w&+}KGFJu<ojI55w_pX;NA=>UZp15Xa%LlF0FZ=DE9+0l|k-4`cL3-T7bR&55<
z{yx3VeS2AM&!bzOKk3>)d-IB0Kk7&#%^@Bj-+h1-W8Zo?gSPhqi90*ku#>m=&aM-b
zBV?C_H``PV(=%%+##~mMwcl&@0e0}IaP1m0CUi%=Z!qFHEL30I4ZI^FjJb3Wjg3&H
ziR1v45{LO<!7BU7I(vP~NU%-LGRQ$KH=6mp^UIHx#!6RQEcQX`?ki=Ep}39Ri9m0D
zo9Wk3l#c{x!5W>LwN!<G>*4Ndvi1>pbAvJ_#|+ow>W(_$o%NXTFm6LHwQK|8IXPOW
z=U0=ct?a~Tz>Zps78TQy=GLw_s|FJ2*q-O!t6-Pr0Qd(`M%@UrJZ!!}%X5JAl$M9_
z5<IXfCzd@2n!ow?K}Yy~_=}Mf8M2B?q-?kfaqp~d3fd`Zen=78HAUNX`xthmWmMuM
z#ar{GfeAA(%wPjhYuT#j?lDNDgU2Oi3|gb8Cq1m~G?UiTm}#fC#4(2UR2jd5UTG)!
zQ^V;wfJg9M2V<LrKWxn^yx)TF3UHqb^o8T^n7#1bcB`xm0i<=bAP?)h^1!Z~xE>2p
z0O#EY%e#+#HnR_LizLA#rU0>Otj7syf@_(i=6YUzppj10h7(U|@NBVsE7ihZutc9U
z<M7(`8F(X6P(FZec0Wx3q>8=I$>f=AP`-gy|0W-%ZO_Pp{5Ajzu>hKER_tofC%X(n
zY1_QZz*VP^p&tOZ)>U=go0@3R=2ujmU&MErmC!v{%Ex~uRv%<aR#B=gkIa$1R&%7x
zqvtpJb#nG1Cj2U0jLQi(cs5AtgGebNhFFG=yP-;IGIj>C>)162tGYZF^=#PuS&H+q
z`Ll0kHlWxTf(YbG>?H)PFJ_=-{YU2^6Ux&h=H$KzYq;{@%ghR}xy+UjJd#tY>-k5J
z<TtWiJ)#tcM!$-Sw0vy637&3wM*wU<7e@MJ;D^Z5icJB#FnjRu$Qy5JVJF+qr-7Ku
z9xX_Zb5TyR2TBE=ep$=7)5CS$0bXze%)2Ac2HPX%AV5sh2|NWQm=u)Z;T<$XiiseD
z-Xu`E0`vuB6-sIE#sDTdXNR-S!M~@t8GhUB>1QtehwaO{Ac<MS|C7VmB6dMR$h_sM
z@a@9qMt01-sLV#T;$7L8>7TjKo#RcY+9Y^Hm?+)a+4p_w%i}6|r(Jn&RqqW5!Pez_
z*KP~e$m+L!1i)UZnc7W=|Em1Me?e77(68S&K<U!8cGJq-CU&nYZ)!5|5ZB7xCqLe(
zAyqncRYF&s?#2k5$rt98L&8`<yd7X52T2o2*Ko;aFi2|Be?Q1S5(R<J7y`@*@Utqb
zjS{Pi;1pk1$^PE-EZCiX=yo%FnsiKAX(X}$a>7afa>5^V<`pEI{EMIbvPH>b48^P6
zJ>}zp@j%LgQ$F7ByvGyRX-WI9f{Zqt?xEmmI&fN#Rl&Qt&1|Is0x!Nwk<S}Yt;h;;
z5zU+zkAYhxt-O_-qQL5YFI#Oa{HCxM?_DSl`k$x!45qGxZKX!9Gk2WZ@FK1t=MdD~
zY381vb3LUv?2_m}-EzxFpqLSCa`|ozdu5+tG&NiCBG--#JtngTCFaK)Ui2Uk`$(Jx
z;!Q6x-n034rQFI^r9Umnm6h&lC}V@rn#xrP-!9-n>TN^h)<7aIJo!47vaLxoob7;T
z90Z>Wz=p<|a_`q~sfaS~q^rzBP=FRcfxR2y8H*8G^fM3I<);vCRH!0EkYRh`G^(_D
z6i8h`qrxZNq-Aj@-HK85u9xjSP#mWNz=H$SpByILEJT~H8$U5A;?!}0%7nx1_^|Tm
zw-TYf;b?)l2qbK1mCMyb+Gq1W`o@;UYW(_%c*_TXA#2vW<CavzdO5-*`Ka;VM#wZl
zVzUS!ZmJLK)jmYAR(YTr#&=p8c3#1QYRrO-7D4aLLQt|*0`<$lIAxl4nS8M-lA@zu
zfUs2ui^*;w%x*|yK5As6e@k%@s1=OQBoSW21c_emD#8hV5dy^&OIs5xOm+jT@+Qbt
zpr<L8{bIPpnkwD;;aN-+kr?CDd*eMkE>Cs5BqDhs&PYJ}zPipo7x%Gpvi{@6vJk%5
zr`jKpjvX>up~-els3ei2&5kkmbC=-|xbxESSDe&XPKVs3Sfu|gndw?e3tSL%^m>hx
zQ!AlLYjT26zpfL8c+)aiXrniLrOI&ztx{hS-kWv%X@xDf0kN54E$afRfhhqhrM+cu
z_dUOcmYIPF#?BWg{hij(vdwSe+O4)da#ejMse1Y~R>#L5yq&1QBR0B#AyXQXP+Bz%
zcm`9L&r`j3+v&7gGfTmGY<nG4YlIYgc4v3($v}jFAfCniB9DfC=cgSyJ5-U~!cLIl
ze4ct9fPILvbJ&K`5KGAr?33BOPRZd}^Il;5E#g9$)-wm;{n^-a@%jrV*`C`#tl(En
zJwRT%H!foWGh|p5zevralURSJN88PX=^XFDuFY@>v$tB0V5?Y9?7s5TiYK&c7OpWY
zS9UDVfA{NZ`9a+R57`cj2a*=<n6X6@>y?~?skeTN(<`6|qOJlj24%gweV|%60_A;n
zxqy8AjB$!`@nync?Lh$Ldi$dK!Wqhyl*VU=66o&io9m4)!3S7qs(N`~q(c5sRt>xs
zzO2lBG&~IIGAq`c!>@!TfEB38>UiYWb6D5IJt0+A)_i-Qdg!g-Qcg$AP=KRNKDs?(
z1k-swDFGRRM#1vAT{bcw`0Z&D?`hU?jezNn3qdgE#Ikl@yCYO~ziiS*39JB;<D8%k
zDVxTfj007anaIInHe}Hk@#`I|am7SJLB=cm^A41A_JYdpYoR?rel9l!H6L^;%GYTA
zw9ai|E{@nJPR!Q)@*$!Ls*1d9TKE~aWnFL~Es(j_C#%3GF*q011l#YSWU3z^Gjdv+
zCQMlc$tzM*I6YI7(jA0=dCNZOrXf**;J_7wr5Eb70A>p)J*%U>&ka4TGRRgi^j2L_
zFjR@Hx}F^eZI^Ef+=T~Njxx7f86I+Vfd?R&`3nyY<{_{qB^T`3OCU^OX(4^Km$Wf$
zzHPOIl0-hQ{d|b#a}p%4sS49f^|C3`TnHFDl+)*YQR6_I&B~pg9rz1>r#-Vo9L@gl
zc}oyZ=iy~z&b=D}O;=5)x|d(TIRmCX!{-oQnUU<w#mUf<Rl6&TZ#}xvy;E`RW%<e+
zOw(-K1`P#*#EGfJ&H`YSMa`}lB@jSQCE6Z<jkF~H);k{oPWkyeLZQzg!FF>7ct+~N
z(1Hv9EEs*{DatLBlpRV{d>^gpf85aYVO=Dyg)N(FliEk@;Sfri2C-}RETsF}fL)x6
z9jr}?zx$~xwf|^$pn7i9Pz2wb0W@KxD5;VSPqk$+!}^`4myGvL9!pXa$ID04;B}SI
zMFf_k2|<<a#!r#<Y`1|w<HJahBu!F3VPtfIU7<iTv*6nr_hIN=ER?F@OOZ7ndE7|^
zr;=4#hBC+0^S*;&rit#WiGA$U>&2bm&8e0w^ZauKL$AiOh9>uHeDrbsMu!&?(g?u~
zjfhP9?TL3AZ(dS4b$FE&1QLcopT!-kb?82PqXhwl;VOvaV6#u(`fA^B@Lr&pl)0L0
z2_DyJmR}8lr^Q_|<@x!*<!fAGEl=|w74mEP+<;m^aXAT=M)4IR`w0h&4sKfvzaxxv
zBU5LT*am{QOF$WC$`e$~>$$P<oFyxk>PBeO4GTjtw<%_A?2|3+6W-ZG{}ePp*Ou<F
zZDf>a9qJe?8MNV)J{VNGnwZL9wQYHC&ncPCk5J<|vDvm%l6nOB!q@K*39@jr{ku6N
zF~j*SF$*6)MPQ_95?P{GV_VXY(RN2K#n753`?q<qq(?+Kz#1Z)qQ5mX{yK`dRrhJa
zc<(+!)dsm5A7M@b6=#+Jcc|O2&Q6Z-t}p_`pMAl_Dk(Sq0hIu`pOoKH1w8>EQrt%v
z8JL_aX69e`5p&2$k^`BsyxoSQ$=5%s9FE27CiEa*Qo`@5;_Ys5k-059agdflN;!Ru
z-^|SnQhdKdyhnQM6F26iopr9DyyLHhO{%2<r07p-{sd>Zi=wPWGjtfq_}@>GvXk2l
z64Vriy*vBRvl~v2LC6{~162W8#gK7)kDW>J9+1>&5{oW@M6MmK1+*>CmOA{-i=!@B
z7H2zcr00+SdRJsO*hJOR(h+<@Yxx6nZ49+;zd&9AwknJ+qGremX^AqoKn-W)nB*(c
zS-=eOqd!hyz3#F!Bnq@eLaQ_AI9nYWr?Wdd0(gz3<;=11hT%x=(t0^dztQW-FS6yq
zjrh0*lIO2!%4+(-=0)@->U^Pc8~K6_^fj-9vR6FTj}RvqJ<msrsZ<Y2OFA+TE+4$G
za*2e?)9s5|vzl_2O5Vq`XsvIYv&$o`Ve{dha(RGWlD-u6RW@nBoL>i4E|=0#^vIB1
z_dfc_E5l)J+}wh<|HKUoy`23LP3^C<cXy$=XZed|>I_D-+wq=6OF^?J3tRd1r4|C3
z<qDfrLqhq;J65COrm30J+9tyCD%sq8+~!kydn1R_d{wOZgItyd8JnVjFrTQ~1aQLY
z?&Dk((o#grM=~ICxBTRw+#}CABxUlJVE6{oE=sC4YYXu@l2GW-C6(AI$lfam=ZV_K
z!@VDlvU%WTw1N$fmBN{*3_u#=VW(?4|7(}5g7JMLKn1WHc(NO42^ejNHq6D#HfKXL
zk1R)p9&Dy$x8T%K*~rXJWeOh|zzikDr$#1T&jAgW@a%4!c@8?uY)C*hOr2N{%2t#J
zZPKS>T0of)9P*ul5!yG+u3Ot9kWXiA{_dwUZ+g`5$S|GK4fUm^+oV=edg)-~M}Ure
z{Wrhdt;4ZTHfj_=@hHtH&B8Q60~l*p{`V*JKY<8j`_%}f$8h6(Pmb*C`IasuEa-ek
z!@z6s<wmnvc^N>^E-yCZ=h0NhBHk<H7r{evzW;)U><zC4*uQq%n0~{W*Lyvxao8As
ziFA+WUc1TWY`Zwl*w@gep=G|d@S&u>guBn}x0n(lugI>9oE-10X*Hv^rUN;PKz&%X
z)uT;ouP5zXm^D;WbyUe~aXmMRZg{^@k(}K*(AZzrm5Hgm_mh0*^O+Abw2R?2Op+Zx
zd!~$CI2IvI7tj`vPHG&!WJxV1Lq6+S&RrypPMw*}rz!8;ztj=5-dfkm#OIGn87vQ1
zWzB=Y`0URJPCR*cfq_tg)9Y52Gs@Kesc0!gLJ2~tKgjw^QrkT_B!4AvuywI{Cc5-K
zdT5Dy5xgFGl)eJF{rJ3N%O#6B-}@=VGMViiTMx<Y4R-U8BSnJ3&ZR?jYFRyA2fGe}
z8(+I@gHG~&>1!l^b);TJ%wPlm$`|)1S58d7#l|GE4c-TQaqS)EEyHKicw+#Gfc<BA
zC%+KP&XTR&o0C_++<xd1c5?4sPAlby)TNE-w>iWgZ(Cf?U)K8R*7Wjdt0%C$tJPJi
z(>No~S9TvfTxqvpC6j9SDZho)QNy~P{#<!tLqrbX1KQquqaQjOeRL~xZyIWWx75zp
z!nJ_J64_MV1rI?)XKnQOF5+ZbpOBC^HB&>fQDZspIY9z&bFqL(Rk2nU-8>+9>(om%
z0S#VfA7jl_eE{7Dc{@Wpe!FeVAUr!%zI{gdcK=R!8K377t6BJ4Q0s6zuRR8}j*y<y
zZ4dWZ<tC;+mm&cBc<%sMhBLL1y<CWd#k#&70pxCyhdTft-zac?!nT*XTz<SzUh8%O
zsAg=S7}KOO1fo=Ih_gN1zfY=pHLY+ue0K%V7`!jXiK5ANr`fgLfUbBv^4aYMJHYLD
zLn7H@=Lvtl%MiqnmEI^B1k5_kL%#`k43drfR9n<fd$MvdwOD?jrng8>ssC-g!(@;o
zQtt_kb@-8b(`5Iyql5zPx-#JBNHvG=x$G2=2xpwTTWf9z^L1U1e(<9C%TSsc=N$Kh
z;EB^h+DP|=@1$M(Bb1lh_DVOu`a~1uudh>wlHDMB9)g6<|1*$|;O!8k2ibmpXsDmF
zk_5>e(Fub-xo+5J)VGS!b2iwzU0&x;^zj2t7M1P%9E+pyLs80vi0yKaP)snq0iuk=
z4>fz0q-6vU#{S5#HJsQD)nKeWzj*F~*&zU>CQ&K+SC)3n{6?RK)D6c0cH4LGk2?Qe
zejj}u;wR@dYqR2|ytP;vYaj8*rT$NDjeS$rOCYG9i_ch`J_IZhWjWgkiK1#6+J2ZH
z(g0@?kVx$Ho22_|lPcb!RO~;TS1Es|4avL6*a}8HcURmF^4%^StdzTDrKjih8;=1(
zYVF!+R;*%6H=7O1YuwNCM`Fc@0(4(^*jGL9N~^8N%jC>3z8l`$o*Ofb(q(<U&tNmO
z9N)n+n}IPu1KeJOTDaQVFe2`7dqGRbPcbP*cP`P8gi;%}GkKTrvm;j@?1AU<4vxEx
zZlCrU7>Q_kyPrP=A<QqC$l-1gf`_tGA76D$9T3^umS)X;LMDhZRRweeGbR@#@I+?F
zJVYPuOZ4Ci%*O2cRHG=_fUcCUB`KS^Q1heA*P}9j!bn(oxp=N;W=Pl{eSm6v>LS@L
zpm0b<_Uh%8u|~U8wDADyviO6)1XAe@j<Fa{K77o8M1{rDRpYYgF*IfpWMvm^%})bH
zUo$@}>6V^cl#t_S$!L*1%$FZjP=S{hKg~`BjQWK}_OQ&{#oxi`GjG8+khG-Fe?k8d
zU~)N2x3I&du08qyDpw$}pR{ft;)m2M>o4H*rt^!3snY1BL;n<=T>!HAje5FAbjw1j
zlRrv#pgK`L%DB_F<qUNGb!cqIb9Z9dH5ww<)VFo5tZOZcy=$aiW;H6IRAyQ+LIT48
z4ym?QUmOY~(lLQC`uzI$KMUPpcat**Cw5Z4Y3B05Vu8PG3AhoO3qj~L<`VrniDEtG
z^;!!OJyfmbLcnPEiG4pI%UZr*XaVJ`(p(2KVG4<7@6+pr`p7G)rdk6=jYmcVn&Tlj
zY=MV1UE&88=BfPn4KJhDJ|zAKhFtSPYivx5`3XxvceH#~f0#gV*-o-nYl_QB6?~c3
zF<}A{EeZciv~<f~hhKil%)(i{*J&a3A_^m4Aw5DmVQ)Z~fQ#E}AS_kQb&uO7J3UwA
zM#2`|r?54arR<3->l^tZy*wxVt_Mq`2|?UGQ$OFMGIIlRyPulek5xyl1bj;HOXdWx
zzv7wOd)s9z(nYAClp5_?_-CpS^5F4rLfX503ddv>U1jBV;i(-iAzMBF!=ldOjiKTr
z!*bV=$A&#SG*4!lPLE7LrM_+OX$2V$zt{L5^{29}`c^vukPNCiG^!7Cu`Cu9#(maC
zt<$(2u8mE8ln?OIFB4nZ#K`~py-74KZK$sVUE3AuGiZd%sck=CmhTbEA&|Q=wV=PT
za#b1!Z5y5~l@6s9yr&O?o>@}i!|U95kR>(1N!U68+#Y@qYf3r4m<8+D?tx&=1kH<l
zu~2^o-Jg91A|J<|X8M}LJ@1sMY#O7BR)oBH%N#AVy6sC2`u?Mb=NQ(f?enc{JIX@$
z?8Euq$O$y}#q~fTCA`{8BV78&soFq;J}Ar!AWq6gF#BhUe4$r26b;MGUG1NqaHT66
zhJH~o(_V7%BGl;lVmkUq3$Rr584VdWw!=Ry980u_f~WeN>cmjT)#Gju?wLvPO6eZq
zo!XN<Z*l_*fXIHaf*ST#W)7QjuC&I>@!}NF`9lsg=D+afz%%5zw*S%<CW}yfC7LQK
z1S}1sNQwC?3<0M6%V(IvpPnz!#AKipR&xvN8w4igIYq1bgTlikxcz~Z(SLD6{|hV$
zK(pkRs*wimr@99UWKL2v^p}65760464D=Uu!JHJ?J(MjbgGhZbRbs-7uRy3&amid?
z^VSEtj;nxz$MHNk89FO9BrM=hBu+P4v-vxhuhMUMgz1(@CPnDCgPvOmKb=5kJsyM8
z4j=yp_l#TD0TfAv2OfbBnxy3Q2mCkl695nirc=EwE{C7RCuz;+0}p@eZ3-od5dhp=
zVzZ`9%{`18q9kG0D(OY`-g``nnW{7Y&Z5Ba&#qz&<;`e9@I$)tn<nK?VBHVRr9}Tn
zr1u$252ju!pHi#;zrjx3fk<b_w;+&c6!aMF{y#jU|9&TZB_(9g0=cWV{Ah#)nxaL^
zE#1N*@PA&d?ct+N9W2-KfG&>Xl-S_W{WJ5`p1(ez40aV@tnn?=u9<Q_fB~SDig$Ak
zdkGh<?1-vCvgny4jW@@;tRU6VCk&wET=1;)f1mLIKp%NsXX<#X=;42Z%#t8f6ENpZ
zsTrSkNxQEIPVJfiBm2+3!j#$Wa6%0faf&5t#Kj{ssJXCP@_&SnLr}0#O?GLG#_79m
z#jrND!rb=tDmYtRA!jKR?lS%r?s8-48qz$8)AToD%FVE5QwI0X%JM&0Du_toO8O+p
zr`n<3?+@QLf~&EUu7pI?e4FzA?{~vC!T|d}`R4xvm>aa;z4$+Z`?<3by8xEK&L2Xl
zzZ`e&OUMI{eeXjpE4q7Ap*=(k8zCTfs+#;ScRWxHHbMxm@F_7zgbLQz%q+WiJ%i4K
z`P)Z;EGOmMsv_&`+e*ti4bj702HQoz@tAdhGHtP_Yv>Tv^Np#QK+XG_@DO4lq1Gnd
zq;Daof~+Lk42aRM_y1RO<<x_1DbQ)<<UaxO)=TTKj<2C5k3a2s@c<4e10)<*(NV4h
zH}A!y9i;O1#tXBgEq1)W#L9r)4{(1u@?KP<2I3iWmfqcO*Di(HAXgxXisnf_k@(iB
zL`A><lm>EQ-I?&~?3+>sJwb+*@G_`*rt;0DD!`)BbZa>;T@xoRZMieymjTg-_kBs;
znB@=MHU;{E&lNbIpH|%Tn*Z+8B&gr;DQ$m}G7wy!<?HNDvJtmaJK1U8wMdsAGeBw^
zTSP&*(*13MRq<1fat5*B6dTu)7Fyn<6&eLv61APLCq{{B?x=V8kIt)nAg9CdF#pX)
zjvOu9R{^m+4WO$7t2Hb1**HC?_$*pQ4on>uGwUiZ3oa7e9x%;Tn6?gc0CEDH_@2E^
zUW*V(K!b-fPV8NS$Y?=|%DQ<Xdf0x1`{{9&8_j1Wv~*iN?EB6p+{4RmhkD4%iDJaE
zTM(hu{)mFvkGCv<H{y>V?iw)W5bT-)N)FwX(j7KgIloafs-LN3f_eo`s^y^T01T!I
z&=ggWF4Jj|0UvOZ`M9sksdhLAgN?P!A^|ew{}I)E-F-PcH|ja~{fb#=Z8=Mu+&dQ1
z^NagEWv7!sS{{Wj%)sZng^`w`$$^7(kJtf8sjcUKDiari=mpR+iQCAMEhB`w8$dW}
zEHB3V*?iB3iM@wVl8O*?BbL(*DK;njXD{#NTK!5>gSBa9cYibm?}MH)=6Pt>>0`67
zO5n4W<>Z+*St3{`djsWN*FRQW_y`D7uJnHh(_hqro)NLkTprN7nmbT$<@%Eq@cROH
zG@O@m*9LX^$V=86n4MM28}vGH;s<`D6^y^j0B2HdZhbk2>Vy-hxeG|FzlEz%8V+rk
zOvGts0}_^6Qi4ZX1#AHRnI?e7I!&<lw6W7wUvbuPd9Y9y{Ne!~B-u+zhpN`q<DGK1
zM~|4My9_nm&?B-bIcAqVitM5pfef5VGYA_d1hKKa{qT@CPN4j&ggOo;lL{%#avt{r
zKBWrC1cg#`zi}F$SG<uZ4@$+ctVTA#0<Yd(WHTs9@m<t;Z?iCY(WfZwlVeXX(MCTY
z<m~?;<W}TQAAMJX#(?0M>>Yju2*7jFkNdR&IG`%GlO4CZ*wwhQ5XZ})hOqoe=MC%2
zMS~-s{&VCyQubsO&A&+c#C`}shdJRtYWl?-Tpvroa(hESiXXW1EX9ji-8~t<b^+;o
zwG${SC_+H;-7AB-3BnTZ;a0jE-m^Qx8%^BjhNcE}9K~XU+5lTdq@-m*;h{BTp<l?;
z3?Kg8!QSxfizp0vg9EsUT`5G`v$L(P`8u1f#pDk#BXo$uoEl9)DFmAXfrP~?EHwZG
zR6_a%%WgHp$A$|bZ<X<`zn^zy_Dqz5+FuCIw<V}!0owiw<)GHV@xMD$-}7lou@zUF
ze$uSK7g`nL@to4N-s@=`+a3YPQ=iqT&ITYxHG$DmqJ2Zmf~iv`3h&ueGp=Dd0<xnL
zsCp?{4Me~%U{nG{3t4#?)KLea0ML(@=q7l&&Ak`L#Ogmt{n4grXVl+Lpj?2;h4Y{!
zA@-H)EQJ8Q!M}Sd6_r~<HLRuH$6kAGQ?ohOQKcZwO8k7|jp_II=pPWxq6)}dTyyZ-
zD87=&!^0U-e3O(+@UnX*eQc;6mi|h<R{Zb{MDLXztu#WtzUzR0P4x}|y_lnr>?`VG
z32?f&j&}w(T19Eii{|22+a&PcP@{V3OhHe;)J?ub`(&N8vi*5W@M9?VZR{I9F^Qu{
ze$vM;gSwd-l)OZ)Kww>a_lXQ@?3T8={g9paqrL9@GU5Qh3%=Ng5RJ?c!I8a|UODE@
zCy5JDqDoqRCJ`7#(%B;a@m>IEA^y`~+drpv`@zrF8w#S0j8l^W;5Rl-<(+uid+M(7
zLDB)vQ2B6W7|6cfRN;%hY%>S}T;h%HMQbU|W1!%=Mg>%*K$jEpP7Cjv&fLL8q~$r-
zeVpJcfC5$ycL-$YST~6z1e<lj@5-Z!^QD`*eBF&dP0aNbTkW)==s_RN*fzJ{=P_#*
zq_U+e==Q@a2hCbl5J)4c%y2(m0|EsGA7871U{1~XoBvm1{~b?t|HqHx(UC*ZQAzfZ
z5HcDzAt56ndsiYOM0U1N3MDH$vR8KYsDzNcS4g((?fZBgb$zb)@AvtBZ`U8Wt~$=^
z^&F4qW8NS4=Svd40q%K~pdV_@7aR4p;*-wmtnZ{Q-PP#_W%YIy*TnxnV1U2-J7^;1
zFbEkSL<f@s(qnjxRQDsK8qyyOAuYP2KO-#zc#3oog{%R96=-STaY&ZCI(1$un5L20
ztx@9ba@}yJ3w<Ye_O4|^^5DHeSF8NXSE_>efOLMWnM4gp=SNaG;brT?Zf-k_(kJsv
zWB&FBvknq>Tv-CcIQE+&H&{KO%3(Qjn1=BcVWF-~6VGo4AEW?y$BTs5Pe07Jpq^9T
zQMc!r$57)8B#Zq^Pkgcp9pl&H%2afwyzQC+sKgM8u|8%{HgG4DHp_M6U<7f>9Nnyh
zU`}mgUY#z#;<;Vk+}v@l?p?joF-Vj>*=d7EQM<xxKSh^Wb1pzdnWl2@L!iqAy7;x=
z*qw9Ww~8XI2)}2R23~yI;Yj$tztggROn<wtyC%?eB_U_nbz8|e%tL1Q3nph}7XV2Y
zbI-ndjsxe(eoStEfHY)xDZaTYb4<2HDu?FtA}}Lx#&okg8rJEQLB{T-5UC-BN7UFF
zNG;D<7>)Cf567%SHA>~!&yWmT^nEQ`68rcrEWAfqgQDDUUXWf*{ffobCe8tn%>=Al
zUQK6_;IoR8c#pfDegBG!MsX|!>uu;RjM=s5=!Y4Yd-g~H75?bS@4^9lX}o|SuyGAz
z+4W2>!hoTmI9NR<@|DXH=U9krOK<X~;m+u^^R)R(Q<L^{_^I<nXJ2r8`YR^f5<Q8)
z7<33ZL|+)(OWzKJJ)LhL_qv^hKz&9L<vm6^YzZrhgPZM?MD?>DHwum}x3=hsguXT9
zhzA6>O<(gyPn<daCrfLnwDLMxxq+S&ts;YSyrj*fta_8l8o8>*%X5EyzHRFNdM4Xd
zZC*dS1BrOctWz#oKsTkyFwz&k_f@kzc5fxQ7S?sX#{sz*X(^TRqTNJwoi%B;j&+Au
z$1jBJL0wJ*af(W{n5p=@5vNG#Nhsn*`k>23O#ts9@~&&i#thY1moZ+Z-`gZGU|H>}
zU5r2iFMwvH0erP?X6830=FF&C)fF^Bgu2~i1L@)3&yloYSo*oQ7w<_8h+`+c>YMdG
zj#ry5K^G}M@9>jle*5Qg?BS<u!YJF#2JTxYWxD~01j#`xnGkFm)>s|X7b|nO84p9F
zMl>=%9Jhe~nQFZmbIn#bc??~>&~v*~CGnziIeOvK*vU_eA!7~WH?DkC5ZztbcyUZ1
zeH{RQ8&$7N%hh~vo^tn0okPVzzmHWim9|<Au7ODI^DZ?91juVzuAGq7=@NHk<YM-j
zeV#d;u#0a7NO0n%#XMXYVvZ+@XxCSChv90Dcz{I@)CX#Pudc)wzeDPi19<F0#}NJM
z5lx6(I3>&{|0R12Q0)OdQg30F2aGIRszv%6H55NsXvTLwAst*2aoq^jMY<|O9yuV<
zpTE{_yY(+bY>!0r?pMY@Z=^S6bkvugbiuL383CdYPMh~?FxajYRjg)mKl<@$V-=Fm
z3>H|jTJ@_pyXTl+=gQ(}B_Q(J+GYk2k1Ay~0>MsL=hk^S*t9;Zl5T0Dt32_wc!CHD
z?Z*ms1}Lj@h17<|$BWkQer*W0^`CE^JN;oc0AcJ%z~i{JI|%N04T8zE`a)^^DUgvK
zaQ36&_X3{P#z3)5{F?zQ@8`v!n)W56fs&@|4^0F#?mHt0OvH_KT@oLXsQmrX^4KNs
z8Kf(tGcBn1`3W%=$$AJg8P&_|`J{3R1h-)s(eNF;fl>D3dfNk&S1H8hW3P&IjVxU_
zCeU^#J+lxJ!eAye`;(r(Qu{iy?bBWCKg_XWj(?C~3Z-&}r1Mestm3=<RB$07QNw&7
z4T9x*X14k9vgc==kmRKX>gd^qo3<)7R{oquIZrZX)6%n^FLQx+1nnOQ)Z;|esu6AF
zr{Ak_m&X*%IzYcpB;T&fNu*&h&?iVWcu*5?toL=q93ActVX}}~^0u1o{`Ej;CIAHf
zpH42^bhHB;!R`_MAk`PBESkN1aa!vUt{+2p=35!>pZ2q$u%^>XQ@(aQyiz$N4^K!M
zBX**>wa+YmVzL<>19z$+(8XFh=UJtG%N>0nl(1UuRQFAeabkM{ZN0fgTLfo8)~deC
zlsdc=Vm)<)?-t~N-fIX?rzF%s$55?(<@Vs$o30<2Vl9H?<oop8bgwqB*G+u&x|k;y
z(A)bU;bjdph-&pJiOyZWdtdk4(c+fF*I6b|aeo`>244b*Dq89!j^X7>`qvaa82TI%
zx_wZ6w3G1U><`2$#=dxv`N0k97pZ|pvIWhdT}-M0FSKJI5mTqwh%~5Ay4F8BdiUIo
zMgP+r#0Y!J00TmbK%yATC+2uQ^2tN+tx1tU`AX3J?yMb-Zm>r*EsG&GKJbtIixAG%
z4OT2Iyy6rH-T<zHKxt8g{$WC`;RXb-FT8~?APNWFbuc<`Qz`U->&L_9)WmR@zN;hZ
z640~6xa~R*Z|iORpr|}^np5Y@WRUOXSLZb05X1<4MrWx#|EA{d{(ieiY@@&)DeI++
zFc9J$G%IT=;<oOss-X%OBq7#5)Y17*MyNm1g-}I&de)9-Em0<z+cRAQ_4E8qNYrQx
zMo=C3z6Aa0jgDp3yjE**433Ll;knS$XZWNqo2Ds<vH)=bHWqzFY3vJR$jSgE?Tr+h
z*23h5!YBL)Ap&KPvL=mq!L&dBSVqVs+oa#*!qIF<lrnTZIrbMp`MsqCaSq0kSuY*d
zh#896y_Sh6H~mcFh|Kc<O8KAGP8`C)<jN@0$ElF_{KfQBAZ4&iq$-VEs7&qpsNc;*
z-jWpH50ab_8tcrc!Hr<Aey1F9RP^3?wckkjCepIP5#gaZ$10gKduRx_T56hw7HDqX
z+5F`_dn)uO;|58={3muc`^@kD0k=faiC7@j*o6R#{-(Y_zlh}_;}^K&&zf&!`wjdo
zK03Lx$Di~85VnMP8G)~{L_byz3e0H~XqU`>cQG#b9biWqU$GCBzCe(CQO*^~-RmUK
zqh{23<}<s8YsbT6IOaX+Z~Z^(=6?z4P091WSkxv5@dFxw+aq=m={+r-FJYfQwAUWH
zcdF&%o8+VZqmiKSoHb$+S&=SOs6d!F>}^hZ2{TY4U1<$Xax_gWaV}mKRL>AdUd*et
zh5fyShqu#_H2*}rByw>ia;c!n$=tL8^4iD9J!b9o(uZ#Wl*?gOx;0(?QAAU($uZVz
z_5+XVJTMbsWqHOe0ZA7LOj|?pTC*X0FPZw#n326-3Hs(CW0ReYGg3RxFM1l|@22!C
z@DvgPc-FaIw>wp;YalZEOI&l8;!3a7!L&ke1lSit1|^}IUC6Bn{4EDMD?1sooiBV9
z7c-z~>NjJ(wL;D;P3R0@m4&1h0Zr#JG<|*UmHQe=-#v@_cR^<*Z@y1CaZ<Hn_-pge
z-(z)QGJGb(8R4NaOJA~Q-_c$+l27dsA`g4}N$_Q>=~}~nAhdBkIMUd9w!DWd<5`|=
zq=F!;phe{hj<15k;{MVFGiU(_i?2-l_f&or?oI<DuzjbaSFS7b_REZqd_ph9qch`w
z<=sr)zR;L<Q7Y%$V+drPg1$aGf9CZV{ils4PFBx}3<JlTcE=kzM;;dTGVh6T@evCF
z`sV*Ki_h1avOd~O`kYkYzoS^PwB<oacczjTtfGf*?dEXFq<vuni#jQgrEIv!Wg$h{
zs<@_w@uv0qmexKN`WHss=E<7~;}~@2e00cHK3$7rQITxy&XxNSs@rC5SFw}33SlBq
z?q$i1uj}0|>w|m)5cD6u_jP^L;%LXWo~ys&ynf_IkX_h6?Q==p=v$-N(uG5tB|4ek
zatp{L1l)w5u9$_{%(Rk&VE?51<y(OyUw5lA%mbi97D?B6;x>Q4w6$Ld?{U8?!OYJ#
z6W8h4UJt?k1ulimGD|x^xbSZ`phFLLfZAN&aOdBQSEl1fTv#9ILIB1L+G@3V-5<XW
z<M;9Xx+-?@yrg6JB-}JioXjDl`#I=>(@kjl_<Ay|Uw2959z=|zd9l0ZPaOYTWqH`R
zL-w~5^n8$nS1xfY3Al=X`(n;wX5`+WVF}Hg2}-PAl6E-0JmCEaJs>CR8tj&yr?Q9b
zT)Hfpz4EFMv|o2n(C3af>75zPR7PK>6@=!la95rwG>&mJx}x%aAGsRSipFc4MJoFf
zkgOah5g6vXti5bxXLQAw`Jt<N_NR+&0J4*^bG<MH_a83X6hd!ZGn$Tbaz}}3pi*)n
zhiUhpmNHz+xo>wcZplRF&2wo2fTQddPz%Y-DMX8`(0~K`vn<whc%SMX$_%J&@NF0N
zyN6uFG?fzF=-ti)F?qd6xe=6zB|giR5_dxF9oe$kr$KVb`|9eF1mtAPZ>vQ8vP#VG
zl^&6#U}bsZ&idiKIp=98bJ&ZUdm+`@xp4B5ebScQ`rJzS<g8}IR2DF6@F?zGNZVdv
z<!uONxy6jOTjVmjvrTp}`q!QGNT=5vRb{KjJG+ln<7Y0n2s1)J9>%FR_q^a*M~7nP
zQ0Ze2bJOo8!@tvN%$-xr3&N;OLzBWw*m+m`UfYfLncd9P7U?HWZYQW#Q#5~?G_{p7
z5FqgLjI?-;$OHAG4(-_DL|2XV&{L@XS{vtBBG2;e2%cR5p7Q3>h9CW}Da5&F%<Y#M
z)0PF&Y)h#*<^xI&EqBF|t+a>O^3Ir>b!`c>>}=Mf)zgz)KcGEt>faT|d{cO8wHvN{
zQ<*^C%}XKeR?_ZTdqLvZk&KacVxP|Wp$;3bc7ohgE|Z)s^SP7)dXhVC)!HRvEXqv{
zePrgt9#N5z>6YpbwWakO$Wi_Fyy?aobj;#8yZ0ZZN<ZW$@|>%?-cxJhIU?`YHZW+s
zWn=0TU26LJQBglO+_rGr@kHk)O=rnq;2DnVn(mG>Ex$IW8U%&%kPk&|L>e;R?nQk$
zi&o=u*<P$YzPjl(?Ka&FooBB@IkaWB*XCCFleAHgb6+>H5WG{fCPCI&Qv36UNH4j;
z(AL;onAx;uiP~!F<WDUj@40gJhtgKlKQhmS$lFn;+cgL>@|y~I&hf5Qq-KZNNpTB#
z?rv(@w5LtAq)ypdn94MiTX-3C_0Aj1s!ZCb%-D(E&Bxrw`<W@4Fd4=^GdtWpC%)Gt
z)YZGU^9|Js-!d8Z8u9eRcd;1lD=?b?NKQyp6b<Wz3my8}`43)2xo%Bu=}5AOTb1D5
zHYQGwmYh!LQ#Te%3;XtY^d1bpt2?EOmREYZKI_nOq2WSKjBY5WO2LBO4H3o-XhnSk
z_~cnzsT|v(?5&vH7Y6KQs{7e?X=w}TmmkiF=LjCwbeZLnyj{sTMPo2?b=74i<IZYJ
znnGuQlV+OW&^x_yr_XxRMxu;8LxnCLB`(`*<u&Ttlr>!!iMwis1POZqL^yRiMKw)@
z)lS}b)w%?lA7#431?^0~b#$wg&!U^>7o5A=<=yr#mve^eU7ty{@Px$~dSQ!OoHe74
z2TW=B-?Y1WGxDO#{k?4MRNRXCOD)=m_s>$G(hpa3R(?uTR3oo6>*mxfbNJAarYeUJ
zRGoeHu)lCByE{``z2g;Td9tOOYu=<QL-QhsZPzH&PS_sy<-f9>>6#k+G<6jU8KG}^
z%%<ZU;b!M0Sd?F3hyJgN7pL1MGW=LQdzYVZTj|K!7)^%mC${mMgLroa6Pl|E=>54L
z|N4IS&K%soeI;)9tKZ|xJ$kpNMN(UeDt~3>CopuxzF)hVy4~^dOR6y{eNwYJBdvF6
z{k7e>WNmLPX?2a^TO{^#EsD%MrXAl~l*MzldPv^9-?FJl3>ymRG)@*bvU5{^)(orF
zd^6i$p~Wk`Lk9Crus`<E^XVr6rh|Jg&SpwUx;r)sM%u1jlV137{vk=Tpb%T-@~&R;
z)Pmcqqn^N9DM|Y)&FxN>TBa5@VF{A(QwirgDzB$UD?Hi=R|wBp<w>*kZF=RD%U)IX
zvJ0Q5G|ww}lhr_!P@sKsaXB(IYMCHy>-fTxfunE=HH}NxIa8me>{Y-C*`<`!ding&
zawu%lPt$>E!)V$azqfmP6d$o0U|-rx13LVTv<gg_09qcXP@eZ&Y5&^0z2{MVn^$b7
zRZIp;Y+ETm^*U6<ws1#tyLJW1^ebfw1y@+#dV&fsx}Z3AIkI*zxI?#vxiqD5noP9v
zK2gY?%Wcv2nE}<{7p2jt>WsYIh?7duElQdFu}X=ZDQIp>O=Ic%SyJT+UA?2!;(vsO
zj{*p2wxJui(oZl=oR%=YnV|WLw1{>zE5rt(4M4cZH7(pY-I;DY)><K2`?zL9&##v7
zdVz)S;P_HF5j-^Ri@7XIn$XTp3AM%l+W@Angc<$C0{nY0%9BI*@Wn{-Bv;rEaydP{
zn5*`R(Fw&S?aWI4UFJ_zMlw8yB}fIXYZaQOwlI9_vM{XNHWs|IlT~Z74O24_{diRm
zj>PGd-)~#%r%6OB=fCuKw5$l)cb*%wU_o@X+t2F<$H(}T2@f0Y_$Wmn!ZN!`!@ax9
z^;$fqMtO8$ez0_PUx?(MzVjSUZ;5UC%3Oc<t5QL#Yfq~u8pB%pI1Qx<N{V|P*AzQk
z|DauD-utdjp?tihiKXARG&RJTEC;tQn<jo)hmb)u|1*eWWDpCJl7*9(;lFi3rvaKd
z7h9C_6*YHaWjW!Jf=qU>;}44?;aiftXuDd3KuziBIa@Vs>@a~m%ZroQ>iRCK9hFZ~
zzU$8YP}|RLe%1Top6}Iu&AE&iQMZa<=Jk@Uz!F{ZPfh4Eu*pQ8BuPYJ-YV{~`u2zK
zO&cGW0(&qQ)RbMl&NG`AV?j_O-Vab4<B7Ts{TLz7m;2rlSbK&!{`j|(_6g?G(wNz1
z0bct^g)=O)K);avUbocFX>uV;xAgg7T0p0wWr#2^ghXF~6_oXltUWtY*P^Yl^)o3T
zPS?}5f?8<4Ddy1fr|5#z*eTojG?_1hsOsv#Jo@DbTf4<ES%T41i(``<Q6jc#s^2-q
zMTa9!s}nL+2|r@7oThk=-GF|o&dIqL=<rmIzeZp$!ZkJz3ZIhCB5Eka2}o`>wldE1
zfFZgx1+m8p3#E`<hWT(s`L8uP5vQ*Z{DjHae4hWEXVLw+^$@-ZYzk8?ZlO0lp83GA
z2KghlBJ?J+-Wm=x2?}jITC=&D*G%gABo(WJ@48p^G(EXFji`_5*Q8MUkLfs6ILrL_
z&E0EcC^z6s$~CM%VFK@>arzZs5nY+yd}<GJNaJwJe27ugTbb@G-9gs6Ul#2|!7^dn
z>kHYn_O=(iSCu9?oPWcBxTX_GP_icshEAZCgUNL9TwMoWM*p)$8F^mx#-bo1vm<q3
z#5GJKlP%iCPSY80af^DHBa2kl-SLOQPzTp3@ti)^w9~2S>e*dFw!2#?&1xAMN>IhZ
zPPM)FS4ma=oGmSxrQ1$4mVb|JN0lMRsTwITB{xY2(6B<LFTOoVwrnW7M1(a!3Uh<8
zs*DN!)0eRXIfv9j{~TaVV?xnp*Cykx-s(UOa_?JJ*|9~7s~wt>;-#qFC&pSjv~Q42
zE=$!v?`hDfx_aqDfmwG$bF|Rs^uc$j-fEa9Rd|FqI@44KiRxxyN$$1HK|8LDt82y1
z??AT;B|7Ebe?Yk?FW;nHD(PmVQQM1F9=)!ID`K42st)7*d|2-nEo2`G9dJe$fHH(p
zv(Q}g%R2OH$|T80y#BpA5Pl4|fO&rwuz3&`kk*U~SwMrj*U7&6RgEy<^{%pOUA;fm
zbSR^cQ#lJ;c@kAR!)aei4r=wih%{~aBVc}+!Wuz$rZUhLylYIp6`SQX3RcjGs>WHV
zNLy%Lx+)bsywvdC)#A4Tk3xj-ernq7SlLZ}8yr2ccoz|$Zt(3K2+B4bk6JExrXTAb
znGIes{25W&%Dc*lwwt7hEWODhZ$cX*V3V}7(tgVtTJG;RefBTOQ@e2d+DIknB)25|
zti9qk(?@vlHOe~&$F`W-V;1dzoL6Jx3<ud2<PH86p6eo2ozAzl2DIHBe_E)8Z;_!&
zZ33DGlTI=h)LK^V7UrAxDns8Xm7ipiEur#-<C5;!o^FAv1;UD@Hh$5{m~VLPvA5f2
zgjt_UVHP#9?VDgVCq3dfHHZzjmQTwaJ1+Dz-8cM7h#K;I>wi7}%k*MbruM|na!VL7
zIonrAo38E?{(huokKtL8M=2A87wvr`(%F6VzViqEx6AgIYYudv6(4>tnUx@J8afWL
z!UR!!WuI?XZ|jXtm$P!rb5sf2@UhG9qCE!%>V6`kV!Hud>S2Pm(>GdTL=N*<Y1zkp
zUa~^%fe~IcW*eCfWY0W-auy(zcT>2Ty`0P2cdd#GFB$Ypp+2K{sSL(yYdI8kl55K^
zo#J`EQs|-Oj0^E?m6rb~Hu-SiO8WYgLhnr4)l!#jlN3RTi_ge@b)*K%1MlU<-6l2Z
z&0VZ^TfHkOqRNL2%j07V5Iu_9knnGCD0(T6#+-1&+lyK=exYf+Jtmv}nP6knmXA@s
zi@Hm&ROil}JMpD;kL)`LWFxuR)w4S4#8PbB5iUgO^7M{<eUG7X=SGlwLvX{wvF?ZP
z(bynzJeH#>p~;$*C+J=i;C1zCijlT5E-fu3s-~-5a@%{73SNpITf!+6M(mIW|51KT
z<CCa5N9HqYnfXMQ&3m|&_6c$%d`W#WA8GawKsA%yq`xqe^Y)y)>i)#b<M0M}jVpXD
z?gVOEgepIl1K!d5nzYUa;MJUzmkj*|fX?ia)ku}qDM@nNZ-1b$%57#w2kbsRU+R^5
z(rC8lgLO3l#Tyq!_3O%U&g=7+Oxn)rZbJ(d6ZDimGZZ~fg$JX<YT+xKPC-?-Qfa5%
z<f;-B63CO7JCdbeSz$g@rU_UF(M{Ok_sZ{O>+#}}ac}Y<!cB*eSANtnhv!bk&XU|m
z$i}?49ImiN2mzAC*nZ1bRZ#bsLcKcXcN+$oju`8~d*t62qjQ=A8gGOS2F6SHHURWl
z^YQ56<HA*yw?mq~9L$9djeCRhA-YxO3?duov#bXaEJhBkd_SkK6w#MeP|;>P$t-_<
zZE$U_zY$n!o>LyISq1UInhBn|5+jN1%O}!BrM1B-HOh}4Kjz;3Ol(I$$j>Q^O#Q}l
z_h4IIaVupb$+xZ*&@*8TxqbA04f*~v#Wo9r^zK>Wfc=ej31pETAlu!=Bp!IWW&N5v
zwAegveZXkTm!ry4>X~rSRpl87#dY1PdT4*ZIsm)6HKfxT!I{pV0Pqtl)M}nzu^bYf
zF8q+HKSx{+kd6t+o(4mEZ6KDPmoc(}k!kKoVV04)6+ZJJ-Rp<&Q23{<a>ba?3Zfbr
zd52@Z9tkv#e&~KGK~A=h#N0MexB4R0gAz}8ska95(q*gz$Y$Gzd(si0w!oDaznq#q
z2&tN-HaV_mTeU&A7V!~lf-q=We-|fwHswuJVaoPZB`zP9CUTazStV>6Boz-OkCN}E
zPU?;jzHHGA+w{dR7k=<Ns=nV^A3)d~9@@+jugSi(!~Jp_QFvBtr)|uU>dnnfYv_|`
ze8v)Uo<jGrl9EeTH`mAU6SSn-m0;`hE4~oF?4*Bp^X(PZ5_N()xzG!*z=7ADEu}B9
zU(h?nmQL_tE1lo0E8`XLCn_vhxIp2>w)9?I07oIUW33NK$sCY5O)sQxXB7G#qdd!F
z*7c_2ZHMie@%l{nEjpJKrBt1dxunIazcR0`W&7Hirp0C3Og1}*fcII`$2HBSJpw(#
z!N4(`+;Oy*T&Ivx9e0imISopNxXU@0W#2inAQ9~Fo!y*f(wVOt+Uh2y9+@n8>^;L5
z<7|;rjCXNpWXchff!~gI_{i7A(ONl?Bi9Hj5Pjh>4Y{V3qYWLcWHa5_VX)HTZn`ci
zDH%2QR+lc3kEDH9BdDL6SC_ukV=tTkuwSi6DO*nj;ehgg+Oek9nb)Cons4xNuxmj1
z?p%LSBe1Kpvz=F))4sEMv5w|;N4F0N^=T35&NGEAP<Uh6-Chp^nw&-uAvp|9A>PtQ
zx?tEwBFMgkg5$TPL)OHIXsL5bRaZuM$~jGZGV*4o+$hlfzP5HfQs+un-xN^yr1|Jp
z_tH|t_#nS|v+D8gtQ;~qAcMR{kN2wN@H!CSyt(SKb&8;DZLr#u;)95es+UngfkCzB
zU1_<Lr&c8k@98A&46B;QqSJWUM^yET2z$~<*n`x>3szg!bkS*pK&y4CpH`>MR{T~4
z=*9XtaWBL1udhsoHOvI>c+MYfX_1dJZi!ifz=e8nAWfBh6Fk_LSrcb*>y3&+hiCE0
zXWJ~z^6QxC@8>p?)`2*Z*72iMpZ1aHlsnmu)urq1hOnt#s)#vChKMhQo19x$bo&G<
zxu48@E^)3kLHfgBdD`u+^;w4Bx%V5N2RzN8uQp)N;EKyzI9nKCmP44khUG7yO(${w
zm2tXj4eJ2V#LxKpGn;9HQ0gu23GWHa;HJGGn#F$pe9%JWzMe`-k<Fw+s>X-Aseu<E
z-0P5y+#`OIPhAY2_a)~w^WBkzz^huI6dUhKTB+q!-n%w~s6R+2AqR`8=|es(#Cv&s
z)EdUdErPSRsCdo86LhC%iAlHpl<7f>VRZ4@SMw$zFOt{T_Ov`z$g}gqF*U37dBkPB
zN?b$tEh&a1bgLZFD08U^WV3a0iSy{f1w-CJGV^GCnxxbvhz4iwajQHep}NA&*7UgM
z49^$I_!InqY@3)X8t&S^I07+bw|^&;g*1<l(xl9&)Wr`#r|i4aNl=_g1j`}8&(5zR
zapNK~a`OX~@cGD>9L9`1lK3ZOFKi0~i^<GN67xLjUQ#CytKV}`c5BkCCZjfNkc3@0
zd(NQ5bxjzpCN(u=l%bcF6yS41#H-s?Do4<(+v#FI<ft`PuJO<K5zV|XAfHdut(@NP
z{6MxwTa_f9Q?d?3_-)1~({Ghv9X6LHJ_o#16yofV-es^H-Zd9h=TD)~1h|$e!fF2%
zSWJIDD0!=JM*5}oqY->lz8oiyyTcVO_ZLU1l`CCcblbg-U)8vPR;yHt?MzpnS$Ijs
zBMbBfB2yiyw?|y!4k41}v2h@1{(&zXZ)q44uGjE`AG&;nNL{PcqjR{b40O_XludK%
zpjxGyW^7H(HKl!L&~~d@I=jxCrJljuLcbVc<APj}jpGu}nYNhjt?D8>#`a5<-b}g{
z?s-_vHg1kewcqQjOx9a8a%1o&$FxN9-I|??m`AHU><zS0Y*Ay#ccL7G_J}ZEbYVcG
zqIluf3TTs_k5ygWUV^9Z&h-^IRVyVc(DoKSj8w_g>iqrUax`}U^-mu$f+2@75?U1G
zjEXd9r#ua2-a&%snIK(FMFPY3fJH0ZBsKm_l0f!Iv_W(<o|aEhPIEJc^Jh`&U{$&E
zdRL@pGql{^Ex$?PnQ5uzk<*uxpx69Ov-)D}xyQ%hXnoCfpW5mz!tyun-kcrl;4~_5
zwgHg@&miOltvrkTm*XQ}6p7xDqkPjeo{J-g(eI`ElvC|WNl(@HSBk`-SSND4-=(zi
z4ksS<oby-&(|x(G?Bw(2+bEoea2}3G3#vMv=4#$MpX2nL)O;3ifM>dW)<-$(QZ#oK
z{q@7~7%ZCfGq)o0g&=-dZl5XJXNMDOHBZ8nc&2+qQZlgocC<+nI7cNO1Ipke%J**Z
zH-AMgceA#{XBFbK*`uABpOQ{~DO1immUl?pDqPyP4<`l0ICbNneM;mg*myh4^lxWo
zajTs#Z|E36ohltXO#051eeE$oS7GU0R$hIJ7V2J3yUFrm@_16U7z*uq_|9ZJa%g`1
zIqr0)4z-{(jGd(-Hhj>YCq)SkA!-Vr3^y>sOTx|ceMOe~kU}cZflFqZEqRL}ZFA<z
zXC^Y3X+RZL=`5lVBo1bJ@!UH(Jn)`K4~cvUJckbWJ<`SldyD;qpEP6aIf6O<1Ii;T
z9NL8)<nu%2+6`e`3)%%R(<1x_{OS0pYR!qCcW?`{4_eYPT#xVqegtewvr52r!wD>!
zQ_gPzXE-((;QTV9*CdATM+(`^2D$ETO)a|t7pF{EX2c-G^WU__(sGVsP`)nSDTrwJ
zB_C|G16wP*D1nCYcB)*ztUET`5$7ypyg_gxu>5|ltYZ-@QC6Nhww<ch08BK>6omM@
zz|$cp8%BpjJUBU^I+(2(<A@5lTDLD|*|UjZW>sFy;8c9s!9F<0&xunXJ$)ev(!dVi
zm5pvf3h<lOWL6Fl4C~?b6hau*4WENy8K$(#72#*(4H8>dp2YJsVA0a?2djr23Be7l
zhyC}leh7G94(;}Tv@xdSHW2g4EUpB_S?qR#!&}@P%YQ6Ej0D-%B}5mR>RtgL_BdYa
zy<0F>=LVU3J}`VAMIFSHVn<TJt+e}C18U+{tiru7_@IS@$QY%*Mi|GKJPD+y0Bt22
zb2GA+0*h|05V(bSdzg*g*>Aa_(ahZj&)lCKnlV4gl=WK+LP0a7J_+P=ZZd973GHqS
zD$>u%p$YoL6Jfk`g}*9TgNerWSo1Nb@jORzUZ89dx2FEYd9!k*uJz#el9rdr;9xwX
zT6bWDC4A5P5RqhbIPsf;fI_!eY>!Ikge_FmqIH1v?$U$r*r~3}$i}X+^70I#vAOmK
z91q~JankOSh*;F0I{&b|TI*bdO-;I9Uh|slYr6qr462lT+!d!_<WW%>c@ku(1u!3l
z=DlZ2?dBR1D?iVts-(U~vfGF_mT+WKDH^}AoobVmdP&6uweHvIO-@~;`%4p)_s>zC
zMF)K1Ryv1>ypYG^8ImrBJyIUX3c56!MsMndDwb8;!q8;@PUJ)OLIru>;p0GzuzVlx
zHpzXmX|1%c)7AUvK1mIbd9g<e+P>aeoe8r|T^QCcFb(N|lsfOjzQo$899NAvA6vtn
zRDWy_y}A}+vM}d$;}Tbom|@(ENst%b)G`i;JpXx;%5!An1(OJ(&fc9HfyA%_M%ZQR
zv1YMVe7?n?78Rex1pxs8O6@?(%TmMX*SaCUq-)xh5%Ead!U9PjtX{+*-anFsvUuCj
zP<}x%uZHHWFUY9T`SU15M&F1{J9(}8?$@>m_PdSc##9M&$(`35W<dvZJG4<F$D0iw
zvcMjM)h)uyFG$Vdr+lhnyeIn@2-S^pr_~iwaGlZ{AS6oL7mbW<5#850a_mf8pvME?
zs^q1Q{+*{0XCzNiPfg^>C}4i-B?!QEy|^AZwuTU!-J+_q$6r4s1toxQO&MqaiSILp
zdH9|q=BCRRkX^--gZM&d5$gcW=gMGw!0!y4AyW}wL_B?RcC|Mkhf`w=9T8={Xs=HF
z@^tXSul{&<r`9KH`*qV1c=K(c4P!DCq3976MD)NX)w0Z)|2p(5uemwKwuI&4uou0T
zxtbUz>gL0kr^o>cqC!Px2;HSb(F3{#T1a&^fB18a`!NOtfx##hw0@VLx(e7E+5Np;
z$@0u%*$}o@QBRpqGQFlv_;rE+?HO?fr{l!Y8hFq8*Tqpv&ML7}(nz_X*W4g_?i>5G
z`bm_u3o4Z!mftT4IjtAG3~bLyh>LrWdQN_eU<9(!G8!PmjR{N=4BkNe;8%>&4ZsdM
z>$u%(ngfx=CEMu^bCG~a5W{1r4mp8M7sexpWhgLT--!Vcks+8x%_nCAml)AT(R1c{
zADZoce(pqLu{DB`ny?BA1R%Nhs8Q??3l!D^t&?GI?)|oObuJ}t3q7eYK@89*NSxC<
zGWi()kxLmt4;jtE@Avk&S)n!XT?xQ{jJSt>a{*WgjE=yHxr_A>+@(da??5K30l*oF
z5_fF%a{4}+?H?ALJ$&5-?Z5%2zu^2F?(}0Z3V5POA#aq%CXHAPw3~)oOaQX-iiKjc
zUIu2bAZS7%BKCM;NOuju{<-&y@jb%ftk*p@m^zKT@DM&LzAGUz4r}x&P-I3@xOmE2
z7pn%PxAb-3tqcJ-*eRP4tCpq13RvP8QV(E1y>Khg550}OO^<H}didwzgJ;!a7B9g{
zMZXY`;2H$|UAjDGffK%cg1h7>xHd=zvMEfNS_QA62t(f9U+!FVL9a|>Kii}|sVzbJ
z_`a<pK0d=Ka1BP|6i*yH^D5eb5(Qf7j{Ad4cA%a=P%8_1!z4c`zz`QfFHAsxdN5F3
zXxh#7h1lh=sb!qs-CFe@G-zXhC>V;tZ;FqAfPj1W>nQF~0ees42=~D1ZCidji5v~o
z0MRElG$#}^@fIPOD!FST6I(RoBnN3A$d5Hq&j;jyd*MwO*me+`SYb!*BVvdr9L9_+
z`v-|zb?}MDS2R3^SBd_z(F^n5+^5(cl)u?s(APALci!JV*!5W^_^NqLqhSB_XJ$Vx
zz-N=K?=6v?7lxsZT?|;k$GZnBdXJ40XHUeiZ7}CobXT7T#=#g+gfCwsZ}KL(&WToY
z<9G-m^%7Dt`tp*xoeuAn1&w-!1_J>BK^vrRr6n@=6tnfpOI%xZptSXQ&$leWr}&JA
zJDjb<bcg5y5m9j$3q?g8K?0d8+``O-$O6-92_gpYlN8okJcrml`DP?Dqy;>VU3*GQ
zKJI-|AqX~6MnORV%d@D68bHG~w~p!Iwi)$~apVdJ0B!V#_ia`nXTCN%Da6R)kGSE#
zBKG979J&Cd&yt~t{t6f8RQ2qbH(dHx*~dN_x6mPW8}3}v?$8b{wVh!GWBaus&k>EU
z2aj=1mC-&}KX3Iaq~Iu2Hg@BFD;aoJ%^FIqFpVG;j~fKlP(N?GV;;t-`xs60Nt#wV
zemX_@{qrchJ`?dbRhP-EnBeq04~#t6MZXvB!BCC2GxQ0$CV}k4kLvg<xM^@;Qn4GL
zhF?QAOVMd{nrYh42Yc1jcoAZaRm#sGT}R)cVxGCP!$zq;8F+E9j)tfxqyWfxIpY-7
zT`;$p<D~C#=kz)kn(pFV?<*#4*PYhqGyT;kQI*h5;$)BLUX3e>0QC(nTOV>p(mnz}
z6?UD&GhH=3>F_w@ebn`fY-iLWgdKBJ!s-B0XN&03h>Q1p_9k<$P7B(W*B9I`_`FW`
zwGgDE@UtV`!J(-}<4U81m!*Vx^k7eaQ{8g%LiSV%t1RSsn<B;3ejaXQV1xu>Yu%Oc
zpFbN4ANG#}X?Hh7O}|<t*i_RJL6trP(?6b)5O89Za0S>z452uk3o*0j2!FHr)*BH0
z@OqDf$zMVZAd?TiDE;ew5xj87sf`L5iu*eLD^gE#Ut-tJW<By>F^|4b3ZB`6sC88o
zV(>jJc@EFc_0H^0i@W5cm5{p2wVsgOb+JP^i+*@;u?!wGN=wa#^PI%0<nZ{AsveiL
zXW{F!U}xUEN{U4U_%Xp*dKCK>G}}$-RzX$0b#xxM)Kq3u&;@9<SWzG#ZUbrCeaA;m
zM{)Y}^cWM`GeO8Bb>QP6@f@4W^SE?_81^|n4iuq8V{1yP42SxLOAKORu?A-`{#Xry
z639{p-ERz)f$(iLYZ!|4r&skkJk2`Om>@<Afoi3kf<iz=R$QD|D5tJ0#{AOlVrE|C
zI8n+9A_+biXez!QvPcnz=y1?Jk=l=#aR1DW50Dk|XeaR~!TC`DgLHE}ONXq)2W+uI
zw4f7TPM^RIQY2sY3cH|rcGzuSMBIwoCNTNPIgnY5a3Id>5yLhfJUmbMfiUM^ogodn
z?F0id{y7x~$mp(qz#xTvu7KM@?wNtGI+I5%AvsJ>6kj2Fzu}bU$aQ%eK@-FbT*a9I
zY|t@0E(8rxAI`qgMh)U_Nn=8QoaZW04-Hf`Ghhg4tKmX7R_4@ZA|vS>w_yL!T14YD
zKZ<9=oh4M+>BX~%^;}K)t``NGXH2+cg#<C!zG46?DJv7+1ajdOPW^(D8!*cdu8NIo
zu_rT{QEIV|{S7=v9OUmhjmm=u9YLXvi)pYJRlFjQgV~e-VOv5t(KK&_TX1W@P44#?
zQwFL84wt1NT=*e~YHn%@L0}j*?u}tw*)4ck;KC+gH-Nf>y>%Wi>8A?PHC%v{fB{^A
zPUEA?;#gCBXv}hl3p_bWW<3rQHo%#nFW^+<LUsyv@eH~c!5mN@vLOP?iK><-LT2fa
zbM(3(y1At#jBm(6f{MrV97IRgUadYSXCFrrHTt*lvVv)=r;f<aaa*({5{X;&7++Zp
zVU6<~2EKAt{bc-6plQth=3I<;u!umuV;Nya6lwYIq#q-&YF_k**>Hk-UKb0n46Scz
zV{}eyv#bDQxP`q}>b!0dA!wV17}G3hG!!!(iANWcDON84+&w8$(PL43=W^&@ECAfZ
zH<KhVe;_x9Jc5XEy2AG{hLv3zru2%6^EvX_306>p8qrgwa3qn8RY$hI{;b<~BeNA=
z^ByeRwD|^%xD42r+*OSjFLz`7^#Pl}V|2nAMSKu|P(n7$_+dM)WB}{tEq$Q3g~z0r
zTFF6g&-W+^z?ue~LiDzFq4_Idh`I^xFEiv#!$9ZCfU(KFq-M&p2r!5V=phT!ciUA}
z5STb+@;y#mEv88Vv#2aaPzk8fQVV5*8VHz+!kXIuI5lYR>j&>U=Osn?>NLD>Wl>2O
zc^?{ipXqhio!`<Cybs@|*fe@>q%g7q=bJRmBk%F?ag-8%%k`=dcVgFt;xW=eA7XD`
zQrhV>5eun<z45U6vtBmGQrWa%y;`Zb(vbCfeID}>Tbz@l*zx-q0K;EHQ}46B)S2-F
zy>se{igEhflj8|sk2Uj>t~~5hL6Dqc0q?Dpxw_8=DZoUKoc3NJvG)Shg>rB*01<-^
zz5?RlU5r9KX8oVQpAroYKyzH+XA8*9zDTLu>dMv^ExP$g6#vyJ*!Ca>iN|wnn8H1Q
z*U|A04nzubgB^^sog9=IGO_E@x}f8x8E@<&ifIQqm!e-*FdldD*>(y7ycFYeY@vd1
zAoExZ7nn1Lmn`K(m0)Ey>imciA0+W8iVg*~tNnFkB)f66ZRkQBM@r>9uidOhePd%V
zLPH}%@4OYOh)2Go#pQR~BWLwTvA6a2hX=#C%MLZFLJ7ILYmgM6Y4eE3g()6qJ*vD$
zfC#J}65xs2MHWb`GVCMuv<gYc!zQb<sb^h)zKR&jmUnkhH5cFrL5wnWLKQ3QusFgU
zCin2qpo8KM&CDJfEhh0e2D7{DJ;sYWsTo8tYA)Rp73Q076ZJo-LGpQ6Fw4`R;G{;m
zK^9ck+KM0D8;+5zMSE+)t{^hasYFoYb%cc2=3@sgF#vji63Mn;0{Ssu6=4}A_$_cI
z>g!vv5l9-QY9+b?f!@+gcI9(o^WBXU(Klw@SsX}=3}<LKQ2IMF{woaZ5*);IGgXg8
zIHaeam9U=pbM~W-<}}+`e4#}f!pcOY(yZgW2tzsSDKPPZjW!rDv2mdI41rET{o4bu
zCZMc}st#-n&d?mf=Y%Qi;#&(LTFZR_gtX%1@*z|W6RZ|6J&94g#~%gd=94a#hRg5$
zF@c`&i)1ucWD!X}!3^)t!AmYhr;Mya#MFUd!ytD%iT~>hhw#GS8=QC_X>lgO9_+*L
zGsi>tqbFc;630an{gpiyZ}JVE%EC`QaKUji^gx44CvElpJSF_~MmUI6&5@}2voJO{
zpf{(wMo<G<l=1wZeMGb_b_6VP4->ZNAgjd*Zk*7?<6?jwK^hy8(p;;g2vQQOCE@e_
zPm{`F3>UyX`QQh*Dd4k2wjoJ6clUoBn0N{UX{%qpe)tC-BeG0q&x5p9izgU@G-2<+
zw}_~%O8l#UrHu=?XTp6PR$8SeEZw%L|Ks@Kj=uXFi=!ne5UV2LKIT8Il@(G+1xSB9
zgVc*N44^tW{@d%2ijz`;)YLmEfTaM$$+nm{k?N0n_`l2!3WC(U=0X0PB{$%vOpO<h
zetnO(hDPk|YeGO}><B#1E1Jn6?CQL(Qh+f@$x}v3g;U?-y?(ps_=$B80No}VB~%UP
zzXad9%8Eo~Q1wNkbx<EYAmstOnD**35JA)#V5ab4?J+iZ`kn^lTUw)R9%kQ+F@ye5
zRdCTVD_j7YpS6v+<cL~%HFKEYz!wO*g2#>oocXVkE0rMg8PN7Xi5;F3B#$@jW$@Vv
z?#7mbpkT#f^yyKG2B?2?!ObPXfI4f0J6p~{CHWoPsS;iLw_XViAi@af30UbR=$w8r
zxMXT==s`=$))0mM6Qv^KVKQOkW}2y<4+(Vj9fh|m^&n+_SIAQ?y;1O%EmEfkMl_%t
zC_CE}$=BV&IptU%CA%WXh7TRuu@jIsY@I-g9dD33s+3rx1rMa^MuwOS;?I0iAQYri
z22C48dh9;#$e$wGphNXjWJ0<8`)FoCusFdd9I8Pu1*877ER|vATg2t};NA%4>lT_v
zkOlz!Kd$!vOl)T>#*6THC<1i#IY#+TLTgoIb*eSN*OgLjx_f(N>h>v=wr%RYvnnpB
zwy8PYdeV@5x*naUrCd7gdKL8E2;8(91nsH{VH<F#w=9%lYIQgZ4ss6e?tX7hK|F3`
zip6lkV69#fcH%svS&k7oOq7#Uj>~!$R7!QLOewO6A9Mz2I~SYHVG8vlOVWE>^<~6!
zI#mnA3JD9ly62?TX2E<*+G^O6oZ%KjDg~hAxrn1X*Hx;@4C`N)dm1oP;46_8Lk(^M
zh!Kl8*Y)?e!jLNr|7ZD1E`v+PVki6kHwKA0trX7_Au<*h?hZAa-Pudq?X%LX8u~>6
zT8bX&yYDSixjfj}(Q2j7!?^VI9?yC^;f1c^3v7Ql-qqc?oEi2x)veICd2NxufD?Yp
z<wB}13s=TH&a)Wrs`p`fX>MH|lORdmT=L^cNQF#(^z;q;E8eO+GqYBK^qou+U=t|E
z<hc+ldH$%O2)fX>JeA=?KemUirth%!woOJh(%>p7Zlwt@ZQGE}EMmV+EXK$KDOCRY
zb;^uFDSYNV&R)Sh&Tl^OYwK!*xPb?4s1J|c{wYj`%&#g!OwDVgBl;MdiYi0;Zic=Y
zMRq%FH5}^#1XQvWPBeoilzjB<V%;gBwQ513o_fk^CW7ke`*vNwPpwTt>vkT|*Unyw
z;>DVylI0tUE_$w;_mwJt{-0T$H<Jdz{J+hK2d$>KHg+oG9z#dtpt6^KGGq#Z>H_Jx
zOp6k>dIEhEM=htjJ9)ZVF|>k@&#S4g&kx%2Ka5t5vXHitnX|rf{f!&VYo%@EM2>xV
z*&eORWvsHV<n;$IgZ9>r%RplD;<~`;*9>5ZUOY+)gQXUGLm*7znQ%;e4t-8?1VN%B
zZlnD=kjjN1q$8}l$w)}}XIs!4V8mvrIY@BI!U5u?S+a9YSPZ!bq>Qu|V$@@SYg@PD
zBI}bs{ua)|tBQuWP)Kwh=kG1Tg7>)Hi*XlAK{Z3#YZKse31&_}lsJyuHm>S&>hEeH
zqdNs=H-X=@1IY-SlY_0&9J^^r7Ie9pUjq6AIXHepVA3#^92-D<AU6j?Erx`b9nsf0
z+}|pYyp+PX!x(f}l}U0m^FrBj0OvFW5utEV5RVRlGReQbN(SEy7>QH5gs41jIE~&U
z{DYEl_6tKxkXSYKgUf<%fP*gfpKSK8-n`^8fF+ltKrZ4Iu+x+MCsXu2Q=1P7;jVmw
zuEB9=Fv7zHh`6PMA3AU%OHt!?I3qI*>*K=m6A$ezHv;YD2~PmuS&~v8%pwOc&RSLM
zfhIZFKa4oc2Te-FglrzsNi15S$Gu$_Rq}Z1EL`N&ib1M&kLL#{amXy3Nr4|$5PQy^
z2<pda)+Z3iu0@9vf}-+(NV*<SkB^n$y5tZrMgsq7B}Wp26<&jb{lE`_X+X9H{hu~Y
ztS*4|KHzvtQs6oWSqL9${?pVH_(xH2P3f&GpTHNm0Dpx4n^CW$wU2tT)@xjn0%lSL
z%8>N`ZR4_Zg*E|J$n$BoH*W$Gy#)Vl<A8uM6nMFQy+iO~fOdQM|LsHk^^kCQHHfk?
za4}N|Y{ilPwsCN&mvY74mYHq`ps*4l)iTN!Wcsh;>i55CQ4EU3ylRRQAIULWR%}X1
z0Lz0uT-}CN{MUEHs@}s9mlLx<@*|i<h=h9V@6x%86{ASu`lL-bI**m088H(uotOTb
zoIpY$nBeH?2Yv{!L@WOR-hY!5a7HG8B<Q;&hfc8~a-EMA`3;_b>96ZZbm8eGRgWl_
z8b}bI<Q;iT;ekN&p<0^AfJCv-Q$qRQ<OBlJ5GJ|MU+;i>?gAjVh}1n){;j=Ga5@?J
zAH2b7FG#uY-#M&cPxhcA<rPu@qq+;V4Qrrj_WBQzMlRPPBy(f{_3<9E#?B&T5Th+Y
z5I>X6rC*^#b>%@$HxC4NAxMiurB#gIUxf|R^do>&Br~9lI6hnp#un#qOAI`e#f4XX
z&mdHgKl0iFYe3PHXB-HXED2y!#s3J`L;Dldtj=_YfiF7Uh@`+*r#sn8R)N6f4TFTw
zS7@}*xhwVpQImgdgUso#5Tru$P(8R5>H?5Q@mB&g!_lKh?*niMSYZOc0!7t(B*np;
zxPbc}9;h-xzm^2D#oHrbxWa(nMm`n~!cK#a<FDl&W1j#ZuO3nuD+z9!6BMc1MOi>C
zL1+!!lJ(#|GN|j?hP<HSX=rJCK>b%=frIds7|fW6lgl8$rat}!sJO_Gc&Z-S0Tk7Y
z8C-~Pe)?*`&p&oqOc8<(@%m*Q)RWVSrJjJT$Ov@Hxe8oT8A#SD*KSU0_dNo&h06mO
zAaB3b4b{DlNkZf{#H;Gk%l~Hy(ARH^%@M1)HCliiO42$&Gd|MX#j&+o{Ag?(ZgXbe
zvTb_HvpW3c9-q~fx~Me7pD9MX_50_h2=STF!Vnz`{wi>@wzj_h^b?Z{aPm+&!X1V=
z2c?Sx6X2nY%FwM&x-ol%H{^#P&J2ixpzU_Ne+b~n^8m(jS?jGUCbl(1m3qAVSd95+
zZLsn9rs_GtVeIK)7xSq3<Aa}CAhv)3{Cv_@14UwdS2RNMWjzt19@?AlH2N7pL~1{6
zb^dNKZl>>Ac2p<#LsyY})G?|nDH)9$R}aMC|5#czSO$ylaUL0Z<$@0x0EX6P96Isy
z=Mn7-w{RNbPk4M5pDCI=N=wlAu(TmJ>q!{r4L^{`Ye(K%Fl!q?%+OZpwx5rNtE{{b
zd}h7WyY+u9Hvg&fX6oFf9<-j;NaD-g{U4~rD5mG5O)|nm!Zc58#An6-#gFa(XsdTD
zihWrIc88@cg;USKJN-)GodeS0dkl;E9ta%49q;hkQZa<)69C7m!g;=bjqfGQjUx69
z&}Y1Y68v7$)<+L!P6?$s<4<31qOaeIOVq8NZu;C9$}wg>@{5Fp{2;DEmeBh;^5N_e
z()tm_gW}{x2=JLv_(UfVBDrx8POj<SK)ApL{(_|^>KEI;j@Qu9L}V^G>tFJ5hkHa1
zlx#Tz2Npx=v9t5UMQstTO}RdIMDN4hrzwNP|KosRZSV@%i$P=LJ{prMuTYyYFBtkO
z{NbPkYp+msc#54y!OfWBl>An41Aw)<1X$S%!mp(NIo}XVy5X(z%^e}3O6=}2&1^z&
zBp|<kVI|T>XL~fUx36lmm9C#U`{RSVAiD#yg^)%=a1M2u?KJ<IPW`E`EyK*+t0Fh0
zgx3pIvUGSN&?`9Db=7ST&p~IySYm;;4|CPZd42RcMK>|CZ-b7Mo$kqD)t4$;iOA>;
znzU`t_x(Rw4*qY0ImfnLFjX%-z;dpg8+n(QCyH3IW9_T;#Px>B@vkpk0>h+M*K7&E
zrGcVV`Du-vWhqJlqeAoH4{{BYe)$#+AGP$L?Dwy6{*^Z|2ZE&~`^MM$cC)K|6I`>M
zS_*<mcfLG5i87Y2d#QIcV>n-TeycL|U12%B?F}9i=Lfc|ldBRB5Dd_PwEq<$WX*zz
z&3pB**|)T_B}VjEXwR14x~ei1ldCus`|*bQPLW(-*w2^Nm(yaf{EWO7OIijkG1ors
z$6g+v?9@(F4Nhy@%c0T}^<4Y^e=@uco$20CHxyN%$7{|SbX(y8o6DYqhEis>+hVl*
zp5Zf<f#fn_!JOprasGuPxN^;+xWU>^$kG6{zD%a+#KdgyTK8n^;{SNKf9HT@#rIeH
z+1T+hGSMR1^iuI~{p;Z6N_Y8PlCABSw+xjT{cJ4s&N({Y^Fr>O_B5z792oJfl4xmu
z&BV?t8))}Yxl%z=lukVI@2dXK{&}m7%mwm&efv^qqHn)jkJPeoy-~VSH(xEr!Ld*!
zO+%cn{Jrm(D+VRRJa#0TKrOQ|I6fgswo`Uu!ZT~zhBK$T>K}=Sr$CGmg4l)H5gU-Q
zJ$nq<gp{91(gGZyvruztAMVe&<8_Sws*Wol7Ef&7*9G)y^E=*lyek$18gSXjg~LaV
z1;L@3Zp@g30Ji&XXG(=Dw6x0>m{wMHbi0<XMnT>~F7~R+bGlN~&NOAS3b+p{5!mLo
zoM!r<m1=5IJ!4~=8L#wJr}T_-JiP(&KWe-I(^Fg^rWaeGu$HN$IlrmhePa2;HL{Nr
zuZ|na4OzA=?A%MdxqO)R;|Y||j~{nMQOqu78bjeb<uoo2Y<FMtU;Vp+Vr{5dhGb%6
zIbtnnJwYz3+=R}A&vc&x=tcD)#gyV(MOPep>U&@IP1?)Oq7B5JkU7;oB^9<pLvC6L
zaVi4Lm06YP(}}PA^GwVw4@dvy@nr(-iF}2oRk<H+E<+J(Uh?5<UipG6ho;=BKLl{2
zJ!v03`aqA*RlZ#CEh<mPi8hR#aKie6H~p7<1oDrljnUINgw<)v+W~!#p+su`EwodD
zJ-@)WLao1RdDbJ{w1ut&YD%|#KXh^4*;X)cj$EtIm`m!PNRPSGdA}giDYL`}Q=HK{
zvHf>owjL47e2tzH{S%g9bX-l;6G?N;p6_QSep6iSoJ0>lvSpDTgf9C}pFe{k+uC7S
zs?8;7n@ki`E_EXKx7dlL5M(T>(6%ckNRfaKCf7=;DGG7__fA2(Yfry{%M%Ll3G%tq
z3M8*@AJ!4d>9jzs_WVykkxnNt$P#B~x(nz&*n#BMFWQD#6zS@zB>q1~#EO-Bw4Ef^
zv{r$#W8qw?o7l_zOb-15&3R`hAC*iUrM*YD`J`_#{Tbx3%}Ul>qgq~p?BzY>1X;)b
zpFz$}F2q<jur2|6KRIn<Tr-KCwUpH~WvyDB95mF=9nynlancyoLzyw}uk}J*t?~h(
zRV44j7024?1W(;nrAh@6{T`=K7vm3o92qrpuRRU6ZJFlKg*6X4vs}6#r4R=H_^U!Z
zj-m9TOVoHR`#J1&`!(0Hb$K2hP4Awp*JVtWeY!MZ_$h8EAm%z|*3aL67vr#@Pv7`%
zqOu{iZnD9nK!B>|_`SYA!tG&oG_k_(A>2OZM3F%(+F6&4)hKv)+^^HIy31y6^dX4f
zeQ-1-g`6@eTHhb_yxm{WC%f(`6uj)+OGYy<AaDC;yGIm8qHpnjoz}N+80Hccf6J2*
zUHF0CZA+DIbG=UaqcVZx_)oe3I@!NtGTNcp{1K_2DA(`uUS?3%RoIjFARh<{SMg}#
zk?Jlb;^_xZJ7{ax#;7|u`<|0G?MXPv2zin}w_W*E&k}n9oV&Yoq)_7Q6!Jvc%vHRg
z8_@O5(>@uUB8$Ph6;r@j415YL5^67d^e-gqo$UtWwu!I}`2SGOCRvSB{>Q|Ph>av<
z^EQCJ_!`@6!Cpt>s@NxF+@jCgQvN$+yesWO?UBc}izqTr18E(dS>LLS`r$@Gdalq~
z(yX(z0Vz{;j1Lfh2xmIb1!ATcolGsB56#U5#FpJz(XL97-N5tUpxTlflYno;E?j7u
zL*Fv;^MygDUI|5&=4y&rMv%au|I{^+lvDp$Nq$Utxk37qa{gNiR|{Y1d|&p<w-0c%
zuaMvW!D2FCp#SlsB_ZK0NS%0p{=A2NQu-iM`1g|eX6;o0>qkY06Qe`}<5mB$1o`-o
z`C8L0Saa{1!Sb&Ptmzi59pYVmaAbRZcJhR_i;^*QvNK*3al~9pfp1GHS5BUtuy*xj
z>FeHhRJYIkv9QIM4aYgsh>cCDRAm!-$6rYnuWwr{c$?q46F;!>{akOwy|AdEk55;G
zKSU(3<TCb<QBZ6%D4suCB)sHdUcY_QDL<WKb!MkJunsCff3<{`2MD@qhKTviL9(d%
zGF{uKYch2_i9%G@MCvM*yDMh8E3|v)y0n5)g?#3!n4-7)Gc+%kr}q-u&&`Fc<Q6~f
zw!VJ-LGq=ifAX_pKKN|(&W=k|_4^M4b?lX#O?va2^*EaLA7#Fvxvbp~!p?GQU`X4V
z<|=?D8P0@lGjiYQJHFJMPoHSFN^C7vx10EcblY?HRnp(pLnnxpK<ct>ixQ>nVPooN
zK3rfnylTdm@7vkc-5$LiNrg(E$z<ftFiy`Vp}$)8>+|Ea%R#rZZ;C|nzqluN^UqA(
z-BYWg=nEU7=$8|R_Btm*E2GYnH|%pwbM%x;BMN6H*DgK(fsXW^lZ<n_k$)C+ams%o
zaYgSG+7u03c6yu9U#$C<FXb#t;m-^M(I}IDB<^1x3pNVBl$dzpCFP7^<Jw@`Xo`>Z
zZ<9=aVwXS1?Ho&T)WCYt?L;Y_Jc=Xz&awzp;g+E)qB}$qlKr>1Xngt7*y;*07?@~$
zU*Dh>#DPHmC!|1JOOKn51WR9DtmZo3ihpd;t<gN+rL5;PX|`!N-%_%?%Vo}zN!lyQ
zi1r+L(NkQ{<?&h6@{Q6x<Ho`r-FJ4CMHX63+0w0?e}&+G9v^@5YvVA7oNIm9p!4%E
zyF1xk)@>I_E@y>d`R@r@tjHORg+6iIdD>#w<Re^3Ctmt@dH>ft(TGzdKH4}{$&uYm
zyth43Czs%~U6K}t?IEXU8&sk`bm)+X%yn@UzHO$Qd&VB}o93xQM_LYi<i7{`&$4<X
t63zCNYoF#CKCd2QBQIr)pX{{jM&xDHf90c`8$9TcjHJT#tZN3I{}0)^Z1?~G

literal 0
HcmV?d00001

diff --git a/docs/manual/_static/pictures/pki_overview.png b/docs/manual/_static/pictures/pki_overview.png
new file mode 100644
index 0000000000000000000000000000000000000000..138493dd955ee186ba90e88b2a1c03931b257322
GIT binary patch
literal 72469
zcmaHT1z1&E*EJlE!l5~oNVkB1lype9q%<f<OB_Ht1*E%M2}wbu8);EMLP0omhe(R_
zzmDGb|G)3v_x{gwd{jjC-fPV@=NMy-xx>}f<Z-cXVWFX+;VLS~XriHA7eGUUFks#Q
zU-_!d^%4z@7EMv+zP5+Sb~c6wvCeVt+zc8l819AJYKV577@efb?0yy6Kq!f91g2kD
z7%izx&vQ(+=dEOtcN9+8X*Ff;N6^x?rhZnWm3()#X4Dp*_#x%n%(rjfW{$=2W7CjA
z$H=+t;BW3~2v1RJd_jc(=)ZnwdodesJM>P5j~K&g(f{ou8?eai2>rKzh0_M6F-jtM
znPa2X6479B|MF2sE{jP*82{}<kO&1gvRpM{^Y7O|kH~Dn_}6C%fSM(s^$ezo-V;{+
z_v=U^5|97o4pDb5sRDo5K%UqqSETsw%XZsgpZecd3m&EjAr>&-pIqnr*TslK>rtJ(
z_OFW}3E@@@ShQ53rpRXg*IfZO`oa6(Z&HDl8K#bm`e2?v_W!vKv4AK3zwH?KdN(6j
zb8gS4t{G4T+J~6u7sqpx)mE|2_3E#rtVauAN=dil*Dj}O?YQly_zr)}NfdK{m@7AJ
zr~Xo=EAQ;=JX@Qdo_>?hnn2inC#ueVy0r2vW6SP+tM{?gxpVW3^;8Y3rj{1s^w8#x
zX&dF2QXT1@2$G=v<i!87{Ir@NMC2mwd{01aAR3`SDyMNoPbAsWS3}2I6{M)&xuA*H
z2Gil@7i^1<DTC%5QmbFz7;01)2{9=R?D9`cqYq|_ko{=C5_f37aLW?)gh$`vm-;?c
zTV*rGEc$cOyy4ek<d+Q2)W|jE{}MnNEFj1?<t0%Om?t;C{BU{46PD8@0cn&+b60Fo
zGQQ^Ca|MwtHC#>M7S_t6mAE>0IbvaF$NoND-xo(G{np|mY0LTk$4xtayRY30v7&jw
z1CH$%4`ppG4~8Xfiu*J~<Pg6?fafpPEW{c}<%*4Gkk51781*<Dk*|940p4<Xx@A4n
z#DC8Lx&CZt`&;#wbG2;Yh24cNkG&qUk!E+tXER`fVhw6-SEjF)KO`bH$60Gv{jbhU
zpK)OPmspg^1n0#%7j1$C9Ug{-KKy<-zS(@8Tw_cS$+S>$iepsRthbn{fh68TT%Mn-
zPuFvS^(-14rSV#)i=q}Y2#=<J+II1Cnr%Q!rW;1YJYQ0j(+M_t9EpDI#;@q!^X0?`
zNw|ap79NqvBn1_H^U1f5^%|X-NI47&^7#8=sLG(DW<3!r-^D~kDDvf^JH?KX*9e6S
z>z<ZeI{lZZl&nET^iP<RFUS$ou-lJa4BG>?n#N44W#;)JGU>%%7ZsHeJAU^*p7pMT
zizFr_s23;@lBjx47`wB^YnFW|sbAvyf{bcNPfX0u<F9PL^aA_A)v%nPtX`tY6m^pu
z@<9BAQ7M@%xlcY=olvhwf>27g(j?mN;*^_TY@Vtc_Rpgf&kVw1G}tB=s?ebU{e+d7
zG4>EMOAg`kwOoI)){d;n{YOl$|0Q|*#m`LJ+lS`|!%J;vJ6bktQ=d)khy`S`l1@_-
zQYvU>yHy=s3h~y*OSF<-vZ;n)k#Uv>4^lX`5Rw@=-Oo`B|C+?-wx_H)=Ds}{xR&D`
zQ?e1$RK0=o_kCq#21hpBa|g)}V`N0H?6kCHZ(zp_X0PQJO+SclUV_bcZ~FLj5(=97
zpS1tlj69C3y22c)NDU^$Cy@^~<HVuz#$lB;Dt`DO+KiR+a8nZ}@?loz#~)U&6oaG$
z{W^oF>xpH5vf}$?xx?|Vif(>&5YIk#N9=B;v+NEIf3sFEBiL!UCwn6L<P&%KTtd(?
zz2q5o<fC2R5(Py!k~G6+12`VdV9&(^D%n)K1ccTZ?}X#G^q>Vt%D$m%J#k5z7+txZ
zB)nEb+8PD?w&UvA6SBAMCn~74#)$Td!ZQDn53LAaHf)q1yc7UiLr6cbGpS+|Rd8C3
zU7l85k<A1tTAQrwpYd=Bb|Y^4HbX9S^T>qs#!O}emIcxTrzu|hiiNfi@hfr!^7nNF
z@h1}i&IhJsp&|%3E5hC6h@FakKBE=t+w<it=AzE-c<j4Jj~E191ZHmxS2Yej-;;3c
z^-BryR91WZxwXg1B)?PK*EP9`bm!I&VP|~Ti2qWD|0*S6c92Wkr%iTk7`h+uuJ;Tw
zjKwvdI8+)vClqwKbim4*BANEV)|J)FFRW_C@Oto%>_kwHs-E9RoXx>11ZH3~4jctE
z4^&^5T-ot~<V3;5(KAQ{T^{m7obi^wA#~QUb@w8veDCI%w|7(@ANl*LutgSB?@!P^
zJG`+@`Hz*5lmcs<uHH8|m>{`GfXVpOmJ#`kxy({(N?kSNo+}pSKvahfvB1oixd8UT
zMt(tyu^j2dxaL~2p1}ZjG?ss!WWhjC|5&mhzMzV}O$yL|tYtW!>_uqQW7y^LR9rM2
zTjdO{FkjGMbBl@Pce4NAw<M_mp7up>G+8_vOfXsUZKq|!*)EHdCK4x=vl8U8f7IqH
z@csLEbRf&oKv?SOt&F{CkHdVuol|8rFLDFuzhIXuBF5Ux=av3>yu(q2*eplHT@`{*
zq;)qm^}zE>_jj!5bSmVldD5Pv)f_l>hBfJ&+=jd3YD|=KHTbf@2Ih7PT<jmWk&C*G
zRq*973W$*Z7xtUA>DpL3&SH1I<*!Xbe((!1c^z!~W0l`WjKR10r2etXk^ooyF4x@>
zfmtLZ*bbw32qMYRMsKk9R~)@m|6D4;C^QBEDmPl!P*A^JQ5U`L9D56g_&Ix{+`8N|
zT`x5nG-o{0nibB#g6fIB!iL5llALVyAKwO>(vz2Hm%uab*+*CoX1sc~^|j&WlpT@H
z8It{fZw4A{QZ8WewS93T0f0{hFpoEltdUI#<@!^JOJCFk`2~)@PlqP6>vk^f=`EQP
zJS^3%jPW|!Txsrfv4%U>|2#dmQ?!V8{kln8?p#VR+3GEj!eRIV6i*`WpWE*PuVL&i
zgwnwA{(jN8fF7`#1~^HpsB)|z`AoU}j{l)$!PqF1ZT00aox5_bfFt$m2f5TF*0{I$
zB#(DySRJM$ukvHXrG|6Fs{Agzv@49hy&!3X{{2TY-autg#1N7R#)$K$D!!R(KZ}0b
zu%YIUTQO?fvTq^%D!B2xiaj4F?;M78-R1h#x1BQRdlmm4Km=(Zg>*y-27&eO#at#5
zoavcoL!>i_>}Kg<JgNLxz4Bl(Ns(B9<2|*moZr=j`{B+EMI;$lOqnl&_a8ru0|Y?6
zY|a+gXqhC*KuonrU2Mjun#h`)9+c_c+f{w)O|CXLxA<<yxb?jG`>~UB#RSz8&%Htk
z!uaS~paLw*GFUYt^B$#B6lazHmERXd->t82oEnX|o3NYyfuM(IB@tufYm!`Gx#?v(
zYy-#2-;ygLTqY`v1rduflidYXs!B>q;v(BA)b}20-54Dkt8!Y9(k^>AIPRlH|ButK
zs|HBL4;(-q8dx4BcaTTDB`<IAG&`c~Sdn_=%&%VTqnc~Q<A3R+l6h}1fwv6A;_1)t
z%HU*VyeHq7tYX+{JvKo)b>Y4@?*I1pg_4AvfM;FCy$@lGBY<|22nLbd8w|^AOb>N(
z+Sd|1Ut0IEQZJCx(q2EIUT*KDBg~|CGT^rTQW^rFtQN8cVi|W&E|&U@=IGhc7TI!g
zmfAng;!A)A6OXTfknbeG)S1VToy1{uh<MxR>%_ZEjf@&i4qP^qd_^z$6EQ!pHouH`
zxfsBzVDFdzX05Bn)!RwpXk2U8LllMj#IT)7{+=tsw7^a;9X@L00RQp>`kX{in&jTK
z@XTh@HbRyZRoPlO$ydwI+jeHrvINs#Y*yMo7vUeQTLKvq-!>xir_(Ci-<D+W0Z3!#
zx!mpwVDo9?su$#FT^>tvE?{O}b`K^Rrj!(`vcA#JD|Z)gesIn33ZnGP2VUrSBGBY`
zwE0Ev?W6mWbAu{zHHSaHPp@SvA;xeTch}UBIJtBje-E<&0>Deo0573kz+4W`{3ay%
z5KldiK)v5MKzdYvE1*D=?%;#|7tDU4IQQ1(QwpcTnW%i1xxThN_k2sD4&(m%lWaTm
z0@LSg(re4AaKu<?My94?;-Y1LAH~-YVu7yCzR16m1KL;=pTYsp43n4Sa%lRQ4NaKY
zO*&4X$Z;l3*i?b(&mS^5P@j7>*fMIL`CP3ZJ6?PDag|Jf!B;N|8O682`x7LGuJp3M
z9!63S%EQC6J7MZi$I1!=D}Z7pI?|Hty=}f{yZsEY^Lu?X@?9@*rFl-kpUlCz@c^f9
z-i^#hgC;_w1O~p%?djxObihvfgx0cxmY1JUO88N->sH7F-N02Z)n4bilHLoSKwVFg
z7VPyk!o_3oREseIHV7>@>K7dw%1F^FFFZH#X}mAPLSr)h6LI~j?m;odhy4O|+2}p0
z-s&JwLwR-oDl~ykm<n~DKpy&BXK#4^Ybn-xwneDPbpsyrp~cR{#ih#gz*75-flhen
ztEh{!<0Swyi?vHMZ>N$q$OR7$i=W{rr*ii2PZ$MlZ$Hg)pY<HLT<nS518_Cpu-*Zn
z(nO}M5lmF7)B|$BYaK=#R7tVKgfclmoF;tmD-x)l&*pL=4i4J}ColE1l5QhzT8y=3
ziXn(68}V+R<?3o|W`qWrh>T-{+O5RduyxzvMqgz0Ut39g3o3&oM&FMS+35ghaBoQD
zNAY%K`_&}{5sO;)NWMJc15@h!PV<l6)1$3D@H?A;ETzwUAcppM{wKp~OI*(8ZJzVP
zu?HwB6rYgr{CyCH`H$IFkF7WL+I$63vXP_<$+{-*7rH_bA35q@%EwaofBMwDK9aw;
zRoR|r)aZPZ+YE}TO<>chOnr|?Dq8lHMEAOhHoY#8`zs&K*FV21e)uNCK>BF}E+GfV
z3q`@o`7?mNEHtj=XiX$@8Vln$hUGZ6?7etb`}7+R3G1y=T8e0w<qQy(|NHn6L^Y7B
zY0;T3zHV@tkE9bk9CT4A!%X7F%wnkyFup>&ZE~G|cJlGoi3YL;LjY{Gpv#{O5h%zQ
z=W?^r+vGXR(sxLvOL8;KPQ(>%V?o@=OJ)bR9VEHdYZVQ%Wn=f55M5JW5<s)%!r@H2
zo!DHGZMlhwL4Z+~UZoNv2(N+rlq1>uR;t5(NB<oZP>eu>JW%8}+s%rkL-9NpUt{Ld
zKUWGaz9*x7u^7p9*ZT8I$n!iO$Eg~d^||);jLTW?A0-Ovgrd6TdVwWcMWsK)E)K_(
z0^VrkzkutW{rrxt*eEbX;yvekoUN2PQ8Y&*>Y*N9^3Lj8s*IzOxe^{K<vC%2N~<OW
zI|YgQ5e0hnqNQNx>!-cB4W7<pnont*#pltHijvM%ywk%%xLKlz)gL`vZA2tqZH^RV
z`eBQ&#Tx$SvF#=g%<Ag@=0xOVmi!|+L_@RRTDx175F(q^vRPU-PD3bocDNCQMZ#8W
zkQItYrTL7PDM5paFM@**o5@y-o|6eu1E7vA%ye-TkXY^I<&CkTFSh{Is(`DuU!K}A
z$wXLxYxQ<7c>S79L=K_Fm7+Azgc(n-5JMq=*XnijT*k8Pa8!Boho-=owXUtb-|0rt
zO`a#15yU6;ZV3ei0CrFu&$#EpC6rU{d>B6zJR4bbQ=t8dBDF_E1y>+W?i1Z*cW6>_
ze<9+l^7&^i_IY?F%Vkbv_OQ|Bgxg-7dtPS{v4FHV8iuI?V(fjW^u!-EEK9K?>TQXq
zLwrZc1LX-7W#W9y;8^if>$YBDxmVo82rWZtnO=>2xyQeD7d$r>H1iJt4ANx%4rkp|
zMN*2m-7!E>?x#~Vutb&z4>$Jcy>9gkzO(qqM&Z>A;;0sG%QRK(Fw?YomXN@yktyP~
zEt$?^p>0m5XhSxama+4RhQv!260QJh41JF9u?hsH)=}QTng&>A^y2HX&MqgCcA1f3
zgG=_GQ54I^jGCDy&#_u_s*h?!`&K)v-4EOCn3H8k^~>y!=m<&k8`3e0K8gK7vwCtJ
zsc+M#uqqbcEC}7B={HLA7s7_BIWE2q^PTfKz->F<SJu(u1vu;)2445hOtY%ILxdzN
zeV&Z1lJ?r0`q|P=yNH*p(zc#oD@{!c6O^NsOIBDnRz=)*x&zR!sTV4d=y<#AARF0Q
zjn3neJi^zLij@iJWP?f2A8tOe9mzQDR}E+6pL%25TvtlQX0uIi_PVgJ<TL}mP!is_
z|Lo)vNG`+Ut{)woZUK~onF{cp6KvlLrHV3ugU*_X%`Yal_TzO&iLuGalM3O$s2?%E
zEK)V|@3OgF)TeoCOOlla7xaG2f9ER7rG((kd64SO@Ea}xW`zHE%-D*@sKm-vcVL$?
z{RMK+-H^d))soIii;VU_K)K#5vuYeWUVDqT<D$JuzK-Kl2r43Ig#k8}3l-620$hVW
z@KLv_?#A@In!gyMqf0#!cX+|Zq*Cm34MCZP7_XdJ9tct27~-LOWB)}KZnIf&QK++O
zz2=W1D-Zv}VThnUn3)yMV)GUIPtmV6isS~cm`hDUtad7j=D!`kfMH~d^ysvaA(L}m
zD}oNAP)zp@5QWF2()eT{j06<WPZ5~_Y(#X2f9cnsFexP`L38oYV8$E#aEM**l+LK#
zc%>p%u#Q6ph~-LTL|6>XUOijS;4cxaov`1uxx)<N_x~6&>EW$b*6Qaf8pHZ7bWYBR
zJrwW08O0kY*f#X9$~OLHuri@wC)S<TO2M(xV0`otiNjB2+|K`C)n|F<7L3vq&qHn1
zck44(pOeS^6jLn4o|)pWMOhaGMzR5Us&U#Dg6ids7h5bH5yS#S^Kp%`zad)SXBgC)
zdigII;I@Nhl>E-n<Jk#Zsd>Jys`BwuP9!m%y!r%Cu_B&;M2f4{=g-E1UiOuMd#D0{
z*Rnj9_5u)8%!~kigcgn=os*Y~(-p>rlSglR_GDyz+cjB=`mQ#ZSb=R)({fVT-CI8U
zm9)1G<rqBPUtXLc`l#HC7f(!m_O9RJvktJz@x0OX!t+X!E@TblGur`%!Jkp&y!)$m
z+2WBvW9xW9eC9azI{MTrky&;BoV!*piCF^~1^3|mBX7?8KrEZ`BGvV;)*#*=^xer(
zc~dNd7<Fd<0JCjtw?9mNqFr1Q>3ZlnA_SJf4kWCa6qYxDeRrdwg6msM<#>@(U6bRv
zn4s{nn1xjEAXck5)X0G{`+)OjtFLKJhyGb2<<YaE=tn)Odvm#xCEp)#Y2P~DR&L;n
zD5dc~uY#Loi{5q+K5<>A_)W(o$1&3g?_I5Bu^-U``3kDZ1>qs1bw9rC!9xahn+fhv
zMDX5~8~PodEGPx2VC*FqSminbOeG{r0TP}=Q!Ko5WIw!a7}w|l*EF1c9&ypu&+=&V
z`cMWDUT1cO<;K**n+GfoxAOUpo)=0iAb=9Qj%?&j;WEX$5WSd)hLp_4vRAgifilU%
zlxOgsmXZR%&sTkRe=y5pf+Rtw<>VPYElPRFyo-wha{+I_v6+g<j6_Kjfs#9`A`3!1
z#*K@@PVoM{4lVJ<mv)5kdls*Z87iNbIbpHkrr|UsVwGQf2%tbLRFo9&ostr>>CV6=
z_fJsCgUoOL1Izl?H<_jj8j&4`DV>}X!<hp3m2IbNhb0>sPHcHrpsFBH`ldv!wr5}9
zS*|p(K(-gpVdU>qLu&wa7C=7X+#jXK&{?+1W;J;OFa;*h;O~1?Mcpej<0JTsU|2_Z
zdtCLU9PRNsc@fWpYb7E3A~)|p)*=<=d&W3gL4nCg{`E_^=`%bI+0^&>8pTo^81F@v
zl-@4BCiP{V@FJp)rICmMF=~GPYwy?5gy~4rGdnHsuTYKf!)<^yb8w4_UTY!wp0#Aj
z{N_?|v`|qD3HhBmzq%h^b?u);WY*DKCu0POFYqnkZaCO9TtMmz(}&0fYPH8>VrN>W
z2^pVbJwzVfGabG^C(~cvu<`vCFJYeLFL|$+v0;JHvm%r%jQV^g+MUAeH-_xIGv+`~
z&TNGC8)$w`sqB?0yM-=<vA<gVDvqg7k^zJZBLO!6-wZEOUVuHNe9)2Ev4Qqjs{vfe
z`FTT0VS(whFFI`BTc3V=he=GgndCjXv9?95b_m!!D$8<XE|(YUIpr%B&T~$5!O?Qe
zv3*{*uw*wEb=-<V)<8v~e=oB=YMEbTV534JA;4tbHS8^U?4l*@2zOGAt9h#H(#6X1
zxNAga%(=Z}5$Xp6K|`ja45$qu&4;Qf9!Z(C5W%+2vNs+i0@d##7n5z=4LiBwqqIx4
zVXB$;WUDO)fzBN-GbMbi1mRW%X-0*HCL5%gx4{9JSt2=-nuGXvene20`m2$(KaWO^
z3tV#FyFPmJ#O^lZ#K+@WOjTc{Ca&Joup#wfI?V~83m=AB$0<-cey^q@)cI@eHMR0O
znwXZ!3W?^9ragkjbWi$_MN3TgaZqrp0N6c0S<5ZWISV6XP;YkoPH<-r4*s(UDo-Td
zoA^!s6QNn0e%BcsY&9}JrgDY0TPv9!9Ga$9tkcJE8aEN!Pt^nppleCYJ-tv%>@)ku
zSCm_6K~YHe*N)!3-(e?Brwb|}hl&xEN5tClL&?jVa)P)atAm-L0H<M?h(dT#NfF%8
zTJ^RNAFR>P`{Jy&;GKdnJJxdq^d|*JV%fttowx$XfE+Pzv-ys|5$7P3l9Gl}HlU1Z
zzll^cOwjmzpT*(StPqw6NW)RMmL2A@y%Z{g3copv+#fG$kN`mUrm$=AOdpw(SW&KH
z2d>k9)MGsrTC1*T$yKRrL9&I6%#t^8+G`Y*&3B0!)8pd<N!TBD02NGy{%zytm$H15
zRxd#O^4~p?%N6%kuQHRB7uPa)cmEb$pdh#<UOc>bL$Cv35)jn3kq88p_-}Bm7;!~y
zw*UB8!JHt>&p)%VM&U1^fh7E$GXs`j%akwRg0+W-3ipVy)U9Ts8aDWH0Kwf32eOi3
zVUfgsKSR86*jEtjQuN>wj89vBS66!FfJNOWCvwxm!va$*9Y=o>9Hk;{ZpQ`$E4i+B
zFl#Ab?H9Qr^DPCSHr?=U(I-S46y^F!y)md=w6{az!@5NQl;`#jMxq$4DE#FwlGvit
zA2}Xvd%kT*sy{jXCNzpL>v0;JQwi*`R>i9Z8>YiwRkhA5N}^Zi2c_?sK#wY*8XSJt
zub!VNP&=;<z3ta?9Nlpc{o`O|=g-mTWF&wEjupHG1>jS4<iSU5GESV5A11}>uLS2<
z>*XO;fSy`D%_eIF0jxj(A#Pthd+GT<?jqniw47Klh~ORrlf%wbt#Tn>t{{T`sUWHs
z2zdO#x5tBnZ>utRKEJb2jsn1*!=UCae{LeU_%<B~6zU<P5Y!2MPA|E~e%pv!AbpL(
zMP4rS&ywZc@4yP=Rd_rGv@EYVOUjFtYm}y9^6{)jZOjq;Kf=aW1-zJQy^d@@j;6~l
zSh!pK#|wbm{`!WZXYe*MQOx_N3^>uWgPcO(GFj4qY`Y9S&p~ApNow>6(>-6_U7w{h
zpGJ{CX9F7+%;5Bb_Gt#80RGjlTX<@>@Z5*!h&ds|Y>=!^kaw}ydNSt1u<%<j+-);L
z2q2ke%a)Ji9)6nV%_1ST34)dbA#2R*bqx@PBq5K9=7Y2*F{$hW*0$D{Ub&!Bq$EU*
zfgqxTJnt>J0`k-O62-RX3Ug8^T2ck1A@MRK*%NcJo?OAkjR6!hGj>@ZKh3Z5W{G7r
zV!@ywt}Nen3xeKQ0Q4zs2L=lTtvmvj<4C;V@~6)qILSy0S!?<jpf!E%jONALjR(k2
zgQCH2E^J>}$4eLM^)*w_JMDZ!)26)3WE#;lK9$sz`7o-chA#>5?OfJ~%!hHfPlJY?
z0?83KU@}1f@>#2|p%^zKK>!*}*5VoI!b$J(iL?8kCyA%~BYn|1O}SVGN^w?VGiBG}
zDX@{eBNF;k94g#({jXKjWFmkRx$RR&ReBGS5P5R1-JD;&;Uv3wcmB*Xu^|2Pu*4PR
zy9cM(c3;cGsl~iNq6@ZklKX{2M#(kAjNS}_xF(Ws0+mt%X)$--vtsIT3ns5o1cl0_
z{uL=|v=5M=({bGP)I*8*MbVR25WmJT)1Wff)VPbI-(r;@o|+$4?eMXq*Bt4*_KC8(
z#d^A>G!LV*%i2&j-C04qdfq+qMjP0`%jjKlPU|NvV2x2BO8Utt7&If<Ap7cifZkZ_
z^v5%J{8|XrXmEPmPq7V@k+Mq1*%opj@~{kv9UCRx(T6k0MX8$(4-LsVJHOMZkQv9L
z$)b-C*zEOe(~y7&|1oV41VQ(^2e&C3c-1<!x^W+P{up*!z|3mv9{fwc!yp!5;t(rx
z_5%&khV&F_n@+3k1M;EYN9H*b$TxasS)h0INF;EnFLtT4tU}7xmhJNL%#q1tK+x;(
zb{inszcs4NqpgWyB5wb)?*dOOEEeY92dz)lmYtsBOPmMv(fCtli@5h*!xs$z6m_bN
ztQvd&{f9dxlUaQS(St7e6MwdPgb4+pa{lV6-4~&{&CzORPs{KB;bRLw5ILtO&`Q3a
zzIu8*a=(&l^E#l_On`j&yugkjvq}swM%8TDj4g2N(&$kg2(xeREZFSVK&M`J0%aYb
ze|XPkR7Te91@A*3faq6SE*x%*0i%Pu;A?s>j{m-T&*1`H)@;klNa80Vq4n=K1`jme
z5YBU^5yoCj2QYXCln!5o)AMIc$)y8nqxb~J3g4<i3i2N1NV&s3gevGs0mQnM>aQR}
zLTi*3x}%?_Ywbes*-uT9>Yr?uRp$9$U8d}?8=3n!VWqyTu3S42KJ!`slY9esVQHiS
zT?F?m)_~%>#BTL?qMv=i`C1|SHJjw2x5CdL{gXIPEFiKJwbIG2zVhMoc*BVW1{1Ix
zsdE=Pm-@;S|EK-p7t`)HtK5ZfmK;e?0d{{*JLbE6pVDCX`MrM5Y_U817q}Zrt;B=c
z36r3{B@Ht!`E$bglis;>XZgPlA`4(-t`q4vy0%+!RG{EmUR4u_<h1lxeut;d#O@zQ
z<9lAHa~3p^W7W=AzG@&B<u$nvaRb`24TePpkc$Fr#$K1a5EqznP0Xuu-O%KFI!ORT
zS{G>cOtZWB;rfWj<;fb=!Z5&|dqApM$aHK&1WUMf8bGK-+`3zjXCo;b8r~ap)yVxN
z?IToxWC3$mWc-p1DafLN<F?0VvRj%>9O$0Z8n)<=X|JE@E7*m45%vtKf4J^W)iXHn
zfw%{oM5&?11&w$x#@m64iOdU^XFvKv$V|deQXAeXWgzV7OcROybX^Z<Ye62YMx`;t
z<>bVKV3Xwmp9c4u2-RO5?Lce7yBrP?L61@90iqAj7TApL+ly>fW>21-n6+a@e60+N
zm@)ho@xjHGE3Wl&jz4jLexv+L-Dw<Vqy|zYSZkHqJRamfJyHHs6$l=))34pfD!Jmu
z&lpp=K^sNq0WVTc(#`&)JDey@#Jys3h<cEYbpzOR`UaBO<5N;dRdpNcdQiHz6IeO(
zgVjOM3L-VEpD<EW!&`n3PcOS|oK^-fEI1O3jDhprgK&k?GgXC=Orfo*Yb=-h1A;Cq
zuqWqE-CS48wjmlNnXzu0ZrMgk42)lL%_nSO)p$LF!9unUe7zt$Mpa$QZ)Ti-0`WaP
zeE$NM!fEE&#4Gn7vubW%Djm&xqu$3*iJ)XlnP>R$4X?v>4bfwyi^fq<q@nWsh&+w#
z$^Htr)4Ze|u6&1qg9B%8EDb*4lj9$Al}ZBrf==^jY&xX{xBNd~<FE?RnFCvqQiJ`M
zQj!Q#j?w{*{{Df1&ZSt13MGvsHXSVEX1C~odOpS9aX|0`suG#G^EpKI@%lHB8;#BK
z9zC9i$9E`yZKRowhp-b%C3_FZ90?k&cy$=Bd@DXBh>g@jM)hf}<Sc@w_MnHL>`own
z@ADuVD18DJsqlTt;3zyQVVMsUcByYn+r|BUEntk7=?)uo-8Zls$-6%5bD+xSI4j!E
zE;JJk1++aFu&A;mSC$wdmsQEl)|i{zQeV2no^28X<va9XNaO+kmF-+xtFs|}<jPvR
z(?aL<Iy$MMuypu!<3?wTBj2inUJA$J$~T7fct2VWVopzi$>@d1PQx|um0npg<6sPG
z4_e1IfoU}WJV9LspKS(|K2raRK(r{XdBe>k=0fw4ODNfs#m`*negekDPvE6L+3aX;
zb}3aX+Ama`(9OHa*`E~$hIMoT_Jo$qtk?koJc=Vgfrv5A8X7|>1PK>E18RKoOV$y?
zy?Z~mzXgFKAZx6RthGy3iZ^}x2t9&~i`p@b$W~(Cg#j`P>S+`f$<X+B=h3)*LV6x0
z*Fww;x57`#HTC0ZB=--e>?(B>P*@+FWAX_j7u;ppF5s!k3XW()AtTTa4F{465vvtl
z$q+GZiMC#jSIpq`cPU*<LW!?vmpbYt=KHrBJ+FRn8W1bm6gt^X?6g#_5OYQeb6rxL
zG@A8bsigDtlyN=V9KT<rmVL+O-G(z0Ku#Sx=Ls)=UVLE5eF@qin@me(m2IW(xXN$Z
zO;ilB>m2ovnZCRqbmL(fzlAi9+Vb_y-vZ3pbncTp>s%W~r>@j?Vgc2KHAeW`Y|x{c
zj(52a5A%fpRh$aQ_3305BxfSdKk<TVMR8CnGRR%-b=8MM?C2XlSG!&K($xD*+0(G4
z$tv^BKvNkRa!oE>&E9Mt(1r^IF0w~Uz0nOIB$5p^@pVngjl4Dr8@|^~Yh#K2v3mix
z2FNK`@JOf{!%UPrb$5L3tfr|O8Ak})gCXfxJUUee>B<P_X{DoQ_(sJCHV(6e86N9f
z1<SH^pI8m=36JFLF*|IAC^5L0cCPRaiv~UJda<H<1-eVgg0_@E7+X8Wb-!f@YGv<N
z&k;kEi7fo{`D&))?n<huoP{r^*NXs5(NQCXyvq!JyVsf_+4M<!QTs%{yZoHSrI*_?
z&1Ce9zz@|N^ZpQIPV@0%jm;qKvDd0pOR41Yq+BLA;Q{dqtAHXFD;IDU%UByZy}#bD
z{qEz_NMZgZuC+g#uP0A?8==+Rm+|Ah&gfKvqIchHpgFd92z#SoDPCqIeeIAI#V0X0
zKxg!~F77l$WQ7MDGEv*cM*}L_2W()aJhufq8D3hIlHEQs6_9hX)yUaDcUwu;Ewy4a
z)yM&=j|h#4DkL7onKYl+q(T=10{E)qV`hNrFBMBIrVaqR;AHX%M}N?3nd!kCvFUSJ
z!kiP3V@hvu`d^+D!H1UVqPjexGOnb1`j`C}$smlTxYY)RkEHR%pyABXsdO}Y%&Hj$
znwLxii=e&r(9p2ax$u-~wIFQV<MEI$>NzF(Pz}{0F{dAcFN(sjbDTez7$b_>Z|H9D
za=kC7Y&LB|@6#QWOQyRDU2Y;<=H-B_y=#k(Pie*ApG8I&Xp($6_6^VMi>1-6ZCGK-
z=Au)p@CPjlZrAnCEwwebr3vTnInI{za6eH4N|=sU<K>Ujts}w$ugux=gOsoK#E-5G
z?j@&G%+=Siw%WJOr1M&p`Y(mV3y}6!f0?|QZnH*P=onRUY*0|N3(ScuJ55`h7GDi*
zg?m)l{WGj1q2&w!oC>GZ$UqSHC7b9|*>%;v%i2Pf>Ys#@s*Ka|qe=Xl4-#eG>%LDt
zJCMYh_;zNp@Nu-L5gD8I?VK3?c@wo9(Qta%2xt}=J`uA@8rn%5gN+|N1aY#G+SgUr
zfPo@J3VM)6Z@Kr?YlXaL66x3zBV)Ts9KRe53W8Pj-6pW9)K^zourV{IUWrO<a~oA1
ziDjLgSKc<-P%$5PL@(f5sJ+Dii)I~v_aZExM+S&Zz_(i7Eqw7As*~@pi7~BLsoAVX
zMAr(->=gozJ^u-t%U_xK-@h0RG??(=GQ%G(v2H0}XgNNwt`msJgq>}LQn(8OW{f96
z+awQhBaEwW1L^pl3{ISZJEaxo;rD5>dZaTpXCq@n=eF8fJ?I;M!8O@Z`|j$`u#hX-
zFy}HX_6sy&86M9f?lEoZW{@fb<;YNcOyLL$YXZ&_ZNt<vlg-J2t3Gq-8W|DOom8Mp
zRbehWY+(<-ze-jbI6`yK6-SFF2AU)CleAOOsox&gqORr+D~_kxZKIH3ndBR#jU}*D
z9$liZe2AgUM@8X?-qZLg;i(BG@B7tj-|Y-s^EHr3a{lx$l$awPVvpY>1mAAC+TT`l
zTVXJ!ZK#-e-Bw)bWe9VHm-!OAg%MXo28lqc@lxdt)}F!cQ{S$cUOcb@RW1(?lc4lU
z^DihIIsi<}(e2{QiyZM7hdr^hr03`7-}L*8?v2?WiEX38@AJ#ao7D9eTSA4n)exnQ
zyxwJIQW8{gBK5SG9?j*?p%=`Q6c5x|vn>cw<<)KpH@)mu^*ya=<1DDJt?8FDEt!~=
z5%M=ZU~;&{AkfM$$|I-im1!P@9FI)#+8asB;ac(GLug5GsW0WLcdM%EeL4G4`B9`t
zl~>|=mNeui5kQ&}E)@!p7}~qQ+pJ))L!xW6fa$+3vkX%ZcuH7bFhtPT4h06>!e9=?
zk=Q=O`e(ZFQXOmzeCnva@A`E`pdVGNFjPGxj17*H){z^E&Vx^ua>s2a;ro-s2H=KG
z2}5tKNG`r+mb(ELX#FyFc+BsZ_p0*H!`J?^q>E2@rY7&K-mqrwE$Y$+awUVNdSd?z
zW5?|bHN;qBJJGtn8Mw{#$+h7b7TQ3NXXFdhfvHKKpE!PKnz9Y1z*ZLaeC1<mtc?n2
z*{SD&#N-{9wcWbwr{Z{5WsOPpYEWRV`*_Zu<~5TE^%fKui^C)?e_gAeam$<<F!jFx
z)j;uL2KZunPJgaTpvr7F3A*aMYs6cd<OWu^7XIoHykR_qmVf@btga(r2G7JaWyuOx
zu1L*=jIguT*S!gKg-fy2A9f`_18uz{#FqS69eTf15;!o&pfF&5*YZP!4jdGFdIe0k
zO6!Z5DvyAxV)K>d#pzKXi-<=rpnlxW%L*9YH+?4x5aS@P?13^NKS%C0e-pC*-l{*2
zE{;rEv-wU=(<hM|JXF6Kw-aU-5{tNmI_A1^B`%Az7L8}ItbvzuZA?u=BcKX8iBqPf
zb(pDvtC)JN4Xj5ML2nw#RScRmo*aD%G>Lq9RQKS!<>$y+FB)JlJ6)18XM98s0yyPW
z0Ug|l8oi|KcJ0sQ!5?|Dky&exa6A|{21eDbd!xv?=k4#4=^OGkn1j{63C!=n=TS1x
z>AL>(M3Rvv=_bN@5dFhPyf@5iR=K_}00UTT+N$URt^}JwNX;L&AHe~%6ZoYM-n%MK
z6lHv@HSqFmu-PzEwv%}xO5lj==QB8Ri|E5~t%A0H$?<GcAqKm{rjSQ-`k`vtxvZxb
zQAQ6nn1Hw<T)DBB1kk9Un4Uu<G&rCjN4eVsGzv6;9a;(&DCy=_2X9i#5+v;WGSVuO
zH+Tb&GOUJgj!G<li%vI|FR;S6InTT=<|#2L`sdN73tjjU-ASxkpY!GMkKi&d#+{PA
zdMW?#xNt>UBZO8l`E@n(H$w{Y4gkMuw^H(BWyx{#f2K5z_G~dOBIEYuzkxNbuHfJ2
zsVp?%GVVX8r>j++|E4JRQDH-Rn#2UM_5f(bu9xH^((t>glAGONh@i%Lr1OwJ>t-%=
zr{zFRVRIN%Q|erbsNITLk0o3_2jtCE6EB-!-H38en<$2jp9yM%ghG(U#zv>+8C!JL
z6T~-*)RMU_fT&`Tc{M7((fzyv&;uzw@1zLz9Ms}4;l>9P0_<WCk=ToBnHK1O0=y90
z^P14JO>G^mL<R(G8`(&7b?kp7|Cs5M;r!`VWoXMnYR!@!WrE4v8$$twQ@+qvsO3;r
z_=iN6CD3fv#8&R}5{gCX5?h$Mf3<M|@Z*|}pKhWZo_L5fih`=3a?33emV^Ko7+`2r
ztgNiuG#0Beop9LM*^l;oFub7VI$ZW3VUuA)hH`-@4sVm*0a)8Z9ivF$DIMStYs(ZN
zl{J~?UuQZf>5(D@f1gZ|-{N4W=-e-H(;ZGXl&fH-I)4qO@(2)ekBg&;DxZ^m=<7$r
zUx6dDNG2SZL#C=9g_Ugs5tKx5g1$$Juj?a7Q1l9qW?MWrEk1zu_&D2iy`wx(X_Qhq
zsov|@fH4q|#5&Z#GHw^xUm1v+o~66U!tbI~N^&KTH}U8{zgDF%av9`rxVk*kX!G&J
z@FdNxP;g%cYPV36VbiZk;7?*ovVL~8c)*ueU)JcdhVq@<)-F~*%))eD=?cYXr~3|E
z`S|-vYW0yFr8;Hf!xemNadW);?!QeVw1Jb%Kzpql=88KOos$gy<qHo(6_}BQAsxjI
zzCfTInSV%N0<FC2Cb_wW&Kg2Bob(QWKWPUoz$qnq7p-6_2ntL;O-w(bASfA1N2zL)
zRXlYLGo{_{P;SnMkFc#ZkZMq#DWvc5OvL-=*Rh>OWXYKB;5%fYmcT3>t*25?ytSk4
zz~>t8A`UzZ<ry7$ImEBn0YxX&5`MN>&`nHO!PzhmA<{)C(Gv<fFJmgD+(}n3jM+2+
zL^nE;tL-Mxn<GnUEXjsHeUbsqiMN1;RHr)SNMlA(iICFx9uk5!K`0nzzz4~~EzHXG
zuf7uj*y%vbo}b5_ZB@R0hvI&yy`HOH88S->;L9o2tD<KtJWMt93v_)7+{O%n^3<Nt
z2cmmWyQ96YyUOzbpFgD6uQKaVV7meH0S(5@IW*7kc+j9gl@Qq1zmE10ljPpVMl16W
zD^XMS+oLyNdcZ^Y`bfnl9yAYVqaVq|P=*66L#mp=2m5e?3oAE3X21_f2fv2>FY}|m
z&$ZJiDk>@{D`U?!$dWoVf4^tsu@K^^s(6P-8RcxnW2WV5DVTkSne9IFj0`x{79Tlo
z-1@C9aQ=?upMQ^Jgv@-l`|NvAmqGwV&Icx9L{0T1Qpwqw$9AG38dbU6k%-XJpouDT
z`8&o<+AwSoS<zFyjQj?|oO51VZ!``9v9FC4J?Q(C&bv3jUP*ufn^cmtby1?S3?E3Q
zYcE=MPe?TBn8XT3^>5<>x-iwxohJkJw(*81%wF=zLr6iZ*@jRdgD&t9rh@H)`<!no
znJ3E;zj+C^%U$p2o<_|rR{&j0hm5_vgoh-qd{CA&K`@wf3Y<q|ramJ-?Llg5Fyee-
zWhLFM8?#OnC#N;~-3!@(7;*0n#h`yqCF&7JHAdwvwIISwe+KeV8U3ZH_ji7vW3l+;
z*Zif#@_-eh%a07l_H5%usJQZ=g9uRRkX}p4m!AiNKc$LsVV3x!yJ!_{r<?0SUCF-i
zUm$rQ0PQSkDsp~k5c-r5H59e;d-CaQyE+cj6witfHJc;jAr6$5?3Kx@mJ=X$Chsz7
z^il4q&WF<YsdI^Qwx2uKj?~&s<N?yV*J`s9gE|eA!1$AT4ZlY!)uWBHvw#);7B%07
z{dklZ_KTjD&>!^CbO^PvN$+$3Jy2N>?7W$!k`k7)i_3v0>lN2XqFW3gvoC?~Y_b87
zpZ(GKjUYX!ovcr%>r|7q=M^X+K^XYGU~nr2__EACzr4Tce(NuSy9`r5j}Tq5t^hqE
zX5R``NE=v*<(c~sLdLs~JE8p&0qhUUQD!Cj2DqxB>PyfsO_T6%<1x&Wf%zPL(QN?E
zuyPaTm#t(b9`|8Hltaw4{DOsQb^w1+t*wJP{aQ1HLcn2LaBf}w2~5Fv2%sfXe)^{Q
z=h)iBO)~j^VNsbFkPrH+o;|n7sU%Vh6pxd<5A+aE-8ji$OoeI;LSjay8UUjR4MHp#
zWF?y>@F@ieH1TzWi@;RSbiBbpnXzJcYM4mOBpvNW2b^O9_(vxZ89B_vf#v0QNZzxz
zPZwxp5cT{D7A9~=0SKQH_1GWH2d9aL1=@yFn<I_E<;;(_*BiSq73@W9I7dNsT1o$k
z*8A9DlqwMl#MuxaH@?y=REk??5s?R20A=m0KC8<9%weD$3}(net4ktfMQwV$AVNYy
zzd+ccEb__vv?%T2wn<CFQRE2y@6$;exVO|NEl$=S=^XQmfp&OfFoR#~f(SKd`hUAs
z-M0f7<YQg}48iv71c)cv*|kE8K>>Uu@K>eaKI-h(K{)n3n=tOfV4e<R>6L<eA}fqV
zfG)<xeeaX;4cSK>0q7_l&!J)A#+SnwkoY=IpmP4TI23g>?|L-qr$c75GxGd|d6hn)
zT>&=nxzbePjzLZTC)c5HZU`!gHz1Zi1BiC>0BPc0@8{3`&TY8bO2hrJcDp5WgihOd
z&QU`I0|*w^<*LsmdbG3~zNpDV*LSn;EU-CSliF3x7m!)oOS7%sRUUh0Ob*W7_t3**
zl$Dg6KQR~VtR^ri?~W>S3H7oFFW!Lw{;#Pa2j}Oc7p%t5dM1AO0vZK9Z4<`8pPBu7
z?=E(Vy;R|-tdq{i&AK<_W!TxGo|@OiKo02JBweqkfrMa@Xj)MWxXdCOUAO_^$^BX=
zehT2kEwb|o71vh_wf>WJsjYT>bgXYU2k!YI>-Zbv{%@l+lqhao%u|bH#D`wyLl8Cw
zELd5RIxZnG@!K|oQ5;^A34PPp*ce@{RyL0jXDYm0P@#h+5Q#Kum~rS2Jy7Osg!-QS
z>;Y@2W{pbA3@^z9$gXPn&1OkdS)aRXKGgiVq%oi5PnPTZQ~w-n8yozA$&R%@7*M3)
z0q+0iMbHK4(6`Dad53GVE(#fC{0T&{Zd98l!39W;4+C*D$L0hJ7Un?y3(RzAVr86G
zYgXWLusr9bGut6y(<HUwA9|9lJ|A^+HSMkn7$lAfR}&7Ayt=#qmPK5JH_1s!#6=CV
z5@u-~pdRjl)`D4QaQ{U<O_zt+)KN5rz+wb@MF$X(DXU^ZqF^I5rXLalyaHXZ<QzyT
zyC993FLZ`jaxPE;g&-5tdU4f}z5dbFdxm0N4i0*DuDQ5COWd-2H7|V&3F_-=CDoiv
zVaqEq<1{H`qCgDP<br}WU&$p04X>q&x=;2`9D<~StnI`AAG|CuV^XS%FZNtt<{&C6
zs)c{K@eV&fiU0YYyq;UO+tZAO^r{{ECsc+MRY`m1nME&+zVF;N*;659x~^6<1N(U*
zjTjUEYQ%a2_9;t9%eOd@PYe(KHY0%VWfMxrV_=K<#Ynrt?zTPo-XL|)vjx^zM&tJj
zegD-3U_rWOLLdu*v5xhgL7ox^S8E+!`k1KPQ!-oaH*qWuwh*fo5OWrkg~c>tUc>-Z
z>g2ulBL)Cnc1%(A@KIl}M!xn&X_a~34R6*pk+=Y8J)iYwH25}rD9&4o-iw!)H<=uk
z<_V@x4>Ha}%%>G6HhWZ)ildy@aAU)~r>$lKYOqp)BK59+mft*HyGeZD9u;Lgzs-0$
z0M)_=M(fGfFi}o&>o29rw%g7-jcdXk3{3=%P!mwkbewX6pxg9s9p}Ug3JdRR<_ap%
z5<`HEt@G{Uu3catS^~fN06(RSAUBZ)?Of(S>xj(7CK;#R$PQL6`u5XJb|%4R>z~p0
z9Sd>77teuO+NDI~x0-JC*8A8&=W7Im8%z`kN^GUhyN~R;-wDk55J|tl34HQJq4X4x
zu9A#Va38f**dOLS`Fd2bvJfs5*J}wQGVd=eE_;A7z&BB88XL*kq+ss?njvf?A)r^z
zOluteF^Sc@R)5OnF1q4I@*LOI$*_OkW}%NqqJ*j6N#VXZ7?srnhIBBWGFyDw(_^04
z0qDTz8XK*Z7CwarP&jBc)KCyBo`t|3c>QnULyD4a_{)|)`i~bNVJdC3yU_c1r(v&`
zf=(lg{;86259o)y@J-`tKYs@o05KWiG9<+E)SK@S4SGoxt41^Ej5<vcX3ABr%w~xD
zHkBT+@tfAt)&63#+Xd;j#xb8zk9BJC_0w>|EJ8s&jLd?Djrp!uc0UQ?UeF|1?ylwf
zmxiVReSNz6uCAg2gx*1M=JjZyGRyKMk>^-K4)X}DW|(+}be<;Yv{Y`2=#=Xb{&qYQ
zy2OED3FZem<>FC_1G6GOT7rN=7i=Cg0h~2Z+IcAAAgZI0F!>|n(g5kJ3EG;iw}szw
zTjmpQcmtRbYv8srknH(<30O%YK&CAlKLnEqcM7y!O})R>*d)R=R#wbVW(aaKFhN#l
zw`IhF3DFFCwlP|``2b9R?;>4>Wy?t|OEe3$H|R_1OK3)0eu5!nO?`M(2HnE%i=PN5
z4DiW(V~)L!Aak<4gKDNm7RlvuFwx=?F)C?Y?k&;=D!}80y2QK=CF>n#=o@kDMbbJ7
z6ce@i`gL@TN%*;nRMPYO)>`)m*eBb3n<M1n`boekeIC%lm~>`%i#aUK6rhQF^VN_$
z_HhA$0b1Rv2zFAaT6k1ql4<y7N<Qnj34=*`=4dcqy#M1#!DvvSavfAV%!!%ape7Wv
z$sqNY_31t+CigYlS9<JfLc@mW#Xsg26cmItRlBUI`CMHbm&VlA(=D!Y)Fa^<H1rlo
z*2UM`u@I{QwQu@vtPa9kqU)-`u>NZyGD-as%fKHHy=%+&0CEM7^HK&RqYGqYl{=vE
zj&AdU_8ELdI!LCx|A*AZB4^Jwjps69e<;@PwBuu4rd1T<Rl;B<1$t(0OrHN#pnVJz
zR7ARFbTonyF_Jyz5hozMsvn0X<(8_ydOmlyGVRzNl7t78jAr;^+iCmNnM4a{+@<l`
zJsdwi1Fbq%iGp6%P<IGuv&jN&$DG-CMsbn(`cU_;lDvlWn`@tpFJlAvM&dd_XF@Gc
z38aBhXn{kb4Cl)7vdsB+$AV+2v#*44hkP3Y2JfCIZbh9|F_w4$w~l7KYp>c{pt41I
zm9}sYG$@Q?qR33?i|nL;1)v1KeGxDQys2N#B?R(pzY!aa(9dM3-gwL;AVB6&PqA-G
z$jvnM9VNBb1`OhrJWI>Udg|u&X*e+>W>l~i$WbwqkuAZ=n7shE33bx22)`;U`>4FB
zAfNoA*}n*6y<A?xtZ4PR4=<hS`?jb61b%%DKZH|Xejb!Q8PJ$P6|b$RQ8+A(k(O27
zvGs^_*6++dQP;_Uo-l4FO*2%>&djoJwy-yCTrSC=YYH_%bQfq{A}MRP7++!<A$mwQ
z+foldR}YJ4Y6Ea3MLREp(5ib})WNEeqKPHFX|43|A)pze)UgBV^R$5=XDwR3k_yp&
zm^Qxcx+wNT29XG{61~z!1EXYTK16QrV5qV>LMB0=L9@Zo7Kw-p$c7d~zLmk`(tp=I
zWYPFAiZE`K9o3rJoTzlnT+=+(67ICLuqfdN4qb$fc@#+4jJxkKXo{UN_eBy0L$?`+
zYZpTTw0Z^=u(QB8|3~kN)LW|w*Xg*Fz?cXTm;6WHxBwdnFn7h;E(^G>tA7dTSL`YQ
zyRXJF!}Rr33NdDoQ$s3?O8Zg<1{wR3n{@ytW1(1Ep1hH8JWyI~6^|BZ10|t(8t)zf
z)QWoPL;>eFAPepRh>GEyIL8tgM({bWyuiH5m1XBk8JQNGK`KLTDLTM-ag{>rA$_eL
zw>Fz@Cvm5N&POQ-%iOswx}4bLEk#8Kt%;LNMy{phMkNSo!HdeT8=_CUV78KaN~f(v
zc99W!0$zvKzyZd2{{c&l{YRIq@!FIQtRkH0?!gVJxCBi?R-3i7DX%>&d-PNaJ1e8-
zr!)ASE1XX^h1HzJff_I*!Qgc>pd(Ajg?5mqpyHK`oik|Rz|vUtXjHEn?!ne!3I!j*
z=0+-WwI)4Mpe=<KsO9k0#X0i;Qv=cI@edju{{}&rU^ePWB&PArdmS@X!;?Z|Ec4Zl
zu&lqnW$X13#;-iaznCNSgy{nR;4_>AFU~^0|8Q+JiCgk#sesq(22Gd5fZ+Sy0Nx-$
zhwCaR#Xy@IUijLJZ|uu=xInerP|xMca5|jzfrW#-LE+Ea##?UXC$EHV&91?4?^Zga
zUIG#$N-AuT(t#R`@mfJCLlVy^83|M&38YL%{9ts9N>!l24F?{FspL6*iISCH9=oPP
z%b8G`Mwa(Z<G?zoUC)6Bf}V+~XG+#O8fumW9?bG?n&m|siOA1fsVz%>X}ADW;{5>~
zg(8;?ERJ+N%CGRar?{R~p5JRH4D2SQ?C77G0=3{57`fo6$<TYfytWQ9Ob@U$<dbeZ
zO>H3m^kK*J65@PZdH+Pt7YvwP<CI&~L`KC2<z-r7ZckQS1I@msQzj1n&4R5;SIITn
zKx?8n{JDJsx)~uM6aYy`@dhS)$zUoVH3jlQ3z*-?AWWP;FnIv3r~%SX9uSz(2)Gts
z^U0Lxl%;s(%(Z&gD=DT}m4M=TkOjP5os7FEh5F4o&|mN3$EISS47s2CJ?__F_H(TP
z#Xz^!hM15w<MGcCvyNxkijU^nd?#Bxc@1i;7gR7dbUqP)A|nDeO91I}Fvz{cOT~mP
zg4y4GwXd0|D!u)3kl!p&vOF>~VS~qQTMwlpnCw(l>D@s-JLFD*^+!r=JlF&8-I#iZ
z3oO--R_TRNL{vmDqXXyyBS1u0Sppz>qyb?rf2O<!j|?b)E2pZJkgU0dn%<SDT1V8Q
zgk1vRKos(6g~q+Ox$m781cgUSmWO8ojp{icfd~)`zG$=_eKkbAjbuou&xj}vw4Tb2
zn|)54ndp^6PxQ#a{DJ0Tz08h_p7bLybW~c_#J9+yQ<}st=c@<YJQ^*0J0Yl<P0|>~
zySC%EKc#VB1FuQZ&GrGn-3GckoLh;7Y(H7eRC9^G>_$i5AobdvzprB#2Z-QH+Cac7
z7lQD`)!ReKIE@r!7~`CvpTKx;BlWUZxnmmLH!Vd6UG&viTZbX=!WV#3G|6>G(GJV2
zhm;zsojYHEVdCdZ$|*0MR|eFa`fBh22I&GrhbQoleB3TXvdE;{YQ9UHF1i`H7D~v&
ztQRZ-eJvV^yvCdY^M%;Lb`BZPoB3m)=e_>ECx2S=K{colwsxA5E#MfG7m>$eP+@o{
zgm!_KhAe<#!swtGCu}vQU68J%GuZnn+)$C#0cCt<oVU)Dkr)JB%$B4@94M?RMrGGf
zdgEK@$K<Jm6N`F`HQvsB$d_yHxVQ>(2zcSnbxTuyKde<;rM0IY?s+YQkbN>;j!Xa1
zdQ1&suSh8oq4z*?6B#kjL74rps0;%x@PKA6+J3B}`$Lx<$DH1)MSk^*O`F?B?;OOZ
zfmuWT`)x2xM)iy`d@ahyiAKO7i;bGI)*VPZ``tkuRDG1_;iOH#Twp%rC`{=Mm6<Fz
ztgo=;>jvhl`CLgkxf^m(H(!k!1DV%xyj(xAUxC&E289c_Z;QNe_y0v<Tp={<d_&8s
zvipeai)7Gd;Wf}g;Zh5_PlOU*yS3ti+}Ogf!BAH0;h`%d3kwE<r09mUWVdQ~MV;n6
z7^b$Q(TmBJcqaSi9?kWo(vn6)vSZnAs}C4zZT;*67hkjbaEpX5zE+h#{=_@{2)tRw
zvrMr&bv%7ffDvlyH=<BwZ!X5F7@oW?w?PTc)@A+cz&b|99U#QzKNYb4Ogrc5Z@0-p
zE#YVMjEhRbPn5CA8jN@brW~F6HtqoT4obh)DU!j1JMjbp?9yW-9GmDlDuC)Shd~3u
zRBG{UrVlqhfFV*aCp!Xou)-bLOhy8JNMQG1HhH>--KJ@=iBLP5O-Pr>F?H|v)CuVs
zTbq+lo{`8JGqEYuj}e2Q_Y4O4KmI>deFapNTNkY$3K&RAh;%E0(nw3gp^+|??o>(+
zDo9G_p*uuCLK;*+1VI`J0g;eaQu?h=z5jb}+;fN5JBV}kxA)p>%{Av-AHtTS^qb=5
zFkNHKIAr5Z;rHS;M{ILztc7gkC_&Tx-Z`j@oqZ&kkRAITP(QU>v&2Du-%GJ_`6Z!1
zTRZSzw4O<G2OPqaQ$j?1ATd5SY~RD`UqD;~U3i4Pm<99}gg*7xpevD;j!Uf+1g^lM
zrMe{cn~q2NQ}%b|=OlQbVL!MguqM}@`8|G}spQeE<RLDTmK$xTF7@Z;YBnTF5}%Nq
zIQ}ZD;q~;;xd827Gi|BU1isvobdfdeEHCVj2v{TRxXn0g*aI|+v!qK5&KpWQ^9a5u
z=f})gJX2K;bplk+zNu1*NW}bbxA{byC=#ilVtWh8Y32@yjo2?TpS?hV1};Q_)C948
zVZ=nNr#@-!p%E<^#|~4fdh%w6xE-PihMTjP;l}n3?*%VO?f&`)zKc05n|$LJuke4W
zC>)Jk4>rA)`ujmDV(63pqZYiEhAygWctZ7ThCr$BX06kJkl+MG>Al&GD8$>Mghx?{
ziI53v@1Zo6u63%#(}t7*1-eZ9m&T3yqO=NmL1DV81Ij<%&(4!!@yz6XEdYinYU0ET
z5lHTbQCynIlb(jo3OPV}m<qaqE9po~^7x)zV=dt9JpzB6b|l)bb6=k4^EDt52POss
z1#rK*IaUo;<R#66PZ@!CgR%ZTWCJ-K^sdrdz>RrBELp5mnx-lkw=Cc=Q6PLdSwV^1
zS#y|H&?$qMXPc-%PfyR2KPNQR$7ClXeI)Y^F5-yL`36GiwWvzzU}Ap41!5-CtKgzR
zP|#sZv;cS97!I^l@@Q77=570So-fBpyo4g5TEj*<?K6_J6_003;VZ+Hg-zQOT%wBM
zN15XvLv77s@u59-+@b#Bn@O+Y{rBH|;95!bll?VM--g1dXwgctE7`bnfJMP2(Jew~
zvw*+Swt6aqh+=m)YuY31Ke|_b<_%3pRcSd#zT4e-xm{HI+uMCvUe203*(P$rzZ$`d
ziQ|?V*e3B4&EH}&<@5)dZx$rt;FD0)!jFqD7|;Su8Rx~^gpDS*PXFGBL}qU2)ODP{
z_ff?f5cE%LPhYUI_)E;p7Y@`WZgk16gi5^G(rAlu?#gwK(qLkz^^tWDUNDYDCjuly
zi?BssXqtJs0K4!H6bwq=ca^POt8|3&6I-*?ADX7l&di!E5A?@`XiK$)wzn7w`k9h3
z3akq5{V0)i<~g^rUAUAg?0zmW{uLi7a99<`Y9IR?{`yd)R3L3YrP=zFNMJiFm&;jG
zx)*`N5N&PY4+e)Dx@D)hnttE&50p`F>1I}-v%+TR?82;p${p92lM5mP5*#?OHw^Rm
zEMpgF*wbU;<D1nL?N);(S+L>r<+&;O9gJ&ReSKLyC;0fp_L@U&C4YUcflB;Y1-i$0
z5QK9L_Fp6kWJ+Z}zdq&GF20`OQ>-(}`PJoh55K%K&%1^1#lK#}GdR4gW#{9nvQltH
z(Fzrwq=~s`_P0M>^l^aZ{^B}h;o93G=gByp0rGAfjPVi=|N4b73^T7lXNMiVaV@GB
zOqwo?U%m*gFL=}<j|ibKYyn*{RUxxg0uFIBI;WV+u!a!y6KY&RaIF_2=iz()E2;6#
z5`Y*(YdrDWQ2CQrz~)5~o<-^s&5<G@c3xX|`_XmQ=wF|uW1Ayq^5#shI=~+nadSke
zLrod(D5)n<#p%!H4XO?-*}S0QQylsfn_22<oj0G?L{dNeTTV%D<W+)}2hWp&VKw<s
z>LCUJ=3AO|5rBY`#c^nB@QKJ6@(oW6*1aD`Cn`mv&2hxQrwv@z+HQICN(05KWoAE$
zL8+eU6j@^_UlhcuD_~_39DqYD0}+n0uX1aUp(fWzG%xq|(hI@wpMd?RRi+@)eCPvo
zF{h1L1;j{>Km@BUhX{h{F($rg(#1-lje`ePzo<t5WZQW>#Qv^-@2jyI-l?ce{OEpb
z!^e7ExOa)poBycKU9OKjSdL%os`h9cG>+==gj}j~x#^YAe2GCFivt1WE$N|L;*%Vq
z$R_rv$CrQwF#as5D^j8Z=l3_h2W}1AAvp2Z^`3wz>ds?vq(31Yh#q`Z4~+);QU0TS
zJz6tj%2I2-N#wH5F83Rr2s^v&HxkQYtzoIT)c)ZhvY#Ft*woV%gi;ick9@II&y|O2
zaMd7YCeQaJr;!4egN=LEb)yzj<^IYXmN@B3J|M_MEA;^xT4fqKw;!PO7<|jT^Gg%|
zA3-1J{KfnsB;7II>Es!SQ59SCdA?{i0bOv)T{-Hlv&@_8kea;%LiyFLs&Wti*a-bM
z4yos=zd0dRW<4Sak9I<4EH0$Ix_k!U=jI}UMFc*}Bq;zkEyA9y1PsxQu^}2KOL-ca
z6&)Wxn&I4u{p{a$I|40MA>H5&HW8+Ib}vM1hoHy6)g?QgG)$_Y`0Lrmg}fod5k<1a
z;642Td2M5-H`W7Zp`FPd>HocfBttHW0f_{sbQ^3g?NEQJoCv6#`Dits!(sU9Fb{+m
zLN-)P{)x<lx)WQ|9pbbM2fb8XySg>H!u?dcIEHIJ)qlPQxxp6;zGomkPY+_qeYkhl
zzJ@~ca<umP2m=(akz<;<N(pzjtC0@MG3Nn~!$ge;y#`Jz5Y=%=1-s9MzjdjWnjpP$
zt8zp3?S9MNuRnL~*Z!$P3+A3z25lP`OTRYY8jX$If8*Bmv7ZjV_0r!UF(vk0I45_?
zYA^57dZK@b{iG@K1;XQWZ79q1ON~HJ2s-5t9kI;2CHh2V$}voYMo6Hhg$_-C_j;p1
z-3upoVy9DB!A_)68m$u6W%PF#g#MWSQSzMa7yJc>y^}<E`(3u7PQxQ-$l>oCc><wO
z`@7uz*}Tg#?A77wnfFS8H)~^5_}sX{0!8M`ey1Y;Lk_vt+&VaL1mqYiqCC2HpfcIC
zv*F)z|GMoya@7gPjs6J|E7p&H3OLl)CCwT82rO_J`l&-j6CZQ2d-~1P<50v>FIz5x
zpj+aC3A4G>?C$l`WGN4WEFk$3cb6;~rqy3N9G*JJwA;*QchFZE9z6>%*<UpTI7j6H
zf(mHu83a#li?@D(lOj3Yn|Y_`hAHS@c&M|;nFyJ&4|dme`oilUuJ0r_*}pV#AQfN*
zhUP0UaY=d2I5Y3LkeZ)-3rJZ$MkI=GO}}a~uCmeQQ+2$3?b@|c{O<so_(OA|NT}V6
zRG=;JHxq*$ByX8A8B0g8&7l&@_QtVgu6h_GTt`@>zWbukRc70~ZM|r&L?)At!DQHd
zjP<EE*RMl8cht=T>c(&2h77IeNMAu3sV)Aeht>_DXA41Qo_Z>@MBLba<!SNthYj+<
zWAf1AI+sw8^qGI4|4*8~*NXBir~}sQhQ`A!$CNf(-*CC4Vo|rnsX(QNjwSWgNvU2+
zm--*BAP=eO&60)PJ|?@-IpNjRt+3R_ZO5%EfMHs8+IdAgr<Llf-qWRd!Y95Z=3R_y
zUip1B+>egm#Te)$H-4fWMJ&s+cO?&;=q}B)?`v34U0M9BS+C=>XR{>}D#5*G;@3FJ
zcE;B&z_7GgWjM~Epk3Iosp-|tC@TU+F298gBUb8dTDvV;EuXJXUDi9t6@okZr!f9K
zsZ%Ej=#=uHWW@8K{4W8J2@mV2BA`jdoX%PEr`5?_+Y=R~4{oT5i3U&CCQIDLMj!}%
zwCz@@uwL8{DJ%i@3|~mu{#eHTGV$yq5)TX{>Q-n_A&R^2iNvI)ruI@^LAaQ8VAzOg
zLyk{Rhlu?NlKwAdEO-mX-&my8uwQyW-1EvWXkZd2l+K*ArjnGRQGzrqh}j@^kAdZ5
zB(4mq41f5Ap5YkHtbP66{0_F?dh8B1PYg5kRhxzfcji#Byaqgq6`A<=H%>N8OG^i4
zQ7r@G2|=eh@6pH3>{)!)r1i~cUf5b-K0Y9(KKhC)J3fYchV$LKaY`%Kv1)rvM8cbc
zj+d%US@Lj1#y)=n$o=%9F;|ox^;@FETju8+>K5~+Z_L;c2dQI2>5H^ez}zyI;w#oy
z7OZ9bADTnqT)juZflaL_&Q-%rE#qWWAc7&Vd)VhoV?1G_9Vk>KxFy+06+gb}H&eLH
zYke~r8alEuVk00`!IOsEkWT8bX$U8_#ySjdldRCvhmo@iokI{g$VqJ0|1v1oUg}!V
zjgwNp-c9n_!qRIwGSO7oH+|iScDGwBWp&RnyYQ%$ur?+Z=kif9Zuq#*U8pw5=O$BM
z0U6PU^IQ#)Ty?`3?)+w4Dt@~kniE?dsuat2>_J7dA7pIu?&TY+(~eC^WW-em$~*n}
zs<d-Y(@Kw*^@Wp;Pe0-68y(-b_<YBJM^yBx+zaYo`U}@0zu1SBRqrQAiHzM3?|vkr
zz4q|}mNhrit{*^-NsB;Qa+Z<s?ip<E9Xc6zd|6xQM{rXt#_Gf|Y=W0jYbo<ANi7H;
zW6?O@H`y5lzAs(gsi%beKPShMM%-K|Hg;C3;BM0+ta?y<Q}bPnmiR=>&FG-0=+zT^
zp=&o$D~B|?i=WdpAqo?p?GY;p3;QnN^2K>nERR=-sPbZfLN;3=8EV9&n4GDK)S&Rv
ztp^>1;6y4#=CjM}ph)DtO0OZl5H2vOrewwUq9ND#fFynEAP(2aQ7XH73TWi|_`dqW
zud4-o)gP{!@xsEc>igY`7k{hkjgI?4?I-q8cpultaSpd3_raB2YBo+Ijk1QJ=h2%(
zttg>uzWcGqlfC`zjk$AI#3?9_w&V3nbJHlr8?36sqLO6$`p0nzP5M$McgzlxqP$I>
z-6PV^#r!gGY|ORsP~d$@>2FkF8TQ&^(2*2Zn9&F9n!JZ(k`c5B4XUqZzqu)(Y{~Ot
zPo|Y_B~cUC7K-xNxbs!LzPZ1l^o~=l8|CR)<mY+q^UJY{5V6y;8l&BKSzdkpCi-=c
z#oNbHf;}dKtEVJpET9^t5Z~q^y^-=jC^;tIweP6tY=LpP^gkS9U>fug+E*t*ay9m*
z;Hi!<kh=Co+!s<G3V-Qpb>WPx@m%USYnMJsq@d7t9XAFO6QG#z7#-`fuuy?=9&j0a
zajT#em92X(??sltHzlrnXNpR!NVT?~U<8~u!QJUSP!H2s&svj)tLJ4(3onhFXL4AY
zI`+P;;7F9#WFu-l@|?pV86|p4cHZlnq$y<2-nTqRhSov>?wo;)#5nYa?e#GAn#pH9
zri=ndUqA0}_D|tL&f8U7n5)_*a3ynbIe&uUCc|>qV{j}?Q?1!0`*_VGT>SQn{qPxX
zOD3ti$&!X{eKG`_VQYV5-xtXi-HLHtTca+#=+Z9QRUw(CSL^Yw;><QiIKL*?kLG(c
z?l6ofzj5P<!rU`RA9_$tP<wTyR`$U^i015K{N!Bn=JkgUmR90c;vIyBrY{&j-kYNk
zdBi>T#*ua+z*)q=c-Dr?{re-#&59~`2s{3BU-mS025mN@=Df%1YPgV!V`%SeT#Ys9
z$0xxPq~)q45nekhdUSK6<k*f;9%E0_VEqtw0C4E?pWSTy^1yB-tHjc$W|LJ>Mt@?E
zhZ|G$id@W>&-&Ii2QS<9Y`;^x2^O5zWBQdvNgXK1OEU}(iV3QoF)U41M0FOAMLy*f
z9aNa#ofw>A9D9DoESr3(TiRiNvn`Qf{Tg=iOkPs``;(MUpOlem1R7Z9rzkihCBjGu
z-^zA&Jkt;mYJa1$tI(o>{jF)Xa*&cr$qK+4RPclkU^VgzH|&J+Nk;Q~kCp=AD5ty>
zdJ2rP?4s4%*8NPb<V?NSJ=v=)KhuEw6HD)_)Y>6f660BmZ_)9NbPIz-T1{KNIkC2B
zpZOX8LTkp10=`2NgK}Yu^%6FhyZ~=(MZj}WIfZRdQLL2&W*cu2NhN3GlX>rw*DjW%
zWeIdz*f@9<e=Z=ee4?OqNo)BdSl>~p`W0@xyEBz)KwEBQ-i-p&Fpso-JeecPy(OGA
zRN|KQ^8wvK6D7a}_~1aTUgy23?Xwvtwtme;D^x7r_UP+@mq}%T(XT3i1D3+DhbA7(
z=ABGsLc$^oO{%Ngq47PDXcD|nfRt(w0F_lp#pyZlmp&2o8ecX+7<+sb_Z>*w1Ran>
z#XS4=ty|95mviR4ZzLNQpv%}pxuLKb<fULjs&y%BY5<oJ!$b!@Bn5q$;A?tDg?7qz
zyI)>W<r<w`C&NGB(b(1@<oQ08*rc$|m4VVKT(QMYn=lWawJ!!+S;i7}KtRQE)~qWE
z&ER;?cFGq79(zqU)Sv7V%#H0^)a72Ox9X~ztcyDkmbsr?aTEJ<hxQ5%amBmE_%)@1
z;qz|$b!z&!4!&R6{J!>wUkt#8Zk>tAy-Ic7Esx7%jf<S&lT)hkQT1Ho`gMscVN_Q{
z3Qa-|c8kXh_HV3B_6%XfCtF=PL-c5CSGZha_yl~@w~z)k*f&gr&&9(*E`8xU*edjN
z+m>?=kL%Z)mPr$S{NtnHA&Dz};>Bg+5RBQk?`=$kI)7jw$3#GkT33xe+rDw@K68Jm
zMr>$Y$NnRjbg_YXO>s;%3!y?|7$5)(GHBBJWrqK_03j%#gM+a;EhwgS{C0;pjW!2N
zNb@Y->(VN$P%Vq?lhlQMm{Zz{bCaN)9OenZOeW(|YIZda*=%?$|K_-vF-k(D8!~<+
zn`XP}hHviic|Xdry+@${VfE^UYLiIk4kD@Kru$8SN!Q68O1o}UcqogZ&B=PnjkxL&
zAkEIpm_MqI2vcrIEq=54^Pwt~3Vf<H<o?F>maQ+2X?Xdcz24Ocbk&Kmsssn{S-#IM
zuk!!;KS4DEuXiB&;SqUU?p4KW=?l%nZ!Wd>+|Lv38i;jur9+V@?ZbIv8hpr6lUF@R
z)MoOoQ<e6aYUZnGUoC2snI64(J8@e&XAvN~Ca;LMhP2mQ@6Y+9%&=<q`%aC5Obj@K
zSMSXY=cglGi~mcG!~i*R^gPnqmgh!nzV3Nk@({WaZpR#y4`f6S&X4XFAf?%eFT+Sc
zPIvx;fplU+c~pT^FwJ0p$?93^PA}rGtkzF~5`Z_ikyy)ex90=<<NYEfDjr-KdO3s`
z0zjT@hj4ea#36BH$0K&;dtnn1Q&(^MS#GSK03f?TwNA;S(BS?(K4D<rMPl-`c*ClQ
zT7{%vWrO)TPO`Y&7jC|`#EajHc_T*o!nOy)5BhJZKd|@RiI_C;tq$4QmRRYYK<!_r
z^yT4lMDc}-{qA(R<=XU?S9BvTcW(8#cgL=pvA+2wqshYB^76No=Ve>FuF+9ZSSEAm
zl*3W*#!E_n_dBV=efh3@_6Wj<`<%y669YAmjCrd<qw|X&Af=|fx)$7EBj(H#CF!&d
zt5+_U0jlby%v>;rEME{2Wx>KF1mXQPVULv{P~Zu+T&c?-*YFuSl^~Ry$nHnpr^dyf
zMAZDOQh?}VLWYG1WyQPfH=-10#ILoX9Pec{1=j3j-Bv4c<>4Fao+#O83E0njG1<9H
zam4F=dGZjP?#>pKmW~qSQmbWn{Yw6F{a*Os&D}TgN$F?&7KnZ<w5Hcs`+PH<pIA-K
z4#tG)IJ7lAeXjP#CfP{oz|eA_hmlQ>fsCB5B;aOx&->*guJAh5Uo!{~OiR{8Uw`Yf
z(A~t&^&5+GM7ESE<?jR{(><Y&N)qMyfG<S5POz7m=;S!K@qCoVOW{s|AK`rBymIdk
zw1|1+Qjn!##r<d>DUn4Kss9T6USdM9X8@GLOGOVB+Yc5Haol}LQAcD<$&Yn^l*ojy
zV*6dz;Srcg7RhcV-n>7ETjK;`q!<Yz?Cq+e?Wlm)4giziyx)Fd`-9F^r)<%S(Z|cg
z;j^4JJulHk5ffYOpD>Y-WAe&AT?%-E)Qnac5_d@2n0&W@ymMX6Wa0}&-<MPU$^d&!
z#%!hwx#rd3hN%}t*D?`hH&Na9GI$T)4~9rehJ25|>M$x~Pg~DhzMb;K*%$i7>JVb|
zOEb{;*+sWw4<8c}0rQf!;_A`zoI<{2fmdhWbjdgmkaDUp`2S|kfH?U+Y<peMB71IW
z;$qDNw1-?7hJ~O{|3|jRWJ=->?x2Wa;F@j!*t3{F&QWNzy2MSA+I)QUOcP7pVp}&L
zPvmU3GjapE_+-`9x!9Jn=|10H7m4dH;cJS4%N+F%n1GqdXG4B4K1mnb)?YawX4{_0
z5)j`SQ9N>XT%1jgWHtAxY_!Gx25vraj!jwa;DdOaMZ*_mk4PDIMlCm~3~k;-7@ry*
zc`cAu!d2eOW*BOe9a$u9LL^Y-W=r%Vhca_8aiB-36-B8Ja6~W*s$nNSzVsyO=X`0o
zLN>oiGK%Vo!jk>sx-HK|zAEpxSI&38Ds4|l{z3C&fhn?PanNhQ%Xt8+`Q5pimJZai
ziuu<%cX?ISh{9X8!>eiW_u|mT6K*p!6t#=3n)sht!QJlH_aQh#{KUF-ZiV~3?TDqN
zs6RjzSEBQbfgiLSK5$P0yM64j1p|4N5Ht<k(^`J0>h|CMR+5*co-z=6Z~uo7(a_et
zm{NH;6K}$sMXKpy9Lef|+EJLX<1Kfla6U0}m4cbP(E?pmWIYt~vD3DsA6}9QRJrzs
zzD}-TKS>q!=5K#-b$Qb~qdY!WAd}}y2g)yHYd7SLyozH~xy9qlhezl$`$G6k4qzVS
zyQR}rW_FN?ZZ^o`%T%f274fkhu;Qc@Sbhv~`sDMZCt6P3-SH503H1J3#<4|i(rU?P
zq$MO)o@|U-KRHu|#`ZW4@<IQ^3i-)?S%T<%5F1L3C|5p;fPU)~{-WrfxaA>>O8nQA
zl{Mra@AMCH@@p{RVJbD%d{St^aL%>Cs*j;rFNT$zp>GxFc|1tdTUDj2_7v0OaWXwi
zfuwjDt?e5H<GZW_`*I(s5u+Ms3u>hQcm|u+=chk$Dr4U*J6QBJdO}Ld;K4yHX=&*i
zOKklr#TNa_48|x7u~1>2*QKk%q~MDR0;bo@KdsLw2k#H&sTjy!=rq%^Nq#j7b?}46
z!lk9e*9-#NA(&wX{3?cGzH+rx9n{BRO#G|0r+m<IAtfQn9vrF)E2`R7AH)<H56kJ5
z*0A#r+FC+;+g$dPl8NZtsh4}XWO60GDn8m1v#Y$^c&%-1-yr{gS+)4iLp70GGT1Bb
z^uZUn6%WBC5_R&`U|<+;<NmB+G6q=N-O#GSIe$4Z-#8Q#uUNq}t&I)sok(6&qUtXq
zN-eis2JWUx+J{u!tyFL0B&q=UR%Q_9MP9BgBZth-zALrXN<jmfu9~le_(C*Mj3eiK
zU*zN(6o(fW#n?;@C1b!;p&Y~EsHdrU?UVtDKx#>?UVII^^<p)HXF&NNw(o3|oMP^}
z!8niHK!26>FMai)WT%(L3qaX=52OXeW6LDo%XYmYL-vN!k&b<ZvJ&~t$+3lJGkKQl
z?kOm7|0%zdt8Hy<&_sQDEV*JG*8=ozTp>wOUf$Se$VUc28cO`Du3o&}`HX{`E;qVS
zIFErR%bfcx97z-o<Ir;tt4m0-<iaS_HB|d=8R?+-N<lUBF?gx^ksitKN`~kvsuyF)
z7@HEga>wHNytIM-?UxlVMMpvchld|{GSqx|&FWC+qF-l@legrpr(WJKw~l;1s}dQ9
zBHVMMip$mR84-1#i`HS)x&*!RbBnjdtJGhC-Fmf`RYdVfP~+!dQRjh|d;&+?#vSf|
zy)GirJP4ijPIv45>$a?guO?l(I6Y|HlpC(sUCzMSS)Yo?Lt)PTSgN%n{z-!sO#1Qj
zXSqj@YIalb%92X(+2W@b<F^@0g6|HuirBK13{6y4mhM)%m9Uw2v+j*{aW%iJF)KNn
z*XX`PCZPRIgJ3vn;C-&%!EQv_Q@iWF{Riu82JZ^*a+5Wmy+mVZqZeOwqw3S(3*z8M
z0MuTqQe?iRW0O7x<5fBo?6;PHv8mJ^WMuEFu~$#ETHxM8={zuItXsi(REeuq*jE)l
z5_Rp*r{tI|9toRs?=<y4RZr<!3r8q{sO+H=Chaw+d7N)~z{F(3+7}K3J=UFh7YpAV
zJK=+M0m~Jy`(afpR62){v7Qr+iI@{_S8kGYD^<p3umN*e?LzW)FjJZK#0Hv(hKjK<
z2-p``FZEJ#Y7Y1kJr$Ym2xTwa{Gqf8#8^$mTi{;zF=4{vi;l@CZN+cvSu?2}n*OiM
z1O?>5bLTJGa#2w?W%#(E(-Lk^8jis|@aso*#F8-12P@|m%(BPs1axNJgA|S%;F5=`
za}ReomGV2VtL~*uzQ1tw%za1W#_gP|sUx3`?9C^wc)UNYG!F}8ubYqx_?j=I{)AQr
zNv~ilDNa^)Ha%;0F%fm1Q;15W#3|z6(Ceh<bDXQZ%fCy)ts(E+{ASn^v9pN{@;0gS
zJHHEh+VABbXf`kNM|3Y=JGg&YJRFjgb^5PHGiXCY8`2#hV<-_Myw>g-yicA@&U&j}
zuop~&mD5Bh;R>lx`UoFj?U~qQCXfmu6ZAB$B%;KzY<IaROJv*MI8HS&6-yWs+f-l=
zlCvWnxFv1dWyufi?f0N03Sk^Oh*?T%^vu2fV#hpyze{S(Ir^s4+JunX$`|#IK9MVD
z@Kch6-HW0}>2ZgG+1R2EY%YiJyJ)7#f!*!Pn)}w{8w={{>dea|eO1?+nGU4JK;d$i
zBU=V@^ZvE_t#<>1s*h{UtDnY~?8sn*pFiL((4&9t7k?q=Y`v(%*gDl-1wW&VkCLkD
z2dE54hd1g4CLf)KR%X`g6WK<)?3%(8p6)c*Of+<Ay1GH2G3X%20Y6XlE`Epj6DAp>
zCBfH!50#)?%jBK9`c^ChcT-MHHha+v26@{C!?oI75?@Hjq}5*Ua63}=6~%L@G3wa|
z)9QbdI3TnyP6_lF*$O&c<dhvh*c(6PlrM--tr8lnegz6nPYkWz&W8C!&w+De<mud%
zmyWJFNZ7F)OW=uaq~E<*s}rP_7vivF=2KL|zWV}b?;KU}oXaZ3X`>h&<2;+?$F{3M
z+=by5gH5yQmztF1<<$-c_pke1zUlbx8GeW#!~Vzf27FG+1my!X&kBwWMNg>@=kGK7
zRU4*rB!)~E?9*4hdVY!4Vdz!Zi0euJxoAY^kI2KR`}5~A$P#7H+UpBr(E`I@N$pZ~
ztp7c)#H6I>e#zbX>b!cV*CJXPC)%E#sv($Hz29}A1N<Hj5nCX}>t;Jve?4&j6jYz2
z{w<w1u2rFrT`=|r9ml2pjmYb$@CFxct;pxb+ABZ$b3++US^37*+6B|XC6Y@MRMmGM
znXm-HH?uvb)dE4fzKPckp1<FCv?P0(CNu}1w%BW^8HfPz1n$tEvu?O_;~d4AA;;!%
zLu%rT@iTe*dSu^v@1`nwZ|cit*dCRU>Tw>}m`v!ts9<rhIiq9y#8A(Af6N;*p;|dp
z+W7%&0;@!;*A_YM@G)pK%2}H@=`~4fE|g7(cXgnY%JoZjORl~FBRt@%DD1t8ymOkf
z?QW71gLzd71lynV4|HG&rs(M0kD{ZaV@av`;jga5x|LQ$VDgx84b_u!Ekg%(8q>5W
z_TRXnJ65%IrxoA6HA;F@SL{MD!?RvZO>jCnEhl}(ek<QYu9AIt!_{EsximxJlVTC+
z;_i)~*9@LOz?Y!uVct;iMUx-cY$cgLi-E<MJb310!9!9;=IOAyuQO0F<mS4_NHhw|
zP{M1qYB@I9FeYz5M9$ZycW|#=!!D+IoJ3$wEHW{%py7eKW})`C9{t&xPo+(V>g$v?
zTSYsQ7K;fbR*$-#o~?RWwJY0okS?8~*lkQiJd~WXq`wRWrK0YT_euYxqrEeU^T0-#
zG+)-#Fjf#aa2*!rJHiJgAOQzATDq#L!7)aHE7PZ7JtBxGxJ^&dz%Z`#+t=IgqXqxi
zKz^ZvU}SWSfQp?UmaMi=EJrapm%mEWmz&&K^_q_&#|(fBanCJuq|dCrZ^*r>ok&Ov
zn}k@qFr2VoY+~H2W|-!(MQAX`i=rr18|lI?I=)RHL-@)<AYXzK`YAgu!byPBiL2Yn
zQOg3V%d2ck9@eQZCYrA^{<f2Gpkj8=_wJ()t@5cg+j}Sq?fWj0?c@A_LQCKHD2#r(
zed9{`wyU=}UnRrqsswHQwdz*XYA8cjf`WN4X85;Nv+AsOU=-$tFR4%>NWMPd%+ls>
zM93jeA2vhZ^^LM?ml~0b4_^CtkCdp(v|R_{(bjw1*Dqx+-Kh>Ea#r2{5)v}V$YC|W
zU6oa2KAYEg`o<s|M@fzK@;Ci@rJYtRB1cZ!aAB(2#R5TuRX003n*m(ykVkf-mB%%j
z)V&Y+4jyv_r-9~&vL{`9{UG#L%ej<BKLvdJy|6CP_g4YQfBbPlg_AXNxTi9nrG(W5
zY3C!824YW9Z$~mo+LwsEKAeb3#=u$cDsVD*erH*Tu={Qj5xZYj<3iCcyWTQD1azaZ
zHdod3V)QFCRcG_6=ksEzdiOKJpFLbS3gr_Jb>f*Og-@CA$1Dd3Y?8cxKQ_~}4$k4X
zLGR`<!kFvr1~X_5{vuqd0_zZ))*OAF(w9#K2T7HMbX71G)_ajJb+pQu9XdbHk$wjN
zlC9oCX(Coj-CjTM?xV`XTCajYer%-(!3;8m>z7)%^{FX<1gMdw(AoTDV@h)dtsr)T
z#`!xyUUG(p)M?&pLJ^-9x?%)fPNLmAEoY$}siQ(c{%r*iuxmnB4ZQX1IH<>pYYS23
z)w2aCqLH*Zd+FIc>EPnN=`mjCT5;WD!$XaM{?*iYhifha$wsS<O7p$1bj-~>#~$hB
z=Z*`v8KoN7DIBQ=e{qwZ(7MF%+M}+aB!Q<WvJU85b4^@X1=qlu`r4KtNFZC-u{CCm
z`W^1wyO%=sSrXP}lC=!P5_4x{<mH2QQ!{ayOc{WqgsP-uacP5P3Tb&goX2?S{nFFd
zUK=Gg1A6L`7>7dN!~`ne4T%!D!!mb{x}AkFl8LH>Cp69y`(3ANs|Nay^r*S}<k}fu
z1wC><Sbf9D#@4~O>5RDB?jo+!V%3PVfN22w@Vn$>%}Al<b00`$eG(<q)rsD{dk44R
zkN3qH%S@)!Shjq4ZFN+XmJ`Zgfb;KB!amLbU&NRZm?MM!fER@Kj*Tng+q^W>v<G&y
zENdSI8pf^%hAHqP17MJouX+9tR{TdGv@V9clQw$e^ZZq8a6AYK3i{bIn-T}B!VMq!
z;vH+_JH$pnRC@9RyG<cDCB_Q#^QTkbH0I&>VP^&C<G+Ik%g<sy=bQiDhiN$E=Emgk
zH!r;FhBazJ+ebjJ?Hx$<osgDTqDA;$NM7`n_jEVNdLBK2uU1vtnW2U;4+wEq-O$h{
ziM+hL{Kr6kgv&np75tjemP+e^$fP7ajfxJV&E6Y`a`b<%-{-J|=#StkVl!!KD6Ls}
z^SIh>R72=`==0S5)yuACSP~$nNO#x(S_IvhXc;YzVg*u5P?;i*Z{o~v%{^n#DbcKs
zQghG#M1~WVGKa6i9e$;aJIQ`rvBiIF7wE9a@j+R}PU*(r^x8AM1>{9>mht&%UY!R$
zy{F*;<|9tC=P<RnP&Qvi+REVA;dYyfocuZ1QAKPMx|7_O6UBjd_5`$7ON*Uiusn|?
zro~V8E_r}{AKck~zqP5sA$CeVrF6QsC-O2p`G2n#8X&Ih;O%``&#j(kP4{^c7IvXH
zO{shqtU}pXwUvtYVPXbdpS!20XMuL{Wn>)X@VBjUQGx7wNNewah4QB#RKDPw?8M`b
z$l4ixfJf8YZk|37{6q}=wj^&quyuSC+5)swWP$;>X1zDK;baV-iumVk*aAm(N+U1z
zo&xRfi(y<&dT3Cgy-VjRlm~IN7b&<Uh{Q(aTPU%KISt=97*UIQ#cn@M!Rq+88^l!6
zx&A(n&)1$JcDjP)i6sbF<ssx*4w$EbsW2_i{Z;Ke)dW;QJy*WT!*47FxNMPZWi3fd
z<qjCT`4b0N7hj|mJA6I32}dBBR7&W9)z9g-cmxC<5iylZBRJqU_`J1Mdd{8~azhDI
zl1LI$a8nCEdyxu<AMce|23{GjnuNUoxe{D@h#`BPa?%sv{Y-u<r=EU{O}sS#LrXdu
zQ=n>Wc>~XItK^7dz<~YP_2)vdLqJlG783+YS+p6#Yn7gT@ZWCG!IPhTkH{^cXsEjv
zcweD~6@F2qsvSuxj7cPlbTMUBNih}mDqTf41y6y+2sn|F0X|>QgtY=A3{1}<!KD0R
zyI{G^5C^r8OOEn=7b`WOjw@|PZ51M4IBThl60i`*ZVNGd2y6&~*g2O}*fRvgHNY(7
zhAtAX?eM3!Q7bCgO)|(5+cy8;{O?epPmom<_YQ_IO~=k&_=!wm>?flBAG{NLI^gx|
z*FP8Y(;05xu76+%dVwU_A95oBw-au8Zak2dkud{h!&*vU^<QUM`IbQ(U8;`3@jDCh
zEz39?o11Z#rEvaB52XGK&uyUv)$>-i(Gdv1o##JM)?bVEO3uv8R21L)P?M8uJ8u8x
zYan<Hj#s@W@JE@#Cse%Y7Tj^~-$MFJu(b3`_%|FF-o}qbN%ROn^ifNz|Kjr;Ir7~1
zTJfZ1W%pkUfY}o^3_nAOj~#Yn1c0%B^+u_@23~Ft-WB{<nQ1Wm(>mu+@yBL?2Ah(S
z(rTjSrb@b4N&fAFNVF=EsWn~t*bQMNY#L@d>`~wxpAkAhcR$4Q0c`3wTuE`Ky+`4+
zeL_4b_IBmpJO>vQ-G)cyYsb~XVlcKxImsz0>xAkHsJYK)9<1-Um@`e^#fEqB9wqSg
z88C<H+-ay-u~bRm7pamg_%Kah!GYU80&&|wDjG*YWiBNmLUk|jeMLqoeT3+hm;#?C
z#xas{%@^*1NL)D`eGI>SZ>_7Pj<VCsbmGXT`AdU^Pb(}xGYAWhsp@<*hmTi-kpPhv
zI6yvw_FtVh#~3RlZtzPZG9k_*3G7X57cm*ISg{!__*O0?1W6p)6+s+6bZcejSj+=3
z_7qM_!r?i5{I_?&El$WSC>-ZHzI-8eaCP+i0t8O_`#PqF2h%|HzrV}3c*D=}ifE+g
zQ8KeB+;ltq?VPZ3=FFK)@QGD?K=XIf0`d-9pnvWR0*eV?eXXU1>?pLXB3o!RNC*r6
zH?=<~8O(sv3nPI1KkunLKcR=fUid)H*mrxVRSJ&AJ>+OK2<;eleg6Cb8h}xek*1}#
zNzIqepMQ_|tpl06=E3u)M-eSBNC^qzCk7Nca0$Yh0*6WhD3Z<yMa72W_#{DW+uK;{
zdq~Wk*3#g)8T-^2Za~`xXZ<Zfe~8Me_&77?^&+wto-t)0J)^G$pN7;K_?r*bZYMnJ
zo}M;s{qW(Mz*0d0n=5DJ<fGIUFaZE>K9mSdTQlAbAb@B1o6A2!{8*R$A^nt$9n-We
z@;OI5!j7ZSmUwRKlUE_@`$k`q_I7ng53!qr_x26sMGonqB=F6Ga<JQ6CmO_Tpm|^C
z@apExn@9?dILF{+A{TLZxC}H^<K9y<*~B0Z$p<=@2;~n@StUW_Y5#fMg}_6|bsmY<
zc+}Xig*4K#fpSSH7&@=0(DEFKX_?&`Mnjl=CiNr$-vrJm(@xxXtUrX(Hq&!+e$wOV
zCJ^~?2>o+%n7}y4|M}RN-n4@a4Lz!kgohDL|C_@7`wHAcV%6C|S<?as|B;!Q87E*x
zFx<M;Z>)2ihNFmw_>&+lo?zs1M(g0Y{hcB87R1-<aeG4S_&<<M<;7Nh2_J{WA8cqi
za6cpNKK}UV;y=c<Tu2(k{If^7Sm(=2t-@%q;)1=OWG%>Y3O@xdR>V+KU!N*F58LUa
z_5m?Bi9f()Gr(J!p?_#GM!K&N0?+){6IhBeS%ld49=a&yknUk`+{Xr=k-!JF3VQ-b
z{=W$U(mJh?ZGfclU7nXjBy~@VEVdUu;`<AhYtmL$1(WnEa>xohFh-`NT=*z~ckZ0a
zI5n>_b`K$(H_HO&3-~x^{oyjd2b&pT{GY!67OSokIq|?;xecNt+6<f;J7R8DShe|y
z1maSrZG~suaQHB3VtcbOEGB2Z{&$<e8=7Lt*p=ad4Z9;Y;7#llDB<jUbG8{ap=F?J
z7}RDkPYg^7(NugkzY`bS68>VoG3)ja4G@>CyaYHjO~EYg>%fS83yL;JjrAXw;X=$H
ziM&M#dsI*ibXF2_Z?`dMw6R%CuD^1bo}2%FDF)p%Y!lwSc$lfNcXqG98;W}=*m{Ur
z8m$pR^&-Z@!PXd9dR4#n4pN`fX0?Xd3iv<B_+gLaT#<hx-_nf(Y0Sls)wVDq24k7!
ziEKwYEX2$+`EU%XhFkgrvsWzd?ZP~i7toOPABhYW2z~_-EtXJTUcRM0{K`$h-Zbd3
zB8ZW2HZ%W#X*veybwvd|(KuiZVvFLb9%(ILEb<E^qtn1(a+<`GgY=OC85e5C_VqqA
zDZOjXz8-=eZYC69{$Xg_|Ax2L<0OjSCnvfcDbYfLj9MTr-)kjN#SsaWz@Zyu2IcrA
zFa_(8Fcce6#?Av*&H=4)=UN_QK_$gz(xlVnX9pn6&oa^sppcKnhLRu{Rzjhm_sba+
zh$A8e??8^*m6-Ua9yW0mJNx2QVYi>7e7(*icqxL;2yO1(9`y*f3okwe@}=|?UoEAj
z*=<>K1?;}``o{FXHX(|PRS6#a)X^a!E&a@-Bs>&!fq2)kL0%|4YqkM4H|JjlxK<g{
zw~&7_e%qt)?`DQb-C_p8@~Uh*7Spr=4vgIj1{iQJeqakq8nACCOoUkkh?&s`8t<?$
z`IZuYipvlG;{w2wsUzbGk3p-FM3UQs{9OuE&^}&Q-O`ZnJw)_$exnMn{+dMny%he{
z0}6MTrXS)Y^IAV~Y}z{u4aS}NDrd<TBw*w!PDo1n49M|9Vu_6KQ!XF|@`Pb9e0H9J
zj&)ZQY!&8RLMD;ufCPw3$jwDNcD+s!n}&%SoJw-rXF!u7DtImb)@}bEKde&3{b&GT
zw0IbI9ECOkvHfDgc&E&nTUZK1v2OxhycqvnI=^}R#eDZo;j)CQwN{)f#`f>I;wJJx
zIcPq44?UAOc~O31HGH+L`6?*wphz01KNPx+PoX#s##s{J9z^52rG96%p8|PfiE$F3
z!}tkFB8R&mk{0}XwHV+qi8jJh&%52a{Vw1<%&xyAB_$R6)S_6s*dkGotFH(lJ{tS{
zlHs)<8)V;tR=`~Xb;QMrh?;sO_96iTgo1{%@+}c~$oxi_1i6_FBxWRxo2IuQJa=%S
z+N5pWQ7`{X0D(o4KocPe$}e!u%K$~-Z;+VxHu-uZcWa;;8wUrx0c=nV&Q%t8|C*7R
zU06VztO9>aGx{T=hE3OQ>#WM*^!NA27UUW@)V4+3ZOi?){Qn+;C!W0M0Z4kX04<((
z4oORV(E{ZJGQk`&ujF<CA^{mRm<|vUPz$2ZoWE?kG5hfgP`W1lPJBDCya0rL4{5|R
zFj~9Q;}}^Dj-$w!Lq*=At?_0*aR-<S_|mBUvPPQZ@NY2ShGY~U`~(81E1B)Vb@UNj
zACbw)A;3B%(ctIg;UPIW-fjLfT=JD6C9?gOz|#y29nBzb`T;Jm5CSv8Ms`YIq`k4%
zA~W+Hxp_j&z3;;Yj%^U>qc9jC<y%h=5Je#O$j!l&Ae=B(Iuq^@V{cBdu!-Y6jl_Op
zJT2^vtOeMu?LcS6Cc_%}GoRK0Qo}$z#%TUA7&g>_#o^yCP3;AWE>iV?aGXwtpU_=l
z<I|f<zNrKfb<iN=Mz1oY&-ooKn<R?)3WI#nABF*%f?rqU6#3=LGoV`5I=+$aUdSwL
z+H#6{rUIfKxYc1c4%t@$iq$#h^6=VSGh%RnekVhLbWjm$?J7+2Qx}sXA|lG|?N|qH
zOaKst^!N5)uf-w55g&r@5)5ln-1`cHq_XhJq6^tvMc^uljP*9~=zf>}_)#F7+Rsk&
z*O{g-W5XDytFz}J5kj`_sZQ}4=64b{#^rw@a|$`c?YZ-OPW@V)(#<i*Y|tD5TcCYp
z<NBOqOn(Lc3!@WcrT4)RGlb15kOd|<`ZK5~R;M4bVlTi12z4N*Gt19I4XF54nTV!J
zD*HFrOg7Gtd~2>W8kvo!7tiUu3AxUr@8JS!YHAsu`d|Wz3@=h9kkM;Mcj40dl+B(A
z&aEjVQ(`tZ!nsRi2E(VqA;4c_?MHm9I@9mpzi&UrciMY@S_q<?=!ayUzwaIPZ%q;!
z593mkEPb`?@Bgb&k?5CTR<r@xKu~DtwVQ130;F{nw6t|~6N#gkiL?>J1jG?}%c#kx
zw!hh=`SI_SiqEkfa^<YJk@8vzczN*KwT)HG&CS`L1O(B6EnHPJjW@Wkw%r9=qH>FF
zD#TN#u$#5&bXy>`)V-3@oGL~Am!DW?!gHn-&%NZMHDr}O&!m=&elYa0it|YpWimgf
z(Y72xX58m-SYA?pHT!s}?86ClXU!^iQ1&RN3RlfOrV~$~N(FDesObJ1QCUU4B^mp0
z!n5EK>-2;2LUWCAV?$qBRmoXX@zj^swr6*?-XiI|*9$&N2CO@H9o@#0=zov&-?2v5
z;|G<|bA?Mc7&dxUxh%aNTp+<x&#K9}JO^D@vTx2XQVT)85gHC`F?Ol^oMwv$4<xe0
znfKLgh!u~-gedh^LQXMA<vw5p4Qx;vXoAxi<U6Niwjw(es>sO6?}M}taR!g2)my&C
zcjo@Rd$C@Al9G~&%}}W7Z@*QpBKq2xP)VDJ0|oSkkbe2SGx6ZhJvbPfa6Vdvi|fjk
ztV5@zT$bpZD~Eb2@hImupG<EoOO*(7r-8=DhiemsgB!7KuC*o|mUS>gQ*jklD<JPx
z`<tFCKX*1@LTTpvcY21Gcx4){n&HEP@Uuia`W>LPeA+epw9gPsK{~{q-tY}=L56xj
zukU-59L+Dz4~u`w<41{T>75SoiTCf{i;D2%|G6nnz*a7nIFtRkmwe?s9J!*L0L7Rs
zEd^9}PtOe^8fof104(AL2jIGsC1Q~#CHqwYhINV$^1}Q;$R9UV%&%oL)^T$+U51)S
zUCW2iU+WoxbrE6qs;%B>wfz#q+Ww+T3{S>vqGd4&3C{uPoNDHeD@M#^vBVJ<>(BhL
zUB67QHzJBtQm8M`h<x!Q{}_ktYqUQOQ?f+JY?ngXKbX3QC=w4<n+^paDPok?Z=d_|
zNc)+rkfdQ&aSlzI7hTZccuc{K!d2G7To<nm(6t1ESg?U9TEi}g6A*N1A4O7VeTo%H
zdk2?|Hv9QuX6C_Up43FfR2#!dYo{J%H2^s#Tc0JAGZ(Pf!|9}&d_0h<Z~~_9<azJ)
z3q#5!0sL_a@xK)x`Z4s3e7pHZ*sL}F@0%P;Ag<K|a^IXO5s|I5VC<lCaBRYR`5czC
zoNT2SlBC?rdD6BacpTV;IYpiHEDRJdWiv_MtF0R#HANvUX%&_D{j~l;ufSmjfzPS8
z^BcZId-*W5AQHX8M(b`|18HQU_R9q@dv_(El8ZW(LEX!UEySbnNGKBRjTo_Undq}(
zCEx{Rus^?F;FxE0tNkr<(Gq6h%o=mFZGcz%-~9Yfo(fOGkx*^9GeoxsX*!ERy!rYe
zK3<`P8QaAsCn#CtLF(T)`d>28AUXZ>qf%nIUH*qW2d&!#*=sg)<$KUGfn=oBv7TXh
zh2``0n}QeI9gUtAP<<8Up|zyPx`<r=)bcGkI5304AH>6Nb0+(cncT!bMX_D_OLO=Y
z6`B66su=c^y+TV{*geDXtXEA~H+DGKuD?6{?Duv{{i|W+?1YoTTf{6vLkX#LQ(KOA
zpY~RMrlm2E?e`zWD}2PvQT4d*zN-rZF$}E|@VxrJJ0ItQKOkmzR0iXO?fyNk9ek^{
zZcT;4$did7s-fa1HRtB0QT`QX?*nz~JxW|&-@bxRA%k3OHBj8Bml}&^D=)pyCKKSI
z_EH_8uoMmm)RAiQ@@po{Xj!}<`NBC4E+HL!7ZH34c?p%r)I1hp{+F#o{#-*6N*OgZ
z6dJpV1huArle98biE9o$hYv^`R&}S2=~%sT%;(Kcevw{S8aJj~z3A@>3SO91{a8-0
z+@D&51<^nuBVnLL@>EWtaArQ>>1I@%bBjIucS?MdESLAV>P=%)?2Dv=qIKOVVNrk5
zEs;N_zgx>AmjK1f@Jz{KMRvk}FDz7x#ze|?rT5Zes&KmhrMqkI8{brOelt>23)(ZW
zg9SGdeT_>zI+de967i``0XsqhK(m{GV}h>#!~M{a5KMvE>9}zfm#zuck*zyzMPC(L
zQ8LpLCpV;KsIoPd$tP~HhDW300dw~hjYQ+)T{oz{@b>N7n(r@eD^FiE`m+O1SR+$Y
zOQaVn?MC}g$h*j(w24HY$7x`92pLbiENCRrmdT{Xg7uLm%Fho#I?u3J80CB}g=XAB
zrL_ZPe41(62wO%*CZr%KHuf24vb{zqd;ZLs$C90fkoFFQ;5Z6o_x~-rO3V069xF~y
zLxTty_MTrIKS?G2EQ@_C1^*xXbo^?gKQ$A`Iwbo={K!lv2DjOujfev9X8NkC(}BQH
zk?1}Am%8QH={_6y5ZY}XTQ1Tgsq-U$G-WGT<3E<9pEPMYvo2!o6H=EFb_}8T=hU2W
zO%t}gB2ho0?3nNvx2MsoqipSNKGUOz7wj0KSdzBeQ75D@4Y?cTBkvwE47vprby<VM
zB0j&%@EbDE|L>6@|6!Vn)@wyQ#7}W)=>o|g;xB0oN0$g2us{)jCJ;BTT3@k>APlMC
z*QOyXad1aKH{;;7T)_c1oCwIHI<IKDsvxKDf3IFti}Fm~ZJZuRJ*g0jDF9~NdCcU9
zo#G_q<?#^klh}OC&VpEg-Kows-x@Q+Qu_aV`zgfRU8~giDp)2kT>A54{ZELvF*S<>
z{xKL7b{Y#EbLXs6Cg2rgC7Kx2#G%}@U7%vg1a0lo-5Op84mhf)s;h48>G%y`5B3P)
zo+Hm-!@ot2h(C<lLNeXlmc`B6AJ4#QQ^>T0&E)Z5TY_ip<r{`UK))Df<E^}d9Y`FR
z@KPhR!ufl9;3!{qje`F`*=jERfAQxu4rHF;;K51(etP-17T=N9AiQ1?BA%^?UK83d
z^$4mB;jV=XFHw8KO>0`jcb^wDR0V@Vu~Zn~T}r8`5wfVH{2)JQmHAEM58WZs%a<7#
z7_gx%eg_tyabu;BcbAxj-Yov}1~~IFPvFshRPx7}P&S2x9_iN*<G21dGU@MoXp(M;
znVCN<-JPi$zUcO?kb)%OccRO0-*x=f_-nH1D&`TlAN`~QN$<r%_Zn!_Y^{uv09ac$
ze~*>eiQFH?S4~fy91B1ZlpB<SxV7%CeZ7e3xj!?%G#M23GO#0r({0bV$%dScjRLo6
zJ+S>!9vz#Y@`#`Z!ymL_1H3c@h$6B3%*@OpNfUqnek9N>Rq^+|tud56_(+UQS?KHQ
zTT6c8@n?Oua736L=E+IT+VZk%B9lu(KQ4yq)tn4_eA&@qn8|+HSFd?=>jMm|K@o++
zJfv7ZjMBa%cmS$Hw-~6=0hD*^3MyiVa4uihMT4lH0nAH)`OyxXn8^6}Ji`R2BKdjQ
z+BIh^h8M$YelJ|9lkPnH6jPvk#L~)FLwlf8EjJ(+8s4IK1q&Gpj5axC*yN3e%tFB>
zpho!kUwN=fkZ=OW6GnJq7CxuTX=%mE&3|V?K9(szb{et3RioVj9=~_rAG*D(_GNVo
z#$4gI1Jl&gP@U=96an5Zvi~DHQPjIS`$m~KzMzbRjqM9saT-7=bK7;GR)eCh?drpc
zZ?Q(UPhmNPXMVPc=V$zwd8}p4A3c-DIQ`{~GIA05N21??GgT*`RKYNtkisr${%>_H
zf|8&SVd`H1P;z@~FeL)HE|eu(Oj^4UkO8rQxMAF&8?p@Ef(`|V4?<AcBzdf5P;O2@
zg%Q%iPL$FQho0MYUb*92pe$bqMm8$vY6aqrzH>FpPfX4fjDCLuLg5SkGk@*d|BL_e
zIEOM5hhTDqnCdV>feOkDX=t4Nf&!7_`ML5a^c%dO$UVR?8AU~noXx<I5iwW0;QAZ^
zo~%1&5sb^{=?|JepvIqd{(IX#3Pm>uVHl`Hp&;(`mpVCG_oK(cw_`Fr`-jtJ<3kRq
zG=PT`d^WLW4(b!U;31#%w<$pQb@L)NSHn+iM3Fw_6mR_Z`N6uMJN}%+BPaCnZ(WBS
zfTnTQd~urn`gND{(Eya|hL*Th&d(zQkTUN)p8<bixd#t&4199ciJbx@pcNP!Gf)ri
z*da+8_uYdrZD-hSaPZox3_*#;Z8}HlHax)#vO{b*rd?<pLngW^4al>?0hXw@3V#0=
zclx9<4GH8sWO^R_tLDrH)6%tz?;@U(y#?xw74@no$Rh=4%B!_|$bh7Lf8>5yk(98=
zck$Cq(Ira7V>J~AaS3|PS`%(>FA^|gr8AqVPF(L03neM`V&K|Ff3v;7X>!TkyF^M?
zdGRw>8|uCK03CFc;f|y72jfvmm8$x0fmaN9TKoQ<OR+o1fUHieQx~at)%rgGmiQbP
z(b{`|GgN@BMQ7$4N_R4hONwf;RG9B1`0e{}9Dj*HTdvzHIS;74=Do~@vl5J{{pdHd
zHFnUOu_+hGs4%h5#8KsUrmxE3hB;;??^}U&<ezX48H<K4(DHPMa~T<DrEe=(Dkv%4
zQC1G~Wn2L^F>I^p1RUvUWqElC#DyJL1kHww<jCCeFF0F4n9b(N(6AJ#)>r}lueW(v
zF9q!FJ(^GBhpOe^*6dO$lc~;x^5|2|sj0vp9H}WOZ+FUGhK{S1boodR{g8DYaH`|A
zQb1cTHn7OI5FovjZ*VPZXSqRhG*(zNI5-%|DmwlcY0J||;3MPW0C><=8EbS~B$m2!
zCyv}0dT{5}7!3L07H=l*WpuE3u<(7?cVXg5hI=+gP%)vT^8lxt_23l#7ohhaQ3g-Z
zajgb@V|$lnn<@3Q{ze5*u8=1J+04aAiBX(cNyOh!G4@a8<d(*3O+1?!|2JEv`-yjf
z@)i!@R@%~^Vq;^8PeEH>x6BmF#OKT;^INhQ^b`ra0k6~8whmrTg%`H?V9%gbOTmdL
zKNz>&Cv4(EnD0DCDifW$5cq*e7#q{j`23WdGlOYYwJQ4Gx&L0>Cal~rldb^_zT{O@
z?lSOItpdH|E!>9l%St&X$P-Zuft=KskZHOe4(tBfWS{E?q+cIK?u|>~5AYd1JG+8j
z)nP3_m&l|)XTYV-QsCc!@i(xOC6r770_f~|1q}-ZK|x(1zQ%iPA-P#X3V$ZkANs=?
z+*F%k_Ia}{DD~v&1tS-A^_z9ouY&LD+^zj|gHhn34C?-4#g?=hJ;TKC&E{|!<Dy^I
zi}dP4>Z^50cm&02A@D^<TlY3MUPEc`d0Md16CY5syF@p0<CCiuwm_$$i~{=d=07P^
z%Y7Vx(O;z`Kb~&EIs~0_0oeL{nE%%SbU@DCiBIhnxTFe<Yb%4k6*+z^)RPx+#rnSH
zDCaz&ok&d^iR^b5{ry6|H`z87>VccJPF7e&Zpl3Z{TEr4o({w6%(_cr^W(w6!bKRk
zkFU_sya)=yn`=g9rky@}0i8qpkA4}6R+KRIQdmX(0oQ)AV%N2GZ}b&>V{vv}@dft4
zV)Bf>h@8Zmno*z1Zz@KDTVh3S;6o*-OI4|eo?+p-KwKt82MTNO%24k=k8n$+ok9vc
z+sJex$^XBYigN)@a^69I|F7oCt<HpB7W!T-hEEI&&Lbb@Bqx{F!|d|%ojX}JpdxfC
z;<XAz9{Lp~)2A)KQtK--yR-49=Ke3=^G7ph$W3gWr3Rf_MvsthI2!2MSC-AXQI2Z6
zCqnEF`zJI9hv&d{1`StL?8|H@`g50(%q=aygTHk<q&Vt;l0F~y2FmQSXV1U@uHW$~
zIhS!5LPz*XC&VU|T+%emLYm&X07OV$n?bxPn<1BuQpl7*^rB3p(<WY(3JCZA0~%M(
zE`S8>9VCe7_Kv_&*$HT19DdcqI;D)&KE1coj{aVjoh&Wu0*{-2@kn7eNwk0!)?LXP
zJ@a`C?6=910%}h^AtWPy!4Y*cvD}F(@Y2c?`vVm^F=2|v+e5o&QnsRSL=;;LW-Oq=
zbYnL6yIl`+&a63oa{*zd<lCT&5mK{#5kv_tctgn%t;cbzeOrC^B5r+qa13yAp5I!r
zNr@uOakb;r3kbxS0HaxrzRoq9nFo*|47&W^0omkgTLBNV4j`@rz^(Myp}3UUjz}^c
z2wz)EL+7=NwA5Qa0xEO6lJ(XJSkZA?e4^;UlC`<^2g`oK5U+ToT7`l^Cde?(ckRX|
zjW51zNUlHH`B%DdIcyxPI?5hC{+=Iz^GQh}q9!RNEfjTImA(W0zW;padFM<vGTd{-
zk-D+)NX~Sy_sAHl`!hHM;y%yt(PdI$ouA2*<s@<!BhZPDkZWGn73*x!ArjrZjCC+$
zakHPmH)ulX;G#1mtrUK<<liG27*eEgUNdsg*VA1JXluj6KPUA-Ua)hHDbqqy*rC9c
zr0Ce|(wJDZWyb_B@fQd$XLpVdJ}s5VSazPyl(q}O(}A%ipVGx?p^*Uz6hDkJd;%~}
z!&bi%Jm9nQJ*mYh4oxr{gt_P!qHc!KIAt)zT81esI9Q!Q9Be}(003u~vH`!+n=pi+
ztp^$tkM*Vi0w!j71iB6N@?ZZT!$>woA|^=sbVL3RZEqb^b@#o23W9=4N+{BZbO}gz
z2}qZ;fOL0vhagIbhwkn}HzM8LCEeX{_j!H8?{Dt?^Ug2~!wj7L*`Kx7T6?W$Jx|g3
z6)0H=Z8|$_jiJDjCsZQdFmU<h-=Jv3ZG8FK9$-9xSP2X0nWP03!8B>IM(*4I3E=0b
zsPud>6Q9+U6)G6^JP?L4icG|&R%`;IGz?obwr^S1z;z3oD8nN=pN5P~XweR!J{0qm
zQNWczezkN}=;Oy<`fhPGd(1>+oDv|v6od!w>I{O+AXy^}pMkWF!Dh%XkAe`GDsL7g
zdHg!`bxHj?13vY;Ch~OBT6Wwv%2JCmb|h@UG}#79JQcB#_R#SY!RVl8v8!tzF!$Nu
zPXW~c-OaBvce#?jd$BQEFH;S47?pno5~ol;!wvBvE*Yy(6P9J74pibFE!T7^KQdjH
z&v@>m(=?3{tK8h&0O-gv8TPd9U07V~QwU}td0<Xb`ar(NG=NAAAYO|w-UyJ(fY!i+
zCj^{|7{ns)@_~PSy$e$wke@IY(IaHH;^&~c0T>$k6thV-HZ~P;L{C5qBnyh-pscHe
zfdGgkgFv4&R^mnMv0ZQ>K9jB=DQ`$IbymTDt$~d_%mNOJ8FrvatomsN3k<+c05&$^
zE-(_H2YMqg1Pds1V#_JXFVbCgX;{`B1Yj;Y&)Scx*1LFIZcxB_i{PRuFRa(S4inMP
z`l-@Q=|wM250HDX)?3qFr6=RzRqtoX5Ye|yR<Nkxti2;J`(0_EI9!iBwY)E}izC9B
zqT$D4{?`sV8`>{4+>}q~mQ0r03@X#C-=QGLy=1!POct1b3EU)i{izm9)vZt#?l-N^
zfievEKi8<ltm*kAgNH_@edPS8Bdyo9^LTDYi@9_K?>f~+Onq<O^8Xb^7M>!|65R^B
z!K56czJI|~%?W`dd0bL~HbGIkucTs{Fa<ain1KIFk(8OdR6#vy7~5K*DR_bc%28Ca
zNxeN?i3YgV<$g#6Uz&kPjI56Fqzw&2fL!Y4cmE;yyc|nTUsjcBaVn6{9^RC%42#Wt
z^pzAy22uenGbo)0v6}#_>bjz21L=A|VBpmcdtr*dE^lTC=QjqLGr!ItlZA?xPdi{4
z8sD`wytXChlAW51ixb{$el4OiNqF%0m@9cEZoIN-o-k$XEyTkZ>z$Xfg0P_eEy3@{
zo(nOXev!h+kT2Q3s{d9oZ!X87PfL6$iEoRq&|sdZDfe_b8nuX`)fDQ(2SAYq;$3^j
z3$^JE<P)F75wHL?d5M=P!m<tE+JAn~P85x0E6$?=amWY5V)Bh3ZC48kEa;HxZurtb
zhXIjibOsQ(kPg_LgvR&)z>nxT!rop6XH(0?fdq>j@BoQnvyt;?U555gt>#xz=@v28
z0Kkjn=&A-_okeEGp!YAJ25Mx<J6j64=m|jEo*3>c=E50dYw1<v{5vqJNY_XLUb>xr
z33A*T)33_Os&A0Rkhm`;2a78Q^QM7m0vEXf6KNQj`}(l+s4^C#`q?)E^UdN-+SX@<
zZ+jtB`ewpb&mN4{5=Lk`GgJGC)|f>+fCmA&w`s~UNn;0~m!cH9$uB`;<$H(`Xeerv
z<0%Z4E-x)bjo1bEMBPUQ{1N&Y53+<sx&#DlzD3{_7*knD^a2nSgw3)r-2`CjK1mRC
zfpQ?VTo{ZMj+7~*FkN3;93}RZZW{g}*~aecEbi<+KqG~rMlPY?7M<M-E_NRP*?WkT
zI9F^?I{;RxeVU2FvQeD}_Zzud2Xp;v7@FNkW|26nb{@=|Nx0N+`hL%)_rx_AyA1h8
zZ7-ammEA+KRGbgO@|+;(eMTFNgHdKm_-t09UkLV+4QeEl6by`<fAtf!NdF4b&KpC^
z<u4b|;T%ICozBml9NNXsc`ky4cqg~q?AvO-4e#m%4Rngad%tVaT*}1Xhwjd3)m2*}
z(ywN|2w<nL<4!aldRT8-E-D;!6qy{rAuPlT)5q#J!zN%QgTuH20GI%PE7HWdF&6dQ
zc=~t31b{YsY&=mDfe7%vAU$PfXhaWQ!+*;DDCF_M$_3r|()F-OmfSyBfc_5a;-8s3
zhdRwEPE`VqPfSPdrwEXo)*PL^T&RQ{i7#KYzS%aDJP0fsKIq%vIVYPfv37Z7{9^o`
z9%MEkPj8c$GAQuLhR#pk{OV5Arfr1MinRT80)Dxe4er@f72a2X*fhBzvZ_)AK~RX!
zqD}w<sql*4NB1hO&yn*V0CNRW_TZho#R{nD3mF+v>VP^U0we71W@w7GIM9hD?6=XV
zt?@{@jbX5HQE*-4-X$9GU@f*vOi{S8`Ge(<!_gB|9X=Rj_4G&YbvYS(bta#nphT=7
z&0}FgpW;{PoU4JF-tY)7`e<3$5z=1FhPZBN2HKEtPd8gNd6;~Tgm~1H+?M9IG!{O1
z)OWRO<CBJNGpfyxF5`YQE0w<X`?3l9j$Q@Z6dN^{dNn0$|NB`PMeLOrG<`RIBk*gc
z<`RkqUmvl4R{s3yt7<3ZSWr5X&dNT2J^iz>Y{LZ$LKVXO|8v=_Q6<OywJ^ENw|sW|
za#k<jJ`6Rui8Z>gY4zwKapcU@*sDU`%yK-x?<-3h-+g`W2f~igq-m0d@nWF~??&a=
z#^;|~-W{vFji~g$8x&3N;oD+k($;?%B~L(yy+55uWU(4htRu8pyj-|~tv%_+30+J&
zi-c4|`<DUlqhgLt+?N3f!b~CYK3I5IVd2qui`pnPdX}5Wv=S3RQFT3->di><9(?sX
z=)!@b?5qzTMtT)JEvB%D5w-|uTi4oLOr{KbT#LssaOPZTQ04X(A<=B+@wl>yAJtVu
zOA#(w^yVuJi0w4rBXK!HlbYQE<n?fH<#oC0Z9JD>GLS{^NmYxR+gQry^In?4<P*Xx
zc+dr9s-L&}{MQw%sSM%K84E(ltuy-B_V$Aw9L3$eZNCpUIc5)fB%Xp-Lih@}tDas4
z;g&d-*~Emddauc>hBohQg_?FFt^fqYH2b#8XR}qYHbw(2dM}C(k5PYNMe~-ZrgF}k
zup)h;W@MeE8o>W`1bZ{3O*6kVDLcl9{Hv)~uwEri?6ABDp1^m|N1M^Ce0p1FhyV4=
zE&S_bXY8cw#U>YHvBSf$Ui<HMA5eh6{QIjN+dMjQivTwMx5IRq+Cq!B;rw$<A&|^@
zD$cjC^1vK9I3Ih5Yun)GOISK|qI#J%Zi$Pw+}o(UVD(c~EKrd2^>l|fnbZ~O8(O?Q
zBF(^2LkH5b{iFr>QKN+Hu4nUZ_c&FIH}|>m`QdN*K?=OF&UxqlA^Nb|HZvM6SP}IS
zbI|52L-^g?6^FEb)_YdgbOE+73pbh;--HNs`=4Ur2U4IK=WaU>|I;)C0#`PwK?!pl
z2>5UY6bLghw#_i`)eMP6Ay*}?CDHkV;JEOl@|ko&sduJFUN!?Ab*+3$-CxxsE#-=2
z5H;&HM8b@RaO+LVPsLB|z9VRmFQ8i64kh*<Tp+jmhQHK3+IUqzSZTmTu6q<mK&0kQ
zl~P#kS#bJ!y*FrqQH9CM?H-II;T~kWTN2P4cGrr{|1LFk0T;@yMFchqTyyA_42HDc
z&7QGJf9w?B$WU)9raUf~#Bmn!k427EBGWz4X<rO_6f7%0h)Xd2eiNNUQhk(6k12D*
z96afwU|NI)32a$QiTdYDKP;7R%rVp-k`>k=>N(Pjy68xY6FEOWaB77xW_uWJi}QF}
zbMgK3uRDG{K2xO3^{(zxIs{@-{rb9}5{z0;D>SNM5M5uJa8*D1eVasq^JqV?fpzi_
z;djy5DmA#%!F{xo-SN3kCKD@Dp)ub`XrYgDpr@>fu>tOCinTx9x#Kj6#E;c0u`!*4
zgI@hd5Zx+iMe@1{vwJm)=BtmhH^`8mNjDKJtsdW}DOp%|$!p*pPLGh6JbHVnD$>OL
z)fTx#N3JT%f<k2CnweZKcuKm1+tRVXcgy}Kv((jVx><TEhu_V=Z{P0`UB9d6vHM*X
zYC?p+4!4CP3<O0*r!X&N(EQpkINp{WU#afLezhFBee#yJu5Q%;-De<ImnUOPt03FS
z&B-i{)Q=k&o~~f`Vm+CuJu+k|9VyikTB8lCvmuarV_F{#Ty?y=dMr0uTN9?E<N%jx
z5XD<3$%==A<rDeIqB+5ybE&BOYgcFxYILEZiJ1iTWsmRtqETi;Yv@mHR&>YFji7<#
z53%l<aCflj{JXP>ER~Ljd`WY>oHBnE)?^>Rw)yb)Hmg}5DazwXC&<`O?!+%?<kP+n
zZ52VL6dcq){WXwmO2gK&Pve@b_K{W){Rsl1j&;kc+MM;=l7(bqyP!tQI}2unl~z*C
z)3^t3n{bf<6T-R2;y%1kj8!ouQd%ilqyqlO(L|*9G`#tcX%ncBv`!+Xb2Y;b)++ub
zoa?ak`XLD^JC<#c^OK!rJW|SzOYWK{B??V2J7!ehfjnOEO|sm5QU4dJ6|-2zYu@_w
zISkbWrdN&Hq{!+ou4i1_+;=I`aX+fE(!d*Lb$vQ`+xkK_Poqv=&sKb?$U$LHNe{b)
z)Y@~l&#Ba!fowLD4s)LhUd?)#vi<908^+6tSKE}!{ESpY2k%=U#P-aiNPU_)!8Mvj
z&((1irk^PDUYWg22C+g4<N@ub2<HoHtjF<S5Dr$H?L{~zSTkq>sxB`-AbGb^FzEa&
zO$eA6!s|qmX>Y*uB(0wzp9ty3^e!`ZyZ<9Fx;@~?lcXq{zmf<gEpO>g4J}|~|09_<
zKl$f#bCr(?vme(FkI;RHx+;GJmdwfqp+hQ`TT%y0Y{=p}>avB+aJG&~UsAqzrn2^|
z?+bc_JkAj^3lEe`d-)sT-!*vfp2z)LK=&GkEscc}^(8n=_u(%@{J(jAq{AVYPR4)s
zF)z4@s^D!U3;bKPZC{icD(GE{k9jDAhgYN|Y;<HI$pO#u`h>h93!lc;1A{s=gy7;B
zU@|W>j&8f|;=b%g@0@gsgTl_Q3dHc?Q^M=R!$Vll?&HUgPWTd_!$$}>et>LT(a4Pd
z6&Jko-OR7wk?5exGyd;LG=s41-X1sT>d_u&t+M_U`JCQ6eTF4$_5h<|65}ntrq0pC
zlvCwwYc?Ln^1AFPz@QEY5LZ$Xnf7hBjNE9GaWE*fBe`o*2Z-p{eVtoZFQa=21>k~X
zfNso*#kz9#_ey-&2$ar9d3a`*Z~X%TmZnULL_U7pfM0RjKRQ>o5`=l2eQ|h~hUK0L
zMz9QXv2`@$b6)TJ##smJdq<yjKl8(GDtnqo?BCl)4&B)`;E=z4<5%-|a|<cPxZ|n7
z;P4-lk#YQS6ZDyJMl*{nv1-YnW9{1~1bi4?6GLr#%Nibh7Q2n~Ujggo0tx(S!!jlS
zxB~2La&hs15aA88)WzY-0RW5<lai*60B#qa25hiJ*NOa0AthJxq@rfpK~Wmxr6t1X
zabuTocG-4_K4!{?$FAub#K7w`UCglba8}{b^l$SQK8DYV&-So|;y7iB6DcyN4C>w5
zlHS4A;(0p6prX6i+#eRY>YMc3(VzEs^BHO4D!jX|FW@5u7S=i+e`~f<NEOv2a?GcB
zYf+3$0<c4p@a?a^?6(xkkU*~=g%G&rklC}oP|Ei1RGH7fCl=QEI*yC%6z+xD>}*EH
z%U6xqSsnKo7smxMG7^RoDtM>1b8wE$M&)Th24@JX6bIn716Nu9kS~H`sY%#v-}W9(
zEvzTQfA8snqsBc;-dNCV{}9b@qxFE7x8b>I|BisXH1+F8HnNIlnv}?>j|3IpBIJtx
zNOc`ueWuvRoGbG43oY;lxJVt50+27Ki>=ELE869Fc>_UIl(NwlA0dnv%BUx)xeLt?
zG_8b2^GK46-(XtBfYWT)X&o<ywBOuM_KgGiuXG>$mwm3j#{(SX;6H94za23UTy<V4
z{*n-jX+^?Dpz81JDQ1f!#Brm6iWeL~Srnf+ljb6+q1wPHBf@smH`L5eOw91|O~QNx
zinwd!XJ<H7#OlwjfxpQ8gJLn7b-;NQn_cf(SIc;Ak?(+=DkPbtgMk!ZCAti7HY|x$
zba-!@2+%xW%243`q<Jcjin%$Qg$CMj5|g^WGP{k8|4K^XeZ06DmS<4H=dE{Ny}JTI
zT@9WzD!xy;xjJ6)BhD}CjlvZnvS@_?Q;{|r*v4Zr5_vBz>AqaaT>LmDqS4has3iy2
z;sXG;J|@wjDyjL;bBr6@kMtuzN&j#c(QD6z@OsGelELP7%Io?F`B9`zZ!KBHxDkSw
zI)gB`=@>1TAQ;nkvFT_5f<Lfwa0rBcIQ_5wJreg{$4S&55aKxa-Tv<1{r(OL;jAA_
z;PrXVvEya<hh_plms#HLQo1MD>g~f#%=VaHSVZx84f^2DLnk-)KTZv=IH(Q8efi=8
zw8lVBw|(WLGqmc3W!<1Y7l^*kNl^a$kY})>R5QPE-+R~xCAg)ag!JtSN4o$md8qiT
zF7i@O9m0r*?ZcKW=$kPrt})=t<!0jlYCpKefU>oML^iEf-80aRr7tQ0y>BNVT~#ne
z)m7&=GRpk<X8gg*nU2yXS*f$5;yUNA(p#_sXBwm5cZI)i3?D#3i1I+f_9tfX$wKVm
z#mjWsq%gH!uOP}T+r-Pql!a4j80^p;FlQMc+#J*k=Iek7PS9ns!rT$kGguiw#;fC6
z53#S`9jT)}-7P6s6@7Ap|6|#1Hm4nlVBQFWHP~JX2milSPJcf?I}8#}Rz5Mlj9><y
z+ylxb*k>jTr7^3Gii3~mdNh(?oj>9`d48~rqTWsx!QJv55-<p)(_tS<3qOa$b`-wn
z_fg<&u*o2Uuh8ux!_sOs8Nboa5Cbxm#e*@{uF>DEQ`o0@F~G*+9@k<u@lLtybGdk;
zFPYr4W;Ji6>OjOiyT?kAuQIeX@+uNCIXM|13*~<IHtevuAH5vl*MYTq$bdxKd3%CM
zh#erKQ$;`FWtasQKaVPZ3jMC0Bxv$JY3kt*l=z@3E()rIa{|K-hXJHN+7|%JM`?kF
z^ffb#;=@)mgSDc&A`+KYW>s7)V*HF_b(L{lYz7_pxLH5rBv_2T_JzGy6BxgLQ*m1Z
z&{`s|_$Ax$V-Q8QfCQbu(DhO99Buv}3aj>IEg?nY@{?&)JTT)4_T~2%V-WBazWhUB
zu1HbQF<SA(g9hcnPG3QG&J8!>$$;4W#da;_=R-a;?^TwU3nK8UhHpr%SNJd%`)cH&
zt%^S?@t3!)!jG(BFIE*KLZanB;3hg`CQ1#mHdjqxU-Uqb%&h;j4c=R+f}qR2EZ_=s
z$&CJIT)+xuQeqOmqJNpx(fEUS=bZ;X#^H4Hw0QLd2(1noh)eA~6+IpNBk3ohfH{nw
zRFi;`aHHjiv=*tA&eccaWfonNQ$gt|xU9OMFk_$mUj!X}yuo<0yjEQg9$vhGwS#Jv
zDd*F&v}@s@5V*xRsH<PAMP}ah7X{WZKLryGrp!P+0G9FmZRO-(Nt!L~&AYE;$9%Py
zhChAw++|Gdx*xp-rxWSv`qc&XEiVcd_QSN>S_*V|WgTfYT40|{vQ&i6TO*Zcg!t=u
zho$el_RsS$u<%z0gxf?AJ0#~m1<b~fTufwjpmm8srJ3<doBJAMV0{_6Rq~hII9d2F
z6;r;L$7J2Y3x2;lO8q=<-QYQEjR=hD@2>?*SYL8F{BqKz3s~mSDqY81eP$2#IK&o@
z1Y43QdBFk%9p(VWHZnc-p%7Q3>~TYz7EBFiOL(7F0vdO@sMwI!q%o1@#4W6c4ESnZ
zOW96}#&_Rc@iUbaF!wX7sQCM&UwFkQXs0;X60=;}2+PlrUm(Z|*)kF}F28f88l?Kq
za*&L`CV{Itf%-Mj<~^8?xDAz3XVcm1tIu{8k&5TF!K0fh=U+ojI4F8}=MTim*$qad
z_eu$`rKRdns{=jgh6NKU&&cu(o(j2_8it{HoFZ*p@wAb-$4_)~A%r#X>SM2+_6xti
z9u2Z&9pegJ$|s~)Ft;vayub>N$oE}H)?M*xnAr3r>*$B0e+jR;!T%mAn$30d0r`bT
zyYuzyMZf<x4zS?EYRu%Rp-scfi9d5s@&>9@^vc)g;h9Et(X}ZEJ1M?II=n%tZJhel
zI!`2;1i4(;shk_rSCGk)NAnPfL<+G`f4%*y2TJ)?f?@bwZ^|sXR&AKxhZFY24@pZs
zJN(wto!Os7^So`$@ylCwu_ByMzQuWQ70RgY#qn6CXzV~_OD1KR8Il^F3pZ^o8FU%r
z6UpWEj7FJGK4wk43t!3<aFu5MbHP7hpcHO}#xkd?`;}zJxw6Mj4S}=J0%vm+AGC*h
z8>tx%SDPEMo6Y^YO*xaea-X%{XU3VFDGPser>S;udBv73^Y*J0zp$QfK4SRu5Hatv
z@rEjSN6n;`rIEf^xs*ZT9~#b$45<ekN#ry-&8ZQ^t62r?<&G4(rW)QO%whw-Hs64T
z!F@vab%EA0OvSe_Cn~ek8eG!bJyX{4b3AP|y%$`Wce^rM|64aYJFK<Ur^N*wS}pjV
z*5AWxG*S?`d+>0KunBG1qp8rm)-IxCw8Sb_I120i%}Maanp~8+#wxzjgP)|i)_&a{
z?B>Lj_#`Sj_kFs#%t>V*%5wwfe)h?}_UIA|p5oRC$C@rl;KJp`?S4>%3y0Y;JFR*(
zVXVoSpibH?|Ah&^83FML!e?uol)whT?VLU9d2=?MF)qvJ4PB+BPoE_9gf!QErDErC
z)QeN_SBelQh-8a7)^YHma0vK+3pnukdwOI<LhmCO%XjCe7Nhqx8lFxd^~5o?FP2Qf
zwNWLdtp9qJ%zpQpt3B%_oW3a}dxYY_iu(25Gy7O>Yh5cVET63&QCTxfiU+nxZDd;a
z4PGtmZYhj;xSW{=nV+(!Zq1k&VDWCLpLw7yRMzEv9zJlcHKjb;0^O)Z#)dn$$k~Q)
zJ4za^W(=;r(_Zn8*6M!xXbx_cR|wF6X<lib^v-_%AJKg^P1gUt1mG_gfLJ?(p6poW
z{?=Gg>$-~Aa;LovXMK~ZrlC&XmhC`>ByN^D<^9kh+4u&G4i2xSyPUW-=L`1RnR9su
zGQ2nZyMqWu*!}0;HyFb!F5|0?R(9w<Ud7*$a;@&8uTFlQBCs1BnWZ9(b8&^A<4`H;
zUuwaB=`oDLLFHOdnlF3f;wLuxka~oFrQ$1mV&&jHJQj0*KWS!fmsvXqs`&d*nu<@Y
z-m}xd7RF2Rw-H?RKApRd-D<>ZN2+D!EZ8(>GuM=!@RA%L88<vdI@AsD!yx|OppgZe
zC*RnyO*+zabr8uCPq1pUS7GPrY)(SeZHI6bgJCo2>0;Jm#uNN-w5$1&!h2oXd`L=x
zo_@!l9$S0drjf%NUe6Y#EO`x)W-s;)B&#FIa@#ys#$yfg${WwBlGBI^TxzN7=BB3a
zXo)08L7)FntQ`UYcu;B>Wwrd4R-F?Q$Zix@ck$V+?t!jm3!o$km54SI!<?F4x*{YD
z?k{z@Cv`Qw<ubWPhDzUl!}Q{ydFDB41oTZZ`-%cq!ZW?H>kyK!Q93VeRZ!{kC1_l~
z6DQBvDlzPlO(NUh`6hqU+I9GP`n$&UcVtTb4Uf|hg(*i=rSzjXU3}OGlrfZ*GGRyN
zE4q0OuuWD5RlQ6XhG>gFm_3Pxp3W{xE54{lKzgKno7k}E3-0Q=^VUI)o*^l=!{5NI
zh5PV{Vc!xy99f}^Ix{Zr$EAg(-0WZNfJpf!BUVcuJ;;ayCYBe^@f090N~%djgCHP>
z7rR?5B3+)d?=$E2s_L&<$~)6?<e?EbA>LyTQHY8D_=<h!+td5Q9#dhz7#hdIo(KxJ
zUUu-f<VQg-EgO;j{3!XZD7aE;zhr=c+CMFK?iIMtO>=!{xtNc;MIFn?7iv_|;Oo#G
zJy)tKnflb_n-@v9H{lSEKfi0KV>@EVzdw(rX`+DG_YIQBzan<4_iLnlg#;cef*axc
zFuRD?c$UIMlmKQml@vBxSy>rOz;oIAAz>5fiJ_hB0eq#xrTJW)>P0oRg#*xa?&m&w
z0z<X}MuaG;AT^iC3R{_Nqu0pUwh2d%*>9h65_mps%)jb$e(~yg++o|tbhnfk9wfo&
z_IWXXi#x%g_=k}PNA2WVV@ZyL&Ddt?nUIfkc7J9&#8$v?pUl)(Rv$Lpze?@9Z$Gel
z`i6dZvcl{IJ$-FZf2_xDDP4hgeB+yiq1=t^+n&R2KPhMuQv9T6fy&V6q+7(jHnREY
zGXBGfu@h&DBiWA$S8Y02kxE4ZpZboxlhF~tW$MkW#*cmg=+Xhob1-E`m}*|ow;?d5
zMmS^LP7uO)3A%@RfXY~+5u|IA`t+*E=C!8+Kc7C_Ifag=w9EvYAB{r;49O=T<LmR<
z8rQV)D)nhU^r%}5&I0ceQ>&2H3}$?L3Oqd>$8XN${FGVW+;3fn4*Usj<X?cv9#^?q
z+O8zHI*9IF)XP;jY{}t?2YxN~7;(wh)Hj>$UD~!o5D|?{Pn}kKCui`;CvCZ^n-|F1
zMxt4$-K#d+x}3T5KsSLp_v&C~Io5}Z`hG>nSLP)K6i0xP(Jr%qQkvsiA&`>K7#e5L
zstW>S{9qWfTf$I<Z8^a)Q?F;7igNchr1eUVgLrlA!0DvI1UyvL_BY=L>7vj&BwBK_
z+&3YQtSwgSLz+~t3ivRzDl>e?CKLY21pmqhxnZ3&L-wl?+LD8kZ+0IsQ<qaUPq}W~
zIOpm%r8M5wER@pWfoq1#kF;Nss!qol`sWAZLgZFzEQR4BmNUMhCwWouIB%EaK4?<S
zsTLG$9c?p^ebythu^lTdV|QgDV&GAH9EssMj-;$!-L)fEa5Uo;Hlv6rg~8|w0Lu8Z
zFC*i=gwRWoasaq(HW1)Ik`Zg`g}9*osCk5Tuh+uyCUvs*$^DR+#cqa}8jJ2woG%8m
zfi`q5*H24~Hzegq`Wl$gu`OQ&cD(Z3d-!{D<R1X)Hy8^~*-jAhwXvs=D|f@KwGcNI
zHFb-p<t>AU=2;%esnJU-(0+)JA9}n$a=h$xSZHE2pI--W*e26?epA%bjgZcd83DgW
zeK03MKnEc{AtiTL`#us&OEbhcFf`;Joc;}_1P@~ZRr4GMB3g64K_hwTEA~7kwXJT+
zy6)o)@xNND9L^}sR2#eO)wRlHqawo=4iEHQWi|YkW@r&aZrvmFf5UqIxwe!6gt&19
z0h2c$(939kHGl{f_|m5Pb(ds+aMvw8;lZIbADsI5T1I`@XZzE&Zv6KRr%s*ynEf9Y
za++15H_2Gpmesk_MtG0UwuZ;N1xY`2txan6_QDAIZtx4LpA)=@$WIaTvUw0i-N_v>
zfmYa(5h}jhIKd7`lm6K{*bn?L+4)2G>M;Is_1e^NPnYM)wzjS7DCgEI5ih0SQ85O{
z2s6@Gbbq~2-yd06ty<k|93Bu6eq?vhK{Bwtjpbe1^=ib3sUfO&J03t2Z)KboD#o%E
zOYpT4YT+1AcEZmmvcGs3-nmdDn_9ry{;>&(7JKE#>K4@^80<7kx#^~8FDk0x+AoX7
zN5?I)Qb}2~-I-4<Gz}|hxc+CQU>Xv}|9W<KBEIFmw;np>Ym&CpR6&1r*FMDe`B3Ch
z44vxge|9`V%l+nnCV$qZ9HCE&;KfpX=Zz$?*kL#9U2jPo^qH7zCQ&r*eadHsNOIU8
zzr$#lhzg{5C`|mC8_BkzuMOHOI9Mq6R=lx;dOUTvAkXR*+kL~={YyVKd8<;DWfUU{
z!n@2VoDCyA-k93G<1P(gvKj8Li0=L$=p7u$*+s0Ldpl+}`r1=%4eUjG&<|f&Tsy97
zLAe0pc<0~sMuq8yCB%NxxgnMCBgOclb@%e&@?L~+E8ZRc)RM(Phw=^I2_u$x8f)sL
zWE+&*Tx~BN2valjUapg6(0{D9Svf|f*`QbksKO`a2#MG7bOgkn4lld<bRKeZ^UF*k
zjFPLKfpU<fbM}g2nC`We1KS+WF;BQbJk4m4!&~%36DA~{+)ClMvKvA{+;tz5k_z?L
z)Jtk-J-yiVOe`FxxbPbDH8+kls$d*?|9$P-gF94xxi6_77(?L!xG#s!;NqnaYQHD=
z?8PG~j}q;UK%8Hn%i?-P7{7j4{`H0Q&s8X7Fj?S!tob1S2bg)O=2aU@%^dkT30of-
zicEw>M6`oUMEwgjZE6-Y>FRP6c+sA>@56h_AQCaL@!vmTJXKlV2rLo_jA4yV>h9Ny
zuOQST+z2wUUt*%>c@``ppigRyu8BwlL|Q`@2OGlsOmF8Wu2A!f&=wyT{euNyL^66a
zU{7>P-?noO-yKV5J&Qy4f9(yZ_GC()#}nlfW)tIpLF^1nAyF}BjxC+Dx!J+RHq@%p
zqv*cxP0gPkmKbgl=HEI%hu^R>S|NkOoR2IP7(t=ea{S3@XTzeZREv8kbOGbwZA4X0
zNC_bQtuHMxIZkvzk~cG>rQLcW!N*En3ee@S;cwU!J5o1HjdJkI(8#4P0MvDbMgk;>
zF3_1c2O^9mP6xUx_izg6PP(S*oXZY<L|#-=H9ma-V3+c{GMm?jM?gHX#l$X)llRrD
z2RBz|49>=6XFwx7SLf#PggiBi&UGrubc<^0vYIY2W(%t?OFDu2K)v5(+x@VM8X^n5
zC?jw6oVI^t$uQ;P{M40<_jE64VtdBz-M4BubM>(n!*N!jTml^hR-6|&{;adw!gfaK
zJZI;wGzfEvZwT}nrQs}`+Vpv?8^hXv@G8YcFT57V`_pQO;l^R3iwP;MIKRBz04T_5
zHO`RHdP(@*cNSzAJa&5`WJZyUM<jb7<gqAsy1IJP<)<wso29p5a|>>q7x{f<jE-G1
z@{u{HtxH}ocq=#P$_01k74KI1$;T_-tZ8XXm*SL$hFUv5;3g%Ue9AUzWOgEKWbSFL
zMOr<okPOWdp?LKwM%X#@1667oOoV~*X7nmBomWy}Es`$}emw|-3=F}{V;KC+{~7HX
z{-#aSPhMQo^X6nc`f3;q-6p#^Ks^9?YGu@Vj(=eYWNEqD7L3s=){h6%1+PZk(F0Pr
zCEu|*fS?5oBOTpi!+9zUd3+3^hM>ZP&7|Ts@cJoXi-NxF7})uJGtH#-#!bJv5nu9F
zL(k}fYiHrRp`2UoyDy=Ro-~0$YkQ(bVYjdE-8Xe?qM_TZSR?eb^!NHmUcNi^P*vu-
zjIYlpBw-w#3uq$dBN)Qj;Qx=Ke+F`rOmD`M@0b`L0HCMKx03p8ww%(~k6r+*iE*h?
zxdMWKbDsn4)IIoKA7Tg}2k~#+7M#!*q|X;JIDo0Ly*{ULz$L~HFUViyq=-}Cyuzhx
zUu}R2XRpjX)ZkSdFZ+Tc=T_Q}PpRi?lCg-GIaUTWXD*a+bY3+ClB>x|r;RNKJ<4W~
z8)+C@jqH#NMpxPsk74CCA6-@S<OMSKKx<b7<Mr9ze9_F-Zo`#@NO@FJfmS^pVEUoP
z7NJVbEjWo<X^bhWNJ7e<x=c|^ie=EYu=fx%{WMj>8~V6ZR`Ij`*>}kfiJxBcbG}jU
ztkMxlkh;0}d_}QM*k6aa--#ugkIzk5uY~f?Hj*VKm>|Cxyy;QQzq?h>3a~~0pWXWG
zRRY2yUbjLlD+UEXB>w!8o&7f{L>CF+*bgZtlbvL=`cz-~EHgWkxl9fV=PMkRTJc8y
za?2B5GbiKw4%ZE>(K#G%nvl=GJAGuZQTQQfo(?rD3JNk2&Y->p@ZcQ95GPeY!#JAr
zX&t8)b2dj*OD)9LCc+tv!$}s>vtnvUS;v;2w+5oc&V0=$2uPE9u7Z*SpDOGTQgzWm
z76F5J8BG+E{1ORMo+;<n5Q9>rrVAIViDqvFYm6UWgRvg7N8eh8$F5tnEX(ZOSL5#p
zCf6#bSda8w@aDuDj4J1&SMqd3r#(~dGArd|HL{OAYs87ThxQ-T>P;@%z;BIN3O7=`
zB0aiAkzUTJOJ`QD<MUTVmVWw+|GxkLjx{5!TchVZ1vOA5lfL4o|I4ZXP+T5ubMvK(
z$irIc$qmMR?fc$8`HOH}Ct0DZqpU&fgx(SJcU&T1f+C)L!E`AS6oH5GMiq_4&nkeB
z5V^%v$V_<{OVm{}=(R8b>@*ln2@14{kdvXS#3s1};8mK`^z*!_(Xj^=6<INZk>cXw
z6E*gEq$U!>;3Q^&5w2AwPkQ6+3MWAHJ;K~rzcmJ~8&+~pbWJB4RT@;^BlF?Jy0Z@`
zF+rKKZpfUh#|_UfTD&o1T@+2dH_QVkY$F>h1r`cDKmAza;PJ}5Auv$9?ZB;KSf%Jm
z;%WWsDExWvd$~XeLg8%dXr@xPk>p0UdypfG&2Uhl9S>5X$F6bywKaKR)ygA4<@X5N
zR9V<<*6Ah1tL33M$%%Shw(wggtQ(i()+n~jb*4^U*aWQh(+GTQwiR1GAl6$O2?5+d
z%3ETnFWx)>6c5UsBs?*!Y=EKNq)qB%fn*W^`X&pHgdQU$_gPLsWKM(EAYoscMQVmD
z^+SRjxfGY}NwtVKn+l{fqxNbcZEA@wrWP?!LRTUgkYbkfL&zxEXXdQx@aHb?rfbpm
zvvaRMEnDIx47l!z)FiX`Luo^3P9OQukor8T*;JDYsi$pgh=Cs9epKRD@x~V6H-3af
z$@**~<teeZ-^bhj>g^xmufN81mUDgGb5G<pvf1TmJmSFJWwx{!?DE@m-Z6=hRu<H#
zb4X%0b1#yNe&v!fOw3c`P~$O?boV^cP|38=v9D%!>lw>F?Ld{3;mzC*V$Q||FLSg+
zLYhHd`}+7OjoVyc01~m+J@~)Bp}WAf^bWjO`y{)s>QtEGb!0+)<e+EU7Imcm{8cg|
z(Fky^Yi`3e&f%KPd$o@VLb%#|AEK#QvfqL{cPgq>9KvR<yg8;A=N#X~n^79wMSb)(
z6Obq?R%ocQnhd?AQ->;c8_?MstT7j;@8yAc#+k)Q27b6BdEBFzO{3XVI_^Up3(g`R
zyE#mAi@P@}`kZ&+t~EBp+=VSC4i4kfKQ%2&93BK4)bq^7?7De}Z?w)}S`r2_nNOA1
zt?AY9-nN{?(kIR-@4A>(2SEDx$9j5urZ3(&9rZ}9nV%ufAMQS(Pv9+NkhZOtm>oXT
z<VmpfWYhcR{5_BR6LiZ~a`w|+|2(!#`&!O2SCqS3;CSIrGtEqnz=}0!ZSL(P-rP0(
zY|XWOTxF`v=4)ZS@f-EfQ*+9ZaYX2pIv?5!&d#03xvuT5KHFAcSWMT(N%8n<rzAzT
zO!PeKRa#|TMF!kITMgTEKNT-4=CHZM7PPg3%~wc_D!MpN*fjaFAvQeqbhERz`ytFc
zPx*VU_udt}uM;F-*vdBP&C3xj!^<743!om$&X!-1SaH|a|JZq9Z#OTuGh3%}C4aiH
z5aX-HV+wVNpKh)BK3rE2N9P6)CN81yHfz)6t!y^?q9G^yluq);K>qRKF^Oemi|bbV
z$y#E#jP}(zV4E0MX!M9Fx@Z!uXH6F;B5xx%>Y0jwI(aUB7~W>AS!u%?>p7!AbuZ|g
z?DL!J=Q)di=VZ}GQ&NXQbmL{<b_+!v-J*cv6O)feQ?o{en|%%6RnDPfR&pL6$FsZe
zcR8re(v9<}Ci%ncpzwYWxmvqshU+-o#KBfi&-ZJf>EVL9m*cXtiOAg%4&^HU^@;p)
z6>51rVk@)Z?Mj4HCBsRn)>PNC0+@CbLF$!HW0=s-9rmX3J!(X%IbCYOoR4Lp<Bh*;
z@hax}L7WY(R4jvs0IJw+Wd@qrh@>&a(24z&T4l!1wl-tYe%FyHKP!@{cU8t78wOh2
zBY^9IXP@8frgo=}MrR`=TCI^v1VD+0!sjd19Ld?G^(FPG#VNumd6~q)Xp6#)sMJWR
zJ`L1(@|~gMPLC!s3Fq!Q4jckH|GmGyc`rRex4==M4>;}a?3Ame-x;ytmpmbw*IsS4
zEv^J)^}Wt+;T3KrB3sG@j~&jA&-lE745&b7XXh9;grWXeJ{Xm42cOWoNwm?6d4{{j
zwc!hOrM!mQm-(-kV$xE*_AjrX^BMO2Bf|ui`=&&mFSuHzjwYTSX-pg++qoYPirqTs
z)t;^v`knFK6piJ-&p#iF-4M31&5>ZvF|o~YL!ru<A<~|F{^e-voOffvVB<qb7r|_5
zJWAQfLB1{PdDr7=nr4T*cLM);3vxLxtFo7cHQn*dG9Pn+CAwH$_~y>1cyzE<6wMV<
zaPp;q`Q%(hsy&8TBxeDp*Ivj##?-P%r!`<>NRk0+fK9V#KpP;&WHS-HZp_}=D{(?U
z7JPioaD9Ni>QpGCvO8aNJaesL=`zK~k(0lA?EHSUU)G{<G4uHv$lk}nU|9~BW1uD>
zA&C+SOy4_@X-sY>x~T0st`ef)d=hH{ee4!r4yCSKMbW2smwKA$A|1hPWx3!!bpOvY
zh$RUg<Goo)$#C#fijkYtUA*cKA15e|U6RJ3ALlTm=`}gG_1dSrRz;``6YOKK`OATD
zjHOEnro~TPCoI$U590AMKX>=aclg}zCtePozjjIgi82-a9@^1>7gLmS)=!wTnL+b_
zJF^n?Q2-?K229BmXvfoPH)v?q*d2`d(|K5UYz&v1<L;O;^2gQxlq9L55eV0azPq&^
zoxAa`xGwF&Im$%(*OK56B);EUG!R#}j=e}6TzR5-aEfg*QLQt9Ew7Sp(nnxhZgbI9
z96=y?zu~Bl3(&58Ia!MEQ7;dKl;9J#4Ka0Sz~fqVq{MM4ukRGhQ;*KT@07Aqsz_D7
z;gN|Q-OK$^wXeatK|f;`^HEFD0SJ9;#i&~#yDgDylQ19oQ7h)=&!lu`s1XRV58c(w
zm8rR;F*}m`X?@4|$JBwnQ@-S{QWZoCG1PWb-jXO7=5S1S%H-Yl6(=vW<~>o=<TWm1
zf9rIaVFVyVzIox6#xrxQ{o{zx;c<iy2is)`oj1YrhfwCD<Q^vVN;7O$S{0t{r?k{F
zEN$F?5-wL0h!(ty!#tgGdp<A|Jy5kJB2nw&&Cu&RmDz0QUhaIsy(@u~OP%nCgOM!<
zTZYUd*dyr+0yM_KBwEA^t#$Ke3<l~)k6^^nJ>%e3&!a3^wUPJ}bx{rrUpMN#4`Q7^
zBw+RCY<}Da@o~A;qTsZ6ocf?A*P3~b^xFP-g{}Y8ty7?fDwO+LkD2rjqas%XHibZc
z9r{&!<aPUNO{+6RjHH_u@yDZdg%D7$AUIG<P4NOV{yBiT$pvV)+W}cAT-Dc$1}yoM
ztfU|K;Ivz$6rj$xtAINT3dp2b&7R%1L#n<)_IpBI9K@*z_S{r{e8?+`OBd_Ib|e=z
zLwxq^UuTn?j*M;*Q;r=wQf{v>%e`eVYN5onR5o9x6Tw@xbl+U7kz)xu0U*z1hUx-7
z7t9<Slcv>v5UpS%;E^p5+)&th3pX}4@EAXM0hU#zt^T)`tAz+WyVKKaLTX!8>|l4P
z7!%0;bKm=cu-)atQ!dgffb7+)lC1^ap==~(Yj0hBpMxAG+KZ4vT)jba*c2#{DSIt!
z85HK?v0Eh<^%@6)DEJH64af^<6`?w=yl!;bn60fOblolqqT;=2`N(q(71|`cSYubw
zU=@Gb7rI>N7es*aB<$aeMfM8<5}V|ZiKNSBTvqvd2dU=4F?L1V#rBn9o@GHp&0fQm
znZnnEN7b9Td5VB=n)l_jv0OGH9Ks`Hpo*djW@Ux|M>Zx#0;iOkX+L>c`ep&?YmWwj
zGfUZ44wdyYx-By8$Jl?SNXsBrF*P(HW;r%%)5}6I%tvm&oPtl>RLz6lXiuM9^z@r6
zd?k3)+0h{jCc_G3k5WVFONGQoU>k--1tTtu`+Nk536w#(sU=f?SAyMhp`O#J_qzDg
zhIuk)((!0~jzSep^9w9KvER`H_G*dwL27mnF3tRm@Wy5R^7(k4nT_gnl*jdebuS*f
z<l_d750LMqnjK%rCGDCKag6{Gj>$}wb$Yjs8~E!cLvNr^rRgxKe+gzTN7Ka6lFlBd
zFFuvwNo#N5ByGQtc{n5`dnTpj)cEtbs7(`DKq-Uy51;esF)*p*G*UV`DRa(>L1x#)
zlG*$_t(!fG$#1EkA~IQ6VTF4Ppobe^)^!YUF}LurEW-|<z|$&#MPUUO(@#KS*2vvu
zGyBTfbFg%ZEIlUH&y6<e;RK`PP56zZZNs;XBYGC$|DO0B+#Mnk+YMXj6c6AmO<#<7
zGCup5?5@<`C+MrI^q4wB19nB8+jd=0ff{tk^Y(~{EB389h)-TJ@Ua>;!EY>P))l7t
z@mTl9WT<d^K1)!5N3=TY<xUUhdor>qqWz#!+ePS)kMni|Z<c)B>l`p%v7E%_;O+mo
zH{I*9D`ac0xwd7u10A1&J>`#R$Rds*Hv&46KYvx>42vT<i^-@Q#opZ05MzW9!^z-L
zsQZ>EI3#Z)6EOY`|1h7Z2J;C7B+E(oMf!2wc9TzICoRUbxsUx_ls9t#zukZXR3w!+
zvHCf({ZHY0-XD<suHqmdVuxBf3%5U{e<FGzu#<Kv#>09wi(5@YlAUW8@b4+`;`ad7
zfoUiFgosr`Obvg~*)hSeR@IYhMSb*Lj&Z$y>`wVTOUbpj{P(<#o(BDx9_rOZ_MJZ$
z$-3m#;VR_pCLBs{bO5J(y5I@oe}41F7jUp?3o>J?XWZI*sppI8I8oP)YE_F8p=#lG
zoX1n$Mc~E1#kCt%Qpo`-On5vlcIlG84KB^=Vr2wS#KTks{gjM*swhr=T)*4kzVe4)
z<MN~jGUWfzMAqRUefH%4IId)DzP0|f^`5JK#p%b>Qx;>5eOF3bS{hkJYaZscQ`@ow
z0Nn)zwY&Pu%{<=NGPesG6nyr9wbQ?BCmtRUWu^21FmsZCXgGcj7^~cZDJD55ePG3B
zF^kIFH6lrHS1GP}qQ-YXleylvN;MOW&LYPt_@5;t7sLD+CpG8UdcMcgs~qFA%nFEo
z7aEnC)g3(Dl}Fr;NtvVo7zm3&M(;`L?3|lNx&|3d4&XJw<8sK?%;YCPB1T7q2b77!
zfGQJ=a#I$KW@crX0*aI|2Cbf?$O(EPw?G5^v#)9*2G^u(bviKt%C|*xE;lQ02N+-d
z8A$|z)d<rbZHT|&ORIj+`z*c2d<*Oe*ZA&8m^btB)^}}l6-dG(m^eG9-FmW$mUG*d
zl9C_9L5;&ifY{|PZ$7%Xic1f;rR4zW9od^^>H6FJB*+{CYb~QLs}nxEeq!I`Nh(fX
zl4;{qHqyUu<DU034C0xvNdIGfyjh0r!tVKM4W$=~CmGJ~r}5wNBs-I>ZcG<7plnqQ
za=uUEb^q7^RKm8cANfHBYidS5@qa{gLuLadT6enl#r%(PMQ>47dbv(zB`SmEZ+0X7
zZP_kQiAIcfZq%UHu2-X?BL8KUNI!zW3kai4XBf`b%BmrJf8s?wTKG%ysJMcoeEIXM
zvv2vD(~kc3Ge(3xGp}oaE;0|`*tW<LsCwR;C%J<pEZwADbpbRZ@&G}@_t*Loze4Pu
zS4$5wm#-~7mq)qckx?@?9W`s_H&<=^iKC3={l__?1$p|<rCgV93K_Z4EN}GlyHuzw
zYgLJ69TjDg4$4pWW-WmYY777l(lqg}uQrBd_~;a0EoLUDgioOt7xBw2u12e9<-jWM
zl`}S>=C20oru`*0Zo(CFyv<FzXntAc))eBUV9&ej|9|fG3U$<QnQ?!v-NjG?3z{jU
zhb#_n*eGlWEi2G|=KV7>Q1;~9$}c+xM6Y>(U)EWHbSBJyR38<|PrFI8su~Q3Yl0&C
z>;B1YFz|XFO0D}NWOQ?VLR&=~+hjVIKJVKxLGG;_+Rk+StOryM;}3IVBIU1oPWE`C
zn<aN7Kb69fJLiXd@Ly}l52KYbViGXs8gAjV$bS;^^=lg7Z8rtPYRdO?-n8_-SJhng
z=66B_IqoVh1t8(c94pk!1LdoIoaI&{{jYhOKZ3Aw%&>{n0;@X@+;flno^!f=u>AJW
zfc=j!BM}Z>e5a}@d9=h()Ura<=Z}qOS*mfWHH}j@T|FJN0yLP{IdfL6C=$}rV<0h;
zse10F<szIcj8qi>0W3CkL&L)-gJMLJ4!ap$%Ce_C#`08GJT@W};n_2JpX|7Aip_5*
z|8qFN8R7yHKgB*yy9F!^^=^myZ4^JQN>rS_8zl9N%~Rh<QOLwU>Gxvd?gHu!d4OL`
z9&r82M^h`YIBZWmOQcf}0-pLYxV!-BL{-ot7zg!i^lcKKDeY=%)@bK7RH_t3*(($Y
z!^!8lhX#)cW@?!!X9to0*m5K+9O4;T0WlFbw>qtEXDMrIYv6389l}Lpi3;-bX{SeV
zJ|XrdaH*`e5v@LwZs|4B5HJxXwt;^&;|BWp`MA+QQ-#6C|D4@MP@Zaq*GWU-?V)u9
z<D2e2#T-w?;m)2gM$|6ZKTcN^Ei6`)&)MUR4_1v>SHxReSQI9j97I)Qn3d_f558Aa
zQ~M5LI`*dw1!j08;rGPfZ*PKR-bO7)ewDAgA*@bSpol(pBiB#h##qGGclzV~>B0&c
z4&xOAJw4bEOZK_ql`yF)XR#rI*9<>(e#hD-74NEZC*ybFA6siNqrMjS8Fp<czHuZ!
zuSqQbBN{hp!?j3xwxw3pC$vfhwx(bplYJDFe)IdY+_1CXmz9KndUpbKcADm}QCi-?
znW`ltuUmeN_s7<fzXi_oC0)g*q8XNMMsAC$cO9L-W2RRT{FrSzQRPN;Yh+#(#h0jV
zP2>i8ik(01F#GCWR>PL1>$53qNiHUxKI9b%{1FX2$E}ro6BWFV{#t5rl2<)g-O{U<
zRw_O>s4uAh3nD=zV3VJzz036Z%enB2KP|SeGRD!<z;`5%D);?zLHck0?56}aEq~_8
zKjFL?YklNK=F)l6=YzxZkp@oty*wq!1{9N|KLh?fcuypB3mcX{GSh$mA+Z;~B5-4(
zE2VNQe{9DeCIJ5O$^Tz}DdIS&O(%uo1i$8xn{}xF1%9_(^Wl|B_~WX1YQvcvzoAk1
z-9XeocKY8Oi5n!DHg<kWO$ZRaEPVO;@6qshj;)r)m(%tMiUsnMUYAr=Wyo)sJ?=DC
zavhMf=UcgM(*o|}<SDkjf;(yL`{M!seK<eJDfffY3M#f8M2>Jb@|8@<gU*mVyOJf-
zS&C>AqyF#r^Sk^Y55qa4qN6iLGy}15*E|D1Z7L6PXnx=5m5Es|X-q75r0?s9m}Nh@
zTB6z2$(y_E8ryXTPe84m7H9&!fxNjp6J)J+_=?%Bc;@+K`;TbyZ(LbW@}gm@$Mnzi
zULIgs*~Pcz9HFghqo8S+LugZ~=4J5}D^@YAs&-kHp0!tc7)=$uuEI)DX2WtZpJ#u?
z%2RNo6<6`Tf8IL$3+D38X1ju(VU_cKrLoDxU1Nxh#A)9A%(mXtZPL+5>U`yx$BV|z
z92}t`>?GN#A`heg?n?g|$bu#??pnD4_4m!Ir-NEopDY<UR^g=$t1gZ*6Y%)TYrA4j
z8D@I8oh9_<)KV8!l2F-fZER1bj)_<<c6qgU+>JluT4YMA9BnCJYv-0S)UH4~dpT3-
zh*%Z7`8@U9`y*W?UaTD}Z>3CnoCxWGQ%h`uD6yc4j5uyG6gDa`Y0aKYp07~vBdR&e
zl<i2t{&?!Nt-5QXj57JMOK~IlGPY-J*Ut-U^7+5%2=OzJoj1!Kr=e;4N*TtM;8;E2
znqiTqkT%%zW$+lWC3C$h!Q6$wewp^`BY|9(qe{-of)L!e*h63!UI~a2o3M}nRT%u3
zW%H+PROzypjjhd%R_VE)6KkHf)Sg?#J2X^Ig=lJov&}mc%eI^oa=y*=M9USc_`}+U
zsw!cn{2L1MxOweQh3_-c5AAPueF^@sVx$-lx{6=AueX~Qt2P8Kna&qg9oGM1zpb}%
z<fTqHXVtbW!LkY<ond*u(Jo`Odd>QsF+UKEX0ckFvPFtn&EcoTO@o`?_xWO;<jV=z
za~J1%6*bm{X4rnuf-)|y`tzu5#P)J2rIp?>G)#NGR4|8(DnT-#$CqJ5$G^;Zu06se
z<=TUh*|zNPvxKJk6y$9b8qsp{kLMMk%`3TzcbMkir^R|LW(xe|v2S(*|7Y<5VDXGt
z?(3~Pfeo+CqX!O;%bsgi#!GpIOnNaZE@mEZS)ErkXw?WrpmKBvVq4F@1iyT~^J`G?
z`C8jQSOB`Iiz9Z{`d6M#n%laQ7_dhO_9|-5ESq_c#t!1ZZk!Z$EF>fE>dl#J^lklz
zP@83m9NR6Iu?B@(%Sf%7tfKiFr>SN?2y|*LFTcucbdzav&to`dt{{B|LCM@E4Z0U_
zXQ#BKPT+CYiu%WCM-T!Y^jV13<^FLBL&L69n-Y<hk!AZWTU6~<iQs&MKbmjK6E>8I
zUH1*OidD8*PrX>(0yD~1DFxZp6jq7p<L`KYT=M-%$y4AiKd`~=N>J93HlwnYmD(Qn
z8A_fkX|6rczwjlnSWWC2SiQi_8SQQNl_yI0*UKOgFGSp1%;ZyRGg2QJr9Jp`mr?cW
z*1xs)m?0W+sZyCH;@b2)%<3r8^ESDRi^X9}q0xXmgMdBPCOFGZ&hgAVMD1s?A4Fj*
z*ClUy234VOGp>vKIMk*qO5vnWFT`57<S}ezL||oBjW}Rsy_D_DWi0Ny)I2=b$B$3o
zCw&MkzN<+mOcc#G5ar|e4#87>a{uG@`8%4uo_E}LfM{u)=!6tq38$diI`UA1UE)E-
z>V-2*Ud$9wt!9#H%p#!q_4Vu4z@he8worFXt{Sh_jjJEu42uZC>}AR8Gwg=f!;z2z
zGRVBjsOY!^_Exq_Y)JzVkd^~iD6>~hn#hT`FR@_eA?p&*pmCh{bI!(rUrY#?xq|Fi
z$vo73Wqx$Kh7NAD{ZE&DPR3ug5fMXVUXKXrD_nxOo7BJSs8(gbmZ%=udOL_`^?+>V
z*iX-5+I9V8Z?szKCMW=sxM>^DStvy`rU-rIi^Nt>xX1#c3D;vQ6~V#0r@2<cVKrw9
za&*_mp@euN(22me*<cL=!DL&|t8v_sUtObZg%JdQZj%`Bi$rup)0cQ=oVB4e^9t73
zE}hoft{mZa3(J)9EDz%SAbt>Dq6OGxQ~i+>S9|o2TFgiEij=Lr!*FX%1=Ho4tqi6r
z`Fby-7FRdCY<*G9l2Tl7`)HNjxBdQ&2VP!$z?<C~T?~v(2l5it?B|J>BgQAT^p*=f
zm*D!gI6fn_j2GRVD-Asy^GK<)VczNx)hC!+aC8^%>{Y7idOqf%QN6)N#05NCFM=CS
zdvtj%CNP29DiSG$HFHG`4UH5sViI2I*qfY$%zjPHZMN)(covyiZt1i0v!re0Sh)=J
zB;qLj-&050e4Tx3dT(##QUA#m(DPufR%0^Xylc{~Aqqm+qZPVK!>fu+w<ei^7hu_Q
zPxKJWBHY<DCs&1+K>o6ffcr~|SfHJPysq2Z*50THyc|25$CVjUiKmeNr@b!^hq`^=
zmMB6zMN*bLq9Unm*~KGe-^VV5?8{_dCMkL-+K^qcWSdF$J%qxHWh`Orn!#8bgBgSO
z9?z2R@q2&A`_KF5w?8^^XzuxZuKT+0`?}8iy3TWh`$m4dr~A9>IRscwr)-U}Hk_p9
z&FH`=y<=uN^83SwOCUv+N_&!+z5fEqyE=}zDup8rTf5R}KIfg+7A92Acu*OXfSg=E
zrW#5BiA>4+T-^*fm5pAycC{3t-Lj*knDr&~#?si;BrmidEauX`S?p775Qd$DyDo3k
z&fZw}-sPQn#SY2!)w|_=Z{?-Vl1M+qGTxPAVlpT5*>4Lv@=sFY8tb*<MG}azlset<
zo|h59zN8o1@kRyDV!1o}1tMD5Jak-(`hKJU13IWjjwjc*kavp@FBF>X_>e~KIk-Vy
z7Y?292(mIevw!GNSfmc8X_k$}vqgKMUr%*Cxg?wP`gDaC6etfY4B*#Go50Og0Z8JU
z0ZX;8#o&%i@XDv{H*Z6uy~KMO=@#Sub(zUhu)%a2ji1F9x$18fARlW)BNV%~QHo_=
z+}lk%;xfpAlqIR{9@W{DfMe2|ydC}Hs%jGnyQ71m<jJ(5qC1!eoeYxBBbEaqiN;F>
zd52qj#uFOun5j!~(55OvZ;o#oR4(-%eh=>+$~E#4k1xQqk$Ed~)OWYu(*pD=k_Lq6
z&ri*XOUInK`f3UbSTiO47ES9ZKRXLdijzmLg9%l%{C?=ydHok&Y31K-W?1OuImI9?
zDEQzu)3lb#P<)=3_{^6}4yj+S_)NmO-zIDlCJbTd`c0+mPYx%H8?;^#cl07tsxPo!
z!p$~?5FH%Td$#f};IS!ieWHu;`u8o^eTqHIu)M(d=SXWJyy$UXo)XOokI3b!EGK}=
zrBR>N6MqFG(VY-xKPW3G^aY2%Ix}Y*N+H{i)cM^R-*lCB%g3(-Xh<$d^yM2?lU?_u
zT=WXFhy=YSDcIpYIqY#gOBH9=R8@7|`Sfq2zPJI&fpX$}ds~-zfa&Ol<2=036+5u-
zRVKd%x0BIfq=Y8(PUY^kGX?)T6X=9MGX2)3p&mLYndlRDYVMl8cg|UQ2ln>-2m{o+
z=FnD%kxH%TO)i1{G%#fufM1NKyX)tT5Wm4YqNzIxvc%n(4wDZ>^x_kG6P;0ow~%LQ
zR>-Kqs8(Q{M%bWP-gQD$iiN*}Yny+&1i3&%*ihJ74CeQT!bn1IQn3!~s)U8zaDmH>
zyZJ=hmtNxi>YO_Q50x*{0c;s&>_3$&v*$h%Xo);C+c<q~=j+Y-t?xWF%L&2#6*Fdo
zcbTvuSvDqO=wkmkH2iQ<0i?VPzKHH3n|)|T?ufKsavf4JE`p{@qMBN`YJ9txL+fYb
z<W#TB^{RMkSKTre*;`{sun*=Gd8gqzu&CHO66b~9n|Y$}D`KKOc@D$eB{nhcf$+E{
zimB5sGi{N@G+LfJm0lgV(izjAo1Y?Lvv;)Isog|0ee=&F%ypVM8i~D}eDwu`JlzTJ
zEmgHo4_f8CIstYFkD$s&!jh+7cn&KjWfaJz@6KqPCA2h7V60(h`>!CZ$Z#2#uok~o
z!GsH#%Y!$&bpSx;3{KNk7(M1m%Jy-m1!9tGG3R8pM|&La;QA0RIxvydcqW0Tm~Uxx
zr?z2tJ>$&Pt+4njkUOeZJl-FX6fsp|GOkLBZ!nX?vgn1VaJh0re_+Q>!iKDd`VEGp
z^4iC12#?zu>J9Cq1`W|cd81|!k6q^i4G7+CN9liYmEHPc9B9MdTR`efBzV9_+(_E}
zjiL&^{xxBvOC(VOAUjS<4|-svxY9Ttmaz=my167)59wshx!>6<QM|X5nS6ezm&;+n
z*=Pl7B+TE7;E;mA=e}Rz(Mp43hw_9Qj2v9|y6QEH#c+PBtKKZIRn;+RO1Eq+VV;vE
zX+>eR{{ngYX-t3Cw|R?=69s;K$zRM(LM`H!2YZ*G19f&*zE>dnJ1Ab9e`uI?WE+UU
zl-c&Z=?_?X^?Zm(U=!yippZ4j2Gdu9g+$-(4S_g1=2F`Y#vY)x1I4(6tN8wxcYjyU
zRIe}fWy-OvUVjknKA-2~6CWx(wB+)Z)wB{LZ_28;{xoQP(YbuM5!UEY@A`Iw_5O#~
z<(S5jauqx0`VpduFTBsxJDT8}qX5=$2fI4z&pO41J=^^B5OQGX>T(L$rwWLngm){R
zn@UB{AYu>8kj?w@c{yKPa-8oCeAQ@4jA4fE>r5&j#`Xu*Irz|4K=utx!1yh}FE}MW
z9!;epX&XxIU@=9}Gt<v1$oYGHcfN{`!;jh7g%Kw64+bQ3oIIm3^+WZ+Q+lnfiJ#hJ
z-h>(WE0!Div$_;|EV-CYXbz{tuOW*19?QuVnnm2h2ghPA4=fNro#-4W-_7{HFO%-2
zaS|<R%O|=pfJ`zD_lP~2lKmQ1S0Xp^NLw7HJB5uwn>cUo+I#%z=V4Wt106Tq<F_}e
z2oaRwKJG5IlhTk*VvTo&*u?KWAiK||SF9}|dO3(F1IyIShiJnp()MDyY@nCbI2!_`
z=)AM}^$<+n22I&p6dX<_s#d^x2h2SO8^7iWZssXw$Y$?bNQ-JA3p83>ddO3*AeX4K
zr_xo;qu_J<Wcx&pYvePNl;dMXo-3GytV$t;T#FT6#G--mz{jBBRe2~B7ZQ&Mgd4Xs
z32>d+*t(3gsgbm)hmM~vTIM-B8@jU9;Gj`79_!>m4t?|S*LA(}M{wB}A!wGFp#t$b
z5}10QS&Ah*&kG&Gwm4c|ZIJ_OlpZGU4yfL;fO&L}y|28UJHJ|q_nl3#F<#l-)zI>T
z5pzphDp6<P%LC>CR`kGbk(JX%g=2@UH>Fv^zI_{5nqNk!5c|UsM3NEBbFf*3p98_<
zBUt8gGqPV{KKZ(R`7{$HOO&wnTPSIq&bRUY(*;R)PnLVuS(TIM#Qu$<umW^;n#b85
z>*ouJLo4l@_`(bW_CyPlvqQXtuKqTYHnw}N?rG?MG8}I*cd*^c^&ODBv*U2kW}a9}
z$t^-&bm7=gf#-HI?1LTZQvCSO0$ElfCF`>t2MX+5|K{;k0H9}{vi+^#p}2X3w(8O)
z48_?#*}yL-44Vs0(vi_|w%agrkln3P!z2n8r5agJP@JC)IavlBla6ys%RL!<Dws#O
zbE?Nzz4PMO)Q+(J5Gtg&+w~ANh^A9H4<h-7mLudYB%sX$0-^c<N{{a7N91mXZR?2p
z!}Uy-^Xq<}=3cAGx+y)@SB5x~s1!O{g-EIOLJx&9Rfvb@){;-~$eiiPbSha8@ep04
z-uC|W^m^C9)t+kIa?|k}?`6JA^rts#+a%hqHL%p|v{%+i>FT9=xcI=wcb01FDo)C=
z4n8TDW3NVlsm4Ftb7fl~hZINnQMaFqbdN%HL`?0=GG<Z<-kcuEPMR>XmBu?KkL1z5
z3rc|q6NKrTIQ!-|aoJJ>5(>fT+&=8psbUY#WGf9VXKqzdJnc5iUV{ggw~%!o4vmi4
zTv7|k&E@-)UBboKLHx<20K+r2mS|@DvU-UKIMyS}Sq7t;Ot*S)moOorgJL5!gpWf5
zrZ&E5VTEPYU;X~{UJJ_F@hvdU{S<ixW>vkntrrm5k{-1FOeBWGV>wk$nadegx7cKO
zVI^M4P`s0aC-aCw2IL%w8fj?xPcaP2h?+!bi;L-YV<>`>RsfJ%bABR~s?odt+GeYN
zP$H;eM%l`svQ&3z3~Y9Z!AWx1f)FBFY?)9Y+R-r}kks%be|He)?iLpNugxDmECgBp
z+t?^&CFVAjkIo+yl%NDTD@<+t(7+aitX14SGF@V2XZeU%X-0V9l7(7}N!`m8^ThN4
zi-n9aAe+vt3-JJ~U^>3F@-yWP+pK)O)34JruARCcYR!~MEo@^u60Y3sOt1MY9-0cZ
z21~}qkac0H8>X-FXj6GLVA?x$XtEJ&HLHlo4NSl})vp+q9xJa~p1FdNZ`cu8dJ8L_
z-rKBL&ypSHvC;Q8sWqtnsmST1wA+vKrQP?*zoUoGY9QZ#7NzP9UZgKd5iDa^LbeMY
zC14GiDZD=6V$mF1=LZ>7(k$;Z8pK=d7Cx>D(7q2#6Bdf^O;f5joD;A;H-!!7<1=g<
z=c^ms46r;Y3dwmffGeljp8(qv7nfy32f+j=feDaLNLoTK$k#gODvp+S<yF9+UqK9M
z>prML;lt9?tCOI1jYFZ@5f`M81JBY5LtHFU$&}@{2jCSAYW2z6#EA*kh!S?UGYiTY
z)g%h&-52w<9WO`{;m_OTF81sjG~;&~=;Oc~NpXzApV{bnD-IX-X+0c@b^L&5B20C7
zQT_cT?QS|+L*=8HQB}1UQ3s*k{|)1|6S{)$@S^~xD}T8pn>mHCsUXpj%9|N0=FXCr
zI5Ix8;^GXezx1ia&RoLCuj56m@ts}BfgHJt`Rw;|g&K$RyIp_#ALgZvQq}4B(YGdO
ztsYx`SN!x8wmB3p`Ln%}Fr4&|Fk|hH_ZsxZa{+Zyk0j1BmPUDoAobH5!Vxpy?Yn|w
z`1Fy~l7LufUu~@q0nb<II!vxF(9cnMDN?3;l&If)L9OB%uHJhIUcuXBuv#ZwjJsc6
z*#CLOi!hmt^L;>w5`JyDE?{TCeWyk=Pv<tU0e=_O27mjr{uQtc!|A)2q;;{kxnvAl
z|F~4L3N1W=`hH%J;vEB}(_kUL2m}s`$$tr{fFv0-)W;8)-8Mm8vf3sPWWyHzXc&1l
zed5i`S7dOYUQ@Hk`GnqPLc2MnoW1;qRW)f;-NkFovh{-Cw!@3~*YBAi+UOEPQbsLT
z5t$<VSM2kaj>2-o9&BH;z|}d<_DKZm7j(p5BFmRadn0x&0>c{OYd@L<BXupD(q^<i
zlCp^m37=|a@+z5jRJ!FYM&u)NJ|M^9Q|2vlT_&QV;`M6gIC+a>3bT)PK45YVwUu?_
zI`S)@x&_WYfsZfXQ;wL1%lQxLxFs<d6%#D8pv3m&Tq<^(1Qdb#$D-IdaeK6jnj?sn
zf>8WWEW-b6?)X4`<HxUDRQRg@8sQnzj(tm0#aO{;H}yq74w5Hv3vBnz7xiAPXk7fd
zIG>b~UyH7X-|ko&J5x_WhAb)06Q%KMBA)I$x8lm`RR%O5>st&7d-!V_Ji^lJ0C1JN
zw`{dg-oVn%I-kozY8kpagezy*UrB$@*Ch2`F}$S-=Y{S+Wq&A-QF_Qtp@>`_4O1&n
zJzo6H3L&OTI_0H^**G@V^C53~R^g81lw;dUMxkXnyjAhKR;W#yMnCjIC%HdLiAd__
z-#?le7~ag*o&fbqp=Jrs3@;40?%H>tkl$RFLmD2CzVwZxdn;EKZ{>}ue>}gll9ZBb
zrJs`L<S~+?XtR*X^3O>G{7DC31Pt6vVNX(CO`qM<^!~OZpyzx)lHzm6<ui{Q2%x?V
zzsu($ym^^2U!epQArsP$<oiE2Q3N=Z&IW?}>>IL4dPnb8%LU)_Lpz4bF%~wTTYL8x
z0qvoTZue^&nsWYc(&3o(_?<Oh@%3*T6i-d*IBBklU2}y`j>+xnA1%!{wG_tIjv!j-
zPIx4vRIM_G7<+ydB+wk<+<(O5iZB|9CdUYHgW(fO2QUf#QXgICrg59HMdj!Uhs8=b
zvdE?)8C5W-g&T0e5xG*{rRR*{nTV8mK2SFp`%np2VOlHlZc;eKi_ooL;XIa`R$!9<
zY~pAWKTq$`I~k<<iM;w{<IdSEn+<zeFa={eCm(o?HpUy3luQ7Em-Ei|bp#qW3FV57
za*jv;z4!}1AxfR!ADhI(=b9YpPDSzWV`|ZYllW@naA46`{A9FaGg4nV{r!X=ch9A$
z?ZVA^{=E>ph+N(sj74c(hEngYtd+IWUQC$$l3O!!Fp=`X-kIr#*S&4|NY@sGxVR+t
ztA55N5rm&|Is6Ca?iE-RUZ=Onhpxgqe4{<D3es|1KmXV7cNw>WJjCnU$YLu(NYmms
zJW)G`FZYa0eKj`!=~0ZR>~K{Qy1}i7D4Y%rVH~dzLm9WFt66W07K8^*cWnMJ$LADq
zia^%XHhy@99^z;_fK>|Wfb)k|bGiGdGA)YXGMnoDW!{!3cwOqL(KuDN`0>Xa?+(6_
zp6s&elBAw?Lz?h26R;J{CFH^kI-|!u)mZ(kP`iuPHXpFsjlXua4Qk27XLImAJ!WV4
z=mb9AX8x19;Y}t!MBt>toN=74)-%siFXwP;8V31A3JWC|mqwQxDZZPl%;NOSo?dd;
zBu7h&Y#g|VJVJGyqE`q$8f|B9W4LihMB?vyf`2{oxyjmxFq{-`?R4#B(E~WBa^}T-
zhvRDqqdEWm+2`r2`!-cB0a#<Dj2sUB*zQ^>6)gW}H)ddGqdqwQ6#l5P;+EQ7@6#u!
zJ6EPDZA1E~7LM{0Zu;dQ{z)w~q|Th_7U9r~hvKwMUta7F7RChTOyK)^O2UEj6O6;K
z|2VwhaULX`n%J_5)?DTb*WlX!5}HF3)W=%Wl$(%ue)22ap`mR6g^*+{d%p?zT-gy(
zv<V~9QG+r5k@?}ji$mG84#80Fbg4~m^2Gl2X0TE!z=2ISs3h(ClzSdp^m697;~kmf
zGA?hfSTX|tHu=ZD1txW?oXNl%(-%uw|HB&Wz#3n!dE2G=R9Ig5!K<J^UNbZxeWAp&
zx!tmJIDK;8IB#jemXkUYo!{kgz>?>btDF<<Gw*($H|OLdFMiVK-@j3ud{0HS7}O3{
z<*_jo&_Fzn#G|`W82VJYl(66XxTzz5K1GX(zZ>I_`9I2rvmqE_3s|GskchSY`KJAC
z68>0u{X6Hs2MySEqWMAnE^}Gtik%|!a)=S*^NE?_xtr}ds#F_=e>?`@b<=9DgLM?I
zz-esO7e|Br3$RrFNM9ww|2=E{SHurIg%?b@jKtqD+_^3AjBFu>K?f`T!c_qB%*}q#
z8vlCOIktH4OZ{p$_U8xZ_}BjhpFI5Qr-T3c?<fCq&i`8Izn<`4Px$N5`mZPafA@qv
z{1Tal=1j<)KW-ZRyG8%k&i~)-{9oH1JlsKm@c%y7HiUzKAd-1wSUs`ab3$=xyxu}R
zj+eMKQ0@xZ0XmNbrX^YJh#Fsf0U+vh8LKG=n&t0-tm&w0pHT$W-gko!p>!*3em`~~
zTse0aM5PZIHFb^xNzp+5T=6ap&>05G$M*Cuu!TSnHaad&?0Qv^-n&OYA;{z&O>#;~
zA!u3aSods`1vCxgr%@$ZtHVWRrLRh9y4d$4w_+OHh2zWzV^KJWMZZ}EBgDJAy83|v
z*3Sl@#eOlW<)zp?i9`0F7Px+c<9-C_Z|6K_a`ME9b<i7!2OTFJ+t+W3oTd7nvKy0E
zSo9Lnfr^;^<2!#<TbMB3uLYH!byuN4x|Z|^)Q6uP(V5(wfOT_zP7mD}4wUp?=>O(N
zJW`n15W4Ns^oYJ`AvTN}!Ht43Kkb~*Klhh+?~nW&HF;sEtv@nW4b2nMO)ml!xt5?i
z63KKFbctF9b1bMzPK0h+S%0TO6^)c1VxVE542Vk2w2b%mevyYsh>9X>q7ztvC7wC}
zdzaMJbWwl!yFxI05|lh1X}=~MY*u#vC5H>pQt3ZN<5~UV6rlVN6~;}&=RgTA9(15o
zV7~*72-jF3Fdw@>N>V?p_4ew`L@Ph8DMus3`BrcXs!yAmaYON+k@rmx0Trh<Id&h$
zK=HOKeHhmLhtO&*XdAM-@3)-ya|O0Hnhd>lD^d~%ly%j|Qjw)<h-&N^;yhX%2+Dvr
zui?nPOUJe<^qF)?wp(|6Fh1izj})5*@D;s<k)jo<)+Er_dI7KdsUb2M^TWv?D9fhW
zCx^oal`N?Vh{v9JH17DN6u;W`iDc%=0)!=4`d$$DmbkHlR8aAlSJ<m8B4u{w1o~hA
z{sN>rk<SJdc|1qT?f{*qSAmR3s&M=4?7eMv&UYF>GRbaid<WD_<0DuV^#I|SfYG0u
zwtQ55L@aipV$`G4RjX=#?D;9+>o8#ZCqoyLQMwyS%^%qQoq^2rU;^5<gyXoxZ}Gt>
zC5n_)RbTv|Xqyv$Z@r6f%d=))2=rp;*|*0M8zb0OY~j}>JsG6lmEmtyaoGjbsMCbM
z0DdE!{Cydh_k!;n^S|y0iY4N}GFDVkvnXwi;k0-+2Ka86=<R!@621E6fb3QM-tM*u
z0|tl}c`?uXKAT79SwP}-k|px>ESj|uAyoJ>1(@cir|n_@`1?p171R1B)hGi)zau`s
zy#hLEU-_2jGPa$O_TYYbCd<1A(2kf_uB7M%e0loYZ)uML4Oc@q$MW(G^J<DCyu`CQ
zTP7LK>1hFbv__PoN%;ZdcMm3tDi;9mAv^kX-3|UzQ(N0NxZLKCW6{kw)nmDx>+5hR
zxs_+PiJ)!Rq%mwq!gE|cZsw%Nt$WU=!CI$fo20PQjPLn9UngB!<?8u$%SA)m1gg@R
z8=SucQQDPu-vJ66S5O`DTOq&6kp?`x_8#pQ{r9(?_-cUeGQ*{j@^Zl7{Cm4(`S2Ro
zJKI*ft6=ebco=xc3iM=z6oeCA>uM=VM)#Ax<xSr|P=TaOM@_&V@<#K6()GZl;Zk+6
zhAq2`HDWJAV|f)uYKr&LgO?dcDL@qYB0;|9=Z{WK8SE#A&U+2tfmy?EGrqOx;yE5Q
zG$o@HDEPDX=6RHE80WX+2ez2UcK}MF)$@+Ktxn$;2-ni3@GDC}z!i;G<cu}}nIb&|
z_^sc8{r1USp$AlygAVdJvEAM)>=?Y-)pJT->50dw^#j$b%9CIk!_VF-ivp~C_qSH3
z%u5}$|G+=}(bRoohPfUnR`Ijk07Pkm&_Y|F`(>Z>3iOyOGcyJ-Ny{ib2`g#w4m-AU
z`Sh<66`JtRzy^m2F<axH7q=HEqZXsm<kagDOhxa4{jdf|qn3q`e!kFJTPQ?Sq+9r}
zwQ@#f!(`QfYpL*0iehFd?8k_d&`2_coy>KW_P|yc4oaDic$_Zb9S_9ugzoKZnpAx|
zWggD28aYQHbW@v6BV=C$3IqeLp(2ZkVX8&%pSUPY9kC&vd4O~&MEvggfBYAG-QUF$
zS;2{-7A8RR(IDx%!|&$mcTQvKTI+zGlWfrX{hr)yAWQ55Ufnj-R=+1YPXN^ItkJ3g
zj3J}hKj85+7<++>@!w?uULRb-9hQD}n^ov^p>bh?M?G=y=`))XM<vC!Wdc?+d4uNO
zJ<RijyClo`!@FcZ4Xb~qe3~2&UKz+zi;)0A2x)=Xq`+2paO3Yk5n2fZ+A<K6P?Su2
zP!a^RNEEGrBX@M6#SM@%^k(0A-4EIVL$<48XUK<jmjna>1EZ2N4wXjjGwp)e06w56
zmcJXHow;TG*|6#x=@P~DWEa73tI+9>|7i!i;1tdt`8^6@0W`6iy1cz=`-s{z8e$KW
z3iZ)>x)7j2`pBS#+I;0Tsr(#lSB_zRqgs<hK=^Whs`<&G_>CWlHVaQUt$URANZk*~
zwzx^A8;9l5rHt2+r6y@9;uwiWy{onvwa8&Cph&Ew)jsJnSP1Es^{_;I^ovXplK15i
z*b)~Gi)-kr+^R2iy37Ddcv?cke9A%7<@>f+p29?%u;HNDsNpVBr+l*mIORwUPGOEH
zX?TkBCJ;ur50*3;*uY_zm)*_2y_{)~^eq<pUg*Hf)`2}e=;WvQZV{sonPp`X@nSZL
zmpPJIqv(|wl3Am%hvP|X_dRYhKPU~ZN=i?M0~*pf&@kMZzEEIXScG#0JXfXPLqFQj
z(OC!n;J_bKJ9#@<<dhZS>$>0~H1a)tMDHVxU?%A_dn@l&j=_m*gdZa~&;(yp7zS>K
z9HF~i)ftS5TDQ?PzOGASwGhB})XAiu29?-u1f6%+E6b9XV#FH0*7o&VK3S-HG%ySU
z;^_pdYO~b^Lwg4m8z*;1CBjO-g=c-vBS>YW2mQQEDlMpS^vcMv#JQmaux4#SlM;;q
zon2jTNDeI^Sa92UgrbaHov6j72N%I&V#sRAGVN-bRb0;qhBxAP+J2#$%IDsK&7i5D
z*$^-&41#(50Q7>dJ`W&waF$kEgZrdoT!g(LEB`bi|0f_jN`k+-#&_Z<%b9z`si4+8
zf@*GcjtAI5G_<vmwLWM=m{1v)Qdk|wa`I<E)2RZnw^)}t5&>5TI=mVrx`!NrBM)M<
zcic8kda-ab9SO`ehc#=X$1%-TtI^uHqEOH>y=F&#EA5%iaYEM9Tl!FrOnO&0;D=4D
z>*;;`N@(uEvJ?E2Z)B2Ch(rpbD3aqnX#6gxH6UybtmBy_(jdvnxTfTWR7gS1c*1g>
z@Ic^?e0(?R#>}&jo#bm)+a(hnhWg&rQl*zSlsJkeQW0I(T$bss;(jCa)dNNW3mh}_
zxcH$Dq+0vfJ(jalvvL`h!As?25ZOBHN{GD_Pm!5;yVKP;1_Gjr1}78*1&!nCrYK1G
zU#Iq74_3YWPAj9NmSx>`FuXOTn)ns7y;4T#Mw0JnYPG`^%alqHY4PjVe~uY=jHHN6
zbVW4+!2<KC4}=8ep@w4>;(Xjd($>w&8ygf8)Z~XX8NWMzVx{nX^($0e(#FqDu}$B^
zIzKSI@UBv+;l)dOMgdO38|z)jM-b=atG$n(po%9;<&c{S3Q#oHQ`rbLf+j7rsJ0Nv
z9YOCI=g;}MX4$pPPf;4prINfNqiRa1({p<2(y(#~^I)l+E)@=OO<wJ%%SVaWXj?dC
zx(r#YE(QKE(kSdd<p>Ta`W!6=5>k3%mi`sCQQOp61?4@{W`;YDE5>0Pt-3FyduU4Y
z&jX!R35O1LNw@DkH9ygm-#<T2hvV|@Vp{bu@vO5HBh0m7)?b_GAvq8ejo5Nfifn(*
ze)GA(ZL-P+M~;b0TOm*qd<<5Hwfwskpo0r_1E3Xsxzpb@6JPu&w>WRND_#n&#FQA$
zb%8Ayj$y`WkdzYe9I;s8wnuv_o$)CseXESI`Q-#R8wBQo|3Efj0gSZ!0P-Gs`DCQW
zM8nuI4ehP_DyMNw#S|84ZLj$t!F*82z?GcbI0R~o`Qmy%M%8+WzkmruNIDG>;sV#3
z19542AZRwN%u5kTfKk@eT`v-t${yja=uSB{wSTOt5bxHLvdGRrIv?G>Tg<=nD_!`f
zzFo@s?4Kg`mWYZ6kuQYGyvM_ELAB|xzXfhr6NEXT_-d$lCFwc0%=L+ZB>EO@+!Bm_
zdlXQqj2lZ&HE0O+h}Z{UbG3I*a9nIb8z<!^5zJogK2AX`Yb(q8FJn|ZwOG$%E(d5<
z;f>@6?k{}*<PbB^k4blh8$nsl?|_$7f_v&*z?9*<c@_#5gMQ=^WKyKZ1Kum{QJ{EB
zd+RIrQ1(J|5)hwcrL^u`U+Y$9)CF+-q0|d+Sfw>iiXSQ<NNwq*a1OvSae21~QQr?l
zD|FN=%BR+kH=chHM;-&KFoZXkQ5zGg{2=F2Kx+&F;!zVe`CzG=*y2<LxK)afo{c*u
zpfKjj#sZ;Y-46Z4O&uy%QC-tRJmup=Ge6JuW;y!OX~$D_WOTLexvAW07EHMfI+3uk
z2AWc<LmP7N@!2Sunua%DLlBdrW8j`YH>r?OyV^(mUX=S6xeC0vG|MxYZf>P8%rPRe
zcn&q$Cw~?#AB^S-I3=IK&fyUhRQ&=kt|(A_vFV1A+NZF#0}*d#6<E5h@iD7mK*X{i
z$R`(9{uX6V*aQvb5jl((kQq>H*SFxp8p3d@5SwJ>YW0x}?64CkW|$wzs1_YFT;<Y;
zx!dr35PY3wFRo7X#v5O>e=jZS1$fk6q&3_&hXgzMJKUyG(IyI<?%!&!mrh!AS;4S1
zufYv#vXs#M%K`XmJXG8&!+U<-eV*Ra%s<wN?B8%`eAEJIg|mbAElxBxf`;K#P8!Zs
z)ux^|Ug8^j*uWr*psH@&<!tTSB+yY!<%vPowtOb}@EdLdh25etaM^2>QSCh5yi88j
zhFSz=BQVTZ(xr_!OUI}Gq_*eST*2Gx*JKINg#ccS;zFU8l4>St<XI=A`#g||HXOHb
zPV?0C4;82>O=Bc<xrYecde#HdGKYG%uWr~@W>jU)g$oz(pE|FUVt<e;9t`dN?)wAV
z{Di4kc?0BzOvkDjL9K_k<E|USV}s9Q@mb3rnyd~i>pa1KA8(j%vfXmn2{&9|A6mdz
z9#B<Lo}|=P=F}=eM~;IFn{5hvu)2u&uj344yUoapR#qpU4HTJ)uPnU2n0Cu3eg{xB
z-~sDl5D-#|FxgD=A9q$@LeYHzU#s$&w6XC>OzL+G^Ao>s3!sFL8Zousyol1B%Agnc
z)m(T^PaX_CT|I0k2Gy(y^fLuIOz!%+mpQ#>zy2oa(*O0CbVR*XC~*L2@Wfqd*qXlU
zuMGpsLisBlsD^h`M(Og~i}ib7?AD!1p%?f?4RB5`ggWl1T1YpD{f27P$ToXq$QRc?
ziL_nu@mQ%Zk32hB2J4XSul>h-6KnjI&J<mlKMJ-@hJ4T?Ed<iPJ{(@YAD6d^eEjl2
z8h$Yyz#VHCx6(w$mM(%YQuEe#6@ia#!`GklDwt~~USUDf?BUA;3D`mNWRX9pf%BnS
zCa@ZkN2oDAeTy%M@wNUV#-9eE_^Aohso-Q*DRAlz0FcKG7~qucc)-q76knvEvXmzm
zU~w-QQfHyk@;EN-hvT;ysZ5H;qgrNGQ!`W=uT%4pFsWw;GFIg^kUhlU91H8UdL#k8
zoOZhWu!(Q0$~AwCcN7P&|9qd|Wwean;#&}s7Y`IdIAzkS?G`{Z$*QT%Ol=FTIypC5
ziRgmppT*_%@W@Rmf{aJ#KQf-Xz>&jA!;UK;EEATLjDINpRK!m4Muo@NNYE+A8<il5
zvgqDS1#w5aZT;BsGpHagCSc=>8V?DEt8sC+(=r|@ojiEMcFqgT+GiGbbVRjU51l<V
zA9i<%9#o+cgH!vtXTQGuEvXrV_YVM2V+NV683jq=r_0RIG_<YklN2MZ8`8CEAl<1;
z>N$A*+e9ryjD7DOL}gtp_nx^$i=r`^1)xHyhic=_#^~WW!Bwj~(6qq{M8yF|zHmQ4
zVkR5bfi<T%KptFGX@$}a?|#gCz!Mm#p0Ik^9gPMG=J3t&;O=8>U1zI?Lr#7#bAAnC
z-E6=lWoF~|y$fmtDK^hh=L?mvkpavHraUgdD`50Dlt?0eHT68*x~(aU!3SKIjq19S
zDI;0!Ihu(JxhWofpTiGRyBRF{@8Nz2nd<vErQPpAB0-fNV{XO^05ACf7`l=~{8G<O
z<rXJAwF5V-tN;=SyL;yof%L60sprhEcp$t7!~>CS15)*|XQg#k8uuDFMu>C0EmFS2
zIWMTt2LH!EfuN>BfhB|Y`SxF5@Vksw6vKgTb>Zb^ZMov(<zVf3(}5_j_>?FvZ@Nff
z`@ks-?yH-TcU?xx5c{}=1t{Zqsm`lEP+;tC?!46@>oxhXEshUC4aq83qycOa62S@0
zj=55Ed&m;{9FV}PR+(w3`hn)<U`Bw$)baKPgnb&)SCjm85DIEjc}j}6KwhM)u->D(
z0QPA>SyT+DJQ6a8Gtw6T65x<-FXO*#sX*uwuOSXvyzj^ah)*&|!miXVUYFsH{ZNo*
zN4;Iv1t4429_35#fg4-pY%1;`$k*hJ6kQOS)YQ=Uq=Evd#+63{kDcb6(Ya<&scyIg
zv|+97Y>T)T!>xS4_XN0nLAmH%%|uXRXa+3b8yXh9*xNF9;ITmyb!j%dE*oG2rr{HS
zu&L<t3IeuMsO5D^WE7l$L;%K^La8}pv5eo!xPnmb5Rj2}9ot7UOo4B+#}sy?9`wKG
z!2j-BzAu14IWie(oVwGCx3&V3oaB-bfLKec0BakarUYxib|u+|3Z6edCk7+MaJUS9
z&=*+1sx(oz&^w%9#r(Py-#?!o`U8}4<(6PUD?pbC%}t>7=Ldb7(4yN&S^m;x0|SGf
z3zFfvfy1%lsqRDYw55fdbJUD5e4096>1Y4LjqzZ2C~0Uu)Fmb-CuidYcspJ3N%7S4
zc+(hg;?Ue$a~}eLs4HMACN*@4t0Fg3ZF5QD*RJ(e9{;OQf~}l7Lw@rY_sa(ULd?Q5
zsn|uDgrA(2w)Ox(gpWOW21p44ZS$(l`!L6?OYGF}B7ie$2?qGwjj$p>c#w=HHX=8>
zQa%qAnZ1@y*B3oqko>V6fK(++sIGmJhMbtB%$__+E!+BMsXV;{eEF^A;Hpjsv7iGa
zCLMKO^FFNp1R{a`x=K5<*C-O<_W|325kPs8XwZ+7!4}H8l6`s~5I(m6mbco@iR=H2
fMjf~A7)43oRbCwju63FQ{JEp1^9Nkz?xX($SdgJI

literal 0
HcmV?d00001

diff --git a/docs/manual/_static/pictures/rtps_message_structure.png b/docs/manual/_static/pictures/rtps_message_structure.png
new file mode 100644
index 0000000000000000000000000000000000000000..fb402a49d72902cea3a0f094ccf84f184390171e
GIT binary patch
literal 14897
zcmeIZWl&sS+vW>RC%6+_g9nG;je8)$0|W~YEV$FSH|`b)9^7361a|^~;O+!%+-K+i
z%scOMPSu<<Q#Hq`&WEmA)qC~Y(re%Ax_|ez!c^YLVWN?uAs`@ND#%N#As`@P10NX5
zbKskbk(met1Zo5YX$cK?gTo9|ca7<#zLh~)Nzfd>yf%_ilD@dOe@(N7ZpvgyQ?5*1
zlX!JeQ?_x$s$_6UFXmLqi}_p^3Gm$2C=N9awWs7|tZDop-I>S^eCeFw)0bu*HwLGj
zjGZ;E<;63xohRX)$L+69$4VH45xpRy_Rk~J1MGsZ@HFm3t&}xm7u2Ds{K+S+v>{bh
zZ`^H<1a#ej5{1qiuvgnX&gKe<zfT74R1S~Ov!Lu+UnZd&WZEJr&UH!8ALIQiH<;>E
z7WToAa29m?+b*uJBO;OLL_E0oi%81`q9<pl;(mtI_ufcr$1}K(qU#<0C#P^1X1e$9
zKw}IaD=KB`i}7TgUVK(cDyk?Cn$SQ^m<w&W71~VBlvA?j#|Wi}ZlBPie$6>K_crL)
zW}K!YA)`|aHT`kw>ja#xP|UsHfiZ`7%4sj+{U}j34M!vm_Mi%MKB7MIk(A*+)!pB8
z!gvhQhBxeQvFNtQ#Wmjw8cPOodgMBZH}N={P|&S%f!RqTV$~ffp{6^yvpGB!yB_o*
zE@YLKk7<J&(nmDbqNns-AQLWXTh@DT;m>I(fe8qxdM{OMN+caGZ4))NP4@kCe~P&_
zF<6kZ$D9QhR_*nOt?f|w`8$~4Zc^ncbdw~4<+EKtThsLNWAjK(`j`cnZI~im_!QwI
zM(_ca;hw9(th_!w+R@itpgf9smFKjGcq($)O)s$r=R9#%$^7<^%w7u3a@|E@#r4NU
z>I=kq66;Ii<4`QV)em8n0nueM`?u9NZxR$5+s~*H<B9z~YB@;mZ|oP7QZ*F~xw;Ns
ziZVjLqeeVLB^T--QOz*s@?Nz&C>ddgdewP8lSDF!#o?K%kgeiGjrDUv{W>Td5TSXK
z%6o}A{h~BpE~yw)>g$0;>!Gy9EyL?UNQXFshcld-XQ_Movu7tC#$)3>#~O1VF?Vf$
zRhr7Z>$<0)(k|}@UQF?u(C{Da7wh%jcnTVLSItLnoB(kg;yzi)68q8A&Ofh#s?30h
zXR!iy&3MGNZ89b_4%{fWEt-boC?+*FKmy4^L_WIMXUc=<Rz<<>Libpd8F2Gbs@=K|
zl*9a^{hNq9%^D6_)t$-les94gN?Wr&pG7iLZ%Z_{%HsQBttok)J>s^}AA%DZ<NWUM
z23X!oxjKYvx*5$U_BSd#`4zWgc^iia1`o{q>F7(qe%h;P`E8>IThqeoUNP__vt#r8
zQ?nA2{u*oe{ll}T>yz4HAC4z>x`W9)_}f3%!zE%HA-c9rtlMi3a-4tqblg9!(Yo)3
z31W6|u(9`c!Lkw`4X2p<UC^lCOM*!81v1=-AD4Ynxh%{|dFx-rbdw0jeRV>i^>{bY
z)cl0b!G0ihhqW<CMA#*^I+>CY8gYF%vtsL<GemUqwSPxmEzVGqeLcTzR%T@6oOLht
z8oH5U$lDXYvFQGXg9ATQ<Jihq%3hu`)8N)QknV%f(QEm#Q1EL8`;$cmJzRcLsg26d
z)dhrGaazg2Y=w_eIU)>}iz9t&=?So=PD7u4(-D16A`yI#H_xo&U`?|fw{R8(d8+%v
zZnLdP4egpb>E`Tgaiuh_W(hS(72LSB*$yk;K#fhEaHgyDR-a$g9cRTmTu)c%vGHF6
zdi=w*PsbdYVad^2WTmGmJIQMi^@j3?8hvWNY0RW<pf{Kobs8P&!ZAsE;hk}HY^n24
zX3{Q4^VSAzLneorGdNVsD|>h3A4VXFwYWDg)eREaE}B>~5CiY>s<P$Nno%sj-|Qq^
zZ<TlSh%G;9#LFo-pc+88U$A;u;u^R1y&>||P$D?;-lg0#cc@6E2y?%4J+eA&3azv*
zRg3+O=kZ37p6eIhA+AHOA_^D3aO2!<QZ0vm)Mthb0+8_&ZQ&-y5&2o_1ssQ}bj8aN
zsqf<ZAaj()`^m*j7@R^^w6Xq++%J*1f?SKkCH*-<9ZH_#Tg+w8KOzbQJ8I*Kpj3wq
z=Q4x#4?+!2f5v1L*_s#gBDU8?wb;XCo9p8L*m<-uTW>+v-QWibtUHOd#iJ|Mwhca8
zljD07gJ>=iALWKRI89dVeu}gmo8G(@K67`wQzXW5OHvelzv8?-u}B$GKAha(QJpVD
zN_SESjfdE_KbUzno_hAU#dLSlAdwB`?J-ogDX{Dl@`UK?x=A!Uunbr3Iczz~+BVLz
zjt!33s^UmevQ3YVE;e{%b=XCTtIDveIbNDv1{KaH!>-lVy>}W{hn8nrf<CK5>*{hW
zhcjVcL){q-FZN$4fZ)qv*BNkqz2$E<9(sD&GQqt9K6DE6p12%aBT~z;HkcoDF9vv$
zaPwe_>5UB|kh0<xdWxYpOPQVRQ+5uT$ISB9aKzbRGfEa;FEkUp3b#3aKg;T!31^*e
zi{wchD%Elm&N1T9>MVI7=B0+D6mjD$iDa1LxRkuY$fq8&?PDrW9G2uVi`m_zD~ONV
zxE+}d0{;?v+!oF8c<2{cy(i_+ZL_t*-Jb@1Iu%>iK7Xf`jkrM$-p|Uk&`=H*(JyWU
z-5yG=I(g{{a!y1|X<uMpHGX*~6^uI!>@aW9%u^>*!P)ey+hVt9lAjN?QVeZ{iS)~~
z_9(I@^e9P3(_i`p`33#_BvGdkGb|MU;!n8WH5Se(z2uN?W7H<iQ58mb*2jz5!<O6)
zv%$JL<qb2-s%BeB@q5fKn`QbyTs;jT<R6f_*H5bSc?8d#xAwlBJS{WhTavHeeqU>j
zYuxYw|9Wpz?6frJDqB$=ySU^z)LOKfa;pH1t}lA31v63^h=?KJciZIRMZTO2S5Gb`
z(6ad!Vjz}mQGIgkerKAX&`AOwDnWCg^G4r(=e6bw$MF?*J<Qxn<-2A#uk&|_ML=z0
z_CNM{M7fIc#G|3;=3vvk%zQw!>@|0gX+*V6!%Ke)oCE{ZKiQb$_DM`{&IwKr^{TQW
z@sPn>qsnl7?)_T=WUI6)sq>s0O?maGbh}$c->R<dv75?a<K)TPFqmwouK-voEtFPQ
zVDC3#ei_2ntbJ-s`}gcPU;W^X$+P;(*bN*PNc}r2IGImVILU_>Z3L6+SBed<H&*qC
zqrvi>VPLGxl^~;2tshlqBaO)ilNcD`R69NUIxm2=sufRuXfez-N5trwZ;y)blp-H>
z;yxknX#R^eKdL}N=NELj)#EMnZX)FOx&cTgxJ1AEzg*O^11ljveXOPzDN!kV=gD%k
z7AtCXH!kkf{S`rrrH?fqFtRKdZMfEf?-&IGn4&}6Emtn=caK<6a1(9d$5AL68Y#vr
zb9NuKZ&&14XRuqTL=D<WHG8Y*#6cb}0Zr5E8`Fl|9bZXVx5)iDGt<$89XLXYukHJh
zek+H|B!m%BA1@o?JXfw14z6PqhgyuM^2YkHqpDE09K2_c0nOuQL+Z>&Nae*-z)aZs
zt}F>JfyG;ea-PQwlP+5kln7&QO;U*Sy9Cc?K}M#<b<n&bp;a2DNcAs@D$Bw9R`rEH
zNaeG?<DbBTQ|xds+Wk4555njDw5h*wtR5bpCpS_-6Eg#pCupX$KIN!ugM{SH0~_s-
zudknX^>g4DEc?8Jb)zX{f5$DV<oRJ;lK43NC8|j~H2}U|d$Lb}?KF!*O*dir*7ZAN
z=+|mSEeRq82p89lUdVNu(KF-sU70*TxP;v-kJ^c<<gI4WAMR(n&U+j!mN$;YkT#wt
z^o}%8&w1N(#0=y5k%Vf6PFfUVj%{jw8?uqd3C@1~Ld!As1lZLcHV)-9Hm-h%Wg2y0
zf*&Iu(}-wLZkNW?MYC@0x&BM+m0wiZisKF_7)J#<#u!SV%y-$juaN}zJU{-Hr+$|L
zn+en0&2*<oVa^n-`O=||68b%MgeP5P=7|P2v!elZ&$t6sPlTaFJ1<99b%$|Lqc)NF
zPu?dqsn`>`h}gMU3}-N4OFbF{-K64D@K5HTauTD)iZ6iKKT(Q1=p$?AR#@MCVi~uO
zhOoMDl6yaU=x3{{(Sbw(({=*<?nv+Xa8<A0kJZ?p@8V!uzpp}fXK`^I^2jGGp3@-W
zRb}|OV|}Zd2P@7LHxStt1YN?5%7c9SI(}MJnat>74Q5KncXp$EeS6FJxn%|I8a$iP
zd<ka~@Qa<-b5=+-(=t&X`)0H)qP(U(X~{fxeB4S>*#QTGKp%Vyo_agVBq}NO9r{Op
zKZQ059M7e!^o_l>;<O!kdURZ__%6rgGjGib^}r$&6I`eu*G>iNy`{c8cVjw>L4GMa
zyF@U$wU%+q)zXJ8r((e|9hKBu{kgX*1YK9}V6OSb2Cat>N|z-B^MCN*jSpg4S#+2l
ztOA~1tT@!+m1B*stp4%Bp>1#j9EU8w|1scEOT<V^s<-tiVtBcm(aJ#DT|1OO5yf=5
zYfHP?8WAnxP4!W&9jP>YaA##*??VF}qQfcjvuCS!R9EYFqn;nWN(}7ee^uxo9v@5E
zXMV-r`%CdXZMCwSh6XX&x0mB;(!!#TcM+Jiq|oG-(aKre4LRT0D2PsvQ@?9}PH|^8
z=YI(krqYh23A{6&-{jgQn5rJVJq#G>qLf<Q9Mdu)xr|&QE1Vz7<3^{b>5w|kahsp!
zg3Bbk<)CEwHW7q*lltz;>3uC9G<oP_Q)>=A!Pzs`Z##LERm7hVpb6S7;v^S!MXUAk
z%sBVNbsKI7oUD;cj%zA%I}m&s_KKE8`NNwq64j1&k&}S{Q+J<<K()Ib=sK^-{;XNd
ziq{4mq<xoHiC9=EK1MAh_baPx^XP^wcHHKK+QU$OvVN70_7zwyrYxBG=s9&&gnsj9
zmY7L(6jqUdBP1UiE!wRvcx&~w?`bq^#5Xo*=-Ji-+E$tL91|2u8_jIamQYC&R(Gzq
zHyZ$T<7-(p-9u@9ofJf_8>-Bllq}9PF6@5&Ns6rJ#xY&Dw4+>v0_KbmxEmn;0q&s@
z9Nls*LhagCmn8Q?A}F<HB7fXjIBnKTbxUn~YOn6SIpq-MuZB%7M|a=0MpxSH(Jx_Q
z>^|yg3Ijy7UZ?G6k0G*A@hN0OZ}qoAY!&;HhDq{qI%cbM!dEohZKjXy2QZ2hL38Hq
zayl@9R{pp3N&Ug!Loaz~+e*EalZF%#wpvT!87+I6uvD1=qAa*Mv>>~Ub8CWT9Ma>s
z-kg8@GDqucT@dbY0w!4_UmA2^IPJIWd&T(pm~rpb-?EBKx@MHWrz(e4$G?$FW;5MU
zvrpY3sG1yv7ZyV>nip`^tYkkmI=J$xHB(U^yM;#BFYT<zr^g#_pPt;CMqTo5ihyW>
z_3xq;cEYr*JSpKAGRrtg{8C9TRgMHTNJ{hFYt0OhxlEvsNp7dV;lYz;rL1kq(GjN6
zHEiqmT3QtejyN1vmypB@r#a&poU@{?V3O8Yj!j(8D1B&aFhn}!ZPuB}@@T9%!MY%(
zgV!xb-|IyROOHkwsGGFHJE)=-E8{1U!SpP+XlM=lsgskNe2>FcjZCxFugO!lWv`M6
zvvR!xOVRRayBYb9Mlm$24)BxIOq=+k32pB=hVsIikIT_C;!uGQlh(*dXWAs?#)e^A
z#|2qcO4|h&YXQ`zWQ47?507OT;KjeK2L1k!1V1Zak*U}kpI7L#0b2hr=;$XmWTIPx
zN)k-?iBRX~k8xy6sO-!o$chmW6ZJe4RXl1i^4cD$MFwF8<6t#*9`c4#Vb82=&bp_n
zhbbr|h?@H~PF#)z7UCc^-Oo%^f<%q%>?Tk?(Xc%oJymTX_@fFxRcqP-7hJnzCa7!@
zE0yaJ%^gZ|5YX2}w>k#i-`_u78q1oXT?{hR-zyY)5fj_L<H^eT+pVj~2(?6_ni_RC
zs&lN{9A{JAf1$6)lV|!nq({wkSiw-w?E>ffg~%BVVk@fG!!K1OGV8uh_k|SBmX!Xy
z<0O-#kyE{rS&<Q9@fh%k%Z2;Z@RIw3!NS#}Gh2*Jzm<Ij9e6{IZhq-_M@{`?_Smk!
zc+(`xn9Z=Bkbl{+wdA_gz!UX!$+MWfvaD|2qGxhv+hlY16f3Oo6%C=IB1jl3KU>+I
zgaM<<=1FP>uH9JvJfpkSM7)x?RakRiBj22|n}_4OzX58>Ck-{dAbRD|ZYn~^g8fKx
zI1{$6#i?F73SHKyjEutbqqg}5-KLi0{z*((C32Bjnnn{KXS}!d{Z;Pvu_tMx%Hg3<
z`{YDljp~X_0BqNGR(yVDn8NX+R#EHaYgRqHu|K{Bk^N8SFGU|t>@az-1%I1ctt1WI
zn{4ng7r65hX%VL4{7fIt?7!$pW6lt^+`sq=wQxz=du{9E@T}ojxhppv$$CfyxQEkv
z68?9TmiV#B?`+>u4w=yR25Udu4r{l6&Y(keP>q;*z#dIW#;^H^b+{7zUAS?5jWIKB
zEG~s@eFq&X=)NEPLjIjlBoX0g!sahEJyiqwEipqM)@kN3{Na*0ryX@ltUZTuv>JzD
ziII*U4R6);hc~dThPaL|QL#v#u^mF0%u$BIdxA5*_`Hh`y4GpySq_cuNj**YrW4E>
zV>$EC68G`LLWfG9P0NA9Ciei%PvRaMl(Ktg<VT^_gtv$Jkg}fX#Stl;y1g2y`=g2A
zaYZ<eX~+FJ(jxC2Zkdlsaowjlb4KHBE~80jR(E&8ZP7>PZngYk?ai%7a;?k>CVqKl
zY!=~!LVa03xJ5wE1W!x>S;1R#Qsk?{#AJ#`M8rvJsZ1zJb(z=2Gw0(uvfyV#bUC3Z
zygb+r28s@XXW7rlWq@BY!Z}GxzkTUBQPtuNm0Uj8V0S8;I}`9ZPzi*j^}V=bgo~nI
zLC9T5pl0Ml-NA4iH`O3cSL>x9)P#aHH@ER0muxG%Bho#SGSC?r!806B8nz`HOO^_+
zMwux=pY_*4a?%dnQ#_Tvtu+OZ*NHHFk+Y{p-7V9|@73CwVDh)XB^1JOY6H8GUHKRL
zT%7xPC{bq>|M|A6(L^T`T*n{|RiXS4!__y#j5rhs|GD?m?865@6Ek6#_Y-gYNkrI^
zfbKe5@UWEwQ7RGk+a&VT<&7U4kkmqTUy^?Vnt4d-4_Du{5dGhQgec~f6s<ss$XhuV
z#3o)Dfb?d<&cL!M$mjiMbdN}`_ILjb^bW@NYclQc=oTV<#D<0c3{)tUZfOZzG$6?-
zO(HAR{~734&S>5LCoeNkp}*pKK9Y<vX3ElyhYio3+&@Ye%lHvfl<yhq$ZYWa2P*1I
z()1x-5$J<|5-01;zQizF-uB#!qUNrUMVrtQUfP-kfplYzrH?&56M?uSq@UCUGXd=_
zP2JH1TDW2~nixgo%P+TrmMy#w95Y(t%65x<tK!a$>W=5XSqm*<Qs~dna;svt(I5UB
z*>~P_ar(Fi{6~*N*jTomI~M~+HiY!z&g3}7WXxt`_3&^@VZ*;U-cJ+!dDKO_)(6|5
zb>=evdxbe=!1AdxkB|IiFD5=r`&j}&`WSJqKmSo3Y3hnZJZ-Q^Mw4wxfyu)S?>?)3
zARF3>VAOvxQvVhRkQow9zRb3yTMOIGqZzBXaGWr^S#wE`I4U!xCXlFJR}m>I>o;tW
zaWQ-;n(jQBd#ym#rz8PR3`LO~{PNElvl=8H6dWYqXrI?*ZTP3SU^IYk^(AQC)mlQ~
z*_$`Rv56o2kPB|}e7_zlzA!x#c|+;AzK~!Qs{{T-@L_dlC$J8Z7txY99S`Jj9(~WV
z3;H5$ai90d5!+uNT-0L5q`)qhdVw793A|{$?SKD0^t4n)J4N;O7}rc5WGk61a7PXA
z+1LX#4M6r{3iDQR0^aKE&YQRBM}0B^^3;CZ0nsy&A)y{bT-pP)l5)r!bsTL+lqKY4
zYb{!xR3J@p08hrx<h^nxz?qz>$o>xrEOVSwd+?bK{cmy}ExsRD&)K_#0CufrDQbXM
zO?BIEnx0cV$+eOWb^%#!G_Aek4!3rQn3bEj%@$&(@CCke6j?}im4PdNG9rM14`@{k
z62rfKrJK5V%<%R{uwcg~AeRnhCev@S{Oo4Vg#f(!|H?g%pG#vj@+abNs_LRXMPlyq
zUh}n*4I=<2xx^JnKYs?~LC>#eFP}+{PM184Ao*!sGDw53X<r__x#Kps1a5d5jK+PH
zTQnbeTcNJeuR`b?4(W_ihdC1l#`=kX$?H{LHU1EUBYYfKi9tF3EZygHX*7=TQ3p>&
zDx2C#4DHW@QJC}M#m;MJXpr~hW7uve7%X?8l^`|@(2^o*l{8<_P4JG<kwZlIBpZ=K
z2}GKwO}RqWD{F6ewz*Ua--r{B+J6{TBiZcbpM#j9KVtoB?qAul<NWRR<#s1+FhEi*
z!VsG0bclFO(%HFmn9VxKDhs;ljBP+FYx&%9n>I*}jykv0n`&%L9LNxxzKToyMkF9A
z%wd-xa|k8XXTVl%*81&s!n;k~u*0j@cY;QZh>TP8YFP5<#-`|y7<MaQBQ|=Z2GvW`
z&F>cW<hg%f7eU4&CO<|9!jJ%E%4C<Y;y?Rxr((mGQ!z|HU6j6!pvQqN*gN^_gjqD`
zHo_7GO;LPjz~|)j6c%Gh?R6ipx^<XZ`SI6RCKhTya81p8`N*f)X<Z_%Z^Ju;rks;2
z@M1Z`GndZ`jI$`$Jx>O+6@$kvXqtnD)K*PKo|V)XacO3^H-L&NT}TPuOM?!R{ZcsE
zyaGR-pa;-oqkk55eHL&BVt044@r7G7e(wv3LqKH$A~88O@TZrcs8E(vRpX$>B5eKO
z5(mm0;RstfXk_R>C!h<`|4ElRJE(@)4;5F^Wlh1VsrQ{~x~N&vxJBPn$1-UVV;EK!
znuSODB#C=|6}0;oVebaqu1Zt?gsvp~dfZgiLOQ+|sUjc`%JStD3civMS9$H_)oZTD
z{;&}NmPf$Ma^RYIpWCty8VXla)zyD4wJAR(qo036`{(ctrGcOr=mr@lf%BOJjR-TE
z0S(<pTEtWT=J0r@0pV7XP|CpDSp`1Xs>gFz8f+;SQ7`Te33&@QX;(5U?>|rm05L=W
z^Vl`7j1IqksREWS71XWJtVbCVzi~3S5G_i3<mB#%A^#V4w6{~5V|QRX9nfh@A`20~
z6t~v&zl34kEKHbWn{-Ui<pdE&f}O=z?@u{Y@kMYi{2j1{`%K|DJkfsfCc9jr>-O4q
z+&HLplGKOSDV!l#FnVV{DS>8L%092_0`I~6aH*D9fI@hH3b8Bvn`i70eebTs^<H9U
z@lfR)$A0;3KEk8m2PT&kKk)y?@PNN9>b5{Jz6a<0^b~r6We~cq|Dshm22oxd(;t1W
zRYmX5Gex31+YKQtN*CUfHy#uZ6&^}&$5^ER&PWYnbo>5%I93c~&|X3-q)BPetcycI
z5c$)>r7=?N-$2LO%8DD0f$tV77<}D`w)&r-!)gKYZ<ym}h?Co)Ncib5Gn2tzPF2@~
zb0tQ#)TnhtpkAl~Q&E|;{(<!LTgM8Bk3n?M+Es~%qXuDr$qRHcc59m8gT;HkXT}kb
zc;$@lPM`0j3X+L-M@^siS>-|O3@W<n{<U&5xjrZOCA#YnV2<TTT{iBDXe?!Q;2%G7
zuzO->l|gaWjA+!lB$>_#+53k~(N(lH!d<ewe^JLPi#`$VOxDn&hDL}nF(IrxH4&}Y
zE&p1_kQC+EQW7%oajno$R&`*`G^imB^KQw@?V6>20n{+^LudMZeXEV$(~hh4obIXj
z@zpivZ@he@s3lT7#N*gHklnQ3L5kq|WN)aH4tbstAk?7Ku^-nNKq*IkF(Aj;`-HbU
zE2DYzE&)d4iT?8bI}VAMtftgf1naRRuIQ6JGv3{~1;Kv@bKokW&<MT4fW>5Vm8}>s
zJ{a^Y)f{Hm9mJW^vF}rOM$6|84GbkDs~O8qRoY=gYCe)=8lGoQi8^GukERMW%x&<m
z2%yGrcwpl9VI^$lCFU?OMyT4JHBCs-L4i7uV{twjH#(HS|NeZ5sf4#^S->R?(xxsZ
zJ9CYTf_7-Bg*<rN_cGL7E?H(W8PanD_X&1<pKBf2)`r`kSeraJ6Dj?{qr%zxN1HI2
z{z;8<kY3sw$!NBo!o)X<2#Grs5U-jX%yqBk(emk)-<i?+t2)|l;Gu}|myCDB`yMM5
zulRQcH#QgkqQd*YTn*m3X33%ak>X#L<ztXUvI3hylg*Pyce_K`k#rt>U%mT+*9oy4
zW;Z~M<N-4(jgEsqF}-C7b16BRC57h=jZd{vEkQ@|$$ZI*kv)n06*%$*bU@%cs>=hV
zMpEgo%{9}0v*P<Pmd8>rH_di+{-raVT9o>GWNHKil7qiqfSYyoN7iwIM4|$vcbU-8
ztsW=E6&cA&0ZUZcWJWSRTbtKsu_?Ues&)!$@Y81O#d!-<)8Ucsv|G(66hb&LsJ;O0
zs|Xx-A9-9WsTMe2$}J6E#dUd!Y`Emm0|K-|N-yY-=#%VxA^}efY=^_Du9D^$7lrv?
z-c3nJ8Bc}fe~5Lo?MzHMRF9}O$b5a;A97K{S~nfdgw^=4>uO+g#IU8_p6zhb7kSQ4
zS;9HV4FVoFh~}pi{*!oMg$js15Sfr3MZf;OklQAlYaI(uuF!rrz#Y#ow&jgus=vOo
zeH0tIF=QIySXq$2aol#JkvICGS?QP8htd`HPSyj5e<9WrbIq;8_i&Y@94s`FsOc1&
z$$e_Jf}dEx;&GUbPrejXKvwM4GCdJQqKuOb5x@czi3V;qM8n9022cz`fhK-ndGQyB
zLsBpJ2wx%sse!=r|A)H7B=k3Y!skX~8(^);4$Q)ygh!G;qs!I>i5P=aOt@)97yWE;
zJ9&|W1z5FW;^fp?NUZqCxLCQ+a%gBmF)*b+S;TgW{|)C_pl9?in3yWW_j<X>6$bkc
zm=TGmM*EMpJ%S*=k9lcI>yXSMJ3s~o&s%c<`PIbY-_qjY)p%xpj>5mDrFA=(6mqn6
zdP9jGd6B_ss~w=94FKYE>5n^WJSgzuP8*Y{jxYNkD2<D2w!U#xw0eYQ-exq%`bnYu
zC+BccBnGnQiK`(lw{3TJO>*ujVrjd7;~XxYzAZ`p4I8`yT6h7cw0N3VH_cN7kjuLT
zhgUb+dBnq7<-JjjixsbqN@ffsy{-&OhFMt3`ADnJn{S8(J=&z!i{FF>FQ#=yOEK@_
z8-$=DS+6|(EQkEIDV5kcIU@eaBI~k)25mbZF>&9{=l{vF79aE`Jfdo|7<%0uU``f2
zr-ry?gwB>($_peV%|%Ruof%pSKImGFaP5{Kp<#K*3ogP9g3y8EOa3JfWLZ5yEV3Ej
z@MqX7^cM~t{!%A>!dY*`o?LG5Ag#{ylHFbOYi*A^z3%tQ9P7WZpMG<m#hQ3GT<RB(
zi1FDb7>8>)IhgvRB7Sc^fa*P!ewl1eC@>iR0{gA?<=w^(k=Dn%M>^IP!Om?A7nYb8
zhUpF)n{j+ds)QE*mtYRpi#l_n<)$s_?Uj#r1;w^or!d~FRJS{DtE`M7P&*|Fr~x?`
znHOXw(9!r1a#Zubq~kKXr?Y%dGi);N(qT)N`umb2(IK7Ple`(D2AvSSmCZjX>!{Pv
z+^wehAyJNHAT1rrq-@u6fYagWyml53k)Goadq8j-^#PZzXuo39*_;bYg({`Kra-66
z3~r7QTdLBqd_@Qqr0q{Ke?5e$Hq^b%H4b_Uyu)w(1U_$1ICt0WDQ&E_XH3>~i&2ZG
z*$nVt(<CQVw)-84c;;2D2G9|l)|hS6j9D?Wn^U%3QUK|?eKjPq@0BG3m)DdgW^OFM
zNYXGlz+<DSgr}%u3LJVL!`jBXM6l%yWiv@);P(EI9(@9uND5tkqpok3*Go%IRo=sH
zm^`@E&Z^5Us$-BI19?R^-T82q6&qZa=qv%uHC)w2&Wn*h%QQObl%xaQ%bBX|CI?Zy
zaJp<Dp5$c=N{wJ)QOz#dlWCPko9p3Kr66ogjBOg(!D=9=0ug^HgMd|8HDv}6jsPBk
zX<4wr`j;)Nl~wn7I0J|Wz!`kszC_mok0B9O+ei9mg5)1wF&AqlH1_f@*%%|WDw8w+
zhf<hJrS1LygZ}$7O>^E2uN-Z1fXipN@cg1d?8l$|XU?yhIISiKr~Kf)*GV4^1O34+
z3o;ti!v0`O!mF%_V1-VC#Ub%@ie4_FFJ!m(oR%S)GIHQ2b^6fhC%h9n&`s})*>*A1
z2wSWwL7Sx^lcfeyXRJTbh~G`DL%IMZ%M6Ym-_FUUqi{1=`mvn|yw5g+3}0DLyRX+!
z`J{{x@lFUp3)mSFD<{TE#NyD``)B>j9Q|Jx`hF}d46FBn&gc+JQK!=WRGB?cwz*ce
z<bSsXAjj&zK@QAB#(2L%oPUEHc7Gv9GEDyDzd?>dJ=~FBul@~kSWVxIW_<I6hJNEe
z;Gy|GfX&08he*Y4q=8LH=<NHyg&eN*n*a?7isu>CuAK}0ff|Q`jv8mXCL3I=`)5w(
zYp_D+Ah_pnHXt4?F)^8jxgG&q=|b*Fzy*LDzeHpy9Vh?ykRzcremc(Y4COo$Q~Yfd
z$<j-V&=}6ueZ<RAKF9~ku|Isjr9rn0tAsq*9aAx}_Pt8pSKwM&M1I=X+cR@c`o+AG
z>35!xB^JwPcp*!eRANV}Mf=RaYK@Fv#H+b_5Er8&=H6a10BGB*LAReG4$lD@r^%Zb
z3@qg2ik;eVu*hFP)%RFJ(?0{iUNIBAJ^}%fp2eS;{-%-w$>Pvcoy|{FQb5&G^O<WJ
z1Vd04XU$yvQ)6`r>5$}K#zC(V+m0Swzg*?~rRY`FuTB3UYv+N-=igytYSSuzWrIDd
z{}e6N4+3A>pIq-XKkf`7`OS>8#B$zKUSB^e`ONyyi9*C}-U^OU>ceh-C>LSv0tM(D
zYZ>RlcPL?$-&%eE*#+H4G5`3sEQg$-(A!ii4P>Vhh>CeYlj*{7Nxvq4>N6nOI$*SS
zoI%qLfuOn<`}Qm~!x8K)HwZ!xT$3Ka#Qp%%F$3M~39DLPN_dyGM5#4P77j~kux9cd
z^6v7vLr>9ttdF3C)QG|;Q#0ufN7o*yct;JiL;1Pvaj={gg!Ua#xvqgZSH{l2)a5t6
zfYXV7s^=17gm2SD@CSik^l%)T(^m>1zJs{u#LlHl3Y-Z4RK&-qo<O`tc`8(s9ft|!
z0^O$YSg=|W>Qh_RPm`ZE?_Vbs{v{~%vB~GpN=$tHZ=?06Lz>FIDsItyFkuoz%vxmI
z6}cBZ@)s!6B?$$y<KlRd7sHn2^k<5z1T6Y!YF(Nk-$FEqx){&Mz%XYS=PQQ;H$c51
z<21##<D2FSa`vwvT*CyZjW=)(r6`|P7^IHgQ`=!1dn(I(v{1fwUG2Z3Sl+-WvI4CS
zPK3vw4G7;M;qYJ)3fuKJJTKKB+?a%v5-#7g`Ugl&njB<w-^o*L5Q#+`gHE@u{C7Q0
zcm)5Th8}NlDn7kZ)sKTk$P`bGhZ6g@>^iuLAeg;n0bCe~<rPEzT631}np*&Bpm{h$
zMUgw~b+&Tc5d5p*e10sc>S}@m?PAX>+f9h3kQqxJW7A1h4s|I%a~qQYH&Y16)2{(v
zl4AWHfq;MeN8L;s^zLr~?->sZ4dMf^NSx0Uj)a20N&;&eni=3JyrmU~?p7*)!9^7a
z1}b<2BV|G0b2&fwPs1#3T0DC+|4Z7KNrG%{bb~%fXDYIyO};up6&~JCGQ>bTY8;%v
zTR&pzDl(i&xdeiRU`X3orCdK21@2E81Vjnd6YR+KmAdI~tt3<UD52x68d}@k+Hu$>
zZ|O^v7^beS>$}z6${|WbM)Hp=#<zMAKZ_8tl%o-W8R{30J_tNt5muxpglktvV!V{W
z?qQAR$F*76S5>X6ru{P=!jWL4IKOCsCr!Wc-5mUC&&b-IK@ng4XVU>r;e0HNgqV>_
z5swlGOq#lP+55)q+-m%J?JG!F5?gpsV#h|>p3>*lB8&obsQ)-AqQ#GzZJ1=JS-CdK
zS$+=bjHSSOK~j@eyTWiE_q*%TH`H57q-M)!1kv;v$wN<%?dhktEXvf>*%$5{kEWO&
z7rWuYW(EtNzpuBM8~Tt5^Oyf<;*ug8TdKce>QhdSqE{aOvCep7POITUiQb&(*Zezl
zs+%g;=ckF^kB?fqUpZpZ)ZDXfaKg04RHyBA$V=a|S~peo_GV_JuM~(|$H~Eqorq^E
zwP+PW;iD8<Nhs)Xei10&4xY&NZ<n#J=Nhlpyr78%*(QTV=fp)vzvJAmd>!UIuRo1O
zpkSlNouKE8=r)nFq_Bw_sWSiezI+=fFM4yY`&Dr`nU0$MF*_T<>uJNls{^VW!Gm(s
zmdLZ`elypsCL+_D@9r`9neK8gIvma9AG4-K|NlHii0Gp)bwL7I4w9+75CWkn)Roo)
z-kP;81L@l@xDzhlN<xN-be4l(dOfbG0q2@vif$6nP3XUk(*5R$yGAqF+v2|V5S7gE
zG8ISCS%VmhN;p`j<NLeY@1d=x3lf%dw8QdxQ^J?zanea~NsMgyJ&{F*E0pe^esDuN
zb|s3v*CD5ATrSqN{dVmRc$9|cqzsW141;paQmXF=^A@)q@&LMTQS7s&rugC$;Uuqr
z?m^%{<%K`}=SY31kRj!NE%o!?J@y3L+p^XW9S_vV&&R_A43{fa#@-|nY;8pe6nw2$
zYB!^soOH@JLEm1Q+YLy`r`?>?z;m>w5zW{5urIg;MaIsuwg?n3v~{w&Xsj<ZnF%#A
zYGhPNtyYXjHm<B@A!<y5aa;Y5n<FTw|NG>iLiI;i3&UzPJT?Vk$W3cY*yWc9HdjO}
zhv?QgTuB0IG(;==f4~N!8j^wfcGg{Ic~r8>KL$+087)vk?H9lPA*ufx{0?Uqo2t(s
z?<sRr(nWW2+R|ypnR=W^*RRhFBQ2YRC(mso;76g3=S+5c;afqhw9qs4Wn|Ug^ggyn
zSYZMcdJRlhpFapaj-@N}&X*+(zaA~DzZKd4{IP})_rwA^EB!`}k?dcoK9fknIvrq#
zOAv2uN&8o(KP|HUc%e>tv;rIP1MB?_mZ+}p-++#kf!34gr{{F5c)$-7t7_Ho?0tdO
z-4zWFHDU@7ef0t|lH&dDfI8!12lf|4)TSUHs^T4#C4v{TfYzh;0ET=gJ)pKzKAPv#
ztv&*+t79oMaS%HYrklXREcA$1fSIq!mx>z+&mI+VsGELPhZ(g=3}`*v#gfGODFTt5
z{m0lFh0X^6VgE0=L_evm>hq2m?FuSaF|Rf+Ugf^nR!rP>GXN(SLiNi4y0PjAijIXf
zw-Y{zz$yQmpAiL)J@J)yD@V}yy*Q{G&prq;Wc8+6?1GGVdEwMt@pyJE6k|VE&~-@4
zsRtP4b&8x3ly7XC!hbCSsg&)9e|0GOpS*uR{QlHZudD^38*tWFrSAWU#SzhPI!J_V
zhw31rTCm6P5JgjWE?|dbn77w|N;3Os-*%avnusjN2N+TOXfGl0+-|wL7RtoYrbi9r
z!}Bq?B83*2FaGQGrHw=W!v<>Kuo`6A|HY20WX5^4TAebD)(n6o&5+A{p9qDpj-Z@^
z-xfO6mWZ~br?K0!%-Ey2wIIBodX!J1O{D1NZHR%r#?}AWSY<IKG<F2uP5?u!o7&@9
zB=~*zq$C>Rj#YIBxf$|4#X~ML?+`6z{_(@wytf@kO@xV@YbOH|>|-S)y1-6K@;_{`
zi5i5f-6F$W-Y5E(jTQAMH=ei~S`k(3d3EKm31CS~qgVOrjRUP06`vy33~Il-ky;e<
z!3{v_Vjq-})~UbH*^5@(@w3;ID1W7q77$Gjn=o0eEEmdP{Fgla0Dlgcu@EHjY_Rk`
zX!@D#iLK>?jVqdxZC2m(c<7ZCi+8Zo+F*TlK~yJcQ}*@iVcF5v4`Ph}r+hc`*pX9l
z{NQJ3o*tMvG8gmHPetkIs<aP2@JbL?8C~AZ`(RfuSTy~NmC&8S7s*?85#5f;w>08Z
z8qg$nsHs+^u^#Sh`^X|_#29?Y_j^4=*V9#=6ZGHYOrW7px~)6BfZG|tcO{w+xuL<2
z#tvB$Q!{iA8dWdjP6-%kkx(`>7sAz~%(ZiEeA5;!N;<>Jmj1CoC%<OZ?TO1HX|;#!
z;DlV=2P37;JE9z`ALr_3S)%L`<XMVfyaUnMhlx-3l7Grv3TWw>D~TnCTp@+@MD@j9
zSC0-$kw5%NE_5(Gwwf3e)6k@U|DuEqro7)TPwau**7i{Lsw)9V0j6+^cxI?Cb{UKQ
zIPtHNSvbW;^t~h(dP1ViJU7m(i87;H=Pz`O`8a+<#np0E&!=Uqj;Jn(!MH4`bX<%Q
zMfpix6{v61eWdVTZ==%_xT0l6qC)fvEMuA4Ec<T$7;)-dkY{%u`+JMV=kAJvBhNR5
z3k7}BM`tbR(GGllo114S2L{Xh5Mv@0_1TZtkO>Kv7ncK%6rgEn>G`SNmvZF}S<8A~
zrE8dLYi9=XK#}v!h11&E)1jgGli_Mr%r}aW%5BbyvS(UzB-z~f%Y6{-5=W!r@~O5r
zz^m&)_wfWXD940#A7t#`=}s;1qvEyO*LgoH<R`49F7}vTWe{nb^)W>~cd;I@TVtss
zA+Y7fUK!M!zZ0kBLFg9gQ#S|xkk}s_p)>1cj1*$&wbLt7T{BIW?F)j9KZWig*~xq=
z-0oOul7XVUmg9D%VZK9<y-X|dRU3%~_BHu;0`7Vfi^W;lMziwyGnLHqrPFa0n+lng
z*)?fJAR$Hst2tu5{8>p0?0PDnw${yn4$#jW>G(IDJT5++`1yAeh@|_??hG(1^p<hO
z)T4I2f`&4!FZ3~7c3>j5Ma?s4WQv21<g;tGU%D3DqsJ)gn`xevC;#1+<oj@HdGB}~
z`2N|p0+6p9$*hXOR{HSO4P}s7#OglRL%<;caJ~DxU1Z`Jtp_Q_qu_*cdc<++s<U%n
z`?IP$9HZ{Q9KOMgcyY&*<uNgnq3nf;iOK}?Skq*>Y;_<huDQ7`bYI;sw84XQ8r4Fi
zbN1(7l|AkWVjS|}ay>oG`DE0Xe)uczjh)VSA`erAEyJc2U(jP{!efy_3sr=XrL*l0
zP?kVu#&p?oe~kgAZ&8ox)+^p9-Yn2#<DR!}WYKm&Qn2Iq9D=wQ_3?19{d!%a?al<F
z8{!*vDRTqzzO?2us<wtO*pvJsba>1J>q(2Vs@Ev0anadEo{ul5NNv)P#u;WJoxUz<
z$`|H5dKHA+JHNn}%n1C+2#BZEx0_{4C<i}LXRvN<BC<5A>tDeJr78r<cVGL+KQgwp
zd2un>vI4vM=H?kP|L!V40IidC#@AkEFRL-KskXo_9K@%dg6*3in?DQT(d#h$Cu#eB
zd5nD_tVf@D@8TM%Fu)YuB#4+-td?e}_nOdnzjGmWc9X1=JSo!*9!uu_+KI?#Y#s*R
z=e894rYO$=c8j#vxFdl9WmLcGK&6y+-;K8OhwjPtkoDp4dcSYYkWJa0#DcX?N4Veg
z1YU_S;^8miSJQ~#0=wNJ+K3at&dTEV6MKu3PQZSy1hdNr<B(j#k*bi6(p+AI!a=Do
z@|K!$ba4sIFq&_8OU-0$-@Sk>bSO_)5-E=?PiN>sF)5Y5$%(VT^DhvcyxAh_lZv=B
zb6XnJZkt;QBya8Xy(!oe^K+~$IL>1zqI*(vCRd_eE{EyiDhxWh=8~?1f_i1lGR@Tl
zrhUd5Q;9jbEf_BfB8tk`Va>~%*6d|5V7)h;{lnP)j~O_dGb9p^KXx~%0>&P5b_u8-
m$wHc9Gfz%k57YOb5F?ZiGZRa9|85RNP>^{iT_O1~;J*M0DrDUN

literal 0
HcmV?d00001

diff --git a/docs/manual/security.rst b/docs/manual/security.rst
new file mode 100644
index 0000000..b8ae578
--- /dev/null
+++ b/docs/manual/security.rst
@@ -0,0 +1,646 @@
+.. _`DDS Security`:
+
+############
+DDS Security
+############
+
+CycloneDDS is (will be) compliant with The Object Management Group (OMG) DDS Security specification.
+
+This specification defines the Security Model and Service Plugin Interface (SPI) architecture for
+compliant DDS implementations. The DDS Security Model is enforced by the invocation of these SPIs
+by the DDS implementation.
+
+.. image:: ./_static/pictures/dds_security_overview.png
+   :width: 1000
+
+The three plugins that comprise the DDS Security Model in CycloneDDS are:
+
+
+**Authentication Service Plugin**
+
+Provides the means to verify the identity of the application and/or user that invokes operations
+on DDS. Includes facilities to perform mutual authentication between participants and establish
+a shared secret.
+
+**AccessControl Service Plugin**
+
+Provides the means to enforce policy decisions on what DDS related operations an authenticated
+user can perform. For example, which domains it can join, which Topics it can publish or
+subscribe to, etc.
+
+**Cryptographic Service Plugin**
+
+Implements (or interfaces with libraries that implement) all cryptographic operations including
+encryption, decryption, hashing, digital signatures, etc. This includes the means to derive keys
+from a shared secret.
+
+----
+
+CycloneDDS provides built-in implementations of these plugins. Authentication uses PKI
+(Public Key Infrastructure) with a pre-configured shared Certificate Authority, RSA is used for
+authentication and Diffie-Hellman is used for key exchange. AccessControl use Permissions document
+signed by shared Certificate Authority. Cryptography uses AES-GCM (AES using Galois Counter Mode)
+for encryption and AES-GMAC for message authentication.
+
+The plugins are accessed by the DDSI2 service when DDS Security is enabled by supplying the
+security configuration within the XML configuration or Participant QoS.
+
+Security plugins are dynamically loaded where the locations are defined in CycloneDDS
+configuration or Participant QoS settings.
+
+
+*******************************************************
+Brief information about PKI (public key infrastructure)
+*******************************************************
+
+The comprehensive system required to provide public-key encryption and digital signature services
+is known as a public-key infrastructure (PKI). The purpose of a PKI is to manage keys and
+certificates. By managing keys and certificates through a PKI, an organization establishes and
+maintains a trustworthy networking environment.
+
+Public Key Cryptography: Each user has a key pair, generated during the initial certificate
+deployment process, that is comprised of a public key, which is shared, and a private key, which
+is not shared. Data is encrypted with the user’s public key and decrypted with their private key.
+Digital signatures, used for non-repudiation, authentication and data integrity, are also generated
+using public key cryptography.
+
+**Identity Certificate**
+
+This is an electronic document used to prove the ownership of a public key. The certificate
+includes information about the key, information about the identity of its owner (called the
+subject), and the digital signature of an entity that has verified the certificate's contents
+(called the issuer). If the signature is valid, and the software examining the certificate
+trusts the issuer, then it can use that key to communicate securely with the certificate's
+subject.
+
+**Certificate Authority**
+
+This issues user certificates and acts as the chief agent of trust.  When issuing a certificate
+to a user, the CA signs the certificate with its private key in order to validate it. During
+electronic transactions the CA also confirms that certificates are still valid. Certificates
+may be revoked for various reasons. For example, a user may leave the organization or they may
+forget their secret passphrase, the certificate may expire or become corrupt. This process is
+usually accomplished through the use of a Certificate Revocation List (CRL) which is a list of
+the certificates that have been revoked. Only the certificates that have been revoked appear on
+this list.
+
+**Subject of Identity Certificate**
+
+This is the identity to be secured. It contains information such as common name (CN),
+organization (OU), state (ST) and country (C).
+
+**Subject Name**
+
+This is aka distinguished name and is the string representation of certificate subject.
+
+ie: emailAddress=alice\@adlink.ist,CN=Alice,OU=IST,O=ADLink,ST=OV,C=NL
+
+
+*************************
+PKI Usage in DDS Security
+*************************
+
+.. image:: ./_static/pictures/pki_overview.png
+   :width: 1000
+
+Alice and Bob are the DDS participants who have their private and public keys. Identitity
+Certificate Authority (ID CA) has its own self-signed certificate (IdentityCA in the diagram).
+ID CA gets Alice's subject information and public key and generates an IdentityCertificate for her.
+Alice's certificate includes her public key and certificate of ID CA; so that her certificate can
+be verified if it is really issued by ID CA.
+
+Access Control is configured with governance and permissions files.
+Governance file defines the security behavior of domains and topics.
+Permissions file contains the permissions of the domain participant, topics, readers and writers,
+binds them to identity certificate by subject name (distinguished name).
+
+Governance files and Permissions files are signed by Permission CA. Signed documents also
+contains Permissions CA certificate; so that they can be verified if they are really issued
+by Permissions CA.
+
+Authenticated participants handshakes with each other and generates a shared key by Diffie-Hellman
+key exchange. This shared key is used for encrypting/decrypting data with AES.
+
+During the handshake Alice checks Bob's certificate and Bob's Permissions file if they are really
+issued by the ID CA certificate and Permissions CA Certificate that **she** has. Also Bob checks
+Alice's certificate and Alice's Permissions file if they are really issued by the ID CA certificate
+and Permissions CA that **he** has.
+Permissions file can contain  permissions for several identities; so subject name of identity
+certificate exist in permissions file to establish a binding between identity and its permissions.
+
+
+*************
+Configuration
+*************
+
+.. image:: ./_static/pictures/dds_security_configuration_overview.png
+   :width: 1000
+
+
+The configuration of DDS Security is split up into two parts.
+
+- `Plugins Configuration`_
+- `Access Control Configuration`_
+
+This section explains the configuration in details. However, you can see a concrete example on
+security section of Example Readme file.
+
+.. _`Plugins Configuration`:
+
+
+Plugins Configuration
+*********************
+
+TODO: Update to reflect the configuration through QoS policies.
+
+| CyclonDDS gets the plugin configuration from DDS2I configuration elements or the Participant QoS
+  Policies as stated in the DDS Security specification.
+
+| This behavior allows applications to use DDS Security without update. Only supplying a new
+  configuration with DDS Security enabled is enough to switch from a non-secure to a secure
+  deployment. However, the same DDS Security configuration is forced upon all the participants
+  within the federation.
+
+| The configuration options are bundled in the ``DDSSecurity`` configuration section in DDS2I.
+
+| Every DDS Security plugin has its own configuration sub-section.
+
+
+.. _`Authentication Properties`:
+
+=========================
+Authentication Properties
+=========================
+
+| To authenticate CycloneDDS, it has to be configured with IdentityCertificate
+  (DDSSecurity/Authentication/IdentityCertificate - see Configuration Guide - DDS Security).
+  This IdentityCertificate is used to authenticate all participants of that particular
+  CycloneDDS domain.
+
+| Associated with the IdentityCertificate is the corresponding PrivateKey
+  (DDSSecurity/Authentication/PrivateKey).
+  The PrivateKey may either be a 2048-bit RSA or a 256-bit Elliptic Curve Key with
+  a prime256v1 curve.
+
+| IdentityCA (DDSSecurity/Authentication/IdentityCA) is the certificate of Identity Certificate
+  Authority (CA) which is the issuer of the IdentityCertificate.  The public key of the
+  IdentityCA shall either be a 2048-bit RSA key or a 256-bit Elliptic Curve Key for the prime256v1
+  curve. The identity_ca can be a self-signed certificate.
+
+| Currently the IdentityCertificate, IdentityCA and PrivateKey should be a X509 document in pem
+  format.
+  It may either be specified directly in the configuration file or the configuration file should
+  contain a reference to a corresponding file.
+
+| Optionally the PrivateKey could be protected by a password (DDSSecurity/Authentication/Password).
+
+| Furthermore the CycloneDDS configuration allows to configure a directory containing additional
+  IdentityCA's
+  which are used to verify the identity certificates that are received by remote instances
+  (DDSSecurity/Authentication/TrustedCADirectory). This option allows to use more than one identity
+  CA throughout the system. TrustedCADirectory is an extension to DDS Security specification; so it
+  can not be used when communicating with other vendors.
+
+
+.. _`Access Control Properties`:
+
+=========================
+Access Control Properties
+=========================
+
+Governance Document (DDSSecurity/AccessControl/Governance),
+Permissions Document (DDSSecurity/AccessControl/Permissions) and
+Permissions CA Certificate (DDSSecurity/AccessControl/PermissionsCA) are required for access
+control plugin. See DDS Security section of Configuration Guide for property descriptions. They
+can be provided by data itself (with CDATA) or path to file on disk.
+
+
+.. _`Cryptography Properties`:
+
+=======================
+Cryptography Properties
+=======================
+
+Cryptography plugin has no property
+
+
+.. _`Access Control Configuration`:
+
+Access Control Configuration
+****************************
+
+| Access Control configuration consists of Governance document and Permissions document.
+  Both governance and permissions files must be signed by the Permissions CA in S/MIME format.
+  Participants use their own permissions CA to validate remote permissions. So, all permissions CA
+  Certificates must be same for all participants.
+
+| The signed document should use S/MIME version 3.2 format as defined in IETF RFC 5761 using
+  SignedData Content Type (section 2.4.2 of IETF RFC 5761) formatted as multipart/signed (section
+  3.4.3 of IETF RFC 5761). This corresponds to the mime-type application/pkcs7-signature.
+  Additionally the signer certificate should be be included within the signature.
+
+
+===================
+Governance Document
+===================
+
+Governance document defines the security behavior of domains and topics. It is an XML document and
+its format is specified in OMG DDS Security Version 1.1 Section 9.4.1.2.3
+
+The attributes that specified in Governance document must match with the remote one for
+establishing communication.
+
+
+Protection Kinds
+================
+
+The domain governance document provides a means for the application to configure the kinds of
+cryptographic transformation applied to the complete RTPS Message, certain RTPS SubMessages, and
+the SerializedPayload RTPS submessage element that appears within the Data.
+
+.. image:: ./_static/pictures/rtps_message_structure.png
+   :width: 300
+
+The configuration allows specification of five protection levels: NONE, SIGN, ENCRYPT,
+SIGN_WITH_ORIGIN_AUTHENTICATION and ENCRYPT_WITH_ORIGIN_AUTHENTICATION.
+
+**NONE**
+  indicates no cryptographic transformation is applied.
+
+**SIGN**
+  indicates the cryptographic transformation shall be purely a message authentication code (MAC),
+  that is, no encryption is performed.
+
+**ENCRYPT**
+  indicates the cryptographic transformation shall be an encryption followed by a message
+  authentication code (MAC) computed on the ciphertext, also known as Encrypt-then-MAC.
+
+**SIGN_WITH_ORIGIN_AUTHENTICATION**
+  indicates the cryptographic transformation shall be purely a set of message authentication codes
+  (MAC), that is, no encryption is performed. This cryptographic transformation shall create a
+  first “common authenticationcode” similar to the case where Protection Kind is SIGN. In addition
+  the cryptographic transformation shall create additional authentication codes, each produced with
+  a different secret key. The additional MACs prove to the receiver that the sender originated the
+  message, preventing other receivers from impersonating the sender.
+
+**ENCRYPT_WITH_ORIGIN_AUTHENTICATION**
+  indicates the cryptographic transformation shall be an encryption followed by a message
+  authentication code (MAC) computed on the ciphertext, followed by additional authentication
+  codes, Each of the additional authentication codes shall use a different secret key. The
+  encryption and first (common) authentication code is similar to ones produced when the Protection
+  Kind is ENCRYPT. The additional authentication codes are similar to the ones produced when the
+  Protection Kind is SIGN_WITH_ORIGIN_AUTHENTICATION.
+
+
+Participant attributes
+======================
+
+**Allow Unauthenticated Participants**
+  This is used for allowing communication with non-secure participants. If this option is enabled,
+  secure participant can communicate with non-secure participant by only non-protected topics.
+
+**Enable Join Access Control**
+  If this option is enabled, remote participant permissions are checked if its subject name is
+  allowed to create a topic anyhow.
+
+**Discovery Protection Kind**
+  Protection attribute for discovery communication when it is enabled for topic. Please see the
+  DDS Security specification document for available options.
+
+**Liveliness Protection Kind**
+  Protection attribute for liveliness communication when it is enabled for topic. Please see the
+  DDS Security specification document for available options.
+
+**RTPS Protection Kind**
+  Protection attribute for all messages on the wire. Please see the DDS Security specification
+  document for available options. If encryption is selected for RTPS, there is no need to encrypt
+  submessages (metadata_protection_kind) and payloads (data_protection_kind) which are defined in
+  topic settings.
+
+
+Topic Attributes
+================
+
+**Enable Discovery protection:**
+  If enabled, discovery is protected according to Discovery Protection Kind attribute of
+  corresponding participant.
+
+**Enable Liveliness protection:**
+  If enabled, liveliness is protected according to Liveliness Protection Kind attribute of
+  corresponding participant.
+
+**Enable Read Access Control:**
+  If enabled, the permissions document is checked if the participant is allowed to create
+  a datareader for the related topic.
+
+**Enable Write Access Control:**
+  If enabled, the permissions document is checked if the participant is allowed to create
+  a datawriter for the related topic.
+
+**Metadata protection Kind:**
+  Protection attribute for submessages.
+
+**Data protection Kind:**
+  Protection attribute for data payload.
+
+There are different settings for different domain ranges. The domain rules are evaluated in the
+same order as they appear in the document. A rule only applies to a particular DomainParticipant
+if the domain Section matches the DDS domain_id to
+which the DomainParticipant belongs. If multiple rules match, the first rule that matches is the
+only one that applies.
+
+The topic access rules are evaluated in the same order as they appear within the
+<topic_access_rules> Section. If multiple rules match the first rule that matches is the only one
+that applies.
+
+fnmatch pattern matching can be used for topic expressions including the following patterns
+
+.. _`fnmatch pattern matching`:
+
++----------+----------------------------------+
+|Pattern   |Meaning                           |
++==========+==================================+
+| \*       | matches everything               |
++----------+----------------------------------+
+| \?       | matches any single character     |
++----------+----------------------------------+
+| [seq]    | matches any character in seq     |
++----------+----------------------------------+
+| [!seq]   | matches any character not in seq |
++----------+----------------------------------+
+
+
+====================
+Permissions Document
+====================
+
+The permissions document is an XML document containing the permissions of the domain participant
+and binding them to the subject name of the DomainParticipant as defined in the identity
+certificate. Its format is specified in OMG DDS Security Version 1.1 Section 9.4.1.3.
+
+
+Validity period
+===============
+
+It is checked before creating participant; expired permissions document results with DDSI shutdown.
+Validity period is also checked during handshake with remote participant; expired remote
+permissions document prevents communications to be established.
+
+
+Subject Name
+============
+
+The subject name must match with Identity Certificate subject. It is checked during create
+participant and during handshake with remote participant. Use the following openssl command to get
+subject name from identity certificate:
+
+``openssl x509 -noout -subject -nameopt RFC2253 -in <identity_certificate_file.crt>``
+
+
+Rules
+=====
+
+DomainParticipant permissions are defined by set of rules.
+
+The rules are applied in the same order that appear in the document. If the criteria for the rule
+matches the domain_id join and/or publish or subscribe operation that is being attempted, then the
+allow or deny decision is applied. If the criteria for a rule does not match the operation being
+attempted, the evaluation shall proceed to the next rule. If all rules have been examined without
+a match, then the decision specified by the “default” rule is applied. The default rule, if
+present, must appear after all allow and deny rules. If the default rule is not present, the
+implied default decision is DENY. The matching criteria for each rule specify the domain_id,
+topics (published and subscribed), the partitions (published and subscribed), and the data-tags
+associated with the DataWriter and DataReader.
+
+For the grant to match there shall be a match of the topics, partitions, and data-tags criteria.
+This is interpreted as an AND of each of the criteria. For a specific criterion to match
+(e.g., <topics>) it is enough that one of the topic expressions listed matches (i.e., an OR of
+the expressions with the <topics> section).
+
+`fnmatch pattern matching`_ can be used for topic expressions and partition expressions.
+
+
+Interactions with DDS Security
+******************************
+
+DDS Security provides the responses through CycloneDDS error and info log. Users can get
+messages for:
+
+- Configuration errors such as plugin library files, certificate files, governance and permissions
+  files that can not be found on filesystem.
+- Permission errors such as denied permission for creating writer of a topic.
+- Attribute mismatch errors such as mismatches of security attributes between participants, topics,
+  readers and writers.
+- Integrity errors such as Permissions file-Permissions CA and Identity Cert-Identity CA integrity.
+
+Local subscription, publication and topic permission errors are written to error log.
+Remote participation, subscription and publication permission errors are written to info log as
+warning message.
+
+
+Data Communication And Handshake Process
+*******************************************
+
+Authentication handshake between participants starts after participant discovery.
+If a reader and a writer created during that period, their match will be delayed until after the
+handshake succeeds.
+This means, during the handshake process, volatile data will be lost, just like there is no reader.
+
+After publication match, the encryption / decryption keys are exchanged between reader and writer.
+Best-effort data that are sent during this exchange will be lost, however reliable data will be
+resent.
+
+
+DDS Secure Discovery
+******************************
+
+Just like normal operation, DDSI will discover local and remote participants, topics, readers and
+writers.
+However, when DDS Security is enabled, it is more complex and will take a longer time (especially
+due to the handshaking that has to happen).
+
+With every new node in the system, the discovery takes exponentially longer. This can become a
+problem if the system contains a number of slow platforms or is large.
+
+The Security discovery performance can be increased quite a bit by using the DDSI
+Internal/SquashParticipants configuration.
+
+
+Proprietary builtin endpoints
+******************************
+
+| The DDS standard contains some builtin endpoints. A few are added by the DDS Security
+  specification. The behaviour of all these builtin endpoints are specified (and thus are be
+  handled by the plugins that implement the DDS Security specification), meaning that they
+  don't have to be present in the Governance or Permissions documents and the users don't
+  have to be bothered with them.
+|
+| A few of these builtin endpoints slave according to the <discovery_protection_kind> within
+  the Governance document. In short, related submessages are protected according to the value
+  of <discovery_protection_kind>. This protects meta information that is send during the
+  discovery phase.
+
+
+*******************
+DataTag Permissions
+*******************
+
+| Data Tags provide an extra (optional) level of identification. This can mean f.i. that
+  a certain reader is not allowed to read data from writer A but it is allowed to read from
+  writer B (all the same topic).
+|
+| This optional feature is not yet supported.
+
+
+***************************
+External Plugin Development
+***************************
+
+DDS Security consists of three plugins (authentication, cryptography and access control).
+CycloneDDS comes with built-in security plugins that comply with OMG DDS Security specification.
+The plugins are loaded in the run-time. However, you can also implement your own custom plugin by
+implementing the given API according to OMG DDS Security specification.
+You can implement all of the plugins or just one of them.
+
+| The followings are the key points for implementing you own plugin:
+
+
+Interface
+*********
+
+Implement all plugin specific functions with exactly same prototype. Plugin specific function
+interfaces are in dds_security_api_access_control.h, dds_security_api_authentication.h and
+dds_security_api_cryptography.h header files accordingly.
+
+
+Init and Finalize
+*****************
+
+| A plugin should have an init and a finalize functions. plugin_init and plugin_finalize
+  interfaces are given in dds_security_api.h header file and function should be same as in
+  configuration file.
+| Init function is called once, just after the plugin is loaded. Finalize function is
+  called once, just before the plugin is unloaded.
+
+
+Inter Plugin Communication
+**************************
+
+| There is a shared object (*DDS_Security_SharedSecretHandle*) within authentication and
+  cryptography plugins. If you want to implement only one of them and use the builtin for the
+  other one, you have to get or provide the shared object properly.
+| *DDS_Security_SharedSecretHandle* is the integer representation of
+  *DDS_Security_SharedSecretHandleImpl* struct object. Cryptography plugin gets the
+  *DDS_Security_SharedSecretHandle* from authentication plugin and casts to
+  *DDS_Security_SharedSecretHandleImpl* struct. Then all needed information can be retieved
+  through *DDS_Security_SharedSecretHandleImpl* struct:
+
+::
+
+  typedef struct DDS_Security_SharedSecretHandleImpl {
+   DDS_Security_octet* shared_secret;
+   DDS_Security_long shared_secret_size;
+   DDS_Security_octet challenge1[DDS_SECURITY_AUTHENTICATION_CHALLENGE_SIZE];
+   DDS_Security_octet challenge2[DDS_SECURITY_AUTHENTICATION_CHALLENGE_SIZE];
+
+  } DDS_Security_SharedSecretHandleImpl;
+
+
+Error Codes
+***********
+
+| Most of the plugin functions have parameter for reporting exception. The following exception
+  codes should be used in the reported exception data according to the situation.
+  dds_security_api_err.h header file contains the code and message constants.
+
++-------+----------------------------------------------------------------+
+| Code  |            Message                                             |
++=======+================================================================+
+| 0     | (OK)                                                           |
++-------+----------------------------------------------------------------+
+| 100   | Can not generate random data                                   |
++-------+----------------------------------------------------------------+
+| 110   | Identity empty                                                 |
++-------+----------------------------------------------------------------+
+| 111   | Participant Crypto Handle empty                                |
++-------+----------------------------------------------------------------+
+| 112   | Permission Handle empty                                        |
++-------+----------------------------------------------------------------+
+| 113   | Invalid Crypto Handle                                          |
++-------+----------------------------------------------------------------+
+| 114   | Invalid argument                                               |
++-------+----------------------------------------------------------------+
+| 115   | Invalid Crypto token                                           |
++-------+----------------------------------------------------------------+
+| 116   | Invalid parameter                                              |
++-------+----------------------------------------------------------------+
+| 117   | File could not be found, opened or is empty, path: %s          |
++-------+----------------------------------------------------------------+
+| 118   | Unknown or unexpected transformation kind                      |
++-------+----------------------------------------------------------------+
+| 119   | Message cannot be authenticated, incorrect signature           |
++-------+----------------------------------------------------------------+
+| 120   | Can not open trusted CA directory                              |
++-------+----------------------------------------------------------------+
+| 121   | Identity CA is not trusted                                     |
++-------+----------------------------------------------------------------+
+| 122   | Certificate start date is in the future                        |
++-------+----------------------------------------------------------------+
+| 123   | Certificate expired                                            |
++-------+----------------------------------------------------------------+
+| 125   | Certificate authentication algorithm unknown                   |
++-------+----------------------------------------------------------------+
+| 126   | Failed to allocate internal structure                          |
++-------+----------------------------------------------------------------+
+| 127   | Failed to parse PKCS7 SMIME document                           |
++-------+----------------------------------------------------------------+
+| 128   | Property is missing: (%s)                                      |
++-------+----------------------------------------------------------------+
+| 129   | Permissions document is invalid                                |
++-------+----------------------------------------------------------------+
+| 130   | Governance document is invalid                                 |
++-------+----------------------------------------------------------------+
+| 131   | Operation is not permitted in this state                       |
++-------+----------------------------------------------------------------+
+| 132   | Remote permissions document is not available                   |
++-------+----------------------------------------------------------------+
+| 133   | Certificate is invalid                                         |
++-------+----------------------------------------------------------------+
+| 134   | Certificate type is not supported                              |
++-------+----------------------------------------------------------------+
+| 135   | Governance property is required                                |
++-------+----------------------------------------------------------------+
+| 136   | Permissions CA property is required                            |
++-------+----------------------------------------------------------------+
+| 137   | Can not parse governance file                                  |
++-------+----------------------------------------------------------------+
+| 138   | Can not parse permissions file                                 |
++-------+----------------------------------------------------------------+
+| 139   | Could not find permissions for topic                           |
++-------+----------------------------------------------------------------+
+| 140   | Could not find domain %d in permissions                        |
++-------+----------------------------------------------------------------+
+| 141   | Could not find domain %d in governance                         |
++-------+----------------------------------------------------------------+
+| 142   | Could not find %s topic attributes for domain(%d) in governance|
++-------+----------------------------------------------------------------+
+| 143   | PluginClass in remote token is incompatible                    |
++-------+----------------------------------------------------------------+
+| 144   | MajorVersion in remote token is incompatible                   |
++-------+----------------------------------------------------------------+
+| 145   | Access denied by access control                                |
++-------+----------------------------------------------------------------+
+| 146   | Subject name is invalid                                        |
++-------+----------------------------------------------------------------+
+| 147   | Permissions validity period expired for %s                     |
++-------+----------------------------------------------------------------+
+| 148   | Permissions validity period has not started yet for %s         |
++-------+----------------------------------------------------------------+
+| 149   | Could not find valid grant in permissions                      |
++-------+----------------------------------------------------------------+
+| 150   | Permissions of subject (%s) outside validity date: %s - %s     |
++-------+----------------------------------------------------------------+
+| 151   | Unsupported URI type: %s                                       |
++-------+----------------------------------------------------------------+
+
+.. EoF

From 73d0f604e33f209a6f9ddce7cca5dd5722f11351 Mon Sep 17 00:00:00 2001
From: Marcel Jordense <marcel.jordense@adlinktech.com>
Date: Thu, 19 Dec 2019 10:45:15 +0100
Subject: [PATCH 082/238] Correct travis build

Signed-off-by: Marcel Jordense <marcel.jordense@adlinktech.com>
---
 .travis.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index c743f04..8cc036b 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -150,7 +150,7 @@ jobs:
       env: [ ARCH=x86_64, ASAN=none, BUILD_TYPE=Release, SSL=YES, SECURITY=YES, LIFESPAN=YES, GENERATOR="Unix Makefiles" ]
     - <<: *linux_gcc8
       env: [ ARCH=x86_64, ASAN=none, BUILD_TYPE=Debug, SSL=NO, SECURITY=YES, LIFESPAN=NO, GENERATOR="Unix Makefiles" ]
-    - <<: *linux_gcc8
+    - <<: *linux_clang
       env: [ ARCH=x86_64, ASAN=address, BUILD_TYPE=Debug, SSL=YES, SECURITY=YES, LIFESPAN=YES, GENERATOR="Unix Makefiles" ]
     - <<: *linux_clang
       env: [ ARCH=x86_64, ASAN=address, BUILD_TYPE=Debug, SSL=YES, SECURITY=NO, LIFESPAN=YES, GENERATOR="Unix Makefiles" ]

From b561cb821f6eb3ce7079e452c5e9876a90c54620 Mon Sep 17 00:00:00 2001
From: MarcelJordense <37329887+MarcelJordense@users.noreply.github.com>
Date: Wed, 8 Jan 2020 16:19:55 +0100
Subject: [PATCH 083/238] support delayed endpoint matching (#315)

* support delayed endpoint matching

Signed-off-by: Marcel Jordense <marcel.jordense@adlinktech.com>

* Update delayed endpoint matching

Signed-off-by: Marcel Jordense <marcel.jordense@adlinktech.com>
---
 src/core/ddsi/CMakeLists.txt                  |   2 +
 .../ddsi/include/dds/ddsi/ddsi_entity_index.h |   1 +
 .../ddsi/include/dds/ddsi/ddsi_handshake.h    | 197 +++++++
 .../ddsi/include/dds/ddsi/ddsi_security_msg.h |   4 +
 .../ddsi/include/dds/ddsi/ddsi_security_omg.h | 267 ++++++++-
 src/core/ddsi/include/dds/ddsi/q_entity.h     |  13 +
 src/core/ddsi/src/ddsi_entity_index.c         |  12 +
 src/core/ddsi/src/ddsi_handshake.c            | 109 ++++
 src/core/ddsi/src/ddsi_security_omg.c         | 154 ++++-
 src/core/ddsi/src/q_entity.c                  | 542 +++++++++++++++++-
 10 files changed, 1282 insertions(+), 19 deletions(-)
 create mode 100644 src/core/ddsi/include/dds/ddsi/ddsi_handshake.h
 create mode 100644 src/core/ddsi/src/ddsi_handshake.c

diff --git a/src/core/ddsi/CMakeLists.txt b/src/core/ddsi/CMakeLists.txt
index e0aaaa8..75c2342 100644
--- a/src/core/ddsi/CMakeLists.txt
+++ b/src/core/ddsi/CMakeLists.txt
@@ -20,6 +20,7 @@ PREPEND(srcs_ddsi "${CMAKE_CURRENT_LIST_DIR}/src"
     ddsi_mcgroup.c
     ddsi_security_omg.c
     ddsi_portmapping.c
+    ddsi_handshake.c
     ddsi_serdata.c
     ddsi_serdata_default.c
     ddsi_sertopic.c
@@ -77,6 +78,7 @@ PREPEND(hdrs_private_ddsi "${CMAKE_CURRENT_LIST_DIR}/include/dds/ddsi"
     ddsi_plist_generic.h
     ddsi_security_omg.h
     ddsi_portmapping.h
+    ddsi_handshake.h    
     ddsi_serdata.h
     ddsi_sertopic.h
     ddsi_serdata_default.h
diff --git a/src/core/ddsi/include/dds/ddsi/ddsi_entity_index.h b/src/core/ddsi/include/dds/ddsi/ddsi_entity_index.h
index 78a353e..1566feb 100644
--- a/src/core/ddsi/include/dds/ddsi/ddsi_entity_index.h
+++ b/src/core/ddsi/include/dds/ddsi/ddsi_entity_index.h
@@ -112,6 +112,7 @@ struct entidx_enum_proxy_reader { struct entidx_enum st; };
 
 void entidx_enum_init (struct entidx_enum *st, const struct entity_index *ei, enum entity_kind kind) ddsrt_nonnull_all;
 void entidx_enum_init_topic (struct entidx_enum *st, const struct entity_index *gh, enum entity_kind kind, const char *topic, struct match_entities_range_key *max) ddsrt_nonnull_all;
+void entidx_enum_init_topic_w_prefix (struct entidx_enum *st, const struct entity_index *ei, enum entity_kind kind, const char *topic, const ddsi_guid_prefix_t *prefix, struct match_entities_range_key *max) ddsrt_nonnull_all;
 void *entidx_enum_next_max (struct entidx_enum *st, const struct match_entities_range_key *max) ddsrt_nonnull_all;
 void *entidx_enum_next (struct entidx_enum *st) ddsrt_nonnull_all;
 void entidx_enum_fini (struct entidx_enum *st) ddsrt_nonnull_all;
diff --git a/src/core/ddsi/include/dds/ddsi/ddsi_handshake.h b/src/core/ddsi/include/dds/ddsi/ddsi_handshake.h
new file mode 100644
index 0000000..1aef76d
--- /dev/null
+++ b/src/core/ddsi/include/dds/ddsi/ddsi_handshake.h
@@ -0,0 +1,197 @@
+/*
+ * Copyright(c) 2006 to 2018 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+#ifndef DDSI_HANDSHAKE_H
+#define DDSI_HANDSHAKE_H
+
+#include "q_unused.h"
+#include "q_entity.h"
+#include "ddsi_security_msg.h"
+
+#if defined (__cplusplus)
+extern "C" {
+#endif
+
+struct participant;
+struct proxy_participant;
+struct ddsi_handshake;
+struct dssi_hsadmin;
+
+enum ddsi_handshake_state {
+    STATE_HANDSHAKE_IN_PROGRESS,
+    STATE_HANDSHAKE_TIMED_OUT,
+    STATE_HANDSHAKE_FAILED,
+    STATE_HANDSHAKE_PROCESSED,
+    STATE_HANDSHAKE_SEND_TOKENS,
+    STATE_HANDSHAKE_OK
+};
+
+/* The handshake will not use the related handshake object after this callback
+ * was executed. This means that it can be deleted in this callback. */
+typedef void (*ddsi_handshake_end_cb_t)(
+    struct q_globals const * const gv,
+    struct ddsi_handshake *handshake,
+    const ddsi_guid_t *lpguid, /* Local participant */
+    const ddsi_guid_t *ppguid, /* Proxy participant */
+    enum ddsi_handshake_state result);
+
+#ifdef DDSI_INCLUDE_SECURITY
+
+#include "dds/ddsi/ddsi_security_msg.h"
+
+/**
+ * @brief Release the handshake.
+ *
+ * This function will decrement the refcount associated with the handshake
+ * and delete the handshake when the refcount becomes 0.
+ *
+ * @param[in] handshake    The handshake.
+ */
+void ddsi_handshake_release(struct ddsi_handshake *handshake);
+
+/**
+ * @brief Handle an authentication handshake message received from the remote participant.
+ *
+ * During the authentication phase handshake messages are being exchanged between the local and
+ * the remote participant. THis function will handle a handshake message received from a remote
+ * participant.
+ *
+ * @param[in] handshake  The handshake.
+ * @param[in] pp         The local participant.
+ * @param[in] proxypp    The remote participant.
+ * @param[in] msg        The handshake message received.
+ */
+void ddsi_handshake_handle_message(struct ddsi_handshake *handshake, const struct participant *pp, const struct proxy_participant *proxypp, const struct nn_participant_generic_message *msg);
+
+/**
+ * @brief Notify the handshake that crypto tokens have been received.
+ *
+ * The handshake could be finished at one end while the other side has not yet processed the
+ * final handshake messages. The arrival of crypto tokens signals that the other side has also finished
+ * processing the handshake. This function is used to signal the handshake that crypto tokens have been
+ * received.
+ *
+ * @param[in] handshake     The handshake.
+ */
+void ddsi_handshake_crypto_tokens_received(struct ddsi_handshake *handshake);
+
+/**
+ * @brief Get the shared secret handle.
+ *
+ * During the handshake a shared secret is established which is used to encrypt
+ * and decrypt the crypto token exchange messages. This function will return a
+ * handle to the shared secret which will be passed to the crypto plugin to
+ * determine the session keys used for the echange of the the crypto tokens.
+ *
+ * @param[in] handshake  The handshake.
+ *
+ * @returns handle to the shared sercet.
+ */
+int64_t ddsi_handshake_get_shared_secret(const struct ddsi_handshake *handshake);
+
+/**
+ * @brief Get the handshake handle
+ *
+ * This function returns the handshake handle that was returned by the authentication plugin
+ * when starting the handshake.
+ *
+ * @param[in]  handshake  The handshake.
+ *
+ * @returns The handshake handle.
+ */
+int64_t ddsi_handshake_get_handle(const struct ddsi_handshake *handshake);
+
+/**
+ * @brief Create and start the handshake for the participants
+ *
+ * This function will create a handshake for the specified local
+ * and remote participants when it does not yet exists. It will start the
+ * handshake procedure by calling the corresponding functions of the authentication plugin.
+ * The callback function is called by the handshake when to report events,
+ * for example to indicate that the handshake has finished or has failed.
+ *
+ * @param[in] pp         The local participant.
+ * @param[in] proxypp    The remote participant.
+ * @param[in] callback   The callback function.
+ *
+ */
+void ddsi_handshake_register(const struct participant *pp, const struct proxy_participant *proxypp, ddsi_handshake_end_cb_t callback);
+
+/**
+ * @brief Remove the handshake associated with the specified participants.
+ *
+ * This function will remove the handshake from the handshake administation and release
+ * the handshake. When the handshake argument is not specified the handshake is searched
+ * in the handshake administation.
+ *
+ * @param[in] pp         The local participant.
+ * @param[in] proxypp    The remote participant.
+ * @param[in] handshake  The handshake.
+ *
+ */
+void ddsi_handshake_remove(const struct participant *pp, const struct proxy_participant *proxypp, struct ddsi_handshake *handshake);
+
+/**
+ * @brief Searches for the handshake associated with the specified participants
+ *
+ * This function will search through the handshake administration to find the handshake
+ * corresponding the to specified local and remote participant.
+ *
+ * @param[in] pp         The local participant.
+ * @param[in] proxypp    The remote participant.
+ *
+ * @returns The handshake
+ */
+struct ddsi_handshake * ddsi_handshake_find(const struct participant *pp, const struct proxy_participant *proxypp);
+
+#else /* DDSI_INCLUDE_SECURITY */
+
+#include "dds/ddsi/q_unused.h"
+
+
+inline void ddsi_handshake_release(UNUSED_ARG(struct ddsi_handshake *handshake))
+{
+}
+
+inline void ddsi_handshake_crypto_tokens_received(UNUSED_ARG(struct ddsi_handshake *handshake))
+{
+}
+
+inline int64_t ddsi_handshake_get_shared_secret(UNUSED_ARG(const struct ddsi_handshake *handshake))
+{
+  return 0;
+}
+
+inline int64_t ddsi_handshake_get_handle(UNUSED_ARG(const struct ddsi_handshake *handshake))
+{
+  return 0;
+}
+
+inline void ddsi_handshake_register(UNUSED_ARG(const struct participant *pp), UNUSED_ARG(const struct proxy_participant *proxypp), UNUSED_ARG(ddsi_handshake_end_cb_t callback))
+{
+}
+
+inline void ddsi_handshake_remove(UNUSED_ARG(const struct participant *pp), UNUSED_ARG(const struct proxy_participant *proxypp), UNUSED_ARG(struct ddsi_handshake *handshake))
+{
+}
+
+inline struct ddsi_handshake * ddsi_handshake_find(UNUSED_ARG(const struct participant *pp), UNUSED_ARG(const struct proxy_participant *proxypp))
+{
+  return NULL;
+}
+
+#endif /* DDSI_INCLUDE_SECURITY */
+
+#if defined (__cplusplus)
+}
+#endif
+
+#endif /* DDSI_HANDSHAKE_H */
diff --git a/src/core/ddsi/include/dds/ddsi/ddsi_security_msg.h b/src/core/ddsi/include/dds/ddsi/ddsi_security_msg.h
index 2db227c..e8ced85 100644
--- a/src/core/ddsi/include/dds/ddsi/ddsi_security_msg.h
+++ b/src/core/ddsi/include/dds/ddsi/ddsi_security_msg.h
@@ -12,6 +12,8 @@
 #ifndef DDSI_SECURITY_MSG_H
 #define DDSI_SECURITY_MSG_H
 
+#ifdef DDSI_INCLUDE_SECURITY
+
 #include "dds/ddsi/q_plist.h"
 #include "dds/ddsi/ddsi_guid.h"
 #include "dds/ddsrt/retcode.h"
@@ -108,4 +110,6 @@ volatile_secure_data_filter(
 }
 #endif
 
+#endif
+
 #endif /* DDSI_SECURITY_MSG_H */
diff --git a/src/core/ddsi/include/dds/ddsi/ddsi_security_omg.h b/src/core/ddsi/include/dds/ddsi/ddsi_security_omg.h
index 316954d..7ad3425 100644
--- a/src/core/ddsi/include/dds/ddsi/ddsi_security_omg.h
+++ b/src/core/ddsi/include/dds/ddsi/ddsi_security_omg.h
@@ -57,6 +57,17 @@ bool q_omg_security_enabled(void);
  */
 bool q_omg_participant_is_secure(const struct participant *pp);
 
+/**
+ * @brief Check if security is enabled for the proxy participant.
+ *
+ * @param[in] proxypp  Proxy participant to check if it is secure.
+ *
+ * @returns bool
+ * @retval true   Proxy participant is secure
+ * @retval false  Proxy participant is not secure
+ */
+bool q_omg_proxy_participant_is_secure(const struct proxy_participant *proxypp);
+
 /**
  * @brief Get the security handle of the given local participant.
  *
@@ -490,6 +501,195 @@ secure_conn_write(
     nn_msg_sec_info_t *sec_info,
     ddsi_tran_write_fn_t conn_write_cb);
 
+/**
+ * @brief Check if the participant and the proxy participant
+ *        have compatible security info settings.
+ *
+ * Associated with a secure participant is the ParticipantSecurityInfo parameter.
+ * This parameter contains the setting of the security attributes and the associated
+ * plugin security attributes of the secure participant.
+ * This function will check if the received ParticipantSecurityInfo parameter is
+ * compatible with the local ParticipantSecurityInfo parameter.
+ *
+ * @param[in] pp      The participant.
+ * @param[in] proxypp The proxy participant.
+ *
+ * @returns bool
+ * @retval true   The participant and the proxy participant have compatible
+ *                security info settings.
+ * @retval false  Otherwise.
+ */
+bool q_omg_is_similar_participant_security_info(struct participant *pp, struct proxy_participant *proxypp);
+
+/**
+ * @brief Check if the participant allows communication with unauthenticated
+ *        participants
+ *
+ * @param[in] pp  The participant.
+ *
+ * @returns bool
+ * @retval true   The participant allows unauthenticated communication
+ * @retval false  Otherwise.
+ */
+bool q_omg_participant_allow_unauthenticated(struct participant *pp);
+
+/**
+ * @brief Register participant with security plugin and check if the
+ *        participant is allowed by security.
+ *
+ * This function will register the participant with the authentication
+ * plugin which will check if the provided security QoS parameters are
+ * correct, e.g. is the provided certificate valid, etc.
+ * When that is successful it is checked with access control if the
+ * participant has the correct permissions and is allowed to be created.
+ *
+ * @param[in] pp        The participant.
+ * @param[in] domain_id The domain id.
+ *
+ * @returns bool
+ * @retval true   The security check on the participant succeeded.
+ * @retval false  The security check on the participant failed.
+ */
+bool q_omg_security_check_create_participant(struct participant *pp, uint32_t domain_id);
+
+/**
+ * @brief Initialize the proxy participant security attributes
+ *
+ * @param[in] proxypp  The proxy participant.
+ *
+ */
+void q_omg_security_init_remote_participant(struct proxy_participant *proxypp);
+
+/**
+ * @brief Check the if the proxy participant is allowed by checking the security permissions.
+ *
+ * The access control plugin is ask to verify if the proxy participant is allowed to
+ * communicate with the local participant. When the proxy participant is allowed the
+ * function will return a valid permission handle which is provided by the access control plugin.
+ *
+ * @param[in] domain_id The domain id
+ * @param[in] pp        The participant
+ * @param[in] proxypp   The proxy participant
+ *
+ * @returns permission handle
+ * @retval !0    The proxy participant is allowed
+ * @retval 0     The proxy participant is not allowed.
+ */
+int64_t q_omg_security_check_remote_participant_permissions(uint32_t domain_id, struct participant *pp, struct proxy_participant *proxypp);
+
+/**
+ * @brief Registers the matched proxy participant with the crypto plugin
+ *
+ * When the proxy participant is authenticated and allowed by access control then the match between the local and
+ * the remote participant must be registered with the cypto factory provided by the crypto plugin. The
+ * shared secret handle obtained from the authentication phase and the permission handle returned when validating
+ * the proxy participant with access control plugin have to be provided.
+ *
+ *
+ * @param[in] pp                 The participant.
+ * @param[in] proxypp            The proxy participant.
+ * @param[in] shared_secret      The shared_secret handle.
+ * @param[in] proxy_permissions  The permission handle associated with the proxy participant.
+ */
+void q_omg_security_register_remote_participant(struct participant *pp, struct proxy_participant *proxypp, int64_t shared_secret, int64_t proxy_permissions);
+
+/**
+ * @brief Removes a registered proxy participant from administation of the authentication,
+ *        access control and crypto plugins.
+ *
+ * @param[in] proxypp            The proxy participant.
+ */
+void q_omg_security_deregister_remote_participant(struct proxy_participant *proxypp);
+
+/**
+ * @brief Generate and send the crypto tokens needed for encoding RTPS messages.
+ *
+ * When the security settings indicate that RTPS message encoding or signing is
+ * configured for the participant then this function will ask the cypto echange for
+ * the corresponding cypto tokens and send these to the proxy participant.
+ *
+ * @param[in] pp                 The participant.
+ * @param[in] proxypp            The proxy participant.
+ */
+void q_omg_security_participant_send_tokens(struct participant *pp, struct proxy_participant *proxypp);
+
+/**
+ * @brief Check if the remote writer is allowed to communicate with endpoints of the
+ *        local participant.
+ *
+ * This function will check with the access control plugin if the remote writer
+ * is allowed to communicate with this participant.
+ *
+ * @param[in] pwr       The remote writer.
+ * @param[in] domain_id The domain id.
+ * @param[in] pp        The local participant.
+ *
+ * @returns bool
+ * @retval true   The remote writer is allowed to communicate.
+ * @retval false  Otherwise.
+ */
+bool q_omg_security_check_remote_writer_permissions(const struct proxy_writer *pwr, uint32_t domain_id, struct participant *pp);
+
+/**
+ * @brief Check if the remote reader is allowed to communicate with endpoints of the
+ *        local participant.
+ *
+ * This function will check with the access control plugin if the remote reader
+ * is allowed to communicate with this participant.
+ *
+ * @param[in] prd       The remote reader.
+ * @param[in] domain_id The domain id.
+ * @param[in] pp        The local participant.
+ *
+ * @returns bool
+ * @retval true   The remote reader is allowed to communicate.
+ * @retval false  Otherwise.
+ */
+bool q_omg_security_check_remote_reader_permissions(const struct proxy_reader *prd, uint32_t domain_id, struct participant *pp);
+
+/**
+ * @brief Check it the remote writer is allowed to communicate with the local reader.
+ *
+ * When a remote writer is allowed by access control it has to be checked if the remote
+ * writer is allowed to communicate with a particular local reader. This function will
+ * check if the provided security end-point attributes are compatible, When the security
+ * attributes are compatible then the function will register the reader and remote writer
+ * match with the crypto factory and will also ask the crypto exchange to generate the
+ * crypto tokens associate with the local reader which will be sent to the remote entity.
+ * Note that the reader crypto tokens are used to encrypt the reader specific submessages
+ * when submessage encoding or signing is configured.
+ *
+ * @param[in] rd   The local reader.
+ * @param[in] pwr  The remote writer.
+ *
+ * @returns bool
+ * @retval true   The local reader and remote writer are allowed to communicate.
+ * @retval false  Otherwise.
+ */
+bool q_omg_security_match_remote_writer_enabled(struct reader *rd, struct proxy_writer *pwr);
+
+/**
+ * @brief Check it the local writer is allowed to communicate with the remote reader.
+ *
+ * When a remote reader is allowed by access control it has to be checked if the local
+ * writer is allowed to communicate with a particular local writer. This function will
+ * check if the provided security end-point attributes are compatible, When the security
+ * attributes are compatible then the function will register the writer and remote reader
+ * match with the crypto factory and will also ask the crypto exchange to generate the
+ * crypto tokens associate with the local writer which will be sent to the remote entity.
+ * Note that the writer crypto tokens are used to encrypt the writer specific submessages
+ * when submessage encoding or signing is configured and also the crypto tokens used
+ * for encoding the payload of data or datafrag messages.
+ *
+ * @param[in] wr   The local writer.
+ * @param[in] prd  The remote reader.
+ *
+ * @returns bool
+ * @retval true   The local writer and remote reader are allowed to communicate.
+ * @retval false  Otherwise.
+ */
+bool q_omg_security_match_remote_reader_enabled(struct writer *wr, struct proxy_reader *prd);
+
 #else /* DDSI_INCLUDE_SECURITY */
 
 #include "dds/ddsi/q_unused.h"
@@ -507,6 +707,13 @@ q_omg_participant_is_secure(
   return false;
 }
 
+inline bool
+q_omg_proxy_participant_is_secure(
+  UNUSED_ARG(const struct proxy_participant *proxypp))
+{
+  return false;
+}
+
 inline unsigned
 determine_subscription_writer(
   UNUSED_ARG(const struct reader *rd))
@@ -530,6 +737,65 @@ is_proxy_participant_deletion_allowed(
   return true;
 }
 
+inline bool q_omg_is_similar_participant_security_info(UNUSED_ARG(struct participant *pp), UNUSED_ARG(struct proxy_participant *proxypp))
+{
+  return true;
+}
+
+inline bool q_omg_participant_allow_unauthenticated(UNUSED_ARG(struct participant *pp))
+{
+  return true;
+}
+
+inline bool
+q_omg_security_check_create_participant(UNUSED_ARG(struct participant *pp), UNUSED_ARG(uint32_t domain_id))
+{
+  return true;
+}
+
+inline void q_omg_security_init_remote_participant(UNUSED_ARG(struct proxy_participant *proxypp))
+{
+}
+
+inline int64_t q_omg_security_check_remote_participant_permissions(UNUSED_ARG(uint32_t domain_id), UNUSED_ARG(struct participant *pp), UNUSED_ARG(struct proxy_participant *proxypp))
+{
+  return 0LL;
+}
+
+inline void q_omg_security_register_remote_participant(UNUSED_ARG(struct participant *pp), UNUSED_ARG(struct proxy_participant *proxypp), UNUSED_ARG(int64_t shared_secret), UNUSED_ARG(int64_t proxy_permissions))
+{
+}
+
+inline void q_omg_security_deregister_remote_participant(UNUSED_ARG(struct proxy_participant *proxypp))
+{
+}
+
+inline void q_omg_security_participant_send_tokens(UNUSED_ARG(struct participant *pp), UNUSED_ARG(struct proxy_participant *proxypp))
+{
+}
+
+inline bool q_omg_security_match_remote_writer_enabled(UNUSED_ARG(struct reader *rd), UNUSED_ARG(struct proxy_writer *pwr))
+{
+  return true;
+}
+
+inline bool q_omg_security_match_remote_reader_enabled(UNUSED_ARG(struct writer *wr), UNUSED_ARG(struct proxy_reader *prd))
+{
+  return true;
+}
+
+inline bool
+q_omg_security_check_remote_writer_permissions(UNUSED_ARG(const struct proxy_writer *pwr), UNUSED_ARG(uint32_t domain_id), UNUSED_ARG(struct participant *pp))
+{
+  return true;
+}
+
+inline bool
+q_omg_security_check_remote_reader_permissions(UNUSED_ARG(const struct proxy_reader *prd), UNUSED_ARG(uint32_t domain_id), UNUSED_ARG(struct participant *pp))
+{
+  return true;
+}
+
 inline void
 set_proxy_participant_security_info(
   UNUSED_ARG(struct proxy_participant *prd),
@@ -551,7 +817,6 @@ set_proxy_writer_security_info(
 {
 }
 
-
 inline bool
 decode_Data(
   UNUSED_ARG(const struct q_globals *gv),
diff --git a/src/core/ddsi/include/dds/ddsi/q_entity.h b/src/core/ddsi/include/dds/ddsi/q_entity.h
index 66c6ca1..2e3eba4 100644
--- a/src/core/ddsi/include/dds/ddsi/q_entity.h
+++ b/src/core/ddsi/include/dds/ddsi/q_entity.h
@@ -20,11 +20,13 @@
 #include "dds/ddsi/q_rtps.h"
 #include "dds/ddsi/q_plist.h"
 #include "dds/ddsi/q_protocol.h"
+#include "dds/ddsi/q_plist.h"
 #include "dds/ddsi/q_lat_estim.h"
 #include "dds/ddsi/q_hbcontrol.h"
 #include "dds/ddsi/q_feature_check.h"
 #include "dds/ddsi/q_inverse_uint32_set.h"
 #include "dds/ddsi/ddsi_serdata_default.h"
+#include "dds/ddsi/ddsi_handshake.h"
 
 #include "dds/ddsi/ddsi_tran.h"
 
@@ -214,6 +216,11 @@ struct participant
   int32_t builtin_refc; /* number of built-in endpoints in this participant [refc_lock] */
   int builtins_deleted; /* whether deletion of built-in endpoints has been initiated [refc_lock] */
   ddsrt_fibheap_t ldur_auto_wr; /* Heap that contains lease duration for writers with automatic liveliness in this participant */
+#ifdef DDSI_INCLUDE_SECURITY
+  int64_t local_identity_handle;   /* OMG DDS Security related member */
+  int64_t permissions_handle; /* OMG DDS Security related member */
+  struct participant_sec_attributes *sec_attr;
+#endif
 };
 
 struct endpoint_common {
@@ -356,7 +363,9 @@ struct proxy_participant
   unsigned proxypp_have_cm: 1;
   unsigned owns_lease: 1;
 #ifdef DDSI_INCLUDE_SECURITY
+  int64_t remote_identity_handle;   /* OMG DDS Security related member */
   nn_security_info_t security_info;
+  struct proxy_participant_sec_attributes *sec_attr;
 #endif
 };
 
@@ -712,6 +721,10 @@ void rebuild_or_clear_writer_addrsets(struct q_globals *gv, int rebuild);
 
 void local_reader_ary_setfastpath_ok (struct local_reader_ary *x, bool fastpath_ok);
 
+void connect_writer_with_proxy_reader_secure(struct writer *wr, struct proxy_reader *prd, nn_mtime_t tnow);
+void connect_reader_with_proxy_writer_secure(struct reader *rd, struct proxy_writer *pwr, nn_mtime_t tnow);
+
+
 struct ddsi_writer_info;
 DDS_EXPORT void ddsi_make_writer_info(struct ddsi_writer_info *wrinfo, const struct entity_common *e, const struct dds_qos *xqos, uint32_t statusinfo);
 
diff --git a/src/core/ddsi/src/ddsi_entity_index.c b/src/core/ddsi/src/ddsi_entity_index.c
index c7b09b9..b22488b 100644
--- a/src/core/ddsi/src/ddsi_entity_index.c
+++ b/src/core/ddsi/src/ddsi_entity_index.c
@@ -439,6 +439,18 @@ void entidx_enum_init_topic (struct entidx_enum *st, const struct entity_index *
     st->cur = NULL;
 }
 
+void entidx_enum_init_topic_w_prefix (struct entidx_enum *st, const struct entity_index *ei, enum entity_kind kind, const char *topic, const ddsi_guid_prefix_t *prefix, struct match_entities_range_key *max)
+{
+  assert (kind == EK_READER || kind == EK_WRITER || kind == EK_PROXY_READER || kind == EK_PROXY_WRITER);
+  struct match_entities_range_key min;
+  match_endpoint_range (kind, topic, &min, max);
+  min.entity.e.guid.prefix = *prefix;
+  max->entity.e.guid.prefix = *prefix;
+  entidx_enum_init_minmax_int (st, ei, &min);
+  if (st->cur && all_entities_compare (st->cur, &max->entity) > 0)
+    st->cur = NULL;
+}
+
 void entidx_enum_init (struct entidx_enum *st, const struct entity_index *ei, enum entity_kind kind)
 {
   struct match_entities_range_key min;
diff --git a/src/core/ddsi/src/ddsi_handshake.c b/src/core/ddsi/src/ddsi_handshake.c
new file mode 100644
index 0000000..13d8390
--- /dev/null
+++ b/src/core/ddsi/src/ddsi_handshake.c
@@ -0,0 +1,109 @@
+/*
+ * Copyright(c) 2006 to 2018 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+
+#include "dds/ddsi/ddsi_handshake.h"
+
+#ifdef DDSI_INCLUDE_SECURITY
+
+#include "dds/security/dds_security_api.h"
+#include "dds/ddsrt/hopscotch.h"
+
+struct ddsi_handshake
+{
+  enum ddsi_handshake_state state;
+
+  ddsi_guid_t local_pguid;  /* the guid of the local participant */
+  ddsi_guid_t remote_pguid; /* the guid of the remote participant */
+  ddsi_handshake_end_cb_t end_cb;
+  struct q_globals *gv;
+  ddsrt_mutex_t lock;
+  ddsrt_cond_t cv;
+
+  ddsrt_atomic_uint32_t refc;
+
+  DDS_Security_IdentityHandle local_identity_handle;
+  DDS_Security_IdentityHandle remote_identity_handle;
+  DDS_Security_HandshakeHandle handshake_handle;
+
+  DDS_Security_HandshakeMessageToken handshake_message_in_token;
+  nn_message_identity_t handshake_message_in_id;
+  DDS_Security_HandshakeMessageToken *handshake_message_out;
+  DDS_Security_AuthRequestMessageToken local_auth_request_token;
+  DDS_Security_AuthRequestMessageToken *remote_auth_request_token;
+  DDS_Security_OctetSeq pdata;
+  DDS_Security_SharedSecretHandle shared_secret;
+  int handled_handshake_message;
+};
+
+
+void ddsi_handshake_handle_message(struct ddsi_handshake *handshake, const struct participant *pp, const struct proxy_participant *proxypp, const struct nn_participant_generic_message *msg)
+{
+  DDSRT_UNUSED_ARG(handshake);
+  DDSRT_UNUSED_ARG(pp);
+  DDSRT_UNUSED_ARG(proxypp);
+  DDSRT_UNUSED_ARG(msg);
+}
+
+void ddsi_handshake_crypto_tokens_received(struct ddsi_handshake *handshake)
+{
+  DDSRT_UNUSED_ARG(handshake);
+}
+
+int64_t ddsi_handshake_get_shared_secret(const struct ddsi_handshake *handshake)
+{
+  DDSRT_UNUSED_ARG(handshake);
+
+  return 0;
+}
+
+int64_t ddsi_handshake_get_handle(const struct ddsi_handshake *handshake)
+{
+  DDSRT_UNUSED_ARG(handshake);
+
+  return 0;
+}
+
+void ddsi_handshake_register(const struct participant *pp, const struct proxy_participant *proxypp, ddsi_handshake_end_cb_t callback)
+{
+  DDSRT_UNUSED_ARG(pp);
+  DDSRT_UNUSED_ARG(proxypp);
+  DDSRT_UNUSED_ARG(callback);
+}
+
+void ddsi_handshake_remove(const struct participant *pp, const struct proxy_participant *proxypp, struct ddsi_handshake *handshake)
+{
+  DDSRT_UNUSED_ARG(pp);
+  DDSRT_UNUSED_ARG(proxypp);
+  DDSRT_UNUSED_ARG(handshake);
+}
+
+struct ddsi_handshake * ddsi_handshake_find(const struct participant *pp, const struct proxy_participant *proxypp)
+{
+  DDSRT_UNUSED_ARG(pp);
+  DDSRT_UNUSED_ARG(proxypp);
+
+  return NULL;
+}
+
+
+#else
+
+extern inline void ddsi_handshake_release(UNUSED_ARG(struct ddsi_handshake *handshake));
+extern inline void ddsi_handshake_crypto_tokens_received(UNUSED_ARG(struct ddsi_handshake *handshake));
+extern inline int64_t ddsi_handshake_get_shared_secret(UNUSED_ARG(const struct ddsi_handshake *handshake));
+extern inline int64_t ddsi_handshake_get_handle(UNUSED_ARG(const struct ddsi_handshake *handshake));
+extern inline void ddsi_handshake_register(UNUSED_ARG(const struct participant *pp), UNUSED_ARG(const struct proxy_participant *proxypp), UNUSED_ARG(ddsi_handshake_end_cb_t callback));
+extern inline void ddsi_handshake_remove(UNUSED_ARG(const struct participant *pp), UNUSED_ARG(const struct proxy_participant *proxypp), UNUSED_ARG(struct ddsi_handshake *handshake));
+extern inline struct ddsi_handshake * ddsi_handshake_find(UNUSED_ARG(const struct participant *pp), UNUSED_ARG(const struct proxy_participant *proxypp));
+
+
+#endif /* DDSI_INCLUDE_DDS_SECURITY */
diff --git a/src/core/ddsi/src/ddsi_security_omg.c b/src/core/ddsi/src/ddsi_security_omg.c
index 32f3b11..10fca50 100644
--- a/src/core/ddsi/src/ddsi_security_omg.c
+++ b/src/core/ddsi/src/ddsi_security_omg.c
@@ -92,6 +92,15 @@ q_omg_participant_is_secure(
   return false;
 }
 
+bool
+q_omg_proxy_participant_is_secure(
+    const struct proxy_participant *proxypp)
+{
+  /* TODO: Register remote participant */
+  DDSRT_UNUSED_ARG(proxypp);
+  return false;
+}
+
 static bool
 q_omg_writer_is_discovery_protected(
   const struct writer *wr)
@@ -147,6 +156,12 @@ q_omg_get_reader_security_info(
   return false;
 }
 
+void
+q_omg_security_init_remote_participant(struct proxy_participant *proxypp)
+{
+  DDSRT_UNUSED_ARG(proxypp);
+}
+
 static bool
 q_omg_proxyparticipant_is_authenticated(
   const struct proxy_participant *proxy_pp)
@@ -174,6 +189,14 @@ q_omg_security_get_remote_participant_handle(
   return 0;
 }
 
+bool
+q_omg_participant_allow_unauthenticated(struct participant *pp)
+{
+  DDSRT_UNUSED_ARG(pp);
+
+  return true;
+}
+
 unsigned
 determine_subscription_writer(
   const struct reader *rd)
@@ -196,6 +219,21 @@ determine_publication_writer(
   return NN_ENTITYID_SEDP_BUILTIN_PUBLICATIONS_WRITER;
 }
 
+void
+q_omg_security_register_remote_participant(struct participant *pp, struct proxy_participant *proxypp, int64_t shared_secret, int64_t proxy_permissions)
+{
+  DDSRT_UNUSED_ARG(pp);
+  DDSRT_UNUSED_ARG(proxypp);
+  DDSRT_UNUSED_ARG(shared_secret);
+  DDSRT_UNUSED_ARG(proxy_permissions);
+}
+
+void
+q_omg_security_deregister_remote_participant(struct proxy_participant *proxypp)
+{
+  DDSRT_UNUSED_ARG(proxypp);
+}
+
 bool
 is_proxy_participant_deletion_allowed(
   struct q_globals * const gv,
@@ -225,6 +263,93 @@ is_proxy_participant_deletion_allowed(
   return (!q_omg_proxyparticipant_is_authenticated(proxypp));
 }
 
+/* ask to access control security plugin for the remote participant permissions */
+int64_t
+q_omg_security_check_remote_participant_permissions(uint32_t domain_id, struct participant *pp, struct proxy_participant *proxypp)
+{
+  DDSRT_UNUSED_ARG(domain_id);
+  DDSRT_UNUSED_ARG(pp);
+  DDSRT_UNUSED_ARG(proxypp);
+
+  return 0;
+}
+
+bool
+q_omg_is_similar_participant_security_info(struct participant *pp, struct proxy_participant *proxypp)
+{
+  DDSRT_UNUSED_ARG(pp);
+  DDSRT_UNUSED_ARG(proxypp);
+
+  return true;
+}
+
+bool
+q_omg_security_check_create_participant(struct participant *pp, uint32_t domain_id)
+{
+  DDSRT_UNUSED_ARG(pp);
+  DDSRT_UNUSED_ARG(domain_id);
+  return true;
+}
+
+void
+q_omg_security_participant_send_tokens(struct participant *pp, struct proxy_participant *proxypp)
+{
+  DDSRT_UNUSED_ARG(pp);
+  DDSRT_UNUSED_ARG(proxypp);
+}
+
+bool
+q_omg_security_match_remote_writer_enabled(struct reader *rd, struct proxy_writer *pwr)
+{
+  DDSRT_UNUSED_ARG(rd);
+  DDSRT_UNUSED_ARG(pwr);
+
+  assert(rd);
+  assert(pwr);
+
+  return true;
+}
+
+bool
+q_omg_security_match_remote_reader_enabled(struct writer *wr, struct proxy_reader *prd)
+{
+  DDSRT_UNUSED_ARG(wr);
+  DDSRT_UNUSED_ARG(prd);
+
+  assert(wr);
+  assert(prd);
+
+  return true;
+}
+
+bool
+q_omg_security_check_remote_writer_permissions(const struct proxy_writer *pwr, uint32_t domain_id, struct participant *pp)
+{
+  DDSRT_UNUSED_ARG(pwr);
+  DDSRT_UNUSED_ARG(domain_id);
+  DDSRT_UNUSED_ARG(pp);
+
+  assert(pwr);
+  assert(pp);
+  assert(pwr->c.proxypp);
+
+  return true;
+}
+
+bool
+q_omg_security_check_remote_reader_permissions(const struct proxy_reader *prd, uint32_t domain_id, struct participant *pp)
+{
+  DDSRT_UNUSED_ARG(prd);
+  DDSRT_UNUSED_ARG(domain_id);
+  DDSRT_UNUSED_ARG(pp);
+
+  assert(prd);
+  assert(pp);
+  assert(prd->c.proxypp);
+
+  return true;
+}
+
 bool
 q_omg_security_is_remote_rtps_protected(
   struct proxy_participant *proxy_pp,
@@ -792,7 +917,7 @@ validate_msg_decoding(
    * that is expected. */
   if (q_omg_security_is_remote_rtps_protected(proxypp, e->guid.entityid) && !rst->rtps_encoded)
   {
-    return 0;
+    return false;
   }
 
   return true;
@@ -1182,6 +1307,9 @@ secure_conn_write(
 
 #include "dds/ddsi/ddsi_security_omg.h"
 
+
+extern inline bool q_omg_participant_is_secure(UNUSED_ARG(const struct participant *pp));
+extern inline bool q_omg_proxy_participant_is_secure(const struct proxy_participant *proxypp);
 extern inline bool q_omg_security_enabled(void);
 
 extern inline bool q_omg_participant_is_secure(
@@ -1190,6 +1318,12 @@ extern inline bool q_omg_participant_is_secure(
 extern inline unsigned determine_subscription_writer(
   UNUSED_ARG(const struct reader *rd));
 
+extern inline bool q_omg_security_match_remote_writer_enabled(UNUSED_ARG(struct reader *rd), UNUSED_ARG(struct proxy_writer *pwr));
+extern inline bool q_omg_security_match_remote_reader_enabled(UNUSED_ARG(struct writer *wr), UNUSED_ARG(struct proxy_reader *prd));
+
+extern inline bool q_omg_security_check_remote_writer_permissions(UNUSED_ARG(const struct proxy_writer *pwr), UNUSED_ARG(uint32_t domain_id), UNUSED_ARG(struct participant *pp));
+extern inline bool q_omg_security_check_remote_reader_permissions(UNUSED_ARG(const struct proxy_reader *prd), UNUSED_ARG(uint32_t domain_id), UNUSED_ARG(struct participant *par));
+
 extern inline unsigned determine_publication_writer(
   UNUSED_ARG(const struct writer *wr));
 
@@ -1198,6 +1332,24 @@ extern inline bool is_proxy_participant_deletion_allowed(
   UNUSED_ARG(const struct ddsi_guid *guid),
   UNUSED_ARG(const ddsi_entityid_t pwr_entityid));
 
+extern inline bool q_omg_is_similar_participant_security_info(UNUSED_ARG(struct participant *pp), UNUSED_ARG(struct proxy_participant *proxypp));
+
+extern inline bool q_omg_participant_allow_unauthenticated(UNUSED_ARG(struct participant *pp));
+
+extern inline bool q_omg_security_check_create_participant(UNUSED_ARG(struct participant *pp), UNUSED_ARG(uint32_t domain_id));
+
+/* initialize the proxy participant security attributes */
+extern inline void q_omg_security_init_remote_participant(UNUSED_ARG(struct proxy_participant *proxypp));
+
+/* ask to access control security plugin for the remote participant permissions */
+extern inline int64_t q_omg_security_check_remote_participant_permissions(UNUSED_ARG(uint32_t domain_id), UNUSED_ARG(struct participant *pp), UNUSED_ARG(struct proxy_participant *proxypp));
+
+extern inline void q_omg_security_register_remote_participant(UNUSED_ARG(struct participant *pp), UNUSED_ARG(struct proxy_participant *proxypp), UNUSED_ARG(int64_t shared_secret), UNUSED_ARG(int64_t proxy_permissions));
+
+extern inline void q_omg_security_deregister_remote_participant(UNUSED_ARG(struct proxy_participant *proxypp));
+
+extern inline void q_omg_security_participant_send_tokens(UNUSED_ARG(struct participant *pp), UNUSED_ARG(struct proxy_participant *proxypp));
+
 extern inline void set_proxy_participant_security_info(
   UNUSED_ARG(struct proxy_participant *prd),
   UNUSED_ARG(const nn_plist_t *plist));
diff --git a/src/core/ddsi/src/q_entity.c b/src/core/ddsi/src/q_entity.c
index d0b246f..6a126c7 100644
--- a/src/core/ddsi/src/q_entity.c
+++ b/src/core/ddsi/src/q_entity.c
@@ -105,10 +105,19 @@ static const unsigned prismtech_builtin_writers_besmask =
   NN_DISC_BUILTIN_ENDPOINT_CM_PUBLISHER_WRITER |
   NN_DISC_BUILTIN_ENDPOINT_CM_SUBSCRIBER_WRITER;
 
+
 static dds_return_t new_writer_guid (struct writer **wr_out, const struct ddsi_guid *guid, const struct ddsi_guid *group_guid, struct participant *pp, const struct ddsi_sertopic *topic, const struct dds_qos *xqos, struct whc *whc, status_cb_t status_cb, void *status_cbarg);
 static dds_return_t new_reader_guid (struct reader **rd_out, const struct ddsi_guid *guid, const struct ddsi_guid *group_guid, struct participant *pp, const struct ddsi_sertopic *topic, const struct dds_qos *xqos, struct ddsi_rhc *rhc, status_cb_t status_cb, void *status_cbarg);
 static struct participant *ref_participant (struct participant *pp, const struct ddsi_guid *guid_of_refing_entity);
 static void unref_participant (struct participant *pp, const struct ddsi_guid *guid_of_refing_entity);
+static struct entity_common *entity_common_from_proxy_endpoint_common (const struct proxy_endpoint_common *c);
+
+#ifdef DDSI_INCLUDE_SECURITY
+static const unsigned BES_MASK_NON_SECURITY = 0xf000ffff;
+
+static void handshake_end_cb(struct q_globals const * const gv, struct ddsi_handshake *handshake, const struct ddsi_guid *lpguid, const struct ddsi_guid *ppguid, enum ddsi_handshake_state result);
+static void downgrade_to_nonsecure(struct proxy_participant *proxypp);
+#endif
 
 static int gcreq_participant (struct participant *pp);
 static int gcreq_writer (struct writer *wr);
@@ -201,6 +210,22 @@ int is_builtin_endpoint (ddsi_entityid_t id, nn_vendorid_t vendorid)
   return is_builtin_entityid (id, vendorid) && id.u != NN_ENTITYID_PARTICIPANT;
 }
 
+#ifdef DDSI_INCLUDE_SECURITY
+
+static int is_builtin_volatile_endpoint (ddsi_entityid_t id)
+{
+  switch (id.u) {
+  case NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_VOLATILE_SECURE_WRITER:
+  case NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_VOLATILE_SECURE_READER:
+    return 1;
+  default:
+    break;
+  }
+  return 0;
+}
+
+#endif
+
 bool is_local_orphan_endpoint (const struct entity_common *e)
 {
   return (e->guid.prefix.u[0] == 0 && e->guid.prefix.u[1] == 0 && e->guid.prefix.u[2] == 0 &&
@@ -570,6 +595,47 @@ static void add_security_builtin_endpoints(struct participant *pp, ddsi_guid_t *
 }
 #endif
 
+
+#ifdef DDSI_INCLUDE_SECURITY
+
+static void connect_participant_secure(struct q_globals *gv, struct participant *pp)
+{
+  struct proxy_participant *proxypp;
+  struct entidx_enum_proxy_participant it;
+
+  if (q_omg_participant_is_secure(pp))
+  {
+    entidx_enum_proxy_participant_init (&it, gv->entity_index);
+    while ((proxypp = entidx_enum_proxy_participant_next (&it)) != NULL)
+    {
+      /* Do not start handshaking when security info doesn't match. */
+      if (q_omg_is_similar_participant_security_info(pp, proxypp))
+      {
+        ddsi_handshake_register(pp, proxypp, handshake_end_cb);
+      }
+    }
+    entidx_enum_proxy_participant_fini (&it);
+  }
+}
+
+static void disconnect_participant_secure(struct participant *pp)
+{
+  struct proxy_participant *proxypp;
+  struct entidx_enum_proxy_participant it;
+  struct q_globals * const gv = pp->e.gv;
+
+  if (q_omg_participant_is_secure(pp))
+  {
+    entidx_enum_proxy_participant_init (&it, gv->entity_index);
+    while ((proxypp = entidx_enum_proxy_participant_next (&it)) != NULL)
+    {
+      ddsi_handshake_remove(pp, proxypp, NULL);
+    }
+    entidx_enum_proxy_participant_fini (&it);
+  }
+}
+#endif
+
 dds_return_t new_participant_guid (const ddsi_guid_t *ppguid, struct q_globals *gv, unsigned flags, const nn_plist_t *plist)
 {
   struct participant *pp;
@@ -660,6 +726,16 @@ dds_return_t new_participant_guid (const ddsi_guid_t *ppguid, struct q_globals *
         goto new_pp_err_secprop;
     }
   }
+
+  if (nn_xqos_has_prop (&pp->plist->qos, "dds.sec.", true))
+  {
+    if (!q_omg_security_check_create_participant (pp, gv->config.domainId))
+    {
+      ret = DDS_RETCODE_NOT_ALLOWED_BY_SECURITY;
+      goto not_allowed;
+    }
+  }
+
 #endif
 
   if (gv->logconfig.c.mask & DDS_LC_DISCOVERY)
@@ -856,9 +932,18 @@ dds_return_t new_participant_guid (const ddsi_guid_t *ppguid, struct q_globals *
     tsched.v = (pp->lease_duration == T_NEVER) ? T_NEVER : 0;
     pp->pmd_update_xevent = qxev_pmd_update (gv->xevents, tsched, &pp->e.guid);
   }
+
+#ifdef DDSI_INCLUDE_SECURITY
+  if (q_omg_participant_is_secure(pp))
+  {
+    connect_participant_secure (gv, pp);
+  }
+#endif
+
   return ret;
 
 #ifdef DDSI_INCLUDE_SECURITY
+not_allowed:
 new_pp_err_secprop:
   nn_plist_fini (pp->plist);
   ddsrt_free (pp->plist);
@@ -1099,6 +1184,9 @@ dds_return_t delete_participant (struct q_globals *gv, const struct ddsi_guid *p
     return DDS_RETCODE_BAD_PARAMETER;
   builtintopic_write (gv->builtin_topic_interface, &pp->e, now(), false);
   remember_deleted_participant_guid (gv->deleted_participants, &pp->e.guid);
+#ifdef DDSI_INCLUDE_SECURITY
+  disconnect_participant_secure (pp);
+#endif
   entidx_remove_participant_guid (gv->entity_index, pp);
   gcreq_participant (pp);
   return 0;
@@ -2449,6 +2537,31 @@ static bool topickind_qos_match_p_lock (struct entity_common *rd, const dds_qos_
   return ret;
 }
 
+void connect_writer_with_proxy_reader_secure(struct writer *wr, struct proxy_reader *prd, nn_mtime_t tnow)
+{
+  DDSRT_UNUSED_ARG(tnow);
+  proxy_reader_add_connection (prd, wr);
+  writer_add_connection (wr, prd);
+}
+
+void connect_reader_with_proxy_writer_secure(struct reader *rd, struct proxy_writer *pwr, nn_mtime_t tnow)
+{
+  nn_count_t init_count;
+  struct proxy_writer_alive_state alive_state;
+
+  /* Initialize the reader's tracking information for the writer liveliness state to something
+     sensible, but that may be outdated by the time the reader gets added to the writer's list
+     of matching readers. */
+  proxy_writer_get_alive_state (pwr, &alive_state);
+  reader_add_connection (rd, pwr, &init_count,  &alive_state);
+  proxy_writer_add_connection (pwr, rd, tnow, init_count);
+
+  /* Once everything is set up: update with the latest state, any updates to the alive state
+     happening in parallel will cause this to become a no-op. */
+  proxy_writer_get_alive_state (pwr, &alive_state);
+  reader_update_notify_pwr_alive_state (rd, pwr, &alive_state);
+}
+
 static void connect_writer_with_proxy_reader (struct writer *wr, struct proxy_reader *prd, nn_mtime_t tnow)
 {
   const int isb0 = (is_builtin_entityid (wr->e.guid.entityid, NN_VENDORID_ECLIPSE) != 0);
@@ -2464,8 +2577,22 @@ static void connect_writer_with_proxy_reader (struct writer *wr, struct proxy_re
     writer_qos_mismatch (wr, reason);
     return;
   }
-  proxy_reader_add_connection (prd, wr);
-  writer_add_connection (wr, prd);
+
+  if (!q_omg_security_check_remote_reader_permissions (prd, wr->e.gv->config.domainId, wr->c.pp))
+  {
+    EELOGDISC (&wr->e, "connect_writer_with_proxy_reader (wr "PGUIDFMT") with (prd "PGUIDFMT") not allowed by security\n",
+                   PGUID (wr->e.guid), PGUID (prd->e.guid));
+  }
+  else if (!q_omg_security_match_remote_reader_enabled (wr, prd))
+  {
+    EELOGDISC (&wr->e, "connect_writer_with_proxy_reader (wr "PGUIDFMT") with (prd "PGUIDFMT") waiting for approval by security\n",
+                     PGUID (wr->e.guid), PGUID (prd->e.guid));
+  }
+  else
+  {
+    proxy_reader_add_connection (prd, wr);
+    writer_add_connection (wr, prd);
+  }
 }
 
 static void connect_proxy_writer_with_reader (struct proxy_writer *pwr, struct reader *rd, nn_mtime_t tnow)
@@ -2485,17 +2612,30 @@ static void connect_proxy_writer_with_reader (struct proxy_writer *pwr, struct r
     return;
   }
 
-  /* Initialze the reader's tracking information for the writer liveliness state to something
-     sensible, but that may be outdated by the time the reader gets added to the writer's list
-     of matching readers. */
-  proxy_writer_get_alive_state (pwr, &alive_state);
-  reader_add_connection (rd, pwr, &init_count, &alive_state);
-  proxy_writer_add_connection (pwr, rd, tnow, init_count);
+  if (!q_omg_security_check_remote_writer_permissions(pwr, rd->e.gv->config.domainId, rd->c.pp))
+  {
+    EELOGDISC (&rd->e, "connect_proxy_writer_with_reader (pwr "PGUIDFMT") with (rd "PGUIDFMT") not allowed by security\n",
+        PGUID (pwr->e.guid), PGUID (rd->e.guid));
+  }
+  else if (!q_omg_security_match_remote_writer_enabled(rd, pwr))
+  {
+    EELOGDISC (&rd->e, "connect_proxy_writer_with_reader (pwr "PGUIDFMT") with  (rd "PGUIDFMT") waiting for approval by security\n",
+        PGUID (pwr->e.guid), PGUID (rd->e.guid));
+  }
+  else
+  {
+    /* Initialize the reader's tracking information for the writer liveliness state to something
+       sensible, but that may be outdated by the time the reader gets added to the writer's list
+       of matching readers. */
+    proxy_writer_get_alive_state (pwr, &alive_state);
+    reader_add_connection (rd, pwr, &init_count, &alive_state);
+    proxy_writer_add_connection (pwr, rd, tnow, init_count);
 
-  /* Once everything is set up: update with the latest state, any updates to the alive state
-     happening in parallel will cause this to become a no-op. */
-  proxy_writer_get_alive_state (pwr, &alive_state);
-  reader_update_notify_pwr_alive_state (rd, pwr, &alive_state);
+    /* Once everything is set up: update with the latest state, any updates to the alive state
+       happening in parallel will cause this to become a no-op. */
+    proxy_writer_get_alive_state (pwr, &alive_state);
+    reader_update_notify_pwr_alive_state (rd, pwr, &alive_state);
+  }
 }
 
 static bool ignore_local_p (const ddsi_guid_t *guid1, const ddsi_guid_t *guid2, const struct dds_qos *xqos1, const struct dds_qos *xqos2)
@@ -2733,6 +2873,126 @@ static void match_proxy_reader_with_writers (struct proxy_reader *prd, nn_mtime_
   generic_do_match(&prd->e, tnow, false);
 }
 
+#ifdef DDSI_INCLUDE_SECURITY
+
+static void match_volatile_secure_endpoints (struct participant *pp, struct proxy_participant *proxypp)
+{
+  struct reader *rd;
+  struct writer *wr;
+  struct proxy_reader *prd;
+  struct proxy_writer *pwr;
+  ddsi_guid_t guid;
+  nn_mtime_t tnow = now_mt ();
+
+  EELOGDISC (&pp->e, "match volatile endpoints (pp "PGUIDFMT") with (proxypp "PGUIDFMT")\n",
+             PGUID(pp->e.guid), PGUID(proxypp->e.guid));
+
+  guid = pp->e.guid;
+  guid.entityid.u = NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_VOLATILE_SECURE_READER;
+  rd = entidx_lookup_reader_guid (pp->e.gv->entity_index, &guid);
+  assert(rd);
+  guid.entityid.u = NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_VOLATILE_SECURE_WRITER;
+  wr = entidx_lookup_writer_guid (pp->e.gv->entity_index, &guid);
+  assert(wr);
+
+  guid = proxypp->e.guid;
+  guid.entityid.u = NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_VOLATILE_SECURE_READER;
+  prd = entidx_lookup_proxy_reader_guid (pp->e.gv->entity_index, &guid);
+  assert(rd);
+  guid.entityid.u = NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_VOLATILE_SECURE_WRITER;
+  pwr = entidx_lookup_proxy_writer_guid (pp->e.gv->entity_index, &guid);
+  assert(wr);
+
+  connect_proxy_writer_with_reader_wrapper(&pwr->e, &rd->e, tnow);
+  connect_writer_with_proxy_reader_wrapper(&wr->e, &prd->e, tnow);
+}
+
+static struct entity_common * get_entity_parent(struct entity_common *e)
+{
+  switch (e->kind)
+  {
+  case EK_WRITER:
+     return &((struct writer *)e)->c.pp->e;
+   case EK_READER:
+     return &((struct reader *)e)->c.pp->e;
+   case EK_PROXY_WRITER:
+     return &((struct proxy_writer *)e)->c.proxypp->e;
+   case EK_PROXY_READER:
+     return &((struct proxy_reader *)e)->c.proxypp->e;
+   case EK_PARTICIPANT:
+   case EK_PROXY_PARTICIPANT:
+     return NULL;
+  }
+  return NULL;
+}
+
+static void update_proxy_participant_endpoint_matching (struct proxy_participant *proxypp, struct participant *pp)
+{
+  struct entity_index * const entidx = pp->e.gv->entity_index;
+  struct proxy_endpoint_common *cep;
+  ddsi_guid_t guid;
+  ddsi_entityid_t *endpoint_ids;
+  uint32_t num = 0, i;
+  nn_mtime_t tnow = now_mt ();
+
+  EELOGDISC (&proxypp->e, "update_proxy_participant_endpoint_matching (proxypp "PGUIDFMT" pp "PGUIDFMT")\n",
+             PGUID (proxypp->e.guid), PGUID (pp->e.guid));
+
+  ddsrt_mutex_lock(&proxypp->e.lock);
+  endpoint_ids = ddsrt_malloc(proxypp->refc * sizeof(ddsi_entityid_t));
+  for (cep = proxypp->endpoints; cep != NULL; cep = cep->next_ep)
+  {
+    struct entity_common *e = entity_common_from_proxy_endpoint_common (cep);
+    endpoint_ids[num++] = e->guid.entityid;
+  }
+  ddsrt_mutex_unlock(&proxypp->e.lock);
+
+  guid.prefix = proxypp->e.guid.prefix;
+
+  for (i = 0; i < num; i++)
+  {
+    struct entity_common *e;
+    enum entity_kind mkind;
+
+    guid.entityid = endpoint_ids[i];
+    if ((e = entidx_lookup_guid_untyped(proxypp->e.gv->entity_index, &guid)) == NULL)
+      continue;
+
+    mkind = generic_do_match_mkind (e->kind, false);
+    if (!is_builtin_entityid (e->guid.entityid, NN_VENDORID_ECLIPSE))
+    {
+      struct entidx_enum it;
+      struct entity_common *em;
+      struct match_entities_range_key max;
+      const char *tp = entity_topic_name (e);
+
+      entidx_enum_init_topic_w_prefix (&it, entidx, mkind, tp, &pp->e.guid.prefix, &max);
+      while ((em = entidx_enum_next_max (&it, &max)) != NULL)
+      {
+        if (&pp->e == get_entity_parent(e))
+          generic_do_match_connect (e, em, tnow, false);
+      }
+      entidx_enum_fini (&it);
+    }
+    else
+    {
+      const ddsi_entityid_t tgt_ent = builtin_entityid_match (e->guid.entityid);
+      const ddsi_guid_t tgt_guid = { pp->e.guid.prefix, tgt_ent };
+
+      if (!is_builtin_volatile_endpoint (tgt_ent))
+      {
+        struct entity_common *ep;
+        if ((ep = entidx_lookup_guid (entidx, &tgt_guid, mkind)) != NULL)
+          generic_do_match_connect (e, ep, tnow, false);
+      }
+    }
+  }
+
+  ddsrt_free(endpoint_ids);
+}
+
+#endif
+
 /* ENDPOINT --------------------------------------------------------- */
 
 static void new_reader_writer_common (const struct ddsrt_log_cfg *logcfg, const struct ddsi_guid *guid, const struct ddsi_sertopic *topic, const struct dds_qos *xqos)
@@ -4048,7 +4308,7 @@ static void add_proxy_builtin_endpoints(
 
   /* Register lease for auto liveliness, but be careful not to accidentally re-register
      DDSI2's lease, as we may have become dependent on DDSI2 any time after
-     ephash_insert_proxy_participant_guid even if privileged_pp_guid was NULL originally */
+     entidx_insert_proxy_participant_guid even if privileged_pp_guid was NULL originally */
   ddsrt_mutex_lock (&proxypp->e.lock);
 
   if (proxypp->owns_lease)
@@ -4124,6 +4384,142 @@ static void proxy_participant_remove_pwr_lease_locked (struct proxy_participant
   }
 }
 
+#ifdef DDSI_INCLUDE_SECURITY
+
+void handshake_end_cb
+(
+  struct q_globals const * const gv,
+  struct ddsi_handshake *handshake,
+  const struct ddsi_guid *lpguid,
+  const struct ddsi_guid *ppguid,
+  enum ddsi_handshake_state result)
+{
+  struct proxy_participant *proxypp;
+  struct participant *pp;
+  int64_t shared_secret;
+  int64_t permissions_hdl;
+
+  assert(handshake);
+  assert(lpguid);
+  assert(ppguid);
+
+  assert(gv);
+
+  proxypp = entidx_lookup_proxy_participant_guid (gv->entity_index, ppguid);
+  if (!proxypp)
+    return;
+
+  pp = entidx_lookup_participant_guid (gv->entity_index, lpguid);
+  if (!pp)
+    return;
+
+  switch(result)
+  {
+  case STATE_HANDSHAKE_PROCESSED:
+    shared_secret = ddsi_handshake_get_shared_secret(handshake);
+    DDS_CLOG (DDS_LC_DISCOVERY, &gv->logconfig, "handshake (lguid="PGUIDFMT" rguid="PGUIDFMT") processed\n", PGUID (*lpguid), PGUID (*ppguid));
+    permissions_hdl = q_omg_security_check_remote_participant_permissions(gv->config.domainId, pp, proxypp);
+    if (permissions_hdl != 0) {
+      q_omg_security_register_remote_participant(pp, proxypp, shared_secret, permissions_hdl);
+      match_volatile_secure_endpoints(pp, proxypp);
+    }
+    break;
+
+  case STATE_HANDSHAKE_SEND_TOKENS:
+    DDS_CLOG (DDS_LC_DISCOVERY, &gv->logconfig, "handshake (lguid="PGUIDFMT" rguid="PGUIDFMT") send tokens\n", PGUID (*lpguid), PGUID (*ppguid));
+    q_omg_security_participant_send_tokens(pp, proxypp);
+    break;
+
+  case STATE_HANDSHAKE_OK:
+    DDS_CLOG (DDS_LC_DISCOVERY, &gv->logconfig, "handshake (lguid="PGUIDFMT" rguid="PGUIDFMT") succeeded\n", PGUID (*lpguid), PGUID (*ppguid));
+    update_proxy_participant_endpoint_matching(proxypp, pp);
+    ddsi_handshake_remove(pp, proxypp, handshake);
+    break;
+
+  case STATE_HANDSHAKE_TIMED_OUT:
+    DDS_CERROR (&gv->logconfig, "handshake (lguid="PGUIDFMT" rguid="PGUIDFMT") failed: (%d) Timed out\n", PGUID (*lpguid), PGUID (*ppguid), (int)result);
+    if (q_omg_participant_allow_unauthenticated(pp)) {
+      downgrade_to_nonsecure(proxypp);
+      update_proxy_participant_endpoint_matching(proxypp, pp);
+    }
+    ddsi_handshake_remove(pp, proxypp, handshake);
+    break;
+  case STATE_HANDSHAKE_FAILED:
+    DDS_CERROR (&gv->logconfig, "handshake (lguid="PGUIDFMT" rguid="PGUIDFMT") failed: (%d) Failed\n", PGUID (*lpguid), PGUID (*ppguid), (int)result);
+    if (q_omg_participant_allow_unauthenticated(pp)) {
+      downgrade_to_nonsecure(proxypp);
+      update_proxy_participant_endpoint_matching(proxypp, pp);
+    }
+    ddsi_handshake_remove(pp, proxypp, handshake);
+    break;
+  default:
+    DDS_CERROR (&gv->logconfig, "handshake (lguid="PGUIDFMT" rguid="PGUIDFMT") failed: (%d) Unknown failure\n", PGUID (*lpguid), PGUID (*ppguid), (int)result);
+    ddsi_handshake_remove(pp, proxypp, handshake);
+    break;
+  }
+}
+
+static int proxy_participant_check_security_info(struct q_globals *gv, struct proxy_participant *proxypp)
+{
+  int r = 0;
+  struct participant *pp;
+  struct entidx_enum_participant est;
+
+  entidx_enum_participant_init (&est, gv->entity_index);
+  while (((pp = entidx_enum_participant_next (&est)) != NULL) && (r == 0)) {
+    if (q_omg_is_similar_participant_security_info(pp, proxypp)) {
+      r = 1;
+      break;
+    }
+  }
+  entidx_enum_participant_fini(&est);
+  return r;
+}
+
+
+static void proxy_participant_create_handshakes(struct q_globals *gv, struct proxy_participant *proxypp)
+{
+  struct participant *pp;
+  struct entidx_enum_participant est;
+
+  entidx_enum_participant_init (&est, gv->entity_index);
+  while (((pp = entidx_enum_participant_next (&est)) != NULL)) {
+    if (q_omg_participant_is_secure(pp))
+    {
+      ddsi_handshake_register(pp, proxypp, handshake_end_cb);
+    }
+  }
+  entidx_enum_participant_fini(&est);
+}
+
+#endif
+
+#ifdef DDSI_INCLUDE_SECURITY
+
+static void free_proxy_participant(struct proxy_participant *proxypp)
+{
+  q_omg_security_deregister_remote_participant(proxypp);
+  unref_addrset (proxypp->as_default);
+  unref_addrset (proxypp->as_meta);
+  nn_plist_fini (proxypp->plist);
+  ddsrt_free (proxypp->plist);
+  if (proxypp->owns_lease)
+  {
+    struct lease * minl_auto = ddsrt_atomic_ldvoidp (&proxypp->minl_auto);
+    ddsrt_fibheap_delete (&lease_fhdef_proxypp, &proxypp->leaseheap_auto, proxypp->lease);
+    assert (ddsrt_fibheap_min (&lease_fhdef_proxypp, &proxypp->leaseheap_auto) == NULL);
+    assert (ddsrt_fibheap_min (&lease_fhdef_proxypp, &proxypp->leaseheap_man) == NULL);
+    assert (ddsrt_atomic_ldvoidp (&proxypp->minl_man) == NULL);
+    assert (!compare_guid (&minl_auto->entity->guid, &proxypp->e.guid));
+    lease_unregister (minl_auto);
+    lease_free (minl_auto);
+    lease_free (proxypp->lease);
+  }
+  entity_common_fini (&proxypp->e);
+  ddsrt_free (proxypp);
+}
+#endif
+
 void new_proxy_participant
 (
   struct q_globals *gv,
@@ -4145,6 +4541,9 @@ void new_proxy_participant
      runs on a single thread, it can't go wrong. FIXME, maybe? The
      same holds for the other functions for creating entities. */
   struct proxy_participant *proxypp;
+#ifdef DDSI_INCLUDE_SECURITY
+  bool secure = false;
+#endif
 
   assert (ppguid->entityid.u == NN_ENTITYID_PARTICIPANT);
   assert (entidx_lookup_proxy_participant_guid (gv->entity_index, ppguid) == NULL);
@@ -4229,7 +4628,17 @@ void new_proxy_participant
   nn_xqos_mergein_missing (&proxypp->plist->qos, &gv->default_plist_pp.qos, ~(uint64_t)0);
   ddsrt_avl_init (&proxypp_groups_treedef, &proxypp->groups);
 
+#ifdef DDSI_INCLUDE_SECURITY
+  proxypp->remote_identity_handle = 0;
+  proxypp->sec_attr = NULL;
+  secure = ((bes & NN_DISC_BUILTIN_ENDPOINT_PARTICIPANT_SECURE_ANNOUNCER) != 0);
+  if (!secure)
+  {
+    /* Make sure we don't create any security builtin endpoint when it's considered unsecure. */
+    proxypp->bes &= BES_MASK_NON_SECURITY;
+  }
   set_proxy_participant_security_info(proxypp, plist);
+#endif
 
   if (custom_flags & CF_INC_KERNEL_SEQUENCE_NUMBERS)
     proxypp->kernel_sequence_numbers = 1;
@@ -4253,12 +4662,52 @@ void new_proxy_participant
   else
     proxypp->proxypp_have_cm = 0;
 
-  /* Proxy participant must be in the hash tables for
-     new_proxy_{writer,reader} to work */
-  entidx_insert_proxy_participant_guid (gv->entity_index, proxypp);
+#ifdef DDSI_INCLUDE_SECURITY
+  if (secure)
+  {
+    /* Secure participant detected: start handshake. */
+    if ((plist->present & PP_IDENTITY_TOKEN))
+    {
+      /* initialize the security attributes associated with the proxy participant */
+      q_omg_security_init_remote_participant(proxypp);
 
-  /* TODO: Do security checks on the proxy participant. Either add the endpoints or delete the proxy. */
+      /* check if the proxy participant has a match with a local participant */
+      if (proxy_participant_check_security_info(gv, proxypp))
+      {
+        /* Proxy participant must be in the hash tables for new_proxy_{writer,reader} to work */
+        entidx_insert_proxy_participant_guid (gv->entity_index, proxypp);
+        /* Create builtin endpoints, of which a few are used in the handshake. */
+        add_proxy_builtin_endpoints(gv, ppguid, proxypp, timestamp);
+        /* create authentication handshakes for each local secure participant */
+        proxy_participant_create_handshakes(gv, proxypp);
+      }
+      else
+      {
+        DDS_CWARNING(&gv->logconfig, "Remote secure participant "PGUIDFMT" not allowed\n", PGUID (*ppguid));
+        free_proxy_participant(proxypp);
+      }
+    }
+    else
+    {
+      /* Do not communicate with un-secure participants. */
+      DDS_CWARNING(&gv->logconfig, "Don't communicate with secure participant "PGUIDFMT" which does not provide an identity token\n", PGUID (*ppguid));
+      free_proxy_participant(proxypp);
+    }
+  }
+  else
+  {
+    /* Remote is un-secure. Try the discovery anyway. Maybe there's a local secure
+     * participant that allowed communication with remote non-secure ones
+     */
+    entidx_insert_proxy_participant_guid (gv->entity_index, proxypp);
+    add_proxy_builtin_endpoints(gv, ppguid, proxypp, timestamp);
+    DDS_CLOG (DDS_LC_INFO, &gv->logconfig, "Un-secure participant "PGUIDFMT" tries to connect.\n", PGUID (*ppguid));
+  }
+#else
+  /* Proxy participant must be in the hash tables for new_proxy_{writer,reader} to work */
+  entidx_insert_proxy_participant_guid (gv->entity_index, proxypp);
   add_proxy_builtin_endpoints(gv, ppguid, proxypp, timestamp);
+#endif
 }
 
 int update_proxy_participant_plist_locked (struct proxy_participant *proxypp, seqno_t seq, const struct nn_plist *datap, enum update_proxy_participant_source source, nn_wctime_t timestamp)
@@ -4356,6 +4805,10 @@ static void unref_proxy_participant (struct proxy_participant *proxypp, struct p
     }
     ddsrt_mutex_unlock (&proxypp->e.lock);
     ELOGDISC (proxypp, "unref_proxy_participant("PGUIDFMT"): refc=0, freeing\n", PGUID (proxypp->e.guid));
+
+#ifdef DDSI_INCLUDE_SECURITY
+    q_omg_security_deregister_remote_participant(proxypp);
+#endif
     unref_addrset (proxypp->as_default);
     unref_addrset (proxypp->as_meta);
     nn_plist_fini (proxypp->plist);
@@ -4478,6 +4931,61 @@ static void delete_ppt (struct proxy_participant *proxypp, nn_wctime_t timestamp
   gcreq_proxy_participant (proxypp);
 }
 
+#ifdef DDSI_INCLUDE_SECURITY
+
+struct setab {
+  enum entity_kind kind;
+  uint32_t id;
+};
+
+
+static void downgrade_to_nonsecure(struct proxy_participant *proxypp)
+{
+  const nn_wctime_t tnow = now();
+  struct ddsi_guid guid;
+  static const struct setab setab[] = {
+      {EK_PROXY_WRITER, NN_ENTITYID_SEDP_BUILTIN_PUBLICATIONS_SECURE_WRITER},
+      {EK_PROXY_READER, NN_ENTITYID_SEDP_BUILTIN_PUBLICATIONS_SECURE_READER},
+      {EK_PROXY_WRITER, NN_ENTITYID_SEDP_BUILTIN_SUBSCRIPTIONS_SECURE_WRITER},
+      {EK_PROXY_READER, NN_ENTITYID_SEDP_BUILTIN_SUBSCRIPTIONS_SECURE_READER},
+      {EK_PROXY_WRITER, NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_STATELESS_MESSAGE_WRITER},
+      {EK_PROXY_READER, NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_STATELESS_MESSAGE_READER},
+      {EK_PROXY_WRITER, NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_MESSAGE_SECURE_WRITER},
+      {EK_PROXY_READER, NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_MESSAGE_SECURE_READER},
+      {EK_PROXY_WRITER, NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_VOLATILE_SECURE_WRITER},
+      {EK_PROXY_READER, NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_VOLATILE_SECURE_READER},
+      {EK_PROXY_WRITER, NN_ENTITYID_SPDP_RELIABLE_BUILTIN_PARTICIPANT_SECURE_WRITER},
+      {EK_PROXY_READER, NN_ENTITYID_SPDP_RELIABLE_BUILTIN_PARTICIPANT_SECURE_READER}
+  };
+  int i;
+
+  DDS_CWARNING (&proxypp->e.gv->logconfig, "downgrade participant "PGUIDFMT" to non-secure\n", PGUID (proxypp->e.guid));
+
+  guid.prefix = proxypp->e.guid.prefix;
+  /* Remove security related endpoints. */
+  for (i = 0; i < (int)(sizeof(setab)/sizeof(*setab)); i++)
+  {
+    guid.entityid.u = setab[i].id;
+    switch (setab[i].kind)
+    {
+    case EK_PROXY_READER:
+      (void)delete_proxy_reader (proxypp->e.gv, &guid, tnow, 0);
+      break;
+    case EK_PROXY_WRITER:
+      (void)delete_proxy_writer (proxypp->e.gv, &guid, tnow, 0);
+      break;
+    default:
+      assert(0);
+    }
+  }
+
+  /* Cleanup all kinds of related security information. */
+  q_omg_security_deregister_remote_participant(proxypp);
+  proxypp->bes &= BES_MASK_NON_SECURITY;
+}
+#endif
+
+
 typedef struct proxy_purge_data {
   struct proxy_participant *proxypp;
   const nn_locator_t *loc;

From b81ef4042bb377bfb7e043c06ce4b2853caa7cc4 Mon Sep 17 00:00:00 2001
From: Kurtulus Oksuztepe <kurtulus.oksuztepe@adlinktech.com>
Date: Wed, 20 Nov 2019 16:54:28 +0100
Subject: [PATCH 084/238] DDS Security dynamic plugin loading Security plugin
 loading with the given configuration has been added.

The configuration can be given by either the Cyclone DDS configuration file or ParticipantQoS during participant creation.
ParticipantQoS is required by DDS Security spec. However, the configuration file is an additional useful feature that helps the user to add security to the DDS application without changing the binary.
If ParticipantQoS has a Property starting with the name "dds.sec", then the configuration file is ignored.

If the participant is the first participant, the security component is initialized. If the participant is the last active participant, then the security component is de-initialized.

Signed-off-by: Kurtulus Oksuztepe <kurtulus.oksuztepe@adlinktech.com>
---
 src/core/ddsc/tests/CMakeLists.txt            |   32 +-
 src/core/ddsc/tests/config.c                  | 1128 ++++++++++-------
 src/core/ddsc/tests/config_env.h.in           |    4 +
 .../ddsi/include/dds/ddsi/ddsi_security_omg.h |   57 +-
 src/core/ddsi/include/dds/ddsi/q_entity.h     |    1 +
 src/core/ddsi/include/dds/ddsi/q_globals.h    |    7 +
 src/core/ddsi/include/dds/ddsi/q_xqos.h       |   13 +-
 src/core/ddsi/src/ddsi_security_omg.c         |  301 ++++-
 src/core/ddsi/src/q_entity.c                  |   77 +-
 src/core/ddsi/src/q_init.c                    |    8 +
 src/core/ddsi/src/q_plist.c                   |   40 +-
 src/core/ddsi/src/q_xevent.c                  |    9 +-
 src/ddsrt/src/dynlib/posix/dynlib.c           |    1 +
 src/security/CMakeLists.txt                   |    1 +
 .../dds/security/dds_security_api_defs.h      |   24 +
 .../authentication/src/auth_utils.c           |    2 +-
 .../authentication/src/auth_utils.h           |    2 +-
 .../authentication/src/authentication.c       |    9 +-
 .../builtin_plugins/tests/CMakeLists.txt      |    5 +-
 src/security/core/CMakeLists.txt              |   18 +-
 .../dds/security/core/dds_security_plugins.h  |   65 +
 src/security/core/src/dds_security_plugins.c  |  404 ++++++
 .../core/tests/plugin_loading/CMakeLists.txt  |  129 ++
 .../core/tests/plugin_loading/config_env.h.in |   21 +
 .../tests/plugin_loading/plugin_loading.c     |  910 +++++++++++++
 .../mock_access_control.c                     |  597 +++++++++
 .../mock_access_control.h                     |  281 ++++
 .../mock_access_control.c                     |  600 +++++++++
 .../mock_access_control.h                     |  280 ++++
 .../mock_authentication.c                     |  396 ++++++
 .../mock_authentication.h                     |  213 ++++
 .../mock_authentication.c                     |  353 ++++++
 .../mock_authentication.h                     |  136 ++
 .../mock_authentication.c                     |  388 ++++++
 .../mock_authentication.h                     |  264 ++++
 .../mock_authentication.c                     |  347 +++++
 .../mock_authentication.h                     |  217 ++++
 .../mock_authentication.c                     |  396 ++++++
 .../mock_authentication.h                     |  218 ++++
 .../cryptography_all_ok/mock_cryptography.c   |  667 ++++++++++
 .../cryptography_all_ok/mock_cryptography.h   |   21 +
 .../mock_cryptography.c                       |  656 ++++++++++
 .../mock_cryptography.h                       |   26 +
 43 files changed, 8709 insertions(+), 615 deletions(-)
 create mode 100644 src/security/core/include/dds/security/core/dds_security_plugins.h
 create mode 100644 src/security/core/src/dds_security_plugins.c
 create mode 100644 src/security/core/tests/plugin_loading/CMakeLists.txt
 create mode 100644 src/security/core/tests/plugin_loading/config_env.h.in
 create mode 100644 src/security/core/tests/plugin_loading/plugin_loading.c
 create mode 100644 src/security/core/tests/plugin_loading/plugin_mock/access_control_all_ok/mock_access_control.c
 create mode 100644 src/security/core/tests/plugin_loading/plugin_mock/access_control_all_ok/mock_access_control.h
 create mode 100644 src/security/core/tests/plugin_loading/plugin_mock/access_control_missing_function/mock_access_control.c
 create mode 100644 src/security/core/tests/plugin_loading/plugin_mock/access_control_missing_function/mock_access_control.h
 create mode 100644 src/security/core/tests/plugin_loading/plugin_mock/authentication_all_ok/mock_authentication.c
 create mode 100644 src/security/core/tests/plugin_loading/plugin_mock/authentication_all_ok/mock_authentication.h
 create mode 100644 src/security/core/tests/plugin_loading/plugin_mock/authentication_all_ok_other/mock_authentication.c
 create mode 100644 src/security/core/tests/plugin_loading/plugin_mock/authentication_all_ok_other/mock_authentication.h
 create mode 100644 src/security/core/tests/plugin_loading/plugin_mock/authentication_finalize_error/mock_authentication.c
 create mode 100644 src/security/core/tests/plugin_loading/plugin_mock/authentication_finalize_error/mock_authentication.h
 create mode 100644 src/security/core/tests/plugin_loading/plugin_mock/authentication_init_error/mock_authentication.c
 create mode 100644 src/security/core/tests/plugin_loading/plugin_mock/authentication_init_error/mock_authentication.h
 create mode 100644 src/security/core/tests/plugin_loading/plugin_mock/authentication_missing_function/mock_authentication.c
 create mode 100644 src/security/core/tests/plugin_loading/plugin_mock/authentication_missing_function/mock_authentication.h
 create mode 100644 src/security/core/tests/plugin_loading/plugin_mock/cryptography_all_ok/mock_cryptography.c
 create mode 100644 src/security/core/tests/plugin_loading/plugin_mock/cryptography_all_ok/mock_cryptography.h
 create mode 100644 src/security/core/tests/plugin_loading/plugin_mock/cryptography_missing_function/mock_cryptography.c
 create mode 100644 src/security/core/tests/plugin_loading/plugin_mock/cryptography_missing_function/mock_cryptography.h

diff --git a/src/core/ddsc/tests/CMakeLists.txt b/src/core/ddsc/tests/CMakeLists.txt
index bb6dbe7..62e8844 100644
--- a/src/core/ddsc/tests/CMakeLists.txt
+++ b/src/core/ddsc/tests/CMakeLists.txt
@@ -74,10 +74,40 @@ set(CUnit_ddsc_config_simple_udp_uri "file://${CUnit_ddsc_config_simple_udp_file
 set(CUnit_ddsc_config_simple_udp_max_participants "0")
 set(CUnit_ddsc_config_simple_udp_env "${PROJECT_NAME_CAPS}_URI=${CUnit_ddsc_config_simple_udp_uri};MAX_PARTICIPANTS=${CUnit_ddsc_config_simple_udp_max_participants};${CUnit_ddsc_config_simple_udp_env}")
 
+
+unset(test_lib_tests)
+# Let the cunit application know the location and name of the security mock libraries.
+#file(TO_NATIVE_PATH "${CMAKE_CURRENT_BINARY_DIR}/../../../security/core/tests/plugin_loading" test_lib_native_dir)
+
+
+file(TO_NATIVE_PATH "${PROJECT_BINARY_DIR}/src/security/core/tests/plugin_loading" test_lib_native_dir)
+file(TO_NATIVE_PATH "/" test_lib_sep)
+string(REPLACE "\\" "\\\\" test_lib_dir ${test_lib_native_dir})
+string(REPLACE "\\" "\\\\" test_lib_sep ${test_lib_sep})
+
+process_cunit_source_file("config.c" test_lib_header test_lib_suites test_lib_tests)
+foreach(libtest ${test_lib_tests})
+	string(REPLACE ":" ";" libtest ${libtest})
+	list(GET libtest 0 suite)
+	list(GET libtest 1 test)
+	set(libtestname "CUnit_${suite}_${test}")
+	if("${CMAKE_HOST_SYSTEM}" MATCHES ".*Windows.*")
+		set_property(TEST ${libtestname} APPEND PROPERTY ENVIRONMENT "${test_lib_native_dir}")
+	else()
+		set_property(TEST ${libtestname} APPEND PROPERTY ENVIRONMENT "LD_LIBRARY_PATH=${test_lib_native_dir};$ENV{LD_LIBRARY_PATH}")
+	endif()
+endforeach()
+
+
+
 set_tests_properties(
 	CUnit_ddsc_config_simple_udp
 	PROPERTIES
 		REQUIRED_FILES ${CUnit_ddsc_config_simple_udp_file}
 		ENVIRONMENT "${CUnit_ddsc_config_simple_udp_env}")
 
-configure_file("config_env.h.in" "config_env.h")
+configure_file("config_env.h.in" "config_env.h" @ONLY)
+
+
+
+
diff --git a/src/core/ddsc/tests/config.c b/src/core/ddsc/tests/config.c
index ff8d975..644867c 100644
--- a/src/core/ddsc/tests/config.c
+++ b/src/core/ddsc/tests/config.c
@@ -22,6 +22,10 @@
 #include "dds/ddsi/q_misc.h"
 #include "dds/ddsi/q_xqos.h"
 
+#ifdef DDSI_INCLUDE_SECURITY
+#include "dds/security/dds_security_api_defs.h"
+#endif
+
 #define FORCE_ENV
 
 #define URI_VARIABLE DDS_PROJECT_NAME_NOSPACE_CAPS"_URI"
@@ -94,193 +98,215 @@ CU_Test (ddsc_config, user_config, .init = ddsrt_init, .fini = ddsrt_fini)
 static uint32_t found;
 static void logger(void *ptr, const dds_log_data_t *data)
 {
-    char **expected = (char**)ptr;
-    for (uint32_t i = 0; expected[i] != NULL; i++) {
-        if (ddsi2_patmatch(expected[i], data->message)) {
-            found |= (uint32_t)(1 << i);
-        }
-    }
+  char **expected = (char**)ptr;
+  for (uint32_t i = 0; expected[i] != NULL; i++) {
+      if (ddsi2_patmatch(expected[i], data->message)) {
+          found |= (uint32_t)(1 << i);
+      }
+  }
 }
 
 CU_Test(ddsc_config, security_non, .init = ddsrt_init, .fini = ddsrt_fini) {
 
-    /* There shouldn't be traces that mention security. */
-    const char *log_expected[] = {
-      "*Security*",
-      NULL
-    };
+  /* There shouldn't be traces that mention security. */
+  const char *log_expected[] = {
+    "*Security*",
+    NULL
+  };
 
-    dds_entity_t participant;
+  dds_entity_t participant;
 
-    /* Set up the trace sinks to detect the config parsing. */
-    dds_set_log_mask(DDS_LC_FATAL|DDS_LC_ERROR|DDS_LC_WARNING|DDS_LC_CONFIG);
-    dds_set_log_sink(&logger, (void*)log_expected);
-    dds_set_trace_sink(&logger, (void*)log_expected);
+  /* Set up the trace sinks to detect the config parsing. */
+  dds_set_log_mask(DDS_LC_FATAL|DDS_LC_ERROR|DDS_LC_WARNING|DDS_LC_CONFIG);
+  dds_set_log_sink(&logger, (void*)log_expected);
+  dds_set_trace_sink(&logger, (void*)log_expected);
 
-    /* Create participant with an empty security element. */
-    found = 0;
-    ddsrt_setenv(URI_VARIABLE, "<Tracing><Verbosity>finest</></>");
-    participant = dds_create_participant(DDS_DOMAIN_DEFAULT, NULL, NULL);
-    ddsrt_setenv(URI_VARIABLE, "");
-    CU_ASSERT_FATAL(participant > 0);
-    dds_delete(participant);
+  /* Create participant with an empty security element. */
+  found = 0;
+  ddsrt_setenv(URI_VARIABLE, "<Tracing><Verbosity>finest</></>");
+  participant = dds_create_participant(DDS_DOMAIN_DEFAULT, NULL, NULL);
+  ddsrt_setenv(URI_VARIABLE, "");
+  CU_ASSERT_FATAL(participant > 0);
+  dds_delete(participant);
+  dds_set_log_sink(NULL, NULL);
+  dds_set_trace_sink(NULL, NULL);
 
-    /* No security traces should have been provided. */
-    CU_ASSERT_FATAL(found == 0x0);
+  /* No security traces should have been provided. */
+  CU_ASSERT_FATAL(found == 0x0);
 }
 
 CU_Test(ddsc_config, security_empty, .init = ddsrt_init, .fini = ddsrt_fini) {
 
-    /* Expected traces when creating participant with an empty security element. */
-    const char *log_expected[] = {
+  /* Expected traces when creating participant with an empty security element. */
+  const char *log_expected[] = {
 #ifndef DDSI_INCLUDE_SECURITY
-      "config: //CycloneDDS/Domain: DDSSecurity: unknown element*",
+    "config: //CycloneDDS/Domain: DDSSecurity: unknown element*",
 #else
-      "config: //CycloneDDS/Domain/DDSSecurity/Authentication/IdentityCertificate/#text: element missing in configuration*",
-      "config: //CycloneDDS/Domain/DDSSecurity/Authentication/IdentityCA/#text: element missing in configuration*",
-      "config: //CycloneDDS/Domain/DDSSecurity/Authentication/PrivateKey/#text: element missing in configuration*",
+    "config: //CycloneDDS/Domain/DDSSecurity/Authentication/IdentityCertificate/#text: element missing in configuration*",
+    "config: //CycloneDDS/Domain/DDSSecurity/Authentication/IdentityCA/#text: element missing in configuration*",
+    "config: //CycloneDDS/Domain/DDSSecurity/Authentication/PrivateKey/#text: element missing in configuration*",
 #endif
       NULL
-    };
+  };
 
-    dds_entity_t participant;
+  dds_entity_t participant;
 
-    /* Set up the trace sinks to detect the config parsing. */
-    dds_set_log_mask(DDS_LC_FATAL|DDS_LC_ERROR|DDS_LC_WARNING|DDS_LC_CONFIG);
-    dds_set_log_sink(&logger, (void*)log_expected);
-    dds_set_trace_sink(&logger, (void*)log_expected);
+  /* Set up the trace sinks to detect the config parsing. */
+  dds_set_log_mask(DDS_LC_FATAL|DDS_LC_ERROR|DDS_LC_WARNING|DDS_LC_CONFIG);
+  dds_set_log_sink(&logger, (void*)log_expected);
+  dds_set_trace_sink(&logger, (void*)log_expected);
 
-    /* Create participant with an empty security element. */
-    found = 0;
-    ddsrt_setenv(URI_VARIABLE, "<DDSSecurity/>");
-    participant = dds_create_participant(DDS_DOMAIN_DEFAULT, NULL, NULL);
-    ddsrt_setenv(URI_VARIABLE, "");
-    CU_ASSERT_FATAL(participant < 0);
+  /* Create participant with an empty security element. */
+  found = 0;
+  ddsrt_setenv(URI_VARIABLE, "<DDSSecurity/>");
+  participant = dds_create_participant(DDS_DOMAIN_DEFAULT, NULL, NULL);
+  ddsrt_setenv(URI_VARIABLE, "");
+  CU_ASSERT_FATAL(participant < 0);
+  dds_set_log_sink(NULL, NULL);
+  dds_set_trace_sink(NULL, NULL);
 
-    /* All traces should have been provided. */
+  /* All traces should have been provided. */
 #ifndef DDSI_INCLUDE_SECURITY
-    CU_ASSERT_FATAL(found == 0x1);
+  CU_ASSERT_FATAL(found == 0x1);
 #else
-    CU_ASSERT_FATAL(found == 0x7);
+  CU_ASSERT_FATAL(found == 0x7);
 #endif
 }
 
 CU_Test(ddsc_config, security_missing, .init = ddsrt_init, .fini = ddsrt_fini) {
 
-    /* Expected traces when creating participant with the security elements. */
-    const char *log_expected[] = {
+  /* Expected traces when creating participant with the security elements. */
+  const char *log_expected[] = {
 #ifndef DDSI_INCLUDE_SECURITY
-      "config: //CycloneDDS/Domain: DDSSecurity: unknown element*",
+    "config: //CycloneDDS/Domain: DDSSecurity: unknown element*",
 #else
-      "config: //CycloneDDS/Domain/DDSSecurity/Authentication/IdentityCertificate/#text: element missing in configuration*",
-      "config: //CycloneDDS/Domain/DDSSecurity/Authentication/IdentityCA/#text: element missing in configuration*",
-      "config: //CycloneDDS/Domain/DDSSecurity/Authentication/PrivateKey/#text: element missing in configuration*",
+    "config: //CycloneDDS/Domain/DDSSecurity/Authentication/IdentityCertificate/#text: element missing in configuration*",
+    "config: //CycloneDDS/Domain/DDSSecurity/Authentication/IdentityCA/#text: element missing in configuration*",
+    "config: //CycloneDDS/Domain/DDSSecurity/Authentication/PrivateKey/#text: element missing in configuration*",
 #endif
       NULL
     };
 
-    /* IdentityCertificate, IdentityCA and PrivateKey values or elements are missing. */
-    const char *sec_config =
-      "<Tracing><Verbosity>finest</></>"
-      "<DDSSecurity>"
-        "<Authentication>"
-          "<Library path=\"dds_security_auth\" initFunction=\"init_authentication\" finalizeFunction=\"finalize_authentication\" />"
-          "<IdentityCertificate></IdentityCertificate>"
-          "<PrivateKey></PrivateKey>"
-          "<Password>testtext_Password_testtext</Password>"
-        "</Authentication>"
-          "<Cryptographic>"
-            "<Library path=\"dds_security_crypto\" initFunction=\"init_crypto\" finalizeFunction=\"finalize_crypto\"/>"
-          "</Cryptographic>"
-        "<AccessControl>"
-          "<Library path=\"dds_security_ac\" initFunction=\"init_ac\" finalizeFunction=\"finalize_ac\"/>"
-          "<Governance>file:Governance.p7s</Governance>"
-          "<PermissionsCA>file:Permissions_CA.pem</PermissionsCA>"
-          "<Permissions>file:Permissions.p7s</Permissions>"
-        "</AccessControl>"
-      "</DDSSecurity>";
+  /* IdentityCertificate, IdentityCA and PrivateKey values or elements are missing. */
+  const char *sec_config =
+    "<Tracing><Verbosity>finest</></>"
+    "<DDSSecurity>"
+      "<Authentication>"
+        "<Library path=\""CONFIG_PLUGIN_MOCK_DIR""CONFIG_LIB_SEP""CONFIG_LIB_PREFIX"dds_security_authentication_all_ok"CONFIG_LIB_SUFFIX"\" initFunction=\"init_authentication\" finalizeFunction=\"finalize_authentication\" />"
+        "<IdentityCertificate></IdentityCertificate>"
+        "<PrivateKey></PrivateKey>"
+        "<Password>testtext_Password_testtext</Password>"
+      "</Authentication>"
+      "<Cryptographic>"
+        "<Library path=\""CONFIG_PLUGIN_MOCK_DIR""CONFIG_LIB_SEP""CONFIG_LIB_PREFIX"dds_security_cryptography_all_ok"CONFIG_LIB_SUFFIX"\" initFunction=\"init_crypto\" finalizeFunction=\"finalize_crypto\"/>"
+      "</Cryptographic>"
+      "<AccessControl>"
+        "<Library path=\""CONFIG_PLUGIN_MOCK_DIR""CONFIG_LIB_SEP""CONFIG_LIB_PREFIX"dds_security_access_control_all_ok"CONFIG_LIB_SUFFIX"\" initFunction=\"init_access_control\" finalizeFunction=\"finalize_access_control\"/>"
+        "<Governance>file:Governance.p7s</Governance>"
+        "<PermissionsCA>file:Permissions_CA.pem</PermissionsCA>"
+        "<Permissions>file:Permissions.p7s</Permissions>"
+      "</AccessControl>"
+    "</DDSSecurity>";
 
 
-    dds_entity_t participant;
+  dds_entity_t participant;
 
-    /* Set up the trace sinks to detect the config parsing. */
-    dds_set_log_mask(DDS_LC_FATAL|DDS_LC_ERROR|DDS_LC_WARNING|DDS_LC_CONFIG);
-    dds_set_log_sink(&logger, (void*)log_expected);
-    dds_set_trace_sink(&logger, (void*)log_expected);
+  /* Set up the trace sinks to detect the config parsing. */
+  dds_set_log_mask(DDS_LC_FATAL|DDS_LC_ERROR|DDS_LC_WARNING|DDS_LC_CONFIG);
+  dds_set_log_sink(&logger, (void*)log_expected);
+  dds_set_trace_sink(&logger, (void*)log_expected);
 
-    /* Create participant with an empty security element. */
-    found = 0;
-    ddsrt_setenv(URI_VARIABLE, sec_config);
-    participant = dds_create_participant(DDS_DOMAIN_DEFAULT, NULL, NULL);
-    ddsrt_setenv(URI_VARIABLE, "");
-    CU_ASSERT_FATAL(participant < 0);
-
-    /* All traces should have been provided. */
+  /* Create participant with an empty security element. */
+  found = 0;
+  ddsrt_setenv(URI_VARIABLE, sec_config);
+  participant = dds_create_participant(DDS_DOMAIN_DEFAULT, NULL, NULL);
+  ddsrt_setenv(URI_VARIABLE, "");
+  CU_ASSERT_FATAL(participant < 0);
+  dds_set_log_sink(NULL, NULL);
+  dds_set_trace_sink(NULL, NULL);
+  /* All traces should have been provided. */
 #ifndef DDSI_INCLUDE_SECURITY
-    CU_ASSERT_FATAL(found == 0x1);
+  CU_ASSERT_FATAL(found == 0x1);
 #else
-    CU_ASSERT_FATAL(found == 0x7);
+  CU_ASSERT_FATAL(found == 0x7);
 #endif
 }
 
 CU_Test(ddsc_config, security_all, .init = ddsrt_init, .fini = ddsrt_fini) {
 
-    /* Expected traces when creating participant with the security elements. */
-    const char *log_expected[] = {
+  /* Expected traces when creating participant with the security elements. */
+  const char *log_expected[] = {
 #ifndef DDSI_INCLUDE_SECURITY
-      "config: //CycloneDDS/Domain: DDSSecurity: unknown element*",
+    "config: //CycloneDDS/Domain: DDSSecurity: unknown element*",
 #else
-      "config: Domain/DDSSecurity/Authentication/Library/#text: dds_security_auth*",
-      "config: Domain/DDSSecurity/Authentication/Library[@path]: dds_security_auth*",
-      "config: Domain/DDSSecurity/Authentication/Library[@initFunction]: init_authentication*",
-      "config: Domain/DDSSecurity/Authentication/Library[@finalizeFunction]: finalize_authentication*",
-      "config: Domain/DDSSecurity/Authentication/IdentityCertificate/#text: testtext_IdentityCertificate_testtext*",
-      "config: Domain/DDSSecurity/Authentication/IdentityCA/#text: testtext_IdentityCA_testtext*",
-      "config: Domain/DDSSecurity/Authentication/PrivateKey/#text: testtext_PrivateKey_testtext*",
-      "config: Domain/DDSSecurity/Authentication/Password/#text: testtext_Password_testtext*",
-      "config: Domain/DDSSecurity/Authentication/TrustedCADirectory/#text: testtext_Dir_testtext*",
-      "config: Domain/DDSSecurity/AccessControl/Library/#text: dds_security_ac*",
-      "config: Domain/DDSSecurity/AccessControl/Library[@path]: dds_security_ac*",
-      "config: Domain/DDSSecurity/AccessControl/Library[@initFunction]: init_ac*",
-      "config: Domain/DDSSecurity/AccessControl/Library[@finalizeFunction]: finalize_ac*",
-      "config: Domain/DDSSecurity/AccessControl/PermissionsCA/#text: file:Permissions_CA.pem*",
-      "config: Domain/DDSSecurity/AccessControl/Governance/#text: file:Governance.p7s*",
-      "config: Domain/DDSSecurity/AccessControl/Permissions/#text: file:Permissions.p7s*",
-      "config: Domain/DDSSecurity/Cryptographic/Library/#text: dds_security_crypto*",
-      "config: Domain/DDSSecurity/Cryptographic/Library[@path]: dds_security_crypto*",
-      "config: Domain/DDSSecurity/Cryptographic/Library[@initFunction]: init_crypto*",
-      "config: Domain/DDSSecurity/Cryptographic/Library[@finalizeFunction]: finalize_crypto*",
-      /* The config should have been parsed into the participant QoS. */
-      "PARTICIPANT * QOS={*property_list={value={{dds.sec.auth.identity_ca,testtext_IdentityCA_testtext,0},{dds.sec.auth.private_key,testtext_PrivateKey_testtext,0},{dds.sec.auth.identity_certificate,testtext_IdentityCertificate_testtext,0},{dds.sec.access.permissions_ca,file:Permissions_CA.pem,0},{dds.sec.access.governance,file:Governance.p7s,0},{dds.sec.access.permissions,file:Permissions.p7s,0},{dds.sec.auth.password,testtext_Password_testtext,0},{dds.sec.auth.trusted_ca_dir,testtext_Dir_testtext,0}}binary_value={}}*}*",
-#endif
-      NULL
-    };
+    "config: Domain/DDSSecurity/Authentication/Library/#text: "CONFIG_PLUGIN_MOCK_DIR""CONFIG_LIB_SEP""CONFIG_LIB_PREFIX"dds_security_authentication_all_ok"CONFIG_LIB_SUFFIX"*",
+    "config: Domain/DDSSecurity/Authentication/Library[@path]: "CONFIG_PLUGIN_MOCK_DIR""CONFIG_LIB_SEP""CONFIG_LIB_PREFIX"dds_security_authentication_all_ok"CONFIG_LIB_SUFFIX"*",
+    "config: Domain/DDSSecurity/Authentication/Library[@initFunction]: init_authentication*",
+    "config: Domain/DDSSecurity/Authentication/Library[@finalizeFunction]: finalize_authentication*",
+    "config: Domain/DDSSecurity/Authentication/IdentityCertificate/#text: testtext_IdentityCertificate_testtext*",
+    "config: Domain/DDSSecurity/Authentication/IdentityCA/#text: testtext_IdentityCA_testtext*",
+    "config: Domain/DDSSecurity/Authentication/PrivateKey/#text: testtext_PrivateKey_testtext*",
+    "config: Domain/DDSSecurity/Authentication/Password/#text: testtext_Password_testtext*",
+    "config: Domain/DDSSecurity/Authentication/TrustedCADirectory/#text: testtext_Dir_testtext*",
+    "config: Domain/DDSSecurity/AccessControl/Library/#text: "CONFIG_PLUGIN_MOCK_DIR""CONFIG_LIB_SEP""CONFIG_LIB_PREFIX"dds_security_access_control_all_ok"CONFIG_LIB_SUFFIX"*",
+    "config: Domain/DDSSecurity/AccessControl/Library[@path]: "CONFIG_PLUGIN_MOCK_DIR""CONFIG_LIB_SEP""CONFIG_LIB_PREFIX"dds_security_access_control_all_ok"CONFIG_LIB_SUFFIX"*",
+    "config: Domain/DDSSecurity/AccessControl/Library[@initFunction]: init_access_control*",
+    "config: Domain/DDSSecurity/AccessControl/Library[@finalizeFunction]: finalize_access_control*",
+    "config: Domain/DDSSecurity/AccessControl/PermissionsCA/#text: file:Permissions_CA.pem*",
+    "config: Domain/DDSSecurity/AccessControl/Governance/#text: file:Governance.p7s*",
+    "config: Domain/DDSSecurity/AccessControl/Permissions/#text: file:Permissions.p7s*",
+    "config: Domain/DDSSecurity/Cryptographic/Library/#text: "CONFIG_PLUGIN_MOCK_DIR""CONFIG_LIB_SEP""CONFIG_LIB_PREFIX"dds_security_cryptography_all_ok"CONFIG_LIB_SUFFIX"*",
+    "config: Domain/DDSSecurity/Cryptographic/Library[@path]: "CONFIG_PLUGIN_MOCK_DIR""CONFIG_LIB_SEP""CONFIG_LIB_PREFIX"dds_security_cryptography_all_ok"CONFIG_LIB_SUFFIX"*",
+    "config: Domain/DDSSecurity/Cryptographic/Library[@initFunction]: init_crypto*",
+    "config: Domain/DDSSecurity/Cryptographic/Library[@finalizeFunction]: finalize_crypto*",
+    /* The config should have been parsed into the participant QoS. */
+    "PARTICIPANT * QOS={*property_list={value={{dds.sec.auth.library.path,"CONFIG_PLUGIN_MOCK_DIR""CONFIG_LIB_SEP""CONFIG_LIB_PREFIX"dds_security_authentication_all_ok"CONFIG_LIB_SUFFIX",0},"
+      "{dds.sec.auth.library.init,init_authentication,0},"
+      "{dds.sec.auth.library.finalize,finalize_authentication,0},"
+      "{dds.sec.crypto.library.path,"CONFIG_PLUGIN_MOCK_DIR""CONFIG_LIB_SEP""CONFIG_LIB_PREFIX"dds_security_cryptography_all_ok"CONFIG_LIB_SUFFIX",0},"
+      "{dds.sec.crypto.library.init,init_crypto,0},"
+      "{dds.sec.crypto.library.finalize,finalize_crypto,0},"
+      "{dds.sec.access.library.path,"CONFIG_PLUGIN_MOCK_DIR""CONFIG_LIB_SEP""CONFIG_LIB_PREFIX"dds_security_access_control_all_ok"CONFIG_LIB_SUFFIX",0},"
+      "{dds.sec.access.library.init,init_access_control,0},"
+      "{dds.sec.access.library.finalize,finalize_access_control,0},"
+      "{dds.sec.auth.identity_ca,testtext_IdentityCA_testtext,0},"
+      "{dds.sec.auth.private_key,testtext_PrivateKey_testtext,0},"
+      "{dds.sec.auth.identity_certificate,testtext_IdentityCertificate_testtext,0},"
+      "{dds.sec.access.permissions_ca,file:Permissions_CA.pem,0},"
+      "{dds.sec.access.governance,file:Governance.p7s,0},"
+      "{dds.sec.access.permissions,file:Permissions.p7s,0},"
+      "{dds.sec.auth.password,testtext_Password_testtext,0},"
+      "{dds.sec.auth.trusted_ca_dir,testtext_Dir_testtext,0}}binary_value={}}*}*",
+
+#endif
+    NULL
+  };
+  const char *sec_config =
+    "<"DDS_PROJECT_NAME">"
+      "<Domain id=\"any\">"
+      "<Tracing><Verbosity>finest</></>"
+      "<DDSSecurity>"
+      "<Authentication>"
+        "<Library path=\""CONFIG_PLUGIN_MOCK_DIR""CONFIG_LIB_SEP""CONFIG_LIB_PREFIX"dds_security_authentication_all_ok"CONFIG_LIB_SUFFIX"\" initFunction=\"init_authentication\" finalizeFunction=\"finalize_authentication\" />"
+        "<IdentityCertificate>testtext_IdentityCertificate_testtext</IdentityCertificate>"
+        "<IdentityCA>testtext_IdentityCA_testtext</IdentityCA>"
+        "<PrivateKey>testtext_PrivateKey_testtext</PrivateKey>"
+        "<Password>testtext_Password_testtext</Password>"
+        "<TrustedCADirectory>testtext_Dir_testtext</TrustedCADirectory>"
+      "</Authentication>"
+      "<Cryptographic>"
+        "<Library path=\""CONFIG_PLUGIN_MOCK_DIR""CONFIG_LIB_SEP""CONFIG_LIB_PREFIX"dds_security_cryptography_all_ok"CONFIG_LIB_SUFFIX"\" initFunction=\"init_crypto\" finalizeFunction=\"finalize_crypto\"/>"
+      "</Cryptographic>"
+      "<AccessControl>"
+        "<Library path=\""CONFIG_PLUGIN_MOCK_DIR""CONFIG_LIB_SEP""CONFIG_LIB_PREFIX"dds_security_access_control_all_ok"CONFIG_LIB_SUFFIX"\" initFunction=\"init_access_control\" finalizeFunction=\"finalize_access_control\"/>"
+      "<Governance>file:Governance.p7s</Governance>"
+      "<PermissionsCA>file:Permissions_CA.pem</PermissionsCA>"
+      "<Permissions>file:Permissions.p7s</Permissions>"
+      "</AccessControl>"
+      "</DDSSecurity>"
+    "</Domain>"
+    "</"DDS_PROJECT_NAME">";
 
-    const char *sec_config =
-      "<"DDS_PROJECT_NAME">"
-        "<Domain id=\"any\">"
-          "<Tracing><Verbosity>finest</></>"
-          "<DDSSecurity>"
-            "<Authentication>"
-              "<Library path=\"dds_security_auth\" initFunction=\"init_authentication\" finalizeFunction=\"finalize_authentication\" />"
-              "<IdentityCertificate>testtext_IdentityCertificate_testtext</IdentityCertificate>"
-              "<IdentityCA>testtext_IdentityCA_testtext</IdentityCA>"
-              "<PrivateKey>testtext_PrivateKey_testtext</PrivateKey>"
-              "<Password>testtext_Password_testtext</Password>"
-              "<TrustedCADirectory>testtext_Dir_testtext</TrustedCADirectory>"
-            "</Authentication>"
-            "<Cryptographic>"
-              "<Library path=\"dds_security_crypto\" initFunction=\"init_crypto\" finalizeFunction=\"finalize_crypto\"/>"
-            "</Cryptographic>"
-            "<AccessControl>"
-              "<Library path=\"dds_security_ac\" initFunction=\"init_ac\" finalizeFunction=\"finalize_ac\"/>"
-              "<Governance>file:Governance.p7s</Governance>"
-              "<PermissionsCA>file:Permissions_CA.pem</PermissionsCA>"
-              "<Permissions>file:Permissions.p7s</Permissions>"
-            "</AccessControl>"
-          "</DDSSecurity>"
-        "</Domain>"
-      "</"DDS_PROJECT_NAME">";
 
 
     dds_entity_t participant;
@@ -296,6 +322,8 @@ CU_Test(ddsc_config, security_all, .init = ddsrt_init, .fini = ddsrt_fini) {
     participant = dds_create_participant(DDS_DOMAIN_DEFAULT, NULL, NULL);
     ddsrt_setenv(URI_VARIABLE, "");
     dds_delete(participant);
+    dds_set_log_sink(NULL, NULL);
+    dds_set_trace_sink(NULL, NULL);
 
     /* All traces should have been provided. */
 #ifndef DDSI_INCLUDE_SECURITY
@@ -312,8 +340,8 @@ CU_Test(ddsc_config, security, .init = ddsrt_init, .fini = ddsrt_fini) {
 #ifndef DDSI_INCLUDE_SECURITY
       "config: //CycloneDDS/Domain: DDSSecurity: unknown element*",
 #else
-      "config: Domain/DDSSecurity/Authentication/Library/#text: dds_security_auth*",
-      "config: Domain/DDSSecurity/Authentication/Library[@path]: dds_security_auth*",
+      "config: Domain/DDSSecurity/Authentication/Library/#text: "CONFIG_PLUGIN_MOCK_DIR""CONFIG_LIB_SEP""CONFIG_LIB_PREFIX"dds_security_authentication_all_ok"CONFIG_LIB_SUFFIX"*",
+      "config: Domain/DDSSecurity/Authentication/Library[@path]: "CONFIG_PLUGIN_MOCK_DIR""CONFIG_LIB_SEP""CONFIG_LIB_PREFIX"dds_security_authentication_all_ok"CONFIG_LIB_SUFFIX"*",
       "config: Domain/DDSSecurity/Authentication/Library[@initFunction]: init_authentication*",
       "config: Domain/DDSSecurity/Authentication/Library[@finalizeFunction]: finalize_authentication*",
       "config: Domain/DDSSecurity/Authentication/IdentityCertificate/#text: testtext_IdentityCertificate_testtext*",
@@ -321,42 +349,58 @@ CU_Test(ddsc_config, security, .init = ddsrt_init, .fini = ddsrt_fini) {
       "config: Domain/DDSSecurity/Authentication/PrivateKey/#text: testtext_PrivateKey_testtext*",
       "config: Domain/DDSSecurity/Authentication/Password/#text:  {}*",
       "config: Domain/DDSSecurity/Authentication/TrustedCADirectory/#text:  {}*",
-      "config: Domain/DDSSecurity/AccessControl/Library/#text: dds_security_ac*",
-      "config: Domain/DDSSecurity/AccessControl/Library[@path]: dds_security_ac*",
-      "config: Domain/DDSSecurity/AccessControl/Library[@initFunction]: init_ac*",
-      "config: Domain/DDSSecurity/AccessControl/Library[@finalizeFunction]: finalize_ac*",
+      "config: Domain/DDSSecurity/AccessControl/Library/#text: "CONFIG_PLUGIN_MOCK_DIR""CONFIG_LIB_SEP""CONFIG_LIB_PREFIX"dds_security_access_control_all_ok"CONFIG_LIB_SUFFIX"*",
+      "config: Domain/DDSSecurity/AccessControl/Library[@path]: "CONFIG_PLUGIN_MOCK_DIR""CONFIG_LIB_SEP""CONFIG_LIB_PREFIX"dds_security_access_control_all_ok"CONFIG_LIB_SUFFIX"*",
+      "config: Domain/DDSSecurity/AccessControl/Library[@initFunction]: init_access_control*",
+      "config: Domain/DDSSecurity/AccessControl/Library[@finalizeFunction]: finalize_access_control*",
       "config: Domain/DDSSecurity/AccessControl/PermissionsCA/#text: file:Permissions_CA.pem*",
       "config: Domain/DDSSecurity/AccessControl/Governance/#text: file:Governance.p7s*",
       "config: Domain/DDSSecurity/AccessControl/Permissions/#text: file:Permissions.p7s*",
-      "config: Domain/DDSSecurity/Cryptographic/Library/#text: dds_security_crypto*",
-      "config: Domain/DDSSecurity/Cryptographic/Library[@path]: dds_security_crypto*",
+      "config: Domain/DDSSecurity/Cryptographic/Library/#text: "CONFIG_PLUGIN_MOCK_DIR""CONFIG_LIB_SEP""CONFIG_LIB_PREFIX"dds_security_cryptography_all_ok"CONFIG_LIB_SUFFIX"*",
+      "config: Domain/DDSSecurity/Cryptographic/Library[@path]: "CONFIG_PLUGIN_MOCK_DIR""CONFIG_LIB_SEP""CONFIG_LIB_PREFIX"dds_security_cryptography_all_ok"CONFIG_LIB_SUFFIX"*",
       "config: Domain/DDSSecurity/Cryptographic/Library[@initFunction]: init_crypto*",
       "config: Domain/DDSSecurity/Cryptographic/Library[@finalizeFunction]: finalize_crypto*",
       /* The config should have been parsed into the participant QoS. */
-      "PARTICIPANT * QOS={*property_list={value={{dds.sec.auth.identity_ca,testtext_IdentityCA_testtext,0},{dds.sec.auth.private_key,testtext_PrivateKey_testtext,0},{dds.sec.auth.identity_certificate,testtext_IdentityCertificate_testtext,0},{dds.sec.access.permissions_ca,file:Permissions_CA.pem,0},{dds.sec.access.governance,file:Governance.p7s,0},{dds.sec.access.permissions,file:Permissions.p7s,0}}binary_value={}}*}*",
+      "PARTICIPANT * QOS={*property_list={value={{dds.sec.auth.library.path,"CONFIG_PLUGIN_MOCK_DIR""CONFIG_LIB_SEP""CONFIG_LIB_PREFIX"dds_security_authentication_all_ok"CONFIG_LIB_SUFFIX",0},"
+        "{dds.sec.auth.library.init,init_authentication,0},"
+        "{dds.sec.auth.library.finalize,finalize_authentication,0},"
+        "{dds.sec.crypto.library.path,"CONFIG_PLUGIN_MOCK_DIR""CONFIG_LIB_SEP""CONFIG_LIB_PREFIX"dds_security_cryptography_all_ok"CONFIG_LIB_SUFFIX",0},"
+        "{dds.sec.crypto.library.init,init_crypto,0},"
+        "{dds.sec.crypto.library.finalize,finalize_crypto,0},"
+        "{dds.sec.access.library.path,"CONFIG_PLUGIN_MOCK_DIR""CONFIG_LIB_SEP""CONFIG_LIB_PREFIX"dds_security_access_control_all_ok"CONFIG_LIB_SUFFIX",0},"
+        "{dds.sec.access.library.init,init_access_control,0},"
+        "{dds.sec.access.library.finalize,finalize_access_control,0},"
+        "{dds.sec.auth.identity_ca,testtext_IdentityCA_testtext,0},"
+        "{dds.sec.auth.private_key,testtext_PrivateKey_testtext,0},"
+        "{dds.sec.auth.identity_certificate,testtext_IdentityCertificate_testtext,0},"
+        "{dds.sec.access.permissions_ca,file:Permissions_CA.pem,0},"
+        "{dds.sec.access.governance,file:Governance.p7s,0},"
+        "{dds.sec.access.permissions,file:Permissions.p7s,0},"
+        "{dds.sec.auth.password,,0},"
+        "{dds.sec.auth.trusted_ca_dir,,0}}binary_value={}}*}*",
 #endif
-      NULL
-    };
+    NULL
+  };
 
-    const char *sec_config =
-      "<Tracing><Verbosity>finest</></>"
-      "<DDSSecurity>"
-        "<Authentication>"
-          "<Library path=\"dds_security_auth\" initFunction=\"init_authentication\" finalizeFunction=\"finalize_authentication\" />"
-          "<IdentityCertificate>testtext_IdentityCertificate_testtext</IdentityCertificate>"
-          "<IdentityCA>testtext_IdentityCA_testtext</IdentityCA>"
-          "<PrivateKey>testtext_PrivateKey_testtext</PrivateKey>"
-        "</Authentication>"
-          "<Cryptographic>"
-            "<Library path=\"dds_security_crypto\" initFunction=\"init_crypto\" finalizeFunction=\"finalize_crypto\"/>"
-          "</Cryptographic>"
-        "<AccessControl>"
-          "<Library path=\"dds_security_ac\" initFunction=\"init_ac\" finalizeFunction=\"finalize_ac\"/>"
-          "<Governance>file:Governance.p7s</Governance>"
-          "<PermissionsCA>file:Permissions_CA.pem</PermissionsCA>"
-          "<Permissions>file:Permissions.p7s</Permissions>"
-        "</AccessControl>"
-      "</DDSSecurity>";
+  const char *sec_config =
+    "<Tracing><Verbosity>finest</></>"
+    "<DDSSecurity>"
+      "<Authentication>"
+        "<Library path=\""CONFIG_PLUGIN_MOCK_DIR""CONFIG_LIB_SEP""CONFIG_LIB_PREFIX"dds_security_authentication_all_ok"CONFIG_LIB_SUFFIX"\" initFunction=\"init_authentication\" finalizeFunction=\"finalize_authentication\" />"
+        "<IdentityCertificate>testtext_IdentityCertificate_testtext</IdentityCertificate>"
+        "<IdentityCA>testtext_IdentityCA_testtext</IdentityCA>"
+        "<PrivateKey>testtext_PrivateKey_testtext</PrivateKey>"
+      "</Authentication>"
+      "<Cryptographic>"
+        "<Library path=\""CONFIG_PLUGIN_MOCK_DIR""CONFIG_LIB_SEP""CONFIG_LIB_PREFIX"dds_security_cryptography_all_ok"CONFIG_LIB_SUFFIX"\" initFunction=\"init_crypto\" finalizeFunction=\"finalize_crypto\"/>"
+      "</Cryptographic>"
+      "<AccessControl>"
+        "<Library path=\""CONFIG_PLUGIN_MOCK_DIR""CONFIG_LIB_SEP""CONFIG_LIB_PREFIX"dds_security_access_control_all_ok"CONFIG_LIB_SUFFIX"\" initFunction=\"init_access_control\" finalizeFunction=\"finalize_access_control\"/>"
+        "<Governance>file:Governance.p7s</Governance>"
+        "<PermissionsCA>file:Permissions_CA.pem</PermissionsCA>"
+        "<Permissions>file:Permissions.p7s</Permissions>"
+      "</AccessControl>"
+    "</DDSSecurity>";
 
 
     dds_entity_t participant;
@@ -372,6 +416,8 @@ CU_Test(ddsc_config, security, .init = ddsrt_init, .fini = ddsrt_fini) {
     participant = dds_create_participant(DDS_DOMAIN_DEFAULT, NULL, NULL);
     ddsrt_setenv(URI_VARIABLE, "");
     dds_delete(participant);
+    dds_set_log_sink(NULL, NULL);
+    dds_set_trace_sink(NULL, NULL);
 
     /* All traces should have been provided. */
 #ifndef DDSI_INCLUDE_SECURITY
@@ -388,404 +434,508 @@ CU_Test(ddsc_config, security_deprecated, .init = ddsrt_init, .fini = ddsrt_fini
 #ifndef DDSI_INCLUDE_SECURITY
       "config: //CycloneDDS/Domain: DDSSecurity: unknown element*",
 #else
-      "config: Domain/DDSSecurity/Authentication/Library/#text: dds_security_auth*",
-      "config: Domain/DDSSecurity/Authentication/Library[@path]: dds_security_auth*",
-      "config: Domain/DDSSecurity/Authentication/Library[@initFunction]: init_authentication*",
-      "config: Domain/DDSSecurity/Authentication/Library[@finalizeFunction]: finalize_authentication*",
-      "config: Domain/DDSSecurity/Authentication/IdentityCertificate/#text: testtext_IdentityCertificate_testtext*",
-      "config: Domain/DDSSecurity/Authentication/IdentityCA/#text: testtext_IdentityCA_testtext*",
-      "config: Domain/DDSSecurity/Authentication/PrivateKey/#text: testtext_PrivateKey_testtext*",
-      "config: Domain/DDSSecurity/Authentication/Password/#text: testtext_Password_testtext*",
-      "config: Domain/DDSSecurity/Authentication/TrustedCADirectory/#text: testtext_Dir_testtext*",
-      "config: Domain/DDSSecurity/AccessControl/Library/#text: dds_security_ac*",
-      "config: Domain/DDSSecurity/AccessControl/Library[@path]: dds_security_ac*",
-      "config: Domain/DDSSecurity/AccessControl/Library[@initFunction]: init_ac*",
-      "config: Domain/DDSSecurity/AccessControl/Library[@finalizeFunction]: finalize_ac*",
-      "config: Domain/DDSSecurity/AccessControl/PermissionsCA/#text: file:Permissions_CA.pem*",
-      "config: Domain/DDSSecurity/AccessControl/Governance/#text: file:Governance.p7s*",
-      "config: Domain/DDSSecurity/AccessControl/Permissions/#text: file:Permissions.p7s*",
-      "config: Domain/DDSSecurity/Cryptographic/Library/#text: dds_security_crypto*",
-      "config: Domain/DDSSecurity/Cryptographic/Library[@path]: dds_security_crypto*",
-      "config: Domain/DDSSecurity/Cryptographic/Library[@initFunction]: init_crypto*",
-      "config: Domain/DDSSecurity/Cryptographic/Library[@finalizeFunction]: finalize_crypto*",
-      /* The config should have been parsed into the participant QoS. */
-      "PARTICIPANT * QOS={*property_list={value={{dds.sec.auth.identity_ca,testtext_IdentityCA_testtext,0},{dds.sec.auth.private_key,testtext_PrivateKey_testtext,0},{dds.sec.auth.identity_certificate,testtext_IdentityCertificate_testtext,0},{dds.sec.access.permissions_ca,file:Permissions_CA.pem,0},{dds.sec.access.governance,file:Governance.p7s,0},{dds.sec.access.permissions,file:Permissions.p7s,0},{dds.sec.auth.password,testtext_Password_testtext,0},{dds.sec.auth.trusted_ca_dir,testtext_Dir_testtext,0}}binary_value={}}*}*",
+    "config: Domain/DDSSecurity/Authentication/Library/#text: "CONFIG_PLUGIN_MOCK_DIR""CONFIG_LIB_SEP""CONFIG_LIB_PREFIX"dds_security_authentication_all_ok"CONFIG_LIB_SUFFIX"*",
+    "config: Domain/DDSSecurity/Authentication/Library[@path]: "CONFIG_PLUGIN_MOCK_DIR""CONFIG_LIB_SEP""CONFIG_LIB_PREFIX"dds_security_authentication_all_ok"CONFIG_LIB_SUFFIX"*",
+    "config: Domain/DDSSecurity/Authentication/Library[@initFunction]: init_authentication*",
+    "config: Domain/DDSSecurity/Authentication/Library[@finalizeFunction]: finalize_authentication*",
+    "config: Domain/DDSSecurity/Authentication/IdentityCertificate/#text: testtext_IdentityCertificate_testtext*",
+    "config: Domain/DDSSecurity/Authentication/IdentityCA/#text: testtext_IdentityCA_testtext*",
+    "config: Domain/DDSSecurity/Authentication/PrivateKey/#text: testtext_PrivateKey_testtext*",
+    "config: Domain/DDSSecurity/Authentication/Password/#text: testtext_Password_testtext*",
+    "config: Domain/DDSSecurity/Authentication/TrustedCADirectory/#text: testtext_Dir_testtext*",
+    "config: Domain/DDSSecurity/AccessControl/Library/#text: "CONFIG_PLUGIN_MOCK_DIR""CONFIG_LIB_SEP""CONFIG_LIB_PREFIX"dds_security_access_control_all_ok"CONFIG_LIB_SUFFIX"*",
+    "config: Domain/DDSSecurity/AccessControl/Library[@path]: "CONFIG_PLUGIN_MOCK_DIR""CONFIG_LIB_SEP""CONFIG_LIB_PREFIX"dds_security_access_control_all_ok"CONFIG_LIB_SUFFIX"*",
+    "config: Domain/DDSSecurity/AccessControl/Library[@initFunction]: init_access_control*",
+    "config: Domain/DDSSecurity/AccessControl/Library[@finalizeFunction]: finalize_access_control*",
+    "config: Domain/DDSSecurity/AccessControl/PermissionsCA/#text: file:Permissions_CA.pem*",
+    "config: Domain/DDSSecurity/AccessControl/Governance/#text: file:Governance.p7s*",
+    "config: Domain/DDSSecurity/AccessControl/Permissions/#text: file:Permissions.p7s*",
+    "config: Domain/DDSSecurity/Cryptographic/Library/#text: "CONFIG_PLUGIN_MOCK_DIR""CONFIG_LIB_SEP""CONFIG_LIB_PREFIX"dds_security_cryptography_all_ok"CONFIG_LIB_SUFFIX"*",
+    "config: Domain/DDSSecurity/Cryptographic/Library[@path]: "CONFIG_PLUGIN_MOCK_DIR""CONFIG_LIB_SEP""CONFIG_LIB_PREFIX"dds_security_cryptography_all_ok"CONFIG_LIB_SUFFIX"*",
+    "config: Domain/DDSSecurity/Cryptographic/Library[@initFunction]: init_crypto*",
+    "config: Domain/DDSSecurity/Cryptographic/Library[@finalizeFunction]: finalize_crypto*",
+    /* The config should have been parsed into the participant QoS. */
+    "PARTICIPANT * QOS={*property_list={value={"
+      "{dds.sec.auth.library.path,"CONFIG_PLUGIN_MOCK_DIR""CONFIG_LIB_SEP""CONFIG_LIB_PREFIX"dds_security_authentication_all_ok"CONFIG_LIB_SUFFIX",0},"
+      "{dds.sec.auth.library.init,init_authentication,0},"
+      "{dds.sec.auth.library.finalize,finalize_authentication,0},"
+      "{dds.sec.crypto.library.path,"CONFIG_PLUGIN_MOCK_DIR""CONFIG_LIB_SEP""CONFIG_LIB_PREFIX"dds_security_cryptography_all_ok"CONFIG_LIB_SUFFIX",0},"
+      "{dds.sec.crypto.library.init,init_crypto,0},"
+      "{dds.sec.crypto.library.finalize,finalize_crypto,0},"
+      "{dds.sec.access.library.path,"CONFIG_PLUGIN_MOCK_DIR""CONFIG_LIB_SEP""CONFIG_LIB_PREFIX"dds_security_access_control_all_ok"CONFIG_LIB_SUFFIX",0},"
+      "{dds.sec.access.library.init,init_access_control,0},{dds.sec.access.library.finalize,finalize_access_control,0},{dds.sec.auth.identity_ca,testtext_IdentityCA_testtext,0},"
+      "{dds.sec.auth.private_key,testtext_PrivateKey_testtext,0},"
+      "{dds.sec.auth.identity_certificate,testtext_IdentityCertificate_testtext,0},"
+      "{dds.sec.access.permissions_ca,file:Permissions_CA.pem,0},"
+      "{dds.sec.access.governance,file:Governance.p7s,0},"
+      "{dds.sec.access.permissions,file:Permissions.p7s,0},"
+      "{dds.sec.auth.password,testtext_Password_testtext,0},"
+      "{dds.sec.auth.trusted_ca_dir,testtext_Dir_testtext,0}}binary_value={}}*}*",
 #endif
-      NULL
-    };
+    NULL
+  };
 
-    const char *sec_config =
-      "<"DDS_PROJECT_NAME">"
-        "<Domain>"
-          "<Id>any</Id>"
-        "</Domain>"
-        "<DDSI2E>"
-          "<DDSSecurity>"
-            "<Authentication>"
-              "<Library path=\"dds_security_auth\" initFunction=\"init_authentication\" finalizeFunction=\"finalize_authentication\" />"
-              "<IdentityCertificate>testtext_IdentityCertificate_testtext</IdentityCertificate>"
-              "<IdentityCA>testtext_IdentityCA_testtext</IdentityCA>"
-              "<PrivateKey>testtext_PrivateKey_testtext</PrivateKey>"
-              "<Password>testtext_Password_testtext</Password>"
-              "<TrustedCADirectory>testtext_Dir_testtext</TrustedCADirectory>"
-            "</Authentication>"
-            "<Cryptographic>"
-              "<Library path=\"dds_security_crypto\" initFunction=\"init_crypto\" finalizeFunction=\"finalize_crypto\"/>"
-            "</Cryptographic>"
-            "<AccessControl>"
-              "<Library path=\"dds_security_ac\" initFunction=\"init_ac\" finalizeFunction=\"finalize_ac\"/>"
-              "<Governance>file:Governance.p7s</Governance>"
-              "<PermissionsCA>file:Permissions_CA.pem</PermissionsCA>"
-              "<Permissions>file:Permissions.p7s</Permissions>"
-            "</AccessControl>"
-          "</DDSSecurity>"
-          "<Tracing><Verbosity>finest</></>"
-        "</DDSI2E>"
-      "</"DDS_PROJECT_NAME">";
+  const char *sec_config =
+    "<"DDS_PROJECT_NAME">"
+      "<Domain>"
+      "<Id>any</Id>"
+      "</Domain>"
+      "<DDSI2E>"
+        "<DDSSecurity>"
+          "<Authentication>"
+            "<Library path=\""CONFIG_PLUGIN_MOCK_DIR""CONFIG_LIB_SEP""CONFIG_LIB_PREFIX"dds_security_authentication_all_ok"CONFIG_LIB_SUFFIX"\" initFunction=\"init_authentication\" finalizeFunction=\"finalize_authentication\" />"
+            "<IdentityCertificate>testtext_IdentityCertificate_testtext</IdentityCertificate>"
+            "<IdentityCA>testtext_IdentityCA_testtext</IdentityCA>"
+            "<PrivateKey>testtext_PrivateKey_testtext</PrivateKey>"
+            "<Password>testtext_Password_testtext</Password>"
+            "<TrustedCADirectory>testtext_Dir_testtext</TrustedCADirectory>"
+          "</Authentication>"
+          "<Cryptographic>"
+            "<Library path=\""CONFIG_PLUGIN_MOCK_DIR""CONFIG_LIB_SEP""CONFIG_LIB_PREFIX"dds_security_cryptography_all_ok"CONFIG_LIB_SUFFIX"\" initFunction=\"init_crypto\" finalizeFunction=\"finalize_crypto\"/>"
+          "</Cryptographic>"
+          "<AccessControl>"
+            "<Library path=\""CONFIG_PLUGIN_MOCK_DIR""CONFIG_LIB_SEP""CONFIG_LIB_PREFIX"dds_security_access_control_all_ok"CONFIG_LIB_SUFFIX"\" initFunction=\"init_access_control\" finalizeFunction=\"finalize_access_control\"/>"
+            "<Governance>file:Governance.p7s</Governance>"
+            "<PermissionsCA>file:Permissions_CA.pem</PermissionsCA>"
+            "<Permissions>file:Permissions.p7s</Permissions>"
+          "</AccessControl>"
+        "</DDSSecurity>"
+        "<Tracing><Verbosity>finest</></>"
+      "</DDSI2E>"
+    "</"DDS_PROJECT_NAME">";
 
+  dds_entity_t participant;
 
-    dds_entity_t participant;
+  /* Set up the trace sinks to detect the config parsing. */
+  dds_set_log_mask(DDS_LC_FATAL|DDS_LC_ERROR|DDS_LC_WARNING|DDS_LC_CONFIG);
+  dds_set_log_sink(&logger, (void*)log_expected);
+  dds_set_trace_sink(&logger, (void*)log_expected);
 
-    /* Set up the trace sinks to detect the config parsing. */
-    dds_set_log_mask(DDS_LC_FATAL|DDS_LC_ERROR|DDS_LC_WARNING|DDS_LC_CONFIG);
-    dds_set_log_sink(&logger, (void*)log_expected);
-    dds_set_trace_sink(&logger, (void*)log_expected);
+  /* Create participant with security elements. */
+  found = 0;
+  ddsrt_setenv(URI_VARIABLE, sec_config);
+  participant = dds_create_participant(DDS_DOMAIN_DEFAULT, NULL, NULL);
+  ddsrt_setenv(URI_VARIABLE, "");
+  dds_delete(participant);
+  dds_set_log_sink(NULL, NULL);
+  dds_set_trace_sink(NULL, NULL);
 
-    /* Create participant with security elements. */
-    found = 0;
-    ddsrt_setenv(URI_VARIABLE, sec_config);
-    participant = dds_create_participant(DDS_DOMAIN_DEFAULT, NULL, NULL);
-    ddsrt_setenv(URI_VARIABLE, "");
-    dds_delete(participant);
-
-    /* All traces should have been provided. */
+  /* All traces should have been provided. */
 #ifndef DDSI_INCLUDE_SECURITY
-    CU_ASSERT_FATAL(found == 0x1);
+  CU_ASSERT_FATAL(found == 0x1);
 #else
-    CU_ASSERT_FATAL(found == 0x1fffff);
+  CU_ASSERT_FATAL(found == 0x1fffff);
 #endif
 }
 
 CU_Test(ddsc_config, security_qos, .init = ddsrt_init, .fini = ddsrt_fini)
 {
-    /* Expected traces when creating participant with the security elements. */
-    const char *log_expected[] = {
+  /* Expected traces when creating participant with the security elements. */
+  const char *log_expected[] = {
 #ifdef DDSI_INCLUDE_SECURITY
-      /* The config should have been parsed into the participant QoS. */
-      "PARTICIPANT * QOS={*property_list={value={"
-        "{dds.sec.auth.identity_ca,testtext_IdentityCA_testtext,0},"
-        "{dds.sec.auth.private_key,testtext_PrivateKey_testtext,0},"
-        "{dds.sec.auth.identity_certificate,testtext_IdentityCertificate_testtext,0},"
-        "{dds.sec.access.permissions_ca,file:Permissions_CA.pem,0},"
-        "{dds.sec.access.governance,file:Governance.p7s,0},"
-        "{dds.sec.access.permissions,file:Permissions.p7s,0},"
-        "{dds.sec.auth.password,testtext_Password_testtext,0},"
-        "{dds.sec.auth.trusted_ca_dir,file:/test/dir,0}"
-        "}binary_value={}}*}*",
-#endif
-      NULL
-    };
+  /* The config should have been parsed into the participant QoS. */
+  "PARTICIPANT * QOS={*property_list={value={"
+    "{dds.sec.auth.identity_ca,testtext_IdentityCA_testtext,0},"
+    "{dds.sec.auth.private_key,testtext_PrivateKey_testtext,0},"
+    "{dds.sec.auth.identity_certificate,testtext_IdentityCertificate_testtext,0},"
+    "{dds.sec.access.permissions_ca,file:Permissions_CA.pem,0},"
+    "{dds.sec.access.governance,file:Governance.p7s,0},"
+    "{dds.sec.access.permissions,file:Permissions.p7s,0},"
+    "{dds.sec.auth.password,testtext_Password_testtext,0},"
+    "{dds.sec.auth.trusted_ca_dir,file:/test/dir,0},"
+    "{dds.sec.auth.library.path,"CONFIG_PLUGIN_MOCK_DIR""CONFIG_LIB_SEP""CONFIG_LIB_PREFIX"dds_security_authentication_all_ok"CONFIG_LIB_SUFFIX",0},"
+    "{dds.sec.auth.library.init,init_authentication,0},"
+    "{dds.sec.auth.library.finalize,finalize_authentication,0},"
+    "{dds.sec.crypto.library.path,"CONFIG_PLUGIN_MOCK_DIR""CONFIG_LIB_SEP""CONFIG_LIB_PREFIX"dds_security_cryptography_all_ok"CONFIG_LIB_SUFFIX",0},"
+    "{dds.sec.crypto.library.init,init_crypto,0},"
+    "{dds.sec.crypto.library.finalize,finalize_crypto,0},"
+    "{dds.sec.access.library.path,"CONFIG_PLUGIN_MOCK_DIR""CONFIG_LIB_SEP""CONFIG_LIB_PREFIX"dds_security_access_control_all_ok"CONFIG_LIB_SUFFIX",0},"
+    "{dds.sec.access.library.init,init_access_control,0},"
+    "{dds.sec.access.library.finalize,finalize_access_control,0}}binary_value={}}*}*",
+  #endif
+    NULL
+  };
 
-    dds_entity_t participant;
-    dds_qos_t * qos;
+  dds_entity_t participant;
+  dds_qos_t * qos;
 
-    /* Set up the trace sinks to detect the config parsing. */
-    dds_set_log_mask(DDS_LC_FATAL|DDS_LC_ERROR|DDS_LC_WARNING|DDS_LC_CONFIG);
-    dds_set_log_sink(&logger, (void*)log_expected);
-    dds_set_trace_sink(&logger, (void*)log_expected);
+  /* Set up the trace sinks to detect the config parsing. */
+  dds_set_log_mask(DDS_LC_FATAL|DDS_LC_ERROR|DDS_LC_WARNING|DDS_LC_CONFIG);
+  dds_set_log_sink(&logger, (void*)log_expected);
+  dds_set_trace_sink(&logger, (void*)log_expected);
 
-    /* Create the qos */
-    CU_ASSERT_FATAL ((qos = dds_create_qos()) != NULL);
-    dds_qset_prop (qos, "dds.sec.auth.identity_ca", "testtext_IdentityCA_testtext");
-    dds_qset_prop (qos, "dds.sec.auth.private_key", "testtext_PrivateKey_testtext");
-    dds_qset_prop (qos, "dds.sec.auth.identity_certificate", "testtext_IdentityCertificate_testtext");
-    dds_qset_prop (qos, "dds.sec.access.permissions_ca", "file:Permissions_CA.pem");
-    dds_qset_prop (qos, "dds.sec.access.governance", "file:Governance.p7s");
-    dds_qset_prop (qos, "dds.sec.access.permissions", "file:Permissions.p7s");
-    dds_qset_prop (qos, "dds.sec.auth.password", "testtext_Password_testtext");
-    dds_qset_prop (qos, "dds.sec.auth.trusted_ca_dir", "file:/test/dir");
+  /* Create the qos */
+  CU_ASSERT_FATAL((qos = dds_create_qos()) != NULL);
+  dds_qset_prop(qos, "dds.sec.auth.identity_ca", "testtext_IdentityCA_testtext");
+  dds_qset_prop(qos, "dds.sec.auth.private_key", "testtext_PrivateKey_testtext");
+  dds_qset_prop(qos, "dds.sec.auth.identity_certificate", "testtext_IdentityCertificate_testtext");
+  dds_qset_prop(qos, "dds.sec.access.permissions_ca", "file:Permissions_CA.pem");
+  dds_qset_prop(qos, "dds.sec.access.governance", "file:Governance.p7s");
+  dds_qset_prop(qos, "dds.sec.access.permissions", "file:Permissions.p7s");
+  dds_qset_prop(qos, "dds.sec.auth.password", "testtext_Password_testtext");
+  dds_qset_prop(qos, "dds.sec.auth.trusted_ca_dir", "file:/test/dir");
+  dds_qset_prop(qos, "dds.sec.auth.library.path", ""CONFIG_PLUGIN_MOCK_DIR""CONFIG_LIB_SEP""CONFIG_LIB_PREFIX"dds_security_authentication_all_ok"CONFIG_LIB_SUFFIX"");
+  dds_qset_prop(qos, "dds.sec.auth.library.init", "init_authentication");
+  dds_qset_prop(qos, "dds.sec.auth.library.finalize", "finalize_authentication");
+  dds_qset_prop(qos, "dds.sec.crypto.library.path", ""CONFIG_PLUGIN_MOCK_DIR""CONFIG_LIB_SEP""CONFIG_LIB_PREFIX"dds_security_cryptography_all_ok"CONFIG_LIB_SUFFIX"");
+  dds_qset_prop(qos, "dds.sec.crypto.library.init", "init_crypto");
+  dds_qset_prop(qos, "dds.sec.crypto.library.finalize", "finalize_crypto");
+  dds_qset_prop(qos, "dds.sec.access.library.path", ""CONFIG_PLUGIN_MOCK_DIR""CONFIG_LIB_SEP""CONFIG_LIB_PREFIX"dds_security_access_control_all_ok"CONFIG_LIB_SUFFIX"");
+  dds_qset_prop(qos, "dds.sec.access.library.init", "init_access_control");
+  dds_qset_prop(qos, "dds.sec.access.library.finalize", "finalize_access_control");
 
-    /* Create participant with security config in qos. */
-    found = 0;
-    ddsrt_setenv(URI_VARIABLE, "<Tracing><Verbosity>finest</></>");
-    CU_ASSERT_FATAL ((participant = dds_create_participant(DDS_DOMAIN_DEFAULT, qos, NULL)) > 0);
-    ddsrt_setenv(URI_VARIABLE, "");
-    dds_delete(participant);
-    dds_delete_qos(qos);
+  /* Create participant with security config in qos. */
+  found = 0;
+  ddsrt_setenv(URI_VARIABLE, "<Tracing><Verbosity>finest</></>");
+  CU_ASSERT_FATAL ((participant = dds_create_participant(DDS_DOMAIN_DEFAULT, qos, NULL)) > 0);
+  ddsrt_setenv(URI_VARIABLE, "");
+  dds_delete(participant);
+  dds_delete_qos(qos);
+  dds_set_log_sink(NULL, NULL);
+  dds_set_trace_sink(NULL, NULL);
 
-    /* All traces should have been provided. */
+  /* All traces should have been provided. */
 #ifndef DDSI_INCLUDE_SECURITY
-    CU_ASSERT_FATAL(found == 0);
+  CU_ASSERT_FATAL(found == 0);
 #else
-    CU_ASSERT_FATAL(found == 0x1);
+  CU_ASSERT_FATAL(found == 0x1);
 #endif
 }
 
 CU_Test(ddsc_config, security_qos_props, .init = ddsrt_init, .fini = ddsrt_fini)
 {
-    /* Expected traces when creating participant with the security elements. */
-    const char *log_expected[] = {
+  /* Expected traces when creating participant with the security elements. */
+  const char *log_expected[] = {
 #ifdef DDSI_INCLUDE_SECURITY
-      /* The config should have been parsed into the participant QoS. */
-      "PARTICIPANT * QOS={*property_list={value={"
-        "{test.prop1,testtext_value1_testtext,0},"
-        "{dds.sec.auth.identity_ca,testtext_IdentityCA_testtext,0},"
-        "{dds.sec.auth.private_key,testtext_PrivateKey_testtext,0},"
-        "{dds.sec.auth.identity_certificate,testtext_IdentityCertificate_testtext,0},"
-        "{dds.sec.access.permissions_ca,file:Permissions_CA.pem,0},"
-        "{dds.sec.access.governance,file:Governance.p7s,0},"
-        "{dds.sec.access.permissions,file:Permissions.p7s,0},"
-        "{dds.sec.auth.password,testtext_Password_testtext,0},"
-        "{dds.sec.auth.trusted_ca_dir,file:/test/dir,0},"
-        "{test.prop2,testtext_value2_testtext,0}}"
-        "binary_value={{test.bprop1,(3,*),0}}}*}*",
-#endif
-      NULL
-    };
+    /* The config should have been parsed into the participant QoS. */
+    "PARTICIPANT * QOS={*property_list={value={"
+      "{test.prop1,testtext_value1_testtext,0},"
+      "{dds.sec.auth.identity_ca,testtext_IdentityCA_testtext,0},"
+      "{dds.sec.auth.private_key,testtext_PrivateKey_testtext,0},"
+      "{dds.sec.auth.identity_certificate,testtext_IdentityCertificate_testtext,0},"
+      "{dds.sec.access.permissions_ca,file:Permissions_CA.pem,0},"
+      "{dds.sec.access.governance,file:Governance.p7s,0},"
+      "{dds.sec.access.permissions,file:Permissions.p7s,0},"
+      "{dds.sec.auth.password,testtext_Password_testtext,0},"
+      "{dds.sec.auth.trusted_ca_dir,file:/test/dir,0},"
+      "{dds.sec.auth.library.path,"CONFIG_PLUGIN_MOCK_DIR""CONFIG_LIB_SEP""CONFIG_LIB_PREFIX"dds_security_authentication_all_ok"CONFIG_LIB_SUFFIX",0},"
+      "{dds.sec.auth.library.init,init_authentication,0},"
+      "{dds.sec.auth.library.finalize,finalize_authentication,0},"
+      "{dds.sec.crypto.library.path,"CONFIG_PLUGIN_MOCK_DIR""CONFIG_LIB_SEP""CONFIG_LIB_PREFIX"dds_security_cryptography_all_ok"CONFIG_LIB_SUFFIX",0},"
+      "{dds.sec.crypto.library.init,init_crypto,0},"
+      "{dds.sec.crypto.library.finalize,finalize_crypto,0},"
+      "{dds.sec.access.library.path,"CONFIG_PLUGIN_MOCK_DIR""CONFIG_LIB_SEP""CONFIG_LIB_PREFIX"dds_security_access_control_all_ok"CONFIG_LIB_SUFFIX",0},"
+      "{dds.sec.access.library.init,init_access_control,0},"
+      "{dds.sec.access.library.finalize,finalize_access_control,0},"
+      "{test.prop2,testtext_value2_testtext,0}}"
+      "binary_value={{test.bprop1,(3,*),0}}}*}*",
 
-    dds_entity_t participant;
-    dds_qos_t * qos;
+  #endif
+    NULL
+  };
 
-    /* Set up the trace sinks to detect the config parsing. */
-    dds_set_log_mask(DDS_LC_FATAL|DDS_LC_ERROR|DDS_LC_WARNING|DDS_LC_CONFIG);
-    dds_set_log_sink(&logger, (void*)log_expected);
-    dds_set_trace_sink(&logger, (void*)log_expected);
+  dds_entity_t participant;
+  dds_qos_t * qos;
 
-    /* Create the qos */
-    unsigned char bvalue[3] = { 0x01, 0x02, 0x03 };
-    CU_ASSERT_FATAL ((qos = dds_create_qos()) != NULL);
-    dds_qset_prop (qos, "test.prop1", "testtext_value1_testtext");
-    dds_qset_prop (qos, "dds.sec.auth.identity_ca", "testtext_IdentityCA_testtext");
-    dds_qset_prop (qos, "dds.sec.auth.private_key", "testtext_PrivateKey_testtext");
-    dds_qset_prop (qos, "dds.sec.auth.identity_certificate", "testtext_IdentityCertificate_testtext");
-    dds_qset_prop (qos, "dds.sec.access.permissions_ca", "file:Permissions_CA.pem");
-    dds_qset_prop (qos, "dds.sec.access.governance", "file:Governance.p7s");
-    dds_qset_prop (qos, "dds.sec.access.permissions", "file:Permissions.p7s");
-    dds_qset_prop (qos, "dds.sec.auth.password", "testtext_Password_testtext");
-    dds_qset_prop (qos, "dds.sec.auth.trusted_ca_dir", "file:/test/dir");
-    dds_qset_prop (qos, "test.prop2", "testtext_value2_testtext");
-    dds_qset_bprop (qos, "test.bprop1", bvalue, 3);
+  /* Set up the trace sinks to detect the config parsing. */
+  dds_set_log_mask(DDS_LC_FATAL | DDS_LC_ERROR | DDS_LC_WARNING | DDS_LC_CONFIG);
+  dds_set_log_sink(&logger, (void*)log_expected);
+  dds_set_trace_sink(&logger, (void*)log_expected);
 
-    /* Create participant with security config in qos. */
-    found = 0;
-    ddsrt_setenv(URI_VARIABLE, "<Tracing><Verbosity>finest</></>");
-    CU_ASSERT_FATAL ((participant = dds_create_participant(DDS_DOMAIN_DEFAULT, qos, NULL)) > 0);
-    ddsrt_setenv(URI_VARIABLE, "");
-    dds_delete(participant);
-    dds_delete_qos(qos);
+  /* Create the qos */
+  unsigned char bvalue[3] = { 0x01, 0x02, 0x03 };
+  CU_ASSERT_FATAL((qos = dds_create_qos()) != NULL);
+  dds_qset_prop(qos, "test.prop1", "testtext_value1_testtext");
+  dds_qset_prop(qos, "dds.sec.auth.identity_ca", "testtext_IdentityCA_testtext");
+  dds_qset_prop(qos, "dds.sec.auth.private_key", "testtext_PrivateKey_testtext");
+  dds_qset_prop(qos, "dds.sec.auth.identity_certificate", "testtext_IdentityCertificate_testtext");
+  dds_qset_prop(qos, "dds.sec.access.permissions_ca", "file:Permissions_CA.pem");
+  dds_qset_prop(qos, "dds.sec.access.governance", "file:Governance.p7s");
+  dds_qset_prop(qos, "dds.sec.access.permissions", "file:Permissions.p7s");
+  dds_qset_prop(qos, "dds.sec.auth.password", "testtext_Password_testtext");
+  dds_qset_prop(qos, "dds.sec.auth.trusted_ca_dir", "file:/test/dir");
 
-    /* All traces should have been provided. */
+  dds_qset_prop(qos, "dds.sec.auth.library.path", ""CONFIG_PLUGIN_MOCK_DIR""CONFIG_LIB_SEP""CONFIG_LIB_PREFIX"dds_security_authentication_all_ok"CONFIG_LIB_SUFFIX"");
+  dds_qset_prop(qos, "dds.sec.auth.library.init", "init_authentication");
+  dds_qset_prop(qos, "dds.sec.auth.library.finalize", "finalize_authentication");
+  dds_qset_prop(qos, "dds.sec.crypto.library.path", ""CONFIG_PLUGIN_MOCK_DIR""CONFIG_LIB_SEP""CONFIG_LIB_PREFIX"dds_security_cryptography_all_ok"CONFIG_LIB_SUFFIX"");
+  dds_qset_prop(qos, "dds.sec.crypto.library.init", "init_crypto");
+  dds_qset_prop(qos, "dds.sec.crypto.library.finalize", "finalize_crypto");
+  dds_qset_prop(qos, "dds.sec.access.library.path", ""CONFIG_PLUGIN_MOCK_DIR""CONFIG_LIB_SEP""CONFIG_LIB_PREFIX"dds_security_access_control_all_ok"CONFIG_LIB_SUFFIX"");
+  dds_qset_prop(qos, "dds.sec.access.library.init", "init_access_control");
+  dds_qset_prop(qos, "dds.sec.access.library.finalize", "finalize_access_control");
+
+  dds_qset_prop(qos, "test.prop2", "testtext_value2_testtext");
+
+  dds_qset_prop(qos, "dds.sec.auth.identity_ca", "testtext_IdentityCA_testtext");
+
+  dds_qset_bprop(qos, "test.bprop1", bvalue, 3);
+
+  /* Create participant with security config in qos. */
+  found = 0;
+  ddsrt_setenv(URI_VARIABLE, "<Tracing><Verbosity>finest</></>");
+  participant = dds_create_participant(DDS_DOMAIN_DEFAULT, qos, NULL);
+  CU_ASSERT_FATAL(participant > 0);
+  ddsrt_setenv(URI_VARIABLE, "");
+  dds_delete(participant);
+  dds_set_log_sink(NULL, NULL);
+  dds_set_trace_sink(NULL, NULL);
+  dds_delete_qos(qos);
+
+
+  /* All traces should have been provided. */
 #ifndef DDSI_INCLUDE_SECURITY
-    CU_ASSERT_FATAL(found == 0);
+  CU_ASSERT_FATAL(found == 0);
 #else
-    CU_ASSERT_FATAL(found == 0x1);
+  CU_ASSERT_FATAL(found == 0x1);
 #endif
 }
 
 CU_Test(ddsc_config, security_config_qos, .init = ddsrt_init, .fini = ddsrt_fini)
 {
-    /* Expect qos settings used when creating participant with config security elements and qos. */
-    const char *log_expected[] = {
+  /* Expect qos settings used when creating participant with config security elements and qos. */
+  const char *log_expected[] = {
 #ifndef DDSI_INCLUDE_SECURITY
-      "config: //CycloneDDS/Domain: DDSSecurity: unknown element*",
+    "config: //CycloneDDS/Domain: DDSSecurity: unknown element*",
 #else
-      /* The security settings from qos properties should have been parsed into the participant QoS. */
-      "new_participant(*): using security settings from QoS, ignoring security configuration*",
-      "PARTICIPANT * QOS={*property_list={value={"
-        "{dds.sec.auth.identity_ca,testtext_QOS_IdentityCA_testtext,0},"
-        "{dds.sec.auth.private_key,testtext_QOS_PrivateKey_testtext,0},"
-        "{dds.sec.auth.identity_certificate,testtext_QOS_IdentityCertificate_testtext,0},"
-        "{dds.sec.access.permissions_ca,file:QOS_Permissions_CA.pem,0},"
-        "{dds.sec.access.governance,file:QOS_Governance.p7s,0},"
-        "{dds.sec.access.permissions,file:QOS_Permissions.p7s,0}"
-        "}binary_value={}}*}*",
+    /* The security settings from qos properties should have been parsed into the participant QoS. */
+    "new_participant(*): using security settings from QoS*",
+    "PARTICIPANT * QOS={*property_list={value={"
+      "{dds.sec.auth.identity_ca,testtext_QOS_IdentityCA_testtext,0},"
+      "{dds.sec.auth.private_key,testtext_QOS_PrivateKey_testtext,0},"
+      "{dds.sec.auth.identity_certificate,testtext_QOS_IdentityCertificate_testtext,0},"
+      "{dds.sec.access.permissions_ca,file:QOS_Permissions_CA.pem,0},"
+      "{dds.sec.access.governance,file:QOS_Governance.p7s,0},"
+      "{dds.sec.access.permissions,file:QOS_Permissions.p7s,0},"
+      "{dds.sec.auth.library.path,"CONFIG_PLUGIN_MOCK_DIR""CONFIG_LIB_SEP""CONFIG_LIB_PREFIX"dds_security_authentication_all_ok"CONFIG_LIB_SUFFIX",0},"
+      "{dds.sec.auth.library.init,init_authentication,0},"
+      "{dds.sec.auth.library.finalize,finalize_authentication,0},"
+      "{dds.sec.crypto.library.path,"CONFIG_PLUGIN_MOCK_DIR""CONFIG_LIB_SEP""CONFIG_LIB_PREFIX"dds_security_cryptography_all_ok"CONFIG_LIB_SUFFIX",0},"
+      "{dds.sec.crypto.library.init,init_crypto,0},"
+      "{dds.sec.crypto.library.finalize,finalize_crypto,0},"
+      "{dds.sec.access.library.path,"CONFIG_PLUGIN_MOCK_DIR""CONFIG_LIB_SEP""CONFIG_LIB_PREFIX"dds_security_access_control_all_ok"CONFIG_LIB_SUFFIX",0},"
+      "{dds.sec.access.library.init,init_access_control,0},"
+      "{dds.sec.access.library.finalize,finalize_access_control,0}"
+      "}binary_value={}}*}*",
+  #endif
+    NULL
+  };
+
+  const char *sec_config =
+    "<Tracing><Verbosity>finest</></>"
+    "<DDSSecurity>"
+      "<Authentication>"
+      "<IdentityCertificate>testtext_IdentityCertificate_testtext</IdentityCertificate>"
+      "<IdentityCA>testtext_IdentityCA_testtext</IdentityCA>"
+      "<PrivateKey>testtext_PrivateKey_testtext</PrivateKey>"
+    "</Authentication>"
+    "<AccessControl>"
+      "<Governance>file:Governance.p7s</Governance>"
+      "<PermissionsCA>file:Permissions_CA.pem</PermissionsCA>"
+      "<Permissions>file:Permissions.p7s</Permissions>"
+    "</AccessControl>"
+    "</DDSSecurity>";
+
+  dds_entity_t participant;
+  dds_qos_t * qos;
+
+  CU_ASSERT_FATAL((qos = dds_create_qos()) != NULL);
+  dds_qset_prop(qos, "dds.sec.auth.identity_ca", "testtext_QOS_IdentityCA_testtext");
+  dds_qset_prop(qos, "dds.sec.auth.private_key", "testtext_QOS_PrivateKey_testtext");
+  dds_qset_prop(qos, "dds.sec.auth.identity_certificate", "testtext_QOS_IdentityCertificate_testtext");
+  dds_qset_prop(qos, "dds.sec.access.permissions_ca", "file:QOS_Permissions_CA.pem");
+  dds_qset_prop(qos, "dds.sec.access.governance", "file:QOS_Governance.p7s");
+  dds_qset_prop(qos, "dds.sec.access.permissions", "file:QOS_Permissions.p7s");
+#ifdef DDSI_INCLUDE_SECURITY /*for using with constants coming from API */
+  dds_qset_prop(qos, DDS_SEC_PROP_AUTH_LIBRARY_PATH, ""CONFIG_PLUGIN_MOCK_DIR""CONFIG_LIB_SEP""CONFIG_LIB_PREFIX"dds_security_authentication_all_ok"CONFIG_LIB_SUFFIX"");
+  dds_qset_prop(qos, DDS_SEC_PROP_AUTH_LIBRARY_INIT, "init_authentication");
+  dds_qset_prop(qos, DDS_SEC_PROP_AUTH_LIBRARY_FINALIZE, "finalize_authentication");
+  dds_qset_prop(qos, DDS_SEC_PROP_CRYPTO_LIBRARY_PATH, ""CONFIG_PLUGIN_MOCK_DIR""CONFIG_LIB_SEP""CONFIG_LIB_PREFIX"dds_security_cryptography_all_ok"CONFIG_LIB_SUFFIX"");
+  dds_qset_prop(qos, DDS_SEC_PROP_CRYPTO_LIBRARY_INIT, "init_crypto");
+  dds_qset_prop(qos, DDS_SEC_PROP_CRYPTO_LIBRARY_FINALIZE, "finalize_crypto");
+  dds_qset_prop(qos, DDS_SEC_PROP_ACCESS_LIBRARY_PATH, ""CONFIG_PLUGIN_MOCK_DIR""CONFIG_LIB_SEP""CONFIG_LIB_PREFIX"dds_security_access_control_all_ok"CONFIG_LIB_SUFFIX"");
+  dds_qset_prop(qos, DDS_SEC_PROP_ACCESS_LIBRARY_INIT, "init_access_control");
+  dds_qset_prop(qos, DDS_SEC_PROP_ACCESS_LIBRARY_FINALIZE, "finalize_access_control");
 #endif
-      NULL
-    };
+  /* Set up the trace sinks to detect the config parsing. */
+  dds_set_log_mask(DDS_LC_FATAL | DDS_LC_ERROR | DDS_LC_WARNING | DDS_LC_CONFIG);
+  dds_set_log_sink(&logger, (void*)log_expected);
+  dds_set_trace_sink(&logger, (void*)log_expected);
 
-    const char *sec_config =
-      "<Tracing><Verbosity>finest</></>"
-      "<DDSSecurity>"
-        "<Authentication>"
-          "<IdentityCertificate>testtext_IdentityCertificate_testtext</IdentityCertificate>"
-          "<IdentityCA>testtext_IdentityCA_testtext</IdentityCA>"
-          "<PrivateKey>testtext_PrivateKey_testtext</PrivateKey>"
-        "</Authentication>"
-        "<AccessControl>"
-          "<Governance>file:Governance.p7s</Governance>"
-          "<PermissionsCA>file:Permissions_CA.pem</PermissionsCA>"
-          "<Permissions>file:Permissions.p7s</Permissions>"
-        "</AccessControl>"
-      "</DDSSecurity>";
+  /* Create participant with security elements. */
+  found = 0;
+  ddsrt_setenv(URI_VARIABLE, sec_config);
+  participant = dds_create_participant(DDS_DOMAIN_DEFAULT, qos, NULL);
+  ddsrt_setenv(URI_VARIABLE, "");
+  dds_delete(participant);
+  dds_set_log_sink(NULL, NULL);
+  dds_set_trace_sink(NULL, NULL);
+  dds_delete_qos(qos);
 
-    dds_entity_t participant;
-    dds_qos_t * qos;
-
-    CU_ASSERT_FATAL ((qos = dds_create_qos()) != NULL);
-    dds_qset_prop (qos, "dds.sec.auth.identity_ca", "testtext_QOS_IdentityCA_testtext");
-    dds_qset_prop (qos, "dds.sec.auth.private_key", "testtext_QOS_PrivateKey_testtext");
-    dds_qset_prop (qos, "dds.sec.auth.identity_certificate", "testtext_QOS_IdentityCertificate_testtext");
-    dds_qset_prop (qos, "dds.sec.access.permissions_ca", "file:QOS_Permissions_CA.pem");
-    dds_qset_prop (qos, "dds.sec.access.governance", "file:QOS_Governance.p7s");
-    dds_qset_prop (qos, "dds.sec.access.permissions", "file:QOS_Permissions.p7s");
-
-    /* Set up the trace sinks to detect the config parsing. */
-    dds_set_log_mask(DDS_LC_FATAL|DDS_LC_ERROR|DDS_LC_WARNING|DDS_LC_CONFIG);
-    dds_set_log_sink(&logger, (void*)log_expected);
-    dds_set_trace_sink(&logger, (void*)log_expected);
-
-    /* Create participant with security elements. */
-    found = 0;
-    ddsrt_setenv(URI_VARIABLE, sec_config);
-    participant = dds_create_participant(DDS_DOMAIN_DEFAULT, qos, NULL);
-    ddsrt_setenv(URI_VARIABLE, "");
-    dds_delete(participant);
-    dds_delete_qos(qos);
-
-    /* All traces should have been provided. */
+  /* All traces should have been provided. */
 #ifndef DDSI_INCLUDE_SECURITY
-    CU_ASSERT_FATAL(found == 0x1);
+  CU_ASSERT_FATAL(found == 0x1);
 #else
-    CU_ASSERT_FATAL(found == 0x3);
+  CU_ASSERT_FATAL(found == 0x3);
 #endif
 }
 
 CU_Test(ddsc_config, security_other_prop, .init = ddsrt_init, .fini = ddsrt_fini)
 {
-    /* Expect config used when creating participant with config security elements and
-     * qos containing only non-security properties. */
-    const char *log_expected[] = {
+  /* Expect config used when creating participant with config security elements and
+   * qos containing only non-security properties. */
+  const char *log_expected[] = {
 #ifndef DDSI_INCLUDE_SECURITY
-      "config: //CycloneDDS/Domain: DDSSecurity: unknown element*",
+    "config: //CycloneDDS/Domain: DDSSecurity: unknown element*",
 #else
-      /* The security settings from config should have been parsed into the participant QoS. */
-      "PARTICIPANT * QOS={*property_list={value={"
-        "{test.dds.sec.prop1,testtext_value1_testtext,0},"
-        "{dds.sec.auth.identity_ca,testtext_IdentityCA_testtext,0},"
-        "{dds.sec.auth.private_key,testtext_PrivateKey_testtext,0},"
-        "{dds.sec.auth.identity_certificate,testtext_IdentityCertificate_testtext,0},"
-        "{dds.sec.access.permissions_ca,file:Permissions_CA.pem,0},"
-        "{dds.sec.access.governance,file:Governance.p7s,0},"
-        "{dds.sec.access.permissions,file:Permissions.p7s,0}"
-        "}binary_value={}}*}*",
-#endif
-      NULL
-    };
+    /* The security settings from config should have been parsed into the participant QoS. */
+    "PARTICIPANT * QOS={*property_list={value={{test.dds.sec.prop1,testtext_value1_testtext,0},"
+      "{dds.sec.auth.library.path,"CONFIG_PLUGIN_MOCK_DIR""CONFIG_LIB_SEP""CONFIG_LIB_PREFIX"dds_security_authentication_all_ok"CONFIG_LIB_SUFFIX",0},"
+      "{dds.sec.auth.library.init,init_authentication,0},"
+      "{dds.sec.auth.library.finalize,finalize_authentication,0},"
+      "{dds.sec.crypto.library.path,"CONFIG_PLUGIN_MOCK_DIR""CONFIG_LIB_SEP""CONFIG_LIB_PREFIX"dds_security_cryptography_all_ok"CONFIG_LIB_SUFFIX",0},"
+      "{dds.sec.crypto.library.init,init_crypto,0},"
+      "{dds.sec.crypto.library.finalize,finalize_crypto,0},"
+      "{dds.sec.access.library.path,"CONFIG_PLUGIN_MOCK_DIR""CONFIG_LIB_SEP""CONFIG_LIB_PREFIX"dds_security_access_control_all_ok"CONFIG_LIB_SUFFIX",0},"
+      "{dds.sec.access.library.init,init_access_control,0},"
+      "{dds.sec.access.library.finalize,finalize_access_control,0},"
+      "{dds.sec.auth.identity_ca,testtext_IdentityCA_testtext,0},"
+      "{dds.sec.auth.private_key,testtext_PrivateKey_testtext,0},"
+      "{dds.sec.auth.identity_certificate,testtext_IdentityCertificate_testtext,0},"
+      "{dds.sec.access.permissions_ca,file:Permissions_CA.pem,0},"
+      "{dds.sec.access.governance,file:Governance.p7s,0},"
+      "{dds.sec.access.permissions,file:Permissions.p7s,0},"
+      "{dds.sec.auth.password,testtext_Password_testtext,0},"
+      "{dds.sec.auth.trusted_ca_dir,testtext_Dir_testtext,0}}binary_value={}}*}*",
+  #endif
+    NULL
+  };
 
-    const char *sec_config =
-      "<Tracing><Verbosity>finest</></>"
-      "<DDSSecurity>"
-        "<Authentication>"
-          "<IdentityCertificate>testtext_IdentityCertificate_testtext</IdentityCertificate>"
-          "<IdentityCA>testtext_IdentityCA_testtext</IdentityCA>"
-          "<PrivateKey>testtext_PrivateKey_testtext</PrivateKey>"
-        "</Authentication>"
-        "<AccessControl>"
-          "<Governance>file:Governance.p7s</Governance>"
-          "<PermissionsCA>file:Permissions_CA.pem</PermissionsCA>"
-          "<Permissions>file:Permissions.p7s</Permissions>"
-        "</AccessControl>"
-      "</DDSSecurity>";
+  const char *sec_config =
+    "<Tracing><Verbosity>finest</></>"
+    "<DDSSecurity>"
+      "<Authentication>"
+        "<Library path=\""CONFIG_PLUGIN_MOCK_DIR""CONFIG_LIB_SEP""CONFIG_LIB_PREFIX"dds_security_authentication_all_ok"CONFIG_LIB_SUFFIX"\" initFunction=\"init_authentication\" finalizeFunction=\"finalize_authentication\" />"
+        "<IdentityCertificate>testtext_IdentityCertificate_testtext</IdentityCertificate>"
+        "<IdentityCA>testtext_IdentityCA_testtext</IdentityCA>"
+        "<PrivateKey>testtext_PrivateKey_testtext</PrivateKey>"
+        "<Password>testtext_Password_testtext</Password>"
+        "<TrustedCADirectory>testtext_Dir_testtext</TrustedCADirectory>"
+      "</Authentication>"
+      "<Cryptographic>"
+        "<Library path=\""CONFIG_PLUGIN_MOCK_DIR""CONFIG_LIB_SEP""CONFIG_LIB_PREFIX"dds_security_cryptography_all_ok"CONFIG_LIB_SUFFIX"\" initFunction=\"init_crypto\" finalizeFunction=\"finalize_crypto\"/>"
+      "</Cryptographic>"
+      "<AccessControl>"
+        "<Library path=\""CONFIG_PLUGIN_MOCK_DIR""CONFIG_LIB_SEP""CONFIG_LIB_PREFIX"dds_security_access_control_all_ok"CONFIG_LIB_SUFFIX"\" initFunction=\"init_access_control\" finalizeFunction=\"finalize_access_control\"/>"
+        "<Governance>file:Governance.p7s</Governance>"
+        "<PermissionsCA>file:Permissions_CA.pem</PermissionsCA>"
+        "<Permissions>file:Permissions.p7s</Permissions>"
+      "</AccessControl>"
+    "</DDSSecurity>";
 
-    dds_entity_t participant;
-    dds_qos_t * qos;
+  dds_entity_t participant;
+  dds_qos_t * qos;
 
-    CU_ASSERT_FATAL ((qos = dds_create_qos()) != NULL);
-    dds_qset_prop (qos, "test.dds.sec.prop1", "testtext_value1_testtext");
+  CU_ASSERT_FATAL((qos = dds_create_qos()) != NULL);
+  dds_qset_prop(qos, "test.dds.sec.prop1", "testtext_value1_testtext");
 
-    /* Set up the trace sinks to detect the config parsing. */
-    dds_set_log_mask(DDS_LC_FATAL|DDS_LC_ERROR|DDS_LC_WARNING|DDS_LC_CONFIG);
-    dds_set_log_sink(&logger, (void*)log_expected);
-    dds_set_trace_sink(&logger, (void*)log_expected);
+  /* Set up the trace sinks to detect the config parsing. */
+  dds_set_log_mask(DDS_LC_FATAL | DDS_LC_ERROR | DDS_LC_WARNING | DDS_LC_CONFIG);
+  dds_set_log_sink(&logger, (void*)log_expected);
+  dds_set_trace_sink(&logger, (void*)log_expected);
 
-    /* Create participant with security elements. */
-    found = 0;
-    ddsrt_setenv(URI_VARIABLE, sec_config);
-    participant = dds_create_participant(DDS_DOMAIN_DEFAULT, qos, NULL);
-    ddsrt_setenv(URI_VARIABLE, "");
-    dds_delete(participant);
-    dds_delete_qos(qos);
+  /* Create participant with security elements. */
+  found = 0;
+  ddsrt_setenv(URI_VARIABLE, sec_config);
+  participant = dds_create_participant(DDS_DOMAIN_DEFAULT, qos, NULL);
+  ddsrt_setenv(URI_VARIABLE, "");
+  dds_delete(participant);
+  dds_set_log_sink(NULL, NULL);
+  dds_set_trace_sink(NULL, NULL);
+  dds_delete_qos(qos);
 
-    /* All traces should have been provided. */
+  /* All traces should have been provided. */
 #ifndef DDSI_INCLUDE_SECURITY
-    CU_ASSERT_FATAL(found == 0x1);
+  CU_ASSERT_FATAL(found == 0x1);
 #else
-    CU_ASSERT_FATAL(found == 0x1);
+  CU_ASSERT_FATAL(found == 0x1);
 #endif
 }
 
 CU_Test(ddsc_config, security_qos_invalid, .init = ddsrt_init, .fini = ddsrt_fini)
 {
-    /* Expected traces when creating participant with the security elements. */
-    const char *log_expected[] = {
+  /* Expected traces when creating participant with the security elements. */
+  const char *log_expected[] = {
 #ifndef DDSI_INCLUDE_SECURITY
-      "config: //CycloneDDS/Domain: DDSSecurity: unknown element*",
+    "config: //CycloneDDS/Domain: DDSSecurity: unknown element*",
 #else
-      /* The config should have been parsed into the participant QoS. */
-      "PARTICIPANT * QOS={*property_list={value={"
-        "{dds.sec.auth.identity_ca,testtext_IdentityCA_testtext,0},"
-        "{dds.sec.auth.private_key,testtext_PrivateKey_testtext,0},"
-        "{dds.sec.auth.identity_certificate,testtext_IdentityCertificate_testtext,0},"
-        "{dds.sec.access.permissions_ca,file:Permissions_CA.pem,0},"
-        "{dds.sec.access.governance,file:Governance.p7s,0},"
-        "{dds.sec.access.permissions,file:Permissions.p7s,0}"
-        "}binary_value={}}*}*",
-      "new_participant(*): required security property "DDS_SEC_PROP_AUTH_IDENTITY_CA" missing in Property QoS*",
-      "new_participant(*): required security property "DDS_SEC_PROP_AUTH_PRIV_KEY" missing in Property QoS*",
-      "new_participant(*): required security property "DDS_SEC_PROP_AUTH_IDENTITY_CERT" missing in Property QoS*",
-      "new_participant(*): required security property "DDS_SEC_PROP_ACCESS_PERMISSIONS_CA" missing in Property QoS*",
-      "new_participant(*): required security property "DDS_SEC_PROP_ACCESS_GOVERNANCE" missing in Property QoS*",
-      "new_participant(*): required security property "DDS_SEC_PROP_ACCESS_PERMISSIONS" missing in Property QoS*",
-#endif
-      NULL
-    };
+    /* The config should have been parsed into the participant QoS. */
+    "new_participant(*): using security settings from QoS*",
+    "new_participant(*): required security property dds.sec.auth.identity_ca missing in Property QoS*",
+    "new_participant(*): required security property dds.sec.auth.private_key missing in Property QoS*",
+    "new_participant(*): required security property dds.sec.auth.identity_certificate missing in Property QoS*",
+    "new_participant(*): required security property dds.sec.access.permissions_ca missing in Property QoS*",
+    "new_participant(*): required security property dds.sec.access.governance missing in Property QoS*",
+    "new_participant(*): required security property dds.sec.access.permissions missing in Property QoS*",
+    "new_participant(*): required security property dds.sec.auth.library.path missing in Property QoS*",
+    "new_participant(*): required security property dds.sec.auth.library.init missing in Property QoS*",
+    "new_participant(*): required security property dds.sec.auth.library.finalize missing in Property QoS*",
+    "new_participant(*): required security property dds.sec.crypto.library.path missing in Property QoS*",
+    "new_participant(*): required security property dds.sec.crypto.library.init missing in Property QoS*",
+    "new_participant(*): required security property dds.sec.crypto.library.finalize missing in Property QoS*",
+    "new_participant(*): required security property dds.sec.access.library.path missing in Property QoS*",
+    "new_participant(*): required security property dds.sec.access.library.init missing in Property QoS*",
+    "new_participant(*): required security property dds.sec.access.library.finalize missing in Property QoS*",
+  #endif
+    NULL
+  };
 
-    const char *sec_config =
-      "<Tracing><Verbosity>finest</></>"
-      "<DDSSecurity>"
-        "<Authentication>"
-          "<IdentityCertificate>testtext_IdentityCertificate_testtext</IdentityCertificate>"
-          "<IdentityCA>testtext_IdentityCA_testtext</IdentityCA>"
-          "<PrivateKey>testtext_PrivateKey_testtext</PrivateKey>"
-        "</Authentication>"
-        "<AccessControl>"
-          "<Governance>file:Governance.p7s</Governance>"
-          "<PermissionsCA>file:Permissions_CA.pem</PermissionsCA>"
-          "<Permissions>file:Permissions.p7s</Permissions>"
-        "</AccessControl>"
-      "</DDSSecurity>";
+  const char *sec_config =
+    "<Tracing><Verbosity>finest</></>"
+    "<DDSSecurity>"
+      "<Authentication>"
+        "<IdentityCertificate>testtext_IdentityCertificate_testtext</IdentityCertificate>"
+        "<IdentityCA>testtext_IdentityCA_testtext</IdentityCA>"
+        "<PrivateKey>testtext_PrivateKey_testtext</PrivateKey>"
+      "</Authentication>"
+      "<AccessControl>"
+        "<Governance>file:Governance.p7s</Governance>"
+        "<PermissionsCA>file:Permissions_CA.pem</PermissionsCA>"
+        "<Permissions>file:Permissions.p7s</Permissions>"
+      "</AccessControl>"
+    "</DDSSecurity>";
 
-    dds_entity_t participant;
-    dds_qos_t * qos;
+  dds_entity_t participant;
+  dds_qos_t * qos;
 
-    /* Set up the trace sinks to detect the config parsing. */
-    dds_set_log_mask(DDS_LC_FATAL|DDS_LC_ERROR|DDS_LC_WARNING|DDS_LC_CONFIG);
-    dds_set_log_sink(&logger, (void*)log_expected);
-    dds_set_trace_sink(&logger, (void*)log_expected);
+  /* Set up the trace sinks to detect the config parsing. */
+  dds_set_log_mask(DDS_LC_FATAL | DDS_LC_ERROR | DDS_LC_WARNING | DDS_LC_CONFIG);
+  dds_set_log_sink(&logger, (void*)log_expected);
+  dds_set_trace_sink(&logger, (void*)log_expected);
 
-    /* Create the qos */
-    CU_ASSERT_FATAL ((qos = dds_create_qos()) != NULL);
-    dds_qset_prop (qos, "dds.sec.dummy", "testtext_dummy_testtext");
+  /* Create the qos */
+  CU_ASSERT_FATAL((qos = dds_create_qos()) != NULL);
+  dds_qset_prop(qos, "dds.sec.dummy", "testtext_dummy_testtext");
 
-    /* Create participant with security config in qos. */
-    found = 0;
-    ddsrt_setenv(URI_VARIABLE, sec_config);
-    participant = dds_create_participant(DDS_DOMAIN_DEFAULT, qos, NULL);
-    dds_delete_qos(qos);
+  /* Create participant with security config in qos. */
+  found = 0;
+  ddsrt_setenv(URI_VARIABLE, sec_config);
+  participant = dds_create_participant(DDS_DOMAIN_DEFAULT, qos, NULL);
+  dds_delete_qos(qos);
 #ifdef DDSI_INCLUDE_SECURITY
-    CU_ASSERT_EQUAL_FATAL (participant, DDS_RETCODE_ERROR);
+  CU_ASSERT_EQUAL_FATAL(participant, DDS_RETCODE_ERROR);
 #else
-    dds_delete(participant);
+  dds_delete(participant);
 #endif
-    ddsrt_setenv(URI_VARIABLE, "");
+  ddsrt_setenv(URI_VARIABLE, "");
 
-    /* All traces should have been provided. */
+  /* All traces should have been provided. */
 #ifndef DDSI_INCLUDE_SECURITY
-    CU_ASSERT_FATAL(found == 0x01);
+  CU_ASSERT_FATAL(found == 0x01);
 #else
-    CU_ASSERT_FATAL(found == 0x7e);
+  CU_ASSERT_FATAL(found == 0xffff);
 #endif
-    dds_set_log_sink(NULL, NULL);
-    dds_set_trace_sink(NULL, NULL);
+  dds_set_log_sink(NULL, NULL);
+  dds_set_trace_sink(NULL, NULL);
 }
 
diff --git a/src/core/ddsc/tests/config_env.h.in b/src/core/ddsc/tests/config_env.h.in
index 5d984d6..60339cf 100644
--- a/src/core/ddsc/tests/config_env.h.in
+++ b/src/core/ddsc/tests/config_env.h.in
@@ -14,5 +14,9 @@
 
 #define CONFIG_ENV_SIMPLE_UDP           "@CUnit_ddsc_config_simple_udp_uri@"
 #define CONFIG_ENV_MAX_PARTICIPANTS     "@CUnit_ddsc_config_simple_udp_max_participants@"
+#define CONFIG_PLUGIN_MOCK_DIR          "@test_lib_dir@"
+#define CONFIG_LIB_SUFFIX "@CMAKE_SHARED_LIBRARY_SUFFIX@"
+#define CONFIG_LIB_PREFIX "@CMAKE_SHARED_LIBRARY_PREFIX@"
+#define CONFIG_LIB_SEP    "@test_lib_sep@"
 
 #endif /* CONFIG_ENV_H */
diff --git a/src/core/ddsi/include/dds/ddsi/ddsi_security_omg.h b/src/core/ddsi/include/dds/ddsi/ddsi_security_omg.h
index 7ad3425..db0514e 100644
--- a/src/core/ddsi/include/dds/ddsi/ddsi_security_omg.h
+++ b/src/core/ddsi/include/dds/ddsi/ddsi_security_omg.h
@@ -17,6 +17,10 @@
 #include "dds/ddsi/q_globals.h"
 #include "dds/ddsi/q_radmin.h"
 #include "dds/ddsi/q_xmsg.h"
+#include "dds/ddsrt/retcode.h"
+#include "dds/ddsrt/types.h"
+#include "dds/ddsrt/sync.h"
+
 
 #if defined (__cplusplus)
 extern "C" {
@@ -30,6 +34,9 @@ typedef enum {
 
 #ifdef DDSI_INCLUDE_SECURITY
 
+#include "dds/security/dds_security_api.h"
+#include "dds/security/core/dds_security_plugins.h"
+
 typedef struct nn_msg_sec_info {
   int64_t src_pp_handle;
   int64_t dst_pp_handle;
@@ -37,14 +44,7 @@ typedef struct nn_msg_sec_info {
 } nn_msg_sec_info_t;
 
 
-/**
- * @brief Check if any participant has security enabled.
- *
- * @returns bool
- * @retval true   Some participant is secure
- * @retval false  No participant is not secure
- */
-bool q_omg_security_enabled(void);
+
 
 /**
  * @brief Check if security is enabled for the participant.
@@ -500,6 +500,30 @@ secure_conn_write(
     bool dst_one,
     nn_msg_sec_info_t *sec_info,
     ddsi_tran_write_fn_t conn_write_cb);
+    
+
+/**
+ * @brief Loads the security plugins with the given configuration.
+ *        This function tries to load the plugins only once. Returns the same
+ *        result on subsequent calls.
+ *        It logs the reason and returns error if can not load a plugin.
+ *
+ * @param[in] qos   Participant qos which owns the Property list
+ *                             that contains security configurations and
+ *                             plugin properties that are required for loading libraries
+ * @returns dds_return_t
+ * @retval DDS_RETCODE_OK   All plugins are successfully loaded
+ * @retval DDS_RETCODE_ERROR  One or more security plugins are not loaded.
+ */
+dds_return_t q_omg_security_load( struct dds_security_context *security_context, const dds_qos_t *qos );
+
+
+void q_omg_security_init( struct dds_security_context **sc);
+
+void q_omg_security_deinit( struct dds_security_context **sc);
+
+bool q_omg_is_security_loaded(  struct dds_security_context *sc );
+    
 
 /**
  * @brief Check if the participant and the proxy participant
@@ -694,12 +718,6 @@ bool q_omg_security_match_remote_reader_enabled(struct writer *wr, struct proxy_
 
 #include "dds/ddsi/q_unused.h"
 
-inline bool
-q_omg_security_enabled(void)
-{
-  return false;
-}
-
 inline bool
 q_omg_participant_is_secure(
   UNUSED_ARG(const struct participant *pp))
@@ -895,6 +913,17 @@ decode_rtps_message(
   return NN_RTPS_MSG_STATE_PLAIN;
 }
 
+inline dds_return_t q_omg_security_load( UNUSED_ARG( struct dds_security_context *security_context ), UNUSED_ARG( const dds_qos_t *property_seq) )
+{
+  return DDS_RETCODE_ERROR;
+}
+
+inline void q_omg_security_init( UNUSED_ARG( struct dds_security_context *sc) ) {}
+
+inline void q_omg_security_deinit( UNUSED_ARG( struct dds_security_context *sc) ) {}
+
+inline bool q_omg_is_security_loaded(  UNUSED_ARG( struct dds_security_context *sc )) { return false; }
+
 #endif /* DDSI_INCLUDE_SECURITY */
 
 #if defined (__cplusplus)
diff --git a/src/core/ddsi/include/dds/ddsi/q_entity.h b/src/core/ddsi/include/dds/ddsi/q_entity.h
index 2e3eba4..d769c12 100644
--- a/src/core/ddsi/include/dds/ddsi/q_entity.h
+++ b/src/core/ddsi/include/dds/ddsi/q_entity.h
@@ -220,6 +220,7 @@ struct participant
   int64_t local_identity_handle;   /* OMG DDS Security related member */
   int64_t permissions_handle; /* OMG DDS Security related member */
   struct participant_sec_attributes *sec_attr;
+  nn_security_info_t security_info;
 #endif
 };
 
diff --git a/src/core/ddsi/include/dds/ddsi/q_globals.h b/src/core/ddsi/include/dds/ddsi/q_globals.h
index 9ce01f4..4d12f96 100644
--- a/src/core/ddsi/include/dds/ddsi/q_globals.h
+++ b/src/core/ddsi/include/dds/ddsi/q_globals.h
@@ -46,6 +46,7 @@ struct ddsi_tran_factory;
 struct ddsrt_thread_pool_s;
 struct debug_monitor;
 struct ddsi_tkmap;
+struct dds_security_context;
 
 typedef struct config_in_addr_node {
    nn_locator_t loc;
@@ -296,6 +297,12 @@ struct q_globals {
   struct ddsi_builtin_topic_interface *builtin_topic_interface;
 
   struct nn_group_membership *mship;
+
+  /* security globals */
+#ifdef DDSI_INCLUDE_SECURITY
+  struct dds_security_context *security_context;
+#endif
+
 };
 
 #if defined (__cplusplus)
diff --git a/src/core/ddsi/include/dds/ddsi/q_xqos.h b/src/core/ddsi/include/dds/ddsi/q_xqos.h
index d77a21d..bb64519 100644
--- a/src/core/ddsi/include/dds/ddsi/q_xqos.h
+++ b/src/core/ddsi/include/dds/ddsi/q_xqos.h
@@ -321,21 +321,14 @@ DDS_EXPORT uint64_t nn_xqos_delta (const dds_qos_t *a, const dds_qos_t *b, uint6
 DDS_EXPORT void nn_xqos_addtomsg (struct nn_xmsg *m, const dds_qos_t *xqos, uint64_t wanted);
 DDS_EXPORT void nn_log_xqos (uint32_t cat, const struct ddsrt_log_cfg *logcfg, const dds_qos_t *xqos);
 DDS_EXPORT dds_qos_t *nn_xqos_dup (const dds_qos_t *src);
-DDS_EXPORT bool nn_xqos_has_prop (const dds_qos_t *xqos, const char *pname, bool startswith);
+DDS_EXPORT bool nn_xqos_has_prop (const dds_qos_t *xqos, const char *pname, bool startswith, bool check_non_empty);
 
 #ifdef DDSI_INCLUDE_SECURITY
 
-#define DDS_SEC_PROP_AUTH_IDENTITY_CA "dds.sec.auth.identity_ca"
-#define DDS_SEC_PROP_AUTH_PRIV_KEY "dds.sec.auth.private_key"
-#define DDS_SEC_PROP_AUTH_IDENTITY_CERT "dds.sec.auth.identity_certificate"
-#define DDS_SEC_PROP_AUTH_PASSWORD "dds.sec.auth.password"
-#define DDS_SEC_PROP_ACCESS_PERMISSIONS_CA "dds.sec.access.permissions_ca"
-#define DDS_SEC_PROP_ACCESS_GOVERNANCE "dds.sec.access.governance"
-#define DDS_SEC_PROP_ACCESS_PERMISSIONS "dds.sec.access.permissions"
-#define DDS_SEC_PROP_ACCESS_TRUSTED_CA_DIR "dds.sec.auth.trusted_ca_dir"
+
 
 struct omg_security_configuration_type;
-DDS_EXPORT bool nn_xqos_mergein_security_config (dds_qos_t *xqos, const struct omg_security_configuration_type *cfg);
+DDS_EXPORT void nn_xqos_mergein_security_config (dds_qos_t *xqos, const struct omg_security_configuration_type *cfg);
 #endif
 
 #if defined (__cplusplus)
diff --git a/src/core/ddsi/src/ddsi_security_omg.c b/src/core/ddsi/src/ddsi_security_omg.c
index 10fca50..0759f73 100644
--- a/src/core/ddsi/src/ddsi_security_omg.c
+++ b/src/core/ddsi/src/ddsi_security_omg.c
@@ -20,12 +20,43 @@
 #include "dds/ddsrt/process.h"
 
 #include "dds/ddsi/q_bswap.h"
-#include "dds/ddsi/q_unused.h"
 #include "dds/ddsi/q_radmin.h"
 #include "dds/ddsi/ddsi_entity_index.h"
 #include "dds/ddsi/ddsi_security_omg.h"
 #include "dds/ddsi/ddsi_sertopic.h"
+#include "dds/ddsi/q_config.h"
+#include "dds/ddsi/q_log.h"
+#include "dds/ddsrt/sync.h"
+#include "dds/security/dds_security_api.h"
+#include "dds/security/core/dds_security_utils.h"
+#include "dds/security/core/dds_security_plugins.h"
+#include "dds/ddsrt/hopscotch.h"
 
+#include "dds/ddsi/q_entity.h"
+#include "dds/ddsi/q_xevent.h"
+#include "dds/ddsi/q_plist.h"
+
+
+
+#define AUTH_NAME "Authentication"
+#define AC_NAME "Access Control"
+#define CRYPTO_NAME "Cryptographic"
+
+#define SECURITY_EXCEPTION_INIT {NULL, 0, 0}
+
+struct dds_security_context {
+  dds_security_plugin auth_plugin;
+  dds_security_plugin ac_plugin;
+  dds_security_plugin crypto_plugin;
+
+  dds_security_authentication *authentication_context;
+  dds_security_cryptography *crypto_context;
+  dds_security_access_control *access_control_context;
+  ddsrt_mutex_t omg_security_lock;
+  uint32_t next_plugin_id;
+};
+
+typedef struct dds_security_context dds_security_context;
 
 
 static bool
@@ -34,6 +65,7 @@ q_omg_writer_is_payload_protected(
 
 
 
+
 static bool endpoint_is_DCPSParticipantSecure(const ddsi_guid_t *guid)
 {
   return ((guid->entityid.u == NN_ENTITYID_SPDP_RELIABLE_BUILTIN_PARTICIPANT_SECURE_WRITER) ||
@@ -76,11 +108,209 @@ static bool endpoint_is_DCPSParticipantVolatileMessageSecure(const ddsi_guid_t *
 #endif
 }
 
+bool q_omg_is_security_loaded(  dds_security_context *sc ){
+  if( sc->crypto_context == NULL && sc->authentication_context == NULL && sc->access_control_context == NULL){
+    return false;
+  } else {
+    return true;
+  }
+}
 
-bool
-q_omg_security_enabled(void)
+void q_omg_security_init( dds_security_context **sc )
 {
-  return false;
+
+
+    *sc = ddsrt_malloc( sizeof( dds_security_context));
+    memset( *sc, 0, sizeof( dds_security_context));
+  //if( participant_reference_count == 0 ){
+
+    (*sc)->auth_plugin.name = AUTH_NAME;
+    (*sc)->ac_plugin.name = AC_NAME;
+    (*sc)->crypto_plugin.name = CRYPTO_NAME;
+
+    (void)ddsrt_mutex_init(&(*sc)->omg_security_lock);
+    DDS_LOG(DDS_LC_TRACE,"DDS Security init\n");
+#if HANDSHAKE_IMPLEMENTED
+    //remote_participant_crypto_handle_list_init();
+#endif
+  //}
+
+  //participant_reference_count++;
+}
+
+
+
+/**
+ * Releases all plugins
+ */
+static void release_plugins( dds_security_context *security_context )
+{
+#if HANDSHAKE_IMPLEMENTED
+  q_handshake_terminate();
+#endif
+
+
+  if (dds_security_plugin_release( &security_context->auth_plugin, security_context->authentication_context )) {
+    DDS_ERROR("Error occured releasing %s plugin", security_context->auth_plugin.name);
+  }
+
+  if (dds_security_plugin_release( &security_context->crypto_plugin, security_context->crypto_context )) {
+    DDS_ERROR("Error occured releasing %s plugin", security_context->crypto_plugin.name);
+  }
+
+  if (dds_security_plugin_release( &security_context->ac_plugin, security_context->access_control_context )) {
+    DDS_ERROR("Error occured releasing %s plugin", security_context->ac_plugin.name);
+  }
+
+  security_context->authentication_context = NULL;
+  security_context->access_control_context = NULL;
+  security_context->crypto_context = NULL;
+}
+
+
+void q_omg_security_deinit( struct dds_security_context **security_context) {
+
+  assert( security_context != NULL );
+  assert( *security_context != NULL );
+
+#if HANDSHAKE_IMPLEMENTED
+    //remote_participant_crypto_handle_list_deinit();
+#endif
+    if( (*security_context)->authentication_context != NULL && (*security_context)->access_control_context != NULL && (*security_context)->crypto_context != NULL ){
+      release_plugins( *security_context );
+    }
+
+    ddsrt_mutex_destroy(&(*security_context)->omg_security_lock);
+    ddsrt_free( *security_context );
+    *security_context = NULL;
+
+    DDS_LOG(DDS_LC_TRACE,"DDS Security deinit\n");
+}
+
+
+
+static void
+dds_qos_to_security_plugin_configuration(
+   const dds_qos_t *qos,
+   dds_security_plugin_suite_config *suite_config)
+{
+  uint32_t i;
+
+#define CHECK_SECURITY_PROPERTY( security_property, target ) \
+    if(strcmp (qos->property.value.props[i].name, security_property) == 0){ \
+      target = ddsrt_strdup( qos->property.value.props[i].value ); \
+    }
+
+  for (i = 0; i < qos->property.value.n; i++) {
+    CHECK_SECURITY_PROPERTY( DDS_SEC_PROP_AUTH_LIBRARY_PATH, suite_config->authentication.library_path )
+    else CHECK_SECURITY_PROPERTY( DDS_SEC_PROP_AUTH_LIBRARY_INIT, suite_config->authentication.library_init )
+    else CHECK_SECURITY_PROPERTY( DDS_SEC_PROP_AUTH_LIBRARY_FINALIZE, suite_config->authentication.library_finalize )
+    else CHECK_SECURITY_PROPERTY( DDS_SEC_PROP_CRYPTO_LIBRARY_PATH, suite_config->cryptography.library_path )
+    else CHECK_SECURITY_PROPERTY( DDS_SEC_PROP_CRYPTO_LIBRARY_INIT, suite_config->cryptography.library_init )
+    else CHECK_SECURITY_PROPERTY( DDS_SEC_PROP_CRYPTO_LIBRARY_FINALIZE, suite_config->cryptography.library_finalize )
+    else CHECK_SECURITY_PROPERTY( DDS_SEC_PROP_ACCESS_LIBRARY_PATH, suite_config->access_control.library_path )
+    else CHECK_SECURITY_PROPERTY( DDS_SEC_PROP_ACCESS_LIBRARY_INIT, suite_config->access_control.library_init )
+    else CHECK_SECURITY_PROPERTY( DDS_SEC_PROP_ACCESS_LIBRARY_FINALIZE, suite_config->access_control.library_finalize )
+  }
+
+#undef CHECK_SECURITY_PROPERTY
+}
+
+static void deinit_plugin_config(dds_security_plugin_config *plugin_config){
+  ddsrt_free( plugin_config->library_path );
+  ddsrt_free( plugin_config->library_init );
+  ddsrt_free( plugin_config->library_finalize );
+}
+
+static void deinit_plugin_suite_config(dds_security_plugin_suite_config *suite_config ){
+  deinit_plugin_config( &suite_config->access_control );
+  deinit_plugin_config( &suite_config->authentication );
+  deinit_plugin_config( &suite_config->cryptography );
+
+}
+
+dds_return_t q_omg_security_load( dds_security_context *security_context,
+    const dds_qos_t *qos)
+{
+  dds_return_t ret = DDS_RETCODE_ERROR;
+
+  ddsrt_mutex_lock(&security_context->omg_security_lock);
+
+  dds_security_plugin_suite_config plugin_suite_config;
+
+  memset ( &plugin_suite_config, 0, sizeof(dds_security_plugin_suite_config));
+  /* Get plugin information */
+
+  dds_qos_to_security_plugin_configuration( qos, &plugin_suite_config);
+
+  /* Check configuration content */
+  if( dds_security_check_plugin_configuration( &plugin_suite_config ) == DDS_RETCODE_OK ){
+
+    if (dds_security_load_security_library(
+        &(plugin_suite_config.authentication), &security_context->auth_plugin,
+        (void**) &security_context->authentication_context) == DDS_RETCODE_OK) {
+
+      if (dds_security_load_security_library(
+          &(plugin_suite_config.access_control), &security_context->ac_plugin,
+          (void**) &security_context->access_control_context)  == DDS_RETCODE_OK ) {
+
+        if (dds_security_load_security_library(
+                  &(plugin_suite_config.cryptography), &security_context->crypto_plugin,
+                  (void**) &security_context->crypto_context) == DDS_RETCODE_OK ) {
+          /* now check if all plugin functions are implemented */
+          if( dds_security_verify_plugin_functions(
+              security_context->authentication_context,&security_context->auth_plugin,
+              security_context->crypto_context,&security_context->crypto_plugin,
+              security_context->access_control_context, &security_context->ac_plugin) == DDS_RETCODE_OK){
+
+            /* Add listeners */
+#if LISTENERS_IMPLEMENTED
+            if ( access_control_context->set_listener(access_control_context, &listener_ac, &ex)) {
+              if ( authentication_context->set_listener(authentication_context, &listener_auth, &ex)) {
+#if HANDSHAKE_IMPLEMENTED
+              (void)q_handshake_initialize();
+#endif
+              } else {
+                DDS_ERROR("Could not set authentication listener: %s\n",
+                          ex.message ? ex.message : "<unknown error>");
+              }
+
+            } else {
+              DDS_ERROR("Could not set access_control listener: %s\n",
+                        ex.message ? ex.message : "<unknown error>");
+            }
+#endif //LISTENERS_IMPLEMENTED
+
+            //tried_to_load = true;
+            //ret = last_load_result = DDS_RETCODE_OK;
+            ret = DDS_RETCODE_OK;
+            //omg_security_plugin_loaded = true;
+            DDS_INFO( "DDS Security plugins have been loaded\n" );
+          } else {
+            release_plugins( security_context );
+          }
+
+        } else{
+          DDS_ERROR("Could not load %s library\n", security_context->crypto_plugin.name);
+        }
+      }else{
+        DDS_ERROR("Could not load %s library\n", security_context->ac_plugin.name);
+      }
+
+    }
+    else{
+      DDS_ERROR("Could not load %s plugin.\n", security_context->auth_plugin.name);
+
+    }
+
+  }
+
+  deinit_plugin_suite_config( &plugin_suite_config );
+
+  ddsrt_mutex_unlock( &security_context->omg_security_lock );
+
+
+  return ret;
 }
 
 bool
@@ -797,53 +1027,54 @@ encode_datareader_submsg(
   struct proxy_writer *pwr,
   const struct ddsi_guid *rd_guid)
 {
+  struct reader *rd = entidx_lookup_reader_guid(pwr->e.gv->entity_index, rd_guid);
+  struct participant *pp = NULL;
   /* Only encode when needed. */
-  if (q_omg_security_enabled())
+  if( rd != NULL ){
+    pp = rd->c.pp;
+  }
+  if (!pp && q_omg_participant_is_secure( pp ))
   {
-    struct reader *rd = entidx_lookup_reader_guid(pwr->e.gv->entity_index, rd_guid);
-    if (rd)
+    if (q_omg_reader_is_submessage_protected(rd))
     {
-      if (q_omg_reader_is_submessage_protected(rd))
+      unsigned char *src_buf;
+      unsigned int   src_len;
+      unsigned char *dst_buf;
+      unsigned int   dst_len;
+
+      /* Make one blob of the current sub-message by appending the serialized payload. */
+      nn_xmsg_submsg_append_refd_payload(msg, sm_marker);
+
+      /* Get the sub-message buffer. */
+      src_buf = (unsigned char*)nn_xmsg_submsg_from_marker(msg, sm_marker);
+      src_len = (unsigned int)nn_xmsg_submsg_size(msg, sm_marker);
+
+      /* Do the actual encryption. */
+      if (q_omg_security_encode_datareader_submessage(rd, &(pwr->e.guid.prefix), src_buf, src_len, &dst_buf, &dst_len))
       {
-        unsigned char *src_buf;
-        unsigned int   src_len;
-        unsigned char *dst_buf;
-        unsigned int   dst_len;
-
-        /* Make one blob of the current sub-message by appending the serialized payload. */
-        nn_xmsg_submsg_append_refd_payload(msg, sm_marker);
-
-        /* Get the sub-message buffer. */
-        src_buf = (unsigned char*)nn_xmsg_submsg_from_marker(msg, sm_marker);
-        src_len = (unsigned int)nn_xmsg_submsg_size(msg, sm_marker);
-
-        /* Do the actual encryption. */
-        if (q_omg_security_encode_datareader_submessage(rd, &(pwr->e.guid.prefix), src_buf, src_len, &dst_buf, &dst_len))
-        {
-          /* Replace the old sub-message with the new encoded one(s). */
-          nn_xmsg_submsg_replace(msg, sm_marker, dst_buf, dst_len);
-          ddsrt_free(dst_buf);
-        }
-        else
-        {
-          /* The sub-message should have been encoded, which failed.
-           * Remove it to prevent it from being send. */
-          nn_xmsg_submsg_remove(msg, sm_marker);
-        }
+        /* Replace the old sub-message with the new encoded one(s). */
+        nn_xmsg_submsg_replace(msg, sm_marker, dst_buf, dst_len);
+        ddsrt_free(dst_buf);
+      }
+      else
+      {
+        /* The sub-message should have been encoded, which failed.
+         * Remove it to prevent it from being send. */
+        nn_xmsg_submsg_remove(msg, sm_marker);
       }
     }
   }
 }
 
-
 void
 encode_datawriter_submsg(
   struct nn_xmsg *msg,
   struct nn_xmsg_marker sm_marker,
   struct writer *wr)
 {
+  struct participant *pp = wr->c.pp;
   /* Only encode when needed. */
-  if (q_omg_security_enabled())
+  if (q_omg_participant_is_secure( pp ))
   {
     if (q_omg_writer_is_submessage_protected(wr))
     {
diff --git a/src/core/ddsi/src/q_entity.c b/src/core/ddsi/src/q_entity.c
index 6a126c7..264ca47 100644
--- a/src/core/ddsi/src/q_entity.c
+++ b/src/core/ddsi/src/q_entity.c
@@ -698,44 +698,77 @@ dds_return_t new_participant_guid (const ddsi_guid_t *ppguid, struct q_globals *
   nn_plist_mergein_missing (pp->plist, &gv->default_local_plist_pp, ~(uint64_t)0, ~(uint64_t)0);
 
 #ifdef DDSI_INCLUDE_SECURITY
-  if (gv->config.omg_security_configuration)
+  /*
+   * if there there are security properties check them .
+   * if there are no security properties, then merge from security configuration if there is
+   */
+  /* check for existing security properties (name starts with dds.sec. conform DDS Security spec 7.2.4.1)
+   * and return if any is found */
   {
-    /* For security, configuration can be provided through the configuration.
-     * However, the specification (and the plugins) expect it to be in the QoS. */
-    if (!nn_xqos_mergein_security_config(&pp->plist->qos, &gv->config.omg_security_configuration->cfg))
-    {
-      char *req[] = { DDS_SEC_PROP_AUTH_IDENTITY_CA,
-                      DDS_SEC_PROP_AUTH_PRIV_KEY,
-                      DDS_SEC_PROP_AUTH_IDENTITY_CERT,
-                      DDS_SEC_PROP_ACCESS_PERMISSIONS_CA,
-                      DDS_SEC_PROP_ACCESS_GOVERNANCE,
-                      DDS_SEC_PROP_ACCESS_PERMISSIONS };
+    bool ready_to_load_security = false;
+    if (nn_xqos_has_prop(&pp->plist->qos, "dds.sec.", true, false)) {
+      char *req[] = {DDS_SEC_PROP_AUTH_IDENTITY_CA,
+                     DDS_SEC_PROP_AUTH_PRIV_KEY,
+                     DDS_SEC_PROP_AUTH_IDENTITY_CERT,
+                     DDS_SEC_PROP_ACCESS_PERMISSIONS_CA,
+                     DDS_SEC_PROP_ACCESS_GOVERNANCE,
+                     DDS_SEC_PROP_ACCESS_PERMISSIONS,
 
-      GVLOGDISC ("new_participant("PGUIDFMT"): using security settings from QoS, ignoring security configuration\n", PGUID (*ppguid));
+                     DDS_SEC_PROP_AUTH_LIBRARY_PATH,
+                     DDS_SEC_PROP_AUTH_LIBRARY_INIT,
+                     DDS_SEC_PROP_AUTH_LIBRARY_FINALIZE,
+                     DDS_SEC_PROP_CRYPTO_LIBRARY_PATH,
+                     DDS_SEC_PROP_CRYPTO_LIBRARY_INIT,
+                     DDS_SEC_PROP_CRYPTO_LIBRARY_FINALIZE,
+                     DDS_SEC_PROP_ACCESS_LIBRARY_PATH,
+                     DDS_SEC_PROP_ACCESS_LIBRARY_INIT,
+                     DDS_SEC_PROP_ACCESS_LIBRARY_FINALIZE};
+      GVLOGDISC ("new_participant("
+                         PGUIDFMT
+                         "): using security settings from QoS\n", PGUID(*ppguid));
 
       /* check if all required security properties exist in qos */
-      for (size_t i = 0; i < sizeof(req) / sizeof(req[0]); i++)
-      {
-        if (!nn_xqos_has_prop (&pp->plist->qos, req[i], false))
-        {
-          GVERROR ("new_participant("PGUIDFMT"): required security property %s missing in Property QoS\n", PGUID (*ppguid), req[i]);
+      for (size_t i = 0; i < sizeof(req) / sizeof(req[0]); i++) {
+        if (!nn_xqos_has_prop(&pp->plist->qos, req[i], false, true)) {
+          GVERROR ("new_participant("
+                           PGUIDFMT
+                           "): required security property %s missing in Property QoS\n", PGUID(*ppguid), req[i]);
           ret = DDS_RETCODE_PRECONDITION_NOT_MET;
         }
       }
-      if (ret != DDS_RETCODE_OK)
+      if (ret == DDS_RETCODE_OK) {
+        ready_to_load_security = true;
+      } else {
         goto new_pp_err_secprop;
+      }
+    } else if (gv->config.omg_security_configuration) {
+      /* For security, configuration can be provided through the configuration.
+       * However, the specification (and the plugins) expect it to be in the QoS. */
+      GVLOGDISC ("new_participant("
+                         PGUIDFMT
+                         "): using security settings from configuration\n", PGUID(*ppguid));
+      nn_xqos_mergein_security_config(&pp->plist->qos, &gv->config.omg_security_configuration->cfg);
+      ready_to_load_security = true;
+    }
+
+    if( q_omg_is_security_loaded( gv->security_context ) == false ){
+      if (ready_to_load_security && q_omg_security_load(gv->security_context, &pp->plist->qos) < 0) {
+        GVERROR("Could not load security\n");
+        ret = DDS_RETCODE_NOT_ALLOWED_BY_SECURITY;
+        goto new_pp_err_secprop;
+      }
+    } else {
+      GVLOGDISC ("new_participant("
+                               PGUIDFMT
+                               "): security is already loaded for this domain\n", PGUID(*ppguid));
     }
-  }
 
-  if (nn_xqos_has_prop (&pp->plist->qos, "dds.sec.", true))
-  {
     if (!q_omg_security_check_create_participant (pp, gv->config.domainId))
     {
       ret = DDS_RETCODE_NOT_ALLOWED_BY_SECURITY;
       goto not_allowed;
     }
   }
-
 #endif
 
   if (gv->logconfig.c.mask & DDS_LC_DISCOVERY)
diff --git a/src/core/ddsi/src/q_init.c b/src/core/ddsi/src/q_init.c
index e214d48..d519ed6 100644
--- a/src/core/ddsi/src/q_init.c
+++ b/src/core/ddsi/src/q_init.c
@@ -62,6 +62,8 @@
 #include "dds__whc.h"
 #include "dds/ddsi/ddsi_iid.h"
 
+#include "dds/ddsi/ddsi_security_omg.h"
+
 static void add_peer_addresses (const struct q_globals *gv, struct addrset *as, const struct config_peer_listelem *list)
 {
   while (list)
@@ -1081,6 +1083,8 @@ int rtps_init (struct q_globals *gv)
    * the entities (see DDS Security spec chapter 8.8.8.1). */
   add_property_to_xqos(&gv->builtin_volatile_xqos_rd, "dds.sec.builtin_endpoint_name", "BuiltinParticipantVolatileMessageSecureReader");
   add_property_to_xqos(&gv->builtin_volatile_xqos_wr, "dds.sec.builtin_endpoint_name", "BuiltinParticipantVolatileMessageSecureWriter");
+  
+  q_omg_security_init( &gv->security_context );
 #endif
 
   make_special_topics (gv);
@@ -1420,6 +1424,8 @@ err_unicast_sockets:
   nn_xqos_fini (&gv->builtin_stateless_xqos_rd);
   nn_xqos_fini (&gv->builtin_volatile_xqos_wr);
   nn_xqos_fini (&gv->builtin_volatile_xqos_rd);
+  
+  q_omg_security_deinit( &gv->security_context );
 #endif
   nn_xqos_fini (&gv->builtin_endpoint_xqos_wr);
   nn_xqos_fini (&gv->builtin_endpoint_xqos_rd);
@@ -1764,6 +1770,8 @@ void rtps_fini (struct q_globals *gv)
   nn_xqos_fini (&gv->builtin_stateless_xqos_rd);
   nn_xqos_fini (&gv->builtin_volatile_xqos_wr);
   nn_xqos_fini (&gv->builtin_volatile_xqos_rd);
+  
+  q_omg_security_deinit( &gv->security_context);
 #endif
   nn_xqos_fini (&gv->builtin_endpoint_xqos_wr);
   nn_xqos_fini (&gv->builtin_endpoint_xqos_rd);
diff --git a/src/core/ddsi/src/q_plist.c b/src/core/ddsi/src/q_plist.c
index 1cabed6..2e38033 100644
--- a/src/core/ddsi/src/q_plist.c
+++ b/src/core/ddsi/src/q_plist.c
@@ -40,6 +40,7 @@
 #include "dds/ddsi/q_misc.h" /* for vendor_is_... */
 
 #include "dds/ddsi/ddsi_plist_generic.h"
+#include "dds/ddsi/ddsi_security_omg.h"
 
 /* I am tempted to change LENGTH_UNLIMITED to 0 in the API (with -1
    supported for backwards compatibility) ... on the wire however
@@ -2884,17 +2885,17 @@ dds_qos_t * nn_xqos_dup (const dds_qos_t *src)
   return dst;
 }
 
-bool nn_xqos_has_prop (const dds_qos_t *xqos, const char *pname, bool startswith)
+bool nn_xqos_has_prop (const dds_qos_t *xqos, const char *pname, bool startswith, bool check_non_empty)
 {
   if (!(xqos->present & QP_PROPERTY_LIST))
     return false;
 
-  for (uint32_t i = 0; i < xqos->property.value.n; i++)
-  {
-    if (startswith && (strncmp (xqos->property.value.props[i].name, pname, strlen (pname)) == 0))
-      return true;
-    else if (!startswith && (strcmp (xqos->property.value.props[i].name, pname) == 0))
-      return true;
+  for (uint32_t i = 0; i < xqos->property.value.n; i++) {
+    if (startswith && (strncmp(xqos->property.value.props[i].name, pname, strlen(pname)) == 0)) {
+      return !check_non_empty || strlen(xqos->property.value.props[i].value) != 0;
+    } else if (!startswith && (strcmp(xqos->property.value.props[i].name, pname) == 0)) {
+      return !check_non_empty || strlen(xqos->property.value.props[i].value) != 0;
+    }
   }
   return false;
 }
@@ -2912,7 +2913,7 @@ static void fill_property(dds_property_t *prop, const char *name, const char *va
  * plugins to get their proper settings. If security properties are already present in
  * the QoS, the settings from configuration are ignored.
  */
-bool nn_xqos_mergein_security_config (dds_qos_t *xqos, const struct omg_security_configuration_type *cfg)
+void nn_xqos_mergein_security_config (dds_qos_t *xqos, const struct omg_security_configuration_type *cfg)
 {
   assert(cfg != NULL);
 
@@ -2925,24 +2926,29 @@ bool nn_xqos_mergein_security_config (dds_qos_t *xqos, const struct omg_security
     xqos->present |= QP_PROPERTY_LIST;
   }
 
-  /* check for existing security properties (name starts with dds.sec. conform DDS Security spec 7.2.4.1)
-   * and return if any is found */
-  if (nn_xqos_has_prop (xqos, "dds.sec.", true))
-    return false;
+  /* assume that no security properties exist in qos: fill QoS properties with values from configuration */
+  xqos->property.value.props = ddsrt_realloc (xqos->property.value.props, xqos->property.value.n + 18 /* max */ * sizeof (dds_property_t));
+
+  fill_property(&(xqos->property.value.props[xqos->property.value.n++]), DDS_SEC_PROP_AUTH_LIBRARY_PATH, cfg->authentication_plugin.library_path);
+  fill_property(&(xqos->property.value.props[xqos->property.value.n++]), DDS_SEC_PROP_AUTH_LIBRARY_INIT, cfg->authentication_plugin.library_init);
+  fill_property(&(xqos->property.value.props[xqos->property.value.n++]), DDS_SEC_PROP_AUTH_LIBRARY_FINALIZE, cfg->authentication_plugin.library_finalize);
+  fill_property(&(xqos->property.value.props[xqos->property.value.n++]), DDS_SEC_PROP_CRYPTO_LIBRARY_PATH, cfg->cryptography_plugin.library_path);
+  fill_property(&(xqos->property.value.props[xqos->property.value.n++]), DDS_SEC_PROP_CRYPTO_LIBRARY_INIT, cfg->cryptography_plugin.library_init);
+  fill_property(&(xqos->property.value.props[xqos->property.value.n++]), DDS_SEC_PROP_CRYPTO_LIBRARY_FINALIZE, cfg->cryptography_plugin.library_finalize);
+  fill_property(&(xqos->property.value.props[xqos->property.value.n++]), DDS_SEC_PROP_ACCESS_LIBRARY_PATH, cfg->access_control_plugin.library_path);
+  fill_property(&(xqos->property.value.props[xqos->property.value.n++]), DDS_SEC_PROP_ACCESS_LIBRARY_INIT, cfg->access_control_plugin.library_init);
+  fill_property(&(xqos->property.value.props[xqos->property.value.n++]), DDS_SEC_PROP_ACCESS_LIBRARY_FINALIZE, cfg->access_control_plugin.library_finalize);
 
-  /* no security properties exist in qos: fill QoS properties with values from configuration */
-  xqos->property.value.props = ddsrt_realloc (xqos->property.value.props, xqos->property.value.n + 8 /* max */ * sizeof (dds_property_t));
   fill_property(&(xqos->property.value.props[xqos->property.value.n++]), DDS_SEC_PROP_AUTH_IDENTITY_CA, cfg->authentication_properties.identity_ca);
   fill_property(&(xqos->property.value.props[xqos->property.value.n++]), DDS_SEC_PROP_AUTH_PRIV_KEY, cfg->authentication_properties.private_key);
   fill_property(&(xqos->property.value.props[xqos->property.value.n++]), DDS_SEC_PROP_AUTH_IDENTITY_CERT, cfg->authentication_properties.identity_certificate);
   fill_property(&(xqos->property.value.props[xqos->property.value.n++]), DDS_SEC_PROP_ACCESS_PERMISSIONS_CA, cfg->access_control_properties.permissions_ca);
   fill_property(&(xqos->property.value.props[xqos->property.value.n++]), DDS_SEC_PROP_ACCESS_GOVERNANCE, cfg->access_control_properties.governance);
   fill_property(&(xqos->property.value.props[xqos->property.value.n++]), DDS_SEC_PROP_ACCESS_PERMISSIONS, cfg->access_control_properties.permissions);
-  if (cfg->authentication_properties.password && (strlen(cfg->authentication_properties.password) != 0))
+  if (cfg->authentication_properties.password )
     fill_property(&(xqos->property.value.props[xqos->property.value.n++]), DDS_SEC_PROP_AUTH_PASSWORD, cfg->authentication_properties.password);
-  if (cfg->authentication_properties.trusted_ca_dir && (strlen(cfg->authentication_properties.trusted_ca_dir) != 0))
+  if (cfg->authentication_properties.trusted_ca_dir )
     fill_property(&(xqos->property.value.props[xqos->property.value.n++]), DDS_SEC_PROP_ACCESS_TRUSTED_CA_DIR, cfg->authentication_properties.trusted_ca_dir);
-  return true;
 }
 #endif /* DDSI_INCLUDE_SECURITY */
 
diff --git a/src/core/ddsi/src/q_xevent.c b/src/core/ddsi/src/q_xevent.c
index b9ccc2e..4ff5608 100644
--- a/src/core/ddsi/src/q_xevent.c
+++ b/src/core/ddsi/src/q_xevent.c
@@ -977,12 +977,9 @@ static void handle_xevk_acknack (struct nn_xpack *xp, struct xevent *ev, nn_mtim
     seqno_t nack_seq;
 
     struct participant *pp = NULL;
-    if (q_omg_security_enabled())
-    {
-      struct reader *rd = entidx_lookup_reader_guid(pwr->e.gv->entity_index, &ev->u.acknack.rd_guid);
-      if (rd)
-        pp = rd->c.pp;
-    }
+    struct reader *rd = entidx_lookup_reader_guid(pwr->e.gv->entity_index, &ev->u.acknack.rd_guid);
+    if (rd)
+      pp = rd->c.pp;
 
     if ((msg = nn_xmsg_new (gv->xmsgpool, &ev->u.acknack.rd_guid, pp, ACKNACK_SIZE_MAX, NN_XMSG_KIND_CONTROL)) == NULL)
       goto outofmem;
diff --git a/src/ddsrt/src/dynlib/posix/dynlib.c b/src/ddsrt/src/dynlib/posix/dynlib.c
index 4ee6bb7..1a61267 100644
--- a/src/ddsrt/src/dynlib/posix/dynlib.c
+++ b/src/ddsrt/src/dynlib/posix/dynlib.c
@@ -44,6 +44,7 @@ dds_return_t ddsrt_dlopen(const char *name, bool translate,
     *handle = dlopen(name, RTLD_GLOBAL | RTLD_NOW);
   }
 
+
   if (*handle != NULL) {
     retcode = DDS_RETCODE_OK;
   } else {
diff --git a/src/security/CMakeLists.txt b/src/security/CMakeLists.txt
index 2d67ac3..3b2d8f9 100644
--- a/src/security/CMakeLists.txt
+++ b/src/security/CMakeLists.txt
@@ -12,6 +12,7 @@
 cmake_minimum_required(VERSION 3.7)
 
 if( ENABLE_SECURITY )
+    add_definitions(-DDDSI_INCLUDE_SECURITY)
     add_subdirectory(api)
     add_subdirectory(core)
 
diff --git a/src/security/api/include/dds/security/dds_security_api_defs.h b/src/security/api/include/dds/security/dds_security_api_defs.h
index d3d1705..fbc2539 100644
--- a/src/security/api/include/dds/security/dds_security_api_defs.h
+++ b/src/security/api/include/dds/security/dds_security_api_defs.h
@@ -183,6 +183,30 @@ typedef enum {
 #define DDS_SECURITY_MASTER_RECEIVER_SPECIFIC_KEY_SIZE_128 16
 #define DDS_SECURITY_MASTER_RECEIVER_SPECIFIC_KEY_SIZE_256 32
 
+/**************************************************************************
+ *                                                                        *
+ * Security Property Key Names                                                     *
+ *                                                                        *
+ *************************************************************************/
+#define DDS_SEC_PROP_AUTH_LIBRARY_PATH "dds.sec.auth.library.path"
+#define DDS_SEC_PROP_AUTH_LIBRARY_INIT "dds.sec.auth.library.init"
+#define DDS_SEC_PROP_AUTH_LIBRARY_FINALIZE "dds.sec.auth.library.finalize"
+#define DDS_SEC_PROP_CRYPTO_LIBRARY_PATH "dds.sec.crypto.library.path"
+#define DDS_SEC_PROP_CRYPTO_LIBRARY_INIT "dds.sec.crypto.library.init"
+#define DDS_SEC_PROP_CRYPTO_LIBRARY_FINALIZE "dds.sec.crypto.library.finalize"
+#define DDS_SEC_PROP_ACCESS_LIBRARY_PATH "dds.sec.access.library.path"
+#define DDS_SEC_PROP_ACCESS_LIBRARY_INIT "dds.sec.access.library.init"
+#define DDS_SEC_PROP_ACCESS_LIBRARY_FINALIZE "dds.sec.access.library.finalize"
+
+#define DDS_SEC_PROP_AUTH_IDENTITY_CA "dds.sec.auth.identity_ca"
+#define DDS_SEC_PROP_AUTH_PRIV_KEY "dds.sec.auth.private_key"
+#define DDS_SEC_PROP_AUTH_IDENTITY_CERT "dds.sec.auth.identity_certificate"
+#define DDS_SEC_PROP_AUTH_PASSWORD "dds.sec.auth.password"
+#define DDS_SEC_PROP_ACCESS_PERMISSIONS_CA "dds.sec.access.permissions_ca"
+#define DDS_SEC_PROP_ACCESS_GOVERNANCE "dds.sec.access.governance"
+#define DDS_SEC_PROP_ACCESS_PERMISSIONS "dds.sec.access.permissions"
+#define DDS_SEC_PROP_ACCESS_TRUSTED_CA_DIR "dds.sec.auth.trusted_ca_dir"
+
 
 #if defined (__cplusplus)
 }
diff --git a/src/security/builtin_plugins/authentication/src/auth_utils.c b/src/security/builtin_plugins/authentication/src/auth_utils.c
index 57d5a3a..430dffd 100644
--- a/src/security/builtin_plugins/authentication/src/auth_utils.c
+++ b/src/security/builtin_plugins/authentication/src/auth_utils.c
@@ -79,7 +79,7 @@ get_openssl_error_message(
 
 char *
 get_certificate_subject_name(
-        const X509 *cert,
+        X509 *cert,
         DDS_Security_SecurityException *ex)
 {
     X509_NAME *name;
diff --git a/src/security/builtin_plugins/authentication/src/auth_utils.h b/src/security/builtin_plugins/authentication/src/auth_utils.h
index f9db31d..b08df38 100644
--- a/src/security/builtin_plugins/authentication/src/auth_utils.h
+++ b/src/security/builtin_plugins/authentication/src/auth_utils.h
@@ -61,7 +61,7 @@ get_openssl_error_message(
  */
 char*
 get_certificate_subject_name(
-        const X509 *cert,
+        X509 *cert,
         DDS_Security_SecurityException *ex);
 
 /* Return the expiry date of contained in a X509 certificate
diff --git a/src/security/builtin_plugins/authentication/src/authentication.c b/src/security/builtin_plugins/authentication/src/authentication.c
index c893254..dada4db 100644
--- a/src/security/builtin_plugins/authentication/src/authentication.c
+++ b/src/security/builtin_plugins/authentication/src/authentication.c
@@ -199,7 +199,6 @@ typedef struct HandshakeInfo {
 
 typedef struct dds_security_authentication_impl {
     dds_security_authentication base;
-    int id; //sample internal member
     ddsrt_mutex_t lock;
     struct ddsrt_hh *objectHash;
     struct ddsrt_hh *remoteGuidHash;
@@ -969,8 +968,6 @@ validate_local_identity(
         goto err_bad_param;
     }
 
-    implementation->id = 2;
-
     identityCertPEM = DDS_Security_Property_get_value(&participant_qos->property.value, PROPERTY_IDENTITY_CERT);
     if (!identityCertPEM) {
         result = DDS_SECURITY_VALIDATION_FAILED;
@@ -3387,7 +3384,8 @@ DDS_Security_boolean return_sharedsecret_handle(
     return true;
 }
 
-int32_t init_authentication( const char *argument, void **context)
+int32_t
+init_authentication( const char *argument, void **context)
 {
 
     dds_security_authentication_impl *authentication;
@@ -3442,9 +3440,6 @@ int32_t init_authentication( const char *argument, void **context)
 
     authentication->base.return_sharedsecret_handle = &return_sharedsecret_handle;
 
-    //prepare implementation wrapper
-    authentication->id = 1;
-
     ddsrt_mutex_init(&authentication->lock);
 
     authentication->objectHash = ddsrt_hh_new(32, security_object_hash, security_object_equal);
diff --git a/src/security/builtin_plugins/tests/CMakeLists.txt b/src/security/builtin_plugins/tests/CMakeLists.txt
index 226255f..d3250d0 100644
--- a/src/security/builtin_plugins/tests/CMakeLists.txt
+++ b/src/security/builtin_plugins/tests/CMakeLists.txt
@@ -50,9 +50,10 @@ set(security_crypto_test_sources
 
 add_cunit_executable(cunit_security_plugins ${security_auth_test_sources} ${security_crypto_test_sources})
 if(OPENSSL_FOUND)
+  target_link_libraries(cunit_security_plugins PRIVATE ddsc dds_security_crypto)
   target_link_libraries(cunit_security_plugins PRIVATE OpenSSL::SSL)
 else()
-  message(FATAL_ERROR "To build without openssl support, set DDSC_ENABLE_OPENSSL to OFF")
+  message(FATAL_ERROR "To build with openssl support, set ENABLE_OPENSSL to ON")
 endif()
 
 target_include_directories(
@@ -65,7 +66,7 @@ target_include_directories(
       "$<BUILD_INTERFACE:${CMAKE_CURRENT_BINARY_DIR}>"
 )
 
-target_link_libraries(cunit_security_plugins PRIVATE ddsc security_api dds_security_crypto)
+
 
 set(CUnit_builtin_plugins_tests_dir "${CMAKE_CURRENT_LIST_DIR}")
 
diff --git a/src/security/core/CMakeLists.txt b/src/security/core/CMakeLists.txt
index 231eb9e..6802c73 100644
--- a/src/security/core/CMakeLists.txt
+++ b/src/security/core/CMakeLists.txt
@@ -12,19 +12,23 @@
 PREPEND(srcs_security_core "${CMAKE_CURRENT_LIST_DIR}/src"
     dds_security_serialize.c
     dds_security_utils.c
+    dds_security_plugins.c
     shared_secret.c
 )
  
 PREPEND(hdrs_public_security_core "${CMAKE_CURRENT_LIST_DIR}/include/security/core"
-    dds_security_core_if.h
     dds_security_serialize.h
     dds_security_types.h
     dds_security_utils.h
+    dds_security_plugins.h
     shared_secret.h
 )
 
-set (CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} -fPIC" )
-set (CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -fPIC" )
+if(NOT WIN32)
+  set (CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} -fPIC" )
+  set (CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -fPIC" )
+endif()
+
 add_library(security_core INTERFACE)
 
 
@@ -48,10 +52,4 @@ install(
   DESTINATION "${CMAKE_INSTALL_INCLUDEDIR}/dds/security/core/"
   COMPONENT dev)
 
-#install(
-# TARGETS security_core
-# EXPORT "${PROJECT_NAME}"
-#  RUNTIME DESTINATION "${CMAKE_INSTALL_BINDIR}" COMPONENT lib
-#  LIBRARY DESTINATION "${CMAKE_INSTALL_LIBDIR}" COMPONENT lib
-#  ARCHIVE DESTINATION "${CMAKE_INSTALL_LIBDIR}" COMPONENT lib
-#)
+add_subdirectory(tests/plugin_loading)
diff --git a/src/security/core/include/dds/security/core/dds_security_plugins.h b/src/security/core/include/dds/security/core/dds_security_plugins.h
new file mode 100644
index 0000000..da5d2ad
--- /dev/null
+++ b/src/security/core/include/dds/security/core/dds_security_plugins.h
@@ -0,0 +1,65 @@
+/*
+ * Copyright(c) 2006 to 2019 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+
+
+#ifndef SECURITY_CORE_PLUGINS_H_
+#define SECURITY_CORE_PLUGINS_H_
+
+#include "dds/export.h"
+#include "dds/ddsrt/retcode.h"
+#include "dds/ddsrt/dynlib.h"
+#include <stdint.h>
+#include "dds/security/dds_security_api.h"
+
+typedef struct dds_security_plugin {
+  ddsrt_dynlib_t lib_handle;
+  plugin_init func_init;
+  plugin_finalize func_finalize;
+  char *name;
+} dds_security_plugin;
+
+/* we are using our own security plugin configuration (not certificates etc)
+ * because we do not want to depend on DDSI configuration data types.
+ *
+ * A configuration data type is needed because there are traverses to properties several times
+ */
+
+typedef struct dds_security_plugin_config {
+  char *library_path;
+  char *library_init;
+  char *library_finalize;
+} dds_security_plugin_config;
+
+typedef struct dds_security_plugin_suite_config{
+  dds_security_plugin_config authentication;
+  dds_security_plugin_config cryptography;
+  dds_security_plugin_config access_control;
+} dds_security_plugin_suite_config;
+
+DDS_EXPORT dds_return_t dds_security_plugin_release(
+        const dds_security_plugin *security_plugin,
+        void *context );
+
+DDS_EXPORT dds_return_t dds_security_check_plugin_configuration(
+        const dds_security_plugin_suite_config *security_suite_config );
+
+DDS_EXPORT dds_return_t dds_security_load_security_library(
+        const dds_security_plugin_config *plugin_config,
+        dds_security_plugin *security_plugin, void **security_plugin_context);
+
+DDS_EXPORT dds_return_t dds_security_verify_plugin_functions(
+        dds_security_authentication *authentication_context, dds_security_plugin *auth_plugin,
+        dds_security_cryptography *crypto_context, dds_security_plugin *crypto_plugin,
+        dds_security_access_control *access_control_context, dds_security_plugin *ac_plugin);
+
+#endif /* SECURITY_CORE_PLUGINS_H_ */
+
diff --git a/src/security/core/src/dds_security_plugins.c b/src/security/core/src/dds_security_plugins.c
new file mode 100644
index 0000000..942e94b
--- /dev/null
+++ b/src/security/core/src/dds_security_plugins.c
@@ -0,0 +1,404 @@
+/*
+ * Copyright(c) 2006 to 2019 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+#include <string.h>
+
+#include "dds/ddsrt/misc.h"
+
+#include "dds/security/core/dds_security_utils.h"
+#include "dds/security/core/dds_security_plugins.h"
+#include "dds/security/dds_security_api.h"
+#include "dds/ddsi/q_unused.h"
+#include "dds/ddsi/ddsi_security_msg.h"
+#include "dds/ddsi/ddsi_security_omg.h"
+
+
+#include "dds/ddsi/q_config.h"
+#include "dds/ddsi/q_log.h"
+#include "dds/ddsrt/atomics.h"
+#include "dds/ddsrt/heap.h"
+#include "dds/ddsrt/dynlib.h"
+#include "dds/ddsrt/process.h"
+#include "dds/ddsrt/string.h"
+#include "dds/ddsrt/sync.h"
+#include "dds/ddsrt/hopscotch.h"
+
+#include "dds/ddsi/q_entity.h"
+#include "dds/ddsi/q_bswap.h"
+#include "dds/ddsi/q_xevent.h"
+#include "dds/ddsi/q_time.h"
+#include "dds/ddsi/q_plist.h"
+#include "dds/ddsrt/io.h"
+
+
+
+#define AUTH_NAME "Authentication"
+#define AC_NAME "Access Control"
+#define CRYPTO_NAME "Cryptographic"
+
+dds_return_t dds_security_check_plugin_configuration(
+    const dds_security_plugin_suite_config *security_suite_config )
+{
+
+  dds_return_t result = DDS_RETCODE_ERROR;
+
+  if (security_suite_config->access_control.library_path == NULL) {
+    DDS_ERROR("AccessControl security plugin library path is not defined");
+  } else if (strlen(security_suite_config->access_control.library_path)
+      == 0) {
+    DDS_ERROR("AccessControl security plugin library path is empty ");
+  } else if (security_suite_config->access_control.library_init == NULL) {
+    DDS_ERROR("AccessControl security plugin init function is not defined");
+  } else if (strlen(security_suite_config->access_control.library_init)
+      == 0) {
+    DDS_ERROR("AccessControl security plugin init function is empty ");
+  } else if (security_suite_config->access_control.library_finalize == NULL) {
+    DDS_ERROR(
+        "AccessControl security plugin finalize function is not defined ");
+  } else if (strlen(security_suite_config->access_control.library_finalize)
+      == 0) {
+    DDS_ERROR("AccessControl security plugin finalize function is empty");
+  } else if (security_suite_config->authentication.library_path == NULL) {
+    DDS_ERROR(
+        "Authentication security plugin library path is not defined in the configuration ");
+  } else  if (strlen(security_suite_config->authentication.library_path)
+      == 0) {
+    DDS_ERROR("Authentication security plugin library path is empty ");
+  } else if (security_suite_config->authentication.library_init == NULL) {
+    DDS_ERROR("Authentication security plugin init function is not defined ");
+  } else if (strlen(security_suite_config->authentication.library_init)
+      == 0) {
+    DDS_ERROR("Authentication security plugin init function is empty ");
+  } else if (security_suite_config->authentication.library_finalize == NULL) {
+    DDS_ERROR(
+        "Authentication security plugin finalize function is not defined ");
+  } else if (strlen(security_suite_config->authentication.library_finalize)
+      == 0) {
+    DDS_ERROR("Authentication security plugin finalize function is empty");
+  } else if (security_suite_config->cryptography.library_path == NULL) {
+    DDS_ERROR(
+        "Cryptography security plugin library path is not defined in the configuration ");
+  } else if (strlen(security_suite_config->cryptography.library_path)
+      == 0) {
+    DDS_ERROR("Cryptography security plugin library path is empty ");
+  } else if (security_suite_config->cryptography.library_init == NULL) {
+    DDS_ERROR("Cryptography security plugin init function is not defined ");
+  } else if (strlen(security_suite_config->cryptography.library_init)
+      == 0) {
+    DDS_ERROR("Cryptography security plugin init function is empty ");
+  } else if (security_suite_config->cryptography.library_finalize == NULL) {
+    DDS_ERROR("Cryptography security plugin finalize function is not defined ");
+  } else if (strlen(security_suite_config->cryptography.library_finalize)
+      == 0) {
+    DDS_ERROR("Cryptography security plugin finalize function is empty");
+  } else {
+    result = DDS_RETCODE_OK;
+  }
+
+  return result;
+}
+
+/*
+ * checks the function pointer value and CHANGES the out-result value if it is NULL
+ */
+static bool verify_function(void *function_ptr, dds_security_plugin *plugin,
+    const char *function_name)
+{
+
+  if ( function_ptr == NULL ) {
+    DDS_ERROR("Could not find the function for %s: %s \n", plugin->name,
+        function_name);
+    return false;
+  }
+  else {
+    return true;
+  }
+}
+
+dds_return_t dds_security_verify_plugin_functions(
+    dds_security_authentication *authentication_context, dds_security_plugin *auth_plugin,
+    dds_security_cryptography *crypto_context, dds_security_plugin *crypto_plugin,
+    dds_security_access_control *access_control_context, dds_security_plugin *ac_plugin)
+{
+
+  if(
+    verify_function(authentication_context->validate_local_identity, auth_plugin,
+        "validate_local_identity" ) &&
+    verify_function(authentication_context->get_identity_token, auth_plugin,
+        "get_identity_token" ) &&
+    verify_function(authentication_context->get_identity_status_token,
+        auth_plugin, "get_identity_status_token" ) &&
+    verify_function(authentication_context->set_permissions_credential_and_token,
+        auth_plugin, "set_permissions_credential_and_token" ) &&
+    verify_function(authentication_context->validate_remote_identity,
+        auth_plugin, "validate_remote_identity" ) &&
+    verify_function(authentication_context->begin_handshake_request, auth_plugin,
+        "begin_handshake_request" ) &&
+    verify_function(authentication_context->begin_handshake_reply, auth_plugin,
+        "begin_handshake_reply" ) &&
+    verify_function(authentication_context->process_handshake, auth_plugin,
+        "process_handshake" ) &&
+    verify_function(authentication_context->get_shared_secret, auth_plugin,
+        "get_shared_secret" ) &&
+    verify_function(
+        authentication_context->get_authenticated_peer_credential_token,
+        auth_plugin, "get_authenticated_peer_credential_token" ) &&
+    verify_function(authentication_context->set_listener, auth_plugin,
+        "set_listener" ) &&
+    verify_function(authentication_context->return_identity_token, auth_plugin,
+        "return_identity_token" ) &&
+    verify_function(authentication_context->return_identity_status_token,
+        auth_plugin, "return_identity_status_token" ) &&
+
+    verify_function(
+        authentication_context->return_authenticated_peer_credential_token,
+        auth_plugin, "return_authenticated_peer_credential_token" ) &&
+    verify_function(authentication_context->return_handshake_handle, auth_plugin,
+        "return_handshake_handle" ) &&
+    verify_function(authentication_context->return_identity_handle, auth_plugin,
+        "return_identity_handle" ) &&
+    verify_function(authentication_context->return_sharedsecret_handle,
+        auth_plugin, "return_sharedsecret_handle" ) &&
+
+    verify_function(access_control_context->validate_local_permissions,
+        ac_plugin, "validate_local_permissions" ) &&
+    verify_function(access_control_context->validate_remote_permissions,
+        ac_plugin, "validate_remote_permissions" ) &&
+    verify_function(access_control_context->check_create_participant, ac_plugin,
+        "check_create_participant" ) &&
+    verify_function(access_control_context->check_create_datawriter, ac_plugin,
+        "check_create_datawriter" ) &&
+    verify_function(access_control_context->check_create_datareader, ac_plugin,
+        "check_create_datareader" ) &&
+
+    verify_function(access_control_context->check_create_topic, ac_plugin,
+        "check_create_topic" ) &&
+    verify_function(
+        access_control_context->check_local_datawriter_register_instance,
+        ac_plugin, "check_local_datawriter_register_instance" ) &&
+    verify_function(
+        access_control_context->check_local_datawriter_dispose_instance,
+        ac_plugin, "check_local_datawriter_dispose_instance" ) &&
+    verify_function(access_control_context->check_remote_participant, ac_plugin,
+        "check_remote_participant" ) &&
+    verify_function(access_control_context->check_remote_datawriter, ac_plugin,
+        "check_remote_datawriter" ) &&
+    verify_function(access_control_context->check_remote_datareader, ac_plugin,
+        "check_remote_datareader" ) &&
+    verify_function(access_control_context->check_remote_topic, ac_plugin,
+        "check_remote_topic" ) &&
+    verify_function(access_control_context->check_local_datawriter_match,
+        ac_plugin, "check_local_datawriter_match" ) &&
+    verify_function(access_control_context->check_local_datareader_match,
+        ac_plugin, "check_local_datareader_match" ) &&
+    verify_function(
+        access_control_context->check_remote_datawriter_register_instance,
+        ac_plugin, "check_remote_datawriter_register_instance" ) &&
+    verify_function(
+        access_control_context->check_remote_datawriter_dispose_instance,
+        ac_plugin, "check_remote_datawriter_dispose_instance" ) &&
+    verify_function(access_control_context->get_permissions_token, ac_plugin,
+        "get_permissions_token" ) &&
+    verify_function(access_control_context->get_permissions_credential_token,
+        ac_plugin, "get_permissions_credential_token" ) &&
+    verify_function(access_control_context->set_listener, ac_plugin,
+        "set_listener" ) &&
+    verify_function(access_control_context->return_permissions_token, ac_plugin,
+        "return_permissions_token" ) &&
+    verify_function(access_control_context->return_permissions_credential_token,
+        ac_plugin, "return_permissions_credential_token" ) &&
+    verify_function(access_control_context->get_participant_sec_attributes,
+        ac_plugin, "get_participant_sec_attributes" ) &&
+    verify_function(access_control_context->get_topic_sec_attributes, ac_plugin,
+        "get_topic_sec_attributes" ) &&
+    verify_function(access_control_context->get_datawriter_sec_attributes,
+        ac_plugin, "get_datawriter_sec_attributes" ) &&
+    verify_function(access_control_context->get_datareader_sec_attributes,
+        ac_plugin, "get_datareader_sec_attributes" ) &&
+    verify_function(access_control_context->return_participant_sec_attributes,
+        ac_plugin, "return_participant_sec_attributes" ) &&
+    verify_function(access_control_context->return_datawriter_sec_attributes,
+        ac_plugin, "return_datawriter_sec_attributes" ) &&
+    verify_function(access_control_context->return_datareader_sec_attributes,
+        ac_plugin, "return_datareader_sec_attributes" ) &&
+    verify_function(access_control_context->return_permissions_handle,
+          ac_plugin, "return_permissions_handle" ) &&
+
+    verify_function(
+        crypto_context->crypto_key_factory->register_local_participant,
+        crypto_plugin, "register_local_participant" ) &&
+    verify_function(
+        crypto_context->crypto_key_factory->register_matched_remote_participant,
+        crypto_plugin, "register_matched_remote_participant" ) &&
+    verify_function(crypto_context->crypto_key_factory->register_local_datawriter,
+        crypto_plugin, "register_local_datawriter" ) &&
+    verify_function(
+        crypto_context->crypto_key_factory->register_matched_remote_datareader,
+        crypto_plugin, "register_matched_remote_datareader" ) &&
+    verify_function(crypto_context->crypto_key_factory->register_local_datareader,
+        crypto_plugin, "register_local_datareader" ) &&
+    verify_function(
+        crypto_context->crypto_key_factory->register_matched_remote_datawriter,
+        crypto_plugin, "register_matched_remote_datawriter" ) &&
+    verify_function(crypto_context->crypto_key_factory->unregister_participant,
+        crypto_plugin, "unregister_participant" ) &&
+    verify_function(crypto_context->crypto_key_factory->unregister_datawriter,
+        crypto_plugin, "unregister_datawriter" ) &&
+    verify_function(crypto_context->crypto_key_factory->unregister_datareader,
+        crypto_plugin, "unregister_datareader" ) &&
+
+    verify_function(
+        crypto_context->crypto_key_exchange->create_local_participant_crypto_tokens,
+        crypto_plugin, "create_local_participant_crypto_tokens" ) &&
+    verify_function(
+        crypto_context->crypto_key_exchange->set_remote_participant_crypto_tokens,
+        crypto_plugin, "set_remote_participant_crypto_tokens" ) &&
+    verify_function(
+        crypto_context->crypto_key_exchange->create_local_datawriter_crypto_tokens,
+        crypto_plugin, "create_local_datawriter_crypto_tokens" ) &&
+    verify_function(
+        crypto_context->crypto_key_exchange->set_remote_datawriter_crypto_tokens,
+        crypto_plugin, "set_remote_datawriter_crypto_tokens" ) &&
+    verify_function(
+        crypto_context->crypto_key_exchange->create_local_datareader_crypto_tokens,
+        crypto_plugin, "create_local_datareader_crypto_tokens" ) &&
+    verify_function(
+        crypto_context->crypto_key_exchange->set_remote_datareader_crypto_tokens,
+        crypto_plugin, "set_remote_datareader_crypto_tokens" ) &&
+    verify_function(crypto_context->crypto_key_exchange->return_crypto_tokens,
+        crypto_plugin, "return_crypto_tokens" ) &&
+
+    verify_function(crypto_context->crypto_transform->encode_serialized_payload,
+        crypto_plugin, "encode_serialized_payload" ) &&
+    verify_function(
+        crypto_context->crypto_transform->encode_datawriter_submessage,
+        crypto_plugin, "encode_datawriter_submessage" ) &&
+    verify_function(
+        crypto_context->crypto_transform->encode_datareader_submessage,
+        crypto_plugin, "encode_datareader_submessage" ) &&
+    verify_function(crypto_context->crypto_transform->encode_rtps_message,
+        crypto_plugin, "encode_rtps_message" ) &&
+    verify_function(crypto_context->crypto_transform->decode_rtps_message,
+        crypto_plugin, "decode_rtps_message" ) &&
+    verify_function(crypto_context->crypto_transform->preprocess_secure_submsg,
+        crypto_plugin, "preprocess_secure_submsg" ) &&
+    verify_function(
+        crypto_context->crypto_transform->decode_datawriter_submessage,
+        crypto_plugin, "decode_datawriter_submessage" ) &&
+    verify_function(
+        crypto_context->crypto_transform->decode_datareader_submessage,
+        crypto_plugin, "decode_datareader_submessage" ) &&
+    verify_function(crypto_context->crypto_transform->decode_serialized_payload,
+        crypto_plugin, "decode_serialized_payload" ) ){
+    return DDS_RETCODE_OK;
+  }
+  else {
+    return DDS_RETCODE_ERROR;
+  }
+
+}
+
+/**
+ * All fields of the library properties are supposed to be non-empty
+ */
+dds_return_t dds_security_load_security_library(
+    const dds_security_plugin_config *plugin_config,
+    dds_security_plugin *security_plugin,
+    void **security_plugin_context)
+{
+  dds_return_t ret = DDS_RETCODE_ERROR;
+  dds_return_t lib_ret = DDS_RETCODE_ERROR;
+  char * init_parameters = "";
+  char *library_str;
+
+  assert( plugin_config->library_path );
+  assert( plugin_config->library_init );
+  assert( plugin_config->library_finalize );
+
+  if ( strlen(plugin_config->library_path) > 0 ) {
+
+    //library_str = ddsrt_malloc(strlen(plugin_config->library_path) + 1);
+
+    if (strncmp(plugin_config->library_path, "file://", 7) == 0) {
+      (void)ddsrt_asprintf(&library_str, "%s", &plugin_config->library_path[7]);
+    } else {
+      (void)ddsrt_asprintf(&library_str, "%s", plugin_config->library_path);
+    }
+
+    lib_ret = ddsrt_dlopen( library_str, true, &security_plugin->lib_handle);
+    ddsrt_free(library_str);
+    if( lib_ret == DDS_RETCODE_OK && security_plugin->lib_handle){
+
+      /* Get init and fini functions . */
+      if ( ddsrt_dlsym(security_plugin->lib_handle, plugin_config->library_init, (void **)&security_plugin->func_init) == DDS_RETCODE_OK){
+        if ( ddsrt_dlsym(security_plugin->lib_handle, plugin_config->library_finalize, (void **)&security_plugin->func_finalize) == DDS_RETCODE_OK){
+
+          /* Initialize plugin. */
+          if ( security_plugin->func_init != NULL) {
+            lib_ret = security_plugin->func_init(init_parameters, (void **) security_plugin_context);
+
+            if (lib_ret == DDS_RETCODE_OK){ /* error occured on init */
+              return DDS_RETCODE_OK;
+            } else{
+              DDS_ERROR("Error occured while initializing %s plugin\n",
+                 security_plugin->name);
+              goto library_error;
+            }
+          }
+
+        }
+        else {
+          DDS_ERROR("Could not find the function: %s\n", plugin_config->library_finalize);
+          goto library_error;
+        }
+
+
+      }
+      else{
+        DDS_ERROR("Could not find the function: %s\n",plugin_config->library_init);
+        goto library_error;
+      }
+
+    } else {
+      char buffer[256];
+      ddsrt_dlerror(buffer, sizeof(buffer));
+      DDS_ERROR("Could not load %s library: %s\n", security_plugin->name, buffer);
+      goto load_error;
+    }
+
+
+    return ret;
+  }
+
+
+library_error:
+  ddsrt_dlclose(security_plugin->lib_handle);
+  security_plugin->lib_handle = NULL;
+load_error:
+  return ret;
+}
+
+dds_return_t dds_security_plugin_release( const dds_security_plugin *security_plugin, void *context ){
+  dds_return_t result= DDS_RETCODE_OK;
+  assert( security_plugin->lib_handle );
+  assert( security_plugin->func_finalize );
+
+  /* if get error from either finalize OR close,  return error */
+  if( security_plugin->func_finalize( context ) != DDS_RETCODE_OK){
+    DDS_ERROR("Error occured while finaizing %s plugin", security_plugin->name);
+    result = DDS_RETCODE_ERROR;
+  }
+  if( ddsrt_dlclose( security_plugin->lib_handle ) != DDS_RETCODE_OK){
+    result = DDS_RETCODE_ERROR;
+  }
+  return result;
+}
+
diff --git a/src/security/core/tests/plugin_loading/CMakeLists.txt b/src/security/core/tests/plugin_loading/CMakeLists.txt
new file mode 100644
index 0000000..9b2e088
--- /dev/null
+++ b/src/security/core/tests/plugin_loading/CMakeLists.txt
@@ -0,0 +1,129 @@
+ #
+# Copyright(c) 2006 to 2019 ADLINK Technology Limited and others
+#
+# This program and the accompanying materials are made available under the
+# terms of the Eclipse Public License v. 2.0 which is available at
+# http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+# v. 1.0 which is available at
+# http://www.eclipse.org/org/documents/edl-v10.php.
+#
+# SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+#
+include (GenerateExportHeader)
+include (CUnit)
+
+set(security_plugin_loading_test_sources
+    "plugin_loading.c"
+  )
+
+add_cunit_executable(cunit_security_plugin_loading ${security_plugin_loading_test_sources})
+target_include_directories(
+  cunit_security_plugin_loading PRIVATE
+  "$<BUILD_INTERFACE:${CMAKE_BINARY_DIR}/src/include/>"
+        "$<BUILD_INTERFACE:$<TARGET_PROPERTY:ddsrt,INTERFACE_INCLUDE_DIRECTORIES>>"
+        "$<BUILD_INTERFACE:$<TARGET_PROPERTY:ddsc,INTERFACE_INCLUDE_DIRECTORIES>>"
+        "$<BUILD_INTERFACE:${CMAKE_CURRENT_LIST_DIR}>"
+        "$<BUILD_INTERFACE:${CMAKE_CURRENT_BINARY_DIR}>"
+        "$<BUILD_INTERFACE:${CMAKE_CURRENT_LIST_DIR}/../../../../core/ddsi/include>"
+ )
+
+
+target_link_libraries(cunit_security_plugin_loading PRIVATE ddsc security_api)
+target_include_directories(cunit_security_plugin_loading PRIVATE "${CMAKE_CURRENT_BINARY_DIR}")
+
+set(CUnit_plugin_mock_dir ".")
+
+
+configure_file("config_env.h.in" "config_env.h")
+
+# Let the cunit application know the location and name of the library.
+file(TO_NATIVE_PATH "${CMAKE_CURRENT_BINARY_DIR}" test_lib_native_dir)
+file(TO_NATIVE_PATH "." test_lib_sep)
+string(REPLACE "\\" "\\\\" test_lib_dir ${test_lib_native_dir})
+string(REPLACE "\\" "\\\\" test_lib_sep ${test_lib_sep})
+configure_file("config_env.h.in" "${CMAKE_CURRENT_BINARY_DIR}/include/config_env.h" @ONLY)
+# Let ctest set the proper library path when executing library tests.
+unset(test_lib_tests)
+process_cunit_source_file("plugin_loading.c" test_lib_header test_lib_suites test_lib_tests)
+foreach(libtest ${test_lib_tests})
+  string(REPLACE ":" ";" libtest ${libtest})
+  list(GET libtest 0 suite)
+  list(GET libtest 1 test)
+  set(libtestname "CUnit_${suite}_${test}")
+  if("${CMAKE_HOST_SYSTEM}" MATCHES ".*Windows.*")
+    set_property(TEST ${libtestname} APPEND PROPERTY ENVIRONMENT "${test_lib_native_dir}")
+  else()
+    set_property(TEST ${libtestname} APPEND PROPERTY ENVIRONMENT "LD_LIBRARY_PATH=${test_lib_native_dir};$ENV{LD_LIBRARY_PATH}")
+  endif()
+endforeach()
+
+
+function( add_mock libname casename )
+
+
+  PREPEND(srcs_mock_authentication_all_ok "${CMAKE_CURRENT_LIST_DIR}/plugin_mock/${casename}"
+      "mock_${libname}.c"
+  )
+   
+#   PREPEND(hdrs_private_authentication_all_ok "${CMAKE_CURRENT_LIST_DIR}/plugin_mock/${casename}"
+#        "mock_${libname}.h"
+#   )
+#   
+  add_library("dds_security_${casename}" SHARED "")
+  
+  generate_export_header(
+          "dds_security_${casename}"
+          BASE_NAME SECURITY
+          EXPORT_FILE_NAME "${CMAKE_CURRENT_BINARY_DIR}/include/dds/security/${casename}_export.h"
+  )
+  
+  set_target_properties(
+          "dds_security_${casename}"
+          PROPERTIES
+          RUNTIME_OUTPUT_DIRECTORY                ${CMAKE_CURRENT_BINARY_DIR}
+          RUNTIME_OUTPUT_DIRECTORY_DEBUG          ${CMAKE_CURRENT_BINARY_DIR}
+          RUNTIME_OUTPUT_DIRECTORY_RELEASE        ${CMAKE_CURRENT_BINARY_DIR}
+          RUNTIME_OUTPUT_DIRECTORY_RELWITHDEBINFO ${CMAKE_CURRENT_BINARY_DIR}
+          RUNTIME_OUTPUT_DIRECTORY_MINSIZEREL     ${CMAKE_CURRENT_BINARY_DIR}
+          LIBRARY_OUTPUT_DIRECTORY                ${CMAKE_CURRENT_BINARY_DIR}
+          LIBRARY_OUTPUT_DIRECTORY_DEBUG          ${CMAKE_CURRENT_BINARY_DIR}
+          LIBRARY_OUTPUT_DIRECTORY_RELEASE        ${CMAKE_CURRENT_BINARY_DIR}
+          LIBRARY_OUTPUT_DIRECTORY_RELWITHDEBINFO ${CMAKE_CURRENT_BINARY_DIR}
+          LIBRARY_OUTPUT_DIRECTORY_MINSIZEREL     ${CMAKE_CURRENT_BINARY_DIR} )
+  
+  
+  #find_package(OpenSSL )
+  
+  target_link_libraries("dds_security_${casename}" PUBLIC ddsc)
+  #target_link_libraries("dds_security_${casename}" PUBLIC OpenSSL::SSL)
+  
+  target_sources("dds_security_${casename}"
+      PRIVATE
+          ${srcs_mock_authentication_all_ok}
+  
+  )
+  
+  target_include_directories("dds_security_${casename}"
+      PUBLIC
+          "$<BUILD_INTERFACE:$<TARGET_PROPERTY:security_api,INTERFACE_INCLUDE_DIRECTORIES>>"
+          "$<BUILD_INTERFACE:$<TARGET_PROPERTY:security_core,INTERFACE_INCLUDE_DIRECTORIES>>"
+          "$<BUILD_INTERFACE:$<TARGET_PROPERTY:ddsrt,INTERFACE_INCLUDE_DIRECTORIES>>"
+          "$<BUILD_INTERFACE:${CMAKE_CURRENT_BINARY_DIR}/include>"
+          
+  )
+
+
+endfunction()
+
+#PLUGIN MOCKS
+add_mock( authentication authentication_all_ok )
+add_mock( authentication authentication_all_ok_other )
+add_mock( authentication authentication_missing_function )
+add_mock( authentication authentication_finalize_error )
+add_mock( access_control access_control_all_ok )
+add_mock( access_control access_control_missing_function )
+add_mock( cryptography cryptography_all_ok )
+add_mock( cryptography cryptography_missing_function )
+add_mock( authentication authentication_init_error )
+
+
diff --git a/src/security/core/tests/plugin_loading/config_env.h.in b/src/security/core/tests/plugin_loading/config_env.h.in
new file mode 100644
index 0000000..203620f
--- /dev/null
+++ b/src/security/core/tests/plugin_loading/config_env.h.in
@@ -0,0 +1,21 @@
+/*
+ * Copyright(c) 2006 to 2019 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+#ifndef CONFIG_ENV_H
+#define CONFIG_ENV_H
+
+#define CONFIG_ENV_PLUGIN_MOCK_DIR "@CUnit_plugin_mock_dir@"
+#define TEST_LIB_DIR    "@test_lib_dir@"
+#define TEST_LIB_SEP    "@test_lib_sep@"
+#define TEST_LIB_SUFFIX "@CMAKE_SHARED_LIBRARY_SUFFIX@"
+#define TEST_LIB_PREFIX "@CMAKE_SHARED_LIBRARY_PREFIX@"
+
+#endif /* CONFIG_ENV_H */
diff --git a/src/security/core/tests/plugin_loading/plugin_loading.c b/src/security/core/tests/plugin_loading/plugin_loading.c
new file mode 100644
index 0000000..b3d145d
--- /dev/null
+++ b/src/security/core/tests/plugin_loading/plugin_loading.c
@@ -0,0 +1,910 @@
+/*
+ * Copyright(c) 2006 to 2019 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+#include <stdlib.h>
+#include <dds/security/dds_security_api_defs.h>
+
+#include "dds/dds.h"
+#include "CUnit/Test.h"
+#include "config_env.h"
+
+#include "dds/version.h"
+#include "dds/ddsrt/cdtors.h"
+#include "dds/ddsrt/environ.h"
+#include "dds/ddsrt/heap.h"
+//#include "dds/ddsi/ddsi_security_omg.h"
+
+#define FORCE_ENV
+
+#define URI_VARIABLE DDS_PROJECT_NAME_NOSPACE_CAPS"_URI"
+#define MAX_PARTICIPANTS_VARIABLE "MAX_PARTICIPANTS"
+static bool print_log=true;
+
+static int patmatch (const char *pat, const char *str)
+{
+  while (*pat)
+  {
+    if (*pat == '?')
+    {
+      /* any character will do */
+      if (*str++ == 0)
+      {
+        return 0;
+      }
+      pat++;
+    }
+    else if (*pat == '*')
+    {
+      /* collapse a sequence of wildcards, requiring as many
+       characters in str as there are ?s in the sequence */
+      while (*pat == '*' || *pat == '?')
+      {
+        if (*pat == '?' && *str++ == 0)
+        {
+          return 0;
+        }
+        pat++;
+      }
+      /* try matching on all positions where str matches pat */
+      while (*str)
+      {
+        if (*str == *pat && patmatch (pat+1, str+1))
+        {
+          return 1;
+        }
+        str++;
+      }
+      return *pat == 0;
+    }
+    else
+    {
+      /* only an exact match */
+      if (*str++ != *pat++)
+      {
+        return 0;
+      }
+    }
+  }
+  return *str == 0;
+}
+
+
+/*
+ * The 'found' variable will contain flags related to the expected log
+ * messages that were received.
+ * Using flags will allow to show that when message isn't received,
+ * which one it was.
+ */
+static uint32_t found;
+static void logger(void *ptr, const dds_log_data_t *data) {
+  char **expected = (char **) ptr;
+  if (print_log) {
+    printf("%s\n", data->message);
+  }
+  for (uint32_t i = 0; expected[i] != NULL; i++) {
+      if (patmatch(expected[i], data->message)) {
+          found |= (uint32_t)(1 << i);
+      }
+  }
+}
+
+
+CU_Test(ddssec_security_plugin_loading, all_ok, .init = ddsrt_init, .fini = ddsrt_fini) {
+
+    /* Expected traces when creating participant with the security elements. */
+    const char *log_expected[] = {
+        "DDS Security plugins have been loaded*",
+        NULL
+    };
+
+    const char *sec_config =
+      "<"DDS_PROJECT_NAME">"
+        "<Domain id=\"any\">"
+          "<Tracing><Verbosity>finest</></>"
+          "<DDSSecurity>"
+            "<Authentication>"
+              "<Library path=\"dds_security_authentication_all_ok\" initFunction=\"init_authentication\" finalizeFunction=\"finalize_authentication\" />"
+              "<IdentityCertificate>testtext_IdentityCertificate_testtext</IdentityCertificate>"
+              "<IdentityCA>testtext_IdentityCA_testtext</IdentityCA>"
+              "<PrivateKey>testtext_PrivateKey_testtext</PrivateKey>"
+              "<Password>testtext_Password_testtext</Password>"
+              "<TrustedCADirectory>testtext_Dir_testtext</TrustedCADirectory>"
+            "</Authentication>"
+            "<Cryptographic>"
+              "<Library path=\"dds_security_cryptography_all_ok\" initFunction=\"init_crypto\" finalizeFunction=\"finalize_crypto\"/>"
+            "</Cryptographic>"
+            "<AccessControl>"
+              "<Library path=\"dds_security_access_control_all_ok\" initFunction=\"init_access_control\" finalizeFunction=\"finalize_access_control\"/>"
+              "<Governance>file:Governance.p7s</Governance>"
+              "<PermissionsCA>file:Permissions_CA.pem</PermissionsCA>"
+              "<Permissions>file:Permissions.p7s</Permissions>"
+            "</AccessControl>"
+          "</DDSSecurity>"
+        "</Domain>"
+      "</"DDS_PROJECT_NAME">";
+
+
+    dds_entity_t participant;
+
+    /* Set up the trace sinks to detect the config parsing. */
+    dds_set_log_mask(DDS_LC_FATAL|DDS_LC_ERROR|DDS_LC_WARNING|DDS_LC_INFO| DDS_LC_TRACE);
+    dds_set_log_sink(&logger, (void*)log_expected);
+    dds_set_trace_sink(&logger, (void*)log_expected);
+
+    /* Create participant with security elements. */
+    found = 0;
+    ddsrt_setenv(URI_VARIABLE, sec_config);
+    participant = dds_create_participant(DDS_DOMAIN_DEFAULT, NULL, NULL);
+    dds_set_log_sink(NULL,NULL);
+    dds_set_trace_sink(NULL,NULL);
+    ddsrt_setenv(URI_VARIABLE, "");
+    CU_ASSERT_FATAL(found == 0x1);
+
+
+    dds_delete(participant);
+
+}
+
+CU_Test(ddssec_security_plugin_loading, missing_finalize, .init = ddsrt_init, .fini = ddsrt_fini) {
+
+    /* Expected traces when creating participant with the security elements. */
+  const char *log_expected[] = {
+      "Could not find the function: finalize_authentication*",
+      "Could not load Authentication plugin*",
+      NULL
+  };
+
+  const char *sec_config =
+    "<"DDS_PROJECT_NAME">"
+      "<Domain id=\"any\">"
+        "<Tracing><Verbosity>finest</></>"
+        "<DDSSecurity>"
+          "<Authentication>"
+            "<Library path=\"dds_security_authentication_finalize_error\" initFunction=\"init_authentication\" finalizeFunction=\"finalize_authentication\" />"
+            "<IdentityCertificate>testtext_IdentityCertificate_testtext</IdentityCertificate>"
+            "<IdentityCA>testtext_IdentityCA_testtext</IdentityCA>"
+            "<PrivateKey>testtext_PrivateKey_testtext</PrivateKey>"
+            "<Password>testtext_Password_testtext</Password>"
+            "<TrustedCADirectory>testtext_Dir_testtext</TrustedCADirectory>"
+          "</Authentication>"
+          "<Cryptographic>"
+            "<Library path=\"dds_security_cryptography_all_ok\" initFunction=\"init_crypto\" finalizeFunction=\"finalize_crypto\"/>"
+          "</Cryptographic>"
+          "<AccessControl>"
+            "<Library path=\"dds_security_access_control_all_ok\" initFunction=\"init_access_control\" finalizeFunction=\"finalize_access_control\"/>"
+            "<Governance>file:Governance.p7s</Governance>"
+            "<PermissionsCA>file:Permissions_CA.pem</PermissionsCA>"
+            "<Permissions>file:Permissions.p7s</Permissions>"
+          "</AccessControl>"
+        "</DDSSecurity>"
+      "</Domain>"
+    "</"DDS_PROJECT_NAME">";
+
+
+    dds_entity_t participant;
+
+    /* Set up the trace sinks to detect the config parsing. */
+    dds_set_log_mask(DDS_LC_FATAL|DDS_LC_ERROR|DDS_LC_WARNING|DDS_LC_CONFIG);
+    dds_set_log_sink(&logger, (void*)log_expected);
+    dds_set_trace_sink(&logger, (void*)log_expected);
+
+    /* Create participant with security elements. */
+    found = 0;
+    ddsrt_setenv(URI_VARIABLE, sec_config);
+    participant = dds_create_participant(DDS_DOMAIN_DEFAULT, NULL, NULL);
+    dds_set_log_sink( NULL, NULL );
+    dds_set_trace_sink(NULL, NULL);
+    ddsrt_setenv(URI_VARIABLE, "");
+#ifdef PR304_MERGED
+    /* It is better dds to return DDS_RETCODE_NOT_ALLOWED_BY_SECURITY instead of DDS_RETCODE_ERROR
+    CU_ASSERT_FATAL( participant == DDS_RETCODE_NOT_ALLOWED_BY_SECURITY ); */
+    CU_ASSERT_FATAL( participant == DDS_RETCODE_ERROR );
+#else
+    dds_delete(participant);
+#endif
+    CU_ASSERT_FATAL(found == 0x3);
+
+}
+
+
+CU_Test(ddssec_security_plugin_loading, authentication_missing_function, .init = ddsrt_init, .fini = ddsrt_fini) {
+
+  /* Expected traces when creating participant with the security elements. */
+  const char *log_expected[] = {
+          "Could not find the function for Authentication: get_shared_secret*",
+          "Could not load security*",
+          NULL
+  };
+
+  const char *sec_config =
+          "<"DDS_PROJECT_NAME">"
+            "<Domain id=\"any\">"
+            "<Tracing><Verbosity>finest</></>"
+            "<DDSSecurity>"
+              "<Authentication>"
+                "<Library path=\"dds_security_authentication_missing_function\" initFunction=\"init_authentication\" finalizeFunction=\"finalize_authentication\" />"
+                "<IdentityCertificate>testtext_IdentityCertificate_testtext</IdentityCertificate>"
+                "<IdentityCA>testtext_IdentityCA_testtext</IdentityCA>"
+                "<PrivateKey>testtext_PrivateKey_testtext</PrivateKey>"
+                "<Password>testtext_Password_testtext</Password>"
+                "<TrustedCADirectory>testtext_Dir_testtext</TrustedCADirectory>"
+              "</Authentication>"
+              "<Cryptographic>"
+                "<Library path=\"dds_security_cryptography_all_ok\" initFunction=\"init_crypto\" finalizeFunction=\"finalize_crypto\"/>"
+              "</Cryptographic>"
+              "<AccessControl>"
+                "<Library path=\"dds_security_access_control_all_ok\" initFunction=\"init_access_control\" finalizeFunction=\"finalize_access_control\"/>"
+                "<Governance>file:Governance.p7s</Governance>"
+                "<PermissionsCA>file:Permissions_CA.pem</PermissionsCA>"
+                "<Permissions>file:Permissions.p7s</Permissions>"
+              "</AccessControl>"
+            "</DDSSecurity>"
+          "</Domain>"
+          "</"DDS_PROJECT_NAME">";
+
+
+  dds_entity_t participant;
+
+  /* Set up the trace sinks to detect the config parsing. */
+  dds_set_log_mask(DDS_LC_ERROR);
+  dds_set_log_sink(&logger, (void*)log_expected);
+  dds_set_trace_sink(&logger, (void*)log_expected);
+
+  /* Create participant with security elements. */
+  found = 0;
+  ddsrt_setenv(URI_VARIABLE, sec_config);
+  print_log = true;
+  participant = dds_create_participant(DDS_DOMAIN_DEFAULT, NULL, NULL);
+  dds_set_log_sink(NULL, NULL);
+  dds_set_trace_sink(NULL, NULL);
+  ddsrt_setenv(URI_VARIABLE, "");
+#ifdef PR304_MERGED
+  /* It is better dds to return DDS_RETCODE_NOT_ALLOWED_BY_SECURITY instead of DDS_RETCODE_ERROR
+    CU_ASSERT_FATAL( participant == DDS_RETCODE_NOT_ALLOWED_BY_SECURITY ); */
+    CU_ASSERT_FATAL( participant == DDS_RETCODE_ERROR );
+#else
+  dds_delete(participant);
+#endif
+  CU_ASSERT_FATAL(found == 0x3);
+
+
+}
+
+
+CU_Test(ddssec_security_plugin_loading, access_control_missing_function, .init = ddsrt_init, .fini = ddsrt_fini) {
+
+  /* Expected traces when creating participant with the security elements. */
+  const char *log_expected[] = {
+          "Could not find the function for Access Control: check_create_datareader*",
+          "Could not load security*",
+          NULL
+  };
+
+  const char *sec_config =
+          "<"DDS_PROJECT_NAME">"
+          "<Domain id=\"any\">"
+          "<Tracing><Verbosity>finest</></>"
+          "<DDSSecurity>"
+          "<Authentication>"
+          "<Library path=\"dds_security_authentication_all_ok\" initFunction=\"init_authentication\" finalizeFunction=\"finalize_authentication\" />"
+          "<IdentityCertificate>testtext_IdentityCertificate_testtext</IdentityCertificate>"
+          "<IdentityCA>testtext_IdentityCA_testtext</IdentityCA>"
+          "<PrivateKey>testtext_PrivateKey_testtext</PrivateKey>"
+          "<Password>testtext_Password_testtext</Password>"
+          "<TrustedCADirectory>testtext_Dir_testtext</TrustedCADirectory>"
+          "</Authentication>"
+          "<Cryptographic>"
+          "<Library path=\"dds_security_cryptography_all_ok\" initFunction=\"init_crypto\" finalizeFunction=\"finalize_crypto\"/>"
+          "</Cryptographic>"
+          "<AccessControl>"
+          "<Library path=\"dds_security_access_control_missing_function\" initFunction=\"init_access_control\" finalizeFunction=\"finalize_access_control\"/>"
+          "<Governance>file:Governance.p7s</Governance>"
+          "<PermissionsCA>file:Permissions_CA.pem</PermissionsCA>"
+          "<Permissions>file:Permissions.p7s</Permissions>"
+          "</AccessControl>"
+          "</DDSSecurity>"
+          "</Domain>"
+          "</"DDS_PROJECT_NAME">";
+
+
+  dds_entity_t participant;
+
+  /* Set up the trace sinks to detect the config parsing. */
+  dds_set_log_mask(DDS_LC_FATAL|DDS_LC_ERROR);
+  dds_set_log_sink(&logger, (void*)log_expected);
+  dds_set_trace_sink(&logger, (void*)log_expected);
+
+  /* Create participant with security elements. */
+  found = 0;
+  ddsrt_setenv(URI_VARIABLE, sec_config);
+  participant = dds_create_participant(DDS_DOMAIN_DEFAULT, NULL, NULL);
+  ddsrt_setenv(URI_VARIABLE, "");
+  dds_set_log_sink(NULL, NULL);
+  dds_set_trace_sink(NULL, NULL);
+
+#ifdef PR304_MERGED
+  /* It is better dds to return DDS_RETCODE_NOT_ALLOWED_BY_SECURITY instead of DDS_RETCODE_ERROR
+    CU_ASSERT_FATAL( participant == DDS_RETCODE_NOT_ALLOWED_BY_SECURITY ); */
+    CU_ASSERT_FATAL( participant == DDS_RETCODE_ERROR );
+#else
+  dds_delete(participant);
+#endif
+  CU_ASSERT_FATAL(found == 0x3);
+
+
+
+}
+
+
+CU_Test(ddssec_security_plugin_loading, cryptography_missing_function, .init = ddsrt_init, .fini = ddsrt_fini) {
+
+  /* Expected traces when creating participant with the security elements. */
+  const char *log_expected[] = {
+          "Could not find the function for Cryptographic: set_remote_participant_crypto_tokens*",
+          "Could not load security*",
+          NULL
+  };
+
+  const char *sec_config =
+          "<"DDS_PROJECT_NAME">"
+          "<Domain id=\"any\">"
+          "<Tracing><Verbosity>finest</></>"
+          "<DDSSecurity>"
+          "<Authentication>"
+          "<Library path=\"dds_security_authentication_all_ok\" initFunction=\"init_authentication\" finalizeFunction=\"finalize_authentication\" />"
+          "<IdentityCertificate>testtext_IdentityCertificate_testtext</IdentityCertificate>"
+          "<IdentityCA>testtext_IdentityCA_testtext</IdentityCA>"
+          "<PrivateKey>testtext_PrivateKey_testtext</PrivateKey>"
+          "<Password>testtext_Password_testtext</Password>"
+          "<TrustedCADirectory>testtext_Dir_testtext</TrustedCADirectory>"
+          "</Authentication>"
+          "<Cryptographic>"
+          "<Library path=\"dds_security_cryptography_missing_function\" initFunction=\"init_crypto\" finalizeFunction=\"finalize_crypto\"/>"
+          "</Cryptographic>"
+          "<AccessControl>"
+          "<Library path=\"dds_security_access_control_all_ok\" initFunction=\"init_access_control\" finalizeFunction=\"finalize_access_control\"/>"
+          "<Governance>file:Governance.p7s</Governance>"
+          "<PermissionsCA>file:Permissions_CA.pem</PermissionsCA>"
+          "<Permissions>file:Permissions.p7s</Permissions>"
+          "</AccessControl>"
+          "</DDSSecurity>"
+          "</Domain>"
+          "</"DDS_PROJECT_NAME">";
+
+
+  dds_entity_t participant;
+
+  /* Set up the trace sinks to detect the config parsing. */
+  dds_set_log_mask(DDS_LC_FATAL|DDS_LC_ERROR|DDS_LC_WARNING);
+  dds_set_log_sink(&logger, (void*)log_expected);
+  dds_set_trace_sink(&logger, (void*)log_expected);
+
+  /* Create participant with security elements. */
+  found = 0;
+  ddsrt_setenv(URI_VARIABLE, sec_config);
+  participant = dds_create_participant(DDS_DOMAIN_DEFAULT, NULL, NULL);
+  ddsrt_setenv(URI_VARIABLE, "");
+  dds_set_log_sink(NULL, NULL);
+  dds_set_trace_sink(NULL, NULL);
+
+#ifdef PR304_MERGED
+  /* It is better dds to return DDS_RETCODE_NOT_ALLOWED_BY_SECURITY instead of DDS_RETCODE_ERROR
+    CU_ASSERT_FATAL( participant == DDS_RETCODE_NOT_ALLOWED_BY_SECURITY ); */
+    CU_ASSERT_FATAL( participant == DDS_RETCODE_ERROR );
+#else
+  dds_delete(participant);
+#endif
+  CU_ASSERT_FATAL(found == 0x3);
+
+
+
+}
+
+
+CU_Test(ddssec_security_plugin_loading, no_library_in_path, .init = ddsrt_init, .fini = ddsrt_fini) {
+
+  /* Expected traces when creating participant with the security elements. */
+  const char *log_expected[] = {
+          "Could not load Authentication library: no_library_in_path: cannot open shared object file: No such file or directory*",
+          "Could not load Authentication library: *not*found*",
+          "Could not load Authentication plugin*",
+          "Could not load security*",
+          NULL
+  };
+
+  const char *sec_config =
+          "<"DDS_PROJECT_NAME">"
+            "<Domain id=\"any\">"
+              "<Tracing><Verbosity>finest</></>"
+              "<DDSSecurity>"
+                "<Authentication>"
+                  "<Library path=\"no_library_in_path\" initFunction=\"init_authentication\" finalizeFunction=\"finalize_authentication\" />"
+                  "<IdentityCertificate>testtext_IdentityCertificate_testtext</IdentityCertificate>"
+                  "<IdentityCA>testtext_IdentityCA_testtext</IdentityCA>"
+                  "<PrivateKey>testtext_PrivateKey_testtext</PrivateKey>"
+                  "<Password>testtext_Password_testtext</Password>"
+                  "<TrustedCADirectory>testtext_Dir_testtext</TrustedCADirectory>"
+                "</Authentication>"
+                "<Cryptographic>"
+                  "<Library path=\"dds_security_cryptography_all_ok\" initFunction=\"init_crypto\" finalizeFunction=\"finalize_crypto\"/>"
+                "</Cryptographic>"
+                "<AccessControl>"
+                  "<Library path=\"dds_security_access_control_all_ok\" initFunction=\"init_access_control\" finalizeFunction=\"finalize_access_control\"/>"
+                  "<Governance>file:Governance.p7s</Governance>"
+                  "<PermissionsCA>file:Permissions_CA.pem</PermissionsCA>"
+                  "<Permissions>file:Permissions.p7s</Permissions>"
+                "</AccessControl>"
+              "</DDSSecurity>"
+            "</Domain>"
+          "</"DDS_PROJECT_NAME">";
+
+
+  dds_entity_t participant;
+
+  /* Set up the trace sinks to detect the config parsing. */
+  dds_set_log_mask(DDS_LC_FATAL|DDS_LC_ERROR|DDS_LC_WARNING|DDS_LC_INFO| DDS_LC_TRACE);
+  dds_set_log_sink(&logger, (void*)log_expected);
+  dds_set_trace_sink(&logger, (void*)log_expected);
+
+  /* Create participant with security elements. */
+  found = 0;
+  ddsrt_setenv(URI_VARIABLE, sec_config);
+  participant = dds_create_participant(DDS_DOMAIN_DEFAULT, NULL, NULL);
+  ddsrt_setenv(URI_VARIABLE, "");
+  dds_set_log_sink(NULL, NULL);
+  dds_set_trace_sink(NULL, NULL);
+
+#ifdef PR304_MERGED
+  /* It is better dds to return DDS_RETCODE_NOT_ALLOWED_BY_SECURITY instead of DDS_RETCODE_ERROR
+    CU_ASSERT_FATAL( participant == DDS_RETCODE_NOT_ALLOWED_BY_SECURITY ); */
+    CU_ASSERT_FATAL( participant == DDS_RETCODE_ERROR );
+#else
+  dds_delete(participant);
+#endif
+  
+  CU_ASSERT_FATAL(found == 0xd || found == 0xe);
+
+  dds_delete(participant);
+
+}
+
+
+CU_Test(ddssec_security_plugin_loading, init_error, .init = ddsrt_init, .fini = ddsrt_fini) {
+
+  /* Expected traces when creating participant with the security elements. */
+  const char *log_expected[] = {
+          "Error occured while initializing Authentication plugin*",
+          "Could not load Authentication plugin*",
+          "Could not load security*",
+          NULL
+  };
+
+  const char *sec_config =
+          "<"DDS_PROJECT_NAME">"
+            "<Domain id=\"any\">"
+              "<Tracing><Verbosity>finest</></>"
+              "<DDSSecurity>"
+                "<Authentication>"
+                  "<Library path=\"dds_security_authentication_init_error\" initFunction=\"init_authentication\" finalizeFunction=\"finalize_authentication\" />"
+                  "<IdentityCertificate>testtext_IdentityCertificate_testtext</IdentityCertificate>"
+                  "<IdentityCA>testtext_IdentityCA_testtext</IdentityCA>"
+                  "<PrivateKey>testtext_PrivateKey_testtext</PrivateKey>"
+                  "<Password>testtext_Password_testtext</Password>"
+                  "<TrustedCADirectory>testtext_Dir_testtext</TrustedCADirectory>"
+                "</Authentication>"
+                "<Cryptographic>"
+                  "<Library path=\"dds_security_cryptography_all_ok\" initFunction=\"init_crypto\" finalizeFunction=\"finalize_crypto\"/>"
+                "</Cryptographic>"
+                "<AccessControl>"
+                  "<Library path=\"dds_security_access_control_all_ok\" initFunction=\"init_access_control\" finalizeFunction=\"finalize_access_control\"/>"
+                  "<Governance>file:Governance.p7s</Governance>"
+                  "<PermissionsCA>file:Permissions_CA.pem</PermissionsCA>"
+                  "<Permissions>file:Permissions.p7s</Permissions>"
+                "</AccessControl>"
+              "</DDSSecurity>"
+            "</Domain>"
+          "</"DDS_PROJECT_NAME">";
+
+
+  dds_entity_t participant;
+
+  /* Set up the trace sinks to detect the config parsing. */
+  dds_set_log_mask(DDS_LC_FATAL|DDS_LC_ERROR|DDS_LC_WARNING|DDS_LC_INFO| DDS_LC_TRACE);
+  dds_set_log_sink(&logger, (void*)log_expected);
+  dds_set_trace_sink(&logger, (void*)log_expected);
+
+  /* Create participant with security elements. */
+  found = 0;
+  ddsrt_setenv(URI_VARIABLE, sec_config);
+  participant = dds_create_participant(DDS_DOMAIN_DEFAULT, NULL, NULL);
+  ddsrt_setenv(URI_VARIABLE, "");
+  dds_set_log_sink(NULL, NULL);
+  dds_set_trace_sink(NULL, NULL);
+
+#ifdef PR304_MERGED
+  /* It is better dds to return DDS_RETCODE_NOT_ALLOWED_BY_SECURITY instead of DDS_RETCODE_ERROR
+    CU_ASSERT_FATAL( participant == DDS_RETCODE_NOT_ALLOWED_BY_SECURITY ); */
+    CU_ASSERT_FATAL( participant == DDS_RETCODE_ERROR );
+#else
+  dds_delete(participant);
+#endif
+  CU_ASSERT_FATAL(found == 0x7);
+
+
+  dds_delete(participant);
+
+}
+CU_Test(ddssec_security_plugin_loading, all_ok_with_props, .init = ddsrt_init, .fini = ddsrt_fini) {
+  /* Expected traces when creating participant with the security elements. */
+  const char *log_expected[] = {
+          "DDS Security plugins have been loaded*",
+          NULL
+  };
+
+  dds_entity_t participant;
+  dds_qos_t * qos;
+  
+  
+  /* Set up the trace sinks to detect the config parsing. */
+  dds_set_log_mask(DDS_LC_INFO);
+  dds_set_log_sink(&logger, (void*)log_expected);
+  dds_set_trace_sink(&logger, (void*)log_expected);
+  
+  /* Create the qos */
+  unsigned char bvalue[3] = { 0x01, 0x02, 0x03 };
+  CU_ASSERT_FATAL ((qos = dds_create_qos()) != NULL);
+  dds_qset_prop (qos, "test.prop1", "testtext_value1_testtext");
+  dds_qset_prop (qos, DDS_SEC_PROP_AUTH_IDENTITY_CA, "testtext_IdentityCA_testtext");
+  dds_qset_prop (qos, DDS_SEC_PROP_AUTH_PRIV_KEY, "testtext_PrivateKey_testtext");
+  dds_qset_prop (qos, DDS_SEC_PROP_AUTH_IDENTITY_CERT, "testtext_IdentityCertificate_testtext");
+  dds_qset_prop (qos, DDS_SEC_PROP_ACCESS_PERMISSIONS_CA, "file:Permissions_CA.pem");
+  dds_qset_prop (qos, DDS_SEC_PROP_ACCESS_GOVERNANCE, "file:Governance.p7s");
+  dds_qset_prop (qos, DDS_SEC_PROP_ACCESS_PERMISSIONS, "file:Permissions.p7s");
+  dds_qset_prop (qos, DDS_SEC_PROP_AUTH_PASSWORD, "testtext_Password_testtext");
+  dds_qset_prop (qos, DDS_SEC_PROP_ACCESS_TRUSTED_CA_DIR, "file:/test/dir");
+
+  dds_qset_prop (qos, DDS_SEC_PROP_AUTH_LIBRARY_PATH, "dds_security_authentication_all_ok");
+  dds_qset_prop (qos, DDS_SEC_PROP_AUTH_LIBRARY_INIT, "init_authentication");
+  dds_qset_prop (qos, DDS_SEC_PROP_AUTH_LIBRARY_FINALIZE, "finalize_authentication");
+  dds_qset_prop (qos, DDS_SEC_PROP_CRYPTO_LIBRARY_PATH, "dds_security_cryptography_all_ok");
+  dds_qset_prop (qos, DDS_SEC_PROP_CRYPTO_LIBRARY_INIT, "init_crypto");
+  dds_qset_prop (qos, DDS_SEC_PROP_CRYPTO_LIBRARY_FINALIZE, "finalize_crypto");
+  dds_qset_prop (qos, DDS_SEC_PROP_ACCESS_LIBRARY_PATH, "dds_security_access_control_all_ok");
+  dds_qset_prop (qos, DDS_SEC_PROP_ACCESS_LIBRARY_INIT, "init_access_control");
+  dds_qset_prop (qos, DDS_SEC_PROP_ACCESS_LIBRARY_FINALIZE, "finalize_access_control");
+
+  dds_qset_prop (qos, "test.prop2", "testtext_value2_testtext");
+
+  dds_qset_prop (qos, DDS_SEC_PROP_AUTH_IDENTITY_CA, "testtext_IdentityCA_testtext");
+
+  dds_qset_bprop (qos, "test.bprop1", bvalue, 3);
+
+  /* Create participant with security config in qos. */
+  found = 0;
+  ddsrt_setenv(URI_VARIABLE, "<Tracing><Verbosity>finest</></>");
+  CU_ASSERT_FATAL ((participant = dds_create_participant(DDS_DOMAIN_DEFAULT, qos, NULL)) > 0);
+  ddsrt_setenv(URI_VARIABLE, "");
+  dds_set_log_sink(NULL, NULL);
+  dds_set_trace_sink(NULL, NULL);
+
+  dds_delete(participant);
+  dds_delete_qos(qos);
+  CU_ASSERT_FATAL(found == 0x1);
+}
+
+
+
+CU_Test(ddssec_security_plugin_loading, missing_plugin_property_with_props, .init = ddsrt_init, .fini = ddsrt_fini) {
+  /* Expected traces when creating participant with the security elements. */
+  const char *log_expected[] = {
+          "*using security settings from QoS*",
+          "*required security property dds.sec.auth.library.init missing in Property QoS*",
+          NULL
+  };
+
+  dds_entity_t participant;
+  dds_qos_t * qos;
+
+  /* Set up the trace sinks to detect the config parsing. */
+  dds_set_log_mask(DDS_LC_INFO|DDS_LC_ERROR);
+  dds_set_log_sink(&logger, (void*)log_expected);
+  dds_set_trace_sink(&logger, (void*)log_expected);
+
+  /* Create the qos */
+  unsigned char bvalue[3] = { 0x01, 0x02, 0x03 };
+  CU_ASSERT_FATAL ((qos = dds_create_qos()) != NULL);
+  dds_qset_prop (qos, "test.prop1", "testtext_value1_testtext");
+  dds_qset_prop (qos, DDS_SEC_PROP_AUTH_IDENTITY_CA, "testtext_IdentityCA_testtext");
+  dds_qset_prop (qos, DDS_SEC_PROP_AUTH_PRIV_KEY, "testtext_PrivateKey_testtext");
+  dds_qset_prop (qos, DDS_SEC_PROP_AUTH_IDENTITY_CERT, "testtext_IdentityCertificate_testtext");
+  dds_qset_prop (qos, DDS_SEC_PROP_ACCESS_PERMISSIONS_CA, "file:Permissions_CA.pem");
+  dds_qset_prop (qos, DDS_SEC_PROP_ACCESS_GOVERNANCE, "file:Governance.p7s");
+  dds_qset_prop (qos, DDS_SEC_PROP_ACCESS_PERMISSIONS, "file:Permissions.p7s");
+  dds_qset_prop (qos, DDS_SEC_PROP_AUTH_PASSWORD, "testtext_Password_testtext");
+  dds_qset_prop (qos, DDS_SEC_PROP_ACCESS_TRUSTED_CA_DIR, "file:/test/dir");
+
+  dds_qset_prop (qos, DDS_SEC_PROP_AUTH_LIBRARY_PATH, "dds_security_authentication_all_ok");
+  dds_qset_prop (qos, DDS_SEC_PROP_AUTH_LIBRARY_FINALIZE, "finalize_authentication");
+  dds_qset_prop (qos, DDS_SEC_PROP_CRYPTO_LIBRARY_PATH, "dds_security_cryptography_all_ok");
+  dds_qset_prop (qos, DDS_SEC_PROP_CRYPTO_LIBRARY_INIT, "init_crypto");
+  dds_qset_prop (qos, DDS_SEC_PROP_CRYPTO_LIBRARY_FINALIZE, "finalize_crypto");
+  dds_qset_prop (qos, DDS_SEC_PROP_ACCESS_LIBRARY_PATH, "dds_security_access_control_all_ok");
+  dds_qset_prop (qos, DDS_SEC_PROP_ACCESS_LIBRARY_INIT, "init_access_control");
+  dds_qset_prop (qos, DDS_SEC_PROP_ACCESS_LIBRARY_FINALIZE, "finalize_access_control");
+
+  dds_qset_prop (qos, "test.prop2", "testtext_value2_testtext");
+  dds_qset_prop (qos, DDS_SEC_PROP_AUTH_IDENTITY_CA, "testtext_IdentityCA_testtext");
+  dds_qset_bprop (qos, "test.bprop1", bvalue, 3);
+
+  /* Create participant with security config in qos. */
+  found = 0;
+  ddsrt_setenv(URI_VARIABLE, "<Tracing><Verbosity>finest</></>");
+  participant = dds_create_participant(DDS_DOMAIN_DEFAULT, qos, NULL);
+  dds_set_log_sink(NULL, NULL);
+  dds_set_trace_sink(NULL, NULL);
+  ddsrt_setenv(URI_VARIABLE, "");
+#ifdef PR304_MERGED
+  /* It is better dds to return DDS_RETCODE_NOT_ALLOWED_BY_SECURITY instead of DDS_RETCODE_ERROR
+    CU_ASSERT_FATAL( participant == DDS_RETCODE_NOT_ALLOWED_BY_SECURITY ); */
+    CU_ASSERT_FATAL( participant == DDS_RETCODE_ERROR );
+#else
+  dds_delete(participant);
+#endif
+  CU_ASSERT_FATAL(found == 0x3);
+  dds_delete_qos(qos);
+}
+
+
+
+CU_Test(ddssec_security_plugin_loading, empty_plugin_property_with_props, .init = ddsrt_init, .fini = ddsrt_fini) {
+  /* Expected traces when creating participant with the security elements. */
+  const char *log_expected[] = {
+          "*using security settings from QoS*",
+          "*required security property dds.sec.auth.library.finalize missing in Property QoS*",
+          NULL
+  };
+
+  dds_entity_t participant;
+  dds_qos_t * qos;
+
+  /* Set up the trace sinks to detect the config parsing. */
+  dds_set_log_mask(DDS_LC_INFO|DDS_LC_ERROR);
+  dds_set_log_sink(&logger, (void*)log_expected);
+  dds_set_trace_sink(&logger, (void*)log_expected);
+
+  /* Create the qos */
+  unsigned char bvalue[3] = { 0x01, 0x02, 0x03 };
+  CU_ASSERT_FATAL ((qos = dds_create_qos()) != NULL);
+  dds_qset_prop (qos, "test.prop1", "testtext_value1_testtext");
+  dds_qset_prop (qos, DDS_SEC_PROP_AUTH_IDENTITY_CA, "testtext_IdentityCA_testtext");
+  dds_qset_prop (qos, DDS_SEC_PROP_AUTH_PRIV_KEY, "testtext_PrivateKey_testtext");
+  dds_qset_prop (qos, DDS_SEC_PROP_AUTH_IDENTITY_CERT, "testtext_IdentityCertificate_testtext");
+  dds_qset_prop (qos, DDS_SEC_PROP_ACCESS_PERMISSIONS_CA, "file:Permissions_CA.pem");
+  dds_qset_prop (qos, DDS_SEC_PROP_ACCESS_GOVERNANCE, "file:Governance.p7s");
+  dds_qset_prop (qos, DDS_SEC_PROP_ACCESS_PERMISSIONS, "file:Permissions.p7s");
+  dds_qset_prop (qos, DDS_SEC_PROP_AUTH_PASSWORD, "testtext_Password_testtext");
+  dds_qset_prop (qos, DDS_SEC_PROP_ACCESS_TRUSTED_CA_DIR, "file:/test/dir");
+
+  dds_qset_prop (qos, DDS_SEC_PROP_AUTH_LIBRARY_PATH, "dds_security_authentication_all_ok");
+  dds_qset_prop (qos, DDS_SEC_PROP_AUTH_LIBRARY_INIT, "init_authentication");
+  dds_qset_prop (qos, DDS_SEC_PROP_AUTH_LIBRARY_FINALIZE, "");
+  dds_qset_prop (qos, DDS_SEC_PROP_CRYPTO_LIBRARY_PATH, "dds_security_cryptography_all_ok");
+  dds_qset_prop (qos, DDS_SEC_PROP_CRYPTO_LIBRARY_INIT, "init_crypto");
+  dds_qset_prop (qos, DDS_SEC_PROP_CRYPTO_LIBRARY_FINALIZE, "finalize_crypto");
+  dds_qset_prop (qos, DDS_SEC_PROP_ACCESS_LIBRARY_PATH, "dds_security_access_control_all_ok");
+  dds_qset_prop (qos, DDS_SEC_PROP_ACCESS_LIBRARY_INIT, "init_access_control");
+  dds_qset_prop (qos, DDS_SEC_PROP_ACCESS_LIBRARY_FINALIZE, "finalize_access_control");
+
+  dds_qset_prop (qos, "test.prop2", "testtext_value2_testtext");
+  dds_qset_prop (qos, DDS_SEC_PROP_AUTH_IDENTITY_CA, "testtext_IdentityCA_testtext");
+  dds_qset_bprop (qos, "test.bprop1", bvalue, 3);
+
+  /* Create participant with security config in qos. */
+  found = 0;
+  ddsrt_setenv(URI_VARIABLE, "<Tracing><Verbosity>finest</></>");
+  participant = dds_create_participant(DDS_DOMAIN_DEFAULT, qos, NULL);
+  dds_set_log_sink(NULL, NULL);
+  dds_set_trace_sink(NULL, NULL);
+  ddsrt_setenv(URI_VARIABLE, "");
+#ifdef PR304_MERGED
+  /* It is better dds to return DDS_RETCODE_NOT_ALLOWED_BY_SECURITY instead of DDS_RETCODE_ERROR
+    CU_ASSERT_FATAL( participant == DDS_RETCODE_NOT_ALLOWED_BY_SECURITY ); */
+    CU_ASSERT_FATAL( participant == DDS_RETCODE_ERROR );
+#else
+  dds_delete(participant);
+#endif
+  CU_ASSERT_FATAL(found == 0x3);
+  dds_delete_qos(qos);
+}
+
+
+CU_Test(ddssec_security_plugin_loading, missing_security_property_with_props, .init = ddsrt_init, .fini = ddsrt_fini) {
+  /* Expected traces when creating participant with the security elements. */
+  const char *log_expected[] = {
+          "*using security settings from QoS*",
+          "*required security property dds.sec.access.permissions missing in Property QoS*",
+          NULL
+  };
+
+
+  dds_entity_t participant;
+  dds_qos_t * qos;
+
+  /* Set up the trace sinks to detect the config parsing. */
+  dds_set_log_mask(DDS_LC_INFO|DDS_LC_ERROR);
+  dds_set_log_sink(&logger, (void*)log_expected);
+  dds_set_trace_sink(&logger, (void*)log_expected);
+
+  /* Create the qos */
+  unsigned char bvalue[3] = { 0x01, 0x02, 0x03 };
+  CU_ASSERT_FATAL ((qos = dds_create_qos()) != NULL);
+  dds_qset_prop (qos, "test.prop1", "testtext_value1_testtext");
+  dds_qset_prop (qos, DDS_SEC_PROP_AUTH_IDENTITY_CA, "testtext_IdentityCA_testtext");
+  dds_qset_prop (qos, DDS_SEC_PROP_AUTH_PRIV_KEY, "testtext_PrivateKey_testtext");
+  dds_qset_prop (qos, DDS_SEC_PROP_AUTH_IDENTITY_CERT, "testtext_IdentityCertificate_testtext");
+  dds_qset_prop (qos, DDS_SEC_PROP_ACCESS_PERMISSIONS_CA, "file:Permissions_CA.pem");
+  dds_qset_prop (qos, DDS_SEC_PROP_ACCESS_GOVERNANCE, "file:Governance.p7s");
+  /* we ignore permissions for testing
+  //dds_qset_prop (qos, DDS_SEC_PROP_ACCESS_PERMISSIONS, "file:Permissions.p7s"); */
+  dds_qset_prop (qos, DDS_SEC_PROP_AUTH_PASSWORD, "testtext_Password_testtext");
+  dds_qset_prop (qos, DDS_SEC_PROP_ACCESS_TRUSTED_CA_DIR, "file:/test/dir");
+
+  dds_qset_prop (qos, DDS_SEC_PROP_AUTH_LIBRARY_PATH, "dds_security_authentication_all_ok");
+  dds_qset_prop (qos, DDS_SEC_PROP_AUTH_LIBRARY_INIT, "init_authentication");
+  dds_qset_prop (qos, DDS_SEC_PROP_AUTH_LIBRARY_FINALIZE, "finalize_authentication");
+  dds_qset_prop (qos, DDS_SEC_PROP_CRYPTO_LIBRARY_PATH, "dds_security_cryptography_all_ok");
+  dds_qset_prop (qos, DDS_SEC_PROP_CRYPTO_LIBRARY_INIT, "init_crypto");
+  dds_qset_prop (qos, DDS_SEC_PROP_CRYPTO_LIBRARY_FINALIZE, "finalize_crypto");
+  dds_qset_prop (qos, DDS_SEC_PROP_ACCESS_LIBRARY_PATH, "dds_security_access_control_all_ok");
+  dds_qset_prop (qos, DDS_SEC_PROP_ACCESS_LIBRARY_INIT, "init_access_control");
+  dds_qset_prop (qos, DDS_SEC_PROP_ACCESS_LIBRARY_FINALIZE, "finalize_access_control");
+
+  dds_qset_prop (qos, "test.prop2", "testtext_value2_testtext");
+  dds_qset_prop (qos, DDS_SEC_PROP_AUTH_IDENTITY_CA, "testtext_IdentityCA_testtext");
+  dds_qset_bprop (qos, "test.bprop1", bvalue, 3);
+
+  /* Create participant with security config in qos. */
+  found = 0;
+  ddsrt_setenv(URI_VARIABLE, "<Tracing><Verbosity>finest</></>");
+  participant = dds_create_participant(DDS_DOMAIN_DEFAULT, qos, NULL);
+  dds_set_log_sink(NULL, NULL);
+  dds_set_trace_sink(NULL, NULL);
+  ddsrt_setenv(URI_VARIABLE, "");
+#ifdef PR304_MERGED
+  /* It is better dds to return DDS_RETCODE_NOT_ALLOWED_BY_SECURITY instead of DDS_RETCODE_ERROR
+    CU_ASSERT_FATAL( participant == DDS_RETCODE_NOT_ALLOWED_BY_SECURITY ); */
+    CU_ASSERT_FATAL( participant == DDS_RETCODE_ERROR );
+#else
+  dds_delete(participant);
+#endif
+  CU_ASSERT_FATAL(found == 0x3);
+  dds_delete_qos(qos);
+}
+
+
+
+
+CU_Test(ddssec_security_plugin_loading, multiple_domains_different_config, .init = ddsrt_init, .fini = ddsrt_fini) {
+  /* Expected traces when creating participant with the security elements. */
+  const char *log_expected[] = {
+          "*using security settings from configuration*",
+          "*using security settings from QoS*",
+          "DDS Security plugins have been loaded*",
+          "*security is already loaded for this domain*",
+          NULL
+  };
+
+  const char *sec_config =
+        "<"DDS_PROJECT_NAME">"
+          "<Domain id=\"1\">"
+            "<Tracing><Verbosity>finest</></>"
+            "<DDSSecurity>"
+              "<Authentication>"
+                "<Library path=\"dds_security_authentication_all_ok\" initFunction=\"init_authentication\" finalizeFunction=\"finalize_authentication\" />"
+                "<IdentityCertificate>testtext_IdentityCertificate_testtext</IdentityCertificate>"
+                "<IdentityCA>testtext_IdentityCA_testtext</IdentityCA>"
+                "<PrivateKey>testtext_PrivateKey_testtext</PrivateKey>"
+                "<Password>testtext_Password_testtext</Password>"
+                "<TrustedCADirectory>testtext_Dir_testtext</TrustedCADirectory>"
+              "</Authentication>"
+              "<Cryptographic>"
+                "<Library path=\"dds_security_cryptography_all_ok\" initFunction=\"init_crypto\" finalizeFunction=\"finalize_crypto\"/>"
+              "</Cryptographic>"
+              "<AccessControl>"
+                "<Library path=\"dds_security_access_control_all_ok\" initFunction=\"init_access_control\" finalizeFunction=\"finalize_access_control\"/>"
+                "<Governance>file:Governance.p7s</Governance>"
+                "<PermissionsCA>file:Permissions_CA.pem</PermissionsCA>"
+                "<Permissions>file:Permissions.p7s</Permissions>"
+              "</AccessControl>"
+            "</DDSSecurity>"
+          "</Domain>"
+          "<Domain id=\"2\">"
+            "<Tracing><Verbosity>finest</></>"
+            "<DDSSecurity>"
+              "<Authentication>"
+                "<Library path=\"dds_security_authentication_invalid\" initFunction=\"init_authentication\" finalizeFunction=\"finalize_authentication\" />"
+                "<IdentityCertificate>testtext_IdentityCertificate_testtext</IdentityCertificate>"
+                "<IdentityCA>testtext_IdentityCA_testtext</IdentityCA>"
+                "<PrivateKey>testtext_PrivateKey_testtext</PrivateKey>"
+                "<Password>testtext_Password_testtext</Password>"
+                "<TrustedCADirectory>testtext_Dir_testtext</TrustedCADirectory>"
+              "</Authentication>"
+              "<Cryptographic>"
+                "<Library path=\"dds_security_cryptography_invalid\" initFunction=\"init_crypto\" finalizeFunction=\"finalize_crypto\"/>"
+              "</Cryptographic>"
+              "<AccessControl>"
+                "<Library path=\"dds_security_access_control_invalid\" initFunction=\"init_access_control\" finalizeFunction=\"finalize_access_control\"/>"
+                "<Governance>file:Governance.p7s</Governance>"
+                "<PermissionsCA>file:Permissions_CA.pem</PermissionsCA>"
+                "<Permissions>file:Permissions.p7s</Permissions>"
+              "</AccessControl>"
+            "</DDSSecurity>"
+          "</Domain>"
+        "</"DDS_PROJECT_NAME">";
+
+
+  dds_entity_t participant1, participant2, participant3;
+  dds_qos_t * qos;
+
+  /* Set up the trace sinks to detect the config parsing. */
+  dds_set_log_mask(DDS_LC_INFO|DDS_LC_ERROR);
+  dds_set_log_sink(&logger, (void*)log_expected);
+  dds_set_trace_sink(&logger, (void*)log_expected);
+
+  /* Create the qos */
+  unsigned char bvalue[3] = { 0x01, 0x02, 0x03 };
+  CU_ASSERT_FATAL ((qos = dds_create_qos()) != NULL);
+  dds_qset_prop (qos, "test.prop1", "testtext_value1_testtext");
+  dds_qset_prop (qos, DDS_SEC_PROP_AUTH_IDENTITY_CA, "testtext_IdentityCA_testtext");
+  dds_qset_prop (qos, DDS_SEC_PROP_AUTH_PRIV_KEY, "testtext_PrivateKey_testtext");
+  dds_qset_prop (qos, DDS_SEC_PROP_AUTH_IDENTITY_CERT, "testtext_IdentityCertificate_testtext");
+  dds_qset_prop (qos, DDS_SEC_PROP_ACCESS_PERMISSIONS_CA, "file:Permissions_CA.pem");
+  dds_qset_prop (qos, DDS_SEC_PROP_ACCESS_GOVERNANCE, "file:Governance.p7s");
+  dds_qset_prop (qos, DDS_SEC_PROP_ACCESS_PERMISSIONS, "file:Permissions.p7s");
+  dds_qset_prop (qos, DDS_SEC_PROP_AUTH_PASSWORD, "testtext_Password_testtext");
+  dds_qset_prop (qos, DDS_SEC_PROP_ACCESS_TRUSTED_CA_DIR, "file:/test/dir");
+
+  dds_qset_prop (qos, DDS_SEC_PROP_AUTH_LIBRARY_PATH, "dds_security_authentication_all_ok_other");
+  dds_qset_prop (qos, DDS_SEC_PROP_AUTH_LIBRARY_INIT, "init_authentication");
+  dds_qset_prop (qos, DDS_SEC_PROP_AUTH_LIBRARY_FINALIZE, "finalize_authentication");
+  dds_qset_prop (qos, DDS_SEC_PROP_CRYPTO_LIBRARY_PATH, "dds_security_cryptography_all_ok");
+  dds_qset_prop (qos, DDS_SEC_PROP_CRYPTO_LIBRARY_INIT, "init_crypto");
+  dds_qset_prop (qos, DDS_SEC_PROP_CRYPTO_LIBRARY_FINALIZE, "finalize_crypto");
+  dds_qset_prop (qos, DDS_SEC_PROP_ACCESS_LIBRARY_PATH, "dds_security_access_control_all_ok");
+  dds_qset_prop (qos, DDS_SEC_PROP_ACCESS_LIBRARY_INIT, "init_access_control");
+  dds_qset_prop (qos, DDS_SEC_PROP_ACCESS_LIBRARY_FINALIZE, "finalize_access_control");
+
+  dds_qset_prop (qos, "test.prop2", "testtext_value2_testtext");
+  dds_qset_prop (qos, DDS_SEC_PROP_AUTH_IDENTITY_CA, "testtext_IdentityCA_testtext");
+  dds_qset_bprop (qos, "test.bprop1", bvalue, 3);
+
+  /* Create participant with security config in qos. */
+  found = 0;
+  print_log = true;
+  ddsrt_setenv(URI_VARIABLE, sec_config);
+  participant1 = dds_create_participant(1, NULL, NULL);
+  participant2 = dds_create_participant(2, qos, NULL);
+  participant3 = dds_create_participant(2, NULL, NULL);
+  dds_set_log_sink(NULL, NULL);
+  dds_set_trace_sink(NULL, NULL);
+  ddsrt_setenv(URI_VARIABLE, "");
+#ifdef PR304_MERGED
+  /* It is better dds to return DDS_RETCODE_NOT_ALLOWED_BY_SECURITY instead of DDS_RETCODE_ERROR
+    CU_ASSERT_FATAL( participant1 == DDS_RETCODE_NOT_ALLOWED_BY_SECURITY ); */
+    CU_ASSERT_FATAL( participant1 == DDS_RETCODE_ERROR );
+#else
+  dds_delete(participant1);
+  dds_delete(participant2);
+  dds_delete(participant3);
+#endif
+  CU_ASSERT_FATAL(found == 0xf);
+  dds_delete_qos(qos);
+}
diff --git a/src/security/core/tests/plugin_loading/plugin_mock/access_control_all_ok/mock_access_control.c b/src/security/core/tests/plugin_loading/plugin_mock/access_control_all_ok/mock_access_control.c
new file mode 100644
index 0000000..322c465
--- /dev/null
+++ b/src/security/core/tests/plugin_loading/plugin_mock/access_control_all_ok/mock_access_control.c
@@ -0,0 +1,597 @@
+/*
+ * Copyright(c) 2006 to 2019 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+#include "dds/security/dds_security_api.h"
+#include "dds/ddsrt/heap.h"
+#include "dds/ddsrt/misc.h"
+#include "mock_access_control.h"
+#include <stdio.h>
+#include <string.h>
+#include <stdbool.h>
+
+/**
+ * Implementation structure for storing encapsulated members of the instance
+ * while giving only the interface definition to user
+ */
+
+typedef struct dds_security_access_control_impl {
+  dds_security_access_control base;
+  int member;
+} dds_security_access_control_impl;
+
+/**
+ * Function implementations
+ */
+
+DDS_Security_PermissionsHandle validate_local_permissions(
+     dds_security_access_control *instance,
+     const dds_security_authentication *auth_plugin,
+     const DDS_Security_IdentityHandle identity,
+     const DDS_Security_DomainId domain_id,
+     const DDS_Security_Qos *participant_qos,
+    DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(auth_plugin);
+  DDSRT_UNUSED_ARG(auth_plugin);
+  DDSRT_UNUSED_ARG(identity);
+  DDSRT_UNUSED_ARG(domain_id);
+  DDSRT_UNUSED_ARG(participant_qos);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+
+  return 1;
+}
+
+DDS_Security_PermissionsHandle validate_remote_permissions(
+     dds_security_access_control *instance,
+     const dds_security_authentication *auth_plugin,
+     const DDS_Security_IdentityHandle local_identity_handle,
+     const DDS_Security_IdentityHandle remote_identity_handle,
+     const DDS_Security_PermissionsToken *remote_permissions_token,
+     const DDS_Security_AuthenticatedPeerCredentialToken *remote_credential_token,
+    DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(auth_plugin);
+  DDSRT_UNUSED_ARG(local_identity_handle);
+  DDSRT_UNUSED_ARG(remote_identity_handle);
+  DDSRT_UNUSED_ARG(remote_permissions_token);
+  DDSRT_UNUSED_ARG(remote_credential_token);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+
+  return 0;
+}
+
+DDS_Security_boolean check_create_participant( dds_security_access_control *instance,
+     const DDS_Security_PermissionsHandle permissions_handle,
+     const DDS_Security_DomainId domain_id,  const DDS_Security_Qos *participant_qos,
+    DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(permissions_handle);
+  DDSRT_UNUSED_ARG(domain_id);
+  DDSRT_UNUSED_ARG(participant_qos);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+
+  return true;
+}
+
+DDS_Security_boolean check_create_datawriter( dds_security_access_control *instance,
+     const DDS_Security_PermissionsHandle permissions_handle,
+     const DDS_Security_DomainId domain_id,  const char *topic_name,
+     const DDS_Security_Qos *writer_qos,
+     const DDS_Security_PartitionQosPolicy *partition,
+     const DDS_Security_DataTags *data_tag,
+    DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(permissions_handle);
+  DDSRT_UNUSED_ARG(domain_id);
+  DDSRT_UNUSED_ARG(topic_name);
+  DDSRT_UNUSED_ARG(writer_qos);
+  DDSRT_UNUSED_ARG(partition);
+  DDSRT_UNUSED_ARG(data_tag);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+
+  return true;
+}
+
+DDS_Security_boolean check_create_datareader( dds_security_access_control *instance,
+     const DDS_Security_PermissionsHandle permissions_handle,
+     const DDS_Security_DomainId domain_id,  const char *topic_name,
+     const DDS_Security_Qos *reader_qos,
+     const DDS_Security_PartitionQosPolicy *partition,
+     const DDS_Security_DataTags *data_tag,
+    DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(permissions_handle);
+  DDSRT_UNUSED_ARG(domain_id);
+  DDSRT_UNUSED_ARG(topic_name);
+  DDSRT_UNUSED_ARG(reader_qos);
+  DDSRT_UNUSED_ARG(partition);
+  DDSRT_UNUSED_ARG(data_tag);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+
+  return true;
+}
+
+DDS_Security_boolean check_create_topic( dds_security_access_control *instance,
+     const DDS_Security_PermissionsHandle permissions_handle,
+     const DDS_Security_DomainId domain_id,  const char *topic_name,
+     const DDS_Security_Qos *qos, DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(permissions_handle);
+  DDSRT_UNUSED_ARG(domain_id);
+  DDSRT_UNUSED_ARG(topic_name);
+  DDSRT_UNUSED_ARG(qos);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+
+  return true;
+}
+
+DDS_Security_boolean check_local_datawriter_register_instance(
+     dds_security_access_control *instance,
+     const DDS_Security_PermissionsHandle permissions_handle,
+     const DDS_Security_Entity *writer,  const DDS_Security_DynamicData *key,
+    DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(permissions_handle);
+  DDSRT_UNUSED_ARG(writer);
+  DDSRT_UNUSED_ARG(key);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+
+  return true;
+}
+
+DDS_Security_boolean check_local_datawriter_dispose_instance(
+     dds_security_access_control *instance,
+     const DDS_Security_PermissionsHandle permissions_handle,
+     const DDS_Security_Entity *writer,  const DDS_Security_DynamicData key,
+    DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(permissions_handle);
+  DDSRT_UNUSED_ARG(writer);
+  DDSRT_UNUSED_ARG(key);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+
+  return true;
+}
+
+DDS_Security_boolean check_remote_participant( dds_security_access_control *instance,
+     const DDS_Security_PermissionsHandle permissions_handle,
+     const DDS_Security_DomainId domain_id,
+     const DDS_Security_ParticipantBuiltinTopicDataSecure *participant_data,
+    DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(permissions_handle);
+  DDSRT_UNUSED_ARG(domain_id);
+  DDSRT_UNUSED_ARG(participant_data);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+
+  return true;
+}
+
+DDS_Security_boolean check_remote_datawriter( dds_security_access_control *instance,
+     const DDS_Security_PermissionsHandle permissions_handle,
+     const DDS_Security_DomainId domain_id,
+     const DDS_Security_PublicationBuiltinTopicDataSecure *publication_data,
+    DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(permissions_handle);
+  DDSRT_UNUSED_ARG(domain_id);
+  DDSRT_UNUSED_ARG(publication_data);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+
+  return true;
+}
+
+DDS_Security_boolean check_remote_datareader( dds_security_access_control *instance,
+     const DDS_Security_PermissionsHandle permissions_handle,
+     const DDS_Security_DomainId domain_id,
+     const DDS_Security_SubscriptionBuiltinTopicDataSecure *subscription_data,
+    DDS_Security_boolean *relay_only, DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(permissions_handle);
+  DDSRT_UNUSED_ARG(domain_id);
+  DDSRT_UNUSED_ARG(subscription_data);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+
+  *relay_only = false;
+
+  return true;
+}
+
+DDS_Security_boolean check_remote_topic( dds_security_access_control *instance,
+     const DDS_Security_PermissionsHandle permissions_handle,
+     const DDS_Security_DomainId domain_id,
+     const DDS_Security_TopicBuiltinTopicData *topic_data,
+    DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(permissions_handle);
+  DDSRT_UNUSED_ARG(domain_id);
+  DDSRT_UNUSED_ARG(topic_data);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+
+  return true;
+}
+
+DDS_Security_boolean check_local_datawriter_match(
+     dds_security_access_control *instance,
+     const DDS_Security_PermissionsHandle writer_permissions_handle,
+     const DDS_Security_PermissionsHandle reader_permissions_handle,
+     const DDS_Security_PublicationBuiltinTopicDataSecure *publication_data,
+     const DDS_Security_SubscriptionBuiltinTopicDataSecure *subscription_data,
+    DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(writer_permissions_handle);
+  DDSRT_UNUSED_ARG(reader_permissions_handle);
+  DDSRT_UNUSED_ARG(publication_data);
+  DDSRT_UNUSED_ARG(subscription_data);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+
+  return true;
+}
+
+DDS_Security_boolean check_local_datareader_match(
+     dds_security_access_control *instance,
+     const DDS_Security_PermissionsHandle reader_permissions_handle,
+     const DDS_Security_PermissionsHandle writer_permissions_handle,
+     const DDS_Security_SubscriptionBuiltinTopicDataSecure *subscription_data,
+     const DDS_Security_PublicationBuiltinTopicDataSecure *publication_data,
+    DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(reader_permissions_handle);
+  DDSRT_UNUSED_ARG(writer_permissions_handle);
+  DDSRT_UNUSED_ARG(subscription_data);
+  DDSRT_UNUSED_ARG(publication_data);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+
+  return true;
+}
+
+DDS_Security_boolean check_remote_datawriter_register_instance(
+     dds_security_access_control *instance,
+     const DDS_Security_PermissionsHandle permissions_handle,
+     const DDS_Security_Entity *reader,
+     const DDS_Security_InstanceHandle publication_handle,
+     const DDS_Security_DynamicData key,
+     const DDS_Security_InstanceHandle instance_handle,
+    DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(permissions_handle);
+  DDSRT_UNUSED_ARG(reader);
+  DDSRT_UNUSED_ARG(publication_handle);
+  DDSRT_UNUSED_ARG(key);
+  DDSRT_UNUSED_ARG(instance_handle);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+
+  return true;
+}
+
+DDS_Security_boolean check_remote_datawriter_dispose_instance(
+     dds_security_access_control *instance,
+     const DDS_Security_PermissionsHandle permissions_handle,
+     const DDS_Security_Entity *reader,
+     const DDS_Security_InstanceHandle publication_handle,
+     const DDS_Security_DynamicData key,
+    DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(permissions_handle);
+  DDSRT_UNUSED_ARG(reader);
+  DDSRT_UNUSED_ARG(publication_handle);
+  DDSRT_UNUSED_ARG(key);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+
+  return true;
+}
+
+DDS_Security_boolean get_permissions_token( dds_security_access_control *instance,
+    DDS_Security_PermissionsToken *permissions_token,
+     const DDS_Security_PermissionsHandle handle,
+    DDS_Security_SecurityException *ex)
+{
+
+  DDSRT_UNUSED_ARG(permissions_token);
+  DDSRT_UNUSED_ARG(handle);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+
+  return true;
+}
+
+DDS_Security_boolean get_permissions_credential_token(
+     dds_security_access_control *instance,
+    DDS_Security_PermissionsCredentialToken *permissions_credential_token,
+     const DDS_Security_PermissionsHandle handle,
+    DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(permissions_credential_token);
+  DDSRT_UNUSED_ARG(handle);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+
+  return true;
+}
+
+DDS_Security_boolean set_listener( dds_security_access_control *instance,
+     const dds_security_access_control_listener *listener,
+    DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(listener);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+
+  return true;
+}
+
+DDS_Security_boolean return_permissions_token( dds_security_access_control *instance,
+     const DDS_Security_PermissionsToken *token,
+    DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(token);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+
+  return true;
+}
+
+DDS_Security_boolean return_permissions_credential_token(
+     dds_security_access_control *instance,
+     const DDS_Security_PermissionsCredentialToken *permissions_credential_token,
+    DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(permissions_credential_token);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+
+  return true;
+}
+
+DDS_Security_boolean get_participant_sec_attributes(
+     dds_security_access_control *instance,
+     const DDS_Security_PermissionsHandle permissions_handle,
+    DDS_Security_ParticipantSecurityAttributes *attributes,
+    DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(permissions_handle);
+  DDSRT_UNUSED_ARG(attributes);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+
+  return true;
+}
+
+DDS_Security_boolean get_topic_sec_attributes( dds_security_access_control *instance,
+     const DDS_Security_PermissionsHandle permissions_handle,
+     const char *topic_name,
+    DDS_Security_TopicSecurityAttributes *attributes,
+    DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(permissions_handle);
+  DDSRT_UNUSED_ARG(topic_name);
+  DDSRT_UNUSED_ARG(attributes);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+
+  return true;
+}
+
+DDS_Security_boolean get_datawriter_sec_attributes(
+     dds_security_access_control *instance,
+     const DDS_Security_PermissionsHandle permissions_handle,
+     const char *topic_name,
+     const DDS_Security_PartitionQosPolicy *partition,
+     const DDS_Security_DataTagQosPolicy *data_tag,
+    DDS_Security_EndpointSecurityAttributes *attributes,
+    DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(permissions_handle);
+  DDSRT_UNUSED_ARG(topic_name);
+  DDSRT_UNUSED_ARG(partition);
+  DDSRT_UNUSED_ARG(data_tag);
+  DDSRT_UNUSED_ARG(attributes);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+
+  return true;
+}
+
+DDS_Security_boolean get_datareader_sec_attributes(
+     dds_security_access_control *instance,
+     const DDS_Security_PermissionsHandle permissions_handle,
+     const char *topic_name,
+     const DDS_Security_PartitionQosPolicy *partition,
+     const DDS_Security_DataTagQosPolicy *data_tag,
+    DDS_Security_EndpointSecurityAttributes *attributes,
+    DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(permissions_handle);
+  DDSRT_UNUSED_ARG(topic_name);
+  DDSRT_UNUSED_ARG(partition);
+  DDSRT_UNUSED_ARG(data_tag);
+  DDSRT_UNUSED_ARG(attributes);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+
+  return true;
+}
+
+DDS_Security_boolean return_participant_sec_attributes(
+     dds_security_access_control *instance,
+     const DDS_Security_ParticipantSecurityAttributes *attributes,
+    DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(attributes);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+
+  return true;
+}
+
+DDS_Security_boolean return_topic_sec_attributes(
+     dds_security_access_control *instance,
+     const DDS_Security_TopicSecurityAttributes *attributes,
+    DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(attributes);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+
+  return true;
+}
+
+DDS_Security_boolean return_datawriter_sec_attributes(
+     dds_security_access_control *instance,
+     const DDS_Security_EndpointSecurityAttributes *attributes,
+    DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(attributes);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+
+  return true;
+}
+
+DDS_Security_boolean return_datareader_sec_attributes(
+     dds_security_access_control *instance,
+     const DDS_Security_EndpointSecurityAttributes *attributes,
+    DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(attributes);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+
+  return true;
+}
+
+DDS_Security_boolean return_permissions_handle(
+     dds_security_access_control *instance,
+     const DDS_Security_PermissionsHandle permissions_handle,
+    DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(permissions_handle);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+
+  return true;
+}
+
+ int32_t init_access_control(  const char *argument, void **context)
+{
+
+  dds_security_access_control *access_control;
+
+  DDSRT_UNUSED_ARG(argument);
+
+  //allocate new instance
+  access_control = ddsrt_malloc(sizeof(dds_security_access_control));
+  memset(access_control, 0, sizeof(dds_security_access_control));
+
+  //assign the interface functions
+  access_control->validate_local_permissions = &validate_local_permissions;
+
+  access_control->validate_remote_permissions = &validate_remote_permissions;
+
+  access_control->check_create_participant = &check_create_participant;
+
+  access_control->check_create_datawriter = &check_create_datawriter;
+
+  access_control->check_create_datareader = &check_create_datareader;
+
+  access_control->check_create_topic = &check_create_topic;
+
+  access_control->check_local_datawriter_register_instance =
+      &check_local_datawriter_register_instance;
+
+  access_control->check_local_datawriter_dispose_instance =
+      &check_local_datawriter_dispose_instance;
+
+  access_control->check_remote_participant = &check_remote_participant;
+
+  access_control->check_remote_datawriter = &check_remote_datawriter;
+
+  access_control->check_remote_datareader = &check_remote_datareader;
+
+  access_control->check_remote_topic = &check_remote_topic;
+
+  access_control->check_local_datawriter_match = &check_local_datawriter_match;
+
+  access_control->check_local_datareader_match = &check_local_datareader_match;
+
+  access_control->check_remote_datawriter_register_instance =
+      &check_remote_datawriter_register_instance;
+
+  access_control->check_remote_datawriter_dispose_instance =
+      &check_remote_datawriter_dispose_instance;
+
+  access_control->get_permissions_token = &get_permissions_token;
+
+  access_control->get_permissions_credential_token =
+      &get_permissions_credential_token;
+
+  access_control->set_listener = &set_listener;
+
+  access_control->return_permissions_token = &return_permissions_token;
+
+  access_control->return_permissions_credential_token =
+      &return_permissions_credential_token;
+
+  access_control->get_participant_sec_attributes =
+      &get_participant_sec_attributes;
+
+  access_control->get_topic_sec_attributes = &get_topic_sec_attributes;
+
+  access_control->get_datawriter_sec_attributes =
+      &get_datawriter_sec_attributes;
+
+  access_control->get_datareader_sec_attributes =
+      &get_datareader_sec_attributes;
+
+  access_control->return_participant_sec_attributes =
+      &return_participant_sec_attributes;
+
+  access_control->return_topic_sec_attributes =
+       &return_topic_sec_attributes;
+
+  access_control->return_datawriter_sec_attributes =
+      &return_datawriter_sec_attributes;
+
+  access_control->return_datareader_sec_attributes =
+      &return_datareader_sec_attributes;
+
+  access_control->return_permissions_handle =
+        &return_permissions_handle;
+
+  //return the instance
+  *context = access_control;
+  return 0;
+}
+
+ int32_t finalize_access_control(  void *context)
+{
+
+  DDSRT_UNUSED_ARG(context);
+
+  ddsrt_free((dds_security_access_control*) context);
+  return 0;
+}
diff --git a/src/security/core/tests/plugin_loading/plugin_mock/access_control_all_ok/mock_access_control.h b/src/security/core/tests/plugin_loading/plugin_mock/access_control_all_ok/mock_access_control.h
new file mode 100644
index 0000000..07eb595
--- /dev/null
+++ b/src/security/core/tests/plugin_loading/plugin_mock/access_control_all_ok/mock_access_control.h
@@ -0,0 +1,281 @@
+/*
+ * Copyright(c) 2006 to 2019 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+
+#ifndef SECURITY_ACCESS_CONTROL_ALLOK_H_
+#define SECURITY_BUILTIN_PLUGINS_AUTHENTICATION_H_
+
+#include "dds/security/access_control_all_ok_export.h"
+#include "dds/security/dds_security_api.h"
+
+SECURITY_EXPORT int32_t
+init_access_control(const char *argument, void **context);
+
+SECURITY_EXPORT int32_t
+finalize_access_control(void *context);
+
+
+/**
+ * AccessControl Interface
+ */
+
+DDS_Security_PermissionsHandle
+validate_local_permissions
+        ( dds_security_access_control *instance,
+          const dds_security_authentication *auth_plugin,
+          const DDS_Security_IdentityHandle identity,
+          const DDS_Security_DomainId domain_id,
+          const DDS_Security_Qos *participant_qos,
+          DDS_Security_SecurityException *ex);
+
+DDS_Security_PermissionsHandle
+validate_remote_permissions
+        ( dds_security_access_control *instance,
+          const dds_security_authentication *auth_plugin,
+          const DDS_Security_IdentityHandle local_identity_handle,
+          const DDS_Security_IdentityHandle remote_identity_handle,
+          const DDS_Security_PermissionsToken *remote_permissions_token,
+          const DDS_Security_AuthenticatedPeerCredentialToken *remote_credential_token,
+          DDS_Security_SecurityException *ex);
+
+DDS_Security_boolean
+check_create_participant
+        ( dds_security_access_control *instance,
+          const DDS_Security_PermissionsHandle permissions_handle,
+          const DDS_Security_DomainId domain_id,
+          const DDS_Security_Qos *participant_qos,
+          DDS_Security_SecurityException *ex);
+
+DDS_Security_boolean
+check_create_datawriter
+        ( dds_security_access_control *instance,
+          const DDS_Security_PermissionsHandle permissions_handle,
+          const DDS_Security_DomainId domain_id,
+          const DDS_Security_char *topic_name,
+          const DDS_Security_Qos *writer_qos,
+          const DDS_Security_PartitionQosPolicy *partition,
+          const DDS_Security_DataTags *data_tag,
+          DDS_Security_SecurityException *ex);
+
+DDS_Security_boolean
+check_create_datareader
+        ( dds_security_access_control *instance,
+          const DDS_Security_PermissionsHandle permissions_handle,
+          const DDS_Security_DomainId domain_id,
+          const DDS_Security_char *topic_name,
+          const DDS_Security_Qos *reader_qos,
+          const DDS_Security_PartitionQosPolicy *partition,
+          const DDS_Security_DataTags *data_tag,
+          DDS_Security_SecurityException *ex);
+
+
+DDS_Security_boolean
+check_create_topic
+        ( dds_security_access_control *instance,
+          const DDS_Security_PermissionsHandle permissions_handle,
+          const DDS_Security_DomainId domain_id,
+          const DDS_Security_char *topic_name,
+          const DDS_Security_Qos *topic_qos,
+          DDS_Security_SecurityException *ex);
+
+DDS_Security_boolean
+check_local_datawriter_register_instance
+        ( dds_security_access_control *instance,
+          const DDS_Security_PermissionsHandle permissions_handle,
+          const DDS_Security_Entity *writer,
+          const DDS_Security_DynamicData *key,
+          DDS_Security_SecurityException *ex);
+
+DDS_Security_boolean
+check_local_datawriter_dispose_instance
+        ( dds_security_access_control *instance,
+          const DDS_Security_PermissionsHandle permissions_handle,
+          const DDS_Security_Entity *writer,
+          const DDS_Security_DynamicData key,
+          DDS_Security_SecurityException *ex);
+
+DDS_Security_boolean
+check_remote_participant
+        ( dds_security_access_control *instance,
+          const DDS_Security_PermissionsHandle permissions_handle,
+          const DDS_Security_DomainId domain_id,
+          const DDS_Security_ParticipantBuiltinTopicDataSecure *participant_data,
+          DDS_Security_SecurityException *ex);
+
+DDS_Security_boolean
+check_remote_datawriter
+        ( dds_security_access_control *instance,
+          const DDS_Security_PermissionsHandle permissions_handle,
+          const DDS_Security_DomainId domain_id,
+          const DDS_Security_PublicationBuiltinTopicDataSecure *publication_data,
+          DDS_Security_SecurityException *ex);
+
+DDS_Security_boolean
+check_remote_datareader
+        ( dds_security_access_control *instance,
+          const DDS_Security_PermissionsHandle permissions_handle,
+          const DDS_Security_DomainId domain_id,
+          const DDS_Security_SubscriptionBuiltinTopicDataSecure *subscription_data,
+          DDS_Security_boolean *relay_only,
+          DDS_Security_SecurityException *ex);
+
+DDS_Security_boolean
+check_remote_topic
+        ( dds_security_access_control *instance,
+          const DDS_Security_PermissionsHandle permissions_handle,
+          const DDS_Security_DomainId domain_id,
+          const DDS_Security_TopicBuiltinTopicData *topic_data,
+          DDS_Security_SecurityException *ex);
+
+
+DDS_Security_boolean
+check_local_datawriter_match
+        ( dds_security_access_control *instance,
+          const DDS_Security_PermissionsHandle writer_permissions_handle,
+          const DDS_Security_PermissionsHandle reader_permissions_handle,
+          const DDS_Security_PublicationBuiltinTopicDataSecure *publication_data,
+          const DDS_Security_SubscriptionBuiltinTopicDataSecure *subscription_data,
+          DDS_Security_SecurityException *ex);
+
+
+DDS_Security_boolean
+check_local_datareader_match
+        ( dds_security_access_control *instance,
+          const DDS_Security_PermissionsHandle reader_permissions_handle,
+          const DDS_Security_PermissionsHandle writer_permissions_handle,
+          const DDS_Security_SubscriptionBuiltinTopicDataSecure *subscription_data,
+          const DDS_Security_PublicationBuiltinTopicDataSecure *publication_data,
+          DDS_Security_SecurityException *ex);
+
+DDS_Security_boolean
+check_remote_datawriter_register_instance
+        ( dds_security_access_control *instance,
+          const DDS_Security_PermissionsHandle permissions_handle,
+          const DDS_Security_Entity *reader,
+          const DDS_Security_InstanceHandle publication_handle,
+          const DDS_Security_DynamicData key,
+          const DDS_Security_InstanceHandle instance_handle,
+          DDS_Security_SecurityException *ex);
+
+DDS_Security_boolean
+check_remote_datawriter_dispose_instance
+        ( dds_security_access_control *instance,
+          const DDS_Security_PermissionsHandle permissions_handle,
+          const DDS_Security_Entity *reader,
+          const DDS_Security_InstanceHandle publication_handle,
+          const DDS_Security_DynamicData key,
+          DDS_Security_SecurityException *ex);
+
+DDS_Security_boolean
+get_permissions_token
+        ( dds_security_access_control *instance,
+          DDS_Security_PermissionsToken *permissions_token,
+          const DDS_Security_PermissionsHandle handle,
+          DDS_Security_SecurityException *ex);
+
+DDS_Security_boolean
+get_permissions_credential_token
+        ( dds_security_access_control *instance,
+          DDS_Security_PermissionsCredentialToken *permissions_credential_token,
+          const DDS_Security_PermissionsHandle handle,
+          DDS_Security_SecurityException *ex);
+
+DDS_Security_boolean
+set_listener
+        ( dds_security_access_control *instance,
+          const dds_security_access_control_listener *listener,
+          DDS_Security_SecurityException *ex);
+
+DDS_Security_boolean
+return_permissions_token
+        ( dds_security_access_control *instance,
+          const DDS_Security_PermissionsToken *token,
+          DDS_Security_SecurityException *ex);
+
+DDS_Security_boolean
+return_permissions_credential_token
+        ( dds_security_access_control *instance,
+          const DDS_Security_PermissionsCredentialToken *permissions_credential_token,
+          DDS_Security_SecurityException *ex);
+
+DDS_Security_boolean
+get_participant_sec_attributes
+        ( dds_security_access_control *instance,
+          const DDS_Security_PermissionsHandle permissions_handle,
+          DDS_Security_ParticipantSecurityAttributes *attributes,
+          DDS_Security_SecurityException *ex);
+
+
+DDS_Security_boolean
+get_topic_sec_attributes
+        ( dds_security_access_control *instance,
+          const DDS_Security_PermissionsHandle permissions_handle,
+          const DDS_Security_char *topic_name,
+          DDS_Security_TopicSecurityAttributes *attributes,
+          DDS_Security_SecurityException *ex);
+
+
+DDS_Security_boolean
+get_datawriter_sec_attributes
+        ( dds_security_access_control *instance,
+          const DDS_Security_PermissionsHandle permissions_handle,
+          const DDS_Security_char *topic_name,
+          const DDS_Security_PartitionQosPolicy *partition,
+          const DDS_Security_DataTagQosPolicy *data_tag,
+          DDS_Security_EndpointSecurityAttributes *attributes,
+          DDS_Security_SecurityException *ex);
+
+
+DDS_Security_boolean
+get_datareader_sec_attributes
+        ( dds_security_access_control *instance,
+          const DDS_Security_PermissionsHandle permissions_handle,
+          const DDS_Security_char *topic_name,
+          const DDS_Security_PartitionQosPolicy *partition,
+          const DDS_Security_DataTagQosPolicy *data_tag,
+          DDS_Security_EndpointSecurityAttributes *attributes,
+          DDS_Security_SecurityException *ex);
+
+
+DDS_Security_boolean
+return_participant_sec_attributes
+        ( dds_security_access_control *instance,
+          const DDS_Security_ParticipantSecurityAttributes *attributes,
+          DDS_Security_SecurityException *ex);
+
+DDS_Security_boolean
+return_topic_sec_attributes
+        ( dds_security_access_control *instance,
+          const DDS_Security_TopicSecurityAttributes *attributes,
+          DDS_Security_SecurityException *ex);
+
+DDS_Security_boolean
+return_datawriter_sec_attributes
+        ( dds_security_access_control *instance,
+          const DDS_Security_EndpointSecurityAttributes *attributes,
+          DDS_Security_SecurityException *ex);
+
+
+DDS_Security_boolean
+return_datareader_sec_attributes
+        ( dds_security_access_control *instance,
+          const DDS_Security_EndpointSecurityAttributes *attributes,
+          DDS_Security_SecurityException *ex);
+
+DDS_Security_boolean
+return_permissions_handle
+        ( dds_security_access_control *instance,
+          const DDS_Security_PermissionsHandle permissions_handle,
+          DDS_Security_SecurityException *ex);
+
+
+
+#endif /* SECURITY_BUILTIN_PLUGINS_AUTHENTICATION_H_ */
diff --git a/src/security/core/tests/plugin_loading/plugin_mock/access_control_missing_function/mock_access_control.c b/src/security/core/tests/plugin_loading/plugin_mock/access_control_missing_function/mock_access_control.c
new file mode 100644
index 0000000..a28e7e7
--- /dev/null
+++ b/src/security/core/tests/plugin_loading/plugin_mock/access_control_missing_function/mock_access_control.c
@@ -0,0 +1,600 @@
+/*
+ * Copyright(c) 2006 to 2019 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+#include "dds/security/dds_security_api.h"
+#include "dds/ddsrt/heap.h"
+#include "dds/ddsrt/misc.h"
+#include "mock_access_control.h"
+#include <stdio.h>
+#include <string.h>
+#include <stdbool.h>
+
+/**
+ * Implementation structure for storing encapsulated members of the instance
+ * while giving only the interface definition to user
+ */
+
+typedef struct dds_security_access_control_impl {
+  dds_security_access_control base;
+  int member;
+} dds_security_access_control_impl;
+
+/**
+ * Function implementations
+ */
+
+DDS_Security_PermissionsHandle validate_local_permissions(
+     dds_security_access_control *instance,
+     const dds_security_authentication *auth_plugin,
+     const DDS_Security_IdentityHandle identity,
+     const DDS_Security_DomainId domain_id,
+     const DDS_Security_Qos *participant_qos,
+    DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(auth_plugin);
+  DDSRT_UNUSED_ARG(auth_plugin);
+  DDSRT_UNUSED_ARG(identity);
+  DDSRT_UNUSED_ARG(domain_id);
+  DDSRT_UNUSED_ARG(participant_qos);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+
+  return 1;
+}
+
+DDS_Security_PermissionsHandle validate_remote_permissions(
+     dds_security_access_control *instance,
+     const dds_security_authentication *auth_plugin,
+     const DDS_Security_IdentityHandle local_identity_handle,
+     const DDS_Security_IdentityHandle remote_identity_handle,
+     const DDS_Security_PermissionsToken *remote_permissions_token,
+     const DDS_Security_AuthenticatedPeerCredentialToken *remote_credential_token,
+    DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(auth_plugin);
+  DDSRT_UNUSED_ARG(local_identity_handle);
+  DDSRT_UNUSED_ARG(remote_identity_handle);
+  DDSRT_UNUSED_ARG(remote_permissions_token);
+  DDSRT_UNUSED_ARG(remote_credential_token);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+
+  return 0;
+}
+
+DDS_Security_boolean check_create_participant( dds_security_access_control *instance,
+     const DDS_Security_PermissionsHandle permissions_handle,
+     const DDS_Security_DomainId domain_id,  const DDS_Security_Qos *participant_qos,
+    DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(permissions_handle);
+  DDSRT_UNUSED_ARG(domain_id);
+  DDSRT_UNUSED_ARG(participant_qos);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+
+  return true;
+}
+
+DDS_Security_boolean check_create_datawriter( dds_security_access_control *instance,
+     const DDS_Security_PermissionsHandle permissions_handle,
+     const DDS_Security_DomainId domain_id,  const char *topic_name,
+     const DDS_Security_Qos *writer_qos,
+     const DDS_Security_PartitionQosPolicy *partition,
+     const DDS_Security_DataTags *data_tag,
+    DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(permissions_handle);
+  DDSRT_UNUSED_ARG(domain_id);
+  DDSRT_UNUSED_ARG(topic_name);
+  DDSRT_UNUSED_ARG(writer_qos);
+  DDSRT_UNUSED_ARG(partition);
+  DDSRT_UNUSED_ARG(data_tag);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+
+  return true;
+}
+
+DDS_Security_boolean check_create_datareader( dds_security_access_control *instance,
+     const DDS_Security_PermissionsHandle permissions_handle,
+     const DDS_Security_DomainId domain_id,  const char *topic_name,
+     const DDS_Security_Qos *reader_qos,
+     const DDS_Security_PartitionQosPolicy *partition,
+     const DDS_Security_DataTags *data_tag,
+    DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(permissions_handle);
+  DDSRT_UNUSED_ARG(domain_id);
+  DDSRT_UNUSED_ARG(topic_name);
+  DDSRT_UNUSED_ARG(reader_qos);
+  DDSRT_UNUSED_ARG(partition);
+  DDSRT_UNUSED_ARG(data_tag);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+
+  return true;
+}
+
+DDS_Security_boolean check_create_topic( dds_security_access_control *instance,
+     const DDS_Security_PermissionsHandle permissions_handle,
+     const DDS_Security_DomainId domain_id,  const char *topic_name,
+     const DDS_Security_Qos *qos, DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(permissions_handle);
+  DDSRT_UNUSED_ARG(domain_id);
+  DDSRT_UNUSED_ARG(topic_name);
+  DDSRT_UNUSED_ARG(qos);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+
+  return true;
+}
+
+DDS_Security_boolean check_local_datawriter_register_instance(
+     dds_security_access_control *instance,
+     const DDS_Security_PermissionsHandle permissions_handle,
+     const DDS_Security_Entity *writer,  const DDS_Security_DynamicData *key,
+    DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(permissions_handle);
+  DDSRT_UNUSED_ARG(writer);
+  DDSRT_UNUSED_ARG(key);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+
+  return true;
+}
+
+DDS_Security_boolean check_local_datawriter_dispose_instance(
+     dds_security_access_control *instance,
+     const DDS_Security_PermissionsHandle permissions_handle,
+     const DDS_Security_Entity *writer,  const DDS_Security_DynamicData key,
+    DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(permissions_handle);
+  DDSRT_UNUSED_ARG(writer);
+  DDSRT_UNUSED_ARG(key);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+
+  return true;
+}
+
+DDS_Security_boolean check_remote_participant( dds_security_access_control *instance,
+     const DDS_Security_PermissionsHandle permissions_handle,
+     const DDS_Security_DomainId domain_id,
+     const DDS_Security_ParticipantBuiltinTopicDataSecure *participant_data,
+    DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(permissions_handle);
+  DDSRT_UNUSED_ARG(domain_id);
+  DDSRT_UNUSED_ARG(participant_data);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+
+  return true;
+}
+
+DDS_Security_boolean check_remote_datawriter( dds_security_access_control *instance,
+     const DDS_Security_PermissionsHandle permissions_handle,
+     const DDS_Security_DomainId domain_id,
+     const DDS_Security_PublicationBuiltinTopicDataSecure *publication_data,
+    DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(permissions_handle);
+  DDSRT_UNUSED_ARG(domain_id);
+  DDSRT_UNUSED_ARG(publication_data);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+
+  return true;
+}
+
+DDS_Security_boolean check_remote_datareader( dds_security_access_control *instance,
+     const DDS_Security_PermissionsHandle permissions_handle,
+     const DDS_Security_DomainId domain_id,
+     const DDS_Security_SubscriptionBuiltinTopicDataSecure *subscription_data,
+    DDS_Security_boolean *relay_only, DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(permissions_handle);
+  DDSRT_UNUSED_ARG(domain_id);
+  DDSRT_UNUSED_ARG(subscription_data);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+
+  *relay_only = false;
+
+  return true;
+}
+
+DDS_Security_boolean check_remote_topic( dds_security_access_control *instance,
+     const DDS_Security_PermissionsHandle permissions_handle,
+     const DDS_Security_DomainId domain_id,
+     const DDS_Security_TopicBuiltinTopicData *topic_data,
+    DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(permissions_handle);
+  DDSRT_UNUSED_ARG(domain_id);
+  DDSRT_UNUSED_ARG(topic_data);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+
+  return true;
+}
+
+DDS_Security_boolean check_local_datawriter_match(
+     dds_security_access_control *instance,
+     const DDS_Security_PermissionsHandle writer_permissions_handle,
+     const DDS_Security_PermissionsHandle reader_permissions_handle,
+     const DDS_Security_PublicationBuiltinTopicDataSecure *publication_data,
+     const DDS_Security_SubscriptionBuiltinTopicDataSecure *subscription_data,
+    DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(writer_permissions_handle);
+  DDSRT_UNUSED_ARG(reader_permissions_handle);
+  DDSRT_UNUSED_ARG(publication_data);
+  DDSRT_UNUSED_ARG(subscription_data);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+
+  return true;
+}
+
+DDS_Security_boolean check_local_datareader_match(
+     dds_security_access_control *instance,
+     const DDS_Security_PermissionsHandle reader_permissions_handle,
+     const DDS_Security_PermissionsHandle writer_permissions_handle,
+     const DDS_Security_SubscriptionBuiltinTopicDataSecure *subscription_data,
+     const DDS_Security_PublicationBuiltinTopicDataSecure *publication_data,
+    DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(reader_permissions_handle);
+  DDSRT_UNUSED_ARG(writer_permissions_handle);
+  DDSRT_UNUSED_ARG(subscription_data);
+  DDSRT_UNUSED_ARG(publication_data);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+
+  return true;
+}
+
+DDS_Security_boolean check_remote_datawriter_register_instance(
+     dds_security_access_control *instance,
+     const DDS_Security_PermissionsHandle permissions_handle,
+     const DDS_Security_Entity *reader,
+     const DDS_Security_InstanceHandle publication_handle,
+     const DDS_Security_DynamicData key,
+     const DDS_Security_InstanceHandle instance_handle,
+    DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(permissions_handle);
+  DDSRT_UNUSED_ARG(reader);
+  DDSRT_UNUSED_ARG(publication_handle);
+  DDSRT_UNUSED_ARG(key);
+  DDSRT_UNUSED_ARG(instance_handle);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+
+  return true;
+}
+
+DDS_Security_boolean check_remote_datawriter_dispose_instance(
+     dds_security_access_control *instance,
+     const DDS_Security_PermissionsHandle permissions_handle,
+     const DDS_Security_Entity *reader,
+     const DDS_Security_InstanceHandle publication_handle,
+     const DDS_Security_DynamicData key,
+    DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(permissions_handle);
+  DDSRT_UNUSED_ARG(reader);
+  DDSRT_UNUSED_ARG(publication_handle);
+  DDSRT_UNUSED_ARG(key);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+
+  return true;
+}
+
+DDS_Security_boolean get_permissions_token( dds_security_access_control *instance,
+    DDS_Security_PermissionsToken *permissions_token,
+     const DDS_Security_PermissionsHandle handle,
+    DDS_Security_SecurityException *ex)
+{
+
+  DDSRT_UNUSED_ARG(permissions_token);
+  DDSRT_UNUSED_ARG(handle);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+
+  return true;
+}
+
+DDS_Security_boolean get_permissions_credential_token(
+     dds_security_access_control *instance,
+    DDS_Security_PermissionsCredentialToken *permissions_credential_token,
+     const DDS_Security_PermissionsHandle handle,
+    DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(permissions_credential_token);
+  DDSRT_UNUSED_ARG(handle);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+
+  return true;
+}
+
+DDS_Security_boolean set_listener( dds_security_access_control *instance,
+     const dds_security_access_control_listener *listener,
+    DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(listener);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+
+  return true;
+}
+
+DDS_Security_boolean return_permissions_token( dds_security_access_control *instance,
+     const DDS_Security_PermissionsToken *token,
+    DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(token);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+
+  return true;
+}
+
+DDS_Security_boolean return_permissions_credential_token(
+     dds_security_access_control *instance,
+     const DDS_Security_PermissionsCredentialToken *permissions_credential_token,
+    DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(permissions_credential_token);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+
+  return true;
+}
+
+DDS_Security_boolean get_participant_sec_attributes(
+     dds_security_access_control *instance,
+     const DDS_Security_PermissionsHandle permissions_handle,
+    DDS_Security_ParticipantSecurityAttributes *attributes,
+    DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(permissions_handle);
+  DDSRT_UNUSED_ARG(attributes);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+
+  return true;
+}
+
+DDS_Security_boolean get_topic_sec_attributes( dds_security_access_control *instance,
+     const DDS_Security_PermissionsHandle permissions_handle,
+     const char *topic_name,
+    DDS_Security_TopicSecurityAttributes *attributes,
+    DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(permissions_handle);
+  DDSRT_UNUSED_ARG(topic_name);
+  DDSRT_UNUSED_ARG(attributes);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+
+  return true;
+}
+
+DDS_Security_boolean get_datawriter_sec_attributes(
+     dds_security_access_control *instance,
+     const DDS_Security_PermissionsHandle permissions_handle,
+     const char *topic_name,
+     const DDS_Security_PartitionQosPolicy *partition,
+     const DDS_Security_DataTagQosPolicy *data_tag,
+    DDS_Security_EndpointSecurityAttributes *attributes,
+    DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(permissions_handle);
+  DDSRT_UNUSED_ARG(topic_name);
+  DDSRT_UNUSED_ARG(partition);
+  DDSRT_UNUSED_ARG(data_tag);
+  DDSRT_UNUSED_ARG(attributes);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+
+  return true;
+}
+
+DDS_Security_boolean get_datareader_sec_attributes(
+     dds_security_access_control *instance,
+     const DDS_Security_PermissionsHandle permissions_handle,
+     const char *topic_name,
+     const DDS_Security_PartitionQosPolicy *partition,
+     const DDS_Security_DataTagQosPolicy *data_tag,
+    DDS_Security_EndpointSecurityAttributes *attributes,
+    DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(permissions_handle);
+  DDSRT_UNUSED_ARG(topic_name);
+  DDSRT_UNUSED_ARG(partition);
+  DDSRT_UNUSED_ARG(data_tag);
+  DDSRT_UNUSED_ARG(attributes);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+
+  return true;
+}
+
+DDS_Security_boolean return_participant_sec_attributes(
+     dds_security_access_control *instance,
+     const DDS_Security_ParticipantSecurityAttributes *attributes,
+    DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(attributes);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+
+  return true;
+}
+
+DDS_Security_boolean return_topic_sec_attributes(
+     dds_security_access_control *instance,
+     const DDS_Security_TopicSecurityAttributes *attributes,
+    DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(attributes);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+
+  return true;
+}
+
+DDS_Security_boolean return_datawriter_sec_attributes(
+     dds_security_access_control *instance,
+     const DDS_Security_EndpointSecurityAttributes *attributes,
+    DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(attributes);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+
+  return true;
+}
+
+DDS_Security_boolean return_datareader_sec_attributes(
+     dds_security_access_control *instance,
+     const DDS_Security_EndpointSecurityAttributes *attributes,
+    DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(attributes);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+
+  return true;
+}
+
+DDS_Security_boolean return_permissions_handle(
+     dds_security_access_control *instance,
+     const DDS_Security_PermissionsHandle permissions_handle,
+    DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(permissions_handle);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+
+  return true;
+}
+
+int32_t init_access_control(  const char *argument, void **context)
+{
+
+  dds_security_access_control *access_control;
+
+  DDSRT_UNUSED_ARG(argument);
+
+  //allocate new instance
+  access_control = ddsrt_malloc(sizeof(dds_security_access_control));
+  memset(access_control, 0, sizeof(dds_security_access_control));
+
+  //assign the interface functions
+  access_control->validate_local_permissions = &validate_local_permissions;
+
+  access_control->validate_remote_permissions = &validate_remote_permissions;
+
+  access_control->check_create_participant = &check_create_participant;
+
+  access_control->check_create_datawriter = &check_create_datawriter;
+
+  /* removed the function assignment
+   access_control->check_create_datareader = &check_create_datareader;
+
+   */
+
+  access_control->check_create_topic = &check_create_topic;
+
+  access_control->check_local_datawriter_register_instance =
+      &check_local_datawriter_register_instance;
+
+  access_control->check_local_datawriter_dispose_instance =
+      &check_local_datawriter_dispose_instance;
+
+  access_control->check_remote_participant = &check_remote_participant;
+
+  access_control->check_remote_datawriter = &check_remote_datawriter;
+
+  access_control->check_remote_datareader = &check_remote_datareader;
+
+  access_control->check_remote_topic = &check_remote_topic;
+
+  access_control->check_local_datawriter_match = &check_local_datawriter_match;
+
+  access_control->check_local_datareader_match = &check_local_datareader_match;
+
+  access_control->check_remote_datawriter_register_instance =
+      &check_remote_datawriter_register_instance;
+
+  access_control->check_remote_datawriter_dispose_instance =
+      &check_remote_datawriter_dispose_instance;
+
+  access_control->get_permissions_token = &get_permissions_token;
+
+  access_control->get_permissions_credential_token =
+      &get_permissions_credential_token;
+
+  access_control->set_listener = &set_listener;
+
+  access_control->return_permissions_token = &return_permissions_token;
+
+  access_control->return_permissions_credential_token =
+      &return_permissions_credential_token;
+
+  access_control->get_participant_sec_attributes =
+      &get_participant_sec_attributes;
+
+  access_control->get_topic_sec_attributes = &get_topic_sec_attributes;
+
+  access_control->get_datawriter_sec_attributes =
+      &get_datawriter_sec_attributes;
+
+  access_control->get_datareader_sec_attributes =
+      &get_datareader_sec_attributes;
+
+  access_control->return_participant_sec_attributes =
+      &return_participant_sec_attributes;
+
+  access_control->return_topic_sec_attributes =
+       &return_topic_sec_attributes;
+
+  access_control->return_datawriter_sec_attributes =
+      &return_datawriter_sec_attributes;
+
+  access_control->return_datareader_sec_attributes =
+      &return_datareader_sec_attributes;
+
+  access_control->return_permissions_handle =
+        &return_permissions_handle;
+
+  //return the instance
+  *context = access_control;
+  return 0;
+}
+
+ int32_t finalize_access_control(  void *context)
+{
+
+  DDSRT_UNUSED_ARG(context);
+
+  ddsrt_free((dds_security_access_control*) context);
+  return 0;
+}
diff --git a/src/security/core/tests/plugin_loading/plugin_mock/access_control_missing_function/mock_access_control.h b/src/security/core/tests/plugin_loading/plugin_mock/access_control_missing_function/mock_access_control.h
new file mode 100644
index 0000000..89d87c0
--- /dev/null
+++ b/src/security/core/tests/plugin_loading/plugin_mock/access_control_missing_function/mock_access_control.h
@@ -0,0 +1,280 @@
+/*
+ * Copyright(c) 2006 to 2019 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+#ifndef SECURITY_ACCESS_CONTROL_ALLOK_H_
+#define SECURITY_BUILTIN_PLUGINS_AUTHENTICATION_H_
+
+#include "dds/security/access_control_missing_function_export.h"
+#include "dds/security/dds_security_api.h"
+
+SECURITY_EXPORT int32_t
+init_access_control(const char *argument, void **context);
+
+SECURITY_EXPORT int32_t
+finalize_access_control(void *context);
+
+
+/**
+ * AccessControl Interface
+ */
+
+DDS_Security_PermissionsHandle
+validate_local_permissions
+        ( dds_security_access_control *instance,
+          const dds_security_authentication *auth_plugin,
+          const DDS_Security_IdentityHandle identity,
+          const DDS_Security_DomainId domain_id,
+          const DDS_Security_Qos *participant_qos,
+          DDS_Security_SecurityException *ex);
+
+DDS_Security_PermissionsHandle
+validate_remote_permissions
+        ( dds_security_access_control *instance,
+          const dds_security_authentication *auth_plugin,
+          const DDS_Security_IdentityHandle local_identity_handle,
+          const DDS_Security_IdentityHandle remote_identity_handle,
+          const DDS_Security_PermissionsToken *remote_permissions_token,
+          const DDS_Security_AuthenticatedPeerCredentialToken *remote_credential_token,
+          DDS_Security_SecurityException *ex);
+
+DDS_Security_boolean
+check_create_participant
+        ( dds_security_access_control *instance,
+          const DDS_Security_PermissionsHandle permissions_handle,
+          const DDS_Security_DomainId domain_id,
+          const DDS_Security_Qos *participant_qos,
+          DDS_Security_SecurityException *ex);
+
+DDS_Security_boolean
+check_create_datawriter
+        ( dds_security_access_control *instance,
+          const DDS_Security_PermissionsHandle permissions_handle,
+          const DDS_Security_DomainId domain_id,
+          const DDS_Security_char *topic_name,
+          const DDS_Security_Qos *writer_qos,
+          const DDS_Security_PartitionQosPolicy *partition,
+          const DDS_Security_DataTags *data_tag,
+          DDS_Security_SecurityException *ex);
+
+DDS_Security_boolean
+check_create_datareader
+        ( dds_security_access_control *instance,
+          const DDS_Security_PermissionsHandle permissions_handle,
+          const DDS_Security_DomainId domain_id,
+          const DDS_Security_char *topic_name,
+          const DDS_Security_Qos *reader_qos,
+          const DDS_Security_PartitionQosPolicy *partition,
+          const DDS_Security_DataTags *data_tag,
+          DDS_Security_SecurityException *ex);
+
+
+DDS_Security_boolean
+check_create_topic
+        ( dds_security_access_control *instance,
+          const DDS_Security_PermissionsHandle permissions_handle,
+          const DDS_Security_DomainId domain_id,
+          const DDS_Security_char *topic_name,
+          const DDS_Security_Qos *topic_qos,
+          DDS_Security_SecurityException *ex);
+
+DDS_Security_boolean
+check_local_datawriter_register_instance
+        ( dds_security_access_control *instance,
+          const DDS_Security_PermissionsHandle permissions_handle,
+          const DDS_Security_Entity *writer,
+          const DDS_Security_DynamicData *key,
+          DDS_Security_SecurityException *ex);
+
+DDS_Security_boolean
+check_local_datawriter_dispose_instance
+        ( dds_security_access_control *instance,
+          const DDS_Security_PermissionsHandle permissions_handle,
+          const DDS_Security_Entity *writer,
+          const DDS_Security_DynamicData key,
+          DDS_Security_SecurityException *ex);
+
+DDS_Security_boolean
+check_remote_participant
+        ( dds_security_access_control *instance,
+          const DDS_Security_PermissionsHandle permissions_handle,
+          const DDS_Security_DomainId domain_id,
+          const DDS_Security_ParticipantBuiltinTopicDataSecure *participant_data,
+          DDS_Security_SecurityException *ex);
+
+DDS_Security_boolean
+check_remote_datawriter
+        ( dds_security_access_control *instance,
+          const DDS_Security_PermissionsHandle permissions_handle,
+          const DDS_Security_DomainId domain_id,
+          const DDS_Security_PublicationBuiltinTopicDataSecure *publication_data,
+          DDS_Security_SecurityException *ex);
+
+DDS_Security_boolean
+check_remote_datareader
+        ( dds_security_access_control *instance,
+          const DDS_Security_PermissionsHandle permissions_handle,
+          const DDS_Security_DomainId domain_id,
+          const DDS_Security_SubscriptionBuiltinTopicDataSecure *subscription_data,
+          DDS_Security_boolean *relay_only,
+          DDS_Security_SecurityException *ex);
+
+DDS_Security_boolean
+check_remote_topic
+        ( dds_security_access_control *instance,
+          const DDS_Security_PermissionsHandle permissions_handle,
+          const DDS_Security_DomainId domain_id,
+          const DDS_Security_TopicBuiltinTopicData *topic_data,
+          DDS_Security_SecurityException *ex);
+
+
+DDS_Security_boolean
+check_local_datawriter_match
+        ( dds_security_access_control *instance,
+          const DDS_Security_PermissionsHandle writer_permissions_handle,
+          const DDS_Security_PermissionsHandle reader_permissions_handle,
+          const DDS_Security_PublicationBuiltinTopicDataSecure *publication_data,
+          const DDS_Security_SubscriptionBuiltinTopicDataSecure *subscription_data,
+          DDS_Security_SecurityException *ex);
+
+
+DDS_Security_boolean
+check_local_datareader_match
+        ( dds_security_access_control *instance,
+          const DDS_Security_PermissionsHandle reader_permissions_handle,
+          const DDS_Security_PermissionsHandle writer_permissions_handle,
+          const DDS_Security_SubscriptionBuiltinTopicDataSecure *subscription_data,
+          const DDS_Security_PublicationBuiltinTopicDataSecure *publication_data,
+          DDS_Security_SecurityException *ex);
+
+DDS_Security_boolean
+check_remote_datawriter_register_instance
+        ( dds_security_access_control *instance,
+          const DDS_Security_PermissionsHandle permissions_handle,
+          const DDS_Security_Entity *reader,
+          const DDS_Security_InstanceHandle publication_handle,
+          const DDS_Security_DynamicData key,
+          const DDS_Security_InstanceHandle instance_handle,
+          DDS_Security_SecurityException *ex);
+
+DDS_Security_boolean
+check_remote_datawriter_dispose_instance
+        ( dds_security_access_control *instance,
+          const DDS_Security_PermissionsHandle permissions_handle,
+          const DDS_Security_Entity *reader,
+          const DDS_Security_InstanceHandle publication_handle,
+          const DDS_Security_DynamicData key,
+          DDS_Security_SecurityException *ex);
+
+DDS_Security_boolean
+get_permissions_token
+        ( dds_security_access_control *instance,
+          DDS_Security_PermissionsToken *permissions_token,
+          const DDS_Security_PermissionsHandle handle,
+          DDS_Security_SecurityException *ex);
+
+DDS_Security_boolean
+get_permissions_credential_token
+        ( dds_security_access_control *instance,
+          DDS_Security_PermissionsCredentialToken *permissions_credential_token,
+          const DDS_Security_PermissionsHandle handle,
+          DDS_Security_SecurityException *ex);
+
+DDS_Security_boolean
+set_listener
+        ( dds_security_access_control *instance,
+          const dds_security_access_control_listener *listener,
+          DDS_Security_SecurityException *ex);
+
+DDS_Security_boolean
+return_permissions_token
+        ( dds_security_access_control *instance,
+          const DDS_Security_PermissionsToken *token,
+          DDS_Security_SecurityException *ex);
+
+DDS_Security_boolean
+return_permissions_credential_token
+        ( dds_security_access_control *instance,
+          const DDS_Security_PermissionsCredentialToken *permissions_credential_token,
+          DDS_Security_SecurityException *ex);
+
+DDS_Security_boolean
+get_participant_sec_attributes
+        ( dds_security_access_control *instance,
+          const DDS_Security_PermissionsHandle permissions_handle,
+          DDS_Security_ParticipantSecurityAttributes *attributes,
+          DDS_Security_SecurityException *ex);
+
+
+DDS_Security_boolean
+get_topic_sec_attributes
+        ( dds_security_access_control *instance,
+          const DDS_Security_PermissionsHandle permissions_handle,
+          const DDS_Security_char *topic_name,
+          DDS_Security_TopicSecurityAttributes *attributes,
+          DDS_Security_SecurityException *ex);
+
+
+DDS_Security_boolean
+get_datawriter_sec_attributes
+        ( dds_security_access_control *instance,
+          const DDS_Security_PermissionsHandle permissions_handle,
+          const DDS_Security_char *topic_name,
+          const DDS_Security_PartitionQosPolicy *partition,
+          const DDS_Security_DataTagQosPolicy *data_tag,
+          DDS_Security_EndpointSecurityAttributes *attributes,
+          DDS_Security_SecurityException *ex);
+
+
+DDS_Security_boolean
+get_datareader_sec_attributes
+        ( dds_security_access_control *instance,
+          const DDS_Security_PermissionsHandle permissions_handle,
+          const DDS_Security_char *topic_name,
+          const DDS_Security_PartitionQosPolicy *partition,
+          const DDS_Security_DataTagQosPolicy *data_tag,
+          DDS_Security_EndpointSecurityAttributes *attributes,
+          DDS_Security_SecurityException *ex);
+
+
+DDS_Security_boolean
+return_participant_sec_attributes
+        ( dds_security_access_control *instance,
+          const DDS_Security_ParticipantSecurityAttributes *attributes,
+          DDS_Security_SecurityException *ex);
+
+DDS_Security_boolean
+return_topic_sec_attributes
+        ( dds_security_access_control *instance,
+          const DDS_Security_TopicSecurityAttributes *attributes,
+          DDS_Security_SecurityException *ex);
+
+DDS_Security_boolean
+return_datawriter_sec_attributes
+        ( dds_security_access_control *instance,
+          const DDS_Security_EndpointSecurityAttributes *attributes,
+          DDS_Security_SecurityException *ex);
+
+
+DDS_Security_boolean
+return_datareader_sec_attributes
+        ( dds_security_access_control *instance,
+          const DDS_Security_EndpointSecurityAttributes *attributes,
+          DDS_Security_SecurityException *ex);
+
+DDS_Security_boolean
+return_permissions_handle
+        ( dds_security_access_control *instance,
+          const  DDS_Security_PermissionsHandle permissions_handle,
+          DDS_Security_SecurityException *ex);
+
+
+
+#endif /* SECURITY_BUILTIN_PLUGINS_AUTHENTICATION_H_ */
diff --git a/src/security/core/tests/plugin_loading/plugin_mock/authentication_all_ok/mock_authentication.c b/src/security/core/tests/plugin_loading/plugin_mock/authentication_all_ok/mock_authentication.c
new file mode 100644
index 0000000..cfe680a
--- /dev/null
+++ b/src/security/core/tests/plugin_loading/plugin_mock/authentication_all_ok/mock_authentication.c
@@ -0,0 +1,396 @@
+/*
+ * Copyright(c) 2006 to 2019 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+
+#include "dds/security/dds_security_api.h"
+#include "dds/ddsrt/heap.h"
+#include "dds/ddsrt/misc.h"
+#include "mock_authentication.h"
+#include <stdio.h>
+#include <string.h>
+#include <stdbool.h>
+
+/**
+ * Implementation structure for storing encapsulated members of the instance
+ * while giving only the interface definition to user
+ */
+
+typedef struct dds_security_authentication_impl {
+  dds_security_authentication base;
+  int id; //sample internal member
+} dds_security_authentication_impl;
+
+DDS_Security_ValidationResult_t validate_local_identity(
+    dds_security_authentication *instance,
+     DDS_Security_IdentityHandle *local_identity_handle,
+     DDS_Security_GUID_t *adjusted_participant_guid,
+    const DDS_Security_DomainId domain_id,
+    const DDS_Security_Qos *participant_qos,
+    const DDS_Security_GUID_t *candidate_participant_guid,
+     DDS_Security_SecurityException *ex)
+{
+
+  unsigned i;
+  DDS_Security_ValidationResult_t result=DDS_SECURITY_VALIDATION_OK;
+  dds_security_authentication_impl *implementation =
+      (dds_security_authentication_impl *) instance;
+  char *identity_ca = NULL;
+  char *identity_certificate = NULL;
+  char *private_key = NULL;
+
+  DDSRT_UNUSED_ARG(local_identity_handle);
+  DDSRT_UNUSED_ARG(adjusted_participant_guid);
+  DDSRT_UNUSED_ARG(domain_id);
+  DDSRT_UNUSED_ARG(participant_qos);
+  DDSRT_UNUSED_ARG(candidate_participant_guid);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+
+  implementation->id = 2;
+
+  memcpy(adjusted_participant_guid, candidate_participant_guid, sizeof(DDS_Security_GUID_t));
+
+  for( i=0; i< participant_qos->property.value._length; i++)
+  {
+
+    //printf("%s: %s",participant_qos->property.value._buffer[i].name, participant_qos->property.value._buffer[i].value);
+    printf("%s\n",participant_qos->property.value._buffer[i].name);
+    if( strcmp(participant_qos->property.value._buffer[i].name, "dds.sec.auth.private_key") == 0)
+    {
+      private_key = participant_qos->property.value._buffer[i].value;
+    } else if( strcmp(participant_qos->property.value._buffer[i].name, "dds.sec.auth.identity_ca") == 0)
+    {
+      identity_ca = participant_qos->property.value._buffer[i].value;
+    } else if( strcmp(participant_qos->property.value._buffer[i].name, "dds.sec.auth.identity_certificate") == 0)
+    {
+      identity_certificate = participant_qos->property.value._buffer[i].value;
+    }
+  }
+
+  if( strcmp(identity_certificate, test_identity_certificate) != 0){
+
+    result = DDS_SECURITY_VALIDATION_FAILED;
+    printf("FAILED: Could not get identity_certificate value properly\n");
+  }
+  else if( strcmp(identity_ca, test_ca_certificate) != 0){
+    printf("FAILED: Could not get identity_ca value properly\n");
+    result = DDS_SECURITY_VALIDATION_FAILED;
+  }else if( strcmp(private_key, test_privatekey) != 0){
+    printf("FAILED: Could not get private_key value properly\n");
+    result = DDS_SECURITY_VALIDATION_FAILED;
+  }
+
+  if( result == DDS_SECURITY_VALIDATION_OK )
+  {
+    printf("DDS_SECURITY_VALIDATION_OK\n");
+  }
+
+
+  return result;
+}
+
+DDS_Security_boolean get_identity_token(dds_security_authentication *instance,
+     DDS_Security_IdentityToken *identity_token,
+    const DDS_Security_IdentityHandle handle,
+     DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(identity_token);
+  DDSRT_UNUSED_ARG(handle);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+
+  memset(identity_token, 0, sizeof(*identity_token));
+
+  return true;
+}
+
+DDS_Security_boolean get_identity_status_token(
+    dds_security_authentication *instance,
+     DDS_Security_IdentityStatusToken *identity_status_token,
+    const DDS_Security_IdentityHandle handle,
+     DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(identity_status_token);
+  DDSRT_UNUSED_ARG(handle);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+
+  return true;
+}
+
+DDS_Security_boolean set_permissions_credential_and_token(
+    dds_security_authentication *instance,
+    const DDS_Security_IdentityHandle handle,
+    const DDS_Security_PermissionsCredentialToken *permissions_credential,
+    const DDS_Security_PermissionsToken *permissions_token,
+     DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(handle);
+  DDSRT_UNUSED_ARG(permissions_credential);
+  DDSRT_UNUSED_ARG(permissions_token);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+
+  return true;
+}
+
+DDS_Security_ValidationResult_t validate_remote_identity(
+    dds_security_authentication *instance,
+     DDS_Security_IdentityHandle *remote_identity_handle,
+     DDS_Security_AuthRequestMessageToken *local_auth_request_token,
+    const DDS_Security_AuthRequestMessageToken *remote_auth_request_token,
+    const DDS_Security_IdentityHandle local_identity_handle,
+    const DDS_Security_IdentityToken *remote_identity_token,
+    const DDS_Security_GUID_t *remote_participant_guid,
+     DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(remote_identity_handle);
+  DDSRT_UNUSED_ARG(local_auth_request_token);
+  DDSRT_UNUSED_ARG(remote_auth_request_token);
+  DDSRT_UNUSED_ARG(local_identity_handle);
+  DDSRT_UNUSED_ARG(remote_identity_token);
+  DDSRT_UNUSED_ARG(remote_participant_guid);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+
+  return DDS_SECURITY_VALIDATION_OK;
+}
+
+DDS_Security_ValidationResult_t begin_handshake_request(
+    dds_security_authentication *instance,
+     DDS_Security_HandshakeHandle *handshake_handle,
+     DDS_Security_HandshakeMessageToken *handshake_message,
+    const DDS_Security_IdentityHandle initiator_identity_handle,
+    const DDS_Security_IdentityHandle replier_identity_handle,
+    const DDS_Security_OctetSeq *serialized_local_participant_data,
+     DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(handshake_handle);
+  DDSRT_UNUSED_ARG(handshake_message);
+  DDSRT_UNUSED_ARG(initiator_identity_handle);
+  DDSRT_UNUSED_ARG(replier_identity_handle);
+  DDSRT_UNUSED_ARG(serialized_local_participant_data);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+
+  return DDS_SECURITY_VALIDATION_OK;
+}
+
+DDS_Security_ValidationResult_t begin_handshake_reply(
+    dds_security_authentication *instance,
+     DDS_Security_HandshakeHandle *handshake_handle,
+     DDS_Security_HandshakeMessageToken *handshake_message_out,
+    const DDS_Security_HandshakeMessageToken *handshake_message_in,
+    const DDS_Security_IdentityHandle initiator_identity_handle,
+    const DDS_Security_IdentityHandle replier_identity_handle,
+    const DDS_Security_OctetSeq *serialized_local_participant_data,
+     DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(handshake_handle);
+  DDSRT_UNUSED_ARG(handshake_message_out);
+  DDSRT_UNUSED_ARG(handshake_message_in);
+  DDSRT_UNUSED_ARG(initiator_identity_handle);
+  DDSRT_UNUSED_ARG(replier_identity_handle);
+  DDSRT_UNUSED_ARG(serialized_local_participant_data);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+
+  return DDS_SECURITY_VALIDATION_OK;
+}
+
+DDS_Security_ValidationResult_t process_handshake(
+    dds_security_authentication *instance,
+     DDS_Security_HandshakeMessageToken *handshake_message_out,
+    const DDS_Security_HandshakeMessageToken *handshake_message_in,
+    const DDS_Security_HandshakeHandle handshake_handle,
+     DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(handshake_message_out);
+  DDSRT_UNUSED_ARG(handshake_message_in);
+  DDSRT_UNUSED_ARG(handshake_handle);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+
+  return DDS_SECURITY_VALIDATION_OK;
+}
+
+DDS_Security_SharedSecretHandle get_shared_secret(
+    dds_security_authentication *instance,
+    const DDS_Security_HandshakeHandle handshake_handle,
+     DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(handshake_handle);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+
+  return 0;
+}
+
+DDS_Security_boolean get_authenticated_peer_credential_token(
+    dds_security_authentication *instance,
+     DDS_Security_AuthenticatedPeerCredentialToken *peer_credential_token,
+    const DDS_Security_HandshakeHandle handshake_handle,
+     DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(peer_credential_token);
+  DDSRT_UNUSED_ARG(handshake_handle);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+
+  return true;
+}
+
+DDS_Security_boolean set_listener(dds_security_authentication *instance,
+    const dds_security_authentication_listener *listener,
+     DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(listener);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+
+  return true;
+}
+
+DDS_Security_boolean return_identity_token(dds_security_authentication *instance,
+    const DDS_Security_IdentityToken *token,
+     DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(token);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+
+  return true;
+}
+
+DDS_Security_boolean return_identity_status_token(
+    dds_security_authentication *instance,
+    const DDS_Security_IdentityStatusToken *token,
+     DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(token);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+
+  return true;
+}
+
+DDS_Security_boolean return_authenticated_peer_credential_token(
+    dds_security_authentication *instance,
+    const DDS_Security_AuthenticatedPeerCredentialToken *peer_credential_token,
+     DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(peer_credential_token);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+
+  return true;
+}
+
+DDS_Security_boolean return_handshake_handle(dds_security_authentication *instance,
+    const DDS_Security_HandshakeHandle handshake_handle,
+     DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(handshake_handle);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+
+  return true;
+}
+
+DDS_Security_boolean return_identity_handle(dds_security_authentication *instance,
+    const DDS_Security_IdentityHandle identity_handle,
+     DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(identity_handle);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+
+  return true;
+}
+
+DDS_Security_boolean return_sharedsecret_handle(
+    dds_security_authentication *instance,
+    const DDS_Security_SharedSecretHandle sharedsecret_handle,
+     DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(sharedsecret_handle);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+
+  return true;
+}
+
+int32_t init_authentication( const char *argument,  void **context)
+{
+
+  dds_security_authentication_impl *authentication;
+
+  DDSRT_UNUSED_ARG(argument);
+
+  //allocate implementation wrapper
+  authentication = (dds_security_authentication_impl*) ddsrt_malloc(
+      sizeof(dds_security_authentication_impl));
+  memset(authentication, 0, sizeof(dds_security_authentication_impl));
+
+  //assign the interface functions
+  authentication->base.validate_local_identity = &validate_local_identity;
+
+  authentication->base.get_identity_token = &get_identity_token;
+
+  authentication->base.get_identity_status_token = &get_identity_status_token;
+
+  authentication->base.set_permissions_credential_and_token =
+      &set_permissions_credential_and_token;
+
+  authentication->base.validate_remote_identity = &validate_remote_identity;
+
+  authentication->base.begin_handshake_request = &begin_handshake_request;
+
+  authentication->base.begin_handshake_reply = &begin_handshake_reply;
+
+  authentication->base.process_handshake = &process_handshake;
+
+  authentication->base.get_shared_secret = &get_shared_secret;
+
+  authentication->base.get_authenticated_peer_credential_token =
+      &get_authenticated_peer_credential_token;
+
+  authentication->base.set_listener = &set_listener;
+
+  authentication->base.return_identity_token = &return_identity_token;
+
+  authentication->base.return_identity_status_token =
+      &return_identity_status_token;
+
+  authentication->base.return_authenticated_peer_credential_token =
+      &return_authenticated_peer_credential_token;
+
+  authentication->base.return_handshake_handle = &return_handshake_handle;
+
+  authentication->base.return_identity_handle = &return_identity_handle;
+
+  authentication->base.return_sharedsecret_handle = &return_sharedsecret_handle;
+
+  //prepare implementation wrapper
+  authentication->id = 1;
+
+  //return the instance
+  *context = authentication;
+  return 0;
+}
+
+int32_t finalize_authentication(void *instance)
+{
+
+  ddsrt_free((dds_security_authentication_impl*) instance);
+
+  return 0;
+}
diff --git a/src/security/core/tests/plugin_loading/plugin_mock/authentication_all_ok/mock_authentication.h b/src/security/core/tests/plugin_loading/plugin_mock/authentication_all_ok/mock_authentication.h
new file mode 100644
index 0000000..56d297c
--- /dev/null
+++ b/src/security/core/tests/plugin_loading/plugin_mock/authentication_all_ok/mock_authentication.h
@@ -0,0 +1,213 @@
+/*
+ * authentication.h
+ *
+ *  Created on: Jan 15, 2018
+ *      Author: kurtulus oksuztepe
+ */
+
+#ifndef SECURITY_BUILTIN_PLUGINS_AUTHENTICATION_H_
+#define SECURITY_BUILTIN_PLUGINS_AUTHENTICATION_H_
+
+#include "dds/security/authentication_all_ok_export.h"
+
+SECURITY_EXPORT int32_t
+init_authentication(const char *argument, void **context);
+
+SECURITY_EXPORT int32_t
+finalize_authentication(void *context);
+
+char *test_identity_certificate="data:,-----BEGIN CERTIFICATE-----\n\
+MIIDYDCCAkigAwIBAgIBBDANBgkqhkiG9w0BAQsFADByMQswCQYDVQQGEwJOTDEL\n\
+MAkGA1UECBMCT1YxEzARBgNVBAoTCkFETGluayBJU1QxGTAXBgNVBAMTEElkZW50\n\
+aXR5IENBIFRlc3QxJjAkBgkqhkiG9w0BCQEWF2luZm9AaXN0LmFkbGlua3RlY2gu\n\
+Y29tMB4XDTE4MDMxMjAwMDAwMFoXDTI3MDMxMTIzNTk1OVowdTELMAkGA1UEBhMC\n\
+TkwxCzAJBgNVBAgTAk9WMRAwDgYDVQQKEwdBRExpbmsgMREwDwYDVQQLEwhJU1Qg\n\
+VGVzdDETMBEGA1UEAxMKQWxpY2UgVGVzdDEfMB0GCSqGSIb3DQEJARYQYWxpY2VA\n\
+YWRsaW5rLmlzdDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBANBW+tEZ\n\
+Baw7EQCEXyzH9n7IkZ8PQIKe8hG1LAOGYOF/oUYQZJO/HxbWoC4rFqOC20+A6is6\n\
+kFwr1Zzp/Wurk9CrFXo5Nomi6ActH6LUM57nYqN68w6U38z/XkQxVY/ESZ5dySfD\n\
+9Q1C8R+zdE8gwbimdYmwX7ioz336nghM2CoAHPDRthQeJupl8x4V7isOltr9CGx8\n\
++imJXbGr39OK6u87cNLeu23sUkOIC0lSRMIqIQK3oJtHS70J2qecXdqp9MhE7Xky\n\
+/GPlI8ptQ1gJ8A3cAOvtI9mtMJMszs2EKWTLfeTcmfJHKKhKjvCgDdh3Jan4x5YP\n\
+Yg7HG6H+ceOUkMMCAwEAATANBgkqhkiG9w0BAQsFAAOCAQEAkvuqZzyJ3Nu4/Eo5\n\
+kD0nVgYGBUl7cspu+636q39zPSrxLEDMUWz+u8oXLpyGcgiZ8lZulPTV8dmOn+3C\n\
+Vg55c5C+gbnbX3MDyb3wB17296RmxYf6YNul4sFOmj6+g2i+Dw9WH0PBCVKbA84F\n\
+jR3Gx2Pfoifor3DvT0YFSsjNIRt090u4dQglbIb6cWEafC7O24t5jFhGPvJ7L9SE\n\
+gB0Drh/HmKTVuaqaRkoOKkKaKuWoXsszK1ZFda1DHommnR5LpYPsDRQ2fVM4EuBF\n\
+By03727uneuG8HLuNcLEV9H0i7LxtyfFkyCPUQvWG5jehb7xPOz/Ml26NAwwjlTJ\n\
+xEEFrw==\n\
+-----END CERTIFICATE-----";
+
+char *test_ca_certificate="data:,-----BEGIN CERTIFICATE-----\n\
+MIIEKTCCAxGgAwIBAgIBATANBgkqhkiG9w0BAQsFADByMQswCQYDVQQGEwJOTDEL\n\
+MAkGA1UECBMCT1YxEzARBgNVBAoTCkFETGluayBJU1QxGTAXBgNVBAMTEElkZW50\n\
+aXR5IENBIFRlc3QxJjAkBgkqhkiG9w0BCQEWF2luZm9AaXN0LmFkbGlua3RlY2gu\n\
+Y29tMB4XDTE4MDMxMjAwMDAwMFoXDTI3MDMxMTIzNTk1OVowcjELMAkGA1UEBhMC\n\
+TkwxCzAJBgNVBAgTAk9WMRMwEQYDVQQKEwpBRExpbmsgSVNUMRkwFwYDVQQDExBJ\n\
+ZGVudGl0eSBDQSBUZXN0MSYwJAYJKoZIhvcNAQkBFhdpbmZvQGlzdC5hZGxpbmt0\n\
+ZWNoLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBANa/ENFfGVXg\n\
+bPLTzBdDfiZQcp5dWZ//Pb8ErFOJu8uosVHFv8t69dgjHgNHB4OsjmjnR7GfKUZT\n\
+0cMvWJnjsC7DDlBwFET9rj4k40n96bbVCH9I7+tNhsoqzc6Eu+5h4sk7VfNGTM2Z\n\
+SyCd4GiSZRuA44rRbhXI7/LDpr4hY5J9ZDo5AM9ZyoLAoh774H3CZWD67S35XvUs\n\
+72dzE6uKG/vxBbvZ7eW2GLO6ewa9UxlnLVMPfJdpkp/xYXwwcPW2+2YXCge1ujxs\n\
+tjrOQJ5HUySh6DkE/kZpx8zwYWm9AaCrsvCIX1thsqgvKy+U5v1FS1L58eGc6s//\n\
+9yMgNhU29R0CAwEAAaOByTCBxjAMBgNVHRMEBTADAQH/MB0GA1UdDgQWBBRNVUJN\n\
+FzhJPReYT4QSx6dK53CXCTAfBgNVHSMEGDAWgBRNVUJNFzhJPReYT4QSx6dK53CX\n\
+CTAPBgNVHQ8BAf8EBQMDB/+AMGUGA1UdJQEB/wRbMFkGCCsGAQUFBwMBBggrBgEF\n\
+BQcDAgYIKwYBBQUHAwMGCCsGAQUFBwMEBggrBgEFBQcDCAYIKwYBBQUHAwkGCCsG\n\
+AQUFBwMNBggrBgEFBQcDDgYHKwYBBQIDBTANBgkqhkiG9w0BAQsFAAOCAQEAcOLF\n\
+ZYdJguj0uxeXB8v3xnUr1AWz9+gwg0URdfNLU2KvF2lsb/uznv6168b3/FcPgezN\n\
+Ihl9GqB+RvGwgXS/1UelCGbQiIUdsNxk246P4uOGPIyW32RoJcYPWZcpY+cw11tQ\n\
+NOnk994Y5/8ad1DmcxVLLqq5kwpXGWQufV1zOONq8B+mCvcVAmM4vkyF/de56Lwa\n\
+sAMpk1p77uhaDnuq2lIR4q3QHX2wGctFid5Q375DRscFQteY01r/dtwBBrMn0wuL\n\
+AMNx9ZGD+zAoOUaslpIlEQ+keAxk3jgGMWFMxF81YfhEnXzevSQXWpyek86XUyFL\n\
+O9IAQi5pa15gXjSbUg==\n\
+-----END CERTIFICATE-----";
+
+char *test_privatekey = "data:,-----BEGIN RSA PRIVATE KEY-----\n\
+MIIEowIBAAKCAQEA0Fb60RkFrDsRAIRfLMf2fsiRnw9Agp7yEbUsA4Zg4X+hRhBk\n\
+k78fFtagLisWo4LbT4DqKzqQXCvVnOn9a6uT0KsVejk2iaLoBy0fotQznudio3rz\n\
+DpTfzP9eRDFVj8RJnl3JJ8P1DULxH7N0TyDBuKZ1ibBfuKjPffqeCEzYKgAc8NG2\n\
+FB4m6mXzHhXuKw6W2v0IbHz6KYldsavf04rq7ztw0t67bexSQ4gLSVJEwiohAreg\n\
+m0dLvQnap5xd2qn0yETteTL8Y+Ujym1DWAnwDdwA6+0j2a0wkyzOzYQpZMt95NyZ\n\
+8kcoqEqO8KAN2HclqfjHlg9iDscbof5x45SQwwIDAQABAoIBAG0dYPeqd0IhHWJ7\n\
+8azufbchLMN1pX/D51xG2uptssfnpHuhkkufSZUYi4QipRS2ME6PYhWJ8pmTi6lH\n\
+E6cUkbI0KGd/F4U2gPdhNrR9Fxwea5bbifkVF7Gx/ZkRjZJiZ3w9+mCNTQbJDKhh\n\
+wITAzzT6WYznhvqbzzBX1fTa6kv0GAQtX7aHKM+XIwkhX2gzU5TU80bvH8aMrT05\n\
+tAMGQqkUeRnpo0yucBl4VmTZzd/+X/d2UyXR0my15jE5iH5o+p+E6qTRE9D+MGUd\n\
+MQ6Ftj0Untqy1lcog1ZLL6zPlnwcD4jgY5VCYDgvabnrSwymOJapPLsAEdWdq+U5\n\
+ec44BMECgYEA/+3qPUrd4XxA517qO3fCGBvf2Gkr7w5ZDeATOTHGuD8QZeK0nxPl\n\
+CWhRjdgkqo0fyf1cjczL5XgYayo+YxkO1Z4RUU+8lJAHlVx9izOQo+MTQfkwH4BK\n\
+LYlHxMoHJwAOXXoE+dmBaDh5xT0mDUGU750r763L6EFovE4qRBn9hxkCgYEA0GWz\n\
+rpOPNxb419WxG9npoQYdCZ5IbmEOGDH3ReggVzWHmW8sqtkqTZm5srcyDpqAc1Gu\n\
+paUveMblEBbU+NFJjLWOfwB5PCp8jsrqRgCQSxolShiVkc3Vu3oyzMus9PDge1eo\n\
+9mwVGO7ojQKWRu/WVAakENPaAjeyyhv4dqSNnjsCgYEAlwe8yszqoY1k8+U0T0G+\n\
+HeIdOCXgkmOiNCj+zyrLvaEhuS6PLq1b5TBVqGJcSPWdQ+MrglbQIKu9pUg5ptt7\n\
+wJ5WU+i9PeK9Ruxc/g/BFKYFkFJQjtZzb+nqm3wpul8zGwDN/O/ZiTqCyd3rHbmM\n\
+/dZ/viKPCZHIEBAEq0m3LskCgYBndzcAo+5k8ZjWwBfQth5SfhCIp/daJgGzbYtR\n\
+P/BenAsY2KOap3tjT8Fsw5usuHSxzIojX6H0Gvu7Qzq11mLn43Q+BeQrRQTWeFRc\n\
+MQdy4iZFZXNNEp7dF8yE9VKHwdgSJPGUdxD6chMvf2tRCN6mlS171VLV6wVvZvez\n\
+H/vX5QKBgD2Dq/NHpjCpAsECP9awmNF5Akn5WJbRGmegwXIih2mOtgtYYDeuQyxY\n\
+ZCrdJFfIUjUVPagshEmUklKhkYMYpzy2PQDVtaVcm6UNFroxT5h+J+KDs1LN1H8G\n\
+LsASrzyAg8EpRulwXEfLrWKiu9DKv8bMEgO4Ovgz8zTKJZIFhcac\n\
+-----END RSA PRIVATE KEY-----";
+
+
+DDS_Security_ValidationResult_t
+validate_local_identity(
+        dds_security_authentication *instance,
+        DDS_Security_IdentityHandle *local_identity_handle,
+        DDS_Security_GUID_t *adjusted_participant_guid,
+        const DDS_Security_DomainId domain_id,
+        const DDS_Security_Qos *participant_qos,
+        const DDS_Security_GUID_t *candidate_participant_guid,
+
+        DDS_Security_SecurityException *ex);
+DDS_Security_boolean
+get_identity_token(dds_security_authentication *instance,
+                   DDS_Security_IdentityToken *identity_token,
+                   const DDS_Security_IdentityHandle handle,
+                   DDS_Security_SecurityException *ex);
+DDS_Security_boolean
+set_permissions_credential_and_token(
+        dds_security_authentication *instance,
+        const DDS_Security_IdentityHandle handle,
+        const DDS_Security_PermissionsCredentialToken *permissions_credential,
+        const DDS_Security_PermissionsToken *permissions_token,
+        DDS_Security_SecurityException *ex);
+
+DDS_Security_ValidationResult_t
+validate_remote_identity(
+        dds_security_authentication *instance,
+        DDS_Security_IdentityHandle *remote_identity_handle,
+        DDS_Security_AuthRequestMessageToken *local_auth_request_token,
+        const DDS_Security_AuthRequestMessageToken *remote_auth_request_token,
+        const DDS_Security_IdentityHandle local_identity_handle,
+        const DDS_Security_IdentityToken *remote_identity_token,
+        const DDS_Security_GUID_t *remote_participant_guid,
+        DDS_Security_SecurityException *ex);
+
+DDS_Security_ValidationResult_t
+begin_handshake_request(
+        dds_security_authentication *instance,
+        DDS_Security_HandshakeHandle *handshake_handle,
+        DDS_Security_HandshakeMessageToken *handshake_message,
+        const DDS_Security_IdentityHandle initiator_identity_handle,
+        const DDS_Security_IdentityHandle replier_identity_handle,
+        const DDS_Security_OctetSeq *serialized_local_participant_data,
+        DDS_Security_SecurityException *ex);
+
+DDS_Security_ValidationResult_t
+begin_handshake_reply(
+        dds_security_authentication *instance,
+        DDS_Security_HandshakeHandle *handshake_handle,
+        DDS_Security_HandshakeMessageToken *handshake_message_out,
+        const DDS_Security_HandshakeMessageToken *handshake_message_in,
+        const DDS_Security_IdentityHandle initiator_identity_handle,
+        const DDS_Security_IdentityHandle replier_identity_handle,
+        const DDS_Security_OctetSeq *serialized_local_participant_data,
+        DDS_Security_SecurityException *ex);
+
+DDS_Security_ValidationResult_t
+process_handshake(
+        dds_security_authentication *instance,
+        DDS_Security_HandshakeMessageToken *handshake_message_out,
+        const DDS_Security_HandshakeMessageToken *handshake_message_in,
+        const DDS_Security_HandshakeHandle handshake_handle,
+        DDS_Security_SecurityException *ex);
+
+DDS_Security_SharedSecretHandle get_shared_secret(
+        dds_security_authentication *instance,
+        const DDS_Security_HandshakeHandle handshake_handle,
+        DDS_Security_SecurityException *ex);
+
+DDS_Security_boolean
+get_authenticated_peer_credential_token(
+        dds_security_authentication *instance,
+        DDS_Security_AuthenticatedPeerCredentialToken *peer_credential_token,
+        const DDS_Security_HandshakeHandle handshake_handle,
+        DDS_Security_SecurityException *ex);
+
+
+DDS_Security_boolean get_identity_status_token(
+        dds_security_authentication *instance,
+        DDS_Security_IdentityStatusToken *identity_status_token,
+        const DDS_Security_IdentityHandle handle,
+        DDS_Security_SecurityException *ex);
+
+DDS_Security_boolean set_listener(dds_security_authentication *instance,
+                                  const dds_security_authentication_listener *listener,
+                                  DDS_Security_SecurityException *ex);
+
+DDS_Security_boolean return_identity_token(dds_security_authentication *instance,
+                                           const DDS_Security_IdentityToken *token,
+                                           DDS_Security_SecurityException *ex);
+
+DDS_Security_boolean return_identity_status_token(
+        dds_security_authentication *instance,
+        const DDS_Security_IdentityStatusToken *token,
+        DDS_Security_SecurityException *ex);
+
+DDS_Security_boolean return_authenticated_peer_credential_token(
+        dds_security_authentication *instance,
+        const DDS_Security_AuthenticatedPeerCredentialToken *peer_credential_token,
+        DDS_Security_SecurityException *ex);
+
+DDS_Security_boolean
+return_handshake_handle(dds_security_authentication *instance,
+                        const DDS_Security_HandshakeHandle handshake_handle,
+                        DDS_Security_SecurityException *ex);
+DDS_Security_boolean
+return_identity_handle(
+        dds_security_authentication *instance,
+        const DDS_Security_IdentityHandle identity_handle,
+        DDS_Security_SecurityException *ex);
+
+DDS_Security_boolean return_sharedsecret_handle(
+        dds_security_authentication *instance,
+        const DDS_Security_SharedSecretHandle sharedsecret_handle,
+        DDS_Security_SecurityException *ex);
+
+
+
+#endif /* SECURITY_BUILTIN_PLUGINS_AUTHENTICATION_H_ */
diff --git a/src/security/core/tests/plugin_loading/plugin_mock/authentication_all_ok_other/mock_authentication.c b/src/security/core/tests/plugin_loading/plugin_mock/authentication_all_ok_other/mock_authentication.c
new file mode 100644
index 0000000..ff367c5
--- /dev/null
+++ b/src/security/core/tests/plugin_loading/plugin_mock/authentication_all_ok_other/mock_authentication.c
@@ -0,0 +1,353 @@
+/*
+ * Copyright(c) 2006 to 2019 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+
+#include "dds/security/dds_security_api.h"
+#include "dds/ddsrt/heap.h"
+#include "dds/ddsrt/misc.h"
+#include "dds/ddsrt/string.h"
+#include "mock_authentication.h"
+#include <stdio.h>
+#include <string.h>
+#include <stdbool.h>
+
+/**
+ * Implementation structure for storing encapsulated members of the instance
+ * while giving only the interface definition to user
+ */
+
+typedef struct dds_security_authentication_impl {
+  dds_security_authentication base;
+  int id; //sample internal member
+} dds_security_authentication_impl;
+
+DDS_Security_ValidationResult_t validate_local_identity(
+    dds_security_authentication *instance,
+     DDS_Security_IdentityHandle *local_identity_handle,
+     DDS_Security_GUID_t *adjusted_participant_guid,
+    const DDS_Security_DomainId domain_id,
+    const DDS_Security_Qos *participant_qos,
+    const DDS_Security_GUID_t *candidate_participant_guid,
+     DDS_Security_SecurityException *ex)
+{
+
+  DDSRT_UNUSED_ARG(local_identity_handle);
+  DDSRT_UNUSED_ARG(adjusted_participant_guid);
+  DDSRT_UNUSED_ARG(domain_id);
+  DDSRT_UNUSED_ARG(participant_qos);
+  DDSRT_UNUSED_ARG(candidate_participant_guid);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+
+  ex->message = ddsrt_strdup("Certificate expired");
+  ex->code = DDS_SECURITY_ERR_CERT_EXPIRED_CODE;
+  ex->minor_code = 0;
+
+  return DDS_SECURITY_VALIDATION_FAILED;
+}
+
+DDS_Security_boolean get_identity_token(dds_security_authentication *instance,
+     DDS_Security_IdentityToken *identity_token,
+    const DDS_Security_IdentityHandle handle,
+     DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(identity_token);
+  DDSRT_UNUSED_ARG(handle);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+
+  memset(identity_token, 0, sizeof(*identity_token));
+
+  return true;
+}
+
+DDS_Security_boolean get_identity_status_token(
+    dds_security_authentication *instance,
+     DDS_Security_IdentityStatusToken *identity_status_token,
+    const DDS_Security_IdentityHandle handle,
+     DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(identity_status_token);
+  DDSRT_UNUSED_ARG(handle);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+
+  return true;
+}
+
+DDS_Security_boolean set_permissions_credential_and_token(
+    dds_security_authentication *instance,
+    const DDS_Security_IdentityHandle handle,
+    const DDS_Security_PermissionsCredentialToken *permissions_credential,
+    const DDS_Security_PermissionsToken *permissions_token,
+     DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(handle);
+  DDSRT_UNUSED_ARG(permissions_credential);
+  DDSRT_UNUSED_ARG(permissions_token);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+
+  return true;
+}
+
+DDS_Security_ValidationResult_t validate_remote_identity(
+    dds_security_authentication *instance,
+     DDS_Security_IdentityHandle *remote_identity_handle,
+     DDS_Security_AuthRequestMessageToken *local_auth_request_token,
+    const DDS_Security_AuthRequestMessageToken *remote_auth_request_token,
+    const DDS_Security_IdentityHandle local_identity_handle,
+    const DDS_Security_IdentityToken *remote_identity_token,
+    const DDS_Security_GUID_t *remote_participant_guid,
+     DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(remote_identity_handle);
+  DDSRT_UNUSED_ARG(local_auth_request_token);
+  DDSRT_UNUSED_ARG(remote_auth_request_token);
+  DDSRT_UNUSED_ARG(local_identity_handle);
+  DDSRT_UNUSED_ARG(remote_identity_token);
+  DDSRT_UNUSED_ARG(remote_participant_guid);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+
+  return DDS_SECURITY_VALIDATION_OK;
+}
+
+DDS_Security_ValidationResult_t begin_handshake_request(
+    dds_security_authentication *instance,
+     DDS_Security_HandshakeHandle *handshake_handle,
+     DDS_Security_HandshakeMessageToken *handshake_message,
+    const DDS_Security_IdentityHandle initiator_identity_handle,
+    const DDS_Security_IdentityHandle replier_identity_handle,
+    const DDS_Security_OctetSeq *serialized_local_participant_data,
+     DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(handshake_handle);
+  DDSRT_UNUSED_ARG(handshake_message);
+  DDSRT_UNUSED_ARG(initiator_identity_handle);
+  DDSRT_UNUSED_ARG(replier_identity_handle);
+  DDSRT_UNUSED_ARG(serialized_local_participant_data);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+
+  return DDS_SECURITY_VALIDATION_OK;
+}
+
+DDS_Security_ValidationResult_t begin_handshake_reply(
+    dds_security_authentication *instance,
+     DDS_Security_HandshakeHandle *handshake_handle,
+     DDS_Security_HandshakeMessageToken *handshake_message_out,
+    const DDS_Security_HandshakeMessageToken *handshake_message_in,
+    const DDS_Security_IdentityHandle initiator_identity_handle,
+    const DDS_Security_IdentityHandle replier_identity_handle,
+    const DDS_Security_OctetSeq *serialized_local_participant_data,
+     DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(handshake_handle);
+  DDSRT_UNUSED_ARG(handshake_message_out);
+  DDSRT_UNUSED_ARG(handshake_message_in);
+  DDSRT_UNUSED_ARG(initiator_identity_handle);
+  DDSRT_UNUSED_ARG(replier_identity_handle);
+  DDSRT_UNUSED_ARG(serialized_local_participant_data);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+
+  return DDS_SECURITY_VALIDATION_OK;
+}
+
+DDS_Security_ValidationResult_t process_handshake(
+    dds_security_authentication *instance,
+     DDS_Security_HandshakeMessageToken *handshake_message_out,
+    const DDS_Security_HandshakeMessageToken *handshake_message_in,
+    const DDS_Security_HandshakeHandle handshake_handle,
+     DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(handshake_message_out);
+  DDSRT_UNUSED_ARG(handshake_message_in);
+  DDSRT_UNUSED_ARG(handshake_handle);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+
+  return DDS_SECURITY_VALIDATION_OK;
+}
+
+DDS_Security_SharedSecretHandle get_shared_secret(
+    dds_security_authentication *instance,
+    const DDS_Security_HandshakeHandle handshake_handle,
+     DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(handshake_handle);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+
+  return 0;
+}
+
+DDS_Security_boolean get_authenticated_peer_credential_token(
+    dds_security_authentication *instance,
+     DDS_Security_AuthenticatedPeerCredentialToken *peer_credential_token,
+    const DDS_Security_HandshakeHandle handshake_handle,
+     DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(peer_credential_token);
+  DDSRT_UNUSED_ARG(handshake_handle);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+
+  return true;
+}
+
+DDS_Security_boolean set_listener(dds_security_authentication *instance,
+    const dds_security_authentication_listener *listener,
+     DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(listener);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+
+  return true;
+}
+
+DDS_Security_boolean return_identity_token(dds_security_authentication *instance,
+    const DDS_Security_IdentityToken *token,
+     DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(token);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+
+  return true;
+}
+
+DDS_Security_boolean return_identity_status_token(
+    dds_security_authentication *instance,
+    const DDS_Security_IdentityStatusToken *token,
+     DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(token);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+
+  return true;
+}
+
+DDS_Security_boolean return_authenticated_peer_credential_token(
+    dds_security_authentication *instance,
+    const DDS_Security_AuthenticatedPeerCredentialToken *peer_credential_token,
+     DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(peer_credential_token);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+
+  return true;
+}
+
+DDS_Security_boolean return_handshake_handle(dds_security_authentication *instance,
+    const DDS_Security_HandshakeHandle handshake_handle,
+     DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(handshake_handle);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+
+  return true;
+}
+
+DDS_Security_boolean return_identity_handle(dds_security_authentication *instance,
+    const DDS_Security_IdentityHandle identity_handle,
+     DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(identity_handle);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+
+  return true;
+}
+
+DDS_Security_boolean return_sharedsecret_handle(
+    dds_security_authentication *instance,
+    const DDS_Security_SharedSecretHandle sharedsecret_handle,
+     DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(sharedsecret_handle);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+
+  return true;
+}
+
+int32_t init_authentication( const char *argument,  void **context)
+{
+
+  dds_security_authentication_impl *authentication;
+
+  DDSRT_UNUSED_ARG(argument);
+
+  //allocate implementation wrapper
+  authentication = (dds_security_authentication_impl*) ddsrt_malloc(
+      sizeof(dds_security_authentication_impl));
+  memset(authentication, 0, sizeof(dds_security_authentication_impl));
+
+  //assign the interface functions
+  authentication->base.validate_local_identity = &validate_local_identity;
+
+  authentication->base.get_identity_token = &get_identity_token;
+
+  authentication->base.get_identity_status_token = &get_identity_status_token;
+
+  authentication->base.set_permissions_credential_and_token =
+      &set_permissions_credential_and_token;
+
+  authentication->base.validate_remote_identity = &validate_remote_identity;
+
+  authentication->base.begin_handshake_request = &begin_handshake_request;
+
+  authentication->base.begin_handshake_reply = &begin_handshake_reply;
+
+  authentication->base.process_handshake = &process_handshake;
+
+  authentication->base.get_shared_secret = &get_shared_secret;
+
+  authentication->base.get_authenticated_peer_credential_token =
+      &get_authenticated_peer_credential_token;
+
+  authentication->base.set_listener = &set_listener;
+
+  authentication->base.return_identity_token = &return_identity_token;
+
+  authentication->base.return_identity_status_token =
+      &return_identity_status_token;
+
+  authentication->base.return_authenticated_peer_credential_token =
+      &return_authenticated_peer_credential_token;
+
+  authentication->base.return_handshake_handle = &return_handshake_handle;
+
+  authentication->base.return_identity_handle = &return_identity_handle;
+
+  authentication->base.return_sharedsecret_handle = &return_sharedsecret_handle;
+
+  //prepare implementation wrapper
+  authentication->id = 1;
+
+  //return the instance
+  *context = authentication;
+  return 0;
+}
+
+int32_t finalize_authentication(void *instance)
+{
+
+  ddsrt_free((dds_security_authentication_impl*) instance);
+
+  return 0;
+}
diff --git a/src/security/core/tests/plugin_loading/plugin_mock/authentication_all_ok_other/mock_authentication.h b/src/security/core/tests/plugin_loading/plugin_mock/authentication_all_ok_other/mock_authentication.h
new file mode 100644
index 0000000..c6a416f
--- /dev/null
+++ b/src/security/core/tests/plugin_loading/plugin_mock/authentication_all_ok_other/mock_authentication.h
@@ -0,0 +1,136 @@
+/*
+ * authentication.h
+ *
+ *  Created on: Jan 15, 2018
+ *      Author: kurtulus oksuztepe
+ */
+
+#ifndef SECURITY_BUILTIN_PLUGINS_AUTHENTICATION_H_
+#define SECURITY_BUILTIN_PLUGINS_AUTHENTICATION_H_
+
+#include "dds/security/authentication_all_ok_other_export.h"
+
+SECURITY_EXPORT int32_t
+init_authentication(const char *argument, void **context);
+
+SECURITY_EXPORT int32_t
+finalize_authentication(void *context);
+
+DDS_Security_ValidationResult_t
+validate_local_identity(
+        dds_security_authentication *instance,
+        DDS_Security_IdentityHandle *local_identity_handle,
+        DDS_Security_GUID_t *adjusted_participant_guid,
+        const DDS_Security_DomainId domain_id,
+        const DDS_Security_Qos *participant_qos,
+        const DDS_Security_GUID_t *candidate_participant_guid,
+
+        DDS_Security_SecurityException *ex);
+DDS_Security_boolean
+get_identity_token(dds_security_authentication *instance,
+                   DDS_Security_IdentityToken *identity_token,
+                   const DDS_Security_IdentityHandle handle,
+                   DDS_Security_SecurityException *ex);
+DDS_Security_boolean
+set_permissions_credential_and_token(
+        dds_security_authentication *instance,
+        const DDS_Security_IdentityHandle handle,
+        const DDS_Security_PermissionsCredentialToken *permissions_credential,
+        const DDS_Security_PermissionsToken *permissions_token,
+        DDS_Security_SecurityException *ex);
+
+DDS_Security_ValidationResult_t
+validate_remote_identity(
+        dds_security_authentication *instance,
+        DDS_Security_IdentityHandle *remote_identity_handle,
+        DDS_Security_AuthRequestMessageToken *local_auth_request_token,
+        const DDS_Security_AuthRequestMessageToken *remote_auth_request_token,
+        const DDS_Security_IdentityHandle local_identity_handle,
+        const DDS_Security_IdentityToken *remote_identity_token,
+        const DDS_Security_GUID_t *remote_participant_guid,
+        DDS_Security_SecurityException *ex);
+
+DDS_Security_ValidationResult_t
+begin_handshake_request(
+        dds_security_authentication *instance,
+        DDS_Security_HandshakeHandle *handshake_handle,
+        DDS_Security_HandshakeMessageToken *handshake_message,
+        const DDS_Security_IdentityHandle initiator_identity_handle,
+        const DDS_Security_IdentityHandle replier_identity_handle,
+        const DDS_Security_OctetSeq *serialized_local_participant_data,
+        DDS_Security_SecurityException *ex);
+
+DDS_Security_ValidationResult_t
+begin_handshake_reply(
+        dds_security_authentication *instance,
+        DDS_Security_HandshakeHandle *handshake_handle,
+        DDS_Security_HandshakeMessageToken *handshake_message_out,
+        const DDS_Security_HandshakeMessageToken *handshake_message_in,
+        const DDS_Security_IdentityHandle initiator_identity_handle,
+        const DDS_Security_IdentityHandle replier_identity_handle,
+        const DDS_Security_OctetSeq *serialized_local_participant_data,
+        DDS_Security_SecurityException *ex);
+
+DDS_Security_ValidationResult_t
+process_handshake(
+        dds_security_authentication *instance,
+        DDS_Security_HandshakeMessageToken *handshake_message_out,
+        const DDS_Security_HandshakeMessageToken *handshake_message_in,
+        const DDS_Security_HandshakeHandle handshake_handle,
+        DDS_Security_SecurityException *ex);
+
+DDS_Security_SharedSecretHandle get_shared_secret(
+        dds_security_authentication *instance,
+        const DDS_Security_HandshakeHandle handshake_handle,
+        DDS_Security_SecurityException *ex);
+
+DDS_Security_boolean
+get_authenticated_peer_credential_token(
+        dds_security_authentication *instance,
+        DDS_Security_AuthenticatedPeerCredentialToken *peer_credential_token,
+        const DDS_Security_HandshakeHandle handshake_handle,
+        DDS_Security_SecurityException *ex);
+
+
+DDS_Security_boolean get_identity_status_token(
+        dds_security_authentication *instance,
+        DDS_Security_IdentityStatusToken *identity_status_token,
+        const DDS_Security_IdentityHandle handle,
+        DDS_Security_SecurityException *ex);
+
+DDS_Security_boolean set_listener(dds_security_authentication *instance,
+                                  const dds_security_authentication_listener *listener,
+                                  DDS_Security_SecurityException *ex);
+
+DDS_Security_boolean return_identity_token(dds_security_authentication *instance,
+                                           const DDS_Security_IdentityToken *token,
+                                           DDS_Security_SecurityException *ex);
+
+DDS_Security_boolean return_identity_status_token(
+        dds_security_authentication *instance,
+        const DDS_Security_IdentityStatusToken *token,
+        DDS_Security_SecurityException *ex);
+
+DDS_Security_boolean return_authenticated_peer_credential_token(
+        dds_security_authentication *instance,
+        const DDS_Security_AuthenticatedPeerCredentialToken *peer_credential_token,
+        DDS_Security_SecurityException *ex);
+
+DDS_Security_boolean
+return_handshake_handle(dds_security_authentication *instance,
+                        const DDS_Security_HandshakeHandle handshake_handle,
+                        DDS_Security_SecurityException *ex);
+DDS_Security_boolean
+return_identity_handle(
+        dds_security_authentication *instance,
+        const DDS_Security_IdentityHandle identity_handle,
+        DDS_Security_SecurityException *ex);
+
+DDS_Security_boolean return_sharedsecret_handle(
+        dds_security_authentication *instance,
+        const DDS_Security_SharedSecretHandle sharedsecret_handle,
+        DDS_Security_SecurityException *ex);
+
+
+
+#endif /* SECURITY_BUILTIN_PLUGINS_AUTHENTICATION_H_ */
diff --git a/src/security/core/tests/plugin_loading/plugin_mock/authentication_finalize_error/mock_authentication.c b/src/security/core/tests/plugin_loading/plugin_mock/authentication_finalize_error/mock_authentication.c
new file mode 100644
index 0000000..a072b00
--- /dev/null
+++ b/src/security/core/tests/plugin_loading/plugin_mock/authentication_finalize_error/mock_authentication.c
@@ -0,0 +1,388 @@
+/*
+ * Copyright(c) 2006 to 2019 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+
+#include "dds/security/dds_security_api.h"
+#include "dds/ddsrt/heap.h"
+#include "dds/ddsrt/misc.h"
+#include "mock_authentication.h"
+#include <stdio.h>
+#include <string.h>
+#include <stdbool.h>
+
+/**
+ * Implementation structure for storing encapsulated members of the instance
+ * while giving only the interface definition to user
+ */
+
+typedef struct dds_security_authentication_impl {
+  dds_security_authentication base;
+  int id; //sample internal member
+} dds_security_authentication_impl;
+
+DDS_Security_ValidationResult_t validate_local_identity(
+     dds_security_authentication *instance,
+     DDS_Security_IdentityHandle *local_identity_handle,
+     DDS_Security_GUID_t *adjusted_participant_guid,
+     const DDS_Security_DomainId domain_id,
+     const DDS_Security_Qos *participant_qos,
+     const DDS_Security_GUID_t *candidate_participant_guid,
+     DDS_Security_SecurityException *ex)
+{
+
+  unsigned i;
+  DDS_Security_ValidationResult_t result=DDS_SECURITY_VALIDATION_OK;
+  dds_security_authentication_impl *implementation =
+      (dds_security_authentication_impl *) instance;
+  char *identity_ca=NULL;
+  char *identity_certificate=NULL;
+  char *private_key=NULL;
+
+  DDSRT_UNUSED_ARG(local_identity_handle);
+  DDSRT_UNUSED_ARG(adjusted_participant_guid);
+  DDSRT_UNUSED_ARG(domain_id);
+  DDSRT_UNUSED_ARG(participant_qos);
+  DDSRT_UNUSED_ARG(candidate_participant_guid);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+
+  implementation->id = 2;
+
+  for( i=0; i< participant_qos->property.value._length; i++)
+  {
+
+    printf("%s: %s",participant_qos->property.value._buffer[i].name, participant_qos->property.value._buffer[i].value);
+    if( strcmp(participant_qos->property.value._buffer[i].name, "dds.sec.auth.private_key") == 0)
+    {
+      private_key = participant_qos->property.value._buffer[i].value;
+    } else if( strcmp(participant_qos->property.value._buffer[i].name, "dds.sec.auth.identity_ca") == 0)
+    {
+      identity_ca = participant_qos->property.value._buffer[i].value;
+    } else if( strcmp(participant_qos->property.value._buffer[i].name, "dds.sec.auth.identity_certificate") == 0)
+    {
+      identity_certificate = participant_qos->property.value._buffer[i].value;
+    }
+  }
+
+  if( strcmp(identity_certificate, test_identity_certificate) != 0){
+
+    result = DDS_SECURITY_VALIDATION_FAILED;
+    printf("FAILED: Could not get identity_certificate value properly\n");
+  }
+  else if( strcmp(identity_ca, test_ca_certificate) != 0){
+    printf("FAILED: Could not get identity_ca value properly\n");
+    result = DDS_SECURITY_VALIDATION_FAILED;
+  }else if( strcmp(private_key, test_privatekey) != 0){
+    printf("FAILED: Could not get private_key value properly\n");
+    result = DDS_SECURITY_VALIDATION_FAILED;
+  }
+
+
+  return result;
+}
+
+DDS_Security_boolean get_identity_token( dds_security_authentication *instance,
+    DDS_Security_IdentityToken *identity_token,
+     const DDS_Security_IdentityHandle handle,
+    DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(identity_token);
+  DDSRT_UNUSED_ARG(handle);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+
+  memset(identity_token, 0, sizeof(*identity_token));
+
+  return true;
+}
+
+DDS_Security_boolean get_identity_status_token(
+     dds_security_authentication *instance,
+    DDS_Security_IdentityStatusToken *identity_status_token,
+     const DDS_Security_IdentityHandle handle,
+    DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(identity_status_token);
+  DDSRT_UNUSED_ARG(handle);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+
+  return true;
+}
+
+DDS_Security_boolean set_permissions_credential_and_token(
+     dds_security_authentication *instance,
+     const DDS_Security_IdentityHandle handle,
+     const DDS_Security_PermissionsCredentialToken *permissions_credential,
+     const DDS_Security_PermissionsToken *permissions_token,
+    DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(handle);
+  DDSRT_UNUSED_ARG(permissions_credential);
+  DDSRT_UNUSED_ARG(permissions_token);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+
+  return true;
+}
+
+DDS_Security_ValidationResult_t validate_remote_identity(
+     dds_security_authentication *instance,
+    DDS_Security_IdentityHandle *remote_identity_handle,
+    DDS_Security_AuthRequestMessageToken *local_auth_request_token,
+     const DDS_Security_AuthRequestMessageToken *remote_auth_request_token,
+     const DDS_Security_IdentityHandle local_identity_handle,
+     const DDS_Security_IdentityToken *remote_identity_token,
+     const DDS_Security_GUID_t *remote_participant_guid,
+    DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(remote_identity_handle);
+  DDSRT_UNUSED_ARG(local_auth_request_token);
+  DDSRT_UNUSED_ARG(remote_auth_request_token);
+  DDSRT_UNUSED_ARG(local_identity_handle);
+  DDSRT_UNUSED_ARG(remote_identity_token);
+  DDSRT_UNUSED_ARG(remote_participant_guid);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+
+  return DDS_SECURITY_VALIDATION_OK;
+}
+
+DDS_Security_ValidationResult_t begin_handshake_request(
+     dds_security_authentication *instance,
+    DDS_Security_HandshakeHandle *handshake_handle,
+    DDS_Security_HandshakeMessageToken *handshake_message,
+     const DDS_Security_IdentityHandle initiator_identity_handle,
+     const DDS_Security_IdentityHandle replier_identity_handle,
+     const DDS_Security_OctetSeq *serialized_local_participant_data,
+    DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(handshake_handle);
+  DDSRT_UNUSED_ARG(handshake_message);
+  DDSRT_UNUSED_ARG(initiator_identity_handle);
+  DDSRT_UNUSED_ARG(replier_identity_handle);
+  DDSRT_UNUSED_ARG(serialized_local_participant_data);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+
+  return DDS_SECURITY_VALIDATION_OK;
+}
+
+DDS_Security_ValidationResult_t begin_handshake_reply(
+     dds_security_authentication *instance,
+    DDS_Security_HandshakeHandle *handshake_handle,
+    DDS_Security_HandshakeMessageToken *handshake_message_out,
+     const DDS_Security_HandshakeMessageToken *handshake_message_in,
+     const DDS_Security_IdentityHandle initiator_identity_handle,
+     const DDS_Security_IdentityHandle replier_identity_handle,
+     const DDS_Security_OctetSeq *serialized_local_participant_data,
+    DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(handshake_handle);
+  DDSRT_UNUSED_ARG(handshake_message_out);
+  DDSRT_UNUSED_ARG(handshake_message_in);
+  DDSRT_UNUSED_ARG(initiator_identity_handle);
+  DDSRT_UNUSED_ARG(replier_identity_handle);
+  DDSRT_UNUSED_ARG(serialized_local_participant_data);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+
+  return DDS_SECURITY_VALIDATION_OK;
+}
+
+DDS_Security_ValidationResult_t process_handshake(
+     dds_security_authentication *instance,
+    DDS_Security_HandshakeMessageToken *handshake_message_out,
+     const DDS_Security_HandshakeMessageToken *handshake_message_in,
+     const DDS_Security_HandshakeHandle handshake_handle,
+    DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(handshake_message_out);
+  DDSRT_UNUSED_ARG(handshake_message_in);
+  DDSRT_UNUSED_ARG(handshake_handle);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+
+  return DDS_SECURITY_VALIDATION_OK;
+}
+
+DDS_Security_SharedSecretHandle get_shared_secret(
+     dds_security_authentication *instance,
+     const DDS_Security_HandshakeHandle handshake_handle,
+    DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(handshake_handle);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+
+  return 0;
+}
+
+DDS_Security_boolean get_authenticated_peer_credential_token(
+     dds_security_authentication *instance,
+    DDS_Security_AuthenticatedPeerCredentialToken *peer_credential_token,
+     const DDS_Security_HandshakeHandle handshake_handle,
+    DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(peer_credential_token);
+  DDSRT_UNUSED_ARG(handshake_handle);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+
+  return true;
+}
+
+DDS_Security_boolean set_listener( dds_security_authentication *instance,
+     const dds_security_authentication_listener *listener,
+    DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(listener);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+
+  return true;
+}
+
+DDS_Security_boolean return_identity_token( dds_security_authentication *instance,
+     const DDS_Security_IdentityToken *token,
+    DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(token);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+
+  return true;
+}
+
+DDS_Security_boolean return_identity_status_token(
+     dds_security_authentication *instance,
+     const DDS_Security_IdentityStatusToken *token,
+    DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(token);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+
+  return true;
+}
+
+DDS_Security_boolean return_authenticated_peer_credential_token(
+     dds_security_authentication *instance,
+     const DDS_Security_AuthenticatedPeerCredentialToken *peer_credential_token,
+    DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(peer_credential_token);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+
+  return true;
+}
+
+DDS_Security_boolean return_handshake_handle( dds_security_authentication *instance,
+     const DDS_Security_HandshakeHandle handshake_handle,
+    DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(handshake_handle);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+
+  return true;
+}
+
+DDS_Security_boolean return_identity_handle( dds_security_authentication *instance,
+     const DDS_Security_IdentityHandle identity_handle,
+    DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(identity_handle);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+
+  return true;
+}
+
+DDS_Security_boolean return_sharedsecret_handle(
+     dds_security_authentication *instance,
+     const DDS_Security_SharedSecretHandle sharedsecret_handle,
+    DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(sharedsecret_handle);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+
+  return true;
+}
+
+int32_t init_authentication(  const char *argument, void **context)
+{
+
+  dds_security_authentication_impl *authentication;
+  DDSRT_UNUSED_ARG(argument);
+
+  //allocate implementation wrapper
+  authentication = (dds_security_authentication_impl*) ddsrt_malloc(
+      sizeof(dds_security_authentication_impl));
+  memset(authentication, 0, sizeof(dds_security_authentication_impl));
+
+  //assign the interface functions
+  authentication->base.validate_local_identity = &validate_local_identity;
+
+  authentication->base.get_identity_token = &get_identity_token;
+
+  authentication->base.get_identity_status_token = &get_identity_status_token;
+
+  authentication->base.set_permissions_credential_and_token =
+      &set_permissions_credential_and_token;
+
+  authentication->base.validate_remote_identity = &validate_remote_identity;
+
+  authentication->base.begin_handshake_request = &begin_handshake_request;
+
+  authentication->base.begin_handshake_reply = &begin_handshake_reply;
+
+  authentication->base.process_handshake = &process_handshake;
+
+  authentication->base.get_shared_secret = &get_shared_secret;
+
+  authentication->base.get_authenticated_peer_credential_token =
+      &get_authenticated_peer_credential_token;
+
+  authentication->base.set_listener = &set_listener;
+
+  authentication->base.return_identity_token = &return_identity_token;
+
+  authentication->base.return_identity_status_token =
+      &return_identity_status_token;
+
+  authentication->base.return_authenticated_peer_credential_token =
+      &return_authenticated_peer_credential_token;
+
+  authentication->base.return_handshake_handle = &return_handshake_handle;
+
+  authentication->base.return_identity_handle = &return_identity_handle;
+
+  authentication->base.return_sharedsecret_handle = &return_sharedsecret_handle;
+
+  //prepare implementation wrapper
+  authentication->id = 1;
+
+  //return the instance
+  *context = authentication;
+  return 0;
+}
+
+/* wrong finalize function name for test purposes */
+int32_t finalize_authentication_WRONG_NAME( void *instance)
+{
+
+  ddsrt_free((dds_security_authentication_impl*) instance);
+
+  return 0;
+}
diff --git a/src/security/core/tests/plugin_loading/plugin_mock/authentication_finalize_error/mock_authentication.h b/src/security/core/tests/plugin_loading/plugin_mock/authentication_finalize_error/mock_authentication.h
new file mode 100644
index 0000000..d7c0e09
--- /dev/null
+++ b/src/security/core/tests/plugin_loading/plugin_mock/authentication_finalize_error/mock_authentication.h
@@ -0,0 +1,264 @@
+/*
+ * authentication.h
+ *
+ *  Created on: Jan 15, 2018
+ *      Author: kurtulus oksuztepe
+ */
+
+#ifndef SECURITY_BUILTIN_PLUGINS_AUTHENTICATION_H_
+#define SECURITY_BUILTIN_PLUGINS_AUTHENTICATION_H_
+
+
+#include "dds/security/authentication_finalize_error_export.h"
+
+SECURITY_EXPORT int32_t
+init_authentication(const char *argument, void **context);
+
+SECURITY_EXPORT int32_t
+finalize_authentication_WRONG_NAME(void *context);
+
+char *test_identity_certificate="data:,-----BEGIN CERTIFICATE-----\n\
+MIIGJzCCBA+gAwIBAgIBATANBgkqhkiG9w0BAQUFADCBsjELMAkGA1UEBhMCRlIx\n\
+DzANBgNVBAgMBkFsc2FjZTETMBEGA1UEBwwKU3RyYXNib3VyZzEYMBYGA1UECgwP\n\
+d3d3LmZyZWVsYW4ub3JnMRAwDgYDVQQLDAdmcmVlbGFuMS0wKwYDVQQDDCRGcmVl\n\
+bGFuIFNhbXBsZSBDZXJ0aWZpY2F0ZSBBdXRob3JpdHkxIjAgBgkqhkiG9w0BCQEW\n\
+E2NvbnRhY3RAZnJlZWxhbi5vcmcwHhcNMTIwNDI3MTAzMTE4WhcNMjIwNDI1MTAz\n\
+MTE4WjB+MQswCQYDVQQGEwJGUjEPMA0GA1UECAwGQWxzYWNlMRgwFgYDVQQKDA93\n\
+d3cuZnJlZWxhbi5vcmcxEDAOBgNVBAsMB2ZyZWVsYW4xDjAMBgNVBAMMBWFsaWNl\n\
+MSIwIAYJKoZIhvcNAQkBFhNjb250YWN0QGZyZWVsYW4ub3JnMIICIjANBgkqhkiG\n\
+9w0BAQEFAAOCAg8AMIICCgKCAgEA3W29+ID6194bH6ejLrIC4hb2Ugo8v6ZC+Mrc\n\
+k2dNYMNPjcOKABvxxEtBamnSaeU/IY7FC/giN622LEtV/3oDcrua0+yWuVafyxmZ\n\
+yTKUb4/GUgafRQPf/eiX9urWurtIK7XgNGFNUjYPq4dSJQPPhwCHE/LKAykWnZBX\n\
+RrX0Dq4XyApNku0IpjIjEXH+8ixE12wH8wt7DEvdO7T3N3CfUbaITl1qBX+Nm2Z6\n\
+q4Ag/u5rl8NJfXg71ZmXA3XOj7zFvpyapRIZcPmkvZYn7SMCp8dXyXHPdpSiIWL2\n\
+uB3KiO4JrUYvt2GzLBUThp+lNSZaZ/Q3yOaAAUkOx+1h08285Pi+P8lO+H2Xic4S\n\
+vMq1xtLg2bNoPC5KnbRfuFPuUD2/3dSiiragJ6uYDLOyWJDivKGt/72OVTEPAL9o\n\
+6T2pGZrwbQuiFGrGTMZOvWMSpQtNl+tCCXlT4mWqJDRwuMGrI4DnnGzt3IKqNwS4\n\
+Qyo9KqjMIPwnXZAmWPm3FOKe4sFwc5fpawKO01JZewDsYTDxVj+cwXwFxbE2yBiF\n\
+z2FAHwfopwaH35p3C6lkcgP2k/zgAlnBluzACUI+MKJ/G0gv/uAhj1OHJQ3L6kn1\n\
+SpvQ41/ueBjlunExqQSYD7GtZ1Kg8uOcq2r+WISE3Qc9MpQFFkUVllmgWGwYDuN3\n\
+Zsez95kCAwEAAaN7MHkwCQYDVR0TBAIwADAsBglghkgBhvhCAQ0EHxYdT3BlblNT\n\
+TCBHZW5lcmF0ZWQgQ2VydGlmaWNhdGUwHQYDVR0OBBYEFFlfyRO6G8y5qEFKikl5\n\
+ajb2fT7XMB8GA1UdIwQYMBaAFCNsLT0+KV14uGw+quK7Lh5sh/JTMA0GCSqGSIb3\n\
+DQEBBQUAA4ICAQAT5wJFPqervbja5+90iKxi1d0QVtVGB+z6aoAMuWK+qgi0vgvr\n\
+mu9ot2lvTSCSnRhjeiP0SIdqFMORmBtOCFk/kYDp9M/91b+vS+S9eAlxrNCB5VOf\n\
+PqxEPp/wv1rBcE4GBO/c6HcFon3F+oBYCsUQbZDKSSZxhDm3mj7pb67FNbZbJIzJ\n\
+70HDsRe2O04oiTx+h6g6pW3cOQMgIAvFgKN5Ex727K4230B0NIdGkzuj4KSML0NM\n\
+slSAcXZ41OoSKNjy44BVEZv0ZdxTDrRM4EwJtNyggFzmtTuV02nkUj1bYYYC5f0L\n\
+ADr6s0XMyaNk8twlWYlYDZ5uKDpVRVBfiGcq0uJIzIvemhuTrofh8pBQQNkPRDFT\n\
+Rq1iTo1Ihhl3/Fl1kXk1WR3jTjNb4jHX7lIoXwpwp767HAPKGhjQ9cFbnHMEtkro\n\
+RlJYdtRq5mccDtwT0GFyoJLLBZdHHMHJz0F9H7FNk2tTQQMhK5MVYwg+LIaee586\n\
+CQVqfbscp7evlgjLW98H+5zylRHAgoH2G79aHljNKMp9BOuq6SnEglEsiWGVtu2l\n\
+hnx8SB3sVJZHeer8f/UQQwqbAO+Kdy70NmbSaqaVtp8jOxLiidWkwSyRTsuU6D8i\n\
+DiH5uEqBXExjrj0FslxcVKdVj5glVcSmkLwZKbEU1OKwleT/iXFhvooWhQ==\n\
+-----END CERTIFICATE-----";
+
+char *test_ca_certificate="data:,-----BEGIN CERTIFICATE-----\n\
+MIIGOTCCBCGgAwIBAgIJAOE/vJd8EB24MA0GCSqGSIb3DQEBBQUAMIGyMQswCQYD\n\
+VQQGEwJGUjEPMA0GA1UECAwGQWxzYWNlMRMwEQYDVQQHDApTdHJhc2JvdXJnMRgw\n\
+FgYDVQQKDA93d3cuZnJlZWxhbi5vcmcxEDAOBgNVBAsMB2ZyZWVsYW4xLTArBgNV\n\
+BAMMJEZyZWVsYW4gU2FtcGxlIENlcnRpZmljYXRlIEF1dGhvcml0eTEiMCAGCSqG\n\
+SIb3DQEJARYTY29udGFjdEBmcmVlbGFuLm9yZzAeFw0xMjA0MjcxMDE3NDRaFw0x\n\
+MjA1MjcxMDE3NDRaMIGyMQswCQYDVQQGEwJGUjEPMA0GA1UECAwGQWxzYWNlMRMw\n\
+EQYDVQQHDApTdHJhc2JvdXJnMRgwFgYDVQQKDA93d3cuZnJlZWxhbi5vcmcxEDAO\n\
+BgNVBAsMB2ZyZWVsYW4xLTArBgNVBAMMJEZyZWVsYW4gU2FtcGxlIENlcnRpZmlj\n\
+YXRlIEF1dGhvcml0eTEiMCAGCSqGSIb3DQEJARYTY29udGFjdEBmcmVlbGFuLm9y\n\
+ZzCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAODp+8oQcK+MTuWPZVxJ\n\
+ZR75paK4zcUngupYXWSGWFXPTV7vssFk6vInePArTL+T9KwHfiZ29Pp3UbzDlysY\n\
+Kz9f9Ae50jGD6xVPwXgQ/VI979GyFXzhiEMtSYykF04tBJiDl2/FZxbHPpNxC39t\n\
+14kwuDqBin9N/ZbT5+45tbbS8ziXS+QgL5hD2q2eYCWayrGEt1Y+jDAdHDHmGnZ8\n\
+d4hbgILJAs3IInOCDjC4c1gwHFb8G4QHHTwVhjhqpkq2hQHgzWBC1l2Dku/oDYev\n\
+Zu/pfpTo3z6+NOYBrUWseQmIuG+DGMQA9KOuSQveyTywBm4G4vZKn0sCu1/v2+9T\n\
+BGv41tgS/Yf6oeeQVrbS4RFY1r9qTK6DW9wkTTesa4xoDKQrWjSJ7+aa8tvBXLGX\n\
+x2xdRNWLeRMuGBSOihwXmDr+rCJRauT7pItN5X+uWNTX1ofNksQSUMaFJ5K7L0LU\n\
+iQqU2Yyt/8UphdVZL4EFkGSA13UDWtb9mM1hY0h65LlSYwCchEphrtI9cuV+ITrS\n\
+NcN6cP/dqDx1/jWd6dqjNu7+dugwX5elQS9uUYCFmugR5s1m2eeBg3QuC7gZLE0N\n\
+NbgS7oSxKJe9KeOcw68jHWfBKsCfBfQ4fU2t/ntMybT3hCdEMQu4dgM5Tyw/UeFq\n\
+0SaJyTl+G1bTzS0FW6uUp6NLAgMBAAGjUDBOMB0GA1UdDgQWBBQjbC09PildeLhs\n\
+Pqriuy4ebIfyUzAfBgNVHSMEGDAWgBQjbC09PildeLhsPqriuy4ebIfyUzAMBgNV\n\
+HRMEBTADAQH/MA0GCSqGSIb3DQEBBQUAA4ICAQCwRJpJCgp7S+k9BT6X3kBefonE\n\
+EOYtyWXBPpuyG3Qlm1rdhc66DCGForDmTxjMmHYtNmAVnM37ILW7MoflWrAkaY19\n\
+gv88Fzwa5e6rWK4fTSpiEOc5WB2A3HPN9wJnhQXt1WWMDD7jJSLxLIwFqkzpDbDE\n\
+9122TtnIbmKNv0UQpzPV3Ygbqojy6eZHUOT05NaOT7vviv5QwMAH5WeRfiCys8CG\n\
+Sno/o830OniEHvePTYswLlX22LyfSHeoTQCCI8pocytl7IwARKCvBgeFqvPrMiqP\n\
+ch16FiU9II8KaMgpebrUSz3J1BApOOd1LBd42BeTAkNSxjRvbh8/lDWfnE7ODbKc\n\
+b6Ad3V9flFb5OBZH4aTi6QfrDnBmbLgLL8o/MLM+d3Kg94XRU9LjC2rjivQ6MC53\n\
+EnWNobcJFY+soXsJokGtFxKgIx8XrhF5GOsT2f1pmMlYL4cjlU0uWkPOOkhq8tIp\n\
+R8cBYphzXu1v6h2AaZLRq184e30ZO98omKyQoQ2KAm5AZayRrZZtjvEZPNamSuVQ\n\
+iPe3o/4tyQGq+jEMAEjLlDECu0dEa6RFntcbBPMBP3wZwE2bI9GYgvyaZd63DNdm\n\
+Xd65m0mmfOWYttfrDT3Q95YP54nHpIxKBw1eFOzrnXOqbKVmJ/1FDP2yWeooKVLf\n\
+KvbxUcDaVvXB0EU0bg==\n\
+-----END CERTIFICATE-----";
+
+char *test_privatekey = "data:,-----BEGIN RSA PRIVATE KEY-----\n\
+MIIJKQIBAAKCAgEA3W29+ID6194bH6ejLrIC4hb2Ugo8v6ZC+Mrck2dNYMNPjcOK\n\
+ABvxxEtBamnSaeU/IY7FC/giN622LEtV/3oDcrua0+yWuVafyxmZyTKUb4/GUgaf\n\
+RQPf/eiX9urWurtIK7XgNGFNUjYPq4dSJQPPhwCHE/LKAykWnZBXRrX0Dq4XyApN\n\
+ku0IpjIjEXH+8ixE12wH8wt7DEvdO7T3N3CfUbaITl1qBX+Nm2Z6q4Ag/u5rl8NJ\n\
+fXg71ZmXA3XOj7zFvpyapRIZcPmkvZYn7SMCp8dXyXHPdpSiIWL2uB3KiO4JrUYv\n\
+t2GzLBUThp+lNSZaZ/Q3yOaAAUkOx+1h08285Pi+P8lO+H2Xic4SvMq1xtLg2bNo\n\
+PC5KnbRfuFPuUD2/3dSiiragJ6uYDLOyWJDivKGt/72OVTEPAL9o6T2pGZrwbQui\n\
+FGrGTMZOvWMSpQtNl+tCCXlT4mWqJDRwuMGrI4DnnGzt3IKqNwS4Qyo9KqjMIPwn\n\
+XZAmWPm3FOKe4sFwc5fpawKO01JZewDsYTDxVj+cwXwFxbE2yBiFz2FAHwfopwaH\n\
+35p3C6lkcgP2k/zgAlnBluzACUI+MKJ/G0gv/uAhj1OHJQ3L6kn1SpvQ41/ueBjl\n\
+unExqQSYD7GtZ1Kg8uOcq2r+WISE3Qc9MpQFFkUVllmgWGwYDuN3Zsez95kCAwEA\n\
+AQKCAgBymEHxouau4z6MUlisaOn/Ej0mVi/8S1JrqakgDB1Kj6nTRzhbOBsWKJBR\n\
+PzTrIv5aIqYtvJwQzrDyGYcHMaEpNpg5Rz716jPGi5hAPRH+7pyHhO/Watv4bvB+\n\
+lCjO+O+v12+SDC1U96+CaQUFLQSw7H/7vfH4UsJmhvX0HWSSWFzsZRCiklOgl1/4\n\
+vlNgB7MU/c7bZLyor3ZuWQh8Q6fgRSQj0kp1T/78RrwDl8r7xG4gW6vj6F6m+9bg\n\
+ro5Zayu3qxqJhWVvR3OPvm8pVa4hIJR5J5Jj3yZNOwdOX/Saiv6tEx7MvB5bGQlC\n\
+6co5SIEPPZ/FNC1Y/PNOWrb/Q4GW1AScdICZu7wIkKzWAJCo59A8Luv5FV8vm4R2\n\
+4JkyB6kXcVfowrjYXqDF/UX0ddDLLGF96ZStte3PXX8PQWY89FZuBkGw6NRZInHi\n\
+xinN2V8cm7Cw85d9Ez2zEGB4KC7LI+JgLQtdg3XvbdfhOi06eGjgK2mwfOqT8Sq+\n\
+v9POIJXTNEI3fi3dB86af/8OXRtOrAa1mik2msDI1Goi7cKQbC3fz/p1ISQCptvs\n\
+YvNwstDDutkA9o9araQy5b0LC6w5k+CSdVNbd8O2EUd0OBOUjblHKvdZ3Voz8EDF\n\
+ywYimmNGje1lK8nh2ndpja5q3ipDs1hKg5UujoGfei2gn0ch5QKCAQEA8O+IHOOu\n\
+T/lUgWspophE0Y1aUJQPqgK3EiKB84apwLfz2eAPSBff2dCN7Xp6s//u0fo41LE5\n\
+P0ds/5eu9PDlNF6HH5H3OYpV/57v5O2OSBQdB/+3TmNmQGYJCSzouIS3YNOUPQ1z\n\
+FFvRateN91BW7wKFHr0+M4zG6ezfutAQywWNoce7oGaYTT8z/yWXqmFidDqng5w5\n\
+6d8t40ScozIVacGug+lRi8lbTC+3Tp0r+la66h49upged3hFOvGXIOybvYcE98K2\n\
+GpNl9cc4q6O1WLdR7QC91ZNflKOKE8fALLZ/stEXL0p2bixbSnbIdxOEUch/iQhM\n\
+chxlsRFLjxV1dwKCAQEA60X6LyefIlXzU3PA+gIRYV0g8FOxzxXfvqvYeyOGwDaa\n\
+p/Ex50z76jIJK8wlW5Ei7U6xsxxw3E9DLH7Sf3H4KiGouBVIdcv9+IR0LcdYPR9V\n\
+oCQ1Mm5a7fjnm/FJwTokdgWGSwmFTH7/jGcNHZ8lumlRFCj6VcLT/nRxM6dgIXSo\n\
+w1D9QGC9V+e6KOZ6VR5xK0h8pOtkqoGrbFLu26GPBSuguPJXt0fwJt9PAG+6VvxJ\n\
+89NLML/n+g2/jVKXhfTT1Mbb3Fx4lnbLnkP+JrvYIaoQ1PZNggILYCUGJJTLtqOT\n\
+gkg1S41/X8EFg671kAB6ZYPbd5WnL14Xp0a9MOB/bwKCAQEA6WVAl6u/al1/jTdA\n\
+R+/1ioHB4Zjsa6bhrUGcXUowGy6XnJG+e/oUsS2kr04cm03sDaC1eOSNLk2Euzw3\n\
+EbRidI61mtGNikIF+PAAN+YgFJbXYK5I5jjIDs5JJohIkKaP9c5AJbxnpGslvLg/\n\
+IDrFXBc22YY9QTa4YldCi/eOrP0eLIANs95u3zXAqwPBnh1kgG9pYsbuGy5Fh4kp\n\
+q7WSpLYo1kQo6J8QQAdhLVh4B7QIsU7GQYGm0djCR81Mt2o9nCW1nEUUnz32YVay\n\
+ASM/Q0eip1I2kzSGPLkHww2XjjjkD1cZfIhHnYZ+kO3sV92iKo9tbFOLqmbz48l7\n\
+RoplFQKCAQEA6i+DcoCL5A+N3tlvkuuQBUw/xzhn2uu5BP/kwd2A+b7gfp6Uv9lf\n\
+P6SCgHf6D4UOMQyN0O1UYdb71ESAnp8BGF7cpC97KtXcfQzK3+53JJAWGQsxcHts\n\
+Q0foss6gTZfkRx4EqJhXeOdI06aX5Y5ObZj7PYf0dn0xqyyYqYPHKkYG3jO1gelJ\n\
+T0C3ipKv3h4pI55Jg5dTYm0kBvUeELxlsg3VM4L2UNdocikBaDvOTVte+Taut12u\n\
+OLaKns9BR/OFD1zJ6DSbS5n/4A9p4YBFCG1Rx8lLKUeDrzXrQWpiw+9amunpMsUr\n\
+rlJhfMwgXjA7pOR1BjmOapXMEZNWKlqsPQKCAQByVDxIwMQczUFwQMXcu2IbA3Z8\n\
+Czhf66+vQWh+hLRzQOY4hPBNceUiekpHRLwdHaxSlDTqB7VPq+2gSkVrCX8/XTFb\n\
+SeVHTYE7iy0Ckyme+2xcmsl/DiUHfEy+XNcDgOutS5MnWXANqMQEoaLW+NPLI3Lu\n\
+V1sCMYTd7HN9tw7whqLg18wB1zomSMVGT4DkkmAzq4zSKI1FNYp8KA3OE1Emwq+0\n\
+wRsQuawQVLCUEP3To6kYOwTzJq7jhiUK6FnjLjeTrNQSVdoqwoJrlTAHgXVV3q7q\n\
+v3TGd3xXD9yQIjmugNgxNiwAZzhJs/ZJy++fPSJ1XQxbd9qPghgGoe/ff6G7\n\
+-----END RSA PRIVATE KEY-----";
+
+
+
+DDS_Security_ValidationResult_t
+validate_local_identity(
+        dds_security_authentication *instance,
+        DDS_Security_IdentityHandle *local_identity_handle,
+        DDS_Security_GUID_t *adjusted_participant_guid,
+        const DDS_Security_DomainId domain_id,
+        const DDS_Security_Qos *participant_qos,
+        const DDS_Security_GUID_t *candidate_participant_guid,
+
+        DDS_Security_SecurityException *ex);
+DDS_Security_boolean
+get_identity_token(dds_security_authentication *instance,
+                   DDS_Security_IdentityToken *identity_token,
+                   const DDS_Security_IdentityHandle handle,
+                   DDS_Security_SecurityException *ex);
+DDS_Security_boolean
+set_permissions_credential_and_token(
+        dds_security_authentication *instance,
+        const DDS_Security_IdentityHandle handle,
+        const DDS_Security_PermissionsCredentialToken *permissions_credential,
+        const DDS_Security_PermissionsToken *permissions_token,
+        DDS_Security_SecurityException *ex);
+
+DDS_Security_ValidationResult_t
+validate_remote_identity(
+        dds_security_authentication *instance,
+        DDS_Security_IdentityHandle *remote_identity_handle,
+        DDS_Security_AuthRequestMessageToken *local_auth_request_token,
+        const DDS_Security_AuthRequestMessageToken *remote_auth_request_token,
+        const DDS_Security_IdentityHandle local_identity_handle,
+        const DDS_Security_IdentityToken *remote_identity_token,
+        const DDS_Security_GUID_t *remote_participant_guid,
+        DDS_Security_SecurityException *ex);
+
+DDS_Security_ValidationResult_t
+begin_handshake_request(
+        dds_security_authentication *instance,
+        DDS_Security_HandshakeHandle *handshake_handle,
+        DDS_Security_HandshakeMessageToken *handshake_message,
+        const DDS_Security_IdentityHandle initiator_identity_handle,
+        const DDS_Security_IdentityHandle replier_identity_handle,
+        const DDS_Security_OctetSeq *serialized_local_participant_data,
+        DDS_Security_SecurityException *ex);
+
+DDS_Security_ValidationResult_t
+begin_handshake_reply(
+        dds_security_authentication *instance,
+        DDS_Security_HandshakeHandle *handshake_handle,
+        DDS_Security_HandshakeMessageToken *handshake_message_out,
+        const DDS_Security_HandshakeMessageToken *handshake_message_in,
+        const DDS_Security_IdentityHandle initiator_identity_handle,
+        const DDS_Security_IdentityHandle replier_identity_handle,
+        const DDS_Security_OctetSeq *serialized_local_participant_data,
+        DDS_Security_SecurityException *ex);
+
+DDS_Security_ValidationResult_t
+process_handshake(
+        dds_security_authentication *instance,
+        DDS_Security_HandshakeMessageToken *handshake_message_out,
+        const DDS_Security_HandshakeMessageToken *handshake_message_in,
+        const DDS_Security_HandshakeHandle handshake_handle,
+        DDS_Security_SecurityException *ex);
+
+DDS_Security_SharedSecretHandle get_shared_secret(
+        dds_security_authentication *instance,
+        const DDS_Security_HandshakeHandle handshake_handle,
+        DDS_Security_SecurityException *ex);
+
+DDS_Security_boolean
+get_authenticated_peer_credential_token(
+        dds_security_authentication *instance,
+        DDS_Security_AuthenticatedPeerCredentialToken *peer_credential_token,
+        const DDS_Security_HandshakeHandle handshake_handle,
+        DDS_Security_SecurityException *ex);
+
+
+DDS_Security_boolean get_identity_status_token(
+        dds_security_authentication *instance,
+        DDS_Security_IdentityStatusToken *identity_status_token,
+        const DDS_Security_IdentityHandle handle,
+        DDS_Security_SecurityException *ex);
+
+DDS_Security_boolean set_listener(dds_security_authentication *instance,
+                                  const dds_security_authentication_listener *listener,
+                                  DDS_Security_SecurityException *ex);
+
+DDS_Security_boolean return_identity_token(dds_security_authentication *instance,
+                                           const DDS_Security_IdentityToken *token,
+                                           DDS_Security_SecurityException *ex);
+
+DDS_Security_boolean return_identity_status_token(
+        dds_security_authentication *instance,
+        const DDS_Security_IdentityStatusToken *token,
+        DDS_Security_SecurityException *ex);
+
+DDS_Security_boolean return_authenticated_peer_credential_token(
+        dds_security_authentication *instance,
+        const DDS_Security_AuthenticatedPeerCredentialToken *peer_credential_token,
+        DDS_Security_SecurityException *ex);
+
+DDS_Security_boolean
+return_handshake_handle(dds_security_authentication *instance,
+                        const DDS_Security_HandshakeHandle handshake_handle,
+                        DDS_Security_SecurityException *ex);
+DDS_Security_boolean
+return_identity_handle(
+        dds_security_authentication *instance,
+        const DDS_Security_IdentityHandle identity_handle,
+        DDS_Security_SecurityException *ex);
+
+DDS_Security_boolean return_sharedsecret_handle(
+        dds_security_authentication *instance,
+        const DDS_Security_SharedSecretHandle sharedsecret_handle,
+        DDS_Security_SecurityException *ex);
+
+
+
+#endif /* SECURITY_BUILTIN_PLUGINS_AUTHENTICATION_H_ */
diff --git a/src/security/core/tests/plugin_loading/plugin_mock/authentication_init_error/mock_authentication.c b/src/security/core/tests/plugin_loading/plugin_mock/authentication_init_error/mock_authentication.c
new file mode 100644
index 0000000..d42e4f5
--- /dev/null
+++ b/src/security/core/tests/plugin_loading/plugin_mock/authentication_init_error/mock_authentication.c
@@ -0,0 +1,347 @@
+/*
+ * Copyright(c) 2006 to 2019 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+
+#include "dds/security/dds_security_api.h"
+#include "dds/ddsrt/heap.h"
+#include "dds/ddsrt/misc.h"
+#include "mock_authentication.h"
+#include <stdio.h>
+#include <string.h>
+#include <stdbool.h>
+
+/**
+ * Implementation structure for storing encapsulated members of the instance
+ * while giving only the interface definition to user
+ */
+
+typedef struct dds_security_authentication_impl {
+  dds_security_authentication base;
+  int id; //sample internal member
+} dds_security_authentication_impl;
+
+DDS_Security_ValidationResult_t validate_local_identity(
+    dds_security_authentication *instance,
+     DDS_Security_IdentityHandle *local_identity_handle,
+     DDS_Security_GUID_t *adjusted_participant_guid,
+    const DDS_Security_DomainId domain_id,
+    const DDS_Security_Qos *participant_qos,
+    const DDS_Security_GUID_t *candidate_participant_guid,
+     DDS_Security_SecurityException *ex)
+{
+
+  unsigned i;
+  DDS_Security_ValidationResult_t result=DDS_SECURITY_VALIDATION_OK;
+  dds_security_authentication_impl *implementation =
+      (dds_security_authentication_impl *) instance;
+  char *identity_ca = NULL;
+  char *identity_certificate = NULL;
+  char *private_key = NULL;
+
+  DDSRT_UNUSED_ARG(local_identity_handle);
+  DDSRT_UNUSED_ARG(adjusted_participant_guid);
+  DDSRT_UNUSED_ARG(domain_id);
+  DDSRT_UNUSED_ARG(participant_qos);
+  DDSRT_UNUSED_ARG(candidate_participant_guid);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+
+  implementation->id = 2;
+
+  memcpy(adjusted_participant_guid, candidate_participant_guid, sizeof(DDS_Security_GUID_t));
+
+  for( i=0; i< participant_qos->property.value._length; i++)
+  {
+
+    //printf("%s: %s",participant_qos->property.value._buffer[i].name, participant_qos->property.value._buffer[i].value);
+    printf("%s\n",participant_qos->property.value._buffer[i].name);
+    if( strcmp(participant_qos->property.value._buffer[i].name, "dds.sec.auth.private_key") == 0)
+    {
+      private_key = participant_qos->property.value._buffer[i].value;
+    } else if( strcmp(participant_qos->property.value._buffer[i].name, "dds.sec.auth.identity_ca") == 0)
+    {
+      identity_ca = participant_qos->property.value._buffer[i].value;
+    } else if( strcmp(participant_qos->property.value._buffer[i].name, "dds.sec.auth.identity_certificate") == 0)
+    {
+      identity_certificate = participant_qos->property.value._buffer[i].value;
+    }
+  }
+
+  if( strcmp(identity_certificate, test_identity_certificate) != 0){
+
+    result = DDS_SECURITY_VALIDATION_FAILED;
+    printf("FAILED: Could not get identity_certificate value properly\n");
+  }
+  else if( strcmp(identity_ca, test_ca_certificate) != 0){
+    printf("FAILED: Could not get identity_ca value properly\n");
+    result = DDS_SECURITY_VALIDATION_FAILED;
+  }else if( strcmp(private_key, test_privatekey) != 0){
+    printf("FAILED: Could not get private_key value properly\n");
+    result = DDS_SECURITY_VALIDATION_FAILED;
+  }
+
+  if( result == DDS_SECURITY_VALIDATION_OK )
+  {
+    printf("DDS_SECURITY_VALIDATION_OK\n");
+  }
+
+
+  return result;
+}
+
+DDS_Security_boolean get_identity_token(dds_security_authentication *instance,
+     DDS_Security_IdentityToken *identity_token,
+    const DDS_Security_IdentityHandle handle,
+     DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(identity_token);
+  DDSRT_UNUSED_ARG(handle);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+
+  memset(identity_token, 0, sizeof(*identity_token));
+
+  return true;
+}
+
+DDS_Security_boolean get_identity_status_token(
+    dds_security_authentication *instance,
+     DDS_Security_IdentityStatusToken *identity_status_token,
+    const DDS_Security_IdentityHandle handle,
+     DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(identity_status_token);
+  DDSRT_UNUSED_ARG(handle);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+
+  return true;
+}
+
+DDS_Security_boolean set_permissions_credential_and_token(
+    dds_security_authentication *instance,
+    const DDS_Security_IdentityHandle handle,
+    const DDS_Security_PermissionsCredentialToken *permissions_credential,
+    const DDS_Security_PermissionsToken *permissions_token,
+     DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(handle);
+  DDSRT_UNUSED_ARG(permissions_credential);
+  DDSRT_UNUSED_ARG(permissions_token);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+
+  return true;
+}
+
+DDS_Security_ValidationResult_t validate_remote_identity(
+    dds_security_authentication *instance,
+     DDS_Security_IdentityHandle *remote_identity_handle,
+     DDS_Security_AuthRequestMessageToken *local_auth_request_token,
+    const DDS_Security_AuthRequestMessageToken *remote_auth_request_token,
+    const DDS_Security_IdentityHandle local_identity_handle,
+    const DDS_Security_IdentityToken *remote_identity_token,
+    const DDS_Security_GUID_t *remote_participant_guid,
+     DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(remote_identity_handle);
+  DDSRT_UNUSED_ARG(local_auth_request_token);
+  DDSRT_UNUSED_ARG(remote_auth_request_token);
+  DDSRT_UNUSED_ARG(local_identity_handle);
+  DDSRT_UNUSED_ARG(remote_identity_token);
+  DDSRT_UNUSED_ARG(remote_participant_guid);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+
+  return DDS_SECURITY_VALIDATION_OK;
+}
+
+DDS_Security_ValidationResult_t begin_handshake_request(
+    dds_security_authentication *instance,
+     DDS_Security_HandshakeHandle *handshake_handle,
+     DDS_Security_HandshakeMessageToken *handshake_message,
+    const DDS_Security_IdentityHandle initiator_identity_handle,
+    const DDS_Security_IdentityHandle replier_identity_handle,
+    const DDS_Security_OctetSeq *serialized_local_participant_data,
+     DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(handshake_handle);
+  DDSRT_UNUSED_ARG(handshake_message);
+  DDSRT_UNUSED_ARG(initiator_identity_handle);
+  DDSRT_UNUSED_ARG(replier_identity_handle);
+  DDSRT_UNUSED_ARG(serialized_local_participant_data);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+
+  return DDS_SECURITY_VALIDATION_OK;
+}
+
+DDS_Security_ValidationResult_t begin_handshake_reply(
+    dds_security_authentication *instance,
+     DDS_Security_HandshakeHandle *handshake_handle,
+     DDS_Security_HandshakeMessageToken *handshake_message_out,
+    const DDS_Security_HandshakeMessageToken *handshake_message_in,
+    const DDS_Security_IdentityHandle initiator_identity_handle,
+    const DDS_Security_IdentityHandle replier_identity_handle,
+    const DDS_Security_OctetSeq *serialized_local_participant_data,
+     DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(handshake_handle);
+  DDSRT_UNUSED_ARG(handshake_message_out);
+  DDSRT_UNUSED_ARG(handshake_message_in);
+  DDSRT_UNUSED_ARG(initiator_identity_handle);
+  DDSRT_UNUSED_ARG(replier_identity_handle);
+  DDSRT_UNUSED_ARG(serialized_local_participant_data);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+
+  return DDS_SECURITY_VALIDATION_OK;
+}
+
+DDS_Security_ValidationResult_t process_handshake(
+    dds_security_authentication *instance,
+     DDS_Security_HandshakeMessageToken *handshake_message_out,
+    const DDS_Security_HandshakeMessageToken *handshake_message_in,
+    const DDS_Security_HandshakeHandle handshake_handle,
+     DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(handshake_message_out);
+  DDSRT_UNUSED_ARG(handshake_message_in);
+  DDSRT_UNUSED_ARG(handshake_handle);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+
+  return DDS_SECURITY_VALIDATION_OK;
+}
+
+DDS_Security_SharedSecretHandle get_shared_secret(
+    dds_security_authentication *instance,
+    const DDS_Security_HandshakeHandle handshake_handle,
+     DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(handshake_handle);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+
+  return 0;
+}
+
+DDS_Security_boolean get_authenticated_peer_credential_token(
+    dds_security_authentication *instance,
+     DDS_Security_AuthenticatedPeerCredentialToken *peer_credential_token,
+    const DDS_Security_HandshakeHandle handshake_handle,
+     DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(peer_credential_token);
+  DDSRT_UNUSED_ARG(handshake_handle);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+
+  return true;
+}
+
+DDS_Security_boolean set_listener(dds_security_authentication *instance,
+    const dds_security_authentication_listener *listener,
+     DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(listener);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+
+  return true;
+}
+
+DDS_Security_boolean return_identity_token(dds_security_authentication *instance,
+    const DDS_Security_IdentityToken *token,
+     DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(token);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+
+  return true;
+}
+
+DDS_Security_boolean return_identity_status_token(
+    dds_security_authentication *instance,
+    const DDS_Security_IdentityStatusToken *token,
+     DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(token);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+
+  return true;
+}
+
+DDS_Security_boolean return_authenticated_peer_credential_token(
+    dds_security_authentication *instance,
+    const DDS_Security_AuthenticatedPeerCredentialToken *peer_credential_token,
+     DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(peer_credential_token);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+
+  return true;
+}
+
+DDS_Security_boolean return_handshake_handle(dds_security_authentication *instance,
+    const DDS_Security_HandshakeHandle handshake_handle,
+     DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(handshake_handle);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+
+  return true;
+}
+
+DDS_Security_boolean return_identity_handle(dds_security_authentication *instance,
+    const DDS_Security_IdentityHandle identity_handle,
+     DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(identity_handle);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+
+  return true;
+}
+
+DDS_Security_boolean return_sharedsecret_handle(
+    dds_security_authentication *instance,
+    const DDS_Security_SharedSecretHandle sharedsecret_handle,
+     DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(sharedsecret_handle);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+
+  return true;
+}
+
+int32_t init_authentication( const char *argument,  void **context)
+{
+
+  DDSRT_UNUSED_ARG(argument);
+  DDSRT_UNUSED_ARG(context);
+
+  /* return error code for test purposes */
+  return 1;
+}
+
+int32_t finalize_authentication(void *instance)
+{
+
+  ddsrt_free((dds_security_authentication_impl*) instance);
+
+  return 0;
+}
diff --git a/src/security/core/tests/plugin_loading/plugin_mock/authentication_init_error/mock_authentication.h b/src/security/core/tests/plugin_loading/plugin_mock/authentication_init_error/mock_authentication.h
new file mode 100644
index 0000000..faceace
--- /dev/null
+++ b/src/security/core/tests/plugin_loading/plugin_mock/authentication_init_error/mock_authentication.h
@@ -0,0 +1,217 @@
+/*
+ * Copyright(c) 2006 to 2019 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+#ifndef SECURITY_BUILTIN_PLUGINS_AUTHENTICATION_H_
+#define SECURITY_BUILTIN_PLUGINS_AUTHENTICATION_H_
+
+#include "dds/security/authentication_init_error_export.h"
+
+SECURITY_EXPORT int32_t
+init_authentication(const char *argument, void **context);
+
+SECURITY_EXPORT int32_t
+finalize_authentication(void *context);
+
+char *test_identity_certificate="data:,-----BEGIN CERTIFICATE-----\n\
+MIIDYDCCAkigAwIBAgIBBDANBgkqhkiG9w0BAQsFADByMQswCQYDVQQGEwJOTDEL\n\
+MAkGA1UECBMCT1YxEzARBgNVBAoTCkFETGluayBJU1QxGTAXBgNVBAMTEElkZW50\n\
+aXR5IENBIFRlc3QxJjAkBgkqhkiG9w0BCQEWF2luZm9AaXN0LmFkbGlua3RlY2gu\n\
+Y29tMB4XDTE4MDMxMjAwMDAwMFoXDTI3MDMxMTIzNTk1OVowdTELMAkGA1UEBhMC\n\
+TkwxCzAJBgNVBAgTAk9WMRAwDgYDVQQKEwdBRExpbmsgMREwDwYDVQQLEwhJU1Qg\n\
+VGVzdDETMBEGA1UEAxMKQWxpY2UgVGVzdDEfMB0GCSqGSIb3DQEJARYQYWxpY2VA\n\
+YWRsaW5rLmlzdDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBANBW+tEZ\n\
+Baw7EQCEXyzH9n7IkZ8PQIKe8hG1LAOGYOF/oUYQZJO/HxbWoC4rFqOC20+A6is6\n\
+kFwr1Zzp/Wurk9CrFXo5Nomi6ActH6LUM57nYqN68w6U38z/XkQxVY/ESZ5dySfD\n\
+9Q1C8R+zdE8gwbimdYmwX7ioz336nghM2CoAHPDRthQeJupl8x4V7isOltr9CGx8\n\
++imJXbGr39OK6u87cNLeu23sUkOIC0lSRMIqIQK3oJtHS70J2qecXdqp9MhE7Xky\n\
+/GPlI8ptQ1gJ8A3cAOvtI9mtMJMszs2EKWTLfeTcmfJHKKhKjvCgDdh3Jan4x5YP\n\
+Yg7HG6H+ceOUkMMCAwEAATANBgkqhkiG9w0BAQsFAAOCAQEAkvuqZzyJ3Nu4/Eo5\n\
+kD0nVgYGBUl7cspu+636q39zPSrxLEDMUWz+u8oXLpyGcgiZ8lZulPTV8dmOn+3C\n\
+Vg55c5C+gbnbX3MDyb3wB17296RmxYf6YNul4sFOmj6+g2i+Dw9WH0PBCVKbA84F\n\
+jR3Gx2Pfoifor3DvT0YFSsjNIRt090u4dQglbIb6cWEafC7O24t5jFhGPvJ7L9SE\n\
+gB0Drh/HmKTVuaqaRkoOKkKaKuWoXsszK1ZFda1DHommnR5LpYPsDRQ2fVM4EuBF\n\
+By03727uneuG8HLuNcLEV9H0i7LxtyfFkyCPUQvWG5jehb7xPOz/Ml26NAwwjlTJ\n\
+xEEFrw==\n\
+-----END CERTIFICATE-----";
+
+char *test_ca_certificate="data:,-----BEGIN CERTIFICATE-----\n\
+MIIEKTCCAxGgAwIBAgIBATANBgkqhkiG9w0BAQsFADByMQswCQYDVQQGEwJOTDEL\n\
+MAkGA1UECBMCT1YxEzARBgNVBAoTCkFETGluayBJU1QxGTAXBgNVBAMTEElkZW50\n\
+aXR5IENBIFRlc3QxJjAkBgkqhkiG9w0BCQEWF2luZm9AaXN0LmFkbGlua3RlY2gu\n\
+Y29tMB4XDTE4MDMxMjAwMDAwMFoXDTI3MDMxMTIzNTk1OVowcjELMAkGA1UEBhMC\n\
+TkwxCzAJBgNVBAgTAk9WMRMwEQYDVQQKEwpBRExpbmsgSVNUMRkwFwYDVQQDExBJ\n\
+ZGVudGl0eSBDQSBUZXN0MSYwJAYJKoZIhvcNAQkBFhdpbmZvQGlzdC5hZGxpbmt0\n\
+ZWNoLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBANa/ENFfGVXg\n\
+bPLTzBdDfiZQcp5dWZ//Pb8ErFOJu8uosVHFv8t69dgjHgNHB4OsjmjnR7GfKUZT\n\
+0cMvWJnjsC7DDlBwFET9rj4k40n96bbVCH9I7+tNhsoqzc6Eu+5h4sk7VfNGTM2Z\n\
+SyCd4GiSZRuA44rRbhXI7/LDpr4hY5J9ZDo5AM9ZyoLAoh774H3CZWD67S35XvUs\n\
+72dzE6uKG/vxBbvZ7eW2GLO6ewa9UxlnLVMPfJdpkp/xYXwwcPW2+2YXCge1ujxs\n\
+tjrOQJ5HUySh6DkE/kZpx8zwYWm9AaCrsvCIX1thsqgvKy+U5v1FS1L58eGc6s//\n\
+9yMgNhU29R0CAwEAAaOByTCBxjAMBgNVHRMEBTADAQH/MB0GA1UdDgQWBBRNVUJN\n\
+FzhJPReYT4QSx6dK53CXCTAfBgNVHSMEGDAWgBRNVUJNFzhJPReYT4QSx6dK53CX\n\
+CTAPBgNVHQ8BAf8EBQMDB/+AMGUGA1UdJQEB/wRbMFkGCCsGAQUFBwMBBggrBgEF\n\
+BQcDAgYIKwYBBQUHAwMGCCsGAQUFBwMEBggrBgEFBQcDCAYIKwYBBQUHAwkGCCsG\n\
+AQUFBwMNBggrBgEFBQcDDgYHKwYBBQIDBTANBgkqhkiG9w0BAQsFAAOCAQEAcOLF\n\
+ZYdJguj0uxeXB8v3xnUr1AWz9+gwg0URdfNLU2KvF2lsb/uznv6168b3/FcPgezN\n\
+Ihl9GqB+RvGwgXS/1UelCGbQiIUdsNxk246P4uOGPIyW32RoJcYPWZcpY+cw11tQ\n\
+NOnk994Y5/8ad1DmcxVLLqq5kwpXGWQufV1zOONq8B+mCvcVAmM4vkyF/de56Lwa\n\
+sAMpk1p77uhaDnuq2lIR4q3QHX2wGctFid5Q375DRscFQteY01r/dtwBBrMn0wuL\n\
+AMNx9ZGD+zAoOUaslpIlEQ+keAxk3jgGMWFMxF81YfhEnXzevSQXWpyek86XUyFL\n\
+O9IAQi5pa15gXjSbUg==\n\
+-----END CERTIFICATE-----";
+
+char *test_privatekey = "data:,-----BEGIN RSA PRIVATE KEY-----\n\
+MIIEowIBAAKCAQEA0Fb60RkFrDsRAIRfLMf2fsiRnw9Agp7yEbUsA4Zg4X+hRhBk\n\
+k78fFtagLisWo4LbT4DqKzqQXCvVnOn9a6uT0KsVejk2iaLoBy0fotQznudio3rz\n\
+DpTfzP9eRDFVj8RJnl3JJ8P1DULxH7N0TyDBuKZ1ibBfuKjPffqeCEzYKgAc8NG2\n\
+FB4m6mXzHhXuKw6W2v0IbHz6KYldsavf04rq7ztw0t67bexSQ4gLSVJEwiohAreg\n\
+m0dLvQnap5xd2qn0yETteTL8Y+Ujym1DWAnwDdwA6+0j2a0wkyzOzYQpZMt95NyZ\n\
+8kcoqEqO8KAN2HclqfjHlg9iDscbof5x45SQwwIDAQABAoIBAG0dYPeqd0IhHWJ7\n\
+8azufbchLMN1pX/D51xG2uptssfnpHuhkkufSZUYi4QipRS2ME6PYhWJ8pmTi6lH\n\
+E6cUkbI0KGd/F4U2gPdhNrR9Fxwea5bbifkVF7Gx/ZkRjZJiZ3w9+mCNTQbJDKhh\n\
+wITAzzT6WYznhvqbzzBX1fTa6kv0GAQtX7aHKM+XIwkhX2gzU5TU80bvH8aMrT05\n\
+tAMGQqkUeRnpo0yucBl4VmTZzd/+X/d2UyXR0my15jE5iH5o+p+E6qTRE9D+MGUd\n\
+MQ6Ftj0Untqy1lcog1ZLL6zPlnwcD4jgY5VCYDgvabnrSwymOJapPLsAEdWdq+U5\n\
+ec44BMECgYEA/+3qPUrd4XxA517qO3fCGBvf2Gkr7w5ZDeATOTHGuD8QZeK0nxPl\n\
+CWhRjdgkqo0fyf1cjczL5XgYayo+YxkO1Z4RUU+8lJAHlVx9izOQo+MTQfkwH4BK\n\
+LYlHxMoHJwAOXXoE+dmBaDh5xT0mDUGU750r763L6EFovE4qRBn9hxkCgYEA0GWz\n\
+rpOPNxb419WxG9npoQYdCZ5IbmEOGDH3ReggVzWHmW8sqtkqTZm5srcyDpqAc1Gu\n\
+paUveMblEBbU+NFJjLWOfwB5PCp8jsrqRgCQSxolShiVkc3Vu3oyzMus9PDge1eo\n\
+9mwVGO7ojQKWRu/WVAakENPaAjeyyhv4dqSNnjsCgYEAlwe8yszqoY1k8+U0T0G+\n\
+HeIdOCXgkmOiNCj+zyrLvaEhuS6PLq1b5TBVqGJcSPWdQ+MrglbQIKu9pUg5ptt7\n\
+wJ5WU+i9PeK9Ruxc/g/BFKYFkFJQjtZzb+nqm3wpul8zGwDN/O/ZiTqCyd3rHbmM\n\
+/dZ/viKPCZHIEBAEq0m3LskCgYBndzcAo+5k8ZjWwBfQth5SfhCIp/daJgGzbYtR\n\
+P/BenAsY2KOap3tjT8Fsw5usuHSxzIojX6H0Gvu7Qzq11mLn43Q+BeQrRQTWeFRc\n\
+MQdy4iZFZXNNEp7dF8yE9VKHwdgSJPGUdxD6chMvf2tRCN6mlS171VLV6wVvZvez\n\
+H/vX5QKBgD2Dq/NHpjCpAsECP9awmNF5Akn5WJbRGmegwXIih2mOtgtYYDeuQyxY\n\
+ZCrdJFfIUjUVPagshEmUklKhkYMYpzy2PQDVtaVcm6UNFroxT5h+J+KDs1LN1H8G\n\
+LsASrzyAg8EpRulwXEfLrWKiu9DKv8bMEgO4Ovgz8zTKJZIFhcac\n\
+-----END RSA PRIVATE KEY-----";
+
+
+DDS_Security_ValidationResult_t
+validate_local_identity(
+        dds_security_authentication *instance,
+        DDS_Security_IdentityHandle *local_identity_handle,
+        DDS_Security_GUID_t *adjusted_participant_guid,
+        const DDS_Security_DomainId domain_id,
+        const DDS_Security_Qos *participant_qos,
+        const DDS_Security_GUID_t *candidate_participant_guid,
+
+        DDS_Security_SecurityException *ex);
+DDS_Security_boolean
+get_identity_token(dds_security_authentication *instance,
+                   DDS_Security_IdentityToken *identity_token,
+                   const DDS_Security_IdentityHandle handle,
+                   DDS_Security_SecurityException *ex);
+DDS_Security_boolean
+set_permissions_credential_and_token(
+        dds_security_authentication *instance,
+        const DDS_Security_IdentityHandle handle,
+        const DDS_Security_PermissionsCredentialToken *permissions_credential,
+        const DDS_Security_PermissionsToken *permissions_token,
+        DDS_Security_SecurityException *ex);
+
+DDS_Security_ValidationResult_t
+validate_remote_identity(
+        dds_security_authentication *instance,
+        DDS_Security_IdentityHandle *remote_identity_handle,
+        DDS_Security_AuthRequestMessageToken *local_auth_request_token,
+        const DDS_Security_AuthRequestMessageToken *remote_auth_request_token,
+        const DDS_Security_IdentityHandle local_identity_handle,
+        const DDS_Security_IdentityToken *remote_identity_token,
+        const DDS_Security_GUID_t *remote_participant_guid,
+        DDS_Security_SecurityException *ex);
+
+DDS_Security_ValidationResult_t
+begin_handshake_request(
+        dds_security_authentication *instance,
+        DDS_Security_HandshakeHandle *handshake_handle,
+        DDS_Security_HandshakeMessageToken *handshake_message,
+        const DDS_Security_IdentityHandle initiator_identity_handle,
+        const DDS_Security_IdentityHandle replier_identity_handle,
+        const DDS_Security_OctetSeq *serialized_local_participant_data,
+        DDS_Security_SecurityException *ex);
+
+DDS_Security_ValidationResult_t
+begin_handshake_reply(
+        dds_security_authentication *instance,
+        DDS_Security_HandshakeHandle *handshake_handle,
+        DDS_Security_HandshakeMessageToken *handshake_message_out,
+        const DDS_Security_HandshakeMessageToken *handshake_message_in,
+        const DDS_Security_IdentityHandle initiator_identity_handle,
+        const DDS_Security_IdentityHandle replier_identity_handle,
+        const DDS_Security_OctetSeq *serialized_local_participant_data,
+        DDS_Security_SecurityException *ex);
+
+DDS_Security_ValidationResult_t
+process_handshake(
+        dds_security_authentication *instance,
+        DDS_Security_HandshakeMessageToken *handshake_message_out,
+        const DDS_Security_HandshakeMessageToken *handshake_message_in,
+        const DDS_Security_HandshakeHandle handshake_handle,
+        DDS_Security_SecurityException *ex);
+
+DDS_Security_SharedSecretHandle get_shared_secret(
+        dds_security_authentication *instance,
+        const DDS_Security_HandshakeHandle handshake_handle,
+        DDS_Security_SecurityException *ex);
+
+DDS_Security_boolean
+get_authenticated_peer_credential_token(
+        dds_security_authentication *instance,
+        DDS_Security_AuthenticatedPeerCredentialToken *peer_credential_token,
+        const DDS_Security_HandshakeHandle handshake_handle,
+        DDS_Security_SecurityException *ex);
+
+
+DDS_Security_boolean get_identity_status_token(
+        dds_security_authentication *instance,
+        DDS_Security_IdentityStatusToken *identity_status_token,
+        const DDS_Security_IdentityHandle handle,
+        DDS_Security_SecurityException *ex);
+
+DDS_Security_boolean set_listener(dds_security_authentication *instance,
+                                  const dds_security_authentication_listener *listener,
+                                  DDS_Security_SecurityException *ex);
+
+DDS_Security_boolean return_identity_token(dds_security_authentication *instance,
+                                           const DDS_Security_IdentityToken *token,
+                                           DDS_Security_SecurityException *ex);
+
+DDS_Security_boolean return_identity_status_token(
+        dds_security_authentication *instance,
+        const DDS_Security_IdentityStatusToken *token,
+        DDS_Security_SecurityException *ex);
+
+DDS_Security_boolean return_authenticated_peer_credential_token(
+        dds_security_authentication *instance,
+        const DDS_Security_AuthenticatedPeerCredentialToken *peer_credential_token,
+        DDS_Security_SecurityException *ex);
+
+DDS_Security_boolean
+return_handshake_handle(dds_security_authentication *instance,
+                        const DDS_Security_HandshakeHandle handshake_handle,
+                        DDS_Security_SecurityException *ex);
+DDS_Security_boolean
+return_identity_handle(
+        dds_security_authentication *instance,
+        const DDS_Security_IdentityHandle identity_handle,
+        DDS_Security_SecurityException *ex);
+
+DDS_Security_boolean return_sharedsecret_handle(
+        dds_security_authentication *instance,
+        const DDS_Security_SharedSecretHandle sharedsecret_handle,
+        DDS_Security_SecurityException *ex);
+
+
+
+#endif /* SECURITY_BUILTIN_PLUGINS_AUTHENTICATION_H_ */
diff --git a/src/security/core/tests/plugin_loading/plugin_mock/authentication_missing_function/mock_authentication.c b/src/security/core/tests/plugin_loading/plugin_mock/authentication_missing_function/mock_authentication.c
new file mode 100644
index 0000000..ee4efe2
--- /dev/null
+++ b/src/security/core/tests/plugin_loading/plugin_mock/authentication_missing_function/mock_authentication.c
@@ -0,0 +1,396 @@
+/*
+ * authentication.c
+ *
+ *  Created on: Jan 12, 2018
+ *      Author: kurtulus oksuztepe
+ *
+ *  Description: This file implements the Authentication interface for DDS Security 1.2
+ *
+ */
+
+#include "dds/security/dds_security_api.h"
+#include "dds/ddsrt/heap.h"
+#include "dds/ddsrt/misc.h"
+#include "mock_authentication.h"
+#include <stdio.h>
+#include <string.h>
+#include <stdbool.h>
+
+/**
+ * Implementation structure for storing encapsulated members of the instance
+ * while giving only the interface definition to user
+ */
+
+typedef struct dds_security_authentication_impl {
+  dds_security_authentication base;
+  int id; //sample internal member
+} dds_security_authentication_impl;
+
+DDS_Security_ValidationResult_t validate_local_identity(
+    dds_security_authentication *instance,
+     DDS_Security_IdentityHandle *local_identity_handle,
+     DDS_Security_GUID_t *adjusted_participant_guid,
+    const DDS_Security_DomainId domain_id,
+    const DDS_Security_Qos *participant_qos,
+    const DDS_Security_GUID_t *candidate_participant_guid,
+     DDS_Security_SecurityException *ex)
+{
+
+  unsigned i;
+  DDS_Security_ValidationResult_t result=DDS_SECURITY_VALIDATION_OK;
+  dds_security_authentication_impl *implementation =
+      (dds_security_authentication_impl *) instance;
+  char *identity_ca = NULL;
+  char *identity_certificate = NULL;
+  char *private_key = NULL;
+
+  DDSRT_UNUSED_ARG(local_identity_handle);
+  DDSRT_UNUSED_ARG(adjusted_participant_guid);
+  DDSRT_UNUSED_ARG(domain_id);
+  DDSRT_UNUSED_ARG(participant_qos);
+  DDSRT_UNUSED_ARG(candidate_participant_guid);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+
+  implementation->id = 2;
+
+  memcpy(adjusted_participant_guid, candidate_participant_guid, sizeof(DDS_Security_GUID_t));
+
+  for( i=0; i< participant_qos->property.value._length; i++)
+  {
+
+    //printf("%s: %s",participant_qos->property.value._buffer[i].name, participant_qos->property.value._buffer[i].value);
+    printf("%s\n",participant_qos->property.value._buffer[i].name);
+    if( strcmp(participant_qos->property.value._buffer[i].name, "dds.sec.auth.private_key") == 0)
+    {
+      private_key = participant_qos->property.value._buffer[i].value;
+    } else if( strcmp(participant_qos->property.value._buffer[i].name, "dds.sec.auth.identity_ca") == 0)
+    {
+      identity_ca = participant_qos->property.value._buffer[i].value;
+    } else if( strcmp(participant_qos->property.value._buffer[i].name, "dds.sec.auth.identity_certificate") == 0)
+    {
+      identity_certificate = participant_qos->property.value._buffer[i].value;
+    }
+  }
+
+  if( strcmp(identity_certificate, test_identity_certificate) != 0){
+
+    result = DDS_SECURITY_VALIDATION_FAILED;
+    printf("FAILED: Could not get identity_certificate value properly\n");
+  }
+  else if( strcmp(identity_ca, test_ca_certificate) != 0){
+    printf("FAILED: Could not get identity_ca value properly\n");
+    result = DDS_SECURITY_VALIDATION_FAILED;
+  }else if( strcmp(private_key, test_privatekey) != 0){
+    printf("FAILED: Could not get private_key value properly\n");
+    result = DDS_SECURITY_VALIDATION_FAILED;
+  }
+
+  if( result == DDS_SECURITY_VALIDATION_OK )
+  {
+    printf("DDS_SECURITY_VALIDATION_OK\n");
+  }
+
+
+  return result;
+}
+
+DDS_Security_boolean get_identity_token(dds_security_authentication *instance,
+     DDS_Security_IdentityToken *identity_token,
+    const DDS_Security_IdentityHandle handle,
+     DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(identity_token);
+  DDSRT_UNUSED_ARG(handle);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+
+  memset(identity_token, 0, sizeof(*identity_token));
+
+  return true;
+}
+
+DDS_Security_boolean get_identity_status_token(
+    dds_security_authentication *instance,
+     DDS_Security_IdentityStatusToken *identity_status_token,
+    const DDS_Security_IdentityHandle handle,
+     DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(identity_status_token);
+  DDSRT_UNUSED_ARG(handle);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+
+  return true;
+}
+
+DDS_Security_boolean set_permissions_credential_and_token(
+    dds_security_authentication *instance,
+    const DDS_Security_IdentityHandle handle,
+    const DDS_Security_PermissionsCredentialToken *permissions_credential,
+    const DDS_Security_PermissionsToken *permissions_token,
+     DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(handle);
+  DDSRT_UNUSED_ARG(permissions_credential);
+  DDSRT_UNUSED_ARG(permissions_token);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+
+  return true;
+}
+
+DDS_Security_ValidationResult_t validate_remote_identity(
+    dds_security_authentication *instance,
+     DDS_Security_IdentityHandle *remote_identity_handle,
+     DDS_Security_AuthRequestMessageToken *local_auth_request_token,
+    const DDS_Security_AuthRequestMessageToken *remote_auth_request_token,
+    const DDS_Security_IdentityHandle local_identity_handle,
+    const DDS_Security_IdentityToken *remote_identity_token,
+    const DDS_Security_GUID_t *remote_participant_guid,
+     DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(remote_identity_handle);
+  DDSRT_UNUSED_ARG(local_auth_request_token);
+  DDSRT_UNUSED_ARG(remote_auth_request_token);
+  DDSRT_UNUSED_ARG(local_identity_handle);
+  DDSRT_UNUSED_ARG(remote_identity_token);
+  DDSRT_UNUSED_ARG(remote_participant_guid);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+
+  return DDS_SECURITY_VALIDATION_OK;
+}
+
+DDS_Security_ValidationResult_t begin_handshake_request(
+    dds_security_authentication *instance,
+     DDS_Security_HandshakeHandle *handshake_handle,
+     DDS_Security_HandshakeMessageToken *handshake_message,
+    const DDS_Security_IdentityHandle initiator_identity_handle,
+    const DDS_Security_IdentityHandle replier_identity_handle,
+    const DDS_Security_OctetSeq *serialized_local_participant_data,
+     DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(handshake_handle);
+  DDSRT_UNUSED_ARG(handshake_message);
+  DDSRT_UNUSED_ARG(initiator_identity_handle);
+  DDSRT_UNUSED_ARG(replier_identity_handle);
+  DDSRT_UNUSED_ARG(serialized_local_participant_data);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+
+  return DDS_SECURITY_VALIDATION_OK;
+}
+
+DDS_Security_ValidationResult_t begin_handshake_reply(
+    dds_security_authentication *instance,
+     DDS_Security_HandshakeHandle *handshake_handle,
+     DDS_Security_HandshakeMessageToken *handshake_message_out,
+    const DDS_Security_HandshakeMessageToken *handshake_message_in,
+    const DDS_Security_IdentityHandle initiator_identity_handle,
+    const DDS_Security_IdentityHandle replier_identity_handle,
+    const DDS_Security_OctetSeq *serialized_local_participant_data,
+     DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(handshake_handle);
+  DDSRT_UNUSED_ARG(handshake_message_out);
+  DDSRT_UNUSED_ARG(handshake_message_in);
+  DDSRT_UNUSED_ARG(initiator_identity_handle);
+  DDSRT_UNUSED_ARG(replier_identity_handle);
+  DDSRT_UNUSED_ARG(serialized_local_participant_data);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+
+  return DDS_SECURITY_VALIDATION_OK;
+}
+
+DDS_Security_ValidationResult_t process_handshake(
+    dds_security_authentication *instance,
+     DDS_Security_HandshakeMessageToken *handshake_message_out,
+    const DDS_Security_HandshakeMessageToken *handshake_message_in,
+    const DDS_Security_HandshakeHandle handshake_handle,
+     DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(handshake_message_out);
+  DDSRT_UNUSED_ARG(handshake_message_in);
+  DDSRT_UNUSED_ARG(handshake_handle);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+
+  return DDS_SECURITY_VALIDATION_OK;
+}
+
+DDS_Security_SharedSecretHandle get_shared_secret(
+    dds_security_authentication *instance,
+    const DDS_Security_HandshakeHandle handshake_handle,
+     DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(handshake_handle);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+
+  return 0;
+}
+
+DDS_Security_boolean get_authenticated_peer_credential_token(
+    dds_security_authentication *instance,
+     DDS_Security_AuthenticatedPeerCredentialToken *peer_credential_token,
+    const DDS_Security_HandshakeHandle handshake_handle,
+     DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(peer_credential_token);
+  DDSRT_UNUSED_ARG(handshake_handle);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+
+  return true;
+}
+
+DDS_Security_boolean set_listener(dds_security_authentication *instance,
+    const dds_security_authentication_listener *listener,
+     DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(listener);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+
+  return true;
+}
+
+DDS_Security_boolean return_identity_token(dds_security_authentication *instance,
+    const DDS_Security_IdentityToken *token,
+     DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(token);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+
+  return true;
+}
+
+DDS_Security_boolean return_identity_status_token(
+    dds_security_authentication *instance,
+    const DDS_Security_IdentityStatusToken *token,
+     DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(token);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+
+  return true;
+}
+
+DDS_Security_boolean return_authenticated_peer_credential_token(
+    dds_security_authentication *instance,
+    const DDS_Security_AuthenticatedPeerCredentialToken *peer_credential_token,
+     DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(peer_credential_token);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+
+  return true;
+}
+
+DDS_Security_boolean return_handshake_handle(dds_security_authentication *instance,
+    const DDS_Security_HandshakeHandle handshake_handle,
+     DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(handshake_handle);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+
+  return true;
+}
+
+DDS_Security_boolean return_identity_handle(dds_security_authentication *instance,
+    const DDS_Security_IdentityHandle identity_handle,
+     DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(identity_handle);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+
+  return true;
+}
+
+DDS_Security_boolean return_sharedsecret_handle(
+    dds_security_authentication *instance,
+    const DDS_Security_SharedSecretHandle sharedsecret_handle,
+     DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(sharedsecret_handle);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+
+  return true;
+}
+
+int32_t init_authentication( const char *argument,  void **context)
+{
+
+  dds_security_authentication_impl *authentication;
+
+  DDSRT_UNUSED_ARG(argument);
+
+  //allocate implementation wrapper
+  authentication = (dds_security_authentication_impl*) ddsrt_malloc(
+      sizeof(dds_security_authentication_impl));
+  memset(authentication, 0, sizeof(dds_security_authentication_impl));
+
+  //assign the interface functions
+  authentication->base.validate_local_identity = &validate_local_identity;
+
+  authentication->base.get_identity_token = &get_identity_token;
+
+  authentication->base.get_identity_status_token = &get_identity_status_token;
+
+  authentication->base.set_permissions_credential_and_token =
+      &set_permissions_credential_and_token;
+
+  authentication->base.validate_remote_identity = &validate_remote_identity;
+
+  authentication->base.begin_handshake_request = &begin_handshake_request;
+
+  authentication->base.begin_handshake_reply = &begin_handshake_reply;
+
+  authentication->base.process_handshake = &process_handshake;
+
+  /*   missing function
+  authentication->base.get_shared_secret = &get_shared_secret;
+  */
+
+  authentication->base.get_authenticated_peer_credential_token =
+      &get_authenticated_peer_credential_token;
+
+  authentication->base.set_listener = &set_listener;
+
+  authentication->base.return_identity_token = &return_identity_token;
+
+  authentication->base.return_identity_status_token =
+      &return_identity_status_token;
+
+  authentication->base.return_authenticated_peer_credential_token =
+      &return_authenticated_peer_credential_token;
+
+  authentication->base.return_handshake_handle = &return_handshake_handle;
+
+  authentication->base.return_identity_handle = &return_identity_handle;
+
+  authentication->base.return_sharedsecret_handle = &return_sharedsecret_handle;
+
+  //prepare implementation wrapper
+  authentication->id = 1;
+
+  //return the instance
+  *context = authentication;
+  return 0;
+}
+
+int32_t finalize_authentication(void *instance)
+{
+
+  ddsrt_free((dds_security_authentication_impl*) instance);
+
+  return 0;
+}
diff --git a/src/security/core/tests/plugin_loading/plugin_mock/authentication_missing_function/mock_authentication.h b/src/security/core/tests/plugin_loading/plugin_mock/authentication_missing_function/mock_authentication.h
new file mode 100644
index 0000000..d3854b1
--- /dev/null
+++ b/src/security/core/tests/plugin_loading/plugin_mock/authentication_missing_function/mock_authentication.h
@@ -0,0 +1,218 @@
+/*
+ * Copyright(c) 2006 to 2019 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+
+#ifndef SECURITY_BUILTIN_PLUGINS_AUTHENTICATION_H_
+#define SECURITY_BUILTIN_PLUGINS_AUTHENTICATION_H_
+
+#include "dds/security/authentication_missing_function_export.h"
+
+SECURITY_EXPORT int32_t
+init_authentication(const char *argument, void **context);
+
+SECURITY_EXPORT int32_t
+finalize_authentication(void *context);
+
+char *test_identity_certificate="data:,-----BEGIN CERTIFICATE-----\n\
+MIIDYDCCAkigAwIBAgIBBDANBgkqhkiG9w0BAQsFADByMQswCQYDVQQGEwJOTDEL\n\
+MAkGA1UECBMCT1YxEzARBgNVBAoTCkFETGluayBJU1QxGTAXBgNVBAMTEElkZW50\n\
+aXR5IENBIFRlc3QxJjAkBgkqhkiG9w0BCQEWF2luZm9AaXN0LmFkbGlua3RlY2gu\n\
+Y29tMB4XDTE4MDMxMjAwMDAwMFoXDTI3MDMxMTIzNTk1OVowdTELMAkGA1UEBhMC\n\
+TkwxCzAJBgNVBAgTAk9WMRAwDgYDVQQKEwdBRExpbmsgMREwDwYDVQQLEwhJU1Qg\n\
+VGVzdDETMBEGA1UEAxMKQWxpY2UgVGVzdDEfMB0GCSqGSIb3DQEJARYQYWxpY2VA\n\
+YWRsaW5rLmlzdDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBANBW+tEZ\n\
+Baw7EQCEXyzH9n7IkZ8PQIKe8hG1LAOGYOF/oUYQZJO/HxbWoC4rFqOC20+A6is6\n\
+kFwr1Zzp/Wurk9CrFXo5Nomi6ActH6LUM57nYqN68w6U38z/XkQxVY/ESZ5dySfD\n\
+9Q1C8R+zdE8gwbimdYmwX7ioz336nghM2CoAHPDRthQeJupl8x4V7isOltr9CGx8\n\
++imJXbGr39OK6u87cNLeu23sUkOIC0lSRMIqIQK3oJtHS70J2qecXdqp9MhE7Xky\n\
+/GPlI8ptQ1gJ8A3cAOvtI9mtMJMszs2EKWTLfeTcmfJHKKhKjvCgDdh3Jan4x5YP\n\
+Yg7HG6H+ceOUkMMCAwEAATANBgkqhkiG9w0BAQsFAAOCAQEAkvuqZzyJ3Nu4/Eo5\n\
+kD0nVgYGBUl7cspu+636q39zPSrxLEDMUWz+u8oXLpyGcgiZ8lZulPTV8dmOn+3C\n\
+Vg55c5C+gbnbX3MDyb3wB17296RmxYf6YNul4sFOmj6+g2i+Dw9WH0PBCVKbA84F\n\
+jR3Gx2Pfoifor3DvT0YFSsjNIRt090u4dQglbIb6cWEafC7O24t5jFhGPvJ7L9SE\n\
+gB0Drh/HmKTVuaqaRkoOKkKaKuWoXsszK1ZFda1DHommnR5LpYPsDRQ2fVM4EuBF\n\
+By03727uneuG8HLuNcLEV9H0i7LxtyfFkyCPUQvWG5jehb7xPOz/Ml26NAwwjlTJ\n\
+xEEFrw==\n\
+-----END CERTIFICATE-----";
+
+char *test_ca_certificate="data:,-----BEGIN CERTIFICATE-----\n\
+MIIEKTCCAxGgAwIBAgIBATANBgkqhkiG9w0BAQsFADByMQswCQYDVQQGEwJOTDEL\n\
+MAkGA1UECBMCT1YxEzARBgNVBAoTCkFETGluayBJU1QxGTAXBgNVBAMTEElkZW50\n\
+aXR5IENBIFRlc3QxJjAkBgkqhkiG9w0BCQEWF2luZm9AaXN0LmFkbGlua3RlY2gu\n\
+Y29tMB4XDTE4MDMxMjAwMDAwMFoXDTI3MDMxMTIzNTk1OVowcjELMAkGA1UEBhMC\n\
+TkwxCzAJBgNVBAgTAk9WMRMwEQYDVQQKEwpBRExpbmsgSVNUMRkwFwYDVQQDExBJ\n\
+ZGVudGl0eSBDQSBUZXN0MSYwJAYJKoZIhvcNAQkBFhdpbmZvQGlzdC5hZGxpbmt0\n\
+ZWNoLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBANa/ENFfGVXg\n\
+bPLTzBdDfiZQcp5dWZ//Pb8ErFOJu8uosVHFv8t69dgjHgNHB4OsjmjnR7GfKUZT\n\
+0cMvWJnjsC7DDlBwFET9rj4k40n96bbVCH9I7+tNhsoqzc6Eu+5h4sk7VfNGTM2Z\n\
+SyCd4GiSZRuA44rRbhXI7/LDpr4hY5J9ZDo5AM9ZyoLAoh774H3CZWD67S35XvUs\n\
+72dzE6uKG/vxBbvZ7eW2GLO6ewa9UxlnLVMPfJdpkp/xYXwwcPW2+2YXCge1ujxs\n\
+tjrOQJ5HUySh6DkE/kZpx8zwYWm9AaCrsvCIX1thsqgvKy+U5v1FS1L58eGc6s//\n\
+9yMgNhU29R0CAwEAAaOByTCBxjAMBgNVHRMEBTADAQH/MB0GA1UdDgQWBBRNVUJN\n\
+FzhJPReYT4QSx6dK53CXCTAfBgNVHSMEGDAWgBRNVUJNFzhJPReYT4QSx6dK53CX\n\
+CTAPBgNVHQ8BAf8EBQMDB/+AMGUGA1UdJQEB/wRbMFkGCCsGAQUFBwMBBggrBgEF\n\
+BQcDAgYIKwYBBQUHAwMGCCsGAQUFBwMEBggrBgEFBQcDCAYIKwYBBQUHAwkGCCsG\n\
+AQUFBwMNBggrBgEFBQcDDgYHKwYBBQIDBTANBgkqhkiG9w0BAQsFAAOCAQEAcOLF\n\
+ZYdJguj0uxeXB8v3xnUr1AWz9+gwg0URdfNLU2KvF2lsb/uznv6168b3/FcPgezN\n\
+Ihl9GqB+RvGwgXS/1UelCGbQiIUdsNxk246P4uOGPIyW32RoJcYPWZcpY+cw11tQ\n\
+NOnk994Y5/8ad1DmcxVLLqq5kwpXGWQufV1zOONq8B+mCvcVAmM4vkyF/de56Lwa\n\
+sAMpk1p77uhaDnuq2lIR4q3QHX2wGctFid5Q375DRscFQteY01r/dtwBBrMn0wuL\n\
+AMNx9ZGD+zAoOUaslpIlEQ+keAxk3jgGMWFMxF81YfhEnXzevSQXWpyek86XUyFL\n\
+O9IAQi5pa15gXjSbUg==\n\
+-----END CERTIFICATE-----";
+
+char *test_privatekey = "data:,-----BEGIN RSA PRIVATE KEY-----\n\
+MIIEowIBAAKCAQEA0Fb60RkFrDsRAIRfLMf2fsiRnw9Agp7yEbUsA4Zg4X+hRhBk\n\
+k78fFtagLisWo4LbT4DqKzqQXCvVnOn9a6uT0KsVejk2iaLoBy0fotQznudio3rz\n\
+DpTfzP9eRDFVj8RJnl3JJ8P1DULxH7N0TyDBuKZ1ibBfuKjPffqeCEzYKgAc8NG2\n\
+FB4m6mXzHhXuKw6W2v0IbHz6KYldsavf04rq7ztw0t67bexSQ4gLSVJEwiohAreg\n\
+m0dLvQnap5xd2qn0yETteTL8Y+Ujym1DWAnwDdwA6+0j2a0wkyzOzYQpZMt95NyZ\n\
+8kcoqEqO8KAN2HclqfjHlg9iDscbof5x45SQwwIDAQABAoIBAG0dYPeqd0IhHWJ7\n\
+8azufbchLMN1pX/D51xG2uptssfnpHuhkkufSZUYi4QipRS2ME6PYhWJ8pmTi6lH\n\
+E6cUkbI0KGd/F4U2gPdhNrR9Fxwea5bbifkVF7Gx/ZkRjZJiZ3w9+mCNTQbJDKhh\n\
+wITAzzT6WYznhvqbzzBX1fTa6kv0GAQtX7aHKM+XIwkhX2gzU5TU80bvH8aMrT05\n\
+tAMGQqkUeRnpo0yucBl4VmTZzd/+X/d2UyXR0my15jE5iH5o+p+E6qTRE9D+MGUd\n\
+MQ6Ftj0Untqy1lcog1ZLL6zPlnwcD4jgY5VCYDgvabnrSwymOJapPLsAEdWdq+U5\n\
+ec44BMECgYEA/+3qPUrd4XxA517qO3fCGBvf2Gkr7w5ZDeATOTHGuD8QZeK0nxPl\n\
+CWhRjdgkqo0fyf1cjczL5XgYayo+YxkO1Z4RUU+8lJAHlVx9izOQo+MTQfkwH4BK\n\
+LYlHxMoHJwAOXXoE+dmBaDh5xT0mDUGU750r763L6EFovE4qRBn9hxkCgYEA0GWz\n\
+rpOPNxb419WxG9npoQYdCZ5IbmEOGDH3ReggVzWHmW8sqtkqTZm5srcyDpqAc1Gu\n\
+paUveMblEBbU+NFJjLWOfwB5PCp8jsrqRgCQSxolShiVkc3Vu3oyzMus9PDge1eo\n\
+9mwVGO7ojQKWRu/WVAakENPaAjeyyhv4dqSNnjsCgYEAlwe8yszqoY1k8+U0T0G+\n\
+HeIdOCXgkmOiNCj+zyrLvaEhuS6PLq1b5TBVqGJcSPWdQ+MrglbQIKu9pUg5ptt7\n\
+wJ5WU+i9PeK9Ruxc/g/BFKYFkFJQjtZzb+nqm3wpul8zGwDN/O/ZiTqCyd3rHbmM\n\
+/dZ/viKPCZHIEBAEq0m3LskCgYBndzcAo+5k8ZjWwBfQth5SfhCIp/daJgGzbYtR\n\
+P/BenAsY2KOap3tjT8Fsw5usuHSxzIojX6H0Gvu7Qzq11mLn43Q+BeQrRQTWeFRc\n\
+MQdy4iZFZXNNEp7dF8yE9VKHwdgSJPGUdxD6chMvf2tRCN6mlS171VLV6wVvZvez\n\
+H/vX5QKBgD2Dq/NHpjCpAsECP9awmNF5Akn5WJbRGmegwXIih2mOtgtYYDeuQyxY\n\
+ZCrdJFfIUjUVPagshEmUklKhkYMYpzy2PQDVtaVcm6UNFroxT5h+J+KDs1LN1H8G\n\
+LsASrzyAg8EpRulwXEfLrWKiu9DKv8bMEgO4Ovgz8zTKJZIFhcac\n\
+-----END RSA PRIVATE KEY-----";
+
+
+DDS_Security_ValidationResult_t
+validate_local_identity(
+        dds_security_authentication *instance,
+        DDS_Security_IdentityHandle *local_identity_handle,
+        DDS_Security_GUID_t *adjusted_participant_guid,
+        const DDS_Security_DomainId domain_id,
+        const DDS_Security_Qos *participant_qos,
+        const DDS_Security_GUID_t *candidate_participant_guid,
+
+        DDS_Security_SecurityException *ex);
+DDS_Security_boolean
+get_identity_token(dds_security_authentication *instance,
+                   DDS_Security_IdentityToken *identity_token,
+                   const DDS_Security_IdentityHandle handle,
+                   DDS_Security_SecurityException *ex);
+DDS_Security_boolean
+set_permissions_credential_and_token(
+        dds_security_authentication *instance,
+        const DDS_Security_IdentityHandle handle,
+        const DDS_Security_PermissionsCredentialToken *permissions_credential,
+        const DDS_Security_PermissionsToken *permissions_token,
+        DDS_Security_SecurityException *ex);
+
+DDS_Security_ValidationResult_t
+validate_remote_identity(
+        dds_security_authentication *instance,
+        DDS_Security_IdentityHandle *remote_identity_handle,
+        DDS_Security_AuthRequestMessageToken *local_auth_request_token,
+        const DDS_Security_AuthRequestMessageToken *remote_auth_request_token,
+        const DDS_Security_IdentityHandle local_identity_handle,
+        const DDS_Security_IdentityToken *remote_identity_token,
+        const DDS_Security_GUID_t *remote_participant_guid,
+        DDS_Security_SecurityException *ex);
+
+DDS_Security_ValidationResult_t
+begin_handshake_request(
+        dds_security_authentication *instance,
+        DDS_Security_HandshakeHandle *handshake_handle,
+        DDS_Security_HandshakeMessageToken *handshake_message,
+        const DDS_Security_IdentityHandle initiator_identity_handle,
+        const DDS_Security_IdentityHandle replier_identity_handle,
+        const DDS_Security_OctetSeq *serialized_local_participant_data,
+        DDS_Security_SecurityException *ex);
+
+DDS_Security_ValidationResult_t
+begin_handshake_reply(
+        dds_security_authentication *instance,
+        DDS_Security_HandshakeHandle *handshake_handle,
+        DDS_Security_HandshakeMessageToken *handshake_message_out,
+        const DDS_Security_HandshakeMessageToken *handshake_message_in,
+        const DDS_Security_IdentityHandle initiator_identity_handle,
+        const DDS_Security_IdentityHandle replier_identity_handle,
+        const DDS_Security_OctetSeq *serialized_local_participant_data,
+        DDS_Security_SecurityException *ex);
+
+DDS_Security_ValidationResult_t
+process_handshake(
+        dds_security_authentication *instance,
+        DDS_Security_HandshakeMessageToken *handshake_message_out,
+        const DDS_Security_HandshakeMessageToken *handshake_message_in,
+        const DDS_Security_HandshakeHandle handshake_handle,
+        DDS_Security_SecurityException *ex);
+
+DDS_Security_SharedSecretHandle get_shared_secret(
+        dds_security_authentication *instance,
+        const DDS_Security_HandshakeHandle handshake_handle,
+        DDS_Security_SecurityException *ex);
+
+DDS_Security_boolean
+get_authenticated_peer_credential_token(
+        dds_security_authentication *instance,
+        DDS_Security_AuthenticatedPeerCredentialToken *peer_credential_token,
+        const DDS_Security_HandshakeHandle handshake_handle,
+        DDS_Security_SecurityException *ex);
+
+
+DDS_Security_boolean get_identity_status_token(
+        dds_security_authentication *instance,
+        DDS_Security_IdentityStatusToken *identity_status_token,
+        const DDS_Security_IdentityHandle handle,
+        DDS_Security_SecurityException *ex);
+
+DDS_Security_boolean set_listener(dds_security_authentication *instance,
+                                  const dds_security_authentication_listener *listener,
+                                  DDS_Security_SecurityException *ex);
+
+DDS_Security_boolean return_identity_token(dds_security_authentication *instance,
+                                           const DDS_Security_IdentityToken *token,
+                                           DDS_Security_SecurityException *ex);
+
+DDS_Security_boolean return_identity_status_token(
+        dds_security_authentication *instance,
+        const DDS_Security_IdentityStatusToken *token,
+        DDS_Security_SecurityException *ex);
+
+DDS_Security_boolean return_authenticated_peer_credential_token(
+        dds_security_authentication *instance,
+        const DDS_Security_AuthenticatedPeerCredentialToken *peer_credential_token,
+        DDS_Security_SecurityException *ex);
+
+DDS_Security_boolean
+return_handshake_handle(dds_security_authentication *instance,
+                        const DDS_Security_HandshakeHandle handshake_handle,
+                        DDS_Security_SecurityException *ex);
+DDS_Security_boolean
+return_identity_handle(
+        dds_security_authentication *instance,
+        const DDS_Security_IdentityHandle identity_handle,
+        DDS_Security_SecurityException *ex);
+
+DDS_Security_boolean return_sharedsecret_handle(
+        dds_security_authentication *instance,
+        const DDS_Security_SharedSecretHandle sharedsecret_handle,
+        DDS_Security_SecurityException *ex);
+
+
+
+#endif /* SECURITY_BUILTIN_PLUGINS_AUTHENTICATION_H_ */
diff --git a/src/security/core/tests/plugin_loading/plugin_mock/cryptography_all_ok/mock_cryptography.c b/src/security/core/tests/plugin_loading/plugin_mock/cryptography_all_ok/mock_cryptography.c
new file mode 100644
index 0000000..7f664bf
--- /dev/null
+++ b/src/security/core/tests/plugin_loading/plugin_mock/cryptography_all_ok/mock_cryptography.c
@@ -0,0 +1,667 @@
+/*
+ * Copyright(c) 2006 to 2019 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+
+#include "dds/security/dds_security_api.h"
+#include "dds/ddsrt/heap.h"
+#include "dds/ddsrt/misc.h"
+#include <stdio.h>
+#include <string.h>
+#include <stdbool.h>
+#include "mock_cryptography.h"
+/**
+ * Implementation structure for storing encapsulated members of the instance
+ * while giving only the interface definition to user
+ */
+
+typedef struct dds_security_cryptography_impl {
+  dds_security_cryptography base;
+  int member;
+} dds_security_cryptography_impl;
+
+
+dds_security_crypto_key_exchange* dds_security_crypto_key_exchange__alloc(void);
+void dds_security_crypto_key_exchange__dealloc(
+    dds_security_crypto_key_exchange* instance);
+
+dds_security_crypto_key_factory* dds_security_crypto_key_factory__alloc(void);
+void dds_security_crypto_key_factory__dealloc(
+    dds_security_crypto_key_factory* instance);
+
+/**
+ * CryptoTransform Interface
+ */
+
+/*
+ * Allocation function for implementer structure (with internal variables) transparently.
+ *
+ */
+
+dds_security_crypto_transform* dds_security_crypto_transform__alloc(void);
+void dds_security_crypto_transform__dealloc(
+    dds_security_crypto_transform* instance);
+
+
+int32_t init_crypto(  const char *argument, void **context)
+{
+
+  dds_security_cryptography_impl *cryptography;
+
+  dds_security_crypto_key_exchange *crypto_key_exchange;
+  dds_security_crypto_key_factory *crypto_key_factory;
+  dds_security_crypto_transform *crypto_transform;
+
+
+  DDSRT_UNUSED_ARG(argument);
+
+  //allocate new instance
+  cryptography = (dds_security_cryptography_impl*) ddsrt_malloc(
+      sizeof(dds_security_cryptography_impl));
+
+  //assign the sub components
+  crypto_key_exchange = dds_security_crypto_key_exchange__alloc();
+  crypto_key_factory = dds_security_crypto_key_factory__alloc();
+  crypto_transform = dds_security_crypto_transform__alloc();
+
+
+  cryptography->base.crypto_key_exchange = crypto_key_exchange;
+  cryptography->base.crypto_key_factory = crypto_key_factory;
+  cryptography->base.crypto_transform = crypto_transform;
+
+  //return the instance
+  *context = cryptography;
+  return 0;
+}
+
+int32_t finalize_crypto( void *instance)
+{
+
+  dds_security_cryptography_impl* instance_impl =
+      (dds_security_cryptography_impl*) instance;
+
+  //deallocate components
+  dds_security_crypto_key_exchange__dealloc(
+      instance_impl->base.crypto_key_exchange);
+  dds_security_crypto_key_factory__dealloc(
+      instance_impl->base.crypto_key_factory);
+  dds_security_crypto_transform__dealloc(instance_impl->base.crypto_transform);
+  //deallocate cryptography
+  ddsrt_free(instance_impl);
+
+  return 0;
+}
+
+
+
+
+
+
+/**
+ * Implementation structure for storing encapsulated members of the instance
+ * while giving only the interface definition to user
+ */
+
+typedef struct dds_security_crypto_key_exchange_impl {
+  dds_security_crypto_key_exchange base;
+  int member;
+} dds_security_crypto_key_exchange_impl;
+
+/**
+ * Function implementations
+ */
+static DDS_Security_boolean create_local_participant_crypto_tokens(
+     dds_security_crypto_key_exchange *instance,
+    DDS_Security_ParticipantCryptoTokenSeq *local_participant_crypto_tokens,
+     const DDS_Security_ParticipantCryptoHandle local_participant_crypto,
+     const DDS_Security_ParticipantCryptoHandle remote_participant_crypto,
+    DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(instance);
+  DDSRT_UNUSED_ARG(local_participant_crypto_tokens);
+  DDSRT_UNUSED_ARG(local_participant_crypto);
+  DDSRT_UNUSED_ARG(remote_participant_crypto);
+  DDSRT_UNUSED_ARG(ex);
+  return true;
+
+}
+
+static DDS_Security_boolean set_remote_participant_crypto_tokens(
+     dds_security_crypto_key_exchange *instance,
+     const DDS_Security_ParticipantCryptoHandle local_participant_crypto,
+     const DDS_Security_ParticipantCryptoHandle remote_participant_crypto,
+     const DDS_Security_ParticipantCryptoTokenSeq *remote_participant_tokens,
+    DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(instance);
+  DDSRT_UNUSED_ARG(local_participant_crypto);
+  DDSRT_UNUSED_ARG(remote_participant_crypto);
+  DDSRT_UNUSED_ARG(remote_participant_tokens);
+  DDSRT_UNUSED_ARG(ex);
+
+  return true;
+}
+
+static DDS_Security_boolean create_local_datawriter_crypto_tokens(
+     dds_security_crypto_key_exchange *instance,
+    DDS_Security_DatawriterCryptoTokenSeq *local_datawriter_crypto_tokens,
+     const DDS_Security_DatawriterCryptoHandle local_datawriter_crypto,
+     const DDS_Security_DatareaderCryptoHandle remote_datareader_crypto,
+    DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(instance);
+  DDSRT_UNUSED_ARG(local_datawriter_crypto_tokens);
+  DDSRT_UNUSED_ARG(local_datawriter_crypto);
+  DDSRT_UNUSED_ARG(remote_datareader_crypto);
+  DDSRT_UNUSED_ARG(ex);
+
+  return true;
+}
+
+static DDS_Security_boolean set_remote_datawriter_crypto_tokens(
+     dds_security_crypto_key_exchange *instance,
+     const DDS_Security_DatareaderCryptoHandle local_datareader_crypto,
+     const DDS_Security_DatawriterCryptoHandle remote_datawriter_crypto,
+     const DDS_Security_DatawriterCryptoTokenSeq *remote_datawriter_tokens,
+    DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(instance);
+  DDSRT_UNUSED_ARG(local_datareader_crypto);
+  DDSRT_UNUSED_ARG(remote_datawriter_crypto);
+  DDSRT_UNUSED_ARG(remote_datawriter_tokens);
+  DDSRT_UNUSED_ARG(ex);
+
+  return true;
+}
+
+static DDS_Security_boolean create_local_datareader_crypto_tokens(
+     dds_security_crypto_key_exchange *instance,
+    DDS_Security_DatareaderCryptoTokenSeq *local_datareader_cryto_tokens,
+     const DDS_Security_DatareaderCryptoHandle local_datareader_crypto,
+     const DDS_Security_DatawriterCryptoHandle remote_datawriter_crypto,
+    DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(instance);
+  DDSRT_UNUSED_ARG(local_datareader_cryto_tokens);
+  DDSRT_UNUSED_ARG(local_datareader_crypto);
+  DDSRT_UNUSED_ARG(remote_datawriter_crypto);
+  DDSRT_UNUSED_ARG(ex);
+
+  return true;
+}
+
+static DDS_Security_boolean set_remote_datareader_crypto_tokens(
+     dds_security_crypto_key_exchange *instance,
+     const DDS_Security_DatawriterCryptoHandle local_datawriter_crypto,
+     const DDS_Security_DatareaderCryptoHandle remote_datareader_crypto,
+     const DDS_Security_DatareaderCryptoTokenSeq *remote_datareader_tokens,
+    DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(instance);
+  DDSRT_UNUSED_ARG(local_datawriter_crypto);
+  DDSRT_UNUSED_ARG(remote_datareader_crypto);
+  DDSRT_UNUSED_ARG(remote_datareader_tokens);
+  DDSRT_UNUSED_ARG(ex);
+
+  return true;
+}
+
+static DDS_Security_boolean return_crypto_tokens(
+     dds_security_crypto_key_exchange *instance,
+     DDS_Security_CryptoTokenSeq *crypto_tokens,
+    DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(instance);
+  DDSRT_UNUSED_ARG(crypto_tokens);
+  DDSRT_UNUSED_ARG(ex);
+
+  return true;
+}
+
+dds_security_crypto_key_exchange* dds_security_crypto_key_exchange__alloc(void)
+{
+  dds_security_crypto_key_exchange_impl *instance;
+  instance = (dds_security_crypto_key_exchange_impl*) ddsrt_malloc(
+      sizeof(dds_security_crypto_key_exchange_impl));
+
+  instance->base.create_local_participant_crypto_tokens =
+      &create_local_participant_crypto_tokens;
+
+  instance->base.set_remote_participant_crypto_tokens =
+      &set_remote_participant_crypto_tokens;
+
+  instance->base.create_local_datawriter_crypto_tokens =
+      &create_local_datawriter_crypto_tokens;
+
+  instance->base.set_remote_datawriter_crypto_tokens =
+      &set_remote_datawriter_crypto_tokens;
+
+  instance->base.create_local_datareader_crypto_tokens =
+      &create_local_datareader_crypto_tokens;
+
+  instance->base.set_remote_datareader_crypto_tokens =
+      &set_remote_datareader_crypto_tokens;
+
+  instance->base.return_crypto_tokens = &return_crypto_tokens;
+
+  return (dds_security_crypto_key_exchange*) instance;
+}
+
+void dds_security_crypto_key_exchange__dealloc(
+    dds_security_crypto_key_exchange* instance)
+{
+
+  ddsrt_free((dds_security_crypto_key_exchange_impl*) instance);
+}
+
+
+
+/**
+ * Implementation structure for storing encapsulated members of the instance
+ * while giving only the interface definition to user
+ */
+
+typedef struct dds_security_crypto_key_factory_impl {
+  dds_security_crypto_key_factory base;
+  int member;
+} dds_security_crypto_key_factory_impl;
+
+/**
+ * Function implementations
+ */
+
+static DDS_Security_ParticipantCryptoHandle register_local_participant(
+     dds_security_crypto_key_factory *instance,
+     const DDS_Security_IdentityHandle participant_identity,
+     const DDS_Security_PermissionsHandle participant_permissions,
+     const DDS_Security_PropertySeq *participant_properties,
+     const DDS_Security_ParticipantSecurityAttributes *participant_security_attributes,
+    DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(instance);
+  DDSRT_UNUSED_ARG(participant_identity);
+  DDSRT_UNUSED_ARG(participant_permissions);
+  DDSRT_UNUSED_ARG(participant_properties);
+  DDSRT_UNUSED_ARG(participant_security_attributes);
+  DDSRT_UNUSED_ARG(ex);
+  return 0;
+}
+
+static DDS_Security_ParticipantCryptoHandle register_matched_remote_participant(
+     dds_security_crypto_key_factory *instance,
+     const DDS_Security_ParticipantCryptoHandle local_participant_crypto_handle,
+     const DDS_Security_IdentityHandle remote_participant_identity,
+     const DDS_Security_PermissionsHandle remote_participant_permissions,
+     const DDS_Security_SharedSecretHandle shared_secret,
+    DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(instance);
+  DDSRT_UNUSED_ARG(local_participant_crypto_handle);
+  DDSRT_UNUSED_ARG(remote_participant_identity);
+  DDSRT_UNUSED_ARG(remote_participant_permissions);
+  DDSRT_UNUSED_ARG(shared_secret);
+  DDSRT_UNUSED_ARG(ex);
+  return 0;
+}
+
+static DDS_Security_DatawriterCryptoHandle register_local_datawriter(
+     dds_security_crypto_key_factory *instance,
+     const DDS_Security_ParticipantCryptoHandle participant_crypto,
+     const DDS_Security_PropertySeq *datawriter_properties,
+     const DDS_Security_EndpointSecurityAttributes *datawriter_security_attributes,
+    DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(instance);
+  DDSRT_UNUSED_ARG(participant_crypto);
+  DDSRT_UNUSED_ARG(datawriter_properties);
+  DDSRT_UNUSED_ARG(datawriter_security_attributes);
+  DDSRT_UNUSED_ARG(ex);
+  return 0;
+}
+
+static DDS_Security_DatareaderCryptoHandle register_matched_remote_datareader(
+     dds_security_crypto_key_factory *instance,
+     const DDS_Security_DatawriterCryptoHandle local_datawritert_crypto_handle,
+     const DDS_Security_ParticipantCryptoHandle remote_participant_crypto,
+     const DDS_Security_SharedSecretHandle shared_secret,
+     const DDS_Security_boolean relay_only,
+    DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(instance);
+  DDSRT_UNUSED_ARG(local_datawritert_crypto_handle);
+  DDSRT_UNUSED_ARG(remote_participant_crypto);
+  DDSRT_UNUSED_ARG(shared_secret);
+  DDSRT_UNUSED_ARG(relay_only);
+  DDSRT_UNUSED_ARG(ex);
+  return 0;
+}
+
+static DDS_Security_DatareaderCryptoHandle register_local_datareader(
+     dds_security_crypto_key_factory *instance,
+     const DDS_Security_ParticipantCryptoHandle participant_crypto,
+     const DDS_Security_PropertySeq *datareader_properties,
+     const DDS_Security_EndpointSecurityAttributes *datareader_security_attributes,
+    DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(instance);
+  DDSRT_UNUSED_ARG(participant_crypto);
+  DDSRT_UNUSED_ARG(datareader_properties);
+  DDSRT_UNUSED_ARG(datareader_security_attributes);
+  DDSRT_UNUSED_ARG(ex);
+
+  return 0;
+}
+
+static DDS_Security_DatawriterCryptoHandle register_matched_remote_datawriter(
+     dds_security_crypto_key_factory *instance,
+     const DDS_Security_DatareaderCryptoHandle local_datareader_crypto_handle,
+     const DDS_Security_ParticipantCryptoHandle remote_participant_crypt,
+     const DDS_Security_SharedSecretHandle shared_secret,
+    DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(instance);
+  DDSRT_UNUSED_ARG(local_datareader_crypto_handle);
+  DDSRT_UNUSED_ARG(remote_participant_crypt);
+  DDSRT_UNUSED_ARG(shared_secret);
+  DDSRT_UNUSED_ARG(ex);
+  return true;
+}
+
+static DDS_Security_boolean unregister_participant(
+     dds_security_crypto_key_factory *instance,
+     const DDS_Security_ParticipantCryptoHandle participant_crypto_handle,
+    DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(instance);
+  DDSRT_UNUSED_ARG(participant_crypto_handle);
+  DDSRT_UNUSED_ARG(ex);
+  return true;
+}
+
+static DDS_Security_boolean unregister_datawriter(
+     dds_security_crypto_key_factory *instance,
+     const DDS_Security_DatawriterCryptoHandle datawriter_crypto_handle,
+    DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(instance);
+  DDSRT_UNUSED_ARG(datawriter_crypto_handle);
+  DDSRT_UNUSED_ARG(ex);
+  return true;
+}
+
+static DDS_Security_boolean unregister_datareader(
+     dds_security_crypto_key_factory *instance,
+     const DDS_Security_DatareaderCryptoHandle datareader_crypto_handle,
+    DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(instance);
+  DDSRT_UNUSED_ARG(datareader_crypto_handle);
+  DDSRT_UNUSED_ARG(ex);
+  return true;
+}
+
+dds_security_crypto_key_factory* dds_security_crypto_key_factory__alloc(void)
+{
+  dds_security_crypto_key_factory_impl *instance;
+  instance = (dds_security_crypto_key_factory_impl*) ddsrt_malloc(
+      sizeof(dds_security_crypto_key_factory_impl));
+
+  instance->base.register_local_participant = &register_local_participant;
+
+  instance->base.register_matched_remote_participant =
+      &register_matched_remote_participant;
+
+  instance->base.register_local_datawriter = &register_local_datawriter;
+
+  instance->base.register_matched_remote_datareader =
+      &register_matched_remote_datareader;
+
+  instance->base.register_local_datareader = &register_local_datareader;
+
+  instance->base.register_matched_remote_datawriter =
+      &register_matched_remote_datawriter;
+
+  instance->base.unregister_participant = &unregister_participant;
+
+  instance->base.unregister_datawriter = &unregister_datawriter;
+
+  instance->base.unregister_datareader = &unregister_datareader;
+
+  return (dds_security_crypto_key_factory*) instance;
+}
+
+void dds_security_crypto_key_factory__dealloc(
+    dds_security_crypto_key_factory* instance)
+{
+
+  ddsrt_free((dds_security_crypto_key_factory_impl*) instance);
+}
+
+
+
+/**
+ * Implementation structure for storing encapsulated members of the instance
+ * while giving only the interface definition to user
+ */
+
+typedef struct dds_security_crypto_transform_impl {
+  dds_security_crypto_transform base;
+  int member;
+} dds_security_crypto_transform_impl;
+
+/**
+ * Function implementations
+ */
+static DDS_Security_boolean encode_serialized_payload(
+     dds_security_crypto_transform *instance,
+    DDS_Security_OctetSeq *encoded_buffer,
+    DDS_Security_OctetSeq *extra_inline_qos,
+     const DDS_Security_OctetSeq *plain_buffer,
+     const DDS_Security_DatawriterCryptoHandle sending_datawriter_crypto,
+    DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(instance);
+  DDSRT_UNUSED_ARG(encoded_buffer);
+  DDSRT_UNUSED_ARG(extra_inline_qos);
+  DDSRT_UNUSED_ARG(plain_buffer);
+  DDSRT_UNUSED_ARG(sending_datawriter_crypto);
+  DDSRT_UNUSED_ARG(ex);
+
+  return true;
+}
+
+static DDS_Security_boolean encode_datawriter_submessage(
+     dds_security_crypto_transform *instance,
+    DDS_Security_OctetSeq *encoded_rtps_submessage,
+     const DDS_Security_OctetSeq *plain_rtps_submessage,
+     const DDS_Security_DatawriterCryptoHandle sending_datawriter_crypto,
+     const DDS_Security_DatareaderCryptoHandleSeq *receiving_datareader_crypto_list,
+    int32_t *receiving_datareader_crypto_list_index,
+    DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(instance);
+  DDSRT_UNUSED_ARG(encoded_rtps_submessage);
+  DDSRT_UNUSED_ARG(plain_rtps_submessage);
+  DDSRT_UNUSED_ARG(sending_datawriter_crypto);
+  DDSRT_UNUSED_ARG(receiving_datareader_crypto_list);
+  DDSRT_UNUSED_ARG(receiving_datareader_crypto_list_index);
+  DDSRT_UNUSED_ARG(ex);
+
+  return true;
+}
+
+static DDS_Security_boolean encode_datareader_submessage(
+     dds_security_crypto_transform *instance,
+    DDS_Security_OctetSeq *encoded_rtps_submessage,
+     const DDS_Security_OctetSeq *plain_rtps_submessage,
+     const DDS_Security_DatareaderCryptoHandle sending_datareader_crypto,
+     const DDS_Security_DatawriterCryptoHandleSeq *receiving_datawriter_crypto_list,
+    DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(instance);
+  DDSRT_UNUSED_ARG(encoded_rtps_submessage);
+  DDSRT_UNUSED_ARG(plain_rtps_submessage);
+  DDSRT_UNUSED_ARG(sending_datareader_crypto);
+  DDSRT_UNUSED_ARG(receiving_datawriter_crypto_list);
+  DDSRT_UNUSED_ARG(ex);
+
+  return true;
+}
+
+static DDS_Security_boolean encode_rtps_message(  dds_security_crypto_transform *instance,
+    DDS_Security_OctetSeq *encoded_rtps_message,
+     const DDS_Security_OctetSeq *plain_rtps_message,
+     const DDS_Security_ParticipantCryptoHandle sending_participant_crypto,
+     const DDS_Security_ParticipantCryptoHandleSeq *receiving_participant_crypto_list,
+    int32_t *receiving_participant_crypto_list_index,
+    DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(instance);
+  DDSRT_UNUSED_ARG(encoded_rtps_message);
+  DDSRT_UNUSED_ARG(plain_rtps_message);
+  DDSRT_UNUSED_ARG(sending_participant_crypto);
+  DDSRT_UNUSED_ARG(receiving_participant_crypto_list);
+  DDSRT_UNUSED_ARG(receiving_participant_crypto_list_index);
+  DDSRT_UNUSED_ARG(ex);
+
+  return true;
+}
+
+static DDS_Security_boolean decode_rtps_message(  dds_security_crypto_transform *instance,
+    DDS_Security_OctetSeq *plain_buffer,  const DDS_Security_OctetSeq *encoded_buffer,
+     const DDS_Security_ParticipantCryptoHandle receiving_participant_crypto,
+     const DDS_Security_ParticipantCryptoHandle sending_participant_crypto,
+    DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(instance);
+  DDSRT_UNUSED_ARG(plain_buffer);
+  DDSRT_UNUSED_ARG(encoded_buffer);
+  DDSRT_UNUSED_ARG(receiving_participant_crypto);
+  DDSRT_UNUSED_ARG(sending_participant_crypto);
+  DDSRT_UNUSED_ARG(ex);
+
+  return true;
+}
+
+
+static DDS_Security_boolean preprocess_secure_submsg(
+     dds_security_crypto_transform *instance,
+    DDS_Security_DatawriterCryptoHandle *datawriter_crypto,
+    DDS_Security_DatareaderCryptoHandle *datareader_crypto,
+    DDS_Security_SecureSubmessageCategory_t *secure_submessage_category,
+     const DDS_Security_OctetSeq *encoded_rtps_submessage,
+     const DDS_Security_ParticipantCryptoHandle receiving_participant_crypto,
+     const DDS_Security_ParticipantCryptoHandle sending_participant_crypto,
+    DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(instance);
+  DDSRT_UNUSED_ARG(datawriter_crypto);
+  DDSRT_UNUSED_ARG(datareader_crypto);
+  DDSRT_UNUSED_ARG(secure_submessage_category);
+  DDSRT_UNUSED_ARG(encoded_rtps_submessage);
+  DDSRT_UNUSED_ARG(receiving_participant_crypto);
+  DDSRT_UNUSED_ARG(sending_participant_crypto);
+  DDSRT_UNUSED_ARG(ex);
+
+  return true;
+}
+
+static DDS_Security_boolean decode_datawriter_submessage(
+     dds_security_crypto_transform *instance,
+    DDS_Security_OctetSeq *plain_rtps_submessage,
+     const DDS_Security_OctetSeq *encoded_rtps_submessage,
+     const DDS_Security_DatareaderCryptoHandle receiving_datareader_crypto,
+     const DDS_Security_DatawriterCryptoHandle sending_datawriter_crypto,
+    DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(instance);
+  DDSRT_UNUSED_ARG(plain_rtps_submessage);
+  DDSRT_UNUSED_ARG(encoded_rtps_submessage);
+  DDSRT_UNUSED_ARG(receiving_datareader_crypto);
+  DDSRT_UNUSED_ARG(sending_datawriter_crypto);
+  DDSRT_UNUSED_ARG(ex);
+
+  return true;
+}
+
+static DDS_Security_boolean decode_datareader_submessage(
+     dds_security_crypto_transform *instance,
+    DDS_Security_OctetSeq *plain_rtps_message,
+     const DDS_Security_OctetSeq *encoded_rtps_message,
+     const DDS_Security_DatawriterCryptoHandle receiving_datawriter_crypto,
+     const DDS_Security_DatareaderCryptoHandle sending_datareader_crypto,
+    DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(instance);
+  DDSRT_UNUSED_ARG(plain_rtps_message);
+  DDSRT_UNUSED_ARG(encoded_rtps_message);
+  DDSRT_UNUSED_ARG(receiving_datawriter_crypto);
+  DDSRT_UNUSED_ARG(sending_datareader_crypto);
+  DDSRT_UNUSED_ARG(ex);
+
+  return true;
+}
+
+static DDS_Security_boolean decode_serialized_payload(
+     dds_security_crypto_transform *instance,
+    DDS_Security_OctetSeq *plain_buffer,  const DDS_Security_OctetSeq *encoded_buffer,
+     const DDS_Security_OctetSeq *inline_qos,
+     const DDS_Security_DatareaderCryptoHandle receiving_datareader_crypto,
+     const DDS_Security_DatawriterCryptoHandle sending_datawriter_crypto,
+    DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(instance);
+  DDSRT_UNUSED_ARG(plain_buffer);
+  DDSRT_UNUSED_ARG(encoded_buffer);
+  DDSRT_UNUSED_ARG(inline_qos);
+  DDSRT_UNUSED_ARG(receiving_datareader_crypto);
+  DDSRT_UNUSED_ARG(sending_datawriter_crypto);
+  DDSRT_UNUSED_ARG(ex);
+
+  return true;
+}
+
+dds_security_crypto_transform* dds_security_crypto_transform__alloc(void)
+{
+  dds_security_crypto_transform_impl *instance;
+  instance = (dds_security_crypto_transform_impl*) ddsrt_malloc(
+      sizeof(dds_security_crypto_transform_impl));
+
+  memset( instance, 0, sizeof(dds_security_crypto_transform_impl));
+
+  instance->base.encode_datawriter_submessage = &encode_datawriter_submessage;
+
+  instance->base.encode_datareader_submessage = &encode_datareader_submessage;
+
+  instance->base.encode_rtps_message = &encode_rtps_message;
+
+  instance->base.decode_rtps_message = &decode_rtps_message;
+
+  instance->base.preprocess_secure_submsg = &preprocess_secure_submsg;
+
+  instance->base.decode_datawriter_submessage = &decode_datawriter_submessage;
+
+  instance->base.decode_datareader_submessage = &decode_datareader_submessage;
+
+  instance->base.decode_serialized_payload = &decode_serialized_payload;
+
+  instance->base.encode_serialized_payload = &encode_serialized_payload;
+
+  return (dds_security_crypto_transform*) instance;
+}
+
+void dds_security_crypto_transform__dealloc(
+    dds_security_crypto_transform* instance)
+{
+
+  ddsrt_free((dds_security_crypto_transform_impl*) instance);
+}
+
+
diff --git a/src/security/core/tests/plugin_loading/plugin_mock/cryptography_all_ok/mock_cryptography.h b/src/security/core/tests/plugin_loading/plugin_mock/cryptography_all_ok/mock_cryptography.h
new file mode 100644
index 0000000..e532a94
--- /dev/null
+++ b/src/security/core/tests/plugin_loading/plugin_mock/cryptography_all_ok/mock_cryptography.h
@@ -0,0 +1,21 @@
+/*
+ * authentication.h
+ *
+ *  Created on: Jan 15, 2018
+ *      Author: kurtulus oksuztepe
+ */
+
+#ifndef SECURITY_CRYPTO_OK_H_
+#define SECURITY_CRYPTO_OK_H_
+
+#include "dds/security/cryptography_all_ok_export.h"
+#include "dds/security/dds_security_api.h"
+
+SECURITY_EXPORT int32_t
+init_crypto(const char *argument, void **context);
+
+SECURITY_EXPORT int32_t
+finalize_crypto(void *context);
+
+
+#endif /* SECURITY_CRYPTO_OK_H_ */
diff --git a/src/security/core/tests/plugin_loading/plugin_mock/cryptography_missing_function/mock_cryptography.c b/src/security/core/tests/plugin_loading/plugin_mock/cryptography_missing_function/mock_cryptography.c
new file mode 100644
index 0000000..3a72441
--- /dev/null
+++ b/src/security/core/tests/plugin_loading/plugin_mock/cryptography_missing_function/mock_cryptography.c
@@ -0,0 +1,656 @@
+/*
+ * Copyright(c) 2006 to 2019 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+
+#include "dds/security/dds_security_api.h"
+#include "dds/ddsrt/heap.h"
+#include "dds/ddsrt/misc.h"
+#include <stdio.h>
+#include <string.h>
+#include <stdbool.h>
+#include "mock_cryptography.h"
+/**
+ * Implementation structure for storing encapsulated members of the instance
+ * while giving only the interface definition to user
+ */
+
+typedef struct dds_security_cryptography_impl {
+  dds_security_cryptography base;
+  int member;
+} dds_security_cryptography_impl;
+
+
+dds_security_crypto_key_exchange* dds_security_crypto_key_exchange__alloc(void);
+void dds_security_crypto_key_exchange__dealloc(
+    dds_security_crypto_key_exchange* instance);
+
+dds_security_crypto_key_factory* dds_security_crypto_key_factory__alloc(void);
+void dds_security_crypto_key_factory__dealloc(
+    dds_security_crypto_key_factory* instance);
+
+/**
+ * CryptoTransform Interface
+ */
+
+/*
+ * Allocation function for implementer structure (with internal variables) transparently.
+ *
+ */
+
+dds_security_crypto_transform* dds_security_crypto_transform__alloc(void);
+void dds_security_crypto_transform__dealloc(
+    dds_security_crypto_transform* instance);
+
+
+int32_t init_crypto(  const char *argument, void **context)
+{
+
+  dds_security_cryptography_impl *cryptography;
+
+  dds_security_crypto_key_exchange *crypto_key_exchange;
+  dds_security_crypto_key_factory *crypto_key_factory;
+  dds_security_crypto_transform *crypto_transform;
+
+
+  DDSRT_UNUSED_ARG(argument);
+
+  //allocate new instance
+  cryptography = (dds_security_cryptography_impl*) ddsrt_malloc(
+      sizeof(dds_security_cryptography_impl));
+
+  memset( cryptography, 0, sizeof(dds_security_cryptography_impl));
+  //assign the sub components
+  crypto_key_exchange = dds_security_crypto_key_exchange__alloc();
+  crypto_key_factory = dds_security_crypto_key_factory__alloc();
+  crypto_transform = dds_security_crypto_transform__alloc();
+
+
+  cryptography->base.crypto_key_exchange = crypto_key_exchange;
+  cryptography->base.crypto_key_factory = crypto_key_factory;
+  cryptography->base.crypto_transform = crypto_transform;
+
+  //return the instance
+  *context = cryptography;
+  return 0;
+}
+
+int32_t finalize_crypto( void *instance)
+{
+
+  dds_security_cryptography_impl* instance_impl =
+      (dds_security_cryptography_impl*) instance;
+
+  //deallocate components
+  dds_security_crypto_key_exchange__dealloc(
+      instance_impl->base.crypto_key_exchange);
+  dds_security_crypto_key_factory__dealloc(
+      instance_impl->base.crypto_key_factory);
+  dds_security_crypto_transform__dealloc(instance_impl->base.crypto_transform);
+  //deallocate cryptography
+  ddsrt_free(instance_impl);
+
+  return 0;
+}
+
+
+
+
+
+
+/**
+ * Implementation structure for storing encapsulated members of the instance
+ * while giving only the interface definition to user
+ */
+
+typedef struct dds_security_crypto_key_exchange_impl {
+  dds_security_crypto_key_exchange base;
+  int member;
+} dds_security_crypto_key_exchange_impl;
+
+/**
+ * Function implementations
+ */
+static DDS_Security_boolean create_local_participant_crypto_tokens(
+     dds_security_crypto_key_exchange *instance,
+    DDS_Security_ParticipantCryptoTokenSeq *local_participant_crypto_tokens,
+     const DDS_Security_ParticipantCryptoHandle local_participant_crypto,
+     const DDS_Security_ParticipantCryptoHandle remote_participant_crypto,
+    DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(instance);
+  DDSRT_UNUSED_ARG(local_participant_crypto_tokens);
+  DDSRT_UNUSED_ARG(local_participant_crypto);
+  DDSRT_UNUSED_ARG(remote_participant_crypto);
+  DDSRT_UNUSED_ARG(ex);
+  return true;
+
+}
+
+static DDS_Security_boolean create_local_datawriter_crypto_tokens(
+     dds_security_crypto_key_exchange *instance,
+    DDS_Security_DatawriterCryptoTokenSeq *local_datawriter_crypto_tokens,
+     const DDS_Security_DatawriterCryptoHandle local_datawriter_crypto,
+     const DDS_Security_DatareaderCryptoHandle remote_datareader_crypto,
+    DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(instance);
+  DDSRT_UNUSED_ARG(local_datawriter_crypto_tokens);
+  DDSRT_UNUSED_ARG(local_datawriter_crypto);
+  DDSRT_UNUSED_ARG(remote_datareader_crypto);
+  DDSRT_UNUSED_ARG(ex);
+
+  return true;
+}
+
+static DDS_Security_boolean set_remote_datawriter_crypto_tokens(
+     dds_security_crypto_key_exchange *instance,
+     const DDS_Security_DatareaderCryptoHandle local_datareader_crypto,
+     const DDS_Security_DatawriterCryptoHandle remote_datawriter_crypto,
+     const DDS_Security_DatawriterCryptoTokenSeq *remote_datawriter_tokens,
+    DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(instance);
+  DDSRT_UNUSED_ARG(local_datareader_crypto);
+  DDSRT_UNUSED_ARG(remote_datawriter_crypto);
+  DDSRT_UNUSED_ARG(remote_datawriter_tokens);
+  DDSRT_UNUSED_ARG(ex);
+
+  return true;
+}
+
+static DDS_Security_boolean create_local_datareader_crypto_tokens(
+     dds_security_crypto_key_exchange *instance,
+    DDS_Security_DatareaderCryptoTokenSeq *local_datareader_cryto_tokens,
+     const DDS_Security_DatareaderCryptoHandle local_datareader_crypto,
+     const DDS_Security_DatawriterCryptoHandle remote_datawriter_crypto,
+    DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(instance);
+  DDSRT_UNUSED_ARG(local_datareader_cryto_tokens);
+  DDSRT_UNUSED_ARG(local_datareader_crypto);
+  DDSRT_UNUSED_ARG(remote_datawriter_crypto);
+  DDSRT_UNUSED_ARG(ex);
+
+  return true;
+}
+
+static DDS_Security_boolean set_remote_datareader_crypto_tokens(
+     dds_security_crypto_key_exchange *instance,
+     const DDS_Security_DatawriterCryptoHandle local_datawriter_crypto,
+     const DDS_Security_DatareaderCryptoHandle remote_datareader_crypto,
+     const DDS_Security_DatareaderCryptoTokenSeq *remote_datareader_tokens,
+    DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(instance);
+  DDSRT_UNUSED_ARG(local_datawriter_crypto);
+  DDSRT_UNUSED_ARG(remote_datareader_crypto);
+  DDSRT_UNUSED_ARG(remote_datareader_tokens);
+  DDSRT_UNUSED_ARG(ex);
+
+  return true;
+}
+
+static DDS_Security_boolean return_crypto_tokens(
+     dds_security_crypto_key_exchange *instance,
+     DDS_Security_CryptoTokenSeq *crypto_tokens,
+    DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(instance);
+  DDSRT_UNUSED_ARG(crypto_tokens);
+  DDSRT_UNUSED_ARG(ex);
+
+  return true;
+}
+
+dds_security_crypto_key_exchange* dds_security_crypto_key_exchange__alloc(void)
+{
+  dds_security_crypto_key_exchange_impl *instance;
+  instance = (dds_security_crypto_key_exchange_impl*) ddsrt_malloc(
+      sizeof(dds_security_crypto_key_exchange_impl));
+
+  memset( instance, 0, sizeof(dds_security_crypto_key_exchange_impl));
+
+  instance->base.create_local_participant_crypto_tokens =
+      &create_local_participant_crypto_tokens;
+
+  /* Do not assign it for testing purposes
+    instance->base.set_remote_participant_crypto_tokens =
+        &set_remote_participant_crypto_tokens;
+  */
+
+  instance->base.create_local_datawriter_crypto_tokens =
+      &create_local_datawriter_crypto_tokens;
+
+  instance->base.set_remote_datawriter_crypto_tokens =
+      &set_remote_datawriter_crypto_tokens;
+
+  instance->base.create_local_datareader_crypto_tokens =
+      &create_local_datareader_crypto_tokens;
+
+  instance->base.set_remote_datareader_crypto_tokens =
+      &set_remote_datareader_crypto_tokens;
+
+  instance->base.return_crypto_tokens = &return_crypto_tokens;
+
+  return (dds_security_crypto_key_exchange*) instance;
+}
+
+void dds_security_crypto_key_exchange__dealloc(
+    dds_security_crypto_key_exchange* instance)
+{
+
+  ddsrt_free((dds_security_crypto_key_exchange_impl*) instance);
+}
+
+
+
+/**
+ * Implementation structure for storing encapsulated members of the instance
+ * while giving only the interface definition to user
+ */
+
+typedef struct dds_security_crypto_key_factory_impl {
+  dds_security_crypto_key_factory base;
+  int member;
+} dds_security_crypto_key_factory_impl;
+
+/**
+ * Function implementations
+ */
+
+static DDS_Security_ParticipantCryptoHandle register_local_participant(
+     dds_security_crypto_key_factory *instance,
+     const DDS_Security_IdentityHandle participant_identity,
+     const DDS_Security_PermissionsHandle participant_permissions,
+     const DDS_Security_PropertySeq *participant_properties,
+     const DDS_Security_ParticipantSecurityAttributes *participant_security_attributes,
+    DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(instance);
+  DDSRT_UNUSED_ARG(participant_identity);
+  DDSRT_UNUSED_ARG(participant_permissions);
+  DDSRT_UNUSED_ARG(participant_properties);
+  DDSRT_UNUSED_ARG(participant_security_attributes);
+  DDSRT_UNUSED_ARG(ex);
+  return 0;
+}
+
+static DDS_Security_ParticipantCryptoHandle register_matched_remote_participant(
+     dds_security_crypto_key_factory *instance,
+     const DDS_Security_ParticipantCryptoHandle local_participant_crypto_handle,
+     const DDS_Security_IdentityHandle remote_participant_identity,
+     const DDS_Security_PermissionsHandle remote_participant_permissions,
+     const DDS_Security_SharedSecretHandle shared_secret,
+    DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(instance);
+  DDSRT_UNUSED_ARG(local_participant_crypto_handle);
+  DDSRT_UNUSED_ARG(remote_participant_identity);
+  DDSRT_UNUSED_ARG(remote_participant_permissions);
+  DDSRT_UNUSED_ARG(shared_secret);
+  DDSRT_UNUSED_ARG(ex);
+  return 0;
+}
+
+static DDS_Security_DatawriterCryptoHandle register_local_datawriter(
+     dds_security_crypto_key_factory *instance,
+     const DDS_Security_ParticipantCryptoHandle participant_crypto,
+     const DDS_Security_PropertySeq *datawriter_properties,
+     const DDS_Security_EndpointSecurityAttributes *datawriter_security_attributes,
+    DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(instance);
+  DDSRT_UNUSED_ARG(participant_crypto);
+  DDSRT_UNUSED_ARG(datawriter_properties);
+  DDSRT_UNUSED_ARG(datawriter_security_attributes);
+  DDSRT_UNUSED_ARG(ex);
+  return 0;
+}
+
+static DDS_Security_DatareaderCryptoHandle register_matched_remote_datareader(
+     dds_security_crypto_key_factory *instance,
+     const DDS_Security_DatawriterCryptoHandle local_datawritert_crypto_handle,
+     const DDS_Security_ParticipantCryptoHandle remote_participant_crypto,
+     const DDS_Security_SharedSecretHandle shared_secret,
+     const DDS_Security_boolean relay_only,
+    DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(instance);
+  DDSRT_UNUSED_ARG(local_datawritert_crypto_handle);
+  DDSRT_UNUSED_ARG(remote_participant_crypto);
+  DDSRT_UNUSED_ARG(shared_secret);
+  DDSRT_UNUSED_ARG(relay_only);
+  DDSRT_UNUSED_ARG(ex);
+  return 0;
+}
+
+static DDS_Security_DatareaderCryptoHandle register_local_datareader(
+     dds_security_crypto_key_factory *instance,
+     const DDS_Security_ParticipantCryptoHandle participant_crypto,
+     const DDS_Security_PropertySeq *datareader_properties,
+     const DDS_Security_EndpointSecurityAttributes *datareader_security_attributes,
+    DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(instance);
+  DDSRT_UNUSED_ARG(participant_crypto);
+  DDSRT_UNUSED_ARG(datareader_properties);
+  DDSRT_UNUSED_ARG(datareader_security_attributes);
+  DDSRT_UNUSED_ARG(ex);
+
+  return 0;
+}
+
+static DDS_Security_DatawriterCryptoHandle register_matched_remote_datawriter(
+     dds_security_crypto_key_factory *instance,
+     const DDS_Security_DatareaderCryptoHandle local_datareader_crypto_handle,
+     const DDS_Security_ParticipantCryptoHandle remote_participant_crypt,
+     const DDS_Security_SharedSecretHandle shared_secret,
+    DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(instance);
+  DDSRT_UNUSED_ARG(local_datareader_crypto_handle);
+  DDSRT_UNUSED_ARG(remote_participant_crypt);
+  DDSRT_UNUSED_ARG(shared_secret);
+  DDSRT_UNUSED_ARG(ex);
+  return true;
+}
+
+static DDS_Security_boolean unregister_participant(
+     dds_security_crypto_key_factory *instance,
+     const DDS_Security_ParticipantCryptoHandle participant_crypto_handle,
+    DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(instance);
+  DDSRT_UNUSED_ARG(participant_crypto_handle);
+  DDSRT_UNUSED_ARG(ex);
+  return true;
+}
+
+static DDS_Security_boolean unregister_datawriter(
+     dds_security_crypto_key_factory *instance,
+     const DDS_Security_DatawriterCryptoHandle datawriter_crypto_handle,
+    DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(instance);
+  DDSRT_UNUSED_ARG(datawriter_crypto_handle);
+  DDSRT_UNUSED_ARG(ex);
+  return true;
+}
+
+static DDS_Security_boolean unregister_datareader(
+     dds_security_crypto_key_factory *instance,
+     const DDS_Security_DatareaderCryptoHandle datareader_crypto_handle,
+    DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(instance);
+  DDSRT_UNUSED_ARG(datareader_crypto_handle);
+  DDSRT_UNUSED_ARG(ex);
+  return true;
+}
+
+dds_security_crypto_key_factory* dds_security_crypto_key_factory__alloc(void)
+{
+  dds_security_crypto_key_factory_impl *instance;
+  instance = (dds_security_crypto_key_factory_impl*) ddsrt_malloc(
+      sizeof(dds_security_crypto_key_factory_impl));
+
+  memset( instance, 0, sizeof(dds_security_crypto_key_factory_impl));
+  instance->base.register_local_participant = &register_local_participant;
+
+  instance->base.register_matched_remote_participant =
+      &register_matched_remote_participant;
+
+  instance->base.register_local_datawriter = &register_local_datawriter;
+
+  instance->base.register_matched_remote_datareader =
+      &register_matched_remote_datareader;
+
+  instance->base.register_local_datareader = &register_local_datareader;
+
+  instance->base.register_matched_remote_datawriter =
+      &register_matched_remote_datawriter;
+
+  instance->base.unregister_participant = &unregister_participant;
+
+  instance->base.unregister_datawriter = &unregister_datawriter;
+
+  instance->base.unregister_datareader = &unregister_datareader;
+
+  return (dds_security_crypto_key_factory*) instance;
+}
+
+void dds_security_crypto_key_factory__dealloc(
+    dds_security_crypto_key_factory* instance)
+{
+
+  ddsrt_free((dds_security_crypto_key_factory_impl*) instance);
+}
+
+
+
+/**
+ * Implementation structure for storing encapsulated members of the instance
+ * while giving only the interface definition to user
+ */
+
+typedef struct dds_security_crypto_transform_impl {
+  dds_security_crypto_transform base;
+  int member;
+} dds_security_crypto_transform_impl;
+
+/**
+ * Function implementations
+ */
+static DDS_Security_boolean encode_serialized_payload(
+     dds_security_crypto_transform *instance,
+    DDS_Security_OctetSeq *encoded_buffer,
+    DDS_Security_OctetSeq *extra_inline_qos,
+     const DDS_Security_OctetSeq *plain_buffer,
+     const DDS_Security_DatawriterCryptoHandle sending_datawriter_crypto,
+    DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(instance);
+  DDSRT_UNUSED_ARG(encoded_buffer);
+  DDSRT_UNUSED_ARG(extra_inline_qos);
+  DDSRT_UNUSED_ARG(plain_buffer);
+  DDSRT_UNUSED_ARG(sending_datawriter_crypto);
+  DDSRT_UNUSED_ARG(ex);
+
+  return true;
+}
+
+static DDS_Security_boolean encode_datawriter_submessage(
+     dds_security_crypto_transform *instance,
+    DDS_Security_OctetSeq *encoded_rtps_submessage,
+     const DDS_Security_OctetSeq *plain_rtps_submessage,
+     const DDS_Security_DatawriterCryptoHandle sending_datawriter_crypto,
+     const DDS_Security_DatareaderCryptoHandleSeq *receiving_datareader_crypto_list,
+    int32_t *receiving_datareader_crypto_list_index,
+    DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(instance);
+  DDSRT_UNUSED_ARG(encoded_rtps_submessage);
+  DDSRT_UNUSED_ARG(plain_rtps_submessage);
+  DDSRT_UNUSED_ARG(sending_datawriter_crypto);
+  DDSRT_UNUSED_ARG(receiving_datareader_crypto_list);
+  DDSRT_UNUSED_ARG(receiving_datareader_crypto_list_index);
+  DDSRT_UNUSED_ARG(ex);
+
+  return true;
+}
+
+static DDS_Security_boolean encode_datareader_submessage(
+     dds_security_crypto_transform *instance,
+    DDS_Security_OctetSeq *encoded_rtps_submessage,
+     const DDS_Security_OctetSeq *plain_rtps_submessage,
+     const DDS_Security_DatareaderCryptoHandle sending_datareader_crypto,
+     const DDS_Security_DatawriterCryptoHandleSeq *receiving_datawriter_crypto_list,
+    DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(instance);
+  DDSRT_UNUSED_ARG(encoded_rtps_submessage);
+  DDSRT_UNUSED_ARG(plain_rtps_submessage);
+  DDSRT_UNUSED_ARG(sending_datareader_crypto);
+  DDSRT_UNUSED_ARG(receiving_datawriter_crypto_list);
+  DDSRT_UNUSED_ARG(ex);
+
+  return true;
+}
+
+static DDS_Security_boolean encode_rtps_message(  dds_security_crypto_transform *instance,
+    DDS_Security_OctetSeq *encoded_rtps_message,
+     const DDS_Security_OctetSeq *plain_rtps_message,
+     const DDS_Security_ParticipantCryptoHandle sending_participant_crypto,
+     const DDS_Security_ParticipantCryptoHandleSeq *receiving_participant_crypto_list,
+    int32_t *receiving_participant_crypto_list_index,
+    DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(instance);
+  DDSRT_UNUSED_ARG(encoded_rtps_message);
+  DDSRT_UNUSED_ARG(plain_rtps_message);
+  DDSRT_UNUSED_ARG(sending_participant_crypto);
+  DDSRT_UNUSED_ARG(receiving_participant_crypto_list);
+  DDSRT_UNUSED_ARG(receiving_participant_crypto_list_index);
+  DDSRT_UNUSED_ARG(ex);
+
+  return true;
+}
+
+static DDS_Security_boolean decode_rtps_message(  dds_security_crypto_transform *instance,
+    DDS_Security_OctetSeq *plain_buffer,  const DDS_Security_OctetSeq *encoded_buffer,
+     const DDS_Security_ParticipantCryptoHandle receiving_participant_crypto,
+     const DDS_Security_ParticipantCryptoHandle sending_participant_crypto,
+    DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(instance);
+  DDSRT_UNUSED_ARG(plain_buffer);
+  DDSRT_UNUSED_ARG(encoded_buffer);
+  DDSRT_UNUSED_ARG(receiving_participant_crypto);
+  DDSRT_UNUSED_ARG(sending_participant_crypto);
+  DDSRT_UNUSED_ARG(ex);
+
+  return true;
+}
+
+static DDS_Security_boolean preprocess_secure_submsg(
+     dds_security_crypto_transform *instance,
+    DDS_Security_DatawriterCryptoHandle *datawriter_crypto,
+    DDS_Security_DatareaderCryptoHandle *datareader_crypto,
+    DDS_Security_SecureSubmessageCategory_t *secure_submessage_category,
+     const DDS_Security_OctetSeq *encoded_rtps_submessage,
+     const DDS_Security_ParticipantCryptoHandle receiving_participant_crypto,
+     const DDS_Security_ParticipantCryptoHandle sending_participant_crypto,
+    DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(instance);
+  DDSRT_UNUSED_ARG(datawriter_crypto);
+  DDSRT_UNUSED_ARG(datareader_crypto);
+  DDSRT_UNUSED_ARG(secure_submessage_category);
+  DDSRT_UNUSED_ARG(encoded_rtps_submessage);
+  DDSRT_UNUSED_ARG(receiving_participant_crypto);
+  DDSRT_UNUSED_ARG(sending_participant_crypto);
+  DDSRT_UNUSED_ARG(ex);
+
+  return true;
+}
+
+static DDS_Security_boolean decode_datawriter_submessage(
+     dds_security_crypto_transform *instance,
+    DDS_Security_OctetSeq *plain_rtps_submessage,
+     const DDS_Security_OctetSeq *encoded_rtps_submessage,
+     const DDS_Security_DatareaderCryptoHandle receiving_datareader_crypto,
+     const DDS_Security_DatawriterCryptoHandle sending_datawriter_crypto,
+    DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(instance);
+  DDSRT_UNUSED_ARG(plain_rtps_submessage);
+  DDSRT_UNUSED_ARG(encoded_rtps_submessage);
+  DDSRT_UNUSED_ARG(receiving_datareader_crypto);
+  DDSRT_UNUSED_ARG(sending_datawriter_crypto);
+  DDSRT_UNUSED_ARG(ex);
+
+  return true;
+}
+
+static DDS_Security_boolean decode_datareader_submessage(
+     dds_security_crypto_transform *instance,
+    DDS_Security_OctetSeq *plain_rtps_message,
+     const DDS_Security_OctetSeq *encoded_rtps_message,
+     const DDS_Security_DatawriterCryptoHandle receiving_datawriter_crypto,
+     const DDS_Security_DatareaderCryptoHandle sending_datareader_crypto,
+    DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(instance);
+  DDSRT_UNUSED_ARG(plain_rtps_message);
+  DDSRT_UNUSED_ARG(encoded_rtps_message);
+  DDSRT_UNUSED_ARG(receiving_datawriter_crypto);
+  DDSRT_UNUSED_ARG(sending_datareader_crypto);
+  DDSRT_UNUSED_ARG(ex);
+
+  return true;
+}
+
+static DDS_Security_boolean decode_serialized_payload(
+     dds_security_crypto_transform *instance,
+    DDS_Security_OctetSeq *plain_buffer,  const DDS_Security_OctetSeq *encoded_buffer,
+     const DDS_Security_OctetSeq *inline_qos,
+     const DDS_Security_DatareaderCryptoHandle receiving_datareader_crypto,
+     const DDS_Security_DatawriterCryptoHandle sending_datawriter_crypto,
+    DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(instance);
+  DDSRT_UNUSED_ARG(plain_buffer);
+  DDSRT_UNUSED_ARG(encoded_buffer);
+  DDSRT_UNUSED_ARG(inline_qos);
+  DDSRT_UNUSED_ARG(receiving_datareader_crypto);
+  DDSRT_UNUSED_ARG(sending_datawriter_crypto);
+  DDSRT_UNUSED_ARG(ex);
+
+  return true;
+}
+
+dds_security_crypto_transform* dds_security_crypto_transform__alloc(void)
+{
+  dds_security_crypto_transform_impl *instance;
+  instance = (dds_security_crypto_transform_impl*) ddsrt_malloc(
+      sizeof(dds_security_crypto_transform_impl));
+
+
+
+  instance->base.encode_datawriter_submessage = &encode_datawriter_submessage;
+
+  instance->base.encode_datareader_submessage = &encode_datareader_submessage;
+
+  instance->base.encode_rtps_message = &encode_rtps_message;
+
+  instance->base.decode_rtps_message = &decode_rtps_message;
+
+  instance->base.preprocess_secure_submsg = &preprocess_secure_submsg;
+
+  instance->base.decode_datawriter_submessage = &decode_datawriter_submessage;
+
+  instance->base.decode_datareader_submessage = &decode_datareader_submessage;
+
+  instance->base.decode_serialized_payload = &decode_serialized_payload;
+
+  instance->base.encode_serialized_payload = &encode_serialized_payload;
+
+  return (dds_security_crypto_transform*) instance;
+}
+
+void dds_security_crypto_transform__dealloc(
+    dds_security_crypto_transform* instance)
+{
+
+  ddsrt_free((dds_security_crypto_transform_impl*) instance);
+}
+
+
diff --git a/src/security/core/tests/plugin_loading/plugin_mock/cryptography_missing_function/mock_cryptography.h b/src/security/core/tests/plugin_loading/plugin_mock/cryptography_missing_function/mock_cryptography.h
new file mode 100644
index 0000000..2908eeb
--- /dev/null
+++ b/src/security/core/tests/plugin_loading/plugin_mock/cryptography_missing_function/mock_cryptography.h
@@ -0,0 +1,26 @@
+/*
+ * Copyright(c) 2006 to 2019 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+
+#ifndef SECURITY_CRYPTO_MISSING_H_
+#define SECURITY_CRYPTO_MISSING_H_
+
+#include "dds/security/cryptography_missing_function_export.h"
+#include "dds/security/dds_security_api.h"
+
+SECURITY_EXPORT int32_t
+init_crypto(const char *argument, void **context);
+
+SECURITY_EXPORT int32_t
+finalize_crypto(void *context);
+
+
+#endif /* SECURITY_CRYPTO_MISSING_H_ */

From 3c407a5d68553ef7d6997e9d242cd289dfcdfabb Mon Sep 17 00:00:00 2001
From: Erik Boasson <eb@ilities.com>
Date: Thu, 9 Jan 2020 14:57:42 +0100
Subject: [PATCH 085/238] Fix tracing discovery of a non-secure participant

Use DISCOVERY instead of INFO (which ends up in the log, and so by
default on stderr).

Signed-off-by: Erik Boasson <eb@ilities.com>
---
 src/core/ddsi/src/q_entity.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/core/ddsi/src/q_entity.c b/src/core/ddsi/src/q_entity.c
index 264ca47..53f215e 100644
--- a/src/core/ddsi/src/q_entity.c
+++ b/src/core/ddsi/src/q_entity.c
@@ -4734,7 +4734,7 @@ void new_proxy_participant
      */
     entidx_insert_proxy_participant_guid (gv->entity_index, proxypp);
     add_proxy_builtin_endpoints(gv, ppguid, proxypp, timestamp);
-    DDS_CLOG (DDS_LC_INFO, &gv->logconfig, "Un-secure participant "PGUIDFMT" tries to connect.\n", PGUID (*ppguid));
+    ELOGDISC (proxypp, "Un-secure participant "PGUIDFMT" tries to connect.\n", PGUID (*ppguid));
   }
 #else
   /* Proxy participant must be in the hash tables for new_proxy_{writer,reader} to work */

From 37db2dc6c37679ad9195cf3df50702d39ef5ec94 Mon Sep 17 00:00:00 2001
From: Erik Boasson <eb@ilities.com>
Date: Thu, 9 Jan 2020 15:04:07 +0100
Subject: [PATCH 086/238] Update XSD

Signed-off-by: Erik Boasson <eb@ilities.com>
---
 etc/cyclonedds.xsd | 428 +++++++++++++++++++++++++++++++++++++++++++--
 1 file changed, 414 insertions(+), 14 deletions(-)

diff --git a/etc/cyclonedds.xsd b/etc/cyclonedds.xsd
index 867f95b..3bd9a64 100644
--- a/etc/cyclonedds.xsd
+++ b/etc/cyclonedds.xsd
@@ -7,7 +7,7 @@ CycloneDDS configuration</xs:documentation>
     </xs:annotation>
     <xs:complexType>
       <xs:sequence>
-        <xs:element minOccurs="0" ref="config:Domain"/>
+        <xs:element minOccurs="0" maxOccurs="unbounded" ref="config:Domain"/>
       </xs:sequence>
     </xs:complexType>
   </xs:element>
@@ -17,17 +17,18 @@ CycloneDDS configuration</xs:documentation>
 &lt;p&gt;The General element specifying Domain related settings.&lt;/p&gt;</xs:documentation>
     </xs:annotation>
     <xs:complexType>
-      <xs:all>
-        <xs:element minOccurs="0" ref="config:Compatibility"/>
-        <xs:element minOccurs="0" ref="config:Discovery"/>
-        <xs:element minOccurs="0" ref="config:General"/>
-        <xs:element minOccurs="0" ref="config:Internal"/>
-        <xs:element minOccurs="0" ref="config:Partitioning"/>
-        <xs:element minOccurs="0" ref="config:SSL"/>
-        <xs:element minOccurs="0" ref="config:Sizing"/>
-        <xs:element minOccurs="0" ref="config:TCP"/>
-        <xs:element minOccurs="0" ref="config:ThreadPool"/>
-        <xs:element minOccurs="0" name="Threads">
+      <xs:choice minOccurs="0" maxOccurs="unbounded">
+        <xs:element ref="config:Compatibility"/>
+        <xs:element ref="config:DDSSecurity"/>
+        <xs:element ref="config:Discovery"/>
+        <xs:element ref="config:General"/>
+        <xs:element ref="config:Internal"/>
+        <xs:element ref="config:Partitioning"/>
+        <xs:element ref="config:SSL"/>
+        <xs:element ref="config:Sizing"/>
+        <xs:element ref="config:TCP"/>
+        <xs:element ref="config:ThreadPool"/>
+        <xs:element name="Threads">
           <xs:annotation>
             <xs:documentation>
 &lt;p&gt;This element is used to set thread properties.&lt;/p&gt;</xs:documentation>
@@ -38,8 +39,8 @@ CycloneDDS configuration</xs:documentation>
             </xs:sequence>
           </xs:complexType>
         </xs:element>
-        <xs:element minOccurs="0" ref="config:Tracing"/>
-      </xs:all>
+        <xs:element ref="config:Tracing"/>
+      </xs:choice>
       <xs:attribute name="Id">
         <xs:annotation>
           <xs:documentation>
@@ -146,6 +147,405 @@ though there is no good reason not to.&lt;/li&gt;&lt;/ul&gt;
       </xs:restriction>
     </xs:simpleType>
   </xs:element>
+  <xs:element name="DDSSecurity">
+    <xs:annotation>
+      <xs:documentation>
+&lt;p&gt;This element is used to configure Cyclone DDS with the DDS Security
+specification plugins and settings.&lt;/p&gt;</xs:documentation>
+    </xs:annotation>
+    <xs:complexType>
+      <xs:all>
+        <xs:element minOccurs="0" ref="config:AccessControl"/>
+        <xs:element minOccurs="0" ref="config:Authentication"/>
+        <xs:element minOccurs="0" ref="config:Cryptographic"/>
+      </xs:all>
+    </xs:complexType>
+  </xs:element>
+  <xs:element name="AccessControl">
+    <xs:annotation>
+      <xs:documentation>
+&lt;p&gt;This element configures the Access Control plugin of the DDS Security
+specification.&lt;/p&gt;</xs:documentation>
+    </xs:annotation>
+    <xs:complexType>
+      <xs:all>
+        <xs:element minOccurs="0" ref="config:Governance"/>
+        <xs:element minOccurs="0" name="Library">
+          <xs:annotation>
+            <xs:documentation>
+RELOFF (cfg.access_control_plugin), pf_string, BLURB("&lt;p&gt;This element
+specifies the library to be loaded as the DDS Security Access Control
+plugin.&lt;/p&gt;</xs:documentation>
+          </xs:annotation>
+          <xs:complexType>
+            <xs:all>
+              <xs:element minOccurs="0" name="finalizeFunction">
+                <xs:annotation>
+                  <xs:documentation>
+RELOFF (cfg.access_control_plugin.library_finalize), pf_string,
+BLURB("&lt;p&gt;This element names the finalization function of Access Control
+plugin. This function is called to let the plugin release its
+resources.&lt;/p&gt;</xs:documentation>
+                </xs:annotation>
+                <xs:complexType/>
+              </xs:element>
+              <xs:element minOccurs="0" name="initFunction">
+                <xs:annotation>
+                  <xs:documentation>
+RELOFF (cfg.access_control_plugin.library_init), pf_string,
+BLURB("&lt;p&gt;This element names the initialization function of Access
+Control plugin. This function is called after loading the plugin library
+for instantiation purposes. Init function must return an object that
+implements DDS Security Access Control interface.&lt;/p&gt;</xs:documentation>
+                </xs:annotation>
+                <xs:complexType/>
+              </xs:element>
+              <xs:element minOccurs="0" name="path">
+                <xs:annotation>
+                  <xs:documentation>
+RELOFF (cfg.access_control_plugin.library_path), pf_string,
+BLURB("&lt;p&gt;This element points to the path of Access Control plugin
+library.&lt;/p&gt;
+
+&lt;p&gt;It can be either absolute path excluding file extension (
+/usr/lib/dds_security_ac ) or single file without extension (
+dds_security_ac ).&lt;/p&gt;
+
+&lt;p&gt;If single file is supplied, the library located by way of the current
+working directory, or LD_LIBRARY_PATH for Unix systems, and PATH for
+Windows systems.&lt;/p&gt;</xs:documentation>
+                </xs:annotation>
+                <xs:complexType/>
+              </xs:element>
+            </xs:all>
+          </xs:complexType>
+        </xs:element>
+        <xs:element minOccurs="0" ref="config:Permissions"/>
+        <xs:element minOccurs="0" ref="config:PermissionsCA"/>
+      </xs:all>
+    </xs:complexType>
+  </xs:element>
+  <xs:element name="Governance">
+    <xs:annotation>
+      <xs:documentation>
+RELOFF (cfg.access_control_properties.governance), pf_string,
+BLURB("&lt;p&gt;URI to the shared Governance Document signed by the Permissions
+CA in S/MIME format&lt;/p&gt;
+
+&lt;p&gt;URI schemes: file, data&lt;/p&gt;&lt;br&gt;
+
+&lt;p&gt;Examples file URIs:&lt;/p&gt;
+
+&lt;p&gt;&lt;Governance&gt;file:governance.smime&lt;/Governance&gt;&lt;/p&gt;
+
+&lt;p&gt;&lt;Governance&gt;file:/home/myuser/governance.smime&lt;/Governance&gt;&lt;/p&gt;&lt;br&gt;
+
+&lt;p&gt;&lt;Governance&gt;&lt;![CDATA[data:,MIME-Version: 1.0&lt;/p&gt;
+
+&lt;p&gt;Content-Type: multipart/signed;
+protocol="application/x-pkcs7-signature"; micalg="sha-256";
+boundary="----F9A8A198D6F08E1285A292ADF14DD04F"&lt;/p&gt;
+
+&lt;p&gt;This is an S/MIME signed message &lt;/p&gt;
+
+&lt;p&gt;------F9A8A198D6F08E1285A292ADF14DD04F&lt;/p&gt;
+
+&lt;p&gt;&lt;?xml version="1.0" encoding="UTF-8"?&gt;&lt;/p&gt;
+
+&lt;p&gt;&lt;dds xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"&lt;/p&gt;
+
+&lt;p&gt;xsi:noNamespaceSchemaLocation="omg_shared_ca_governance.xsd"&gt;&lt;/p&gt;
+
+&lt;p&gt;&lt;domain_access_rules&gt;&lt;/p&gt;
+
+&lt;p&gt; . . . &lt;/p&gt;
+
+&lt;p&gt;&lt;/domain_access_rules&gt;&lt;/p&gt;
+
+&lt;p&gt;&lt;/dds&gt;&lt;/p&gt;
+
+&lt;p&gt;...&lt;/p&gt;
+
+&lt;p&gt;------F9A8A198D6F08E1285A292ADF14DD04F&lt;/p&gt;
+
+&lt;p&gt;Content-Type: application/x-pkcs7-signature; name="smime.p7s"&lt;/p&gt;
+
+&lt;p&gt;Content-Transfer-Encoding: base64&lt;/p&gt;
+
+&lt;p&gt;Content-Disposition: attachment; filename="smime.p7s"&lt;/p&gt;
+
+&lt;p&gt;MIIDuAYJKoZIhv ...al5s=&lt;/p&gt;
+
+&lt;p&gt;------F9A8A198D6F08E1285A292ADF14DD04F-]]&lt;/Governance&gt;&lt;/p&gt;</xs:documentation>
+    </xs:annotation>
+    <xs:complexType/>
+  </xs:element>
+  <xs:element name="Permissions">
+    <xs:annotation>
+      <xs:documentation>
+RELOFF (cfg.access_control_properties.permissions), pf_string,
+BLURB("&lt;p&gt;URI to the DomainParticipant permissions document signed by the
+Permissions CA in S/MIME format&lt;/p&gt;
+
+&lt;p&gt;The permissions document specifies the permissions to be applied to a
+domain.&lt;/p&gt;&lt;br&gt;
+
+&lt;p&gt;Example file URIs:&lt;/p&gt;
+
+&lt;p&gt;&lt;Permissions&gt;file:permissions_document.p7s&lt;/Permissions&gt;&lt;/p&gt;
+
+&lt;p&gt;&lt;Permissions&gt;file:/path_to/permissions_document.p7s&lt;/Permissions&gt;&lt;/p&gt;
+
+&lt;p&gt;Example data URI:&lt;/p&gt;
+
+&lt;p&gt;&lt;Permissions&gt;&lt;![CDATA[data:,.........]]&lt;/Permissions&gt;&lt;/p&gt;</xs:documentation>
+    </xs:annotation>
+    <xs:complexType/>
+  </xs:element>
+  <xs:element name="PermissionsCA">
+    <xs:annotation>
+      <xs:documentation>
+RELOFF (cfg.access_control_properties.permissions_ca), pf_string,
+BLURB("&lt;p&gt;URI to a X509 certificate for the PermissionsCA in PEM
+format.&lt;/p&gt;
+
+&lt;p&gt;Supported URI schemes: file, data&lt;/p&gt;
+
+&lt;p&gt;The file and data schemas shall refer to a X.509 v3 certificate (see
+X.509 v3 ITU-T Recommendation X.509 (2005) [39]) in PEM format.&lt;/p&gt;&lt;br&gt;
+
+&lt;p&gt;Examples:&lt;/p&gt;&lt;br&gt;
+
+&lt;p&gt;&lt;PermissionsCA&gt;file:permissions_ca.pem&lt;/PermissionsCA&gt;&lt;/p&gt;
+
+&lt;p&gt;&lt;PermissionsCA&gt;file:/home/myuser/permissions_ca.pem&lt;/PermissionsCA&gt;&lt;/p&gt;&lt;br&gt;
+
+&lt;p&gt;&lt;PermissionsCA&gt;data:&lt;strong&gt;,&lt;/strong&gt;-----BEGIN CERTIFICATE-----&lt;/p&gt;
+
+&lt;p&gt;MIIC3DCCAcQCCQCWE5x+Z ... PhovK0mp2ohhRLYI0ZiyYQ==&lt;/p&gt;
+
+&lt;p&gt;-----END CERTIFICATE-----&lt;/PermissionsCA&gt;&lt;/p&gt;</xs:documentation>
+    </xs:annotation>
+    <xs:complexType/>
+  </xs:element>
+  <xs:element name="Authentication">
+    <xs:annotation>
+      <xs:documentation>
+&lt;p&gt;This element configures the Authentication plugin of the DDS Security
+specification.&lt;/p&gt;</xs:documentation>
+    </xs:annotation>
+    <xs:complexType>
+      <xs:all>
+        <xs:element minOccurs="0" ref="config:IdentityCA"/>
+        <xs:element minOccurs="0" ref="config:IdentityCertificate"/>
+        <xs:element minOccurs="0" name="Library">
+          <xs:annotation>
+            <xs:documentation>
+RELOFF (cfg.authentication_plugin), pf_string, BLURB("&lt;p&gt;This element
+specifies the library to be loaded as the DDS Security Access Control
+plugin.&lt;/p&gt;</xs:documentation>
+          </xs:annotation>
+          <xs:complexType>
+            <xs:all>
+              <xs:element minOccurs="0" name="finalizeFunction">
+                <xs:annotation>
+                  <xs:documentation>
+RELOFF (cfg.authentication_plugin.library_finalize), pf_string,
+BLURB("&lt;p&gt;This element names the finalization function of Authentication
+plugin. This function is called to let the plugin release its
+resources.&lt;/p&gt;</xs:documentation>
+                </xs:annotation>
+                <xs:complexType/>
+              </xs:element>
+              <xs:element minOccurs="0" name="initFunction">
+                <xs:annotation>
+                  <xs:documentation>
+RELOFF (cfg.authentication_plugin.library_init), pf_string,
+BLURB("&lt;p&gt;This element names the initialization function of
+Authentication plugin. This function is called after loading the plugin
+library for instantiation purposes. Init function must return an object
+that implements DDS Security Authentication interface.&lt;/p&gt;</xs:documentation>
+                </xs:annotation>
+                <xs:complexType/>
+              </xs:element>
+              <xs:element minOccurs="0" name="path">
+                <xs:annotation>
+                  <xs:documentation>
+RELOFF (cfg.authentication_plugin.library_path), pf_string,
+BLURB("&lt;p&gt;This element points to the path of Authentication plugin
+library.&lt;/p&gt;
+
+&lt;p&gt;It can be either absolute path excluding file extension (
+/usr/lib/dds_security_auth ) or single file without extension (
+dds_security_auth ).&lt;/p&gt;
+
+&lt;p&gt;If single file is supplied, the library located by way of the current
+working directory, or LD_LIBRARY_PATH for Unix systems, and PATH for
+Windows systems.&lt;/p&gt;</xs:documentation>
+                </xs:annotation>
+                <xs:complexType/>
+              </xs:element>
+            </xs:all>
+          </xs:complexType>
+        </xs:element>
+        <xs:element minOccurs="0" ref="config:Password"/>
+        <xs:element minOccurs="0" ref="config:PrivateKey"/>
+        <xs:element minOccurs="0" ref="config:TrustedCADirectory"/>
+      </xs:all>
+    </xs:complexType>
+  </xs:element>
+  <xs:element name="IdentityCA">
+    <xs:annotation>
+      <xs:documentation>
+RELOFF (cfg.authentication_properties.identity_ca), pf_string,
+BLURB("&lt;p&gt;URI to the X509 certificate [39] of the Identity CA that is the
+signer of Identity Certificate.&lt;/p&gt;
+
+&lt;p&gt;Supported URI schemes: file, data&lt;/p&gt;
+
+&lt;p&gt;The file and data schemas shall refer to a X.509 v3 certificate (see
+X.509 v3 ITU-T Recommendation X.509 (2005) [39]) in PEM format.&lt;/p&gt;
+
+&lt;p&gt;Examples:&lt;/p&gt;
+
+&lt;p&gt;&lt;IdentityCA&gt;file:identity_ca.pem&lt;/IdentityCA&gt;&lt;/p&gt;
+
+&lt;p&gt;&lt;IdentityCA&gt;data:,-----BEGIN CERTIFICATE-----&lt;br&gt;
+
+MIIC3DCCAcQCCQCWE5x+Z...PhovK0mp2ohhRLYI0ZiyYQ==&lt;br&gt;
+
+-----END CERTIFICATE-----&lt;/IdentityCA&gt;&lt;/p&gt;</xs:documentation>
+    </xs:annotation>
+    <xs:complexType/>
+  </xs:element>
+  <xs:element name="IdentityCertificate">
+    <xs:annotation>
+      <xs:documentation>
+RELOFF (cfg.authentication_properties.identity_certificate), pf_string,
+BLURB("&lt;p&gt;Identity certificate that will be used for identifying all
+participants in the OSPL instance.&lt;br&gt;The content is URI to a X509
+certificate signed by the IdentityCA in PEM format containing the signed
+public key.&lt;/p&gt;
+
+&lt;p&gt;Supported URI schemes: file, data&lt;/p&gt;
+
+&lt;p&gt;Examples:&lt;/p&gt;
+
+&lt;p&gt;&lt;IdentityCertificate&gt;file:participant1_identity_cert.pem&lt;/IdentityCertificate&gt;&lt;/p&gt;
+
+&lt;p&gt;&lt;IdentityCertificate&gt;data:,-----BEGIN CERTIFICATE-----&lt;br&gt;
+
+MIIDjjCCAnYCCQDCEu9...6rmT87dhTo=&lt;br&gt;
+
+-----END CERTIFICATE-----&lt;/IdentityCertificate&gt;&lt;/p&gt;</xs:documentation>
+    </xs:annotation>
+    <xs:complexType/>
+  </xs:element>
+  <xs:element name="Password">
+    <xs:annotation>
+      <xs:documentation>
+RELOFF (cfg.authentication_properties.password), pf_string, BLURB("&lt;p&gt;A
+password used to decrypt the private_key.&lt;/p&gt;
+
+The value of the password property shall be interpreted as the Base64
+encoding of the AES-128 key that shall be used to decrypt the private_key
+using AES128-CBC.&lt;/p&gt;
+
+If the password property is not present, then the value supplied in the
+private_key property must contain the unencrypted private key. &lt;/p&gt;</xs:documentation>
+    </xs:annotation>
+    <xs:complexType/>
+  </xs:element>
+  <xs:element name="PrivateKey">
+    <xs:annotation>
+      <xs:documentation>
+RELOFF (cfg.authentication_properties.private_key), pf_string,
+BLURB("&lt;p&gt;URI to access the private Private Key for all of the
+participants in the OSPL federation.&lt;/p&gt;
+
+&lt;p&gt;Supported URI schemes: file, data&lt;/p&gt;
+
+&lt;p&gt;Examples:&lt;/p&gt;
+
+&lt;p&gt;&lt;PrivateKey&gt;file:identity_ca_private_key.pem&lt;/PrivateKey&gt;&lt;/p&gt;
+
+&lt;p&gt;&lt;PrivateKey&gt;data:,-----BEGIN RSA PRIVATE KEY-----&lt;br&gt;
+
+MIIEpAIBAAKCAQEA3HIh...AOBaaqSV37XBUJg==&lt;br&gt;
+
+-----END RSA PRIVATE KEY-----&lt;/PrivateKey&gt;&lt;/p&gt;</xs:documentation>
+    </xs:annotation>
+    <xs:complexType/>
+  </xs:element>
+  <xs:element name="TrustedCADirectory">
+    <xs:annotation>
+      <xs:documentation>
+RELOFF (cfg.authentication_properties.trusted_ca_dir), pf_string,
+BLURB("&lt;p&gt;Trusted CA Directory which contains trusted CA certificates as
+separated files.&lt;/p&gt;</xs:documentation>
+    </xs:annotation>
+    <xs:complexType/>
+  </xs:element>
+  <xs:element name="Cryptographic">
+    <xs:annotation>
+      <xs:documentation>
+&lt;p&gt;This element configures the Cryptographic plugin of the DDS Security
+specification.&lt;/p&gt;</xs:documentation>
+    </xs:annotation>
+    <xs:complexType>
+      <xs:sequence>
+        <xs:element minOccurs="0" name="Library">
+          <xs:annotation>
+            <xs:documentation>
+RELOFF (cfg.cryptography_plugin), pf_string, BLURB("&lt;p&gt;This element
+specifies the library to be loaded as the DDS Security Cryptographic
+plugin.&lt;/p&gt;</xs:documentation>
+          </xs:annotation>
+          <xs:complexType>
+            <xs:all>
+              <xs:element minOccurs="0" name="finalizeFunction">
+                <xs:annotation>
+                  <xs:documentation>
+RELOFF (cfg.cryptography_plugin.library_finalize), pf_string,
+BLURB("&lt;p&gt;This element names the finalization function of Cryptographic
+plugin. This function is called to let the plugin release its
+resources.&lt;/p&gt;</xs:documentation>
+                </xs:annotation>
+                <xs:complexType/>
+              </xs:element>
+              <xs:element minOccurs="0" name="initFunction">
+                <xs:annotation>
+                  <xs:documentation>
+RELOFF (cfg.cryptography_plugin.library_init), pf_string, BLURB("&lt;p&gt;This
+element names the initialization function of Cryptographic plugin. This
+function is called after loading the plugin library for instantiation
+purposes. Init function must return an object that implements DDS
+Security Cryptographic interface.&lt;/p&gt;</xs:documentation>
+                </xs:annotation>
+                <xs:complexType/>
+              </xs:element>
+              <xs:element minOccurs="0" name="path">
+                <xs:annotation>
+                  <xs:documentation>
+RELOFF (cfg.cryptography_plugin.library_path), pf_string, BLURB("&lt;p&gt;This
+element points to the path of Cryptographic plugin library.&lt;/p&gt;
+
+&lt;p&gt;It can be either absolute path excluding file extension (
+/usr/lib/dds_security_crypto ) or single file without extension (
+dds_security_crypto ).&lt;/p&gt;
+
+&lt;p&gt;If single file is supplied, the library located by way of the current
+working directory, or LD_LIBRARY_PATH for Unix systems, and PATH for
+Windows systems.&lt;/p&gt;</xs:documentation>
+                </xs:annotation>
+                <xs:complexType/>
+              </xs:element>
+            </xs:all>
+          </xs:complexType>
+        </xs:element>
+      </xs:sequence>
+    </xs:complexType>
+  </xs:element>
   <xs:element name="Discovery">
     <xs:annotation>
       <xs:documentation>

From 5748f72c9027e9b9e6780ec0eef3aca1232b7595 Mon Sep 17 00:00:00 2001
From: Erik Boasson <eb@ilities.com>
Date: Fri, 10 Jan 2020 15:16:47 +0100
Subject: [PATCH 087/238] Clean up plugin loading

Signed-off-by: Erik Boasson <eb@ilities.com>
---
 src/core/ddsc/tests/lifespan.c                |    2 +-
 .../ddsi/include/dds/ddsi/ddsi_security_omg.h |   32 +-
 src/core/ddsi/include/dds/ddsi/q_globals.h    |    1 -
 src/core/ddsi/src/ddsi_security_omg.c         | 1605 +++++++----------
 src/core/ddsi/src/q_init.c                    |    2 +-
 src/core/ddsi/src/q_receive.c                 |    2 +-
 .../cryptographic/src/crypto_defs.h           |    2 +-
 .../tests/common/src/crypto_helper.h          |    3 +-
 .../tests/common/src/handshake_helper.h       |    2 +-
 .../src/validate_local_identity_utests.c      |    2 +-
 .../dds/security/core/dds_security_plugins.h  |   11 +-
 src/security/core/src/dds_security_plugins.c  |  550 +++---
 12 files changed, 898 insertions(+), 1316 deletions(-)

diff --git a/src/core/ddsc/tests/lifespan.c b/src/core/ddsc/tests/lifespan.c
index 7190a71..fea4079 100644
--- a/src/core/ddsc/tests/lifespan.c
+++ b/src/core/ddsc/tests/lifespan.c
@@ -161,4 +161,4 @@ CU_Test(ddsc_lifespan, basic, .init=lifespan_init, .fini=lifespan_fini)
   check_whc_state(g_writer, -1, -1);
 
   dds_delete_qos(qos);
-}
\ No newline at end of file
+}
diff --git a/src/core/ddsi/include/dds/ddsi/ddsi_security_omg.h b/src/core/ddsi/include/dds/ddsi/ddsi_security_omg.h
index db0514e..220c29b 100644
--- a/src/core/ddsi/include/dds/ddsi/ddsi_security_omg.h
+++ b/src/core/ddsi/include/dds/ddsi/ddsi_security_omg.h
@@ -181,7 +181,7 @@ is_proxy_participant_deletion_allowed(
  */
 bool
 q_omg_security_is_remote_rtps_protected(
-  struct proxy_participant *proxy_pp,
+  const struct proxy_participant *proxy_pp,
   ddsi_entityid_t entityid);
 
 /**
@@ -197,7 +197,7 @@ q_omg_security_is_remote_rtps_protected(
  */
 bool
 q_omg_security_is_local_rtps_protected(
-  struct participant *pp,
+  const struct participant *pp,
   ddsi_entityid_t entityid);
 
 /**
@@ -256,10 +256,10 @@ q_omg_security_encode_rtps_message(
   int64_t                 src_handle,
   ddsi_guid_t            *src_guid,
   const unsigned char    *src_buf,
-  const unsigned int      src_len,
-  unsigned char        **dst_buf,
-  unsigned int          *dst_len,
-  int64_t                dst_handle);
+  size_t                  src_len,
+  unsigned char         **dst_buf,
+  size_t                 *dst_len,
+  int64_t                 dst_handle);
 
 /**
  * @brief Encode payload when necessary.
@@ -406,8 +406,8 @@ bool
 validate_msg_decoding(
   const struct entity_common *e,
   const struct proxy_endpoint_common *c,
-  struct proxy_participant *proxypp,
-  struct receiver_state *rst,
+  const struct proxy_participant *proxypp,
+  const struct receiver_state *rst,
   SubmessageKind_t prev_smid);
 
 /**
@@ -426,13 +426,13 @@ validate_msg_decoding(
  * @param[in]     dst_prefix  Prefix of the destination entity.
  * @param[in]     byteswap    Do the bytes need swapping?
  *
- * @returns int
- * @retval >= 0   Decoding succeeded.
- * @retval <  0   Decoding failed.
+ * @returns bool
+ * @retval true   Decoding succeeded.
+ * @retval false  Decoding failed.
  */
-int
+bool
 decode_SecPrefix(
-  struct receiver_state *rst,
+  const struct receiver_state *rst,
   unsigned char *submsg,
   size_t submsg_size,
   unsigned char * const msg_end,
@@ -500,7 +500,7 @@ secure_conn_write(
     bool dst_one,
     nn_msg_sec_info_t *sec_info,
     ddsi_tran_write_fn_t conn_write_cb);
-    
+
 
 /**
  * @brief Loads the security plugins with the given configuration.
@@ -518,12 +518,12 @@ secure_conn_write(
 dds_return_t q_omg_security_load( struct dds_security_context *security_context, const dds_qos_t *qos );
 
 
-void q_omg_security_init( struct dds_security_context **sc);
+void q_omg_security_init( struct dds_security_context **sc, const struct ddsrt_log_cfg *logcfg);
 
 void q_omg_security_deinit( struct dds_security_context **sc);
 
 bool q_omg_is_security_loaded(  struct dds_security_context *sc );
-    
+
 
 /**
  * @brief Check if the participant and the proxy participant
diff --git a/src/core/ddsi/include/dds/ddsi/q_globals.h b/src/core/ddsi/include/dds/ddsi/q_globals.h
index 4d12f96..e261652 100644
--- a/src/core/ddsi/include/dds/ddsi/q_globals.h
+++ b/src/core/ddsi/include/dds/ddsi/q_globals.h
@@ -302,7 +302,6 @@ struct q_globals {
 #ifdef DDSI_INCLUDE_SECURITY
   struct dds_security_context *security_context;
 #endif
-
 };
 
 #if defined (__cplusplus)
diff --git a/src/core/ddsi/src/ddsi_security_omg.c b/src/core/ddsi/src/ddsi_security_omg.c
index 0759f73..c08b649 100644
--- a/src/core/ddsi/src/ddsi_security_omg.c
+++ b/src/core/ddsi/src/ddsi_security_omg.c
@@ -36,8 +36,6 @@
 #include "dds/ddsi/q_xevent.h"
 #include "dds/ddsi/q_plist.h"
 
-
-
 #define AUTH_NAME "Authentication"
 #define AC_NAME "Access Control"
 #define CRYPTO_NAME "Cryptographic"
@@ -54,49 +52,45 @@ struct dds_security_context {
   dds_security_access_control *access_control_context;
   ddsrt_mutex_t omg_security_lock;
   uint32_t next_plugin_id;
+
+  const struct ddsrt_log_cfg *logcfg;
 };
 
 typedef struct dds_security_context dds_security_context;
 
+static bool q_omg_writer_is_payload_protected (const struct writer *wr);
 
-static bool
-q_omg_writer_is_payload_protected(
-  const struct writer *wr);
-
-
-
-
-static bool endpoint_is_DCPSParticipantSecure(const ddsi_guid_t *guid)
+static bool endpoint_is_DCPSParticipantSecure (const ddsi_guid_t *guid)
 {
   return ((guid->entityid.u == NN_ENTITYID_SPDP_RELIABLE_BUILTIN_PARTICIPANT_SECURE_WRITER) ||
-          (guid->entityid.u == NN_ENTITYID_SPDP_RELIABLE_BUILTIN_PARTICIPANT_SECURE_READER) );
+          (guid->entityid.u == NN_ENTITYID_SPDP_RELIABLE_BUILTIN_PARTICIPANT_SECURE_READER));
 }
 
-static bool endpoint_is_DCPSPublicationsSecure(const ddsi_guid_t *guid)
+static bool endpoint_is_DCPSPublicationsSecure (const ddsi_guid_t *guid)
 {
   return ((guid->entityid.u == NN_ENTITYID_SEDP_BUILTIN_PUBLICATIONS_SECURE_WRITER) ||
-          (guid->entityid.u == NN_ENTITYID_SEDP_BUILTIN_PUBLICATIONS_SECURE_READER) );
+          (guid->entityid.u == NN_ENTITYID_SEDP_BUILTIN_PUBLICATIONS_SECURE_READER));
 }
 
-static bool endpoint_is_DCPSSubscriptionsSecure(const ddsi_guid_t *guid)
+static bool endpoint_is_DCPSSubscriptionsSecure (const ddsi_guid_t *guid)
 {
   return ((guid->entityid.u == NN_ENTITYID_SEDP_BUILTIN_SUBSCRIPTIONS_SECURE_WRITER) ||
-          (guid->entityid.u == NN_ENTITYID_SEDP_BUILTIN_SUBSCRIPTIONS_SECURE_READER) );
+          (guid->entityid.u == NN_ENTITYID_SEDP_BUILTIN_SUBSCRIPTIONS_SECURE_READER));
 }
 
-static bool endpoint_is_DCPSParticipantStatelessMessage(const ddsi_guid_t *guid)
+static bool endpoint_is_DCPSParticipantStatelessMessage (const ddsi_guid_t *guid)
 {
   return ((guid->entityid.u == NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_STATELESS_MESSAGE_WRITER) ||
-          (guid->entityid.u == NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_STATELESS_MESSAGE_READER) );
+          (guid->entityid.u == NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_STATELESS_MESSAGE_READER));
 }
 
-static bool endpoint_is_DCPSParticipantMessageSecure(const ddsi_guid_t *guid)
+static bool endpoint_is_DCPSParticipantMessageSecure (const ddsi_guid_t *guid)
 {
   return ((guid->entityid.u == NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_MESSAGE_SECURE_WRITER) ||
-          (guid->entityid.u == NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_MESSAGE_SECURE_READER) );
+          (guid->entityid.u == NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_MESSAGE_SECURE_READER));
 }
 
-static bool endpoint_is_DCPSParticipantVolatileMessageSecure(const ddsi_guid_t *guid)
+static bool endpoint_is_DCPSParticipantVolatileMessageSecure (const ddsi_guid_t *guid)
 {
 #if 1
   /* TODO: volatile endpoint. */
@@ -104,266 +98,227 @@ static bool endpoint_is_DCPSParticipantVolatileMessageSecure(const ddsi_guid_t *
   return false;
 #else
   return ((guid->entityid.u == NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_VOLATILE_SECURE_WRITER) ||
-          (guid->entityid.u == NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_VOLATILE_SECURE_READER) );
+          (guid->entityid.u == NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_VOLATILE_SECURE_READER));
 #endif
 }
 
-bool q_omg_is_security_loaded(  dds_security_context *sc ){
-  if( sc->crypto_context == NULL && sc->authentication_context == NULL && sc->access_control_context == NULL){
-    return false;
-  } else {
-    return true;
-  }
-}
-
-void q_omg_security_init( dds_security_context **sc )
+bool q_omg_is_security_loaded (dds_security_context *sc)
 {
-
-
-    *sc = ddsrt_malloc( sizeof( dds_security_context));
-    memset( *sc, 0, sizeof( dds_security_context));
-  //if( participant_reference_count == 0 ){
-
-    (*sc)->auth_plugin.name = AUTH_NAME;
-    (*sc)->ac_plugin.name = AC_NAME;
-    (*sc)->crypto_plugin.name = CRYPTO_NAME;
-
-    (void)ddsrt_mutex_init(&(*sc)->omg_security_lock);
-    DDS_LOG(DDS_LC_TRACE,"DDS Security init\n");
-#if HANDSHAKE_IMPLEMENTED
-    //remote_participant_crypto_handle_list_init();
-#endif
-  //}
-
-  //participant_reference_count++;
+  return (sc->crypto_context != NULL || sc->authentication_context != NULL || sc->access_control_context != NULL);
 }
 
+void q_omg_security_init (dds_security_context **sc, const struct ddsrt_log_cfg *logcfg)
+{
+  *sc = ddsrt_malloc (sizeof (dds_security_context));
+  memset (*sc, 0, sizeof (dds_security_context));
 
+  (*sc)->auth_plugin.name = AUTH_NAME;
+  (*sc)->ac_plugin.name = AC_NAME;
+  (*sc)->crypto_plugin.name = CRYPTO_NAME;
+
+  ddsrt_mutex_init (&(*sc)->omg_security_lock);
+  (*sc)->logcfg = logcfg;
+
+  //DDS_CTRACE ((*sc)->logcfg, "DDS Security init\n");
+#if HANDSHAKE_IMPLEMENTED
+  //remote_participant_crypto_handle_list_init();
+#endif
+}
 
 /**
  * Releases all plugins
  */
-static void release_plugins( dds_security_context *security_context )
+static void release_plugins (dds_security_context *sc)
 {
 #if HANDSHAKE_IMPLEMENTED
-  q_handshake_terminate();
+  q_handshake_terminate ();
 #endif
 
+  if (dds_security_plugin_release (&sc->auth_plugin, sc->authentication_context))
+    DDS_CERROR (sc->logcfg, "Error occured releasing %s plugin", sc->auth_plugin.name);
 
-  if (dds_security_plugin_release( &security_context->auth_plugin, security_context->authentication_context )) {
-    DDS_ERROR("Error occured releasing %s plugin", security_context->auth_plugin.name);
-  }
+  if (dds_security_plugin_release (&sc->crypto_plugin, sc->crypto_context))
+    DDS_CERROR (sc->logcfg, "Error occured releasing %s plugin", sc->crypto_plugin.name);
 
-  if (dds_security_plugin_release( &security_context->crypto_plugin, security_context->crypto_context )) {
-    DDS_ERROR("Error occured releasing %s plugin", security_context->crypto_plugin.name);
-  }
+  if (dds_security_plugin_release (&sc->ac_plugin, sc->access_control_context))
+    DDS_CERROR (sc->logcfg, "Error occured releasing %s plugin", sc->ac_plugin.name);
 
-  if (dds_security_plugin_release( &security_context->ac_plugin, security_context->access_control_context )) {
-    DDS_ERROR("Error occured releasing %s plugin", security_context->ac_plugin.name);
-  }
-
-  security_context->authentication_context = NULL;
-  security_context->access_control_context = NULL;
-  security_context->crypto_context = NULL;
+  sc->authentication_context = NULL;
+  sc->access_control_context = NULL;
+  sc->crypto_context = NULL;
 }
 
-
-void q_omg_security_deinit( struct dds_security_context **security_context) {
-
-  assert( security_context != NULL );
-  assert( *security_context != NULL );
+void q_omg_security_deinit (struct dds_security_context **sc)
+{
+  assert (sc != NULL);
+  assert (*sc != NULL);
 
 #if HANDSHAKE_IMPLEMENTED
-    //remote_participant_crypto_handle_list_deinit();
+  //remote_participant_crypto_handle_list_deinit();
 #endif
-    if( (*security_context)->authentication_context != NULL && (*security_context)->access_control_context != NULL && (*security_context)->crypto_context != NULL ){
-      release_plugins( *security_context );
-    }
 
-    ddsrt_mutex_destroy(&(*security_context)->omg_security_lock);
-    ddsrt_free( *security_context );
-    *security_context = NULL;
-
-    DDS_LOG(DDS_LC_TRACE,"DDS Security deinit\n");
-}
-
-
-
-static void
-dds_qos_to_security_plugin_configuration(
-   const dds_qos_t *qos,
-   dds_security_plugin_suite_config *suite_config)
-{
-  uint32_t i;
-
-#define CHECK_SECURITY_PROPERTY( security_property, target ) \
-    if(strcmp (qos->property.value.props[i].name, security_property) == 0){ \
-      target = ddsrt_strdup( qos->property.value.props[i].value ); \
-    }
-
-  for (i = 0; i < qos->property.value.n; i++) {
-    CHECK_SECURITY_PROPERTY( DDS_SEC_PROP_AUTH_LIBRARY_PATH, suite_config->authentication.library_path )
-    else CHECK_SECURITY_PROPERTY( DDS_SEC_PROP_AUTH_LIBRARY_INIT, suite_config->authentication.library_init )
-    else CHECK_SECURITY_PROPERTY( DDS_SEC_PROP_AUTH_LIBRARY_FINALIZE, suite_config->authentication.library_finalize )
-    else CHECK_SECURITY_PROPERTY( DDS_SEC_PROP_CRYPTO_LIBRARY_PATH, suite_config->cryptography.library_path )
-    else CHECK_SECURITY_PROPERTY( DDS_SEC_PROP_CRYPTO_LIBRARY_INIT, suite_config->cryptography.library_init )
-    else CHECK_SECURITY_PROPERTY( DDS_SEC_PROP_CRYPTO_LIBRARY_FINALIZE, suite_config->cryptography.library_finalize )
-    else CHECK_SECURITY_PROPERTY( DDS_SEC_PROP_ACCESS_LIBRARY_PATH, suite_config->access_control.library_path )
-    else CHECK_SECURITY_PROPERTY( DDS_SEC_PROP_ACCESS_LIBRARY_INIT, suite_config->access_control.library_init )
-    else CHECK_SECURITY_PROPERTY( DDS_SEC_PROP_ACCESS_LIBRARY_FINALIZE, suite_config->access_control.library_finalize )
+  if ((*sc)->authentication_context != NULL && (*sc)->access_control_context != NULL && (*sc)->crypto_context != NULL){
+    release_plugins (*sc);
   }
 
-#undef CHECK_SECURITY_PROPERTY
+  ddsrt_mutex_destroy (&(*sc)->omg_security_lock);
+
+  //DDS_CTRACE ((*sc)->logcfg, "DDS Security deinit\n");
+  ddsrt_free (*sc);
+  *sc = NULL;
 }
 
-static void deinit_plugin_config(dds_security_plugin_config *plugin_config){
-  ddsrt_free( plugin_config->library_path );
-  ddsrt_free( plugin_config->library_init );
-  ddsrt_free( plugin_config->library_finalize );
-}
-
-static void deinit_plugin_suite_config(dds_security_plugin_suite_config *suite_config ){
-  deinit_plugin_config( &suite_config->access_control );
-  deinit_plugin_config( &suite_config->authentication );
-  deinit_plugin_config( &suite_config->cryptography );
-
-}
-
-dds_return_t q_omg_security_load( dds_security_context *security_context,
-    const dds_qos_t *qos)
+static void dds_qos_to_security_plugin_configuration (const dds_qos_t *qos, dds_security_plugin_suite_config *suite_config)
 {
-  dds_return_t ret = DDS_RETCODE_ERROR;
+  const struct { const char *name; size_t offset; } tab[] = {
+    { DDS_SEC_PROP_AUTH_LIBRARY_PATH, offsetof (dds_security_plugin_suite_config, authentication.library_path) },
+    { DDS_SEC_PROP_AUTH_LIBRARY_INIT, offsetof (dds_security_plugin_suite_config, authentication.library_init) },
+    { DDS_SEC_PROP_AUTH_LIBRARY_FINALIZE, offsetof (dds_security_plugin_suite_config, authentication.library_finalize) },
+    { DDS_SEC_PROP_CRYPTO_LIBRARY_PATH, offsetof (dds_security_plugin_suite_config, cryptography.library_path) },
+    { DDS_SEC_PROP_CRYPTO_LIBRARY_INIT, offsetof (dds_security_plugin_suite_config, cryptography.library_init) },
+    { DDS_SEC_PROP_CRYPTO_LIBRARY_FINALIZE, offsetof (dds_security_plugin_suite_config, cryptography.library_finalize) },
+    { DDS_SEC_PROP_ACCESS_LIBRARY_PATH, offsetof (dds_security_plugin_suite_config, access_control.library_path) },
+    { DDS_SEC_PROP_ACCESS_LIBRARY_INIT, offsetof (dds_security_plugin_suite_config, access_control.library_init) },
+    { DDS_SEC_PROP_ACCESS_LIBRARY_FINALIZE, offsetof (dds_security_plugin_suite_config, access_control.library_finalize) }
+  };
 
-  ddsrt_mutex_lock(&security_context->omg_security_lock);
+  for (size_t i = 0; i < qos->property.value.n; i++)
+    for (size_t j = 0; j < sizeof (tab) / sizeof (tab[0]); j++)
+      if (strcmp (qos->property.value.props[i].name, tab[j].name) == 0)
+        *((char **) ((char *) suite_config + tab[j].offset)) = ddsrt_strdup (qos->property.value.props[i].value);
+}
 
-  dds_security_plugin_suite_config plugin_suite_config;
+static void deinit_plugin_config (dds_security_plugin_config *plugin_config)
+{
+  ddsrt_free (plugin_config->library_path);
+  ddsrt_free (plugin_config->library_init);
+  ddsrt_free (plugin_config->library_finalize);
+}
+
+static void deinit_plugin_suite_config (dds_security_plugin_suite_config *suite_config)
+{
+  deinit_plugin_config (&suite_config->access_control);
+  deinit_plugin_config (&suite_config->authentication);
+  deinit_plugin_config (&suite_config->cryptography);
+}
+
+dds_return_t q_omg_security_load (dds_security_context *sc, const dds_qos_t *qos)
+{
+  dds_security_plugin_suite_config psc;
+  memset (&psc, 0, sizeof (psc));
+
+  ddsrt_mutex_lock (&sc->omg_security_lock);
 
-  memset ( &plugin_suite_config, 0, sizeof(dds_security_plugin_suite_config));
   /* Get plugin information */
-
-  dds_qos_to_security_plugin_configuration( qos, &plugin_suite_config);
+  dds_qos_to_security_plugin_configuration (qos, &psc);
 
   /* Check configuration content */
-  if( dds_security_check_plugin_configuration( &plugin_suite_config ) == DDS_RETCODE_OK ){
-
-    if (dds_security_load_security_library(
-        &(plugin_suite_config.authentication), &security_context->auth_plugin,
-        (void**) &security_context->authentication_context) == DDS_RETCODE_OK) {
-
-      if (dds_security_load_security_library(
-          &(plugin_suite_config.access_control), &security_context->ac_plugin,
-          (void**) &security_context->access_control_context)  == DDS_RETCODE_OK ) {
-
-        if (dds_security_load_security_library(
-                  &(plugin_suite_config.cryptography), &security_context->crypto_plugin,
-                  (void**) &security_context->crypto_context) == DDS_RETCODE_OK ) {
-          /* now check if all plugin functions are implemented */
-          if( dds_security_verify_plugin_functions(
-              security_context->authentication_context,&security_context->auth_plugin,
-              security_context->crypto_context,&security_context->crypto_plugin,
-              security_context->access_control_context, &security_context->ac_plugin) == DDS_RETCODE_OK){
-
-            /* Add listeners */
-#if LISTENERS_IMPLEMENTED
-            if ( access_control_context->set_listener(access_control_context, &listener_ac, &ex)) {
-              if ( authentication_context->set_listener(authentication_context, &listener_auth, &ex)) {
-#if HANDSHAKE_IMPLEMENTED
-              (void)q_handshake_initialize();
-#endif
-              } else {
-                DDS_ERROR("Could not set authentication listener: %s\n",
-                          ex.message ? ex.message : "<unknown error>");
-              }
-
-            } else {
-              DDS_ERROR("Could not set access_control listener: %s\n",
-                        ex.message ? ex.message : "<unknown error>");
-            }
-#endif //LISTENERS_IMPLEMENTED
-
-            //tried_to_load = true;
-            //ret = last_load_result = DDS_RETCODE_OK;
-            ret = DDS_RETCODE_OK;
-            //omg_security_plugin_loaded = true;
-            DDS_INFO( "DDS Security plugins have been loaded\n" );
-          } else {
-            release_plugins( security_context );
-          }
-
-        } else{
-          DDS_ERROR("Could not load %s library\n", security_context->crypto_plugin.name);
-        }
-      }else{
-        DDS_ERROR("Could not load %s library\n", security_context->ac_plugin.name);
-      }
-
-    }
-    else{
-      DDS_ERROR("Could not load %s plugin.\n", security_context->auth_plugin.name);
-
-    }
+  if (dds_security_check_plugin_configuration (&psc, sc->logcfg) != DDS_RETCODE_OK)
+    goto error;
 
+  if (dds_security_load_security_library (&psc.authentication, &sc->auth_plugin, (void **) &sc->authentication_context, sc->logcfg) != DDS_RETCODE_OK)
+  {
+    DDS_CERROR (sc->logcfg, "Could not load %s plugin.\n", sc->auth_plugin.name);
+    goto error;
+  }
+  if (dds_security_load_security_library (&psc.access_control, &sc->ac_plugin, (void **) &sc->access_control_context, sc->logcfg) != DDS_RETCODE_OK)
+  {
+    DDS_CERROR (sc->logcfg, "Could not load %s library\n", sc->ac_plugin.name);
+    goto error;
+  }
+  if (dds_security_load_security_library (&psc.cryptography, &sc->crypto_plugin, (void **) &sc->crypto_context, sc->logcfg) != DDS_RETCODE_OK)
+  {
+    DDS_CERROR (sc->logcfg, "Could not load %s library\n", sc->crypto_plugin.name);
+    goto error;
   }
 
-  deinit_plugin_suite_config( &plugin_suite_config );
+  /* now check if all plugin functions are implemented */
+  if (dds_security_verify_plugin_functions (
+              sc->authentication_context, &sc->auth_plugin,
+              sc->crypto_context, &sc->crypto_plugin,
+              sc->access_control_context, &sc->ac_plugin,
+              sc->logcfg) != DDS_RETCODE_OK)
+  {
+    goto error_verify;
+  }
 
-  ddsrt_mutex_unlock( &security_context->omg_security_lock );
+  /* Add listeners */
+#if LISTENERS_IMPLEMENTED
+  if (!access_control_context->set_listener (access_control_context, &listener_ac, &ex))
+  {
+    DDS_CERROR (sc->logcfg, "Could not set access_control listener: %s\n", ex.message ? ex.message : "<unknown error>");
+    goto error_set_ac_listener;
+  }
+  if (!authentication_context->set_listener (authentication_context, &listener_auth, &ex))
+  {
+    DDS_CERROR (sc->logcfg, "Could not set authentication listener: %s\n", ex.message ? ex.message : "<unknown error>");
+    goto err_set_auth_listener;
+  }
+#endif
 
+#if HANDSHAKE_IMPLEMENTED
+    (void) q_handshake_initialize ();
+#endif
 
-  return ret;
+  deinit_plugin_suite_config (&psc);
+  ddsrt_mutex_unlock (&sc->omg_security_lock);
+  DDS_CLOG (DDS_LC_TRACE, sc->logcfg, "DDS Security plugins have been loaded\n");
+  return DDS_RETCODE_OK;
+
+#if LISTENERS_IMPLEMENTED
+error_set_auth_listener:
+  access_control_context->set_listener (access_control_context, NULL, &ex);
+error_set_ac_listener:
+#endif
+error_verify:
+  release_plugins (sc);
+error:
+  deinit_plugin_suite_config (&psc);
+  ddsrt_mutex_unlock (&sc->omg_security_lock);
+  return DDS_RETCODE_ERROR;
 }
 
-bool
-q_omg_participant_is_secure(
-  const struct participant *pp)
+bool q_omg_participant_is_secure (const struct participant *pp)
 {
   /* TODO: Register local participant. */
-  DDSRT_UNUSED_ARG(pp);
+  DDSRT_UNUSED_ARG (pp);
   return false;
 }
 
-bool
-q_omg_proxy_participant_is_secure(
-    const struct proxy_participant *proxypp)
+bool q_omg_proxy_participant_is_secure (const struct proxy_participant *proxypp)
 {
   /* TODO: Register remote participant */
-  DDSRT_UNUSED_ARG(proxypp);
+  DDSRT_UNUSED_ARG (proxypp);
   return false;
 }
 
-static bool
-q_omg_writer_is_discovery_protected(
-  const struct writer *wr)
+static bool q_omg_writer_is_discovery_protected (const struct writer *wr)
 {
   /* TODO: Register local writer. */
-  DDSRT_UNUSED_ARG(wr);
+  DDSRT_UNUSED_ARG (wr);
   return false;
 }
 
-static bool
-q_omg_reader_is_discovery_protected(
-  const struct reader *rd)
+static bool q_omg_reader_is_discovery_protected (const struct reader *rd)
 {
   /* TODO: Register local reader. */
-  DDSRT_UNUSED_ARG(rd);
+  DDSRT_UNUSED_ARG (rd);
   return false;
 }
 
-bool
-q_omg_get_writer_security_info(
-  const struct writer *wr,
-  nn_security_info_t *info)
+bool q_omg_get_writer_security_info (const struct writer *wr, nn_security_info_t *info)
 {
-  assert(wr);
-  assert(info);
+  assert (wr);
+  assert (info);
   /* TODO: Register local writer. */
-  DDSRT_UNUSED_ARG(wr);
+  DDSRT_UNUSED_ARG (wr);
 
   info->plugin_security_attributes = 0;
-  if (q_omg_writer_is_payload_protected(wr))
+  if (q_omg_writer_is_payload_protected (wr))
   {
-    info->security_attributes = NN_ENDPOINT_SECURITY_ATTRIBUTES_FLAG_IS_VALID|
-                                NN_ENDPOINT_SECURITY_ATTRIBUTES_FLAG_IS_PAYLOAD_PROTECTED;
+    info->security_attributes =
+      NN_ENDPOINT_SECURITY_ATTRIBUTES_FLAG_IS_VALID |
+      NN_ENDPOINT_SECURITY_ATTRIBUTES_FLAG_IS_PAYLOAD_PROTECTED;
   }
   else
   {
@@ -372,108 +327,84 @@ q_omg_get_writer_security_info(
   return true;
 }
 
-bool
-q_omg_get_reader_security_info(
-  const struct reader *rd,
-  nn_security_info_t *info)
+bool q_omg_get_reader_security_info (const struct reader *rd, nn_security_info_t *info)
 {
-  assert(rd);
-  assert(info);
+  assert (rd);
+  assert (info);
   /* TODO: Register local reader. */
-  DDSRT_UNUSED_ARG(rd);
+  DDSRT_UNUSED_ARG (rd);
   info->plugin_security_attributes = 0;
   info->security_attributes = 0;
   return false;
 }
 
-void
-q_omg_security_init_remote_participant(struct proxy_participant *proxypp)
+void q_omg_security_init_remote_participant (struct proxy_participant *proxypp)
 {
-  DDSRT_UNUSED_ARG(proxypp);
+  DDSRT_UNUSED_ARG (proxypp);
 }
 
-static bool
-q_omg_proxyparticipant_is_authenticated(
-  const struct proxy_participant *proxy_pp)
+static bool q_omg_proxyparticipant_is_authenticated (const struct proxy_participant *proxy_pp)
 {
   /* TODO: Handshake */
-  DDSRT_UNUSED_ARG(proxy_pp);
+  DDSRT_UNUSED_ARG (proxy_pp);
   return false;
 }
 
-int64_t
-q_omg_security_get_local_participant_handle(
-  struct participant *pp)
+int64_t q_omg_security_get_local_participant_handle (struct participant *pp)
 {
   /* TODO: Local registration */
-  DDSRT_UNUSED_ARG(pp);
+  DDSRT_UNUSED_ARG (pp);
   return 0;
 }
 
-int64_t
-q_omg_security_get_remote_participant_handle(
-  struct proxy_participant *proxypp)
+int64_t q_omg_security_get_remote_participant_handle (struct proxy_participant *proxypp)
 {
   /* TODO: Handshake */
   DDSRT_UNUSED_ARG(proxypp);
   return 0;
 }
 
-bool
-q_omg_participant_allow_unauthenticated(struct participant *pp)
+bool q_omg_participant_allow_unauthenticated (struct participant *pp)
 {
-  DDSRT_UNUSED_ARG(pp);
-
+  DDSRT_UNUSED_ARG (pp);
   return true;
 }
 
-unsigned
-determine_subscription_writer(
-  const struct reader *rd)
+unsigned determine_subscription_writer (const struct reader *rd)
 {
-  if (q_omg_reader_is_discovery_protected(rd))
-  {
+  if (q_omg_reader_is_discovery_protected (rd))
     return NN_ENTITYID_SEDP_BUILTIN_SUBSCRIPTIONS_SECURE_WRITER;
-  }
-  return NN_ENTITYID_SEDP_BUILTIN_SUBSCRIPTIONS_WRITER;
+  else
+    return NN_ENTITYID_SEDP_BUILTIN_SUBSCRIPTIONS_WRITER;
 }
 
-unsigned
-determine_publication_writer(
-  const struct writer *wr)
+unsigned determine_publication_writer (const struct writer *wr)
 {
-  if (q_omg_writer_is_discovery_protected(wr))
-  {
+  if (q_omg_writer_is_discovery_protected (wr))
     return NN_ENTITYID_SEDP_BUILTIN_PUBLICATIONS_SECURE_WRITER;
-  }
-  return NN_ENTITYID_SEDP_BUILTIN_PUBLICATIONS_WRITER;
+  else
+    return NN_ENTITYID_SEDP_BUILTIN_PUBLICATIONS_WRITER;
 }
 
-void
-q_omg_security_register_remote_participant(struct participant *pp, struct proxy_participant *proxypp, int64_t shared_secret, int64_t proxy_permissions)
+void q_omg_security_register_remote_participant (struct participant *pp, struct proxy_participant *proxypp, int64_t shared_secret, int64_t proxy_permissions)
 {
-  DDSRT_UNUSED_ARG(pp);
-  DDSRT_UNUSED_ARG(proxypp);
-  DDSRT_UNUSED_ARG(shared_secret);
-  DDSRT_UNUSED_ARG(proxy_permissions);
+  DDSRT_UNUSED_ARG (pp);
+  DDSRT_UNUSED_ARG (proxypp);
+  DDSRT_UNUSED_ARG (shared_secret);
+  DDSRT_UNUSED_ARG (proxy_permissions);
 }
 
-void
-q_omg_security_deregister_remote_participant(struct proxy_participant *proxypp)
+void q_omg_security_deregister_remote_participant (struct proxy_participant *proxypp)
 {
-  DDSRT_UNUSED_ARG(proxypp);
+  DDSRT_UNUSED_ARG (proxypp);
 }
 
-bool
-is_proxy_participant_deletion_allowed(
-  struct q_globals * const gv,
-  const struct ddsi_guid *guid,
-  const ddsi_entityid_t pwr_entityid)
+bool is_proxy_participant_deletion_allowed (struct q_globals * const gv, const struct ddsi_guid *guid, const ddsi_entityid_t pwr_entityid)
 {
   struct proxy_participant *proxypp;
 
-  assert(gv);
-  assert(guid);
+  assert (gv);
+  assert (guid);
 
   /* TODO: Check if the proxy writer guid prefix matches that of the proxy
    *       participant. Deletion is not allowed when they're not equal. */
@@ -484,131 +415,104 @@ is_proxy_participant_deletion_allowed(
 
   /* Not from a secure proxy writer.
    * Only allow deletion when proxy participant is not authenticated. */
-  proxypp = entidx_lookup_proxy_participant_guid(gv->entity_index, guid);
+  proxypp = entidx_lookup_proxy_participant_guid (gv->entity_index, guid);
   if (!proxypp)
   {
     GVLOGDISC (" unknown");
     return false;
   }
-  return (!q_omg_proxyparticipant_is_authenticated(proxypp));
+  return (!q_omg_proxyparticipant_is_authenticated (proxypp));
 }
 
 /* ask to access control security plugin for the remote participant permissions */
-int64_t
-q_omg_security_check_remote_participant_permissions(uint32_t domain_id, struct participant *pp, struct proxy_participant *proxypp)
+int64_t q_omg_security_check_remote_participant_permissions (uint32_t domain_id, struct participant *pp, struct proxy_participant *proxypp)
 {
-  DDSRT_UNUSED_ARG(domain_id);
-  DDSRT_UNUSED_ARG(pp);
-  DDSRT_UNUSED_ARG(proxypp);
-
+  DDSRT_UNUSED_ARG (domain_id);
+  DDSRT_UNUSED_ARG (pp);
+  DDSRT_UNUSED_ARG (proxypp);
   return 0;
 }
 
-bool
-q_omg_is_similar_participant_security_info(struct participant *pp, struct proxy_participant *proxypp)
+bool q_omg_is_similar_participant_security_info (struct participant *pp, struct proxy_participant *proxypp)
 {
-  DDSRT_UNUSED_ARG(pp);
-  DDSRT_UNUSED_ARG(proxypp);
-
+  DDSRT_UNUSED_ARG (pp);
+  DDSRT_UNUSED_ARG (proxypp);
   return true;
 }
 
-bool
-q_omg_security_check_create_participant(struct participant *pp, uint32_t domain_id)
+bool q_omg_security_check_create_participant (struct participant *pp, uint32_t domain_id)
 {
-  DDSRT_UNUSED_ARG(pp);
-  DDSRT_UNUSED_ARG(domain_id);
+  DDSRT_UNUSED_ARG (pp);
+  DDSRT_UNUSED_ARG (domain_id);
   return true;
 }
 
-void
-q_omg_security_participant_send_tokens(struct participant *pp, struct proxy_participant *proxypp)
+void q_omg_security_participant_send_tokens (struct participant *pp, struct proxy_participant *proxypp)
 {
-  DDSRT_UNUSED_ARG(pp);
-  DDSRT_UNUSED_ARG(proxypp);
+  DDSRT_UNUSED_ARG (pp);
+  DDSRT_UNUSED_ARG (proxypp);
 }
 
-bool
-q_omg_security_match_remote_writer_enabled(struct reader *rd, struct proxy_writer *pwr)
+bool q_omg_security_match_remote_writer_enabled (struct reader *rd, struct proxy_writer *pwr)
 {
-  DDSRT_UNUSED_ARG(rd);
-  DDSRT_UNUSED_ARG(pwr);
-
-  assert(rd);
-  assert(pwr);
-
+  DDSRT_UNUSED_ARG (rd);
+  DDSRT_UNUSED_ARG (pwr);
+  assert (rd);
+  assert (pwr);
   return true;
 }
 
-bool
-q_omg_security_match_remote_reader_enabled(struct writer *wr, struct proxy_reader *prd)
+bool q_omg_security_match_remote_reader_enabled (struct writer *wr, struct proxy_reader *prd)
 {
-  DDSRT_UNUSED_ARG(wr);
-  DDSRT_UNUSED_ARG(prd);
-
-  assert(wr);
-  assert(prd);
-
+  DDSRT_UNUSED_ARG (wr);
+  DDSRT_UNUSED_ARG (prd);
+  assert (wr);
+  assert (prd);
   return true;
 }
 
-bool
-q_omg_security_check_remote_writer_permissions(const struct proxy_writer *pwr, uint32_t domain_id, struct participant *pp)
+bool q_omg_security_check_remote_writer_permissions (const struct proxy_writer *pwr, uint32_t domain_id, struct participant *pp)
 {
-  DDSRT_UNUSED_ARG(pwr);
-  DDSRT_UNUSED_ARG(domain_id);
-  DDSRT_UNUSED_ARG(pp);
-
-  assert(pwr);
-  assert(pp);
-  assert(pwr->c.proxypp);
-
+  DDSRT_UNUSED_ARG (pwr);
+  DDSRT_UNUSED_ARG (domain_id);
+  DDSRT_UNUSED_ARG (pp);
+  assert (pwr);
+  assert (pp);
+  assert (pwr->c.proxypp);
   return true;
 }
 
-bool
-q_omg_security_check_remote_reader_permissions(const struct proxy_reader *prd, uint32_t domain_id, struct participant *pp)
+bool q_omg_security_check_remote_reader_permissions (const struct proxy_reader *prd, uint32_t domain_id, struct participant *pp)
 {
-  DDSRT_UNUSED_ARG(prd);
-  DDSRT_UNUSED_ARG(domain_id);
-  DDSRT_UNUSED_ARG(pp);
-
-  assert(prd);
-  assert(pp);
-  assert(prd->c.proxypp);
-
+  DDSRT_UNUSED_ARG (prd);
+  DDSRT_UNUSED_ARG (domain_id);
+  DDSRT_UNUSED_ARG (pp);
+  assert (prd);
+  assert (pp);
+  assert (prd->c.proxypp);
   return true;
 }
 
-bool
-q_omg_security_is_remote_rtps_protected(
-  struct proxy_participant *proxy_pp,
-  ddsi_entityid_t entityid)
+bool q_omg_security_is_remote_rtps_protected (const struct proxy_participant *proxy_pp, ddsi_entityid_t entityid)
 {
   /* TODO: Handshake */
-  DDSRT_UNUSED_ARG(proxy_pp);
-  DDSRT_UNUSED_ARG(entityid);
+  DDSRT_UNUSED_ARG (proxy_pp);
+  DDSRT_UNUSED_ARG (entityid);
   return false;
 }
 
-bool
-q_omg_security_is_local_rtps_protected(
-  struct participant *pp,
-  ddsi_entityid_t entityid)
+bool q_omg_security_is_local_rtps_protected (const struct participant *pp, ddsi_entityid_t entityid)
 {
   /* TODO: Handshake */
-  DDSRT_UNUSED_ARG(pp);
-  DDSRT_UNUSED_ARG(entityid);
+  DDSRT_UNUSED_ARG (pp);
+  DDSRT_UNUSED_ARG (entityid);
   return false;
 }
 
-void
-set_proxy_participant_security_info(
-  struct proxy_participant *proxypp,
-  const nn_plist_t *plist)
+void set_proxy_participant_security_info (struct proxy_participant *proxypp, const nn_plist_t *plist)
 {
-  assert(proxypp);
-  assert(plist);
+  assert (proxypp);
+  assert (plist);
   if (plist->present & PP_PARTICIPANT_SECURITY_INFO) {
     proxypp->security_info.security_attributes = plist->participant_security_info.security_attributes;
     proxypp->security_info.plugin_security_attributes = plist->participant_security_info.plugin_security_attributes;
@@ -618,17 +522,10 @@ set_proxy_participant_security_info(
   }
 }
 
-static void
-q_omg_get_proxy_endpoint_security_info(
-  const struct entity_common *entity,
-  nn_security_info_t *proxypp_sec_info,
-  const nn_plist_t *plist,
-  nn_security_info_t *info)
+static void q_omg_get_proxy_endpoint_security_info (const struct entity_common *entity, nn_security_info_t *proxypp_sec_info, const nn_plist_t *plist, nn_security_info_t *info)
 {
-  bool proxypp_info_available;
-
-  proxypp_info_available = (proxypp_sec_info->security_attributes != 0) ||
-                           (proxypp_sec_info->plugin_security_attributes != 0);
+  const bool proxypp_info_available =
+    (proxypp_sec_info->security_attributes != 0 || proxypp_sec_info->plugin_security_attributes != 0);
 
   /*
    * If Security info is present, use that.
@@ -641,26 +538,21 @@ q_omg_get_proxy_endpoint_security_info(
     info->security_attributes = plist->endpoint_security_info.security_attributes;
     info->plugin_security_attributes = plist->endpoint_security_info.plugin_security_attributes;
   }
-  else if (endpoint_is_DCPSParticipantSecure(&(entity->guid)) ||
-           endpoint_is_DCPSPublicationsSecure(&(entity->guid)) ||
-           endpoint_is_DCPSSubscriptionsSecure(&(entity->guid)) )
+  else if (endpoint_is_DCPSParticipantSecure (&entity->guid)||
+           endpoint_is_DCPSPublicationsSecure (&entity->guid) ||
+           endpoint_is_DCPSSubscriptionsSecure (&entity->guid))
   {
+    /* Discovery protection flags */
     info->plugin_security_attributes = NN_ENDPOINT_SECURITY_ATTRIBUTES_FLAG_IS_VALID;
     info->security_attributes = NN_ENDPOINT_SECURITY_ATTRIBUTES_FLAG_IS_VALID;
     if (proxypp_info_available)
     {
       if (proxypp_sec_info->security_attributes & NN_PARTICIPANT_SECURITY_ATTRIBUTES_FLAG_IS_DISCOVERY_PROTECTED)
-      {
         info->security_attributes |= NN_ENDPOINT_SECURITY_ATTRIBUTES_FLAG_IS_SUBMESSAGE_PROTECTED;
-      }
       if (proxypp_sec_info->plugin_security_attributes & NN_PLUGIN_PARTICIPANT_SECURITY_ATTRIBUTES_FLAG_IS_DISCOVERY_ENCRYPTED)
-      {
         info->plugin_security_attributes |= NN_PLUGIN_ENDPOINT_SECURITY_ATTRIBUTES_FLAG_IS_SUBMESSAGE_ENCRYPTED;
-      }
       if (proxypp_sec_info->plugin_security_attributes & NN_PLUGIN_PARTICIPANT_SECURITY_ATTRIBUTES_FLAG_IS_DISCOVERY_AUTHENTICATED)
-      {
         info->plugin_security_attributes |= NN_PLUGIN_ENDPOINT_SECURITY_ATTRIBUTES_FLAG_IS_SUBMESSAGE_ORIGIN_AUTHENTICATED;
-      }
     }
     else
     {
@@ -669,24 +561,19 @@ q_omg_get_proxy_endpoint_security_info(
       info->plugin_security_attributes |= NN_PLUGIN_ENDPOINT_SECURITY_ATTRIBUTES_FLAG_IS_SUBMESSAGE_ENCRYPTED;
     }
   }
-  else if (endpoint_is_DCPSParticipantMessageSecure(&(entity->guid)))
+  else if (endpoint_is_DCPSParticipantMessageSecure (&entity->guid))
   {
+    /* Liveliness protection flags */
     info->plugin_security_attributes = NN_ENDPOINT_SECURITY_ATTRIBUTES_FLAG_IS_VALID;
     info->security_attributes = NN_ENDPOINT_SECURITY_ATTRIBUTES_FLAG_IS_VALID;
     if (proxypp_info_available)
     {
       if (proxypp_sec_info->security_attributes & NN_PARTICIPANT_SECURITY_ATTRIBUTES_FLAG_IS_LIVELINESS_PROTECTED)
-      {
         info->security_attributes |= NN_ENDPOINT_SECURITY_ATTRIBUTES_FLAG_IS_SUBMESSAGE_PROTECTED;
-      }
       if (proxypp_sec_info->plugin_security_attributes & NN_PLUGIN_PARTICIPANT_SECURITY_ATTRIBUTES_FLAG_IS_LIVELINESS_ENCRYPTED)
-      {
         info->plugin_security_attributes |= NN_PLUGIN_ENDPOINT_SECURITY_ATTRIBUTES_FLAG_IS_SUBMESSAGE_ENCRYPTED;
-      }
       if (proxypp_sec_info->plugin_security_attributes & NN_PLUGIN_PARTICIPANT_SECURITY_ATTRIBUTES_FLAG_IS_LIVELINESS_AUTHENTICATED)
-      {
         info->plugin_security_attributes |= NN_PLUGIN_ENDPOINT_SECURITY_ATTRIBUTES_FLAG_IS_SUBMESSAGE_ORIGIN_AUTHENTICATED;
-      }
     }
     else
     {
@@ -695,15 +582,15 @@ q_omg_get_proxy_endpoint_security_info(
       info->plugin_security_attributes |= NN_PLUGIN_ENDPOINT_SECURITY_ATTRIBUTES_FLAG_IS_SUBMESSAGE_ENCRYPTED;
     }
   }
-  else if (endpoint_is_DCPSParticipantStatelessMessage(&(entity->guid)))
+  else if (endpoint_is_DCPSParticipantStatelessMessage (&entity->guid))
   {
     info->security_attributes = NN_ENDPOINT_SECURITY_ATTRIBUTES_FLAG_IS_VALID;
     info->plugin_security_attributes = 0;
   }
-  else if (endpoint_is_DCPSParticipantVolatileMessageSecure(&(entity->guid)))
+  else if (endpoint_is_DCPSParticipantVolatileMessageSecure (&entity->guid))
   {
-    info->security_attributes = NN_ENDPOINT_SECURITY_ATTRIBUTES_FLAG_IS_VALID |
-                                NN_ENDPOINT_SECURITY_ATTRIBUTES_FLAG_IS_SUBMESSAGE_PROTECTED;
+    info->security_attributes =
+      NN_ENDPOINT_SECURITY_ATTRIBUTES_FLAG_IS_VALID | NN_ENDPOINT_SECURITY_ATTRIBUTES_FLAG_IS_SUBMESSAGE_PROTECTED;
     info->plugin_security_attributes = 0;
   }
   else
@@ -713,421 +600,281 @@ q_omg_get_proxy_endpoint_security_info(
   }
 }
 
-void
-set_proxy_reader_security_info(
-  struct proxy_reader *prd,
-  const nn_plist_t *plist)
+void set_proxy_reader_security_info (struct proxy_reader *prd, const nn_plist_t *plist)
 {
-  assert(prd);
-  q_omg_get_proxy_endpoint_security_info(&(prd->e),
-                                         &(prd->c.proxypp->security_info),
-                                         plist,
-                                         &(prd->c.security_info));
+  assert (prd);
+  q_omg_get_proxy_endpoint_security_info (&prd->e, &prd->c.proxypp->security_info, plist, &prd->c.security_info);
 }
 
-void
-set_proxy_writer_security_info(
-  struct proxy_writer *pwr,
-  const nn_plist_t *plist)
+void set_proxy_writer_security_info (struct proxy_writer *pwr, const nn_plist_t *plist)
 {
-  assert(pwr);
-  q_omg_get_proxy_endpoint_security_info(&(pwr->e),
-                                         &(pwr->c.proxypp->security_info),
-                                         plist,
-                                         &(pwr->c.security_info));
+  assert (pwr);
+  q_omg_get_proxy_endpoint_security_info (&pwr->e, &pwr->c.proxypp->security_info, plist, &pwr->c.security_info);
 }
 
 
-static bool
-q_omg_security_encode_datareader_submessage(
-  struct reader            *rd,
-  const ddsi_guid_prefix_t *dst_prefix,
-  const unsigned char      *src_buf,
-  const unsigned int        src_len,
-  unsigned char           **dst_buf,
-  unsigned int             *dst_len)
+static bool q_omg_security_encode_datareader_submessage (struct reader *rd, const ddsi_guid_prefix_t *dst_prefix, const unsigned char *src_buf, size_t src_len, unsigned char **dst_buf, size_t *dst_len)
 {
   /* TODO: Use proper keys to actually encode (need key-exchange). */
-  DDSRT_UNUSED_ARG(rd);
-  DDSRT_UNUSED_ARG(dst_prefix);
-  DDSRT_UNUSED_ARG(src_buf);
-  DDSRT_UNUSED_ARG(src_len);
-  DDSRT_UNUSED_ARG(dst_buf);
-  DDSRT_UNUSED_ARG(dst_len);
+  DDSRT_UNUSED_ARG (rd);
+  DDSRT_UNUSED_ARG (dst_prefix);
+  DDSRT_UNUSED_ARG (src_buf);
+  DDSRT_UNUSED_ARG (src_len);
+  DDSRT_UNUSED_ARG (dst_buf);
+  DDSRT_UNUSED_ARG (dst_len);
   return false;
 }
 
-static bool
-q_omg_security_encode_datawriter_submessage(
-  struct writer            *wr,
-  const ddsi_guid_prefix_t *dst_prefix,
-  const unsigned char      *src_buf,
-  const unsigned int        src_len,
-  unsigned char           **dst_buf,
-  unsigned int             *dst_len)
+static bool q_omg_security_encode_datawriter_submessage (struct writer *wr, const ddsi_guid_prefix_t *dst_prefix, const unsigned char *src_buf, size_t src_len, unsigned char **dst_buf, size_t *dst_len)
 {
   /* TODO: Use proper keys to actually encode (need key-exchange). */
-  DDSRT_UNUSED_ARG(wr);
-  DDSRT_UNUSED_ARG(dst_prefix);
-  DDSRT_UNUSED_ARG(src_buf);
-  DDSRT_UNUSED_ARG(src_len);
-  DDSRT_UNUSED_ARG(dst_buf);
-  DDSRT_UNUSED_ARG(dst_len);
+  DDSRT_UNUSED_ARG (wr);
+  DDSRT_UNUSED_ARG (dst_prefix);
+  DDSRT_UNUSED_ARG (src_buf);
+  DDSRT_UNUSED_ARG (src_len);
+  DDSRT_UNUSED_ARG (dst_buf);
+  DDSRT_UNUSED_ARG (dst_len);
   return false;
 }
 
-static bool
-q_omg_security_decode_submessage(
-  const ddsi_guid_prefix_t* const src_prefix,
-  const ddsi_guid_prefix_t* const dst_prefix,
-  const unsigned char   *src_buf,
-  const unsigned int     src_len,
-  unsigned char        **dst_buf,
-  unsigned int          *dst_len)
+static bool q_omg_security_decode_submessage (const ddsi_guid_prefix_t * const src_prefix, const ddsi_guid_prefix_t * const dst_prefix, const unsigned char *src_buf, size_t src_len, unsigned char **dst_buf, size_t *dst_len)
 {
   /* TODO: Use proper keys to actually decode (need key-exchange). */
-  DDSRT_UNUSED_ARG(src_prefix);
-  DDSRT_UNUSED_ARG(dst_prefix);
-  DDSRT_UNUSED_ARG(src_buf);
-  DDSRT_UNUSED_ARG(src_len);
-  DDSRT_UNUSED_ARG(dst_buf);
-  DDSRT_UNUSED_ARG(dst_len);
+  DDSRT_UNUSED_ARG (src_prefix);
+  DDSRT_UNUSED_ARG (dst_prefix);
+  DDSRT_UNUSED_ARG (src_buf);
+  DDSRT_UNUSED_ARG (src_len);
+  DDSRT_UNUSED_ARG (dst_buf);
+  DDSRT_UNUSED_ARG (dst_len);
   return false;
 }
 
-static bool
-q_omg_security_encode_serialized_payload(
-  const struct writer *wr,
-  const unsigned char *src_buf,
-  const unsigned int   src_len,
-  unsigned char     **dst_buf,
-  unsigned int       *dst_len)
+static bool q_omg_security_encode_serialized_payload (const struct writer *wr, const unsigned char *src_buf, size_t src_len, unsigned char **dst_buf, size_t *dst_len)
 {
   /* TODO: Use proper keys to actually encode (need key-exchange). */
-  DDSRT_UNUSED_ARG(wr);
-  DDSRT_UNUSED_ARG(src_buf);
-  DDSRT_UNUSED_ARG(src_len);
-  DDSRT_UNUSED_ARG(dst_buf);
-  DDSRT_UNUSED_ARG(dst_len);
+  DDSRT_UNUSED_ARG (wr);
+  DDSRT_UNUSED_ARG (src_buf);
+  DDSRT_UNUSED_ARG (src_len);
+  DDSRT_UNUSED_ARG (dst_buf);
+  DDSRT_UNUSED_ARG (dst_len);
   return false;
 }
 
-static bool
-q_omg_security_decode_serialized_payload(
-  struct proxy_writer *pwr,
-  const unsigned char *src_buf,
-  const unsigned int   src_len,
-  unsigned char     **dst_buf,
-  unsigned int       *dst_len)
+static bool q_omg_security_decode_serialized_payload (struct proxy_writer *pwr, const unsigned char *src_buf, size_t src_len, unsigned char **dst_buf, size_t *dst_len)
 {
   /* TODO: Use proper keys to actually decode (need key-exchange). */
-  DDSRT_UNUSED_ARG(pwr);
-  DDSRT_UNUSED_ARG(src_buf);
-  DDSRT_UNUSED_ARG(src_len);
-  DDSRT_UNUSED_ARG(dst_buf);
-  DDSRT_UNUSED_ARG(dst_len);
+  DDSRT_UNUSED_ARG (pwr);
+  DDSRT_UNUSED_ARG (src_buf);
+  DDSRT_UNUSED_ARG (src_len);
+  DDSRT_UNUSED_ARG (dst_buf);
+  DDSRT_UNUSED_ARG (dst_len);
   return false;
 }
 
-bool
-q_omg_security_encode_rtps_message(
-  int64_t                 src_handle,
-  ddsi_guid_t            *src_guid,
-  const unsigned char    *src_buf,
-  const unsigned int      src_len,
-  unsigned char        **dst_buf,
-  unsigned int          *dst_len,
-  int64_t                dst_handle)
+bool q_omg_security_encode_rtps_message (int64_t src_handle, ddsi_guid_t *src_guid, const unsigned char *src_buf, size_t src_len, unsigned char **dst_buf, size_t *dst_len, int64_t dst_handle)
 {
   /* TODO: Use proper keys to actually encode (need key-exchange). */
-  DDSRT_UNUSED_ARG(src_handle);
-  DDSRT_UNUSED_ARG(src_guid);
-  DDSRT_UNUSED_ARG(src_buf);
-  DDSRT_UNUSED_ARG(src_len);
-  DDSRT_UNUSED_ARG(dst_buf);
-  DDSRT_UNUSED_ARG(dst_len);
-  DDSRT_UNUSED_ARG(dst_handle);
+  DDSRT_UNUSED_ARG (src_handle);
+  DDSRT_UNUSED_ARG (src_guid);
+  DDSRT_UNUSED_ARG (src_buf);
+  DDSRT_UNUSED_ARG (src_len);
+  DDSRT_UNUSED_ARG (dst_buf);
+  DDSRT_UNUSED_ARG (dst_len);
+  DDSRT_UNUSED_ARG (dst_handle);
   return false;
 }
 
-static bool
-q_omg_security_decode_rtps_message(
-  struct proxy_participant *proxypp,
-  const unsigned char      *src_buf,
-  const unsigned int        src_len,
-  unsigned char          **dst_buf,
-  unsigned int            *dst_len)
+static bool q_omg_security_decode_rtps_message (struct proxy_participant *proxypp, const unsigned char *src_buf, size_t src_len, unsigned char **dst_buf, size_t *dst_len)
 {
   /* TODO: Use proper keys to actually decode (need key-exchange). */
-  DDSRT_UNUSED_ARG(proxypp);
-  DDSRT_UNUSED_ARG(src_buf);
-  DDSRT_UNUSED_ARG(src_len);
-  DDSRT_UNUSED_ARG(dst_buf);
-  DDSRT_UNUSED_ARG(dst_len);
+  DDSRT_UNUSED_ARG (proxypp);
+  DDSRT_UNUSED_ARG (src_buf);
+  DDSRT_UNUSED_ARG (src_len);
+  DDSRT_UNUSED_ARG (dst_buf);
+  DDSRT_UNUSED_ARG (dst_len);
   return false;
 }
 
-static bool
-q_omg_writer_is_payload_protected(
-  const struct writer *wr)
+static bool q_omg_writer_is_payload_protected (const struct writer *wr)
 {
   /* TODO: Local registration. */
-  DDSRT_UNUSED_ARG(wr);
+  DDSRT_UNUSED_ARG (wr);
   return false;
 }
 
-static bool
-q_omg_writer_is_submessage_protected(
-  struct writer *wr)
+static bool q_omg_writer_is_submessage_protected (struct writer *wr)
 {
   /* TODO: Local registration. */
-  DDSRT_UNUSED_ARG(wr);
+  DDSRT_UNUSED_ARG (wr);
   return false;
 }
 
-static bool
-q_omg_reader_is_submessage_protected(
-  struct reader *rd)
+static bool q_omg_reader_is_submessage_protected (struct reader *rd)
 {
   /* TODO: Local registration. */
-  DDSRT_UNUSED_ARG(rd);
+  DDSRT_UNUSED_ARG (rd);
   return false;
 }
 
-bool
-encode_payload(
-  struct writer *wr,
-  ddsrt_iovec_t *vec,
-  unsigned char **buf)
+bool encode_payload (struct writer *wr, ddsrt_iovec_t *vec, unsigned char **buf)
 {
-  bool ok = true;
   *buf = NULL;
-  if (q_omg_writer_is_payload_protected(wr))
-  {
-    /* Encrypt the data. */
-    unsigned char *enc_buf;
-    unsigned int   enc_len;
-    ok = q_omg_security_encode_serialized_payload(
-                    wr,
-                    vec->iov_base,
-                    (unsigned int)vec->iov_len,
-                    &enc_buf,
-                    &enc_len);
-    if (ok)
-    {
-      /* Replace the iov buffer, which should always be aliased. */
-      vec->iov_base = (char *)enc_buf;
-      vec->iov_len = enc_len;
-      /* Remember the pointer to be able to free the memory. */
-      *buf = enc_buf;
-    }
-  }
-  return ok;
+  if (!q_omg_writer_is_payload_protected (wr))
+    return true;
+
+  unsigned char *enc_buf;
+  size_t enc_len;
+  if (!q_omg_security_encode_serialized_payload (wr, vec->iov_base, vec->iov_len, &enc_buf, &enc_len))
+    return false;
+
+  /* Replace the iov buffer, which should always be aliased. */
+  vec->iov_base = (char *) enc_buf;
+  vec->iov_len = (ddsrt_iov_len_t) enc_len;
+  assert ((size_t) vec->iov_len == enc_len);
+  *buf = enc_buf;
+  return true;
 }
 
 
-static bool
-decode_payload(
-  const struct q_globals *gv,
-  struct nn_rsample_info *sampleinfo,
-  unsigned char *payloadp,
-  uint32_t *payloadsz,
-  size_t *submsg_len)
+static bool decode_payload (const struct q_globals *gv, struct nn_rsample_info *sampleinfo, unsigned char *payloadp, uint32_t *payloadsz, size_t *submsg_len)
 {
-  bool ok = true;
-
-  assert(payloadp);
-  assert(payloadsz);
-  assert(*payloadsz);
-  assert(submsg_len);
-  assert(sampleinfo);
+  assert (payloadp);
+  assert (payloadsz);
+  assert (*payloadsz);
+  assert (submsg_len);
+  assert (sampleinfo);
 
   if (sampleinfo->pwr == NULL)
-  {
     /* No specified proxy writer means no encoding. */
     return true;
-  }
 
   /* Only decode when the attributes tell us so. */
   if ((sampleinfo->pwr->c.security_info.security_attributes & NN_ENDPOINT_SECURITY_ATTRIBUTES_FLAG_IS_PAYLOAD_PROTECTED)
-                                                           == NN_ENDPOINT_SECURITY_ATTRIBUTES_FLAG_IS_PAYLOAD_PROTECTED)
+      != NN_ENDPOINT_SECURITY_ATTRIBUTES_FLAG_IS_PAYLOAD_PROTECTED)
+    return true;
+
+  unsigned char *dst_buf = NULL;
+  size_t dst_len = 0;
+  if (!q_omg_security_decode_serialized_payload (sampleinfo->pwr, payloadp, *payloadsz, &dst_buf, &dst_len))
   {
-    unsigned char *dst_buf = NULL;
-    unsigned int   dst_len = 0;
-
-    /* Decrypt the payload. */
-    if (q_omg_security_decode_serialized_payload(sampleinfo->pwr, payloadp, *payloadsz, &dst_buf, &dst_len))
-    {
-      /* Expect result to always fit into the original buffer. */
-      assert(*payloadsz >= dst_len);
-
-      /* Reduce submessage and payload lengths. */
-      *submsg_len -= (*payloadsz - dst_len);
-      *payloadsz   = dst_len;
-
-      /* Replace the encrypted payload with the decrypted. */
-      memcpy(payloadp, dst_buf, dst_len);
-      ddsrt_free(dst_buf);
-    }
-    else
-    {
-      GVWARNING("decode_payload: failed to decrypt data from "PGUIDFMT"", PGUID (sampleinfo->pwr->e.guid));
-      ok = false;
-    }
+    GVWARNING ("decode_payload: failed to decrypt data from "PGUIDFMT"", PGUID (sampleinfo->pwr->e.guid));
+    return false;
   }
 
-  return ok;
+  /* Expect result to always fit into the original buffer. */
+  assert (*payloadsz >= dst_len);
+
+  /* Reduce submessage and payload lengths. */
+  *submsg_len -= *payloadsz - (uint32_t) dst_len;
+  *payloadsz = (uint32_t) dst_len;
+  memcpy (payloadp, dst_buf, dst_len);
+  ddsrt_free (dst_buf);
+  return true;
 }
 
-bool
-decode_Data(
-  const struct q_globals *gv,
-  struct nn_rsample_info *sampleinfo,
-  unsigned char *payloadp,
-  uint32_t payloadsz,
-  size_t *submsg_len)
+bool decode_Data (const struct q_globals *gv, struct nn_rsample_info *sampleinfo, unsigned char *payloadp, uint32_t payloadsz, size_t *submsg_len)
 {
-  int ok = true;
   /* Only decode when there's actual data. */
-  if (payloadp && (payloadsz > 0))
+  if (payloadp == NULL || payloadsz == 0)
+    return true;
+  else if (!decode_payload (gv, sampleinfo, payloadp, &payloadsz, submsg_len))
+    return false;
+  else
   {
-    ok = decode_payload(gv, sampleinfo, payloadp, &payloadsz, submsg_len);
-    if (ok)
-    {
-      /* It's possible that the payload size (and thus the sample size) has been reduced. */
-      sampleinfo->size = payloadsz;
-    }
-  }
-  return ok;
-}
-
-bool
-decode_DataFrag(
-  const struct q_globals *gv,
-  struct nn_rsample_info *sampleinfo,
-  unsigned char *payloadp,
-  uint32_t payloadsz,
-  size_t *submsg_len)
-{
-  int ok = true;
-  /* Only decode when there's actual data. */
-  if (payloadp && (payloadsz > 0))
-  {
-    ok = decode_payload(gv, sampleinfo, payloadp, &payloadsz, submsg_len);
-    /* Do not touch the sampleinfo->size in contradiction to decode_Data() (it has been calculated differently). */
-  }
-  return ok;
-}
-
-
-void
-encode_datareader_submsg(
-  struct nn_xmsg *msg,
-  struct nn_xmsg_marker sm_marker,
-  struct proxy_writer *pwr,
-  const struct ddsi_guid *rd_guid)
-{
-  struct reader *rd = entidx_lookup_reader_guid(pwr->e.gv->entity_index, rd_guid);
-  struct participant *pp = NULL;
-  /* Only encode when needed. */
-  if( rd != NULL ){
-    pp = rd->c.pp;
-  }
-  if (!pp && q_omg_participant_is_secure( pp ))
-  {
-    if (q_omg_reader_is_submessage_protected(rd))
-    {
-      unsigned char *src_buf;
-      unsigned int   src_len;
-      unsigned char *dst_buf;
-      unsigned int   dst_len;
-
-      /* Make one blob of the current sub-message by appending the serialized payload. */
-      nn_xmsg_submsg_append_refd_payload(msg, sm_marker);
-
-      /* Get the sub-message buffer. */
-      src_buf = (unsigned char*)nn_xmsg_submsg_from_marker(msg, sm_marker);
-      src_len = (unsigned int)nn_xmsg_submsg_size(msg, sm_marker);
-
-      /* Do the actual encryption. */
-      if (q_omg_security_encode_datareader_submessage(rd, &(pwr->e.guid.prefix), src_buf, src_len, &dst_buf, &dst_len))
-      {
-        /* Replace the old sub-message with the new encoded one(s). */
-        nn_xmsg_submsg_replace(msg, sm_marker, dst_buf, dst_len);
-        ddsrt_free(dst_buf);
-      }
-      else
-      {
-        /* The sub-message should have been encoded, which failed.
-         * Remove it to prevent it from being send. */
-        nn_xmsg_submsg_remove(msg, sm_marker);
-      }
-    }
+    /* It's possible that the payload size (and thus the sample size) has been reduced. */
+    sampleinfo->size = payloadsz;
+    return true;
   }
 }
 
-void
-encode_datawriter_submsg(
-  struct nn_xmsg *msg,
-  struct nn_xmsg_marker sm_marker,
-  struct writer *wr)
+bool decode_DataFrag (const struct q_globals *gv, struct nn_rsample_info *sampleinfo, unsigned char *payloadp, uint32_t payloadsz, size_t *submsg_len)
 {
-  struct participant *pp = wr->c.pp;
-  /* Only encode when needed. */
-  if (q_omg_participant_is_secure( pp ))
+  /* Only decode when there's actual data; do not touch the sampleinfo->size in
+     contradiction to decode_Data() (it has been calculated differently). */
+  if (payloadp == NULL || payloadsz == 0)
+    return true;
+  else
+    return decode_payload (gv, sampleinfo, payloadp, &payloadsz, submsg_len);
+}
+
+void encode_datareader_submsg (struct nn_xmsg *msg, struct nn_xmsg_marker sm_marker, struct proxy_writer *pwr, const struct ddsi_guid *rd_guid)
+{
+  /* FIXME: avoid this lookup */
+  struct reader * const rd = entidx_lookup_reader_guid (pwr->e.gv->entity_index, rd_guid);
+  /* surely a reader can only be protected if the participant has security enabled? */
+  if (rd == NULL || !q_omg_reader_is_submessage_protected (rd))
   {
-    if (q_omg_writer_is_submessage_protected(wr))
-    {
-      unsigned char *src_buf;
-      unsigned int   src_len;
-      unsigned char *dst_buf;
-      unsigned int   dst_len;
-      ddsi_guid_prefix_t dst_guid_prefix;
-      ddsi_guid_prefix_t *dst = NULL;
+    assert (rd == NULL || !q_omg_participant_is_secure (rd->c.pp));
+    return;
+  }
+  assert (q_omg_participant_is_secure (rd->c.pp));
 
-      /* Make one blob of the current sub-message by appending the serialized payload. */
-      nn_xmsg_submsg_append_refd_payload(msg, sm_marker);
+  unsigned char *src_buf;
+  size_t src_len;
+  unsigned char *dst_buf;
+  size_t dst_len;
 
-      /* Get the sub-message buffer. */
-      src_buf = (unsigned char*)nn_xmsg_submsg_from_marker(msg, sm_marker);
-      src_len = (unsigned int)nn_xmsg_submsg_size(msg, sm_marker);
+  /* Make one blob of the current sub-message by appending the serialized payload. */
+  nn_xmsg_submsg_append_refd_payload (msg, sm_marker);
 
-      if (nn_xmsg_getdst1prefix(msg, &dst_guid_prefix))
-      {
-        dst = &dst_guid_prefix;
-      }
+  /* Get the sub-message buffer. */
+  src_buf = nn_xmsg_submsg_from_marker (msg, sm_marker);
+  src_len = nn_xmsg_submsg_size (msg, sm_marker);
 
-      /* Do the actual encryption. */
-      if (q_omg_security_encode_datawriter_submessage(wr, dst, src_buf, src_len, &dst_buf, &dst_len))
-      {
-        /* Replace the old sub-message with the new encoded one(s). */
-        nn_xmsg_submsg_replace(msg, sm_marker, dst_buf, dst_len);
-        ddsrt_free(dst_buf);
-      }
-      else
-      {
-        /* The sub-message should have been encoded, which failed.
-         * Remove it to prevent it from being send. */
-        nn_xmsg_submsg_remove(msg, sm_marker);
-      }
-    }
+  if (q_omg_security_encode_datareader_submessage (rd, &pwr->e.guid.prefix, src_buf, src_len, &dst_buf, &dst_len))
+  {
+    nn_xmsg_submsg_replace (msg, sm_marker, dst_buf, dst_len);
+    ddsrt_free (dst_buf);
+  }
+  else
+  {
+    /* The sub-message should have been encoded, which failed. Remove it to prevent it from being send. */
+    nn_xmsg_submsg_remove (msg, sm_marker);
   }
 }
 
-
-
-bool
-validate_msg_decoding(
-  const struct entity_common *e,
-  const struct proxy_endpoint_common *c,
-  struct proxy_participant *proxypp,
-  struct receiver_state *rst,
-  SubmessageKind_t prev_smid)
+void encode_datawriter_submsg (struct nn_xmsg *msg, struct nn_xmsg_marker sm_marker, struct writer *wr)
 {
-  assert(e);
-  assert(c);
-  assert(proxypp);
-  assert(rst);
+  /* Only encode when needed.  Surely a writer can only be protected if the participant has security enabled? */
+  assert (!q_omg_writer_is_submessage_protected (wr) || q_omg_participant_is_secure (wr->c.pp));
+  if (!q_omg_writer_is_submessage_protected (wr))
+    return;
+
+  unsigned char *src_buf;
+  size_t src_len;
+  unsigned char *dst_buf;
+  size_t dst_len;
+  ddsi_guid_prefix_t dst_guid_prefix;
+  ddsi_guid_prefix_t *dst = NULL;
+
+  /* Make one blob of the current sub-message by appending the serialized payload. */
+  nn_xmsg_submsg_append_refd_payload (msg, sm_marker);
+
+  /* Get the sub-message buffer. */
+  src_buf = nn_xmsg_submsg_from_marker (msg, sm_marker);
+  src_len = nn_xmsg_submsg_size (msg, sm_marker);
+
+  if (nn_xmsg_getdst1prefix (msg, &dst_guid_prefix))
+    dst = &dst_guid_prefix;
+
+  if (q_omg_security_encode_datawriter_submessage (wr, dst, src_buf, src_len, &dst_buf, &dst_len))
+  {
+    nn_xmsg_submsg_replace (msg, sm_marker, dst_buf, dst_len);
+    ddsrt_free (dst_buf);
+  }
+  else
+  {
+    /* The sub-message should have been encoded, which failed. Remove it to prevent it from being send. */
+    nn_xmsg_submsg_remove (msg, sm_marker);
+  }
+}
+
+bool validate_msg_decoding (const struct entity_common *e, const struct proxy_endpoint_common *c, const struct proxy_participant *proxypp, const struct receiver_state *rst, SubmessageKind_t prev_smid)
+{
+  assert (e);
+  assert (c);
+  assert (proxypp);
+  assert (rst);
 
   /* If this endpoint is expected to have submessages protected, it means that the
    * previous submessage id (prev_smid) has to be SMID_SEC_PREFIX. That caused the
@@ -1136,17 +883,15 @@ validate_msg_decoding(
    * However, we have to check if the prev_smid is actually SMID_SEC_PREFIX, otherwise
    * a rascal can inject data as just a clear submessage. */
   if ((c->security_info.security_attributes & NN_ENDPOINT_SECURITY_ATTRIBUTES_FLAG_IS_SUBMESSAGE_PROTECTED)
-                                           == NN_ENDPOINT_SECURITY_ATTRIBUTES_FLAG_IS_SUBMESSAGE_PROTECTED)
+      == NN_ENDPOINT_SECURITY_ATTRIBUTES_FLAG_IS_SUBMESSAGE_PROTECTED)
   {
     if (prev_smid != SMID_SEC_PREFIX)
-    {
       return false;
-    }
   }
 
   /* At this point, we should also check if the complete RTPS message was encoded when
    * that is expected. */
-  if (q_omg_security_is_remote_rtps_protected(proxypp, e->guid.entityid) && !rst->rtps_encoded)
+  if (q_omg_security_is_remote_rtps_protected (proxypp, e->guid.entityid) && !rst->rtps_encoded)
   {
     return false;
   }
@@ -1154,214 +899,233 @@ validate_msg_decoding(
   return true;
 }
 
-static int
-validate_submsg(struct q_globals *gv, unsigned char smid, unsigned char *submsg, unsigned char * const end, int byteswap)
+static int32_t validate_submsg (struct q_globals *gv, SubmessageKind_t smid, const unsigned char *submsg, unsigned char const * const end, int byteswap)
 {
-  int result = -1;
-  if ((submsg + RTPS_SUBMESSAGE_HEADER_SIZE) <= end)
+  assert (end >= submsg);
+  if ((size_t) (end - submsg) < RTPS_SUBMESSAGE_HEADER_SIZE)
   {
-    SubmessageHeader_t *hdr = (SubmessageHeader_t*)submsg;
-    if ((smid == 0 /* don't care */) || (hdr->submessageId == smid))
-    {
-      unsigned short size = hdr->octetsToNextHeader;
-      if (byteswap)
-      {
-         size = ddsrt_bswap2u(size);
-      }
-      result = (int)size + (int)RTPS_SUBMESSAGE_HEADER_SIZE;
-      if ((submsg + result) > end)
-      {
-        result = -1;
-      }
-    }
-    else
-    {
-      GVWARNING("Unexpected submsg 0x%02x (0x%02x expected)", hdr->submessageId, smid);
-    }
+    GVWARNING ("Submsg 0x%02x does not fit message", smid);
+    return -1;
   }
-  else
+
+  SubmessageHeader_t const * const hdr = (SubmessageHeader_t *) submsg;
+  if (hdr->submessageId != smid && smid != SMID_PAD)
   {
-    GVWARNING("Submsg 0x%02x does not fit message", smid);
+    GVWARNING("Unexpected submsg 0x%02x (0x%02x expected)", hdr->submessageId, smid);
+    return -1;
+  }
+
+  uint16_t size = hdr->octetsToNextHeader;
+  if (byteswap)
+    size = ddsrt_bswap2u (size);
+  const int32_t result = (int32_t) size + (int32_t) RTPS_SUBMESSAGE_HEADER_SIZE;
+  if (end - submsg < result)
+  {
+    GVWARNING ("Submsg 0x%02x does not fit message", smid);
+    return -1;
   }
   return result;
 }
 
-
-static int
-padding_submsg(struct q_globals *gv, unsigned char *start, unsigned char *end, int byteswap)
+static int32_t padding_submsg (struct q_globals *gv, unsigned char *start, unsigned char *end, int byteswap)
 {
-  SubmessageHeader_t *padding = (SubmessageHeader_t*)start;
-  size_t size = (size_t)(end - start);
-  int result = -1;
-
-  assert(start <= end);
-
-  if (size > sizeof(SubmessageHeader_t))
-  {
-    result = (int)size;
-    padding->submessageId = SMID_PAD;
-    padding->flags = (byteswap ? !(DDSRT_ENDIAN == DDSRT_LITTLE_ENDIAN) : (DDSRT_ENDIAN == DDSRT_LITTLE_ENDIAN));
-    padding->octetsToNextHeader = (unsigned short)(size - sizeof(SubmessageHeader_t));
-    if (byteswap)
-    {
-      padding->octetsToNextHeader = ddsrt_bswap2u(padding->octetsToNextHeader);
-    }
-  }
-  else
+  assert (end >= start);
+  const size_t size = (size_t) (end - start);
+  if (size < RTPS_SUBMESSAGE_HEADER_SIZE)
   {
     GVWARNING("Padding submessage doesn't fit");
+    return -1;
   }
-  return result;
+
+  assert (size <= UINT16_MAX + RTPS_SUBMESSAGE_HEADER_SIZE);
+  SubmessageHeader_t * const padding = (SubmessageHeader_t *) start;
+  padding->submessageId = SMID_PAD;
+  DDSRT_STATIC_ASSERT (SMFLAG_ENDIANNESS == 1);
+  padding->flags = (byteswap ? !(DDSRT_ENDIAN == DDSRT_LITTLE_ENDIAN) : (DDSRT_ENDIAN == DDSRT_LITTLE_ENDIAN));
+  padding->octetsToNextHeader = (uint16_t) (size - RTPS_SUBMESSAGE_HEADER_SIZE);
+  if (byteswap)
+    padding->octetsToNextHeader = ddsrt_bswap2u (padding->octetsToNextHeader);
+  return (int32_t) size;
 }
 
-int
-decode_SecPrefix(
-  struct receiver_state *rst,
-  unsigned char *submsg,
-  size_t submsg_size,
-  unsigned char * const msg_end,
-  const ddsi_guid_prefix_t * const src_prefix,
-  const ddsi_guid_prefix_t * const dst_prefix,
-  int byteswap)
+static bool decode_SecPrefix_patched_hdr_flags (const struct receiver_state *rst, unsigned char *submsg, size_t submsg_size, unsigned char * const msg_end, const ddsi_guid_prefix_t * const src_prefix, const ddsi_guid_prefix_t * const dst_prefix, int byteswap)
 {
-  int result = -1;
-  int totalsize = (int)submsg_size;
+  int smsize = -1;
+  size_t totalsize = submsg_size;
   unsigned char *body_submsg;
   unsigned char *prefix_submsg;
   unsigned char *postfix_submsg;
-  SubmessageHeader_t *hdr = (SubmessageHeader_t*)submsg;
-  uint8_t flags = hdr->flags;
-
-  if (byteswap)
-  {
-    if ((DDSRT_ENDIAN == DDSRT_LITTLE_ENDIAN))
-      hdr->flags |= 0x01;
-    else
-      hdr->flags &= 0xFE;
-  }
 
   /* First sub-message is the SEC_PREFIX. */
   prefix_submsg = submsg;
 
   /* Next sub-message is SEC_BODY when encrypted or the original submessage when only signed. */
   body_submsg = submsg + submsg_size;
-  result = validate_submsg(rst->gv, 0 /* don't care smid */, body_submsg, msg_end, byteswap);
-  if (result > 0)
+  if ((smsize = validate_submsg (rst->gv, SMID_PAD, body_submsg, msg_end, byteswap)) <= 0)
+    return false;
+  totalsize += (size_t) smsize;
+
+  /* Third sub-message should be the SEC_POSTFIX. */
+  postfix_submsg = submsg + totalsize;
+  if ((smsize = validate_submsg (rst->gv, SMID_SEC_POSTFIX, postfix_submsg, msg_end, byteswap)) <= 0)
+    return false;
+  totalsize += (size_t) smsize;
+
+  /* Decode all three submessages. */
+  unsigned char *dst_buf;
+  size_t dst_len;
+  const bool decoded = q_omg_security_decode_submessage (src_prefix, dst_prefix, submsg, totalsize, &dst_buf, &dst_len);
+  if (decoded && dst_buf)
   {
-    totalsize += result;
-
-    /* Third sub-message should be the SEC_POSTFIX. */
-    postfix_submsg = submsg + totalsize;
-    result = validate_submsg(rst->gv, SMID_SEC_POSTFIX, postfix_submsg, msg_end, byteswap);
-    if (result > 0)
+    /*
+     * The 'normal' submessage sequence handling will continue after the
+     * given security SEC_PREFIX.
+     */
+    SubmessageHeader_t const * const body_submsg_hdr = (SubmessageHeader_t const *) body_submsg;
+    if (body_submsg_hdr->submessageId == SMID_SEC_BODY)
     {
-      bool decoded;
-      unsigned char *dst_buf;
-      unsigned int   dst_len;
+      /*
+       * Copy the decoded buffer into the original message, replacing (part
+       * of) SEC_BODY.
+       *
+       * By replacing the SEC_BODY with the decoded submessage, everything
+       * can continue as if there was never an encoded submessage.
+       */
+      assert (totalsize >= submsg_size);
+      assert (dst_len <= totalsize - submsg_size);
+      memcpy (body_submsg, dst_buf, dst_len);
 
-      totalsize += result;
-
-      /* Decode all three submessages. */
-      decoded = q_omg_security_decode_submessage(src_prefix, dst_prefix, submsg, (unsigned int)totalsize, &dst_buf, &dst_len);
-      if (decoded && dst_buf)
-      {
-        /*
-         * The 'normal' submessage sequence handling will continue after the
-         * given security SEC_PREFIX.
-         */
-        if (*body_submsg == SMID_SEC_BODY)
-        {
-          /*
-           * Copy the decoded buffer into the original message, replacing (part
-           * of) SEC_BODY.
-           *
-           * By replacing the SEC_BODY with the decoded submessage, everything
-           * can continue as if there was never an encoded submessage.
-           */
-          assert((int)dst_len <= ((int)totalsize - (int)submsg_size));
-          memcpy(body_submsg, dst_buf, dst_len);
-
-          /* Remainder of SEC_BODY & SEC_POSTFIX should be padded to keep the submsg sequence going. */
-          result = padding_submsg(rst->gv, body_submsg + dst_len, prefix_submsg + totalsize, byteswap);
-        }
-        else
-        {
-          /*
-           * When only signed, then the submessage is already available and
-           * SMID_SEC_POSTFIX will be ignored.
-           * So, we don't really have to do anything.
-           */
-        }
-        ddsrt_free(dst_buf);
-      }
-      else
-      {
-        /*
-         * Decoding or signing failed.
-         *
-         * Replace the security submessages with padding. This also removes a plain
-         * submessage when a signature check failed.
-         */
-        result = padding_submsg(rst->gv, body_submsg, prefix_submsg + totalsize, byteswap);
-      }
-    }
-  }
-  /* Restore flags. */
-  hdr->flags = flags;
-  return result;
-}
-
-static nn_rtps_msg_state_t
-check_rtps_message_is_secure(
-    struct q_globals *gv,
-    Header_t *hdr,
-    unsigned char *buff,
-    bool isstream,
-    struct proxy_participant **proxypp)
-{
-  nn_rtps_msg_state_t ret = NN_RTPS_MSG_STATE_ERROR;
-
-  SubmessageHeader_t *submsg;
-  uint32_t offset = RTPS_MESSAGE_HEADER_SIZE + (isstream ? sizeof(MsgLen_t) : 0);
-
-  submsg = (SubmessageHeader_t *)(buff + offset);
-  if (submsg->submessageId == SMID_SRTPS_PREFIX)
-  {
-    ddsi_guid_t guid;
-
-    guid.prefix = hdr->guid_prefix;
-    guid.entityid.u = NN_ENTITYID_PARTICIPANT;
-
-    GVTRACE(" from "PGUIDFMT, PGUID(guid));
-
-    *proxypp = entidx_lookup_proxy_participant_guid(gv->entity_index, &guid);
-    if (*proxypp)
-    {
-      if (q_omg_proxyparticipant_is_authenticated(*proxypp))
-      {
-        ret = NN_RTPS_MSG_STATE_ENCODED;
-      }
-      else
-      {
-        GVTRACE ("received encoded rtps message from unauthenticated participant");
-      }
+      /* Remainder of SEC_BODY & SEC_POSTFIX should be padded to keep the submsg sequence going. */
+      smsize = padding_submsg (rst->gv, body_submsg + dst_len, prefix_submsg + totalsize, byteswap);
     }
     else
     {
-      GVTRACE ("received encoded rtps message from unknown participant");
+      /*
+       * When only signed, then the submessage is already available and
+       * SMID_SEC_POSTFIX will be ignored.
+       * So, we don't really have to do anything.
+       */
     }
-    GVTRACE("\n");
+    ddsrt_free (dst_buf);
   }
   else
   {
-    ret = NN_RTPS_MSG_STATE_PLAIN;
+    /*
+     * Decoding or signing failed.
+     *
+     * Replace the security submessages with padding. This also removes a plain
+     * submessage when a signature check failed.
+     */
+    smsize = padding_submsg (rst->gv, body_submsg, prefix_submsg + totalsize, byteswap);
   }
 
-  return ret;
+  return (smsize > 0);
+}
+
+bool decode_SecPrefix (const struct receiver_state *rst, unsigned char *submsg, size_t submsg_size, unsigned char * const msg_end, const ddsi_guid_prefix_t * const src_prefix, const ddsi_guid_prefix_t * const dst_prefix, int byteswap)
+{
+  /* FIXME: eliminate the patching of hdr->flags if possible */
+  SubmessageHeader_t *hdr = (SubmessageHeader_t *) submsg;
+  const uint8_t saved_flags = hdr->flags;
+  if (byteswap)
+  {
+    if (DDSRT_ENDIAN == DDSRT_LITTLE_ENDIAN)
+      hdr->flags |= 0x01;
+    else
+      hdr->flags &= 0xFE;
+  }
+  bool result = decode_SecPrefix_patched_hdr_flags (rst, submsg, submsg_size, msg_end, src_prefix, dst_prefix, byteswap);
+  hdr->flags = saved_flags;
+  return result;
+}
+
+static nn_rtps_msg_state_t check_rtps_message_is_secure (struct q_globals *gv, Header_t *hdr, const unsigned char *buff, bool isstream, struct proxy_participant **proxypp)
+{
+  const uint32_t offset = RTPS_MESSAGE_HEADER_SIZE + (isstream ? sizeof (MsgLen_t) : 0);
+  const SubmessageHeader_t *submsg = (const SubmessageHeader_t *) (buff + offset);
+  if (submsg->submessageId != SMID_SRTPS_PREFIX)
+    return NN_RTPS_MSG_STATE_PLAIN;
+
+  ddsi_guid_t guid;
+  guid.prefix = hdr->guid_prefix;
+  guid.entityid.u = NN_ENTITYID_PARTICIPANT;
+
+  GVTRACE (" from "PGUIDFMT, PGUID (guid));
+
+  if ((*proxypp = entidx_lookup_proxy_participant_guid (gv->entity_index, &guid)) == NULL)
+  {
+    GVTRACE ("received encoded rtps message from unknown participant\n");
+    return NN_RTPS_MSG_STATE_ERROR;
+  }
+  else if (!q_omg_proxyparticipant_is_authenticated (*proxypp))
+  {
+    GVTRACE ("received encoded rtps message from unauthenticated participant\n");
+    return NN_RTPS_MSG_STATE_ERROR;
+  }
+  else
+  {
+    return NN_RTPS_MSG_STATE_ENCODED;
+  }
+}
+
+static nn_rtps_msg_state_t
+decode_rtps_message_awake (
+  struct nn_rmsg **rmsg,
+  Header_t **hdr,
+  unsigned char **buff,
+  ssize_t *sz,
+  struct nn_rbufpool *rbpool,
+  bool isstream,
+  struct proxy_participant *proxypp)
+{
+  unsigned char *dstbuf;
+  unsigned char *srcbuf;
+  size_t srclen, dstlen;
+
+  /* Currently the decode_rtps_message returns a new allocated buffer.
+   * This could be optimized by providing a pre-allocated nn_rmsg buffer to
+   * copy the decoded rtps message in.
+   */
+  if (isstream)
+  {
+    /* Remove MsgLen Submessage which was only needed for a stream to determine the end of the message */
+    assert (*sz > (ssize_t) sizeof (MsgLen_t));
+    srcbuf = *buff + sizeof (MsgLen_t);
+    srclen = (size_t) *sz - sizeof (MsgLen_t);
+    memmove (srcbuf, *buff, RTPS_MESSAGE_HEADER_SIZE);
+  }
+  else
+  {
+    assert (*sz > 0);
+    srcbuf = *buff;
+    srclen = (size_t) *sz;
+  }
+
+  if (!q_omg_security_decode_rtps_message (proxypp, srcbuf, srclen, &dstbuf, &dstlen))
+    return NN_RTPS_MSG_STATE_ERROR;
+  else
+  {
+    assert (dstlen <= UINT32_MAX);
+
+    nn_rmsg_commit (*rmsg);
+    *rmsg = nn_rmsg_new (rbpool);
+    *buff = NN_RMSG_PAYLOAD (*rmsg);
+
+    memcpy(*buff, dstbuf, dstlen);
+    nn_rmsg_setsize (*rmsg, (uint32_t) dstlen);
+
+    ddsrt_free (dstbuf);
+
+    *hdr = (Header_t *) *buff;
+    (*hdr)->guid_prefix = nn_ntoh_guid_prefix ((*hdr)->guid_prefix);
+    *sz = (ssize_t) dstlen;
+    assert ((size_t) *sz == dstlen);
+    return NN_RTPS_MSG_STATE_ENCODED;
+  }
 }
 
 nn_rtps_msg_state_t
-decode_rtps_message(
+decode_rtps_message (
   struct thread_state1 * const ts1,
   struct q_globals *gv,
   struct nn_rmsg **rmsg,
@@ -1371,54 +1135,12 @@ decode_rtps_message(
   struct nn_rbufpool *rbpool,
   bool isstream)
 {
-  nn_rtps_msg_state_t ret = NN_RTPS_MSG_STATE_ERROR;
-  struct proxy_participant *proxypp = NULL;
-  unsigned char *dstbuf;
-  unsigned char *srcbuf;
-  uint32_t srclen, dstlen;
-  bool decoded;
-
-  /* Currently the decode_rtps_message returns a new allocated buffer.
-   * This could be optimized by providing a pre-allocated nn_rmsg buffer to
-   * copy the decoded rtps message in.
-   */
+  struct proxy_participant *proxypp;
+  nn_rtps_msg_state_t ret;
   thread_state_awake_fixed_domain (ts1);
-  ret = check_rtps_message_is_secure(gv, *hdr, *buff, isstream, &proxypp);
+  ret = check_rtps_message_is_secure (gv, *hdr, *buff, isstream, &proxypp);
   if (ret == NN_RTPS_MSG_STATE_ENCODED)
-  {
-    if (isstream)
-    {
-      /* Remove MsgLen Submessage which was only needed for a stream to determine the end of the message */
-      srcbuf = *buff + sizeof(MsgLen_t);
-      srclen = (uint32_t)((size_t)(*sz) - sizeof(MsgLen_t));
-      memmove(srcbuf, *buff, RTPS_MESSAGE_HEADER_SIZE);
-    }
-    else
-    {
-      srcbuf = *buff;
-      srclen = (uint32_t)*sz;
-    }
-
-    decoded = q_omg_security_decode_rtps_message(proxypp, srcbuf, srclen, &dstbuf, &dstlen);
-    if (decoded)
-    {
-      nn_rmsg_commit (*rmsg);
-      *rmsg = nn_rmsg_new (rbpool);
-
-      *buff = (unsigned char *) NN_RMSG_PAYLOAD (*rmsg);
-
-      memcpy(*buff, dstbuf, dstlen);
-      nn_rmsg_setsize (*rmsg, dstlen);
-
-      ddsrt_free(dstbuf);
-
-      *hdr = (Header_t*) *buff;
-      (*hdr)->guid_prefix = nn_ntoh_guid_prefix ((*hdr)->guid_prefix);
-      *sz = (ssize_t)dstlen;
-    } else {
-      ret = NN_RTPS_MSG_STATE_ERROR;
-    }
-  }
+    ret = decode_rtps_message_awake (rmsg, hdr, buff, sz, rbpool, isstream, proxypp);
   thread_state_asleep (ts1);
   return ret;
 }
@@ -1435,15 +1157,12 @@ secure_conn_write(
     nn_msg_sec_info_t *sec_info,
     ddsi_tran_write_fn_t conn_write_cb)
 {
-  ssize_t ret = -1;
-
-  unsigned i;
   Header_t *hdr;
   ddsi_guid_t guid;
   unsigned char stbuf[2048];
   unsigned char *srcbuf;
-  unsigned char *dstbuf = NULL;
-  uint32_t srclen, dstlen;
+  unsigned char *dstbuf;
+  size_t srclen, dstlen;
   int64_t dst_handle = 0;
 
   assert(iov);
@@ -1461,41 +1180,40 @@ secure_conn_write(
     }
   }
 
-  hdr = (Header_t *)iov[0].iov_base;
-  guid.prefix = nn_ntoh_guid_prefix(hdr->guid_prefix);
+  hdr = (Header_t *) iov[0].iov_base;
+  guid.prefix = nn_ntoh_guid_prefix (hdr->guid_prefix);
   guid.entityid.u = NN_ENTITYID_PARTICIPANT;
 
   /* first determine the size of the message, then select the
    *  on-stack buffer or allocate one on the heap ...
    */
   srclen = 0;
-  for (i = 0; i < (unsigned)niov; i++)
+  for (size_t i = 0; i < niov; i++)
   {
     /* Do not copy MsgLen submessage in case of a stream connection */
-    if ((i != 1) || !conn->m_stream)
-      srclen += (uint32_t) iov[i].iov_len;
+    if (i != 1 || !conn->m_stream)
+      srclen += iov[i].iov_len;
   }
   if (srclen <= sizeof (stbuf))
-  {
     srcbuf = stbuf;
-  }
   else
-  {
     srcbuf = ddsrt_malloc (srclen);
-  }
 
   /* ... then copy data into buffer */
   srclen = 0;
-  for (i = 0; i < (unsigned)niov; i++)
+  for (size_t i = 0; i < niov; i++)
   {
-    if ((i != 1) || !conn->m_stream)
+    if (i != 1 || !conn->m_stream)
     {
-      memcpy(srcbuf + srclen, iov[i].iov_base, iov[i].iov_len);
-      srclen += (uint32_t) iov[i].iov_len;
+      memcpy (srcbuf + srclen, iov[i].iov_base, iov[i].iov_len);
+      srclen += iov[i].iov_len;
     }
   }
 
-  if (q_omg_security_encode_rtps_message(sec_info->src_pp_handle, &guid, srcbuf, srclen, &dstbuf, &dstlen, dst_handle))
+  ssize_t ret = -1;
+  if (!q_omg_security_encode_rtps_message (sec_info->src_pp_handle, &guid, srcbuf, srclen, &dstbuf, &dstlen, dst_handle))
+    ret = -1;
+  else
   {
     ddsrt_iovec_t tmp_iov[3];
     size_t tmp_niov;
@@ -1503,34 +1221,32 @@ secure_conn_write(
     if (conn->m_stream)
     {
       /* Add MsgLen submessage after Header */
-      msg_len->length = dstlen + (uint32_t)sizeof(*msg_len);
+      assert (dstlen <= UINT32_MAX - sizeof (*msg_len));
+      msg_len->length = (uint32_t) (dstlen + sizeof (*msg_len));
 
       tmp_iov[0].iov_base = dstbuf;
       tmp_iov[0].iov_len = RTPS_MESSAGE_HEADER_SIZE;
-      tmp_iov[1].iov_base = (void*) msg_len;
+      tmp_iov[1].iov_base = (void *) msg_len;
       tmp_iov[1].iov_len = sizeof (*msg_len);
       tmp_iov[2].iov_base = dstbuf + RTPS_MESSAGE_HEADER_SIZE;
-      tmp_iov[2].iov_len = dstlen - RTPS_MESSAGE_HEADER_SIZE;
+      tmp_iov[2].iov_len = (ddsrt_iov_len_t) (dstlen - RTPS_MESSAGE_HEADER_SIZE);
       tmp_niov = 3;
     }
     else
     {
-      msg_len->length = dstlen;
+      assert (dstlen <= UINT32_MAX);
+      msg_len->length = (uint32_t) dstlen;
 
       tmp_iov[0].iov_base = dstbuf;
-      tmp_iov[0].iov_len = dstlen;
+      tmp_iov[0].iov_len = (ddsrt_iov_len_t) dstlen;
       tmp_niov = 1;
     }
     ret = conn_write_cb (conn, dst, tmp_niov, tmp_iov, flags);
+    ddsrt_free (dstbuf);
   }
 
   if (srcbuf != stbuf)
-  {
     ddsrt_free (srcbuf);
-  }
-
-  ddsrt_free(dstbuf);
-
   return ret;
 }
 
@@ -1538,7 +1254,6 @@ secure_conn_write(
 
 #include "dds/ddsi/ddsi_security_omg.h"
 
-
 extern inline bool q_omg_participant_is_secure(UNUSED_ARG(const struct participant *pp));
 extern inline bool q_omg_proxy_participant_is_secure(const struct proxy_participant *proxypp);
 extern inline bool q_omg_security_enabled(void);
diff --git a/src/core/ddsi/src/q_init.c b/src/core/ddsi/src/q_init.c
index d519ed6..498e069 100644
--- a/src/core/ddsi/src/q_init.c
+++ b/src/core/ddsi/src/q_init.c
@@ -1084,7 +1084,7 @@ int rtps_init (struct q_globals *gv)
   add_property_to_xqos(&gv->builtin_volatile_xqos_rd, "dds.sec.builtin_endpoint_name", "BuiltinParticipantVolatileMessageSecureReader");
   add_property_to_xqos(&gv->builtin_volatile_xqos_wr, "dds.sec.builtin_endpoint_name", "BuiltinParticipantVolatileMessageSecureWriter");
   
-  q_omg_security_init( &gv->security_context );
+  q_omg_security_init( &gv->security_context, &gv->logconfig );
 #endif
 
   make_special_topics (gv);
diff --git a/src/core/ddsi/src/q_receive.c b/src/core/ddsi/src/q_receive.c
index 0714714..42f874d 100644
--- a/src/core/ddsi/src/q_receive.c
+++ b/src/core/ddsi/src/q_receive.c
@@ -3068,7 +3068,7 @@ static int handle_submsg_sequence
         state = "parse:sec_prefix";
         {
           GVTRACE ("SEC_PREFIX");
-          if (decode_SecPrefix(rst, submsg, submsg_size, end, &rst->src_guid_prefix, &rst->dst_guid_prefix, byteswap) < 0)
+          if (!decode_SecPrefix(rst, submsg, submsg_size, end, &rst->src_guid_prefix, &rst->dst_guid_prefix, byteswap))
             goto malformed;
         }
         break;
diff --git a/src/security/builtin_plugins/cryptographic/src/crypto_defs.h b/src/security/builtin_plugins/cryptographic/src/crypto_defs.h
index a0fdf2a..5947f29 100644
--- a/src/security/builtin_plugins/cryptographic/src/crypto_defs.h
+++ b/src/security/builtin_plugins/cryptographic/src/crypto_defs.h
@@ -111,4 +111,4 @@ typedef enum RTPS_Message_Type
   RTPS_Message_Type_SRTPS_POSTFIX = 0x34
 } RTPS_Message_Type;
 
-#endif /* CRYPTO_DEFS_H */
\ No newline at end of file
+#endif /* CRYPTO_DEFS_H */
diff --git a/src/security/builtin_plugins/tests/common/src/crypto_helper.h b/src/security/builtin_plugins/tests/common/src/crypto_helper.h
index ad64fcb..775a1d7 100644
--- a/src/security/builtin_plugins/tests/common/src/crypto_helper.h
+++ b/src/security/builtin_plugins/tests/common/src/crypto_helper.h
@@ -35,4 +35,5 @@ int master_salt_not_empty(master_key_material *keymat);
 int master_key_not_empty(master_key_material *keymat);
 int master_receiver_specific_key_not_empty(master_key_material *keymat);
 
-#endif /* DDS_SECURITY_BUITIN_TEST_CRYPTO_HELPER_H */
\ No newline at end of file
+#endif /* DDS_SECURITY_BUITIN_TEST_CRYPTO_HELPER_H */
+
diff --git a/src/security/builtin_plugins/tests/common/src/handshake_helper.h b/src/security/builtin_plugins/tests/common/src/handshake_helper.h
index b6e2e38..ac3ec24 100644
--- a/src/security/builtin_plugins/tests/common/src/handshake_helper.h
+++ b/src/security/builtin_plugins/tests/common/src/handshake_helper.h
@@ -87,4 +87,4 @@ check_shared_secret(
     EVP_PKEY *dh_local_private,
     DDS_Security_HandshakeHandle handshake_handle);
 
-#endif
\ No newline at end of file
+#endif
diff --git a/src/security/builtin_plugins/tests/validate_local_identity/src/validate_local_identity_utests.c b/src/security/builtin_plugins/tests/validate_local_identity/src/validate_local_identity_utests.c
index b4c7067..5d17ebd 100644
--- a/src/security/builtin_plugins/tests/validate_local_identity/src/validate_local_identity_utests.c
+++ b/src/security/builtin_plugins/tests/validate_local_identity/src/validate_local_identity_utests.c
@@ -2106,4 +2106,4 @@ CU _ Test(validate_local_identity,with_extended_certificate_check)
 
 
 }
-#endif
\ No newline at end of file
+#endif
diff --git a/src/security/core/include/dds/security/core/dds_security_plugins.h b/src/security/core/include/dds/security/core/dds_security_plugins.h
index da5d2ad..3a28e43 100644
--- a/src/security/core/include/dds/security/core/dds_security_plugins.h
+++ b/src/security/core/include/dds/security/core/dds_security_plugins.h
@@ -20,6 +20,8 @@
 #include <stdint.h>
 #include "dds/security/dds_security_api.h"
 
+struct ddsrt_log_cfg;
+
 typedef struct dds_security_plugin {
   ddsrt_dynlib_t lib_handle;
   plugin_init func_init;
@@ -50,16 +52,19 @@ DDS_EXPORT dds_return_t dds_security_plugin_release(
         void *context );
 
 DDS_EXPORT dds_return_t dds_security_check_plugin_configuration(
-        const dds_security_plugin_suite_config *security_suite_config );
+        const dds_security_plugin_suite_config *security_suite_config,
+        const struct ddsrt_log_cfg *logcfg);
 
 DDS_EXPORT dds_return_t dds_security_load_security_library(
         const dds_security_plugin_config *plugin_config,
-        dds_security_plugin *security_plugin, void **security_plugin_context);
+        dds_security_plugin *security_plugin, void **security_plugin_context,
+        const struct ddsrt_log_cfg *logcfg);
 
 DDS_EXPORT dds_return_t dds_security_verify_plugin_functions(
         dds_security_authentication *authentication_context, dds_security_plugin *auth_plugin,
         dds_security_cryptography *crypto_context, dds_security_plugin *crypto_plugin,
-        dds_security_access_control *access_control_context, dds_security_plugin *ac_plugin);
+        dds_security_access_control *access_control_context, dds_security_plugin *ac_plugin,
+        const struct ddsrt_log_cfg *logcfg);
 
 #endif /* SECURITY_CORE_PLUGINS_H_ */
 
diff --git a/src/security/core/src/dds_security_plugins.c b/src/security/core/src/dds_security_plugins.c
index 942e94b..bfc75a4 100644
--- a/src/security/core/src/dds_security_plugins.c
+++ b/src/security/core/src/dds_security_plugins.c
@@ -10,395 +10,257 @@
  * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
  */
 #include <string.h>
+#include <assert.h>
 
-#include "dds/ddsrt/misc.h"
-
-#include "dds/security/core/dds_security_utils.h"
 #include "dds/security/core/dds_security_plugins.h"
-#include "dds/security/dds_security_api.h"
-#include "dds/ddsi/q_unused.h"
-#include "dds/ddsi/ddsi_security_msg.h"
-#include "dds/ddsi/ddsi_security_omg.h"
-
-
-#include "dds/ddsi/q_config.h"
-#include "dds/ddsi/q_log.h"
+#include "dds/ddsrt/log.h"
 #include "dds/ddsrt/atomics.h"
 #include "dds/ddsrt/heap.h"
 #include "dds/ddsrt/dynlib.h"
-#include "dds/ddsrt/process.h"
-#include "dds/ddsrt/string.h"
-#include "dds/ddsrt/sync.h"
-#include "dds/ddsrt/hopscotch.h"
-
-#include "dds/ddsi/q_entity.h"
-#include "dds/ddsi/q_bswap.h"
-#include "dds/ddsi/q_xevent.h"
-#include "dds/ddsi/q_time.h"
-#include "dds/ddsi/q_plist.h"
 #include "dds/ddsrt/io.h"
 
-
-
-#define AUTH_NAME "Authentication"
-#define AC_NAME "Access Control"
-#define CRYPTO_NAME "Cryptographic"
-
-dds_return_t dds_security_check_plugin_configuration(
-    const dds_security_plugin_suite_config *security_suite_config )
+static bool check_plugin_configuration (const dds_security_plugin_config *config, const char *name, const struct ddsrt_log_cfg *logcfg)
 {
-
-  dds_return_t result = DDS_RETCODE_ERROR;
-
-  if (security_suite_config->access_control.library_path == NULL) {
-    DDS_ERROR("AccessControl security plugin library path is not defined");
-  } else if (strlen(security_suite_config->access_control.library_path)
-      == 0) {
-    DDS_ERROR("AccessControl security plugin library path is empty ");
-  } else if (security_suite_config->access_control.library_init == NULL) {
-    DDS_ERROR("AccessControl security plugin init function is not defined");
-  } else if (strlen(security_suite_config->access_control.library_init)
-      == 0) {
-    DDS_ERROR("AccessControl security plugin init function is empty ");
-  } else if (security_suite_config->access_control.library_finalize == NULL) {
-    DDS_ERROR(
-        "AccessControl security plugin finalize function is not defined ");
-  } else if (strlen(security_suite_config->access_control.library_finalize)
-      == 0) {
-    DDS_ERROR("AccessControl security plugin finalize function is empty");
-  } else if (security_suite_config->authentication.library_path == NULL) {
-    DDS_ERROR(
-        "Authentication security plugin library path is not defined in the configuration ");
-  } else  if (strlen(security_suite_config->authentication.library_path)
-      == 0) {
-    DDS_ERROR("Authentication security plugin library path is empty ");
-  } else if (security_suite_config->authentication.library_init == NULL) {
-    DDS_ERROR("Authentication security plugin init function is not defined ");
-  } else if (strlen(security_suite_config->authentication.library_init)
-      == 0) {
-    DDS_ERROR("Authentication security plugin init function is empty ");
-  } else if (security_suite_config->authentication.library_finalize == NULL) {
-    DDS_ERROR(
-        "Authentication security plugin finalize function is not defined ");
-  } else if (strlen(security_suite_config->authentication.library_finalize)
-      == 0) {
-    DDS_ERROR("Authentication security plugin finalize function is empty");
-  } else if (security_suite_config->cryptography.library_path == NULL) {
-    DDS_ERROR(
-        "Cryptography security plugin library path is not defined in the configuration ");
-  } else if (strlen(security_suite_config->cryptography.library_path)
-      == 0) {
-    DDS_ERROR("Cryptography security plugin library path is empty ");
-  } else if (security_suite_config->cryptography.library_init == NULL) {
-    DDS_ERROR("Cryptography security plugin init function is not defined ");
-  } else if (strlen(security_suite_config->cryptography.library_init)
-      == 0) {
-    DDS_ERROR("Cryptography security plugin init function is empty ");
-  } else if (security_suite_config->cryptography.library_finalize == NULL) {
-    DDS_ERROR("Cryptography security plugin finalize function is not defined ");
-  } else if (strlen(security_suite_config->cryptography.library_finalize)
-      == 0) {
-    DDS_ERROR("Cryptography security plugin finalize function is empty");
-  } else {
-    result = DDS_RETCODE_OK;
-  }
-
-  return result;
-}
-
-/*
- * checks the function pointer value and CHANGES the out-result value if it is NULL
- */
-static bool verify_function(void *function_ptr, dds_security_plugin *plugin,
-    const char *function_name)
-{
-
-  if ( function_ptr == NULL ) {
-    DDS_ERROR("Could not find the function for %s: %s \n", plugin->name,
-        function_name);
+  if (config->library_path == NULL || *config->library_path == 0) {
+    DDS_CERROR (logcfg, "%s security plugin library path is undefined or empty\n", name);
     return false;
   }
-  else {
-    return true;
+  if (config->library_init == NULL || *config->library_init == 0) {
+    DDS_CERROR (logcfg, "%s security plugin init function is undefined or empty\n", name);
+    return false;
   }
+  if (config->library_finalize == NULL || *config->library_finalize == 0) {
+    DDS_CERROR (logcfg, "%s security plugin finalize function is undefined or empty\n", name);
+    return false;
+  }
+  return true;
+}
+
+dds_return_t dds_security_check_plugin_configuration (const dds_security_plugin_suite_config *security_suite_config, const struct ddsrt_log_cfg *logcfg)
+{
+  if (check_plugin_configuration (&security_suite_config->access_control, "AccessControl", logcfg) &&
+      check_plugin_configuration (&security_suite_config->authentication, "Authentication", logcfg) &&
+      check_plugin_configuration (&security_suite_config->cryptography, "Cryptography", logcfg))
+    return DDS_RETCODE_OK;
+  else
+    return DDS_RETCODE_ERROR;
+}
+
+static bool verify_function (const void *function_ptr, dds_security_plugin *plugin, const char *function_name, const struct ddsrt_log_cfg *logcfg)
+{
+  if (function_ptr != NULL)
+    return true;
+  else
+  {
+    DDS_CERROR (logcfg, "Could not find the function for %s: %s\n", plugin->name, function_name);
+    return false;
+  }
+}
+
+struct verify_plugin_functions_tab {
+  size_t off;
+  const char *name;
+};
+
+static bool verify_plugin_functions (const void *context, dds_security_plugin *plugin, const struct verify_plugin_functions_tab *entries, size_t nentries, const struct ddsrt_log_cfg *logcfg)
+{
+  for (size_t i = 0; i < nentries; i++)
+  {
+    const char *p = (const char *) context + entries[i].off;
+    if (!verify_function (*((void **) p), plugin, entries[i].name, logcfg))
+      return false;
+  }
+  return true;
 }
 
 dds_return_t dds_security_verify_plugin_functions(
     dds_security_authentication *authentication_context, dds_security_plugin *auth_plugin,
     dds_security_cryptography *crypto_context, dds_security_plugin *crypto_plugin,
-    dds_security_access_control *access_control_context, dds_security_plugin *ac_plugin)
+    dds_security_access_control *access_control_context, dds_security_plugin *ac_plugin,
+    const struct ddsrt_log_cfg *logcfg)
 {
-
-  if(
-    verify_function(authentication_context->validate_local_identity, auth_plugin,
-        "validate_local_identity" ) &&
-    verify_function(authentication_context->get_identity_token, auth_plugin,
-        "get_identity_token" ) &&
-    verify_function(authentication_context->get_identity_status_token,
-        auth_plugin, "get_identity_status_token" ) &&
-    verify_function(authentication_context->set_permissions_credential_and_token,
-        auth_plugin, "set_permissions_credential_and_token" ) &&
-    verify_function(authentication_context->validate_remote_identity,
-        auth_plugin, "validate_remote_identity" ) &&
-    verify_function(authentication_context->begin_handshake_request, auth_plugin,
-        "begin_handshake_request" ) &&
-    verify_function(authentication_context->begin_handshake_reply, auth_plugin,
-        "begin_handshake_reply" ) &&
-    verify_function(authentication_context->process_handshake, auth_plugin,
-        "process_handshake" ) &&
-    verify_function(authentication_context->get_shared_secret, auth_plugin,
-        "get_shared_secret" ) &&
-    verify_function(
-        authentication_context->get_authenticated_peer_credential_token,
-        auth_plugin, "get_authenticated_peer_credential_token" ) &&
-    verify_function(authentication_context->set_listener, auth_plugin,
-        "set_listener" ) &&
-    verify_function(authentication_context->return_identity_token, auth_plugin,
-        "return_identity_token" ) &&
-    verify_function(authentication_context->return_identity_status_token,
-        auth_plugin, "return_identity_status_token" ) &&
-
-    verify_function(
-        authentication_context->return_authenticated_peer_credential_token,
-        auth_plugin, "return_authenticated_peer_credential_token" ) &&
-    verify_function(authentication_context->return_handshake_handle, auth_plugin,
-        "return_handshake_handle" ) &&
-    verify_function(authentication_context->return_identity_handle, auth_plugin,
-        "return_identity_handle" ) &&
-    verify_function(authentication_context->return_sharedsecret_handle,
-        auth_plugin, "return_sharedsecret_handle" ) &&
-
-    verify_function(access_control_context->validate_local_permissions,
-        ac_plugin, "validate_local_permissions" ) &&
-    verify_function(access_control_context->validate_remote_permissions,
-        ac_plugin, "validate_remote_permissions" ) &&
-    verify_function(access_control_context->check_create_participant, ac_plugin,
-        "check_create_participant" ) &&
-    verify_function(access_control_context->check_create_datawriter, ac_plugin,
-        "check_create_datawriter" ) &&
-    verify_function(access_control_context->check_create_datareader, ac_plugin,
-        "check_create_datareader" ) &&
-
-    verify_function(access_control_context->check_create_topic, ac_plugin,
-        "check_create_topic" ) &&
-    verify_function(
-        access_control_context->check_local_datawriter_register_instance,
-        ac_plugin, "check_local_datawriter_register_instance" ) &&
-    verify_function(
-        access_control_context->check_local_datawriter_dispose_instance,
-        ac_plugin, "check_local_datawriter_dispose_instance" ) &&
-    verify_function(access_control_context->check_remote_participant, ac_plugin,
-        "check_remote_participant" ) &&
-    verify_function(access_control_context->check_remote_datawriter, ac_plugin,
-        "check_remote_datawriter" ) &&
-    verify_function(access_control_context->check_remote_datareader, ac_plugin,
-        "check_remote_datareader" ) &&
-    verify_function(access_control_context->check_remote_topic, ac_plugin,
-        "check_remote_topic" ) &&
-    verify_function(access_control_context->check_local_datawriter_match,
-        ac_plugin, "check_local_datawriter_match" ) &&
-    verify_function(access_control_context->check_local_datareader_match,
-        ac_plugin, "check_local_datareader_match" ) &&
-    verify_function(
-        access_control_context->check_remote_datawriter_register_instance,
-        ac_plugin, "check_remote_datawriter_register_instance" ) &&
-    verify_function(
-        access_control_context->check_remote_datawriter_dispose_instance,
-        ac_plugin, "check_remote_datawriter_dispose_instance" ) &&
-    verify_function(access_control_context->get_permissions_token, ac_plugin,
-        "get_permissions_token" ) &&
-    verify_function(access_control_context->get_permissions_credential_token,
-        ac_plugin, "get_permissions_credential_token" ) &&
-    verify_function(access_control_context->set_listener, ac_plugin,
-        "set_listener" ) &&
-    verify_function(access_control_context->return_permissions_token, ac_plugin,
-        "return_permissions_token" ) &&
-    verify_function(access_control_context->return_permissions_credential_token,
-        ac_plugin, "return_permissions_credential_token" ) &&
-    verify_function(access_control_context->get_participant_sec_attributes,
-        ac_plugin, "get_participant_sec_attributes" ) &&
-    verify_function(access_control_context->get_topic_sec_attributes, ac_plugin,
-        "get_topic_sec_attributes" ) &&
-    verify_function(access_control_context->get_datawriter_sec_attributes,
-        ac_plugin, "get_datawriter_sec_attributes" ) &&
-    verify_function(access_control_context->get_datareader_sec_attributes,
-        ac_plugin, "get_datareader_sec_attributes" ) &&
-    verify_function(access_control_context->return_participant_sec_attributes,
-        ac_plugin, "return_participant_sec_attributes" ) &&
-    verify_function(access_control_context->return_datawriter_sec_attributes,
-        ac_plugin, "return_datawriter_sec_attributes" ) &&
-    verify_function(access_control_context->return_datareader_sec_attributes,
-        ac_plugin, "return_datareader_sec_attributes" ) &&
-    verify_function(access_control_context->return_permissions_handle,
-          ac_plugin, "return_permissions_handle" ) &&
-
-    verify_function(
-        crypto_context->crypto_key_factory->register_local_participant,
-        crypto_plugin, "register_local_participant" ) &&
-    verify_function(
-        crypto_context->crypto_key_factory->register_matched_remote_participant,
-        crypto_plugin, "register_matched_remote_participant" ) &&
-    verify_function(crypto_context->crypto_key_factory->register_local_datawriter,
-        crypto_plugin, "register_local_datawriter" ) &&
-    verify_function(
-        crypto_context->crypto_key_factory->register_matched_remote_datareader,
-        crypto_plugin, "register_matched_remote_datareader" ) &&
-    verify_function(crypto_context->crypto_key_factory->register_local_datareader,
-        crypto_plugin, "register_local_datareader" ) &&
-    verify_function(
-        crypto_context->crypto_key_factory->register_matched_remote_datawriter,
-        crypto_plugin, "register_matched_remote_datawriter" ) &&
-    verify_function(crypto_context->crypto_key_factory->unregister_participant,
-        crypto_plugin, "unregister_participant" ) &&
-    verify_function(crypto_context->crypto_key_factory->unregister_datawriter,
-        crypto_plugin, "unregister_datawriter" ) &&
-    verify_function(crypto_context->crypto_key_factory->unregister_datareader,
-        crypto_plugin, "unregister_datareader" ) &&
-
-    verify_function(
-        crypto_context->crypto_key_exchange->create_local_participant_crypto_tokens,
-        crypto_plugin, "create_local_participant_crypto_tokens" ) &&
-    verify_function(
-        crypto_context->crypto_key_exchange->set_remote_participant_crypto_tokens,
-        crypto_plugin, "set_remote_participant_crypto_tokens" ) &&
-    verify_function(
-        crypto_context->crypto_key_exchange->create_local_datawriter_crypto_tokens,
-        crypto_plugin, "create_local_datawriter_crypto_tokens" ) &&
-    verify_function(
-        crypto_context->crypto_key_exchange->set_remote_datawriter_crypto_tokens,
-        crypto_plugin, "set_remote_datawriter_crypto_tokens" ) &&
-    verify_function(
-        crypto_context->crypto_key_exchange->create_local_datareader_crypto_tokens,
-        crypto_plugin, "create_local_datareader_crypto_tokens" ) &&
-    verify_function(
-        crypto_context->crypto_key_exchange->set_remote_datareader_crypto_tokens,
-        crypto_plugin, "set_remote_datareader_crypto_tokens" ) &&
-    verify_function(crypto_context->crypto_key_exchange->return_crypto_tokens,
-        crypto_plugin, "return_crypto_tokens" ) &&
-
-    verify_function(crypto_context->crypto_transform->encode_serialized_payload,
-        crypto_plugin, "encode_serialized_payload" ) &&
-    verify_function(
-        crypto_context->crypto_transform->encode_datawriter_submessage,
-        crypto_plugin, "encode_datawriter_submessage" ) &&
-    verify_function(
-        crypto_context->crypto_transform->encode_datareader_submessage,
-        crypto_plugin, "encode_datareader_submessage" ) &&
-    verify_function(crypto_context->crypto_transform->encode_rtps_message,
-        crypto_plugin, "encode_rtps_message" ) &&
-    verify_function(crypto_context->crypto_transform->decode_rtps_message,
-        crypto_plugin, "decode_rtps_message" ) &&
-    verify_function(crypto_context->crypto_transform->preprocess_secure_submsg,
-        crypto_plugin, "preprocess_secure_submsg" ) &&
-    verify_function(
-        crypto_context->crypto_transform->decode_datawriter_submessage,
-        crypto_plugin, "decode_datawriter_submessage" ) &&
-    verify_function(
-        crypto_context->crypto_transform->decode_datareader_submessage,
-        crypto_plugin, "decode_datareader_submessage" ) &&
-    verify_function(crypto_context->crypto_transform->decode_serialized_payload,
-        crypto_plugin, "decode_serialized_payload" ) ){
+#define FGEN(context, name) { offsetof (context, name), #name }
+#define F(name) FGEN (dds_security_authentication, name)
+  static const struct verify_plugin_functions_tab auth[] = {
+    F (validate_local_identity),
+    F (get_identity_token),
+    F (get_identity_status_token),
+    F (set_permissions_credential_and_token),
+    F (validate_remote_identity),
+    F (begin_handshake_request),
+    F (begin_handshake_reply),
+    F (process_handshake),
+    F (get_shared_secret),
+    F (get_authenticated_peer_credential_token),
+    F (set_listener),
+    F (return_identity_token),
+    F (return_identity_status_token),
+    F (return_authenticated_peer_credential_token),
+    F (return_handshake_handle),
+    F (return_sharedsecret_handle)
+  };
+#undef F
+#define F(name) FGEN (dds_security_access_control, name)
+  static const struct verify_plugin_functions_tab ac[] = {
+    F (validate_local_permissions),
+    F (validate_remote_permissions),
+    F (check_create_participant),
+    F (check_create_datawriter),
+    F (check_create_datareader),
+    F (check_create_topic),
+    F (check_local_datawriter_register_instance),
+    F (check_local_datawriter_dispose_instance),
+    F (check_remote_participant),
+    F (check_remote_datawriter),
+    F (check_remote_datareader),
+    F (check_remote_topic),
+    F (check_local_datawriter_match),
+    F (check_local_datareader_match),
+    F (check_remote_datawriter_register_instance),
+    F (check_remote_datawriter_dispose_instance),
+    F (get_permissions_token),
+    F (get_permissions_credential_token),
+    F (set_listener),
+    F (return_permissions_token),
+    F (return_permissions_credential_token),
+    F (get_participant_sec_attributes),
+    F (get_topic_sec_attributes),
+    F (get_datawriter_sec_attributes),
+    F (get_datareader_sec_attributes),
+    F (return_participant_sec_attributes),
+    F (return_datawriter_sec_attributes),
+    F (return_datareader_sec_attributes),
+    F (return_permissions_handle)
+  };
+#undef F
+#define F(name) FGEN (dds_security_crypto_key_factory, name)
+  static const struct verify_plugin_functions_tab cryptoF[] = {
+    F (register_local_participant),
+    F (register_matched_remote_participant),
+    F (register_local_datawriter),
+    F (register_matched_remote_datareader),
+    F (register_local_datareader),
+    F (register_matched_remote_datawriter),
+    F (unregister_participant),
+    F (unregister_datawriter),
+    F (unregister_datareader)
+  };
+#undef F
+#define F(name) FGEN (dds_security_crypto_key_exchange, name)
+  static const struct verify_plugin_functions_tab cryptoX[] = {
+    F (create_local_participant_crypto_tokens),
+    F (set_remote_participant_crypto_tokens),
+    F (create_local_datawriter_crypto_tokens),
+    F (set_remote_datawriter_crypto_tokens),
+    F (create_local_datareader_crypto_tokens),
+    F (set_remote_datareader_crypto_tokens),
+    F (return_crypto_tokens)
+  };
+#undef F
+#define F(name) FGEN (dds_security_crypto_transform, name)
+  static const struct verify_plugin_functions_tab cryptoT[] = {
+    F (encode_serialized_payload),
+    F (encode_datawriter_submessage),
+    F (encode_datareader_submessage),
+    F (encode_rtps_message),
+    F (decode_rtps_message),
+    F (preprocess_secure_submsg),
+    F (decode_datawriter_submessage),
+    F (decode_datareader_submessage),
+    F (decode_serialized_payload)
+  };
+#undef F
+#define C(context, plugin, table) verify_plugin_functions (context, plugin, table, sizeof (table) / sizeof (table[0]), logcfg)
+  if (C (authentication_context, auth_plugin, auth) &&
+      C (access_control_context, ac_plugin, ac) &&
+      C (crypto_context->crypto_key_factory, crypto_plugin, cryptoF) &&
+      C (crypto_context->crypto_key_exchange, crypto_plugin, cryptoX) &&
+      C (crypto_context->crypto_transform, crypto_plugin, cryptoT))
+  {
     return DDS_RETCODE_OK;
   }
-  else {
+  else
+  {
     return DDS_RETCODE_ERROR;
   }
-
+#undef C
 }
 
 /**
  * All fields of the library properties are supposed to be non-empty
  */
-dds_return_t dds_security_load_security_library(
-    const dds_security_plugin_config *plugin_config,
-    dds_security_plugin *security_plugin,
-    void **security_plugin_context)
+dds_return_t dds_security_load_security_library (const dds_security_plugin_config *plugin_config, dds_security_plugin *security_plugin, void **security_plugin_context, const struct ddsrt_log_cfg *logcfg)
 {
-  dds_return_t ret = DDS_RETCODE_ERROR;
-  dds_return_t lib_ret = DDS_RETCODE_ERROR;
-  char * init_parameters = "";
+  dds_return_t lib_ret;
+  char *init_parameters = "";
   char *library_str;
 
-  assert( plugin_config->library_path );
-  assert( plugin_config->library_init );
-  assert( plugin_config->library_finalize );
+  assert (plugin_config->library_path);
+  assert (plugin_config->library_init);
+  assert (plugin_config->library_finalize);
 
-  if ( strlen(plugin_config->library_path) > 0 ) {
+  security_plugin->lib_handle = NULL;
+  if (*plugin_config->library_path == 0)
+    return DDS_RETCODE_ERROR;
 
-    //library_str = ddsrt_malloc(strlen(plugin_config->library_path) + 1);
-
-    if (strncmp(plugin_config->library_path, "file://", 7) == 0) {
-      (void)ddsrt_asprintf(&library_str, "%s", &plugin_config->library_path[7]);
-    } else {
-      (void)ddsrt_asprintf(&library_str, "%s", plugin_config->library_path);
-    }
-
-    lib_ret = ddsrt_dlopen( library_str, true, &security_plugin->lib_handle);
-    ddsrt_free(library_str);
-    if( lib_ret == DDS_RETCODE_OK && security_plugin->lib_handle){
-
-      /* Get init and fini functions . */
-      if ( ddsrt_dlsym(security_plugin->lib_handle, plugin_config->library_init, (void **)&security_plugin->func_init) == DDS_RETCODE_OK){
-        if ( ddsrt_dlsym(security_plugin->lib_handle, plugin_config->library_finalize, (void **)&security_plugin->func_finalize) == DDS_RETCODE_OK){
-
-          /* Initialize plugin. */
-          if ( security_plugin->func_init != NULL) {
-            lib_ret = security_plugin->func_init(init_parameters, (void **) security_plugin_context);
-
-            if (lib_ret == DDS_RETCODE_OK){ /* error occured on init */
-              return DDS_RETCODE_OK;
-            } else{
-              DDS_ERROR("Error occured while initializing %s plugin\n",
-                 security_plugin->name);
-              goto library_error;
-            }
-          }
-
-        }
-        else {
-          DDS_ERROR("Could not find the function: %s\n", plugin_config->library_finalize);
-          goto library_error;
-        }
-
-
-      }
-      else{
-        DDS_ERROR("Could not find the function: %s\n",plugin_config->library_init);
-        goto library_error;
-      }
-
-    } else {
-      char buffer[256];
-      ddsrt_dlerror(buffer, sizeof(buffer));
-      DDS_ERROR("Could not load %s library: %s\n", security_plugin->name, buffer);
-      goto load_error;
-    }
-
-
-    return ret;
+  const size_t poff = (strncmp (plugin_config->library_path, "file://", 7) == 0) ? 7 : 0;
+  (void) ddsrt_asprintf (&library_str, "%s", plugin_config->library_path + poff);
+  lib_ret = ddsrt_dlopen (library_str, true, &security_plugin->lib_handle);
+  ddsrt_free (library_str);
+  if (lib_ret != DDS_RETCODE_OK)
+  {
+    char buffer[256];
+    ddsrt_dlerror (buffer, sizeof (buffer));
+    DDS_CERROR (logcfg, "Could not load %s library: %s\n", security_plugin->name, buffer);
+    goto load_error;
   }
 
+  void *tmp;
+  if (ddsrt_dlsym (security_plugin->lib_handle, plugin_config->library_init, &tmp) != DDS_RETCODE_OK)
+  {
+    DDS_CERROR (logcfg, "Could not find the function: %s\n", plugin_config->library_init);
+    goto library_error;
+  }
+  security_plugin->func_init = (plugin_init) tmp;
+
+  if (ddsrt_dlsym (security_plugin->lib_handle, plugin_config->library_finalize, &tmp) != DDS_RETCODE_OK)
+  {
+    DDS_CERROR (logcfg, "Could not find the function: %s\n", plugin_config->library_finalize);
+    goto library_error;
+  }
+  security_plugin->func_finalize = (plugin_finalize) tmp;
+
+  if (security_plugin->func_init != 0)
+  {
+    if (security_plugin->func_init (init_parameters, (void **) security_plugin_context) != DDS_RETCODE_OK)
+    {
+      DDS_CERROR (logcfg, "Error occured while initializing %s plugin\n", security_plugin->name);
+      goto library_error;
+    }
+  }
+  return DDS_RETCODE_OK;
 
 library_error:
-  ddsrt_dlclose(security_plugin->lib_handle);
+  ddsrt_dlclose (security_plugin->lib_handle);
   security_plugin->lib_handle = NULL;
 load_error:
-  return ret;
+  return DDS_RETCODE_ERROR;
 }
 
-dds_return_t dds_security_plugin_release( const dds_security_plugin *security_plugin, void *context ){
-  dds_return_t result= DDS_RETCODE_OK;
-  assert( security_plugin->lib_handle );
-  assert( security_plugin->func_finalize );
+dds_return_t dds_security_plugin_release (const dds_security_plugin *security_plugin, void *context)
+{
+  dds_return_t result = DDS_RETCODE_OK;
+  assert (security_plugin->lib_handle);
+  assert (security_plugin->func_finalize);
 
   /* if get error from either finalize OR close,  return error */
-  if( security_plugin->func_finalize( context ) != DDS_RETCODE_OK){
+  if (security_plugin->func_finalize (context) != DDS_RETCODE_OK)
+  {
     DDS_ERROR("Error occured while finaizing %s plugin", security_plugin->name);
     result = DDS_RETCODE_ERROR;
   }
-  if( ddsrt_dlclose( security_plugin->lib_handle ) != DDS_RETCODE_OK){
+  if (ddsrt_dlclose (security_plugin->lib_handle) != DDS_RETCODE_OK){
     result = DDS_RETCODE_ERROR;
   }
   return result;
 }
-

From 03b8c51332c216ccf22abdef3d154c93c86a8c76 Mon Sep 17 00:00:00 2001
From: Erik Boasson <eb@ilities.com>
Date: Thu, 16 Jan 2020 13:20:41 +0100
Subject: [PATCH 088/238] Move security config tests

Signed-off-by: Erik Boasson <eb@ilities.com>
---
 src/core/ddsc/tests/CMakeLists.txt            |  31 -
 src/core/ddsc/tests/config.c                  | 808 +----------------
 src/core/ddsc/tests/config_env.h.in           |   4 -
 .../core/tests/plugin_loading/CMakeLists.txt  | 134 +--
 .../core/tests/plugin_loading/config_env.h.in |   4 +
 .../tests/plugin_loading/security_config.c    | 812 ++++++++++++++++++
 6 files changed, 866 insertions(+), 927 deletions(-)
 create mode 100644 src/security/core/tests/plugin_loading/security_config.c

diff --git a/src/core/ddsc/tests/CMakeLists.txt b/src/core/ddsc/tests/CMakeLists.txt
index 62e8844..3365bb0 100644
--- a/src/core/ddsc/tests/CMakeLists.txt
+++ b/src/core/ddsc/tests/CMakeLists.txt
@@ -73,33 +73,6 @@ set(CUnit_ddsc_config_simple_udp_file "${CMAKE_CURRENT_LIST_DIR}/config_simple_u
 set(CUnit_ddsc_config_simple_udp_uri "file://${CUnit_ddsc_config_simple_udp_file}")
 set(CUnit_ddsc_config_simple_udp_max_participants "0")
 set(CUnit_ddsc_config_simple_udp_env "${PROJECT_NAME_CAPS}_URI=${CUnit_ddsc_config_simple_udp_uri};MAX_PARTICIPANTS=${CUnit_ddsc_config_simple_udp_max_participants};${CUnit_ddsc_config_simple_udp_env}")
-
-
-unset(test_lib_tests)
-# Let the cunit application know the location and name of the security mock libraries.
-#file(TO_NATIVE_PATH "${CMAKE_CURRENT_BINARY_DIR}/../../../security/core/tests/plugin_loading" test_lib_native_dir)
-
-
-file(TO_NATIVE_PATH "${PROJECT_BINARY_DIR}/src/security/core/tests/plugin_loading" test_lib_native_dir)
-file(TO_NATIVE_PATH "/" test_lib_sep)
-string(REPLACE "\\" "\\\\" test_lib_dir ${test_lib_native_dir})
-string(REPLACE "\\" "\\\\" test_lib_sep ${test_lib_sep})
-
-process_cunit_source_file("config.c" test_lib_header test_lib_suites test_lib_tests)
-foreach(libtest ${test_lib_tests})
-	string(REPLACE ":" ";" libtest ${libtest})
-	list(GET libtest 0 suite)
-	list(GET libtest 1 test)
-	set(libtestname "CUnit_${suite}_${test}")
-	if("${CMAKE_HOST_SYSTEM}" MATCHES ".*Windows.*")
-		set_property(TEST ${libtestname} APPEND PROPERTY ENVIRONMENT "${test_lib_native_dir}")
-	else()
-		set_property(TEST ${libtestname} APPEND PROPERTY ENVIRONMENT "LD_LIBRARY_PATH=${test_lib_native_dir};$ENV{LD_LIBRARY_PATH}")
-	endif()
-endforeach()
-
-
-
 set_tests_properties(
 	CUnit_ddsc_config_simple_udp
 	PROPERTIES
@@ -107,7 +80,3 @@ set_tests_properties(
 		ENVIRONMENT "${CUnit_ddsc_config_simple_udp_env}")
 
 configure_file("config_env.h.in" "config_env.h" @ONLY)
-
-
-
-
diff --git a/src/core/ddsc/tests/config.c b/src/core/ddsc/tests/config.c
index 644867c..bb82d85 100644
--- a/src/core/ddsc/tests/config.c
+++ b/src/core/ddsc/tests/config.c
@@ -22,10 +22,6 @@
 #include "dds/ddsi/q_misc.h"
 #include "dds/ddsi/q_xqos.h"
 
-#ifdef DDSI_INCLUDE_SECURITY
-#include "dds/security/dds_security_api_defs.h"
-#endif
-
 #define FORCE_ENV
 
 #define URI_VARIABLE DDS_PROJECT_NAME_NOSPACE_CAPS"_URI"
@@ -106,38 +102,11 @@ static void logger(void *ptr, const dds_log_data_t *data)
   }
 }
 
-CU_Test(ddsc_config, security_non, .init = ddsrt_init, .fini = ddsrt_fini) {
-
-  /* There shouldn't be traces that mention security. */
-  const char *log_expected[] = {
-    "*Security*",
-    NULL
-  };
-
-  dds_entity_t participant;
-
-  /* Set up the trace sinks to detect the config parsing. */
-  dds_set_log_mask(DDS_LC_FATAL|DDS_LC_ERROR|DDS_LC_WARNING|DDS_LC_CONFIG);
-  dds_set_log_sink(&logger, (void*)log_expected);
-  dds_set_trace_sink(&logger, (void*)log_expected);
-
-  /* Create participant with an empty security element. */
-  found = 0;
-  ddsrt_setenv(URI_VARIABLE, "<Tracing><Verbosity>finest</></>");
-  participant = dds_create_participant(DDS_DOMAIN_DEFAULT, NULL, NULL);
-  ddsrt_setenv(URI_VARIABLE, "");
-  CU_ASSERT_FATAL(participant > 0);
-  dds_delete(participant);
-  dds_set_log_sink(NULL, NULL);
-  dds_set_trace_sink(NULL, NULL);
-
-  /* No security traces should have been provided. */
-  CU_ASSERT_FATAL(found == 0x0);
-}
-
-CU_Test(ddsc_config, security_empty, .init = ddsrt_init, .fini = ddsrt_fini) {
-
-  /* Expected traces when creating participant with an empty security element. */
+CU_Test(ddsc_security_config, empty, .init = ddsrt_init, .fini = ddsrt_fini)
+{
+  /* Expected traces when creating participant with an empty security element.  We need to
+     test this one here to be sure that it refuses to start when security is configured
+     but the implementation doesn't include support for it. */
   const char *log_expected[] = {
 #ifndef DDSI_INCLUDE_SECURITY
     "config: //CycloneDDS/Domain: DDSSecurity: unknown element*",
@@ -172,770 +141,3 @@ CU_Test(ddsc_config, security_empty, .init = ddsrt_init, .fini = ddsrt_fini) {
   CU_ASSERT_FATAL(found == 0x7);
 #endif
 }
-
-CU_Test(ddsc_config, security_missing, .init = ddsrt_init, .fini = ddsrt_fini) {
-
-  /* Expected traces when creating participant with the security elements. */
-  const char *log_expected[] = {
-#ifndef DDSI_INCLUDE_SECURITY
-    "config: //CycloneDDS/Domain: DDSSecurity: unknown element*",
-#else
-    "config: //CycloneDDS/Domain/DDSSecurity/Authentication/IdentityCertificate/#text: element missing in configuration*",
-    "config: //CycloneDDS/Domain/DDSSecurity/Authentication/IdentityCA/#text: element missing in configuration*",
-    "config: //CycloneDDS/Domain/DDSSecurity/Authentication/PrivateKey/#text: element missing in configuration*",
-#endif
-      NULL
-    };
-
-  /* IdentityCertificate, IdentityCA and PrivateKey values or elements are missing. */
-  const char *sec_config =
-    "<Tracing><Verbosity>finest</></>"
-    "<DDSSecurity>"
-      "<Authentication>"
-        "<Library path=\""CONFIG_PLUGIN_MOCK_DIR""CONFIG_LIB_SEP""CONFIG_LIB_PREFIX"dds_security_authentication_all_ok"CONFIG_LIB_SUFFIX"\" initFunction=\"init_authentication\" finalizeFunction=\"finalize_authentication\" />"
-        "<IdentityCertificate></IdentityCertificate>"
-        "<PrivateKey></PrivateKey>"
-        "<Password>testtext_Password_testtext</Password>"
-      "</Authentication>"
-      "<Cryptographic>"
-        "<Library path=\""CONFIG_PLUGIN_MOCK_DIR""CONFIG_LIB_SEP""CONFIG_LIB_PREFIX"dds_security_cryptography_all_ok"CONFIG_LIB_SUFFIX"\" initFunction=\"init_crypto\" finalizeFunction=\"finalize_crypto\"/>"
-      "</Cryptographic>"
-      "<AccessControl>"
-        "<Library path=\""CONFIG_PLUGIN_MOCK_DIR""CONFIG_LIB_SEP""CONFIG_LIB_PREFIX"dds_security_access_control_all_ok"CONFIG_LIB_SUFFIX"\" initFunction=\"init_access_control\" finalizeFunction=\"finalize_access_control\"/>"
-        "<Governance>file:Governance.p7s</Governance>"
-        "<PermissionsCA>file:Permissions_CA.pem</PermissionsCA>"
-        "<Permissions>file:Permissions.p7s</Permissions>"
-      "</AccessControl>"
-    "</DDSSecurity>";
-
-
-  dds_entity_t participant;
-
-  /* Set up the trace sinks to detect the config parsing. */
-  dds_set_log_mask(DDS_LC_FATAL|DDS_LC_ERROR|DDS_LC_WARNING|DDS_LC_CONFIG);
-  dds_set_log_sink(&logger, (void*)log_expected);
-  dds_set_trace_sink(&logger, (void*)log_expected);
-
-  /* Create participant with an empty security element. */
-  found = 0;
-  ddsrt_setenv(URI_VARIABLE, sec_config);
-  participant = dds_create_participant(DDS_DOMAIN_DEFAULT, NULL, NULL);
-  ddsrt_setenv(URI_VARIABLE, "");
-  CU_ASSERT_FATAL(participant < 0);
-  dds_set_log_sink(NULL, NULL);
-  dds_set_trace_sink(NULL, NULL);
-  /* All traces should have been provided. */
-#ifndef DDSI_INCLUDE_SECURITY
-  CU_ASSERT_FATAL(found == 0x1);
-#else
-  CU_ASSERT_FATAL(found == 0x7);
-#endif
-}
-
-CU_Test(ddsc_config, security_all, .init = ddsrt_init, .fini = ddsrt_fini) {
-
-  /* Expected traces when creating participant with the security elements. */
-  const char *log_expected[] = {
-#ifndef DDSI_INCLUDE_SECURITY
-    "config: //CycloneDDS/Domain: DDSSecurity: unknown element*",
-#else
-    "config: Domain/DDSSecurity/Authentication/Library/#text: "CONFIG_PLUGIN_MOCK_DIR""CONFIG_LIB_SEP""CONFIG_LIB_PREFIX"dds_security_authentication_all_ok"CONFIG_LIB_SUFFIX"*",
-    "config: Domain/DDSSecurity/Authentication/Library[@path]: "CONFIG_PLUGIN_MOCK_DIR""CONFIG_LIB_SEP""CONFIG_LIB_PREFIX"dds_security_authentication_all_ok"CONFIG_LIB_SUFFIX"*",
-    "config: Domain/DDSSecurity/Authentication/Library[@initFunction]: init_authentication*",
-    "config: Domain/DDSSecurity/Authentication/Library[@finalizeFunction]: finalize_authentication*",
-    "config: Domain/DDSSecurity/Authentication/IdentityCertificate/#text: testtext_IdentityCertificate_testtext*",
-    "config: Domain/DDSSecurity/Authentication/IdentityCA/#text: testtext_IdentityCA_testtext*",
-    "config: Domain/DDSSecurity/Authentication/PrivateKey/#text: testtext_PrivateKey_testtext*",
-    "config: Domain/DDSSecurity/Authentication/Password/#text: testtext_Password_testtext*",
-    "config: Domain/DDSSecurity/Authentication/TrustedCADirectory/#text: testtext_Dir_testtext*",
-    "config: Domain/DDSSecurity/AccessControl/Library/#text: "CONFIG_PLUGIN_MOCK_DIR""CONFIG_LIB_SEP""CONFIG_LIB_PREFIX"dds_security_access_control_all_ok"CONFIG_LIB_SUFFIX"*",
-    "config: Domain/DDSSecurity/AccessControl/Library[@path]: "CONFIG_PLUGIN_MOCK_DIR""CONFIG_LIB_SEP""CONFIG_LIB_PREFIX"dds_security_access_control_all_ok"CONFIG_LIB_SUFFIX"*",
-    "config: Domain/DDSSecurity/AccessControl/Library[@initFunction]: init_access_control*",
-    "config: Domain/DDSSecurity/AccessControl/Library[@finalizeFunction]: finalize_access_control*",
-    "config: Domain/DDSSecurity/AccessControl/PermissionsCA/#text: file:Permissions_CA.pem*",
-    "config: Domain/DDSSecurity/AccessControl/Governance/#text: file:Governance.p7s*",
-    "config: Domain/DDSSecurity/AccessControl/Permissions/#text: file:Permissions.p7s*",
-    "config: Domain/DDSSecurity/Cryptographic/Library/#text: "CONFIG_PLUGIN_MOCK_DIR""CONFIG_LIB_SEP""CONFIG_LIB_PREFIX"dds_security_cryptography_all_ok"CONFIG_LIB_SUFFIX"*",
-    "config: Domain/DDSSecurity/Cryptographic/Library[@path]: "CONFIG_PLUGIN_MOCK_DIR""CONFIG_LIB_SEP""CONFIG_LIB_PREFIX"dds_security_cryptography_all_ok"CONFIG_LIB_SUFFIX"*",
-    "config: Domain/DDSSecurity/Cryptographic/Library[@initFunction]: init_crypto*",
-    "config: Domain/DDSSecurity/Cryptographic/Library[@finalizeFunction]: finalize_crypto*",
-    /* The config should have been parsed into the participant QoS. */
-    "PARTICIPANT * QOS={*property_list={value={{dds.sec.auth.library.path,"CONFIG_PLUGIN_MOCK_DIR""CONFIG_LIB_SEP""CONFIG_LIB_PREFIX"dds_security_authentication_all_ok"CONFIG_LIB_SUFFIX",0},"
-      "{dds.sec.auth.library.init,init_authentication,0},"
-      "{dds.sec.auth.library.finalize,finalize_authentication,0},"
-      "{dds.sec.crypto.library.path,"CONFIG_PLUGIN_MOCK_DIR""CONFIG_LIB_SEP""CONFIG_LIB_PREFIX"dds_security_cryptography_all_ok"CONFIG_LIB_SUFFIX",0},"
-      "{dds.sec.crypto.library.init,init_crypto,0},"
-      "{dds.sec.crypto.library.finalize,finalize_crypto,0},"
-      "{dds.sec.access.library.path,"CONFIG_PLUGIN_MOCK_DIR""CONFIG_LIB_SEP""CONFIG_LIB_PREFIX"dds_security_access_control_all_ok"CONFIG_LIB_SUFFIX",0},"
-      "{dds.sec.access.library.init,init_access_control,0},"
-      "{dds.sec.access.library.finalize,finalize_access_control,0},"
-      "{dds.sec.auth.identity_ca,testtext_IdentityCA_testtext,0},"
-      "{dds.sec.auth.private_key,testtext_PrivateKey_testtext,0},"
-      "{dds.sec.auth.identity_certificate,testtext_IdentityCertificate_testtext,0},"
-      "{dds.sec.access.permissions_ca,file:Permissions_CA.pem,0},"
-      "{dds.sec.access.governance,file:Governance.p7s,0},"
-      "{dds.sec.access.permissions,file:Permissions.p7s,0},"
-      "{dds.sec.auth.password,testtext_Password_testtext,0},"
-      "{dds.sec.auth.trusted_ca_dir,testtext_Dir_testtext,0}}binary_value={}}*}*",
-
-#endif
-    NULL
-  };
-  const char *sec_config =
-    "<"DDS_PROJECT_NAME">"
-      "<Domain id=\"any\">"
-      "<Tracing><Verbosity>finest</></>"
-      "<DDSSecurity>"
-      "<Authentication>"
-        "<Library path=\""CONFIG_PLUGIN_MOCK_DIR""CONFIG_LIB_SEP""CONFIG_LIB_PREFIX"dds_security_authentication_all_ok"CONFIG_LIB_SUFFIX"\" initFunction=\"init_authentication\" finalizeFunction=\"finalize_authentication\" />"
-        "<IdentityCertificate>testtext_IdentityCertificate_testtext</IdentityCertificate>"
-        "<IdentityCA>testtext_IdentityCA_testtext</IdentityCA>"
-        "<PrivateKey>testtext_PrivateKey_testtext</PrivateKey>"
-        "<Password>testtext_Password_testtext</Password>"
-        "<TrustedCADirectory>testtext_Dir_testtext</TrustedCADirectory>"
-      "</Authentication>"
-      "<Cryptographic>"
-        "<Library path=\""CONFIG_PLUGIN_MOCK_DIR""CONFIG_LIB_SEP""CONFIG_LIB_PREFIX"dds_security_cryptography_all_ok"CONFIG_LIB_SUFFIX"\" initFunction=\"init_crypto\" finalizeFunction=\"finalize_crypto\"/>"
-      "</Cryptographic>"
-      "<AccessControl>"
-        "<Library path=\""CONFIG_PLUGIN_MOCK_DIR""CONFIG_LIB_SEP""CONFIG_LIB_PREFIX"dds_security_access_control_all_ok"CONFIG_LIB_SUFFIX"\" initFunction=\"init_access_control\" finalizeFunction=\"finalize_access_control\"/>"
-      "<Governance>file:Governance.p7s</Governance>"
-      "<PermissionsCA>file:Permissions_CA.pem</PermissionsCA>"
-      "<Permissions>file:Permissions.p7s</Permissions>"
-      "</AccessControl>"
-      "</DDSSecurity>"
-    "</Domain>"
-    "</"DDS_PROJECT_NAME">";
-
-
-
-    dds_entity_t participant;
-
-    /* Set up the trace sinks to detect the config parsing. */
-    dds_set_log_mask(DDS_LC_FATAL|DDS_LC_ERROR|DDS_LC_WARNING|DDS_LC_CONFIG);
-    dds_set_log_sink(&logger, (void*)log_expected);
-    dds_set_trace_sink(&logger, (void*)log_expected);
-
-    /* Create participant with security elements. */
-    found = 0;
-    ddsrt_setenv(URI_VARIABLE, sec_config);
-    participant = dds_create_participant(DDS_DOMAIN_DEFAULT, NULL, NULL);
-    ddsrt_setenv(URI_VARIABLE, "");
-    dds_delete(participant);
-    dds_set_log_sink(NULL, NULL);
-    dds_set_trace_sink(NULL, NULL);
-
-    /* All traces should have been provided. */
-#ifndef DDSI_INCLUDE_SECURITY
-    CU_ASSERT_FATAL(found == 0x1);
-#else
-    CU_ASSERT_FATAL(found == 0x1fffff);
-#endif
-}
-
-CU_Test(ddsc_config, security, .init = ddsrt_init, .fini = ddsrt_fini) {
-
-    /* Expected traces when creating participant with the security elements. */
-    const char *log_expected[] = {
-#ifndef DDSI_INCLUDE_SECURITY
-      "config: //CycloneDDS/Domain: DDSSecurity: unknown element*",
-#else
-      "config: Domain/DDSSecurity/Authentication/Library/#text: "CONFIG_PLUGIN_MOCK_DIR""CONFIG_LIB_SEP""CONFIG_LIB_PREFIX"dds_security_authentication_all_ok"CONFIG_LIB_SUFFIX"*",
-      "config: Domain/DDSSecurity/Authentication/Library[@path]: "CONFIG_PLUGIN_MOCK_DIR""CONFIG_LIB_SEP""CONFIG_LIB_PREFIX"dds_security_authentication_all_ok"CONFIG_LIB_SUFFIX"*",
-      "config: Domain/DDSSecurity/Authentication/Library[@initFunction]: init_authentication*",
-      "config: Domain/DDSSecurity/Authentication/Library[@finalizeFunction]: finalize_authentication*",
-      "config: Domain/DDSSecurity/Authentication/IdentityCertificate/#text: testtext_IdentityCertificate_testtext*",
-      "config: Domain/DDSSecurity/Authentication/IdentityCA/#text: testtext_IdentityCA_testtext*",
-      "config: Domain/DDSSecurity/Authentication/PrivateKey/#text: testtext_PrivateKey_testtext*",
-      "config: Domain/DDSSecurity/Authentication/Password/#text:  {}*",
-      "config: Domain/DDSSecurity/Authentication/TrustedCADirectory/#text:  {}*",
-      "config: Domain/DDSSecurity/AccessControl/Library/#text: "CONFIG_PLUGIN_MOCK_DIR""CONFIG_LIB_SEP""CONFIG_LIB_PREFIX"dds_security_access_control_all_ok"CONFIG_LIB_SUFFIX"*",
-      "config: Domain/DDSSecurity/AccessControl/Library[@path]: "CONFIG_PLUGIN_MOCK_DIR""CONFIG_LIB_SEP""CONFIG_LIB_PREFIX"dds_security_access_control_all_ok"CONFIG_LIB_SUFFIX"*",
-      "config: Domain/DDSSecurity/AccessControl/Library[@initFunction]: init_access_control*",
-      "config: Domain/DDSSecurity/AccessControl/Library[@finalizeFunction]: finalize_access_control*",
-      "config: Domain/DDSSecurity/AccessControl/PermissionsCA/#text: file:Permissions_CA.pem*",
-      "config: Domain/DDSSecurity/AccessControl/Governance/#text: file:Governance.p7s*",
-      "config: Domain/DDSSecurity/AccessControl/Permissions/#text: file:Permissions.p7s*",
-      "config: Domain/DDSSecurity/Cryptographic/Library/#text: "CONFIG_PLUGIN_MOCK_DIR""CONFIG_LIB_SEP""CONFIG_LIB_PREFIX"dds_security_cryptography_all_ok"CONFIG_LIB_SUFFIX"*",
-      "config: Domain/DDSSecurity/Cryptographic/Library[@path]: "CONFIG_PLUGIN_MOCK_DIR""CONFIG_LIB_SEP""CONFIG_LIB_PREFIX"dds_security_cryptography_all_ok"CONFIG_LIB_SUFFIX"*",
-      "config: Domain/DDSSecurity/Cryptographic/Library[@initFunction]: init_crypto*",
-      "config: Domain/DDSSecurity/Cryptographic/Library[@finalizeFunction]: finalize_crypto*",
-      /* The config should have been parsed into the participant QoS. */
-      "PARTICIPANT * QOS={*property_list={value={{dds.sec.auth.library.path,"CONFIG_PLUGIN_MOCK_DIR""CONFIG_LIB_SEP""CONFIG_LIB_PREFIX"dds_security_authentication_all_ok"CONFIG_LIB_SUFFIX",0},"
-        "{dds.sec.auth.library.init,init_authentication,0},"
-        "{dds.sec.auth.library.finalize,finalize_authentication,0},"
-        "{dds.sec.crypto.library.path,"CONFIG_PLUGIN_MOCK_DIR""CONFIG_LIB_SEP""CONFIG_LIB_PREFIX"dds_security_cryptography_all_ok"CONFIG_LIB_SUFFIX",0},"
-        "{dds.sec.crypto.library.init,init_crypto,0},"
-        "{dds.sec.crypto.library.finalize,finalize_crypto,0},"
-        "{dds.sec.access.library.path,"CONFIG_PLUGIN_MOCK_DIR""CONFIG_LIB_SEP""CONFIG_LIB_PREFIX"dds_security_access_control_all_ok"CONFIG_LIB_SUFFIX",0},"
-        "{dds.sec.access.library.init,init_access_control,0},"
-        "{dds.sec.access.library.finalize,finalize_access_control,0},"
-        "{dds.sec.auth.identity_ca,testtext_IdentityCA_testtext,0},"
-        "{dds.sec.auth.private_key,testtext_PrivateKey_testtext,0},"
-        "{dds.sec.auth.identity_certificate,testtext_IdentityCertificate_testtext,0},"
-        "{dds.sec.access.permissions_ca,file:Permissions_CA.pem,0},"
-        "{dds.sec.access.governance,file:Governance.p7s,0},"
-        "{dds.sec.access.permissions,file:Permissions.p7s,0},"
-        "{dds.sec.auth.password,,0},"
-        "{dds.sec.auth.trusted_ca_dir,,0}}binary_value={}}*}*",
-#endif
-    NULL
-  };
-
-  const char *sec_config =
-    "<Tracing><Verbosity>finest</></>"
-    "<DDSSecurity>"
-      "<Authentication>"
-        "<Library path=\""CONFIG_PLUGIN_MOCK_DIR""CONFIG_LIB_SEP""CONFIG_LIB_PREFIX"dds_security_authentication_all_ok"CONFIG_LIB_SUFFIX"\" initFunction=\"init_authentication\" finalizeFunction=\"finalize_authentication\" />"
-        "<IdentityCertificate>testtext_IdentityCertificate_testtext</IdentityCertificate>"
-        "<IdentityCA>testtext_IdentityCA_testtext</IdentityCA>"
-        "<PrivateKey>testtext_PrivateKey_testtext</PrivateKey>"
-      "</Authentication>"
-      "<Cryptographic>"
-        "<Library path=\""CONFIG_PLUGIN_MOCK_DIR""CONFIG_LIB_SEP""CONFIG_LIB_PREFIX"dds_security_cryptography_all_ok"CONFIG_LIB_SUFFIX"\" initFunction=\"init_crypto\" finalizeFunction=\"finalize_crypto\"/>"
-      "</Cryptographic>"
-      "<AccessControl>"
-        "<Library path=\""CONFIG_PLUGIN_MOCK_DIR""CONFIG_LIB_SEP""CONFIG_LIB_PREFIX"dds_security_access_control_all_ok"CONFIG_LIB_SUFFIX"\" initFunction=\"init_access_control\" finalizeFunction=\"finalize_access_control\"/>"
-        "<Governance>file:Governance.p7s</Governance>"
-        "<PermissionsCA>file:Permissions_CA.pem</PermissionsCA>"
-        "<Permissions>file:Permissions.p7s</Permissions>"
-      "</AccessControl>"
-    "</DDSSecurity>";
-
-
-    dds_entity_t participant;
-
-    /* Set up the trace sinks to detect the config parsing. */
-    dds_set_log_mask(DDS_LC_FATAL|DDS_LC_ERROR|DDS_LC_WARNING|DDS_LC_CONFIG);
-    dds_set_log_sink(&logger, (void*)log_expected);
-    dds_set_trace_sink(&logger, (void*)log_expected);
-
-    /* Create participant with security elements. */
-    found = 0;
-    ddsrt_setenv(URI_VARIABLE, sec_config);
-    participant = dds_create_participant(DDS_DOMAIN_DEFAULT, NULL, NULL);
-    ddsrt_setenv(URI_VARIABLE, "");
-    dds_delete(participant);
-    dds_set_log_sink(NULL, NULL);
-    dds_set_trace_sink(NULL, NULL);
-
-    /* All traces should have been provided. */
-#ifndef DDSI_INCLUDE_SECURITY
-    CU_ASSERT_FATAL(found == 0x1);
-#else
-    CU_ASSERT_FATAL(found == 0x1fffff);
-#endif
-}
-
-CU_Test(ddsc_config, security_deprecated, .init = ddsrt_init, .fini = ddsrt_fini) {
-
-    /* Expected traces when creating participant with the security elements. */
-    const char *log_expected[] = {
-#ifndef DDSI_INCLUDE_SECURITY
-      "config: //CycloneDDS/Domain: DDSSecurity: unknown element*",
-#else
-    "config: Domain/DDSSecurity/Authentication/Library/#text: "CONFIG_PLUGIN_MOCK_DIR""CONFIG_LIB_SEP""CONFIG_LIB_PREFIX"dds_security_authentication_all_ok"CONFIG_LIB_SUFFIX"*",
-    "config: Domain/DDSSecurity/Authentication/Library[@path]: "CONFIG_PLUGIN_MOCK_DIR""CONFIG_LIB_SEP""CONFIG_LIB_PREFIX"dds_security_authentication_all_ok"CONFIG_LIB_SUFFIX"*",
-    "config: Domain/DDSSecurity/Authentication/Library[@initFunction]: init_authentication*",
-    "config: Domain/DDSSecurity/Authentication/Library[@finalizeFunction]: finalize_authentication*",
-    "config: Domain/DDSSecurity/Authentication/IdentityCertificate/#text: testtext_IdentityCertificate_testtext*",
-    "config: Domain/DDSSecurity/Authentication/IdentityCA/#text: testtext_IdentityCA_testtext*",
-    "config: Domain/DDSSecurity/Authentication/PrivateKey/#text: testtext_PrivateKey_testtext*",
-    "config: Domain/DDSSecurity/Authentication/Password/#text: testtext_Password_testtext*",
-    "config: Domain/DDSSecurity/Authentication/TrustedCADirectory/#text: testtext_Dir_testtext*",
-    "config: Domain/DDSSecurity/AccessControl/Library/#text: "CONFIG_PLUGIN_MOCK_DIR""CONFIG_LIB_SEP""CONFIG_LIB_PREFIX"dds_security_access_control_all_ok"CONFIG_LIB_SUFFIX"*",
-    "config: Domain/DDSSecurity/AccessControl/Library[@path]: "CONFIG_PLUGIN_MOCK_DIR""CONFIG_LIB_SEP""CONFIG_LIB_PREFIX"dds_security_access_control_all_ok"CONFIG_LIB_SUFFIX"*",
-    "config: Domain/DDSSecurity/AccessControl/Library[@initFunction]: init_access_control*",
-    "config: Domain/DDSSecurity/AccessControl/Library[@finalizeFunction]: finalize_access_control*",
-    "config: Domain/DDSSecurity/AccessControl/PermissionsCA/#text: file:Permissions_CA.pem*",
-    "config: Domain/DDSSecurity/AccessControl/Governance/#text: file:Governance.p7s*",
-    "config: Domain/DDSSecurity/AccessControl/Permissions/#text: file:Permissions.p7s*",
-    "config: Domain/DDSSecurity/Cryptographic/Library/#text: "CONFIG_PLUGIN_MOCK_DIR""CONFIG_LIB_SEP""CONFIG_LIB_PREFIX"dds_security_cryptography_all_ok"CONFIG_LIB_SUFFIX"*",
-    "config: Domain/DDSSecurity/Cryptographic/Library[@path]: "CONFIG_PLUGIN_MOCK_DIR""CONFIG_LIB_SEP""CONFIG_LIB_PREFIX"dds_security_cryptography_all_ok"CONFIG_LIB_SUFFIX"*",
-    "config: Domain/DDSSecurity/Cryptographic/Library[@initFunction]: init_crypto*",
-    "config: Domain/DDSSecurity/Cryptographic/Library[@finalizeFunction]: finalize_crypto*",
-    /* The config should have been parsed into the participant QoS. */
-    "PARTICIPANT * QOS={*property_list={value={"
-      "{dds.sec.auth.library.path,"CONFIG_PLUGIN_MOCK_DIR""CONFIG_LIB_SEP""CONFIG_LIB_PREFIX"dds_security_authentication_all_ok"CONFIG_LIB_SUFFIX",0},"
-      "{dds.sec.auth.library.init,init_authentication,0},"
-      "{dds.sec.auth.library.finalize,finalize_authentication,0},"
-      "{dds.sec.crypto.library.path,"CONFIG_PLUGIN_MOCK_DIR""CONFIG_LIB_SEP""CONFIG_LIB_PREFIX"dds_security_cryptography_all_ok"CONFIG_LIB_SUFFIX",0},"
-      "{dds.sec.crypto.library.init,init_crypto,0},"
-      "{dds.sec.crypto.library.finalize,finalize_crypto,0},"
-      "{dds.sec.access.library.path,"CONFIG_PLUGIN_MOCK_DIR""CONFIG_LIB_SEP""CONFIG_LIB_PREFIX"dds_security_access_control_all_ok"CONFIG_LIB_SUFFIX",0},"
-      "{dds.sec.access.library.init,init_access_control,0},{dds.sec.access.library.finalize,finalize_access_control,0},{dds.sec.auth.identity_ca,testtext_IdentityCA_testtext,0},"
-      "{dds.sec.auth.private_key,testtext_PrivateKey_testtext,0},"
-      "{dds.sec.auth.identity_certificate,testtext_IdentityCertificate_testtext,0},"
-      "{dds.sec.access.permissions_ca,file:Permissions_CA.pem,0},"
-      "{dds.sec.access.governance,file:Governance.p7s,0},"
-      "{dds.sec.access.permissions,file:Permissions.p7s,0},"
-      "{dds.sec.auth.password,testtext_Password_testtext,0},"
-      "{dds.sec.auth.trusted_ca_dir,testtext_Dir_testtext,0}}binary_value={}}*}*",
-#endif
-    NULL
-  };
-
-  const char *sec_config =
-    "<"DDS_PROJECT_NAME">"
-      "<Domain>"
-      "<Id>any</Id>"
-      "</Domain>"
-      "<DDSI2E>"
-        "<DDSSecurity>"
-          "<Authentication>"
-            "<Library path=\""CONFIG_PLUGIN_MOCK_DIR""CONFIG_LIB_SEP""CONFIG_LIB_PREFIX"dds_security_authentication_all_ok"CONFIG_LIB_SUFFIX"\" initFunction=\"init_authentication\" finalizeFunction=\"finalize_authentication\" />"
-            "<IdentityCertificate>testtext_IdentityCertificate_testtext</IdentityCertificate>"
-            "<IdentityCA>testtext_IdentityCA_testtext</IdentityCA>"
-            "<PrivateKey>testtext_PrivateKey_testtext</PrivateKey>"
-            "<Password>testtext_Password_testtext</Password>"
-            "<TrustedCADirectory>testtext_Dir_testtext</TrustedCADirectory>"
-          "</Authentication>"
-          "<Cryptographic>"
-            "<Library path=\""CONFIG_PLUGIN_MOCK_DIR""CONFIG_LIB_SEP""CONFIG_LIB_PREFIX"dds_security_cryptography_all_ok"CONFIG_LIB_SUFFIX"\" initFunction=\"init_crypto\" finalizeFunction=\"finalize_crypto\"/>"
-          "</Cryptographic>"
-          "<AccessControl>"
-            "<Library path=\""CONFIG_PLUGIN_MOCK_DIR""CONFIG_LIB_SEP""CONFIG_LIB_PREFIX"dds_security_access_control_all_ok"CONFIG_LIB_SUFFIX"\" initFunction=\"init_access_control\" finalizeFunction=\"finalize_access_control\"/>"
-            "<Governance>file:Governance.p7s</Governance>"
-            "<PermissionsCA>file:Permissions_CA.pem</PermissionsCA>"
-            "<Permissions>file:Permissions.p7s</Permissions>"
-          "</AccessControl>"
-        "</DDSSecurity>"
-        "<Tracing><Verbosity>finest</></>"
-      "</DDSI2E>"
-    "</"DDS_PROJECT_NAME">";
-
-  dds_entity_t participant;
-
-  /* Set up the trace sinks to detect the config parsing. */
-  dds_set_log_mask(DDS_LC_FATAL|DDS_LC_ERROR|DDS_LC_WARNING|DDS_LC_CONFIG);
-  dds_set_log_sink(&logger, (void*)log_expected);
-  dds_set_trace_sink(&logger, (void*)log_expected);
-
-  /* Create participant with security elements. */
-  found = 0;
-  ddsrt_setenv(URI_VARIABLE, sec_config);
-  participant = dds_create_participant(DDS_DOMAIN_DEFAULT, NULL, NULL);
-  ddsrt_setenv(URI_VARIABLE, "");
-  dds_delete(participant);
-  dds_set_log_sink(NULL, NULL);
-  dds_set_trace_sink(NULL, NULL);
-
-  /* All traces should have been provided. */
-#ifndef DDSI_INCLUDE_SECURITY
-  CU_ASSERT_FATAL(found == 0x1);
-#else
-  CU_ASSERT_FATAL(found == 0x1fffff);
-#endif
-}
-
-CU_Test(ddsc_config, security_qos, .init = ddsrt_init, .fini = ddsrt_fini)
-{
-  /* Expected traces when creating participant with the security elements. */
-  const char *log_expected[] = {
-#ifdef DDSI_INCLUDE_SECURITY
-  /* The config should have been parsed into the participant QoS. */
-  "PARTICIPANT * QOS={*property_list={value={"
-    "{dds.sec.auth.identity_ca,testtext_IdentityCA_testtext,0},"
-    "{dds.sec.auth.private_key,testtext_PrivateKey_testtext,0},"
-    "{dds.sec.auth.identity_certificate,testtext_IdentityCertificate_testtext,0},"
-    "{dds.sec.access.permissions_ca,file:Permissions_CA.pem,0},"
-    "{dds.sec.access.governance,file:Governance.p7s,0},"
-    "{dds.sec.access.permissions,file:Permissions.p7s,0},"
-    "{dds.sec.auth.password,testtext_Password_testtext,0},"
-    "{dds.sec.auth.trusted_ca_dir,file:/test/dir,0},"
-    "{dds.sec.auth.library.path,"CONFIG_PLUGIN_MOCK_DIR""CONFIG_LIB_SEP""CONFIG_LIB_PREFIX"dds_security_authentication_all_ok"CONFIG_LIB_SUFFIX",0},"
-    "{dds.sec.auth.library.init,init_authentication,0},"
-    "{dds.sec.auth.library.finalize,finalize_authentication,0},"
-    "{dds.sec.crypto.library.path,"CONFIG_PLUGIN_MOCK_DIR""CONFIG_LIB_SEP""CONFIG_LIB_PREFIX"dds_security_cryptography_all_ok"CONFIG_LIB_SUFFIX",0},"
-    "{dds.sec.crypto.library.init,init_crypto,0},"
-    "{dds.sec.crypto.library.finalize,finalize_crypto,0},"
-    "{dds.sec.access.library.path,"CONFIG_PLUGIN_MOCK_DIR""CONFIG_LIB_SEP""CONFIG_LIB_PREFIX"dds_security_access_control_all_ok"CONFIG_LIB_SUFFIX",0},"
-    "{dds.sec.access.library.init,init_access_control,0},"
-    "{dds.sec.access.library.finalize,finalize_access_control,0}}binary_value={}}*}*",
-  #endif
-    NULL
-  };
-
-  dds_entity_t participant;
-  dds_qos_t * qos;
-
-  /* Set up the trace sinks to detect the config parsing. */
-  dds_set_log_mask(DDS_LC_FATAL|DDS_LC_ERROR|DDS_LC_WARNING|DDS_LC_CONFIG);
-  dds_set_log_sink(&logger, (void*)log_expected);
-  dds_set_trace_sink(&logger, (void*)log_expected);
-
-  /* Create the qos */
-  CU_ASSERT_FATAL((qos = dds_create_qos()) != NULL);
-  dds_qset_prop(qos, "dds.sec.auth.identity_ca", "testtext_IdentityCA_testtext");
-  dds_qset_prop(qos, "dds.sec.auth.private_key", "testtext_PrivateKey_testtext");
-  dds_qset_prop(qos, "dds.sec.auth.identity_certificate", "testtext_IdentityCertificate_testtext");
-  dds_qset_prop(qos, "dds.sec.access.permissions_ca", "file:Permissions_CA.pem");
-  dds_qset_prop(qos, "dds.sec.access.governance", "file:Governance.p7s");
-  dds_qset_prop(qos, "dds.sec.access.permissions", "file:Permissions.p7s");
-  dds_qset_prop(qos, "dds.sec.auth.password", "testtext_Password_testtext");
-  dds_qset_prop(qos, "dds.sec.auth.trusted_ca_dir", "file:/test/dir");
-  dds_qset_prop(qos, "dds.sec.auth.library.path", ""CONFIG_PLUGIN_MOCK_DIR""CONFIG_LIB_SEP""CONFIG_LIB_PREFIX"dds_security_authentication_all_ok"CONFIG_LIB_SUFFIX"");
-  dds_qset_prop(qos, "dds.sec.auth.library.init", "init_authentication");
-  dds_qset_prop(qos, "dds.sec.auth.library.finalize", "finalize_authentication");
-  dds_qset_prop(qos, "dds.sec.crypto.library.path", ""CONFIG_PLUGIN_MOCK_DIR""CONFIG_LIB_SEP""CONFIG_LIB_PREFIX"dds_security_cryptography_all_ok"CONFIG_LIB_SUFFIX"");
-  dds_qset_prop(qos, "dds.sec.crypto.library.init", "init_crypto");
-  dds_qset_prop(qos, "dds.sec.crypto.library.finalize", "finalize_crypto");
-  dds_qset_prop(qos, "dds.sec.access.library.path", ""CONFIG_PLUGIN_MOCK_DIR""CONFIG_LIB_SEP""CONFIG_LIB_PREFIX"dds_security_access_control_all_ok"CONFIG_LIB_SUFFIX"");
-  dds_qset_prop(qos, "dds.sec.access.library.init", "init_access_control");
-  dds_qset_prop(qos, "dds.sec.access.library.finalize", "finalize_access_control");
-
-  /* Create participant with security config in qos. */
-  found = 0;
-  ddsrt_setenv(URI_VARIABLE, "<Tracing><Verbosity>finest</></>");
-  CU_ASSERT_FATAL ((participant = dds_create_participant(DDS_DOMAIN_DEFAULT, qos, NULL)) > 0);
-  ddsrt_setenv(URI_VARIABLE, "");
-  dds_delete(participant);
-  dds_delete_qos(qos);
-  dds_set_log_sink(NULL, NULL);
-  dds_set_trace_sink(NULL, NULL);
-
-  /* All traces should have been provided. */
-#ifndef DDSI_INCLUDE_SECURITY
-  CU_ASSERT_FATAL(found == 0);
-#else
-  CU_ASSERT_FATAL(found == 0x1);
-#endif
-}
-
-CU_Test(ddsc_config, security_qos_props, .init = ddsrt_init, .fini = ddsrt_fini)
-{
-  /* Expected traces when creating participant with the security elements. */
-  const char *log_expected[] = {
-#ifdef DDSI_INCLUDE_SECURITY
-    /* The config should have been parsed into the participant QoS. */
-    "PARTICIPANT * QOS={*property_list={value={"
-      "{test.prop1,testtext_value1_testtext,0},"
-      "{dds.sec.auth.identity_ca,testtext_IdentityCA_testtext,0},"
-      "{dds.sec.auth.private_key,testtext_PrivateKey_testtext,0},"
-      "{dds.sec.auth.identity_certificate,testtext_IdentityCertificate_testtext,0},"
-      "{dds.sec.access.permissions_ca,file:Permissions_CA.pem,0},"
-      "{dds.sec.access.governance,file:Governance.p7s,0},"
-      "{dds.sec.access.permissions,file:Permissions.p7s,0},"
-      "{dds.sec.auth.password,testtext_Password_testtext,0},"
-      "{dds.sec.auth.trusted_ca_dir,file:/test/dir,0},"
-      "{dds.sec.auth.library.path,"CONFIG_PLUGIN_MOCK_DIR""CONFIG_LIB_SEP""CONFIG_LIB_PREFIX"dds_security_authentication_all_ok"CONFIG_LIB_SUFFIX",0},"
-      "{dds.sec.auth.library.init,init_authentication,0},"
-      "{dds.sec.auth.library.finalize,finalize_authentication,0},"
-      "{dds.sec.crypto.library.path,"CONFIG_PLUGIN_MOCK_DIR""CONFIG_LIB_SEP""CONFIG_LIB_PREFIX"dds_security_cryptography_all_ok"CONFIG_LIB_SUFFIX",0},"
-      "{dds.sec.crypto.library.init,init_crypto,0},"
-      "{dds.sec.crypto.library.finalize,finalize_crypto,0},"
-      "{dds.sec.access.library.path,"CONFIG_PLUGIN_MOCK_DIR""CONFIG_LIB_SEP""CONFIG_LIB_PREFIX"dds_security_access_control_all_ok"CONFIG_LIB_SUFFIX",0},"
-      "{dds.sec.access.library.init,init_access_control,0},"
-      "{dds.sec.access.library.finalize,finalize_access_control,0},"
-      "{test.prop2,testtext_value2_testtext,0}}"
-      "binary_value={{test.bprop1,(3,*),0}}}*}*",
-
-  #endif
-    NULL
-  };
-
-  dds_entity_t participant;
-  dds_qos_t * qos;
-
-  /* Set up the trace sinks to detect the config parsing. */
-  dds_set_log_mask(DDS_LC_FATAL | DDS_LC_ERROR | DDS_LC_WARNING | DDS_LC_CONFIG);
-  dds_set_log_sink(&logger, (void*)log_expected);
-  dds_set_trace_sink(&logger, (void*)log_expected);
-
-  /* Create the qos */
-  unsigned char bvalue[3] = { 0x01, 0x02, 0x03 };
-  CU_ASSERT_FATAL((qos = dds_create_qos()) != NULL);
-  dds_qset_prop(qos, "test.prop1", "testtext_value1_testtext");
-  dds_qset_prop(qos, "dds.sec.auth.identity_ca", "testtext_IdentityCA_testtext");
-  dds_qset_prop(qos, "dds.sec.auth.private_key", "testtext_PrivateKey_testtext");
-  dds_qset_prop(qos, "dds.sec.auth.identity_certificate", "testtext_IdentityCertificate_testtext");
-  dds_qset_prop(qos, "dds.sec.access.permissions_ca", "file:Permissions_CA.pem");
-  dds_qset_prop(qos, "dds.sec.access.governance", "file:Governance.p7s");
-  dds_qset_prop(qos, "dds.sec.access.permissions", "file:Permissions.p7s");
-  dds_qset_prop(qos, "dds.sec.auth.password", "testtext_Password_testtext");
-  dds_qset_prop(qos, "dds.sec.auth.trusted_ca_dir", "file:/test/dir");
-
-  dds_qset_prop(qos, "dds.sec.auth.library.path", ""CONFIG_PLUGIN_MOCK_DIR""CONFIG_LIB_SEP""CONFIG_LIB_PREFIX"dds_security_authentication_all_ok"CONFIG_LIB_SUFFIX"");
-  dds_qset_prop(qos, "dds.sec.auth.library.init", "init_authentication");
-  dds_qset_prop(qos, "dds.sec.auth.library.finalize", "finalize_authentication");
-  dds_qset_prop(qos, "dds.sec.crypto.library.path", ""CONFIG_PLUGIN_MOCK_DIR""CONFIG_LIB_SEP""CONFIG_LIB_PREFIX"dds_security_cryptography_all_ok"CONFIG_LIB_SUFFIX"");
-  dds_qset_prop(qos, "dds.sec.crypto.library.init", "init_crypto");
-  dds_qset_prop(qos, "dds.sec.crypto.library.finalize", "finalize_crypto");
-  dds_qset_prop(qos, "dds.sec.access.library.path", ""CONFIG_PLUGIN_MOCK_DIR""CONFIG_LIB_SEP""CONFIG_LIB_PREFIX"dds_security_access_control_all_ok"CONFIG_LIB_SUFFIX"");
-  dds_qset_prop(qos, "dds.sec.access.library.init", "init_access_control");
-  dds_qset_prop(qos, "dds.sec.access.library.finalize", "finalize_access_control");
-
-  dds_qset_prop(qos, "test.prop2", "testtext_value2_testtext");
-
-  dds_qset_prop(qos, "dds.sec.auth.identity_ca", "testtext_IdentityCA_testtext");
-
-  dds_qset_bprop(qos, "test.bprop1", bvalue, 3);
-
-  /* Create participant with security config in qos. */
-  found = 0;
-  ddsrt_setenv(URI_VARIABLE, "<Tracing><Verbosity>finest</></>");
-  participant = dds_create_participant(DDS_DOMAIN_DEFAULT, qos, NULL);
-  CU_ASSERT_FATAL(participant > 0);
-  ddsrt_setenv(URI_VARIABLE, "");
-  dds_delete(participant);
-  dds_set_log_sink(NULL, NULL);
-  dds_set_trace_sink(NULL, NULL);
-  dds_delete_qos(qos);
-
-
-  /* All traces should have been provided. */
-#ifndef DDSI_INCLUDE_SECURITY
-  CU_ASSERT_FATAL(found == 0);
-#else
-  CU_ASSERT_FATAL(found == 0x1);
-#endif
-}
-
-CU_Test(ddsc_config, security_config_qos, .init = ddsrt_init, .fini = ddsrt_fini)
-{
-  /* Expect qos settings used when creating participant with config security elements and qos. */
-  const char *log_expected[] = {
-#ifndef DDSI_INCLUDE_SECURITY
-    "config: //CycloneDDS/Domain: DDSSecurity: unknown element*",
-#else
-    /* The security settings from qos properties should have been parsed into the participant QoS. */
-    "new_participant(*): using security settings from QoS*",
-    "PARTICIPANT * QOS={*property_list={value={"
-      "{dds.sec.auth.identity_ca,testtext_QOS_IdentityCA_testtext,0},"
-      "{dds.sec.auth.private_key,testtext_QOS_PrivateKey_testtext,0},"
-      "{dds.sec.auth.identity_certificate,testtext_QOS_IdentityCertificate_testtext,0},"
-      "{dds.sec.access.permissions_ca,file:QOS_Permissions_CA.pem,0},"
-      "{dds.sec.access.governance,file:QOS_Governance.p7s,0},"
-      "{dds.sec.access.permissions,file:QOS_Permissions.p7s,0},"
-      "{dds.sec.auth.library.path,"CONFIG_PLUGIN_MOCK_DIR""CONFIG_LIB_SEP""CONFIG_LIB_PREFIX"dds_security_authentication_all_ok"CONFIG_LIB_SUFFIX",0},"
-      "{dds.sec.auth.library.init,init_authentication,0},"
-      "{dds.sec.auth.library.finalize,finalize_authentication,0},"
-      "{dds.sec.crypto.library.path,"CONFIG_PLUGIN_MOCK_DIR""CONFIG_LIB_SEP""CONFIG_LIB_PREFIX"dds_security_cryptography_all_ok"CONFIG_LIB_SUFFIX",0},"
-      "{dds.sec.crypto.library.init,init_crypto,0},"
-      "{dds.sec.crypto.library.finalize,finalize_crypto,0},"
-      "{dds.sec.access.library.path,"CONFIG_PLUGIN_MOCK_DIR""CONFIG_LIB_SEP""CONFIG_LIB_PREFIX"dds_security_access_control_all_ok"CONFIG_LIB_SUFFIX",0},"
-      "{dds.sec.access.library.init,init_access_control,0},"
-      "{dds.sec.access.library.finalize,finalize_access_control,0}"
-      "}binary_value={}}*}*",
-  #endif
-    NULL
-  };
-
-  const char *sec_config =
-    "<Tracing><Verbosity>finest</></>"
-    "<DDSSecurity>"
-      "<Authentication>"
-      "<IdentityCertificate>testtext_IdentityCertificate_testtext</IdentityCertificate>"
-      "<IdentityCA>testtext_IdentityCA_testtext</IdentityCA>"
-      "<PrivateKey>testtext_PrivateKey_testtext</PrivateKey>"
-    "</Authentication>"
-    "<AccessControl>"
-      "<Governance>file:Governance.p7s</Governance>"
-      "<PermissionsCA>file:Permissions_CA.pem</PermissionsCA>"
-      "<Permissions>file:Permissions.p7s</Permissions>"
-    "</AccessControl>"
-    "</DDSSecurity>";
-
-  dds_entity_t participant;
-  dds_qos_t * qos;
-
-  CU_ASSERT_FATAL((qos = dds_create_qos()) != NULL);
-  dds_qset_prop(qos, "dds.sec.auth.identity_ca", "testtext_QOS_IdentityCA_testtext");
-  dds_qset_prop(qos, "dds.sec.auth.private_key", "testtext_QOS_PrivateKey_testtext");
-  dds_qset_prop(qos, "dds.sec.auth.identity_certificate", "testtext_QOS_IdentityCertificate_testtext");
-  dds_qset_prop(qos, "dds.sec.access.permissions_ca", "file:QOS_Permissions_CA.pem");
-  dds_qset_prop(qos, "dds.sec.access.governance", "file:QOS_Governance.p7s");
-  dds_qset_prop(qos, "dds.sec.access.permissions", "file:QOS_Permissions.p7s");
-#ifdef DDSI_INCLUDE_SECURITY /*for using with constants coming from API */
-  dds_qset_prop(qos, DDS_SEC_PROP_AUTH_LIBRARY_PATH, ""CONFIG_PLUGIN_MOCK_DIR""CONFIG_LIB_SEP""CONFIG_LIB_PREFIX"dds_security_authentication_all_ok"CONFIG_LIB_SUFFIX"");
-  dds_qset_prop(qos, DDS_SEC_PROP_AUTH_LIBRARY_INIT, "init_authentication");
-  dds_qset_prop(qos, DDS_SEC_PROP_AUTH_LIBRARY_FINALIZE, "finalize_authentication");
-  dds_qset_prop(qos, DDS_SEC_PROP_CRYPTO_LIBRARY_PATH, ""CONFIG_PLUGIN_MOCK_DIR""CONFIG_LIB_SEP""CONFIG_LIB_PREFIX"dds_security_cryptography_all_ok"CONFIG_LIB_SUFFIX"");
-  dds_qset_prop(qos, DDS_SEC_PROP_CRYPTO_LIBRARY_INIT, "init_crypto");
-  dds_qset_prop(qos, DDS_SEC_PROP_CRYPTO_LIBRARY_FINALIZE, "finalize_crypto");
-  dds_qset_prop(qos, DDS_SEC_PROP_ACCESS_LIBRARY_PATH, ""CONFIG_PLUGIN_MOCK_DIR""CONFIG_LIB_SEP""CONFIG_LIB_PREFIX"dds_security_access_control_all_ok"CONFIG_LIB_SUFFIX"");
-  dds_qset_prop(qos, DDS_SEC_PROP_ACCESS_LIBRARY_INIT, "init_access_control");
-  dds_qset_prop(qos, DDS_SEC_PROP_ACCESS_LIBRARY_FINALIZE, "finalize_access_control");
-#endif
-  /* Set up the trace sinks to detect the config parsing. */
-  dds_set_log_mask(DDS_LC_FATAL | DDS_LC_ERROR | DDS_LC_WARNING | DDS_LC_CONFIG);
-  dds_set_log_sink(&logger, (void*)log_expected);
-  dds_set_trace_sink(&logger, (void*)log_expected);
-
-  /* Create participant with security elements. */
-  found = 0;
-  ddsrt_setenv(URI_VARIABLE, sec_config);
-  participant = dds_create_participant(DDS_DOMAIN_DEFAULT, qos, NULL);
-  ddsrt_setenv(URI_VARIABLE, "");
-  dds_delete(participant);
-  dds_set_log_sink(NULL, NULL);
-  dds_set_trace_sink(NULL, NULL);
-  dds_delete_qos(qos);
-
-  /* All traces should have been provided. */
-#ifndef DDSI_INCLUDE_SECURITY
-  CU_ASSERT_FATAL(found == 0x1);
-#else
-  CU_ASSERT_FATAL(found == 0x3);
-#endif
-}
-
-CU_Test(ddsc_config, security_other_prop, .init = ddsrt_init, .fini = ddsrt_fini)
-{
-  /* Expect config used when creating participant with config security elements and
-   * qos containing only non-security properties. */
-  const char *log_expected[] = {
-#ifndef DDSI_INCLUDE_SECURITY
-    "config: //CycloneDDS/Domain: DDSSecurity: unknown element*",
-#else
-    /* The security settings from config should have been parsed into the participant QoS. */
-    "PARTICIPANT * QOS={*property_list={value={{test.dds.sec.prop1,testtext_value1_testtext,0},"
-      "{dds.sec.auth.library.path,"CONFIG_PLUGIN_MOCK_DIR""CONFIG_LIB_SEP""CONFIG_LIB_PREFIX"dds_security_authentication_all_ok"CONFIG_LIB_SUFFIX",0},"
-      "{dds.sec.auth.library.init,init_authentication,0},"
-      "{dds.sec.auth.library.finalize,finalize_authentication,0},"
-      "{dds.sec.crypto.library.path,"CONFIG_PLUGIN_MOCK_DIR""CONFIG_LIB_SEP""CONFIG_LIB_PREFIX"dds_security_cryptography_all_ok"CONFIG_LIB_SUFFIX",0},"
-      "{dds.sec.crypto.library.init,init_crypto,0},"
-      "{dds.sec.crypto.library.finalize,finalize_crypto,0},"
-      "{dds.sec.access.library.path,"CONFIG_PLUGIN_MOCK_DIR""CONFIG_LIB_SEP""CONFIG_LIB_PREFIX"dds_security_access_control_all_ok"CONFIG_LIB_SUFFIX",0},"
-      "{dds.sec.access.library.init,init_access_control,0},"
-      "{dds.sec.access.library.finalize,finalize_access_control,0},"
-      "{dds.sec.auth.identity_ca,testtext_IdentityCA_testtext,0},"
-      "{dds.sec.auth.private_key,testtext_PrivateKey_testtext,0},"
-      "{dds.sec.auth.identity_certificate,testtext_IdentityCertificate_testtext,0},"
-      "{dds.sec.access.permissions_ca,file:Permissions_CA.pem,0},"
-      "{dds.sec.access.governance,file:Governance.p7s,0},"
-      "{dds.sec.access.permissions,file:Permissions.p7s,0},"
-      "{dds.sec.auth.password,testtext_Password_testtext,0},"
-      "{dds.sec.auth.trusted_ca_dir,testtext_Dir_testtext,0}}binary_value={}}*}*",
-  #endif
-    NULL
-  };
-
-  const char *sec_config =
-    "<Tracing><Verbosity>finest</></>"
-    "<DDSSecurity>"
-      "<Authentication>"
-        "<Library path=\""CONFIG_PLUGIN_MOCK_DIR""CONFIG_LIB_SEP""CONFIG_LIB_PREFIX"dds_security_authentication_all_ok"CONFIG_LIB_SUFFIX"\" initFunction=\"init_authentication\" finalizeFunction=\"finalize_authentication\" />"
-        "<IdentityCertificate>testtext_IdentityCertificate_testtext</IdentityCertificate>"
-        "<IdentityCA>testtext_IdentityCA_testtext</IdentityCA>"
-        "<PrivateKey>testtext_PrivateKey_testtext</PrivateKey>"
-        "<Password>testtext_Password_testtext</Password>"
-        "<TrustedCADirectory>testtext_Dir_testtext</TrustedCADirectory>"
-      "</Authentication>"
-      "<Cryptographic>"
-        "<Library path=\""CONFIG_PLUGIN_MOCK_DIR""CONFIG_LIB_SEP""CONFIG_LIB_PREFIX"dds_security_cryptography_all_ok"CONFIG_LIB_SUFFIX"\" initFunction=\"init_crypto\" finalizeFunction=\"finalize_crypto\"/>"
-      "</Cryptographic>"
-      "<AccessControl>"
-        "<Library path=\""CONFIG_PLUGIN_MOCK_DIR""CONFIG_LIB_SEP""CONFIG_LIB_PREFIX"dds_security_access_control_all_ok"CONFIG_LIB_SUFFIX"\" initFunction=\"init_access_control\" finalizeFunction=\"finalize_access_control\"/>"
-        "<Governance>file:Governance.p7s</Governance>"
-        "<PermissionsCA>file:Permissions_CA.pem</PermissionsCA>"
-        "<Permissions>file:Permissions.p7s</Permissions>"
-      "</AccessControl>"
-    "</DDSSecurity>";
-
-  dds_entity_t participant;
-  dds_qos_t * qos;
-
-  CU_ASSERT_FATAL((qos = dds_create_qos()) != NULL);
-  dds_qset_prop(qos, "test.dds.sec.prop1", "testtext_value1_testtext");
-
-  /* Set up the trace sinks to detect the config parsing. */
-  dds_set_log_mask(DDS_LC_FATAL | DDS_LC_ERROR | DDS_LC_WARNING | DDS_LC_CONFIG);
-  dds_set_log_sink(&logger, (void*)log_expected);
-  dds_set_trace_sink(&logger, (void*)log_expected);
-
-  /* Create participant with security elements. */
-  found = 0;
-  ddsrt_setenv(URI_VARIABLE, sec_config);
-  participant = dds_create_participant(DDS_DOMAIN_DEFAULT, qos, NULL);
-  ddsrt_setenv(URI_VARIABLE, "");
-  dds_delete(participant);
-  dds_set_log_sink(NULL, NULL);
-  dds_set_trace_sink(NULL, NULL);
-  dds_delete_qos(qos);
-
-  /* All traces should have been provided. */
-#ifndef DDSI_INCLUDE_SECURITY
-  CU_ASSERT_FATAL(found == 0x1);
-#else
-  CU_ASSERT_FATAL(found == 0x1);
-#endif
-}
-
-CU_Test(ddsc_config, security_qos_invalid, .init = ddsrt_init, .fini = ddsrt_fini)
-{
-  /* Expected traces when creating participant with the security elements. */
-  const char *log_expected[] = {
-#ifndef DDSI_INCLUDE_SECURITY
-    "config: //CycloneDDS/Domain: DDSSecurity: unknown element*",
-#else
-    /* The config should have been parsed into the participant QoS. */
-    "new_participant(*): using security settings from QoS*",
-    "new_participant(*): required security property dds.sec.auth.identity_ca missing in Property QoS*",
-    "new_participant(*): required security property dds.sec.auth.private_key missing in Property QoS*",
-    "new_participant(*): required security property dds.sec.auth.identity_certificate missing in Property QoS*",
-    "new_participant(*): required security property dds.sec.access.permissions_ca missing in Property QoS*",
-    "new_participant(*): required security property dds.sec.access.governance missing in Property QoS*",
-    "new_participant(*): required security property dds.sec.access.permissions missing in Property QoS*",
-    "new_participant(*): required security property dds.sec.auth.library.path missing in Property QoS*",
-    "new_participant(*): required security property dds.sec.auth.library.init missing in Property QoS*",
-    "new_participant(*): required security property dds.sec.auth.library.finalize missing in Property QoS*",
-    "new_participant(*): required security property dds.sec.crypto.library.path missing in Property QoS*",
-    "new_participant(*): required security property dds.sec.crypto.library.init missing in Property QoS*",
-    "new_participant(*): required security property dds.sec.crypto.library.finalize missing in Property QoS*",
-    "new_participant(*): required security property dds.sec.access.library.path missing in Property QoS*",
-    "new_participant(*): required security property dds.sec.access.library.init missing in Property QoS*",
-    "new_participant(*): required security property dds.sec.access.library.finalize missing in Property QoS*",
-  #endif
-    NULL
-  };
-
-  const char *sec_config =
-    "<Tracing><Verbosity>finest</></>"
-    "<DDSSecurity>"
-      "<Authentication>"
-        "<IdentityCertificate>testtext_IdentityCertificate_testtext</IdentityCertificate>"
-        "<IdentityCA>testtext_IdentityCA_testtext</IdentityCA>"
-        "<PrivateKey>testtext_PrivateKey_testtext</PrivateKey>"
-      "</Authentication>"
-      "<AccessControl>"
-        "<Governance>file:Governance.p7s</Governance>"
-        "<PermissionsCA>file:Permissions_CA.pem</PermissionsCA>"
-        "<Permissions>file:Permissions.p7s</Permissions>"
-      "</AccessControl>"
-    "</DDSSecurity>";
-
-  dds_entity_t participant;
-  dds_qos_t * qos;
-
-  /* Set up the trace sinks to detect the config parsing. */
-  dds_set_log_mask(DDS_LC_FATAL | DDS_LC_ERROR | DDS_LC_WARNING | DDS_LC_CONFIG);
-  dds_set_log_sink(&logger, (void*)log_expected);
-  dds_set_trace_sink(&logger, (void*)log_expected);
-
-  /* Create the qos */
-  CU_ASSERT_FATAL((qos = dds_create_qos()) != NULL);
-  dds_qset_prop(qos, "dds.sec.dummy", "testtext_dummy_testtext");
-
-  /* Create participant with security config in qos. */
-  found = 0;
-  ddsrt_setenv(URI_VARIABLE, sec_config);
-  participant = dds_create_participant(DDS_DOMAIN_DEFAULT, qos, NULL);
-  dds_delete_qos(qos);
-#ifdef DDSI_INCLUDE_SECURITY
-  CU_ASSERT_EQUAL_FATAL(participant, DDS_RETCODE_ERROR);
-#else
-  dds_delete(participant);
-#endif
-  ddsrt_setenv(URI_VARIABLE, "");
-
-  /* All traces should have been provided. */
-#ifndef DDSI_INCLUDE_SECURITY
-  CU_ASSERT_FATAL(found == 0x01);
-#else
-  CU_ASSERT_FATAL(found == 0xffff);
-#endif
-  dds_set_log_sink(NULL, NULL);
-  dds_set_trace_sink(NULL, NULL);
-}
-
diff --git a/src/core/ddsc/tests/config_env.h.in b/src/core/ddsc/tests/config_env.h.in
index 60339cf..5d984d6 100644
--- a/src/core/ddsc/tests/config_env.h.in
+++ b/src/core/ddsc/tests/config_env.h.in
@@ -14,9 +14,5 @@
 
 #define CONFIG_ENV_SIMPLE_UDP           "@CUnit_ddsc_config_simple_udp_uri@"
 #define CONFIG_ENV_MAX_PARTICIPANTS     "@CUnit_ddsc_config_simple_udp_max_participants@"
-#define CONFIG_PLUGIN_MOCK_DIR          "@test_lib_dir@"
-#define CONFIG_LIB_SUFFIX "@CMAKE_SHARED_LIBRARY_SUFFIX@"
-#define CONFIG_LIB_PREFIX "@CMAKE_SHARED_LIBRARY_PREFIX@"
-#define CONFIG_LIB_SEP    "@test_lib_sep@"
 
 #endif /* CONFIG_ENV_H */
diff --git a/src/security/core/tests/plugin_loading/CMakeLists.txt b/src/security/core/tests/plugin_loading/CMakeLists.txt
index 9b2e088..0eda38b 100644
--- a/src/security/core/tests/plugin_loading/CMakeLists.txt
+++ b/src/security/core/tests/plugin_loading/CMakeLists.txt
@@ -9,121 +9,77 @@
 #
 # SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
 #
-include (GenerateExportHeader)
-include (CUnit)
+include(GenerateExportHeader)
+include(CUnit)
 
 set(security_plugin_loading_test_sources
-    "plugin_loading.c"
-  )
+  "security_config.c"
+  "plugin_loading.c")
 
 add_cunit_executable(cunit_security_plugin_loading ${security_plugin_loading_test_sources})
 target_include_directories(
   cunit_security_plugin_loading PRIVATE
   "$<BUILD_INTERFACE:${CMAKE_BINARY_DIR}/src/include/>"
-        "$<BUILD_INTERFACE:$<TARGET_PROPERTY:ddsrt,INTERFACE_INCLUDE_DIRECTORIES>>"
-        "$<BUILD_INTERFACE:$<TARGET_PROPERTY:ddsc,INTERFACE_INCLUDE_DIRECTORIES>>"
-        "$<BUILD_INTERFACE:${CMAKE_CURRENT_LIST_DIR}>"
-        "$<BUILD_INTERFACE:${CMAKE_CURRENT_BINARY_DIR}>"
-        "$<BUILD_INTERFACE:${CMAKE_CURRENT_LIST_DIR}/../../../../core/ddsi/include>"
- )
-
+  "$<BUILD_INTERFACE:$<TARGET_PROPERTY:ddsrt,INTERFACE_INCLUDE_DIRECTORIES>>"
+  "$<BUILD_INTERFACE:$<TARGET_PROPERTY:ddsc,INTERFACE_INCLUDE_DIRECTORIES>>"
+  "$<BUILD_INTERFACE:${CMAKE_CURRENT_LIST_DIR}>"
+  "$<BUILD_INTERFACE:${CMAKE_CURRENT_BINARY_DIR}>"
+  "$<BUILD_INTERFACE:${CMAKE_CURRENT_LIST_DIR}/../../../../core/ddsi/include>")
 
 target_link_libraries(cunit_security_plugin_loading PRIVATE ddsc security_api)
 target_include_directories(cunit_security_plugin_loading PRIVATE "${CMAKE_CURRENT_BINARY_DIR}")
 
 set(CUnit_plugin_mock_dir ".")
 
-
+# Let the cunit application know the location and name of the library.
 configure_file("config_env.h.in" "config_env.h")
 
-# Let the cunit application know the location and name of the library.
-file(TO_NATIVE_PATH "${CMAKE_CURRENT_BINARY_DIR}" test_lib_native_dir)
-file(TO_NATIVE_PATH "." test_lib_sep)
-string(REPLACE "\\" "\\\\" test_lib_dir ${test_lib_native_dir})
-string(REPLACE "\\" "\\\\" test_lib_sep ${test_lib_sep})
-configure_file("config_env.h.in" "${CMAKE_CURRENT_BINARY_DIR}/include/config_env.h" @ONLY)
-# Let ctest set the proper library path when executing library tests.
-unset(test_lib_tests)
-process_cunit_source_file("plugin_loading.c" test_lib_header test_lib_suites test_lib_tests)
-foreach(libtest ${test_lib_tests})
-  string(REPLACE ":" ";" libtest ${libtest})
-  list(GET libtest 0 suite)
-  list(GET libtest 1 test)
-  set(libtestname "CUnit_${suite}_${test}")
-  if("${CMAKE_HOST_SYSTEM}" MATCHES ".*Windows.*")
-    set_property(TEST ${libtestname} APPEND PROPERTY ENVIRONMENT "${test_lib_native_dir}")
-  else()
-    set_property(TEST ${libtestname} APPEND PROPERTY ENVIRONMENT "LD_LIBRARY_PATH=${test_lib_native_dir};$ENV{LD_LIBRARY_PATH}")
-  endif()
-endforeach()
-
-
-function( add_mock libname casename )
-
-
+function(add_mock libname casename)
   PREPEND(srcs_mock_authentication_all_ok "${CMAKE_CURRENT_LIST_DIR}/plugin_mock/${casename}"
-      "mock_${libname}.c"
-  )
-   
-#   PREPEND(hdrs_private_authentication_all_ok "${CMAKE_CURRENT_LIST_DIR}/plugin_mock/${casename}"
-#        "mock_${libname}.h"
-#   )
-#   
+    "mock_${libname}.c")
   add_library("dds_security_${casename}" SHARED "")
   
   generate_export_header(
-          "dds_security_${casename}"
-          BASE_NAME SECURITY
-          EXPORT_FILE_NAME "${CMAKE_CURRENT_BINARY_DIR}/include/dds/security/${casename}_export.h"
-  )
+    "dds_security_${casename}"
+    BASE_NAME SECURITY
+    EXPORT_FILE_NAME "${CMAKE_CURRENT_BINARY_DIR}/include/dds/security/${casename}_export.h")
   
   set_target_properties(
-          "dds_security_${casename}"
-          PROPERTIES
-          RUNTIME_OUTPUT_DIRECTORY                ${CMAKE_CURRENT_BINARY_DIR}
-          RUNTIME_OUTPUT_DIRECTORY_DEBUG          ${CMAKE_CURRENT_BINARY_DIR}
-          RUNTIME_OUTPUT_DIRECTORY_RELEASE        ${CMAKE_CURRENT_BINARY_DIR}
-          RUNTIME_OUTPUT_DIRECTORY_RELWITHDEBINFO ${CMAKE_CURRENT_BINARY_DIR}
-          RUNTIME_OUTPUT_DIRECTORY_MINSIZEREL     ${CMAKE_CURRENT_BINARY_DIR}
-          LIBRARY_OUTPUT_DIRECTORY                ${CMAKE_CURRENT_BINARY_DIR}
-          LIBRARY_OUTPUT_DIRECTORY_DEBUG          ${CMAKE_CURRENT_BINARY_DIR}
-          LIBRARY_OUTPUT_DIRECTORY_RELEASE        ${CMAKE_CURRENT_BINARY_DIR}
-          LIBRARY_OUTPUT_DIRECTORY_RELWITHDEBINFO ${CMAKE_CURRENT_BINARY_DIR}
-          LIBRARY_OUTPUT_DIRECTORY_MINSIZEREL     ${CMAKE_CURRENT_BINARY_DIR} )
-  
-  
+    "dds_security_${casename}"
+    PROPERTIES
+    RUNTIME_OUTPUT_DIRECTORY                ${CMAKE_CURRENT_BINARY_DIR}
+    RUNTIME_OUTPUT_DIRECTORY_DEBUG          ${CMAKE_CURRENT_BINARY_DIR}
+    RUNTIME_OUTPUT_DIRECTORY_RELEASE        ${CMAKE_CURRENT_BINARY_DIR}
+    RUNTIME_OUTPUT_DIRECTORY_RELWITHDEBINFO ${CMAKE_CURRENT_BINARY_DIR}
+    RUNTIME_OUTPUT_DIRECTORY_MINSIZEREL     ${CMAKE_CURRENT_BINARY_DIR}
+    LIBRARY_OUTPUT_DIRECTORY                ${CMAKE_CURRENT_BINARY_DIR}
+    LIBRARY_OUTPUT_DIRECTORY_DEBUG          ${CMAKE_CURRENT_BINARY_DIR}
+    LIBRARY_OUTPUT_DIRECTORY_RELEASE        ${CMAKE_CURRENT_BINARY_DIR}
+    LIBRARY_OUTPUT_DIRECTORY_RELWITHDEBINFO ${CMAKE_CURRENT_BINARY_DIR}
+    LIBRARY_OUTPUT_DIRECTORY_MINSIZEREL     ${CMAKE_CURRENT_BINARY_DIR})
+
   #find_package(OpenSSL )
-  
-  target_link_libraries("dds_security_${casename}" PUBLIC ddsc)
   #target_link_libraries("dds_security_${casename}" PUBLIC OpenSSL::SSL)
+  target_link_libraries("dds_security_${casename}" PUBLIC ddsc)
   
   target_sources("dds_security_${casename}"
-      PRIVATE
-          ${srcs_mock_authentication_all_ok}
-  
-  )
-  
+    PRIVATE
+      ${srcs_mock_authentication_all_ok})
   target_include_directories("dds_security_${casename}"
-      PUBLIC
-          "$<BUILD_INTERFACE:$<TARGET_PROPERTY:security_api,INTERFACE_INCLUDE_DIRECTORIES>>"
-          "$<BUILD_INTERFACE:$<TARGET_PROPERTY:security_core,INTERFACE_INCLUDE_DIRECTORIES>>"
-          "$<BUILD_INTERFACE:$<TARGET_PROPERTY:ddsrt,INTERFACE_INCLUDE_DIRECTORIES>>"
-          "$<BUILD_INTERFACE:${CMAKE_CURRENT_BINARY_DIR}/include>"
-          
-  )
-
-
+    PUBLIC
+      "$<BUILD_INTERFACE:$<TARGET_PROPERTY:security_api,INTERFACE_INCLUDE_DIRECTORIES>>"
+      "$<BUILD_INTERFACE:$<TARGET_PROPERTY:security_core,INTERFACE_INCLUDE_DIRECTORIES>>"
+      "$<BUILD_INTERFACE:$<TARGET_PROPERTY:ddsrt,INTERFACE_INCLUDE_DIRECTORIES>>"
+      "$<BUILD_INTERFACE:${CMAKE_CURRENT_BINARY_DIR}/include>")
 endfunction()
 
 #PLUGIN MOCKS
-add_mock( authentication authentication_all_ok )
-add_mock( authentication authentication_all_ok_other )
-add_mock( authentication authentication_missing_function )
-add_mock( authentication authentication_finalize_error )
-add_mock( access_control access_control_all_ok )
-add_mock( access_control access_control_missing_function )
-add_mock( cryptography cryptography_all_ok )
-add_mock( cryptography cryptography_missing_function )
-add_mock( authentication authentication_init_error )
-
-
+add_mock(authentication authentication_all_ok)
+add_mock(authentication authentication_all_ok_other)
+add_mock(authentication authentication_missing_function)
+add_mock(authentication authentication_finalize_error)
+add_mock(access_control access_control_all_ok)
+add_mock(access_control access_control_missing_function)
+add_mock(cryptography cryptography_all_ok)
+add_mock(cryptography cryptography_missing_function)
+add_mock(authentication authentication_init_error)
diff --git a/src/security/core/tests/plugin_loading/config_env.h.in b/src/security/core/tests/plugin_loading/config_env.h.in
index 203620f..6d05734 100644
--- a/src/security/core/tests/plugin_loading/config_env.h.in
+++ b/src/security/core/tests/plugin_loading/config_env.h.in
@@ -17,5 +17,9 @@
 #define TEST_LIB_SEP    "@test_lib_sep@"
 #define TEST_LIB_SUFFIX "@CMAKE_SHARED_LIBRARY_SUFFIX@"
 #define TEST_LIB_PREFIX "@CMAKE_SHARED_LIBRARY_PREFIX@"
+#define CONFIG_PLUGIN_MOCK_DIR          "@test_lib_dir@"
+#define CONFIG_LIB_SUFFIX "@CMAKE_SHARED_LIBRARY_SUFFIX@"
+#define CONFIG_LIB_PREFIX "@CMAKE_SHARED_LIBRARY_PREFIX@"
+#define CONFIG_LIB_SEP    "@test_lib_sep@"
 
 #endif /* CONFIG_ENV_H */
diff --git a/src/security/core/tests/plugin_loading/security_config.c b/src/security/core/tests/plugin_loading/security_config.c
new file mode 100644
index 0000000..5e95683
--- /dev/null
+++ b/src/security/core/tests/plugin_loading/security_config.c
@@ -0,0 +1,812 @@
+/*
+ * Copyright(c) 2006 to 2018 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+#include <stdlib.h>
+
+#include "dds/dds.h"
+#include "CUnit/Test.h"
+#include "config_env.h"
+
+#include "dds/version.h"
+#include "dds/ddsrt/cdtors.h"
+#include "dds/ddsrt/environ.h"
+#include "dds/ddsrt/heap.h"
+#include "dds/ddsi/q_misc.h"
+#include "dds/ddsi/q_xqos.h"
+
+#include "dds/security/dds_security_api_defs.h"
+
+#define MOCKLIB_PATH(name) \
+  CONFIG_PLUGIN_MOCK_DIR CONFIG_LIB_SEP CONFIG_LIB_PREFIX name CONFIG_LIB_SUFFIX
+#define MOCKLIB_ELEM_AUTH(name) \
+  "<Library path=\"" MOCKLIB_PATH(name) "\"" \
+  " initFunction=\"init_authentication\"" \
+  " finalizeFunction=\"finalize_authentication\" />"
+#define MOCKLIB_ELEM_CRYPTO(name) \
+  "<Library path=\"" MOCKLIB_PATH(name) "\"" \
+  " initFunction=\"init_crypto\"" \
+  " finalizeFunction=\"finalize_crypto\" />"
+#define MOCKLIB_ELEM_ACCESS_CONTROL(name) \
+  "<Library path=\"" MOCKLIB_PATH(name) "\"" \
+  " initFunction=\"init_access_control\"" \
+  " finalizeFunction=\"finalize_access_control\" />"
+
+#define URI_VARIABLE DDS_PROJECT_NAME_NOSPACE_CAPS"_URI"
+
+/*
+ * The 'found' variable will contain flags related to the expected log
+ * messages that were received.
+ * Using flags will allow to show that when message isn't received,
+ * which one it was.
+ */
+static uint32_t found;
+
+static void logger(void *ptr, const dds_log_data_t *data)
+{
+  char **expected = (char**)ptr;
+  for (uint32_t i = 0; expected[i] != NULL; i++) {
+    if (ddsi2_patmatch(expected[i], data->message)) {
+      found |= (uint32_t)(1 << i);
+    }
+  }
+}
+
+
+CU_Test(ddsc_security_config, empty, .init = ddsrt_init, .fini = ddsrt_fini)
+{
+  /* Expected traces when creating participant with an empty security element.  We need to
+     test this one here to be sure that it refuses to start when security is configured
+     but the implementation doesn't include support for it. */
+  const char *log_expected[] = {
+    "config: //CycloneDDS/Domain/DDSSecurity/Authentication/IdentityCertificate/#text: element missing in configuration*",
+    "config: //CycloneDDS/Domain/DDSSecurity/Authentication/IdentityCA/#text: element missing in configuration*",
+    "config: //CycloneDDS/Domain/DDSSecurity/Authentication/PrivateKey/#text: element missing in configuration*",
+    NULL
+  };
+
+  dds_entity_t participant;
+
+  /* Set up the trace sinks to detect the config parsing. */
+  dds_set_log_mask(DDS_LC_FATAL|DDS_LC_ERROR|DDS_LC_WARNING|DDS_LC_CONFIG);
+  dds_set_log_sink(&logger, (void*)log_expected);
+  dds_set_trace_sink(&logger, (void*)log_expected);
+
+  /* Create participant with an empty security element. */
+  found = 0;
+  ddsrt_setenv(URI_VARIABLE, "<DDSSecurity/>");
+  participant = dds_create_participant(DDS_DOMAIN_DEFAULT, NULL, NULL);
+  ddsrt_setenv(URI_VARIABLE, "");
+  CU_ASSERT_FATAL(participant < 0);
+  dds_set_log_sink(NULL, NULL);
+  dds_set_trace_sink(NULL, NULL);
+
+  /* All traces should have been provided. */
+  CU_ASSERT_FATAL(found == 0x7);
+}
+
+CU_Test(ddsc_security_config, non, .init = ddsrt_init, .fini = ddsrt_fini)
+{
+  /* There shouldn't be traces that mention security. */
+  const char *log_expected[] = {
+    "*Security*",
+    NULL
+  };
+
+  dds_entity_t participant;
+
+  /* Set up the trace sinks to detect the config parsing. */
+  dds_set_log_mask(DDS_LC_FATAL|DDS_LC_ERROR|DDS_LC_WARNING|DDS_LC_CONFIG);
+  dds_set_log_sink(&logger, (void*)log_expected);
+  dds_set_trace_sink(&logger, (void*)log_expected);
+
+  /* Create participant with an empty security element. */
+  found = 0;
+  ddsrt_setenv(URI_VARIABLE, "<Tracing><Verbosity>finest</></>");
+  participant = dds_create_participant(DDS_DOMAIN_DEFAULT, NULL, NULL);
+  ddsrt_setenv(URI_VARIABLE, "");
+  CU_ASSERT_FATAL(participant > 0);
+  dds_delete(participant);
+  dds_set_log_sink(NULL, NULL);
+  dds_set_trace_sink(NULL, NULL);
+
+  /* No security traces should have been provided. */
+  CU_ASSERT_FATAL(found == 0x0);
+}
+
+CU_Test(ddsc_security_config, missing, .init = ddsrt_init, .fini = ddsrt_fini)
+{
+  /* Expected traces when creating participant with the security elements. */
+  const char *log_expected[] = {
+    "config: //CycloneDDS/Domain/DDSSecurity/Authentication/IdentityCertificate/#text: element missing in configuration*",
+    "config: //CycloneDDS/Domain/DDSSecurity/Authentication/IdentityCA/#text: element missing in configuration*",
+    "config: //CycloneDDS/Domain/DDSSecurity/Authentication/PrivateKey/#text: element missing in configuration*",
+    NULL
+  };
+
+  /* IdentityCertificate, IdentityCA and PrivateKey values or elements are missing. */
+  const char *sec_config =
+    "<Tracing><Verbosity>finest</></>"
+    "<DDSSecurity>"
+    "  <Authentication>"
+    "    "MOCKLIB_ELEM_AUTH("dds_security_authentication_all_ok")
+    "    <IdentityCertificate></IdentityCertificate>"
+    "    <PrivateKey></PrivateKey>"
+    "    <Password>testtext_Password_testtext</Password>"
+    "  </Authentication>"
+    "  <Cryptographic>"
+    "    "MOCKLIB_ELEM_CRYPTO("dds_security_cryptography_all_ok")
+    "  </Cryptographic>"
+    "  <AccessControl>"
+    "    "MOCKLIB_ELEM_ACCESS_CONTROL("dds_security_access_control_all_ok")
+    "    <Governance>file:Governance.p7s</Governance>"
+    "    <PermissionsCA>file:Permissions_CA.pem</PermissionsCA>"
+    "    <Permissions>file:Permissions.p7s</Permissions>"
+    "  </AccessControl>"
+    "</DDSSecurity>";
+
+  dds_entity_t participant;
+
+  /* Set up the trace sinks to detect the config parsing. */
+  dds_set_log_mask(DDS_LC_FATAL|DDS_LC_ERROR|DDS_LC_WARNING|DDS_LC_CONFIG);
+  dds_set_log_sink(&logger, (void*)log_expected);
+  dds_set_trace_sink(&logger, (void*)log_expected);
+
+  /* Create participant with an empty security element. */
+  found = 0;
+  ddsrt_setenv(URI_VARIABLE, sec_config);
+  participant = dds_create_participant(DDS_DOMAIN_DEFAULT, NULL, NULL);
+  ddsrt_setenv(URI_VARIABLE, "");
+  CU_ASSERT_FATAL(participant < 0);
+  dds_set_log_sink(NULL, NULL);
+  dds_set_trace_sink(NULL, NULL);
+  /* All traces should have been provided. */
+  CU_ASSERT_FATAL(found == 0x7);
+}
+
+CU_Test(ddsc_security_config, all, .init = ddsrt_init, .fini = ddsrt_fini)
+{
+  /* Expected traces when creating participant with the security elements. */
+  const char *log_expected[] = {
+    "config: Domain/DDSSecurity/Authentication/Library/#text: "MOCKLIB_PATH("dds_security_authentication_all_ok")"*",
+    "config: Domain/DDSSecurity/Authentication/Library[@path]: "MOCKLIB_PATH("dds_security_authentication_all_ok")"*",
+    "config: Domain/DDSSecurity/Authentication/Library[@initFunction]: init_authentication*",
+    "config: Domain/DDSSecurity/Authentication/Library[@finalizeFunction]: finalize_authentication*",
+    "config: Domain/DDSSecurity/Authentication/IdentityCertificate/#text: testtext_IdentityCertificate_testtext*",
+    "config: Domain/DDSSecurity/Authentication/IdentityCA/#text: testtext_IdentityCA_testtext*",
+    "config: Domain/DDSSecurity/Authentication/PrivateKey/#text: testtext_PrivateKey_testtext*",
+    "config: Domain/DDSSecurity/Authentication/Password/#text: testtext_Password_testtext*",
+    "config: Domain/DDSSecurity/Authentication/TrustedCADirectory/#text: testtext_Dir_testtext*",
+    "config: Domain/DDSSecurity/AccessControl/Library/#text: "MOCKLIB_PATH("dds_security_access_control_all_ok")"*",
+    "config: Domain/DDSSecurity/AccessControl/Library[@path]: "MOCKLIB_PATH("dds_security_access_control_all_ok")"*",
+    "config: Domain/DDSSecurity/AccessControl/Library[@initFunction]: init_access_control*",
+    "config: Domain/DDSSecurity/AccessControl/Library[@finalizeFunction]: finalize_access_control*",
+    "config: Domain/DDSSecurity/AccessControl/PermissionsCA/#text: file:Permissions_CA.pem*",
+    "config: Domain/DDSSecurity/AccessControl/Governance/#text: file:Governance.p7s*",
+    "config: Domain/DDSSecurity/AccessControl/Permissions/#text: file:Permissions.p7s*",
+    "config: Domain/DDSSecurity/Cryptographic/Library/#text: "MOCKLIB_PATH("dds_security_cryptography_all_ok")"*",
+    "config: Domain/DDSSecurity/Cryptographic/Library[@path]: "MOCKLIB_PATH("dds_security_cryptography_all_ok")"*",
+    "config: Domain/DDSSecurity/Cryptographic/Library[@initFunction]: init_crypto*",
+    "config: Domain/DDSSecurity/Cryptographic/Library[@finalizeFunction]: finalize_crypto*",
+    /* The config should have been parsed into the participant QoS. */
+    "PARTICIPANT * QOS={*property_list={value={{dds.sec.auth.library.path,"MOCKLIB_PATH("dds_security_authentication_all_ok")",0},"
+    "{dds.sec.auth.library.init,init_authentication,0},"
+    "{dds.sec.auth.library.finalize,finalize_authentication,0},"
+    "{dds.sec.crypto.library.path,"MOCKLIB_PATH("dds_security_cryptography_all_ok")",0},"
+    "{dds.sec.crypto.library.init,init_crypto,0},"
+    "{dds.sec.crypto.library.finalize,finalize_crypto,0},"
+    "{dds.sec.access.library.path,"MOCKLIB_PATH("dds_security_access_control_all_ok")",0},"
+    "{dds.sec.access.library.init,init_access_control,0},"
+    "{dds.sec.access.library.finalize,finalize_access_control,0},"
+    "{dds.sec.auth.identity_ca,testtext_IdentityCA_testtext,0},"
+    "{dds.sec.auth.private_key,testtext_PrivateKey_testtext,0},"
+    "{dds.sec.auth.identity_certificate,testtext_IdentityCertificate_testtext,0},"
+    "{dds.sec.access.permissions_ca,file:Permissions_CA.pem,0},"
+    "{dds.sec.access.governance,file:Governance.p7s,0},"
+    "{dds.sec.access.permissions,file:Permissions.p7s,0},"
+    "{dds.sec.auth.password,testtext_Password_testtext,0},"
+    "{dds.sec.auth.trusted_ca_dir,testtext_Dir_testtext,0}}binary_value={}}*}*",
+    NULL
+  };
+  const char *sec_config =
+    "<"DDS_PROJECT_NAME">"
+    "  <Domain id=\"any\">"
+    "    <Tracing><Verbosity>finest</></>"
+    "    <DDSSecurity>"
+    "      <Authentication>"
+    "        "MOCKLIB_ELEM_AUTH("dds_security_authentication_all_ok")
+    "        <IdentityCertificate>testtext_IdentityCertificate_testtext</IdentityCertificate>"
+    "        <IdentityCA>testtext_IdentityCA_testtext</IdentityCA>"
+    "        <PrivateKey>testtext_PrivateKey_testtext</PrivateKey>"
+    "        <Password>testtext_Password_testtext</Password>"
+    "        <TrustedCADirectory>testtext_Dir_testtext</TrustedCADirectory>"
+    "      </Authentication>"
+    "      <Cryptographic>"
+    "        "MOCKLIB_ELEM_CRYPTO("dds_security_cryptography_all_ok")
+    "      </Cryptographic>"
+    "      <AccessControl>"
+    "        "MOCKLIB_ELEM_ACCESS_CONTROL("dds_security_access_control_all_ok")
+    "        <Governance>file:Governance.p7s</Governance>"
+    "        <PermissionsCA>file:Permissions_CA.pem</PermissionsCA>"
+    "        <Permissions>file:Permissions.p7s</Permissions>"
+    "      </AccessControl>"
+    "    </DDSSecurity>"
+    "  </Domain>"
+    "</"DDS_PROJECT_NAME">";
+
+  dds_entity_t participant;
+
+  /* Set up the trace sinks to detect the config parsing. */
+  dds_set_log_mask(DDS_LC_FATAL|DDS_LC_ERROR|DDS_LC_WARNING|DDS_LC_CONFIG);
+  dds_set_log_sink(&logger, (void*)log_expected);
+  dds_set_trace_sink(&logger, (void*)log_expected);
+
+  /* Create participant with security elements. */
+  found = 0;
+  ddsrt_setenv(URI_VARIABLE, sec_config);
+  participant = dds_create_participant(DDS_DOMAIN_DEFAULT, NULL, NULL);
+  CU_ASSERT_FATAL(participant > 0);
+  ddsrt_setenv(URI_VARIABLE, "");
+  dds_delete(participant);
+  dds_set_log_sink(NULL, NULL);
+  dds_set_trace_sink(NULL, NULL);
+
+  /* All traces should have been provided. */
+  CU_ASSERT_FATAL(found == 0x1fffff);
+}
+
+CU_Test(ddsc_security_config, security, .init = ddsrt_init, .fini = ddsrt_fini)
+{
+  /* Expected traces when creating participant with the security elements. */
+  const char *log_expected[] = {
+    "config: Domain/DDSSecurity/Authentication/Library/#text: "MOCKLIB_PATH("dds_security_authentication_all_ok")"*",
+    "config: Domain/DDSSecurity/Authentication/Library[@path]: "MOCKLIB_PATH("dds_security_authentication_all_ok")"*",
+    "config: Domain/DDSSecurity/Authentication/Library[@initFunction]: init_authentication*",
+    "config: Domain/DDSSecurity/Authentication/Library[@finalizeFunction]: finalize_authentication*",
+    "config: Domain/DDSSecurity/Authentication/IdentityCertificate/#text: testtext_IdentityCertificate_testtext*",
+    "config: Domain/DDSSecurity/Authentication/IdentityCA/#text: testtext_IdentityCA_testtext*",
+    "config: Domain/DDSSecurity/Authentication/PrivateKey/#text: testtext_PrivateKey_testtext*",
+    "config: Domain/DDSSecurity/Authentication/Password/#text:  {}*",
+    "config: Domain/DDSSecurity/Authentication/TrustedCADirectory/#text:  {}*",
+    "config: Domain/DDSSecurity/AccessControl/Library/#text: "MOCKLIB_PATH("dds_security_access_control_all_ok")"*",
+    "config: Domain/DDSSecurity/AccessControl/Library[@path]: "MOCKLIB_PATH("dds_security_access_control_all_ok")"*",
+    "config: Domain/DDSSecurity/AccessControl/Library[@initFunction]: init_access_control*",
+    "config: Domain/DDSSecurity/AccessControl/Library[@finalizeFunction]: finalize_access_control*",
+    "config: Domain/DDSSecurity/AccessControl/PermissionsCA/#text: file:Permissions_CA.pem*",
+    "config: Domain/DDSSecurity/AccessControl/Governance/#text: file:Governance.p7s*",
+    "config: Domain/DDSSecurity/AccessControl/Permissions/#text: file:Permissions.p7s*",
+    "config: Domain/DDSSecurity/Cryptographic/Library/#text: "MOCKLIB_PATH("dds_security_cryptography_all_ok")"*",
+    "config: Domain/DDSSecurity/Cryptographic/Library[@path]: "MOCKLIB_PATH("dds_security_cryptography_all_ok")"*",
+    "config: Domain/DDSSecurity/Cryptographic/Library[@initFunction]: init_crypto*",
+    "config: Domain/DDSSecurity/Cryptographic/Library[@finalizeFunction]: finalize_crypto*",
+    /* The config should have been parsed into the participant QoS. */
+    "PARTICIPANT * QOS={*property_list={value={{dds.sec.auth.library.path,"MOCKLIB_PATH("dds_security_authentication_all_ok")",0},"
+    "{dds.sec.auth.library.init,init_authentication,0},"
+    "{dds.sec.auth.library.finalize,finalize_authentication,0},"
+    "{dds.sec.crypto.library.path,"MOCKLIB_PATH("dds_security_cryptography_all_ok")",0},"
+    "{dds.sec.crypto.library.init,init_crypto,0},"
+    "{dds.sec.crypto.library.finalize,finalize_crypto,0},"
+    "{dds.sec.access.library.path,"MOCKLIB_PATH("dds_security_access_control_all_ok")",0},"
+    "{dds.sec.access.library.init,init_access_control,0},"
+    "{dds.sec.access.library.finalize,finalize_access_control,0},"
+    "{dds.sec.auth.identity_ca,testtext_IdentityCA_testtext,0},"
+    "{dds.sec.auth.private_key,testtext_PrivateKey_testtext,0},"
+    "{dds.sec.auth.identity_certificate,testtext_IdentityCertificate_testtext,0},"
+    "{dds.sec.access.permissions_ca,file:Permissions_CA.pem,0},"
+    "{dds.sec.access.governance,file:Governance.p7s,0},"
+    "{dds.sec.access.permissions,file:Permissions.p7s,0},"
+    "{dds.sec.auth.password,,0},"
+    "{dds.sec.auth.trusted_ca_dir,,0}}binary_value={}}*}*",
+    NULL
+  };
+
+  const char *sec_config =
+    "<Tracing><Verbosity>finest</></>"
+    "<DDSSecurity>"
+    "  <Authentication>"
+    "    "MOCKLIB_ELEM_AUTH("dds_security_authentication_all_ok")
+    "    <IdentityCertificate>testtext_IdentityCertificate_testtext</IdentityCertificate>"
+    "    <IdentityCA>testtext_IdentityCA_testtext</IdentityCA>"
+    "    <PrivateKey>testtext_PrivateKey_testtext</PrivateKey>"
+    "  </Authentication>"
+    "  <Cryptographic>"
+    "    "MOCKLIB_ELEM_CRYPTO("dds_security_cryptography_all_ok")
+    "  </Cryptographic>"
+    "  <AccessControl>"
+    "    "MOCKLIB_ELEM_ACCESS_CONTROL("dds_security_access_control_all_ok")
+    "    <Governance>file:Governance.p7s</Governance>"
+    "    <PermissionsCA>file:Permissions_CA.pem</PermissionsCA>"
+    "    <Permissions>file:Permissions.p7s</Permissions>"
+    "  </AccessControl>"
+    "</DDSSecurity>";
+
+  dds_entity_t participant;
+
+  /* Set up the trace sinks to detect the config parsing. */
+  dds_set_log_mask(DDS_LC_FATAL|DDS_LC_ERROR|DDS_LC_WARNING|DDS_LC_CONFIG);
+  dds_set_log_sink(&logger, (void*)log_expected);
+  dds_set_trace_sink(&logger, (void*)log_expected);
+
+  /* Create participant with security elements. */
+  found = 0;
+  ddsrt_setenv(URI_VARIABLE, sec_config);
+  participant = dds_create_participant(DDS_DOMAIN_DEFAULT, NULL, NULL);
+  CU_ASSERT_FATAL(participant > 0);
+  ddsrt_setenv(URI_VARIABLE, "");
+  dds_delete(participant);
+  dds_set_log_sink(NULL, NULL);
+  dds_set_trace_sink(NULL, NULL);
+
+  /* All traces should have been provided. */
+  CU_ASSERT_FATAL(found == 0x1fffff);
+}
+
+CU_Test(ddsc_security_config, deprecated, .init = ddsrt_init, .fini = ddsrt_fini)
+{
+  /* Expected traces when creating participant with the security elements. */
+  const char *log_expected[] = {
+    "config: Domain/DDSSecurity/Authentication/Library/#text: "MOCKLIB_PATH("dds_security_authentication_all_ok")"*",
+    "config: Domain/DDSSecurity/Authentication/Library[@path]: "MOCKLIB_PATH("dds_security_authentication_all_ok")"*",
+    "config: Domain/DDSSecurity/Authentication/Library[@initFunction]: init_authentication*",
+    "config: Domain/DDSSecurity/Authentication/Library[@finalizeFunction]: finalize_authentication*",
+    "config: Domain/DDSSecurity/Authentication/IdentityCertificate/#text: testtext_IdentityCertificate_testtext*",
+    "config: Domain/DDSSecurity/Authentication/IdentityCA/#text: testtext_IdentityCA_testtext*",
+    "config: Domain/DDSSecurity/Authentication/PrivateKey/#text: testtext_PrivateKey_testtext*",
+    "config: Domain/DDSSecurity/Authentication/Password/#text: testtext_Password_testtext*",
+    "config: Domain/DDSSecurity/Authentication/TrustedCADirectory/#text: testtext_Dir_testtext*",
+    "config: Domain/DDSSecurity/AccessControl/Library/#text: "MOCKLIB_PATH("dds_security_access_control_all_ok")"*",
+    "config: Domain/DDSSecurity/AccessControl/Library[@path]: "MOCKLIB_PATH("dds_security_access_control_all_ok")"*",
+    "config: Domain/DDSSecurity/AccessControl/Library[@initFunction]: init_access_control*",
+    "config: Domain/DDSSecurity/AccessControl/Library[@finalizeFunction]: finalize_access_control*",
+    "config: Domain/DDSSecurity/AccessControl/PermissionsCA/#text: file:Permissions_CA.pem*",
+    "config: Domain/DDSSecurity/AccessControl/Governance/#text: file:Governance.p7s*",
+    "config: Domain/DDSSecurity/AccessControl/Permissions/#text: file:Permissions.p7s*",
+    "config: Domain/DDSSecurity/Cryptographic/Library/#text: "MOCKLIB_PATH("dds_security_cryptography_all_ok")"*",
+    "config: Domain/DDSSecurity/Cryptographic/Library[@path]: "MOCKLIB_PATH("dds_security_cryptography_all_ok")"*",
+    "config: Domain/DDSSecurity/Cryptographic/Library[@initFunction]: init_crypto*",
+    "config: Domain/DDSSecurity/Cryptographic/Library[@finalizeFunction]: finalize_crypto*",
+    /* The config should have been parsed into the participant QoS. */
+    "PARTICIPANT * QOS={*property_list={value={"
+    "{dds.sec.auth.library.path,"MOCKLIB_PATH("dds_security_authentication_all_ok")",0},"
+    "{dds.sec.auth.library.init,init_authentication,0},"
+    "{dds.sec.auth.library.finalize,finalize_authentication,0},"
+    "{dds.sec.crypto.library.path,"MOCKLIB_PATH("dds_security_cryptography_all_ok")",0},"
+    "{dds.sec.crypto.library.init,init_crypto,0},"
+    "{dds.sec.crypto.library.finalize,finalize_crypto,0},"
+    "{dds.sec.access.library.path,"MOCKLIB_PATH("dds_security_access_control_all_ok")",0},"
+    "{dds.sec.access.library.init,init_access_control,0},{dds.sec.access.library.finalize,finalize_access_control,0},{dds.sec.auth.identity_ca,testtext_IdentityCA_testtext,0},"
+    "{dds.sec.auth.private_key,testtext_PrivateKey_testtext,0},"
+    "{dds.sec.auth.identity_certificate,testtext_IdentityCertificate_testtext,0},"
+    "{dds.sec.access.permissions_ca,file:Permissions_CA.pem,0},"
+    "{dds.sec.access.governance,file:Governance.p7s,0},"
+    "{dds.sec.access.permissions,file:Permissions.p7s,0},"
+    "{dds.sec.auth.password,testtext_Password_testtext,0},"
+    "{dds.sec.auth.trusted_ca_dir,testtext_Dir_testtext,0}}binary_value={}}*}*",
+    NULL
+  };
+
+  const char *sec_config =
+    "<"DDS_PROJECT_NAME">"
+    "  <Domain id=\"any\">"
+    "    <DDSSecurity>"
+    "      <Authentication>"
+    "        "MOCKLIB_ELEM_AUTH("dds_security_authentication_all_ok")
+    "        <IdentityCertificate>testtext_IdentityCertificate_testtext</IdentityCertificate>"
+    "        <IdentityCA>testtext_IdentityCA_testtext</IdentityCA>"
+    "        <PrivateKey>testtext_PrivateKey_testtext</PrivateKey>"
+    "        <Password>testtext_Password_testtext</Password>"
+    "        <TrustedCADirectory>testtext_Dir_testtext</TrustedCADirectory>"
+    "      </Authentication>"
+    "      <Cryptographic>"
+    "        "MOCKLIB_ELEM_CRYPTO("dds_security_cryptography_all_ok")
+    "      </Cryptographic>"
+    "      <AccessControl>"
+    "        "MOCKLIB_ELEM_ACCESS_CONTROL("dds_security_access_control_all_ok")
+    "        <Governance>file:Governance.p7s</Governance>"
+    "        <PermissionsCA>file:Permissions_CA.pem</PermissionsCA>"
+    "        <Permissions>file:Permissions.p7s</Permissions>"
+    "      </AccessControl>"
+    "    </DDSSecurity>"
+    "    <Tracing><Verbosity>finest</></>"
+    "  </Domain>"
+    "</"DDS_PROJECT_NAME">";
+
+  dds_entity_t participant;
+
+  /* Set up the trace sinks to detect the config parsing. */
+  dds_set_log_mask(DDS_LC_FATAL|DDS_LC_ERROR|DDS_LC_WARNING|DDS_LC_CONFIG);
+  dds_set_log_sink(&logger, (void*)log_expected);
+  dds_set_trace_sink(&logger, (void*)log_expected);
+
+  /* Create participant with security elements. */
+  found = 0;
+  ddsrt_setenv(URI_VARIABLE, sec_config);
+  participant = dds_create_participant(DDS_DOMAIN_DEFAULT, NULL, NULL);
+  CU_ASSERT_FATAL(participant > 0);
+  ddsrt_setenv(URI_VARIABLE, "");
+  dds_delete(participant);
+  dds_set_log_sink(NULL, NULL);
+  dds_set_trace_sink(NULL, NULL);
+
+  /* All traces should have been provided. */
+  CU_ASSERT_FATAL(found == 0x1fffff);
+}
+
+CU_Test(ddsc_security_config, qos, .init = ddsrt_init, .fini = ddsrt_fini)
+{
+  /* Expected traces when creating participant with the security elements. */
+  const char *log_expected[] = {
+    /* The config should have been parsed into the participant QoS. */
+    "PARTICIPANT * QOS={*property_list={value={"
+    "{dds.sec.auth.identity_ca,testtext_IdentityCA_testtext,0},"
+    "{dds.sec.auth.private_key,testtext_PrivateKey_testtext,0},"
+    "{dds.sec.auth.identity_certificate,testtext_IdentityCertificate_testtext,0},"
+    "{dds.sec.access.permissions_ca,file:Permissions_CA.pem,0},"
+    "{dds.sec.access.governance,file:Governance.p7s,0},"
+    "{dds.sec.access.permissions,file:Permissions.p7s,0},"
+    "{dds.sec.auth.password,testtext_Password_testtext,0},"
+    "{dds.sec.auth.trusted_ca_dir,file:/test/dir,0},"
+    "{dds.sec.auth.library.path,"MOCKLIB_PATH("dds_security_authentication_all_ok")",0},"
+    "{dds.sec.auth.library.init,init_authentication,0},"
+    "{dds.sec.auth.library.finalize,finalize_authentication,0},"
+    "{dds.sec.crypto.library.path,"MOCKLIB_PATH("dds_security_cryptography_all_ok")",0},"
+    "{dds.sec.crypto.library.init,init_crypto,0},"
+    "{dds.sec.crypto.library.finalize,finalize_crypto,0},"
+    "{dds.sec.access.library.path,"MOCKLIB_PATH("dds_security_access_control_all_ok")",0},"
+    "{dds.sec.access.library.init,init_access_control,0},"
+    "{dds.sec.access.library.finalize,finalize_access_control,0}}binary_value={}}*}*",
+    NULL
+  };
+
+  dds_entity_t participant;
+  dds_qos_t * qos;
+
+  /* Set up the trace sinks to detect the config parsing. */
+  dds_set_log_mask(DDS_LC_FATAL|DDS_LC_ERROR|DDS_LC_WARNING|DDS_LC_CONFIG);
+  dds_set_log_sink(&logger, (void*)log_expected);
+  dds_set_trace_sink(&logger, (void*)log_expected);
+
+  /* Create the qos */
+  CU_ASSERT_FATAL((qos = dds_create_qos()) != NULL);
+  dds_qset_prop(qos, "dds.sec.auth.identity_ca", "testtext_IdentityCA_testtext");
+  dds_qset_prop(qos, "dds.sec.auth.private_key", "testtext_PrivateKey_testtext");
+  dds_qset_prop(qos, "dds.sec.auth.identity_certificate", "testtext_IdentityCertificate_testtext");
+  dds_qset_prop(qos, "dds.sec.access.permissions_ca", "file:Permissions_CA.pem");
+  dds_qset_prop(qos, "dds.sec.access.governance", "file:Governance.p7s");
+  dds_qset_prop(qos, "dds.sec.access.permissions", "file:Permissions.p7s");
+  dds_qset_prop(qos, "dds.sec.auth.password", "testtext_Password_testtext");
+  dds_qset_prop(qos, "dds.sec.auth.trusted_ca_dir", "file:/test/dir");
+  dds_qset_prop(qos, "dds.sec.auth.library.path", ""MOCKLIB_PATH("dds_security_authentication_all_ok")"");
+  dds_qset_prop(qos, "dds.sec.auth.library.init", "init_authentication");
+  dds_qset_prop(qos, "dds.sec.auth.library.finalize", "finalize_authentication");
+  dds_qset_prop(qos, "dds.sec.crypto.library.path", ""MOCKLIB_PATH("dds_security_cryptography_all_ok")"");
+  dds_qset_prop(qos, "dds.sec.crypto.library.init", "init_crypto");
+  dds_qset_prop(qos, "dds.sec.crypto.library.finalize", "finalize_crypto");
+  dds_qset_prop(qos, "dds.sec.access.library.path", ""MOCKLIB_PATH("dds_security_access_control_all_ok")"");
+  dds_qset_prop(qos, "dds.sec.access.library.init", "init_access_control");
+  dds_qset_prop(qos, "dds.sec.access.library.finalize", "finalize_access_control");
+
+  /* Create participant with security config in qos. */
+  found = 0;
+  ddsrt_setenv(URI_VARIABLE, "<Tracing><Verbosity>finest</></>");
+  participant = dds_create_participant(DDS_DOMAIN_DEFAULT, qos, NULL);
+  CU_ASSERT_FATAL(participant > 0);
+  ddsrt_setenv(URI_VARIABLE, "");
+  dds_delete(participant);
+  dds_delete_qos(qos);
+  dds_set_log_sink(NULL, NULL);
+  dds_set_trace_sink(NULL, NULL);
+
+  /* All traces should have been provided. */
+  CU_ASSERT_FATAL(found == 0x1);
+}
+
+CU_Test(ddsc_security_config, qos_props, .init = ddsrt_init, .fini = ddsrt_fini)
+{
+  /* Expected traces when creating participant with the security elements. */
+  const char *log_expected[] = {
+    /* The config should have been parsed into the participant QoS. */
+    "PARTICIPANT * QOS={*property_list={value={"
+    "{test.prop1,testtext_value1_testtext,0},"
+    "{dds.sec.auth.identity_ca,testtext_IdentityCA_testtext,0},"
+    "{dds.sec.auth.private_key,testtext_PrivateKey_testtext,0},"
+    "{dds.sec.auth.identity_certificate,testtext_IdentityCertificate_testtext,0},"
+    "{dds.sec.access.permissions_ca,file:Permissions_CA.pem,0},"
+    "{dds.sec.access.governance,file:Governance.p7s,0},"
+    "{dds.sec.access.permissions,file:Permissions.p7s,0},"
+    "{dds.sec.auth.password,testtext_Password_testtext,0},"
+    "{dds.sec.auth.trusted_ca_dir,file:/test/dir,0},"
+    "{dds.sec.auth.library.path,"MOCKLIB_PATH("dds_security_authentication_all_ok")",0},"
+    "{dds.sec.auth.library.init,init_authentication,0},"
+    "{dds.sec.auth.library.finalize,finalize_authentication,0},"
+    "{dds.sec.crypto.library.path,"MOCKLIB_PATH("dds_security_cryptography_all_ok")",0},"
+    "{dds.sec.crypto.library.init,init_crypto,0},"
+    "{dds.sec.crypto.library.finalize,finalize_crypto,0},"
+    "{dds.sec.access.library.path,"MOCKLIB_PATH("dds_security_access_control_all_ok")",0},"
+    "{dds.sec.access.library.init,init_access_control,0},"
+    "{dds.sec.access.library.finalize,finalize_access_control,0},"
+    "{test.prop2,testtext_value2_testtext,0}}"
+    "binary_value={{test.bprop1,(3,*),0}}}*}*",
+    NULL
+  };
+
+  dds_entity_t participant;
+  dds_qos_t * qos;
+
+  /* Set up the trace sinks to detect the config parsing. */
+  dds_set_log_mask(DDS_LC_FATAL | DDS_LC_ERROR | DDS_LC_WARNING | DDS_LC_CONFIG);
+  dds_set_log_sink(&logger, (void*)log_expected);
+  dds_set_trace_sink(&logger, (void*)log_expected);
+
+  /* Create the qos */
+  unsigned char bvalue[3] = { 0x01, 0x02, 0x03 };
+  CU_ASSERT_FATAL((qos = dds_create_qos()) != NULL);
+  dds_qset_prop(qos, "test.prop1", "testtext_value1_testtext");
+  dds_qset_prop(qos, "dds.sec.auth.identity_ca", "testtext_IdentityCA_testtext");
+  dds_qset_prop(qos, "dds.sec.auth.private_key", "testtext_PrivateKey_testtext");
+  dds_qset_prop(qos, "dds.sec.auth.identity_certificate", "testtext_IdentityCertificate_testtext");
+  dds_qset_prop(qos, "dds.sec.access.permissions_ca", "file:Permissions_CA.pem");
+  dds_qset_prop(qos, "dds.sec.access.governance", "file:Governance.p7s");
+  dds_qset_prop(qos, "dds.sec.access.permissions", "file:Permissions.p7s");
+  dds_qset_prop(qos, "dds.sec.auth.password", "testtext_Password_testtext");
+  dds_qset_prop(qos, "dds.sec.auth.trusted_ca_dir", "file:/test/dir");
+
+  dds_qset_prop(qos, "dds.sec.auth.library.path", ""MOCKLIB_PATH("dds_security_authentication_all_ok")"");
+  dds_qset_prop(qos, "dds.sec.auth.library.init", "init_authentication");
+  dds_qset_prop(qos, "dds.sec.auth.library.finalize", "finalize_authentication");
+  dds_qset_prop(qos, "dds.sec.crypto.library.path", ""MOCKLIB_PATH("dds_security_cryptography_all_ok")"");
+  dds_qset_prop(qos, "dds.sec.crypto.library.init", "init_crypto");
+  dds_qset_prop(qos, "dds.sec.crypto.library.finalize", "finalize_crypto");
+  dds_qset_prop(qos, "dds.sec.access.library.path", ""MOCKLIB_PATH("dds_security_access_control_all_ok")"");
+  dds_qset_prop(qos, "dds.sec.access.library.init", "init_access_control");
+  dds_qset_prop(qos, "dds.sec.access.library.finalize", "finalize_access_control");
+
+  dds_qset_prop(qos, "test.prop2", "testtext_value2_testtext");
+
+  dds_qset_prop(qos, "dds.sec.auth.identity_ca", "testtext_IdentityCA_testtext");
+
+  dds_qset_bprop(qos, "test.bprop1", bvalue, 3);
+
+  /* Create participant with security config in qos. */
+  found = 0;
+  ddsrt_setenv(URI_VARIABLE, "<Tracing><Verbosity>finest</></>");
+  participant = dds_create_participant(DDS_DOMAIN_DEFAULT, qos, NULL);
+  CU_ASSERT_FATAL(participant > 0);
+  ddsrt_setenv(URI_VARIABLE, "");
+  dds_delete(participant);
+  dds_set_log_sink(NULL, NULL);
+  dds_set_trace_sink(NULL, NULL);
+  dds_delete_qos(qos);
+
+  /* All traces should have been provided. */
+  CU_ASSERT_FATAL(found == 0x1);
+}
+
+CU_Test(ddsc_security_config, config_qos, .init = ddsrt_init, .fini = ddsrt_fini)
+{
+  /* Expect qos settings used when creating participant with config security elements and qos. */
+  const char *log_expected[] = {
+    /* The security settings from qos properties should have been parsed into the participant QoS. */
+    "new_participant(*): using security settings from QoS*",
+    "PARTICIPANT * QOS={*property_list={value={"
+    "{dds.sec.auth.identity_ca,testtext_QOS_IdentityCA_testtext,0},"
+    "{dds.sec.auth.private_key,testtext_QOS_PrivateKey_testtext,0},"
+    "{dds.sec.auth.identity_certificate,testtext_QOS_IdentityCertificate_testtext,0},"
+    "{dds.sec.access.permissions_ca,file:QOS_Permissions_CA.pem,0},"
+    "{dds.sec.access.governance,file:QOS_Governance.p7s,0},"
+    "{dds.sec.access.permissions,file:QOS_Permissions.p7s,0},"
+    "{dds.sec.auth.library.path,"MOCKLIB_PATH("dds_security_authentication_all_ok")",0},"
+    "{dds.sec.auth.library.init,init_authentication,0},"
+    "{dds.sec.auth.library.finalize,finalize_authentication,0},"
+    "{dds.sec.crypto.library.path,"MOCKLIB_PATH("dds_security_cryptography_all_ok")",0},"
+    "{dds.sec.crypto.library.init,init_crypto,0},"
+    "{dds.sec.crypto.library.finalize,finalize_crypto,0},"
+    "{dds.sec.access.library.path,"MOCKLIB_PATH("dds_security_access_control_all_ok")",0},"
+    "{dds.sec.access.library.init,init_access_control,0},"
+    "{dds.sec.access.library.finalize,finalize_access_control,0}"
+    "}binary_value={}}*}*",
+    NULL
+  };
+
+  const char *sec_config =
+    "<Tracing><Verbosity>finest</></>"
+    "<DDSSecurity>"
+    "  <Authentication>"
+    "    <IdentityCertificate>testtext_IdentityCertificate_testtext</IdentityCertificate>"
+    "    <IdentityCA>testtext_IdentityCA_testtext</IdentityCA>"
+    "    <PrivateKey>testtext_PrivateKey_testtext</PrivateKey>"
+    "  </Authentication>"
+    "  <AccessControl>"
+    "    <Governance>file:Governance.p7s</Governance>"
+    "    <PermissionsCA>file:Permissions_CA.pem</PermissionsCA>"
+    "    <Permissions>file:Permissions.p7s</Permissions>"
+    "  </AccessControl>"
+    "</DDSSecurity>";
+
+  dds_entity_t participant;
+  dds_qos_t * qos;
+
+  CU_ASSERT_FATAL((qos = dds_create_qos()) != NULL);
+  dds_qset_prop(qos, "dds.sec.auth.identity_ca", "testtext_QOS_IdentityCA_testtext");
+  dds_qset_prop(qos, "dds.sec.auth.private_key", "testtext_QOS_PrivateKey_testtext");
+  dds_qset_prop(qos, "dds.sec.auth.identity_certificate", "testtext_QOS_IdentityCertificate_testtext");
+  dds_qset_prop(qos, "dds.sec.access.permissions_ca", "file:QOS_Permissions_CA.pem");
+  dds_qset_prop(qos, "dds.sec.access.governance", "file:QOS_Governance.p7s");
+  dds_qset_prop(qos, "dds.sec.access.permissions", "file:QOS_Permissions.p7s");
+
+  dds_qset_prop(qos, DDS_SEC_PROP_AUTH_LIBRARY_PATH, ""MOCKLIB_PATH("dds_security_authentication_all_ok")"");
+  dds_qset_prop(qos, DDS_SEC_PROP_AUTH_LIBRARY_INIT, "init_authentication");
+  dds_qset_prop(qos, DDS_SEC_PROP_AUTH_LIBRARY_FINALIZE, "finalize_authentication");
+  dds_qset_prop(qos, DDS_SEC_PROP_CRYPTO_LIBRARY_PATH, ""MOCKLIB_PATH("dds_security_cryptography_all_ok")"");
+  dds_qset_prop(qos, DDS_SEC_PROP_CRYPTO_LIBRARY_INIT, "init_crypto");
+  dds_qset_prop(qos, DDS_SEC_PROP_CRYPTO_LIBRARY_FINALIZE, "finalize_crypto");
+  dds_qset_prop(qos, DDS_SEC_PROP_ACCESS_LIBRARY_PATH, ""MOCKLIB_PATH("dds_security_access_control_all_ok")"");
+  dds_qset_prop(qos, DDS_SEC_PROP_ACCESS_LIBRARY_INIT, "init_access_control");
+  dds_qset_prop(qos, DDS_SEC_PROP_ACCESS_LIBRARY_FINALIZE, "finalize_access_control");
+
+  /* Set up the trace sinks to detect the config parsing. */
+  dds_set_log_mask(DDS_LC_FATAL | DDS_LC_ERROR | DDS_LC_WARNING | DDS_LC_CONFIG);
+  dds_set_log_sink(&logger, (void*)log_expected);
+  dds_set_trace_sink(&logger, (void*)log_expected);
+
+  /* Create participant with security elements. */
+  found = 0;
+  ddsrt_setenv(URI_VARIABLE, sec_config);
+  participant = dds_create_participant(DDS_DOMAIN_DEFAULT, qos, NULL);
+  CU_ASSERT_FATAL (participant > 0);
+  ddsrt_setenv(URI_VARIABLE, "");
+  dds_delete(participant);
+  dds_set_log_sink(NULL, NULL);
+  dds_set_trace_sink(NULL, NULL);
+  dds_delete_qos(qos);
+
+  /* All traces should have been provided. */
+  CU_ASSERT_FATAL(found == 0x3);
+}
+
+CU_Test(ddsc_security_config, other_prop, .init = ddsrt_init, .fini = ddsrt_fini)
+{
+  /* Expect config used when creating participant with config security elements and
+   * qos containing only non-security properties. */
+  const char *log_expected[] = {
+    /* The security settings from config should have been parsed into the participant QoS. */
+    "PARTICIPANT * QOS={*property_list={value={{test.dds.sec.prop1,testtext_value1_testtext,0},"
+    "{dds.sec.auth.library.path,"MOCKLIB_PATH("dds_security_authentication_all_ok")",0},"
+    "{dds.sec.auth.library.init,init_authentication,0},"
+    "{dds.sec.auth.library.finalize,finalize_authentication,0},"
+    "{dds.sec.crypto.library.path,"MOCKLIB_PATH("dds_security_cryptography_all_ok")",0},"
+    "{dds.sec.crypto.library.init,init_crypto,0},"
+    "{dds.sec.crypto.library.finalize,finalize_crypto,0},"
+    "{dds.sec.access.library.path,"MOCKLIB_PATH("dds_security_access_control_all_ok")",0},"
+    "{dds.sec.access.library.init,init_access_control,0},"
+    "{dds.sec.access.library.finalize,finalize_access_control,0},"
+    "{dds.sec.auth.identity_ca,testtext_IdentityCA_testtext,0},"
+    "{dds.sec.auth.private_key,testtext_PrivateKey_testtext,0},"
+    "{dds.sec.auth.identity_certificate,testtext_IdentityCertificate_testtext,0},"
+    "{dds.sec.access.permissions_ca,file:Permissions_CA.pem,0},"
+    "{dds.sec.access.governance,file:Governance.p7s,0},"
+    "{dds.sec.access.permissions,file:Permissions.p7s,0},"
+    "{dds.sec.auth.password,testtext_Password_testtext,0},"
+    "{dds.sec.auth.trusted_ca_dir,testtext_Dir_testtext,0}}binary_value={}}*}*",
+    NULL
+  };
+
+  const char *sec_config =
+    "<Tracing><Verbosity>finest</></>"
+    "<DDSSecurity>"
+    "  <Authentication>"
+    "    "MOCKLIB_ELEM_AUTH("dds_security_authentication_all_ok")
+    "    <IdentityCertificate>testtext_IdentityCertificate_testtext</IdentityCertificate>"
+    "    <IdentityCA>testtext_IdentityCA_testtext</IdentityCA>"
+    "    <PrivateKey>testtext_PrivateKey_testtext</PrivateKey>"
+    "    <Password>testtext_Password_testtext</Password>"
+    "    <TrustedCADirectory>testtext_Dir_testtext</TrustedCADirectory>"
+    "  </Authentication>"
+    "  <Cryptographic>"
+    "    "MOCKLIB_ELEM_CRYPTO("dds_security_cryptography_all_ok")
+    "  </Cryptographic>"
+    "  <AccessControl>"
+    "    "MOCKLIB_ELEM_ACCESS_CONTROL("dds_security_access_control_all_ok")
+    "    <Governance>file:Governance.p7s</Governance>"
+    "    <PermissionsCA>file:Permissions_CA.pem</PermissionsCA>"
+    "    <Permissions>file:Permissions.p7s</Permissions>"
+    "  </AccessControl>"
+    "</DDSSecurity>";
+
+  dds_entity_t participant;
+  dds_qos_t * qos;
+
+  CU_ASSERT_FATAL((qos = dds_create_qos()) != NULL);
+  dds_qset_prop(qos, "test.dds.sec.prop1", "testtext_value1_testtext");
+
+  /* Set up the trace sinks to detect the config parsing. */
+  dds_set_log_mask(DDS_LC_FATAL | DDS_LC_ERROR | DDS_LC_WARNING | DDS_LC_CONFIG);
+  dds_set_log_sink(&logger, (void*)log_expected);
+  dds_set_trace_sink(&logger, (void*)log_expected);
+
+  /* Create participant with security elements. */
+  found = 0;
+  ddsrt_setenv(URI_VARIABLE, sec_config);
+  participant = dds_create_participant(DDS_DOMAIN_DEFAULT, qos, NULL);
+  CU_ASSERT_FATAL (participant > 0);
+  ddsrt_setenv(URI_VARIABLE, "");
+  dds_delete(participant);
+  dds_set_log_sink(NULL, NULL);
+  dds_set_trace_sink(NULL, NULL);
+  dds_delete_qos(qos);
+
+  /* All traces should have been provided. */
+  CU_ASSERT_FATAL(found == 0x1);
+}
+
+CU_Test(ddsc_security_config, qos_invalid, .init = ddsrt_init, .fini = ddsrt_fini)
+{
+  /* Expected traces when creating participant with the security elements. */
+  const char *log_expected[] = {
+    /* The config should have been parsed into the participant QoS. */
+    "new_participant(*): using security settings from QoS*",
+    "new_participant(*): required security property dds.sec.auth.identity_ca missing in Property QoS*",
+    "new_participant(*): required security property dds.sec.auth.private_key missing in Property QoS*",
+    "new_participant(*): required security property dds.sec.auth.identity_certificate missing in Property QoS*",
+    "new_participant(*): required security property dds.sec.access.permissions_ca missing in Property QoS*",
+    "new_participant(*): required security property dds.sec.access.governance missing in Property QoS*",
+    "new_participant(*): required security property dds.sec.access.permissions missing in Property QoS*",
+    "new_participant(*): required security property dds.sec.auth.library.path missing in Property QoS*",
+    "new_participant(*): required security property dds.sec.auth.library.init missing in Property QoS*",
+    "new_participant(*): required security property dds.sec.auth.library.finalize missing in Property QoS*",
+    "new_participant(*): required security property dds.sec.crypto.library.path missing in Property QoS*",
+    "new_participant(*): required security property dds.sec.crypto.library.init missing in Property QoS*",
+    "new_participant(*): required security property dds.sec.crypto.library.finalize missing in Property QoS*",
+    "new_participant(*): required security property dds.sec.access.library.path missing in Property QoS*",
+    "new_participant(*): required security property dds.sec.access.library.init missing in Property QoS*",
+    "new_participant(*): required security property dds.sec.access.library.finalize missing in Property QoS*",
+    NULL
+  };
+
+  const char *sec_config =
+    "<Tracing><Verbosity>finest</></>"
+    "<DDSSecurity>"
+    "  <Authentication>"
+    "    <IdentityCertificate>testtext_IdentityCertificate_testtext</IdentityCertificate>"
+    "    <IdentityCA>testtext_IdentityCA_testtext</IdentityCA>"
+    "    <PrivateKey>testtext_PrivateKey_testtext</PrivateKey>"
+    "  </Authentication>"
+    "  <AccessControl>"
+    "    <Governance>file:Governance.p7s</Governance>"
+    "    <PermissionsCA>file:Permissions_CA.pem</PermissionsCA>"
+    "    <Permissions>file:Permissions.p7s</Permissions>"
+    "  </AccessControl>"
+    "</DDSSecurity>";
+
+  dds_entity_t participant;
+  dds_qos_t * qos;
+
+  /* Set up the trace sinks to detect the config parsing. */
+  dds_set_log_mask(DDS_LC_FATAL | DDS_LC_ERROR | DDS_LC_WARNING | DDS_LC_CONFIG);
+  dds_set_log_sink(&logger, (void*)log_expected);
+  dds_set_trace_sink(&logger, (void*)log_expected);
+
+  /* Create the qos */
+  CU_ASSERT_FATAL((qos = dds_create_qos()) != NULL);
+  dds_qset_prop(qos, "dds.sec.dummy", "testtext_dummy_testtext");
+
+  /* Create participant with security config in qos. */
+  found = 0;
+  ddsrt_setenv(URI_VARIABLE, sec_config);
+  participant = dds_create_participant(DDS_DOMAIN_DEFAULT, qos, NULL);
+  dds_delete_qos(qos);
+  CU_ASSERT_EQUAL_FATAL(participant, DDS_RETCODE_ERROR);
+  ddsrt_setenv(URI_VARIABLE, "");
+
+  /* All traces should have been provided. */
+  CU_ASSERT_FATAL(found == 0xffff);
+  dds_set_log_sink(NULL, NULL);
+  dds_set_trace_sink(NULL, NULL);
+}

From 9481a75e9d77216f19875149309c488a2004753a Mon Sep 17 00:00:00 2001
From: Erik Boasson <eb@ilities.com>
Date: Mon, 20 Jan 2020 15:28:46 +0100
Subject: [PATCH 089/238] Config file doc generator parsing of RELOFF construct

Signed-off-by: Erik Boasson <eb@ilities.com>
---
 docs/makernc.pl        |   2 +-
 docs/manual/options.md |  98 +++++++--------
 etc/cyclonedds.rnc     | 191 ++++++++++++++---------------
 etc/cyclonedds.xsd     | 268 ++++++++++++++++++-----------------------
 4 files changed, 259 insertions(+), 300 deletions(-)

diff --git a/docs/makernc.pl b/docs/makernc.pl
index 1fad42f..0de6a8e 100644
--- a/docs/makernc.pl
+++ b/docs/makernc.pl
@@ -626,7 +626,7 @@ sub read_config {
       # skip reference to internal name (either ABSOFF(field),
       # RELOFF(field,field) or <int>,<int> (the latter being used by
       # "verbosity")
-      $rest =~ s/(ABSOFF *\( *[A-Za-z_0-9.]+ *\)|RELOFF *\( *[A-Za-z_0-9.]+ *, *[A-Za-z_0-9]+ *\)|[0-9]+ *, *[0-9]+) *, *//;
+      $rest =~ s/(ABSOFF *\( *[A-Za-z_0-9.]+ *\)|RELOFF *\( *[A-Za-z_0-9.]+ *, *[A-Za-z_0-9. ]+\)|[0-9]+ *, *[0-9]+) *, *//;
       # skip init function
       $rest =~ s/([A-Za-z_0-9]+|0) *, *//;
       # type hint from conversion function
diff --git a/docs/manual/options.md b/docs/manual/options.md
index 98c0166..f875c77 100644
--- a/docs/manual/options.md
+++ b/docs/manual/options.md
@@ -117,8 +117,7 @@ specification.
 
 
 ##### //CycloneDDS/Domain/DDSSecurity/AccessControl/Governance
-
-RELOFF (cfg.access_control_properties.governance), pf_string, BLURB("
+Text
 
 URI to the shared Governance Document signed by the Permissions CA in
 S/MIME format
@@ -168,38 +167,39 @@ MIIDuAYJKoZIhv ...al5s=
 
 ------F9A8A198D6F08E1285A292ADF14DD04F-]]</Governance>
 
+The default value is: "".
+
 
 ##### //CycloneDDS/Domain/DDSSecurity/AccessControl/Library
-Children: [finalizeFunction](#cycloneddsdomainddssecurityaccesscontrollibraryfinalizefunction), [initFunction](#cycloneddsdomainddssecurityaccesscontrollibraryinitfunction), [path](#cycloneddsdomainddssecurityaccesscontrollibrarypath)
+Attributes: [finalizeFunction](#cycloneddsdomainddssecurityaccesscontrollibraryfinalizefunction), [initFunction](#cycloneddsdomainddssecurityaccesscontrollibraryinitfunction), [path](#cycloneddsdomainddssecurityaccesscontrollibrarypath)
 
 
-RELOFF (cfg.access_control_plugin), pf_string, BLURB("
-
 This element specifies the library to be loaded as the DDS Security
 Access Control plugin.
 
 
-###### //CycloneDDS/Domain/DDSSecurity/AccessControl/Library/finalizeFunction
-
-RELOFF (cfg.access_control_plugin.library_finalize), pf_string, BLURB("
+##### //CycloneDDS/Domain/DDSSecurity/AccessControl/Library[@finalizeFunction]
+Text
 
 This element names the finalization function of Access Control plugin.
 This function is called to let the plugin release its resources.
 
+The default value is: "finalize_access_control".
 
-###### //CycloneDDS/Domain/DDSSecurity/AccessControl/Library/initFunction
 
-RELOFF (cfg.access_control_plugin.library_init), pf_string, BLURB("
+##### //CycloneDDS/Domain/DDSSecurity/AccessControl/Library[@initFunction]
+Text
 
 This element names the initialization function of Access Control plugin.
 This function is called after loading the plugin library for
 instantiation purposes. Init function must return an object that
 implements DDS Security Access Control interface.
 
+The default value is: "init_access_control".
 
-###### //CycloneDDS/Domain/DDSSecurity/AccessControl/Library/path
 
-RELOFF (cfg.access_control_plugin.library_path), pf_string, BLURB("
+##### //CycloneDDS/Domain/DDSSecurity/AccessControl/Library[@path]
+Text
 
 This element points to the path of Access Control plugin library.
 
@@ -211,10 +211,11 @@ If single file is supplied, the library located by way of the current
 working directory, or LD_LIBRARY_PATH for Unix systems, and PATH for
 Windows systems.
 
+The default value is: "dds_security_ac".
+
 
 ##### //CycloneDDS/Domain/DDSSecurity/AccessControl/Permissions
-
-RELOFF (cfg.access_control_properties.permissions), pf_string, BLURB("
+Text
 
 URI to the DomainParticipant permissions document signed by the
 Permissions CA in S/MIME format
@@ -232,10 +233,11 @@ Example data URI:
 
 <Permissions><![CDATA[data:,.........]]</Permissions>
 
+The default value is: "".
+
 
 ##### //CycloneDDS/Domain/DDSSecurity/AccessControl/PermissionsCA
-
-RELOFF (cfg.access_control_properties.permissions_ca), pf_string, BLURB("
+Text
 
 URI to a X509 certificate for the PermissionsCA in PEM format.
 
@@ -256,6 +258,8 @@ MIIC3DCCAcQCCQCWE5x+Z ... PhovK0mp2ohhRLYI0ZiyYQ==
 
 -----END CERTIFICATE-----</PermissionsCA>
 
+The default value is: "".
+
 
 #### //CycloneDDS/Domain/DDSSecurity/Authentication
 Children: [IdentityCA](#cycloneddsdomainddssecurityauthenticationidentityca), [IdentityCertificate](#cycloneddsdomainddssecurityauthenticationidentitycertificate), [Library](#cycloneddsdomainddssecurityauthenticationlibrary), [Password](#cycloneddsdomainddssecurityauthenticationpassword), [PrivateKey](#cycloneddsdomainddssecurityauthenticationprivatekey), [TrustedCADirectory](#cycloneddsdomainddssecurityauthenticationtrustedcadirectory)
@@ -266,8 +270,7 @@ specification.
 
 
 ##### //CycloneDDS/Domain/DDSSecurity/Authentication/IdentityCA
-
-RELOFF (cfg.authentication_properties.identity_ca), pf_string, BLURB("
+Text
 
 URI to the X509 certificate [39] of the Identity CA that is the signer of
 Identity Certificate.
@@ -289,9 +292,7 @@ MIIC3DCCAcQCCQCWE5x+Z...PhovK0mp2ohhRLYI0ZiyYQ==<br>
 
 
 ##### //CycloneDDS/Domain/DDSSecurity/Authentication/IdentityCertificate
-
-RELOFF (cfg.authentication_properties.identity_certificate), pf_string,
-BLURB("
+Text
 
 Identity certificate that will be used for identifying all participants
 in the OSPL instance.<br>The content is URI to a X509 certificate signed
@@ -311,36 +312,35 @@ MIIDjjCCAnYCCQDCEu9...6rmT87dhTo=<br>
 
 
 ##### //CycloneDDS/Domain/DDSSecurity/Authentication/Library
-Children: [finalizeFunction](#cycloneddsdomainddssecurityauthenticationlibraryfinalizefunction), [initFunction](#cycloneddsdomainddssecurityauthenticationlibraryinitfunction), [path](#cycloneddsdomainddssecurityauthenticationlibrarypath)
+Attributes: [finalizeFunction](#cycloneddsdomainddssecurityauthenticationlibraryfinalizefunction), [initFunction](#cycloneddsdomainddssecurityauthenticationlibraryinitfunction), [path](#cycloneddsdomainddssecurityauthenticationlibrarypath)
 
 
-RELOFF (cfg.authentication_plugin), pf_string, BLURB("
-
 This element specifies the library to be loaded as the DDS Security
 Access Control plugin.
 
 
-###### //CycloneDDS/Domain/DDSSecurity/Authentication/Library/finalizeFunction
-
-RELOFF (cfg.authentication_plugin.library_finalize), pf_string, BLURB("
+##### //CycloneDDS/Domain/DDSSecurity/Authentication/Library[@finalizeFunction]
+Text
 
 This element names the finalization function of Authentication plugin.
 This function is called to let the plugin release its resources.
 
+The default value is: "finalize_authentication".
 
-###### //CycloneDDS/Domain/DDSSecurity/Authentication/Library/initFunction
 
-RELOFF (cfg.authentication_plugin.library_init), pf_string, BLURB("
+##### //CycloneDDS/Domain/DDSSecurity/Authentication/Library[@initFunction]
+Text
 
 This element names the initialization function of Authentication plugin.
 This function is called after loading the plugin library for
 instantiation purposes. Init function must return an object that
 implements DDS Security Authentication interface.
 
+The default value is: "init_authentication".
 
-###### //CycloneDDS/Domain/DDSSecurity/Authentication/Library/path
 
-RELOFF (cfg.authentication_plugin.library_path), pf_string, BLURB("
+##### //CycloneDDS/Domain/DDSSecurity/Authentication/Library[@path]
+Text
 
 This element points to the path of Authentication plugin library.
 
@@ -352,10 +352,11 @@ If single file is supplied, the library located by way of the current
 working directory, or LD_LIBRARY_PATH for Unix systems, and PATH for
 Windows systems.
 
+The default value is: "dds_security_auth".
+
 
 ##### //CycloneDDS/Domain/DDSSecurity/Authentication/Password
-
-RELOFF (cfg.authentication_properties.password), pf_string, BLURB("
+Text
 
 A password used to decrypt the private_key.
 
@@ -366,10 +367,11 @@ using AES128-CBC.
 If the password property is not present, then the value supplied in the
 private_key property must contain the unencrypted private key.
 
+The default value is: "".
+
 
 ##### //CycloneDDS/Domain/DDSSecurity/Authentication/PrivateKey
-
-RELOFF (cfg.authentication_properties.private_key), pf_string, BLURB("
+Text
 
 URI to access the private Private Key for all of the participants in the
 OSPL federation.
@@ -388,12 +390,13 @@ MIIEpAIBAAKCAQEA3HIh...AOBaaqSV37XBUJg==<br>
 
 
 ##### //CycloneDDS/Domain/DDSSecurity/Authentication/TrustedCADirectory
-
-RELOFF (cfg.authentication_properties.trusted_ca_dir), pf_string, BLURB("
+Text
 
 Trusted CA Directory which contains trusted CA certificates as separated
 files.
 
+The default value is: "".
+
 
 #### //CycloneDDS/Domain/DDSSecurity/Cryptographic
 Children: [Library](#cycloneddsdomainddssecuritycryptographiclibrary)
@@ -404,36 +407,35 @@ specification.
 
 
 ##### //CycloneDDS/Domain/DDSSecurity/Cryptographic/Library
-Children: [finalizeFunction](#cycloneddsdomainddssecuritycryptographiclibraryfinalizefunction), [initFunction](#cycloneddsdomainddssecuritycryptographiclibraryinitfunction), [path](#cycloneddsdomainddssecuritycryptographiclibrarypath)
+Attributes: [finalizeFunction](#cycloneddsdomainddssecuritycryptographiclibraryfinalizefunction), [initFunction](#cycloneddsdomainddssecuritycryptographiclibraryinitfunction), [path](#cycloneddsdomainddssecuritycryptographiclibrarypath)
 
 
-RELOFF (cfg.cryptography_plugin), pf_string, BLURB("
-
 This element specifies the library to be loaded as the DDS Security
 Cryptographic plugin.
 
 
-###### //CycloneDDS/Domain/DDSSecurity/Cryptographic/Library/finalizeFunction
-
-RELOFF (cfg.cryptography_plugin.library_finalize), pf_string, BLURB("
+##### //CycloneDDS/Domain/DDSSecurity/Cryptographic/Library[@finalizeFunction]
+Text
 
 This element names the finalization function of Cryptographic plugin.
 This function is called to let the plugin release its resources.
 
+The default value is: "finalize_crypto".
 
-###### //CycloneDDS/Domain/DDSSecurity/Cryptographic/Library/initFunction
 
-RELOFF (cfg.cryptography_plugin.library_init), pf_string, BLURB("
+##### //CycloneDDS/Domain/DDSSecurity/Cryptographic/Library[@initFunction]
+Text
 
 This element names the initialization function of Cryptographic plugin.
 This function is called after loading the plugin library for
 instantiation purposes. Init function must return an object that
 implements DDS Security Cryptographic interface.
 
+The default value is: "init_crypto".
 
-###### //CycloneDDS/Domain/DDSSecurity/Cryptographic/Library/path
 
-RELOFF (cfg.cryptography_plugin.library_path), pf_string, BLURB("
+##### //CycloneDDS/Domain/DDSSecurity/Cryptographic/Library[@path]
+Text
 
 This element points to the path of Cryptographic plugin library.
 
@@ -445,6 +447,8 @@ If single file is supplied, the library located by way of the current
 working directory, or LD_LIBRARY_PATH for Unix systems, and PATH for
 Windows systems.
 
+The default value is: "dds_security_crypto".
+
 
 ### //CycloneDDS/Domain/Discovery
 Children: [DSGracePeriod](#cycloneddsdomaindiscoverydsgraceperiod), [DefaultMulticastAddress](#cycloneddsdomaindiscoverydefaultmulticastaddress), [EnableTopicDiscovery](#cycloneddsdomaindiscoveryenabletopicdiscovery), [ExternalDomainId](#cycloneddsdomaindiscoveryexternaldomainid), [MaxAutoParticipantIndex](#cycloneddsdomaindiscoverymaxautoparticipantindex), [ParticipantIndex](#cycloneddsdomaindiscoveryparticipantindex), [Peers](#cycloneddsdomaindiscoverypeers), [Ports](#cycloneddsdomaindiscoveryports), [SPDPInterval](#cycloneddsdomaindiscoveryspdpinterval), [SPDPMulticastAddress](#cycloneddsdomaindiscoveryspdpmulticastaddress), [Tag](#cycloneddsdomaindiscoverytag)
diff --git a/etc/cyclonedds.rnc b/etc/cyclonedds.rnc
index 3a73819..eac2679 100644
--- a/etc/cyclonedds.rnc
+++ b/etc/cyclonedds.rnc
@@ -90,9 +90,8 @@ specification plugins and settings.</p>""" ] ]
 specification.</p>""" ] ]
         element AccessControl {
           [ a:documentation [ xml:lang="en" """
-RELOFF (cfg.access_control_properties.governance), pf_string,
-BLURB("<p>URI to the shared Governance Document signed by the Permissions
-CA in S/MIME format</p>
+<p>URI to the shared Governance Document signed by the Permissions CA in
+S/MIME format</p>
 
 <p>URI schemes: file, data</p><br>
 
@@ -138,36 +137,34 @@ boundary="----F9A8A198D6F08E1285A292ADF14DD04F"</p>
 
 <p>MIIDuAYJKoZIhv ...al5s=</p>
 
-<p>------F9A8A198D6F08E1285A292ADF14DD04F-]]</Governance></p>""" ] ]
+<p>------F9A8A198D6F08E1285A292ADF14DD04F-]]</Governance></p><p>The
+default value is: &quot;&quot;.</p>""" ] ]
           element Governance {
-            empty
+            text
           }?
           & [ a:documentation [ xml:lang="en" """
-RELOFF (cfg.access_control_plugin), pf_string, BLURB("<p>This element
-specifies the library to be loaded as the DDS Security Access Control
-plugin.</p>""" ] ]
+<p>This element specifies the library to be loaded as the DDS Security
+Access Control plugin.</p>""" ] ]
           element Library {
             [ a:documentation [ xml:lang="en" """
-RELOFF (cfg.access_control_plugin.library_finalize), pf_string,
-BLURB("<p>This element names the finalization function of Access Control
-plugin. This function is called to let the plugin release its
-resources.</p>""" ] ]
-            element finalizeFunction {
-              empty
+<p>This element names the finalization function of Access Control plugin.
+This function is called to let the plugin release its
+resources.</p><p>The default value is:
+&quot;finalize_access_control&quot;.</p>""" ] ]
+            attribute finalizeFunction {
+              text
             }?
             & [ a:documentation [ xml:lang="en" """
-RELOFF (cfg.access_control_plugin.library_init), pf_string,
-BLURB("<p>This element names the initialization function of Access
-Control plugin. This function is called after loading the plugin library
-for instantiation purposes. Init function must return an object that
-implements DDS Security Access Control interface.</p>""" ] ]
-            element initFunction {
-              empty
+<p>This element names the initialization function of Access Control
+plugin. This function is called after loading the plugin library for
+instantiation purposes. Init function must return an object that
+implements DDS Security Access Control interface.</p><p>The default value
+is: &quot;init_access_control&quot;.</p>""" ] ]
+            attribute initFunction {
+              text
             }?
             & [ a:documentation [ xml:lang="en" """
-RELOFF (cfg.access_control_plugin.library_path), pf_string,
-BLURB("<p>This element points to the path of Access Control plugin
-library.</p>
+<p>This element points to the path of Access Control plugin library.</p>
 
 <p>It can be either absolute path excluding file extension (
 /usr/lib/dds_security_ac ) or single file without extension (
@@ -175,14 +172,14 @@ dds_security_ac ).</p>
 
 <p>If single file is supplied, the library located by way of the current
 working directory, or LD_LIBRARY_PATH for Unix systems, and PATH for
-Windows systems.</p>""" ] ]
-            element path {
-              empty
+Windows systems.</p><p>The default value is:
+&quot;dds_security_ac&quot;.</p>""" ] ]
+            attribute path {
+              text
             }?
           }?
           & [ a:documentation [ xml:lang="en" """
-RELOFF (cfg.access_control_properties.permissions), pf_string,
-BLURB("<p>URI to the DomainParticipant permissions document signed by the
+<p>URI to the DomainParticipant permissions document signed by the
 Permissions CA in S/MIME format</p>
 
 <p>The permissions document specifies the permissions to be applied to a
@@ -196,14 +193,13 @@ domain.</p><br>
 
 <p>Example data URI:</p>
 
-<p><Permissions><![CDATA[data:,.........]]</Permissions></p>""" ] ]
+<p><Permissions><![CDATA[data:,.........]]</Permissions></p><p>The
+default value is: &quot;&quot;.</p>""" ] ]
           element Permissions {
-            empty
+            text
           }?
           & [ a:documentation [ xml:lang="en" """
-RELOFF (cfg.access_control_properties.permissions_ca), pf_string,
-BLURB("<p>URI to a X509 certificate for the PermissionsCA in PEM
-format.</p>
+<p>URI to a X509 certificate for the PermissionsCA in PEM format.</p>
 
 <p>Supported URI schemes: file, data</p>
 
@@ -220,9 +216,10 @@ X.509 v3 ITU-T Recommendation X.509 (2005) [39]) in PEM format.</p><br>
 
 <p>MIIC3DCCAcQCCQCWE5x+Z ... PhovK0mp2ohhRLYI0ZiyYQ==</p>
 
-<p>-----END CERTIFICATE-----</PermissionsCA></p>""" ] ]
+<p>-----END CERTIFICATE-----</PermissionsCA></p><p>The default value is:
+&quot;&quot;.</p>""" ] ]
           element PermissionsCA {
-            empty
+            text
           }?
         }?
         & [ a:documentation [ xml:lang="en" """
@@ -230,9 +227,8 @@ X.509 v3 ITU-T Recommendation X.509 (2005) [39]) in PEM format.</p><br>
 specification.</p>""" ] ]
         element Authentication {
           [ a:documentation [ xml:lang="en" """
-RELOFF (cfg.authentication_properties.identity_ca), pf_string,
-BLURB("<p>URI to the X509 certificate [39] of the Identity CA that is the
-signer of Identity Certificate.</p>
+<p>URI to the X509 certificate [39] of the Identity CA that is the signer
+of Identity Certificate.</p>
 
 <p>Supported URI schemes: file, data</p>
 
@@ -249,11 +245,10 @@ MIIC3DCCAcQCCQCWE5x+Z...PhovK0mp2ohhRLYI0ZiyYQ==<br>
 
 -----END CERTIFICATE-----</IdentityCA></p>""" ] ]
           element IdentityCA {
-            empty
-          }?
+            text
+          }
           & [ a:documentation [ xml:lang="en" """
-RELOFF (cfg.authentication_properties.identity_certificate), pf_string,
-BLURB("<p>Identity certificate that will be used for identifying all
+<p>Identity certificate that will be used for identifying all
 participants in the OSPL instance.<br>The content is URI to a X509
 certificate signed by the IdentityCA in PEM format containing the signed
 public key.</p>
@@ -270,34 +265,31 @@ MIIDjjCCAnYCCQDCEu9...6rmT87dhTo=<br>
 
 -----END CERTIFICATE-----</IdentityCertificate></p>""" ] ]
           element IdentityCertificate {
-            empty
-          }?
+            text
+          }
           & [ a:documentation [ xml:lang="en" """
-RELOFF (cfg.authentication_plugin), pf_string, BLURB("<p>This element
-specifies the library to be loaded as the DDS Security Access Control
-plugin.</p>""" ] ]
+<p>This element specifies the library to be loaded as the DDS Security
+Access Control plugin.</p>""" ] ]
           element Library {
             [ a:documentation [ xml:lang="en" """
-RELOFF (cfg.authentication_plugin.library_finalize), pf_string,
-BLURB("<p>This element names the finalization function of Authentication
-plugin. This function is called to let the plugin release its
-resources.</p>""" ] ]
-            element finalizeFunction {
-              empty
+<p>This element names the finalization function of Authentication plugin.
+This function is called to let the plugin release its
+resources.</p><p>The default value is:
+&quot;finalize_authentication&quot;.</p>""" ] ]
+            attribute finalizeFunction {
+              text
             }?
             & [ a:documentation [ xml:lang="en" """
-RELOFF (cfg.authentication_plugin.library_init), pf_string,
-BLURB("<p>This element names the initialization function of
-Authentication plugin. This function is called after loading the plugin
-library for instantiation purposes. Init function must return an object
-that implements DDS Security Authentication interface.</p>""" ] ]
-            element initFunction {
-              empty
+<p>This element names the initialization function of Authentication
+plugin. This function is called after loading the plugin library for
+instantiation purposes. Init function must return an object that
+implements DDS Security Authentication interface.</p><p>The default value
+is: &quot;init_authentication&quot;.</p>""" ] ]
+            attribute initFunction {
+              text
             }?
             & [ a:documentation [ xml:lang="en" """
-RELOFF (cfg.authentication_plugin.library_path), pf_string,
-BLURB("<p>This element points to the path of Authentication plugin
-library.</p>
+<p>This element points to the path of Authentication plugin library.</p>
 
 <p>It can be either absolute path excluding file extension (
 /usr/lib/dds_security_auth ) or single file without extension (
@@ -305,28 +297,28 @@ dds_security_auth ).</p>
 
 <p>If single file is supplied, the library located by way of the current
 working directory, or LD_LIBRARY_PATH for Unix systems, and PATH for
-Windows systems.</p>""" ] ]
-            element path {
-              empty
+Windows systems.</p><p>The default value is:
+&quot;dds_security_auth&quot;.</p>""" ] ]
+            attribute path {
+              text
             }?
           }?
           & [ a:documentation [ xml:lang="en" """
-RELOFF (cfg.authentication_properties.password), pf_string, BLURB("<p>A
-password used to decrypt the private_key.</p>
+<p>A password used to decrypt the private_key.</p>
 
 The value of the password property shall be interpreted as the Base64
 encoding of the AES-128 key that shall be used to decrypt the private_key
 using AES128-CBC.</p>
 
 If the password property is not present, then the value supplied in the
-private_key property must contain the unencrypted private key. </p>""" ] ]
+private_key property must contain the unencrypted private key. </p><p>The
+default value is: &quot;&quot;.</p>""" ] ]
           element Password {
-            empty
+            text
           }?
           & [ a:documentation [ xml:lang="en" """
-RELOFF (cfg.authentication_properties.private_key), pf_string,
-BLURB("<p>URI to access the private Private Key for all of the
-participants in the OSPL federation.</p>
+<p>URI to access the private Private Key for all of the participants in
+the OSPL federation.</p>
 
 <p>Supported URI schemes: file, data</p>
 
@@ -340,14 +332,13 @@ MIIEpAIBAAKCAQEA3HIh...AOBaaqSV37XBUJg==<br>
 
 -----END RSA PRIVATE KEY-----</PrivateKey></p>""" ] ]
           element PrivateKey {
-            empty
-          }?
+            text
+          }
           & [ a:documentation [ xml:lang="en" """
-RELOFF (cfg.authentication_properties.trusted_ca_dir), pf_string,
-BLURB("<p>Trusted CA Directory which contains trusted CA certificates as
-separated files.</p>""" ] ]
+<p>Trusted CA Directory which contains trusted CA certificates as
+separated files.</p><p>The default value is: &quot;&quot;.</p>""" ] ]
           element TrustedCADirectory {
-            empty
+            text
           }?
         }?
         & [ a:documentation [ xml:lang="en" """
@@ -355,30 +346,27 @@ separated files.</p>""" ] ]
 specification.</p>""" ] ]
         element Cryptographic {
           [ a:documentation [ xml:lang="en" """
-RELOFF (cfg.cryptography_plugin), pf_string, BLURB("<p>This element
-specifies the library to be loaded as the DDS Security Cryptographic
-plugin.</p>""" ] ]
+<p>This element specifies the library to be loaded as the DDS Security
+Cryptographic plugin.</p>""" ] ]
           element Library {
             [ a:documentation [ xml:lang="en" """
-RELOFF (cfg.cryptography_plugin.library_finalize), pf_string,
-BLURB("<p>This element names the finalization function of Cryptographic
-plugin. This function is called to let the plugin release its
-resources.</p>""" ] ]
-            element finalizeFunction {
-              empty
+<p>This element names the finalization function of Cryptographic plugin.
+This function is called to let the plugin release its
+resources.</p><p>The default value is: &quot;finalize_crypto&quot;.</p>""" ] ]
+            attribute finalizeFunction {
+              text
             }?
             & [ a:documentation [ xml:lang="en" """
-RELOFF (cfg.cryptography_plugin.library_init), pf_string, BLURB("<p>This
-element names the initialization function of Cryptographic plugin. This
-function is called after loading the plugin library for instantiation
-purposes. Init function must return an object that implements DDS
-Security Cryptographic interface.</p>""" ] ]
-            element initFunction {
-              empty
+<p>This element names the initialization function of Cryptographic
+plugin. This function is called after loading the plugin library for
+instantiation purposes. Init function must return an object that
+implements DDS Security Cryptographic interface.</p><p>The default value
+is: &quot;init_crypto&quot;.</p>""" ] ]
+            attribute initFunction {
+              text
             }?
             & [ a:documentation [ xml:lang="en" """
-RELOFF (cfg.cryptography_plugin.library_path), pf_string, BLURB("<p>This
-element points to the path of Cryptographic plugin library.</p>
+<p>This element points to the path of Cryptographic plugin library.</p>
 
 <p>It can be either absolute path excluding file extension (
 /usr/lib/dds_security_crypto ) or single file without extension (
@@ -386,9 +374,10 @@ dds_security_crypto ).</p>
 
 <p>If single file is supplied, the library located by way of the current
 working directory, or LD_LIBRARY_PATH for Unix systems, and PATH for
-Windows systems.</p>""" ] ]
-            element path {
-              empty
+Windows systems.</p><p>The default value is:
+&quot;dds_security_crypto&quot;.</p>""" ] ]
+            attribute path {
+              text
             }?
           }?
         }?
diff --git a/etc/cyclonedds.xsd b/etc/cyclonedds.xsd
index 3bd9a64..8821495 100644
--- a/etc/cyclonedds.xsd
+++ b/etc/cyclonedds.xsd
@@ -173,39 +173,33 @@ specification.&lt;/p&gt;</xs:documentation>
         <xs:element minOccurs="0" name="Library">
           <xs:annotation>
             <xs:documentation>
-RELOFF (cfg.access_control_plugin), pf_string, BLURB("&lt;p&gt;This element
-specifies the library to be loaded as the DDS Security Access Control
-plugin.&lt;/p&gt;</xs:documentation>
+&lt;p&gt;This element specifies the library to be loaded as the DDS Security
+Access Control plugin.&lt;/p&gt;</xs:documentation>
           </xs:annotation>
           <xs:complexType>
-            <xs:all>
-              <xs:element minOccurs="0" name="finalizeFunction">
-                <xs:annotation>
-                  <xs:documentation>
-RELOFF (cfg.access_control_plugin.library_finalize), pf_string,
-BLURB("&lt;p&gt;This element names the finalization function of Access Control
-plugin. This function is called to let the plugin release its
-resources.&lt;/p&gt;</xs:documentation>
-                </xs:annotation>
-                <xs:complexType/>
-              </xs:element>
-              <xs:element minOccurs="0" name="initFunction">
-                <xs:annotation>
-                  <xs:documentation>
-RELOFF (cfg.access_control_plugin.library_init), pf_string,
-BLURB("&lt;p&gt;This element names the initialization function of Access
-Control plugin. This function is called after loading the plugin library
-for instantiation purposes. Init function must return an object that
-implements DDS Security Access Control interface.&lt;/p&gt;</xs:documentation>
-                </xs:annotation>
-                <xs:complexType/>
-              </xs:element>
-              <xs:element minOccurs="0" name="path">
-                <xs:annotation>
-                  <xs:documentation>
-RELOFF (cfg.access_control_plugin.library_path), pf_string,
-BLURB("&lt;p&gt;This element points to the path of Access Control plugin
-library.&lt;/p&gt;
+            <xs:attribute name="finalizeFunction">
+              <xs:annotation>
+                <xs:documentation>
+&lt;p&gt;This element names the finalization function of Access Control plugin.
+This function is called to let the plugin release its
+resources.&lt;/p&gt;&lt;p&gt;The default value is:
+&amp;quot;finalize_access_control&amp;quot;.&lt;/p&gt;</xs:documentation>
+              </xs:annotation>
+            </xs:attribute>
+            <xs:attribute name="initFunction">
+              <xs:annotation>
+                <xs:documentation>
+&lt;p&gt;This element names the initialization function of Access Control
+plugin. This function is called after loading the plugin library for
+instantiation purposes. Init function must return an object that
+implements DDS Security Access Control interface.&lt;/p&gt;&lt;p&gt;The default value
+is: &amp;quot;init_access_control&amp;quot;.&lt;/p&gt;</xs:documentation>
+              </xs:annotation>
+            </xs:attribute>
+            <xs:attribute name="path">
+              <xs:annotation>
+                <xs:documentation>
+&lt;p&gt;This element points to the path of Access Control plugin library.&lt;/p&gt;
 
 &lt;p&gt;It can be either absolute path excluding file extension (
 /usr/lib/dds_security_ac ) or single file without extension (
@@ -213,11 +207,10 @@ dds_security_ac ).&lt;/p&gt;
 
 &lt;p&gt;If single file is supplied, the library located by way of the current
 working directory, or LD_LIBRARY_PATH for Unix systems, and PATH for
-Windows systems.&lt;/p&gt;</xs:documentation>
-                </xs:annotation>
-                <xs:complexType/>
-              </xs:element>
-            </xs:all>
+Windows systems.&lt;/p&gt;&lt;p&gt;The default value is:
+&amp;quot;dds_security_ac&amp;quot;.&lt;/p&gt;</xs:documentation>
+              </xs:annotation>
+            </xs:attribute>
           </xs:complexType>
         </xs:element>
         <xs:element minOccurs="0" ref="config:Permissions"/>
@@ -225,12 +218,11 @@ Windows systems.&lt;/p&gt;</xs:documentation>
       </xs:all>
     </xs:complexType>
   </xs:element>
-  <xs:element name="Governance">
+  <xs:element name="Governance" type="xs:string">
     <xs:annotation>
       <xs:documentation>
-RELOFF (cfg.access_control_properties.governance), pf_string,
-BLURB("&lt;p&gt;URI to the shared Governance Document signed by the Permissions
-CA in S/MIME format&lt;/p&gt;
+&lt;p&gt;URI to the shared Governance Document signed by the Permissions CA in
+S/MIME format&lt;/p&gt;
 
 &lt;p&gt;URI schemes: file, data&lt;/p&gt;&lt;br&gt;
 
@@ -276,15 +268,14 @@ boundary="----F9A8A198D6F08E1285A292ADF14DD04F"&lt;/p&gt;
 
 &lt;p&gt;MIIDuAYJKoZIhv ...al5s=&lt;/p&gt;
 
-&lt;p&gt;------F9A8A198D6F08E1285A292ADF14DD04F-]]&lt;/Governance&gt;&lt;/p&gt;</xs:documentation>
+&lt;p&gt;------F9A8A198D6F08E1285A292ADF14DD04F-]]&lt;/Governance&gt;&lt;/p&gt;&lt;p&gt;The
+default value is: &amp;quot;&amp;quot;.&lt;/p&gt;</xs:documentation>
     </xs:annotation>
-    <xs:complexType/>
   </xs:element>
-  <xs:element name="Permissions">
+  <xs:element name="Permissions" type="xs:string">
     <xs:annotation>
       <xs:documentation>
-RELOFF (cfg.access_control_properties.permissions), pf_string,
-BLURB("&lt;p&gt;URI to the DomainParticipant permissions document signed by the
+&lt;p&gt;URI to the DomainParticipant permissions document signed by the
 Permissions CA in S/MIME format&lt;/p&gt;
 
 &lt;p&gt;The permissions document specifies the permissions to be applied to a
@@ -298,16 +289,14 @@ domain.&lt;/p&gt;&lt;br&gt;
 
 &lt;p&gt;Example data URI:&lt;/p&gt;
 
-&lt;p&gt;&lt;Permissions&gt;&lt;![CDATA[data:,.........]]&lt;/Permissions&gt;&lt;/p&gt;</xs:documentation>
+&lt;p&gt;&lt;Permissions&gt;&lt;![CDATA[data:,.........]]&lt;/Permissions&gt;&lt;/p&gt;&lt;p&gt;The
+default value is: &amp;quot;&amp;quot;.&lt;/p&gt;</xs:documentation>
     </xs:annotation>
-    <xs:complexType/>
   </xs:element>
-  <xs:element name="PermissionsCA">
+  <xs:element name="PermissionsCA" type="xs:string">
     <xs:annotation>
       <xs:documentation>
-RELOFF (cfg.access_control_properties.permissions_ca), pf_string,
-BLURB("&lt;p&gt;URI to a X509 certificate for the PermissionsCA in PEM
-format.&lt;/p&gt;
+&lt;p&gt;URI to a X509 certificate for the PermissionsCA in PEM format.&lt;/p&gt;
 
 &lt;p&gt;Supported URI schemes: file, data&lt;/p&gt;
 
@@ -324,9 +313,9 @@ X.509 v3 ITU-T Recommendation X.509 (2005) [39]) in PEM format.&lt;/p&gt;&lt;br&
 
 &lt;p&gt;MIIC3DCCAcQCCQCWE5x+Z ... PhovK0mp2ohhRLYI0ZiyYQ==&lt;/p&gt;
 
-&lt;p&gt;-----END CERTIFICATE-----&lt;/PermissionsCA&gt;&lt;/p&gt;</xs:documentation>
+&lt;p&gt;-----END CERTIFICATE-----&lt;/PermissionsCA&gt;&lt;/p&gt;&lt;p&gt;The default value is:
+&amp;quot;&amp;quot;.&lt;/p&gt;</xs:documentation>
     </xs:annotation>
-    <xs:complexType/>
   </xs:element>
   <xs:element name="Authentication">
     <xs:annotation>
@@ -336,44 +325,38 @@ specification.&lt;/p&gt;</xs:documentation>
     </xs:annotation>
     <xs:complexType>
       <xs:all>
-        <xs:element minOccurs="0" ref="config:IdentityCA"/>
-        <xs:element minOccurs="0" ref="config:IdentityCertificate"/>
+        <xs:element ref="config:IdentityCA"/>
+        <xs:element ref="config:IdentityCertificate"/>
         <xs:element minOccurs="0" name="Library">
           <xs:annotation>
             <xs:documentation>
-RELOFF (cfg.authentication_plugin), pf_string, BLURB("&lt;p&gt;This element
-specifies the library to be loaded as the DDS Security Access Control
-plugin.&lt;/p&gt;</xs:documentation>
+&lt;p&gt;This element specifies the library to be loaded as the DDS Security
+Access Control plugin.&lt;/p&gt;</xs:documentation>
           </xs:annotation>
           <xs:complexType>
-            <xs:all>
-              <xs:element minOccurs="0" name="finalizeFunction">
-                <xs:annotation>
-                  <xs:documentation>
-RELOFF (cfg.authentication_plugin.library_finalize), pf_string,
-BLURB("&lt;p&gt;This element names the finalization function of Authentication
-plugin. This function is called to let the plugin release its
-resources.&lt;/p&gt;</xs:documentation>
-                </xs:annotation>
-                <xs:complexType/>
-              </xs:element>
-              <xs:element minOccurs="0" name="initFunction">
-                <xs:annotation>
-                  <xs:documentation>
-RELOFF (cfg.authentication_plugin.library_init), pf_string,
-BLURB("&lt;p&gt;This element names the initialization function of
-Authentication plugin. This function is called after loading the plugin
-library for instantiation purposes. Init function must return an object
-that implements DDS Security Authentication interface.&lt;/p&gt;</xs:documentation>
-                </xs:annotation>
-                <xs:complexType/>
-              </xs:element>
-              <xs:element minOccurs="0" name="path">
-                <xs:annotation>
-                  <xs:documentation>
-RELOFF (cfg.authentication_plugin.library_path), pf_string,
-BLURB("&lt;p&gt;This element points to the path of Authentication plugin
-library.&lt;/p&gt;
+            <xs:attribute name="finalizeFunction">
+              <xs:annotation>
+                <xs:documentation>
+&lt;p&gt;This element names the finalization function of Authentication plugin.
+This function is called to let the plugin release its
+resources.&lt;/p&gt;&lt;p&gt;The default value is:
+&amp;quot;finalize_authentication&amp;quot;.&lt;/p&gt;</xs:documentation>
+              </xs:annotation>
+            </xs:attribute>
+            <xs:attribute name="initFunction">
+              <xs:annotation>
+                <xs:documentation>
+&lt;p&gt;This element names the initialization function of Authentication
+plugin. This function is called after loading the plugin library for
+instantiation purposes. Init function must return an object that
+implements DDS Security Authentication interface.&lt;/p&gt;&lt;p&gt;The default value
+is: &amp;quot;init_authentication&amp;quot;.&lt;/p&gt;</xs:documentation>
+              </xs:annotation>
+            </xs:attribute>
+            <xs:attribute name="path">
+              <xs:annotation>
+                <xs:documentation>
+&lt;p&gt;This element points to the path of Authentication plugin library.&lt;/p&gt;
 
 &lt;p&gt;It can be either absolute path excluding file extension (
 /usr/lib/dds_security_auth ) or single file without extension (
@@ -381,25 +364,23 @@ dds_security_auth ).&lt;/p&gt;
 
 &lt;p&gt;If single file is supplied, the library located by way of the current
 working directory, or LD_LIBRARY_PATH for Unix systems, and PATH for
-Windows systems.&lt;/p&gt;</xs:documentation>
-                </xs:annotation>
-                <xs:complexType/>
-              </xs:element>
-            </xs:all>
+Windows systems.&lt;/p&gt;&lt;p&gt;The default value is:
+&amp;quot;dds_security_auth&amp;quot;.&lt;/p&gt;</xs:documentation>
+              </xs:annotation>
+            </xs:attribute>
           </xs:complexType>
         </xs:element>
         <xs:element minOccurs="0" ref="config:Password"/>
-        <xs:element minOccurs="0" ref="config:PrivateKey"/>
+        <xs:element ref="config:PrivateKey"/>
         <xs:element minOccurs="0" ref="config:TrustedCADirectory"/>
       </xs:all>
     </xs:complexType>
   </xs:element>
-  <xs:element name="IdentityCA">
+  <xs:element name="IdentityCA" type="xs:string">
     <xs:annotation>
       <xs:documentation>
-RELOFF (cfg.authentication_properties.identity_ca), pf_string,
-BLURB("&lt;p&gt;URI to the X509 certificate [39] of the Identity CA that is the
-signer of Identity Certificate.&lt;/p&gt;
+&lt;p&gt;URI to the X509 certificate [39] of the Identity CA that is the signer
+of Identity Certificate.&lt;/p&gt;
 
 &lt;p&gt;Supported URI schemes: file, data&lt;/p&gt;
 
@@ -416,13 +397,11 @@ MIIC3DCCAcQCCQCWE5x+Z...PhovK0mp2ohhRLYI0ZiyYQ==&lt;br&gt;
 
 -----END CERTIFICATE-----&lt;/IdentityCA&gt;&lt;/p&gt;</xs:documentation>
     </xs:annotation>
-    <xs:complexType/>
   </xs:element>
-  <xs:element name="IdentityCertificate">
+  <xs:element name="IdentityCertificate" type="xs:string">
     <xs:annotation>
       <xs:documentation>
-RELOFF (cfg.authentication_properties.identity_certificate), pf_string,
-BLURB("&lt;p&gt;Identity certificate that will be used for identifying all
+&lt;p&gt;Identity certificate that will be used for identifying all
 participants in the OSPL instance.&lt;br&gt;The content is URI to a X509
 certificate signed by the IdentityCA in PEM format containing the signed
 public key.&lt;/p&gt;
@@ -439,29 +418,26 @@ MIIDjjCCAnYCCQDCEu9...6rmT87dhTo=&lt;br&gt;
 
 -----END CERTIFICATE-----&lt;/IdentityCertificate&gt;&lt;/p&gt;</xs:documentation>
     </xs:annotation>
-    <xs:complexType/>
   </xs:element>
-  <xs:element name="Password">
+  <xs:element name="Password" type="xs:string">
     <xs:annotation>
       <xs:documentation>
-RELOFF (cfg.authentication_properties.password), pf_string, BLURB("&lt;p&gt;A
-password used to decrypt the private_key.&lt;/p&gt;
+&lt;p&gt;A password used to decrypt the private_key.&lt;/p&gt;
 
 The value of the password property shall be interpreted as the Base64
 encoding of the AES-128 key that shall be used to decrypt the private_key
 using AES128-CBC.&lt;/p&gt;
 
 If the password property is not present, then the value supplied in the
-private_key property must contain the unencrypted private key. &lt;/p&gt;</xs:documentation>
+private_key property must contain the unencrypted private key. &lt;/p&gt;&lt;p&gt;The
+default value is: &amp;quot;&amp;quot;.&lt;/p&gt;</xs:documentation>
     </xs:annotation>
-    <xs:complexType/>
   </xs:element>
-  <xs:element name="PrivateKey">
+  <xs:element name="PrivateKey" type="xs:string">
     <xs:annotation>
       <xs:documentation>
-RELOFF (cfg.authentication_properties.private_key), pf_string,
-BLURB("&lt;p&gt;URI to access the private Private Key for all of the
-participants in the OSPL federation.&lt;/p&gt;
+&lt;p&gt;URI to access the private Private Key for all of the participants in
+the OSPL federation.&lt;/p&gt;
 
 &lt;p&gt;Supported URI schemes: file, data&lt;/p&gt;
 
@@ -475,16 +451,13 @@ MIIEpAIBAAKCAQEA3HIh...AOBaaqSV37XBUJg==&lt;br&gt;
 
 -----END RSA PRIVATE KEY-----&lt;/PrivateKey&gt;&lt;/p&gt;</xs:documentation>
     </xs:annotation>
-    <xs:complexType/>
   </xs:element>
-  <xs:element name="TrustedCADirectory">
+  <xs:element name="TrustedCADirectory" type="xs:string">
     <xs:annotation>
       <xs:documentation>
-RELOFF (cfg.authentication_properties.trusted_ca_dir), pf_string,
-BLURB("&lt;p&gt;Trusted CA Directory which contains trusted CA certificates as
-separated files.&lt;/p&gt;</xs:documentation>
+&lt;p&gt;Trusted CA Directory which contains trusted CA certificates as
+separated files.&lt;/p&gt;&lt;p&gt;The default value is: &amp;quot;&amp;quot;.&lt;/p&gt;</xs:documentation>
     </xs:annotation>
-    <xs:complexType/>
   </xs:element>
   <xs:element name="Cryptographic">
     <xs:annotation>
@@ -497,38 +470,32 @@ specification.&lt;/p&gt;</xs:documentation>
         <xs:element minOccurs="0" name="Library">
           <xs:annotation>
             <xs:documentation>
-RELOFF (cfg.cryptography_plugin), pf_string, BLURB("&lt;p&gt;This element
-specifies the library to be loaded as the DDS Security Cryptographic
-plugin.&lt;/p&gt;</xs:documentation>
+&lt;p&gt;This element specifies the library to be loaded as the DDS Security
+Cryptographic plugin.&lt;/p&gt;</xs:documentation>
           </xs:annotation>
           <xs:complexType>
-            <xs:all>
-              <xs:element minOccurs="0" name="finalizeFunction">
-                <xs:annotation>
-                  <xs:documentation>
-RELOFF (cfg.cryptography_plugin.library_finalize), pf_string,
-BLURB("&lt;p&gt;This element names the finalization function of Cryptographic
-plugin. This function is called to let the plugin release its
-resources.&lt;/p&gt;</xs:documentation>
-                </xs:annotation>
-                <xs:complexType/>
-              </xs:element>
-              <xs:element minOccurs="0" name="initFunction">
-                <xs:annotation>
-                  <xs:documentation>
-RELOFF (cfg.cryptography_plugin.library_init), pf_string, BLURB("&lt;p&gt;This
-element names the initialization function of Cryptographic plugin. This
-function is called after loading the plugin library for instantiation
-purposes. Init function must return an object that implements DDS
-Security Cryptographic interface.&lt;/p&gt;</xs:documentation>
-                </xs:annotation>
-                <xs:complexType/>
-              </xs:element>
-              <xs:element minOccurs="0" name="path">
-                <xs:annotation>
-                  <xs:documentation>
-RELOFF (cfg.cryptography_plugin.library_path), pf_string, BLURB("&lt;p&gt;This
-element points to the path of Cryptographic plugin library.&lt;/p&gt;
+            <xs:attribute name="finalizeFunction">
+              <xs:annotation>
+                <xs:documentation>
+&lt;p&gt;This element names the finalization function of Cryptographic plugin.
+This function is called to let the plugin release its
+resources.&lt;/p&gt;&lt;p&gt;The default value is: &amp;quot;finalize_crypto&amp;quot;.&lt;/p&gt;</xs:documentation>
+              </xs:annotation>
+            </xs:attribute>
+            <xs:attribute name="initFunction">
+              <xs:annotation>
+                <xs:documentation>
+&lt;p&gt;This element names the initialization function of Cryptographic
+plugin. This function is called after loading the plugin library for
+instantiation purposes. Init function must return an object that
+implements DDS Security Cryptographic interface.&lt;/p&gt;&lt;p&gt;The default value
+is: &amp;quot;init_crypto&amp;quot;.&lt;/p&gt;</xs:documentation>
+              </xs:annotation>
+            </xs:attribute>
+            <xs:attribute name="path">
+              <xs:annotation>
+                <xs:documentation>
+&lt;p&gt;This element points to the path of Cryptographic plugin library.&lt;/p&gt;
 
 &lt;p&gt;It can be either absolute path excluding file extension (
 /usr/lib/dds_security_crypto ) or single file without extension (
@@ -536,11 +503,10 @@ dds_security_crypto ).&lt;/p&gt;
 
 &lt;p&gt;If single file is supplied, the library located by way of the current
 working directory, or LD_LIBRARY_PATH for Unix systems, and PATH for
-Windows systems.&lt;/p&gt;</xs:documentation>
-                </xs:annotation>
-                <xs:complexType/>
-              </xs:element>
-            </xs:all>
+Windows systems.&lt;/p&gt;&lt;p&gt;The default value is:
+&amp;quot;dds_security_crypto&amp;quot;.&lt;/p&gt;</xs:documentation>
+              </xs:annotation>
+            </xs:attribute>
           </xs:complexType>
         </xs:element>
       </xs:sequence>

From 0b1804e039119e64ef4fbf4d869c1f22db10b7aa Mon Sep 17 00:00:00 2001
From: Kurtulus Oksuztepe <kurtulus.oksuztepe@adlinktech.com>
Date: Fri, 6 Dec 2019 16:17:36 +0100
Subject: [PATCH 090/238] Finite State Machine for Security A generic FSM has
 been added to DDS Security Core component to realize authentication handshake
 process. The list of the states and the transitions are given in the creation
 and the FSM is started with a start call. Passing arguments to transition
 funstions is possible. Timeout transitions are possible.

Signed-off-by: Kurtulus Oksuztepe <kurtulus.oksuztepe@adlinktech.com>
---
 src/ddsrt/include/dds/ddsrt/threads.h         |  11 +-
 src/ddsrt/src/threads/freertos/threads.c      |   7 +
 src/ddsrt/src/threads/posix/threads.c         |   8 +
 src/ddsrt/src/threads/windows/threads.c       |   8 +
 src/security/core/CMakeLists.txt              |   4 +-
 .../dds/security/core/dds_security_fsm.h      | 224 +++++
 src/security/core/src/dds_security_fsm.c      | 749 +++++++++++++++++
 src/security/core/tests/CMakeLists.txt        |  39 +
 src/security/core/tests/tc_fsm.c              | 766 ++++++++++++++++++
 9 files changed, 1814 insertions(+), 2 deletions(-)
 create mode 100644 src/security/core/include/dds/security/core/dds_security_fsm.h
 create mode 100644 src/security/core/src/dds_security_fsm.c
 create mode 100644 src/security/core/tests/CMakeLists.txt
 create mode 100644 src/security/core/tests/tc_fsm.c

diff --git a/src/ddsrt/include/dds/ddsrt/threads.h b/src/ddsrt/include/dds/ddsrt/threads.h
index e258218..c4d3d81 100644
--- a/src/ddsrt/include/dds/ddsrt/threads.h
+++ b/src/ddsrt/include/dds/ddsrt/threads.h
@@ -140,11 +140,20 @@ ddsrt_nonnull((1,2,3,4));
 /**
  * @brief Retrieve integer representation of the given thread id.
  *
- * @returns The integer representation of the given thread.
+ * @returns The integer representation of the current thread.
  */
 DDS_EXPORT ddsrt_tid_t
 ddsrt_gettid(void);
 
+/**
+ * @brief Retrieve integer representation of the given thread id.
+ *
+ * @returns The integer representation of the given thread.
+ */
+DDS_EXPORT ddsrt_tid_t
+ddsrt_gettid_for_thread( ddsrt_thread_t thread);
+
+
 /**
  * @brief Return thread ID of the calling thread.
  *
diff --git a/src/ddsrt/src/threads/freertos/threads.c b/src/ddsrt/src/threads/freertos/threads.c
index be4e177..be636c5 100644
--- a/src/ddsrt/src/threads/freertos/threads.c
+++ b/src/ddsrt/src/threads/freertos/threads.c
@@ -83,6 +83,13 @@ ddsrt_gettid(void)
   return status.xTaskNumber;
 }
 
+DDS_EXPORT ddsrt_tid_t
+ddsrt_gettid_for_thread( ddsrt_thread_t thread)
+{
+  return (ddsrt_tid_t)thread.task;
+}
+
+
 ddsrt_thread_t
 ddsrt_thread_self(void)
 {
diff --git a/src/ddsrt/src/threads/posix/threads.c b/src/ddsrt/src/threads/posix/threads.c
index 0d2c387..2affcdb 100644
--- a/src/ddsrt/src/threads/posix/threads.c
+++ b/src/ddsrt/src/threads/posix/threads.c
@@ -346,6 +346,14 @@ ddsrt_gettid(void)
   return tid;
 }
 
+ddsrt_tid_t
+ddsrt_gettid_for_thread( ddsrt_thread_t thread)
+{
+  return (ddsrt_tid_t) thread.v;
+
+}
+
+
 ddsrt_thread_t
 ddsrt_thread_self(void)
 {
diff --git a/src/ddsrt/src/threads/windows/threads.c b/src/ddsrt/src/threads/windows/threads.c
index 2bc8052..a028e6c 100644
--- a/src/ddsrt/src/threads/windows/threads.c
+++ b/src/ddsrt/src/threads/windows/threads.c
@@ -173,6 +173,14 @@ ddsrt_gettid(void)
   return GetCurrentThreadId();
 }
 
+
+ddsrt_tid_t
+ddsrt_gettid_for_thread( ddsrt_thread_t thread)
+{
+  return (ddsrt_tid_t) thread.tid;
+
+}
+
 ddsrt_thread_t
 ddsrt_thread_self(
     void)
diff --git a/src/security/core/CMakeLists.txt b/src/security/core/CMakeLists.txt
index 6802c73..b0701e9 100644
--- a/src/security/core/CMakeLists.txt
+++ b/src/security/core/CMakeLists.txt
@@ -14,6 +14,7 @@ PREPEND(srcs_security_core "${CMAKE_CURRENT_LIST_DIR}/src"
     dds_security_utils.c
     dds_security_plugins.c
     shared_secret.c
+    dds_security_fsm.c
 )
  
 PREPEND(hdrs_public_security_core "${CMAKE_CURRENT_LIST_DIR}/include/security/core"
@@ -21,6 +22,7 @@ PREPEND(hdrs_public_security_core "${CMAKE_CURRENT_LIST_DIR}/include/security/co
     dds_security_types.h
     dds_security_utils.h
     dds_security_plugins.h
+    dds_security_fsm.h
     shared_secret.h
 )
 
@@ -52,4 +54,4 @@ install(
   DESTINATION "${CMAKE_INSTALL_INCLUDEDIR}/dds/security/core/"
   COMPONENT dev)
 
-add_subdirectory(tests/plugin_loading)
+add_subdirectory(tests)
diff --git a/src/security/core/include/dds/security/core/dds_security_fsm.h b/src/security/core/include/dds/security/core/dds_security_fsm.h
new file mode 100644
index 0000000..db6374a
--- /dev/null
+++ b/src/security/core/include/dds/security/core/dds_security_fsm.h
@@ -0,0 +1,224 @@
+/*
+ * Copyright(c) 2006 to 2019 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+
+#ifndef DDS_SECURITY_FSM_H
+#define DDS_SECURITY_FSM_H
+
+#include "dds/ddsrt/time.h"
+#include "dds/ddsrt/threads.h"
+
+#if defined (__cplusplus)
+extern "C" {
+#endif
+
+#define DDS_SECURITY_FSM_EVENT_AUTO    (-1)
+#define DDS_SECURITY_FSM_EVENT_TIMEOUT (-2)
+
+typedef enum {
+  DDS_SECURITY_FSM_DEBUG_ACT_DISPATCH,
+  DDS_SECURITY_FSM_DEBUG_ACT_DISPATCH_DIRECT,
+  DDS_SECURITY_FSM_DEBUG_ACT_HANDLING
+} DDS_SECURITY_FSM_DEBUG_ACT;
+
+struct dds_security_fsm;
+struct dds_security_fsm_context;
+
+typedef ddsrt_thread_t (*dds_security_fsm_thread_create_func)(const char *name, ddsrt_thread_routine_t f, void *arg);
+
+typedef void (*dds_security_fsm_thread_destroy_func)( ddsrt_thread_t tid);
+
+/**
+ * Template for user-defined state methods.
+ * It is allowed to call dds_security_fsm_dispatch() from within a dispatch function.
+ */
+typedef void (*dds_security_fsm_action)(struct dds_security_fsm *fsm, void *arg);
+
+/**
+ * State struct
+ *
+ * - func    : optional user defined function, invoked by when reaching this state
+ * - timeout : optional timeout which is controlled by the fsm
+ */
+typedef struct dds_security_fsm_state {
+  const dds_security_fsm_action func;
+  dds_duration_t timeout;
+} dds_security_fsm_state;
+
+/**
+ * Template for user-defined debug methods.
+ * It'll be called for every dispatched event, regardless of which state it
+ * is in (which is also provided).
+ * This can be used to get extra information about the behaviour of the
+ * state machine.
+ * It is not allowed to call any fsm API functions from within this
+ * debug callback.
+ */
+typedef void (*dds_security_fsm_debug)(struct dds_security_fsm *fsm, DDS_SECURITY_FSM_DEBUG_ACT act,
+    const dds_security_fsm_state *current, int event_id, void *arg);
+
+/**
+ * Transition definitions
+ *
+ * begin    : start state (to transition from)
+ * event_id : indicate the event responsible for the transition
+ * func     : user defined function, invoked during transition
+ * end      : end state (to transition to)
+ */
+typedef struct dds_security_fsm_transition {
+  const dds_security_fsm_state *begin;
+  const int event_id;
+  const dds_security_fsm_action func;
+  const dds_security_fsm_state *end;
+} dds_security_fsm_transition;
+
+/**
+ * Create a new fsm context
+ * Creates an fsm context. The fsm context manages the global state of the fsm's created within
+ * this context. The fsm context uses a number of threads to control the state machined allocated
+ * to this context. A thread create callback has to be provided to created the threads in the
+ * context of the caller.
+ *
+ * @param thr_create_func  a callback function used to created the threads used to manage
+ *                         the allocated state machines
+ *
+ * @return              Returns the new fsm context on success. Null on failure.
+ */
+DDS_EXPORT struct dds_security_fsm_context *
+dds_security_fsm_context_create( dds_security_fsm_thread_create_func thr_create_func);
+
+/**
+ * Destroys a fsm context
+ * The function clears the fsm context and stops the associated threads. The thread destroy
+ * function is called to allow the caller to free resources associated with the threads and
+ * to wait for the threads to exit.
+ *
+ * @param context           the context to be destroyed
+ * @param thr_destroy_func  a callback function used to wait a thread to terminate
+ *                          the allocated state machine
+ */
+DDS_EXPORT void
+dds_security_fsm_context_destroy(struct dds_security_fsm_context *context,
+    dds_security_fsm_thread_destroy_func thr_destroy_func);
+
+/**
+ * Create a new fsm
+ * Initializes a new fsm. Fsm does not start.
+ *
+ * @param transitions   array of transitions which the defines the functioning of the state machine
+ * @param size          number of transitions
+ * @param arg           Extra data to pass to the fsm. Will be passed to all user defined callback
+ *                      methods.
+ *
+ * @return              Returns the new created state machine on success. Null on failure.
+ */
+DDS_EXPORT struct dds_security_fsm *
+dds_security_fsm_create(struct dds_security_fsm_context *context,
+    const dds_security_fsm_transition *transitions, int size, void *arg);
+
+/**
+ * Start a fsm
+ * Starts the fsm, start with the firs transition
+ *
+ * @param fsm fsm to start.
+ */
+DDS_EXPORT void
+dds_security_fsm_start(struct dds_security_fsm *fsm);
+
+/**
+ * Set an overall timeout for the given state machine
+ * Will be monitoring the overall timeout of the given state machine,
+ * invoking a user defined callback when the given timeout expires.
+ * Timeout will be aborted upon a cleanup of the state machine.
+ *
+ * @param fsm       fsm to set the overall timeout for
+ * @param func      user defined function which is called when the
+ *                  overall timeout expires.
+ * @param timeout   indicates the overall timeout
+ */
+DDS_EXPORT void
+dds_security_fsm_set_timeout(struct dds_security_fsm *fsm, dds_security_fsm_action func, dds_time_t timeout);
+
+/**
+ * Set an debug callback for the given state machine.
+ *
+ * @param fsm       fsm to set the overall timeout for
+ * @param func      user defined function which is called for every
+ *                  event, whether being dispatched or actually
+ *                  handled.
+ */
+DDS_EXPORT void
+dds_security_fsm_set_debug(struct dds_security_fsm *fsm, dds_security_fsm_debug func);
+
+/**
+ * Dispatches the next event
+ * Assignment for the state machine to transisiton to the next state.
+ *
+ * @param fsm       The state machine
+ * @param event_id  Indicate where to transisition to (outcome of current state)
+ */
+DDS_EXPORT void
+dds_security_fsm_dispatch(struct dds_security_fsm *fsm, int32_t event_id);
+
+/**
+ * Dispatches the next event with priority
+ * Assignment for the state machine to transisiton to the next state.
+ * This event will be placed at the top of the event list.
+ *
+ * @param fsm       The state machine
+ * @param event_id  Indicate where to transisition to (outcome of current state)
+ */
+DDS_EXPORT void
+dds_security_fsm_dispatch_direct(struct dds_security_fsm *fsm, int32_t event_id);
+
+/**
+ * Retrieve the current state of a given state machine
+ *
+ * @param fsm       The state machine
+ *
+ * @return          The current state of the given state machine
+ */
+DDS_EXPORT const dds_security_fsm_state*
+dds_security_fsm_current_state(struct dds_security_fsm *fsm);
+
+/**
+ * Clean the given state machine
+ * Cleaning up the given state machine. This will abort all timeouts for
+ * this state machine and remove all events from the internals.
+ *
+ * @param fsm   The state machine to clean.
+ */
+DDS_EXPORT void
+dds_security_fsm_cleanup(struct dds_security_fsm *fsm);
+
+/**
+ * Freeing the state machine.
+ * Stops all running timeouts and events and cleaning all memory
+ * related to this machine.
+ *
+ * When calling this from another thread, then it may block until
+ * a possible concurrent event has finished. After this call, the
+ * fsm may not be used anymore.
+ *
+ * When in the fsm action callback function context, this will
+ * not block. It will garbage collect when the event has been
+ * handled.
+ *
+ * @param fsm   The state machine to free
+ */
+DDS_EXPORT void /* Implicit cleanup. */
+dds_security_fsm_free(struct dds_security_fsm *fsm);
+
+#if defined (__cplusplus)
+}
+#endif
+
+#endif /* DDS_SECURITY_FSM_H */
diff --git a/src/security/core/src/dds_security_fsm.c b/src/security/core/src/dds_security_fsm.c
new file mode 100644
index 0000000..220b017
--- /dev/null
+++ b/src/security/core/src/dds_security_fsm.c
@@ -0,0 +1,749 @@
+/*
+ * Copyright(c) 2006 to 2019 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+
+#include <string.h>
+#include <assert.h>
+#include "dds/security/core/dds_security_fsm.h"
+#include "dds/ddsrt/threads.h"
+#include "dds/ddsrt/sync.h"
+#include "dds/ddsrt/heap.h"
+#include "dds/ddsrt/atomics.h"
+#include "dds/ddsrt/retcode.h"
+#include "dds/ddsrt/time.h"
+#include "dds/ddsrt/timeconv.h"
+#include <stdbool.h>
+
+typedef struct dds_security_fsm {
+  const dds_security_fsm_transition *transitions;
+  int size;
+  void *arg;
+  const dds_security_fsm_state *current;
+  dds_time_t current_state_endtime;
+  ddsrt_atomic_uint32_t ref_cnt;
+  dds_security_fsm_debug debug_func;
+  struct dds_security_fsm_context *context;
+
+  struct dds_security_fsm *next;
+  struct dds_security_fsm *prev;
+} dds_security_fsm;
+
+typedef struct fsm_event {
+  struct dds_security_fsm *fsm;
+  int event_id;
+  struct fsm_event *next;
+  struct fsm_event *prev;
+} fsm_event;
+
+typedef struct fsm_state_timeout {
+  struct dds_security_fsm *fsm;
+  dds_time_t endtime;
+} fsm_state_timeout;
+
+typedef struct fsm_overall_timeout {
+  struct dds_security_fsm *fsm;
+  dds_time_t endtime;
+  dds_security_fsm_action func;
+  struct fsm_overall_timeout *next;
+  struct fsm_overall_timeout *prev;
+} fsm_overall_timeout;
+
+typedef struct dds_security_fsm_context {
+  ddsrt_thread_t fsm_tid;
+  ddsrt_thread_t fsm_timeout_tid;
+  bool fsm_teardown;
+  fsm_event *fsm_queue;
+  fsm_overall_timeout *fsm_overall_timeouts;
+  ddsrt_mutex_t fsm_fsms_mutex;
+  dds_security_fsm *fsm_fsms;
+  fsm_state_timeout *fsm_next_state_timeout;
+  ddsrt_mutex_t fsm_state_timeout_mutex;
+  ddsrt_cond_t fsm_event_cond;
+  ddsrt_mutex_t fsm_event_cond_mutex;
+
+  // Overall timeout guard
+  ddsrt_cond_t fsm_overall_timeout_cond;
+  ddsrt_mutex_t fsm_overall_timeout_cond_mutex;
+} dds_security_fsm_context;
+
+static dds_security_fsm_context *fsm_context = NULL;
+
+// Thread safe initialization of the Generic State Machine Utility
+bool dds_security_fsm_initialized = false;
+static ddsrt_atomic_uint32_t _fsmInitCount = DDSRT_ATOMIC_UINT32_INIT(0);
+
+static void fsm_dispatch(struct dds_security_fsm *fsm, int event_id, int lifo) {
+  fsm_event *event;
+  dds_security_fsm_context *context;
+
+  assert(fsm);
+
+  if (fsm->size < 0) {
+    /* This fsm is cleaned up (but probably not freed yet).
+     * So, ignore the new event. */
+    return;
+  }
+
+  context = fsm->context;
+  assert(context);
+
+  if (fsm->debug_func) {
+    fsm->debug_func(fsm,
+        lifo ? DDS_SECURITY_FSM_DEBUG_ACT_DISPATCH_DIRECT : DDS_SECURITY_FSM_DEBUG_ACT_DISPATCH,
+        fsm->current, event_id, fsm->arg);
+  }
+
+  event = ddsrt_malloc(sizeof(fsm_event));
+  event->fsm = fsm;
+  event->event_id = event_id;
+  event->next = NULL;
+  event->prev = NULL;
+
+  if (lifo) {
+    /* Insert event at the top of the event list */
+    if (context->fsm_queue) {
+      context->fsm_queue->prev = event;
+    }
+    event->next = context->fsm_queue;
+    context->fsm_queue = event;
+  } else {
+    /* Insert FIFO event */
+    if (context->fsm_queue) {
+      fsm_event *last = context->fsm_queue;
+      while (last->next != NULL ) {
+        last = last->next;
+      }
+      last->next = event;
+      event->prev = last;
+    } else {
+      context->fsm_queue = event;
+    }
+  }
+}
+
+static void fsm_set_next_state_timeout(dds_security_fsm_context *context,
+    dds_security_fsm *ignore) {
+  dds_security_fsm *fsm;
+
+  ddsrt_mutex_lock(&context->fsm_event_cond_mutex);
+
+  // reset the current time
+  context->fsm_next_state_timeout->endtime = DDS_NEVER;
+  context->fsm_next_state_timeout->fsm = NULL;
+
+  fsm = context->fsm_fsms;
+  while (fsm) {
+    if ((fsm->current) && (fsm->current->timeout) && (fsm != ignore)) {
+      // first set the endtime of this state (if not set)
+      if (fsm->current_state_endtime == 0) {
+        fsm->current_state_endtime = ddsrt_time_add_duration(dds_time(),
+            fsm->current->timeout);
+      }
+      // Initialize the current endtime
+      if (context->fsm_next_state_timeout->fsm == NULL) {
+        context->fsm_next_state_timeout->endtime = fsm->current_state_endtime;
+        context->fsm_next_state_timeout->fsm = fsm;
+      } else if (fsm->current_state_endtime
+          < context->fsm_next_state_timeout->endtime) {
+        context->fsm_next_state_timeout->endtime = fsm->current_state_endtime;
+        context->fsm_next_state_timeout->fsm = fsm;
+      }
+    }
+    fsm = fsm->next;
+  }
+
+  ddsrt_mutex_unlock(&context->fsm_event_cond_mutex);
+}
+
+static void fsm_state_change(fsm_event *event) {
+  dds_security_fsm *fsm = event->fsm;
+  dds_security_fsm_context *context = fsm->context;
+  int event_id = event->event_id;
+  int i, j;
+
+  if (fsm->debug_func) {
+    fsm->debug_func(fsm, DDS_SECURITY_FSM_DEBUG_ACT_HANDLING, fsm->current, event_id,
+        fsm->arg);
+  }
+
+  for (i = 0; !context->fsm_teardown && i < fsm->size; i++) {
+    if ((fsm->transitions[i].begin == fsm->current)
+        && (fsm->transitions[i].event_id == event_id)) {
+      /* Transition. */
+      if (fsm->transitions[i].func) {
+        fsm->transitions[i].func(fsm, fsm->arg);
+      }
+      /* New state. */
+      fsm->current = fsm->transitions[i].end;
+      if (fsm->current) {
+        if (fsm->current->func) {
+          fsm->current->func(fsm, fsm->arg);
+        }
+        /* Reset timeout. */
+        fsm->current_state_endtime = ddsrt_time_add_duration(dds_time(),
+            fsm->current->timeout);
+        /* Check if an auto transition is to be dispatched */
+        for (j = 0; j < fsm->size; j++) {
+          if ((fsm->transitions[j].begin == fsm->current)
+              && (fsm->transitions[j].event_id == DDS_SECURITY_FSM_EVENT_AUTO)) {
+            dds_security_fsm_dispatch_direct(fsm, DDS_SECURITY_FSM_EVENT_AUTO);
+          }
+        }
+      }
+    }
+  }
+}
+
+static uint32_t
+fsm_thread(void *a) {
+  dds_security_fsm_context *context = a;
+  dds_duration_t dur_to_wait;
+  dds_time_t now = DDS_TIME_INVALID;
+  fsm_event *event;
+
+  while (!context->fsm_teardown) {
+    event = NULL;
+
+    ddsrt_mutex_lock(&context->fsm_event_cond_mutex);
+    if (!context->fsm_queue) {
+      if (context->fsm_next_state_timeout->endtime == DDS_NEVER) {
+        dur_to_wait = DDS_NEVER;
+      } else {
+        now = dds_time();
+        dur_to_wait = context->fsm_next_state_timeout->endtime - now;
+      }
+      if (dur_to_wait > 0) {
+        if (ddsrt_cond_waitfor(&context->fsm_event_cond,
+            &context->fsm_event_cond_mutex, dur_to_wait) == false) {
+          if (context->fsm_next_state_timeout->fsm) {
+            /* Next timeout could have changed. */
+            if (context->fsm_next_state_timeout->endtime != DDS_NEVER
+                && (context->fsm_next_state_timeout->endtime - now <= 0)) {
+              fsm_dispatch(context->fsm_next_state_timeout->fsm,
+                  DDS_SECURITY_FSM_EVENT_TIMEOUT, 1);
+            }
+          }
+        }
+      } else {
+        if (context->fsm_next_state_timeout->fsm) {
+          fsm_dispatch(context->fsm_next_state_timeout->fsm,
+              DDS_SECURITY_FSM_EVENT_TIMEOUT, 1);
+        }
+      }
+    } else {
+      event = context->fsm_queue;
+      context->fsm_queue = context->fsm_queue->next;
+      if (context->fsm_queue) {
+        context->fsm_queue->prev = NULL;
+      }
+      ddsrt_atomic_inc32(&(event->fsm->ref_cnt));
+    }
+    ddsrt_mutex_unlock(&context->fsm_event_cond_mutex);
+
+    if (event) {
+      fsm_state_change(event);
+      if (ddsrt_atomic_dec32_nv(&(event->fsm->ref_cnt)) == 0) {
+        ddsrt_free(event->fsm);
+      }
+      ddsrt_free(event);
+    }
+    fsm_set_next_state_timeout(context, NULL);
+  }
+  return 0;
+}
+
+static fsm_overall_timeout *
+fsm_get_first_overall_timeout(dds_security_fsm_context *context) {
+  fsm_overall_timeout *timeout;
+  fsm_overall_timeout *first_timeout;
+  dds_time_t first_time = DDS_NEVER;
+
+  timeout = context->fsm_overall_timeouts;
+  first_timeout = context->fsm_overall_timeouts;
+  while (timeout) {
+    if (timeout->endtime < first_time) {
+      first_time = timeout->endtime;
+      first_timeout = timeout;
+    }
+    timeout = timeout->next;
+  }
+
+  return first_timeout;
+}
+
+static void fsm_remove_overall_timeout_from_list(dds_security_fsm_context *context,
+    fsm_overall_timeout *timeout) {
+  fsm_overall_timeout *tmp_next_timeout;
+  fsm_overall_timeout *tmp_prev_timeout;
+
+  if (timeout) {
+
+    tmp_next_timeout = timeout->next;
+    tmp_prev_timeout = timeout->prev;
+    if (tmp_prev_timeout) {
+      tmp_prev_timeout->next = tmp_next_timeout;
+    }
+    if (tmp_next_timeout) {
+      tmp_next_timeout->prev = tmp_prev_timeout;
+    }
+
+    if (timeout == context->fsm_overall_timeouts) {
+      context->fsm_overall_timeouts = tmp_next_timeout;
+    }
+
+    ddsrt_free(timeout);
+    timeout = NULL;
+  }
+}
+
+static uint32_t
+fsm_run_timeout(void *arg) {
+  dds_security_fsm_context *context = arg;
+  dds_return_t result;
+  fsm_overall_timeout *to;
+  dds_time_t time_to_wait;
+  dds_time_t now;
+
+  while (!context->fsm_teardown) {
+    ddsrt_mutex_lock(&context->fsm_overall_timeout_cond_mutex);
+    to = fsm_get_first_overall_timeout(context);
+    if (to) {
+      struct dds_security_fsm *fsm = to->fsm;
+      ddsrt_atomic_inc32(&(fsm->ref_cnt));
+
+      result = DDS_RETCODE_TIMEOUT;
+      now = dds_time();
+      if (to->endtime > now) {
+        time_to_wait = to->endtime - now;
+        result = ddsrt_cond_waitfor(&context->fsm_overall_timeout_cond,
+            &context->fsm_overall_timeout_cond_mutex, time_to_wait);
+      }
+
+      if (result == DDS_RETCODE_TIMEOUT) {
+        /* Prevent calling timeout when the fsm has been cleaned. */
+        dds_security_fsm_action func = to->func;
+        fsm_remove_overall_timeout_from_list(context, to);
+        if (fsm->size > 0) {
+          ddsrt_mutex_unlock(&context->fsm_overall_timeout_cond_mutex);
+          func(fsm, fsm->arg);
+          ddsrt_mutex_lock(&context->fsm_overall_timeout_cond_mutex);
+        }
+      }
+
+      if (ddsrt_atomic_dec32_nv(&(fsm->ref_cnt)) == 0) {
+        ddsrt_free(fsm);
+      }
+    } else {
+      ddsrt_cond_wait(&context->fsm_overall_timeout_cond,
+          &context->fsm_overall_timeout_cond_mutex);
+    }
+    ddsrt_mutex_unlock(&context->fsm_overall_timeout_cond_mutex);
+  }
+  return 0;
+}
+
+static void fsm_remove_fsm_list(dds_security_fsm *fsm) {
+  dds_security_fsm_context *context;
+  dds_security_fsm *tmp_next_fsm;
+  dds_security_fsm *tmp_prev_fsm;
+
+  if (fsm) {
+    context = fsm->context;
+
+    ddsrt_mutex_lock(&context->fsm_fsms_mutex);
+    tmp_next_fsm = fsm->next;
+    tmp_prev_fsm = fsm->prev;
+    if (tmp_prev_fsm) {
+      tmp_prev_fsm->next = tmp_next_fsm;
+    }
+    if (tmp_next_fsm) {
+      tmp_next_fsm->prev = tmp_prev_fsm;
+    }
+    if (fsm == context->fsm_fsms) {
+      context->fsm_fsms = tmp_next_fsm;
+    }
+    ddsrt_mutex_unlock(&context->fsm_fsms_mutex);
+
+    ddsrt_mutex_lock(&context->fsm_overall_timeout_cond_mutex);
+    ddsrt_cond_signal(&context->fsm_overall_timeout_cond);
+    ddsrt_mutex_unlock(&context->fsm_overall_timeout_cond_mutex);
+  }
+}
+
+static ddsrt_thread_t fsm_thread_create( const char *name,
+    ddsrt_thread_routine_t f, void *arg) {
+  ddsrt_thread_t tid;
+  ddsrt_threadattr_t threadAttr;
+
+  ddsrt_threadattr_init(&threadAttr);
+  if (ddsrt_thread_create(&tid, name, &threadAttr, f, arg) != DDS_RETCODE_OK) {
+    memset(&tid, 0, sizeof(ddsrt_thread_t));
+  }
+  return tid;
+}
+#ifdef  AT_PROC_EXIT_IMPLEMENTED
+static void fsm_thread_destroy( ddsrt_thread_t tid) {
+  uint32_t thread_result;
+
+  (void) ddsrt_thread_join( tid, &thread_result);
+}
+#endif
+
+struct dds_security_fsm_context *
+dds_security_fsm_context_create( dds_security_fsm_thread_create_func thr_create_func) {
+  struct dds_security_fsm_context *context;
+
+  context = ddsrt_malloc(sizeof(*context));
+
+  context->fsm_next_state_timeout = ddsrt_malloc(sizeof(fsm_state_timeout));
+  context->fsm_next_state_timeout->endtime = DDS_NEVER;
+  context->fsm_next_state_timeout->fsm = NULL;
+
+  context->fsm_teardown = false;
+  context->fsm_queue = NULL;
+  context->fsm_overall_timeouts = NULL;
+  context->fsm_fsms = NULL;
+
+  (void) ddsrt_mutex_init( &context->fsm_fsms_mutex );
+
+  // Overall timeout guard
+  (void) ddsrt_mutex_init( &context->fsm_overall_timeout_cond_mutex );
+  (void) ddsrt_cond_init( &context->fsm_overall_timeout_cond );
+
+  // State timeouts
+  (void) ddsrt_mutex_init(&context->fsm_state_timeout_mutex );
+
+  // Events
+  (void) ddsrt_mutex_init(&context->fsm_event_cond_mutex );
+  (void) ddsrt_cond_init(&context->fsm_event_cond );
+
+  context->fsm_tid = thr_create_func( "dds_security_fsm", fsm_thread, context);
+  context->fsm_timeout_tid = thr_create_func( "dds_security_fsm_timeout",
+      fsm_run_timeout, context);
+
+  return context;
+}
+
+void dds_security_fsm_context_destroy(dds_security_fsm_context *context,
+    dds_security_fsm_thread_destroy_func thr_destroy_func) {
+  if (context) {
+    context->fsm_teardown = true;
+
+    ddsrt_mutex_lock( &context->fsm_overall_timeout_cond_mutex);
+    ddsrt_cond_signal( &context->fsm_overall_timeout_cond);
+    ddsrt_mutex_unlock( &context->fsm_overall_timeout_cond_mutex);
+
+    ddsrt_mutex_lock(&context->fsm_event_cond_mutex);
+    ddsrt_cond_signal(&context->fsm_event_cond);
+    ddsrt_mutex_unlock(&context->fsm_event_cond_mutex);
+
+    thr_destroy_func( context->fsm_tid);
+    ddsrt_mutex_destroy(&context->fsm_event_cond_mutex);
+    ddsrt_cond_destroy(&context->fsm_event_cond);
+
+    thr_destroy_func( context->fsm_timeout_tid);
+    ddsrt_mutex_destroy(&context->fsm_fsms_mutex);
+    ddsrt_mutex_destroy(&context->fsm_overall_timeout_cond_mutex);
+    ddsrt_cond_destroy(&context->fsm_overall_timeout_cond);
+
+    ddsrt_free(context->fsm_next_state_timeout);
+  }
+}
+#ifdef  AT_PROC_EXIT_IMPLEMENTED
+static void fsm_fini(void) {
+  dds_security_fsm_context_destroy(fsm_context, NULL, fsm_thread_destroy);
+
+  /* os_osExit(); ???? */
+}
+
+#endif
+static bool fsm_init_once(void) {
+  bool ret = true;
+  uint32_t initCount;
+
+  initCount = ddsrt_atomic_inc32_nv(&_fsmInitCount);
+
+  if (initCount == 1) {
+    assert( dds_security_fsm_initialized == false );
+
+    /* ddsrt_osInit(); ??? */
+
+    fsm_context = dds_security_fsm_context_create( fsm_thread_create);
+
+    if (fsm_context) {
+      /* os_procAtExit( fsm_fini ); ??? */
+      dds_security_fsm_initialized = true;
+    } else {
+      ret = false;
+    }
+  } else {
+    if (dds_security_fsm_initialized == false) {
+      /* Another thread is currently initializing the fsm. Since
+       * both results (osr_fsm and osr_timeout) should be ddsrt_resultSuccess
+       * a sleep is performed, to ensure that (if succeeded) successive
+       * init calls will also actually pass.
+       */
+      dds_sleepfor( DDS_MSECS( 100 ));
+    }
+    if (dds_security_fsm_initialized == false) {
+      /* Initialization did not succeed, undo increment and return error */
+      initCount = ddsrt_atomic_dec32_nv(&_fsmInitCount);
+      ret = false;
+    }
+  }
+  return ret;
+}
+
+static int /* 1 = ok, other = error */
+fsm_validate(const dds_security_fsm_transition *transitions, int size) {
+  int i;
+
+  for (i = 0; i < size; i++) {
+    /* It needs to have a start. */
+    if ((transitions[i].begin == NULL )
+        && (transitions[i].event_id == DDS_SECURITY_FSM_EVENT_AUTO)) {
+      return 1;
+    }
+  }
+
+  return 0;
+}
+
+struct dds_security_fsm *
+dds_security_fsm_create(struct dds_security_fsm_context *context,
+    const dds_security_fsm_transition *transitions, int size, void *arg) {
+  struct dds_security_fsm* fsm = NULL;
+  struct dds_security_fsm_context *ctx = NULL;
+
+  assert(transitions);
+  assert(size > 0);
+
+  if (context == NULL) {
+    if (fsm_init_once()) {
+      ctx = fsm_context;
+    }
+  } else {
+    ctx = context;
+  }
+
+  if (ctx) {
+    if (fsm_validate(transitions, size) == 1) {
+      fsm = ddsrt_malloc(sizeof(struct dds_security_fsm));
+      fsm->transitions = transitions;
+      fsm->size = size;
+      fsm->arg = arg;
+      fsm->current = NULL;
+      fsm->debug_func = NULL;
+      fsm->next = NULL;
+      fsm->prev = NULL;
+      fsm->context = ctx;
+      ddsrt_atomic_st32( &fsm->ref_cnt, 1 );
+      fsm->current_state_endtime = 0;
+
+      ddsrt_mutex_lock(&fsm->context->fsm_fsms_mutex);
+      if (fsm->context->fsm_fsms) {
+        dds_security_fsm *last = fsm->context->fsm_fsms;
+        while (last->next != NULL ) {
+          last = last->next;
+        }
+        last->next = fsm;
+        fsm->prev = last;
+      } else {
+        fsm->context->fsm_fsms = fsm;
+      }
+      ddsrt_mutex_unlock(&fsm->context->fsm_fsms_mutex);
+    }
+  }
+  return fsm;
+}
+
+void dds_security_fsm_start(struct dds_security_fsm *fsm) {
+  assert(fsm);
+  dds_security_fsm_dispatch(fsm, DDS_SECURITY_FSM_EVENT_AUTO);
+}
+
+void dds_security_fsm_set_timeout(struct dds_security_fsm *fsm, dds_security_fsm_action func,
+    dds_time_t timeout) {
+  fsm_overall_timeout *to;
+  dds_security_fsm_context *context;
+
+  assert(fsm);
+
+  context = fsm->context;
+  assert(context);
+
+  to = ddsrt_malloc(sizeof(fsm_overall_timeout));
+  to->fsm = fsm;
+  to->func = func;
+  to->endtime = ddsrt_time_add_duration( dds_time(), timeout);
+  to->next = NULL;
+  to->prev = NULL;
+
+  ddsrt_mutex_lock(&context->fsm_overall_timeout_cond_mutex);
+  if (context->fsm_overall_timeouts) {
+    fsm_overall_timeout *last = context->fsm_overall_timeouts;
+    while (last->next != NULL ) {
+      last = last->next;
+    }
+    last->next = to;
+    to->prev = last;
+  } else {
+    context->fsm_overall_timeouts = to;
+  }
+  ddsrt_cond_signal(&context->fsm_overall_timeout_cond);
+  ddsrt_mutex_unlock(&context->fsm_overall_timeout_cond_mutex);
+}
+
+void dds_security_fsm_set_debug(struct dds_security_fsm *fsm, dds_security_fsm_debug func) {
+  dds_security_fsm_context *context;
+
+  assert(fsm);
+
+  context = fsm->context;
+  assert(context);
+
+  ddsrt_mutex_lock(&context->fsm_overall_timeout_cond_mutex);
+  fsm->debug_func = func;
+  ddsrt_mutex_unlock(&context->fsm_overall_timeout_cond_mutex);
+}
+
+void dds_security_fsm_dispatch(struct dds_security_fsm *fsm, int32_t event_id) {
+  dds_security_fsm_context *context;
+
+  assert(fsm);
+
+  context = fsm->context;
+  assert(context);
+
+  ddsrt_mutex_lock(&context->fsm_event_cond_mutex);
+  fsm_dispatch(fsm, event_id, 0);
+  ddsrt_cond_signal(&context->fsm_event_cond);
+  ddsrt_mutex_unlock(&context->fsm_event_cond_mutex);
+}
+
+void dds_security_fsm_dispatch_direct(struct dds_security_fsm *fsm, int32_t event_id) {
+  dds_security_fsm_context *context;
+
+  assert(fsm);
+
+  context = fsm->context;
+  assert(context);
+
+  ddsrt_mutex_lock(&context->fsm_event_cond_mutex);
+  fsm_dispatch(fsm, event_id, 1);
+  ddsrt_cond_signal(&context->fsm_event_cond);
+  ddsrt_mutex_unlock(&context->fsm_event_cond_mutex);
+}
+
+const dds_security_fsm_state*
+dds_security_fsm_current_state(struct dds_security_fsm *fsm) {
+  assert(fsm);
+  return fsm->current;
+}
+
+void dds_security_fsm_cleanup(struct dds_security_fsm *fsm) {
+  dds_security_fsm_context *context;
+  fsm_event *event;
+  fsm_event *tmp_prev_event;
+  fsm_event *tmp_next_event;
+  fsm_overall_timeout *timeout;
+
+  assert(fsm);
+
+  context = fsm->context;
+  assert(context);
+
+  // Signal the timeout thread.
+  // First hold to lock to the overall timeout list
+  // so that the next timeout can't be determined until
+  // we've done removing the overall timeout of this fsm
+
+  // Signal the thread so that it's not using timeout structs
+  ddsrt_mutex_lock(&context->fsm_overall_timeout_cond_mutex);
+  ddsrt_cond_signal(&context->fsm_overall_timeout_cond);
+
+  timeout = context->fsm_overall_timeouts;
+
+  // Search the overall timeout of this fsm
+  while (timeout) {
+    if (timeout->fsm == fsm) {
+      break;
+    }
+    timeout = timeout->next;
+  }
+  fsm_remove_overall_timeout_from_list(context, timeout);
+  ddsrt_mutex_unlock(&context->fsm_overall_timeout_cond_mutex);
+
+  /* The current fsm could be the one that would trigger a possible timeout.
+   * Reset the state timeout and make sure it's not the current fsm. */
+  fsm_set_next_state_timeout(context, fsm);
+
+  /* Now, remove all possible events from the queue related to the fsm. */
+  ddsrt_mutex_lock(&context->fsm_event_cond_mutex);
+  event = context->fsm_queue;
+  while (event) {
+    if (event->fsm == fsm) {
+      tmp_next_event = event->next;
+      tmp_prev_event = event->prev;
+      if (tmp_prev_event) {
+        tmp_prev_event->next = tmp_next_event;
+      }
+      if (tmp_next_event) {
+        tmp_next_event->prev = tmp_prev_event;
+      }
+      if (event == context->fsm_queue) {
+        context->fsm_queue = tmp_next_event;
+      }
+      ddsrt_free(event);
+      event = tmp_next_event;
+    } else {
+      event = event->next;
+    }
+  }
+  ddsrt_cond_signal(&context->fsm_event_cond);
+  ddsrt_mutex_unlock(&context->fsm_event_cond_mutex);
+}
+
+void dds_security_fsm_free(struct dds_security_fsm *fsm) {
+  ddsrt_tid_t self = ddsrt_gettid_for_thread( ddsrt_thread_self() );
+  dds_security_fsm_context *context;
+
+  assert(fsm);
+
+  context = fsm->context;
+  assert(context);
+
+  /* Indicate termination. */
+  fsm->size = -1;
+
+  /* Cleanup stuff. */
+  dds_security_fsm_cleanup(fsm);
+  fsm_remove_fsm_list(fsm);
+
+  /* Is this being freed from the FSM context? */
+  if ((self ==  ddsrt_gettid_for_thread( context->fsm_tid ) )
+      || (self ==  ddsrt_gettid_for_thread( context->fsm_timeout_tid ) ) ) {
+    /* Yes.
+     * Just reduce the reference count and let the garbage collection be
+     * done by the FSM context after event handling. */
+    ddsrt_atomic_dec32(&(fsm->ref_cnt));
+  } else {
+    /* No.
+     * Block the outside thread until a possible concurrent event
+     * has being handled. */
+    while (ddsrt_atomic_ld32( &(fsm->ref_cnt)) > 1) {
+      /* Currently, an event is still being handled for this FSM. */
+      dds_sleepfor( 10 * DDS_NSECS_IN_MSEC );
+    }
+    /* We have the only reference, so it's safe to free the FSM. */
+    ddsrt_free(fsm);
+  }
+}
diff --git a/src/security/core/tests/CMakeLists.txt b/src/security/core/tests/CMakeLists.txt
new file mode 100644
index 0000000..e002ba4
--- /dev/null
+++ b/src/security/core/tests/CMakeLists.txt
@@ -0,0 +1,39 @@
+#
+# Copyright(c) 2006 to 2019 ADLINK Technology Limited and others
+#
+# This program and the accompanying materials are made available under the
+# terms of the Eclipse Public License v. 2.0 which is available at
+# http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+# v. 1.0 which is available at
+# http://www.eclipse.org/org/documents/edl-v10.php.
+#
+# SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+#
+include (GenerateExportHeader)
+include (CUnit)
+
+set(security_core_test_sources
+    "tc_fsm.c"
+  )
+
+add_definitions(-DDDSI_INCLUDE_SECURITY)
+add_cunit_executable(cunit_security_core ${security_core_test_sources})
+
+target_include_directories(
+  cunit_security_core PRIVATE
+  "$<BUILD_INTERFACE:${CMAKE_BINARY_DIR}/src/include/>"
+        "$<BUILD_INTERFACE:$<TARGET_PROPERTY:ddsrt,INTERFACE_INCLUDE_DIRECTORIES>>"
+        "$<BUILD_INTERFACE:$<TARGET_PROPERTY:ddsc,INTERFACE_INCLUDE_DIRECTORIES>>"
+        "$<BUILD_INTERFACE:$<TARGET_PROPERTY:security_core,INTERFACE_INCLUDE_DIRECTORIES>>"
+        "$<BUILD_INTERFACE:${CMAKE_CURRENT_LIST_DIR}>"
+        "$<BUILD_INTERFACE:${CMAKE_CURRENT_BINARY_DIR}>"
+        "$<BUILD_INTERFACE:${CMAKE_CURRENT_LIST_DIR}/../../../../core/ddsi/include>"
+ )
+
+
+target_link_libraries(cunit_security_core PRIVATE ddsc security_api)
+target_include_directories(cunit_security_core PRIVATE "${CMAKE_CURRENT_BINARY_DIR}")
+
+
+
+# configure_file("config_env.h.in" "config_env.h")
\ No newline at end of file
diff --git a/src/security/core/tests/tc_fsm.c b/src/security/core/tests/tc_fsm.c
new file mode 100644
index 0000000..442b921
--- /dev/null
+++ b/src/security/core/tests/tc_fsm.c
@@ -0,0 +1,766 @@
+#include "dds/security/core/dds_security_fsm.h"
+#include "dds/ddsrt/sync.h"
+#include "dds/ddsrt/misc.h"
+#include <stdio.h>
+#include <stdbool.h>
+#include "CUnit/CUnit.h"
+#include "CUnit/Test.h"
+
+#define CHECK_BIT(var, pos) ((var) & (1<<(pos)))
+
+#define FSM_AUTH_ARG 10
+
+#define DB_TC_PRINT_DEBUG  (false)
+
+static struct dds_security_fsm *fsm_auth;
+static struct dds_security_fsm *fsm_test;
+static struct dds_security_fsm *fsm_timeout;
+static struct dds_security_fsm *fsm_timeout2;
+static struct dds_security_fsm *fsm_timeout3;
+
+static uint32_t visited_auth = 0;
+static uint32_t visited_test = 0;
+static uint32_t visited_timeout = 0;
+
+uint32_t correct_fsm = 0;
+uint32_t correct_arg = 0;
+
+uint32_t correct_fsm_timeout = 0;
+uint32_t correct_arg_timeout = 0;
+
+static ddsrt_cond_t stop_timeout_cond;
+static ddsrt_mutex_t stop_timeout_cond_mutex;
+static uint32_t stop_timeout_cond_cnt = 0;
+static int validate_remote_identity_first = 1;
+static int begin_handshake_reply_first = 1;
+static int do_stuff_counter = 0;
+static int do_other_stuff_counter = 0;
+/*
+ * Authentication State Machine properties and methods
+ */
+typedef enum {
+    VALIDATION_PENDING_RETRY,
+    VALIDATION_FAILED,
+    VALIDATION_OK,
+    VALIDATION_OK_FINAL_MESSAGE,
+    VALIDATION_PENDING_HANDSHAKE_MESSAGE,
+    VALIDATION_PENDING_HANDSHAKE_REQUEST,
+    PluginReturn_MAX
+} PluginReturn;
+
+static PluginReturn validate_remote_identity(void) {
+
+  if (DB_TC_PRINT_DEBUG) {
+    printf("validate_remote_identity - %d\n", validate_remote_identity_first);
+  }
+  if (validate_remote_identity_first) {
+    validate_remote_identity_first = 0;
+    return VALIDATION_PENDING_RETRY;
+  }
+  return VALIDATION_PENDING_HANDSHAKE_MESSAGE;
+}
+
+static PluginReturn begin_handshake_reply(void) {
+
+  if (DB_TC_PRINT_DEBUG) {
+    printf("begin_handshake_reply - %d\n", begin_handshake_reply_first);
+  }
+  if (begin_handshake_reply_first) {
+    begin_handshake_reply_first = 0;
+    return VALIDATION_PENDING_RETRY;
+  }
+  return VALIDATION_OK_FINAL_MESSAGE;
+}
+
+static PluginReturn get_shared_secret(void) {
+  return VALIDATION_OK;
+}
+
+/* State actions. */
+static void fsm_validate_remote_identity(struct dds_security_fsm *fsm, void *arg) {
+  PluginReturn ret;
+
+  DDSRT_UNUSED_ARG(arg);
+
+  ret = validate_remote_identity();
+
+  if (DB_TC_PRINT_DEBUG) {
+    printf("[%p] State %s (ret %d)\n", fsm, __FUNCTION__, (int) ret);
+  }
+
+  dds_security_fsm_dispatch(fsm, (int32_t) ret);
+}
+
+static void fsm_begin_handshake_reply(struct dds_security_fsm *fsm, void *arg) {
+  PluginReturn ret;
+
+  DDSRT_UNUSED_ARG(arg);
+
+  ret = begin_handshake_reply();
+  if (ret == VALIDATION_OK_FINAL_MESSAGE) {
+    ret = get_shared_secret();
+  }
+
+  if (DB_TC_PRINT_DEBUG) {
+    printf("[%p] State %s (ret %d)\n", fsm, __FUNCTION__, (int) ret);
+  }
+
+  dds_security_fsm_dispatch(fsm, (int32_t) ret);
+}
+
+/* A few states from the handshake state-machine. */
+static dds_security_fsm_state StateValidateRemoteIdentity = {
+        fsm_validate_remote_identity, 0};
+static dds_security_fsm_state StateValRemIdentityRetryWait = {NULL, 100000000};
+static dds_security_fsm_state StateHandshakeInitMessageWait = {NULL, 0};
+static dds_security_fsm_state StateBeginHandshakeReply = {fsm_begin_handshake_reply, 0};
+static dds_security_fsm_state StateBeginHsReplyWait = {NULL, 100000000};
+
+static void a(struct dds_security_fsm *fsm, void *arg) {
+  int *fsm_arg;
+
+  if (DB_TC_PRINT_DEBUG) {
+    printf("[%p] Transition %s\n", fsm, __FUNCTION__);
+  }
+
+  if (arg != NULL) {
+    fsm_arg = (int *) arg;
+
+    if (*fsm_arg == FSM_AUTH_ARG) {
+      correct_arg = 1;
+    } else {
+      correct_arg = 0;
+    }
+  }
+
+  if (fsm == fsm_auth) {
+    correct_fsm = 1;
+  } else {
+    correct_fsm = 0;
+  }
+  visited_auth |= 1UL << 0;
+}
+
+static void b(struct dds_security_fsm *fsm, void *arg) {
+  DDSRT_UNUSED_ARG(fsm);
+  DDSRT_UNUSED_ARG(arg);
+  if (DB_TC_PRINT_DEBUG)
+    printf("[%p] Transition %s\n", fsm, __FUNCTION__);
+  visited_auth |= 1UL << 1;
+}
+
+static void c(struct dds_security_fsm *fsm, void *arg) {
+  DDSRT_UNUSED_ARG(fsm);
+  DDSRT_UNUSED_ARG(arg);
+  if (DB_TC_PRINT_DEBUG)
+    printf("[%p] Transition %s\n", fsm, __FUNCTION__);
+  visited_auth |= 1UL << 2;
+}
+
+static void d(struct dds_security_fsm *fsm, void *arg) {
+  DDSRT_UNUSED_ARG(fsm);
+  DDSRT_UNUSED_ARG(arg);
+  if (DB_TC_PRINT_DEBUG)
+    printf("[%p] Transition %s\n", fsm, __FUNCTION__);
+  visited_auth |= 1UL << 3;
+}
+
+static void e(struct dds_security_fsm *fsm, void *arg) {
+  DDSRT_UNUSED_ARG(fsm);
+  DDSRT_UNUSED_ARG(arg);
+  if (DB_TC_PRINT_DEBUG)
+    printf("[%p] Transition %s\n", fsm, __FUNCTION__);
+  visited_auth |= 1UL << 4;
+}
+
+static void f(struct dds_security_fsm *fsm, void *arg) {
+  DDSRT_UNUSED_ARG(fsm);
+  DDSRT_UNUSED_ARG(arg);
+  if (DB_TC_PRINT_DEBUG)
+    printf("[%p] Transition %s\n", fsm, __FUNCTION__);
+  visited_auth |= 1UL << 5;
+}
+
+static void g(struct dds_security_fsm *fsm, void *arg) {
+  DDSRT_UNUSED_ARG(fsm);
+  DDSRT_UNUSED_ARG(arg);
+  if (DB_TC_PRINT_DEBUG)
+    printf("[%p] Transition %s\n", fsm, __FUNCTION__);
+  visited_auth |= 1UL << 6;
+}
+
+static void h(struct dds_security_fsm *fsm, void *arg) {
+  DDSRT_UNUSED_ARG(fsm);
+  DDSRT_UNUSED_ARG(arg);
+  if (DB_TC_PRINT_DEBUG)
+    printf("[%p] Transition %s\n", fsm, __FUNCTION__);
+  visited_auth |= 1UL << 7;
+}
+
+#define SHM_MSG_RECEIVED (PluginReturn_MAX + 1)
+
+/*
+ * .--.
+ * |##|--------------------------------------.
+ * '--'       a()                            v
+ *                 .----------------------------------------------------.
+ *                 |            StateValidateRemoteIdentity             |
+ *                 |----------------------------------------------------|
+ *         .------>| fsm_validate_remote_identity()                     |
+ *         |       |    - dispatch VALIDATION_PENDING_RETRY             |
+ *    100ms|       |    - dispatch VALIDATION_PENDING_HANDSHAKE_MESSAGE |
+ *    d()  |       '----------------------------------------------------'
+ *         |          VALIDATION_PENDING_RETRY|  | VALIDATION_PENDING_HANDSHAKE_MESSAGE
+ *         |          b()                     |  | c()
+ *         |                                  |  |
+ * .------------------------------.           |  |       .-------------------------------.
+ * | StateValRemIdentityRetryWait |           |  |       | StateHandshakeInitMessageWait |
+ * |------------------------------|<----------'  '------>|-------------------------------|
+ * '------------------------------'                      '-------------------------------'
+ *                                                SHM_MSG_RECEIVED  |
+ *                                                e()               |
+ *                                                                  v
+ *                                      .----------------------------------------.
+ *          VALIDATION_PENDING_RETRY    |        StateBeginHandshakeReply        |
+ *          f()                         |----------------------------------------|
+ *            .-------------------------| fsm_begin_handshake_reply()            |
+ *            |                         |    - dispatch VALIDATION_PENDING_RETRY |
+ *            v                         |    - dispatch VALIDATION_OK            |
+ * .-----------------------.    100ms   '----------------------------------------'
+ * | StateBeginHsReplyWait |    h()                ^        VALIDATION_OK |
+ * |-----------------------|-----------------------'        g()           |
+ * '-----------------------'                                              v
+ *                                                                       .-.
+ *                                                                       '-'
+ */
+dds_security_fsm_transition HandshakeTransistions[] =
+        {{NULL,                           DDS_SECURITY_FSM_EVENT_AUTO,                  a, &StateValidateRemoteIdentity}, // NULL state is the start state
+         {&StateValidateRemoteIdentity, VALIDATION_PENDING_RETRY,             b,
+                                                                                 &StateValRemIdentityRetryWait},
+         {&StateValidateRemoteIdentity,
+                                        VALIDATION_PENDING_HANDSHAKE_MESSAGE, c,
+                                                                                 &StateHandshakeInitMessageWait},
+         {&StateValRemIdentityRetryWait,
+                                          DDS_SECURITY_FSM_EVENT_TIMEOUT,               d, &StateValidateRemoteIdentity},
+         {
+          &StateHandshakeInitMessageWait, SHM_MSG_RECEIVED,                   e,
+                                                                                 &StateBeginHandshakeReply},
+         {&StateBeginHandshakeReply,
+                                        VALIDATION_PENDING_RETRY,             f, &StateBeginHsReplyWait},
+         {
+          &StateBeginHandshakeReply,    VALIDATION_OK,                        g, NULL}, // Reaching NULL means end of state-diagram
+         {&StateBeginHsReplyWait,         DDS_SECURITY_FSM_EVENT_TIMEOUT,               h,
+                                                                                 &StateBeginHandshakeReply},};
+
+/*
+ * Example State Machine properties and methods
+ */
+typedef enum {
+    eventX, eventY, eventZ,
+} test_events;
+
+/* The functions called from the state-machine. */
+static void doStart(struct dds_security_fsm *fsm, void *arg) {
+  DDSRT_UNUSED_ARG(fsm);
+  DDSRT_UNUSED_ARG(arg);
+  if (DB_TC_PRINT_DEBUG)
+    printf("Transition %s\n", __FUNCTION__);
+  visited_test |= 1UL << 0;
+}
+
+static void doRestart(struct dds_security_fsm *fsm, void *arg) {
+  DDSRT_UNUSED_ARG(fsm);
+  DDSRT_UNUSED_ARG(arg);
+  if (DB_TC_PRINT_DEBUG)
+    printf("Transition %s\n", __FUNCTION__);
+  visited_test |= 1UL << 1;
+}
+
+static void doEventStuff(struct dds_security_fsm *fsm, void *arg) {
+  DDSRT_UNUSED_ARG(fsm);
+  DDSRT_UNUSED_ARG(arg);
+  if (DB_TC_PRINT_DEBUG)
+    printf("Transition %s\n", __FUNCTION__);
+  visited_test |= 1UL << 4;
+}
+
+static void doStuff(struct dds_security_fsm *fsm, void *arg) {
+
+  DDSRT_UNUSED_ARG(fsm);
+  DDSRT_UNUSED_ARG(arg);
+
+  if (DB_TC_PRINT_DEBUG) {
+    printf("Transition %s - %d\n", __FUNCTION__, do_stuff_counter);
+  }
+  visited_test |= 1UL << 2;
+
+  if (do_stuff_counter == 0) {
+    dds_security_fsm_dispatch(fsm, eventZ);
+  } else if (do_stuff_counter == 2) {
+    dds_security_fsm_dispatch(fsm, eventY);
+  }
+  ++do_stuff_counter;
+}
+
+static void doOtherStuff(struct dds_security_fsm *fsm, void *arg) {
+  DDSRT_UNUSED_ARG(fsm);
+  DDSRT_UNUSED_ARG(arg);
+
+  if (DB_TC_PRINT_DEBUG) {
+    printf("Transition %s - %d\n", __FUNCTION__, do_other_stuff_counter);
+  }
+  visited_test |= 1UL << 3;
+  if (do_other_stuff_counter == 0) {
+    dds_security_fsm_dispatch(fsm, DDS_SECURITY_FSM_EVENT_AUTO);
+  }
+  if (do_other_stuff_counter == 1) {
+    dds_security_fsm_dispatch(fsm, eventY);
+  } else if (do_other_stuff_counter == 2) {
+    dds_security_fsm_dispatch(fsm, eventX);
+  }
+  ++do_other_stuff_counter;
+}
+
+dds_security_fsm_state StateA = {doStuff, 0};
+dds_security_fsm_state StateB = {doStuff, 100000000};
+dds_security_fsm_state StateC = {NULL, 0};
+dds_security_fsm_state StateD = {doOtherStuff, 0};
+
+dds_security_fsm_transition transitions[] = {
+        {NULL,    DDS_SECURITY_FSM_EVENT_AUTO, doStart,      &StateA}, // NULL state is the start state
+        {&StateA, eventZ, NULL,                    &StateB},
+        {&StateA, eventY,            doOtherStuff, &StateC},
+        {&StateB, eventX, NULL,               NULL}, // Reaching NULL means end of state-diagram
+        {&StateB, eventZ,            doRestart,    &StateA},
+        {&StateC, DDS_SECURITY_FSM_EVENT_AUTO,
+                                     doEventStuff, &StateD},
+        {&StateD, eventY,            doEventStuff, &StateD},
+        {
+         &StateD, eventX,            doStuff, NULL}, // Reaching NULL means end of state-diagram
+};
+
+/*
+ * Timeout State Machine properties and methods
+ */
+typedef enum {
+    eventToTimeout, eventToEnd,
+} timeout_events;
+
+/* The functions callld from the state-machine. */
+static void doInterupt(struct dds_security_fsm *fsm, void *arg) {
+  DDSRT_UNUSED_ARG(fsm);
+  DDSRT_UNUSED_ARG(arg);
+  if (DB_TC_PRINT_DEBUG) {
+    printf("Transition %s\n", __FUNCTION__);
+  }
+  visited_timeout |= 1UL << 0;
+}
+
+static void doTimeout(struct dds_security_fsm *fsm, void *arg) {
+  dds_duration_t delay4 = 4 * DDS_NSECS_IN_SEC;
+
+  DDSRT_UNUSED_ARG(arg);
+
+  if (DB_TC_PRINT_DEBUG) {
+    printf("Transition >>>> %s %d\n", __FUNCTION__, stop_timeout_cond_cnt);
+  }
+  visited_timeout |= 1UL << 1;
+
+  stop_timeout_cond_cnt++;
+  ddsrt_mutex_lock(&stop_timeout_cond_mutex);
+  (void) ddsrt_cond_waitfor(&stop_timeout_cond, &stop_timeout_cond_mutex,
+                            delay4);
+  ddsrt_mutex_unlock(&stop_timeout_cond_mutex);
+  stop_timeout_cond_cnt--;
+
+  if (DB_TC_PRINT_DEBUG) {
+    printf("Transition <<<< %s %d\n", __FUNCTION__, stop_timeout_cond_cnt);
+  }
+
+  dds_security_fsm_dispatch(fsm, eventToTimeout);
+}
+
+static void TimeoutCallback(struct dds_security_fsm *fsm, void *arg) {
+  int *fsm_arg;
+
+  if (DB_TC_PRINT_DEBUG) {
+    printf("TimeoutCallback\n");
+  }
+
+  visited_timeout |= 1UL << 2;
+
+  if (arg != NULL) {
+    fsm_arg = (int *) arg;
+
+    if (*fsm_arg == FSM_AUTH_ARG) {
+      correct_arg_timeout = 1;
+    } else {
+      correct_arg_timeout = 0;
+    }
+  }
+  if (fsm == fsm_timeout) {
+    correct_fsm_timeout = 1;
+  } else {
+    correct_fsm_timeout = 0;
+  }
+}
+
+static void TimeoutCallback2(struct dds_security_fsm *fsm, void *arg) {
+  DDSRT_UNUSED_ARG(fsm);
+  DDSRT_UNUSED_ARG(arg);
+  if (DB_TC_PRINT_DEBUG) {
+    printf("TimeoutCallback2\n");
+  }
+  visited_timeout |= 1UL << 3;
+}
+
+dds_security_fsm_state StateTimeout = {doTimeout, 0};
+dds_security_fsm_state StateInterupt = {doInterupt, 0};
+
+dds_security_fsm_transition timeout_transitions[] = {{NULL, DDS_SECURITY_FSM_EVENT_AUTO,       NULL,
+                                                                                 &StateTimeout}, // NULL state is the start state
+                                           {&StateTimeout, eventToTimeout, NULL, &StateInterupt},
+                                           {&StateInterupt,
+                                                           eventToEnd,     NULL, NULL}, // Reaching NULL means end of state-diagram
+};
+
+static dds_time_t time0 = 0;
+static dds_time_t time1 = 0;
+static dds_time_t time2 = 0;
+static dds_time_t time3 = 0;
+
+static void StateParTime1(struct dds_security_fsm *fsm, void *arg) {
+  DDSRT_UNUSED_ARG(fsm);
+  DDSRT_UNUSED_ARG(arg);
+  time1 = dds_time();
+}
+
+static void StateParTime2(struct dds_security_fsm *fsm, void *arg) {
+  DDSRT_UNUSED_ARG(fsm);
+  DDSRT_UNUSED_ARG(arg);
+  time2 = dds_time();
+}
+
+static void StateParTime3(struct dds_security_fsm *fsm, void *arg) {
+  DDSRT_UNUSED_ARG(fsm);
+  DDSRT_UNUSED_ARG(arg);
+  time3 = dds_time();
+}
+
+dds_security_fsm_state StateParTimeout1 = {NULL, DDS_NSECS_IN_SEC};
+dds_security_fsm_state StateParTimeout2 = {NULL, 2 * DDS_NSECS_IN_SEC};
+dds_security_fsm_state StateParTimeout3 = {NULL, DDS_NSECS_IN_SEC};
+
+dds_security_fsm_transition par_timeout_transitions_1[] = {{NULL,              DDS_SECURITY_FSM_EVENT_AUTO,
+                                                         NULL, &StateParTimeout1}, // NULL state is the start state
+                                                 {&StateParTimeout1, DDS_SECURITY_FSM_EVENT_TIMEOUT, &StateParTime1, NULL}, // Reaching NULL means end of state-diagram
+};
+
+dds_security_fsm_transition par_timeout_transitions_2[] = {{NULL,              DDS_SECURITY_FSM_EVENT_AUTO,
+                                                         NULL, &StateParTimeout2}, // NULL state is the start state
+                                                 {&StateParTimeout2, DDS_SECURITY_FSM_EVENT_TIMEOUT, &StateParTime2, NULL}, // Reaching NULL means end of state-diagram
+};
+
+dds_security_fsm_transition par_timeout_transitions_3[] = {{NULL,              DDS_SECURITY_FSM_EVENT_AUTO,
+                                                         NULL, &StateParTimeout3}, // NULL state is the start state
+                                                 {&StateParTimeout3, DDS_SECURITY_FSM_EVENT_TIMEOUT, &StateParTime3, NULL}, // Reaching NULL means end of state-diagram
+};
+
+int fsm_arg = FSM_AUTH_ARG;
+dds_time_t delay1 = DDS_NSECS_IN_SEC;
+dds_time_t delay2 = 2 * DDS_NSECS_IN_SEC;
+dds_time_t delay30 = 30 * DDS_NSECS_IN_SEC;
+int timeout;
+static const dds_duration_t msec100 = 100 * DDS_NSECS_IN_MSEC;
+
+static void init_testcase(void) {
+  (void) ddsrt_mutex_init(&stop_timeout_cond_mutex);
+  (void) ddsrt_cond_init(&stop_timeout_cond);
+
+}
+
+static void fini_testcase(void) {
+  ddsrt_cond_destroy(&stop_timeout_cond);
+  ddsrt_mutex_destroy(&stop_timeout_cond_mutex);
+}
+
+CU_Test(ddssec_fsm, create, .init = init_testcase, .fini = fini_testcase) {
+
+  /*
+   * Test single running state machine
+   * Check creation of a single State Machine
+   */
+
+  fsm_auth = dds_security_fsm_create(NULL, HandshakeTransistions,
+                           sizeof(HandshakeTransistions) / sizeof(HandshakeTransistions[0]),
+                           &fsm_arg);
+  CU_ASSERT_FATAL(fsm_auth != NULL)
+
+  // set a delay that doesn't expire. Should be terminate when fsm is freed.
+  dds_security_fsm_set_timeout(fsm_auth, TimeoutCallback, delay30);
+  dds_security_fsm_start(fsm_auth);
+
+  /**
+   * Check the result of one running State Machine
+   */
+
+  // Wait for the last state to occur
+  timeout = 100; /* 10 sec */
+  while ((dds_security_fsm_current_state(fsm_auth) != &StateHandshakeInitMessageWait)
+         && (timeout > 0)) {
+    dds_sleepfor(msec100);
+    timeout--;
+  }
+  CU_ASSERT(timeout > 0);
+  dds_security_fsm_dispatch(fsm_auth, SHM_MSG_RECEIVED);
+
+  timeout = 100; /* 10 sec */
+  while ((dds_security_fsm_current_state(fsm_auth) != NULL) && (timeout > 0)) {
+    dds_sleepfor(msec100);
+    timeout--;
+  }
+
+  CU_ASSERT(timeout > 0);
+  CU_ASSERT(
+          CHECK_BIT(visited_auth, 0) && CHECK_BIT(visited_auth, 1) && CHECK_BIT(visited_auth, 2) &&
+          CHECK_BIT(visited_auth, 3) && CHECK_BIT(visited_auth, 4) && CHECK_BIT(visited_auth, 5) &&
+          CHECK_BIT(visited_auth, 6) && CHECK_BIT(visited_auth, 7));
+
+  /*
+   * "Check correct callback parameter passing (from fsm to user defined methods) ");
+   */
+  CU_ASSERT(correct_arg && correct_fsm);
+  dds_security_fsm_free(fsm_auth);
+
+  /* Check whether timeout callback has NOT been invoked */
+  CU_ASSERT(visited_timeout == 0);
+}
+
+/*
+ * Test multiple (2) running state machines
+ */
+CU_Test(ddssec_fsm, multiple, .init = init_testcase, .fini = fini_testcase) {
+
+  /*Check creation of multiple (2) State Machines*/
+  validate_remote_identity_first = 0;
+  begin_handshake_reply_first = 0;
+  visited_auth = 0;
+
+  fsm_auth = dds_security_fsm_create(NULL, HandshakeTransistions,
+                           sizeof(HandshakeTransistions) / sizeof(HandshakeTransistions[0]), NULL);
+  fsm_test = dds_security_fsm_create(NULL, transitions,
+                           sizeof(transitions) / sizeof(transitions[0]), NULL);
+  CU_ASSERT_FALSE(fsm_auth == NULL || fsm_test == NULL);
+  dds_security_fsm_start(fsm_auth);
+  dds_security_fsm_start(fsm_test);
+
+  /*Check the results of multiple running State Machines */
+
+  // Wait for the last state to occur
+  timeout = 100; /* 10 sec */
+  while ((dds_security_fsm_current_state(fsm_auth) != &StateHandshakeInitMessageWait)
+         && (timeout > 0)) {
+    dds_sleepfor(100 * DDS_NSECS_IN_MSEC);
+    timeout--;
+  }
+  CU_ASSERT_FATAL(timeout > 0);
+  timeout = 100; /* 10 sec */
+  dds_security_fsm_dispatch(fsm_auth, SHM_MSG_RECEIVED);
+  while ((dds_security_fsm_current_state(fsm_auth) != NULL) && (timeout > 0)) {
+    dds_sleepfor(100 * DDS_NSECS_IN_MSEC);
+    timeout--;
+  }
+  CU_ASSERT_FATAL(timeout > 0);
+  // not all bits are set since we're running the state machine a second time
+  CU_ASSERT_FATAL(
+          CHECK_BIT(visited_auth, 0) && !CHECK_BIT(visited_auth, 1) && CHECK_BIT(visited_auth, 2) &&
+          !CHECK_BIT(visited_auth, 3) && CHECK_BIT(visited_auth, 4) && !CHECK_BIT(visited_auth, 5) &&
+          CHECK_BIT(visited_auth, 6) && !CHECK_BIT(visited_auth, 7));
+
+  timeout = 100; /* 10 sec */
+  // Wait for the last state to occur
+  while ((dds_security_fsm_current_state(fsm_test) != NULL) && timeout > 0) {
+    dds_sleepfor(100 * DDS_NSECS_IN_MSEC);
+    timeout--;
+  }
+  CU_ASSERT_FATAL(timeout > 0);
+  CU_ASSERT_FATAL(
+          CHECK_BIT(visited_test, 0) && CHECK_BIT(visited_test, 1) && CHECK_BIT(visited_test, 2) &&
+          CHECK_BIT(visited_test, 3));
+  dds_security_fsm_free(fsm_auth);
+  dds_security_fsm_free(fsm_test);
+
+}
+
+/**
+ * Check creation of State Machine for timeout purposes
+ */
+CU_Test(ddssec_fsm, timeout, .init = init_testcase, .fini = fini_testcase) {
+
+  /*
+   * Test timeout monitoring of state machines
+   */
+  fsm_timeout = dds_security_fsm_create(NULL, timeout_transitions,
+                              sizeof(timeout_transitions) / sizeof(timeout_transitions[0]), &fsm_arg);
+  CU_ASSERT(fsm_timeout != NULL);
+
+  dds_security_fsm_set_timeout(fsm_timeout, TimeoutCallback, delay1);
+  dds_security_fsm_start(fsm_timeout);
+
+  /*Check the result of the running State Machine for timeout purposes*/
+
+  // Wait for the last state to occur
+  timeout = 100; /* 10 sec */
+  while ((dds_security_fsm_current_state(fsm_timeout) != &StateInterupt) && (timeout > 0)) {
+    dds_sleepfor(100 * DDS_NSECS_IN_MSEC);
+    timeout--;
+  }
+  CU_ASSERT(timeout > 0);
+  CU_ASSERT(
+          CHECK_BIT(visited_timeout, 0) && CHECK_BIT(visited_timeout, 1) && CHECK_BIT(visited_timeout, 2));
+  CU_ASSERT(correct_arg_timeout && correct_fsm_timeout);
+
+  dds_security_fsm_free(fsm_timeout);
+
+}
+
+/**
+ * Check the double global timeout
+ */
+CU_Test(ddssec_fsm, double_timeout, .init = init_testcase, .fini = fini_testcase) {
+
+  visited_timeout = 0;
+  fsm_timeout = dds_security_fsm_create(NULL, timeout_transitions,
+                              sizeof(timeout_transitions) / sizeof(timeout_transitions[0]), &fsm_arg);
+  CU_ASSERT(fsm_timeout != NULL);
+  fsm_timeout2 = dds_security_fsm_create(NULL, timeout_transitions,
+                               sizeof(timeout_transitions) / sizeof(timeout_transitions[0]), &fsm_arg);
+  CU_ASSERT(fsm_timeout2 != NULL);
+  dds_security_fsm_set_timeout(fsm_timeout, TimeoutCallback, delay1);
+  dds_security_fsm_set_timeout(fsm_timeout2, TimeoutCallback2, delay2);
+  dds_security_fsm_start(fsm_timeout);
+  dds_security_fsm_start(fsm_timeout2);
+  timeout = 100; /* 10 sec */
+  while ((CHECK_BIT(visited_timeout, 2) == 0) && (timeout > 0)) {
+    dds_sleepfor(100 * DDS_NSECS_IN_MSEC);
+    timeout--;
+  }
+  CU_ASSERT(CHECK_BIT(visited_timeout, 2));
+  dds_security_fsm_cleanup(fsm_timeout);
+  timeout = 100; /* 10 sec */
+  while ((CHECK_BIT(visited_timeout, 3) == 0) && (timeout > 0)) {
+    dds_sleepfor(100 * DDS_NSECS_IN_MSEC);
+    timeout--;
+  }
+  CU_ASSERT(CHECK_BIT(visited_timeout, 3));
+  dds_security_fsm_free(fsm_timeout);
+  dds_security_fsm_free(fsm_timeout2);
+  ddsrt_mutex_lock(&stop_timeout_cond_mutex);
+  ddsrt_cond_signal(&stop_timeout_cond);
+  ddsrt_mutex_unlock(&stop_timeout_cond_mutex);
+
+}
+
+/**
+ * Check parallel state timeouts
+ */
+CU_Test(ddssec_fsm, parallel_timeout, .init = init_testcase, .fini = fini_testcase) {
+  visited_timeout = 0;
+  fsm_timeout = dds_security_fsm_create(NULL, par_timeout_transitions_1,
+                              sizeof(par_timeout_transitions_1) / sizeof(par_timeout_transitions_1[0]),
+                              &fsm_arg);
+  CU_ASSERT(fsm_timeout != NULL);
+  fsm_timeout2 = dds_security_fsm_create(NULL, par_timeout_transitions_2,
+                               sizeof(par_timeout_transitions_2) / sizeof(par_timeout_transitions_2[0]),
+                               &fsm_arg);
+  CU_ASSERT(fsm_timeout2 != NULL);
+  fsm_timeout3 = dds_security_fsm_create(NULL, par_timeout_transitions_3,
+                               sizeof(par_timeout_transitions_3) / sizeof(par_timeout_transitions_3[0]),
+                               &fsm_arg);
+  CU_ASSERT(fsm_timeout3 != NULL);
+  dds_duration_t delta1;
+  dds_duration_t delta2;
+  dds_duration_t delta3;
+
+  time0 = dds_time();
+  dds_security_fsm_start(fsm_timeout);
+  dds_security_fsm_start(fsm_timeout2);
+  dds_security_fsm_start(fsm_timeout3);
+
+  /* Wait for both to end. */
+  timeout = 100; /* 10 sec */
+  /* First, they have to be started. */
+  while (((dds_security_fsm_current_state(fsm_timeout) == NULL)
+          || (dds_security_fsm_current_state(fsm_timeout2) == NULL)
+          || (dds_security_fsm_current_state(fsm_timeout3) == NULL)) && (timeout > 0)) {
+    dds_sleepfor(100 * DDS_NSECS_IN_MSEC);
+    timeout--;
+  }
+  /* Then, they have to have ended. */
+  while (((dds_security_fsm_current_state(fsm_timeout) != NULL)
+          || (dds_security_fsm_current_state(fsm_timeout2) != NULL)
+          || (dds_security_fsm_current_state(fsm_timeout3) != NULL)) && (timeout > 0)) {
+    dds_sleepfor(100 * DDS_NSECS_IN_MSEC);
+    timeout--;
+  }
+
+  /*
+   * There should be about 1 second difference between all times:
+   *      time1 = time0 + 1
+   *      time2 = time0 + 2
+   *      time3 = time0 + 1
+   */
+  delta1 = time1 - time0;
+  delta2 = time2 - time0;
+  delta3 = time3 - time0;
+  printf("Time0 %" PRId64 "\n", time0);
+  printf("Time1 %" PRId64 "\n", time1);
+  printf("Time2 %" PRId64 "\n", time2);
+  printf("Time3 %" PRId64 "\n", time3);
+  printf("Delta1 %" PRId64 "\n", delta1);
+  printf("Delta2 %" PRId64 "\n", delta2);
+  printf("Delta3 %" PRId64 "\n", delta3);
+  CU_ASSERT(delta1 > 750 * DDS_NSECS_IN_MSEC);
+  CU_ASSERT(delta1 < 1250 * DDS_NSECS_IN_MSEC);
+  CU_ASSERT(delta2 > 1750 * DDS_NSECS_IN_MSEC);
+  CU_ASSERT(delta2 < 2250 * DDS_NSECS_IN_MSEC);
+  CU_ASSERT(delta3 > 750 * DDS_NSECS_IN_MSEC);
+  CU_ASSERT(delta3 < 1250 * DDS_NSECS_IN_MSEC);
+
+  dds_security_fsm_free(fsm_timeout);
+  dds_security_fsm_free(fsm_timeout2);
+  dds_security_fsm_free(fsm_timeout3);
+
+}
+
+/**
+ * Delete with event timeout
+ */
+CU_Test(ddssec_fsm, delete_with_timeout, .init = init_testcase, .fini = fini_testcase) {
+
+  fsm_timeout = dds_security_fsm_create(NULL, timeout_transitions,
+                              sizeof(timeout_transitions) / sizeof(timeout_transitions[0]), &fsm_arg);
+  CU_ASSERT (fsm_timeout != NULL);
+  visited_timeout = 0;
+  dds_security_fsm_start(fsm_timeout);
+
+  /* Wait until we're in the timeout function. */
+  timeout = 100; /* 10 sec */
+  while ((visited_timeout == 0) && (timeout > 0)) {
+    dds_sleepfor(100 * DDS_NSECS_IN_MSEC);
+    timeout--;
+  }
+
+  dds_security_fsm_free(fsm_timeout);
+  dds_sleepfor(100 * DDS_NSECS_IN_MSEC);
+
+  /* Just for safety to be certain that the condition isn't used anymore before destroying it. */
+  while (stop_timeout_cond_cnt > 0) {
+    dds_time_t d = DDS_NSECS_IN_SEC;
+    ddsrt_cond_signal(&stop_timeout_cond);
+    dds_sleepfor(d);
+  }
+
+
+}
+

From a9b9a65e1b3fa271783b07ee114212c707184f58 Mon Sep 17 00:00:00 2001
From: Marcel Jordense <marcel.jordense@adlinktech.com>
Date: Tue, 14 Jan 2020 11:26:59 +0100
Subject: [PATCH 091/238] FSM combine event and timeout thread

Signed-off-by: Marcel Jordense <marcel.jordense@adlinktech.com>
---
 docs/manual/options.md                        |    2 +
 etc/cyclonedds.rnc                            |    3 +
 etc/cyclonedds.xsd                            |    3 +
 src/core/ddsi/src/q_config.c                  |    1 +
 src/core/ddsi/src/q_init.c                    |    4 +-
 src/security/core/CMakeLists.txt              |    1 +
 .../dds/security/core/dds_security_fsm.h      |  122 +-
 src/security/core/src/dds_security_fsm.c      | 1051 +++++++----------
 src/security/core/tests/CMakeLists.txt        |    7 +-
 src/security/core/tests/tc_fsm.c              |  456 ++++---
 10 files changed, 755 insertions(+), 895 deletions(-)

diff --git a/docs/manual/options.md b/docs/manual/options.md
index f875c77..85ae1eb 100644
--- a/docs/manual/options.md
+++ b/docs/manual/options.md
@@ -1994,6 +1994,8 @@ threads exist:
 
 * tev: general timed-event handling, retransmits and discovery;
 
+* fsm: finite state machine thread for handling security handshake;
+
 * xmit.CHAN: transmit thread for channel CHAN;
 
 * dq.CHAN: delivery thread for channel CHAN;
diff --git a/etc/cyclonedds.rnc b/etc/cyclonedds.rnc
index eac2679..9f03f62 100644
--- a/etc/cyclonedds.rnc
+++ b/etc/cyclonedds.rnc
@@ -1609,6 +1609,9 @@ for discovery;</li>
 <li><i>tev</i>: general timed-event handling, retransmits and
 discovery;</li>
 
+<li><i>fsm</i>: finite state machine thread for handling security
+handshake;</li>
+
 <li><i>xmit.CHAN</i>: transmit thread for channel CHAN;</li>
 
 <li><i>dq.CHAN</i>: delivery thread for channel CHAN;</li>
diff --git a/etc/cyclonedds.xsd b/etc/cyclonedds.xsd
index 8821495..d0d21dd 100644
--- a/etc/cyclonedds.xsd
+++ b/etc/cyclonedds.xsd
@@ -2133,6 +2133,9 @@ for discovery;&lt;/li&gt;
 &lt;li&gt;&lt;i&gt;tev&lt;/i&gt;: general timed-event handling, retransmits and
 discovery;&lt;/li&gt;
 
+&lt;li&gt;&lt;i&gt;fsm&lt;/i&gt;: finite state machine thread for handling security
+handshake;&lt;/li&gt;
+
 &lt;li&gt;&lt;i&gt;xmit.CHAN&lt;/i&gt;: transmit thread for channel CHAN;&lt;/li&gt;
 
 &lt;li&gt;&lt;i&gt;dq.CHAN&lt;/i&gt;: delivery thread for channel CHAN;&lt;/li&gt;
diff --git a/src/core/ddsi/src/q_config.c b/src/core/ddsi/src/q_config.c
index a419f93..53533b0 100644
--- a/src/core/ddsi/src/q_config.c
+++ b/src/core/ddsi/src/q_config.c
@@ -531,6 +531,7 @@ static const struct cfgelem thread_properties_cfgattrs[] = {
 <li><i>dq.builtins</i>: delivery thread for DDSI-builtin data, primarily for discovery;</li>\n\
 <li><i>lease</i>: DDSI liveliness monitoring;</li>\n\
 <li><i>tev</i>: general timed-event handling, retransmits and discovery;</li>\n\
+<li><i>fsm</i>: finite state machine thread for handling security handshake;</li>\n\
 <li><i>xmit.CHAN</i>: transmit thread for channel CHAN;</li>\n\
 <li><i>dq.CHAN</i>: delivery thread for channel CHAN;</li>\n\
 <li><i>tev.CHAN</i>: timed-even thread for channel CHAN.</li></ul>") },
diff --git a/src/core/ddsi/src/q_init.c b/src/core/ddsi/src/q_init.c
index 498e069..7765f59 100644
--- a/src/core/ddsi/src/q_init.c
+++ b/src/core/ddsi/src/q_init.c
@@ -397,10 +397,10 @@ static int known_channel_p (const struct q_globals *gv, const char *name)
 static int check_thread_properties (const struct q_globals *gv)
 {
 #ifdef DDSI_INCLUDE_NETWORK_CHANNELS
-  static const char *fixed[] = { "recv", "tev", "gc", "lease", "dq.builtins", "debmon", NULL };
+  static const char *fixed[] = { "recv", "tev", "gc", "lease", "dq.builtins", "debmon", "fsm", NULL };
   static const char *chanprefix[] = { "xmit.", "tev.","dq.",NULL };
 #else
-  static const char *fixed[] = { "recv", "tev", "gc", "lease", "dq.builtins", "xmit.user", "dq.user", "debmon", NULL };
+  static const char *fixed[] = { "recv", "tev", "gc", "lease", "dq.builtins", "xmit.user", "dq.user", "debmon", "fsm", NULL };
 #endif
   const struct config_thread_properties_listelem *e;
   int ok = 1, i;
diff --git a/src/security/core/CMakeLists.txt b/src/security/core/CMakeLists.txt
index b0701e9..836bc70 100644
--- a/src/security/core/CMakeLists.txt
+++ b/src/security/core/CMakeLists.txt
@@ -55,3 +55,4 @@ install(
   COMPONENT dev)
 
 add_subdirectory(tests)
+add_subdirectory(tests/plugin_loading)
diff --git a/src/security/core/include/dds/security/core/dds_security_fsm.h b/src/security/core/include/dds/security/core/dds_security_fsm.h
index db6374a..198c1c4 100644
--- a/src/security/core/include/dds/security/core/dds_security_fsm.h
+++ b/src/security/core/include/dds/security/core/dds_security_fsm.h
@@ -14,14 +14,18 @@
 #define DDS_SECURITY_FSM_H
 
 #include "dds/ddsrt/time.h"
-#include "dds/ddsrt/threads.h"
+#include "dds/ddsi/q_globals.h"
 
 #if defined (__cplusplus)
 extern "C" {
 #endif
 
-#define DDS_SECURITY_FSM_EVENT_AUTO    (-1)
-#define DDS_SECURITY_FSM_EVENT_TIMEOUT (-2)
+#define DDS_SECURITY_FSM_EVENT_AUTO            (-1)
+#define DDS_SECURITY_FSM_EVENT_TIMEOUT         (-2)
+#define DDS_SECURITY_FSM_EVENT_DELETE          (-3)
+
+struct dds_security_fsm;
+struct dds_security_fsm_control;
 
 typedef enum {
   DDS_SECURITY_FSM_DEBUG_ACT_DISPATCH,
@@ -29,13 +33,6 @@ typedef enum {
   DDS_SECURITY_FSM_DEBUG_ACT_HANDLING
 } DDS_SECURITY_FSM_DEBUG_ACT;
 
-struct dds_security_fsm;
-struct dds_security_fsm_context;
-
-typedef ddsrt_thread_t (*dds_security_fsm_thread_create_func)(const char *name, ddsrt_thread_routine_t f, void *arg);
-
-typedef void (*dds_security_fsm_thread_destroy_func)( ddsrt_thread_t tid);
-
 /**
  * Template for user-defined state methods.
  * It is allowed to call dds_security_fsm_dispatch() from within a dispatch function.
@@ -62,8 +59,7 @@ typedef struct dds_security_fsm_state {
  * It is not allowed to call any fsm API functions from within this
  * debug callback.
  */
-typedef void (*dds_security_fsm_debug)(struct dds_security_fsm *fsm, DDS_SECURITY_FSM_DEBUG_ACT act,
-    const dds_security_fsm_state *current, int event_id, void *arg);
+typedef void (*dds_security_fsm_debug)(struct dds_security_fsm *fsm, DDS_SECURITY_FSM_DEBUG_ACT act, const dds_security_fsm_state *current, int event_id, void *arg);
 
 /**
  * Transition definitions
@@ -80,34 +76,6 @@ typedef struct dds_security_fsm_transition {
   const dds_security_fsm_state *end;
 } dds_security_fsm_transition;
 
-/**
- * Create a new fsm context
- * Creates an fsm context. The fsm context manages the global state of the fsm's created within
- * this context. The fsm context uses a number of threads to control the state machined allocated
- * to this context. A thread create callback has to be provided to created the threads in the
- * context of the caller.
- *
- * @param thr_create_func  a callback function used to created the threads used to manage
- *                         the allocated state machines
- *
- * @return              Returns the new fsm context on success. Null on failure.
- */
-DDS_EXPORT struct dds_security_fsm_context *
-dds_security_fsm_context_create( dds_security_fsm_thread_create_func thr_create_func);
-
-/**
- * Destroys a fsm context
- * The function clears the fsm context and stops the associated threads. The thread destroy
- * function is called to allow the caller to free resources associated with the threads and
- * to wait for the threads to exit.
- *
- * @param context           the context to be destroyed
- * @param thr_destroy_func  a callback function used to wait a thread to terminate
- *                          the allocated state machine
- */
-DDS_EXPORT void
-dds_security_fsm_context_destroy(struct dds_security_fsm_context *context,
-    dds_security_fsm_thread_destroy_func thr_destroy_func);
 
 /**
  * Create a new fsm
@@ -121,8 +89,8 @@ dds_security_fsm_context_destroy(struct dds_security_fsm_context *context,
  * @return              Returns the new created state machine on success. Null on failure.
  */
 DDS_EXPORT struct dds_security_fsm *
-dds_security_fsm_create(struct dds_security_fsm_context *context,
-    const dds_security_fsm_transition *transitions, int size, void *arg);
+dds_security_fsm_create(struct dds_security_fsm_control *control, const dds_security_fsm_transition *transitions, uint32_t size, void *arg);
+
 
 /**
  * Start a fsm
@@ -164,20 +132,10 @@ dds_security_fsm_set_debug(struct dds_security_fsm *fsm, dds_security_fsm_debug
  *
  * @param fsm       The state machine
  * @param event_id  Indicate where to transisition to (outcome of current state)
+ * @param prio      Indicates if the event has to be scheduled with priority.
  */
 DDS_EXPORT void
-dds_security_fsm_dispatch(struct dds_security_fsm *fsm, int32_t event_id);
-
-/**
- * Dispatches the next event with priority
- * Assignment for the state machine to transisiton to the next state.
- * This event will be placed at the top of the event list.
- *
- * @param fsm       The state machine
- * @param event_id  Indicate where to transisition to (outcome of current state)
- */
-DDS_EXPORT void
-dds_security_fsm_dispatch_direct(struct dds_security_fsm *fsm, int32_t event_id);
+dds_security_fsm_dispatch(struct dds_security_fsm *fsm, int32_t event_id, bool prio);
 
 /**
  * Retrieve the current state of a given state machine
@@ -190,17 +148,7 @@ DDS_EXPORT const dds_security_fsm_state*
 dds_security_fsm_current_state(struct dds_security_fsm *fsm);
 
 /**
- * Clean the given state machine
- * Cleaning up the given state machine. This will abort all timeouts for
- * this state machine and remove all events from the internals.
- *
- * @param fsm   The state machine to clean.
- */
-DDS_EXPORT void
-dds_security_fsm_cleanup(struct dds_security_fsm *fsm);
-
-/**
- * Freeing the state machine.
+ * Free the state machine.
  * Stops all running timeouts and events and cleaning all memory
  * related to this machine.
  *
@@ -212,11 +160,51 @@ dds_security_fsm_cleanup(struct dds_security_fsm *fsm);
  * not block. It will garbage collect when the event has been
  * handled.
  *
- * @param fsm   The state machine to free
+ * @param fsm   The state machine to be removed
  */
-DDS_EXPORT void /* Implicit cleanup. */
+DDS_EXPORT void
 dds_security_fsm_free(struct dds_security_fsm *fsm);
 
+/**
+ * Create a new fsm control context,
+ * The fsm control context manages the global state of the fsm's created within
+ * this context. The fsm control a thread to control the state machined allocated
+ * to this control.
+ *
+ * @param gv  The global settings.
+ *
+ * @return Returns the new fsm control on success. Null on failure.
+ */
+DDS_EXPORT struct dds_security_fsm_control *
+dds_security_fsm_control_create (struct q_globals *gv);
+
+/**
+ * Frees the fsm control and the allocated fsm's.
+ * A precondition is that the fsm control is stopped.
+ *
+ * @param control The fsm control to be freed.
+ */
+DDS_EXPORT void
+dds_security_fsm_control_free(struct dds_security_fsm_control *control);
+
+/**
+ * Starts the thread that handles the events and timeouts associated
+ * with the fsm that are managed by this fsm control.
+ *
+ * @param control The fsm control to be started.
+ */
+DDS_EXPORT dds_return_t
+dds_security_fsm_control_start (struct dds_security_fsm_control *control, const char *name);
+
+/**
+ * Stops the thread that handles the events and timeouts.
+ *
+ * @param control The fsm control to be started.
+ */
+DDS_EXPORT void
+dds_security_fsm_control_stop(struct dds_security_fsm_control *control);
+
+
 #if defined (__cplusplus)
 }
 #endif
diff --git a/src/security/core/src/dds_security_fsm.c b/src/security/core/src/dds_security_fsm.c
index 220b017..4fa9d8e 100644
--- a/src/security/core/src/dds_security_fsm.c
+++ b/src/security/core/src/dds_security_fsm.c
@@ -9,91 +9,87 @@
  *
  * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
  */
-
 #include <string.h>
 #include <assert.h>
-#include "dds/security/core/dds_security_fsm.h"
-#include "dds/ddsrt/threads.h"
+#include <stdbool.h>
+
 #include "dds/ddsrt/sync.h"
 #include "dds/ddsrt/heap.h"
 #include "dds/ddsrt/atomics.h"
 #include "dds/ddsrt/retcode.h"
 #include "dds/ddsrt/time.h"
 #include "dds/ddsrt/timeconv.h"
-#include <stdbool.h>
+#include "dds/ddsrt/fibheap.h"
+#include "dds/ddsi/q_thread.h"
+#include "dds/security/core/dds_security_fsm.h"
 
-typedef struct dds_security_fsm {
-  const dds_security_fsm_transition *transitions;
-  int size;
-  void *arg;
-  const dds_security_fsm_state *current;
-  dds_time_t current_state_endtime;
-  ddsrt_atomic_uint32_t ref_cnt;
-  dds_security_fsm_debug debug_func;
-  struct dds_security_fsm_context *context;
 
-  struct dds_security_fsm *next;
-  struct dds_security_fsm *prev;
-} dds_security_fsm;
-
-typedef struct fsm_event {
+struct fsm_event
+{
   struct dds_security_fsm *fsm;
   int event_id;
   struct fsm_event *next;
   struct fsm_event *prev;
-} fsm_event;
+};
 
-typedef struct fsm_state_timeout {
+typedef enum fsm_timeout_kind {
+  FSM_TIMEOUT_STATE,
+  FSM_TIMEOUT_OVERALL
+} fsm_timeout_kind_t;
+
+struct fsm_timer_event
+{
+  ddsrt_fibheap_node_t heapnode;
   struct dds_security_fsm *fsm;
+  fsm_timeout_kind_t kind;
   dds_time_t endtime;
-} fsm_state_timeout;
+};
 
-typedef struct fsm_overall_timeout {
-  struct dds_security_fsm *fsm;
-  dds_time_t endtime;
-  dds_security_fsm_action func;
-  struct fsm_overall_timeout *next;
-  struct fsm_overall_timeout *prev;
-} fsm_overall_timeout;
+struct dds_security_fsm
+{
+  struct dds_security_fsm *next_fsm;
+  struct dds_security_fsm *prev_fsm;
+  bool active;
+  struct dds_security_fsm_control *control;
+  const dds_security_fsm_transition *transitions;
+  uint32_t size;
+  void *arg;
+  const dds_security_fsm_state *current;
+  struct fsm_timer_event state_timeout_event;
+  struct fsm_timer_event overall_timeout_event;
+  dds_security_fsm_action overall_timeout_action;
+  dds_security_fsm_debug debug_func;
+};
 
-typedef struct dds_security_fsm_context {
-  ddsrt_thread_t fsm_tid;
-  ddsrt_thread_t fsm_timeout_tid;
-  bool fsm_teardown;
-  fsm_event *fsm_queue;
-  fsm_overall_timeout *fsm_overall_timeouts;
-  ddsrt_mutex_t fsm_fsms_mutex;
-  dds_security_fsm *fsm_fsms;
-  fsm_state_timeout *fsm_next_state_timeout;
-  ddsrt_mutex_t fsm_state_timeout_mutex;
-  ddsrt_cond_t fsm_event_cond;
-  ddsrt_mutex_t fsm_event_cond_mutex;
+struct dds_security_fsm_control
+{
+  ddsrt_mutex_t lock;
+  ddsrt_cond_t cond;
+  struct thread_state1 *ts;
+  struct q_globals *gv;
+  struct dds_security_fsm *first_fsm;
+  struct dds_security_fsm *last_fsm;
+  struct fsm_event *event_queue;
+  ddsrt_fibheap_t timers;
+  bool running;
+};
 
-  // Overall timeout guard
-  ddsrt_cond_t fsm_overall_timeout_cond;
-  ddsrt_mutex_t fsm_overall_timeout_cond_mutex;
-} dds_security_fsm_context;
+static int compare_timer_event (const void *va, const void *vb);
+static void fsm_delete (struct dds_security_fsm_control *control, struct dds_security_fsm *fsm);
 
-static dds_security_fsm_context *fsm_context = NULL;
+const ddsrt_fibheap_def_t timer_events_fhdef = DDSRT_FIBHEAPDEF_INITIALIZER(offsetof (struct fsm_timer_event, heapnode), compare_timer_event);
 
-// Thread safe initialization of the Generic State Machine Utility
-bool dds_security_fsm_initialized = false;
-static ddsrt_atomic_uint32_t _fsmInitCount = DDSRT_ATOMIC_UINT32_INIT(0);
+static int compare_timer_event (const void *va, const void *vb)
+{
+  const struct fsm_timer_event *a = va;
+  const struct fsm_timer_event *b = vb;
+  return (a->endtime == b->endtime) ? 0 : (a->endtime < b->endtime) ? -1 : 1;
+}
 
-static void fsm_dispatch(struct dds_security_fsm *fsm, int event_id, int lifo) {
-  fsm_event *event;
-  dds_security_fsm_context *context;
-
-  assert(fsm);
-
-  if (fsm->size < 0) {
-    /* This fsm is cleaned up (but probably not freed yet).
-     * So, ignore the new event. */
-    return;
-  }
-
-  context = fsm->context;
-  assert(context);
+static void fsm_dispatch (struct dds_security_fsm *fsm, int event_id, bool lifo)
+{
+  struct dds_security_fsm_control *control = fsm->control;
+  struct fsm_event *event;
 
   if (fsm->debug_func) {
     fsm->debug_func(fsm,
@@ -101,7 +97,7 @@ static void fsm_dispatch(struct dds_security_fsm *fsm, int event_id, int lifo) {
         fsm->current, event_id, fsm->arg);
   }
 
-  event = ddsrt_malloc(sizeof(fsm_event));
+  event = ddsrt_malloc (sizeof(struct fsm_event));
   event->fsm = fsm;
   event->event_id = event_id;
   event->next = NULL;
@@ -109,641 +105,422 @@ static void fsm_dispatch(struct dds_security_fsm *fsm, int event_id, int lifo) {
 
   if (lifo) {
     /* Insert event at the top of the event list */
-    if (context->fsm_queue) {
-      context->fsm_queue->prev = event;
+    if (control->event_queue) {
+       control->event_queue->prev = event;
     }
-    event->next = context->fsm_queue;
-    context->fsm_queue = event;
+    event->next = control->event_queue;
+    control->event_queue = event;
   } else {
     /* Insert FIFO event */
-    if (context->fsm_queue) {
-      fsm_event *last = context->fsm_queue;
+    if (control->event_queue) {
+      struct fsm_event *last = control->event_queue;
       while (last->next != NULL ) {
         last = last->next;
       }
       last->next = event;
       event->prev = last;
     } else {
-      context->fsm_queue = event;
+      control->event_queue = event;
     }
   }
 }
 
-static void fsm_set_next_state_timeout(dds_security_fsm_context *context,
-    dds_security_fsm *ignore) {
-  dds_security_fsm *fsm;
+static void set_state_timer (struct dds_security_fsm *fsm)
+{
+  struct dds_security_fsm_control *control = fsm->control;
 
-  ddsrt_mutex_lock(&context->fsm_event_cond_mutex);
-
-  // reset the current time
-  context->fsm_next_state_timeout->endtime = DDS_NEVER;
-  context->fsm_next_state_timeout->fsm = NULL;
-
-  fsm = context->fsm_fsms;
-  while (fsm) {
-    if ((fsm->current) && (fsm->current->timeout) && (fsm != ignore)) {
-      // first set the endtime of this state (if not set)
-      if (fsm->current_state_endtime == 0) {
-        fsm->current_state_endtime = ddsrt_time_add_duration(dds_time(),
-            fsm->current->timeout);
-      }
-      // Initialize the current endtime
-      if (context->fsm_next_state_timeout->fsm == NULL) {
-        context->fsm_next_state_timeout->endtime = fsm->current_state_endtime;
-        context->fsm_next_state_timeout->fsm = fsm;
-      } else if (fsm->current_state_endtime
-          < context->fsm_next_state_timeout->endtime) {
-        context->fsm_next_state_timeout->endtime = fsm->current_state_endtime;
-        context->fsm_next_state_timeout->fsm = fsm;
-      }
-    }
-    fsm = fsm->next;
+  if (fsm->current && fsm->current->timeout > 0 && fsm->current->timeout != DDS_NEVER)
+  {
+    fsm->state_timeout_event.endtime = ddsrt_time_add_duration (dds_time(), fsm->current->timeout);
+    ddsrt_fibheap_insert (&timer_events_fhdef, &control->timers, &fsm->state_timeout_event);
   }
-
-  ddsrt_mutex_unlock(&context->fsm_event_cond_mutex);
+  else
+    fsm->state_timeout_event.endtime = DDS_NEVER;
 }
 
-static void fsm_state_change(fsm_event *event) {
-  dds_security_fsm *fsm = event->fsm;
-  dds_security_fsm_context *context = fsm->context;
+static void clear_state_timer (struct dds_security_fsm *fsm)
+{
+  struct dds_security_fsm_control *control = fsm->control;
+
+  if (fsm->current && fsm->state_timeout_event.endtime != DDS_NEVER)
+    ddsrt_fibheap_delete (&timer_events_fhdef, &control->timers, &fsm->state_timeout_event);
+}
+
+static void clear_overall_timer (struct dds_security_fsm *fsm)
+{
+  struct dds_security_fsm_control *control = fsm->control;
+
+  if (fsm->current && fsm->overall_timeout_event.endtime != DDS_NEVER)
+    ddsrt_fibheap_delete (&timer_events_fhdef, &control->timers, &fsm->overall_timeout_event);
+}
+
+static dds_time_t first_timeout (struct dds_security_fsm_control *control)
+{
+  struct fsm_timer_event *min;
+  if ((min = ddsrt_fibheap_min (&timer_events_fhdef, &control->timers)) != NULL)
+    return min->endtime;
+  return DDS_NEVER;
+}
+
+static void fsm_check_auto_state_change (struct dds_security_fsm *fsm)
+{
+  if (fsm->current)
+  {
+    uint32_t i;
+
+    for (i = 0; i < fsm->size; i++)
+    {
+      if (fsm->transitions[i].begin == fsm->current && fsm->transitions[i].event_id == DDS_SECURITY_FSM_EVENT_AUTO)
+      {
+        fsm_dispatch (fsm, DDS_SECURITY_FSM_EVENT_AUTO, true);
+        break;
+      }
+    }
+  }
+}
+
+static void fsm_state_change (struct dds_security_fsm_control *control, struct fsm_event *event)
+{
+  struct dds_security_fsm *fsm = event->fsm;
   int event_id = event->event_id;
-  int i, j;
+  uint32_t i;
 
-  if (fsm->debug_func) {
-    fsm->debug_func(fsm, DDS_SECURITY_FSM_DEBUG_ACT_HANDLING, fsm->current, event_id,
-        fsm->arg);
-  }
+  if (fsm->active)
+  {
+    if (fsm->debug_func)
+      fsm->debug_func (fsm, DDS_SECURITY_FSM_DEBUG_ACT_HANDLING, fsm->current, event_id, fsm->arg);
 
-  for (i = 0; !context->fsm_teardown && i < fsm->size; i++) {
-    if ((fsm->transitions[i].begin == fsm->current)
-        && (fsm->transitions[i].event_id == event_id)) {
-      /* Transition. */
-      if (fsm->transitions[i].func) {
-        fsm->transitions[i].func(fsm, fsm->arg);
-      }
-      /* New state. */
-      fsm->current = fsm->transitions[i].end;
-      if (fsm->current) {
-        if (fsm->current->func) {
-          fsm->current->func(fsm, fsm->arg);
-        }
-        /* Reset timeout. */
-        fsm->current_state_endtime = ddsrt_time_add_duration(dds_time(),
-            fsm->current->timeout);
-        /* Check if an auto transition is to be dispatched */
-        for (j = 0; j < fsm->size; j++) {
-          if ((fsm->transitions[j].begin == fsm->current)
-              && (fsm->transitions[j].event_id == DDS_SECURITY_FSM_EVENT_AUTO)) {
-            dds_security_fsm_dispatch_direct(fsm, DDS_SECURITY_FSM_EVENT_AUTO);
-          }
-        }
+    for (i = 0; i < fsm->size; i++)
+    {
+      if ((fsm->transitions[i].begin == fsm->current) && (fsm->transitions[i].event_id == event_id))
+      {
+        clear_state_timer (fsm);
+        fsm->current = fsm->transitions[i].end;
+        set_state_timer (fsm);
+
+        ddsrt_mutex_unlock (&control->lock);
+        if (fsm->transitions[i].func)
+          fsm->transitions[i].func (fsm, fsm->arg);
+        if (fsm->current && fsm->current->func)
+          fsm->current->func (fsm, fsm->arg);
+        ddsrt_mutex_lock (&control->lock);
+        fsm_check_auto_state_change (fsm);
+        break;
       }
     }
   }
+  else if (event_id == DDS_SECURITY_FSM_EVENT_DELETE)
+    fsm_delete (control, fsm);
+
 }
 
-static uint32_t
-fsm_thread(void *a) {
-  dds_security_fsm_context *context = a;
-  dds_duration_t dur_to_wait;
-  dds_time_t now = DDS_TIME_INVALID;
-  fsm_event *event;
+static void fsm_handle_timeout (struct dds_security_fsm_control *control, struct fsm_timer_event *timer_event)
+{
+  struct dds_security_fsm *fsm = timer_event->fsm;
 
-  while (!context->fsm_teardown) {
-    event = NULL;
-
-    ddsrt_mutex_lock(&context->fsm_event_cond_mutex);
-    if (!context->fsm_queue) {
-      if (context->fsm_next_state_timeout->endtime == DDS_NEVER) {
-        dur_to_wait = DDS_NEVER;
-      } else {
-        now = dds_time();
-        dur_to_wait = context->fsm_next_state_timeout->endtime - now;
-      }
-      if (dur_to_wait > 0) {
-        if (ddsrt_cond_waitfor(&context->fsm_event_cond,
-            &context->fsm_event_cond_mutex, dur_to_wait) == false) {
-          if (context->fsm_next_state_timeout->fsm) {
-            /* Next timeout could have changed. */
-            if (context->fsm_next_state_timeout->endtime != DDS_NEVER
-                && (context->fsm_next_state_timeout->endtime - now <= 0)) {
-              fsm_dispatch(context->fsm_next_state_timeout->fsm,
-                  DDS_SECURITY_FSM_EVENT_TIMEOUT, 1);
-            }
-          }
-        }
-      } else {
-        if (context->fsm_next_state_timeout->fsm) {
-          fsm_dispatch(context->fsm_next_state_timeout->fsm,
-              DDS_SECURITY_FSM_EVENT_TIMEOUT, 1);
-        }
-      }
-    } else {
-      event = context->fsm_queue;
-      context->fsm_queue = context->fsm_queue->next;
-      if (context->fsm_queue) {
-        context->fsm_queue->prev = NULL;
-      }
-      ddsrt_atomic_inc32(&(event->fsm->ref_cnt));
+  if (fsm->active)
+  {
+    switch (timer_event->kind)
+    {
+    case FSM_TIMEOUT_STATE:
+      fsm_dispatch (fsm, DDS_SECURITY_FSM_EVENT_TIMEOUT, true);
+      break;
+    case FSM_TIMEOUT_OVERALL:
+      ddsrt_mutex_unlock (&control->lock);
+      if (fsm->overall_timeout_action)
+        fsm->overall_timeout_action (fsm, fsm->arg);
+      ddsrt_mutex_lock (&control->lock);
+      break;
     }
-    ddsrt_mutex_unlock(&context->fsm_event_cond_mutex);
-
-    if (event) {
-      fsm_state_change(event);
-      if (ddsrt_atomic_dec32_nv(&(event->fsm->ref_cnt)) == 0) {
-        ddsrt_free(event->fsm);
-      }
-      ddsrt_free(event);
-    }
-    fsm_set_next_state_timeout(context, NULL);
   }
+
+  /* mark timer event as being processed */
+  timer_event->endtime = DDS_NEVER;
+}
+
+static uint32_t handle_events (struct dds_security_fsm_control *control)
+{
+  struct thread_state1 * const ts1 = lookup_thread_state ();
+
+  ddsrt_mutex_lock (&control->lock);
+  thread_state_awake (ts1, control->gv);
+  while (control->running)
+  {
+    if (control->event_queue)
+    {
+      struct fsm_event *event = control->event_queue;
+
+      control->event_queue = event->next;
+      if (control->event_queue)
+        control->event_queue->prev = NULL;
+      fsm_state_change (control, event);
+      ddsrt_free (event);
+    }
+    else
+    {
+      dds_time_t timeout = first_timeout (control);
+
+      if (timeout > dds_time ())
+      {
+        thread_state_asleep (ts1);
+        (void)ddsrt_cond_waituntil( &control->cond, &control->lock, timeout);
+        thread_state_awake (ts1, control->gv);
+      }
+      else
+      {
+        struct fsm_timer_event *timer_event = ddsrt_fibheap_extract_min (&timer_events_fhdef, &control->timers);
+        fsm_handle_timeout (control, timer_event);
+      }
+    }
+  }
+  thread_state_asleep (ts1);
+  ddsrt_mutex_unlock (&control->lock);
+
   return 0;
 }
 
-static fsm_overall_timeout *
-fsm_get_first_overall_timeout(dds_security_fsm_context *context) {
-  fsm_overall_timeout *timeout;
-  fsm_overall_timeout *first_timeout;
-  dds_time_t first_time = DDS_NEVER;
+void dds_security_fsm_set_timeout (struct dds_security_fsm *fsm, dds_security_fsm_action action, dds_duration_t timeout)
+{
+  assert(fsm);
+  assert(fsm->control);
+  assert(timeout > 0);
 
-  timeout = context->fsm_overall_timeouts;
-  first_timeout = context->fsm_overall_timeouts;
-  while (timeout) {
-    if (timeout->endtime < first_time) {
-      first_time = timeout->endtime;
-      first_timeout = timeout;
+  ddsrt_mutex_lock (&fsm->control->lock);
+  if (fsm->active)
+  {
+    if (timeout != DDS_NEVER)
+    {
+      clear_overall_timer(fsm);
+      fsm->overall_timeout_action = action;
+      fsm->overall_timeout_event.endtime = ddsrt_time_add_duration(dds_time(), timeout);
+      ddsrt_fibheap_insert (&timer_events_fhdef, &fsm->control->timers, &fsm->overall_timeout_event);
+      if (fsm->overall_timeout_event.endtime < first_timeout(fsm->control))
+        ddsrt_cond_signal (&fsm->control->cond);
     }
-    timeout = timeout->next;
+    else
+      clear_overall_timer (fsm);
   }
-
-  return first_timeout;
+  ddsrt_mutex_unlock (&fsm->control->lock);
 }
 
-static void fsm_remove_overall_timeout_from_list(dds_security_fsm_context *context,
-    fsm_overall_timeout *timeout) {
-  fsm_overall_timeout *tmp_next_timeout;
-  fsm_overall_timeout *tmp_prev_timeout;
+void dds_security_fsm_dispatch (struct dds_security_fsm *fsm, int32_t event_id, bool prio)
+{
+  assert(fsm);
+  assert(fsm->control);
 
-  if (timeout) {
-
-    tmp_next_timeout = timeout->next;
-    tmp_prev_timeout = timeout->prev;
-    if (tmp_prev_timeout) {
-      tmp_prev_timeout->next = tmp_next_timeout;
-    }
-    if (tmp_next_timeout) {
-      tmp_next_timeout->prev = tmp_prev_timeout;
-    }
-
-    if (timeout == context->fsm_overall_timeouts) {
-      context->fsm_overall_timeouts = tmp_next_timeout;
-    }
-
-    ddsrt_free(timeout);
-    timeout = NULL;
+  ddsrt_mutex_lock (&fsm->control->lock);
+  if (fsm->active)
+  {
+    fsm_dispatch (fsm, event_id, prio);
+    ddsrt_cond_signal (&fsm->control->cond);
   }
+  ddsrt_mutex_unlock (&fsm->control->lock);
 }
 
-static uint32_t
-fsm_run_timeout(void *arg) {
-  dds_security_fsm_context *context = arg;
-  dds_return_t result;
-  fsm_overall_timeout *to;
-  dds_time_t time_to_wait;
-  dds_time_t now;
+const dds_security_fsm_state * dds_security_fsm_current_state (struct dds_security_fsm *fsm)
+{
+  const dds_security_fsm_state *state;
 
-  while (!context->fsm_teardown) {
-    ddsrt_mutex_lock(&context->fsm_overall_timeout_cond_mutex);
-    to = fsm_get_first_overall_timeout(context);
-    if (to) {
-      struct dds_security_fsm *fsm = to->fsm;
-      ddsrt_atomic_inc32(&(fsm->ref_cnt));
+  assert(fsm);
+  assert(fsm->active);
 
-      result = DDS_RETCODE_TIMEOUT;
-      now = dds_time();
-      if (to->endtime > now) {
-        time_to_wait = to->endtime - now;
-        result = ddsrt_cond_waitfor(&context->fsm_overall_timeout_cond,
-            &context->fsm_overall_timeout_cond_mutex, time_to_wait);
-      }
+  ddsrt_mutex_lock (&fsm->control->lock);
+  state = fsm->current;
+  ddsrt_mutex_unlock (&fsm->control->lock);
 
-      if (result == DDS_RETCODE_TIMEOUT) {
-        /* Prevent calling timeout when the fsm has been cleaned. */
-        dds_security_fsm_action func = to->func;
-        fsm_remove_overall_timeout_from_list(context, to);
-        if (fsm->size > 0) {
-          ddsrt_mutex_unlock(&context->fsm_overall_timeout_cond_mutex);
-          func(fsm, fsm->arg);
-          ddsrt_mutex_lock(&context->fsm_overall_timeout_cond_mutex);
-        }
-      }
-
-      if (ddsrt_atomic_dec32_nv(&(fsm->ref_cnt)) == 0) {
-        ddsrt_free(fsm);
-      }
-    } else {
-      ddsrt_cond_wait(&context->fsm_overall_timeout_cond,
-          &context->fsm_overall_timeout_cond_mutex);
-    }
-    ddsrt_mutex_unlock(&context->fsm_overall_timeout_cond_mutex);
-  }
-  return 0;
+  return state;
 }
 
-static void fsm_remove_fsm_list(dds_security_fsm *fsm) {
-  dds_security_fsm_context *context;
-  dds_security_fsm *tmp_next_fsm;
-  dds_security_fsm *tmp_prev_fsm;
+void dds_security_fsm_set_debug (struct dds_security_fsm *fsm, dds_security_fsm_debug func)
+{
+  assert(fsm);
 
-  if (fsm) {
-    context = fsm->context;
-
-    ddsrt_mutex_lock(&context->fsm_fsms_mutex);
-    tmp_next_fsm = fsm->next;
-    tmp_prev_fsm = fsm->prev;
-    if (tmp_prev_fsm) {
-      tmp_prev_fsm->next = tmp_next_fsm;
-    }
-    if (tmp_next_fsm) {
-      tmp_next_fsm->prev = tmp_prev_fsm;
-    }
-    if (fsm == context->fsm_fsms) {
-      context->fsm_fsms = tmp_next_fsm;
-    }
-    ddsrt_mutex_unlock(&context->fsm_fsms_mutex);
-
-    ddsrt_mutex_lock(&context->fsm_overall_timeout_cond_mutex);
-    ddsrt_cond_signal(&context->fsm_overall_timeout_cond);
-    ddsrt_mutex_unlock(&context->fsm_overall_timeout_cond_mutex);
-  }
+  ddsrt_mutex_lock (&fsm->control->lock);
+  fsm->debug_func = func;
+  ddsrt_mutex_unlock (&fsm->control->lock);
 }
 
-static ddsrt_thread_t fsm_thread_create( const char *name,
-    ddsrt_thread_routine_t f, void *arg) {
-  ddsrt_thread_t tid;
-  ddsrt_threadattr_t threadAttr;
+static bool fsm_validate (const dds_security_fsm_transition *transitions, uint32_t size)
+{
+  uint32_t i;
 
-  ddsrt_threadattr_init(&threadAttr);
-  if (ddsrt_thread_create(&tid, name, &threadAttr, f, arg) != DDS_RETCODE_OK) {
-    memset(&tid, 0, sizeof(ddsrt_thread_t));
-  }
-  return tid;
-}
-#ifdef  AT_PROC_EXIT_IMPLEMENTED
-static void fsm_thread_destroy( ddsrt_thread_t tid) {
-  uint32_t thread_result;
-
-  (void) ddsrt_thread_join( tid, &thread_result);
-}
-#endif
-
-struct dds_security_fsm_context *
-dds_security_fsm_context_create( dds_security_fsm_thread_create_func thr_create_func) {
-  struct dds_security_fsm_context *context;
-
-  context = ddsrt_malloc(sizeof(*context));
-
-  context->fsm_next_state_timeout = ddsrt_malloc(sizeof(fsm_state_timeout));
-  context->fsm_next_state_timeout->endtime = DDS_NEVER;
-  context->fsm_next_state_timeout->fsm = NULL;
-
-  context->fsm_teardown = false;
-  context->fsm_queue = NULL;
-  context->fsm_overall_timeouts = NULL;
-  context->fsm_fsms = NULL;
-
-  (void) ddsrt_mutex_init( &context->fsm_fsms_mutex );
-
-  // Overall timeout guard
-  (void) ddsrt_mutex_init( &context->fsm_overall_timeout_cond_mutex );
-  (void) ddsrt_cond_init( &context->fsm_overall_timeout_cond );
-
-  // State timeouts
-  (void) ddsrt_mutex_init(&context->fsm_state_timeout_mutex );
-
-  // Events
-  (void) ddsrt_mutex_init(&context->fsm_event_cond_mutex );
-  (void) ddsrt_cond_init(&context->fsm_event_cond );
-
-  context->fsm_tid = thr_create_func( "dds_security_fsm", fsm_thread, context);
-  context->fsm_timeout_tid = thr_create_func( "dds_security_fsm_timeout",
-      fsm_run_timeout, context);
-
-  return context;
-}
-
-void dds_security_fsm_context_destroy(dds_security_fsm_context *context,
-    dds_security_fsm_thread_destroy_func thr_destroy_func) {
-  if (context) {
-    context->fsm_teardown = true;
-
-    ddsrt_mutex_lock( &context->fsm_overall_timeout_cond_mutex);
-    ddsrt_cond_signal( &context->fsm_overall_timeout_cond);
-    ddsrt_mutex_unlock( &context->fsm_overall_timeout_cond_mutex);
-
-    ddsrt_mutex_lock(&context->fsm_event_cond_mutex);
-    ddsrt_cond_signal(&context->fsm_event_cond);
-    ddsrt_mutex_unlock(&context->fsm_event_cond_mutex);
-
-    thr_destroy_func( context->fsm_tid);
-    ddsrt_mutex_destroy(&context->fsm_event_cond_mutex);
-    ddsrt_cond_destroy(&context->fsm_event_cond);
-
-    thr_destroy_func( context->fsm_timeout_tid);
-    ddsrt_mutex_destroy(&context->fsm_fsms_mutex);
-    ddsrt_mutex_destroy(&context->fsm_overall_timeout_cond_mutex);
-    ddsrt_cond_destroy(&context->fsm_overall_timeout_cond);
-
-    ddsrt_free(context->fsm_next_state_timeout);
-  }
-}
-#ifdef  AT_PROC_EXIT_IMPLEMENTED
-static void fsm_fini(void) {
-  dds_security_fsm_context_destroy(fsm_context, NULL, fsm_thread_destroy);
-
-  /* os_osExit(); ???? */
-}
-
-#endif
-static bool fsm_init_once(void) {
-  bool ret = true;
-  uint32_t initCount;
-
-  initCount = ddsrt_atomic_inc32_nv(&_fsmInitCount);
-
-  if (initCount == 1) {
-    assert( dds_security_fsm_initialized == false );
-
-    /* ddsrt_osInit(); ??? */
-
-    fsm_context = dds_security_fsm_context_create( fsm_thread_create);
-
-    if (fsm_context) {
-      /* os_procAtExit( fsm_fini ); ??? */
-      dds_security_fsm_initialized = true;
-    } else {
-      ret = false;
-    }
-  } else {
-    if (dds_security_fsm_initialized == false) {
-      /* Another thread is currently initializing the fsm. Since
-       * both results (osr_fsm and osr_timeout) should be ddsrt_resultSuccess
-       * a sleep is performed, to ensure that (if succeeded) successive
-       * init calls will also actually pass.
-       */
-      dds_sleepfor( DDS_MSECS( 100 ));
-    }
-    if (dds_security_fsm_initialized == false) {
-      /* Initialization did not succeed, undo increment and return error */
-      initCount = ddsrt_atomic_dec32_nv(&_fsmInitCount);
-      ret = false;
-    }
-  }
-  return ret;
-}
-
-static int /* 1 = ok, other = error */
-fsm_validate(const dds_security_fsm_transition *transitions, int size) {
-  int i;
-
-  for (i = 0; i < size; i++) {
+  for (i = 0; i < size; i++)
+  {
     /* It needs to have a start. */
-    if ((transitions[i].begin == NULL )
-        && (transitions[i].event_id == DDS_SECURITY_FSM_EVENT_AUTO)) {
-      return 1;
-    }
+    if (transitions[i].begin && transitions[i].event_id == DDS_SECURITY_FSM_EVENT_AUTO)
+      return true;
   }
-
-  return 0;
+  return true;
 }
 
-struct dds_security_fsm *
-dds_security_fsm_create(struct dds_security_fsm_context *context,
-    const dds_security_fsm_transition *transitions, int size, void *arg) {
-  struct dds_security_fsm* fsm = NULL;
-  struct dds_security_fsm_context *ctx = NULL;
-
-  assert(transitions);
-  assert(size > 0);
-
-  if (context == NULL) {
-    if (fsm_init_once()) {
-      ctx = fsm_context;
-    }
-  } else {
-    ctx = context;
+static void add_fsm_to_list (struct dds_security_fsm_control *control, struct dds_security_fsm *fsm)
+{
+  fsm->next_fsm = NULL;
+  fsm->prev_fsm = control->last_fsm;
+  if (control->last_fsm)
+  {
+    assert(control->first_fsm != NULL);
+    control->last_fsm->next_fsm = fsm;
   }
+  else
+  {
+    assert(control->first_fsm == NULL);
+    control->first_fsm = fsm;
+  }
+  control->last_fsm = fsm;
+}
 
-  if (ctx) {
-    if (fsm_validate(transitions, size) == 1) {
-      fsm = ddsrt_malloc(sizeof(struct dds_security_fsm));
-      fsm->transitions = transitions;
-      fsm->size = size;
-      fsm->arg = arg;
-      fsm->current = NULL;
-      fsm->debug_func = NULL;
-      fsm->next = NULL;
-      fsm->prev = NULL;
-      fsm->context = ctx;
-      ddsrt_atomic_st32( &fsm->ref_cnt, 1 );
-      fsm->current_state_endtime = 0;
+static void remove_fsm_from_list (struct dds_security_fsm_control *control, struct dds_security_fsm *fsm)
+{
+  if (fsm->prev_fsm)
+    fsm->prev_fsm->next_fsm = fsm->next_fsm;
+  else
+    control->first_fsm = fsm->next_fsm;
 
-      ddsrt_mutex_lock(&fsm->context->fsm_fsms_mutex);
-      if (fsm->context->fsm_fsms) {
-        dds_security_fsm *last = fsm->context->fsm_fsms;
-        while (last->next != NULL ) {
-          last = last->next;
-        }
-        last->next = fsm;
-        fsm->prev = last;
-      } else {
-        fsm->context->fsm_fsms = fsm;
-      }
-      ddsrt_mutex_unlock(&fsm->context->fsm_fsms_mutex);
-    }
+  if (fsm->next_fsm)
+    fsm->next_fsm->prev_fsm = fsm->prev_fsm;
+  else
+    control->last_fsm = fsm->prev_fsm;
+}
+
+struct dds_security_fsm * dds_security_fsm_create (struct dds_security_fsm_control *control, const dds_security_fsm_transition *transitions, uint32_t size, void *arg)
+{
+  struct dds_security_fsm *fsm = NULL;
+
+  assert(control);
+  assert(transitions);
+
+  if (fsm_validate (transitions, size))
+  {
+    fsm = ddsrt_malloc (sizeof(struct dds_security_fsm));
+    fsm->transitions = transitions;
+    fsm->size = size;
+    fsm->arg = arg;
+    fsm->current = NULL;
+    fsm->debug_func = NULL;
+    fsm->overall_timeout_action = NULL;
+    fsm->state_timeout_event.kind = FSM_TIMEOUT_STATE;
+    fsm->state_timeout_event.endtime = DDS_NEVER;
+    fsm->state_timeout_event.fsm = fsm;
+    fsm->overall_timeout_event.kind = FSM_TIMEOUT_OVERALL;
+    fsm->overall_timeout_event.endtime = DDS_NEVER;
+    fsm->overall_timeout_event.fsm = fsm;
+    fsm->active = true;
+    fsm->next_fsm = NULL;
+    fsm->prev_fsm = NULL;
+    fsm->control = control;
+
+    ddsrt_mutex_lock (&control->lock);
+    add_fsm_to_list (control, fsm);
+    ddsrt_mutex_unlock (&control->lock);
   }
   return fsm;
 }
 
-void dds_security_fsm_start(struct dds_security_fsm *fsm) {
-  assert(fsm);
-  dds_security_fsm_dispatch(fsm, DDS_SECURITY_FSM_EVENT_AUTO);
+void
+dds_security_fsm_start (struct dds_security_fsm *fsm)
+{
+  dds_security_fsm_dispatch(fsm, DDS_SECURITY_FSM_EVENT_AUTO, false);
 }
 
-void dds_security_fsm_set_timeout(struct dds_security_fsm *fsm, dds_security_fsm_action func,
-    dds_time_t timeout) {
-  fsm_overall_timeout *to;
-  dds_security_fsm_context *context;
-
-  assert(fsm);
-
-  context = fsm->context;
-  assert(context);
-
-  to = ddsrt_malloc(sizeof(fsm_overall_timeout));
-  to->fsm = fsm;
-  to->func = func;
-  to->endtime = ddsrt_time_add_duration( dds_time(), timeout);
-  to->next = NULL;
-  to->prev = NULL;
-
-  ddsrt_mutex_lock(&context->fsm_overall_timeout_cond_mutex);
-  if (context->fsm_overall_timeouts) {
-    fsm_overall_timeout *last = context->fsm_overall_timeouts;
-    while (last->next != NULL ) {
-      last = last->next;
-    }
-    last->next = to;
-    to->prev = last;
-  } else {
-    context->fsm_overall_timeouts = to;
-  }
-  ddsrt_cond_signal(&context->fsm_overall_timeout_cond);
-  ddsrt_mutex_unlock(&context->fsm_overall_timeout_cond_mutex);
-}
-
-void dds_security_fsm_set_debug(struct dds_security_fsm *fsm, dds_security_fsm_debug func) {
-  dds_security_fsm_context *context;
-
-  assert(fsm);
-
-  context = fsm->context;
-  assert(context);
-
-  ddsrt_mutex_lock(&context->fsm_overall_timeout_cond_mutex);
-  fsm->debug_func = func;
-  ddsrt_mutex_unlock(&context->fsm_overall_timeout_cond_mutex);
-}
-
-void dds_security_fsm_dispatch(struct dds_security_fsm *fsm, int32_t event_id) {
-  dds_security_fsm_context *context;
-
-  assert(fsm);
-
-  context = fsm->context;
-  assert(context);
-
-  ddsrt_mutex_lock(&context->fsm_event_cond_mutex);
-  fsm_dispatch(fsm, event_id, 0);
-  ddsrt_cond_signal(&context->fsm_event_cond);
-  ddsrt_mutex_unlock(&context->fsm_event_cond_mutex);
-}
-
-void dds_security_fsm_dispatch_direct(struct dds_security_fsm *fsm, int32_t event_id) {
-  dds_security_fsm_context *context;
-
-  assert(fsm);
-
-  context = fsm->context;
-  assert(context);
-
-  ddsrt_mutex_lock(&context->fsm_event_cond_mutex);
-  fsm_dispatch(fsm, event_id, 1);
-  ddsrt_cond_signal(&context->fsm_event_cond);
-  ddsrt_mutex_unlock(&context->fsm_event_cond_mutex);
-}
-
-const dds_security_fsm_state*
-dds_security_fsm_current_state(struct dds_security_fsm *fsm) {
-  assert(fsm);
-  return fsm->current;
-}
-
-void dds_security_fsm_cleanup(struct dds_security_fsm *fsm) {
-  dds_security_fsm_context *context;
-  fsm_event *event;
-  fsm_event *tmp_prev_event;
-  fsm_event *tmp_next_event;
-  fsm_overall_timeout *timeout;
-
-  assert(fsm);
-
-  context = fsm->context;
-  assert(context);
-
-  // Signal the timeout thread.
-  // First hold to lock to the overall timeout list
-  // so that the next timeout can't be determined until
-  // we've done removing the overall timeout of this fsm
-
-  // Signal the thread so that it's not using timeout structs
-  ddsrt_mutex_lock(&context->fsm_overall_timeout_cond_mutex);
-  ddsrt_cond_signal(&context->fsm_overall_timeout_cond);
-
-  timeout = context->fsm_overall_timeouts;
-
-  // Search the overall timeout of this fsm
-  while (timeout) {
-    if (timeout->fsm == fsm) {
-      break;
-    }
-    timeout = timeout->next;
-  }
-  fsm_remove_overall_timeout_from_list(context, timeout);
-  ddsrt_mutex_unlock(&context->fsm_overall_timeout_cond_mutex);
-
-  /* The current fsm could be the one that would trigger a possible timeout.
-   * Reset the state timeout and make sure it's not the current fsm. */
-  fsm_set_next_state_timeout(context, fsm);
-
-  /* Now, remove all possible events from the queue related to the fsm. */
-  ddsrt_mutex_lock(&context->fsm_event_cond_mutex);
-  event = context->fsm_queue;
-  while (event) {
-    if (event->fsm == fsm) {
-      tmp_next_event = event->next;
-      tmp_prev_event = event->prev;
-      if (tmp_prev_event) {
-        tmp_prev_event->next = tmp_next_event;
-      }
-      if (tmp_next_event) {
-        tmp_next_event->prev = tmp_prev_event;
-      }
-      if (event == context->fsm_queue) {
-        context->fsm_queue = tmp_next_event;
-      }
-      ddsrt_free(event);
-      event = tmp_next_event;
-    } else {
-      event = event->next;
-    }
-  }
-  ddsrt_cond_signal(&context->fsm_event_cond);
-  ddsrt_mutex_unlock(&context->fsm_event_cond_mutex);
-}
-
-void dds_security_fsm_free(struct dds_security_fsm *fsm) {
-  ddsrt_tid_t self = ddsrt_gettid_for_thread( ddsrt_thread_self() );
-  dds_security_fsm_context *context;
-
-  assert(fsm);
-
-  context = fsm->context;
-  assert(context);
-
-  /* Indicate termination. */
-  fsm->size = -1;
-
-  /* Cleanup stuff. */
-  dds_security_fsm_cleanup(fsm);
-  fsm_remove_fsm_list(fsm);
-
-  /* Is this being freed from the FSM context? */
-  if ((self ==  ddsrt_gettid_for_thread( context->fsm_tid ) )
-      || (self ==  ddsrt_gettid_for_thread( context->fsm_timeout_tid ) ) ) {
-    /* Yes.
-     * Just reduce the reference count and let the garbage collection be
-     * done by the FSM context after event handling. */
-    ddsrt_atomic_dec32(&(fsm->ref_cnt));
-  } else {
-    /* No.
-     * Block the outside thread until a possible concurrent event
-     * has being handled. */
-    while (ddsrt_atomic_ld32( &(fsm->ref_cnt)) > 1) {
-      /* Currently, an event is still being handled for this FSM. */
-      dds_sleepfor( 10 * DDS_NSECS_IN_MSEC );
-    }
-    /* We have the only reference, so it's safe to free the FSM. */
-    ddsrt_free(fsm);
+static void fsm_deactivate (struct dds_security_fsm *fsm, bool gen_del_event)
+{
+  if (fsm->active)
+  {
+    fsm->active = false;
+    clear_state_timer (fsm);
+    clear_overall_timer (fsm);
+    fsm->current = NULL;
+    if (gen_del_event)
+      fsm_dispatch (fsm, DDS_SECURITY_FSM_EVENT_DELETE, false);
   }
 }
+
+void dds_security_fsm_free (struct dds_security_fsm *fsm)
+{
+  struct dds_security_fsm_control *control;
+
+  assert(fsm);
+  assert(fsm->control);
+
+  control = fsm->control;
+  ddsrt_mutex_lock (&control->lock);
+  fsm_deactivate (fsm, true);
+  ddsrt_mutex_unlock (&control->lock);
+}
+
+static void fsm_delete (struct dds_security_fsm_control *control, struct dds_security_fsm *fsm)
+{
+  fsm_deactivate (fsm, false);
+  remove_fsm_from_list (control, fsm);
+  ddsrt_free(fsm);
+}
+
+struct dds_security_fsm_control * dds_security_fsm_control_create (struct q_globals *gv)
+{
+  struct dds_security_fsm_control *control;
+
+  control = ddsrt_malloc (sizeof(*control));
+  control->running = false;
+  control->event_queue = NULL;
+  control->first_fsm = NULL;
+  control->last_fsm = NULL;
+  control->gv = gv;
+  ddsrt_mutex_init (&control->lock);
+  ddsrt_cond_init (&control->cond);
+  ddsrt_fibheap_init (&timer_events_fhdef, &control->timers);
+
+  return control;
+}
+
+void dds_security_fsm_control_free (struct dds_security_fsm_control *control)
+{
+  struct dds_security_fsm *fsm;
+  struct fsm_event *event;
+
+  assert(control);
+  assert(!control->running);
+
+  while ((fsm = control->first_fsm) != NULL)
+  {
+    control->first_fsm = fsm->next_fsm;
+    fsm_deactivate (fsm, false);
+    ddsrt_free (fsm);
+  }
+  while ((event = control->event_queue) != NULL)
+  {
+    control->event_queue = event->next;
+    ddsrt_free (event);
+  }
+
+  ddsrt_cond_destroy (&control->cond);
+  ddsrt_mutex_destroy (&control->lock);
+  ddsrt_free (control);
+}
+
+dds_return_t dds_security_fsm_control_start (struct dds_security_fsm_control *control, const char *name)
+{
+  dds_return_t rc;
+  const char *fsm_name = name ? name : "fsm";
+
+  assert(control);
+
+  control->running = true;
+  rc = create_thread (&control->ts, control->gv, fsm_name, (uint32_t (*) (void *)) handle_events, control);
+
+  return rc;
+}
+
+void dds_security_fsm_control_stop (struct dds_security_fsm_control *control)
+{
+  assert(control);
+  assert(control->running);
+
+  ddsrt_mutex_lock (&control->lock);
+  control->running = false;
+  ddsrt_cond_signal (&control->cond);
+  ddsrt_mutex_unlock (&control->lock);
+
+  join_thread (control->ts);
+  control->ts = NULL;
+}
diff --git a/src/security/core/tests/CMakeLists.txt b/src/security/core/tests/CMakeLists.txt
index e002ba4..40a6650 100644
--- a/src/security/core/tests/CMakeLists.txt
+++ b/src/security/core/tests/CMakeLists.txt
@@ -27,13 +27,10 @@ target_include_directories(
         "$<BUILD_INTERFACE:$<TARGET_PROPERTY:security_core,INTERFACE_INCLUDE_DIRECTORIES>>"
         "$<BUILD_INTERFACE:${CMAKE_CURRENT_LIST_DIR}>"
         "$<BUILD_INTERFACE:${CMAKE_CURRENT_BINARY_DIR}>"
-        "$<BUILD_INTERFACE:${CMAKE_CURRENT_LIST_DIR}/../../../../core/ddsi/include>"
+        "$<BUILD_INTERFACE:${CMAKE_CURRENT_SOURCE_DIR}/../../../core/ddsi/include>"
+        "$<BUILD_INTERFACE:${CMAKE_CURRENT_SOURCE_DIR}/../../../core/ddsc/src>"
  )
 
 
 target_link_libraries(cunit_security_core PRIVATE ddsc security_api)
 target_include_directories(cunit_security_core PRIVATE "${CMAKE_CURRENT_BINARY_DIR}")
-
-
-
-# configure_file("config_env.h.in" "config_env.h")
\ No newline at end of file
diff --git a/src/security/core/tests/tc_fsm.c b/src/security/core/tests/tc_fsm.c
index 442b921..c2c7647 100644
--- a/src/security/core/tests/tc_fsm.c
+++ b/src/security/core/tests/tc_fsm.c
@@ -1,43 +1,45 @@
-#include "dds/security/core/dds_security_fsm.h"
-#include "dds/ddsrt/sync.h"
-#include "dds/ddsrt/misc.h"
+/*
+ * Copyright(c) 2006 to 2018 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
 #include <stdio.h>
 #include <stdbool.h>
+
+#include "dds/ddsrt/sync.h"
+#include "dds/ddsrt/misc.h"
+
 #include "CUnit/CUnit.h"
 #include "CUnit/Test.h"
+#include "dds/dds.h"
+#include "dds__types.h"
+#include "dds__entity.h"
+#include "dds/security/core/dds_security_fsm.h"
 
 #define CHECK_BIT(var, pos) ((var) & (1<<(pos)))
 
 #define FSM_AUTH_ARG 10
 
-#define DB_TC_PRINT_DEBUG  (false)
+#define DB_TC_PRINT_DEBUG  (true)
 
-static struct dds_security_fsm *fsm_auth;
-static struct dds_security_fsm *fsm_test;
-static struct dds_security_fsm *fsm_timeout;
-static struct dds_security_fsm *fsm_timeout2;
-static struct dds_security_fsm *fsm_timeout3;
+static dds_entity_t g_participant = 0;
+static struct dds_security_fsm_control *g_fsm_control = NULL;
+static const dds_duration_t msec100 = DDS_MSECS(100);
 
-static uint32_t visited_auth = 0;
-static uint32_t visited_test = 0;
-static uint32_t visited_timeout = 0;
+//static int fsm_arg = FSM_AUTH_ARG;
 
-uint32_t correct_fsm = 0;
-uint32_t correct_arg = 0;
 
-uint32_t correct_fsm_timeout = 0;
-uint32_t correct_arg_timeout = 0;
 
-static ddsrt_cond_t stop_timeout_cond;
-static ddsrt_mutex_t stop_timeout_cond_mutex;
-static uint32_t stop_timeout_cond_cnt = 0;
-static int validate_remote_identity_first = 1;
-static int begin_handshake_reply_first = 1;
-static int do_stuff_counter = 0;
-static int do_other_stuff_counter = 0;
-/*
+/**********************************************************************
  * Authentication State Machine properties and methods
- */
+ **********************************************************************/
+
 typedef enum {
     VALIDATION_PENDING_RETRY,
     VALIDATION_FAILED,
@@ -48,8 +50,16 @@ typedef enum {
     PluginReturn_MAX
 } PluginReturn;
 
-static PluginReturn validate_remote_identity(void) {
+static struct dds_security_fsm *fsm_auth;
+static uint32_t visited_auth = 0;
+static uint32_t correct_fsm = 0;
+static uint32_t correct_arg = 0;
+static int validate_remote_identity_first = 1;
+static int begin_handshake_reply_first = 1;
 
+
+static PluginReturn validate_remote_identity(void)
+{
   if (DB_TC_PRINT_DEBUG) {
     printf("validate_remote_identity - %d\n", validate_remote_identity_first);
   }
@@ -60,8 +70,8 @@ static PluginReturn validate_remote_identity(void) {
   return VALIDATION_PENDING_HANDSHAKE_MESSAGE;
 }
 
-static PluginReturn begin_handshake_reply(void) {
-
+static PluginReturn begin_handshake_reply(void)
+{
   if (DB_TC_PRINT_DEBUG) {
     printf("begin_handshake_reply - %d\n", begin_handshake_reply_first);
   }
@@ -72,12 +82,14 @@ static PluginReturn begin_handshake_reply(void) {
   return VALIDATION_OK_FINAL_MESSAGE;
 }
 
-static PluginReturn get_shared_secret(void) {
+static PluginReturn get_shared_secret(void)
+{
   return VALIDATION_OK;
 }
 
 /* State actions. */
-static void fsm_validate_remote_identity(struct dds_security_fsm *fsm, void *arg) {
+static void fsm_validate_remote_identity(struct dds_security_fsm *fsm, void *arg)
+{
   PluginReturn ret;
 
   DDSRT_UNUSED_ARG(arg);
@@ -88,10 +100,11 @@ static void fsm_validate_remote_identity(struct dds_security_fsm *fsm, void *arg
     printf("[%p] State %s (ret %d)\n", fsm, __FUNCTION__, (int) ret);
   }
 
-  dds_security_fsm_dispatch(fsm, (int32_t) ret);
+  dds_security_fsm_dispatch(fsm, (int32_t) ret, false);
 }
 
-static void fsm_begin_handshake_reply(struct dds_security_fsm *fsm, void *arg) {
+static void fsm_begin_handshake_reply(struct dds_security_fsm *fsm, void *arg)
+{
   PluginReturn ret;
 
   DDSRT_UNUSED_ARG(arg);
@@ -105,18 +118,18 @@ static void fsm_begin_handshake_reply(struct dds_security_fsm *fsm, void *arg) {
     printf("[%p] State %s (ret %d)\n", fsm, __FUNCTION__, (int) ret);
   }
 
-  dds_security_fsm_dispatch(fsm, (int32_t) ret);
+  dds_security_fsm_dispatch(fsm, (int32_t) ret, false);
 }
 
 /* A few states from the handshake state-machine. */
-static dds_security_fsm_state StateValidateRemoteIdentity = {
-        fsm_validate_remote_identity, 0};
+static dds_security_fsm_state StateValidateRemoteIdentity = {fsm_validate_remote_identity, 0};
 static dds_security_fsm_state StateValRemIdentityRetryWait = {NULL, 100000000};
 static dds_security_fsm_state StateHandshakeInitMessageWait = {NULL, 0};
 static dds_security_fsm_state StateBeginHandshakeReply = {fsm_begin_handshake_reply, 0};
 static dds_security_fsm_state StateBeginHsReplyWait = {NULL, 100000000};
 
-static void a(struct dds_security_fsm *fsm, void *arg) {
+static void a(struct dds_security_fsm *fsm, void *arg)
+{
   int *fsm_arg;
 
   if (DB_TC_PRINT_DEBUG) {
@@ -141,7 +154,8 @@ static void a(struct dds_security_fsm *fsm, void *arg) {
   visited_auth |= 1UL << 0;
 }
 
-static void b(struct dds_security_fsm *fsm, void *arg) {
+static void b(struct dds_security_fsm *fsm, void *arg)
+{
   DDSRT_UNUSED_ARG(fsm);
   DDSRT_UNUSED_ARG(arg);
   if (DB_TC_PRINT_DEBUG)
@@ -149,7 +163,8 @@ static void b(struct dds_security_fsm *fsm, void *arg) {
   visited_auth |= 1UL << 1;
 }
 
-static void c(struct dds_security_fsm *fsm, void *arg) {
+static void c(struct dds_security_fsm *fsm, void *arg)
+{
   DDSRT_UNUSED_ARG(fsm);
   DDSRT_UNUSED_ARG(arg);
   if (DB_TC_PRINT_DEBUG)
@@ -157,7 +172,8 @@ static void c(struct dds_security_fsm *fsm, void *arg) {
   visited_auth |= 1UL << 2;
 }
 
-static void d(struct dds_security_fsm *fsm, void *arg) {
+static void d(struct dds_security_fsm *fsm, void *arg)
+{
   DDSRT_UNUSED_ARG(fsm);
   DDSRT_UNUSED_ARG(arg);
   if (DB_TC_PRINT_DEBUG)
@@ -165,7 +181,8 @@ static void d(struct dds_security_fsm *fsm, void *arg) {
   visited_auth |= 1UL << 3;
 }
 
-static void e(struct dds_security_fsm *fsm, void *arg) {
+static void e(struct dds_security_fsm *fsm, void *arg)
+{
   DDSRT_UNUSED_ARG(fsm);
   DDSRT_UNUSED_ARG(arg);
   if (DB_TC_PRINT_DEBUG)
@@ -173,7 +190,8 @@ static void e(struct dds_security_fsm *fsm, void *arg) {
   visited_auth |= 1UL << 4;
 }
 
-static void f(struct dds_security_fsm *fsm, void *arg) {
+static void f(struct dds_security_fsm *fsm, void *arg)
+{
   DDSRT_UNUSED_ARG(fsm);
   DDSRT_UNUSED_ARG(arg);
   if (DB_TC_PRINT_DEBUG)
@@ -181,7 +199,8 @@ static void f(struct dds_security_fsm *fsm, void *arg) {
   visited_auth |= 1UL << 5;
 }
 
-static void g(struct dds_security_fsm *fsm, void *arg) {
+static void g(struct dds_security_fsm *fsm, void *arg)
+{
   DDSRT_UNUSED_ARG(fsm);
   DDSRT_UNUSED_ARG(arg);
   if (DB_TC_PRINT_DEBUG)
@@ -189,7 +208,8 @@ static void g(struct dds_security_fsm *fsm, void *arg) {
   visited_auth |= 1UL << 6;
 }
 
-static void h(struct dds_security_fsm *fsm, void *arg) {
+static void h(struct dds_security_fsm *fsm, void *arg)
+{
   DDSRT_UNUSED_ARG(fsm);
   DDSRT_UNUSED_ARG(arg);
   if (DB_TC_PRINT_DEBUG)
@@ -233,34 +253,35 @@ static void h(struct dds_security_fsm *fsm, void *arg) {
  *                                                                       .-.
  *                                                                       '-'
  */
-dds_security_fsm_transition HandshakeTransistions[] =
-        {{NULL,                           DDS_SECURITY_FSM_EVENT_AUTO,                  a, &StateValidateRemoteIdentity}, // NULL state is the start state
-         {&StateValidateRemoteIdentity, VALIDATION_PENDING_RETRY,             b,
-                                                                                 &StateValRemIdentityRetryWait},
-         {&StateValidateRemoteIdentity,
-                                        VALIDATION_PENDING_HANDSHAKE_MESSAGE, c,
-                                                                                 &StateHandshakeInitMessageWait},
-         {&StateValRemIdentityRetryWait,
-                                          DDS_SECURITY_FSM_EVENT_TIMEOUT,               d, &StateValidateRemoteIdentity},
-         {
-          &StateHandshakeInitMessageWait, SHM_MSG_RECEIVED,                   e,
-                                                                                 &StateBeginHandshakeReply},
-         {&StateBeginHandshakeReply,
-                                        VALIDATION_PENDING_RETRY,             f, &StateBeginHsReplyWait},
-         {
-          &StateBeginHandshakeReply,    VALIDATION_OK,                        g, NULL}, // Reaching NULL means end of state-diagram
-         {&StateBeginHsReplyWait,         DDS_SECURITY_FSM_EVENT_TIMEOUT,               h,
-                                                                                 &StateBeginHandshakeReply},};
+static dds_security_fsm_transition HandshakeTransistions[] = {
+    {NULL,                           DDS_SECURITY_FSM_EVENT_AUTO,          a, &StateValidateRemoteIdentity}, // NULL state is the start state
+    {&StateValidateRemoteIdentity,   VALIDATION_PENDING_RETRY,             b, &StateValRemIdentityRetryWait},
+    {&StateValidateRemoteIdentity,   VALIDATION_PENDING_HANDSHAKE_MESSAGE, c, &StateHandshakeInitMessageWait},
+    {&StateValRemIdentityRetryWait,  DDS_SECURITY_FSM_EVENT_TIMEOUT,       d, &StateValidateRemoteIdentity},
+    {&StateHandshakeInitMessageWait, SHM_MSG_RECEIVED,                     e, &StateBeginHandshakeReply},
+    {&StateBeginHandshakeReply,      VALIDATION_PENDING_RETRY,             f, &StateBeginHsReplyWait},
+    {&StateBeginHandshakeReply,      VALIDATION_OK,                        g, NULL}, // Reaching NULL means end of state-diagram
+    {&StateBeginHsReplyWait,         DDS_SECURITY_FSM_EVENT_TIMEOUT,       h, &StateBeginHandshakeReply}
+};
+static const uint32_t HandshakeTransistionsSize = sizeof(HandshakeTransistions)/sizeof(HandshakeTransistions[0]);
 
-/*
+
+/**********************************************************************
  * Example State Machine properties and methods
- */
+ **********************************************************************/
+
 typedef enum {
     eventX, eventY, eventZ,
 } test_events;
 
+static struct dds_security_fsm *fsm_test;
+static uint32_t visited_test = 0;
+static int do_stuff_counter = 0;
+static int do_other_stuff_counter = 0;
+
 /* The functions called from the state-machine. */
-static void doStart(struct dds_security_fsm *fsm, void *arg) {
+static void doStart(struct dds_security_fsm *fsm, void *arg)
+{
   DDSRT_UNUSED_ARG(fsm);
   DDSRT_UNUSED_ARG(arg);
   if (DB_TC_PRINT_DEBUG)
@@ -268,7 +289,8 @@ static void doStart(struct dds_security_fsm *fsm, void *arg) {
   visited_test |= 1UL << 0;
 }
 
-static void doRestart(struct dds_security_fsm *fsm, void *arg) {
+static void doRestart(struct dds_security_fsm *fsm, void *arg)
+{
   DDSRT_UNUSED_ARG(fsm);
   DDSRT_UNUSED_ARG(arg);
   if (DB_TC_PRINT_DEBUG)
@@ -276,7 +298,8 @@ static void doRestart(struct dds_security_fsm *fsm, void *arg) {
   visited_test |= 1UL << 1;
 }
 
-static void doEventStuff(struct dds_security_fsm *fsm, void *arg) {
+static void doEventStuff(struct dds_security_fsm *fsm, void *arg)
+{
   DDSRT_UNUSED_ARG(fsm);
   DDSRT_UNUSED_ARG(arg);
   if (DB_TC_PRINT_DEBUG)
@@ -284,8 +307,8 @@ static void doEventStuff(struct dds_security_fsm *fsm, void *arg) {
   visited_test |= 1UL << 4;
 }
 
-static void doStuff(struct dds_security_fsm *fsm, void *arg) {
-
+static void doStuff(struct dds_security_fsm *fsm, void *arg)
+{
   DDSRT_UNUSED_ARG(fsm);
   DDSRT_UNUSED_ARG(arg);
 
@@ -294,15 +317,16 @@ static void doStuff(struct dds_security_fsm *fsm, void *arg) {
   }
   visited_test |= 1UL << 2;
 
-  if (do_stuff_counter == 0) {
-    dds_security_fsm_dispatch(fsm, eventZ);
+  if (do_stuff_counter < 2) {
+    dds_security_fsm_dispatch(fsm, eventZ, false);
   } else if (do_stuff_counter == 2) {
-    dds_security_fsm_dispatch(fsm, eventY);
+    dds_security_fsm_dispatch(fsm, eventY, false);
   }
   ++do_stuff_counter;
 }
 
-static void doOtherStuff(struct dds_security_fsm *fsm, void *arg) {
+static void doOtherStuff(struct dds_security_fsm *fsm, void *arg)
+{
   DDSRT_UNUSED_ARG(fsm);
   DDSRT_UNUSED_ARG(arg);
 
@@ -311,43 +335,54 @@ static void doOtherStuff(struct dds_security_fsm *fsm, void *arg) {
   }
   visited_test |= 1UL << 3;
   if (do_other_stuff_counter == 0) {
-    dds_security_fsm_dispatch(fsm, DDS_SECURITY_FSM_EVENT_AUTO);
+    dds_security_fsm_dispatch(fsm, DDS_SECURITY_FSM_EVENT_AUTO, false);
   }
+
   if (do_other_stuff_counter == 1) {
-    dds_security_fsm_dispatch(fsm, eventY);
+    dds_security_fsm_dispatch(fsm, eventY, false);
   } else if (do_other_stuff_counter == 2) {
-    dds_security_fsm_dispatch(fsm, eventX);
+    dds_security_fsm_dispatch(fsm, eventX, false);
   }
   ++do_other_stuff_counter;
 }
 
-dds_security_fsm_state StateA = {doStuff, 0};
-dds_security_fsm_state StateB = {doStuff, 100000000};
-dds_security_fsm_state StateC = {NULL, 0};
-dds_security_fsm_state StateD = {doOtherStuff, 0};
+static dds_security_fsm_state StateA = {doStuff,      0};
+static dds_security_fsm_state StateB = {doStuff,      100000000};
+static dds_security_fsm_state StateC = {NULL,         0};
+static dds_security_fsm_state StateD = {doOtherStuff, 0};
 
-dds_security_fsm_transition transitions[] = {
-        {NULL,    DDS_SECURITY_FSM_EVENT_AUTO, doStart,      &StateA}, // NULL state is the start state
-        {&StateA, eventZ, NULL,                    &StateB},
-        {&StateA, eventY,            doOtherStuff, &StateC},
-        {&StateB, eventX, NULL,               NULL}, // Reaching NULL means end of state-diagram
-        {&StateB, eventZ,            doRestart,    &StateA},
-        {&StateC, DDS_SECURITY_FSM_EVENT_AUTO,
-                                     doEventStuff, &StateD},
-        {&StateD, eventY,            doEventStuff, &StateD},
-        {
-         &StateD, eventX,            doStuff, NULL}, // Reaching NULL means end of state-diagram
+static dds_security_fsm_transition Transitions[] = {
+    {NULL,    DDS_SECURITY_FSM_EVENT_AUTO, doStart,      &StateA}, // NULL state is the start state
+    {&StateA, eventZ,                      NULL,         &StateB},
+    {&StateA, eventY,                      doOtherStuff, &StateC},
+    {&StateB, eventX,                      NULL,         NULL}, // Reaching NULL means end of state-diagram
+    {&StateB, eventZ,                      doRestart,    &StateA},
+    {&StateC, DDS_SECURITY_FSM_EVENT_AUTO, doEventStuff, &StateD},
+    {&StateD, eventY,                      doEventStuff, &StateD},
+    {&StateD, eventX,                      doStuff,      NULL}, // Reaching NULL means end of sttimeoutate-diagram
 };
+static const uint32_t TransitionsSize = sizeof(Transitions)/sizeof(Transitions[0]);
 
-/*
+
+/**********************************************************************
  * Timeout State Machine properties and methods
- */
+ **********************************************************************/
+
 typedef enum {
     eventToTimeout, eventToEnd,
 } timeout_events;
 
-/* The functions callld from the state-machine. */
-static void doInterupt(struct dds_security_fsm *fsm, void *arg) {
+static struct dds_security_fsm *fsm_timeout;
+static uint32_t visited_timeout = 0;
+static uint32_t correct_fsm_timeout = 0;
+static uint32_t correct_arg_timeout = 0;
+static ddsrt_cond_t stop_timeout_cond;
+static ddsrt_mutex_t stop_timeout_cond_mutex;
+static uint32_t stop_timeout_cond_cnt = 0;
+
+/* The functions called from the state-machine. */
+static void doInterupt(struct dds_security_fsm *fsm, void *arg)
+{
   DDSRT_UNUSED_ARG(fsm);
   DDSRT_UNUSED_ARG(arg);
   if (DB_TC_PRINT_DEBUG) {
@@ -356,7 +391,8 @@ static void doInterupt(struct dds_security_fsm *fsm, void *arg) {
   visited_timeout |= 1UL << 0;
 }
 
-static void doTimeout(struct dds_security_fsm *fsm, void *arg) {
+static void doTimeout(struct dds_security_fsm *fsm, void *arg)
+{
   dds_duration_t delay4 = 4 * DDS_NSECS_IN_SEC;
 
   DDSRT_UNUSED_ARG(arg);
@@ -377,10 +413,11 @@ static void doTimeout(struct dds_security_fsm *fsm, void *arg) {
     printf("Transition <<<< %s %d\n", __FUNCTION__, stop_timeout_cond_cnt);
   }
 
-  dds_security_fsm_dispatch(fsm, eventToTimeout);
+  dds_security_fsm_dispatch(fsm, eventToTimeout, false);
 }
 
-static void TimeoutCallback(struct dds_security_fsm *fsm, void *arg) {
+static void TimeoutCallback(struct dds_security_fsm *fsm, void *arg)
+{
   int *fsm_arg;
 
   if (DB_TC_PRINT_DEBUG) {
@@ -405,7 +442,8 @@ static void TimeoutCallback(struct dds_security_fsm *fsm, void *arg) {
   }
 }
 
-static void TimeoutCallback2(struct dds_security_fsm *fsm, void *arg) {
+static void TimeoutCallback2(struct dds_security_fsm *fsm, void *arg)
+{
   DDSRT_UNUSED_ARG(fsm);
   DDSRT_UNUSED_ARG(arg);
   if (DB_TC_PRINT_DEBUG) {
@@ -414,86 +452,121 @@ static void TimeoutCallback2(struct dds_security_fsm *fsm, void *arg) {
   visited_timeout |= 1UL << 3;
 }
 
-dds_security_fsm_state StateTimeout = {doTimeout, 0};
-dds_security_fsm_state StateInterupt = {doInterupt, 0};
+static dds_security_fsm_state StateTimeout  = {doTimeout,  0};static int fsm_arg = FSM_AUTH_ARG;
 
-dds_security_fsm_transition timeout_transitions[] = {{NULL, DDS_SECURITY_FSM_EVENT_AUTO,       NULL,
-                                                                                 &StateTimeout}, // NULL state is the start state
-                                           {&StateTimeout, eventToTimeout, NULL, &StateInterupt},
-                                           {&StateInterupt,
-                                                           eventToEnd,     NULL, NULL}, // Reaching NULL means end of state-diagram
+static dds_security_fsm_state StateInterupt = {doInterupt, 0};
+
+static const dds_security_fsm_transition TimeoutTransitions[] = {
+    {NULL,          DDS_SECURITY_FSM_EVENT_AUTO, NULL, &StateTimeout},  // NULL state is the start state
+    {&StateTimeout, eventToTimeout,              NULL, &StateInterupt},
+    {&StateInterupt,eventToEnd,                  NULL, NULL},           // Reaching NULL means end of state-diagram
 };
+static const uint32_t TimeoutTransitionsSize = sizeof(TimeoutTransitions)/sizeof(TimeoutTransitions[0]);
+
+
+/**********************************************************************
+ * Parallel Timeout State Machines properties and methods
+ **********************************************************************/
+
+static struct dds_security_fsm *fsm_timeout1;
+static struct dds_security_fsm *fsm_timeout2;
+static struct dds_security_fsm *fsm_timeout3;
 
 static dds_time_t time0 = 0;
 static dds_time_t time1 = 0;
 static dds_time_t time2 = 0;
 static dds_time_t time3 = 0;
 
-static void StateParTime1(struct dds_security_fsm *fsm, void *arg) {
+static void StateParTime1(struct dds_security_fsm *fsm, void *arg)
+{
   DDSRT_UNUSED_ARG(fsm);
   DDSRT_UNUSED_ARG(arg);
   time1 = dds_time();
 }
 
-static void StateParTime2(struct dds_security_fsm *fsm, void *arg) {
+static void StateParTime2(struct dds_security_fsm *fsm, void *arg)
+{
   DDSRT_UNUSED_ARG(fsm);
   DDSRT_UNUSED_ARG(arg);
   time2 = dds_time();
 }
 
-static void StateParTime3(struct dds_security_fsm *fsm, void *arg) {
+static void StateParTime3(struct dds_security_fsm *fsm, void *arg)
+{
   DDSRT_UNUSED_ARG(fsm);
   DDSRT_UNUSED_ARG(arg);
   time3 = dds_time();
 }
 
-dds_security_fsm_state StateParTimeout1 = {NULL, DDS_NSECS_IN_SEC};
-dds_security_fsm_state StateParTimeout2 = {NULL, 2 * DDS_NSECS_IN_SEC};
-dds_security_fsm_state StateParTimeout3 = {NULL, DDS_NSECS_IN_SEC};
+static dds_security_fsm_state StateParTimeout1 = {NULL, DDS_SECS(1)};
+static dds_security_fsm_state StateParTimeout2 = {NULL, DDS_SECS(2)};
+static dds_security_fsm_state StateParTimeout3 = {NULL, DDS_SECS(1)};
 
-dds_security_fsm_transition par_timeout_transitions_1[] = {{NULL,              DDS_SECURITY_FSM_EVENT_AUTO,
-                                                         NULL, &StateParTimeout1}, // NULL state is the start state
-                                                 {&StateParTimeout1, DDS_SECURITY_FSM_EVENT_TIMEOUT, &StateParTime1, NULL}, // Reaching NULL means end of state-diagram
+static dds_security_fsm_transition ParallelTimeoutTransitions_1[] = {
+    {NULL,              DDS_SECURITY_FSM_EVENT_AUTO,    NULL,           &StateParTimeout1}, // NULL state is the startfsm_control_thread state
+    {&StateParTimeout1, DDS_SECURITY_FSM_EVENT_TIMEOUT, &StateParTime1, NULL},              // Reaching NULL means end of state-diagram
 };
+static const uint32_t ParallelTimeoutTransitionsSize_1 = sizeof(ParallelTimeoutTransitions_1) / sizeof(ParallelTimeoutTransitions_1[0]);
 
-dds_security_fsm_transition par_timeout_transitions_2[] = {{NULL,              DDS_SECURITY_FSM_EVENT_AUTO,
-                                                         NULL, &StateParTimeout2}, // NULL state is the start state
-                                                 {&StateParTimeout2, DDS_SECURITY_FSM_EVENT_TIMEOUT, &StateParTime2, NULL}, // Reaching NULL means end of state-diagram
+static dds_security_fsm_transition ParallelTimeoutTransitions_2[] = {
+    {NULL,              DDS_SECURITY_FSM_EVENT_AUTO,    NULL,           &StateParTimeout2}, // NULL state is the start state
+    {&StateParTimeout2, DDS_SECURITY_FSM_EVENT_TIMEOUT, &StateParTime2, NULL},              // Reaching NULL means end of state-diagram
 };
+static const uint32_t ParallelTimeoutTransitionsSize_2 = sizeof(ParallelTimeoutTransitions_2) / sizeof(ParallelTimeoutTransitions_2[0]);
 
-dds_security_fsm_transition par_timeout_transitions_3[] = {{NULL,              DDS_SECURITY_FSM_EVENT_AUTO,
-                                                         NULL, &StateParTimeout3}, // NULL state is the start state
-                                                 {&StateParTimeout3, DDS_SECURITY_FSM_EVENT_TIMEOUT, &StateParTime3, NULL}, // Reaching NULL means end of state-diagram
+static dds_security_fsm_transition ParallelTimeoutTransitions_3[] = {
+    {NULL,              DDS_SECURITY_FSM_EVENT_AUTO,    NULL,           &StateParTimeout3}, // NULL state is the start state
+    {&StateParTimeout3, DDS_SECURITY_FSM_EVENT_TIMEOUT, &StateParTime3, NULL},              // Reaching NULL means end of state-diagram
 };
+static const uint32_t ParallelTimeoutTransitionsSize_3 = sizeof(ParallelTimeoutTransitions_3) / sizeof(ParallelTimeoutTransitions_3[0]);
 
-int fsm_arg = FSM_AUTH_ARG;
-dds_time_t delay1 = DDS_NSECS_IN_SEC;
-dds_time_t delay2 = 2 * DDS_NSECS_IN_SEC;
-dds_time_t delay30 = 30 * DDS_NSECS_IN_SEC;
-int timeout;
-static const dds_duration_t msec100 = 100 * DDS_NSECS_IN_MSEC;
 
-static void init_testcase(void) {
-  (void) ddsrt_mutex_init(&stop_timeout_cond_mutex);
-  (void) ddsrt_cond_init(&stop_timeout_cond);
 
+
+static void fsm_control_init(void)
+{
+  dds_return_t rc;
+  struct dds_entity *e;
+
+  g_participant = dds_create_participant(DDS_DOMAIN_DEFAULT, NULL, NULL);
+  CU_ASSERT_FATAL(g_participant > 0);
+
+  rc = dds_entity_pin(g_participant, &e);
+  CU_ASSERT_FATAL(rc == 0);
+
+  g_fsm_control = dds_security_fsm_control_create (&e->m_domain->gv);
+  CU_ASSERT_FATAL (g_fsm_control != NULL);
+
+  dds_entity_unpin (e);
+
+  rc = dds_security_fsm_control_start (g_fsm_control, NULL);
+  CU_ASSERT_FATAL(rc == 0);
+
+  ddsrt_mutex_init(&stop_timeout_cond_mutex);
+  ddsrt_cond_init(&stop_timeout_cond);
 }
 
-static void fini_testcase(void) {
+static void fsm_control_fini(void)
+{
   ddsrt_cond_destroy(&stop_timeout_cond);
   ddsrt_mutex_destroy(&stop_timeout_cond_mutex);
+
+  dds_security_fsm_control_stop(g_fsm_control);
+  dds_security_fsm_control_free(g_fsm_control);
+
+  dds_delete(g_participant);
 }
 
-CU_Test(ddssec_fsm, create, .init = init_testcase, .fini = fini_testcase) {
+CU_Test(ddssec_fsm, create, .init = fsm_control_init, .fini = fsm_control_fini)
+{
+  dds_time_t delay30 = DDS_SECS(30);
+  int timeout;
 
   /*
    * Test single running state machine
    * Check creation of a single State Machine
    */
-
-  fsm_auth = dds_security_fsm_create(NULL, HandshakeTransistions,
-                           sizeof(HandshakeTransistions) / sizeof(HandshakeTransistions[0]),
-                           &fsm_arg);
+  fsm_auth = dds_security_fsm_create(g_fsm_control, HandshakeTransistions, HandshakeTransistionsSize, &fsm_arg);
   CU_ASSERT_FATAL(fsm_auth != NULL)
 
   // set a delay that doesn't expire. Should be terminate when fsm is freed.
@@ -506,21 +579,20 @@ CU_Test(ddssec_fsm, create, .init = init_testcase, .fini = fini_testcase) {
 
   // Wait for the last state to occur
   timeout = 100; /* 10 sec */
-  while ((dds_security_fsm_current_state(fsm_auth) != &StateHandshakeInitMessageWait)
-         && (timeout > 0)) {
+  while ((dds_security_fsm_current_state(fsm_auth) != &StateHandshakeInitMessageWait) && (timeout > 0)) {
     dds_sleepfor(msec100);
     timeout--;
   }
   CU_ASSERT(timeout > 0);
-  dds_security_fsm_dispatch(fsm_auth, SHM_MSG_RECEIVED);
+  dds_security_fsm_dispatch(fsm_auth, SHM_MSG_RECEIVED, false);
 
   timeout = 100; /* 10 sec */
   while ((dds_security_fsm_current_state(fsm_auth) != NULL) && (timeout > 0)) {
     dds_sleepfor(msec100);
     timeout--;
   }
-
   CU_ASSERT(timeout > 0);
+
   CU_ASSERT(
           CHECK_BIT(visited_auth, 0) && CHECK_BIT(visited_auth, 1) && CHECK_BIT(visited_auth, 2) &&
           CHECK_BIT(visited_auth, 3) && CHECK_BIT(visited_auth, 4) && CHECK_BIT(visited_auth, 5) &&
@@ -539,54 +611,61 @@ CU_Test(ddssec_fsm, create, .init = init_testcase, .fini = fini_testcase) {
 /*
  * Test multiple (2) running state machines
  */
-CU_Test(ddssec_fsm, multiple, .init = init_testcase, .fini = fini_testcase) {
+CU_Test(ddssec_fsm, multiple, .init = fsm_control_init, .fini = fsm_control_fini)
+{
+  int timeout;
 
   /*Check creation of multiple (2) State Machines*/
   validate_remote_identity_first = 0;
   begin_handshake_reply_first = 0;
   visited_auth = 0;
+  visited_test = 0;
+
+  fsm_auth = dds_security_fsm_create(g_fsm_control, HandshakeTransistions, HandshakeTransistionsSize, NULL);
+  CU_ASSERT_FATAL(fsm_auth != NULL);
+
+  fsm_test = dds_security_fsm_create(g_fsm_control, Transitions, TransitionsSize, NULL);
+  CU_ASSERT_FATAL(fsm_test != NULL);
 
-  fsm_auth = dds_security_fsm_create(NULL, HandshakeTransistions,
-                           sizeof(HandshakeTransistions) / sizeof(HandshakeTransistions[0]), NULL);
-  fsm_test = dds_security_fsm_create(NULL, transitions,
-                           sizeof(transitions) / sizeof(transitions[0]), NULL);
-  CU_ASSERT_FALSE(fsm_auth == NULL || fsm_test == NULL);
   dds_security_fsm_start(fsm_auth);
   dds_security_fsm_start(fsm_test);
 
-  /*Check the results of multiple running State Machines */
+  /* Check the results of multiple running State Machines */
 
-  // Wait for the last state to occur
+  /* Wait for the last state to occur */
   timeout = 100; /* 10 sec */
-  while ((dds_security_fsm_current_state(fsm_auth) != &StateHandshakeInitMessageWait)
-         && (timeout > 0)) {
+  while ((dds_security_fsm_current_state(fsm_auth) != &StateHandshakeInitMessageWait) && (timeout > 0)) {
     dds_sleepfor(100 * DDS_NSECS_IN_MSEC);
     timeout--;
   }
   CU_ASSERT_FATAL(timeout > 0);
+
   timeout = 100; /* 10 sec */
-  dds_security_fsm_dispatch(fsm_auth, SHM_MSG_RECEIVED);
+  dds_security_fsm_dispatch(fsm_auth, SHM_MSG_RECEIVED, false);
   while ((dds_security_fsm_current_state(fsm_auth) != NULL) && (timeout > 0)) {
     dds_sleepfor(100 * DDS_NSECS_IN_MSEC);
     timeout--;
   }
   CU_ASSERT_FATAL(timeout > 0);
+
   // not all bits are set since we're running the state machine a second time
   CU_ASSERT_FATAL(
           CHECK_BIT(visited_auth, 0) && !CHECK_BIT(visited_auth, 1) && CHECK_BIT(visited_auth, 2) &&
           !CHECK_BIT(visited_auth, 3) && CHECK_BIT(visited_auth, 4) && !CHECK_BIT(visited_auth, 5) &&
           CHECK_BIT(visited_auth, 6) && !CHECK_BIT(visited_auth, 7));
 
+  /* Wait for the last state to occur */
   timeout = 100; /* 10 sec */
-  // Wait for the last state to occur
   while ((dds_security_fsm_current_state(fsm_test) != NULL) && timeout > 0) {
     dds_sleepfor(100 * DDS_NSECS_IN_MSEC);
     timeout--;
   }
   CU_ASSERT_FATAL(timeout > 0);
-  CU_ASSERT_FATAL(
+
+  CU_ASSERT(
           CHECK_BIT(visited_test, 0) && CHECK_BIT(visited_test, 1) && CHECK_BIT(visited_test, 2) &&
           CHECK_BIT(visited_test, 3));
+
   dds_security_fsm_free(fsm_auth);
   dds_security_fsm_free(fsm_test);
 
@@ -595,13 +674,15 @@ CU_Test(ddssec_fsm, multiple, .init = init_testcase, .fini = fini_testcase) {
 /**
  * Check creation of State Machine for timeout purposes
  */
-CU_Test(ddssec_fsm, timeout, .init = init_testcase, .fini = fini_testcase) {
+CU_Test(ddssec_fsm, timeout, .init = fsm_control_init, .fini = fsm_control_fini)
+{
+  dds_time_t delay1 = DDS_SECS(1);
+  int timeout;
 
   /*
    * Test timeout monitoring of state machines
    */
-  fsm_timeout = dds_security_fsm_create(NULL, timeout_transitions,
-                              sizeof(timeout_transitions) / sizeof(timeout_transitions[0]), &fsm_arg);
+  fsm_timeout = dds_security_fsm_create(g_fsm_control, TimeoutTransitions, TimeoutTransitionsSize, &fsm_arg);
   CU_ASSERT(fsm_timeout != NULL);
 
   dds_security_fsm_set_timeout(fsm_timeout, TimeoutCallback, delay1);
@@ -627,15 +708,19 @@ CU_Test(ddssec_fsm, timeout, .init = init_testcase, .fini = fini_testcase) {
 /**
  * Check the double global timeout
  */
-CU_Test(ddssec_fsm, double_timeout, .init = init_testcase, .fini = fini_testcase) {
+CU_Test(ddssec_fsm, double_timeout, .init = fsm_control_init, .fini = fsm_control_fini)
+{
+  dds_time_t delay1 = DDS_SECS(1);
+  dds_time_t delay2 = DDS_SECS(2);
+  int timeout;
 
   visited_timeout = 0;
-  fsm_timeout = dds_security_fsm_create(NULL, timeout_transitions,
-                              sizeof(timeout_transitions) / sizeof(timeout_transitions[0]), &fsm_arg);
+  fsm_timeout = dds_security_fsm_create(g_fsm_control, TimeoutTransitions, TimeoutTransitionsSize, &fsm_arg);
   CU_ASSERT(fsm_timeout != NULL);
-  fsm_timeout2 = dds_security_fsm_create(NULL, timeout_transitions,
-                               sizeof(timeout_transitions) / sizeof(timeout_transitions[0]), &fsm_arg);
+
+  fsm_timeout2 = dds_security_fsm_create(g_fsm_control, TimeoutTransitions, TimeoutTransitionsSize, &fsm_arg);
   CU_ASSERT(fsm_timeout2 != NULL);
+
   dds_security_fsm_set_timeout(fsm_timeout, TimeoutCallback, delay1);
   dds_security_fsm_set_timeout(fsm_timeout2, TimeoutCallback2, delay2);
   dds_security_fsm_start(fsm_timeout);
@@ -646,7 +731,7 @@ CU_Test(ddssec_fsm, double_timeout, .init = init_testcase, .fini = fini_testcase
     timeout--;
   }
   CU_ASSERT(CHECK_BIT(visited_timeout, 2));
-  dds_security_fsm_cleanup(fsm_timeout);
+//  dds_security_fsm_cleanup(fsm_timeout);
   timeout = 100; /* 10 sec */
   while ((CHECK_BIT(visited_timeout, 3) == 0) && (timeout > 0)) {
     dds_sleepfor(100 * DDS_NSECS_IN_MSEC);
@@ -664,40 +749,41 @@ CU_Test(ddssec_fsm, double_timeout, .init = init_testcase, .fini = fini_testcase
 /**
  * Check parallel state timeouts
  */
-CU_Test(ddssec_fsm, parallel_timeout, .init = init_testcase, .fini = fini_testcase) {
-  visited_timeout = 0;
-  fsm_timeout = dds_security_fsm_create(NULL, par_timeout_transitions_1,
-                              sizeof(par_timeout_transitions_1) / sizeof(par_timeout_transitions_1[0]),
-                              &fsm_arg);
-  CU_ASSERT(fsm_timeout != NULL);
-  fsm_timeout2 = dds_security_fsm_create(NULL, par_timeout_transitions_2,
-                               sizeof(par_timeout_transitions_2) / sizeof(par_timeout_transitions_2[0]),
-                               &fsm_arg);
-  CU_ASSERT(fsm_timeout2 != NULL);
-  fsm_timeout3 = dds_security_fsm_create(NULL, par_timeout_transitions_3,
-                               sizeof(par_timeout_transitions_3) / sizeof(par_timeout_transitions_3[0]),
-                               &fsm_arg);
-  CU_ASSERT(fsm_timeout3 != NULL);
+CU_Test(ddssec_fsm, parallel_timeout, .init = fsm_control_init, .fini = fsm_control_fini)
+{
   dds_duration_t delta1;
   dds_duration_t delta2;
   dds_duration_t delta3;
+  int timeout;
+
+  visited_timeout = 0;
+
+  fsm_timeout1 = dds_security_fsm_create(g_fsm_control, ParallelTimeoutTransitions_1, ParallelTimeoutTransitionsSize_1, &fsm_arg);
+  CU_ASSERT_FATAL(fsm_timeout1 != NULL);
+
+  fsm_timeout2 = dds_security_fsm_create(g_fsm_control, ParallelTimeoutTransitions_2, ParallelTimeoutTransitionsSize_2, &fsm_arg);
+  CU_ASSERT_FATAL(fsm_timeout2 != NULL);
+
+  fsm_timeout3 = dds_security_fsm_create(g_fsm_control, ParallelTimeoutTransitions_3, ParallelTimeoutTransitionsSize_3, &fsm_arg);
+  CU_ASSERT_FATAL(fsm_timeout3 != NULL);
 
   time0 = dds_time();
-  dds_security_fsm_start(fsm_timeout);
+  dds_security_fsm_start(fsm_timeout1);
   dds_security_fsm_start(fsm_timeout2);
   dds_security_fsm_start(fsm_timeout3);
 
   /* Wait for both to end. */
-  timeout = 100; /* 10 sec */
+  timeout = 300; /* 10 sec */
   /* First, they have to be started. */
-  while (((dds_security_fsm_current_state(fsm_timeout) == NULL)
+  while (((dds_security_fsm_current_state(fsm_timeout1) == NULL)
           || (dds_security_fsm_current_state(fsm_timeout2) == NULL)
           || (dds_security_fsm_current_state(fsm_timeout3) == NULL)) && (timeout > 0)) {
     dds_sleepfor(100 * DDS_NSECS_IN_MSEC);
     timeout--;
   }
+
   /* Then, they have to have ended. */
-  while (((dds_security_fsm_current_state(fsm_timeout) != NULL)
+  while (((dds_security_fsm_current_state(fsm_timeout1) != NULL)
           || (dds_security_fsm_current_state(fsm_timeout2) != NULL)
           || (dds_security_fsm_current_state(fsm_timeout3) != NULL)) && (timeout > 0)) {
     dds_sleepfor(100 * DDS_NSECS_IN_MSEC);
@@ -727,7 +813,7 @@ CU_Test(ddssec_fsm, parallel_timeout, .init = init_testcase, .fini = fini_testca
   CU_ASSERT(delta3 > 750 * DDS_NSECS_IN_MSEC);
   CU_ASSERT(delta3 < 1250 * DDS_NSECS_IN_MSEC);
 
-  dds_security_fsm_free(fsm_timeout);
+  dds_security_fsm_free(fsm_timeout1);
   dds_security_fsm_free(fsm_timeout2);
   dds_security_fsm_free(fsm_timeout3);
 
@@ -736,11 +822,13 @@ CU_Test(ddssec_fsm, parallel_timeout, .init = init_testcase, .fini = fini_testca
 /**
  * Delete with event timeout
  */
-CU_Test(ddssec_fsm, delete_with_timeout, .init = init_testcase, .fini = fini_testcase) {
+CU_Test(ddssec_fsm, delete_with_timeout, .init = fsm_control_init, .fini = fsm_control_fini)
+{
+  int timeout;
+
+  fsm_timeout = dds_security_fsm_create(g_fsm_control, TimeoutTransitions, TimeoutTransitionsSize, &fsm_arg);
+  CU_ASSERT (fsm_timeout != NULL)
 
-  fsm_timeout = dds_security_fsm_create(NULL, timeout_transitions,
-                              sizeof(timeout_transitions) / sizeof(timeout_transitions[0]), &fsm_arg);
-  CU_ASSERT (fsm_timeout != NULL);
   visited_timeout = 0;
   dds_security_fsm_start(fsm_timeout);
 

From 97c3025e54db892e6c03129248bf218336a3cd91 Mon Sep 17 00:00:00 2001
From: Joao Rebelo <jrebelo@s2e-systems.com>
Date: Mon, 25 Nov 2019 13:07:34 +0100
Subject: [PATCH 092/238] Add timed callback dispatcher to security core

Dispatchers are added to a custom linked list while each dispatcher owns a
fibheap of callbacks that are ordered by expiry timestamp. A seperate
fibheap is use for each dispatcher to allow disabling and enabling of
each dispatcher. A new and free function is added that creates a
timed_cd_data object that is used by every public function. A thread is
initialized at object creation instead of using a counter. Add
a protection for the terminate flag.

Signed-off-by: Joao Rebelo <jrebelo@s2e-systems.com>
---
 src/security/core/CMakeLists.txt              |  10 +-
 .../dds/security/core/dds_security_timed_cb.h | 183 ++++++
 src/security/core/src/dds_security_timed_cb.c | 329 +++++++++++
 src/security/core/tests/CMakeLists.txt        |   1 +
 src/security/core/tests/dds_security_core.c   | 546 ++++++++++++++++++
 5 files changed, 1066 insertions(+), 3 deletions(-)
 create mode 100644 src/security/core/include/dds/security/core/dds_security_timed_cb.h
 create mode 100644 src/security/core/src/dds_security_timed_cb.c
 create mode 100644 src/security/core/tests/dds_security_core.c

diff --git a/src/security/core/CMakeLists.txt b/src/security/core/CMakeLists.txt
index 836bc70..8719946 100644
--- a/src/security/core/CMakeLists.txt
+++ b/src/security/core/CMakeLists.txt
@@ -15,6 +15,7 @@ PREPEND(srcs_security_core "${CMAKE_CURRENT_LIST_DIR}/src"
     dds_security_plugins.c
     shared_secret.c
     dds_security_fsm.c
+    dds_security_timed_cb.c
 )
  
 PREPEND(hdrs_public_security_core "${CMAKE_CURRENT_LIST_DIR}/include/security/core"
@@ -24,6 +25,7 @@ PREPEND(hdrs_public_security_core "${CMAKE_CURRENT_LIST_DIR}/include/security/co
     dds_security_plugins.h
     dds_security_fsm.h
     shared_secret.h
+    dds_security_timed_cb.h
 )
 
 if(NOT WIN32)
@@ -49,10 +51,12 @@ target_include_directories(security_core
 )
 #target_link_libraries(security_core PRIVATE ddsrt security_api)
 
+if(BUILD_TESTING)
+  add_subdirectory(tests)
+  add_subdirectory(tests/plugin_loading)
+endif()
+
 install(
   DIRECTORY "${CMAKE_CURRENT_LIST_DIR}/include/dds/security/core/"
   DESTINATION "${CMAKE_INSTALL_INCLUDEDIR}/dds/security/core/"
   COMPONENT dev)
-
-add_subdirectory(tests)
-add_subdirectory(tests/plugin_loading)
diff --git a/src/security/core/include/dds/security/core/dds_security_timed_cb.h b/src/security/core/include/dds/security/core/dds_security_timed_cb.h
new file mode 100644
index 0000000..6a883d6
--- /dev/null
+++ b/src/security/core/include/dds/security/core/dds_security_timed_cb.h
@@ -0,0 +1,183 @@
+/*
+ * Copyright(c) 2006 to 2019 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+
+#ifndef DDS_SECURITY_TIMED_CALLBACK_H
+#define DDS_SECURITY_TIMED_CALLBACK_H
+
+#include "dds/export.h"
+#include "dds/ddsrt/time.h"
+
+#if defined (__cplusplus)
+extern "C" {
+#endif
+
+/**
+ * The dispatcher that will trigger the timed callbacks.
+ */
+struct dds_security_timed_dispatcher_t;
+
+struct dds_security_timed_cb_data_t;
+
+/**
+ * The callback is triggered by two causes:
+ * 1. The trigger timeout has been reached.
+ * 2. The related dispatcher is being deleted.
+ */
+typedef enum {
+    DDS_SECURITY_TIMED_CB_KIND_TIMEOUT,
+    DDS_SECURITY_TIMED_CB_KIND_DELETE
+} dds_security_timed_cb_kind;
+
+
+
+/**
+ * Template for the timed callback functions.
+ * It is NOT allowed to call any t_timed_cb API functions from within this
+ * callback context.
+ *
+ * This will be called when the trigger time of the added callback is reached,
+ * or if the related dispatcher is deleted. The latter can be used to clean up
+ * possible callback resources.
+ *
+ * @param d             Related dispatcher.
+ * @param kind          Triggered by cb timeout or dispatcher deletion.
+ * @param listener      Listener that was provided when enabling the related
+ *                      dispatcher (NULL with a deletion trigger).
+ * @param arg           User data, provided when adding a callback to the
+ *                      related dispatcher.
+ */
+typedef void
+(*dds_security_timed_cb_t) (
+        struct dds_security_timed_dispatcher_t *d,
+        dds_security_timed_cb_kind kind,
+        void *listener,
+        void *arg);
+
+DDS_EXPORT struct dds_security_timed_cb_data*
+dds_security_timed_cb_new(void);
+
+DDS_EXPORT void
+dds_security_timed_cb_free(
+        struct dds_security_timed_cb_data *dl);
+
+/**
+ * Create a new dispatcher for timed callbacks.
+ * The dispatcher is not enabled (see dds_security_timed_dispatcher_enable).
+ *
+ * @return              New (disabled) timed callbacks dispatcher.
+ */
+DDS_EXPORT struct dds_security_timed_dispatcher_t*
+dds_security_timed_dispatcher_new(
+        struct dds_security_timed_cb_data *tcb);
+
+/**
+ * Frees the given dispatcher.
+ * If the dispatcher contains timed callbacks, then these will be
+ * triggered with DDS_SECURITY_TIMED_CB_KIND_DELETE and then removed. This
+ * is done whether the dispatcher is enabled or not.
+ *
+ * @param d             The dispatcher to free.
+ * 
+ */
+DDS_EXPORT void
+dds_security_timed_dispatcher_free(
+        struct dds_security_timed_cb_data *tcb,
+        struct dds_security_timed_dispatcher_t *d);
+
+
+
+/**
+ * Enables a dispatcher for timed callbacks.
+ *
+ * Until a dispatcher is enabled, no DDS_SECURITY_TIMED_CB_KIND_TIMEOUT callbacks will
+ * be triggered.
+ * As soon as it is enabled, possible stored timed callbacks that are in the
+ * past will be triggered at that moment.
+ * Also, from this point on, possible future callbacks will also be triggered
+ * when the appropriate time has been reached.
+ *
+ * A listener argument can be supplied that is returned when the callback
+ * is triggered. The dispatcher doesn't do anything more with it, so it may
+ * be NULL.
+ *
+ * DDS_SECURITY_TIMED_CB_KIND_DELETE callbacks will always be triggered despite the
+ * dispatcher being possibly disabled.
+ *
+ * @param d             The dispatcher to enable.
+ * @param listener      An object that is returned with the callback.
+ *
+ */
+DDS_EXPORT void
+dds_security_timed_dispatcher_enable(
+        struct dds_security_timed_cb_data *tcb,
+        struct dds_security_timed_dispatcher_t *d,
+        void *listener);
+
+
+
+/**
+ * Disables a dispatcher for timed callbacks.
+ *
+ * When a dispatcher is disabled (default after creation), it will not
+ * trigger any related callbacks. It will still store them, however, so
+ * that they can be triggered after a (re)enabling.
+ *
+ * This is when the callback is actually triggered by a timeout and thus
+ * its kind is DDS_SECURITY_TIMED_CB_KIND_TIMEOUT. DDS_SECURITY_TIMED_CB_KIND_DELETE callbacks
+ * will always be triggered despite the dispatcher being possibly disabled.
+ *
+ * @param d             The dispatcher to disable.
+ *
+ */
+DDS_EXPORT void
+dds_security_timed_dispatcher_disable(
+        struct dds_security_timed_cb_data *tcb,
+        struct dds_security_timed_dispatcher_t *d);
+
+
+
+/**
+ * Adds a timed callback to a dispatcher.
+ *
+ * The given callback will be triggered with DDS_SECURITY_TIMED_CB_KIND_TIMEOUT when:
+ *  1. The dispatcher is enabled and
+ *  2. The trigger_time has been reached.
+ *
+ * If the trigger_time lays in the past, then the callback is still added.
+ * When the dispatcher is already enabled, it will trigger this 'past'
+ * callback immediately. Otherwise, the 'past' callback will be triggered
+ * at the moment that the dispatcher is enabled.
+ *
+ * The given callback will be triggered with DDS_SECURITY_TIMED_CB_KIND_DELETE when:
+ *  1. The related dispatcher is deleted (ignoring enable/disable).
+ *
+ * This is done so that possible related callback resources can be freed.
+ *
+ * @param d             The dispatcher to add the callback to.
+ * @param cb            The actual callback function.
+ * @param trigger_time  A wall-clock time of when to trigger the callback.
+ * @param arg           User data that is provided with the callback.
+ *
+ */
+DDS_EXPORT void
+dds_security_timed_dispatcher_add(
+        struct dds_security_timed_cb_data *tcb,
+        struct dds_security_timed_dispatcher_t *d,
+        dds_security_timed_cb_t cb,
+        dds_time_t trigger_time,
+        void *arg);
+
+#if defined (__cplusplus)
+}
+#endif
+
+#endif /* DDS_SECURITY_TIMED_CALLBACK_H */
diff --git a/src/security/core/src/dds_security_timed_cb.c b/src/security/core/src/dds_security_timed_cb.c
new file mode 100644
index 0000000..a8bfb0e
--- /dev/null
+++ b/src/security/core/src/dds_security_timed_cb.c
@@ -0,0 +1,329 @@
+/*
+ * Copyright(c) 2006 to 2019 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <assert.h>
+
+#include "dds/ddsrt/atomics.h"
+#include "dds/ddsrt/heap.h"
+#include "dds/ddsrt/log.h"
+#include "dds/ddsrt/sync.h"
+#include "dds/ddsrt/threads.h"
+#include "dds/ddsrt/time.h"
+#include "dds/ddsrt/fibheap.h"
+
+
+#include "dds/security/core/dds_security_timed_cb.h"
+
+
+struct dds_security_timed_dispatcher_t
+{
+    bool active;
+    void *listener;
+    ddsrt_fibheap_t events;
+};
+
+struct list_dispatcher_t
+{
+    struct list_dispatcher_t *next;
+    struct dds_security_timed_dispatcher_t *dispatcher;
+};
+
+struct event_t
+{
+    ddsrt_fibheap_node_t heapnode;
+    dds_security_timed_cb_t callback;
+    dds_time_t trigger_time;
+    void *arg;
+};
+
+static int compare_timed_cb_trigger_time(const void *va, const void *vb);
+static const ddsrt_fibheap_def_t timed_cb_queue_fhdef = DDSRT_FIBHEAPDEF_INITIALIZER(offsetof(struct event_t, heapnode), compare_timed_cb_trigger_time);
+
+static int compare_timed_cb_trigger_time(const void *va, const void *vb)
+{
+    const struct event_t *a = va;
+    const struct event_t *b = vb;
+    return (a->trigger_time == b->trigger_time) ? 0 : (a->trigger_time < b->trigger_time) ? -1 : 1;
+}
+
+struct dds_security_timed_cb_data {
+    ddsrt_mutex_t lock;
+    ddsrt_cond_t  cond;
+    struct list_dispatcher_t *first_dispatcher_node;
+    ddsrt_thread_t thread;
+    bool terminate;
+};
+
+
+static uint32_t timed_dispatcher_thread(
+        void *tcbv)
+{
+    struct list_dispatcher_t *dispatcher_node;
+    struct event_t *event;
+    dds_duration_t timeout;
+    dds_duration_t remain_time;
+    struct dds_security_timed_cb_data *tcb = (struct dds_security_timed_cb_data *)tcbv;
+
+    ddsrt_mutex_lock(&tcb->lock);
+    do
+    {
+        remain_time = DDS_INFINITY;
+        for (dispatcher_node = tcb->first_dispatcher_node; dispatcher_node != NULL; dispatcher_node = dispatcher_node->next)
+        {
+            /* Just some sanity checks. */
+            assert(dispatcher_node->dispatcher);
+            if (dispatcher_node->dispatcher->active)
+            {
+                do
+                {
+                    timeout = DDS_INFINITY;
+                    event = ddsrt_fibheap_min(&timed_cb_queue_fhdef, &dispatcher_node->dispatcher->events);
+                    if (event)
+                    {
+                        /* Just some sanity checks. */
+                        assert(event->callback);
+                        /* Determine the trigger timeout of this callback. */
+                        timeout = event->trigger_time - dds_time();
+                        if (timeout <= 0)
+                        {
+                            /* Trigger callback when related dispatcher is active. */
+                            event->callback(dispatcher_node->dispatcher,
+                                            DDS_SECURITY_TIMED_CB_KIND_TIMEOUT,
+                                            dispatcher_node->dispatcher->listener,
+                                            event->arg);
+
+                            /* Remove handled event from queue, continue with next. */
+                            ddsrt_fibheap_delete(&timed_cb_queue_fhdef, &dispatcher_node->dispatcher->events, event);
+                            ddsrt_free(event);
+                        }
+                        else if (timeout < remain_time)
+                        {
+                            remain_time = timeout;
+                        }
+                    }
+                }
+                while (timeout < 0);
+            }
+        }
+        // tcb->cond condition may be triggered before this thread runs and causes
+        // this waitfor to wait infinity, hence the check of the tcb->terminate
+        if (((remain_time > 0) || (remain_time == DDS_INFINITY)) && !tcb->terminate)
+        {
+            /* Wait for new event, timeout or the end. */
+            (void)ddsrt_cond_waitfor(&tcb->cond, &tcb->lock, remain_time);
+        }
+
+    } while (!tcb->terminate);
+
+    ddsrt_mutex_unlock(&tcb->lock);
+
+    return 0;
+}
+
+struct dds_security_timed_cb_data*
+dds_security_timed_cb_new()
+{
+    struct dds_security_timed_cb_data *tcb = ddsrt_malloc(sizeof(*tcb));
+    dds_return_t osres;
+    ddsrt_threadattr_t attr;
+
+    ddsrt_mutex_init(&tcb->lock);
+    ddsrt_cond_init(&tcb->cond);
+    tcb->first_dispatcher_node = NULL;
+    tcb->terminate = false;
+
+    ddsrt_threadattr_init(&attr);
+    osres = ddsrt_thread_create(&tcb->thread, "security_dispatcher", &attr, timed_dispatcher_thread, (void*)tcb);
+    if (osres != DDS_RETCODE_OK)
+    {
+        DDS_FATAL("Cannot create thread security_dispatcher");
+    }
+
+    return tcb;
+}
+
+void
+dds_security_timed_cb_free(
+        struct dds_security_timed_cb_data *tcb)
+{
+    ddsrt_mutex_lock(&tcb->lock);
+    tcb->terminate = true;
+    ddsrt_mutex_unlock(&tcb->lock);
+    ddsrt_cond_signal(&tcb->cond);
+    ddsrt_thread_join(tcb->thread, NULL);
+
+    ddsrt_cond_destroy(&tcb->cond);
+    ddsrt_mutex_destroy(&tcb->lock);
+    ddsrt_free(tcb);
+}
+
+
+struct dds_security_timed_dispatcher_t*
+dds_security_timed_dispatcher_new(
+        struct dds_security_timed_cb_data *tcb)
+{
+    struct dds_security_timed_dispatcher_t *d;
+    struct list_dispatcher_t *dispatcher_node_new;
+    struct list_dispatcher_t *dispatcher_node_wrk;
+
+    /* New dispatcher. */
+    d = ddsrt_malloc(sizeof(struct dds_security_timed_dispatcher_t));
+    memset(d, 0, sizeof(struct dds_security_timed_dispatcher_t));
+
+    ddsrt_fibheap_init(&timed_cb_queue_fhdef, &d->events);
+
+    dispatcher_node_new = ddsrt_malloc(sizeof(struct list_dispatcher_t));
+    memset(dispatcher_node_new, 0, sizeof(struct list_dispatcher_t));
+    dispatcher_node_new->dispatcher = d;
+
+    ddsrt_mutex_lock(&tcb->lock);
+
+    /* Append to list */
+    if (tcb->first_dispatcher_node) {
+        struct list_dispatcher_t *last = NULL;
+        for (dispatcher_node_wrk = tcb->first_dispatcher_node; dispatcher_node_wrk != NULL; dispatcher_node_wrk = dispatcher_node_wrk->next) {
+            last = dispatcher_node_wrk;
+        }
+        last->next = dispatcher_node_new;
+    } else {
+        /* This new event is the first one. */
+        tcb->first_dispatcher_node = dispatcher_node_new;
+    }
+
+    ddsrt_mutex_unlock(&tcb->lock);
+
+
+    return d;
+}
+
+void
+dds_security_timed_dispatcher_free(
+        struct dds_security_timed_cb_data *tcb,
+        struct dds_security_timed_dispatcher_t *d)
+{
+    struct event_t *event;
+    struct list_dispatcher_t *dispatcher_node;
+    struct list_dispatcher_t *dispatcher_node_prev;
+
+    assert(d);
+
+    /* Remove related events from queue. */
+    ddsrt_mutex_lock(&tcb->lock);
+
+    while((event = ddsrt_fibheap_extract_min(&timed_cb_queue_fhdef, &d->events)) != NULL)
+    {
+        event->callback(d, DDS_SECURITY_TIMED_CB_KIND_DELETE, NULL, event->arg);
+        ddsrt_free(event);
+    }
+
+    /* Remove dispatcher from list */
+    dispatcher_node_prev = NULL;
+    for (dispatcher_node = tcb->first_dispatcher_node; dispatcher_node != NULL; dispatcher_node = dispatcher_node->next)
+    {
+        if (dispatcher_node->dispatcher == d)
+        {
+            /* remove element */
+            if (dispatcher_node_prev != NULL)
+            {
+                dispatcher_node_prev->next = dispatcher_node->next;
+            }
+            else
+            {
+                tcb->first_dispatcher_node = dispatcher_node->next;
+            }
+
+            ddsrt_free(dispatcher_node);
+            break;
+        }
+        dispatcher_node_prev = dispatcher_node;
+    }
+    /* Free this dispatcher. */
+    ddsrt_free(d);
+
+    ddsrt_mutex_unlock(&tcb->lock);
+
+}
+
+
+void
+dds_security_timed_dispatcher_enable(
+        struct dds_security_timed_cb_data *tcb,
+        struct dds_security_timed_dispatcher_t *d,
+        void *listener)
+{
+    assert(d);
+    assert(!(d->active));
+
+    ddsrt_mutex_lock(&tcb->lock);
+
+    /* Remember possible listener and activate. */
+    d->listener = listener;
+    d->active = true;
+
+    /* Start thread when not running, otherwise wake it up to
+     * trigger callbacks that were (possibly) previously added. */
+    ddsrt_cond_signal(&tcb->cond);
+
+    ddsrt_mutex_unlock(&tcb->lock);
+}
+
+
+void
+dds_security_timed_dispatcher_disable(
+        struct dds_security_timed_cb_data *tcb,
+        struct dds_security_timed_dispatcher_t *d)
+{
+    assert(d);
+    assert(d->active);
+
+    ddsrt_mutex_lock(&tcb->lock);
+
+    /* Forget listener and deactivate. */
+    d->listener = NULL;
+    d->active = false;
+
+    ddsrt_mutex_unlock(&tcb->lock);
+}
+
+
+void
+dds_security_timed_dispatcher_add(
+        struct dds_security_timed_cb_data *tcb,
+        struct dds_security_timed_dispatcher_t *d,
+        dds_security_timed_cb_t cb,
+        dds_time_t trigger_time,
+        void *arg)
+{
+    struct event_t *event_new;
+
+    assert(d);
+    assert(cb);
+
+    /* Create event. */
+    event_new = ddsrt_malloc(sizeof(struct event_t));
+    memset(event_new, 0, sizeof(struct event_t));
+    event_new->trigger_time = trigger_time;
+    event_new->callback = cb;
+    event_new->arg = arg;
+
+    /* Insert event based on trigger_time. */
+    ddsrt_mutex_lock(&tcb->lock);
+    ddsrt_fibheap_insert(&timed_cb_queue_fhdef, &d->events, event_new);
+    ddsrt_mutex_unlock(&tcb->lock);
+
+    /* Wake up thread (if it's running). */
+    ddsrt_cond_signal(&tcb->cond);
+}
+
diff --git a/src/security/core/tests/CMakeLists.txt b/src/security/core/tests/CMakeLists.txt
index 40a6650..9cd0e27 100644
--- a/src/security/core/tests/CMakeLists.txt
+++ b/src/security/core/tests/CMakeLists.txt
@@ -14,6 +14,7 @@ include (CUnit)
 
 set(security_core_test_sources
     "tc_fsm.c"
+    "dds_security_core.c"
   )
 
 add_definitions(-DDDSI_INCLUDE_SECURITY)
diff --git a/src/security/core/tests/dds_security_core.c b/src/security/core/tests/dds_security_core.c
new file mode 100644
index 0000000..ac494c2
--- /dev/null
+++ b/src/security/core/tests/dds_security_core.c
@@ -0,0 +1,546 @@
+/*
+ * Copyright(c) 2019 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+
+#include <stdio.h>
+#include "CUnit/Test.h"
+
+#include "dds/security/core/dds_security_timed_cb.h"
+#include "dds/ddsrt/misc.h"
+
+#define SEQ_SIZE (16)
+
+typedef struct {
+    struct dds_security_timed_dispatcher_t *d;
+    dds_security_timed_cb_kind kind;
+    void *listener;
+    void *arg;
+    dds_time_t time;
+} tc__sequence_data;
+
+static int g_sequence_idx = 0;
+static tc__sequence_data g_sequence_array[SEQ_SIZE];
+
+static void simple_callback(struct dds_security_timed_dispatcher_t *d,
+        dds_security_timed_cb_kind kind,
+        void *listener,
+        void *arg)
+{
+    DDSRT_UNUSED_ARG(d);
+    DDSRT_UNUSED_ARG(kind);
+    DDSRT_UNUSED_ARG(listener);
+
+    if (*((bool *)arg) == false)
+    {
+        *((bool *)arg) = true;
+    }
+    else
+    {
+        *((bool *)arg) = false;
+    }
+}
+
+static int g_order_callback_idx = 0;
+static void* g_order_callback[2] = {(void*)NULL, (void*)NULL};
+static void order_callback(struct dds_security_timed_dispatcher_t *d,
+        dds_security_timed_cb_kind kind,
+        void *listener,
+        void *arg)
+{
+    DDSRT_UNUSED_ARG(d);
+    DDSRT_UNUSED_ARG(kind);
+    DDSRT_UNUSED_ARG(listener);
+
+    g_order_callback[g_order_callback_idx] = arg;
+    g_order_callback_idx++;
+}
+
+static void
+tc__callback(
+        struct dds_security_timed_dispatcher_t *d,
+        dds_security_timed_cb_kind kind,
+        void *listener,
+        void *arg)
+{
+    if (g_sequence_idx < SEQ_SIZE) {
+        g_sequence_array[g_sequence_idx].d = d;
+        g_sequence_array[g_sequence_idx].arg = arg;
+        g_sequence_array[g_sequence_idx].kind = kind;
+        g_sequence_array[g_sequence_idx].listener = listener;
+        g_sequence_array[g_sequence_idx].time = dds_time();
+    }
+    g_sequence_idx++;
+}
+
+CU_Test(dds_security_timed_cb, simple_test)
+{
+    struct dds_security_timed_cb_data *tcb = dds_security_timed_cb_new();
+    struct dds_security_timed_dispatcher_t *d1 = NULL;
+    static bool test_var = false;
+
+    dds_time_t now     = dds_time();
+    dds_time_t future  = now + DDS_SECS(2);
+
+    d1 = dds_security_timed_dispatcher_new(tcb);
+
+    CU_ASSERT_PTR_NOT_NULL_FATAL(d1);
+
+    dds_security_timed_dispatcher_add(tcb, d1, simple_callback, future, (void*)&test_var);
+
+    dds_security_timed_dispatcher_enable(tcb, d1, (void*)NULL);
+
+    CU_ASSERT_FALSE_FATAL(test_var);
+
+    dds_sleepfor(DDS_MSECS(500));
+
+    CU_ASSERT_FALSE_FATAL(test_var);
+
+    dds_sleepfor(DDS_SECS(2));
+
+    CU_ASSERT_TRUE_FATAL(test_var);
+
+    dds_security_timed_dispatcher_free(tcb, d1);
+
+    dds_security_timed_cb_free(tcb);
+}
+
+CU_Test(dds_security_timed_cb, simple_order)
+{
+    struct dds_security_timed_cb_data *tcb = dds_security_timed_cb_new();
+    struct dds_security_timed_dispatcher_t *d1 = NULL;
+    dds_time_t future;
+    dds_time_t future2;
+
+    d1 = dds_security_timed_dispatcher_new(tcb);
+    CU_ASSERT_PTR_NOT_NULL_FATAL(d1);
+    future  = dds_time() + DDS_MSECS(20);
+    future2  = future;
+    dds_security_timed_dispatcher_add(tcb, d1, order_callback, future, (void*)1);
+    dds_security_timed_dispatcher_add(tcb, d1, order_callback, future2, (void*)2);
+    dds_security_timed_dispatcher_enable(tcb, d1, (void*)&g_order_callback);
+    dds_sleepfor(DDS_MSECS(10));
+
+    dds_security_timed_dispatcher_free(tcb, d1);
+
+    CU_ASSERT_EQUAL_FATAL(g_order_callback[0], (void*)1);
+    CU_ASSERT_EQUAL_FATAL(g_order_callback[1], (void*)2);
+
+    dds_security_timed_cb_free(tcb);
+}
+
+CU_Test(dds_security_timed_cb, test_enabled_and_disabled)
+{
+    struct dds_security_timed_cb_data *tcb = dds_security_timed_cb_new();
+    struct dds_security_timed_dispatcher_t *d1 = NULL;
+    static bool test_var = false;
+
+    dds_time_t now     = dds_time();
+    dds_time_t future  = now + DDS_SECS(2);
+
+    d1 = dds_security_timed_dispatcher_new(tcb);
+
+    CU_ASSERT_PTR_NOT_NULL_FATAL(d1);
+
+    dds_security_timed_dispatcher_add(tcb, d1, simple_callback, future, (void*)&test_var);
+
+    dds_security_timed_dispatcher_enable(tcb, d1, (void*)NULL);
+
+    CU_ASSERT_FALSE(test_var);
+
+    dds_security_timed_dispatcher_disable(tcb, d1);
+
+    dds_sleepfor(DDS_MSECS(500));
+
+    CU_ASSERT_FALSE(test_var);
+
+    dds_sleepfor(DDS_SECS(2));
+
+    CU_ASSERT_FALSE(test_var);
+
+    dds_security_timed_dispatcher_free(tcb, d1);
+
+    dds_security_timed_cb_free(tcb);
+}
+
+CU_Test(dds_security_timed_cb, simple_test_with_future)
+{
+    struct dds_security_timed_cb_data *tcb = dds_security_timed_cb_new();
+    struct dds_security_timed_dispatcher_t *d1 = NULL;
+    static bool test_var = false;
+
+    dds_time_t now     = dds_time();
+    dds_time_t future  = now + DDS_SECS(2);
+    dds_time_t far_future  = now + DDS_SECS(10);
+
+    d1 = dds_security_timed_dispatcher_new(tcb);
+
+    CU_ASSERT_PTR_NOT_NULL_FATAL(d1);
+
+    dds_security_timed_dispatcher_enable(tcb, d1, (void*)NULL);
+
+    dds_security_timed_dispatcher_add(tcb, d1, simple_callback, future, (void*)&test_var);
+    dds_security_timed_dispatcher_add(tcb, d1, simple_callback, far_future, (void*)&test_var);
+
+    CU_ASSERT_FALSE_FATAL(test_var);
+
+    dds_sleepfor(DDS_MSECS(500));
+
+    CU_ASSERT_FALSE_FATAL(test_var);
+
+    dds_sleepfor(DDS_SECS(2));
+
+    CU_ASSERT_TRUE_FATAL(test_var);
+
+    dds_security_timed_dispatcher_free(tcb, d1);
+
+    dds_security_timed_cb_free(tcb);
+}
+
+CU_Test(dds_security_timed_cb, test_multiple_dispatchers)
+{
+    struct dds_security_timed_cb_data *tcb = dds_security_timed_cb_new();
+    struct dds_security_timed_dispatcher_t *d1 = NULL;
+    struct dds_security_timed_dispatcher_t *d2 = NULL;
+    static bool test_var = false;
+
+    dds_time_t now     = dds_time();
+    dds_time_t future  = now + DDS_SECS(2);
+    dds_time_t far_future  = now + DDS_SECS(10);
+
+    d1 = dds_security_timed_dispatcher_new(tcb);
+    d2 = dds_security_timed_dispatcher_new(tcb);
+
+    CU_ASSERT_PTR_NOT_NULL_FATAL(d1);
+
+    dds_security_timed_dispatcher_enable(tcb, d1, (void*)NULL);
+    dds_security_timed_dispatcher_enable(tcb, d2, (void*)NULL);
+
+    dds_security_timed_dispatcher_free(tcb, d2);
+
+    dds_security_timed_dispatcher_add(tcb, d1, simple_callback, future, (void*)&test_var);
+    dds_security_timed_dispatcher_add(tcb, d1, simple_callback, far_future, (void*)&test_var);
+
+    CU_ASSERT_FALSE_FATAL(test_var);
+
+    dds_sleepfor(DDS_MSECS(500));
+
+    CU_ASSERT_FALSE_FATAL(test_var);
+
+    dds_sleepfor(DDS_SECS(2));
+
+    CU_ASSERT_TRUE_FATAL(test_var);
+
+    dds_security_timed_dispatcher_free(tcb, d1);
+
+    dds_security_timed_cb_free(tcb);
+}
+
+CU_Test(dds_security_timed_cb, test_not_enabled_multiple_dispatchers)
+{
+    struct dds_security_timed_cb_data *tcb = dds_security_timed_cb_new();
+    struct dds_security_timed_dispatcher_t *d1 = NULL;
+    struct dds_security_timed_dispatcher_t *d2 = NULL;
+
+    d1 = dds_security_timed_dispatcher_new(tcb);
+    d2 = dds_security_timed_dispatcher_new(tcb);
+
+    CU_ASSERT_PTR_NOT_NULL_FATAL(d1);
+    CU_ASSERT_PTR_NOT_NULL_FATAL(d2);
+
+    dds_security_timed_dispatcher_free(tcb, d2);
+
+    dds_security_timed_dispatcher_free(tcb, d1);
+
+    dds_security_timed_cb_free(tcb);
+
+    CU_PASS("Timed callbacks enabled and disabled without add");
+}
+
+CU_Test(dds_security_timed_cb, test_create_dispatcher)
+{
+    struct dds_security_timed_cb_data *tcb = dds_security_timed_cb_new();
+    struct dds_security_timed_dispatcher_t *d1 = NULL;
+    struct dds_security_timed_dispatcher_t *d2 = NULL;
+    struct dds_security_timed_dispatcher_t *d3 = NULL;
+    struct dds_security_timed_dispatcher_t *d4 = NULL;
+    struct dds_security_timed_dispatcher_t *d5 = NULL;
+    bool ok = false;
+
+    dds_time_t now     = dds_time();
+    dds_time_t past    = now - DDS_SECS(1);
+    dds_time_t present = now + DDS_SECS(1);
+    dds_time_t future  = present + DDS_SECS(1);
+    dds_time_t future2 = future + DDS_SECS(10);
+
+    /*************************************************************************
+     * Check if dispatchers can be created
+     *************************************************************************/
+    d1 = dds_security_timed_dispatcher_new(tcb);
+    d2 = dds_security_timed_dispatcher_new(tcb);
+    CU_ASSERT_PTR_NOT_NULL_FATAL(d1);
+    CU_ASSERT_PTR_NOT_NULL_FATAL(d2);
+
+    /*************************************************************************
+     * Check if adding callbacks succeeds
+     *************************************************************************/
+    
+    /* The last argument is a sequence number in which
+     * the callbacks are expected to be called. */
+    /* We can only really check if it crashes or not... */
+    dds_security_timed_dispatcher_add(tcb, d1, tc__callback, present, (void*)1);
+    dds_security_timed_dispatcher_add(tcb, d2, tc__callback, past,    (void*)0);
+    dds_security_timed_dispatcher_add(tcb, d2, tc__callback, present, (void*)2);
+    dds_security_timed_dispatcher_add(tcb, d1, tc__callback, future,  (void*)7);
+        
+    CU_PASS("Added callbacks")
+
+    /*************************************************************************
+     * Check if dispatchers can be created
+     *************************************************************************/
+    d3 = dds_security_timed_dispatcher_new(tcb);
+    d4 = dds_security_timed_dispatcher_new(tcb);
+    d5 = dds_security_timed_dispatcher_new(tcb);
+    
+    CU_ASSERT_PTR_NOT_NULL_FATAL(d3);
+    CU_ASSERT_PTR_NOT_NULL_FATAL(d4);
+    CU_ASSERT_PTR_NOT_NULL_FATAL(d5);
+
+
+    /*************************************************************************
+     * Check if enabling dispatchers succeeds
+     *************************************************************************/
+
+    /* The sleeps are added to get the timing between
+        * 'present' and 'past' callbacks right. */
+    /* We can only really check if it crashes or not... */
+    dds_sleepfor(DDS_MSECS(600));
+    dds_security_timed_dispatcher_enable(tcb, d1, (void*)NULL);
+    dds_security_timed_dispatcher_enable(tcb, d2, (void*)  d2);
+    dds_security_timed_dispatcher_enable(tcb, d3, (void*)NULL);
+    /* Specifically not enabling d4 and d5. */
+    dds_sleepfor(DDS_MSECS(600));
+    CU_PASS("Enabled dds_security_timed_dispatchers.");
+
+    /*************************************************************************
+     * Check if adding callbacks succeeds
+     *************************************************************************/
+
+    /* The last argument is a sequence number in which
+        * the callbacks are expected to be called. */
+    /* We can only really check if it crashes or not... */
+    dds_security_timed_dispatcher_add(tcb, d4, tc__callback, past,    (void*)99);
+    dds_security_timed_dispatcher_add(tcb, d2, tc__callback, future,  (void*) 8);
+    dds_security_timed_dispatcher_add(tcb, d3, tc__callback, future2, (void*) 9);
+    dds_security_timed_dispatcher_add(tcb, d1, tc__callback, past,    (void*) 3);
+    dds_security_timed_dispatcher_add(tcb, d1, tc__callback, future2, (void*)10);
+    dds_security_timed_dispatcher_add(tcb, d1, tc__callback, present, (void*) 4);
+    dds_security_timed_dispatcher_add(tcb, d2, tc__callback, present, (void*) 5);
+    dds_security_timed_dispatcher_add(tcb, d1, tc__callback, future,  (void*) 6);
+    dds_security_timed_dispatcher_add(tcb, d3, tc__callback, future2, (void*)11);
+    CU_PASS("Added callbacks.");
+
+
+    /*************************************************************************
+     * Check if timeout callbacks are triggered in the right sequence
+     *************************************************************************/
+    
+    int idx;
+    int timeout = 200; /* 2 seconds */
+
+    /* Wait for the callbacks to have been triggered.
+        * Ignore the ones in the far future. */
+    while ((g_sequence_idx < 8) && (timeout > 0)) {
+        dds_sleepfor(DDS_MSECS(10));
+        timeout--;
+    }
+
+    /* Print and check sequence of triggered callbacks. */
+    for (idx = 0; (idx < g_sequence_idx) && (idx < SEQ_SIZE); idx++) {
+        int seq = (int)(long long)(g_sequence_array[idx].arg);
+        struct dds_security_timed_dispatcher_t *expected_d;
+        void *expected_l;
+
+        /*
+            * Sequence checks.
+            */
+        if ((seq == 1) || (seq == 6) || (seq == 3) || (seq == 10) || (seq == 4) || (seq == 7)) {
+            expected_d = d1;
+            expected_l = NULL;
+        } else if ((seq == 0) || (seq == 2) || (seq == 8) || (seq == 5)) {
+            expected_d = d2;
+            expected_l = d2;
+        } else if (seq == 9) {
+            expected_d = d3;
+            expected_l = NULL;
+        } else if (seq == 99) {
+            expected_d = d4;
+            expected_l = NULL;
+            CU_FAIL("Unexpected callback on a disabled dispatcher");
+            ok = false;
+        } else {
+            expected_d = NULL;
+            expected_l = NULL;
+            CU_FAIL(sprintf("Unknown sequence idx received %d", seq));
+            ok = false;
+        }
+
+        if (seq != idx) {
+            /* 6 and 7 order may be mixed since the order is not defined for same time stamp */
+            if (!((seq == 6 && idx == 7) || (seq == 7 && idx == 6)))
+            {
+                printf("Unexpected sequence ordering %d vs %d\n", seq, idx);
+                CU_FAIL("Unexpected sequence ordering");
+                ok = false;
+            }
+        }
+        if (seq > 8) {
+            CU_FAIL(sprintf("Unexpected sequence idx %d of the far future", seq));
+            ok = false;
+        }
+        if (idx > 8) {
+            CU_FAIL(sprintf("Too many callbacks %d", idx));
+            ok = false;
+        }
+
+        /*
+         * Callback contents checks.
+         */
+        if (expected_d != NULL) {
+            if (g_sequence_array[idx].d != expected_d) {
+                printf("Unexpected dispatcher %p vs %p\n", g_sequence_array[idx].d, expected_d);
+                CU_FAIL("Unexpected dispatcher");
+                ok = false;
+            }
+            if (g_sequence_array[idx].listener != expected_l) {
+                CU_FAIL(sprintf("Unexpected listener %p vs %p", g_sequence_array[idx].listener, expected_l));
+                ok = false;
+            }
+        }
+
+        /*
+         * Callback kind check.
+         */
+        if (g_sequence_array[idx].kind != DDS_SECURITY_TIMED_CB_KIND_TIMEOUT) {
+            CU_FAIL(sprintf("Unexpected kind %d vs %d", (int)g_sequence_array[idx].kind, (int)DDS_SECURITY_TIMED_CB_KIND_TIMEOUT));
+            ok = false;
+        }
+    }
+    if (g_sequence_idx < 8) {
+        CU_FAIL(sprintf("Received %d callbacks, while 9 are expected",
+                                g_sequence_idx + 1));
+        ok = false;
+    }
+    if (ok) {
+        CU_FAIL(sprintf("Received timeout callbacks."));
+    }
+
+    /* Reset callback index to catch the deletion ones. */
+    g_sequence_idx = 0;
+
+
+    /*************************************************************************
+     * Check if deleting succeeds with dispatchers in different states
+     *************************************************************************/
+    /* We can only really check if it crashes or not... */
+    if (d1) {
+        dds_security_timed_dispatcher_free(tcb, d1);
+    }
+    if (d2) {
+        dds_security_timed_dispatcher_free(tcb, d2);
+    }
+    if (d3) {
+        dds_security_timed_dispatcher_free(tcb, d3);
+    }
+    if (d4) {
+        dds_security_timed_dispatcher_free(tcb, d4);
+    }
+    if (d5) {
+        dds_security_timed_dispatcher_free(tcb, d5);
+    }
+    CU_PASS("Deleted dispatchers.");
+
+
+    /*************************************************************************
+     * Check if deletion callbacks are triggered
+     *************************************************************************/
+    if (ok) {
+        timeout = 200; /* 2 seconds */
+
+        /* Wait for the callbacks to have been triggered.
+         * Ignore the ones in the far future. */
+        while ((g_sequence_idx < 4) && (timeout > 0)) {
+            dds_sleepfor(DDS_MSECS(10));
+            timeout--;
+        }
+
+        /* Print and check sequence of triggered callbacks. */
+        for (idx = 0; (idx < g_sequence_idx) && (idx < SEQ_SIZE); idx++) {
+            int seq = (int)(long long)(g_sequence_array[idx].arg);
+            struct dds_security_timed_dispatcher_t *expected_d;
+
+            /*
+             * Human (somewhat) readable format.
+             */
+            // tc__sequence_data_print(&(g_sequence_array[idx]));
+
+            /*
+             * Sequence checks.
+             */
+            if (seq == 99) {
+                expected_d = d4;
+            } else if ((seq == 9) || (seq == 11)) {
+                expected_d = d3;
+            } else if (seq == 10) {
+                expected_d = d1;
+            } else {
+                expected_d = NULL;
+                CU_FAIL(sprintf("Unexpected sequence idx received %d", seq));
+                ok = false;
+            }
+            if (idx > 4) {
+                CU_FAIL(sprintf("Too many callbacks %d", idx));
+                ok = false;
+            }
+
+            /*
+             * Callback contents checks.
+             */
+            if (expected_d != NULL) {
+                if (g_sequence_array[idx].d != expected_d) {
+                    CU_FAIL(sprintf("Unexpected dispatcher %p vs %p", g_sequence_array[idx].d, expected_d));
+                    ok = false;
+                }
+                if (g_sequence_array[idx].listener != NULL) {
+                    CU_FAIL(sprintf("Unexpected listener %p vs NULL", g_sequence_array[idx].listener));
+                    ok = false;
+                }
+            }
+
+            /*
+             * Callback kind check.
+             */
+            if (g_sequence_array[idx].kind != DDS_SECURITY_TIMED_CB_KIND_DELETE) {
+                CU_FAIL(sprintf("Unexpected kind %d vs %d", (int)g_sequence_array[idx].kind, (int)DDS_SECURITY_TIMED_CB_KIND_TIMEOUT));
+                ok = false;
+            }
+        }
+        if (g_sequence_idx < 4) {
+            CU_FAIL(sprintf("Received %d callbacks, while 3 are expected",
+                                    g_sequence_idx + 1));
+            ok = false;
+        }
+        if (ok) {
+            CU_PASS("Received deletion callbacks.");
+        }
+    }
+
+    dds_security_timed_cb_free(tcb);
+}

From 68f789d77b11a86618b1620ef1d56b2cc8d264f1 Mon Sep 17 00:00:00 2001
From: Erik Boasson <eb@ilities.com>
Date: Sun, 19 Jan 2020 17:00:18 +0100
Subject: [PATCH 093/238] Address some spurious Clang static analyzer warnings

Signed-off-by: Erik Boasson <eb@ilities.com>

Fix typo in dlopen_unknown test

Signed-off-by: Dennis Potman <dennis.potman@adlinktech.com>

Signed-off-by: Erik Boasson <eb@ilities.com>
---
 src/core/ddsc/src/dds_qos.c        |  2 ++
 src/core/ddsc/tests/qos.c          |  6 ++++++
 src/core/ddsi/src/q_xevent.c       | 10 +---------
 src/core/ddsi/tests/security_msg.c |  2 ++
 src/ddsrt/tests/dynlib.c           |  8 +++++++-
 src/ddsrt/tests/string.c           |  2 ++
 6 files changed, 20 insertions(+), 10 deletions(-)

diff --git a/src/core/ddsc/src/dds_qos.c b/src/core/ddsc/src/dds_qos.c
index 1cebe53..d13eeeb 100644
--- a/src/core/ddsc/src/dds_qos.c
+++ b/src/core/ddsc/src/dds_qos.c
@@ -403,6 +403,7 @@ void dds_qset_prop (dds_qos_t * __restrict qos, const char * name, const char *
   dds_qprop_init (qos);
   if (dds_qprop_get_index (qos, name, &i))
   {
+    assert (&qos->property.value.props[i] != NULL); /* for Clang static analyzer */
     dds_free (qos->property.value.props[i].value);
     qos->property.value.props[i].value = dds_string_dup (value);
   }
@@ -426,6 +427,7 @@ void dds_qset_bprop (dds_qos_t * __restrict qos, const char * name, const void *
   dds_qprop_init (qos);
   if (dds_qbprop_get_index (qos, name, &i))
   {
+    assert (&qos->property.binary_value.props[i].value != NULL); /* for Clang static analyzer */
     dds_qos_data_copy_in (&qos->property.binary_value.props[i].value, value, sz, true);
   }
   else
diff --git a/src/core/ddsc/tests/qos.c b/src/core/ddsc/tests/qos.c
index 3e6e644..24be7d3 100644
--- a/src/core/ddsc/tests/qos.c
+++ b/src/core/ddsc/tests/qos.c
@@ -11,6 +11,7 @@
  */
 #include "CUnit/Test.h"
 #include "dds/dds.h"
+#include <assert.h>
 
 /****************************************************************************
  * Convenience global policies
@@ -746,6 +747,7 @@ CU_Test(ddsc_qos, bproperty, .init=qos_init, .fini=qos_fini)
     CU_ASSERT_FATAL(dds_qget_bprop (g_qos, c_bproperty_names[0], &bvalue, &size));
     CU_ASSERT_FATAL (bvalue != NULL);
     CU_ASSERT_EQUAL_FATAL (size, 3);
+    assert (c_bproperty_values[0] != NULL); /* for Clang static analyzer */
     CU_ASSERT_EQUAL_FATAL (memcmp (bvalue, c_bproperty_values[0], size), 0);
     dds_free (bvalue);
 
@@ -754,6 +756,7 @@ CU_Test(ddsc_qos, bproperty, .init=qos_init, .fini=qos_fini)
     CU_ASSERT_FATAL (dds_qget_bprop (g_qos, c_bproperty_names[0], &bvalue, &size));
     CU_ASSERT_FATAL (bvalue != NULL);
     CU_ASSERT_EQUAL_FATAL (size, 3);
+    assert (c_bproperty_values[1] != NULL); /* for Clang static analyzer */
     CU_ASSERT_EQUAL_FATAL (memcmp (bvalue, c_bproperty_values[1], size), 0);
     dds_free (bvalue);
     dds_qset_bprop (g_qos, c_bproperty_names[0], &c_bproperty_values[0], 3);
@@ -782,11 +785,13 @@ CU_Test(ddsc_qos, bproperty, .init=qos_init, .fini=qos_fini)
     CU_ASSERT_FATAL (dds_qget_bprop (g_qos, c_bproperty_names[0], &bvalue, &size));
     CU_ASSERT_FATAL (bvalue != NULL);
     CU_ASSERT_EQUAL_FATAL (size, 3);
+    assert (c_bproperty_values[0] != NULL); /* for Clang static analyzer */
     CU_ASSERT_EQUAL_FATAL (memcmp (bvalue, c_bproperty_values[0], size), 0);
     dds_free (bvalue);
     CU_ASSERT_FATAL (dds_qget_bprop (g_qos, c_bproperty_names[2], &bvalue, &size));
     CU_ASSERT_FATAL (bvalue != NULL);
     CU_ASSERT_EQUAL_FATAL (size, 3);
+    assert (c_bproperty_values[2] != NULL); /* for Clang static analyzer */
     CU_ASSERT_EQUAL_FATAL (memcmp (bvalue, c_bproperty_values[2], size), 0);
     dds_free (bvalue);
     dds_qunset_bprop (g_qos, c_bproperty_names[0]);
@@ -809,6 +814,7 @@ CU_Test(ddsc_qos, property_mixed, .init=qos_init, .fini=qos_fini)
     CU_ASSERT_FATAL (dds_qget_bprop (g_qos, c_property_names[0], &bvalue, &size));
     CU_ASSERT_FATAL (bvalue != NULL);
     CU_ASSERT_EQUAL_FATAL (size, 3);
+    assert (c_bproperty_values[0] != NULL); /* for Clang static analyzer */
     CU_ASSERT_EQUAL_FATAL (memcmp (bvalue, c_bproperty_values[0], size), 0);
     dds_free (bvalue);
     CU_ASSERT_FATAL (dds_qget_prop (g_qos, c_property_names[0], &value));
diff --git a/src/core/ddsi/src/q_xevent.c b/src/core/ddsi/src/q_xevent.c
index 4ff5608..3c852d5 100644
--- a/src/core/ddsi/src/q_xevent.c
+++ b/src/core/ddsi/src/q_xevent.c
@@ -584,7 +584,6 @@ static void send_heartbeat_to_all_readers(struct nn_xpack *xp, struct xevent *ev
 {
   struct whc_state whcst;
   nn_mtime_t t_next;
-  int hbansreq = 0;
   unsigned count = 0;
 
   ddsrt_mutex_lock (&wr->e.lock);
@@ -592,21 +591,14 @@ static void send_heartbeat_to_all_readers(struct nn_xpack *xp, struct xevent *ev
   whc_get_state(wr->whc, &whcst);
 
   if (!writer_must_have_hb_scheduled (wr, &whcst))
-  {
-    hbansreq = 1; /* just for trace */
     t_next.v = T_NEVER;
-  }
   else if (!writer_hbcontrol_must_send (wr, &whcst, tnow))
-  {
-    hbansreq = 1; /* just for trace */
     t_next.v = tnow.v + writer_hbcontrol_intv (wr, &whcst, tnow);
-  }
   else
   {
     struct wr_prd_match *m;
     struct ddsi_guid last_guid = { .prefix = {.u = {0,0,0}}, .entityid = {0} };
-
-    hbansreq = writer_hbcontrol_ack_required (wr, &whcst, tnow);
+    const int hbansreq = writer_hbcontrol_ack_required (wr, &whcst, tnow);
     t_next.v = tnow.v + writer_hbcontrol_intv (wr, &whcst, tnow);
 
     while ((m = ddsrt_avl_lookup_succ (&wr_readers_treedef, &wr->readers, &last_guid)) != NULL)
diff --git a/src/core/ddsi/tests/security_msg.c b/src/core/ddsi/tests/security_msg.c
index 87bd734..c052a89 100644
--- a/src/core/ddsi/tests/security_msg.c
+++ b/src/core/ddsi/tests/security_msg.c
@@ -15,6 +15,7 @@
 #include "dds/ddsrt/string.h"
 #include "dds/ddsi/ddsi_security_msg.h"
 #include "mem_ser.h"
+#include <assert.h>
 
 static nn_participant_generic_message_t test_msg_in =
 {
@@ -302,6 +303,7 @@ CU_Test (ddsi_security_msg, serializer)
 
   /* Check serialization result. */
   size_t cmpsize = (len < sizeof(test_msg_ser)) ? len : sizeof(test_msg_ser);
+  assert(data != NULL); /* for Clang static analyzer */
   if (memcmp (data, test_msg_ser, cmpsize) != 0)
   {
     printf ("memcmp(%d)\n", (int)cmpsize);
diff --git a/src/ddsrt/tests/dynlib.c b/src/ddsrt/tests/dynlib.c
index 76d5871..9b8d5df 100644
--- a/src/ddsrt/tests/dynlib.c
+++ b/src/ddsrt/tests/dynlib.c
@@ -87,7 +87,7 @@ CU_Test(ddsrt_library, dlopen_unknown)
   ddsrt_dynlib_t l;
 
   r = ddsrt_dlopen("UnknownLib", false, &l);
-
+  CU_ASSERT_NOT_EQUAL(r, DDS_RETCODE_OK);
   CU_ASSERT_PTR_NULL_FATAL(l);
 
   r = ddsrt_dlerror(buffer, sizeof(buffer));
@@ -123,6 +123,7 @@ CU_Test(ddsrt_library, dlsym_unknown)
   void* f;
 
   r = ddsrt_dlopen(TEST_LIB_NAME, true, &l);
+  CU_ASSERT_EQUAL(r, DDS_RETCODE_OK);
   CU_ASSERT_PTR_NOT_NULL(l);
   TEST_ABORT_IF_NULL(l,"ddsrt_dlopen() failed. Is the proper library path set?");
 
@@ -150,17 +151,21 @@ CU_Test(ddsrt_library, call)
   ddsrt_dynlib_t l;
 
   r = ddsrt_dlopen(TEST_LIB_NAME, true, &l);
+  CU_ASSERT_EQUAL(r, DDS_RETCODE_OK);
   CU_ASSERT_PTR_NOT_NULL(l);
   TEST_ABORT_IF_NULL(l, "ddsrt_dlopen() failed. Is the proper library path set?");
 
   r = ddsrt_dlsym(l, "get_int", (void **)&f_get);
+  CU_ASSERT_EQUAL(r, DDS_RETCODE_OK);
   CU_ASSERT_PTR_NOT_NULL(f_get);
   TEST_ABORT_IF_NULL(f_get, "ddsrt_dlsym(l, \"get_int\") failed.");
 
   r = ddsrt_dlsym(l, "set_int", (void **)&f_set);
+  CU_ASSERT_EQUAL(r, DDS_RETCODE_OK);
   CU_ASSERT_PTR_NOT_NULL(f_set);
   TEST_ABORT_IF_NULL(f_set, "ddsrt_dlsym(l, \"set_int\") failed.");
 
+  assert(f_set != 0 && f_get != 0); /* for Clang static analyzer */
   f_set(set_int);
   get_int = f_get();
   CU_ASSERT_EQUAL(set_int, get_int);
@@ -175,6 +180,7 @@ CU_Test(ddsrt_library, dlclose_error)
     ddsrt_dynlib_t l;
 
     r = ddsrt_dlopen(TEST_LIB_NAME, true, &l);
+    CU_ASSERT_EQUAL(r, DDS_RETCODE_OK);
     CU_ASSERT_PTR_NOT_NULL(l);
     TEST_ABORT_IF_NULL(l, "ddsrt_dlopen() failed. Is the proper library path set?");
 
diff --git a/src/ddsrt/tests/string.c b/src/ddsrt/tests/string.c
index babe9af..2d809ea 100644
--- a/src/ddsrt/tests/string.c
+++ b/src/ddsrt/tests/string.c
@@ -10,6 +10,7 @@
  * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
  */
 #include <string.h>
+#include <assert.h>
 
 #include "CUnit/Theory.h"
 #include "dds/ddsrt/heap.h"
@@ -82,6 +83,7 @@ CU_Theory((const char *str, const char *srch, const char *subst, size_t max, con
   if (exp != NULL)
   {
     CU_ASSERT_FATAL(r != NULL);
+    assert(r != NULL); /* for Clang static analyzer */
     CU_ASSERT(strcmp(r, exp) == 0);
     ddsrt_free(r);
   }

From 3b4facbd454308247e7be3a423e1f1f44cf944d7 Mon Sep 17 00:00:00 2001
From: Dennis Potman <dennis.potman@adlinktech.com>
Date: Thu, 21 Nov 2019 12:01:34 +0100
Subject: [PATCH 094/238] DDS Security built-in Access Control plugin

This commit adds the build-in Access Control plugin that is part of the
DDS Security implementation for Cyclone.

The Access Control Plugin API defines the types and operations necessary
to support an access control mechanism for DDS Domain Participants.

Similar to other builtin plugins, the DDS Security access control plugin
is built as a shared library to allow dynamic library loading on runtime.
This enables DDS participants to use specific plugin implementations with
different configurations.

This commit includes some basic tests for the access control functions.
This initial version of the plugin does not support permissions expiry
(not-valid-after date in permissions configuration).

Signed-off-by: Dennis Potman <dennis.potman@adlinktech.com>

Process review comments for access control plugin

Signed-off-by: Dennis Potman <dennis.potman@adlinktech.com>

Part 2 of processing review changes for access control

Signed-off-by: Dennis Potman <dennis.potman@adlinktech.com>

Add test for topicname dcps, add comment for xml date parser

Signed-off-by: Dennis Potman <dennis.potman@adlinktech.com>

Fixed an bug in leap year count for year 2200, changed the rounding for sub-ns fraction and added an additional overflow test in DDS_Security_parse_xml_date

Signed-off-by: Dennis Potman <dennis.potman@adlinktech.com>
---
 src/core/ddsc/src/dds__topic.h                |    2 +
 src/core/ddsc/src/dds_builtin.c               |    2 +-
 src/core/ddsc/src/dds_topic.c                 |   11 +-
 src/core/ddsc/tests/topic.c                   |    2 +-
 .../dds/security/dds_security_api_err.h       |   10 +-
 src/security/builtin_plugins/CMakeLists.txt   |    1 +
 .../access_control/CMakeLists.txt             |   55 +
 .../access_control/src/access_control.c       | 2486 +++++++++++++++++
 .../access_control/src/access_control.h       |   21 +
 .../src/access_control_objects.c              |  283 ++
 .../src/access_control_objects.h              |  106 +
 .../src/access_control_parser.c               | 1212 ++++++++
 .../src/access_control_parser.h               |  301 ++
 .../access_control/src/access_control_utils.c |  406 +++
 .../access_control/src/access_control_utils.h |   30 +
 .../builtin_plugins/tests/CMakeLists.txt      |   27 +-
 .../src/access_control_fnmatch_utests.c       |   67 +
 .../etc/Test_Governance_ok.p7s                |  114 +
 .../etc/Test_Permissions_ok.p7s               |   85 +
 .../get_permissions_credential_token_utests.c |  497 ++++
 .../etc/Test_Governance_ok.p7s                |  114 +
 .../etc/Test_Permissions_ok.p7s               |   85 +
 .../src/get_permissions_token_utests.c        |  439 +++
 .../etc/Test_Governance_full.p7s              |  267 ++
 ..._Governance_liveliness_discovery_clear.p7s |  114 +
 ..._Governance_liveliness_discovery_clear.xml |   62 +
 ...ernance_liveliness_discovery_different.p7s |  114 +
 ...ernance_liveliness_discovery_different.xml |   62 +
 ...ernance_liveliness_discovery_encrypted.p7s |  114 +
 ...ernance_liveliness_discovery_encrypted.xml |   62 +
 ..._discovery_encrypted_and_authenticated.p7s |  114 +
 ..._discovery_encrypted_and_authenticated.xml |   62 +
 ...Governance_liveliness_discovery_signed.p7s |  114 +
 ...Governance_liveliness_discovery_signed.xml |   62 +
 ...ess_discovery_signed_and_authenticated.p7s |  114 +
 ...ess_discovery_signed_and_authenticated.xml |   62 +
 .../etc/Test_Permissions_ok.p7s               |   85 +
 .../src/get_xxx_sec_attributes_utests.c       | 1649 +++++++++++
 .../etc/Test_Governance_ok.p7s                |  114 +
 .../etc/Test_Permissions_ca.pem               |   22 +
 .../etc/Test_Permissions_ca_key.pem           |   27 +
 .../etc/Test_Permissions_listener.p7s         |   51 +
 .../src/listeners_access_control_utests.c     |  671 +++++
 .../etc/Test_File_empty.txt                   |    0
 .../etc/Test_File_text.txt                    |    3 +
 ...st_Governance_check_create_participant.p7s |  199 ++
 ...st_Governance_check_create_participant.xml |  147 +
 .../etc/Test_Governance_full.p7s              |  267 ++
 .../etc/Test_Governance_full.xml              |  215 ++
 .../etc/Test_Governance_invalid_data.p7s      |  175 ++
 .../etc/Test_Governance_invalid_data.xml      |  123 +
 .../etc/Test_Governance_invalid_element.p7s   |  178 ++
 .../etc/Test_Governance_invalid_element.xml   |  126 +
 .../etc/Test_Governance_not_signed.p7s        |   62 +
 .../etc/Test_Governance_ok.p7s                |  114 +
 .../etc/Test_Governance_unknown_ca.p7s        |  117 +
 .../etc/Test_Permissions_ca.pem               |   22 +
 .../etc/Test_Permissions_ca_key.pem           |   27 +
 .../etc/Test_Permissions_expired.p7s          |  243 ++
 .../etc/Test_Permissions_expired.xml          |  191 ++
 .../etc/Test_Permissions_full.p7s             |  243 ++
 .../etc/Test_Permissions_full.xml             |  191 ++
 .../etc/Test_Permissions_invalid_data.p7s     |  219 ++
 .../etc/Test_Permissions_invalid_data.xml     |  167 ++
 .../etc/Test_Permissions_invalid_element.p7s  |  219 ++
 .../etc/Test_Permissions_invalid_element.xml  |  167 ++
 .../Test_Permissions_lack_of_not_after.p7s    |   95 +
 .../Test_Permissions_lack_of_not_after.xml    |   43 +
 .../Test_Permissions_lack_of_not_before.p7s   |   95 +
 .../Test_Permissions_lack_of_not_before.xml   |   43 +
 .../etc/Test_Permissions_not_signed.p7s       |   33 +
 .../etc/Test_Permissions_notyet.p7s           |  243 ++
 .../etc/Test_Permissions_notyet.xml           |  191 ++
 .../etc/Test_Permissions_ok.p7s               |   85 +
 .../etc/Test_Permissions_ok.xml               |   33 +
 .../etc/Test_Permissions_unknown_ca.p7s       |   87 +
 .../etc/Test_Permissions_unknown_subject.p7s  |   85 +
 .../etc/Test_Permissions_unknown_subject.xml  |   33 +
 .../src/validate_local_permissions_utests.c   | 1020 +++++++
 .../etc/Test_Governance_ok.p7s                |  114 +
 ...sions_different_subject_representation.p7s |   96 +
 ...sions_different_subject_representation.xml |   44 +
 .../etc/Test_Permissions_expired.p7s          |  243 ++
 .../etc/Test_Permissions_expired.xml          |  191 ++
 .../etc/Test_Permissions_invalid_data.p7s     |  219 ++
 .../etc/Test_Permissions_invalid_data.xml     |  167 ++
 ..._Permissions_missing_subject_component.p7s |   96 +
 ..._Permissions_missing_subject_component.xml |   44 +
 .../etc/Test_Permissions_not_signed.p7s       |   33 +
 .../etc/Test_Permissions_notyet.p7s           |  243 ++
 .../etc/Test_Permissions_notyet.xml           |  191 ++
 .../etc/Test_Permissions_ok.p7s               |   85 +
 .../etc/Test_Permissions_ok.xml               |   33 +
 .../etc/Test_Permissions_unknown_ca.p7s       |   87 +
 .../etc/Test_Permissions_unknown_subject.p7s  |   85 +
 .../etc/Test_Permissions_unknown_subject.xml  |   33 +
 .../src/validate_remote_permissions_utests.c  | 1068 +++++++
 .../dds/security/core/dds_security_utils.h    |    8 +-
 src/security/core/src/dds_security_utils.c    |  264 +-
 src/security/core/tests/CMakeLists.txt        |    1 +
 src/security/core/tests/security_utils.c      |   62 +
 101 files changed, 19154 insertions(+), 52 deletions(-)
 create mode 100644 src/security/builtin_plugins/access_control/CMakeLists.txt
 create mode 100644 src/security/builtin_plugins/access_control/src/access_control.c
 create mode 100644 src/security/builtin_plugins/access_control/src/access_control.h
 create mode 100644 src/security/builtin_plugins/access_control/src/access_control_objects.c
 create mode 100644 src/security/builtin_plugins/access_control/src/access_control_objects.h
 create mode 100644 src/security/builtin_plugins/access_control/src/access_control_parser.c
 create mode 100644 src/security/builtin_plugins/access_control/src/access_control_parser.h
 create mode 100644 src/security/builtin_plugins/access_control/src/access_control_utils.c
 create mode 100644 src/security/builtin_plugins/access_control/src/access_control_utils.h
 create mode 100644 src/security/builtin_plugins/tests/access_control_fnmatch/src/access_control_fnmatch_utests.c
 create mode 100644 src/security/builtin_plugins/tests/get_permissions_credential_token/etc/Test_Governance_ok.p7s
 create mode 100644 src/security/builtin_plugins/tests/get_permissions_credential_token/etc/Test_Permissions_ok.p7s
 create mode 100644 src/security/builtin_plugins/tests/get_permissions_credential_token/src/get_permissions_credential_token_utests.c
 create mode 100644 src/security/builtin_plugins/tests/get_permissions_token/etc/Test_Governance_ok.p7s
 create mode 100644 src/security/builtin_plugins/tests/get_permissions_token/etc/Test_Permissions_ok.p7s
 create mode 100644 src/security/builtin_plugins/tests/get_permissions_token/src/get_permissions_token_utests.c
 create mode 100644 src/security/builtin_plugins/tests/get_xxx_sec_attributes/etc/Test_Governance_full.p7s
 create mode 100644 src/security/builtin_plugins/tests/get_xxx_sec_attributes/etc/Test_Governance_liveliness_discovery_clear.p7s
 create mode 100644 src/security/builtin_plugins/tests/get_xxx_sec_attributes/etc/Test_Governance_liveliness_discovery_clear.xml
 create mode 100644 src/security/builtin_plugins/tests/get_xxx_sec_attributes/etc/Test_Governance_liveliness_discovery_different.p7s
 create mode 100644 src/security/builtin_plugins/tests/get_xxx_sec_attributes/etc/Test_Governance_liveliness_discovery_different.xml
 create mode 100644 src/security/builtin_plugins/tests/get_xxx_sec_attributes/etc/Test_Governance_liveliness_discovery_encrypted.p7s
 create mode 100644 src/security/builtin_plugins/tests/get_xxx_sec_attributes/etc/Test_Governance_liveliness_discovery_encrypted.xml
 create mode 100644 src/security/builtin_plugins/tests/get_xxx_sec_attributes/etc/Test_Governance_liveliness_discovery_encrypted_and_authenticated.p7s
 create mode 100644 src/security/builtin_plugins/tests/get_xxx_sec_attributes/etc/Test_Governance_liveliness_discovery_encrypted_and_authenticated.xml
 create mode 100644 src/security/builtin_plugins/tests/get_xxx_sec_attributes/etc/Test_Governance_liveliness_discovery_signed.p7s
 create mode 100644 src/security/builtin_plugins/tests/get_xxx_sec_attributes/etc/Test_Governance_liveliness_discovery_signed.xml
 create mode 100644 src/security/builtin_plugins/tests/get_xxx_sec_attributes/etc/Test_Governance_liveliness_discovery_signed_and_authenticated.p7s
 create mode 100644 src/security/builtin_plugins/tests/get_xxx_sec_attributes/etc/Test_Governance_liveliness_discovery_signed_and_authenticated.xml
 create mode 100644 src/security/builtin_plugins/tests/get_xxx_sec_attributes/etc/Test_Permissions_ok.p7s
 create mode 100644 src/security/builtin_plugins/tests/get_xxx_sec_attributes/src/get_xxx_sec_attributes_utests.c
 create mode 100644 src/security/builtin_plugins/tests/listeners_access_control/etc/Test_Governance_ok.p7s
 create mode 100644 src/security/builtin_plugins/tests/listeners_access_control/etc/Test_Permissions_ca.pem
 create mode 100644 src/security/builtin_plugins/tests/listeners_access_control/etc/Test_Permissions_ca_key.pem
 create mode 100644 src/security/builtin_plugins/tests/listeners_access_control/etc/Test_Permissions_listener.p7s
 create mode 100644 src/security/builtin_plugins/tests/listeners_access_control/src/listeners_access_control_utests.c
 create mode 100644 src/security/builtin_plugins/tests/validate_local_permissions/etc/Test_File_empty.txt
 create mode 100644 src/security/builtin_plugins/tests/validate_local_permissions/etc/Test_File_text.txt
 create mode 100644 src/security/builtin_plugins/tests/validate_local_permissions/etc/Test_Governance_check_create_participant.p7s
 create mode 100644 src/security/builtin_plugins/tests/validate_local_permissions/etc/Test_Governance_check_create_participant.xml
 create mode 100644 src/security/builtin_plugins/tests/validate_local_permissions/etc/Test_Governance_full.p7s
 create mode 100644 src/security/builtin_plugins/tests/validate_local_permissions/etc/Test_Governance_full.xml
 create mode 100644 src/security/builtin_plugins/tests/validate_local_permissions/etc/Test_Governance_invalid_data.p7s
 create mode 100644 src/security/builtin_plugins/tests/validate_local_permissions/etc/Test_Governance_invalid_data.xml
 create mode 100644 src/security/builtin_plugins/tests/validate_local_permissions/etc/Test_Governance_invalid_element.p7s
 create mode 100644 src/security/builtin_plugins/tests/validate_local_permissions/etc/Test_Governance_invalid_element.xml
 create mode 100644 src/security/builtin_plugins/tests/validate_local_permissions/etc/Test_Governance_not_signed.p7s
 create mode 100644 src/security/builtin_plugins/tests/validate_local_permissions/etc/Test_Governance_ok.p7s
 create mode 100644 src/security/builtin_plugins/tests/validate_local_permissions/etc/Test_Governance_unknown_ca.p7s
 create mode 100644 src/security/builtin_plugins/tests/validate_local_permissions/etc/Test_Permissions_ca.pem
 create mode 100644 src/security/builtin_plugins/tests/validate_local_permissions/etc/Test_Permissions_ca_key.pem
 create mode 100644 src/security/builtin_plugins/tests/validate_local_permissions/etc/Test_Permissions_expired.p7s
 create mode 100644 src/security/builtin_plugins/tests/validate_local_permissions/etc/Test_Permissions_expired.xml
 create mode 100644 src/security/builtin_plugins/tests/validate_local_permissions/etc/Test_Permissions_full.p7s
 create mode 100644 src/security/builtin_plugins/tests/validate_local_permissions/etc/Test_Permissions_full.xml
 create mode 100644 src/security/builtin_plugins/tests/validate_local_permissions/etc/Test_Permissions_invalid_data.p7s
 create mode 100644 src/security/builtin_plugins/tests/validate_local_permissions/etc/Test_Permissions_invalid_data.xml
 create mode 100644 src/security/builtin_plugins/tests/validate_local_permissions/etc/Test_Permissions_invalid_element.p7s
 create mode 100644 src/security/builtin_plugins/tests/validate_local_permissions/etc/Test_Permissions_invalid_element.xml
 create mode 100644 src/security/builtin_plugins/tests/validate_local_permissions/etc/Test_Permissions_lack_of_not_after.p7s
 create mode 100644 src/security/builtin_plugins/tests/validate_local_permissions/etc/Test_Permissions_lack_of_not_after.xml
 create mode 100644 src/security/builtin_plugins/tests/validate_local_permissions/etc/Test_Permissions_lack_of_not_before.p7s
 create mode 100644 src/security/builtin_plugins/tests/validate_local_permissions/etc/Test_Permissions_lack_of_not_before.xml
 create mode 100644 src/security/builtin_plugins/tests/validate_local_permissions/etc/Test_Permissions_not_signed.p7s
 create mode 100644 src/security/builtin_plugins/tests/validate_local_permissions/etc/Test_Permissions_notyet.p7s
 create mode 100644 src/security/builtin_plugins/tests/validate_local_permissions/etc/Test_Permissions_notyet.xml
 create mode 100644 src/security/builtin_plugins/tests/validate_local_permissions/etc/Test_Permissions_ok.p7s
 create mode 100644 src/security/builtin_plugins/tests/validate_local_permissions/etc/Test_Permissions_ok.xml
 create mode 100644 src/security/builtin_plugins/tests/validate_local_permissions/etc/Test_Permissions_unknown_ca.p7s
 create mode 100644 src/security/builtin_plugins/tests/validate_local_permissions/etc/Test_Permissions_unknown_subject.p7s
 create mode 100644 src/security/builtin_plugins/tests/validate_local_permissions/etc/Test_Permissions_unknown_subject.xml
 create mode 100644 src/security/builtin_plugins/tests/validate_local_permissions/src/validate_local_permissions_utests.c
 create mode 100644 src/security/builtin_plugins/tests/validate_remote_permissions/etc/Test_Governance_ok.p7s
 create mode 100644 src/security/builtin_plugins/tests/validate_remote_permissions/etc/Test_Permissions_different_subject_representation.p7s
 create mode 100644 src/security/builtin_plugins/tests/validate_remote_permissions/etc/Test_Permissions_different_subject_representation.xml
 create mode 100644 src/security/builtin_plugins/tests/validate_remote_permissions/etc/Test_Permissions_expired.p7s
 create mode 100644 src/security/builtin_plugins/tests/validate_remote_permissions/etc/Test_Permissions_expired.xml
 create mode 100644 src/security/builtin_plugins/tests/validate_remote_permissions/etc/Test_Permissions_invalid_data.p7s
 create mode 100644 src/security/builtin_plugins/tests/validate_remote_permissions/etc/Test_Permissions_invalid_data.xml
 create mode 100644 src/security/builtin_plugins/tests/validate_remote_permissions/etc/Test_Permissions_missing_subject_component.p7s
 create mode 100644 src/security/builtin_plugins/tests/validate_remote_permissions/etc/Test_Permissions_missing_subject_component.xml
 create mode 100644 src/security/builtin_plugins/tests/validate_remote_permissions/etc/Test_Permissions_not_signed.p7s
 create mode 100644 src/security/builtin_plugins/tests/validate_remote_permissions/etc/Test_Permissions_notyet.p7s
 create mode 100644 src/security/builtin_plugins/tests/validate_remote_permissions/etc/Test_Permissions_notyet.xml
 create mode 100644 src/security/builtin_plugins/tests/validate_remote_permissions/etc/Test_Permissions_ok.p7s
 create mode 100644 src/security/builtin_plugins/tests/validate_remote_permissions/etc/Test_Permissions_ok.xml
 create mode 100644 src/security/builtin_plugins/tests/validate_remote_permissions/etc/Test_Permissions_unknown_ca.p7s
 create mode 100644 src/security/builtin_plugins/tests/validate_remote_permissions/etc/Test_Permissions_unknown_subject.p7s
 create mode 100644 src/security/builtin_plugins/tests/validate_remote_permissions/etc/Test_Permissions_unknown_subject.xml
 create mode 100644 src/security/builtin_plugins/tests/validate_remote_permissions/src/validate_remote_permissions_utests.c
 create mode 100644 src/security/core/tests/security_utils.c

diff --git a/src/core/ddsc/src/dds__topic.h b/src/core/ddsc/src/dds__topic.h
index d59dc1f..f6de42a 100644
--- a/src/core/ddsc/src/dds__topic.h
+++ b/src/core/ddsc/src/dds__topic.h
@@ -35,6 +35,8 @@ DDS_EXPORT void dds_topic_set_filter_with_ctx
 DDS_EXPORT dds_topic_intern_filter_fn dds_topic_get_filter_with_ctx
   (dds_entity_t topic);
 
+DDS_EXPORT dds_entity_t dds_create_topic_impl (dds_entity_t participant, struct ddsi_sertopic *sertopic, const dds_qos_t *qos, const dds_listener_t *listener, const nn_plist_t *sedp_plist);
+
 #if defined (__cplusplus)
 }
 #endif
diff --git a/src/core/ddsc/src/dds_builtin.c b/src/core/ddsc/src/dds_builtin.c
index 8dd026f..ca45561 100644
--- a/src/core/ddsc/src/dds_builtin.c
+++ b/src/core/ddsc/src/dds_builtin.c
@@ -76,7 +76,7 @@ dds_entity_t dds__get_builtin_topic (dds_entity_t entity, dds_entity_t topic)
   }
 
   dds_qos_t *qos = dds__create_builtin_qos ();
-  tp = dds_create_topic_arbitrary (par->m_entity.m_hdllink.hdl, sertopic, qos, NULL, NULL);
+  tp = dds_create_topic_impl (par->m_entity.m_hdllink.hdl, sertopic, qos, NULL, NULL);
   dds_delete_qos (qos);
   dds_entity_unpin (e);
   return tp;
diff --git a/src/core/ddsc/src/dds_topic.c b/src/core/ddsc/src/dds_topic.c
index 7d9df7d..4796703 100644
--- a/src/core/ddsc/src/dds_topic.c
+++ b/src/core/ddsc/src/dds_topic.c
@@ -280,7 +280,7 @@ const struct dds_entity_deriver dds_entity_deriver_topic = {
   .validate_status = dds_topic_status_validate
 };
 
-dds_entity_t dds_create_topic_arbitrary (dds_entity_t participant, struct ddsi_sertopic *sertopic, const dds_qos_t *qos, const dds_listener_t *listener, const nn_plist_t *sedp_plist)
+dds_entity_t dds_create_topic_impl (dds_entity_t participant, struct ddsi_sertopic *sertopic, const dds_qos_t *qos, const dds_listener_t *listener, const nn_plist_t *sedp_plist)
 {
   dds_return_t rc;
   dds_participant *par;
@@ -465,6 +465,15 @@ err_invalid_qos:
   return rc;
 }
 
+dds_entity_t dds_create_topic_arbitrary (dds_entity_t participant, struct ddsi_sertopic *sertopic, const dds_qos_t *qos, const dds_listener_t *listener, const nn_plist_t *sedp_plist)
+{
+  assert(sertopic);
+  assert(sertopic->name);
+  if (!strncmp(sertopic->name, "DCPS", 4))
+    return DDS_RETCODE_BAD_PARAMETER;
+  return dds_create_topic_impl (participant, sertopic, qos, listener, sedp_plist);
+}
+
 dds_entity_t dds_create_topic (dds_entity_t participant, const dds_topic_descriptor_t *desc, const char *name, const dds_qos_t *qos, const dds_listener_t *listener)
 {
   struct ddsi_sertopic_default *st;
diff --git a/src/core/ddsc/tests/topic.c b/src/core/ddsc/tests/topic.c
index d71c8d5..3707715 100644
--- a/src/core/ddsc/tests/topic.c
+++ b/src/core/ddsc/tests/topic.c
@@ -177,7 +177,7 @@ CU_Test(ddsc_topic_create, desc_null, .init=ddsc_topic_init, .fini=ddsc_topic_fi
 
 
 CU_TheoryDataPoints(ddsc_topic_create, invalid_names) = {
-        CU_DataPoints(char *, NULL, "", "mi-dle", "-start", "end-", "1st", "Thus$", "pl+s", "t(4)"),
+        CU_DataPoints(char *, NULL, "", "mi-dle", "-start", "end-", "1st", "Thus$", "pl+s", "t(4)", "DCPSmytopic"),
 };
 CU_Theory((char *name), ddsc_topic_create, invalid_names, .init=ddsc_topic_init, .fini=ddsc_topic_fini)
 {
diff --git a/src/security/api/include/dds/security/dds_security_api_err.h b/src/security/api/include/dds/security/dds_security_api_err.h
index 20ee24b..9246ba5 100644
--- a/src/security/api/include/dds/security/dds_security_api_err.h
+++ b/src/security/api/include/dds/security/dds_security_api_err.h
@@ -97,16 +97,14 @@ extern "C" {
 #define DDS_SECURITY_ERR_INVALID_SUBJECT_NAME_CODE 146
 #define DDS_SECURITY_ERR_INVALID_SUBJECT_NAME_MESSAGE "Subject name is invalid"
 #define DDS_SECURITY_ERR_VALIDITY_PERIOD_EXPIRED_CODE 147
-#define DDS_SECURITY_ERR_VALIDITY_PERIOD_EXPIRED_MESSAGE "Permissions validity period expired for %s"
+#define DDS_SECURITY_ERR_VALIDITY_PERIOD_EXPIRED_MESSAGE "Permissions validity period expired for %s (expired: %s)"
 #define DDS_SECURITY_ERR_VALIDITY_PERIOD_NOT_STARTED_CODE 148
-#define DDS_SECURITY_ERR_VALIDITY_PERIOD_NOT_STARTED_MESSAGE "Permissions validity period has not started yet for %s"
+#define DDS_SECURITY_ERR_VALIDITY_PERIOD_NOT_STARTED_MESSAGE "Permissions validity period has not started yet for %s (start: %s)"
 #define DDS_SECURITY_ERR_CAN_NOT_FIND_PERMISSIONS_GRANT_CODE 149
 #define DDS_SECURITY_ERR_CAN_NOT_FIND_PERMISSIONS_GRANT_MESSAGE "Could not find valid grant in permissions"
-#define DDS_SECURITY_ERR_PERMISSIONS_OUT_OF_VALIDITY_DATE_CODE 150
-#define DDS_SECURITY_ERR_PERMISSIONS_OUT_OF_VALIDITY_DATE_MESSAGE "Permissions of subject (%s) outside validity date: %s - %s"
-#define DDS_SECURITY_ERR_URI_TYPE_NOT_SUPPORTED_CODE 151
+#define DDS_SECURITY_ERR_URI_TYPE_NOT_SUPPORTED_CODE 150
 #define DDS_SECURITY_ERR_URI_TYPE_NOT_SUPPORTED_MESSAGE "Unsupported URI type: %s"
-#define DDS_SECURITY_ERR_INVALID_CRYPTO_DATA_NOT_ALIGNED_CODE 152
+#define DDS_SECURITY_ERR_INVALID_CRYPTO_DATA_NOT_ALIGNED_CODE 151
 #define DDS_SECURITY_ERR_INVALID_CRYPTO_DATA_NOT_ALIGNED_MESSAGE "The payload is not aligned at 4 bytes"
 
 #define DDS_SECURITY_ERR_UNDEFINED_CODE 200
diff --git a/src/security/builtin_plugins/CMakeLists.txt b/src/security/builtin_plugins/CMakeLists.txt
index 113d0b4..93feffb 100644
--- a/src/security/builtin_plugins/CMakeLists.txt
+++ b/src/security/builtin_plugins/CMakeLists.txt
@@ -11,6 +11,7 @@
 #
 cmake_minimum_required(VERSION 3.7)
 
+add_subdirectory("${CMAKE_CURRENT_LIST_DIR}/access_control")
 add_subdirectory("${CMAKE_CURRENT_LIST_DIR}/authentication")
 add_subdirectory("${CMAKE_CURRENT_LIST_DIR}/cryptographic")
 
diff --git a/src/security/builtin_plugins/access_control/CMakeLists.txt b/src/security/builtin_plugins/access_control/CMakeLists.txt
new file mode 100644
index 0000000..c0cee0a
--- /dev/null
+++ b/src/security/builtin_plugins/access_control/CMakeLists.txt
@@ -0,0 +1,55 @@
+#
+# Copyright(c) 2006 to 2019 ADLINK Technology Limited and others
+#
+# This program and the accompanying materials are made available under the
+# terms of the Eclipse Public License v. 2.0 which is available at
+# http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+# v. 1.0 which is available at
+# http://www.eclipse.org/org/documents/edl-v10.php.
+#
+# SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+#
+include (GenerateExportHeader)
+
+find_package(OpenSSL)
+
+PREPEND(srcs_accesscontrol "${CMAKE_CURRENT_LIST_DIR}/src"
+    access_control_objects.c
+    access_control_parser.c
+    access_control_utils.c
+    access_control.c
+)
+
+add_library(dds_security_ac SHARED "")
+
+generate_export_header(
+    dds_security_ac
+        BASE_NAME SECURITY
+        EXPORT_FILE_NAME "${CMAKE_CURRENT_BINARY_DIR}/include/dds/security/export.h"
+)
+
+add_definitions(-DDDSI_INCLUDE_SSL)
+
+target_link_libraries(dds_security_ac PUBLIC ddsc)
+target_link_libraries(dds_security_ac PUBLIC OpenSSL::SSL)
+
+target_sources(dds_security_ac
+    PRIVATE
+        ${srcs_accesscontrol}
+)
+
+target_include_directories(dds_security_ac
+    PUBLIC
+        "$<BUILD_INTERFACE:$<TARGET_PROPERTY:security_api,INTERFACE_INCLUDE_DIRECTORIES>>"
+        "$<BUILD_INTERFACE:$<TARGET_PROPERTY:security_core,INTERFACE_INCLUDE_DIRECTORIES>>"
+        "$<BUILD_INTERFACE:$<TARGET_PROPERTY:ddsrt,INTERFACE_INCLUDE_DIRECTORIES>>"
+        "$<BUILD_INTERFACE:${CMAKE_CURRENT_BINARY_DIR}/include>"
+)
+
+install(
+  TARGETS
+  EXPORT "${PROJECT_NAME}"
+  RUNTIME DESTINATION "${CMAKE_INSTALL_BINDIR}" COMPONENT lib
+  LIBRARY DESTINATION "${CMAKE_INSTALL_LIBDIR}" COMPONENT lib
+  ARCHIVE DESTINATION "${CMAKE_INSTALL_LIBDIR}" COMPONENT lib
+)
diff --git a/src/security/builtin_plugins/access_control/src/access_control.c b/src/security/builtin_plugins/access_control/src/access_control.c
new file mode 100644
index 0000000..f356445
--- /dev/null
+++ b/src/security/builtin_plugins/access_control/src/access_control.c
@@ -0,0 +1,2486 @@
+/*
+ * Copyright(c) 2006 to 2019 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+#define ACCESS_CONTROL_USE_ONE_PERMISSION
+
+#include <assert.h>
+#include <string.h>
+#include <openssl/x509.h>
+#include <openssl/err.h>
+#include "dds/ddsrt/heap.h"
+#include "dds/ddsrt/misc.h"
+#include "dds/ddsrt/string.h"
+#include "dds/ddsrt/sync.h"
+#include "dds/ddsrt/types.h"
+#include "dds/security/dds_security_api.h"
+#include "dds/security/core/dds_security_utils.h"
+#include "access_control.h"
+#include "access_control_utils.h"
+#include "access_control_objects.h"
+#include "access_control_parser.h"
+
+#if OPENSSL_VERSION_NUMBER >= 0x10000000L && OPENSSL_VERSION_NUMBER < 0x10100000L
+#define REMOVE_THREAD_STATE() ERR_remove_thread_state(NULL);
+#elif OPENSSL_VERSION_NUMBER < 0x10000000L
+#define REMOVE_THREAD_STATE() ERR_remove_state(0);
+#else
+#define REMOVE_THREAD_STATE()
+#endif
+
+static const char *ACCESS_CONTROL_PROTOCOL_CLASS = "DDS:Access";
+static const unsigned ACCESS_CONTROL_PROTOCOL_VERSION_MAJOR = 1;
+static const unsigned ACCESS_CONTROL_PROTOCOL_VERSION_MINOR = 0;
+
+static const char *ACCESS_CONTROL_PERMISSIONS_CLASS_ID = "Permissions";
+
+static const char *QOS_PROPERTY_PERMISSIONS_DOCUMENT = "dds.sec.access.permissions";
+static const char *QOS_PROPERTY_GOVERNANCE_DOCUMENT = "dds.sec.access.governance";
+static const char *QOS_PROPERTY_PERMISSIONS_CA = "dds.sec.access.permissions_ca";
+static const char *QOS_PROPERTY_IDENTITY_CERT = "dds.sec.auth.identity_certificate";
+
+static const char *ACCESS_PERMISSIONS_CREDENTIAL_TOKEN_ID = "DDS:Access:PermissionsCredential";
+static const char *ACCESS_PROPERTY_PERMISSION_DOCUMENT = "dds.perm.cert";
+
+typedef enum TOPIC_TYPE
+{
+  TOPIC_TYPE_USER = 0,
+  TOPIC_TYPE_NON_SECURE_BUILTIN,
+  TOPIC_TYPE_SECURE_ParticipantsSecure,
+  TOPIC_TYPE_SECURE_PublicationsSecure,
+  TOPIC_TYPE_SECURE_SubscriptionsSecure,
+  TOPIC_TYPE_SECURE_ParticipantMessageSecure,
+  TOPIC_TYPE_SECURE_ParticipantStatelessMessage,
+  TOPIC_TYPE_SECURE_ParticipantVolatileMessageSecure
+} TOPIC_TYPE;
+
+/**
+ * Implementation structure for storing encapsulated members of the instance
+ * while giving only the interface definition to user
+ */
+
+typedef struct dds_security_access_control_impl
+{
+  dds_security_access_control base;
+  ddsrt_mutex_t lock;
+
+#ifdef ACCESS_CONTROL_USE_ONE_PERMISSION
+  local_participant_access_rights *local_access_rights;
+#else
+  /* TODO: implement access rights per participant */
+  struct AccessControlTable *local_permissions;
+#endif
+  struct AccessControlTable *remote_permissions;
+#if TIMED_CALLBACK_IMPLEMENTED
+  struct ut_timed_dispatcher_t *timed_callbacks;
+#endif
+} dds_security_access_control_impl;
+
+static bool get_sec_attributes(dds_security_access_control_impl *ac, const DDS_Security_PermissionsHandle permissions_handle, const char *topic_name,
+    DDS_Security_EndpointSecurityAttributes *attributes, DDS_Security_SecurityException *ex);
+static char *get_access_control_class_id(const char *classid);
+static local_participant_access_rights *check_and_create_local_participant_rights(DDS_Security_IdentityHandle identity_handle, int domain_id, const DDS_Security_Qos *participant_qos, DDS_Security_SecurityException *ex);
+static remote_participant_access_rights *check_and_create_remote_participant_rights(DDS_Security_IdentityHandle remote_identity_handle, local_participant_access_rights *local_rights,
+    const DDS_Security_PermissionsToken *remote_permissions_token, const DDS_Security_AuthenticatedPeerCredentialToken *remote_credential_token, DDS_Security_SecurityException *ex);
+static local_participant_access_rights *find_local_access_rights(dds_security_access_control_impl *ac, DDS_Security_PermissionsHandle handle);
+static local_participant_access_rights *find_local_rights_by_identity(dds_security_access_control_impl *ac, DDS_Security_IdentityHandle identity_handle);
+static remote_participant_access_rights *find_remote_rights_by_identity(dds_security_access_control_impl *ac, DDS_Security_IdentityHandle identity_handle);
+static DDS_Security_boolean domainid_within_sets(struct domain_id_set *domain, int domain_id);
+static DDS_Security_boolean is_topic_in_criteria(const struct criteria *criteria, const char *topic_name);
+static DDS_Security_boolean is_partition_qos_in_criteria(const struct criteria *criteria, const DDS_Security_PartitionQosPolicy *partitions);
+static DDS_Security_boolean is_partition_in_criteria(const struct criteria *criteria, const char *partition_name);
+static struct domain_rule *find_domain_rule_in_governance(struct domain_rule *rule, int domain_id);
+static DDS_Security_boolean get_participant_sec_attributes(dds_security_access_control *instance, const DDS_Security_PermissionsHandle permissions_handle,
+    DDS_Security_ParticipantSecurityAttributes *attributes, DDS_Security_SecurityException *ex);
+static DDS_Security_boolean get_permissions_token(dds_security_access_control *instance, DDS_Security_PermissionsToken *permissions_token, const DDS_Security_PermissionsHandle handle, DDS_Security_SecurityException *ex);
+static remote_participant_access_rights *find_remote_permissions_by_permissions_handle(dds_security_access_control_impl *ac, DDS_Security_PermissionsHandle permissions_handle);
+static struct topic_rule *find_topic_from_domain_rule(struct domain_rule *domain_rule, const char *topic_name);
+static DDS_Security_boolean domainid_within_sets(struct domain_id_set *domain, int domain_id);
+static DDS_Security_boolean compare_class_id_plugin_classname(DDS_Security_string class_id_1, DDS_Security_string class_id_2);
+static DDS_Security_boolean compare_class_id_major_ver(DDS_Security_string class_id_1, DDS_Security_string class_id_2);
+#if TIMED_CALLBACK_IMPLEMENTED
+  static void add_validity_end_trigger(dds_security_access_control_impl *ac, const DDS_Security_PermissionsHandle permissions_handle, dds_time_t end);
+#endif
+static DDS_Security_boolean is_allowed_by_permissions(struct permissions_parser *permissions, int domain_id, const char *topic_name, const DDS_Security_PartitionQosPolicy *partitions,
+    const char *identity_subject_name, permission_criteria_type criteria_type, DDS_Security_SecurityException *ex);
+static void sanity_check_local_access_rights(local_participant_access_rights *rights);
+static void sanity_check_remote_access_rights(remote_participant_access_rights *rights);
+static TOPIC_TYPE get_topic_type(const char *topic_name);
+
+
+static DDS_Security_PermissionsHandle
+validate_local_permissions(
+    dds_security_access_control *instance,
+    const dds_security_authentication *auth_plugin,
+    const DDS_Security_IdentityHandle identity_handle,
+    const DDS_Security_DomainId domain_id,
+    const DDS_Security_Qos *participant_qos,
+    DDS_Security_SecurityException *ex)
+{
+  dds_security_access_control_impl *ac = (dds_security_access_control_impl *)instance;
+  local_participant_access_rights *rights;
+  DDS_Security_PermissionsHandle permissions_handle = DDS_SECURITY_HANDLE_NIL;
+
+  if (!instance || !auth_plugin || identity_handle == DDS_SECURITY_HANDLE_NIL || !participant_qos)
+  {
+    DDS_Security_Exception_set(ex, DDS_ACCESS_CONTROL_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_PARAMETER_CODE, 0, DDS_SECURITY_ERR_INVALID_PARAMETER_MESSAGE);
+    return DDS_SECURITY_HANDLE_NIL;
+  }
+
+#ifdef ACCESS_CONTROL_USE_ONE_PERMISSION
+  ddsrt_mutex_lock(&ac->lock);
+  if (ac->local_access_rights == NULL)
+  {
+    rights = check_and_create_local_participant_rights(identity_handle, domain_id, participant_qos, ex);
+    ac->local_access_rights = rights;
+  }
+  else
+  {
+    ACCESS_CONTROL_OBJECT_KEEP(ac->local_access_rights);
+    rights = ac->local_access_rights;
+  }
+  ddsrt_mutex_unlock(&ac->lock);
+#else
+  {
+    local_participant_access_rights *existing = find_local_rights_by_identity(ac, identity_handle);
+    if (existing)
+    {
+      ACCESS_CONTROL_OBJECT_RELEASE(existing);
+      return ACCESS_CONTROL_OBJECT_HANDLE(existing);
+    }
+
+    rights = check_and_create_local_participant_rights(identity_handle, domain_id, participant_qos, ex);
+    if (rights)
+      access_control_table_insert(ac->local_permissions, (AccessControlObject *)rights);
+  }
+#endif
+
+  permissions_handle = ACCESS_CONTROL_OBJECT_HANDLE(rights);
+
+  if (permissions_handle != DDS_SECURITY_HANDLE_NIL)
+  {
+    assert (rights->permissions_expiry != DDS_TIME_INVALID);
+
+#if TIMED_CALLBACK_IMPLEMENTED
+    if (rights->permissions_expiry != 0)
+      add_validity_end_trigger(ac, permissions_handle, rights->permissions_expiry);
+#endif
+  }
+
+  return permissions_handle;
+}
+
+static DDS_Security_PermissionsHandle
+validate_remote_permissions(
+    dds_security_access_control *instance,
+    const dds_security_authentication *auth_plugin,
+    const DDS_Security_IdentityHandle local_identity_handle,
+    const DDS_Security_IdentityHandle remote_identity_handle,
+    const DDS_Security_PermissionsToken *remote_permissions_token,
+    const DDS_Security_AuthenticatedPeerCredentialToken *remote_credential_token,
+    DDS_Security_SecurityException *ex)
+{
+  dds_security_access_control_impl *ac = (dds_security_access_control_impl *)instance;
+  local_participant_access_rights *local_rights;
+  remote_participant_access_rights *remote_rights, *existing;
+  DDS_Security_PermissionsHandle permissions_handle = DDS_SECURITY_HANDLE_NIL;
+
+  if (!instance || !auth_plugin || local_identity_handle == DDS_SECURITY_HANDLE_NIL || remote_identity_handle == DDS_SECURITY_HANDLE_NIL ||
+      !remote_permissions_token || !remote_permissions_token->class_id || !remote_credential_token)
+  {
+    DDS_Security_Exception_set(ex, DDS_ACCESS_CONTROL_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_PARAMETER_CODE, 0, DDS_SECURITY_ERR_INVALID_PARAMETER_MESSAGE);
+    return DDS_SECURITY_HANDLE_NIL;
+  }
+
+  if (!(local_rights = find_local_rights_by_identity(ac, local_identity_handle)))
+  {
+    DDS_Security_Exception_set(ex, DDS_ACCESS_CONTROL_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_PARAMETER_CODE, 0, DDS_SECURITY_ERR_INVALID_PARAMETER_MESSAGE);
+    return DDS_SECURITY_HANDLE_NIL;
+  }
+
+  if ((existing = find_remote_rights_by_identity(ac, remote_identity_handle)))
+  {
+    if (existing->local_rights->local_identity == local_identity_handle)
+    {
+      ACCESS_CONTROL_OBJECT_RELEASE(existing);
+      return ACCESS_CONTROL_OBJECT_HANDLE(existing);
+    }
+  }
+
+#ifdef ACCESS_CONTROL_USE_ONE_PERMISSION
+  if (existing)
+  {
+    /* No check because it has already been checked */
+    remote_rights = ac_remote_participant_access_rights_new(remote_identity_handle, local_rights, existing->permissions, existing->permissions_expiry, remote_permissions_token, existing->identity_subject_name);
+    sanity_check_remote_access_rights(remote_rights);
+    /* TODO: copy or relate security attributes of existing with new remote permissions object */
+  }
+  else
+  {
+    remote_rights = check_and_create_remote_participant_rights(remote_identity_handle, local_rights, remote_permissions_token, remote_credential_token, ex);
+  }
+#else
+  remote_rights = check_and_create_remote_participant_rights(remote_identity_handle, local_rights, remote_permissions_token, remote_credential_token, ex);
+#endif
+
+  permissions_handle = ACCESS_CONTROL_OBJECT_HANDLE(remote_rights);
+
+#if TIMED_CALLBACK_IMPLEMENTED
+  if (permissions_handle != DDS_SECURITY_HANDLE_NIL)
+    add_validity_end_trigger(ac, permissions_handle, remote_rights->permissions_expiry);
+#endif
+
+  if (remote_rights)
+    access_control_table_insert(ac->remote_permissions, (AccessControlObject *)remote_rights);
+
+  ACCESS_CONTROL_OBJECT_RELEASE(existing);
+  ACCESS_CONTROL_OBJECT_RELEASE(remote_rights);
+  ACCESS_CONTROL_OBJECT_RELEASE(local_rights);
+
+  return permissions_handle;
+}
+
+static DDS_Security_boolean
+check_create_participant(dds_security_access_control *instance,
+                         const DDS_Security_PermissionsHandle permissions_handle,
+                         const DDS_Security_DomainId domain_id,
+                         const DDS_Security_Qos *participant_qos,
+                         DDS_Security_SecurityException *ex)
+{
+  dds_security_access_control_impl *ac = (dds_security_access_control_impl *)instance;
+  local_participant_access_rights *rights;
+  struct domain_rule *domainRule = NULL;
+  struct topic_rule *topicRule = NULL;
+  DDS_Security_ParticipantSecurityAttributes participantSecurityAttributes;
+  DDS_Security_boolean result = false;
+
+  if (instance == NULL || permissions_handle == DDS_SECURITY_HANDLE_NIL || participant_qos == NULL)
+  {
+    DDS_Security_Exception_set(ex, DDS_ACCESS_CONTROL_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_PARAMETER_CODE, 0, DDS_SECURITY_ERR_INVALID_PARAMETER_MESSAGE);
+    return false;
+  }
+
+  /* Retrieve rights */
+  if ((rights = find_local_access_rights(ac, permissions_handle)) == NULL)
+  {
+    DDS_Security_Exception_set(ex, DDS_ACCESS_CONTROL_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_PARAMETER_CODE, 0, "Could not find local rights for the participant.");
+    return false;
+  }
+
+  /* Retrieve domain rules */
+  domainRule = find_domain_rule_in_governance(rights->governance_tree->dds->domain_access_rules->domain_rule, domain_id);
+  if (domainRule == NULL || domainRule->topic_access_rules == NULL || domainRule->topic_access_rules->topic_rule == NULL)
+  {
+    DDS_Security_Exception_set(ex, DDS_ACCESS_CONTROL_PLUGIN_CONTEXT, DDS_SECURITY_ERR_CAN_NOT_FIND_DOMAIN_IN_GOVERNANCE_CODE, 0, DDS_SECURITY_ERR_CAN_NOT_FIND_DOMAIN_IN_GOVERNANCE_MESSAGE, domain_id);
+    goto exit;
+  }
+
+  /* Iterate over topics rules*/
+  topicRule = domainRule->topic_access_rules->topic_rule;
+  while (topicRule != NULL)
+  {
+    if (!topicRule->enable_read_access_control->value || !topicRule->enable_write_access_control->value)
+    {
+      /* Governance specifies any topics on the DomainParticipant
+         domain_id with enable_read_access_control set to false or with enable_write_access_control set to false */
+      result = true;
+      goto exit;
+    }
+    topicRule = (struct topic_rule *)topicRule->node.next;
+  }
+
+  if (!get_participant_sec_attributes(instance, permissions_handle, &participantSecurityAttributes, ex))
+    goto exit;
+
+  if (!participantSecurityAttributes.is_access_protected)
+  {
+    result = true;
+    goto exit;
+  }
+
+  /* Is this participant permitted? */
+  result = is_allowed_by_permissions(rights->permissions_tree, domain_id, NULL /* topic_name */, NULL /* partitions */, rights->identity_subject_name, UNKNOWN_CRITERIA, ex);
+
+exit:
+  ACCESS_CONTROL_OBJECT_RELEASE(rights);
+  return result;
+}
+
+static DDS_Security_boolean
+check_create_datawriter(dds_security_access_control *instance,
+                        const DDS_Security_PermissionsHandle permissions_handle,
+                        const DDS_Security_DomainId domain_id, const char *topic_name,
+                        const DDS_Security_Qos *writer_qos,
+                        const DDS_Security_PartitionQosPolicy *partition,
+                        const DDS_Security_DataTags *data_tag,
+                        DDS_Security_SecurityException *ex)
+{
+  DDS_Security_TopicSecurityAttributes topic_sec_attr;
+  local_participant_access_rights *local_rights;
+  DDS_Security_boolean result = false;
+  DDSRT_UNUSED_ARG(data_tag);
+
+  if (instance == NULL)
+  {
+    DDS_Security_Exception_set(ex, DDS_ACCESS_CONTROL_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_PARAMETER_CODE, 0, "Plugin instance not provided");
+    return false;
+  }
+  if (permissions_handle == DDS_SECURITY_HANDLE_NIL)
+  {
+    DDS_Security_Exception_set(ex, DDS_ACCESS_CONTROL_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_PARAMETER_CODE, 0, "Permissions handle not provided");
+    return false;
+  }
+  if (topic_name == NULL)
+  {
+    DDS_Security_Exception_set(ex, DDS_ACCESS_CONTROL_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_PARAMETER_CODE, 0, "Topic name not provided");
+    return false;
+  }
+  if (writer_qos == NULL)
+  {
+    DDS_Security_Exception_set(ex, DDS_ACCESS_CONTROL_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_PARAMETER_CODE, 0, "QoS not provided");
+    return false;
+  }
+  if (partition == NULL)
+  {
+    DDS_Security_Exception_set(ex, DDS_ACCESS_CONTROL_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_PARAMETER_CODE, 0, "Partition not provided");
+    return false;
+  }
+  if ((local_rights = find_local_access_rights((dds_security_access_control_impl *)instance, permissions_handle)) == NULL)
+  {
+    DDS_Security_Exception_set(ex, DDS_ACCESS_CONTROL_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_PARAMETER_CODE, 0, "Could not find rights material");
+    return false;
+  }
+  if (local_rights->domain_id != domain_id)
+  {
+    DDS_Security_Exception_set(ex, DDS_ACCESS_CONTROL_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_PARAMETER_CODE, 0,
+        "Given domain_id (%d) does not match the related participant domain_id (%d)\n", domain_id, local_rights->domain_id);
+    goto exit;
+  }
+
+  /* Find a topic with the specified topic name in the Governance */
+  if (!(result = instance->get_topic_sec_attributes(instance, permissions_handle, topic_name, &topic_sec_attr, ex)))
+    goto exit;
+
+  if (!topic_sec_attr.is_write_protected)
+  {
+    result = true;
+    goto exit;
+  }
+
+  /* Find a topic with the specified topic name in the Governance */
+  result = is_allowed_by_permissions(local_rights->permissions_tree, domain_id, topic_name, partition, local_rights->identity_subject_name, PUBLISH_CRITERIA, ex);
+
+exit:
+  ACCESS_CONTROL_OBJECT_RELEASE(local_rights);
+  return result;
+}
+
+static DDS_Security_boolean
+check_create_datareader(dds_security_access_control *instance,
+                        const DDS_Security_PermissionsHandle permissions_handle,
+                        const DDS_Security_DomainId domain_id,
+                        const char *topic_name,
+                        const DDS_Security_Qos *reader_qos,
+                        const DDS_Security_PartitionQosPolicy *partition,
+                        const DDS_Security_DataTags *data_tag,
+                        DDS_Security_SecurityException *ex)
+{
+  DDS_Security_TopicSecurityAttributes topic_sec_attr;
+  local_participant_access_rights *local_rights;
+  DDS_Security_boolean result = false;
+
+  DDSRT_UNUSED_ARG(data_tag);
+
+  if (instance == NULL || permissions_handle == DDS_SECURITY_HANDLE_NIL || topic_name == NULL || reader_qos == NULL || partition == NULL)
+  {
+    DDS_Security_Exception_set(ex, DDS_ACCESS_CONTROL_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_PARAMETER_CODE, 0, DDS_SECURITY_ERR_INVALID_PARAMETER_MESSAGE);
+    return false;
+  }
+  if ((local_rights = find_local_access_rights((dds_security_access_control_impl *)instance, permissions_handle)) == NULL)
+  {
+    DDS_Security_Exception_set(ex, DDS_ACCESS_CONTROL_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_PARAMETER_CODE, 0, DDS_SECURITY_ERR_INVALID_PARAMETER_MESSAGE);
+    return false;
+  }
+  if (local_rights->domain_id != domain_id)
+  {
+    DDS_Security_Exception_set(ex, DDS_ACCESS_CONTROL_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_PARAMETER_CODE, 0,
+        "Given domain_id (%d) does not match the related participant domain_id (%d)\n", domain_id, local_rights->domain_id);
+    goto exit;
+  }
+
+  /* Find a topic with the specified topic name in the Governance */
+  if ((result = instance->get_topic_sec_attributes(instance, permissions_handle, topic_name, &topic_sec_attr, ex)) == false)
+    goto exit;
+
+  if (topic_sec_attr.is_read_protected == false)
+  {
+    result = true;
+    goto exit;
+  }
+
+  /* Find a topic with the specified topic name in the Governance */
+  result = is_allowed_by_permissions(local_rights->permissions_tree, domain_id, topic_name, partition, local_rights->identity_subject_name, SUBSCRIBE_CRITERIA, ex);
+
+exit:
+  ACCESS_CONTROL_OBJECT_RELEASE(local_rights);
+  return result;
+}
+
+static DDS_Security_boolean
+check_create_topic(dds_security_access_control *instance,
+                   const DDS_Security_PermissionsHandle permissions_handle,
+                   const DDS_Security_DomainId domain_id, const char *topic_name,
+                   const DDS_Security_Qos *qos, DDS_Security_SecurityException *ex)
+{
+  DDS_Security_TopicSecurityAttributes topic_sec_attr;
+  local_participant_access_rights *local_rights;
+  DDS_Security_boolean result = false;
+
+  if (instance == NULL || permissions_handle == DDS_SECURITY_HANDLE_NIL || qos == NULL || topic_name == NULL)
+  {
+    DDS_Security_Exception_set(ex, DDS_ACCESS_CONTROL_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_PARAMETER_CODE, 0, DDS_SECURITY_ERR_INVALID_PARAMETER_MESSAGE);
+    return false;
+  }
+  if ((local_rights = find_local_access_rights((dds_security_access_control_impl *)instance, permissions_handle)) == NULL)
+  {
+    DDS_Security_Exception_set(ex, DDS_ACCESS_CONTROL_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_PARAMETER_CODE, 0, DDS_SECURITY_ERR_INVALID_PARAMETER_MESSAGE);
+    return false;
+  }
+  if (local_rights->domain_id != domain_id)
+  {
+    DDS_Security_Exception_set(ex, DDS_ACCESS_CONTROL_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_PARAMETER_CODE, 0,
+        "Given domain_id (%d) does not match the related participant domain_id (%d)\n", domain_id, local_rights->domain_id);
+    goto exit;
+  }
+
+  /* Find a topic with the specified topic name in the Governance */
+  if ((result = instance->get_topic_sec_attributes(instance, permissions_handle, topic_name, &topic_sec_attr, ex)) == false)
+    goto exit;
+
+  if (topic_sec_attr.is_read_protected == false || topic_sec_attr.is_write_protected == false)
+  {
+    result = true;
+    goto exit;
+  }
+
+  /* Find a topic with the specified topic name in the Governance */
+  result = is_allowed_by_permissions(local_rights->permissions_tree, domain_id, topic_name, NULL, local_rights->identity_subject_name, UNKNOWN_CRITERIA /* both publish and subscribe rules */, ex);
+
+exit:
+  ACCESS_CONTROL_OBJECT_RELEASE(local_rights);
+  return result;
+}
+
+static DDS_Security_boolean
+check_local_datawriter_register_instance(
+    dds_security_access_control *instance,
+    const DDS_Security_PermissionsHandle permissions_handle,
+    const DDS_Security_Entity *writer, const DDS_Security_DynamicData *key,
+    DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(permissions_handle);
+  DDSRT_UNUSED_ARG(writer);
+  DDSRT_UNUSED_ARG(key);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+
+  /* Not implemented */
+  return true;
+}
+
+static DDS_Security_boolean
+check_local_datawriter_dispose_instance(
+    dds_security_access_control *instance,
+    const DDS_Security_PermissionsHandle permissions_handle,
+    const DDS_Security_Entity *writer, const DDS_Security_DynamicData key,
+    DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(permissions_handle);
+  DDSRT_UNUSED_ARG(writer);
+  DDSRT_UNUSED_ARG(key);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+
+  /* Not implemented */
+  return true;
+}
+
+static DDS_Security_boolean
+check_remote_participant(dds_security_access_control *instance,
+                         const DDS_Security_PermissionsHandle permissions_handle,
+                         const DDS_Security_DomainId domain_id,
+                         const DDS_Security_ParticipantBuiltinTopicDataSecure *participant_data,
+                         DDS_Security_SecurityException *ex)
+{
+  dds_security_access_control_impl *ac = (dds_security_access_control_impl *)instance;
+  remote_participant_access_rights *remote_rights = NULL;
+  DDS_Security_boolean isValid = false;
+  DDS_Security_ParticipantSecurityAttributes participantSecurityAttributes;
+  DDS_Security_PermissionsHandle local_permissions_handle;
+  DDS_Security_string class_id_remote_str;
+  DDS_Security_string class_id_local_str;
+  DDS_Security_boolean result = false;
+
+  if (instance == NULL || permissions_handle == DDS_SECURITY_HANDLE_NIL || participant_data == NULL)
+  {
+    DDS_Security_Exception_set(ex, DDS_ACCESS_CONTROL_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_PARAMETER_CODE, 0, DDS_SECURITY_ERR_INVALID_PARAMETER_MESSAGE);
+    return false;
+  }
+
+  /* retrieve the cached remote DomainParticipant Governance; the permissions_handle is associated with the remote participant */
+  if ((remote_rights = find_remote_permissions_by_permissions_handle(ac, permissions_handle)) == NULL)
+  {
+    DDS_Security_Exception_set(ex, DDS_ACCESS_CONTROL_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_PARAMETER_CODE, 0, DDS_SECURITY_ERR_INVALID_PARAMETER_MESSAGE);
+    return false;
+  }
+
+  /* The local rights pointer is actually the local permissions handle. */
+  local_permissions_handle = ACCESS_CONTROL_OBJECT_HANDLE(remote_rights->local_rights);
+  if ((isValid = get_participant_sec_attributes(instance, local_permissions_handle, &participantSecurityAttributes, ex)) == false)
+    goto exit;
+  if (participantSecurityAttributes.is_access_protected == false)
+  {
+    result = true;
+    goto exit;
+  }
+
+  /* 2) If the PluginClassName or the MajorVersion of the local permissions_token differ from those in the remote_permissions_token,
+       the operation shall return false. */
+  class_id_remote_str = remote_rights->permissions->remote_permissions_token_class_id;
+  class_id_local_str = get_access_control_class_id(ACCESS_CONTROL_PERMISSIONS_CLASS_ID);
+  if (compare_class_id_plugin_classname(class_id_remote_str, class_id_local_str) == false)
+  {
+    DDS_Security_Exception_set(ex, DDS_ACCESS_CONTROL_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INCOMPATIBLE_REMOTE_PLUGIN_CLASSNAME_CODE, 0, DDS_SECURITY_ERR_INCOMPATIBLE_REMOTE_PLUGIN_CLASSNAME_MESSAGE);
+    goto exit_free_classid;
+  }
+  if (compare_class_id_major_ver(class_id_remote_str, class_id_local_str) == false)
+  {
+    DDS_Security_Exception_set(ex, DDS_ACCESS_CONTROL_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INCOMPATIBLE_REMOTE_PLUGIN_MAJORVERSION_CODE, 0, DDS_SECURITY_ERR_INCOMPATIBLE_REMOTE_PLUGIN_MAJORVERSION_MESSAGE);
+    goto exit_free_classid;
+  }
+
+  /* 3) If the Permissions document contains a Grant for the remote DomainParticipant and the Grant contains an allow rule on
+       the DomainParticipant domain_id, then the  operation shall succeed and return true. */
+  /* Iterate over the grants and rules of the remote participant */
+  result = is_allowed_by_permissions(remote_rights->permissions->permissions_tree, domain_id, NULL, NULL, remote_rights->identity_subject_name, UNKNOWN_CRITERIA, ex);
+
+exit_free_classid:
+  ddsrt_free(class_id_local_str);
+exit:
+  ACCESS_CONTROL_OBJECT_RELEASE(remote_rights);
+  return result;
+}
+
+static DDS_Security_boolean
+check_remote_datawriter(dds_security_access_control *instance,
+                        const DDS_Security_PermissionsHandle permissions_handle,
+                        const DDS_Security_DomainId domain_id,
+                        const DDS_Security_PublicationBuiltinTopicDataSecure *publication_data,
+                        DDS_Security_SecurityException *ex)
+{
+  dds_security_access_control_impl *ac = (dds_security_access_control_impl *)instance;
+  DDS_Security_TopicSecurityAttributes topic_sec_attr;
+  remote_participant_access_rights *remote_rights;
+  DDS_Security_string class_id_remote_str;
+  DDS_Security_string class_id_local_str;
+  DDS_Security_boolean result = false;
+
+  if (instance == NULL || permissions_handle == DDS_SECURITY_HANDLE_NIL || publication_data == NULL)
+  {
+    DDS_Security_Exception_set(ex, DDS_ACCESS_CONTROL_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_PARAMETER_CODE, 0, DDS_SECURITY_ERR_INVALID_PARAMETER_MESSAGE);
+    return false;
+  }
+  if ((remote_rights = find_remote_permissions_by_permissions_handle(ac, permissions_handle)) == NULL)
+  {
+    DDS_Security_Exception_set(ex, DDS_ACCESS_CONTROL_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_PARAMETER_CODE, 0, DDS_SECURITY_ERR_INVALID_PARAMETER_MESSAGE);
+    return false;
+  }
+  if ((result = instance->get_topic_sec_attributes(instance, ACCESS_CONTROL_OBJECT_HANDLE(remote_rights->local_rights), publication_data->topic_name, &topic_sec_attr, ex)) == false)
+    goto exit;
+  if (topic_sec_attr.is_write_protected == false)
+  {
+    result = true;
+    goto exit;
+  }
+
+  /* Compare PluginClassName and MajorVersion parts */
+  class_id_remote_str = remote_rights->permissions->remote_permissions_token_class_id;
+  class_id_local_str = get_access_control_class_id(ACCESS_CONTROL_PERMISSIONS_CLASS_ID);
+  if (compare_class_id_plugin_classname(class_id_remote_str, class_id_local_str) == false)
+  {
+    DDS_Security_Exception_set(ex, DDS_ACCESS_CONTROL_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INCOMPATIBLE_REMOTE_PLUGIN_CLASSNAME_CODE, 0,
+        DDS_SECURITY_ERR_INCOMPATIBLE_REMOTE_PLUGIN_CLASSNAME_MESSAGE);
+    goto exit_free_classid;
+  }
+  if (compare_class_id_major_ver(class_id_remote_str, class_id_local_str) == false)
+  {
+    DDS_Security_Exception_set(ex, DDS_ACCESS_CONTROL_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INCOMPATIBLE_REMOTE_PLUGIN_MAJORVERSION_CODE, 0,
+        DDS_SECURITY_ERR_INCOMPATIBLE_REMOTE_PLUGIN_MAJORVERSION_MESSAGE);
+    goto exit_free_classid;
+  }
+
+  /* Find a topic with the specified topic name in the Governance */
+  result = is_allowed_by_permissions(remote_rights->permissions->permissions_tree, domain_id, publication_data->topic_name,
+      &(publication_data->partition), remote_rights->identity_subject_name, PUBLISH_CRITERIA, ex);
+
+exit_free_classid:
+  ddsrt_free(class_id_local_str);
+exit:
+  ACCESS_CONTROL_OBJECT_RELEASE(remote_rights);
+  return result;
+}
+
+static DDS_Security_boolean
+check_remote_datareader(dds_security_access_control *instance,
+                        const DDS_Security_PermissionsHandle permissions_handle,
+                        const DDS_Security_DomainId domain_id,
+                        const DDS_Security_SubscriptionBuiltinTopicDataSecure *subscription_data,
+                        DDS_Security_boolean *relay_only,
+                        DDS_Security_SecurityException *ex)
+{
+  dds_security_access_control_impl *ac = (dds_security_access_control_impl *)instance;
+  DDS_Security_TopicSecurityAttributes topic_sec_attr;
+  remote_participant_access_rights *remote_rights;
+  DDS_Security_string class_id_remote_str;
+  DDS_Security_string class_id_local_str;
+
+  DDS_Security_boolean result = false;
+
+  if (instance == NULL || permissions_handle == DDS_SECURITY_HANDLE_NIL || subscription_data == NULL || relay_only == NULL)
+  {
+    DDS_Security_Exception_set(ex, DDS_ACCESS_CONTROL_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_PARAMETER_CODE, 0, DDS_SECURITY_ERR_INVALID_PARAMETER_MESSAGE);
+    return false;
+  }
+
+  *relay_only = false;
+  if ((remote_rights = find_remote_permissions_by_permissions_handle(ac, permissions_handle)) == NULL)
+  {
+    DDS_Security_Exception_set(ex, DDS_ACCESS_CONTROL_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_PARAMETER_CODE, 0, DDS_SECURITY_ERR_INVALID_PARAMETER_MESSAGE);
+    return false;
+  }
+  if (!(instance->get_topic_sec_attributes(instance, ACCESS_CONTROL_OBJECT_HANDLE(remote_rights->local_rights), subscription_data->topic_name, &topic_sec_attr, ex)))
+    goto exit;
+  if (!topic_sec_attr.is_read_protected)
+  {
+    result = true;
+    goto exit;
+  }
+
+  /* Compare PluginClassName and MajorVersion parts */
+  class_id_remote_str = remote_rights->permissions->remote_permissions_token_class_id;
+  class_id_local_str = get_access_control_class_id(ACCESS_CONTROL_PERMISSIONS_CLASS_ID);
+  if (compare_class_id_plugin_classname(class_id_remote_str, class_id_local_str) == false)
+  {
+    DDS_Security_Exception_set(ex, DDS_ACCESS_CONTROL_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INCOMPATIBLE_REMOTE_PLUGIN_CLASSNAME_CODE, 0,
+        DDS_SECURITY_ERR_INCOMPATIBLE_REMOTE_PLUGIN_CLASSNAME_MESSAGE);
+    goto exit_free_classid;
+  }
+  if (compare_class_id_major_ver(class_id_remote_str, class_id_local_str) == false)
+  {
+    DDS_Security_Exception_set(ex, DDS_ACCESS_CONTROL_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INCOMPATIBLE_REMOTE_PLUGIN_MAJORVERSION_CODE, 0,
+                               DDS_SECURITY_ERR_INCOMPATIBLE_REMOTE_PLUGIN_MAJORVERSION_MESSAGE);
+    ACCESS_CONTROL_OBJECT_RELEASE(remote_rights);
+    goto exit_free_classid;
+  }
+
+  /* Find a topic with the specified topic name in the Governance */
+  result = is_allowed_by_permissions(remote_rights->permissions->permissions_tree, domain_id, subscription_data->topic_name,
+      &(subscription_data->partition), remote_rights->identity_subject_name, SUBSCRIBE_CRITERIA, ex);
+
+exit_free_classid:
+  ddsrt_free(class_id_local_str);
+exit:
+  ACCESS_CONTROL_OBJECT_RELEASE(remote_rights);
+  return result;
+}
+
+static DDS_Security_boolean
+check_remote_topic(dds_security_access_control *instance,
+                   const DDS_Security_PermissionsHandle permissions_handle,
+                   const DDS_Security_DomainId domain_id,
+                   const DDS_Security_TopicBuiltinTopicData *topic_data,
+                   DDS_Security_SecurityException *ex)
+{
+  dds_security_access_control_impl *ac = (dds_security_access_control_impl *)instance;
+  DDS_Security_TopicSecurityAttributes topic_sec_attr;
+  remote_participant_access_rights *remote_rights;
+  DDS_Security_string class_id_remote_str;
+  DDS_Security_string class_id_local_str;
+  DDS_Security_boolean result = false;
+
+  if (instance == NULL || permissions_handle == DDS_SECURITY_HANDLE_NIL || topic_data == NULL)
+  {
+    DDS_Security_Exception_set(ex, DDS_ACCESS_CONTROL_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_PARAMETER_CODE, 0, DDS_SECURITY_ERR_INVALID_PARAMETER_MESSAGE);
+    return false;
+  }
+  if ((remote_rights = find_remote_permissions_by_permissions_handle(ac, permissions_handle)) == NULL)
+  {
+    DDS_Security_Exception_set(ex, DDS_ACCESS_CONTROL_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_PARAMETER_CODE, 0, DDS_SECURITY_ERR_INVALID_PARAMETER_MESSAGE);
+    return false;
+  }
+  if ((result = instance->get_topic_sec_attributes(instance, ACCESS_CONTROL_OBJECT_HANDLE(remote_rights->local_rights), topic_data->name, &topic_sec_attr, ex)) == false)
+    goto exit;
+  if (!topic_sec_attr.is_read_protected || !topic_sec_attr.is_write_protected)
+  {
+    result = true;
+    goto exit;
+  }
+
+  /* Compare PluginClassName and MajorVersion parts */
+  class_id_remote_str = remote_rights->permissions->remote_permissions_token_class_id;
+  class_id_local_str = get_access_control_class_id(ACCESS_CONTROL_PERMISSIONS_CLASS_ID);
+  if (!compare_class_id_plugin_classname(class_id_remote_str, class_id_local_str))
+  {
+    DDS_Security_Exception_set(ex, DDS_ACCESS_CONTROL_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INCOMPATIBLE_REMOTE_PLUGIN_CLASSNAME_CODE, 0,
+      DDS_SECURITY_ERR_INCOMPATIBLE_REMOTE_PLUGIN_CLASSNAME_MESSAGE);
+    goto exit_free_classid;
+  }
+  if (!compare_class_id_major_ver(class_id_remote_str, class_id_local_str))
+  {
+    DDS_Security_Exception_set(ex, DDS_ACCESS_CONTROL_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INCOMPATIBLE_REMOTE_PLUGIN_MAJORVERSION_CODE, 0,
+      DDS_SECURITY_ERR_INCOMPATIBLE_REMOTE_PLUGIN_MAJORVERSION_MESSAGE);
+    goto exit_free_classid;
+  }
+
+  result = is_allowed_by_permissions(remote_rights->permissions->permissions_tree, domain_id, topic_data->name, NULL, remote_rights->identity_subject_name, UNKNOWN_CRITERIA, ex);
+
+exit_free_classid:
+  ddsrt_free(class_id_local_str);
+exit:
+  ACCESS_CONTROL_OBJECT_RELEASE(remote_rights);
+  return result;
+}
+
+static DDS_Security_boolean
+check_local_datawriter_match(
+    dds_security_access_control *instance,
+    const DDS_Security_PermissionsHandle writer_permissions_handle,
+    const DDS_Security_PermissionsHandle reader_permissions_handle,
+    const DDS_Security_PublicationBuiltinTopicDataSecure *publication_data,
+    const DDS_Security_SubscriptionBuiltinTopicDataSecure *subscription_data,
+    DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(writer_permissions_handle);
+  DDSRT_UNUSED_ARG(reader_permissions_handle);
+  DDSRT_UNUSED_ARG(publication_data);
+  DDSRT_UNUSED_ARG(subscription_data);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+
+  /* This function is not implemented because it relies on DataTagging,
+     an optional DDS Security feature that is not implemented */
+  return true;
+}
+
+static DDS_Security_boolean
+check_local_datareader_match(
+    dds_security_access_control *instance,
+    const DDS_Security_PermissionsHandle reader_permissions_handle,
+    const DDS_Security_PermissionsHandle writer_permissions_handle,
+    const DDS_Security_SubscriptionBuiltinTopicDataSecure *subscription_data,
+    const DDS_Security_PublicationBuiltinTopicDataSecure *publication_data,
+    DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(reader_permissions_handle);
+  DDSRT_UNUSED_ARG(writer_permissions_handle);
+  DDSRT_UNUSED_ARG(subscription_data);
+  DDSRT_UNUSED_ARG(publication_data);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+
+  /* Not implemented */
+  return true;
+}
+
+static DDS_Security_boolean
+check_remote_datawriter_register_instance(
+    dds_security_access_control *instance,
+    const DDS_Security_PermissionsHandle permissions_handle,
+    const DDS_Security_Entity *reader,
+    const DDS_Security_InstanceHandle publication_handle,
+    const DDS_Security_DynamicData key,
+    const DDS_Security_InstanceHandle instance_handle,
+    DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(permissions_handle);
+  DDSRT_UNUSED_ARG(reader);
+  DDSRT_UNUSED_ARG(publication_handle);
+  DDSRT_UNUSED_ARG(key);
+  DDSRT_UNUSED_ARG(instance_handle);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+
+  /* Not implemented */
+  return true;
+}
+
+static DDS_Security_boolean
+check_remote_datawriter_dispose_instance(
+    dds_security_access_control *instance,
+    const DDS_Security_PermissionsHandle permissions_handle,
+    const DDS_Security_Entity *reader,
+    const DDS_Security_InstanceHandle publication_handle,
+    const DDS_Security_DynamicData key,
+    DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(permissions_handle);
+  DDSRT_UNUSED_ARG(reader);
+  DDSRT_UNUSED_ARG(publication_handle);
+  DDSRT_UNUSED_ARG(key);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+
+  /* Not implemented */
+  return true;
+}
+
+static DDS_Security_boolean
+get_permissions_token(dds_security_access_control *instance,
+                      DDS_Security_PermissionsToken *permissions_token,
+                      const DDS_Security_PermissionsHandle handle,
+                      DDS_Security_SecurityException *ex)
+{
+  local_participant_access_rights *rights;
+  if (!ex)
+    return false;
+  if (!instance)
+  {
+    DDS_Security_Exception_set(ex, DDS_ACCESS_CONTROL_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_PARAMETER_CODE, DDS_SECURITY_VALIDATION_FAILED, "get_permissions_token: No instance provided");
+    return false;
+  }
+  if (!permissions_token)
+  {
+    DDS_Security_Exception_set(ex, DDS_ACCESS_CONTROL_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_PARAMETER_CODE, DDS_SECURITY_VALIDATION_FAILED, "get_permissions_token: No permissions token provided");
+    return false;
+  }
+  if (handle == DDS_SECURITY_HANDLE_NIL)
+  {
+    DDS_Security_Exception_set(ex, DDS_ACCESS_CONTROL_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_PARAMETER_CODE, DDS_SECURITY_VALIDATION_FAILED, "get_permissions_token: No permissions handle provided");
+    return false;
+  }
+  if ((rights = find_local_access_rights((dds_security_access_control_impl *)instance, handle)) == NULL)
+  {
+    DDS_Security_Exception_set(ex, DDS_ACCESS_CONTROL_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_PARAMETER_CODE, 0, "get_permissions_token: Unused permissions handle provided");
+    return false;
+  }
+
+  ACCESS_CONTROL_OBJECT_RELEASE(rights);
+  memset(permissions_token, 0, sizeof(*permissions_token));
+  permissions_token->class_id = get_access_control_class_id(ACCESS_CONTROL_PERMISSIONS_CLASS_ID);
+  return true;
+}
+
+static DDS_Security_boolean
+get_permissions_credential_token(
+    dds_security_access_control *instance,
+    DDS_Security_PermissionsCredentialToken *permissions_credential_token,
+    const DDS_Security_PermissionsHandle handle,
+    DDS_Security_SecurityException *ex)
+{
+  dds_security_access_control_impl *ac = (dds_security_access_control_impl *)instance;
+  local_participant_access_rights *rights;
+  if (!ex)
+    return false;
+  if (!instance)
+  {
+    DDS_Security_Exception_set(ex, DDS_ACCESS_CONTROL_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_PARAMETER_CODE, DDS_SECURITY_VALIDATION_FAILED, "get_permissions_credential_token: No instance provided");
+    return false;
+  }
+  if (!permissions_credential_token)
+  {
+    DDS_Security_Exception_set(ex, DDS_ACCESS_CONTROL_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_PARAMETER_CODE, DDS_SECURITY_VALIDATION_FAILED, "get_permissions_credential_token: No permissions credential token provided");
+    return false;
+  }
+  if (handle == DDS_SECURITY_HANDLE_NIL)
+  {
+    DDS_Security_Exception_set(ex, DDS_ACCESS_CONTROL_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_PARAMETER_CODE, DDS_SECURITY_VALIDATION_FAILED, "get_permissions_credential_token: No permissions handle provided");
+    return false;
+  }
+  if ((rights = find_local_access_rights(ac, handle)) == NULL)
+  {
+    DDS_Security_Exception_set(ex, DDS_ACCESS_CONTROL_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_PARAMETER_CODE, 0, "get_permissions_credential_token: Unused permissions handle provided");
+    return false;
+  }
+
+  memset(permissions_credential_token, 0, sizeof(*permissions_credential_token));
+  permissions_credential_token->class_id = ddsrt_strdup(ACCESS_PERMISSIONS_CREDENTIAL_TOKEN_ID);
+  permissions_credential_token->properties._length = permissions_credential_token->properties._maximum = 1;
+  permissions_credential_token->properties._buffer = DDS_Security_PropertySeq_allocbuf(1);
+  permissions_credential_token->properties._buffer[0].name = ddsrt_strdup(ACCESS_PROPERTY_PERMISSION_DOCUMENT);
+  permissions_credential_token->properties._buffer[0].value = ddsrt_strdup(rights->permissions_document);
+  ACCESS_CONTROL_OBJECT_RELEASE(rights);
+  return true;
+}
+
+
+static DDS_Security_boolean
+set_listener(dds_security_access_control *instance,
+             const dds_security_access_control_listener *listener,
+             DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(ex);
+#if TIMED_CALLBACK_IMPLEMENTED
+  dds_security_access_control_impl *ac = (dds_security_access_control_impl *)instance;
+  if (listener)
+    ut_timed_dispatcher_enable(ac->timed_callbacks, (void *)listener);
+  else
+    ut_timed_dispatcher_disable(ac->timed_callbacks);
+#else
+  DDSRT_UNUSED_ARG(instance);
+  DDSRT_UNUSED_ARG(listener);
+#endif
+
+  return true;
+}
+
+static DDS_Security_boolean
+return_permissions_token(
+    dds_security_access_control *instance,
+    const DDS_Security_PermissionsToken *token,
+    DDS_Security_SecurityException *ex)
+{
+  if (!instance || !token)
+  {
+    DDS_Security_Exception_set(ex, DDS_ACCESS_CONTROL_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_PARAMETER_CODE, 0, DDS_SECURITY_ERR_INVALID_PARAMETER_MESSAGE);
+    return false;
+  }
+  DDS_Security_DataHolder_deinit((DDS_Security_DataHolder *)token);
+  return true;
+}
+
+static DDS_Security_boolean
+return_permissions_credential_token(
+    dds_security_access_control *instance,
+    const DDS_Security_PermissionsCredentialToken *permissions_credential_token,
+    DDS_Security_SecurityException *ex)
+{
+  if (!instance || !permissions_credential_token)
+  {
+    DDS_Security_Exception_set(ex, DDS_ACCESS_CONTROL_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_PARAMETER_CODE, 0, DDS_SECURITY_ERR_INVALID_PARAMETER_MESSAGE);
+    return false;
+  }
+  DDS_Security_DataHolder_deinit((DDS_Security_DataHolder *)permissions_credential_token);
+  return true;
+}
+
+static void
+protectionkind_to_participant_attribute(
+    DDS_Security_ProtectionKind kind,
+    DDS_Security_boolean *is_protected,
+    DDS_Security_ParticipantSecurityAttributesMask *mask,
+    DDS_Security_ParticipantSecurityAttributesMask encryption_bit,
+    DDS_Security_ParticipantSecurityAttributesMask authentication_bit)
+{
+  switch (kind)
+  {
+  case DDS_SECURITY_PROTECTION_KIND_ENCRYPT_WITH_ORIGIN_AUTHENTICATION:
+    (*mask) |= authentication_bit;
+    (*mask) |= encryption_bit;
+    (*is_protected) = true;
+    break;
+  case DDS_SECURITY_PROTECTION_KIND_ENCRYPT:
+    (*mask) |= encryption_bit;
+    (*is_protected) = true;
+    break;
+  case DDS_SECURITY_PROTECTION_KIND_SIGN_WITH_ORIGIN_AUTHENTICATION:
+    (*mask) |= authentication_bit;
+    (*is_protected) = true;
+    break;
+  case DDS_SECURITY_PROTECTION_KIND_SIGN:
+    (*is_protected) = true;
+    break;
+  case DDS_SECURITY_PROTECTION_KIND_NONE:
+  default:
+    (*is_protected) = false;
+    break;
+  }
+}
+
+static DDS_Security_PluginEndpointSecurityAttributesMask
+get_plugin_endpoint_security_attributes_mask(
+    DDS_Security_boolean is_payload_encrypted,
+    DDS_Security_boolean is_submessage_encrypted,
+    DDS_Security_boolean is_submessage_origin_authenticated)
+{
+  DDS_Security_PluginEndpointSecurityAttributesMask mask = DDS_SECURITY_ENDPOINT_ATTRIBUTES_FLAG_IS_VALID;
+  if (is_submessage_encrypted)
+    mask |= DDS_SECURITY_PLUGIN_ENDPOINT_ATTRIBUTES_FLAG_IS_SUBMESSAGE_ENCRYPTED;
+  if (is_payload_encrypted)
+    mask |= DDS_SECURITY_PLUGIN_ENDPOINT_ATTRIBUTES_FLAG_IS_PAYLOAD_ENCRYPTED;
+  if (is_submessage_origin_authenticated)
+    mask |= DDS_SECURITY_PLUGIN_ENDPOINT_ATTRIBUTES_FLAG_IS_SUBMESSAGE_ORIGIN_AUTHENTICATED;
+  return mask;
+}
+
+static void
+domain_rule_to_participant_attributes(
+    const struct domain_rule *rule,
+    DDS_Security_ParticipantSecurityAttributes *attributes)
+{
+  /* Expect proper rule. */
+  assert(rule);
+  assert(rule->allow_unauthenticated_participants);
+  assert(rule->enable_join_access_control);
+  assert(rule->liveliness_protection_kind);
+  assert(rule->discovery_protection_kind);
+  assert(rule->rtps_protection_kind);
+  assert(attributes);
+
+  memset(attributes, 0, sizeof(DDS_Security_ParticipantSecurityAttributes));
+
+  attributes->allow_unauthenticated_participants = rule->allow_unauthenticated_participants->value;
+  attributes->is_access_protected = rule->enable_join_access_control->value;
+
+  attributes->plugin_participant_attributes = DDS_SECURITY_PARTICIPANT_ATTRIBUTES_FLAG_IS_VALID;
+
+  protectionkind_to_participant_attribute(
+      rule->discovery_protection_kind->value,
+      &(attributes->is_discovery_protected),
+      &(attributes->plugin_participant_attributes),
+      DDS_SECURITY_PLUGIN_PARTICIPANT_ATTRIBUTES_FLAG_IS_DISCOVERY_ENCRYPTED,
+      DDS_SECURITY_PLUGIN_PARTICIPANT_ATTRIBUTES_FLAG_IS_DISCOVERY_AUTHENTICATED);
+
+  protectionkind_to_participant_attribute(
+      rule->liveliness_protection_kind->value,
+      &(attributes->is_liveliness_protected),
+      &(attributes->plugin_participant_attributes),
+      DDS_SECURITY_PLUGIN_PARTICIPANT_ATTRIBUTES_FLAG_IS_LIVELINESS_ENCRYPTED,
+      DDS_SECURITY_PLUGIN_PARTICIPANT_ATTRIBUTES_FLAG_IS_LIVELINESS_AUTHENTICATED);
+
+  protectionkind_to_participant_attribute(
+      rule->rtps_protection_kind->value,
+      &(attributes->is_rtps_protected),
+      &(attributes->plugin_participant_attributes),
+      DDS_SECURITY_PLUGIN_PARTICIPANT_ATTRIBUTES_FLAG_IS_RTPS_ENCRYPTED,
+      DDS_SECURITY_PLUGIN_PARTICIPANT_ATTRIBUTES_FLAG_IS_RTPS_AUTHENTICATED);
+}
+
+static DDS_Security_boolean
+domainid_within_sets(
+    struct domain_id_set *domain,
+    int domain_id)
+{
+  DDS_Security_boolean found = false;
+  int32_t min;
+  int32_t max;
+
+  while (domain != NULL && !found)
+  {
+    assert(domain->min);
+    min = domain->min->value;
+    max = domain->max ? domain->max->value : min;
+    if ((domain_id >= min) && (domain_id <= max))
+      found = true;
+    domain = (struct domain_id_set *)domain->node.next;
+  }
+  return found;
+}
+
+static struct domain_rule *
+find_domain_rule_in_governance(struct domain_rule *rule, int domain_id)
+{
+  struct domain_rule *found = NULL;
+  while ((rule != NULL) && (found == NULL))
+  {
+    assert(rule->domains);
+    if (domainid_within_sets(rule->domains->domain_id_set, domain_id))
+      found = rule;
+    rule = (struct domain_rule *)rule->node.next;
+  }
+  return found;
+}
+
+static DDS_Security_boolean
+get_participant_sec_attributes(
+    dds_security_access_control *instance,
+    const DDS_Security_PermissionsHandle permissions_handle,
+    DDS_Security_ParticipantSecurityAttributes *attributes,
+    DDS_Security_SecurityException *ex)
+{
+  dds_security_access_control_impl *ac = (dds_security_access_control_impl *)instance;
+  local_participant_access_rights *local_rights;
+  struct domain_rule *found = NULL;
+  DDS_Security_boolean result = false;
+
+  if (instance == 0 || permissions_handle == DDS_SECURITY_HANDLE_NIL || attributes == NULL)
+  {
+    DDS_Security_Exception_set(ex, DDS_ACCESS_CONTROL_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_PARAMETER_CODE, 0, DDS_SECURITY_ERR_INVALID_PARAMETER_MESSAGE);
+    return false;
+  }
+
+  /* The local rights are actually the local permissions handle. Check that. */
+  if ((local_rights = find_local_access_rights(ac, permissions_handle)) == NULL)
+  {
+    DDS_Security_Exception_set(ex, DDS_ACCESS_CONTROL_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_PARAMETER_CODE, 0, "Invalid permissions handle");
+    return false;
+  }
+  if ((found = find_domain_rule_in_governance(local_rights->governance_tree->dds->domain_access_rules->domain_rule, local_rights->domain_id)))
+  {
+    domain_rule_to_participant_attributes(found, attributes);
+    result = true;
+  }
+  else
+  {
+    DDS_Security_Exception_set(ex, DDS_ACCESS_CONTROL_PLUGIN_CONTEXT, DDS_SECURITY_ERR_IDENTITY_EMPTY_CODE, 0, "Could not domain id within governance file.");
+  }
+  ACCESS_CONTROL_OBJECT_RELEASE(local_rights);
+  return result;
+}
+
+static DDS_Security_boolean
+compare_class_id_plugin_classname(DDS_Security_string classid1, DDS_Security_string classid2)
+{
+  char *classname1 = strrchr(classid1, ':');
+  char *classname2 = strrchr(classid2, ':');
+  const ptrdiff_t len1 = classname1 - classid1;
+  const ptrdiff_t len2 = classname2 - classid2;
+  return len1 == len2 && classname1 && classname2 &&
+    ddsrt_strncasecmp(classid1, classid2, (size_t) len1) == 0;
+}
+
+static DDS_Security_boolean
+compare_class_id_major_ver(DDS_Security_string classid1, DDS_Security_string classid2)
+{
+  char *version_1 = strrchr(classid1, ':');
+  char *version_2 = strrchr(classid2, ':');
+  if (version_1 && version_2)
+  {
+    const char *majorVersion_1 = strrchr(version_1, '.');
+    const char *majorVersion_2 = strrchr(version_2, '.');
+    const ptrdiff_t len1 = majorVersion_1 - version_1;
+    const ptrdiff_t len2 = majorVersion_2 - version_2;
+    return len1 == len2 && majorVersion_1 && majorVersion_2 &&
+      ddsrt_strncasecmp(version_1, version_2, (size_t) len1) == 0;
+  }
+  return false;
+}
+
+static DDS_Security_boolean
+is_partition_qos_in_criteria(
+    const struct criteria *criteria,
+    const DDS_Security_PartitionQosPolicy *partitions)
+{
+  unsigned int partition_index = 0;
+  const char *partitionDefault[] = {""};
+  const DDS_Security_PartitionQosPolicy *partitionsToCheck;
+  DDS_Security_PartitionQosPolicy defaultPartitions;
+  defaultPartitions.name._length = 1;
+  defaultPartitions.name._maximum = 1;
+  defaultPartitions.name._buffer = (char **)partitionDefault;
+
+  if (criteria == NULL)
+    return false;
+
+  if (!partitions || partitions->name._length == 0)
+    partitionsToCheck = &defaultPartitions;
+  else
+    partitionsToCheck = partitions;
+
+  for (partition_index = 0; partition_index < partitionsToCheck->name._length; partition_index++)
+  {
+    if (is_partition_in_criteria(criteria, partitionsToCheck->name._buffer[partition_index]) == false)
+      return false;
+  }
+
+  return true;
+}
+
+static DDS_Security_boolean
+is_partition_in_criteria(
+    const struct criteria *criteria,
+    const char *partition_name)
+{
+  struct partitions *current_partitions;
+  struct string_value *current_partition;
+
+  if (criteria == NULL || partition_name == NULL)
+    return false;
+
+  current_partitions = (struct partitions *)criteria->partitions;
+  while (current_partitions != NULL)
+  {
+    current_partition = current_partitions->partition;
+    while (current_partition != NULL)
+    {
+      if (ac_fnmatch(current_partition->value, partition_name))
+        return true;
+      current_partition = (struct string_value *)current_partition->node.next;
+    }
+    current_partitions = (struct partitions *)current_partitions->node.next;
+  }
+  return false;
+}
+
+static DDS_Security_boolean
+is_topic_in_criteria(
+    const struct criteria *criteria,
+    const char *topic_name)
+{
+  struct topics *current_topics;
+  struct string_value *current_topic;
+
+  if (criteria == NULL || topic_name == NULL)
+    return false;
+
+  /* Start by checking for a matching topic */
+  current_topics = criteria->topics;
+  while (current_topics != NULL)
+  {
+    current_topic = current_topics->topic;
+    while (current_topic != NULL)
+    {
+      if (ac_fnmatch(current_topic->value, topic_name))
+        return true;
+      current_topic = (struct string_value *)current_topic->node.next;
+    }
+    current_topics = (struct topics *)current_topics->node.next;
+  }
+  return false;
+}
+
+static struct topic_rule *
+find_topic_from_domain_rule(
+    struct domain_rule *domain_rule,
+    const char *topic_name)
+{
+  struct topic_rule *topic_rule;
+  struct topic_rule *topic_found = NULL;
+
+  if (domain_rule->topic_access_rules != NULL &&
+      domain_rule->topic_access_rules->topic_rule != NULL)
+  {
+    topic_rule = domain_rule->topic_access_rules->topic_rule;
+    while (topic_rule != NULL && topic_found == NULL)
+    {
+      assert(topic_rule->topic_expression);
+      if (ac_fnmatch(topic_rule->topic_expression->value, topic_name))
+        topic_found = topic_rule;
+      topic_rule = (struct topic_rule *)topic_rule->node.next;
+    }
+  }
+  return topic_found;
+}
+
+static DDS_Security_boolean
+get_topic_sec_attributes(
+    dds_security_access_control *instance,
+    const DDS_Security_PermissionsHandle permissions_handle,
+    const char *topic_name,
+    DDS_Security_TopicSecurityAttributes *attributes,
+    DDS_Security_SecurityException *ex)
+{
+  dds_security_access_control_impl *ac = (dds_security_access_control_impl *)instance;
+  local_participant_access_rights *rights;
+  struct domain_rule *found;
+  DDS_Security_boolean result = false;
+
+  if (instance == 0)
+  {
+    DDS_Security_Exception_set(ex, DDS_ACCESS_CONTROL_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_PARAMETER_CODE, 0, "No plugin instance provided");
+    return false;
+  }
+  if (permissions_handle == DDS_SECURITY_HANDLE_NIL)
+  {
+    DDS_Security_Exception_set(ex, DDS_ACCESS_CONTROL_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_PARAMETER_CODE, 0, "No permissions handle provided");
+    return false;
+  }
+  if (topic_name == NULL || strlen(topic_name) == 0)
+  {
+    DDS_Security_Exception_set(ex, DDS_ACCESS_CONTROL_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_PARAMETER_CODE, 0, "No topic name provided");
+    return false;
+  }
+  if (attributes == NULL)
+  {
+    DDS_Security_Exception_set(ex, DDS_ACCESS_CONTROL_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_PARAMETER_CODE, 0, "No attributes provided");
+    return false;
+  }
+  rights = find_local_access_rights(ac, permissions_handle);
+  if (rights == NULL)
+  {
+    DDS_Security_Exception_set(ex, DDS_ACCESS_CONTROL_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_PARAMETER_CODE, 0, "Unused permissions handle provided");
+    return false;
+  }
+
+  memset(attributes, 0, sizeof(*attributes));
+
+  if (get_topic_type(topic_name) != TOPIC_TYPE_USER)
+  {
+    /* No attributes are set for builtin topics. */
+    ACCESS_CONTROL_OBJECT_RELEASE(rights);
+    return true;
+  }
+
+  if ((found = find_domain_rule_in_governance(rights->governance_tree->dds->domain_access_rules->domain_rule, rights->domain_id)))
+  {
+    struct topic_rule *topic_rule = find_topic_from_domain_rule(found, topic_name);
+    if (topic_rule)
+    {
+      attributes->is_discovery_protected = topic_rule->enable_discovery_protection->value;
+      attributes->is_liveliness_protected = topic_rule->enable_liveliness_protection->value;
+      attributes->is_read_protected = topic_rule->enable_read_access_control->value;
+      attributes->is_write_protected = topic_rule->enable_write_access_control->value;
+      result = true;
+    }
+    else
+    {
+      DDS_Security_Exception_set(ex, DDS_ACCESS_CONTROL_PLUGIN_CONTEXT, DDS_SECURITY_ERR_CAN_NOT_FIND_TOPIC_IN_DOMAIN_CODE, 0, DDS_SECURITY_ERR_CAN_NOT_FIND_TOPIC_IN_DOMAIN_MESSAGE, topic_name, rights->domain_id);
+    }
+  }
+  else
+  {
+    DDS_Security_Exception_set(ex, DDS_ACCESS_CONTROL_PLUGIN_CONTEXT, DDS_SECURITY_ERR_CAN_NOT_FIND_DOMAIN_IN_GOVERNANCE_CODE, 0, DDS_SECURITY_ERR_CAN_NOT_FIND_DOMAIN_IN_GOVERNANCE_MESSAGE, rights->domain_id);
+  }
+
+  ACCESS_CONTROL_OBJECT_RELEASE(rights);
+  return result;
+}
+
+static DDS_Security_boolean
+get_datawriter_sec_attributes(
+    dds_security_access_control *instance,
+    const DDS_Security_PermissionsHandle permissions_handle,
+    const char *topic_name,
+    const DDS_Security_PartitionQosPolicy *partition,
+    const DDS_Security_DataTagQosPolicy *data_tag,
+    DDS_Security_EndpointSecurityAttributes *attributes,
+    DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(partition);
+  DDSRT_UNUSED_ARG(data_tag);
+  dds_security_access_control_impl *ac = (dds_security_access_control_impl *)instance;
+
+  if (instance == 0 || permissions_handle == DDS_SECURITY_HANDLE_NIL || topic_name == 0 || strlen(topic_name) == 0 || attributes == NULL)
+  {
+    DDS_Security_Exception_set(ex, DDS_ACCESS_CONTROL_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_PARAMETER_CODE, 0, DDS_SECURITY_ERR_INVALID_PARAMETER_MESSAGE);
+    return false;
+  }
+  return get_sec_attributes(ac, permissions_handle, topic_name, attributes, ex);
+}
+
+static DDS_Security_boolean
+get_datareader_sec_attributes(
+    dds_security_access_control *instance,
+    const DDS_Security_PermissionsHandle permissions_handle,
+    const char *topic_name,
+    const DDS_Security_PartitionQosPolicy *partition,
+    const DDS_Security_DataTagQosPolicy *data_tag,
+    DDS_Security_EndpointSecurityAttributes *attributes,
+    DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(partition);
+  DDSRT_UNUSED_ARG(data_tag);
+  dds_security_access_control_impl *ac = (dds_security_access_control_impl *)instance;
+
+  if (instance == 0 || permissions_handle == DDS_SECURITY_HANDLE_NIL || topic_name == 0 || strlen(topic_name) == 0 || attributes == NULL)
+  {
+    DDS_Security_Exception_set(ex, DDS_ACCESS_CONTROL_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_PARAMETER_CODE, 0, DDS_SECURITY_ERR_INVALID_PARAMETER_MESSAGE);
+    return false;
+  }
+  return get_sec_attributes(ac, permissions_handle, topic_name, attributes, ex);
+}
+
+static DDS_Security_boolean
+return_participant_sec_attributes(
+    dds_security_access_control *instance,
+    const DDS_Security_ParticipantSecurityAttributes *attributes,
+    DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(attributes);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+  /* Nothing to do. */
+  return true;
+}
+
+static DDS_Security_boolean
+return_topic_sec_attributes(
+    dds_security_access_control *instance,
+    const DDS_Security_TopicSecurityAttributes *attributes,
+    DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(attributes);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+  /* Nothing to do. */
+  return true;
+}
+
+static DDS_Security_boolean
+return_datawriter_sec_attributes(
+    dds_security_access_control *instance,
+    const DDS_Security_EndpointSecurityAttributes *attributes,
+    DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(attributes);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+  /* Nothing to do. */
+  return true;
+}
+
+static DDS_Security_boolean
+return_datareader_sec_attributes(
+    dds_security_access_control *instance,
+    const DDS_Security_EndpointSecurityAttributes *attributes,
+    DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(attributes);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+  /* Nothing to do. */
+  return true;
+}
+
+static DDS_Security_boolean
+return_permissions_handle(
+    dds_security_access_control *instance,
+    const DDS_Security_PermissionsHandle permissions_handle,
+    DDS_Security_SecurityException *ex)
+{
+  dds_security_access_control_impl *ac = (dds_security_access_control_impl *)instance;
+  AccessControlObject *object;
+
+  if (!instance || !permissions_handle)
+  {
+    DDS_Security_Exception_set(ex, DDS_ACCESS_CONTROL_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_PARAMETER_CODE, 0, DDS_SECURITY_ERR_INVALID_PARAMETER_MESSAGE);
+    return false;
+  }
+
+#ifdef ACCESS_CONTROL_USE_ONE_PERMISSION
+  ddsrt_mutex_lock(&ac->lock);
+  if (permissions_handle == ACCESS_CONTROL_OBJECT_HANDLE(ac->local_access_rights))
+  {
+    ddsrt_mutex_unlock(&ac->lock);
+    return true;
+  }
+  ddsrt_mutex_unlock(&ac->lock);
+#else
+  object = access_control_table_find(ac->local_permissions, permissions_handle);
+  if (object)
+  {
+    access_control_table_remove_object(ac->local_permissions, object);
+    access_control_object_release(object);
+    return true;
+  }
+#endif
+
+  object = access_control_table_find(ac->remote_permissions, permissions_handle);
+  if (!object)
+  {
+    DDS_Security_Exception_set(ex, DDS_ACCESS_CONTROL_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_PARAMETER_CODE, 0, DDS_SECURITY_ERR_INVALID_PARAMETER_MESSAGE);
+    return false;
+  }
+
+  access_control_table_remove_object(ac->remote_permissions, object);
+  access_control_object_release(object);
+  return true;
+}
+
+int init_access_control(const char *argument, void **context)
+{
+  DDSRT_UNUSED_ARG(argument);
+
+  dds_security_access_control_impl *access_control = ddsrt_malloc(sizeof(*access_control));
+  memset(access_control, 0, sizeof(*access_control));
+
+#if TIMED_CALLBACK_IMPLEMENTED
+  access_control->timed_callbacks = ut_timed_dispatcher_new();
+#endif
+  access_control->base.validate_local_permissions = &validate_local_permissions;
+  access_control->base.validate_remote_permissions = &validate_remote_permissions;
+  access_control->base.check_create_participant = &check_create_participant;
+  access_control->base.check_create_datawriter = &check_create_datawriter;
+  access_control->base.check_create_datareader = &check_create_datareader;
+  access_control->base.check_create_topic = &check_create_topic;
+  access_control->base.check_local_datawriter_register_instance = &check_local_datawriter_register_instance;
+  access_control->base.check_local_datawriter_dispose_instance = &check_local_datawriter_dispose_instance;
+  access_control->base.check_remote_participant = &check_remote_participant;
+  access_control->base.check_remote_datawriter = &check_remote_datawriter;
+  access_control->base.check_remote_datareader = &check_remote_datareader;
+  access_control->base.check_remote_topic = &check_remote_topic;
+  access_control->base.check_local_datawriter_match = &check_local_datawriter_match;
+  access_control->base.check_local_datareader_match = &check_local_datareader_match;
+  access_control->base.check_remote_datawriter_register_instance = &check_remote_datawriter_register_instance;
+  access_control->base.check_remote_datawriter_dispose_instance = &check_remote_datawriter_dispose_instance;
+  access_control->base.get_permissions_token = &get_permissions_token;
+  access_control->base.get_permissions_credential_token = &get_permissions_credential_token;
+  access_control->base.set_listener = &set_listener;
+  access_control->base.return_permissions_token = &return_permissions_token;
+  access_control->base.return_permissions_credential_token = &return_permissions_credential_token;
+  access_control->base.get_participant_sec_attributes = &get_participant_sec_attributes;
+  access_control->base.get_topic_sec_attributes = &get_topic_sec_attributes;
+  access_control->base.get_datawriter_sec_attributes = &get_datawriter_sec_attributes;
+  access_control->base.get_datareader_sec_attributes = &get_datareader_sec_attributes;
+  access_control->base.return_participant_sec_attributes = &return_participant_sec_attributes;
+  access_control->base.return_topic_sec_attributes = &return_topic_sec_attributes;
+  access_control->base.return_datawriter_sec_attributes = &return_datawriter_sec_attributes;
+  access_control->base.return_datareader_sec_attributes = &return_datareader_sec_attributes;
+  access_control->base.return_permissions_handle = &return_permissions_handle;
+  ddsrt_mutex_init(&access_control->lock);
+
+#ifdef ACCESS_CONTROL_USE_ONE_PERMISSION
+  access_control->local_access_rights = NULL;
+#else
+  access_control->local_permissions = access_control_table_new();
+#endif
+  access_control->remote_permissions = access_control_table_new();
+
+  OpenSSL_add_all_algorithms();
+  OpenSSL_add_all_ciphers();
+  OpenSSL_add_all_digests();
+  ERR_load_BIO_strings();
+  ERR_load_crypto_strings();
+
+  *context = access_control;
+  return 0;
+}
+
+static bool
+get_sec_attributes(
+    dds_security_access_control_impl *ac,
+    const DDS_Security_PermissionsHandle permissions_handle,
+    const char *topic_name,
+    DDS_Security_EndpointSecurityAttributes *attributes,
+    DDS_Security_SecurityException *ex)
+{
+  local_participant_access_rights *rights;
+  DDS_Security_boolean result = false;
+  TOPIC_TYPE topic_type;
+  assert(topic_name);
+  assert(attributes);
+  memset(attributes, 0, sizeof(DDS_Security_EndpointSecurityAttributes));
+  if ((rights = find_local_access_rights(ac, permissions_handle)) == NULL)
+  {
+    DDS_Security_Exception_set(ex, DDS_ACCESS_CONTROL_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_PARAMETER_CODE, 0, "Invalid permissions handle");
+    return false;
+  }
+
+  if ((topic_type = get_topic_type(topic_name)) != TOPIC_TYPE_USER)
+  {
+    /* Builtin topics are treated in a special manner. */
+    result = true;
+
+    if (topic_type == TOPIC_TYPE_SECURE_ParticipantsSecure || topic_type == TOPIC_TYPE_SECURE_PublicationsSecure ||
+        topic_type == TOPIC_TYPE_SECURE_SubscriptionsSecure || topic_type == TOPIC_TYPE_SECURE_ParticipantMessageSecure)
+    {
+      struct domain_rule *found = find_domain_rule_in_governance(rights->governance_tree->dds->domain_access_rules->domain_rule, rights->domain_id);
+      if (found)
+      { /* Domain matched */
+        /* is_submessage_protected should match is_liveliness_protected of
+             * ParticipantSecurityAttributes for DCPSParticipantMessageSecure.
+             * is_submessage_protected should match is_discovery_protected of
+             * ParticipantSecurityAttributes for OTHER 3.*/
+        if (topic_type == TOPIC_TYPE_SECURE_ParticipantMessageSecure)
+        {
+          attributes->is_submessage_protected = !(found->liveliness_protection_kind->value == DDS_SECURITY_PROTECTION_KIND_NONE);
+          attributes->plugin_endpoint_attributes = get_plugin_endpoint_security_attributes_mask(
+              /* payload encrypted */
+              false,
+              /* submsg encrypted */
+              found->liveliness_protection_kind->value == DDS_SECURITY_PROTECTION_KIND_ENCRYPT ||
+                  found->liveliness_protection_kind->value == DDS_SECURITY_PROTECTION_KIND_ENCRYPT_WITH_ORIGIN_AUTHENTICATION,
+              /* submsg authenticated */
+              found->liveliness_protection_kind->value == DDS_SECURITY_PROTECTION_KIND_ENCRYPT_WITH_ORIGIN_AUTHENTICATION ||
+                  found->liveliness_protection_kind->value == DDS_SECURITY_PROTECTION_KIND_SIGN_WITH_ORIGIN_AUTHENTICATION);
+        }
+        else
+        {
+          attributes->is_submessage_protected = !(found->discovery_protection_kind->value == DDS_SECURITY_PROTECTION_KIND_NONE);
+          attributes->plugin_endpoint_attributes = get_plugin_endpoint_security_attributes_mask(
+              /* payload encrypted */
+              false,
+              /* submsg encrypted */
+              found->discovery_protection_kind->value == DDS_SECURITY_PROTECTION_KIND_ENCRYPT ||
+                  found->discovery_protection_kind->value == DDS_SECURITY_PROTECTION_KIND_ENCRYPT_WITH_ORIGIN_AUTHENTICATION,
+              /* submsg authenticated */
+              found->discovery_protection_kind->value == DDS_SECURITY_PROTECTION_KIND_ENCRYPT_WITH_ORIGIN_AUTHENTICATION ||
+                  found->discovery_protection_kind->value == DDS_SECURITY_PROTECTION_KIND_SIGN_WITH_ORIGIN_AUTHENTICATION);
+        }
+      }
+      else
+      {
+        DDS_Security_Exception_set(ex, DDS_ACCESS_CONTROL_PLUGIN_CONTEXT, DDS_SECURITY_ERR_CAN_NOT_FIND_DOMAIN_IN_GOVERNANCE_CODE, 0, DDS_SECURITY_ERR_CAN_NOT_FIND_DOMAIN_IN_GOVERNANCE_MESSAGE, rights->domain_id);
+        result = false;
+      }
+      attributes->is_read_protected = false;
+      attributes->is_write_protected = false;
+      attributes->is_payload_protected = false;
+      attributes->is_key_protected = false;
+    }
+    else if (topic_type == TOPIC_TYPE_SECURE_ParticipantStatelessMessage)
+    {
+      attributes->plugin_endpoint_attributes = DDS_SECURITY_ENDPOINT_ATTRIBUTES_FLAG_IS_VALID;
+      attributes->is_read_protected = false;
+      attributes->is_write_protected = false;
+      attributes->is_payload_protected = false;
+      attributes->is_key_protected = false;
+      attributes->is_submessage_protected = false;
+    }
+    else if (topic_type == TOPIC_TYPE_SECURE_ParticipantVolatileMessageSecure)
+    {
+      attributes->plugin_endpoint_attributes = DDS_SECURITY_ENDPOINT_ATTRIBUTES_FLAG_IS_VALID |
+                                               DDS_SECURITY_PLUGIN_ENDPOINT_ATTRIBUTES_FLAG_IS_SUBMESSAGE_ENCRYPTED;
+      attributes->is_read_protected = false;
+      attributes->is_write_protected = false;
+      attributes->is_payload_protected = false;
+      attributes->is_key_protected = false;
+      attributes->is_submessage_protected = true;
+    }
+    else
+    {
+      /* Non secure builtin topics. */
+      attributes->plugin_endpoint_attributes = DDS_SECURITY_ENDPOINT_ATTRIBUTES_FLAG_IS_VALID;
+      attributes->is_read_protected = false;
+      attributes->is_write_protected = false;
+      attributes->is_payload_protected = false;
+      attributes->is_key_protected = false;
+      attributes->is_submessage_protected = false;
+    }
+  }
+  else
+  {
+    /* Normal user topic attributes are acquired from governance and permission documents. */
+    struct domain_rule *found = find_domain_rule_in_governance(rights->governance_tree->dds->domain_access_rules->domain_rule, rights->domain_id);
+    if (found)
+    { /* Domain matched */
+      struct topic_rule *topic_rule = find_topic_from_domain_rule(found, topic_name);
+      if (topic_rule)
+      { /* Topic matched */
+        attributes->is_discovery_protected = topic_rule->enable_discovery_protection->value;
+        attributes->is_liveliness_protected = topic_rule->enable_liveliness_protection->value;
+        attributes->is_read_protected = topic_rule->enable_read_access_control->value;
+        attributes->is_write_protected = topic_rule->enable_write_access_control->value;
+        attributes->is_payload_protected = topic_rule->data_protection_kind->value != DDS_SECURITY_BASICPROTECTION_KIND_NONE;
+        attributes->is_submessage_protected = topic_rule->metadata_protection_kind->value != DDS_SECURITY_PROTECTION_KIND_NONE;
+        attributes->is_key_protected = topic_rule->data_protection_kind->value == DDS_SECURITY_BASICPROTECTION_KIND_ENCRYPT;
+
+        /*calculate and assign the mask */
+        attributes->plugin_endpoint_attributes = get_plugin_endpoint_security_attributes_mask(
+            topic_rule->data_protection_kind->value == DDS_SECURITY_BASICPROTECTION_KIND_ENCRYPT,
+            topic_rule->metadata_protection_kind->value == DDS_SECURITY_PROTECTION_KIND_ENCRYPT ||
+                    topic_rule->metadata_protection_kind->value == DDS_SECURITY_PROTECTION_KIND_ENCRYPT_WITH_ORIGIN_AUTHENTICATION,
+            topic_rule->metadata_protection_kind->value == DDS_SECURITY_PROTECTION_KIND_ENCRYPT_WITH_ORIGIN_AUTHENTICATION ||
+                    topic_rule->metadata_protection_kind->value == DDS_SECURITY_PROTECTION_KIND_SIGN_WITH_ORIGIN_AUTHENTICATION);
+
+        memset(&attributes->ac_endpoint_properties, 0, sizeof(DDS_Security_PropertySeq));
+        result = true;
+      }
+      else
+      {
+        DDS_Security_Exception_set(ex, DDS_ACCESS_CONTROL_PLUGIN_CONTEXT, DDS_SECURITY_ERR_CAN_NOT_FIND_TOPIC_IN_DOMAIN_CODE, 0, DDS_SECURITY_ERR_CAN_NOT_FIND_TOPIC_IN_DOMAIN_MESSAGE, topic_name, rights->domain_id);
+      }
+    }
+    else
+    {
+      DDS_Security_Exception_set(ex, DDS_ACCESS_CONTROL_PLUGIN_CONTEXT, DDS_SECURITY_ERR_CAN_NOT_FIND_DOMAIN_IN_GOVERNANCE_CODE, 0, DDS_SECURITY_ERR_CAN_NOT_FIND_DOMAIN_IN_GOVERNANCE_MESSAGE, rights->domain_id);
+    }
+  }
+  ACCESS_CONTROL_OBJECT_RELEASE(rights);
+  return result;
+}
+
+static char *
+get_access_control_class_id(
+    const char *classid)
+{
+  size_t sz = strlen(ACCESS_CONTROL_PROTOCOL_CLASS) + strlen(classid) + 6;
+  char *classId = ddsrt_malloc(sz);
+  snprintf(classId, sz, "%s:%s:%1u.%1u", ACCESS_CONTROL_PROTOCOL_CLASS, classid, ACCESS_CONTROL_PROTOCOL_VERSION_MAJOR, ACCESS_CONTROL_PROTOCOL_VERSION_MINOR);
+  return classId;
+}
+
+static void
+sanity_check_local_access_rights(
+    local_participant_access_rights *rights)
+{
+#ifndef NDEBUG
+  if (rights)
+  {
+    assert(rights->permissions_document);
+    assert(rights->governance_tree);
+    assert(rights->governance_tree->dds);
+    assert(rights->governance_tree->dds->domain_access_rules);
+    assert(rights->governance_tree->dds->domain_access_rules->domain_rule);
+    assert(rights->permissions_tree);
+    assert(rights->permissions_tree->dds);
+    assert(rights->permissions_tree->dds->permissions);
+    assert(rights->permissions_tree->dds->permissions->grant);
+  }
+#else
+  DDSRT_UNUSED_ARG(rights);
+#endif
+}
+
+static void
+sanity_check_remote_access_rights(
+    remote_participant_access_rights *rights)
+{
+#ifndef NDEBUG
+  /* Just some sanity checks. */
+  if (rights)
+  {
+    assert(rights->permissions);
+    assert(rights->permissions->permissions_tree);
+    assert(rights->permissions->permissions_tree->dds);
+    assert(rights->permissions->permissions_tree->dds->permissions);
+    assert(rights->permissions->remote_permissions_token_class_id);
+    assert(rights->local_rights);
+    sanity_check_local_access_rights(rights->local_rights);
+  }
+#else
+  DDSRT_UNUSED_ARG(rights);
+#endif
+}
+
+static local_participant_access_rights *
+find_local_access_rights(
+    dds_security_access_control_impl *ac,
+    DDS_Security_PermissionsHandle handle)
+{
+  local_participant_access_rights *rights = NULL;
+
+#ifdef ACCESS_CONTROL_USE_ONE_PERMISSION
+  DDSRT_UNUSED_ARG(handle);
+
+  ddsrt_mutex_lock(&ac->lock);
+  if (handle == ACCESS_CONTROL_OBJECT_HANDLE(ac->local_access_rights))
+    rights = (local_participant_access_rights *)ACCESS_CONTROL_OBJECT_KEEP(ac->local_access_rights);
+  ddsrt_mutex_unlock(&ac->lock);
+#else
+  rights = (local_participant_access_rights *)access_control_table_find(ac->local_permissions, handle);
+#endif
+
+  sanity_check_local_access_rights(rights);
+  return rights;
+}
+
+struct find_by_identity_arg
+{
+  AccessControlObject *object;
+  DDS_Security_IdentityHandle handle;
+};
+
+#ifndef ACCESS_CONTROL_USE_ONE_PERMISSION
+static int
+local_identity_handle_match(
+    AccessControlObject *obj,
+    void *arg)
+{
+  local_participant_access_rights *rights = (local_participant_access_rights *)obj;
+  struct find_by_identity_arg *info = arg;
+
+  if (rights->local_identity == info->handle)
+  {
+    info->object = obj;
+    return 0;
+  }
+
+  return 1;
+}
+#endif
+
+static int
+remote_identity_handle_match(
+    AccessControlObject *obj,
+    void *arg)
+{
+  remote_participant_access_rights *rights = (remote_participant_access_rights *)obj;
+  struct find_by_identity_arg *info = arg;
+
+  if (rights->remote_identity == info->handle)
+  {
+    info->object = ACCESS_CONTROL_OBJECT_KEEP(obj);
+    return 0;
+  }
+
+  return 1;
+}
+
+static local_participant_access_rights *
+find_local_rights_by_identity(
+    dds_security_access_control_impl *ac,
+    DDS_Security_IdentityHandle identity_handle)
+{
+  local_participant_access_rights *rights = NULL;
+
+#ifdef ACCESS_CONTROL_USE_ONE_PERMISSION
+  DDSRT_UNUSED_ARG(identity_handle);
+
+  ddsrt_mutex_lock(&ac->lock);
+  rights = (local_participant_access_rights *)ACCESS_CONTROL_OBJECT_KEEP(ac->local_access_rights);
+  ddsrt_mutex_unlock(&ac->lock);
+#else
+  {
+    struct find_by_identity_arg args;
+    args.object = NULL;
+    args.handle = identity_handle;
+    access_control_table_walk(ac->local_permissions, local_identity_handle_match, &args);
+    rights = (local_participant_access_rights *)args.object;
+  }
+#endif
+  sanity_check_local_access_rights(rights);
+  return rights;
+}
+
+static remote_participant_access_rights *
+find_remote_rights_by_identity(
+    dds_security_access_control_impl *ac,
+    DDS_Security_IdentityHandle identity_handle)
+{
+  struct find_by_identity_arg args;
+  args.object = NULL;
+  args.handle = identity_handle;
+  access_control_table_walk(ac->remote_permissions, remote_identity_handle_match, &args);
+  sanity_check_remote_access_rights((remote_participant_access_rights *)args.object);
+  return (remote_participant_access_rights *)args.object;
+}
+
+struct find_by_permissions_handle_arg
+{
+  AccessControlObject *object;
+  DDS_Security_PermissionsHandle handle;
+};
+
+static int
+remote_permissions_handle_match(
+    AccessControlObject *obj,
+    void *arg)
+{
+  struct find_by_permissions_handle_arg *info = arg;
+  if (obj->handle == info->handle)
+  {
+    info->object = ACCESS_CONTROL_OBJECT_KEEP(obj);
+    return 0;
+  }
+  return 1;
+}
+
+static remote_participant_access_rights *
+find_remote_permissions_by_permissions_handle(
+    dds_security_access_control_impl *ac,
+    DDS_Security_PermissionsHandle permissions_handle)
+{
+  struct find_by_permissions_handle_arg args;
+  args.object = NULL;
+  args.handle = permissions_handle;
+  access_control_table_walk(ac->remote_permissions, remote_permissions_handle_match, &args);
+  sanity_check_remote_access_rights((remote_participant_access_rights *)args.object);
+  return (remote_participant_access_rights *)args.object;
+}
+
+#if TIMED_CALLBACK_IMPLEMENTED
+
+typedef struct
+{
+  dds_security_access_control_impl *ac;
+  DDS_Security_PermissionsHandle hdl;
+} validity_cb_info;
+
+static void
+validity_callback(struct ut_timed_dispatcher_t *d,
+                  ut_timed_cb_kind kind,
+                  void *listener,
+                  void *arg)
+{
+  validity_cb_info *info = arg;
+  assert(d);
+  assert(arg);
+  if (kind == UT_TIMED_CB_KIND_TIMEOUT)
+  {
+    assert(listener);
+    if (1 /* TODO: Check if hdl is still valid or if it has been already returned. */)
+    {
+      dds_security_access_control_listener *ac_listener = (dds_security_access_control_listener *)listener;
+      if (ac_listener->on_revoke_permissions)
+        ac_listener->on_revoke_permissions(ac_listener, (dds_security_access_control *)info->ac, info->hdl);
+    }
+  }
+  ddsrt_free(arg);
+}
+
+static void
+add_validity_end_trigger(dds_security_access_control_impl *ac,
+                         const DDS_Security_PermissionsHandle permissions_handle,
+                         dds_time_t end)
+{
+  validity_cb_info *arg = ddsrt_malloc(sizeof(validity_cb_info));
+  arg->ac = ac;
+  arg->hdl = permissions_handle;
+  ut_timed_dispatcher_add(ac->timed_callbacks, validity_callback, end, (void *)arg);
+}
+#endif
+
+static DDS_Security_boolean
+is_allowed_by_permissions(struct permissions_parser *permissions,
+                          int domain_id,
+                          const char *topic_name,
+                          const DDS_Security_PartitionQosPolicy *partitions,
+                          const char *identity_subject_name,
+                          permission_criteria_type criteria_type,
+                          DDS_Security_SecurityException *ex)
+{
+  struct grant *permissions_grant;
+  struct allow_deny_rule *current_rule;
+  struct criteria *current_criteria;
+
+  assert(permissions);
+  assert(permissions->dds);
+  assert(permissions->dds->permissions);
+
+  permissions_grant = permissions->dds->permissions->grant;
+
+  /* Check for a matching grant */
+  while (permissions_grant != NULL)
+  {
+    /* Verify that it is within the validity date and the subject name matches */
+    if (permissions_grant->subject_name != NULL &&
+        permissions_grant->subject_name->value != NULL &&
+        strcmp(permissions_grant->subject_name->value, identity_subject_name) == 0)
+    {
+      dds_time_t tnow = dds_time();
+      if (tnow <= DDS_Security_parse_xml_date(permissions_grant->validity->not_before->value))
+      {
+        DDS_Security_Exception_set(ex, DDS_ACCESS_CONTROL_PLUGIN_CONTEXT, DDS_SECURITY_ERR_VALIDITY_PERIOD_NOT_STARTED_CODE, 0,
+            DDS_SECURITY_ERR_VALIDITY_PERIOD_NOT_STARTED_MESSAGE, permissions_grant->subject_name->value, permissions_grant->validity->not_before->value);
+        return false;
+      }
+      if (tnow >= DDS_Security_parse_xml_date(permissions_grant->validity->not_after->value))
+      {
+        DDS_Security_Exception_set(ex, DDS_ACCESS_CONTROL_PLUGIN_CONTEXT, DDS_SECURITY_ERR_VALIDITY_PERIOD_EXPIRED_CODE, 0,
+            DDS_SECURITY_ERR_VALIDITY_PERIOD_EXPIRED_MESSAGE, permissions_grant->subject_name->value, permissions_grant->validity->not_after->value);
+        return false;
+      }
+
+      current_rule = permissions_grant->allow_deny_rule;
+      while (current_rule != NULL)
+      {
+        /* Check if the domain matches the given ID otherwise move on */
+        if (domainid_within_sets(current_rule->domains->domain_id_set, domain_id))
+        {
+          if (topic_name == NULL)
+          {
+            if (current_rule->rule_type == ALLOW_RULE)
+              return true;
+          }
+
+          /* Check all subscribe criteria to find the topics, partition and tags */
+          current_criteria = current_rule->criteria;
+          while (current_criteria != NULL)
+          {
+            if (current_criteria->criteria_type == criteria_type || (int)criteria_type == UNKNOWN_CRITERIA)
+            {
+              if (is_topic_in_criteria(current_criteria, topic_name) && is_partition_qos_in_criteria(current_criteria, partitions))
+              {
+                if (current_rule->rule_type == ALLOW_RULE)
+                  return true;
+                if (current_rule->rule_type == DENY_RULE)
+                {
+                  DDS_Security_Exception_set(ex, DDS_ACCESS_CONTROL_PLUGIN_CONTEXT, DDS_SECURITY_ERR_ACCESS_DENIED_CODE, 0, "%s found in deny_rule.", topic_name);
+                  return false;
+                }
+              }
+            }
+            current_criteria = (struct criteria *)current_criteria->node.next;
+          }
+        }
+        current_rule = (struct allow_deny_rule *)current_rule->node.next;
+      }
+
+      /* If nothing found but the grant matches, return the default value */
+      if (permissions_grant->default_action == NULL)
+      {
+        DDS_Security_Exception_set(ex, DDS_ACCESS_CONTROL_PLUGIN_CONTEXT, DDS_SECURITY_ERR_ACCESS_DENIED_CODE, 0, "No rule found for %s", topic_name ? topic_name : "participant");
+        return false;
+      }
+
+      if (strcmp(permissions_grant->default_action->value, "ALLOW") != 0)
+      {
+        DDS_Security_Exception_set(ex, DDS_ACCESS_CONTROL_PLUGIN_CONTEXT, DDS_SECURITY_ERR_ACCESS_DENIED_CODE, 0, "%s denied by default rule", topic_name ? topic_name : "participant");
+        return false;
+      }
+
+      return true;
+    }
+    permissions_grant = (struct grant *)permissions_grant->node.next;
+  }
+
+  DDS_Security_Exception_set(ex, DDS_ACCESS_CONTROL_PLUGIN_CONTEXT, DDS_SECURITY_ERR_CAN_NOT_FIND_PERMISSIONS_GRANT_CODE, 0, DDS_SECURITY_ERR_CAN_NOT_FIND_PERMISSIONS_GRANT_MESSAGE);
+  return false;
+}
+
+static bool
+read_document_from_file(
+    const char *filename,
+    char **doc,
+    DDS_Security_SecurityException *ex)
+{
+  DDSRT_WARNING_MSVC_OFF(4996);
+  FILE *fp;
+  char *document = NULL;
+  char *fname = NULL;
+  size_t sz, r;
+
+  assert(doc);
+  *doc = NULL;
+  /* Get portable file name. */
+  fname = DDS_Security_normalize_file(filename);
+  if (fname)
+  {
+    /* Get size if it is a accessible regular file (no dir or link). */
+    sz = ac_regular_file_size(fname);
+    if (sz > 0)
+    {
+      /* Open the actual file. */
+      fp = fopen(fname, "r");
+      if (fp)
+      {
+        /* Read the content. */
+        document = ddsrt_malloc(sz + 1);
+        r = fread(document, 1, sz, fp);
+        if (r == 0)
+        {
+          ddsrt_free(document);
+        }
+        else
+        {
+          document[r] = '\0';
+          *doc = document;
+        }
+        (void)fclose(fp);
+      }
+    }
+    ddsrt_free(fname);
+  }
+
+  if ((*doc) == NULL)
+  {
+    DDS_Security_Exception_set(ex, DDS_ACCESS_CONTROL_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_FILE_PATH_CODE, 0, DDS_SECURITY_ERR_INVALID_FILE_PATH_MESSAGE, (filename ? filename : "NULL"));
+    return false;
+  }
+  return true;
+  DDSRT_WARNING_MSVC_ON(4996);
+}
+
+static bool
+read_document(
+    const char *doc_uri,
+    char **doc,
+    DDS_Security_SecurityException *ex)
+{
+  bool result = true;
+  char *data = NULL;
+
+  switch (DDS_Security_get_conf_item_type(doc_uri, &data))
+  {
+  case DDS_SECURITY_CONFIG_ITEM_PREFIX_DATA:
+    *doc = data;
+    break;
+  case DDS_SECURITY_CONFIG_ITEM_PREFIX_FILE:
+    result = read_document_from_file(data, doc, ex);
+    ddsrt_free(data);
+    break;
+  default:
+    DDS_Security_Exception_set(ex, DDS_ACCESS_CONTROL_PLUGIN_CONTEXT, DDS_SECURITY_ERR_URI_TYPE_NOT_SUPPORTED_CODE, 0, DDS_SECURITY_ERR_URI_TYPE_NOT_SUPPORTED_MESSAGE, doc_uri);
+    return false;
+  }
+  return result;
+}
+
+static bool
+validate_subject_name_in_permissions(struct permissions_parser *permissions_tree,
+                                     const char *identity_subject_name,
+                                     char **permission_subject_name,
+                                     dds_time_t *permission_validity_not_after,
+                                     DDS_Security_SecurityException *ex)
+{
+
+  struct grant *permissions_grant;
+  assert(permission_subject_name);
+
+  *permission_subject_name = NULL;
+  if (permissions_tree == NULL || permissions_tree->dds == NULL || permissions_tree->dds->permissions == NULL || permissions_tree->dds->permissions->grant == NULL)
+  {
+    DDS_Security_Exception_set(ex, DDS_ACCESS_CONTROL_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_PARAMETER_CODE, 0, DDS_SECURITY_ERR_INVALID_PARAMETER_MESSAGE);
+    return false;
+  }
+
+  permissions_grant = permissions_tree->dds->permissions->grant;
+  while (permissions_grant != NULL)
+  {
+    /* Verify that it is within the validity date and the subject name matches */
+    if (identity_subject_name != NULL && ac_check_subjects_are_equal(permissions_grant->subject_name->value, identity_subject_name))
+    {
+      dds_time_t tnow = dds_time ();
+      if (tnow <= DDS_Security_parse_xml_date(permissions_grant->validity->not_before->value))
+      {
+        DDS_Security_Exception_set(ex, DDS_ACCESS_CONTROL_PLUGIN_CONTEXT, DDS_SECURITY_ERR_VALIDITY_PERIOD_NOT_STARTED_CODE, 0,
+            DDS_SECURITY_ERR_VALIDITY_PERIOD_NOT_STARTED_MESSAGE, permissions_grant->subject_name->value, permissions_grant->validity->not_before->value);
+        return false;
+      }
+      if (tnow >= DDS_Security_parse_xml_date(permissions_grant->validity->not_after->value))
+      {
+        DDS_Security_Exception_set(ex, DDS_ACCESS_CONTROL_PLUGIN_CONTEXT, DDS_SECURITY_ERR_VALIDITY_PERIOD_EXPIRED_CODE, 0,
+            DDS_SECURITY_ERR_VALIDITY_PERIOD_EXPIRED_MESSAGE, permissions_grant->subject_name->value, permissions_grant->validity->not_after->value);
+        return false;
+      }
+
+      /* identity subject name and permission subject name may not be exactly same because of different string representations
+        * That's why we are returning the string in permissions file to be stored for further comparisons */
+      *permission_subject_name = ddsrt_strdup(permissions_grant->subject_name->value);
+      *permission_validity_not_after = DDS_Security_parse_xml_date(permissions_grant->validity->not_after->value);
+      return true;
+    }
+    permissions_grant = (struct grant *)permissions_grant->node.next;
+  }
+
+  DDS_Security_Exception_set(ex, DDS_ACCESS_CONTROL_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_SUBJECT_NAME_CODE, 0,
+      DDS_SECURITY_ERR_INVALID_SUBJECT_NAME_MESSAGE);
+  return false;
+}
+
+static local_participant_access_rights *
+check_and_create_local_participant_rights(
+    DDS_Security_IdentityHandle identity_handle,
+    int domain_id,
+    const DDS_Security_Qos *participant_qos,
+    DDS_Security_SecurityException *ex)
+{
+  local_participant_access_rights *rights = NULL;
+  X509 *identity_cert;
+  X509 *permission_ca = NULL;
+  size_t pdlen;
+  size_t gvlen;
+  char *identity_cert_data = NULL;
+  char *permission_ca_data = NULL;
+  char *permission_document = NULL;
+  char *governance_document = NULL;
+  char *permission_xml = NULL;
+  char *governance_xml = NULL;
+  char *identity_subject = NULL;
+  struct governance_parser *governance_tree = NULL;
+  struct permissions_parser *permissions_tree = NULL;
+  char *permission_subject = NULL;
+  char *permissions_uri = NULL;
+  char *governance_uri = NULL;
+  dds_time_t permission_expiry = DDS_TIME_INVALID;
+
+  /* Retrieve the identity certificate from the participant QoS */
+  identity_cert_data = DDS_Security_Property_get_value(&participant_qos->property.value, QOS_PROPERTY_IDENTITY_CERT);
+  if (!identity_cert_data)
+  {
+    DDS_Security_Exception_set(ex, DDS_ACCESS_CONTROL_PLUGIN_CONTEXT, DDS_SECURITY_ERR_MISSING_PROPERTY_CODE, 0,
+        DDS_SECURITY_ERR_MISSING_PROPERTY_MESSAGE, QOS_PROPERTY_IDENTITY_CERT);
+    goto err_no_identity_cert;
+  }
+
+  if (!ac_X509_certificate_read(identity_cert_data, &identity_cert, ex))
+    goto err_inv_identity_cert;
+
+  if (!(identity_subject = ac_get_certificate_subject_name(identity_cert, ex)))
+    goto err_inv_identity_cert;
+
+  if (!(governance_uri = DDS_Security_Property_get_value(&participant_qos->property.value, QOS_PROPERTY_GOVERNANCE_DOCUMENT)))
+  {
+    DDS_Security_Exception_set(ex, DDS_ACCESS_CONTROL_PLUGIN_CONTEXT, DDS_SECURITY_ERR_MISSING_PROPERTY_CODE, 0,
+        DDS_SECURITY_ERR_MISSING_PROPERTY_MESSAGE, QOS_PROPERTY_GOVERNANCE_DOCUMENT);
+    goto err_no_governance;
+  }
+
+  if (!(permissions_uri = DDS_Security_Property_get_value(&participant_qos->property.value, QOS_PROPERTY_PERMISSIONS_DOCUMENT)))
+  {
+    DDS_Security_Exception_set(ex, DDS_ACCESS_CONTROL_PLUGIN_CONTEXT, DDS_SECURITY_ERR_MISSING_PROPERTY_CODE, 0,
+        DDS_SECURITY_ERR_MISSING_PROPERTY_MESSAGE, QOS_PROPERTY_PERMISSIONS_DOCUMENT);
+    goto err_no_permissions;
+  }
+
+  if (!(permission_ca_data = DDS_Security_Property_get_value(&participant_qos->property.value, QOS_PROPERTY_PERMISSIONS_CA)))
+  {
+    DDS_Security_Exception_set(ex, DDS_ACCESS_CONTROL_PLUGIN_CONTEXT, DDS_SECURITY_ERR_MISSING_PROPERTY_CODE, 0,
+        DDS_SECURITY_ERR_MISSING_PROPERTY_MESSAGE, QOS_PROPERTY_PERMISSIONS_CA);
+    goto err_no_permission_ca;
+  }
+
+  if (strlen(governance_uri) == 0 && strlen(permissions_uri) == 0 && strlen(permission_ca_data) == 0)
+  {
+    bool result;
+
+    result = ac_parse_governance_xml(DDS_SECURITY_DEFAULT_GOVERNANCE, &governance_tree, ex);
+    assert(result);
+    DDSRT_UNUSED_ARG(result);
+
+    result = ac_parse_permissions_xml(DDS_SECURITY_DEFAULT_PERMISSIONS, &permissions_tree, ex);
+    assert(result);
+    DDSRT_UNUSED_ARG(result);
+
+    /*set subject name on default permissions */
+    ddsrt_free(permissions_tree->dds->permissions->grant->subject_name->value);
+    permissions_tree->dds->permissions->grant->subject_name->value = ddsrt_strdup(identity_subject);
+    permission_document = ddsrt_strdup("");
+
+    rights = ac_local_participant_access_rights_new(identity_handle, domain_id, permission_document, NULL, identity_subject, governance_tree, permissions_tree);
+    sanity_check_local_access_rights(rights);
+  }
+  else if (strlen(governance_uri) > 0 && strlen(permissions_uri) > 0 && strlen(permission_ca_data) > 0)
+  {
+    /* Retrieve the permission ca certificate from the participant QoS */
+    if (!ac_X509_certificate_read(permission_ca_data, &permission_ca, ex))
+      goto err_inv_permission_ca;
+
+    /* Retrieve the permissions document from the participant QoS */
+    if (!read_document(permissions_uri, &permission_document, ex))
+      goto err_read_perm_doc;
+
+    if ((pdlen = strlen(permission_document)) == 0)
+    {
+      DDS_Security_Exception_set(ex, DDS_ACCESS_CONTROL_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_PERMISSION_DOCUMENT_PROPERTY_CODE,
+          DDS_SECURITY_VALIDATION_FAILED, DDS_SECURITY_ERR_INVALID_PERMISSION_DOCUMENT_PROPERTY_MESSAGE);
+      goto err_read_perm_doc;
+    }
+
+    /* Retrieve the governance from the participant QoS */
+    if (!read_document(governance_uri, &governance_document, ex))
+      goto err_read_gov_doc;
+
+    if ((gvlen = strlen(governance_document)) == 0)
+    {
+      DDS_Security_Exception_set(ex, DDS_ACCESS_CONTROL_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_GOVERNANCE_DOCUMENT_PROPERTY_CODE,
+          DDS_SECURITY_VALIDATION_FAILED, DDS_SECURITY_ERR_INVALID_GOVERNANCE_DOCUMENT_PROPERTY_MESSAGE);
+      goto err_read_gov_doc;
+    }
+
+    if (!ac_PKCS7_document_check(permission_document, pdlen, permission_ca, &permission_xml, ex))
+      goto err_inv_perm_doc;
+
+    if (!ac_PKCS7_document_check(governance_document, gvlen, permission_ca, &governance_xml, ex))
+      goto err_inv_gov_doc;
+
+    if (!ac_parse_governance_xml(governance_xml, &governance_tree, ex))
+      goto err_inv_gov_xml;
+
+    if (!ac_parse_permissions_xml(permission_xml, &permissions_tree, ex))
+    {
+      ac_return_governance_tree(governance_tree);
+      goto err_inv_perm_xml;
+    }
+
+    /* check if subject name of identity certificate matches the subject name in the permissions document */
+    if (!validate_subject_name_in_permissions(permissions_tree, identity_subject, &permission_subject, &permission_expiry, ex))
+    {
+      ac_return_governance_tree(governance_tree);
+      ac_return_permissions_tree(permissions_tree);
+      goto err_inv_subject;
+    }
+
+    rights = ac_local_participant_access_rights_new(identity_handle, domain_id, permission_document, permission_ca, permission_subject, governance_tree, permissions_tree);
+    rights->permissions_expiry = permission_expiry;
+    sanity_check_local_access_rights(rights);
+  }
+  else
+  { /*one of them is not empty but the others */
+    DDS_Security_Exception_set(ex, DDS_ACCESS_CONTROL_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_PARAMETER_CODE, DDS_SECURITY_VALIDATION_FAILED,
+        "Governance, Permissions and Permissions CA properties do not exist properly. Either all must be empty or all must be valid");
+    goto err_inv_properties;
+  }
+
+err_inv_subject:
+err_inv_perm_xml:
+err_inv_gov_xml:
+  ddsrt_free(governance_xml);
+err_inv_gov_doc:
+  ddsrt_free(permission_xml);
+err_inv_perm_doc:
+err_read_gov_doc:
+  ddsrt_free(governance_document);
+err_read_perm_doc:
+  if (!rights)
+  {
+    ddsrt_free(permission_document);
+    X509_free(permission_ca);
+  }
+err_inv_properties:
+err_inv_permission_ca:
+  ddsrt_free(permission_ca_data);
+err_no_permission_ca:
+  ddsrt_free(permissions_uri);
+err_no_permissions:
+  ddsrt_free(governance_uri);
+err_no_governance:
+  X509_free(identity_cert);
+err_inv_identity_cert:
+  ddsrt_free(identity_subject);
+  ddsrt_free(permission_subject);
+  ddsrt_free(identity_cert_data);
+err_no_identity_cert:
+  return rights;
+}
+
+static remote_participant_access_rights *
+check_and_create_remote_participant_rights(
+    DDS_Security_IdentityHandle remote_identity_handle,
+    local_participant_access_rights *local_rights,
+    const DDS_Security_PermissionsToken *remote_permissions_token,
+    const DDS_Security_AuthenticatedPeerCredentialToken *remote_credential_token,
+    DDS_Security_SecurityException *ex)
+{
+  remote_participant_access_rights *rights = NULL;
+  X509 *identity_cert = NULL;
+  const DDS_Security_Property_t *identity_cert_property;
+  const DDS_Security_Property_t *permission_doc_property;
+  char *identity_subject = NULL;
+  char *permissions_xml = NULL;
+  remote_permissions *permissions = NULL;
+  char *permission_subject = NULL;
+  dds_time_t permission_expiry = DDS_TIME_INVALID;
+  size_t len;
+
+  /* Retrieve the remote identity certificate from the remote_credential_token */
+  identity_cert_property = DDS_Security_DataHolder_find_property(remote_credential_token, "c.id");
+  if (!identity_cert_property || !identity_cert_property->value)
+  {
+    DDS_Security_Exception_set(ex, DDS_ACCESS_CONTROL_PLUGIN_CONTEXT, DDS_SECURITY_ERR_MISSING_PROPERTY_CODE, 0,
+        DDS_SECURITY_ERR_MISSING_PROPERTY_MESSAGE, "c.id");
+    goto err_no_identity_cert;
+  }
+
+  len = strlen(identity_cert_property->value);
+  assert (len <= INT32_MAX);
+  if (!ac_X509_certificate_from_data(identity_cert_property->value, (int) len, &identity_cert, ex))
+    goto err_inv_identity_cert;
+
+  if (!(identity_subject = ac_get_certificate_subject_name(identity_cert, ex)))
+    goto err_inv_identity_cert;
+
+  /* Retrieve the remote permissions document from the remote_credential_token */
+  permission_doc_property = DDS_Security_DataHolder_find_property(remote_credential_token, "c.perm");
+  if (!permission_doc_property || !permission_doc_property->value)
+  {
+    DDS_Security_Exception_set(ex, DDS_ACCESS_CONTROL_PLUGIN_CONTEXT, DDS_SECURITY_ERR_MISSING_PROPERTY_CODE, 0, DDS_SECURITY_ERR_MISSING_PROPERTY_MESSAGE, "c.perm");
+    goto err_inv_perm_doc;
+  }
+
+  if (strlen(permission_doc_property->value) == 0)
+  {
+    /* use default permissions document (all deny) if there is no permissions file
+         *to communicate with access_control=false and comply with previous release */
+    struct domain_rule *domainRule = find_domain_rule_in_governance(local_rights->governance_tree->dds->domain_access_rules->domain_rule, local_rights->domain_id);
+    if (!domainRule->enable_join_access_control->value)
+    {
+      permissions_xml = ddsrt_str_replace(DDS_SECURITY_DEFAULT_PERMISSIONS, "DEFAULT_SUBJECT", identity_subject, 1);
+    }
+    else
+    {
+      DDS_Security_Exception_set(ex, DDS_ACCESS_CONTROL_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_PERMISSION_DOCUMENT_PROPERTY_CODE, 0, DDS_SECURITY_ERR_INVALID_PERMISSION_DOCUMENT_PROPERTY_MESSAGE);
+      goto err_inv_perm_doc;
+    }
+  }
+  else
+  {
+    if (!ac_PKCS7_document_check(permission_doc_property->value, strlen(permission_doc_property->value), local_rights->permissions_ca, &permissions_xml, ex))
+      goto err_inv_perm_doc;
+  }
+
+  permissions = ddsrt_malloc(sizeof(remote_permissions));
+  permissions->ref_cnt = 0;
+  permissions->permissions_tree = NULL;
+  if (!ac_parse_permissions_xml(permissions_xml, &(permissions->permissions_tree), ex))
+  {
+    ddsrt_free(permissions);
+    goto err_inv_perm_xml;
+  }
+
+  /* check if subject name of identity certificate matches the subject name in the permissions document */
+  if (!validate_subject_name_in_permissions(permissions->permissions_tree, identity_subject, &permission_subject, &permission_expiry, ex))
+  {
+    ac_return_permissions_tree(permissions->permissions_tree);
+    ddsrt_free(permissions);
+    goto err_inv_subject;
+  }
+  rights = ac_remote_participant_access_rights_new(remote_identity_handle, local_rights, permissions, permission_expiry, remote_permissions_token, permission_subject);
+  sanity_check_remote_access_rights(rights);
+  ddsrt_free(permission_subject);
+
+err_inv_subject:
+err_inv_perm_xml:
+  ddsrt_free(permissions_xml);
+err_inv_perm_doc:
+  X509_free(identity_cert);
+err_inv_identity_cert:
+  ddsrt_free(identity_subject);
+err_no_identity_cert:
+  return rights;
+}
+
+static TOPIC_TYPE
+get_topic_type(
+    const char *topic_name)
+{
+  TOPIC_TYPE type = TOPIC_TYPE_USER;
+  assert(topic_name);
+
+  /* All builtin topics start with "DCPS" */
+  if (strncmp(topic_name, "DCPS", 4) == 0)
+  {
+    /* There are a number of builtin topics starting with "DCPSParticipant" */
+    if (strncmp(&(topic_name[4]), "Participant", 11) == 0)
+    {
+      if (strcmp(&(topic_name[15]), "") == 0)
+        type = TOPIC_TYPE_NON_SECURE_BUILTIN; /* DCPSParticipant */
+      else if (strcmp(&(topic_name[15]), "Message") == 0)
+        type = TOPIC_TYPE_NON_SECURE_BUILTIN; /* DCPSParticipantMessage */
+      else if (strcmp(&(topic_name[15]), "MessageSecure") == 0)
+        type = TOPIC_TYPE_SECURE_ParticipantMessageSecure; /* DCPSParticipantMessageSecure */
+      else if (strcmp(&(topic_name[15]), "VolatileMessageSecure") == 0)
+        type = TOPIC_TYPE_SECURE_ParticipantVolatileMessageSecure; /* DCPSParticipantVolatileMessageSecure */
+      else if (strcmp(&(topic_name[15]), "StatelessMessage") == 0)
+        type = TOPIC_TYPE_SECURE_ParticipantStatelessMessage; /* DCPSParticipantStatelessMessage */
+      else if (strcmp(&(topic_name[15]), "sSecure") == 0)
+        type = TOPIC_TYPE_SECURE_ParticipantsSecure; /* DCPSParticipantsSecure */
+    }
+    else if (strcmp(&(topic_name[4]), "SubscriptionsSecure") == 0)
+      type = TOPIC_TYPE_SECURE_SubscriptionsSecure; /* DCPSSubscriptionsSecure */
+    else if (strcmp(&(topic_name[4]), "PublicationsSecure") == 0)
+      type = TOPIC_TYPE_SECURE_PublicationsSecure; /* DCPSPublicationsSecure */
+    else if ((strcmp(&(topic_name[4]), "Topic") == 0) ||
+             (strcmp(&(topic_name[4]), "Publication") == 0) ||
+             (strcmp(&(topic_name[4]), "Subscription") == 0))
+    {
+      /* DCPSTopic        */
+      /* DCPSPublication  */
+      /* DCPSSubscription */
+      type = TOPIC_TYPE_NON_SECURE_BUILTIN;
+    }
+  }
+  return type;
+}
+
+int finalize_access_control(void *context)
+{
+  dds_security_access_control_impl *access_control = context;
+  if (access_control)
+  {
+#if TIMED_CALLBACK_IMPLEMENTED
+    ut_timed_dispatcher_free(access_control->timed_callbacks);
+#endif
+    access_control_table_free(access_control->remote_permissions);
+#ifdef ACCESS_CONTROL_USE_ONE_PERMISSION
+    if (access_control->local_access_rights)
+      access_control_object_free((AccessControlObject *)access_control->local_access_rights);
+#else
+    access_control_table_free(access_control->local_permissions);
+#endif
+    ddsrt_mutex_destroy(&access_control->lock);
+    ddsrt_free(access_control);
+  }
+  EVP_cleanup();
+  CRYPTO_cleanup_all_ex_data();
+  REMOVE_THREAD_STATE();
+  ERR_free_strings();
+  return 0;
+}
diff --git a/src/security/builtin_plugins/access_control/src/access_control.h b/src/security/builtin_plugins/access_control/src/access_control.h
new file mode 100644
index 0000000..b98d2d7
--- /dev/null
+++ b/src/security/builtin_plugins/access_control/src/access_control.h
@@ -0,0 +1,21 @@
+/*
+ * Copyright(c) 2006 to 2019 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+#ifndef ACCESS_CONTROL_H
+#define ACCESS_CONTROL_H
+
+#include "dds/security/dds_security_api.h"
+#include "dds/security/export.h"
+
+SECURITY_EXPORT int init_access_control(const char *argument, void **context);
+SECURITY_EXPORT int finalize_access_control(void *context);
+
+#endif /* ACCESS_CONTROL_H */
diff --git a/src/security/builtin_plugins/access_control/src/access_control_objects.c b/src/security/builtin_plugins/access_control/src/access_control_objects.c
new file mode 100644
index 0000000..cee88cb
--- /dev/null
+++ b/src/security/builtin_plugins/access_control/src/access_control_objects.c
@@ -0,0 +1,283 @@
+/*
+ * Copyright(c) 2006 to 2019 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+#include <assert.h>
+#include <string.h>
+#include "dds/ddsrt/atomics.h"
+#include "dds/ddsrt/heap.h"
+#include "dds/ddsrt/hopscotch.h"
+#include "dds/ddsrt/string.h"
+#include "dds/ddsrt/sync.h"
+#include "dds/ddsrt/types.h"
+#include "access_control_objects.h"
+#include "access_control_utils.h"
+#include "access_control_parser.h"
+
+struct AccessControlTable
+{
+  struct ddsrt_hh *htab;
+  ddsrt_mutex_t lock;
+};
+
+bool access_control_object_valid(const AccessControlObject *obj, const AccessControlObjectKind_t kind)
+{
+  if (!obj)
+    return false;
+  if (obj->kind != kind)
+    return false;
+  if (obj->handle != (int64_t)(uintptr_t)obj)
+    return false;
+
+  return true;
+}
+
+static uint32_t access_control_object_hash(const void *obj)
+{
+  const AccessControlObject *object = obj;
+  const uint64_t c = 0xE21B371BEB9E6C05;
+  const uint32_t x = (uint32_t)object->handle;
+  return (unsigned)((x * c) >> 32);
+}
+
+static int access_control_object_equal(const void *ha, const void *hb)
+{
+  const AccessControlObject *la = ha;
+  const AccessControlObject *lb = hb;
+  return la->handle == lb->handle;
+}
+
+void access_control_object_init(AccessControlObject *obj, AccessControlObjectKind_t kind, AccessControlObjectDestructor destructor)
+{
+  assert(obj);
+  obj->kind = kind;
+  obj->handle = (int64_t)(uintptr_t)obj;
+  obj->destructor = destructor;
+  ddsrt_atomic_st32(&obj->refcount, 1);
+}
+
+static void access_control_object_deinit(AccessControlObject *obj)
+{
+  assert(obj);
+  obj->handle = DDS_SECURITY_HANDLE_NIL;
+  obj->kind = ACCESS_CONTROL_OBJECT_KIND_UNKNOWN;
+  obj->destructor = NULL;
+}
+
+void access_control_object_free(AccessControlObject *obj)
+{
+  if (obj && obj->destructor)
+    obj->destructor(obj);
+}
+
+AccessControlObject *access_control_object_keep(AccessControlObject *obj)
+{
+  if (obj)
+    ddsrt_atomic_inc32(&obj->refcount);
+  return obj;
+}
+
+void access_control_object_release(AccessControlObject *obj)
+{
+  if (obj)
+  {
+    if (ddsrt_atomic_dec32_nv(&obj->refcount) == 0)
+      access_control_object_free(obj);
+  }
+}
+
+struct AccessControlTable *access_control_table_new(void)
+{
+  struct AccessControlTable *table;
+
+  table = ddsrt_malloc(sizeof(*table));
+  table->htab = ddsrt_hh_new(32, access_control_object_hash, access_control_object_equal);
+  ddsrt_mutex_init(&table->lock);
+  return table;
+}
+
+void access_control_table_free(struct AccessControlTable *table)
+{
+  struct ddsrt_hh_iter it;
+  AccessControlObject *obj;
+
+  if (!table)
+    return;
+  for (obj = ddsrt_hh_iter_first(table->htab, &it); obj; obj = ddsrt_hh_iter_next(&it))
+  {
+    (void)ddsrt_hh_remove(table->htab, obj);
+    access_control_object_release(obj);
+  }
+  ddsrt_hh_free(table->htab);
+  ddsrt_mutex_destroy(&table->lock);
+  ddsrt_free(table);
+}
+
+AccessControlObject *access_control_table_insert(struct AccessControlTable *table, AccessControlObject *object)
+{
+  AccessControlObject template;
+  AccessControlObject *cur;
+  assert(table);
+  assert(object);
+  template.handle = object->handle;
+  ddsrt_mutex_lock(&table->lock);
+  if (!(cur = access_control_object_keep(ddsrt_hh_lookup(table->htab, &template))))
+  {
+    cur = access_control_object_keep(object);
+    (void)ddsrt_hh_add(table->htab, cur);
+  }
+  ddsrt_mutex_unlock(&table->lock);
+  return cur;
+}
+
+void access_control_table_remove_object(struct AccessControlTable *table, AccessControlObject *object)
+{
+  assert(table);
+  assert(object);
+  ddsrt_mutex_lock(&table->lock);
+  (void)ddsrt_hh_remove(table->htab, object);
+  ddsrt_mutex_unlock(&table->lock);
+  access_control_object_release(object);
+}
+
+AccessControlObject *access_control_table_remove(struct AccessControlTable *table, int64_t handle)
+{
+  AccessControlObject template;
+  AccessControlObject *object;
+  assert(table);
+  template.handle = handle;
+  ddsrt_mutex_lock(&table->lock);
+  if ((object = access_control_object_keep(ddsrt_hh_lookup(table->htab, &template))))
+  {
+    (void)ddsrt_hh_remove(table->htab, object);
+    access_control_object_release(object);
+  }
+  ddsrt_mutex_unlock(&table->lock);
+  return object;
+}
+
+AccessControlObject *access_control_table_find(struct AccessControlTable *table, int64_t handle)
+{
+  AccessControlObject template;
+  AccessControlObject *object;
+  assert(table);
+  template.handle = handle;
+  ddsrt_mutex_lock(&table->lock);
+  object = access_control_object_keep(ddsrt_hh_lookup(table->htab, &template));
+  ddsrt_mutex_unlock(&table->lock);
+  return object;
+}
+
+void access_control_table_walk(struct AccessControlTable *table, AccessControlTableCallback callback, void *arg)
+{
+  struct ddsrt_hh_iter it;
+  AccessControlObject *obj;
+  int r = 1;
+  assert(table);
+  assert(callback);
+  ddsrt_mutex_lock(&table->lock);
+  for (obj = ddsrt_hh_iter_first(table->htab, &it); r && obj; obj = ddsrt_hh_iter_next(&it))
+    r = callback(obj, arg);
+  ddsrt_mutex_unlock(&table->lock);
+}
+
+static void local_participant_access_rights_free(AccessControlObject *obj)
+{
+  local_participant_access_rights *rights = (local_participant_access_rights *)obj;
+  if (rights)
+  {
+    ddsrt_free(rights->permissions_document);
+    if (rights->permissions_ca)
+      X509_free(rights->permissions_ca);
+    access_control_object_deinit((AccessControlObject *)rights);
+    if (rights->governance_tree)
+      ac_return_governance_tree(rights->governance_tree);
+    if (rights->permissions_tree)
+      ac_return_permissions_tree(rights->permissions_tree);
+    ddsrt_free(rights->identity_subject_name);
+    ddsrt_free(rights);
+  }
+}
+
+local_participant_access_rights *ac_local_participant_access_rights_new(
+    DDS_Security_IdentityHandle local_identity,
+    int domain_id,
+    char *permissions_document,
+    X509 *permissions_ca,
+    const char *identity_subject_name,
+    struct governance_parser *governance_tree,
+    struct permissions_parser *permissions_tree)
+{
+  local_participant_access_rights *rights = ddsrt_malloc(sizeof(local_participant_access_rights));
+  memset(rights, 0, sizeof(local_participant_access_rights));
+  access_control_object_init((AccessControlObject *)rights, ACCESS_CONTROL_OBJECT_KIND_LOCAL_PARTICIPANT, local_participant_access_rights_free);
+  rights->local_identity = local_identity;
+  rights->domain_id = domain_id;
+  rights->permissions_document = permissions_document;
+  rights->permissions_ca = permissions_ca;
+  rights->identity_subject_name = ddsrt_strdup(identity_subject_name);
+  rights->governance_tree = governance_tree;
+  rights->permissions_tree = permissions_tree;
+  return rights;
+}
+
+
+static void remote_participant_access_rights_free(AccessControlObject *obj)
+{
+  remote_participant_access_rights *rights = (remote_participant_access_rights *)obj;
+  if (rights)
+  {
+    if (rights->permissions)
+    {
+      assert(rights->permissions->ref_cnt > 0);
+      rights->permissions->ref_cnt--;
+      if (rights->permissions->ref_cnt == 0)
+      {
+        ac_return_permissions_tree(rights->permissions->permissions_tree);
+        ddsrt_free(rights->permissions->remote_permissions_token_class_id);
+        ddsrt_free(rights->permissions);
+      }
+    }
+    ddsrt_free(rights->identity_subject_name);
+    ACCESS_CONTROL_OBJECT_RELEASE(rights->local_rights);
+    access_control_object_deinit((AccessControlObject *)rights);
+    ddsrt_free(rights);
+  }
+}
+
+remote_participant_access_rights *
+ac_remote_participant_access_rights_new(
+    DDS_Security_IdentityHandle remote_identity,
+    const local_participant_access_rights *local_rights,
+    remote_permissions *permissions,
+    dds_time_t permission_expiry,
+    const DDS_Security_PermissionsToken *remote_permissions_token,
+    const char *identity_subject)
+{
+  remote_participant_access_rights *rights = ddsrt_malloc(sizeof(remote_participant_access_rights));
+  memset(rights, 0, sizeof(remote_participant_access_rights));
+  access_control_object_init((AccessControlObject *)rights, ACCESS_CONTROL_OBJECT_KIND_REMOTE_PARTICIPANT, remote_participant_access_rights_free);
+  rights->remote_identity = remote_identity;
+  rights->permissions = permissions;
+  rights->permissions_expiry = permission_expiry;
+  rights->local_rights = (local_participant_access_rights *)ACCESS_CONTROL_OBJECT_KEEP(local_rights);
+  if (rights->permissions)
+  {
+    rights->permissions->remote_permissions_token_class_id = ddsrt_strdup(remote_permissions_token->class_id);
+    rights->permissions->ref_cnt++;
+    rights->identity_subject_name = ddsrt_strdup(identity_subject);
+  }
+  else
+  {
+    assert(identity_subject == NULL);
+    rights->identity_subject_name = NULL;
+  }
+  return rights;
+}
diff --git a/src/security/builtin_plugins/access_control/src/access_control_objects.h b/src/security/builtin_plugins/access_control/src/access_control_objects.h
new file mode 100644
index 0000000..b1f033b
--- /dev/null
+++ b/src/security/builtin_plugins/access_control/src/access_control_objects.h
@@ -0,0 +1,106 @@
+/*
+ * Copyright(c) 2006 to 2019 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+#ifndef ACCESS_CONTROL_OBJECTS_H
+#define ACCESS_CONTROL_OBJECTS_H
+
+#include <openssl/x509.h>
+#include "dds/ddsrt/atomics.h"
+#include "dds/ddsrt/types.h"
+#include "dds/security/dds_security_api.h"
+
+#define ACCESS_CONTROL_OBJECT(o)            ((AccessControlObject *)(o))
+#define ACCESS_CONTROL_OBJECT_HANDLE(o)     ((o) ? ACCESS_CONTROL_OBJECT(o)->handle : DDS_SECURITY_HANDLE_NIL)
+
+#define ACCESS_CONTROL_OBJECT_KEEP(o)       access_control_object_keep((AccessControlObject *)(o))
+#define ACCESS_CONTROL_OBJECT_RELEASE(o)    access_control_object_release((AccessControlObject *)(o))
+#define ACCESS_CONTROL_OBJECT_VALID(o,k)    access_control_object_valid((AccessControlObject *)(o), k)
+
+typedef enum {
+    ACCESS_CONTROL_OBJECT_KIND_UNKNOWN,
+    ACCESS_CONTROL_OBJECT_KIND_LOCAL_PARTICIPANT,
+    ACCESS_CONTROL_OBJECT_KIND_REMOTE_PARTICIPANT,
+} AccessControlObjectKind_t;
+
+typedef struct AccessControlObject AccessControlObject;
+typedef void (*AccessControlObjectDestructor)(AccessControlObject *obj);
+
+struct AccessControlObject {
+    int64_t handle;
+    ddsrt_atomic_uint32_t refcount;
+    AccessControlObjectKind_t kind;
+    AccessControlObjectDestructor destructor;
+};
+
+typedef struct local_participant_access_rights {
+    AccessControlObject _parent;
+    DDS_Security_ParticipantSecurityAttributes participant_attributes;
+    DDS_Security_IdentityHandle local_identity;
+    struct governance_parser *governance_tree;
+    struct permissions_parser *permissions_tree;
+    int domain_id;
+    char *identity_subject_name;
+    char *permissions_document;
+    X509 *permissions_ca;
+    dds_time_t permissions_expiry;
+} local_participant_access_rights;
+
+
+typedef struct remote_permissions {
+    int ref_cnt;
+    struct permissions_parser *permissions_tree;
+    DDS_Security_string remote_permissions_token_class_id;
+} remote_permissions;
+
+typedef struct remote_participant_access_rights {
+    AccessControlObject _parent;
+    DDS_Security_IdentityHandle remote_identity;
+    local_participant_access_rights *local_rights;
+    remote_permissions *permissions;
+    char *identity_subject_name;
+    dds_time_t permissions_expiry;
+} remote_participant_access_rights;
+
+void access_control_object_init(AccessControlObject *obj, AccessControlObjectKind_t kind, AccessControlObjectDestructor destructor);
+AccessControlObject *access_control_object_keep(AccessControlObject *obj);
+void access_control_object_release(AccessControlObject *obj);
+bool access_control_object_valid(const AccessControlObject *obj, AccessControlObjectKind_t kind);
+void access_control_object_free(AccessControlObject *obj);
+
+struct AccessControlTable;
+typedef int (*AccessControlTableCallback)(AccessControlObject *obj, void *arg);
+struct AccessControlTable *access_control_table_new(void);
+
+void access_control_table_free(struct AccessControlTable *table);
+AccessControlObject *access_control_table_insert(struct AccessControlTable *table, AccessControlObject *object);
+void access_control_table_remove_object(struct AccessControlTable *table, AccessControlObject *object);
+AccessControlObject *access_control_table_remove(struct AccessControlTable *table, int64_t handle);
+AccessControlObject *access_control_table_find(struct AccessControlTable *table, int64_t handle);
+void access_control_table_walk(struct AccessControlTable *table, AccessControlTableCallback callback, void *arg);
+
+local_participant_access_rights *ac_local_participant_access_rights_new(
+    DDS_Security_IdentityHandle local_identity,
+    int domain_id,
+    char *permissions_document,
+    X509 *permissions_ca,
+    const char* identity_subject_name,
+    struct governance_parser *governance_tree,
+    struct permissions_parser *permissions_tree);
+
+remote_participant_access_rights *ac_remote_participant_access_rights_new(
+    DDS_Security_IdentityHandle remote_identity,
+    const local_participant_access_rights *local_rights,
+    remote_permissions *permissions,
+    dds_time_t permission_expiry,
+    const DDS_Security_PermissionsToken *remote_permissions_token,
+    const char *identity_subject);
+
+#endif /* ACCESS_CONTROL_OBJECTS_H */
diff --git a/src/security/builtin_plugins/access_control/src/access_control_parser.c b/src/security/builtin_plugins/access_control/src/access_control_parser.c
new file mode 100644
index 0000000..5f1cf2d
--- /dev/null
+++ b/src/security/builtin_plugins/access_control/src/access_control_parser.c
@@ -0,0 +1,1212 @@
+/*
+ * Copyright(c) 2006 to 2019 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+#include <assert.h>
+#include <string.h>
+#include <openssl/x509.h>
+#include <openssl/pkcs7.h>
+#include <openssl/pem.h>
+#include <openssl/bio.h>
+#include <openssl/err.h>
+#include "dds/ddsrt/heap.h"
+#include "dds/ddsrt/misc.h"
+#include "dds/ddsrt/string.h"
+#include "dds/ddsrt/strtol.h"
+#include "dds/ddsrt/types.h"
+#include "dds/ddsrt/xmlparser.h"
+#include "dds/security/dds_security_api.h"
+#include "dds/security/core/dds_security_utils.h"
+#include "access_control_parser.h"
+#include "access_control_utils.h"
+
+#define DEBUG_PARSER 0
+#if (DEBUG_PARSER)
+
+static void print_tab(int spaces)
+{
+  while (spaces > 0)
+  {
+    printf(" ");
+    spaces--;
+  }
+}
+
+static void print_string_value(struct string_value *val, const char *info, int spaces)
+{
+  print_tab(spaces);
+  printf("%s", info);
+  if (val)
+    printf(": %s", val->value ? val->value : "<noval>");
+  printf("\n");
+}
+
+#define PRINT_VALUE_BASIC(name_, type_) \
+  static void print_##name_##_value (type_ *val, const char *info, int spaces) \
+  { \
+    print_tab(spaces); \
+    printf("%s", info); \
+    if (val) \
+      printf(": %d", val->value); \
+    printf("\n"); \
+  }
+PRINT_VALUE_BASIC(bool, struct boolean_value)
+PRINT_VALUE_BASIC(int, struct integer_value)
+PRINT_VALUE_BASIC(protection, struct protection_kind_value)
+PRINT_VALUE_BASIC(basic_protection, struct basicprotection_kind_value)
+#undef PRINT_VALUE_BASIC
+
+static void print_domains(struct domains *domains, int spaces)
+{
+  print_tab(spaces);
+  printf("domains {\n");
+  if (domains)
+  {
+    struct domain_id_set *current = domains->domain_id_set;
+    while (current != NULL)
+    {
+      if (current->max == NULL)
+      {
+        print_int_value(current->min, "id", spaces + 3);
+      }
+      else
+      {
+        print_int_value(current->min, "min", spaces + 3);
+        print_int_value(current->max, "max", spaces + 3);
+      }
+      current = (struct domain_id_set *)current->node.next;
+    }
+  }
+  else
+  {
+    printf(" {\n");
+  }
+  print_tab(spaces);
+  printf("}\n");
+}
+
+static void print_topic_rule(struct topic_rule *rule, int spaces)
+{
+  print_tab(spaces);
+  printf("topic_rule {\n");
+  if (rule)
+  {
+    print_string_value(rule->topic_expression, "topic_expression", spaces + 3);
+    print_bool_value(rule->enable_discovery_protection, "enable_discovery_protection", spaces + 3);
+    print_bool_value(rule->enable_liveliness_protection, "enable_liveliness_protection", spaces + 3);
+    print_bool_value(rule->enable_read_access_control, "enable_read_access_control", spaces + 3);
+    print_bool_value(rule->enable_write_access_control, "enable_write_access_control", spaces + 3);
+    print_protection_value(rule->metadata_protection_kind, "metadata_protection_kind", spaces + 3);
+    print_basic_protection_value(rule->data_protection_kind, "data_protection_kind", spaces + 3);
+  }
+  else
+  {
+    printf(" {\n");
+  }
+  print_tab(spaces);
+  printf("}\n");
+}
+
+static void print_topic_access_rules(struct topic_access_rules *tar, int spaces)
+{
+  print_tab(spaces);
+  printf("topic_access_rules {\n");
+  if (tar)
+  {
+    struct topic_rule *current = tar->topic_rule;
+    while (current != NULL)
+    {
+      print_topic_rule(current, spaces + 3);
+      current = (struct topic_rule *)current->node.next;
+    }
+  }
+  else
+  {
+    printf(" {\n");
+  }
+  print_tab(spaces);
+  printf("}\n");
+}
+
+static void print_domain_rule(struct domain_rule *rule, int spaces)
+{
+  print_tab(spaces);
+  printf("domain_rule {\n");
+  if (rule)
+  {
+    print_domains(rule->domains, spaces + 3);
+    print_bool_value(rule->allow_unauthenticated_participants, "allow_unauthenticated_participants", spaces + 3);
+    print_bool_value(rule->enable_join_access_control, "enable_join_access_control", spaces + 3);
+    print_protection_value(rule->rtps_protection_kind, "rtps_protection_kind", spaces + 3);
+    print_protection_value(rule->discovery_protection_kind, "discovery_protection_kind", spaces + 3);
+    print_protection_value(rule->liveliness_protection_kind, "liveliness_protection_kind", spaces + 3);
+    print_topic_access_rules(rule->topic_access_rules, spaces + 3);
+  }
+  else
+  {
+    printf(" {\n");
+  }
+  print_tab(spaces);
+  printf("}\n");
+}
+
+static void print_domain_access_rules(struct domain_access_rules *dar, int spaces)
+{
+  print_tab(spaces);
+  printf("domain_access_rules {\n");
+  if (dar)
+  {
+    struct domain_rule *current = dar->domain_rule;
+    while (current != NULL)
+    {
+      print_domain_rule(current, spaces + 3);
+      current = (struct domain_rule *)current->node.next;
+    }
+  }
+  else
+  {
+    printf(" {\n");
+  }
+  print_tab(spaces);
+  printf("}\n");
+}
+
+static void print_governance_parser_result(struct governance_parser *parser)
+{
+  assert(parser);
+  assert(parser->dds);
+  assert(parser->dds->domain_access_rules);
+  printf("-----------------------------------------------\n");
+  print_domain_access_rules(parser->dds->domain_access_rules, 0);
+  printf("-----------------------------------------------\n");
+}
+
+static void print_topic(struct string_value *topic, int spaces)
+{
+  if (topic)
+  {
+    print_string_value(topic, "topic", spaces);
+    print_topic((struct string_value *)topic->node.next, spaces);
+  }
+}
+
+static void print_topics(struct topics *topics, int spaces)
+{
+  if (topics)
+  {
+    print_tab(spaces);
+    printf("topics {\n");
+    print_topic(topics->topic, spaces + 3);
+    print_tab(spaces);
+    printf("}\n");
+  }
+}
+
+static void print_partition(struct string_value *partition, int spaces)
+{
+  if (partition)
+  {
+    print_string_value(partition, "partition", spaces);
+    print_partition((struct string_value *)partition->node.next, spaces);
+  }
+}
+
+static void print_partitions(struct partitions *partitions, int spaces)
+{
+  if (partitions)
+  {
+    print_tab(spaces);
+    printf("partitions {\n");
+    print_partition(partitions->partition, spaces + 3);
+    print_tab(spaces);
+    printf("}\n");
+  }
+}
+
+static void print_criteria(struct criteria *criteria, int spaces)
+{
+  if (criteria)
+  {
+    struct criteria *current = criteria;
+    while (current != NULL)
+    {
+      print_tab(spaces);
+      if (current->criteria_type == SUBSCRIBE_CRITERIA)
+        printf("subscribe {\n");
+      else if (current->criteria_type == PUBLISH_CRITERIA)
+        printf("publish {\n");
+      else
+        assert(0);
+      print_topics(current->topics, spaces + 3);
+      print_partitions(current->partitions, spaces + 3);
+      print_tab(spaces);
+      printf("}\n");
+      current = (struct criteria *)current->node.next;
+    }
+  }
+}
+
+static void print_allow_deny_rule(struct allow_deny_rule *allow_deny_rule, int spaces)
+{
+  if (allow_deny_rule)
+  {
+    struct allow_deny_rule *current = allow_deny_rule;
+    while (current != NULL)
+    {
+      print_tab(spaces);
+      if (current->rule_type == ALLOW_RULE)
+        printf("allow_rule {\n");
+      else if (current->rule_type == DENY_RULE)
+        printf("deny_rule {\n");
+      else
+        assert(0);
+      print_domains(current->domains, spaces + 3);
+      print_criteria(current->criteria, spaces + 3);
+      print_tab(spaces);
+      printf("}\n");
+      current = (struct allow_deny_rule *)current->node.next;
+    }
+  }
+}
+
+static void print_permissions(struct permissions *permissions, int spaces)
+{
+  struct grant *current = permissions->grant;
+  print_tab(spaces);
+  printf("permissions {\n");
+  while (current != NULL)
+  {
+    print_tab(spaces + 3);
+    printf("grant {\n");
+    print_tab(spaces + 6);
+    printf("name: %s\n", current->name);
+    print_string_value(current->subject_name, "subject_name", spaces + 6);
+    print_string_value(current->validity->not_before, "validity_not_before", spaces + 6);
+    print_string_value(current->validity->not_after, "validity_not_after", spaces + 6);
+    print_allow_deny_rule(current->allow_deny_rule, spaces + 6);
+    print_string_value(current->default_action, "default", spaces + 6);
+    current = (struct grant *)current->node.next;
+    print_tab(spaces + 3);
+    printf("}\n");
+  }
+  print_tab(spaces);
+  printf("}\n");
+}
+
+static void print_permissions_parser_result(struct permissions_parser *parser)
+{
+  assert(parser);
+  assert(parser->dds);
+  assert(parser->dds->permissions);
+  printf("-----------------------------------------------\n");
+  print_permissions(parser->dds->permissions, 0);
+  printf("-----------------------------------------------\n");
+}
+
+#endif /* DEBUG_PARSER */
+
+static struct element *new_element(element_kind kind, struct element *parent, size_t size)
+{
+  struct element *e = ddsrt_malloc(size);
+  memset(e, 0, size);
+  e->parent = parent;
+  e->kind = kind;
+  e->next = NULL;
+  return e;
+}
+
+#define PREPARE_NODE(element_type, element_kind, element_name, parent_type, parent_kind, current) \
+  {                                                                                               \
+    xml_##parent_type *P = (xml_##parent_type *)current;                                          \
+    if (!current || current->kind != ELEMENT_KIND_##parent_kind)                                  \
+    {                                                                                             \
+      return -1;                                                                                  \
+    }                                                                                             \
+    current = new_element(ELEMENT_KIND_##element_kind, current, sizeof(xml_##element_type));      \
+    P->element_name = (xml_##element_type *)current;                                              \
+  }
+
+#define PREPARE_NODE_WITH_LIST(element_type, element_kind, element_name, parent_type, parent_kind, current) \
+  {                                                                                                         \
+    xml_##parent_type *P = (xml_##parent_type *)current;                                                    \
+    xml_element *tail;                                                                                      \
+    if (!current || current->kind != ELEMENT_KIND_##parent_kind)                                            \
+    {                                                                                                       \
+      return -1;                                                                                            \
+    }                                                                                                       \
+    tail = (xml_element *)P->element_name;                                                                  \
+    current = new_element(ELEMENT_KIND_##element_kind, current, sizeof(xml_##element_type));                \
+    if (!P->element_name)                                                                                   \
+    {                                                                                                       \
+      P->element_name = (xml_##element_type *)current;                                                      \
+    }                                                                                                       \
+    else                                                                                                    \
+    {                                                                                                       \
+      while (tail->next != NULL)                                                                            \
+      {                                                                                                     \
+        tail = tail->next;                                                                                  \
+      }                                                                                                     \
+      tail->next = current;                                                                                 \
+      tail->next->next = NULL;                                                                              \
+    }                                                                                                       \
+  }
+
+static void validate_domains(const struct domain_id_set *domains_set, DDS_Security_SecurityException *ex)
+{
+  const struct domain_id_set *domain = domains_set;
+  if (!domains_set)
+  {
+    DDS_Security_Exception_set(ex, DDS_ACCESS_CONTROL_PLUGIN_CONTEXT, DDS_SECURITY_ERR_IDENTITY_EMPTY_CODE, 0, "Found domain set in Governance file without domain ids.");
+    return;
+  }
+  while (domain != NULL && ex->code == 0)
+  {
+    if (!domain->min)
+      DDS_Security_Exception_set(ex, DDS_ACCESS_CONTROL_PLUGIN_CONTEXT, DDS_SECURITY_ERR_IDENTITY_EMPTY_CODE, 0, "Found domain range in Governance file without minimum value.");
+    else if (!domain->max)
+      ; /* The max isn't set with only an id (no range), so no error. */
+    else if (domain->max->value < domain->min->value)
+      DDS_Security_Exception_set(ex, DDS_ACCESS_CONTROL_PLUGIN_CONTEXT, DDS_SECURITY_ERR_IDENTITY_EMPTY_CODE, 0, "Found domain range in Governance file with invalid range min(%d) max(%d).", domain->min->value, domain->max->value);
+    domain = (struct domain_id_set *)domain->node.next;
+  }
+}
+
+static void validate_topic_rules(const struct topic_rule *topic_rule, DDS_Security_SecurityException *ex)
+{
+  while (topic_rule && ex->code == 0)
+  {
+    if (!topic_rule->data_protection_kind)
+      DDS_Security_Exception_set(ex, DDS_ACCESS_CONTROL_PLUGIN_CONTEXT, DDS_SECURITY_ERR_IDENTITY_EMPTY_CODE, 0, "Found topic rule in Governance file without data_protection_kind");
+    else if (!topic_rule->enable_discovery_protection)
+      DDS_Security_Exception_set(ex, DDS_ACCESS_CONTROL_PLUGIN_CONTEXT, DDS_SECURITY_ERR_IDENTITY_EMPTY_CODE, 0, "Found topic rule in Governance file without enable_discovery_protection");
+    else if (!topic_rule->enable_liveliness_protection)
+      DDS_Security_Exception_set(ex, DDS_ACCESS_CONTROL_PLUGIN_CONTEXT, DDS_SECURITY_ERR_IDENTITY_EMPTY_CODE, 0, "Found topic rule in Governance file without enable_liveliness_protection");
+    else if (!topic_rule->enable_read_access_control)
+      DDS_Security_Exception_set(ex, DDS_ACCESS_CONTROL_PLUGIN_CONTEXT, DDS_SECURITY_ERR_IDENTITY_EMPTY_CODE, 0, "Found topic rule in Governance file without enable_read_access_control");
+    else if (!topic_rule->enable_write_access_control)
+      DDS_Security_Exception_set(ex, DDS_ACCESS_CONTROL_PLUGIN_CONTEXT, DDS_SECURITY_ERR_IDENTITY_EMPTY_CODE, 0, "Found topic rule in Governance file without enable_write_access_control");
+    else if (!topic_rule->metadata_protection_kind)
+      DDS_Security_Exception_set(ex, DDS_ACCESS_CONTROL_PLUGIN_CONTEXT, DDS_SECURITY_ERR_IDENTITY_EMPTY_CODE, 0, "Found topic rule in Governance file without metadata_protection_kind");
+    else
+      topic_rule = (struct topic_rule *)topic_rule->node.next;
+  }
+}
+
+static DDS_Security_boolean validate_rules(const struct domain_rule *rule, DDS_Security_SecurityException *ex)
+{
+  while (rule && ex->code == 0)
+  {
+    if (!rule->domains)
+      DDS_Security_Exception_set(ex, DDS_ACCESS_CONTROL_PLUGIN_CONTEXT, DDS_SECURITY_ERR_IDENTITY_EMPTY_CODE, 0, "Found rule in Governance file without domain ids.");
+    else if (!rule->allow_unauthenticated_participants)
+      DDS_Security_Exception_set(ex, DDS_ACCESS_CONTROL_PLUGIN_CONTEXT, DDS_SECURITY_ERR_IDENTITY_EMPTY_CODE, 0, "Found rule in Governance file without allow_unauthenticated_participants.");
+    else if (!rule->enable_join_access_control)
+      DDS_Security_Exception_set(ex, DDS_ACCESS_CONTROL_PLUGIN_CONTEXT, DDS_SECURITY_ERR_IDENTITY_EMPTY_CODE, 0, "Found rule in Governance file without enable_join_access_control.");
+    else if (!rule->rtps_protection_kind)
+      DDS_Security_Exception_set(ex, DDS_ACCESS_CONTROL_PLUGIN_CONTEXT, DDS_SECURITY_ERR_IDENTITY_EMPTY_CODE, 0, "Found rule in Governance file without rtps_protection_kind.");
+    else if (!rule->discovery_protection_kind)
+      DDS_Security_Exception_set(ex, DDS_ACCESS_CONTROL_PLUGIN_CONTEXT, DDS_SECURITY_ERR_IDENTITY_EMPTY_CODE, 0, "Found rule in Governance file without discovery_protection_kind.");
+    else if (!rule->liveliness_protection_kind)
+      DDS_Security_Exception_set(ex, DDS_ACCESS_CONTROL_PLUGIN_CONTEXT, DDS_SECURITY_ERR_IDENTITY_EMPTY_CODE, 0, "Found rule in Governance file without liveliness_protection_kind.");
+    else
+    {
+      /* Last but not least, check the domain ids (ex is set when there's a failure) */
+      validate_domains(rule->domains->domain_id_set, ex);
+      if (!rule->topic_access_rules && rule->topic_access_rules->topic_rule)
+        DDS_Security_Exception_set(ex, DDS_ACCESS_CONTROL_PLUGIN_CONTEXT, DDS_SECURITY_ERR_IDENTITY_EMPTY_CODE, 0, "Found rule in Governance file without topic_access_rules");
+      else
+      {
+        validate_topic_rules(rule->topic_access_rules->topic_rule, ex);
+        rule = (struct domain_rule *)rule->node.next;
+      }
+    }
+  }
+  return (ex->code == 0);
+}
+
+static int validate_permissions_tree(const struct grant *grant, DDS_Security_SecurityException *ex)
+{
+  while (grant && (ex->code == 0))
+  {
+    xml_allow_deny_rule *allow_deny_rule;
+    if (!grant->subject_name || !grant->subject_name->value)
+      DDS_Security_Exception_set(ex, DDS_ACCESS_CONTROL_PLUGIN_CONTEXT, DDS_SECURITY_ERR_CAN_NOT_PARSE_PERMISSIONS_CODE, 0, "Found tree in Permissions file without subject name.");
+    else if (!grant->validity)
+      DDS_Security_Exception_set(ex, DDS_ACCESS_CONTROL_PLUGIN_CONTEXT, DDS_SECURITY_ERR_CAN_NOT_PARSE_PERMISSIONS_CODE, 0, "Found tree in Permissions file without Validity.");
+    else if (!grant->validity->not_after || !grant->validity->not_after->value)
+      DDS_Security_Exception_set(ex, DDS_ACCESS_CONTROL_PLUGIN_CONTEXT, DDS_SECURITY_ERR_CAN_NOT_PARSE_PERMISSIONS_CODE, 0, "Found tree in Permissions file without Validity/not_after.");
+    else if (!grant->validity->not_before || !grant->validity->not_before->value)
+      DDS_Security_Exception_set(ex, DDS_ACCESS_CONTROL_PLUGIN_CONTEXT, DDS_SECURITY_ERR_CAN_NOT_PARSE_PERMISSIONS_CODE, 0, "Found tree in Permissions file without Validity/not_before.");
+    else
+    {
+      /*validate partitions*/
+      allow_deny_rule = grant->allow_deny_rule;
+      while (allow_deny_rule)
+      {
+        xml_criteria *criteria = allow_deny_rule->criteria;
+        while (criteria)
+        {
+          /* set to default partition, if there is no partition specifien in the XML. (DDS Security SPEC 9.4.1.3.2.3.1.4)*/
+          if (criteria->partitions == NULL)
+          {
+            xml_element *criteria_element = &(criteria->node);
+            xml_element *partitions_element;
+            PREPARE_NODE(partitions, PARTITIONS, partitions, criteria, CRITERIA, criteria_element)
+            assert(criteria->partitions);
+            partitions_element = &(criteria->partitions->node);
+            PREPARE_NODE_WITH_LIST(string_value, STRING_VALUE, partition, partitions, PARTITIONS, partitions_element)
+            assert(criteria->partitions->partition);
+            criteria->partitions->partition->value = ddsrt_strdup("");
+          }
+          criteria = (xml_criteria *)criteria->node.next;
+        }
+        allow_deny_rule = (xml_allow_deny_rule *)allow_deny_rule->node.next;
+      }
+    }
+    grant = (struct grant *)grant->node.next;
+  }
+  return (ex->code == 0);
+}
+
+static int to_protection_kind(const char *kindStr, DDS_Security_ProtectionKind *kindEnum)
+{
+  if (strcmp(kindStr, "ENCRYPT_WITH_ORIGIN_AUTHENTICATION") == 0)
+    *kindEnum = DDS_SECURITY_PROTECTION_KIND_ENCRYPT_WITH_ORIGIN_AUTHENTICATION;
+  else if (strcmp(kindStr, "SIGN_WITH_ORIGIN_AUTHENTICATION") == 0)
+    *kindEnum = DDS_SECURITY_PROTECTION_KIND_SIGN_WITH_ORIGIN_AUTHENTICATION;
+  else if (strcmp(kindStr, "ENCRYPT") == 0)
+    *kindEnum = DDS_SECURITY_PROTECTION_KIND_ENCRYPT;
+  else if (strcmp(kindStr, "SIGN") == 0)
+    *kindEnum = DDS_SECURITY_PROTECTION_KIND_SIGN;
+  else if (strcmp(kindStr, "NONE") == 0)
+    *kindEnum = DDS_SECURITY_PROTECTION_KIND_NONE;
+  else
+    return -1;
+  return 0;
+}
+
+static int to_basic_protection_kind(const char *kindStr, DDS_Security_BasicProtectionKind *kindEnum)
+{
+  if (strcmp(kindStr, "ENCRYPT") == 0)
+    *kindEnum = DDS_SECURITY_BASICPROTECTION_KIND_ENCRYPT;
+  else if (strcmp(kindStr, "SIGN") == 0)
+    *kindEnum = DDS_SECURITY_BASICPROTECTION_KIND_SIGN;
+  else if (strcmp(kindStr, "NONE") == 0)
+    *kindEnum = DDS_SECURITY_BASICPROTECTION_KIND_NONE;
+  else
+    return -1;
+  return 0;
+}
+
+static int governance_element_open_cb(void *varg, uintptr_t parentinfo, uintptr_t *eleminfo, const char *name, int line)
+{
+  governance_parser *parser = (governance_parser *)varg;
+  DDS_Security_SecurityException ex;
+  memset(&ex, 0, sizeof(DDS_Security_SecurityException));
+  DDSRT_UNUSED_ARG(parentinfo);
+  DDSRT_UNUSED_ARG(eleminfo);
+  DDSRT_UNUSED_ARG(line);
+  if (ddsrt_strcasecmp(name, "dds") == 0)
+  {
+    /* This should be the first element. */
+    if (parser->current || parser->dds)
+      return -1;
+    parser->current = new_element(ELEMENT_KIND_DDS, NULL, sizeof(struct governance_dds));
+    parser->dds = (struct governance_dds *)parser->current;
+  }
+  else if (ddsrt_strcasecmp(name, "domain_access_rules") == 0)
+    PREPARE_NODE(domain_access_rules, DOMAIN_ACCESS_RULES, domain_access_rules, governance_dds, DDS, parser->current)
+  else if (ddsrt_strcasecmp(name, "domain_rule") == 0)
+    PREPARE_NODE_WITH_LIST(domain_rule, DOMAIN_RULE, domain_rule, domain_access_rules, DOMAIN_ACCESS_RULES, parser->current)
+  else if (ddsrt_strcasecmp(name, "domains") == 0)
+    PREPARE_NODE(domains, DOMAINS, domains, domain_rule, DOMAIN_RULE, parser->current)
+  else if (ddsrt_strcasecmp(name, "id") == 0)
+  {
+    xml_domains *domains = (xml_domains *)parser->current;
+    xml_domain_id_set *tail;
+    if (!parser->current || parser->current->kind != ELEMENT_KIND_DOMAINS)
+      return -1;
+    tail = domains->domain_id_set;
+    parser->current = new_element(ELEMENT_KIND_DOMAIN_VALUE, parser->current, sizeof(xml_integer_value));
+    if (!tail)
+    {
+      domains->domain_id_set = (xml_domain_id_set *)new_element(ELEMENT_KIND_DOMAIN_ID_SET, parser->current, sizeof(xml_domain_id_set));
+      tail = domains->domain_id_set;
+    }
+    else
+    {
+      while (tail->node.next != NULL)
+        tail = (xml_domain_id_set *)tail->node.next;
+      tail->node.next = new_element(ELEMENT_KIND_DOMAIN_ID_SET, parser->current, sizeof(xml_domain_id_set));
+      tail = (xml_domain_id_set *)tail->node.next;
+    }
+    tail->min = (xml_integer_value *)parser->current;
+    tail->max = NULL;
+  }
+  else if (ddsrt_strcasecmp(name, "id_range") == 0)
+    PREPARE_NODE_WITH_LIST(domain_id_set, DOMAIN_ID_SET, domain_id_set, domains, DOMAINS, parser->current)
+  else if (ddsrt_strcasecmp(name, "min") == 0)
+    PREPARE_NODE(integer_value, DOMAIN_VALUE, min, domain_id_set, DOMAIN_ID_SET, parser->current)
+  else if (ddsrt_strcasecmp(name, "max") == 0)
+    PREPARE_NODE(integer_value, DOMAIN_VALUE, max, domain_id_set, DOMAIN_ID_SET, parser->current)
+  else if (ddsrt_strcasecmp(name, "allow_unauthenticated_participants") == 0)
+    PREPARE_NODE(boolean_value, BOOLEAN_VALUE, allow_unauthenticated_participants, domain_rule, DOMAIN_RULE, parser->current)
+  else if (ddsrt_strcasecmp(name, "enable_join_access_control") == 0)
+    PREPARE_NODE(boolean_value, BOOLEAN_VALUE, enable_join_access_control, domain_rule, DOMAIN_RULE, parser->current)
+  else if (ddsrt_strcasecmp(name, "rtps_protection_kind") == 0)
+    PREPARE_NODE(protection_kind_value, PROTECTION_KIND_VALUE, rtps_protection_kind, domain_rule, DOMAIN_RULE, parser->current)
+  else if (ddsrt_strcasecmp(name, "discovery_protection_kind") == 0)
+    PREPARE_NODE(protection_kind_value, PROTECTION_KIND_VALUE, discovery_protection_kind, domain_rule, DOMAIN_RULE, parser->current)
+  else if (ddsrt_strcasecmp(name, "liveliness_protection_kind") == 0)
+    PREPARE_NODE(protection_kind_value, PROTECTION_KIND_VALUE, liveliness_protection_kind, domain_rule, DOMAIN_RULE, parser->current)
+  else if (ddsrt_strcasecmp(name, "topic_access_rules") == 0)
+    PREPARE_NODE(topic_access_rules, TOPIC_ACCESS_RULES, topic_access_rules, domain_rule, DOMAIN_RULE, parser->current)
+  else if (ddsrt_strcasecmp(name, "topic_rule") == 0)
+    PREPARE_NODE_WITH_LIST(topic_rule, TOPIC_RULE, topic_rule, topic_access_rules, TOPIC_ACCESS_RULES, parser->current)
+  else if (ddsrt_strcasecmp(name, "enable_read_access_control") == 0)
+    PREPARE_NODE(boolean_value, BOOLEAN_VALUE, enable_read_access_control, topic_rule, TOPIC_RULE, parser->current)
+  else if (ddsrt_strcasecmp(name, "enable_write_access_control") == 0)
+    PREPARE_NODE(boolean_value, BOOLEAN_VALUE, enable_write_access_control, topic_rule, TOPIC_RULE, parser->current)
+  else if (ddsrt_strcasecmp(name, "metadata_protection_kind") == 0)
+    PREPARE_NODE(protection_kind_value, PROTECTION_KIND_VALUE, metadata_protection_kind, topic_rule, TOPIC_RULE, parser->current)
+  else if (ddsrt_strcasecmp(name, "data_protection_kind") == 0)
+    PREPARE_NODE(basicprotection_kind_value, BASICPROTECTION_KIND_VALUE, data_protection_kind, topic_rule, TOPIC_RULE, parser->current)
+  else if (ddsrt_strcasecmp(name, "enable_liveliness_protection") == 0)
+    PREPARE_NODE(boolean_value, BOOLEAN_VALUE, enable_liveliness_protection, topic_rule, TOPIC_RULE, parser->current)
+  else if (ddsrt_strcasecmp(name, "enable_discovery_protection") == 0)
+    PREPARE_NODE(boolean_value, BOOLEAN_VALUE, enable_discovery_protection, topic_rule, TOPIC_RULE, parser->current)
+  else if (ddsrt_strcasecmp(name, "topic_expression") == 0)
+  {
+    /* Current should be topic_rule. */
+    struct topic_rule *topicRule = (struct topic_rule *)parser->current;
+    if (!parser->current || parser->current->kind != ELEMENT_KIND_TOPIC_RULE)
+      return -1;
+    parser->current = new_element(ELEMENT_KIND_STRING_VALUE, parser->current, sizeof(struct string_value));
+    topicRule->topic_expression = (struct string_value *)parser->current;
+  }
+  else
+  {
+    printf("Unknown XML element: %s\n", name);
+    return -1;
+  }
+
+  return 0;
+}
+
+/* The function that is called on each attribute captured in XML.
+ * Only the following attributes will be handled:
+ * - name : the name of an element or attribute
+ */
+static int governance_element_attr_cb(void *varg, uintptr_t eleminfo, const char *name, const char *value, int line)
+{
+  /* There is no attribute in that XML */
+  DDSRT_UNUSED_ARG(eleminfo);
+  DDSRT_UNUSED_ARG(varg);
+  DDSRT_UNUSED_ARG(value);
+  DDSRT_UNUSED_ARG(line);
+
+  if (ddsrt_strcasecmp(name, "xmlns:xsi") == 0 || ddsrt_strcasecmp(name, "xsi:noNamespaceSchemaLocation") == 0)
+    return 0;
+  return -1;
+}
+
+static bool str_to_intvalue(const char *image, int32_t *value)
+{
+  char *endptr;
+  long long l;
+  if (ddsrt_strtoll(image, &endptr, 0, &l) != DDS_RETCODE_OK)
+    return false;
+  *value = (int32_t)l;
+  if (*endptr != '\0')
+    return false;
+  return true;
+}
+
+/* The function that is called on each data item captured in XML.
+ * - data: the string value between the element tags
+ */
+static int governance_element_data_cb(void *varg, uintptr_t eleminfo, const char *data, int line)
+{
+  struct governance_parser *parser = (struct governance_parser *)varg;
+  DDSRT_UNUSED_ARG(eleminfo);
+  DDSRT_UNUSED_ARG(line);
+  if (!parser || !parser->current)
+    return -1;
+  if (parser->current->kind == ELEMENT_KIND_STRING_VALUE)
+  {
+    struct string_value *value = (struct string_value *)parser->current;
+    value->value = ddsrt_strdup(data);
+  }
+  else if (parser->current->kind == ELEMENT_KIND_DOMAIN_VALUE)
+  {
+    struct integer_value *value = (struct integer_value *)parser->current;
+    if (str_to_intvalue(data, &value->value))
+    {
+      if (value->value < 0 || value->value > 230)
+        return -1;
+    }
+    else
+    {
+      return -1;
+    }
+  }
+  else if (parser->current->kind == ELEMENT_KIND_BOOLEAN_VALUE)
+  {
+    struct boolean_value *value = (struct boolean_value *)parser->current;
+    if (ddsrt_strcasecmp("true", data) == 0 || strcmp("1", data) == 0)
+      value->value = true;
+    else if (ddsrt_strcasecmp("false", data) == 0 || strcmp("0", data) == 0)
+      value->value = false;
+    else
+      return -1;
+  }
+  else if (parser->current->kind == ELEMENT_KIND_PROTECTION_KIND_VALUE)
+  {
+    struct protection_kind_value *value = (struct protection_kind_value *)parser->current;
+    if (to_protection_kind(data, &(value->value)) != 0)
+      return -1;
+  }
+  else if (parser->current->kind == ELEMENT_KIND_BASICPROTECTION_KIND_VALUE)
+  {
+    struct basicprotection_kind_value *value = (struct basicprotection_kind_value *)parser->current;
+    if (to_basic_protection_kind(data, &(value->value)) != 0)
+      return -1;
+  }
+  else
+  {
+    return -1;
+  }
+
+  return 0;
+}
+
+static int governance_element_close_cb(void *varg, uintptr_t eleminfo, int line)
+{
+  struct governance_parser *parser = (struct governance_parser *)varg;
+  DDSRT_UNUSED_ARG(eleminfo);
+  DDSRT_UNUSED_ARG(line);
+  if (!parser->current)
+    return -1;
+  parser->current = parser->current->parent;
+  return 0;
+}
+
+static void governance_error_cb(void *varg, const char *msg, int line)
+{
+  DDSRT_UNUSED_ARG(varg);
+  printf("Failed to parse configuration file: error %d - %s\n", line, msg);
+}
+
+static void free_stringvalue(struct string_value *str)
+{
+  if (str)
+  {
+    ddsrt_free(str->value);
+    ddsrt_free(str);
+  }
+}
+
+static void free_domainid_set(struct domain_id_set *dis)
+{
+  if (dis)
+  {
+    if (dis->node.next)
+    {
+      free_domainid_set((struct domain_id_set *)dis->node.next);
+    }
+    ddsrt_free(dis->min);
+    ddsrt_free(dis->max);
+    ddsrt_free(dis);
+  }
+}
+
+static void free_domains(struct domains *domains)
+{
+  if (domains)
+  {
+    free_domainid_set(domains->domain_id_set);
+    ddsrt_free(domains);
+  }
+}
+
+static void free_topic_rule(struct topic_rule *rule)
+{
+  if (rule)
+  {
+    if (rule->node.next)
+      free_topic_rule((struct topic_rule *)rule->node.next);
+    free_stringvalue(rule->topic_expression);
+    ddsrt_free(rule->enable_discovery_protection);
+    ddsrt_free(rule->enable_liveliness_protection);
+    ddsrt_free(rule->enable_read_access_control);
+    ddsrt_free(rule->enable_write_access_control);
+    ddsrt_free(rule->metadata_protection_kind);
+    ddsrt_free(rule->data_protection_kind);
+    ddsrt_free(rule);
+  }
+}
+
+static void free_topic_access_rules(struct topic_access_rules *tar)
+{
+  if (tar)
+  {
+    struct topic_rule *current = tar->topic_rule;
+    free_topic_rule(current);
+  }
+  ddsrt_free(tar);
+}
+
+static void free_domain_rule(struct domain_rule *rule)
+{
+  if (rule)
+  {
+    if (rule->node.next)
+      free_domain_rule((struct domain_rule *)rule->node.next);
+    free_domains(rule->domains);
+    ddsrt_free(rule->allow_unauthenticated_participants);
+    ddsrt_free(rule->enable_join_access_control);
+    ddsrt_free(rule->rtps_protection_kind);
+    ddsrt_free(rule->discovery_protection_kind);
+    ddsrt_free(rule->liveliness_protection_kind);
+    free_topic_access_rules(rule->topic_access_rules);
+    ddsrt_free(rule);
+  }
+}
+
+static void free_domain_access_rules(struct domain_access_rules *dar)
+{
+  if (dar)
+  {
+    free_domain_rule(dar->domain_rule);
+    ddsrt_free(dar);
+  }
+}
+
+bool ac_parse_governance_xml(const char *xml, struct governance_parser **governance_tree, DDS_Security_SecurityException *ex)
+{
+  struct governance_parser *parser = NULL;
+  struct ddsrt_xmlp_state *st = NULL;
+  if (xml)
+  {
+    struct ddsrt_xmlp_callbacks cb;
+    cb.elem_open = governance_element_open_cb;
+    cb.elem_data = governance_element_data_cb;
+    cb.elem_close = governance_element_close_cb;
+    cb.attr = governance_element_attr_cb;
+    cb.error = governance_error_cb;
+    parser = ddsrt_malloc(sizeof(struct governance_parser));
+    parser->current = NULL;
+    parser->dds = NULL;
+    st = ddsrt_xmlp_new_string(xml, parser, &cb);
+    if (ddsrt_xmlp_parse(st) != 0)
+    {
+      DDS_Security_Exception_set(ex, DDS_ACCESS_CONTROL_PLUGIN_CONTEXT, DDS_SECURITY_ERR_CAN_NOT_PARSE_GOVERNANCE_CODE, 0, DDS_SECURITY_ERR_CAN_NOT_PARSE_GOVERNANCE_MESSAGE);
+      goto err_xml_parsing;
+    }
+#if DEBUG_PARSER
+    print_governance_parser_result(parser);
+#endif
+    if ((parser->dds != NULL) && (parser->dds->domain_access_rules != NULL) && (parser->dds->domain_access_rules->domain_rule != NULL))
+    {
+      if (!validate_rules(parser->dds->domain_access_rules->domain_rule, ex))
+        goto err_rules_validation;
+    }
+    else
+    {
+      DDS_Security_Exception_set(ex, DDS_ACCESS_CONTROL_PLUGIN_CONTEXT, DDS_SECURITY_ERR_CAN_NOT_PARSE_GOVERNANCE_CODE, 0, DDS_SECURITY_ERR_CAN_NOT_PARSE_GOVERNANCE_MESSAGE);
+      goto err_parser_content;
+    }
+    *governance_tree = parser;
+  }
+  else
+  {
+    DDS_Security_Exception_set(ex, DDS_ACCESS_CONTROL_PLUGIN_CONTEXT, DDS_SECURITY_ERR_CAN_NOT_PARSE_GOVERNANCE_CODE, 0, DDS_SECURITY_ERR_CAN_NOT_PARSE_GOVERNANCE_MESSAGE);
+    goto err_xml;
+  }
+  ddsrt_xmlp_free(st);
+  return true;
+
+err_parser_content:
+err_rules_validation:
+err_xml_parsing:
+  ddsrt_xmlp_free(st);
+  ac_return_governance_tree(parser);
+err_xml:
+  return false;
+}
+
+void ac_return_governance_tree(struct governance_parser *parser)
+{
+  if (parser)
+  {
+    if (parser->dds)
+    {
+      free_domain_access_rules(parser->dds->domain_access_rules);
+      ddsrt_free(parser->dds);
+    }
+    ddsrt_free(parser);
+  }
+}
+
+/* Permissions Callback functions */
+
+static int permissions_element_open_cb(void *varg, uintptr_t parentinfo, uintptr_t *eleminfo, const char *name, int line)
+{
+  permissions_parser *parser = (permissions_parser *)varg;
+  DDS_Security_SecurityException ex;
+  memset(&ex, 0, sizeof(DDS_Security_SecurityException));
+  DDSRT_UNUSED_ARG(parentinfo);
+  DDSRT_UNUSED_ARG(eleminfo);
+  DDSRT_UNUSED_ARG(line);
+
+  /*it may be a valid element under an ignored element */
+  if (parser->current && parser->current->kind == ELEMENT_KIND_IGNORED)
+    parser->current = new_element(ELEMENT_KIND_IGNORED, parser->current, sizeof(struct element));
+  else if (ddsrt_strcasecmp(name, "dds") == 0)
+  {
+    /* This should be the first element. */
+    if (parser->current || parser->dds)
+      return -1;
+    parser->current = new_element(ELEMENT_KIND_DDS, NULL, sizeof(struct permissions_dds));
+    parser->dds = (struct permissions_dds *)parser->current;
+  }
+  else if (ddsrt_strcasecmp(name, "permissions") == 0)
+    PREPARE_NODE(permissions, PERMISSIONS, permissions, permissions_dds, DDS, parser->current)
+  else if (ddsrt_strcasecmp(name, "grant") == 0)
+    PREPARE_NODE_WITH_LIST(grant, GRANT, grant, permissions, PERMISSIONS, parser->current)
+  else if (ddsrt_strcasecmp(name, "domains") == 0)
+    PREPARE_NODE(domains, DOMAINS, domains, allow_deny_rule, ALLOW_DENY_RULE, parser->current)
+  else if (ddsrt_strcasecmp(name, "id") == 0)
+  {
+    xml_domains *domains = (xml_domains *)parser->current;
+    xml_domain_id_set *tail;
+    if (!parser->current || parser->current->kind != ELEMENT_KIND_DOMAINS)
+      return -1;
+    tail = domains->domain_id_set;
+    parser->current = new_element(ELEMENT_KIND_DOMAIN_VALUE, parser->current, sizeof(xml_integer_value));
+    if (!tail)
+    {
+      domains->domain_id_set = (xml_domain_id_set *)new_element(ELEMENT_KIND_DOMAIN_ID_SET, parser->current, sizeof(xml_domain_id_set));
+      tail = domains->domain_id_set;
+    }
+    else
+    {
+      while (tail->node.next != NULL)
+        tail = (xml_domain_id_set *)tail->node.next;
+      tail->node.next = new_element(ELEMENT_KIND_DOMAIN_ID_SET, parser->current, sizeof(xml_domain_id_set));
+      tail = (xml_domain_id_set *)tail->node.next;
+    }
+    tail->min = (xml_integer_value *)parser->current;
+    tail->max = NULL;
+  }
+  else if (ddsrt_strcasecmp(name, "id_range") == 0)
+    PREPARE_NODE_WITH_LIST(domain_id_set, DOMAIN_ID_SET, domain_id_set, domains, DOMAINS, parser->current)
+  else if (ddsrt_strcasecmp(name, "min") == 0)
+    PREPARE_NODE(integer_value, DOMAIN_VALUE, min, domain_id_set, DOMAIN_ID_SET, parser->current)
+  else if (ddsrt_strcasecmp(name, "max") == 0)
+    PREPARE_NODE(integer_value, DOMAIN_VALUE, max, domain_id_set, DOMAIN_ID_SET, parser->current)
+  else if (ddsrt_strcasecmp(name, "subject_name") == 0)
+    PREPARE_NODE(string_value, STRING_VALUE, subject_name, grant, GRANT, parser->current)
+  else if (ddsrt_strcasecmp(name, "validity") == 0)
+    PREPARE_NODE(validity, VALIDITY, validity, grant, GRANT, parser->current)
+  else if (ddsrt_strcasecmp(name, "not_before") == 0)
+    PREPARE_NODE(string_value, STRING_VALUE, not_before, validity, VALIDITY, parser->current)
+  else if (ddsrt_strcasecmp(name, "not_after") == 0)
+    PREPARE_NODE(string_value, STRING_VALUE, not_after, validity, VALIDITY, parser->current)
+  else if (ddsrt_strcasecmp(name, "allow_rule") == 0)
+  {
+    PREPARE_NODE_WITH_LIST(allow_deny_rule, ALLOW_DENY_RULE, allow_deny_rule, grant, GRANT, parser->current)
+    ((xml_allow_deny_rule *)parser->current)->rule_type = ALLOW_RULE;
+  }
+  else if (ddsrt_strcasecmp(name, "deny_rule") == 0)
+  {
+    PREPARE_NODE_WITH_LIST(allow_deny_rule, ALLOW_DENY_RULE, allow_deny_rule, grant, GRANT, parser->current)
+    ((xml_allow_deny_rule *)parser->current)->rule_type = DENY_RULE;
+  }
+  else if (ddsrt_strcasecmp(name, "subscribe") == 0)
+  {
+    PREPARE_NODE_WITH_LIST(criteria, CRITERIA, criteria, allow_deny_rule, ALLOW_DENY_RULE, parser->current)
+    ((xml_criteria *)parser->current)->criteria_type = SUBSCRIBE_CRITERIA;
+  }
+  else if (ddsrt_strcasecmp(name, "publish") == 0)
+  {
+    PREPARE_NODE_WITH_LIST(criteria, CRITERIA, criteria, allow_deny_rule, ALLOW_DENY_RULE, parser->current)
+    ((xml_criteria *)parser->current)->criteria_type = PUBLISH_CRITERIA;
+  }
+  else if (ddsrt_strcasecmp(name, "topics") == 0)
+    PREPARE_NODE(topics, TOPICS, topics, criteria, CRITERIA, parser->current)
+  else if (ddsrt_strcasecmp(name, "topic") == 0)
+    PREPARE_NODE_WITH_LIST(string_value, STRING_VALUE, topic, topics, TOPICS, parser->current)
+  else if (ddsrt_strcasecmp(name, "partitions") == 0)
+    PREPARE_NODE(partitions, PARTITIONS, partitions, criteria, CRITERIA, parser->current)
+  else if (ddsrt_strcasecmp(name, "partition") == 0)
+    PREPARE_NODE_WITH_LIST(string_value, STRING_VALUE, partition, partitions, PARTITIONS, parser->current)
+  else if (ddsrt_strcasecmp(name, "default") == 0)
+    PREPARE_NODE(string_value, STRING_VALUE, default_action, grant, GRANT, parser->current)
+  else if (ddsrt_strcasecmp(name, "relay") == 0 ||
+           ddsrt_strcasecmp(name, "value") == 0 ||
+           ddsrt_strcasecmp(name, "name") == 0 ||
+           ddsrt_strcasecmp(name, "tag") == 0 ||
+           ddsrt_strcasecmp(name, "data_tags") == 0)
+  {
+    parser->current = new_element(ELEMENT_KIND_IGNORED, parser->current, sizeof(struct element));
+    /*if this is the first element in the IGNORED branch, then give warning for the user*/
+    if (parser->current->parent->kind != ELEMENT_KIND_IGNORED)
+      printf("Warning: Unsupported element \"%s\" has been ignored in permissions file.\n", name);
+  }
+  else
+  {
+    printf("Unknown XML element: %s\n", name);
+    return -1;
+  }
+
+  return 0;
+}
+
+/* The function that is called on each attribute captured in XML.
+ * Only the following attributes will be handled:
+ * - name : the name of an element or attribute
+ */
+static int permissions_element_attr_cb(void *varg, uintptr_t eleminfo, const char *name, const char *value, int line)
+{
+  struct permissions_parser *parser = (struct permissions_parser *)varg;
+  DDSRT_UNUSED_ARG(eleminfo);
+  DDSRT_UNUSED_ARG(line);
+  if (ddsrt_strcasecmp(name, "xmlns:xsi") == 0 || ddsrt_strcasecmp(name, "xsi:noNamespaceSchemaLocation") == 0)
+    return 0;
+  if (strcmp(name, "name") == 0)
+  {
+    /* Parent should be grants. */
+    struct grant *grant = (struct grant *)parser->current;
+    if (!parser->current || parser->current->kind != ELEMENT_KIND_GRANT)
+      return -1;
+    grant->name = ddsrt_strdup(value);
+    return 0;
+  }
+  return -1;
+}
+
+/* The function that is called on each data item captured in XML.
+ * - data: the string value between the element tags */
+static int permissions_element_data_cb(void *varg, uintptr_t eleminfo, const char *data, int line)
+{
+  struct permissions_parser *parser = (struct permissions_parser *)varg;
+  DDS_Security_SecurityException ex;
+  memset(&ex, 0, sizeof(DDS_Security_SecurityException));
+  DDSRT_UNUSED_ARG(eleminfo);
+  DDSRT_UNUSED_ARG(line);
+  if (!parser || !parser->current)
+    return -1;
+  if (parser->current->kind == ELEMENT_KIND_STRING_VALUE)
+  {
+    struct string_value *value = (struct string_value *)parser->current;
+    value->value = ddsrt_strdup(data);
+  }
+  else if (parser->current->kind == ELEMENT_KIND_DOMAIN_VALUE)
+  {
+    struct integer_value *value = (struct integer_value *)parser->current;
+    if (str_to_intvalue(data, &value->value))
+    {
+      if (value->value < 0 || value->value > 230)
+        return -1;
+    }
+    else
+      return -1;
+  }
+  else
+  {
+    if (parser->current->kind != ELEMENT_KIND_IGNORED)
+      return -1;
+  }
+  return 0;
+}
+
+static int permissions_element_close_cb(void *varg, uintptr_t eleminfo, int line)
+{
+  struct permissions_parser *parser = (struct permissions_parser *)varg;
+  struct element *parent;
+  DDSRT_UNUSED_ARG(eleminfo);
+  DDSRT_UNUSED_ARG(line);
+
+  if (!parser->current)
+    return -1;
+  parent = parser->current->parent;
+  if (parser->current->kind == ELEMENT_KIND_IGNORED)
+    ddsrt_free(parser->current);
+  parser->current = parent;
+  return 0;
+}
+
+static void permissions_error_cb(void *varg, const char *msg, int line)
+{
+  DDSRT_UNUSED_ARG(varg);
+  printf("Failed to parse configuration file: error %d - %s\n", line, msg);
+}
+
+bool ac_parse_permissions_xml(const char *xml, struct permissions_parser **permissions_tree, DDS_Security_SecurityException *ex)
+{
+  struct permissions_parser *parser = NULL;
+  struct ddsrt_xmlp_state *st = NULL;
+
+  if (xml)
+  {
+    struct ddsrt_xmlp_callbacks cb;
+    cb.elem_open = permissions_element_open_cb;
+    cb.elem_data = permissions_element_data_cb;
+    cb.elem_close = permissions_element_close_cb;
+    cb.attr = permissions_element_attr_cb;
+    cb.error = permissions_error_cb;
+    parser = ddsrt_malloc(sizeof(struct permissions_parser));
+    parser->current = NULL;
+    parser->dds = NULL;
+    st = ddsrt_xmlp_new_string(xml, parser, &cb);
+    if (ddsrt_xmlp_parse(st) != 0)
+    {
+      DDS_Security_Exception_set(ex, DDS_ACCESS_CONTROL_PLUGIN_CONTEXT, DDS_SECURITY_ERR_CAN_NOT_PARSE_PERMISSIONS_CODE, 0, DDS_SECURITY_ERR_CAN_NOT_PARSE_PERMISSIONS_MESSAGE);
+      goto err_xml_parsing;
+    }
+#if DEBUG_PARSER
+    print_permissions_parser_result(parser);
+#endif
+    if ((parser->dds != NULL) && (parser->dds->permissions != NULL) && (parser->dds->permissions->grant != NULL))
+    {
+      if (!validate_permissions_tree(parser->dds->permissions->grant, ex))
+        goto err_parser_content;
+    }
+    else
+    {
+      DDS_Security_Exception_set(ex, DDS_ACCESS_CONTROL_PLUGIN_CONTEXT, DDS_SECURITY_ERR_CAN_NOT_PARSE_PERMISSIONS_CODE, 0, DDS_SECURITY_ERR_CAN_NOT_PARSE_PERMISSIONS_MESSAGE);
+      goto err_parser_content;
+    }
+    *permissions_tree = parser;
+  }
+  else
+  {
+    DDS_Security_Exception_set(ex, DDS_ACCESS_CONTROL_PLUGIN_CONTEXT, DDS_SECURITY_ERR_CAN_NOT_PARSE_PERMISSIONS_CODE, 0, DDS_SECURITY_ERR_CAN_NOT_PARSE_PERMISSIONS_MESSAGE);
+    goto err_xml;
+  }
+  ddsrt_xmlp_free(st);
+  return true;
+
+err_parser_content:
+err_xml_parsing:
+  ddsrt_xmlp_free(st);
+  ac_return_permissions_tree(parser);
+err_xml:
+  return false;
+}
+
+static void free_topic(struct string_value *topic)
+{
+  if (topic)
+  {
+    if (topic->node.next != NULL)
+      free_topic((struct string_value *)topic->node.next);
+    free_stringvalue(topic);
+  }
+}
+
+static void free_topics(struct topics *topics)
+{
+  if (topics)
+  {
+    free_topic(topics->topic);
+    ddsrt_free(topics);
+  }
+}
+
+static void free_partition(struct string_value *partition)
+{
+  if (partition)
+  {
+    if (partition->node.next != NULL)
+      free_partition((struct string_value *)partition->node.next);
+    free_stringvalue(partition);
+  }
+}
+
+static void free_partitions(struct partitions *partitions)
+{
+  if (partitions)
+  {
+    free_partition(partitions->partition);
+    ddsrt_free(partitions);
+  }
+}
+
+static void free_validity(struct validity *validity)
+{
+  if (validity)
+  {
+    free_stringvalue(validity->not_after);
+    free_stringvalue(validity->not_before);
+    ddsrt_free(validity);
+  }
+}
+
+static void free_criteria(struct criteria *criteria)
+{
+  if (criteria)
+  {
+    if (criteria->node.next)
+      free_criteria((struct criteria *)criteria->node.next);
+    free_partitions(criteria->partitions);
+    free_topics(criteria->topics);
+    ddsrt_free(criteria);
+  }
+}
+
+static void free_allow_deny_rule(struct allow_deny_rule *rule)
+{
+  if (rule)
+  {
+    free_allow_deny_rule((struct allow_deny_rule *)rule->node.next);
+    free_domains(rule->domains);
+    free_criteria(rule->criteria);
+    ddsrt_free(rule);
+  }
+}
+
+static void free_grant(struct grant *grant)
+{
+  if (grant)
+  {
+    if (grant->node.next)
+      free_grant((struct grant *)grant->node.next);
+    ddsrt_free(grant->name);
+    free_stringvalue(grant->subject_name);
+    free_stringvalue(grant->default_action);
+    free_validity(grant->validity);
+    free_allow_deny_rule(grant->allow_deny_rule);
+    ddsrt_free(grant);
+  }
+}
+
+static void free_permissions(struct permissions *permissions)
+{
+  if (permissions)
+  {
+    free_grant(permissions->grant);
+    ddsrt_free(permissions);
+  }
+}
+
+void ac_return_permissions_tree(struct permissions_parser *parser)
+{
+  if (parser)
+  {
+    if (parser->dds)
+    {
+      free_permissions(parser->dds->permissions);
+      ddsrt_free(parser->dds);
+    }
+    ddsrt_free(parser);
+  }
+}
diff --git a/src/security/builtin_plugins/access_control/src/access_control_parser.h b/src/security/builtin_plugins/access_control/src/access_control_parser.h
new file mode 100644
index 0000000..b4ed491
--- /dev/null
+++ b/src/security/builtin_plugins/access_control/src/access_control_parser.h
@@ -0,0 +1,301 @@
+/*
+ * Copyright(c) 2006 to 2019 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+#ifndef ACCESS_CONTROL_PARSER_H
+#define ACCESS_CONTROL_PARSER_H
+
+#include "dds/ddsrt/types.h"
+#include "dds/security/dds_security_api.h"
+
+typedef enum
+{
+  ELEMENT_KIND_UNDEFINED,
+  ELEMENT_KIND_DDS,
+  ELEMENT_KIND_DOMAIN_ACCESS_RULES,
+  ELEMENT_KIND_DOMAIN_RULE,
+  ELEMENT_KIND_DOMAINS,
+  ELEMENT_KIND_DOMAIN_ID_SET,
+  ELEMENT_KIND_RANGE,
+  ELEMENT_KIND_ALLOW_UNAUTHENTICATED_PARTICIPANTS,
+  ELEMENT_KIND_ENABLE_JOIN_ACCESS_CONTROL,
+  ELEMENT_KIND_RTPS_PROTECTION,
+  ELEMENT_KIND_DISCOVERY_PROTECTION,
+  ELEMENT_KIND_LIVELINESS_PROTECTION,
+  ELEMENT_KIND_TOPIC_ACCESS_RULES,
+  ELEMENT_KIND_TOPIC_RULE,
+  ELEMENT_KIND_STRING_VALUE,
+  ELEMENT_KIND_BOOLEAN_VALUE,
+  ELEMENT_KIND_DOMAIN_VALUE,
+  ELEMENT_KIND_PROTECTION_KIND_VALUE,
+  ELEMENT_KIND_BASICPROTECTION_KIND_VALUE,
+  ELEMENT_KIND_PERMISSIONS,
+  ELEMENT_KIND_GRANT,
+  ELEMENT_KIND_ALLOW_DENY_RULE,
+  ELEMENT_KIND_CRITERIA,
+  ELEMENT_KIND_VALIDITY,
+  ELEMENT_KIND_TOPICS,
+  ELEMENT_KIND_PARTITIONS,
+  ELEMENT_KIND_DEFAULT,
+  ELEMENT_KIND_IGNORED
+} element_kind;
+
+typedef enum
+{
+  UNKNOWN_CRITERIA,
+  SUBSCRIBE_CRITERIA,
+  PUBLISH_CRITERIA
+} permission_criteria_type;
+
+typedef enum
+{
+  ALLOW_RULE,
+  DENY_RULE
+} permission_rule_type;
+
+typedef struct element
+{
+  struct element *parent;
+  element_kind kind;
+  struct element *next; /*used in case of string list usage */
+} xml_element;
+
+/* TODO: Change the value nodes for specific nodes for
+ * proper value parsing and validating. */
+
+typedef struct string_value
+{
+  struct element node;
+  char *value;
+} xml_string_value;
+
+typedef struct boolean_value
+{
+  struct element node;
+  bool value;
+} xml_boolean_value;
+
+typedef struct integer_value
+{
+  struct element node;
+  int32_t value;
+} xml_integer_value;
+
+typedef struct protection_kind_value
+{
+  struct element node;
+  DDS_Security_ProtectionKind value;
+} xml_protection_kind_value;
+
+typedef struct basicprotection_kind_value
+{
+  struct element node;
+  DDS_Security_BasicProtectionKind value;
+} xml_basicprotection_kind_value;
+
+typedef struct domain_id_set
+{
+  struct element node;
+  struct integer_value *min;
+  struct integer_value *max;
+} xml_domain_id_set;
+
+typedef struct domains
+{
+  struct element node;
+  struct domain_id_set *domain_id_set; /*linked list*/
+} xml_domains;
+
+typedef struct topic_rule
+{
+  struct element node;
+  struct string_value *topic_expression;
+  struct boolean_value *enable_discovery_protection;
+  struct boolean_value *enable_liveliness_protection;
+  struct boolean_value *enable_read_access_control;
+  struct boolean_value *enable_write_access_control;
+  struct protection_kind_value *metadata_protection_kind;
+  struct basicprotection_kind_value *data_protection_kind;
+} xml_topic_rule;
+
+typedef struct topic_access_rules
+{
+  struct element node;
+  struct topic_rule *topic_rule; /*linked_list*/
+} xml_topic_access_rules;
+
+typedef struct domain_rule
+{
+  struct element node;
+  struct domains *domains;
+  struct boolean_value *allow_unauthenticated_participants;
+  struct boolean_value *enable_join_access_control;
+  struct protection_kind_value *discovery_protection_kind;
+  struct protection_kind_value *liveliness_protection_kind;
+  struct protection_kind_value *rtps_protection_kind;
+  struct topic_access_rules *topic_access_rules;
+} xml_domain_rule;
+
+typedef struct domain_access_rules
+{
+  struct element node;
+  struct domain_rule *domain_rule;
+} xml_domain_access_rules;
+
+typedef struct governance_dds
+{
+  struct element node;
+  struct domain_access_rules *domain_access_rules;
+} xml_governance_dds;
+
+typedef struct governance_parser
+{
+  struct governance_dds *dds;
+  struct element *current;
+} governance_parser;
+
+/* permissions file specific types */
+typedef struct validity
+{
+  struct element node;
+  struct string_value *not_before;
+  struct string_value *not_after;
+} xml_validity;
+
+typedef struct topics
+{
+  struct element node;
+  struct string_value *topic;
+} xml_topics;
+
+typedef struct partitions
+{
+  struct element node;
+  struct string_value *partition;
+} xml_partitions;
+
+typedef struct criteria
+{
+  struct element node;
+  permission_criteria_type criteria_type;
+  struct topics *topics;
+  struct partitions *partitions;
+} xml_criteria;
+
+typedef struct allow_deny_rule
+{
+  struct element node;
+  permission_rule_type rule_type;
+  struct domains *domains;
+  struct criteria *criteria;
+} xml_allow_deny_rule;
+
+typedef struct grant
+{
+  struct element node;
+  char *name;
+  struct string_value *subject_name;
+  struct validity *validity;
+  struct allow_deny_rule *allow_deny_rule;
+  struct string_value *default_action;
+} xml_grant;
+
+typedef struct permissions
+{
+  struct element node;
+  struct grant *grant;
+} xml_permissions;
+
+typedef struct permissions_dds
+{
+  struct element node;
+  struct permissions *permissions;
+} xml_permissions_dds;
+
+typedef struct permissions_parser
+{
+  struct permissions_dds *dds;
+  struct element *current;
+} permissions_parser;
+
+bool ac_parse_governance_xml(const char *xml, struct governance_parser **governance_tree, DDS_Security_SecurityException *ex);
+bool ac_parse_permissions_xml(const char *xml, struct permissions_parser **permissions_tree, DDS_Security_SecurityException *ex);
+void ac_return_governance_tree(struct governance_parser *parser);
+void ac_return_permissions_tree(struct permissions_parser *parser);
+
+#define DDS_SECURITY_DEFAULT_GOVERNANCE "<?xml version=\"1.0\" encoding=\"utf-8\"?> \
+<dds xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" \
+    xsi:noNamespaceSchemaLocation=\"https://www.omg.org/spec/DDS-SECURITY/20170901/omg_shared_ca_governance.xsd\"> \
+    <domain_access_rules>                                                                                               \
+        <domain_rule>                                                                                                   \
+            <domains>                                                                                                   \
+                <!-- All domains -->                                                                                    \
+                <id_range>                                                                                              \
+                    <min>0</min>                                                                                        \
+                    <max>230</max>                                                                                      \
+                </id_range>                                                                                             \
+            </domains>                                                                                                  \
+                                                                                                                        \
+            <allow_unauthenticated_participants>false</allow_unauthenticated_participants>                              \
+            <enable_join_access_control>false</enable_join_access_control>                                               \
+            <discovery_protection_kind>ENCRYPT</discovery_protection_kind>                                              \
+            <liveliness_protection_kind>ENCRYPT</liveliness_protection_kind>                                            \
+            <rtps_protection_kind>NONE</rtps_protection_kind>                                                           \
+            <topic_access_rules>                                                                                        \
+                <topic_rule>                                                                                            \
+                    <topic_expression>*</topic_expression>                                                              \
+                    <enable_liveliness_protection>true</enable_liveliness_protection>                                   \
+                    <enable_discovery_protection>true</enable_discovery_protection>                                     \
+                    <enable_read_access_control>false</enable_read_access_control>                                      \
+                    <enable_write_access_control>false</enable_write_access_control>                                    \
+                    <metadata_protection_kind>ENCRYPT</metadata_protection_kind>                                        \
+                    <data_protection_kind>ENCRYPT</data_protection_kind>                                                \
+                </topic_rule>                                                                                           \
+            </topic_access_rules>                                                                                       \
+        </domain_rule>                                                                                                  \
+    </domain_access_rules>                                                                                              \
+</dds>                                      "
+
+#define DDS_SECURITY_DEFAULT_PERMISSIONS "<?xml version=\"1.0\" encoding=\"utf-8\"?>                                    \
+<dds xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\"                                                            \
+    xsi:noNamespaceSchemaLocation=\"https://www.omg.org/spec/DDS-SECURITY/20170901/omg_shared_ca_permissions.xsd\">      \
+    <permissions>                                                                                                       \
+        <grant name=\"DEFAULT_PERMISSIONS\">                                                                            \
+            <subject_name>DEFAULT_SUBJECT</subject_name>                                                                               \
+            <validity>                                                                                                  \
+                <not_before>2015-09-15T01:00:00</not_before>                                                            \
+                <not_after>2115-09-15T01:00:00</not_after>                                                              \
+            </validity>                                                                                                 \
+            <deny_rule>                                                                                                \
+                <domains>                                                                                               \
+                    <id_range>                                                                                          \
+                        <min>0</min>                                                                                    \
+                        <max>230</max>                                                                                  \
+                    </id_range>                                                                                         \
+                </domains>                                                                                              \
+                <publish>                                                                                               \
+                    <topics>                                                                                            \
+                        <topic>*</topic>                                                                                \
+                    </topics>                                                                                           \
+                    <partitions/>                                                                                       \
+                </publish>                                                                                              \
+                <subscribe>                                                                                             \
+                    <topics>                                                                                            \
+                        <topic>*</topic>                                                                                \
+                    </topics>                                                                                           \
+                    <partitions/>                                                                                       \
+                </subscribe>                                                                                            \
+           </deny_rule>                                                                                                \
+           <default>DENY</default>                                                                                     \
+        </grant>                                                                                                        \
+    </permissions>                                                                                                      \
+</dds>                                  "
+
+#endif /* ACCESS_CONTROL_UTILS_H */
diff --git a/src/security/builtin_plugins/access_control/src/access_control_utils.c b/src/security/builtin_plugins/access_control/src/access_control_utils.c
new file mode 100644
index 0000000..6c56d9e
--- /dev/null
+++ b/src/security/builtin_plugins/access_control/src/access_control_utils.c
@@ -0,0 +1,406 @@
+/*
+ * Copyright(c) 2006 to 2019 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+#include <assert.h>
+#include <stdio.h>
+#include <string.h>
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <openssl/x509.h>
+#include <openssl/pkcs7.h>
+#include <openssl/pem.h>
+#include <openssl/bio.h>
+#include <openssl/err.h>
+#include "dds/ddsrt/heap.h"
+#include "dds/ddsrt/misc.h"
+#include "dds/ddsrt/string.h"
+#include "dds/ddsrt/time.h"
+#include "dds/ddsrt/types.h"
+#include "dds/security/dds_security_api.h"
+#include "dds/security/core/dds_security_utils.h"
+#include "access_control_utils.h"
+
+#define SEQ_ERR -1
+#define SEQ_NOMATCH 0
+#define SEQ_MATCH 1
+
+bool ac_X509_certificate_from_data(const char *data, int len, X509 **x509Cert, DDS_Security_SecurityException *ex)
+{
+  BIO *bio;
+  assert(data);
+  assert(len >= 0);
+  assert(x509Cert);
+
+  /* load certificate in buffer */
+  if ((bio = BIO_new_mem_buf((void *)data, len)) == NULL)
+  {
+    DDS_Security_Exception_set_with_openssl_error(ex, DDS_ACCESS_CONTROL_PLUGIN_CONTEXT, DDS_SECURITY_ERR_ALLOCATION_FAILED_CODE, 0, DDS_SECURITY_ERR_ALLOCATION_FAILED_MESSAGE ": ");
+    return false;
+  }
+  if ((*x509Cert = PEM_read_bio_X509(bio, NULL, NULL, NULL)) == NULL)
+  {
+    DDS_Security_Exception_set_with_openssl_error(ex, DDS_ACCESS_CONTROL_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_CERTIFICATE_CODE, 0, DDS_SECURITY_ERR_INVALID_CERTICICATE_MESSAGE ": ");
+    BIO_free(bio);
+    return false;
+  }
+  BIO_free(bio);
+  return true;
+}
+
+static bool X509_certificate_from_file(const char *filename, X509 **x509Cert, DDS_Security_SecurityException *ex)
+{
+  DDSRT_WARNING_MSVC_OFF(4996);
+  FILE *fp;
+  assert(filename);
+  assert(x509Cert);
+
+  /* Check if this is a valid file by getting its size. */
+  if (ac_regular_file_size(filename) == 0)
+  {
+    DDS_Security_Exception_set(ex, DDS_ACCESS_CONTROL_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_FILE_PATH_CODE, 0, DDS_SECURITY_ERR_INVALID_FILE_PATH_MESSAGE, filename);
+    return false;
+  }
+  if ((fp = fopen(filename, "r")) == NULL)
+  {
+    DDS_Security_Exception_set(ex, DDS_ACCESS_CONTROL_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_FILE_PATH_CODE, 0, DDS_SECURITY_ERR_INVALID_FILE_PATH_MESSAGE, filename);
+    return false;
+  }
+  if ((*x509Cert = PEM_read_X509(fp, NULL, NULL, NULL)) == NULL)
+  {
+    DDS_Security_Exception_set_with_openssl_error(ex, DDS_ACCESS_CONTROL_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_CERTIFICATE_CODE, 0, DDS_SECURITY_ERR_INVALID_CERTICICATE_MESSAGE ": ");
+    fclose(fp);
+    return false;
+  }
+  fclose(fp);
+  return true;
+  DDSRT_WARNING_MSVC_ON(4996);
+}
+
+bool ac_X509_certificate_read(const char *data, X509 **x509Cert, DDS_Security_SecurityException *ex)
+{
+  bool result = false;
+  char *contents = NULL;
+  assert(data);
+  assert(x509Cert);
+
+  switch (DDS_Security_get_conf_item_type(data, &contents))
+  {
+  case DDS_SECURITY_CONFIG_ITEM_PREFIX_FILE:
+    result = X509_certificate_from_file(contents, x509Cert, ex);
+    break;
+  case DDS_SECURITY_CONFIG_ITEM_PREFIX_DATA:
+    result = ac_X509_certificate_from_data(contents, (int)strlen(contents), x509Cert, ex);
+    break;
+  case DDS_SECURITY_CONFIG_ITEM_PREFIX_PKCS11:
+    DDS_Security_Exception_set(
+        ex, DDS_ACCESS_CONTROL_PLUGIN_CONTEXT, DDS_SECURITY_ERR_CERTIFICATE_TYPE_NOT_SUPPORTED_CODE, 0,
+        DDS_SECURITY_ERR_CERTIFICATE_TYPE_NOT_SUPPORTED_MESSAGE " (pkcs11)");
+    break;
+  default:
+    DDS_Security_Exception_set(
+        ex, DDS_ACCESS_CONTROL_PLUGIN_CONTEXT, DDS_SECURITY_ERR_CERTIFICATE_TYPE_NOT_SUPPORTED_CODE, 0,
+        DDS_SECURITY_ERR_CERTIFICATE_TYPE_NOT_SUPPORTED_MESSAGE);
+    break;
+  }
+  ddsrt_free(contents);
+  return result;
+}
+
+char *ac_get_certificate_subject_name(X509 *cert, DDS_Security_SecurityException *ex)
+{
+  X509_NAME *name;
+  BIO *bio;
+  char *subject = NULL;
+  char *pmem;
+  size_t sz;
+  assert(cert);
+  if (!(bio = BIO_new(BIO_s_mem())))
+  {
+    DDS_Security_Exception_set_with_openssl_error(ex, DDS_ACCESS_CONTROL_PLUGIN_CONTEXT, DDS_SECURITY_ERR_ALLOCATION_FAILED_CODE, 0, DDS_SECURITY_ERR_ALLOCATION_FAILED_MESSAGE ": ");
+    goto err_bio_alloc;
+  }
+  if (!(name = X509_get_subject_name(cert)))
+  {
+    DDS_Security_Exception_set_with_openssl_error(ex, DDS_ACCESS_CONTROL_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_SUBJECT_NAME_CODE, 0, DDS_SECURITY_ERR_INVALID_SUBJECT_NAME_MESSAGE ": ");
+    goto err_get_subject;
+  }
+
+  /* TODO: check if this is the correct format of the subject name: check spec */
+  X509_NAME_print_ex(bio, name, 0, XN_FLAG_RFC2253);
+
+  sz = (size_t) BIO_get_mem_data(bio, &pmem);
+  subject = ddsrt_malloc(sz + 1);
+
+  if (BIO_gets(bio, subject, (int)sz + 1) < 0)
+  {
+    DDS_Security_Exception_set_with_openssl_error(ex, DDS_ACCESS_CONTROL_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_SUBJECT_NAME_CODE, 0, DDS_SECURITY_ERR_INVALID_SUBJECT_NAME_MESSAGE ": ");
+    ddsrt_free(subject);
+    subject = NULL;
+  }
+  BIO_free(bio);
+  return subject;
+
+err_get_subject:
+  BIO_free(bio);
+err_bio_alloc:
+  return NULL;
+}
+
+static bool PKCS7_document_from_data(const char *data, size_t len, PKCS7 **p7, BIO **bcont, DDS_Security_SecurityException *ex)
+{
+  BIO *bio;
+  assert(data);
+  assert(p7);
+  assert(bcont);
+
+  *bcont = NULL;
+  assert (len < INT32_MAX);
+  if ((bio = BIO_new_mem_buf((void *)data, (int)len)) == NULL)
+  {
+    DDS_Security_Exception_set_with_openssl_error(ex, DDS_ACCESS_CONTROL_PLUGIN_CONTEXT, DDS_SECURITY_ERR_ALLOCATION_FAILED_CODE, 0, DDS_SECURITY_ERR_ALLOCATION_FAILED_MESSAGE ": ");
+    return false;
+  }
+  if ((*p7 = SMIME_read_PKCS7(bio, bcont)) == NULL)
+  {
+    DDS_Security_Exception_set_with_openssl_error(ex, DDS_ACCESS_CONTROL_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_SMIME_DOCUMENT_CODE, 0, DDS_SECURITY_ERR_INVALID_SMIME_DOCUMENT_MESSAGE ": ");
+    BIO_free(bio);
+    return false;
+  }
+  BIO_free(bio);
+  return true;
+}
+
+static bool PKCS7_document_verify(PKCS7 *p7, X509 *cert, BIO *inbio, BIO **outbio, DDS_Security_SecurityException *ex)
+{
+  bool result = false;
+  X509_STORE *store = NULL;
+
+  assert(p7);
+  assert(cert);
+  assert(inbio);
+  assert(outbio);
+
+  if ((*outbio = BIO_new(BIO_s_mem())) == NULL)
+    DDS_Security_Exception_set_with_openssl_error(ex, DDS_ACCESS_CONTROL_PLUGIN_CONTEXT, DDS_SECURITY_ERR_ALLOCATION_FAILED_CODE, 0, DDS_SECURITY_ERR_ALLOCATION_FAILED_MESSAGE ": ");
+  else if ((store = X509_STORE_new()) == NULL)
+    DDS_Security_Exception_set_with_openssl_error(ex, DDS_ACCESS_CONTROL_PLUGIN_CONTEXT, DDS_SECURITY_ERR_ALLOCATION_FAILED_CODE, 0, DDS_SECURITY_ERR_ALLOCATION_FAILED_MESSAGE ": ");
+  else
+  {
+    X509_STORE_add_cert(store, cert);
+    if (PKCS7_verify(p7, NULL, store, inbio, *outbio, PKCS7_TEXT) != 1)
+      DDS_Security_Exception_set_with_openssl_error(ex, DDS_ACCESS_CONTROL_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_SMIME_DOCUMENT_CODE, 0, DDS_SECURITY_ERR_INVALID_SMIME_DOCUMENT_MESSAGE ": ");
+    else
+      result = true;
+  }
+  if (store)
+    X509_STORE_free(store);
+  if (!result && *outbio)
+  {
+    BIO_free(*outbio);
+    *outbio = NULL;
+  }
+  return result;
+}
+
+bool ac_PKCS7_document_check(const char *data, size_t len, X509 *cert, char **document, DDS_Security_SecurityException *ex)
+{
+  bool result = false;
+  PKCS7 *p7;
+  BIO *bcont, *bdoc;
+  char *pmem;
+  size_t sz;
+
+  assert(data);
+  assert(cert);
+  assert(document);
+
+  if (!PKCS7_document_from_data(data, len, &p7, &bcont, ex))
+    goto err_read_data;
+
+  if (!PKCS7_document_verify(p7, cert, bcont, &bdoc, ex))
+    goto err_verify;
+
+  sz = (size_t) BIO_get_mem_data(bdoc, &pmem);
+  *document = ddsrt_malloc(sz + 1);
+  memcpy(*document, pmem, sz);
+  (*document)[sz] = '\0';
+  result = true;
+  BIO_free(bdoc);
+
+err_verify:
+  PKCS7_free(p7);
+  BIO_free(bcont);
+err_read_data:
+  return result;
+}
+
+static bool string_to_properties(const char *str, DDS_Security_PropertySeq *properties)
+{
+  char *copy = ddsrt_strdup (str), *cursor = copy, *tok;
+  while ((tok = ddsrt_strsep (&cursor, ",/|")) != NULL)
+  {
+    if (strlen(tok) == 0)
+      continue;
+    char *name = ddsrt_strsep (&tok, "=");
+    if (name == NULL || tok == NULL || properties->_length >= properties->_maximum)
+    {
+      ddsrt_free (copy);
+      return false;
+    }
+    properties->_buffer[properties->_length].name = ddsrt_strdup(name);
+    properties->_buffer[properties->_length].value = ddsrt_strdup(tok);
+    properties->_length++;
+  }
+  ddsrt_free (copy);
+  return true;
+}
+
+bool ac_check_subjects_are_equal(const char *permissions_sn, const char *identity_sn)
+{
+  bool result = false;
+  char *copy_idsn = ddsrt_strdup (identity_sn), *cursor_idsn = copy_idsn, *tok_idsn;
+  DDS_Security_PropertySeq prop_pmsn;
+  prop_pmsn._length = 0;
+  prop_pmsn._maximum = 20;
+  prop_pmsn._buffer = ddsrt_malloc(prop_pmsn._maximum * sizeof(DDS_Security_Property_t));
+
+  if (!string_to_properties(permissions_sn, &prop_pmsn))
+    goto check_subj_equal_failed;
+
+  while ((tok_idsn = ddsrt_strsep (&cursor_idsn, ",/|")) != NULL)
+  {
+    char *value_pmsn;
+    char *name_idsn = ddsrt_strsep (&tok_idsn, "=");
+    if (name_idsn == NULL || tok_idsn == NULL)
+      goto check_subj_equal_failed;
+    value_pmsn = DDS_Security_Property_get_value(&prop_pmsn, name_idsn);
+    if (value_pmsn == NULL || strcmp(value_pmsn, value_pmsn) != 0)
+    {
+      ddsrt_free(value_pmsn);
+      goto check_subj_equal_failed;
+    }
+    ddsrt_free(value_pmsn);
+  }
+  result = true;
+
+check_subj_equal_failed:
+  ddsrt_free(copy_idsn);
+  DDS_Security_PropertySeq_deinit(&prop_pmsn);
+  return result;
+}
+
+size_t ac_regular_file_size(const char *filename)
+{
+  if (filename)
+  {
+#if _WIN32
+    struct _stat stat_info;
+    if (_stat (filename, &stat_info) == 0)
+      if (stat_info.st_mode & _S_IFREG)
+        return (size_t) stat_info.st_size;
+#else
+    struct stat stat_info;
+    if (stat (filename, &stat_info) == 0)
+      if (S_ISREG(stat_info.st_mode))
+        return (size_t) stat_info.st_size;
+#endif
+  }
+  return 0;
+}
+
+static int sequencematch(const char *pat, char c, char **new_pat)
+{
+  char patc = *pat;
+  char rpatc;
+  const bool neg = (patc == '!');
+  bool m = false;
+
+  if (neg)
+    ++pat;
+  for (patc = *pat; patc != ']'; pat++)
+  {
+    patc = *pat;
+    if (patc == '\0')
+      return SEQ_ERR;
+    if (*(pat + 1) == '-')
+    {
+      rpatc = *(pat + 2);
+      if (rpatc == '\0' || rpatc == ']')
+        return SEQ_ERR;
+      if ((uint8_t)patc <= (uint8_t)c && (uint8_t)c <= (uint8_t)rpatc)
+        m = true;
+      pat += 2;
+    }
+    else if (patc == c)
+      m = true;
+  }
+  *new_pat = (char *) pat;
+  return (m != neg) ? SEQ_MATCH : SEQ_NOMATCH;
+}
+
+bool ac_fnmatch(const char* pat, const char* str)
+{
+  char patc;
+  bool ret;
+  char *new_pat;
+
+  assert(pat != NULL);
+  assert(str != NULL);
+
+  for (;;)
+  {
+    switch (patc = *pat++)
+    {
+    case '\0':
+      return (*str == '\0');
+    case '?':
+      if (*str == '\0')
+        return false;
+      ++str;
+      break;
+    case '*':
+      patc = *pat;
+      while (patc == '*')
+        patc = *++pat;
+      if (patc == '\0')
+        return true;
+      while (*str != '\0')
+      {
+        ret = ac_fnmatch(pat, str);
+        if (ret)
+          return true;
+        ++str;
+      }
+      return false;
+      break;
+    case '[':
+      if (*str == '\0')
+        return false;
+      switch (sequencematch(pat, *str, &new_pat))
+      {
+      case SEQ_MATCH:
+        pat = new_pat;
+        ++str;
+        break;
+      case SEQ_NOMATCH:
+      case SEQ_ERR:
+        return false;
+      }
+      break;
+    default: /* Regular character */
+      if (*str != patc)
+        return false;
+      str++;
+      break;
+    }
+  }
+}
+
diff --git a/src/security/builtin_plugins/access_control/src/access_control_utils.h b/src/security/builtin_plugins/access_control/src/access_control_utils.h
new file mode 100644
index 0000000..008ab21
--- /dev/null
+++ b/src/security/builtin_plugins/access_control/src/access_control_utils.h
@@ -0,0 +1,30 @@
+/*
+ * Copyright(c) 2006 to 2019 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+#ifndef ACCESS_CONTROL_UTILS_H
+#define ACCESS_CONTROL_UTILS_H
+
+#include <openssl/x509.h>
+#include "dds/ddsrt/types.h"
+#include "dds/security/dds_security_api.h"
+#include "dds/security/export.h"
+
+#define DDS_ACCESS_CONTROL_PLUGIN_CONTEXT "Access Control"
+
+bool ac_X509_certificate_read(const char *data, X509 **x509Cert, DDS_Security_SecurityException *ex);
+bool ac_X509_certificate_from_data(const char *data, int len, X509 **x509Cert, DDS_Security_SecurityException *ex);
+char *ac_get_certificate_subject_name(X509 *cert, DDS_Security_SecurityException *ex);
+bool ac_PKCS7_document_check(const char *data, size_t len, X509 *cert, char **document, DDS_Security_SecurityException *ex);
+bool ac_check_subjects_are_equal(const char *permissions_sn, const char *identity_sn);
+size_t ac_regular_file_size(const char *filename);
+SECURITY_EXPORT bool ac_fnmatch(const char* pattern, const char* string);
+
+#endif /* ACCESS_CONTROL_UTILS_H */
diff --git a/src/security/builtin_plugins/tests/CMakeLists.txt b/src/security/builtin_plugins/tests/CMakeLists.txt
index d3250d0..d822524 100644
--- a/src/security/builtin_plugins/tests/CMakeLists.txt
+++ b/src/security/builtin_plugins/tests/CMakeLists.txt
@@ -23,6 +23,16 @@ set(security_auth_test_sources
     "validate_remote_identity/src/validate_remote_identity_utests.c"
 )
 
+set(security_ac_test_sources
+    "access_control_fnmatch/src/access_control_fnmatch_utests.c"
+    "get_permissions_credential_token/src/get_permissions_credential_token_utests.c"
+    "get_permissions_token/src/get_permissions_token_utests.c"
+    "get_xxx_sec_attributes/src/get_xxx_sec_attributes_utests.c"
+    # "listeners_access_control/src/listeners_access_control_utests.c"
+    "validate_local_permissions/src/validate_local_permissions_utests.c"
+    "validate_remote_permissions/src/validate_remote_permissions_utests.c"
+)
+
 set(security_crypto_test_sources
     "common/src/crypto_helper.c"
     "create_local_datareader_crypto_tokens/src/create_local_datareader_crypto_tokens_utests.c"
@@ -48,9 +58,21 @@ set(security_crypto_test_sources
     "set_remote_participant_crypto_tokens/src/set_remote_participant_crypto_tokens_utests.c"
 )
 
-add_cunit_executable(cunit_security_plugins ${security_auth_test_sources} ${security_crypto_test_sources})
+add_cunit_executable(cunit_security_plugins ${security_auth_test_sources} ${security_ac_test_sources} ${security_crypto_test_sources})
+target_include_directories(
+  cunit_security_plugins PRIVATE
+  "$<BUILD_INTERFACE:${CMAKE_BINARY_DIR}/src/include/>"
+  "$<BUILD_INTERFACE:$<TARGET_PROPERTY:security_api,INTERFACE_INCLUDE_DIRECTORIES>>"
+  "$<BUILD_INTERFACE:$<TARGET_PROPERTY:security_core,INTERFACE_INCLUDE_DIRECTORIES>>"
+  "$<BUILD_INTERFACE:$<TARGET_PROPERTY:ddsrt,INTERFACE_INCLUDE_DIRECTORIES>>"
+  "$<BUILD_INTERFACE:${CMAKE_CURRENT_LIST_DIR}>"
+  "$<BUILD_INTERFACE:${CMAKE_CURRENT_BINARY_DIR}>"
+)
+target_link_libraries(cunit_security_plugins PRIVATE ddsc security_api)
+
 if(OPENSSL_FOUND)
-  target_link_libraries(cunit_security_plugins PRIVATE ddsc dds_security_crypto)
+target_link_libraries(cunit_security_plugins PRIVATE ddsc dds_security_ac)
+target_link_libraries(cunit_security_plugins PRIVATE ddsc dds_security_crypto)
   target_link_libraries(cunit_security_plugins PRIVATE OpenSSL::SSL)
 else()
   message(FATAL_ERROR "To build with openssl support, set ENABLE_OPENSSL to ON")
@@ -58,6 +80,7 @@ endif()
 
 target_include_directories(
   cunit_security_plugins PRIVATE
+      "$<BUILD_INTERFACE:${CMAKE_CURRENT_LIST_DIR}/../access_control/src/>"
       "$<BUILD_INTERFACE:${CMAKE_CURRENT_LIST_DIR}/../cryptographic/src/>"
       "$<BUILD_INTERFACE:$<TARGET_PROPERTY:security_api,INTERFACE_INCLUDE_DIRECTORIES>>"
       "$<BUILD_INTERFACE:$<TARGET_PROPERTY:security_core,INTERFACE_INCLUDE_DIRECTORIES>>"
diff --git a/src/security/builtin_plugins/tests/access_control_fnmatch/src/access_control_fnmatch_utests.c b/src/security/builtin_plugins/tests/access_control_fnmatch/src/access_control_fnmatch_utests.c
new file mode 100644
index 0000000..08568a3
--- /dev/null
+++ b/src/security/builtin_plugins/tests/access_control_fnmatch/src/access_control_fnmatch_utests.c
@@ -0,0 +1,67 @@
+/*
+ * Copyright(c) 2006 to 2019 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+
+#include <stdio.h>
+#include <string.h>
+#include "CUnit/CUnit.h"
+#include "CUnit/Test.h"
+#include "assert.h"
+#include "access_control_utils.h"
+
+
+CU_Test(ddssec_builtin_access_control_fnmatch, basic)
+{
+  CU_ASSERT(ac_fnmatch("", ""));
+  CU_ASSERT(ac_fnmatch("abc", "abc"));
+  CU_ASSERT(!ac_fnmatch("abc", "ab"));
+  CU_ASSERT(!ac_fnmatch("", "a"));
+  CU_ASSERT(!ac_fnmatch("a", ""));
+
+  CU_ASSERT(ac_fnmatch("a?", "ab"));
+  CU_ASSERT(ac_fnmatch("?b", "ab"));
+  CU_ASSERT(ac_fnmatch("a?c", "abc"));
+  CU_ASSERT(!ac_fnmatch("a?", "abc"));
+  CU_ASSERT(!ac_fnmatch("?c", "abc"));
+
+  CU_ASSERT(ac_fnmatch("a*", "a"));
+  CU_ASSERT(ac_fnmatch("a*", "abc"));
+  CU_ASSERT(ac_fnmatch("a*c", "abc"));
+  CU_ASSERT(ac_fnmatch("a*c", "abbc"));
+  CU_ASSERT(ac_fnmatch("*c", "abc"));
+  CU_ASSERT(ac_fnmatch("*c", "c"));
+  CU_ASSERT(!ac_fnmatch("a*", ""));
+  CU_ASSERT(!ac_fnmatch("a*c", "bc"));
+
+  CU_ASSERT(ac_fnmatch("[ab]", "a"));
+  CU_ASSERT(ac_fnmatch("[ab]", "b"));
+  CU_ASSERT(ac_fnmatch("a[bc]", "ab"));
+  CU_ASSERT(ac_fnmatch("a[bc]", "ac"));
+  CU_ASSERT(ac_fnmatch("a[bc]d", "abd"));
+  CU_ASSERT(ac_fnmatch("a[b-d]", "ab"));
+  CU_ASSERT(ac_fnmatch("a[b-d]", "ac"));
+  CU_ASSERT(ac_fnmatch("a[b-d]", "ad"));
+  CU_ASSERT(ac_fnmatch("a[-b]", "ab"));
+  CU_ASSERT(ac_fnmatch("a[!b]", "ac"));
+  CU_ASSERT(ac_fnmatch("a[!bc]d", "aad"));
+  CU_ASSERT(ac_fnmatch("a]", "a]"));
+  CU_ASSERT(!ac_fnmatch("[ab]", "c"));
+  CU_ASSERT(!ac_fnmatch("a[bc]", "ad"));
+  CU_ASSERT(!ac_fnmatch("a[bc]", "abc"));
+  CU_ASSERT(!ac_fnmatch("a[b-]", "ab"));
+  CU_ASSERT(!ac_fnmatch("a[-", "a"));
+  CU_ASSERT(!ac_fnmatch("a[", "a["));
+  CU_ASSERT(!ac_fnmatch("a[-", "a[-"));
+  CU_ASSERT(!ac_fnmatch("a[!b]", "ab"));
+  CU_ASSERT(!ac_fnmatch("a[!bc]d", "abd"));
+  CU_ASSERT(!ac_fnmatch("a[!b-d]", "ac"));
+  CU_ASSERT(!ac_fnmatch("a[!-b]", "ab"));
+}
diff --git a/src/security/builtin_plugins/tests/get_permissions_credential_token/etc/Test_Governance_ok.p7s b/src/security/builtin_plugins/tests/get_permissions_credential_token/etc/Test_Governance_ok.p7s
new file mode 100644
index 0000000..c39903f
--- /dev/null
+++ b/src/security/builtin_plugins/tests/get_permissions_credential_token/etc/Test_Governance_ok.p7s
@@ -0,0 +1,114 @@
+MIME-Version: 1.0
+Content-Type: multipart/signed; protocol="application/x-pkcs7-signature"; micalg="sha-256"; boundary="----DB94A190D9780A24156FB0E8F1E76B5F"
+
+This is an S/MIME signed message
+
+------DB94A190D9780A24156FB0E8F1E76B5F
+Content-Type: text/plain
+
+<?xml version="1.0" encoding="utf-8"?>
+<dds xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xsi:noNamespaceSchemaLocation="http://www.omg.org/spec/DDSSecurity/
+20170801/omg_shared_ca_domain_governance.xsd">
+    <domain_access_rules>
+        <domain_rule>
+            <domains>
+                <!-- All domains -->
+                <id_range>
+                    <min>0</min>
+                    <max>230</max>
+                </id_range>
+            </domains>
+
+            <!-- DomainParticipant that cann not authenticate or fail the authentication should be
+                 allowed to join the domain and see any any discovery data that are configured as "unprotected"
+                 and topics that are configured as "unprotected" -->
+            <allow_unauthenticated_participants>false</allow_unauthenticated_participants>
+
+            <!--  Only and any authenticated DomainParticipant should be allowed to join the domain and
+                  see the discovery data without checking access control  -->
+            <enable_join_access_control>true</enable_join_access_control>
+
+            <!-- Discovery information should be protected with encryption followed by MAC (Message Authentication Codes) -->
+            <discovery_protection_kind>ENCRYPT</discovery_protection_kind>
+
+            <!--  Liveliness messages are also encrypted -->
+            <liveliness_protection_kind>ENCRYPT</liveliness_protection_kind>
+
+            <!-- Whole RTPS message is not protected -->
+            <rtps_protection_kind>NONE</rtps_protection_kind>
+
+            <topic_access_rules>
+                <topic_rule>
+                    <!-- All (non-builtin) topics -->
+                    <topic_expression>*</topic_expression>
+
+                    <!-- Liveliness QoS data is protected -->
+                    <enable_liveliness_protection>true</enable_liveliness_protection>
+
+                    <!-- The discovery information on specific Topics should be sent
+                         using the secure (protected) discovery writers -->
+                    <enable_discovery_protection>true</enable_discovery_protection>
+
+                    <!-- The read access to all topics should be open to all. -->
+                    <enable_read_access_control>false</enable_read_access_control>
+
+                    <!-- The write access to all topics should be open to all. -->
+                    <enable_write_access_control>false</enable_write_access_control>
+
+                    <!-- Whole RTPS sub-message is protected. This includes metadata information
+                         like sequence numbers, heartbeats, key hashes, gaps,
+                         acknowledgment messages, etc. It also includes th possible payload. -->
+                    <metadata_protection_kind>ENCRYPT</metadata_protection_kind>
+
+                    <!-- The payload data sent on the Topic (serialized application level data) should be
+                         protected with Encrypt then MAC. -->
+                    <data_protection_kind>ENCRYPT</data_protection_kind>
+                </topic_rule>
+            </topic_access_rules>
+        </domain_rule>
+    </domain_access_rules>
+</dds>
+
+------DB94A190D9780A24156FB0E8F1E76B5F
+Content-Type: application/x-pkcs7-signature; name="smime.p7s"
+Content-Transfer-Encoding: base64
+Content-Disposition: attachment; filename="smime.p7s"
+
+MIIGSAYJKoZIhvcNAQcCoIIGOTCCBjUCAQExDzANBglghkgBZQMEAgEFADALBgkq
+hkiG9w0BBwGgggORMIIDjTCCAnWgAwIBAgIJANsr3sm0NrypMA0GCSqGSIb3DQEB
+CwUAMFwxCzAJBgNVBAYTAk5MMRMwEQYDVQQIDApTb21lLVN0YXRlMR8wHQYDVQQK
+DBZBRExJTksgVGVjaG5vbG9jeSBJbmMuMRcwFQYDVQQDDA5hZGxpbmt0ZWNoLmNv
+bTAgFw0xODA3MzAxMjQ1NTVaGA8yMTE4MDcwNjEyNDU1NVowXDELMAkGA1UEBhMC
+TkwxEzARBgNVBAgMClNvbWUtU3RhdGUxHzAdBgNVBAoMFkFETElOSyBUZWNobm9s
+b2N5IEluYy4xFzAVBgNVBAMMDmFkbGlua3RlY2guY29tMIIBIjANBgkqhkiG9w0B
+AQEFAAOCAQ8AMIIBCgKCAQEAu7jfnJ0wYVuXgG+PgNawdN38+dRpa8jceqi+blID
+ehV6XCxrnGXusTCDuFmo7HMOBVMVNDXlcBWgoGd+u5EultnOEiIeGTgtHc1O6V9w
+icp3BGSpZZax/TcONjMVORaqHCADbQ2J8wsz1FHxuKDwX6BJElYOlK77lb/x3yLs
+DFFC+a0qn2RFh37rcWBRAHy8VEASXKZElT9ZmfKd+KUq34KojhNJ4DepKStTq074
+BRDXVivx+wVD951LFNPiQXq+mgHcLj1k37KlZflTFhdP5oEMtATNsXNJPHlEymiy
+SogRWAmKhysLQudukHfNKN+r0FEQMk/hzpYcFeZSOvbfNQIDAQABo1AwTjAdBgNV
+HQ4EFgQURWMbWvBKZwJvRV1/tyc1R82k0+gwHwYDVR0jBBgwFoAURWMbWvBKZwJv
+RV1/tyc1R82k0+gwDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAQEAkPF+
+ysVtvHnk2hpu9yNDLCJ96ZzIoKOyY7uRj4ovzlAHFdpNOJQdcJihTmN8i7Trht9X
+Vh0rGoR/6nHzo3TIeiogRC80RlDtuA3PF2dDQBMVDStlZMTZPb693hfjdAjhyyw9
+yghhKHHqNDvSsAL0KfBqjG4yGfGpJylYXIT5fWuKlo/ln/yyPa5s54T5XDo+CMbt
+lLX3QnwVOmaRyzylPiTcPCDIkdLBdXmlfyJcmW6fWa6kPx+35MOxPsXZbujCo+42
++OyLqcH1rKT6XhcshjXBEf+kdgUfSClrM1pNRWsw2ChIYim0F+nry5JFy0Y+8Hbb
+6SDB340BFmtgDHbFHTGCAnswggJ3AgEBMGkwXDELMAkGA1UEBhMCTkwxEzARBgNV
+BAgMClNvbWUtU3RhdGUxHzAdBgNVBAoMFkFETElOSyBUZWNobm9sb2N5IEluYy4x
+FzAVBgNVBAMMDmFkbGlua3RlY2guY29tAgkA2yveybQ2vKkwDQYJYIZIAWUDBAIB
+BQCggeQwGAYJKoZIhvcNAQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG9w0BCQUxDxcN
+MTgwOTEzMDczOTUwWjAvBgkqhkiG9w0BCQQxIgQgXv8DkvlwebXMwHDbNc0/Pc30
+gyG3xWCnwet49TRMWFsweQYJKoZIhvcNAQkPMWwwajALBglghkgBZQMEASowCwYJ
+YIZIAWUDBAEWMAsGCWCGSAFlAwQBAjAKBggqhkiG9w0DBzAOBggqhkiG9w0DAgIC
+AIAwDQYIKoZIhvcNAwICAUAwBwYFKw4DAgcwDQYIKoZIhvcNAwICASgwDQYJKoZI
+hvcNAQEBBQAEggEANy8t0EFmv5j1n0+mMn2ut3Chu8PSJceC8gd34IiKq79uC1O3
+PbL9xgiJ2vz7QiTEEeNL2q+CG77cXOcHGUWa4nvbggr/9CqLfHEKGQxDfyXlJZfM
+8l550xIXRRBOQ7ilOGLD4QJFfbf9XA4rMuRe8WEYN3FleAaYBJag1tMPg1SS6tgA
+BBDM9b1kXHU319zYOk6kZFjlbwHv6XO22SEVRUpXrKudAI8hrGvwksF/+W0S/jS5
+NmYtj/1oMGlCGIaA5rs27H9CkgwrzoMQ3MsR98JlwEUSa4PEe8CClsIziOulQxsp
+MicBlMWL0rzpBPVfPTE4gZ/kP7hGBDEQlRzVTA==
+
+------DB94A190D9780A24156FB0E8F1E76B5F--
+
diff --git a/src/security/builtin_plugins/tests/get_permissions_credential_token/etc/Test_Permissions_ok.p7s b/src/security/builtin_plugins/tests/get_permissions_credential_token/etc/Test_Permissions_ok.p7s
new file mode 100644
index 0000000..052075b
--- /dev/null
+++ b/src/security/builtin_plugins/tests/get_permissions_credential_token/etc/Test_Permissions_ok.p7s
@@ -0,0 +1,85 @@
+MIME-Version: 1.0
+Content-Type: multipart/signed; protocol="application/x-pkcs7-signature"; micalg="sha-256"; boundary="----6B91005B007BBA8EDE10CD1CE487DB27"
+
+This is an S/MIME signed message
+
+------6B91005B007BBA8EDE10CD1CE487DB27
+Content-Type: text/plain
+
+<?xml version="1.0" encoding="utf-8"?>
+<dds xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xsi:noNamespaceSchemaLocation="https://www.omg.org/spec/DDS-SECURITY/20170901/omg_shared_ca_permissions.xsd">
+    <permissions>
+        <grant name="OpenSplicePermissions">
+            <subject_name>CN=CHAM500 cert,O=Internet Widgits Pty Ltd,ST=Some-State,C=NL</subject_name>
+            <validity>
+                <!-- Format is CCYY-MM-DDThh:mm:ss[Z|(+|-)hh:mm] in GMT -->
+                <not_before>2015-09-15T01:00:00</not_before>
+                <not_after>2115-09-15T01:00:00</not_after>
+            </validity>
+            <allow_rule>
+                <domains>
+                    <id_range>
+                        <min>0</min>
+                        <max>230</max>
+                    </id_range>
+                </domains>
+                <publish>
+                    <topics>
+                        <topic>*</topic>
+                    </topics>
+                </publish>
+                <subscribe>
+                    <topics>
+                        <topic>*</topic>
+                    </topics>
+                </subscribe>
+            </allow_rule>
+            <default>DENY</default>
+        </grant>
+    </permissions>
+</dds>
+
+------6B91005B007BBA8EDE10CD1CE487DB27
+Content-Type: application/x-pkcs7-signature; name="smime.p7s"
+Content-Transfer-Encoding: base64
+Content-Disposition: attachment; filename="smime.p7s"
+
+MIIGXgYJKoZIhvcNAQcCoIIGTzCCBksCAQExDzANBglghkgBZQMEAgEFADALBgkq
+hkiG9w0BBwGgggORMIIDjTCCAnWgAwIBAgIJANsr3sm0NrypMA0GCSqGSIb3DQEB
+CwUAMFwxCzAJBgNVBAYTAk5MMRMwEQYDVQQIDApTb21lLVN0YXRlMR8wHQYDVQQK
+DBZBRExJTksgVGVjaG5vbG9jeSBJbmMuMRcwFQYDVQQDDA5hZGxpbmt0ZWNoLmNv
+bTAgFw0xODA3MzAxMjQ1NTVaGA8yMTE4MDcwNjEyNDU1NVowXDELMAkGA1UEBhMC
+TkwxEzARBgNVBAgMClNvbWUtU3RhdGUxHzAdBgNVBAoMFkFETElOSyBUZWNobm9s
+b2N5IEluYy4xFzAVBgNVBAMMDmFkbGlua3RlY2guY29tMIIBIjANBgkqhkiG9w0B
+AQEFAAOCAQ8AMIIBCgKCAQEAu7jfnJ0wYVuXgG+PgNawdN38+dRpa8jceqi+blID
+ehV6XCxrnGXusTCDuFmo7HMOBVMVNDXlcBWgoGd+u5EultnOEiIeGTgtHc1O6V9w
+icp3BGSpZZax/TcONjMVORaqHCADbQ2J8wsz1FHxuKDwX6BJElYOlK77lb/x3yLs
+DFFC+a0qn2RFh37rcWBRAHy8VEASXKZElT9ZmfKd+KUq34KojhNJ4DepKStTq074
+BRDXVivx+wVD951LFNPiQXq+mgHcLj1k37KlZflTFhdP5oEMtATNsXNJPHlEymiy
+SogRWAmKhysLQudukHfNKN+r0FEQMk/hzpYcFeZSOvbfNQIDAQABo1AwTjAdBgNV
+HQ4EFgQURWMbWvBKZwJvRV1/tyc1R82k0+gwHwYDVR0jBBgwFoAURWMbWvBKZwJv
+RV1/tyc1R82k0+gwDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAQEAkPF+
+ysVtvHnk2hpu9yNDLCJ96ZzIoKOyY7uRj4ovzlAHFdpNOJQdcJihTmN8i7Trht9X
+Vh0rGoR/6nHzo3TIeiogRC80RlDtuA3PF2dDQBMVDStlZMTZPb693hfjdAjhyyw9
+yghhKHHqNDvSsAL0KfBqjG4yGfGpJylYXIT5fWuKlo/ln/yyPa5s54T5XDo+CMbt
+lLX3QnwVOmaRyzylPiTcPCDIkdLBdXmlfyJcmW6fWa6kPx+35MOxPsXZbujCo+42
++OyLqcH1rKT6XhcshjXBEf+kdgUfSClrM1pNRWsw2ChIYim0F+nry5JFy0Y+8Hbb
+6SDB340BFmtgDHbFHTGCApEwggKNAgEBMGkwXDELMAkGA1UEBhMCTkwxEzARBgNV
+BAgMClNvbWUtU3RhdGUxHzAdBgNVBAoMFkFETElOSyBUZWNobm9sb2N5IEluYy4x
+FzAVBgNVBAMMDmFkbGlua3RlY2guY29tAgkA2yveybQ2vKkwDQYJYIZIAWUDBAIB
+BQCggfowGAYJKoZIhvcNAQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG9w0BCQUxDxcN
+MTkwMzI5MTMwODAzWjAvBgkqhkiG9w0BCQQxIgQgl3LfUhn9L0vG/3QRPVYptcYw
+/NH5HMN99aMe9JAT+LAwgY4GCSqGSIb3DQEJDzGBgDB+MAsGCWCGSAFlAwQBKjAI
+BgYqhQMCAgkwCAYGKoUDAgIVMAsGCWCGSAFlAwQBFjALBglghkgBZQMEAQIwCgYI
+KoZIhvcNAwcwDgYIKoZIhvcNAwICAgCAMA0GCCqGSIb3DQMCAgFAMAcGBSsOAwIH
+MA0GCCqGSIb3DQMCAgEoMA0GCSqGSIb3DQEBAQUABIIBAHe9vakfXPvbpgMeqlhG
+SW6Z3uVA3Yri9bgQDpJ9daIUsM0/TLBSQVs85twTMXvqUSntKbfSGehxDQ9F+yje
+mOEPMIwxOqcVyc2jpqoYsUWqpwiiZyk49DHUFrOfWJUx+rKdBftZWkxD05Wkovhk
+2d4hGS/65Haoho4Z0AZwcyH+F52FZMiqw7I9FKrPlhxvJfQXmhIjOKtnvWnQ+Ar7
+YYiSrBEHMCy82LF1aKzz0nkL1SYWQHuQX475qoU4LMYY1J8WsD3rSBeq4GYZrl2K
+X/JcOquMYqjfJLMYZY4fsc3FgEBkKNqJz1tDZ3ir24VMl+WsbEjVK8oXe/wt4V0U
+aNQ=
+
+------6B91005B007BBA8EDE10CD1CE487DB27--
+
diff --git a/src/security/builtin_plugins/tests/get_permissions_credential_token/src/get_permissions_credential_token_utests.c b/src/security/builtin_plugins/tests/get_permissions_credential_token/src/get_permissions_credential_token_utests.c
new file mode 100644
index 0000000..bed337f
--- /dev/null
+++ b/src/security/builtin_plugins/tests/get_permissions_credential_token/src/get_permissions_credential_token_utests.c
@@ -0,0 +1,497 @@
+/*
+ * Copyright(c) 2006 to 2019 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+#include <assert.h>
+#include <string.h>
+#include <openssl/evp.h>
+#include <openssl/hmac.h>
+#include <openssl/bio.h>
+#include <openssl/err.h>
+
+#include "dds/ddsrt/environ.h"
+#include "dds/ddsrt/heap.h"
+#include "dds/ddsrt/io.h"
+#include "dds/ddsrt/string.h"
+#include "dds/ddsrt/types.h"
+#include "dds/security/dds_security_api.h"
+#include "dds/security/core/dds_security_utils.h"
+#include "CUnit/CUnit.h"
+#include "CUnit/Test.h"
+#include "common/src/loader.h"
+#include "config_env.h"
+
+static const char *PERMISSIONS_FILE_NAME = "Test_Permissions_ok.p7s";
+static const char *GOVERNANCE_FILE_NAME = "Test_Governance_ok.p7s";
+
+static const char *PROPERTY_IDENTITY_CA = "dds.sec.auth.identity_ca";
+static const char *PROPERTY_PRIVATE_KEY = "dds.sec.auth.private_key";
+static const char *PROPERTY_IDENTITY_CERT = "dds.sec.auth.identity_certificate";
+static const char *PROPERTY_PERMISSIONS_CA = "dds.sec.access.permissions_ca";
+static const char *PROPERTY_PERMISSIONS = "dds.sec.access.permissions";
+static const char *PROPERTY_GOVERNANCE = "dds.sec.access.governance";
+
+static const char *RELATIVE_PATH_TO_ETC_DIR = "/get_permissions_credential_token/etc/";
+
+static const char *IDENTITY_CERTIFICATE =
+    "data:,-----BEGIN CERTIFICATE-----\n"
+    "MIIEQTCCAymgAwIBAgIINpuaAAnrQZIwDQYJKoZIhvcNAQELBQAwXzELMAkGA1UE\n"
+    "BhMCTkwxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdp\n"
+    "ZGdpdHMgUHR5IEx0ZDEYMBYGA1UEAxMPQ0hBTTUwMCByb290IGNhMCAXDTE3MDIy\n"
+    "MjIyMjIwMFoYDzIyMjIwMjIyMjIyMjAwWjBcMQswCQYDVQQGEwJOTDETMBEGA1UE\n"
+    "CBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRk\n"
+    "MRUwEwYDVQQDEwxDSEFNNTAwIGNlcnQwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAw\n"
+    "ggEKAoIBAQDCpVhivH/wBIyu74rvQncnSZqKyspN6CvD1pmV9wft5PHhVt9jV79v\n"
+    "gSub5LADoRHAgFdv9duYgBr17Ob6uRrIY4B18CcrCjhQcC4gjx8y2jl9PeYm+qYD\n"
+    "3o44FYBrBq0QCnrQgKsb/qX9Z+Mw/VUiw65x68W876LEHQQoEgT4kxSuagwBoVRk\n"
+    "ePD6fYAKmT4XS3x+O0v+rHESTcsKF6yMadgp7h3eH1b8kJTzSx8JV9Zzq++mxjox\n"
+    "qhbBVP5nDze2hhSIeCkCvSrx7efkgKS4AQXa5/Z44GiAu1TfXXUqdic9rxwD0edn\n"
+    "ajNElnZe7sjok/0yuqvH+2hSqpNva/zpAgMBAAGjggEAMIH9MAwGA1UdDwQFAwMH\n"
+    "/4AwgewGA1UdJQSB5DCB4QYIKwYBBQUHAwEGCCsGAQUFBwMCBggrBgEFBQcDAwYI\n"
+    "KwYBBQUHAwQGCCsGAQUFBwMIBgorBgEEAYI3AgEVBgorBgEEAYI3AgEWBgorBgEE\n"
+    "AYI3CgMBBgorBgEEAYI3CgMDBgorBgEEAYI3CgMEBglghkgBhvhCBAEGCysGAQQB\n"
+    "gjcKAwQBBggrBgEFBQcDBQYIKwYBBQUHAwYGCCsGAQUFBwMHBggrBgEFBQgCAgYK\n"
+    "KwYBBAGCNxQCAgYIKwYBBQUHAwkGCCsGAQUFBwMNBggrBgEFBQcDDgYHKwYBBQID\n"
+    "BTANBgkqhkiG9w0BAQsFAAOCAQEAawdHy0Xw7nTK2ltp91Ion6fJ7hqYuj///zr7\n"
+    "Adt6uonpDh/xl3esuwcFimIJrJrHujnGkL0nLddRCikmnzuBMNDWS6yq0/Ckl/YG\n"
+    "yjNr44dlX24wo+MVAgkj3/8CyWDZ3a8kBg9QT3bs2SqbjmhTrXN1DRyf9S5vJysE\n"
+    "I7V1gTN66BeKL64hOrAlRVrEu8Ds6TWL6Q/YH+61ViZkoLTeSaPjH4nknaFr4C35\n"
+    "iji0JhkyfRHRRVPHFnaj25AkxOrSV64qVKoTMjDl5fji5iMGtjm6iJ7q05ml/qDl\n"
+    "nLotHXemZNvYhbwUmRzbt4Dls9EMH4VRbP85I94nM5TAvtHVNA==\n"
+    "-----END CERTIFICATE-----\n";
+
+static const char *IDENTITY_CA =
+    "data:,-----BEGIN CERTIFICATE-----\n"
+    "MIIEmTCCA4GgAwIBAgIIZ5gEIUFhO5wwDQYJKoZIhvcNAQELBQAwXzELMAkGA1UE\n"
+    "BhMCTkwxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdp\n"
+    "ZGdpdHMgUHR5IEx0ZDEYMBYGA1UEAxMPQ0hBTTUwMCByb290IGNhMCAXDTE4MDIx\n"
+    "MjE1MDUwMFoYDzIyMjIwMjIyMjIyMjAwWjBfMQswCQYDVQQGEwJOTDETMBEGA1UE\n"
+    "CBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRk\n"
+    "MRgwFgYDVQQDEw9DSEFNNTAwIHJvb3QgY2EwggEiMA0GCSqGSIb3DQEBAQUAA4IB\n"
+    "DwAwggEKAoIBAQC6Fa3TheL+UrdZCp9GhU/2WbneP2t/avUa3muwDttPxeI2XU9k\n"
+    "ZjBR95mAXme4SPXHk5+YDN319AqIje3oKhzky/ngvKH2GkoJKYxWnuDBfMEHdViz\n"
+    "2Q9/xso2ZvH50ukwWa0pfx2/EVV1wRxeQcRd/UVfq3KTJizG0M88mOYvGEAw3LFf\n"
+    "zef7k1aCuOofQmBvLukUudcYpMzfyHFp7lQqU4CcrrR5RtmfiUfrWfdGLea2iPDB\n"
+    "pJgN8ESOMwEHtOTEBDclYnH9L4t7CHQz+fXXS5IWFsDK9fCMQjnxDsDVeNrNzTYL\n"
+    "FaZrMg9S6IUQCEsQWsnq5weS8omOpVLUm9klAgMBAAGjggFVMIIBUTAMBgNVHRME\n"
+    "BTADAQH/MB0GA1UdDgQWBBQg2FZB/j8uWDVnJhjwXkX278znSTAfBgNVHSMEGDAW\n"
+    "gBQg2FZB/j8uWDVnJhjwXkX278znSTAPBgNVHQ8BAf8EBQMDB/+AMIHvBgNVHSUB\n"
+    "Af8EgeQwgeEGCCsGAQUFBwMBBggrBgEFBQcDAgYIKwYBBQUHAwMGCCsGAQUFBwME\n"
+    "BggrBgEFBQcDCAYKKwYBBAGCNwIBFQYKKwYBBAGCNwIBFgYKKwYBBAGCNwoDAQYK\n"
+    "KwYBBAGCNwoDAwYKKwYBBAGCNwoDBAYJYIZIAYb4QgQBBgsrBgEEAYI3CgMEAQYI\n"
+    "KwYBBQUHAwUGCCsGAQUFBwMGBggrBgEFBQcDBwYIKwYBBQUIAgIGCisGAQQBgjcU\n"
+    "AgIGCCsGAQUFBwMJBggrBgEFBQcDDQYIKwYBBQUHAw4GBysGAQUCAwUwDQYJKoZI\n"
+    "hvcNAQELBQADggEBAKHmwejWRwGE1wf1k2rG8SNRV/neGsZ6Qfqf6co3TpR/Wi1s\n"
+    "iZDvSeT/rbqNBS7z34xnG88NIUwu00y78e8Mfon31ZZbK4Uo7fla9/D3ukdJqPQC\n"
+    "LKdbKJjR2kH+KCukY/1rghjJ8/X+t2egBit0LCOdsFCl07Sfksb9kpGUIZSFcYYm\n"
+    "geqhjhoNwxazzHiw+QWHC5HG9248JIizBmy1aymNWuMnPudhjHAnPcsIlqMVNq3t\n"
+    "Rv9ap7S8JeCxHVRPJvJeCwXWvW3dW/v3xH52Yn/fqRblN1w9Fxz5NhopKx0gj/Jd\n"
+    "sw2N4Fk4gaOWEolFpa0bwNw8nAx7moehZpowzfw=\n"
+    "-----END CERTIFICATE-----\n";
+
+static const char *PRIVATE_KEY =
+    "data:,-----BEGIN RSA PRIVATE KEY-----\n"
+    "MIIEogIBAAKCAQEAwqVYYrx/8ASMru+K70J3J0maisrKTegrw9aZlfcH7eTx4Vbf\n"
+    "Y1e/b4Erm+SwA6ERwIBXb/XbmIAa9ezm+rkayGOAdfAnKwo4UHAuII8fMto5fT3m\n"
+    "JvqmA96OOBWAawatEAp60ICrG/6l/WfjMP1VIsOucevFvO+ixB0EKBIE+JMUrmoM\n"
+    "AaFUZHjw+n2ACpk+F0t8fjtL/qxxEk3LChesjGnYKe4d3h9W/JCU80sfCVfWc6vv\n"
+    "psY6MaoWwVT+Zw83toYUiHgpAr0q8e3n5ICkuAEF2uf2eOBogLtU3111KnYnPa8c\n"
+    "A9HnZ2ozRJZ2Xu7I6JP9Mrqrx/toUqqTb2v86QIDAQABAoIBAC1q32DKkx+yMBFx\n"
+    "m32QiLUGG6VfBC2BixS7MkMnzRXZYgcuehl4FBc0kLRjfB6cqsO8LqrVN1QyMBhK\n"
+    "GutN3c38SbE7RChqzhEW2+yE+Mao3Nk4ZEecHLiyaYT0n25ZtHAVwep823BAzwJ+\n"
+    "BykbM45VEpNKbG1VjSktjBa9faNyZiZAEJEjVyla+6R8N4kHV52LbZcLjvJv3IQ2\n"
+    "iPYRrmMyI5C23qTni0vy7yJbAXBo3CqgSlwie9FARBWT7Puu7F4mF1O1c/SnTysw\n"
+    "Tm3e5FzgfHipQbnRVn0w4rDprPMKmPxMnvf/Wkw0zVgNadp1Tc1I6Yj525DEQ07i\n"
+    "2gIn/gECgYEA4jNnY1u2Eu7x3pAQF3dRO0x35boVtuq9iwQk7q+uaZaK4RJRr+0Y\n"
+    "T68S3bPnfer6SHvcxtST89Bvs/j/Ky4SOaX037UYjFh6T7OIzPl+MzO1yb+VOBT6\n"
+    "D6FVGEJGp8ZAITU1OfJPeTYViUeEC8tHFGoKUCk50FbB6jOf1oKtv/ECgYEA3EnB\n"
+    "Y7kSbJJaUuj9ciFUL/pAno86Cim3VjegK1wKgEiyDb610bhoMErovPwfVJbtcttG\n"
+    "eKJNuwizkRcVbj+vpjDvqqaP5eMxLl6/Nd4haPMJYzGo88Z8NJpwFRNF2KEWjOpQ\n"
+    "2NEvoCeRtVulCJyka2Tpljzw8cOXkxhPOe2UhHkCgYBo3entj0QO7QXm56T+LAvV\n"
+    "0PK45xdQEO3EuCwjGAFk5C0IgUSrqeCeeIzniZMltj1IQ1wsNbtNynEu3530t8wt\n"
+    "O7oVyFBUKGSz9IjUdkpClJOPr6kPMfJoMqRPtdIpz+hFPPSrI6IikKdVWHloOlp+\n"
+    "pVaYqTQrWT1XRY2xli3VEQKBgGySmZN6Cx+h/oywswIGdUT0VdcQhq2to+QFpJba\n"
+    "VX6m1cM6hMip2Ag9U3qZ1SNPBBdBBfm9HQybHE3dj713/C2wHuAAGhpXIM1W+20k\n"
+    "X1knuC/AsSH9aQhQOf/ZMOq1crTfZBuI9q0782/sjGmzMsKPySU4QhUWruVb7OiD\n"
+    "NVkZAoGAEvihW7G+8/iOE40vGHyBqUeopAAWLciTAUIEwM/Oi3BYfNWNTWF/FWNc\n"
+    "nMvCZPYigY8C1vO+1iT2Frtd3CIU+f01Q3fJNJoRLlEiKLNZUJRF48OKUqjKSmsi\n"
+    "w6pucFO40z05YW7utApj4L82rZnOS0pd1tUI1yexqvj0i4ThJfk=\n"
+    "-----END RSA PRIVATE KEY-----\n";
+
+static const char *PERMISSIONS_CA =
+    "data:,-----BEGIN CERTIFICATE-----\n"
+    "MIIDjTCCAnWgAwIBAgIJANsr3sm0NrypMA0GCSqGSIb3DQEBCwUAMFwxCzAJBgNV\n"
+    "BAYTAk5MMRMwEQYDVQQIDApTb21lLVN0YXRlMR8wHQYDVQQKDBZBRExJTksgVGVj\n"
+    "aG5vbG9jeSBJbmMuMRcwFQYDVQQDDA5hZGxpbmt0ZWNoLmNvbTAgFw0xODA3MzAx\n"
+    "MjQ1NTVaGA8yMTE4MDcwNjEyNDU1NVowXDELMAkGA1UEBhMCTkwxEzARBgNVBAgM\n"
+    "ClNvbWUtU3RhdGUxHzAdBgNVBAoMFkFETElOSyBUZWNobm9sb2N5IEluYy4xFzAV\n"
+    "BgNVBAMMDmFkbGlua3RlY2guY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB\n"
+    "CgKCAQEAu7jfnJ0wYVuXgG+PgNawdN38+dRpa8jceqi+blIDehV6XCxrnGXusTCD\n"
+    "uFmo7HMOBVMVNDXlcBWgoGd+u5EultnOEiIeGTgtHc1O6V9wicp3BGSpZZax/TcO\n"
+    "NjMVORaqHCADbQ2J8wsz1FHxuKDwX6BJElYOlK77lb/x3yLsDFFC+a0qn2RFh37r\n"
+    "cWBRAHy8VEASXKZElT9ZmfKd+KUq34KojhNJ4DepKStTq074BRDXVivx+wVD951L\n"
+    "FNPiQXq+mgHcLj1k37KlZflTFhdP5oEMtATNsXNJPHlEymiySogRWAmKhysLQudu\n"
+    "kHfNKN+r0FEQMk/hzpYcFeZSOvbfNQIDAQABo1AwTjAdBgNVHQ4EFgQURWMbWvBK\n"
+    "ZwJvRV1/tyc1R82k0+gwHwYDVR0jBBgwFoAURWMbWvBKZwJvRV1/tyc1R82k0+gw\n"
+    "DAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAQEAkPF+ysVtvHnk2hpu9yND\n"
+    "LCJ96ZzIoKOyY7uRj4ovzlAHFdpNOJQdcJihTmN8i7Trht9XVh0rGoR/6nHzo3TI\n"
+    "eiogRC80RlDtuA3PF2dDQBMVDStlZMTZPb693hfjdAjhyyw9yghhKHHqNDvSsAL0\n"
+    "KfBqjG4yGfGpJylYXIT5fWuKlo/ln/yyPa5s54T5XDo+CMbtlLX3QnwVOmaRyzyl\n"
+    "PiTcPCDIkdLBdXmlfyJcmW6fWa6kPx+35MOxPsXZbujCo+42+OyLqcH1rKT6Xhcs\n"
+    "hjXBEf+kdgUfSClrM1pNRWsw2ChIYim0F+nry5JFy0Y+8Hbb6SDB340BFmtgDHbF\n"
+    "HQ==\n"
+    "-----END CERTIFICATE-----\n";
+
+static char *permissions = NULL;
+static char *g_path_to_etc_dir = NULL;
+static struct plugins_hdl *plugins = NULL;
+static dds_security_authentication *auth = NULL;
+static dds_security_access_control *access_control = NULL;
+
+static DDS_Security_IdentityHandle local_identity_handle = DDS_SECURITY_HANDLE_NIL;
+static DDS_Security_PermissionsHandle local_permissions_handle = DDS_SECURITY_HANDLE_NIL;
+
+static void reset_exception(DDS_Security_SecurityException *ex)
+{
+  ex->code = 0;
+  ex->minor_code = 0;
+  ddsrt_free(ex->message);
+  ex->message = NULL;
+}
+
+static DDS_Security_Property_t *find_property(DDS_Security_DataHolder *token, const char *name)
+{
+  DDS_Security_Property_t *result = NULL;
+  uint32_t i;
+
+  for (i = 0; i < token->properties._length && !result; i++)
+    if (token->properties._buffer[i].name && (strcmp(token->properties._buffer[i].name, name) == 0))
+      result = &token->properties._buffer[i];
+  return result;
+}
+
+static void dds_security_property_init(DDS_Security_PropertySeq *seq, DDS_Security_unsigned_long size)
+{
+  seq->_length = size;
+  seq->_maximum = size;
+  seq->_buffer = ddsrt_malloc(size * sizeof(DDS_Security_Property_t));
+  memset(seq->_buffer, 0, size * sizeof(DDS_Security_Property_t));
+}
+
+static void dds_security_property_deinit(DDS_Security_PropertySeq *seq)
+{
+  uint32_t i;
+  for (i = 0; i < seq->_length; i++)
+  {
+    ddsrt_free(seq->_buffer[i].name);
+    ddsrt_free(seq->_buffer[i].value);
+  }
+  ddsrt_free(seq->_buffer);
+}
+
+static char *read_document_from_file(const char *filename)
+{
+  char *document;
+  char *normalized;
+  char *name;
+
+  /* Get proper file name. */
+  ddsrt_asprintf(&name, "%s%s", g_path_to_etc_dir, filename);
+  normalized = DDS_Security_normalize_file(name);
+  ddsrt_free(name);
+  document = load_file_contents(normalized);
+
+  ddsrt_free(normalized);
+
+  return document;
+}
+
+static void fill_participant_qos(DDS_Security_Qos *qos, const char *permission_filename, const char *governance_filename)
+{
+  char *permission_uri;
+  char *governance_uri;
+
+  ddsrt_asprintf(&permission_uri, "file:%s%s", g_path_to_etc_dir, permission_filename);
+  ddsrt_asprintf(&governance_uri, "file:%s%s", g_path_to_etc_dir, governance_filename);
+
+  memset(qos, 0, sizeof(*qos));
+  dds_security_property_init(&qos->property.value, 6);
+  qos->property.value._buffer[0].name = ddsrt_strdup(PROPERTY_IDENTITY_CERT);
+  qos->property.value._buffer[0].value = ddsrt_strdup(IDENTITY_CERTIFICATE);
+  qos->property.value._buffer[1].name = ddsrt_strdup(PROPERTY_IDENTITY_CA);
+  qos->property.value._buffer[1].value = ddsrt_strdup(IDENTITY_CA);
+  qos->property.value._buffer[2].name = ddsrt_strdup(PROPERTY_PRIVATE_KEY);
+  qos->property.value._buffer[2].value = ddsrt_strdup(PRIVATE_KEY);
+  qos->property.value._buffer[3].name = ddsrt_strdup(PROPERTY_PERMISSIONS_CA);
+  qos->property.value._buffer[3].value = ddsrt_strdup(PERMISSIONS_CA);
+  qos->property.value._buffer[4].name = ddsrt_strdup(PROPERTY_PERMISSIONS);
+  qos->property.value._buffer[4].value = ddsrt_strdup(permission_uri);
+  qos->property.value._buffer[5].name = ddsrt_strdup(PROPERTY_GOVERNANCE);
+  qos->property.value._buffer[5].value = ddsrt_strdup(governance_uri);
+
+  ddsrt_free(permission_uri);
+  ddsrt_free(governance_uri);
+}
+
+static int local_permissions_init(DDS_Security_DomainId domain_id)
+{
+  int res = 0;
+  DDS_Security_ValidationResult_t result;
+  DDS_Security_Qos participant_qos;
+  DDS_Security_GUID_t local_participant_guid;
+  DDS_Security_GUID_t candidate_participant_guid;
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  DDS_Security_GuidPrefix_t prefix = {0xb0, 0xb1, 0xb2, 0xb3, 0xb4, 0xb5, 0xb6, 0xb7, 0xb8, 0xb9, 0xba, 0xbb};
+  DDS_Security_EntityId_t entityId = {{0xb0, 0xb1, 0xb2}, 0x1};
+
+  memset(&local_participant_guid, 0, sizeof(local_participant_guid));
+  memcpy(&candidate_participant_guid.prefix, &prefix, sizeof(prefix));
+  memcpy(&candidate_participant_guid.entityId, &entityId, sizeof(entityId));
+
+  fill_participant_qos(&participant_qos, PERMISSIONS_FILE_NAME, GOVERNANCE_FILE_NAME);
+
+  result = auth->validate_local_identity(
+      auth,
+      &local_identity_handle,
+      &local_participant_guid,
+      domain_id,
+      &participant_qos,
+      &candidate_participant_guid,
+      &exception);
+
+  if (result != DDS_SECURITY_VALIDATION_OK)
+  {
+    res = -1;
+    printf("validate_local_identity_failed: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+
+  reset_exception(&exception);
+
+  if (res == 0)
+  {
+    local_permissions_handle = access_control->validate_local_permissions(
+        access_control,
+        auth,
+        local_identity_handle,
+        domain_id,
+        &participant_qos,
+        &exception);
+
+    if (local_permissions_handle == DDS_SECURITY_HANDLE_NIL)
+    {
+      res = -1;
+      printf("validate_local_permissions_failed: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+  }
+
+  reset_exception(&exception);
+
+  dds_security_property_deinit(&participant_qos.property.value);
+
+  return res;
+}
+
+static void local_permissions_clean(void)
+{
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  DDS_Security_boolean success;
+
+  if (local_permissions_handle != DDS_SECURITY_HANDLE_NIL)
+  {
+    success = access_control->return_permissions_handle(access_control, local_permissions_handle, &exception);
+    if (!success)
+    {
+      printf("return_permission_handle failed: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+    reset_exception(&exception);
+  }
+
+  if (local_identity_handle != DDS_SECURITY_HANDLE_NIL)
+  {
+    success = auth->return_identity_handle(auth, local_identity_handle, &exception);
+    if (!success)
+    {
+      printf("return_identity_handle failed: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+    reset_exception(&exception);
+  }
+}
+
+static void set_path_to_etc_dir(void)
+{
+  ddsrt_asprintf(&g_path_to_etc_dir, "%s%s", CONFIG_ENV_TESTS_DIR, RELATIVE_PATH_TO_ETC_DIR);
+}
+
+static void suite_get_permissions_credential_token_init(void)
+{
+  plugins = load_plugins(&access_control, &auth, NULL /* Cryptograpy */);
+  CU_ASSERT_FATAL (plugins != NULL);
+  set_path_to_etc_dir();
+  local_permissions_init(0);
+  permissions = read_document_from_file(PERMISSIONS_FILE_NAME);
+  CU_ASSERT_FATAL (permissions != NULL);
+}
+
+static void suite_get_permissions_credential_token_fini(void)
+{
+  local_permissions_clean();
+  unload_plugins(plugins);
+  ddsrt_free(g_path_to_etc_dir);
+  ddsrt_free(permissions);
+}
+
+static bool validate_permissions_token(DDS_Security_PermissionsCredentialToken *token)
+{
+  DDS_Security_Property_t *property;
+
+  if (!token->class_id || strcmp(token->class_id, "DDS:Access:PermissionsCredential") != 0)
+  {
+    CU_FAIL("PermissionsCredentialToken incorrect class_id");
+    return false;
+  }
+
+  property = find_property(token, "dds.perm.cert");
+  if (property == NULL)
+  {
+    CU_FAIL("PermissionsCredentialToken property 'dds.perm.cert' not found");
+    return false;
+  }
+  if (property->value == NULL)
+  {
+    CU_FAIL("PermissionsCredentialToken property 'dds.perm.cert' does not have a value");
+    return false;
+  }
+  if (strcmp(property->value, permissions) != 0)
+  {
+    CU_FAIL("PermissionsCredentialToken property 'dds.perm.cert' content does not match the permissions file");
+    return false;
+  }
+
+  return true;
+}
+
+CU_Test(ddssec_builtin_get_permissions_credential_token, happy_day, .init = suite_get_permissions_credential_token_init, .fini = suite_get_permissions_credential_token_fini)
+{
+  DDS_Security_PermissionsCredentialToken token;
+  DDS_Security_SecurityException exception;
+  DDS_Security_boolean result;
+
+  /* Pre-requisites. */
+  CU_ASSERT_FATAL(access_control != NULL);
+  CU_ASSERT_FATAL(access_control->get_permissions_credential_token != NULL);
+  memset(&exception, 0, sizeof(DDS_Security_SecurityException));
+  memset(&token, 0, sizeof(token));
+
+  /* Test function call. */
+  result = access_control->get_permissions_credential_token(
+      access_control,
+      &token,
+      local_permissions_handle,
+      &exception);
+  if (!result)
+  {
+    printf("get_permissions_credential_token: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+  CU_ASSERT_FATAL(result);
+  CU_ASSERT(exception.code == 0);
+  CU_ASSERT(exception.message == NULL);
+
+  /* Test token contents. */
+  CU_ASSERT(validate_permissions_token(&token));
+
+  /* Post-requisites. */
+  DDS_Security_DataHolder_deinit(&token);
+  reset_exception(&exception);
+}
+
+CU_Test(ddssec_builtin_get_permissions_credential_token, invalid_args, .init = suite_get_permissions_credential_token_init, .fini = suite_get_permissions_credential_token_fini)
+{
+  DDS_Security_PermissionsCredentialToken token;
+  DDS_Security_SecurityException exception;
+  DDS_Security_boolean result;
+
+  /* Pre-requisites. */
+  CU_ASSERT_FATAL(access_control != NULL);
+  CU_ASSERT_FATAL(access_control->get_permissions_token != NULL);
+  memset(&exception, 0, sizeof(DDS_Security_SecurityException));
+  memset(&token, 0, sizeof(token));
+
+  /* Test function calls with different invalid args. */
+  result = access_control->get_permissions_credential_token(
+      NULL,
+      &token,
+      local_permissions_handle,
+      &exception);
+  if (!result)
+  {
+    printf("get_permissions_token: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+  CU_ASSERT(!result);
+  CU_ASSERT(exception.code == DDS_SECURITY_ERR_INVALID_PARAMETER_CODE);
+  CU_ASSERT(exception.message != NULL);
+  reset_exception(&exception);
+
+  result = access_control->get_permissions_credential_token(
+      access_control,
+      NULL,
+      local_permissions_handle,
+      &exception);
+  if (!result)
+  {
+    printf("get_permissions_credential_token: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+  CU_ASSERT(!result);
+  CU_ASSERT(exception.code == DDS_SECURITY_ERR_INVALID_PARAMETER_CODE);
+  CU_ASSERT(exception.message != NULL);
+  reset_exception(&exception);
+
+  result = access_control->get_permissions_credential_token(
+      access_control,
+      &token,
+      0,
+      &exception);
+  if (!result)
+  {
+    printf("get_permissions_credential_token: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+  CU_ASSERT(!result);
+  CU_ASSERT(exception.code == DDS_SECURITY_ERR_INVALID_PARAMETER_CODE);
+  CU_ASSERT(exception.message != NULL);
+  reset_exception(&exception);
+
+  result = access_control->get_permissions_credential_token(
+      access_control,
+      &token,
+      local_permissions_handle,
+      NULL);
+  if (!result)
+  {
+    printf("get_permissions_credential_token: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+  CU_ASSERT(!result);
+  CU_ASSERT(exception.code == 0);
+  CU_ASSERT(exception.message == NULL);
+  reset_exception(&exception);
+
+  result = access_control->get_permissions_credential_token(
+      access_control,
+      &token,
+      local_permissions_handle + 12345 /* invalid handle */,
+      &exception);
+  if (!result)
+  {
+    printf("get_permissions_credential_token: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+  CU_ASSERT(!result);
+  CU_ASSERT(exception.code == DDS_SECURITY_ERR_INVALID_PARAMETER_CODE);
+  CU_ASSERT(exception.message != NULL);
+  reset_exception(&exception);
+}
+
diff --git a/src/security/builtin_plugins/tests/get_permissions_token/etc/Test_Governance_ok.p7s b/src/security/builtin_plugins/tests/get_permissions_token/etc/Test_Governance_ok.p7s
new file mode 100644
index 0000000..c39903f
--- /dev/null
+++ b/src/security/builtin_plugins/tests/get_permissions_token/etc/Test_Governance_ok.p7s
@@ -0,0 +1,114 @@
+MIME-Version: 1.0
+Content-Type: multipart/signed; protocol="application/x-pkcs7-signature"; micalg="sha-256"; boundary="----DB94A190D9780A24156FB0E8F1E76B5F"
+
+This is an S/MIME signed message
+
+------DB94A190D9780A24156FB0E8F1E76B5F
+Content-Type: text/plain
+
+<?xml version="1.0" encoding="utf-8"?>
+<dds xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xsi:noNamespaceSchemaLocation="http://www.omg.org/spec/DDSSecurity/
+20170801/omg_shared_ca_domain_governance.xsd">
+    <domain_access_rules>
+        <domain_rule>
+            <domains>
+                <!-- All domains -->
+                <id_range>
+                    <min>0</min>
+                    <max>230</max>
+                </id_range>
+            </domains>
+
+            <!-- DomainParticipant that cann not authenticate or fail the authentication should be
+                 allowed to join the domain and see any any discovery data that are configured as "unprotected"
+                 and topics that are configured as "unprotected" -->
+            <allow_unauthenticated_participants>false</allow_unauthenticated_participants>
+
+            <!--  Only and any authenticated DomainParticipant should be allowed to join the domain and
+                  see the discovery data without checking access control  -->
+            <enable_join_access_control>true</enable_join_access_control>
+
+            <!-- Discovery information should be protected with encryption followed by MAC (Message Authentication Codes) -->
+            <discovery_protection_kind>ENCRYPT</discovery_protection_kind>
+
+            <!--  Liveliness messages are also encrypted -->
+            <liveliness_protection_kind>ENCRYPT</liveliness_protection_kind>
+
+            <!-- Whole RTPS message is not protected -->
+            <rtps_protection_kind>NONE</rtps_protection_kind>
+
+            <topic_access_rules>
+                <topic_rule>
+                    <!-- All (non-builtin) topics -->
+                    <topic_expression>*</topic_expression>
+
+                    <!-- Liveliness QoS data is protected -->
+                    <enable_liveliness_protection>true</enable_liveliness_protection>
+
+                    <!-- The discovery information on specific Topics should be sent
+                         using the secure (protected) discovery writers -->
+                    <enable_discovery_protection>true</enable_discovery_protection>
+
+                    <!-- The read access to all topics should be open to all. -->
+                    <enable_read_access_control>false</enable_read_access_control>
+
+                    <!-- The write access to all topics should be open to all. -->
+                    <enable_write_access_control>false</enable_write_access_control>
+
+                    <!-- Whole RTPS sub-message is protected. This includes metadata information
+                         like sequence numbers, heartbeats, key hashes, gaps,
+                         acknowledgment messages, etc. It also includes th possible payload. -->
+                    <metadata_protection_kind>ENCRYPT</metadata_protection_kind>
+
+                    <!-- The payload data sent on the Topic (serialized application level data) should be
+                         protected with Encrypt then MAC. -->
+                    <data_protection_kind>ENCRYPT</data_protection_kind>
+                </topic_rule>
+            </topic_access_rules>
+        </domain_rule>
+    </domain_access_rules>
+</dds>
+
+------DB94A190D9780A24156FB0E8F1E76B5F
+Content-Type: application/x-pkcs7-signature; name="smime.p7s"
+Content-Transfer-Encoding: base64
+Content-Disposition: attachment; filename="smime.p7s"
+
+MIIGSAYJKoZIhvcNAQcCoIIGOTCCBjUCAQExDzANBglghkgBZQMEAgEFADALBgkq
+hkiG9w0BBwGgggORMIIDjTCCAnWgAwIBAgIJANsr3sm0NrypMA0GCSqGSIb3DQEB
+CwUAMFwxCzAJBgNVBAYTAk5MMRMwEQYDVQQIDApTb21lLVN0YXRlMR8wHQYDVQQK
+DBZBRExJTksgVGVjaG5vbG9jeSBJbmMuMRcwFQYDVQQDDA5hZGxpbmt0ZWNoLmNv
+bTAgFw0xODA3MzAxMjQ1NTVaGA8yMTE4MDcwNjEyNDU1NVowXDELMAkGA1UEBhMC
+TkwxEzARBgNVBAgMClNvbWUtU3RhdGUxHzAdBgNVBAoMFkFETElOSyBUZWNobm9s
+b2N5IEluYy4xFzAVBgNVBAMMDmFkbGlua3RlY2guY29tMIIBIjANBgkqhkiG9w0B
+AQEFAAOCAQ8AMIIBCgKCAQEAu7jfnJ0wYVuXgG+PgNawdN38+dRpa8jceqi+blID
+ehV6XCxrnGXusTCDuFmo7HMOBVMVNDXlcBWgoGd+u5EultnOEiIeGTgtHc1O6V9w
+icp3BGSpZZax/TcONjMVORaqHCADbQ2J8wsz1FHxuKDwX6BJElYOlK77lb/x3yLs
+DFFC+a0qn2RFh37rcWBRAHy8VEASXKZElT9ZmfKd+KUq34KojhNJ4DepKStTq074
+BRDXVivx+wVD951LFNPiQXq+mgHcLj1k37KlZflTFhdP5oEMtATNsXNJPHlEymiy
+SogRWAmKhysLQudukHfNKN+r0FEQMk/hzpYcFeZSOvbfNQIDAQABo1AwTjAdBgNV
+HQ4EFgQURWMbWvBKZwJvRV1/tyc1R82k0+gwHwYDVR0jBBgwFoAURWMbWvBKZwJv
+RV1/tyc1R82k0+gwDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAQEAkPF+
+ysVtvHnk2hpu9yNDLCJ96ZzIoKOyY7uRj4ovzlAHFdpNOJQdcJihTmN8i7Trht9X
+Vh0rGoR/6nHzo3TIeiogRC80RlDtuA3PF2dDQBMVDStlZMTZPb693hfjdAjhyyw9
+yghhKHHqNDvSsAL0KfBqjG4yGfGpJylYXIT5fWuKlo/ln/yyPa5s54T5XDo+CMbt
+lLX3QnwVOmaRyzylPiTcPCDIkdLBdXmlfyJcmW6fWa6kPx+35MOxPsXZbujCo+42
++OyLqcH1rKT6XhcshjXBEf+kdgUfSClrM1pNRWsw2ChIYim0F+nry5JFy0Y+8Hbb
+6SDB340BFmtgDHbFHTGCAnswggJ3AgEBMGkwXDELMAkGA1UEBhMCTkwxEzARBgNV
+BAgMClNvbWUtU3RhdGUxHzAdBgNVBAoMFkFETElOSyBUZWNobm9sb2N5IEluYy4x
+FzAVBgNVBAMMDmFkbGlua3RlY2guY29tAgkA2yveybQ2vKkwDQYJYIZIAWUDBAIB
+BQCggeQwGAYJKoZIhvcNAQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG9w0BCQUxDxcN
+MTgwOTEzMDczOTUwWjAvBgkqhkiG9w0BCQQxIgQgXv8DkvlwebXMwHDbNc0/Pc30
+gyG3xWCnwet49TRMWFsweQYJKoZIhvcNAQkPMWwwajALBglghkgBZQMEASowCwYJ
+YIZIAWUDBAEWMAsGCWCGSAFlAwQBAjAKBggqhkiG9w0DBzAOBggqhkiG9w0DAgIC
+AIAwDQYIKoZIhvcNAwICAUAwBwYFKw4DAgcwDQYIKoZIhvcNAwICASgwDQYJKoZI
+hvcNAQEBBQAEggEANy8t0EFmv5j1n0+mMn2ut3Chu8PSJceC8gd34IiKq79uC1O3
+PbL9xgiJ2vz7QiTEEeNL2q+CG77cXOcHGUWa4nvbggr/9CqLfHEKGQxDfyXlJZfM
+8l550xIXRRBOQ7ilOGLD4QJFfbf9XA4rMuRe8WEYN3FleAaYBJag1tMPg1SS6tgA
+BBDM9b1kXHU319zYOk6kZFjlbwHv6XO22SEVRUpXrKudAI8hrGvwksF/+W0S/jS5
+NmYtj/1oMGlCGIaA5rs27H9CkgwrzoMQ3MsR98JlwEUSa4PEe8CClsIziOulQxsp
+MicBlMWL0rzpBPVfPTE4gZ/kP7hGBDEQlRzVTA==
+
+------DB94A190D9780A24156FB0E8F1E76B5F--
+
diff --git a/src/security/builtin_plugins/tests/get_permissions_token/etc/Test_Permissions_ok.p7s b/src/security/builtin_plugins/tests/get_permissions_token/etc/Test_Permissions_ok.p7s
new file mode 100644
index 0000000..052075b
--- /dev/null
+++ b/src/security/builtin_plugins/tests/get_permissions_token/etc/Test_Permissions_ok.p7s
@@ -0,0 +1,85 @@
+MIME-Version: 1.0
+Content-Type: multipart/signed; protocol="application/x-pkcs7-signature"; micalg="sha-256"; boundary="----6B91005B007BBA8EDE10CD1CE487DB27"
+
+This is an S/MIME signed message
+
+------6B91005B007BBA8EDE10CD1CE487DB27
+Content-Type: text/plain
+
+<?xml version="1.0" encoding="utf-8"?>
+<dds xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xsi:noNamespaceSchemaLocation="https://www.omg.org/spec/DDS-SECURITY/20170901/omg_shared_ca_permissions.xsd">
+    <permissions>
+        <grant name="OpenSplicePermissions">
+            <subject_name>CN=CHAM500 cert,O=Internet Widgits Pty Ltd,ST=Some-State,C=NL</subject_name>
+            <validity>
+                <!-- Format is CCYY-MM-DDThh:mm:ss[Z|(+|-)hh:mm] in GMT -->
+                <not_before>2015-09-15T01:00:00</not_before>
+                <not_after>2115-09-15T01:00:00</not_after>
+            </validity>
+            <allow_rule>
+                <domains>
+                    <id_range>
+                        <min>0</min>
+                        <max>230</max>
+                    </id_range>
+                </domains>
+                <publish>
+                    <topics>
+                        <topic>*</topic>
+                    </topics>
+                </publish>
+                <subscribe>
+                    <topics>
+                        <topic>*</topic>
+                    </topics>
+                </subscribe>
+            </allow_rule>
+            <default>DENY</default>
+        </grant>
+    </permissions>
+</dds>
+
+------6B91005B007BBA8EDE10CD1CE487DB27
+Content-Type: application/x-pkcs7-signature; name="smime.p7s"
+Content-Transfer-Encoding: base64
+Content-Disposition: attachment; filename="smime.p7s"
+
+MIIGXgYJKoZIhvcNAQcCoIIGTzCCBksCAQExDzANBglghkgBZQMEAgEFADALBgkq
+hkiG9w0BBwGgggORMIIDjTCCAnWgAwIBAgIJANsr3sm0NrypMA0GCSqGSIb3DQEB
+CwUAMFwxCzAJBgNVBAYTAk5MMRMwEQYDVQQIDApTb21lLVN0YXRlMR8wHQYDVQQK
+DBZBRExJTksgVGVjaG5vbG9jeSBJbmMuMRcwFQYDVQQDDA5hZGxpbmt0ZWNoLmNv
+bTAgFw0xODA3MzAxMjQ1NTVaGA8yMTE4MDcwNjEyNDU1NVowXDELMAkGA1UEBhMC
+TkwxEzARBgNVBAgMClNvbWUtU3RhdGUxHzAdBgNVBAoMFkFETElOSyBUZWNobm9s
+b2N5IEluYy4xFzAVBgNVBAMMDmFkbGlua3RlY2guY29tMIIBIjANBgkqhkiG9w0B
+AQEFAAOCAQ8AMIIBCgKCAQEAu7jfnJ0wYVuXgG+PgNawdN38+dRpa8jceqi+blID
+ehV6XCxrnGXusTCDuFmo7HMOBVMVNDXlcBWgoGd+u5EultnOEiIeGTgtHc1O6V9w
+icp3BGSpZZax/TcONjMVORaqHCADbQ2J8wsz1FHxuKDwX6BJElYOlK77lb/x3yLs
+DFFC+a0qn2RFh37rcWBRAHy8VEASXKZElT9ZmfKd+KUq34KojhNJ4DepKStTq074
+BRDXVivx+wVD951LFNPiQXq+mgHcLj1k37KlZflTFhdP5oEMtATNsXNJPHlEymiy
+SogRWAmKhysLQudukHfNKN+r0FEQMk/hzpYcFeZSOvbfNQIDAQABo1AwTjAdBgNV
+HQ4EFgQURWMbWvBKZwJvRV1/tyc1R82k0+gwHwYDVR0jBBgwFoAURWMbWvBKZwJv
+RV1/tyc1R82k0+gwDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAQEAkPF+
+ysVtvHnk2hpu9yNDLCJ96ZzIoKOyY7uRj4ovzlAHFdpNOJQdcJihTmN8i7Trht9X
+Vh0rGoR/6nHzo3TIeiogRC80RlDtuA3PF2dDQBMVDStlZMTZPb693hfjdAjhyyw9
+yghhKHHqNDvSsAL0KfBqjG4yGfGpJylYXIT5fWuKlo/ln/yyPa5s54T5XDo+CMbt
+lLX3QnwVOmaRyzylPiTcPCDIkdLBdXmlfyJcmW6fWa6kPx+35MOxPsXZbujCo+42
++OyLqcH1rKT6XhcshjXBEf+kdgUfSClrM1pNRWsw2ChIYim0F+nry5JFy0Y+8Hbb
+6SDB340BFmtgDHbFHTGCApEwggKNAgEBMGkwXDELMAkGA1UEBhMCTkwxEzARBgNV
+BAgMClNvbWUtU3RhdGUxHzAdBgNVBAoMFkFETElOSyBUZWNobm9sb2N5IEluYy4x
+FzAVBgNVBAMMDmFkbGlua3RlY2guY29tAgkA2yveybQ2vKkwDQYJYIZIAWUDBAIB
+BQCggfowGAYJKoZIhvcNAQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG9w0BCQUxDxcN
+MTkwMzI5MTMwODAzWjAvBgkqhkiG9w0BCQQxIgQgl3LfUhn9L0vG/3QRPVYptcYw
+/NH5HMN99aMe9JAT+LAwgY4GCSqGSIb3DQEJDzGBgDB+MAsGCWCGSAFlAwQBKjAI
+BgYqhQMCAgkwCAYGKoUDAgIVMAsGCWCGSAFlAwQBFjALBglghkgBZQMEAQIwCgYI
+KoZIhvcNAwcwDgYIKoZIhvcNAwICAgCAMA0GCCqGSIb3DQMCAgFAMAcGBSsOAwIH
+MA0GCCqGSIb3DQMCAgEoMA0GCSqGSIb3DQEBAQUABIIBAHe9vakfXPvbpgMeqlhG
+SW6Z3uVA3Yri9bgQDpJ9daIUsM0/TLBSQVs85twTMXvqUSntKbfSGehxDQ9F+yje
+mOEPMIwxOqcVyc2jpqoYsUWqpwiiZyk49DHUFrOfWJUx+rKdBftZWkxD05Wkovhk
+2d4hGS/65Haoho4Z0AZwcyH+F52FZMiqw7I9FKrPlhxvJfQXmhIjOKtnvWnQ+Ar7
+YYiSrBEHMCy82LF1aKzz0nkL1SYWQHuQX475qoU4LMYY1J8WsD3rSBeq4GYZrl2K
+X/JcOquMYqjfJLMYZY4fsc3FgEBkKNqJz1tDZ3ir24VMl+WsbEjVK8oXe/wt4V0U
+aNQ=
+
+------6B91005B007BBA8EDE10CD1CE487DB27--
+
diff --git a/src/security/builtin_plugins/tests/get_permissions_token/src/get_permissions_token_utests.c b/src/security/builtin_plugins/tests/get_permissions_token/src/get_permissions_token_utests.c
new file mode 100644
index 0000000..ca4f708
--- /dev/null
+++ b/src/security/builtin_plugins/tests/get_permissions_token/src/get_permissions_token_utests.c
@@ -0,0 +1,439 @@
+/*
+ * Copyright(c) 2006 to 2019 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+#include <assert.h>
+#include <openssl/evp.h>
+#include <openssl/hmac.h>
+#include <openssl/bio.h>
+#include <openssl/err.h>
+
+#include "dds/ddsrt/environ.h"
+#include "dds/ddsrt/heap.h"
+#include "dds/ddsrt/io.h"
+#include "dds/ddsrt/string.h"
+#include "dds/ddsrt/types.h"
+#include "dds/security/dds_security_api.h"
+#include "dds/security/core/dds_security_utils.h"
+#include "CUnit/CUnit.h"
+#include "CUnit/Test.h"
+#include "common/src/loader.h"
+#include "config_env.h"
+
+static const char *PROPERTY_IDENTITY_CA = "dds.sec.auth.identity_ca";
+static const char *PROPERTY_PRIVATE_KEY = "dds.sec.auth.private_key";
+static const char *PROPERTY_IDENTITY_CERT = "dds.sec.auth.identity_certificate";
+static const char *PROPERTY_PERMISSIONS_CA = "dds.sec.access.permissions_ca";
+static const char *PROPERTY_PERMISSIONS = "dds.sec.access.permissions";
+static const char *PROPERTY_GOVERNANCE = "dds.sec.access.governance";
+
+static const char *RELATIVE_PATH_TO_ETC_DIR = "/get_permissions_token/etc/";
+
+static const char *IDENTITY_CERTIFICATE =
+    "data:,-----BEGIN CERTIFICATE-----\n"
+    "MIIEQTCCAymgAwIBAgIINpuaAAnrQZIwDQYJKoZIhvcNAQELBQAwXzELMAkGA1UE\n"
+    "BhMCTkwxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdp\n"
+    "ZGdpdHMgUHR5IEx0ZDEYMBYGA1UEAxMPQ0hBTTUwMCByb290IGNhMCAXDTE3MDIy\n"
+    "MjIyMjIwMFoYDzIyMjIwMjIyMjIyMjAwWjBcMQswCQYDVQQGEwJOTDETMBEGA1UE\n"
+    "CBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRk\n"
+    "MRUwEwYDVQQDEwxDSEFNNTAwIGNlcnQwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAw\n"
+    "ggEKAoIBAQDCpVhivH/wBIyu74rvQncnSZqKyspN6CvD1pmV9wft5PHhVt9jV79v\n"
+    "gSub5LADoRHAgFdv9duYgBr17Ob6uRrIY4B18CcrCjhQcC4gjx8y2jl9PeYm+qYD\n"
+    "3o44FYBrBq0QCnrQgKsb/qX9Z+Mw/VUiw65x68W876LEHQQoEgT4kxSuagwBoVRk\n"
+    "ePD6fYAKmT4XS3x+O0v+rHESTcsKF6yMadgp7h3eH1b8kJTzSx8JV9Zzq++mxjox\n"
+    "qhbBVP5nDze2hhSIeCkCvSrx7efkgKS4AQXa5/Z44GiAu1TfXXUqdic9rxwD0edn\n"
+    "ajNElnZe7sjok/0yuqvH+2hSqpNva/zpAgMBAAGjggEAMIH9MAwGA1UdDwQFAwMH\n"
+    "/4AwgewGA1UdJQSB5DCB4QYIKwYBBQUHAwEGCCsGAQUFBwMCBggrBgEFBQcDAwYI\n"
+    "KwYBBQUHAwQGCCsGAQUFBwMIBgorBgEEAYI3AgEVBgorBgEEAYI3AgEWBgorBgEE\n"
+    "AYI3CgMBBgorBgEEAYI3CgMDBgorBgEEAYI3CgMEBglghkgBhvhCBAEGCysGAQQB\n"
+    "gjcKAwQBBggrBgEFBQcDBQYIKwYBBQUHAwYGCCsGAQUFBwMHBggrBgEFBQgCAgYK\n"
+    "KwYBBAGCNxQCAgYIKwYBBQUHAwkGCCsGAQUFBwMNBggrBgEFBQcDDgYHKwYBBQID\n"
+    "BTANBgkqhkiG9w0BAQsFAAOCAQEAawdHy0Xw7nTK2ltp91Ion6fJ7hqYuj///zr7\n"
+    "Adt6uonpDh/xl3esuwcFimIJrJrHujnGkL0nLddRCikmnzuBMNDWS6yq0/Ckl/YG\n"
+    "yjNr44dlX24wo+MVAgkj3/8CyWDZ3a8kBg9QT3bs2SqbjmhTrXN1DRyf9S5vJysE\n"
+    "I7V1gTN66BeKL64hOrAlRVrEu8Ds6TWL6Q/YH+61ViZkoLTeSaPjH4nknaFr4C35\n"
+    "iji0JhkyfRHRRVPHFnaj25AkxOrSV64qVKoTMjDl5fji5iMGtjm6iJ7q05ml/qDl\n"
+    "nLotHXemZNvYhbwUmRzbt4Dls9EMH4VRbP85I94nM5TAvtHVNA==\n"
+    "-----END CERTIFICATE-----\n";
+
+static const char *IDENTITY_CA =
+    "data:,-----BEGIN CERTIFICATE-----\n"
+    "MIIEmTCCA4GgAwIBAgIIZ5gEIUFhO5wwDQYJKoZIhvcNAQELBQAwXzELMAkGA1UE\n"
+    "BhMCTkwxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdp\n"
+    "ZGdpdHMgUHR5IEx0ZDEYMBYGA1UEAxMPQ0hBTTUwMCByb290IGNhMCAXDTE4MDIx\n"
+    "MjE1MDUwMFoYDzIyMjIwMjIyMjIyMjAwWjBfMQswCQYDVQQGEwJOTDETMBEGA1UE\n"
+    "CBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRk\n"
+    "MRgwFgYDVQQDEw9DSEFNNTAwIHJvb3QgY2EwggEiMA0GCSqGSIb3DQEBAQUAA4IB\n"
+    "DwAwggEKAoIBAQC6Fa3TheL+UrdZCp9GhU/2WbneP2t/avUa3muwDttPxeI2XU9k\n"
+    "ZjBR95mAXme4SPXHk5+YDN319AqIje3oKhzky/ngvKH2GkoJKYxWnuDBfMEHdViz\n"
+    "2Q9/xso2ZvH50ukwWa0pfx2/EVV1wRxeQcRd/UVfq3KTJizG0M88mOYvGEAw3LFf\n"
+    "zef7k1aCuOofQmBvLukUudcYpMzfyHFp7lQqU4CcrrR5RtmfiUfrWfdGLea2iPDB\n"
+    "pJgN8ESOMwEHtOTEBDclYnH9L4t7CHQz+fXXS5IWFsDK9fCMQjnxDsDVeNrNzTYL\n"
+    "FaZrMg9S6IUQCEsQWsnq5weS8omOpVLUm9klAgMBAAGjggFVMIIBUTAMBgNVHRME\n"
+    "BTADAQH/MB0GA1UdDgQWBBQg2FZB/j8uWDVnJhjwXkX278znSTAfBgNVHSMEGDAW\n"
+    "gBQg2FZB/j8uWDVnJhjwXkX278znSTAPBgNVHQ8BAf8EBQMDB/+AMIHvBgNVHSUB\n"
+    "Af8EgeQwgeEGCCsGAQUFBwMBBggrBgEFBQcDAgYIKwYBBQUHAwMGCCsGAQUFBwME\n"
+    "BggrBgEFBQcDCAYKKwYBBAGCNwIBFQYKKwYBBAGCNwIBFgYKKwYBBAGCNwoDAQYK\n"
+    "KwYBBAGCNwoDAwYKKwYBBAGCNwoDBAYJYIZIAYb4QgQBBgsrBgEEAYI3CgMEAQYI\n"
+    "KwYBBQUHAwUGCCsGAQUFBwMGBggrBgEFBQcDBwYIKwYBBQUIAgIGCisGAQQBgjcU\n"
+    "AgIGCCsGAQUFBwMJBggrBgEFBQcDDQYIKwYBBQUHAw4GBysGAQUCAwUwDQYJKoZI\n"
+    "hvcNAQELBQADggEBAKHmwejWRwGE1wf1k2rG8SNRV/neGsZ6Qfqf6co3TpR/Wi1s\n"
+    "iZDvSeT/rbqNBS7z34xnG88NIUwu00y78e8Mfon31ZZbK4Uo7fla9/D3ukdJqPQC\n"
+    "LKdbKJjR2kH+KCukY/1rghjJ8/X+t2egBit0LCOdsFCl07Sfksb9kpGUIZSFcYYm\n"
+    "geqhjhoNwxazzHiw+QWHC5HG9248JIizBmy1aymNWuMnPudhjHAnPcsIlqMVNq3t\n"
+    "Rv9ap7S8JeCxHVRPJvJeCwXWvW3dW/v3xH52Yn/fqRblN1w9Fxz5NhopKx0gj/Jd\n"
+    "sw2N4Fk4gaOWEolFpa0bwNw8nAx7moehZpowzfw=\n"
+    "-----END CERTIFICATE-----\n";
+
+static const char *PRIVATE_KEY =
+    "data:,-----BEGIN RSA PRIVATE KEY-----\n"
+    "MIIEogIBAAKCAQEAwqVYYrx/8ASMru+K70J3J0maisrKTegrw9aZlfcH7eTx4Vbf\n"
+    "Y1e/b4Erm+SwA6ERwIBXb/XbmIAa9ezm+rkayGOAdfAnKwo4UHAuII8fMto5fT3m\n"
+    "JvqmA96OOBWAawatEAp60ICrG/6l/WfjMP1VIsOucevFvO+ixB0EKBIE+JMUrmoM\n"
+    "AaFUZHjw+n2ACpk+F0t8fjtL/qxxEk3LChesjGnYKe4d3h9W/JCU80sfCVfWc6vv\n"
+    "psY6MaoWwVT+Zw83toYUiHgpAr0q8e3n5ICkuAEF2uf2eOBogLtU3111KnYnPa8c\n"
+    "A9HnZ2ozRJZ2Xu7I6JP9Mrqrx/toUqqTb2v86QIDAQABAoIBAC1q32DKkx+yMBFx\n"
+    "m32QiLUGG6VfBC2BixS7MkMnzRXZYgcuehl4FBc0kLRjfB6cqsO8LqrVN1QyMBhK\n"
+    "GutN3c38SbE7RChqzhEW2+yE+Mao3Nk4ZEecHLiyaYT0n25ZtHAVwep823BAzwJ+\n"
+    "BykbM45VEpNKbG1VjSktjBa9faNyZiZAEJEjVyla+6R8N4kHV52LbZcLjvJv3IQ2\n"
+    "iPYRrmMyI5C23qTni0vy7yJbAXBo3CqgSlwie9FARBWT7Puu7F4mF1O1c/SnTysw\n"
+    "Tm3e5FzgfHipQbnRVn0w4rDprPMKmPxMnvf/Wkw0zVgNadp1Tc1I6Yj525DEQ07i\n"
+    "2gIn/gECgYEA4jNnY1u2Eu7x3pAQF3dRO0x35boVtuq9iwQk7q+uaZaK4RJRr+0Y\n"
+    "T68S3bPnfer6SHvcxtST89Bvs/j/Ky4SOaX037UYjFh6T7OIzPl+MzO1yb+VOBT6\n"
+    "D6FVGEJGp8ZAITU1OfJPeTYViUeEC8tHFGoKUCk50FbB6jOf1oKtv/ECgYEA3EnB\n"
+    "Y7kSbJJaUuj9ciFUL/pAno86Cim3VjegK1wKgEiyDb610bhoMErovPwfVJbtcttG\n"
+    "eKJNuwizkRcVbj+vpjDvqqaP5eMxLl6/Nd4haPMJYzGo88Z8NJpwFRNF2KEWjOpQ\n"
+    "2NEvoCeRtVulCJyka2Tpljzw8cOXkxhPOe2UhHkCgYBo3entj0QO7QXm56T+LAvV\n"
+    "0PK45xdQEO3EuCwjGAFk5C0IgUSrqeCeeIzniZMltj1IQ1wsNbtNynEu3530t8wt\n"
+    "O7oVyFBUKGSz9IjUdkpClJOPr6kPMfJoMqRPtdIpz+hFPPSrI6IikKdVWHloOlp+\n"
+    "pVaYqTQrWT1XRY2xli3VEQKBgGySmZN6Cx+h/oywswIGdUT0VdcQhq2to+QFpJba\n"
+    "VX6m1cM6hMip2Ag9U3qZ1SNPBBdBBfm9HQybHE3dj713/C2wHuAAGhpXIM1W+20k\n"
+    "X1knuC/AsSH9aQhQOf/ZMOq1crTfZBuI9q0782/sjGmzMsKPySU4QhUWruVb7OiD\n"
+    "NVkZAoGAEvihW7G+8/iOE40vGHyBqUeopAAWLciTAUIEwM/Oi3BYfNWNTWF/FWNc\n"
+    "nMvCZPYigY8C1vO+1iT2Frtd3CIU+f01Q3fJNJoRLlEiKLNZUJRF48OKUqjKSmsi\n"
+    "w6pucFO40z05YW7utApj4L82rZnOS0pd1tUI1yexqvj0i4ThJfk=\n"
+    "-----END RSA PRIVATE KEY-----\n";
+
+static const char *PERMISSIONS_CA =
+    "data:,-----BEGIN CERTIFICATE-----\n"
+    "MIIDjTCCAnWgAwIBAgIJANsr3sm0NrypMA0GCSqGSIb3DQEBCwUAMFwxCzAJBgNV\n"
+    "BAYTAk5MMRMwEQYDVQQIDApTb21lLVN0YXRlMR8wHQYDVQQKDBZBRExJTksgVGVj\n"
+    "aG5vbG9jeSBJbmMuMRcwFQYDVQQDDA5hZGxpbmt0ZWNoLmNvbTAgFw0xODA3MzAx\n"
+    "MjQ1NTVaGA8yMTE4MDcwNjEyNDU1NVowXDELMAkGA1UEBhMCTkwxEzARBgNVBAgM\n"
+    "ClNvbWUtU3RhdGUxHzAdBgNVBAoMFkFETElOSyBUZWNobm9sb2N5IEluYy4xFzAV\n"
+    "BgNVBAMMDmFkbGlua3RlY2guY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB\n"
+    "CgKCAQEAu7jfnJ0wYVuXgG+PgNawdN38+dRpa8jceqi+blIDehV6XCxrnGXusTCD\n"
+    "uFmo7HMOBVMVNDXlcBWgoGd+u5EultnOEiIeGTgtHc1O6V9wicp3BGSpZZax/TcO\n"
+    "NjMVORaqHCADbQ2J8wsz1FHxuKDwX6BJElYOlK77lb/x3yLsDFFC+a0qn2RFh37r\n"
+    "cWBRAHy8VEASXKZElT9ZmfKd+KUq34KojhNJ4DepKStTq074BRDXVivx+wVD951L\n"
+    "FNPiQXq+mgHcLj1k37KlZflTFhdP5oEMtATNsXNJPHlEymiySogRWAmKhysLQudu\n"
+    "kHfNKN+r0FEQMk/hzpYcFeZSOvbfNQIDAQABo1AwTjAdBgNVHQ4EFgQURWMbWvBK\n"
+    "ZwJvRV1/tyc1R82k0+gwHwYDVR0jBBgwFoAURWMbWvBKZwJvRV1/tyc1R82k0+gw\n"
+    "DAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAQEAkPF+ysVtvHnk2hpu9yND\n"
+    "LCJ96ZzIoKOyY7uRj4ovzlAHFdpNOJQdcJihTmN8i7Trht9XVh0rGoR/6nHzo3TI\n"
+    "eiogRC80RlDtuA3PF2dDQBMVDStlZMTZPb693hfjdAjhyyw9yghhKHHqNDvSsAL0\n"
+    "KfBqjG4yGfGpJylYXIT5fWuKlo/ln/yyPa5s54T5XDo+CMbtlLX3QnwVOmaRyzyl\n"
+    "PiTcPCDIkdLBdXmlfyJcmW6fWa6kPx+35MOxPsXZbujCo+42+OyLqcH1rKT6Xhcs\n"
+    "hjXBEf+kdgUfSClrM1pNRWsw2ChIYim0F+nry5JFy0Y+8Hbb6SDB340BFmtgDHbF\n"
+    "HQ==\n"
+    "-----END CERTIFICATE-----\n";
+
+static char *g_path_to_etc_dir = NULL;
+static struct plugins_hdl *plugins = NULL;
+static dds_security_authentication *auth = NULL;
+static dds_security_access_control *access_control = NULL;
+
+static DDS_Security_IdentityHandle local_identity_handle = DDS_SECURITY_HANDLE_NIL;
+static DDS_Security_PermissionsHandle local_permissions_handle = DDS_SECURITY_HANDLE_NIL;
+
+static void reset_exception(DDS_Security_SecurityException *ex)
+{
+  ex->code = 0;
+  ex->minor_code = 0;
+  ddsrt_free(ex->message);
+  ex->message = NULL;
+}
+
+static DDS_Security_Property_t *find_property(DDS_Security_DataHolder *token, const char *name)
+{
+  DDS_Security_Property_t *result = NULL;
+  uint32_t i;
+  for (i = 0; i < token->properties._length && !result; i++)
+    if (token->properties._buffer[i].name && (strcmp(token->properties._buffer[i].name, name) == 0))
+      result = &token->properties._buffer[i];
+  return result;
+}
+
+static void dds_security_property_init(DDS_Security_PropertySeq *seq, DDS_Security_unsigned_long size)
+{
+  seq->_length = size;
+  seq->_maximum = size;
+  seq->_buffer = ddsrt_malloc(size * sizeof(DDS_Security_Property_t));
+  memset(seq->_buffer, 0, size * sizeof(DDS_Security_Property_t));
+}
+
+static void dds_security_property_deinit(DDS_Security_PropertySeq *seq)
+{
+  uint32_t i;
+  for (i = 0; i < seq->_length; i++)
+  {
+    ddsrt_free(seq->_buffer[i].name);
+    ddsrt_free(seq->_buffer[i].value);
+  }
+  ddsrt_free(seq->_buffer);
+}
+
+static void fill_participant_qos(DDS_Security_Qos *qos, const char *permission_filename, const char *governance_filename)
+{
+  char *permission_uri;
+  char *governance_uri;
+
+  ddsrt_asprintf(&permission_uri, "file:%s%s", g_path_to_etc_dir, permission_filename);
+  ddsrt_asprintf(&governance_uri, "file:%s%s", g_path_to_etc_dir, governance_filename);
+
+  memset(qos, 0, sizeof(*qos));
+  dds_security_property_init(&qos->property.value, 6);
+  qos->property.value._buffer[0].name = ddsrt_strdup(PROPERTY_IDENTITY_CERT);
+  qos->property.value._buffer[0].value = ddsrt_strdup(IDENTITY_CERTIFICATE);
+  qos->property.value._buffer[1].name = ddsrt_strdup(PROPERTY_IDENTITY_CA);
+  qos->property.value._buffer[1].value = ddsrt_strdup(IDENTITY_CA);
+  qos->property.value._buffer[2].name = ddsrt_strdup(PROPERTY_PRIVATE_KEY);
+  qos->property.value._buffer[2].value = ddsrt_strdup(PRIVATE_KEY);
+  qos->property.value._buffer[3].name = ddsrt_strdup(PROPERTY_PERMISSIONS_CA);
+  qos->property.value._buffer[3].value = ddsrt_strdup(PERMISSIONS_CA);
+  qos->property.value._buffer[4].name = ddsrt_strdup(PROPERTY_PERMISSIONS);
+  qos->property.value._buffer[4].value = ddsrt_strdup(permission_uri);
+  qos->property.value._buffer[5].name = ddsrt_strdup(PROPERTY_GOVERNANCE);
+  qos->property.value._buffer[5].value = ddsrt_strdup(governance_uri);
+
+  ddsrt_free(permission_uri);
+  ddsrt_free(governance_uri);
+}
+
+static void local_permissions_init(DDS_Security_DomainId domain_id)
+{
+  DDS_Security_ValidationResult_t result;
+  DDS_Security_Qos participant_qos;
+  DDS_Security_GUID_t local_participant_guid;
+  DDS_Security_GUID_t candidate_participant_guid;
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  DDS_Security_GuidPrefix_t prefix = {0xb0, 0xb1, 0xb2, 0xb3, 0xb4, 0xb5, 0xb6, 0xb7, 0xb8, 0xb9, 0xba, 0xbb};
+  DDS_Security_EntityId_t entityId = {{0xb0, 0xb1, 0xb2}, 0x1};
+
+  memset(&local_participant_guid, 0, sizeof(local_participant_guid));
+  memcpy(&candidate_participant_guid.prefix, &prefix, sizeof(prefix));
+  memcpy(&candidate_participant_guid.entityId, &entityId, sizeof(entityId));
+
+  fill_participant_qos(&participant_qos, "Test_Permissions_ok.p7s", "Test_Governance_ok.p7s");
+
+  result = auth->validate_local_identity(
+      auth,
+      &local_identity_handle,
+      &local_participant_guid,
+      domain_id,
+      &participant_qos,
+      &candidate_participant_guid,
+      &exception);
+
+  CU_ASSERT_EQUAL_FATAL (result, DDS_SECURITY_VALIDATION_OK);
+  reset_exception(&exception);
+  local_permissions_handle = access_control->validate_local_permissions(
+      access_control,
+      auth,
+      local_identity_handle,
+      domain_id,
+      &participant_qos,
+      &exception);
+
+  CU_ASSERT_FATAL (local_permissions_handle != DDS_SECURITY_HANDLE_NIL);
+  reset_exception(&exception);
+  dds_security_property_deinit(&participant_qos.property.value);
+}
+
+static void local_permissions_clean(void)
+{
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  DDS_Security_boolean success;
+
+  if (local_permissions_handle != DDS_SECURITY_HANDLE_NIL)
+  {
+    success = access_control->return_permissions_handle(access_control, local_permissions_handle, &exception);
+    if (!success)
+    {
+      printf("return_permission_handle failed: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+    reset_exception(&exception);
+  }
+
+  if (local_identity_handle != DDS_SECURITY_HANDLE_NIL)
+  {
+    success = auth->return_identity_handle(auth, local_identity_handle, &exception);
+    if (!success)
+    {
+      printf("return_identity_handle failed: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+    reset_exception(&exception);
+  }
+}
+
+static void set_path_to_etc_dir(void)
+{
+  ddsrt_asprintf(&g_path_to_etc_dir, "%s%s", CONFIG_ENV_TESTS_DIR, RELATIVE_PATH_TO_ETC_DIR);
+}
+
+static void suite_get_permissions_token_init(void)
+{
+  plugins = load_plugins(&access_control, &auth, NULL /* Cryptograpy */);
+  CU_ASSERT_FATAL (plugins != NULL);
+  set_path_to_etc_dir();
+  local_permissions_init(0);
+}
+
+static void suite_get_permissions_token_fini(void)
+{
+  local_permissions_clean();
+  unload_plugins(plugins);
+  ddsrt_free(g_path_to_etc_dir);
+}
+
+static bool validate_permissions_token(
+    DDS_Security_PermissionsToken *token)
+{
+  if (!token->class_id || strcmp(token->class_id, "DDS:Access:Permissions:1.0") != 0)
+  {
+    CU_FAIL("PermissionsToken incorrect class_id");
+    return false;
+  }
+
+  /* Optional. */
+  if (find_property(token, "dds.perm_ca.sn") == NULL)
+    printf("Optional PermissionsToken property 'dds.perm_ca.sn' not found\n");
+  if (find_property(token, "dds.perm_ca.algo") == NULL)
+    printf("Optional PermissionsToken property 'dds.perm_ca.algo' not found\n");
+  return true;
+}
+
+CU_Test(ddssec_builtin_get_permissions_token, happy_day, .init = suite_get_permissions_token_init, .fini = suite_get_permissions_token_fini)
+{
+  DDS_Security_SecurityException exception;
+  DDS_Security_PermissionsToken token;
+  DDS_Security_boolean result;
+
+  /* Pre-requisites. */
+  CU_ASSERT_FATAL(access_control != NULL);
+  CU_ASSERT_FATAL(access_control->get_permissions_token != NULL);
+  memset(&exception, 0, sizeof(DDS_Security_SecurityException));
+  memset(&token, 0, sizeof(token));
+
+  /* Test function call. */
+  result = access_control->get_permissions_token(
+      access_control,
+      &token,
+      local_permissions_handle,
+      &exception);
+  if (!result)
+  {
+    printf("get_permissions_token: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+  CU_ASSERT_FATAL(result);
+  CU_ASSERT(exception.code == 0);
+  CU_ASSERT(exception.message == NULL);
+
+  /* Test token contents. */
+  CU_ASSERT(validate_permissions_token(&token));
+
+  /* Post-requisites. */
+  DDS_Security_DataHolder_deinit(&token);
+  reset_exception(&exception);
+}
+
+CU_Test(ddssec_builtin_get_permissions_token, invalid_args, .init = suite_get_permissions_token_init, .fini = suite_get_permissions_token_fini)
+{
+  DDS_Security_SecurityException exception;
+  DDS_Security_PermissionsToken token;
+  DDS_Security_boolean result;
+
+  /* Pre-requisites. */
+  CU_ASSERT_FATAL(access_control != NULL);
+  CU_ASSERT_FATAL(access_control->get_permissions_token != NULL);
+  memset(&exception, 0, sizeof(DDS_Security_SecurityException));
+  memset(&token, 0, sizeof(token));
+
+  /* Test function calls with different invalid args. */
+  result = access_control->get_permissions_token(
+      NULL,
+      &token,
+      local_permissions_handle,
+      &exception);
+  if (!result)
+  {
+    printf("get_permissions_token: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+  CU_ASSERT(!result);
+  CU_ASSERT(exception.code == DDS_SECURITY_ERR_INVALID_PARAMETER_CODE);
+  CU_ASSERT(exception.message != NULL);
+  reset_exception(&exception);
+
+  result = access_control->get_permissions_token(
+      access_control,
+      NULL,
+      local_permissions_handle,
+      &exception);
+  if (!result)
+  {
+    printf("get_permissions_token: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+  CU_ASSERT(!result);
+  CU_ASSERT(exception.code == DDS_SECURITY_ERR_INVALID_PARAMETER_CODE);
+  CU_ASSERT(exception.message != NULL);
+  reset_exception(&exception);
+
+  result = access_control->get_permissions_token(
+      access_control,
+      &token,
+      0,
+      &exception);
+  if (!result)
+  {
+    printf("get_permissions_token: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+  CU_ASSERT(!result);
+  CU_ASSERT(exception.code == DDS_SECURITY_ERR_INVALID_PARAMETER_CODE);
+  CU_ASSERT(exception.message != NULL);
+  reset_exception(&exception);
+
+  result = access_control->get_permissions_token(
+      access_control,
+      &token,
+      local_permissions_handle,
+      NULL);
+  if (!result)
+  {
+    printf("get_permissions_token: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+  CU_ASSERT(!result);
+  CU_ASSERT(exception.code == 0);
+  CU_ASSERT(exception.message == NULL);
+  reset_exception(&exception);
+
+  result = access_control->get_permissions_token(
+      access_control,
+      &token,
+      local_permissions_handle + 12345 /* invalid handle */,
+      &exception);
+  if (!result)
+  {
+    printf("get_permissions_token: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+  CU_ASSERT(!result);
+  CU_ASSERT(exception.code == DDS_SECURITY_ERR_INVALID_PARAMETER_CODE);
+  CU_ASSERT(exception.message != NULL);
+  reset_exception(&exception);
+}
diff --git a/src/security/builtin_plugins/tests/get_xxx_sec_attributes/etc/Test_Governance_full.p7s b/src/security/builtin_plugins/tests/get_xxx_sec_attributes/etc/Test_Governance_full.p7s
new file mode 100644
index 0000000..4ea8fe8
--- /dev/null
+++ b/src/security/builtin_plugins/tests/get_xxx_sec_attributes/etc/Test_Governance_full.p7s
@@ -0,0 +1,267 @@
+MIME-Version: 1.0
+Content-Type: multipart/signed; protocol="application/x-pkcs7-signature"; micalg="sha-256"; boundary="----05DBD6F6E587875751A79EAC78048D60"
+
+This is an S/MIME signed message
+
+------05DBD6F6E587875751A79EAC78048D60
+Content-Type: text/plain
+
+<?xml version="1.0" encoding="utf-8"?>
+<dds xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xsi:noNamespaceSchemaLocation="https://www.omg.org/spec/DDS-SECURITY/20170901/omg_shared_ca_governance.xsd">
+    <domain_access_rules>
+        <domain_rule>
+            <domains>
+                <!-- All domains -->
+                <id>20</id>
+                <id_range>
+                    <min>0</min>
+                    <max>23</max>
+                </id_range>
+                <id_range>
+                    <min>100</min>
+                    <max>120</max>
+                </id_range>
+                <id>200</id>
+            </domains>
+
+            <!-- DomainParticipant that cann not authenticate or fail the authentication should be
+                 allowed to join the domain and see any any discovery data that are configured as "unprotected"
+                 and topics that are configured as "unprotected" -->
+            <allow_unauthenticated_participants>false</allow_unauthenticated_participants>
+
+            <!--  Only and any authenticated DomainParticipant should be allowed to join the domain and
+                  see the discovery data without checking access control  -->
+            <enable_join_access_control>TRUE</enable_join_access_control>
+
+            <!-- Discovery information should be protected with encryption followed by MAC (Message Authentication Codes) -->
+            <discovery_protection_kind>SIGN_WITH_ORIGIN_AUTHENTICATION</discovery_protection_kind>
+
+            <!--  Liveliness messages are also encrypted -->
+            <liveliness_protection_kind>ENCRYPT</liveliness_protection_kind>
+
+            <!-- Whole RTPS message is not protected -->
+            <rtps_protection_kind>ENCRYPT_WITH_ORIGIN_AUTHENTICATION</rtps_protection_kind>
+
+            <topic_access_rules>
+                                
+                <topic_rule>
+                    <!-- All (non-builtin) topics -->
+                    <topic_expression>OwnShip?ata</topic_expression>
+
+                    <!-- Liveliness QoS data is protected -->
+                    <enable_liveliness_protection>FALSE</enable_liveliness_protection>
+
+                    <!-- The discovery information on specific Topics should be sent
+                         using the secure (protected) discovery writers -->
+                    <enable_discovery_protection>false</enable_discovery_protection>
+
+                    <!-- The read access to all topics should be open to all. -->
+                    <enable_read_access_control>false</enable_read_access_control>
+
+                    <!-- The write access to all topics should be open to all. -->
+                    <enable_write_access_control>true</enable_write_access_control>
+
+                    <!-- Whole RTPS sub-message is protected. This includes metadata information
+                         like sequence numbers, heartbeats, key hashes, gaps,
+                         acknowledgment messages, etc. It also includes th possible payload. -->
+                    <metadata_protection_kind>SIGN</metadata_protection_kind>
+
+                    <!-- The payload data sent on the Topic (serialized application level data) should be
+                         protected with Encrypt then MAC. -->
+                    <data_protection_kind>ENCRYPT</data_protection_kind>
+                </topic_rule>
+                
+                <topic_rule>
+                    <!-- All (non-builtin) topics -->
+                    <topic_expression>Kinematics</topic_expression>
+
+                    <!-- Liveliness QoS data is protected -->
+                    <enable_liveliness_protection>true</enable_liveliness_protection>
+
+                    <!-- The discovery information on specific Topics should be sent
+                         using the secure (protected) discovery writers -->
+                    <enable_discovery_protection>true</enable_discovery_protection>
+
+                    <!-- The read access to all topics should be open to all. -->
+                    <enable_read_access_control>true</enable_read_access_control>
+
+                    <!-- The write access to all topics should be open to all. -->
+                    <enable_write_access_control>false</enable_write_access_control>
+
+                    <!-- Whole RTPS sub-message is protected. This includes metadata information
+                         like sequence numbers, heartbeats, key hashes, gaps,
+                         acknowledgment messages, etc. It also includes th possible payload. -->
+                    <metadata_protection_kind>NONE</metadata_protection_kind>
+
+                    <!-- The payload data sent on the Topic (serialized application level data) should be
+                         protected with Encrypt then MAC. -->
+                    <data_protection_kind>NONE</data_protection_kind>
+                </topic_rule>
+
+                <topic_rule>
+                    <!-- All (non-builtin) topics -->
+                    <topic_expression>*other</topic_expression>
+
+                    <!-- Liveliness QoS data is protected -->
+                    <enable_liveliness_protection>true</enable_liveliness_protection>
+
+                    <!-- The discovery information on specific Topics should be sent
+                         using the secure (protected) discovery writers -->
+                    <enable_discovery_protection>true</enable_discovery_protection>
+
+                    <!-- The read access to all topics should be open to all. -->
+                    <enable_read_access_control>true</enable_read_access_control>
+
+                    <!-- The write access to all topics should be open to all. -->
+                    <enable_write_access_control>true</enable_write_access_control>
+
+                    <!-- Whole RTPS sub-message is protected. This includes metadata information
+                         like sequence numbers, heartbeats, key hashes, gaps,
+                         acknowledgment messages, etc. It also includes th possible payload. -->
+                    <metadata_protection_kind>NONE</metadata_protection_kind>
+
+                    <!-- The payload data sent on the Topic (serialized application level data) should be
+                         protected with Encrypt then MAC. -->
+                    <data_protection_kind>NONE</data_protection_kind>
+                </topic_rule>
+
+                <topic_rule>
+                    <!-- All (non-builtin) topics -->
+                    <topic_expression>*</topic_expression>
+
+                    <!-- Liveliness QoS data is protected -->
+                    <enable_liveliness_protection>true</enable_liveliness_protection>
+
+                    <!-- The discovery information on specific Topics should be sent
+                         using the secure (protected) discovery writers -->
+                    <enable_discovery_protection>true</enable_discovery_protection>
+
+                    <!-- The read access to all topics should be open to all. -->
+                    <enable_read_access_control>false</enable_read_access_control>
+
+                    <!-- The write access to all topics should be open to all. -->
+                    <enable_write_access_control>false</enable_write_access_control>
+
+                    <!-- Whole RTPS sub-message is protected. This includes metadata information
+                         like sequence numbers, heartbeats, key hashes, gaps,
+                         acknowledgment messages, etc. It also includes th possible payload. -->
+                    <metadata_protection_kind>ENCRYPT_WITH_ORIGIN_AUTHENTICATION</metadata_protection_kind>
+
+                    <!-- The payload data sent on the Topic (serialized application level data) should be
+                         protected with Encrypt then MAC. -->
+                    <data_protection_kind>ENCRYPT</data_protection_kind>
+                </topic_rule>
+            </topic_access_rules>
+        </domain_rule>
+        <domain_rule>
+            <domains>
+                <!-- All domains -->
+                <id_range>
+                    <min>100</min>
+                    <max>120</max>
+                </id_range>
+                <id>20</id>
+                <id_range>
+                    <min>0</min>
+                    <max>23</max>
+                </id_range>                
+                <id>200</id>
+                <id>30</id>
+            </domains>
+
+            <!-- DomainParticipant that cann not authenticate or fail the authentication should be
+                 allowed to join the domain and see any any discovery data that are configured as "unprotected"
+                 and topics that are configured as "unprotected" -->
+            <allow_unauthenticated_participants>1</allow_unauthenticated_participants>
+
+            <!--  Only and any authenticated DomainParticipant should be allowed to join the domain and
+                  see the discovery data without checking access control  -->
+            <enable_join_access_control>0</enable_join_access_control>
+
+            <!-- Discovery information should be protected with encryption followed by MAC (Message Authentication Codes) -->
+            <discovery_protection_kind>SIGN</discovery_protection_kind>
+
+            <!--  Liveliness messages are also encrypted -->
+            <liveliness_protection_kind>ENCRYPT</liveliness_protection_kind>
+
+            <!-- Whole RTPS message is not protected -->
+            <rtps_protection_kind>NONE</rtps_protection_kind>
+
+            <topic_access_rules>
+                <topic_rule>
+                    <!-- All (non-builtin) topics -->
+                    <topic_expression>OwnShipData</topic_expression>
+
+                    <!-- Liveliness QoS data is protected -->
+                    <enable_liveliness_protection>true</enable_liveliness_protection>
+
+                    <!-- The discovery information on specific Topics should be sent
+                         using the secure (protected) discovery writers -->
+                    <enable_discovery_protection>true</enable_discovery_protection>
+
+                    <!-- The read access to all topics should be open to all. -->
+                    <enable_read_access_control>false</enable_read_access_control>
+
+                    <!-- The write access to all topics should be open to all. -->
+                    <enable_write_access_control>false</enable_write_access_control>
+
+                    <!-- Whole RTPS sub-message is protected. This includes metadata information
+                         like sequence numbers, heartbeats, key hashes, gaps,
+                         acknowledgment messages, etc. It also includes th possible payload. -->
+                    <metadata_protection_kind>ENCRYPT_WITH_ORIGIN_AUTHENTICATION</metadata_protection_kind>
+
+                    <!-- The payload data sent on the Topic (serialized application level data) should be
+                         protected with Encrypt then MAC. -->
+                    <data_protection_kind>ENCRYPT</data_protection_kind>
+                </topic_rule>
+                
+           
+            </topic_access_rules>
+        </domain_rule>
+    </domain_access_rules>
+</dds>
+
+------05DBD6F6E587875751A79EAC78048D60
+Content-Type: application/x-pkcs7-signature; name="smime.p7s"
+Content-Transfer-Encoding: base64
+Content-Disposition: attachment; filename="smime.p7s"
+
+MIIGXgYJKoZIhvcNAQcCoIIGTzCCBksCAQExDzANBglghkgBZQMEAgEFADALBgkq
+hkiG9w0BBwGgggORMIIDjTCCAnWgAwIBAgIJANsr3sm0NrypMA0GCSqGSIb3DQEB
+CwUAMFwxCzAJBgNVBAYTAk5MMRMwEQYDVQQIDApTb21lLVN0YXRlMR8wHQYDVQQK
+DBZBRExJTksgVGVjaG5vbG9jeSBJbmMuMRcwFQYDVQQDDA5hZGxpbmt0ZWNoLmNv
+bTAgFw0xODA3MzAxMjQ1NTVaGA8yMTE4MDcwNjEyNDU1NVowXDELMAkGA1UEBhMC
+TkwxEzARBgNVBAgMClNvbWUtU3RhdGUxHzAdBgNVBAoMFkFETElOSyBUZWNobm9s
+b2N5IEluYy4xFzAVBgNVBAMMDmFkbGlua3RlY2guY29tMIIBIjANBgkqhkiG9w0B
+AQEFAAOCAQ8AMIIBCgKCAQEAu7jfnJ0wYVuXgG+PgNawdN38+dRpa8jceqi+blID
+ehV6XCxrnGXusTCDuFmo7HMOBVMVNDXlcBWgoGd+u5EultnOEiIeGTgtHc1O6V9w
+icp3BGSpZZax/TcONjMVORaqHCADbQ2J8wsz1FHxuKDwX6BJElYOlK77lb/x3yLs
+DFFC+a0qn2RFh37rcWBRAHy8VEASXKZElT9ZmfKd+KUq34KojhNJ4DepKStTq074
+BRDXVivx+wVD951LFNPiQXq+mgHcLj1k37KlZflTFhdP5oEMtATNsXNJPHlEymiy
+SogRWAmKhysLQudukHfNKN+r0FEQMk/hzpYcFeZSOvbfNQIDAQABo1AwTjAdBgNV
+HQ4EFgQURWMbWvBKZwJvRV1/tyc1R82k0+gwHwYDVR0jBBgwFoAURWMbWvBKZwJv
+RV1/tyc1R82k0+gwDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAQEAkPF+
+ysVtvHnk2hpu9yNDLCJ96ZzIoKOyY7uRj4ovzlAHFdpNOJQdcJihTmN8i7Trht9X
+Vh0rGoR/6nHzo3TIeiogRC80RlDtuA3PF2dDQBMVDStlZMTZPb693hfjdAjhyyw9
+yghhKHHqNDvSsAL0KfBqjG4yGfGpJylYXIT5fWuKlo/ln/yyPa5s54T5XDo+CMbt
+lLX3QnwVOmaRyzylPiTcPCDIkdLBdXmlfyJcmW6fWa6kPx+35MOxPsXZbujCo+42
++OyLqcH1rKT6XhcshjXBEf+kdgUfSClrM1pNRWsw2ChIYim0F+nry5JFy0Y+8Hbb
+6SDB340BFmtgDHbFHTGCApEwggKNAgEBMGkwXDELMAkGA1UEBhMCTkwxEzARBgNV
+BAgMClNvbWUtU3RhdGUxHzAdBgNVBAoMFkFETElOSyBUZWNobm9sb2N5IEluYy4x
+FzAVBgNVBAMMDmFkbGlua3RlY2guY29tAgkA2yveybQ2vKkwDQYJYIZIAWUDBAIB
+BQCggfowGAYJKoZIhvcNAQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG9w0BCQUxDxcN
+MTkwMzI5MTMwODAzWjAvBgkqhkiG9w0BCQQxIgQg0GyBZYdNlmQT2Nv1CHrUEB6+
+C0U0yXvpmj5+mlGojPAwgY4GCSqGSIb3DQEJDzGBgDB+MAsGCWCGSAFlAwQBKjAI
+BgYqhQMCAgkwCAYGKoUDAgIVMAsGCWCGSAFlAwQBFjALBglghkgBZQMEAQIwCgYI
+KoZIhvcNAwcwDgYIKoZIhvcNAwICAgCAMA0GCCqGSIb3DQMCAgFAMAcGBSsOAwIH
+MA0GCCqGSIb3DQMCAgEoMA0GCSqGSIb3DQEBAQUABIIBAJXrVHO7KdgYM20uGGNL
+P4VRPmYVWoWIkl5/OEzZ8uirs+oGJR7tYLiFl1wzXUzPBB/03qsANmlshDpFgbmV
+thTV7AGRg3SXUDa/cG4N9PupE5VRZaVdbcbdH1DfoIZCLLp4HK3HgqUXkH9vnC92
+tdtgzxZOCrQ4A6WbGiBkWr5LtMWg2lnwPp55vrfRoh6u0qVEumD+VQi+Lroo9M1E
+659LB2dwEcNb1g1HyoodpKlUSsbGsY/JA7bbNrw/KIGVYcoXfmpgWmtzUjfpkPDj
+zVPImqr6jdxP4quGmGWRmrLHPrEYJscJqCwjNTi6naXnAvaE4nxQ4HBgveEodTuP
+8tM=
+
+------05DBD6F6E587875751A79EAC78048D60--
+
diff --git a/src/security/builtin_plugins/tests/get_xxx_sec_attributes/etc/Test_Governance_liveliness_discovery_clear.p7s b/src/security/builtin_plugins/tests/get_xxx_sec_attributes/etc/Test_Governance_liveliness_discovery_clear.p7s
new file mode 100644
index 0000000..3ef33a2
--- /dev/null
+++ b/src/security/builtin_plugins/tests/get_xxx_sec_attributes/etc/Test_Governance_liveliness_discovery_clear.p7s
@@ -0,0 +1,114 @@
+MIME-Version: 1.0
+Content-Type: multipart/signed; protocol="application/x-pkcs7-signature"; micalg="sha-256"; boundary="----D5AADCFDEEF9EC8B0B116AC356AF41CA"
+
+This is an S/MIME signed message
+
+------D5AADCFDEEF9EC8B0B116AC356AF41CA
+Content-Type: text/plain
+
+<?xml version="1.0" encoding="utf-8"?>
+<dds xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xsi:noNamespaceSchemaLocation="https://www.omg.org/spec/DDS-SECURITY/20170901/omg_shared_ca_governance.xsd">
+    <domain_access_rules>
+        <domain_rule>
+            <domains>
+                <!-- All domains -->
+                <id_range>
+                    <min>0</min>
+                    <max>230</max>
+                </id_range>
+            </domains>
+
+            <!-- DomainParticipant that cann not authenticate or fail the authentication should be
+                 allowed to join the domain and see any any discovery data that are configured as "unprotected"
+                 and topics that are configured as "unprotected" -->
+            <allow_unauthenticated_participants>false</allow_unauthenticated_participants>
+
+            <!--  Only and any authenticated DomainParticipant should be allowed to join the domain and
+                  see the discovery data without checking access control  -->
+            <enable_join_access_control>TRUE</enable_join_access_control>
+
+            <!-- Discovery information should be protected with encryption followed by MAC (Message Authentication Codes) -->
+            <discovery_protection_kind>NONE</discovery_protection_kind>
+
+            <!--  Liveliness messages are also encrypted -->
+            <liveliness_protection_kind>NONE</liveliness_protection_kind>
+
+            <!-- Whole RTPS message is not protected -->
+            <rtps_protection_kind>NONE</rtps_protection_kind>
+
+            <topic_access_rules>
+                <topic_rule>
+                    <!-- All (non-builtin) topics -->
+                    <topic_expression>*</topic_expression>
+
+                    <!-- Liveliness QoS data is protected -->
+                    <enable_liveliness_protection>FALSE</enable_liveliness_protection>
+
+                    <!-- The discovery information on specific Topics should be sent
+                         using the secure (protected) discovery writers -->
+                    <enable_discovery_protection>false</enable_discovery_protection>
+
+                    <!-- The read access to all topics should be open to all. -->
+                    <enable_read_access_control>false</enable_read_access_control>
+
+                    <!-- The write access to all topics should be open to all. -->
+                    <enable_write_access_control>false</enable_write_access_control>
+
+                    <!-- Whole RTPS sub-message is protected. This includes metadata information
+                         like sequence numbers, heartbeats, key hashes, gaps,
+                         acknowledgment messages, etc. It also includes th possible payload. -->
+                    <metadata_protection_kind>NONE</metadata_protection_kind>
+
+                    <!-- The payload data sent on the Topic (serialized application level data) should be
+                         protected with Encrypt then MAC. -->
+                    <data_protection_kind>NONE</data_protection_kind>
+                </topic_rule>
+            </topic_access_rules>
+        </domain_rule>
+    </domain_access_rules>
+</dds>
+
+------D5AADCFDEEF9EC8B0B116AC356AF41CA
+Content-Type: application/x-pkcs7-signature; name="smime.p7s"
+Content-Transfer-Encoding: base64
+Content-Disposition: attachment; filename="smime.p7s"
+
+MIIGXgYJKoZIhvcNAQcCoIIGTzCCBksCAQExDzANBglghkgBZQMEAgEFADALBgkq
+hkiG9w0BBwGgggORMIIDjTCCAnWgAwIBAgIJANsr3sm0NrypMA0GCSqGSIb3DQEB
+CwUAMFwxCzAJBgNVBAYTAk5MMRMwEQYDVQQIDApTb21lLVN0YXRlMR8wHQYDVQQK
+DBZBRExJTksgVGVjaG5vbG9jeSBJbmMuMRcwFQYDVQQDDA5hZGxpbmt0ZWNoLmNv
+bTAgFw0xODA3MzAxMjQ1NTVaGA8yMTE4MDcwNjEyNDU1NVowXDELMAkGA1UEBhMC
+TkwxEzARBgNVBAgMClNvbWUtU3RhdGUxHzAdBgNVBAoMFkFETElOSyBUZWNobm9s
+b2N5IEluYy4xFzAVBgNVBAMMDmFkbGlua3RlY2guY29tMIIBIjANBgkqhkiG9w0B
+AQEFAAOCAQ8AMIIBCgKCAQEAu7jfnJ0wYVuXgG+PgNawdN38+dRpa8jceqi+blID
+ehV6XCxrnGXusTCDuFmo7HMOBVMVNDXlcBWgoGd+u5EultnOEiIeGTgtHc1O6V9w
+icp3BGSpZZax/TcONjMVORaqHCADbQ2J8wsz1FHxuKDwX6BJElYOlK77lb/x3yLs
+DFFC+a0qn2RFh37rcWBRAHy8VEASXKZElT9ZmfKd+KUq34KojhNJ4DepKStTq074
+BRDXVivx+wVD951LFNPiQXq+mgHcLj1k37KlZflTFhdP5oEMtATNsXNJPHlEymiy
+SogRWAmKhysLQudukHfNKN+r0FEQMk/hzpYcFeZSOvbfNQIDAQABo1AwTjAdBgNV
+HQ4EFgQURWMbWvBKZwJvRV1/tyc1R82k0+gwHwYDVR0jBBgwFoAURWMbWvBKZwJv
+RV1/tyc1R82k0+gwDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAQEAkPF+
+ysVtvHnk2hpu9yNDLCJ96ZzIoKOyY7uRj4ovzlAHFdpNOJQdcJihTmN8i7Trht9X
+Vh0rGoR/6nHzo3TIeiogRC80RlDtuA3PF2dDQBMVDStlZMTZPb693hfjdAjhyyw9
+yghhKHHqNDvSsAL0KfBqjG4yGfGpJylYXIT5fWuKlo/ln/yyPa5s54T5XDo+CMbt
+lLX3QnwVOmaRyzylPiTcPCDIkdLBdXmlfyJcmW6fWa6kPx+35MOxPsXZbujCo+42
++OyLqcH1rKT6XhcshjXBEf+kdgUfSClrM1pNRWsw2ChIYim0F+nry5JFy0Y+8Hbb
+6SDB340BFmtgDHbFHTGCApEwggKNAgEBMGkwXDELMAkGA1UEBhMCTkwxEzARBgNV
+BAgMClNvbWUtU3RhdGUxHzAdBgNVBAoMFkFETElOSyBUZWNobm9sb2N5IEluYy4x
+FzAVBgNVBAMMDmFkbGlua3RlY2guY29tAgkA2yveybQ2vKkwDQYJYIZIAWUDBAIB
+BQCggfowGAYJKoZIhvcNAQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG9w0BCQUxDxcN
+MTkwMzI5MTMwODAzWjAvBgkqhkiG9w0BCQQxIgQg1l4l1hEFvxsjc65MThWHhvCb
+YoBySw0UQA61LL+lSsEwgY4GCSqGSIb3DQEJDzGBgDB+MAsGCWCGSAFlAwQBKjAI
+BgYqhQMCAgkwCAYGKoUDAgIVMAsGCWCGSAFlAwQBFjALBglghkgBZQMEAQIwCgYI
+KoZIhvcNAwcwDgYIKoZIhvcNAwICAgCAMA0GCCqGSIb3DQMCAgFAMAcGBSsOAwIH
+MA0GCCqGSIb3DQMCAgEoMA0GCSqGSIb3DQEBAQUABIIBAF88Gg525eeqmgAtBky5
+lMnQehnA0c37pSL5uTklEcb0xwkQcdWQVerkAwKQb8CJGz4ttwvVqIde2Jn8boJP
+Tb8xYvk38HXFHOpzSEv0qAj0u6dVB+go3OnrdhcM1R7jrHfReBRgnict8pLOPb+Y
+khdlqzOMVxoTpJSiXUWdt5ucKbNvuWROG6TsNs4S5+lJ3EEvDn3++g32VRX9V3h4
+5Hni4AMGmZrjBbmL/S02iR33ltwXYqfipUQjR5S5V/HS0LHX/mjYwuiWCtHNiSIi
+s+8mqW8vNebYA9LeK7bvWXCygqnVr3qJT+ryeXUXtBl7dCTV+QVAlUzbW1wgHSuq
+wtc=
+
+------D5AADCFDEEF9EC8B0B116AC356AF41CA--
+
diff --git a/src/security/builtin_plugins/tests/get_xxx_sec_attributes/etc/Test_Governance_liveliness_discovery_clear.xml b/src/security/builtin_plugins/tests/get_xxx_sec_attributes/etc/Test_Governance_liveliness_discovery_clear.xml
new file mode 100644
index 0000000..e829911
--- /dev/null
+++ b/src/security/builtin_plugins/tests/get_xxx_sec_attributes/etc/Test_Governance_liveliness_discovery_clear.xml
@@ -0,0 +1,62 @@
+<?xml version="1.0" encoding="utf-8"?>
+<dds xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xsi:noNamespaceSchemaLocation="https://www.omg.org/spec/DDS-SECURITY/20170901/omg_shared_ca_governance.xsd">
+    <domain_access_rules>
+        <domain_rule>
+            <domains>
+                <!-- All domains -->
+                <id_range>
+                    <min>0</min>
+                    <max>230</max>
+                </id_range>
+            </domains>
+
+            <!-- DomainParticipant that cann not authenticate or fail the authentication should be
+                 allowed to join the domain and see any any discovery data that are configured as "unprotected"
+                 and topics that are configured as "unprotected" -->
+            <allow_unauthenticated_participants>false</allow_unauthenticated_participants>
+
+            <!--  Only and any authenticated DomainParticipant should be allowed to join the domain and
+                  see the discovery data without checking access control  -->
+            <enable_join_access_control>TRUE</enable_join_access_control>
+
+            <!-- Discovery information should be protected with encryption followed by MAC (Message Authentication Codes) -->
+            <discovery_protection_kind>NONE</discovery_protection_kind>
+
+            <!--  Liveliness messages are also encrypted -->
+            <liveliness_protection_kind>NONE</liveliness_protection_kind>
+
+            <!-- Whole RTPS message is not protected -->
+            <rtps_protection_kind>NONE</rtps_protection_kind>
+
+            <topic_access_rules>
+                <topic_rule>
+                    <!-- All (non-builtin) topics -->
+                    <topic_expression>*</topic_expression>
+
+                    <!-- Liveliness QoS data is protected -->
+                    <enable_liveliness_protection>FALSE</enable_liveliness_protection>
+
+                    <!-- The discovery information on specific Topics should be sent
+                         using the secure (protected) discovery writers -->
+                    <enable_discovery_protection>false</enable_discovery_protection>
+
+                    <!-- The read access to all topics should be open to all. -->
+                    <enable_read_access_control>false</enable_read_access_control>
+
+                    <!-- The write access to all topics should be open to all. -->
+                    <enable_write_access_control>false</enable_write_access_control>
+
+                    <!-- Whole RTPS sub-message is protected. This includes metadata information
+                         like sequence numbers, heartbeats, key hashes, gaps,
+                         acknowledgment messages, etc. It also includes th possible payload. -->
+                    <metadata_protection_kind>NONE</metadata_protection_kind>
+
+                    <!-- The payload data sent on the Topic (serialized application level data) should be
+                         protected with Encrypt then MAC. -->
+                    <data_protection_kind>NONE</data_protection_kind>
+                </topic_rule>
+            </topic_access_rules>
+        </domain_rule>
+    </domain_access_rules>
+</dds>
diff --git a/src/security/builtin_plugins/tests/get_xxx_sec_attributes/etc/Test_Governance_liveliness_discovery_different.p7s b/src/security/builtin_plugins/tests/get_xxx_sec_attributes/etc/Test_Governance_liveliness_discovery_different.p7s
new file mode 100644
index 0000000..38b2c26
--- /dev/null
+++ b/src/security/builtin_plugins/tests/get_xxx_sec_attributes/etc/Test_Governance_liveliness_discovery_different.p7s
@@ -0,0 +1,114 @@
+MIME-Version: 1.0
+Content-Type: multipart/signed; protocol="application/x-pkcs7-signature"; micalg="sha-256"; boundary="----37F7530AAA327BE7C00C18ECA28FFF95"
+
+This is an S/MIME signed message
+
+------37F7530AAA327BE7C00C18ECA28FFF95
+Content-Type: text/plain
+
+<?xml version="1.0" encoding="utf-8"?>
+<dds xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xsi:noNamespaceSchemaLocation="https://www.omg.org/spec/DDS-SECURITY/20170901/omg_shared_ca_governance.xsd">
+    <domain_access_rules>
+        <domain_rule>
+            <domains>
+                <!-- All domains -->
+                <id_range>
+                    <min>0</min>
+                    <max>230</max>
+                </id_range>
+            </domains>
+
+            <!-- DomainParticipant that cann not authenticate or fail the authentication should be
+                 allowed to join the domain and see any any discovery data that are configured as "unprotected"
+                 and topics that are configured as "unprotected" -->
+            <allow_unauthenticated_participants>false</allow_unauthenticated_participants>
+
+            <!--  Only and any authenticated DomainParticipant should be allowed to join the domain and
+                  see the discovery data without checking access control  -->
+            <enable_join_access_control>TRUE</enable_join_access_control>
+
+            <!-- Discovery information should be protected with encryption followed by MAC (Message Authentication Codes) -->
+            <discovery_protection_kind>ENCRYPT</discovery_protection_kind>
+
+            <!--  Liveliness messages are also encrypted -->
+            <liveliness_protection_kind>NONE</liveliness_protection_kind>
+
+            <!-- Whole RTPS message is not protected -->
+            <rtps_protection_kind>NONE</rtps_protection_kind>
+
+            <topic_access_rules>
+                <topic_rule>
+                    <!-- All (non-builtin) topics -->
+                    <topic_expression>*</topic_expression>
+
+                    <!-- Liveliness QoS data is protected -->
+                    <enable_liveliness_protection>false</enable_liveliness_protection>
+
+                    <!-- The discovery information on specific Topics should be sent
+                         using the secure (protected) discovery writers -->
+                    <enable_discovery_protection>true</enable_discovery_protection>
+
+                    <!-- The read access to all topics should be open to all. -->
+                    <enable_read_access_control>false</enable_read_access_control>
+
+                    <!-- The write access to all topics should be open to all. -->
+                    <enable_write_access_control>false</enable_write_access_control>
+
+                    <!-- Whole RTPS sub-message is protected. This includes metadata information
+                         like sequence numbers, heartbeats, key hashes, gaps,
+                         acknowledgment messages, etc. It also includes th possible payload. -->
+                    <metadata_protection_kind>NONE</metadata_protection_kind>
+
+                    <!-- The payload data sent on the Topic (serialized application level data) should be
+                         protected with Encrypt then MAC. -->
+                    <data_protection_kind>NONE</data_protection_kind>
+                </topic_rule>
+            </topic_access_rules>
+        </domain_rule>
+    </domain_access_rules>
+</dds>
+
+------37F7530AAA327BE7C00C18ECA28FFF95
+Content-Type: application/x-pkcs7-signature; name="smime.p7s"
+Content-Transfer-Encoding: base64
+Content-Disposition: attachment; filename="smime.p7s"
+
+MIIGXgYJKoZIhvcNAQcCoIIGTzCCBksCAQExDzANBglghkgBZQMEAgEFADALBgkq
+hkiG9w0BBwGgggORMIIDjTCCAnWgAwIBAgIJANsr3sm0NrypMA0GCSqGSIb3DQEB
+CwUAMFwxCzAJBgNVBAYTAk5MMRMwEQYDVQQIDApTb21lLVN0YXRlMR8wHQYDVQQK
+DBZBRExJTksgVGVjaG5vbG9jeSBJbmMuMRcwFQYDVQQDDA5hZGxpbmt0ZWNoLmNv
+bTAgFw0xODA3MzAxMjQ1NTVaGA8yMTE4MDcwNjEyNDU1NVowXDELMAkGA1UEBhMC
+TkwxEzARBgNVBAgMClNvbWUtU3RhdGUxHzAdBgNVBAoMFkFETElOSyBUZWNobm9s
+b2N5IEluYy4xFzAVBgNVBAMMDmFkbGlua3RlY2guY29tMIIBIjANBgkqhkiG9w0B
+AQEFAAOCAQ8AMIIBCgKCAQEAu7jfnJ0wYVuXgG+PgNawdN38+dRpa8jceqi+blID
+ehV6XCxrnGXusTCDuFmo7HMOBVMVNDXlcBWgoGd+u5EultnOEiIeGTgtHc1O6V9w
+icp3BGSpZZax/TcONjMVORaqHCADbQ2J8wsz1FHxuKDwX6BJElYOlK77lb/x3yLs
+DFFC+a0qn2RFh37rcWBRAHy8VEASXKZElT9ZmfKd+KUq34KojhNJ4DepKStTq074
+BRDXVivx+wVD951LFNPiQXq+mgHcLj1k37KlZflTFhdP5oEMtATNsXNJPHlEymiy
+SogRWAmKhysLQudukHfNKN+r0FEQMk/hzpYcFeZSOvbfNQIDAQABo1AwTjAdBgNV
+HQ4EFgQURWMbWvBKZwJvRV1/tyc1R82k0+gwHwYDVR0jBBgwFoAURWMbWvBKZwJv
+RV1/tyc1R82k0+gwDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAQEAkPF+
+ysVtvHnk2hpu9yNDLCJ96ZzIoKOyY7uRj4ovzlAHFdpNOJQdcJihTmN8i7Trht9X
+Vh0rGoR/6nHzo3TIeiogRC80RlDtuA3PF2dDQBMVDStlZMTZPb693hfjdAjhyyw9
+yghhKHHqNDvSsAL0KfBqjG4yGfGpJylYXIT5fWuKlo/ln/yyPa5s54T5XDo+CMbt
+lLX3QnwVOmaRyzylPiTcPCDIkdLBdXmlfyJcmW6fWa6kPx+35MOxPsXZbujCo+42
++OyLqcH1rKT6XhcshjXBEf+kdgUfSClrM1pNRWsw2ChIYim0F+nry5JFy0Y+8Hbb
+6SDB340BFmtgDHbFHTGCApEwggKNAgEBMGkwXDELMAkGA1UEBhMCTkwxEzARBgNV
+BAgMClNvbWUtU3RhdGUxHzAdBgNVBAoMFkFETElOSyBUZWNobm9sb2N5IEluYy4x
+FzAVBgNVBAMMDmFkbGlua3RlY2guY29tAgkA2yveybQ2vKkwDQYJYIZIAWUDBAIB
+BQCggfowGAYJKoZIhvcNAQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG9w0BCQUxDxcN
+MTkwMzI5MTMwODAzWjAvBgkqhkiG9w0BCQQxIgQgqqTuijPzgi5UyYnaRmfKMSwt
+M8Mbr6egpAxWLt7vkkAwgY4GCSqGSIb3DQEJDzGBgDB+MAsGCWCGSAFlAwQBKjAI
+BgYqhQMCAgkwCAYGKoUDAgIVMAsGCWCGSAFlAwQBFjALBglghkgBZQMEAQIwCgYI
+KoZIhvcNAwcwDgYIKoZIhvcNAwICAgCAMA0GCCqGSIb3DQMCAgFAMAcGBSsOAwIH
+MA0GCCqGSIb3DQMCAgEoMA0GCSqGSIb3DQEBAQUABIIBACmMVANcUvNpeIpdG6is
+IbAJWbvoIh68B4nMLMU8gij1ZcNavWg6dDU709AJcrCU2ZbVsHKPyBvRuSctkbKe
+XHCRv5bAkcqkLsEVPc4Yu8w2hIC8nSTW1E2l1I+tChcXepcSsmrRFjZI8myDWmre
+Slzcq0nSwKayhMSkv0CJeSzhQGCHBhRnVCb7ZDJXL94VKh1OBxlqTWGLRNQcIk0p
+WXI0B2j5n8nM+neQd1gnKKuvqjSh2/IwUPariRfqpfVm1e8Mc0zNAubHOfuZ/hXj
+tDAPBcJq8gz3sKSbwvN4Rk1J7YV0AnA8pPq3nfoZWvqcUzbdExn2zvzawRgteUyf
+luw=
+
+------37F7530AAA327BE7C00C18ECA28FFF95--
+
diff --git a/src/security/builtin_plugins/tests/get_xxx_sec_attributes/etc/Test_Governance_liveliness_discovery_different.xml b/src/security/builtin_plugins/tests/get_xxx_sec_attributes/etc/Test_Governance_liveliness_discovery_different.xml
new file mode 100644
index 0000000..6f12d18
--- /dev/null
+++ b/src/security/builtin_plugins/tests/get_xxx_sec_attributes/etc/Test_Governance_liveliness_discovery_different.xml
@@ -0,0 +1,62 @@
+<?xml version="1.0" encoding="utf-8"?>
+<dds xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xsi:noNamespaceSchemaLocation="https://www.omg.org/spec/DDS-SECURITY/20170901/omg_shared_ca_governance.xsd">
+    <domain_access_rules>
+        <domain_rule>
+            <domains>
+                <!-- All domains -->
+                <id_range>
+                    <min>0</min>
+                    <max>230</max>
+                </id_range>
+            </domains>
+
+            <!-- DomainParticipant that cann not authenticate or fail the authentication should be
+                 allowed to join the domain and see any any discovery data that are configured as "unprotected"
+                 and topics that are configured as "unprotected" -->
+            <allow_unauthenticated_participants>false</allow_unauthenticated_participants>
+
+            <!--  Only and any authenticated DomainParticipant should be allowed to join the domain and
+                  see the discovery data without checking access control  -->
+            <enable_join_access_control>TRUE</enable_join_access_control>
+
+            <!-- Discovery information should be protected with encryption followed by MAC (Message Authentication Codes) -->
+            <discovery_protection_kind>ENCRYPT</discovery_protection_kind>
+
+            <!--  Liveliness messages are also encrypted -->
+            <liveliness_protection_kind>NONE</liveliness_protection_kind>
+
+            <!-- Whole RTPS message is not protected -->
+            <rtps_protection_kind>NONE</rtps_protection_kind>
+
+            <topic_access_rules>
+                <topic_rule>
+                    <!-- All (non-builtin) topics -->
+                    <topic_expression>*</topic_expression>
+
+                    <!-- Liveliness QoS data is protected -->
+                    <enable_liveliness_protection>false</enable_liveliness_protection>
+
+                    <!-- The discovery information on specific Topics should be sent
+                         using the secure (protected) discovery writers -->
+                    <enable_discovery_protection>true</enable_discovery_protection>
+
+                    <!-- The read access to all topics should be open to all. -->
+                    <enable_read_access_control>false</enable_read_access_control>
+
+                    <!-- The write access to all topics should be open to all. -->
+                    <enable_write_access_control>false</enable_write_access_control>
+
+                    <!-- Whole RTPS sub-message is protected. This includes metadata information
+                         like sequence numbers, heartbeats, key hashes, gaps,
+                         acknowledgment messages, etc. It also includes th possible payload. -->
+                    <metadata_protection_kind>NONE</metadata_protection_kind>
+
+                    <!-- The payload data sent on the Topic (serialized application level data) should be
+                         protected with Encrypt then MAC. -->
+                    <data_protection_kind>NONE</data_protection_kind>
+                </topic_rule>
+            </topic_access_rules>
+        </domain_rule>
+    </domain_access_rules>
+</dds>
diff --git a/src/security/builtin_plugins/tests/get_xxx_sec_attributes/etc/Test_Governance_liveliness_discovery_encrypted.p7s b/src/security/builtin_plugins/tests/get_xxx_sec_attributes/etc/Test_Governance_liveliness_discovery_encrypted.p7s
new file mode 100644
index 0000000..cfc92ac
--- /dev/null
+++ b/src/security/builtin_plugins/tests/get_xxx_sec_attributes/etc/Test_Governance_liveliness_discovery_encrypted.p7s
@@ -0,0 +1,114 @@
+MIME-Version: 1.0
+Content-Type: multipart/signed; protocol="application/x-pkcs7-signature"; micalg="sha-256"; boundary="----E6FE6351D381785F2D971BF5DB266909"
+
+This is an S/MIME signed message
+
+------E6FE6351D381785F2D971BF5DB266909
+Content-Type: text/plain
+
+<?xml version="1.0" encoding="utf-8"?>
+<dds xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xsi:noNamespaceSchemaLocation="https://www.omg.org/spec/DDS-SECURITY/20170901/omg_shared_ca_governance.xsd">
+    <domain_access_rules>
+        <domain_rule>
+            <domains>
+                <!-- All domains -->
+                <id_range>
+                    <min>0</min>
+                    <max>230</max>
+                </id_range>
+            </domains>
+
+            <!-- DomainParticipant that cann not authenticate or fail the authentication should be
+                 allowed to join the domain and see any any discovery data that are configured as "unprotected"
+                 and topics that are configured as "unprotected" -->
+            <allow_unauthenticated_participants>false</allow_unauthenticated_participants>
+
+            <!--  Only and any authenticated DomainParticipant should be allowed to join the domain and
+                  see the discovery data without checking access control  -->
+            <enable_join_access_control>TRUE</enable_join_access_control>
+
+            <!-- Discovery information should be protected with encryption followed by MAC (Message Authentication Codes) -->
+            <discovery_protection_kind>ENCRYPT</discovery_protection_kind>
+
+            <!--  Liveliness messages are also encrypted -->
+            <liveliness_protection_kind>ENCRYPT</liveliness_protection_kind>
+
+            <!-- Whole RTPS message is not protected -->
+            <rtps_protection_kind>NONE</rtps_protection_kind>
+
+            <topic_access_rules>
+                <topic_rule>
+                    <!-- All (non-builtin) topics -->
+                    <topic_expression>*</topic_expression>
+
+                    <!-- Liveliness QoS data is protected -->
+                    <enable_liveliness_protection>true</enable_liveliness_protection>
+
+                    <!-- The discovery information on specific Topics should be sent
+                         using the secure (protected) discovery writers -->
+                    <enable_discovery_protection>true</enable_discovery_protection>
+
+                    <!-- The read access to all topics should be open to all. -->
+                    <enable_read_access_control>false</enable_read_access_control>
+
+                    <!-- The write access to all topics should be open to all. -->
+                    <enable_write_access_control>false</enable_write_access_control>
+
+                    <!-- Whole RTPS sub-message is protected. This includes metadata information
+                         like sequence numbers, heartbeats, key hashes, gaps,
+                         acknowledgment messages, etc. It also includes th possible payload. -->
+                    <metadata_protection_kind>NONE</metadata_protection_kind>
+
+                    <!-- The payload data sent on the Topic (serialized application level data) should be
+                         protected with Encrypt then MAC. -->
+                    <data_protection_kind>NONE</data_protection_kind>
+                </topic_rule>
+            </topic_access_rules>
+        </domain_rule>
+    </domain_access_rules>
+</dds>
+
+------E6FE6351D381785F2D971BF5DB266909
+Content-Type: application/x-pkcs7-signature; name="smime.p7s"
+Content-Transfer-Encoding: base64
+Content-Disposition: attachment; filename="smime.p7s"
+
+MIIGXgYJKoZIhvcNAQcCoIIGTzCCBksCAQExDzANBglghkgBZQMEAgEFADALBgkq
+hkiG9w0BBwGgggORMIIDjTCCAnWgAwIBAgIJANsr3sm0NrypMA0GCSqGSIb3DQEB
+CwUAMFwxCzAJBgNVBAYTAk5MMRMwEQYDVQQIDApTb21lLVN0YXRlMR8wHQYDVQQK
+DBZBRExJTksgVGVjaG5vbG9jeSBJbmMuMRcwFQYDVQQDDA5hZGxpbmt0ZWNoLmNv
+bTAgFw0xODA3MzAxMjQ1NTVaGA8yMTE4MDcwNjEyNDU1NVowXDELMAkGA1UEBhMC
+TkwxEzARBgNVBAgMClNvbWUtU3RhdGUxHzAdBgNVBAoMFkFETElOSyBUZWNobm9s
+b2N5IEluYy4xFzAVBgNVBAMMDmFkbGlua3RlY2guY29tMIIBIjANBgkqhkiG9w0B
+AQEFAAOCAQ8AMIIBCgKCAQEAu7jfnJ0wYVuXgG+PgNawdN38+dRpa8jceqi+blID
+ehV6XCxrnGXusTCDuFmo7HMOBVMVNDXlcBWgoGd+u5EultnOEiIeGTgtHc1O6V9w
+icp3BGSpZZax/TcONjMVORaqHCADbQ2J8wsz1FHxuKDwX6BJElYOlK77lb/x3yLs
+DFFC+a0qn2RFh37rcWBRAHy8VEASXKZElT9ZmfKd+KUq34KojhNJ4DepKStTq074
+BRDXVivx+wVD951LFNPiQXq+mgHcLj1k37KlZflTFhdP5oEMtATNsXNJPHlEymiy
+SogRWAmKhysLQudukHfNKN+r0FEQMk/hzpYcFeZSOvbfNQIDAQABo1AwTjAdBgNV
+HQ4EFgQURWMbWvBKZwJvRV1/tyc1R82k0+gwHwYDVR0jBBgwFoAURWMbWvBKZwJv
+RV1/tyc1R82k0+gwDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAQEAkPF+
+ysVtvHnk2hpu9yNDLCJ96ZzIoKOyY7uRj4ovzlAHFdpNOJQdcJihTmN8i7Trht9X
+Vh0rGoR/6nHzo3TIeiogRC80RlDtuA3PF2dDQBMVDStlZMTZPb693hfjdAjhyyw9
+yghhKHHqNDvSsAL0KfBqjG4yGfGpJylYXIT5fWuKlo/ln/yyPa5s54T5XDo+CMbt
+lLX3QnwVOmaRyzylPiTcPCDIkdLBdXmlfyJcmW6fWa6kPx+35MOxPsXZbujCo+42
++OyLqcH1rKT6XhcshjXBEf+kdgUfSClrM1pNRWsw2ChIYim0F+nry5JFy0Y+8Hbb
+6SDB340BFmtgDHbFHTGCApEwggKNAgEBMGkwXDELMAkGA1UEBhMCTkwxEzARBgNV
+BAgMClNvbWUtU3RhdGUxHzAdBgNVBAoMFkFETElOSyBUZWNobm9sb2N5IEluYy4x
+FzAVBgNVBAMMDmFkbGlua3RlY2guY29tAgkA2yveybQ2vKkwDQYJYIZIAWUDBAIB
+BQCggfowGAYJKoZIhvcNAQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG9w0BCQUxDxcN
+MTkwMzI5MTMwODAzWjAvBgkqhkiG9w0BCQQxIgQg7ee1YxacZ9KtXJCLUCzhZB8p
+Sv4SXMFrKtVchg886ZkwgY4GCSqGSIb3DQEJDzGBgDB+MAsGCWCGSAFlAwQBKjAI
+BgYqhQMCAgkwCAYGKoUDAgIVMAsGCWCGSAFlAwQBFjALBglghkgBZQMEAQIwCgYI
+KoZIhvcNAwcwDgYIKoZIhvcNAwICAgCAMA0GCCqGSIb3DQMCAgFAMAcGBSsOAwIH
+MA0GCCqGSIb3DQMCAgEoMA0GCSqGSIb3DQEBAQUABIIBAB3tqkFmfwnk2HXgn9H1
+Ap6Hk7I3TIYBMMQkDTZHbPj3EMOls02+QI++ztvwaBzG7bS6f7qfxhHnNgXF/52t
+Qf20nOXjxAUL82UxVxNmJjqE+FHksSTqEjtKFMy8V+wz9doVSUgdfKKD8SUOOr1I
+nakp0o/Vk/E5bbYOoWaDXJKAo7iiEssbsw33/8eZgPpVOyPS0pqk7w6d/fmo2OMm
+niCl24qiXjdQbkuUT+zuhjKIfBjxqIPRKnOxK+HheR77m/EhkNsYYbsOgLaSXQVW
+O3Kv0GmJGKg0N2KXW5VH+6FhS5KA6TL/6Xz6LzLZFsSyAmhWsBK0l1Ted+z4Tgw3
+fP8=
+
+------E6FE6351D381785F2D971BF5DB266909--
+
diff --git a/src/security/builtin_plugins/tests/get_xxx_sec_attributes/etc/Test_Governance_liveliness_discovery_encrypted.xml b/src/security/builtin_plugins/tests/get_xxx_sec_attributes/etc/Test_Governance_liveliness_discovery_encrypted.xml
new file mode 100644
index 0000000..01b2d20
--- /dev/null
+++ b/src/security/builtin_plugins/tests/get_xxx_sec_attributes/etc/Test_Governance_liveliness_discovery_encrypted.xml
@@ -0,0 +1,62 @@
+<?xml version="1.0" encoding="utf-8"?>
+<dds xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xsi:noNamespaceSchemaLocation="https://www.omg.org/spec/DDS-SECURITY/20170901/omg_shared_ca_governance.xsd">
+    <domain_access_rules>
+        <domain_rule>
+            <domains>
+                <!-- All domains -->
+                <id_range>
+                    <min>0</min>
+                    <max>230</max>
+                </id_range>
+            </domains>
+
+            <!-- DomainParticipant that cann not authenticate or fail the authentication should be
+                 allowed to join the domain and see any any discovery data that are configured as "unprotected"
+                 and topics that are configured as "unprotected" -->
+            <allow_unauthenticated_participants>false</allow_unauthenticated_participants>
+
+            <!--  Only and any authenticated DomainParticipant should be allowed to join the domain and
+                  see the discovery data without checking access control  -->
+            <enable_join_access_control>TRUE</enable_join_access_control>
+
+            <!-- Discovery information should be protected with encryption followed by MAC (Message Authentication Codes) -->
+            <discovery_protection_kind>ENCRYPT</discovery_protection_kind>
+
+            <!--  Liveliness messages are also encrypted -->
+            <liveliness_protection_kind>ENCRYPT</liveliness_protection_kind>
+
+            <!-- Whole RTPS message is not protected -->
+            <rtps_protection_kind>NONE</rtps_protection_kind>
+
+            <topic_access_rules>
+                <topic_rule>
+                    <!-- All (non-builtin) topics -->
+                    <topic_expression>*</topic_expression>
+
+                    <!-- Liveliness QoS data is protected -->
+                    <enable_liveliness_protection>true</enable_liveliness_protection>
+
+                    <!-- The discovery information on specific Topics should be sent
+                         using the secure (protected) discovery writers -->
+                    <enable_discovery_protection>true</enable_discovery_protection>
+
+                    <!-- The read access to all topics should be open to all. -->
+                    <enable_read_access_control>false</enable_read_access_control>
+
+                    <!-- The write access to all topics should be open to all. -->
+                    <enable_write_access_control>false</enable_write_access_control>
+
+                    <!-- Whole RTPS sub-message is protected. This includes metadata information
+                         like sequence numbers, heartbeats, key hashes, gaps,
+                         acknowledgment messages, etc. It also includes th possible payload. -->
+                    <metadata_protection_kind>NONE</metadata_protection_kind>
+
+                    <!-- The payload data sent on the Topic (serialized application level data) should be
+                         protected with Encrypt then MAC. -->
+                    <data_protection_kind>NONE</data_protection_kind>
+                </topic_rule>
+            </topic_access_rules>
+        </domain_rule>
+    </domain_access_rules>
+</dds>
diff --git a/src/security/builtin_plugins/tests/get_xxx_sec_attributes/etc/Test_Governance_liveliness_discovery_encrypted_and_authenticated.p7s b/src/security/builtin_plugins/tests/get_xxx_sec_attributes/etc/Test_Governance_liveliness_discovery_encrypted_and_authenticated.p7s
new file mode 100644
index 0000000..c604b13
--- /dev/null
+++ b/src/security/builtin_plugins/tests/get_xxx_sec_attributes/etc/Test_Governance_liveliness_discovery_encrypted_and_authenticated.p7s
@@ -0,0 +1,114 @@
+MIME-Version: 1.0
+Content-Type: multipart/signed; protocol="application/x-pkcs7-signature"; micalg="sha-256"; boundary="----4375434DF6819FB7435B04810D502609"
+
+This is an S/MIME signed message
+
+------4375434DF6819FB7435B04810D502609
+Content-Type: text/plain
+
+<?xml version="1.0" encoding="utf-8"?>
+<dds xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xsi:noNamespaceSchemaLocation="https://www.omg.org/spec/DDS-SECURITY/20170901/omg_shared_ca_governance.xsd">
+    <domain_access_rules>
+        <domain_rule>
+            <domains>
+                <!-- All domains -->
+                <id_range>
+                    <min>0</min>
+                    <max>230</max>
+                </id_range>
+            </domains>
+
+            <!-- DomainParticipant that cann not authenticate or fail the authentication should be
+                 allowed to join the domain and see any any discovery data that are configured as "unprotected"
+                 and topics that are configured as "unprotected" -->
+            <allow_unauthenticated_participants>false</allow_unauthenticated_participants>
+
+            <!--  Only and any authenticated DomainParticipant should be allowed to join the domain and
+                  see the discovery data without checking access control  -->
+            <enable_join_access_control>TRUE</enable_join_access_control>
+
+            <!-- Discovery information should be protected with encryption followed by MAC (Message Authentication Codes) -->
+            <discovery_protection_kind>ENCRYPT_WITH_ORIGIN_AUTHENTICATION</discovery_protection_kind>
+
+            <!--  Liveliness messages are also encrypted -->
+            <liveliness_protection_kind>ENCRYPT_WITH_ORIGIN_AUTHENTICATION</liveliness_protection_kind>
+
+            <!-- Whole RTPS message is not protected -->
+            <rtps_protection_kind>NONE</rtps_protection_kind>
+
+            <topic_access_rules>
+                <topic_rule>
+                    <!-- All (non-builtin) topics -->
+                    <topic_expression>*</topic_expression>
+
+                    <!-- Liveliness QoS data is protected -->
+                    <enable_liveliness_protection>true</enable_liveliness_protection>
+
+                    <!-- The discovery information on specific Topics should be sent
+                         using the secure (protected) discovery writers -->
+                    <enable_discovery_protection>true</enable_discovery_protection>
+
+                    <!-- The read access to all topics should be open to all. -->
+                    <enable_read_access_control>false</enable_read_access_control>
+
+                    <!-- The write access to all topics should be open to all. -->
+                    <enable_write_access_control>false</enable_write_access_control>
+
+                    <!-- Whole RTPS sub-message is protected. This includes metadata information
+                         like sequence numbers, heartbeats, key hashes, gaps,
+                         acknowledgment messages, etc. It also includes th possible payload. -->
+                    <metadata_protection_kind>NONE</metadata_protection_kind>
+
+                    <!-- The payload data sent on the Topic (serialized application level data) should be
+                         protected with Encrypt then MAC. -->
+                    <data_protection_kind>NONE</data_protection_kind>
+                </topic_rule>
+            </topic_access_rules>
+        </domain_rule>
+    </domain_access_rules>
+</dds>
+
+------4375434DF6819FB7435B04810D502609
+Content-Type: application/x-pkcs7-signature; name="smime.p7s"
+Content-Transfer-Encoding: base64
+Content-Disposition: attachment; filename="smime.p7s"
+
+MIIGXgYJKoZIhvcNAQcCoIIGTzCCBksCAQExDzANBglghkgBZQMEAgEFADALBgkq
+hkiG9w0BBwGgggORMIIDjTCCAnWgAwIBAgIJANsr3sm0NrypMA0GCSqGSIb3DQEB
+CwUAMFwxCzAJBgNVBAYTAk5MMRMwEQYDVQQIDApTb21lLVN0YXRlMR8wHQYDVQQK
+DBZBRExJTksgVGVjaG5vbG9jeSBJbmMuMRcwFQYDVQQDDA5hZGxpbmt0ZWNoLmNv
+bTAgFw0xODA3MzAxMjQ1NTVaGA8yMTE4MDcwNjEyNDU1NVowXDELMAkGA1UEBhMC
+TkwxEzARBgNVBAgMClNvbWUtU3RhdGUxHzAdBgNVBAoMFkFETElOSyBUZWNobm9s
+b2N5IEluYy4xFzAVBgNVBAMMDmFkbGlua3RlY2guY29tMIIBIjANBgkqhkiG9w0B
+AQEFAAOCAQ8AMIIBCgKCAQEAu7jfnJ0wYVuXgG+PgNawdN38+dRpa8jceqi+blID
+ehV6XCxrnGXusTCDuFmo7HMOBVMVNDXlcBWgoGd+u5EultnOEiIeGTgtHc1O6V9w
+icp3BGSpZZax/TcONjMVORaqHCADbQ2J8wsz1FHxuKDwX6BJElYOlK77lb/x3yLs
+DFFC+a0qn2RFh37rcWBRAHy8VEASXKZElT9ZmfKd+KUq34KojhNJ4DepKStTq074
+BRDXVivx+wVD951LFNPiQXq+mgHcLj1k37KlZflTFhdP5oEMtATNsXNJPHlEymiy
+SogRWAmKhysLQudukHfNKN+r0FEQMk/hzpYcFeZSOvbfNQIDAQABo1AwTjAdBgNV
+HQ4EFgQURWMbWvBKZwJvRV1/tyc1R82k0+gwHwYDVR0jBBgwFoAURWMbWvBKZwJv
+RV1/tyc1R82k0+gwDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAQEAkPF+
+ysVtvHnk2hpu9yNDLCJ96ZzIoKOyY7uRj4ovzlAHFdpNOJQdcJihTmN8i7Trht9X
+Vh0rGoR/6nHzo3TIeiogRC80RlDtuA3PF2dDQBMVDStlZMTZPb693hfjdAjhyyw9
+yghhKHHqNDvSsAL0KfBqjG4yGfGpJylYXIT5fWuKlo/ln/yyPa5s54T5XDo+CMbt
+lLX3QnwVOmaRyzylPiTcPCDIkdLBdXmlfyJcmW6fWa6kPx+35MOxPsXZbujCo+42
++OyLqcH1rKT6XhcshjXBEf+kdgUfSClrM1pNRWsw2ChIYim0F+nry5JFy0Y+8Hbb
+6SDB340BFmtgDHbFHTGCApEwggKNAgEBMGkwXDELMAkGA1UEBhMCTkwxEzARBgNV
+BAgMClNvbWUtU3RhdGUxHzAdBgNVBAoMFkFETElOSyBUZWNobm9sb2N5IEluYy4x
+FzAVBgNVBAMMDmFkbGlua3RlY2guY29tAgkA2yveybQ2vKkwDQYJYIZIAWUDBAIB
+BQCggfowGAYJKoZIhvcNAQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG9w0BCQUxDxcN
+MTkwMzI5MTMwODAzWjAvBgkqhkiG9w0BCQQxIgQglibSNHDswKA0PDJrsz8tZiXT
+1UrMUhYJJbXsLdvTGVowgY4GCSqGSIb3DQEJDzGBgDB+MAsGCWCGSAFlAwQBKjAI
+BgYqhQMCAgkwCAYGKoUDAgIVMAsGCWCGSAFlAwQBFjALBglghkgBZQMEAQIwCgYI
+KoZIhvcNAwcwDgYIKoZIhvcNAwICAgCAMA0GCCqGSIb3DQMCAgFAMAcGBSsOAwIH
+MA0GCCqGSIb3DQMCAgEoMA0GCSqGSIb3DQEBAQUABIIBACLqhHS8kapMUhLBjAfI
+17FuvzGjgJ2CSy7/yJDz1+OsUdbCofV8jA1rxxPIGv9Koq/BaKHtJdtzpLaag/CD
+SITepCjU+rRoGnZ5vOeSgaHJlDWcRBtAoFME3NrgdYT7ldUABuiPngR5HuwNAUTA
+aY2rPaSds2eWluqH6WJqO+qvRvSZEsypy+OSpRAu954rDfkFGyZ00aQnTpzJTVJT
+MLF8rXziOY9CAHXFN0w6jEBy7Y4pBjnp/bQQFmE41NH9KuATEGPLChInQOYEEeNK
+2rr96Z/rgfhcBE1qyZdt4RNgGNFNCRzeGIX5Kti/jTeas1430sQ+DYJypObVhrhY
+S/M=
+
+------4375434DF6819FB7435B04810D502609--
+
diff --git a/src/security/builtin_plugins/tests/get_xxx_sec_attributes/etc/Test_Governance_liveliness_discovery_encrypted_and_authenticated.xml b/src/security/builtin_plugins/tests/get_xxx_sec_attributes/etc/Test_Governance_liveliness_discovery_encrypted_and_authenticated.xml
new file mode 100644
index 0000000..d011e9c
--- /dev/null
+++ b/src/security/builtin_plugins/tests/get_xxx_sec_attributes/etc/Test_Governance_liveliness_discovery_encrypted_and_authenticated.xml
@@ -0,0 +1,62 @@
+<?xml version="1.0" encoding="utf-8"?>
+<dds xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xsi:noNamespaceSchemaLocation="https://www.omg.org/spec/DDS-SECURITY/20170901/omg_shared_ca_governance.xsd">
+    <domain_access_rules>
+        <domain_rule>
+            <domains>
+                <!-- All domains -->
+                <id_range>
+                    <min>0</min>
+                    <max>230</max>
+                </id_range>
+            </domains>
+
+            <!-- DomainParticipant that cann not authenticate or fail the authentication should be
+                 allowed to join the domain and see any any discovery data that are configured as "unprotected"
+                 and topics that are configured as "unprotected" -->
+            <allow_unauthenticated_participants>false</allow_unauthenticated_participants>
+
+            <!--  Only and any authenticated DomainParticipant should be allowed to join the domain and
+                  see the discovery data without checking access control  -->
+            <enable_join_access_control>TRUE</enable_join_access_control>
+
+            <!-- Discovery information should be protected with encryption followed by MAC (Message Authentication Codes) -->
+            <discovery_protection_kind>ENCRYPT_WITH_ORIGIN_AUTHENTICATION</discovery_protection_kind>
+
+            <!--  Liveliness messages are also encrypted -->
+            <liveliness_protection_kind>ENCRYPT_WITH_ORIGIN_AUTHENTICATION</liveliness_protection_kind>
+
+            <!-- Whole RTPS message is not protected -->
+            <rtps_protection_kind>NONE</rtps_protection_kind>
+
+            <topic_access_rules>
+                <topic_rule>
+                    <!-- All (non-builtin) topics -->
+                    <topic_expression>*</topic_expression>
+
+                    <!-- Liveliness QoS data is protected -->
+                    <enable_liveliness_protection>true</enable_liveliness_protection>
+
+                    <!-- The discovery information on specific Topics should be sent
+                         using the secure (protected) discovery writers -->
+                    <enable_discovery_protection>true</enable_discovery_protection>
+
+                    <!-- The read access to all topics should be open to all. -->
+                    <enable_read_access_control>false</enable_read_access_control>
+
+                    <!-- The write access to all topics should be open to all. -->
+                    <enable_write_access_control>false</enable_write_access_control>
+
+                    <!-- Whole RTPS sub-message is protected. This includes metadata information
+                         like sequence numbers, heartbeats, key hashes, gaps,
+                         acknowledgment messages, etc. It also includes th possible payload. -->
+                    <metadata_protection_kind>NONE</metadata_protection_kind>
+
+                    <!-- The payload data sent on the Topic (serialized application level data) should be
+                         protected with Encrypt then MAC. -->
+                    <data_protection_kind>NONE</data_protection_kind>
+                </topic_rule>
+            </topic_access_rules>
+        </domain_rule>
+    </domain_access_rules>
+</dds>
diff --git a/src/security/builtin_plugins/tests/get_xxx_sec_attributes/etc/Test_Governance_liveliness_discovery_signed.p7s b/src/security/builtin_plugins/tests/get_xxx_sec_attributes/etc/Test_Governance_liveliness_discovery_signed.p7s
new file mode 100644
index 0000000..55cf899
--- /dev/null
+++ b/src/security/builtin_plugins/tests/get_xxx_sec_attributes/etc/Test_Governance_liveliness_discovery_signed.p7s
@@ -0,0 +1,114 @@
+MIME-Version: 1.0
+Content-Type: multipart/signed; protocol="application/x-pkcs7-signature"; micalg="sha-256"; boundary="----CAAC97AAFA02CB29461AE6EEFCBDADE0"
+
+This is an S/MIME signed message
+
+------CAAC97AAFA02CB29461AE6EEFCBDADE0
+Content-Type: text/plain
+
+<?xml version="1.0" encoding="utf-8"?>
+<dds xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xsi:noNamespaceSchemaLocation="https://www.omg.org/spec/DDS-SECURITY/20170901/omg_shared_ca_governance.xsd">
+    <domain_access_rules>
+        <domain_rule>
+            <domains>
+                <!-- All domains -->
+                <id_range>
+                    <min>0</min>
+                    <max>230</max>
+                </id_range>
+            </domains>
+
+            <!-- DomainParticipant that cann not authenticate or fail the authentication should be
+                 allowed to join the domain and see any any discovery data that are configured as "unprotected"
+                 and topics that are configured as "unprotected" -->
+            <allow_unauthenticated_participants>false</allow_unauthenticated_participants>
+
+            <!--  Only and any authenticated DomainParticipant should be allowed to join the domain and
+                  see the discovery data without checking access control  -->
+            <enable_join_access_control>TRUE</enable_join_access_control>
+
+            <!-- Discovery information should be protected with encryption followed by MAC (Message Authentication Codes) -->
+            <discovery_protection_kind>SIGN</discovery_protection_kind>
+
+            <!--  Liveliness messages are also encrypted -->
+            <liveliness_protection_kind>SIGN</liveliness_protection_kind>
+
+            <!-- Whole RTPS message is not protected -->
+            <rtps_protection_kind>NONE</rtps_protection_kind>
+
+            <topic_access_rules>
+                <topic_rule>
+                    <!-- All (non-builtin) topics -->
+                    <topic_expression>*</topic_expression>
+
+                    <!-- Liveliness QoS data is protected -->
+                    <enable_liveliness_protection>true</enable_liveliness_protection>
+
+                    <!-- The discovery information on specific Topics should be sent
+                         using the secure (protected) discovery writers -->
+                    <enable_discovery_protection>true</enable_discovery_protection>
+
+                    <!-- The read access to all topics should be open to all. -->
+                    <enable_read_access_control>false</enable_read_access_control>
+
+                    <!-- The write access to all topics should be open to all. -->
+                    <enable_write_access_control>false</enable_write_access_control>
+
+                    <!-- Whole RTPS sub-message is protected. This includes metadata information
+                         like sequence numbers, heartbeats, key hashes, gaps,
+                         acknowledgment messages, etc. It also includes th possible payload. -->
+                    <metadata_protection_kind>NONE</metadata_protection_kind>
+
+                    <!-- The payload data sent on the Topic (serialized application level data) should be
+                         protected with Encrypt then MAC. -->
+                    <data_protection_kind>NONE</data_protection_kind>
+                </topic_rule>
+            </topic_access_rules>
+        </domain_rule>
+    </domain_access_rules>
+</dds>
+
+------CAAC97AAFA02CB29461AE6EEFCBDADE0
+Content-Type: application/x-pkcs7-signature; name="smime.p7s"
+Content-Transfer-Encoding: base64
+Content-Disposition: attachment; filename="smime.p7s"
+
+MIIGXgYJKoZIhvcNAQcCoIIGTzCCBksCAQExDzANBglghkgBZQMEAgEFADALBgkq
+hkiG9w0BBwGgggORMIIDjTCCAnWgAwIBAgIJANsr3sm0NrypMA0GCSqGSIb3DQEB
+CwUAMFwxCzAJBgNVBAYTAk5MMRMwEQYDVQQIDApTb21lLVN0YXRlMR8wHQYDVQQK
+DBZBRExJTksgVGVjaG5vbG9jeSBJbmMuMRcwFQYDVQQDDA5hZGxpbmt0ZWNoLmNv
+bTAgFw0xODA3MzAxMjQ1NTVaGA8yMTE4MDcwNjEyNDU1NVowXDELMAkGA1UEBhMC
+TkwxEzARBgNVBAgMClNvbWUtU3RhdGUxHzAdBgNVBAoMFkFETElOSyBUZWNobm9s
+b2N5IEluYy4xFzAVBgNVBAMMDmFkbGlua3RlY2guY29tMIIBIjANBgkqhkiG9w0B
+AQEFAAOCAQ8AMIIBCgKCAQEAu7jfnJ0wYVuXgG+PgNawdN38+dRpa8jceqi+blID
+ehV6XCxrnGXusTCDuFmo7HMOBVMVNDXlcBWgoGd+u5EultnOEiIeGTgtHc1O6V9w
+icp3BGSpZZax/TcONjMVORaqHCADbQ2J8wsz1FHxuKDwX6BJElYOlK77lb/x3yLs
+DFFC+a0qn2RFh37rcWBRAHy8VEASXKZElT9ZmfKd+KUq34KojhNJ4DepKStTq074
+BRDXVivx+wVD951LFNPiQXq+mgHcLj1k37KlZflTFhdP5oEMtATNsXNJPHlEymiy
+SogRWAmKhysLQudukHfNKN+r0FEQMk/hzpYcFeZSOvbfNQIDAQABo1AwTjAdBgNV
+HQ4EFgQURWMbWvBKZwJvRV1/tyc1R82k0+gwHwYDVR0jBBgwFoAURWMbWvBKZwJv
+RV1/tyc1R82k0+gwDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAQEAkPF+
+ysVtvHnk2hpu9yNDLCJ96ZzIoKOyY7uRj4ovzlAHFdpNOJQdcJihTmN8i7Trht9X
+Vh0rGoR/6nHzo3TIeiogRC80RlDtuA3PF2dDQBMVDStlZMTZPb693hfjdAjhyyw9
+yghhKHHqNDvSsAL0KfBqjG4yGfGpJylYXIT5fWuKlo/ln/yyPa5s54T5XDo+CMbt
+lLX3QnwVOmaRyzylPiTcPCDIkdLBdXmlfyJcmW6fWa6kPx+35MOxPsXZbujCo+42
++OyLqcH1rKT6XhcshjXBEf+kdgUfSClrM1pNRWsw2ChIYim0F+nry5JFy0Y+8Hbb
+6SDB340BFmtgDHbFHTGCApEwggKNAgEBMGkwXDELMAkGA1UEBhMCTkwxEzARBgNV
+BAgMClNvbWUtU3RhdGUxHzAdBgNVBAoMFkFETElOSyBUZWNobm9sb2N5IEluYy4x
+FzAVBgNVBAMMDmFkbGlua3RlY2guY29tAgkA2yveybQ2vKkwDQYJYIZIAWUDBAIB
+BQCggfowGAYJKoZIhvcNAQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG9w0BCQUxDxcN
+MTkwMzI5MTMwODAzWjAvBgkqhkiG9w0BCQQxIgQgUQGGQlfgFH2GTdp8QcQHAf7c
+ytQO0EMxvnsXNDiWmfcwgY4GCSqGSIb3DQEJDzGBgDB+MAsGCWCGSAFlAwQBKjAI
+BgYqhQMCAgkwCAYGKoUDAgIVMAsGCWCGSAFlAwQBFjALBglghkgBZQMEAQIwCgYI
+KoZIhvcNAwcwDgYIKoZIhvcNAwICAgCAMA0GCCqGSIb3DQMCAgFAMAcGBSsOAwIH
+MA0GCCqGSIb3DQMCAgEoMA0GCSqGSIb3DQEBAQUABIIBABl+6OuVlW5UltPGg+9c
+6DlnX12Ah1feD0c/cmOkWjKW9A/soc+5npXvLcbxlkO/+MEkHlH00QKQmX7uY+3Z
+NybUU/2KbzEeqo8WwkqJPFBBPrjbHTAuIIPDHFcSq9oY6zUWMcHDFVjaXcNOfyiA
+clECqfcXesxfwGNXv5x58y0rJdxGiyptryLvJnZozwjNJ08ggY6d2mnitxbtSowY
+InQ02I95vWHYquonVAihvKX9NhaCSDEMyJb/ckL8tJuzQ3qUsEfc5DJVUSOEyCo8
+C7cZbfCpM9R+ZwyhRQOaleHs4kLvli7Q8OkpH8ecUBeg9gQmriju1G2/irvTg4t+
+Tlw=
+
+------CAAC97AAFA02CB29461AE6EEFCBDADE0--
+
diff --git a/src/security/builtin_plugins/tests/get_xxx_sec_attributes/etc/Test_Governance_liveliness_discovery_signed.xml b/src/security/builtin_plugins/tests/get_xxx_sec_attributes/etc/Test_Governance_liveliness_discovery_signed.xml
new file mode 100644
index 0000000..63ee9e4
--- /dev/null
+++ b/src/security/builtin_plugins/tests/get_xxx_sec_attributes/etc/Test_Governance_liveliness_discovery_signed.xml
@@ -0,0 +1,62 @@
+<?xml version="1.0" encoding="utf-8"?>
+<dds xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xsi:noNamespaceSchemaLocation="https://www.omg.org/spec/DDS-SECURITY/20170901/omg_shared_ca_governance.xsd">
+    <domain_access_rules>
+        <domain_rule>
+            <domains>
+                <!-- All domains -->
+                <id_range>
+                    <min>0</min>
+                    <max>230</max>
+                </id_range>
+            </domains>
+
+            <!-- DomainParticipant that cann not authenticate or fail the authentication should be
+                 allowed to join the domain and see any any discovery data that are configured as "unprotected"
+                 and topics that are configured as "unprotected" -->
+            <allow_unauthenticated_participants>false</allow_unauthenticated_participants>
+
+            <!--  Only and any authenticated DomainParticipant should be allowed to join the domain and
+                  see the discovery data without checking access control  -->
+            <enable_join_access_control>TRUE</enable_join_access_control>
+
+            <!-- Discovery information should be protected with encryption followed by MAC (Message Authentication Codes) -->
+            <discovery_protection_kind>SIGN</discovery_protection_kind>
+
+            <!--  Liveliness messages are also encrypted -->
+            <liveliness_protection_kind>SIGN</liveliness_protection_kind>
+
+            <!-- Whole RTPS message is not protected -->
+            <rtps_protection_kind>NONE</rtps_protection_kind>
+
+            <topic_access_rules>
+                <topic_rule>
+                    <!-- All (non-builtin) topics -->
+                    <topic_expression>*</topic_expression>
+
+                    <!-- Liveliness QoS data is protected -->
+                    <enable_liveliness_protection>true</enable_liveliness_protection>
+
+                    <!-- The discovery information on specific Topics should be sent
+                         using the secure (protected) discovery writers -->
+                    <enable_discovery_protection>true</enable_discovery_protection>
+
+                    <!-- The read access to all topics should be open to all. -->
+                    <enable_read_access_control>false</enable_read_access_control>
+
+                    <!-- The write access to all topics should be open to all. -->
+                    <enable_write_access_control>false</enable_write_access_control>
+
+                    <!-- Whole RTPS sub-message is protected. This includes metadata information
+                         like sequence numbers, heartbeats, key hashes, gaps,
+                         acknowledgment messages, etc. It also includes th possible payload. -->
+                    <metadata_protection_kind>NONE</metadata_protection_kind>
+
+                    <!-- The payload data sent on the Topic (serialized application level data) should be
+                         protected with Encrypt then MAC. -->
+                    <data_protection_kind>NONE</data_protection_kind>
+                </topic_rule>
+            </topic_access_rules>
+        </domain_rule>
+    </domain_access_rules>
+</dds>
diff --git a/src/security/builtin_plugins/tests/get_xxx_sec_attributes/etc/Test_Governance_liveliness_discovery_signed_and_authenticated.p7s b/src/security/builtin_plugins/tests/get_xxx_sec_attributes/etc/Test_Governance_liveliness_discovery_signed_and_authenticated.p7s
new file mode 100644
index 0000000..6273245
--- /dev/null
+++ b/src/security/builtin_plugins/tests/get_xxx_sec_attributes/etc/Test_Governance_liveliness_discovery_signed_and_authenticated.p7s
@@ -0,0 +1,114 @@
+MIME-Version: 1.0
+Content-Type: multipart/signed; protocol="application/x-pkcs7-signature"; micalg="sha-256"; boundary="----7D08A7D2B4B01785900B9A7208F12A69"
+
+This is an S/MIME signed message
+
+------7D08A7D2B4B01785900B9A7208F12A69
+Content-Type: text/plain
+
+<?xml version="1.0" encoding="utf-8"?>
+<dds xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xsi:noNamespaceSchemaLocation="https://www.omg.org/spec/DDS-SECURITY/20170901/omg_shared_ca_governance.xsd">
+    <domain_access_rules>
+        <domain_rule>
+            <domains>
+                <!-- All domains -->
+                <id_range>
+                    <min>0</min>
+                    <max>230</max>
+                </id_range>
+            </domains>
+
+            <!-- DomainParticipant that cann not authenticate or fail the authentication should be
+                 allowed to join the domain and see any any discovery data that are configured as "unprotected"
+                 and topics that are configured as "unprotected" -->
+            <allow_unauthenticated_participants>false</allow_unauthenticated_participants>
+
+            <!--  Only and any authenticated DomainParticipant should be allowed to join the domain and
+                  see the discovery data without checking access control  -->
+            <enable_join_access_control>TRUE</enable_join_access_control>
+
+            <!-- Discovery information should be protected with encryption followed by MAC (Message Authentication Codes) -->
+            <discovery_protection_kind>SIGN_WITH_ORIGIN_AUTHENTICATION</discovery_protection_kind>
+
+            <!--  Liveliness messages are also encrypted -->
+            <liveliness_protection_kind>SIGN_WITH_ORIGIN_AUTHENTICATION</liveliness_protection_kind>
+
+            <!-- Whole RTPS message is not protected -->
+            <rtps_protection_kind>NONE</rtps_protection_kind>
+
+            <topic_access_rules>
+                <topic_rule>
+                    <!-- All (non-builtin) topics -->
+                    <topic_expression>*</topic_expression>
+
+                    <!-- Liveliness QoS data is protected -->
+                    <enable_liveliness_protection>true</enable_liveliness_protection>
+
+                    <!-- The discovery information on specific Topics should be sent
+                         using the secure (protected) discovery writers -->
+                    <enable_discovery_protection>true</enable_discovery_protection>
+
+                    <!-- The read access to all topics should be open to all. -->
+                    <enable_read_access_control>false</enable_read_access_control>
+
+                    <!-- The write access to all topics should be open to all. -->
+                    <enable_write_access_control>false</enable_write_access_control>
+
+                    <!-- Whole RTPS sub-message is protected. This includes metadata information
+                         like sequence numbers, heartbeats, key hashes, gaps,
+                         acknowledgment messages, etc. It also includes th possible payload. -->
+                    <metadata_protection_kind>NONE</metadata_protection_kind>
+
+                    <!-- The payload data sent on the Topic (serialized application level data) should be
+                         protected with Encrypt then MAC. -->
+                    <data_protection_kind>NONE</data_protection_kind>
+                </topic_rule>
+            </topic_access_rules>
+        </domain_rule>
+    </domain_access_rules>
+</dds>
+
+------7D08A7D2B4B01785900B9A7208F12A69
+Content-Type: application/x-pkcs7-signature; name="smime.p7s"
+Content-Transfer-Encoding: base64
+Content-Disposition: attachment; filename="smime.p7s"
+
+MIIGXgYJKoZIhvcNAQcCoIIGTzCCBksCAQExDzANBglghkgBZQMEAgEFADALBgkq
+hkiG9w0BBwGgggORMIIDjTCCAnWgAwIBAgIJANsr3sm0NrypMA0GCSqGSIb3DQEB
+CwUAMFwxCzAJBgNVBAYTAk5MMRMwEQYDVQQIDApTb21lLVN0YXRlMR8wHQYDVQQK
+DBZBRExJTksgVGVjaG5vbG9jeSBJbmMuMRcwFQYDVQQDDA5hZGxpbmt0ZWNoLmNv
+bTAgFw0xODA3MzAxMjQ1NTVaGA8yMTE4MDcwNjEyNDU1NVowXDELMAkGA1UEBhMC
+TkwxEzARBgNVBAgMClNvbWUtU3RhdGUxHzAdBgNVBAoMFkFETElOSyBUZWNobm9s
+b2N5IEluYy4xFzAVBgNVBAMMDmFkbGlua3RlY2guY29tMIIBIjANBgkqhkiG9w0B
+AQEFAAOCAQ8AMIIBCgKCAQEAu7jfnJ0wYVuXgG+PgNawdN38+dRpa8jceqi+blID
+ehV6XCxrnGXusTCDuFmo7HMOBVMVNDXlcBWgoGd+u5EultnOEiIeGTgtHc1O6V9w
+icp3BGSpZZax/TcONjMVORaqHCADbQ2J8wsz1FHxuKDwX6BJElYOlK77lb/x3yLs
+DFFC+a0qn2RFh37rcWBRAHy8VEASXKZElT9ZmfKd+KUq34KojhNJ4DepKStTq074
+BRDXVivx+wVD951LFNPiQXq+mgHcLj1k37KlZflTFhdP5oEMtATNsXNJPHlEymiy
+SogRWAmKhysLQudukHfNKN+r0FEQMk/hzpYcFeZSOvbfNQIDAQABo1AwTjAdBgNV
+HQ4EFgQURWMbWvBKZwJvRV1/tyc1R82k0+gwHwYDVR0jBBgwFoAURWMbWvBKZwJv
+RV1/tyc1R82k0+gwDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAQEAkPF+
+ysVtvHnk2hpu9yNDLCJ96ZzIoKOyY7uRj4ovzlAHFdpNOJQdcJihTmN8i7Trht9X
+Vh0rGoR/6nHzo3TIeiogRC80RlDtuA3PF2dDQBMVDStlZMTZPb693hfjdAjhyyw9
+yghhKHHqNDvSsAL0KfBqjG4yGfGpJylYXIT5fWuKlo/ln/yyPa5s54T5XDo+CMbt
+lLX3QnwVOmaRyzylPiTcPCDIkdLBdXmlfyJcmW6fWa6kPx+35MOxPsXZbujCo+42
++OyLqcH1rKT6XhcshjXBEf+kdgUfSClrM1pNRWsw2ChIYim0F+nry5JFy0Y+8Hbb
+6SDB340BFmtgDHbFHTGCApEwggKNAgEBMGkwXDELMAkGA1UEBhMCTkwxEzARBgNV
+BAgMClNvbWUtU3RhdGUxHzAdBgNVBAoMFkFETElOSyBUZWNobm9sb2N5IEluYy4x
+FzAVBgNVBAMMDmFkbGlua3RlY2guY29tAgkA2yveybQ2vKkwDQYJYIZIAWUDBAIB
+BQCggfowGAYJKoZIhvcNAQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG9w0BCQUxDxcN
+MTkwMzI5MTMwODAzWjAvBgkqhkiG9w0BCQQxIgQgu4lTESCOlPw4ua2e8RFY0V80
+KDwe7OyvA7k5OJvb70MwgY4GCSqGSIb3DQEJDzGBgDB+MAsGCWCGSAFlAwQBKjAI
+BgYqhQMCAgkwCAYGKoUDAgIVMAsGCWCGSAFlAwQBFjALBglghkgBZQMEAQIwCgYI
+KoZIhvcNAwcwDgYIKoZIhvcNAwICAgCAMA0GCCqGSIb3DQMCAgFAMAcGBSsOAwIH
+MA0GCCqGSIb3DQMCAgEoMA0GCSqGSIb3DQEBAQUABIIBAE6icR4lmUwDahVEA4BA
+QIl2Pp+WGo1wDLHRdR1YnKt9narfgi6YHlt37sppOuKYPZSrjkcE07nlj9IN3PNR
+2RxeUogt5fLHPll2E+GIfXRkPq5MtCscko+7MyrPkaMOPCv0pQ8e+nEvDkLeKqvS
+jinelekFzICvUd8vg9UozxyUQciPLvjmEVwe+czFiM0oFqN9O9d1y5n985HXc/T5
+RfhSXpXUk2KBPvU+tN9UtdInMylPs8PK8wbONTem7uG9nP/tKL7VCjLiTQm5zAuo
+ecEvLybuALPVwylTppB2a8jMwb3Qt3ERY/do9s9RyFszvMOqBXsDOpSGtjBHT2uU
+Bhs=
+
+------7D08A7D2B4B01785900B9A7208F12A69--
+
diff --git a/src/security/builtin_plugins/tests/get_xxx_sec_attributes/etc/Test_Governance_liveliness_discovery_signed_and_authenticated.xml b/src/security/builtin_plugins/tests/get_xxx_sec_attributes/etc/Test_Governance_liveliness_discovery_signed_and_authenticated.xml
new file mode 100644
index 0000000..3930f88
--- /dev/null
+++ b/src/security/builtin_plugins/tests/get_xxx_sec_attributes/etc/Test_Governance_liveliness_discovery_signed_and_authenticated.xml
@@ -0,0 +1,62 @@
+<?xml version="1.0" encoding="utf-8"?>
+<dds xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xsi:noNamespaceSchemaLocation="https://www.omg.org/spec/DDS-SECURITY/20170901/omg_shared_ca_governance.xsd">
+    <domain_access_rules>
+        <domain_rule>
+            <domains>
+                <!-- All domains -->
+                <id_range>
+                    <min>0</min>
+                    <max>230</max>
+                </id_range>
+            </domains>
+
+            <!-- DomainParticipant that cann not authenticate or fail the authentication should be
+                 allowed to join the domain and see any any discovery data that are configured as "unprotected"
+                 and topics that are configured as "unprotected" -->
+            <allow_unauthenticated_participants>false</allow_unauthenticated_participants>
+
+            <!--  Only and any authenticated DomainParticipant should be allowed to join the domain and
+                  see the discovery data without checking access control  -->
+            <enable_join_access_control>TRUE</enable_join_access_control>
+
+            <!-- Discovery information should be protected with encryption followed by MAC (Message Authentication Codes) -->
+            <discovery_protection_kind>SIGN_WITH_ORIGIN_AUTHENTICATION</discovery_protection_kind>
+
+            <!--  Liveliness messages are also encrypted -->
+            <liveliness_protection_kind>SIGN_WITH_ORIGIN_AUTHENTICATION</liveliness_protection_kind>
+
+            <!-- Whole RTPS message is not protected -->
+            <rtps_protection_kind>NONE</rtps_protection_kind>
+
+            <topic_access_rules>
+                <topic_rule>
+                    <!-- All (non-builtin) topics -->
+                    <topic_expression>*</topic_expression>
+
+                    <!-- Liveliness QoS data is protected -->
+                    <enable_liveliness_protection>true</enable_liveliness_protection>
+
+                    <!-- The discovery information on specific Topics should be sent
+                         using the secure (protected) discovery writers -->
+                    <enable_discovery_protection>true</enable_discovery_protection>
+
+                    <!-- The read access to all topics should be open to all. -->
+                    <enable_read_access_control>false</enable_read_access_control>
+
+                    <!-- The write access to all topics should be open to all. -->
+                    <enable_write_access_control>false</enable_write_access_control>
+
+                    <!-- Whole RTPS sub-message is protected. This includes metadata information
+                         like sequence numbers, heartbeats, key hashes, gaps,
+                         acknowledgment messages, etc. It also includes th possible payload. -->
+                    <metadata_protection_kind>NONE</metadata_protection_kind>
+
+                    <!-- The payload data sent on the Topic (serialized application level data) should be
+                         protected with Encrypt then MAC. -->
+                    <data_protection_kind>NONE</data_protection_kind>
+                </topic_rule>
+            </topic_access_rules>
+        </domain_rule>
+    </domain_access_rules>
+</dds>
diff --git a/src/security/builtin_plugins/tests/get_xxx_sec_attributes/etc/Test_Permissions_ok.p7s b/src/security/builtin_plugins/tests/get_xxx_sec_attributes/etc/Test_Permissions_ok.p7s
new file mode 100644
index 0000000..052075b
--- /dev/null
+++ b/src/security/builtin_plugins/tests/get_xxx_sec_attributes/etc/Test_Permissions_ok.p7s
@@ -0,0 +1,85 @@
+MIME-Version: 1.0
+Content-Type: multipart/signed; protocol="application/x-pkcs7-signature"; micalg="sha-256"; boundary="----6B91005B007BBA8EDE10CD1CE487DB27"
+
+This is an S/MIME signed message
+
+------6B91005B007BBA8EDE10CD1CE487DB27
+Content-Type: text/plain
+
+<?xml version="1.0" encoding="utf-8"?>
+<dds xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xsi:noNamespaceSchemaLocation="https://www.omg.org/spec/DDS-SECURITY/20170901/omg_shared_ca_permissions.xsd">
+    <permissions>
+        <grant name="OpenSplicePermissions">
+            <subject_name>CN=CHAM500 cert,O=Internet Widgits Pty Ltd,ST=Some-State,C=NL</subject_name>
+            <validity>
+                <!-- Format is CCYY-MM-DDThh:mm:ss[Z|(+|-)hh:mm] in GMT -->
+                <not_before>2015-09-15T01:00:00</not_before>
+                <not_after>2115-09-15T01:00:00</not_after>
+            </validity>
+            <allow_rule>
+                <domains>
+                    <id_range>
+                        <min>0</min>
+                        <max>230</max>
+                    </id_range>
+                </domains>
+                <publish>
+                    <topics>
+                        <topic>*</topic>
+                    </topics>
+                </publish>
+                <subscribe>
+                    <topics>
+                        <topic>*</topic>
+                    </topics>
+                </subscribe>
+            </allow_rule>
+            <default>DENY</default>
+        </grant>
+    </permissions>
+</dds>
+
+------6B91005B007BBA8EDE10CD1CE487DB27
+Content-Type: application/x-pkcs7-signature; name="smime.p7s"
+Content-Transfer-Encoding: base64
+Content-Disposition: attachment; filename="smime.p7s"
+
+MIIGXgYJKoZIhvcNAQcCoIIGTzCCBksCAQExDzANBglghkgBZQMEAgEFADALBgkq
+hkiG9w0BBwGgggORMIIDjTCCAnWgAwIBAgIJANsr3sm0NrypMA0GCSqGSIb3DQEB
+CwUAMFwxCzAJBgNVBAYTAk5MMRMwEQYDVQQIDApTb21lLVN0YXRlMR8wHQYDVQQK
+DBZBRExJTksgVGVjaG5vbG9jeSBJbmMuMRcwFQYDVQQDDA5hZGxpbmt0ZWNoLmNv
+bTAgFw0xODA3MzAxMjQ1NTVaGA8yMTE4MDcwNjEyNDU1NVowXDELMAkGA1UEBhMC
+TkwxEzARBgNVBAgMClNvbWUtU3RhdGUxHzAdBgNVBAoMFkFETElOSyBUZWNobm9s
+b2N5IEluYy4xFzAVBgNVBAMMDmFkbGlua3RlY2guY29tMIIBIjANBgkqhkiG9w0B
+AQEFAAOCAQ8AMIIBCgKCAQEAu7jfnJ0wYVuXgG+PgNawdN38+dRpa8jceqi+blID
+ehV6XCxrnGXusTCDuFmo7HMOBVMVNDXlcBWgoGd+u5EultnOEiIeGTgtHc1O6V9w
+icp3BGSpZZax/TcONjMVORaqHCADbQ2J8wsz1FHxuKDwX6BJElYOlK77lb/x3yLs
+DFFC+a0qn2RFh37rcWBRAHy8VEASXKZElT9ZmfKd+KUq34KojhNJ4DepKStTq074
+BRDXVivx+wVD951LFNPiQXq+mgHcLj1k37KlZflTFhdP5oEMtATNsXNJPHlEymiy
+SogRWAmKhysLQudukHfNKN+r0FEQMk/hzpYcFeZSOvbfNQIDAQABo1AwTjAdBgNV
+HQ4EFgQURWMbWvBKZwJvRV1/tyc1R82k0+gwHwYDVR0jBBgwFoAURWMbWvBKZwJv
+RV1/tyc1R82k0+gwDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAQEAkPF+
+ysVtvHnk2hpu9yNDLCJ96ZzIoKOyY7uRj4ovzlAHFdpNOJQdcJihTmN8i7Trht9X
+Vh0rGoR/6nHzo3TIeiogRC80RlDtuA3PF2dDQBMVDStlZMTZPb693hfjdAjhyyw9
+yghhKHHqNDvSsAL0KfBqjG4yGfGpJylYXIT5fWuKlo/ln/yyPa5s54T5XDo+CMbt
+lLX3QnwVOmaRyzylPiTcPCDIkdLBdXmlfyJcmW6fWa6kPx+35MOxPsXZbujCo+42
++OyLqcH1rKT6XhcshjXBEf+kdgUfSClrM1pNRWsw2ChIYim0F+nry5JFy0Y+8Hbb
+6SDB340BFmtgDHbFHTGCApEwggKNAgEBMGkwXDELMAkGA1UEBhMCTkwxEzARBgNV
+BAgMClNvbWUtU3RhdGUxHzAdBgNVBAoMFkFETElOSyBUZWNobm9sb2N5IEluYy4x
+FzAVBgNVBAMMDmFkbGlua3RlY2guY29tAgkA2yveybQ2vKkwDQYJYIZIAWUDBAIB
+BQCggfowGAYJKoZIhvcNAQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG9w0BCQUxDxcN
+MTkwMzI5MTMwODAzWjAvBgkqhkiG9w0BCQQxIgQgl3LfUhn9L0vG/3QRPVYptcYw
+/NH5HMN99aMe9JAT+LAwgY4GCSqGSIb3DQEJDzGBgDB+MAsGCWCGSAFlAwQBKjAI
+BgYqhQMCAgkwCAYGKoUDAgIVMAsGCWCGSAFlAwQBFjALBglghkgBZQMEAQIwCgYI
+KoZIhvcNAwcwDgYIKoZIhvcNAwICAgCAMA0GCCqGSIb3DQMCAgFAMAcGBSsOAwIH
+MA0GCCqGSIb3DQMCAgEoMA0GCSqGSIb3DQEBAQUABIIBAHe9vakfXPvbpgMeqlhG
+SW6Z3uVA3Yri9bgQDpJ9daIUsM0/TLBSQVs85twTMXvqUSntKbfSGehxDQ9F+yje
+mOEPMIwxOqcVyc2jpqoYsUWqpwiiZyk49DHUFrOfWJUx+rKdBftZWkxD05Wkovhk
+2d4hGS/65Haoho4Z0AZwcyH+F52FZMiqw7I9FKrPlhxvJfQXmhIjOKtnvWnQ+Ar7
+YYiSrBEHMCy82LF1aKzz0nkL1SYWQHuQX475qoU4LMYY1J8WsD3rSBeq4GYZrl2K
+X/JcOquMYqjfJLMYZY4fsc3FgEBkKNqJz1tDZ3ir24VMl+WsbEjVK8oXe/wt4V0U
+aNQ=
+
+------6B91005B007BBA8EDE10CD1CE487DB27--
+
diff --git a/src/security/builtin_plugins/tests/get_xxx_sec_attributes/src/get_xxx_sec_attributes_utests.c b/src/security/builtin_plugins/tests/get_xxx_sec_attributes/src/get_xxx_sec_attributes_utests.c
new file mode 100644
index 0000000..91381aa
--- /dev/null
+++ b/src/security/builtin_plugins/tests/get_xxx_sec_attributes/src/get_xxx_sec_attributes_utests.c
@@ -0,0 +1,1649 @@
+/*
+ * Copyright(c) 2006 to 2019 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+#include <assert.h>
+#include <openssl/evp.h>
+#include <openssl/hmac.h>
+#include <openssl/bio.h>
+#include <openssl/err.h>
+
+#include "dds/ddsrt/environ.h"
+#include "dds/ddsrt/heap.h"
+#include "dds/ddsrt/io.h"
+#include "dds/ddsrt/string.h"
+#include "dds/ddsrt/types.h"
+#include "dds/security/dds_security_api.h"
+#include "dds/security/core/dds_security_utils.h"
+#include "CUnit/CUnit.h"
+#include "CUnit/Test.h"
+#include "common/src/loader.h"
+#include "config_env.h"
+
+#if OPENSLL_VERSION_NUMBER >= 0x10002000L
+#define AUTH_INCLUDE_EC
+#endif
+
+static const char *RELATIVE_PATH_TO_ETC_DIR = "/get_xxx_sec_attributes/etc/";
+
+static const char *PROPERTY_IDENTITY_CA = "dds.sec.auth.identity_ca";
+static const char *PROPERTY_PRIVATE_KEY = "dds.sec.auth.private_key";
+static const char *PROPERTY_IDENTITY_CERT = "dds.sec.auth.identity_certificate";
+static const char *PROPERTY_PERMISSIONS_CA = "dds.sec.access.permissions_ca";
+static const char *PROPERTY_PERMISSIONS = "dds.sec.access.permissions";
+static const char *PROPERTY_GOVERNANCE = "dds.sec.access.governance";
+
+static const char *IDENTITY_CERTIFICATE =
+    "data:,-----BEGIN CERTIFICATE-----\n"
+    "MIIEQTCCAymgAwIBAgIINpuaAAnrQZIwDQYJKoZIhvcNAQELBQAwXzELMAkGA1UE\n"
+    "BhMCTkwxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdp\n"
+    "ZGdpdHMgUHR5IEx0ZDEYMBYGA1UEAxMPQ0hBTTUwMCByb290IGNhMCAXDTE3MDIy\n"
+    "MjIyMjIwMFoYDzIyMjIwMjIyMjIyMjAwWjBcMQswCQYDVQQGEwJOTDETMBEGA1UE\n"
+    "CBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRk\n"
+    "MRUwEwYDVQQDEwxDSEFNNTAwIGNlcnQwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAw\n"
+    "ggEKAoIBAQDCpVhivH/wBIyu74rvQncnSZqKyspN6CvD1pmV9wft5PHhVt9jV79v\n"
+    "gSub5LADoRHAgFdv9duYgBr17Ob6uRrIY4B18CcrCjhQcC4gjx8y2jl9PeYm+qYD\n"
+    "3o44FYBrBq0QCnrQgKsb/qX9Z+Mw/VUiw65x68W876LEHQQoEgT4kxSuagwBoVRk\n"
+    "ePD6fYAKmT4XS3x+O0v+rHESTcsKF6yMadgp7h3eH1b8kJTzSx8JV9Zzq++mxjox\n"
+    "qhbBVP5nDze2hhSIeCkCvSrx7efkgKS4AQXa5/Z44GiAu1TfXXUqdic9rxwD0edn\n"
+    "ajNElnZe7sjok/0yuqvH+2hSqpNva/zpAgMBAAGjggEAMIH9MAwGA1UdDwQFAwMH\n"
+    "/4AwgewGA1UdJQSB5DCB4QYIKwYBBQUHAwEGCCsGAQUFBwMCBggrBgEFBQcDAwYI\n"
+    "KwYBBQUHAwQGCCsGAQUFBwMIBgorBgEEAYI3AgEVBgorBgEEAYI3AgEWBgorBgEE\n"
+    "AYI3CgMBBgorBgEEAYI3CgMDBgorBgEEAYI3CgMEBglghkgBhvhCBAEGCysGAQQB\n"
+    "gjcKAwQBBggrBgEFBQcDBQYIKwYBBQUHAwYGCCsGAQUFBwMHBggrBgEFBQgCAgYK\n"
+    "KwYBBAGCNxQCAgYIKwYBBQUHAwkGCCsGAQUFBwMNBggrBgEFBQcDDgYHKwYBBQID\n"
+    "BTANBgkqhkiG9w0BAQsFAAOCAQEAawdHy0Xw7nTK2ltp91Ion6fJ7hqYuj///zr7\n"
+    "Adt6uonpDh/xl3esuwcFimIJrJrHujnGkL0nLddRCikmnzuBMNDWS6yq0/Ckl/YG\n"
+    "yjNr44dlX24wo+MVAgkj3/8CyWDZ3a8kBg9QT3bs2SqbjmhTrXN1DRyf9S5vJysE\n"
+    "I7V1gTN66BeKL64hOrAlRVrEu8Ds6TWL6Q/YH+61ViZkoLTeSaPjH4nknaFr4C35\n"
+    "iji0JhkyfRHRRVPHFnaj25AkxOrSV64qVKoTMjDl5fji5iMGtjm6iJ7q05ml/qDl\n"
+    "nLotHXemZNvYhbwUmRzbt4Dls9EMH4VRbP85I94nM5TAvtHVNA==\n"
+    "-----END CERTIFICATE-----\n";
+
+static const char *IDENTITY_CA =
+    "data:,-----BEGIN CERTIFICATE-----\n"
+    "MIIEmTCCA4GgAwIBAgIIZ5gEIUFhO5wwDQYJKoZIhvcNAQELBQAwXzELMAkGA1UE\n"
+    "BhMCTkwxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdp\n"
+    "ZGdpdHMgUHR5IEx0ZDEYMBYGA1UEAxMPQ0hBTTUwMCByb290IGNhMCAXDTE4MDIx\n"
+    "MjE1MDUwMFoYDzIyMjIwMjIyMjIyMjAwWjBfMQswCQYDVQQGEwJOTDETMBEGA1UE\n"
+    "CBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRk\n"
+    "MRgwFgYDVQQDEw9DSEFNNTAwIHJvb3QgY2EwggEiMA0GCSqGSIb3DQEBAQUAA4IB\n"
+    "DwAwggEKAoIBAQC6Fa3TheL+UrdZCp9GhU/2WbneP2t/avUa3muwDttPxeI2XU9k\n"
+    "ZjBR95mAXme4SPXHk5+YDN319AqIje3oKhzky/ngvKH2GkoJKYxWnuDBfMEHdViz\n"
+    "2Q9/xso2ZvH50ukwWa0pfx2/EVV1wRxeQcRd/UVfq3KTJizG0M88mOYvGEAw3LFf\n"
+    "zef7k1aCuOofQmBvLukUudcYpMzfyHFp7lQqU4CcrrR5RtmfiUfrWfdGLea2iPDB\n"
+    "pJgN8ESOMwEHtOTEBDclYnH9L4t7CHQz+fXXS5IWFsDK9fCMQjnxDsDVeNrNzTYL\n"
+    "FaZrMg9S6IUQCEsQWsnq5weS8omOpVLUm9klAgMBAAGjggFVMIIBUTAMBgNVHRME\n"
+    "BTADAQH/MB0GA1UdDgQWBBQg2FZB/j8uWDVnJhjwXkX278znSTAfBgNVHSMEGDAW\n"
+    "gBQg2FZB/j8uWDVnJhjwXkX278znSTAPBgNVHQ8BAf8EBQMDB/+AMIHvBgNVHSUB\n"
+    "Af8EgeQwgeEGCCsGAQUFBwMBBggrBgEFBQcDAgYIKwYBBQUHAwMGCCsGAQUFBwME\n"
+    "BggrBgEFBQcDCAYKKwYBBAGCNwIBFQYKKwYBBAGCNwIBFgYKKwYBBAGCNwoDAQYK\n"
+    "KwYBBAGCNwoDAwYKKwYBBAGCNwoDBAYJYIZIAYb4QgQBBgsrBgEEAYI3CgMEAQYI\n"
+    "KwYBBQUHAwUGCCsGAQUFBwMGBggrBgEFBQcDBwYIKwYBBQUIAgIGCisGAQQBgjcU\n"
+    "AgIGCCsGAQUFBwMJBggrBgEFBQcDDQYIKwYBBQUHAw4GBysGAQUCAwUwDQYJKoZI\n"
+    "hvcNAQELBQADggEBAKHmwejWRwGE1wf1k2rG8SNRV/neGsZ6Qfqf6co3TpR/Wi1s\n"
+    "iZDvSeT/rbqNBS7z34xnG88NIUwu00y78e8Mfon31ZZbK4Uo7fla9/D3ukdJqPQC\n"
+    "LKdbKJjR2kH+KCukY/1rghjJ8/X+t2egBit0LCOdsFCl07Sfksb9kpGUIZSFcYYm\n"
+    "geqhjhoNwxazzHiw+QWHC5HG9248JIizBmy1aymNWuMnPudhjHAnPcsIlqMVNq3t\n"
+    "Rv9ap7S8JeCxHVRPJvJeCwXWvW3dW/v3xH52Yn/fqRblN1w9Fxz5NhopKx0gj/Jd\n"
+    "sw2N4Fk4gaOWEolFpa0bwNw8nAx7moehZpowzfw=\n"
+    "-----END CERTIFICATE-----\n";
+
+static const char *PRIVATE_KEY =
+    "data:,-----BEGIN RSA PRIVATE KEY-----\n"
+    "MIIEogIBAAKCAQEAwqVYYrx/8ASMru+K70J3J0maisrKTegrw9aZlfcH7eTx4Vbf\n"
+    "Y1e/b4Erm+SwA6ERwIBXb/XbmIAa9ezm+rkayGOAdfAnKwo4UHAuII8fMto5fT3m\n"
+    "JvqmA96OOBWAawatEAp60ICrG/6l/WfjMP1VIsOucevFvO+ixB0EKBIE+JMUrmoM\n"
+    "AaFUZHjw+n2ACpk+F0t8fjtL/qxxEk3LChesjGnYKe4d3h9W/JCU80sfCVfWc6vv\n"
+    "psY6MaoWwVT+Zw83toYUiHgpAr0q8e3n5ICkuAEF2uf2eOBogLtU3111KnYnPa8c\n"
+    "A9HnZ2ozRJZ2Xu7I6JP9Mrqrx/toUqqTb2v86QIDAQABAoIBAC1q32DKkx+yMBFx\n"
+    "m32QiLUGG6VfBC2BixS7MkMnzRXZYgcuehl4FBc0kLRjfB6cqsO8LqrVN1QyMBhK\n"
+    "GutN3c38SbE7RChqzhEW2+yE+Mao3Nk4ZEecHLiyaYT0n25ZtHAVwep823BAzwJ+\n"
+    "BykbM45VEpNKbG1VjSktjBa9faNyZiZAEJEjVyla+6R8N4kHV52LbZcLjvJv3IQ2\n"
+    "iPYRrmMyI5C23qTni0vy7yJbAXBo3CqgSlwie9FARBWT7Puu7F4mF1O1c/SnTysw\n"
+    "Tm3e5FzgfHipQbnRVn0w4rDprPMKmPxMnvf/Wkw0zVgNadp1Tc1I6Yj525DEQ07i\n"
+    "2gIn/gECgYEA4jNnY1u2Eu7x3pAQF3dRO0x35boVtuq9iwQk7q+uaZaK4RJRr+0Y\n"
+    "T68S3bPnfer6SHvcxtST89Bvs/j/Ky4SOaX037UYjFh6T7OIzPl+MzO1yb+VOBT6\n"
+    "D6FVGEJGp8ZAITU1OfJPeTYViUeEC8tHFGoKUCk50FbB6jOf1oKtv/ECgYEA3EnB\n"
+    "Y7kSbJJaUuj9ciFUL/pAno86Cim3VjegK1wKgEiyDb610bhoMErovPwfVJbtcttG\n"
+    "eKJNuwizkRcVbj+vpjDvqqaP5eMxLl6/Nd4haPMJYzGo88Z8NJpwFRNF2KEWjOpQ\n"
+    "2NEvoCeRtVulCJyka2Tpljzw8cOXkxhPOe2UhHkCgYBo3entj0QO7QXm56T+LAvV\n"
+    "0PK45xdQEO3EuCwjGAFk5C0IgUSrqeCeeIzniZMltj1IQ1wsNbtNynEu3530t8wt\n"
+    "O7oVyFBUKGSz9IjUdkpClJOPr6kPMfJoMqRPtdIpz+hFPPSrI6IikKdVWHloOlp+\n"
+    "pVaYqTQrWT1XRY2xli3VEQKBgGySmZN6Cx+h/oywswIGdUT0VdcQhq2to+QFpJba\n"
+    "VX6m1cM6hMip2Ag9U3qZ1SNPBBdBBfm9HQybHE3dj713/C2wHuAAGhpXIM1W+20k\n"
+    "X1knuC/AsSH9aQhQOf/ZMOq1crTfZBuI9q0782/sjGmzMsKPySU4QhUWruVb7OiD\n"
+    "NVkZAoGAEvihW7G+8/iOE40vGHyBqUeopAAWLciTAUIEwM/Oi3BYfNWNTWF/FWNc\n"
+    "nMvCZPYigY8C1vO+1iT2Frtd3CIU+f01Q3fJNJoRLlEiKLNZUJRF48OKUqjKSmsi\n"
+    "w6pucFO40z05YW7utApj4L82rZnOS0pd1tUI1yexqvj0i4ThJfk=\n"
+    "-----END RSA PRIVATE KEY-----\n";
+
+static const char *PERMISSIONS_CA =
+    "data:,-----BEGIN CERTIFICATE-----\n"
+    "MIIDjTCCAnWgAwIBAgIJANsr3sm0NrypMA0GCSqGSIb3DQEBCwUAMFwxCzAJBgNV\n"
+    "BAYTAk5MMRMwEQYDVQQIDApTb21lLVN0YXRlMR8wHQYDVQQKDBZBRExJTksgVGVj\n"
+    "aG5vbG9jeSBJbmMuMRcwFQYDVQQDDA5hZGxpbmt0ZWNoLmNvbTAgFw0xODA3MzAx\n"
+    "MjQ1NTVaGA8yMTE4MDcwNjEyNDU1NVowXDELMAkGA1UEBhMCTkwxEzARBgNVBAgM\n"
+    "ClNvbWUtU3RhdGUxHzAdBgNVBAoMFkFETElOSyBUZWNobm9sb2N5IEluYy4xFzAV\n"
+    "BgNVBAMMDmFkbGlua3RlY2guY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB\n"
+    "CgKCAQEAu7jfnJ0wYVuXgG+PgNawdN38+dRpa8jceqi+blIDehV6XCxrnGXusTCD\n"
+    "uFmo7HMOBVMVNDXlcBWgoGd+u5EultnOEiIeGTgtHc1O6V9wicp3BGSpZZax/TcO\n"
+    "NjMVORaqHCADbQ2J8wsz1FHxuKDwX6BJElYOlK77lb/x3yLsDFFC+a0qn2RFh37r\n"
+    "cWBRAHy8VEASXKZElT9ZmfKd+KUq34KojhNJ4DepKStTq074BRDXVivx+wVD951L\n"
+    "FNPiQXq+mgHcLj1k37KlZflTFhdP5oEMtATNsXNJPHlEymiySogRWAmKhysLQudu\n"
+    "kHfNKN+r0FEQMk/hzpYcFeZSOvbfNQIDAQABo1AwTjAdBgNVHQ4EFgQURWMbWvBK\n"
+    "ZwJvRV1/tyc1R82k0+gwHwYDVR0jBBgwFoAURWMbWvBKZwJvRV1/tyc1R82k0+gw\n"
+    "DAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAQEAkPF+ysVtvHnk2hpu9yND\n"
+    "LCJ96ZzIoKOyY7uRj4ovzlAHFdpNOJQdcJihTmN8i7Trht9XVh0rGoR/6nHzo3TI\n"
+    "eiogRC80RlDtuA3PF2dDQBMVDStlZMTZPb693hfjdAjhyyw9yghhKHHqNDvSsAL0\n"
+    "KfBqjG4yGfGpJylYXIT5fWuKlo/ln/yyPa5s54T5XDo+CMbtlLX3QnwVOmaRyzyl\n"
+    "PiTcPCDIkdLBdXmlfyJcmW6fWa6kPx+35MOxPsXZbujCo+42+OyLqcH1rKT6Xhcs\n"
+    "hjXBEf+kdgUfSClrM1pNRWsw2ChIYim0F+nry5JFy0Y+8Hbb6SDB340BFmtgDHbF\n"
+    "HQ==\n"
+    "-----END CERTIFICATE-----\n";
+
+static struct plugins_hdl *plugins = NULL;
+static dds_security_access_control *access_control = NULL;
+static dds_security_authentication *auth = NULL;
+static DDS_Security_IdentityHandle local_identity_handle = DDS_SECURITY_HANDLE_NIL;
+static DDS_Security_PermissionsHandle local_permissions_handle = DDS_SECURITY_HANDLE_NIL;
+static DDS_Security_GUID_t local_participant_guid;
+static char *g_path_to_etc_dir = NULL;
+
+typedef enum SEC_TOPIC_NAME
+{
+  SEC_TOPIC_DCPSPARTICIPANTSECURE,
+  SEC_TOPIC_DCPSPUBLICATIONSSECURE,
+  SEC_TOPIC_DCPSSUBSCRIPTIONSSECURE,
+  SEC_TOPIC_DCPSPARTICIPANTMESSAGESECURE,
+  SEC_TOPIC_DCPSPARTICIPANTSTATELESSMESSAGE,
+  SEC_TOPIC_DCPSPARTICIPANTVOLATILEMESSAGESECURE,
+  SEC_TOPIC_DCPS_KINEMATICS,
+  SEC_TOPIC_DCPS_OWNSHIPDATA,
+  SEC_TOPIC_DCPS_SHAPE
+} SEC_TOPIC_TYPE;
+
+const char *TOPIC_NAMES[] = {"DCPSParticipantsSecure",
+                             "DCPSPublicationsSecure",
+                             "DCPSSubscriptionsSecure",
+                             "DCPSParticipantMessageSecure",
+                             "DCPSParticipantStatelessMessage",
+                             "DCPSParticipantVolatileMessageSecure",
+                             "Kinematics",
+                             "OwnShipData",
+                             "Shape"
+
+};
+
+static DDS_Security_EndpointSecurityAttributes ATTRIBUTE_CHECKLIST[9];
+
+static void reset_exception(DDS_Security_SecurityException *ex)
+{
+  ex->code = 0;
+  ex->minor_code = 0;
+  ddsrt_free(ex->message);
+  ex->message = NULL;
+}
+
+static void dds_security_property_init(DDS_Security_PropertySeq *seq, DDS_Security_unsigned_long size)
+{
+  seq->_length = size;
+  seq->_maximum = size;
+  seq->_buffer = ddsrt_malloc(size * sizeof(DDS_Security_Property_t));
+  memset(seq->_buffer, 0, size * sizeof(DDS_Security_Property_t));
+}
+
+static void dds_security_property_deinit(DDS_Security_PropertySeq *seq)
+{
+  uint32_t i;
+  for (i = 0; i < seq->_length; i++)
+  {
+    ddsrt_free(seq->_buffer[i].name);
+    ddsrt_free(seq->_buffer[i].value);
+  }
+  ddsrt_free(seq->_buffer);
+}
+
+static void fill_participant_qos(DDS_Security_Qos *qos, const char *permission_filename,
+                                 const char *governance_filename)
+{
+  char *permission_uri;
+  char *governance_uri;
+
+  ddsrt_asprintf(&permission_uri, "file:%s%s", g_path_to_etc_dir, permission_filename);
+  ddsrt_asprintf(&governance_uri, "file:%s%s", g_path_to_etc_dir, governance_filename);
+
+  memset(qos, 0, sizeof(*qos));
+  dds_security_property_init(&qos->property.value, 6);
+  qos->property.value._buffer[0].name = ddsrt_strdup(PROPERTY_IDENTITY_CERT);
+  qos->property.value._buffer[0].value = ddsrt_strdup(IDENTITY_CERTIFICATE);
+  qos->property.value._buffer[1].name = ddsrt_strdup(PROPERTY_IDENTITY_CA);
+  qos->property.value._buffer[1].value = ddsrt_strdup(IDENTITY_CA);
+  qos->property.value._buffer[2].name = ddsrt_strdup(PROPERTY_PRIVATE_KEY);
+  qos->property.value._buffer[2].value = ddsrt_strdup(PRIVATE_KEY);
+  qos->property.value._buffer[3].name = ddsrt_strdup(PROPERTY_PERMISSIONS_CA);
+  qos->property.value._buffer[3].value = ddsrt_strdup(PERMISSIONS_CA);
+  qos->property.value._buffer[4].name = ddsrt_strdup(PROPERTY_PERMISSIONS);
+  qos->property.value._buffer[4].value = ddsrt_strdup(permission_uri);
+  qos->property.value._buffer[5].name = ddsrt_strdup(PROPERTY_GOVERNANCE);
+  qos->property.value._buffer[5].value = ddsrt_strdup(governance_uri);
+
+  ddsrt_free(permission_uri);
+  ddsrt_free(governance_uri);
+}
+
+static bool create_local_identity(DDS_Security_DomainId domain_id, const char *governance_file)
+{
+  DDS_Security_ValidationResult_t result;
+  DDS_Security_Qos participant_qos;
+  DDS_Security_GUID_t candidate_participant_guid;
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  DDS_Security_GuidPrefix_t prefix = {0xb0, 0xb1, 0xb2, 0xb3, 0xb4, 0xb5, 0xb6, 0xb7, 0xb8, 0xb9, 0xba, 0xbb};
+  DDS_Security_EntityId_t entityId = {{0xb0, 0xb1, 0xb2}, 0x1};
+
+  memset(&local_participant_guid, 0, sizeof(local_participant_guid));
+  memcpy(&candidate_participant_guid.prefix, &prefix, sizeof(prefix));
+  memcpy(&candidate_participant_guid.entityId, &entityId, sizeof(entityId));
+
+  fill_participant_qos(&participant_qos, "Test_Permissions_ok.p7s", governance_file);
+
+  /* Now call the function. */
+  result = auth->validate_local_identity(
+      auth,
+      &local_identity_handle,
+      &local_participant_guid,
+      domain_id,
+      &participant_qos,
+      &candidate_participant_guid,
+      &exception);
+
+  if (result != DDS_SECURITY_VALIDATION_OK)
+  {
+    printf("[ERROR] validate_local_identity_failed: %s\n", exception.message ? exception.message : "Error message missing");
+    return false;
+  }
+
+  local_permissions_handle = access_control->validate_local_permissions(
+      access_control,
+      auth,
+      local_identity_handle,
+      domain_id,
+      &participant_qos,
+      &exception);
+
+  if (local_permissions_handle == DDS_SECURITY_HANDLE_NIL)
+  {
+    printf("[ERROR] validate_local_identity_failed: %s\n", exception.message ? exception.message : "Error message missing");
+    return false;
+  }
+
+  dds_security_property_deinit(&participant_qos.property.value);
+
+  return true;
+}
+
+static void clear_local_identity(void)
+{
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  DDS_Security_boolean success;
+
+  if (local_identity_handle != DDS_SECURITY_HANDLE_NIL)
+  {
+    success = auth->return_identity_handle(auth, local_identity_handle, &exception);
+    if (!success)
+    {
+      printf("return_identity_handle failed: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+    reset_exception(&exception);
+  }
+
+  if (local_permissions_handle != DDS_SECURITY_HANDLE_NIL)
+  {
+    success = access_control->return_permissions_handle(access_control, local_permissions_handle, &exception);
+    if (!success)
+    {
+      printf("return_permissions_handle failed: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+    reset_exception(&exception);
+  }
+
+  local_identity_handle = DDS_SECURITY_HANDLE_NIL;
+  local_permissions_handle = DDS_SECURITY_HANDLE_NIL;
+}
+
+static void set_path_to_etc_dir(void)
+{
+  ddsrt_asprintf(&g_path_to_etc_dir, "%s%s", CONFIG_ENV_TESTS_DIR, RELATIVE_PATH_TO_ETC_DIR);
+}
+
+static DDS_Security_PluginEndpointSecurityAttributesMask get_plugin_endpoint_security_attributes_mask(DDS_Security_boolean is_payload_encrypted, DDS_Security_boolean is_submessage_encrypted, DDS_Security_boolean is_submessage_origin_authenticated)
+{
+  DDS_Security_PluginEndpointSecurityAttributesMask mask = DDS_SECURITY_ENDPOINT_ATTRIBUTES_FLAG_IS_VALID;
+  if (is_submessage_encrypted)
+    mask |= DDS_SECURITY_PLUGIN_ENDPOINT_ATTRIBUTES_FLAG_IS_SUBMESSAGE_ENCRYPTED;
+  if (is_payload_encrypted)
+    mask |= DDS_SECURITY_PLUGIN_ENDPOINT_ATTRIBUTES_FLAG_IS_PAYLOAD_ENCRYPTED;
+  if (is_submessage_origin_authenticated)
+    mask |= DDS_SECURITY_PLUGIN_ENDPOINT_ATTRIBUTES_FLAG_IS_SUBMESSAGE_ORIGIN_AUTHENTICATED;
+  return mask;
+}
+
+static void suite_get_xxx_sec_attributes_init(void)
+{
+  set_path_to_etc_dir();
+
+  ATTRIBUTE_CHECKLIST[SEC_TOPIC_DCPSPARTICIPANTSECURE].is_read_protected =
+      ATTRIBUTE_CHECKLIST[SEC_TOPIC_DCPSPUBLICATIONSSECURE].is_read_protected =
+          ATTRIBUTE_CHECKLIST[SEC_TOPIC_DCPSSUBSCRIPTIONSSECURE].is_read_protected =
+              ATTRIBUTE_CHECKLIST[SEC_TOPIC_DCPSPARTICIPANTMESSAGESECURE].is_read_protected =
+                  ATTRIBUTE_CHECKLIST[SEC_TOPIC_DCPSPARTICIPANTSTATELESSMESSAGE].is_read_protected =
+                      ATTRIBUTE_CHECKLIST[SEC_TOPIC_DCPSPARTICIPANTVOLATILEMESSAGESECURE].is_read_protected = false;
+
+  ATTRIBUTE_CHECKLIST[SEC_TOPIC_DCPSPARTICIPANTSECURE].is_write_protected =
+      ATTRIBUTE_CHECKLIST[SEC_TOPIC_DCPSPUBLICATIONSSECURE].is_write_protected =
+          ATTRIBUTE_CHECKLIST[SEC_TOPIC_DCPSSUBSCRIPTIONSSECURE].is_write_protected =
+              ATTRIBUTE_CHECKLIST[SEC_TOPIC_DCPSPARTICIPANTMESSAGESECURE].is_write_protected =
+                  ATTRIBUTE_CHECKLIST[SEC_TOPIC_DCPSPARTICIPANTSTATELESSMESSAGE].is_write_protected =
+                      ATTRIBUTE_CHECKLIST[SEC_TOPIC_DCPSPARTICIPANTVOLATILEMESSAGESECURE].is_write_protected = false;
+
+  ATTRIBUTE_CHECKLIST[SEC_TOPIC_DCPSPARTICIPANTSECURE].is_payload_protected =
+      ATTRIBUTE_CHECKLIST[SEC_TOPIC_DCPSPUBLICATIONSSECURE].is_payload_protected =
+          ATTRIBUTE_CHECKLIST[SEC_TOPIC_DCPSSUBSCRIPTIONSSECURE].is_payload_protected =
+              ATTRIBUTE_CHECKLIST[SEC_TOPIC_DCPSPARTICIPANTMESSAGESECURE].is_payload_protected =
+                  ATTRIBUTE_CHECKLIST[SEC_TOPIC_DCPSPARTICIPANTSTATELESSMESSAGE].is_payload_protected =
+                      ATTRIBUTE_CHECKLIST[SEC_TOPIC_DCPSPARTICIPANTVOLATILEMESSAGESECURE].is_payload_protected = false;
+
+  ATTRIBUTE_CHECKLIST[SEC_TOPIC_DCPSPARTICIPANTSECURE].is_key_protected =
+      ATTRIBUTE_CHECKLIST[SEC_TOPIC_DCPSPUBLICATIONSSECURE].is_key_protected =
+          ATTRIBUTE_CHECKLIST[SEC_TOPIC_DCPSSUBSCRIPTIONSSECURE].is_key_protected =
+              ATTRIBUTE_CHECKLIST[SEC_TOPIC_DCPSPARTICIPANTMESSAGESECURE].is_key_protected =
+                  ATTRIBUTE_CHECKLIST[SEC_TOPIC_DCPSPARTICIPANTSTATELESSMESSAGE].is_key_protected =
+                      ATTRIBUTE_CHECKLIST[SEC_TOPIC_DCPSPARTICIPANTVOLATILEMESSAGESECURE].is_key_protected = false;
+
+  ATTRIBUTE_CHECKLIST[SEC_TOPIC_DCPSPARTICIPANTSECURE].is_submessage_protected =
+      ATTRIBUTE_CHECKLIST[SEC_TOPIC_DCPSPUBLICATIONSSECURE].is_submessage_protected =
+          ATTRIBUTE_CHECKLIST[SEC_TOPIC_DCPSSUBSCRIPTIONSSECURE].is_submessage_protected =
+              ATTRIBUTE_CHECKLIST[SEC_TOPIC_DCPSPARTICIPANTMESSAGESECURE].is_submessage_protected = true;
+
+  ATTRIBUTE_CHECKLIST[SEC_TOPIC_DCPSPARTICIPANTSTATELESSMESSAGE].is_submessage_protected = false;
+  ATTRIBUTE_CHECKLIST[SEC_TOPIC_DCPSPARTICIPANTVOLATILEMESSAGESECURE].is_submessage_protected = true;
+
+  ATTRIBUTE_CHECKLIST[SEC_TOPIC_DCPS_KINEMATICS].is_read_protected = true;
+  ATTRIBUTE_CHECKLIST[SEC_TOPIC_DCPS_KINEMATICS].is_write_protected = false;
+  ATTRIBUTE_CHECKLIST[SEC_TOPIC_DCPS_KINEMATICS].is_discovery_protected = true;
+  ATTRIBUTE_CHECKLIST[SEC_TOPIC_DCPS_KINEMATICS].is_liveliness_protected = true;
+  ATTRIBUTE_CHECKLIST[SEC_TOPIC_DCPS_KINEMATICS].is_submessage_protected = false;
+  ATTRIBUTE_CHECKLIST[SEC_TOPIC_DCPS_KINEMATICS].is_payload_protected = false;
+  ATTRIBUTE_CHECKLIST[SEC_TOPIC_DCPS_KINEMATICS].is_key_protected = false;
+
+  ATTRIBUTE_CHECKLIST[SEC_TOPIC_DCPS_KINEMATICS].plugin_endpoint_attributes =
+      get_plugin_endpoint_security_attributes_mask(false, false, false);
+
+  ATTRIBUTE_CHECKLIST[SEC_TOPIC_DCPS_OWNSHIPDATA].is_read_protected = false;
+  ATTRIBUTE_CHECKLIST[SEC_TOPIC_DCPS_OWNSHIPDATA].is_write_protected = true;
+  ATTRIBUTE_CHECKLIST[SEC_TOPIC_DCPS_OWNSHIPDATA].is_discovery_protected = false;
+  ATTRIBUTE_CHECKLIST[SEC_TOPIC_DCPS_OWNSHIPDATA].is_liveliness_protected = false;
+  ATTRIBUTE_CHECKLIST[SEC_TOPIC_DCPS_OWNSHIPDATA].is_submessage_protected = true;
+  ATTRIBUTE_CHECKLIST[SEC_TOPIC_DCPS_OWNSHIPDATA].is_payload_protected = true;
+  ATTRIBUTE_CHECKLIST[SEC_TOPIC_DCPS_OWNSHIPDATA].is_key_protected = true;
+
+  ATTRIBUTE_CHECKLIST[SEC_TOPIC_DCPS_OWNSHIPDATA].plugin_endpoint_attributes =
+      get_plugin_endpoint_security_attributes_mask(true, false, false);
+
+  ATTRIBUTE_CHECKLIST[SEC_TOPIC_DCPS_SHAPE].is_read_protected = false;
+  ATTRIBUTE_CHECKLIST[SEC_TOPIC_DCPS_SHAPE].is_write_protected = false;
+  ATTRIBUTE_CHECKLIST[SEC_TOPIC_DCPS_SHAPE].is_discovery_protected = true;
+  ATTRIBUTE_CHECKLIST[SEC_TOPIC_DCPS_SHAPE].is_liveliness_protected = true;
+  ATTRIBUTE_CHECKLIST[SEC_TOPIC_DCPS_SHAPE].is_submessage_protected = true;
+  ATTRIBUTE_CHECKLIST[SEC_TOPIC_DCPS_SHAPE].is_payload_protected = true;
+  ATTRIBUTE_CHECKLIST[SEC_TOPIC_DCPS_SHAPE].is_key_protected = true;
+
+  ATTRIBUTE_CHECKLIST[SEC_TOPIC_DCPS_SHAPE].plugin_endpoint_attributes =
+      get_plugin_endpoint_security_attributes_mask(true, true, true);
+}
+
+static void suite_get_xxx_sec_attributes_fini(void)
+{
+  ddsrt_free(g_path_to_etc_dir);
+}
+
+static bool plugins_init(void)
+{
+  /* Checking AccessControl, but needing Authentication to setup local identity. */
+  plugins = load_plugins(&access_control, &auth, NULL /* Cryptograpy */);
+  return plugins ? true : false;
+}
+
+static void plugins_fini(void)
+{
+  unload_plugins(plugins);
+}
+
+static bool
+verify_endpoint_attributes(SEC_TOPIC_TYPE topic_type, DDS_Security_EndpointSecurityAttributes *attributes)
+{
+  bool result = true;
+  if (attributes->is_read_protected != ATTRIBUTE_CHECKLIST[topic_type].is_read_protected ||
+      attributes->is_write_protected != ATTRIBUTE_CHECKLIST[topic_type].is_write_protected ||
+      attributes->is_submessage_protected != ATTRIBUTE_CHECKLIST[topic_type].is_submessage_protected ||
+      attributes->is_payload_protected != ATTRIBUTE_CHECKLIST[topic_type].is_payload_protected ||
+      attributes->is_key_protected != ATTRIBUTE_CHECKLIST[topic_type].is_key_protected)
+  {
+
+    result = false;
+  }
+  if (topic_type == SEC_TOPIC_DCPS_KINEMATICS || topic_type == SEC_TOPIC_DCPS_SHAPE)
+  {
+    if (attributes->is_discovery_protected != ATTRIBUTE_CHECKLIST[topic_type].is_discovery_protected ||
+        attributes->is_liveliness_protected != ATTRIBUTE_CHECKLIST[topic_type].is_liveliness_protected ||
+        attributes->plugin_endpoint_attributes != ATTRIBUTE_CHECKLIST[topic_type].plugin_endpoint_attributes)
+    {
+      result = false;
+    }
+  }
+
+  if (!result)
+  {
+    printf("Invalid attribute for Topic: %s\n", TOPIC_NAMES[topic_type]);
+    printf("is_read_protected: EXPECTED: %d ACTUAL: %d\n"
+           "is_write_protected: EXPECTED: %d ACTUAL: %d\n"
+           "is_discovery_protected: EXPECTED: %d ACTUAL: %d\n"
+           "is_liveliness_protected: EXPECTED: %d ACTUAL: %d\n"
+           "is_submessage_protected: EXPECTED: %d ACTUAL: %d\n"
+           "is_payload_protected: EXPECTED: %d ACTUAL: %d\n"
+           "is_key_protected: EXPECTED: %d ACTUAL: %d\n",
+           ATTRIBUTE_CHECKLIST[topic_type].is_read_protected, attributes->is_read_protected,
+           ATTRIBUTE_CHECKLIST[topic_type].is_write_protected, attributes->is_write_protected,
+           ATTRIBUTE_CHECKLIST[topic_type].is_discovery_protected, attributes->is_discovery_protected,
+           ATTRIBUTE_CHECKLIST[topic_type].is_liveliness_protected, attributes->is_liveliness_protected,
+           ATTRIBUTE_CHECKLIST[topic_type].is_submessage_protected, attributes->is_submessage_protected,
+           ATTRIBUTE_CHECKLIST[topic_type].is_payload_protected, attributes->is_payload_protected,
+           ATTRIBUTE_CHECKLIST[topic_type].is_key_protected, attributes->is_key_protected);
+  }
+
+  return result;
+}
+
+static bool verify_topic_attributes(SEC_TOPIC_TYPE topic_type, DDS_Security_TopicSecurityAttributes *attributes)
+{
+  bool result = true;
+  if (attributes->is_read_protected != ATTRIBUTE_CHECKLIST[topic_type].is_read_protected ||
+      attributes->is_write_protected != ATTRIBUTE_CHECKLIST[topic_type].is_write_protected ||
+      attributes->is_discovery_protected != ATTRIBUTE_CHECKLIST[topic_type].is_discovery_protected ||
+      attributes->is_liveliness_protected != ATTRIBUTE_CHECKLIST[topic_type].is_liveliness_protected)
+  {
+    result = false;
+  }
+
+  if (!result)
+  {
+    printf("Invalid attribute for Topic: %s\n", TOPIC_NAMES[topic_type]);
+    printf("is_read_protected: EXPECTED: %d ACTUAL: %d\n"
+           "is_write_protected: EXPECTED: %d ACTUAL: %d\n"
+           "is_discovery_protected: EXPECTED: %d ACTUAL: %d\n"
+           "is_liveliness_protected: EXPECTED: %d ACTUAL: %d\n",
+           ATTRIBUTE_CHECKLIST[topic_type].is_read_protected, attributes->is_read_protected,
+           ATTRIBUTE_CHECKLIST[topic_type].is_write_protected, attributes->is_write_protected,
+           ATTRIBUTE_CHECKLIST[topic_type].is_discovery_protected, attributes->is_discovery_protected,
+           ATTRIBUTE_CHECKLIST[topic_type].is_liveliness_protected, attributes->is_liveliness_protected);
+  }
+
+  return result;
+}
+
+CU_Test(ddssec_builtin_get_xxx_sec_attributes, participant_happy_day, .init = suite_get_xxx_sec_attributes_init, .fini = suite_get_xxx_sec_attributes_fini)
+{
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  DDS_Security_ParticipantSecurityAttributes attributes;
+  bool result;
+
+  result = plugins_init();
+  CU_ASSERT_FATAL(result);
+  CU_ASSERT_FATAL(access_control != NULL);
+  CU_ASSERT_FATAL(access_control->get_participant_sec_attributes != NULL);
+
+  result = create_local_identity(0, "Test_Governance_full.p7s");
+  CU_ASSERT_FATAL(result);
+
+  memset(&attributes, 0, sizeof(attributes));
+
+  result = access_control->get_participant_sec_attributes(
+      access_control,
+      local_permissions_handle,
+      &attributes,
+      &exception);
+  CU_ASSERT(result);
+
+  /*
+     * Expect these values based on these options, which is the 1st domain rule
+     * in the Test_Governance_full.p7s (selected because of domain id 0):
+     *
+     *    <allow_unauthenticated_participants>false</allow_unauthenticated_participants>
+     *    <enable_join_access_control>true</enable_join_access_control>
+     *    <discovery_protection_kind>SIGN_WITH_ORIGIN_AUTHENTICATION</discovery_protection_kind>
+     *    <liveliness_protection_kind>ENCRYPT</liveliness_protection_kind>
+     *    <rtps_protection_kind>ENCRYPT_WITH_ORIGIN_AUTHENTICATION</rtps_protection_kind>
+     */
+  CU_ASSERT(attributes.allow_unauthenticated_participants == false);
+  CU_ASSERT(attributes.is_access_protected == true);
+  CU_ASSERT(attributes.is_discovery_protected == true);
+  CU_ASSERT(attributes.is_liveliness_protected == true);
+  CU_ASSERT(attributes.is_rtps_protected == true);
+  CU_ASSERT((attributes.plugin_participant_attributes & DDS_SECURITY_PLUGIN_PARTICIPANT_ATTRIBUTES_FLAG_IS_RTPS_ENCRYPTED) == DDS_SECURITY_PLUGIN_PARTICIPANT_ATTRIBUTES_FLAG_IS_RTPS_ENCRYPTED);
+  CU_ASSERT((attributes.plugin_participant_attributes & DDS_SECURITY_PLUGIN_PARTICIPANT_ATTRIBUTES_FLAG_IS_DISCOVERY_ENCRYPTED) == 0);
+  CU_ASSERT((attributes.plugin_participant_attributes & DDS_SECURITY_PLUGIN_PARTICIPANT_ATTRIBUTES_FLAG_IS_LIVELINESS_ENCRYPTED) == DDS_SECURITY_PLUGIN_PARTICIPANT_ATTRIBUTES_FLAG_IS_LIVELINESS_ENCRYPTED);
+  CU_ASSERT((attributes.plugin_participant_attributes & DDS_SECURITY_PLUGIN_PARTICIPANT_ATTRIBUTES_FLAG_IS_RTPS_AUTHENTICATED) == DDS_SECURITY_PLUGIN_PARTICIPANT_ATTRIBUTES_FLAG_IS_RTPS_AUTHENTICATED);
+  CU_ASSERT((attributes.plugin_participant_attributes & DDS_SECURITY_PLUGIN_PARTICIPANT_ATTRIBUTES_FLAG_IS_DISCOVERY_AUTHENTICATED) == DDS_SECURITY_PLUGIN_PARTICIPANT_ATTRIBUTES_FLAG_IS_DISCOVERY_AUTHENTICATED);
+  CU_ASSERT((attributes.plugin_participant_attributes & DDS_SECURITY_PLUGIN_PARTICIPANT_ATTRIBUTES_FLAG_IS_LIVELINESS_AUTHENTICATED) == 0);
+  CU_ASSERT((attributes.plugin_participant_attributes & DDS_SECURITY_PARTICIPANT_ATTRIBUTES_FLAG_IS_VALID) != 0);
+
+  result = access_control->return_participant_sec_attributes(
+      access_control,
+      &attributes,
+      &exception);
+  CU_ASSERT(result);
+
+  clear_local_identity();
+  plugins_fini();
+}
+
+CU_Test(ddssec_builtin_get_xxx_sec_attributes, datawriter_happy_day, .init = suite_get_xxx_sec_attributes_init, .fini = suite_get_xxx_sec_attributes_fini)
+{
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  DDS_Security_PartitionQosPolicy *partition = NULL;
+  DDS_Security_DataTagQosPolicy data_tag;
+  DDS_Security_EndpointSecurityAttributes attributes;
+  bool result;
+  unsigned i;
+
+  result = plugins_init();
+  CU_ASSERT_FATAL(result);
+  CU_ASSERT_FATAL(access_control != NULL);
+  CU_ASSERT_FATAL(access_control->get_datawriter_sec_attributes != NULL);
+
+  result = create_local_identity(0, "Test_Governance_full.p7s");
+  CU_ASSERT_FATAL(result);
+
+  memset(&attributes, 0, sizeof(attributes));
+
+  /*Test for each builtin topics:
+     "DCPSParticipantsSecure", "DCPSPublicationsSecure", "DCPSSubscriptionsSecure"
+     "DCPSParticipantMessageSecure", "DCPSParticipantStatelessMessage", "DCPSParticipantVolatileMessageSecure"
+    and a sample DCPS topic*/
+
+  /* Now call the function. */
+  for (i = SEC_TOPIC_DCPSPARTICIPANTSECURE; i <= SEC_TOPIC_DCPS_SHAPE; ++i)
+  {
+
+    result = access_control->get_datawriter_sec_attributes(
+        access_control,
+        local_permissions_handle,
+        TOPIC_NAMES[i],
+        partition,
+        &data_tag,
+        &attributes,
+        &exception);
+
+    CU_ASSERT_FATAL(result);
+
+    CU_ASSERT_FATAL(exception.code == DDS_SECURITY_ERR_OK_CODE);
+    CU_ASSERT_FATAL(verify_endpoint_attributes(i, &attributes));
+
+    //reset control values
+    memset(&attributes, 0, sizeof(attributes));
+    reset_exception(&exception);
+  }
+
+  plugins_fini();
+}
+
+CU_Test(ddssec_builtin_get_xxx_sec_attributes, datawriter_non_existing_topic, .init = suite_get_xxx_sec_attributes_init, .fini = suite_get_xxx_sec_attributes_fini)
+{
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  DDS_Security_PartitionQosPolicy *partition = NULL;
+  DDS_Security_DataTagQosPolicy data_tag;
+  DDS_Security_EndpointSecurityAttributes attributes;
+  bool result;
+
+  result = plugins_init();
+  CU_ASSERT_FATAL(result);
+  CU_ASSERT_FATAL(access_control != NULL);
+  CU_ASSERT_FATAL(access_control->get_datawriter_sec_attributes != NULL);
+
+  /* use a different domain(30) to get non matching topic result */
+  result = create_local_identity(30, "Test_Governance_full.p7s");
+  CU_ASSERT_FATAL(result);
+
+  memset(&attributes, 0, sizeof(attributes));
+
+  /* Now call the function. */
+  result = access_control->get_datawriter_sec_attributes(
+      access_control,
+      local_permissions_handle,
+      TOPIC_NAMES[SEC_TOPIC_DCPS_SHAPE],
+      partition,
+      &data_tag,
+      &attributes,
+      &exception);
+
+  CU_ASSERT_FATAL(!result);
+
+  CU_ASSERT_FATAL(exception.code == DDS_SECURITY_ERR_CAN_NOT_FIND_TOPIC_IN_DOMAIN_CODE);
+
+  //reset control values
+  memset(&attributes, 0, sizeof(attributes));
+  reset_exception(&exception);
+
+  plugins_fini();
+}
+
+CU_Test(ddssec_builtin_get_xxx_sec_attributes, datareader_happy_day, .init = suite_get_xxx_sec_attributes_init, .fini = suite_get_xxx_sec_attributes_fini)
+{
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  DDS_Security_PartitionQosPolicy *partition = NULL;
+  DDS_Security_DataTagQosPolicy data_tag;
+  DDS_Security_EndpointSecurityAttributes attributes;
+  bool result;
+  unsigned i;
+
+  result = plugins_init();
+  CU_ASSERT_FATAL(result);
+  CU_ASSERT_FATAL(access_control != NULL);
+  CU_ASSERT_FATAL(access_control->get_datareader_sec_attributes != NULL);
+
+  result = create_local_identity(0, "Test_Governance_full.p7s");
+  CU_ASSERT_FATAL(result);
+
+  memset(&attributes, 0, sizeof(attributes));
+
+  /*Test for each builtin topics:
+     "DCPSParticipantSecure", "DCPSPublicationsSecure", "DCPSSubscriptionsSecure"
+     "DCPSParticipantMessageSecure", "DCPSParticipantStatelessMessage", "DCPSParticipantVolatileMessageSecure"
+     and a sample DCPS topic*/
+
+  /* Now call the function. */
+  for (i = SEC_TOPIC_DCPSPARTICIPANTSECURE; i <= SEC_TOPIC_DCPS_SHAPE; ++i)
+  {
+
+    result = access_control->get_datareader_sec_attributes(
+        access_control,
+        local_permissions_handle,
+        TOPIC_NAMES[i],
+        partition,
+        &data_tag,
+        &attributes,
+        &exception);
+
+    CU_ASSERT_FATAL(result);
+
+    CU_ASSERT_FATAL(exception.code == DDS_SECURITY_ERR_OK_CODE);
+    CU_ASSERT_FATAL(verify_endpoint_attributes(i, &attributes) == true);
+
+    //reset control values
+    memset(&attributes, 0, sizeof(attributes));
+    reset_exception(&exception);
+  }
+
+  plugins_fini();
+}
+
+CU_Test(ddssec_builtin_get_xxx_sec_attributes, datareader_non_existing_topic, .init = suite_get_xxx_sec_attributes_init, .fini = suite_get_xxx_sec_attributes_fini)
+{
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  DDS_Security_PartitionQosPolicy *partition = NULL;
+  DDS_Security_DataTagQosPolicy data_tag;
+  DDS_Security_EndpointSecurityAttributes attributes;
+  bool result;
+
+  result = plugins_init();
+  CU_ASSERT_FATAL(result);
+  CU_ASSERT_FATAL(access_control != NULL);
+  CU_ASSERT_FATAL(access_control->get_datawriter_sec_attributes != NULL);
+
+  /* use a different domain (30) to get non matching topic result */
+  result = create_local_identity(30, "Test_Governance_full.p7s");
+  CU_ASSERT_FATAL(result);
+
+  memset(&attributes, 0, sizeof(attributes));
+
+  result = access_control->get_datareader_sec_attributes(
+      access_control,
+      local_permissions_handle,
+      TOPIC_NAMES[SEC_TOPIC_DCPS_SHAPE],
+      partition,
+      &data_tag,
+      &attributes,
+      &exception);
+
+  CU_ASSERT_FATAL(!result);
+
+  CU_ASSERT_FATAL(exception.code == DDS_SECURITY_ERR_CAN_NOT_FIND_TOPIC_IN_DOMAIN_CODE);
+
+  //reset control values
+  memset(&attributes, 0, sizeof(attributes));
+  reset_exception(&exception);
+
+  plugins_fini();
+}
+
+CU_Test(ddssec_builtin_get_xxx_sec_attributes, participant_invalid_param, .init = suite_get_xxx_sec_attributes_init, .fini = suite_get_xxx_sec_attributes_fini)
+{
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  DDS_Security_ParticipantSecurityAttributes attributes;
+  bool result;
+
+  memset(&attributes, 0, sizeof(attributes));
+
+  result = plugins_init();
+  CU_ASSERT_FATAL(result);
+  CU_ASSERT_FATAL(access_control != NULL);
+  CU_ASSERT_FATAL(access_control->get_participant_sec_attributes != NULL);
+
+  result = access_control->get_participant_sec_attributes(
+      NULL,
+      local_permissions_handle,
+      &attributes,
+      &exception);
+  CU_ASSERT(!result);
+  CU_ASSERT(exception.code == DDS_SECURITY_ERR_INVALID_PARAMETER_CODE);
+  memset(&attributes, 0, sizeof(attributes));
+  reset_exception(&exception);
+
+  result = access_control->get_participant_sec_attributes(
+      access_control,
+      0,
+      &attributes,
+      &exception);
+  CU_ASSERT(!result);
+  CU_ASSERT(exception.code == DDS_SECURITY_ERR_INVALID_PARAMETER_CODE);
+  memset(&attributes, 0, sizeof(attributes));
+  reset_exception(&exception);
+
+  result = access_control->get_participant_sec_attributes(
+      access_control,
+      local_permissions_handle,
+      NULL,
+      &exception);
+  CU_ASSERT(!result);
+  CU_ASSERT(exception.code == DDS_SECURITY_ERR_INVALID_PARAMETER_CODE);
+  memset(&attributes, 0, sizeof(attributes));
+  reset_exception(&exception);
+
+  result = access_control->get_participant_sec_attributes(
+      access_control,
+      local_permissions_handle + 12345,
+      &attributes,
+      &exception);
+  CU_ASSERT(!result);
+  CU_ASSERT(exception.code == DDS_SECURITY_ERR_INVALID_PARAMETER_CODE);
+  memset(&attributes, 0, sizeof(attributes));
+  reset_exception(&exception);
+
+  plugins_fini();
+}
+
+CU_Test(ddssec_builtin_get_xxx_sec_attributes, datareader_invalid_param, .init = suite_get_xxx_sec_attributes_init, .fini = suite_get_xxx_sec_attributes_fini)
+{
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  DDS_Security_PartitionQosPolicy *partition = NULL;
+  DDS_Security_DataTagQosPolicy data_tag;
+  DDS_Security_EndpointSecurityAttributes attributes;
+  bool result;
+
+  result = plugins_init();
+  CU_ASSERT_FATAL(result);
+  CU_ASSERT_FATAL(access_control != NULL);
+  CU_ASSERT_FATAL(access_control->get_datareader_sec_attributes != NULL);
+
+  memset(&attributes, 0, sizeof(attributes));
+
+  /* Now call the function. */
+
+  result = access_control->get_datareader_sec_attributes(
+      access_control,
+      local_permissions_handle,
+      NULL,
+      partition,
+      &data_tag,
+      &attributes,
+      &exception);
+
+  CU_ASSERT_FATAL(!result);
+  CU_ASSERT_FATAL(exception.code == DDS_SECURITY_ERR_INVALID_PARAMETER_CODE);
+
+  //reset control values
+  memset(&attributes, 0, sizeof(attributes));
+  reset_exception(&exception);
+
+  result = access_control->get_datareader_sec_attributes(
+      access_control,
+      local_permissions_handle,
+      "",
+      partition,
+      &data_tag,
+      &attributes,
+      &exception);
+
+  CU_ASSERT_FATAL(!result);
+  CU_ASSERT_FATAL(exception.code == DDS_SECURITY_ERR_INVALID_PARAMETER_CODE);
+
+  //reset control values
+  memset(&attributes, 0, sizeof(attributes));
+  reset_exception(&exception);
+
+  result = access_control->get_datareader_sec_attributes(
+      access_control,
+      local_permissions_handle,
+      "Shape",
+      partition,
+      &data_tag,
+      NULL,
+      &exception);
+
+  CU_ASSERT_FATAL(!result);
+  CU_ASSERT_FATAL(exception.code == DDS_SECURITY_ERR_INVALID_PARAMETER_CODE);
+
+  //reset control values
+  memset(&attributes, 0, sizeof(attributes));
+  reset_exception(&exception);
+
+  result = access_control->get_datareader_sec_attributes(
+      access_control,
+      local_permissions_handle + 12345,
+      "Shape",
+      partition,
+      &data_tag,
+      &attributes,
+      &exception);
+
+  CU_ASSERT_FATAL(!result);
+  CU_ASSERT_FATAL(exception.code == DDS_SECURITY_ERR_INVALID_PARAMETER_CODE);
+
+  //reset control values
+  memset(&attributes, 0, sizeof(attributes));
+  reset_exception(&exception);
+
+  plugins_fini();
+}
+
+CU_Test(ddssec_builtin_get_xxx_sec_attributes, datawriter_invalid_param, .init = suite_get_xxx_sec_attributes_init, .fini = suite_get_xxx_sec_attributes_fini)
+{
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  DDS_Security_PartitionQosPolicy *partition = NULL;
+  DDS_Security_DataTagQosPolicy data_tag;
+  DDS_Security_EndpointSecurityAttributes attributes;
+  bool result;
+
+  result = plugins_init();
+  CU_ASSERT_FATAL(result);
+  CU_ASSERT_FATAL(access_control != NULL);
+  CU_ASSERT_FATAL(access_control->get_datawriter_sec_attributes != NULL);
+
+  memset(&attributes, 0, sizeof(attributes));
+
+  /* Now call the function. */
+
+  result = access_control->get_datawriter_sec_attributes(
+      access_control,
+      local_permissions_handle,
+      NULL,
+      partition,
+      &data_tag,
+      &attributes,
+      &exception);
+
+  CU_ASSERT_FATAL(!result);
+  CU_ASSERT_FATAL(exception.code == DDS_SECURITY_ERR_INVALID_PARAMETER_CODE);
+
+  //reset control values
+  memset(&attributes, 0, sizeof(attributes));
+  reset_exception(&exception);
+
+  result = access_control->get_datawriter_sec_attributes(
+      access_control,
+      local_permissions_handle,
+      "",
+      partition,
+      &data_tag,
+      &attributes,
+      &exception);
+
+  CU_ASSERT_FATAL(!result);
+  CU_ASSERT_FATAL(exception.code == DDS_SECURITY_ERR_INVALID_PARAMETER_CODE);
+
+  //reset control values
+  memset(&attributes, 0, sizeof(attributes));
+  reset_exception(&exception);
+
+  result = access_control->get_datawriter_sec_attributes(
+      access_control,
+      local_permissions_handle,
+      "Shape",
+      partition,
+      &data_tag,
+      NULL,
+      &exception);
+
+  CU_ASSERT_FATAL(!result);
+  CU_ASSERT_FATAL(exception.code == DDS_SECURITY_ERR_INVALID_PARAMETER_CODE);
+
+  //reset control values
+  memset(&attributes, 0, sizeof(attributes));
+  reset_exception(&exception);
+
+  result = access_control->get_datawriter_sec_attributes(
+      access_control,
+      local_permissions_handle + 12345,
+      "Shape",
+      partition,
+      &data_tag,
+      &attributes,
+      &exception);
+
+  CU_ASSERT_FATAL(!result);
+  CU_ASSERT_FATAL(exception.code == DDS_SECURITY_ERR_INVALID_PARAMETER_CODE);
+
+  //reset control values
+  memset(&attributes, 0, sizeof(attributes));
+  reset_exception(&exception);
+
+  plugins_fini();
+}
+
+CU_Test(ddssec_builtin_get_xxx_sec_attributes, topic_happy_day, .init = suite_get_xxx_sec_attributes_init, .fini = suite_get_xxx_sec_attributes_fini)
+{
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  DDS_Security_TopicSecurityAttributes attributes;
+  bool result;
+  unsigned i;
+
+  result = plugins_init();
+  CU_ASSERT_FATAL(result);
+  CU_ASSERT_FATAL(access_control != NULL);
+  CU_ASSERT_FATAL(access_control->get_topic_sec_attributes != NULL);
+
+  result = create_local_identity(0, "Test_Governance_full.p7s");
+  CU_ASSERT_FATAL(result);
+
+  memset(&attributes, 0, sizeof(attributes));
+
+  /*Test for each builtin topics:
+     "DCPSParticipantsSecure", "DCPSPublicationsSecure", "DCPSSubscriptionsSecure"
+     "DCPSParticipantMessageSecure", "DCPSParticipantStatelessMessage", "DCPSParticipantVolatileMessageSecure"
+    and a sample DCPS topic*/
+
+  /* Now call the function. */
+  for (i = SEC_TOPIC_DCPS_KINEMATICS; i <= SEC_TOPIC_DCPS_SHAPE; ++i)
+  {
+
+    result = access_control->get_topic_sec_attributes(
+        access_control,
+        local_permissions_handle,
+        TOPIC_NAMES[i],
+        &attributes,
+        &exception);
+
+    CU_ASSERT_FATAL(result);
+
+    CU_ASSERT_FATAL(exception.code == DDS_SECURITY_ERR_OK_CODE);
+    CU_ASSERT_FATAL(verify_topic_attributes(i, &attributes));
+
+    //reset control values
+    memset(&attributes, 0, sizeof(attributes));
+    reset_exception(&exception);
+  }
+
+  plugins_fini();
+}
+
+CU_Test(ddssec_builtin_get_xxx_sec_attributes, topic_non_existing_topic, .init = suite_get_xxx_sec_attributes_init, .fini = suite_get_xxx_sec_attributes_fini)
+{
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  DDS_Security_TopicSecurityAttributes attributes;
+  bool result;
+
+  result = plugins_init();
+  CU_ASSERT_FATAL(result);
+  CU_ASSERT_FATAL(access_control != NULL);
+  CU_ASSERT_FATAL(access_control->get_topic_sec_attributes != NULL);
+
+  result = create_local_identity(30, "Test_Governance_full.p7s");
+  CU_ASSERT_FATAL(result);
+
+  memset(&attributes, 0, sizeof(attributes));
+
+  /*Test for each builtin topics:
+     "DCPSParticipantsSecure", "DCPSPublicationsSecure", "DCPSSubscriptionsSecure"
+     "DCPSParticipantMessageSecure", "DCPSParticipantStatelessMessage", "DCPSParticipantVolatileMessageSecure"
+    and a sample DCPS topic*/
+
+  /* Now call the function. */
+  result = access_control->get_topic_sec_attributes(
+      access_control,
+      local_permissions_handle,
+      TOPIC_NAMES[SEC_TOPIC_DCPS_SHAPE],
+      &attributes,
+      &exception);
+
+  CU_ASSERT_FATAL(!result);
+
+  CU_ASSERT_FATAL(exception.code == DDS_SECURITY_ERR_CAN_NOT_FIND_TOPIC_IN_DOMAIN_CODE);
+
+  //reset control values
+  memset(&attributes, 0, sizeof(attributes));
+  reset_exception(&exception);
+
+  plugins_fini();
+}
+
+CU_Test(ddssec_builtin_get_xxx_sec_attributes, topic_invalid_param, .init = suite_get_xxx_sec_attributes_init, .fini = suite_get_xxx_sec_attributes_fini)
+{
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  DDS_Security_TopicSecurityAttributes attributes;
+  bool result;
+
+  result = plugins_init();
+  CU_ASSERT_FATAL(result);
+  CU_ASSERT_FATAL(access_control != NULL);
+  CU_ASSERT_FATAL(access_control->get_topic_sec_attributes != NULL);
+
+  result = create_local_identity(0, "Test_Governance_full.p7s");
+  CU_ASSERT_FATAL(result);
+
+  memset(&attributes, 0, sizeof(attributes));
+
+  /* Now call the function. */
+
+  result = access_control->get_topic_sec_attributes(
+      access_control,
+      local_permissions_handle,
+      NULL,
+      &attributes,
+      &exception);
+
+  CU_ASSERT_FATAL(!result);
+  CU_ASSERT_FATAL(exception.code == DDS_SECURITY_ERR_INVALID_PARAMETER_CODE);
+
+  //reset control values
+  memset(&attributes, 0, sizeof(attributes));
+  reset_exception(&exception);
+
+  result = access_control->get_topic_sec_attributes(
+      access_control,
+      local_permissions_handle,
+      "",
+      &attributes,
+      &exception);
+
+  CU_ASSERT_FATAL(!result);
+  CU_ASSERT_FATAL(exception.code == DDS_SECURITY_ERR_INVALID_PARAMETER_CODE);
+
+  //reset control values
+  memset(&attributes, 0, sizeof(attributes));
+  reset_exception(&exception);
+
+  result = access_control->get_topic_sec_attributes(
+      access_control,
+      local_permissions_handle,
+      "Shape",
+      NULL,
+      &exception);
+
+  CU_ASSERT_FATAL(!result);
+  CU_ASSERT_FATAL(exception.code == DDS_SECURITY_ERR_INVALID_PARAMETER_CODE);
+
+  //reset control values
+  memset(&attributes, 0, sizeof(attributes));
+  reset_exception(&exception);
+
+  result = access_control->get_topic_sec_attributes(
+      access_control,
+      local_permissions_handle + 12345,
+      "Shape",
+      &attributes,
+      &exception);
+
+  CU_ASSERT_FATAL(!result);
+  CU_ASSERT_FATAL(exception.code == DDS_SECURITY_ERR_INVALID_PARAMETER_CODE);
+
+  //reset control values
+  memset(&attributes, 0, sizeof(attributes));
+  reset_exception(&exception);
+
+  plugins_fini();
+}
+
+CU_Test(ddssec_builtin_get_xxx_sec_attributes, participant_2nd_rule, .init = suite_get_xxx_sec_attributes_init, .fini = suite_get_xxx_sec_attributes_fini)
+{
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  DDS_Security_ParticipantSecurityAttributes attributes;
+  bool result;
+
+  result = plugins_init();
+  CU_ASSERT_FATAL(result);
+  CU_ASSERT_FATAL(access_control != NULL);
+  CU_ASSERT_FATAL(access_control->get_participant_sec_attributes != NULL);
+
+  result = create_local_identity(30, "Test_Governance_full.p7s");
+  CU_ASSERT_FATAL(result);
+
+  memset(&attributes, 0, sizeof(attributes));
+
+  result = access_control->get_participant_sec_attributes(
+      access_control,
+      local_permissions_handle,
+      &attributes,
+      &exception);
+  CU_ASSERT(result);
+
+  /*
+     * Expect these values based on these options, which is the 2nd domain rule
+     * in the Test_Governance_full.p7s (selected because of domain id 30):
+     *
+     *    <allow_unauthenticated_participants>1</allow_unauthenticated_participants>
+     *    <enable_join_access_control>0</enable_join_access_control>
+     *    <discovery_protection_kind>SIGN</discovery_protection_kind>
+     *    <liveliness_protection_kind>ENCRYPT</liveliness_protection_kind>
+     *    <rtps_protection_kind>NONE</rtps_protection_kind>
+     */
+  CU_ASSERT(attributes.allow_unauthenticated_participants == true);
+  CU_ASSERT(attributes.is_access_protected == false);
+  CU_ASSERT(attributes.is_discovery_protected == true);
+  CU_ASSERT(attributes.is_liveliness_protected == true);
+  CU_ASSERT(attributes.is_rtps_protected == false);
+  CU_ASSERT((attributes.plugin_participant_attributes & DDS_SECURITY_PLUGIN_PARTICIPANT_ATTRIBUTES_FLAG_IS_RTPS_ENCRYPTED) ==
+            0);
+  CU_ASSERT((attributes.plugin_participant_attributes & DDS_SECURITY_PLUGIN_PARTICIPANT_ATTRIBUTES_FLAG_IS_DISCOVERY_ENCRYPTED) ==
+            0);
+  CU_ASSERT((attributes.plugin_participant_attributes & DDS_SECURITY_PLUGIN_PARTICIPANT_ATTRIBUTES_FLAG_IS_LIVELINESS_ENCRYPTED) ==
+            DDS_SECURITY_PLUGIN_PARTICIPANT_ATTRIBUTES_FLAG_IS_LIVELINESS_ENCRYPTED);
+  CU_ASSERT((attributes.plugin_participant_attributes & DDS_SECURITY_PLUGIN_PARTICIPANT_ATTRIBUTES_FLAG_IS_RTPS_AUTHENTICATED) ==
+            0);
+  CU_ASSERT((attributes.plugin_participant_attributes & DDS_SECURITY_PLUGIN_PARTICIPANT_ATTRIBUTES_FLAG_IS_DISCOVERY_AUTHENTICATED) ==
+            0);
+  CU_ASSERT((attributes.plugin_participant_attributes & DDS_SECURITY_PLUGIN_PARTICIPANT_ATTRIBUTES_FLAG_IS_LIVELINESS_AUTHENTICATED) ==
+            0);
+
+  result = access_control->return_participant_sec_attributes(
+      access_control,
+      &attributes,
+      &exception);
+  CU_ASSERT(result);
+
+  clear_local_identity();
+  plugins_fini();
+}
+
+static void test_liveliness_discovery_participant_attr(
+    DDS_Security_PermissionsHandle hdl,
+    bool liveliness_protected,
+    DDS_Security_unsigned_long liveliness_mask,
+    bool discovery_protected,
+    DDS_Security_unsigned_long discovery_mask)
+{
+  DDS_Security_unsigned_long mask = DDS_SECURITY_PARTICIPANT_ATTRIBUTES_FLAG_IS_VALID |
+                                    liveliness_mask |
+                                    discovery_mask;
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  DDS_Security_ParticipantSecurityAttributes attr;
+  bool result;
+
+  CU_ASSERT_FATAL(access_control->get_participant_sec_attributes != NULL);
+
+  memset(&attr, 0, sizeof(attr));
+
+  result = access_control->get_participant_sec_attributes(
+      access_control,
+      hdl,
+      &attr,
+      &exception);
+  CU_ASSERT(result);
+
+  CU_ASSERT(attr.allow_unauthenticated_participants == false);
+  CU_ASSERT(attr.is_access_protected == true);
+  CU_ASSERT(attr.is_discovery_protected == discovery_protected);
+  CU_ASSERT(attr.is_liveliness_protected == liveliness_protected);
+  CU_ASSERT(attr.is_rtps_protected == false);
+  CU_ASSERT(attr.plugin_participant_attributes == mask);
+
+  result = access_control->return_participant_sec_attributes(
+      access_control,
+      &attr,
+      &exception);
+  CU_ASSERT(result);
+}
+
+static void test_liveliness_discovery_writer_attr(
+    const char *topic_name,
+    DDS_Security_PermissionsHandle hdl,
+    bool liveliness_protected,
+    bool discovery_protected,
+    bool submsg_protected,
+    DDS_Security_unsigned_long submsg_mask)
+{
+  DDS_Security_unsigned_long mask = DDS_SECURITY_PARTICIPANT_ATTRIBUTES_FLAG_IS_VALID | submsg_mask;
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  DDS_Security_EndpointSecurityAttributes attr;
+  DDS_Security_DataTagQosPolicy data_tag;
+  DDS_Security_PartitionQosPolicy *partition = NULL;
+  bool result;
+
+  CU_ASSERT_FATAL(access_control->get_datawriter_sec_attributes != NULL);
+
+  memset(&attr, 0, sizeof(attr));
+
+  result = access_control->get_datawriter_sec_attributes(
+      access_control,
+      hdl,
+      topic_name,
+      partition,
+      &data_tag,
+      &attr,
+      &exception);
+  CU_ASSERT_FATAL(result);
+
+  CU_ASSERT(attr.is_read_protected == false);
+  CU_ASSERT(attr.is_write_protected == false);
+  CU_ASSERT(attr.is_submessage_protected == submsg_protected);
+  CU_ASSERT(attr.is_payload_protected == false);
+  CU_ASSERT(attr.is_key_protected == false);
+  CU_ASSERT(attr.is_discovery_protected == discovery_protected);
+  CU_ASSERT(attr.is_liveliness_protected == liveliness_protected);
+  CU_ASSERT(attr.plugin_endpoint_attributes == mask);
+
+  result = access_control->return_datawriter_sec_attributes(
+      access_control,
+      &attr,
+      &exception);
+  CU_ASSERT(result);
+}
+
+static void test_liveliness_discovery_reader_attr(
+    const char *topic_name,
+    DDS_Security_PermissionsHandle hdl,
+    bool liveliness_protected,
+    bool discovery_protected,
+    bool submsg_protected,
+    DDS_Security_unsigned_long submsg_mask)
+{
+  DDS_Security_unsigned_long mask = DDS_SECURITY_PARTICIPANT_ATTRIBUTES_FLAG_IS_VALID | submsg_mask;
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  DDS_Security_EndpointSecurityAttributes attr;
+  DDS_Security_DataTagQosPolicy data_tag;
+  DDS_Security_PartitionQosPolicy *partition = NULL;
+  bool result;
+  return;
+  CU_ASSERT_FATAL(access_control->get_datareader_sec_attributes != NULL);
+
+  memset(&attr, 0, sizeof(attr));
+
+  result = access_control->get_datareader_sec_attributes(
+      access_control,
+      hdl,
+      topic_name,
+      partition,
+      &data_tag,
+      &attr,
+      &exception);
+  CU_ASSERT_FATAL(result);
+
+  CU_ASSERT(attr.is_read_protected == false);
+  CU_ASSERT(attr.is_write_protected == false);
+  CU_ASSERT(attr.is_submessage_protected == submsg_protected);
+  CU_ASSERT(attr.is_payload_protected == false);
+  CU_ASSERT(attr.is_key_protected == false);
+  CU_ASSERT(attr.is_discovery_protected == discovery_protected);
+  CU_ASSERT(attr.is_liveliness_protected == liveliness_protected);
+  CU_ASSERT(attr.plugin_endpoint_attributes == mask);
+
+  result = access_control->return_datareader_sec_attributes(
+      access_control,
+      &attr,
+      &exception);
+  CU_ASSERT(result);
+}
+
+static void test_liveliness_discovery_attr(
+    const char *governance,
+    bool liveliness_protected,
+    DDS_Security_unsigned_long liveliness_mask,
+    bool discovery_protected,
+    DDS_Security_unsigned_long discovery_mask)
+{
+  DDS_Security_unsigned_long submsg_liveliness_mask = 0;
+  DDS_Security_unsigned_long submsg_discovery_mask = 0;
+  bool result;
+
+  result = plugins_init();
+  CU_ASSERT_FATAL(result);
+  CU_ASSERT_FATAL(access_control != NULL);
+
+  result = create_local_identity(0, governance);
+  CU_ASSERT_FATAL(result);
+
+  /* For some endpoints, the submsg encryption mask depends on either the
+     * discovery or liveliness mask. */
+  if (liveliness_mask & DDS_SECURITY_PLUGIN_PARTICIPANT_ATTRIBUTES_FLAG_IS_LIVELINESS_ENCRYPTED)
+  {
+    submsg_liveliness_mask |= DDS_SECURITY_PLUGIN_ENDPOINT_ATTRIBUTES_FLAG_IS_SUBMESSAGE_ENCRYPTED;
+  }
+  if (liveliness_mask & DDS_SECURITY_PLUGIN_PARTICIPANT_ATTRIBUTES_FLAG_IS_LIVELINESS_AUTHENTICATED)
+  {
+    submsg_liveliness_mask |= DDS_SECURITY_PLUGIN_ENDPOINT_ATTRIBUTES_FLAG_IS_SUBMESSAGE_ORIGIN_AUTHENTICATED;
+  }
+  if (discovery_mask & DDS_SECURITY_PLUGIN_PARTICIPANT_ATTRIBUTES_FLAG_IS_DISCOVERY_ENCRYPTED)
+  {
+    submsg_discovery_mask |= DDS_SECURITY_PLUGIN_ENDPOINT_ATTRIBUTES_FLAG_IS_SUBMESSAGE_ENCRYPTED;
+  }
+  if (discovery_mask & DDS_SECURITY_PLUGIN_PARTICIPANT_ATTRIBUTES_FLAG_IS_DISCOVERY_AUTHENTICATED)
+  {
+    submsg_discovery_mask |= DDS_SECURITY_PLUGIN_ENDPOINT_ATTRIBUTES_FLAG_IS_SUBMESSAGE_ORIGIN_AUTHENTICATED;
+  }
+
+  /* Participant attributes */
+
+  test_liveliness_discovery_participant_attr(
+      local_permissions_handle,
+      liveliness_protected,
+      liveliness_mask,
+      discovery_protected,
+      discovery_mask);
+
+  /* Writer attributes */
+
+  /* User topic. */
+  test_liveliness_discovery_writer_attr(
+      "Kinematics",
+      local_permissions_handle,
+      liveliness_protected,
+      discovery_protected,
+      false /* submsg_protected     */,
+      0 /* submsg_mask          */);
+
+  /* Builtin topic. */
+  test_liveliness_discovery_writer_attr(
+      "DCPSPublication",
+      local_permissions_handle,
+      false /* liveliness_protected */,
+      false /* discovery_protected  */,
+      false /* submsg_protected     */,
+      0 /* submsg_mask          */);
+
+  /* Security (normal) builtin topic. */
+  test_liveliness_discovery_writer_attr(
+      "DCPSPublicationsSecure",
+      local_permissions_handle,
+      false /* liveliness_protected */,
+      false /* discovery_protected  */,
+      discovery_protected /* submsg_protected     */,
+      submsg_discovery_mask /* submsg_mask          */);
+
+  /* Security (liveliness affected) builtin topic. */
+  test_liveliness_discovery_writer_attr(
+      "DCPSParticipantMessageSecure",
+      local_permissions_handle,
+      false /* liveliness_protected */,
+      false /* discovery_protected  */,
+      liveliness_protected /* submsg_protected     */,
+      submsg_liveliness_mask /* submsg_mask          */);
+
+  /* Reader attributes */
+
+  /* User topic. */
+  test_liveliness_discovery_reader_attr(
+      "Kinematics",
+      local_permissions_handle,
+      liveliness_protected,
+      discovery_protected,
+      false /* submsg_protected     */,
+      false /* submsg_mask          */);
+
+  /* Builtin topic. */
+  test_liveliness_discovery_reader_attr(
+      "DCPSPublication",
+      local_permissions_handle,
+      false /* liveliness_protected */,
+      false /* discovery_protected  */,
+      false /* submsg_protected     */,
+      0 /* submsg_mask          */);
+
+  /* Security (normal) builtin topic. */
+  test_liveliness_discovery_reader_attr(
+      "DCPSPublicationsSecure",
+      local_permissions_handle,
+      false /* liveliness_protected */,
+      false /* discovery_protected  */,
+      discovery_protected /* submsg_protected     */,
+      submsg_discovery_mask /* submsg_mask          */);
+
+  /* Security (liveliness affected) builtin topic. */
+  test_liveliness_discovery_reader_attr(
+      "DCPSParticipantMessageSecure",
+      local_permissions_handle,
+      false /* liveliness_protected */,
+      false /* discovery_protected  */,
+      liveliness_protected /* submsg_protected     */,
+      submsg_liveliness_mask /* submsg_mask          */);
+
+  clear_local_identity();
+  plugins_fini();
+}
+
+CU_Test(ddssec_builtin_get_xxx_sec_attributes, liveliness_discovery_clear, .init = suite_get_xxx_sec_attributes_init, .fini = suite_get_xxx_sec_attributes_fini)
+{
+  /*
+     * Expect these values based on these options, which is the 1st domain rule
+     * in the Test_Governance_liveliness_discovery_clear.p7s (selected because of domain id 0):
+     *
+     *   <allow_unauthenticated_participants>false</allow_unauthenticated_participants>
+     *   <enable_join_access_control>true</enable_join_access_control>
+     *   <discovery_protection_kind>NONE</discovery_protection_kind>
+     *   <liveliness_protection_kind>NONE</liveliness_protection_kind>
+     *   <rtps_protection_kind>NONE</rtps_protection_kind>
+     *   <topic_access_rules>
+     *       <topic_rule>
+     *           <topic_expression>*</topic_expression>
+     *           <enable_liveliness_protection>false</enable_liveliness_protection>
+     *           <enable_discovery_protection>false</enable_discovery_protection>
+     *           <enable_read_access_control>false</enable_read_access_control>
+     *           <enable_write_access_control>false</enable_write_access_control>
+     *           <metadata_protection_kind>NONE</metadata_protection_kind>
+     *           <data_protection_kind>NONE</data_protection_kind>
+     *       </topic_rule>
+     *   </topic_access_rules>
+     */
+  test_liveliness_discovery_attr(
+      "Test_Governance_liveliness_discovery_clear.p7s",
+      /* liveliness_protected */
+      false,
+      /* liveliness_mask      */
+      0,
+      /* discovery_protected  */
+      false,
+      /* discovery_mask       */
+      0);
+}
+
+CU_Test(ddssec_builtin_get_xxx_sec_attributes, liveliness_discovery_encrypted, .init = suite_get_xxx_sec_attributes_init, .fini = suite_get_xxx_sec_attributes_fini)
+{
+  /*
+     * Expect these values based on these options, which is the 1st domain rule
+     * in the Test_Governance_liveliness_discovery_clear.p7s (selected because of domain id 0):
+     *
+     *   <allow_unauthenticated_participants>false</allow_unauthenticated_participants>
+     *   <enable_join_access_control>true</enable_join_access_control>
+     *   <discovery_protection_kind>ENCRYPT</discovery_protection_kind>
+     *   <liveliness_protection_kind>ENCRYPT</liveliness_protection_kind>
+     *   <rtps_protection_kind>NONE</rtps_protection_kind>
+     *   <topic_access_rules>
+     *       <topic_rule>
+     *           <topic_expression>*</topic_expression>
+     *           <enable_liveliness_protection>true</enable_liveliness_protection>
+     *           <enable_discovery_protection>true</enable_discovery_protection>
+     *           <enable_read_access_control>false</enable_read_access_control>
+     *           <enable_write_access_control>false</enable_write_access_control>
+     *           <metadata_protection_kind>NONE</metadata_protection_kind>
+     *           <data_protection_kind>NONE</data_protection_kind>
+     *       </topic_rule>
+     *   </topic_access_rules>
+     */
+  test_liveliness_discovery_attr(
+      "Test_Governance_liveliness_discovery_encrypted.p7s",
+      /* liveliness_protected */
+      true,
+      /* liveliness_mask      */
+      DDS_SECURITY_PLUGIN_PARTICIPANT_ATTRIBUTES_FLAG_IS_LIVELINESS_ENCRYPTED,
+      /* discovery_protected  */
+      true,
+      /* discovery_mask       */
+      DDS_SECURITY_PLUGIN_PARTICIPANT_ATTRIBUTES_FLAG_IS_DISCOVERY_ENCRYPTED);
+}
+
+CU_Test(ddssec_builtin_get_xxx_sec_attributes, liveliness_discovery_signed, .init = suite_get_xxx_sec_attributes_init, .fini = suite_get_xxx_sec_attributes_fini)
+{
+  /*
+     * Expect these values based on these options, which is the 1st domain rule
+     * in the Test_Governance_liveliness_discovery_clear.p7s (selected because of domain id 0):
+     *
+     *   <allow_unauthenticated_participants>false</allow_unauthenticated_participants>
+     *   <enable_join_access_control>true</enable_join_access_control>
+     *   <discovery_protection_kind>SIGN</discovery_protection_kind>
+     *   <liveliness_protection_kind>SIGN</liveliness_protection_kind>
+     *   <rtps_protection_kind>NONE</rtps_protection_kind>
+     *   <topic_access_rules>
+     *       <topic_rule>
+     *           <topic_expression>*</topic_expression>
+     *           <enable_liveliness_protection>true</enable_liveliness_protection>
+     *           <enable_discovery_protection>true</enable_discovery_protection>
+     *           <enable_read_access_control>false</enable_read_access_control>
+     *           <enable_write_access_control>false</enable_write_access_control>
+     *           <metadata_protection_kind>NONE</metadata_protection_kind>
+     *           <data_protection_kind>NONE</data_protection_kind>
+     *       </topic_rule>
+     *   </topic_access_rules>
+     */
+  test_liveliness_discovery_attr(
+      "Test_Governance_liveliness_discovery_signed.p7s",
+      /* liveliness_protected */
+      true,
+      /* liveliness_mask      */
+      0,
+      /* discovery_protected  */
+      true,
+      /* discovery_mask       */
+      0);
+}
+
+CU_Test(ddssec_builtin_get_xxx_sec_attributes, liveliness_discovery_encrypted_and_authenticated, .init = suite_get_xxx_sec_attributes_init, .fini = suite_get_xxx_sec_attributes_fini)
+{
+  /*
+     * Expect these values based on these options, which is the 1st domain rule
+     * in the Test_Governance_liveliness_discovery_clear.p7s (selected because of domain id 0):
+     *
+     *   <allow_unauthenticated_participants>false</allow_unauthenticated_participants>
+     *   <enable_join_access_control>true</enable_join_access_control>
+     *   <discovery_protection_kind>ENCRYPT_WITH_ORIGIN_AUTHENTICATION</discovery_protection_kind>
+     *   <liveliness_protection_kind>ENCRYPT_WITH_ORIGIN_AUTHENTICATION</liveliness_protection_kind>
+     *   <rtps_protection_kind>NONE</rtps_protection_kind>
+     *   <topic_access_rules>
+     *       <topic_rule>
+     *           <topic_expression>*</topic_expression>
+     *           <enable_liveliness_protection>true</enable_liveliness_protection>
+     *           <enable_discovery_protection>true</enable_discovery_protection>
+     *           <enable_read_access_control>false</enable_read_access_control>
+     *           <enable_write_access_control>false</enable_write_access_control>
+     *           <metadata_protection_kind>NONE</metadata_protection_kind>
+     *           <data_protection_kind>NONE</data_protection_kind>
+     *       </topic_rule>
+     *   </topic_access_rules>
+     */
+  test_liveliness_discovery_attr(
+      "Test_Governance_liveliness_discovery_encrypted_and_authenticated.p7s",
+      /* liveliness_protected */
+      true,
+      /* liveliness_mask      */
+      DDS_SECURITY_PLUGIN_PARTICIPANT_ATTRIBUTES_FLAG_IS_LIVELINESS_ENCRYPTED |
+          DDS_SECURITY_PLUGIN_PARTICIPANT_ATTRIBUTES_FLAG_IS_LIVELINESS_AUTHENTICATED,
+      /* discovery_protected  */
+      true,
+      /* discovery_mask       */
+      DDS_SECURITY_PLUGIN_PARTICIPANT_ATTRIBUTES_FLAG_IS_DISCOVERY_ENCRYPTED |
+          DDS_SECURITY_PLUGIN_PARTICIPANT_ATTRIBUTES_FLAG_IS_DISCOVERY_AUTHENTICATED);
+}
+
+CU_Test(ddssec_builtin_get_xxx_sec_attributes, liveliness_discovery_signed_and_authenticated, .init = suite_get_xxx_sec_attributes_init, .fini = suite_get_xxx_sec_attributes_fini)
+{
+  /*
+     * Expect these values based on these options, which is the 1st domain rule
+     * in the Test_Governance_liveliness_discovery_clear.p7s (selected because of domain id 0):
+     *
+     *   <allow_unauthenticated_participants>false</allow_unauthenticated_participants>
+     *   <enable_join_access_control>true</enable_join_access_control>
+     *   <discovery_protection_kind>SIGN_WITH_ORIGIN_AUTHENTICATION</discovery_protection_kind>
+     *   <liveliness_protection_kind>SIGN_WITH_ORIGIN_AUTHENTICATION</liveliness_protection_kind>
+     *   <rtps_protection_kind>NONE</rtps_protection_kind>
+     *   <topic_access_rules>
+     *       <topic_rule>
+     *           <topic_expression>*</topic_expression>
+     *           <enable_liveliness_protection>true</enable_liveliness_protection>
+     *           <enable_discovery_protection>true</enable_discovery_protection>
+     *           <enable_read_access_control>false</enable_read_access_control>
+     *           <enable_write_access_control>false</enable_write_access_control>
+     *           <metadata_protection_kind>NONE</metadata_protection_kind>
+     *           <data_protection_kind>NONE</data_protection_kind>
+     *       </topic_rule>
+     *   </topic_access_rules>
+     */
+  test_liveliness_discovery_attr(
+      "Test_Governance_liveliness_discovery_signed_and_authenticated.p7s",
+      /* liveliness_protected */
+      true,
+      /* liveliness_mask      */
+      DDS_SECURITY_PLUGIN_PARTICIPANT_ATTRIBUTES_FLAG_IS_LIVELINESS_AUTHENTICATED,
+      /* discovery_protected  */
+      true,
+      /* discovery_mask       */
+      DDS_SECURITY_PLUGIN_PARTICIPANT_ATTRIBUTES_FLAG_IS_DISCOVERY_AUTHENTICATED);
+}
+
+CU_Test(ddssec_builtin_get_xxx_sec_attributes, liveliness_discovery_different, .init = suite_get_xxx_sec_attributes_init, .fini = suite_get_xxx_sec_attributes_fini)
+{
+  /*
+     * Expect these values based on these options, which is the 1st domain rule
+     * in the Test_Governance_liveliness_discovery_clear.p7s (selected because of domain id 0):
+     *
+     *   <allow_unauthenticated_participants>false</allow_unauthenticated_participants>
+     *   <enable_join_access_control>true</enable_join_access_control>
+     *   <discovery_protection_kind>ENCRYPT</discovery_protection_kind>
+     *   <liveliness_protection_kind>NONE</liveliness_protection_kind>
+     *   <rtps_protection_kind>NONE</rtps_protection_kind>
+     *   <topic_access_rules>
+     *       <topic_rule>
+     *           <topic_expression>*</topic_expression>
+     *           <enable_liveliness_protection>false</enable_liveliness_protection>
+     *           <enable_discovery_protection>true</enable_discovery_protection>
+     *           <enable_read_access_control>false</enable_read_access_control>
+     *           <enable_write_access_control>false</enable_write_access_control>
+     *           <metadata_protection_kind>NONE</metadata_protection_kind>
+     *           <data_protection_kind>NONE</data_protection_kind>
+     *       </topic_rule>
+     *   </topic_access_rules>
+     */
+  test_liveliness_discovery_attr(
+      "Test_Governance_liveliness_discovery_different.p7s",
+      /* liveliness_protected */
+      false,
+      /* liveliness_mask      */
+      0,
+      /* discovery_protected  */
+      true,
+      /* discovery_mask       */
+      DDS_SECURITY_PLUGIN_PARTICIPANT_ATTRIBUTES_FLAG_IS_DISCOVERY_ENCRYPTED);
+}
diff --git a/src/security/builtin_plugins/tests/listeners_access_control/etc/Test_Governance_ok.p7s b/src/security/builtin_plugins/tests/listeners_access_control/etc/Test_Governance_ok.p7s
new file mode 100644
index 0000000..c39903f
--- /dev/null
+++ b/src/security/builtin_plugins/tests/listeners_access_control/etc/Test_Governance_ok.p7s
@@ -0,0 +1,114 @@
+MIME-Version: 1.0
+Content-Type: multipart/signed; protocol="application/x-pkcs7-signature"; micalg="sha-256"; boundary="----DB94A190D9780A24156FB0E8F1E76B5F"
+
+This is an S/MIME signed message
+
+------DB94A190D9780A24156FB0E8F1E76B5F
+Content-Type: text/plain
+
+<?xml version="1.0" encoding="utf-8"?>
+<dds xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xsi:noNamespaceSchemaLocation="http://www.omg.org/spec/DDSSecurity/
+20170801/omg_shared_ca_domain_governance.xsd">
+    <domain_access_rules>
+        <domain_rule>
+            <domains>
+                <!-- All domains -->
+                <id_range>
+                    <min>0</min>
+                    <max>230</max>
+                </id_range>
+            </domains>
+
+            <!-- DomainParticipant that cann not authenticate or fail the authentication should be
+                 allowed to join the domain and see any any discovery data that are configured as "unprotected"
+                 and topics that are configured as "unprotected" -->
+            <allow_unauthenticated_participants>false</allow_unauthenticated_participants>
+
+            <!--  Only and any authenticated DomainParticipant should be allowed to join the domain and
+                  see the discovery data without checking access control  -->
+            <enable_join_access_control>true</enable_join_access_control>
+
+            <!-- Discovery information should be protected with encryption followed by MAC (Message Authentication Codes) -->
+            <discovery_protection_kind>ENCRYPT</discovery_protection_kind>
+
+            <!--  Liveliness messages are also encrypted -->
+            <liveliness_protection_kind>ENCRYPT</liveliness_protection_kind>
+
+            <!-- Whole RTPS message is not protected -->
+            <rtps_protection_kind>NONE</rtps_protection_kind>
+
+            <topic_access_rules>
+                <topic_rule>
+                    <!-- All (non-builtin) topics -->
+                    <topic_expression>*</topic_expression>
+
+                    <!-- Liveliness QoS data is protected -->
+                    <enable_liveliness_protection>true</enable_liveliness_protection>
+
+                    <!-- The discovery information on specific Topics should be sent
+                         using the secure (protected) discovery writers -->
+                    <enable_discovery_protection>true</enable_discovery_protection>
+
+                    <!-- The read access to all topics should be open to all. -->
+                    <enable_read_access_control>false</enable_read_access_control>
+
+                    <!-- The write access to all topics should be open to all. -->
+                    <enable_write_access_control>false</enable_write_access_control>
+
+                    <!-- Whole RTPS sub-message is protected. This includes metadata information
+                         like sequence numbers, heartbeats, key hashes, gaps,
+                         acknowledgment messages, etc. It also includes th possible payload. -->
+                    <metadata_protection_kind>ENCRYPT</metadata_protection_kind>
+
+                    <!-- The payload data sent on the Topic (serialized application level data) should be
+                         protected with Encrypt then MAC. -->
+                    <data_protection_kind>ENCRYPT</data_protection_kind>
+                </topic_rule>
+            </topic_access_rules>
+        </domain_rule>
+    </domain_access_rules>
+</dds>
+
+------DB94A190D9780A24156FB0E8F1E76B5F
+Content-Type: application/x-pkcs7-signature; name="smime.p7s"
+Content-Transfer-Encoding: base64
+Content-Disposition: attachment; filename="smime.p7s"
+
+MIIGSAYJKoZIhvcNAQcCoIIGOTCCBjUCAQExDzANBglghkgBZQMEAgEFADALBgkq
+hkiG9w0BBwGgggORMIIDjTCCAnWgAwIBAgIJANsr3sm0NrypMA0GCSqGSIb3DQEB
+CwUAMFwxCzAJBgNVBAYTAk5MMRMwEQYDVQQIDApTb21lLVN0YXRlMR8wHQYDVQQK
+DBZBRExJTksgVGVjaG5vbG9jeSBJbmMuMRcwFQYDVQQDDA5hZGxpbmt0ZWNoLmNv
+bTAgFw0xODA3MzAxMjQ1NTVaGA8yMTE4MDcwNjEyNDU1NVowXDELMAkGA1UEBhMC
+TkwxEzARBgNVBAgMClNvbWUtU3RhdGUxHzAdBgNVBAoMFkFETElOSyBUZWNobm9s
+b2N5IEluYy4xFzAVBgNVBAMMDmFkbGlua3RlY2guY29tMIIBIjANBgkqhkiG9w0B
+AQEFAAOCAQ8AMIIBCgKCAQEAu7jfnJ0wYVuXgG+PgNawdN38+dRpa8jceqi+blID
+ehV6XCxrnGXusTCDuFmo7HMOBVMVNDXlcBWgoGd+u5EultnOEiIeGTgtHc1O6V9w
+icp3BGSpZZax/TcONjMVORaqHCADbQ2J8wsz1FHxuKDwX6BJElYOlK77lb/x3yLs
+DFFC+a0qn2RFh37rcWBRAHy8VEASXKZElT9ZmfKd+KUq34KojhNJ4DepKStTq074
+BRDXVivx+wVD951LFNPiQXq+mgHcLj1k37KlZflTFhdP5oEMtATNsXNJPHlEymiy
+SogRWAmKhysLQudukHfNKN+r0FEQMk/hzpYcFeZSOvbfNQIDAQABo1AwTjAdBgNV
+HQ4EFgQURWMbWvBKZwJvRV1/tyc1R82k0+gwHwYDVR0jBBgwFoAURWMbWvBKZwJv
+RV1/tyc1R82k0+gwDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAQEAkPF+
+ysVtvHnk2hpu9yNDLCJ96ZzIoKOyY7uRj4ovzlAHFdpNOJQdcJihTmN8i7Trht9X
+Vh0rGoR/6nHzo3TIeiogRC80RlDtuA3PF2dDQBMVDStlZMTZPb693hfjdAjhyyw9
+yghhKHHqNDvSsAL0KfBqjG4yGfGpJylYXIT5fWuKlo/ln/yyPa5s54T5XDo+CMbt
+lLX3QnwVOmaRyzylPiTcPCDIkdLBdXmlfyJcmW6fWa6kPx+35MOxPsXZbujCo+42
++OyLqcH1rKT6XhcshjXBEf+kdgUfSClrM1pNRWsw2ChIYim0F+nry5JFy0Y+8Hbb
+6SDB340BFmtgDHbFHTGCAnswggJ3AgEBMGkwXDELMAkGA1UEBhMCTkwxEzARBgNV
+BAgMClNvbWUtU3RhdGUxHzAdBgNVBAoMFkFETElOSyBUZWNobm9sb2N5IEluYy4x
+FzAVBgNVBAMMDmFkbGlua3RlY2guY29tAgkA2yveybQ2vKkwDQYJYIZIAWUDBAIB
+BQCggeQwGAYJKoZIhvcNAQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG9w0BCQUxDxcN
+MTgwOTEzMDczOTUwWjAvBgkqhkiG9w0BCQQxIgQgXv8DkvlwebXMwHDbNc0/Pc30
+gyG3xWCnwet49TRMWFsweQYJKoZIhvcNAQkPMWwwajALBglghkgBZQMEASowCwYJ
+YIZIAWUDBAEWMAsGCWCGSAFlAwQBAjAKBggqhkiG9w0DBzAOBggqhkiG9w0DAgIC
+AIAwDQYIKoZIhvcNAwICAUAwBwYFKw4DAgcwDQYIKoZIhvcNAwICASgwDQYJKoZI
+hvcNAQEBBQAEggEANy8t0EFmv5j1n0+mMn2ut3Chu8PSJceC8gd34IiKq79uC1O3
+PbL9xgiJ2vz7QiTEEeNL2q+CG77cXOcHGUWa4nvbggr/9CqLfHEKGQxDfyXlJZfM
+8l550xIXRRBOQ7ilOGLD4QJFfbf9XA4rMuRe8WEYN3FleAaYBJag1tMPg1SS6tgA
+BBDM9b1kXHU319zYOk6kZFjlbwHv6XO22SEVRUpXrKudAI8hrGvwksF/+W0S/jS5
+NmYtj/1oMGlCGIaA5rs27H9CkgwrzoMQ3MsR98JlwEUSa4PEe8CClsIziOulQxsp
+MicBlMWL0rzpBPVfPTE4gZ/kP7hGBDEQlRzVTA==
+
+------DB94A190D9780A24156FB0E8F1E76B5F--
+
diff --git a/src/security/builtin_plugins/tests/listeners_access_control/etc/Test_Permissions_ca.pem b/src/security/builtin_plugins/tests/listeners_access_control/etc/Test_Permissions_ca.pem
new file mode 100644
index 0000000..2372ae0
--- /dev/null
+++ b/src/security/builtin_plugins/tests/listeners_access_control/etc/Test_Permissions_ca.pem
@@ -0,0 +1,22 @@
+-----BEGIN CERTIFICATE-----
+MIIDjTCCAnWgAwIBAgIJANsr3sm0NrypMA0GCSqGSIb3DQEBCwUAMFwxCzAJBgNV
+BAYTAk5MMRMwEQYDVQQIDApTb21lLVN0YXRlMR8wHQYDVQQKDBZBRExJTksgVGVj
+aG5vbG9jeSBJbmMuMRcwFQYDVQQDDA5hZGxpbmt0ZWNoLmNvbTAgFw0xODA3MzAx
+MjQ1NTVaGA8yMTE4MDcwNjEyNDU1NVowXDELMAkGA1UEBhMCTkwxEzARBgNVBAgM
+ClNvbWUtU3RhdGUxHzAdBgNVBAoMFkFETElOSyBUZWNobm9sb2N5IEluYy4xFzAV
+BgNVBAMMDmFkbGlua3RlY2guY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB
+CgKCAQEAu7jfnJ0wYVuXgG+PgNawdN38+dRpa8jceqi+blIDehV6XCxrnGXusTCD
+uFmo7HMOBVMVNDXlcBWgoGd+u5EultnOEiIeGTgtHc1O6V9wicp3BGSpZZax/TcO
+NjMVORaqHCADbQ2J8wsz1FHxuKDwX6BJElYOlK77lb/x3yLsDFFC+a0qn2RFh37r
+cWBRAHy8VEASXKZElT9ZmfKd+KUq34KojhNJ4DepKStTq074BRDXVivx+wVD951L
+FNPiQXq+mgHcLj1k37KlZflTFhdP5oEMtATNsXNJPHlEymiySogRWAmKhysLQudu
+kHfNKN+r0FEQMk/hzpYcFeZSOvbfNQIDAQABo1AwTjAdBgNVHQ4EFgQURWMbWvBK
+ZwJvRV1/tyc1R82k0+gwHwYDVR0jBBgwFoAURWMbWvBKZwJvRV1/tyc1R82k0+gw
+DAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAQEAkPF+ysVtvHnk2hpu9yND
+LCJ96ZzIoKOyY7uRj4ovzlAHFdpNOJQdcJihTmN8i7Trht9XVh0rGoR/6nHzo3TI
+eiogRC80RlDtuA3PF2dDQBMVDStlZMTZPb693hfjdAjhyyw9yghhKHHqNDvSsAL0
+KfBqjG4yGfGpJylYXIT5fWuKlo/ln/yyPa5s54T5XDo+CMbtlLX3QnwVOmaRyzyl
+PiTcPCDIkdLBdXmlfyJcmW6fWa6kPx+35MOxPsXZbujCo+42+OyLqcH1rKT6Xhcs
+hjXBEf+kdgUfSClrM1pNRWsw2ChIYim0F+nry5JFy0Y+8Hbb6SDB340BFmtgDHbF
+HQ==
+-----END CERTIFICATE-----
diff --git a/src/security/builtin_plugins/tests/listeners_access_control/etc/Test_Permissions_ca_key.pem b/src/security/builtin_plugins/tests/listeners_access_control/etc/Test_Permissions_ca_key.pem
new file mode 100644
index 0000000..22fac8b
--- /dev/null
+++ b/src/security/builtin_plugins/tests/listeners_access_control/etc/Test_Permissions_ca_key.pem
@@ -0,0 +1,27 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIIEpAIBAAKCAQEAu7jfnJ0wYVuXgG+PgNawdN38+dRpa8jceqi+blIDehV6XCxr
+nGXusTCDuFmo7HMOBVMVNDXlcBWgoGd+u5EultnOEiIeGTgtHc1O6V9wicp3BGSp
+ZZax/TcONjMVORaqHCADbQ2J8wsz1FHxuKDwX6BJElYOlK77lb/x3yLsDFFC+a0q
+n2RFh37rcWBRAHy8VEASXKZElT9ZmfKd+KUq34KojhNJ4DepKStTq074BRDXVivx
++wVD951LFNPiQXq+mgHcLj1k37KlZflTFhdP5oEMtATNsXNJPHlEymiySogRWAmK
+hysLQudukHfNKN+r0FEQMk/hzpYcFeZSOvbfNQIDAQABAoIBABWqhMSCr+7Mr3O3
+bIymOr+CT4xWI8S47hmKGFCLTrNsfy7cQZ9PdHkm7Ez+rCx+KwQaTrwz7EM/e8aH
+q2zimMn4YXxeS7MFdM+Xvp/Y0BhXMd1j8Nk0x14+WHmQ88YfA4szdrHDekR+6oB6
+5Lc2fAfNbCGdpRksCQWDndrvIOda1swKW1RsGWHPGtSM1qOg09A4CeASqbsxZfdL
+9MgI7aJKYnvJrUhqsNZU3fuOrLDNl7/JvdI08nYLnNkEvbDYbdfH0Q/4laKsSJcp
+0jM6tPrxbHMDmBEwullVPrVqJX+n6Hvz3E8C9QiZq8NWbJUc5FntLx8ynbiJg6Lb
+1w49WxECgYEA8yVky++3v0ZMKZeSeGj3MuKuEJ2q3UdmsKXA+Pyq0rL/hh7r2oUY
+dQDs23BIuaHeIZxAGaMeMjoYQBi+G50XfwHZSMqivxX/yYkXxOJfPQvVLDbqCIWS
+94qU4/xo50IkCNxpvRwfpKG2ce5YG7jrQkfb5I6TfKUWAaXpmaQnbYsCgYEAxaVn
+Hzw3OdY7q6kURSY6a8KqtcuN0lNKeUb68vZemmZ0FNKmyh+xGVFXXlvmJpQgr5Zm
+2W2a1C1oPq2DEdvSKt/aTHVIazG9TtFK1WAXpLxmlXlyqWRv+IvdVkph+p/3dIT0
+Ilaglgbndth4xk0c1zqy3g4VlAgWgKKi5owZ/j8CgYEAndsFGbHEJZZKFCannSzo
+cEzinT7/kzGr5bt3ES9Y5/n2Euk4TmJignPbUowPaxU/1apPo1VXYVx+Kf7mTZ8r
+hfV5T9ze1BhAPGOY3uXo1wU7nLz6LBYsWDHMgEd7A8jZBDe1HmWH1aZ3gHgxE652
+bk2g4T3/WskDBIbmpi0AvAkCgYBKAfFnRMj5IzscwCcS7YmaqD377MiiJQYR+34k
+VBSAhDSbR3Wk4dESxd6NOqQndff3R74jVGNRZ99M+PPHUCSWYVQApToEyY81YDFB
+TMYNrW5MMjm5LB6xVs3+bcPacOPcAZzY7s8a3mL1oYE339AY16X6eBOkZpLmf/+3
+jGZ/SQKBgQDkyxymL4xJGV8HCDontJZiBStD954GH1AgqEAOdQxU5vW4ySQ7yRoT
+ajb8tH052yWW11Mxd0TRW9qbVI0/4/4lR86sODYLFbgrHAMBl7mxJ8Qwi4zdI9Am
+FXGkj5SX2bYrf2f0YvCHNUbELTd4mF6kAH0Eg6kHRXLsSbhtWC7D3Q==
+-----END RSA PRIVATE KEY-----
diff --git a/src/security/builtin_plugins/tests/listeners_access_control/etc/Test_Permissions_listener.p7s b/src/security/builtin_plugins/tests/listeners_access_control/etc/Test_Permissions_listener.p7s
new file mode 100644
index 0000000..08434a9
--- /dev/null
+++ b/src/security/builtin_plugins/tests/listeners_access_control/etc/Test_Permissions_listener.p7s
@@ -0,0 +1,51 @@
+MIME-Version: 1.0
+Content-Type: multipart/signed; protocol="application/x-pkcs7-signature"; micalg="sha-256"; boundary="----3900963D3572093F6AEC654A72CAEE5A"
+
+This is an S/MIME signed message
+
+------3900963D3572093F6AEC654A72CAEE5A
+Content-Type: text/plain
+
+<?xml version="1.0" encoding="utf-8"?>                                    <dds xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"                                                                xsi:noNamespaceSchemaLocation="https://www.omg.org/spec/DDS-SECURITY/20170901/omg_shared_ca_permissions.xsd">          <permissions>                                                                                                               <grant name="DEFAULT_PERMISSIONS">                                                                                        <subject_name>/C=NL/ST=Some-State/O=Internet Widgits Pty Ltd/CN=CHAM500 cert</subject_name>                                                                                           <validity>                                                                                                                  <not_before>2015-09-15T01:00:00</not_before>                                                                            <not_after>2019-11-18T11:48:49</not_after>                                                                          </validity>                                                                                                             <deny_rule>                                                                                                                <domains>                                                                                                                   <id_range>                                                                                                                  <min>0</min>                                                                                                            <max>230</max>                                                                                                      </id_range>                                                                                                         </domains>                                                                                                              <publish>                                                                                                                   <topics>                                                                                                                    <topic>*</topic>                                                                                                    </topics>                                                                                                               <partitions/>                                                                                                       </publish>                                                                                                              <subscribe>                                                                                                                 <topics>                                                                                                                    <topic>*</topic>                                                                                                    </topics>                                                                                                               <partitions/>                                                                                                       </subscribe>                                                                                                       </deny_rule>                                                                                                           <default>DENY</default>                                                                                             </grant>                                                                                                            </permissions>                                                                                                      </dds>                                  
+------3900963D3572093F6AEC654A72CAEE5A
+Content-Type: application/x-pkcs7-signature; name="smime.p7s"
+Content-Transfer-Encoding: base64
+Content-Disposition: attachment; filename="smime.p7s"
+
+MIIGSAYJKoZIhvcNAQcCoIIGOTCCBjUCAQExDzANBglghkgBZQMEAgEFADALBgkq
+hkiG9w0BBwGgggORMIIDjTCCAnWgAwIBAgIJANsr3sm0NrypMA0GCSqGSIb3DQEB
+CwUAMFwxCzAJBgNVBAYTAk5MMRMwEQYDVQQIDApTb21lLVN0YXRlMR8wHQYDVQQK
+DBZBRExJTksgVGVjaG5vbG9jeSBJbmMuMRcwFQYDVQQDDA5hZGxpbmt0ZWNoLmNv
+bTAgFw0xODA3MzAxMjQ1NTVaGA8yMTE4MDcwNjEyNDU1NVowXDELMAkGA1UEBhMC
+TkwxEzARBgNVBAgMClNvbWUtU3RhdGUxHzAdBgNVBAoMFkFETElOSyBUZWNobm9s
+b2N5IEluYy4xFzAVBgNVBAMMDmFkbGlua3RlY2guY29tMIIBIjANBgkqhkiG9w0B
+AQEFAAOCAQ8AMIIBCgKCAQEAu7jfnJ0wYVuXgG+PgNawdN38+dRpa8jceqi+blID
+ehV6XCxrnGXusTCDuFmo7HMOBVMVNDXlcBWgoGd+u5EultnOEiIeGTgtHc1O6V9w
+icp3BGSpZZax/TcONjMVORaqHCADbQ2J8wsz1FHxuKDwX6BJElYOlK77lb/x3yLs
+DFFC+a0qn2RFh37rcWBRAHy8VEASXKZElT9ZmfKd+KUq34KojhNJ4DepKStTq074
+BRDXVivx+wVD951LFNPiQXq+mgHcLj1k37KlZflTFhdP5oEMtATNsXNJPHlEymiy
+SogRWAmKhysLQudukHfNKN+r0FEQMk/hzpYcFeZSOvbfNQIDAQABo1AwTjAdBgNV
+HQ4EFgQURWMbWvBKZwJvRV1/tyc1R82k0+gwHwYDVR0jBBgwFoAURWMbWvBKZwJv
+RV1/tyc1R82k0+gwDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAQEAkPF+
+ysVtvHnk2hpu9yNDLCJ96ZzIoKOyY7uRj4ovzlAHFdpNOJQdcJihTmN8i7Trht9X
+Vh0rGoR/6nHzo3TIeiogRC80RlDtuA3PF2dDQBMVDStlZMTZPb693hfjdAjhyyw9
+yghhKHHqNDvSsAL0KfBqjG4yGfGpJylYXIT5fWuKlo/ln/yyPa5s54T5XDo+CMbt
+lLX3QnwVOmaRyzylPiTcPCDIkdLBdXmlfyJcmW6fWa6kPx+35MOxPsXZbujCo+42
++OyLqcH1rKT6XhcshjXBEf+kdgUfSClrM1pNRWsw2ChIYim0F+nry5JFy0Y+8Hbb
+6SDB340BFmtgDHbFHTGCAnswggJ3AgEBMGkwXDELMAkGA1UEBhMCTkwxEzARBgNV
+BAgMClNvbWUtU3RhdGUxHzAdBgNVBAoMFkFETElOSyBUZWNobm9sb2N5IEluYy4x
+FzAVBgNVBAMMDmFkbGlua3RlY2guY29tAgkA2yveybQ2vKkwDQYJYIZIAWUDBAIB
+BQCggeQwGAYJKoZIhvcNAQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG9w0BCQUxDxcN
+MTkxMTE4MTE0ODQ4WjAvBgkqhkiG9w0BCQQxIgQgaLNNlFwfVR0PrziT9wCAy5bM
+qCZJX9yO3xJgut3/o7EweQYJKoZIhvcNAQkPMWwwajALBglghkgBZQMEASowCwYJ
+YIZIAWUDBAEWMAsGCWCGSAFlAwQBAjAKBggqhkiG9w0DBzAOBggqhkiG9w0DAgIC
+AIAwDQYIKoZIhvcNAwICAUAwBwYFKw4DAgcwDQYIKoZIhvcNAwICASgwDQYJKoZI
+hvcNAQEBBQAEggEAWCFrUIvdYKBeT0lmpkRdmYJuvdmQ/Ro7k9iyreVofpB1/70B
+hVOEeRjrlmhv/TUjSgQyli56wmXFmexcNRzSzpPNycz0gjwP9kX5BMnhAkKd08fC
+4rgoirScmNxvxEkj5+wyq7s7rBEJOgVQ9ofwiZXEBVDMVvW2ENZhVF3FyoNulDQe
+6BjXkuLw/QrJLWjywPy5naSSda2T7V3+Ssdu5/2vEjXPIJMM+xPOCaqGHJsSb72s
+KiP48jZ95Wruvj3QAlpGxDaazWPTgn7tfThYrY3Kgiz5zyZM7FhFyIqxRF/89Ngo
+hbu2mWzcXFF7wBLy+CvK5Foajro9t/PzD8uNuA==
+
+------3900963D3572093F6AEC654A72CAEE5A--
+
diff --git a/src/security/builtin_plugins/tests/listeners_access_control/src/listeners_access_control_utests.c b/src/security/builtin_plugins/tests/listeners_access_control/src/listeners_access_control_utests.c
new file mode 100644
index 0000000..5f32d09
--- /dev/null
+++ b/src/security/builtin_plugins/tests/listeners_access_control/src/listeners_access_control_utests.c
@@ -0,0 +1,671 @@
+/*
+ * Copyright(c) 2006 to 2019 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+#include <assert.h>
+#include <openssl/evp.h>
+#include <openssl/hmac.h>
+#include <openssl/bio.h>
+#include <openssl/err.h>
+#include <openssl/pkcs7.h>
+#include <openssl/pem.h>
+
+#include "dds/ddsrt/environ.h"
+#include "dds/ddsrt/heap.h"
+#include "dds/ddsrt/io.h"
+#include "dds/ddsrt/misc.h"
+#include "dds/ddsrt/string.h"
+#include "dds/ddsrt/types.h"
+#include "dds/security/dds_security_api.h"
+#include "dds/security/core/dds_security_utils.h"
+#include "CUnit/CUnit.h"
+#include "CUnit/Test.h"
+#include "common/src/loader.h"
+#include "config_env.h"
+
+#if OPENSSL_VERSION_NUMBER >= 0x10000000L && OPENSSL_VERSION_NUMBER < 0x10100000L
+#define REMOVE_THREAD_STATE() ERR_remove_thread_state(NULL);
+#elif OPENSSL_VERSION_NUMBER < 0x10000000L
+#define REMOVE_THREAD_STATE() ERR_remove_state(0);
+#else
+#define REMOVE_THREAD_STATE()
+#endif
+
+static const char *ACCESS_PERMISSIONS_TOKEN_ID = "DDS:Access:Permissions:1.0";
+static const char *AUTH_PROTOCOL_CLASS_ID = "DDS:Auth:PKI-DH:1.0";
+
+static const char *PROPERTY_IDENTITY_CA = "dds.sec.auth.identity_ca";
+static const char *PROPERTY_PRIVATE_KEY = "dds.sec.auth.private_key";
+static const char *PROPERTY_IDENTITY_CERT = "dds.sec.auth.identity_certificate";
+static const char *PROPERTY_PERMISSIONS_CA = "dds.sec.access.permissions_ca";
+static const char *PROPERTY_PERMISSIONS = "dds.sec.access.permissions";
+static const char *PROPERTY_GOVERNANCE = "dds.sec.access.governance";
+
+static const char *PROPERTY_PERMISSIONS_CA_SN = "dds.perm_ca.sn";
+static const char *PROPERTY_PERMISSIONS_CA_ALGO = "dds.perm_ca.algo";
+static const char *PROPERTY_C_ID = "c.id";
+static const char *PROPERTY_C_PERM = "c.perm";
+
+static const char *SUBJECT_NAME_PERMISSIONS_CA = "C=NL, ST=Some-State, O=ADLINK Technolocy Inc., CN=adlinktech.com";
+static const char *RSA_2048_ALGORITHM_NAME = "RSA-2048";
+
+static const char *RELATIVE_PATH_TO_ETC_DIR = "/listeners_access_control/etc/";
+static const char *PERMISSIONS_CA_CERT_FILE = "Test_Permissions_ca.pem";
+static const char *PERMISSIONS_CA_KEY_FILE = "Test_Permissions_ca_key.pem";
+static const char *PERMISSIONS_FILE = "Test_Permissions_listener.p7s";
+static dds_security_access_control_listener ac_listener;
+
+static const char *identity_certificate =
+    "data:,-----BEGIN CERTIFICATE-----\n"
+    "MIIEQTCCAymgAwIBAgIINpuaAAnrQZIwDQYJKoZIhvcNAQELBQAwXzELMAkGA1UE\n"
+    "BhMCTkwxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdp\n"
+    "ZGdpdHMgUHR5IEx0ZDEYMBYGA1UEAxMPQ0hBTTUwMCByb290IGNhMCAXDTE3MDIy\n"
+    "MjIyMjIwMFoYDzIyMjIwMjIyMjIyMjAwWjBcMQswCQYDVQQGEwJOTDETMBEGA1UE\n"
+    "CBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRk\n"
+    "MRUwEwYDVQQDEwxDSEFNNTAwIGNlcnQwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAw\n"
+    "ggEKAoIBAQDCpVhivH/wBIyu74rvQncnSZqKyspN6CvD1pmV9wft5PHhVt9jV79v\n"
+    "gSub5LADoRHAgFdv9duYgBr17Ob6uRrIY4B18CcrCjhQcC4gjx8y2jl9PeYm+qYD\n"
+    "3o44FYBrBq0QCnrQgKsb/qX9Z+Mw/VUiw65x68W876LEHQQoEgT4kxSuagwBoVRk\n"
+    "ePD6fYAKmT4XS3x+O0v+rHESTcsKF6yMadgp7h3eH1b8kJTzSx8JV9Zzq++mxjox\n"
+    "qhbBVP5nDze2hhSIeCkCvSrx7efkgKS4AQXa5/Z44GiAu1TfXXUqdic9rxwD0edn\n"
+    "ajNElnZe7sjok/0yuqvH+2hSqpNva/zpAgMBAAGjggEAMIH9MAwGA1UdDwQFAwMH\n"
+    "/4AwgewGA1UdJQSB5DCB4QYIKwYBBQUHAwEGCCsGAQUFBwMCBggrBgEFBQcDAwYI\n"
+    "KwYBBQUHAwQGCCsGAQUFBwMIBgorBgEEAYI3AgEVBgorBgEEAYI3AgEWBgorBgEE\n"
+    "AYI3CgMBBgorBgEEAYI3CgMDBgorBgEEAYI3CgMEBglghkgBhvhCBAEGCysGAQQB\n"
+    "gjcKAwQBBggrBgEFBQcDBQYIKwYBBQUHAwYGCCsGAQUFBwMHBggrBgEFBQgCAgYK\n"
+    "KwYBBAGCNxQCAgYIKwYBBQUHAwkGCCsGAQUFBwMNBggrBgEFBQcDDgYHKwYBBQID\n"
+    "BTANBgkqhkiG9w0BAQsFAAOCAQEAawdHy0Xw7nTK2ltp91Ion6fJ7hqYuj///zr7\n"
+    "Adt6uonpDh/xl3esuwcFimIJrJrHujnGkL0nLddRCikmnzuBMNDWS6yq0/Ckl/YG\n"
+    "yjNr44dlX24wo+MVAgkj3/8CyWDZ3a8kBg9QT3bs2SqbjmhTrXN1DRyf9S5vJysE\n"
+    "I7V1gTN66BeKL64hOrAlRVrEu8Ds6TWL6Q/YH+61ViZkoLTeSaPjH4nknaFr4C35\n"
+    "iji0JhkyfRHRRVPHFnaj25AkxOrSV64qVKoTMjDl5fji5iMGtjm6iJ7q05ml/qDl\n"
+    "nLotHXemZNvYhbwUmRzbt4Dls9EMH4VRbP85I94nM5TAvtHVNA==\n"
+    "-----END CERTIFICATE-----\n";
+
+static const char *identity_ca =
+    "data:,-----BEGIN CERTIFICATE-----\n"
+    "MIIEmTCCA4GgAwIBAgIIZ5gEIUFhO5wwDQYJKoZIhvcNAQELBQAwXzELMAkGA1UE\n"
+    "BhMCTkwxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdp\n"
+    "ZGdpdHMgUHR5IEx0ZDEYMBYGA1UEAxMPQ0hBTTUwMCByb290IGNhMCAXDTE4MDIx\n"
+    "MjE1MDUwMFoYDzIyMjIwMjIyMjIyMjAwWjBfMQswCQYDVQQGEwJOTDETMBEGA1UE\n"
+    "CBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRk\n"
+    "MRgwFgYDVQQDEw9DSEFNNTAwIHJvb3QgY2EwggEiMA0GCSqGSIb3DQEBAQUAA4IB\n"
+    "DwAwggEKAoIBAQC6Fa3TheL+UrdZCp9GhU/2WbneP2t/avUa3muwDttPxeI2XU9k\n"
+    "ZjBR95mAXme4SPXHk5+YDN319AqIje3oKhzky/ngvKH2GkoJKYxWnuDBfMEHdViz\n"
+    "2Q9/xso2ZvH50ukwWa0pfx2/EVV1wRxeQcRd/UVfq3KTJizG0M88mOYvGEAw3LFf\n"
+    "zef7k1aCuOofQmBvLukUudcYpMzfyHFp7lQqU4CcrrR5RtmfiUfrWfdGLea2iPDB\n"
+    "pJgN8ESOMwEHtOTEBDclYnH9L4t7CHQz+fXXS5IWFsDK9fCMQjnxDsDVeNrNzTYL\n"
+    "FaZrMg9S6IUQCEsQWsnq5weS8omOpVLUm9klAgMBAAGjggFVMIIBUTAMBgNVHRME\n"
+    "BTADAQH/MB0GA1UdDgQWBBQg2FZB/j8uWDVnJhjwXkX278znSTAfBgNVHSMEGDAW\n"
+    "gBQg2FZB/j8uWDVnJhjwXkX278znSTAPBgNVHQ8BAf8EBQMDB/+AMIHvBgNVHSUB\n"
+    "Af8EgeQwgeEGCCsGAQUFBwMBBggrBgEFBQcDAgYIKwYBBQUHAwMGCCsGAQUFBwME\n"
+    "BggrBgEFBQcDCAYKKwYBBAGCNwIBFQYKKwYBBAGCNwIBFgYKKwYBBAGCNwoDAQYK\n"
+    "KwYBBAGCNwoDAwYKKwYBBAGCNwoDBAYJYIZIAYb4QgQBBgsrBgEEAYI3CgMEAQYI\n"
+    "KwYBBQUHAwUGCCsGAQUFBwMGBggrBgEFBQcDBwYIKwYBBQUIAgIGCisGAQQBgjcU\n"
+    "AgIGCCsGAQUFBwMJBggrBgEFBQcDDQYIKwYBBQUHAw4GBysGAQUCAwUwDQYJKoZI\n"
+    "hvcNAQELBQADggEBAKHmwejWRwGE1wf1k2rG8SNRV/neGsZ6Qfqf6co3TpR/Wi1s\n"
+    "iZDvSeT/rbqNBS7z34xnG88NIUwu00y78e8Mfon31ZZbK4Uo7fla9/D3ukdJqPQC\n"
+    "LKdbKJjR2kH+KCukY/1rghjJ8/X+t2egBit0LCOdsFCl07Sfksb9kpGUIZSFcYYm\n"
+    "geqhjhoNwxazzHiw+QWHC5HG9248JIizBmy1aymNWuMnPudhjHAnPcsIlqMVNq3t\n"
+    "Rv9ap7S8JeCxHVRPJvJeCwXWvW3dW/v3xH52Yn/fqRblN1w9Fxz5NhopKx0gj/Jd\n"
+    "sw2N4Fk4gaOWEolFpa0bwNw8nAx7moehZpowzfw=\n"
+    "-----END CERTIFICATE-----\n";
+
+static const char *private_key =
+    "data:,-----BEGIN RSA PRIVATE KEY-----\n"
+    "MIIEogIBAAKCAQEAwqVYYrx/8ASMru+K70J3J0maisrKTegrw9aZlfcH7eTx4Vbf\n"
+    "Y1e/b4Erm+SwA6ERwIBXb/XbmIAa9ezm+rkayGOAdfAnKwo4UHAuII8fMto5fT3m\n"
+    "JvqmA96OOBWAawatEAp60ICrG/6l/WfjMP1VIsOucevFvO+ixB0EKBIE+JMUrmoM\n"
+    "AaFUZHjw+n2ACpk+F0t8fjtL/qxxEk3LChesjGnYKe4d3h9W/JCU80sfCVfWc6vv\n"
+    "psY6MaoWwVT+Zw83toYUiHgpAr0q8e3n5ICkuAEF2uf2eOBogLtU3111KnYnPa8c\n"
+    "A9HnZ2ozRJZ2Xu7I6JP9Mrqrx/toUqqTb2v86QIDAQABAoIBAC1q32DKkx+yMBFx\n"
+    "m32QiLUGG6VfBC2BixS7MkMnzRXZYgcuehl4FBc0kLRjfB6cqsO8LqrVN1QyMBhK\n"
+    "GutN3c38SbE7RChqzhEW2+yE+Mao3Nk4ZEecHLiyaYT0n25ZtHAVwep823BAzwJ+\n"
+    "BykbM45VEpNKbG1VjSktjBa9faNyZiZAEJEjVyla+6R8N4kHV52LbZcLjvJv3IQ2\n"
+    "iPYRrmMyI5C23qTni0vy7yJbAXBo3CqgSlwie9FARBWT7Puu7F4mF1O1c/SnTysw\n"
+    "Tm3e5FzgfHipQbnRVn0w4rDprPMKmPxMnvf/Wkw0zVgNadp1Tc1I6Yj525DEQ07i\n"
+    "2gIn/gECgYEA4jNnY1u2Eu7x3pAQF3dRO0x35boVtuq9iwQk7q+uaZaK4RJRr+0Y\n"
+    "T68S3bPnfer6SHvcxtST89Bvs/j/Ky4SOaX037UYjFh6T7OIzPl+MzO1yb+VOBT6\n"
+    "D6FVGEJGp8ZAITU1OfJPeTYViUeEC8tHFGoKUCk50FbB6jOf1oKtv/ECgYEA3EnB\n"
+    "Y7kSbJJaUuj9ciFUL/pAno86Cim3VjegK1wKgEiyDb610bhoMErovPwfVJbtcttG\n"
+    "eKJNuwizkRcVbj+vpjDvqqaP5eMxLl6/Nd4haPMJYzGo88Z8NJpwFRNF2KEWjOpQ\n"
+    "2NEvoCeRtVulCJyka2Tpljzw8cOXkxhPOe2UhHkCgYBo3entj0QO7QXm56T+LAvV\n"
+    "0PK45xdQEO3EuCwjGAFk5C0IgUSrqeCeeIzniZMltj1IQ1wsNbtNynEu3530t8wt\n"
+    "O7oVyFBUKGSz9IjUdkpClJOPr6kPMfJoMqRPtdIpz+hFPPSrI6IikKdVWHloOlp+\n"
+    "pVaYqTQrWT1XRY2xli3VEQKBgGySmZN6Cx+h/oywswIGdUT0VdcQhq2to+QFpJba\n"
+    "VX6m1cM6hMip2Ag9U3qZ1SNPBBdBBfm9HQybHE3dj713/C2wHuAAGhpXIM1W+20k\n"
+    "X1knuC/AsSH9aQhQOf/ZMOq1crTfZBuI9q0782/sjGmzMsKPySU4QhUWruVb7OiD\n"
+    "NVkZAoGAEvihW7G+8/iOE40vGHyBqUeopAAWLciTAUIEwM/Oi3BYfNWNTWF/FWNc\n"
+    "nMvCZPYigY8C1vO+1iT2Frtd3CIU+f01Q3fJNJoRLlEiKLNZUJRF48OKUqjKSmsi\n"
+    "w6pucFO40z05YW7utApj4L82rZnOS0pd1tUI1yexqvj0i4ThJfk=\n"
+    "-----END RSA PRIVATE KEY-----\n";
+
+static const char *permissions_ca = /*Test_Permissions_ca.pem */
+    "data:,-----BEGIN CERTIFICATE-----\n"
+    "MIIDjTCCAnWgAwIBAgIJANsr3sm0NrypMA0GCSqGSIb3DQEBCwUAMFwxCzAJBgNV\n"
+    "BAYTAk5MMRMwEQYDVQQIDApTb21lLVN0YXRlMR8wHQYDVQQKDBZBRExJTksgVGVj\n"
+    "aG5vbG9jeSBJbmMuMRcwFQYDVQQDDA5hZGxpbmt0ZWNoLmNvbTAgFw0xODA3MzAx\n"
+    "MjQ1NTVaGA8yMTE4MDcwNjEyNDU1NVowXDELMAkGA1UEBhMCTkwxEzARBgNVBAgM\n"
+    "ClNvbWUtU3RhdGUxHzAdBgNVBAoMFkFETElOSyBUZWNobm9sb2N5IEluYy4xFzAV\n"
+    "BgNVBAMMDmFkbGlua3RlY2guY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB\n"
+    "CgKCAQEAu7jfnJ0wYVuXgG+PgNawdN38+dRpa8jceqi+blIDehV6XCxrnGXusTCD\n"
+    "uFmo7HMOBVMVNDXlcBWgoGd+u5EultnOEiIeGTgtHc1O6V9wicp3BGSpZZax/TcO\n"
+    "NjMVORaqHCADbQ2J8wsz1FHxuKDwX6BJElYOlK77lb/x3yLsDFFC+a0qn2RFh37r\n"
+    "cWBRAHy8VEASXKZElT9ZmfKd+KUq34KojhNJ4DepKStTq074BRDXVivx+wVD951L\n"
+    "FNPiQXq+mgHcLj1k37KlZflTFhdP5oEMtATNsXNJPHlEymiySogRWAmKhysLQudu\n"
+    "kHfNKN+r0FEQMk/hzpYcFeZSOvbfNQIDAQABo1AwTjAdBgNVHQ4EFgQURWMbWvBK\n"
+    "ZwJvRV1/tyc1R82k0+gwHwYDVR0jBBgwFoAURWMbWvBKZwJvRV1/tyc1R82k0+gw\n"
+    "DAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAQEAkPF+ysVtvHnk2hpu9yND\n"
+    "LCJ96ZzIoKOyY7uRj4ovzlAHFdpNOJQdcJihTmN8i7Trht9XVh0rGoR/6nHzo3TI\n"
+    "eiogRC80RlDtuA3PF2dDQBMVDStlZMTZPb693hfjdAjhyyw9yghhKHHqNDvSsAL0\n"
+    "KfBqjG4yGfGpJylYXIT5fWuKlo/ln/yyPa5s54T5XDo+CMbtlLX3QnwVOmaRyzyl\n"
+    "PiTcPCDIkdLBdXmlfyJcmW6fWa6kPx+35MOxPsXZbujCo+42+OyLqcH1rKT6Xhcs\n"
+    "hjXBEf+kdgUfSClrM1pNRWsw2ChIYim0F+nry5JFy0Y+8Hbb6SDB340BFmtgDHbF\n"
+    "HQ==\n"
+    "-----END CERTIFICATE-----\n";
+
+#define PERMISSIONS_DOCUMENT "<?xml version=\"1.0\" encoding=\"utf-8\"?>                                    \
+<dds xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\"                                                            \
+    xsi:noNamespaceSchemaLocation=\"https://www.omg.org/spec/DDS-SECURITY/20170901/omg_shared_ca_permissions.xsd\">      \
+    <permissions>                                                                                                       \
+        <grant name=\"DEFAULT_PERMISSIONS\">                                                                            \
+            <subject_name>/C=NL/ST=Some-State/O=Internet Widgits Pty Ltd/CN=CHAM500 cert</subject_name>                                                                               \
+            <validity>                                                                                                  \
+                <not_before>2015-09-15T01:00:00</not_before>                                                            \
+                <not_after>PERMISSION_EXPIRY_DATE</not_after>                                                              \
+            </validity>                                                                                                 \
+            <deny_rule>                                                                                                \
+                <domains>                                                                                               \
+                    <id_range>                                                                                          \
+                        <min>0</min>                                                                                    \
+                        <max>230</max>                                                                                  \
+                    </id_range>                                                                                         \
+                </domains>                                                                                              \
+                <publish>                                                                                               \
+                    <topics>                                                                                            \
+                        <topic>*</topic>                                                                                \
+                    </topics>                                                                                           \
+                    <partitions/>                                                                                       \
+                </publish>                                                                                              \
+                <subscribe>                                                                                             \
+                    <topics>                                                                                            \
+                        <topic>*</topic>                                                                                \
+                    </topics>                                                                                           \
+                    <partitions/>                                                                                       \
+                </subscribe>                                                                                            \
+           </deny_rule>                                                                                                \
+           <default>DENY</default>                                                                                     \
+        </grant>                                                                                                        \
+    </permissions>                                                                                                      \
+</dds>                                  "
+
+static struct plugins_hdl *plugins = NULL;
+static dds_security_authentication *auth = NULL;
+static dds_security_access_control *access_control = NULL;
+static DDS_Security_IdentityHandle local_identity_handle = DDS_SECURITY_HANDLE_NIL;
+static DDS_Security_IdentityHandle remote_identity_handle = DDS_SECURITY_HANDLE_NIL;
+static DDS_Security_PermissionsHandle local_permissions_handle = DDS_SECURITY_HANDLE_NIL;
+static DDS_Security_PermissionsHandle remote_permissions_handle = DDS_SECURITY_HANDLE_NIL;
+static DDS_Security_GUID_t local_participant_guid;
+static char *g_path_to_etc_dir = NULL;
+static DDS_Security_PermissionsHandle permission_handle_for_callback1 = DDS_SECURITY_HANDLE_NIL;
+static DDS_Security_PermissionsHandle permission_handle_for_callback2 = DDS_SECURITY_HANDLE_NIL;
+static dds_time_t local_expiry_date;
+static dds_time_t remote_expiry_date;
+
+static void dds_security_property_init(DDS_Security_PropertySeq *seq, DDS_Security_unsigned_long size)
+{
+  seq->_length = size;
+  seq->_maximum = size;
+  seq->_buffer = ddsrt_malloc(size * sizeof(DDS_Security_Property_t));
+  memset(seq->_buffer, 0, size * sizeof(DDS_Security_Property_t));
+}
+
+static void dds_security_property_deinit(DDS_Security_PropertySeq *seq)
+{
+  uint32_t i;
+
+  for (i = 0; i < seq->_length; i++)
+  {
+    ddsrt_free(seq->_buffer[i].name);
+    ddsrt_free(seq->_buffer[i].value);
+  }
+  ddsrt_free(seq->_buffer);
+}
+
+static void reset_exception(DDS_Security_SecurityException *ex)
+{
+  ex->code = 0;
+  ex->minor_code = 0;
+  ddsrt_free(ex->message);
+  ex->message = NULL;
+}
+
+static void get_future_xsdate(char *str, size_t len, int32_t delta)
+{
+  time_t rawtime;
+  struct tm *future;
+
+  /* Get future time. */
+  rawtime = time(NULL) + delta;
+  future = gmtime(&rawtime);
+
+  /* Put the future time in a xsDate format. */
+  strftime(str, len, "%Y-%m-%dT%H:%M:%S", future);
+}
+
+static int smime_sign(const char *certificate_file, const char *key_file, const char *data, const char *out_file)
+{
+  BIO *in = NULL, *out = NULL, *tbio = NULL, *keybio = NULL;
+  X509 *scert = NULL;
+  EVP_PKEY *skey = NULL;
+  PKCS7 *p7 = NULL;
+  int ret = 1;
+  int flags = PKCS7_DETACHED | PKCS7_STREAM | PKCS7_TEXT;
+
+  /* Read in signer certificate and private key */
+  tbio = BIO_new_file(certificate_file, "r");
+  if (!tbio)
+    goto err;
+  scert = PEM_read_bio_X509(tbio, NULL, 0, NULL);
+
+  keybio = BIO_new_file(key_file, "r");
+  if (!keybio)
+    goto err;
+
+  skey = PEM_read_bio_PrivateKey(keybio, NULL, 0, NULL);
+  if (!scert || !skey)
+    goto err;
+
+  /* Open content being signed */
+  in = BIO_new_mem_buf(data, (int)strlen(data));
+  if (!in)
+    goto err;
+  /* Sign content */
+  p7 = PKCS7_sign(scert, skey, NULL, in, flags);
+  if (!p7)
+    goto err;
+  out = BIO_new_file(out_file, "w");
+  if (!out)
+    goto err;
+
+  //if (!(flags & PKCS7_STREAM))
+  //    BIO_reset(in);
+
+  /* Write out S/MIME message */
+  if (!SMIME_write_PKCS7(out, p7, in, flags))
+    goto err;
+  ret = 0;
+err:
+  if (ret)
+  {
+    fprintf(stderr, "Error Signing Data\n");
+    ERR_print_errors_fp(stderr);
+  }
+  if (p7)
+    PKCS7_free(p7);
+  if (scert)
+    X509_free(scert);
+  if (skey)
+    EVP_PKEY_free(skey);
+  if (in)
+    BIO_free(in);
+  if (keybio)
+    BIO_free(keybio);
+  if (out)
+    BIO_free(out);
+  if (tbio)
+    BIO_free(tbio);
+
+  return ret;
+}
+
+static void fill_participant_qos(DDS_Security_Qos *qos, int32_t permission_expiry, const char *governance_filename)
+{
+  char *permission_uri;
+  char *governance_uri;
+  char *permissions_ca_cert_file;
+  char *permissions_ca_key_file;
+  char *permissions_file;
+  char *permissions_xml_with_expiry;
+  char permission_expiry_date_str[30];
+
+  /*get time in future */
+  get_future_xsdate(permission_expiry_date_str, 30, permission_expiry);
+  local_expiry_date = DDS_Security_parse_xml_date(permission_expiry_date_str);
+
+  permissions_xml_with_expiry = ddsrt_str_replace(PERMISSIONS_DOCUMENT, "PERMISSION_EXPIRY_DATE", permission_expiry_date_str, 1);
+
+  ddsrt_asprintf(&permissions_ca_cert_file, "%s%s", g_path_to_etc_dir, PERMISSIONS_CA_CERT_FILE);
+  ddsrt_asprintf(&permissions_ca_key_file, "%s%s", g_path_to_etc_dir, PERMISSIONS_CA_KEY_FILE);
+  ddsrt_asprintf(&permissions_file, "%s%s", g_path_to_etc_dir, PERMISSIONS_FILE);
+
+  smime_sign(permissions_ca_cert_file, permissions_ca_key_file, permissions_xml_with_expiry, permissions_file);
+
+  //check sign result
+  ddsrt_asprintf(&permission_uri, "file:%s", permissions_file);
+  ddsrt_asprintf(&governance_uri, "file:%s%s", g_path_to_etc_dir, governance_filename);
+
+  memset(qos, 0, sizeof(*qos));
+  dds_security_property_init(&qos->property.value, 6);
+  qos->property.value._buffer[0].name = ddsrt_strdup(PROPERTY_IDENTITY_CERT);
+  qos->property.value._buffer[0].value = ddsrt_strdup(identity_certificate);
+  qos->property.value._buffer[1].name = ddsrt_strdup(PROPERTY_IDENTITY_CA);
+  qos->property.value._buffer[1].value = ddsrt_strdup(identity_ca);
+  qos->property.value._buffer[2].name = ddsrt_strdup(PROPERTY_PRIVATE_KEY);
+  qos->property.value._buffer[2].value = ddsrt_strdup(private_key);
+  qos->property.value._buffer[3].name = ddsrt_strdup(PROPERTY_PERMISSIONS_CA);
+  qos->property.value._buffer[3].value = ddsrt_strdup(permissions_ca);
+  qos->property.value._buffer[4].name = ddsrt_strdup(PROPERTY_PERMISSIONS);
+  qos->property.value._buffer[4].value = ddsrt_strdup(permission_uri);
+  qos->property.value._buffer[5].name = ddsrt_strdup(PROPERTY_GOVERNANCE);
+  qos->property.value._buffer[5].value = ddsrt_strdup(governance_uri);
+
+  ddsrt_free(permission_uri);
+  ddsrt_free(governance_uri);
+  ddsrt_free(permissions_xml_with_expiry);
+  ddsrt_free(permissions_ca_key_file);
+  ddsrt_free(permissions_ca_cert_file);
+  ddsrt_free(permissions_file);
+}
+
+static void fill_permissions_token(DDS_Security_PermissionsToken *token)
+{
+  memset(token, 0, sizeof(DDS_Security_PermissionsToken));
+
+  token->class_id = ddsrt_strdup(ACCESS_PERMISSIONS_TOKEN_ID);
+  token->properties._length = token->properties._maximum = 2;
+  token->properties._buffer = DDS_Security_PropertySeq_allocbuf(2);
+
+  token->properties._buffer[0].name = ddsrt_strdup(PROPERTY_PERMISSIONS_CA_SN);
+  token->properties._buffer[0].value = ddsrt_strdup(SUBJECT_NAME_PERMISSIONS_CA);
+
+  token->properties._buffer[1].name = ddsrt_strdup(PROPERTY_PERMISSIONS_CA_ALGO);
+  token->properties._buffer[1].value = ddsrt_strdup(RSA_2048_ALGORITHM_NAME);
+}
+
+static int fill_peer_credential_token(DDS_Security_AuthenticatedPeerCredentialToken *token, int32_t permission_expiry)
+{
+  int result = 1;
+  char *permission_data;
+
+  char *permissions_ca_cert_file;
+  char *permissions_ca_key_file;
+  char *permissions_file;
+  char *permissions_xml_with_expiry;
+  char permission_expiry_date_str[30];
+
+  /*get time in future */
+  get_future_xsdate(permission_expiry_date_str, 30, permission_expiry);
+  remote_expiry_date = DDS_Security_parse_xml_date(permission_expiry_date_str);
+  permissions_xml_with_expiry = ddsrt_str_replace(PERMISSIONS_DOCUMENT, "PERMISSION_EXPIRY_DATE", permission_expiry_date_str, 1);
+
+  ddsrt_asprintf(permissions_ca_cert_file, "%s%s", g_path_to_etc_dir, PERMISSIONS_CA_CERT_FILE);
+  ddsrt_asprintf(permissions_ca_key_file, "%s%s", g_path_to_etc_dir, PERMISSIONS_CA_KEY_FILE);
+  ddsrt_asprintf(permissions_file, "%s%s", g_path_to_etc_dir, PERMISSIONS_FILE);
+
+  smime_sign(permissions_ca_cert_file, permissions_ca_key_file, permissions_xml_with_expiry, permissions_file);
+
+  memset(token, 0, sizeof(DDS_Security_AuthenticatedPeerCredentialToken));
+
+  permission_data = load_file_contents(permissions_file);
+
+  if (permission_data)
+  {
+    token->class_id = ddsrt_strdup(AUTH_PROTOCOL_CLASS_ID);
+    token->properties._length = token->properties._maximum = 2;
+    token->properties._buffer = DDS_Security_PropertySeq_allocbuf(2);
+
+    token->properties._buffer[0].name = ddsrt_strdup(PROPERTY_C_ID);
+    token->properties._buffer[0].value = ddsrt_strdup(&identity_certificate[6]);
+
+    token->properties._buffer[1].name = ddsrt_strdup(PROPERTY_C_PERM);
+    token->properties._buffer[1].value = permission_data;
+  }
+  else
+  {
+    ddsrt_free(permission_data);
+    result = 0;
+  }
+
+  ddsrt_free(permissions_xml_with_expiry);
+  ddsrt_free(permissions_ca_key_file);
+  ddsrt_free(permissions_ca_cert_file);
+  ddsrt_free(permissions_file);
+  return result;
+}
+
+static DDS_Security_long
+validate_local_identity_and_permissions(int32_t permission_expiry)
+{
+  DDS_Security_long res = DDS_SECURITY_ERR_OK_CODE;
+  DDS_Security_ValidationResult_t result;
+  DDS_Security_DomainId domain_id = 0;
+  DDS_Security_Qos participant_qos;
+  DDS_Security_GUID_t candidate_participant_guid;
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  DDS_Security_GuidPrefix_t prefix = {0xb0, 0xb1, 0xb2, 0xb3, 0xb4, 0xb5, 0xb6, 0xb7, 0xb8, 0xb9, 0xba, 0xbb};
+  DDS_Security_EntityId_t entityId = {{0xb0, 0xb1, 0xb2}, 0x1};
+
+  memset(&local_participant_guid, 0, sizeof(local_participant_guid));
+  memcpy(&candidate_participant_guid.prefix, &prefix, sizeof(prefix));
+  memcpy(&candidate_participant_guid.entityId, &entityId, sizeof(entityId));
+
+  fill_participant_qos(&participant_qos, permission_expiry, "Test_Governance_ok.p7s");
+
+  /* Now call the function. */
+  result = auth->validate_local_identity(
+      auth,
+      &local_identity_handle,
+      &local_participant_guid,
+      domain_id,
+      &participant_qos,
+      &candidate_participant_guid,
+      &exception);
+
+  if (result != DDS_SECURITY_VALIDATION_OK)
+  {
+    res = DDS_SECURITY_ERR_UNDEFINED_CODE;
+    printf("validate_local_identity_failed: (%d) %s\n", (int)exception.code, exception.message ? exception.message : "Error message missing");
+  }
+
+  reset_exception(&exception);
+
+  if (res == 0)
+  {
+    local_permissions_handle = access_control->validate_local_permissions(
+        access_control,
+        auth,
+        local_identity_handle,
+        0,
+        &participant_qos,
+        &exception);
+
+    if (local_permissions_handle == DDS_SECURITY_HANDLE_NIL)
+    {
+      printf("validate_local_permissions_failed: (%d) %s\n", (int)exception.code, exception.message ? exception.message : "Error message missing");
+      if (exception.code == DDS_SECURITY_ERR_VALIDITY_PERIOD_EXPIRED_CODE)
+        /* This can happen on very slow platforms or when doing a valgrind run. */
+        res = DDS_SECURITY_ERR_VALIDITY_PERIOD_EXPIRED_CODE;
+      else
+        res = DDS_SECURITY_ERR_UNDEFINED_CODE;
+    }
+  }
+
+  dds_security_property_deinit(&participant_qos.property.value);
+  ddsrt_free(exception.message);
+
+  return res;
+}
+
+static void clear_local_identity_and_permissions(void)
+{
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  DDS_Security_boolean success;
+
+  if (local_permissions_handle != DDS_SECURITY_HANDLE_NIL)
+  {
+    success = access_control->return_permissions_handle(access_control, local_permissions_handle, &exception);
+    if (!success)
+      printf("return_permission_handle failed: %s\n", exception.message ? exception.message : "Error message missing");
+    reset_exception(&exception);
+  }
+
+  if (local_identity_handle != DDS_SECURITY_HANDLE_NIL)
+  {
+    success = auth->return_identity_handle(auth, local_identity_handle, &exception);
+    if (!success)
+      printf("return_identity_handle failed: %s\n", exception.message ? exception.message : "Error message missing");
+    reset_exception(&exception);
+  }
+}
+
+static void set_path_to_etc_dir(void)
+{
+  ddsrt_asprintf(&g_path_to_etc_dir, "%s%s", CONFIG_ENV_TESTS_DIR, RELATIVE_PATH_TO_ETC_DIR);
+}
+
+static void suite_listeners_access_control_init(void)
+{
+  plugins = load_plugins(&access_control, &auth, NULL /* Cryptograpy */);
+  CU_ASSERT_FATAL(plugins != NULL);
+  set_path_to_etc_dir();
+  OpenSSL_add_all_algorithms();
+  ERR_load_crypto_strings();
+}
+
+static void suite_listeners_access_control_fini(void)
+{
+  unload_plugins(plugins);
+  ddsrt_free(g_path_to_etc_dir);
+  EVP_cleanup();
+  CRYPTO_cleanup_all_ex_data();
+  REMOVE_THREAD_STATE();
+  ERR_free_strings();
+}
+
+static DDS_Security_boolean on_revoke_permissions_cb(dds_security_access_control_listener *instance, const dds_security_access_control *plugin, const DDS_Security_PermissionsHandle handle)
+{
+  DDSRT_UNUSED_ARG(instance);
+  DDSRT_UNUSED_ARG(plugin);
+  if (permission_handle_for_callback1 == DDS_SECURITY_HANDLE_NIL)
+    permission_handle_for_callback1 = handle;
+  else if (permission_handle_for_callback2 == DDS_SECURITY_HANDLE_NIL)
+    permission_handle_for_callback2 = handle;
+  printf("Listener called for handle: %lld  Local:%ld Remote:%ld\n", (long long)handle, local_permissions_handle, remote_permissions_handle);
+  return true;
+}
+
+CU_Test(ddssec_builtin_listeners_access_control, local_2secs, .init = suite_listeners_access_control_init, .fini = suite_listeners_access_control_fini)
+{
+  DDS_Security_PermissionsHandle result;
+  DDS_Security_PermissionsToken permissions_token;
+  DDS_Security_AuthenticatedPeerCredentialToken credential_token;
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  DDS_Security_long valid;
+  int r;
+  dds_duration_t time_left = DDS_MSECS(10000);
+  bool local_expired = false;
+  bool remote_expired = false;
+
+  local_expiry_date = 0;
+  remote_expiry_date = 0;
+
+  ac_listener.on_revoke_permissions = &on_revoke_permissions_cb;
+
+  valid = validate_local_identity_and_permissions(2);
+  if (valid == DDS_SECURITY_ERR_VALIDITY_PERIOD_EXPIRED_CODE)
+  {
+    /* This can happen on very slow platforms or when doing a valgrind run.
+         * Just take our losses and quit, simulating a success. */
+    return;
+  }
+  CU_ASSERT_FATAL(valid == DDS_SECURITY_ERR_OK_CODE);
+
+  /* Check if we actually have validate_remote_permissions function. */
+  CU_ASSERT_FATAL(access_control != NULL);
+  CU_ASSERT_FATAL(local_identity_handle != DDS_SECURITY_HANDLE_NIL);
+  CU_ASSERT_FATAL(access_control->validate_remote_permissions != NULL);
+  CU_ASSERT_FATAL(access_control->return_permissions_handle != NULL);
+
+  fill_permissions_token(&permissions_token);
+  r = fill_peer_credential_token(&credential_token, 1);
+  CU_ASSERT_FATAL(r);
+
+  remote_identity_handle++;
+
+  access_control->set_listener(access_control, &ac_listener, &exception);
+
+  result = access_control->validate_remote_permissions(
+      access_control,
+      auth,
+      local_identity_handle,
+      remote_identity_handle,
+      &permissions_token,
+      &credential_token,
+      &exception);
+
+  if (result == 0)
+  {
+    printf("validate_remote_permissions_failed: %s\n", exception.message ? exception.message : "Error message missing");
+    /* Expiry can happen on very slow platforms or when doing a valgrind run.
+         * Just take our losses and quit, simulating a success. */
+    CU_ASSERT(exception.code == DDS_SECURITY_ERR_VALIDITY_PERIOD_EXPIRED_CODE);
+    goto end;
+  }
+
+  remote_permissions_handle = result;
+
+  reset_exception(&exception);
+
+  while (time_left > 0 && (!local_expired || !remote_expired))
+  {
+    /* Normally, it is expected that the remote expiry is triggered before the
+         * local one. However, that can change on slow platforms. */
+    if (remote_expiry_date < local_expiry_date)
+    {
+      if (permission_handle_for_callback1 == remote_permissions_handle)
+      {
+        remote_expired = true;
+      }
+      if (permission_handle_for_callback2 == local_permissions_handle)
+      {
+        local_expired = true;
+      }
+    }
+    else
+    {
+      if (permission_handle_for_callback2 == remote_permissions_handle)
+      {
+        remote_expired = true;
+      }
+      if (permission_handle_for_callback1 == local_permissions_handle)
+      {
+        local_expired = true;
+      }
+    }
+
+    dds_sleepfor(DDS_MSECS(100));
+    time_left -= DDS_MSECS(100);
+  }
+
+  CU_ASSERT(local_expired);
+  CU_ASSERT(remote_expired);
+
+  access_control->return_permissions_handle(access_control, result, &exception);
+
+end:
+  reset_exception(&exception);
+
+  DDS_Security_DataHolder_deinit((DDS_Security_DataHolder *)&permissions_token);
+  DDS_Security_DataHolder_deinit((DDS_Security_DataHolder *)&credential_token);
+
+  clear_local_identity_and_permissions();
+}
diff --git a/src/security/builtin_plugins/tests/validate_local_permissions/etc/Test_File_empty.txt b/src/security/builtin_plugins/tests/validate_local_permissions/etc/Test_File_empty.txt
new file mode 100644
index 0000000..e69de29
diff --git a/src/security/builtin_plugins/tests/validate_local_permissions/etc/Test_File_text.txt b/src/security/builtin_plugins/tests/validate_local_permissions/etc/Test_File_text.txt
new file mode 100644
index 0000000..c1991b0
--- /dev/null
+++ b/src/security/builtin_plugins/tests/validate_local_permissions/etc/Test_File_text.txt
@@ -0,0 +1,3 @@
+This is just a file to see how the Security Plugin
+reacts when it receives a file that doesn't contain
+expected content, but just some text.
diff --git a/src/security/builtin_plugins/tests/validate_local_permissions/etc/Test_Governance_check_create_participant.p7s b/src/security/builtin_plugins/tests/validate_local_permissions/etc/Test_Governance_check_create_participant.p7s
new file mode 100644
index 0000000..8992b03
--- /dev/null
+++ b/src/security/builtin_plugins/tests/validate_local_permissions/etc/Test_Governance_check_create_participant.p7s
@@ -0,0 +1,199 @@
+MIME-Version: 1.0
+Content-Type: multipart/signed; protocol="application/x-pkcs7-signature"; micalg="sha-256"; boundary="----988CFBB47A225358D7A5B33A4CA9AD64"
+
+This is an S/MIME signed message
+
+------988CFBB47A225358D7A5B33A4CA9AD64
+Content-Type: text/plain
+
+<?xml version="1.0" encoding="utf-8"?>
+<dds xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xsi:noNamespaceSchemaLocation="https://www.omg.org/spec/DDS-SECURITY/20170901/omg_shared_ca_governance.xsd">
+    <domain_access_rules>
+        <domain_rule>
+            <!-- No access control by any topic and participant is access protected -->
+            <domains>
+                <id>1</id>
+            </domains>
+            <allow_unauthenticated_participants>1</allow_unauthenticated_participants>
+            <rtps_protection_kind>NONE</rtps_protection_kind>
+            <discovery_protection_kind>SIGN</discovery_protection_kind>
+            <liveliness_protection_kind>ENCRYPT</liveliness_protection_kind>
+            <!--  Only and any authenticated DomainParticipant should be allowed to join the domain and
+                  see the discovery data without checking access control  -->
+            <enable_join_access_control>TRUE</enable_join_access_control>
+
+            <topic_access_rules>
+                <topic_rule>
+                    <enable_liveliness_protection>FALSE</enable_liveliness_protection>
+                    <data_protection_kind>ENCRYPT</data_protection_kind>
+                    <enable_discovery_protection>TRUE</enable_discovery_protection>
+                    <metadata_protection_kind>SIGN</metadata_protection_kind>
+                    <topic_expression>Topic1</topic_expression>
+                    <!-- The read access to all topics should be open to all. -->
+                    <enable_read_access_control>true</enable_read_access_control>
+                    <!-- The write access to all topics should be open to all. -->
+                    <enable_write_access_control>true</enable_write_access_control>
+                </topic_rule>
+                <topic_rule>
+                    <enable_liveliness_protection>FALSE</enable_liveliness_protection>
+                    <data_protection_kind>ENCRYPT</data_protection_kind>
+                    <enable_discovery_protection>TRUE</enable_discovery_protection>
+                    <metadata_protection_kind>SIGN</metadata_protection_kind>
+                    <topic_expression>Topic2</topic_expression>
+                    <!-- The read access to all topics should be open to all. -->
+                    <enable_read_access_control>true</enable_read_access_control>
+                    <!-- The write access to all topics should be open to all. -->
+                    <enable_write_access_control>true</enable_write_access_control>
+                </topic_rule>
+            </topic_access_rules>
+        </domain_rule>
+        <domain_rule>
+            <!-- No write access control by one topic -->
+            <domains>
+                <id>2</id>
+            </domains>
+            <allow_unauthenticated_participants>1</allow_unauthenticated_participants>
+            <rtps_protection_kind>NONE</rtps_protection_kind>
+            <discovery_protection_kind>SIGN</discovery_protection_kind>
+            <liveliness_protection_kind>ENCRYPT</liveliness_protection_kind>
+            <!--  Only and any authenticated DomainParticipant should be allowed to join the domain and
+                  see the discovery data without checking access control  -->
+            <enable_join_access_control>TRUE</enable_join_access_control>
+
+            <topic_access_rules>
+                <topic_rule>
+                    <enable_liveliness_protection>FALSE</enable_liveliness_protection>
+                    <data_protection_kind>ENCRYPT</data_protection_kind>
+                    <enable_discovery_protection>TRUE</enable_discovery_protection>
+                    <metadata_protection_kind>SIGN</metadata_protection_kind>
+                    <topic_expression>Topic1</topic_expression>
+                    <!-- The read access to all topics should be open to all. -->
+                    <enable_read_access_control>true</enable_read_access_control>
+                    <!-- The write access to all topics should be open to all. -->
+                    <enable_write_access_control>false</enable_write_access_control>
+                </topic_rule>
+                <topic_rule>
+                    <enable_liveliness_protection>FALSE</enable_liveliness_protection>
+                    <data_protection_kind>ENCRYPT</data_protection_kind>
+                    <enable_discovery_protection>TRUE</enable_discovery_protection>
+                    <metadata_protection_kind>SIGN</metadata_protection_kind>
+                    <topic_expression>Topic2</topic_expression>
+                    <!-- The read access to all topics should be open to all. -->
+                    <enable_read_access_control>true</enable_read_access_control>
+                    <!-- The write access to all topics should be open to all. -->
+                    <enable_write_access_control>true</enable_write_access_control>
+                </topic_rule>
+            </topic_access_rules>
+        </domain_rule> 
+        <domain_rule>
+            <!-- No write and read access control by all topic -->
+            <domains>
+                <id>3</id>
+            </domains>
+            <allow_unauthenticated_participants>1</allow_unauthenticated_participants>
+            <rtps_protection_kind>NONE</rtps_protection_kind>
+            <discovery_protection_kind>SIGN</discovery_protection_kind>
+            <liveliness_protection_kind>ENCRYPT</liveliness_protection_kind>
+            <!--  Only and any authenticated DomainParticipant should be allowed to join the domain and
+                  see the discovery data without checking access control  -->
+            <enable_join_access_control>TRUE</enable_join_access_control>
+
+            <topic_access_rules>
+                <topic_rule>
+                    <enable_liveliness_protection>FALSE</enable_liveliness_protection>
+                    <data_protection_kind>ENCRYPT</data_protection_kind>
+                    <enable_discovery_protection>TRUE</enable_discovery_protection>
+                    <metadata_protection_kind>SIGN</metadata_protection_kind>
+                    <topic_expression>Topic1</topic_expression>
+                    <!-- The read access to all topics should be open to all. -->
+                    <enable_read_access_control>false</enable_read_access_control>
+                    <!-- The write access to all topics should be open to all. -->
+                    <enable_write_access_control>false</enable_write_access_control>
+                </topic_rule>
+                <topic_rule>
+                    <enable_liveliness_protection>FALSE</enable_liveliness_protection>
+                    <data_protection_kind>ENCRYPT</data_protection_kind>
+                    <enable_discovery_protection>TRUE</enable_discovery_protection>
+                    <metadata_protection_kind>SIGN</metadata_protection_kind>
+                    <topic_expression>Topic2</topic_expression>
+                    <!-- The read access to all topics should be open to all. -->
+                    <enable_read_access_control>false</enable_read_access_control>
+                    <!-- The write access to all topics should be open to all. -->
+                    <enable_write_access_control>false</enable_write_access_control>
+                </topic_rule>
+            </topic_access_rules>
+        </domain_rule>                  
+        <domain_rule>
+            <!-- Participant is access protected -->
+            <domains>
+                <id>4</id>
+            </domains>
+            <allow_unauthenticated_participants>1</allow_unauthenticated_participants>
+            <rtps_protection_kind>NONE</rtps_protection_kind>
+            <discovery_protection_kind>SIGN</discovery_protection_kind>
+            <liveliness_protection_kind>ENCRYPT</liveliness_protection_kind>
+            <!--  Only and any authenticated DomainParticipant should be allowed to join the domain and
+                  see the discovery data without checking access control  -->
+            <enable_join_access_control>FALSE</enable_join_access_control>
+
+            <topic_access_rules>
+                <topic_rule>
+                    <enable_liveliness_protection>FALSE</enable_liveliness_protection>
+                    <data_protection_kind>ENCRYPT</data_protection_kind>
+                    <enable_discovery_protection>TRUE</enable_discovery_protection>
+                    <metadata_protection_kind>SIGN</metadata_protection_kind>
+                    <topic_expression>Topic1</topic_expression>
+                    <!-- The read access to all topics should be open to all. -->
+                    <enable_read_access_control>true</enable_read_access_control>
+                    <!-- The write access to all topics should be open to all. -->
+                    <enable_write_access_control>true</enable_write_access_control>
+                </topic_rule>
+            </topic_access_rules>
+        </domain_rule>
+    </domain_access_rules>
+</dds>
+
+------988CFBB47A225358D7A5B33A4CA9AD64
+Content-Type: application/x-pkcs7-signature; name="smime.p7s"
+Content-Transfer-Encoding: base64
+Content-Disposition: attachment; filename="smime.p7s"
+
+MIIGXgYJKoZIhvcNAQcCoIIGTzCCBksCAQExDzANBglghkgBZQMEAgEFADALBgkq
+hkiG9w0BBwGgggORMIIDjTCCAnWgAwIBAgIJANsr3sm0NrypMA0GCSqGSIb3DQEB
+CwUAMFwxCzAJBgNVBAYTAk5MMRMwEQYDVQQIDApTb21lLVN0YXRlMR8wHQYDVQQK
+DBZBRExJTksgVGVjaG5vbG9jeSBJbmMuMRcwFQYDVQQDDA5hZGxpbmt0ZWNoLmNv
+bTAgFw0xODA3MzAxMjQ1NTVaGA8yMTE4MDcwNjEyNDU1NVowXDELMAkGA1UEBhMC
+TkwxEzARBgNVBAgMClNvbWUtU3RhdGUxHzAdBgNVBAoMFkFETElOSyBUZWNobm9s
+b2N5IEluYy4xFzAVBgNVBAMMDmFkbGlua3RlY2guY29tMIIBIjANBgkqhkiG9w0B
+AQEFAAOCAQ8AMIIBCgKCAQEAu7jfnJ0wYVuXgG+PgNawdN38+dRpa8jceqi+blID
+ehV6XCxrnGXusTCDuFmo7HMOBVMVNDXlcBWgoGd+u5EultnOEiIeGTgtHc1O6V9w
+icp3BGSpZZax/TcONjMVORaqHCADbQ2J8wsz1FHxuKDwX6BJElYOlK77lb/x3yLs
+DFFC+a0qn2RFh37rcWBRAHy8VEASXKZElT9ZmfKd+KUq34KojhNJ4DepKStTq074
+BRDXVivx+wVD951LFNPiQXq+mgHcLj1k37KlZflTFhdP5oEMtATNsXNJPHlEymiy
+SogRWAmKhysLQudukHfNKN+r0FEQMk/hzpYcFeZSOvbfNQIDAQABo1AwTjAdBgNV
+HQ4EFgQURWMbWvBKZwJvRV1/tyc1R82k0+gwHwYDVR0jBBgwFoAURWMbWvBKZwJv
+RV1/tyc1R82k0+gwDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAQEAkPF+
+ysVtvHnk2hpu9yNDLCJ96ZzIoKOyY7uRj4ovzlAHFdpNOJQdcJihTmN8i7Trht9X
+Vh0rGoR/6nHzo3TIeiogRC80RlDtuA3PF2dDQBMVDStlZMTZPb693hfjdAjhyyw9
+yghhKHHqNDvSsAL0KfBqjG4yGfGpJylYXIT5fWuKlo/ln/yyPa5s54T5XDo+CMbt
+lLX3QnwVOmaRyzylPiTcPCDIkdLBdXmlfyJcmW6fWa6kPx+35MOxPsXZbujCo+42
++OyLqcH1rKT6XhcshjXBEf+kdgUfSClrM1pNRWsw2ChIYim0F+nry5JFy0Y+8Hbb
+6SDB340BFmtgDHbFHTGCApEwggKNAgEBMGkwXDELMAkGA1UEBhMCTkwxEzARBgNV
+BAgMClNvbWUtU3RhdGUxHzAdBgNVBAoMFkFETElOSyBUZWNobm9sb2N5IEluYy4x
+FzAVBgNVBAMMDmFkbGlua3RlY2guY29tAgkA2yveybQ2vKkwDQYJYIZIAWUDBAIB
+BQCggfowGAYJKoZIhvcNAQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG9w0BCQUxDxcN
+MTkwMzI5MTMwODAyWjAvBgkqhkiG9w0BCQQxIgQg9ZheySVcKVr9eNKQTeuBdR0z
+Cbgnm4HbSvO8/V0a7CAwgY4GCSqGSIb3DQEJDzGBgDB+MAsGCWCGSAFlAwQBKjAI
+BgYqhQMCAgkwCAYGKoUDAgIVMAsGCWCGSAFlAwQBFjALBglghkgBZQMEAQIwCgYI
+KoZIhvcNAwcwDgYIKoZIhvcNAwICAgCAMA0GCCqGSIb3DQMCAgFAMAcGBSsOAwIH
+MA0GCCqGSIb3DQMCAgEoMA0GCSqGSIb3DQEBAQUABIIBACn66JQOghwlIQUMDQ0s
+vMCGMl7OcZtxDdNQ2BYajufv+JGaf46xP6TWk4+c+bDq+9XTDFoTr/KY2XP7vKVD
+RSAm9nlqChzzsKF/7yYdzOP8hILF644PT837mP+E5ss4EYPoPByQLVPWr1B52xWB
+N/kixmZcMxe4btXqE8LGlSsPNioniZsDBRlDOcdFjxTL/3Ksgv6fX2gSEJgYVBH/
+xZ+Cpf4TsdtVDrQwUynck1+BogRtcofnkBFuKozqzwvzDQoLfW2fMnct5Jd7KPwM
+6kN/bRvOEMGYTKYRgfJVdM4rZqbfdRlVnCj+pza4dIHmf5BDSOlsbRqWyJPRmQ8S
+JkM=
+
+------988CFBB47A225358D7A5B33A4CA9AD64--
+
diff --git a/src/security/builtin_plugins/tests/validate_local_permissions/etc/Test_Governance_check_create_participant.xml b/src/security/builtin_plugins/tests/validate_local_permissions/etc/Test_Governance_check_create_participant.xml
new file mode 100644
index 0000000..37749a3
--- /dev/null
+++ b/src/security/builtin_plugins/tests/validate_local_permissions/etc/Test_Governance_check_create_participant.xml
@@ -0,0 +1,147 @@
+<?xml version="1.0" encoding="utf-8"?>
+<dds xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xsi:noNamespaceSchemaLocation="https://www.omg.org/spec/DDS-SECURITY/20170901/omg_shared_ca_governance.xsd">
+    <domain_access_rules>
+        <domain_rule>
+            <!-- No access control by any topic and participant is access protected -->
+            <domains>
+                <id>1</id>
+            </domains>
+            <allow_unauthenticated_participants>1</allow_unauthenticated_participants>
+            <rtps_protection_kind>NONE</rtps_protection_kind>
+            <discovery_protection_kind>SIGN</discovery_protection_kind>
+            <liveliness_protection_kind>ENCRYPT</liveliness_protection_kind>
+            <!--  Only and any authenticated DomainParticipant should be allowed to join the domain and
+                  see the discovery data without checking access control  -->
+            <enable_join_access_control>TRUE</enable_join_access_control>
+
+            <topic_access_rules>
+                <topic_rule>
+                    <enable_liveliness_protection>FALSE</enable_liveliness_protection>
+                    <data_protection_kind>ENCRYPT</data_protection_kind>
+                    <enable_discovery_protection>TRUE</enable_discovery_protection>
+                    <metadata_protection_kind>SIGN</metadata_protection_kind>
+                    <topic_expression>Topic1</topic_expression>
+                    <!-- The read access to all topics should be open to all. -->
+                    <enable_read_access_control>true</enable_read_access_control>
+                    <!-- The write access to all topics should be open to all. -->
+                    <enable_write_access_control>true</enable_write_access_control>
+                </topic_rule>
+                <topic_rule>
+                    <enable_liveliness_protection>FALSE</enable_liveliness_protection>
+                    <data_protection_kind>ENCRYPT</data_protection_kind>
+                    <enable_discovery_protection>TRUE</enable_discovery_protection>
+                    <metadata_protection_kind>SIGN</metadata_protection_kind>
+                    <topic_expression>Topic2</topic_expression>
+                    <!-- The read access to all topics should be open to all. -->
+                    <enable_read_access_control>true</enable_read_access_control>
+                    <!-- The write access to all topics should be open to all. -->
+                    <enable_write_access_control>true</enable_write_access_control>
+                </topic_rule>
+            </topic_access_rules>
+        </domain_rule>
+        <domain_rule>
+            <!-- No write access control by one topic -->
+            <domains>
+                <id>2</id>
+            </domains>
+            <allow_unauthenticated_participants>1</allow_unauthenticated_participants>
+            <rtps_protection_kind>NONE</rtps_protection_kind>
+            <discovery_protection_kind>SIGN</discovery_protection_kind>
+            <liveliness_protection_kind>ENCRYPT</liveliness_protection_kind>
+            <!--  Only and any authenticated DomainParticipant should be allowed to join the domain and
+                  see the discovery data without checking access control  -->
+            <enable_join_access_control>TRUE</enable_join_access_control>
+
+            <topic_access_rules>
+                <topic_rule>
+                    <enable_liveliness_protection>FALSE</enable_liveliness_protection>
+                    <data_protection_kind>ENCRYPT</data_protection_kind>
+                    <enable_discovery_protection>TRUE</enable_discovery_protection>
+                    <metadata_protection_kind>SIGN</metadata_protection_kind>
+                    <topic_expression>Topic1</topic_expression>
+                    <!-- The read access to all topics should be open to all. -->
+                    <enable_read_access_control>true</enable_read_access_control>
+                    <!-- The write access to all topics should be open to all. -->
+                    <enable_write_access_control>false</enable_write_access_control>
+                </topic_rule>
+                <topic_rule>
+                    <enable_liveliness_protection>FALSE</enable_liveliness_protection>
+                    <data_protection_kind>ENCRYPT</data_protection_kind>
+                    <enable_discovery_protection>TRUE</enable_discovery_protection>
+                    <metadata_protection_kind>SIGN</metadata_protection_kind>
+                    <topic_expression>Topic2</topic_expression>
+                    <!-- The read access to all topics should be open to all. -->
+                    <enable_read_access_control>true</enable_read_access_control>
+                    <!-- The write access to all topics should be open to all. -->
+                    <enable_write_access_control>true</enable_write_access_control>
+                </topic_rule>
+            </topic_access_rules>
+        </domain_rule> 
+        <domain_rule>
+            <!-- No write and read access control by all topic -->
+            <domains>
+                <id>3</id>
+            </domains>
+            <allow_unauthenticated_participants>1</allow_unauthenticated_participants>
+            <rtps_protection_kind>NONE</rtps_protection_kind>
+            <discovery_protection_kind>SIGN</discovery_protection_kind>
+            <liveliness_protection_kind>ENCRYPT</liveliness_protection_kind>
+            <!--  Only and any authenticated DomainParticipant should be allowed to join the domain and
+                  see the discovery data without checking access control  -->
+            <enable_join_access_control>TRUE</enable_join_access_control>
+
+            <topic_access_rules>
+                <topic_rule>
+                    <enable_liveliness_protection>FALSE</enable_liveliness_protection>
+                    <data_protection_kind>ENCRYPT</data_protection_kind>
+                    <enable_discovery_protection>TRUE</enable_discovery_protection>
+                    <metadata_protection_kind>SIGN</metadata_protection_kind>
+                    <topic_expression>Topic1</topic_expression>
+                    <!-- The read access to all topics should be open to all. -->
+                    <enable_read_access_control>false</enable_read_access_control>
+                    <!-- The write access to all topics should be open to all. -->
+                    <enable_write_access_control>false</enable_write_access_control>
+                </topic_rule>
+                <topic_rule>
+                    <enable_liveliness_protection>FALSE</enable_liveliness_protection>
+                    <data_protection_kind>ENCRYPT</data_protection_kind>
+                    <enable_discovery_protection>TRUE</enable_discovery_protection>
+                    <metadata_protection_kind>SIGN</metadata_protection_kind>
+                    <topic_expression>Topic2</topic_expression>
+                    <!-- The read access to all topics should be open to all. -->
+                    <enable_read_access_control>false</enable_read_access_control>
+                    <!-- The write access to all topics should be open to all. -->
+                    <enable_write_access_control>false</enable_write_access_control>
+                </topic_rule>
+            </topic_access_rules>
+        </domain_rule>                  
+        <domain_rule>
+            <!-- Participant is access protected -->
+            <domains>
+                <id>4</id>
+            </domains>
+            <allow_unauthenticated_participants>1</allow_unauthenticated_participants>
+            <rtps_protection_kind>NONE</rtps_protection_kind>
+            <discovery_protection_kind>SIGN</discovery_protection_kind>
+            <liveliness_protection_kind>ENCRYPT</liveliness_protection_kind>
+            <!--  Only and any authenticated DomainParticipant should be allowed to join the domain and
+                  see the discovery data without checking access control  -->
+            <enable_join_access_control>FALSE</enable_join_access_control>
+
+            <topic_access_rules>
+                <topic_rule>
+                    <enable_liveliness_protection>FALSE</enable_liveliness_protection>
+                    <data_protection_kind>ENCRYPT</data_protection_kind>
+                    <enable_discovery_protection>TRUE</enable_discovery_protection>
+                    <metadata_protection_kind>SIGN</metadata_protection_kind>
+                    <topic_expression>Topic1</topic_expression>
+                    <!-- The read access to all topics should be open to all. -->
+                    <enable_read_access_control>true</enable_read_access_control>
+                    <!-- The write access to all topics should be open to all. -->
+                    <enable_write_access_control>true</enable_write_access_control>
+                </topic_rule>
+            </topic_access_rules>
+        </domain_rule>
+    </domain_access_rules>
+</dds>
diff --git a/src/security/builtin_plugins/tests/validate_local_permissions/etc/Test_Governance_full.p7s b/src/security/builtin_plugins/tests/validate_local_permissions/etc/Test_Governance_full.p7s
new file mode 100644
index 0000000..4ea8fe8
--- /dev/null
+++ b/src/security/builtin_plugins/tests/validate_local_permissions/etc/Test_Governance_full.p7s
@@ -0,0 +1,267 @@
+MIME-Version: 1.0
+Content-Type: multipart/signed; protocol="application/x-pkcs7-signature"; micalg="sha-256"; boundary="----05DBD6F6E587875751A79EAC78048D60"
+
+This is an S/MIME signed message
+
+------05DBD6F6E587875751A79EAC78048D60
+Content-Type: text/plain
+
+<?xml version="1.0" encoding="utf-8"?>
+<dds xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xsi:noNamespaceSchemaLocation="https://www.omg.org/spec/DDS-SECURITY/20170901/omg_shared_ca_governance.xsd">
+    <domain_access_rules>
+        <domain_rule>
+            <domains>
+                <!-- All domains -->
+                <id>20</id>
+                <id_range>
+                    <min>0</min>
+                    <max>23</max>
+                </id_range>
+                <id_range>
+                    <min>100</min>
+                    <max>120</max>
+                </id_range>
+                <id>200</id>
+            </domains>
+
+            <!-- DomainParticipant that cann not authenticate or fail the authentication should be
+                 allowed to join the domain and see any any discovery data that are configured as "unprotected"
+                 and topics that are configured as "unprotected" -->
+            <allow_unauthenticated_participants>false</allow_unauthenticated_participants>
+
+            <!--  Only and any authenticated DomainParticipant should be allowed to join the domain and
+                  see the discovery data without checking access control  -->
+            <enable_join_access_control>TRUE</enable_join_access_control>
+
+            <!-- Discovery information should be protected with encryption followed by MAC (Message Authentication Codes) -->
+            <discovery_protection_kind>SIGN_WITH_ORIGIN_AUTHENTICATION</discovery_protection_kind>
+
+            <!--  Liveliness messages are also encrypted -->
+            <liveliness_protection_kind>ENCRYPT</liveliness_protection_kind>
+
+            <!-- Whole RTPS message is not protected -->
+            <rtps_protection_kind>ENCRYPT_WITH_ORIGIN_AUTHENTICATION</rtps_protection_kind>
+
+            <topic_access_rules>
+                                
+                <topic_rule>
+                    <!-- All (non-builtin) topics -->
+                    <topic_expression>OwnShip?ata</topic_expression>
+
+                    <!-- Liveliness QoS data is protected -->
+                    <enable_liveliness_protection>FALSE</enable_liveliness_protection>
+
+                    <!-- The discovery information on specific Topics should be sent
+                         using the secure (protected) discovery writers -->
+                    <enable_discovery_protection>false</enable_discovery_protection>
+
+                    <!-- The read access to all topics should be open to all. -->
+                    <enable_read_access_control>false</enable_read_access_control>
+
+                    <!-- The write access to all topics should be open to all. -->
+                    <enable_write_access_control>true</enable_write_access_control>
+
+                    <!-- Whole RTPS sub-message is protected. This includes metadata information
+                         like sequence numbers, heartbeats, key hashes, gaps,
+                         acknowledgment messages, etc. It also includes th possible payload. -->
+                    <metadata_protection_kind>SIGN</metadata_protection_kind>
+
+                    <!-- The payload data sent on the Topic (serialized application level data) should be
+                         protected with Encrypt then MAC. -->
+                    <data_protection_kind>ENCRYPT</data_protection_kind>
+                </topic_rule>
+                
+                <topic_rule>
+                    <!-- All (non-builtin) topics -->
+                    <topic_expression>Kinematics</topic_expression>
+
+                    <!-- Liveliness QoS data is protected -->
+                    <enable_liveliness_protection>true</enable_liveliness_protection>
+
+                    <!-- The discovery information on specific Topics should be sent
+                         using the secure (protected) discovery writers -->
+                    <enable_discovery_protection>true</enable_discovery_protection>
+
+                    <!-- The read access to all topics should be open to all. -->
+                    <enable_read_access_control>true</enable_read_access_control>
+
+                    <!-- The write access to all topics should be open to all. -->
+                    <enable_write_access_control>false</enable_write_access_control>
+
+                    <!-- Whole RTPS sub-message is protected. This includes metadata information
+                         like sequence numbers, heartbeats, key hashes, gaps,
+                         acknowledgment messages, etc. It also includes th possible payload. -->
+                    <metadata_protection_kind>NONE</metadata_protection_kind>
+
+                    <!-- The payload data sent on the Topic (serialized application level data) should be
+                         protected with Encrypt then MAC. -->
+                    <data_protection_kind>NONE</data_protection_kind>
+                </topic_rule>
+
+                <topic_rule>
+                    <!-- All (non-builtin) topics -->
+                    <topic_expression>*other</topic_expression>
+
+                    <!-- Liveliness QoS data is protected -->
+                    <enable_liveliness_protection>true</enable_liveliness_protection>
+
+                    <!-- The discovery information on specific Topics should be sent
+                         using the secure (protected) discovery writers -->
+                    <enable_discovery_protection>true</enable_discovery_protection>
+
+                    <!-- The read access to all topics should be open to all. -->
+                    <enable_read_access_control>true</enable_read_access_control>
+
+                    <!-- The write access to all topics should be open to all. -->
+                    <enable_write_access_control>true</enable_write_access_control>
+
+                    <!-- Whole RTPS sub-message is protected. This includes metadata information
+                         like sequence numbers, heartbeats, key hashes, gaps,
+                         acknowledgment messages, etc. It also includes th possible payload. -->
+                    <metadata_protection_kind>NONE</metadata_protection_kind>
+
+                    <!-- The payload data sent on the Topic (serialized application level data) should be
+                         protected with Encrypt then MAC. -->
+                    <data_protection_kind>NONE</data_protection_kind>
+                </topic_rule>
+
+                <topic_rule>
+                    <!-- All (non-builtin) topics -->
+                    <topic_expression>*</topic_expression>
+
+                    <!-- Liveliness QoS data is protected -->
+                    <enable_liveliness_protection>true</enable_liveliness_protection>
+
+                    <!-- The discovery information on specific Topics should be sent
+                         using the secure (protected) discovery writers -->
+                    <enable_discovery_protection>true</enable_discovery_protection>
+
+                    <!-- The read access to all topics should be open to all. -->
+                    <enable_read_access_control>false</enable_read_access_control>
+
+                    <!-- The write access to all topics should be open to all. -->
+                    <enable_write_access_control>false</enable_write_access_control>
+
+                    <!-- Whole RTPS sub-message is protected. This includes metadata information
+                         like sequence numbers, heartbeats, key hashes, gaps,
+                         acknowledgment messages, etc. It also includes th possible payload. -->
+                    <metadata_protection_kind>ENCRYPT_WITH_ORIGIN_AUTHENTICATION</metadata_protection_kind>
+
+                    <!-- The payload data sent on the Topic (serialized application level data) should be
+                         protected with Encrypt then MAC. -->
+                    <data_protection_kind>ENCRYPT</data_protection_kind>
+                </topic_rule>
+            </topic_access_rules>
+        </domain_rule>
+        <domain_rule>
+            <domains>
+                <!-- All domains -->
+                <id_range>
+                    <min>100</min>
+                    <max>120</max>
+                </id_range>
+                <id>20</id>
+                <id_range>
+                    <min>0</min>
+                    <max>23</max>
+                </id_range>                
+                <id>200</id>
+                <id>30</id>
+            </domains>
+
+            <!-- DomainParticipant that cann not authenticate or fail the authentication should be
+                 allowed to join the domain and see any any discovery data that are configured as "unprotected"
+                 and topics that are configured as "unprotected" -->
+            <allow_unauthenticated_participants>1</allow_unauthenticated_participants>
+
+            <!--  Only and any authenticated DomainParticipant should be allowed to join the domain and
+                  see the discovery data without checking access control  -->
+            <enable_join_access_control>0</enable_join_access_control>
+
+            <!-- Discovery information should be protected with encryption followed by MAC (Message Authentication Codes) -->
+            <discovery_protection_kind>SIGN</discovery_protection_kind>
+
+            <!--  Liveliness messages are also encrypted -->
+            <liveliness_protection_kind>ENCRYPT</liveliness_protection_kind>
+
+            <!-- Whole RTPS message is not protected -->
+            <rtps_protection_kind>NONE</rtps_protection_kind>
+
+            <topic_access_rules>
+                <topic_rule>
+                    <!-- All (non-builtin) topics -->
+                    <topic_expression>OwnShipData</topic_expression>
+
+                    <!-- Liveliness QoS data is protected -->
+                    <enable_liveliness_protection>true</enable_liveliness_protection>
+
+                    <!-- The discovery information on specific Topics should be sent
+                         using the secure (protected) discovery writers -->
+                    <enable_discovery_protection>true</enable_discovery_protection>
+
+                    <!-- The read access to all topics should be open to all. -->
+                    <enable_read_access_control>false</enable_read_access_control>
+
+                    <!-- The write access to all topics should be open to all. -->
+                    <enable_write_access_control>false</enable_write_access_control>
+
+                    <!-- Whole RTPS sub-message is protected. This includes metadata information
+                         like sequence numbers, heartbeats, key hashes, gaps,
+                         acknowledgment messages, etc. It also includes th possible payload. -->
+                    <metadata_protection_kind>ENCRYPT_WITH_ORIGIN_AUTHENTICATION</metadata_protection_kind>
+
+                    <!-- The payload data sent on the Topic (serialized application level data) should be
+                         protected with Encrypt then MAC. -->
+                    <data_protection_kind>ENCRYPT</data_protection_kind>
+                </topic_rule>
+                
+           
+            </topic_access_rules>
+        </domain_rule>
+    </domain_access_rules>
+</dds>
+
+------05DBD6F6E587875751A79EAC78048D60
+Content-Type: application/x-pkcs7-signature; name="smime.p7s"
+Content-Transfer-Encoding: base64
+Content-Disposition: attachment; filename="smime.p7s"
+
+MIIGXgYJKoZIhvcNAQcCoIIGTzCCBksCAQExDzANBglghkgBZQMEAgEFADALBgkq
+hkiG9w0BBwGgggORMIIDjTCCAnWgAwIBAgIJANsr3sm0NrypMA0GCSqGSIb3DQEB
+CwUAMFwxCzAJBgNVBAYTAk5MMRMwEQYDVQQIDApTb21lLVN0YXRlMR8wHQYDVQQK
+DBZBRExJTksgVGVjaG5vbG9jeSBJbmMuMRcwFQYDVQQDDA5hZGxpbmt0ZWNoLmNv
+bTAgFw0xODA3MzAxMjQ1NTVaGA8yMTE4MDcwNjEyNDU1NVowXDELMAkGA1UEBhMC
+TkwxEzARBgNVBAgMClNvbWUtU3RhdGUxHzAdBgNVBAoMFkFETElOSyBUZWNobm9s
+b2N5IEluYy4xFzAVBgNVBAMMDmFkbGlua3RlY2guY29tMIIBIjANBgkqhkiG9w0B
+AQEFAAOCAQ8AMIIBCgKCAQEAu7jfnJ0wYVuXgG+PgNawdN38+dRpa8jceqi+blID
+ehV6XCxrnGXusTCDuFmo7HMOBVMVNDXlcBWgoGd+u5EultnOEiIeGTgtHc1O6V9w
+icp3BGSpZZax/TcONjMVORaqHCADbQ2J8wsz1FHxuKDwX6BJElYOlK77lb/x3yLs
+DFFC+a0qn2RFh37rcWBRAHy8VEASXKZElT9ZmfKd+KUq34KojhNJ4DepKStTq074
+BRDXVivx+wVD951LFNPiQXq+mgHcLj1k37KlZflTFhdP5oEMtATNsXNJPHlEymiy
+SogRWAmKhysLQudukHfNKN+r0FEQMk/hzpYcFeZSOvbfNQIDAQABo1AwTjAdBgNV
+HQ4EFgQURWMbWvBKZwJvRV1/tyc1R82k0+gwHwYDVR0jBBgwFoAURWMbWvBKZwJv
+RV1/tyc1R82k0+gwDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAQEAkPF+
+ysVtvHnk2hpu9yNDLCJ96ZzIoKOyY7uRj4ovzlAHFdpNOJQdcJihTmN8i7Trht9X
+Vh0rGoR/6nHzo3TIeiogRC80RlDtuA3PF2dDQBMVDStlZMTZPb693hfjdAjhyyw9
+yghhKHHqNDvSsAL0KfBqjG4yGfGpJylYXIT5fWuKlo/ln/yyPa5s54T5XDo+CMbt
+lLX3QnwVOmaRyzylPiTcPCDIkdLBdXmlfyJcmW6fWa6kPx+35MOxPsXZbujCo+42
++OyLqcH1rKT6XhcshjXBEf+kdgUfSClrM1pNRWsw2ChIYim0F+nry5JFy0Y+8Hbb
+6SDB340BFmtgDHbFHTGCApEwggKNAgEBMGkwXDELMAkGA1UEBhMCTkwxEzARBgNV
+BAgMClNvbWUtU3RhdGUxHzAdBgNVBAoMFkFETElOSyBUZWNobm9sb2N5IEluYy4x
+FzAVBgNVBAMMDmFkbGlua3RlY2guY29tAgkA2yveybQ2vKkwDQYJYIZIAWUDBAIB
+BQCggfowGAYJKoZIhvcNAQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG9w0BCQUxDxcN
+MTkwMzI5MTMwODAzWjAvBgkqhkiG9w0BCQQxIgQg0GyBZYdNlmQT2Nv1CHrUEB6+
+C0U0yXvpmj5+mlGojPAwgY4GCSqGSIb3DQEJDzGBgDB+MAsGCWCGSAFlAwQBKjAI
+BgYqhQMCAgkwCAYGKoUDAgIVMAsGCWCGSAFlAwQBFjALBglghkgBZQMEAQIwCgYI
+KoZIhvcNAwcwDgYIKoZIhvcNAwICAgCAMA0GCCqGSIb3DQMCAgFAMAcGBSsOAwIH
+MA0GCCqGSIb3DQMCAgEoMA0GCSqGSIb3DQEBAQUABIIBAJXrVHO7KdgYM20uGGNL
+P4VRPmYVWoWIkl5/OEzZ8uirs+oGJR7tYLiFl1wzXUzPBB/03qsANmlshDpFgbmV
+thTV7AGRg3SXUDa/cG4N9PupE5VRZaVdbcbdH1DfoIZCLLp4HK3HgqUXkH9vnC92
+tdtgzxZOCrQ4A6WbGiBkWr5LtMWg2lnwPp55vrfRoh6u0qVEumD+VQi+Lroo9M1E
+659LB2dwEcNb1g1HyoodpKlUSsbGsY/JA7bbNrw/KIGVYcoXfmpgWmtzUjfpkPDj
+zVPImqr6jdxP4quGmGWRmrLHPrEYJscJqCwjNTi6naXnAvaE4nxQ4HBgveEodTuP
+8tM=
+
+------05DBD6F6E587875751A79EAC78048D60--
+
diff --git a/src/security/builtin_plugins/tests/validate_local_permissions/etc/Test_Governance_full.xml b/src/security/builtin_plugins/tests/validate_local_permissions/etc/Test_Governance_full.xml
new file mode 100644
index 0000000..4ff15ab
--- /dev/null
+++ b/src/security/builtin_plugins/tests/validate_local_permissions/etc/Test_Governance_full.xml
@@ -0,0 +1,215 @@
+<?xml version="1.0" encoding="utf-8"?>
+<dds xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xsi:noNamespaceSchemaLocation="https://www.omg.org/spec/DDS-SECURITY/20170901/omg_shared_ca_governance.xsd">
+    <domain_access_rules>
+        <domain_rule>
+            <domains>
+                <!-- All domains -->
+                <id>20</id>
+                <id_range>
+                    <min>0</min>
+                    <max>23</max>
+                </id_range>
+                <id_range>
+                    <min>100</min>
+                    <max>120</max>
+                </id_range>
+                <id>200</id>
+            </domains>
+
+            <!-- DomainParticipant that cann not authenticate or fail the authentication should be
+                 allowed to join the domain and see any any discovery data that are configured as "unprotected"
+                 and topics that are configured as "unprotected" -->
+            <allow_unauthenticated_participants>false</allow_unauthenticated_participants>
+
+            <!--  Only and any authenticated DomainParticipant should be allowed to join the domain and
+                  see the discovery data without checking access control  -->
+            <enable_join_access_control>TRUE</enable_join_access_control>
+
+            <!-- Discovery information should be protected with encryption followed by MAC (Message Authentication Codes) -->
+            <discovery_protection_kind>SIGN_WITH_ORIGIN_AUTHENTICATION</discovery_protection_kind>
+
+            <!--  Liveliness messages are also encrypted -->
+            <liveliness_protection_kind>ENCRYPT</liveliness_protection_kind>
+
+            <!-- Whole RTPS message is not protected -->
+            <rtps_protection_kind>ENCRYPT_WITH_ORIGIN_AUTHENTICATION</rtps_protection_kind>
+
+            <topic_access_rules>
+                                
+                <topic_rule>
+                    <!-- All (non-builtin) topics -->
+                    <topic_expression>OwnShip?ata</topic_expression>
+
+                    <!-- Liveliness QoS data is protected -->
+                    <enable_liveliness_protection>FALSE</enable_liveliness_protection>
+
+                    <!-- The discovery information on specific Topics should be sent
+                         using the secure (protected) discovery writers -->
+                    <enable_discovery_protection>false</enable_discovery_protection>
+
+                    <!-- The read access to all topics should be open to all. -->
+                    <enable_read_access_control>false</enable_read_access_control>
+
+                    <!-- The write access to all topics should be open to all. -->
+                    <enable_write_access_control>true</enable_write_access_control>
+
+                    <!-- Whole RTPS sub-message is protected. This includes metadata information
+                         like sequence numbers, heartbeats, key hashes, gaps,
+                         acknowledgment messages, etc. It also includes th possible payload. -->
+                    <metadata_protection_kind>SIGN</metadata_protection_kind>
+
+                    <!-- The payload data sent on the Topic (serialized application level data) should be
+                         protected with Encrypt then MAC. -->
+                    <data_protection_kind>ENCRYPT</data_protection_kind>
+                </topic_rule>
+                
+                <topic_rule>
+                    <!-- All (non-builtin) topics -->
+                    <topic_expression>Kinematics</topic_expression>
+
+                    <!-- Liveliness QoS data is protected -->
+                    <enable_liveliness_protection>true</enable_liveliness_protection>
+
+                    <!-- The discovery information on specific Topics should be sent
+                         using the secure (protected) discovery writers -->
+                    <enable_discovery_protection>true</enable_discovery_protection>
+
+                    <!-- The read access to all topics should be open to all. -->
+                    <enable_read_access_control>true</enable_read_access_control>
+
+                    <!-- The write access to all topics should be open to all. -->
+                    <enable_write_access_control>false</enable_write_access_control>
+
+                    <!-- Whole RTPS sub-message is protected. This includes metadata information
+                         like sequence numbers, heartbeats, key hashes, gaps,
+                         acknowledgment messages, etc. It also includes th possible payload. -->
+                    <metadata_protection_kind>NONE</metadata_protection_kind>
+
+                    <!-- The payload data sent on the Topic (serialized application level data) should be
+                         protected with Encrypt then MAC. -->
+                    <data_protection_kind>NONE</data_protection_kind>
+                </topic_rule>
+
+                <topic_rule>
+                    <!-- All (non-builtin) topics -->
+                    <topic_expression>*other</topic_expression>
+
+                    <!-- Liveliness QoS data is protected -->
+                    <enable_liveliness_protection>true</enable_liveliness_protection>
+
+                    <!-- The discovery information on specific Topics should be sent
+                         using the secure (protected) discovery writers -->
+                    <enable_discovery_protection>true</enable_discovery_protection>
+
+                    <!-- The read access to all topics should be open to all. -->
+                    <enable_read_access_control>true</enable_read_access_control>
+
+                    <!-- The write access to all topics should be open to all. -->
+                    <enable_write_access_control>true</enable_write_access_control>
+
+                    <!-- Whole RTPS sub-message is protected. This includes metadata information
+                         like sequence numbers, heartbeats, key hashes, gaps,
+                         acknowledgment messages, etc. It also includes th possible payload. -->
+                    <metadata_protection_kind>NONE</metadata_protection_kind>
+
+                    <!-- The payload data sent on the Topic (serialized application level data) should be
+                         protected with Encrypt then MAC. -->
+                    <data_protection_kind>NONE</data_protection_kind>
+                </topic_rule>
+
+                <topic_rule>
+                    <!-- All (non-builtin) topics -->
+                    <topic_expression>*</topic_expression>
+
+                    <!-- Liveliness QoS data is protected -->
+                    <enable_liveliness_protection>true</enable_liveliness_protection>
+
+                    <!-- The discovery information on specific Topics should be sent
+                         using the secure (protected) discovery writers -->
+                    <enable_discovery_protection>true</enable_discovery_protection>
+
+                    <!-- The read access to all topics should be open to all. -->
+                    <enable_read_access_control>false</enable_read_access_control>
+
+                    <!-- The write access to all topics should be open to all. -->
+                    <enable_write_access_control>false</enable_write_access_control>
+
+                    <!-- Whole RTPS sub-message is protected. This includes metadata information
+                         like sequence numbers, heartbeats, key hashes, gaps,
+                         acknowledgment messages, etc. It also includes th possible payload. -->
+                    <metadata_protection_kind>ENCRYPT_WITH_ORIGIN_AUTHENTICATION</metadata_protection_kind>
+
+                    <!-- The payload data sent on the Topic (serialized application level data) should be
+                         protected with Encrypt then MAC. -->
+                    <data_protection_kind>ENCRYPT</data_protection_kind>
+                </topic_rule>
+            </topic_access_rules>
+        </domain_rule>
+        <domain_rule>
+            <domains>
+                <!-- All domains -->
+                <id_range>
+                    <min>100</min>
+                    <max>120</max>
+                </id_range>
+                <id>20</id>
+                <id_range>
+                    <min>0</min>
+                    <max>23</max>
+                </id_range>                
+                <id>200</id>
+                <id>30</id>
+            </domains>
+
+            <!-- DomainParticipant that cann not authenticate or fail the authentication should be
+                 allowed to join the domain and see any any discovery data that are configured as "unprotected"
+                 and topics that are configured as "unprotected" -->
+            <allow_unauthenticated_participants>1</allow_unauthenticated_participants>
+
+            <!--  Only and any authenticated DomainParticipant should be allowed to join the domain and
+                  see the discovery data without checking access control  -->
+            <enable_join_access_control>0</enable_join_access_control>
+
+            <!-- Discovery information should be protected with encryption followed by MAC (Message Authentication Codes) -->
+            <discovery_protection_kind>SIGN</discovery_protection_kind>
+
+            <!--  Liveliness messages are also encrypted -->
+            <liveliness_protection_kind>ENCRYPT</liveliness_protection_kind>
+
+            <!-- Whole RTPS message is not protected -->
+            <rtps_protection_kind>NONE</rtps_protection_kind>
+
+            <topic_access_rules>
+                <topic_rule>
+                    <!-- All (non-builtin) topics -->
+                    <topic_expression>OwnShipData</topic_expression>
+
+                    <!-- Liveliness QoS data is protected -->
+                    <enable_liveliness_protection>true</enable_liveliness_protection>
+
+                    <!-- The discovery information on specific Topics should be sent
+                         using the secure (protected) discovery writers -->
+                    <enable_discovery_protection>true</enable_discovery_protection>
+
+                    <!-- The read access to all topics should be open to all. -->
+                    <enable_read_access_control>false</enable_read_access_control>
+
+                    <!-- The write access to all topics should be open to all. -->
+                    <enable_write_access_control>false</enable_write_access_control>
+
+                    <!-- Whole RTPS sub-message is protected. This includes metadata information
+                         like sequence numbers, heartbeats, key hashes, gaps,
+                         acknowledgment messages, etc. It also includes th possible payload. -->
+                    <metadata_protection_kind>ENCRYPT_WITH_ORIGIN_AUTHENTICATION</metadata_protection_kind>
+
+                    <!-- The payload data sent on the Topic (serialized application level data) should be
+                         protected with Encrypt then MAC. -->
+                    <data_protection_kind>ENCRYPT</data_protection_kind>
+                </topic_rule>
+                
+           
+            </topic_access_rules>
+        </domain_rule>
+    </domain_access_rules>
+</dds>
diff --git a/src/security/builtin_plugins/tests/validate_local_permissions/etc/Test_Governance_invalid_data.p7s b/src/security/builtin_plugins/tests/validate_local_permissions/etc/Test_Governance_invalid_data.p7s
new file mode 100644
index 0000000..ba75bfe
--- /dev/null
+++ b/src/security/builtin_plugins/tests/validate_local_permissions/etc/Test_Governance_invalid_data.p7s
@@ -0,0 +1,175 @@
+MIME-Version: 1.0
+Content-Type: multipart/signed; protocol="application/x-pkcs7-signature"; micalg="sha-256"; boundary="----1A6607CDB3CA97628720C3874B28523D"
+
+This is an S/MIME signed message
+
+------1A6607CDB3CA97628720C3874B28523D
+Content-Type: text/plain
+
+<?xml version="1.0" encoding="utf-8"?>
+<dds xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xsi:noNamespaceSchemaLocation="https://www.omg.org/spec/DDS-SECURITY/20170901/omg_shared_ca_governance.xsd">
+    <domain_access_rules>
+        <domain_rule>
+            <domains>
+                <!-- All domains -->
+                <id>20</id>
+                <id>30</id>
+                <id_range>
+                    <min>0</min>
+                    <max>23</max>
+                </id_range>
+                <id_range>
+                    <min>100</min>
+                    <max>120</max>
+                </id_range>
+                <id>200</id>
+            </domains>
+
+            <!-- DomainParticipant that cann not authenticate or fail the authentication should be
+                 allowed to join the domain and see any any discovery data that are configured as "unprotected"
+                 and topics that are configured as "unprotected" -->
+            <allow_unauthenticated_participants>false</allow_unauthenticated_participants>
+
+            <!--  Only and any authenticated DomainParticipant should be allowed to join the domain and
+                  see the discovery data without checking access control  -->
+            <enable_join_access_control>TRUE</enable_join_access_control>
+
+            <!-- Discovery information should be protected with encryption followed by MAC (Message Authentication Codes) -->
+            <discovery_protection_kind>SIGN_WITH_ORIGIN_AUTHENTICATION</discovery_protection_kind>
+
+            <!--  Liveliness messages are also encrypted -->
+            <liveliness_protection_kind>ENCRYPT</liveliness_protection_kind>
+
+            <!-- Whole RTPS message is not protected -->
+            <rtps_protection_kind>ENCRYPT_WITH_ORIGIN_AUTHENTICATION</rtps_protection_kind>
+
+            <topic_access_rules>
+                <topic_rule>
+                    <!-- All (non-builtin) topics -->
+                    <topic_expression>*</topic_expression>
+
+                    <!-- Liveliness QoS data is protected -->
+                    <enable_liveliness_protection>true</enable_liveliness_protection>
+
+                    <!-- The discovery information on specific Topics should be sent
+                         using the secure (protected) discovery writers -->
+                    <enable_discovery_protection>true</enable_discovery_protection>
+
+                    <!-- The read access to all topics should be open to all. -->
+                    <enable_read_access_control>false</enable_read_access_control>
+
+                    <!-- The write access to all topics should be open to all. -->
+                    <enable_write_access_control>false</enable_write_access_control>
+
+                    <!-- Whole RTPS sub-message is protected. This includes metadata information
+                         like sequence numbers, heartbeats, key hashes, gaps,
+                         acknowledgment messages, etc. It also includes th possible payload. -->
+                    <metadata_protection_kind>ENCRYPT_WITH_</metadata_protection_kind>
+
+                    <!-- The payload data sent on the Topic (serialized application level data) should be
+                         protected with Encrypt then MAC. -->
+                    <data_protection_kind>ENCRYPT</data_protection_kind>
+                </topic_rule>
+                
+                <topic_rule>
+                    <!-- All (non-builtin) topics -->
+                    <topic_expression>OwnShip?ata</topic_expression>
+
+                    <!-- Liveliness QoS data is protected -->
+                    <enable_liveliness_protection>FALSE</enable_liveliness_protection>
+
+                    <!-- The discovery information on specific Topics should be sent
+                         using the secure (protected) discovery writers -->
+                    <enable_discovery_protection>false</enable_discovery_protection>
+
+                    <!-- The read access to all topics should be open to all. -->
+                    <enable_read_access_control>false</enable_read_access_control>
+
+                    <!-- The write access to all topics should be open to all. -->
+                    <enable_write_access_control>true</enable_write_access_control>
+
+                    <!-- Whole RTPS sub-message is protected. This includes metadata information
+                         like sequence numbers, heartbeats, key hashes, gaps,
+                         acknowledgment messages, etc. It also includes th possible payload. -->
+                    <metadata_protection_kind>SIGN</metadata_protection_kind>
+
+                    <!-- The payload data sent on the Topic (serialized application level data) should be
+                         protected with Encrypt then MAC. -->
+                    <data_protection_kind>ENCRYPT</data_protection_kind>
+                </topic_rule>
+                
+                <topic_rule>
+                    <!-- All (non-builtin) topics -->
+                    <topic_expression>Kinematics</topic_expression>
+
+                    <!-- Liveliness QoS data is protected -->
+                    <enable_liveliness_protection>true</enable_liveliness_protection>
+
+                    <!-- The discovery information on specific Topics should be sent
+                         using the secure (protected) discovery writers -->
+                    <enable_discovery_protection>true</enable_discovery_protection>
+
+                    <!-- The read access to all topics should be open to all. -->
+                    <enable_read_access_control>true</enable_read_access_control>
+
+                    <!-- The write access to all topics should be open to all. -->
+                    <enable_write_access_control>false</enable_write_access_control>
+
+                    <!-- Whole RTPS sub-message is protected. This includes metadata information
+                         like sequence numbers, heartbeats, key hashes, gaps,
+                         acknowledgment messages, etc. It also includes th possible payload. -->
+                    <metadata_protection_kind>NONE</metadata_protection_kind>
+
+                    <!-- The payload data sent on the Topic (serialized application level data) should be
+                         protected with Encrypt then MAC. -->
+                    <data_protection_kind>NONE</data_protection_kind>
+                </topic_rule>
+            </topic_access_rules>
+        </domain_rule>
+    </domain_access_rules>
+</dds>
+
+------1A6607CDB3CA97628720C3874B28523D
+Content-Type: application/x-pkcs7-signature; name="smime.p7s"
+Content-Transfer-Encoding: base64
+Content-Disposition: attachment; filename="smime.p7s"
+
+MIIGXgYJKoZIhvcNAQcCoIIGTzCCBksCAQExDzANBglghkgBZQMEAgEFADALBgkq
+hkiG9w0BBwGgggORMIIDjTCCAnWgAwIBAgIJANsr3sm0NrypMA0GCSqGSIb3DQEB
+CwUAMFwxCzAJBgNVBAYTAk5MMRMwEQYDVQQIDApTb21lLVN0YXRlMR8wHQYDVQQK
+DBZBRExJTksgVGVjaG5vbG9jeSBJbmMuMRcwFQYDVQQDDA5hZGxpbmt0ZWNoLmNv
+bTAgFw0xODA3MzAxMjQ1NTVaGA8yMTE4MDcwNjEyNDU1NVowXDELMAkGA1UEBhMC
+TkwxEzARBgNVBAgMClNvbWUtU3RhdGUxHzAdBgNVBAoMFkFETElOSyBUZWNobm9s
+b2N5IEluYy4xFzAVBgNVBAMMDmFkbGlua3RlY2guY29tMIIBIjANBgkqhkiG9w0B
+AQEFAAOCAQ8AMIIBCgKCAQEAu7jfnJ0wYVuXgG+PgNawdN38+dRpa8jceqi+blID
+ehV6XCxrnGXusTCDuFmo7HMOBVMVNDXlcBWgoGd+u5EultnOEiIeGTgtHc1O6V9w
+icp3BGSpZZax/TcONjMVORaqHCADbQ2J8wsz1FHxuKDwX6BJElYOlK77lb/x3yLs
+DFFC+a0qn2RFh37rcWBRAHy8VEASXKZElT9ZmfKd+KUq34KojhNJ4DepKStTq074
+BRDXVivx+wVD951LFNPiQXq+mgHcLj1k37KlZflTFhdP5oEMtATNsXNJPHlEymiy
+SogRWAmKhysLQudukHfNKN+r0FEQMk/hzpYcFeZSOvbfNQIDAQABo1AwTjAdBgNV
+HQ4EFgQURWMbWvBKZwJvRV1/tyc1R82k0+gwHwYDVR0jBBgwFoAURWMbWvBKZwJv
+RV1/tyc1R82k0+gwDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAQEAkPF+
+ysVtvHnk2hpu9yNDLCJ96ZzIoKOyY7uRj4ovzlAHFdpNOJQdcJihTmN8i7Trht9X
+Vh0rGoR/6nHzo3TIeiogRC80RlDtuA3PF2dDQBMVDStlZMTZPb693hfjdAjhyyw9
+yghhKHHqNDvSsAL0KfBqjG4yGfGpJylYXIT5fWuKlo/ln/yyPa5s54T5XDo+CMbt
+lLX3QnwVOmaRyzylPiTcPCDIkdLBdXmlfyJcmW6fWa6kPx+35MOxPsXZbujCo+42
++OyLqcH1rKT6XhcshjXBEf+kdgUfSClrM1pNRWsw2ChIYim0F+nry5JFy0Y+8Hbb
+6SDB340BFmtgDHbFHTGCApEwggKNAgEBMGkwXDELMAkGA1UEBhMCTkwxEzARBgNV
+BAgMClNvbWUtU3RhdGUxHzAdBgNVBAoMFkFETElOSyBUZWNobm9sb2N5IEluYy4x
+FzAVBgNVBAMMDmFkbGlua3RlY2guY29tAgkA2yveybQ2vKkwDQYJYIZIAWUDBAIB
+BQCggfowGAYJKoZIhvcNAQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG9w0BCQUxDxcN
+MTkwMzI5MTMwODAzWjAvBgkqhkiG9w0BCQQxIgQg16RVkhnhbWczLVFXDHVD6lPy
+G5w7StRkpXgPtz/r+5MwgY4GCSqGSIb3DQEJDzGBgDB+MAsGCWCGSAFlAwQBKjAI
+BgYqhQMCAgkwCAYGKoUDAgIVMAsGCWCGSAFlAwQBFjALBglghkgBZQMEAQIwCgYI
+KoZIhvcNAwcwDgYIKoZIhvcNAwICAgCAMA0GCCqGSIb3DQMCAgFAMAcGBSsOAwIH
+MA0GCCqGSIb3DQMCAgEoMA0GCSqGSIb3DQEBAQUABIIBAJsBPV85r3vm0jr/YWKo
+J1j054f+gdqnrfH9kv6dvhg/IAK67mfWDHYUUah6D/1HFJve5KMR8tBu2j770M42
+rDjUBVQADqwWc+9ymiGcIjav9r1+YVTzOCHZnASJyqWPakCwwrdMthb2bB//ASmL
+rHOxsJZs68r0ci8ZC4bPbe0m8gAC8lkAvfhIr0/WLO4zhdhVaSrKNKptEjTVGRan
+KcjoHAiNOhxWZfwZ+OVEp6Rnax4xcpGK3oyCcg9v8zGKj9rDX917K3VfW9Guo+Px
+fZ1u+ukL2GgvzPMdJuU0Uw6mPbWMPeAKbIFwLR9P8iXtKuj2HHqteFVbcyIQXZSE
+nRM=
+
+------1A6607CDB3CA97628720C3874B28523D--
+
diff --git a/src/security/builtin_plugins/tests/validate_local_permissions/etc/Test_Governance_invalid_data.xml b/src/security/builtin_plugins/tests/validate_local_permissions/etc/Test_Governance_invalid_data.xml
new file mode 100644
index 0000000..d445705
--- /dev/null
+++ b/src/security/builtin_plugins/tests/validate_local_permissions/etc/Test_Governance_invalid_data.xml
@@ -0,0 +1,123 @@
+<?xml version="1.0" encoding="utf-8"?>
+<dds xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xsi:noNamespaceSchemaLocation="https://www.omg.org/spec/DDS-SECURITY/20170901/omg_shared_ca_governance.xsd">
+    <domain_access_rules>
+        <domain_rule>
+            <domains>
+                <!-- All domains -->
+                <id>20</id>
+                <id>30</id>
+                <id_range>
+                    <min>0</min>
+                    <max>23</max>
+                </id_range>
+                <id_range>
+                    <min>100</min>
+                    <max>120</max>
+                </id_range>
+                <id>200</id>
+            </domains>
+
+            <!-- DomainParticipant that cann not authenticate or fail the authentication should be
+                 allowed to join the domain and see any any discovery data that are configured as "unprotected"
+                 and topics that are configured as "unprotected" -->
+            <allow_unauthenticated_participants>false</allow_unauthenticated_participants>
+
+            <!--  Only and any authenticated DomainParticipant should be allowed to join the domain and
+                  see the discovery data without checking access control  -->
+            <enable_join_access_control>TRUE</enable_join_access_control>
+
+            <!-- Discovery information should be protected with encryption followed by MAC (Message Authentication Codes) -->
+            <discovery_protection_kind>SIGN_WITH_ORIGIN_AUTHENTICATION</discovery_protection_kind>
+
+            <!--  Liveliness messages are also encrypted -->
+            <liveliness_protection_kind>ENCRYPT</liveliness_protection_kind>
+
+            <!-- Whole RTPS message is not protected -->
+            <rtps_protection_kind>ENCRYPT_WITH_ORIGIN_AUTHENTICATION</rtps_protection_kind>
+
+            <topic_access_rules>
+                <topic_rule>
+                    <!-- All (non-builtin) topics -->
+                    <topic_expression>*</topic_expression>
+
+                    <!-- Liveliness QoS data is protected -->
+                    <enable_liveliness_protection>true</enable_liveliness_protection>
+
+                    <!-- The discovery information on specific Topics should be sent
+                         using the secure (protected) discovery writers -->
+                    <enable_discovery_protection>true</enable_discovery_protection>
+
+                    <!-- The read access to all topics should be open to all. -->
+                    <enable_read_access_control>false</enable_read_access_control>
+
+                    <!-- The write access to all topics should be open to all. -->
+                    <enable_write_access_control>false</enable_write_access_control>
+
+                    <!-- Whole RTPS sub-message is protected. This includes metadata information
+                         like sequence numbers, heartbeats, key hashes, gaps,
+                         acknowledgment messages, etc. It also includes th possible payload. -->
+                    <metadata_protection_kind>ENCRYPT_WITH_</metadata_protection_kind>
+
+                    <!-- The payload data sent on the Topic (serialized application level data) should be
+                         protected with Encrypt then MAC. -->
+                    <data_protection_kind>ENCRYPT</data_protection_kind>
+                </topic_rule>
+                
+                <topic_rule>
+                    <!-- All (non-builtin) topics -->
+                    <topic_expression>OwnShip?ata</topic_expression>
+
+                    <!-- Liveliness QoS data is protected -->
+                    <enable_liveliness_protection>FALSE</enable_liveliness_protection>
+
+                    <!-- The discovery information on specific Topics should be sent
+                         using the secure (protected) discovery writers -->
+                    <enable_discovery_protection>false</enable_discovery_protection>
+
+                    <!-- The read access to all topics should be open to all. -->
+                    <enable_read_access_control>false</enable_read_access_control>
+
+                    <!-- The write access to all topics should be open to all. -->
+                    <enable_write_access_control>true</enable_write_access_control>
+
+                    <!-- Whole RTPS sub-message is protected. This includes metadata information
+                         like sequence numbers, heartbeats, key hashes, gaps,
+                         acknowledgment messages, etc. It also includes th possible payload. -->
+                    <metadata_protection_kind>SIGN</metadata_protection_kind>
+
+                    <!-- The payload data sent on the Topic (serialized application level data) should be
+                         protected with Encrypt then MAC. -->
+                    <data_protection_kind>ENCRYPT</data_protection_kind>
+                </topic_rule>
+                
+                <topic_rule>
+                    <!-- All (non-builtin) topics -->
+                    <topic_expression>Kinematics</topic_expression>
+
+                    <!-- Liveliness QoS data is protected -->
+                    <enable_liveliness_protection>true</enable_liveliness_protection>
+
+                    <!-- The discovery information on specific Topics should be sent
+                         using the secure (protected) discovery writers -->
+                    <enable_discovery_protection>true</enable_discovery_protection>
+
+                    <!-- The read access to all topics should be open to all. -->
+                    <enable_read_access_control>true</enable_read_access_control>
+
+                    <!-- The write access to all topics should be open to all. -->
+                    <enable_write_access_control>false</enable_write_access_control>
+
+                    <!-- Whole RTPS sub-message is protected. This includes metadata information
+                         like sequence numbers, heartbeats, key hashes, gaps,
+                         acknowledgment messages, etc. It also includes th possible payload. -->
+                    <metadata_protection_kind>NONE</metadata_protection_kind>
+
+                    <!-- The payload data sent on the Topic (serialized application level data) should be
+                         protected with Encrypt then MAC. -->
+                    <data_protection_kind>NONE</data_protection_kind>
+                </topic_rule>
+            </topic_access_rules>
+        </domain_rule>
+    </domain_access_rules>
+</dds>
diff --git a/src/security/builtin_plugins/tests/validate_local_permissions/etc/Test_Governance_invalid_element.p7s b/src/security/builtin_plugins/tests/validate_local_permissions/etc/Test_Governance_invalid_element.p7s
new file mode 100644
index 0000000..9a51a3f
--- /dev/null
+++ b/src/security/builtin_plugins/tests/validate_local_permissions/etc/Test_Governance_invalid_element.p7s
@@ -0,0 +1,178 @@
+MIME-Version: 1.0
+Content-Type: multipart/signed; protocol="application/x-pkcs7-signature"; micalg="sha-256"; boundary="----4B1AFE4A648D807454B86C7DDD6F392C"
+
+This is an S/MIME signed message
+
+------4B1AFE4A648D807454B86C7DDD6F392C
+Content-Type: text/plain
+
+<?xml version="1.0" encoding="utf-8"?>
+<dds xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xsi:noNamespaceSchemaLocation="https://www.omg.org/spec/DDS-SECURITY/20170901/omg_shared_ca_governance.xsd">
+    <domain_access_rules>
+        <domain_rule>
+            <domains>
+                <!-- All domains -->
+                <id>20</id>
+                <id>30</id>
+                <id_range>
+                    <min>0</min>
+                    <max>23</max>
+                </id_range>
+                <id_range>
+                    <min>100</min>
+                    <max>120</max>
+                </id_range>
+                <id>200</id>
+            </domains>
+
+            <!-- DomainParticipant that cann not authenticate or fail the authentication should be
+                 allowed to join the domain and see any any discovery data that are configured as "unprotected"
+                 and topics that are configured as "unprotected" -->
+            <allow_unauthenticated_participants>false</allow_unauthenticated_participants>
+
+            <!--  Only and any authenticated DomainParticipant should be allowed to join the domain and
+                  see the discovery data without checking access control  -->
+            <enable_join_access_control>TRUE</enable_join_access_control>
+
+            <!-- Discovery information should be protected with encryption followed by MAC (Message Authentication Codes) -->
+            <discovery_protection_kind>SIGN_WITH_ORIGIN_AUTHENTICATION</discovery_protection_kind>
+
+            <!--  Liveliness messages are also encrypted -->
+            <liveliness_protection_kind>ENCRYPT</liveliness_protection_kind>
+
+            <ufo>Unidentified Flying Object</ufo>
+
+
+            <!-- Whole RTPS message is not protected -->
+            <rtps_protection_kind>ENCRYPT_WITH_ORIGIN_AUTHENTICATION</rtps_protection_kind>
+
+            <topic_access_rules>
+                <topic_rule>
+                    <!-- All (non-builtin) topics -->
+                    <topic_expression>*</topic_expression>
+
+                    <!-- Liveliness QoS data is protected -->
+                    <enable_liveliness_protection>true</enable_liveliness_protection>
+
+                    <!-- The discovery information on specific Topics should be sent
+                         using the secure (protected) discovery writers -->
+                    <enable_discovery_protection>true</enable_discovery_protection>
+
+                    <!-- The read access to all topics should be open to all. -->
+                    <enable_read_access_control>false</enable_read_access_control>
+
+                    <!-- The write access to all topics should be open to all. -->
+                    <enable_write_access_control>false</enable_write_access_control>
+
+                    <!-- Whole RTPS sub-message is protected. This includes metadata information
+                         like sequence numbers, heartbeats, key hashes, gaps,
+                         acknowledgment messages, etc. It also includes th possible payload. -->
+                    <metadata_protection_kind>ENCRYPT_WITH_ORIGIN_AUTHENTICATION</metadata_protection_kind>
+
+                    <!-- The payload data sent on the Topic (serialized application level data) should be
+                         protected with Encrypt then MAC. -->
+                    <data_protection_kind>ENCRYPT</data_protection_kind>
+                </topic_rule>
+                
+                <topic_rule>
+                    <!-- All (non-builtin) topics -->
+                    <topic_expression>OwnShip?ata</topic_expression>
+
+                    <!-- Liveliness QoS data is protected -->
+                    <enable_liveliness_protection>FALSE</enable_liveliness_protection>
+
+                    <!-- The discovery information on specific Topics should be sent
+                         using the secure (protected) discovery writers -->
+                    <enable_discovery_protection>false</enable_discovery_protection>
+
+                    <!-- The read access to all topics should be open to all. -->
+                    <enable_read_access_control>false</enable_read_access_control>
+
+                    <!-- The write access to all topics should be open to all. -->
+                    <enable_write_access_control>true</enable_write_access_control>
+
+                    <!-- Whole RTPS sub-message is protected. This includes metadata information
+                         like sequence numbers, heartbeats, key hashes, gaps,
+                         acknowledgment messages, etc. It also includes th possible payload. -->
+                    <metadata_protection_kind>SIGN</metadata_protection_kind>
+
+                    <!-- The payload data sent on the Topic (serialized application level data) should be
+                         protected with Encrypt then MAC. -->
+                    <data_protection_kind>ENCRYPT</data_protection_kind>
+                </topic_rule>
+                
+                <topic_rule>
+                    <!-- All (non-builtin) topics -->
+                    <topic_expression>Kinematics</topic_expression>
+
+                    <!-- Liveliness QoS data is protected -->
+                    <enable_liveliness_protection>true</enable_liveliness_protection>
+
+                    <!-- The discovery information on specific Topics should be sent
+                         using the secure (protected) discovery writers -->
+                    <enable_discovery_protection>true</enable_discovery_protection>
+
+                    <!-- The read access to all topics should be open to all. -->
+                    <enable_read_access_control>true</enable_read_access_control>
+
+                    <!-- The write access to all topics should be open to all. -->
+                    <enable_write_access_control>false</enable_write_access_control>
+
+                    <!-- Whole RTPS sub-message is protected. This includes metadata information
+                         like sequence numbers, heartbeats, key hashes, gaps,
+                         acknowledgment messages, etc. It also includes th possible payload. -->
+                    <metadata_protection_kind>NONE</metadata_protection_kind>
+
+                    <!-- The payload data sent on the Topic (serialized application level data) should be
+                         protected with Encrypt then MAC. -->
+                    <data_protection_kind>NONE</data_protection_kind>
+                </topic_rule>
+            </topic_access_rules>
+        </domain_rule>
+    </domain_access_rules>
+</dds>
+
+------4B1AFE4A648D807454B86C7DDD6F392C
+Content-Type: application/x-pkcs7-signature; name="smime.p7s"
+Content-Transfer-Encoding: base64
+Content-Disposition: attachment; filename="smime.p7s"
+
+MIIGXgYJKoZIhvcNAQcCoIIGTzCCBksCAQExDzANBglghkgBZQMEAgEFADALBgkq
+hkiG9w0BBwGgggORMIIDjTCCAnWgAwIBAgIJANsr3sm0NrypMA0GCSqGSIb3DQEB
+CwUAMFwxCzAJBgNVBAYTAk5MMRMwEQYDVQQIDApTb21lLVN0YXRlMR8wHQYDVQQK
+DBZBRExJTksgVGVjaG5vbG9jeSBJbmMuMRcwFQYDVQQDDA5hZGxpbmt0ZWNoLmNv
+bTAgFw0xODA3MzAxMjQ1NTVaGA8yMTE4MDcwNjEyNDU1NVowXDELMAkGA1UEBhMC
+TkwxEzARBgNVBAgMClNvbWUtU3RhdGUxHzAdBgNVBAoMFkFETElOSyBUZWNobm9s
+b2N5IEluYy4xFzAVBgNVBAMMDmFkbGlua3RlY2guY29tMIIBIjANBgkqhkiG9w0B
+AQEFAAOCAQ8AMIIBCgKCAQEAu7jfnJ0wYVuXgG+PgNawdN38+dRpa8jceqi+blID
+ehV6XCxrnGXusTCDuFmo7HMOBVMVNDXlcBWgoGd+u5EultnOEiIeGTgtHc1O6V9w
+icp3BGSpZZax/TcONjMVORaqHCADbQ2J8wsz1FHxuKDwX6BJElYOlK77lb/x3yLs
+DFFC+a0qn2RFh37rcWBRAHy8VEASXKZElT9ZmfKd+KUq34KojhNJ4DepKStTq074
+BRDXVivx+wVD951LFNPiQXq+mgHcLj1k37KlZflTFhdP5oEMtATNsXNJPHlEymiy
+SogRWAmKhysLQudukHfNKN+r0FEQMk/hzpYcFeZSOvbfNQIDAQABo1AwTjAdBgNV
+HQ4EFgQURWMbWvBKZwJvRV1/tyc1R82k0+gwHwYDVR0jBBgwFoAURWMbWvBKZwJv
+RV1/tyc1R82k0+gwDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAQEAkPF+
+ysVtvHnk2hpu9yNDLCJ96ZzIoKOyY7uRj4ovzlAHFdpNOJQdcJihTmN8i7Trht9X
+Vh0rGoR/6nHzo3TIeiogRC80RlDtuA3PF2dDQBMVDStlZMTZPb693hfjdAjhyyw9
+yghhKHHqNDvSsAL0KfBqjG4yGfGpJylYXIT5fWuKlo/ln/yyPa5s54T5XDo+CMbt
+lLX3QnwVOmaRyzylPiTcPCDIkdLBdXmlfyJcmW6fWa6kPx+35MOxPsXZbujCo+42
++OyLqcH1rKT6XhcshjXBEf+kdgUfSClrM1pNRWsw2ChIYim0F+nry5JFy0Y+8Hbb
+6SDB340BFmtgDHbFHTGCApEwggKNAgEBMGkwXDELMAkGA1UEBhMCTkwxEzARBgNV
+BAgMClNvbWUtU3RhdGUxHzAdBgNVBAoMFkFETElOSyBUZWNobm9sb2N5IEluYy4x
+FzAVBgNVBAMMDmFkbGlua3RlY2guY29tAgkA2yveybQ2vKkwDQYJYIZIAWUDBAIB
+BQCggfowGAYJKoZIhvcNAQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG9w0BCQUxDxcN
+MTkwMzI5MTMwODAzWjAvBgkqhkiG9w0BCQQxIgQgLhPNfJcKb6QszZuyFWmmLGOQ
+ZDTY0NBpcqMym1+AijAwgY4GCSqGSIb3DQEJDzGBgDB+MAsGCWCGSAFlAwQBKjAI
+BgYqhQMCAgkwCAYGKoUDAgIVMAsGCWCGSAFlAwQBFjALBglghkgBZQMEAQIwCgYI
+KoZIhvcNAwcwDgYIKoZIhvcNAwICAgCAMA0GCCqGSIb3DQMCAgFAMAcGBSsOAwIH
+MA0GCCqGSIb3DQMCAgEoMA0GCSqGSIb3DQEBAQUABIIBABwNsFseYbpH+mGslN/g
+UY1RNq8f9pFOhTn89NAu94xJgZ2wu5izmSsaEK8K8nrPnxTouD7b5P5w5JQnEVU5
+m2yDD62ZdrlNm51u6VS1JoleHleTEyseagVYlLk+R2FYIH8xfjT0e6jc93qIlm+f
+XehwwbCsVUUdy3ViV9APoFP6b5YB+bXe6AtMMTobhEzplqs7GzOFzzC4YuhHSvi2
+sVFXmlHFwOKKIS7he8467breo+SYunv5IttcyqypltydmEcOndCQ2uAWiPvsJIat
+DyIkewjrWFL/0l/uTDmk3EUcTmmugVkhykmkfb9subqMHXKbDkcXgZgggR57/9+n
+eOU=
+
+------4B1AFE4A648D807454B86C7DDD6F392C--
+
diff --git a/src/security/builtin_plugins/tests/validate_local_permissions/etc/Test_Governance_invalid_element.xml b/src/security/builtin_plugins/tests/validate_local_permissions/etc/Test_Governance_invalid_element.xml
new file mode 100644
index 0000000..81f5ea6
--- /dev/null
+++ b/src/security/builtin_plugins/tests/validate_local_permissions/etc/Test_Governance_invalid_element.xml
@@ -0,0 +1,126 @@
+<?xml version="1.0" encoding="utf-8"?>
+<dds xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xsi:noNamespaceSchemaLocation="https://www.omg.org/spec/DDS-SECURITY/20170901/omg_shared_ca_governance.xsd">
+    <domain_access_rules>
+        <domain_rule>
+            <domains>
+                <!-- All domains -->
+                <id>20</id>
+                <id>30</id>
+                <id_range>
+                    <min>0</min>
+                    <max>23</max>
+                </id_range>
+                <id_range>
+                    <min>100</min>
+                    <max>120</max>
+                </id_range>
+                <id>200</id>
+            </domains>
+
+            <!-- DomainParticipant that cann not authenticate or fail the authentication should be
+                 allowed to join the domain and see any any discovery data that are configured as "unprotected"
+                 and topics that are configured as "unprotected" -->
+            <allow_unauthenticated_participants>false</allow_unauthenticated_participants>
+
+            <!--  Only and any authenticated DomainParticipant should be allowed to join the domain and
+                  see the discovery data without checking access control  -->
+            <enable_join_access_control>TRUE</enable_join_access_control>
+
+            <!-- Discovery information should be protected with encryption followed by MAC (Message Authentication Codes) -->
+            <discovery_protection_kind>SIGN_WITH_ORIGIN_AUTHENTICATION</discovery_protection_kind>
+
+            <!--  Liveliness messages are also encrypted -->
+            <liveliness_protection_kind>ENCRYPT</liveliness_protection_kind>
+
+            <ufo>Unidentified Flying Object</ufo>
+
+
+            <!-- Whole RTPS message is not protected -->
+            <rtps_protection_kind>ENCRYPT_WITH_ORIGIN_AUTHENTICATION</rtps_protection_kind>
+
+            <topic_access_rules>
+                <topic_rule>
+                    <!-- All (non-builtin) topics -->
+                    <topic_expression>*</topic_expression>
+
+                    <!-- Liveliness QoS data is protected -->
+                    <enable_liveliness_protection>true</enable_liveliness_protection>
+
+                    <!-- The discovery information on specific Topics should be sent
+                         using the secure (protected) discovery writers -->
+                    <enable_discovery_protection>true</enable_discovery_protection>
+
+                    <!-- The read access to all topics should be open to all. -->
+                    <enable_read_access_control>false</enable_read_access_control>
+
+                    <!-- The write access to all topics should be open to all. -->
+                    <enable_write_access_control>false</enable_write_access_control>
+
+                    <!-- Whole RTPS sub-message is protected. This includes metadata information
+                         like sequence numbers, heartbeats, key hashes, gaps,
+                         acknowledgment messages, etc. It also includes th possible payload. -->
+                    <metadata_protection_kind>ENCRYPT_WITH_ORIGIN_AUTHENTICATION</metadata_protection_kind>
+
+                    <!-- The payload data sent on the Topic (serialized application level data) should be
+                         protected with Encrypt then MAC. -->
+                    <data_protection_kind>ENCRYPT</data_protection_kind>
+                </topic_rule>
+                
+                <topic_rule>
+                    <!-- All (non-builtin) topics -->
+                    <topic_expression>OwnShip?ata</topic_expression>
+
+                    <!-- Liveliness QoS data is protected -->
+                    <enable_liveliness_protection>FALSE</enable_liveliness_protection>
+
+                    <!-- The discovery information on specific Topics should be sent
+                         using the secure (protected) discovery writers -->
+                    <enable_discovery_protection>false</enable_discovery_protection>
+
+                    <!-- The read access to all topics should be open to all. -->
+                    <enable_read_access_control>false</enable_read_access_control>
+
+                    <!-- The write access to all topics should be open to all. -->
+                    <enable_write_access_control>true</enable_write_access_control>
+
+                    <!-- Whole RTPS sub-message is protected. This includes metadata information
+                         like sequence numbers, heartbeats, key hashes, gaps,
+                         acknowledgment messages, etc. It also includes th possible payload. -->
+                    <metadata_protection_kind>SIGN</metadata_protection_kind>
+
+                    <!-- The payload data sent on the Topic (serialized application level data) should be
+                         protected with Encrypt then MAC. -->
+                    <data_protection_kind>ENCRYPT</data_protection_kind>
+                </topic_rule>
+                
+                <topic_rule>
+                    <!-- All (non-builtin) topics -->
+                    <topic_expression>Kinematics</topic_expression>
+
+                    <!-- Liveliness QoS data is protected -->
+                    <enable_liveliness_protection>true</enable_liveliness_protection>
+
+                    <!-- The discovery information on specific Topics should be sent
+                         using the secure (protected) discovery writers -->
+                    <enable_discovery_protection>true</enable_discovery_protection>
+
+                    <!-- The read access to all topics should be open to all. -->
+                    <enable_read_access_control>true</enable_read_access_control>
+
+                    <!-- The write access to all topics should be open to all. -->
+                    <enable_write_access_control>false</enable_write_access_control>
+
+                    <!-- Whole RTPS sub-message is protected. This includes metadata information
+                         like sequence numbers, heartbeats, key hashes, gaps,
+                         acknowledgment messages, etc. It also includes th possible payload. -->
+                    <metadata_protection_kind>NONE</metadata_protection_kind>
+
+                    <!-- The payload data sent on the Topic (serialized application level data) should be
+                         protected with Encrypt then MAC. -->
+                    <data_protection_kind>NONE</data_protection_kind>
+                </topic_rule>
+            </topic_access_rules>
+        </domain_rule>
+    </domain_access_rules>
+</dds>
diff --git a/src/security/builtin_plugins/tests/validate_local_permissions/etc/Test_Governance_not_signed.p7s b/src/security/builtin_plugins/tests/validate_local_permissions/etc/Test_Governance_not_signed.p7s
new file mode 100644
index 0000000..30fa20a
--- /dev/null
+++ b/src/security/builtin_plugins/tests/validate_local_permissions/etc/Test_Governance_not_signed.p7s
@@ -0,0 +1,62 @@
+<?xml version="1.0" encoding="utf-8"?>
+<dds xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xsi:noNamespaceSchemaLocation="https://www.omg.org/spec/DDS-SECURITY/20170901/omg_shared_ca_governance.xsd">
+    <domain_access_rules>
+        <domain_rule>
+            <domains>
+                <!-- All domains -->
+                <id_range>
+                    <min>0</min>
+                    <max>230</max>
+                </id_range>
+            </domains>
+
+            <!-- DomainParticipant that cann not authenticate or fail the authentication should be
+                 allowed to join the domain and see any any discovery data that are configured as "unprotected"
+                 and topics that are configured as "unprotected" -->
+            <allow_unauthenticated_participants>false</allow_unauthenticated_participants>
+
+            <!--  Only and any authenticated DomainParticipant should be allowed to join the domain and
+                  see the discovery data without checking access control  -->
+            <enable_join_access_control>true</enable_join_access_control>
+
+            <!-- Discovery information should be protected with encryption followed by MAC (Message Authentication Codes) -->
+            <discovery_protection_kind>ENCRYPT</discovery_protection_kind>
+
+            <!--  Liveliness messages are also encrypted -->
+            <liveliness_protection_kind>ENCRYPT</liveliness_protection_kind>
+
+            <!-- Whole RTPS message is not protected -->
+            <rtps_protection_kind>NONE</rtps_protection_kind>
+
+            <topic_access_rules>
+                <topic_rule>
+                    <!-- All (non-builtin) topics -->
+                    <topic_expression>*</topic_expression>
+
+                    <!-- Liveliness QoS data is protected -->
+                    <enable_liveliness_protection>true</enable_liveliness_protection>
+
+                    <!-- The discovery information on specific Topics should be sent
+                         using the secure (protected) discovery writers -->
+                    <enable_discovery_protection>true</enable_discovery_protection>
+
+                    <!-- The read access to all topics should be open to all. -->
+                    <enable_read_access_control>false</enable_read_access_control>
+
+                    <!-- The write access to all topics should be open to all. -->
+                    <enable_write_access_control>false</enable_write_access_control>
+
+                    <!-- Whole RTPS sub-message is protected. This includes metadata information
+                         like sequence numbers, heartbeats, key hashes, gaps,
+                         acknowledgment messages, etc. It also includes th possible payload. -->
+                    <metadata_protection_kind>ENCRYPT</metadata_protection_kind>
+
+                    <!-- The payload data sent on the Topic (serialized application level data) should be
+                         protected with Encrypt then MAC. -->
+                    <data_protection_kind>ENCRYPT</data_protection_kind>
+                </topic_rule>
+            </topic_access_rules>
+        </domain_rule>
+    </domain_access_rules>
+</dds>
diff --git a/src/security/builtin_plugins/tests/validate_local_permissions/etc/Test_Governance_ok.p7s b/src/security/builtin_plugins/tests/validate_local_permissions/etc/Test_Governance_ok.p7s
new file mode 100644
index 0000000..c39903f
--- /dev/null
+++ b/src/security/builtin_plugins/tests/validate_local_permissions/etc/Test_Governance_ok.p7s
@@ -0,0 +1,114 @@
+MIME-Version: 1.0
+Content-Type: multipart/signed; protocol="application/x-pkcs7-signature"; micalg="sha-256"; boundary="----DB94A190D9780A24156FB0E8F1E76B5F"
+
+This is an S/MIME signed message
+
+------DB94A190D9780A24156FB0E8F1E76B5F
+Content-Type: text/plain
+
+<?xml version="1.0" encoding="utf-8"?>
+<dds xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xsi:noNamespaceSchemaLocation="http://www.omg.org/spec/DDSSecurity/
+20170801/omg_shared_ca_domain_governance.xsd">
+    <domain_access_rules>
+        <domain_rule>
+            <domains>
+                <!-- All domains -->
+                <id_range>
+                    <min>0</min>
+                    <max>230</max>
+                </id_range>
+            </domains>
+
+            <!-- DomainParticipant that cann not authenticate or fail the authentication should be
+                 allowed to join the domain and see any any discovery data that are configured as "unprotected"
+                 and topics that are configured as "unprotected" -->
+            <allow_unauthenticated_participants>false</allow_unauthenticated_participants>
+
+            <!--  Only and any authenticated DomainParticipant should be allowed to join the domain and
+                  see the discovery data without checking access control  -->
+            <enable_join_access_control>true</enable_join_access_control>
+
+            <!-- Discovery information should be protected with encryption followed by MAC (Message Authentication Codes) -->
+            <discovery_protection_kind>ENCRYPT</discovery_protection_kind>
+
+            <!--  Liveliness messages are also encrypted -->
+            <liveliness_protection_kind>ENCRYPT</liveliness_protection_kind>
+
+            <!-- Whole RTPS message is not protected -->
+            <rtps_protection_kind>NONE</rtps_protection_kind>
+
+            <topic_access_rules>
+                <topic_rule>
+                    <!-- All (non-builtin) topics -->
+                    <topic_expression>*</topic_expression>
+
+                    <!-- Liveliness QoS data is protected -->
+                    <enable_liveliness_protection>true</enable_liveliness_protection>
+
+                    <!-- The discovery information on specific Topics should be sent
+                         using the secure (protected) discovery writers -->
+                    <enable_discovery_protection>true</enable_discovery_protection>
+
+                    <!-- The read access to all topics should be open to all. -->
+                    <enable_read_access_control>false</enable_read_access_control>
+
+                    <!-- The write access to all topics should be open to all. -->
+                    <enable_write_access_control>false</enable_write_access_control>
+
+                    <!-- Whole RTPS sub-message is protected. This includes metadata information
+                         like sequence numbers, heartbeats, key hashes, gaps,
+                         acknowledgment messages, etc. It also includes th possible payload. -->
+                    <metadata_protection_kind>ENCRYPT</metadata_protection_kind>
+
+                    <!-- The payload data sent on the Topic (serialized application level data) should be
+                         protected with Encrypt then MAC. -->
+                    <data_protection_kind>ENCRYPT</data_protection_kind>
+                </topic_rule>
+            </topic_access_rules>
+        </domain_rule>
+    </domain_access_rules>
+</dds>
+
+------DB94A190D9780A24156FB0E8F1E76B5F
+Content-Type: application/x-pkcs7-signature; name="smime.p7s"
+Content-Transfer-Encoding: base64
+Content-Disposition: attachment; filename="smime.p7s"
+
+MIIGSAYJKoZIhvcNAQcCoIIGOTCCBjUCAQExDzANBglghkgBZQMEAgEFADALBgkq
+hkiG9w0BBwGgggORMIIDjTCCAnWgAwIBAgIJANsr3sm0NrypMA0GCSqGSIb3DQEB
+CwUAMFwxCzAJBgNVBAYTAk5MMRMwEQYDVQQIDApTb21lLVN0YXRlMR8wHQYDVQQK
+DBZBRExJTksgVGVjaG5vbG9jeSBJbmMuMRcwFQYDVQQDDA5hZGxpbmt0ZWNoLmNv
+bTAgFw0xODA3MzAxMjQ1NTVaGA8yMTE4MDcwNjEyNDU1NVowXDELMAkGA1UEBhMC
+TkwxEzARBgNVBAgMClNvbWUtU3RhdGUxHzAdBgNVBAoMFkFETElOSyBUZWNobm9s
+b2N5IEluYy4xFzAVBgNVBAMMDmFkbGlua3RlY2guY29tMIIBIjANBgkqhkiG9w0B
+AQEFAAOCAQ8AMIIBCgKCAQEAu7jfnJ0wYVuXgG+PgNawdN38+dRpa8jceqi+blID
+ehV6XCxrnGXusTCDuFmo7HMOBVMVNDXlcBWgoGd+u5EultnOEiIeGTgtHc1O6V9w
+icp3BGSpZZax/TcONjMVORaqHCADbQ2J8wsz1FHxuKDwX6BJElYOlK77lb/x3yLs
+DFFC+a0qn2RFh37rcWBRAHy8VEASXKZElT9ZmfKd+KUq34KojhNJ4DepKStTq074
+BRDXVivx+wVD951LFNPiQXq+mgHcLj1k37KlZflTFhdP5oEMtATNsXNJPHlEymiy
+SogRWAmKhysLQudukHfNKN+r0FEQMk/hzpYcFeZSOvbfNQIDAQABo1AwTjAdBgNV
+HQ4EFgQURWMbWvBKZwJvRV1/tyc1R82k0+gwHwYDVR0jBBgwFoAURWMbWvBKZwJv
+RV1/tyc1R82k0+gwDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAQEAkPF+
+ysVtvHnk2hpu9yNDLCJ96ZzIoKOyY7uRj4ovzlAHFdpNOJQdcJihTmN8i7Trht9X
+Vh0rGoR/6nHzo3TIeiogRC80RlDtuA3PF2dDQBMVDStlZMTZPb693hfjdAjhyyw9
+yghhKHHqNDvSsAL0KfBqjG4yGfGpJylYXIT5fWuKlo/ln/yyPa5s54T5XDo+CMbt
+lLX3QnwVOmaRyzylPiTcPCDIkdLBdXmlfyJcmW6fWa6kPx+35MOxPsXZbujCo+42
++OyLqcH1rKT6XhcshjXBEf+kdgUfSClrM1pNRWsw2ChIYim0F+nry5JFy0Y+8Hbb
+6SDB340BFmtgDHbFHTGCAnswggJ3AgEBMGkwXDELMAkGA1UEBhMCTkwxEzARBgNV
+BAgMClNvbWUtU3RhdGUxHzAdBgNVBAoMFkFETElOSyBUZWNobm9sb2N5IEluYy4x
+FzAVBgNVBAMMDmFkbGlua3RlY2guY29tAgkA2yveybQ2vKkwDQYJYIZIAWUDBAIB
+BQCggeQwGAYJKoZIhvcNAQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG9w0BCQUxDxcN
+MTgwOTEzMDczOTUwWjAvBgkqhkiG9w0BCQQxIgQgXv8DkvlwebXMwHDbNc0/Pc30
+gyG3xWCnwet49TRMWFsweQYJKoZIhvcNAQkPMWwwajALBglghkgBZQMEASowCwYJ
+YIZIAWUDBAEWMAsGCWCGSAFlAwQBAjAKBggqhkiG9w0DBzAOBggqhkiG9w0DAgIC
+AIAwDQYIKoZIhvcNAwICAUAwBwYFKw4DAgcwDQYIKoZIhvcNAwICASgwDQYJKoZI
+hvcNAQEBBQAEggEANy8t0EFmv5j1n0+mMn2ut3Chu8PSJceC8gd34IiKq79uC1O3
+PbL9xgiJ2vz7QiTEEeNL2q+CG77cXOcHGUWa4nvbggr/9CqLfHEKGQxDfyXlJZfM
+8l550xIXRRBOQ7ilOGLD4QJFfbf9XA4rMuRe8WEYN3FleAaYBJag1tMPg1SS6tgA
+BBDM9b1kXHU319zYOk6kZFjlbwHv6XO22SEVRUpXrKudAI8hrGvwksF/+W0S/jS5
+NmYtj/1oMGlCGIaA5rs27H9CkgwrzoMQ3MsR98JlwEUSa4PEe8CClsIziOulQxsp
+MicBlMWL0rzpBPVfPTE4gZ/kP7hGBDEQlRzVTA==
+
+------DB94A190D9780A24156FB0E8F1E76B5F--
+
diff --git a/src/security/builtin_plugins/tests/validate_local_permissions/etc/Test_Governance_unknown_ca.p7s b/src/security/builtin_plugins/tests/validate_local_permissions/etc/Test_Governance_unknown_ca.p7s
new file mode 100644
index 0000000..9f07e40
--- /dev/null
+++ b/src/security/builtin_plugins/tests/validate_local_permissions/etc/Test_Governance_unknown_ca.p7s
@@ -0,0 +1,117 @@
+MIME-Version: 1.0
+Content-Type: multipart/signed; protocol="application/x-pkcs7-signature"; micalg="sha-256"; boundary="----F38FD3F34A584E774726CA12090D0B48"
+
+This is an S/MIME signed message
+
+------F38FD3F34A584E774726CA12090D0B48
+Content-Type: text/plain
+
+<?xml version="1.0" encoding="utf-8"?>
+<dds xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xsi:noNamespaceSchemaLocation="http://www.omg.org/spec/DDSSecurity/
+20170801/omg_shared_ca_domain_governance.xsd">
+    <domain_access_rules>
+        <domain_rule>
+            <domains>
+                <!-- All domains -->
+                <id_range>
+                    <min>0</min>
+                    <max>230</max>
+                </id_range>
+            </domains>
+
+            <!-- DomainParticipant that cann not authenticate or fail the authentication should be
+                 allowed to join the domain and see any any discovery data that are configured as "unprotected"
+                 and topics that are configured as "unprotected" -->
+            <allow_unauthenticated_participants>false</allow_unauthenticated_participants>
+
+            <!--  Only and any authenticated DomainParticipant should be allowed to join the domain and
+                  see the discovery data without checking access control  -->
+            <enable_join_access_control>true</enable_join_access_control>
+
+            <!-- Discovery information should be protected with encryption followed by MAC (Message Authentication Codes) -->
+            <discovery_protection_kind>ENCRYPT</discovery_protection_kind>
+
+            <!--  Liveliness messages are also encrypted -->
+            <liveliness_protection_kind>ENCRYPT</liveliness_protection_kind>
+
+            <!-- Whole RTPS message is not protected -->
+            <rtps_protection_kind>NONE</rtps_protection_kind>
+
+            <topic_access_rules>
+                <topic_rule>
+                    <!-- All (non-builtin) topics -->
+                    <topic_expression>*</topic_expression>
+
+                    <!-- Liveliness QoS data is protected -->
+                    <enable_liveliness_protection>true</enable_liveliness_protection>
+
+                    <!-- The discovery information on specific Topics should be sent
+                         using the secure (protected) discovery writers -->
+                    <enable_discovery_protection>true</enable_discovery_protection>
+
+                    <!-- The read access to all topics should be open to all. -->
+                    <enable_read_access_control>false</enable_read_access_control>
+
+                    <!-- The write access to all topics should be open to all. -->
+                    <enable_write_access_control>false</enable_write_access_control>
+
+                    <!-- Whole RTPS sub-message is protected. This includes metadata information
+                         like sequence numbers, heartbeats, key hashes, gaps,
+                         acknowledgment messages, etc. It also includes th possible payload. -->
+                    <metadata_protection_kind>ENCRYPT</metadata_protection_kind>
+
+                    <!-- The payload data sent on the Topic (serialized application level data) should be
+                         protected with Encrypt then MAC. -->
+                    <data_protection_kind>ENCRYPT</data_protection_kind>
+                </topic_rule>
+            </topic_access_rules>
+        </domain_rule>
+    </domain_access_rules>
+</dds>
+
+------F38FD3F34A584E774726CA12090D0B48
+Content-Type: application/x-pkcs7-signature; name="smime.p7s"
+Content-Transfer-Encoding: base64
+Content-Disposition: attachment; filename="smime.p7s"
+
+MIIGywYJKoZIhvcNAQcCoIIGvDCCBrgCAQExDzANBglghkgBZQMEAgEFADALBgkq
+hkiG9w0BBwGgggPKMIIDxjCCAq4CCQCBuTktP0h8BDANBgkqhkiG9w0BAQsFADCB
+pDEWMBQGA1UEBwwNTG9jYWxpdHkgTmFtZTEhMB8GA1UECwwYT3JnYW5pemF0aW9u
+YWwgVW5pdCBOYW1lMRwwGgYJKoZIhvcNAQkBFg1FbWFpbCBBZGRyZXNzMQswCQYD
+VQQGEwJVUzELMAkGA1UECAwCTkoxGjAYBgNVBAoMEUV4YW1wbGUgU2lnbmVyIENB
+MRMwEQYDVQQDDApFeGFtcGxlIENBMB4XDTE4MDgxNTA4NTE0MVoXDTQzMDgwOTA4
+NTE0MVowgaQxFjAUBgNVBAcMDUxvY2FsaXR5IE5hbWUxITAfBgNVBAsMGE9yZ2Fu
+aXphdGlvbmFsIFVuaXQgTmFtZTEcMBoGCSqGSIb3DQEJARYNRW1haWwgQWRkcmVz
+czELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAk5KMRowGAYDVQQKDBFFeGFtcGxlIFNp
+Z25lciBDQTETMBEGA1UEAwwKRXhhbXBsZSBDQTCCASIwDQYJKoZIhvcNAQEBBQAD
+ggEPADCCAQoCggEBALStAQ0yjM2qAWwsOXdX3hiyoZ6DDHWOTNI5LoCZGaN9rUZe
+MY0waSxWNQ0ruURgZISeOFkdQTAE81Em+UaZI+MZvfYcEcSlVtF6yve/WnIzRYWu
+f917moMCAInktfch4E6mskr4h7n+9sEz+3GsQS8SQRtwUe+PiXzjZrqHSbLC4Kn3
+/b8Mt+Ww3a4FyjHDZQJZsGSvrScr0Gq3xeKfMwb+KYNEnmh0o4os0gEGA4KUR+/1
+YDl1NmxQnm/AIMqwJzeaezBoMn0Nsi+OlAms85imGURNj9BCEJZBWwuuNL5ECDAq
+WLOM3AKUsApVgtGd8/OLWW1RwYkW8uqTtkIR87MCAwEAATANBgkqhkiG9w0BAQsF
+AAOCAQEAokKC77/kvxlObLSwkT5+7+S+DeznLBRiGVEh8+9PQw1q91sjiOZWf0e3
+T3XPH7CR/NDYoQJkrsqzIwKYrj41z/1jAs+HkH45NpTFiGlUFXNs5iwNh4RUqgf4
+e78Mge4q7pHMFzWTEwEn4DJMGcDDjLW1kN8GobGwHR7O0MpAJKrqcBSo+SPomnQv
+TgiEMQ+Vlz0EJx6JPsq8c7HrxlSdeDAAWIOww/wcGyzlpYEoyz6voSSfdhMt5iy5
+k5BvhBJnTiJTasCHy9KRuis/6qpTZKEj0d7J7LAqpGh8oRIphMwCbFYQT0QBgV6p
+gM8Ufss/RZ6CshMNxz7KtIYpvmxPPTGCAsUwggLBAgEBMIGyMIGkMRYwFAYDVQQH
+DA1Mb2NhbGl0eSBOYW1lMSEwHwYDVQQLDBhPcmdhbml6YXRpb25hbCBVbml0IE5h
+bWUxHDAaBgkqhkiG9w0BCQEWDUVtYWlsIEFkZHJlc3MxCzAJBgNVBAYTAlVTMQsw
+CQYDVQQIDAJOSjEaMBgGA1UECgwRRXhhbXBsZSBTaWduZXIgQ0ExEzARBgNVBAMM
+CkV4YW1wbGUgQ0ECCQCBuTktP0h8BDANBglghkgBZQMEAgEFAKCB5DAYBgkqhkiG
+9w0BCQMxCwYJKoZIhvcNAQcBMBwGCSqGSIb3DQEJBTEPFw0xODA5MTMwOTIyMzha
+MC8GCSqGSIb3DQEJBDEiBCBe/wOS+XB5tczAcNs1zT89zfSDIbfFYKfB63j1NExY
+WzB5BgkqhkiG9w0BCQ8xbDBqMAsGCWCGSAFlAwQBKjALBglghkgBZQMEARYwCwYJ
+YIZIAWUDBAECMAoGCCqGSIb3DQMHMA4GCCqGSIb3DQMCAgIAgDANBggqhkiG9w0D
+AgIBQDAHBgUrDgMCBzANBggqhkiG9w0DAgIBKDANBgkqhkiG9w0BAQEFAASCAQAy
+baJVxRJcZ3wYtb/TfQUDKNmaz7pYWNoKNxkPyKUerMOAZ9n0yvySNJUpzG+kJJNi
+Ib792GXdmP4hdz4qC4Zx3S7H26OAYcOsTwd6+O/xcv8H7PQoPD+3fplhIvLtpIlS
+//9ghpBXbUowdgzeDrYBpzRLqUth58IxsHd9cJQCCboKZIv8+6eP9fn1OD/CLGV3
+BNMvmeP88LU8UgtiivmmEJZ0fRtDVAGRIWykT1AvTfl69Pv9VKDuUW3qkuMwz7lW
+Dv0c624BYPbQWdU7W5//iy4kSfwrtXtag7aovUbcwkmb2qb5v5c5ZqNoLPUvUpIG
+KZUh0/aBuBovjwHZMcgl
+
+------F38FD3F34A584E774726CA12090D0B48--
+
diff --git a/src/security/builtin_plugins/tests/validate_local_permissions/etc/Test_Permissions_ca.pem b/src/security/builtin_plugins/tests/validate_local_permissions/etc/Test_Permissions_ca.pem
new file mode 100644
index 0000000..2372ae0
--- /dev/null
+++ b/src/security/builtin_plugins/tests/validate_local_permissions/etc/Test_Permissions_ca.pem
@@ -0,0 +1,22 @@
+-----BEGIN CERTIFICATE-----
+MIIDjTCCAnWgAwIBAgIJANsr3sm0NrypMA0GCSqGSIb3DQEBCwUAMFwxCzAJBgNV
+BAYTAk5MMRMwEQYDVQQIDApTb21lLVN0YXRlMR8wHQYDVQQKDBZBRExJTksgVGVj
+aG5vbG9jeSBJbmMuMRcwFQYDVQQDDA5hZGxpbmt0ZWNoLmNvbTAgFw0xODA3MzAx
+MjQ1NTVaGA8yMTE4MDcwNjEyNDU1NVowXDELMAkGA1UEBhMCTkwxEzARBgNVBAgM
+ClNvbWUtU3RhdGUxHzAdBgNVBAoMFkFETElOSyBUZWNobm9sb2N5IEluYy4xFzAV
+BgNVBAMMDmFkbGlua3RlY2guY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB
+CgKCAQEAu7jfnJ0wYVuXgG+PgNawdN38+dRpa8jceqi+blIDehV6XCxrnGXusTCD
+uFmo7HMOBVMVNDXlcBWgoGd+u5EultnOEiIeGTgtHc1O6V9wicp3BGSpZZax/TcO
+NjMVORaqHCADbQ2J8wsz1FHxuKDwX6BJElYOlK77lb/x3yLsDFFC+a0qn2RFh37r
+cWBRAHy8VEASXKZElT9ZmfKd+KUq34KojhNJ4DepKStTq074BRDXVivx+wVD951L
+FNPiQXq+mgHcLj1k37KlZflTFhdP5oEMtATNsXNJPHlEymiySogRWAmKhysLQudu
+kHfNKN+r0FEQMk/hzpYcFeZSOvbfNQIDAQABo1AwTjAdBgNVHQ4EFgQURWMbWvBK
+ZwJvRV1/tyc1R82k0+gwHwYDVR0jBBgwFoAURWMbWvBKZwJvRV1/tyc1R82k0+gw
+DAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAQEAkPF+ysVtvHnk2hpu9yND
+LCJ96ZzIoKOyY7uRj4ovzlAHFdpNOJQdcJihTmN8i7Trht9XVh0rGoR/6nHzo3TI
+eiogRC80RlDtuA3PF2dDQBMVDStlZMTZPb693hfjdAjhyyw9yghhKHHqNDvSsAL0
+KfBqjG4yGfGpJylYXIT5fWuKlo/ln/yyPa5s54T5XDo+CMbtlLX3QnwVOmaRyzyl
+PiTcPCDIkdLBdXmlfyJcmW6fWa6kPx+35MOxPsXZbujCo+42+OyLqcH1rKT6Xhcs
+hjXBEf+kdgUfSClrM1pNRWsw2ChIYim0F+nry5JFy0Y+8Hbb6SDB340BFmtgDHbF
+HQ==
+-----END CERTIFICATE-----
diff --git a/src/security/builtin_plugins/tests/validate_local_permissions/etc/Test_Permissions_ca_key.pem b/src/security/builtin_plugins/tests/validate_local_permissions/etc/Test_Permissions_ca_key.pem
new file mode 100644
index 0000000..22fac8b
--- /dev/null
+++ b/src/security/builtin_plugins/tests/validate_local_permissions/etc/Test_Permissions_ca_key.pem
@@ -0,0 +1,27 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIIEpAIBAAKCAQEAu7jfnJ0wYVuXgG+PgNawdN38+dRpa8jceqi+blIDehV6XCxr
+nGXusTCDuFmo7HMOBVMVNDXlcBWgoGd+u5EultnOEiIeGTgtHc1O6V9wicp3BGSp
+ZZax/TcONjMVORaqHCADbQ2J8wsz1FHxuKDwX6BJElYOlK77lb/x3yLsDFFC+a0q
+n2RFh37rcWBRAHy8VEASXKZElT9ZmfKd+KUq34KojhNJ4DepKStTq074BRDXVivx
++wVD951LFNPiQXq+mgHcLj1k37KlZflTFhdP5oEMtATNsXNJPHlEymiySogRWAmK
+hysLQudukHfNKN+r0FEQMk/hzpYcFeZSOvbfNQIDAQABAoIBABWqhMSCr+7Mr3O3
+bIymOr+CT4xWI8S47hmKGFCLTrNsfy7cQZ9PdHkm7Ez+rCx+KwQaTrwz7EM/e8aH
+q2zimMn4YXxeS7MFdM+Xvp/Y0BhXMd1j8Nk0x14+WHmQ88YfA4szdrHDekR+6oB6
+5Lc2fAfNbCGdpRksCQWDndrvIOda1swKW1RsGWHPGtSM1qOg09A4CeASqbsxZfdL
+9MgI7aJKYnvJrUhqsNZU3fuOrLDNl7/JvdI08nYLnNkEvbDYbdfH0Q/4laKsSJcp
+0jM6tPrxbHMDmBEwullVPrVqJX+n6Hvz3E8C9QiZq8NWbJUc5FntLx8ynbiJg6Lb
+1w49WxECgYEA8yVky++3v0ZMKZeSeGj3MuKuEJ2q3UdmsKXA+Pyq0rL/hh7r2oUY
+dQDs23BIuaHeIZxAGaMeMjoYQBi+G50XfwHZSMqivxX/yYkXxOJfPQvVLDbqCIWS
+94qU4/xo50IkCNxpvRwfpKG2ce5YG7jrQkfb5I6TfKUWAaXpmaQnbYsCgYEAxaVn
+Hzw3OdY7q6kURSY6a8KqtcuN0lNKeUb68vZemmZ0FNKmyh+xGVFXXlvmJpQgr5Zm
+2W2a1C1oPq2DEdvSKt/aTHVIazG9TtFK1WAXpLxmlXlyqWRv+IvdVkph+p/3dIT0
+Ilaglgbndth4xk0c1zqy3g4VlAgWgKKi5owZ/j8CgYEAndsFGbHEJZZKFCannSzo
+cEzinT7/kzGr5bt3ES9Y5/n2Euk4TmJignPbUowPaxU/1apPo1VXYVx+Kf7mTZ8r
+hfV5T9ze1BhAPGOY3uXo1wU7nLz6LBYsWDHMgEd7A8jZBDe1HmWH1aZ3gHgxE652
+bk2g4T3/WskDBIbmpi0AvAkCgYBKAfFnRMj5IzscwCcS7YmaqD377MiiJQYR+34k
+VBSAhDSbR3Wk4dESxd6NOqQndff3R74jVGNRZ99M+PPHUCSWYVQApToEyY81YDFB
+TMYNrW5MMjm5LB6xVs3+bcPacOPcAZzY7s8a3mL1oYE339AY16X6eBOkZpLmf/+3
+jGZ/SQKBgQDkyxymL4xJGV8HCDontJZiBStD954GH1AgqEAOdQxU5vW4ySQ7yRoT
+ajb8tH052yWW11Mxd0TRW9qbVI0/4/4lR86sODYLFbgrHAMBl7mxJ8Qwi4zdI9Am
+FXGkj5SX2bYrf2f0YvCHNUbELTd4mF6kAH0Eg6kHRXLsSbhtWC7D3Q==
+-----END RSA PRIVATE KEY-----
diff --git a/src/security/builtin_plugins/tests/validate_local_permissions/etc/Test_Permissions_expired.p7s b/src/security/builtin_plugins/tests/validate_local_permissions/etc/Test_Permissions_expired.p7s
new file mode 100644
index 0000000..bf35bf7
--- /dev/null
+++ b/src/security/builtin_plugins/tests/validate_local_permissions/etc/Test_Permissions_expired.p7s
@@ -0,0 +1,243 @@
+MIME-Version: 1.0
+Content-Type: multipart/signed; protocol="application/x-pkcs7-signature"; micalg="sha-256"; boundary="----11798C99B4C31493D0479BB8A2064C72"
+
+This is an S/MIME signed message
+
+------11798C99B4C31493D0479BB8A2064C72
+Content-Type: text/plain
+
+<?xml version="1.0" encoding="utf-8"?>
+<dds xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xsi:noNamespaceSchemaLocation="https://www.omg.org/spec/DDS-SECURITY/20170901/omg_shared_ca_permissions.xsd">
+    <permissions>
+        <grant name="OpenSplicePermissions">
+            <subject_name>CN=CHAM500 cert,O=Internet Widgits Pty Ltd,ST=Some-State,C=NL</subject_name>
+            <validity>
+                <!-- Format is CCYY-MM-DDThh:mm:ss[Z|(+|-)hh:mm] in GMT -->
+                <not_before>2015-09-15T01:00:00</not_before>
+                <not_after>2016-09-15T01:00:00</not_after>
+            </validity>
+            <allow_rule>
+                <domains>
+                    <id_range>
+                        <min>0</min>
+                        <max>230</max>
+                    </id_range>
+                </domains>
+                <publish>
+                    <topics>
+                        <topic>K*</topic>
+                        <topic>*OldMessage</topic>
+                        <topic>OldMessanger</topic>
+                        <topic>NewMessage</topic>
+                    </topics>
+        <partitions>
+      <partition>Apart</partition>
+      <partition>Bpa?t*</partition>
+        </partitions>
+                </publish>
+                <subscribe>
+                    <topics>
+                        <topic>K*</topic>
+                        <topic>*OldMessage</topic>
+                        <topic>OldMessanger</topic>
+                        <topic>NewMessage</topic>
+                    </topics>
+        <partitions>
+      <partition>Apart</partition>
+      <partition>Bpa?t*</partition>
+        </partitions>
+                </subscribe>
+            </allow_rule>
+            <deny_rule>
+                <domains>
+                    <id_range>
+                        <min>0</min>
+                        <max>230</max>
+                    </id_range>
+                </domains>
+                <publish>
+                    <topics>
+                        <topic>P*</topic>
+                        <topic>*WrongMessage</topic>
+                        <topic>FakeMessanger</topic>
+                        <topic>ChangedMessage</topic>
+                    </topics>
+        <partitions>
+      <partition>Apart</partition>
+      <partition>Bpa?t*</partition>
+        </partitions>
+                </publish>
+                <subscribe>
+                    <topics>
+                        <topic>P*</topic>
+                        <topic>*WrongMessage</topic>
+                        <topic>FakeMessanger</topic>
+                        <topic>ChangedMessage</topic>
+                    </topics>
+        <partitions>
+      <partition>Apart</partition>
+      <partition>Bpa?t*</partition>
+        </partitions>
+                </subscribe>
+            </deny_rule>
+
+            <default>DENY</default>
+        </grant>
+        <grant name="SpareNodeOpenSplicePermissions">
+            <subject_name>CN=Spare cert,O=Internet Widgits Pty Ltd,ST=Some-State,C=NL</subject_name>
+            <validity>
+                <!-- Format is CCYY-MM-DDThh:mm:ss[Z|(+|-)hh:mm] in GMT -->
+                <not_before>2015-09-15T01:00:00</not_before>
+                <not_after>2115-09-15T01:00:00</not_after>
+            </validity>
+            <allow_rule>
+                <domains>
+                <!-- All domains -->
+                 <id>20</id>
+                 <id>30</id>
+                 <id_range>
+                     <min>0</min>
+                     <max>23</max>
+                 </id_range>
+                 <id_range>
+                     <min>100</min>
+                     <max>120</max>
+                 </id_range>
+                 <id>200</id>
+               </domains>
+                <publish>
+                    <topics>
+                        <topic>K*</topic>
+                        <topic>*OldMessage</topic>
+                        <topic>OldMessanger</topic>
+                        <topic>NewMessage</topic>
+                    </topics>
+        <partitions>
+      <partition>Apart</partition>
+      <partition>Bpa?t*</partition>
+        </partitions>
+                </publish>
+                <subscribe>
+                    <topics>
+                        <topic>K*</topic>
+                        <topic>*OldMessage</topic>
+                        <topic>OldMessanger</topic>
+                        <topic>NewMessage</topic>
+                    </topics>
+        <partitions>
+      <partition>Apart</partition>
+      <partition>Bpa?t*</partition>
+        </partitions>
+                </subscribe>
+            </allow_rule>
+            <deny_rule>
+                <domains>
+                 <id_range>
+                     <min>0</min>
+                     <max>23</max>
+                 </id_range>
+                 <id_range>
+                     <min>100</min>
+                     <max>120</max>
+                 </id_range>
+                 <id>200</id>
+                </domains>
+                <publish>
+                    <topics>
+                        <topic>P*</topic>
+                        <topic>*WrongMessage</topic>
+                        <topic>FakeMessanger</topic>
+                        <topic>ChangedMessage</topic>
+                    </topics>
+                    <partitions>
+                      <partition>Apart</partition>
+                      <partition>Bpa?t*</partition>
+                    </partitions>
+                </publish>
+                <subscribe>
+                    <topics>
+                        <topic>P*</topic>
+                        <topic>*WrongMessage</topic>
+                        <topic>FakeMessanger</topic>
+                        <topic>ChangedMessage</topic>
+                    </topics>
+                    <partitions>
+                      <partition>Apart</partition>
+                      <partition>Bpa?t*</partition>
+                    </partitions>
+                    <data_tags>
+                      <tag>
+                        <name>aTagName1</name>
+                        <value>aTagValue1</value>
+                      </tag>
+                    </data_tags>
+                </subscribe>
+                <relay>
+                  <topics>
+                        <topic>P*</topic>
+                        <topic>*WrongMessage</topic>
+                        <topic>FakeMessanger</topic>
+                        <topic>ChangedMessage</topic>
+                    </topics>
+                    <partitions>
+                      <partition>Apart</partition>
+                      <partition>Bpa?t*</partition>
+                    </partitions>
+                    <data_tags>
+                      <tag>
+                        <name>aTagName1</name>
+                        <value>aTagValue1</value>
+                      </tag>
+                    </data_tags>
+                </relay>
+            </deny_rule>
+
+            <default>ALLOW</default>
+        </grant>
+    </permissions>
+</dds>
+
+------11798C99B4C31493D0479BB8A2064C72
+Content-Type: application/x-pkcs7-signature; name="smime.p7s"
+Content-Transfer-Encoding: base64
+Content-Disposition: attachment; filename="smime.p7s"
+
+MIIGXgYJKoZIhvcNAQcCoIIGTzCCBksCAQExDzANBglghkgBZQMEAgEFADALBgkq
+hkiG9w0BBwGgggORMIIDjTCCAnWgAwIBAgIJANsr3sm0NrypMA0GCSqGSIb3DQEB
+CwUAMFwxCzAJBgNVBAYTAk5MMRMwEQYDVQQIDApTb21lLVN0YXRlMR8wHQYDVQQK
+DBZBRExJTksgVGVjaG5vbG9jeSBJbmMuMRcwFQYDVQQDDA5hZGxpbmt0ZWNoLmNv
+bTAgFw0xODA3MzAxMjQ1NTVaGA8yMTE4MDcwNjEyNDU1NVowXDELMAkGA1UEBhMC
+TkwxEzARBgNVBAgMClNvbWUtU3RhdGUxHzAdBgNVBAoMFkFETElOSyBUZWNobm9s
+b2N5IEluYy4xFzAVBgNVBAMMDmFkbGlua3RlY2guY29tMIIBIjANBgkqhkiG9w0B
+AQEFAAOCAQ8AMIIBCgKCAQEAu7jfnJ0wYVuXgG+PgNawdN38+dRpa8jceqi+blID
+ehV6XCxrnGXusTCDuFmo7HMOBVMVNDXlcBWgoGd+u5EultnOEiIeGTgtHc1O6V9w
+icp3BGSpZZax/TcONjMVORaqHCADbQ2J8wsz1FHxuKDwX6BJElYOlK77lb/x3yLs
+DFFC+a0qn2RFh37rcWBRAHy8VEASXKZElT9ZmfKd+KUq34KojhNJ4DepKStTq074
+BRDXVivx+wVD951LFNPiQXq+mgHcLj1k37KlZflTFhdP5oEMtATNsXNJPHlEymiy
+SogRWAmKhysLQudukHfNKN+r0FEQMk/hzpYcFeZSOvbfNQIDAQABo1AwTjAdBgNV
+HQ4EFgQURWMbWvBKZwJvRV1/tyc1R82k0+gwHwYDVR0jBBgwFoAURWMbWvBKZwJv
+RV1/tyc1R82k0+gwDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAQEAkPF+
+ysVtvHnk2hpu9yNDLCJ96ZzIoKOyY7uRj4ovzlAHFdpNOJQdcJihTmN8i7Trht9X
+Vh0rGoR/6nHzo3TIeiogRC80RlDtuA3PF2dDQBMVDStlZMTZPb693hfjdAjhyyw9
+yghhKHHqNDvSsAL0KfBqjG4yGfGpJylYXIT5fWuKlo/ln/yyPa5s54T5XDo+CMbt
+lLX3QnwVOmaRyzylPiTcPCDIkdLBdXmlfyJcmW6fWa6kPx+35MOxPsXZbujCo+42
++OyLqcH1rKT6XhcshjXBEf+kdgUfSClrM1pNRWsw2ChIYim0F+nry5JFy0Y+8Hbb
+6SDB340BFmtgDHbFHTGCApEwggKNAgEBMGkwXDELMAkGA1UEBhMCTkwxEzARBgNV
+BAgMClNvbWUtU3RhdGUxHzAdBgNVBAoMFkFETElOSyBUZWNobm9sb2N5IEluYy4x
+FzAVBgNVBAMMDmFkbGlua3RlY2guY29tAgkA2yveybQ2vKkwDQYJYIZIAWUDBAIB
+BQCggfowGAYJKoZIhvcNAQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG9w0BCQUxDxcN
+MTkwMzI5MTMwODAzWjAvBgkqhkiG9w0BCQQxIgQgXPEkUvQgZwRMdZgxT8k/mrsJ
+delB0E3RjpayHUkKYzowgY4GCSqGSIb3DQEJDzGBgDB+MAsGCWCGSAFlAwQBKjAI
+BgYqhQMCAgkwCAYGKoUDAgIVMAsGCWCGSAFlAwQBFjALBglghkgBZQMEAQIwCgYI
+KoZIhvcNAwcwDgYIKoZIhvcNAwICAgCAMA0GCCqGSIb3DQMCAgFAMAcGBSsOAwIH
+MA0GCCqGSIb3DQMCAgEoMA0GCSqGSIb3DQEBAQUABIIBAA/TNULF62fO5mfjXm1L
+Yk4Dg/5ZxAF/grDAjamo5v2fxGn6B1rrkj8YtyB1FEA0moM/cL31kNXNMqLvFdhY
+lHCmX8x5PHkKzLihTIMx6diSCupBvvqUACeA7Ir1A3tMqW5tYYMg6sZ/YolgLLFG
+8XmhttpEibtZm90MN3Xpsa4TiW5PlEWHC5ai3tyeyd/RCVoeQJVA0pAytmjdf2Mw
+C3W/28tUxVCAjdlqXYap6jWZlNv/43P5HED837bF5iqoa1dTvDirca6WPanNjp28
+GQDi4bnD1kAk8wAKIm14qwS+fzxM3SKxJtdQuUCx+s/tPma4bLCqt843ok35SoWo
+QKM=
+
+------11798C99B4C31493D0479BB8A2064C72--
+
diff --git a/src/security/builtin_plugins/tests/validate_local_permissions/etc/Test_Permissions_expired.xml b/src/security/builtin_plugins/tests/validate_local_permissions/etc/Test_Permissions_expired.xml
new file mode 100644
index 0000000..f408942
--- /dev/null
+++ b/src/security/builtin_plugins/tests/validate_local_permissions/etc/Test_Permissions_expired.xml
@@ -0,0 +1,191 @@
+<?xml version="1.0" encoding="utf-8"?>
+<dds xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xsi:noNamespaceSchemaLocation="https://www.omg.org/spec/DDS-SECURITY/20170901/omg_shared_ca_permissions.xsd">
+    <permissions>
+        <grant name="OpenSplicePermissions">
+            <subject_name>CN=CHAM500 cert,O=Internet Widgits Pty Ltd,ST=Some-State,C=NL</subject_name>
+            <validity>
+                <!-- Format is CCYY-MM-DDThh:mm:ss[Z|(+|-)hh:mm] in GMT -->
+                <not_before>2015-09-15T01:00:00</not_before>
+                <not_after>2016-09-15T01:00:00</not_after>
+            </validity>
+            <allow_rule>
+                <domains>
+                    <id_range>
+                        <min>0</min>
+                        <max>230</max>
+                    </id_range>
+                </domains>
+                <publish>
+                    <topics>
+                        <topic>K*</topic>
+                        <topic>*OldMessage</topic>
+                        <topic>OldMessanger</topic>
+                        <topic>NewMessage</topic>
+                    </topics>
+        <partitions>
+      <partition>Apart</partition>
+      <partition>Bpa?t*</partition>
+        </partitions>
+                </publish>
+                <subscribe>
+                    <topics>
+                        <topic>K*</topic>
+                        <topic>*OldMessage</topic>
+                        <topic>OldMessanger</topic>
+                        <topic>NewMessage</topic>
+                    </topics>
+        <partitions>
+      <partition>Apart</partition>
+      <partition>Bpa?t*</partition>
+        </partitions>
+                </subscribe>
+            </allow_rule>
+            <deny_rule>
+                <domains>
+                    <id_range>
+                        <min>0</min>
+                        <max>230</max>
+                    </id_range>
+                </domains>
+                <publish>
+                    <topics>
+                        <topic>P*</topic>
+                        <topic>*WrongMessage</topic>
+                        <topic>FakeMessanger</topic>
+                        <topic>ChangedMessage</topic>
+                    </topics>
+        <partitions>
+      <partition>Apart</partition>
+      <partition>Bpa?t*</partition>
+        </partitions>
+                </publish>
+                <subscribe>
+                    <topics>
+                        <topic>P*</topic>
+                        <topic>*WrongMessage</topic>
+                        <topic>FakeMessanger</topic>
+                        <topic>ChangedMessage</topic>
+                    </topics>
+        <partitions>
+      <partition>Apart</partition>
+      <partition>Bpa?t*</partition>
+        </partitions>
+                </subscribe>
+            </deny_rule>
+
+            <default>DENY</default>
+        </grant>
+        <grant name="SpareNodeOpenSplicePermissions">
+            <subject_name>CN=Spare cert,O=Internet Widgits Pty Ltd,ST=Some-State,C=NL</subject_name>
+            <validity>
+                <!-- Format is CCYY-MM-DDThh:mm:ss[Z|(+|-)hh:mm] in GMT -->
+                <not_before>2015-09-15T01:00:00</not_before>
+                <not_after>2115-09-15T01:00:00</not_after>
+            </validity>
+            <allow_rule>
+                <domains>
+                <!-- All domains -->
+                 <id>20</id>
+                 <id>30</id>
+                 <id_range>
+                     <min>0</min>
+                     <max>23</max>
+                 </id_range>
+                 <id_range>
+                     <min>100</min>
+                     <max>120</max>
+                 </id_range>
+                 <id>200</id>
+               </domains>
+                <publish>
+                    <topics>
+                        <topic>K*</topic>
+                        <topic>*OldMessage</topic>
+                        <topic>OldMessanger</topic>
+                        <topic>NewMessage</topic>
+                    </topics>
+        <partitions>
+      <partition>Apart</partition>
+      <partition>Bpa?t*</partition>
+        </partitions>
+                </publish>
+                <subscribe>
+                    <topics>
+                        <topic>K*</topic>
+                        <topic>*OldMessage</topic>
+                        <topic>OldMessanger</topic>
+                        <topic>NewMessage</topic>
+                    </topics>
+        <partitions>
+      <partition>Apart</partition>
+      <partition>Bpa?t*</partition>
+        </partitions>
+                </subscribe>
+            </allow_rule>
+            <deny_rule>
+                <domains>
+                 <id_range>
+                     <min>0</min>
+                     <max>23</max>
+                 </id_range>
+                 <id_range>
+                     <min>100</min>
+                     <max>120</max>
+                 </id_range>
+                 <id>200</id>
+                </domains>
+                <publish>
+                    <topics>
+                        <topic>P*</topic>
+                        <topic>*WrongMessage</topic>
+                        <topic>FakeMessanger</topic>
+                        <topic>ChangedMessage</topic>
+                    </topics>
+                    <partitions>
+                      <partition>Apart</partition>
+                      <partition>Bpa?t*</partition>
+                    </partitions>
+                </publish>
+                <subscribe>
+                    <topics>
+                        <topic>P*</topic>
+                        <topic>*WrongMessage</topic>
+                        <topic>FakeMessanger</topic>
+                        <topic>ChangedMessage</topic>
+                    </topics>
+                    <partitions>
+                      <partition>Apart</partition>
+                      <partition>Bpa?t*</partition>
+                    </partitions>
+                    <data_tags>
+                      <tag>
+                        <name>aTagName1</name>
+                        <value>aTagValue1</value>
+                      </tag>
+                    </data_tags>
+                </subscribe>
+                <relay>
+                  <topics>
+                        <topic>P*</topic>
+                        <topic>*WrongMessage</topic>
+                        <topic>FakeMessanger</topic>
+                        <topic>ChangedMessage</topic>
+                    </topics>
+                    <partitions>
+                      <partition>Apart</partition>
+                      <partition>Bpa?t*</partition>
+                    </partitions>
+                    <data_tags>
+                      <tag>
+                        <name>aTagName1</name>
+                        <value>aTagValue1</value>
+                      </tag>
+                    </data_tags>
+                </relay>
+            </deny_rule>
+
+            <default>ALLOW</default>
+        </grant>
+    </permissions>
+</dds>
diff --git a/src/security/builtin_plugins/tests/validate_local_permissions/etc/Test_Permissions_full.p7s b/src/security/builtin_plugins/tests/validate_local_permissions/etc/Test_Permissions_full.p7s
new file mode 100644
index 0000000..a8e71c1
--- /dev/null
+++ b/src/security/builtin_plugins/tests/validate_local_permissions/etc/Test_Permissions_full.p7s
@@ -0,0 +1,243 @@
+MIME-Version: 1.0
+Content-Type: multipart/signed; protocol="application/x-pkcs7-signature"; micalg="sha-256"; boundary="----D2957343698C311655D075C56A04A68D"
+
+This is an S/MIME signed message
+
+------D2957343698C311655D075C56A04A68D
+Content-Type: text/plain
+
+<?xml version="1.0" encoding="utf-8"?>
+<dds xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xsi:noNamespaceSchemaLocation="https://www.omg.org/spec/DDS-SECURITY/20170901/omg_shared_ca_permissions.xsd">
+    <permissions>
+        <grant name="OpenSplicePermissions">
+            <subject_name>CN=CHAM500 cert,O=Internet Widgits Pty Ltd,ST=Some-State,C=NL</subject_name>
+            <validity>
+                <!-- Format is CCYY-MM-DDThh:mm:ss[Z|(+|-)hh:mm] in GMT -->
+                <not_before>2015-09-15T01:00:00</not_before>
+                <not_after>2115-09-15T01:00:00</not_after>
+            </validity>
+            <allow_rule>
+                <domains>
+                    <id_range>
+                        <min>0</min>
+                        <max>230</max>
+                    </id_range>
+                </domains>
+                <publish>
+                    <topics>
+                        <topic>K*</topic>
+                        <topic>*OldMessage</topic>
+                        <topic>OldMessanger</topic>
+                        <topic>NewMessage</topic>
+                    </topics>
+        <partitions>
+      <partition>Apart</partition>
+      <partition>Bpa?t*</partition>
+        </partitions>
+                </publish>
+                <subscribe>
+                    <topics>
+                        <topic>K*</topic>
+                        <topic>*OldMessage</topic>
+                        <topic>OldMessanger</topic>
+                        <topic>NewMessage</topic>
+                    </topics>
+        <partitions>
+      <partition>Apart</partition>
+      <partition>Bpa?t*</partition>
+        </partitions>
+                </subscribe>
+            </allow_rule>
+            <deny_rule>
+                <domains>
+                    <id_range>
+                        <min>0</min>
+                        <max>230</max>
+                    </id_range>
+                </domains>
+                <publish>
+                    <topics>
+                        <topic>P*</topic>
+                        <topic>*WrongMessage</topic>
+                        <topic>FakeMessanger</topic>
+                        <topic>ChangedMessage</topic>
+                    </topics>
+        <partitions>
+      <partition>Apart</partition>
+      <partition>Bpa?t*</partition>
+        </partitions>
+                </publish>
+                <subscribe>
+                    <topics>
+                        <topic>P*</topic>
+                        <topic>*WrongMessage</topic>
+                        <topic>FakeMessanger</topic>
+                        <topic>ChangedMessage</topic>
+                    </topics>
+        <partitions>
+      <partition>Apart</partition>
+      <partition>Bpa?t*</partition>
+        </partitions>
+                </subscribe>
+            </deny_rule>
+
+            <default>DENY</default>
+        </grant>
+        <grant name="SpareNodeOpenSplicePermissions">
+            <subject_name>CN=Spare cert,O=Internet Widgits Pty Ltd,ST=Some-State,C=NL</subject_name>
+            <validity>
+                <!-- Format is CCYY-MM-DDThh:mm:ss[Z|(+|-)hh:mm] in GMT -->
+                <not_before>2015-09-15T01:00:00</not_before>
+                <not_after>2115-09-15T01:00:00</not_after>
+            </validity>
+            <allow_rule>
+                <domains>
+                <!-- All domains -->
+                 <id>20</id>
+                 <id>30</id>
+                 <id_range>
+                     <min>0</min>
+                     <max>23</max>
+                 </id_range>
+                 <id_range>
+                     <min>100</min>
+                     <max>120</max>
+                 </id_range>
+                 <id>200</id>
+               </domains>
+                <publish>
+                    <topics>
+                        <topic>K*</topic>
+                        <topic>*OldMessage</topic>
+                        <topic>OldMessanger</topic>
+                        <topic>NewMessage</topic>
+                    </topics>
+        <partitions>
+      <partition>Apart</partition>
+      <partition>Bpa?t*</partition>
+        </partitions>
+                </publish>
+                <subscribe>
+                    <topics>
+                        <topic>K*</topic>
+                        <topic>*OldMessage</topic>
+                        <topic>OldMessanger</topic>
+                        <topic>NewMessage</topic>
+                    </topics>
+        <partitions>
+      <partition>Apart</partition>
+      <partition>Bpa?t*</partition>
+        </partitions>
+                </subscribe>
+            </allow_rule>
+            <deny_rule>
+                <domains>
+                 <id_range>
+                     <min>0</min>
+                     <max>23</max>
+                 </id_range>
+                 <id_range>
+                     <min>100</min>
+                     <max>120</max>
+                 </id_range>
+                 <id>200</id>
+                </domains>
+                <publish>
+                    <topics>
+                        <topic>P*</topic>
+                        <topic>*WrongMessage</topic>
+                        <topic>FakeMessanger</topic>
+                        <topic>ChangedMessage</topic>
+                    </topics>
+                    <partitions>
+                      <partition>Apart</partition>
+                      <partition>Bpa?t*</partition>
+                    </partitions>
+                </publish>
+                <subscribe>
+                    <topics>
+                        <topic>P*</topic>
+                        <topic>*WrongMessage</topic>
+                        <topic>FakeMessanger</topic>
+                        <topic>ChangedMessage</topic>
+                    </topics>
+                    <partitions>
+                      <partition>Apart</partition>
+                      <partition>Bpa?t*</partition>
+                    </partitions>
+                    <data_tags>
+                      <tag>
+                        <name>aTagName1</name>
+                        <value>aTagValue1</value>
+                      </tag>
+                    </data_tags>
+                </subscribe>
+                <relay>
+                  <topics>
+                        <topic>P*</topic>
+                        <topic>*WrongMessage</topic>
+                        <topic>FakeMessanger</topic>
+                        <topic>ChangedMessage</topic>
+                    </topics>
+                    <partitions>
+                      <partition>Apart</partition>
+                      <partition>Bpa?t*</partition>
+                    </partitions>
+                    <data_tags>
+                      <tag>
+                        <name>aTagName1</name>
+                        <value>aTagValue1</value>
+                      </tag>
+                    </data_tags>
+                </relay>
+            </deny_rule>
+
+            <default>ALLOW</default>
+        </grant>
+    </permissions>
+</dds>
+
+------D2957343698C311655D075C56A04A68D
+Content-Type: application/x-pkcs7-signature; name="smime.p7s"
+Content-Transfer-Encoding: base64
+Content-Disposition: attachment; filename="smime.p7s"
+
+MIIGXgYJKoZIhvcNAQcCoIIGTzCCBksCAQExDzANBglghkgBZQMEAgEFADALBgkq
+hkiG9w0BBwGgggORMIIDjTCCAnWgAwIBAgIJANsr3sm0NrypMA0GCSqGSIb3DQEB
+CwUAMFwxCzAJBgNVBAYTAk5MMRMwEQYDVQQIDApTb21lLVN0YXRlMR8wHQYDVQQK
+DBZBRExJTksgVGVjaG5vbG9jeSBJbmMuMRcwFQYDVQQDDA5hZGxpbmt0ZWNoLmNv
+bTAgFw0xODA3MzAxMjQ1NTVaGA8yMTE4MDcwNjEyNDU1NVowXDELMAkGA1UEBhMC
+TkwxEzARBgNVBAgMClNvbWUtU3RhdGUxHzAdBgNVBAoMFkFETElOSyBUZWNobm9s
+b2N5IEluYy4xFzAVBgNVBAMMDmFkbGlua3RlY2guY29tMIIBIjANBgkqhkiG9w0B
+AQEFAAOCAQ8AMIIBCgKCAQEAu7jfnJ0wYVuXgG+PgNawdN38+dRpa8jceqi+blID
+ehV6XCxrnGXusTCDuFmo7HMOBVMVNDXlcBWgoGd+u5EultnOEiIeGTgtHc1O6V9w
+icp3BGSpZZax/TcONjMVORaqHCADbQ2J8wsz1FHxuKDwX6BJElYOlK77lb/x3yLs
+DFFC+a0qn2RFh37rcWBRAHy8VEASXKZElT9ZmfKd+KUq34KojhNJ4DepKStTq074
+BRDXVivx+wVD951LFNPiQXq+mgHcLj1k37KlZflTFhdP5oEMtATNsXNJPHlEymiy
+SogRWAmKhysLQudukHfNKN+r0FEQMk/hzpYcFeZSOvbfNQIDAQABo1AwTjAdBgNV
+HQ4EFgQURWMbWvBKZwJvRV1/tyc1R82k0+gwHwYDVR0jBBgwFoAURWMbWvBKZwJv
+RV1/tyc1R82k0+gwDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAQEAkPF+
+ysVtvHnk2hpu9yNDLCJ96ZzIoKOyY7uRj4ovzlAHFdpNOJQdcJihTmN8i7Trht9X
+Vh0rGoR/6nHzo3TIeiogRC80RlDtuA3PF2dDQBMVDStlZMTZPb693hfjdAjhyyw9
+yghhKHHqNDvSsAL0KfBqjG4yGfGpJylYXIT5fWuKlo/ln/yyPa5s54T5XDo+CMbt
+lLX3QnwVOmaRyzylPiTcPCDIkdLBdXmlfyJcmW6fWa6kPx+35MOxPsXZbujCo+42
++OyLqcH1rKT6XhcshjXBEf+kdgUfSClrM1pNRWsw2ChIYim0F+nry5JFy0Y+8Hbb
+6SDB340BFmtgDHbFHTGCApEwggKNAgEBMGkwXDELMAkGA1UEBhMCTkwxEzARBgNV
+BAgMClNvbWUtU3RhdGUxHzAdBgNVBAoMFkFETElOSyBUZWNobm9sb2N5IEluYy4x
+FzAVBgNVBAMMDmFkbGlua3RlY2guY29tAgkA2yveybQ2vKkwDQYJYIZIAWUDBAIB
+BQCggfowGAYJKoZIhvcNAQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG9w0BCQUxDxcN
+MTkwMzI5MTMwODAzWjAvBgkqhkiG9w0BCQQxIgQgcYMSlCRiboSPUqMbBIKL7lBv
+QJlEFiHrJ5t/aOJZbi0wgY4GCSqGSIb3DQEJDzGBgDB+MAsGCWCGSAFlAwQBKjAI
+BgYqhQMCAgkwCAYGKoUDAgIVMAsGCWCGSAFlAwQBFjALBglghkgBZQMEAQIwCgYI
+KoZIhvcNAwcwDgYIKoZIhvcNAwICAgCAMA0GCCqGSIb3DQMCAgFAMAcGBSsOAwIH
+MA0GCCqGSIb3DQMCAgEoMA0GCSqGSIb3DQEBAQUABIIBAJsR4q4Eeorhd4sQaw+D
+PErzkTuI1PEDzv2oYy3U/w4ZdGF2TJQqZ/OqiKEtmwqVAKfuPb9XQLPSENtn2uZC
+wz9ZcvMJ4/GOOMWezN6J65pfuAeEWa0oGCcAASl7tuk+QpAK3MY8L5hxCPb6sfr9
+jslfMqJ+WYgrOVuqWMAYZoXwIgJ1GdREXOXoCnyEkwy6Prk6NhSDO6Jl91PxcZWG
+ZITu7y/mklX8cSx09MNyOfefFhCIfNnXGJu0HUTYluTFd1LgRan6f0uyPR2zBLlE
+qzuaetvpNlUclf8dywlazI8oRjfrusYo3tiKG+hHkjrXc7WHOh+I08Tqeyue+0tg
+cjw=
+
+------D2957343698C311655D075C56A04A68D--
+
diff --git a/src/security/builtin_plugins/tests/validate_local_permissions/etc/Test_Permissions_full.xml b/src/security/builtin_plugins/tests/validate_local_permissions/etc/Test_Permissions_full.xml
new file mode 100644
index 0000000..0be3fa2
--- /dev/null
+++ b/src/security/builtin_plugins/tests/validate_local_permissions/etc/Test_Permissions_full.xml
@@ -0,0 +1,191 @@
+<?xml version="1.0" encoding="utf-8"?>
+<dds xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xsi:noNamespaceSchemaLocation="https://www.omg.org/spec/DDS-SECURITY/20170901/omg_shared_ca_permissions.xsd">
+    <permissions>
+        <grant name="OpenSplicePermissions">
+            <subject_name>CN=CHAM500 cert,O=Internet Widgits Pty Ltd,ST=Some-State,C=NL</subject_name>
+            <validity>
+                <!-- Format is CCYY-MM-DDThh:mm:ss[Z|(+|-)hh:mm] in GMT -->
+                <not_before>2015-09-15T01:00:00</not_before>
+                <not_after>2115-09-15T01:00:00</not_after>
+            </validity>
+            <allow_rule>
+                <domains>
+                    <id_range>
+                        <min>0</min>
+                        <max>230</max>
+                    </id_range>
+                </domains>
+                <publish>
+                    <topics>
+                        <topic>K*</topic>
+                        <topic>*OldMessage</topic>
+                        <topic>OldMessanger</topic>
+                        <topic>NewMessage</topic>
+                    </topics>
+        <partitions>
+      <partition>Apart</partition>
+      <partition>Bpa?t*</partition>
+        </partitions>
+                </publish>
+                <subscribe>
+                    <topics>
+                        <topic>K*</topic>
+                        <topic>*OldMessage</topic>
+                        <topic>OldMessanger</topic>
+                        <topic>NewMessage</topic>
+                    </topics>
+        <partitions>
+      <partition>Apart</partition>
+      <partition>Bpa?t*</partition>
+        </partitions>
+                </subscribe>
+            </allow_rule>
+            <deny_rule>
+                <domains>
+                    <id_range>
+                        <min>0</min>
+                        <max>230</max>
+                    </id_range>
+                </domains>
+                <publish>
+                    <topics>
+                        <topic>P*</topic>
+                        <topic>*WrongMessage</topic>
+                        <topic>FakeMessanger</topic>
+                        <topic>ChangedMessage</topic>
+                    </topics>
+        <partitions>
+      <partition>Apart</partition>
+      <partition>Bpa?t*</partition>
+        </partitions>
+                </publish>
+                <subscribe>
+                    <topics>
+                        <topic>P*</topic>
+                        <topic>*WrongMessage</topic>
+                        <topic>FakeMessanger</topic>
+                        <topic>ChangedMessage</topic>
+                    </topics>
+        <partitions>
+      <partition>Apart</partition>
+      <partition>Bpa?t*</partition>
+        </partitions>
+                </subscribe>
+            </deny_rule>
+
+            <default>DENY</default>
+        </grant>
+        <grant name="SpareNodeOpenSplicePermissions">
+            <subject_name>CN=Spare cert,O=Internet Widgits Pty Ltd,ST=Some-State,C=NL</subject_name>
+            <validity>
+                <!-- Format is CCYY-MM-DDThh:mm:ss[Z|(+|-)hh:mm] in GMT -->
+                <not_before>2015-09-15T01:00:00</not_before>
+                <not_after>2115-09-15T01:00:00</not_after>
+            </validity>
+            <allow_rule>
+                <domains>
+                <!-- All domains -->
+                 <id>20</id>
+                 <id>30</id>
+                 <id_range>
+                     <min>0</min>
+                     <max>23</max>
+                 </id_range>
+                 <id_range>
+                     <min>100</min>
+                     <max>120</max>
+                 </id_range>
+                 <id>200</id>
+               </domains>
+                <publish>
+                    <topics>
+                        <topic>K*</topic>
+                        <topic>*OldMessage</topic>
+                        <topic>OldMessanger</topic>
+                        <topic>NewMessage</topic>
+                    </topics>
+        <partitions>
+      <partition>Apart</partition>
+      <partition>Bpa?t*</partition>
+        </partitions>
+                </publish>
+                <subscribe>
+                    <topics>
+                        <topic>K*</topic>
+                        <topic>*OldMessage</topic>
+                        <topic>OldMessanger</topic>
+                        <topic>NewMessage</topic>
+                    </topics>
+        <partitions>
+      <partition>Apart</partition>
+      <partition>Bpa?t*</partition>
+        </partitions>
+                </subscribe>
+            </allow_rule>
+            <deny_rule>
+                <domains>
+                 <id_range>
+                     <min>0</min>
+                     <max>23</max>
+                 </id_range>
+                 <id_range>
+                     <min>100</min>
+                     <max>120</max>
+                 </id_range>
+                 <id>200</id>
+                </domains>
+                <publish>
+                    <topics>
+                        <topic>P*</topic>
+                        <topic>*WrongMessage</topic>
+                        <topic>FakeMessanger</topic>
+                        <topic>ChangedMessage</topic>
+                    </topics>
+                    <partitions>
+                      <partition>Apart</partition>
+                      <partition>Bpa?t*</partition>
+                    </partitions>
+                </publish>
+                <subscribe>
+                    <topics>
+                        <topic>P*</topic>
+                        <topic>*WrongMessage</topic>
+                        <topic>FakeMessanger</topic>
+                        <topic>ChangedMessage</topic>
+                    </topics>
+                    <partitions>
+                      <partition>Apart</partition>
+                      <partition>Bpa?t*</partition>
+                    </partitions>
+                    <data_tags>
+                      <tag>
+                        <name>aTagName1</name>
+                        <value>aTagValue1</value>
+                      </tag>
+                    </data_tags>
+                </subscribe>
+                <relay>
+                  <topics>
+                        <topic>P*</topic>
+                        <topic>*WrongMessage</topic>
+                        <topic>FakeMessanger</topic>
+                        <topic>ChangedMessage</topic>
+                    </topics>
+                    <partitions>
+                      <partition>Apart</partition>
+                      <partition>Bpa?t*</partition>
+                    </partitions>
+                    <data_tags>
+                      <tag>
+                        <name>aTagName1</name>
+                        <value>aTagValue1</value>
+                      </tag>
+                    </data_tags>
+                </relay>
+            </deny_rule>
+
+            <default>ALLOW</default>
+        </grant>
+    </permissions>
+</dds>
diff --git a/src/security/builtin_plugins/tests/validate_local_permissions/etc/Test_Permissions_invalid_data.p7s b/src/security/builtin_plugins/tests/validate_local_permissions/etc/Test_Permissions_invalid_data.p7s
new file mode 100644
index 0000000..b3b969e
--- /dev/null
+++ b/src/security/builtin_plugins/tests/validate_local_permissions/etc/Test_Permissions_invalid_data.p7s
@@ -0,0 +1,219 @@
+MIME-Version: 1.0
+Content-Type: multipart/signed; protocol="application/x-pkcs7-signature"; micalg="sha-256"; boundary="----62BE4CE8CF1FCB0420A2F2884B1618E6"
+
+This is an S/MIME signed message
+
+------62BE4CE8CF1FCB0420A2F2884B1618E6
+Content-Type: text/plain
+
+<?xml version="1.0" encoding="utf-8"?>
+<dds xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xsi:noNamespaceSchemaLocation="https://www.omg.org/spec/DDS-SECURITY/20170901/omg_shared_ca_permissions.xsd">
+    <permissions>
+        <grant name="OpenSplicePermissions">
+            <subject_name>CN=CHAM500 cert,O=Internet Widgits Pty Ltd,ST=Some-State,C=NL</subject_name>
+            <validity>
+                <!-- Format is CCYY-MM-DDThh:mm:ss[Z|(+|-)hh:mm] in GMT -->
+                <not_before>2015-09-15T01:00:00</not_before>
+                <not_after>2115-09-15T01:00:00</not_after>
+            </validity>
+            <allow_rule>
+                <domains>
+                    <id_range>
+                        <min>0</min>
+                        <max>430</max>
+                    </id_range>
+                </domains>
+                <publish>
+                    <topics>
+                        <topic>K*</topic>
+                        <topic>*OldMessage</topic>
+                        <topic>OldMessanger</topic>
+                        <topic>NewMessage</topic>
+                    </topics>
+		    <partitions>
+			<partition>Apart</partition>
+			<partition>Bpa?t*</partition>
+		    </partitions>
+                </publish>
+                <subscribe>
+                    <topics>
+                        <topic>K*</topic>
+                        <topic>*OldMessage</topic>
+                        <topic>OldMessanger</topic>
+                        <topic>NewMessage</topic>
+                    </topics>
+		    <partitions>
+			<partition>Apart</partition>
+			<partition>Bpa?t*</partition>
+		    </partitions>
+                </subscribe>
+            </allow_rule>
+            <deny_rule>
+                <domains>
+                    <id_range>
+                        <min>0</min>
+                        <max>230</max>
+                    </id_range>
+                </domains>
+                <publish>
+                    <topics>
+                        <topic>P*</topic>
+                        <topic>*WrongMessage</topic>
+                        <topic>FakeMessanger</topic>
+                        <topic>ChangedMessage</topic>
+                    </topics>
+		    <partitions>
+			<partition>Apart</partition>
+			<partition>Bpa?t*</partition>
+		    </partitions>
+                </publish>
+                <subscribe>
+                    <topics>
+                        <topic>P*</topic>
+                        <topic>*WrongMessage</topic>
+                        <topic>FakeMessanger</topic>
+                        <topic>ChangedMessage</topic>
+                    </topics>
+		    <partitions>
+			<partition>Apart</partition>
+			<partition>Bpa?t*</partition>
+		    </partitions>
+                </subscribe>
+            </deny_rule>
+
+            <default>DENY</default>
+        </grant>
+        <grant name="SpareNodeOpenSplicePermissions">
+            <subject_name>CN=CHAM500 cert,O=Internet Widgits Pty Ltd,ST=Some-State,C=NL</subject_name>
+            <validity>
+                <!-- Format is CCYY-MM-DDThh:mm:ss[Z|(+|-)hh:mm] in GMT -->
+                <not_before>2015-09-15T01:00:00</not_before>
+                <not_after>2115-09-15T01:00:00</not_after>
+            </validity>
+            <allow_rule>
+                <domains>
+                <!-- All domains -->
+                 <id>20</id>
+                 <id>30</id>
+                 <id_range>
+                     <min>0</min>
+                     <max>23</max>
+                 </id_range>
+                 <id_range>
+                     <min>100</min>
+                     <max>120</max>
+                 </id_range>
+                 <id>200</id>
+               </domains>
+                <publish>
+                    <topics>
+                        <topic>K*</topic>
+                        <topic>*OldMessage</topic>
+                        <topic>OldMessanger</topic>
+                        <topic>NewMessage</topic>
+                    </topics>
+		    <partitions>
+			<partition>Apart</partition>
+			<partition>Bpa?t*</partition>
+		    </partitions>
+                </publish>
+                <subscribe>
+                    <topics>
+                        <topic>K*</topic>
+                        <topic>*OldMessage</topic>
+                        <topic>OldMessanger</topic>
+                        <topic>NewMessage</topic>
+                    </topics>
+		    <partitions>
+			<partition>Apart</partition>
+			<partition>Bpa?t*</partition>
+		    </partitions>
+                </subscribe>
+            </allow_rule>
+            <deny_rule>
+                <domains>
+                 <id_range>
+                     <min>0</min>
+                     <max>23</max>
+                 </id_range>
+                 <id_range>
+                     <min>100</min>
+                     <max>120</max>
+                 </id_range>
+                 <id>200</id>
+                </domains>
+                <publish>
+                    <topics>
+                        <topic>P*</topic>
+                        <topic>*WrongMessage</topic>
+                        <topic>FakeMessanger</topic>
+                        <topic>ChangedMessage</topic>
+                    </topics>
+		    <partitions>
+			<partition>Apart</partition>
+			<partition>Bpa?t*</partition>
+		    </partitions>
+                </publish>
+                <subscribe>
+                    <topics>
+                        <topic>P*</topic>
+                        <topic>*WrongMessage</topic>
+                        <topic>FakeMessanger</topic>
+                        <topic>ChangedMessage</topic>
+                    </topics>
+		    <partitions>
+			<partition>Apart</partition>
+			<partition>Bpa?t*</partition>
+		    </partitions>
+                </subscribe>
+            </deny_rule>
+
+            <default>DENY</default>
+        </grant>
+    </permissions>
+</dds>
+
+------62BE4CE8CF1FCB0420A2F2884B1618E6
+Content-Type: application/x-pkcs7-signature; name="smime.p7s"
+Content-Transfer-Encoding: base64
+Content-Disposition: attachment; filename="smime.p7s"
+
+MIIGXgYJKoZIhvcNAQcCoIIGTzCCBksCAQExDzANBglghkgBZQMEAgEFADALBgkq
+hkiG9w0BBwGgggORMIIDjTCCAnWgAwIBAgIJANsr3sm0NrypMA0GCSqGSIb3DQEB
+CwUAMFwxCzAJBgNVBAYTAk5MMRMwEQYDVQQIDApTb21lLVN0YXRlMR8wHQYDVQQK
+DBZBRExJTksgVGVjaG5vbG9jeSBJbmMuMRcwFQYDVQQDDA5hZGxpbmt0ZWNoLmNv
+bTAgFw0xODA3MzAxMjQ1NTVaGA8yMTE4MDcwNjEyNDU1NVowXDELMAkGA1UEBhMC
+TkwxEzARBgNVBAgMClNvbWUtU3RhdGUxHzAdBgNVBAoMFkFETElOSyBUZWNobm9s
+b2N5IEluYy4xFzAVBgNVBAMMDmFkbGlua3RlY2guY29tMIIBIjANBgkqhkiG9w0B
+AQEFAAOCAQ8AMIIBCgKCAQEAu7jfnJ0wYVuXgG+PgNawdN38+dRpa8jceqi+blID
+ehV6XCxrnGXusTCDuFmo7HMOBVMVNDXlcBWgoGd+u5EultnOEiIeGTgtHc1O6V9w
+icp3BGSpZZax/TcONjMVORaqHCADbQ2J8wsz1FHxuKDwX6BJElYOlK77lb/x3yLs
+DFFC+a0qn2RFh37rcWBRAHy8VEASXKZElT9ZmfKd+KUq34KojhNJ4DepKStTq074
+BRDXVivx+wVD951LFNPiQXq+mgHcLj1k37KlZflTFhdP5oEMtATNsXNJPHlEymiy
+SogRWAmKhysLQudukHfNKN+r0FEQMk/hzpYcFeZSOvbfNQIDAQABo1AwTjAdBgNV
+HQ4EFgQURWMbWvBKZwJvRV1/tyc1R82k0+gwHwYDVR0jBBgwFoAURWMbWvBKZwJv
+RV1/tyc1R82k0+gwDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAQEAkPF+
+ysVtvHnk2hpu9yNDLCJ96ZzIoKOyY7uRj4ovzlAHFdpNOJQdcJihTmN8i7Trht9X
+Vh0rGoR/6nHzo3TIeiogRC80RlDtuA3PF2dDQBMVDStlZMTZPb693hfjdAjhyyw9
+yghhKHHqNDvSsAL0KfBqjG4yGfGpJylYXIT5fWuKlo/ln/yyPa5s54T5XDo+CMbt
+lLX3QnwVOmaRyzylPiTcPCDIkdLBdXmlfyJcmW6fWa6kPx+35MOxPsXZbujCo+42
++OyLqcH1rKT6XhcshjXBEf+kdgUfSClrM1pNRWsw2ChIYim0F+nry5JFy0Y+8Hbb
+6SDB340BFmtgDHbFHTGCApEwggKNAgEBMGkwXDELMAkGA1UEBhMCTkwxEzARBgNV
+BAgMClNvbWUtU3RhdGUxHzAdBgNVBAoMFkFETElOSyBUZWNobm9sb2N5IEluYy4x
+FzAVBgNVBAMMDmFkbGlua3RlY2guY29tAgkA2yveybQ2vKkwDQYJYIZIAWUDBAIB
+BQCggfowGAYJKoZIhvcNAQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG9w0BCQUxDxcN
+MTkwMzI5MTMwODAzWjAvBgkqhkiG9w0BCQQxIgQghoicue+FOmdIHF9rpsNCfmjP
++ZyN+t9kCdmR68JCJU0wgY4GCSqGSIb3DQEJDzGBgDB+MAsGCWCGSAFlAwQBKjAI
+BgYqhQMCAgkwCAYGKoUDAgIVMAsGCWCGSAFlAwQBFjALBglghkgBZQMEAQIwCgYI
+KoZIhvcNAwcwDgYIKoZIhvcNAwICAgCAMA0GCCqGSIb3DQMCAgFAMAcGBSsOAwIH
+MA0GCCqGSIb3DQMCAgEoMA0GCSqGSIb3DQEBAQUABIIBAI0BX2tu2DbQjvuzKG35
+myNBcOC9ZzRDqJEtmQhcY/2hAJzurlnclJVTEXFyXdpV4ywtA+lQvbtToh11AvnY
+IY1QWNVm19mfO1J6m6PFu18tizd30sG7p1TZKxGB3zDeVVqmedZ+o7QJHv9/ixzz
+Pyo2B9tG5Su94+ADc0LQNyGICjeMr7L6dhFDsm7fXBi8pMBKy/zEAynTA3r1ibsn
+5zlizPMlad2HCaYv44x7Xksg9FSbzJwJpTiprbQbZSUPYk4WlfVz0l4plzRKu4AP
+lCOsdRE6C6GQFnK5bLyndu3Ycp10niwfkfobruCDyigu+gjZtmmF/T7A8Xkk1uvx
+fAM=
+
+------62BE4CE8CF1FCB0420A2F2884B1618E6--
+
diff --git a/src/security/builtin_plugins/tests/validate_local_permissions/etc/Test_Permissions_invalid_data.xml b/src/security/builtin_plugins/tests/validate_local_permissions/etc/Test_Permissions_invalid_data.xml
new file mode 100644
index 0000000..5ebb397
--- /dev/null
+++ b/src/security/builtin_plugins/tests/validate_local_permissions/etc/Test_Permissions_invalid_data.xml
@@ -0,0 +1,167 @@
+<?xml version="1.0" encoding="utf-8"?>
+<dds xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xsi:noNamespaceSchemaLocation="https://www.omg.org/spec/DDS-SECURITY/20170901/omg_shared_ca_permissions.xsd">
+    <permissions>
+        <grant name="OpenSplicePermissions">
+            <subject_name>CN=CHAM500 cert,O=Internet Widgits Pty Ltd,ST=Some-State,C=NL</subject_name>
+            <validity>
+                <!-- Format is CCYY-MM-DDThh:mm:ss[Z|(+|-)hh:mm] in GMT -->
+                <not_before>2015-09-15T01:00:00</not_before>
+                <not_after>2115-09-15T01:00:00</not_after>
+            </validity>
+            <allow_rule>
+                <domains>
+                    <id_range>
+                        <min>0</min>
+                        <max>430</max>
+                    </id_range>
+                </domains>
+                <publish>
+                    <topics>
+                        <topic>K*</topic>
+                        <topic>*OldMessage</topic>
+                        <topic>OldMessanger</topic>
+                        <topic>NewMessage</topic>
+                    </topics>
+		    <partitions>
+			<partition>Apart</partition>
+			<partition>Bpa?t*</partition>
+		    </partitions>
+                </publish>
+                <subscribe>
+                    <topics>
+                        <topic>K*</topic>
+                        <topic>*OldMessage</topic>
+                        <topic>OldMessanger</topic>
+                        <topic>NewMessage</topic>
+                    </topics>
+		    <partitions>
+			<partition>Apart</partition>
+			<partition>Bpa?t*</partition>
+		    </partitions>
+                </subscribe>
+            </allow_rule>
+            <deny_rule>
+                <domains>
+                    <id_range>
+                        <min>0</min>
+                        <max>230</max>
+                    </id_range>
+                </domains>
+                <publish>
+                    <topics>
+                        <topic>P*</topic>
+                        <topic>*WrongMessage</topic>
+                        <topic>FakeMessanger</topic>
+                        <topic>ChangedMessage</topic>
+                    </topics>
+		    <partitions>
+			<partition>Apart</partition>
+			<partition>Bpa?t*</partition>
+		    </partitions>
+                </publish>
+                <subscribe>
+                    <topics>
+                        <topic>P*</topic>
+                        <topic>*WrongMessage</topic>
+                        <topic>FakeMessanger</topic>
+                        <topic>ChangedMessage</topic>
+                    </topics>
+		    <partitions>
+			<partition>Apart</partition>
+			<partition>Bpa?t*</partition>
+		    </partitions>
+                </subscribe>
+            </deny_rule>
+
+            <default>DENY</default>
+        </grant>
+        <grant name="SpareNodeOpenSplicePermissions">
+            <subject_name>CN=CHAM500 cert,O=Internet Widgits Pty Ltd,ST=Some-State,C=NL</subject_name>
+            <validity>
+                <!-- Format is CCYY-MM-DDThh:mm:ss[Z|(+|-)hh:mm] in GMT -->
+                <not_before>2015-09-15T01:00:00</not_before>
+                <not_after>2115-09-15T01:00:00</not_after>
+            </validity>
+            <allow_rule>
+                <domains>
+                <!-- All domains -->
+                 <id>20</id>
+                 <id>30</id>
+                 <id_range>
+                     <min>0</min>
+                     <max>23</max>
+                 </id_range>
+                 <id_range>
+                     <min>100</min>
+                     <max>120</max>
+                 </id_range>
+                 <id>200</id>
+               </domains>
+                <publish>
+                    <topics>
+                        <topic>K*</topic>
+                        <topic>*OldMessage</topic>
+                        <topic>OldMessanger</topic>
+                        <topic>NewMessage</topic>
+                    </topics>
+		    <partitions>
+			<partition>Apart</partition>
+			<partition>Bpa?t*</partition>
+		    </partitions>
+                </publish>
+                <subscribe>
+                    <topics>
+                        <topic>K*</topic>
+                        <topic>*OldMessage</topic>
+                        <topic>OldMessanger</topic>
+                        <topic>NewMessage</topic>
+                    </topics>
+		    <partitions>
+			<partition>Apart</partition>
+			<partition>Bpa?t*</partition>
+		    </partitions>
+                </subscribe>
+            </allow_rule>
+            <deny_rule>
+                <domains>
+                 <id_range>
+                     <min>0</min>
+                     <max>23</max>
+                 </id_range>
+                 <id_range>
+                     <min>100</min>
+                     <max>120</max>
+                 </id_range>
+                 <id>200</id>
+                </domains>
+                <publish>
+                    <topics>
+                        <topic>P*</topic>
+                        <topic>*WrongMessage</topic>
+                        <topic>FakeMessanger</topic>
+                        <topic>ChangedMessage</topic>
+                    </topics>
+		    <partitions>
+			<partition>Apart</partition>
+			<partition>Bpa?t*</partition>
+		    </partitions>
+                </publish>
+                <subscribe>
+                    <topics>
+                        <topic>P*</topic>
+                        <topic>*WrongMessage</topic>
+                        <topic>FakeMessanger</topic>
+                        <topic>ChangedMessage</topic>
+                    </topics>
+		    <partitions>
+			<partition>Apart</partition>
+			<partition>Bpa?t*</partition>
+		    </partitions>
+                </subscribe>
+            </deny_rule>
+
+            <default>DENY</default>
+        </grant>
+    </permissions>
+</dds>
diff --git a/src/security/builtin_plugins/tests/validate_local_permissions/etc/Test_Permissions_invalid_element.p7s b/src/security/builtin_plugins/tests/validate_local_permissions/etc/Test_Permissions_invalid_element.p7s
new file mode 100644
index 0000000..521f4cf
--- /dev/null
+++ b/src/security/builtin_plugins/tests/validate_local_permissions/etc/Test_Permissions_invalid_element.p7s
@@ -0,0 +1,219 @@
+MIME-Version: 1.0
+Content-Type: multipart/signed; protocol="application/x-pkcs7-signature"; micalg="sha-256"; boundary="----3EE420429594FF1492D49B1EEBFBAF0E"
+
+This is an S/MIME signed message
+
+------3EE420429594FF1492D49B1EEBFBAF0E
+Content-Type: text/plain
+
+<?xml version="1.0" encoding="utf-8"?>
+<dds xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xsi:noNamespaceSchemaLocation="https://www.omg.org/spec/DDS-SECURITY/20170901/omg_shared_ca_permissions.xsd">
+    <permissions>
+        <grant name="OpenSplicePermissions">
+            <subject_name>CN=CHAM500 cert,O=Internet Widgits Pty Ltd,ST=Some-State,C=NL</subject_name>
+            <validity>
+                <!-- Format is CCYY-MM-DDThh:mm:ss[Z|(+|-)hh:mm] in GMT -->
+                <not_before>2015-09-15T01:00:00</not_before>
+                <not_after>2115-09-15T01:00:00</not_after>
+            </validity>
+            <allow_rule>
+                <domains>
+                    <id_range>
+                        <min>0</min>
+                        <max>230</max>
+                    </id_range>
+                </domains>
+                <ufo>
+                    <topics>
+                        <topic>K*</topic>
+                        <topic>*OldMessage</topic>
+                        <topic>OldMessanger</topic>
+                        <topic>NewMessage</topic>
+                    </topics>
+		    <partitions>
+			<partition>Apart</partition>
+			<partition>Bpa?t*</partition>
+		    </partitions>
+                </ufo>
+                <subscribe>
+                    <topics>
+                        <topic>K*</topic>
+                        <topic>*OldMessage</topic>
+                        <topic>OldMessanger</topic>
+                        <topic>NewMessage</topic>
+                    </topics>
+		    <partitions>
+			<partition>Apart</partition>
+			<partition>Bpa?t*</partition>
+		    </partitions>
+                </subscribe>
+            </allow_rule>
+            <deny_rule>
+                <domains>
+                    <id_range>
+                        <min>0</min>
+                        <max>230</max>
+                    </id_range>
+                </domains>
+                <publish>
+                    <topics>
+                        <topic>P*</topic>
+                        <topic>*WrongMessage</topic>
+                        <topic>FakeMessanger</topic>
+                        <topic>ChangedMessage</topic>
+                    </topics>
+		    <partitions>
+			<partition>Apart</partition>
+			<partition>Bpa?t*</partition>
+		    </partitions>
+                </publish>
+                <subscribe>
+                    <topics>
+                        <topic>P*</topic>
+                        <topic>*WrongMessage</topic>
+                        <topic>FakeMessanger</topic>
+                        <topic>ChangedMessage</topic>
+                    </topics>
+		    <partitions>
+			<partition>Apart</partition>
+			<partition>Bpa?t*</partition>
+		    </partitions>
+                </subscribe>
+            </deny_rule>
+
+            <default>DENY</default>
+        </grant>
+        <grant name="SpareNodeOpenSplicePermissions">
+            <subject_name>CN=CHAM500 cert,O=Internet Widgits Pty Ltd,ST=Some-State,C=NL</subject_name>
+            <validity>
+                <!-- Format is CCYY-MM-DDThh:mm:ss[Z|(+|-)hh:mm] in GMT -->
+                <not_before>2015-09-15T01:00:00</not_before>
+                <not_after>2115-09-15T01:00:00</not_after>
+            </validity>
+            <allow_rule>
+                <domains>
+                <!-- All domains -->
+                 <id>20</id>
+                 <id>30</id>
+                 <id_range>
+                     <min>0</min>
+                     <max>23</max>
+                 </id_range>
+                 <id_range>
+                     <min>100</min>
+                     <max>120</max>
+                 </id_range>
+                 <id>200</id>
+               </domains>
+                <publish>
+                    <topics>
+                        <topic>K*</topic>
+                        <topic>*OldMessage</topic>
+                        <topic>OldMessanger</topic>
+                        <topic>NewMessage</topic>
+                    </topics>
+		    <partitions>
+			<partition>Apart</partition>
+			<partition>Bpa?t*</partition>
+		    </partitions>
+                </publish>
+                <subscribe>
+                    <topics>
+                        <topic>K*</topic>
+                        <topic>*OldMessage</topic>
+                        <topic>OldMessanger</topic>
+                        <topic>NewMessage</topic>
+                    </topics>
+		    <partitions>
+			<partition>Apart</partition>
+			<partition>Bpa?t*</partition>
+		    </partitions>
+                </subscribe>
+            </allow_rule>
+            <deny_rule>
+                <domains>
+                 <id_range>
+                     <min>0</min>
+                     <max>23</max>
+                 </id_range>
+                 <id_range>
+                     <min>100</min>
+                     <max>120</max>
+                 </id_range>
+                 <id>200</id>
+                </domains>
+                <publish>
+                    <topics>
+                        <topic>P*</topic>
+                        <topic>*WrongMessage</topic>
+                        <topic>FakeMessanger</topic>
+                        <topic>ChangedMessage</topic>
+                    </topics>
+		    <partitions>
+			<partition>Apart</partition>
+			<partition>Bpa?t*</partition>
+		    </partitions>
+                </publish>
+                <subscribe>
+                    <topics>
+                        <topic>P*</topic>
+                        <topic>*WrongMessage</topic>
+                        <topic>FakeMessanger</topic>
+                        <topic>ChangedMessage</topic>
+                    </topics>
+		    <partitions>
+			<partition>Apart</partition>
+			<partition>Bpa?t*</partition>
+		    </partitions>
+                </subscribe>
+            </deny_rule>
+
+            <default>DENY</default>
+        </grant>
+    </permissions>
+</dds>
+
+------3EE420429594FF1492D49B1EEBFBAF0E
+Content-Type: application/x-pkcs7-signature; name="smime.p7s"
+Content-Transfer-Encoding: base64
+Content-Disposition: attachment; filename="smime.p7s"
+
+MIIGXgYJKoZIhvcNAQcCoIIGTzCCBksCAQExDzANBglghkgBZQMEAgEFADALBgkq
+hkiG9w0BBwGgggORMIIDjTCCAnWgAwIBAgIJANsr3sm0NrypMA0GCSqGSIb3DQEB
+CwUAMFwxCzAJBgNVBAYTAk5MMRMwEQYDVQQIDApTb21lLVN0YXRlMR8wHQYDVQQK
+DBZBRExJTksgVGVjaG5vbG9jeSBJbmMuMRcwFQYDVQQDDA5hZGxpbmt0ZWNoLmNv
+bTAgFw0xODA3MzAxMjQ1NTVaGA8yMTE4MDcwNjEyNDU1NVowXDELMAkGA1UEBhMC
+TkwxEzARBgNVBAgMClNvbWUtU3RhdGUxHzAdBgNVBAoMFkFETElOSyBUZWNobm9s
+b2N5IEluYy4xFzAVBgNVBAMMDmFkbGlua3RlY2guY29tMIIBIjANBgkqhkiG9w0B
+AQEFAAOCAQ8AMIIBCgKCAQEAu7jfnJ0wYVuXgG+PgNawdN38+dRpa8jceqi+blID
+ehV6XCxrnGXusTCDuFmo7HMOBVMVNDXlcBWgoGd+u5EultnOEiIeGTgtHc1O6V9w
+icp3BGSpZZax/TcONjMVORaqHCADbQ2J8wsz1FHxuKDwX6BJElYOlK77lb/x3yLs
+DFFC+a0qn2RFh37rcWBRAHy8VEASXKZElT9ZmfKd+KUq34KojhNJ4DepKStTq074
+BRDXVivx+wVD951LFNPiQXq+mgHcLj1k37KlZflTFhdP5oEMtATNsXNJPHlEymiy
+SogRWAmKhysLQudukHfNKN+r0FEQMk/hzpYcFeZSOvbfNQIDAQABo1AwTjAdBgNV
+HQ4EFgQURWMbWvBKZwJvRV1/tyc1R82k0+gwHwYDVR0jBBgwFoAURWMbWvBKZwJv
+RV1/tyc1R82k0+gwDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAQEAkPF+
+ysVtvHnk2hpu9yNDLCJ96ZzIoKOyY7uRj4ovzlAHFdpNOJQdcJihTmN8i7Trht9X
+Vh0rGoR/6nHzo3TIeiogRC80RlDtuA3PF2dDQBMVDStlZMTZPb693hfjdAjhyyw9
+yghhKHHqNDvSsAL0KfBqjG4yGfGpJylYXIT5fWuKlo/ln/yyPa5s54T5XDo+CMbt
+lLX3QnwVOmaRyzylPiTcPCDIkdLBdXmlfyJcmW6fWa6kPx+35MOxPsXZbujCo+42
++OyLqcH1rKT6XhcshjXBEf+kdgUfSClrM1pNRWsw2ChIYim0F+nry5JFy0Y+8Hbb
+6SDB340BFmtgDHbFHTGCApEwggKNAgEBMGkwXDELMAkGA1UEBhMCTkwxEzARBgNV
+BAgMClNvbWUtU3RhdGUxHzAdBgNVBAoMFkFETElOSyBUZWNobm9sb2N5IEluYy4x
+FzAVBgNVBAMMDmFkbGlua3RlY2guY29tAgkA2yveybQ2vKkwDQYJYIZIAWUDBAIB
+BQCggfowGAYJKoZIhvcNAQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG9w0BCQUxDxcN
+MTkwMzI5MTMwODAzWjAvBgkqhkiG9w0BCQQxIgQgk4Y6Rw4+DVfETNs8Ddv6rnhK
+w7EwwZ9nE7SiujxSsDEwgY4GCSqGSIb3DQEJDzGBgDB+MAsGCWCGSAFlAwQBKjAI
+BgYqhQMCAgkwCAYGKoUDAgIVMAsGCWCGSAFlAwQBFjALBglghkgBZQMEAQIwCgYI
+KoZIhvcNAwcwDgYIKoZIhvcNAwICAgCAMA0GCCqGSIb3DQMCAgFAMAcGBSsOAwIH
+MA0GCCqGSIb3DQMCAgEoMA0GCSqGSIb3DQEBAQUABIIBAGkiiP+V49XZIwqbpqwN
+RHv0tn06/BAuRGNybse1GkVzlNmuwbGObUUpKtKh4VxN8XuTfH5uuLEqftN2LvGG
+zEiyosHX0gjsX6hihqoIcbfdsKpxd/OPCr/iNdOKWCSyV0aqaP3fc9Y2L1xVdXfn
+avjfd8wief+ERfwKlsbHYsgh6/zwhVeMt2mzr8T0c+ICC99+XXmSvpnGJ89amYub
+NnQwdxTp4PBQhudXixG3LrZ1CZafoLRz+x9vEIVF9oFyy7kMkeFtjd7aXc346Ama
+djOu1LtzvWZKOMeGYVaSiQMl4HhpOh/embx+AClH/Hf1o7AA+ivF8vZgUDAAK2GD
+rx8=
+
+------3EE420429594FF1492D49B1EEBFBAF0E--
+
diff --git a/src/security/builtin_plugins/tests/validate_local_permissions/etc/Test_Permissions_invalid_element.xml b/src/security/builtin_plugins/tests/validate_local_permissions/etc/Test_Permissions_invalid_element.xml
new file mode 100644
index 0000000..6f38953
--- /dev/null
+++ b/src/security/builtin_plugins/tests/validate_local_permissions/etc/Test_Permissions_invalid_element.xml
@@ -0,0 +1,167 @@
+<?xml version="1.0" encoding="utf-8"?>
+<dds xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xsi:noNamespaceSchemaLocation="https://www.omg.org/spec/DDS-SECURITY/20170901/omg_shared_ca_permissions.xsd">
+    <permissions>
+        <grant name="OpenSplicePermissions">
+            <subject_name>CN=CHAM500 cert,O=Internet Widgits Pty Ltd,ST=Some-State,C=NL</subject_name>
+            <validity>
+                <!-- Format is CCYY-MM-DDThh:mm:ss[Z|(+|-)hh:mm] in GMT -->
+                <not_before>2015-09-15T01:00:00</not_before>
+                <not_after>2115-09-15T01:00:00</not_after>
+            </validity>
+            <allow_rule>
+                <domains>
+                    <id_range>
+                        <min>0</min>
+                        <max>230</max>
+                    </id_range>
+                </domains>
+                <ufo>
+                    <topics>
+                        <topic>K*</topic>
+                        <topic>*OldMessage</topic>
+                        <topic>OldMessanger</topic>
+                        <topic>NewMessage</topic>
+                    </topics>
+		    <partitions>
+			<partition>Apart</partition>
+			<partition>Bpa?t*</partition>
+		    </partitions>
+                </ufo>
+                <subscribe>
+                    <topics>
+                        <topic>K*</topic>
+                        <topic>*OldMessage</topic>
+                        <topic>OldMessanger</topic>
+                        <topic>NewMessage</topic>
+                    </topics>
+		    <partitions>
+			<partition>Apart</partition>
+			<partition>Bpa?t*</partition>
+		    </partitions>
+                </subscribe>
+            </allow_rule>
+            <deny_rule>
+                <domains>
+                    <id_range>
+                        <min>0</min>
+                        <max>230</max>
+                    </id_range>
+                </domains>
+                <publish>
+                    <topics>
+                        <topic>P*</topic>
+                        <topic>*WrongMessage</topic>
+                        <topic>FakeMessanger</topic>
+                        <topic>ChangedMessage</topic>
+                    </topics>
+		    <partitions>
+			<partition>Apart</partition>
+			<partition>Bpa?t*</partition>
+		    </partitions>
+                </publish>
+                <subscribe>
+                    <topics>
+                        <topic>P*</topic>
+                        <topic>*WrongMessage</topic>
+                        <topic>FakeMessanger</topic>
+                        <topic>ChangedMessage</topic>
+                    </topics>
+		    <partitions>
+			<partition>Apart</partition>
+			<partition>Bpa?t*</partition>
+		    </partitions>
+                </subscribe>
+            </deny_rule>
+
+            <default>DENY</default>
+        </grant>
+        <grant name="SpareNodeOpenSplicePermissions">
+            <subject_name>CN=CHAM500 cert,O=Internet Widgits Pty Ltd,ST=Some-State,C=NL</subject_name>
+            <validity>
+                <!-- Format is CCYY-MM-DDThh:mm:ss[Z|(+|-)hh:mm] in GMT -->
+                <not_before>2015-09-15T01:00:00</not_before>
+                <not_after>2115-09-15T01:00:00</not_after>
+            </validity>
+            <allow_rule>
+                <domains>
+                <!-- All domains -->
+                 <id>20</id>
+                 <id>30</id>
+                 <id_range>
+                     <min>0</min>
+                     <max>23</max>
+                 </id_range>
+                 <id_range>
+                     <min>100</min>
+                     <max>120</max>
+                 </id_range>
+                 <id>200</id>
+               </domains>
+                <publish>
+                    <topics>
+                        <topic>K*</topic>
+                        <topic>*OldMessage</topic>
+                        <topic>OldMessanger</topic>
+                        <topic>NewMessage</topic>
+                    </topics>
+		    <partitions>
+			<partition>Apart</partition>
+			<partition>Bpa?t*</partition>
+		    </partitions>
+                </publish>
+                <subscribe>
+                    <topics>
+                        <topic>K*</topic>
+                        <topic>*OldMessage</topic>
+                        <topic>OldMessanger</topic>
+                        <topic>NewMessage</topic>
+                    </topics>
+		    <partitions>
+			<partition>Apart</partition>
+			<partition>Bpa?t*</partition>
+		    </partitions>
+                </subscribe>
+            </allow_rule>
+            <deny_rule>
+                <domains>
+                 <id_range>
+                     <min>0</min>
+                     <max>23</max>
+                 </id_range>
+                 <id_range>
+                     <min>100</min>
+                     <max>120</max>
+                 </id_range>
+                 <id>200</id>
+                </domains>
+                <publish>
+                    <topics>
+                        <topic>P*</topic>
+                        <topic>*WrongMessage</topic>
+                        <topic>FakeMessanger</topic>
+                        <topic>ChangedMessage</topic>
+                    </topics>
+		    <partitions>
+			<partition>Apart</partition>
+			<partition>Bpa?t*</partition>
+		    </partitions>
+                </publish>
+                <subscribe>
+                    <topics>
+                        <topic>P*</topic>
+                        <topic>*WrongMessage</topic>
+                        <topic>FakeMessanger</topic>
+                        <topic>ChangedMessage</topic>
+                    </topics>
+		    <partitions>
+			<partition>Apart</partition>
+			<partition>Bpa?t*</partition>
+		    </partitions>
+                </subscribe>
+            </deny_rule>
+
+            <default>DENY</default>
+        </grant>
+    </permissions>
+</dds>
diff --git a/src/security/builtin_plugins/tests/validate_local_permissions/etc/Test_Permissions_lack_of_not_after.p7s b/src/security/builtin_plugins/tests/validate_local_permissions/etc/Test_Permissions_lack_of_not_after.p7s
new file mode 100644
index 0000000..804f556
--- /dev/null
+++ b/src/security/builtin_plugins/tests/validate_local_permissions/etc/Test_Permissions_lack_of_not_after.p7s
@@ -0,0 +1,95 @@
+MIME-Version: 1.0
+Content-Type: multipart/signed; protocol="application/x-pkcs7-signature"; micalg="sha-256"; boundary="----E9994989EF5BC12DCCE6563CF088037D"
+
+This is an S/MIME signed message
+
+------E9994989EF5BC12DCCE6563CF088037D
+Content-Type: text/plain
+
+<?xml version="1.0" encoding="utf-8"?>
+<dds xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xsi:noNamespaceSchemaLocation="https://www.omg.org/spec/DDS-SECURITY/20170901/omg_shared_ca_permissions.xsd">
+    <permissions>
+        <grant name="OpenSplicePermissions">
+            <subject_name>/O=Internet Widgits Pty Ltd/ST=Some-State/C=NL/CN=CHAM500 cert</subject_name>
+            <validity>
+                <!-- Format is CCYY-MM-DDThh:mm:ss[Z|(+|-)hh:mm] in GMT -->
+                <not_before>2015-09-15T01:00:00</not_before>
+            </validity>
+            <allow_rule>
+                <domains>
+                    <id_range>
+                        <min>0</min>
+                        <max>230</max>
+                    </id_range>
+                </domains>
+                <publish>
+                    <topics>
+                        <topic>K*</topic>
+                        <topic>*OldMessage</topic>
+                        <topic>OldMessanger</topic>
+                        <topic>NewMessage</topic>
+                    </topics>
+        <partitions>
+      <partition>Apart</partition>
+      <partition>Bpa?t*</partition>
+        </partitions>
+                </publish>
+                <subscribe>
+                    <topics>
+                        <topic>K*</topic>
+                        <topic>*OldMessage</topic>
+                        <topic>OldMessanger</topic>
+                        <topic>NewMessage</topic>
+                    </topics>
+                </subscribe>
+            </allow_rule>
+
+            <default>ALLOW</default>
+        </grant>
+    </permissions>
+</dds>
+
+------E9994989EF5BC12DCCE6563CF088037D
+Content-Type: application/x-pkcs7-signature; name="smime.p7s"
+Content-Transfer-Encoding: base64
+Content-Disposition: attachment; filename="smime.p7s"
+
+MIIGXgYJKoZIhvcNAQcCoIIGTzCCBksCAQExDzANBglghkgBZQMEAgEFADALBgkq
+hkiG9w0BBwGgggORMIIDjTCCAnWgAwIBAgIJANsr3sm0NrypMA0GCSqGSIb3DQEB
+CwUAMFwxCzAJBgNVBAYTAk5MMRMwEQYDVQQIDApTb21lLVN0YXRlMR8wHQYDVQQK
+DBZBRExJTksgVGVjaG5vbG9jeSBJbmMuMRcwFQYDVQQDDA5hZGxpbmt0ZWNoLmNv
+bTAgFw0xODA3MzAxMjQ1NTVaGA8yMTE4MDcwNjEyNDU1NVowXDELMAkGA1UEBhMC
+TkwxEzARBgNVBAgMClNvbWUtU3RhdGUxHzAdBgNVBAoMFkFETElOSyBUZWNobm9s
+b2N5IEluYy4xFzAVBgNVBAMMDmFkbGlua3RlY2guY29tMIIBIjANBgkqhkiG9w0B
+AQEFAAOCAQ8AMIIBCgKCAQEAu7jfnJ0wYVuXgG+PgNawdN38+dRpa8jceqi+blID
+ehV6XCxrnGXusTCDuFmo7HMOBVMVNDXlcBWgoGd+u5EultnOEiIeGTgtHc1O6V9w
+icp3BGSpZZax/TcONjMVORaqHCADbQ2J8wsz1FHxuKDwX6BJElYOlK77lb/x3yLs
+DFFC+a0qn2RFh37rcWBRAHy8VEASXKZElT9ZmfKd+KUq34KojhNJ4DepKStTq074
+BRDXVivx+wVD951LFNPiQXq+mgHcLj1k37KlZflTFhdP5oEMtATNsXNJPHlEymiy
+SogRWAmKhysLQudukHfNKN+r0FEQMk/hzpYcFeZSOvbfNQIDAQABo1AwTjAdBgNV
+HQ4EFgQURWMbWvBKZwJvRV1/tyc1R82k0+gwHwYDVR0jBBgwFoAURWMbWvBKZwJv
+RV1/tyc1R82k0+gwDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAQEAkPF+
+ysVtvHnk2hpu9yNDLCJ96ZzIoKOyY7uRj4ovzlAHFdpNOJQdcJihTmN8i7Trht9X
+Vh0rGoR/6nHzo3TIeiogRC80RlDtuA3PF2dDQBMVDStlZMTZPb693hfjdAjhyyw9
+yghhKHHqNDvSsAL0KfBqjG4yGfGpJylYXIT5fWuKlo/ln/yyPa5s54T5XDo+CMbt
+lLX3QnwVOmaRyzylPiTcPCDIkdLBdXmlfyJcmW6fWa6kPx+35MOxPsXZbujCo+42
++OyLqcH1rKT6XhcshjXBEf+kdgUfSClrM1pNRWsw2ChIYim0F+nry5JFy0Y+8Hbb
+6SDB340BFmtgDHbFHTGCApEwggKNAgEBMGkwXDELMAkGA1UEBhMCTkwxEzARBgNV
+BAgMClNvbWUtU3RhdGUxHzAdBgNVBAoMFkFETElOSyBUZWNobm9sb2N5IEluYy4x
+FzAVBgNVBAMMDmFkbGlua3RlY2guY29tAgkA2yveybQ2vKkwDQYJYIZIAWUDBAIB
+BQCggfowGAYJKoZIhvcNAQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG9w0BCQUxDxcN
+MTkwMzI5MTMwODAzWjAvBgkqhkiG9w0BCQQxIgQgVn6yZWB0OOqW+6/ubhU1M4pT
+tL+lh8qj9izsf/c3gKMwgY4GCSqGSIb3DQEJDzGBgDB+MAsGCWCGSAFlAwQBKjAI
+BgYqhQMCAgkwCAYGKoUDAgIVMAsGCWCGSAFlAwQBFjALBglghkgBZQMEAQIwCgYI
+KoZIhvcNAwcwDgYIKoZIhvcNAwICAgCAMA0GCCqGSIb3DQMCAgFAMAcGBSsOAwIH
+MA0GCCqGSIb3DQMCAgEoMA0GCSqGSIb3DQEBAQUABIIBAKhwx+Ew2m6lHQxL0I0K
+Z0fdN8+19XGKYPWNuGwDR5MYpMX5jin/w/FgzeG5gSHqB51PRLJjH81incNVcRCf
+bRKvwOv8b4J8D14ZG28SoNCsKejbXccFuA967ir+GHYrh0V9ikM/TwPuhosxclM5
+hZQuvRKig6Fum+PmGO7sLNyIPB1ODE8gbz0IiY9l6Zlp0xEe/+4YYpBL+GKamnlS
+boRrfgGaTaWWi9EnjZWmJkFBO9vC08XZQ1akCubC0G8Kki0X3ZXJVXkX3AxjvZJY
+XDdstpKWbfqlWzkYlJSI/I96BO2ZXY7nnsQU+8tvPV/6k6BaC80m0FhoTQJfDdLR
+WnA=
+
+------E9994989EF5BC12DCCE6563CF088037D--
+
diff --git a/src/security/builtin_plugins/tests/validate_local_permissions/etc/Test_Permissions_lack_of_not_after.xml b/src/security/builtin_plugins/tests/validate_local_permissions/etc/Test_Permissions_lack_of_not_after.xml
new file mode 100644
index 0000000..27e5fb9
--- /dev/null
+++ b/src/security/builtin_plugins/tests/validate_local_permissions/etc/Test_Permissions_lack_of_not_after.xml
@@ -0,0 +1,43 @@
+<?xml version="1.0" encoding="utf-8"?>
+<dds xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xsi:noNamespaceSchemaLocation="https://www.omg.org/spec/DDS-SECURITY/20170901/omg_shared_ca_permissions.xsd">
+    <permissions>
+        <grant name="OpenSplicePermissions">
+            <subject_name>/O=Internet Widgits Pty Ltd/ST=Some-State/C=NL/CN=CHAM500 cert</subject_name>
+            <validity>
+                <!-- Format is CCYY-MM-DDThh:mm:ss[Z|(+|-)hh:mm] in GMT -->
+                <not_before>2015-09-15T01:00:00</not_before>
+            </validity>
+            <allow_rule>
+                <domains>
+                    <id_range>
+                        <min>0</min>
+                        <max>230</max>
+                    </id_range>
+                </domains>
+                <publish>
+                    <topics>
+                        <topic>K*</topic>
+                        <topic>*OldMessage</topic>
+                        <topic>OldMessanger</topic>
+                        <topic>NewMessage</topic>
+                    </topics>
+        <partitions>
+      <partition>Apart</partition>
+      <partition>Bpa?t*</partition>
+        </partitions>
+                </publish>
+                <subscribe>
+                    <topics>
+                        <topic>K*</topic>
+                        <topic>*OldMessage</topic>
+                        <topic>OldMessanger</topic>
+                        <topic>NewMessage</topic>
+                    </topics>
+                </subscribe>
+            </allow_rule>
+
+            <default>ALLOW</default>
+        </grant>
+    </permissions>
+</dds>
diff --git a/src/security/builtin_plugins/tests/validate_local_permissions/etc/Test_Permissions_lack_of_not_before.p7s b/src/security/builtin_plugins/tests/validate_local_permissions/etc/Test_Permissions_lack_of_not_before.p7s
new file mode 100644
index 0000000..a21bac6
--- /dev/null
+++ b/src/security/builtin_plugins/tests/validate_local_permissions/etc/Test_Permissions_lack_of_not_before.p7s
@@ -0,0 +1,95 @@
+MIME-Version: 1.0
+Content-Type: multipart/signed; protocol="application/x-pkcs7-signature"; micalg="sha-256"; boundary="----E0088C6C0B487BC746E35E87718DA89E"
+
+This is an S/MIME signed message
+
+------E0088C6C0B487BC746E35E87718DA89E
+Content-Type: text/plain
+
+<?xml version="1.0" encoding="utf-8"?>
+<dds xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xsi:noNamespaceSchemaLocation="https://www.omg.org/spec/DDS-SECURITY/20170901/omg_shared_ca_permissions.xsd">
+    <permissions>
+        <grant name="OpenSplicePermissions">
+            <subject_name>/O=Internet Widgits Pty Ltd/ST=Some-State/C=NL/CN=CHAM500 cert</subject_name>
+            <validity>
+                <!-- Format is CCYY-MM-DDThh:mm:ss[Z|(+|-)hh:mm] in GMT -->
+                <not_after>2115-09-15T01:00:00</not_after>
+            </validity>
+            <allow_rule>
+                <domains>
+                    <id_range>
+                        <min>0</min>
+                        <max>230</max>
+                    </id_range>
+                </domains>
+                <publish>
+                    <topics>
+                        <topic>K*</topic>
+                        <topic>*OldMessage</topic>
+                        <topic>OldMessanger</topic>
+                        <topic>NewMessage</topic>
+                    </topics>
+        <partitions>
+      <partition>Apart</partition>
+      <partition>Bpa?t*</partition>
+        </partitions>
+                </publish>
+                <subscribe>
+                    <topics>
+                        <topic>K*</topic>
+                        <topic>*OldMessage</topic>
+                        <topic>OldMessanger</topic>
+                        <topic>NewMessage</topic>
+                    </topics>
+                </subscribe>
+            </allow_rule>
+
+            <default>ALLOW</default>
+        </grant>
+    </permissions>
+</dds>
+
+------E0088C6C0B487BC746E35E87718DA89E
+Content-Type: application/x-pkcs7-signature; name="smime.p7s"
+Content-Transfer-Encoding: base64
+Content-Disposition: attachment; filename="smime.p7s"
+
+MIIGXgYJKoZIhvcNAQcCoIIGTzCCBksCAQExDzANBglghkgBZQMEAgEFADALBgkq
+hkiG9w0BBwGgggORMIIDjTCCAnWgAwIBAgIJANsr3sm0NrypMA0GCSqGSIb3DQEB
+CwUAMFwxCzAJBgNVBAYTAk5MMRMwEQYDVQQIDApTb21lLVN0YXRlMR8wHQYDVQQK
+DBZBRExJTksgVGVjaG5vbG9jeSBJbmMuMRcwFQYDVQQDDA5hZGxpbmt0ZWNoLmNv
+bTAgFw0xODA3MzAxMjQ1NTVaGA8yMTE4MDcwNjEyNDU1NVowXDELMAkGA1UEBhMC
+TkwxEzARBgNVBAgMClNvbWUtU3RhdGUxHzAdBgNVBAoMFkFETElOSyBUZWNobm9s
+b2N5IEluYy4xFzAVBgNVBAMMDmFkbGlua3RlY2guY29tMIIBIjANBgkqhkiG9w0B
+AQEFAAOCAQ8AMIIBCgKCAQEAu7jfnJ0wYVuXgG+PgNawdN38+dRpa8jceqi+blID
+ehV6XCxrnGXusTCDuFmo7HMOBVMVNDXlcBWgoGd+u5EultnOEiIeGTgtHc1O6V9w
+icp3BGSpZZax/TcONjMVORaqHCADbQ2J8wsz1FHxuKDwX6BJElYOlK77lb/x3yLs
+DFFC+a0qn2RFh37rcWBRAHy8VEASXKZElT9ZmfKd+KUq34KojhNJ4DepKStTq074
+BRDXVivx+wVD951LFNPiQXq+mgHcLj1k37KlZflTFhdP5oEMtATNsXNJPHlEymiy
+SogRWAmKhysLQudukHfNKN+r0FEQMk/hzpYcFeZSOvbfNQIDAQABo1AwTjAdBgNV
+HQ4EFgQURWMbWvBKZwJvRV1/tyc1R82k0+gwHwYDVR0jBBgwFoAURWMbWvBKZwJv
+RV1/tyc1R82k0+gwDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAQEAkPF+
+ysVtvHnk2hpu9yNDLCJ96ZzIoKOyY7uRj4ovzlAHFdpNOJQdcJihTmN8i7Trht9X
+Vh0rGoR/6nHzo3TIeiogRC80RlDtuA3PF2dDQBMVDStlZMTZPb693hfjdAjhyyw9
+yghhKHHqNDvSsAL0KfBqjG4yGfGpJylYXIT5fWuKlo/ln/yyPa5s54T5XDo+CMbt
+lLX3QnwVOmaRyzylPiTcPCDIkdLBdXmlfyJcmW6fWa6kPx+35MOxPsXZbujCo+42
++OyLqcH1rKT6XhcshjXBEf+kdgUfSClrM1pNRWsw2ChIYim0F+nry5JFy0Y+8Hbb
+6SDB340BFmtgDHbFHTGCApEwggKNAgEBMGkwXDELMAkGA1UEBhMCTkwxEzARBgNV
+BAgMClNvbWUtU3RhdGUxHzAdBgNVBAoMFkFETElOSyBUZWNobm9sb2N5IEluYy4x
+FzAVBgNVBAMMDmFkbGlua3RlY2guY29tAgkA2yveybQ2vKkwDQYJYIZIAWUDBAIB
+BQCggfowGAYJKoZIhvcNAQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG9w0BCQUxDxcN
+MTkwMzI5MTMwODAzWjAvBgkqhkiG9w0BCQQxIgQgOCgkm0Mu6pRSDhlMd5/7OGhr
+3TedLdpw5DQNC60vDgYwgY4GCSqGSIb3DQEJDzGBgDB+MAsGCWCGSAFlAwQBKjAI
+BgYqhQMCAgkwCAYGKoUDAgIVMAsGCWCGSAFlAwQBFjALBglghkgBZQMEAQIwCgYI
+KoZIhvcNAwcwDgYIKoZIhvcNAwICAgCAMA0GCCqGSIb3DQMCAgFAMAcGBSsOAwIH
+MA0GCCqGSIb3DQMCAgEoMA0GCSqGSIb3DQEBAQUABIIBALYwxGivvBYfCdRADnYd
+ysgBOITPhEY+TqqqEtiX4cIyeEdZGMFxcciMxbXVB1qy7js7PM+tbZ/+ICutyA7J
+dkU9cNO9hLM/LYASv9B9zpgxMecYcA9rx7OEpM3Sr2eXOTbu2j3gUoCun7y8f+yv
+iiYUORa0cX8oFnq++rQXHE/0rOVd17tboLvsy97Tro8o1e7WFA2gkJsCyo4QF+Lg
+yz8IKdKMIRLpEl07bGIcIq4gvarQnN3qT1KuOMrDQD29CFZMwCO/TSGVeZYRHdW9
+s1hhmrTlkmlhPyXG9yxm9PH9UHZyfhkbrhIXZtN6M/7SO8VfTMfotyTbFtuatzzL
+fz4=
+
+------E0088C6C0B487BC746E35E87718DA89E--
+
diff --git a/src/security/builtin_plugins/tests/validate_local_permissions/etc/Test_Permissions_lack_of_not_before.xml b/src/security/builtin_plugins/tests/validate_local_permissions/etc/Test_Permissions_lack_of_not_before.xml
new file mode 100644
index 0000000..6c3f892
--- /dev/null
+++ b/src/security/builtin_plugins/tests/validate_local_permissions/etc/Test_Permissions_lack_of_not_before.xml
@@ -0,0 +1,43 @@
+<?xml version="1.0" encoding="utf-8"?>
+<dds xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xsi:noNamespaceSchemaLocation="https://www.omg.org/spec/DDS-SECURITY/20170901/omg_shared_ca_permissions.xsd">
+    <permissions>
+        <grant name="OpenSplicePermissions">
+            <subject_name>/O=Internet Widgits Pty Ltd/ST=Some-State/C=NL/CN=CHAM500 cert</subject_name>
+            <validity>
+                <!-- Format is CCYY-MM-DDThh:mm:ss[Z|(+|-)hh:mm] in GMT -->
+                <not_after>2115-09-15T01:00:00</not_after>
+            </validity>
+            <allow_rule>
+                <domains>
+                    <id_range>
+                        <min>0</min>
+                        <max>230</max>
+                    </id_range>
+                </domains>
+                <publish>
+                    <topics>
+                        <topic>K*</topic>
+                        <topic>*OldMessage</topic>
+                        <topic>OldMessanger</topic>
+                        <topic>NewMessage</topic>
+                    </topics>
+        <partitions>
+      <partition>Apart</partition>
+      <partition>Bpa?t*</partition>
+        </partitions>
+                </publish>
+                <subscribe>
+                    <topics>
+                        <topic>K*</topic>
+                        <topic>*OldMessage</topic>
+                        <topic>OldMessanger</topic>
+                        <topic>NewMessage</topic>
+                    </topics>
+                </subscribe>
+            </allow_rule>
+
+            <default>ALLOW</default>
+        </grant>
+    </permissions>
+</dds>
diff --git a/src/security/builtin_plugins/tests/validate_local_permissions/etc/Test_Permissions_not_signed.p7s b/src/security/builtin_plugins/tests/validate_local_permissions/etc/Test_Permissions_not_signed.p7s
new file mode 100644
index 0000000..8759d91
--- /dev/null
+++ b/src/security/builtin_plugins/tests/validate_local_permissions/etc/Test_Permissions_not_signed.p7s
@@ -0,0 +1,33 @@
+<?xml version="1.0" encoding="utf-8"?>
+<dds xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xsi:noNamespaceSchemaLocation="https://www.omg.org/spec/DDS-SECURITY/20170901/omg_shared_ca_permissions.xsd">
+    <permissions>
+        <grant name="OpenSplicePermissions">
+            <subject_name>CN=CHAM500 cert,O=Internet Widgits Pty Ltd,ST=Some-State,C=NL</subject_name>
+            <validity>
+                <!-- Format is CCYY-MM-DDThh:mm:ss[Z|(+|-)hh:mm] in GMT -->
+                <not_before>2015-09-15T01:00:00</not_before>
+                <not_after>2115-09-15T01:00:00</not_after>
+            </validity>
+            <allow_rule>
+                <domains>
+                    <id_range>
+                        <min>0</min>
+                        <max>230</max>
+                    </id_range>
+                </domains>
+                <publish>
+                    <topics>
+                        <topic>*</topic>
+                    </topics>
+                </publish>
+                <subscribe>
+                    <topics>
+                        <topic>*</topic>
+                    </topics>
+                </subscribe>
+            </allow_rule>
+            <default>DENY</default>
+        </grant>
+    </permissions>
+</dds>
diff --git a/src/security/builtin_plugins/tests/validate_local_permissions/etc/Test_Permissions_notyet.p7s b/src/security/builtin_plugins/tests/validate_local_permissions/etc/Test_Permissions_notyet.p7s
new file mode 100644
index 0000000..7fd4098
--- /dev/null
+++ b/src/security/builtin_plugins/tests/validate_local_permissions/etc/Test_Permissions_notyet.p7s
@@ -0,0 +1,243 @@
+MIME-Version: 1.0
+Content-Type: multipart/signed; protocol="application/x-pkcs7-signature"; micalg="sha-256"; boundary="----F87E07CA6CCEAB50B03A143AC2354EB4"
+
+This is an S/MIME signed message
+
+------F87E07CA6CCEAB50B03A143AC2354EB4
+Content-Type: text/plain
+
+<?xml version="1.0" encoding="utf-8"?>
+<dds xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xsi:noNamespaceSchemaLocation="https://www.omg.org/spec/DDS-SECURITY/20170901/omg_shared_ca_permissions.xsd">
+    <permissions>
+        <grant name="OpenSplicePermissions">
+            <subject_name>CN=CHAM500 cert,O=Internet Widgits Pty Ltd,ST=Some-State,C=NL</subject_name>
+            <validity>
+                <!-- Format is CCYY-MM-DDThh:mm:ss[Z|(+|-)hh:mm] in GMT -->
+                <not_before>2035-09-15T01:00:00</not_before>
+                <not_after>2046-09-15T01:00:00</not_after>
+            </validity>
+            <allow_rule>
+                <domains>
+                    <id_range>
+                        <min>0</min>
+                        <max>230</max>
+                    </id_range>
+                </domains>
+                <publish>
+                    <topics>
+                        <topic>K*</topic>
+                        <topic>*OldMessage</topic>
+                        <topic>OldMessanger</topic>
+                        <topic>NewMessage</topic>
+                    </topics>
+        <partitions>
+      <partition>Apart</partition>
+      <partition>Bpa?t*</partition>
+        </partitions>
+                </publish>
+                <subscribe>
+                    <topics>
+                        <topic>K*</topic>
+                        <topic>*OldMessage</topic>
+                        <topic>OldMessanger</topic>
+                        <topic>NewMessage</topic>
+                    </topics>
+        <partitions>
+      <partition>Apart</partition>
+      <partition>Bpa?t*</partition>
+        </partitions>
+                </subscribe>
+            </allow_rule>
+            <deny_rule>
+                <domains>
+                    <id_range>
+                        <min>0</min>
+                        <max>230</max>
+                    </id_range>
+                </domains>
+                <publish>
+                    <topics>
+                        <topic>P*</topic>
+                        <topic>*WrongMessage</topic>
+                        <topic>FakeMessanger</topic>
+                        <topic>ChangedMessage</topic>
+                    </topics>
+        <partitions>
+      <partition>Apart</partition>
+      <partition>Bpa?t*</partition>
+        </partitions>
+                </publish>
+                <subscribe>
+                    <topics>
+                        <topic>P*</topic>
+                        <topic>*WrongMessage</topic>
+                        <topic>FakeMessanger</topic>
+                        <topic>ChangedMessage</topic>
+                    </topics>
+        <partitions>
+      <partition>Apart</partition>
+      <partition>Bpa?t*</partition>
+        </partitions>
+                </subscribe>
+            </deny_rule>
+
+            <default>DENY</default>
+        </grant>
+        <grant name="SpareNodeOpenSplicePermissions">
+            <subject_name>CN=Spare cert,O=Internet Widgits Pty Ltd,ST=Some-State,C=NL</subject_name>
+            <validity>
+                <!-- Format is CCYY-MM-DDThh:mm:ss[Z|(+|-)hh:mm] in GMT -->
+                <not_before>2015-09-15T01:00:00</not_before>
+                <not_after>2115-09-15T01:00:00</not_after>
+            </validity>
+            <allow_rule>
+                <domains>
+                <!-- All domains -->
+                 <id>20</id>
+                 <id>30</id>
+                 <id_range>
+                     <min>0</min>
+                     <max>23</max>
+                 </id_range>
+                 <id_range>
+                     <min>100</min>
+                     <max>120</max>
+                 </id_range>
+                 <id>200</id>
+               </domains>
+                <publish>
+                    <topics>
+                        <topic>K*</topic>
+                        <topic>*OldMessage</topic>
+                        <topic>OldMessanger</topic>
+                        <topic>NewMessage</topic>
+                    </topics>
+        <partitions>
+      <partition>Apart</partition>
+      <partition>Bpa?t*</partition>
+        </partitions>
+                </publish>
+                <subscribe>
+                    <topics>
+                        <topic>K*</topic>
+                        <topic>*OldMessage</topic>
+                        <topic>OldMessanger</topic>
+                        <topic>NewMessage</topic>
+                    </topics>
+        <partitions>
+      <partition>Apart</partition>
+      <partition>Bpa?t*</partition>
+        </partitions>
+                </subscribe>
+            </allow_rule>
+            <deny_rule>
+                <domains>
+                 <id_range>
+                     <min>0</min>
+                     <max>23</max>
+                 </id_range>
+                 <id_range>
+                     <min>100</min>
+                     <max>120</max>
+                 </id_range>
+                 <id>200</id>
+                </domains>
+                <publish>
+                    <topics>
+                        <topic>P*</topic>
+                        <topic>*WrongMessage</topic>
+                        <topic>FakeMessanger</topic>
+                        <topic>ChangedMessage</topic>
+                    </topics>
+                    <partitions>
+                      <partition>Apart</partition>
+                      <partition>Bpa?t*</partition>
+                    </partitions>
+                </publish>
+                <subscribe>
+                    <topics>
+                        <topic>P*</topic>
+                        <topic>*WrongMessage</topic>
+                        <topic>FakeMessanger</topic>
+                        <topic>ChangedMessage</topic>
+                    </topics>
+                    <partitions>
+                      <partition>Apart</partition>
+                      <partition>Bpa?t*</partition>
+                    </partitions>
+                    <data_tags>
+                      <tag>
+                        <name>aTagName1</name>
+                        <value>aTagValue1</value>
+                      </tag>
+                    </data_tags>
+                </subscribe>
+                <relay>
+                  <topics>
+                        <topic>P*</topic>
+                        <topic>*WrongMessage</topic>
+                        <topic>FakeMessanger</topic>
+                        <topic>ChangedMessage</topic>
+                    </topics>
+                    <partitions>
+                      <partition>Apart</partition>
+                      <partition>Bpa?t*</partition>
+                    </partitions>
+                    <data_tags>
+                      <tag>
+                        <name>aTagName1</name>
+                        <value>aTagValue1</value>
+                      </tag>
+                    </data_tags>
+                </relay>
+            </deny_rule>
+
+            <default>ALLOW</default>
+        </grant>
+    </permissions>
+</dds>
+
+------F87E07CA6CCEAB50B03A143AC2354EB4
+Content-Type: application/x-pkcs7-signature; name="smime.p7s"
+Content-Transfer-Encoding: base64
+Content-Disposition: attachment; filename="smime.p7s"
+
+MIIGXgYJKoZIhvcNAQcCoIIGTzCCBksCAQExDzANBglghkgBZQMEAgEFADALBgkq
+hkiG9w0BBwGgggORMIIDjTCCAnWgAwIBAgIJANsr3sm0NrypMA0GCSqGSIb3DQEB
+CwUAMFwxCzAJBgNVBAYTAk5MMRMwEQYDVQQIDApTb21lLVN0YXRlMR8wHQYDVQQK
+DBZBRExJTksgVGVjaG5vbG9jeSBJbmMuMRcwFQYDVQQDDA5hZGxpbmt0ZWNoLmNv
+bTAgFw0xODA3MzAxMjQ1NTVaGA8yMTE4MDcwNjEyNDU1NVowXDELMAkGA1UEBhMC
+TkwxEzARBgNVBAgMClNvbWUtU3RhdGUxHzAdBgNVBAoMFkFETElOSyBUZWNobm9s
+b2N5IEluYy4xFzAVBgNVBAMMDmFkbGlua3RlY2guY29tMIIBIjANBgkqhkiG9w0B
+AQEFAAOCAQ8AMIIBCgKCAQEAu7jfnJ0wYVuXgG+PgNawdN38+dRpa8jceqi+blID
+ehV6XCxrnGXusTCDuFmo7HMOBVMVNDXlcBWgoGd+u5EultnOEiIeGTgtHc1O6V9w
+icp3BGSpZZax/TcONjMVORaqHCADbQ2J8wsz1FHxuKDwX6BJElYOlK77lb/x3yLs
+DFFC+a0qn2RFh37rcWBRAHy8VEASXKZElT9ZmfKd+KUq34KojhNJ4DepKStTq074
+BRDXVivx+wVD951LFNPiQXq+mgHcLj1k37KlZflTFhdP5oEMtATNsXNJPHlEymiy
+SogRWAmKhysLQudukHfNKN+r0FEQMk/hzpYcFeZSOvbfNQIDAQABo1AwTjAdBgNV
+HQ4EFgQURWMbWvBKZwJvRV1/tyc1R82k0+gwHwYDVR0jBBgwFoAURWMbWvBKZwJv
+RV1/tyc1R82k0+gwDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAQEAkPF+
+ysVtvHnk2hpu9yNDLCJ96ZzIoKOyY7uRj4ovzlAHFdpNOJQdcJihTmN8i7Trht9X
+Vh0rGoR/6nHzo3TIeiogRC80RlDtuA3PF2dDQBMVDStlZMTZPb693hfjdAjhyyw9
+yghhKHHqNDvSsAL0KfBqjG4yGfGpJylYXIT5fWuKlo/ln/yyPa5s54T5XDo+CMbt
+lLX3QnwVOmaRyzylPiTcPCDIkdLBdXmlfyJcmW6fWa6kPx+35MOxPsXZbujCo+42
++OyLqcH1rKT6XhcshjXBEf+kdgUfSClrM1pNRWsw2ChIYim0F+nry5JFy0Y+8Hbb
+6SDB340BFmtgDHbFHTGCApEwggKNAgEBMGkwXDELMAkGA1UEBhMCTkwxEzARBgNV
+BAgMClNvbWUtU3RhdGUxHzAdBgNVBAoMFkFETElOSyBUZWNobm9sb2N5IEluYy4x
+FzAVBgNVBAMMDmFkbGlua3RlY2guY29tAgkA2yveybQ2vKkwDQYJYIZIAWUDBAIB
+BQCggfowGAYJKoZIhvcNAQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG9w0BCQUxDxcN
+MTkwMzI5MTMwODAzWjAvBgkqhkiG9w0BCQQxIgQg0GGu1gWhHWhfWnmg55AIr4tv
+zMK0kIxNfJYQbb7LpJ8wgY4GCSqGSIb3DQEJDzGBgDB+MAsGCWCGSAFlAwQBKjAI
+BgYqhQMCAgkwCAYGKoUDAgIVMAsGCWCGSAFlAwQBFjALBglghkgBZQMEAQIwCgYI
+KoZIhvcNAwcwDgYIKoZIhvcNAwICAgCAMA0GCCqGSIb3DQMCAgFAMAcGBSsOAwIH
+MA0GCCqGSIb3DQMCAgEoMA0GCSqGSIb3DQEBAQUABIIBALsPI2+b0w+iUPJGJeMd
+VdrY7s/GZYm6M8qOA5fmh3144bY1rZRjdHjXtLdaNDNN1Z5buRCiQcklAilf6O14
+7u6a5HR12N4LTbg3OYQplwz4ed/wBsL726htmkAK3JogGk5OVLqmmdrz3UOD8IaZ
+wAfx2tpj3VJOVuW0XsqOrzQpnOjGWcPeOw6NAxRH1gLsxBP9HDz5+wrsKXjV/zG8
+dFTaZ0bKnBXTp5ccc9jB4qbcllC9nlJkJszGqvwOP7zWBAOXeU+joUGM4Bt+8Pmt
+pKsVAmEqMpc368RMayDBWtTqUWpUKvDh4HSkuOGD4Hj5ViAoLFjisROhIK2d98XI
+cRQ=
+
+------F87E07CA6CCEAB50B03A143AC2354EB4--
+
diff --git a/src/security/builtin_plugins/tests/validate_local_permissions/etc/Test_Permissions_notyet.xml b/src/security/builtin_plugins/tests/validate_local_permissions/etc/Test_Permissions_notyet.xml
new file mode 100644
index 0000000..99fec50
--- /dev/null
+++ b/src/security/builtin_plugins/tests/validate_local_permissions/etc/Test_Permissions_notyet.xml
@@ -0,0 +1,191 @@
+<?xml version="1.0" encoding="utf-8"?>
+<dds xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xsi:noNamespaceSchemaLocation="https://www.omg.org/spec/DDS-SECURITY/20170901/omg_shared_ca_permissions.xsd">
+    <permissions>
+        <grant name="OpenSplicePermissions">
+            <subject_name>CN=CHAM500 cert,O=Internet Widgits Pty Ltd,ST=Some-State,C=NL</subject_name>
+            <validity>
+                <!-- Format is CCYY-MM-DDThh:mm:ss[Z|(+|-)hh:mm] in GMT -->
+                <not_before>2035-09-15T01:00:00</not_before>
+                <not_after>2046-09-15T01:00:00</not_after>
+            </validity>
+            <allow_rule>
+                <domains>
+                    <id_range>
+                        <min>0</min>
+                        <max>230</max>
+                    </id_range>
+                </domains>
+                <publish>
+                    <topics>
+                        <topic>K*</topic>
+                        <topic>*OldMessage</topic>
+                        <topic>OldMessanger</topic>
+                        <topic>NewMessage</topic>
+                    </topics>
+        <partitions>
+      <partition>Apart</partition>
+      <partition>Bpa?t*</partition>
+        </partitions>
+                </publish>
+                <subscribe>
+                    <topics>
+                        <topic>K*</topic>
+                        <topic>*OldMessage</topic>
+                        <topic>OldMessanger</topic>
+                        <topic>NewMessage</topic>
+                    </topics>
+        <partitions>
+      <partition>Apart</partition>
+      <partition>Bpa?t*</partition>
+        </partitions>
+                </subscribe>
+            </allow_rule>
+            <deny_rule>
+                <domains>
+                    <id_range>
+                        <min>0</min>
+                        <max>230</max>
+                    </id_range>
+                </domains>
+                <publish>
+                    <topics>
+                        <topic>P*</topic>
+                        <topic>*WrongMessage</topic>
+                        <topic>FakeMessanger</topic>
+                        <topic>ChangedMessage</topic>
+                    </topics>
+        <partitions>
+      <partition>Apart</partition>
+      <partition>Bpa?t*</partition>
+        </partitions>
+                </publish>
+                <subscribe>
+                    <topics>
+                        <topic>P*</topic>
+                        <topic>*WrongMessage</topic>
+                        <topic>FakeMessanger</topic>
+                        <topic>ChangedMessage</topic>
+                    </topics>
+        <partitions>
+      <partition>Apart</partition>
+      <partition>Bpa?t*</partition>
+        </partitions>
+                </subscribe>
+            </deny_rule>
+
+            <default>DENY</default>
+        </grant>
+        <grant name="SpareNodeOpenSplicePermissions">
+            <subject_name>CN=Spare cert,O=Internet Widgits Pty Ltd,ST=Some-State,C=NL</subject_name>
+            <validity>
+                <!-- Format is CCYY-MM-DDThh:mm:ss[Z|(+|-)hh:mm] in GMT -->
+                <not_before>2015-09-15T01:00:00</not_before>
+                <not_after>2115-09-15T01:00:00</not_after>
+            </validity>
+            <allow_rule>
+                <domains>
+                <!-- All domains -->
+                 <id>20</id>
+                 <id>30</id>
+                 <id_range>
+                     <min>0</min>
+                     <max>23</max>
+                 </id_range>
+                 <id_range>
+                     <min>100</min>
+                     <max>120</max>
+                 </id_range>
+                 <id>200</id>
+               </domains>
+                <publish>
+                    <topics>
+                        <topic>K*</topic>
+                        <topic>*OldMessage</topic>
+                        <topic>OldMessanger</topic>
+                        <topic>NewMessage</topic>
+                    </topics>
+        <partitions>
+      <partition>Apart</partition>
+      <partition>Bpa?t*</partition>
+        </partitions>
+                </publish>
+                <subscribe>
+                    <topics>
+                        <topic>K*</topic>
+                        <topic>*OldMessage</topic>
+                        <topic>OldMessanger</topic>
+                        <topic>NewMessage</topic>
+                    </topics>
+        <partitions>
+      <partition>Apart</partition>
+      <partition>Bpa?t*</partition>
+        </partitions>
+                </subscribe>
+            </allow_rule>
+            <deny_rule>
+                <domains>
+                 <id_range>
+                     <min>0</min>
+                     <max>23</max>
+                 </id_range>
+                 <id_range>
+                     <min>100</min>
+                     <max>120</max>
+                 </id_range>
+                 <id>200</id>
+                </domains>
+                <publish>
+                    <topics>
+                        <topic>P*</topic>
+                        <topic>*WrongMessage</topic>
+                        <topic>FakeMessanger</topic>
+                        <topic>ChangedMessage</topic>
+                    </topics>
+                    <partitions>
+                      <partition>Apart</partition>
+                      <partition>Bpa?t*</partition>
+                    </partitions>
+                </publish>
+                <subscribe>
+                    <topics>
+                        <topic>P*</topic>
+                        <topic>*WrongMessage</topic>
+                        <topic>FakeMessanger</topic>
+                        <topic>ChangedMessage</topic>
+                    </topics>
+                    <partitions>
+                      <partition>Apart</partition>
+                      <partition>Bpa?t*</partition>
+                    </partitions>
+                    <data_tags>
+                      <tag>
+                        <name>aTagName1</name>
+                        <value>aTagValue1</value>
+                      </tag>
+                    </data_tags>
+                </subscribe>
+                <relay>
+                  <topics>
+                        <topic>P*</topic>
+                        <topic>*WrongMessage</topic>
+                        <topic>FakeMessanger</topic>
+                        <topic>ChangedMessage</topic>
+                    </topics>
+                    <partitions>
+                      <partition>Apart</partition>
+                      <partition>Bpa?t*</partition>
+                    </partitions>
+                    <data_tags>
+                      <tag>
+                        <name>aTagName1</name>
+                        <value>aTagValue1</value>
+                      </tag>
+                    </data_tags>
+                </relay>
+            </deny_rule>
+
+            <default>ALLOW</default>
+        </grant>
+    </permissions>
+</dds>
diff --git a/src/security/builtin_plugins/tests/validate_local_permissions/etc/Test_Permissions_ok.p7s b/src/security/builtin_plugins/tests/validate_local_permissions/etc/Test_Permissions_ok.p7s
new file mode 100644
index 0000000..052075b
--- /dev/null
+++ b/src/security/builtin_plugins/tests/validate_local_permissions/etc/Test_Permissions_ok.p7s
@@ -0,0 +1,85 @@
+MIME-Version: 1.0
+Content-Type: multipart/signed; protocol="application/x-pkcs7-signature"; micalg="sha-256"; boundary="----6B91005B007BBA8EDE10CD1CE487DB27"
+
+This is an S/MIME signed message
+
+------6B91005B007BBA8EDE10CD1CE487DB27
+Content-Type: text/plain
+
+<?xml version="1.0" encoding="utf-8"?>
+<dds xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xsi:noNamespaceSchemaLocation="https://www.omg.org/spec/DDS-SECURITY/20170901/omg_shared_ca_permissions.xsd">
+    <permissions>
+        <grant name="OpenSplicePermissions">
+            <subject_name>CN=CHAM500 cert,O=Internet Widgits Pty Ltd,ST=Some-State,C=NL</subject_name>
+            <validity>
+                <!-- Format is CCYY-MM-DDThh:mm:ss[Z|(+|-)hh:mm] in GMT -->
+                <not_before>2015-09-15T01:00:00</not_before>
+                <not_after>2115-09-15T01:00:00</not_after>
+            </validity>
+            <allow_rule>
+                <domains>
+                    <id_range>
+                        <min>0</min>
+                        <max>230</max>
+                    </id_range>
+                </domains>
+                <publish>
+                    <topics>
+                        <topic>*</topic>
+                    </topics>
+                </publish>
+                <subscribe>
+                    <topics>
+                        <topic>*</topic>
+                    </topics>
+                </subscribe>
+            </allow_rule>
+            <default>DENY</default>
+        </grant>
+    </permissions>
+</dds>
+
+------6B91005B007BBA8EDE10CD1CE487DB27
+Content-Type: application/x-pkcs7-signature; name="smime.p7s"
+Content-Transfer-Encoding: base64
+Content-Disposition: attachment; filename="smime.p7s"
+
+MIIGXgYJKoZIhvcNAQcCoIIGTzCCBksCAQExDzANBglghkgBZQMEAgEFADALBgkq
+hkiG9w0BBwGgggORMIIDjTCCAnWgAwIBAgIJANsr3sm0NrypMA0GCSqGSIb3DQEB
+CwUAMFwxCzAJBgNVBAYTAk5MMRMwEQYDVQQIDApTb21lLVN0YXRlMR8wHQYDVQQK
+DBZBRExJTksgVGVjaG5vbG9jeSBJbmMuMRcwFQYDVQQDDA5hZGxpbmt0ZWNoLmNv
+bTAgFw0xODA3MzAxMjQ1NTVaGA8yMTE4MDcwNjEyNDU1NVowXDELMAkGA1UEBhMC
+TkwxEzARBgNVBAgMClNvbWUtU3RhdGUxHzAdBgNVBAoMFkFETElOSyBUZWNobm9s
+b2N5IEluYy4xFzAVBgNVBAMMDmFkbGlua3RlY2guY29tMIIBIjANBgkqhkiG9w0B
+AQEFAAOCAQ8AMIIBCgKCAQEAu7jfnJ0wYVuXgG+PgNawdN38+dRpa8jceqi+blID
+ehV6XCxrnGXusTCDuFmo7HMOBVMVNDXlcBWgoGd+u5EultnOEiIeGTgtHc1O6V9w
+icp3BGSpZZax/TcONjMVORaqHCADbQ2J8wsz1FHxuKDwX6BJElYOlK77lb/x3yLs
+DFFC+a0qn2RFh37rcWBRAHy8VEASXKZElT9ZmfKd+KUq34KojhNJ4DepKStTq074
+BRDXVivx+wVD951LFNPiQXq+mgHcLj1k37KlZflTFhdP5oEMtATNsXNJPHlEymiy
+SogRWAmKhysLQudukHfNKN+r0FEQMk/hzpYcFeZSOvbfNQIDAQABo1AwTjAdBgNV
+HQ4EFgQURWMbWvBKZwJvRV1/tyc1R82k0+gwHwYDVR0jBBgwFoAURWMbWvBKZwJv
+RV1/tyc1R82k0+gwDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAQEAkPF+
+ysVtvHnk2hpu9yNDLCJ96ZzIoKOyY7uRj4ovzlAHFdpNOJQdcJihTmN8i7Trht9X
+Vh0rGoR/6nHzo3TIeiogRC80RlDtuA3PF2dDQBMVDStlZMTZPb693hfjdAjhyyw9
+yghhKHHqNDvSsAL0KfBqjG4yGfGpJylYXIT5fWuKlo/ln/yyPa5s54T5XDo+CMbt
+lLX3QnwVOmaRyzylPiTcPCDIkdLBdXmlfyJcmW6fWa6kPx+35MOxPsXZbujCo+42
++OyLqcH1rKT6XhcshjXBEf+kdgUfSClrM1pNRWsw2ChIYim0F+nry5JFy0Y+8Hbb
+6SDB340BFmtgDHbFHTGCApEwggKNAgEBMGkwXDELMAkGA1UEBhMCTkwxEzARBgNV
+BAgMClNvbWUtU3RhdGUxHzAdBgNVBAoMFkFETElOSyBUZWNobm9sb2N5IEluYy4x
+FzAVBgNVBAMMDmFkbGlua3RlY2guY29tAgkA2yveybQ2vKkwDQYJYIZIAWUDBAIB
+BQCggfowGAYJKoZIhvcNAQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG9w0BCQUxDxcN
+MTkwMzI5MTMwODAzWjAvBgkqhkiG9w0BCQQxIgQgl3LfUhn9L0vG/3QRPVYptcYw
+/NH5HMN99aMe9JAT+LAwgY4GCSqGSIb3DQEJDzGBgDB+MAsGCWCGSAFlAwQBKjAI
+BgYqhQMCAgkwCAYGKoUDAgIVMAsGCWCGSAFlAwQBFjALBglghkgBZQMEAQIwCgYI
+KoZIhvcNAwcwDgYIKoZIhvcNAwICAgCAMA0GCCqGSIb3DQMCAgFAMAcGBSsOAwIH
+MA0GCCqGSIb3DQMCAgEoMA0GCSqGSIb3DQEBAQUABIIBAHe9vakfXPvbpgMeqlhG
+SW6Z3uVA3Yri9bgQDpJ9daIUsM0/TLBSQVs85twTMXvqUSntKbfSGehxDQ9F+yje
+mOEPMIwxOqcVyc2jpqoYsUWqpwiiZyk49DHUFrOfWJUx+rKdBftZWkxD05Wkovhk
+2d4hGS/65Haoho4Z0AZwcyH+F52FZMiqw7I9FKrPlhxvJfQXmhIjOKtnvWnQ+Ar7
+YYiSrBEHMCy82LF1aKzz0nkL1SYWQHuQX475qoU4LMYY1J8WsD3rSBeq4GYZrl2K
+X/JcOquMYqjfJLMYZY4fsc3FgEBkKNqJz1tDZ3ir24VMl+WsbEjVK8oXe/wt4V0U
+aNQ=
+
+------6B91005B007BBA8EDE10CD1CE487DB27--
+
diff --git a/src/security/builtin_plugins/tests/validate_local_permissions/etc/Test_Permissions_ok.xml b/src/security/builtin_plugins/tests/validate_local_permissions/etc/Test_Permissions_ok.xml
new file mode 100644
index 0000000..8759d91
--- /dev/null
+++ b/src/security/builtin_plugins/tests/validate_local_permissions/etc/Test_Permissions_ok.xml
@@ -0,0 +1,33 @@
+<?xml version="1.0" encoding="utf-8"?>
+<dds xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xsi:noNamespaceSchemaLocation="https://www.omg.org/spec/DDS-SECURITY/20170901/omg_shared_ca_permissions.xsd">
+    <permissions>
+        <grant name="OpenSplicePermissions">
+            <subject_name>CN=CHAM500 cert,O=Internet Widgits Pty Ltd,ST=Some-State,C=NL</subject_name>
+            <validity>
+                <!-- Format is CCYY-MM-DDThh:mm:ss[Z|(+|-)hh:mm] in GMT -->
+                <not_before>2015-09-15T01:00:00</not_before>
+                <not_after>2115-09-15T01:00:00</not_after>
+            </validity>
+            <allow_rule>
+                <domains>
+                    <id_range>
+                        <min>0</min>
+                        <max>230</max>
+                    </id_range>
+                </domains>
+                <publish>
+                    <topics>
+                        <topic>*</topic>
+                    </topics>
+                </publish>
+                <subscribe>
+                    <topics>
+                        <topic>*</topic>
+                    </topics>
+                </subscribe>
+            </allow_rule>
+            <default>DENY</default>
+        </grant>
+    </permissions>
+</dds>
diff --git a/src/security/builtin_plugins/tests/validate_local_permissions/etc/Test_Permissions_unknown_ca.p7s b/src/security/builtin_plugins/tests/validate_local_permissions/etc/Test_Permissions_unknown_ca.p7s
new file mode 100644
index 0000000..6a2905a
--- /dev/null
+++ b/src/security/builtin_plugins/tests/validate_local_permissions/etc/Test_Permissions_unknown_ca.p7s
@@ -0,0 +1,87 @@
+MIME-Version: 1.0
+Content-Type: multipart/signed; protocol="application/x-pkcs7-signature"; micalg="sha-256"; boundary="----7FBACED8776E5A4CF7612C83F9C33E17"
+
+This is an S/MIME signed message
+
+------7FBACED8776E5A4CF7612C83F9C33E17
+Content-Type: text/plain
+
+<?xml version="1.0" encoding="utf-8"?>
+<dds xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xsi:noNamespaceSchemaLocation="https://www.omg.org/spec/DDS-SECURITY/20170901/omg_shared_ca_permissions.xsd">
+    <permissions>
+        <grant name="OpenSplicePermissions">
+            <subject_name>/C=NL/ST=Some-State/O=ADLINK Technolocy Inc./CN=adlinktech.com</subject_name>
+            <validity>
+                <!-- Format is CCYY-MM-DDThh:mm:ss[Z|(+|-)hh:mm] in GMT -->
+                <not_before>2015-09-15T01:00:00</not_before>
+                <not_after>2115-09-15T01:00:00</not_after>
+            </validity>
+            <allow_rule>
+                <domains>
+                    <id_range>
+                        <min>0</min>
+                        <max>230</max>
+                    </id_range>
+                </domains>
+                <publish>
+                    <topics>
+                        <topic>*</topic>
+                    </topics>
+                </publish>
+                <subscribe>
+                    <topics>
+                        <topic>*</topic>
+                    </topics>
+                </subscribe>
+            </allow_rule>
+            <default>DENY</default>
+        </grant>
+    </permissions>
+</dds>
+
+------7FBACED8776E5A4CF7612C83F9C33E17
+Content-Type: application/x-pkcs7-signature; name="smime.p7s"
+Content-Transfer-Encoding: base64
+Content-Disposition: attachment; filename="smime.p7s"
+
+MIIGywYJKoZIhvcNAQcCoIIGvDCCBrgCAQExDzANBglghkgBZQMEAgEFADALBgkq
+hkiG9w0BBwGgggPKMIIDxjCCAq4CCQCBuTktP0h8BDANBgkqhkiG9w0BAQsFADCB
+pDEWMBQGA1UEBwwNTG9jYWxpdHkgTmFtZTEhMB8GA1UECwwYT3JnYW5pemF0aW9u
+YWwgVW5pdCBOYW1lMRwwGgYJKoZIhvcNAQkBFg1FbWFpbCBBZGRyZXNzMQswCQYD
+VQQGEwJVUzELMAkGA1UECAwCTkoxGjAYBgNVBAoMEUV4YW1wbGUgU2lnbmVyIENB
+MRMwEQYDVQQDDApFeGFtcGxlIENBMB4XDTE4MDgxNTA4NTE0MVoXDTQzMDgwOTA4
+NTE0MVowgaQxFjAUBgNVBAcMDUxvY2FsaXR5IE5hbWUxITAfBgNVBAsMGE9yZ2Fu
+aXphdGlvbmFsIFVuaXQgTmFtZTEcMBoGCSqGSIb3DQEJARYNRW1haWwgQWRkcmVz
+czELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAk5KMRowGAYDVQQKDBFFeGFtcGxlIFNp
+Z25lciBDQTETMBEGA1UEAwwKRXhhbXBsZSBDQTCCASIwDQYJKoZIhvcNAQEBBQAD
+ggEPADCCAQoCggEBALStAQ0yjM2qAWwsOXdX3hiyoZ6DDHWOTNI5LoCZGaN9rUZe
+MY0waSxWNQ0ruURgZISeOFkdQTAE81Em+UaZI+MZvfYcEcSlVtF6yve/WnIzRYWu
+f917moMCAInktfch4E6mskr4h7n+9sEz+3GsQS8SQRtwUe+PiXzjZrqHSbLC4Kn3
+/b8Mt+Ww3a4FyjHDZQJZsGSvrScr0Gq3xeKfMwb+KYNEnmh0o4os0gEGA4KUR+/1
+YDl1NmxQnm/AIMqwJzeaezBoMn0Nsi+OlAms85imGURNj9BCEJZBWwuuNL5ECDAq
+WLOM3AKUsApVgtGd8/OLWW1RwYkW8uqTtkIR87MCAwEAATANBgkqhkiG9w0BAQsF
+AAOCAQEAokKC77/kvxlObLSwkT5+7+S+DeznLBRiGVEh8+9PQw1q91sjiOZWf0e3
+T3XPH7CR/NDYoQJkrsqzIwKYrj41z/1jAs+HkH45NpTFiGlUFXNs5iwNh4RUqgf4
+e78Mge4q7pHMFzWTEwEn4DJMGcDDjLW1kN8GobGwHR7O0MpAJKrqcBSo+SPomnQv
+TgiEMQ+Vlz0EJx6JPsq8c7HrxlSdeDAAWIOww/wcGyzlpYEoyz6voSSfdhMt5iy5
+k5BvhBJnTiJTasCHy9KRuis/6qpTZKEj0d7J7LAqpGh8oRIphMwCbFYQT0QBgV6p
+gM8Ufss/RZ6CshMNxz7KtIYpvmxPPTGCAsUwggLBAgEBMIGyMIGkMRYwFAYDVQQH
+DA1Mb2NhbGl0eSBOYW1lMSEwHwYDVQQLDBhPcmdhbml6YXRpb25hbCBVbml0IE5h
+bWUxHDAaBgkqhkiG9w0BCQEWDUVtYWlsIEFkZHJlc3MxCzAJBgNVBAYTAlVTMQsw
+CQYDVQQIDAJOSjEaMBgGA1UECgwRRXhhbXBsZSBTaWduZXIgQ0ExEzARBgNVBAMM
+CkV4YW1wbGUgQ0ECCQCBuTktP0h8BDANBglghkgBZQMEAgEFAKCB5DAYBgkqhkiG
+9w0BCQMxCwYJKoZIhvcNAQcBMBwGCSqGSIb3DQEJBTEPFw0xODA5MTMwOTIzMDNa
+MC8GCSqGSIb3DQEJBDEiBCCvP08gFBO7651mPPDFQ2suhL+eprGCGuRLXmiBmdvx
+ITB5BgkqhkiG9w0BCQ8xbDBqMAsGCWCGSAFlAwQBKjALBglghkgBZQMEARYwCwYJ
+YIZIAWUDBAECMAoGCCqGSIb3DQMHMA4GCCqGSIb3DQMCAgIAgDANBggqhkiG9w0D
+AgIBQDAHBgUrDgMCBzANBggqhkiG9w0DAgIBKDANBgkqhkiG9w0BAQEFAASCAQB/
+4EQel+0LsmiNFCUjWM68u4ZvPtFBpeDe456DJuG6QR0LIzW42U7N4P2ZTIqjpGZx
+YekBCNdkiVy6ER5IA4WfcKd6zXZEuXVxkMrGpJlqGdd+IdZpTsrBygGZJS4vMUfD
+/6ty6OycET88RmJIu4V/TM3yLVKzHuj6TxCXb4OIYx8g3mdXUwUrp6DGgqggRSPJ
+tatbpnqGZGcvty8MusXVnjnEwUWnJ/jojypY3MyL4MTbjufjv0K6NKQ3RzoLssot
+SLq0YDLwvX/s9sLXDCedAwFXBS/6Qv56v0M2x4o8e3Eul7gGTMuCd/dJ0BhF8CW+
+IGxR5I3xXssh/AuWRRtV
+
+------7FBACED8776E5A4CF7612C83F9C33E17--
+
diff --git a/src/security/builtin_plugins/tests/validate_local_permissions/etc/Test_Permissions_unknown_subject.p7s b/src/security/builtin_plugins/tests/validate_local_permissions/etc/Test_Permissions_unknown_subject.p7s
new file mode 100644
index 0000000..fb488c7
--- /dev/null
+++ b/src/security/builtin_plugins/tests/validate_local_permissions/etc/Test_Permissions_unknown_subject.p7s
@@ -0,0 +1,85 @@
+MIME-Version: 1.0
+Content-Type: multipart/signed; protocol="application/x-pkcs7-signature"; micalg="sha-256"; boundary="----7B161F9203F175A7F82A389A3E044741"
+
+This is an S/MIME signed message
+
+------7B161F9203F175A7F82A389A3E044741
+Content-Type: text/plain
+
+<?xml version="1.0" encoding="utf-8"?>
+<dds xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xsi:noNamespaceSchemaLocation="https://www.omg.org/spec/DDS-SECURITY/20170901/omg_shared_ca_permissions.xsd">
+    <permissions>
+        <grant name="OpenSplicePermissions">
+            <subject_name>gibberish</subject_name>
+            <validity>
+                <!-- Format is CCYY-MM-DDThh:mm:ss[Z|(+|-)hh:mm] in GMT -->
+                <not_before>2015-09-15T01:00:00</not_before>
+                <not_after>2115-09-15T01:00:00</not_after>
+            </validity>
+            <allow_rule>
+                <domains>
+                    <id_range>
+                        <min>0</min>
+                        <max>230</max>
+                    </id_range>
+                </domains>
+                <publish>
+                    <topics>
+                        <topic>*</topic>
+                    </topics>
+                </publish>
+                <subscribe>
+                    <topics>
+                        <topic>*</topic>
+                    </topics>
+                </subscribe>
+            </allow_rule>
+            <default>DENY</default>
+        </grant>
+    </permissions>
+</dds>
+
+------7B161F9203F175A7F82A389A3E044741
+Content-Type: application/x-pkcs7-signature; name="smime.p7s"
+Content-Transfer-Encoding: base64
+Content-Disposition: attachment; filename="smime.p7s"
+
+MIIGXgYJKoZIhvcNAQcCoIIGTzCCBksCAQExDzANBglghkgBZQMEAgEFADALBgkq
+hkiG9w0BBwGgggORMIIDjTCCAnWgAwIBAgIJANsr3sm0NrypMA0GCSqGSIb3DQEB
+CwUAMFwxCzAJBgNVBAYTAk5MMRMwEQYDVQQIDApTb21lLVN0YXRlMR8wHQYDVQQK
+DBZBRExJTksgVGVjaG5vbG9jeSBJbmMuMRcwFQYDVQQDDA5hZGxpbmt0ZWNoLmNv
+bTAgFw0xODA3MzAxMjQ1NTVaGA8yMTE4MDcwNjEyNDU1NVowXDELMAkGA1UEBhMC
+TkwxEzARBgNVBAgMClNvbWUtU3RhdGUxHzAdBgNVBAoMFkFETElOSyBUZWNobm9s
+b2N5IEluYy4xFzAVBgNVBAMMDmFkbGlua3RlY2guY29tMIIBIjANBgkqhkiG9w0B
+AQEFAAOCAQ8AMIIBCgKCAQEAu7jfnJ0wYVuXgG+PgNawdN38+dRpa8jceqi+blID
+ehV6XCxrnGXusTCDuFmo7HMOBVMVNDXlcBWgoGd+u5EultnOEiIeGTgtHc1O6V9w
+icp3BGSpZZax/TcONjMVORaqHCADbQ2J8wsz1FHxuKDwX6BJElYOlK77lb/x3yLs
+DFFC+a0qn2RFh37rcWBRAHy8VEASXKZElT9ZmfKd+KUq34KojhNJ4DepKStTq074
+BRDXVivx+wVD951LFNPiQXq+mgHcLj1k37KlZflTFhdP5oEMtATNsXNJPHlEymiy
+SogRWAmKhysLQudukHfNKN+r0FEQMk/hzpYcFeZSOvbfNQIDAQABo1AwTjAdBgNV
+HQ4EFgQURWMbWvBKZwJvRV1/tyc1R82k0+gwHwYDVR0jBBgwFoAURWMbWvBKZwJv
+RV1/tyc1R82k0+gwDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAQEAkPF+
+ysVtvHnk2hpu9yNDLCJ96ZzIoKOyY7uRj4ovzlAHFdpNOJQdcJihTmN8i7Trht9X
+Vh0rGoR/6nHzo3TIeiogRC80RlDtuA3PF2dDQBMVDStlZMTZPb693hfjdAjhyyw9
+yghhKHHqNDvSsAL0KfBqjG4yGfGpJylYXIT5fWuKlo/ln/yyPa5s54T5XDo+CMbt
+lLX3QnwVOmaRyzylPiTcPCDIkdLBdXmlfyJcmW6fWa6kPx+35MOxPsXZbujCo+42
++OyLqcH1rKT6XhcshjXBEf+kdgUfSClrM1pNRWsw2ChIYim0F+nry5JFy0Y+8Hbb
+6SDB340BFmtgDHbFHTGCApEwggKNAgEBMGkwXDELMAkGA1UEBhMCTkwxEzARBgNV
+BAgMClNvbWUtU3RhdGUxHzAdBgNVBAoMFkFETElOSyBUZWNobm9sb2N5IEluYy4x
+FzAVBgNVBAMMDmFkbGlua3RlY2guY29tAgkA2yveybQ2vKkwDQYJYIZIAWUDBAIB
+BQCggfowGAYJKoZIhvcNAQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG9w0BCQUxDxcN
+MTkwMzI5MTMwODAzWjAvBgkqhkiG9w0BCQQxIgQg44QSCYJrKGm9hdPbOKQjrnQ8
+LXMSbo0mve1cRKvrm3gwgY4GCSqGSIb3DQEJDzGBgDB+MAsGCWCGSAFlAwQBKjAI
+BgYqhQMCAgkwCAYGKoUDAgIVMAsGCWCGSAFlAwQBFjALBglghkgBZQMEAQIwCgYI
+KoZIhvcNAwcwDgYIKoZIhvcNAwICAgCAMA0GCCqGSIb3DQMCAgFAMAcGBSsOAwIH
+MA0GCCqGSIb3DQMCAgEoMA0GCSqGSIb3DQEBAQUABIIBAH/fJ90OwloC73faPAGC
+VRZrhW/gSsy/1VnprvWdDAU1ZZK+srIISFZAy19LcApTis0Vy9yz2PG8pue49R+y
+UF6mCDSuN/l9SRBdUN+CXQdQ8sGq5SHXNhGzSX/nbR20ol4cSUMpKlEGx66E0KUW
+tkk8HzYw7aHMiwK2E2Y0sbm/M/rdmAbgEoywYfvc25V4FHP66TstfCLBjN9Hz3bH
+WcrCZuPjZo6vBd/rIJQSlgH81aCWn5RfCIccbc3iogwzIhYxAr6d+4do3LNa6H80
+W6CMgl0AnWFfa4QwnXFUzb1/W2rFjHp453w1Cbqk4Ll4ZlVJr4fzIuyuJMQlMrmK
+1P0=
+
+------7B161F9203F175A7F82A389A3E044741--
+
diff --git a/src/security/builtin_plugins/tests/validate_local_permissions/etc/Test_Permissions_unknown_subject.xml b/src/security/builtin_plugins/tests/validate_local_permissions/etc/Test_Permissions_unknown_subject.xml
new file mode 100644
index 0000000..8a55faf
--- /dev/null
+++ b/src/security/builtin_plugins/tests/validate_local_permissions/etc/Test_Permissions_unknown_subject.xml
@@ -0,0 +1,33 @@
+<?xml version="1.0" encoding="utf-8"?>
+<dds xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xsi:noNamespaceSchemaLocation="https://www.omg.org/spec/DDS-SECURITY/20170901/omg_shared_ca_permissions.xsd">
+    <permissions>
+        <grant name="OpenSplicePermissions">
+            <subject_name>gibberish</subject_name>
+            <validity>
+                <!-- Format is CCYY-MM-DDThh:mm:ss[Z|(+|-)hh:mm] in GMT -->
+                <not_before>2015-09-15T01:00:00</not_before>
+                <not_after>2115-09-15T01:00:00</not_after>
+            </validity>
+            <allow_rule>
+                <domains>
+                    <id_range>
+                        <min>0</min>
+                        <max>230</max>
+                    </id_range>
+                </domains>
+                <publish>
+                    <topics>
+                        <topic>*</topic>
+                    </topics>
+                </publish>
+                <subscribe>
+                    <topics>
+                        <topic>*</topic>
+                    </topics>
+                </subscribe>
+            </allow_rule>
+            <default>DENY</default>
+        </grant>
+    </permissions>
+</dds>
diff --git a/src/security/builtin_plugins/tests/validate_local_permissions/src/validate_local_permissions_utests.c b/src/security/builtin_plugins/tests/validate_local_permissions/src/validate_local_permissions_utests.c
new file mode 100644
index 0000000..b690fdb
--- /dev/null
+++ b/src/security/builtin_plugins/tests/validate_local_permissions/src/validate_local_permissions_utests.c
@@ -0,0 +1,1020 @@
+/*
+ * Copyright(c) 2006 to 2019 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+#include <assert.h>
+#include <openssl/evp.h>
+#include <openssl/hmac.h>
+#include <openssl/bio.h>
+#include <openssl/err.h>
+
+#include "dds/ddsrt/environ.h"
+#include "dds/ddsrt/heap.h"
+#include "dds/ddsrt/io.h"
+#include "dds/ddsrt/string.h"
+#include "dds/ddsrt/types.h"
+#include "dds/security/dds_security_api.h"
+#include "dds/security/core/dds_security_utils.h"
+#include "CUnit/CUnit.h"
+#include "CUnit/Test.h"
+#include "common/src/loader.h"
+#include "config_env.h"
+
+static const char *PROPERTY_IDENTITY_CA = "dds.sec.auth.identity_ca";
+static const char *PROPERTY_PRIVATE_KEY = "dds.sec.auth.private_key";
+static const char *PROPERTY_IDENTITY_CERT = "dds.sec.auth.identity_certificate";
+static const char *PROPERTY_PERMISSIONS_CA = "dds.sec.access.permissions_ca";
+static const char *PROPERTY_PERMISSIONS = "dds.sec.access.permissions";
+static const char *PROPERTY_GOVERNANCE = "dds.sec.access.governance";
+
+static const char *RELATIVE_PATH_TO_ETC_DIR = "/validate_local_permissions/etc/";
+
+static const char *AUTH_IDENTITY_CERT =
+    "data:,-----BEGIN CERTIFICATE-----\n"
+    "MIIEQTCCAymgAwIBAgIINpuaAAnrQZIwDQYJKoZIhvcNAQELBQAwXzELMAkGA1UE\n"
+    "BhMCTkwxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdp\n"
+    "ZGdpdHMgUHR5IEx0ZDEYMBYGA1UEAxMPQ0hBTTUwMCByb290IGNhMCAXDTE3MDIy\n"
+    "MjIyMjIwMFoYDzIyMjIwMjIyMjIyMjAwWjBcMQswCQYDVQQGEwJOTDETMBEGA1UE\n"
+    "CBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRk\n"
+    "MRUwEwYDVQQDEwxDSEFNNTAwIGNlcnQwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAw\n"
+    "ggEKAoIBAQDCpVhivH/wBIyu74rvQncnSZqKyspN6CvD1pmV9wft5PHhVt9jV79v\n"
+    "gSub5LADoRHAgFdv9duYgBr17Ob6uRrIY4B18CcrCjhQcC4gjx8y2jl9PeYm+qYD\n"
+    "3o44FYBrBq0QCnrQgKsb/qX9Z+Mw/VUiw65x68W876LEHQQoEgT4kxSuagwBoVRk\n"
+    "ePD6fYAKmT4XS3x+O0v+rHESTcsKF6yMadgp7h3eH1b8kJTzSx8JV9Zzq++mxjox\n"
+    "qhbBVP5nDze2hhSIeCkCvSrx7efkgKS4AQXa5/Z44GiAu1TfXXUqdic9rxwD0edn\n"
+    "ajNElnZe7sjok/0yuqvH+2hSqpNva/zpAgMBAAGjggEAMIH9MAwGA1UdDwQFAwMH\n"
+    "/4AwgewGA1UdJQSB5DCB4QYIKwYBBQUHAwEGCCsGAQUFBwMCBggrBgEFBQcDAwYI\n"
+    "KwYBBQUHAwQGCCsGAQUFBwMIBgorBgEEAYI3AgEVBgorBgEEAYI3AgEWBgorBgEE\n"
+    "AYI3CgMBBgorBgEEAYI3CgMDBgorBgEEAYI3CgMEBglghkgBhvhCBAEGCysGAQQB\n"
+    "gjcKAwQBBggrBgEFBQcDBQYIKwYBBQUHAwYGCCsGAQUFBwMHBggrBgEFBQgCAgYK\n"
+    "KwYBBAGCNxQCAgYIKwYBBQUHAwkGCCsGAQUFBwMNBggrBgEFBQcDDgYHKwYBBQID\n"
+    "BTANBgkqhkiG9w0BAQsFAAOCAQEAawdHy0Xw7nTK2ltp91Ion6fJ7hqYuj///zr7\n"
+    "Adt6uonpDh/xl3esuwcFimIJrJrHujnGkL0nLddRCikmnzuBMNDWS6yq0/Ckl/YG\n"
+    "yjNr44dlX24wo+MVAgkj3/8CyWDZ3a8kBg9QT3bs2SqbjmhTrXN1DRyf9S5vJysE\n"
+    "I7V1gTN66BeKL64hOrAlRVrEu8Ds6TWL6Q/YH+61ViZkoLTeSaPjH4nknaFr4C35\n"
+    "iji0JhkyfRHRRVPHFnaj25AkxOrSV64qVKoTMjDl5fji5iMGtjm6iJ7q05ml/qDl\n"
+    "nLotHXemZNvYhbwUmRzbt4Dls9EMH4VRbP85I94nM5TAvtHVNA==\n"
+    "-----END CERTIFICATE-----\n";
+
+static const char *AUTH_IDENTITY_CA =
+    "data:,-----BEGIN CERTIFICATE-----\n"
+    "MIIEmTCCA4GgAwIBAgIIZ5gEIUFhO5wwDQYJKoZIhvcNAQELBQAwXzELMAkGA1UE\n"
+    "BhMCTkwxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdp\n"
+    "ZGdpdHMgUHR5IEx0ZDEYMBYGA1UEAxMPQ0hBTTUwMCByb290IGNhMCAXDTE4MDIx\n"
+    "MjE1MDUwMFoYDzIyMjIwMjIyMjIyMjAwWjBfMQswCQYDVQQGEwJOTDETMBEGA1UE\n"
+    "CBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRk\n"
+    "MRgwFgYDVQQDEw9DSEFNNTAwIHJvb3QgY2EwggEiMA0GCSqGSIb3DQEBAQUAA4IB\n"
+    "DwAwggEKAoIBAQC6Fa3TheL+UrdZCp9GhU/2WbneP2t/avUa3muwDttPxeI2XU9k\n"
+    "ZjBR95mAXme4SPXHk5+YDN319AqIje3oKhzky/ngvKH2GkoJKYxWnuDBfMEHdViz\n"
+    "2Q9/xso2ZvH50ukwWa0pfx2/EVV1wRxeQcRd/UVfq3KTJizG0M88mOYvGEAw3LFf\n"
+    "zef7k1aCuOofQmBvLukUudcYpMzfyHFp7lQqU4CcrrR5RtmfiUfrWfdGLea2iPDB\n"
+    "pJgN8ESOMwEHtOTEBDclYnH9L4t7CHQz+fXXS5IWFsDK9fCMQjnxDsDVeNrNzTYL\n"
+    "FaZrMg9S6IUQCEsQWsnq5weS8omOpVLUm9klAgMBAAGjggFVMIIBUTAMBgNVHRME\n"
+    "BTADAQH/MB0GA1UdDgQWBBQg2FZB/j8uWDVnJhjwXkX278znSTAfBgNVHSMEGDAW\n"
+    "gBQg2FZB/j8uWDVnJhjwXkX278znSTAPBgNVHQ8BAf8EBQMDB/+AMIHvBgNVHSUB\n"
+    "Af8EgeQwgeEGCCsGAQUFBwMBBggrBgEFBQcDAgYIKwYBBQUHAwMGCCsGAQUFBwME\n"
+    "BggrBgEFBQcDCAYKKwYBBAGCNwIBFQYKKwYBBAGCNwIBFgYKKwYBBAGCNwoDAQYK\n"
+    "KwYBBAGCNwoDAwYKKwYBBAGCNwoDBAYJYIZIAYb4QgQBBgsrBgEEAYI3CgMEAQYI\n"
+    "KwYBBQUHAwUGCCsGAQUFBwMGBggrBgEFBQcDBwYIKwYBBQUIAgIGCisGAQQBgjcU\n"
+    "AgIGCCsGAQUFBwMJBggrBgEFBQcDDQYIKwYBBQUHAw4GBysGAQUCAwUwDQYJKoZI\n"
+    "hvcNAQELBQADggEBAKHmwejWRwGE1wf1k2rG8SNRV/neGsZ6Qfqf6co3TpR/Wi1s\n"
+    "iZDvSeT/rbqNBS7z34xnG88NIUwu00y78e8Mfon31ZZbK4Uo7fla9/D3ukdJqPQC\n"
+    "LKdbKJjR2kH+KCukY/1rghjJ8/X+t2egBit0LCOdsFCl07Sfksb9kpGUIZSFcYYm\n"
+    "geqhjhoNwxazzHiw+QWHC5HG9248JIizBmy1aymNWuMnPudhjHAnPcsIlqMVNq3t\n"
+    "Rv9ap7S8JeCxHVRPJvJeCwXWvW3dW/v3xH52Yn/fqRblN1w9Fxz5NhopKx0gj/Jd\n"
+    "sw2N4Fk4gaOWEolFpa0bwNw8nAx7moehZpowzfw=\n"
+    "-----END CERTIFICATE-----\n";
+
+static const char *AUTH_PRIVATE_KEY =
+    "data:,-----BEGIN RSA PRIVATE KEY-----\n"
+    "MIIEogIBAAKCAQEAwqVYYrx/8ASMru+K70J3J0maisrKTegrw9aZlfcH7eTx4Vbf\n"
+    "Y1e/b4Erm+SwA6ERwIBXb/XbmIAa9ezm+rkayGOAdfAnKwo4UHAuII8fMto5fT3m\n"
+    "JvqmA96OOBWAawatEAp60ICrG/6l/WfjMP1VIsOucevFvO+ixB0EKBIE+JMUrmoM\n"
+    "AaFUZHjw+n2ACpk+F0t8fjtL/qxxEk3LChesjGnYKe4d3h9W/JCU80sfCVfWc6vv\n"
+    "psY6MaoWwVT+Zw83toYUiHgpAr0q8e3n5ICkuAEF2uf2eOBogLtU3111KnYnPa8c\n"
+    "A9HnZ2ozRJZ2Xu7I6JP9Mrqrx/toUqqTb2v86QIDAQABAoIBAC1q32DKkx+yMBFx\n"
+    "m32QiLUGG6VfBC2BixS7MkMnzRXZYgcuehl4FBc0kLRjfB6cqsO8LqrVN1QyMBhK\n"
+    "GutN3c38SbE7RChqzhEW2+yE+Mao3Nk4ZEecHLiyaYT0n25ZtHAVwep823BAzwJ+\n"
+    "BykbM45VEpNKbG1VjSktjBa9faNyZiZAEJEjVyla+6R8N4kHV52LbZcLjvJv3IQ2\n"
+    "iPYRrmMyI5C23qTni0vy7yJbAXBo3CqgSlwie9FARBWT7Puu7F4mF1O1c/SnTysw\n"
+    "Tm3e5FzgfHipQbnRVn0w4rDprPMKmPxMnvf/Wkw0zVgNadp1Tc1I6Yj525DEQ07i\n"
+    "2gIn/gECgYEA4jNnY1u2Eu7x3pAQF3dRO0x35boVtuq9iwQk7q+uaZaK4RJRr+0Y\n"
+    "T68S3bPnfer6SHvcxtST89Bvs/j/Ky4SOaX037UYjFh6T7OIzPl+MzO1yb+VOBT6\n"
+    "D6FVGEJGp8ZAITU1OfJPeTYViUeEC8tHFGoKUCk50FbB6jOf1oKtv/ECgYEA3EnB\n"
+    "Y7kSbJJaUuj9ciFUL/pAno86Cim3VjegK1wKgEiyDb610bhoMErovPwfVJbtcttG\n"
+    "eKJNuwizkRcVbj+vpjDvqqaP5eMxLl6/Nd4haPMJYzGo88Z8NJpwFRNF2KEWjOpQ\n"
+    "2NEvoCeRtVulCJyka2Tpljzw8cOXkxhPOe2UhHkCgYBo3entj0QO7QXm56T+LAvV\n"
+    "0PK45xdQEO3EuCwjGAFk5C0IgUSrqeCeeIzniZMltj1IQ1wsNbtNynEu3530t8wt\n"
+    "O7oVyFBUKGSz9IjUdkpClJOPr6kPMfJoMqRPtdIpz+hFPPSrI6IikKdVWHloOlp+\n"
+    "pVaYqTQrWT1XRY2xli3VEQKBgGySmZN6Cx+h/oywswIGdUT0VdcQhq2to+QFpJba\n"
+    "VX6m1cM6hMip2Ag9U3qZ1SNPBBdBBfm9HQybHE3dj713/C2wHuAAGhpXIM1W+20k\n"
+    "X1knuC/AsSH9aQhQOf/ZMOq1crTfZBuI9q0782/sjGmzMsKPySU4QhUWruVb7OiD\n"
+    "NVkZAoGAEvihW7G+8/iOE40vGHyBqUeopAAWLciTAUIEwM/Oi3BYfNWNTWF/FWNc\n"
+    "nMvCZPYigY8C1vO+1iT2Frtd3CIU+f01Q3fJNJoRLlEiKLNZUJRF48OKUqjKSmsi\n"
+    "w6pucFO40z05YW7utApj4L82rZnOS0pd1tUI1yexqvj0i4ThJfk=\n"
+    "-----END RSA PRIVATE KEY-----\n";
+
+static struct plugins_hdl *g_plugins = NULL;
+static dds_security_authentication *g_auth = NULL;
+static dds_security_access_control *g_access_control = NULL;
+static char *g_path_to_etc_dir = NULL;
+
+/* Prepare a property sequence. */
+static void dds_security_property_init(DDS_Security_PropertySeq *seq, DDS_Security_unsigned_long size)
+{
+  seq->_length = size;
+  seq->_maximum = size;
+  seq->_buffer = ddsrt_malloc(size * sizeof(DDS_Security_Property_t));
+  memset(seq->_buffer, 0, size * sizeof(DDS_Security_Property_t));
+}
+
+/* Cleanup a property sequence.*/
+static void dds_security_property_deinit(DDS_Security_PropertySeq *seq)
+{
+  uint32_t i;
+
+  for (i = 0; i < seq->_length; i++)
+  {
+    ddsrt_free(seq->_buffer[i].name);
+    ddsrt_free(seq->_buffer[i].value);
+  }
+  ddsrt_free(seq->_buffer);
+}
+
+/* Find a property within a sequence.*/
+static DDS_Security_Property_t *dds_security_property_find(DDS_Security_PropertySeq *seq, const char *name)
+{
+  DDS_Security_Property_t *prop = NULL;
+  uint32_t i;
+  for (i = 0; (i < seq->_length) && (prop == NULL); i++)
+  {
+    if (strcmp(seq->_buffer[i].name, name) == 0)
+    {
+      prop = &(seq->_buffer[i]);
+    }
+  }
+  return prop;
+}
+
+/* Cleanup exception contents.*/
+static void reset_exception(DDS_Security_SecurityException *ex)
+{
+  ex->code = 0;
+  ex->minor_code = 0;
+  ddsrt_free(ex->message);
+  ex->message = NULL;
+}
+
+/* Glue two strings together */
+static char *combine_strings(const char *prefix, const char *postfix)
+{
+  char *str;
+  ddsrt_asprintf(&str, "%s%s", prefix, postfix);
+  return str;
+}
+
+/* Use the given file to create a proper file uri (with directory).*/
+static char *create_uri_file(const char *file)
+{
+  char *uri;
+  char *dir;
+  if (file)
+  {
+    dir = combine_strings("file:", g_path_to_etc_dir);
+    uri = combine_strings(dir, file);
+    ddsrt_free(dir);
+  }
+  else
+  {
+    uri = ddsrt_strdup("file:");
+  }
+  return uri;
+}
+
+/* Read the given file contents and transform it into a data uri.*/
+static char *create_uri_data(const char *file)
+{
+  char *data = NULL;
+  char *location;
+  char *contents;
+
+  if (file)
+  {
+    location = combine_strings(g_path_to_etc_dir, file);
+    if (location)
+    {
+      contents = load_file_contents(location);
+      if (contents)
+      {
+        data = combine_strings("data:,", contents);
+        ddsrt_free(contents);
+      }
+      ddsrt_free(location);
+    }
+  }
+  else
+  {
+    data = ddsrt_strdup("data:,");
+  }
+
+  return data;
+}
+
+/* Fill the security properties of a participant QoS with the
+ * authorization and access_control values. */
+static void fill_property_policy(DDS_Security_PropertyQosPolicy *property, const char *permission_ca, const char *permission_uri, const char *governance_uri)
+{
+  dds_security_property_init(&property->value, 6);
+  /* Authentication properties. */
+  property->value._buffer[0].name = ddsrt_strdup(PROPERTY_IDENTITY_CERT);
+  property->value._buffer[0].value = ddsrt_strdup(AUTH_IDENTITY_CERT);
+  property->value._buffer[1].name = ddsrt_strdup(PROPERTY_IDENTITY_CA);
+  property->value._buffer[1].value = ddsrt_strdup(AUTH_IDENTITY_CA);
+  property->value._buffer[2].name = ddsrt_strdup(PROPERTY_PRIVATE_KEY);
+  property->value._buffer[2].value = ddsrt_strdup(AUTH_PRIVATE_KEY);
+  /* AccessControl properties. */
+  property->value._buffer[3].name = ddsrt_strdup(PROPERTY_PERMISSIONS_CA);
+  property->value._buffer[3].value = permission_ca ? ddsrt_strdup(permission_ca) : NULL;
+  property->value._buffer[4].name = ddsrt_strdup(PROPERTY_PERMISSIONS);
+  property->value._buffer[4].value = permission_uri ? ddsrt_strdup(permission_uri) : NULL;
+  property->value._buffer[5].name = ddsrt_strdup(PROPERTY_GOVERNANCE);
+  property->value._buffer[5].value = governance_uri ? ddsrt_strdup(governance_uri) : NULL;
+}
+
+/* Open a local identity by calling the authorization plugin with
+ * properly created dummy values and the given participant QoS.*/
+static DDS_Security_IdentityHandle create_local_identity(DDS_Security_Qos *participant_qos)
+{
+  DDS_Security_IdentityHandle local_id_hdl = DDS_SECURITY_HANDLE_NIL;
+  DDS_Security_ValidationResult_t result;
+  DDS_Security_DomainId domain_id = 0;
+  DDS_Security_GUID_t local_participant_guid;
+  DDS_Security_GUID_t candidate_participant_guid;
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  DDS_Security_GuidPrefix_t prefix = {0xb0, 0xb1, 0xb2, 0xb3, 0xb4, 0xb5, 0xb6, 0xb7, 0xb8, 0xb9, 0xba, 0xbb};
+  DDS_Security_EntityId_t entityId = {{0xb0, 0xb1, 0xb2}, 0x1};
+
+  CU_ASSERT_FATAL(g_auth->validate_local_identity != NULL);
+
+  memset(&local_participant_guid, 0, sizeof(local_participant_guid));
+  memcpy(&candidate_participant_guid.prefix, &prefix, sizeof(prefix));
+  memcpy(&candidate_participant_guid.entityId, &entityId, sizeof(entityId));
+
+  /* Now call the function. */
+  result = g_auth->validate_local_identity(
+      g_auth,
+      &local_id_hdl,
+      &local_participant_guid,
+      domain_id,
+      participant_qos,
+      &candidate_participant_guid,
+      &exception);
+
+  if (result != DDS_SECURITY_VALIDATION_OK)
+  {
+    printf("validate_local_identity_failed: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+
+  reset_exception(&exception);
+
+  return local_id_hdl;
+}
+
+/* Close the given local identity by returning its handle to the
+ * authorization plugin.*/
+static void clear_local_identity(DDS_Security_IdentityHandle local_id_hdl)
+{
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  DDS_Security_boolean success;
+
+  if (local_id_hdl != DDS_SECURITY_HANDLE_NIL)
+  {
+    success = g_auth->return_identity_handle(g_auth, local_id_hdl, &exception);
+    if (!success)
+    {
+      printf("return_identity_handle failed: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+    reset_exception(&exception);
+  }
+}
+
+/* Prepare the global link to the test's "etc" directory.*/
+static void set_path_to_etc_dir(void)
+{
+  ddsrt_asprintf(&g_path_to_etc_dir, "%s%s", CONFIG_ENV_TESTS_DIR, RELATIVE_PATH_TO_ETC_DIR);
+}
+
+/* Initialize the participant QoS with security related properties.
+ * It will transform the given files into proper uri's.
+ * A NULL will result in a file uri without actual link.*/
+static void qos_init_file(DDS_Security_Qos *participant_qos, const char *certificate_filename, const char *permission_filename, const char *governance_filename)
+{
+  char *permission_ca;
+  char *permission_uri;
+  char *governance_uri;
+
+  permission_ca = create_uri_file(certificate_filename);
+  permission_uri = create_uri_file(permission_filename);
+  governance_uri = create_uri_file(governance_filename);
+
+  memset(participant_qos, 0, sizeof(*participant_qos));
+  fill_property_policy(&(participant_qos->property),
+                       permission_ca,
+                       permission_uri,
+                       governance_uri);
+
+  ddsrt_free(permission_ca);
+  ddsrt_free(permission_uri);
+  ddsrt_free(governance_uri);
+}
+
+/* Initialize the participant QoS with security related properties.
+ * It will transform the given files into data uri's.
+ * A NULL will result in a data uri without actual data.*/
+static void qos_init_data(DDS_Security_Qos *participant_qos, const char *certificate_filename, const char *permission_filename, const char *governance_filename)
+{
+  char *permission_ca;
+  char *permission_uri;
+  char *governance_uri;
+
+  permission_ca = create_uri_data(certificate_filename);
+  permission_uri = create_uri_data(permission_filename);
+  governance_uri = create_uri_data(governance_filename);
+  CU_ASSERT_FATAL(permission_ca != NULL);
+  CU_ASSERT_FATAL(permission_uri != NULL);
+  CU_ASSERT_FATAL(governance_uri != NULL);
+
+  memset(participant_qos, 0, sizeof(*participant_qos));
+  fill_property_policy(&(participant_qos->property),
+                       permission_ca,
+                       permission_uri,
+                       governance_uri);
+
+  ddsrt_free(permission_ca);
+  ddsrt_free(permission_uri);
+  ddsrt_free(governance_uri);
+}
+
+/* Initialize the participant QoS with security related properties.
+ * A NULL will result in an uri with an unknown type.*/
+static void qos_init_type(DDS_Security_Qos *participant_qos, const char *certificate_filename, const char *permission_filename, const char *governance_filename)
+{
+  char *permission_ca;
+  char *permission_uri;
+  char *governance_uri;
+
+  if (certificate_filename)
+    permission_ca = create_uri_file(certificate_filename);
+  else
+    permission_ca = ddsrt_strdup("unknown_type:,just some data");
+  if (permission_filename)
+    permission_uri = create_uri_file(permission_filename);
+  else
+    permission_uri = ddsrt_strdup("unknown_type:,just some data");
+  if (governance_filename)
+    governance_uri = create_uri_file(governance_filename);
+  else
+    governance_uri = ddsrt_strdup("unknown_type:,just some data");
+
+  memset(participant_qos, 0, sizeof(*participant_qos));
+  fill_property_policy(&(participant_qos->property),
+                       permission_ca,
+                       permission_uri,
+                       governance_uri);
+
+  ddsrt_free(permission_ca);
+  ddsrt_free(permission_uri);
+  ddsrt_free(governance_uri);
+}
+
+/* Initialize the participant QoS with security related properties.
+ * Allow NULL as property value.*/
+static void qos_init_null(DDS_Security_Qos *participant_qos, const char *certificate_filename, const char *permission_filename, const char *governance_filename)
+{
+  char *permission_ca = NULL;
+  char *permission_uri = NULL;
+  char *governance_uri = NULL;
+
+  if (certificate_filename)
+    permission_ca = create_uri_file(certificate_filename);
+  if (permission_filename)
+    permission_uri = create_uri_file(permission_filename);
+  if (governance_filename)
+    governance_uri = create_uri_file(governance_filename);
+
+  memset(participant_qos, 0, sizeof(*participant_qos));
+  fill_property_policy(&(participant_qos->property),
+                       permission_ca,
+                       permission_uri,
+                       governance_uri);
+
+  ddsrt_free(permission_ca);
+  ddsrt_free(permission_uri);
+  ddsrt_free(governance_uri);
+}
+
+/* Cleanup the participant QoS.*/
+static void qos_deinit(DDS_Security_Qos *participant_qos)
+{
+  dds_security_property_deinit(&(participant_qos->property.value));
+}
+
+/* Setup the testing environment by loading the plugins and
+ * creating a local identity.*/
+static DDS_Security_IdentityHandle test_setup(DDS_Security_Qos *participant_qos)
+{
+  DDS_Security_IdentityHandle local_id_hdl = DDS_SECURITY_HANDLE_NIL;
+
+  g_plugins = load_plugins(&g_access_control /* Access Control */,
+                           &g_auth /* Authentication */,
+                           NULL /* Cryptograpy    */);
+  if (g_plugins)
+  {
+    CU_ASSERT_FATAL(g_auth != NULL);
+    CU_ASSERT_FATAL(g_access_control != NULL);
+    CU_ASSERT_FATAL(g_access_control->validate_local_permissions != NULL);
+    CU_ASSERT_FATAL(g_access_control->return_permissions_handle != NULL);
+
+    local_id_hdl = create_local_identity(participant_qos);
+  }
+
+  return local_id_hdl;
+}
+
+/* Teardown the testing environment by clearing the local identity
+ * and closing the plugins.*/
+static int test_teardown(DDS_Security_IdentityHandle local_id_hdl)
+{
+  clear_local_identity(local_id_hdl);
+  unload_plugins(g_plugins);
+  g_plugins = NULL;
+  g_access_control = NULL;
+  g_auth = NULL;
+  return 0;
+}
+
+/* The AccessControl related properties in the participant_qos will
+ * have some kind of problem that should force a failure when
+ * checking the local permissions.*/
+static DDS_Security_long test_failure_scenario(DDS_Security_Qos *participant_qos)
+{
+  DDS_Security_long code = DDS_SECURITY_ERR_OK_CODE;
+  DDS_Security_IdentityHandle local_id_hdl = DDS_SECURITY_HANDLE_NIL;
+  DDS_Security_PermissionsHandle result;
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+
+  /* Prepare testing environment. */
+  local_id_hdl = test_setup(participant_qos);
+  CU_ASSERT_FATAL(local_id_hdl != DDS_SECURITY_HANDLE_NIL);
+
+  /* Call the plugin with the invalid property. */
+  result = g_access_control->validate_local_permissions(
+      g_access_control,
+      g_auth,
+      local_id_hdl,
+      0,
+      participant_qos,
+      &exception);
+
+  /* Be sure the plugin returned a failure. */
+  CU_ASSERT(result == 0);
+  if (result == 0)
+  {
+    code = exception.code;
+    CU_ASSERT(exception.message != NULL);
+    printf("validate_local_permissions failed: (%d) %s\n", (int)exception.code, exception.message ? exception.message : "Error message missing");
+  }
+  else
+  {
+    reset_exception(&exception);
+    g_access_control->return_permissions_handle(g_access_control, result, &exception);
+  }
+  reset_exception(&exception);
+
+  /* Cleanup the testing environment. */
+  test_teardown(local_id_hdl);
+
+  return code;
+}
+
+/* Use with invalid file link for certificate, permission or
+ * governance. The local permissions check should fail.*/
+static DDS_Security_long test_invalid_file_uri(const char *certificate_filename, const char *permission_filename, const char *governance_filename)
+{
+  DDS_Security_long code = DDS_SECURITY_ERR_OK_CODE;
+  DDS_Security_Qos participant_qos;
+
+  qos_init_file(&participant_qos,
+                certificate_filename,
+                permission_filename,
+                governance_filename);
+
+  code = test_failure_scenario(&participant_qos);
+
+  qos_deinit(&participant_qos);
+
+  return code;
+}
+
+/* Use with invalid data for certificate, permission or governance.
+ * The local permissions check should fail.*/
+static DDS_Security_long test_invalid_data_uri(const char *certificate_filename, const char *permission_filename, const char *governance_filename)
+{
+  DDS_Security_long code = DDS_SECURITY_ERR_OK_CODE;
+  DDS_Security_Qos participant_qos;
+
+  qos_init_data(&participant_qos,
+                certificate_filename,
+                permission_filename,
+                governance_filename);
+
+  code = test_failure_scenario(&participant_qos);
+
+  qos_deinit(&participant_qos);
+
+  return code;
+}
+
+/* Generate uri's with invalid types for certificate, permission
+ * or governance. The local permissions check should fail.*/
+static DDS_Security_long test_invalid_type_uri(const char *certificate_filename, const char *permission_filename, const char *governance_filename)
+{
+  DDS_Security_long code = DDS_SECURITY_ERR_OK_CODE;
+  DDS_Security_Qos participant_qos;
+
+  qos_init_type(&participant_qos,
+                certificate_filename,
+                permission_filename,
+                governance_filename);
+
+  code = test_failure_scenario(&participant_qos);
+  qos_deinit(&participant_qos);
+  return code;
+}
+
+/* Create properties in the QoS without actual values (NULL).
+ * The local permissions check should fail.*/
+static DDS_Security_long test_null_uri(const char *certificate_filename, const char *permission_filename, const char *governance_filename)
+{
+  DDS_Security_long code = DDS_SECURITY_ERR_OK_CODE;
+  DDS_Security_Qos participant_qos;
+
+  qos_init_null(&participant_qos,
+                certificate_filename,
+                permission_filename,
+                governance_filename);
+
+  code = test_failure_scenario(&participant_qos);
+
+  qos_deinit(&participant_qos);
+
+  return code;
+}
+
+/* Get valid documents, but corrupt the signatures.
+ * The local permissions check should fail.*/
+static DDS_Security_long test_corrupted_signature(bool corrupt_permissions, bool corrupt_governance)
+{
+  DDS_Security_long code = DDS_SECURITY_ERR_OK_CODE;
+  DDS_Security_Property_t *prop = NULL;
+  DDS_Security_Qos participant_qos;
+  size_t len;
+
+  /* Get data with valid signatures. */
+  qos_init_data(&participant_qos,
+                "Test_Permissions_ca.pem",
+                "Test_Permissions_full.p7s",
+                "Test_Governance_full.p7s");
+
+  /* Only allow one signature to be corrupted. */
+  CU_ASSERT_FATAL(corrupt_permissions != corrupt_governance);
+
+  /* Corrupt the signature. */
+  if (corrupt_permissions)
+    prop = dds_security_property_find(&(participant_qos.property.value), PROPERTY_PERMISSIONS);
+  if (corrupt_governance)
+    prop = dds_security_property_find(&(participant_qos.property.value), PROPERTY_GOVERNANCE);
+
+  /* Just some (hardcoded) sanity checks. */
+  CU_ASSERT_FATAL(prop != NULL);
+  CU_ASSERT_FATAL(prop->value != NULL);
+  len = strlen(prop->value);
+  CU_ASSERT_FATAL(len > 2250);
+
+  /* Corrupt a byte somewhere in the signature. */
+  prop->value[len - 75]--;
+
+  code = test_failure_scenario(&participant_qos);
+  qos_deinit(&participant_qos);
+  return code;
+}
+
+static void suite_validate_local_permissions_init(void)
+{
+  set_path_to_etc_dir();
+}
+
+static void suite_validate_local_permissions_fini(void)
+{
+  ddsrt_free(g_path_to_etc_dir);
+}
+
+/* Supplying proper files should pass the local permissions check */
+CU_Test(ddssec_builtin_validate_local_permissions, valid_file, .init = suite_validate_local_permissions_init, .fini = suite_validate_local_permissions_fini)
+{
+  DDS_Security_IdentityHandle local_id_hdl = DDS_SECURITY_HANDLE_NIL;
+  DDS_Security_PermissionsHandle result;
+  DDS_Security_Qos participant_qos;
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+
+  qos_init_file(&participant_qos,
+                "Test_Permissions_ca.pem",
+                "Test_Permissions_full.p7s",
+                "Test_Governance_full.p7s");
+  local_id_hdl = test_setup(&participant_qos);
+  CU_ASSERT_FATAL(local_id_hdl != DDS_SECURITY_HANDLE_NIL);
+
+  result = g_access_control->validate_local_permissions(
+      g_access_control,
+      g_auth,
+      local_id_hdl,
+      0,
+      &participant_qos,
+      &exception);
+
+  CU_ASSERT(result != 0);
+  if (result == 0)
+  {
+    printf("validate_local_permissions_failed: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+  else
+  {
+    g_access_control->return_permissions_handle(g_access_control, result, &exception);
+  }
+  reset_exception(&exception);
+
+  test_teardown(local_id_hdl);
+  qos_deinit(&participant_qos);
+}
+
+/* Supplying proper data should pass the local permissions check */
+CU_Test(ddssec_builtin_validate_local_permissions, valid_data, .init = suite_validate_local_permissions_init, .fini = suite_validate_local_permissions_fini)
+{
+  DDS_Security_IdentityHandle local_id_hdl = DDS_SECURITY_HANDLE_NIL;
+  DDS_Security_PermissionsHandle result;
+  DDS_Security_Qos participant_qos;
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+
+  qos_init_data(&participant_qos,
+                "Test_Permissions_ca.pem",
+                "Test_Permissions_full.p7s",
+                "Test_Governance_full.p7s");
+  local_id_hdl = test_setup(&participant_qos);
+  CU_ASSERT(local_id_hdl != DDS_SECURITY_HANDLE_NIL);
+
+  result = g_access_control->validate_local_permissions(
+      g_access_control,
+      g_auth,
+      local_id_hdl,
+      0,
+      &participant_qos,
+      &exception);
+
+  CU_ASSERT(result != 0);
+  if (result == 0)
+  {
+    printf("validate_local_permissions_failed: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+  else
+  {
+    g_access_control->return_permissions_handle(g_access_control, result, &exception);
+  }
+  reset_exception(&exception);
+
+  test_teardown(local_id_hdl);
+  qos_deinit(&participant_qos);
+}
+
+/* Supplying no files but directories should fail the local permissions check. */
+CU_Test(ddssec_builtin_validate_local_permissions, uri_directories, .init = suite_validate_local_permissions_init, .fini = suite_validate_local_permissions_fini)
+{
+  DDS_Security_long code;
+
+  /* Certificate points to a valid directory.*/
+  code = test_invalid_file_uri("",
+                               "Test_Permissions_full.p7s",
+                               "Test_Governance_full.p7s");
+  CU_ASSERT(code == DDS_SECURITY_ERR_INVALID_FILE_PATH_CODE);
+
+  /* Permission points to a valid directory. */
+  code = test_invalid_file_uri("Test_Permissions_ca.pem",
+                               "",
+                               "Test_Governance_full.p7s");
+  CU_ASSERT(code == DDS_SECURITY_ERR_INVALID_FILE_PATH_CODE);
+
+  /* Governance points to a valid directory.*/
+  code = test_invalid_file_uri("Test_Permissions_ca.pem",
+                               "Test_Permissions_full.p7s",
+                               "");
+  CU_ASSERT(code == DDS_SECURITY_ERR_INVALID_FILE_PATH_CODE);
+}
+
+/* Supplying empty files should fail the local permissions check. */
+CU_Test(ddssec_builtin_validate_local_permissions, uri_empty_files, .init = suite_validate_local_permissions_init, .fini = suite_validate_local_permissions_fini)
+{
+  DDS_Security_long code;
+
+  /* Certificate points to an empty file. */
+  code = test_invalid_file_uri("Test_File_empty.txt",
+                               "Test_Permissions_full.p7s",
+                               "Test_Governance_full.p7s");
+  CU_ASSERT(code == DDS_SECURITY_ERR_INVALID_FILE_PATH_CODE);
+
+  /* Permission points to an empty file. */
+  code = test_invalid_file_uri("Test_Permissions_ca.pem",
+                               "Test_File_empty.txt",
+                               "Test_Governance_full.p7s");
+  CU_ASSERT(code == DDS_SECURITY_ERR_INVALID_FILE_PATH_CODE);
+
+  /* Governance points to an empty file. */
+  code = test_invalid_file_uri("Test_Permissions_ca.pem",
+                               "Test_Permissions_full.p7s",
+                               "Test_File_empty.txt");
+  CU_ASSERT(code == DDS_SECURITY_ERR_INVALID_FILE_PATH_CODE);
+}
+
+/* Supplying text files should fail the local permissions check. */
+CU_Test(ddssec_builtin_validate_local_permissions, uri_text_files, .init = suite_validate_local_permissions_init, .fini = suite_validate_local_permissions_fini)
+{
+  DDS_Security_long code;
+
+  /* Certificate points to a file with only text. */
+  code = test_invalid_file_uri("Test_File_text.txt",
+                               "Test_Permissions_full.p7s",
+                               "Test_Governance_full.p7s");
+  CU_ASSERT(code == DDS_SECURITY_ERR_INVALID_CERTIFICATE_CODE);
+
+  /* Permission points to a file with only text. */
+  code = test_invalid_file_uri("Test_Permissions_ca.pem",
+                               "Test_File_text.txt",
+                               "Test_Governance_full.p7s");
+  CU_ASSERT(code == DDS_SECURITY_ERR_INVALID_SMIME_DOCUMENT_CODE);
+
+  /* Governance points to a file with only text. */
+  code = test_invalid_file_uri("Test_Permissions_ca.pem",
+                               "Test_Permissions_full.p7s",
+                               "Test_File_text.txt");
+  CU_ASSERT(code == DDS_SECURITY_ERR_INVALID_SMIME_DOCUMENT_CODE);
+}
+
+/* Not supplying files should fail the local permissions check. */
+CU_Test(ddssec_builtin_validate_local_permissions, uri_absent_files, .init = suite_validate_local_permissions_init, .fini = suite_validate_local_permissions_fini)
+{
+  DDS_Security_long code;
+
+  /* Certificate points to a non-existing file.*/
+  code = test_invalid_file_uri("Test_File_absent.txt",
+                               "Test_Permissions_full.p7s",
+                               "Test_Governance_full.p7s");
+  CU_ASSERT(code == DDS_SECURITY_ERR_INVALID_FILE_PATH_CODE);
+
+  /* Permission points to a non-existing file.*/
+  code = test_invalid_file_uri("Test_Permissions_ca.pem",
+                               "Test_File_absent.txt",
+                               "Test_Governance_full.p7s");
+  CU_ASSERT(code == DDS_SECURITY_ERR_INVALID_FILE_PATH_CODE);
+
+  /* Governance points to a non-existing file.*/
+  code = test_invalid_file_uri("Test_Permissions_ca.pem",
+                               "Test_Permissions_full.p7s",
+                               "Test_File_absent.txt");
+  CU_ASSERT(code == DDS_SECURITY_ERR_INVALID_FILE_PATH_CODE);
+}
+
+/* Not supplying file uris should fail the local permissions check. */
+CU_Test(ddssec_builtin_validate_local_permissions, uri_no_files, .init = suite_validate_local_permissions_init, .fini = suite_validate_local_permissions_fini)
+{
+  DDS_Security_long code;
+
+  /* Certificate file uri doesn't point to anything.*/
+  code = test_invalid_file_uri(NULL,
+                               "Test_Permissions_full.p7s",
+                               "Test_Governance_full.p7s");
+  CU_ASSERT(code == DDS_SECURITY_ERR_INVALID_FILE_PATH_CODE);
+
+  /* Permission file uri doesn't point to anything.*/
+  code = test_invalid_file_uri("Test_Permissions_ca.pem",
+                               NULL,
+                               "Test_Governance_full.p7s");
+  CU_ASSERT(code == DDS_SECURITY_ERR_INVALID_FILE_PATH_CODE);
+
+  /* Governance file uri doesn't point to anything.*/
+  code = test_invalid_file_uri("Test_Permissions_ca.pem",
+                               "Test_Permissions_full.p7s",
+                               NULL);
+  CU_ASSERT(code == DDS_SECURITY_ERR_INVALID_FILE_PATH_CODE);
+}
+
+/* Supplying empty data should fail the local permissions check. */
+CU_Test(ddssec_builtin_validate_local_permissions, uri_empty_data, .init = suite_validate_local_permissions_init, .fini = suite_validate_local_permissions_fini)
+{
+  DDS_Security_long code;
+
+  /* Certificate is empty data.*/
+  code = test_invalid_data_uri(NULL,
+                               "Test_Permissions_full.p7s",
+                               "Test_Governance_full.p7s");
+  CU_ASSERT(code == DDS_SECURITY_ERR_INVALID_CERTIFICATE_CODE);
+
+  /* Permission is empty data.*/
+  code = test_invalid_data_uri("Test_Permissions_ca.pem",
+                               NULL,
+                               "Test_Governance_full.p7s");
+  CU_ASSERT(code == DDS_SECURITY_ERR_INVALID_PERMISSION_DOCUMENT_PROPERTY_CODE);
+
+  /* Governance is empty data.*/
+  code = test_invalid_data_uri("Test_Permissions_ca.pem",
+                               "Test_Permissions_full.p7s",
+                               NULL);
+  CU_ASSERT(code == DDS_SECURITY_ERR_INVALID_GOVERNANCE_DOCUMENT_PROPERTY_CODE);
+}
+
+/* Supplying uris with invalid types should fail the local permissions check. */
+CU_Test(ddssec_builtin_validate_local_permissions, uri_invalid_types, .init = suite_validate_local_permissions_init, .fini = suite_validate_local_permissions_fini)
+{
+  DDS_Security_long code;
+
+  /* Certificate doesn't point to anything: results in invalid type.*/
+  code = test_invalid_type_uri(NULL,
+                               "Test_Permissions_full.p7s",
+                               "Test_Governance_full.p7s");
+  CU_ASSERT(code == DDS_SECURITY_ERR_CERTIFICATE_TYPE_NOT_SUPPORTED_CODE);
+
+  /* Permission doesn't point to anything: results in invalid type.*/
+  code = test_invalid_type_uri("Test_Permissions_ca.pem",
+                               NULL,
+                               "Test_Governance_full.p7s");
+  CU_ASSERT(code == DDS_SECURITY_ERR_URI_TYPE_NOT_SUPPORTED_CODE);
+
+  /* Governance doesn't point to anything: results in invalid type*/
+  code = test_invalid_type_uri("Test_Permissions_ca.pem",
+                               "Test_Permissions_full.p7s",
+                               NULL);
+  CU_ASSERT(code == DDS_SECURITY_ERR_URI_TYPE_NOT_SUPPORTED_CODE);
+}
+
+/* Not supplying actual uris should fail the local permissions check. */
+CU_Test(ddssec_builtin_validate_local_permissions, uri_null, .init = suite_validate_local_permissions_init, .fini = suite_validate_local_permissions_fini)
+{
+  DDS_Security_long code;
+
+  /* Certificate doesn't point to anything.*/
+  code = test_null_uri(NULL,
+                       "Test_Permissions_full.p7s",
+                       "Test_Governance_full.p7s");
+  CU_ASSERT(code == DDS_SECURITY_ERR_MISSING_PROPERTY_CODE);
+
+  /* Permission doesn't point to anything.*/
+  code = test_null_uri("Test_Permissions_ca.pem",
+                       NULL,
+                       "Test_Governance_full.p7s");
+  CU_ASSERT(code == DDS_SECURITY_ERR_MISSING_PROPERTY_CODE);
+
+  /* Governance doesn't point to anything.*/
+  code = test_null_uri("Test_Permissions_ca.pem",
+                       "Test_Permissions_full.p7s",
+                       NULL);
+  CU_ASSERT(code == DDS_SECURITY_ERR_MISSING_PROPERTY_CODE);
+}
+
+/* Corrupted signatures should fail the local permissions check. */
+CU_Test(ddssec_builtin_validate_local_permissions, corrupted_signatures, .init = suite_validate_local_permissions_init, .fini = suite_validate_local_permissions_fini)
+{
+  DDS_Security_long code;
+
+  /* Corrupt permission signature.*/
+  code = test_corrupted_signature(true /* Corrupt permissions? Yes. */,
+                                  false /* Corrupt governance?  No.  */);
+  CU_ASSERT(code == DDS_SECURITY_ERR_INVALID_SMIME_DOCUMENT_CODE);
+
+  /* Corrupt governance signature.*/
+  code = test_corrupted_signature(false /* Corrupt permissions? No.  */,
+                                  true /* Corrupt governance?  Yes. */);
+  CU_ASSERT(code == DDS_SECURITY_ERR_INVALID_SMIME_DOCUMENT_CODE);
+}
+
+/* Unknown signatures should fail the local permissions check. */
+CU_Test(ddssec_builtin_validate_local_permissions, unknown_ca, .init = suite_validate_local_permissions_init, .fini = suite_validate_local_permissions_fini)
+{
+  DDS_Security_long code;
+
+  /* Permission with unknown CA.*/
+  code = test_invalid_file_uri("Test_Permissions_ca.pem",
+                               "Test_Permissions_unknown_ca.p7s",
+                               "Test_Governance_full.p7s");
+  CU_ASSERT(code == DDS_SECURITY_ERR_INVALID_SMIME_DOCUMENT_CODE);
+
+  /* Governance with unknown CA.*/
+  code = test_invalid_file_uri("Test_Permissions_ca.pem",
+                               "Test_Permissions_full.p7s",
+                               "Test_Governance_unknown_ca.p7s");
+  CU_ASSERT(code == DDS_SECURITY_ERR_INVALID_SMIME_DOCUMENT_CODE);
+}
+
+/* Un-available signatures should fail the local permissions check. */
+CU_Test(ddssec_builtin_validate_local_permissions, not_signed, .init = suite_validate_local_permissions_init, .fini = suite_validate_local_permissions_fini)
+{
+  DDS_Security_long code;
+
+  /* Permission not signed.*/
+  code = test_invalid_file_uri("Test_Permissions_ca.pem",
+                               "Test_Permissions_not_signed.p7s",
+                               "Test_Governance_full.p7s");
+  CU_ASSERT(code == DDS_SECURITY_ERR_INVALID_SMIME_DOCUMENT_CODE);
+
+  /* Governance not signed.*/
+  code = test_invalid_file_uri("Test_Permissions_ca.pem",
+                               "Test_Permissions_full.p7s",
+                               "Test_Governance_not_signed.p7s");
+  CU_ASSERT(code == DDS_SECURITY_ERR_INVALID_SMIME_DOCUMENT_CODE);
+}
+
+/* Permissions outside the validity data should fail the local */
+CU_Test(ddssec_builtin_validate_local_permissions, validity, .init = suite_validate_local_permissions_init, .fini = suite_validate_local_permissions_fini)
+{
+  DDS_Security_long code;
+
+  /* Permission already expired.*/
+  code = test_invalid_file_uri("Test_Permissions_ca.pem",
+                               "Test_Permissions_expired.p7s",
+                               "Test_Governance_full.p7s");
+  CU_ASSERT(code == DDS_SECURITY_ERR_VALIDITY_PERIOD_EXPIRED_CODE);
+
+  /* Permission not yet valid.*/
+  code = test_invalid_file_uri("Test_Permissions_ca.pem",
+                               "Test_Permissions_notyet.p7s",
+                               "Test_Governance_full.p7s");
+  CU_ASSERT(code == DDS_SECURITY_ERR_VALIDITY_PERIOD_NOT_STARTED_CODE);
+}
+
+/* Permissions document does not contain a proper subject_name,
+ * which should fail the local permissions check. */
+CU_Test(ddssec_builtin_validate_local_permissions, subject_name, .init = suite_validate_local_permissions_init, .fini = suite_validate_local_permissions_fini)
+{
+  DDS_Security_long code;
+
+  /* Permission document with unknown subject. */
+  code = test_invalid_file_uri("Test_Permissions_ca.pem",
+                               "Test_Permissions_unknown_subject.p7s",
+                               "Test_Governance_check_create_participant.p7s");
+  CU_ASSERT(code == DDS_SECURITY_ERR_INVALID_SUBJECT_NAME_CODE);
+}
+
+/* Documents with invalid xml should fail the local permissions check. */
+CU_Test(ddssec_builtin_validate_local_permissions, xml_invalid, .init = suite_validate_local_permissions_init, .fini = suite_validate_local_permissions_fini)
+{
+  DDS_Security_long code;
+
+  /* Permission XML contains invalid domain id. */
+  code = test_invalid_file_uri("Test_Permissions_ca.pem",
+                               "Test_Permissions_invalid_data.p7s",
+                               "Test_Governance_ok.p7s");
+  CU_ASSERT(code == DDS_SECURITY_ERR_CAN_NOT_PARSE_PERMISSIONS_CODE);
+
+  /* Permission XML contains invalid domain id. */
+  code = test_invalid_file_uri("Test_Permissions_ca.pem",
+                               "Test_Permissions_invalid_element.p7s",
+                               "Test_Governance_ok.p7s");
+  CU_ASSERT(code == DDS_SECURITY_ERR_CAN_NOT_PARSE_PERMISSIONS_CODE);
+
+  /* Permission XML is missing the 'not before' validity tag.*/
+  code = test_invalid_file_uri("Test_Permissions_ca.pem",
+                               "Test_Permissions_lack_of_not_before.p7s",
+                               "Test_Governance_ok.p7s");
+  CU_ASSERT(code == DDS_SECURITY_ERR_CAN_NOT_PARSE_PERMISSIONS_CODE);
+
+  /* Permission XML is missing the 'not after' validity tag.*/
+  code = test_invalid_file_uri("Test_Permissions_ca.pem",
+                               "Test_Permissions_lack_of_not_after.p7s",
+                               "Test_Governance_ok.p7s");
+  CU_ASSERT(code == DDS_SECURITY_ERR_CAN_NOT_PARSE_PERMISSIONS_CODE);
+
+  /* Governance XML contains invalid encryption kind.*/
+  code = test_invalid_file_uri("Test_Permissions_ca.pem",
+                               "Test_Permissions_ok.p7s",
+                               "Test_Governance_invalid_data.p7s");
+  CU_ASSERT(code == DDS_SECURITY_ERR_CAN_NOT_PARSE_GOVERNANCE_CODE);
+
+  /* Governance XML contains unknown element.*/
+  code = test_invalid_file_uri("Test_Permissions_ca.pem",
+                               "Test_Permissions_ok.p7s",
+                               "Test_Governance_invalid_element.p7s");
+  CU_ASSERT(code == DDS_SECURITY_ERR_CAN_NOT_PARSE_GOVERNANCE_CODE);
+}
diff --git a/src/security/builtin_plugins/tests/validate_remote_permissions/etc/Test_Governance_ok.p7s b/src/security/builtin_plugins/tests/validate_remote_permissions/etc/Test_Governance_ok.p7s
new file mode 100644
index 0000000..c39903f
--- /dev/null
+++ b/src/security/builtin_plugins/tests/validate_remote_permissions/etc/Test_Governance_ok.p7s
@@ -0,0 +1,114 @@
+MIME-Version: 1.0
+Content-Type: multipart/signed; protocol="application/x-pkcs7-signature"; micalg="sha-256"; boundary="----DB94A190D9780A24156FB0E8F1E76B5F"
+
+This is an S/MIME signed message
+
+------DB94A190D9780A24156FB0E8F1E76B5F
+Content-Type: text/plain
+
+<?xml version="1.0" encoding="utf-8"?>
+<dds xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xsi:noNamespaceSchemaLocation="http://www.omg.org/spec/DDSSecurity/
+20170801/omg_shared_ca_domain_governance.xsd">
+    <domain_access_rules>
+        <domain_rule>
+            <domains>
+                <!-- All domains -->
+                <id_range>
+                    <min>0</min>
+                    <max>230</max>
+                </id_range>
+            </domains>
+
+            <!-- DomainParticipant that cann not authenticate or fail the authentication should be
+                 allowed to join the domain and see any any discovery data that are configured as "unprotected"
+                 and topics that are configured as "unprotected" -->
+            <allow_unauthenticated_participants>false</allow_unauthenticated_participants>
+
+            <!--  Only and any authenticated DomainParticipant should be allowed to join the domain and
+                  see the discovery data without checking access control  -->
+            <enable_join_access_control>true</enable_join_access_control>
+
+            <!-- Discovery information should be protected with encryption followed by MAC (Message Authentication Codes) -->
+            <discovery_protection_kind>ENCRYPT</discovery_protection_kind>
+
+            <!--  Liveliness messages are also encrypted -->
+            <liveliness_protection_kind>ENCRYPT</liveliness_protection_kind>
+
+            <!-- Whole RTPS message is not protected -->
+            <rtps_protection_kind>NONE</rtps_protection_kind>
+
+            <topic_access_rules>
+                <topic_rule>
+                    <!-- All (non-builtin) topics -->
+                    <topic_expression>*</topic_expression>
+
+                    <!-- Liveliness QoS data is protected -->
+                    <enable_liveliness_protection>true</enable_liveliness_protection>
+
+                    <!-- The discovery information on specific Topics should be sent
+                         using the secure (protected) discovery writers -->
+                    <enable_discovery_protection>true</enable_discovery_protection>
+
+                    <!-- The read access to all topics should be open to all. -->
+                    <enable_read_access_control>false</enable_read_access_control>
+
+                    <!-- The write access to all topics should be open to all. -->
+                    <enable_write_access_control>false</enable_write_access_control>
+
+                    <!-- Whole RTPS sub-message is protected. This includes metadata information
+                         like sequence numbers, heartbeats, key hashes, gaps,
+                         acknowledgment messages, etc. It also includes th possible payload. -->
+                    <metadata_protection_kind>ENCRYPT</metadata_protection_kind>
+
+                    <!-- The payload data sent on the Topic (serialized application level data) should be
+                         protected with Encrypt then MAC. -->
+                    <data_protection_kind>ENCRYPT</data_protection_kind>
+                </topic_rule>
+            </topic_access_rules>
+        </domain_rule>
+    </domain_access_rules>
+</dds>
+
+------DB94A190D9780A24156FB0E8F1E76B5F
+Content-Type: application/x-pkcs7-signature; name="smime.p7s"
+Content-Transfer-Encoding: base64
+Content-Disposition: attachment; filename="smime.p7s"
+
+MIIGSAYJKoZIhvcNAQcCoIIGOTCCBjUCAQExDzANBglghkgBZQMEAgEFADALBgkq
+hkiG9w0BBwGgggORMIIDjTCCAnWgAwIBAgIJANsr3sm0NrypMA0GCSqGSIb3DQEB
+CwUAMFwxCzAJBgNVBAYTAk5MMRMwEQYDVQQIDApTb21lLVN0YXRlMR8wHQYDVQQK
+DBZBRExJTksgVGVjaG5vbG9jeSBJbmMuMRcwFQYDVQQDDA5hZGxpbmt0ZWNoLmNv
+bTAgFw0xODA3MzAxMjQ1NTVaGA8yMTE4MDcwNjEyNDU1NVowXDELMAkGA1UEBhMC
+TkwxEzARBgNVBAgMClNvbWUtU3RhdGUxHzAdBgNVBAoMFkFETElOSyBUZWNobm9s
+b2N5IEluYy4xFzAVBgNVBAMMDmFkbGlua3RlY2guY29tMIIBIjANBgkqhkiG9w0B
+AQEFAAOCAQ8AMIIBCgKCAQEAu7jfnJ0wYVuXgG+PgNawdN38+dRpa8jceqi+blID
+ehV6XCxrnGXusTCDuFmo7HMOBVMVNDXlcBWgoGd+u5EultnOEiIeGTgtHc1O6V9w
+icp3BGSpZZax/TcONjMVORaqHCADbQ2J8wsz1FHxuKDwX6BJElYOlK77lb/x3yLs
+DFFC+a0qn2RFh37rcWBRAHy8VEASXKZElT9ZmfKd+KUq34KojhNJ4DepKStTq074
+BRDXVivx+wVD951LFNPiQXq+mgHcLj1k37KlZflTFhdP5oEMtATNsXNJPHlEymiy
+SogRWAmKhysLQudukHfNKN+r0FEQMk/hzpYcFeZSOvbfNQIDAQABo1AwTjAdBgNV
+HQ4EFgQURWMbWvBKZwJvRV1/tyc1R82k0+gwHwYDVR0jBBgwFoAURWMbWvBKZwJv
+RV1/tyc1R82k0+gwDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAQEAkPF+
+ysVtvHnk2hpu9yNDLCJ96ZzIoKOyY7uRj4ovzlAHFdpNOJQdcJihTmN8i7Trht9X
+Vh0rGoR/6nHzo3TIeiogRC80RlDtuA3PF2dDQBMVDStlZMTZPb693hfjdAjhyyw9
+yghhKHHqNDvSsAL0KfBqjG4yGfGpJylYXIT5fWuKlo/ln/yyPa5s54T5XDo+CMbt
+lLX3QnwVOmaRyzylPiTcPCDIkdLBdXmlfyJcmW6fWa6kPx+35MOxPsXZbujCo+42
++OyLqcH1rKT6XhcshjXBEf+kdgUfSClrM1pNRWsw2ChIYim0F+nry5JFy0Y+8Hbb
+6SDB340BFmtgDHbFHTGCAnswggJ3AgEBMGkwXDELMAkGA1UEBhMCTkwxEzARBgNV
+BAgMClNvbWUtU3RhdGUxHzAdBgNVBAoMFkFETElOSyBUZWNobm9sb2N5IEluYy4x
+FzAVBgNVBAMMDmFkbGlua3RlY2guY29tAgkA2yveybQ2vKkwDQYJYIZIAWUDBAIB
+BQCggeQwGAYJKoZIhvcNAQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG9w0BCQUxDxcN
+MTgwOTEzMDczOTUwWjAvBgkqhkiG9w0BCQQxIgQgXv8DkvlwebXMwHDbNc0/Pc30
+gyG3xWCnwet49TRMWFsweQYJKoZIhvcNAQkPMWwwajALBglghkgBZQMEASowCwYJ
+YIZIAWUDBAEWMAsGCWCGSAFlAwQBAjAKBggqhkiG9w0DBzAOBggqhkiG9w0DAgIC
+AIAwDQYIKoZIhvcNAwICAUAwBwYFKw4DAgcwDQYIKoZIhvcNAwICASgwDQYJKoZI
+hvcNAQEBBQAEggEANy8t0EFmv5j1n0+mMn2ut3Chu8PSJceC8gd34IiKq79uC1O3
+PbL9xgiJ2vz7QiTEEeNL2q+CG77cXOcHGUWa4nvbggr/9CqLfHEKGQxDfyXlJZfM
+8l550xIXRRBOQ7ilOGLD4QJFfbf9XA4rMuRe8WEYN3FleAaYBJag1tMPg1SS6tgA
+BBDM9b1kXHU319zYOk6kZFjlbwHv6XO22SEVRUpXrKudAI8hrGvwksF/+W0S/jS5
+NmYtj/1oMGlCGIaA5rs27H9CkgwrzoMQ3MsR98JlwEUSa4PEe8CClsIziOulQxsp
+MicBlMWL0rzpBPVfPTE4gZ/kP7hGBDEQlRzVTA==
+
+------DB94A190D9780A24156FB0E8F1E76B5F--
+
diff --git a/src/security/builtin_plugins/tests/validate_remote_permissions/etc/Test_Permissions_different_subject_representation.p7s b/src/security/builtin_plugins/tests/validate_remote_permissions/etc/Test_Permissions_different_subject_representation.p7s
new file mode 100644
index 0000000..13273ba
--- /dev/null
+++ b/src/security/builtin_plugins/tests/validate_remote_permissions/etc/Test_Permissions_different_subject_representation.p7s
@@ -0,0 +1,96 @@
+MIME-Version: 1.0
+Content-Type: multipart/signed; protocol="application/x-pkcs7-signature"; micalg="sha-256"; boundary="----57B71E0E17C33E9E1569D11B98DA1D03"
+
+This is an S/MIME signed message
+
+------57B71E0E17C33E9E1569D11B98DA1D03
+Content-Type: text/plain
+
+<?xml version="1.0" encoding="utf-8"?>
+<dds xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xsi:noNamespaceSchemaLocation="https://www.omg.org/spec/DDS-SECURITY/20170901/omg_shared_ca_permissions.xsd">
+    <permissions>
+        <grant name="OpenSplicePermissions">
+            <subject_name>/O=Internet Widgits Pty Ltd/ST=Some-State/C=NL/CN=CHAM500 cert</subject_name>
+            <validity>
+                <!-- Format is CCYY-MM-DDThh:mm:ss[Z|(+|-)hh:mm] in GMT -->
+                <not_before>2015-09-15T01:00:00</not_before>
+                <not_after>2115-09-15T01:00:00</not_after>
+            </validity>
+            <allow_rule>
+                <domains>
+                    <id_range>
+                        <min>0</min>
+                        <max>230</max>
+                    </id_range>
+                </domains>
+                <publish>
+                    <topics>
+                        <topic>K*</topic>
+                        <topic>*OldMessage</topic>
+                        <topic>OldMessanger</topic>
+                        <topic>NewMessage</topic>
+                    </topics>
+        <partitions>
+      <partition>Apart</partition>
+      <partition>Bpa?t*</partition>
+        </partitions>
+                </publish>
+                <subscribe>
+                    <topics>
+                        <topic>K*</topic>
+                        <topic>*OldMessage</topic>
+                        <topic>OldMessanger</topic>
+                        <topic>NewMessage</topic>
+                    </topics>
+                </subscribe>
+            </allow_rule>
+
+            <default>ALLOW</default>
+        </grant>
+    </permissions>
+</dds>
+
+------57B71E0E17C33E9E1569D11B98DA1D03
+Content-Type: application/x-pkcs7-signature; name="smime.p7s"
+Content-Transfer-Encoding: base64
+Content-Disposition: attachment; filename="smime.p7s"
+
+MIIGXgYJKoZIhvcNAQcCoIIGTzCCBksCAQExDzANBglghkgBZQMEAgEFADALBgkq
+hkiG9w0BBwGgggORMIIDjTCCAnWgAwIBAgIJANsr3sm0NrypMA0GCSqGSIb3DQEB
+CwUAMFwxCzAJBgNVBAYTAk5MMRMwEQYDVQQIDApTb21lLVN0YXRlMR8wHQYDVQQK
+DBZBRExJTksgVGVjaG5vbG9jeSBJbmMuMRcwFQYDVQQDDA5hZGxpbmt0ZWNoLmNv
+bTAgFw0xODA3MzAxMjQ1NTVaGA8yMTE4MDcwNjEyNDU1NVowXDELMAkGA1UEBhMC
+TkwxEzARBgNVBAgMClNvbWUtU3RhdGUxHzAdBgNVBAoMFkFETElOSyBUZWNobm9s
+b2N5IEluYy4xFzAVBgNVBAMMDmFkbGlua3RlY2guY29tMIIBIjANBgkqhkiG9w0B
+AQEFAAOCAQ8AMIIBCgKCAQEAu7jfnJ0wYVuXgG+PgNawdN38+dRpa8jceqi+blID
+ehV6XCxrnGXusTCDuFmo7HMOBVMVNDXlcBWgoGd+u5EultnOEiIeGTgtHc1O6V9w
+icp3BGSpZZax/TcONjMVORaqHCADbQ2J8wsz1FHxuKDwX6BJElYOlK77lb/x3yLs
+DFFC+a0qn2RFh37rcWBRAHy8VEASXKZElT9ZmfKd+KUq34KojhNJ4DepKStTq074
+BRDXVivx+wVD951LFNPiQXq+mgHcLj1k37KlZflTFhdP5oEMtATNsXNJPHlEymiy
+SogRWAmKhysLQudukHfNKN+r0FEQMk/hzpYcFeZSOvbfNQIDAQABo1AwTjAdBgNV
+HQ4EFgQURWMbWvBKZwJvRV1/tyc1R82k0+gwHwYDVR0jBBgwFoAURWMbWvBKZwJv
+RV1/tyc1R82k0+gwDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAQEAkPF+
+ysVtvHnk2hpu9yNDLCJ96ZzIoKOyY7uRj4ovzlAHFdpNOJQdcJihTmN8i7Trht9X
+Vh0rGoR/6nHzo3TIeiogRC80RlDtuA3PF2dDQBMVDStlZMTZPb693hfjdAjhyyw9
+yghhKHHqNDvSsAL0KfBqjG4yGfGpJylYXIT5fWuKlo/ln/yyPa5s54T5XDo+CMbt
+lLX3QnwVOmaRyzylPiTcPCDIkdLBdXmlfyJcmW6fWa6kPx+35MOxPsXZbujCo+42
++OyLqcH1rKT6XhcshjXBEf+kdgUfSClrM1pNRWsw2ChIYim0F+nry5JFy0Y+8Hbb
+6SDB340BFmtgDHbFHTGCApEwggKNAgEBMGkwXDELMAkGA1UEBhMCTkwxEzARBgNV
+BAgMClNvbWUtU3RhdGUxHzAdBgNVBAoMFkFETElOSyBUZWNobm9sb2N5IEluYy4x
+FzAVBgNVBAMMDmFkbGlua3RlY2guY29tAgkA2yveybQ2vKkwDQYJYIZIAWUDBAIB
+BQCggfowGAYJKoZIhvcNAQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG9w0BCQUxDxcN
+MTkwMzI5MTMwODAzWjAvBgkqhkiG9w0BCQQxIgQgocQS4FLDqU6X3kzlYhW9GLLt
+ItKIWQ9ghIL29OEyHPcwgY4GCSqGSIb3DQEJDzGBgDB+MAsGCWCGSAFlAwQBKjAI
+BgYqhQMCAgkwCAYGKoUDAgIVMAsGCWCGSAFlAwQBFjALBglghkgBZQMEAQIwCgYI
+KoZIhvcNAwcwDgYIKoZIhvcNAwICAgCAMA0GCCqGSIb3DQMCAgFAMAcGBSsOAwIH
+MA0GCCqGSIb3DQMCAgEoMA0GCSqGSIb3DQEBAQUABIIBADPtNnKmzgMNaoeAiyxH
+0oO3D9qsLWlon9eG+ri3e4O4IBGAwPtwN92ah3OmqXeB7xqBlZwnR4jQIxwVl8eL
+Zs2y7lJ6LxPYHJj6qERlYbRjS55X7Wnjcwy81w+yQelSLFcKvdmrV5HIuLbeskWw
+WiJxu3Sxtett3NnJxV5za6C27pxGXmv+xdspUe1Zeoz7WjAA0ljOazSUXAyCriQH
+LXSGjTM8Lgn/P8xJTVzGgxmLmGm9fAhhYk+25G9Fspomigvnj+B6HobEf4xKA/Mm
+WPaLsNkLtbi954g5+EM9AOjpCR/2Ii1NB4lWeKGZLtbEm71dEUe2VDePy2ju+oOB
+9ec=
+
+------57B71E0E17C33E9E1569D11B98DA1D03--
+
diff --git a/src/security/builtin_plugins/tests/validate_remote_permissions/etc/Test_Permissions_different_subject_representation.xml b/src/security/builtin_plugins/tests/validate_remote_permissions/etc/Test_Permissions_different_subject_representation.xml
new file mode 100644
index 0000000..585030e
--- /dev/null
+++ b/src/security/builtin_plugins/tests/validate_remote_permissions/etc/Test_Permissions_different_subject_representation.xml
@@ -0,0 +1,44 @@
+<?xml version="1.0" encoding="utf-8"?>
+<dds xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xsi:noNamespaceSchemaLocation="https://www.omg.org/spec/DDS-SECURITY/20170901/omg_shared_ca_permissions.xsd">
+    <permissions>
+        <grant name="OpenSplicePermissions">
+            <subject_name>/O=Internet Widgits Pty Ltd/ST=Some-State/C=NL/CN=CHAM500 cert</subject_name>
+            <validity>
+                <!-- Format is CCYY-MM-DDThh:mm:ss[Z|(+|-)hh:mm] in GMT -->
+                <not_before>2015-09-15T01:00:00</not_before>
+                <not_after>2115-09-15T01:00:00</not_after>
+            </validity>
+            <allow_rule>
+                <domains>
+                    <id_range>
+                        <min>0</min>
+                        <max>230</max>
+                    </id_range>
+                </domains>
+                <publish>
+                    <topics>
+                        <topic>K*</topic>
+                        <topic>*OldMessage</topic>
+                        <topic>OldMessanger</topic>
+                        <topic>NewMessage</topic>
+                    </topics>
+        <partitions>
+      <partition>Apart</partition>
+      <partition>Bpa?t*</partition>
+        </partitions>
+                </publish>
+                <subscribe>
+                    <topics>
+                        <topic>K*</topic>
+                        <topic>*OldMessage</topic>
+                        <topic>OldMessanger</topic>
+                        <topic>NewMessage</topic>
+                    </topics>
+                </subscribe>
+            </allow_rule>
+
+            <default>ALLOW</default>
+        </grant>
+    </permissions>
+</dds>
diff --git a/src/security/builtin_plugins/tests/validate_remote_permissions/etc/Test_Permissions_expired.p7s b/src/security/builtin_plugins/tests/validate_remote_permissions/etc/Test_Permissions_expired.p7s
new file mode 100644
index 0000000..bf35bf7
--- /dev/null
+++ b/src/security/builtin_plugins/tests/validate_remote_permissions/etc/Test_Permissions_expired.p7s
@@ -0,0 +1,243 @@
+MIME-Version: 1.0
+Content-Type: multipart/signed; protocol="application/x-pkcs7-signature"; micalg="sha-256"; boundary="----11798C99B4C31493D0479BB8A2064C72"
+
+This is an S/MIME signed message
+
+------11798C99B4C31493D0479BB8A2064C72
+Content-Type: text/plain
+
+<?xml version="1.0" encoding="utf-8"?>
+<dds xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xsi:noNamespaceSchemaLocation="https://www.omg.org/spec/DDS-SECURITY/20170901/omg_shared_ca_permissions.xsd">
+    <permissions>
+        <grant name="OpenSplicePermissions">
+            <subject_name>CN=CHAM500 cert,O=Internet Widgits Pty Ltd,ST=Some-State,C=NL</subject_name>
+            <validity>
+                <!-- Format is CCYY-MM-DDThh:mm:ss[Z|(+|-)hh:mm] in GMT -->
+                <not_before>2015-09-15T01:00:00</not_before>
+                <not_after>2016-09-15T01:00:00</not_after>
+            </validity>
+            <allow_rule>
+                <domains>
+                    <id_range>
+                        <min>0</min>
+                        <max>230</max>
+                    </id_range>
+                </domains>
+                <publish>
+                    <topics>
+                        <topic>K*</topic>
+                        <topic>*OldMessage</topic>
+                        <topic>OldMessanger</topic>
+                        <topic>NewMessage</topic>
+                    </topics>
+        <partitions>
+      <partition>Apart</partition>
+      <partition>Bpa?t*</partition>
+        </partitions>
+                </publish>
+                <subscribe>
+                    <topics>
+                        <topic>K*</topic>
+                        <topic>*OldMessage</topic>
+                        <topic>OldMessanger</topic>
+                        <topic>NewMessage</topic>
+                    </topics>
+        <partitions>
+      <partition>Apart</partition>
+      <partition>Bpa?t*</partition>
+        </partitions>
+                </subscribe>
+            </allow_rule>
+            <deny_rule>
+                <domains>
+                    <id_range>
+                        <min>0</min>
+                        <max>230</max>
+                    </id_range>
+                </domains>
+                <publish>
+                    <topics>
+                        <topic>P*</topic>
+                        <topic>*WrongMessage</topic>
+                        <topic>FakeMessanger</topic>
+                        <topic>ChangedMessage</topic>
+                    </topics>
+        <partitions>
+      <partition>Apart</partition>
+      <partition>Bpa?t*</partition>
+        </partitions>
+                </publish>
+                <subscribe>
+                    <topics>
+                        <topic>P*</topic>
+                        <topic>*WrongMessage</topic>
+                        <topic>FakeMessanger</topic>
+                        <topic>ChangedMessage</topic>
+                    </topics>
+        <partitions>
+      <partition>Apart</partition>
+      <partition>Bpa?t*</partition>
+        </partitions>
+                </subscribe>
+            </deny_rule>
+
+            <default>DENY</default>
+        </grant>
+        <grant name="SpareNodeOpenSplicePermissions">
+            <subject_name>CN=Spare cert,O=Internet Widgits Pty Ltd,ST=Some-State,C=NL</subject_name>
+            <validity>
+                <!-- Format is CCYY-MM-DDThh:mm:ss[Z|(+|-)hh:mm] in GMT -->
+                <not_before>2015-09-15T01:00:00</not_before>
+                <not_after>2115-09-15T01:00:00</not_after>
+            </validity>
+            <allow_rule>
+                <domains>
+                <!-- All domains -->
+                 <id>20</id>
+                 <id>30</id>
+                 <id_range>
+                     <min>0</min>
+                     <max>23</max>
+                 </id_range>
+                 <id_range>
+                     <min>100</min>
+                     <max>120</max>
+                 </id_range>
+                 <id>200</id>
+               </domains>
+                <publish>
+                    <topics>
+                        <topic>K*</topic>
+                        <topic>*OldMessage</topic>
+                        <topic>OldMessanger</topic>
+                        <topic>NewMessage</topic>
+                    </topics>
+        <partitions>
+      <partition>Apart</partition>
+      <partition>Bpa?t*</partition>
+        </partitions>
+                </publish>
+                <subscribe>
+                    <topics>
+                        <topic>K*</topic>
+                        <topic>*OldMessage</topic>
+                        <topic>OldMessanger</topic>
+                        <topic>NewMessage</topic>
+                    </topics>
+        <partitions>
+      <partition>Apart</partition>
+      <partition>Bpa?t*</partition>
+        </partitions>
+                </subscribe>
+            </allow_rule>
+            <deny_rule>
+                <domains>
+                 <id_range>
+                     <min>0</min>
+                     <max>23</max>
+                 </id_range>
+                 <id_range>
+                     <min>100</min>
+                     <max>120</max>
+                 </id_range>
+                 <id>200</id>
+                </domains>
+                <publish>
+                    <topics>
+                        <topic>P*</topic>
+                        <topic>*WrongMessage</topic>
+                        <topic>FakeMessanger</topic>
+                        <topic>ChangedMessage</topic>
+                    </topics>
+                    <partitions>
+                      <partition>Apart</partition>
+                      <partition>Bpa?t*</partition>
+                    </partitions>
+                </publish>
+                <subscribe>
+                    <topics>
+                        <topic>P*</topic>
+                        <topic>*WrongMessage</topic>
+                        <topic>FakeMessanger</topic>
+                        <topic>ChangedMessage</topic>
+                    </topics>
+                    <partitions>
+                      <partition>Apart</partition>
+                      <partition>Bpa?t*</partition>
+                    </partitions>
+                    <data_tags>
+                      <tag>
+                        <name>aTagName1</name>
+                        <value>aTagValue1</value>
+                      </tag>
+                    </data_tags>
+                </subscribe>
+                <relay>
+                  <topics>
+                        <topic>P*</topic>
+                        <topic>*WrongMessage</topic>
+                        <topic>FakeMessanger</topic>
+                        <topic>ChangedMessage</topic>
+                    </topics>
+                    <partitions>
+                      <partition>Apart</partition>
+                      <partition>Bpa?t*</partition>
+                    </partitions>
+                    <data_tags>
+                      <tag>
+                        <name>aTagName1</name>
+                        <value>aTagValue1</value>
+                      </tag>
+                    </data_tags>
+                </relay>
+            </deny_rule>
+
+            <default>ALLOW</default>
+        </grant>
+    </permissions>
+</dds>
+
+------11798C99B4C31493D0479BB8A2064C72
+Content-Type: application/x-pkcs7-signature; name="smime.p7s"
+Content-Transfer-Encoding: base64
+Content-Disposition: attachment; filename="smime.p7s"
+
+MIIGXgYJKoZIhvcNAQcCoIIGTzCCBksCAQExDzANBglghkgBZQMEAgEFADALBgkq
+hkiG9w0BBwGgggORMIIDjTCCAnWgAwIBAgIJANsr3sm0NrypMA0GCSqGSIb3DQEB
+CwUAMFwxCzAJBgNVBAYTAk5MMRMwEQYDVQQIDApTb21lLVN0YXRlMR8wHQYDVQQK
+DBZBRExJTksgVGVjaG5vbG9jeSBJbmMuMRcwFQYDVQQDDA5hZGxpbmt0ZWNoLmNv
+bTAgFw0xODA3MzAxMjQ1NTVaGA8yMTE4MDcwNjEyNDU1NVowXDELMAkGA1UEBhMC
+TkwxEzARBgNVBAgMClNvbWUtU3RhdGUxHzAdBgNVBAoMFkFETElOSyBUZWNobm9s
+b2N5IEluYy4xFzAVBgNVBAMMDmFkbGlua3RlY2guY29tMIIBIjANBgkqhkiG9w0B
+AQEFAAOCAQ8AMIIBCgKCAQEAu7jfnJ0wYVuXgG+PgNawdN38+dRpa8jceqi+blID
+ehV6XCxrnGXusTCDuFmo7HMOBVMVNDXlcBWgoGd+u5EultnOEiIeGTgtHc1O6V9w
+icp3BGSpZZax/TcONjMVORaqHCADbQ2J8wsz1FHxuKDwX6BJElYOlK77lb/x3yLs
+DFFC+a0qn2RFh37rcWBRAHy8VEASXKZElT9ZmfKd+KUq34KojhNJ4DepKStTq074
+BRDXVivx+wVD951LFNPiQXq+mgHcLj1k37KlZflTFhdP5oEMtATNsXNJPHlEymiy
+SogRWAmKhysLQudukHfNKN+r0FEQMk/hzpYcFeZSOvbfNQIDAQABo1AwTjAdBgNV
+HQ4EFgQURWMbWvBKZwJvRV1/tyc1R82k0+gwHwYDVR0jBBgwFoAURWMbWvBKZwJv
+RV1/tyc1R82k0+gwDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAQEAkPF+
+ysVtvHnk2hpu9yNDLCJ96ZzIoKOyY7uRj4ovzlAHFdpNOJQdcJihTmN8i7Trht9X
+Vh0rGoR/6nHzo3TIeiogRC80RlDtuA3PF2dDQBMVDStlZMTZPb693hfjdAjhyyw9
+yghhKHHqNDvSsAL0KfBqjG4yGfGpJylYXIT5fWuKlo/ln/yyPa5s54T5XDo+CMbt
+lLX3QnwVOmaRyzylPiTcPCDIkdLBdXmlfyJcmW6fWa6kPx+35MOxPsXZbujCo+42
++OyLqcH1rKT6XhcshjXBEf+kdgUfSClrM1pNRWsw2ChIYim0F+nry5JFy0Y+8Hbb
+6SDB340BFmtgDHbFHTGCApEwggKNAgEBMGkwXDELMAkGA1UEBhMCTkwxEzARBgNV
+BAgMClNvbWUtU3RhdGUxHzAdBgNVBAoMFkFETElOSyBUZWNobm9sb2N5IEluYy4x
+FzAVBgNVBAMMDmFkbGlua3RlY2guY29tAgkA2yveybQ2vKkwDQYJYIZIAWUDBAIB
+BQCggfowGAYJKoZIhvcNAQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG9w0BCQUxDxcN
+MTkwMzI5MTMwODAzWjAvBgkqhkiG9w0BCQQxIgQgXPEkUvQgZwRMdZgxT8k/mrsJ
+delB0E3RjpayHUkKYzowgY4GCSqGSIb3DQEJDzGBgDB+MAsGCWCGSAFlAwQBKjAI
+BgYqhQMCAgkwCAYGKoUDAgIVMAsGCWCGSAFlAwQBFjALBglghkgBZQMEAQIwCgYI
+KoZIhvcNAwcwDgYIKoZIhvcNAwICAgCAMA0GCCqGSIb3DQMCAgFAMAcGBSsOAwIH
+MA0GCCqGSIb3DQMCAgEoMA0GCSqGSIb3DQEBAQUABIIBAA/TNULF62fO5mfjXm1L
+Yk4Dg/5ZxAF/grDAjamo5v2fxGn6B1rrkj8YtyB1FEA0moM/cL31kNXNMqLvFdhY
+lHCmX8x5PHkKzLihTIMx6diSCupBvvqUACeA7Ir1A3tMqW5tYYMg6sZ/YolgLLFG
+8XmhttpEibtZm90MN3Xpsa4TiW5PlEWHC5ai3tyeyd/RCVoeQJVA0pAytmjdf2Mw
+C3W/28tUxVCAjdlqXYap6jWZlNv/43P5HED837bF5iqoa1dTvDirca6WPanNjp28
+GQDi4bnD1kAk8wAKIm14qwS+fzxM3SKxJtdQuUCx+s/tPma4bLCqt843ok35SoWo
+QKM=
+
+------11798C99B4C31493D0479BB8A2064C72--
+
diff --git a/src/security/builtin_plugins/tests/validate_remote_permissions/etc/Test_Permissions_expired.xml b/src/security/builtin_plugins/tests/validate_remote_permissions/etc/Test_Permissions_expired.xml
new file mode 100644
index 0000000..f408942
--- /dev/null
+++ b/src/security/builtin_plugins/tests/validate_remote_permissions/etc/Test_Permissions_expired.xml
@@ -0,0 +1,191 @@
+<?xml version="1.0" encoding="utf-8"?>
+<dds xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xsi:noNamespaceSchemaLocation="https://www.omg.org/spec/DDS-SECURITY/20170901/omg_shared_ca_permissions.xsd">
+    <permissions>
+        <grant name="OpenSplicePermissions">
+            <subject_name>CN=CHAM500 cert,O=Internet Widgits Pty Ltd,ST=Some-State,C=NL</subject_name>
+            <validity>
+                <!-- Format is CCYY-MM-DDThh:mm:ss[Z|(+|-)hh:mm] in GMT -->
+                <not_before>2015-09-15T01:00:00</not_before>
+                <not_after>2016-09-15T01:00:00</not_after>
+            </validity>
+            <allow_rule>
+                <domains>
+                    <id_range>
+                        <min>0</min>
+                        <max>230</max>
+                    </id_range>
+                </domains>
+                <publish>
+                    <topics>
+                        <topic>K*</topic>
+                        <topic>*OldMessage</topic>
+                        <topic>OldMessanger</topic>
+                        <topic>NewMessage</topic>
+                    </topics>
+        <partitions>
+      <partition>Apart</partition>
+      <partition>Bpa?t*</partition>
+        </partitions>
+                </publish>
+                <subscribe>
+                    <topics>
+                        <topic>K*</topic>
+                        <topic>*OldMessage</topic>
+                        <topic>OldMessanger</topic>
+                        <topic>NewMessage</topic>
+                    </topics>
+        <partitions>
+      <partition>Apart</partition>
+      <partition>Bpa?t*</partition>
+        </partitions>
+                </subscribe>
+            </allow_rule>
+            <deny_rule>
+                <domains>
+                    <id_range>
+                        <min>0</min>
+                        <max>230</max>
+                    </id_range>
+                </domains>
+                <publish>
+                    <topics>
+                        <topic>P*</topic>
+                        <topic>*WrongMessage</topic>
+                        <topic>FakeMessanger</topic>
+                        <topic>ChangedMessage</topic>
+                    </topics>
+        <partitions>
+      <partition>Apart</partition>
+      <partition>Bpa?t*</partition>
+        </partitions>
+                </publish>
+                <subscribe>
+                    <topics>
+                        <topic>P*</topic>
+                        <topic>*WrongMessage</topic>
+                        <topic>FakeMessanger</topic>
+                        <topic>ChangedMessage</topic>
+                    </topics>
+        <partitions>
+      <partition>Apart</partition>
+      <partition>Bpa?t*</partition>
+        </partitions>
+                </subscribe>
+            </deny_rule>
+
+            <default>DENY</default>
+        </grant>
+        <grant name="SpareNodeOpenSplicePermissions">
+            <subject_name>CN=Spare cert,O=Internet Widgits Pty Ltd,ST=Some-State,C=NL</subject_name>
+            <validity>
+                <!-- Format is CCYY-MM-DDThh:mm:ss[Z|(+|-)hh:mm] in GMT -->
+                <not_before>2015-09-15T01:00:00</not_before>
+                <not_after>2115-09-15T01:00:00</not_after>
+            </validity>
+            <allow_rule>
+                <domains>
+                <!-- All domains -->
+                 <id>20</id>
+                 <id>30</id>
+                 <id_range>
+                     <min>0</min>
+                     <max>23</max>
+                 </id_range>
+                 <id_range>
+                     <min>100</min>
+                     <max>120</max>
+                 </id_range>
+                 <id>200</id>
+               </domains>
+                <publish>
+                    <topics>
+                        <topic>K*</topic>
+                        <topic>*OldMessage</topic>
+                        <topic>OldMessanger</topic>
+                        <topic>NewMessage</topic>
+                    </topics>
+        <partitions>
+      <partition>Apart</partition>
+      <partition>Bpa?t*</partition>
+        </partitions>
+                </publish>
+                <subscribe>
+                    <topics>
+                        <topic>K*</topic>
+                        <topic>*OldMessage</topic>
+                        <topic>OldMessanger</topic>
+                        <topic>NewMessage</topic>
+                    </topics>
+        <partitions>
+      <partition>Apart</partition>
+      <partition>Bpa?t*</partition>
+        </partitions>
+                </subscribe>
+            </allow_rule>
+            <deny_rule>
+                <domains>
+                 <id_range>
+                     <min>0</min>
+                     <max>23</max>
+                 </id_range>
+                 <id_range>
+                     <min>100</min>
+                     <max>120</max>
+                 </id_range>
+                 <id>200</id>
+                </domains>
+                <publish>
+                    <topics>
+                        <topic>P*</topic>
+                        <topic>*WrongMessage</topic>
+                        <topic>FakeMessanger</topic>
+                        <topic>ChangedMessage</topic>
+                    </topics>
+                    <partitions>
+                      <partition>Apart</partition>
+                      <partition>Bpa?t*</partition>
+                    </partitions>
+                </publish>
+                <subscribe>
+                    <topics>
+                        <topic>P*</topic>
+                        <topic>*WrongMessage</topic>
+                        <topic>FakeMessanger</topic>
+                        <topic>ChangedMessage</topic>
+                    </topics>
+                    <partitions>
+                      <partition>Apart</partition>
+                      <partition>Bpa?t*</partition>
+                    </partitions>
+                    <data_tags>
+                      <tag>
+                        <name>aTagName1</name>
+                        <value>aTagValue1</value>
+                      </tag>
+                    </data_tags>
+                </subscribe>
+                <relay>
+                  <topics>
+                        <topic>P*</topic>
+                        <topic>*WrongMessage</topic>
+                        <topic>FakeMessanger</topic>
+                        <topic>ChangedMessage</topic>
+                    </topics>
+                    <partitions>
+                      <partition>Apart</partition>
+                      <partition>Bpa?t*</partition>
+                    </partitions>
+                    <data_tags>
+                      <tag>
+                        <name>aTagName1</name>
+                        <value>aTagValue1</value>
+                      </tag>
+                    </data_tags>
+                </relay>
+            </deny_rule>
+
+            <default>ALLOW</default>
+        </grant>
+    </permissions>
+</dds>
diff --git a/src/security/builtin_plugins/tests/validate_remote_permissions/etc/Test_Permissions_invalid_data.p7s b/src/security/builtin_plugins/tests/validate_remote_permissions/etc/Test_Permissions_invalid_data.p7s
new file mode 100644
index 0000000..b3b969e
--- /dev/null
+++ b/src/security/builtin_plugins/tests/validate_remote_permissions/etc/Test_Permissions_invalid_data.p7s
@@ -0,0 +1,219 @@
+MIME-Version: 1.0
+Content-Type: multipart/signed; protocol="application/x-pkcs7-signature"; micalg="sha-256"; boundary="----62BE4CE8CF1FCB0420A2F2884B1618E6"
+
+This is an S/MIME signed message
+
+------62BE4CE8CF1FCB0420A2F2884B1618E6
+Content-Type: text/plain
+
+<?xml version="1.0" encoding="utf-8"?>
+<dds xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xsi:noNamespaceSchemaLocation="https://www.omg.org/spec/DDS-SECURITY/20170901/omg_shared_ca_permissions.xsd">
+    <permissions>
+        <grant name="OpenSplicePermissions">
+            <subject_name>CN=CHAM500 cert,O=Internet Widgits Pty Ltd,ST=Some-State,C=NL</subject_name>
+            <validity>
+                <!-- Format is CCYY-MM-DDThh:mm:ss[Z|(+|-)hh:mm] in GMT -->
+                <not_before>2015-09-15T01:00:00</not_before>
+                <not_after>2115-09-15T01:00:00</not_after>
+            </validity>
+            <allow_rule>
+                <domains>
+                    <id_range>
+                        <min>0</min>
+                        <max>430</max>
+                    </id_range>
+                </domains>
+                <publish>
+                    <topics>
+                        <topic>K*</topic>
+                        <topic>*OldMessage</topic>
+                        <topic>OldMessanger</topic>
+                        <topic>NewMessage</topic>
+                    </topics>
+		    <partitions>
+			<partition>Apart</partition>
+			<partition>Bpa?t*</partition>
+		    </partitions>
+                </publish>
+                <subscribe>
+                    <topics>
+                        <topic>K*</topic>
+                        <topic>*OldMessage</topic>
+                        <topic>OldMessanger</topic>
+                        <topic>NewMessage</topic>
+                    </topics>
+		    <partitions>
+			<partition>Apart</partition>
+			<partition>Bpa?t*</partition>
+		    </partitions>
+                </subscribe>
+            </allow_rule>
+            <deny_rule>
+                <domains>
+                    <id_range>
+                        <min>0</min>
+                        <max>230</max>
+                    </id_range>
+                </domains>
+                <publish>
+                    <topics>
+                        <topic>P*</topic>
+                        <topic>*WrongMessage</topic>
+                        <topic>FakeMessanger</topic>
+                        <topic>ChangedMessage</topic>
+                    </topics>
+		    <partitions>
+			<partition>Apart</partition>
+			<partition>Bpa?t*</partition>
+		    </partitions>
+                </publish>
+                <subscribe>
+                    <topics>
+                        <topic>P*</topic>
+                        <topic>*WrongMessage</topic>
+                        <topic>FakeMessanger</topic>
+                        <topic>ChangedMessage</topic>
+                    </topics>
+		    <partitions>
+			<partition>Apart</partition>
+			<partition>Bpa?t*</partition>
+		    </partitions>
+                </subscribe>
+            </deny_rule>
+
+            <default>DENY</default>
+        </grant>
+        <grant name="SpareNodeOpenSplicePermissions">
+            <subject_name>CN=CHAM500 cert,O=Internet Widgits Pty Ltd,ST=Some-State,C=NL</subject_name>
+            <validity>
+                <!-- Format is CCYY-MM-DDThh:mm:ss[Z|(+|-)hh:mm] in GMT -->
+                <not_before>2015-09-15T01:00:00</not_before>
+                <not_after>2115-09-15T01:00:00</not_after>
+            </validity>
+            <allow_rule>
+                <domains>
+                <!-- All domains -->
+                 <id>20</id>
+                 <id>30</id>
+                 <id_range>
+                     <min>0</min>
+                     <max>23</max>
+                 </id_range>
+                 <id_range>
+                     <min>100</min>
+                     <max>120</max>
+                 </id_range>
+                 <id>200</id>
+               </domains>
+                <publish>
+                    <topics>
+                        <topic>K*</topic>
+                        <topic>*OldMessage</topic>
+                        <topic>OldMessanger</topic>
+                        <topic>NewMessage</topic>
+                    </topics>
+		    <partitions>
+			<partition>Apart</partition>
+			<partition>Bpa?t*</partition>
+		    </partitions>
+                </publish>
+                <subscribe>
+                    <topics>
+                        <topic>K*</topic>
+                        <topic>*OldMessage</topic>
+                        <topic>OldMessanger</topic>
+                        <topic>NewMessage</topic>
+                    </topics>
+		    <partitions>
+			<partition>Apart</partition>
+			<partition>Bpa?t*</partition>
+		    </partitions>
+                </subscribe>
+            </allow_rule>
+            <deny_rule>
+                <domains>
+                 <id_range>
+                     <min>0</min>
+                     <max>23</max>
+                 </id_range>
+                 <id_range>
+                     <min>100</min>
+                     <max>120</max>
+                 </id_range>
+                 <id>200</id>
+                </domains>
+                <publish>
+                    <topics>
+                        <topic>P*</topic>
+                        <topic>*WrongMessage</topic>
+                        <topic>FakeMessanger</topic>
+                        <topic>ChangedMessage</topic>
+                    </topics>
+		    <partitions>
+			<partition>Apart</partition>
+			<partition>Bpa?t*</partition>
+		    </partitions>
+                </publish>
+                <subscribe>
+                    <topics>
+                        <topic>P*</topic>
+                        <topic>*WrongMessage</topic>
+                        <topic>FakeMessanger</topic>
+                        <topic>ChangedMessage</topic>
+                    </topics>
+		    <partitions>
+			<partition>Apart</partition>
+			<partition>Bpa?t*</partition>
+		    </partitions>
+                </subscribe>
+            </deny_rule>
+
+            <default>DENY</default>
+        </grant>
+    </permissions>
+</dds>
+
+------62BE4CE8CF1FCB0420A2F2884B1618E6
+Content-Type: application/x-pkcs7-signature; name="smime.p7s"
+Content-Transfer-Encoding: base64
+Content-Disposition: attachment; filename="smime.p7s"
+
+MIIGXgYJKoZIhvcNAQcCoIIGTzCCBksCAQExDzANBglghkgBZQMEAgEFADALBgkq
+hkiG9w0BBwGgggORMIIDjTCCAnWgAwIBAgIJANsr3sm0NrypMA0GCSqGSIb3DQEB
+CwUAMFwxCzAJBgNVBAYTAk5MMRMwEQYDVQQIDApTb21lLVN0YXRlMR8wHQYDVQQK
+DBZBRExJTksgVGVjaG5vbG9jeSBJbmMuMRcwFQYDVQQDDA5hZGxpbmt0ZWNoLmNv
+bTAgFw0xODA3MzAxMjQ1NTVaGA8yMTE4MDcwNjEyNDU1NVowXDELMAkGA1UEBhMC
+TkwxEzARBgNVBAgMClNvbWUtU3RhdGUxHzAdBgNVBAoMFkFETElOSyBUZWNobm9s
+b2N5IEluYy4xFzAVBgNVBAMMDmFkbGlua3RlY2guY29tMIIBIjANBgkqhkiG9w0B
+AQEFAAOCAQ8AMIIBCgKCAQEAu7jfnJ0wYVuXgG+PgNawdN38+dRpa8jceqi+blID
+ehV6XCxrnGXusTCDuFmo7HMOBVMVNDXlcBWgoGd+u5EultnOEiIeGTgtHc1O6V9w
+icp3BGSpZZax/TcONjMVORaqHCADbQ2J8wsz1FHxuKDwX6BJElYOlK77lb/x3yLs
+DFFC+a0qn2RFh37rcWBRAHy8VEASXKZElT9ZmfKd+KUq34KojhNJ4DepKStTq074
+BRDXVivx+wVD951LFNPiQXq+mgHcLj1k37KlZflTFhdP5oEMtATNsXNJPHlEymiy
+SogRWAmKhysLQudukHfNKN+r0FEQMk/hzpYcFeZSOvbfNQIDAQABo1AwTjAdBgNV
+HQ4EFgQURWMbWvBKZwJvRV1/tyc1R82k0+gwHwYDVR0jBBgwFoAURWMbWvBKZwJv
+RV1/tyc1R82k0+gwDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAQEAkPF+
+ysVtvHnk2hpu9yNDLCJ96ZzIoKOyY7uRj4ovzlAHFdpNOJQdcJihTmN8i7Trht9X
+Vh0rGoR/6nHzo3TIeiogRC80RlDtuA3PF2dDQBMVDStlZMTZPb693hfjdAjhyyw9
+yghhKHHqNDvSsAL0KfBqjG4yGfGpJylYXIT5fWuKlo/ln/yyPa5s54T5XDo+CMbt
+lLX3QnwVOmaRyzylPiTcPCDIkdLBdXmlfyJcmW6fWa6kPx+35MOxPsXZbujCo+42
++OyLqcH1rKT6XhcshjXBEf+kdgUfSClrM1pNRWsw2ChIYim0F+nry5JFy0Y+8Hbb
+6SDB340BFmtgDHbFHTGCApEwggKNAgEBMGkwXDELMAkGA1UEBhMCTkwxEzARBgNV
+BAgMClNvbWUtU3RhdGUxHzAdBgNVBAoMFkFETElOSyBUZWNobm9sb2N5IEluYy4x
+FzAVBgNVBAMMDmFkbGlua3RlY2guY29tAgkA2yveybQ2vKkwDQYJYIZIAWUDBAIB
+BQCggfowGAYJKoZIhvcNAQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG9w0BCQUxDxcN
+MTkwMzI5MTMwODAzWjAvBgkqhkiG9w0BCQQxIgQghoicue+FOmdIHF9rpsNCfmjP
++ZyN+t9kCdmR68JCJU0wgY4GCSqGSIb3DQEJDzGBgDB+MAsGCWCGSAFlAwQBKjAI
+BgYqhQMCAgkwCAYGKoUDAgIVMAsGCWCGSAFlAwQBFjALBglghkgBZQMEAQIwCgYI
+KoZIhvcNAwcwDgYIKoZIhvcNAwICAgCAMA0GCCqGSIb3DQMCAgFAMAcGBSsOAwIH
+MA0GCCqGSIb3DQMCAgEoMA0GCSqGSIb3DQEBAQUABIIBAI0BX2tu2DbQjvuzKG35
+myNBcOC9ZzRDqJEtmQhcY/2hAJzurlnclJVTEXFyXdpV4ywtA+lQvbtToh11AvnY
+IY1QWNVm19mfO1J6m6PFu18tizd30sG7p1TZKxGB3zDeVVqmedZ+o7QJHv9/ixzz
+Pyo2B9tG5Su94+ADc0LQNyGICjeMr7L6dhFDsm7fXBi8pMBKy/zEAynTA3r1ibsn
+5zlizPMlad2HCaYv44x7Xksg9FSbzJwJpTiprbQbZSUPYk4WlfVz0l4plzRKu4AP
+lCOsdRE6C6GQFnK5bLyndu3Ycp10niwfkfobruCDyigu+gjZtmmF/T7A8Xkk1uvx
+fAM=
+
+------62BE4CE8CF1FCB0420A2F2884B1618E6--
+
diff --git a/src/security/builtin_plugins/tests/validate_remote_permissions/etc/Test_Permissions_invalid_data.xml b/src/security/builtin_plugins/tests/validate_remote_permissions/etc/Test_Permissions_invalid_data.xml
new file mode 100644
index 0000000..5ebb397
--- /dev/null
+++ b/src/security/builtin_plugins/tests/validate_remote_permissions/etc/Test_Permissions_invalid_data.xml
@@ -0,0 +1,167 @@
+<?xml version="1.0" encoding="utf-8"?>
+<dds xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xsi:noNamespaceSchemaLocation="https://www.omg.org/spec/DDS-SECURITY/20170901/omg_shared_ca_permissions.xsd">
+    <permissions>
+        <grant name="OpenSplicePermissions">
+            <subject_name>CN=CHAM500 cert,O=Internet Widgits Pty Ltd,ST=Some-State,C=NL</subject_name>
+            <validity>
+                <!-- Format is CCYY-MM-DDThh:mm:ss[Z|(+|-)hh:mm] in GMT -->
+                <not_before>2015-09-15T01:00:00</not_before>
+                <not_after>2115-09-15T01:00:00</not_after>
+            </validity>
+            <allow_rule>
+                <domains>
+                    <id_range>
+                        <min>0</min>
+                        <max>430</max>
+                    </id_range>
+                </domains>
+                <publish>
+                    <topics>
+                        <topic>K*</topic>
+                        <topic>*OldMessage</topic>
+                        <topic>OldMessanger</topic>
+                        <topic>NewMessage</topic>
+                    </topics>
+		    <partitions>
+			<partition>Apart</partition>
+			<partition>Bpa?t*</partition>
+		    </partitions>
+                </publish>
+                <subscribe>
+                    <topics>
+                        <topic>K*</topic>
+                        <topic>*OldMessage</topic>
+                        <topic>OldMessanger</topic>
+                        <topic>NewMessage</topic>
+                    </topics>
+		    <partitions>
+			<partition>Apart</partition>
+			<partition>Bpa?t*</partition>
+		    </partitions>
+                </subscribe>
+            </allow_rule>
+            <deny_rule>
+                <domains>
+                    <id_range>
+                        <min>0</min>
+                        <max>230</max>
+                    </id_range>
+                </domains>
+                <publish>
+                    <topics>
+                        <topic>P*</topic>
+                        <topic>*WrongMessage</topic>
+                        <topic>FakeMessanger</topic>
+                        <topic>ChangedMessage</topic>
+                    </topics>
+		    <partitions>
+			<partition>Apart</partition>
+			<partition>Bpa?t*</partition>
+		    </partitions>
+                </publish>
+                <subscribe>
+                    <topics>
+                        <topic>P*</topic>
+                        <topic>*WrongMessage</topic>
+                        <topic>FakeMessanger</topic>
+                        <topic>ChangedMessage</topic>
+                    </topics>
+		    <partitions>
+			<partition>Apart</partition>
+			<partition>Bpa?t*</partition>
+		    </partitions>
+                </subscribe>
+            </deny_rule>
+
+            <default>DENY</default>
+        </grant>
+        <grant name="SpareNodeOpenSplicePermissions">
+            <subject_name>CN=CHAM500 cert,O=Internet Widgits Pty Ltd,ST=Some-State,C=NL</subject_name>
+            <validity>
+                <!-- Format is CCYY-MM-DDThh:mm:ss[Z|(+|-)hh:mm] in GMT -->
+                <not_before>2015-09-15T01:00:00</not_before>
+                <not_after>2115-09-15T01:00:00</not_after>
+            </validity>
+            <allow_rule>
+                <domains>
+                <!-- All domains -->
+                 <id>20</id>
+                 <id>30</id>
+                 <id_range>
+                     <min>0</min>
+                     <max>23</max>
+                 </id_range>
+                 <id_range>
+                     <min>100</min>
+                     <max>120</max>
+                 </id_range>
+                 <id>200</id>
+               </domains>
+                <publish>
+                    <topics>
+                        <topic>K*</topic>
+                        <topic>*OldMessage</topic>
+                        <topic>OldMessanger</topic>
+                        <topic>NewMessage</topic>
+                    </topics>
+		    <partitions>
+			<partition>Apart</partition>
+			<partition>Bpa?t*</partition>
+		    </partitions>
+                </publish>
+                <subscribe>
+                    <topics>
+                        <topic>K*</topic>
+                        <topic>*OldMessage</topic>
+                        <topic>OldMessanger</topic>
+                        <topic>NewMessage</topic>
+                    </topics>
+		    <partitions>
+			<partition>Apart</partition>
+			<partition>Bpa?t*</partition>
+		    </partitions>
+                </subscribe>
+            </allow_rule>
+            <deny_rule>
+                <domains>
+                 <id_range>
+                     <min>0</min>
+                     <max>23</max>
+                 </id_range>
+                 <id_range>
+                     <min>100</min>
+                     <max>120</max>
+                 </id_range>
+                 <id>200</id>
+                </domains>
+                <publish>
+                    <topics>
+                        <topic>P*</topic>
+                        <topic>*WrongMessage</topic>
+                        <topic>FakeMessanger</topic>
+                        <topic>ChangedMessage</topic>
+                    </topics>
+		    <partitions>
+			<partition>Apart</partition>
+			<partition>Bpa?t*</partition>
+		    </partitions>
+                </publish>
+                <subscribe>
+                    <topics>
+                        <topic>P*</topic>
+                        <topic>*WrongMessage</topic>
+                        <topic>FakeMessanger</topic>
+                        <topic>ChangedMessage</topic>
+                    </topics>
+		    <partitions>
+			<partition>Apart</partition>
+			<partition>Bpa?t*</partition>
+		    </partitions>
+                </subscribe>
+            </deny_rule>
+
+            <default>DENY</default>
+        </grant>
+    </permissions>
+</dds>
diff --git a/src/security/builtin_plugins/tests/validate_remote_permissions/etc/Test_Permissions_missing_subject_component.p7s b/src/security/builtin_plugins/tests/validate_remote_permissions/etc/Test_Permissions_missing_subject_component.p7s
new file mode 100644
index 0000000..1362a86
--- /dev/null
+++ b/src/security/builtin_plugins/tests/validate_remote_permissions/etc/Test_Permissions_missing_subject_component.p7s
@@ -0,0 +1,96 @@
+MIME-Version: 1.0
+Content-Type: multipart/signed; protocol="application/x-pkcs7-signature"; micalg="sha-256"; boundary="----DE8A6693E9678989859C23D21F4587AD"
+
+This is an S/MIME signed message
+
+------DE8A6693E9678989859C23D21F4587AD
+Content-Type: text/plain
+
+<?xml version="1.0" encoding="utf-8"?>
+<dds xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xsi:noNamespaceSchemaLocation="https://www.omg.org/spec/DDS-SECURITY/20170901/omg_shared_ca_permissions.xsd">
+    <permissions>
+        <grant name="OpenSplicePermissions">
+            <subject_name>/O=Internet Widgits Pty Ltd/ST=Some-State/CN=CHAM500 cert</subject_name>
+            <validity>
+                <!-- Format is CCYY-MM-DDThh:mm:ss[Z|(+|-)hh:mm] in GMT -->
+                <not_before>2015-09-15T01:00:00</not_before>
+                <not_after>2115-09-15T01:00:00</not_after>
+            </validity>
+            <allow_rule>
+                <domains>
+                    <id_range>
+                        <min>0</min>
+                        <max>230</max>
+                    </id_range>
+                </domains>
+                <publish>
+                    <topics>
+                        <topic>K*</topic>
+                        <topic>*OldMessage</topic>
+                        <topic>OldMessanger</topic>
+                        <topic>NewMessage</topic>
+                    </topics>
+        <partitions>
+      <partition>Apart</partition>
+      <partition>Bpa?t*</partition>
+        </partitions>
+                </publish>
+                <subscribe>
+                    <topics>
+                        <topic>K*</topic>
+                        <topic>*OldMessage</topic>
+                        <topic>OldMessanger</topic>
+                        <topic>NewMessage</topic>
+                    </topics>
+                </subscribe>
+            </allow_rule>
+
+            <default>ALLOW</default>
+        </grant>
+    </permissions>
+</dds>
+
+------DE8A6693E9678989859C23D21F4587AD
+Content-Type: application/x-pkcs7-signature; name="smime.p7s"
+Content-Transfer-Encoding: base64
+Content-Disposition: attachment; filename="smime.p7s"
+
+MIIGXgYJKoZIhvcNAQcCoIIGTzCCBksCAQExDzANBglghkgBZQMEAgEFADALBgkq
+hkiG9w0BBwGgggORMIIDjTCCAnWgAwIBAgIJANsr3sm0NrypMA0GCSqGSIb3DQEB
+CwUAMFwxCzAJBgNVBAYTAk5MMRMwEQYDVQQIDApTb21lLVN0YXRlMR8wHQYDVQQK
+DBZBRExJTksgVGVjaG5vbG9jeSBJbmMuMRcwFQYDVQQDDA5hZGxpbmt0ZWNoLmNv
+bTAgFw0xODA3MzAxMjQ1NTVaGA8yMTE4MDcwNjEyNDU1NVowXDELMAkGA1UEBhMC
+TkwxEzARBgNVBAgMClNvbWUtU3RhdGUxHzAdBgNVBAoMFkFETElOSyBUZWNobm9s
+b2N5IEluYy4xFzAVBgNVBAMMDmFkbGlua3RlY2guY29tMIIBIjANBgkqhkiG9w0B
+AQEFAAOCAQ8AMIIBCgKCAQEAu7jfnJ0wYVuXgG+PgNawdN38+dRpa8jceqi+blID
+ehV6XCxrnGXusTCDuFmo7HMOBVMVNDXlcBWgoGd+u5EultnOEiIeGTgtHc1O6V9w
+icp3BGSpZZax/TcONjMVORaqHCADbQ2J8wsz1FHxuKDwX6BJElYOlK77lb/x3yLs
+DFFC+a0qn2RFh37rcWBRAHy8VEASXKZElT9ZmfKd+KUq34KojhNJ4DepKStTq074
+BRDXVivx+wVD951LFNPiQXq+mgHcLj1k37KlZflTFhdP5oEMtATNsXNJPHlEymiy
+SogRWAmKhysLQudukHfNKN+r0FEQMk/hzpYcFeZSOvbfNQIDAQABo1AwTjAdBgNV
+HQ4EFgQURWMbWvBKZwJvRV1/tyc1R82k0+gwHwYDVR0jBBgwFoAURWMbWvBKZwJv
+RV1/tyc1R82k0+gwDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAQEAkPF+
+ysVtvHnk2hpu9yNDLCJ96ZzIoKOyY7uRj4ovzlAHFdpNOJQdcJihTmN8i7Trht9X
+Vh0rGoR/6nHzo3TIeiogRC80RlDtuA3PF2dDQBMVDStlZMTZPb693hfjdAjhyyw9
+yghhKHHqNDvSsAL0KfBqjG4yGfGpJylYXIT5fWuKlo/ln/yyPa5s54T5XDo+CMbt
+lLX3QnwVOmaRyzylPiTcPCDIkdLBdXmlfyJcmW6fWa6kPx+35MOxPsXZbujCo+42
++OyLqcH1rKT6XhcshjXBEf+kdgUfSClrM1pNRWsw2ChIYim0F+nry5JFy0Y+8Hbb
+6SDB340BFmtgDHbFHTGCApEwggKNAgEBMGkwXDELMAkGA1UEBhMCTkwxEzARBgNV
+BAgMClNvbWUtU3RhdGUxHzAdBgNVBAoMFkFETElOSyBUZWNobm9sb2N5IEluYy4x
+FzAVBgNVBAMMDmFkbGlua3RlY2guY29tAgkA2yveybQ2vKkwDQYJYIZIAWUDBAIB
+BQCggfowGAYJKoZIhvcNAQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG9w0BCQUxDxcN
+MTkwMzI5MTMwODAzWjAvBgkqhkiG9w0BCQQxIgQgrFwsV4SyJfHq+dBhrRXj6PlS
+nZYIo1hJ+L29+U2Xpk0wgY4GCSqGSIb3DQEJDzGBgDB+MAsGCWCGSAFlAwQBKjAI
+BgYqhQMCAgkwCAYGKoUDAgIVMAsGCWCGSAFlAwQBFjALBglghkgBZQMEAQIwCgYI
+KoZIhvcNAwcwDgYIKoZIhvcNAwICAgCAMA0GCCqGSIb3DQMCAgFAMAcGBSsOAwIH
+MA0GCCqGSIb3DQMCAgEoMA0GCSqGSIb3DQEBAQUABIIBAAt1pbdIgmqHNrruevrr
+TUptMNDw6YzlmXpWAq3KZBGaeaiHpYbkI+WhJJee9hG7bF9NGI/SfjPhiaiTjk2X
+XCgmFZJUQhY8pOWkVPSAhBxd+r4kQtRxo2Na148Z2nrxeqcLbk+SE1hxTwT2OgLh
+HWHBoQofZcRFp36Z9v51fZHAZLbQ8pD45+oAe/7ElyrO80MnJc+2RUxcnLScT1J0
+ykgTsgrQxcVVZX6EFHhQxnzpqCbjGvpdGSnyojAFI4PuQ3uNiOTPTYqad4jf/vIq
+YHngEXSMN8wkd8bopl1EPVdxDqKkXuwAb29Q6UvDWLQ4IDZkdHTWc/ojiKjxWsKF
+wuQ=
+
+------DE8A6693E9678989859C23D21F4587AD--
+
diff --git a/src/security/builtin_plugins/tests/validate_remote_permissions/etc/Test_Permissions_missing_subject_component.xml b/src/security/builtin_plugins/tests/validate_remote_permissions/etc/Test_Permissions_missing_subject_component.xml
new file mode 100644
index 0000000..de70a1c
--- /dev/null
+++ b/src/security/builtin_plugins/tests/validate_remote_permissions/etc/Test_Permissions_missing_subject_component.xml
@@ -0,0 +1,44 @@
+<?xml version="1.0" encoding="utf-8"?>
+<dds xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xsi:noNamespaceSchemaLocation="https://www.omg.org/spec/DDS-SECURITY/20170901/omg_shared_ca_permissions.xsd">
+    <permissions>
+        <grant name="OpenSplicePermissions">
+            <subject_name>/O=Internet Widgits Pty Ltd/ST=Some-State/CN=CHAM500 cert</subject_name>
+            <validity>
+                <!-- Format is CCYY-MM-DDThh:mm:ss[Z|(+|-)hh:mm] in GMT -->
+                <not_before>2015-09-15T01:00:00</not_before>
+                <not_after>2115-09-15T01:00:00</not_after>
+            </validity>
+            <allow_rule>
+                <domains>
+                    <id_range>
+                        <min>0</min>
+                        <max>230</max>
+                    </id_range>
+                </domains>
+                <publish>
+                    <topics>
+                        <topic>K*</topic>
+                        <topic>*OldMessage</topic>
+                        <topic>OldMessanger</topic>
+                        <topic>NewMessage</topic>
+                    </topics>
+        <partitions>
+      <partition>Apart</partition>
+      <partition>Bpa?t*</partition>
+        </partitions>
+                </publish>
+                <subscribe>
+                    <topics>
+                        <topic>K*</topic>
+                        <topic>*OldMessage</topic>
+                        <topic>OldMessanger</topic>
+                        <topic>NewMessage</topic>
+                    </topics>
+                </subscribe>
+            </allow_rule>
+
+            <default>ALLOW</default>
+        </grant>
+    </permissions>
+</dds>
diff --git a/src/security/builtin_plugins/tests/validate_remote_permissions/etc/Test_Permissions_not_signed.p7s b/src/security/builtin_plugins/tests/validate_remote_permissions/etc/Test_Permissions_not_signed.p7s
new file mode 100644
index 0000000..8759d91
--- /dev/null
+++ b/src/security/builtin_plugins/tests/validate_remote_permissions/etc/Test_Permissions_not_signed.p7s
@@ -0,0 +1,33 @@
+<?xml version="1.0" encoding="utf-8"?>
+<dds xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xsi:noNamespaceSchemaLocation="https://www.omg.org/spec/DDS-SECURITY/20170901/omg_shared_ca_permissions.xsd">
+    <permissions>
+        <grant name="OpenSplicePermissions">
+            <subject_name>CN=CHAM500 cert,O=Internet Widgits Pty Ltd,ST=Some-State,C=NL</subject_name>
+            <validity>
+                <!-- Format is CCYY-MM-DDThh:mm:ss[Z|(+|-)hh:mm] in GMT -->
+                <not_before>2015-09-15T01:00:00</not_before>
+                <not_after>2115-09-15T01:00:00</not_after>
+            </validity>
+            <allow_rule>
+                <domains>
+                    <id_range>
+                        <min>0</min>
+                        <max>230</max>
+                    </id_range>
+                </domains>
+                <publish>
+                    <topics>
+                        <topic>*</topic>
+                    </topics>
+                </publish>
+                <subscribe>
+                    <topics>
+                        <topic>*</topic>
+                    </topics>
+                </subscribe>
+            </allow_rule>
+            <default>DENY</default>
+        </grant>
+    </permissions>
+</dds>
diff --git a/src/security/builtin_plugins/tests/validate_remote_permissions/etc/Test_Permissions_notyet.p7s b/src/security/builtin_plugins/tests/validate_remote_permissions/etc/Test_Permissions_notyet.p7s
new file mode 100644
index 0000000..7fd4098
--- /dev/null
+++ b/src/security/builtin_plugins/tests/validate_remote_permissions/etc/Test_Permissions_notyet.p7s
@@ -0,0 +1,243 @@
+MIME-Version: 1.0
+Content-Type: multipart/signed; protocol="application/x-pkcs7-signature"; micalg="sha-256"; boundary="----F87E07CA6CCEAB50B03A143AC2354EB4"
+
+This is an S/MIME signed message
+
+------F87E07CA6CCEAB50B03A143AC2354EB4
+Content-Type: text/plain
+
+<?xml version="1.0" encoding="utf-8"?>
+<dds xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xsi:noNamespaceSchemaLocation="https://www.omg.org/spec/DDS-SECURITY/20170901/omg_shared_ca_permissions.xsd">
+    <permissions>
+        <grant name="OpenSplicePermissions">
+            <subject_name>CN=CHAM500 cert,O=Internet Widgits Pty Ltd,ST=Some-State,C=NL</subject_name>
+            <validity>
+                <!-- Format is CCYY-MM-DDThh:mm:ss[Z|(+|-)hh:mm] in GMT -->
+                <not_before>2035-09-15T01:00:00</not_before>
+                <not_after>2046-09-15T01:00:00</not_after>
+            </validity>
+            <allow_rule>
+                <domains>
+                    <id_range>
+                        <min>0</min>
+                        <max>230</max>
+                    </id_range>
+                </domains>
+                <publish>
+                    <topics>
+                        <topic>K*</topic>
+                        <topic>*OldMessage</topic>
+                        <topic>OldMessanger</topic>
+                        <topic>NewMessage</topic>
+                    </topics>
+        <partitions>
+      <partition>Apart</partition>
+      <partition>Bpa?t*</partition>
+        </partitions>
+                </publish>
+                <subscribe>
+                    <topics>
+                        <topic>K*</topic>
+                        <topic>*OldMessage</topic>
+                        <topic>OldMessanger</topic>
+                        <topic>NewMessage</topic>
+                    </topics>
+        <partitions>
+      <partition>Apart</partition>
+      <partition>Bpa?t*</partition>
+        </partitions>
+                </subscribe>
+            </allow_rule>
+            <deny_rule>
+                <domains>
+                    <id_range>
+                        <min>0</min>
+                        <max>230</max>
+                    </id_range>
+                </domains>
+                <publish>
+                    <topics>
+                        <topic>P*</topic>
+                        <topic>*WrongMessage</topic>
+                        <topic>FakeMessanger</topic>
+                        <topic>ChangedMessage</topic>
+                    </topics>
+        <partitions>
+      <partition>Apart</partition>
+      <partition>Bpa?t*</partition>
+        </partitions>
+                </publish>
+                <subscribe>
+                    <topics>
+                        <topic>P*</topic>
+                        <topic>*WrongMessage</topic>
+                        <topic>FakeMessanger</topic>
+                        <topic>ChangedMessage</topic>
+                    </topics>
+        <partitions>
+      <partition>Apart</partition>
+      <partition>Bpa?t*</partition>
+        </partitions>
+                </subscribe>
+            </deny_rule>
+
+            <default>DENY</default>
+        </grant>
+        <grant name="SpareNodeOpenSplicePermissions">
+            <subject_name>CN=Spare cert,O=Internet Widgits Pty Ltd,ST=Some-State,C=NL</subject_name>
+            <validity>
+                <!-- Format is CCYY-MM-DDThh:mm:ss[Z|(+|-)hh:mm] in GMT -->
+                <not_before>2015-09-15T01:00:00</not_before>
+                <not_after>2115-09-15T01:00:00</not_after>
+            </validity>
+            <allow_rule>
+                <domains>
+                <!-- All domains -->
+                 <id>20</id>
+                 <id>30</id>
+                 <id_range>
+                     <min>0</min>
+                     <max>23</max>
+                 </id_range>
+                 <id_range>
+                     <min>100</min>
+                     <max>120</max>
+                 </id_range>
+                 <id>200</id>
+               </domains>
+                <publish>
+                    <topics>
+                        <topic>K*</topic>
+                        <topic>*OldMessage</topic>
+                        <topic>OldMessanger</topic>
+                        <topic>NewMessage</topic>
+                    </topics>
+        <partitions>
+      <partition>Apart</partition>
+      <partition>Bpa?t*</partition>
+        </partitions>
+                </publish>
+                <subscribe>
+                    <topics>
+                        <topic>K*</topic>
+                        <topic>*OldMessage</topic>
+                        <topic>OldMessanger</topic>
+                        <topic>NewMessage</topic>
+                    </topics>
+        <partitions>
+      <partition>Apart</partition>
+      <partition>Bpa?t*</partition>
+        </partitions>
+                </subscribe>
+            </allow_rule>
+            <deny_rule>
+                <domains>
+                 <id_range>
+                     <min>0</min>
+                     <max>23</max>
+                 </id_range>
+                 <id_range>
+                     <min>100</min>
+                     <max>120</max>
+                 </id_range>
+                 <id>200</id>
+                </domains>
+                <publish>
+                    <topics>
+                        <topic>P*</topic>
+                        <topic>*WrongMessage</topic>
+                        <topic>FakeMessanger</topic>
+                        <topic>ChangedMessage</topic>
+                    </topics>
+                    <partitions>
+                      <partition>Apart</partition>
+                      <partition>Bpa?t*</partition>
+                    </partitions>
+                </publish>
+                <subscribe>
+                    <topics>
+                        <topic>P*</topic>
+                        <topic>*WrongMessage</topic>
+                        <topic>FakeMessanger</topic>
+                        <topic>ChangedMessage</topic>
+                    </topics>
+                    <partitions>
+                      <partition>Apart</partition>
+                      <partition>Bpa?t*</partition>
+                    </partitions>
+                    <data_tags>
+                      <tag>
+                        <name>aTagName1</name>
+                        <value>aTagValue1</value>
+                      </tag>
+                    </data_tags>
+                </subscribe>
+                <relay>
+                  <topics>
+                        <topic>P*</topic>
+                        <topic>*WrongMessage</topic>
+                        <topic>FakeMessanger</topic>
+                        <topic>ChangedMessage</topic>
+                    </topics>
+                    <partitions>
+                      <partition>Apart</partition>
+                      <partition>Bpa?t*</partition>
+                    </partitions>
+                    <data_tags>
+                      <tag>
+                        <name>aTagName1</name>
+                        <value>aTagValue1</value>
+                      </tag>
+                    </data_tags>
+                </relay>
+            </deny_rule>
+
+            <default>ALLOW</default>
+        </grant>
+    </permissions>
+</dds>
+
+------F87E07CA6CCEAB50B03A143AC2354EB4
+Content-Type: application/x-pkcs7-signature; name="smime.p7s"
+Content-Transfer-Encoding: base64
+Content-Disposition: attachment; filename="smime.p7s"
+
+MIIGXgYJKoZIhvcNAQcCoIIGTzCCBksCAQExDzANBglghkgBZQMEAgEFADALBgkq
+hkiG9w0BBwGgggORMIIDjTCCAnWgAwIBAgIJANsr3sm0NrypMA0GCSqGSIb3DQEB
+CwUAMFwxCzAJBgNVBAYTAk5MMRMwEQYDVQQIDApTb21lLVN0YXRlMR8wHQYDVQQK
+DBZBRExJTksgVGVjaG5vbG9jeSBJbmMuMRcwFQYDVQQDDA5hZGxpbmt0ZWNoLmNv
+bTAgFw0xODA3MzAxMjQ1NTVaGA8yMTE4MDcwNjEyNDU1NVowXDELMAkGA1UEBhMC
+TkwxEzARBgNVBAgMClNvbWUtU3RhdGUxHzAdBgNVBAoMFkFETElOSyBUZWNobm9s
+b2N5IEluYy4xFzAVBgNVBAMMDmFkbGlua3RlY2guY29tMIIBIjANBgkqhkiG9w0B
+AQEFAAOCAQ8AMIIBCgKCAQEAu7jfnJ0wYVuXgG+PgNawdN38+dRpa8jceqi+blID
+ehV6XCxrnGXusTCDuFmo7HMOBVMVNDXlcBWgoGd+u5EultnOEiIeGTgtHc1O6V9w
+icp3BGSpZZax/TcONjMVORaqHCADbQ2J8wsz1FHxuKDwX6BJElYOlK77lb/x3yLs
+DFFC+a0qn2RFh37rcWBRAHy8VEASXKZElT9ZmfKd+KUq34KojhNJ4DepKStTq074
+BRDXVivx+wVD951LFNPiQXq+mgHcLj1k37KlZflTFhdP5oEMtATNsXNJPHlEymiy
+SogRWAmKhysLQudukHfNKN+r0FEQMk/hzpYcFeZSOvbfNQIDAQABo1AwTjAdBgNV
+HQ4EFgQURWMbWvBKZwJvRV1/tyc1R82k0+gwHwYDVR0jBBgwFoAURWMbWvBKZwJv
+RV1/tyc1R82k0+gwDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAQEAkPF+
+ysVtvHnk2hpu9yNDLCJ96ZzIoKOyY7uRj4ovzlAHFdpNOJQdcJihTmN8i7Trht9X
+Vh0rGoR/6nHzo3TIeiogRC80RlDtuA3PF2dDQBMVDStlZMTZPb693hfjdAjhyyw9
+yghhKHHqNDvSsAL0KfBqjG4yGfGpJylYXIT5fWuKlo/ln/yyPa5s54T5XDo+CMbt
+lLX3QnwVOmaRyzylPiTcPCDIkdLBdXmlfyJcmW6fWa6kPx+35MOxPsXZbujCo+42
++OyLqcH1rKT6XhcshjXBEf+kdgUfSClrM1pNRWsw2ChIYim0F+nry5JFy0Y+8Hbb
+6SDB340BFmtgDHbFHTGCApEwggKNAgEBMGkwXDELMAkGA1UEBhMCTkwxEzARBgNV
+BAgMClNvbWUtU3RhdGUxHzAdBgNVBAoMFkFETElOSyBUZWNobm9sb2N5IEluYy4x
+FzAVBgNVBAMMDmFkbGlua3RlY2guY29tAgkA2yveybQ2vKkwDQYJYIZIAWUDBAIB
+BQCggfowGAYJKoZIhvcNAQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG9w0BCQUxDxcN
+MTkwMzI5MTMwODAzWjAvBgkqhkiG9w0BCQQxIgQg0GGu1gWhHWhfWnmg55AIr4tv
+zMK0kIxNfJYQbb7LpJ8wgY4GCSqGSIb3DQEJDzGBgDB+MAsGCWCGSAFlAwQBKjAI
+BgYqhQMCAgkwCAYGKoUDAgIVMAsGCWCGSAFlAwQBFjALBglghkgBZQMEAQIwCgYI
+KoZIhvcNAwcwDgYIKoZIhvcNAwICAgCAMA0GCCqGSIb3DQMCAgFAMAcGBSsOAwIH
+MA0GCCqGSIb3DQMCAgEoMA0GCSqGSIb3DQEBAQUABIIBALsPI2+b0w+iUPJGJeMd
+VdrY7s/GZYm6M8qOA5fmh3144bY1rZRjdHjXtLdaNDNN1Z5buRCiQcklAilf6O14
+7u6a5HR12N4LTbg3OYQplwz4ed/wBsL726htmkAK3JogGk5OVLqmmdrz3UOD8IaZ
+wAfx2tpj3VJOVuW0XsqOrzQpnOjGWcPeOw6NAxRH1gLsxBP9HDz5+wrsKXjV/zG8
+dFTaZ0bKnBXTp5ccc9jB4qbcllC9nlJkJszGqvwOP7zWBAOXeU+joUGM4Bt+8Pmt
+pKsVAmEqMpc368RMayDBWtTqUWpUKvDh4HSkuOGD4Hj5ViAoLFjisROhIK2d98XI
+cRQ=
+
+------F87E07CA6CCEAB50B03A143AC2354EB4--
+
diff --git a/src/security/builtin_plugins/tests/validate_remote_permissions/etc/Test_Permissions_notyet.xml b/src/security/builtin_plugins/tests/validate_remote_permissions/etc/Test_Permissions_notyet.xml
new file mode 100644
index 0000000..99fec50
--- /dev/null
+++ b/src/security/builtin_plugins/tests/validate_remote_permissions/etc/Test_Permissions_notyet.xml
@@ -0,0 +1,191 @@
+<?xml version="1.0" encoding="utf-8"?>
+<dds xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xsi:noNamespaceSchemaLocation="https://www.omg.org/spec/DDS-SECURITY/20170901/omg_shared_ca_permissions.xsd">
+    <permissions>
+        <grant name="OpenSplicePermissions">
+            <subject_name>CN=CHAM500 cert,O=Internet Widgits Pty Ltd,ST=Some-State,C=NL</subject_name>
+            <validity>
+                <!-- Format is CCYY-MM-DDThh:mm:ss[Z|(+|-)hh:mm] in GMT -->
+                <not_before>2035-09-15T01:00:00</not_before>
+                <not_after>2046-09-15T01:00:00</not_after>
+            </validity>
+            <allow_rule>
+                <domains>
+                    <id_range>
+                        <min>0</min>
+                        <max>230</max>
+                    </id_range>
+                </domains>
+                <publish>
+                    <topics>
+                        <topic>K*</topic>
+                        <topic>*OldMessage</topic>
+                        <topic>OldMessanger</topic>
+                        <topic>NewMessage</topic>
+                    </topics>
+        <partitions>
+      <partition>Apart</partition>
+      <partition>Bpa?t*</partition>
+        </partitions>
+                </publish>
+                <subscribe>
+                    <topics>
+                        <topic>K*</topic>
+                        <topic>*OldMessage</topic>
+                        <topic>OldMessanger</topic>
+                        <topic>NewMessage</topic>
+                    </topics>
+        <partitions>
+      <partition>Apart</partition>
+      <partition>Bpa?t*</partition>
+        </partitions>
+                </subscribe>
+            </allow_rule>
+            <deny_rule>
+                <domains>
+                    <id_range>
+                        <min>0</min>
+                        <max>230</max>
+                    </id_range>
+                </domains>
+                <publish>
+                    <topics>
+                        <topic>P*</topic>
+                        <topic>*WrongMessage</topic>
+                        <topic>FakeMessanger</topic>
+                        <topic>ChangedMessage</topic>
+                    </topics>
+        <partitions>
+      <partition>Apart</partition>
+      <partition>Bpa?t*</partition>
+        </partitions>
+                </publish>
+                <subscribe>
+                    <topics>
+                        <topic>P*</topic>
+                        <topic>*WrongMessage</topic>
+                        <topic>FakeMessanger</topic>
+                        <topic>ChangedMessage</topic>
+                    </topics>
+        <partitions>
+      <partition>Apart</partition>
+      <partition>Bpa?t*</partition>
+        </partitions>
+                </subscribe>
+            </deny_rule>
+
+            <default>DENY</default>
+        </grant>
+        <grant name="SpareNodeOpenSplicePermissions">
+            <subject_name>CN=Spare cert,O=Internet Widgits Pty Ltd,ST=Some-State,C=NL</subject_name>
+            <validity>
+                <!-- Format is CCYY-MM-DDThh:mm:ss[Z|(+|-)hh:mm] in GMT -->
+                <not_before>2015-09-15T01:00:00</not_before>
+                <not_after>2115-09-15T01:00:00</not_after>
+            </validity>
+            <allow_rule>
+                <domains>
+                <!-- All domains -->
+                 <id>20</id>
+                 <id>30</id>
+                 <id_range>
+                     <min>0</min>
+                     <max>23</max>
+                 </id_range>
+                 <id_range>
+                     <min>100</min>
+                     <max>120</max>
+                 </id_range>
+                 <id>200</id>
+               </domains>
+                <publish>
+                    <topics>
+                        <topic>K*</topic>
+                        <topic>*OldMessage</topic>
+                        <topic>OldMessanger</topic>
+                        <topic>NewMessage</topic>
+                    </topics>
+        <partitions>
+      <partition>Apart</partition>
+      <partition>Bpa?t*</partition>
+        </partitions>
+                </publish>
+                <subscribe>
+                    <topics>
+                        <topic>K*</topic>
+                        <topic>*OldMessage</topic>
+                        <topic>OldMessanger</topic>
+                        <topic>NewMessage</topic>
+                    </topics>
+        <partitions>
+      <partition>Apart</partition>
+      <partition>Bpa?t*</partition>
+        </partitions>
+                </subscribe>
+            </allow_rule>
+            <deny_rule>
+                <domains>
+                 <id_range>
+                     <min>0</min>
+                     <max>23</max>
+                 </id_range>
+                 <id_range>
+                     <min>100</min>
+                     <max>120</max>
+                 </id_range>
+                 <id>200</id>
+                </domains>
+                <publish>
+                    <topics>
+                        <topic>P*</topic>
+                        <topic>*WrongMessage</topic>
+                        <topic>FakeMessanger</topic>
+                        <topic>ChangedMessage</topic>
+                    </topics>
+                    <partitions>
+                      <partition>Apart</partition>
+                      <partition>Bpa?t*</partition>
+                    </partitions>
+                </publish>
+                <subscribe>
+                    <topics>
+                        <topic>P*</topic>
+                        <topic>*WrongMessage</topic>
+                        <topic>FakeMessanger</topic>
+                        <topic>ChangedMessage</topic>
+                    </topics>
+                    <partitions>
+                      <partition>Apart</partition>
+                      <partition>Bpa?t*</partition>
+                    </partitions>
+                    <data_tags>
+                      <tag>
+                        <name>aTagName1</name>
+                        <value>aTagValue1</value>
+                      </tag>
+                    </data_tags>
+                </subscribe>
+                <relay>
+                  <topics>
+                        <topic>P*</topic>
+                        <topic>*WrongMessage</topic>
+                        <topic>FakeMessanger</topic>
+                        <topic>ChangedMessage</topic>
+                    </topics>
+                    <partitions>
+                      <partition>Apart</partition>
+                      <partition>Bpa?t*</partition>
+                    </partitions>
+                    <data_tags>
+                      <tag>
+                        <name>aTagName1</name>
+                        <value>aTagValue1</value>
+                      </tag>
+                    </data_tags>
+                </relay>
+            </deny_rule>
+
+            <default>ALLOW</default>
+        </grant>
+    </permissions>
+</dds>
diff --git a/src/security/builtin_plugins/tests/validate_remote_permissions/etc/Test_Permissions_ok.p7s b/src/security/builtin_plugins/tests/validate_remote_permissions/etc/Test_Permissions_ok.p7s
new file mode 100644
index 0000000..052075b
--- /dev/null
+++ b/src/security/builtin_plugins/tests/validate_remote_permissions/etc/Test_Permissions_ok.p7s
@@ -0,0 +1,85 @@
+MIME-Version: 1.0
+Content-Type: multipart/signed; protocol="application/x-pkcs7-signature"; micalg="sha-256"; boundary="----6B91005B007BBA8EDE10CD1CE487DB27"
+
+This is an S/MIME signed message
+
+------6B91005B007BBA8EDE10CD1CE487DB27
+Content-Type: text/plain
+
+<?xml version="1.0" encoding="utf-8"?>
+<dds xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xsi:noNamespaceSchemaLocation="https://www.omg.org/spec/DDS-SECURITY/20170901/omg_shared_ca_permissions.xsd">
+    <permissions>
+        <grant name="OpenSplicePermissions">
+            <subject_name>CN=CHAM500 cert,O=Internet Widgits Pty Ltd,ST=Some-State,C=NL</subject_name>
+            <validity>
+                <!-- Format is CCYY-MM-DDThh:mm:ss[Z|(+|-)hh:mm] in GMT -->
+                <not_before>2015-09-15T01:00:00</not_before>
+                <not_after>2115-09-15T01:00:00</not_after>
+            </validity>
+            <allow_rule>
+                <domains>
+                    <id_range>
+                        <min>0</min>
+                        <max>230</max>
+                    </id_range>
+                </domains>
+                <publish>
+                    <topics>
+                        <topic>*</topic>
+                    </topics>
+                </publish>
+                <subscribe>
+                    <topics>
+                        <topic>*</topic>
+                    </topics>
+                </subscribe>
+            </allow_rule>
+            <default>DENY</default>
+        </grant>
+    </permissions>
+</dds>
+
+------6B91005B007BBA8EDE10CD1CE487DB27
+Content-Type: application/x-pkcs7-signature; name="smime.p7s"
+Content-Transfer-Encoding: base64
+Content-Disposition: attachment; filename="smime.p7s"
+
+MIIGXgYJKoZIhvcNAQcCoIIGTzCCBksCAQExDzANBglghkgBZQMEAgEFADALBgkq
+hkiG9w0BBwGgggORMIIDjTCCAnWgAwIBAgIJANsr3sm0NrypMA0GCSqGSIb3DQEB
+CwUAMFwxCzAJBgNVBAYTAk5MMRMwEQYDVQQIDApTb21lLVN0YXRlMR8wHQYDVQQK
+DBZBRExJTksgVGVjaG5vbG9jeSBJbmMuMRcwFQYDVQQDDA5hZGxpbmt0ZWNoLmNv
+bTAgFw0xODA3MzAxMjQ1NTVaGA8yMTE4MDcwNjEyNDU1NVowXDELMAkGA1UEBhMC
+TkwxEzARBgNVBAgMClNvbWUtU3RhdGUxHzAdBgNVBAoMFkFETElOSyBUZWNobm9s
+b2N5IEluYy4xFzAVBgNVBAMMDmFkbGlua3RlY2guY29tMIIBIjANBgkqhkiG9w0B
+AQEFAAOCAQ8AMIIBCgKCAQEAu7jfnJ0wYVuXgG+PgNawdN38+dRpa8jceqi+blID
+ehV6XCxrnGXusTCDuFmo7HMOBVMVNDXlcBWgoGd+u5EultnOEiIeGTgtHc1O6V9w
+icp3BGSpZZax/TcONjMVORaqHCADbQ2J8wsz1FHxuKDwX6BJElYOlK77lb/x3yLs
+DFFC+a0qn2RFh37rcWBRAHy8VEASXKZElT9ZmfKd+KUq34KojhNJ4DepKStTq074
+BRDXVivx+wVD951LFNPiQXq+mgHcLj1k37KlZflTFhdP5oEMtATNsXNJPHlEymiy
+SogRWAmKhysLQudukHfNKN+r0FEQMk/hzpYcFeZSOvbfNQIDAQABo1AwTjAdBgNV
+HQ4EFgQURWMbWvBKZwJvRV1/tyc1R82k0+gwHwYDVR0jBBgwFoAURWMbWvBKZwJv
+RV1/tyc1R82k0+gwDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAQEAkPF+
+ysVtvHnk2hpu9yNDLCJ96ZzIoKOyY7uRj4ovzlAHFdpNOJQdcJihTmN8i7Trht9X
+Vh0rGoR/6nHzo3TIeiogRC80RlDtuA3PF2dDQBMVDStlZMTZPb693hfjdAjhyyw9
+yghhKHHqNDvSsAL0KfBqjG4yGfGpJylYXIT5fWuKlo/ln/yyPa5s54T5XDo+CMbt
+lLX3QnwVOmaRyzylPiTcPCDIkdLBdXmlfyJcmW6fWa6kPx+35MOxPsXZbujCo+42
++OyLqcH1rKT6XhcshjXBEf+kdgUfSClrM1pNRWsw2ChIYim0F+nry5JFy0Y+8Hbb
+6SDB340BFmtgDHbFHTGCApEwggKNAgEBMGkwXDELMAkGA1UEBhMCTkwxEzARBgNV
+BAgMClNvbWUtU3RhdGUxHzAdBgNVBAoMFkFETElOSyBUZWNobm9sb2N5IEluYy4x
+FzAVBgNVBAMMDmFkbGlua3RlY2guY29tAgkA2yveybQ2vKkwDQYJYIZIAWUDBAIB
+BQCggfowGAYJKoZIhvcNAQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG9w0BCQUxDxcN
+MTkwMzI5MTMwODAzWjAvBgkqhkiG9w0BCQQxIgQgl3LfUhn9L0vG/3QRPVYptcYw
+/NH5HMN99aMe9JAT+LAwgY4GCSqGSIb3DQEJDzGBgDB+MAsGCWCGSAFlAwQBKjAI
+BgYqhQMCAgkwCAYGKoUDAgIVMAsGCWCGSAFlAwQBFjALBglghkgBZQMEAQIwCgYI
+KoZIhvcNAwcwDgYIKoZIhvcNAwICAgCAMA0GCCqGSIb3DQMCAgFAMAcGBSsOAwIH
+MA0GCCqGSIb3DQMCAgEoMA0GCSqGSIb3DQEBAQUABIIBAHe9vakfXPvbpgMeqlhG
+SW6Z3uVA3Yri9bgQDpJ9daIUsM0/TLBSQVs85twTMXvqUSntKbfSGehxDQ9F+yje
+mOEPMIwxOqcVyc2jpqoYsUWqpwiiZyk49DHUFrOfWJUx+rKdBftZWkxD05Wkovhk
+2d4hGS/65Haoho4Z0AZwcyH+F52FZMiqw7I9FKrPlhxvJfQXmhIjOKtnvWnQ+Ar7
+YYiSrBEHMCy82LF1aKzz0nkL1SYWQHuQX475qoU4LMYY1J8WsD3rSBeq4GYZrl2K
+X/JcOquMYqjfJLMYZY4fsc3FgEBkKNqJz1tDZ3ir24VMl+WsbEjVK8oXe/wt4V0U
+aNQ=
+
+------6B91005B007BBA8EDE10CD1CE487DB27--
+
diff --git a/src/security/builtin_plugins/tests/validate_remote_permissions/etc/Test_Permissions_ok.xml b/src/security/builtin_plugins/tests/validate_remote_permissions/etc/Test_Permissions_ok.xml
new file mode 100644
index 0000000..8759d91
--- /dev/null
+++ b/src/security/builtin_plugins/tests/validate_remote_permissions/etc/Test_Permissions_ok.xml
@@ -0,0 +1,33 @@
+<?xml version="1.0" encoding="utf-8"?>
+<dds xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xsi:noNamespaceSchemaLocation="https://www.omg.org/spec/DDS-SECURITY/20170901/omg_shared_ca_permissions.xsd">
+    <permissions>
+        <grant name="OpenSplicePermissions">
+            <subject_name>CN=CHAM500 cert,O=Internet Widgits Pty Ltd,ST=Some-State,C=NL</subject_name>
+            <validity>
+                <!-- Format is CCYY-MM-DDThh:mm:ss[Z|(+|-)hh:mm] in GMT -->
+                <not_before>2015-09-15T01:00:00</not_before>
+                <not_after>2115-09-15T01:00:00</not_after>
+            </validity>
+            <allow_rule>
+                <domains>
+                    <id_range>
+                        <min>0</min>
+                        <max>230</max>
+                    </id_range>
+                </domains>
+                <publish>
+                    <topics>
+                        <topic>*</topic>
+                    </topics>
+                </publish>
+                <subscribe>
+                    <topics>
+                        <topic>*</topic>
+                    </topics>
+                </subscribe>
+            </allow_rule>
+            <default>DENY</default>
+        </grant>
+    </permissions>
+</dds>
diff --git a/src/security/builtin_plugins/tests/validate_remote_permissions/etc/Test_Permissions_unknown_ca.p7s b/src/security/builtin_plugins/tests/validate_remote_permissions/etc/Test_Permissions_unknown_ca.p7s
new file mode 100644
index 0000000..6a2905a
--- /dev/null
+++ b/src/security/builtin_plugins/tests/validate_remote_permissions/etc/Test_Permissions_unknown_ca.p7s
@@ -0,0 +1,87 @@
+MIME-Version: 1.0
+Content-Type: multipart/signed; protocol="application/x-pkcs7-signature"; micalg="sha-256"; boundary="----7FBACED8776E5A4CF7612C83F9C33E17"
+
+This is an S/MIME signed message
+
+------7FBACED8776E5A4CF7612C83F9C33E17
+Content-Type: text/plain
+
+<?xml version="1.0" encoding="utf-8"?>
+<dds xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xsi:noNamespaceSchemaLocation="https://www.omg.org/spec/DDS-SECURITY/20170901/omg_shared_ca_permissions.xsd">
+    <permissions>
+        <grant name="OpenSplicePermissions">
+            <subject_name>/C=NL/ST=Some-State/O=ADLINK Technolocy Inc./CN=adlinktech.com</subject_name>
+            <validity>
+                <!-- Format is CCYY-MM-DDThh:mm:ss[Z|(+|-)hh:mm] in GMT -->
+                <not_before>2015-09-15T01:00:00</not_before>
+                <not_after>2115-09-15T01:00:00</not_after>
+            </validity>
+            <allow_rule>
+                <domains>
+                    <id_range>
+                        <min>0</min>
+                        <max>230</max>
+                    </id_range>
+                </domains>
+                <publish>
+                    <topics>
+                        <topic>*</topic>
+                    </topics>
+                </publish>
+                <subscribe>
+                    <topics>
+                        <topic>*</topic>
+                    </topics>
+                </subscribe>
+            </allow_rule>
+            <default>DENY</default>
+        </grant>
+    </permissions>
+</dds>
+
+------7FBACED8776E5A4CF7612C83F9C33E17
+Content-Type: application/x-pkcs7-signature; name="smime.p7s"
+Content-Transfer-Encoding: base64
+Content-Disposition: attachment; filename="smime.p7s"
+
+MIIGywYJKoZIhvcNAQcCoIIGvDCCBrgCAQExDzANBglghkgBZQMEAgEFADALBgkq
+hkiG9w0BBwGgggPKMIIDxjCCAq4CCQCBuTktP0h8BDANBgkqhkiG9w0BAQsFADCB
+pDEWMBQGA1UEBwwNTG9jYWxpdHkgTmFtZTEhMB8GA1UECwwYT3JnYW5pemF0aW9u
+YWwgVW5pdCBOYW1lMRwwGgYJKoZIhvcNAQkBFg1FbWFpbCBBZGRyZXNzMQswCQYD
+VQQGEwJVUzELMAkGA1UECAwCTkoxGjAYBgNVBAoMEUV4YW1wbGUgU2lnbmVyIENB
+MRMwEQYDVQQDDApFeGFtcGxlIENBMB4XDTE4MDgxNTA4NTE0MVoXDTQzMDgwOTA4
+NTE0MVowgaQxFjAUBgNVBAcMDUxvY2FsaXR5IE5hbWUxITAfBgNVBAsMGE9yZ2Fu
+aXphdGlvbmFsIFVuaXQgTmFtZTEcMBoGCSqGSIb3DQEJARYNRW1haWwgQWRkcmVz
+czELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAk5KMRowGAYDVQQKDBFFeGFtcGxlIFNp
+Z25lciBDQTETMBEGA1UEAwwKRXhhbXBsZSBDQTCCASIwDQYJKoZIhvcNAQEBBQAD
+ggEPADCCAQoCggEBALStAQ0yjM2qAWwsOXdX3hiyoZ6DDHWOTNI5LoCZGaN9rUZe
+MY0waSxWNQ0ruURgZISeOFkdQTAE81Em+UaZI+MZvfYcEcSlVtF6yve/WnIzRYWu
+f917moMCAInktfch4E6mskr4h7n+9sEz+3GsQS8SQRtwUe+PiXzjZrqHSbLC4Kn3
+/b8Mt+Ww3a4FyjHDZQJZsGSvrScr0Gq3xeKfMwb+KYNEnmh0o4os0gEGA4KUR+/1
+YDl1NmxQnm/AIMqwJzeaezBoMn0Nsi+OlAms85imGURNj9BCEJZBWwuuNL5ECDAq
+WLOM3AKUsApVgtGd8/OLWW1RwYkW8uqTtkIR87MCAwEAATANBgkqhkiG9w0BAQsF
+AAOCAQEAokKC77/kvxlObLSwkT5+7+S+DeznLBRiGVEh8+9PQw1q91sjiOZWf0e3
+T3XPH7CR/NDYoQJkrsqzIwKYrj41z/1jAs+HkH45NpTFiGlUFXNs5iwNh4RUqgf4
+e78Mge4q7pHMFzWTEwEn4DJMGcDDjLW1kN8GobGwHR7O0MpAJKrqcBSo+SPomnQv
+TgiEMQ+Vlz0EJx6JPsq8c7HrxlSdeDAAWIOww/wcGyzlpYEoyz6voSSfdhMt5iy5
+k5BvhBJnTiJTasCHy9KRuis/6qpTZKEj0d7J7LAqpGh8oRIphMwCbFYQT0QBgV6p
+gM8Ufss/RZ6CshMNxz7KtIYpvmxPPTGCAsUwggLBAgEBMIGyMIGkMRYwFAYDVQQH
+DA1Mb2NhbGl0eSBOYW1lMSEwHwYDVQQLDBhPcmdhbml6YXRpb25hbCBVbml0IE5h
+bWUxHDAaBgkqhkiG9w0BCQEWDUVtYWlsIEFkZHJlc3MxCzAJBgNVBAYTAlVTMQsw
+CQYDVQQIDAJOSjEaMBgGA1UECgwRRXhhbXBsZSBTaWduZXIgQ0ExEzARBgNVBAMM
+CkV4YW1wbGUgQ0ECCQCBuTktP0h8BDANBglghkgBZQMEAgEFAKCB5DAYBgkqhkiG
+9w0BCQMxCwYJKoZIhvcNAQcBMBwGCSqGSIb3DQEJBTEPFw0xODA5MTMwOTIzMDNa
+MC8GCSqGSIb3DQEJBDEiBCCvP08gFBO7651mPPDFQ2suhL+eprGCGuRLXmiBmdvx
+ITB5BgkqhkiG9w0BCQ8xbDBqMAsGCWCGSAFlAwQBKjALBglghkgBZQMEARYwCwYJ
+YIZIAWUDBAECMAoGCCqGSIb3DQMHMA4GCCqGSIb3DQMCAgIAgDANBggqhkiG9w0D
+AgIBQDAHBgUrDgMCBzANBggqhkiG9w0DAgIBKDANBgkqhkiG9w0BAQEFAASCAQB/
+4EQel+0LsmiNFCUjWM68u4ZvPtFBpeDe456DJuG6QR0LIzW42U7N4P2ZTIqjpGZx
+YekBCNdkiVy6ER5IA4WfcKd6zXZEuXVxkMrGpJlqGdd+IdZpTsrBygGZJS4vMUfD
+/6ty6OycET88RmJIu4V/TM3yLVKzHuj6TxCXb4OIYx8g3mdXUwUrp6DGgqggRSPJ
+tatbpnqGZGcvty8MusXVnjnEwUWnJ/jojypY3MyL4MTbjufjv0K6NKQ3RzoLssot
+SLq0YDLwvX/s9sLXDCedAwFXBS/6Qv56v0M2x4o8e3Eul7gGTMuCd/dJ0BhF8CW+
+IGxR5I3xXssh/AuWRRtV
+
+------7FBACED8776E5A4CF7612C83F9C33E17--
+
diff --git a/src/security/builtin_plugins/tests/validate_remote_permissions/etc/Test_Permissions_unknown_subject.p7s b/src/security/builtin_plugins/tests/validate_remote_permissions/etc/Test_Permissions_unknown_subject.p7s
new file mode 100644
index 0000000..fb488c7
--- /dev/null
+++ b/src/security/builtin_plugins/tests/validate_remote_permissions/etc/Test_Permissions_unknown_subject.p7s
@@ -0,0 +1,85 @@
+MIME-Version: 1.0
+Content-Type: multipart/signed; protocol="application/x-pkcs7-signature"; micalg="sha-256"; boundary="----7B161F9203F175A7F82A389A3E044741"
+
+This is an S/MIME signed message
+
+------7B161F9203F175A7F82A389A3E044741
+Content-Type: text/plain
+
+<?xml version="1.0" encoding="utf-8"?>
+<dds xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xsi:noNamespaceSchemaLocation="https://www.omg.org/spec/DDS-SECURITY/20170901/omg_shared_ca_permissions.xsd">
+    <permissions>
+        <grant name="OpenSplicePermissions">
+            <subject_name>gibberish</subject_name>
+            <validity>
+                <!-- Format is CCYY-MM-DDThh:mm:ss[Z|(+|-)hh:mm] in GMT -->
+                <not_before>2015-09-15T01:00:00</not_before>
+                <not_after>2115-09-15T01:00:00</not_after>
+            </validity>
+            <allow_rule>
+                <domains>
+                    <id_range>
+                        <min>0</min>
+                        <max>230</max>
+                    </id_range>
+                </domains>
+                <publish>
+                    <topics>
+                        <topic>*</topic>
+                    </topics>
+                </publish>
+                <subscribe>
+                    <topics>
+                        <topic>*</topic>
+                    </topics>
+                </subscribe>
+            </allow_rule>
+            <default>DENY</default>
+        </grant>
+    </permissions>
+</dds>
+
+------7B161F9203F175A7F82A389A3E044741
+Content-Type: application/x-pkcs7-signature; name="smime.p7s"
+Content-Transfer-Encoding: base64
+Content-Disposition: attachment; filename="smime.p7s"
+
+MIIGXgYJKoZIhvcNAQcCoIIGTzCCBksCAQExDzANBglghkgBZQMEAgEFADALBgkq
+hkiG9w0BBwGgggORMIIDjTCCAnWgAwIBAgIJANsr3sm0NrypMA0GCSqGSIb3DQEB
+CwUAMFwxCzAJBgNVBAYTAk5MMRMwEQYDVQQIDApTb21lLVN0YXRlMR8wHQYDVQQK
+DBZBRExJTksgVGVjaG5vbG9jeSBJbmMuMRcwFQYDVQQDDA5hZGxpbmt0ZWNoLmNv
+bTAgFw0xODA3MzAxMjQ1NTVaGA8yMTE4MDcwNjEyNDU1NVowXDELMAkGA1UEBhMC
+TkwxEzARBgNVBAgMClNvbWUtU3RhdGUxHzAdBgNVBAoMFkFETElOSyBUZWNobm9s
+b2N5IEluYy4xFzAVBgNVBAMMDmFkbGlua3RlY2guY29tMIIBIjANBgkqhkiG9w0B
+AQEFAAOCAQ8AMIIBCgKCAQEAu7jfnJ0wYVuXgG+PgNawdN38+dRpa8jceqi+blID
+ehV6XCxrnGXusTCDuFmo7HMOBVMVNDXlcBWgoGd+u5EultnOEiIeGTgtHc1O6V9w
+icp3BGSpZZax/TcONjMVORaqHCADbQ2J8wsz1FHxuKDwX6BJElYOlK77lb/x3yLs
+DFFC+a0qn2RFh37rcWBRAHy8VEASXKZElT9ZmfKd+KUq34KojhNJ4DepKStTq074
+BRDXVivx+wVD951LFNPiQXq+mgHcLj1k37KlZflTFhdP5oEMtATNsXNJPHlEymiy
+SogRWAmKhysLQudukHfNKN+r0FEQMk/hzpYcFeZSOvbfNQIDAQABo1AwTjAdBgNV
+HQ4EFgQURWMbWvBKZwJvRV1/tyc1R82k0+gwHwYDVR0jBBgwFoAURWMbWvBKZwJv
+RV1/tyc1R82k0+gwDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAQEAkPF+
+ysVtvHnk2hpu9yNDLCJ96ZzIoKOyY7uRj4ovzlAHFdpNOJQdcJihTmN8i7Trht9X
+Vh0rGoR/6nHzo3TIeiogRC80RlDtuA3PF2dDQBMVDStlZMTZPb693hfjdAjhyyw9
+yghhKHHqNDvSsAL0KfBqjG4yGfGpJylYXIT5fWuKlo/ln/yyPa5s54T5XDo+CMbt
+lLX3QnwVOmaRyzylPiTcPCDIkdLBdXmlfyJcmW6fWa6kPx+35MOxPsXZbujCo+42
++OyLqcH1rKT6XhcshjXBEf+kdgUfSClrM1pNRWsw2ChIYim0F+nry5JFy0Y+8Hbb
+6SDB340BFmtgDHbFHTGCApEwggKNAgEBMGkwXDELMAkGA1UEBhMCTkwxEzARBgNV
+BAgMClNvbWUtU3RhdGUxHzAdBgNVBAoMFkFETElOSyBUZWNobm9sb2N5IEluYy4x
+FzAVBgNVBAMMDmFkbGlua3RlY2guY29tAgkA2yveybQ2vKkwDQYJYIZIAWUDBAIB
+BQCggfowGAYJKoZIhvcNAQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG9w0BCQUxDxcN
+MTkwMzI5MTMwODAzWjAvBgkqhkiG9w0BCQQxIgQg44QSCYJrKGm9hdPbOKQjrnQ8
+LXMSbo0mve1cRKvrm3gwgY4GCSqGSIb3DQEJDzGBgDB+MAsGCWCGSAFlAwQBKjAI
+BgYqhQMCAgkwCAYGKoUDAgIVMAsGCWCGSAFlAwQBFjALBglghkgBZQMEAQIwCgYI
+KoZIhvcNAwcwDgYIKoZIhvcNAwICAgCAMA0GCCqGSIb3DQMCAgFAMAcGBSsOAwIH
+MA0GCCqGSIb3DQMCAgEoMA0GCSqGSIb3DQEBAQUABIIBAH/fJ90OwloC73faPAGC
+VRZrhW/gSsy/1VnprvWdDAU1ZZK+srIISFZAy19LcApTis0Vy9yz2PG8pue49R+y
+UF6mCDSuN/l9SRBdUN+CXQdQ8sGq5SHXNhGzSX/nbR20ol4cSUMpKlEGx66E0KUW
+tkk8HzYw7aHMiwK2E2Y0sbm/M/rdmAbgEoywYfvc25V4FHP66TstfCLBjN9Hz3bH
+WcrCZuPjZo6vBd/rIJQSlgH81aCWn5RfCIccbc3iogwzIhYxAr6d+4do3LNa6H80
+W6CMgl0AnWFfa4QwnXFUzb1/W2rFjHp453w1Cbqk4Ll4ZlVJr4fzIuyuJMQlMrmK
+1P0=
+
+------7B161F9203F175A7F82A389A3E044741--
+
diff --git a/src/security/builtin_plugins/tests/validate_remote_permissions/etc/Test_Permissions_unknown_subject.xml b/src/security/builtin_plugins/tests/validate_remote_permissions/etc/Test_Permissions_unknown_subject.xml
new file mode 100644
index 0000000..8a55faf
--- /dev/null
+++ b/src/security/builtin_plugins/tests/validate_remote_permissions/etc/Test_Permissions_unknown_subject.xml
@@ -0,0 +1,33 @@
+<?xml version="1.0" encoding="utf-8"?>
+<dds xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xsi:noNamespaceSchemaLocation="https://www.omg.org/spec/DDS-SECURITY/20170901/omg_shared_ca_permissions.xsd">
+    <permissions>
+        <grant name="OpenSplicePermissions">
+            <subject_name>gibberish</subject_name>
+            <validity>
+                <!-- Format is CCYY-MM-DDThh:mm:ss[Z|(+|-)hh:mm] in GMT -->
+                <not_before>2015-09-15T01:00:00</not_before>
+                <not_after>2115-09-15T01:00:00</not_after>
+            </validity>
+            <allow_rule>
+                <domains>
+                    <id_range>
+                        <min>0</min>
+                        <max>230</max>
+                    </id_range>
+                </domains>
+                <publish>
+                    <topics>
+                        <topic>*</topic>
+                    </topics>
+                </publish>
+                <subscribe>
+                    <topics>
+                        <topic>*</topic>
+                    </topics>
+                </subscribe>
+            </allow_rule>
+            <default>DENY</default>
+        </grant>
+    </permissions>
+</dds>
diff --git a/src/security/builtin_plugins/tests/validate_remote_permissions/src/validate_remote_permissions_utests.c b/src/security/builtin_plugins/tests/validate_remote_permissions/src/validate_remote_permissions_utests.c
new file mode 100644
index 0000000..137137a
--- /dev/null
+++ b/src/security/builtin_plugins/tests/validate_remote_permissions/src/validate_remote_permissions_utests.c
@@ -0,0 +1,1068 @@
+/*
+ * Copyright(c) 2006 to 2019 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+#include <assert.h>
+#include <openssl/evp.h>
+#include <openssl/hmac.h>
+#include <openssl/bio.h>
+#include <openssl/err.h>
+
+#include "dds/ddsrt/environ.h"
+#include "dds/ddsrt/heap.h"
+#include "dds/ddsrt/io.h"
+#include "dds/ddsrt/string.h"
+#include "dds/ddsrt/types.h"
+#include "dds/security/dds_security_api.h"
+#include "dds/security/core/dds_security_utils.h"
+#include "CUnit/CUnit.h"
+#include "CUnit/Test.h"
+#include "common/src/loader.h"
+#include "config_env.h"
+
+static const char *ACCESS_PERMISSIONS_TOKEN_ID = "DDS:Access:Permissions:1.0";
+static const char *AUTH_PROTOCOL_CLASS_ID = "DDS:Auth:PKI-DH:1.0";
+
+static const char *PROPERTY_IDENTITY_CA = "dds.sec.auth.identity_ca";
+static const char *PROPERTY_PRIVATE_KEY = "dds.sec.auth.private_key";
+static const char *PROPERTY_IDENTITY_CERT = "dds.sec.auth.identity_certificate";
+static const char *PROPERTY_PERMISSIONS_CA = "dds.sec.access.permissions_ca";
+static const char *PROPERTY_PERMISSIONS = "dds.sec.access.permissions";
+static const char *PROPERTY_GOVERNANCE = "dds.sec.access.governance";
+
+static const char *PROPERTY_PERMISSIONS_CA_SN = "dds.perm_ca.sn";
+static const char *PROPERTY_PERMISSIONS_CA_ALGO = "dds.perm_ca.algo";
+static const char *PROPERTY_C_ID = "c.id";
+static const char *PROPERTY_C_PERM = "c.perm";
+
+static const char *SUBJECT_NAME_PERMISSIONS_CA = "C=NL, ST=Some-State, O=ADLINK Technolocy Inc., CN=adlinktech.com";
+static const char *RSA_2048_ALGORITHM_NAME = "RSA-2048";
+
+static const char *RELATIVE_PATH_TO_ETC_DIR = "/validate_remote_permissions/etc/";
+
+static const char *identity_certificate =
+    "data:,-----BEGIN CERTIFICATE-----\n"
+    "MIIEQTCCAymgAwIBAgIINpuaAAnrQZIwDQYJKoZIhvcNAQELBQAwXzELMAkGA1UE\n"
+    "BhMCTkwxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdp\n"
+    "ZGdpdHMgUHR5IEx0ZDEYMBYGA1UEAxMPQ0hBTTUwMCByb290IGNhMCAXDTE3MDIy\n"
+    "MjIyMjIwMFoYDzIyMjIwMjIyMjIyMjAwWjBcMQswCQYDVQQGEwJOTDETMBEGA1UE\n"
+    "CBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRk\n"
+    "MRUwEwYDVQQDEwxDSEFNNTAwIGNlcnQwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAw\n"
+    "ggEKAoIBAQDCpVhivH/wBIyu74rvQncnSZqKyspN6CvD1pmV9wft5PHhVt9jV79v\n"
+    "gSub5LADoRHAgFdv9duYgBr17Ob6uRrIY4B18CcrCjhQcC4gjx8y2jl9PeYm+qYD\n"
+    "3o44FYBrBq0QCnrQgKsb/qX9Z+Mw/VUiw65x68W876LEHQQoEgT4kxSuagwBoVRk\n"
+    "ePD6fYAKmT4XS3x+O0v+rHESTcsKF6yMadgp7h3eH1b8kJTzSx8JV9Zzq++mxjox\n"
+    "qhbBVP5nDze2hhSIeCkCvSrx7efkgKS4AQXa5/Z44GiAu1TfXXUqdic9rxwD0edn\n"
+    "ajNElnZe7sjok/0yuqvH+2hSqpNva/zpAgMBAAGjggEAMIH9MAwGA1UdDwQFAwMH\n"
+    "/4AwgewGA1UdJQSB5DCB4QYIKwYBBQUHAwEGCCsGAQUFBwMCBggrBgEFBQcDAwYI\n"
+    "KwYBBQUHAwQGCCsGAQUFBwMIBgorBgEEAYI3AgEVBgorBgEEAYI3AgEWBgorBgEE\n"
+    "AYI3CgMBBgorBgEEAYI3CgMDBgorBgEEAYI3CgMEBglghkgBhvhCBAEGCysGAQQB\n"
+    "gjcKAwQBBggrBgEFBQcDBQYIKwYBBQUHAwYGCCsGAQUFBwMHBggrBgEFBQgCAgYK\n"
+    "KwYBBAGCNxQCAgYIKwYBBQUHAwkGCCsGAQUFBwMNBggrBgEFBQcDDgYHKwYBBQID\n"
+    "BTANBgkqhkiG9w0BAQsFAAOCAQEAawdHy0Xw7nTK2ltp91Ion6fJ7hqYuj///zr7\n"
+    "Adt6uonpDh/xl3esuwcFimIJrJrHujnGkL0nLddRCikmnzuBMNDWS6yq0/Ckl/YG\n"
+    "yjNr44dlX24wo+MVAgkj3/8CyWDZ3a8kBg9QT3bs2SqbjmhTrXN1DRyf9S5vJysE\n"
+    "I7V1gTN66BeKL64hOrAlRVrEu8Ds6TWL6Q/YH+61ViZkoLTeSaPjH4nknaFr4C35\n"
+    "iji0JhkyfRHRRVPHFnaj25AkxOrSV64qVKoTMjDl5fji5iMGtjm6iJ7q05ml/qDl\n"
+    "nLotHXemZNvYhbwUmRzbt4Dls9EMH4VRbP85I94nM5TAvtHVNA==\n"
+    "-----END CERTIFICATE-----\n";
+
+static const char *identity_ca =
+    "data:,-----BEGIN CERTIFICATE-----\n"
+    "MIIEmTCCA4GgAwIBAgIIZ5gEIUFhO5wwDQYJKoZIhvcNAQELBQAwXzELMAkGA1UE\n"
+    "BhMCTkwxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdp\n"
+    "ZGdpdHMgUHR5IEx0ZDEYMBYGA1UEAxMPQ0hBTTUwMCByb290IGNhMCAXDTE4MDIx\n"
+    "MjE1MDUwMFoYDzIyMjIwMjIyMjIyMjAwWjBfMQswCQYDVQQGEwJOTDETMBEGA1UE\n"
+    "CBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRk\n"
+    "MRgwFgYDVQQDEw9DSEFNNTAwIHJvb3QgY2EwggEiMA0GCSqGSIb3DQEBAQUAA4IB\n"
+    "DwAwggEKAoIBAQC6Fa3TheL+UrdZCp9GhU/2WbneP2t/avUa3muwDttPxeI2XU9k\n"
+    "ZjBR95mAXme4SPXHk5+YDN319AqIje3oKhzky/ngvKH2GkoJKYxWnuDBfMEHdViz\n"
+    "2Q9/xso2ZvH50ukwWa0pfx2/EVV1wRxeQcRd/UVfq3KTJizG0M88mOYvGEAw3LFf\n"
+    "zef7k1aCuOofQmBvLukUudcYpMzfyHFp7lQqU4CcrrR5RtmfiUfrWfdGLea2iPDB\n"
+    "pJgN8ESOMwEHtOTEBDclYnH9L4t7CHQz+fXXS5IWFsDK9fCMQjnxDsDVeNrNzTYL\n"
+    "FaZrMg9S6IUQCEsQWsnq5weS8omOpVLUm9klAgMBAAGjggFVMIIBUTAMBgNVHRME\n"
+    "BTADAQH/MB0GA1UdDgQWBBQg2FZB/j8uWDVnJhjwXkX278znSTAfBgNVHSMEGDAW\n"
+    "gBQg2FZB/j8uWDVnJhjwXkX278znSTAPBgNVHQ8BAf8EBQMDB/+AMIHvBgNVHSUB\n"
+    "Af8EgeQwgeEGCCsGAQUFBwMBBggrBgEFBQcDAgYIKwYBBQUHAwMGCCsGAQUFBwME\n"
+    "BggrBgEFBQcDCAYKKwYBBAGCNwIBFQYKKwYBBAGCNwIBFgYKKwYBBAGCNwoDAQYK\n"
+    "KwYBBAGCNwoDAwYKKwYBBAGCNwoDBAYJYIZIAYb4QgQBBgsrBgEEAYI3CgMEAQYI\n"
+    "KwYBBQUHAwUGCCsGAQUFBwMGBggrBgEFBQcDBwYIKwYBBQUIAgIGCisGAQQBgjcU\n"
+    "AgIGCCsGAQUFBwMJBggrBgEFBQcDDQYIKwYBBQUHAw4GBysGAQUCAwUwDQYJKoZI\n"
+    "hvcNAQELBQADggEBAKHmwejWRwGE1wf1k2rG8SNRV/neGsZ6Qfqf6co3TpR/Wi1s\n"
+    "iZDvSeT/rbqNBS7z34xnG88NIUwu00y78e8Mfon31ZZbK4Uo7fla9/D3ukdJqPQC\n"
+    "LKdbKJjR2kH+KCukY/1rghjJ8/X+t2egBit0LCOdsFCl07Sfksb9kpGUIZSFcYYm\n"
+    "geqhjhoNwxazzHiw+QWHC5HG9248JIizBmy1aymNWuMnPudhjHAnPcsIlqMVNq3t\n"
+    "Rv9ap7S8JeCxHVRPJvJeCwXWvW3dW/v3xH52Yn/fqRblN1w9Fxz5NhopKx0gj/Jd\n"
+    "sw2N4Fk4gaOWEolFpa0bwNw8nAx7moehZpowzfw=\n"
+    "-----END CERTIFICATE-----\n";
+
+static const char *private_key =
+    "data:,-----BEGIN RSA PRIVATE KEY-----\n"
+    "MIIEogIBAAKCAQEAwqVYYrx/8ASMru+K70J3J0maisrKTegrw9aZlfcH7eTx4Vbf\n"
+    "Y1e/b4Erm+SwA6ERwIBXb/XbmIAa9ezm+rkayGOAdfAnKwo4UHAuII8fMto5fT3m\n"
+    "JvqmA96OOBWAawatEAp60ICrG/6l/WfjMP1VIsOucevFvO+ixB0EKBIE+JMUrmoM\n"
+    "AaFUZHjw+n2ACpk+F0t8fjtL/qxxEk3LChesjGnYKe4d3h9W/JCU80sfCVfWc6vv\n"
+    "psY6MaoWwVT+Zw83toYUiHgpAr0q8e3n5ICkuAEF2uf2eOBogLtU3111KnYnPa8c\n"
+    "A9HnZ2ozRJZ2Xu7I6JP9Mrqrx/toUqqTb2v86QIDAQABAoIBAC1q32DKkx+yMBFx\n"
+    "m32QiLUGG6VfBC2BixS7MkMnzRXZYgcuehl4FBc0kLRjfB6cqsO8LqrVN1QyMBhK\n"
+    "GutN3c38SbE7RChqzhEW2+yE+Mao3Nk4ZEecHLiyaYT0n25ZtHAVwep823BAzwJ+\n"
+    "BykbM45VEpNKbG1VjSktjBa9faNyZiZAEJEjVyla+6R8N4kHV52LbZcLjvJv3IQ2\n"
+    "iPYRrmMyI5C23qTni0vy7yJbAXBo3CqgSlwie9FARBWT7Puu7F4mF1O1c/SnTysw\n"
+    "Tm3e5FzgfHipQbnRVn0w4rDprPMKmPxMnvf/Wkw0zVgNadp1Tc1I6Yj525DEQ07i\n"
+    "2gIn/gECgYEA4jNnY1u2Eu7x3pAQF3dRO0x35boVtuq9iwQk7q+uaZaK4RJRr+0Y\n"
+    "T68S3bPnfer6SHvcxtST89Bvs/j/Ky4SOaX037UYjFh6T7OIzPl+MzO1yb+VOBT6\n"
+    "D6FVGEJGp8ZAITU1OfJPeTYViUeEC8tHFGoKUCk50FbB6jOf1oKtv/ECgYEA3EnB\n"
+    "Y7kSbJJaUuj9ciFUL/pAno86Cim3VjegK1wKgEiyDb610bhoMErovPwfVJbtcttG\n"
+    "eKJNuwizkRcVbj+vpjDvqqaP5eMxLl6/Nd4haPMJYzGo88Z8NJpwFRNF2KEWjOpQ\n"
+    "2NEvoCeRtVulCJyka2Tpljzw8cOXkxhPOe2UhHkCgYBo3entj0QO7QXm56T+LAvV\n"
+    "0PK45xdQEO3EuCwjGAFk5C0IgUSrqeCeeIzniZMltj1IQ1wsNbtNynEu3530t8wt\n"
+    "O7oVyFBUKGSz9IjUdkpClJOPr6kPMfJoMqRPtdIpz+hFPPSrI6IikKdVWHloOlp+\n"
+    "pVaYqTQrWT1XRY2xli3VEQKBgGySmZN6Cx+h/oywswIGdUT0VdcQhq2to+QFpJba\n"
+    "VX6m1cM6hMip2Ag9U3qZ1SNPBBdBBfm9HQybHE3dj713/C2wHuAAGhpXIM1W+20k\n"
+    "X1knuC/AsSH9aQhQOf/ZMOq1crTfZBuI9q0782/sjGmzMsKPySU4QhUWruVb7OiD\n"
+    "NVkZAoGAEvihW7G+8/iOE40vGHyBqUeopAAWLciTAUIEwM/Oi3BYfNWNTWF/FWNc\n"
+    "nMvCZPYigY8C1vO+1iT2Frtd3CIU+f01Q3fJNJoRLlEiKLNZUJRF48OKUqjKSmsi\n"
+    "w6pucFO40z05YW7utApj4L82rZnOS0pd1tUI1yexqvj0i4ThJfk=\n"
+    "-----END RSA PRIVATE KEY-----\n";
+
+static const char *permissions_ca =
+    "data:,-----BEGIN CERTIFICATE-----\n"
+    "MIIDjTCCAnWgAwIBAgIJANsr3sm0NrypMA0GCSqGSIb3DQEBCwUAMFwxCzAJBgNV\n"
+    "BAYTAk5MMRMwEQYDVQQIDApTb21lLVN0YXRlMR8wHQYDVQQKDBZBRExJTksgVGVj\n"
+    "aG5vbG9jeSBJbmMuMRcwFQYDVQQDDA5hZGxpbmt0ZWNoLmNvbTAgFw0xODA3MzAx\n"
+    "MjQ1NTVaGA8yMTE4MDcwNjEyNDU1NVowXDELMAkGA1UEBhMCTkwxEzARBgNVBAgM\n"
+    "ClNvbWUtU3RhdGUxHzAdBgNVBAoMFkFETElOSyBUZWNobm9sb2N5IEluYy4xFzAV\n"
+    "BgNVBAMMDmFkbGlua3RlY2guY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB\n"
+    "CgKCAQEAu7jfnJ0wYVuXgG+PgNawdN38+dRpa8jceqi+blIDehV6XCxrnGXusTCD\n"
+    "uFmo7HMOBVMVNDXlcBWgoGd+u5EultnOEiIeGTgtHc1O6V9wicp3BGSpZZax/TcO\n"
+    "NjMVORaqHCADbQ2J8wsz1FHxuKDwX6BJElYOlK77lb/x3yLsDFFC+a0qn2RFh37r\n"
+    "cWBRAHy8VEASXKZElT9ZmfKd+KUq34KojhNJ4DepKStTq074BRDXVivx+wVD951L\n"
+    "FNPiQXq+mgHcLj1k37KlZflTFhdP5oEMtATNsXNJPHlEymiySogRWAmKhysLQudu\n"
+    "kHfNKN+r0FEQMk/hzpYcFeZSOvbfNQIDAQABo1AwTjAdBgNVHQ4EFgQURWMbWvBK\n"
+    "ZwJvRV1/tyc1R82k0+gwHwYDVR0jBBgwFoAURWMbWvBKZwJvRV1/tyc1R82k0+gw\n"
+    "DAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAQEAkPF+ysVtvHnk2hpu9yND\n"
+    "LCJ96ZzIoKOyY7uRj4ovzlAHFdpNOJQdcJihTmN8i7Trht9XVh0rGoR/6nHzo3TI\n"
+    "eiogRC80RlDtuA3PF2dDQBMVDStlZMTZPb693hfjdAjhyyw9yghhKHHqNDvSsAL0\n"
+    "KfBqjG4yGfGpJylYXIT5fWuKlo/ln/yyPa5s54T5XDo+CMbtlLX3QnwVOmaRyzyl\n"
+    "PiTcPCDIkdLBdXmlfyJcmW6fWa6kPx+35MOxPsXZbujCo+42+OyLqcH1rKT6Xhcs\n"
+    "hjXBEf+kdgUfSClrM1pNRWsw2ChIYim0F+nry5JFy0Y+8Hbb6SDB340BFmtgDHbF\n"
+    "HQ==\n"
+    "-----END CERTIFICATE-----\n";
+
+static struct plugins_hdl *plugins = NULL;
+static dds_security_authentication *auth = NULL;
+static dds_security_access_control *access_control = NULL;
+static DDS_Security_IdentityHandle local_identity_handle = DDS_SECURITY_HANDLE_NIL;
+static DDS_Security_IdentityHandle remote_identity_handle = DDS_SECURITY_HANDLE_NIL;
+static DDS_Security_PermissionsHandle local_permissions_handle = DDS_SECURITY_HANDLE_NIL;
+static DDS_Security_GUID_t local_participant_guid;
+static char *g_path_to_etc_dir = NULL;
+
+static void dds_security_property_init(DDS_Security_PropertySeq *seq, DDS_Security_unsigned_long size)
+{
+  seq->_length = size;
+  seq->_maximum = size;
+  seq->_buffer = ddsrt_malloc(size * sizeof(DDS_Security_Property_t));
+  memset(seq->_buffer, 0, size * sizeof(DDS_Security_Property_t));
+}
+
+static void dds_security_property_deinit(DDS_Security_PropertySeq *seq)
+{
+  uint32_t i;
+
+  for (i = 0; i < seq->_length; i++)
+  {
+    ddsrt_free(seq->_buffer[i].name);
+    ddsrt_free(seq->_buffer[i].value);
+  }
+  ddsrt_free(seq->_buffer);
+}
+
+static void reset_exception(DDS_Security_SecurityException *ex)
+{
+  ex->code = 0;
+  ex->minor_code = 0;
+  ddsrt_free(ex->message);
+  ex->message = NULL;
+}
+
+static void fill_participant_qos(DDS_Security_Qos *qos, const char *permission_filename, const char *governance_filename)
+{
+  char *permission_uri;
+  char *governance_uri;
+
+  ddsrt_asprintf(&permission_uri, "file:%s%s", g_path_to_etc_dir, permission_filename);
+  ddsrt_asprintf(&governance_uri, "file:%s%s", g_path_to_etc_dir, governance_filename);
+
+  memset(qos, 0, sizeof(*qos));
+  dds_security_property_init(&qos->property.value, 6);
+  qos->property.value._buffer[0].name = ddsrt_strdup(PROPERTY_IDENTITY_CERT);
+  qos->property.value._buffer[0].value = ddsrt_strdup(identity_certificate);
+  qos->property.value._buffer[1].name = ddsrt_strdup(PROPERTY_IDENTITY_CA);
+  qos->property.value._buffer[1].value = ddsrt_strdup(identity_ca);
+  qos->property.value._buffer[2].name = ddsrt_strdup(PROPERTY_PRIVATE_KEY);
+  qos->property.value._buffer[2].value = ddsrt_strdup(private_key);
+  qos->property.value._buffer[3].name = ddsrt_strdup(PROPERTY_PERMISSIONS_CA);
+  qos->property.value._buffer[3].value = ddsrt_strdup(permissions_ca);
+  qos->property.value._buffer[4].name = ddsrt_strdup(PROPERTY_PERMISSIONS);
+  qos->property.value._buffer[4].value = ddsrt_strdup(permission_uri);
+  qos->property.value._buffer[5].name = ddsrt_strdup(PROPERTY_GOVERNANCE);
+  qos->property.value._buffer[5].value = ddsrt_strdup(governance_uri);
+
+  ddsrt_free(permission_uri);
+  ddsrt_free(governance_uri);
+}
+
+static void fill_permissions_token(DDS_Security_PermissionsToken *token)
+{
+  memset(token, 0, sizeof(DDS_Security_PermissionsToken));
+
+  token->class_id = ddsrt_strdup(ACCESS_PERMISSIONS_TOKEN_ID);
+  token->properties._length = token->properties._maximum = 2;
+  token->properties._buffer = DDS_Security_PropertySeq_allocbuf(2);
+
+  token->properties._buffer[0].name = ddsrt_strdup(PROPERTY_PERMISSIONS_CA_SN);
+  token->properties._buffer[0].value = ddsrt_strdup(SUBJECT_NAME_PERMISSIONS_CA);
+
+  token->properties._buffer[1].name = ddsrt_strdup(PROPERTY_PERMISSIONS_CA_ALGO);
+  token->properties._buffer[1].value = ddsrt_strdup(RSA_2048_ALGORITHM_NAME);
+}
+
+static int fill_peer_credential_token(DDS_Security_AuthenticatedPeerCredentialToken *token, const char *permission_filename)
+{
+  int result = 1;
+  char *permission_uri;
+  char *permission_data;
+
+  memset(token, 0, sizeof(DDS_Security_AuthenticatedPeerCredentialToken));
+
+  ddsrt_asprintf(&permission_uri, "%s%s", g_path_to_etc_dir, permission_filename);
+
+  permission_data = load_file_contents(permission_uri);
+
+  if (permission_data)
+  {
+    token->class_id = ddsrt_strdup(AUTH_PROTOCOL_CLASS_ID);
+    token->properties._length = token->properties._maximum = 2;
+    token->properties._buffer = DDS_Security_PropertySeq_allocbuf(2);
+
+    token->properties._buffer[0].name = ddsrt_strdup(PROPERTY_C_ID);
+    token->properties._buffer[0].value = ddsrt_strdup(&identity_certificate[6]);
+
+    token->properties._buffer[1].name = ddsrt_strdup(PROPERTY_C_PERM);
+    token->properties._buffer[1].value = permission_data;
+  }
+  else
+  {
+    ddsrt_free(permission_data);
+    result = 0;
+  }
+  ddsrt_free(permission_uri);
+
+  return result;
+}
+
+static void corrupt_permission_signature(DDS_Security_AuthenticatedPeerCredentialToken *token)
+{
+  DDS_Security_string permissions;
+  size_t len;
+
+  /* It is expected that the permissions are available in a fixed location. */
+  CU_ASSERT_FATAL(token != NULL);
+  CU_ASSERT_FATAL(token->properties._buffer != NULL);
+  CU_ASSERT_FATAL(token->properties._length == 2);
+  CU_ASSERT_FATAL(token->properties._buffer[1].name != NULL);
+  CU_ASSERT_FATAL(token->properties._buffer[1].value != NULL);
+  CU_ASSERT_FATAL(strcmp(token->properties._buffer[1].name, PROPERTY_C_PERM) == 0);
+
+  /* Corrupt a byte somewhere in the signature. */
+  permissions = token->properties._buffer[1].value;
+  CU_ASSERT_FATAL(permissions != NULL);
+  len = strlen(permissions);
+  CU_ASSERT_FATAL(len > 100);
+  permissions[len - 75]--;
+}
+
+static int validate_local_identity_and_permissions(void)
+{
+  int res = 0;
+  DDS_Security_ValidationResult_t result;
+  DDS_Security_DomainId domain_id = 0;
+  DDS_Security_Qos participant_qos;
+  DDS_Security_GUID_t candidate_participant_guid;
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  DDS_Security_GuidPrefix_t prefix = {0xb0, 0xb1, 0xb2, 0xb3, 0xb4, 0xb5, 0xb6, 0xb7, 0xb8, 0xb9, 0xba, 0xbb};
+  DDS_Security_EntityId_t entityId = {{0xb0, 0xb1, 0xb2}, 0x1};
+
+  memset(&local_participant_guid, 0, sizeof(local_participant_guid));
+  memcpy(&candidate_participant_guid.prefix, &prefix, sizeof(prefix));
+  memcpy(&candidate_participant_guid.entityId, &entityId, sizeof(entityId));
+
+  fill_participant_qos(&participant_qos, "Test_Permissions_ok.p7s", "Test_Governance_ok.p7s");
+
+  /* Now call the function. */
+  result = auth->validate_local_identity(
+      auth,
+      &local_identity_handle,
+      &local_participant_guid,
+      domain_id,
+      &participant_qos,
+      &candidate_participant_guid,
+      &exception);
+
+  if (result != DDS_SECURITY_VALIDATION_OK)
+  {
+    res = -1;
+    printf("validate_local_identity_failed: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+
+  reset_exception(&exception);
+
+  if (res == 0)
+  {
+    local_permissions_handle = access_control->validate_local_permissions(
+        access_control,
+        auth,
+        local_identity_handle,
+        0,
+        &participant_qos,
+        &exception);
+
+    if (local_permissions_handle == DDS_SECURITY_HANDLE_NIL)
+    {
+      res = -1;
+      printf("validate_local_permissions_failed: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+  }
+
+  dds_security_property_deinit(&participant_qos.property.value);
+
+  return res;
+}
+
+static void clear_local_identity_and_permissions(void)
+{
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  DDS_Security_boolean success;
+
+  if (local_permissions_handle != DDS_SECURITY_HANDLE_NIL)
+  {
+    success = access_control->return_permissions_handle(access_control, local_permissions_handle, &exception);
+    if (!success)
+      printf("return_permission_handle failed: %s\n", exception.message ? exception.message : "Error message missing");
+    reset_exception(&exception);
+  }
+
+  if (local_identity_handle != DDS_SECURITY_HANDLE_NIL)
+  {
+    success = auth->return_identity_handle(auth, local_identity_handle, &exception);
+    if (!success)
+      printf("return_identity_handle failed: %s\n", exception.message ? exception.message : "Error message missing");
+    reset_exception(&exception);
+  }
+}
+
+static void set_path_to_etc_dir(void)
+{
+  ddsrt_asprintf(&g_path_to_etc_dir, "%s%s", CONFIG_ENV_TESTS_DIR, RELATIVE_PATH_TO_ETC_DIR);
+}
+
+static void suite_validate_remote_permissions_init(void)
+{
+  plugins = load_plugins(&access_control, &auth, NULL /* Cryptograpy */);
+  CU_ASSERT_FATAL(plugins != NULL);
+  set_path_to_etc_dir();
+  validate_local_identity_and_permissions();
+}
+
+static void suite_validate_remote_permissions_fini(void)
+{
+  clear_local_identity_and_permissions();
+  unload_plugins(plugins);
+  ddsrt_free(g_path_to_etc_dir);
+}
+
+CU_Test(ddssec_builtin_validate_remote_permissions, valid_permissions, .init = suite_validate_remote_permissions_init, .fini = suite_validate_remote_permissions_fini)
+{
+  DDS_Security_PermissionsHandle result;
+  DDS_Security_PermissionsToken permissions_token;
+  DDS_Security_AuthenticatedPeerCredentialToken credential_token;
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  int r;
+
+  /* Check if we actually have validate_remote_permissions function. */
+  CU_ASSERT_FATAL(access_control != NULL);
+  CU_ASSERT_FATAL(local_identity_handle != DDS_SECURITY_HANDLE_NIL);
+  CU_ASSERT_FATAL(access_control->validate_remote_permissions != NULL);
+  CU_ASSERT_FATAL(access_control->return_permissions_handle != NULL);
+
+  fill_permissions_token(&permissions_token);
+  r = fill_peer_credential_token(&credential_token, "Test_Permissions_ok.p7s");
+  CU_ASSERT_FATAL(r);
+
+  remote_identity_handle++;
+
+  result = access_control->validate_remote_permissions(
+      access_control,
+      auth,
+      local_identity_handle,
+      remote_identity_handle,
+      &permissions_token,
+      &credential_token,
+      &exception);
+
+  if (result == 0)
+    printf("validate_remote_permissions_failed: %s\n", exception.message ? exception.message : "Error message missing");
+  reset_exception(&exception);
+  CU_ASSERT_FATAL(result != 0);
+  access_control->return_permissions_handle(access_control, result, &exception);
+  reset_exception(&exception);
+  DDS_Security_DataHolder_deinit((DDS_Security_DataHolder *)&permissions_token);
+  DDS_Security_DataHolder_deinit((DDS_Security_DataHolder *)&credential_token);
+}
+
+CU_Test(ddssec_builtin_validate_remote_permissions, permissions_unknown_ca, .init = suite_validate_remote_permissions_init, .fini = suite_validate_remote_permissions_fini)
+{
+  DDS_Security_PermissionsHandle result;
+  DDS_Security_PermissionsToken permissions_token;
+  DDS_Security_AuthenticatedPeerCredentialToken credential_token;
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  int r;
+
+  /* Check if we actually have validate_remote_permissions function. */
+  CU_ASSERT_FATAL(access_control != NULL);
+  CU_ASSERT_FATAL(local_identity_handle != DDS_SECURITY_HANDLE_NIL);
+  CU_ASSERT_FATAL(access_control->validate_remote_permissions != NULL);
+  CU_ASSERT_FATAL(access_control->return_permissions_handle != NULL);
+
+  fill_permissions_token(&permissions_token);
+  r = fill_peer_credential_token(&credential_token, "Test_Permissions_unknown_ca.p7s");
+  CU_ASSERT_FATAL(r);
+
+  remote_identity_handle++;
+
+  result = access_control->validate_remote_permissions(
+      access_control,
+      auth,
+      local_identity_handle,
+      remote_identity_handle,
+      &permissions_token,
+      &credential_token,
+      &exception);
+
+  if (result == 0)
+  {
+    printf("validate_remote_permissions_failed: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+
+  CU_ASSERT(result == 0);
+  if (result == 0)
+  {
+    CU_ASSERT(exception.code != 0);
+    CU_ASSERT(exception.message != NULL);
+  }
+  else
+  {
+    reset_exception(&exception);
+    access_control->return_permissions_handle(access_control, result, &exception);
+  }
+
+  reset_exception(&exception);
+
+  DDS_Security_DataHolder_deinit((DDS_Security_DataHolder *)&permissions_token);
+  DDS_Security_DataHolder_deinit((DDS_Security_DataHolder *)&credential_token);
+}
+
+CU_Test(ddssec_builtin_validate_remote_permissions, permissions_not_signed, .init = suite_validate_remote_permissions_init, .fini = suite_validate_remote_permissions_fini)
+{
+  DDS_Security_PermissionsHandle result;
+  DDS_Security_PermissionsToken permissions_token;
+  DDS_Security_AuthenticatedPeerCredentialToken credential_token;
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  int r;
+
+  /* Check if we actually have validate_remote_permissions function. */
+  CU_ASSERT_FATAL(access_control != NULL);
+  CU_ASSERT_FATAL(local_identity_handle != DDS_SECURITY_HANDLE_NIL);
+  CU_ASSERT_FATAL(access_control->validate_remote_permissions != NULL);
+  CU_ASSERT_FATAL(access_control->return_permissions_handle != NULL);
+
+  fill_permissions_token(&permissions_token);
+  r = fill_peer_credential_token(&credential_token, "Test_Permissions_not_signed.p7s");
+  CU_ASSERT_FATAL(r);
+
+  remote_identity_handle++;
+
+  result = access_control->validate_remote_permissions(
+      access_control,
+      auth,
+      local_identity_handle,
+      remote_identity_handle,
+      &permissions_token,
+      &credential_token,
+      &exception);
+
+  if (result == 0)
+  {
+    printf("validate_remote_permissions_failed: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+
+  CU_ASSERT(result == 0);
+  if (result == 0)
+  {
+    CU_ASSERT(exception.code != 0);
+    CU_ASSERT(exception.message != NULL);
+  }
+  else
+  {
+    reset_exception(&exception);
+    access_control->return_permissions_handle(access_control, result, &exception);
+  }
+
+  reset_exception(&exception);
+
+  DDS_Security_DataHolder_deinit((DDS_Security_DataHolder *)&permissions_token);
+  DDS_Security_DataHolder_deinit((DDS_Security_DataHolder *)&credential_token);
+}
+
+CU_Test(ddssec_builtin_validate_remote_permissions, invalid_credential_token, .init = suite_validate_remote_permissions_init, .fini = suite_validate_remote_permissions_fini)
+{
+  DDS_Security_PermissionsHandle result;
+  DDS_Security_PermissionsToken permissions_token;
+  DDS_Security_AuthenticatedPeerCredentialToken credential_token;
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+
+  /* Check if we actually have validate_remote_permissions function. */
+  CU_ASSERT_FATAL(access_control != NULL);
+  CU_ASSERT_FATAL(local_identity_handle != DDS_SECURITY_HANDLE_NIL);
+  CU_ASSERT_FATAL(access_control->validate_remote_permissions != NULL);
+  CU_ASSERT_FATAL(access_control->return_permissions_handle != NULL);
+
+  remote_identity_handle++;
+
+  fill_permissions_token(&permissions_token);
+
+  /* empty peer credential token */
+  memset(&credential_token, 0, sizeof(credential_token));
+
+  result = access_control->validate_remote_permissions(
+      access_control,
+      auth,
+      local_identity_handle,
+      remote_identity_handle,
+      &permissions_token,
+      &credential_token,
+      &exception);
+
+  if (result == 0)
+  {
+    printf("validate_remote_permissions_failed: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+
+  CU_ASSERT(result == 0);
+  if (result == 0)
+  {
+    CU_ASSERT(exception.code != 0);
+    CU_ASSERT(exception.message != NULL);
+  }
+  else
+  {
+    reset_exception(&exception);
+    access_control->return_permissions_handle(access_control, result, &exception);
+  }
+
+  reset_exception(&exception);
+
+  /* peer credential token with invalid class id */
+  credential_token.class_id = "UNKNOWN";
+
+  result = access_control->validate_remote_permissions(
+      access_control,
+      auth,
+      local_identity_handle,
+      remote_identity_handle,
+      &permissions_token,
+      &credential_token,
+      &exception);
+
+  if (result == 0)
+  {
+    printf("validate_remote_permissions_failed: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+
+  CU_ASSERT(result == 0);
+  if (result == 0)
+  {
+    CU_ASSERT(exception.code != 0);
+    CU_ASSERT(exception.message != NULL);
+  }
+  else
+  {
+    reset_exception(&exception);
+    access_control->return_permissions_handle(access_control, result, &exception);
+  }
+
+  reset_exception(&exception);
+
+  /* peer credential token with no properties */
+  credential_token.class_id = ddsrt_strdup(AUTH_PROTOCOL_CLASS_ID);
+
+  result = access_control->validate_remote_permissions(
+      access_control,
+      auth,
+      local_identity_handle,
+      remote_identity_handle,
+      &permissions_token,
+      &credential_token,
+      &exception);
+
+  if (result == 0)
+  {
+    printf("validate_remote_permissions_failed: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+
+  CU_ASSERT(result == 0);
+  if (result == 0)
+  {
+    CU_ASSERT(exception.code != 0);
+    CU_ASSERT(exception.message != NULL);
+  }
+  else
+  {
+    reset_exception(&exception);
+    access_control->return_permissions_handle(access_control, result, &exception);
+  }
+
+  reset_exception(&exception);
+
+  /* peer credential token with empty properties */
+  credential_token.properties._length = credential_token.properties._maximum = 2;
+  credential_token.properties._buffer = DDS_Security_PropertySeq_allocbuf(2);
+
+  result = access_control->validate_remote_permissions(
+      access_control,
+      auth,
+      local_identity_handle,
+      remote_identity_handle,
+      &permissions_token,
+      &credential_token,
+      &exception);
+
+  if (result == 0)
+  {
+    printf("validate_remote_permissions_failed: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+
+  CU_ASSERT(result == 0);
+  if (result == 0)
+  {
+    CU_ASSERT(exception.code != 0);
+    CU_ASSERT(exception.message != NULL);
+  }
+  else
+  {
+    reset_exception(&exception);
+    access_control->return_permissions_handle(access_control, result, &exception);
+  }
+
+  reset_exception(&exception);
+
+  /* peer credential token with no c.id value */
+  credential_token.properties._buffer[0].name = ddsrt_strdup(PROPERTY_C_ID);
+
+  result = access_control->validate_remote_permissions(
+      access_control,
+      auth,
+      local_identity_handle,
+      remote_identity_handle,
+      &permissions_token,
+      &credential_token,
+      &exception);
+
+  if (result == 0)
+  {
+    printf("validate_remote_permissions_failed: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+
+  CU_ASSERT(result == 0);
+  if (result == 0)
+  {
+    CU_ASSERT(exception.code != 0);
+    CU_ASSERT(exception.message != NULL);
+  }
+  else
+  {
+    reset_exception(&exception);
+    access_control->return_permissions_handle(access_control, result, &exception);
+  }
+
+  reset_exception(&exception);
+
+  /* peer credential token with no c.perm */
+  credential_token.properties._buffer[0].value = ddsrt_strdup(PROPERTY_IDENTITY_CERT);
+
+  result = access_control->validate_remote_permissions(
+      access_control,
+      auth,
+      local_identity_handle,
+      remote_identity_handle,
+      &permissions_token,
+      &credential_token,
+      &exception);
+
+  if (result == 0)
+  {
+    printf("validate_remote_permissions_failed: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+
+  CU_ASSERT(result == 0);
+  if (result == 0)
+  {
+    CU_ASSERT(exception.code != 0);
+    CU_ASSERT(exception.message != NULL);
+  }
+  else
+  {
+    reset_exception(&exception);
+    access_control->return_permissions_handle(access_control, result, &exception);
+  }
+
+  reset_exception(&exception);
+
+  /* peer credential token with no c.perm value*/
+  credential_token.properties._buffer[1].name = ddsrt_strdup(PROPERTY_C_PERM);
+
+  result = access_control->validate_remote_permissions(
+      access_control,
+      auth,
+      local_identity_handle,
+      remote_identity_handle,
+      &permissions_token,
+      &credential_token,
+      &exception);
+
+  if (result == 0)
+  {
+    printf("validate_remote_permissions_failed: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+
+  CU_ASSERT(result == 0);
+  if (result == 0)
+  {
+    CU_ASSERT(exception.code != 0);
+    CU_ASSERT(exception.message != NULL);
+  }
+  else
+  {
+    reset_exception(&exception);
+    access_control->return_permissions_handle(access_control, result, &exception);
+  }
+
+  reset_exception(&exception);
+
+  /* peer credential token with invalid c.perm value */
+  credential_token.properties._buffer[1].value = ddsrt_strdup("Invalid value");
+
+  result = access_control->validate_remote_permissions(
+      access_control,
+      auth,
+      local_identity_handle,
+      remote_identity_handle,
+      &permissions_token,
+      &credential_token,
+      &exception);
+
+  if (result == 0)
+  {
+    printf("validate_remote_permissions_failed: %s\n", exception.message ? exception.message : "Error message missing");
+  }
+
+  CU_ASSERT(result == 0);
+  if (result == 0)
+  {
+    CU_ASSERT(exception.code != 0);
+    CU_ASSERT(exception.message != NULL);
+  }
+  else
+  {
+    reset_exception(&exception);
+    access_control->return_permissions_handle(access_control, result, &exception);
+  }
+
+  reset_exception(&exception);
+
+  DDS_Security_DataHolder_deinit((DDS_Security_DataHolder *)&permissions_token);
+  DDS_Security_DataHolder_deinit((DDS_Security_DataHolder *)&credential_token);
+}
+
+CU_Test(ddssec_builtin_validate_remote_permissions, invalid_xml, .init = suite_validate_remote_permissions_init, .fini = suite_validate_remote_permissions_fini)
+{
+  DDS_Security_PermissionsHandle result;
+  DDS_Security_PermissionsToken permissions_token;
+  DDS_Security_AuthenticatedPeerCredentialToken credential_token;
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  int r;
+
+  /* Check if we actually have validate_remote_permissions function. */
+  CU_ASSERT_FATAL(access_control != NULL);
+  CU_ASSERT_FATAL(local_identity_handle != DDS_SECURITY_HANDLE_NIL);
+  CU_ASSERT_FATAL(access_control->validate_remote_permissions != NULL);
+  CU_ASSERT_FATAL(access_control->return_permissions_handle != NULL);
+
+  fill_permissions_token(&permissions_token);
+  //permissions_token.
+  r = fill_peer_credential_token(&credential_token, "Test_Permissions_invalid_data.p7s");
+  CU_ASSERT_FATAL(r);
+
+  remote_identity_handle++;
+
+  result = access_control->validate_remote_permissions(
+      access_control,
+      auth,
+      local_identity_handle,
+      remote_identity_handle,
+      &permissions_token,
+      &credential_token,
+      &exception);
+
+  CU_ASSERT(result == 0);
+  CU_ASSERT(exception.code == DDS_SECURITY_ERR_CAN_NOT_PARSE_PERMISSIONS_CODE);
+  CU_ASSERT(exception.message != NULL);
+  if (exception.message)
+  {
+    printf("(%d) %s\n", (int)exception.code, exception.message);
+  }
+  reset_exception(&exception);
+
+  DDS_Security_DataHolder_deinit((DDS_Security_DataHolder *)&permissions_token);
+  DDS_Security_DataHolder_deinit((DDS_Security_DataHolder *)&credential_token);
+}
+
+CU_Test(ddssec_builtin_validate_remote_permissions, permissions_expired, .init = suite_validate_remote_permissions_init, .fini = suite_validate_remote_permissions_fini)
+{
+  DDS_Security_PermissionsHandle result;
+  DDS_Security_PermissionsToken permissions_token;
+  DDS_Security_AuthenticatedPeerCredentialToken credential_token;
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  int r;
+
+  /* Check if we actually have validate_remote_permissions function. */
+  CU_ASSERT_FATAL(access_control != NULL);
+  CU_ASSERT_FATAL(local_identity_handle != DDS_SECURITY_HANDLE_NIL);
+  CU_ASSERT_FATAL(access_control->validate_remote_permissions != NULL);
+  CU_ASSERT_FATAL(access_control->return_permissions_handle != NULL);
+
+  fill_permissions_token(&permissions_token);
+  r = fill_peer_credential_token(&credential_token, "Test_Permissions_expired.p7s");
+  CU_ASSERT_FATAL(r);
+
+  remote_identity_handle++;
+
+  result = access_control->validate_remote_permissions(
+      access_control,
+      auth,
+      local_identity_handle,
+      remote_identity_handle,
+      &permissions_token,
+      &credential_token,
+      &exception);
+
+  CU_ASSERT_FATAL(result == 0);
+  CU_ASSERT_FATAL(exception.code == DDS_SECURITY_ERR_VALIDITY_PERIOD_EXPIRED_CODE);
+  CU_ASSERT_NSTRING_EQUAL_FATAL(DDS_SECURITY_ERR_VALIDITY_PERIOD_EXPIRED_MESSAGE, exception.message, strlen(DDS_SECURITY_ERR_VALIDITY_PERIOD_EXPIRED_MESSAGE) - 16);
+  reset_exception(&exception);
+
+  DDS_Security_DataHolder_deinit((DDS_Security_DataHolder *)&permissions_token);
+  DDS_Security_DataHolder_deinit((DDS_Security_DataHolder *)&credential_token);
+}
+
+CU_Test(ddssec_builtin_validate_remote_permissions, permissions_not_yet, .init = suite_validate_remote_permissions_init, .fini = suite_validate_remote_permissions_fini)
+{
+  DDS_Security_PermissionsHandle result;
+  DDS_Security_PermissionsToken permissions_token;
+  DDS_Security_AuthenticatedPeerCredentialToken credential_token;
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  int r;
+
+  /* Check if we actually have validate_remote_permissions function. */
+  CU_ASSERT_FATAL(access_control != NULL);
+  CU_ASSERT_FATAL(local_identity_handle != DDS_SECURITY_HANDLE_NIL);
+  CU_ASSERT_FATAL(access_control->validate_remote_permissions != NULL);
+  CU_ASSERT_FATAL(access_control->return_permissions_handle != NULL);
+
+  fill_permissions_token(&permissions_token);
+  r = fill_peer_credential_token(&credential_token, "Test_Permissions_notyet.p7s");
+  CU_ASSERT_FATAL(r);
+
+  remote_identity_handle++;
+
+  result = access_control->validate_remote_permissions(
+      access_control,
+      auth,
+      local_identity_handle,
+      remote_identity_handle,
+      &permissions_token,
+      &credential_token,
+      &exception);
+
+  CU_ASSERT_FATAL(result == 0);
+  CU_ASSERT_FATAL(exception.code == DDS_SECURITY_ERR_VALIDITY_PERIOD_NOT_STARTED_CODE);
+  CU_ASSERT_NSTRING_EQUAL_FATAL(DDS_SECURITY_ERR_VALIDITY_PERIOD_NOT_STARTED_MESSAGE, exception.message, strlen(DDS_SECURITY_ERR_VALIDITY_PERIOD_NOT_STARTED_MESSAGE) - 14);
+  reset_exception(&exception);
+
+  DDS_Security_DataHolder_deinit((DDS_Security_DataHolder *)&permissions_token);
+  DDS_Security_DataHolder_deinit((DDS_Security_DataHolder *)&credential_token);
+}
+
+CU_Test(ddssec_builtin_validate_remote_permissions, permissions_unknown_subject_name, .init = suite_validate_remote_permissions_init, .fini = suite_validate_remote_permissions_fini)
+{
+  DDS_Security_PermissionsHandle result;
+  DDS_Security_PermissionsToken permissions_token;
+  DDS_Security_AuthenticatedPeerCredentialToken credential_token;
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  int r;
+
+  /* Check if we actually have validate_remote_permissions function. */
+  CU_ASSERT_FATAL(access_control != NULL);
+  CU_ASSERT_FATAL(local_identity_handle != DDS_SECURITY_HANDLE_NIL);
+  CU_ASSERT_FATAL(access_control->validate_remote_permissions != NULL);
+  CU_ASSERT_FATAL(access_control->return_permissions_handle != NULL);
+
+  fill_permissions_token(&permissions_token);
+  r = fill_peer_credential_token(&credential_token, "Test_Permissions_unknown_subject.p7s");
+  CU_ASSERT_FATAL(r);
+
+  remote_identity_handle++;
+
+  result = access_control->validate_remote_permissions(
+      access_control,
+      auth,
+      local_identity_handle,
+      remote_identity_handle,
+      &permissions_token,
+      &credential_token,
+      &exception);
+
+  CU_ASSERT_FATAL(result == 0);
+  CU_ASSERT_FATAL(exception.code == DDS_SECURITY_ERR_INVALID_SUBJECT_NAME_CODE);
+  CU_ASSERT_STRING_EQUAL_FATAL(DDS_SECURITY_ERR_INVALID_SUBJECT_NAME_MESSAGE, exception.message);
+  reset_exception(&exception);
+
+  DDS_Security_DataHolder_deinit((DDS_Security_DataHolder *)&permissions_token);
+  DDS_Security_DataHolder_deinit((DDS_Security_DataHolder *)&credential_token);
+
+  /* missing subject name component */
+
+  fill_permissions_token(&permissions_token);
+  r = fill_peer_credential_token(&credential_token, "Test_Permissions_missing_subject_component.p7s");
+  CU_ASSERT_FATAL(r);
+
+  remote_identity_handle++;
+
+  result = access_control->validate_remote_permissions(
+      access_control,
+      auth,
+      local_identity_handle,
+      remote_identity_handle,
+      &permissions_token,
+      &credential_token,
+      &exception);
+
+  CU_ASSERT_FATAL(result == 0);
+  CU_ASSERT_FATAL(exception.code == DDS_SECURITY_ERR_INVALID_SUBJECT_NAME_CODE);
+  CU_ASSERT_STRING_EQUAL_FATAL(DDS_SECURITY_ERR_INVALID_SUBJECT_NAME_MESSAGE, exception.message);
+  reset_exception(&exception);
+
+  DDS_Security_DataHolder_deinit((DDS_Security_DataHolder *)&permissions_token);
+  DDS_Security_DataHolder_deinit((DDS_Security_DataHolder *)&credential_token);
+}
+
+CU_Test(ddssec_builtin_validate_remote_permissions, permissions_different_subject, .init = suite_validate_remote_permissions_init, .fini = suite_validate_remote_permissions_fini)
+{
+  DDS_Security_PermissionsHandle result;
+  DDS_Security_PermissionsToken permissions_token;
+  DDS_Security_AuthenticatedPeerCredentialToken credential_token;
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  int r;
+
+  /* Check if we actually have validate_remote_permissions function. */
+  CU_ASSERT_FATAL(access_control != NULL);
+  CU_ASSERT_FATAL(local_identity_handle != DDS_SECURITY_HANDLE_NIL);
+  CU_ASSERT_FATAL(access_control->validate_remote_permissions != NULL);
+  CU_ASSERT_FATAL(access_control->return_permissions_handle != NULL);
+
+  fill_permissions_token(&permissions_token);
+  r = fill_peer_credential_token(&credential_token, "Test_Permissions_different_subject_representation.p7s");
+  CU_ASSERT_FATAL(r);
+
+  remote_identity_handle++;
+
+  result = access_control->validate_remote_permissions(
+      access_control,
+      auth,
+      local_identity_handle,
+      remote_identity_handle,
+      &permissions_token,
+      &credential_token,
+      &exception);
+
+  CU_ASSERT_FATAL(result != 0);
+  CU_ASSERT_FATAL(exception.code == DDS_SECURITY_ERR_OK_CODE);
+
+  reset_exception(&exception);
+
+  DDS_Security_DataHolder_deinit((DDS_Security_DataHolder *)&permissions_token);
+  DDS_Security_DataHolder_deinit((DDS_Security_DataHolder *)&credential_token);
+}
+
+CU_Test(ddssec_builtin_validate_remote_permissions, corrupted_signature, .init = suite_validate_remote_permissions_init, .fini = suite_validate_remote_permissions_fini)
+{
+  DDS_Security_PermissionsHandle result;
+  DDS_Security_PermissionsToken permissions_token;
+  DDS_Security_AuthenticatedPeerCredentialToken credential_token;
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+  int r;
+
+  /* Check if we actually have validate_remote_permissions function. */
+  CU_ASSERT_FATAL(access_control != NULL);
+  CU_ASSERT_FATAL(local_identity_handle != DDS_SECURITY_HANDLE_NIL);
+  CU_ASSERT_FATAL(access_control->validate_remote_permissions != NULL);
+  CU_ASSERT_FATAL(access_control->return_permissions_handle != NULL);
+
+  fill_permissions_token(&permissions_token);
+  //permissions_token.
+  r = fill_peer_credential_token(&credential_token, "Test_Permissions_ok.p7s");
+  CU_ASSERT_FATAL(r);
+
+  corrupt_permission_signature(&credential_token);
+
+  remote_identity_handle++;
+
+  result = access_control->validate_remote_permissions(
+      access_control,
+      auth,
+      local_identity_handle,
+      remote_identity_handle,
+      &permissions_token,
+      &credential_token,
+      &exception);
+
+  CU_ASSERT(result == 0);
+  CU_ASSERT(exception.code == DDS_SECURITY_ERR_INVALID_SMIME_DOCUMENT_CODE);
+  CU_ASSERT(exception.message != NULL);
+  if (exception.message)
+  {
+    printf("(%d) %s\n", (int)exception.code, exception.message);
+  }
+  reset_exception(&exception);
+
+  DDS_Security_DataHolder_deinit((DDS_Security_DataHolder *)&permissions_token);
+  DDS_Security_DataHolder_deinit((DDS_Security_DataHolder *)&credential_token);
+}
diff --git a/src/security/core/include/dds/security/core/dds_security_utils.h b/src/security/core/include/dds/security/core/dds_security_utils.h
index fe975d6..a66c4d3 100644
--- a/src/security/core/include/dds/security/core/dds_security_utils.h
+++ b/src/security/core/include/dds/security/core/dds_security_utils.h
@@ -13,10 +13,12 @@
 #ifndef DSCMN_SECURITY_UTILS_H_
 #define DSCMN_SECURITY_UTILS_H_
 
-#include "dds/export.h"
 #include <stddef.h>
 #include <stdint.h>
 #include <stdbool.h>
+#include "dds/export.h"
+#include "dds/ddsrt/strtol.h"
+#include "dds/ddsrt/time.h"
 #include "dds/security/core/dds_security_types.h"
 #include "dds/security/dds_security_api.h"
 
@@ -339,6 +341,10 @@ ddssec_strchrs (
         const char *chrs,
         bool inc);
 
+DDS_EXPORT dds_time_t
+DDS_Security_parse_xml_date(
+        char *buf);
+
 
 #define DDS_Security_ParticipantCryptoTokenSeq_alloc() \
                     DDS_Security_DataHolderSeq_alloc())
diff --git a/src/security/core/src/dds_security_utils.c b/src/security/core/src/dds_security_utils.c
index 665e587..8a5cef7 100644
--- a/src/security/core/src/dds_security_utils.c
+++ b/src/security/core/src/dds_security_utils.c
@@ -807,47 +807,34 @@ DDS_Security_Exception_set(
 #if DDSI_INCLUDE_SSL
 DDS_EXPORT void
 DDS_Security_Exception_set_with_openssl_error(
-         DDS_Security_SecurityException *ex,
-         const char *context,
-         int code,
-         int minor_code,
-         const char *error_area
-        )
+    DDS_Security_SecurityException *ex,
+    const char *context,
+    int code,
+    int minor_code,
+    const char *error_area)
 {
+    BIO *bio;
+    assert(context);
+    assert(error_area);
+    assert(ex);
+    DDSRT_UNUSED_ARG(context);
 
-  BIO *bio;
-  char *buf = NULL;
-  char *str;
-  size_t len; /*BIO_get_mem_data requires long int */
-  assert(context);
-  assert(error_area);
-  assert(ex);
-  DDSRT_UNUSED_ARG( context );
-
-  bio = BIO_new(BIO_s_mem());
-
-  if (bio) {
-      size_t exception_msg_len;
-      ERR_print_errors(bio);
-      len = (size_t)BIO_get_mem_data (bio, &buf);
-      exception_msg_len = len + strlen(error_area) + 1;
-      str = ddsrt_malloc(  exception_msg_len );
-
-      ddsrt_strlcpy(str, error_area, exception_msg_len);
-      memcpy(str + strlen(error_area), buf, len );
-      str [ exception_msg_len -1 ] = '\0';
-      //snprintf( str, exception_msg_len, "%s%s", error_area, buf );
-
-      ex->message = str;
-      ex->code = code;
-      ex->minor_code = minor_code;
-
-      BIO_free(bio);
-
-  } else {
-      DDS_Security_Exception_set(ex, context, code,  minor_code, "BIO_new failed");
-  }
-
+    if ((bio = BIO_new(BIO_s_mem()))) {
+        ERR_print_errors(bio);
+        char *buf = NULL;
+        size_t len = (size_t)BIO_get_mem_data(bio, &buf);
+        size_t exception_msg_len = len + strlen(error_area) + 1;
+        char *str = ddsrt_malloc(exception_msg_len);
+        ddsrt_strlcpy(str, error_area, exception_msg_len);
+        memcpy(str + strlen(error_area), buf, len);
+        str[exception_msg_len - 1] = '\0';
+        ex->message = str;
+        ex->code = code;
+        ex->minor_code = minor_code;
+        BIO_free(bio);
+    } else {
+        DDS_Security_Exception_set(ex, context, code, minor_code, "BIO_new failed");
+    }
 }
 #endif
 
@@ -1104,6 +1091,203 @@ DDS_Security_normalize_file(
     }
 #undef __FILESEPCHAR
     return norm;
-
 }
 
+/**
+ * Parses an XML date string and returns this as a dds_time_t value. As leap seconds are not permitted
+ * in the XML date format (as stated in the XML Schema specification), this parser function does not
+ * accept leap seconds in its input string. This complies with the dds_time_t representation on posix,
+ * which is a unix timestamp (that also ignores leap seconds).
+ *
+ * As a dds_time_t is expressed as nanoseconds, the fractional seconds part of the input string will
+ * be rounded in case the fractional part has more than 9 digits.
+ */
+dds_time_t
+DDS_Security_parse_xml_date(
+    char *buf)
+{
+  int32_t year = -1;
+  int32_t month = -1;
+  int32_t day = -1;
+  int32_t hour = -1;
+  int32_t minute = -1;
+  int32_t second = -1;
+  int32_t hour_offset = -1;
+  int32_t minute_offset = -1;
+
+  int64_t frac_ns = 0;
+
+  size_t cnt = 0;
+  size_t cnt_frac_sec = 0;
+
+  assert(buf != NULL);
+
+  /* Make an integrity check of the string before the conversion*/
+  while (buf[cnt] != '\0')
+  {
+    if (cnt == 4 || cnt == 7)
+    {
+      if (buf[cnt] != '-')
+        return DDS_TIME_INVALID;
+    }
+    else if (cnt == 10)
+    {
+      if (buf[cnt] != 'T')
+        return DDS_TIME_INVALID;
+    }
+    else if (cnt == 13 || cnt == 16)
+    {
+      if (buf[cnt] != ':')
+        return DDS_TIME_INVALID;
+    }
+    else if (cnt == 19)
+    {
+      if (buf[cnt] != 'Z' && buf[cnt] != '+' && buf[cnt] != '-' && buf[cnt] != '.')
+        return DDS_TIME_INVALID;
+
+      /* If a dot is found then a variable number of fractional seconds is present.
+               A second integrity loop to account for the variability is used */
+      if (buf[cnt] == '.' && !cnt_frac_sec)
+      {
+        cnt_frac_sec = 1;
+        while (buf[cnt + 1] != '\0' && buf[cnt + 1] >= '0' && buf[cnt + 1] <= '9')
+        {
+          cnt_frac_sec++;
+          cnt++;
+        }
+      }
+    }
+    else if (cnt == 19 + cnt_frac_sec)
+    {
+      if (buf[cnt] != 'Z' && buf[cnt] != '+' && buf[cnt] != '-')
+        return DDS_TIME_INVALID;
+    }
+    else if (cnt == 22 + cnt_frac_sec)
+    {
+      if (buf[cnt] != ':')
+        return DDS_TIME_INVALID;
+    }
+    else
+    {
+      if (buf[cnt] < '0' || buf[cnt] > '9')
+        return DDS_TIME_INVALID;
+    }
+    cnt++;
+  }
+
+  /* Do not allow more than 12 (13 including the dot) and less than 1 fractional second digits if they are used */
+  if (cnt_frac_sec && (cnt_frac_sec < 2 || cnt_frac_sec > 13))
+    return DDS_TIME_INVALID;
+
+  /* Valid string length value at this stage are 19, 20 and 25 plus the fractional seconds part */
+  if (cnt != 19 + cnt_frac_sec && cnt != 20 + cnt_frac_sec && cnt != 25 + cnt_frac_sec)
+    return DDS_TIME_INVALID;
+
+  year = ddsrt_todigit(buf[0]) * 1000 + ddsrt_todigit(buf[1]) * 100 + ddsrt_todigit(buf[2]) * 10 + ddsrt_todigit(buf[3]);
+  month = ddsrt_todigit(buf[5]) * 10 + ddsrt_todigit(buf[6]);
+  day = ddsrt_todigit(buf[8]) * 10 + ddsrt_todigit(buf[9]);
+
+  hour = ddsrt_todigit(buf[11]) * 10 + ddsrt_todigit(buf[12]);
+  minute = ddsrt_todigit(buf[14]) * 10 + ddsrt_todigit(buf[15]);
+  second = ddsrt_todigit(buf[17]) * 10 + ddsrt_todigit(buf[18]);
+
+  {
+    int64_t frac_ns_pow = DDS_NSECS_IN_SEC / 10;
+    size_t n = 0;
+    for (n = 0; cnt_frac_sec && n < cnt_frac_sec - 1; n++)
+    {
+      /* Maximum granularity is nanosecond so round to maximum 9 digits */
+      if (n == 9)
+      {
+        if (ddsrt_todigit(buf[20 + n]) >= 5)
+          frac_ns++;
+        break;
+      }
+      frac_ns += ddsrt_todigit(buf[20 + n]) * frac_ns_pow;
+      frac_ns_pow = frac_ns_pow / 10;
+    }
+  }
+
+  /* If the length is 20 the last character must be a Z representing UTC time zone */
+  if (cnt == 19 + cnt_frac_sec || (cnt == 20 + cnt_frac_sec && buf[19 + cnt_frac_sec] == 'Z'))
+  {
+    hour_offset = 0;
+    minute_offset = 0;
+  }
+  else if (cnt == 25 + cnt_frac_sec)
+  {
+    hour_offset = ddsrt_todigit(buf[20 + cnt_frac_sec]) * 10 + ddsrt_todigit(buf[21 + cnt_frac_sec]);
+    minute_offset = ddsrt_todigit(buf[23 + cnt_frac_sec]) * 10 + ddsrt_todigit(buf[24 + cnt_frac_sec]);
+  }
+  else
+    return DDS_TIME_INVALID;
+
+  /* Make a limit check to make sure that all the numbers are within absolute boundaries.
+     Note that leap seconds are not allowed in XML dates and therefore not supported. */
+  if (year < 1970 || year > 2262 || month < 1 || month > 12 || day < 1 || day > 31 ||
+      hour < 0 || hour > 23 || minute < 0 || minute > 59 || second < 0 || second > 59 ||
+      ((hour_offset < 0 || hour_offset > 11 || minute_offset < 0 || minute_offset > 59) && (hour_offset != 12 || minute_offset != 0)))
+  {
+    return DDS_TIME_INVALID;
+  }
+
+  /*  Boundary check including consideration for month and leap years */
+  if (!(((month == 4 || month == 6 || month == 9 || month == 11) && (day >= 1 && day <= 30)) ||
+      ((month == 1 || month == 3 || month == 5 || month == 7 || month == 8 || month == 10 || month == 12) && (day >= 1 && day <= 31)) ||
+      (month == 2 && ((year % 100 != 0 && year % 4 == 0) || (year % 400 == 0)) && (day >= 1 && day <= 29)) ||
+      (month == 2 && (day >= 1 && day <= 28))))
+  {
+    return DDS_TIME_INVALID;
+  }
+
+  /* Convert the year-month-day to total number of days */
+  int32_t total_leap_years = (year - 1970 + 1) / 4;
+  /* Leap year count decreased by the number of xx00 years before current year because these are not leap years,
+     except for 2000. The year 2400 is not in the valid year range so we don't take that into account. */
+  if (year > 2100)
+    total_leap_years -= year / 100 - 20;
+  if (year == 2200)
+    total_leap_years++;
+
+  int32_t total_reg_years = year - 1970 - total_leap_years;
+  int32_t total_num_days = total_leap_years * 366 + total_reg_years * 365;
+  int32_t month_cnt;
+
+  for (month_cnt = 1; month_cnt < month; month_cnt++)
+  {
+    if (month_cnt == 4 || month_cnt == 6 || month_cnt == 9 || month_cnt == 11)
+      total_num_days += 30;
+    else if (month_cnt == 2)
+    {
+      if (year % 400 == 0 || (year % 100 != 0 && year % 4 == 0))
+        total_num_days += 29;
+      else
+        total_num_days += 28;
+    }
+    else
+      total_num_days += 31;
+  }
+  total_num_days += day - 1;
+
+  /* Correct the offset sign if negative */
+  if (buf[19 + cnt_frac_sec] == '-')
+  {
+    hour_offset = -hour_offset;
+    minute_offset = -minute_offset;
+  }
+  /* Convert the total number of days to seconds */
+  int64_t ts_days = (int64_t)total_num_days * 24 * 60 * 60;
+  int64_t ts_hms = hour * 60 * 60 + minute * 60 + second;
+  if (ts_days + ts_hms > INT64_MAX / DDS_NSECS_IN_SEC)
+    return DDS_TIME_INVALID;
+  int64_t ts = DDS_SECS(ts_days + ts_hms);
+
+  /* Apply the hour and minute offset */
+  int64_t ts_offset = DDS_SECS((int64_t)hour_offset * 60 * 60 + minute_offset * 60);
+
+  /* Prevent the offset from making the timestamp negative or overflow it */
+  if ((ts_offset <= 0 || (ts_offset > 0 && ts_offset < ts)) && INT64_MAX - ts - frac_ns >= -ts_offset)
+    return ts - ts_offset + frac_ns;
+
+  return DDS_TIME_INVALID;
+}
diff --git a/src/security/core/tests/CMakeLists.txt b/src/security/core/tests/CMakeLists.txt
index 9cd0e27..d240583 100644
--- a/src/security/core/tests/CMakeLists.txt
+++ b/src/security/core/tests/CMakeLists.txt
@@ -15,6 +15,7 @@ include (CUnit)
 set(security_core_test_sources
     "tc_fsm.c"
     "dds_security_core.c"
+    "security_utils.c"
   )
 
 add_definitions(-DDDSI_INCLUDE_SECURITY)
diff --git a/src/security/core/tests/security_utils.c b/src/security/core/tests/security_utils.c
new file mode 100644
index 0000000..ec4ab89
--- /dev/null
+++ b/src/security/core/tests/security_utils.c
@@ -0,0 +1,62 @@
+/*
+ * Copyright(c) 2006 to 2019 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+
+#include <stdio.h>
+#include <string.h>
+#include "CUnit/CUnit.h"
+#include "CUnit/Test.h"
+#include "dds/ddsrt/time.h"
+#include "dds/security/core/dds_security_utils.h"
+
+CU_Test(ddssec_security_utils, parse_xml_date)
+{
+  CU_ASSERT_EQUAL(DDS_Security_parse_xml_date(""), DDS_TIME_INVALID);
+  CU_ASSERT_EQUAL(DDS_Security_parse_xml_date("abc"), DDS_TIME_INVALID);
+  CU_ASSERT_EQUAL(DDS_Security_parse_xml_date("2020-01-01"), DDS_TIME_INVALID);
+  CU_ASSERT_EQUAL(DDS_Security_parse_xml_date("2020-01-01D01:01:01Z"), DDS_TIME_INVALID);
+  CU_ASSERT_EQUAL(DDS_Security_parse_xml_date("2019-02-29T01:01:01Z"), DDS_TIME_INVALID);
+  CU_ASSERT_EQUAL(DDS_Security_parse_xml_date("2100-02-29T01:01:01Z"), DDS_TIME_INVALID);
+  CU_ASSERT_EQUAL(DDS_Security_parse_xml_date("1969-01-01T01:01:01Z"), DDS_TIME_INVALID);
+  CU_ASSERT_EQUAL(DDS_Security_parse_xml_date("2010-01-01T23:59:60Z"), DDS_TIME_INVALID);
+  CU_ASSERT_EQUAL(DDS_Security_parse_xml_date("1969-01-01T01:01:01+01"), DDS_TIME_INVALID);
+  CU_ASSERT_EQUAL(DDS_Security_parse_xml_date("1969-01-01T01:01:01+0100"), DDS_TIME_INVALID);
+  CU_ASSERT_EQUAL(DDS_Security_parse_xml_date("1969-01-01T01:01:01+0:00"), DDS_TIME_INVALID);
+  CU_ASSERT_EQUAL(DDS_Security_parse_xml_date("1970-01-01T00:00:00+01:00"), DDS_TIME_INVALID);
+  CU_ASSERT_EQUAL(DDS_Security_parse_xml_date("2020-01-01T01:01:01.0000000000001+01:00"), DDS_TIME_INVALID);
+  CU_ASSERT_EQUAL(DDS_Security_parse_xml_date("2020-01-01T01:01:01.0.1+01:00"), DDS_TIME_INVALID);
+  CU_ASSERT_EQUAL(DDS_Security_parse_xml_date("2020-01-01T01:01:01.+01:00"), DDS_TIME_INVALID);
+
+  CU_ASSERT_EQUAL(DDS_Security_parse_xml_date("1970-01-01T00:00:00Z"), 0);
+  CU_ASSERT_EQUAL(DDS_Security_parse_xml_date("2000-02-29T00:00:00Z"), DDS_SECS(951782400));
+  CU_ASSERT_EQUAL(DDS_Security_parse_xml_date("2020-01-01T01:01:01Z"), DDS_SECS(1577840461));
+  CU_ASSERT_EQUAL(DDS_Security_parse_xml_date("2020-01-01T01:01:01+00:30"), DDS_SECS(1577840461 - 30 * 60));
+  CU_ASSERT_EQUAL(DDS_Security_parse_xml_date("2020-01-01T01:01:01+01:00"), DDS_SECS(1577840461 - 60 * 60));
+  CU_ASSERT_EQUAL(DDS_Security_parse_xml_date("2020-01-01T01:01:01+12:00"), DDS_SECS(1577840461 - 12 * 60 * 60));
+  CU_ASSERT_EQUAL(DDS_Security_parse_xml_date("2020-01-01T01:01:01-01:00"), DDS_SECS(1577840461 + 60 * 60));
+  CU_ASSERT_EQUAL(DDS_Security_parse_xml_date("2020-12-31T23:59:59Z"), DDS_SECS(1609459199));
+  CU_ASSERT_EQUAL(DDS_Security_parse_xml_date("2020-02-29T01:01:01Z"), DDS_SECS(1582938061));
+  CU_ASSERT_EQUAL(DDS_Security_parse_xml_date("2038-01-19T03:14:07Z"), DDS_SECS(INT32_MAX));
+  CU_ASSERT_EQUAL(DDS_Security_parse_xml_date("2038-01-19T03:14:08Z"), DDS_SECS(INT64_C(INT32_MAX + 1)));
+  CU_ASSERT_EQUAL(DDS_Security_parse_xml_date("2100-01-01T00:00:00Z"), DDS_SECS(4102444800));
+  CU_ASSERT_EQUAL(DDS_Security_parse_xml_date("2120-01-01T00:00:00Z"), DDS_SECS(4733510400));
+  CU_ASSERT_EQUAL(DDS_Security_parse_xml_date("2200-01-01T00:00:00Z"), DDS_SECS(7258118400));
+  CU_ASSERT_EQUAL(DDS_Security_parse_xml_date("2220-01-01T00:00:00Z"), DDS_SECS(7889184000));
+  CU_ASSERT_EQUAL(DDS_Security_parse_xml_date("2262-04-11T23:47:16.854775807Z"), INT64_MAX);
+  CU_ASSERT_EQUAL(DDS_Security_parse_xml_date("2262-04-11T23:47:16.854775808Z"), DDS_TIME_INVALID);
+  CU_ASSERT_EQUAL(DDS_Security_parse_xml_date("2262-04-11T23:47:16.854775807+00:01"), INT64_MAX - DDS_SECS(60));
+  CU_ASSERT_EQUAL(DDS_Security_parse_xml_date("2262-04-11T23:47:16.854775807-00:01"), DDS_TIME_INVALID);
+
+  CU_ASSERT_EQUAL(DDS_Security_parse_xml_date("2020-01-01T01:01:01.000000001+01:00"),  INT64_C(1577836861000000001));
+  CU_ASSERT_EQUAL(DDS_Security_parse_xml_date("2020-01-01T01:01:01.0000000004+01:00"), INT64_C(1577836861000000000));
+  CU_ASSERT_EQUAL(DDS_Security_parse_xml_date("2020-01-01T01:01:01.0000000005+01:00"), INT64_C(1577836861000000001));
+  CU_ASSERT_EQUAL(DDS_Security_parse_xml_date("2020-01-01T01:01:01.987654321+01:00"),  INT64_C(1577836861987654321));
+}

From aef4f0a12661c7149d990acad47dc00a5573b2b9 Mon Sep 17 00:00:00 2001
From: Stefan Kimmer <skimmer@s2e-systems.com>
Date: Fri, 24 Jan 2020 10:53:18 +0100
Subject: [PATCH 095/238] Certificate trigger and directory operations

Implement trigger of certificate and permission expiries using the timed callbacks.

Implement directory operations such that trusted CA can be read.
This implements OS abstraction functions such as opendir and stat.

Signed-off-by: Stefan Kimmer <skimmer@s2e-systems.com>
---
 src/ddsrt/CMakeLists.txt                      |    2 +-
 src/ddsrt/include/dds/ddsrt/filesystem.h      |  123 +
 .../include/dds/ddsrt/filesystem/posix.h      |   34 +
 .../include/dds/ddsrt/filesystem/windows.h    |   34 +
 src/ddsrt/src/filesystem/posix/filesystem.c   |  116 +
 src/ddsrt/src/filesystem/windows/filesystem.c |  122 +
 .../access_control/src/access_control.c       |   51 +-
 .../authentication/src/auth_utils.c           |   50 +-
 .../authentication/src/authentication.c       |   43 +-
 .../builtin_plugins/tests/CMakeLists.txt      |    6 +
 .../builtin_plugins/tests/config_env.h.in     |    1 +
 .../etc/Test_Permissions_listener.p7s         |   51 -
 .../src/listeners_access_control_utests.c     |   49 +-
 .../etc/Example_Governance.p7s                |  120 +
 .../etc/Example_Permissions_Alice.p7s         |   98 +
 .../etc/Example_Permissions_Bob.p7s           |   98 +
 .../etc/Identity_CA_Cert.pem                  |   25 +
 .../etc/Identity_CA_Private_Key.pem           |   27 +
 .../etc/Permissions_CA_Cert.pem               |   26 +
 .../src/listeners_authentication_utests.c     | 2105 +++++++++++++++++
 .../src/process_handshake_utests.c            |    2 +-
 .../validate_begin_handshake_reply_utests.c   |    9 +-
 .../src/validate_local_identity_utests.c      |    9 +-
 .../dds/security/core/dds_security_timed_cb.h |    6 +-
 src/security/core/src/dds_security_utils.c    |    1 +
 25 files changed, 3039 insertions(+), 169 deletions(-)
 create mode 100644 src/ddsrt/include/dds/ddsrt/filesystem.h
 create mode 100644 src/ddsrt/include/dds/ddsrt/filesystem/posix.h
 create mode 100644 src/ddsrt/include/dds/ddsrt/filesystem/windows.h
 create mode 100644 src/ddsrt/src/filesystem/posix/filesystem.c
 create mode 100644 src/ddsrt/src/filesystem/windows/filesystem.c
 delete mode 100644 src/security/builtin_plugins/tests/listeners_access_control/etc/Test_Permissions_listener.p7s
 create mode 100644 src/security/builtin_plugins/tests/listeners_authentication/etc/Example_Governance.p7s
 create mode 100644 src/security/builtin_plugins/tests/listeners_authentication/etc/Example_Permissions_Alice.p7s
 create mode 100644 src/security/builtin_plugins/tests/listeners_authentication/etc/Example_Permissions_Bob.p7s
 create mode 100644 src/security/builtin_plugins/tests/listeners_authentication/etc/Identity_CA_Cert.pem
 create mode 100644 src/security/builtin_plugins/tests/listeners_authentication/etc/Identity_CA_Private_Key.pem
 create mode 100644 src/security/builtin_plugins/tests/listeners_authentication/etc/Permissions_CA_Cert.pem
 create mode 100644 src/security/builtin_plugins/tests/listeners_authentication/src/listeners_authentication_utests.c

diff --git a/src/ddsrt/CMakeLists.txt b/src/ddsrt/CMakeLists.txt
index c9c44a7..00d51e5 100644
--- a/src/ddsrt/CMakeLists.txt
+++ b/src/ddsrt/CMakeLists.txt
@@ -149,7 +149,7 @@ list(APPEND sources
 # network stack. In order to mix-and-match various compilers, architectures,
 # operating systems, etc input from the build system is required.
 foreach(feature atomics cdtors environ heap ifaddrs random rusage
-        sockets string sync threads time md5 process netstat dynlib)
+        sockets string sync threads time md5 process netstat dynlib filesystem)
   if(EXISTS "${include_path}/dds/ddsrt/${feature}.h")
     list(APPEND headers "${include_path}/dds/ddsrt/${feature}.h")
     file(GLOB_RECURSE
diff --git a/src/ddsrt/include/dds/ddsrt/filesystem.h b/src/ddsrt/include/dds/ddsrt/filesystem.h
new file mode 100644
index 0000000..60ade53
--- /dev/null
+++ b/src/ddsrt/include/dds/ddsrt/filesystem.h
@@ -0,0 +1,123 @@
+/*
+ * Copyright(c) 2006 to 2018 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+
+#ifndef FILESYSTEM_H
+#define FILESYSTEM_H
+
+#include <stddef.h>
+
+#include "dds/export.h"
+#include "dds/ddsrt/retcode.h"
+#include "dds/ddsrt/time.h"
+
+#if _WIN32
+#include "dds/ddsrt/filesystem/windows.h"
+#else
+#include "dds/ddsrt/filesystem/posix.h"
+#endif
+
+#if defined (__cplusplus)
+extern "C" {
+#endif
+
+struct ddsrt_stat {
+  ddsrt_mode_t stat_mode;
+  size_t stat_size;
+  dds_time_t  stat_mtime;
+};
+
+
+struct ddsrt_dirent {
+    char d_name[DDSRT_PATH_MAX + 1];
+};
+
+/** \brief opendir wrapper
+ *
+ * Open the directory conform opendir
+ *
+ * Precondition:
+ *   none
+ *
+ * Possible results:
+ * - return DDS_RETCODE_OK if directory 'name' is opened
+ * - DDS_RETCODE_ERROR if 'name' could not
+ *     be found or is not a directory.
+ */
+DDS_EXPORT dds_return_t ddsrt_opendir(const char *name, ddsrt_dir_handle_t *dir);
+
+/** \brief closedir wrapper
+ *
+ * Close the directory conform closdir
+ *
+ * Precondition:
+ *   none
+ *
+ * Possible results:
+ * - return DDS_RETCODE_OK if directory identified by the handle
+ *     is succesfully closed
+ * - return DDS_RETCODE_ERROR if the handle is invalid.
+ */
+DDS_EXPORT dds_return_t ddsrt_closedir(ddsrt_dir_handle_t d);
+
+/** \brief readdir wrapper
+ *
+ * Read the directory conform readdir.
+ *
+ * Precondition:
+ *   none
+ *
+ * Possible results:
+ * - return DDS_RETCODE_OK if next directory is found
+ * - return DDS_RETCODE_ERROR if no more directories are found.
+ */
+DDS_EXPORT dds_return_t ddsrt_readdir(ddsrt_dir_handle_t d, struct ddsrt_dirent *direntp);
+
+/** \brief stat wrapper
+ *
+ * Gets directory status conform stat.
+ *
+ * Precondition:
+ *   none
+ *
+ * Possible results:
+ * - return DDS_RETCODE_OK if stat is successful
+ * - return DDS_RETCODE_ERROR if stat fails.
+ */
+DDS_EXPORT dds_return_t ddsrt_stat(const char *path, struct ddsrt_stat *buf);
+
+/** \brief Transforms the given filepath into a platform specific filepath.
+ *
+ * This translation function will replace any platform file seperator into
+ * the fileseperator of the current platform. Doulbe quotes are removed
+ * as well.
+ *
+ * Precondition:
+ *   none
+ *
+ * Possible results:
+ * - returns normalized filepath conform current platform
+ * - return NULL if out of memory.
+ */
+DDS_EXPORT char* ddsrt_file_normalize(const char *filepath);
+
+/** \brief Get file seperator
+ *
+ * Possible Results:
+ * - "<file-seperator-string>"
+ */
+DDS_EXPORT const char* ddsrt_file_sep(void);
+
+#if defined (__cplusplus)
+}
+#endif
+
+#endif // FILESYSTEM_H
diff --git a/src/ddsrt/include/dds/ddsrt/filesystem/posix.h b/src/ddsrt/include/dds/ddsrt/filesystem/posix.h
new file mode 100644
index 0000000..7d8e7c2
--- /dev/null
+++ b/src/ddsrt/include/dds/ddsrt/filesystem/posix.h
@@ -0,0 +1,34 @@
+/*
+ * Copyright(c) 2006 to 2018 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+#ifndef DDSRT_FILESYSTEM_POSIX_H
+#define DDSRT_FILESYSTEM_POSIX_H
+
+#include <sys/stat.h>
+#include <sys/types.h>
+#include <dirent.h>
+#include <limits.h>
+
+typedef DIR *ddsrt_dir_handle_t;
+typedef mode_t ddsrt_mode_t;
+
+#define DDSRT_PATH_MAX PATH_MAX
+#define DDSRT_FILESEPCHAR '/'
+
+#if defined(__cplusplus)
+extern "C" {
+#endif
+
+#if defined(__cplusplus)
+}
+#endif
+
+#endif /* DDSRT_FILESYSTEM_POSIX_H */
diff --git a/src/ddsrt/include/dds/ddsrt/filesystem/windows.h b/src/ddsrt/include/dds/ddsrt/filesystem/windows.h
new file mode 100644
index 0000000..abde1d6
--- /dev/null
+++ b/src/ddsrt/include/dds/ddsrt/filesystem/windows.h
@@ -0,0 +1,34 @@
+/*
+ * Copyright(c) 2006 to 2018 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+#ifndef DDSRT_FILESYSTEM_WINDOWS_H
+#define DDSRT_FILESYSTEM_WINDOWS_H
+
+#include <sys/types.h>
+#include <sys/stat.h>
+
+#include "dds/ddsrt/types.h"
+
+typedef HANDLE ddsrt_dir_handle_t;
+typedef unsigned short ddsrt_mode_t;
+
+#define DDSRT_PATH_MAX MAX_PATH
+#define DDSRT_FILESEPCHAR '\\'
+
+#if defined(__cplusplus)
+extern "C" {
+#endif
+
+#if defined(__cplusplus)
+}
+#endif
+
+#endif /* DDSRT_FILESYSTEM_WINDOWS_H */
diff --git a/src/ddsrt/src/filesystem/posix/filesystem.c b/src/ddsrt/src/filesystem/posix/filesystem.c
new file mode 100644
index 0000000..11b57ce
--- /dev/null
+++ b/src/ddsrt/src/filesystem/posix/filesystem.c
@@ -0,0 +1,116 @@
+/*
+ * Copyright(c) 2006 to 2018 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+
+#include <string.h>
+
+#include "dds/ddsrt/filesystem.h"
+#include "dds/ddsrt/string.h"
+#include "dds/ddsrt/heap.h"
+
+dds_return_t ddsrt_opendir(const char *name, ddsrt_dir_handle_t *dir)
+{
+    dds_return_t result = DDS_RETCODE_ERROR;
+    DIR *d;
+    if (dir) {
+        d = opendir(name);
+        if (d) {
+            *dir = d;
+            result = DDS_RETCODE_OK;
+        }
+    }
+    return result;
+}
+
+dds_return_t ddsrt_readdir(ddsrt_dir_handle_t d, struct ddsrt_dirent *direntp)
+{
+    dds_return_t result;
+    struct dirent *d_entry;
+
+    result = DDS_RETCODE_ERROR;
+    if (d && direntp) {
+        d_entry = readdir(d);
+        if (d_entry) {
+            ddsrt_strlcpy(direntp->d_name, d_entry->d_name, sizeof(direntp->d_name));
+            result = DDS_RETCODE_OK;
+        }
+    }
+
+    return result;
+}
+
+dds_return_t ddsrt_closedir(ddsrt_dir_handle_t d)
+{
+    dds_return_t result;
+
+    result = DDS_RETCODE_ERROR;
+    if (d) {
+        if (closedir(d) == 0) {
+            result = DDS_RETCODE_OK;
+        }
+    }
+
+    return result;
+}
+
+dds_return_t ddsrt_stat(const char *path, struct ddsrt_stat *buf)
+{
+    dds_return_t result;
+    struct stat _buf;
+    int r;
+
+    r = stat(path, &_buf);
+    if (r == 0) {
+        buf->stat_mode = _buf.st_mode;
+        buf->stat_size = (size_t) _buf.st_size;
+        buf->stat_mtime = DDS_SECS(_buf.st_mtime);
+        result = DDS_RETCODE_OK;
+    } else {
+        result = DDS_RETCODE_ERROR;
+    }
+
+    return result;
+}
+
+char * ddsrt_file_normalize(const char *filepath)
+{
+    char *norm;
+    const char *fpPtr;
+    char *normPtr;
+
+    norm = NULL;
+    if ((filepath != NULL) && (*filepath != '\0')) {
+        norm = ddsrt_malloc(strlen(filepath) + 1);
+        /* replace any / or \ by DDSRT_FILESEPCHAR */
+        fpPtr = (char *) filepath;
+        normPtr = norm;
+        while (*fpPtr != '\0') {
+            *normPtr = *fpPtr;
+            if ((*fpPtr == '/') || (*fpPtr == '\\')) {
+                *normPtr = DDSRT_FILESEPCHAR;
+                normPtr++;
+            } else {
+                if (*fpPtr != '\"') {
+                    normPtr++;
+                }
+            }
+            fpPtr++;
+        }
+        *normPtr = '\0';
+    }
+
+    return norm;
+}
+
+const char *ddsrt_file_sep(void)
+{
+    return "/";
+}
diff --git a/src/ddsrt/src/filesystem/windows/filesystem.c b/src/ddsrt/src/filesystem/windows/filesystem.c
new file mode 100644
index 0000000..068d76e
--- /dev/null
+++ b/src/ddsrt/src/filesystem/windows/filesystem.c
@@ -0,0 +1,122 @@
+/*
+ * Copyright(c) 2006 to 2018 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+
+#include <string.h>
+
+#include "dds/ddsrt/filesystem.h"
+#include "dds/ddsrt/string.h"
+#include "dds/ddsrt/heap.h"
+#include "dds/ddsrt/io.h"
+
+dds_return_t ddsrt_opendir(const char *name, ddsrt_dir_handle_t *dir)
+{
+    dds_return_t result;
+
+    TCHAR szDir[DDSRT_PATH_MAX + 1];
+    WIN32_FIND_DATA FileData;
+    HANDLE hList;
+
+    result = DDS_RETCODE_ERROR;
+    if (dir) {
+        snprintf(szDir, DDSRT_PATH_MAX, "%s\\*", name);
+        hList = FindFirstFile(szDir, &FileData);
+
+        if (hList != INVALID_HANDLE_VALUE) {
+            *dir = hList;
+            result = DDS_RETCODE_OK;
+        }
+    }
+
+    return result;
+}
+
+dds_return_t ddsrt_readdir(ddsrt_dir_handle_t d, struct ddsrt_dirent *direntp)
+{
+    dds_return_t result;
+    WIN32_FIND_DATA FileData;
+    BOOL r;
+
+    if (direntp) {
+        r = FindNextFile(d, &FileData);
+        if (r) {
+            ddsrt_strlcpy(direntp->d_name, FileData.cFileName, sizeof(direntp->d_name));
+            result = DDS_RETCODE_OK;
+        } else {
+            result = DDS_RETCODE_ERROR;
+        }
+    } else {
+        result = DDS_RETCODE_ERROR;
+    }
+
+    return result;
+}
+
+dds_return_t ddsrt_closedir(ddsrt_dir_handle_t d)
+{
+    FindClose(d);
+
+    return DDS_RETCODE_OK;
+}
+
+dds_return_t ddsrt_stat(const char *path, struct ddsrt_stat *buf)
+{
+    dds_return_t result;
+    struct _stat _buf;
+    int r;
+
+    r = _stat(path, &_buf);
+    if (r == 0) {
+        buf->stat_mode = _buf.st_mode;
+        buf->stat_size = _buf.st_size;
+        buf->stat_mtime = DDS_SECS(_buf.st_mtime);;
+        result = DDS_RETCODE_OK;
+    } else {
+        result = DDS_RETCODE_ERROR;
+    }
+
+    return result;
+}
+
+char * ddsrt_file_normalize(const char *filepath)
+{
+    char *norm;
+    const char *fpPtr;
+    char *normPtr;
+
+    norm = NULL;
+    if ((filepath != NULL) && (*filepath != '\0')) {
+        norm = ddsrt_malloc(strlen(filepath) + 1);
+        /* replace any / or \ by DDSRT_FILESEPCHAR */
+        fpPtr = (char *) filepath;
+        normPtr = norm;
+        while (*fpPtr != '\0') {
+            *normPtr = *fpPtr;
+            if ((*fpPtr == '/') || (*fpPtr == '\\')) {
+                *normPtr = DDSRT_FILESEPCHAR;
+                normPtr++;
+            } else {
+                if (*fpPtr != '\"') {
+                    normPtr++;
+                }
+            }
+            fpPtr++;
+        }
+        *normPtr = '\0';
+    }
+
+    return norm;
+}
+
+const char *ddsrt_file_sep(void)
+{
+    return "\\";
+}
diff --git a/src/security/builtin_plugins/access_control/src/access_control.c b/src/security/builtin_plugins/access_control/src/access_control.c
index f356445..d26b761 100644
--- a/src/security/builtin_plugins/access_control/src/access_control.c
+++ b/src/security/builtin_plugins/access_control/src/access_control.c
@@ -26,6 +26,7 @@
 #include "access_control_utils.h"
 #include "access_control_objects.h"
 #include "access_control_parser.h"
+#include "dds/security/core/dds_security_timed_cb.h"
 
 #if OPENSSL_VERSION_NUMBER >= 0x10000000L && OPENSSL_VERSION_NUMBER < 0x10100000L
 #define REMOVE_THREAD_STATE() ERR_remove_thread_state(NULL);
@@ -78,9 +79,10 @@ typedef struct dds_security_access_control_impl
   struct AccessControlTable *local_permissions;
 #endif
   struct AccessControlTable *remote_permissions;
-#if TIMED_CALLBACK_IMPLEMENTED
-  struct ut_timed_dispatcher_t *timed_callbacks;
-#endif
+
+  struct dds_security_timed_cb_data *timed_callbacks;
+  struct dds_security_timed_dispatcher_t *dispatcher;
+
 } dds_security_access_control_impl;
 
 static bool get_sec_attributes(dds_security_access_control_impl *ac, const DDS_Security_PermissionsHandle permissions_handle, const char *topic_name,
@@ -105,9 +107,7 @@ static struct topic_rule *find_topic_from_domain_rule(struct domain_rule *domain
 static DDS_Security_boolean domainid_within_sets(struct domain_id_set *domain, int domain_id);
 static DDS_Security_boolean compare_class_id_plugin_classname(DDS_Security_string class_id_1, DDS_Security_string class_id_2);
 static DDS_Security_boolean compare_class_id_major_ver(DDS_Security_string class_id_1, DDS_Security_string class_id_2);
-#if TIMED_CALLBACK_IMPLEMENTED
-  static void add_validity_end_trigger(dds_security_access_control_impl *ac, const DDS_Security_PermissionsHandle permissions_handle, dds_time_t end);
-#endif
+static void add_validity_end_trigger(dds_security_access_control_impl *ac, const DDS_Security_PermissionsHandle permissions_handle, dds_time_t end);
 static DDS_Security_boolean is_allowed_by_permissions(struct permissions_parser *permissions, int domain_id, const char *topic_name, const DDS_Security_PartitionQosPolicy *partitions,
     const char *identity_subject_name, permission_criteria_type criteria_type, DDS_Security_SecurityException *ex);
 static void sanity_check_local_access_rights(local_participant_access_rights *rights);
@@ -168,10 +168,8 @@ validate_local_permissions(
   {
     assert (rights->permissions_expiry != DDS_TIME_INVALID);
 
-#if TIMED_CALLBACK_IMPLEMENTED
     if (rights->permissions_expiry != 0)
       add_validity_end_trigger(ac, permissions_handle, rights->permissions_expiry);
-#endif
   }
 
   return permissions_handle;
@@ -232,10 +230,8 @@ validate_remote_permissions(
 
   permissions_handle = ACCESS_CONTROL_OBJECT_HANDLE(remote_rights);
 
-#if TIMED_CALLBACK_IMPLEMENTED
   if (permissions_handle != DDS_SECURITY_HANDLE_NIL)
     add_validity_end_trigger(ac, permissions_handle, remote_rights->permissions_expiry);
-#endif
 
   if (remote_rights)
     access_control_table_insert(ac->remote_permissions, (AccessControlObject *)remote_rights);
@@ -926,16 +922,12 @@ set_listener(dds_security_access_control *instance,
              DDS_Security_SecurityException *ex)
 {
   DDSRT_UNUSED_ARG(ex);
-#if TIMED_CALLBACK_IMPLEMENTED
+
   dds_security_access_control_impl *ac = (dds_security_access_control_impl *)instance;
   if (listener)
-    ut_timed_dispatcher_enable(ac->timed_callbacks, (void *)listener);
+    dds_security_timed_dispatcher_enable(ac->timed_callbacks, ac->dispatcher, (void *)listener);
   else
-    ut_timed_dispatcher_disable(ac->timed_callbacks);
-#else
-  DDSRT_UNUSED_ARG(instance);
-  DDSRT_UNUSED_ARG(listener);
-#endif
+    dds_security_timed_dispatcher_disable(ac->timed_callbacks, ac->dispatcher);
 
   return true;
 }
@@ -1490,9 +1482,9 @@ int init_access_control(const char *argument, void **context)
   dds_security_access_control_impl *access_control = ddsrt_malloc(sizeof(*access_control));
   memset(access_control, 0, sizeof(*access_control));
 
-#if TIMED_CALLBACK_IMPLEMENTED
-  access_control->timed_callbacks = ut_timed_dispatcher_new();
-#endif
+
+  access_control->timed_callbacks = dds_security_timed_cb_new();
+  access_control->dispatcher = dds_security_timed_dispatcher_new(access_control->timed_callbacks);
   access_control->base.validate_local_permissions = &validate_local_permissions;
   access_control->base.validate_remote_permissions = &validate_remote_permissions;
   access_control->base.check_create_participant = &check_create_participant;
@@ -1875,7 +1867,6 @@ find_remote_permissions_by_permissions_handle(
   return (remote_participant_access_rights *)args.object;
 }
 
-#if TIMED_CALLBACK_IMPLEMENTED
 
 typedef struct
 {
@@ -1884,15 +1875,17 @@ typedef struct
 } validity_cb_info;
 
 static void
-validity_callback(struct ut_timed_dispatcher_t *d,
-                  ut_timed_cb_kind kind,
+validity_callback(struct dds_security_timed_dispatcher_t *d,
+                  dds_security_timed_cb_kind kind,
                   void *listener,
                   void *arg)
 {
   validity_cb_info *info = arg;
+
+  DDSRT_UNUSED_ARG(d);
   assert(d);
   assert(arg);
-  if (kind == UT_TIMED_CB_KIND_TIMEOUT)
+  if (kind == DDS_SECURITY_TIMED_CB_KIND_TIMEOUT)
   {
     assert(listener);
     if (1 /* TODO: Check if hdl is still valid or if it has been already returned. */)
@@ -1913,9 +1906,8 @@ add_validity_end_trigger(dds_security_access_control_impl *ac,
   validity_cb_info *arg = ddsrt_malloc(sizeof(validity_cb_info));
   arg->ac = ac;
   arg->hdl = permissions_handle;
-  ut_timed_dispatcher_add(ac->timed_callbacks, validity_callback, end, (void *)arg);
+  dds_security_timed_dispatcher_add(ac->timed_callbacks, ac->dispatcher, validity_callback, end, (void *)arg);
 }
-#endif
 
 static DDS_Security_boolean
 is_allowed_by_permissions(struct permissions_parser *permissions,
@@ -2465,9 +2457,10 @@ int finalize_access_control(void *context)
   dds_security_access_control_impl *access_control = context;
   if (access_control)
   {
-#if TIMED_CALLBACK_IMPLEMENTED
-    ut_timed_dispatcher_free(access_control->timed_callbacks);
-#endif
+
+    dds_security_timed_dispatcher_free(access_control->timed_callbacks, access_control->dispatcher);
+    dds_security_timed_cb_free(access_control->timed_callbacks);
+
     access_control_table_free(access_control->remote_permissions);
 #ifdef ACCESS_CONTROL_USE_ONE_PERMISSION
     if (access_control->local_access_rights)
diff --git a/src/security/builtin_plugins/authentication/src/auth_utils.c b/src/security/builtin_plugins/authentication/src/auth_utils.c
index 430dffd..54b2224 100644
--- a/src/security/builtin_plugins/authentication/src/auth_utils.c
+++ b/src/security/builtin_plugins/authentication/src/auth_utils.c
@@ -30,6 +30,8 @@
 #include <openssl/rand.h>
 #include "dds/ddsrt/time.h"
 #include "dds/ddsrt/heap.h"
+#include "dds/ddsrt/filesystem.h"
+#include "dds/ddsrt/retcode.h"
 #include "dds/security/dds_security_api_defs.h"
 #include "dds/security/core/dds_security_utils.h"
 #include <assert.h>
@@ -47,11 +49,11 @@
 #include "dds/ddsrt/heap.h"
 #include "dds/ddsrt/atomics.h"
 #include "dds/ddsrt/string.h"
+#include "dds/ddsrt/io.h"
 #include "dds/security/core/dds_security_utils.h"
 #include <string.h>
 #include "auth_utils.h"
 
-
 #define MAX_TRUSTED_CA 100
 
 char *
@@ -1190,40 +1192,29 @@ get_trusted_ca_list ( const char* trusted_ca_dir,
 
 
     DDS_Security_ValidationResult_t loading_result = DDS_RETCODE_OK;
-    DDSRT_UNUSED_ARG( ca_list );
-    DDSRT_UNUSED_ARG( trusted_ca_dir );
-    DDSRT_UNUSED_ARG( ex );
-/* TODO: Trusted CA directory tracing function should be ported */
-/* TODO: MAX_TRUSTED_CA limitation will be removed */
-#ifdef TRUSTED_CA_LIST_IMPLEMENTED
 
-    os_result        r;
-    os_dirHandle     d_descr;
-    struct os_dirent d_entry;
-    struct os_stat_s status;
+    dds_return_t        r;
+    ddsrt_dir_handle_t     d_descr;
+    struct ddsrt_dirent d_entry;
+    struct ddsrt_stat status;
     char *full_file_path;
     char *trusted_ca_dir_normalized;
 
     X509 *ca_buffer_array[MAX_TRUSTED_CA]; /*max trusted CA size */
     unsigned ca_buffer_array_size=0;
     unsigned i;
-    trusted_ca_dir_normalized  = os_fileNormalize(trusted_ca_dir);
+    trusted_ca_dir_normalized  = ddsrt_file_normalize(trusted_ca_dir);
 
-    r = os_opendir(trusted_ca_dir_normalized, &d_descr);
+    r = ddsrt_opendir(trusted_ca_dir_normalized, &d_descr);
     ddsrt_free ( trusted_ca_dir_normalized );
-
-    if (r == os_resultSuccess && ca_buffer_array_size < MAX_TRUSTED_CA) { /* accessable */
-        r = os_readdir(d_descr, &d_entry);
-        while (r == os_resultSuccess) {
-            full_file_path = (char*) ddsrt_malloc(strlen(trusted_ca_dir) + strlen(os_fileSep()) + strlen(d_entry.d_name) + strlen(os_fileSep()) + 1 );
-            ddsrt_strcpy(full_file_path, trusted_ca_dir);
-            ddsrt_strcat(full_file_path, os_fileSep());
-            ddsrt_strcat(full_file_path, d_entry.d_name);
-
-            if (os_stat (full_file_path, &status) == os_resultSuccess) { /* accessable */
+    if (r == DDS_RETCODE_OK && ca_buffer_array_size < MAX_TRUSTED_CA) { /* accessable */
+        r = ddsrt_readdir(d_descr, &d_entry);
+        while (r == DDS_RETCODE_OK) {
+            ddsrt_asprintf(&full_file_path, "%s%s%s", trusted_ca_dir, ddsrt_file_sep(), d_entry.d_name);
+            if (ddsrt_stat (full_file_path, &status) == DDS_RETCODE_OK) { /* accessable */
                 if ((strcmp(d_entry.d_name, ".") != 0) &&
                     (strcmp(d_entry.d_name, "..") != 0)) {
-                    char * filename = os_fileNormalize(full_file_path);
+                    char * filename = ddsrt_file_normalize(full_file_path);
 
                     if(filename){
                         X509 *identityCA;
@@ -1239,26 +1230,26 @@ get_trusted_ca_list ( const char* trusted_ca_dir,
                     }
                 }
             }
-            r = os_readdir(d_descr, &d_entry);
+            r = ddsrt_readdir(d_descr, &d_entry);
 
             ddsrt_free(full_file_path);
         }
 
-        os_closedir (d_descr);
+        ddsrt_closedir (d_descr);
 
         /* deallocate given ca_list if it is not NULL */
         free_ca_list_contents(ca_list);
 
         /*copy CAs to out parameter as HASH*/
         if( ca_buffer_array_size > 0 ){
-            ca_list->_buffer = ddsrt_malloc( ca_buffer_array_size * sizeof(X509 * ) );
+            ca_list->buffer = ddsrt_malloc( ca_buffer_array_size * sizeof(X509 * ) );
             for (i = 0; i < ca_buffer_array_size; ++i) {
-                ca_list->_buffer[i] = ca_buffer_array[i];
+                ca_list->buffer[i] = ca_buffer_array[i];
 
             }
 
         }
-        ca_list->_length = ca_buffer_array_size;
+        ca_list->length = ca_buffer_array_size;
 
         return DDS_SECURITY_VALIDATION_OK;
 
@@ -1267,7 +1258,6 @@ get_trusted_ca_list ( const char* trusted_ca_dir,
         DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_TRUSTED_CA_DIR_CODE, 0, DDS_SECURITY_ERR_INVALID_TRUSTED_CA_DIR_MESSAGE);
         return DDS_SECURITY_VALIDATION_FAILED;
     }
-#endif
 
     return loading_result;
 }
diff --git a/src/security/builtin_plugins/authentication/src/authentication.c b/src/security/builtin_plugins/authentication/src/authentication.c
index dada4db..a3d5ea7 100644
--- a/src/security/builtin_plugins/authentication/src/authentication.c
+++ b/src/security/builtin_plugins/authentication/src/authentication.c
@@ -22,6 +22,7 @@
 #include "authentication.h"
 #include "dds/ddsrt/heap.h"
 #include "dds/security/dds_security_api.h"
+#include "dds/security/core/dds_security_timed_cb.h"
 
 
 #if OPENSLL_VERSION_NUMBER >= 0x10002000L
@@ -202,7 +203,8 @@ typedef struct dds_security_authentication_impl {
     ddsrt_mutex_t lock;
     struct ddsrt_hh *objectHash;
     struct ddsrt_hh *remoteGuidHash;
-    struct ut_timed_dispatcher_t *timed_callbacks;
+    struct dds_security_timed_cb_data *timed_callbacks;
+    struct dds_security_timed_dispatcher_t *dispatcher;
     X509Seq trustedCAList;
 
 
@@ -844,22 +846,19 @@ hash_value_to_binary_property(
     return bp;
 }
 
-
-/* Will be enabled after timed callback feature implementation */
-#if TIMED_CALLBACK_IMPLEMENTED
-
 static void
-validity_callback(struct ut_timed_dispatcher_t *d,
-                  ut_timed_cb_kind kind,
+validity_callback(struct dds_security_timed_dispatcher_t *d,
+                  dds_security_timed_cb_kind kind,
                   void *listener,
                   void *arg)
 {
     validity_cb_info *info = arg;
 
+    DDSRT_UNUSED_ARG(d);
     assert(d);
     assert(arg);
 
-    if (kind == UT_TIMED_CB_KIND_TIMEOUT) {
+    if (kind == DDS_SECURITY_TIMED_CB_KIND_TIMEOUT) {
         assert(listener);
         dds_security_authentication_listener *auth_listener = (dds_security_authentication_listener*)listener;
         if (auth_listener->on_revoke_identity) {
@@ -872,26 +871,19 @@ validity_callback(struct ut_timed_dispatcher_t *d,
     ddsrt_free(arg);
 }
 
-#endif
 
 static void
 add_validity_end_trigger(dds_security_authentication_impl *auth,
                          const DDS_Security_IdentityHandle identity_handle,
                          dds_time_t end)
 {
-    DDSRT_UNUSED_ARG( auth );
-    DDSRT_UNUSED_ARG( identity_handle );
-    DDSRT_UNUSED_ARG( end );
-    /* Will be enabled after timed call back feature implementation */
-    /*
     validity_cb_info *arg = ddsrt_malloc(sizeof(validity_cb_info));
     arg->auth = auth;
     arg->hdl = identity_handle;
-    ut_timed_dispatcher_add(auth->timed_callbacks,
+    dds_security_timed_dispatcher_add(auth->timed_callbacks, auth->dispatcher,
                             validity_callback,
                             end,
                             (void*)arg);
-                            */
 }
 
 
@@ -3170,18 +3162,14 @@ DDS_Security_boolean set_listener(dds_security_authentication *instance,
 {
     dds_security_authentication_impl *auth = (dds_security_authentication_impl*)instance;
 
-    DDSRT_UNUSED_ARG(auth);
-    DDSRT_UNUSED_ARG(listener);
     DDSRT_UNUSED_ARG(ex);
 
-    /* Will be enabled after timed call back feature implementation */
-#if TIMED_CALLBACK_IMPLEMENTED
     if (listener) {
-        ut_timed_dispatcher_enable(auth->timed_callbacks, (void*)listener);
+        dds_security_timed_dispatcher_enable(auth->timed_callbacks, auth->dispatcher, (void*)listener);
     } else {
-        ut_timed_dispatcher_disable(auth->timed_callbacks);
+        dds_security_timed_dispatcher_disable(auth->timed_callbacks, auth->dispatcher);
     }
-#endif
+
     return true;
 }
 
@@ -3398,8 +3386,8 @@ init_authentication( const char *argument, void **context)
     memset(authentication, 0, sizeof(dds_security_authentication_impl));
 
     /* assign dispatcher to be notified when a validity date ends */
-    /* Disable it until timed callback is ready */
-    /*authentication->timed_callbacks = ut_timed_dispatcher_new(); */
+    authentication->timed_callbacks = dds_security_timed_cb_new();
+    authentication->dispatcher = dds_security_timed_dispatcher_new(authentication->timed_callbacks);
 
     /* assign the interface functions */
     authentication->base.validate_local_identity = &validate_local_identity;
@@ -3474,8 +3462,9 @@ int32_t finalize_authentication(void *instance)
     if( authentication ){
         ddsrt_mutex_lock(&authentication->lock);
 
-        /* Will be enabled after timed call back feature implementation */
-        /* ut_timed_dispatcher_free(authentication->timed_callbacks); */
+        dds_security_timed_dispatcher_free(authentication->timed_callbacks, authentication->dispatcher);
+        dds_security_timed_cb_free(authentication->timed_callbacks);
+
         if (authentication->remoteGuidHash) {
             ddsrt_hh_free(authentication->remoteGuidHash);
         }
diff --git a/src/security/builtin_plugins/tests/CMakeLists.txt b/src/security/builtin_plugins/tests/CMakeLists.txt
index d822524..ac56a7f 100644
--- a/src/security/builtin_plugins/tests/CMakeLists.txt
+++ b/src/security/builtin_plugins/tests/CMakeLists.txt
@@ -21,6 +21,8 @@ set(security_auth_test_sources
     "validate_begin_handshake_request/src/validate_begin_handshake_request_utests.c"
     "validate_local_identity/src/validate_local_identity_utests.c"
     "validate_remote_identity/src/validate_remote_identity_utests.c"
+    "listeners_authentication/src/listeners_authentication_utests.c"
+    "listeners_access_control/src/listeners_access_control_utests.c"
 )
 
 set(security_ac_test_sources
@@ -74,6 +76,7 @@ if(OPENSSL_FOUND)
 target_link_libraries(cunit_security_plugins PRIVATE ddsc dds_security_ac)
 target_link_libraries(cunit_security_plugins PRIVATE ddsc dds_security_crypto)
   target_link_libraries(cunit_security_plugins PRIVATE OpenSSL::SSL)
+
 else()
   message(FATAL_ERROR "To build with openssl support, set ENABLE_OPENSSL to ON")
 endif()
@@ -92,5 +95,8 @@ target_include_directories(
 
 
 set(CUnit_builtin_plugins_tests_dir "${CMAKE_CURRENT_LIST_DIR}")
+set(CUnit_build_dir "${CMAKE_CURRENT_BINARY_DIR}")
 
 configure_file("config_env.h.in" "config_env.h")
+
+
diff --git a/src/security/builtin_plugins/tests/config_env.h.in b/src/security/builtin_plugins/tests/config_env.h.in
index 3f2b23a..c22d1f5 100644
--- a/src/security/builtin_plugins/tests/config_env.h.in
+++ b/src/security/builtin_plugins/tests/config_env.h.in
@@ -13,5 +13,6 @@
 #define CONFIG_ENV_H
 
 #define CONFIG_ENV_TESTS_DIR           "@CUnit_builtin_plugins_tests_dir@"
+#define CONFIG_ENV_BUILD_DIR           "@CUnit_build_dir@"
 
 #endif /* CONFIG_ENV_H */
diff --git a/src/security/builtin_plugins/tests/listeners_access_control/etc/Test_Permissions_listener.p7s b/src/security/builtin_plugins/tests/listeners_access_control/etc/Test_Permissions_listener.p7s
deleted file mode 100644
index 08434a9..0000000
--- a/src/security/builtin_plugins/tests/listeners_access_control/etc/Test_Permissions_listener.p7s
+++ /dev/null
@@ -1,51 +0,0 @@
-MIME-Version: 1.0
-Content-Type: multipart/signed; protocol="application/x-pkcs7-signature"; micalg="sha-256"; boundary="----3900963D3572093F6AEC654A72CAEE5A"
-
-This is an S/MIME signed message
-
-------3900963D3572093F6AEC654A72CAEE5A
-Content-Type: text/plain
-
-<?xml version="1.0" encoding="utf-8"?>                                    <dds xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"                                                                xsi:noNamespaceSchemaLocation="https://www.omg.org/spec/DDS-SECURITY/20170901/omg_shared_ca_permissions.xsd">          <permissions>                                                                                                               <grant name="DEFAULT_PERMISSIONS">                                                                                        <subject_name>/C=NL/ST=Some-State/O=Internet Widgits Pty Ltd/CN=CHAM500 cert</subject_name>                                                                                           <validity>                                                                                                                  <not_before>2015-09-15T01:00:00</not_before>                                                                            <not_after>2019-11-18T11:48:49</not_after>                                                                          </validity>                                                                                                             <deny_rule>                                                                                                                <domains>                                                                                                                   <id_range>                                                                                                                  <min>0</min>                                                                                                            <max>230</max>                                                                                                      </id_range>                                                                                                         </domains>                                                                                                              <publish>                                                                                                                   <topics>                                                                                                                    <topic>*</topic>                                                                                                    </topics>                                                                                                               <partitions/>                                                                                                       </publish>                                                                                                              <subscribe>                                                                                                                 <topics>                                                                                                                    <topic>*</topic>                                                                                                    </topics>                                                                                                               <partitions/>                                                                                                       </subscribe>                                                                                                       </deny_rule>                                                                                                           <default>DENY</default>                                                                                             </grant>                                                                                                            </permissions>                                                                                                      </dds>                                  
-------3900963D3572093F6AEC654A72CAEE5A
-Content-Type: application/x-pkcs7-signature; name="smime.p7s"
-Content-Transfer-Encoding: base64
-Content-Disposition: attachment; filename="smime.p7s"
-
-MIIGSAYJKoZIhvcNAQcCoIIGOTCCBjUCAQExDzANBglghkgBZQMEAgEFADALBgkq
-hkiG9w0BBwGgggORMIIDjTCCAnWgAwIBAgIJANsr3sm0NrypMA0GCSqGSIb3DQEB
-CwUAMFwxCzAJBgNVBAYTAk5MMRMwEQYDVQQIDApTb21lLVN0YXRlMR8wHQYDVQQK
-DBZBRExJTksgVGVjaG5vbG9jeSBJbmMuMRcwFQYDVQQDDA5hZGxpbmt0ZWNoLmNv
-bTAgFw0xODA3MzAxMjQ1NTVaGA8yMTE4MDcwNjEyNDU1NVowXDELMAkGA1UEBhMC
-TkwxEzARBgNVBAgMClNvbWUtU3RhdGUxHzAdBgNVBAoMFkFETElOSyBUZWNobm9s
-b2N5IEluYy4xFzAVBgNVBAMMDmFkbGlua3RlY2guY29tMIIBIjANBgkqhkiG9w0B
-AQEFAAOCAQ8AMIIBCgKCAQEAu7jfnJ0wYVuXgG+PgNawdN38+dRpa8jceqi+blID
-ehV6XCxrnGXusTCDuFmo7HMOBVMVNDXlcBWgoGd+u5EultnOEiIeGTgtHc1O6V9w
-icp3BGSpZZax/TcONjMVORaqHCADbQ2J8wsz1FHxuKDwX6BJElYOlK77lb/x3yLs
-DFFC+a0qn2RFh37rcWBRAHy8VEASXKZElT9ZmfKd+KUq34KojhNJ4DepKStTq074
-BRDXVivx+wVD951LFNPiQXq+mgHcLj1k37KlZflTFhdP5oEMtATNsXNJPHlEymiy
-SogRWAmKhysLQudukHfNKN+r0FEQMk/hzpYcFeZSOvbfNQIDAQABo1AwTjAdBgNV
-HQ4EFgQURWMbWvBKZwJvRV1/tyc1R82k0+gwHwYDVR0jBBgwFoAURWMbWvBKZwJv
-RV1/tyc1R82k0+gwDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAQEAkPF+
-ysVtvHnk2hpu9yNDLCJ96ZzIoKOyY7uRj4ovzlAHFdpNOJQdcJihTmN8i7Trht9X
-Vh0rGoR/6nHzo3TIeiogRC80RlDtuA3PF2dDQBMVDStlZMTZPb693hfjdAjhyyw9
-yghhKHHqNDvSsAL0KfBqjG4yGfGpJylYXIT5fWuKlo/ln/yyPa5s54T5XDo+CMbt
-lLX3QnwVOmaRyzylPiTcPCDIkdLBdXmlfyJcmW6fWa6kPx+35MOxPsXZbujCo+42
-+OyLqcH1rKT6XhcshjXBEf+kdgUfSClrM1pNRWsw2ChIYim0F+nry5JFy0Y+8Hbb
-6SDB340BFmtgDHbFHTGCAnswggJ3AgEBMGkwXDELMAkGA1UEBhMCTkwxEzARBgNV
-BAgMClNvbWUtU3RhdGUxHzAdBgNVBAoMFkFETElOSyBUZWNobm9sb2N5IEluYy4x
-FzAVBgNVBAMMDmFkbGlua3RlY2guY29tAgkA2yveybQ2vKkwDQYJYIZIAWUDBAIB
-BQCggeQwGAYJKoZIhvcNAQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG9w0BCQUxDxcN
-MTkxMTE4MTE0ODQ4WjAvBgkqhkiG9w0BCQQxIgQgaLNNlFwfVR0PrziT9wCAy5bM
-qCZJX9yO3xJgut3/o7EweQYJKoZIhvcNAQkPMWwwajALBglghkgBZQMEASowCwYJ
-YIZIAWUDBAEWMAsGCWCGSAFlAwQBAjAKBggqhkiG9w0DBzAOBggqhkiG9w0DAgIC
-AIAwDQYIKoZIhvcNAwICAUAwBwYFKw4DAgcwDQYIKoZIhvcNAwICASgwDQYJKoZI
-hvcNAQEBBQAEggEAWCFrUIvdYKBeT0lmpkRdmYJuvdmQ/Ro7k9iyreVofpB1/70B
-hVOEeRjrlmhv/TUjSgQyli56wmXFmexcNRzSzpPNycz0gjwP9kX5BMnhAkKd08fC
-4rgoirScmNxvxEkj5+wyq7s7rBEJOgVQ9ofwiZXEBVDMVvW2ENZhVF3FyoNulDQe
-6BjXkuLw/QrJLWjywPy5naSSda2T7V3+Ssdu5/2vEjXPIJMM+xPOCaqGHJsSb72s
-KiP48jZ95Wruvj3QAlpGxDaazWPTgn7tfThYrY3Kgiz5zyZM7FhFyIqxRF/89Ngo
-hbu2mWzcXFF7wBLy+CvK5Foajro9t/PzD8uNuA==
-
-------3900963D3572093F6AEC654A72CAEE5A--
-
diff --git a/src/security/builtin_plugins/tests/listeners_access_control/src/listeners_access_control_utests.c b/src/security/builtin_plugins/tests/listeners_access_control/src/listeners_access_control_utests.c
index 5f32d09..f215738 100644
--- a/src/security/builtin_plugins/tests/listeners_access_control/src/listeners_access_control_utests.c
+++ b/src/security/builtin_plugins/tests/listeners_access_control/src/listeners_access_control_utests.c
@@ -215,6 +215,7 @@ static DDS_Security_PermissionsHandle local_permissions_handle = DDS_SECURITY_HA
 static DDS_Security_PermissionsHandle remote_permissions_handle = DDS_SECURITY_HANDLE_NIL;
 static DDS_Security_GUID_t local_participant_guid;
 static char *g_path_to_etc_dir = NULL;
+static char *g_path_build_dir = NULL;
 static DDS_Security_PermissionsHandle permission_handle_for_callback1 = DDS_SECURITY_HANDLE_NIL;
 static DDS_Security_PermissionsHandle permission_handle_for_callback2 = DDS_SECURITY_HANDLE_NIL;
 static dds_time_t local_expiry_date;
@@ -251,14 +252,16 @@ static void reset_exception(DDS_Security_SecurityException *ex)
 static void get_future_xsdate(char *str, size_t len, int32_t delta)
 {
   time_t rawtime;
-  struct tm *future;
+  struct tm *future = ddsrt_malloc(sizeof(struct tm));
 
   /* Get future time. */
   rawtime = time(NULL) + delta;
-  future = gmtime(&rawtime);
+  OPENSSL_gmtime(&rawtime, future);
 
   /* Put the future time in a xsDate format. */
   strftime(str, len, "%Y-%m-%dT%H:%M:%S", future);
+
+  ddsrt_free(future);
 }
 
 static int smime_sign(const char *certificate_file, const char *key_file, const char *data, const char *out_file)
@@ -345,7 +348,7 @@ static void fill_participant_qos(DDS_Security_Qos *qos, int32_t permission_expir
 
   ddsrt_asprintf(&permissions_ca_cert_file, "%s%s", g_path_to_etc_dir, PERMISSIONS_CA_CERT_FILE);
   ddsrt_asprintf(&permissions_ca_key_file, "%s%s", g_path_to_etc_dir, PERMISSIONS_CA_KEY_FILE);
-  ddsrt_asprintf(&permissions_file, "%s%s", g_path_to_etc_dir, PERMISSIONS_FILE);
+  ddsrt_asprintf(&permissions_file, "%s%s", g_path_build_dir, PERMISSIONS_FILE);
 
   smime_sign(permissions_ca_cert_file, permissions_ca_key_file, permissions_xml_with_expiry, permissions_file);
 
@@ -407,9 +410,9 @@ static int fill_peer_credential_token(DDS_Security_AuthenticatedPeerCredentialTo
   remote_expiry_date = DDS_Security_parse_xml_date(permission_expiry_date_str);
   permissions_xml_with_expiry = ddsrt_str_replace(PERMISSIONS_DOCUMENT, "PERMISSION_EXPIRY_DATE", permission_expiry_date_str, 1);
 
-  ddsrt_asprintf(permissions_ca_cert_file, "%s%s", g_path_to_etc_dir, PERMISSIONS_CA_CERT_FILE);
-  ddsrt_asprintf(permissions_ca_key_file, "%s%s", g_path_to_etc_dir, PERMISSIONS_CA_KEY_FILE);
-  ddsrt_asprintf(permissions_file, "%s%s", g_path_to_etc_dir, PERMISSIONS_FILE);
+  ddsrt_asprintf(&permissions_ca_cert_file, "%s%s", g_path_to_etc_dir, PERMISSIONS_CA_CERT_FILE);
+  ddsrt_asprintf(&permissions_ca_key_file, "%s%s", g_path_to_etc_dir, PERMISSIONS_CA_KEY_FILE);
+  ddsrt_asprintf(&permissions_file, "%s%s", g_path_build_dir, PERMISSIONS_FILE);
 
   smime_sign(permissions_ca_cert_file, permissions_ca_key_file, permissions_xml_with_expiry, permissions_file);
 
@@ -531,17 +534,29 @@ static void set_path_to_etc_dir(void)
 {
   ddsrt_asprintf(&g_path_to_etc_dir, "%s%s", CONFIG_ENV_TESTS_DIR, RELATIVE_PATH_TO_ETC_DIR);
 }
-
-static void suite_listeners_access_control_init(void)
+static void set_path_build_dir(void)
 {
-  plugins = load_plugins(&access_control, &auth, NULL /* Cryptograpy */);
-  CU_ASSERT_FATAL(plugins != NULL);
-  set_path_to_etc_dir();
-  OpenSSL_add_all_algorithms();
-  ERR_load_crypto_strings();
+  ddsrt_asprintf(&g_path_build_dir, "%s/", CONFIG_ENV_BUILD_DIR);
 }
 
-static void suite_listeners_access_control_fini(void)
+CU_Init(ddssec_builtin_listeners_access_control)
+{
+  int res = 0;
+
+  plugins = load_plugins(&access_control, &auth, NULL /* Cryptograpy */);
+  if (!plugins) {
+    res = -1;
+  } else {
+    set_path_to_etc_dir();
+    set_path_build_dir();
+    OpenSSL_add_all_algorithms();
+    ERR_load_crypto_strings();
+  }
+
+  return res;
+}
+
+CU_Clean(ddssec_builtin_listeners_access_control)
 {
   unload_plugins(plugins);
   ddsrt_free(g_path_to_etc_dir);
@@ -549,6 +564,8 @@ static void suite_listeners_access_control_fini(void)
   CRYPTO_cleanup_all_ex_data();
   REMOVE_THREAD_STATE();
   ERR_free_strings();
+
+  return 0;
 }
 
 static DDS_Security_boolean on_revoke_permissions_cb(dds_security_access_control_listener *instance, const dds_security_access_control *plugin, const DDS_Security_PermissionsHandle handle)
@@ -559,11 +576,11 @@ static DDS_Security_boolean on_revoke_permissions_cb(dds_security_access_control
     permission_handle_for_callback1 = handle;
   else if (permission_handle_for_callback2 == DDS_SECURITY_HANDLE_NIL)
     permission_handle_for_callback2 = handle;
-  printf("Listener called for handle: %lld  Local:%ld Remote:%ld\n", (long long)handle, local_permissions_handle, remote_permissions_handle);
+  printf("Listener called for handle: %lld  Local:%lld Remote:%lld\n", (long long)handle, (long long)local_permissions_handle, (long long)remote_permissions_handle);
   return true;
 }
 
-CU_Test(ddssec_builtin_listeners_access_control, local_2secs, .init = suite_listeners_access_control_init, .fini = suite_listeners_access_control_fini)
+CU_Test(ddssec_builtin_listeners_access_control, local_2secs)
 {
   DDS_Security_PermissionsHandle result;
   DDS_Security_PermissionsToken permissions_token;
diff --git a/src/security/builtin_plugins/tests/listeners_authentication/etc/Example_Governance.p7s b/src/security/builtin_plugins/tests/listeners_authentication/etc/Example_Governance.p7s
new file mode 100644
index 0000000..8c6aae5
--- /dev/null
+++ b/src/security/builtin_plugins/tests/listeners_authentication/etc/Example_Governance.p7s
@@ -0,0 +1,120 @@
+MIME-Version: 1.0
+Content-Type: multipart/signed; protocol="application/x-pkcs7-signature"; micalg="sha-256"; boundary="----8F2D5CA80FE8B4509AF031712E008F0E"
+
+This is an S/MIME signed message
+
+------8F2D5CA80FE8B4509AF031712E008F0E
+Content-Type: text/plain
+
+<?xml version="1.0" encoding="utf-8"?>
+<dds xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xsi:noNamespaceSchemaLocation="https://www.omg.org/spec/DDS-SECURITY/20170901/omg_shared_ca_governance.xsd">
+    <domain_access_rules>
+        <domain_rule>
+            <domains>
+                <!-- All domains -->
+                <id_range>
+                    <min>0</min>
+                    <max>230</max>
+                </id_range>
+            </domains>
+
+            <!-- DomainParticipant that cann not authenticate or fail the authentication should be
+                 allowed to join the domain and see any any discovery data that are configured as "unprotected"
+                 and topics that are configured as "unprotected" -->
+            <allow_unauthenticated_participants>true</allow_unauthenticated_participants>
+
+            <!--  Only and any authenticated DomainParticipant should be allowed to join the domain and
+                  see the discovery data without checking access control  -->
+            <enable_join_access_control>true</enable_join_access_control>
+
+            <!-- Discovery information should be protected with encryption followed by MAC (Message Authentication Codes) -->
+            <discovery_protection_kind>ENCRYPT</discovery_protection_kind>
+
+            <!--  Liveliness messages are also encrypted -->
+            <liveliness_protection_kind>ENCRYPT</liveliness_protection_kind>
+
+            <!-- Whole RTPS message is not protected -->
+            <rtps_protection_kind>ENCRYPT</rtps_protection_kind>
+
+            <topic_access_rules>
+                <topic_rule>
+                    <!-- All (non-builtin) topics -->
+                    <topic_expression>*</topic_expression>
+
+                    <!-- Liveliness QoS data is protected -->
+                    <enable_liveliness_protection>true</enable_liveliness_protection>
+
+                    <!-- The discovery information on specific Topics should be sent
+                         using the secure (protected) discovery writers -->
+                    <enable_discovery_protection>true</enable_discovery_protection>
+
+                    <!-- The read access to all topics should be open to all. -->
+                    <enable_read_access_control>true</enable_read_access_control>
+
+                    <!-- The write access to all topics should be open to all. -->
+                    <enable_write_access_control>true</enable_write_access_control>
+
+                    <!-- Whole RTPS sub-message is protected. This includes metadata information
+                         like sequence numbers, heartbeats, key hashes, gaps,
+                         acknowledgment messages, etc. It also includes th possible payload. -->
+                    <metadata_protection_kind>ENCRYPT</metadata_protection_kind>
+
+                    <!-- The payload data sent on the Topic (serialized application level data) should be
+                         protected with Encrypt then MAC. -->
+                    <data_protection_kind>ENCRYPT</data_protection_kind>
+                </topic_rule>
+            </topic_access_rules>
+        </domain_rule>
+    </domain_access_rules>
+</dds>
+
+------8F2D5CA80FE8B4509AF031712E008F0E
+Content-Type: application/x-pkcs7-signature; name="smime.p7s"
+Content-Transfer-Encoding: base64
+Content-Disposition: attachment; filename="smime.p7s"
+
+MIIHiwYJKoZIhvcNAQcCoIIHfDCCB3gCAQExDzANBglghkgBZQMEAgEFADALBgkq
+hkiG9w0BBwGgggRnMIIEYzCCA0ugAwIBAgIJAM3yAtULcaEIMA0GCSqGSIb3DQEB
+CwUAMIHHMQswCQYDVQQGEwJOTDELMAkGA1UECAwCT1YxFjAUBgNVBAcMDUxvY2Fs
+aXR5IE5hbWUxITAfBgNVBAsMGE9yZ2FuaXphdGlvbmFsIFVuaXQgTmFtZTEgMB4G
+A1UECgwXRXhhbXBsZSBDQSBPcmdhbml6YXRpb24xHzAdBgNVBAMMFkV4YW1wbGUg
+UGVybWlzc2lvbnMgQ0ExLTArBgkqhkiG9w0BCQEWHmF1dGhvcml0eUBwZXJtaXNz
+aW9uc2NhbHRkLm9yZzAeFw0xOTAyMTIxMzUyMzJaFw0yOTAyMDkxMzUyMzJaMIHH
+MQswCQYDVQQGEwJOTDELMAkGA1UECAwCT1YxFjAUBgNVBAcMDUxvY2FsaXR5IE5h
+bWUxITAfBgNVBAsMGE9yZ2FuaXphdGlvbmFsIFVuaXQgTmFtZTEgMB4GA1UECgwX
+RXhhbXBsZSBDQSBPcmdhbml6YXRpb24xHzAdBgNVBAMMFkV4YW1wbGUgUGVybWlz
+c2lvbnMgQ0ExLTArBgkqhkiG9w0BCQEWHmF1dGhvcml0eUBwZXJtaXNzaW9uc2Nh
+bHRkLm9yZzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAKD6nYCszMha
+h3xGfJy8f3lowPHIj6zcldVYs5Krg7zXxZn+20lAMHUfgQcWZAauKbCnokYfTvXV
+v0j9HCpQ3mRynNTyjLjc7HxAe6kfaJ75PoIoOMMQMEGvPOqRUq0tomVVJvcgzZZk
+pwE30E6xvZrlQcrkQY/aOQ0sbje+RN8RKQ9vf6O45Np/0m2K5ohZPlBqg4F539v2
+iXGZczCr9AqAszc/7rOPX1aqZmmRDou0T+Zhx3ZZSAwZYQtr7uvvlUeGmDhNh+8p
+LC+1FQPtkKmcVXO8oZWm5N8piOvH3M+v3qhyPtLv30cpl0bDiFl+PN7nZ6InOOtd
+ZJVMa2rYCk8CAwEAAaNQME4wHQYDVR0OBBYEFA/CtiP8Z5Fk4aWDIb2j3FPwh9pg
+MB8GA1UdIwQYMBaAFA/CtiP8Z5Fk4aWDIb2j3FPwh9pgMAwGA1UdEwQFMAMBAf8w
+DQYJKoZIhvcNAQELBQADggEBACBupRddIR9zYBFLGFTzeiW+H1tRRKz+B3SWnCJH
+89ijEdMYlKKLYT0R18lCV0vHnl29bU1CPlkLn+GQkvdfIjKguWEQKTP+GLzoa9TV
+zOKAJ8NttCyW3YqriUOUGKqra1Fdt8nvrAyZUF+v/k8pTInmCvwu3l5HrVhkKHER
+IbCIohKi/2mk1JZS9reWvZhqLoUIw5IDFlqtBDYOfMaqm8XF01YjEDBM6OuyQzYN
+gDFVUZx0At4zzRjGTvqpLTkDYL1A3v4QYXZcwZiKeEVbFuNkauXgD+8pEZMB8yL4
+h1feIH+aucsAKBz1Ne5fTiTCannlKvLl8xWz5IdzP7gF0LIxggLoMIIC5AIBATCB
+1TCBxzELMAkGA1UEBhMCTkwxCzAJBgNVBAgMAk9WMRYwFAYDVQQHDA1Mb2NhbGl0
+eSBOYW1lMSEwHwYDVQQLDBhPcmdhbml6YXRpb25hbCBVbml0IE5hbWUxIDAeBgNV
+BAoMF0V4YW1wbGUgQ0EgT3JnYW5pemF0aW9uMR8wHQYDVQQDDBZFeGFtcGxlIFBl
+cm1pc3Npb25zIENBMS0wKwYJKoZIhvcNAQkBFh5hdXRob3JpdHlAcGVybWlzc2lv
+bnNjYWx0ZC5vcmcCCQDN8gLVC3GhCDANBglghkgBZQMEAgEFAKCB5DAYBgkqhkiG
+9w0BCQMxCwYJKoZIhvcNAQcBMBwGCSqGSIb3DQEJBTEPFw0xOTEyMDcxNjAxMjZa
+MC8GCSqGSIb3DQEJBDEiBCCAw/IHksMBWVnBQEtBoPLvJ1B+9IvOrQ4OkihJ6q0v
+ijB5BgkqhkiG9w0BCQ8xbDBqMAsGCWCGSAFlAwQBKjALBglghkgBZQMEARYwCwYJ
+YIZIAWUDBAECMAoGCCqGSIb3DQMHMA4GCCqGSIb3DQMCAgIAgDANBggqhkiG9w0D
+AgIBQDAHBgUrDgMCBzANBggqhkiG9w0DAgIBKDANBgkqhkiG9w0BAQEFAASCAQAd
+j3vO63v4bBbNhE0wZ8gWPHFfJsZO4JUu+ZzJ08hO1fku07Q13medyyp1+6jeZWoV
+rCqQbG37xL1dx023wsRu+mYPSgEtIx2zBGW8ADk2qEIGAVPUPGUiVXl6+7esAmnP
+AFDrt3Qp6nEZIr7iQ6i+4WW3kWM3o9C1ghSz4tVBjP9El5/yrux2mo5DTSeB8QMR
+npMNgwgatwAxTwUrBpQj0FE5NUDm21OT1VwlUAGTHz6m5npw92p6qvQxFYufRzWj
+XoADdJW0qgfbL00Gvoimi2K21cSUqiYcKU06eQeCkrLXyjif2JlFdKXvODwlydOy
+dtwcKpPKVKgBI01+5Imf
+
+------8F2D5CA80FE8B4509AF031712E008F0E--
+
diff --git a/src/security/builtin_plugins/tests/listeners_authentication/etc/Example_Permissions_Alice.p7s b/src/security/builtin_plugins/tests/listeners_authentication/etc/Example_Permissions_Alice.p7s
new file mode 100644
index 0000000..1e19a63
--- /dev/null
+++ b/src/security/builtin_plugins/tests/listeners_authentication/etc/Example_Permissions_Alice.p7s
@@ -0,0 +1,98 @@
+MIME-Version: 1.0
+Content-Type: multipart/signed; protocol="application/x-pkcs7-signature"; micalg="sha-256"; boundary="----51AB97062CF028E6EBDDAA31699954BC"
+
+This is an S/MIME signed message
+
+------51AB97062CF028E6EBDDAA31699954BC
+Content-Type: text/plain
+
+<?xml version="1.0" encoding="utf-8"?>
+<dds xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xsi:noNamespaceSchemaLocation="https://www.omg.org/spec/DDS-SECURITY/20170901/omg_shared_ca_permissions.xsd">
+    <permissions>
+        <grant name="OpenSplicePermissions">
+            <subject_name>/C=NL/ST=OV/L=Locality Name/OU=Organizational Unit Name/O=Example Organization/CN=Alice Example/emailAddress=alice@exampleltd.com</subject_name>
+            <validity>
+                <!-- Format is CCYY-MM-DDThh:mm:ss[Z|(+|-)hh:mm] in GMT -->
+                <not_before>2015-09-15T01:00:00</not_before>
+                <not_after>2115-09-15T01:00:00</not_after>
+            </validity>
+            <allow_rule>
+                <domains>
+                  <id_range>
+                    <min>0</min>
+                    <max>230</max>
+                  </id_range>
+                </domains>
+                <publish>
+                    <topics>
+                        <topic>*</topic>
+                    </topics>
+                    <partitions>
+                        <partition>*</partition>
+                    </partitions>
+                </publish>
+                <subscribe>
+                    <topics>
+                        <topic>*</topic>
+                    </topics>
+                    <partitions>
+                        <partition>*</partition>
+                    </partitions>
+                    
+                </subscribe>
+            </allow_rule>
+            <default>DENY</default>
+        </grant>
+    </permissions>
+</dds>
+
+------51AB97062CF028E6EBDDAA31699954BC
+Content-Type: application/x-pkcs7-signature; name="smime.p7s"
+Content-Transfer-Encoding: base64
+Content-Disposition: attachment; filename="smime.p7s"
+
+MIIHiwYJKoZIhvcNAQcCoIIHfDCCB3gCAQExDzANBglghkgBZQMEAgEFADALBgkq
+hkiG9w0BBwGgggRnMIIEYzCCA0ugAwIBAgIJAM3yAtULcaEIMA0GCSqGSIb3DQEB
+CwUAMIHHMQswCQYDVQQGEwJOTDELMAkGA1UECAwCT1YxFjAUBgNVBAcMDUxvY2Fs
+aXR5IE5hbWUxITAfBgNVBAsMGE9yZ2FuaXphdGlvbmFsIFVuaXQgTmFtZTEgMB4G
+A1UECgwXRXhhbXBsZSBDQSBPcmdhbml6YXRpb24xHzAdBgNVBAMMFkV4YW1wbGUg
+UGVybWlzc2lvbnMgQ0ExLTArBgkqhkiG9w0BCQEWHmF1dGhvcml0eUBwZXJtaXNz
+aW9uc2NhbHRkLm9yZzAeFw0xOTAyMTIxMzUyMzJaFw0yOTAyMDkxMzUyMzJaMIHH
+MQswCQYDVQQGEwJOTDELMAkGA1UECAwCT1YxFjAUBgNVBAcMDUxvY2FsaXR5IE5h
+bWUxITAfBgNVBAsMGE9yZ2FuaXphdGlvbmFsIFVuaXQgTmFtZTEgMB4GA1UECgwX
+RXhhbXBsZSBDQSBPcmdhbml6YXRpb24xHzAdBgNVBAMMFkV4YW1wbGUgUGVybWlz
+c2lvbnMgQ0ExLTArBgkqhkiG9w0BCQEWHmF1dGhvcml0eUBwZXJtaXNzaW9uc2Nh
+bHRkLm9yZzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAKD6nYCszMha
+h3xGfJy8f3lowPHIj6zcldVYs5Krg7zXxZn+20lAMHUfgQcWZAauKbCnokYfTvXV
+v0j9HCpQ3mRynNTyjLjc7HxAe6kfaJ75PoIoOMMQMEGvPOqRUq0tomVVJvcgzZZk
+pwE30E6xvZrlQcrkQY/aOQ0sbje+RN8RKQ9vf6O45Np/0m2K5ohZPlBqg4F539v2
+iXGZczCr9AqAszc/7rOPX1aqZmmRDou0T+Zhx3ZZSAwZYQtr7uvvlUeGmDhNh+8p
+LC+1FQPtkKmcVXO8oZWm5N8piOvH3M+v3qhyPtLv30cpl0bDiFl+PN7nZ6InOOtd
+ZJVMa2rYCk8CAwEAAaNQME4wHQYDVR0OBBYEFA/CtiP8Z5Fk4aWDIb2j3FPwh9pg
+MB8GA1UdIwQYMBaAFA/CtiP8Z5Fk4aWDIb2j3FPwh9pgMAwGA1UdEwQFMAMBAf8w
+DQYJKoZIhvcNAQELBQADggEBACBupRddIR9zYBFLGFTzeiW+H1tRRKz+B3SWnCJH
+89ijEdMYlKKLYT0R18lCV0vHnl29bU1CPlkLn+GQkvdfIjKguWEQKTP+GLzoa9TV
+zOKAJ8NttCyW3YqriUOUGKqra1Fdt8nvrAyZUF+v/k8pTInmCvwu3l5HrVhkKHER
+IbCIohKi/2mk1JZS9reWvZhqLoUIw5IDFlqtBDYOfMaqm8XF01YjEDBM6OuyQzYN
+gDFVUZx0At4zzRjGTvqpLTkDYL1A3v4QYXZcwZiKeEVbFuNkauXgD+8pEZMB8yL4
+h1feIH+aucsAKBz1Ne5fTiTCannlKvLl8xWz5IdzP7gF0LIxggLoMIIC5AIBATCB
+1TCBxzELMAkGA1UEBhMCTkwxCzAJBgNVBAgMAk9WMRYwFAYDVQQHDA1Mb2NhbGl0
+eSBOYW1lMSEwHwYDVQQLDBhPcmdhbml6YXRpb25hbCBVbml0IE5hbWUxIDAeBgNV
+BAoMF0V4YW1wbGUgQ0EgT3JnYW5pemF0aW9uMR8wHQYDVQQDDBZFeGFtcGxlIFBl
+cm1pc3Npb25zIENBMS0wKwYJKoZIhvcNAQkBFh5hdXRob3JpdHlAcGVybWlzc2lv
+bnNjYWx0ZC5vcmcCCQDN8gLVC3GhCDANBglghkgBZQMEAgEFAKCB5DAYBgkqhkiG
+9w0BCQMxCwYJKoZIhvcNAQcBMBwGCSqGSIb3DQEJBTEPFw0xOTEyMDcxNjAxMjZa
+MC8GCSqGSIb3DQEJBDEiBCAX5wSM0Og83gWKRmru9iCOm8h85e9oZ7rBebmSbLVN
+1TB5BgkqhkiG9w0BCQ8xbDBqMAsGCWCGSAFlAwQBKjALBglghkgBZQMEARYwCwYJ
+YIZIAWUDBAECMAoGCCqGSIb3DQMHMA4GCCqGSIb3DQMCAgIAgDANBggqhkiG9w0D
+AgIBQDAHBgUrDgMCBzANBggqhkiG9w0DAgIBKDANBgkqhkiG9w0BAQEFAASCAQAT
+QZbljrtQs/FcBUJBYoenquAQ5++twy5LE6A06dASaHFDxSxPsAe0KBl9EWJzE59X
+4k73u+4bJZiuLHUPztuXIUt3gEKM72DDT+ET/13dWdM2vtITW6HZ27nvkngE35cc
+kdUqkLyeM5dzsSDpr3Ba8epulThlwl7bw9dUd2FUOBCc266da+q1lcChjwfC5GBu
+GB7oWODhSAk6L9dici8w5q9ybygBkFJHXTZVtsXQWuNmDtXWB2ury++WQlvtNK0s
+aF+dtQlyEx2vvi5tV195vncAt514uHJ9optdEbaIyMo51G53QD0Cq62QhuFusug0
+nz2pgcEZ35JCd4gESMkL
+
+------51AB97062CF028E6EBDDAA31699954BC--
+
diff --git a/src/security/builtin_plugins/tests/listeners_authentication/etc/Example_Permissions_Bob.p7s b/src/security/builtin_plugins/tests/listeners_authentication/etc/Example_Permissions_Bob.p7s
new file mode 100644
index 0000000..f5ab923
--- /dev/null
+++ b/src/security/builtin_plugins/tests/listeners_authentication/etc/Example_Permissions_Bob.p7s
@@ -0,0 +1,98 @@
+MIME-Version: 1.0
+Content-Type: multipart/signed; protocol="application/x-pkcs7-signature"; micalg="sha-256"; boundary="----EDFB3CE1089204FED046E2D32968C669"
+
+This is an S/MIME signed message
+
+------EDFB3CE1089204FED046E2D32968C669
+Content-Type: text/plain
+
+<?xml version="1.0" encoding="utf-8"?>
+<dds xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xsi:noNamespaceSchemaLocation="https://www.omg.org/spec/DDS-SECURITY/20170901/omg_shared_ca_permissions.xsd">
+    <permissions>
+        <grant name="OpenSplicePermissions">
+            <subject_name>/C=NL/ST=OV/L=Locality Name/OU=Organizational Unit Name/O=Example Organization/CN=Bob Example/emailAddress=bob@exampleltd.com</subject_name>
+            <validity>
+                <!-- Format is CCYY-MM-DDThh:mm:ss[Z|(+|-)hh:mm] in GMT -->
+                <not_before>2015-09-15T01:00:00</not_before>
+                <not_after>2115-09-15T01:00:00</not_after>
+            </validity>
+            <allow_rule>
+                <domains>
+                  <id_range>
+                    <min>0</min>
+                    <max>230</max>
+                  </id_range>
+                </domains>
+                <publish>
+                    <topics>
+                        <topic>*</topic>
+                    </topics>
+                    <partitions>
+                        <partition>*</partition>
+                    </partitions>
+                </publish>
+                <subscribe>
+                    <topics>
+                        <topic>*</topic>
+                    </topics>
+                    <partitions>
+                        <partition>*</partition>
+                    </partitions>
+                    
+                </subscribe>
+            </allow_rule>
+            <default>DENY</default>
+        </grant>
+    </permissions>
+</dds>
+
+------EDFB3CE1089204FED046E2D32968C669
+Content-Type: application/x-pkcs7-signature; name="smime.p7s"
+Content-Transfer-Encoding: base64
+Content-Disposition: attachment; filename="smime.p7s"
+
+MIIHiwYJKoZIhvcNAQcCoIIHfDCCB3gCAQExDzANBglghkgBZQMEAgEFADALBgkq
+hkiG9w0BBwGgggRnMIIEYzCCA0ugAwIBAgIJAM3yAtULcaEIMA0GCSqGSIb3DQEB
+CwUAMIHHMQswCQYDVQQGEwJOTDELMAkGA1UECAwCT1YxFjAUBgNVBAcMDUxvY2Fs
+aXR5IE5hbWUxITAfBgNVBAsMGE9yZ2FuaXphdGlvbmFsIFVuaXQgTmFtZTEgMB4G
+A1UECgwXRXhhbXBsZSBDQSBPcmdhbml6YXRpb24xHzAdBgNVBAMMFkV4YW1wbGUg
+UGVybWlzc2lvbnMgQ0ExLTArBgkqhkiG9w0BCQEWHmF1dGhvcml0eUBwZXJtaXNz
+aW9uc2NhbHRkLm9yZzAeFw0xOTAyMTIxMzUyMzJaFw0yOTAyMDkxMzUyMzJaMIHH
+MQswCQYDVQQGEwJOTDELMAkGA1UECAwCT1YxFjAUBgNVBAcMDUxvY2FsaXR5IE5h
+bWUxITAfBgNVBAsMGE9yZ2FuaXphdGlvbmFsIFVuaXQgTmFtZTEgMB4GA1UECgwX
+RXhhbXBsZSBDQSBPcmdhbml6YXRpb24xHzAdBgNVBAMMFkV4YW1wbGUgUGVybWlz
+c2lvbnMgQ0ExLTArBgkqhkiG9w0BCQEWHmF1dGhvcml0eUBwZXJtaXNzaW9uc2Nh
+bHRkLm9yZzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAKD6nYCszMha
+h3xGfJy8f3lowPHIj6zcldVYs5Krg7zXxZn+20lAMHUfgQcWZAauKbCnokYfTvXV
+v0j9HCpQ3mRynNTyjLjc7HxAe6kfaJ75PoIoOMMQMEGvPOqRUq0tomVVJvcgzZZk
+pwE30E6xvZrlQcrkQY/aOQ0sbje+RN8RKQ9vf6O45Np/0m2K5ohZPlBqg4F539v2
+iXGZczCr9AqAszc/7rOPX1aqZmmRDou0T+Zhx3ZZSAwZYQtr7uvvlUeGmDhNh+8p
+LC+1FQPtkKmcVXO8oZWm5N8piOvH3M+v3qhyPtLv30cpl0bDiFl+PN7nZ6InOOtd
+ZJVMa2rYCk8CAwEAAaNQME4wHQYDVR0OBBYEFA/CtiP8Z5Fk4aWDIb2j3FPwh9pg
+MB8GA1UdIwQYMBaAFA/CtiP8Z5Fk4aWDIb2j3FPwh9pgMAwGA1UdEwQFMAMBAf8w
+DQYJKoZIhvcNAQELBQADggEBACBupRddIR9zYBFLGFTzeiW+H1tRRKz+B3SWnCJH
+89ijEdMYlKKLYT0R18lCV0vHnl29bU1CPlkLn+GQkvdfIjKguWEQKTP+GLzoa9TV
+zOKAJ8NttCyW3YqriUOUGKqra1Fdt8nvrAyZUF+v/k8pTInmCvwu3l5HrVhkKHER
+IbCIohKi/2mk1JZS9reWvZhqLoUIw5IDFlqtBDYOfMaqm8XF01YjEDBM6OuyQzYN
+gDFVUZx0At4zzRjGTvqpLTkDYL1A3v4QYXZcwZiKeEVbFuNkauXgD+8pEZMB8yL4
+h1feIH+aucsAKBz1Ne5fTiTCannlKvLl8xWz5IdzP7gF0LIxggLoMIIC5AIBATCB
+1TCBxzELMAkGA1UEBhMCTkwxCzAJBgNVBAgMAk9WMRYwFAYDVQQHDA1Mb2NhbGl0
+eSBOYW1lMSEwHwYDVQQLDBhPcmdhbml6YXRpb25hbCBVbml0IE5hbWUxIDAeBgNV
+BAoMF0V4YW1wbGUgQ0EgT3JnYW5pemF0aW9uMR8wHQYDVQQDDBZFeGFtcGxlIFBl
+cm1pc3Npb25zIENBMS0wKwYJKoZIhvcNAQkBFh5hdXRob3JpdHlAcGVybWlzc2lv
+bnNjYWx0ZC5vcmcCCQDN8gLVC3GhCDANBglghkgBZQMEAgEFAKCB5DAYBgkqhkiG
+9w0BCQMxCwYJKoZIhvcNAQcBMBwGCSqGSIb3DQEJBTEPFw0xOTEyMDcxNjAxMjZa
+MC8GCSqGSIb3DQEJBDEiBCCEqUh7CpMRXpSMDeuCmSMz+I6WXjXpO2HRkCdRSczj
+1TB5BgkqhkiG9w0BCQ8xbDBqMAsGCWCGSAFlAwQBKjALBglghkgBZQMEARYwCwYJ
+YIZIAWUDBAECMAoGCCqGSIb3DQMHMA4GCCqGSIb3DQMCAgIAgDANBggqhkiG9w0D
+AgIBQDAHBgUrDgMCBzANBggqhkiG9w0DAgIBKDANBgkqhkiG9w0BAQEFAASCAQAL
+ExoTydhBE/8GgnqGp39cRVQ0Z1YIc55uACZK1V37R2b8rY4upLA7iHyzCBXQOwCz
+mhjHfaNdW8twWru34EvD17RTfk49Lvmge4ceipgmqKwGVyTO57P5xzDaC+2F2KEi
++s6/YWIslixMhlQyuxZsmQDbRWcmQ1FRy7LJ80cctlDA44IviaEfv/u2+sqJgPNL
+Z5AHMEv/qceKjtm/Wh7sdFhjfM4ZnfUWFB6Ni/sdNSmO9O3j9OHfpkzMJHxM4B5r
+G5pMNDn2xibxwlx41he7mfENIjuk4Z3VDaTCTs++8GyivvvsCZSVimd0iuI1kVmd
+JL58DFeKqgEZ358rN9/5
+
+------EDFB3CE1089204FED046E2D32968C669--
+
diff --git a/src/security/builtin_plugins/tests/listeners_authentication/etc/Identity_CA_Cert.pem b/src/security/builtin_plugins/tests/listeners_authentication/etc/Identity_CA_Cert.pem
new file mode 100644
index 0000000..cce5c91
--- /dev/null
+++ b/src/security/builtin_plugins/tests/listeners_authentication/etc/Identity_CA_Cert.pem
@@ -0,0 +1,25 @@
+-----BEGIN CERTIFICATE-----
+MIIEOTCCAyGgAwIBAgIJAPq0b61+PT2WMA0GCSqGSIb3DQEBCwUAMIGyMQswCQYD
+VQQGEwJOTDELMAkGA1UECAwCT1YxFjAUBgNVBAcMDUxvY2FsaXR5IE5hbWUxITAf
+BgNVBAsMGE9yZ2FuaXphdGlvbmFsIFVuaXQgTmFtZTEaMBgGA1UECgwRRXhhbXBs
+ZSBTaWduZXIgQ0ExEzARBgNVBAMMCkV4YW1wbGUgQ0ExKjAoBgkqhkiG9w0BCQEW
+G2F1dGhvcml0eUBpZGVudGl0eWNhbHRkLm9yZzAeFw0xOTAyMTIxMDIxNTJaFw0y
+OTAyMDkxMDIxNTJaMIGyMQswCQYDVQQGEwJOTDELMAkGA1UECAwCT1YxFjAUBgNV
+BAcMDUxvY2FsaXR5IE5hbWUxITAfBgNVBAsMGE9yZ2FuaXphdGlvbmFsIFVuaXQg
+TmFtZTEaMBgGA1UECgwRRXhhbXBsZSBTaWduZXIgQ0ExEzARBgNVBAMMCkV4YW1w
+bGUgQ0ExKjAoBgkqhkiG9w0BCQEWG2F1dGhvcml0eUBpZGVudGl0eWNhbHRkLm9y
+ZzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAKCBJ1r/2AcSHorpA2G2
+WR0CvGHPhhY2x93twW91LCJVOVzO0LuOscZXSkWDtAhyhy1EZN6r+4aLbMku/wVJ
+kdjHPD+WSVEZn70LxYSgxiUwXalpa5RQeTkEHll5cSgtE8kSD4/HIxBsbwizeDVV
+g8SWpBVb044GM4O3TDbCug9F7GJFzqcbSHQZnHO+3nWu6f21BEU7PZjrFox1NREN
+g3H7WmNISx4DOK9bJcWS/i4qJjTxjQPPFmzGvRgO2FfWP+xYb70x/iOeKsML2y+d
+XZqL99yzfP1dnpDtBzCTqJJizfuNMD6gvIXyk2PUy3FpAYoI9BvUehdWCP/okikx
+5jsCAwEAAaNQME4wHQYDVR0OBBYEFL7LTHLvMsEeUDjMYeW4+DcXn62PMB8GA1Ud
+IwQYMBaAFL7LTHLvMsEeUDjMYeW4+DcXn62PMAwGA1UdEwQFMAMBAf8wDQYJKoZI
+hvcNAQELBQADggEBAIDJ4g6aVGIVXDSQ5R2yY9I82zsRf3k+yRF/BBkqBP1XXYRA
+6lk7Wk4y6+DmL9qbVG/xrkTCC066J8kVblOyfFP1LHAzlNOQE7aU+tyrAufW4fpz
+f/Gv8PBQUTQGr8vNqLUuEdoQjzARm8g7L3qeXhIKjiWsWi99ibnm/jTjol1GleIX
+RudKSSGyMcB2VgRjCEEIYrkXdkIfrznKcJxzUw3dsGx277dB+4iFLcqf1YDpoRe2
+aSwbtgx+lLZ4KXWtikBSmLSRBq9j2aGtKO08kru0U3jQo6B4Bvzp1KuJCBiktueY
+yNRfgh8ggNERYF/SpVr/ivm3RM+mnWd3QpmVolw=
+-----END CERTIFICATE-----
diff --git a/src/security/builtin_plugins/tests/listeners_authentication/etc/Identity_CA_Private_Key.pem b/src/security/builtin_plugins/tests/listeners_authentication/etc/Identity_CA_Private_Key.pem
new file mode 100644
index 0000000..16bfbf7
--- /dev/null
+++ b/src/security/builtin_plugins/tests/listeners_authentication/etc/Identity_CA_Private_Key.pem
@@ -0,0 +1,27 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIIEpAIBAAKCAQEAoIEnWv/YBxIeiukDYbZZHQK8Yc+GFjbH3e3Bb3UsIlU5XM7Q
+u46xxldKRYO0CHKHLURk3qv7hotsyS7/BUmR2Mc8P5ZJURmfvQvFhKDGJTBdqWlr
+lFB5OQQeWXlxKC0TyRIPj8cjEGxvCLN4NVWDxJakFVvTjgYzg7dMNsK6D0XsYkXO
+pxtIdBmcc77eda7p/bUERTs9mOsWjHU1EQ2DcftaY0hLHgM4r1slxZL+LiomNPGN
+A88WbMa9GA7YV9Y/7FhvvTH+I54qwwvbL51dmov33LN8/V2ekO0HMJOokmLN+40w
+PqC8hfKTY9TLcWkBigj0G9R6F1YI/+iSKTHmOwIDAQABAoIBAAc5iRH5jjnTQPiz
+wGk3kg9SPjSQ6NI7KQf+WcSwm4n4GBrrXE31AF+TMk6qvQHcVeVdvMShLTNDN2Re
+7y/Hvf7qCPY7x5UU+DHEQ+HSctjdsnmbuzHz5WEBpHQWmVdboBZe78BjEFr+5oiX
+u4N7E/FXbo9fkMhF0y/MomucnE9vnhFsCj/Qz+gqKJDz7n+jY1G9loGJpoZoGllK
+s2+HzbY5qVKrrpDzD5FO5i+M/Obk4uwZVDSnFL316SKe9MzdlrH9ochdtsGlver8
+YsYtetqHy4QgE/WZLSgwQoYY7nlKnkAKUnGvTJ8pnmO2FkO9SAQsBIl32rURMQFY
+2C7ka5ECgYEAz13hOWwsefCkMTpXOXpeagCACN86Oqel+gV+UYDWnRdwDrUKBhjA
+u40+NVaxuJSNKV3mC0N2PxwTuYzQ6BOQgmNzlxv0xyKwkGW/d6F8VunV2mqb3EAL
+m9qzN1k08V30RikSMCt1OV5isuUiC4ox3ToboLTibXKnbEFWjT3juM8CgYEAxiW0
++CvqJQjrjJ/valshCQDF4fYLa2uTJcdDifyU3HVTn06yy0z42tLBhHCv8RY/SBRK
+IqR3RDhYJbBgLhG7oBDvoGWUEhdGJ+z6qcw9v1tDj9QD1bQF7RJvuh2JA7mhbFe5
+cIptcDJNRN7PCrjqGksQfy8Gg6ABOGFhz3xZPtUCgYBeFpKio1pq2a0mSPpashM0
+tZVicSbShk7g6q0t/e9ix8eoZKxvp7uLXcLkILnyrjR+mIRQiAOXDv5EKoh/RKFF
+CCriXWTrFepXGlONzE/Gf8Lwn36oqMabqNe4PVmwSpkTXH9MK+u8Y/8UfLK92a5W
+Wo8+k9RJJMSiceL7oyE4MQKBgQCkVg2bbkCJaraBMPxNxzrEzsFPwNKDyvqFcJhR
+TwzfMuehzpF3D2WthvI8t4EUgJEHZNx/ksvf5qMkzv1V+BsWjDVRYC3IO0lSP7c9
+MEld9YE5PmvXx7DKiGnlgC1sy35X7wG7lvNhBDcVkX1BtU9jczJBaW0LqZ6Zdhq7
+DLSv6QKBgQDNZpHEwi2P2LdlTRgbc4IWYjZZJaj+RrG881lgi+v8SI4E8eizlxLw
+9HlG1nydvRqtU3T5h8UuqLOlXbfvQ7GOxVO2uJjtjJHZ8KbsFUH5i3UwZ+llyrRW
+Y1ydvvE9Hux6I7I3L42J11jphNYKw/YwARkp8/Bc/wzKsGlnh3Oh+w==
+-----END RSA PRIVATE KEY-----
diff --git a/src/security/builtin_plugins/tests/listeners_authentication/etc/Permissions_CA_Cert.pem b/src/security/builtin_plugins/tests/listeners_authentication/etc/Permissions_CA_Cert.pem
new file mode 100644
index 0000000..7420bc4
--- /dev/null
+++ b/src/security/builtin_plugins/tests/listeners_authentication/etc/Permissions_CA_Cert.pem
@@ -0,0 +1,26 @@
+-----BEGIN CERTIFICATE-----
+MIIEYzCCA0ugAwIBAgIJAM3yAtULcaEIMA0GCSqGSIb3DQEBCwUAMIHHMQswCQYD
+VQQGEwJOTDELMAkGA1UECAwCT1YxFjAUBgNVBAcMDUxvY2FsaXR5IE5hbWUxITAf
+BgNVBAsMGE9yZ2FuaXphdGlvbmFsIFVuaXQgTmFtZTEgMB4GA1UECgwXRXhhbXBs
+ZSBDQSBPcmdhbml6YXRpb24xHzAdBgNVBAMMFkV4YW1wbGUgUGVybWlzc2lvbnMg
+Q0ExLTArBgkqhkiG9w0BCQEWHmF1dGhvcml0eUBwZXJtaXNzaW9uc2NhbHRkLm9y
+ZzAeFw0xOTAyMTIxMzUyMzJaFw0yOTAyMDkxMzUyMzJaMIHHMQswCQYDVQQGEwJO
+TDELMAkGA1UECAwCT1YxFjAUBgNVBAcMDUxvY2FsaXR5IE5hbWUxITAfBgNVBAsM
+GE9yZ2FuaXphdGlvbmFsIFVuaXQgTmFtZTEgMB4GA1UECgwXRXhhbXBsZSBDQSBP
+cmdhbml6YXRpb24xHzAdBgNVBAMMFkV4YW1wbGUgUGVybWlzc2lvbnMgQ0ExLTAr
+BgkqhkiG9w0BCQEWHmF1dGhvcml0eUBwZXJtaXNzaW9uc2NhbHRkLm9yZzCCASIw
+DQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAKD6nYCszMhah3xGfJy8f3lowPHI
+j6zcldVYs5Krg7zXxZn+20lAMHUfgQcWZAauKbCnokYfTvXVv0j9HCpQ3mRynNTy
+jLjc7HxAe6kfaJ75PoIoOMMQMEGvPOqRUq0tomVVJvcgzZZkpwE30E6xvZrlQcrk
+QY/aOQ0sbje+RN8RKQ9vf6O45Np/0m2K5ohZPlBqg4F539v2iXGZczCr9AqAszc/
+7rOPX1aqZmmRDou0T+Zhx3ZZSAwZYQtr7uvvlUeGmDhNh+8pLC+1FQPtkKmcVXO8
+oZWm5N8piOvH3M+v3qhyPtLv30cpl0bDiFl+PN7nZ6InOOtdZJVMa2rYCk8CAwEA
+AaNQME4wHQYDVR0OBBYEFA/CtiP8Z5Fk4aWDIb2j3FPwh9pgMB8GA1UdIwQYMBaA
+FA/CtiP8Z5Fk4aWDIb2j3FPwh9pgMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEL
+BQADggEBACBupRddIR9zYBFLGFTzeiW+H1tRRKz+B3SWnCJH89ijEdMYlKKLYT0R
+18lCV0vHnl29bU1CPlkLn+GQkvdfIjKguWEQKTP+GLzoa9TVzOKAJ8NttCyW3Yqr
+iUOUGKqra1Fdt8nvrAyZUF+v/k8pTInmCvwu3l5HrVhkKHERIbCIohKi/2mk1JZS
+9reWvZhqLoUIw5IDFlqtBDYOfMaqm8XF01YjEDBM6OuyQzYNgDFVUZx0At4zzRjG
+TvqpLTkDYL1A3v4QYXZcwZiKeEVbFuNkauXgD+8pEZMB8yL4h1feIH+aucsAKBz1
+Ne5fTiTCannlKvLl8xWz5IdzP7gF0LI=
+-----END CERTIFICATE-----
diff --git a/src/security/builtin_plugins/tests/listeners_authentication/src/listeners_authentication_utests.c b/src/security/builtin_plugins/tests/listeners_authentication/src/listeners_authentication_utests.c
new file mode 100644
index 0000000..a039d25
--- /dev/null
+++ b/src/security/builtin_plugins/tests/listeners_authentication/src/listeners_authentication_utests.c
@@ -0,0 +1,2105 @@
+/** @file qos_utests.c
+ *  @brief Unit tests for qos APIs
+ *
+ */
+/* CUnit includes. */
+#include "CUnit/CUnit.h"
+#include "CUnit/Test.h"
+
+#include <assert.h>
+
+/* Test helper includes. */
+#include "common/src/loader.h"
+
+#include "config_env.h"
+
+#include "dds/ddsrt/time.h"
+#include "dds/security/dds_security_api.h"
+#include "dds/security/dds_security_api_authentication.h"
+#include "dds/ddsrt/heap.h"
+#include "dds/ddsrt/string.h"
+#include "dds/ddsrt/misc.h"
+#include "dds/ddsrt/endian.h"
+#include "dds/ddsrt/io.h"
+#include "dds/security/core/dds_security_serialize.h"
+#include "dds/security/core/dds_security_utils.h"
+
+#include <openssl/pem.h>
+#include <openssl/pkcs7.h>
+#include <openssl/err.h>
+#include <openssl/bio.h>
+#include <openssl/x509v3.h>
+#include <openssl/opensslv.h>
+#include <openssl/sha.h>
+#include <openssl/x509.h>
+#include <openssl/pem.h>
+
+
+#if OPENSSL_VERSION_NUMBER >= 0x1000200fL
+#define AUTH_INCLUDE_EC
+#include <openssl/ec.h>
+#if OPENSSL_VERSION_NUMBER >= 0x10100000L
+#define AUTH_INCLUDE_DH_ACCESSORS
+#endif
+#else
+#error "version not found"
+#endif
+
+
+static const char * ACCESS_PERMISSIONS_TOKEN_ID     = "DDS:Access:Permissions:1.0";
+static const char * AUTH_PROTOCOL_CLASS_ID          = "DDS:Auth:PKI-DH:1.0";
+
+static const char * PROPERTY_IDENTITY_CA            = "dds.sec.auth.identity_ca";
+static const char * PROPERTY_PRIVATE_KEY            = "dds.sec.auth.private_key";
+static const char * PROPERTY_IDENTITY_CERT          = "dds.sec.auth.identity_certificate";
+static const char * PROPERTY_PERMISSIONS_CA         = "dds.sec.access.permissions_ca";
+static const char * PROPERTY_PERMISSIONS            = "dds.sec.access.permissions";
+static const char * PROPERTY_GOVERNANCE             = "dds.sec.access.governance";
+
+static const char * PROPERTY_PERMISSIONS_CA_SN      = "dds.perm_ca.sn";
+static const char * PROPERTY_PERMISSIONS_CA_ALGO    = "dds.perm_ca.algo";
+static const char * PROPERTY_C_ID                   = "c.id";
+static const char * PROPERTY_C_PERM                 = "c.perm";
+
+
+static const char * SUBJECT_NAME_PERMISSIONS_CA     = "/C=NL/ST=OV/L=Locality Name/OU=Organizational Unit Name/O=Example Signer CA/CN=Example CA/emailAddress=authority@identitycaltd.org";
+static const char * RSA_2048_ALGORITHM_NAME         = "RSA-2048";
+
+static const char * PERMISSIONS_CA_CERT_FILE             = "Permissions_CA_Cert.pem";
+static const char * ALICE_PERMISSIONS_FILE             = "Example_Permissions_Alice.p7s";
+static const char * BOB_PERMISSIONS_FILE             = "Example_Permissions_Bob.p7s";
+static const char * ALICE_IDENTITY_CERT_FILE        = "Example_Alice_Cert.pem";
+static const char * BOB_IDENTITY_CERT_FILE          = "Example_Bob_Cert.pem";
+static const char * AUTH_DSIGN_ALGO_RSA_NAME   = "RSASSA-PSS-SHA256";
+static const char * AUTH_KAGREE_ALGO_ECDH_NAME = "ECDH+prime256v1-CEUM";
+static DDS_Security_PermissionsHandle remote_permissions_handle = DDS_SECURITY_HANDLE_NIL;
+static dds_security_authentication_listener auth_listener;
+static dds_security_access_control_listener access_control_listener;
+
+#define IDENTITY_CA_FILE "Identity_CA_Cert.pem"
+#define IDENTITY_CA_KEY_FILE "Identity_CA_Private_Key.pem"
+
+static const char *identity_ca =/*Identity_CA_Cert.pem*/
+        "data:,-----BEGIN CERTIFICATE-----\n"
+        "MIIEOTCCAyGgAwIBAgIJAPq0b61+PT2WMA0GCSqGSIb3DQEBCwUAMIGyMQswCQYD\n"
+        "VQQGEwJOTDELMAkGA1UECAwCT1YxFjAUBgNVBAcMDUxvY2FsaXR5IE5hbWUxITAf\n"
+        "BgNVBAsMGE9yZ2FuaXphdGlvbmFsIFVuaXQgTmFtZTEaMBgGA1UECgwRRXhhbXBs\n"
+        "ZSBTaWduZXIgQ0ExEzARBgNVBAMMCkV4YW1wbGUgQ0ExKjAoBgkqhkiG9w0BCQEW\n"
+        "G2F1dGhvcml0eUBpZGVudGl0eWNhbHRkLm9yZzAeFw0xOTAyMTIxMDIxNTJaFw0y\n"
+        "OTAyMDkxMDIxNTJaMIGyMQswCQYDVQQGEwJOTDELMAkGA1UECAwCT1YxFjAUBgNV\n"
+        "BAcMDUxvY2FsaXR5IE5hbWUxITAfBgNVBAsMGE9yZ2FuaXphdGlvbmFsIFVuaXQg\n"
+        "TmFtZTEaMBgGA1UECgwRRXhhbXBsZSBTaWduZXIgQ0ExEzARBgNVBAMMCkV4YW1w\n"
+        "bGUgQ0ExKjAoBgkqhkiG9w0BCQEWG2F1dGhvcml0eUBpZGVudGl0eWNhbHRkLm9y\n"
+        "ZzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAKCBJ1r/2AcSHorpA2G2\n"
+        "WR0CvGHPhhY2x93twW91LCJVOVzO0LuOscZXSkWDtAhyhy1EZN6r+4aLbMku/wVJ\n"
+        "kdjHPD+WSVEZn70LxYSgxiUwXalpa5RQeTkEHll5cSgtE8kSD4/HIxBsbwizeDVV\n"
+        "g8SWpBVb044GM4O3TDbCug9F7GJFzqcbSHQZnHO+3nWu6f21BEU7PZjrFox1NREN\n"
+        "g3H7WmNISx4DOK9bJcWS/i4qJjTxjQPPFmzGvRgO2FfWP+xYb70x/iOeKsML2y+d\n"
+        "XZqL99yzfP1dnpDtBzCTqJJizfuNMD6gvIXyk2PUy3FpAYoI9BvUehdWCP/okikx\n"
+        "5jsCAwEAAaNQME4wHQYDVR0OBBYEFL7LTHLvMsEeUDjMYeW4+DcXn62PMB8GA1Ud\n"
+        "IwQYMBaAFL7LTHLvMsEeUDjMYeW4+DcXn62PMAwGA1UdEwQFMAMBAf8wDQYJKoZI\n"
+        "hvcNAQELBQADggEBAIDJ4g6aVGIVXDSQ5R2yY9I82zsRf3k+yRF/BBkqBP1XXYRA\n"
+        "6lk7Wk4y6+DmL9qbVG/xrkTCC066J8kVblOyfFP1LHAzlNOQE7aU+tyrAufW4fpz\n"
+        "f/Gv8PBQUTQGr8vNqLUuEdoQjzARm8g7L3qeXhIKjiWsWi99ibnm/jTjol1GleIX\n"
+        "RudKSSGyMcB2VgRjCEEIYrkXdkIfrznKcJxzUw3dsGx277dB+4iFLcqf1YDpoRe2\n"
+        "aSwbtgx+lLZ4KXWtikBSmLSRBq9j2aGtKO08kru0U3jQo6B4Bvzp1KuJCBiktueY\n"
+        "yNRfgh8ggNERYF/SpVr/ivm3RM+mnWd3QpmVolw=\n"
+        "-----END CERTIFICATE-----\n";
+
+static const char *alice_private_key =
+        "data:,-----BEGIN RSA PRIVATE KEY-----\n"
+        "MIIEpAIBAAKCAQEA0Vn9YYllmrC/VVkxWFq6TzsmWn/niMydsE0hhm4Eam00gw3v\n"
+        "M4xScvBexI0td6tbStnWKz8vBiSVtWY1GDX8ICCBDufJcNIypu9L3DsjBoVTpcjx\n"
+        "XmfSpcxsepNaS7IqFPoRd+J+tzrl5qUR0Q52ObI02csp6CwecL8CvfXfc02U+tpP\n"
+        "b7iSsT/AcCeAAc10vdSXtnfcOGVLwy+D527kNr5r2VhE2FYdWbrGSOj8hw5eUfRs\n"
+        "KpnWlermWy1wzYfmMqkIII1hhY1sRDmMDrLpFeiYkf9B/7HQF+R2tFFFok1dYVpg\n"
+        "ZiZUNkONQnDQueThypzu3XB/PwHExILZnBwEtwIDAQABAoIBAHEVxCoQtuKlgOUQ\n"
+        "hfgtIiC0WdZe6unZZYCbWXWtLhNzI/964nAc51iRAQ/5Fstis7CuFONNgRA3aOsQ\n"
+        "57NJTgToqe4sRIL9+EB2WKsBAr19/Z46+i69tGq9DwfzWr4y4kpsfk0c+sftN8yr\n"
+        "9ADSaAhoe+X9uYhhdJwAgfGsw+Qa1BLM5jEexjcLwy1kqXwWKNHrPWU7NW40bPhV\n"
+        "Ne/UguklSp43sKoB1esTgRZe+OlQDCsQoXpyjtPYcKzF3Ion6e5rT8xQ1IkAtLTf\n"
+        "QJJTGMJGCguXxuDo2VRaa5pwbdRAamp63wD0IAPAf+ClCz4JLwOnOYsgSCZoY3l3\n"
+        "3GxWDAkCgYEA/scs7Ft50QOicnJ/DoCjxmpjba0hiqxbz0qAdCyl1llogUKuyCS7\n"
+        "sxQQvVTt6jk3gP0UYa3FJREToIGZuqaEu6qdY4GI61woNN5hXbkJC6G3FXI/VB8v\n"
+        "Actkas0kp6J8YWsmTqnsihE5Yii0WCBn+AnIpoU3S2N9WT7U8eA6B7sCgYEA0lsJ\n"
+        "xqB6NCkKbr+E+V0CGp+S+7zH5dxZtAhDPSKwy2kCYWtDlSVhAzXabTIzF2SW9tJQ\n"
+        "JV3FhRfiCWTBrBm/I7AmNbNtXnrexYyXPVBhN6uqzYCB8fcLy+HPNZYF3KtQtU3c\n"
+        "WxAyO6ZxSLgtcP3UB6J8Ac6CYB25cRWNsnrvETUCgYA1HpHfNbNQQNG9yuFyxJ9g\n"
+        "3w2b8Fzt7MG3lnDxx91Ls5h2WtDWKdJ4o9ZZozt3ejZ4TkvRkclo0QamkF7c65sB\n"
+        "BbGK7Zb+e1hmrXbfc5TPOAhUEF3jzByg4ycsnVjnGpmUNiLmg8ctginUrWfsd9U1\n"
+        "gdSz41KEBVo9ITyEsZtnwQKBgQCOgIfd3CcNIORlZC8D8wMS4BllmlzdFepa8OIE\n"
+        "D3UvR2MKdezho+HVl+zx3nkIFufCK3WJ6r19TVGeRXiCSyrWVWV9KaEkyR4TPAvU\n"
+        "yJgja5MZBj6BmXePVdjWl1w/Qns5Z5aoxg8Ro87IkaSPEBVMWsGhQ7HExT40IoLM\n"
+        "b0V3JQKBgQCnZRrzaY9xOy72rtyacWjQB2QxnmkZgwDUq0iQwU/EdP72fPV/TtG8\n"
+        "PxQqKVPM57XO7qDbyKBt9L3vvmkiC0bABlcMN7UX9H5cHGhnJn6+6muitJlxmtvU\n"
+        "IiwlYmN2hcA52Ft9cRVC8+8W6Knx019vBnJozjhzhy7wxwqggmxsxg==\n"
+        "-----END RSA PRIVATE KEY-----\n";
+
+static const char *bob_private_key =
+        "-----BEGIN RSA PRIVATE KEY-----\n"
+        "MIIEogIBAAKCAQEA5Piv5VnOqg9vAWXGrdxH2Ax1svypJNVmNUlM95qGQloeJQPk\n"
+        "jSzAEHIBVYAE0eU5gHL3l9EI2mw/bVLsT/REXipj9STPN9NYOVNH2yeD8+KHWNXX\n"
+        "miTYJ5YjHP9GHDdKiZ52dn7BYktqUlghlxuY0pjWrqhnNkcJep7YZq4QTbCQcyUV\n"
+        "l+9v+lE6/DuSG5K1KNRCQmmnRVjdWmGQogrW8eZ1xNFwHJuZYgKP/q7ieQSYI+YR\n"
+        "Mrt1pScjj6FjdL5OMYShrBO7OBYrwDjMnpmox9omF+1S1Gmi1y03b3m1COKX4lID\n"
+        "Qpc7gvpwq02ZozEX+kfIs0Ua8EKbVgi23V/2OQIDAQABAoIBACXLry1Kr8R+m7I9\n"
+        "XJhiXjGZjOworLr5xs9Q9DWC+lqFiahOhjGPi3yrdPDqGuGS1vUPBTO4O5/icm3X\n"
+        "XE6uYYKxuKJEmzf52PxNdPUGBtABOpo9YkN9hXizXcRxlt8deV5SG/ffYIibLke9\n"
+        "aH4K/iT1OarG/ZKGE1h8U/hPDz3jcVGpqhwn7K4RtRJO7brYKw1jDJwH64g5gDZ7\n"
+        "Y2zcj5zh1JsnOYPx/1HWxDDIbBN9RbOTyKZIMP9OwglbS5RhIblTgM8zT8ZEHQ1s\n"
+        "h5dF1jt5pKtcqQelYbfACsTmVCvtJR9Uz98mYE/xpwvJTXbzeycmEccdfuWWFkFB\n"
+        "xzQroKECgYEA/VeD9T3/zJ9uls0DBuj+LBu+7mL/RrPuoJrqBIuXvIvddYgmvEkf\n"
+        "IhB7OLgLeMv5KvHRn8XWoEcPGoglfbY4jqIML855gFolyXSNJlbSiOPit8Ea9dKi\n"
+        "60fHhaa1U+E2xdDOeUilQVCEgnnqSBls1kGqB+81os5GVgo7MzW1+Y0CgYEA51+2\n"
+        "PYKLC5KU8r/bWlwjF2DmVJq6tD3O8SonqKsPv9MwGz0AimLO+iNtvEkh2rLVidtK\n"
+        "oP0tvIgsu70xqgX4wRBpZB+rk5IS8y3dCVf6TGVFYK9La5/L5BHLAzbf5jybRzH7\n"
+        "lT3O94oE7w7gkUiexSM37Wp8FoQG4EPl7MXXBl0CgYBDLE5H232U4v0urQNNdL/Y\n"
+        "MC8rBELNm239VbYRKHY+PxOkU0p6CCViId6aRmp8SBE0KtQ7OfjTnKPLlCfksklC\n"
+        "wILctjGPL9fvF6FJdiHyvAHkWSZt4cDjA7BKps5ThFbCkr/8dp+itte7xNmy7lLm\n"
+        "aJjN68Zb+be6npHd3TL4DQKBgBxHXHTEIc52SfIpdNvkav2OgFhS2QLykvpy1ooM\n"
+        "7k3ZuAV8PTaswPNdpSngHl0mgmbpAIQQrahfVGhVxV4sgKzIHrl4DXZp4hsKvftI\n"
+        "X3U643Hfuu4ah8cGTbPE3zS6r5fSChfBiCxFGDlHrjbTk2Qw28MOwr/Vvyll4xI/\n"
+        "U/qZAoGARuIs5CqcL3NTLyXQGCa3OIeUoqlpMHyy9niJb/S4z6ew6BvI2/uuI//j\n"
+        "zyZyRdexTF7rOIFDMqsCz7EpJDO9jjwTeKGZ1n25kFJS2AXHhFIU9mdYF9rZ9yuE\n"
+        "yLB7ISyuiPNMhsOOHMHWWTKiqmQdGBc/HTCKRA1Pu34Bcem55PA=\n"
+        "-----END RSA PRIVATE KEY-----\n";
+
+static const char *alice_csr =
+        "-----BEGIN CERTIFICATE REQUEST-----\n"
+        "MIIC9zCCAd8CAQAwgbExCzAJBgNVBAYTAk5MMQswCQYDVQQIDAJPVjEWMBQGA1UE\n"
+        "BwwNTG9jYWxpdHkgTmFtZTEhMB8GA1UECwwYT3JnYW5pemF0aW9uYWwgVW5pdCBO\n"
+        "YW1lMR0wGwYDVQQKDBRFeGFtcGxlIE9yZ2FuaXphdGlvbjEWMBQGA1UEAwwNQWxp\n"
+        "Y2UgRXhhbXBsZTEjMCEGCSqGSIb3DQEJARYUYWxpY2VAZXhhbXBsZWx0ZC5jb20w\n"
+        "ggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDRWf1hiWWasL9VWTFYWrpP\n"
+        "OyZaf+eIzJ2wTSGGbgRqbTSDDe8zjFJy8F7EjS13q1tK2dYrPy8GJJW1ZjUYNfwg\n"
+        "IIEO58lw0jKm70vcOyMGhVOlyPFeZ9KlzGx6k1pLsioU+hF34n63OuXmpRHRDnY5\n"
+        "sjTZyynoLB5wvwK99d9zTZT62k9vuJKxP8BwJ4ABzXS91Je2d9w4ZUvDL4PnbuQ2\n"
+        "vmvZWETYVh1ZusZI6PyHDl5R9GwqmdaV6uZbLXDNh+YyqQggjWGFjWxEOYwOsukV\n"
+        "6JiR/0H/sdAX5Ha0UUWiTV1hWmBmJlQ2Q41CcNC55OHKnO7dcH8/AcTEgtmcHAS3\n"
+        "AgMBAAGgADANBgkqhkiG9w0BAQsFAAOCAQEAOqzDicnVFXBhsfRI/Gcmk0kyKAjg\n"
+        "UAfADqDT7EyqX31O4C+Flj+G++p4/Yo0W8yP01nSMOF5yB76Eep+hXuLldfL1aKs\n"
+        "krnZgIrCXyUSb5pVYHrbhI76eet6TMD8P9gj0okPLOfzyTHrQz9wCAv9FfiNl2y+\n"
+        "cK/meQPAByyxSiyW41owlHaMkSgIL/xULJHjR07QRCiKIAY3/mwUQ5I3k4qKibzQ\n"
+        "eV4Cus2SEqqXhNsFwZPWQZQmZOXLcEX7g9OsC4iVyGOunUwZdv8BRVThQk+5rGWk\n"
+        "dHjeWYmS7pWc8EjLnaSairQiw9tmZ0SQcNc7DjnPdkBU78MHxMW54sKBrw==\n"
+        "-----END CERTIFICATE REQUEST-----\n";
+
+
+static const char *bob_csr =
+        "-----BEGIN CERTIFICATE REQUEST-----\n"
+        "MIIC8zCCAdsCAQAwga0xCzAJBgNVBAYTAk5MMQswCQYDVQQIDAJPVjEWMBQGA1UE\n"
+        "BwwNTG9jYWxpdHkgTmFtZTEhMB8GA1UECwwYT3JnYW5pemF0aW9uYWwgVW5pdCBO\n"
+        "YW1lMR0wGwYDVQQKDBRFeGFtcGxlIE9yZ2FuaXphdGlvbjEUMBIGA1UEAwwLQm9i\n"
+        "IEV4YW1wbGUxITAfBgkqhkiG9w0BCQEWEmJvYkBleGFtcGxlbHRkLmNvbTCCASIw\n"
+        "DQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAOT4r+VZzqoPbwFlxq3cR9gMdbL8\n"
+        "qSTVZjVJTPeahkJaHiUD5I0swBByAVWABNHlOYBy95fRCNpsP21S7E/0RF4qY/Uk\n"
+        "zzfTWDlTR9sng/Pih1jV15ok2CeWIxz/Rhw3SomednZ+wWJLalJYIZcbmNKY1q6o\n"
+        "ZzZHCXqe2GauEE2wkHMlFZfvb/pROvw7khuStSjUQkJpp0VY3VphkKIK1vHmdcTR\n"
+        "cBybmWICj/6u4nkEmCPmETK7daUnI4+hY3S+TjGEoawTuzgWK8A4zJ6ZqMfaJhft\n"
+        "UtRpotctN295tQjil+JSA0KXO4L6cKtNmaMxF/pHyLNFGvBCm1YItt1f9jkCAwEA\n"
+        "AaAAMA0GCSqGSIb3DQEBCwUAA4IBAQBr85eN2h2q1dLfSeaJHmyVqmwdj2igMOcK\n"
+        "4RllC2LZ1aorfCvMSb5VzAUbVDFwKJOCfM5vk4hXmt9Uxxmr5qHpnBWi5XGoevuf\n"
+        "iQ+hdZqS9HIn1/vzNyX6OlCJwVd4qo42RLJFnxyKYnFtZrhA/kdB33Rf+UyRxfoB\n"
+        "/Su7pUUR+iIMZeu/C3LT3cZy5phqaWzOsw83m3Hap/UzTt5WAhynRfaYRdXuwACU\n"
+        "QscNSTJsYUfSlynzxY2GHgOw3N34x5pLlVGdOBoG4BjjdZVTeyPc/KgpkUYFY3mD\n"
+        "jDnSobyp5xr4wcR4RHJCUxCd3/bAAmqKwXY+GnRvOrdKG35Eii0Z\n"
+        "-----END CERTIFICATE REQUEST-----\n";
+
+
+static char *bob_identity_cert = NULL;
+
+typedef enum {
+    HANDSHAKE_REQUEST,
+    HANDSHAKE_REPLY,
+    HANDSHAKE_FINAL
+} HandshakeStep_t;
+
+
+struct octet_seq {
+    unsigned char  *data;
+    uint32_t  length;
+};
+
+static struct plugins_hdl *plugins = NULL;
+static dds_security_authentication *auth = NULL;
+static dds_security_access_control *access_control = NULL;
+static DDS_Security_IdentityHandle local_identity_handle = DDS_SECURITY_HANDLE_NIL;
+static DDS_Security_IdentityHandle remote_identity_handle = DDS_SECURITY_HANDLE_NIL;
+static DDS_Security_IdentityHandle remote_identity_handle2 = DDS_SECURITY_HANDLE_NIL;
+static DDS_Security_PermissionsHandle local_permissions_handle = DDS_SECURITY_HANDLE_NIL;
+static char *path_to_etc_dir = NULL;
+static char *g_path_build_dir = NULL;
+static DDS_Security_IdentityHandle identity_handle_for_callback1=DDS_SECURITY_HANDLE_NIL;
+static DDS_Security_IdentityHandle identity_handle_for_callback2=DDS_SECURITY_HANDLE_NIL;
+static dds_time_t local_expiry_date;
+static dds_time_t remote_expiry_date;
+
+#define HANDSHAKE_SIGNATURE_SIZE 6
+
+#if DDSRT_ENDIAN == DDSRT_LITTLE_ENDIAN
+static  unsigned bswap4u (unsigned x)
+{
+  return (x >> 24) | ((x >> 8) & 0xff00) | ((x << 8) & 0xff0000) | (x << 24);
+}
+#define toBE4u(x) bswap4u (x)
+#define fromBE4u(x) bswap4u (x)
+#else
+#define toBE4u(x) (x)
+#define fromBE4u(x) (x)
+#endif
+
+static const char * PROPERTY_CERT_SUBJECT_NAME      = "dds.cert.sn";
+static const char * PROPERTY_CERT_ALGORITHM         = "dds.cert.algo";
+static const char * PROPERTY_CA_SUBJECT_NAME        = "dds.ca.sn";
+static const char * PROPERTY_CA_ALGORITHM           = "dds.ca.aglo";
+
+static const char * AUTH_REQUEST_TOKEN_CLASS_ID         = "DDS:Auth:PKI-DH:1.0+AuthReq";
+static const char * AUTH_REQUEST_TOKEN_FUTURE_PROP_NAME = "future_challenge";
+
+static const char * AUTH_HANDSHAKE_REQUEST_TOKEN_CLASS_ID = "DDS:Auth:PKI-DH:1.0+Req";
+static const char * AUTH_HANDSHAKE_REPLY_TOKEN_CLASS_ID   = "DDS:Auth:PKI-DH:1.0+Reply";
+static const char * AUTH_HANDSHAKE_FINAL_TOKEN_CLASS_ID   = "DDS:Auth:PKI-DH:1.0+Final";
+static DDS_Security_AuthRequestMessageToken g_local_auth_request_token = DDS_SECURITY_TOKEN_INIT;
+static DDS_Security_AuthRequestMessageToken g_remote_auth_request_token = DDS_SECURITY_TOKEN_INIT;
+static const DDS_Security_BinaryProperty_t *challenge1_predefined_glb = NULL;
+static const DDS_Security_BinaryProperty_t *challenge2_predefined_glb = NULL;
+static DDS_Security_OctetSeq serialized_participant_data = DDS_SECURITY_SEQUENCE_INIT;
+static DDS_Security_ParticipantBuiltinTopicData *remote_participant_data1 = NULL;
+static DDS_Security_ParticipantBuiltinTopicData *remote_participant_data2 = NULL;
+static DDS_Security_ParticipantBuiltinTopicData *remote_participant_data3 = NULL;
+static DDS_Security_GUID_t candidate_participant_guid;
+static DDS_Security_GUID_t remote_participant_guid1;
+static DDS_Security_GUID_t remote_participant_guid2;
+
+static EVP_PKEY *dh_modp_key = NULL;
+static EVP_PKEY *dh_ecdh_key = NULL;
+static struct octet_seq dh_modp_pub_key = {NULL, 0};
+static struct octet_seq dh_ecdh_pub_key = {NULL, 0};
+static struct octet_seq invalid_dh_pub_key = {NULL, 0};
+
+
+static void
+dds_security_property_init(
+    DDS_Security_PropertySeq *seq,
+    DDS_Security_unsigned_long size)
+{
+    seq->_length = size;
+    seq->_maximum = size;
+    seq->_buffer = ddsrt_malloc(size * sizeof(DDS_Security_Property_t));
+    memset(seq->_buffer, 0, size * sizeof(DDS_Security_Property_t));
+}
+
+static void
+dds_security_property_deinit(
+    DDS_Security_PropertySeq *seq)
+{
+    uint32_t i;
+
+    for (i = 0; i < seq->_length; i++) {
+        ddsrt_free(seq->_buffer[i].name);
+        ddsrt_free(seq->_buffer[i].value);
+    }
+    ddsrt_free(seq->_buffer);
+}
+
+static void
+reset_exception(
+    DDS_Security_SecurityException *ex)
+{
+    ex->code = 0;
+    ex->minor_code = 0;
+    ddsrt_free(ex->message);
+    ex->message = NULL;
+}
+
+
+static dds_time_t
+get_certificate_expiry(
+    /*_In_*/ X509 *cert)
+{
+    dds_time_t expiry = DDS_TIME_INVALID;
+    ASN1_TIME *ans1;
+
+    assert(cert);
+
+    ans1 = X509_get_notAfter(cert);
+    if (ans1 != NULL) {
+        int days;
+        int seconds;
+        if (ASN1_TIME_diff(&days, &seconds, NULL, ans1) != 0) {
+            static const dds_duration_t secs_per_day = 86400;
+            dds_duration_t delta = DDS_SECS(((dds_duration_t)seconds + ((dds_duration_t)days * secs_per_day)));
+            expiry = dds_time() + delta;
+            {
+                BIO *b;
+                b = BIO_new_fp(stdout, BIO_NOCLOSE);
+                BIO_printf(b, "[asn1time] ");
+                ASN1_TIME_print(b, ans1);
+                BIO_printf(b, "\n");
+                BIO_free(b);
+            }
+        }
+    }
+
+    return expiry;
+}
+
+
+/* Generate a CA-signed certificate from CSR (Certificate Signing Request) */
+static DDS_Security_boolean create_certificate_from_csr(const char* csr, long valid_secs,
+                const char* outfile, dds_time_t *expiry)
+{
+
+    ASN1_INTEGER *aserial = NULL;
+    EVP_PKEY *ca_privkey, *req_pubkey;
+    EVP_MD const *digest = NULL;
+    X509 *newcert, *cacert;
+    X509_NAME *name;
+    X509V3_CTX ctx;
+    BIO *fp;
+    BIO *reqbio = NULL;
+    BIO *outbio = NULL;
+    X509_REQ *certreq = NULL;
+    char *identity_ca_cert_file;
+    char *identity_ca_key_file;
+    char* certificate_file;
+
+    outbio = BIO_new(BIO_s_file());
+
+    /* ---------------------------------------------------------- *
+     * Load the request data in a BIO, then in a x509_REQ struct. *
+     * ---------------------------------------------------------- */
+    reqbio = BIO_new_mem_buf(csr, -1);
+
+    if (!(certreq = PEM_read_bio_X509_REQ(reqbio, NULL, NULL, NULL))) {
+        BIO_printf(outbio, "Error can't read X509 request data into memory\n");
+        return false;
+    }
+
+    /* -------------------------------------------------------- *
+     * Load the signing CA Certificate file                    *
+     * ---------------------------------------------------------*/
+
+    ddsrt_asprintf(&identity_ca_cert_file, "%s%s", path_to_etc_dir, IDENTITY_CA_FILE);
+
+    if (!(fp = BIO_new_file(identity_ca_cert_file, "r"))) {
+        BIO_printf(outbio, "Error reading CA cert file\n");
+        return false;
+    }
+
+    if (!(cacert = PEM_read_bio_X509(fp, NULL, NULL, NULL))) {
+        BIO_printf(outbio, "Error loading CA cert into memory\n");
+        return false;
+    }
+
+    BIO_free(fp);
+
+    /* -------------------------------------------------------- *
+     * Import CA private key file for signing                   *
+     * ---------------------------------------------------------*/
+
+    ddsrt_asprintf(&identity_ca_key_file, "%s%s", path_to_etc_dir, IDENTITY_CA_KEY_FILE);
+
+    if (!(fp = BIO_new_file(identity_ca_key_file, "r"))) {
+        BIO_printf(outbio, "Error reading CA private key file\n");
+        return false;
+    }
+
+    if (!(ca_privkey = PEM_read_bio_PrivateKey(fp, NULL, NULL, NULL))) {
+        BIO_printf(outbio, "Error importing key content from file\n");
+        return false;
+    }
+
+    BIO_free(fp);
+
+    /* --------------------------------------------------------- *
+     * Build Certificate with data from request                  *
+     * ----------------------------------------------------------*/
+    if (!(newcert = X509_new())) {
+        BIO_printf(outbio, "Error creating new X509 object\n");
+        return false;
+    }
+
+    if (X509_set_version(newcert, 2) != 1) {
+        BIO_printf(outbio, "Error setting certificate version\n");
+        return false;
+    }
+
+    /* --------------------------------------------------------- *
+     * set the certificate serial number here                    *
+     * If there is a problem, the value defaults to '0'          *
+     * ----------------------------------------------------------*/
+    aserial = ASN1_INTEGER_new();
+    ASN1_INTEGER_set(aserial, 0);
+    if (!X509_set_serialNumber(newcert, aserial)) {
+        BIO_printf(outbio, "Error setting serial number of the certificate\n");
+        return false;
+    }
+
+    /* --------------------------------------------------------- *
+     * Extract the subject name from the request                 *
+     * ----------------------------------------------------------*/
+    if (!(name = X509_REQ_get_subject_name(certreq)))
+        BIO_printf(outbio, "Error getting subject from cert request\n");
+
+    /* --------------------------------------------------------- *
+     * Set the new certificate subject name                      *
+     * ----------------------------------------------------------*/
+    if (X509_set_subject_name(newcert, name) != 1) {
+        BIO_printf(outbio, "Error setting subject name of certificate\n");
+        return false;
+    }
+
+    /* --------------------------------------------------------- *
+     * Extract the subject name from the signing CA cert         *
+     * ----------------------------------------------------------*/
+    if (!(name = X509_get_subject_name(cacert))) {
+        BIO_printf(outbio, "Error getting subject from CA certificate\n");
+        return false;
+    }
+
+    /* --------------------------------------------------------- *
+     * Set the new certificate issuer name                       *
+     * ----------------------------------------------------------*/
+    if (X509_set_issuer_name(newcert, name) != 1) {
+        BIO_printf(outbio, "Error setting issuer name of certificate\n");
+        return false;
+    }
+
+    /* --------------------------------------------------------- *
+     * Extract the public key data from the request              *
+     * ----------------------------------------------------------*/
+    if (!(req_pubkey = X509_REQ_get_pubkey(certreq))) {
+        BIO_printf(outbio, "Error unpacking public key from request\n");
+        return false;
+    }
+
+    /* --------------------------------------------------------- *
+     * Optionally: Use the public key to verify the signature    *
+     * ----------------------------------------------------------*/
+    if (X509_REQ_verify(certreq, req_pubkey) != 1) {
+        BIO_printf(outbio, "Error verifying signature on request\n");
+        return false;
+    }
+
+    /* --------------------------------------------------------- *
+     * Set the new certificate public key                        *
+     * ----------------------------------------------------------*/
+    if (X509_set_pubkey(newcert, req_pubkey) != 1) {
+        BIO_printf(outbio, "Error setting public key of certificate\n");
+        return false;
+    }
+
+    /* ---------------------------------------------------------- *
+     * Set X509V3 start date (now) and expiration date (+365 days)*
+     * -----------------------------------------------------------*/
+    if (!(X509_gmtime_adj(X509_get_notBefore(newcert), -10))) {
+        BIO_printf(outbio, "Error setting start time\n");
+        return false;
+    }
+
+    if (!(X509_gmtime_adj(X509_get_notAfter(newcert), valid_secs))) {
+        BIO_printf(outbio, "Error setting expiration time\n");
+        return false;
+    }
+
+    /* ----------------------------------------------------------- *
+     * Add X509V3 extensions                                       *
+     * ------------------------------------------------------------*/
+    X509V3_set_ctx(&ctx, cacert, newcert, NULL, NULL, 0);
+
+    /* ----------------------------------------------------------- *
+     * Set digest type, sign new certificate with CA's private key *
+     * ------------------------------------------------------------*/
+    digest = EVP_sha256();
+
+    if (!X509_sign(newcert, ca_privkey, digest)) {
+        BIO_printf(outbio, "Error signing the new certificate\n");
+        return false;
+    }
+
+    /* ------------------------------------------------------------ *
+     *  write the certificate to file                               *
+     * -------------------------------------------------------------*/
+    ddsrt_asprintf(&certificate_file, "%s%s", g_path_build_dir, outfile);
+
+    if (!(fp = BIO_new_file(certificate_file, "w"))) {
+        BIO_printf(outbio, "Error opening certificate file for write\n");
+        return false;
+    }
+    if (!PEM_write_bio_X509( fp, newcert)) {
+        BIO_printf(outbio, "Error writing the signed certificate\n");
+        return false;
+    }
+    BIO_free(fp);
+
+    *expiry = get_certificate_expiry( newcert );
+
+    EVP_PKEY_free(req_pubkey);
+    EVP_PKEY_free(ca_privkey);
+    X509_REQ_free(certreq);
+    ASN1_INTEGER_free( aserial );
+    X509_free(newcert);
+    X509_free(cacert);
+    BIO_free_all(reqbio);
+    BIO_free_all(outbio);
+    ddsrt_free(certificate_file);
+    ddsrt_free( identity_ca_cert_file );
+    ddsrt_free( identity_ca_key_file );
+    return true;
+}
+
+/* fills the participant properties and return identity cert expiry */
+static void
+fill_participant_qos(
+    DDS_Security_Qos *qos,
+    long validity_duration,
+    const char *governance_filename,
+    dds_time_t *identity_expiry)
+{
+    char *permission_uri;
+    char *governance_uri;
+    char *permissions_ca_cert_file;
+    char *permissions_ca_uri;
+    char *identity_file;
+    char *identity_uri;
+    char *permissions_file;
+
+    create_certificate_from_csr( alice_csr, validity_duration , ALICE_IDENTITY_CERT_FILE, identity_expiry);
+
+    /*permissions ca cert*/
+    ddsrt_asprintf(&permissions_ca_cert_file, "%s%s", path_to_etc_dir, PERMISSIONS_CA_CERT_FILE);
+
+    ddsrt_asprintf(&permissions_ca_uri, "file:%s",  permissions_ca_cert_file);
+
+    /*Alice Identity*/
+    ddsrt_asprintf(&identity_file, "%s%s", g_path_build_dir, ALICE_IDENTITY_CERT_FILE);
+
+    ddsrt_asprintf(&identity_uri, "file:%s",  identity_file);
+
+    /*Alice Permissions */
+    ddsrt_asprintf(&permissions_file, "%s%s", path_to_etc_dir, ALICE_PERMISSIONS_FILE);
+
+    ddsrt_asprintf(&permission_uri, "file:%s",  permissions_file);
+
+    ddsrt_asprintf(&governance_uri, "file:%s%s", path_to_etc_dir, governance_filename);
+
+    memset(qos, 0, sizeof(*qos));
+    dds_security_property_init(&qos->property.value, 6);
+    qos->property.value._buffer[0].name = ddsrt_strdup(PROPERTY_IDENTITY_CERT);
+    qos->property.value._buffer[0].value = ddsrt_strdup(identity_uri);
+    qos->property.value._buffer[1].name = ddsrt_strdup(PROPERTY_IDENTITY_CA);
+    qos->property.value._buffer[1].value = ddsrt_strdup(identity_ca);
+    qos->property.value._buffer[2].name = ddsrt_strdup(PROPERTY_PRIVATE_KEY);
+    qos->property.value._buffer[2].value = ddsrt_strdup(alice_private_key);
+    qos->property.value._buffer[3].name = ddsrt_strdup(PROPERTY_PERMISSIONS_CA);
+    qos->property.value._buffer[3].value = ddsrt_strdup(permissions_ca_uri);
+    qos->property.value._buffer[4].name = ddsrt_strdup(PROPERTY_PERMISSIONS);
+    qos->property.value._buffer[4].value = ddsrt_strdup(permission_uri);
+    qos->property.value._buffer[5].name = ddsrt_strdup(PROPERTY_GOVERNANCE);
+    qos->property.value._buffer[5].value = ddsrt_strdup(governance_uri);
+
+    ddsrt_free(permission_uri);
+    ddsrt_free(governance_uri);
+    ddsrt_free( permissions_ca_cert_file );
+    ddsrt_free( permissions_file );
+    ddsrt_free ( identity_file );
+    ddsrt_free( identity_uri );
+    ddsrt_free( permissions_ca_uri );
+
+
+}
+
+static void
+fill_permissions_token(
+    DDS_Security_PermissionsToken *token)
+{
+    memset(token, 0, sizeof(DDS_Security_PermissionsToken));
+
+    token->class_id = ddsrt_strdup(ACCESS_PERMISSIONS_TOKEN_ID);
+    token->properties._length = token->properties._maximum = 2;
+    token->properties._buffer = DDS_Security_PropertySeq_allocbuf(2);
+
+    token->properties._buffer[0].name = ddsrt_strdup(PROPERTY_PERMISSIONS_CA_SN);
+    token->properties._buffer[0].value = ddsrt_strdup(SUBJECT_NAME_PERMISSIONS_CA);
+
+    token->properties._buffer[1].name = ddsrt_strdup(PROPERTY_PERMISSIONS_CA_ALGO);
+    token->properties._buffer[1].value = ddsrt_strdup(RSA_2048_ALGORITHM_NAME);
+}
+
+
+static int
+fill_peer_credential_token(
+    DDS_Security_AuthenticatedPeerCredentialToken *token)
+{
+    int result = 1;
+    char *permission_data;
+    char *permissions_ca_cert_file;
+    char *permissions_file;
+
+
+    /*permissions ca cert*/
+    ddsrt_asprintf(&permissions_ca_cert_file, "%s%s", path_to_etc_dir, PERMISSIONS_CA_CERT_FILE);
+
+    /*permissions ca key*/
+    ddsrt_asprintf(&permissions_file, "%s%s", path_to_etc_dir, BOB_PERMISSIONS_FILE);
+
+
+    memset(token, 0, sizeof(DDS_Security_AuthenticatedPeerCredentialToken));
+
+    permission_data = load_file_contents(permissions_file);
+
+    if (permission_data) {
+        token->class_id = ddsrt_strdup(AUTH_PROTOCOL_CLASS_ID);
+        token->properties._length = token->properties._maximum = 2;
+        token->properties._buffer = DDS_Security_PropertySeq_allocbuf(2);
+
+        token->properties._buffer[0].name = ddsrt_strdup(PROPERTY_C_ID);
+        token->properties._buffer[0].value = ddsrt_strdup(&bob_identity_cert[0]);
+
+        token->properties._buffer[1].name = ddsrt_strdup(PROPERTY_C_PERM);
+        token->properties._buffer[1].value = permission_data;
+    } else {
+        ddsrt_free(permission_data);
+        result = 0;
+    }
+
+    ddsrt_free( permissions_ca_cert_file );
+    ddsrt_free( permissions_file );
+    return result;
+}
+
+
+static void
+serializer_participant_data(
+    DDS_Security_ParticipantBuiltinTopicData *pdata,
+    unsigned char **buffer,
+    size_t *size)
+{
+    DDS_Security_Serializer serializer;
+    serializer = DDS_Security_Serializer_new(1024, 1024);
+
+    DDS_Security_Serialize_ParticipantBuiltinTopicData(serializer, pdata);
+    DDS_Security_Serializer_buffer(serializer, buffer, size);
+    DDS_Security_Serializer_free(serializer);
+}
+
+static void
+initialize_identity_token(
+    DDS_Security_IdentityToken *token,
+    const char *certAlgo,
+    const char *caAlgo)
+{
+    memset(token, 0, sizeof(*token));
+
+    token->class_id = ddsrt_strdup(AUTH_PROTOCOL_CLASS_ID);
+    token->properties._maximum = 4;
+    token->properties._length  = 4;
+    token->properties._buffer = DDS_Security_PropertySeq_allocbuf(4);
+
+    token->properties._buffer[0].name = ddsrt_strdup(PROPERTY_CERT_SUBJECT_NAME);
+    token->properties._buffer[0].value = ddsrt_strdup("/C=NL/ST=OV/L=Locality Name/OU=Organizational Unit Name/O=Example Organization/CN=Bob Example/emailAddress=bob@exampleltd.com");
+    token->properties._buffer[0].propagate = true;
+
+    token->properties._buffer[1].name = ddsrt_strdup(PROPERTY_CERT_ALGORITHM);
+    token->properties._buffer[1].value = ddsrt_strdup(certAlgo);
+    token->properties._buffer[1].propagate = true;
+
+    token->properties._buffer[2].name = ddsrt_strdup(PROPERTY_CA_SUBJECT_NAME);
+    token->properties._buffer[2].value = ddsrt_strdup("/C=NL/ST=OV/L=Locality Name/OU=Organizational Unit Name/O=Example Signer CA/CN=Example CA/emailAddress=authority@identitycaltd.org");
+    token->properties._buffer[2].propagate = true;
+
+    token->properties._buffer[3].name = ddsrt_strdup(PROPERTY_CA_ALGORITHM);
+    token->properties._buffer[3].value = ddsrt_strdup(caAlgo);
+    token->properties._buffer[3].propagate = true;
+}
+
+static DDS_Security_long
+validate_local_identity_and_permissions( uint32_t identity_expiry_duration, dds_time_t *identity_expiry )
+{
+    DDS_Security_long res = DDS_SECURITY_ERR_OK_CODE;
+    DDS_Security_ValidationResult_t result;
+    DDS_Security_DomainId domain_id = 0;
+    DDS_Security_Qos participant_qos;
+    DDS_Security_SecurityException exception = {NULL, 0, 0};
+    DDS_Security_GuidPrefix_t prefix = {0xb0, 0xb1, 0xb2, 0xb3, 0xb4, 0xb5, 0xb6, 0xb7, 0xb8, 0xb9, 0xba, 0xbb};
+    DDS_Security_EntityId_t entityId = {{0xb0,0xb1,0xb2},0x1};
+    DDS_Security_GUID_t local_participant_guid;
+    DDS_Security_ParticipantBuiltinTopicData *local_participant_data;
+    unsigned char *sdata;
+    size_t sz;
+
+    memset(&local_participant_guid, 0, sizeof(local_participant_guid));
+    memcpy(&candidate_participant_guid.prefix, &prefix, sizeof(prefix));
+    memcpy(&candidate_participant_guid.entityId, &entityId, sizeof(entityId));
+
+    fill_participant_qos(&participant_qos, identity_expiry_duration, "Example_Governance.p7s", identity_expiry );
+
+    /* Now call the function. */
+    result = auth->validate_local_identity(
+                            auth,
+                            &local_identity_handle,
+                            &local_participant_guid,
+                            domain_id,
+                            &participant_qos,
+                            &candidate_participant_guid,
+                            &exception);
+
+    if (result != DDS_SECURITY_VALIDATION_OK) {
+        res = DDS_SECURITY_ERR_UNDEFINED_CODE;
+        printf("validate_local_identity_failed: (%d) %s\n", (int)exception.code, exception.message ? exception.message : "Error message missing");
+    }
+
+    reset_exception(&exception);
+
+    if (res == 0) {
+        local_permissions_handle = access_control->validate_local_permissions(
+                access_control,
+                auth,
+                local_identity_handle,
+                0,
+                &participant_qos,
+                &exception);
+
+        if (local_permissions_handle == DDS_SECURITY_HANDLE_NIL) {
+            printf("validate_local_permissions_failed: (%d) %s\n", (int)exception.code, exception.message ? exception.message : "Error message missing");
+            if (exception.code == DDS_SECURITY_ERR_VALIDITY_PERIOD_EXPIRED_CODE) {
+                /* This can happen on very slow platforms or when doing a valgrind run. */
+                res = DDS_SECURITY_ERR_VALIDITY_PERIOD_EXPIRED_CODE;
+            } else {
+                res = DDS_SECURITY_ERR_UNDEFINED_CODE;
+            }
+        }
+    }
+
+    dds_security_property_deinit(&participant_qos.property.value);
+    reset_exception(&exception);
+
+    local_participant_data = DDS_Security_ParticipantBuiltinTopicData_alloc();
+    memcpy(&local_participant_data->key[0], &local_participant_guid, 12);
+    /* convert from big-endian format to native format */
+    local_participant_data->key[0] = fromBE4u(local_participant_data->key[0]);
+    local_participant_data->key[1] = fromBE4u(local_participant_data->key[1]);
+    local_participant_data->key[2] = fromBE4u(local_participant_data->key[2]);
+
+    initialize_identity_token(&local_participant_data->identity_token, RSA_2048_ALGORITHM_NAME, RSA_2048_ALGORITHM_NAME);
+    fill_permissions_token(&local_participant_data->permissions_token );
+
+    local_participant_data->security_info.participant_security_attributes = 0x01;
+    local_participant_data->security_info.plugin_participant_security_attributes = 0x02;
+
+    serializer_participant_data(local_participant_data, &sdata, &sz);
+
+    serialized_participant_data._length = serialized_participant_data._maximum = (DDS_Security_unsigned_long) sz;
+    serialized_participant_data._buffer = sdata;
+
+    DDS_Security_ParticipantBuiltinTopicData_free(local_participant_data);
+
+
+
+    return res;
+}
+
+static void
+clear_local_identity_and_permissions(void)
+{
+    DDS_Security_SecurityException exception = {NULL, 0, 0};
+    DDS_Security_boolean success;
+
+    if (local_permissions_handle != DDS_SECURITY_HANDLE_NIL) {
+        success = access_control->return_permissions_handle(access_control, local_permissions_handle, &exception);
+        if (!success) {
+            printf("return_permission_handle failed: %s\n", exception.message ? exception.message : "Error message missing");
+        }
+        reset_exception(&exception);
+    }
+
+    if (local_identity_handle != DDS_SECURITY_HANDLE_NIL) {
+        success = auth->return_identity_handle(auth, local_identity_handle, &exception);
+        if (!success) {
+            printf("return_identity_handle failed: %s\n", exception.message ? exception.message : "Error message missing");
+        }
+        reset_exception(&exception);
+    }
+
+    DDS_Security_OctetSeq_deinit(&serialized_participant_data);
+}
+
+static int
+set_path_to_etc_dir(void)
+{
+    int res = 0;
+    size_t len;
+
+    len = 1024;
+    path_to_etc_dir = ddsrt_malloc(len);
+    snprintf(path_to_etc_dir, 1024, "%s/listeners_authentication/etc/", CONFIG_ENV_TESTS_DIR);
+
+    return res;
+}
+
+static void set_path_build_dir(void)
+{
+  ddsrt_asprintf(&g_path_build_dir, "%s/", CONFIG_ENV_BUILD_DIR);
+}
+
+/* handshake helper functions */
+
+
+static DDS_Security_BinaryProperty_t *
+find_binary_property(
+    DDS_Security_DataHolder *token,
+    const char *name)
+{
+    DDS_Security_BinaryProperty_t *result = NULL;
+    uint32_t i;
+
+    for (i = 0; i < token->binary_properties._length && !result; i++) {
+        if (token->binary_properties._buffer[i].name && (strcmp(token->binary_properties._buffer[i].name, name) == 0)) {
+            result = &token->binary_properties._buffer[i];
+        }
+    }
+
+    return result;
+}
+
+
+static void
+octet_seq_init(
+    struct octet_seq *seq,
+    unsigned char *data,
+    uint32_t size)
+{
+    seq->data = ddsrt_malloc(size);
+    memcpy(seq->data, data, size);
+    seq->length = size;
+}
+
+static void
+octet_seq_deinit(
+    struct octet_seq *seq)
+{
+    ddsrt_free(seq->data);
+}
+static char *
+get_openssl_error_message_for_test(
+        void)
+{
+    BIO *bio = BIO_new(BIO_s_mem());
+    char *msg;
+    char *buf = NULL;
+    size_t len;
+
+    if (bio) {
+        ERR_print_errors(bio);
+        len = (uint32_t)BIO_get_mem_data (bio, &buf);
+        msg = ddsrt_malloc(len + 1);
+        memset(msg, 0, len+1);
+        memcpy(msg, buf, len);
+        BIO_free(bio);
+    } else {
+        msg = ddsrt_strdup("BIO_new failed");
+    }
+
+    return msg;
+}
+
+
+static const BIGNUM *
+dh_get_public_key(
+    /*_In_ */DH *dhkey)
+{
+#ifdef AUTH_INCLUDE_DH_ACCESSORS
+    const BIGNUM *pubkey, *privkey;
+    DH_get0_key(dhkey, &pubkey, &privkey);
+    return pubkey;
+#else
+    return dhkey->pub_key;
+#endif
+}
+
+
+
+/* DH Helper Functions */
+
+static int
+create_dh_key_modp_2048(
+    EVP_PKEY **pkey)
+{
+    int r = 0;
+    EVP_PKEY *params = NULL;
+    EVP_PKEY_CTX *kctx = NULL;
+    DH *dh = NULL;
+
+    *pkey = NULL;
+
+    if ((params = EVP_PKEY_new()) == NULL) {
+        char *msg = get_openssl_error_message_for_test();
+        printf("Failed to allocate EVP_PKEY: %s", msg);
+        ddsrt_free(msg);
+        r = -1;
+    } else if ((dh = DH_get_2048_256()) == NULL) {
+        char *msg = get_openssl_error_message_for_test();
+        printf("Failed to allocate DH parameter: %s", msg);
+        ddsrt_free(msg);
+        r = -1;
+    } else if (EVP_PKEY_set1_DH(params, dh) <= 0) {
+        char *msg = get_openssl_error_message_for_test();
+        printf("Failed to set DH parameter to MODP_2048_256: %s", msg);
+        ddsrt_free(msg);
+        r = -1;
+    } else if ((kctx = EVP_PKEY_CTX_new(params, NULL)) == NULL) {
+        char *msg = get_openssl_error_message_for_test();
+        printf("Failed to allocate KEY context %s", msg);
+        ddsrt_free(msg);
+        r = -1;
+    } else if (EVP_PKEY_keygen_init(kctx) <= 0) {
+        char *msg = get_openssl_error_message_for_test();
+        printf("Failed to initialize KEY context: %s", msg);
+        ddsrt_free(msg);
+        r = -1;
+    } else if (EVP_PKEY_keygen(kctx, pkey) <= 0) {
+        char *msg = get_openssl_error_message_for_test();
+        printf("Failed to generate :MODP_2048_256 keys %s", msg);
+        ddsrt_free(msg);
+        r = -1;
+    }
+
+    if (params) EVP_PKEY_free(params);
+    if (kctx) EVP_PKEY_CTX_free(kctx);
+    if (dh) DH_free(dh);
+
+    return r;
+}
+
+static int
+get_dh_public_key_modp_2048(
+    EVP_PKEY *pkey,
+    struct octet_seq *pubkey)
+{
+    int r = 0;
+    DH *dhkey;
+    unsigned char *buffer = NULL;
+    uint32_t size;
+    ASN1_INTEGER *asn1int;
+
+    dhkey = EVP_PKEY_get1_DH(pkey);
+    if (!dhkey) {
+        char *msg = get_openssl_error_message_for_test();
+        printf("Failed to get DH key from PKEY: %s", msg);
+        ddsrt_free(msg);
+        r = -1;
+        goto fail_get_dhkey;
+    }
+
+    asn1int = BN_to_ASN1_INTEGER( dh_get_public_key(dhkey) , NULL);
+    if (!asn1int) {
+        char *msg = get_openssl_error_message_for_test();
+        printf("Failed to convert DH key to ASN1 integer: %s", msg);
+        ddsrt_free(msg);
+        r = -1;
+        goto fail_get_pubkey;
+    }
+
+    size = (uint32_t)i2d_ASN1_INTEGER(asn1int, &buffer);
+    octet_seq_init(pubkey, buffer, size);
+
+    ASN1_INTEGER_free(asn1int);
+    OPENSSL_free(buffer);
+
+fail_get_pubkey:
+    DH_free(dhkey);
+fail_get_dhkey:
+    return r;
+}
+
+static int
+create_dh_key_ecdh(
+    EVP_PKEY **pkey)
+{
+    int r = 0;
+    EVP_PKEY *params = NULL;
+    EVP_PKEY_CTX *pctx = NULL;
+    EVP_PKEY_CTX *kctx = NULL;
+
+    *pkey = NULL;
+
+    if ((pctx = EVP_PKEY_CTX_new_id(EVP_PKEY_EC, NULL)) == NULL) {
+        char *msg = get_openssl_error_message_for_test();
+        printf("Failed to allocate DH parameter context: %s", msg);
+        ddsrt_free(msg);
+        r = -1;
+    } else if (EVP_PKEY_paramgen_init(pctx) <= 0) {
+        char *msg = get_openssl_error_message_for_test();
+        printf("Failed to initialize DH generation context: %s", msg);
+        ddsrt_free(msg);
+        r = -1;
+    } else if (EVP_PKEY_CTX_set_ec_paramgen_curve_nid(pctx, NID_X9_62_prime256v1) <= 0) {
+        char *msg = get_openssl_error_message_for_test();
+        printf("Failed to set DH generation parameter generation method: %s", msg);
+        ddsrt_free(msg);
+        r = -1;
+    } else if (EVP_PKEY_paramgen(pctx, &params) <= 0) {
+        char *msg = get_openssl_error_message_for_test();
+        printf("Failed to generate DH parameters: %s", msg);
+        ddsrt_free(msg);
+        r = -1;
+    } else if ((kctx = EVP_PKEY_CTX_new(params, NULL)) == NULL) {
+        char *msg = get_openssl_error_message_for_test();
+        printf("Failed to allocate KEY context %s", msg);
+        ddsrt_free(msg);
+        r = -1;
+    } else if (EVP_PKEY_keygen_init(kctx) <= 0) {
+        char *msg = get_openssl_error_message_for_test();
+        printf("Failed to initialize KEY context: %s", msg);
+        ddsrt_free(msg);
+        r = -1;
+    } else if (EVP_PKEY_keygen(kctx, pkey) <= 0) {
+        char *msg = get_openssl_error_message_for_test();
+        printf("Failed to generate :MODP_2048_256 keys %s", msg);
+        ddsrt_free(msg);
+        r = -1;
+    }
+
+    if (kctx) EVP_PKEY_CTX_free(kctx);
+    if (params) EVP_PKEY_free(params);
+    if (pctx) EVP_PKEY_CTX_free(pctx);
+
+    return r;
+}
+
+static int
+get_dh_public_key_ecdh(
+    EVP_PKEY *pkey,
+    struct octet_seq *pubkey)
+{
+    int r = 0;
+    EC_KEY *eckey = NULL;
+    const EC_GROUP *group = NULL;
+    const EC_POINT *point = NULL;
+    size_t sz;
+
+    if (!(eckey = EVP_PKEY_get1_EC_KEY(pkey))) {
+        char *msg = get_openssl_error_message_for_test();
+        printf("Failed to get EC key from PKEY: %s", msg);
+        ddsrt_free(msg);
+        r = -1;
+    } else if (!(point = EC_KEY_get0_public_key(eckey))) {
+        char *msg = get_openssl_error_message_for_test();
+        printf("Failed to get public key from ECKEY: %s", msg);
+        ddsrt_free(msg);
+        r = -1;
+    } else if (!(group = EC_KEY_get0_group(eckey))) {
+        char *msg = get_openssl_error_message_for_test();
+        printf("Failed to get group from ECKEY: %s", msg);
+        ddsrt_free(msg);
+        r = -1;
+    } else if ((sz = EC_POINT_point2oct(group, point, POINT_CONVERSION_COMPRESSED, NULL, 0, NULL)) != 0) {
+        pubkey->data = ddsrt_malloc(sz);
+        pubkey->length = (uint32_t)EC_POINT_point2oct(group, point, POINT_CONVERSION_COMPRESSED, pubkey->data, sz, NULL);
+        if (pubkey->length == 0) {
+            char *msg = get_openssl_error_message_for_test();
+            printf("Failed to serialize public EC key: %s", msg);
+            ddsrt_free(msg);
+            octet_seq_deinit(pubkey);
+            r = -1;
+        }
+    } else {
+        char *msg = get_openssl_error_message_for_test();
+        printf("Failed to serialize public EC key: %s", msg);
+        ddsrt_free(msg);
+        r = -1;
+    }
+
+    if (eckey) EC_KEY_free(eckey);
+
+    return r;
+}
+
+CU_Init(ddssec_builtin_listeners_auth)
+{
+    int res = 0;
+
+    plugins = load_plugins(&access_control   /* Access Control */,
+                           &auth  /* Authentication */,
+                           NULL   /* Cryptograpy    */);
+    if (plugins) {
+        set_path_build_dir();
+        res = set_path_to_etc_dir();
+        if (res >= 0) {
+           res = create_dh_key_modp_2048(&dh_modp_key);
+        }
+        if (res >= 0) {
+            res = get_dh_public_key_modp_2048(dh_modp_key, &dh_modp_pub_key);
+        }
+        if (res >= 0) {
+           res = create_dh_key_ecdh(&dh_ecdh_key);
+        }
+        if (res >= 0) {
+           res = get_dh_public_key_ecdh(dh_ecdh_key, &dh_ecdh_pub_key);
+        }
+        if (res >= 0) {
+           octet_seq_init(&invalid_dh_pub_key, dh_modp_pub_key.data, dh_modp_pub_key.length);
+           invalid_dh_pub_key.data[0] = 0x08;
+        }
+    } else {
+        res = -1;
+    }
+
+    /* Openssl init */
+    OpenSSL_add_all_algorithms();
+    ERR_load_BIO_strings();
+    ERR_load_crypto_strings();
+
+    return res;
+}
+
+CU_Clean(ddssec_builtin_listeners_auth)
+{
+    octet_seq_deinit(&dh_modp_pub_key);
+    octet_seq_deinit(&dh_ecdh_pub_key);
+    octet_seq_deinit(&invalid_dh_pub_key);
+    if (dh_modp_key) {
+        EVP_PKEY_free(dh_modp_key);
+    }
+    if (dh_ecdh_key) {
+        EVP_PKEY_free(dh_ecdh_key);
+    }
+    unload_plugins(plugins);
+
+    ddsrt_free(path_to_etc_dir);
+    EVP_cleanup();
+    CRYPTO_cleanup_all_ex_data();
+    ERR_free_strings();
+    return 0;
+}
+
+
+
+static void
+set_binary_property_value(
+     DDS_Security_BinaryProperty_t *bp,
+     const char *name,
+     const unsigned char *data,
+     uint32_t length)
+{
+    assert(bp);
+    assert(name);
+    assert(data);
+
+    bp->name = ddsrt_strdup(name);
+    bp->value._maximum = bp->value._length = length;
+    if (length) {
+        bp->value._buffer = ddsrt_malloc(length);
+        memcpy(bp->value._buffer, data, length);
+    } else {
+        bp->value._buffer = NULL;
+    }
+}
+
+static void
+set_binary_property_string(
+     DDS_Security_BinaryProperty_t *bp,
+     const char *name,
+     const char *data)
+{
+    uint32_t length;
+
+    assert(bp);
+    assert(name);
+    assert(data);
+
+    length = (uint32_t)strlen(data) + 1;
+    set_binary_property_value(bp, name, (const unsigned char *)data, length);
+}
+
+
+static DDS_Security_ValidationResult_t
+create_asymmetrical_signature_for_test(
+     EVP_PKEY *pkey,
+     void *data,
+     size_t dataLen,
+     unsigned char **signature,
+     size_t *signatureLen,
+     DDS_Security_SecurityException *ex)
+{
+    DDS_Security_ValidationResult_t result = DDS_SECURITY_VALIDATION_OK;
+    EVP_MD_CTX *mdctx = NULL;
+    EVP_PKEY_CTX *kctx = NULL;
+
+    if (!(mdctx = EVP_MD_CTX_create())) {
+        char *msg = get_openssl_error_message_for_test();
+        result = DDS_SECURITY_VALIDATION_FAILED;
+        DDS_Security_Exception_set(ex, "Authentication", DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result, "Failed to create signing context: %s", msg);
+        ddsrt_free(msg);
+        goto err_create_ctx;
+    }
+
+    if (EVP_DigestSignInit(mdctx, &kctx, EVP_sha256(), NULL, pkey) != 1) {
+        char *msg = get_openssl_error_message_for_test();
+        result = DDS_SECURITY_VALIDATION_FAILED;
+        DDS_Security_Exception_set(ex, "Authentication", DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result, "Failed to initialize signing context: %s", msg);
+        ddsrt_free(msg);
+        goto err_sign;
+    }
+
+    if (EVP_PKEY_CTX_set_rsa_padding(kctx, RSA_PKCS1_PSS_PADDING) < 1) {
+        char *msg = get_openssl_error_message_for_test();
+        result = DDS_SECURITY_VALIDATION_FAILED;
+        DDS_Security_Exception_set(ex, "Authentication", DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result, "Failed to initialize signing context: %s", msg);
+        ddsrt_free(msg);
+        goto err_sign;
+    }
+
+    if (EVP_DigestSignUpdate(mdctx, data, dataLen) != 1) {
+        char *msg = get_openssl_error_message_for_test();
+        result = DDS_SECURITY_VALIDATION_FAILED;
+        DDS_Security_Exception_set(ex, "Authentication", DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result, "Failed to update signing context: %s", msg);
+        ddsrt_free(msg);
+        goto err_sign;
+    }
+
+    if (EVP_DigestSignFinal(mdctx, NULL, signatureLen) != 1) {
+        char *msg = get_openssl_error_message_for_test();
+        result = DDS_SECURITY_VALIDATION_FAILED;
+        DDS_Security_Exception_set(ex, "Authentication", DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result, "Failed to finalize signing context: %s", msg);
+        ddsrt_free(msg);
+        goto err_sign;
+    }
+
+    //*signature = ddsrt_malloc(sizeof(unsigned char) * (*signatureLen));
+    *signature = OPENSSL_malloc(*signatureLen);
+    if (EVP_DigestSignFinal(mdctx, *signature, signatureLen) != 1) {
+        char *msg = get_openssl_error_message_for_test();
+        result = DDS_SECURITY_VALIDATION_FAILED;
+        DDS_Security_Exception_set(ex, "Authentication", DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result, "Failed to finalize signing context: %s", msg);
+        ddsrt_free(msg);
+        ddsrt_free(signature);
+    }
+
+err_sign:
+    EVP_MD_CTX_destroy(mdctx);
+err_create_ctx:
+    return result;
+}
+
+
+static X509 *
+load_certificate(
+   const char *data)
+{
+    X509 *cert = NULL;
+    BIO *bio;
+
+    bio = BIO_new_mem_buf((void *) data, -1);
+    if (!bio) {
+        return NULL;
+    }
+
+    cert = PEM_read_bio_X509(bio, NULL, NULL, NULL);
+
+    BIO_free(bio);
+
+    return cert;
+}
+
+static int
+get_adjusted_participant_guid(
+    X509 *cert,
+    const DDS_Security_GUID_t *candidate,
+    DDS_Security_GUID_t *adjusted)
+{
+    int result = 0;
+    unsigned char high[SHA256_DIGEST_LENGTH], low[SHA256_DIGEST_LENGTH];
+    unsigned char *subject;
+    DDS_Security_octet hb = 0x80;
+    X509_NAME *name;
+    unsigned char *tmp = NULL;
+    int i;
+    int sz;
+
+    name = X509_get_subject_name(cert);
+    sz = i2d_X509_NAME(name, &tmp);
+    if (sz > 0) {
+        subject = ddsrt_malloc((size_t)sz);
+        memcpy(subject, tmp, (size_t)sz);
+        OPENSSL_free(tmp);
+
+        SHA256(subject, (size_t)sz, high);
+        SHA256(&candidate->prefix[0], sizeof(DDS_Security_GuidPrefix_t), low);
+
+        adjusted->entityId = candidate->entityId;
+        for (i = 0; i < 6; i++) {
+            adjusted->prefix[i] = hb | high[i]>>1;
+            hb = (DDS_Security_octet)(high[i]<<7);
+        }
+        for (i = 0; i < 6; i++) {
+            adjusted->prefix[i+6] = low[i];
+        }
+        ddsrt_free(subject);
+        result = 1;
+    }
+
+    return result;
+}
+
+static DDS_Security_ValidationResult_t
+create_signature_for_test(
+    EVP_PKEY *pkey,
+    const DDS_Security_BinaryProperty_t **binary_properties,
+    const uint32_t binary_properties_length,
+    unsigned char **signature,
+    size_t *signatureLen,
+    DDS_Security_SecurityException *ex)
+{
+    DDS_Security_ValidationResult_t result;
+    DDS_Security_Serializer serializer;
+    unsigned char *buffer;
+    size_t size;
+
+    serializer = DDS_Security_Serializer_new(4096, 4096);
+
+    DDS_Security_Serialize_BinaryPropertyArray(serializer,binary_properties, binary_properties_length);
+    DDS_Security_Serializer_buffer(serializer, &buffer, &size);
+
+    result = create_asymmetrical_signature_for_test(pkey, buffer, size, signature, signatureLen, ex);
+
+    ddsrt_free(buffer);
+    DDS_Security_Serializer_free(serializer);
+
+    return result;
+}
+
+
+static void
+deinitialize_identity_token(
+    DDS_Security_IdentityToken *token)
+{
+    DDS_Security_DataHolder_deinit(token);
+}
+
+
+
+static void
+fill_auth_request_token(
+    DDS_Security_AuthRequestMessageToken *token)
+{
+    uint32_t i;
+    uint32_t len = 32;
+    unsigned char *challenge;
+
+    challenge = ddsrt_malloc(len);
+
+    for (i = 0; i < len; i++) {
+        challenge[i] = (unsigned char)(0xFF - i);
+    }
+
+    memset(token, 0, sizeof(*token));
+
+    token->class_id = ddsrt_strdup(AUTH_REQUEST_TOKEN_CLASS_ID);
+    token->binary_properties._maximum = 1;
+    token->binary_properties._length = 1;
+    token->binary_properties._buffer = DDS_Security_BinaryPropertySeq_allocbuf(1);
+    token->binary_properties._buffer->name = ddsrt_strdup(AUTH_REQUEST_TOKEN_FUTURE_PROP_NAME);
+
+    token->binary_properties._buffer->value._maximum = len;
+    token->binary_properties._buffer->value._length = len;
+    token->binary_properties._buffer->value._buffer = challenge;
+}
+
+static int
+validate_remote_identity (const char *remote_id_certificate)
+{
+    int res = 0;
+    DDS_Security_ValidationResult_t result;
+    DDS_Security_IdentityToken remote_identity_token;
+    static DDS_Security_AuthRequestMessageToken local_auth_request_token = DDS_SECURITY_TOKEN_INIT;
+    DDS_Security_GUID_t guid1;
+    DDS_Security_GUID_t guid2;
+    DDS_Security_SecurityException exception = {NULL, 0, 0};
+    DDS_Security_GuidPrefix_t prefix1 = {0xa0, 0xa1, 0xa2, 0xa3, 0xa4, 0xa5, 0xa6, 0xa7, 0xa8, 0xa9, 0xaa, 0xab};
+    DDS_Security_GuidPrefix_t prefix2 = {0xc0, 0xc1, 0xc2, 0xc3, 0xc4, 0xc5, 0xc6, 0xc7, 0xc8, 0xc9, 0xca, 0xcb};
+    DDS_Security_EntityId_t entityId = {{0xb0,0xb1,0xb2},0x1};
+    X509 *cert;
+
+    memcpy(&guid1.prefix, &prefix1, sizeof(prefix1));
+    memcpy(&guid1.entityId, &entityId, sizeof(entityId));
+    memcpy(&guid2.prefix, &prefix2, sizeof(prefix2));
+    memcpy(&guid2.entityId, &entityId, sizeof(entityId));
+
+    if (local_identity_handle == DDS_SECURITY_HANDLE_NIL) {
+        return -1;
+    }
+
+    cert = load_certificate(remote_id_certificate);
+    if (!cert) {
+        return -1;
+    }
+
+    if (!get_adjusted_participant_guid(cert, &guid1, &remote_participant_guid1)) {
+        X509_free(cert);
+        return -1;
+    }
+
+    if (!get_adjusted_participant_guid(cert, &guid2, &remote_participant_guid2)) {
+        X509_free(cert);
+        return -1;
+    }
+
+    X509_free(cert);
+
+    initialize_identity_token(&remote_identity_token, RSA_2048_ALGORITHM_NAME, RSA_2048_ALGORITHM_NAME);
+
+    result = auth->validate_remote_identity(
+                auth,
+                &remote_identity_handle,
+                &g_local_auth_request_token,
+                NULL,
+                local_identity_handle,
+                &remote_identity_token,
+                &remote_participant_guid1,
+                &exception);
+
+    if ((result != DDS_SECURITY_VALIDATION_PENDING_HANDSHAKE_REQUEST) &&
+        (result != DDS_SECURITY_VALIDATION_PENDING_HANDSHAKE_MESSAGE)) {
+        printf("validate_remote_identity_failed: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+
+    reset_exception(&exception);
+    fill_auth_request_token(&g_remote_auth_request_token);
+
+    result = auth->validate_remote_identity(
+                auth,
+                &remote_identity_handle2,
+                &local_auth_request_token,
+                &g_remote_auth_request_token,
+                local_identity_handle,
+                &remote_identity_token,
+                &remote_participant_guid2,
+                &exception);
+
+    if ((result != DDS_SECURITY_VALIDATION_PENDING_HANDSHAKE_REQUEST) &&
+            (result != DDS_SECURITY_VALIDATION_PENDING_HANDSHAKE_MESSAGE)) {
+        printf("validate_remote_identity_failed: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+
+    reset_exception(&exception);
+    deinitialize_identity_token(&remote_identity_token);
+    DDS_Security_DataHolder_deinit(&local_auth_request_token);
+
+    remote_participant_data1 = DDS_Security_ParticipantBuiltinTopicData_alloc();
+    memcpy(&remote_participant_data1->key[0], &remote_participant_guid1, 12);
+    remote_participant_data1->key[0] = fromBE4u(remote_participant_data1->key[0]);
+    remote_participant_data1->key[1] = fromBE4u(remote_participant_data1->key[1]);
+    remote_participant_data1->key[2] = fromBE4u(remote_participant_data1->key[2]);
+
+    initialize_identity_token(&remote_participant_data1->identity_token, RSA_2048_ALGORITHM_NAME, RSA_2048_ALGORITHM_NAME);
+    fill_permissions_token(&remote_participant_data1->permissions_token );
+
+    remote_participant_data1->security_info.participant_security_attributes = 0x01;
+    remote_participant_data1->security_info.plugin_participant_security_attributes = 0x02;
+
+    remote_participant_data2 = DDS_Security_ParticipantBuiltinTopicData_alloc();
+    memcpy(&remote_participant_data2->key[0], &remote_participant_guid2, 12);
+    remote_participant_data2->key[0] = fromBE4u(remote_participant_data2->key[0]);
+    remote_participant_data2->key[1] = fromBE4u(remote_participant_data2->key[1]);
+    remote_participant_data2->key[2] = fromBE4u(remote_participant_data2->key[2]);
+
+    initialize_identity_token(&remote_participant_data2->identity_token, RSA_2048_ALGORITHM_NAME, RSA_2048_ALGORITHM_NAME);
+    fill_permissions_token(&remote_participant_data2->permissions_token );
+
+    remote_participant_data2->security_info.participant_security_attributes = 0x01;
+    remote_participant_data2->security_info.plugin_participant_security_attributes = 0x02;
+
+    remote_participant_data3 = DDS_Security_ParticipantBuiltinTopicData_alloc();
+    memcpy(&remote_participant_data3->key[0], &candidate_participant_guid, 12);
+
+    initialize_identity_token(&remote_participant_data3->identity_token, RSA_2048_ALGORITHM_NAME, RSA_2048_ALGORITHM_NAME);
+    fill_permissions_token(&remote_participant_data3->permissions_token );
+
+    remote_participant_data2->security_info.participant_security_attributes = 0x01;
+    remote_participant_data2->security_info.plugin_participant_security_attributes = 0x02;
+
+    challenge1_predefined_glb = find_binary_property(&g_remote_auth_request_token, AUTH_REQUEST_TOKEN_FUTURE_PROP_NAME);
+    challenge2_predefined_glb = challenge1_predefined_glb;
+
+    return res;
+}
+
+static void
+release_remote_identities(void)
+{
+    DDS_Security_SecurityException exception = {NULL, 0, 0};
+    DDS_Security_boolean success;
+
+    if (remote_identity_handle != DDS_SECURITY_HANDLE_NIL) {
+        success = auth->return_identity_handle(auth, remote_identity_handle, &exception);
+        if (!success) {
+            printf("return_identity_handle failed: %s\n", exception.message ? exception.message : "Error message missing");
+        }
+        reset_exception(&exception);
+    }
+
+    if (remote_identity_handle2 != DDS_SECURITY_HANDLE_NIL) {
+        success = auth->return_identity_handle(auth, remote_identity_handle2, &exception);
+        if (!success) {
+            printf("return_identity_handle failed: %s\n", exception.message ? exception.message : "Error message missing");
+        }
+        reset_exception(&exception);
+    }
+
+    DDS_Security_DataHolder_deinit(&g_local_auth_request_token);
+    DDS_Security_DataHolder_deinit(&g_remote_auth_request_token);
+
+    DDS_Security_ParticipantBuiltinTopicData_free(remote_participant_data1);
+    DDS_Security_ParticipantBuiltinTopicData_free(remote_participant_data2);
+    DDS_Security_ParticipantBuiltinTopicData_free(remote_participant_data3);
+}
+
+
+static void
+fill_handshake_message_token(
+    DDS_Security_HandshakeMessageToken *token,
+    DDS_Security_ParticipantBuiltinTopicData *pdata,
+    const char *certificate,
+    const char *dsign,
+    const char *kagree,
+    const struct octet_seq *diffie_hellman1,
+    const unsigned char *challengeData,
+    unsigned int challengeDataSize,
+    const struct octet_seq *diffie_hellman2,
+    const unsigned char *challengeData2,
+    unsigned int challengeDataSize2,
+    const DDS_Security_BinaryProperty_t *hash1_from_request,
+    const DDS_Security_BinaryProperty_t *hash2_from_reply,
+    HandshakeStep_t step)
+{
+    DDS_Security_BinaryProperty_t *tokens;
+    DDS_Security_BinaryProperty_t *c_id;
+    DDS_Security_BinaryProperty_t *c_perm;
+    DDS_Security_BinaryProperty_t *c_pdata;
+    DDS_Security_BinaryProperty_t *c_dsign_algo;
+    DDS_Security_BinaryProperty_t *c_kagree_algo;
+    DDS_Security_BinaryProperty_t *hash_c1;
+    DDS_Security_BinaryProperty_t *hash_c2;
+    DDS_Security_BinaryProperty_t *dh1;
+    DDS_Security_BinaryProperty_t *dh2;
+    DDS_Security_BinaryProperty_t *challenge1;
+    DDS_Security_BinaryProperty_t *challenge2;
+    DDS_Security_BinaryProperty_t *signature;
+    DDS_Security_SecurityException exception = {NULL, 0, 0};
+    unsigned idx;
+    unsigned char *serialized_local_participant_data;
+    size_t serialized_local_participant_data_size;
+    /*unsigned hash[32];*/
+
+    switch( step )
+    {
+
+    case HANDSHAKE_REQUEST:
+       tokens = DDS_Security_BinaryPropertySeq_allocbuf(8);
+       c_id = &tokens[0];
+       c_perm = &tokens[1];
+       c_pdata = &tokens[2];
+       c_dsign_algo = &tokens[3];
+       c_kagree_algo = &tokens[4];
+       hash_c1 = &tokens[5];
+       dh1 = &tokens[6];
+       challenge1 = &tokens[7];
+
+        serializer_participant_data(pdata, &serialized_local_participant_data, &serialized_local_participant_data_size);
+
+       /* Store the Identity Certificate associated with the local identify in c.id property */
+       if (certificate) {
+           set_binary_property_string(c_id, "c.id", certificate);
+       } else {
+           set_binary_property_string(c_id, "c.idx", "rubbish");
+       }
+
+       /* Store the permission document in the c.perm property */
+       set_binary_property_string(c_perm, "c.perm", "permissions_document");
+
+       /* Store the provided local_participant_data in the c.pdata property */
+       set_binary_property_value(c_pdata, "c.pdata", serialized_local_participant_data, (uint32_t)serialized_local_participant_data_size);
+       ddsrt_free(serialized_local_participant_data);
+
+       /* Set the used signing algorithm descriptor in c.dsign_algo */
+       if (dsign) {
+           set_binary_property_string(c_dsign_algo, "c.dsign_algo", dsign);
+       } else {
+           set_binary_property_string(c_dsign_algo, "c.dsign_algox", "rubbish");
+       }
+
+       /* Set the used key algorithm descriptor in c.kagree_algo */
+       if (kagree) {
+           set_binary_property_string(c_kagree_algo, "c.kagree_algo", kagree);
+       } else {
+           set_binary_property_string(c_kagree_algo, "c.kagree_algox", "rubbish");
+       }
+
+       /* Calculate the hash_c1 */
+       {
+           DDS_Security_BinaryPropertySeq bseq;
+           DDS_Security_Serializer serializer;
+           unsigned char hash1_sent_in_request_arr[32];
+           unsigned char *buffer;
+           size_t size;
+
+           bseq._length = bseq._maximum = 5;
+           bseq._buffer = tokens;
+
+           serializer = DDS_Security_Serializer_new(1024, 1024);
+
+           DDS_Security_Serialize_BinaryPropertySeq(serializer, &bseq);
+           DDS_Security_Serializer_buffer(serializer, &buffer, &size);
+           SHA256(buffer, size, hash1_sent_in_request_arr);
+           ddsrt_free(buffer);
+           DDS_Security_Serializer_free(serializer);
+
+           set_binary_property_value(hash_c1, "hash_c1", hash1_sent_in_request_arr, sizeof(hash1_sent_in_request_arr));
+       }
+
+       /* Set the DH public key associated with the local participant in dh1 property */
+       if (diffie_hellman1) {
+           set_binary_property_value(dh1, "dh1", diffie_hellman1->data, diffie_hellman1->length);
+       } else {
+           set_binary_property_string(dh1, "dh1x", "rubbish");
+       }
+
+       /* Set the challenge in challenge1 property */
+       if (challengeData) {
+           set_binary_property_value(challenge1, "challenge1", challengeData, challengeDataSize);
+       } else {
+           set_binary_property_value(challenge1, "challenge1x", challenge1_predefined_glb->value._buffer, challenge1_predefined_glb->value._length);
+       }
+
+       token->class_id = ddsrt_strdup(AUTH_HANDSHAKE_REQUEST_TOKEN_CLASS_ID);
+       token->binary_properties._length = token->binary_properties._maximum = 8;
+       token->binary_properties._buffer = tokens;
+       break;
+
+    case HANDSHAKE_REPLY:
+        tokens = DDS_Security_BinaryPropertySeq_allocbuf(12);
+        idx = 0;
+        c_id = &tokens[idx++];
+        c_perm = &tokens[idx++];
+        c_pdata = &tokens[idx++];
+        c_dsign_algo = &tokens[idx++];
+        c_kagree_algo = &tokens[idx++];
+        hash_c2 = &tokens[idx++];
+        challenge2 = &tokens[idx++];
+        dh2 = &tokens[idx++];
+        challenge1 = &tokens[idx++];
+        dh1 = &tokens[idx++];
+        hash_c1 = &tokens[idx++] ;
+        signature = &tokens[idx++];
+
+        serializer_participant_data(pdata, &serialized_local_participant_data, &serialized_local_participant_data_size);
+
+        /* Store the Identity Certificate associated with the local identify in c.id property */
+        if (certificate) {
+           set_binary_property_string(c_id, "c.id", certificate);
+        } else {
+           set_binary_property_string(c_id, "c.idx", "rubbish");
+        }
+
+        /* Store the permission document in the c.perm property */
+        set_binary_property_string(c_perm, "c.perm", "permissions_document");
+
+        /* Store the provided local_participant_data in the c.pdata property */
+        set_binary_property_value(c_pdata, "c.pdata", serialized_local_participant_data, (uint32_t)serialized_local_participant_data_size);
+        ddsrt_free(serialized_local_participant_data);
+
+        /* Set the used signing algorithm descriptor in c.dsign_algo */
+        if (dsign) {
+           set_binary_property_string(c_dsign_algo, "c.dsign_algo", dsign);
+        } else {
+           set_binary_property_string(c_dsign_algo, "c.dsign_algox", "rubbish");
+        }
+
+        /* Set the used key algorithm descriptor in c.kagree_algo */
+        if (kagree) {
+           set_binary_property_string(c_kagree_algo, "c.kagree_algo", kagree);
+        } else {
+           set_binary_property_string(c_kagree_algo, "c.kagree_algox", "rubbish");
+        }
+
+        CU_ASSERT(hash1_from_request != NULL);
+
+        set_binary_property_value(hash_c1, "hash_c1", hash1_from_request->value._buffer, hash1_from_request->value._length);
+
+        /* Calculate the hash_c2 */
+        {
+           DDS_Security_BinaryPropertySeq bseq;
+           DDS_Security_Serializer serializer;
+           unsigned char hash2_sent_in_reply_arr[32];
+           unsigned char *buffer;
+           size_t size;
+
+           bseq._length = bseq._maximum = 5;
+           bseq._buffer = tokens;
+
+           serializer = DDS_Security_Serializer_new(1024, 1024);
+
+           DDS_Security_Serialize_BinaryPropertySeq(serializer, &bseq);
+           DDS_Security_Serializer_buffer(serializer, &buffer, &size);
+           SHA256(buffer, size, hash2_sent_in_reply_arr);
+
+           ddsrt_free(buffer);
+           DDS_Security_Serializer_free(serializer);
+
+           set_binary_property_value(hash_c2, "hash_c2", hash2_sent_in_reply_arr, sizeof(hash2_sent_in_reply_arr));
+        }
+
+        /* Set the challenge in challenge1 property */
+        if (challengeData) {
+          set_binary_property_value(challenge1, "challenge1", challengeData, challengeDataSize);
+        } else {
+          set_binary_property_value(challenge1, "challenge1x", challenge2->value._buffer, challenge2->value._length);
+        }
+
+        /* Set the challenge in challenge2 property */
+        if (challengeData2) {
+           set_binary_property_value(challenge2, "challenge2", challengeData2, challengeDataSize2);
+        } else {
+           set_binary_property_value(challenge2, "challenge2x", challenge2->value._buffer, challenge2->value._length);
+        }
+
+
+        /* Set the DH public key associated with the local participant in dh1 property */
+        if (diffie_hellman1) {
+          set_binary_property_value(dh1, "dh1", diffie_hellman1->data, diffie_hellman1->length);
+        } else {
+          set_binary_property_string(dh1, "dh1x", "rubbish");
+        }
+
+        /* Set the DH public key associated with the local participant in dh2 property */
+        if (diffie_hellman2) {
+          set_binary_property_value(dh2, "dh2", diffie_hellman2->data, diffie_hellman2->length);
+        } else {
+          set_binary_property_string(dh2, "dh2x", "rubbish");
+        }
+
+        /* Calculate the signature */
+        {
+            BIO *bio;
+            EVP_PKEY *private_key_x509;
+            unsigned char *sign;
+            size_t signlen;
+
+            const DDS_Security_BinaryProperty_t * binary_properties[ HANDSHAKE_SIGNATURE_SIZE ];
+
+            /* load certificate in buffer */
+            bio = BIO_new_mem_buf((const char *) bob_private_key, -1);
+            assert( bio );
+            private_key_x509 = PEM_read_bio_PrivateKey(bio, NULL, NULL, NULL);
+            assert (private_key_x509 );
+
+            binary_properties[0] = hash_c2;
+            binary_properties[1] = challenge2;
+            binary_properties[2] = dh2;
+            binary_properties[3] = challenge1;
+            binary_properties[4] = dh1;
+            binary_properties[5] = hash_c1;
+
+            if (create_signature_for_test(private_key_x509, binary_properties, HANDSHAKE_SIGNATURE_SIZE , &sign, &signlen, &exception) != DDS_SECURITY_VALIDATION_OK)
+            {
+                printf("Exception: %s\n", exception.message);
+            }
+            set_binary_property_value(signature, "signature", sign, (uint32_t)signlen);
+
+            ddsrt_free(sign);
+            EVP_PKEY_free(private_key_x509);
+            BIO_free(bio);
+        }
+
+        token->class_id = ddsrt_strdup(AUTH_HANDSHAKE_REPLY_TOKEN_CLASS_ID);
+        token->binary_properties._length = token->binary_properties._maximum = 12;
+        token->binary_properties._buffer = tokens;
+        break;
+
+    case HANDSHAKE_FINAL:
+        tokens = DDS_Security_BinaryPropertySeq_allocbuf(7);
+        idx = 0;
+        signature = &tokens[idx++];
+        hash_c1 = &tokens[idx++];
+        challenge1 = &tokens[idx++];
+        dh1 = &tokens[idx++];
+        challenge2 = &tokens[idx++];
+        dh2 = &tokens[idx++];
+        hash_c2 = &tokens[idx++];
+
+        CU_ASSERT(hash1_from_request != NULL);
+        CU_ASSERT(hash2_from_reply != NULL);
+
+        set_binary_property_value(hash_c1, "hash_c1", hash1_from_request->value._buffer, hash1_from_request->value._length);
+        set_binary_property_value(hash_c2, "hash_c2", hash2_from_reply->value._buffer, hash2_from_reply->value._length);
+
+        printf("process: %s\n", hash_c1->name);
+
+        /* Set the challenge in challenge1 property */
+        if (challengeData) {
+          set_binary_property_value(challenge1, "challenge1", challengeData, challengeDataSize);
+        } else {
+          set_binary_property_value(challenge1, "challenge1x", challenge2->value._buffer, challenge2->value._length);
+        }
+
+        /* Set the challenge in challenge2 property */
+        if (challengeData2) {
+           set_binary_property_value(challenge2, "challenge2", challengeData2, challengeDataSize2);
+        } else {
+           set_binary_property_value(challenge2, "challenge2x", challenge2->value._buffer, challenge2->value._length);
+        }
+
+
+        /* Set the DH public key associated with the local participant in dh1 property */
+        if (diffie_hellman1) {
+          set_binary_property_value(dh1, "dh1", diffie_hellman1->data, diffie_hellman1->length);
+        } else {
+          set_binary_property_string(dh1, "dh1x", "rubbish");
+        }
+
+        /* Set the DH public key associated with the local participant in dh2 property */
+        if (diffie_hellman2) {
+          set_binary_property_value(dh2, "dh2", diffie_hellman2->data, diffie_hellman2->length);
+        } else {
+          set_binary_property_string(dh2, "dh2x", "rubbish");
+        }
+
+        /* Calculate the signature */
+        {
+            BIO *bio;
+            EVP_PKEY *private_key_x509;
+            unsigned char *sign;
+            size_t signlen;
+            const DDS_Security_BinaryProperty_t * binary_properties[ HANDSHAKE_SIGNATURE_SIZE ];
+
+            /* load certificate in buffer */
+            bio = BIO_new_mem_buf((const char *) bob_private_key, -1);
+            assert( bio );
+            private_key_x509 = PEM_read_bio_PrivateKey(bio, NULL, NULL, NULL);
+            assert (private_key_x509 );
+
+            binary_properties[0] = hash_c1;
+            binary_properties[1] = challenge1;
+            binary_properties[2] = dh1;
+            binary_properties[3] = challenge2;
+            binary_properties[4] = dh2;
+            binary_properties[5] = hash_c2;
+
+            if (create_signature_for_test(private_key_x509, binary_properties, HANDSHAKE_SIGNATURE_SIZE, &sign, &signlen, &exception) != DDS_SECURITY_VALIDATION_OK)
+            {
+                printf("Exception: %s\n", exception.message);
+            }
+            set_binary_property_value(signature, "signature", sign, (uint32_t)signlen);
+
+            ddsrt_free(sign);
+            EVP_PKEY_free(private_key_x509);
+            BIO_free(bio);
+        }
+        token->class_id = ddsrt_strdup(AUTH_HANDSHAKE_FINAL_TOKEN_CLASS_ID);
+        token->binary_properties._length = token->binary_properties._maximum = 7;
+        token->binary_properties._buffer = tokens;
+        break;
+    }
+}
+
+
+static DDS_Security_boolean
+on_revoke_identity_cb( dds_security_authentication_listener *instance,
+                 const dds_security_authentication *plugin,
+                 const DDS_Security_IdentityHandle handle)
+{
+    DDSRT_UNUSED_ARG( instance );
+    DDSRT_UNUSED_ARG( plugin );
+    if (identity_handle_for_callback1 == DDS_SECURITY_HANDLE_NIL) {
+        identity_handle_for_callback1 = handle;
+    } else if (identity_handle_for_callback2 == DDS_SECURITY_HANDLE_NIL) {
+        identity_handle_for_callback2 = handle;
+    }
+    printf( "Listener called for handle: %lld  Local:%lld Remote:%lld\n", (long long) handle, (long long) local_identity_handle, (long long) remote_identity_handle2);
+
+    return true;
+}
+
+
+/* sets listener for authentication expiry and checks if the listener triggered after a while */
+CU_Test(ddssec_builtin_listeners_auth, local_remote_set_before_validation)
+{
+    DDS_Security_PermissionsHandle result;
+    DDS_Security_PermissionsToken permissions_token;
+    DDS_Security_AuthenticatedPeerCredentialToken credential_token;
+    DDS_Security_SecurityException exception = {NULL, 0, 0};
+    DDS_Security_long valid;
+    int r;
+    dds_duration_t time_left =  DDS_MSECS(10000);
+    DDS_Security_boolean local_expired = false;
+    DDS_Security_boolean remote_expired = false;
+    DDS_Security_HandshakeHandle handshake_handle;
+    DDS_Security_HandshakeMessageToken handshake_reply_token_in = DDS_SECURITY_TOKEN_INIT;
+    DDS_Security_HandshakeMessageToken handshake_token_out = DDS_SECURITY_TOKEN_INIT;
+    DDS_Security_HandshakeMessageToken handshake_reply_token_out = DDS_SECURITY_TOKEN_INIT;
+    const DDS_Security_BinaryProperty_t *hash1_sent_in_request;
+    const DDS_Security_BinaryProperty_t *dh1;
+    const DDS_Security_BinaryProperty_t *challenge1_glb;
+    struct octet_seq dh1_pub_key;
+    char *remote_certificate_file;
+
+    local_expiry_date = DDS_TIME_INVALID;
+    remote_expiry_date = DDS_TIME_INVALID;
+
+    auth_listener.on_revoke_identity = &on_revoke_identity_cb;
+
+    auth->set_listener( auth, &auth_listener, &exception);
+    access_control->set_listener( access_control,
+                        &access_control_listener,
+                        &exception);
+
+
+    valid = validate_local_identity_and_permissions( 3, &local_expiry_date);
+    if (valid == DDS_SECURITY_ERR_VALIDITY_PERIOD_EXPIRED_CODE) {
+        /* This can happen on very slow platforms or when doing a valgrind run.
+         * Just take our losses and quit, simulating a success. */
+        return;
+    }
+    CU_ASSERT_FATAL (valid == DDS_SECURITY_ERR_OK_CODE);
+
+    /*Generate remote certificate*/
+    create_certificate_from_csr( bob_csr, 4, BOB_IDENTITY_CERT_FILE, &remote_expiry_date );
+
+    ddsrt_asprintf(&remote_certificate_file, "%s%s", g_path_build_dir, BOB_IDENTITY_CERT_FILE);
+    bob_identity_cert = load_file_contents( remote_certificate_file );
+
+    validate_remote_identity( bob_identity_cert );
+
+
+    /* Check if we actually have validate_remote_permissions function. */
+    CU_ASSERT_FATAL (access_control != NULL);
+    CU_ASSERT_FATAL (local_identity_handle != DDS_SECURITY_HANDLE_NIL);
+    CU_ASSERT_FATAL (access_control->validate_remote_permissions != NULL);
+    CU_ASSERT_FATAL (access_control->return_permissions_handle != NULL);
+
+    fill_permissions_token(&permissions_token);
+    r = fill_peer_credential_token(&credential_token);
+    CU_ASSERT_FATAL (r);
+
+
+
+    /*handshake*/
+    result = auth->begin_handshake_request(
+                    auth,
+                    &handshake_handle,
+                    &handshake_token_out,
+                    local_identity_handle,
+                    remote_identity_handle2,
+                    &serialized_participant_data,
+                    &exception);
+
+    if (result != DDS_SECURITY_VALIDATION_PENDING_HANDSHAKE_MESSAGE) {
+        printf("begin_handshake_request failed: %s\n", exception.message ? exception.message : "Error message missing");
+    }
+
+    /* get challenge 1 from the message */
+    challenge1_glb = find_binary_property(&handshake_token_out, "challenge1");
+
+    /*Get DH1 value */
+    dh1 = find_binary_property(&handshake_token_out, "dh1");
+
+    hash1_sent_in_request = find_binary_property(&handshake_token_out, "hash_c1");
+
+    CU_ASSERT_FATAL(dh1 != NULL);
+    CU_ASSERT_FATAL(dh1->value._length > 0);
+    CU_ASSERT_FATAL(dh1->value._buffer != NULL);
+
+    dh1_pub_key.data = dh1->value._buffer;
+    dh1_pub_key.length = dh1->value._length;
+
+    /* prepare reply */
+    fill_handshake_message_token(
+        &handshake_reply_token_in, remote_participant_data2, bob_identity_cert,
+        AUTH_DSIGN_ALGO_RSA_NAME, AUTH_KAGREE_ALGO_ECDH_NAME,
+        &dh1_pub_key, challenge1_glb->value._buffer, challenge1_glb->value._length,
+        &dh_ecdh_pub_key, challenge2_predefined_glb->value._buffer, challenge2_predefined_glb->value._length, hash1_sent_in_request, NULL, HANDSHAKE_REPLY);
+
+    reset_exception(&exception);
+
+    result = auth->process_handshake(
+                        auth,
+                        &handshake_reply_token_out,
+                        &handshake_reply_token_in,
+                        handshake_handle,
+                        &exception);
+
+    CU_ASSERT_FATAL(result == DDS_SECURITY_VALIDATION_OK_FINAL_MESSAGE);
+    CU_ASSERT(handshake_handle != DDS_SECURITY_HANDLE_NIL);
+
+    result = access_control->validate_remote_permissions(
+                access_control,
+                auth,
+                local_identity_handle,
+                remote_identity_handle,
+                &permissions_token,
+                &credential_token,
+                &exception);
+
+    if (result == 0) {
+        printf("validate_remote_permissions_failed: %s\n", exception.message ? exception.message : "Error message missing");
+        //TODO: Clean-up before failing
+        CU_ASSERT_FATAL (exception.code == DDS_SECURITY_ERR_VALIDITY_PERIOD_EXPIRED_CODE);
+//        goto end;
+
+    }
+
+    remote_permissions_handle = result;
+
+    reset_exception(&exception);
+
+    while( time_left > 0 && (!local_expired || !remote_expired) ){
+        /* Normally, it is expected that the remote expiry is triggered before the
+         * local one. However, that can change on slow platforms. */
+        // TODO: Check for time compare
+        if (remote_expiry_date < local_expiry_date) {
+            if (identity_handle_for_callback1 == remote_identity_handle2) {
+                remote_expired = true;
+            }
+            if (identity_handle_for_callback2 == local_identity_handle) {
+                local_expired = true;
+            }
+        } else {
+            if (identity_handle_for_callback2 == remote_identity_handle2) {
+                remote_expired = true;
+            }
+            if (identity_handle_for_callback1 == local_identity_handle) {
+                local_expired = true;
+            }
+        }
+
+        dds_sleepfor(DDS_MSECS(100));
+        time_left -= DDS_MSECS(100);
+    }
+
+    CU_ASSERT (local_expired);
+    CU_ASSERT (remote_expired);
+
+
+    reset_exception(&exception);
+
+    result = auth->return_handshake_handle(auth, handshake_handle, &exception);
+    release_remote_identities();
+
+    DDS_Security_DataHolder_deinit((DDS_Security_DataHolder *) &permissions_token);
+    DDS_Security_DataHolder_deinit((DDS_Security_DataHolder *) &credential_token);
+
+
+    CU_ASSERT_TRUE (result == 1);
+
+    reset_exception(&exception);
+
+    DDS_Security_DataHolder_deinit(&handshake_token_out);
+    DDS_Security_DataHolder_deinit(&handshake_reply_token_in);
+    DDS_Security_DataHolder_deinit(&handshake_reply_token_out);
+
+    clear_local_identity_and_permissions();
+    ddsrt_free( bob_identity_cert );
+    ddsrt_free ( remote_certificate_file );
+}
diff --git a/src/security/builtin_plugins/tests/process_handshake/src/process_handshake_utests.c b/src/security/builtin_plugins/tests/process_handshake/src/process_handshake_utests.c
index 9eaf2d1..5b2f5d6 100644
--- a/src/security/builtin_plugins/tests/process_handshake/src/process_handshake_utests.c
+++ b/src/security/builtin_plugins/tests/process_handshake/src/process_handshake_utests.c
@@ -523,7 +523,7 @@ validate_local_identity(const char* trusted_ca_dir)
         char trusted_ca_dir_path[1024];
         dds_security_property_init(&participant_qos.property.value, 4);
 #ifdef WIN32
-    snprintf(trusted_ca_dir_path, 1024, "%s\\testsuite\\dbt\\security_plugin\\tests\\validate_begin_handshake_reply\\etc\\%s", CONFIG_ENV_TESTS_DIR,trusted_ca_dir);
+    snprintf(trusted_ca_dir_path, 1024, "%s\\validate_begin_handshake_reply\\etc\\%s", CONFIG_ENV_TESTS_DIR, trusted_ca_dir);
 #else
     snprintf(trusted_ca_dir_path, 1024, "%s/validate_begin_handshake_reply/etc/%s", CONFIG_ENV_TESTS_DIR, trusted_ca_dir);
 #endif
diff --git a/src/security/builtin_plugins/tests/validate_begin_handshake_reply/src/validate_begin_handshake_reply_utests.c b/src/security/builtin_plugins/tests/validate_begin_handshake_reply/src/validate_begin_handshake_reply_utests.c
index b3871db..90cb2a7 100644
--- a/src/security/builtin_plugins/tests/validate_begin_handshake_reply/src/validate_begin_handshake_reply_utests.c
+++ b/src/security/builtin_plugins/tests/validate_begin_handshake_reply/src/validate_begin_handshake_reply_utests.c
@@ -220,7 +220,7 @@ static const char *unrelated_identity =
         "B7DMeaVlLClGQaKZZ7aexEx9se+IyLn2\n"
         "-----END CERTIFICATE-----\n";
 
-#ifdef TRUSTED_CA_DIR_IMPLEMENTED
+
 static const char *remote_identity_trusted =
                 "-----BEGIN CERTIFICATE-----\n"
                 "MIIDcDCCAligAwIBAgIBBTANBgkqhkiG9w0BAQsFADByMQswCQYDVQQGEwJOTDEL\n"
@@ -297,7 +297,6 @@ static const char *remote_identity_trusted_expired =
                 "O3gAjPUL0jzRztp5Yj3dYPV8YyJHLEKr75IXNedV9YKhT4f6kTS3UEjMTqYbYsix\n"
                 "MtqgY283RjsExzjNvw==\n"
                 "-----END CERTIFICATE-----\n";
-#endif
 
 static struct plugins_hdl *plugins = NULL;
 static dds_security_authentication *auth = NULL;
@@ -1968,10 +1967,7 @@ CU_Test(ddssec_builtin_validate_begin_handshake_reply,return_handle,  .init = in
 
 }
 
-/*TODO: test is waiting for Trusted CA parsing function */
-
-#if(0)
-CU _ Test(validate_begin_handshake_reply,extended_certificate_check )
+CU_Test(validate_begin_handshake_reply,extended_certificate_check,  .init = init_testcase, .fini = fini_testcase )
 {
     DDS_Security_ValidationResult_t result;
     DDS_Security_HandshakeHandle handshake_handle;
@@ -2107,4 +2103,3 @@ CU _ Test(validate_begin_handshake_reply,extended_certificate_check )
     handshake_message_deinit(&handshake_token_out);
     reset_exception(&exception);
 }
-#endif
diff --git a/src/security/builtin_plugins/tests/validate_local_identity/src/validate_local_identity_utests.c b/src/security/builtin_plugins/tests/validate_local_identity/src/validate_local_identity_utests.c
index 5d17ebd..59a5567 100644
--- a/src/security/builtin_plugins/tests/validate_local_identity/src/validate_local_identity_utests.c
+++ b/src/security/builtin_plugins/tests/validate_local_identity/src/validate_local_identity_utests.c
@@ -2017,10 +2017,8 @@ CU_Test(ddssec_builtin_validate_local_identity,no_file)
 
 }
 
-/* TODO: Should be enabled after implementing trusted ca dir parsing*/
-#if(0)
-CU _ Test(validate_local_identity,with_extended_certificate_check)
-{
+CU_Test(ddssec_builtin_validate_local_identity,with_extended_certificate_check)
+{ 
     DDS_Security_ValidationResult_t result;
     DDS_Security_IdentityHandle local_identity_handle = DDS_SECURITY_HANDLE_NIL;
     DDS_Security_GUID_t adjusted_participant_guid;
@@ -2042,7 +2040,7 @@ CU _ Test(validate_local_identity,with_extended_certificate_check)
 
     fill_participant_qos(&participant_qos, false, identity_certificate,
                                            false, identity_ca,
-                                           false, private_key,
+                                           false, private_key_pem,
                                            NULL,
                                            "trusted_ca_dir");
     /* Now call the function. */
@@ -2106,4 +2104,3 @@ CU _ Test(validate_local_identity,with_extended_certificate_check)
 
 
 }
-#endif
diff --git a/src/security/core/include/dds/security/core/dds_security_timed_cb.h b/src/security/core/include/dds/security/core/dds_security_timed_cb.h
index 6a883d6..93b2eb4 100644
--- a/src/security/core/include/dds/security/core/dds_security_timed_cb.h
+++ b/src/security/core/include/dds/security/core/dds_security_timed_cb.h
@@ -25,7 +25,11 @@ extern "C" {
  */
 struct dds_security_timed_dispatcher_t;
 
-struct dds_security_timed_cb_data_t;
+/**
+ * The timed callback structure holds a list of dispatchers and manages
+ * the thread that calls the dispatchers callbacks.
+ */
+struct dds_security_timed_cb_data;
 
 /**
  * The callback is triggered by two causes:
diff --git a/src/security/core/src/dds_security_utils.c b/src/security/core/src/dds_security_utils.c
index 8a5cef7..42610af 100644
--- a/src/security/core/src/dds_security_utils.c
+++ b/src/security/core/src/dds_security_utils.c
@@ -1291,3 +1291,4 @@ DDS_Security_parse_xml_date(
 
   return DDS_TIME_INVALID;
 }
+

From d24bf4d27d1b29122140b259c0e31e2f41f6c2dd Mon Sep 17 00:00:00 2001
From: MarcelJordense <37329887+MarcelJordense@users.noreply.github.com>
Date: Mon, 10 Feb 2020 13:24:51 +0100
Subject: [PATCH 096/238] Update authentication plugin with respect to the
 remote identity handle (#379)

* Authentication plugin determine remote identity handle on participant match

Signed-off-by: Marcel Jordense <marcel.jordense@adlinktech.com>

* Correct authentication plugin

Signed-off-by: Marcel Jordense <marcel.jordense@adlinktech.com>
---
 .../authentication/src/authentication.c       | 587 ++++++++----------
 1 file changed, 243 insertions(+), 344 deletions(-)

diff --git a/src/security/builtin_plugins/authentication/src/authentication.c b/src/security/builtin_plugins/authentication/src/authentication.c
index a3d5ea7..257debc 100644
--- a/src/security/builtin_plugins/authentication/src/authentication.c
+++ b/src/security/builtin_plugins/authentication/src/authentication.c
@@ -21,6 +21,7 @@
 #include <openssl/evp.h>
 #include "authentication.h"
 #include "dds/ddsrt/heap.h"
+#include "dds/ddsrt/avl.h"
 #include "dds/security/dds_security_api.h"
 #include "dds/security/core/dds_security_timed_cb.h"
 
@@ -119,9 +120,9 @@ typedef enum {
 typedef enum {
   CREATEDREQUEST,
   CREATEDREPLY
-
 } CreatedHandshakeStep_t;
 
+
 typedef struct SecurityObject SecurityObject;
 
 typedef void (*SecurityObjectDestructor)(SecurityObject *obj);
@@ -129,7 +130,6 @@ typedef void (*SecurityObjectDestructor)(SecurityObject *obj);
 struct SecurityObject {
     int64_t handle;
     SecurityObjectKind_t kind;
-    SecurityObjectDestructor destructor;
 };
 
 
@@ -146,6 +146,35 @@ struct SecurityObject {
 
 #define SECURITY_OBJECT_VALID(o,k)    security_object_valid((SecurityObject *)(o), k)
 
+struct LocalIdentityInfo;
+struct HandshakeInfo;
+
+typedef struct RemoteIdentityInfo {
+    SecurityObject _parent;
+    uint32_t refc;
+    DDS_Security_GUID_t guid;
+    X509 *identityCert;
+    AuthenticationAlgoKind_t dsignAlgoKind;
+    AuthenticationAlgoKind_t kagreeAlgoKind;
+    DDS_Security_IdentityToken *remoteIdentityToken;
+    DDS_Security_OctetSeq pdata;
+    char *permissionsDocument;
+} RemoteIdentityInfo;
+
+/* This structure contains the relation between a local and a remote identity
+ * The handle for this object is the same as the handle of the associated
+ * local identity object. The IdentityRelation object will be stored with the
+ * remote identity.
+ */
+typedef struct IdentityRelation {
+    SecurityObject _parent;
+    ddsrt_avl_node_t avlnode;
+    struct LocalIdentityInfo *localIdentity;
+    struct RemoteIdentityInfo *remoteIdentity;
+    AuthenticationChallenge *lchallenge;
+    AuthenticationChallenge *rchallenge;
+    struct HandshakeInfo *handshake;
+} IdentityRelation;
 
 typedef struct LocalIdentityInfo {
     SecurityObject _parent;
@@ -159,36 +188,12 @@ typedef struct LocalIdentityInfo {
     AuthenticationAlgoKind_t dsignAlgoKind;
     AuthenticationAlgoKind_t kagreeAlgoKind;
     char *permissionsDocument;
+    ddsrt_avl_tree_t relations; /* contains the IdentityRelation objects */
 } LocalIdentityInfo;
 
-typedef struct RemoteIdentityInfo {
-    SecurityObject _parent;
-    DDS_Security_GUID_t guid;
-    X509 *identityCert;
-    AuthenticationAlgoKind_t dsignAlgoKind;
-    AuthenticationAlgoKind_t kagreeAlgoKind;
-    DDS_Security_IdentityToken *remoteIdentityToken;
-    DDS_Security_OctetSeq pdata;
-    char *permissionsDocument;
-    struct ddsrt_hh *linkHash; /* contains the IdentityRelation objects */
-} RemoteIdentityInfo;
-
-
-/* This structure contains the relation between a local and a remote identity
- * The handle for this object is the same as the handle of the associated
- * local identity object. The IdentityRelation object will be stored with the
- * remote identity.
- */
-typedef struct IdentityRelation {
-    SecurityObject _parent;
-    LocalIdentityInfo *localIdentity;
-    RemoteIdentityInfo *remoteIdentity;
-    AuthenticationChallenge *lchallenge;
-    AuthenticationChallenge *rchallenge;
-} IdentityRelation;
-
 typedef struct HandshakeInfo {
     SecurityObject _parent;
+    ddsrt_avl_node_t avlnode;
     IdentityRelation *relation;
     HashValue_t hash_c1;
     HashValue_t hash_c2;
@@ -203,12 +208,10 @@ typedef struct dds_security_authentication_impl {
     ddsrt_mutex_t lock;
     struct ddsrt_hh *objectHash;
     struct ddsrt_hh *remoteGuidHash;
+    struct ddsrt_hh *handshakes;
     struct dds_security_timed_cb_data *timed_callbacks;
     struct dds_security_timed_dispatcher_t *dispatcher;
     X509Seq trustedCAList;
-
-
-
 } dds_security_authentication_impl;
 
 /* data type for timer dispatcher */
@@ -218,6 +221,11 @@ typedef struct {
 } validity_cb_info;
 
 
+static int compare_relation (const void *va, const void *vb);
+
+const ddsrt_avl_treedef_t relations_treedef =
+    DDSRT_AVL_TREEDEF_INITIALIZER_INDKEY (offsetof (struct IdentityRelation, avlnode), offsetof (struct IdentityRelation, remoteIdentity), compare_relation, 0);
+
 static bool
 security_object_valid(
     SecurityObject *obj,
@@ -225,14 +233,7 @@ security_object_valid(
 {
     if (!obj) return false;
     if (obj->kind != kind) return false;
-    if (kind == SECURITY_OBJECT_KIND_IDENTITY_RELATION) {
-        IdentityRelation *relation = (IdentityRelation *)obj;
-        if (!relation->localIdentity || !relation->remoteIdentity || (ddsrt_address)obj->handle != (ddsrt_address)relation->localIdentity) {
-            return false;
-        }
-    } else if ((ddsrt_address)obj->handle != (ddsrt_address)obj) {
-        return false;
-    }
+    if ((uintptr_t)obj->handle != (uintptr_t)obj) return false;
     return true;
 }
 
@@ -268,20 +269,31 @@ security_object_find(
 
     template.handle = handle;
 
-    return (SecurityObject *) ddsrt_hh_lookup(hh, &template);;
+    return (SecurityObject *) ddsrt_hh_lookup(hh, &template);
+}
+
+static int compare_relation (const void *va, const void *vb)
+{
+    const struct RemoteIdentityInfo * ha = va;
+    const struct RemoteIdentityInfo * hb = vb;
+
+    if (IDENTITY_HANDLE(ha) < IDENTITY_HANDLE(hb)) {
+        return -1;
+    } else if (IDENTITY_HANDLE(ha) > IDENTITY_HANDLE(hb)) {
+        return 1;
+    }
+   return 0;
 }
 
 static void
 security_object_init(
     SecurityObject *obj,
-    SecurityObjectKind_t kind,
-    SecurityObjectDestructor destructor)
+    SecurityObjectKind_t kind)
 {
     assert(obj);
 
     obj->kind = kind;
-    obj->handle = (int64_t)(ddsrt_address)obj;
-    obj->destructor = destructor;
+    obj->handle = (int64_t)(uintptr_t)obj;
 }
 
 static void
@@ -292,25 +304,8 @@ security_object_deinit(
     assert(obj);
     obj->handle = DDS_SECURITY_HANDLE_NIL;
     obj->kind = SECURITY_OBJECT_KIND_UNKNOWN;
-    obj->destructor = NULL;
 }
 
-static void
-security_object_free(
-    SecurityObject *obj)
-{
-    assert(obj);
-    if (obj && obj->destructor) {
-        obj->destructor(obj);
-    }
-}
-
-static void
-localIdentityInfoFree(
-    SecurityObject *obj);
-
-
-
 static LocalIdentityInfo *
 localIdentityInfoNew(
         DDS_Security_DomainId domainId,
@@ -332,10 +327,7 @@ localIdentityInfoNew(
     identity = ddsrt_malloc(sizeof(*identity));
     memset(identity, 0, sizeof(*identity));
 
-    security_object_init((SecurityObject *)identity, SECURITY_OBJECT_KIND_LOCAL_IDENTITY, localIdentityInfoFree);
-
-
-
+    security_object_init((SecurityObject *)identity, SECURITY_OBJECT_KIND_LOCAL_IDENTITY);
 
     identity->domainId = domainId;
     identity->identityCert = identityCert;
@@ -348,31 +340,33 @@ localIdentityInfoNew(
     memcpy(&identity->candidateGUID, candidate_participant_guid, sizeof(DDS_Security_GUID_t));
     memcpy(&identity->adjustedGUID, adjusted_participant_guid, sizeof(DDS_Security_GUID_t));
 
+    ddsrt_avl_init(&relations_treedef, &identity->relations);
+
     return identity;
 }
 
 static void
 localIdentityInfoFree(
-    SecurityObject *obj)
+    LocalIdentityInfo *info)
 {
-    LocalIdentityInfo *identity = (LocalIdentityInfo *)obj;
+    CHECK_OBJECT_KIND(info, SECURITY_OBJECT_KIND_LOCAL_IDENTITY);
 
-    CHECK_OBJECT_KIND(obj, SECURITY_OBJECT_KIND_LOCAL_IDENTITY);
-
-    if (identity) {
-        if (identity->identityCert) {
-            X509_free(identity->identityCert);
+    if (info) {
+        assert(ddsrt_avl_is_empty(&info->relations));
+        ddsrt_avl_free(&relations_treedef, &info->relations, NULL);
+        if (info->identityCert) {
+            X509_free(info->identityCert);
         }
-        if (identity->identityCA) {
-            X509_free(identity->identityCA);
+        if (info->identityCA) {
+            X509_free(info->identityCA);
         }
-        if (identity->privateKey) {
-            EVP_PKEY_free(identity->privateKey);
+        if (info->privateKey) {
+            EVP_PKEY_free(info->privateKey);
         }
-        ddsrt_free(identity->pdata._buffer);
-        ddsrt_free(identity->permissionsDocument);
-        security_object_deinit((SecurityObject *)identity);
-        ddsrt_free(identity);
+        ddsrt_free(info->pdata._buffer);
+        ddsrt_free(info->permissionsDocument);
+        security_object_deinit((SecurityObject *)info);
+        ddsrt_free(info);
     }
 }
 
@@ -411,10 +405,6 @@ find_remote_identity_by_guid(
     return (RemoteIdentityInfo *) ddsrt_hh_lookup(hh, &template);
 }
 
-static void
-remoteIdentityInfoFree(
-    SecurityObject *obj);
-
 static RemoteIdentityInfo *
 remoteIdentityInfoNew(
         const DDS_Security_GUID_t *guid,
@@ -428,47 +418,39 @@ remoteIdentityInfoNew(
     identity = ddsrt_malloc(sizeof(*identity));
     memset(identity, 0, sizeof(*identity));
 
-    security_object_init((SecurityObject *)identity, SECURITY_OBJECT_KIND_REMOTE_IDENTITY, remoteIdentityInfoFree);
+    security_object_init((SecurityObject *)identity, SECURITY_OBJECT_KIND_REMOTE_IDENTITY);
 
     memcpy(&identity->guid, guid, sizeof(DDS_Security_GUID_t));
+    identity->refc = 0;
     identity->remoteIdentityToken = DDS_Security_DataHolder_alloc();
     DDS_Security_DataHolder_copy(identity->remoteIdentityToken, remote_identity_token);
     identity->identityCert = NULL;
     identity->dsignAlgoKind = AUTH_ALGO_KIND_UNKNOWN;
     identity->kagreeAlgoKind = AUTH_ALGO_KIND_UNKNOWN;
     identity->permissionsDocument = ddsrt_strdup("");
-    identity->linkHash = ddsrt_hh_new(32, security_object_hash, security_object_equal);
 
     return identity;
 }
 
 static void
 remoteIdentityInfoFree(
-    SecurityObject *obj)
+    RemoteIdentityInfo *info)
 {
-    RemoteIdentityInfo *identity = (RemoteIdentityInfo *)obj;
+    CHECK_OBJECT_KIND(info, SECURITY_OBJECT_KIND_REMOTE_IDENTITY);
 
-    CHECK_OBJECT_KIND(obj, SECURITY_OBJECT_KIND_REMOTE_IDENTITY);
-
-    if (identity) {
-        if (identity->identityCert) {
-            X509_free(identity->identityCert);
+    if (info) {
+        assert(info->refc == 0);
+        if (info->identityCert) {
+            X509_free(info->identityCert);
         }
-        DDS_Security_DataHolder_free(identity->remoteIdentityToken);
-
-        ddsrt_hh_free(identity->linkHash);
-
-        ddsrt_free(identity->pdata._buffer);
-        ddsrt_free(identity->permissionsDocument);
-        security_object_deinit((SecurityObject *)identity);
-        ddsrt_free(identity);
+        DDS_Security_DataHolder_free(info->remoteIdentityToken);
+        ddsrt_free(info->pdata._buffer);
+        ddsrt_free(info->permissionsDocument);
+        security_object_deinit((SecurityObject *)info);
+        ddsrt_free(info);
     }
 }
 
-static void
-identityRelationFree(
-    SecurityObject *obj);
-
 /* The IdentityRelation provides the association between a local and a remote
  * identity. This object manages the challenges which are created for
  * each association between a local and a remote identity.
@@ -492,24 +474,23 @@ identityRelationNew(
     relation = ddsrt_malloc(sizeof(*relation));
     memset(relation, 0, sizeof(*relation));
 
-    security_object_init((SecurityObject *)relation, SECURITY_OBJECT_KIND_IDENTITY_RELATION, identityRelationFree);
-    relation->_parent.handle = SECURITY_OBJECT_HANDLE(localIdentity);
+    security_object_init((SecurityObject *)relation, SECURITY_OBJECT_KIND_IDENTITY_RELATION);
 
     relation->localIdentity = localIdentity;
     relation->remoteIdentity = remoteIdentity;
+    remoteIdentity->refc++;
     relation->lchallenge = lchallenge;
     relation->rchallenge = rchallenge;
+    relation->handshake = NULL;
 
     return relation;
 }
 
 static void
 identityRelationFree(
-    SecurityObject *obj)
+    IdentityRelation *relation)
 {
-    IdentityRelation *relation = (IdentityRelation *)obj;
-
-    CHECK_OBJECT_KIND(obj, SECURITY_OBJECT_KIND_IDENTITY_RELATION);
+    CHECK_OBJECT_KIND(relation, SECURITY_OBJECT_KIND_IDENTITY_RELATION);
 
     if (relation) {
         ddsrt_free(relation->lchallenge);
@@ -519,27 +500,16 @@ identityRelationFree(
     }
 }
 
-static void
-handshakeInfoFree(
-    SecurityObject *obj);
-
 static HandshakeInfo *
 handshakeInfoNew(
-    LocalIdentityInfo *localIdentity,
-    RemoteIdentityInfo *remoteIdentity,
     IdentityRelation *relation)
 {
     HandshakeInfo *handshake;
 
-    assert(localIdentity);
-    assert(remoteIdentity);
-
-    DDSRT_UNUSED_ARG(localIdentity);
-    DDSRT_UNUSED_ARG(remoteIdentity);
     handshake = ddsrt_malloc(sizeof(*handshake));
     memset(handshake, 0, sizeof(*handshake));
 
-    security_object_init((SecurityObject *)handshake, SECURITY_OBJECT_KIND_HANDSHAKE, handshakeInfoFree);
+    security_object_init((SecurityObject *)handshake, SECURITY_OBJECT_KIND_HANDSHAKE);
 
     handshake->relation = relation;
     handshake->shared_secret_handle_impl = NULL;
@@ -549,13 +519,14 @@ handshakeInfoNew(
 
 static void
 handshakeInfoFree(
-    SecurityObject *obj)
+    HandshakeInfo *handshake)
 {
-    HandshakeInfo *handshake = (HandshakeInfo *)obj;
-
-    CHECK_OBJECT_KIND(obj, SECURITY_OBJECT_KIND_HANDSHAKE);
+    CHECK_OBJECT_KIND(handshake, SECURITY_OBJECT_KIND_HANDSHAKE);
 
     if (handshake) {
+        assert(handshake->relation && handshake->relation->handshake == handshake);
+        handshake->relation->handshake = NULL;
+
         if (handshake->ldh) {
             EVP_PKEY_free(handshake->ldh);
         }
@@ -571,48 +542,6 @@ handshakeInfoFree(
     }
 }
 
-static IdentityRelation *
-find_identity_relation(
-    const RemoteIdentityInfo *remote,
-    int64_t lid)
-{
-    return (IdentityRelation *)security_object_find(remote->linkHash, lid);
-}
-
-static void
-remove_identity_relation(
-    RemoteIdentityInfo *remote,
-    IdentityRelation *relation)
-{
-    (void)ddsrt_hh_remove(remote->linkHash, relation);
-    security_object_free((SecurityObject *) relation);
-}
-
-static HandshakeInfo *
-find_handshake(
-    const dds_security_authentication_impl *auth,
-    int64_t localId,
-    int64_t remoteId)
-{
-    struct ddsrt_hh_iter it;
-    SecurityObject *obj;
-    IdentityRelation *relation;
-    HandshakeInfo *found = NULL;
-
-    for (obj = ddsrt_hh_iter_first(auth->objectHash, &it); obj && !found; obj = ddsrt_hh_iter_next(&it)) {
-        if (obj->kind == SECURITY_OBJECT_KIND_HANDSHAKE) {
-            relation = ((HandshakeInfo *)obj)->relation;
-            assert(relation);
-            if ((SECURITY_OBJECT_HANDLE(relation->localIdentity) == localId) &&
-                (SECURITY_OBJECT_HANDLE(relation->remoteIdentity) == remoteId)) {
-                found = (HandshakeInfo *)obj;
-            }
-        }
-    }
-
-    return found;
-}
-
 static char *
 get_authentication_class_id(
     void)
@@ -1374,11 +1303,10 @@ validate_remote_identity(
     DDS_Security_ValidationResult_t result = DDS_SECURITY_VALIDATION_OK;
     dds_security_authentication_impl *impl = (dds_security_authentication_impl *) instance;
     SecurityObject *obj;
-    LocalIdentityInfo *localIdent;
-    RemoteIdentityInfo *remoteIdent;
-    IdentityRelation *relation;
+    LocalIdentityInfo *linfo;
+    RemoteIdentityInfo *rinfo;
+    IdentityRelation *relation = NULL;
     AuthenticationChallenge *lchallenge = NULL, *rchallenge = NULL;
-    int r;
 
     /* validate provided arguments */
     if (!instance || !remote_identity_handle || !local_auth_request_token || !remote_identity_token || !remote_participant_guid) {
@@ -1393,10 +1321,10 @@ validate_remote_identity(
         DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "validate_remote_identity: Invalid handle provided");
         goto err_inv_handle;
     }
-    localIdent = (LocalIdentityInfo *) obj;
+    linfo = (LocalIdentityInfo *) obj;
 
     /* Check if the provided remote_identity_token is compatible */
-    result = validate_remote_identity_token(localIdent, remote_identity_token, ex);
+    result = validate_remote_identity_token(linfo, remote_identity_token, ex);
     if (result != DDS_SECURITY_VALIDATION_OK) {
         goto err_remote_identity_token;
     }
@@ -1421,30 +1349,29 @@ validate_remote_identity(
      */
 
     /* Check if the remote identity has already been validated by a previous validation request. */
-    remoteIdent = find_remote_identity_by_guid(impl->remoteGuidHash, remote_participant_guid);
-    if (!remoteIdent) {
-        remoteIdent = remoteIdentityInfoNew(remote_participant_guid, remote_identity_token);
-        (void)ddsrt_hh_add(impl->objectHash, remoteIdent);
-        (void)ddsrt_hh_add(impl->remoteGuidHash, remoteIdent);
-        relation = identityRelationNew(localIdent, remoteIdent, lchallenge, rchallenge);
-        (void)ddsrt_hh_add(remoteIdent->linkHash, relation);
+    rinfo = find_remote_identity_by_guid(impl->remoteGuidHash, remote_participant_guid);
+    if (!rinfo) {
+        rinfo = remoteIdentityInfoNew(remote_participant_guid, remote_identity_token);
+        (void)ddsrt_hh_add(impl->remoteGuidHash, rinfo);
+        relation = identityRelationNew(linfo, rinfo, lchallenge, rchallenge);
+        (void)ddsrt_hh_add(impl->objectHash, relation);
+        ddsrt_avl_insert(&relations_treedef, &linfo->relations, relation);
     } else {
+        ddsrt_avl_ipath_t path;
         /* When the remote identity has already been validated before,
            check if the remote identity token matches with the existing one
          */
-        if (!DDS_Security_DataHolder_equal(remoteIdent->remoteIdentityToken, remote_identity_token)) {
+        if (!DDS_Security_DataHolder_equal(rinfo->remoteIdentityToken, remote_identity_token)) {
             result = DDS_SECURITY_VALIDATION_FAILED;
             DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result,
                     "validate_remote_identity: remote_identity_token does not match with previously received one");
             goto err_inv_duplicate;
         }
-
-        relation = find_identity_relation(remoteIdent, SECURITY_OBJECT_HANDLE(localIdent));
+        relation = ddsrt_avl_lookup_ipath(&relations_treedef, &linfo->relations, rinfo, &path);
         if (!relation) {
-            relation = identityRelationNew(localIdent, remoteIdent, lchallenge, rchallenge);
-            r = ddsrt_hh_add(remoteIdent->linkHash, relation);
-            assert(r);
-            (void)r;
+            relation = identityRelationNew(linfo, rinfo, lchallenge, rchallenge);
+            (void)ddsrt_hh_add(impl->objectHash, relation);
+            ddsrt_avl_insert_ipath(&relations_treedef, &linfo->relations, relation, &path);
         } else {
             if (remote_auth_request_token) {
                 assert(rchallenge);
@@ -1465,9 +1392,9 @@ validate_remote_identity(
         DDS_Security_set_token_nil(local_auth_request_token);
     }
 
-    *remote_identity_handle = IDENTITY_HANDLE(remoteIdent);;
+    *remote_identity_handle = IDENTITY_HANDLE(relation);
 
-    if (memcmp(&localIdent->adjustedGUID, &remoteIdent->guid, sizeof(DDS_Security_GUID_t)) < 0) {
+    if (memcmp(&linfo->adjustedGUID, &rinfo->guid, sizeof(DDS_Security_GUID_t)) < 0) {
         result = DDS_SECURITY_VALIDATION_PENDING_HANDSHAKE_REQUEST;
     } else {
         result = DDS_SECURITY_VALIDATION_PENDING_HANDSHAKE_MESSAGE;
@@ -1502,8 +1429,7 @@ begin_handshake_request(
     HandshakeInfo *handshake = NULL;
     IdentityRelation *relation = NULL;
     SecurityObject *obj;
-    LocalIdentityInfo *localIdent;
-    RemoteIdentityInfo *remoteIdent;
+    LocalIdentityInfo *linfo;
     EVP_PKEY *dhkey;
     DDS_Security_BinaryProperty_t *tokens;
     DDS_Security_BinaryProperty_t *c_id;
@@ -1534,50 +1460,47 @@ begin_handshake_request(
                 "begin_handshake_request: Invalid initiator_identity_handle provided");
         goto err_inv_handle;
     }
-    localIdent = (LocalIdentityInfo *) obj;
+    linfo = (LocalIdentityInfo *) obj;
 
     obj = security_object_find(impl->objectHash, replier_identity_handle);
-    if (!obj || !security_object_valid(obj, SECURITY_OBJECT_KIND_REMOTE_IDENTITY)) {
+    if (!obj || !security_object_valid(obj, SECURITY_OBJECT_KIND_IDENTITY_RELATION)) {
         DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED,
                 "begin_handshake_request: Invalid replier_identity_handle provided");
         goto err_inv_handle;
     }
-    remoteIdent = (RemoteIdentityInfo *)obj;
+    relation = (IdentityRelation *)obj;
+    handshake = relation->handshake;
 
-    result = get_certificate_contents(localIdent->identityCert, &certData, &certDataSize, ex);
+    result = get_certificate_contents(linfo->identityCert, &certData, &certDataSize, ex);
     if (result != DDS_SECURITY_VALIDATION_OK) {
         goto err_alloc_cid;
     }
 
-    handshake = find_handshake(impl, SECURITY_OBJECT_HANDLE(localIdent), SECURITY_OBJECT_HANDLE(remoteIdent));
     if (!handshake) {
-        relation = find_identity_relation(remoteIdent, SECURITY_OBJECT_HANDLE(localIdent));
-        assert(relation);
-        handshake = handshakeInfoNew(localIdent, remoteIdent, relation);
+        handshake = handshakeInfoNew(relation);
         handshake->created_in = CREATEDREQUEST;
-        (void)ddsrt_hh_add(impl->objectHash, handshake);
+        relation->handshake = handshake;
+        (void)ddsrt_hh_add(impl->handshakes, handshake);
         created = 1;
-    } else {
-        relation = handshake->relation;
-        assert(relation);
     }
 
+    assert(handshake->relation == relation);
+
     if (!handshake->ldh) {
-        result = generate_dh_keys(&dhkey, localIdent->kagreeAlgoKind, ex);
+        result = generate_dh_keys(&dhkey, linfo->kagreeAlgoKind, ex);
         if (result != DDS_SECURITY_VALIDATION_OK) {
             goto err_gen_dh_keys;
         }
-
         handshake->ldh = dhkey;
     }
 
-    result = dh_public_key_to_oct(handshake->ldh, localIdent->kagreeAlgoKind, &dhPubKeyData, &dhPubKeyDataSize, ex);
+    result = dh_public_key_to_oct(handshake->ldh, linfo->kagreeAlgoKind, &dhPubKeyData, &dhPubKeyDataSize, ex);
     if (result != DDS_SECURITY_VALIDATION_OK) {
         goto err_get_public_key;
     }
 
-    if (localIdent->pdata._length == 0) {
-        DDS_Security_OctetSeq_copy(&localIdent->pdata, serialized_local_participant_data);
+    if (linfo->pdata._length == 0) {
+        DDS_Security_OctetSeq_copy(&linfo->pdata, serialized_local_participant_data);
     }
 
     tokens = DDS_Security_BinaryPropertySeq_allocbuf(8);
@@ -1594,8 +1517,8 @@ begin_handshake_request(
     DDS_Security_BinaryProperty_set_by_ref(c_id, "c.id", certData, certDataSize);
 
     /* Store the permission document in the c.perm property */
-    if (localIdent->permissionsDocument) {
-        DDS_Security_BinaryProperty_set_by_string(c_perm, "c.perm", localIdent->permissionsDocument);
+    if (linfo->permissionsDocument) {
+        DDS_Security_BinaryProperty_set_by_string(c_perm, "c.perm", linfo->permissionsDocument);
     } else {
       DDS_Security_BinaryProperty_set_by_string(c_perm, "c.perm", "");
     }
@@ -1604,10 +1527,10 @@ begin_handshake_request(
     DDS_Security_BinaryProperty_set_by_value(c_pdata, "c.pdata", serialized_local_participant_data->_buffer, serialized_local_participant_data->_length);
 
     /* Set the used signing algorithm descriptor in c.dsign_algo */
-    DDS_Security_BinaryProperty_set_by_string(c_dsign_algo, "c.dsign_algo", get_dsign_algo(localIdent->dsignAlgoKind));
+    DDS_Security_BinaryProperty_set_by_string(c_dsign_algo, "c.dsign_algo", get_dsign_algo(linfo->dsignAlgoKind));
 
     /* Set the used key algorithm descriptor in c.kagree_algo */
-    DDS_Security_BinaryProperty_set_by_string(c_kagree_algo, "c.kagree_algo", get_kagree_algo(localIdent->kagreeAlgoKind));
+    DDS_Security_BinaryProperty_set_by_string(c_kagree_algo, "c.kagree_algo", get_kagree_algo(linfo->kagreeAlgoKind));
 
     /* Calculate the hash_c1 */
     {
@@ -1628,8 +1551,6 @@ begin_handshake_request(
     /* Set the challenge in challenge1 property */
     DDS_Security_BinaryProperty_set_by_value(challenge, "challenge1", relation->lchallenge->value, sizeof(AuthenticationChallenge));
 
-    (void)ddsrt_hh_add(impl->objectHash, handshake);
-
     ddsrt_mutex_unlock(&impl->lock);
 
     handshake_message->class_id = ddsrt_strdup(AUTH_HANDSHAKE_REQUEST_TOKEN_ID);
@@ -1644,8 +1565,8 @@ begin_handshake_request(
 err_get_public_key:
 err_gen_dh_keys:
     if (created) {
-        (void)ddsrt_hh_remove(impl->objectHash, handshake);
-        security_object_free((SecurityObject *)handshake);
+        (void)ddsrt_hh_remove(impl->handshakes, handshake);
+        handshakeInfoFree(handshake);
     }
 err_alloc_cid:
     ddsrt_free(certData);
@@ -2503,8 +2424,8 @@ begin_handshake_reply(
     HandshakeInfo *handshake = NULL;
     IdentityRelation *relation = NULL;
     SecurityObject *obj;
-    LocalIdentityInfo *localIdent;
-    RemoteIdentityInfo *remoteIdent;
+    LocalIdentityInfo *linfo;
+    RemoteIdentityInfo *rinfo;
     EVP_PKEY *dhkeyLocal = NULL;
     DDS_Security_BinaryProperty_t *tokens;
     DDS_Security_BinaryProperty_t *c_id;
@@ -2548,41 +2469,40 @@ begin_handshake_reply(
                 "begin_handshake_reply: Invalid replier_identity_handle provided");
         goto err_inv_handle;
     }
-    localIdent = (LocalIdentityInfo *) obj;
+    linfo = (LocalIdentityInfo *) obj;
 
     obj = security_object_find(impl->objectHash, initiator_identity_handle);
-    if (!obj || !security_object_valid(obj, SECURITY_OBJECT_KIND_REMOTE_IDENTITY)) {
+    if (!obj || !security_object_valid(obj, SECURITY_OBJECT_KIND_IDENTITY_RELATION)) {
         DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED,
                 "begin_handshake_reply: Invalid initiator_identity_handle provided");
         goto err_inv_handle;
     }
-    remoteIdent = (RemoteIdentityInfo *)obj;
+    relation = (IdentityRelation *)obj;
+    rinfo = relation->remoteIdentity;
+    handshake = relation->handshake;
 
-    handshake = find_handshake(impl, SECURITY_OBJECT_HANDLE(localIdent), SECURITY_OBJECT_HANDLE(remoteIdent));
     if (!handshake) {
-        relation = find_identity_relation(remoteIdent, SECURITY_OBJECT_HANDLE(localIdent));
-        assert(relation);
-        handshake = handshakeInfoNew(localIdent, remoteIdent, relation);
+        handshake = handshakeInfoNew(relation);
+        relation->handshake = handshake;
         handshake->created_in = CREATEDREPLY;
-        (void)ddsrt_hh_add(impl->objectHash, handshake);
+        (void)ddsrt_hh_add(impl->handshakes, handshake);
         created = 1;
-    } else {
-        relation = handshake->relation;
-        assert(relation);
     }
 
+    assert(handshake->relation == relation);
+
     result = validate_handshake_request_token(handshake_message_in, handshake, &(impl->trustedCAList), ex);
     if (result != DDS_SECURITY_VALIDATION_OK) {
         goto err_inv_token;
     }
 
-    result = get_certificate_contents(localIdent->identityCert, &certData, &certDataSize, ex);
+    result = get_certificate_contents(linfo->identityCert, &certData, &certDataSize, ex);
     if (result != DDS_SECURITY_VALIDATION_OK) {
         goto err_alloc_cid;
     }
 
     if (!handshake->ldh) {
-        result = generate_dh_keys(&dhkeyLocal, remoteIdent->kagreeAlgoKind, ex);
+        result = generate_dh_keys(&dhkeyLocal, rinfo->kagreeAlgoKind, ex);
         if (result != DDS_SECURITY_VALIDATION_OK) {
             goto err_gen_dh_keys;
         }
@@ -2591,13 +2511,13 @@ begin_handshake_reply(
         EVP_PKEY_copy_parameters(handshake->rdh, handshake->ldh);
     }
 
-    result = dh_public_key_to_oct(handshake->ldh, remoteIdent->kagreeAlgoKind, &dhPubKeyData, &dhPubKeyDataSize, ex);
+    result = dh_public_key_to_oct(handshake->ldh, rinfo->kagreeAlgoKind, &dhPubKeyData, &dhPubKeyDataSize, ex);
     if (result != DDS_SECURITY_VALIDATION_OK) {
         goto err_get_public_key;
     }
 
-    if (localIdent->pdata._length == 0) {
-        DDS_Security_OctetSeq_copy(&localIdent->pdata, serialized_local_participant_data);
+    if (linfo->pdata._length == 0) {
+        DDS_Security_OctetSeq_copy(&linfo->pdata, serialized_local_participant_data);
     }
 
     hash_c1_ref = DDS_Security_DataHolder_find_binary_property(handshake_message_in, "hash_c1");
@@ -2623,8 +2543,8 @@ begin_handshake_reply(
     certData = NULL;
 
     /* Store the permission document in the c.perm property */
-    if (localIdent->permissionsDocument) {
-        DDS_Security_BinaryProperty_set_by_string(c_perm, "c.perm", localIdent->permissionsDocument);
+    if (linfo->permissionsDocument) {
+        DDS_Security_BinaryProperty_set_by_string(c_perm, "c.perm", linfo->permissionsDocument);
     } else {
         DDS_Security_BinaryProperty_set_by_string(c_perm, "c.perm", "");
     }
@@ -2633,10 +2553,10 @@ begin_handshake_reply(
     DDS_Security_BinaryProperty_set_by_value(c_pdata, "c.pdata", serialized_local_participant_data->_buffer, serialized_local_participant_data->_length);
 
     /* Set the used signing algorithm descriptor in c.dsign_algo */
-    DDS_Security_BinaryProperty_set_by_string(c_dsign_algo, "c.dsign_algo", get_dsign_algo(localIdent->dsignAlgoKind));
+    DDS_Security_BinaryProperty_set_by_string(c_dsign_algo, "c.dsign_algo", get_dsign_algo(linfo->dsignAlgoKind));
 
     /* Set the used key algorithm descriptor in c.kagree_algo */
-    DDS_Security_BinaryProperty_set_by_string(c_kagree_algo, "c.kagree_algo", get_kagree_algo(remoteIdent->kagreeAlgoKind));
+    DDS_Security_BinaryProperty_set_by_string(c_kagree_algo, "c.kagree_algo", get_kagree_algo(rinfo->kagreeAlgoKind));
 
     /* Calculate the hash_c2 */
     {
@@ -2689,7 +2609,7 @@ begin_handshake_reply(
         binary_properties[4] = dh1;
         binary_properties[5] = hash_c1_val;
 
-        result = create_signature(localIdent->privateKey, binary_properties, HANDSHAKE_SIGNATURE_CONTENT_SIZE , &sign, &signlen, ex);
+        result = create_signature(linfo->privateKey, binary_properties, HANDSHAKE_SIGNATURE_CONTENT_SIZE , &sign, &signlen, ex);
 
         DDS_Security_BinaryProperty_free(hash_c1_val);
         DDS_Security_BinaryProperty_free(hash_c2_val);
@@ -2700,15 +2620,12 @@ begin_handshake_reply(
         DDS_Security_BinaryProperty_set_by_ref(signature, "signature", sign, (uint32_t)signlen);
     }
 
-    (void)ddsrt_hh_add(impl->objectHash, handshake);
-
     handshake_message_out->class_id = ddsrt_strdup(AUTH_HANDSHAKE_REPLY_TOKEN_ID);
     handshake_message_out->binary_properties._length = tokenSize;
     handshake_message_out->binary_properties._buffer = tokens;
 
     ddsrt_mutex_unlock(&impl->lock);
 
-
     *handshake_handle = HANDSHAKE_HANDLE(handshake);
 
     if (result == DDS_SECURITY_VALIDATION_OK) {
@@ -2725,8 +2642,8 @@ err_gen_dh_keys:
 err_alloc_cid:
 err_inv_token:
     if (created) {
-        (void)ddsrt_hh_remove(impl->objectHash, handshake);
-        security_object_free((SecurityObject *)handshake);
+        (void)ddsrt_hh_remove(impl->handshakes, handshake);
+        handshakeInfoFree(handshake);
     }
 err_inv_handle:
     ddsrt_mutex_unlock(&impl->lock);
@@ -2734,7 +2651,6 @@ err_bad_param:
     return DDS_SECURITY_VALIDATION_FAILED;
 }
 
-
 static bool
 generate_shared_secret(
     const HandshakeInfo *handshake,
@@ -2800,9 +2716,6 @@ fail_ctx_new:
     return result;
 }
 
-
-
-
 DDS_Security_ValidationResult_t
 process_handshake(
         dds_security_authentication *instance,
@@ -2846,7 +2759,7 @@ process_handshake(
 
     ddsrt_mutex_lock(&impl->lock);
 
-    obj = security_object_find(impl->objectHash, handshake_handle);
+    obj = security_object_find(impl->handshakes, handshake_handle);
     if (!obj || !security_object_valid(obj, SECURITY_OBJECT_KIND_HANDSHAKE)) {
         DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT,
         DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED,
@@ -2934,7 +2847,6 @@ process_handshake(
                             challenge2_ref->value._length);
         }
 
-
         /* Calculate the signature */
         {
            const DDS_Security_BinaryProperty_t * binary_properties[ HANDSHAKE_SIGNATURE_CONTENT_SIZE ];
@@ -2983,12 +2895,10 @@ process_handshake(
             goto err_inv_token;
         }
 
-
         challenge2_ref_for_shared_secret = (DDS_Security_octet*)(handshake->relation->lchallenge);
         challenge1_ref_for_shared_secret = (DDS_Security_octet*)(handshake->relation->rchallenge);
 
         result =  DDS_SECURITY_VALIDATION_OK;
-
         break;
     default:
         ddsrt_mutex_unlock(&impl->lock);
@@ -3021,10 +2931,9 @@ process_handshake(
           goto err_invalid_expiry;
         } else if( certExpiry != DDS_NEVER ){
             add_validity_end_trigger( impl,
-                            IDENTITY_HANDLE( handshake->relation->remoteIdentity ),
+                            IDENTITY_HANDLE( handshake->relation ),
                             certExpiry);
         }
-
     }
 
     ddsrt_mutex_unlock(&impl->lock);
@@ -3062,14 +2971,14 @@ DDS_Security_SharedSecretHandle get_shared_secret(
     }
 
     ddsrt_mutex_lock(&impl->lock);
-    obj = security_object_find(impl->objectHash, handshake_handle);
+    obj = security_object_find(impl->handshakes, handshake_handle);
     if (!obj || !security_object_valid(obj, SECURITY_OBJECT_KIND_HANDSHAKE)) {
        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "return_handshake_handle: Invalid handle provided");
        goto err_invalid_handle;
     }
 
     ddsrt_mutex_unlock(&impl->lock);
-    return (DDS_Security_SharedSecretHandle)(ddsrt_address)((HandshakeInfo*)obj)->shared_secret_handle_impl;
+    return (DDS_Security_SharedSecretHandle)(uintptr_t)((HandshakeInfo*)obj)->shared_secret_handle_impl;
 
 
     err_invalid_handle:
@@ -3102,7 +3011,7 @@ get_authenticated_peer_credential_token(
 
     ddsrt_mutex_lock(&impl->lock);
 
-    handshake = (HandshakeInfo *) security_object_find(impl->objectHash, handshake_handle);
+    handshake = (HandshakeInfo *) security_object_find(impl->handshakes, handshake_handle);
     if (!handshake || !SECURITY_OBJECT_VALID(handshake, SECURITY_OBJECT_KIND_HANDSHAKE)) {
         DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT,
                 DDS_SECURITY_ERR_INVALID_PARAMETER_CODE, 0,
@@ -3227,18 +3136,15 @@ return_handshake_handle(dds_security_authentication *instance,
     }
 
     ddsrt_mutex_lock(&impl->lock);
-    obj = security_object_find(impl->objectHash, handshake_handle);
+    obj = security_object_find(impl->handshakes, handshake_handle);
     if (!obj || !security_object_valid(obj, SECURITY_OBJECT_KIND_HANDSHAKE)) {
         DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "return_handshake_handle: Invalid handle provided");
         goto err_invalid_handle;
     }
     handshake = (HandshakeInfo *)obj;
 
-    assert(handshake->relation);
-
-    (void)ddsrt_hh_remove(impl->objectHash, obj);
-    security_object_free((SecurityObject *)handshake);
-
+    (void)ddsrt_hh_remove(impl->handshakes, handshake);
+    handshakeInfoFree(handshake);
     ddsrt_mutex_unlock(&impl->lock);
 
     return true;
@@ -3249,56 +3155,63 @@ err_bad_param:
     return false;
 }
 
+static void
+release_remote_info(
+     dds_security_authentication_impl *impl,
+     RemoteIdentityInfo *info)
+{
+    if (--info->refc == 0) {
+        (void)ddsrt_hh_remove(impl->remoteGuidHash, info);
+        remoteIdentityInfoFree(info);
+    }
+}
 
 static void
 invalidate_local_related_objects(
      dds_security_authentication_impl *impl,
-     LocalIdentityInfo *localIdent)
+     LocalIdentityInfo *linfo)
 {
-    struct ddsrt_hh_iter it;
-    SecurityObject *obj;
+    IdentityRelation *relation;
 
-    for (obj = ddsrt_hh_iter_first(impl->objectHash, &it); obj != NULL; obj = ddsrt_hh_iter_next(&it)) {
-        if (obj->kind == SECURITY_OBJECT_KIND_REMOTE_IDENTITY) {
-            RemoteIdentityInfo *remoteIdent = (RemoteIdentityInfo *)obj;
-            IdentityRelation *relation;
-            HandshakeInfo *handshake;
+    relation = ddsrt_avl_find_min(&relations_treedef, &linfo->relations);
+    while (relation) {
+        IdentityRelation *next = ddsrt_avl_find_succ(&relations_treedef, &linfo->relations, relation);
 
-            handshake = find_handshake(impl, SECURITY_OBJECT_HANDLE(localIdent), SECURITY_OBJECT_HANDLE(remoteIdent));
-            if (handshake) {
-                (void)ddsrt_hh_remove(impl->objectHash, handshake);
-                security_object_free((SecurityObject *) handshake);
-            }
+        assert(relation->remoteIdentity);
 
-            relation = find_identity_relation(remoteIdent, SECURITY_OBJECT_HANDLE(localIdent));
-            if (relation) {
-                remove_identity_relation(remoteIdent, relation);
-            }
+        if (relation->handshake) {
+            (void)ddsrt_hh_remove(impl->handshakes, relation->handshake);
+            handshakeInfoFree(relation->handshake);
         }
+        release_remote_info(impl, relation->remoteIdentity);
+        ddsrt_avl_delete(&relations_treedef, &linfo->relations, relation);
+        (void)ddsrt_hh_remove(impl->objectHash, relation);
+        identityRelationFree(relation);
+        relation = next;
     }
+    (void)ddsrt_hh_remove(impl->objectHash, linfo);
+    localIdentityInfoFree(linfo);
 }
 
 static void
 invalidate_remote_related_objects(
     dds_security_authentication_impl *impl,
-    RemoteIdentityInfo *remoteIdentity)
+    IdentityRelation *relation)
 {
-    struct ddsrt_hh_iter it;
-    IdentityRelation *relation;
-    HandshakeInfo *handshake;
+    assert(relation->remoteIdentity);
+    assert(relation->localIdentity);
 
-    for (relation = ddsrt_hh_iter_first(remoteIdentity->linkHash, &it); relation != NULL; relation = ddsrt_hh_iter_next(&it)) {
-        handshake = find_handshake(impl, SECURITY_OBJECT_HANDLE(relation->localIdentity), SECURITY_OBJECT_HANDLE(remoteIdentity));
-        if (handshake) {
-            (void)ddsrt_hh_remove(impl->objectHash, handshake);
-            security_object_free((SecurityObject *) handshake);
-        }
-
-        (void)ddsrt_hh_remove(remoteIdentity->linkHash, relation);
-        security_object_free((SecurityObject *) relation);
+    if (relation->handshake) {
+        (void)ddsrt_hh_remove(impl->handshakes, relation->handshake);
+        handshakeInfoFree(relation->handshake);
     }
+    release_remote_info(impl, relation->remoteIdentity);
+    ddsrt_avl_delete(&relations_treedef, &relation->localIdentity->relations, relation);
+    (void)ddsrt_hh_remove(impl->objectHash, relation);
+    identityRelationFree(relation);
 }
 
+
 DDS_Security_boolean
 return_identity_handle(
         dds_security_authentication *instance,
@@ -3308,8 +3221,8 @@ return_identity_handle(
     DDS_Security_boolean result = true;
     dds_security_authentication_impl *impl = (dds_security_authentication_impl *) instance;
     SecurityObject *obj;
-    LocalIdentityInfo *localIdent;
-    RemoteIdentityInfo *remoteIdent;
+    LocalIdentityInfo *linfo;
+    IdentityRelation *relation;
 
     /* validate provided arguments */
     if (!instance || !identity_handle) {
@@ -3332,17 +3245,12 @@ return_identity_handle(
 
     switch (obj->kind) {
     case SECURITY_OBJECT_KIND_LOCAL_IDENTITY:
-        localIdent = (LocalIdentityInfo *) obj;
-        invalidate_local_related_objects(impl, localIdent);
-        (void)ddsrt_hh_remove(impl->objectHash, obj);
-        security_object_free(obj);
+        linfo = (LocalIdentityInfo *) obj;
+        invalidate_local_related_objects(impl, linfo);
         break;
-    case SECURITY_OBJECT_KIND_REMOTE_IDENTITY:
-        remoteIdent = (RemoteIdentityInfo *) obj;
-        invalidate_remote_related_objects(impl, remoteIdent);
-        (void)ddsrt_hh_remove(impl->remoteGuidHash, remoteIdent);
-        (void)ddsrt_hh_remove(impl->objectHash, obj);
-        security_object_free(obj);
+    case SECURITY_OBJECT_KIND_IDENTITY_RELATION:
+        relation = (IdentityRelation *) obj;
+        invalidate_remote_related_objects(impl, relation);
         break;
     default:
         DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "return_identity_handle: Invalid handle provided");
@@ -3351,7 +3259,6 @@ return_identity_handle(
     }
 
     ddsrt_mutex_unlock(&impl->lock);
-
     return result;
 
 err_invalid_handle:
@@ -3372,10 +3279,8 @@ DDS_Security_boolean return_sharedsecret_handle(
     return true;
 }
 
-int32_t
-init_authentication( const char *argument, void **context)
+int32_t init_authentication( const char *argument, void **context)
 {
-
     dds_security_authentication_impl *authentication;
 
     DDSRT_UNUSED_ARG(argument);
@@ -3391,51 +3296,31 @@ init_authentication( const char *argument, void **context)
 
     /* assign the interface functions */
     authentication->base.validate_local_identity = &validate_local_identity;
-
     authentication->base.get_identity_token = &get_identity_token;
-
     authentication->base.get_identity_status_token = &get_identity_status_token;
-
-    authentication->base.set_permissions_credential_and_token =
-            &set_permissions_credential_and_token;
-
+    authentication->base.set_permissions_credential_and_token = &set_permissions_credential_and_token;
     authentication->base.validate_remote_identity = &validate_remote_identity;
-
     authentication->base.begin_handshake_request = &begin_handshake_request;
-
     authentication->base.begin_handshake_reply = &begin_handshake_reply;
-
     authentication->base.process_handshake = &process_handshake;
-
     authentication->base.get_shared_secret = &get_shared_secret;
-
-    authentication->base.get_authenticated_peer_credential_token =
-            &get_authenticated_peer_credential_token;
-
+    authentication->base.get_authenticated_peer_credential_token = &get_authenticated_peer_credential_token;
     authentication->base.set_listener = &set_listener;
-
     authentication->base.return_identity_token = &return_identity_token;
-
-    authentication->base.return_identity_status_token =
-            &return_identity_status_token;
-
-    authentication->base.return_authenticated_peer_credential_token =
-            &return_authenticated_peer_credential_token;
-
+    authentication->base.return_identity_status_token = &return_identity_status_token;
+    authentication->base.return_authenticated_peer_credential_token = &return_authenticated_peer_credential_token;
     authentication->base.return_handshake_handle = &return_handshake_handle;
-
     authentication->base.return_identity_handle = &return_identity_handle;
-
     authentication->base.return_sharedsecret_handle = &return_sharedsecret_handle;
 
     ddsrt_mutex_init(&authentication->lock);
 
     authentication->objectHash = ddsrt_hh_new(32, security_object_hash, security_object_equal);
     authentication->remoteGuidHash = ddsrt_hh_new(32, remote_guid_hash, remote_guid_equal);
+    authentication->handshakes = ddsrt_hh_new(32, security_object_hash, security_object_equal);
 
     memset( &authentication->trustedCAList, 0, sizeof(X509Seq));
 
-
     /* Initialize openssl */
     OpenSSL_add_all_algorithms();
     OpenSSL_add_all_ciphers();
@@ -3458,6 +3343,8 @@ err_mutex_failed:
 int32_t finalize_authentication(void *instance)
 {
     dds_security_authentication_impl *authentication = instance;
+    LocalIdentityInfo *linfo;
+    IdentityRelation *relation;
 
     if( authentication ){
         ddsrt_mutex_lock(&authentication->lock);
@@ -3465,25 +3352,37 @@ int32_t finalize_authentication(void *instance)
         dds_security_timed_dispatcher_free(authentication->timed_callbacks, authentication->dispatcher);
         dds_security_timed_cb_free(authentication->timed_callbacks);
 
-        if (authentication->remoteGuidHash) {
-            ddsrt_hh_free(authentication->remoteGuidHash);
-        }
-
         if (authentication->objectHash) {
             struct ddsrt_hh_iter it;
             SecurityObject *obj;
             for (obj = ddsrt_hh_iter_first(authentication->objectHash, &it); obj != NULL; obj = ddsrt_hh_iter_next(&it)) {
-                security_object_free(obj);
+                switch (obj->kind) {
+                case SECURITY_OBJECT_KIND_LOCAL_IDENTITY:
+                    linfo = (LocalIdentityInfo *) obj;
+                    invalidate_local_related_objects(authentication, linfo);
+                    break;
+                case SECURITY_OBJECT_KIND_IDENTITY_RELATION:
+                    relation = (IdentityRelation *) obj;
+                    invalidate_remote_related_objects(authentication, relation);
+                    break;
+                default:
+                    break;
+                }
             }
             ddsrt_hh_free(authentication->objectHash);
         }
 
+        if (authentication->remoteGuidHash) {
+            ddsrt_hh_free(authentication->remoteGuidHash);
+        }
+
+        if (authentication->handshakes) {
+            ddsrt_hh_free(authentication->handshakes);
+        }
+
         free_ca_list_contents(&(authentication->trustedCAList));
-
         ddsrt_mutex_unlock(&authentication->lock);
-
         ddsrt_mutex_destroy(&authentication->lock);
-
         ddsrt_free((dds_security_authentication_impl*) instance);
     }
 

From 0d3ca448ff486397224e01dcbdcacca1babbe3af Mon Sep 17 00:00:00 2001
From: Erik Boasson <eb@ilities.com>
Date: Wed, 12 Feb 2020 20:15:49 +0100
Subject: [PATCH 097/238] Liveliness monitoring fixes for security FSM

Signed-off-by: Erik Boasson <eb@ilities.com>
---
 src/security/core/src/dds_security_fsm.c | 16 +++++++++-------
 1 file changed, 9 insertions(+), 7 deletions(-)

diff --git a/src/security/core/src/dds_security_fsm.c b/src/security/core/src/dds_security_fsm.c
index 8413575..ce1a2bb 100644
--- a/src/security/core/src/dds_security_fsm.c
+++ b/src/security/core/src/dds_security_fsm.c
@@ -179,7 +179,7 @@ static void fsm_check_auto_state_change (struct dds_security_fsm *fsm)
   }
 }
 
-static void fsm_state_change (struct dds_security_fsm_control *control, struct fsm_event *event)
+static void fsm_state_change (struct thread_state1 *ts1, struct dds_security_fsm_control *control, struct fsm_event *event)
 {
   struct dds_security_fsm *fsm = event->fsm;
   int event_id = event->event_id;
@@ -199,10 +199,14 @@ static void fsm_state_change (struct dds_security_fsm_control *control, struct f
         set_state_timer (fsm);
 
         ddsrt_mutex_unlock (&control->lock);
+
+        thread_state_asleep (ts1);
         if (fsm->transitions[i].func)
           fsm->transitions[i].func (fsm, fsm->arg);
         if (fsm->current && fsm->current->func)
           fsm->current->func (fsm, fsm->arg);
+
+        thread_state_awake (ts1, control->gv);
         ddsrt_mutex_lock (&control->lock);
         fsm_check_auto_state_change (fsm);
         break;
@@ -241,9 +245,8 @@ static void fsm_handle_timeout (struct dds_security_fsm_control *control, struct
 static uint32_t handle_events (struct dds_security_fsm_control *control)
 {
   struct thread_state1 * const ts1 = lookup_thread_state ();
-
-  ddsrt_mutex_lock (&control->lock);
   thread_state_awake (ts1, control->gv);
+  ddsrt_mutex_lock (&control->lock);
   while (control->running)
   {
     if (control->event_queue)
@@ -253,7 +256,7 @@ static uint32_t handle_events (struct dds_security_fsm_control *control)
       control->event_queue = event->next;
       if (control->event_queue)
         control->event_queue->prev = NULL;
-      fsm_state_change (control, event);
+      fsm_state_change (ts1, control, event);
       ddsrt_free (event);
     }
     else
@@ -263,7 +266,7 @@ static uint32_t handle_events (struct dds_security_fsm_control *control)
       if (timeout > dds_time ())
       {
         thread_state_asleep (ts1);
-        (void)ddsrt_cond_waituntil( &control->cond, &control->lock, timeout);
+        (void)ddsrt_cond_waituntil (&control->cond, &control->lock, timeout);
         thread_state_awake (ts1, control->gv);
       }
       else
@@ -273,9 +276,8 @@ static uint32_t handle_events (struct dds_security_fsm_control *control)
       }
     }
   }
-  thread_state_asleep (ts1);
   ddsrt_mutex_unlock (&control->lock);
-
+  thread_state_asleep (ts1);
   return 0;
 }
 

From 9b43303d82e3dc7f9534708b9414c517fd293f41 Mon Sep 17 00:00:00 2001
From: Erik Boasson <eb@ilities.com>
Date: Thu, 13 Feb 2020 11:48:10 +0100
Subject: [PATCH 098/238] Remove unused "kernel sequence numbers" notion

The flag originates in OpenSplice but is meaningless in Cyclone.

Signed-off-by: Erik Boasson <eb@ilities.com>
---
 src/core/ddsi/include/dds/ddsi/q_entity.h |  9 +++------
 src/core/ddsi/src/q_ddsi_discovery.c      |  3 ---
 src/core/ddsi/src/q_entity.c              | 15 ++-------------
 3 files changed, 5 insertions(+), 22 deletions(-)

diff --git a/src/core/ddsi/include/dds/ddsi/q_entity.h b/src/core/ddsi/include/dds/ddsi/q_entity.h
index 3623888..306029b 100644
--- a/src/core/ddsi/include/dds/ddsi/q_entity.h
+++ b/src/core/ddsi/include/dds/ddsi/q_entity.h
@@ -358,7 +358,6 @@ struct proxy_participant
   struct proxy_endpoint_common *endpoints; /* all proxy endpoints can be reached from here */
   ddsrt_avl_tree_t groups; /* table of all groups (publisher, subscriber), see struct proxy_group */
   seqno_t seq; /* sequence number of most recent SPDP message */
-  unsigned kernel_sequence_numbers : 1; /* whether this proxy participant generates OSPL kernel sequence numbers */
   unsigned implicitly_created : 1; /* participants are implicitly created for Cloud/Fog discovered endpoints */
   unsigned is_ddsi2_pp: 1; /* if this is the federation-leader on the remote node */
   unsigned minimal_bes_mode: 1;
@@ -665,19 +664,17 @@ int writer_set_notalive (struct writer *wr, bool notify);
       XX --
 */
 
-/* Set this custom flag when using nn_prismtech_writer_info_t iso nn_prismtech_writer_info_old_t */
-#define CF_INC_KERNEL_SEQUENCE_NUMBERS         (1 << 0)
 /* Set when this proxy participant is created implicitly and has to be deleted upon disappearance
    of its last endpoint.  FIXME: Currently there is a potential race with adding a new endpoint
    in parallel to deleting the last remaining one. The endpoint will then be created, added to the
    proxy participant and then both are deleted. With the current single-threaded discovery
    this can only happen when it is all triggered by lease expiry. */
-#define CF_IMPLICITLY_CREATED_PROXYPP          (1 << 1)
+#define CF_IMPLICITLY_CREATED_PROXYPP          (1 << 0)
 /* Set when this proxy participant is a DDSI2 participant, to help Cloud figure out whom to send
    discovery data when used in conjunction with the networking bridge */
-#define CF_PARTICIPANT_IS_DDSI2                (1 << 2)
+#define CF_PARTICIPANT_IS_DDSI2                (1 << 1)
 /* Set when this proxy participant is not to be announced on the built-in topics yet */
-#define CF_PROXYPP_NO_SPDP                     (1 << 3)
+#define CF_PROXYPP_NO_SPDP                     (1 << 2)
 
 void new_proxy_participant (struct ddsi_domaingv *gv, const struct ddsi_guid *guid, uint32_t bes, const struct ddsi_guid *privileged_pp_guid, struct addrset *as_default, struct addrset *as_meta, const struct ddsi_plist *plist, dds_duration_t tlease_dur, nn_vendorid_t vendor, unsigned custom_flags, nn_wctime_t timestamp, seqno_t seq);
 int delete_proxy_participant_by_guid (struct ddsi_domaingv *gv, const struct ddsi_guid *guid, nn_wctime_t timestamp, int isimplicit);
diff --git a/src/core/ddsi/src/q_ddsi_discovery.c b/src/core/ddsi/src/q_ddsi_discovery.c
index 8877242..fb3f671 100644
--- a/src/core/ddsi/src/q_ddsi_discovery.c
+++ b/src/core/ddsi/src/q_ddsi_discovery.c
@@ -657,9 +657,6 @@ static int handle_SPDP_alive (const struct receiver_state *rst, seqno_t seq, nn_
   }
 
   if (datap->present & PP_PRISMTECH_PARTICIPANT_VERSION_INFO) {
-    if (datap->prismtech_participant_version_info.flags & NN_PRISMTECH_FL_KERNEL_SEQUENCE_NUMBER)
-      custom_flags |= CF_INC_KERNEL_SEQUENCE_NUMBERS;
-
     if ((datap->prismtech_participant_version_info.flags & NN_PRISMTECH_FL_DDSI2_PARTICIPANT_FLAG) &&
         (datap->prismtech_participant_version_info.flags & NN_PRISMTECH_FL_PARTICIPANT_IS_DDSI2))
       custom_flags |= CF_PARTICIPANT_IS_DDSI2;
diff --git a/src/core/ddsi/src/q_entity.c b/src/core/ddsi/src/q_entity.c
index cf49032..39cc797 100644
--- a/src/core/ddsi/src/q_entity.c
+++ b/src/core/ddsi/src/q_entity.c
@@ -4827,6 +4827,8 @@ void new_proxy_participant (struct ddsi_domaingv *gv, const struct ddsi_guid *pp
     proxypp->minimal_bes_mode = 1;
   else
     proxypp->minimal_bes_mode = 0;
+  proxypp->implicitly_created = ((custom_flags & CF_IMPLICITLY_CREATED_PROXYPP) != 0);
+  proxypp->proxypp_have_spdp = ((custom_flags & CF_PROXYPP_NO_SPDP) == 0);
 
   {
     struct proxy_participant *privpp;
@@ -4889,19 +4891,6 @@ void new_proxy_participant (struct ddsi_domaingv *gv, const struct ddsi_guid *pp
   set_proxy_participant_security_info(proxypp, plist);
 #endif
 
-  if (custom_flags & CF_INC_KERNEL_SEQUENCE_NUMBERS)
-    proxypp->kernel_sequence_numbers = 1;
-  else
-    proxypp->kernel_sequence_numbers = 0;
-  if (custom_flags & CF_IMPLICITLY_CREATED_PROXYPP)
-    proxypp->implicitly_created = 1;
-  else
-    proxypp->implicitly_created = 0;
-
-  if (custom_flags & CF_PROXYPP_NO_SPDP)
-    proxypp->proxypp_have_spdp = 0;
-  else
-    proxypp->proxypp_have_spdp = 1;
 
 #ifdef DDSI_INCLUDE_SECURITY
   if (secure)

From 62a6004e8a9e1ab4aa4fe9a9e8249f14bd42d19d Mon Sep 17 00:00:00 2001
From: Erik Boasson <eb@ilities.com>
Date: Thu, 13 Feb 2020 11:52:52 +0100
Subject: [PATCH 099/238] Remove "CM" topic related flags reintroduced by merge

Signed-off-by: Erik Boasson <eb@ilities.com>
---
 src/core/ddsi/include/dds/ddsi/q_protocol.h | 7 -------
 1 file changed, 7 deletions(-)

diff --git a/src/core/ddsi/include/dds/ddsi/q_protocol.h b/src/core/ddsi/include/dds/ddsi/q_protocol.h
index 1ffb559..b03d0ea 100644
--- a/src/core/ddsi/include/dds/ddsi/q_protocol.h
+++ b/src/core/ddsi/include/dds/ddsi/q_protocol.h
@@ -103,13 +103,6 @@ typedef struct {
 #define NN_DISC_BUILTIN_ENDPOINT_PARTICIPANT_SECURE_ANNOUNCER (1u << 26)
 #define NN_DISC_BUILTIN_ENDPOINT_PARTICIPANT_SECURE_DETECTOR (1u << 27)
 
-/* PrismTech extensions: */
-#define NN_DISC_BUILTIN_ENDPOINT_CM_PARTICIPANT_WRITER (1u << 0)
-#define NN_DISC_BUILTIN_ENDPOINT_CM_PARTICIPANT_READER (1u << 1)
-#define NN_DISC_BUILTIN_ENDPOINT_CM_PUBLISHER_WRITER (1u << 2)
-#define NN_DISC_BUILTIN_ENDPOINT_CM_PUBLISHER_READER (1u << 3)
-#define NN_DISC_BUILTIN_ENDPOINT_CM_SUBSCRIBER_WRITER (1u << 4)
-#define NN_DISC_BUILTIN_ENDPOINT_CM_SUBSCRIBER_READER (1u << 5)
 
 #define NN_LOCATOR_KIND_INVALID -1
 #define NN_LOCATOR_KIND_RESERVED 0

From 4ed01285789c4ae95badb4426ef221c1c16d17d7 Mon Sep 17 00:00:00 2001
From: Erik Boasson <eb@ilities.com>
Date: Thu, 13 Feb 2020 11:54:21 +0100
Subject: [PATCH 100/238] Rework security code in proxy participant creation

Signed-off-by: Erik Boasson <eb@ilities.com>
---
 src/core/ddsi/include/dds/ddsi/q_protocol.h |  1 +
 src/core/ddsi/src/q_ddsi_discovery.c        | 11 ++-
 src/core/ddsi/src/q_entity.c                | 97 +++++++--------------
 3 files changed, 43 insertions(+), 66 deletions(-)

diff --git a/src/core/ddsi/include/dds/ddsi/q_protocol.h b/src/core/ddsi/include/dds/ddsi/q_protocol.h
index b03d0ea..bc86f7c 100644
--- a/src/core/ddsi/include/dds/ddsi/q_protocol.h
+++ b/src/core/ddsi/include/dds/ddsi/q_protocol.h
@@ -103,6 +103,7 @@ typedef struct {
 #define NN_DISC_BUILTIN_ENDPOINT_PARTICIPANT_SECURE_ANNOUNCER (1u << 26)
 #define NN_DISC_BUILTIN_ENDPOINT_PARTICIPANT_SECURE_DETECTOR (1u << 27)
 
+#define NN_BES_MASK_NON_SECURITY 0xf000ffffu
 
 #define NN_LOCATOR_KIND_INVALID -1
 #define NN_LOCATOR_KIND_RESERVED 0
diff --git a/src/core/ddsi/src/q_ddsi_discovery.c b/src/core/ddsi/src/q_ddsi_discovery.c
index fb3f671..05cdea6 100644
--- a/src/core/ddsi/src/q_ddsi_discovery.c
+++ b/src/core/ddsi/src/q_ddsi_discovery.c
@@ -644,7 +644,16 @@ static int handle_SPDP_alive (const struct receiver_state *rst, seqno_t seq, nn_
     }
   }
 
-  GVLOGDISC ("SPDP ST0 "PGUIDFMT" bes %x NEW", PGUID (datap->participant_guid), builtin_endpoint_set);
+  const bool is_secure = (datap->builtin_endpoint_set & NN_DISC_BUILTIN_ENDPOINT_PARTICIPANT_SECURE_ANNOUNCER) != 0;
+  /* Make sure we don't create any security builtin endpoint when it's considered unsecure. */
+  if (!is_secure)
+    builtin_endpoint_set &= NN_BES_MASK_NON_SECURITY;
+  GVLOGDISC ("SPDP ST0 "PGUIDFMT" bes %x%s NEW", PGUID (datap->participant_guid), builtin_endpoint_set, is_secure ? " (secure)" : "");
+  if (is_secure && !(datap->present & PP_IDENTITY_TOKEN))
+  {
+    GVLOGDISC (" identity token missing\n");
+    return 0;
+  }
 
   if (datap->present & PP_PARTICIPANT_LEASE_DURATION)
   {
diff --git a/src/core/ddsi/src/q_entity.c b/src/core/ddsi/src/q_entity.c
index 39cc797..72df23f 100644
--- a/src/core/ddsi/src/q_entity.c
+++ b/src/core/ddsi/src/q_entity.c
@@ -109,8 +109,6 @@ static void unref_participant (struct participant *pp, const struct ddsi_guid *g
 static struct entity_common *entity_common_from_proxy_endpoint_common (const struct proxy_endpoint_common *c);
 
 #ifdef DDSI_INCLUDE_SECURITY
-static const unsigned BES_MASK_NON_SECURITY = 0xf000ffff;
-
 static void handshake_end_cb(struct ddsi_domaingv const * const gv, struct ddsi_handshake *handshake, const struct ddsi_guid *lpguid, const struct ddsi_guid *ppguid, enum ddsi_handshake_state result);
 static void downgrade_to_nonsecure(struct proxy_participant *proxypp);
 #endif
@@ -4572,17 +4570,6 @@ static void add_proxy_builtin_endpoints(
                                  &gv->builtin_stateless_xqos_rd);
 #endif
 
-  /* write DCPSParticipant topic before the lease can expire */
-  builtintopic_write (gv->builtin_topic_interface, &proxypp->e, timestamp, true);
-
-  /* Register lease for auto liveliness, but be careful not to accidentally re-register
-     DDSI2's lease, as we may have become dependent on DDSI2 any time after
-     entidx_insert_proxy_participant_guid even if privileged_pp_guid was NULL originally */
-  ddsrt_mutex_lock (&proxypp->e.lock);
-  if (proxypp->owns_lease)
-    lease_register (ddsrt_atomic_ldvoidp (&proxypp->minl_auto));
-  ddsrt_mutex_unlock (&proxypp->e.lock);
-
 #undef PT_TE
 #undef TE
 #undef LTE
@@ -4770,6 +4757,9 @@ static void free_proxy_participant(struct proxy_participant *proxypp)
     assert (ddsrt_fibheap_min (&lease_fhdef_pp, &proxypp->leaseheap_man) == NULL);
     assert (ddsrt_atomic_ldvoidp (&proxypp->minl_man) == NULL);
     assert (!compare_guid (&minl_auto->entity->guid, &proxypp->e.guid));
+    /* if the lease hasn't been registered yet (which is the case when
+       new_proxy_participant calls this, it is marked as such and calling
+       lease_unregister is ok */
     lease_unregister (minl_auto);
     lease_free (minl_auto);
     lease_free (proxypp->lease);
@@ -4791,9 +4781,9 @@ void new_proxy_participant (struct ddsi_domaingv *gv, const struct ddsi_guid *pp
      runs on a single thread, it can't go wrong. FIXME, maybe? The
      same holds for the other functions for creating entities. */
   struct proxy_participant *proxypp;
-#ifdef DDSI_INCLUDE_SECURITY
-  bool secure = false;
-#endif
+  const bool is_secure = ((bes & NN_DISC_BUILTIN_ENDPOINT_PARTICIPANT_SECURE_ANNOUNCER) != 0);
+  assert (!is_secure || (plist->present & PP_IDENTITY_TOKEN));
+  assert (is_secure || (bes & ~NN_BES_MASK_NON_SECURITY) == 0);
 
   assert (ppguid->entityid.u == NN_ENTITYID_PARTICIPANT);
   assert (entidx_lookup_proxy_participant_guid (gv->entity_index, ppguid) == NULL);
@@ -4882,61 +4872,38 @@ void new_proxy_participant (struct ddsi_domaingv *gv, const struct ddsi_guid *pp
 #ifdef DDSI_INCLUDE_SECURITY
   proxypp->remote_identity_handle = 0;
   proxypp->sec_attr = NULL;
-  secure = ((bes & NN_DISC_BUILTIN_ENDPOINT_PARTICIPANT_SECURE_ANNOUNCER) != 0);
-  if (!secure)
+  set_proxy_participant_security_info (proxypp, plist);
+  if (is_secure)
   {
-    /* Make sure we don't create any security builtin endpoint when it's considered unsecure. */
-    proxypp->bes &= BES_MASK_NON_SECURITY;
+    q_omg_security_init_remote_participant (proxypp);
+    /* check if the proxy participant has a match with a local participant */
+    if (!proxy_participant_check_security_info (gv, proxypp))
+    {
+      GVWARNING ("Remote secure participant "PGUIDFMT" not allowed\n", PGUID (*ppguid));
+      free_proxy_participant (proxypp);
+      return;
+    }
   }
-  set_proxy_participant_security_info(proxypp, plist);
 #endif
 
-
-#ifdef DDSI_INCLUDE_SECURITY
-  if (secure)
-  {
-    /* Secure participant detected: start handshake. */
-    if ((plist->present & PP_IDENTITY_TOKEN))
-    {
-      /* initialize the security attributes associated with the proxy participant */
-      q_omg_security_init_remote_participant(proxypp);
-
-      /* check if the proxy participant has a match with a local participant */
-      if (proxy_participant_check_security_info(gv, proxypp))
-      {
-        /* Proxy participant must be in the hash tables for new_proxy_{writer,reader} to work */
-        entidx_insert_proxy_participant_guid (gv->entity_index, proxypp);
-        /* Create builtin endpoints, of which a few are used in the handshake. */
-        add_proxy_builtin_endpoints(gv, ppguid, proxypp, timestamp);
-        /* create authentication handshakes for each local secure participant */
-        proxy_participant_create_handshakes(gv, proxypp);
-      }
-      else
-      {
-        DDS_CWARNING(&gv->logconfig, "Remote secure participant "PGUIDFMT" not allowed\n", PGUID (*ppguid));
-        free_proxy_participant(proxypp);
-      }
-    }
-    else
-    {
-      /* Do not communicate with un-secure participants. */
-      DDS_CWARNING(&gv->logconfig, "Don't communicate with secure participant "PGUIDFMT" which does not provide an identity token\n", PGUID (*ppguid));
-      free_proxy_participant(proxypp);
-    }
-  }
-  else
-  {
-    /* Remote is un-secure. Try the discovery anyway. Maybe there's a local secure
-     * participant that allowed communication with remote non-secure ones
-     */
-    entidx_insert_proxy_participant_guid (gv->entity_index, proxypp);
-    add_proxy_builtin_endpoints(gv, ppguid, proxypp, timestamp);
-    ELOGDISC (proxypp, "Un-secure participant "PGUIDFMT" tries to connect.\n", PGUID (*ppguid));
-  }
-#else
   /* Proxy participant must be in the hash tables for new_proxy_{writer,reader} to work */
   entidx_insert_proxy_participant_guid (gv->entity_index, proxypp);
   add_proxy_builtin_endpoints(gv, ppguid, proxypp, timestamp);
+
+  /* write DCPSParticipant topic before the lease can expire */
+  builtintopic_write (gv->builtin_topic_interface, &proxypp->e, timestamp, true);
+
+  /* Register lease for auto liveliness, but be careful not to accidentally re-register
+     DDSI2's lease, as we may have become dependent on DDSI2 any time after
+     entidx_insert_proxy_participant_guid even if privileged_pp_guid was NULL originally */
+  ddsrt_mutex_lock (&proxypp->e.lock);
+  if (proxypp->owns_lease)
+    lease_register (ddsrt_atomic_ldvoidp (&proxypp->minl_auto));
+  ddsrt_mutex_unlock (&proxypp->e.lock);
+
+#ifdef DDSI_INCLUDE_SECURITY
+  if (is_secure)
+    proxy_participant_create_handshakes (gv, proxypp);
 #endif
 }
 
@@ -5184,7 +5151,7 @@ static void downgrade_to_nonsecure(struct proxy_participant *proxypp)
 
   /* Cleanup all kinds of related security information. */
   q_omg_security_deregister_remote_participant(proxypp);
-  proxypp->bes &= BES_MASK_NON_SECURITY;
+  proxypp->bes &= NN_BES_MASK_NON_SECURITY;
 }
 #endif
 

From e0a9beb3cb73de55a87c404595a2c72498039537 Mon Sep 17 00:00:00 2001
From: Erik Boasson <eb@ilities.com>
Date: Mon, 24 Feb 2020 13:11:52 +0100
Subject: [PATCH 101/238] Fix condition for validating topic access rules

Signed-off-by: Erik Boasson <eb@ilities.com>
---
 .../builtin_plugins/access_control/src/access_control_parser.c  | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/security/builtin_plugins/access_control/src/access_control_parser.c b/src/security/builtin_plugins/access_control/src/access_control_parser.c
index 5f1cf2d..fbf106c 100644
--- a/src/security/builtin_plugins/access_control/src/access_control_parser.c
+++ b/src/security/builtin_plugins/access_control/src/access_control_parser.c
@@ -419,7 +419,7 @@ static DDS_Security_boolean validate_rules(const struct domain_rule *rule, DDS_S
     {
       /* Last but not least, check the domain ids (ex is set when there's a failure) */
       validate_domains(rule->domains->domain_id_set, ex);
-      if (!rule->topic_access_rules && rule->topic_access_rules->topic_rule)
+      if (!(rule->topic_access_rules && rule->topic_access_rules->topic_rule))
         DDS_Security_Exception_set(ex, DDS_ACCESS_CONTROL_PLUGIN_CONTEXT, DDS_SECURITY_ERR_IDENTITY_EMPTY_CODE, 0, "Found rule in Governance file without topic_access_rules");
       else
       {

From 0d5a8bf4611326987816cc00346dc4fdf449e0ec Mon Sep 17 00:00:00 2001
From: Erik Boasson <eb@ilities.com>
Date: Mon, 24 Feb 2020 13:12:39 +0100
Subject: [PATCH 102/238] Remove built-in crypto plugin unused variables

Signed-off-by: Erik Boasson <eb@ilities.com>
---
 .../cryptographic/src/crypto_transform.c         | 16 +++++-----------
 1 file changed, 5 insertions(+), 11 deletions(-)

diff --git a/src/security/builtin_plugins/cryptographic/src/crypto_transform.c b/src/security/builtin_plugins/cryptographic/src/crypto_transform.c
index f27ea24..0088f94 100644
--- a/src/security/builtin_plugins/cryptographic/src/crypto_transform.c
+++ b/src/security/builtin_plugins/cryptographic/src/crypto_transform.c
@@ -1082,7 +1082,6 @@ encode_datawriter_submessage_encrypt (
   struct submsg_header *prefix;
   struct crypto_header *header;
   struct submsg_header *postfix;
-  struct submsg_header *body;
   struct crypto_footer *footer;
   uint32_t transform_kind, transform_id;
   DDS_Security_boolean result = false;
@@ -1147,7 +1146,7 @@ encode_datawriter_submessage_encrypt (
       goto enc_dw_submsg_fail;
 
     /* add SEC_BODY submessage */
-    body = add_submessage(&data, SMID_SEC_BODY_KIND, flags, submsg_len);
+    struct submsg_header *body = add_submessage(&data, SMID_SEC_BODY_KIND, flags, submsg_len);
     encrypted = (struct encrypted_data *)(body + 1);
     contents = encrypted->data;
 
@@ -1171,7 +1170,6 @@ encode_datawriter_submessage_encrypt (
       goto enc_dw_submsg_fail;
 
     /* copy submessage */
-    body = (struct submsg_header *)contents;
     memcpy(contents, plain_submsg->_buffer, plain_submsg->_length);
     payload_len = plain_submsg->_length;
     data._length += payload_len;
@@ -1319,7 +1317,6 @@ encode_datareader_submessage(
   struct submsg_header *prefix;
   struct crypto_header *header;
   struct submsg_header *postfix;
-  struct submsg_header *body;
   struct crypto_footer *footer;
   session_key_material *session = NULL;
   DDS_Security_ProtectionKind protection_kind;
@@ -1404,7 +1401,7 @@ encode_datareader_submessage(
       goto enc_dr_submsg_fail;
 
     /* add SEC_BODY submessage */
-    body = add_submessage(&data, SMID_SEC_BODY_KIND, flags, submsg_len);
+    struct submsg_header *body = add_submessage(&data, SMID_SEC_BODY_KIND, flags, submsg_len);
     encrypted = (struct encrypted_data *)(body + 1);
     contents = encrypted->data;
 
@@ -1428,7 +1425,6 @@ encode_datareader_submessage(
       goto enc_dr_submsg_fail;
 
     /* copy submessage */
-    body = (struct submsg_header *)contents;
     memcpy(contents, plain_submsg->_buffer, plain_submsg->_length);
     payload_len = plain_submsg->_length;
     data._length += payload_len;
@@ -1540,8 +1536,6 @@ static DDS_Security_boolean encode_rtps_message_sign (
     DDS_Security_SecurityException *ex
 )
 {
-  size_t length_to_postfix, remaining = encoded_rtps_message->_length;
-  unsigned char *ptr;
   DDS_Security_boolean result;
   struct submsg_header *prefix = (struct submsg_header *)(encoded_rtps_message->_buffer + RTPS_HEADER_SIZE);
   struct crypto_header *header = (struct crypto_header *)(prefix + 1);
@@ -1551,13 +1545,13 @@ static DDS_Security_boolean encode_rtps_message_sign (
   if (submessage_header->id == SMID_SRTPS_INFO_SRC_KIND) /* not encrypted */
   {
     /* skip INFO_SRC_HDR to RTPS submessage header */
-    ptr = ((unsigned char *)submessage_header + sizeof(struct submsg_header) + submessage_header->length);
-    remaining = (size_t) (encoded_rtps_message->_buffer + encoded_rtps_message->_length - ptr);
+    unsigned char *ptr = ((unsigned char *)submessage_header + sizeof(struct submsg_header) + submessage_header->length);
+    size_t remaining = (size_t) (encoded_rtps_message->_buffer + encoded_rtps_message->_length - ptr);
     /* There may be multiple RTPS submessages until postfix */
     while (remaining - sizeof(struct submsg_header) > 0)
     {
       submessage_header = (struct submsg_header *)ptr;
-      length_to_postfix = submessage_header->length + sizeof(struct submsg_header);
+      size_t length_to_postfix = submessage_header->length + sizeof(struct submsg_header);
       postfix = (struct submsg_header *)(((unsigned char *)submessage_header) + length_to_postfix);
       if (postfix->id == SMID_SRTPS_POSTFIX_KIND)
         break;

From 1c77aad39c1cad71195a932a68ac21ec72345266 Mon Sep 17 00:00:00 2001
From: Erik Boasson <eb@ilities.com>
Date: Mon, 24 Feb 2020 13:13:23 +0100
Subject: [PATCH 103/238] Fix Clang static analyzer warnings

Signed-off-by: Erik Boasson <eb@ilities.com>
---
 .../authentication/src/authentication.c       |  2 +-
 .../cryptographic/src/crypto_key_factory.c    |  2 ++
 .../src/decode_serialized_payload_utests.c    |  6 +++++
 .../src/encode_datareader_submessage_utests.c |  7 ++++++
 .../src/encode_datawriter_submessage_utests.c |  9 +++++++
 .../src/encode_rtps_message_utests.c          | 25 +++++++++++--------
 .../src/encode_serialized_payload_utests.c    |  4 +++
 ...thenticated_peer_credential_token_utests.c | 13 ++++++++++
 .../src/get_xxx_sec_attributes_utests.c       |  2 +-
 .../src/listeners_authentication_utests.c     | 12 +++++++--
 .../src/process_handshake_utests.c            | 21 +++++++++++++++-
 .../src/register_local_datareader_utests.c    |  9 +++++--
 .../src/register_local_datawriter_utests.c    | 13 +++++++---
 .../src/register_local_participant_utests.c   |  4 +++
 ...egister_matched_remote_datareader_utests.c | 10 +++++---
 ...egister_matched_remote_datawriter_utests.c | 12 ++++++---
 .../validate_begin_handshake_reply_utests.c   | 22 ++++++++--------
 .../src/validate_local_identity_utests.c      |  3 +++
 .../src/validate_local_permissions_utests.c   |  1 +
 .../src/validate_remote_permissions_utests.c  |  2 ++
 .../mock_authentication.c                     |  6 +++++
 .../mock_authentication.c                     |  6 +++++
 22 files changed, 154 insertions(+), 37 deletions(-)

diff --git a/src/security/builtin_plugins/authentication/src/authentication.c b/src/security/builtin_plugins/authentication/src/authentication.c
index 257debc..09d3425 100644
--- a/src/security/builtin_plugins/authentication/src/authentication.c
+++ b/src/security/builtin_plugins/authentication/src/authentication.c
@@ -660,7 +660,7 @@ free_binary_properties(
     uint32_t length)
 {
     uint32_t i;
-
+    assert (seq);
     for (i = 0; i < length; i++) {
         ddsrt_free(seq[i].name);
         ddsrt_free(seq[i].value._buffer);
diff --git a/src/security/builtin_plugins/cryptographic/src/crypto_key_factory.c b/src/security/builtin_plugins/cryptographic/src/crypto_key_factory.c
index 833ca01..e77c99c 100644
--- a/src/security/builtin_plugins/cryptographic/src/crypto_key_factory.c
+++ b/src/security/builtin_plugins/cryptographic/src/crypto_key_factory.c
@@ -1150,6 +1150,8 @@ crypto_factory_set_datawriter_crypto_tokens(
   endpoint_relation *relation;
   uint32_t key_id, i;
 
+  assert (num_key_mat > 0);
+
   remote_writer_crypto = (remote_datawriter_crypto *)crypto_object_table_find(impl->crypto_objects, remote_writer_handle);
   if (!remote_writer_crypto)
   {
diff --git a/src/security/builtin_plugins/tests/decode_serialized_payload/src/decode_serialized_payload_utests.c b/src/security/builtin_plugins/tests/decode_serialized_payload/src/decode_serialized_payload_utests.c
index 91d7e55..05fcf46 100644
--- a/src/security/builtin_plugins/tests/decode_serialized_payload/src/decode_serialized_payload_utests.c
+++ b/src/security/builtin_plugins/tests/decode_serialized_payload/src/decode_serialized_payload_utests.c
@@ -9,6 +9,8 @@
  *
  * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
  */
+#include <assert.h>
+
 #include <openssl/evp.h>
 #include <openssl/hmac.h>
 #include <openssl/bio.h>
@@ -218,6 +220,7 @@ static DDS_Security_DatawriterCryptoHandle register_local_datawriter(bool encryp
     printf("register_local_datawriter: %s\n", exception.message ? exception.message : "Error message missing");
   }
 
+  assert (writer_crypto != 0);
   return writer_crypto;
 }
 
@@ -239,6 +242,7 @@ static DDS_Security_DatawriterCryptoHandle register_remote_datawriter(DDS_Securi
     printf("register_matched_remote_datareader: %s\n", exception.message ? exception.message : "Error message missing");
   }
 
+  assert (writer_crypto != 0);
   return writer_crypto;
 }
 
@@ -839,6 +843,7 @@ CU_Test(ddssec_builtin_decode_serialized_payload, invalid_data, .init = suite_de
   }
 
   CU_ASSERT_FATAL(result);
+  assert(result); // for Clang's static analyzer
   CU_ASSERT(exception.code == 0);
   CU_ASSERT(exception.message == NULL);
 
@@ -846,6 +851,7 @@ CU_Test(ddssec_builtin_decode_serialized_payload, invalid_data, .init = suite_de
 
   result = split_encoded_data(encoded_buffer._buffer, encoded_buffer._length, &header, &contents, (uint32_t *) &length, &footer);
   CU_ASSERT_FATAL(result);
+  assert(result); // for Clang's static analyzer
 
   /* use incorrect transformation kind */
   {
diff --git a/src/security/builtin_plugins/tests/encode_datareader_submessage/src/encode_datareader_submessage_utests.c b/src/security/builtin_plugins/tests/encode_datareader_submessage/src/encode_datareader_submessage_utests.c
index 2513a39..7d97531 100644
--- a/src/security/builtin_plugins/tests/encode_datareader_submessage/src/encode_datareader_submessage_utests.c
+++ b/src/security/builtin_plugins/tests/encode_datareader_submessage/src/encode_datareader_submessage_utests.c
@@ -804,6 +804,7 @@ static void encode_datareader_submessage_not_signed(uint32_t transformation_kind
 
   reader_crypto = register_local_datareader(&datareader_security_attributes, &datareader_properties);
   CU_ASSERT_FATAL(reader_crypto != 0);
+  assert(reader_crypto != 0); // for Clang's static analyzer
 
   session_keys = get_datareader_session(reader_crypto);
 
@@ -829,6 +830,7 @@ static void encode_datareader_submessage_not_signed(uint32_t transformation_kind
   }
 
   CU_ASSERT_FATAL(result);
+  assert(result); // for Clang's static analyzer
   CU_ASSERT(exception.code == 0);
   CU_ASSERT(exception.message == NULL);
 
@@ -836,6 +838,7 @@ static void encode_datareader_submessage_not_signed(uint32_t transformation_kind
 
   result = check_encoded_data(&encoded_buffer, is_encrypted, &header, &footer, &data);
   CU_ASSERT_FATAL(result);
+  assert(result); // for Clang's static analyzer
 
   CU_ASSERT(header->transform_identifier.transformation_kind[3] == transformation_kind);
 
@@ -951,6 +954,7 @@ static void encode_datareader_submessage_sign(uint32_t transformation_kind)
 
   reader_crypto = register_local_datareader(&datareader_security_attributes, &datareader_properties);
   CU_ASSERT_FATAL(reader_crypto != 0);
+  assert(reader_crypto != 0); // for Clang's static analyzer
 
   session_keys = get_datareader_session(reader_crypto);
 
@@ -960,6 +964,7 @@ static void encode_datareader_submessage_sign(uint32_t transformation_kind)
   {
     writer_crypto = register_remote_datawriter(reader_crypto);
     CU_ASSERT_FATAL(writer_crypto != 0);
+    assert(writer_crypto != 0); // for Clang's static analyzer
     writer_list._buffer[i] = writer_crypto;
   }
 
@@ -980,6 +985,7 @@ static void encode_datareader_submessage_sign(uint32_t transformation_kind)
   }
 
   CU_ASSERT_FATAL(result);
+  assert(result); // for Clang's static analyzer
   CU_ASSERT(exception.code == 0);
   CU_ASSERT(exception.message == NULL);
 
@@ -988,6 +994,7 @@ static void encode_datareader_submessage_sign(uint32_t transformation_kind)
 
   result = check_encoded_data(&encoded_buffer, is_encrypted, &header, &footer, &data);
   CU_ASSERT_FATAL(result);
+  assert(result); // for Clang's static analyzer
 
   CU_ASSERT(header->transform_identifier.transformation_kind[3] == transformation_kind);
 
diff --git a/src/security/builtin_plugins/tests/encode_datawriter_submessage/src/encode_datawriter_submessage_utests.c b/src/security/builtin_plugins/tests/encode_datawriter_submessage/src/encode_datawriter_submessage_utests.c
index e4c7428..f7433ac 100644
--- a/src/security/builtin_plugins/tests/encode_datawriter_submessage/src/encode_datawriter_submessage_utests.c
+++ b/src/security/builtin_plugins/tests/encode_datawriter_submessage/src/encode_datawriter_submessage_utests.c
@@ -810,11 +810,13 @@ static void encode_datawriter_submessage_not_signed(DDS_Security_CryptoTransform
 
   writer_crypto = register_local_datawriter(&datawriter_security_attributes, &datawriter_properties);
   CU_ASSERT_FATAL(writer_crypto != 0);
+  assert(writer_crypto != 0); // for Clang's static analyzer
 
   session_keys = get_datawriter_session(writer_crypto);
 
   reader_crypto = register_remote_datareader(writer_crypto);
   CU_ASSERT_FATAL(reader_crypto != 0);
+  assert(reader_crypto != 0); // for Clang's static analyzer
 
   reader_list._length = reader_list._maximum = 1;
   reader_list._buffer = DDS_Security_DatareaderCryptoHandleSeq_allocbuf(1);
@@ -837,6 +839,8 @@ static void encode_datawriter_submessage_not_signed(DDS_Security_CryptoTransform
   }
 
   CU_ASSERT_FATAL(result);
+  assert(result != 0); // for Clang's static analyzer
+
   CU_ASSERT(exception.code == 0);
   CU_ASSERT(exception.message == NULL);
 
@@ -844,6 +848,7 @@ static void encode_datawriter_submessage_not_signed(DDS_Security_CryptoTransform
 
   result = check_encoded_data(&encoded_buffer, is_encrypted, &header, &footer, &data);
   CU_ASSERT_FATAL(result);
+  assert(result); // for Clang's static analyzer
 
   CU_ASSERT(header->transform_identifier.transformation_kind[3] == transformation_kind);
 
@@ -961,6 +966,7 @@ static void encode_datawriter_submessage_sign(DDS_Security_CryptoTransformKind_E
 
   writer_crypto = register_local_datawriter(&datawriter_security_attributes, &datawriter_properties);
   CU_ASSERT_FATAL(writer_crypto != 0);
+  assert(writer_crypto != 0); // for Clang's static analyzer
 
   session_keys = get_datawriter_session(writer_crypto);
 
@@ -970,6 +976,7 @@ static void encode_datawriter_submessage_sign(DDS_Security_CryptoTransformKind_E
   {
     reader_crypto = register_remote_datareader(writer_crypto);
     CU_ASSERT_FATAL(reader_crypto != 0);
+    assert(reader_crypto != 0); // for Clang's static analyzer
     reader_list._buffer[i] = reader_crypto;
   }
   index = 0;
@@ -994,6 +1001,7 @@ static void encode_datawriter_submessage_sign(DDS_Security_CryptoTransformKind_E
     }
 
     CU_ASSERT_FATAL(result);
+    assert(result); // for Clang's static analyzer
     CU_ASSERT(exception.code == 0);
     CU_ASSERT(exception.message == NULL);
 
@@ -1003,6 +1011,7 @@ static void encode_datawriter_submessage_sign(DDS_Security_CryptoTransformKind_E
 
   result = check_encoded_data(&encoded_buffer, is_encrypted, &header, &footer, &data);
   CU_ASSERT_FATAL(result);
+  assert(result); // for Clang's static analyzer
 
   CU_ASSERT(header->transform_identifier.transformation_kind[3] == transformation_kind);
 
diff --git a/src/security/builtin_plugins/tests/encode_rtps_message/src/encode_rtps_message_utests.c b/src/security/builtin_plugins/tests/encode_rtps_message/src/encode_rtps_message_utests.c
index d65a0c7..bdcbb95 100644
--- a/src/security/builtin_plugins/tests/encode_rtps_message/src/encode_rtps_message_utests.c
+++ b/src/security/builtin_plugins/tests/encode_rtps_message/src/encode_rtps_message_utests.c
@@ -40,7 +40,7 @@ static DDS_Security_IdentityHandle local_participant_identity = 1;
 static DDS_Security_IdentityHandle remote_participant_identities[] = {2, 3, 4, 5};
 
 static DDS_Security_ParticipantCryptoHandle local_particpant_crypto = 0;
-static DDS_Security_ParticipantCryptoHandle remote_particpant_cryptos[4];
+static DDS_Security_ParticipantCryptoHandle remote_particpant_cryptos[sizeof(remote_participant_identities) / sizeof(remote_participant_identities[0])];
 
 static DDS_Security_SharedSecretHandleImpl *shared_secret_handle_impl = NULL;
 static DDS_Security_SharedSecretHandle shared_secret_handle;
@@ -63,7 +63,7 @@ struct submsg_header
 struct crypto_header
 {
   struct CryptoTransformIdentifier transform_identifier;
-  unsigned char session_id[4];
+  unsigned char session_id[sizeof(remote_participant_identities) / sizeof(remote_participant_identities[0])];
   unsigned char init_vector_suffix[8];
 };
 
@@ -167,7 +167,7 @@ static int register_remote_participants(void)
   unsigned i;
   int result = 0;
 
-  for (i = 0; i < 4; ++i)
+  for (i = 0; i < sizeof(remote_particpant_cryptos) / sizeof(remote_particpant_cryptos[0]); ++i)
   {
     remote_particpant_cryptos[i] =
         crypto->crypto_key_factory->register_matched_remote_participant(
@@ -194,7 +194,7 @@ unregister_remote_participants(void)
 {
   unsigned i;
   DDS_Security_SecurityException exception = {NULL, 0, 0};
-  for (i = 0; i < 4; ++i)
+  for (i = 0; i < sizeof(remote_particpant_cryptos) / sizeof(remote_particpant_cryptos[0]); ++i)
   {
     if (remote_particpant_cryptos[i])
     {
@@ -825,6 +825,7 @@ static void encode_rtps_message_not_authenticated(DDS_Security_CryptoTransformKi
   }
 
   CU_ASSERT_FATAL(result);
+  assert(result); // for Clang's static analyzer
   CU_ASSERT(exception.code == 0);
   CU_ASSERT(exception.message == NULL);
 
@@ -832,6 +833,7 @@ static void encode_rtps_message_not_authenticated(DDS_Security_CryptoTransformKi
 
   result = check_encoded_data(&encoded_buffer, encrypted, &header, &footer, &data);
   CU_ASSERT_FATAL(result);
+  assert(result); // for Clang's static analyzer
 
   CU_ASSERT(header->transform_identifier.transformation_kind[3] == transformation_kind);
 
@@ -922,7 +924,7 @@ static void encode_rtps_message_sign(DDS_Security_CryptoTransformKind_Enum trans
   struct crypto_header *header = NULL;
   struct crypto_footer *footer = NULL;
   uint32_t session_id;
-  int i;
+  size_t i;
 
   CU_ASSERT_FATAL(crypto != NULL);
   CU_ASSERT_FATAL(crypto->crypto_transform != NULL);
@@ -943,9 +945,9 @@ static void encode_rtps_message_sign(DDS_Security_CryptoTransformKind_Enum trans
 
   register_remote_participants();
 
-  reader_list._length = reader_list._maximum = 4;
-  reader_list._buffer = DDS_Security_ParticipantCryptoHandleSeq_allocbuf(4);
-  for (i = 0; i < 4; i++)
+  reader_list._length = reader_list._maximum = (uint32_t) (sizeof(remote_particpant_cryptos) / sizeof(remote_particpant_cryptos[0]));
+  reader_list._buffer = DDS_Security_ParticipantCryptoHandleSeq_allocbuf(reader_list._maximum);
+  for (i = 0; i < sizeof(remote_particpant_cryptos) / sizeof(remote_particpant_cryptos[0]); i++)
   {
     set_remote_participant_protection_kind(remote_particpant_cryptos[i], protection_kind);
     reader_list._buffer[i] = remote_particpant_cryptos[i];
@@ -955,7 +957,7 @@ static void encode_rtps_message_sign(DDS_Security_CryptoTransformKind_Enum trans
   /* Now call the function. */
 
   buffer = &plain_buffer;
-  while (index != 4)
+  while ((uint32_t) index != reader_list._length)
   {
     result = crypto->crypto_transform->encode_rtps_message(
         crypto->crypto_transform,
@@ -1082,14 +1084,17 @@ CU_Test(ddssec_builtin_encode_rtps_message, invalid_args, .init = suite_encode_r
   memset(&empty_reader_list, 0, sizeof(empty_reader_list));
 
   CU_ASSERT_FATAL(local_particpant_crypto != 0);
+  assert(local_particpant_crypto != 0); // for Clang's static analyzer
 
   register_remote_participants();
-  for (i = 0; i < 4; i++)
+  for (i = 0; i < sizeof (remote_particpant_cryptos) / sizeof (remote_particpant_cryptos[0]); i++)
   {
+    assert (remote_particpant_cryptos[i]); // for Clang's static analyzer
     set_remote_participant_protection_kind(remote_particpant_cryptos[i], DDS_SECURITY_PROTECTION_KIND_ENCRYPT_WITH_ORIGIN_AUTHENTICATION);
   }
 
   CU_ASSERT_FATAL(remote_particpant_cryptos[0] != 0);
+  assert(remote_particpant_cryptos[0] != 0); // for Clang's static analyzer
 
   reader_list._length = reader_list._maximum = 1;
   reader_list._buffer = DDS_Security_ParticipantCryptoHandleSeq_allocbuf(1);
diff --git a/src/security/builtin_plugins/tests/encode_serialized_payload/src/encode_serialized_payload_utests.c b/src/security/builtin_plugins/tests/encode_serialized_payload/src/encode_serialized_payload_utests.c
index f477ea3..e4cd8ea 100644
--- a/src/security/builtin_plugins/tests/encode_serialized_payload/src/encode_serialized_payload_utests.c
+++ b/src/security/builtin_plugins/tests/encode_serialized_payload/src/encode_serialized_payload_utests.c
@@ -566,6 +566,8 @@ static void encode_serialized_payload_check(uint32_t key_size, bool encrypted)
 
   writer_crypto = register_local_datawriter(encrypted);
   CU_ASSERT_FATAL(writer_crypto != 0);
+  assert(writer_crypto != 0); // for Clang's static analyzer
+
   CU_ASSERT(check_protection_kind(writer_crypto, encrypted ? DDS_SECURITY_BASICPROTECTION_KIND_ENCRYPT : DDS_SECURITY_BASICPROTECTION_KIND_SIGN));
 
   session_keys = get_datawriter_session(writer_crypto);
@@ -586,12 +588,14 @@ static void encode_serialized_payload_check(uint32_t key_size, bool encrypted)
     printf("[ERROR] encode_serialized_payload: %s\n", exception.message ? exception.message : "Error message missing");
   }
   CU_ASSERT_FATAL(result);
+  assert(result); // for Clang's static analyzer
   CU_ASSERT(exception.code == 0);
   CU_ASSERT(exception.message == NULL);
   reset_exception(&exception);
 
   result = split_encoded_data(encoded_buffer._buffer, encoded_buffer._length, &header, &encoded_payload, &footer, encrypted);
   CU_ASSERT_FATAL(result == true);
+  assert(result); // for Clang's static analyzer
   CU_ASSERT(check_payload_encoded(&encoded_payload, &plain_buffer, encrypted));
 
   session_id = ddsrt_fromBE4u(*(uint32_t *)header->session_id);
diff --git a/src/security/builtin_plugins/tests/get_authenticated_peer_credential_token/src/get_authenticated_peer_credential_token_utests.c b/src/security/builtin_plugins/tests/get_authenticated_peer_credential_token/src/get_authenticated_peer_credential_token_utests.c
index 160ae83..6ae66d7 100644
--- a/src/security/builtin_plugins/tests/get_authenticated_peer_credential_token/src/get_authenticated_peer_credential_token_utests.c
+++ b/src/security/builtin_plugins/tests/get_authenticated_peer_credential_token/src/get_authenticated_peer_credential_token_utests.c
@@ -1256,6 +1256,7 @@ fill_handshake_message_token(
 
         CU_ASSERT(hash1_from_request != NULL);
         CU_ASSERT(hash2_from_reply != NULL);
+        assert(hash1_from_request && hash2_from_reply); // for Clang's static analyzer
 
         set_binary_property_value(hash_c1, "hash_c1", hash1_from_request->value._buffer, hash1_from_request->value._length);
         set_binary_property_value(hash_c2, "hash_c2", hash2_from_reply->value._buffer, hash2_from_reply->value._length);
@@ -1382,6 +1383,7 @@ CU_Test(ddssec_builtin_get_authenticated_peer_credential,token_after_request )
                     &exception);
 
     CU_ASSERT_FATAL(result == DDS_SECURITY_VALIDATION_PENDING_HANDSHAKE_MESSAGE);
+    assert(result == DDS_SECURITY_VALIDATION_PENDING_HANDSHAKE_MESSAGE); // for Clang's static analyzer
 
     /* mock reply */
     dh1 = find_binary_property(&handshake_token_out, "dh1");
@@ -1414,6 +1416,7 @@ CU_Test(ddssec_builtin_get_authenticated_peer_credential,token_after_request )
                         handshake_handle,
                         &exception);
     CU_ASSERT_FATAL(result == DDS_SECURITY_VALIDATION_OK_FINAL_MESSAGE);
+    assert(result == DDS_SECURITY_VALIDATION_OK_FINAL_MESSAGE); // for Clang's static analyzer
 
     /*
      * Actual test.
@@ -1425,8 +1428,10 @@ CU_Test(ddssec_builtin_get_authenticated_peer_credential,token_after_request )
                         &exception);
 
     CU_ASSERT_TRUE (success);
+    assert(success); // for Clang's static analyzer
 
     CU_ASSERT_FATAL(credential_token.class_id != NULL);
+    assert(credential_token.class_id); // for Clang's static analyzer
     CU_ASSERT(strcmp(credential_token.class_id, AUTH_PROTOCOL_CLASS_ID) == 0);
     CU_ASSERT(credential_token.properties._length == 2);
     CU_ASSERT(credential_token.binary_properties._length == 0);
@@ -1434,12 +1439,14 @@ CU_Test(ddssec_builtin_get_authenticated_peer_credential,token_after_request )
     c_id = find_property(&credential_token, "c.id");
     CU_ASSERT_FATAL(c_id != NULL);
     CU_ASSERT_FATAL(c_id->value != NULL);
+    assert(c_id && c_id->value); // for Clang's static analyzer
     //printf("c_id->value: %s\n", c_id->value);
     CU_ASSERT(strcmp(c_id->value, REMOTE_IDENTITY_CERTIFICATE) == 0);
 
     c_perm = find_property(&credential_token, "c.perm");
     CU_ASSERT_FATAL(c_perm != NULL);
     CU_ASSERT_FATAL(c_perm->value != NULL);
+    assert(c_perm && c_perm->value); // for Clang's static analyzer
     //printf("c_perm->value: %s\n", c_perm->value);
     CU_ASSERT(strcmp(c_perm->value, PERMISSIONS_DOCUMENT) == 0);
 
@@ -1506,6 +1513,7 @@ CU_Test(ddssec_builtin_get_authenticated_peer_credential,token_after_reply )
                     &exception);
 
     CU_ASSERT_FATAL(result == DDS_SECURITY_VALIDATION_PENDING_HANDSHAKE_MESSAGE);
+    assert(result == DDS_SECURITY_VALIDATION_PENDING_HANDSHAKE_MESSAGE); // for Clang's static analyzer
 
     /* mock final */
     dh2 = find_binary_property(&handshake_token_out, "dh2");
@@ -1539,6 +1547,7 @@ CU_Test(ddssec_builtin_get_authenticated_peer_credential,token_after_reply )
                         &exception);
 
     CU_ASSERT_FATAL(result == DDS_SECURITY_VALIDATION_OK);
+    assert(result == DDS_SECURITY_VALIDATION_OK); // for Clang's static analyzer
 
     /*
      * Actual test.
@@ -1550,6 +1559,7 @@ CU_Test(ddssec_builtin_get_authenticated_peer_credential,token_after_reply )
                         &exception);
 
     CU_ASSERT_TRUE (success);
+    assert(success); // for Clang's static analyzer
 
     CU_ASSERT_FATAL(credential_token.class_id != NULL);
     CU_ASSERT(strcmp(credential_token.class_id, AUTH_PROTOCOL_CLASS_ID) == 0);
@@ -1559,12 +1569,14 @@ CU_Test(ddssec_builtin_get_authenticated_peer_credential,token_after_reply )
     c_id = find_property(&credential_token, "c.id");
     CU_ASSERT_FATAL(c_id != NULL);
     CU_ASSERT_FATAL(c_id->value != NULL);
+    assert(c_id && c_id->value); // for Clang's static analyzer
     //printf("c_id->value: %s\n", c_id->value);
     CU_ASSERT(strcmp(c_id->value, REMOTE_IDENTITY_CERTIFICATE) == 0);
 
     c_perm = find_property(&credential_token, "c.perm");
     CU_ASSERT_FATAL(c_perm != NULL);
     CU_ASSERT_FATAL(c_perm->value != NULL);
+    assert(c_perm && c_perm->value); // for Clang's static analyzer
     //printf("c_perm->value: %s\n", c_perm->value);
     CU_ASSERT(strcmp(c_perm->value, PERMISSIONS_DOCUMENT) == 0);
 
@@ -1581,6 +1593,7 @@ CU_Test(ddssec_builtin_get_authenticated_peer_credential,token_after_reply )
 
     success = g_auth->return_handshake_handle(g_auth, handshake_handle, &exception);
     CU_ASSERT_TRUE (success);
+    assert(success); // for Clang's static analyzer
 
     reset_exception(&exception);
 
diff --git a/src/security/builtin_plugins/tests/get_xxx_sec_attributes/src/get_xxx_sec_attributes_utests.c b/src/security/builtin_plugins/tests/get_xxx_sec_attributes/src/get_xxx_sec_attributes_utests.c
index 91381aa..04df354 100644
--- a/src/security/builtin_plugins/tests/get_xxx_sec_attributes/src/get_xxx_sec_attributes_utests.c
+++ b/src/security/builtin_plugins/tests/get_xxx_sec_attributes/src/get_xxx_sec_attributes_utests.c
@@ -1279,7 +1279,7 @@ static void test_liveliness_discovery_reader_attr(
   DDS_Security_DataTagQosPolicy data_tag;
   DDS_Security_PartitionQosPolicy *partition = NULL;
   bool result;
-  return;
+
   CU_ASSERT_FATAL(access_control->get_datareader_sec_attributes != NULL);
 
   memset(&attr, 0, sizeof(attr));
diff --git a/src/security/builtin_plugins/tests/listeners_authentication/src/listeners_authentication_utests.c b/src/security/builtin_plugins/tests/listeners_authentication/src/listeners_authentication_utests.c
index a039d25..779b254 100644
--- a/src/security/builtin_plugins/tests/listeners_authentication/src/listeners_authentication_utests.c
+++ b/src/security/builtin_plugins/tests/listeners_authentication/src/listeners_authentication_utests.c
@@ -1724,7 +1724,8 @@ fill_handshake_message_token(
            set_binary_property_string(c_kagree_algo, "c.kagree_algox", "rubbish");
         }
 
-        CU_ASSERT(hash1_from_request != NULL);
+        CU_ASSERT_FATAL(hash1_from_request != NULL);
+        assert(hash1_from_request != NULL); // for Clang's static analyzer
 
         set_binary_property_value(hash_c1, "hash_c1", hash1_from_request->value._buffer, hash1_from_request->value._length);
 
@@ -1786,6 +1787,7 @@ fill_handshake_message_token(
             EVP_PKEY *private_key_x509;
             unsigned char *sign;
             size_t signlen;
+            DDS_Security_ValidationResult_t rc;
 
             const DDS_Security_BinaryProperty_t * binary_properties[ HANDSHAKE_SIGNATURE_SIZE ];
 
@@ -1802,10 +1804,14 @@ fill_handshake_message_token(
             binary_properties[4] = dh1;
             binary_properties[5] = hash_c1;
 
-            if (create_signature_for_test(private_key_x509, binary_properties, HANDSHAKE_SIGNATURE_SIZE , &sign, &signlen, &exception) != DDS_SECURITY_VALIDATION_OK)
+            rc = create_signature_for_test(private_key_x509, binary_properties, HANDSHAKE_SIGNATURE_SIZE , &sign, &signlen, &exception);
+            if (rc != DDS_SECURITY_VALIDATION_OK)
             {
                 printf("Exception: %s\n", exception.message);
             }
+            CU_ASSERT_FATAL (rc == DDS_SECURITY_VALIDATION_OK);
+            assert(rc == DDS_SECURITY_VALIDATION_OK); // for Clang's static analyzer
+          
             set_binary_property_value(signature, "signature", sign, (uint32_t)signlen);
 
             ddsrt_free(sign);
@@ -2008,8 +2014,10 @@ CU_Test(ddssec_builtin_listeners_auth, local_remote_set_before_validation)
     hash1_sent_in_request = find_binary_property(&handshake_token_out, "hash_c1");
 
     CU_ASSERT_FATAL(dh1 != NULL);
+    assert(dh1 != NULL); // for Clang's static analyzer
     CU_ASSERT_FATAL(dh1->value._length > 0);
     CU_ASSERT_FATAL(dh1->value._buffer != NULL);
+    assert(dh1->value._length > 0 && dh1->value._buffer != NULL); // for Clang's static analyzer
 
     dh1_pub_key.data = dh1->value._buffer;
     dh1_pub_key.length = dh1->value._length;
diff --git a/src/security/builtin_plugins/tests/process_handshake/src/process_handshake_utests.c b/src/security/builtin_plugins/tests/process_handshake/src/process_handshake_utests.c
index 5b2f5d6..dabd5a8 100644
--- a/src/security/builtin_plugins/tests/process_handshake/src/process_handshake_utests.c
+++ b/src/security/builtin_plugins/tests/process_handshake/src/process_handshake_utests.c
@@ -1292,7 +1292,8 @@ fill_handshake_message_token(
            set_binary_property_string(c_kagree_algo, "c.kagree_algox", "rubbish");
         }
 
-        CU_ASSERT(hash1_from_request != NULL);
+        CU_ASSERT_FATAL(hash1_from_request != NULL);
+        assert(hash1_from_request != NULL); // for Clang's static analyzer
 
         set_binary_property_value(hash_c1, "hash_c1", hash1_from_request->value._buffer, hash1_from_request->value._length);
 
@@ -1587,8 +1588,10 @@ CU_Test(ddssec_builtin_process_handshake,happy_day_after_request )
     hash1_sentrequest = find_binary_property(&handshake_token_out, "hash_c1");
 
     CU_ASSERT_FATAL(dh1 != NULL);
+    assert(dh1 != NULL); // for Clang's static analyzer
     CU_ASSERT_FATAL(dh1->value._length > 0);
     CU_ASSERT_FATAL(dh1->value._buffer != NULL);
+    assert(dh1->value._length > 0 && dh1->value._buffer != NULL); // for Clang's static analyzer
 
     dh1_pub_key.data = dh1->value._buffer;
     dh1_pub_key.length = dh1->value._length;
@@ -1875,8 +1878,10 @@ CU_Test(ddssec_builtin_process_handshake,invalid_certificate )
     hash1_sentrequest = find_binary_property(&handshake_token_out, "hash_c1");
 
     CU_ASSERT_FATAL(dh1 != NULL);
+    assert(dh1 != NULL); // for Clang's static analyzer
     CU_ASSERT_FATAL(dh1->value._length > 0);
     CU_ASSERT_FATAL(dh1->value._buffer != NULL);
+    assert(dh1->value._length > 0 && dh1->value._buffer != NULL); // for Clang's static analyzer
 
     /* prepare reply */
     dh1_pub_key.data = dh1->value._buffer;
@@ -1959,8 +1964,10 @@ CU_Test(ddssec_builtin_process_handshake,invalid_dsign_algo )
     hash1_sentrequest = find_binary_property(&handshake_token_out, "hash_c1");
 
     CU_ASSERT_FATAL(dh1 != NULL);
+    assert(dh1 != NULL); // for Clang's static analyzer
     CU_ASSERT_FATAL(dh1->value._length > 0);
     CU_ASSERT_FATAL(dh1->value._buffer != NULL);
+    assert(dh1->value._length > 0 && dh1->value._buffer != NULL); // for Clang's static analyzer
 
     /* prepare reply */
     dh1_pub_key.data = dh1->value._buffer;
@@ -2037,8 +2044,10 @@ CU_Test(ddssec_builtin_process_handshake,invalid_kagree_algo )
     hash1_sentrequest = find_binary_property(&handshake_token_out, "hash_c1");
 
     CU_ASSERT_FATAL(dh1 != NULL);
+    assert (dh1 != NULL); // for Clang's static analyzer
     CU_ASSERT_FATAL(dh1->value._length > 0);
     CU_ASSERT_FATAL(dh1->value._buffer != NULL);
+    assert (dh1->value._length > 0 && dh1->value._buffer != NULL); // for Clang's static analyzer
 
     /* prepare reply */
     dh1_pub_key.data = dh1->value._buffer;
@@ -2114,8 +2123,10 @@ CU_Test(ddssec_builtin_process_handshake,invalid_diffie_hellman )
     hash1_sentrequest = find_binary_property(&handshake_token_out, "hash_c1");
 
     CU_ASSERT_FATAL(dh1 != NULL);
+    assert (dh1 != NULL); // for Clang's static analyzer
     CU_ASSERT_FATAL(dh1->value._length > 0);
     CU_ASSERT_FATAL(dh1->value._buffer != NULL);
+    assert (dh1->value._length > 0 && dh1->value._buffer != NULL); // for Clang's static analyzer
 
     /* prepare reply */
     fill_handshake_message_token(
@@ -2244,6 +2255,8 @@ CU_Test(ddssec_builtin_process_handshake,extended_certificate_check )
     if (result != DDS_SECURITY_VALIDATION_PENDING_HANDSHAKE_MESSAGE) {
         printf("begin_handshake_request failed: %s\n", exception.message ? exception.message : "Error message missing");
     }
+    CU_ASSERT_FATAL(result == DDS_SECURITY_VALIDATION_PENDING_HANDSHAKE_MESSAGE);
+    assert(result == DDS_SECURITY_VALIDATION_PENDING_HANDSHAKE_MESSAGE); // for Clang's static analyzer
 
     /* get challenge 1 from the message */
     challenge1_glb = find_binary_property(&handshake_token_out, "challenge1");
@@ -2254,8 +2267,10 @@ CU_Test(ddssec_builtin_process_handshake,extended_certificate_check )
     hash1_sentrequest = find_binary_property(&handshake_token_out, "hash_c1");
 
     CU_ASSERT_FATAL(dh1 != NULL);
+    assert(dh1 != NULL); // for Clang's static analyzer
     CU_ASSERT_FATAL(dh1->value._length > 0);
     CU_ASSERT_FATAL(dh1->value._buffer != NULL);
+    assert(dh1->value._length > 0 && dh1->value._buffer != NULL); // for Clang's static analyzer
 
     dh1_pub_key.data = dh1->value._buffer;
     dh1_pub_key.length = dh1->value._length;
@@ -2328,8 +2343,10 @@ CU_Test(ddssec_builtin_process_handshake,extended_certificate_check )
     hash1_sentrequest = find_binary_property(&handshake_token_out, "hash_c1");
 
     CU_ASSERT_FATAL(dh1 != NULL);
+    assert (dh1 != NULL); // for Clang's static analyzer
     CU_ASSERT_FATAL(dh1->value._length > 0);
     CU_ASSERT_FATAL(dh1->value._buffer != NULL);
+    assert (dh1->value._length > 0 && dh1->value._buffer != NULL); // for Clang's static analyzer
 
     dh1_pub_key.data = dh1->value._buffer;
     dh1_pub_key.length = dh1->value._length;
@@ -2397,8 +2414,10 @@ CU_Test(ddssec_builtin_process_handshake,extended_certificate_check )
     hash1_sentrequest = find_binary_property(&handshake_token_out, "hash_c1");
 
     CU_ASSERT_FATAL(dh1 != NULL);
+    assert (dh1 != NULL); // for Clang's static analyzer
     CU_ASSERT_FATAL(dh1->value._length > 0);
     CU_ASSERT_FATAL(dh1->value._buffer != NULL);
+    assert (dh1->value._length > 0 && dh1->value._buffer != NULL); // for Clang's static analyzer
 
     dh1_pub_key.data = dh1->value._buffer;
     dh1_pub_key.length = dh1->value._length;
diff --git a/src/security/builtin_plugins/tests/register_local_datareader/src/register_local_datareader_utests.c b/src/security/builtin_plugins/tests/register_local_datareader/src/register_local_datareader_utests.c
index 327ddb7..5747ac3 100644
--- a/src/security/builtin_plugins/tests/register_local_datareader/src/register_local_datareader_utests.c
+++ b/src/security/builtin_plugins/tests/register_local_datareader/src/register_local_datareader_utests.c
@@ -9,6 +9,8 @@
  *
  * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
  */
+#include <assert.h>
+
 #include <openssl/evp.h>
 #include <openssl/hmac.h>
 #include <openssl/bio.h>
@@ -166,6 +168,7 @@ CU_Test(ddssec_builtin_register_local_datareader, happy_day, .init = suite_regis
 
   /* A valid handle to be returned */
   CU_ASSERT(result != 0);
+  assert(result != 0); // for Clang's static analyzer
 
   CU_ASSERT(exception.code == DDS_SECURITY_ERR_OK_CODE);
 
@@ -220,6 +223,7 @@ CU_Test(ddssec_builtin_register_local_datareader, builtin_endpoint, .init = suit
   /* A valid handle to be returned */
   CU_ASSERT(result != 0);
   CU_ASSERT(exception.code == DDS_SECURITY_ERR_OK_CODE);
+  assert(result != 0); // for Clang's static analyzer
 
   /* NOTE: It would be better to check if the keys have been generated but there is no interface to get them from handle */
   reader_crypto = (local_datareader_crypto *)result;
@@ -268,8 +272,9 @@ CU_Test(ddssec_builtin_register_local_datareader, special_endpoint_name, .init =
     printf("register_local_datareader: %s\n", exception.message ? exception.message : "Error message missing");
 
   /* A valid handle to be returned */
-  CU_ASSERT(result != 0);
-  CU_ASSERT(exception.code == DDS_SECURITY_ERR_OK_CODE);
+  CU_ASSERT_FATAL(result != 0);
+  assert(result != 0); // for Clang's static analyzer
+  CU_ASSERT_FATAL(exception.code == DDS_SECURITY_ERR_OK_CODE);
   CU_ASSERT_FATAL(((local_datareader_crypto *)result)->is_builtin_participant_volatile_message_secure_reader);
   reset_exception(&exception);
   DDS_Security_PropertySeq_deinit(&datareader_properties);
diff --git a/src/security/builtin_plugins/tests/register_local_datawriter/src/register_local_datawriter_utests.c b/src/security/builtin_plugins/tests/register_local_datawriter/src/register_local_datawriter_utests.c
index c6d1adc..16d13f3 100644
--- a/src/security/builtin_plugins/tests/register_local_datawriter/src/register_local_datawriter_utests.c
+++ b/src/security/builtin_plugins/tests/register_local_datawriter/src/register_local_datawriter_utests.c
@@ -9,6 +9,8 @@
  *
  * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
  */
+#include <assert.h>
+
 #include <openssl/evp.h>
 #include <openssl/hmac.h>
 #include <openssl/bio.h>
@@ -172,6 +174,7 @@ CU_Test(ddssec_builtin_register_local_datawriter, happy_day, .init = suite_regis
   /* A valid handle to be returned */
   CU_ASSERT(result != 0);
   CU_ASSERT(exception.code == DDS_SECURITY_ERR_OK_CODE);
+  assert(result != 0); // for Clang's static analyzer
 
   /* NOTE: It would be better to check if the keys have been generated but there is no interface to get them from handle */
   writer_crypto = (local_datawriter_crypto *)result;
@@ -230,8 +233,9 @@ CU_Test(ddssec_builtin_register_local_datawriter, builtin_endpoint, .init = suit
     printf("register_local_datawriter: %s\n", exception.message ? exception.message : "Error message missing");
 
   /* A valid handle to be returned */
-  CU_ASSERT(result != 0);
-  CU_ASSERT(exception.code == DDS_SECURITY_ERR_OK_CODE);
+  CU_ASSERT_FATAL(result != 0);
+  CU_ASSERT_FATAL(exception.code == DDS_SECURITY_ERR_OK_CODE);
+  assert(result != 0); // for Clang's static analyzer
 
   /* NOTE: It would be better to check if the keys have been generated but there is no interface to get them from handle */
   writer_crypto = (local_datawriter_crypto *)result;
@@ -289,8 +293,9 @@ CU_Test(ddssec_builtin_register_local_datawriter, special_endpoint_name, .init =
     printf("register_local_datawriter: %s\n", exception.message ? exception.message : "Error message missing");
 
   /* A valid handle to be returned */
-  CU_ASSERT(result != 0);
-  CU_ASSERT(exception.code == DDS_SECURITY_ERR_OK_CODE);
+  CU_ASSERT_FATAL(result != 0);
+  CU_ASSERT_FATAL(exception.code == DDS_SECURITY_ERR_OK_CODE);
+  assert(result != 0); // for Clang's static analyzer
   CU_ASSERT_FATAL(((local_datawriter_crypto *)result)->is_builtin_participant_volatile_message_secure_writer);
 
   reset_exception(&exception);
diff --git a/src/security/builtin_plugins/tests/register_local_participant/src/register_local_participant_utests.c b/src/security/builtin_plugins/tests/register_local_participant/src/register_local_participant_utests.c
index 967cf67..1602d9a 100644
--- a/src/security/builtin_plugins/tests/register_local_participant/src/register_local_participant_utests.c
+++ b/src/security/builtin_plugins/tests/register_local_participant/src/register_local_participant_utests.c
@@ -9,6 +9,8 @@
  *
  * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
  */
+#include <assert.h>
+
 #include <openssl/evp.h>
 #include <openssl/hmac.h>
 #include <openssl/bio.h>
@@ -146,6 +148,8 @@ CU_Test(ddssec_builtin_register_local_participant, empty_identity, .init = suite
     printf("register_local_participant: %s\n", exception.message ? exception.message : "Error message missing");
 
   CU_ASSERT(exception.code == DDS_SECURITY_ERR_IDENTITY_EMPTY_CODE);
+  CU_ASSERT_FATAL(exception.message != NULL);
+  assert(exception.message != NULL); // for Clang's static analyzer
   CU_ASSERT(!strcmp(exception.message, DDS_SECURITY_ERR_IDENTITY_EMPTY_MESSAGE));
   CU_ASSERT(result == 0);
 
diff --git a/src/security/builtin_plugins/tests/register_matched_remote_datareader/src/register_matched_remote_datareader_utests.c b/src/security/builtin_plugins/tests/register_matched_remote_datareader/src/register_matched_remote_datareader_utests.c
index 6c6d6ff..2f0eadb 100644
--- a/src/security/builtin_plugins/tests/register_matched_remote_datareader/src/register_matched_remote_datareader_utests.c
+++ b/src/security/builtin_plugins/tests/register_matched_remote_datareader/src/register_matched_remote_datareader_utests.c
@@ -9,6 +9,8 @@
  *
  * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
  */
+#include <assert.h>
+
 #include <openssl/evp.h>
 #include <openssl/hmac.h>
 #include <openssl/bio.h>
@@ -200,8 +202,9 @@ CU_Test(ddssec_builtin_register_remote_datareader, happy_day, .init = suite_regi
     printf("register_remote_datareader: %s\n", exception.message ? exception.message : "Error message missing");
 
   /* A valid handle to be returned */
-  CU_ASSERT(result != 0);
-  CU_ASSERT(exception.code == DDS_SECURITY_ERR_OK_CODE);
+  CU_ASSERT_FATAL(result != 0);
+  CU_ASSERT_FATAL(exception.code == DDS_SECURITY_ERR_OK_CODE);
+  assert(result != 0); // for Clang's static analyzer
 
   /* NOTE: It would be better to check if the keys have been generated but there is no interface to get them from handle */
   reader_crypto = (remote_datareader_crypto *)result;
@@ -265,6 +268,7 @@ CU_Test(ddssec_builtin_register_remote_datareader, volatile_secure, .init = suit
 
   /* A valid handle to be returned */
   CU_ASSERT_FATAL(result != 0);
+  assert(result != 0); // for Clang's static analyzer
   CU_ASSERT_FATAL(((remote_datareader_crypto *)result)->is_builtin_participant_volatile_message_secure_reader);
   CU_ASSERT_FATAL(exception.code == DDS_SECURITY_ERR_OK_CODE);
   reset_exception(&exception);
@@ -293,7 +297,6 @@ CU_Test(ddssec_builtin_register_remote_datareader, with_origin_authentication, .
   /*set writer protection kind */
   writer_crypto = (local_datawriter_crypto *)local_writer_handle;
   writer_crypto->metadata_protectionKind = DDS_SECURITY_PROTECTION_KIND_ENCRYPT_WITH_ORIGIN_AUTHENTICATION;
-  writer_crypto = (local_datawriter_crypto *)local_writer_handle;
 
   /* Now call the function. */
   result = crypto->crypto_key_factory->register_matched_remote_datareader(
@@ -310,6 +313,7 @@ CU_Test(ddssec_builtin_register_remote_datareader, with_origin_authentication, .
   /* A valid handle to be returned */
   CU_ASSERT(result != 0);
   CU_ASSERT(exception.code == DDS_SECURITY_ERR_OK_CODE);
+  assert(result != 0); // for Clang's static analyzer
 
   /* NOTE: It would be better to check if the keys have been generated but there is no interface to get them from handle */
   reader_crypto = (remote_datareader_crypto *)result;
diff --git a/src/security/builtin_plugins/tests/register_matched_remote_datawriter/src/register_matched_remote_datawriter_utests.c b/src/security/builtin_plugins/tests/register_matched_remote_datawriter/src/register_matched_remote_datawriter_utests.c
index 635c018..c9dc669 100644
--- a/src/security/builtin_plugins/tests/register_matched_remote_datawriter/src/register_matched_remote_datawriter_utests.c
+++ b/src/security/builtin_plugins/tests/register_matched_remote_datawriter/src/register_matched_remote_datawriter_utests.c
@@ -9,6 +9,8 @@
  *
  * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
  */
+#include <assert.h>
+
 #include <openssl/evp.h>
 #include <openssl/hmac.h>
 #include <openssl/bio.h>
@@ -199,10 +201,12 @@ CU_Test(ddssec_builtin_register_remote_datawriter, happy_day, .init = suite_regi
   /* A valid handle to be returned */
   CU_ASSERT_FATAL(result != 0);
   CU_ASSERT_FATAL(exception.code == DDS_SECURITY_ERR_OK_CODE);
+  assert(result != 0); // for Clang's static analyzer
 
   /* NOTE: It would be better to check if the keys have been generated but there is no interface to get them from handle */
   writer_crypto = (remote_datawriter_crypto *)result;
   CU_ASSERT_FATAL(writer_crypto->reader2writer_key_material != NULL);
+  assert(writer_crypto->reader2writer_key_material != NULL); // for Clang's static analyzer
   CU_ASSERT(master_salt_not_empty(writer_crypto->reader2writer_key_material));
   CU_ASSERT(master_key_not_empty(writer_crypto->reader2writer_key_material));
   CU_ASSERT_FATAL(writer_crypto->reader2writer_key_material->receiver_specific_key_id == 0);
@@ -254,6 +258,7 @@ CU_Test(ddssec_builtin_register_remote_datawriter, volatile_secure, .init = suit
 
   /* A valid handle to be returned */
   CU_ASSERT_FATAL(result != 0);
+  assert(result != 0); // for Clang's static analyzer
   CU_ASSERT_FATAL(((remote_datawriter_crypto *)result)->is_builtin_participant_volatile_message_secure_writer);
   CU_ASSERT_FATAL(exception.code == DDS_SECURITY_ERR_OK_CODE);
   reset_exception(&exception);
@@ -282,7 +287,6 @@ CU_Test(ddssec_builtin_register_remote_datawriter, with_origin_authentication, .
   /*set reader protection kind */
   reader_crypto = (local_datareader_crypto *)local_reader_handle;
   reader_crypto->metadata_protectionKind = DDS_SECURITY_PROTECTION_KIND_ENCRYPT_WITH_ORIGIN_AUTHENTICATION;
-  reader_crypto = (local_datareader_crypto *)local_reader_handle;
   /* Now call the function. */
 
   result = crypto->crypto_key_factory->register_matched_remote_datawriter(
@@ -296,12 +300,14 @@ CU_Test(ddssec_builtin_register_remote_datawriter, with_origin_authentication, .
     printf("register_remote_datawriter: %s\n", exception.message ? exception.message : "Error message missing");
 
   /* A valid handle to be returned */
-  CU_ASSERT(result != 0);
-  CU_ASSERT(exception.code == DDS_SECURITY_ERR_OK_CODE);
+  CU_ASSERT_FATAL(result != 0);
+  CU_ASSERT_FATAL(exception.code == DDS_SECURITY_ERR_OK_CODE);
+  assert(result != 0); // for Clang's static analyzer
 
   /* NOTE: It would be better to check if the keys have been generated but there is no interface to get them from handle */
   writer_crypto = (remote_datawriter_crypto *)result;
   CU_ASSERT_FATAL(writer_crypto->reader2writer_key_material != NULL);
+  assert(writer_crypto->reader2writer_key_material != NULL); // for Clang's static analyzer
   CU_ASSERT(master_salt_not_empty(writer_crypto->reader2writer_key_material));
   CU_ASSERT(master_key_not_empty(writer_crypto->reader2writer_key_material));
   CU_ASSERT_FATAL(writer_crypto->reader2writer_key_material->receiver_specific_key_id != 0);
diff --git a/src/security/builtin_plugins/tests/validate_begin_handshake_reply/src/validate_begin_handshake_reply_utests.c b/src/security/builtin_plugins/tests/validate_begin_handshake_reply/src/validate_begin_handshake_reply_utests.c
index 90cb2a7..e8f5259 100644
--- a/src/security/builtin_plugins/tests/validate_begin_handshake_reply/src/validate_begin_handshake_reply_utests.c
+++ b/src/security/builtin_plugins/tests/validate_begin_handshake_reply/src/validate_begin_handshake_reply_utests.c
@@ -1586,6 +1586,7 @@ CU_Test(ddssec_builtin_validate_begin_handshake_reply,invalid_participant_data ,
 
     property = find_binary_property(&handshake_token_in, "c.pdata");
     CU_ASSERT_FATAL(property != NULL);
+    assert(property != NULL); // for Clang's static analyzer
 
     ddsrt_free(property->name);
     property->name = ddsrt_strdup("c.pdatax");
@@ -1835,17 +1836,18 @@ CU_Test(ddssec_builtin_validate_begin_handshake_reply,invalid_challenge ,  .init
     CU_ASSERT_FATAL (remote_identity_handle2 != DDS_SECURITY_HANDLE_NIL);
     CU_ASSERT_FATAL (auth->begin_handshake_reply != NULL);
 
-  fill_handshake_message_token_default(&handshake_token_in, remote_participant_data2, challenge2->value._buffer, challenge2->value._length);
+    fill_handshake_message_token_default(&handshake_token_in, remote_participant_data2, challenge2->value._buffer, challenge2->value._length);
 
-  result = auth->begin_handshake_reply(
-    auth,
-    &handshake_handle,
-    &handshake_token_out,
-    &handshake_token_in,
-    remote_identity_handle1,
-    local_identity_handle,
-    &serialized_participant_data,
-    &exception);
+    result = auth->begin_handshake_reply(
+      auth,
+      &handshake_handle,
+      &handshake_token_out,
+      &handshake_token_in,
+      remote_identity_handle1,
+      local_identity_handle,
+      &serialized_participant_data,
+      &exception);
+    CU_ASSERT_FATAL (result == DDS_SECURITY_VALIDATION_PENDING_HANDSHAKE_MESSAGE);
 
     handshake_message_deinit(&handshake_token_in);
     handshake_message_deinit(&handshake_token_out);
diff --git a/src/security/builtin_plugins/tests/validate_local_identity/src/validate_local_identity_utests.c b/src/security/builtin_plugins/tests/validate_local_identity/src/validate_local_identity_utests.c
index 59a5567..721e854 100644
--- a/src/security/builtin_plugins/tests/validate_local_identity/src/validate_local_identity_utests.c
+++ b/src/security/builtin_plugins/tests/validate_local_identity/src/validate_local_identity_utests.c
@@ -1133,6 +1133,7 @@ CU_Test(ddssec_builtin_validate_local_identity,missing_certificate_property)
     CU_ASSERT (result != DDS_SECURITY_VALIDATION_OK);
     CU_ASSERT (exception.minor_code != 0);
     CU_ASSERT_FATAL (exception.message != NULL);
+    assert(exception.message != NULL); // for Clang's static analyzer
     CU_ASSERT(strcmp(exception.message, "validate_local_identity: missing property 'dds.sec.auth.identity_certificate'") == 0);
 
     dds_security_property_deinit(&participant_qos.property.value);
@@ -1189,6 +1190,7 @@ CU_Test(ddssec_builtin_validate_local_identity,missing_ca_property)
     CU_ASSERT (result != DDS_SECURITY_VALIDATION_OK);
     CU_ASSERT (exception.minor_code != 0);
     CU_ASSERT_FATAL (exception.message != NULL);
+    assert(exception.message != NULL); // for Clang's static analyzer
     CU_ASSERT(strcmp(exception.message, "validate_local_identity: missing property 'dds.sec.auth.identity_ca'") == 0);
 
     dds_security_property_deinit(&participant_qos.property.value);
@@ -1240,6 +1242,7 @@ CU_Test(ddssec_builtin_validate_local_identity,missing_private_key_property)
     CU_ASSERT (result != DDS_SECURITY_VALIDATION_OK);
     CU_ASSERT (exception.minor_code != 0);
     CU_ASSERT_FATAL (exception.message != NULL);
+    assert(exception.message != NULL); // for Clang's static analyzer
     CU_ASSERT(strcmp(exception.message, "validate_local_identity: missing property 'dds.sec.auth.private_key'") == 0);
 
     dds_security_property_deinit(&participant_qos.property.value);
diff --git a/src/security/builtin_plugins/tests/validate_local_permissions/src/validate_local_permissions_utests.c b/src/security/builtin_plugins/tests/validate_local_permissions/src/validate_local_permissions_utests.c
index b690fdb..f0a4cb5 100644
--- a/src/security/builtin_plugins/tests/validate_local_permissions/src/validate_local_permissions_utests.c
+++ b/src/security/builtin_plugins/tests/validate_local_permissions/src/validate_local_permissions_utests.c
@@ -605,6 +605,7 @@ static DDS_Security_long test_corrupted_signature(bool corrupt_permissions, bool
   /* Just some (hardcoded) sanity checks. */
   CU_ASSERT_FATAL(prop != NULL);
   CU_ASSERT_FATAL(prop->value != NULL);
+  assert(prop && prop->value); // for Clang's static analyzer
   len = strlen(prop->value);
   CU_ASSERT_FATAL(len > 2250);
 
diff --git a/src/security/builtin_plugins/tests/validate_remote_permissions/src/validate_remote_permissions_utests.c b/src/security/builtin_plugins/tests/validate_remote_permissions/src/validate_remote_permissions_utests.c
index 137137a..84c413f 100644
--- a/src/security/builtin_plugins/tests/validate_remote_permissions/src/validate_remote_permissions_utests.c
+++ b/src/security/builtin_plugins/tests/validate_remote_permissions/src/validate_remote_permissions_utests.c
@@ -277,6 +277,7 @@ static void corrupt_permission_signature(DDS_Security_AuthenticatedPeerCredentia
   /* It is expected that the permissions are available in a fixed location. */
   CU_ASSERT_FATAL(token != NULL);
   CU_ASSERT_FATAL(token->properties._buffer != NULL);
+  assert(token->properties._buffer != NULL); // for Clang's static analyzer
   CU_ASSERT_FATAL(token->properties._length == 2);
   CU_ASSERT_FATAL(token->properties._buffer[1].name != NULL);
   CU_ASSERT_FATAL(token->properties._buffer[1].value != NULL);
@@ -285,6 +286,7 @@ static void corrupt_permission_signature(DDS_Security_AuthenticatedPeerCredentia
   /* Corrupt a byte somewhere in the signature. */
   permissions = token->properties._buffer[1].value;
   CU_ASSERT_FATAL(permissions != NULL);
+  assert(permissions != NULL); // for Clang's static analyzer
   len = strlen(permissions);
   CU_ASSERT_FATAL(len > 100);
   permissions[len - 75]--;
diff --git a/src/security/core/tests/plugin_loading/plugin_mock/authentication_finalize_error/mock_authentication.c b/src/security/core/tests/plugin_loading/plugin_mock/authentication_finalize_error/mock_authentication.c
index a072b00..68f53ad 100644
--- a/src/security/core/tests/plugin_loading/plugin_mock/authentication_finalize_error/mock_authentication.c
+++ b/src/security/core/tests/plugin_loading/plugin_mock/authentication_finalize_error/mock_authentication.c
@@ -15,6 +15,7 @@
 #include "dds/ddsrt/misc.h"
 #include "mock_authentication.h"
 #include <stdio.h>
+#include <assert.h>
 #include <string.h>
 #include <stdbool.h>
 
@@ -72,6 +73,11 @@ DDS_Security_ValidationResult_t validate_local_identity(
     }
   }
 
+  /* for Clang's static analyzer */
+  assert(identity_certificate != NULL);
+  assert(identity_ca != NULL);
+  assert(private_key != NULL);
+
   if( strcmp(identity_certificate, test_identity_certificate) != 0){
 
     result = DDS_SECURITY_VALIDATION_FAILED;
diff --git a/src/security/core/tests/plugin_loading/plugin_mock/authentication_missing_function/mock_authentication.c b/src/security/core/tests/plugin_loading/plugin_mock/authentication_missing_function/mock_authentication.c
index ee4efe2..c80c8d1 100644
--- a/src/security/core/tests/plugin_loading/plugin_mock/authentication_missing_function/mock_authentication.c
+++ b/src/security/core/tests/plugin_loading/plugin_mock/authentication_missing_function/mock_authentication.c
@@ -13,6 +13,7 @@
 #include "dds/ddsrt/misc.h"
 #include "mock_authentication.h"
 #include <stdio.h>
+#include <assert.h>
 #include <string.h>
 #include <stdbool.h>
 
@@ -73,6 +74,11 @@ DDS_Security_ValidationResult_t validate_local_identity(
     }
   }
 
+  /* for Clang's static analyzer */
+  assert(identity_certificate != NULL);
+  assert(identity_ca != NULL);
+  assert(private_key != NULL);
+
   if( strcmp(identity_certificate, test_identity_certificate) != 0){
 
     result = DDS_SECURITY_VALIDATION_FAILED;

From 4960fbf94ce9857e7e323b6e300014674351431e Mon Sep 17 00:00:00 2001
From: Marcel Jordense <marcel.jordense@adlinktech.com>
Date: Fri, 22 Nov 2019 17:50:35 +0100
Subject: [PATCH 104/238] Add security authentication handshake and encoding
 and decoding

Signed-off-by: Marcel Jordense <marcel.jordense@adlinktech.com>
---
 src/core/ddsc/src/dds_topic.c                 |   19 +-
 src/core/ddsi/CMakeLists.txt                  |    8 +-
 .../ddsi/include/dds/ddsi/ddsi_domaingv.h     |    5 +
 .../ddsi/include/dds/ddsi/ddsi_handshake.h    |   53 +-
 src/core/ddsi/include/dds/ddsi/ddsi_plist.h   |    1 +
 .../include/dds/ddsi/ddsi_security_exchange.h |   49 +
 .../ddsi/include/dds/ddsi/ddsi_security_msg.h |   18 +-
 .../ddsi/include/dds/ddsi/ddsi_security_omg.h | 1153 ++++--
 .../include/dds/ddsi/ddsi_security_util.h     |   91 +
 .../ddsi/include/dds/ddsi/q_ddsi_discovery.h  |    2 +
 src/core/ddsi/include/dds/ddsi/q_entity.h     |   43 +-
 src/core/ddsi/include/dds/ddsi/q_misc.h       |    1 +
 src/core/ddsi/include/dds/ddsi/q_xevent.h     |    2 +
 src/core/ddsi/include/dds/ddsi/q_xmsg.h       |    2 +
 src/core/ddsi/src/ddsi_handshake.c            | 1189 ++++++-
 src/core/ddsi/src/ddsi_plist.c                |   82 +-
 src/core/ddsi/src/ddsi_security_exchange.c    |  428 +++
 src/core/ddsi/src/ddsi_security_msg.c         |   81 +-
 src/core/ddsi/src/ddsi_security_omg.c         | 3077 +++++++++++++++--
 src/core/ddsi/src/ddsi_security_util.c        |  708 ++++
 src/core/ddsi/src/q_ddsi_discovery.c          |  254 +-
 src/core/ddsi/src/q_entity.c                  |  253 +-
 src/core/ddsi/src/q_init.c                    |    7 +-
 src/core/ddsi/src/q_misc.c                    |    5 +
 src/core/ddsi/src/q_receive.c                 |   26 +-
 src/core/ddsi/src/q_transmit.c                |    2 +-
 src/core/ddsi/src/q_xevent.c                  |   34 +-
 src/core/ddsi/src/q_xmsg.c                    |   21 +-
 .../src/access_control_parser.c               |    2 +
 .../authentication/src/auth_utils.c           |    3 +-
 .../authentication/src/authentication.c       |  590 ++--
 .../cryptographic/src/crypto_key_exchange.c   |   73 +-
 .../cryptographic/src/crypto_key_factory.c    |  105 +-
 .../cryptographic/src/crypto_key_factory.h    |    5 +
 .../cryptographic/src/crypto_objects.c        |   13 +-
 .../cryptographic/src/crypto_objects.h        |    8 +-
 ...t_remote_datareader_crypto_tokens_utests.c |    1 +
 ...t_remote_datawriter_crypto_tokens_utests.c |    1 +
 src/security/core/CMakeLists.txt              |    3 +-
 .../dds/security/core/dds_security_utils.h    |    4 +-
 src/security/core/src/dds_security_fsm.c      |  227 +-
 src/security/core/src/dds_security_utils.c    |    8 +-
 .../tests/plugin_loading/plugin_loading.c     |   17 +-
 .../mock_authentication.c                     |   12 +-
 .../mock_authentication.h                     |   78 +-
 .../tests/plugin_loading/plugin_mock_common.h |   98 +
 .../tests/plugin_loading/security_config.c    |   81 +-
 src/security/core/tests/tc_fsm.c              |   69 +-
 48 files changed, 7473 insertions(+), 1539 deletions(-)
 create mode 100644 src/core/ddsi/include/dds/ddsi/ddsi_security_exchange.h
 create mode 100644 src/core/ddsi/include/dds/ddsi/ddsi_security_util.h
 create mode 100644 src/core/ddsi/src/ddsi_security_exchange.c
 create mode 100644 src/core/ddsi/src/ddsi_security_util.c
 create mode 100644 src/security/core/tests/plugin_loading/plugin_mock_common.h

diff --git a/src/core/ddsc/src/dds_topic.c b/src/core/ddsc/src/dds_topic.c
index d85eb91..743e9b9 100644
--- a/src/core/ddsc/src/dds_topic.c
+++ b/src/core/ddsc/src/dds_topic.c
@@ -32,6 +32,7 @@
 #include "dds/ddsi/ddsi_plist.h"
 #include "dds/ddsi/ddsi_domaingv.h"
 #include "dds/ddsi/ddsi_cdrstream.h"
+#include "dds/ddsi/ddsi_security_omg.h"
 #include "dds__serdata_builtintopic.h"
 
 DECL_ENTITY_LOCK_UNLOCK (extern inline, dds_topic)
@@ -317,10 +318,12 @@ dds_entity_t dds_create_topic_impl (dds_entity_t participant, struct ddsi_sertop
    * reliable ... (and keep behaviour unchanged) */
   struct ddsi_domaingv * const gv = &pp->m_entity.m_domain->gv;
   if ((rc = ddsi_xqos_valid (&gv->logconfig, new_qos)) != DDS_RETCODE_OK)
+    goto error;
+
+  if (!q_omg_security_check_create_topic (&pp->m_entity.m_domain->gv, &pp->m_entity.m_guid, sertopic->name, new_qos))
   {
-    dds_delete_qos (new_qos);
-    dds_entity_unpin (&pp->m_entity);
-    return rc;
+    rc = DDS_RETCODE_NOT_ALLOWED_BY_SECURITY;
+    goto error;
   }
 
   /* See if we're allowed to create the topic; ktp is returned pinned & locked
@@ -333,9 +336,8 @@ dds_entity_t dds_create_topic_impl (dds_entity_t participant, struct ddsi_sertop
   if ((rc = lookup_and_check_ktopic (&ktp, pp, sertopic->name, sertopic->type_name, new_qos)) != DDS_RETCODE_OK)
   {
     GVTRACE ("dds_create_topic_arbitrary: failed after compatibility check: %s\n", dds_strretcode (rc));
-    dds_participant_unlock (pp);
-    dds_delete_qos (new_qos);
-    return rc;
+    ddsrt_mutex_unlock (&pp->m_entity.m_mutex);
+    goto error;
   }
 
   /* Create a ktopic if it doesn't exist yet, else reference existing one and delete the
@@ -378,6 +380,11 @@ dds_entity_t dds_create_topic_impl (dds_entity_t participant, struct ddsi_sertop
   dds_participant_unlock (pp);
   GVTRACE ("dds_create_topic_arbitrary: new topic %"PRId32"\n", hdl);
   return hdl;
+
+ error:
+  dds_entity_unpin (&pp->m_entity);
+  dds_delete_qos (new_qos);
+  return rc;
 }
 
 dds_entity_t dds_create_topic_arbitrary (dds_entity_t participant, struct ddsi_sertopic *sertopic, const dds_qos_t *qos, const dds_listener_t *listener, const ddsi_plist_t *sedp_plist)
diff --git a/src/core/ddsi/CMakeLists.txt b/src/core/ddsi/CMakeLists.txt
index ddd07fd..4c466bd 100644
--- a/src/core/ddsi/CMakeLists.txt
+++ b/src/core/ddsi/CMakeLists.txt
@@ -18,6 +18,7 @@ PREPEND(srcs_ddsi "${CMAKE_CURRENT_LIST_DIR}/src"
     ddsi_raweth.c
     ddsi_ipaddr.c
     ddsi_mcgroup.c
+    ddsi_security_util.c
     ddsi_security_omg.c
     ddsi_portmapping.c
     ddsi_handshake.c
@@ -83,6 +84,7 @@ PREPEND(hdrs_private_ddsi "${CMAKE_CURRENT_LIST_DIR}/include/dds/ddsi"
     ddsi_ipaddr.h
     ddsi_mcgroup.h
     ddsi_plist_generic.h
+    ddsi_security_util.h
     ddsi_security_omg.h
     ddsi_portmapping.h
     ddsi_handshake.h    
@@ -148,10 +150,12 @@ target_sources(ddsc
 
 if(ENABLE_SECURITY)
   PREPEND(security_srcs "${CMAKE_CURRENT_LIST_DIR}/src"
-          ddsi_security_msg.c)
+          ddsi_security_msg.c
+          ddsi_security_exchange.c)
 
   PREPEND(security_hdrs "${CMAKE_CURRENT_LIST_DIR}/include/dds/ddsi"
-          ddsi_security_msg.h)
+          ddsi_security_msg.h
+	  ddsi_security_exchange.h)
 
   target_sources(ddsc
     PRIVATE ${security_srcs} ${security_hdrs})
diff --git a/src/core/ddsi/include/dds/ddsi/ddsi_domaingv.h b/src/core/ddsi/include/dds/ddsi/ddsi_domaingv.h
index 17fc797..f7227bd 100644
--- a/src/core/ddsi/include/dds/ddsi/ddsi_domaingv.h
+++ b/src/core/ddsi/include/dds/ddsi/ddsi_domaingv.h
@@ -47,6 +47,8 @@ struct ddsrt_thread_pool_s;
 struct debug_monitor;
 struct ddsi_tkmap;
 struct dds_security_context;
+struct dds_security_match_index;
+struct ddsi_hsadmin;
 
 typedef struct config_in_addr_node {
    nn_locator_t loc;
@@ -299,7 +301,10 @@ struct ddsi_domaingv {
   /* security globals */
 #ifdef DDSI_INCLUDE_SECURITY
   struct dds_security_context *security_context;
+  struct dds_security_match_index *security_matches;
+  struct ddsi_hsadmin *hsadmin;
 #endif
+
 };
 
 #if defined (__cplusplus)
diff --git a/src/core/ddsi/include/dds/ddsi/ddsi_handshake.h b/src/core/ddsi/include/dds/ddsi/ddsi_handshake.h
index 91300d4..f473d0f 100644
--- a/src/core/ddsi/include/dds/ddsi/ddsi_handshake.h
+++ b/src/core/ddsi/include/dds/ddsi/ddsi_handshake.h
@@ -12,9 +12,7 @@
 #ifndef DDSI_HANDSHAKE_H
 #define DDSI_HANDSHAKE_H
 
-#include "q_unused.h"
-#include "q_entity.h"
-#include "ddsi_security_msg.h"
+#include "dds/ddsi/q_entity.h"
 
 #if defined (__cplusplus)
 extern "C" {
@@ -37,10 +35,9 @@ enum ddsi_handshake_state {
 /* The handshake will not use the related handshake object after this callback
  * was executed. This means that it can be deleted in this callback. */
 typedef void (*ddsi_handshake_end_cb_t)(
-    struct ddsi_domaingv const * const gv,
     struct ddsi_handshake *handshake,
-    const ddsi_guid_t *lpguid, /* Local participant */
-    const ddsi_guid_t *ppguid, /* Proxy participant */
+    struct participant *pp,
+    struct proxy_participant *proxypp,
     enum ddsi_handshake_state result);
 
 #ifdef DDSI_INCLUDE_SECURITY
@@ -123,7 +120,7 @@ int64_t ddsi_handshake_get_handle(const struct ddsi_handshake *handshake);
  * @param[in] callback   The callback function.
  *
  */
-void ddsi_handshake_register(const struct participant *pp, const struct proxy_participant *proxypp, ddsi_handshake_end_cb_t callback);
+void ddsi_handshake_register(struct participant *pp, struct proxy_participant *proxypp, ddsi_handshake_end_cb_t callback);
 
 /**
  * @brief Remove the handshake associated with the specified participants.
@@ -137,7 +134,7 @@ void ddsi_handshake_register(const struct participant *pp, const struct proxy_pa
  * @param[in] handshake  The handshake.
  *
  */
-void ddsi_handshake_remove(const struct participant *pp, const struct proxy_participant *proxypp, struct ddsi_handshake *handshake);
+void ddsi_handshake_remove(struct participant *pp, struct proxy_participant *proxypp, struct ddsi_handshake *handshake);
 
 /**
  * @brief Searches for the handshake associated with the specified participants
@@ -150,12 +147,42 @@ void ddsi_handshake_remove(const struct participant *pp, const struct proxy_part
  *
  * @returns The handshake
  */
-struct ddsi_handshake * ddsi_handshake_find(const struct participant *pp, const struct proxy_participant *proxypp);
+struct ddsi_handshake * ddsi_handshake_find(struct participant *pp, struct proxy_participant *proxypp);
+
+/**
+ * @brief Searches for the handshake associated with the specified participants
+ *
+ * This function will search through the handshake administration to find the handshake
+ * corresponding the to specified local and remote participant.
+ *
+ * @param[in] pp         The local participant.
+ * @param[in] proxypp    The remote participant.
+ *
+ * @returns The handshake
+ */
+struct ddsi_handshake * ddsi_handshake_find(struct participant *pp, struct proxy_participant *proxypp);
+
+/**
+ * @brief Initialize the handshake administration
+ *
+ * @param[in] gv         The global parameters
+ */
+void ddsi_handshake_admin_init(struct ddsi_domaingv *gv);
+
+/**
+ * @brief Deinitialze the handshake administration.
+ *
+ * @param[in] gv         The global parameters
+ */
+void ddsi_handshake_admin_deinit(struct ddsi_domaingv *gv);
 
 #else /* DDSI_INCLUDE_SECURITY */
 
 #include "dds/ddsi/q_unused.h"
 
+inline void ddsi_handshake_register(UNUSED_ARG(struct participant *pp), UNUSED_ARG(struct proxy_participant *proxypp), UNUSED_ARG(ddsi_handshake_end_cb_t callback))
+{
+}
 
 inline void ddsi_handshake_release(UNUSED_ARG(struct ddsi_handshake *handshake))
 {
@@ -175,15 +202,11 @@ inline int64_t ddsi_handshake_get_handle(UNUSED_ARG(const struct ddsi_handshake
   return 0;
 }
 
-inline void ddsi_handshake_register(UNUSED_ARG(const struct participant *pp), UNUSED_ARG(const struct proxy_participant *proxypp), UNUSED_ARG(ddsi_handshake_end_cb_t callback))
+inline void ddsi_handshake_remove(UNUSED_ARG(struct participant *pp), UNUSED_ARG(struct proxy_participant *proxypp), UNUSED_ARG(struct ddsi_handshake *handshake))
 {
 }
 
-inline void ddsi_handshake_remove(UNUSED_ARG(const struct participant *pp), UNUSED_ARG(const struct proxy_participant *proxypp), UNUSED_ARG(struct ddsi_handshake *handshake))
-{
-}
-
-inline struct ddsi_handshake * ddsi_handshake_find(UNUSED_ARG(const struct participant *pp), UNUSED_ARG(const struct proxy_participant *proxypp))
+inline struct ddsi_handshake * ddsi_handshake_find(UNUSED_ARG(struct participant *pp), UNUSED_ARG(struct proxy_participant *proxypp))
 {
   return NULL;
 }
diff --git a/src/core/ddsi/include/dds/ddsi/ddsi_plist.h b/src/core/ddsi/include/dds/ddsi/ddsi_plist.h
index c6f5a8d..4f8b07f 100644
--- a/src/core/ddsi/include/dds/ddsi/ddsi_plist.h
+++ b/src/core/ddsi/include/dds/ddsi/ddsi_plist.h
@@ -309,6 +309,7 @@ DDS_EXPORT void ddsi_plist_fini (ddsi_plist_t *ps);
 DDS_EXPORT void ddsi_plist_fini_mask (ddsi_plist_t *plist, uint64_t pmask, uint64_t qmask);
 DDS_EXPORT void ddsi_plist_unalias (ddsi_plist_t *plist);
 DDS_EXPORT void ddsi_plist_addtomsg (struct nn_xmsg *m, const ddsi_plist_t *ps, uint64_t pwanted, uint64_t qwanted);
+DDS_EXPORT void ddsi_plist_addtomsg_bo (struct nn_xmsg *m, const ddsi_plist_t *ps, uint64_t pwanted, uint64_t qwanted, bool be);
 DDS_EXPORT void ddsi_plist_init_default_participant (ddsi_plist_t *plist);
 DDS_EXPORT void ddsi_plist_delta (uint64_t *pdelta, uint64_t *qdelta, const ddsi_plist_t *x, const ddsi_plist_t *y, uint64_t pmask, uint64_t qmask);
 DDS_EXPORT void ddsi_plist_log (uint32_t cat, const struct ddsrt_log_cfg *logcfg, const ddsi_plist_t *plist);
diff --git a/src/core/ddsi/include/dds/ddsi/ddsi_security_exchange.h b/src/core/ddsi/include/dds/ddsi/ddsi_security_exchange.h
new file mode 100644
index 0000000..4495cdf
--- /dev/null
+++ b/src/core/ddsi/include/dds/ddsi/ddsi_security_exchange.h
@@ -0,0 +1,49 @@
+/*
+ * Copyright(c) 2006 to 2018 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+#ifndef DDSI_SECURITY_EXCHANGE_H
+#define DDSI_SECURITY_EXCHANGE_H
+
+#ifdef DDSI_INCLUDE_SECURITY
+
+#if defined (__cplusplus)
+extern "C" {
+#endif
+
+#include "dds/ddsi/q_rtps.h"
+#include "dds/ddsi/q_radmin.h"
+#include "dds/ddsi/q_entity.h"
+#include "dds/ddsi/ddsi_security_msg.h"
+
+
+#define GMCLASSID_SECURITY_PARTICIPANT_CRYPTO_TOKENS    "dds.sec.participant_crypto_tokens"
+#define GMCLASSID_SECURITY_DATAWRITER_CRYPTO_TOKENS     "dds.sec.datawriter_crypto_tokens"
+#define GMCLASSID_SECURITY_DATAREADER_CRYPTO_TOKENS     "dds.sec.datareader_crypto_tokens"
+
+bool write_auth_handshake_message(const struct participant *pp, const struct proxy_participant *proxypp, nn_dataholderseq_t *mdata, bool request, const nn_message_identity_t *related_message_id);
+void handle_auth_handshake_message(const struct receiver_state *rst, ddsi_entityid_t wr_entity_id, nn_wctime_t timestamp,  unsigned statusinfo, const void *vdata, size_t len);
+void handle_crypto_exchange_message(const struct receiver_state *rst, ddsi_entityid_t wr_entity_id, nn_wctime_t timestamp, unsigned statusinfo, const void *vdata, unsigned len);
+void auth_get_serialized_participant_data(struct participant *pp, ddsi_octetseq_t *seq);
+bool write_crypto_participant_tokens(const struct participant *pp, const struct proxy_participant *proxypp, const nn_dataholderseq_t *tokens);
+bool write_crypto_writer_tokens(const struct writer *wr, const struct proxy_reader *prd, const nn_dataholderseq_t *tokens);
+bool write_crypto_reader_tokens(const struct reader *rd, const struct proxy_writer *pwr, const nn_dataholderseq_t *tokens);
+
+#if defined (__cplusplus)
+}
+#endif
+
+#else /* DDSI_INCLUDE_SECURITY */
+
+#define volatile_secure_data_filter NULL
+
+#endif /* DDSI_INCLUDE_SECURITY */
+
+#endif /* DDSI_SECURITY_EXCHANGE_H */
diff --git a/src/core/ddsi/include/dds/ddsi/ddsi_security_msg.h b/src/core/ddsi/include/dds/ddsi/ddsi_security_msg.h
index a35a43d..072a3eb 100644
--- a/src/core/ddsi/include/dds/ddsi/ddsi_security_msg.h
+++ b/src/core/ddsi/include/dds/ddsi/ddsi_security_msg.h
@@ -28,8 +28,13 @@ struct writer;
 struct proxy_reader;
 struct ddsi_serdata;
 
-#define GMCLASSID_SECURITY_AUTH_REQUEST       "dds.sec.auth_request"
-#define GMCLASSID_SECURITY_AUTH_HANDSHAKE     "dds.sec.auth"
+#define DDS_SECURITY_AUTH_REQUEST                     "dds.sec.auth_request"
+#define DDS_SECURITY_AUTH_HANDSHAKE                   "dds.sec.auth"
+#define DDS_SECURITY_AUTH_REQUEST_TOKEN_CLASS_ID      "DDS:Auth:PKI-DH:1.0+AuthReq"
+#define DDS_SECURITY_AUTH_HANDSHAKE_REQUEST_TOKEN_ID  "DDS:Auth:PKI-DH:1.0+Req"
+#define DDS_SECURITY_AUTH_HANDSHAKE_REPLY_TOKEN_ID    "DDS:Auth:PKI-DH:1.0+Reply"
+#define DDS_SECURITY_AUTH_HANDSHAKE_FINAL_TOKEN_ID    "DDS:Auth:PKI-DH:1.0+Final"
+
 
 typedef struct nn_message_identity {
   ddsi_guid_t source_guid;
@@ -91,15 +96,6 @@ nn_participant_generic_message_serialize(
 
 DDS_EXPORT extern const enum pserop pserop_participant_generic_message[];
 
-DDS_EXPORT int
-write_crypto_exchange_message(
-   const struct participant *pp,
-   const ddsi_guid_t *dst_pguid,
-   const ddsi_guid_t *src_eguid,
-   const ddsi_guid_t *dst_eguid,
-   const char *classid,
-   const nn_dataholderseq_t *tokens);
-
 DDS_EXPORT int
 volatile_secure_data_filter(
    struct writer *wr,
diff --git a/src/core/ddsi/include/dds/ddsi/ddsi_security_omg.h b/src/core/ddsi/include/dds/ddsi/ddsi_security_omg.h
index d6a36ea..534a762 100644
--- a/src/core/ddsi/include/dds/ddsi/ddsi_security_omg.h
+++ b/src/core/ddsi/include/dds/ddsi/ddsi_security_omg.h
@@ -12,6 +12,9 @@
 #ifndef DDSI_OMG_SECURITY_H
 #define DDSI_OMG_SECURITY_H
 
+#include "dds/ddsrt/sync.h"
+#include "dds/ddsrt/avl.h"
+
 #include "dds/ddsi/ddsi_plist.h"
 #include "dds/ddsi/q_entity.h"
 #include "dds/ddsi/ddsi_domaingv.h"
@@ -20,7 +23,11 @@
 #include "dds/ddsrt/retcode.h"
 #include "dds/ddsrt/types.h"
 #include "dds/ddsrt/sync.h"
+#include "dds/ddsi/ddsi_xqos.h"
 
+#ifdef DDSI_INCLUDE_SECURITY
+#include "dds/security/dds_security_api.h"
+#endif
 
 #if defined (__cplusplus)
 extern "C" {
@@ -34,26 +41,123 @@ typedef enum {
 
 #ifdef DDSI_INCLUDE_SECURITY
 
-#include "dds/security/dds_security_api.h"
-#include "dds/security/core/dds_security_plugins.h"
+struct ddsi_hsadmin;
+struct participant_sec_attributes;
+struct proxy_participant_sec_attributes;
+struct writer_sec_attributes;
+struct reader_sec_attributes;
+struct dds_security_context;
 
 typedef struct nn_msg_sec_info {
+  unsigned encoded:1;
+  unsigned use_rtps_encoding:1;
   int64_t src_pp_handle;
   int64_t dst_pp_handle;
-  bool use_rtps_encoding;
 } nn_msg_sec_info_t;
 
+struct guid_pair {
+  ddsi_guid_t src;
+  ddsi_guid_t dst;
+};
 
+struct security_entity_match {
+  ddsrt_avl_node_t avlnode;
+  struct guid_pair guids;
+  bool matched;
+  int64_t crypto_handle;
+  DDS_Security_ParticipantCryptoTokenSeq *tokens;
+};
 
+struct dds_security_match_index {
+  ddsrt_mutex_t lock;
+  ddsrt_avl_tree_t matches;
+};
+
+struct pp_proxypp_match {
+  ddsrt_avl_node_t avlnode;
+  ddsi_guid_t proxypp_guid;
+  DDS_Security_ParticipantCryptoHandle proxypp_crypto_handle;
+};
+
+struct proxypp_pp_match {
+  ddsrt_avl_node_t avlnode;
+  ddsi_guid_t pp_guid;
+  DDS_Security_ParticipantCryptoHandle pp_crypto_handle;
+  DDS_Security_PermissionsHandle permissions_handle;
+  DDS_Security_SharedSecretHandle shared_secret;
+};
+
+struct participant_sec_attributes {
+  ddsrt_avl_node_t avlnode;
+  ddsi_guid_t pp_guid;
+  DDS_Security_ParticipantSecurityAttributes attr;
+  DDS_Security_IdentityHandle local_identity_handle;
+  DDS_Security_PermissionsHandle permissions_handle;
+  DDS_Security_ParticipantCryptoHandle crypto_handle;
+  bool plugin_attr;
+  ddsrt_mutex_t lock;
+  ddsrt_avl_ctree_t proxy_participants;
+  bool initialized;
+};
+
+struct proxy_participant_sec_attributes {
+  struct dds_security_context *sc;
+  DDS_Security_IdentityHandle remote_identity_handle;
+  DDS_Security_ParticipantCryptoHandle crypto_handle;
+  ddsrt_mutex_t lock;
+  ddsrt_avl_tree_t participants;
+  bool initialized;
+};
+
+struct writer_sec_attributes {
+  DDS_Security_EndpointSecurityAttributes attr;
+  DDS_Security_DatawriterCryptoHandle crypto_handle;
+  bool plugin_attr;
+};
+
+struct reader_sec_attributes {
+  DDS_Security_EndpointSecurityAttributes attr;
+  DDS_Security_DatareaderCryptoHandle crypto_handle;
+  bool plugin_attr;
+};
+
+struct dds_security_authentication *q_omg_participant_get_authentication(const struct participant *pp);
+
+void q_omg_log_exception(const struct ddsrt_log_cfg *lc, uint32_t cat, DDS_Security_SecurityException *exception, const char *file, uint32_t line, const char *func, const char *fmt, ...);
+
+/**
+ * @brief Check if access control is enabled for the participant.
+ *
+ * @param[in] pp  Participant to check.
+ *
+ * @returns bool  True if access control is enabled for participant
+ */
+bool q_omg_participant_is_access_protected(const struct participant *pp);
+
+/**
+ * @brief Check if protection at RTPS level is enabled for the participant.
+ *
+ * @param[in] pp  Participant to check.
+ *
+ * @returns bool  True if RTPS protection enabled for participant
+ */
+bool q_omg_participant_is_rtps_protected(const struct participant *pp);
+
+/**
+ * @brief Check if liveliness is protected for the participant.
+ *
+ * @param[in] pp  Participant to check.
+ *
+ * @returns bool  True  if liveliness data for participant is protected
+ */
+bool q_omg_participant_is_liveliness_protected(const struct participant *pp);
 
 /**
  * @brief Check if security is enabled for the participant.
  *
  * @param[in] pp  Participant to check if it is secure.
  *
- * @returns bool
- * @retval true   Participant is secure
- * @retval false  Participant is not secure
+ * @returns bool  True if participant is secure
  */
 bool q_omg_participant_is_secure(const struct participant *pp);
 
@@ -62,31 +166,150 @@ bool q_omg_participant_is_secure(const struct participant *pp);
  *
  * @param[in] proxypp  Proxy participant to check if it is secure.
  *
- * @returns bool
- * @retval true   Proxy participant is secure
- * @retval false  Proxy participant is not secure
+ * @returns bool  True if proxy participant is secure
  */
 bool q_omg_proxy_participant_is_secure(const struct proxy_participant *proxypp);
 
 /**
- * @brief Get the security handle of the given local participant.
+ * @brief Check security if it is allowed to create the participant.
+ *
+ * When security is enabled for this participant it is checked if the
+ * participant is authenticated by checking the provided security
+ * certificates. When that is ok the participant is registered with
+ * access control and with cryptography. When that is all successful
+ * this function return true;
+ *
+ * @param[in] pp         The participant to check if alloweed by security.
+ * #param[in] domain_id  The domain_id
+ *
+ * @returns bool
+ * @retval true   Participant is allowed
+ * @retval false  Participant is not allowed
+ */
+bool q_omg_security_check_create_participant(struct participant *pp, uint32_t domain_id);
+
+void q_omg_security_participant_set_initialized(struct participant *pp);
+
+bool q_omg_security_participant_is_initialized(struct participant *pp);
+
+/**
+ * @brief Remove the participant from the security plugins.
+ *
+ * When the participant was registered with the security
+ * plugins then this function will release the allocated
+ * security resources.
+ *
+ * @param[in] pp  Participant to remove.
+ */
+void q_omg_security_deregister_participant(struct participant *pp);
+
+/**
+ * @brief Get the identity handle associate with this participant.
+ *
+ * This function returns the identity handle that was created
+ * when the participant was authenticated. This handle corresponds
+ * with the handle returned by calling validate_local_identity on
+ * the authentication plugin.
  *
  * @param[in] pp  Participant to check if it is secure.
  *
  * @returns int64_t
- * @retval Local participant security handle
+ * @retval !0 Identity handle associated with the participant.
+ * @retval 0  Invalid handle the participant was not registered
  */
-int64_t q_omg_security_get_local_participant_handle(struct participant *pp);
+int64_t q_omg_security_get_local_participant_handle(const struct participant *pp);
 
 /**
- * @brief Get the security handle of the given remote participant.
+ * @brief Get security info flags of the given participant.
  *
- * @param[in] proxypp  Participant to check if it is secure.
+ * @param[in]  pp    Participant to get the security info from.
+ * @param[out] info  The security info.
  *
- * @returns int64_t
- * @retval Remote participant security handle
+ * @returns bool
+ * @retval true   Security info set.
+ * @retval false  Security info not set.
  */
-int64_t q_omg_security_get_remote_participant_handle(struct proxy_participant *proxypp);
+bool q_omg_get_participant_security_info(const struct participant *pp, nn_security_info_t *info);
+
+/**
+ * @brief Get the is_rtps_protected flag of the given remote participant.
+ *
+ * @param[in] pp        The participant.
+ * @param[in] entityid  ID of the entity to check.
+ *
+ * @returns bool
+ * @retval true   RTPS protected is set.
+ * @retval false  RTPS protected is not set.
+ */
+bool q_omg_security_is_local_rtps_protected(const struct participant *pp, ddsi_entityid_t entityid);
+
+/**
+ * @brief Check if the participant and the proxy participant
+ *        have compatible security info settings.
+ *
+ * Associated with a secure participant is the ParticipantSecurityInfo parameter.
+ * This parameter contains the setting of the security attributes and the associated
+ * plugin security attributes of the secure participant.
+ * This function will check if the received ParticipantSecurityInfo parameter is
+ * compatible with the local ParticipantSecurityInfo parameter.
+ *
+ * @param[in] pp      The participant.
+ * @param[in] proxypp The proxy participant.
+ *
+ * @returns bool
+ * @retval true   The participant and the proxy participant have compatible
+ *                security info settings.
+ * @retval false  Otherwise.
+ */
+bool q_omg_is_similar_participant_security_info(struct participant *pp, struct proxy_participant *proxypp);
+
+/**
+ * @brief Check if the parameter list key hash is protected
+ *
+ * @param[in] plist        The parameter list
+ *
+ * @returns bool  True if the parameter list key hash is protected
+ */
+bool q_omg_plist_keyhash_is_protected(const ddsi_plist_t *plist);
+
+/**
+ * @brief Check if the endpoint is protected
+ *
+ * Checks whether the provided parameter list has the flag
+ * ENDPOINT_SECURITY_ATTRIBUTES_FLAG_IS_VALID set. When this flag
+ * is set, this implies that the remote endpoint has protection
+ * enabled.
+ *
+ * @param[in] plist        The parameter list
+ *
+ * @returns bool  True if the endpoint is protected
+ */
+bool q_omg_is_endpoint_protected(const ddsi_plist_t *plist);
+
+/**
+ * @brief Writes the security attributes and security plugin attributes to log (category discovery)
+ *
+ * @param[in] gv        Global variable
+ * @param[in] plist     The parameter list
+ */
+void q_omg_log_endpoint_protection(struct ddsi_domaingv * const gv, const ddsi_plist_t *plist);
+
+/**
+ * @brief Check if security allows to create the topic.
+ *
+ * This function checks with access control if is allowed to create
+ * this topic for the specified domain.
+ *
+ * @param[in] gv          The domain global information.
+ * @param[in] pp_guid     The participant guid.
+ * @param[in] topic_name  The name of the  topic.
+ * @param[in] qos         The topic QoS used.
+ *
+ * @returns bool
+ * @retval true   Creation of the topic is allowed
+ * @retval false  Otherwise.
+ */
+bool q_omg_security_check_create_topic(const struct ddsi_domaingv *gv, const ddsi_guid_t *pp_guid, const char *topic_name, const struct dds_qos *qos);
 
 /**
  * @brief Get security info flags of the given writer.
@@ -100,6 +323,65 @@ int64_t q_omg_security_get_remote_participant_handle(struct proxy_participant *p
  */
 bool q_omg_get_writer_security_info(const struct writer *wr, nn_security_info_t *info);
 
+/**
+ * @brief Return the builtin writer id for this writers' discovery.
+ *
+ * Return builtin entity id of the writer to use for the publication
+ * discovery information.
+ * Depending on whether the discovery is protected or not (for the
+ * given writer), either the default writer or protected writer needs
+ * to be used.
+ *
+ * @param[in] wr Writer to determine the publication writer from.
+ *
+ * @returns unsigned
+ * @retval NN_ENTITYID_SEDP_BUILTIN_PUBLICATIONS_SECURE_WRITER
+ * @retval NN_ENTITYID_SEDP_BUILTIN_PUBLICATIONS_WRITER
+ */
+unsigned determine_publication_writer(const struct writer *wr);
+
+/**
+ * @brief Check if security allows to create the writer.
+ *
+ * This function checks with access control if is allowed to create
+ * this writer for the specified domain.
+ *
+ * @param[in] pp          Participant on which the topic is being created.
+ * @param[in] domain_id   The corresponding domain_id.
+ * @param[in] topic_name  The name of the topic.
+ * @param[in] writer_qos  The writer QoS used.
+ *
+ * @returns bool
+ * @retval true   Creation of the writer is allowed
+ * @retval false  Otherwise.
+ */
+bool q_omg_security_check_create_writer(struct participant *pp, uint32_t domain_id, const char *topic_name, const struct dds_qos *writer_qos);
+
+/**
+ * @brief Register the writer with security.
+ *
+ * This function registers the writer with security
+ * when the associated participant has security enabled.
+ * The security settings associated with this writer are determined
+ * and the writer is registered with cryptography when needed by
+ * the security settings which indicate if payload protection and or
+ * submessage protection is enabled for this writer.
+ *
+ * @param[in] wr  The writer to register.
+ */
+void q_omg_security_register_writer(struct writer *wr);
+
+/**
+ * @brief Remove the writer from security.
+ *
+ * When the writer was registered with security then this function
+ * will remove the writer from security which will free the allocated
+ * security resource created for this writer.
+ *
+ * @param[in] wr  The writer to remove.
+ */
+void q_omg_security_deregister_writer(struct writer *wr);
+
 /**
  * @brief Get security info flags of the given reader.
  *
@@ -128,23 +410,47 @@ bool q_omg_get_reader_security_info(const struct reader *rd, nn_security_info_t
  * @retval NN_ENTITYID_SEDP_BUILTIN_SUBSCRIPTIONS_WRITER
  */
 unsigned determine_subscription_writer(const struct reader *rd);
+/**
+ * @brief Check if security allows to create the reader.
+ *
+ * This function checks with access control if is allowed to create
+ * this reader for the specified domain.
+ *
+ * @param[in] pp          Participant on which the topic is being created.
+ * @param[in] domain_id   The corresponding domain_id.
+ * @param[in] topic_name  The name of the topic.
+ * @param[in] reader_qos  The reader QoS used.
+ *
+ * @returns bool
+ * @retval true   Creation of the writer is allowed
+ * @retval false  Otherwise.
+ */
+bool q_omg_security_check_create_reader(struct participant *pp, uint32_t domain_id, const char *topic_name, const struct dds_qos *reader_qos);
 
 /**
- * @brief Return the builtin writer id for this writers' discovery.
+ * @brief Register the reader with security.
  *
- * Return builtin entity id of the writer to use for the publication
- * discovery information.
- * Depending on whether the discovery is protected or not (for the
- * given writer), either the default writer or protected writer needs
- * to be used.
+ * This function registers the reader with security
+ * when the associated participant has security enabled.
+ * The security settings associated with this reader are determined
+ * and the reader is registered with cryptography when needed by
+ * the security settings which indicate if submessage protection is
+ *  enabled for this reader.
  *
- * @param[in] wr Writer to determine the publication writer from.
- *
- * @returns unsigned
- * @retval NN_ENTITYID_SEDP_BUILTIN_PUBLICATIONS_SECURE_WRITER
- * @retval NN_ENTITYID_SEDP_BUILTIN_PUBLICATIONS_WRITER
+ * @param[in] rd  The reader to register.
  */
-unsigned determine_publication_writer(const struct writer *wr);
+void q_omg_security_register_reader(struct reader *rd);
+
+/**
+ * @brief Remove the reader from security.
+ *
+ * When the reader was registered with security then this function
+ * will remove the reader from security which will free the allocated
+ * security resource created for this reader.
+ *
+ * @param[in] rd  The reader to remove.
+ */
+void q_omg_security_deregister_reader(struct reader *rd);
 
 /**
  * @brief Determine if the proxy participant is allowed to be deleted
@@ -162,11 +468,7 @@ unsigned determine_publication_writer(const struct writer *wr);
  * @retval true   The proxy participant may be deleted.
  * @retval false  The proxy participant may not be deleted by this writer.
  */
-bool
-is_proxy_participant_deletion_allowed(
-  struct ddsi_domaingv * const gv,
-  const struct ddsi_guid *guid,
-  const ddsi_entityid_t pwr_entityid);
+bool is_proxy_participant_deletion_allowed(struct ddsi_domaingv * const gv, const struct ddsi_guid *guid, const ddsi_entityid_t pwr_entityid);
 
 /**
  * @brief Determine if the messages, related to the given remote
@@ -179,26 +481,7 @@ is_proxy_participant_deletion_allowed(
  * @retval true   The entity messages are RTPS protected.
  * @retval false  The entity messages are not RTPS protected.
  */
-bool
-q_omg_security_is_remote_rtps_protected(
-  const struct proxy_participant *proxy_pp,
-  ddsi_entityid_t entityid);
-
-/**
- * @brief Determine if the messages, related to the given local
- * entity, are RTPS protected or not.
- *
- * @param[in] pp        Related participant.
- * @param[in] entityid  ID of the entity to check.
- *
- * @returns bool
- * @retval true   The entity messages are RTPS protected.
- * @retval false  The entity messages are not RTPS protected.
- */
-bool
-q_omg_security_is_local_rtps_protected(
-  const struct participant *pp,
-  ddsi_entityid_t entityid);
+bool q_omg_security_is_remote_rtps_protected(const struct proxy_participant *proxy_pp, ddsi_entityid_t entityid);
 
 /**
  * @brief Set security information, depending on plist, into the given
@@ -207,22 +490,120 @@ q_omg_security_is_local_rtps_protected(
  * @param[in] proxypp  Proxy participant to set security info on.
  * @param[in] plist    Paramater list, possibly contains security info.
  */
-void
-set_proxy_participant_security_info(
-  struct proxy_participant *proxypp,
-  const ddsi_plist_t *plist);
+void set_proxy_participant_security_info(struct proxy_participant *proxypp, const ddsi_plist_t *plist);
 
 /**
- * @brief Set security information, depending on plist and proxy participant,
- * into the given proxy reader.
+ * @brief Check if the participant and the proxy participant
+ *        have compatible security info settings.
  *
- * @param[in] prd      Proxy reader to set security info on.
- * @param[in] plist    Paramater list, possibly contains security info.
+ * Associated with a secure participant is the ParticipantSecurityInfo parameter.
+ * This parameter contains the setting of the security attributes and the associated
+ * plugin security attributes of the secure participant.
+ * This function will check if the received ParticipantSecurityInfo parameter is
+ * compatible with the local ParticipantSecurityInfo parameter.
+ *
+ * @param[in] pp      The participant.
+ * @param[in] proxypp The proxy participant.
+ *
+ * @returns bool
+ * @retval true   The participant and the proxy participant have compatible
+ *                security info settings.
+ * @retval false  Otherwise.
  */
-void
-set_proxy_reader_security_info(
-  struct proxy_reader *prd,
-  const ddsi_plist_t *plist);
+bool q_omg_security_is_local_rtps_protected(const struct participant *pp, ddsi_entityid_t entityid);
+
+/**
+ * @brief Check if the participant allows communication with unauthenticated
+ *        participants
+ *
+ * @param[in] pp  The participant.
+ *
+ * @returns bool
+ * @retval true   The participant allows unauthenticated communication
+ * @retval false  Otherwise.
+ */
+bool q_omg_participant_allow_unauthenticated(struct participant *pp);
+
+/**
+ * @brief Initialize the proxy participant security attributes
+ *
+ * @param[in] proxypp  The proxy participant.
+ *
+ */
+void q_omg_security_init_remote_participant(struct proxy_participant *proxypp);
+
+void q_omg_security_remote_participant_set_initialized(struct proxy_participant *proxypp);
+
+bool q_omg_security_remote_participant_is_initialized(struct proxy_participant *proxypp);
+
+/**
+ * @brief Registers the matched proxy participant with the crypto plugin
+ *
+ * When the proxy participant is authenticated and allowed by access control then the match between the local and
+ * the remote participant must be registered with the cypto factory provided by the crypto plugin. The
+ * shared secret handle obtained from the authentication phase and the permission handle returned when validating
+ * the proxy participant with access control plugin have to be provided.
+ *
+ *
+ * @param[in] pp                 The participant.
+ * @param[in] proxypp            The proxy participant.
+ * @param[in] shared_secret      The shared_secret handle.
+ *
+ * @returns bool
+ * @retval true    The proxy participant is allowed.
+ * @retval false   The proxy participant is not allowed.
+ */
+bool q_omg_security_register_remote_participant(struct participant *pp, struct proxy_participant *proxypp, int64_t shared_secret);
+
+/**
+ * @brief Removes a registered proxy participant from administation of the authentication,
+ *        access control and crypto plugins.
+ *
+ * @param[in] proxypp            The proxy participant.
+ */
+void q_omg_security_deregister_remote_participant(struct proxy_participant *proxypp);
+
+/**
+ * @brief Generate and send the crypto tokens needed for encoding RTPS messages.
+ *
+ * When the security settings indicate that RTPS message encoding or signing is
+ * configured for the participant then this function will ask the cypto echange for
+ * the corresponding cypto tokens and send these to the proxy participant.
+ *
+ * @param[in] pp                 The participant.
+ * @param[in] proxypp            The proxy participant.
+ */
+void q_omg_security_participant_send_tokens(struct participant *pp, struct proxy_participant *proxypp);
+
+/**
+ * @brief Get the cypto handle associated with the proxy participant.
+ *
+ * This function returns the handle which is the association between
+ * the proxy participant and the crypto plugin. This handle is created
+ * when the proxy participant is registered with the crypto plugin.
+ *
+ * @param[in] proxypp            The proxy participant.
+ *
+ * @returns handle
+ * @retval !0  Valid crypto handle associated with the proxy participant.
+ * @retval 0   Otherwise.
+ */
+int64_t q_omg_security_get_remote_participant_handle(struct proxy_participant *proxypp);
+
+/**
+ * @brief Set the crypto tokens used for the encryption and decryption of RTPS messages.
+ *
+ * The remote participant  will send the crypto tokens when the security settings determine that the
+ * communication between the participants must be secure. These tokens are used for the necryption and
+ * decryption of complete RTPS messages. When these tokens are received this function will register these tokens
+ * with the crypto plugin. The crypto plugin will return a crypto handle that will be used to associate the
+ * stored tokens with the remote participant.
+ *
+ * @param[in] pp        The local participant.
+ * @param[in] proxypp   The remote participant.
+ * @param[in] tokens    The crypto token received from the remote participant for the local participant.
+ */
+void q_omg_security_set_participant_crypto_tokens(struct participant *pp, struct proxy_participant *proxypp, const nn_dataholderseq_t *tokens);
 
 /**
  * @brief Set security information, depending on plist and proxy participant,
@@ -231,10 +612,220 @@ set_proxy_reader_security_info(
  * @param[in] pwr      Proxy writer to set security info on.
  * @param[in] plist    Paramater list, possibly contains security info.
  */
-void
-set_proxy_writer_security_info(
-  struct proxy_writer *pwr,
-  const ddsi_plist_t *plist);
+void set_proxy_writer_security_info(struct proxy_writer *pwr, const ddsi_plist_t *plist);
+
+/**
+ * @brief Determine the security settings associated with the remote writer.
+ *
+ * From the security information contained in the parameter list from the remote writer
+ * the corresponding security settings are determined and returned in the info parameter.
+ *
+ * @param[in] pwr       The remote writer.
+ * @param[in] plist     The parameter list from the remote writer.
+ * @param[out] info     The security settings associated with the remote writer.
+ */
+void q_omg_get_proxy_writer_security_info(struct proxy_writer *pwr, const ddsi_plist_t *plist, nn_security_info_t *info);
+
+/**
+ * @brief Check if the writer has the is_discovery_protected flag set
+ *
+ * @param[in] wr        The local writer.
+ *
+ * @returns bool  True if the writer has the is_discovery_protected flag set
+ */
+bool q_omg_writer_is_discovery_protected(const struct writer *wr);
+
+/**
+ * @brief Check if the writer has the is_submessage_protected flag set
+ *
+ * @param[in] wr        The local writer.
+ *
+ * @returns bool  True if the writer has the is_submessage_protected flag set
+ */
+bool q_omg_writer_is_submessage_protected(const struct writer *wr);
+
+/**
+ * @brief Check if the writer has the is_payload_protected flag set
+ *
+ * @param[in] wr        The local writer.
+ *
+ * @returns bool  True if the writer has the is_payload_protected flag set
+ */
+bool q_omg_writer_is_payload_protected(const struct writer *wr);
+
+/**
+ * @brief Check if the remote writer is allowed to communicate with endpoints of the
+ *        local participant.
+ *
+ * This function will check with the access control plugin if the remote writer
+ * is allowed to communicate with this participant.
+ *
+ * @param[in] pwr       The remote writer.
+ * @param[in] domain_id The domain id.
+ * @param[in] pp        The local participant.
+ *
+ * @returns bool
+ * @retval true   The remote writer is allowed to communicate.
+ * @retval false  Otherwise.
+ */
+bool q_omg_security_check_remote_writer_permissions(const struct proxy_writer *pwr, uint32_t domain_id, struct participant *pp);
+
+/**
+ * @brief Check it the remote writer is allowed to communicate with the local reader.
+ *
+ * When a remote writer is allowed by access control it has to be checked if the remote
+ * writer is allowed to communicate with a particular local reader. This function will
+ * check if the provided security end-point attributes are compatible, When the security
+ * attributes are compatible then the function will register the reader and remote writer
+ * match with the crypto factory and will also ask the crypto exchange to generate the
+ * crypto tokens associate with the local reader which will be sent to the remote entity.
+ * Note that the reader crypto tokens are used to encrypt the reader specific submessages
+ * when submessage encoding or signing is configured.
+ *
+ * @param[in] rd   The local reader.
+ * @param[in] pwr  The remote writer.
+ * @param[out] crypto_handle  The crypto handle associated with the match.
+ *
+ * @returns bool
+ * @retval true   The local reader and remote writer are allowed to communicate.
+ * @retval false  Otherwise.
+ */
+bool q_omg_security_match_remote_writer_enabled(struct reader *rd, struct proxy_writer *pwr, int64_t *crypto_handle);
+
+/**
+ * @brief Release the security information associated with the match between a reader and
+ * a remote writer.
+ *
+ * This function releases the security resources that were allocated for this reader and remote
+ * writer match. For example it will release the security tokens that where associated with this
+ * reader and the remote writer.
+ *
+ * @param[in] gv       The global parameters.
+ * @param[in] rd_guid  The guid of the reader.
+ * @param[in] match    The reader-proxy_writer match.
+ */
+void q_omg_security_deregister_remote_writer_match(const struct ddsi_domaingv *gv, const ddsi_guid_t *rd_guid, struct rd_pwr_match *match);
+
+/**
+ * @brief Set the crypto tokens used for the secure communication from the remote writer to the reader.
+ *
+ * The remote writer instance will send the crypto tokens when the security settings determine that the
+ * communication between the remote writer and the reader must be secure. When these tokens are received
+ * this function will register these tokens with the crypto plugin and set the corresponding crypto handle returned
+ * by the crypto plugin which is then used for decrypting messages received from that remote writer to the reader.
+ *
+ * @param[in] rd        The local reader.
+ * @param[in] pwr_guid  The guid of the remote writer.
+ * @param[in] tokens    The crypto token received from the remote writer for the reader.
+ */
+void q_omg_security_set_remote_writer_crypto_tokens(struct reader *rd, const ddsi_guid_t *pwr_guid, const nn_dataholderseq_t *tokens);
+
+/**
+ * @brief Set security information, depending on plist and proxy participant,
+ * into the given proxy reader.
+ *
+ * @param[in] prd      Proxy reader to set security info on.
+ * @param[in] plist    Paramater list, possibly contains security info.
+ */
+void set_proxy_reader_security_info(struct proxy_reader *prd, const ddsi_plist_t *plist);
+
+/**
+ * @brief Determine the security settings associated with the remote reader.
+ *
+ * From the security information contained in the parameter list from the remote reader
+ * the corresponding security settings are determined and returned in the info parameter.
+ *
+ * @param[in] prd       The remote reader.
+ * @param[in] plist     The parameter list from the remote reader.
+ * @param[out] info     The security settings associated with the remote reader.
+ */
+void q_omg_get_proxy_reader_security_info(struct proxy_reader *prd, const ddsi_plist_t *plist, nn_security_info_t *info);
+
+/**
+ * @brief Check if the reader has the is_discovery_protected flag set
+ *
+ * @param[in] rd        The local reader.
+ *
+ * @returns bool  True if the reader has the is_discovery_protected flag set
+ */
+bool q_omg_reader_is_discovery_protected(const struct reader *rd);
+
+/**
+ * @brief Check if the reader has the is_submessage_protected flag set
+ *
+ * @param[in] rd        The local reader.
+ *
+ * @returns bool  True if the reader has the is_submessage_protected flag set
+ */
+bool q_omg_reader_is_submessage_protected(const struct reader *rd);
+
+/**
+ * @brief Check if the remote reader is allowed to communicate with endpoints of the
+ *        local participant.
+ *
+ * This function will check with the access control plugin if the remote reader
+ * is allowed to communicate with this participant.
+ *
+ * @param[in] prd       The remote reader.
+ * @param[in] domain_id The domain id.
+ * @param[in] pp        The local participant.
+ *
+ * @returns bool
+ * @retval true   The remote reader is allowed to communicate.
+ * @retval false  Otherwise.
+ */
+bool q_omg_security_check_remote_reader_permissions(const struct proxy_reader *prd, uint32_t domain_id, struct participant *pp);
+
+/**
+ * @brief Check it the local writer is allowed to communicate with the remote reader.
+ *
+ * When a remote reader is allowed by accessstruct dds_security_garbage control it has to be checked if the local
+ * writer is allowed to communicate with a particular local writer. This function will
+ * check if the provided security end-point attributes are compatible, When the security
+ * attributes are compatible then the function will register the writer and remote reader
+ * match with the crypto factory and will also ask the crypto exchange to generate the
+ * crypto tokens associate with the local writer which will be sent to the remote entity.
+ * Note that the writer crypto tokens are used to encrypt the writer specific submessages
+ * when submessage encoding or signing is configured and also the crypto tokens used
+ * for encoding the payload of data or datafrag messages.
+ *
+ * @param[in] wr              The local writer.
+ * @param[in] prd             The remote reader.
+ * @param[out] crypto_handle  The crypto handle associated with the match.
+ *
+ * @returns bool
+ * @retval true   The local writer and remote reader are allowed to communicate.
+ * @retval false  Otherwise.
+ */
+bool q_omg_security_match_remote_reader_enabled(struct writer *wr, struct proxy_reader *prd, int64_t *crypto_handle);
+
+/**
+ * @brief Release the security information associated with the match between a writer and
+ * a remote reader.
+ *
+ * This function releases the security resources that were allocated for this writer and remote
+ * reader match. For example it will release the security tokens that where associated with this
+ * writer and the remote reader.
+ *
+ * @param[in] gv       The global parameters.
+ * @param[in] wr_guid  The guid of the writer.
+ * @param[in] match    The writer-proxy_reader match.
+ */
+void q_omg_security_deregister_remote_reader_match(const struct ddsi_domaingv *gv, const ddsi_guid_t *wr_guid, struct wr_prd_match *match);
+
+/**
+ * @brief Set the crypto tokens used for the secure communication from the remote reader to the writer.
+ *
+ * The remote reader instance will send the crypto tokens when the security settings determine that the
+ * communication between the remote reader and the writer must be secure. When these tokens are received
+ * this function will register these tokens with the crypto plugin and set the corresponding crypto handle returned
+ * by the crypto plugin which is then used for decrypting messages received from that remote reader to the writer.
+ *
+ * @param[in] wr        The local writer.
+ * @param[in] prd_guid  The guid of the remote reader.
+ * @param[in] tokens    The crypto token received from the remote reader for the writer.
+ */
+void q_omg_security_set_remote_reader_crypto_tokens(struct writer *wr, const ddsi_guid_t *prd_guid, const nn_dataholderseq_t *tokens);
 
 /**
  * @brief Encode RTPS message.
@@ -253,8 +844,9 @@ set_proxy_writer_security_info(
  */
 bool
 q_omg_security_encode_rtps_message(
+  const struct ddsi_domaingv *gv,
   int64_t                 src_handle,
-  ddsi_guid_t            *src_guid,
+  const ddsi_guid_t      *src_guid,
   const unsigned char    *src_buf,
   size_t                  src_len,
   unsigned char         **dst_buf,
@@ -283,11 +875,7 @@ q_omg_security_encode_rtps_message(
  *                contains the payload that should be send.
  * @retval false  Encoding was necessary, but failed.
  */
-bool
-encode_payload(
-  struct writer *wr,
-  ddsrt_iovec_t *vec,
-  unsigned char **buf);
+bool encode_payload(struct writer *wr, ddsrt_iovec_t *vec, unsigned char **buf);
 
 /**
  * @brief Decode the payload of a Data submessage.
@@ -309,13 +897,7 @@ encode_payload(
  *                contains the data that should be deserialized.
  * @retval false  Decoding was necessary, but failed.
  */
-bool
-decode_Data(
-  const struct ddsi_domaingv *gv,
-  struct nn_rsample_info *sampleinfo,
-  unsigned char *payloadp,
-  uint32_t payloadsz,
-  size_t *submsg_len);
+bool decode_Data(const struct ddsi_domaingv *gv, struct nn_rsample_info *sampleinfo, unsigned char *payloadp, uint32_t payloadsz, size_t *submsg_len);
 
 /**
  * @brief Decode the payload of a DataFrag submessage.
@@ -337,13 +919,7 @@ decode_Data(
  *                contains the data that should be deserialized.
  * @retval false  Decoding was necessary, but failed.
  */
-bool
-decode_DataFrag(
-  const struct ddsi_domaingv *gv,
-  struct nn_rsample_info *sampleinfo,
-  unsigned char *payloadp,
-  uint32_t payloadsz,
-  size_t *submsg_len);
+bool decode_DataFrag(const struct ddsi_domaingv *gv, struct nn_rsample_info *sampleinfo, unsigned char *payloadp, uint32_t payloadsz, size_t *submsg_len);
 
 /**
  * @brief Encode datareader submessage when necessary.
@@ -359,12 +935,7 @@ decode_DataFrag(
  * @param[in]     pwr       Writer for which the message is intended.
  * @param[in]     rd_guid   Origin reader guid.
  */
-void
-encode_datareader_submsg(
-  struct nn_xmsg *msg,
-  struct nn_xmsg_marker sm_marker,
-  struct proxy_writer *pwr,
-  const struct ddsi_guid *rd_guid);
+void encode_datareader_submsg(struct nn_xmsg *msg, struct nn_xmsg_marker sm_marker, struct proxy_writer *pwr, const struct ddsi_guid *rd_guid);
 
 /**
  * @brief Encode datawriter submessage when necessary.
@@ -379,11 +950,7 @@ encode_datareader_submsg(
  * @param[in,out] sm_marker Submessage location within message.
  * @param[in]     wr        Origin writer guid.
  */
-void
-encode_datawriter_submsg(
-  struct nn_xmsg *msg,
-  struct nn_xmsg_marker sm_marker,
-  struct writer *wr);
+void encode_datawriter_submsg(struct nn_xmsg *msg, struct nn_xmsg_marker sm_marker, struct writer *wr);
 
 /**
  * @brief Check if given submessage is properly decoded.
@@ -461,16 +1028,7 @@ decode_SecPrefix(
  * @retval NN_RTPS_MSG_STATE_ENCODED  Decoding succeeded.
  * @retval NN_RTPS_MSG_STATE_ERROR    Decoding failed.
  */
-nn_rtps_msg_state_t
-decode_rtps_message(
-  struct thread_state1 * const ts1,
-  struct ddsi_domaingv *gv,
-  struct nn_rmsg **rmsg,
-  Header_t **hdr,
-  unsigned char **buff,
-  ssize_t *sz,
-  struct nn_rbufpool *rbpool,
-  bool isstream);
+nn_rtps_msg_state_t decode_rtps_message(struct thread_state1 * const ts1, struct ddsi_domaingv *gv, struct nn_rmsg **rmsg, Header_t **hdr, unsigned char **buff, ssize_t *sz, struct nn_rbufpool *rbpool, bool isstream);
 
 /**
  * @brief Send the RTPS message securely.
@@ -491,6 +1049,7 @@ decode_rtps_message(
  */
 ssize_t
 secure_conn_write(
+    const struct ddsi_domaingv *gv,
     ddsi_tran_conn_t conn,
     const nn_locator_t *dst,
     size_t niov,
@@ -518,239 +1077,58 @@ secure_conn_write(
 dds_return_t q_omg_security_load( struct dds_security_context *security_context, const dds_qos_t *qos );
 
 
-void q_omg_security_init( struct dds_security_context **sc, const struct ddsrt_log_cfg *logcfg);
+void q_omg_security_init( struct ddsi_domaingv *gv );
 
-void q_omg_security_deinit( struct dds_security_context **sc);
+void q_omg_security_deinit( struct ddsi_domaingv *gv );
 
 bool q_omg_is_security_loaded(  struct dds_security_context *sc );
 
 
-/**
- * @brief Check if the participant and the proxy participant
- *        have compatible security info settings.
- *
- * Associated with a secure participant is the ParticipantSecurityInfo parameter.
- * This parameter contains the setting of the security attributes and the associated
- * plugin security attributes of the secure participant.
- * This function will check if the received ParticipantSecurityInfo parameter is
- * compatible with the local ParticipantSecurityInfo parameter.
- *
- * @param[in] pp      The participant.
- * @param[in] proxypp The proxy participant.
- *
- * @returns bool
- * @retval true   The participant and the proxy participant have compatible
- *                security info settings.
- * @retval false  Otherwise.
- */
-bool q_omg_is_similar_participant_security_info(struct participant *pp, struct proxy_participant *proxypp);
-
-/**
- * @brief Check if the participant allows communication with unauthenticated
- *        participants
- *
- * @param[in] pp  The participant.
- *
- * @returns bool
- * @retval true   The participant allows unauthenticated communication
- * @retval false  Otherwise.
- */
-bool q_omg_participant_allow_unauthenticated(struct participant *pp);
-
-/**
- * @brief Register participant with security plugin and check if the
- *        participant is allowed by security.
- *
- * This function will register the participant with the authentication
- * plugin which will check if the provided security QoS parameters are
- * correct, e.g. is the provided certificate valid, etc.
- * When that is successful it is checked with access control if the
- * participant has the correct permissions and is allowed to be created.
- *
- * @param[in] pp        The participant.
- * @param[in] domain_id The domain id.
- *
- * @returns bool
- * @retval true   The security check on the participant succeeded.
- * @retval false  The security check on the participant failed.
- */
-bool q_omg_security_check_create_participant(struct participant *pp, uint32_t domain_id);
-
-/**
- * @brief Initialize the proxy participant security attributes
- *
- * @param[in] proxypp  The proxy participant.
- *
- */
-void q_omg_security_init_remote_participant(struct proxy_participant *proxypp);
-
-/**
- * @brief Check the if the proxy participant is allowed by checking the security permissions.
- *
- * The access control plugin is ask to verify if the proxy participant is allowed to
- * communicate with the local participant. When the proxy participant is allowed the
- * function will return a valid permission handle which is provided by the access control plugin.
- *
- * @param[in] domain_id The domain id
- * @param[in] pp        The participant
- * @param[in] proxypp   The proxy participant
- *
- * @returns permission handle
- * @retval !0    The proxy participant is allowed
- * @retval 0     The proxy participant is not allowed.
- */
-int64_t q_omg_security_check_remote_participant_permissions(uint32_t domain_id, struct participant *pp, struct proxy_participant *proxypp);
-
-/**
- * @brief Registers the matched proxy participant with the crypto plugin
- *
- * When the proxy participant is authenticated and allowed by access control then the match between the local and
- * the remote participant must be registered with the cypto factory provided by the crypto plugin. The
- * shared secret handle obtained from the authentication phase and the permission handle returned when validating
- * the proxy participant with access control plugin have to be provided.
- *
- *
- * @param[in] pp                 The participant.
- * @param[in] proxypp            The proxy participant.
- * @param[in] shared_secret      The shared_secret handle.
- * @param[in] proxy_permissions  The permission handle associated with the proxy participant.
- */
-void q_omg_security_register_remote_participant(struct participant *pp, struct proxy_participant *proxypp, int64_t shared_secret, int64_t proxy_permissions);
-
-/**
- * @brief Removes a registered proxy participant from administation of the authentication,
- *        access control and crypto plugins.
- *
- * @param[in] proxypp            The proxy participant.
- */
-void q_omg_security_deregister_remote_participant(struct proxy_participant *proxypp);
-
-/**
- * @brief Generate and send the crypto tokens needed for encoding RTPS messages.
- *
- * When the security settings indicate that RTPS message encoding or signing is
- * configured for the participant then this function will ask the cypto echange for
- * the corresponding cypto tokens and send these to the proxy participant.
- *
- * @param[in] pp                 The participant.
- * @param[in] proxypp            The proxy participant.
- */
-void q_omg_security_participant_send_tokens(struct participant *pp, struct proxy_participant *proxypp);
-
-/**
- * @brief Check if the remote writer is allowed to communicate with endpoints of the
- *        local participant.
- *
- * This function will check with the access control plugin if the remote writer
- * is allowed to communicate with this participant.
- *
- * @param[in] pwr       The remote writer.
- * @param[in] domain_id The domain id.
- * @param[in] pp        The local participant.
- *
- * @returns bool
- * @retval true   The remote writer is allowed to communicate.
- * @retval false  Otherwise.
- */
-bool q_omg_security_check_remote_writer_permissions(const struct proxy_writer *pwr, uint32_t domain_id, struct participant *pp);
-
-/**
- * @brief Check if the remote reader is allowed to communicate with endpoints of the
- *        local participant.
- *
- * This function will check with the access control plugin if the remote reader
- * is allowed to communicate with this participant.
- *
- * @param[in] prd       The remote reader.
- * @param[in] domain_id The domain id.
- * @param[in] pp        The local participant.
- *
- * @returns bool
- * @retval true   The remote reader is allowed to communicate.
- * @retval false  Otherwise.
- */
-bool q_omg_security_check_remote_reader_permissions(const struct proxy_reader *prd, uint32_t domain_id, struct participant *pp);
-
-/**
- * @brief Check it the remote writer is allowed to communicate with the local reader.
- *
- * When a remote writer is allowed by access control it has to be checked if the remote
- * writer is allowed to communicate with a particular local reader. This function will
- * check if the provided security end-point attributes are compatible, When the security
- * attributes are compatible then the function will register the reader and remote writer
- * match with the crypto factory and will also ask the crypto exchange to generate the
- * crypto tokens associate with the local reader which will be sent to the remote entity.
- * Note that the reader crypto tokens are used to encrypt the reader specific submessages
- * when submessage encoding or signing is configured.
- *
- * @param[in] rd   The local reader.
- * @param[in] pwr  The remote writer.
- *
- * @returns bool
- * @retval true   The local reader and remote writer are allowed to communicate.
- * @retval false  Otherwise.
- */
-bool q_omg_security_match_remote_writer_enabled(struct reader *rd, struct proxy_writer *pwr);
-
-/**
- * @brief Check it the local writer is allowed to communicate with the remote reader.
- *
- * When a remote reader is allowed by access control it has to be checked if the local
- * writer is allowed to communicate with a particular local writer. This function will
- * check if the provided security end-point attributes are compatible, When the security
- * attributes are compatible then the function will register the writer and remote reader
- * match with the crypto factory and will also ask the crypto exchange to generate the
- * crypto tokens associate with the local writer which will be sent to the remote entity.
- * Note that the writer crypto tokens are used to encrypt the writer specific submessages
- * when submessage encoding or signing is configured and also the crypto tokens used
- * for encoding the payload of data or datafrag messages.
- *
- * @param[in] wr   The local writer.
- * @param[in] prd  The remote reader.
- *
- * @returns bool
- * @retval true   The local writer and remote reader are allowed to communicate.
- * @retval false  Otherwise.
- */
-bool q_omg_security_match_remote_reader_enabled(struct writer *wr, struct proxy_reader *prd);
-
 #else /* DDSI_INCLUDE_SECURITY */
 
 #include "dds/ddsi/q_unused.h"
 
-inline bool
-q_omg_participant_is_secure(
-  UNUSED_ARG(const struct participant *pp))
+inline bool q_omg_security_enabled(void)
 {
   return false;
 }
 
-inline bool
-q_omg_proxy_participant_is_secure(
-  UNUSED_ARG(const struct proxy_participant *proxypp))
+inline bool q_omg_participant_is_access_protected(UNUSED_ARG(const struct participant *pp))
 {
   return false;
 }
 
-inline unsigned
-determine_subscription_writer(
-  UNUSED_ARG(const struct reader *rd))
+inline bool q_omg_participant_is_rtps_protected(UNUSED_ARG(const struct participant *pp))
+{
+  return false;
+}
+
+inline bool q_omg_participant_is_liveliness_protected(UNUSED_ARG(const struct participant *pp))
+{
+  return false;
+}
+
+inline bool q_omg_participant_is_secure(UNUSED_ARG(const struct participant *pp))
+{
+  return false;
+}
+
+inline bool q_omg_proxy_participant_is_secure(UNUSED_ARG(const struct proxy_participant *proxypp))
+{
+  return false;
+}
+
+inline unsigned determine_subscription_writer(UNUSED_ARG(const struct reader *rd))
 {
   return NN_ENTITYID_SEDP_BUILTIN_SUBSCRIPTIONS_WRITER;
 }
 
-inline unsigned
-determine_publication_writer(
-  UNUSED_ARG(const struct writer *wr))
+inline unsigned determine_publication_writer(UNUSED_ARG(const struct writer *wr))
 {
   return NN_ENTITYID_SEDP_BUILTIN_PUBLICATIONS_WRITER;
 }
 
-inline bool
-is_proxy_participant_deletion_allowed(
-  UNUSED_ARG(struct ddsi_domaingv * const gv),
-  UNUSED_ARG(const struct ddsi_guid *guid),
-  UNUSED_ARG(const ddsi_entityid_t pwr_entityid))
+inline bool is_proxy_participant_deletion_allowed(UNUSED_ARG(struct ddsi_domaingv * const gv), UNUSED_ARG(const struct ddsi_guid *guid), UNUSED_ARG(const ddsi_entityid_t pwr_entityid))
 {
   return true;
 }
@@ -765,12 +1143,56 @@ inline bool q_omg_participant_allow_unauthenticated(UNUSED_ARG(struct participan
   return true;
 }
 
-inline bool
-q_omg_security_check_create_participant(UNUSED_ARG(struct participant *pp), UNUSED_ARG(uint32_t domain_id))
+inline bool q_omg_security_check_create_participant(UNUSED_ARG(struct participant *pp), UNUSED_ARG(uint32_t domain_id))
 {
   return true;
 }
 
+inline void q_omg_security_deregister_participant(UNUSED_ARG(struct participant *pp))
+{
+}
+
+inline bool q_omg_security_check_create_topic(UNUSED_ARG(const struct ddsi_domaingv *gv), UNUSED_ARG(const ddsi_guid_t *pp_guid), UNUSED_ARG(const char *topic_name), UNUSED_ARG(const struct dds_qos *qos))
+{
+  return true;
+}
+
+inline int64_t q_omg_security_get_local_participant_handle(UNUSED_ARG(const struct participant *pp))
+{
+  return 0;
+}
+
+inline bool q_omg_security_check_create_writer(UNUSED_ARG(struct participant *pp), UNUSED_ARG(uint32_t domain_id), UNUSED_ARG(const char *topic_name), UNUSED_ARG(const struct dds_qos *writer_qos))
+{
+  return true;
+}
+
+inline void q_omg_security_register_writer(UNUSED_ARG(struct writer *wr))
+{
+}
+
+inline void q_omg_security_deregister_writer(UNUSED_ARG(struct writer *wr))
+{
+}
+
+inline bool q_omg_security_check_create_reader(UNUSED_ARG(struct participant *pp), UNUSED_ARG(uint32_t domain_id), UNUSED_ARG(const char *topic_name), UNUSED_ARG(const struct dds_qos *reader_qos))
+{
+  return true;
+}
+
+inline void q_omg_security_register_reader(UNUSED_ARG(struct reader *rd))
+{
+}
+
+inline void q_omg_security_deregister_reader(UNUSED_ARG(struct reader *rd))
+{
+}
+
+inline bool q_omg_security_is_remote_rtps_protected(UNUSED_ARG(const struct proxy_participant *proxypp), UNUSED_ARG(ddsi_entityid_t entityid))
+{
+  return false;
+}
+
 inline void q_omg_security_init_remote_participant(UNUSED_ARG(struct proxy_participant *proxypp))
 {
 }
@@ -780,8 +1202,9 @@ inline int64_t q_omg_security_check_remote_participant_permissions(UNUSED_ARG(ui
   return 0LL;
 }
 
-inline void q_omg_security_register_remote_participant(UNUSED_ARG(struct participant *pp), UNUSED_ARG(struct proxy_participant *proxypp), UNUSED_ARG(int64_t shared_secret), UNUSED_ARG(int64_t proxy_permissions))
+inline bool q_omg_security_register_remote_participant(UNUSED_ARG(struct participant *pp), UNUSED_ARG(struct proxy_participant *proxypp), UNUSED_ARG(int64_t identity_handle), UNUSED_ARG(int64_t shared_secret))
 {
+  return true;
 }
 
 inline void q_omg_security_deregister_remote_participant(UNUSED_ARG(struct proxy_participant *proxypp))
@@ -792,46 +1215,78 @@ inline void q_omg_security_participant_send_tokens(UNUSED_ARG(struct participant
 {
 }
 
-inline bool q_omg_security_match_remote_writer_enabled(UNUSED_ARG(struct reader *rd), UNUSED_ARG(struct proxy_writer *pwr))
+inline int64_t q_omg_security_get_remote_participant_handle(UNUSED_ARG(struct proxy_participant *proxypp))
+{
+  return 0;
+}
+
+inline bool q_omg_security_match_remote_writer_enabled(UNUSED_ARG(struct reader *rd), UNUSED_ARG(struct proxy_writer *pwr), UNUSED_ARG(int64_t *crypto_handle))
 {
   return true;
 }
 
-inline bool q_omg_security_match_remote_reader_enabled(UNUSED_ARG(struct writer *wr), UNUSED_ARG(struct proxy_reader *prd))
+inline bool q_omg_security_match_remote_reader_enabled(UNUSED_ARG(struct writer *wr), UNUSED_ARG(struct proxy_reader *prd), UNUSED_ARG(int64_t *crypto_handle))
 {
   return true;
 }
 
-inline bool
-q_omg_security_check_remote_writer_permissions(UNUSED_ARG(const struct proxy_writer *pwr), UNUSED_ARG(uint32_t domain_id), UNUSED_ARG(struct participant *pp))
+inline void q_omg_get_proxy_writer_security_info(UNUSED_ARG(struct proxy_writer *pwr), UNUSED_ARG(const ddsi_plist_t *plist), UNUSED_ARG(nn_security_info_t *info))
+{
+}
+
+inline bool q_omg_writer_is_discovery_protected(UNUSED_ARG(const struct writer *wr))
+{
+  return false;
+}
+
+inline bool q_omg_writer_is_submessage_protected(UNUSED_ARG(const struct writer *wr))
+{
+  return false;
+}
+
+inline bool q_omg_writer_is_payload_protected(UNUSED_ARG(const struct writer *wr))
+{
+  return false;
+}
+
+inline bool q_omg_security_check_remote_writer_permissions(UNUSED_ARG(const struct proxy_writer *pwr), UNUSED_ARG(uint32_t domain_id), UNUSED_ARG(struct participant *pp))
 {
   return true;
 }
 
-inline bool
-q_omg_security_check_remote_reader_permissions(UNUSED_ARG(const struct proxy_reader *prd), UNUSED_ARG(uint32_t domain_id), UNUSED_ARG(struct participant *pp))
+inline void q_omg_security_deregister_remote_writer_match(UNUSED_ARG(const struct proxy_writer *pwr), UNUSED_ARG(const struct reader *rd), UNUSED_ARG(struct rd_pwr_match *match))
+{
+}
+
+inline void q_omg_get_proxy_reader_security_info(UNUSED_ARG(struct proxy_reader *prd), UNUSED_ARG(const ddsi_plist_t *plist), UNUSED_ARG(nn_security_info_t *info))
+{
+}
+
+inline bool q_omg_reader_is_discovery_protected(UNUSED_ARG(const struct reader *rd))
+{
+  return false;
+}
+
+inline bool q_omg_reader_is_submessage_protected(UNUSED_ARG(const struct reader *rd))
+{
+  return false;
+}
+
+
+inline bool q_omg_security_check_remote_reader_permissions(UNUSED_ARG(const struct proxy_reader *prd), UNUSED_ARG(uint32_t domain_id), UNUSED_ARG(struct participant *pp))
 {
   return true;
 }
 
-inline void
-set_proxy_participant_security_info(
-  UNUSED_ARG(struct proxy_participant *prd),
-  UNUSED_ARG(const ddsi_plist_t *plist))
+inline void set_proxy_participant_security_info(UNUSED_ARG(struct proxy_participant *prd), UNUSED_ARG(const ddsi_plist_t *plist))
 {
 }
 
-inline void
-set_proxy_reader_security_info(
-  UNUSED_ARG(struct proxy_reader *prd),
-  UNUSED_ARG(const ddsi_plist_t *plist))
+inline void set_proxy_reader_security_info(UNUSED_ARG(struct proxy_reader *prd), UNUSED_ARG(const ddsi_plist_t *plist))
 {
 }
 
-inline void
-set_proxy_writer_security_info(
-  UNUSED_ARG(struct proxy_writer *pwr),
-  UNUSED_ARG(const ddsi_plist_t *plist))
+inline void set_proxy_writer_security_info(UNUSED_ARG(struct proxy_writer *pwr), UNUSED_ARG(const ddsi_plist_t *plist))
 {
 }
 
@@ -924,6 +1379,24 @@ inline void q_omg_security_deinit( UNUSED_ARG( struct dds_security_context *sc)
 
 inline bool q_omg_is_security_loaded(  UNUSED_ARG( struct dds_security_context *sc )) { return false; }
 
+inline void q_omg_security_deregister_remote_reader_match(UNUSED_ARG(const struct proxy_reader *prd), UNUSED_ARG(const struct writer *wr), UNUSED_ARG(struct wr_prd_match *match))
+{
+}
+
+inline bool q_omg_plist_keyhash_is_protected(UNUSED_ARG(const ddsi_plist_t *plist))
+{
+  return false;
+}
+
+inline bool q_omg_is_endpoint_protected(UNUSED_ARG(const ddsi_plist_t *plist))
+{
+  return false;
+}
+
+inline void q_omg_log_endpoint_protection(UNUSED_ARG(struct ddsi_domaingv * const gv), UNUSED_ARG(const ddsi_plist_t *plist))
+{
+}
+
 #endif /* DDSI_INCLUDE_SECURITY */
 
 #if defined (__cplusplus)
diff --git a/src/core/ddsi/include/dds/ddsi/ddsi_security_util.h b/src/core/ddsi/include/dds/ddsi/ddsi_security_util.h
new file mode 100644
index 0000000..7c03496
--- /dev/null
+++ b/src/core/ddsi/include/dds/ddsi/ddsi_security_util.h
@@ -0,0 +1,91 @@
+/*
+ * Copyright(c) 2006 to 2018 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+#ifndef DDSI_SECURITY_UTIL_H
+#define DDSI_SECURITY_UTIL_H
+
+#ifdef DDSI_INCLUDE_SECURITY
+
+#include "dds/ddsi/ddsi_plist.h"
+#include "dds/security/core/dds_security_utils.h"
+
+#if defined (__cplusplus)
+extern "C" {
+#endif
+
+void g_omg_shallow_copy_StringSeq(DDS_Security_StringSeq *dst, const ddsi_stringseq_t *src);
+
+void g_omg_shallow_free_StringSeq(DDS_Security_StringSeq *obj);
+
+void q_omg_copy_PropertySeq(DDS_Security_PropertySeq *dst, const dds_propertyseq_t *src);
+
+void q_omg_shallow_copyin_PropertySeq(DDS_Security_PropertySeq *dst, const dds_propertyseq_t *src);
+
+void q_omg_shallow_copyout_PropertySeq(dds_propertyseq_t *dst, const DDS_Security_PropertySeq *src);
+
+void q_omg_shallow_free_PropertySeq(DDS_Security_PropertySeq *obj);
+
+void q_omg_shallow_copyin_BinaryPropertySeq(DDS_Security_BinaryPropertySeq *dst, const dds_binarypropertyseq_t *src);
+
+void q_omg_shallow_copyout_BinaryPropertySeq(dds_binarypropertyseq_t *dst, const DDS_Security_BinaryPropertySeq *src);
+
+void q_omg_shallow_free_BinaryPropertySeq(DDS_Security_BinaryPropertySeq *obj);
+
+void q_omg_shallow_copy_PropertyQosPolicy(DDS_Security_PropertyQosPolicy *dst, const dds_property_qospolicy_t *src);
+
+void q_omg_shallow_copy_security_qos(DDS_Security_Qos *dst, const struct dds_qos *src);
+
+void q_omg_shallow_free_PropertyQosPolicy(DDS_Security_PropertyQosPolicy *obj);
+
+void q_omg_shallow_free_security_qos(DDS_Security_Qos *obj);
+
+void q_omg_security_dataholder_copyin(nn_dataholder_t *dh, const DDS_Security_DataHolder *holder);
+
+void q_omg_security_dataholder_copyout(DDS_Security_DataHolder *holder, const nn_dataholder_t *dh);
+
+void q_omg_shallow_copyin_DataHolder(DDS_Security_DataHolder *dst, const nn_dataholder_t *src);
+
+void q_omg_shallow_copyout_DataHolder(nn_dataholder_t *dst, const DDS_Security_DataHolder *src);
+
+void q_omg_shallow_free_DataHolder(DDS_Security_DataHolder *obj);
+
+void q_omg_shallow_free_nn_dataholder(nn_dataholder_t *holder);
+
+void q_omg_shallow_copyin_DataHolderSeq(DDS_Security_DataHolderSeq *dst, const nn_dataholderseq_t *src);
+
+void q_omg_copyin_DataHolderSeq(DDS_Security_DataHolderSeq *dst, const nn_dataholderseq_t *src);
+
+void q_omg_shallow_copyout_DataHolderSeq(nn_dataholderseq_t *dst, const DDS_Security_DataHolderSeq *src);
+
+void q_omg_shallow_free_DataHolderSeq(DDS_Security_DataHolderSeq *obj);
+
+void q_omg_shallow_free_nn_dataholderseq(nn_dataholderseq_t *obj);
+
+void q_omg_shallow_copy_ParticipantBuiltinTopicDataSecure(DDS_Security_ParticipantBuiltinTopicDataSecure *dst, const ddsi_guid_t *guid, const ddsi_plist_t *plist);
+
+void q_omg_shallow_free_ParticipantBuiltinTopicDataSecure(DDS_Security_ParticipantBuiltinTopicDataSecure *obj);
+
+void q_omg_shallow_copy_SubscriptionBuiltinTopicDataSecure(DDS_Security_SubscriptionBuiltinTopicDataSecure *dst, const ddsi_guid_t *guid, const struct dds_qos *qos, const nn_security_info_t *secinfo);
+
+void q_omg_shallow_free_SubscriptionBuiltinTopicDataSecure(DDS_Security_SubscriptionBuiltinTopicDataSecure *obj);
+
+void q_omg_shallow_copy_PublicationBuiltinTopicDataSecure(DDS_Security_PublicationBuiltinTopicDataSecure *dst, const ddsi_guid_t *guid, const struct dds_qos *qos, const nn_security_info_t *secinfo);
+
+void q_omg_shallow_free_PublicationBuiltinTopicDataSecure(DDS_Security_PublicationBuiltinTopicDataSecure *obj);
+
+#if defined (__cplusplus)
+}
+#endif
+
+
+#endif /* DDSI_INCLUDE_SECURITY */
+
+#endif /* DDSI_SECURITY_UTIL_H */
diff --git a/src/core/ddsi/include/dds/ddsi/q_ddsi_discovery.h b/src/core/ddsi/include/dds/ddsi/q_ddsi_discovery.h
index c5c801e..e18dde9 100644
--- a/src/core/ddsi/include/dds/ddsi/q_ddsi_discovery.h
+++ b/src/core/ddsi/include/dds/ddsi/q_ddsi_discovery.h
@@ -25,6 +25,8 @@ struct nn_rsample_info;
 struct nn_rdata;
 struct ddsi_plist;
 
+void get_participant_builtin_topic_data(const struct participant *pp, struct nn_xmsg *mpayload, bool be);
+
 int spdp_write (struct participant *pp);
 int spdp_dispose_unregister (struct participant *pp);
 
diff --git a/src/core/ddsi/include/dds/ddsi/q_entity.h b/src/core/ddsi/include/dds/ddsi/q_entity.h
index 306029b..37b4fff 100644
--- a/src/core/ddsi/include/dds/ddsi/q_entity.h
+++ b/src/core/ddsi/include/dds/ddsi/q_entity.h
@@ -45,6 +45,10 @@ struct whc;
 struct dds_qos;
 struct ddsi_plist;
 struct lease;
+struct participant_sec_attributes;
+struct proxy_participant_sec_attributes;
+struct writer_sec_attributes;
+struct reader_sec_attributes;
 
 struct proxy_group;
 struct proxy_endpoint_common;
@@ -83,6 +87,9 @@ typedef void (*status_cb_t) (void *entity, const status_cb_data_t *data);
 struct prd_wr_match {
   ddsrt_avl_node_t avlnode;
   ddsi_guid_t wr_guid;
+#ifdef DDSI_INCLUDE_SECURITY
+  int64_t crypto_handle;
+#endif
 };
 
 struct rd_pwr_match {
@@ -94,6 +101,9 @@ struct rd_pwr_match {
   nn_locator_t ssm_mc_loc;
   nn_locator_t ssm_src_loc;
 #endif
+#ifdef DDSI_INCLUDE_SECURITY
+  int64_t crypto_handle;
+#endif
 };
 
 struct wr_rd_match {
@@ -128,6 +138,9 @@ struct wr_prd_match {
   nn_wctime_t hb_to_ack_latency_tlastlog;
   uint32_t non_responsive_count;
   uint32_t rexmit_requests;
+#ifdef DDSI_INCLUDE_SECURITY
+  int64_t crypto_handle;
+#endif
 };
 
 enum pwr_rd_match_syncstate {
@@ -156,6 +169,9 @@ struct pwr_rd_match {
       struct nn_reorder *reorder; /* can be done (mostly) per proxy writer, but that is harder; only when state=OUT_OF_SYNC */
     } not_in_sync;
   } u;
+#ifdef DDSI_INCLUDE_SECURITY
+  int64_t crypto_handle;
+#endif
 };
 
 struct nn_rsample_info;
@@ -218,8 +234,6 @@ struct participant
   ddsrt_atomic_voidp_t minl_man; /* lease object for shortest manual-by-participant liveliness writer's lease */
   ddsrt_fibheap_t leaseheap_man; /* keeps leases for this participant's writers (with liveliness manual-by-participant) */
 #ifdef DDSI_INCLUDE_SECURITY
-  int64_t local_identity_handle;   /* OMG DDS Security related member */
-  int64_t permissions_handle; /* OMG DDS Security related member */
   struct participant_sec_attributes *sec_attr;
   nn_security_info_t security_info;
 #endif
@@ -286,6 +300,7 @@ struct writer
   uint32_t whc_low, whc_high; /* watermarks for WHC in bytes (counting only unack'd data) */
   nn_etime_t t_rexmit_end; /* time of last 1->0 transition of "retransmitting" */
   nn_etime_t t_whc_high_upd; /* time "whc_high" was last updated for controlled ramp-up of throughput */
+  uint32_t num_readers; /* total number of matching PROXY readers */
   int32_t num_reliable_readers; /* number of matching reliable PROXY readers */
   ddsrt_avl_tree_t readers; /* all matching PROXY readers, see struct wr_prd_match */
   ddsrt_avl_tree_t local_readers; /* all matching LOCAL readers, see struct wr_rd_match */
@@ -301,6 +316,9 @@ struct writer
   struct xeventq *evq; /* timed event queue to be used by this writer */
   struct local_reader_ary rdary; /* LOCAL readers for fast-pathing; if not fast-pathed, fall back to scanning local_readers */
   struct lease *lease; /* for liveliness administration (writer can only become inactive when using manual liveliness) */
+#ifdef DDSI_INCLUDE_SECURITY
+  struct writer_sec_attributes *sec_attr;
+#endif
 };
 
 inline seqno_t writer_read_seq_xmit (const struct writer *wr) {
@@ -333,10 +351,14 @@ struct reader
   struct addrset *as;
 #endif
   const struct ddsi_sertopic * topic; /* topic is NULL for built-in readers */
+  uint32_t num_writers; /* total number of matching PROXY writers */
   ddsrt_avl_tree_t writers; /* all matching PROXY writers, see struct rd_pwr_match */
   ddsrt_avl_tree_t local_writers; /* all matching LOCAL writers, see struct rd_wr_match */
   ddsi2direct_directread_cb_t ddsi2direct_cb;
   void *ddsi2direct_cbarg;
+#ifdef DDSI_INCLUDE_SECURITY
+  struct reader_sec_attributes *sec_attr;
+#endif
 };
 
 struct proxy_participant
@@ -366,7 +388,6 @@ struct proxy_participant
   unsigned proxypp_have_spdp: 1;
   unsigned owns_lease: 1;
 #ifdef DDSI_INCLUDE_SECURITY
-  int64_t remote_identity_handle;   /* OMG DDS Security related member */
   nn_security_info_t security_info;
   struct proxy_participant_sec_attributes *sec_attr;
 #endif
@@ -435,6 +456,9 @@ struct proxy_writer {
   ddsi2direct_directread_cb_t ddsi2direct_cb;
   void *ddsi2direct_cbarg;
   struct lease *lease;
+#ifdef DDSI_INCLUDE_SECURITY
+  nn_security_info_t security_info;
+#endif
 };
 
 
@@ -450,6 +474,9 @@ struct proxy_reader {
 #endif
   ddsrt_avl_tree_t writers; /* matching LOCAL writers */
   filter_fn_t filter;
+#ifdef DDSI_INCLUDE_SECURITY
+  nn_security_info_t security_info;
+#endif
 };
 
 DDS_EXPORT extern const ddsrt_avl_treedef_t wr_readers_treedef;
@@ -533,8 +560,8 @@ nn_vendorid_t get_entity_vendorid (const struct entity_common *e);
 /**
  * @brief Create a new participant with a given GUID in the domain.
  *
- * @param[in]  ppguid
- *               The GUID of the new participant.
+ * @param[in,out]  ppguid
+ *               The GUID of the new participant, may be adjusted by security.
  * @param[in]  flags
  *               Zero or more of:
  *               - RTPS_PF_NO_BUILTIN_READERS   do not create discovery readers in new ppant
@@ -555,7 +582,7 @@ nn_vendorid_t get_entity_vendorid (const struct entity_common *e);
  * @retval DDS_RETCODE_OUT_OF_RESOURCES
  *               The configured maximum number of participants has been reached.
  */
-dds_return_t new_participant_guid (const ddsi_guid_t *ppguid, struct ddsi_domaingv *gv, unsigned flags, const struct ddsi_plist *plist);
+dds_return_t new_participant_guid (ddsi_guid_t *ppguid, struct ddsi_domaingv *gv, unsigned flags, const struct ddsi_plist *plist);
 
 /**
  * @brief Create a new participant in the domain.  See also new_participant_guid.
@@ -720,8 +747,8 @@ void rebuild_or_clear_writer_addrsets(struct ddsi_domaingv *gv, int rebuild);
 
 void local_reader_ary_setfastpath_ok (struct local_reader_ary *x, bool fastpath_ok);
 
-void connect_writer_with_proxy_reader_secure(struct writer *wr, struct proxy_reader *prd, nn_mtime_t tnow);
-void connect_reader_with_proxy_writer_secure(struct reader *rd, struct proxy_writer *pwr, nn_mtime_t tnow);
+void connect_writer_with_proxy_reader_secure(struct writer *wr, struct proxy_reader *prd, nn_mtime_t tnow, int64_t crypto_handle);
+void connect_reader_with_proxy_writer_secure(struct reader *rd, struct proxy_writer *pwr, nn_mtime_t tnow, int64_t crypto_handle);
 
 
 struct ddsi_writer_info;
diff --git a/src/core/ddsi/include/dds/ddsi/q_misc.h b/src/core/ddsi/include/dds/ddsi/q_misc.h
index 22bb720..98a7457 100644
--- a/src/core/ddsi/include/dds/ddsi/q_misc.h
+++ b/src/core/ddsi/include/dds/ddsi/q_misc.h
@@ -35,6 +35,7 @@ unsigned char normalize_data_datafrag_flags (const SubmessageHeader_t *smhdr);
 int WildcardOverlap(char * p1, char * p2);
 #endif
 
+DDS_EXPORT bool guid_prefix_zero (const ddsi_guid_prefix_t *a);
 DDS_EXPORT int guid_prefix_eq (const ddsi_guid_prefix_t *a, const ddsi_guid_prefix_t *b);
 DDS_EXPORT int guid_eq (const struct ddsi_guid *a, const struct ddsi_guid *b);
 DDS_EXPORT int ddsi2_patmatch (const char *pat, const char *str);
diff --git a/src/core/ddsi/include/dds/ddsi/q_xevent.h b/src/core/ddsi/include/dds/ddsi/q_xevent.h
index a3ba7b5..6542633 100644
--- a/src/core/ddsi/include/dds/ddsi/q_xevent.h
+++ b/src/core/ddsi/include/dds/ddsi/q_xevent.h
@@ -50,8 +50,10 @@ DDS_EXPORT dds_return_t xeventq_start (struct xeventq *evq, const char *name); /
 DDS_EXPORT void xeventq_stop (struct xeventq *evq);
 
 DDS_EXPORT void qxev_msg (struct xeventq *evq, struct nn_xmsg *msg);
+
 DDS_EXPORT void qxev_pwr_entityid (struct proxy_writer * pwr, const ddsi_guid_t *guid);
 DDS_EXPORT void qxev_prd_entityid (struct proxy_reader * prd, const ddsi_guid_t *guid);
+DDS_EXPORT void qxev_nt_callback (struct xeventq *evq, void (*cb) (void *arg), void *arg);
 
 /* Returns 1 if queued, 0 otherwise (no point in returning the
    event, you can't do anything with it anyway) */
diff --git a/src/core/ddsi/include/dds/ddsi/q_xmsg.h b/src/core/ddsi/include/dds/ddsi/q_xmsg.h
index e82a81d..fcd6db1 100644
--- a/src/core/ddsi/include/dds/ddsi/q_xmsg.h
+++ b/src/core/ddsi/include/dds/ddsi/q_xmsg.h
@@ -128,10 +128,12 @@ void nn_xmsg_submsg_setnext (struct nn_xmsg *msg, struct nn_xmsg_marker marker);
 void nn_xmsg_submsg_init (struct nn_xmsg *msg, struct nn_xmsg_marker marker, SubmessageKind_t smkind);
 void nn_xmsg_add_timestamp (struct nn_xmsg *m, nn_wctime_t t);
 void nn_xmsg_add_entityid (struct nn_xmsg * m);
+void *nn_xmsg_addpar_bo (struct nn_xmsg *m, nn_parameterid_t pid, size_t len, bool be);
 void *nn_xmsg_addpar (struct nn_xmsg *m, nn_parameterid_t pid, size_t len);
 void nn_xmsg_addpar_keyhash (struct nn_xmsg *m, const struct ddsi_serdata *serdata, bool force_md5);
 void nn_xmsg_addpar_statusinfo (struct nn_xmsg *m, unsigned statusinfo);
 void nn_xmsg_addpar_sentinel (struct nn_xmsg *m);
+void nn_xmsg_addpar_sentinel_bo (struct nn_xmsg * m, bool be);
 int nn_xmsg_addpar_sentinel_ifparam (struct nn_xmsg *m);
 
 /* XPACK */
diff --git a/src/core/ddsi/src/ddsi_handshake.c b/src/core/ddsi/src/ddsi_handshake.c
index 63de1a0..5d1b967 100644
--- a/src/core/ddsi/src/ddsi_handshake.c
+++ b/src/core/ddsi/src/ddsi_handshake.c
@@ -12,27 +12,76 @@
 
 #include "dds/ddsi/ddsi_handshake.h"
 
+
 #ifdef DDSI_INCLUDE_SECURITY
 
+#include <string.h>
+
+#include "dds/ddsi/q_bswap.h"
+#include "dds/ddsi/ddsi_entity_index.h"
+#include "dds/ddsi/ddsi_plist.h"
+#include "dds/ddsi/q_entity.h"
+#include "dds/security/dds_security_api_types.h"
 #include "dds/security/dds_security_api.h"
-#include "dds/ddsrt/hopscotch.h"
+#include "dds/ddsi/ddsi_security_omg.h"
+#include "dds/security/core/dds_security_fsm.h"
+#include "dds/ddsi/ddsi_security_util.h"
+#include "dds/ddsi/ddsi_security_exchange.h"
+#include "dds/ddsrt/heap.h"
+#include "dds/ddsrt/avl.h"
+
+#define HSTRACE(...)    DDS_CTRACE (&handshake->gv->logconfig, __VA_ARGS__)
+#define HSWARNING(...)  DDS_CLOG (DDS_LC_WARNING, &handshake->gv->logconfig, __VA_ARGS__)
+#define HSERROR(...)    DDS_CLOG (DDS_LC_ERROR, &handshake->gv->logconfig, __VA_ARGS__)
+
+#define HSEXCEPTION(e, ...) \
+  q_omg_log_exception(&handshake->gv->logconfig, DDS_LC_WARNING, e, __FILE__, __LINE__, DDS_FUNCTION, __VA_ARGS__)
+
+
+#define VERBOSE_HANDSHAKE_DEBUG
+
+#if 1
+#define TRACE_FUNC(ptr)
+#else
+#undef TRACE
+#define TRACE(args) nn_trace args
+#define TRACE_FUNC(ptr) printf("[%p] %s\n", ptr, __FUNCTION__);
+#endif
+
+typedef enum {
+    EVENT_AUTO                                  = DDS_SECURITY_FSM_EVENT_AUTO,
+    EVENT_TIMEOUT                               = DDS_SECURITY_FSM_EVENT_TIMEOUT,
+    EVENT_VALIDATION_OK                         = DDS_SECURITY_VALIDATION_OK,
+    EVENT_VALIDATION_FAILED                     = DDS_SECURITY_VALIDATION_FAILED,
+    EVENT_VALIDATION_PENDING_RETRY              = DDS_SECURITY_VALIDATION_PENDING_RETRY,
+    EVENT_VALIDATION_PENDING_HANDSHAKE_REQUEST  = DDS_SECURITY_VALIDATION_PENDING_HANDSHAKE_REQUEST,
+    EVENT_VALIDATION_PENDING_HANDSHAKE_MESSAGE  = DDS_SECURITY_VALIDATION_PENDING_HANDSHAKE_MESSAGE,
+    EVENT_VALIDATION_OK_FINAL_MESSAGE           = DDS_SECURITY_VALIDATION_OK_FINAL_MESSAGE,
+    EVENT_RECEIVED_MESSAGE_REQUEST              = 100,
+    EVENT_RECEIVED_MESSAGE_REPLY                = 101,
+    EVENT_RECEIVED_MESSAGE_FINAL                = 102,
+    EVENT_SEND_CRYPTO_TOKENS                    = 103,
+    EVENT_RECV_CRYPTO_TOKENS                    = 104
+} handshake_event_t;
+
+struct handshake_entities {
+  ddsi_guid_t lguid;
+  ddsi_guid_t rguid;
+};
 
 struct ddsi_handshake
 {
+  ddsrt_avl_node_t avlnode;
   enum ddsi_handshake_state state;
-
-  ddsi_guid_t local_pguid;  /* the guid of the local participant */
-  ddsi_guid_t remote_pguid; /* the guid of the remote participant */
-  ddsi_handshake_end_cb_t end_cb;
-  struct ddsi_domaingv *gv;
-  ddsrt_mutex_t lock;
-  ddsrt_cond_t cv;
-
-  ddsrt_atomic_uint32_t refc;
-
-  DDS_Security_IdentityHandle local_identity_handle;
-  DDS_Security_IdentityHandle remote_identity_handle;
+  struct handshake_entities participants;
   DDS_Security_HandshakeHandle handshake_handle;
+  ddsrt_atomic_uint32_t refc;
+  ddsrt_atomic_uint32_t deleting;
+  ddsi_handshake_end_cb_t end_cb;
+  ddsrt_mutex_t lock;
+  struct dds_security_fsm *fsm;
+  const struct ddsi_domaingv *gv;
+  dds_security_authentication *auth;
 
   DDS_Security_HandshakeMessageToken handshake_message_in_token;
   nn_message_identity_t handshake_message_in_id;
@@ -40,58 +89,1121 @@ struct ddsi_handshake
   DDS_Security_AuthRequestMessageToken local_auth_request_token;
   DDS_Security_AuthRequestMessageToken *remote_auth_request_token;
   DDS_Security_OctetSeq pdata;
-  DDS_Security_SharedSecretHandle shared_secret;
+  int64_t shared_secret;
   int handled_handshake_message;
 };
 
+struct ddsi_hsadmin {
+  ddsrt_mutex_t lock;
+  ddsrt_avl_tree_t handshakes;
+  struct dds_security_fsm_control *fsm_control;
+};
+
+static int compare_handshake(const void *va, const void *vb);
+
+const ddsrt_avl_treedef_t handshake_treedef =
+  DDSRT_AVL_TREEDEF_INITIALIZER (offsetof (struct ddsi_handshake, avlnode), offsetof (struct ddsi_handshake, participants), compare_handshake, 0);
+
+static int compare_handshake(const void *va, const void *vb)
+{
+  const struct handshake_entities *ha = va;
+  const struct handshake_entities *hb = vb;
+  int r;
+
+  r = memcmp(&ha->rguid, &hb->rguid, sizeof(ha->rguid));
+  if (r == 0)
+    r = memcmp(&ha->lguid, &hb->lguid, sizeof(ha->lguid));
+  return r;
+}
+
+static bool validate_handshake(struct ddsi_handshake *handshake, struct participant **pp, struct proxy_participant **proxypp)
+{
+  if (ddsrt_atomic_ld32(&handshake->deleting) > 0)
+    return false;
+
+  if (pp)
+  {
+    if ((*pp = entidx_lookup_participant_guid(handshake->gv->entity_index, &handshake->participants.lguid)) == NULL)
+      return false;
+  }
+
+  if (proxypp)
+  {
+    if ((*proxypp = entidx_lookup_proxy_participant_guid(handshake->gv->entity_index, &handshake->participants.rguid)) == NULL)
+      return false;
+  }
+  return true;
+}
+
+
+#define RETRY_TIMEOUT           DDS_SECS(1)
+#define RESEND_TIMEOUT          DDS_SECS(1)
+#define SEND_TOKENS_TIMEOUT     DDS_MSECS(100)
+#define AUTHENTICATION_TIMEOUT  DDS_SECS(100)
+
+static void func_validate_remote_identity     (struct dds_security_fsm *fsm, void *arg);
+static void func_handshake_init_message_resend(struct dds_security_fsm *fsm, void *arg);
+static void func_begin_handshake_reply        (struct dds_security_fsm *fsm, void *arg);
+static void func_begin_handshake_request      (struct dds_security_fsm *fsm, void *arg);
+static void func_process_handshake            (struct dds_security_fsm *fsm, void *arg);
+static void func_handshake_message_resend     (struct dds_security_fsm *fsm, void *arg);
+static void func_validation_ok                (struct dds_security_fsm *fsm, void *arg);
+static void func_validation_failed            (struct dds_security_fsm *fsm, void *arg);
+static void func_send_crypto_tokens_final     (struct dds_security_fsm *fsm, void *arg);
+static void func_send_crypto_tokens           (struct dds_security_fsm *fsm, void *arg);
+
+static dds_security_fsm_state state_validate_remote_identity            = { func_validate_remote_identity,         0 };
+static dds_security_fsm_state state_validate_remote_identity_retry_wait = { NULL,                      RETRY_TIMEOUT };
+static dds_security_fsm_state state_handshake_init_message_resend       = { func_handshake_init_message_resend,    0 };
+static dds_security_fsm_state state_handshake_init_message_wait         = { NULL,                     RESEND_TIMEOUT };
+static dds_security_fsm_state state_begin_handshake_reply               = { func_begin_handshake_reply,            0 };
+static dds_security_fsm_state state_begin_handshake_reply_retry_wait    = { NULL,                      RETRY_TIMEOUT };
+static dds_security_fsm_state state_begin_handshake_request             = { func_begin_handshake_request,          0 };
+static dds_security_fsm_state state_begin_handshake_request_retry_wait  = { NULL,                      RETRY_TIMEOUT };
+static dds_security_fsm_state state_process_handshake                   = { func_process_handshake,                0 };
+static dds_security_fsm_state state_process_handshake_retry_wait        = { NULL,                      RETRY_TIMEOUT };
+static dds_security_fsm_state state_handshake_message_resend            = { func_handshake_message_resend,         0 };
+static dds_security_fsm_state state_handshake_message_wait              = { NULL,                     RESEND_TIMEOUT };
+static dds_security_fsm_state state_validation_ok                       = { func_validation_ok,                    0 };
+static dds_security_fsm_state state_validation_failed                   = { func_validation_failed,                0 };
+static dds_security_fsm_state state_send_crypto_tokens_final_wait       = { NULL,                SEND_TOKENS_TIMEOUT };
+static dds_security_fsm_state state_send_crypto_tokens_wait             = { NULL,                SEND_TOKENS_TIMEOUT };
+static dds_security_fsm_state state_send_crypto_tokens_final            = { func_send_crypto_tokens_final,         0 };
+static dds_security_fsm_state state_send_crypto_tokens                  = { func_send_crypto_tokens,               0 };
+static dds_security_fsm_state state_wait_crypto_tokens                  = { NULL,                                  0 };
+static dds_security_fsm_state state_handshake_final_resend              = { func_handshake_message_resend,         0 };
+
+#ifdef VERBOSE_HANDSHAKE_DEBUG
+static void q_handshake_fsm_debug(
+    struct dds_security_fsm *fsm,
+    DDS_SECURITY_FSM_DEBUG_ACT act,
+    const dds_security_fsm_state *current,
+    int event_id,
+    void *arg)
+{
+  struct ddsi_handshake *handshake = arg;
+  char *dispatch;
+  char *state;
+  char *event;
+
+  assert(handshake);
+  DDSRT_UNUSED_ARG(fsm);
+
+
+  if      (current == NULL)                                        state = "NULL";
+  else if (current == &state_validate_remote_identity)             state = "state_validate_remote_identity";
+  else if (current == &state_validate_remote_identity_retry_wait)  state = "state_validate_remote_identity_retry_wait";
+  else if (current == &state_handshake_init_message_resend)        state = "state_handshake_init_message_resend";
+  else if (current == &state_handshake_init_message_wait)          state = "state_handshake_init_message_wait";
+  else if (current == &state_begin_handshake_reply)                state = "state_begin_handshake_reply";
+  else if (current == &state_begin_handshake_reply_retry_wait)     state = "state_begin_handshake_reply_retry_wait";
+  else if (current == &state_begin_handshake_request)              state = "state_begin_handshake_request";
+  else if (current == &state_begin_handshake_request_retry_wait)   state = "state_begin_handshake_request_retry_wait";
+  else if (current == &state_process_handshake)                    state = "state_process_handshake";
+  else if (current == &state_process_handshake_retry_wait)         state = "state_process_handshake_retry_wait";
+  else if (current == &state_handshake_message_resend)             state = "state_handshake_message_resend";
+  else if (current == &state_handshake_message_wait)               state = "state_handshake_message_wait";
+  else if (current == &state_validation_ok)                        state = "state_validation_ok";
+  else if (current == &state_validation_failed)                    state = "state_validation_failed";
+  else if (current == &state_send_crypto_tokens_final_wait)        state = "state_send_crypto_tokens_final_wait";
+  else if (current == &state_send_crypto_tokens_wait)              state = "state_send_crypto_tokens_wait";
+  else if (current == &state_send_crypto_tokens_final)             state = "state_send_crypto_tokens_final";
+  else if (current == &state_send_crypto_tokens)                   state = "state_send_crypto_tokens";
+  else if (current == &state_wait_crypto_tokens)                   state = "state_wait_crypto_tokens";
+  else if (current == &state_handshake_final_resend)               state = "state_handshake_final_resend";
+  else                                                             state = "else????";
+
+  if      (event_id == EVENT_AUTO)                                 event = "EVENT_AUTO";
+  else if (event_id == EVENT_TIMEOUT)                              event = "EVENT_TIMEOUT";
+  else if (event_id == EVENT_VALIDATION_OK)                        event = "EVENT_VALIDATION_OK";
+  else if (event_id == EVENT_VALIDATION_FAILED)                    event = "EVENT_VALIDATION_FAILED";
+  else if (event_id == EVENT_VALIDATION_PENDING_RETRY)             event = "EVENT_VALIDATION_PENDING_RETRY";
+  else if (event_id == EVENT_VALIDATION_PENDING_HANDSHAKE_REQUEST) event = "EVENT_VALIDATION_PENDING_HANDSHAKE_REQUEST";
+  else if (event_id == EVENT_VALIDATION_PENDING_HANDSHAKE_MESSAGE) event = "EVENT_VALIDATION_PENDING_HANDSHAKE_MESSAGE";
+  else if (event_id == EVENT_VALIDATION_OK_FINAL_MESSAGE)          event = "EVENT_VALIDATION_OK_FINAL_MESSAGE";
+  else if (event_id == EVENT_RECEIVED_MESSAGE_REQUEST)             event = "EVENT_RECEIVED_MESSAGE_REQUEST";
+  else if (event_id == EVENT_RECEIVED_MESSAGE_REPLY)               event = "EVENT_RECEIVED_MESSAGE_REPLY";
+  else if (event_id == EVENT_RECEIVED_MESSAGE_FINAL)               event = "EVENT_RECEIVED_MESSAGE_FINAL";
+  else if (event_id == EVENT_SEND_CRYPTO_TOKENS)                   event = "EVENT_SEND_CRYPTO_TOKENS";
+  else if (event_id == EVENT_RECV_CRYPTO_TOKENS)                   event = "EVENT_RECV_CRYPTO_TOKENS";
+  else                                                             event = "";
+
+  if      (act == DDS_SECURITY_FSM_DEBUG_ACT_DISPATCH)             dispatch = "dispatching";
+  else if (act == DDS_SECURITY_FSM_DEBUG_ACT_DISPATCH_DIRECT)      dispatch = "direct_dispatching";
+  else if (act == DDS_SECURITY_FSM_DEBUG_ACT_HANDLING)             dispatch = "handling";
+  else                                                             dispatch = "";
+
+  HSTRACE ("FSM: handshake_debug (lguid="PGUIDFMT" rguid="PGUIDFMT") act=%s, state=%s, event=%s\n",
+      PGUID (handshake->participants.lguid),
+      PGUID (handshake->participants.rguid),
+      dispatch,
+      state,
+      event);
+
+}
+#endif
+
+
+/************************************************************************************************************
+ Inspiration from https://confluence.prismtech.com/display/VC/Authentication?preview=/30379826/34340895/PT_StateMachine_3g.gif
+
+                            [START]
+                               |
+                               v
+               .---------------------------------.
+               | state_validate_remote_identity  |
+  .------------|---------------------------------|----------.--------------------.
+  |            | func_validate_remote_identity() |          |                    |
+  |            '---------------------------------'          |  VALIDATION_PENDING_HANDSHAKE_MESSAGE
+VALIDATION_FAILED             ^  | VALIDATION_PENDING_RETRY |                    |
+VALIDATION_OK                 |  |                          |                    |
+  |                   TIMEOUT |  v                          |                    v
+  |       .-------------------------------------------.     |  .-----------------------------------.
+  |       | state_validate_remote_identity_retry_wait |     |  | state_handshake_init_message_wait |<---------------.
+  |       |-------------------------------------------|     |  |-----------------------------------|           AUTO |
+  |       | retry_timeout                             |     |  | resend_timeout                    |---------.      |
+  |       '-------------------------------------------'     |  '-----------------------------------' TIMEOUT |      |
+  |                                                         |                    |                           |      |
+  |                     .-----------------------------------'                    |                           |      |
+  |                     |      VALIDATION_PENDING_HANDSHAKE_REQUEST              |                           v      |
+  |                     |                                                        |       .--------------------------------------.
+  |                     v                                      RECEIVED_MESSAGE_REQUEST  | state_handshake_init_message_resend  |
+  |    .--------------------------------.                                        |       |--------------------------------------|
+  |    | state_begin_handshake_request  | VALIDATION_PENDING_RETRY               |       | func_handshake_init_message_resend() |
+  |    |--------------------------------|------------.                           |       '--------------------------------------'
+  |    | func_begin_handshake_request() |            |                           |                           ^
+  |    '--------------------------------'            |                           |                           |
+  |        |            |        ^                   |                           |                           |
+  |        |            |        | TIMEOUT           v                           |                           |
+  | VALIDATION_FAILED   |      .------------------------------------------.      |                           |
+  | VALIDATION_OK       |      | state_begin_handshake_request_retry_wait |      |                           |
+  |        |            |      |------------------------------------------|      |                           |
+  |--------'            |      | retry_timeout                            |      |                           |
+  |                     |      '------------------------------------------'      |                           |
+  |                     |                                                        v                  VALIDATION_FAILED
+  |                     |                                        .------------------------------.            |
+  |   VALIDATION_PENDING_HANDSHAKE_MESSAGE                       | state_begin_handshake_reply  |------------'
+  |                     |                                .-------|------------------------------|
+  |                     |                                |       | func_begin_handshake_reply() |------------.
+  |                     |                                |       '------------------------------'            |
+  |                     |                                |       VALIDATION_OK |              ^     VALIDATION_PENDING_RETRY
+  |                     |                                |                     |              |              |
+  |                     |     VALIDATION_PENDING_HANDSHAKE_MESSAGE             v              | TIMEOUT      |
+  |                     |                                |         goto state_validation_ok   |              |
+  |                     |                                v                                    |              v
+  |                     |                .------------------------------.            .------------------------------------------.
+  |                     |                | state_handshake_message_wait |            | state_begin_handshake_reply_retry_wait   |
+  |                     .--------------->|------------------------------|-------.    |------------------------------------------|
+  |                     |                | resend_timeout               |       |    | retry_timeout                            |
+  |                     |                '------------------------------'       |    '------------------------------------------'
+  |                     | AUTO                           |          ^           |
+  |                     |                        TIMEOUT |          |           |
+  |    .---------------------------------.               |          |           | RECEIVED_MESSAGE_REPLY
+  |    | state_handshake_message_resend  |               |  VALIDATION_FAILED   | RECEIVED_MESSAGE_FINAL
+  |    |---------------------------------|<--------------'          |           |
+  |    | func_handshake_message_resend() |                          |           v
+  |    '---------------------------------'                        .--------------------------.
+  |                                                               | state_process_handshake  |
+  |                              .--------------------------------|--------------------------|--------------------------.
+  |                              |            .------------------>| func_process_handshake() |                          |
+  |                              |            |                   '--------------------------'                          |
+  |                              |            |                                 |                                       |
+  |          VALIDATION_PENDING_RETRY      TIMEOUT                VALIDATION_OK |                                       |
+  |                              v            |                                 v                                       |
+  |           .------------------------------------.            .-------------------------------.                       |
+  |           | state_process_handshake_retry_wait |            | state_send_crypto_tokens_wait |                       |
+  |           |------------------------------------|            |-------------------------------|                       |
+  |           | retry_timeout                      |            | send_tokens_timeout           |                       |
+  |           '------------------------------------'            '-------------------------------'                       |
+  |                                                                     |              |              VALIDATION_OK_FINAL_MESSAGE
+  |                                                       .-------------'              '---------.                      |
+  |                                                       | RECV_CRYPTO_TOKENS           TIMEOUT |                      |
+  |                                                       v                                      v                      |
+  |                                      .---------------------------------.       .---------------------------.        |
+  |                                      | state_send_crypto_tokens_final  |       | state_send_crypto_tokens  |        |
+  |                       .--------------|---------------------------------|       |---------------------------|        |
+  |                       |              | func_send_crypto_tokens_final() |       | func_send_crypto_tokens() |        |
+  |                       |              '---------------------------------'       '---------------------------'        |
+  |                       |                               ^                                      |                      |
+  |                   VALIDATION_OK                       |       .--------------------.   VALIDATION_OK_FINAL_MESSAGE  |
+  |                       |                       TIMEOUT |       | RECV_CRYPTO_TOKENS |         |                      |
+  |                       |                               |       v                    |         v                      |
+  |                       |            .-------------------------------------.     .--------------------------.         |
+  |                       |            | state_send_crypto_tokens_final_wait |     | state_wait_crypto_tokens |<--------'
+  |                       |            |-------------------------------------|     |--------------------------|
+  |                       |            | send_tokens_timeout                 |     |                          |---------.
+  |                       |            '-------------------------------------'     '--------------------------'         |
+  |                       |                               ^                              |               ^              |
+  |                       |                               |                  RECEIVED_MESSAGE_REPLY     AUTO      VALIDATION_OK
+  |                       |                      RECV_CRYPTO_TOKENS                      v               |              |
+  |                       |                               |                     .---------------------------------.     |
+  |                       |                               |                     |  state_handshake_final_resend   |     |
+  |                       |                               '---------------------|---------------------------------|     |
+  | VALIDATION_OK         |                                                     | func_handshake_message_resend() |     |
+  |---------------------------------------------------------.                   '---------------------------------'     |
+  |                                                         |                                                           |
+  '---------------.                                         |                                                           |
+VALIDATION_FAILED |                                         |                                                           |
+                  v                                         v                                                           |
+            .--------------------------.               .----------------------.                                         |
+            | state_validation_failed  |               | state_validation_ok  |                                         |
+            |--------------------------|               |----------------------|<----------------------------------------'
+            | func_validation_failed() |               | func_validation_ok() |
+            '--------------------------'               '----------------------'
+                          |                                       |
+                          v                                       v
+                        [END]                                   [END]
+
+
+ .----------------------------------------.
+ | state_begin_handshake_reply_retry_wait |
+ |----------------------------------------|
+ | retry_timeout                          |
+ '----------------------------------------'
+
+
+*************************************************************************************************************/
+static const dds_security_fsm_transition handshake_transistions [] =
+{   /* Start */
+    { NULL,                                 EVENT_AUTO,                                 NULL,
+                                            &state_validate_remote_identity                },
+    /* validate remote identity */
+    { &state_validate_remote_identity,      EVENT_VALIDATION_PENDING_RETRY,             NULL,
+                                            &state_validate_remote_identity_retry_wait     },
+    { &state_validate_remote_identity,      EVENT_VALIDATION_FAILED,                    NULL,
+                                            &state_validation_failed                       },
+    { &state_validate_remote_identity,      EVENT_VALIDATION_PENDING_HANDSHAKE_REQUEST, NULL,
+                                            &state_begin_handshake_request                 },
+    { &state_validate_remote_identity,      EVENT_VALIDATION_OK,                        NULL,
+                                            &state_validation_ok                           },
+    { &state_validate_remote_identity,      EVENT_VALIDATION_PENDING_HANDSHAKE_MESSAGE, NULL,
+                                            &state_handshake_init_message_wait             },
+    /* ValRemIdentityRetryWait */
+    { &state_validate_remote_identity_retry_wait, EVENT_TIMEOUT,                        NULL,
+                                            &state_validate_remote_identity                },
+    /* HandshakeInitMessageWait */
+    { &state_handshake_init_message_wait,   EVENT_TIMEOUT,                              NULL,
+                                            &state_handshake_init_message_resend           },
+    { &state_handshake_init_message_wait,   EVENT_RECEIVED_MESSAGE_REQUEST,             NULL,
+                                            &state_begin_handshake_reply                   },
+    /* resend message */
+    { &state_handshake_init_message_resend, EVENT_AUTO,                                 NULL,
+                                            &state_handshake_init_message_wait             },
+    /* begin handshake reply */
+    { &state_begin_handshake_reply,         EVENT_VALIDATION_PENDING_RETRY,             NULL,
+                                            &state_begin_handshake_reply_retry_wait        },
+    { &state_begin_handshake_reply,         EVENT_VALIDATION_FAILED,                    NULL,
+                                            &state_handshake_init_message_resend           },
+    { &state_begin_handshake_reply,         EVENT_VALIDATION_PENDING_HANDSHAKE_MESSAGE, NULL,
+                                            &state_handshake_message_wait                  },
+    { &state_begin_handshake_reply,         EVENT_VALIDATION_OK,                        NULL,
+                                            &state_validation_ok                           },
+    /* BeginHsRepRetryWait */
+    { &state_begin_handshake_reply_retry_wait, EVENT_TIMEOUT,                           NULL,
+                                            &state_begin_handshake_reply                   },
+    /* begin handshake request */
+    { &state_begin_handshake_request,       EVENT_VALIDATION_PENDING_RETRY,             NULL,
+                                            &state_begin_handshake_request_retry_wait      },
+    { &state_begin_handshake_request,       EVENT_VALIDATION_FAILED,                    NULL,
+                                            &state_validation_failed                       },
+    { &state_begin_handshake_request,       EVENT_VALIDATION_PENDING_HANDSHAKE_MESSAGE, NULL,
+                                            &state_handshake_message_wait                  },
+    { &state_begin_handshake_request,       EVENT_VALIDATION_OK,                        NULL,
+                                            &state_validation_ok                           },
+    /* BeginHsReqRetryWait */
+    { &state_begin_handshake_request_retry_wait, EVENT_TIMEOUT,                         NULL,
+                                            &state_begin_handshake_request                 },
+    /* HandshakeMessageWait */
+    { &state_handshake_message_wait,        EVENT_TIMEOUT,                              NULL,
+                                            &state_handshake_message_resend                },
+    { &state_handshake_message_wait,        EVENT_RECEIVED_MESSAGE_REPLY,               NULL,
+                                            &state_process_handshake                       },
+    { &state_handshake_message_wait,        EVENT_RECEIVED_MESSAGE_FINAL,               NULL,
+                                            &state_process_handshake                       },
+    /* resend message */
+    { &state_handshake_message_resend,      EVENT_AUTO,                                 NULL,
+                                            &state_handshake_message_wait                  },
+    /* process handshake */
+    { &state_process_handshake,             EVENT_VALIDATION_PENDING_RETRY,             NULL,
+                                            &state_process_handshake_retry_wait            },
+    { &state_process_handshake,             EVENT_VALIDATION_FAILED,                    NULL,
+                                            &state_handshake_message_wait                  },
+    { &state_process_handshake,             EVENT_VALIDATION_OK,                        NULL,
+                                            &state_send_crypto_tokens_wait                 },
+    { &state_process_handshake,             EVENT_VALIDATION_OK_FINAL_MESSAGE,          NULL,
+                                            &state_wait_crypto_tokens                      },
+    /* ProcessHsRetryWait */
+    { &state_process_handshake_retry_wait,  EVENT_TIMEOUT,                              NULL,
+                                            &state_process_handshake                       },
+
+    { &state_send_crypto_tokens_wait,       EVENT_TIMEOUT,                              NULL,
+                                            &state_send_crypto_tokens                      },
+    { &state_send_crypto_tokens_wait,       EVENT_RECV_CRYPTO_TOKENS,                   NULL,
+                                            &state_send_crypto_tokens_final                },
+
+    { &state_send_crypto_tokens_final_wait, EVENT_TIMEOUT,                              NULL,
+                                            &state_send_crypto_tokens_final                },
+
+    /* Process_handshake returned VALIDATION_OK_FINAL_MESSAGE notify user and wait for tokens */
+    { &state_send_crypto_tokens,            EVENT_VALIDATION_OK_FINAL_MESSAGE,          NULL,
+                                            &state_wait_crypto_tokens                      },
+    /* Process_handshake returned VALIDATION_OK notify user and goto ready state */
+    { &state_send_crypto_tokens_final,      EVENT_VALIDATION_OK,                        NULL,
+                                            &state_validation_ok                           },
+
+    { &state_handshake_final_resend,        EVENT_AUTO,                                 NULL,
+                                            &state_wait_crypto_tokens                      },
+
+    { &state_handshake_final_resend,        EVENT_RECV_CRYPTO_TOKENS,                   NULL,
+                                            &state_send_crypto_tokens_final_wait           },
+
+    { &state_wait_crypto_tokens,            EVENT_RECV_CRYPTO_TOKENS,                   NULL,
+                                            &state_send_crypto_tokens_final_wait           },
+
+    { &state_wait_crypto_tokens,            EVENT_VALIDATION_OK,                        NULL,
+                                            &state_validation_ok                           },
+
+    { &state_wait_crypto_tokens,            EVENT_RECEIVED_MESSAGE_REPLY,               NULL,
+                                            &state_handshake_final_resend                  },
+
+    /* End */
+    { &state_validation_ok,                 EVENT_AUTO,                                 NULL,
+                                            NULL                                           },
+    { &state_validation_failed,             EVENT_AUTO,                                 NULL,
+                                            NULL                                           },
+};
+
+
+
+static bool send_handshake_message(const struct ddsi_handshake *handshake, DDS_Security_DataHolder *token, struct participant *pp, struct proxy_participant *proxypp, int request)
+{
+  bool ret = false;
+  nn_dataholderseq_t mdata;
+  DDS_Security_DataHolderSeq tseq;
+
+  tseq._length = tseq._maximum = 1;
+  tseq._buffer = token;
+
+  q_omg_shallow_copyout_DataHolderSeq(&mdata, &tseq);
+
+  if (!(ret = write_auth_handshake_message(pp, proxypp, &mdata, request, &handshake->handshake_message_in_id)))
+  {
+    HSWARNING("Send handshake: failed to send message (lguid="PGUIDFMT" rguid="PGUIDFMT")", PGUID (pp->e.guid), PGUID (proxypp->e.guid));
+  }
+
+  q_omg_shallow_free_nn_dataholderseq(&mdata);
+
+  return ret;
+}
+
+static void func_validate_remote_identity(struct dds_security_fsm *fsm, void *arg)
+{
+  DDS_Security_ValidationResult_t ret;
+  DDS_Security_SecurityException exception = {0};
+  struct ddsi_handshake *handshake = (struct ddsi_handshake*)arg;
+  dds_security_authentication *auth = handshake->auth;
+  struct participant *pp;
+  struct proxy_participant *proxypp;
+  DDS_Security_IdentityToken remote_identity_token;
+  int64_t remote_identity_handle;
+  ddsi_guid_t remote_guid;
+
+  if (!validate_handshake(handshake, &pp, &proxypp))
+    return;
+
+  TRACE_FUNC(fsm);
+
+  if (!(proxypp->plist->present & PP_IDENTITY_TOKEN))
+  {
+    HSERROR("validate remote identity failed: remote participant ("PGUIDFMT") identity token missing", PGUID (proxypp->e.guid));
+    ret = DDS_SECURITY_VALIDATION_FAILED;
+    goto ident_token_missing;
+  }
+
+  remote_guid = nn_hton_guid(proxypp->e.guid);
+  q_omg_security_dataholder_copyout(&remote_identity_token, &proxypp->plist->identity_token);
+
+  ddsrt_mutex_lock(&handshake->lock);
+  ret = auth->validate_remote_identity(
+      auth, &remote_identity_handle, &handshake->local_auth_request_token, handshake->remote_auth_request_token,
+      pp->sec_attr->local_identity_handle, &remote_identity_token, (DDS_Security_GUID_t *)&remote_guid, &exception);
+  ddsrt_mutex_unlock(&handshake->lock);
+
+  /* Trace a failed handshake. */
+  if ((ret != DDS_SECURITY_VALIDATION_OK                       ) &&
+      (ret != DDS_SECURITY_VALIDATION_PENDING_RETRY            ) &&
+      (ret != DDS_SECURITY_VALIDATION_PENDING_HANDSHAKE_REQUEST) &&
+      (ret != DDS_SECURITY_VALIDATION_PENDING_HANDSHAKE_MESSAGE))
+  {
+    HSEXCEPTION(&exception, "Validate remote identity failed");
+    ret = DDS_SECURITY_VALIDATION_FAILED;
+    goto validation_failed;
+  }
+
+  HSTRACE("FSM: validate_remote_identity (lguid="PGUIDFMT" rguid="PGUIDFMT") ret=%d\n", PGUID (pp->e.guid), PGUID (proxypp->e.guid), ret);
+
+  assert(proxypp->sec_attr->remote_identity_handle == 0 || proxypp->sec_attr->remote_identity_handle == remote_identity_handle);
+  proxypp->sec_attr->remote_identity_handle = remote_identity_handle;
+
+  DDS_Security_DataHolder_deinit(&remote_identity_token);
+
+  /* When validate_remote_identity returns a local_auth_request_token
+   * which does not equal TOKEN_NIL then an AUTH_REQUEST message has
+   * to be send.
+   */
+  if (handshake->local_auth_request_token.class_id && strlen(handshake->local_auth_request_token.class_id) != 0)
+    (void)send_handshake_message(handshake, &handshake->local_auth_request_token, pp, proxypp, 1);
+
+validation_failed:
+ident_token_missing:
+  /* Use return value as state machine event. */
+  dds_security_fsm_dispatch(fsm, (int32_t)ret, true);
+}
+
+static void func_handshake_init_message_resend(struct dds_security_fsm *fsm, void *arg)
+{
+  struct ddsi_handshake *handshake = arg;
+  struct participant *pp;
+  struct proxy_participant *proxypp;
+
+  DDSRT_UNUSED_ARG(fsm);
+
+  if (!validate_handshake(handshake, &pp, &proxypp))
+    return;
+
+  TRACE_FUNC(fsm);
+
+  HSTRACE("FSM: handshake init_message_resend (lguid="PGUIDFMT" rguid="PGUIDFMT")\n", PGUID(pp->e.guid), PGUID(proxypp->e.guid));
+
+  if (strlen(handshake->local_auth_request_token.class_id) != 0)
+    (void)send_handshake_message(handshake, &handshake->local_auth_request_token, pp, proxypp, 1);
+}
+
+static void func_begin_handshake_reply(struct dds_security_fsm *fsm, void *arg)
+{
+  DDS_Security_ValidationResult_t ret;
+  DDS_Security_SecurityException exception = {0};
+  struct ddsi_handshake *handshake = arg;
+  dds_security_authentication *auth = handshake->auth;
+  struct participant *pp;
+  struct proxy_participant *proxypp;
+
+  if (!validate_handshake(handshake, &pp, &proxypp))
+     return;
+
+  TRACE_FUNC(fsm);
+
+  ddsrt_mutex_lock(&handshake->lock);
+
+  if (handshake->handshake_message_out)
+    DDS_Security_DataHolder_free(handshake->handshake_message_out);
+  handshake->handshake_message_out = DDS_Security_DataHolder_alloc();
+
+  ret = auth->begin_handshake_reply(
+      auth, &(handshake->handshake_handle), handshake->handshake_message_out, &handshake->handshake_message_in_token,
+      proxypp->sec_attr->remote_identity_handle, pp->sec_attr->local_identity_handle, &handshake->pdata, &exception);
+
+  ddsrt_mutex_unlock(&handshake->lock);
+
+  HSTRACE("FSM: begin_handshake_reply (lguid="PGUIDFMT" rguid="PGUIDFMT") ret=%d\n", PGUID (pp->e.guid), PGUID (proxypp->e.guid), ret);
+
+  /* Trace a failed handshake. */
+  if ((ret != DDS_SECURITY_VALIDATION_OK                       ) &&
+      (ret != DDS_SECURITY_VALIDATION_OK_FINAL_MESSAGE         ) &&
+      (ret != DDS_SECURITY_VALIDATION_PENDING_RETRY            ) &&
+      (ret != DDS_SECURITY_VALIDATION_PENDING_HANDSHAKE_MESSAGE))
+  {
+    HSEXCEPTION(&exception, "Begin handshake reply failed");
+    ret = DDS_SECURITY_VALIDATION_FAILED;
+    goto handshake_failed;
+  }
+
+  if (ret == DDS_SECURITY_VALIDATION_PENDING_HANDSHAKE_MESSAGE) {
+    if (!send_handshake_message(handshake, handshake->handshake_message_out, pp, proxypp, 0)) {
+      ret = DDS_SECURITY_VALIDATION_FAILED;
+      goto handshake_failed;
+    }
+  }
+  else if (ret == DDS_SECURITY_VALIDATION_OK_FINAL_MESSAGE)
+  {
+    if (send_handshake_message(handshake, handshake->handshake_message_out, pp, proxypp, 0))
+      ret = DDS_SECURITY_VALIDATION_OK;
+    else
+    {
+      ret = DDS_SECURITY_VALIDATION_FAILED;
+      goto handshake_failed;
+    }
+  }
+
+  if (ret == DDS_SECURITY_VALIDATION_OK)
+  {
+    handshake->shared_secret = auth->get_shared_secret(auth, handshake->handshake_handle, &exception);
+    if (handshake->shared_secret == DDS_SECURITY_HANDLE_NIL)
+    {
+      HSEXCEPTION(&exception, "Getting shared secret failed");
+      ret = DDS_SECURITY_VALIDATION_FAILED;
+      goto handshake_failed;
+    }
+  }
+
+  dds_security_fsm_dispatch(fsm, (int32_t)ret, true);
+  return;
+
+handshake_failed:
+  DDS_Security_DataHolder_free(handshake->handshake_message_out);
+  handshake->handshake_message_out = NULL;
+  /* Use return value as state machine event. */
+  dds_security_fsm_dispatch(fsm, (int32_t)ret, true);
+}
+
+static void func_begin_handshake_request(struct dds_security_fsm *fsm, void *arg)
+{
+  DDS_Security_ValidationResult_t ret;
+  DDS_Security_SecurityException exception = {0};
+  struct ddsi_handshake *handshake = arg;
+  dds_security_authentication *auth = handshake->auth;
+  struct participant *pp;
+  struct proxy_participant *proxypp;
+
+  if (!validate_handshake(handshake, &pp, &proxypp))
+    return;
+
+  TRACE_FUNC(fsm);
+
+  ddsrt_mutex_lock(&handshake->lock);
+
+  if (handshake->handshake_message_out)
+    DDS_Security_DataHolder_free(handshake->handshake_message_out);
+  handshake->handshake_message_out = DDS_Security_DataHolder_alloc();
+
+  ret = auth->begin_handshake_request(auth, &(handshake->handshake_handle), handshake->handshake_message_out, pp->sec_attr->local_identity_handle, proxypp->sec_attr->remote_identity_handle, &handshake->pdata, &exception);
+  ddsrt_mutex_unlock(&handshake->lock);
+
+  HSTRACE("FSM: begin_handshake_request (lguid="PGUIDFMT" rguid="PGUIDFMT") ret=%d\n", PGUID (pp->e.guid), PGUID (proxypp->e.guid), ret);
+
+  /* Trace a failed handshake. */
+  if ((ret != DDS_SECURITY_VALIDATION_OK                       ) &&
+      (ret != DDS_SECURITY_VALIDATION_OK_FINAL_MESSAGE         ) &&
+      (ret != DDS_SECURITY_VALIDATION_PENDING_RETRY            ) &&
+      (ret != DDS_SECURITY_VALIDATION_PENDING_HANDSHAKE_MESSAGE))
+  {
+    HSEXCEPTION(&exception, "Begin handshake request failed");
+    ret = DDS_SECURITY_VALIDATION_FAILED;
+    goto handshake_failed;
+  }
+
+  if (ret == DDS_SECURITY_VALIDATION_PENDING_HANDSHAKE_MESSAGE)
+  {
+    if (!send_handshake_message(handshake, handshake->handshake_message_out, pp, proxypp, 0))
+    {
+      ret = DDS_SECURITY_VALIDATION_FAILED;
+      goto handshake_failed;
+    }
+  }
+  else if (ret == DDS_SECURITY_VALIDATION_OK_FINAL_MESSAGE)
+  {
+    if (send_handshake_message(handshake, handshake->handshake_message_out, pp, proxypp, 0))
+    {
+      ret = DDS_SECURITY_VALIDATION_OK;
+    } else {
+      ret = DDS_SECURITY_VALIDATION_FAILED;
+      goto handshake_failed;
+    }
+  }
+
+  if (ret == DDS_SECURITY_VALIDATION_OK)
+  {
+    handshake->shared_secret = auth->get_shared_secret(auth, handshake->handshake_handle, &exception);
+    if (handshake->shared_secret == DDS_SECURITY_HANDLE_NIL)
+    {
+      HSEXCEPTION(&exception, "Getting shared secret failed");
+      ret = DDS_SECURITY_VALIDATION_FAILED;
+      goto handshake_failed;
+    }
+  }
+
+  dds_security_fsm_dispatch(fsm, (int32_t)ret, true);
+  return;
+
+handshake_failed:
+  DDS_Security_DataHolder_free(handshake->handshake_message_out);
+  handshake->handshake_message_out = NULL;
+  /* Use return value as state machine event. */
+  dds_security_fsm_dispatch(fsm, (int32_t)ret, true);
+}
+
+static void func_process_handshake(struct dds_security_fsm *fsm, void *arg)
+{
+  DDS_Security_ValidationResult_t ret;
+  DDS_Security_SecurityException exception = {0};
+  struct ddsi_handshake *handshake = arg;
+  dds_security_authentication *auth = handshake->auth;
+  struct participant *pp;
+  struct proxy_participant *proxypp;
+
+  if (!validate_handshake(handshake, &pp, &proxypp))
+    return;
+
+  TRACE_FUNC(fsm);
+
+  ddsrt_mutex_lock(&handshake->lock);
+
+  if (handshake->handshake_message_out)
+    DDS_Security_DataHolder_free(handshake->handshake_message_out);
+  handshake->handshake_message_out = DDS_Security_DataHolder_alloc();
+
+  ret = auth->process_handshake(auth, handshake->handshake_message_out, &handshake->handshake_message_in_token, handshake->handshake_handle, &exception);
+  ddsrt_mutex_unlock(&handshake->lock);
+
+  HSTRACE("FSM: process_handshake (lguid="PGUIDFMT" rguid="PGUIDFMT") ret=%d\n", PGUID (pp->e.guid), PGUID (proxypp->e.guid), ret);
+
+  /* Trace a failed handshake. */
+  if ((ret != DDS_SECURITY_VALIDATION_OK                       ) &&
+      (ret != DDS_SECURITY_VALIDATION_OK_FINAL_MESSAGE         ) &&
+      (ret != DDS_SECURITY_VALIDATION_PENDING_RETRY            ))
+  {
+    HSEXCEPTION(&exception, "Process handshake failed");
+    ret = DDS_SECURITY_VALIDATION_FAILED;
+    goto handshake_failed;
+  }
+
+  if ((ret == DDS_SECURITY_VALIDATION_OK) || (ret == DDS_SECURITY_VALIDATION_OK_FINAL_MESSAGE))
+  {
+    handshake->shared_secret = auth->get_shared_secret(auth, handshake->handshake_handle, &exception);
+    if (handshake->shared_secret == DDS_SECURITY_HANDLE_NIL)
+    {
+      HSEXCEPTION(&exception, "Getting shared secret failed");
+      ret = DDS_SECURITY_VALIDATION_FAILED;
+      goto handshake_failed;
+    }
+    handshake->end_cb(handshake, pp, proxypp, STATE_HANDSHAKE_PROCESSED);
+  }
+
+  if (ret == DDS_SECURITY_VALIDATION_OK_FINAL_MESSAGE)
+  {
+    if (!send_handshake_message(handshake, handshake->handshake_message_out, pp, proxypp, 0))
+    {
+      ret = DDS_SECURITY_VALIDATION_FAILED;
+      goto handshake_failed;
+    }
+  }
+
+  dds_security_fsm_dispatch(fsm, (int32_t)ret, true);
+  return;
+
+handshake_failed:
+  DDS_Security_DataHolder_free(handshake->handshake_message_out);
+  handshake->handshake_message_out = NULL;
+  /* Use return value as state machine event. */
+  dds_security_fsm_dispatch(fsm, (int32_t)ret, true);
+}
+
+static void func_send_crypto_tokens(struct dds_security_fsm *fsm, void *arg)
+{
+  struct ddsi_handshake *handshake = arg;
+  struct participant *pp;
+  struct proxy_participant *proxypp;
+
+  if (!validate_handshake(handshake, &pp, &proxypp))
+    return;
+
+  TRACE_FUNC(fsm);
+
+  /* The final handshake message has been send to the remote
+   * participant. Call the callback function to signal that
+   * the corresponding crypto tokens can be send. Amd start
+   * waiting for the crypto tokens from the remote participant
+   */
+
+  HSTRACE("FSM: handshake send crypto tokens (lguid="PGUIDFMT" rguid="PGUIDFMT")\n", PGUID (pp->e.guid), PGUID (proxypp->e.guid));
+  handshake->end_cb(handshake, pp, proxypp, STATE_HANDSHAKE_SEND_TOKENS);
+  dds_security_fsm_dispatch(fsm, EVENT_VALIDATION_OK_FINAL_MESSAGE, true);
+}
+
+static void func_send_crypto_tokens_final(struct dds_security_fsm *fsm, void *arg)
+{
+  struct ddsi_handshake *handshake = arg;
+  struct participant *pp;
+  struct proxy_participant *proxypp;
+
+  if (!validate_handshake(handshake, &pp, &proxypp))
+    return;
+
+  TRACE_FUNC(fsm);
+
+  /* The final handshake message has been send to the remote
+   * participant. Call the callback function to signal that
+   * the corresponding crypto tokens can be send. Amd start
+   * waiting for the crypto tokens from the remote participant
+   */
+
+  HSTRACE("FSM: handshake send crypto tokens final (lguid="PGUIDFMT" rguid="PGUIDFMT")\n", PGUID (pp->e.guid), PGUID (proxypp->e.guid));
+  handshake->end_cb(handshake, pp, proxypp, STATE_HANDSHAKE_SEND_TOKENS);
+  dds_security_fsm_dispatch(fsm, EVENT_VALIDATION_OK, true);
+}
+
+static void func_handshake_message_resend(struct dds_security_fsm *fsm, void *arg)
+{
+  struct ddsi_handshake *handshake = arg;
+  struct participant *pp;
+  struct proxy_participant *proxypp;
+
+  DDSRT_UNUSED_ARG(fsm);
+  DDSRT_UNUSED_ARG(arg);
+
+  if (!validate_handshake(handshake, &pp, &proxypp))
+    return;
+
+  TRACE_FUNC(fsm);
+
+  HSTRACE("handshake resend (lguid="PGUIDFMT" rguid="PGUIDFMT")\n", PGUID(pp->e.guid), PGUID(proxypp->e.guid));
+  if (handshake->handshake_message_out) {
+    (void)send_handshake_message(handshake, handshake->handshake_message_out, pp, proxypp, 0);
+  }
+}
+
+static void func_validation_ok(struct dds_security_fsm *fsm, void *arg)
+{
+  struct ddsi_handshake *handshake = arg;
+  struct participant *pp;
+  struct proxy_participant *proxypp;
+
+  DDSRT_UNUSED_ARG(fsm);
+
+  if (!validate_handshake(handshake, &pp, &proxypp))
+    return;
+
+  TRACE_FUNC(fsm);
+
+  HSTRACE("FSM: handshake succeeded (lguid="PGUIDFMT" rguid="PGUIDFMT")\n", PGUID(pp->e.guid), PGUID(proxypp->e.guid));
+  handshake->state = STATE_HANDSHAKE_OK;
+  handshake->end_cb(handshake, pp, proxypp, STATE_HANDSHAKE_OK);
+}
+
+static void func_validation_failed(struct dds_security_fsm *fsm, void *arg)
+{
+  struct ddsi_handshake *handshake = arg;
+  struct participant *pp;
+  struct proxy_participant *proxypp;
+
+  DDSRT_UNUSED_ARG(fsm);
+
+  if (!validate_handshake(handshake, &pp, &proxypp))
+    return;
+
+  TRACE_FUNC(fsm);
+
+  HSTRACE("FSM: handshake failed (lguid="PGUIDFMT" rguid="PGUIDFMT")\n", PGUID(pp->e.guid), PGUID(proxypp->e.guid));
+  handshake->state = STATE_HANDSHAKE_FAILED;
+  handshake->end_cb(handshake, pp, proxypp, STATE_HANDSHAKE_FAILED);
+}
+
+static void func_handshake_timeout(struct dds_security_fsm *fsm, void *arg)
+{
+  struct ddsi_handshake *handshake = arg;
+  struct participant *pp;
+  struct proxy_participant *proxypp;
+
+  DDSRT_UNUSED_ARG(fsm);
+
+  if (!validate_handshake(handshake, &pp, &proxypp))
+    return;
+
+  TRACE_FUNC(fsm);
+
+  HSTRACE("FSM: handshake timeout (lguid="PGUIDFMT" rguid="PGUIDFMT")\n", PGUID(pp->e.guid), PGUID(proxypp->e.guid));
+  handshake->state = STATE_HANDSHAKE_TIMED_OUT;
+  handshake->end_cb(handshake, pp, proxypp, STATE_HANDSHAKE_TIMED_OUT);
+}
+
+
+static struct ddsi_handshake * ddsi_handshake_create(struct participant *pp, struct proxy_participant *proxypp, ddsi_handshake_end_cb_t callback)
+{
+  const struct ddsi_domaingv * gv = pp->e.gv;
+  struct ddsi_hsadmin *hsadmin = pp->e.gv->hsadmin;
+  struct ddsi_handshake *handshake;
+  dds_return_t rc;
+  ddsi_octetseq_t pdata;
+
+  TRACE_FUNC(NULL);
+
+  handshake = ddsrt_malloc(sizeof(struct ddsi_handshake));
+  memset(handshake, 0, sizeof(struct ddsi_handshake));
+
+  ddsrt_mutex_init(&handshake->lock);
+  handshake->auth = q_omg_participant_get_authentication(pp);
+  ddsrt_atomic_st32(&handshake->refc, 1);
+  ddsrt_atomic_st32(&handshake->deleting, 0);
+  handshake->participants.lguid = pp->e.guid;
+  handshake->participants.rguid = proxypp->e.guid;
+  handshake->gv = gv;
+  handshake->handshake_handle = 0;
+  handshake->shared_secret = 0;
+  auth_get_serialized_participant_data(pp, &pdata);
+
+  handshake->pdata._length =  handshake->pdata._maximum = pdata.length;
+  handshake->pdata._buffer = pdata.value;
+
+  handshake->end_cb = callback;
+
+  handshake->state = STATE_HANDSHAKE_IN_PROGRESS;
+  if (!hsadmin->fsm_control)
+  {
+    hsadmin->fsm_control = dds_security_fsm_control_create(pp->e.gv);
+    rc = dds_security_fsm_control_start(hsadmin->fsm_control, NULL);
+    if (rc < 0)
+    {
+      GVERROR("Failed to create FSM control");
+      goto fsm_control_failed;
+    }
+  }
+
+  handshake->fsm = dds_security_fsm_create(hsadmin->fsm_control, handshake_transistions, sizeof(handshake_transistions)/sizeof(handshake_transistions[0]), handshake);
+  if (!handshake->fsm)
+  {
+    GVERROR("Failed to create FSM");
+    goto fsm_failed;
+  }
+  dds_security_fsm_set_timeout(handshake->fsm, func_handshake_timeout, AUTHENTICATION_TIMEOUT);
+
+#ifdef VERBOSE_HANDSHAKE_DEBUG
+  dds_security_fsm_set_debug(handshake->fsm, q_handshake_fsm_debug);
+#endif
+  dds_security_fsm_start(handshake->fsm);
+
+  return handshake;
+
+fsm_failed:
+fsm_control_failed:
+  ddsrt_free(handshake);
+  return NULL;
+}
+
+void ddsi_handshake_release(struct ddsi_handshake *handshake)
+{
+  if (!handshake) return;
+
+  if (ddsrt_atomic_dec32_nv(&handshake->refc) == 0)
+  {
+    HSTRACE("handshake delete (lguid="PGUIDFMT" rguid="PGUIDFMT")\n", PGUID(handshake->participants.lguid), PGUID(handshake->participants.rguid));
+    DDS_Security_DataHolder_deinit(&handshake->local_auth_request_token);
+    DDS_Security_DataHolder_deinit(&handshake->handshake_message_in_token);
+    DDS_Security_DataHolder_free(handshake->handshake_message_out);
+    DDS_Security_DataHolder_free(handshake->remote_auth_request_token);
+    DDS_Security_OctetSeq_deinit(&handshake->pdata);
+    ddsrt_mutex_destroy(&handshake->lock);
+    ddsrt_free(handshake);
+  }
+}
 
 void ddsi_handshake_handle_message(struct ddsi_handshake *handshake, const struct participant *pp, const struct proxy_participant *proxypp, const struct nn_participant_generic_message *msg)
 {
-  DDSRT_UNUSED_ARG(handshake);
+  handshake_event_t event = EVENT_VALIDATION_FAILED;
+
   DDSRT_UNUSED_ARG(pp);
   DDSRT_UNUSED_ARG(proxypp);
-  DDSRT_UNUSED_ARG(msg);
+
+  assert(handshake);
+  assert(pp);
+  assert(proxypp);
+  assert(msg);
+
+  TRACE_FUNC(handshake->fsm);
+
+  if (!validate_handshake(handshake, NULL, NULL))
+    return;
+
+  HSTRACE ("FSM: handshake_handle_message (lguid="PGUIDFMT" rguid="PGUIDFMT") class_id=%s\n",
+      PGUID (pp->e.guid), PGUID (proxypp->e.guid),
+      msg->message_class_id ? msg->message_class_id: "NULL");
+
+  if (!msg->message_class_id || msg->message_data.n == 0 || !msg->message_data.tags[0].class_id)
+  {
+    HSERROR("received handshake message ("PGUIDFMT" --> "PGUIDFMT") does not contain a handshake message token\n", PGUID (pp->e.guid), PGUID (proxypp->e.guid));
+    goto invalid_message;
+  }
+  else if (strcmp(msg->message_class_id, DDS_SECURITY_AUTH_REQUEST) == 0)
+  {
+    if (strcmp(msg->message_data.tags[0].class_id, DDS_SECURITY_AUTH_REQUEST_TOKEN_CLASS_ID) == 0)
+    {
+      /* Note the state machine is started by discovery
+       * currently and not by the reception of an auth_request message which was send as the
+       * result of validate_remote_entity at the opposite participant
+       */
+      ddsrt_mutex_lock(&handshake->lock);
+      if (handshake->remote_auth_request_token)
+        DDS_Security_DataHolder_free(handshake->remote_auth_request_token);
+      handshake->remote_auth_request_token = DDS_Security_DataHolder_alloc();
+      q_omg_security_dataholder_copyout(handshake->remote_auth_request_token, &msg->message_data.tags[0]);
+      ddsrt_mutex_unlock(&handshake->lock);
+    }
+    else
+    {
+      HSERROR("received handshake message ("PGUIDFMT" --> "PGUIDFMT") does not contain a valid handshake message token\n", PGUID (pp->e.guid), PGUID (proxypp->e.guid));
+    }
+  }
+  else if (strcmp(msg->message_class_id, DDS_SECURITY_AUTH_HANDSHAKE) == 0)
+  {
+    if (msg->message_data.tags[0].class_id == NULL)
+      HSERROR("received handshake message ("PGUIDFMT" --> "PGUIDFMT") does not contain a valid handshake message token\n", PGUID (pp->e.guid), PGUID (proxypp->e.guid));
+    else if (strcmp(msg->message_data.tags[0].class_id, DDS_SECURITY_AUTH_HANDSHAKE_REQUEST_TOKEN_ID) == 0)
+      event = EVENT_RECEIVED_MESSAGE_REQUEST;
+    else if (strcmp(msg->message_data.tags[0].class_id, DDS_SECURITY_AUTH_HANDSHAKE_REPLY_TOKEN_ID) == 0)
+      event = EVENT_RECEIVED_MESSAGE_REPLY;
+    else if (strcmp(msg->message_data.tags[0].class_id, DDS_SECURITY_AUTH_HANDSHAKE_FINAL_TOKEN_ID) == 0)
+      event = EVENT_RECEIVED_MESSAGE_FINAL;
+    else
+    {
+      HSERROR("received handshake message ("PGUIDFMT" --> "PGUIDFMT") does not contain a valid handshake message token\n", PGUID (pp->e.guid), PGUID (proxypp->e.guid));
+      goto invalid_message;
+    }
+
+    ddsrt_mutex_lock(&handshake->lock);
+    DDS_Security_DataHolder_deinit(&handshake->handshake_message_in_token);
+    q_omg_security_dataholder_copyout(&handshake->handshake_message_in_token, &msg->message_data.tags[0]);
+    memcpy(&handshake->handshake_message_in_id, &msg->message_identity, sizeof(handshake->handshake_message_in_id));
+    handshake->handled_handshake_message = 0;
+    dds_security_fsm_dispatch(handshake->fsm, event, false);
+    ddsrt_mutex_unlock(&handshake->lock);
+  }
+  else
+  {
+    HSERROR("received handshake message ("PGUIDFMT" --> "PGUIDFMT") does not contain a valid message_class_id\n", PGUID (pp->e.guid), PGUID (proxypp->e.guid));
+  }
+
+invalid_message:
+  return;
 }
 
 void ddsi_handshake_crypto_tokens_received(struct ddsi_handshake *handshake)
 {
-  DDSRT_UNUSED_ARG(handshake);
+  struct participant *pp;
+  struct proxy_participant *proxypp;
+
+  assert(handshake);
+  assert(handshake->fsm);
+
+  if (!validate_handshake(handshake, &pp, &proxypp))
+    return;
+
+  HSTRACE("FSM: tokens received (lguid="PGUIDFMT" rguid="PGUIDFMT")\n", PGUID(pp->e.guid), PGUID(proxypp->e.guid));
+
+  dds_security_fsm_dispatch(handshake->fsm, EVENT_RECV_CRYPTO_TOKENS, false);
 }
 
 int64_t ddsi_handshake_get_shared_secret(const struct ddsi_handshake *handshake)
 {
-  DDSRT_UNUSED_ARG(handshake);
-
-  return 0;
+  return handshake->shared_secret;
 }
 
 int64_t ddsi_handshake_get_handle(const struct ddsi_handshake *handshake)
 {
-  DDSRT_UNUSED_ARG(handshake);
-
-  return 0;
+  return handshake->handshake_handle;
 }
 
-void ddsi_handshake_register(const struct participant *pp, const struct proxy_participant *proxypp, ddsi_handshake_end_cb_t callback)
+static struct ddsi_hsadmin * ddsi_handshake_admin_create(void)
 {
-  DDSRT_UNUSED_ARG(pp);
-  DDSRT_UNUSED_ARG(proxypp);
-  DDSRT_UNUSED_ARG(callback);
+  struct ddsi_hsadmin *admin;
+
+  admin = ddsrt_malloc(sizeof(*admin));
+  ddsrt_mutex_init(&admin->lock);
+  ddsrt_avl_init(&handshake_treedef, &admin->handshakes);
+  admin->fsm_control = NULL;
+
+  return admin;
 }
 
-void ddsi_handshake_remove(const struct participant *pp, const struct proxy_participant *proxypp, struct ddsi_handshake *handshake)
+static void release_handshake(void *arg)
 {
-  DDSRT_UNUSED_ARG(pp);
-  DDSRT_UNUSED_ARG(proxypp);
-  DDSRT_UNUSED_ARG(handshake);
+  ddsi_handshake_release((struct ddsi_handshake *)arg);
 }
 
-struct ddsi_handshake * ddsi_handshake_find(const struct participant *pp, const struct proxy_participant *proxypp)
+static void ddsi_handshake_admin_delete(struct ddsi_hsadmin *hsadmin)
 {
-  DDSRT_UNUSED_ARG(pp);
-  DDSRT_UNUSED_ARG(proxypp);
+  if (hsadmin)
+  {
+    ddsrt_mutex_destroy(&hsadmin->lock);
+    ddsrt_avl_free(&handshake_treedef, &hsadmin->handshakes, release_handshake);
+    if (hsadmin->fsm_control)
+    {
+      dds_security_fsm_control_stop(hsadmin->fsm_control);
+      dds_security_fsm_control_free(hsadmin->fsm_control);
+    }
+    ddsrt_free(hsadmin);
+  }
+}
 
-  return NULL;
+static struct ddsi_handshake * ddsi_handshake_find_locked(
+    struct ddsi_hsadmin *hsadmin,
+    struct participant *pp,
+    struct proxy_participant *proxypp)
+{
+  struct handshake_entities handles;
+
+  handles.lguid = pp->e.guid;
+  handles.rguid = proxypp->e.guid;
+
+  return ddsrt_avl_lookup(&handshake_treedef, &hsadmin->handshakes, &handles);
+}
+
+void ddsi_handshake_remove(struct participant *pp, struct proxy_participant *proxypp, struct ddsi_handshake *handshake)
+{
+  struct ddsi_hsadmin *hsadmin = pp->e.gv->hsadmin;
+
+  ddsrt_mutex_lock(&hsadmin->lock);
+  if (!handshake)
+    handshake = ddsi_handshake_find_locked(hsadmin, pp, proxypp);
+  if (handshake)
+  {
+    ddsrt_avl_delete(&handshake_treedef, &hsadmin->handshakes, handshake);
+    ddsrt_atomic_st32(&handshake->deleting, 1);
+  }
+  ddsrt_mutex_unlock(&hsadmin->lock);
+  if (handshake && handshake->fsm)
+    dds_security_fsm_free(handshake->fsm);
+  ddsi_handshake_release(handshake);
+}
+
+struct ddsi_handshake * ddsi_handshake_find(struct participant *pp, struct proxy_participant *proxypp)
+{
+  struct ddsi_hsadmin *hsadmin = pp->e.gv->hsadmin;
+  struct ddsi_handshake *handshake = NULL;
+
+  ddsrt_mutex_lock(&hsadmin->lock);
+  handshake = ddsi_handshake_find_locked(hsadmin, pp, proxypp);
+  if (handshake)
+    ddsrt_atomic_inc32(&handshake->refc);
+  ddsrt_mutex_unlock(&hsadmin->lock);
+
+  return handshake;
+}
+
+void ddsi_handshake_register(struct participant *pp, struct proxy_participant *proxypp, ddsi_handshake_end_cb_t callback)
+{
+  struct ddsi_hsadmin *hsadmin = pp->e.gv->hsadmin;
+  struct ddsi_handshake *handshake = NULL;
+
+  ddsrt_mutex_lock(&hsadmin->lock);
+  handshake = ddsi_handshake_find_locked(hsadmin, pp, proxypp);
+  if (!handshake)
+  {
+    handshake = ddsi_handshake_create(pp, proxypp, callback);
+    if (handshake)
+      ddsrt_avl_insert(&handshake_treedef, &hsadmin->handshakes, handshake);
+  }
+  ddsrt_mutex_unlock(&hsadmin->lock);
+}
+
+void ddsi_handshake_admin_init(struct ddsi_domaingv *gv)
+{
+  assert(gv);
+  gv->hsadmin = ddsi_handshake_admin_create();
+}
+
+void ddsi_handshake_admin_deinit(struct ddsi_domaingv *gv)
+{
+  assert(gv);
+  ddsi_handshake_admin_delete(gv->hsadmin);
 }
 
 
@@ -101,9 +1213,8 @@ extern inline void ddsi_handshake_release(UNUSED_ARG(struct ddsi_handshake *hand
 extern inline void ddsi_handshake_crypto_tokens_received(UNUSED_ARG(struct ddsi_handshake *handshake));
 extern inline int64_t ddsi_handshake_get_shared_secret(UNUSED_ARG(const struct ddsi_handshake *handshake));
 extern inline int64_t ddsi_handshake_get_handle(UNUSED_ARG(const struct ddsi_handshake *handshake));
-extern inline void ddsi_handshake_register(UNUSED_ARG(const struct participant *pp), UNUSED_ARG(const struct proxy_participant *proxypp), UNUSED_ARG(ddsi_handshake_end_cb_t callback));
-extern inline void ddsi_handshake_remove(UNUSED_ARG(const struct participant *pp), UNUSED_ARG(const struct proxy_participant *proxypp), UNUSED_ARG(struct ddsi_handshake *handshake));
-extern inline struct ddsi_handshake * ddsi_handshake_find(UNUSED_ARG(const struct participant *pp), UNUSED_ARG(const struct proxy_participant *proxypp));
-
+extern inline void ddsi_handshake_register(UNUSED_ARG(struct participant *pp), UNUSED_ARG(struct proxy_participant *proxypp), UNUSED_ARG(ddsi_handshake_end_cb_t callback));
+extern inline void ddsi_handshake_remove(UNUSED_ARG(struct participant *pp), UNUSED_ARG(struct proxy_participant *proxypp), UNUSED_ARG(struct ddsi_handshake *handshake));
+extern inline struct ddsi_handshake * ddsi_handshake_find(UNUSED_ARG(struct participant *pp), UNUSED_ARG(struct proxy_participant *proxypp));
 
 #endif /* DDSI_INCLUDE_DDS_SECURITY */
diff --git a/src/core/ddsi/src/ddsi_plist.c b/src/core/ddsi/src/ddsi_plist.c
index d2243f6..9722e02 100644
--- a/src/core/ddsi/src/ddsi_plist.c
+++ b/src/core/ddsi/src/ddsi_plist.c
@@ -106,7 +106,7 @@ struct piddesc {
     const enum pserop desc[12];
     struct {
       dds_return_t (*deser) (void * __restrict dst, size_t * __restrict dstoff, struct flagset *flagset, uint64_t flag, const struct dd * __restrict dd, size_t * __restrict srcoff);
-      dds_return_t (*ser) (struct nn_xmsg *xmsg, nn_parameterid_t pid, const void *src, size_t srcoff);
+      dds_return_t (*ser) (struct nn_xmsg *xmsg, nn_parameterid_t pid, const void *src, size_t srcoff, bool be);
       dds_return_t (*unalias) (void * __restrict dst, size_t * __restrict dstoff);
       dds_return_t (*fini) (void * __restrict dst, size_t * __restrict dstoff, struct flagset *flagset, uint64_t flag);
       dds_return_t (*valid) (const void *src, size_t srcoff);
@@ -289,17 +289,19 @@ static dds_return_t deser_reliability (void * __restrict dst, size_t * __restric
   return 0;
 }
 
-static dds_return_t ser_reliability (struct nn_xmsg *xmsg, nn_parameterid_t pid, const void *src, size_t srcoff)
+static dds_return_t ser_reliability (struct nn_xmsg *xmsg, nn_parameterid_t pid, const void *src, size_t srcoff, bool be)
 {
+#define BO4U(x) ((be) ? ddsrt_toBE4u((x)) : (x))
   DDSRT_STATIC_ASSERT (DDS_EXTERNAL_RELIABILITY_BEST_EFFORT == 1 && DDS_EXTERNAL_RELIABILITY_RELIABLE == 2 &&
                        DDS_RELIABILITY_BEST_EFFORT == 0 && DDS_RELIABILITY_RELIABLE == 1);
   dds_reliability_qospolicy_t const * const x = deser_generic_src (src, &srcoff, alignof (dds_reliability_qospolicy_t));
   ddsi_duration_t mbt = nn_to_ddsi_duration (x->max_blocking_time);
-  uint32_t * const p = nn_xmsg_addpar (xmsg, pid, 3 * sizeof (uint32_t));
-  p[0] = 1 + (uint32_t) x->kind;
-  p[1] = (uint32_t) mbt.seconds;
-  p[2] = mbt.fraction;
+  uint32_t * const p = nn_xmsg_addpar_bo (xmsg, pid, 3 * sizeof (uint32_t), be);
+  p[0] = BO4U(1 + (uint32_t) x->kind);
+  p[1] = BO4U((uint32_t) mbt.seconds);
+  p[2] = BO4U(mbt.fraction);
   return 0;
+#undef BO4U
 }
 
 static dds_return_t valid_reliability (const void *src, size_t srcoff)
@@ -340,10 +342,10 @@ static dds_return_t deser_statusinfo (void * __restrict dst, size_t * __restrict
   return 0;
 }
 
-static dds_return_t ser_statusinfo (struct nn_xmsg *xmsg, nn_parameterid_t pid, const void *src, size_t srcoff)
+static dds_return_t ser_statusinfo (struct nn_xmsg *xmsg, nn_parameterid_t pid, const void *src, size_t srcoff, bool be)
 {
   uint32_t const * const x = deser_generic_src (src, &srcoff, alignof (uint32_t));
-  uint32_t * const p = nn_xmsg_addpar (xmsg, pid, sizeof (uint32_t));
+  uint32_t * const p = nn_xmsg_addpar_bo (xmsg, pid, sizeof (uint32_t), be);
   *p = ddsrt_toBE4u (*x);
   return 0;
 }
@@ -374,14 +376,16 @@ static dds_return_t deser_locator (void * __restrict dst, size_t * __restrict ds
   return 0;
 }
 
-static dds_return_t ser_locator (struct nn_xmsg *xmsg, nn_parameterid_t pid, const void *src, size_t srcoff)
+static dds_return_t ser_locator (struct nn_xmsg *xmsg, nn_parameterid_t pid, const void *src, size_t srcoff, bool be)
 {
   nn_locators_t const * const x = deser_generic_src (src, &srcoff, alignof (nn_locators_t));
   for (const struct nn_locators_one *l = x->first; l != NULL; l = l->next)
   {
-    char * const p = nn_xmsg_addpar (xmsg, pid, 24);
-    memcpy (p, &l->loc.kind, 4);
-    memcpy (p + 4, &l->loc.port, 4);
+    char * const p = nn_xmsg_addpar_bo (xmsg, pid, 24, be);
+    const int32_t kind = be ? ddsrt_toBE4 (l->loc.kind) : l->loc.kind;
+    const uint32_t port = be ? ddsrt_toBE4u (l->loc.port) : l->loc.port;
+    memcpy (p, &kind, 4);
+    memcpy (p + 4, &port, 4);
     memcpy (p + 8, l->loc.address, 16);
   }
   return 0;
@@ -854,8 +858,12 @@ static uint32_t ser_generic_count (const ddsi_octetseq_t *src, size_t elem_size,
   return count;
 }
 
-static dds_return_t ser_generic_embeddable (char * const data, size_t *dstoff, const void *src, size_t srcoff, const enum pserop * __restrict desc)
+static dds_return_t ser_generic_embeddable (char * const data, size_t *dstoff, const void *src, size_t srcoff, const enum pserop * __restrict desc, bool be)
 {
+#define BO4(x)  (be ? ddsrt_toBE4((x)) : (x))
+#define BO4U(x) (be ? ddsrt_toBE4u((x)) : (x))
+#define BO8(x)  (be ? ddsrt_toBE8((x)) : (x))
+
   while (true)
   {
     switch (*desc)
@@ -865,7 +873,7 @@ static dds_return_t ser_generic_embeddable (char * const data, size_t *dstoff, c
       case XO: { /* octet sequence */
         ddsi_octetseq_t const * const x = deser_generic_src (src, &srcoff, alignof (ddsi_octetseq_t));
         char * const p = ser_generic_align4 (data, dstoff);
-        *((uint32_t *) p) = x->length;
+        *((uint32_t *) p) = BO4U(x->length);
         if (x->length) memcpy (p + 4, x->value, x->length);
         *dstoff += 4 + x->length;
         srcoff += sizeof (*x);
@@ -875,7 +883,7 @@ static dds_return_t ser_generic_embeddable (char * const data, size_t *dstoff, c
         char const * const * const x = deser_generic_src (src, &srcoff, alignof (char *));
         const uint32_t size = (uint32_t) (strlen (*x) + 1);
         char * const p = ser_generic_align4 (data, dstoff);
-        *((uint32_t *) p) = size;
+        *((uint32_t *) p) = BO4U(size);
         memcpy (p + 4, *x, size);
         *dstoff += 4 + size;
         srcoff += sizeof (*x);
@@ -884,7 +892,7 @@ static dds_return_t ser_generic_embeddable (char * const data, size_t *dstoff, c
       case XE1: case XE2: case XE3: { /* enum */
         unsigned const * const x = deser_generic_src (src, &srcoff, alignof (unsigned));
         uint32_t * const p = ser_generic_align4 (data, dstoff);
-        *p = (uint32_t) *x;
+        *p = BO4U((uint32_t) *x);
         *dstoff += 4;
         srcoff += sizeof (*x);
         break;
@@ -894,7 +902,7 @@ static dds_return_t ser_generic_embeddable (char * const data, size_t *dstoff, c
         const uint32_t cnt = 1 + (uint32_t) (*desc - Xi);
         int32_t * const p = ser_generic_align4 (data, dstoff);
         for (uint32_t i = 0; i < cnt; i++)
-          p[i] = x[i];
+          p[i] = BO4(x[i]);
         *dstoff += cnt * sizeof (*x);
         srcoff += cnt * sizeof (*x);
         break;
@@ -904,7 +912,7 @@ static dds_return_t ser_generic_embeddable (char * const data, size_t *dstoff, c
         const uint32_t cnt = 1 + (uint32_t) (*desc - Xu);
         uint32_t * const p = ser_generic_align4 (data, dstoff);
         for (uint32_t i = 0; i < cnt; i++)
-          p[i] = x[i];
+          p[i] = BO4U(x[i]);
         *dstoff += cnt * sizeof (*x);
         srcoff += cnt * sizeof (*x);
         break;
@@ -912,7 +920,7 @@ static dds_return_t ser_generic_embeddable (char * const data, size_t *dstoff, c
       case Xl: { /* int64_t */
         int64_t const * const x = deser_generic_src (src, &srcoff, alignof (int64_t));
         int64_t * const p = ser_generic_align8 (data, dstoff);
-        *p = *x;
+        *p = BO8(*x);
         *dstoff += sizeof (*x);
         srcoff += sizeof (*x);
         break;
@@ -924,8 +932,8 @@ static dds_return_t ser_generic_embeddable (char * const data, size_t *dstoff, c
         for (uint32_t i = 0; i < cnt; i++)
         {
           ddsi_duration_t tmp = nn_to_ddsi_duration (x[i]);
-          p[2 * i + 0] = (uint32_t) tmp.seconds;
-          p[2 * i + 1] = tmp.fraction;
+          p[2 * i + 0] = BO4U((uint32_t) tmp.seconds);
+          p[2 * i + 1] = BO4U(tmp.fraction);
         }
         *dstoff += 2 * cnt * sizeof (uint32_t);
         srcoff += cnt * sizeof (*x);
@@ -981,9 +989,9 @@ static dds_return_t ser_generic_embeddable (char * const data, size_t *dstoff, c
         else
         {
           const size_t elem_size = ser_generic_srcsize (desc + 1);
-          *((uint32_t *) p) = ser_generic_count (x, elem_size, desc + 1);
+          *((uint32_t *) p) = BO4U(ser_generic_count (x, elem_size, desc + 1));
           for (uint32_t i = 0; i < x->length; i++)
-            ser_generic_embeddable (data, dstoff, x->value, i * elem_size, desc + 1);
+            ser_generic_embeddable (data, dstoff, x->value, i * elem_size, desc + 1, be);
         }
         srcoff += sizeof (*x);
         break;
@@ -993,13 +1001,18 @@ static dds_return_t ser_generic_embeddable (char * const data, size_t *dstoff, c
     }
     desc = pserop_advance(desc);
   }
+#undef BO4
+#undef BO4U
+#undef BO8
 }
 
-static dds_return_t ser_generic (struct nn_xmsg *xmsg, nn_parameterid_t pid, const void *src, size_t srcoff, const enum pserop * __restrict desc)
+
+
+static dds_return_t ser_generic (struct nn_xmsg *xmsg, nn_parameterid_t pid, const void *src, size_t srcoff, const enum pserop * __restrict desc, bool be)
 {
-  char * const data = nn_xmsg_addpar (xmsg, pid, ser_generic_size (src, srcoff, desc));
+  char * const data = nn_xmsg_addpar_bo (xmsg, pid, ser_generic_size (src, srcoff, desc), be);
   size_t dstoff = 0;
-  return ser_generic_embeddable (data, &dstoff, src, srcoff, desc);
+  return ser_generic_embeddable (data, &dstoff, src, srcoff, desc, be);
 }
 
 dds_return_t plist_ser_generic (void **dst, size_t *dstsize, const void *src, const enum pserop * __restrict desc)
@@ -1010,7 +1023,7 @@ dds_return_t plist_ser_generic (void **dst, size_t *dstsize, const void *src, co
   *dstsize = ser_generic_size (src, srcoff, desc);
   if ((*dst = ddsrt_malloc (*dstsize == 0 ? 1 : *dstsize)) == NULL)
     return DDS_RETCODE_OUT_OF_RESOURCES;
-  ret = ser_generic_embeddable (*dst, &dstoff, src, srcoff, desc);
+  ret = ser_generic_embeddable (*dst, &dstoff, src, srcoff, desc, false);
   assert (dstoff == *dstsize);
   return ret;
 }
@@ -1987,7 +2000,7 @@ static void plist_or_xqos_mergein_missing (void * __restrict dst, const void * _
   assert ((*qfs_dst.aliased & ~ aliased_dst_inq) == 0);
 }
 
-static void plist_or_xqos_addtomsg (struct nn_xmsg *xmsg, const void * __restrict src, size_t shift, uint64_t pwanted, uint64_t qwanted)
+static void plist_or_xqos_addtomsg (struct nn_xmsg *xmsg, const void * __restrict src, size_t shift, uint64_t pwanted, uint64_t qwanted, bool be)
 {
   /* shift == 0: plist, shift > 0: just qos */
   uint64_t pw, qw;
@@ -2017,9 +2030,9 @@ static void plist_or_xqos_addtomsg (struct nn_xmsg *xmsg, const void * __restric
         assert (shift == 0 || entry->plist_offset - shift < sizeof (dds_qos_t));
         size_t srcoff = entry->plist_offset - shift;
         if (!(entry->flags & PDF_FUNCTION))
-          ser_generic (xmsg, entry->pid, src, srcoff, entry->op.desc);
+          ser_generic (xmsg, entry->pid, src, srcoff, entry->op.desc, be);
         else
-          entry->op.f.ser (xmsg, entry->pid, src, srcoff);
+          entry->op.f.ser (xmsg, entry->pid, src, srcoff, be);
       }
     }
   }
@@ -3333,12 +3346,17 @@ static int partitions_equal (const void *srca, const void *srcb, size_t off)
 
 void ddsi_xqos_addtomsg (struct nn_xmsg *m, const dds_qos_t *xqos, uint64_t wanted)
 {
-  plist_or_xqos_addtomsg (m, xqos, offsetof (struct ddsi_plist, qos), 0, wanted);
+  plist_or_xqos_addtomsg (m, xqos, offsetof (struct ddsi_plist, qos), 0, wanted, false);
+}
+
+void ddsi_plist_addtomsg_bo (struct nn_xmsg *m, const ddsi_plist_t *ps, uint64_t pwanted, uint64_t qwanted, bool be)
+{
+  plist_or_xqos_addtomsg (m, ps, 0, pwanted, qwanted, be);
 }
 
 void ddsi_plist_addtomsg (struct nn_xmsg *m, const ddsi_plist_t *ps, uint64_t pwanted, uint64_t qwanted)
 {
-  plist_or_xqos_addtomsg (m, ps, 0, pwanted, qwanted);
+  plist_or_xqos_addtomsg (m, ps, 0, pwanted, qwanted, false);
 }
 
 /*************************/
diff --git a/src/core/ddsi/src/ddsi_security_exchange.c b/src/core/ddsi/src/ddsi_security_exchange.c
new file mode 100644
index 0000000..c583f71
--- /dev/null
+++ b/src/core/ddsi/src/ddsi_security_exchange.c
@@ -0,0 +1,428 @@
+/*
+ * Copyright(c) 2006 to 2018 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+#ifdef DDSI_INCLUDE_SECURITY
+
+#include <string.h>
+
+#include "dds/ddsrt/heap.h"
+#include "dds/ddsrt/md5.h"
+
+#include "dds/ddsi/ddsi_domaingv.h"
+#include "dds/ddsi/ddsi_entity_index.h"
+#include "dds/ddsi/ddsi_security_exchange.h"
+#include "dds/ddsi/ddsi_serdata_default.h"
+#include "dds/ddsi/ddsi_security_omg.h"
+#include "dds/ddsi/ddsi_handshake.h"
+#include "dds/ddsi/q_ddsi_discovery.h"
+#include "dds/ddsi/ddsi_tkmap.h"
+#include "dds/ddsi/q_xmsg.h"
+#include "dds/ddsi/q_transmit.h"
+#include "dds/ddsi/q_log.h"
+#include "dds/ddsi/q_bswap.h"
+
+//#define SECURITY_LOG_MESSAGE_DATA
+
+#ifdef SECURITY_LOG_MESSAGE_DATA
+static void nn_property_seq_log(struct ddsi_domaingv *gv, const dds_propertyseq_t *seq)
+{
+  uint32_t i;
+
+  GVTRACE("{");
+  for (i = 0; i < seq->n; i++) {
+    GVTRACE("n=%s,v=%s", seq->props[i].name, seq->props[i].value);
+  }
+  GVTRACE("}");
+}
+
+static void nn_binary_property_seq_log(struct ddsi_domaingv *gv, const dds_binarypropertyseq_t *seq)
+{
+  uint32_t i;
+
+  GVTRACE("{");
+  for (i = 0; i < seq->n; i++) {
+    uint32_t j;
+    GVTRACE("n=%s,v={", seq->props[i].name);
+    for (j = 0; j < seq->props[i].value.length; j++) {
+      GVTRACE("%02x", seq->props[i].value.value[j]);
+    }
+    GVTRACE("}");
+  }
+  GVTRACE("}");
+}
+
+static void nn_dataholder_seq_log(struct ddsi_domaingv *gv, const char *prefix, const nn_dataholderseq_t *dhseq)
+{
+  uint32_t i;
+
+  GVTRACE("%s={", prefix);
+  for (i = 0; i < dhseq->n; i++) {
+    GVTRACE("cid=%s,", dhseq->tags[i].class_id);
+    nn_property_seq_log(gv, &dhseq->tags[i].properties);
+    GVTRACE(",");
+    nn_binary_property_seq_log(gv, &dhseq->tags[i].binary_properties);
+  }
+  GVTRACE("}");
+}
+#endif
+
+static void nn_participant_generic_message_log(struct ddsi_domaingv *gv, const struct nn_participant_generic_message *msg, int conv)
+{
+  ddsi_guid_t spguid = conv ? nn_ntoh_guid(msg->message_identity.source_guid ): msg->message_identity.source_guid;
+  ddsi_guid_t rmguid = conv ? nn_ntoh_guid(msg->related_message_identity.source_guid) : msg->related_message_identity.source_guid;
+  ddsi_guid_t dpguid = conv ? nn_ntoh_guid(msg->destination_participant_guid) : msg->destination_participant_guid;
+  ddsi_guid_t deguid = conv ? nn_ntoh_guid(msg->destination_endpoint_guid) : msg->destination_endpoint_guid;
+  ddsi_guid_t seguid = conv ? nn_ntoh_guid(msg->source_endpoint_guid) : msg->source_endpoint_guid;
+
+  GVTRACE (" msg=");
+  GVTRACE("mi=" PGUIDFMT "#%" PRId64 ",", PGUID(spguid), msg->message_identity.sequence_number);
+  GVTRACE("rmi=" PGUIDFMT "#%" PRId64 ",", PGUID(rmguid), msg->related_message_identity.sequence_number);
+  GVTRACE("dpg=" PGUIDFMT ",", PGUID(dpguid));
+  GVTRACE("deg=" PGUIDFMT ",", PGUID(deguid));
+  GVTRACE("seg=" PGUIDFMT ",", PGUID(seguid));
+  GVTRACE("cid=%s", msg->message_class_id);
+#ifdef SECURITY_LOG_MESSAGE_DATA
+  nn_dataholder_seq_log(gv, ",mdata", &msg->message_data);
+#endif
+  GVTRACE ("\n");
+}
+
+bool write_auth_handshake_message(const struct participant *pp, const struct proxy_participant *proxypp, nn_dataholderseq_t *mdata, bool request, const nn_message_identity_t *related_message_id)
+{
+  struct ddsi_domaingv *gv = pp->e.gv;
+  struct nn_participant_generic_message pmg;
+  struct ddsi_serdata *serdata;
+  unsigned char *blob;
+  size_t len;
+  struct writer *wr;
+  int64_t seq;
+  struct proxy_reader *prd;
+  ddsi_guid_t prd_guid;
+  bool result = false;
+
+  if ((wr = get_builtin_writer (pp, NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_STATELESS_MESSAGE_WRITER)) == NULL) {
+    GVTRACE ("write_handshake("PGUIDFMT") - builtin stateless message writer not found", PGUID (pp->e.guid));
+    return false;
+  }
+
+  prd_guid.prefix = proxypp->e.guid.prefix;
+  prd_guid.entityid.u = NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_STATELESS_MESSAGE_READER;
+  if ((prd = entidx_lookup_proxy_reader_guid (gv->entity_index, &prd_guid)) == NULL) {
+    GVTRACE ("write_handshake("PGUIDFMT") - builtin stateless message proxy reader not found", PGUID (prd_guid));
+    return false;
+  }
+
+  ddsrt_mutex_lock (&wr->e.lock);
+  seq = ++wr->seq;
+
+  if (request) {
+    nn_participant_generic_message_init(&pmg, &wr->e.guid, seq, &proxypp->e.guid, NULL, NULL, DDS_SECURITY_AUTH_REQUEST, mdata, NULL);
+  } else {
+    nn_participant_generic_message_init(&pmg, &wr->e.guid, seq, &proxypp->e.guid, NULL, NULL, DDS_SECURITY_AUTH_HANDSHAKE, mdata, related_message_id);
+  }
+
+  if (nn_participant_generic_message_serialize(&pmg, &blob, &len) != DDS_RETCODE_OK)
+    return false;
+
+  GVTRACE("write_handshake("PGUIDFMT" --> "PGUIDFMT")(lguid="PGUIDFMT" rguid="PGUIDFMT") ",
+      PGUID (wr->e.guid), PGUID (prd_guid),
+      PGUID (pp->e.guid), PGUID (proxypp->e.guid));
+  nn_participant_generic_message_log(gv, &pmg, 1);
+
+  struct ddsi_rawcdr_sample raw = {
+      .blob = blob,
+      .size = len,
+      .key = NULL,
+      .keysize = 0
+  };
+  serdata = ddsi_serdata_from_sample (gv->rawcdr_topic, SDK_DATA, &raw);
+  serdata->timestamp = now ();
+
+  result = enqueue_sample_wrlock_held (wr, seq, NULL, serdata, prd, 1) == 0;
+  ddsi_serdata_unref (serdata);
+  dds_free(blob);
+
+  ddsrt_mutex_unlock (&wr->e.lock);
+  nn_participant_generic_message_deinit(&pmg);
+
+  return result;
+}
+
+void auth_get_serialized_participant_data(struct participant *pp, ddsi_octetseq_t *seq)
+{
+  struct nn_xmsg *mpayload;
+  size_t sz;
+  char *payload;
+
+  mpayload = nn_xmsg_new (pp->e.gv->xmsgpool, &pp->e.guid, pp, 0, NN_XMSG_KIND_DATA);
+
+  get_participant_builtin_topic_data(pp, mpayload, true);
+  payload = nn_xmsg_payload (&sz, mpayload);
+
+  seq->length = (uint32_t)sz;
+  seq->value = ddsrt_malloc(sz);
+  memcpy(seq->value, payload, sz);
+  nn_xmsg_free (mpayload);
+}
+
+void handle_auth_handshake_message(const struct receiver_state *rst, ddsi_entityid_t wr_entity_id, nn_wctime_t timestamp, unsigned statusinfo, const void *vdata, size_t len)
+{
+  const struct CDRHeader *hdr = vdata; /* built-ins not deserialized (yet) */
+  const bool bswap = (hdr->identifier == CDR_LE) ^ DDSRT_LITTLE_ENDIAN;
+  const void *data = (void *) (hdr + 1);
+  size_t size = (len - sizeof(struct CDRHeader));
+  struct nn_participant_generic_message msg;
+  struct participant *pp = NULL;
+  struct proxy_writer *pwr = NULL;
+  ddsi_guid_t guid;
+  ddsi_guid_t *pwr_guid;
+  struct ddsi_handshake *handshake;
+
+  DDSRT_UNUSED_ARG(wr_entity_id);
+  DDSRT_UNUSED_ARG(timestamp);
+
+  RSTTRACE ("recv_handshake ST%x", statusinfo);
+  if ((hdr->identifier != CDR_LE) && (hdr->identifier != PL_CDR_LE) &&
+      (hdr->identifier != CDR_BE) && (hdr->identifier != PL_CDR_BE))
+  {
+    RSTTRACE (" data->identifier %d !?\n", ntohs (hdr->identifier));
+    return;
+  }
+
+  if (nn_participant_generic_message_deseralize(&msg, data, size, bswap) < 0)
+  {
+    RSTTRACE ("deserialize failed\n");
+    goto err_deser;
+  }
+
+  nn_participant_generic_message_log(rst->gv, &msg, 0);
+
+  if (msg.message_identity.source_guid.entityid.u == NN_ENTITYID_PARTICIPANT)
+  {
+    guid = msg.message_identity.source_guid;
+    guid.entityid.u = NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_STATELESS_MESSAGE_WRITER;
+    pwr_guid= &guid;
+  }
+  else if (msg.message_identity.source_guid.entityid.u == NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_STATELESS_MESSAGE_WRITER)
+  {
+    pwr_guid= &msg.message_identity.source_guid;
+  }
+  else
+  {
+    RSTTRACE ("invalid source entity id\n");
+    goto invalid_source;
+  }
+
+  if ((pp = entidx_lookup_participant_guid(rst->gv->entity_index, &msg.destination_participant_guid)) == NULL)
+  {
+    RSTTRACE ("destination participant ("PGUIDFMT") not found\n", PGUID(msg.destination_participant_guid));
+  }
+  else if ((pwr = entidx_lookup_proxy_writer_guid(rst->gv->entity_index, pwr_guid)) == NULL)
+  {
+    RSTTRACE ("proxy writer ("PGUIDFMT") not found\n", PGUID(*pwr_guid));
+  }
+  else if ((handshake = ddsi_handshake_find(pp, pwr->c.proxypp)) == NULL)
+  {
+    RSTTRACE ("handshake not found ("PGUIDFMT" --> "PGUIDFMT")\n", PGUID (pwr->c.proxypp->e.guid), PGUID(pp->e.guid));
+  }
+  else
+  {
+//    RSTTRACE (" ("PGUIDFMT" --> "PGUIDFMT")\n", PGUID (pwr->c.proxypp->e.guid), PGUID (pp->e.guid));
+    ddsi_handshake_handle_message(handshake, pp, pwr->c.proxypp, &msg);
+    ddsi_handshake_release(handshake);
+  }
+
+invalid_source:
+  nn_participant_generic_message_deinit(&msg);
+err_deser:
+  return;
+}
+
+static bool write_crypto_exchange_message(const struct participant *pp, const ddsi_guid_t *dst_pguid, const ddsi_guid_t *src_eguid, const ddsi_guid_t *dst_eguid, const char *classid, const nn_dataholderseq_t *tokens)
+{
+  struct ddsi_domaingv * const gv = pp->e.gv;
+  struct nn_participant_generic_message pmg;
+  struct ddsi_tkmap_instance *tk;
+  struct ddsi_serdata *serdata;
+  struct proxy_reader *prd;
+  ddsi_guid_t prd_guid;
+  unsigned char *data;
+  size_t len;
+  struct writer *wr;
+  seqno_t seq;
+  int r;
+
+  if ((wr = get_builtin_writer (pp, NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_VOLATILE_SECURE_WRITER)) == NULL)
+  {
+    GVLOG (DDS_LC_DISCOVERY, "write_crypto_exchange_message("PGUIDFMT") - builtin volatile secure writer not found\n", PGUID (pp->e.guid));
+    return false;
+  }
+
+  prd_guid.prefix = dst_pguid->prefix;
+  prd_guid.entityid.u = NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_VOLATILE_SECURE_READER;
+  if ((prd = entidx_lookup_proxy_reader_guid (gv->entity_index, &prd_guid)) == NULL)
+    return false;
+
+  GVLOG (DDS_LC_DISCOVERY, "send crypto tokens("PGUIDFMT" --> "PGUIDFMT")\n", PGUID (wr->e.guid), PGUID (prd_guid));
+
+  ddsrt_mutex_lock (&wr->e.lock);
+  seq = ++wr->seq;
+
+  /* Get serialized message. */
+  nn_participant_generic_message_init(&pmg, &wr->e.guid, seq, dst_pguid, dst_eguid, src_eguid, classid, tokens, NULL);
+  nn_participant_generic_message_serialize(&pmg, &data, &len);
+
+  /* Get the key value. */
+  ddsrt_md5_state_t md5st;
+  ddsrt_md5_byte_t digest[16];
+  ddsrt_md5_init (&md5st);
+  ddsrt_md5_append (&md5st, (const ddsrt_md5_byte_t *)data, sizeof (nn_message_identity_t));
+  ddsrt_md5_finish (&md5st, digest);
+
+  /* Write the sample. */
+  struct ddsi_rawcdr_sample raw = {
+    .blob = data,
+    .size = len,
+    .key = digest,
+    .keysize = 16
+  };
+  serdata = ddsi_serdata_from_sample (gv->rawcdr_topic, SDK_DATA, &raw);
+  tk = ddsi_tkmap_lookup_instance_ref (gv->m_tkmap, serdata);
+  ddsrt_mutex_unlock (&wr->e.lock);
+  ddsrt_free(data);
+
+  r = write_sample_p2p_wrlock_held(wr, seq, NULL, serdata, tk, prd);
+  ddsi_tkmap_instance_unref (gv->m_tkmap, tk);
+  ddsi_serdata_unref (serdata);
+
+  nn_participant_generic_message_deinit(&pmg);
+
+  return (r < 0 ? false : true);
+}
+
+bool write_crypto_participant_tokens(const struct participant *pp, const struct proxy_participant *proxypp, const nn_dataholderseq_t *tokens)
+{
+  return write_crypto_exchange_message(pp, &proxypp->e.guid, NULL, NULL, GMCLASSID_SECURITY_PARTICIPANT_CRYPTO_TOKENS, tokens);
+}
+
+bool write_crypto_writer_tokens(const struct writer *wr, const struct proxy_reader *prd, const nn_dataholderseq_t *tokens)
+{
+  struct participant *pp = wr->c.pp;
+  struct proxy_participant *proxypp = prd->c.proxypp;
+
+  return write_crypto_exchange_message(pp, &proxypp->e.guid, &wr->e.guid, &prd->e.guid, GMCLASSID_SECURITY_DATAWRITER_CRYPTO_TOKENS, tokens);
+}
+
+bool write_crypto_reader_tokens(const struct reader *rd, const struct proxy_writer *pwr, const nn_dataholderseq_t *tokens)
+{
+  struct participant *pp = rd->c.pp;
+  struct proxy_participant *proxypp = pwr->c.proxypp;
+
+  return write_crypto_exchange_message(pp, &proxypp->e.guid, &rd->e.guid, &pwr->e.guid, GMCLASSID_SECURITY_DATAREADER_CRYPTO_TOKENS, tokens);
+}
+
+void handle_crypto_exchange_message(const struct receiver_state *rst, ddsi_entityid_t wr_entity_id, nn_wctime_t timestamp, unsigned statusinfo, const void *vdata, unsigned len)
+{
+  struct ddsi_domaingv *gv = rst->gv;
+  const struct CDRHeader *hdr = vdata; /* built-ins not deserialized (yet) */
+  const int bswap = (hdr->identifier == CDR_LE) ^ DDSRT_LITTLE_ENDIAN;
+  const void *data = (void *) (hdr + 1);
+  unsigned size = (unsigned)(len - sizeof(struct CDRHeader));
+  struct nn_participant_generic_message msg;
+  ddsi_guid_t rd_guid;
+  ddsi_guid_t pwr_guid;
+  ddsi_guid_t proxypp_guid;
+  struct participant *pp;
+  struct proxy_participant *proxypp;
+
+  DDSRT_UNUSED_ARG(timestamp);
+
+  rd_guid.prefix = rst->dst_guid_prefix;
+  rd_guid.entityid.u = NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_VOLATILE_SECURE_READER;
+  pwr_guid.prefix = rst->src_guid_prefix;
+  pwr_guid.entityid = wr_entity_id;
+
+  GVTRACE ("recv crypto tokens ("PGUIDFMT" --> "PGUIDFMT") ST%x", PGUID (pwr_guid), PGUID (rd_guid), statusinfo);
+
+  memset(&msg, 0, sizeof(msg));
+  if (nn_participant_generic_message_deseralize(&msg, data, size, bswap) < 0)
+    goto deser_msg_failed;
+
+  nn_participant_generic_message_log(gv, &msg, 0);
+
+  if (!msg.message_class_id)
+  {
+    ddsi_guid_t guid;
+    guid.prefix = rst->dst_guid_prefix;
+    guid.entityid.u = NN_ENTITYID_PARTICIPANT;
+    GVWARNING("participant "PGUIDFMT" received a crypto exchange message with empty class_id", PGUID(guid));
+    goto invalid_msg;
+  }
+
+  proxypp_guid.prefix = msg.message_identity.source_guid.prefix;
+  proxypp_guid.entityid.u = NN_ENTITYID_PARTICIPANT;
+
+  if (strcmp(GMCLASSID_SECURITY_PARTICIPANT_CRYPTO_TOKENS, msg.message_class_id) == 0)
+  {
+    pp = entidx_lookup_participant_guid(gv->entity_index, &msg.destination_participant_guid);
+    if (!pp)
+    {
+      GVWARNING("received a crypto exchange message from "PGUIDFMT" with participant unknown "PGUIDFMT, PGUID(proxypp_guid), PGUID(msg.destination_participant_guid));
+      goto invalid_msg;
+    }
+    proxypp = entidx_lookup_proxy_participant_guid(gv->entity_index, &proxypp_guid);
+    if (!proxypp)
+    {
+      GVWARNING("received a crypto exchange message from "PGUIDFMT" with proxy participant unknown "PGUIDFMT, PGUID(proxypp_guid), PGUID(msg.destination_participant_guid));
+      goto invalid_msg;
+    }
+    q_omg_security_set_participant_crypto_tokens(pp, proxypp, &msg.message_data);
+  }
+  else if (strcmp(GMCLASSID_SECURITY_DATAWRITER_CRYPTO_TOKENS, msg.message_class_id) == 0)
+  {
+    struct reader *rd;
+
+    rd = entidx_lookup_reader_guid(gv->entity_index, &msg.destination_endpoint_guid);
+    if (!rd)
+    {
+      GVWARNING("received a crypto exchange message from "PGUIDFMT" with reader unknown "PGUIDFMT, PGUID(proxypp_guid), PGUID(msg.destination_participant_guid));
+      goto invalid_msg;
+    }
+    q_omg_security_set_remote_writer_crypto_tokens(rd, &msg.source_endpoint_guid, &msg.message_data);
+  }
+  else if (strcmp(GMCLASSID_SECURITY_DATAREADER_CRYPTO_TOKENS, msg.message_class_id) == 0)
+  {
+    struct writer *wr;
+
+    wr = entidx_lookup_writer_guid(gv->entity_index, &msg.destination_endpoint_guid);
+    if (!wr)
+    {
+      GVWARNING("received a crypto exchange message from "PGUIDFMT" with writer unknown "PGUIDFMT, PGUID(proxypp_guid), PGUID(msg.destination_participant_guid));
+      goto invalid_msg;
+    }
+    q_omg_security_set_remote_reader_crypto_tokens(wr, &msg.source_endpoint_guid, &msg.message_data);
+  }
+  else
+  {
+    ddsi_guid_t guid;
+    guid.prefix = rst->dst_guid_prefix;
+    guid.entityid.u = NN_ENTITYID_PARTICIPANT;
+    GVWARNING("participant "PGUIDFMT" received a crypto exchange message with unknown class_id", PGUID(guid));
+  }
+
+invalid_msg:
+  nn_participant_generic_message_deinit(&msg);
+deser_msg_failed:
+  return;
+}
+
+
+#endif /* DDSI_INCLUDE_SECURITY */
diff --git a/src/core/ddsi/src/ddsi_security_msg.c b/src/core/ddsi/src/ddsi_security_msg.c
index a0bbe77..8838327 100644
--- a/src/core/ddsi/src/ddsi_security_msg.c
+++ b/src/core/ddsi/src/ddsi_security_msg.c
@@ -14,7 +14,6 @@
 #include "dds/ddsrt/md5.h"
 #include "dds/ddsrt/heap.h"
 #include "dds/ddsrt/string.h"
-#include "dds/ddsi/ddsi_plist.h"
 #include "dds/ddsi/q_bswap.h"
 #include "dds/ddsi/q_entity.h"
 #include "dds/ddsi/q_transmit.h"
@@ -23,6 +22,9 @@
 #include "dds/ddsi/ddsi_entity_index.h"
 #include "dds/ddsi/ddsi_security_msg.h"
 #include "dds/ddsi/ddsi_plist_generic.h"
+#include "dds/ddsi/ddsi_plist.h"
+#include "dds/security/core/dds_security_utils.h"
+
 
 const enum pserop pserop_participant_generic_message[] =
 {
@@ -56,6 +58,8 @@ alias_simple_sequence(ddsi_octetseq_t *dst, const ddsi_octetseq_t *src, size_t e
     /* Even when aliased, sequence buffers are not shared. */
     dst->value = ddsrt_memdup(src->value, src->length * elem_size);
   }
+  else
+    dst->value = NULL;
 }
 
 static void
@@ -83,6 +87,8 @@ alias_dataholderseq(nn_dataholderseq_t *dst, const nn_dataholderseq_t *src)
       alias_dataholder(&(dst->tags[i]), &(src->tags[i]));
     }
   }
+  else
+    dst->tags = NULL;
 }
 
 void
@@ -155,76 +161,6 @@ nn_participant_generic_message_deseralize(
   return plist_deser_generic (msg, data, len, bswap, pserop_participant_generic_message);
 }
 
-int
-write_crypto_exchange_message(
-   const struct participant *pp,
-   const ddsi_guid_t *dst_pguid,
-   const ddsi_guid_t *src_eguid,
-   const ddsi_guid_t *dst_eguid,
-   const char *classid,
-   const nn_dataholderseq_t *tokens)
-{
-  struct ddsi_domaingv * const gv = pp->e.gv;
-  struct nn_participant_generic_message pmg;
-  struct ddsi_tkmap_instance *tk;
-  struct ddsi_serdata *serdata;
-  struct proxy_reader *prd;
-  ddsi_guid_t prd_guid;
-  unsigned char *data;
-  size_t len;
-  struct writer *wr;
-  seqno_t seq;
-  int r;
-
-  if ((wr = get_builtin_writer (pp, NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_VOLATILE_SECURE_WRITER)) == NULL)
-  {
-    GVLOG (DDS_LC_DISCOVERY, "write_crypto_exchange_message("PGUIDFMT") - builtin volatile secure writer not found\n", PGUID (pp->e.guid));
-    return -1;
-  }
-
-  prd_guid.prefix = dst_pguid->prefix;
-  prd_guid.entityid.u = NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_VOLATILE_SECURE_READER;
-  if ((prd = entidx_lookup_proxy_reader_guid (gv->entity_index, &prd_guid)) == NULL)
-  {
-    return -1;
-  }
-
-  GVLOG (DDS_LC_DISCOVERY, "send crypto tokens("PGUIDFMT" --> "PGUIDFMT")\n", PGUID (wr->e.guid), PGUID (prd_guid));
-
-  ddsrt_mutex_lock (&wr->e.lock);
-  seq = ++wr->seq;
-
-  /* Get serialized message. */
-  nn_participant_generic_message_init(&pmg, &wr->e.guid, seq, dst_pguid, dst_eguid, src_eguid, classid, tokens, NULL);
-  nn_participant_generic_message_serialize(&pmg, &data, &len);
-
-  /* Get the key value. */
-  ddsrt_md5_state_t md5st;
-  ddsrt_md5_byte_t digest[16];
-  ddsrt_md5_init (&md5st);
-  ddsrt_md5_append (&md5st, (const ddsrt_md5_byte_t *)data, sizeof (nn_message_identity_t));
-  ddsrt_md5_finish (&md5st, digest);
-
-  /* Write the sample. */
-  struct ddsi_rawcdr_sample raw = {
-    .blob = data,
-    .size = len,
-    .key = digest,
-    .keysize = 16
-  };
-  serdata = ddsi_serdata_from_sample (gv->rawcdr_topic, SDK_DATA, &raw);
-  tk = ddsi_tkmap_lookup_instance_ref (gv->m_tkmap, serdata);
-  r = write_sample_p2p_wrlock_held(wr, seq, NULL, serdata, tk, prd);
-  ddsi_tkmap_instance_unref (gv->m_tkmap, tk);
-  ddsi_serdata_unref (serdata);
-
-  nn_participant_generic_message_deinit(&pmg);
-
-  ddsrt_mutex_unlock (&wr->e.lock);
-
-  return r;
-}
-
 int volatile_secure_data_filter(struct writer *wr, struct proxy_reader *prd, struct ddsi_serdata *serdata)
 {
   static const size_t guid_offset = offsetof(nn_participant_generic_message_t, destination_participant_guid);
@@ -239,7 +175,8 @@ int volatile_secure_data_filter(struct writer *wr, struct proxy_reader *prd, str
   assert(prd);
   assert(serdata);
 
-  (void)ddsi_serdata_to_ser_ref(serdata, guid_offset, sizeof(ddsi_guid_t), &guid_ref);
+  /* guid_offset + 4 because 4 bytes header is at 0 */
+  (void)ddsi_serdata_to_ser_ref(serdata, guid_offset + 4, sizeof(ddsi_guid_t), &guid_ref);
   assert(guid_ref.iov_len == sizeof(ddsi_guid_t));
   assert(guid_ref.iov_base);
   msg_guid = (ddsi_guid_t*)guid_ref.iov_base;
diff --git a/src/core/ddsi/src/ddsi_security_omg.c b/src/core/ddsi/src/ddsi_security_omg.c
index f118f41..8e3808d 100644
--- a/src/core/ddsi/src/ddsi_security_omg.c
+++ b/src/core/ddsi/src/ddsi_security_omg.c
@@ -12,17 +12,24 @@
 #ifdef DDSI_INCLUDE_SECURITY
 
 #include <string.h>
+#include <stdarg.h>
 
-#include "dds/ddsrt/misc.h"
 #include "dds/ddsrt/heap.h"
-#include "dds/ddsrt/bswap.h"
 #include "dds/ddsrt/string.h"
-#include "dds/ddsrt/process.h"
+#include "dds/ddsrt/misc.h"
+#include "dds/ddsrt/avl.h"
 
+#include "dds/ddsi/ddsi_domaingv.h"
+#include "dds/ddsi/q_unused.h"
 #include "dds/ddsi/q_bswap.h"
 #include "dds/ddsi/q_radmin.h"
+#include "dds/ddsi/q_misc.h"
 #include "dds/ddsi/ddsi_entity_index.h"
+#include "dds/ddsi/ddsi_security_msg.h"
 #include "dds/ddsi/ddsi_security_omg.h"
+#include "dds/ddsi/ddsi_security_util.h"
+#include "dds/ddsi/ddsi_security_exchange.h"
+#include "dds/ddsi/ddsi_handshake.h"
 #include "dds/ddsi/ddsi_sertopic.h"
 #include "dds/ddsi/q_config.h"
 #include "dds/ddsi/q_log.h"
@@ -35,30 +42,79 @@
 #include "dds/ddsi/q_entity.h"
 #include "dds/ddsi/q_xevent.h"
 #include "dds/ddsi/ddsi_plist.h"
+#include "dds/ddsi/sysdeps.h"
 
 #define AUTH_NAME "Authentication"
 #define AC_NAME "Access Control"
 #define CRYPTO_NAME "Cryptographic"
 
-#define SECURITY_EXCEPTION_INIT {NULL, 0, 0}
+#define EXCEPTION_LOG(sc,e,cat, ...) \
+  q_omg_log_exception(sc->logcfg, cat, e, __FILE__, __LINE__, DDS_FUNCTION, __VA_ARGS__)
 
-struct dds_security_context {
-  dds_security_plugin auth_plugin;
-  dds_security_plugin ac_plugin;
-  dds_security_plugin crypto_plugin;
+#define EXCEPTION_ERROR(s, e, ...)     EXCEPTION_LOG(s, e, DDS_LC_ERROR, __VA_ARGS__)
+#define EXCEPTION_WARNING(s, e, ...)   EXCEPTION_LOG(s, e, DDS_LC_WARNING, __VA_ARGS__)
 
-  dds_security_authentication *authentication_context;
-  dds_security_cryptography *crypto_context;
-  dds_security_access_control *access_control_context;
-  ddsrt_mutex_t omg_security_lock;
-  uint32_t next_plugin_id;
 
-  const struct ddsrt_log_cfg *logcfg;
-};
+#define SECURITY_ATTR_IS_VALID(attr)                                      \
+    ((attr) & NN_ENDPOINT_SECURITY_ATTRIBUTES_FLAG_IS_VALID)
 
-typedef struct dds_security_context dds_security_context;
+/* Security attributes are compatible ... */
+#define SECURITY_ATTR_COMPATIBLE(attr_a, attr_b, is_valid_flag)           \
+(                                                                         \
+    /* ... if masks are equal ... */                                      \
+    (attr_a == attr_b)                                                    \
+    ||                                                                    \
+    /* ... or if either of the masks is not valid ... */                  \
+    (((attr_a & is_valid_flag) == 0) || ((attr_b & is_valid_flag) == 0))  \
+)
 
-static bool q_omg_writer_is_payload_protected (const struct writer *wr);
+/* Security information are compatible ... */
+#define SECURITY_INFO_COMPATIBLE(info_a, info_b, is_valid_flag)           \
+(                                                                         \
+    /* ... if plugin attributes are compatible ... */                     \
+    SECURITY_ATTR_COMPATIBLE(info_a.plugin_security_attributes,           \
+                             info_b.plugin_security_attributes,           \
+                             is_valid_flag)                               \
+    &&                                                                    \
+    /* ... and spec attributes are compatible ... */                      \
+    SECURITY_ATTR_COMPATIBLE(info_a.security_attributes,                  \
+                             info_b.security_attributes,                  \
+                             is_valid_flag)                               \
+)
+
+/* Security information indicates clear data ... */
+#define SECURITY_INFO_CLEAR(info, is_valid_flag)                          \
+(                                                                         \
+    /* ... if no flag was set (ignoring the is_valid flag) ... */         \
+    (info.security_attributes & (~is_valid_flag)) == 0                    \
+)
+
+#define SECURITY_INFO_IS_RTPS_PROTECTED(info)                                                 \
+(                                                                                             \
+    (info.security_attributes & NN_PARTICIPANT_SECURITY_ATTRIBUTES_FLAG_IS_VALID         ) && \
+    (info.security_attributes & NN_PARTICIPANT_SECURITY_ATTRIBUTES_FLAG_IS_RTPS_PROTECTED)    \
+)
+
+#define SECURITY_INFO_IS_WRITE_PROTECTED(info)                                              \
+(                                                                                           \
+    (info.security_attributes & NN_ENDPOINT_SECURITY_ATTRIBUTES_FLAG_IS_VALID          ) && \
+    (info.security_attributes & NN_ENDPOINT_SECURITY_ATTRIBUTES_FLAG_IS_WRITE_PROTECTED)    \
+)
+
+#define SECURITY_INFO_IS_READ_PROTECTED(info)                                               \
+(                                                                                           \
+    (info.security_attributes & NN_ENDPOINT_SECURITY_ATTRIBUTES_FLAG_IS_VALID          ) && \
+    (info.security_attributes & NN_ENDPOINT_SECURITY_ATTRIBUTES_FLAG_IS_READ_PROTECTED )    \
+)
+
+#define SECURITY_INFO_IS_RTPS_PROTECTED(info)                                                 \
+(                                                                                             \
+    (info.security_attributes & NN_PARTICIPANT_SECURITY_ATTRIBUTES_FLAG_IS_VALID         ) && \
+    (info.security_attributes & NN_PARTICIPANT_SECURITY_ATTRIBUTES_FLAG_IS_RTPS_PROTECTED)    \
+)
+
+#define SECURITY_INFO_USE_RTPS_AUTHENTICATION(info) \
+    ((info).plugin_participant_attributes & DDS_SECURITY_PLUGIN_PARTICIPANT_ATTRIBUTES_FLAG_IS_RTPS_AUTHENTICATED)
 
 static bool endpoint_is_DCPSParticipantSecure (const ddsi_guid_t *guid)
 {
@@ -92,14 +148,415 @@ static bool endpoint_is_DCPSParticipantMessageSecure (const ddsi_guid_t *guid)
 
 static bool endpoint_is_DCPSParticipantVolatileMessageSecure (const ddsi_guid_t *guid)
 {
-#if 1
-  /* TODO: volatile endpoint. */
-  DDSRT_UNUSED_ARG(guid);
-  return false;
-#else
   return ((guid->entityid.u == NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_VOLATILE_SECURE_WRITER) ||
           (guid->entityid.u == NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_VOLATILE_SECURE_READER));
-#endif
+}
+
+struct participant_sec_index {
+  ddsrt_mutex_t lock;
+  ddsrt_avl_ctree_t participants;
+};
+
+struct dds_security_context {
+  dds_security_plugin auth_plugin;
+  dds_security_plugin ac_plugin;
+  dds_security_plugin crypto_plugin;
+
+  dds_security_authentication *authentication_context;
+  dds_security_cryptography *crypto_context;
+  dds_security_access_control *access_control_context;
+  ddsrt_mutex_t omg_security_lock;
+  uint32_t next_plugin_id;
+
+  struct participant_sec_index partiticpant_index;
+
+  const struct ddsrt_log_cfg *logcfg;
+};
+
+typedef struct dds_security_context dds_security_context;
+
+static int compare_guid(const void *va, const void *vb);
+static int compare_crypto_handle (const void *va, const void *vb);
+static int compare_guid_pair(const void *va, const void *vb);
+
+const ddsrt_avl_ctreedef_t pp_proxypp_treedef =
+    DDSRT_AVL_CTREEDEF_INITIALIZER (offsetof (struct pp_proxypp_match, avlnode), offsetof (struct pp_proxypp_match, proxypp_guid), compare_guid, 0);
+const ddsrt_avl_treedef_t proxypp_pp_treedef =
+  DDSRT_AVL_TREEDEF_INITIALIZER (offsetof (struct proxypp_pp_match, avlnode), offsetof (struct proxypp_pp_match, pp_crypto_handle), compare_crypto_handle, 0);
+const ddsrt_avl_treedef_t entity_match_treedef =
+  DDSRT_AVL_TREEDEF_INITIALIZER (offsetof (struct security_entity_match, avlnode), offsetof (struct security_entity_match, guids), compare_guid_pair, 0);
+const ddsrt_avl_ctreedef_t participant_index_treedef =
+    DDSRT_AVL_CTREEDEF_INITIALIZER (offsetof (struct participant_sec_attributes, avlnode), offsetof (struct participant_sec_attributes, crypto_handle), compare_crypto_handle, 0);
+
+static int compare_crypto_handle (const void *va, const void *vb)
+{
+  const DDS_Security_ParticipantCryptoHandle *ha = va;
+  const DDS_Security_ParticipantCryptoHandle *hb = vb;
+
+  return ((*ha > *hb) ? 1 : (*ha < *hb) ?  -1 : 0);
+}
+
+static int guid_compare (const ddsi_guid_t *guid1, const ddsi_guid_t *guid2)
+{
+  return memcmp (guid1, guid2, sizeof (ddsi_guid_t));
+}
+
+static int compare_guid(const void *va, const void *vb)
+{
+  const ddsi_guid_t *ga = va;
+  const ddsi_guid_t *gb = vb;
+
+  return guid_compare(ga, gb);
+}
+
+static int compare_guid_pair(const void *va, const void *vb)
+{
+  const struct guid_pair *na = va;
+  const struct guid_pair *nb = vb;
+  int r;
+
+  if ((r = guid_compare(&na->src, &nb->src)) == 0)
+    r = guid_compare(&na->dst, &nb->dst);
+  return r;
+}
+
+static struct dds_security_context * q_omg_security_get_secure_context(const struct participant *pp)
+{
+  if (pp && pp->e.gv->security_context && q_omg_is_security_loaded(pp->e.gv->security_context))
+    return pp->e.gv->security_context;
+  return NULL;
+}
+
+struct dds_security_authentication *q_omg_participant_get_authentication(const struct participant *pp)
+{
+  if (pp && pp->e.gv->security_context && q_omg_is_security_loaded(pp->e.gv->security_context))
+    return pp->e.gv->security_context->authentication_context;
+  return NULL;
+}
+
+static struct dds_security_context * q_omg_security_get_secure_context_from_proxypp(const struct proxy_participant *proxypp)
+{
+  if (proxypp && proxypp->e.gv->security_context && q_omg_is_security_loaded(proxypp->e.gv->security_context))
+    return proxypp->e.gv->security_context;
+  return NULL;
+}
+
+void q_omg_log_exception(const struct ddsrt_log_cfg *lc, uint32_t cat, DDS_Security_SecurityException *exception, const char *file, uint32_t line, const char *func, const char *fmt, ...)
+{
+  char logbuffer[512];
+  va_list ap;
+  int l;
+
+  va_start (ap, fmt);
+  l = vsnprintf(logbuffer, sizeof(logbuffer), fmt, ap);
+  va_end (ap);
+  if ((size_t) l >= sizeof(logbuffer))
+  {
+    logbuffer[sizeof(logbuffer)-1] = '\0';
+  }
+  dds_log_cfg(lc, cat, file, line, func, "%s: %s(code: %d)\n", logbuffer, exception->message ? exception->message : "",  exception->code);
+  DDS_Security_Exception_reset(exception);
+}
+
+static struct security_entity_match * entity_match_new(const ddsi_guid_t *src, const ddsi_guid_t *dst)
+{
+  struct security_entity_match *match;
+
+  match = ddsrt_malloc(sizeof(*match));
+  match->guids.src = *src;
+  match->guids.dst = *dst;
+  match->matched = false;
+  match->crypto_handle = 0;
+  match->tokens = NULL;
+
+  return match;
+}
+
+static void entity_match_free(struct security_entity_match *match)
+{
+  if (match) {
+    if (match->tokens)
+      DDS_Security_ParticipantCryptoTokenSeq_free(match->tokens);
+    ddsrt_free(match);
+  }
+}
+
+static struct security_entity_match * find_entity_match_locked(struct dds_security_match_index *list, const ddsi_guid_t *src, const ddsi_guid_t *dst)
+{
+  struct guid_pair guids;
+
+  guids.src = *src;
+  guids.dst = *dst;
+
+  return ddsrt_avl_lookup(&entity_match_treedef, &list->matches, &guids);
+}
+
+static struct security_entity_match * find_or_create_entity_match(struct dds_security_match_index *list, const ddsi_guid_t *src, const ddsi_guid_t *dst)
+{
+  struct security_entity_match *match;
+
+  ddsrt_mutex_lock(&list->lock);
+  match = find_entity_match_locked(list, src, dst);
+  if (!match)
+  {
+    match = entity_match_new(src, dst);
+    ddsrt_avl_insert(&entity_match_treedef, &list->matches, match);
+  }
+  ddsrt_mutex_unlock(&list->lock);
+
+  return match;
+}
+
+static struct security_entity_match * remove_entity_match(struct dds_security_match_index *list, const ddsi_guid_t *src, const ddsi_guid_t *dst)
+{
+  struct security_entity_match *match;
+  struct guid_pair guids;
+  ddsrt_avl_dpath_t path;
+
+  guids.src = *src;
+  guids.dst = *dst;
+
+  ddsrt_mutex_lock(&list->lock);
+  match = ddsrt_avl_lookup_dpath(&entity_match_treedef, &list->matches, &guids, &path);
+  if (match)
+    ddsrt_avl_delete_dpath(&entity_match_treedef, &list->matches, match, &path);
+  ddsrt_mutex_unlock(&list->lock);
+
+  return match;
+}
+
+static struct dds_security_match_index * security_match_index_new(void)
+{
+  struct dds_security_match_index *list;
+
+  list  = ddsrt_malloc (sizeof(*list));
+  ddsrt_mutex_init (&list->lock);
+  ddsrt_avl_init (&entity_match_treedef, &list->matches);
+  return list;
+}
+
+static void entity_match_free_wrapper(void *arg)
+{
+  struct security_entity_match *match = arg;
+  entity_match_free(match);
+}
+
+static void security_match_index_free(struct dds_security_match_index *list)
+{
+  if (list)
+  {
+    ddsrt_avl_free (&entity_match_treedef, &list->matches, entity_match_free_wrapper);
+    ddsrt_mutex_destroy(&list->lock);
+    ddsrt_free(list);
+  }
+}
+
+static struct pp_proxypp_match * pp_proxypp_match_new(struct proxy_participant *proxypp, DDS_Security_ParticipantCryptoHandle proxypp_crypto_handle)
+{
+  struct pp_proxypp_match *pm;
+
+  pm = ddsrt_malloc(sizeof(*pm));
+  pm->proxypp_guid = proxypp->e.guid;
+  pm->proxypp_crypto_handle = proxypp_crypto_handle;
+
+  return pm;
+}
+
+static void pp_proxypp_match_free(struct dds_security_context *sc, struct pp_proxypp_match *pm)
+{
+  DDSRT_UNUSED_ARG(sc);
+
+  ddsrt_free(pm);
+}
+
+static struct proxypp_pp_match * proxypp_pp_match_new(struct participant *pp, DDS_Security_PermissionsHandle permissions_hdl, DDS_Security_SharedSecretHandle shared_secret)
+{
+  struct proxypp_pp_match *pm;
+
+  pm = ddsrt_malloc(sizeof(*pm));
+  pm->pp_guid = pp->e.guid;
+  pm->pp_crypto_handle = pp->sec_attr->crypto_handle;
+  pm->permissions_handle = permissions_hdl;
+  pm->shared_secret = shared_secret;
+
+  return pm;
+}
+
+static void proxypp_pp_match_free(struct dds_security_context *sc, struct proxypp_pp_match *pm)
+{
+  DDS_Security_SecurityException exception = DDS_SECURITY_EXCEPTION_INIT;
+
+  if (pm->permissions_handle != DDS_SECURITY_HANDLE_NIL)
+  {
+    if (!sc->access_control_context->return_permissions_handle(sc->access_control_context, pm->permissions_handle, &exception))
+      EXCEPTION_ERROR(sc, &exception, "Failed to return remote permissions handle");
+  }
+  ddsrt_free(pm);
+}
+
+static void pp_proxypp_unrelate(struct dds_security_context *sc, struct participant *pp, const ddsi_guid_t *proxypp_guid)
+{
+  struct pp_proxypp_match *pm;
+  ddsrt_avl_dpath_t dpath;
+
+  ddsrt_mutex_lock(&pp->sec_attr->lock);
+  if ((pm = ddsrt_avl_clookup_dpath(&pp_proxypp_treedef, &pp->sec_attr->proxy_participants, proxypp_guid, &dpath)) != NULL)
+  {
+    ddsrt_avl_cdelete_dpath(&pp_proxypp_treedef, &pp->sec_attr->proxy_participants, pm, &dpath);
+    pp_proxypp_match_free(sc, pm);
+  }
+  ddsrt_mutex_unlock(&pp->sec_attr->lock);
+}
+
+static void proxypp_pp_unrelate(struct dds_security_context *sc, struct proxy_participant *proxypp, const ddsi_guid_t *pp_guid, int64_t pp_crypto_handle)
+{
+  if (proxypp->sec_attr)
+  {
+    struct proxypp_pp_match *pm;
+    struct security_entity_match *match;
+    ddsrt_avl_dpath_t dpath;
+
+    match = remove_entity_match(proxypp->e.gv->security_matches, &proxypp->e.guid, pp_guid);
+    if (match)
+      entity_match_free(match);
+
+    ddsrt_mutex_lock(&proxypp->sec_attr->lock);
+    if ((pm = ddsrt_avl_lookup_dpath(&proxypp_pp_treedef, &proxypp->sec_attr->participants, &pp_crypto_handle, &dpath)) != NULL)
+    {
+      ddsrt_avl_delete_dpath(&proxypp_pp_treedef, &proxypp->sec_attr->participants, pm, &dpath);
+      proxypp_pp_match_free(sc, pm);
+    }
+    ddsrt_mutex_unlock(&proxypp->sec_attr->lock);
+  }
+}
+
+static struct participant_sec_attributes * participant_sec_attributes_new(ddsi_guid_t *guid)
+{
+  struct participant_sec_attributes *attr;
+
+  attr = ddsrt_malloc(sizeof(*attr));
+  ddsrt_mutex_init(&attr->lock);
+  ddsrt_avl_cinit(&pp_proxypp_treedef, &attr->proxy_participants);
+  attr->pp_guid = *guid;
+  attr->crypto_handle = DDS_SECURITY_HANDLE_NIL;
+  attr->plugin_attr = false;
+  attr->initialized = false;
+  return attr;
+}
+
+static void participant_sec_attributes_free(struct participant_sec_attributes *attr)
+{
+  if (attr)
+  {
+    ddsrt_avl_cfree(&pp_proxypp_treedef, &attr->proxy_participants, 0);
+    ddsrt_mutex_destroy(&attr->lock);
+    ddsrt_free(attr);
+  }
+}
+
+static struct writer_sec_attributes * writer_sec_attributes_new(void)
+{
+  struct writer_sec_attributes *attr;
+
+  attr = ddsrt_malloc(sizeof(*attr));
+  memset(attr, 0, sizeof(*attr));
+  attr->crypto_handle = DDS_SECURITY_HANDLE_NIL;
+  attr->plugin_attr = false;
+  return attr;
+}
+
+static void writer_sec_attributes_free(struct writer_sec_attributes *attr)
+{
+  ddsrt_free(attr);
+}
+
+static struct reader_sec_attributes * reader_sec_attributes_new(void)
+{
+  struct reader_sec_attributes *attr;
+
+  attr = ddsrt_malloc(sizeof(*attr));
+  memset(attr, 0, sizeof(*attr));
+  attr->crypto_handle = DDS_SECURITY_HANDLE_NIL;
+  attr->plugin_attr = false;
+
+  return attr;
+}
+
+static void reader_sec_attributes_free(struct reader_sec_attributes *attr)
+{
+   ddsrt_free(attr);
+}
+
+static void
+participant_index_add(dds_security_context *sc, struct participant_sec_attributes *attr)
+{
+  ddsrt_mutex_lock(&sc->partiticpant_index.lock);
+  ddsrt_avl_cinsert(&participant_index_treedef, &sc->partiticpant_index.participants, attr);
+  ddsrt_mutex_unlock(&sc->partiticpant_index.lock);
+}
+
+static struct participant_sec_attributes *
+participant_index_find(dds_security_context *sc, int64_t crypto_handle)
+{
+  struct participant_sec_attributes *attr;
+
+  ddsrt_mutex_lock(&sc->partiticpant_index.lock);
+  attr = ddsrt_avl_clookup(&participant_index_treedef, &sc->partiticpant_index.participants, &crypto_handle);
+  ddsrt_mutex_unlock(&sc->partiticpant_index.lock);
+
+  return attr;
+}
+
+static struct participant_sec_attributes *
+participant_index_remove(dds_security_context *sc, int64_t crypto_handle)
+{
+  struct participant_sec_attributes *attr;
+  ddsrt_avl_dpath_t dpath;
+
+  ddsrt_mutex_lock(&sc->partiticpant_index.lock);
+  attr = ddsrt_avl_clookup_dpath(&participant_index_treedef, &sc->partiticpant_index.participants, &crypto_handle, &dpath);
+  if (attr)
+    ddsrt_avl_cdelete_dpath(&participant_index_treedef, &sc->partiticpant_index.participants, attr, &dpath);
+  ddsrt_mutex_unlock(&sc->partiticpant_index.lock);
+
+  return attr;
+}
+
+static uint32_t
+get_matched_proxypp_crypto_handles(struct participant_sec_attributes *attr, DDS_Security_ParticipantCryptoHandleSeq *hdls)
+{
+  uint32_t i;
+  struct pp_proxypp_match *pm;
+  ddsrt_avl_citer_t it;
+
+  ddsrt_mutex_lock(&attr->lock);
+  hdls->_length =  hdls->_maximum = (uint32_t)ddsrt_avl_ccount(&attr->proxy_participants);
+  hdls->_buffer = NULL;
+  if (hdls->_length == 0)
+  {
+    ddsrt_mutex_unlock(&attr->lock);
+    return 0;
+  }
+  hdls->_buffer = ddsrt_malloc(hdls->_length * sizeof(int64_t));
+  for (pm = ddsrt_avl_citer_first(&pp_proxypp_treedef, &attr->proxy_participants, &it), i = 0; pm; pm = ddsrt_avl_citer_next(&it), i++)
+    hdls->_buffer[i] = pm->proxypp_crypto_handle;
+  ddsrt_mutex_unlock(&attr->lock);
+  return hdls->_length;
+}
+
+static int64_t
+get_first_matched_proxypp_crypto_handle(struct participant_sec_attributes *attr)
+{
+  int64_t handle = 0;
+  struct pp_proxypp_match *pm;
+
+  ddsrt_mutex_lock(&attr->lock);
+  pm = ddsrt_avl_croot(&pp_proxypp_treedef, &attr->proxy_participants);
+  if (pm)
+    handle = pm->proxypp_crypto_handle;
+  ddsrt_mutex_unlock(&attr->lock);
+
+  return handle;
 }
 
 bool q_omg_is_security_loaded (dds_security_context *sc)
@@ -107,22 +564,27 @@ bool q_omg_is_security_loaded (dds_security_context *sc)
   return (sc->crypto_context != NULL || sc->authentication_context != NULL || sc->access_control_context != NULL);
 }
 
-void q_omg_security_init (dds_security_context **sc, const struct ddsrt_log_cfg *logcfg)
+void q_omg_security_init (struct ddsi_domaingv *gv)
 {
-  *sc = ddsrt_malloc (sizeof (dds_security_context));
-  memset (*sc, 0, sizeof (dds_security_context));
+  dds_security_context *sc;
 
-  (*sc)->auth_plugin.name = AUTH_NAME;
-  (*sc)->ac_plugin.name = AC_NAME;
-  (*sc)->crypto_plugin.name = CRYPTO_NAME;
+  sc = ddsrt_malloc (sizeof (dds_security_context));
+  memset (sc, 0, sizeof (dds_security_context));
 
-  ddsrt_mutex_init (&(*sc)->omg_security_lock);
-  (*sc)->logcfg = logcfg;
+  sc->auth_plugin.name = AUTH_NAME;
+  sc->ac_plugin.name = AC_NAME;
+  sc->crypto_plugin.name = CRYPTO_NAME;
 
-  //DDS_CTRACE ((*sc)->logcfg, "DDS Security init\n");
-#if HANDSHAKE_IMPLEMENTED
-  //remote_participant_crypto_handle_list_init();
-#endif
+  ddsrt_mutex_init(&sc->partiticpant_index.lock);
+  ddsrt_avl_cinit(&participant_index_treedef, &sc->partiticpant_index.participants);
+
+  ddsrt_mutex_init (&sc->omg_security_lock);
+  sc->logcfg = &gv->logconfig;
+
+  gv->security_context = sc;
+  gv->security_matches = security_match_index_new();
+
+  ddsi_handshake_admin_init(gv);
 }
 
 /**
@@ -130,42 +592,42 @@ void q_omg_security_init (dds_security_context **sc, const struct ddsrt_log_cfg
  */
 static void release_plugins (dds_security_context *sc)
 {
-#if HANDSHAKE_IMPLEMENTED
-  q_handshake_terminate ();
-#endif
-
   if (dds_security_plugin_release (&sc->auth_plugin, sc->authentication_context))
-    DDS_CERROR (sc->logcfg, "Error occured releasing %s plugin", sc->auth_plugin.name);
+    DDS_CERROR (sc->logcfg, "Error occurred releasing %s plugin", sc->auth_plugin.name);
 
   if (dds_security_plugin_release (&sc->crypto_plugin, sc->crypto_context))
-    DDS_CERROR (sc->logcfg, "Error occured releasing %s plugin", sc->crypto_plugin.name);
+    DDS_CERROR (sc->logcfg, "Error occurred releasing %s plugin", sc->crypto_plugin.name);
 
   if (dds_security_plugin_release (&sc->ac_plugin, sc->access_control_context))
-    DDS_CERROR (sc->logcfg, "Error occured releasing %s plugin", sc->ac_plugin.name);
+    DDS_CERROR (sc->logcfg, "Error occurred releasing %s plugin", sc->ac_plugin.name);
 
   sc->authentication_context = NULL;
   sc->access_control_context = NULL;
   sc->crypto_context = NULL;
 }
 
-void q_omg_security_deinit (struct dds_security_context **sc)
+void q_omg_security_deinit (struct ddsi_domaingv *gv)
 {
-  assert (sc != NULL);
-  assert (*sc != NULL);
+  dds_security_context *sc = gv->security_context;
 
-#if HANDSHAKE_IMPLEMENTED
-  //remote_participant_crypto_handle_list_deinit();
-#endif
+  assert (gv->security_context != NULL);
 
-  if ((*sc)->authentication_context != NULL && (*sc)->access_control_context != NULL && (*sc)->crypto_context != NULL){
-    release_plugins (*sc);
+  ddsrt_avl_cfree(&participant_index_treedef, &sc->partiticpant_index.participants, 0);
+  ddsrt_mutex_destroy(&sc->partiticpant_index.lock);
+
+  if (gv->security_context->authentication_context != NULL && gv->security_context->access_control_context != NULL && gv->security_context->crypto_context != NULL){
+    release_plugins (gv->security_context);
   }
 
-  ddsrt_mutex_destroy (&(*sc)->omg_security_lock);
+  ddsi_handshake_admin_deinit(gv);
 
-  //DDS_CTRACE ((*sc)->logcfg, "DDS Security deinit\n");
-  ddsrt_free (*sc);
-  *sc = NULL;
+  security_match_index_free(gv->security_matches);
+  gv->security_matches = NULL;
+
+  ddsrt_mutex_destroy (&gv->security_context->omg_security_lock);
+
+  ddsrt_free(gv->security_context);
+  gv->security_context = NULL;
 }
 
 static void dds_qos_to_security_plugin_configuration (const dds_qos_t *qos, dds_security_plugin_suite_config *suite_config)
@@ -278,99 +740,738 @@ error:
   return DDS_RETCODE_ERROR;
 }
 
-bool q_omg_participant_is_secure (const struct participant *pp)
+static const char * get_builtin_topic_name(ddsi_entityid_t id)
 {
-  /* TODO: Register local participant. */
-  DDSRT_UNUSED_ARG (pp);
-  return false;
+  switch (id.u) {
+  case NN_ENTITYID_SEDP_BUILTIN_TOPIC_WRITER:
+  case NN_ENTITYID_SEDP_BUILTIN_TOPIC_READER:
+    return "DCPSTopic";
+    break;
+  case NN_ENTITYID_SEDP_BUILTIN_PUBLICATIONS_WRITER:
+  case NN_ENTITYID_SEDP_BUILTIN_PUBLICATIONS_READER:
+    return "DCPSPublication";
+    break;
+  case NN_ENTITYID_SEDP_BUILTIN_SUBSCRIPTIONS_WRITER:
+  case NN_ENTITYID_SEDP_BUILTIN_SUBSCRIPTIONS_READER:
+    return "DCPSSubscription";
+    break;
+  case NN_ENTITYID_SPDP_BUILTIN_PARTICIPANT_WRITER:
+  case NN_ENTITYID_SPDP_BUILTIN_PARTICIPANT_READER:
+    return "DCPSParticipant";
+    break;
+  case NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_MESSAGE_WRITER:
+  case NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_MESSAGE_READER:
+    return "DCPSParticipantMessage";
+    break;
+  case NN_ENTITYID_SEDP_BUILTIN_PUBLICATIONS_SECURE_WRITER:
+  case NN_ENTITYID_SEDP_BUILTIN_PUBLICATIONS_SECURE_READER:
+    return "DCPSPublicationsSecure";
+    break;
+  case NN_ENTITYID_SEDP_BUILTIN_SUBSCRIPTIONS_SECURE_WRITER:
+  case NN_ENTITYID_SEDP_BUILTIN_SUBSCRIPTIONS_SECURE_READER:
+    return "DCPSSubscriptionsSecure";
+    break;
+  case NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_STATELESS_MESSAGE_WRITER:
+  case NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_STATELESS_MESSAGE_READER:
+    return "DCPSParticipantStatelessMessage";
+    break;
+  case NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_MESSAGE_SECURE_WRITER:
+  case NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_MESSAGE_SECURE_READER:
+    return "DCPSParticipantMessageSecure";
+    break;
+  case NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_VOLATILE_SECURE_WRITER:
+  case NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_VOLATILE_SECURE_READER:
+    return "DCPSParticipantVolatileMessageSecure";
+    break;
+  case NN_ENTITYID_SPDP_RELIABLE_BUILTIN_PARTICIPANT_SECURE_WRITER:
+  case NN_ENTITYID_SPDP_RELIABLE_BUILTIN_PARTICIPANT_SECURE_READER:
+    return "DCPSParticipantsSecure";
+    break;
+  default:
+    return "(null)";
+    break;
+  }
+
+  return NULL;
+}
+
+static void notify_handshake_recv_token(struct participant *pp, struct proxy_participant *proxypp)
+{
+  struct ddsi_handshake *handshake;
+
+  handshake = ddsi_handshake_find(pp, proxypp);
+  if (handshake) {
+    ddsi_handshake_crypto_tokens_received(handshake);
+    ddsi_handshake_release(handshake);
+  }
+}
+
+static const char * get_reader_topic_name(struct reader *rd)
+{
+  if (rd->topic) {
+    return rd->topic->name;
+  }
+  return get_builtin_topic_name(rd->e.guid.entityid);
+}
+
+static const char * get_writer_topic_name(struct writer *wr)
+{
+  if (wr->topic) {
+    return wr->topic->name;
+  }
+  return get_builtin_topic_name(wr->e.guid.entityid);
+}
+
+bool q_omg_participant_is_secure(const struct participant *pp)
+{
+  return ((pp->sec_attr != NULL) && (pp->sec_attr->crypto_handle != DDS_SECURITY_HANDLE_NIL));
 }
 
 bool q_omg_proxy_participant_is_secure (const struct proxy_participant *proxypp)
 {
-  /* TODO: Register remote participant */
-  DDSRT_UNUSED_ARG (proxypp);
-  return false;
+  return (proxypp->sec_attr != NULL);
 }
 
-static bool q_omg_writer_is_discovery_protected (const struct writer *wr)
+bool q_omg_participant_allow_unauthenticated(struct participant *pp)
 {
-  /* TODO: Register local writer. */
-  DDSRT_UNUSED_ARG (wr);
-  return false;
+  return ((pp->sec_attr != NULL) && pp->sec_attr->attr.allow_unauthenticated_participants);
 }
 
-static bool q_omg_reader_is_discovery_protected (const struct reader *rd)
+bool q_omg_security_check_create_participant(struct participant *pp, uint32_t domain_id)
 {
-  /* TODO: Register local reader. */
-  DDSRT_UNUSED_ARG (rd);
-  return false;
+  bool allowed = false;
+  struct dds_security_context *sc = q_omg_security_get_secure_context(pp);
+  DDS_Security_IdentityHandle identity_handle = DDS_SECURITY_HANDLE_NIL;
+  DDS_Security_SecurityException exception = DDS_SECURITY_EXCEPTION_INIT;
+  DDS_Security_ValidationResult_t result = 0;
+  DDS_Security_IdentityToken identity_token;
+  DDS_Security_PermissionsToken permissions_token = DDS_SECURITY_TOKEN_INIT;
+  DDS_Security_PermissionsCredentialToken credential_token = DDS_SECURITY_TOKEN_INIT;
+  struct participant_sec_attributes *sec_attr = NULL;
+  DDS_Security_Qos par_qos;
+  ddsi_guid_t candidate_guid;
+  ddsi_guid_t adjusted_guid;
+
+  if (!sc)
+    return true;
+
+  /* Validate local identity */
+  ETRACE (pp, "validate_local_identity: candidate_guid: "PGUIDFMT" ", PGUID (pp->e.guid));
+
+  candidate_guid = nn_hton_guid(pp->e.guid);
+  q_omg_shallow_copy_security_qos(&par_qos, &(pp->plist->qos));
+
+  result = sc->authentication_context->validate_local_identity(
+      sc->authentication_context, &identity_handle,
+      (DDS_Security_GUID_t *) &adjusted_guid, (DDS_Security_DomainId) domain_id, &par_qos,
+      (DDS_Security_GUID_t *) &candidate_guid, &exception);
+  if (result != DDS_SECURITY_VALIDATION_OK)
+  {
+    EXCEPTION_ERROR(sc, &exception, "Error occurred while validating local permission");
+    goto validation_failed;
+  }
+  pp->e.guid = nn_ntoh_guid(adjusted_guid);
+
+  sec_attr = participant_sec_attributes_new(&pp->e.guid);
+  sec_attr->local_identity_handle = identity_handle;
+
+  ETRACE (pp, "adjusted_guid: "PGUIDFMT" ", PGUID (pp->e.guid));
+
+  /* Get the identity token and add this to the plist of the participant */
+  if (!sc->authentication_context->get_identity_token(sc->authentication_context, &identity_token, identity_handle, &exception))
+  {
+    EXCEPTION_ERROR(sc, &exception, "Error occurred while retrieving the identity token");
+    goto validation_failed;
+  }
+  assert(exception.code == 0);
+
+  q_omg_security_dataholder_copyin(&pp->plist->identity_token, &identity_token);
+  DDS_Security_DataHolder_deinit(&identity_token);
+  pp->plist->present |= PP_IDENTITY_TOKEN;
+
+  sec_attr->permissions_handle = sc->access_control_context->validate_local_permissions(
+       sc->access_control_context, sc->authentication_context, identity_handle,
+       (DDS_Security_DomainId)domain_id, &par_qos, &exception);
+  if (sec_attr->permissions_handle == DDS_SECURITY_HANDLE_NIL)
+  {
+    EXCEPTION_ERROR(sc, &exception, "Error occurred while validating local permissions");
+    goto not_allowed;
+  }
+
+  /* ask to access control security plugin for create participant permissions related to this identity*/
+  if (!sc->access_control_context->check_create_participant(sc->access_control_context, sec_attr->permissions_handle, (DDS_Security_DomainId) domain_id, &par_qos, &exception))
+  {
+    EXCEPTION_ERROR(sc, &exception, "It is not allowed to create participant");
+    goto not_allowed;
+  }
+
+  /* Get the identity token and add this to the plist of the participant */
+  if (!sc->access_control_context->get_permissions_token(sc->access_control_context, &permissions_token, sec_attr->permissions_handle, &exception))
+  {
+    EXCEPTION_ERROR(sc, &exception, "Error occurred while retrieving the permissions token");
+    goto not_allowed;
+  }
+
+  q_omg_security_dataholder_copyin(&pp->plist->permissions_token, &permissions_token);
+  pp->plist->present |= PP_PERMISSIONS_TOKEN;
+
+  if (!sc->access_control_context->get_permissions_credential_token(sc->access_control_context, &credential_token, sec_attr->permissions_handle, &exception))
+  {
+    EXCEPTION_ERROR(sc, &exception, "Error occurred while retrieving the permissions credential token");
+    goto no_credentials;
+  }
+
+  if (!sc->authentication_context->set_permissions_credential_and_token(sc->authentication_context, sec_attr->local_identity_handle, &credential_token, &permissions_token, &exception))
+  {
+    EXCEPTION_ERROR(sc, &exception, "Error occurred while setting the permissions credential token");
+    goto no_credentials;
+  }
+
+  if (!sc->access_control_context->get_participant_sec_attributes(sc->access_control_context, sec_attr->permissions_handle, &sec_attr->attr, &exception))
+  {
+    EXCEPTION_ERROR(sc, &exception, "Failed to get participant security attributes");
+    goto no_sec_attr;
+  }
+
+  sec_attr->plugin_attr = true;
+  sec_attr->crypto_handle = sc->crypto_context->crypto_key_factory->register_local_participant(
+            sc->crypto_context->crypto_key_factory, sec_attr->local_identity_handle, sec_attr->permissions_handle, NULL, &sec_attr->attr, &exception);
+  if (!sec_attr->crypto_handle) {
+    EXCEPTION_ERROR(sc, &exception, "Failed to register participant with crypto key factory");
+    goto no_crypto;
+  }
+
+  participant_index_add(sc, sec_attr);
+  pp->sec_attr = sec_attr;
+
+  ETRACE (pp, "\n");
+
+  allowed = true;
+
+no_crypto:
+no_sec_attr:
+no_credentials:
+  if (permissions_token.class_id)
+    (void)sc->access_control_context->return_permissions_token(sc->access_control_context, &permissions_token, NULL);
+  if (credential_token.class_id)
+    (void)sc->access_control_context->return_permissions_credential_token(sc->access_control_context, &credential_token, NULL);
+not_allowed:
+  if (!allowed)
+    participant_sec_attributes_free(sec_attr);
+validation_failed:
+  q_omg_shallow_free_security_qos(&par_qos);
+  return allowed;
 }
 
-bool q_omg_get_writer_security_info (const struct writer *wr, nn_security_info_t *info)
+void q_omg_security_participant_set_initialized(struct participant *pp)
 {
-  assert (wr);
-  assert (info);
-  /* TODO: Register local writer. */
-  DDSRT_UNUSED_ARG (wr);
+  if (pp->sec_attr)
+  {
+    ddsrt_mutex_lock(&pp->sec_attr->lock);
+    pp->sec_attr->initialized = true;
+    ddsrt_mutex_unlock(&pp->sec_attr->lock);
+  }
+}
 
+bool q_omg_security_participant_is_initialized(struct participant *pp)
+{
+  bool initialized = false;
+
+  if (pp->sec_attr)
+  {
+    ddsrt_mutex_lock(&pp->sec_attr->lock);
+    initialized = pp->sec_attr->initialized;
+    ddsrt_mutex_unlock(&pp->sec_attr->lock);
+  }
+  return initialized;
+}
+
+struct cleanup_participant_sec_attributes_arg {
+  struct ddsi_domaingv *gv;
+  int64_t crypto_handle;
+};
+
+static void cleanup_participant_sec_attributes(void *arg)
+{
+  DDS_Security_SecurityException exception = DDS_SECURITY_EXCEPTION_INIT;
+  struct cleanup_participant_sec_attributes_arg *info = arg;
+  struct ddsi_domaingv * gv = info->gv;
+  dds_security_context *sc = gv->security_context;
+  struct participant_sec_attributes *attr;
+
+  struct pp_proxypp_match *pm;
+
+  if ((attr = participant_index_remove(sc, info->crypto_handle)) == NULL)
+    return;
+
+  pm = ddsrt_avl_cfind_min(&pp_proxypp_treedef, &attr->proxy_participants);
+  while (pm)
+  {
+    struct pp_proxypp_match *next = ddsrt_avl_cfind_succ(&pp_proxypp_treedef, &attr->proxy_participants, pm);
+    ddsrt_mutex_lock(&gv->lock);
+    struct proxy_participant *proxypp = entidx_lookup_proxy_participant_guid(gv->entity_index, &pm->proxypp_guid);
+    if (proxypp)
+      proxypp_pp_unrelate(sc, proxypp, &attr->pp_guid, attr->crypto_handle);
+    ddsrt_mutex_unlock(&gv->lock);
+    ddsrt_avl_cdelete(&pp_proxypp_treedef, &attr->proxy_participants, pm);
+    ddsrt_free(pm);
+    pm = next;
+  }
+
+  if (attr->permissions_handle != DDS_SECURITY_HANDLE_NIL)
+  {
+    if (!sc->access_control_context->return_permissions_handle(sc->access_control_context, attr->permissions_handle, &exception))
+      EXCEPTION_ERROR(sc, &exception, "Failed to return local permissions handle");
+  }
+  if (attr->local_identity_handle != DDS_SECURITY_HANDLE_NIL)
+  {
+    if (!sc->authentication_context->return_identity_handle(sc->authentication_context, attr->local_identity_handle, &exception))
+      EXCEPTION_ERROR(sc, &exception, "Failed to return local identity handle");
+  }
+  if (attr->plugin_attr)
+  {
+    if (!sc->access_control_context->return_participant_sec_attributes(sc->access_control_context, &attr->attr, &exception))
+      EXCEPTION_ERROR(sc, &exception, "Failed to return participant security attributes");
+  }
+
+  (void)sc->crypto_context->crypto_key_factory->unregister_participant(sc->crypto_context->crypto_key_factory, attr->crypto_handle, NULL);
+
+  ddsrt_avl_cfree(&pp_proxypp_treedef, &attr->proxy_participants, NULL);
+  ddsrt_mutex_unlock(&attr->lock);
+  ddsrt_free(attr);
+  ddsrt_free(arg);
+}
+
+void q_omg_security_deregister_participant(struct participant *pp)
+{
+//  DDS_Security_SecurityException exception = DDS_SECURITY_EXCEPTION_INIT;
+  struct dds_security_context *sc = q_omg_security_get_secure_context(pp);
+
+  if (!sc)
+    return;
+
+  /* When the participant is deleted the timed event queue may still contain
+   * messages from this participant. Therefore the crypto handle should still
+   * be available to ensure that the rtps message can be encoded.
+   * For this purpose the cleanup of the associated crypto handle is delayed.
+   * A callback is scheduled to be called after some delay to cleanup this
+   * crypto handle.
+   */
+  if (pp->sec_attr->crypto_handle != DDS_SECURITY_HANDLE_NIL) {
+    struct cleanup_participant_sec_attributes_arg *arg = ddsrt_malloc (sizeof (*arg));
+    arg->crypto_handle = pp->sec_attr->crypto_handle;
+    arg->gv = pp->e.gv;
+    qxev_nt_callback(pp->e.gv->xevents, cleanup_participant_sec_attributes, arg);
+  }
+
+  pp->sec_attr = NULL;
+}
+
+int64_t q_omg_security_get_local_participant_handle(const struct participant *pp)
+{
+  if (pp->sec_attr)
+    return pp->sec_attr->crypto_handle;
+  return 0;
+}
+
+bool q_omg_participant_is_access_protected(const struct participant *pp)
+{
+  return ((pp->sec_attr != NULL) && pp->sec_attr->attr.is_access_protected);
+}
+
+bool q_omg_participant_is_rtps_protected(const struct participant *pp)
+{
+  return ((pp->sec_attr != NULL) && pp->sec_attr->attr.is_rtps_protected);
+}
+
+bool q_omg_participant_is_liveliness_protected(const struct participant *pp)
+{
+  return ((pp->sec_attr != NULL) && pp->sec_attr->attr.is_liveliness_protected);
+}
+
+
+static bool maybe_rtps_protected(ddsi_entityid_t entityid)
+{
+  if (!is_builtin_entityid(entityid, NN_VENDORID_ECLIPSE))
+    return true;
+
+  switch (entityid.u)
+  {
+    case NN_ENTITYID_SEDP_BUILTIN_PUBLICATIONS_SECURE_WRITER:
+    case NN_ENTITYID_SEDP_BUILTIN_PUBLICATIONS_SECURE_READER:
+    case NN_ENTITYID_SEDP_BUILTIN_SUBSCRIPTIONS_SECURE_WRITER:
+    case NN_ENTITYID_SEDP_BUILTIN_SUBSCRIPTIONS_SECURE_READER:
+    case NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_MESSAGE_SECURE_WRITER:
+    case NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_MESSAGE_SECURE_READER:
+    case NN_ENTITYID_SPDP_RELIABLE_BUILTIN_PARTICIPANT_SECURE_WRITER:
+    case NN_ENTITYID_SPDP_RELIABLE_BUILTIN_PARTICIPANT_SECURE_READER:
+      return true;
+    default:
+      return false;
+  }
+}
+
+static bool proxypp_is_rtps_protected(const struct proxy_participant *proxypp)
+{
+  return (proxypp->sec_attr != NULL && SECURITY_INFO_IS_RTPS_PROTECTED(proxypp->security_info));
+}
+
+bool q_omg_security_is_remote_rtps_protected(const struct proxy_participant *proxypp, ddsi_entityid_t entityid)
+{
+  return q_omg_proxy_participant_is_secure(proxypp) &&
+    SECURITY_INFO_IS_RTPS_PROTECTED(proxypp->security_info) &&
+    maybe_rtps_protected(entityid);
+}
+
+bool q_omg_security_is_local_rtps_protected(const struct participant *pp, ddsi_entityid_t entityid)
+{
+  return q_omg_participant_is_rtps_protected(pp) && maybe_rtps_protected(entityid);
+}
+
+bool q_omg_get_participant_security_info(const struct participant *pp, nn_security_info_t *info)
+{
+  assert(pp);
+  assert(info);
+
+  if (q_omg_participant_is_secure(pp)) {
+    const DDS_Security_ParticipantSecurityAttributes *attr = &(pp->sec_attr->attr);
+
+    info->security_attributes = NN_ENDPOINT_SECURITY_ATTRIBUTES_FLAG_IS_VALID;
+    info->plugin_security_attributes = attr->plugin_participant_attributes;
+
+    if (attr->is_discovery_protected)
+      info->security_attributes |= NN_PARTICIPANT_SECURITY_ATTRIBUTES_FLAG_IS_DISCOVERY_PROTECTED;
+
+    if (attr->is_liveliness_protected)
+      info->security_attributes |= NN_PARTICIPANT_SECURITY_ATTRIBUTES_FLAG_IS_LIVELINESS_PROTECTED;
+
+    if (attr->is_rtps_protected)
+      info->security_attributes |= NN_PARTICIPANT_SECURITY_ATTRIBUTES_FLAG_IS_RTPS_PROTECTED;
+
+    return true;
+  }
+
+  info->security_attributes = 0;
   info->plugin_security_attributes = 0;
-  if (q_omg_writer_is_payload_protected (wr))
-  {
-    info->security_attributes =
-      NN_ENDPOINT_SECURITY_ATTRIBUTES_FLAG_IS_VALID |
-      NN_ENDPOINT_SECURITY_ATTRIBUTES_FLAG_IS_PAYLOAD_PROTECTED;
-  }
-  else
-  {
-    info->security_attributes = 0;
-  }
-  return true;
+
+  return false;
 }
 
-bool q_omg_get_reader_security_info (const struct reader *rd, nn_security_info_t *info)
+static void q_omg_get_endpoint_security_info(DDS_Security_EndpointSecurityAttributes *attr, nn_security_info_t *info)
 {
-  assert (rd);
-  assert (info);
-  /* TODO: Register local reader. */
-  DDSRT_UNUSED_ARG (rd);
+    info->security_attributes = NN_ENDPOINT_SECURITY_ATTRIBUTES_FLAG_IS_VALID;
+    info->plugin_security_attributes = attr->plugin_endpoint_attributes;
+
+    if (attr->is_read_protected)
+        info->security_attributes |= NN_ENDPOINT_SECURITY_ATTRIBUTES_FLAG_IS_READ_PROTECTED;
+
+    if (attr->is_write_protected)
+        info->security_attributes |= NN_ENDPOINT_SECURITY_ATTRIBUTES_FLAG_IS_WRITE_PROTECTED;
+
+    if (attr->is_discovery_protected)
+        info->security_attributes |= NN_ENDPOINT_SECURITY_ATTRIBUTES_FLAG_IS_DISCOVERY_PROTECTED;
+
+    if (attr->is_liveliness_protected)
+        info->security_attributes |= NN_ENDPOINT_SECURITY_ATTRIBUTES_FLAG_IS_LIVELINESS_PROTECTED;
+
+    if (attr->is_submessage_protected)
+        info->security_attributes |= NN_ENDPOINT_SECURITY_ATTRIBUTES_FLAG_IS_SUBMESSAGE_PROTECTED;
+
+    if (attr->is_payload_protected)
+        info->security_attributes |= NN_ENDPOINT_SECURITY_ATTRIBUTES_FLAG_IS_PAYLOAD_PROTECTED;
+
+    if (attr->is_key_protected)
+        info->security_attributes |= NN_ENDPOINT_SECURITY_ATTRIBUTES_FLAG_IS_KEY_PROTECTED;
+}
+
+static bool is_topic_discovery_protected(DDS_Security_PermissionsHandle permission_handle, dds_security_access_control *access_control, const char *topic_name)
+{
+  DDS_Security_TopicSecurityAttributes attributes = {0,0,0,0};
+  DDS_Security_SecurityException exception = DDS_SECURITY_EXCEPTION_INIT;
+
+  if (access_control->get_topic_sec_attributes(access_control, permission_handle, topic_name, &attributes, &exception))
+    return attributes.is_discovery_protected;
+  else
+    DDS_Security_Exception_reset(&exception);
+  return false;
+}
+
+bool q_omg_security_check_create_topic(const struct ddsi_domaingv *gv, const ddsi_guid_t *pp_guid, const char *topic_name, const struct dds_qos *qos)
+{
+  bool result = true;
+  struct participant *pp;
+  struct dds_security_context *sc;
+  DDS_Security_SecurityException exception = DDS_SECURITY_EXCEPTION_INIT;
+  DDS_Security_Qos topic_qos;
+
+  thread_state_awake (lookup_thread_state (), gv);
+  pp = entidx_lookup_participant_guid (gv->entity_index, pp_guid);
+
+  if ((sc = q_omg_security_get_secure_context(pp)) != NULL)
+  {
+    q_omg_shallow_copy_security_qos(&topic_qos, qos);
+    result = sc->access_control_context->check_create_topic(sc->access_control_context, pp->sec_attr->permissions_handle, (DDS_Security_DomainId)gv->config.domainId, topic_name, &topic_qos, &exception);
+    if (!result)
+    {
+      /*log if the topic discovery is not protected*/
+      if (!is_topic_discovery_protected(pp->sec_attr->permissions_handle, sc->access_control_context, topic_name))
+        EXCEPTION_ERROR(sc, &exception, "Local topic permission denied");
+      else
+        DDS_Security_Exception_reset(&exception);
+    }
+    q_omg_shallow_free_security_qos(&topic_qos);
+  }
+  thread_state_asleep (lookup_thread_state ());
+
+  return result;
+}
+
+bool q_omg_security_check_create_writer(struct participant *pp, uint32_t domain_id, const char *topic_name, const struct dds_qos *writer_qos)
+{
+  struct dds_security_context *sc = q_omg_security_get_secure_context(pp) ;
+  DDS_Security_SecurityException exception = DDS_SECURITY_EXCEPTION_INIT;
+  DDS_Security_PartitionQosPolicy partitions;
+  DDS_Security_Qos security_qos;
+  bool result;
+
+  if (!sc)
+    return true;
+
+  if (writer_qos->present & QP_PARTITION)
+    g_omg_shallow_copy_StringSeq(&partitions.name, &(writer_qos->partition));
+  else
+    memset(&(partitions), 0, sizeof(DDS_Security_PartitionQosPolicy));
+
+  q_omg_shallow_copy_security_qos(&security_qos, writer_qos);
+
+  result = sc->access_control_context->check_create_datawriter(sc->access_control_context, pp->sec_attr->permissions_handle, (DDS_Security_DomainId)domain_id, topic_name, &security_qos, &partitions, NULL, &exception);
+  if (!result)
+  {
+    /*log if the topic discovery is not protected*/
+    if (!is_topic_discovery_protected( pp->sec_attr->permissions_handle, sc->access_control_context, topic_name))
+      EXCEPTION_ERROR(sc, &exception, "Local topic permission denied");
+    else
+      DDS_Security_Exception_reset(&exception);
+  }
+
+  q_omg_shallow_free_security_qos(&security_qos);
+  g_omg_shallow_free_StringSeq(&partitions.name);
+
+  return result;
+}
+
+void q_omg_security_register_writer(struct writer *wr)
+{
+  struct participant *pp = wr->c.pp;
+  struct dds_security_context *sc = q_omg_security_get_secure_context(pp);
+  DDS_Security_SecurityException exception = DDS_SECURITY_EXCEPTION_INIT;
+  DDS_Security_PartitionQosPolicy partitions;
+  DDS_Security_PropertySeq properties;
+  const char *topic_name;
+
+  if (!sc)
+    return;
+
+  if (wr->xqos->present & QP_PARTITION)
+    g_omg_shallow_copy_StringSeq(&partitions.name, &(wr->xqos->partition));
+  else
+    memset(&(partitions), 0, sizeof(DDS_Security_PartitionQosPolicy));
+
+  wr->sec_attr = writer_sec_attributes_new();
+  topic_name = get_writer_topic_name(wr);
+  if (!sc->access_control_context->get_datawriter_sec_attributes(sc->access_control_context, pp->sec_attr->permissions_handle, topic_name, &partitions, NULL, &wr->sec_attr->attr, &exception))
+  {
+    EXCEPTION_ERROR(sc, &exception, "Failed to retrieve writer security attributes");
+    goto no_attr;
+  }
+  wr->sec_attr->plugin_attr = true;
+
+  if (wr->sec_attr->attr.is_payload_protected || wr->sec_attr->attr.is_submessage_protected)
+  {
+    if (wr->xqos->present & QP_PROPERTY_LIST)
+      q_omg_copy_PropertySeq(&properties, &wr->xqos->property.value);
+    else
+      memset(&properties, 0, sizeof(DDS_Security_PropertySeq));
+
+    wr->sec_attr->crypto_handle = sc->crypto_context->crypto_key_factory->register_local_datawriter(
+        sc->crypto_context->crypto_key_factory, pp->sec_attr->crypto_handle, &properties, &wr->sec_attr->attr, &exception);
+    DDS_Security_PropertySeq_freebuf(&properties);
+    if (wr->sec_attr->crypto_handle == DDS_SECURITY_HANDLE_NIL)
+    {
+      EXCEPTION_ERROR(sc, &exception, "Failed to register writer with crypto");
+      goto not_registered;
+    }
+  }
+
+  if (wr->sec_attr->attr.is_key_protected)
+    wr->include_keyhash = 1;
+
+not_registered:
+no_attr:
+  g_omg_shallow_free_StringSeq(&partitions.name);
+}
+
+void q_omg_security_deregister_writer(struct writer *wr)
+{
+  struct dds_security_context *sc = q_omg_security_get_secure_context(wr->c.pp);
+  DDS_Security_SecurityException exception = DDS_SECURITY_EXCEPTION_INIT;
+
+  if (wr->sec_attr)
+  {
+    if (wr->sec_attr->crypto_handle != DDS_SECURITY_HANDLE_NIL)
+    {
+      if (!sc->crypto_context->crypto_key_factory->unregister_datawriter(sc->crypto_context->crypto_key_factory, wr->sec_attr->crypto_handle, &exception))
+        EXCEPTION_ERROR(sc, &exception, "Failed to unregister writer with crypto");
+    }
+    if (wr->sec_attr->plugin_attr)
+    {
+      if (!sc->access_control_context->return_datawriter_sec_attributes(sc->access_control_context, &wr->sec_attr->attr, &exception))
+        EXCEPTION_ERROR(sc, &exception, "Failed to return writer security attributes");
+    }
+    writer_sec_attributes_free(wr->sec_attr);
+    wr->sec_attr = NULL;
+  }
+}
+
+bool q_omg_get_writer_security_info(const struct writer *wr, nn_security_info_t *info)
+{
+  assert(wr);
+  assert(info);
+
+  if (wr->sec_attr) {
+      q_omg_get_endpoint_security_info(&wr->sec_attr->attr, info);
+      return true;
+  }
   info->plugin_security_attributes = 0;
   info->security_attributes = 0;
   return false;
 }
 
-void q_omg_security_init_remote_participant (struct proxy_participant *proxypp)
+bool q_omg_security_check_create_reader(struct participant *pp, uint32_t domain_id, const char *topic_name, const struct dds_qos *reader_qos)
 {
-  DDSRT_UNUSED_ARG (proxypp);
+  struct dds_security_context *sc = q_omg_security_get_secure_context(pp);
+  DDS_Security_SecurityException exception = DDS_SECURITY_EXCEPTION_INIT;
+  DDS_Security_PartitionQosPolicy partitions;
+  DDS_Security_Qos security_qos;
+  bool result;
+
+  if (!sc)
+    return true;
+
+  if (reader_qos->present & QP_PARTITION)
+    g_omg_shallow_copy_StringSeq(&partitions.name, &(reader_qos->partition));
+  else
+    memset(&(partitions), 0, sizeof(DDS_Security_PartitionQosPolicy));
+
+  q_omg_shallow_copy_security_qos(&security_qos, reader_qos);
+
+  result = sc->access_control_context->check_create_datareader(sc->access_control_context, pp->sec_attr->permissions_handle, (DDS_Security_DomainId)domain_id, topic_name, &security_qos, &partitions, NULL, &exception);
+  if (!result)
+  {
+    /*log if the topic discovery is not protected*/
+    if (!is_topic_discovery_protected( pp->sec_attr->permissions_handle, sc->access_control_context, topic_name))
+      EXCEPTION_ERROR(sc, &exception, "Reader is not permitted");
+    else
+      DDS_Security_Exception_reset(&exception);
+  }
+
+  q_omg_shallow_free_security_qos(&security_qos);
+  g_omg_shallow_free_StringSeq(&partitions.name);
+
+  return result;
 }
 
-static bool q_omg_proxyparticipant_is_authenticated (const struct proxy_participant *proxy_pp)
+void q_omg_security_register_reader(struct reader *rd)
 {
-  /* TODO: Handshake */
-  DDSRT_UNUSED_ARG (proxy_pp);
+  struct participant *pp = rd->c.pp;
+  struct dds_security_context *sc = q_omg_security_get_secure_context(pp);
+  DDS_Security_SecurityException exception = DDS_SECURITY_EXCEPTION_INIT;
+  DDS_Security_PartitionQosPolicy partitions;
+  DDS_Security_PropertySeq properties;
+  const char *topic_name;
+
+  if (!sc)
+    return;
+
+  if (rd->xqos->present & QP_PARTITION)
+    g_omg_shallow_copy_StringSeq(&partitions.name, &(rd->xqos->partition));
+  else
+    memset(&(partitions), 0, sizeof(DDS_Security_PartitionQosPolicy));
+
+  rd->sec_attr = reader_sec_attributes_new();
+
+  topic_name = get_reader_topic_name(rd);
+  if (!sc->access_control_context->get_datareader_sec_attributes(sc->access_control_context, pp->sec_attr->permissions_handle, topic_name, &partitions, NULL, &rd->sec_attr->attr, &exception))
+  {
+    EXCEPTION_ERROR(sc, &exception, "Failed to retrieve reader security attributes");
+    goto no_attr;
+  }
+  rd->sec_attr->plugin_attr = true;
+
+  if (rd->sec_attr->attr.is_payload_protected || rd->sec_attr->attr.is_submessage_protected)
+  {
+    if (rd->xqos->present & QP_PROPERTY_LIST)
+      q_omg_copy_PropertySeq(&properties, &rd->xqos->property.value);
+    else
+      memset(&properties, 0, sizeof(DDS_Security_PropertySeq));
+
+    rd->sec_attr->crypto_handle = sc->crypto_context->crypto_key_factory->register_local_datareader(
+        sc->crypto_context->crypto_key_factory, pp->sec_attr->crypto_handle, &properties, &rd->sec_attr->attr, &exception);
+    DDS_Security_PropertySeq_freebuf(&properties);
+    if (rd->sec_attr->crypto_handle == DDS_SECURITY_HANDLE_NIL)
+    {
+      EXCEPTION_ERROR(sc, &exception, "Failed to register reader with crypto");
+      goto not_registered;
+    }
+  }
+
+not_registered:
+no_attr:
+  g_omg_shallow_free_StringSeq(&partitions.name);
+}
+
+void q_omg_security_deregister_reader(struct reader *rd)
+{
+  struct dds_security_context *sc = q_omg_security_get_secure_context(rd->c.pp);
+  DDS_Security_SecurityException exception = DDS_SECURITY_EXCEPTION_INIT;
+
+  if (rd->sec_attr)
+  {
+    assert(sc);
+    if (rd->sec_attr->crypto_handle != DDS_SECURITY_HANDLE_NIL)
+    {
+      if (!sc->crypto_context->crypto_key_factory->unregister_datareader(sc->crypto_context->crypto_key_factory, rd->sec_attr->crypto_handle, &exception))
+      {
+        EXCEPTION_ERROR(sc, &exception, "Failed to unregister reader with crypto");
+      }
+    }
+    if (rd->sec_attr->plugin_attr)
+    {
+      if (!sc->access_control_context->return_datareader_sec_attributes(sc->access_control_context, &rd->sec_attr->attr, &exception))
+      {
+        EXCEPTION_ERROR(sc, &exception, "Failed to return reader security attributes");
+      }
+    }
+    reader_sec_attributes_free(rd->sec_attr);
+    rd->sec_attr = NULL;
+  }
+}
+
+bool q_omg_get_reader_security_info(const struct reader *rd, nn_security_info_t *info)
+{
+  assert(rd);
+  assert(info);
+
+  if (rd->sec_attr) {
+    q_omg_get_endpoint_security_info(&rd->sec_attr->attr, info);
+    return true;
+  }
+  info->plugin_security_attributes = 0;
+  info->security_attributes = 0;
   return false;
 }
 
-int64_t q_omg_security_get_local_participant_handle (struct participant *pp)
-{
-  /* TODO: Local registration */
-  DDSRT_UNUSED_ARG (pp);
-  return 0;
-}
-
-int64_t q_omg_security_get_remote_participant_handle (struct proxy_participant *proxypp)
-{
-  /* TODO: Handshake */
-  DDSRT_UNUSED_ARG(proxypp);
-  return 0;
-}
-
-bool q_omg_participant_allow_unauthenticated (struct participant *pp)
-{
-  DDSRT_UNUSED_ARG (pp);
-  return true;
-}
-
-unsigned determine_subscription_writer (const struct reader *rd)
+unsigned determine_subscription_writer(const struct reader *rd)
 {
   if (q_omg_reader_is_discovery_protected (rd))
     return NN_ENTITYID_SEDP_BUILTIN_SUBSCRIPTIONS_SECURE_WRITER;
@@ -386,17 +1487,292 @@ unsigned determine_publication_writer (const struct writer *wr)
     return NN_ENTITYID_SEDP_BUILTIN_PUBLICATIONS_WRITER;
 }
 
-void q_omg_security_register_remote_participant (struct participant *pp, struct proxy_participant *proxypp, int64_t shared_secret, int64_t proxy_permissions)
+static int64_t check_remote_participant_permissions(uint32_t domain_id, struct participant *pp, struct proxy_participant *proxypp, int64_t remote_identity_handle)
 {
-  DDSRT_UNUSED_ARG (pp);
-  DDSRT_UNUSED_ARG (proxypp);
-  DDSRT_UNUSED_ARG (shared_secret);
-  DDSRT_UNUSED_ARG (proxy_permissions);
+  struct dds_security_context *sc = q_omg_security_get_secure_context(pp);
+  DDS_Security_SecurityException exception = DDS_SECURITY_EXCEPTION_INIT;
+  struct ddsi_handshake *handshake;
+  DDS_Security_PermissionsToken permissions_token = DDS_SECURITY_TOKEN_INIT;
+  DDS_Security_AuthenticatedPeerCredentialToken peer_credential_token = DDS_SECURITY_TOKEN_INIT;
+  int64_t permissions_hdl = DDS_SECURITY_HANDLE_NIL;
+
+  if (proxypp->plist->present & PP_PERMISSIONS_TOKEN)
+      q_omg_shallow_copyin_DataHolder(&permissions_token, &proxypp->plist->permissions_token);
+  else
+      memset(&permissions_token, 0, sizeof(DDS_Security_PermissionsToken));
+
+  handshake = ddsi_handshake_find(pp, proxypp);
+  if (!handshake)
+  {
+    ELOG(DDS_LC_ERROR, pp, "Could not find handshake local participant "PGUIDFMT" and remote participant "PGUIDFMT,
+                PGUID(pp->e.guid), PGUID(proxypp->e.guid));
+      goto no_handshake;
+  }
+
+  if (!sc->authentication_context->get_authenticated_peer_credential_token(sc->authentication_context, &peer_credential_token, ddsi_handshake_get_handle(handshake), &exception))
+  {
+    if (q_omg_participant_is_access_protected(pp))
+    {
+      EXCEPTION_ERROR(sc, &exception, "Could not authenticate_peer_credential_token for local participan1152t "PGUIDFMT" and remote participant "PGUIDFMT,
+          PGUID(pp->e.guid), PGUID(proxypp->e.guid));
+      goto no_credentials;
+    }
+    /* Failing is allowed due to the non-protection of access. */
+    EXCEPTION_WARNING(sc, &exception, "Could not authenticate_peer_credential_token for local participant "PGUIDFMT" and remote participant "PGUIDFMT ,
+        PGUID(pp->e.guid), PGUID(proxypp->e.guid));
+  }
+
+  permissions_hdl = sc->access_control_context->validate_remote_permissions(
+      sc->access_control_context, sc->authentication_context, pp->sec_attr->local_identity_handle, remote_identity_handle, &permissions_token, &peer_credential_token, &exception);
+  if (permissions_hdl == DDS_SECURITY_HANDLE_NIL)
+  {
+    if (q_omg_participant_is_access_protected(pp))
+    {
+      EXCEPTION_ERROR(sc, &exception, "Could not get remote participant "PGUIDFMT" permissions from plugin", PGUID(proxypp->e.guid));
+      goto no_permissions;
+    }
+    /* Failing is allowed due to the non-protection of access. */
+    EXCEPTION_WARNING(sc, &exception, "Could not get remote participant "PGUIDFMT" permissions from plugin", PGUID(proxypp->e.guid));
+  }
+
+  /* Only check remote participant if joining access is protected. */
+  if (q_omg_participant_is_access_protected(pp))
+  {
+    DDS_Security_ParticipantBuiltinTopicDataSecure participant_data;
+
+    q_omg_shallow_copy_ParticipantBuiltinTopicDataSecure(&participant_data, &(proxypp->e.guid), proxypp->plist);
+    if (!sc->access_control_context->check_remote_participant(sc->access_control_context, permissions_hdl, (DDS_Security_DomainId)domain_id, &participant_data, &exception))
+    {
+      EXCEPTION_WARNING(sc, &exception, "Plugin does not allow remote participant "PGUIDFMT,  PGUID(proxypp->e.guid));
+      if (!sc->access_control_context->return_permissions_handle(sc->access_control_context, permissions_hdl, &exception))
+      {
+        EXCEPTION_ERROR(sc, &exception, "Failed to return remote permissions handle");
+      }
+      permissions_hdl = DDS_SECURITY_HANDLE_NIL;
+    }
+    q_omg_shallow_free_ParticipantBuiltinTopicDataSecure(&participant_data);
+  }
+
+no_permissions:
+  if (!sc->authentication_context->return_authenticated_peer_credential_token(sc->authentication_context, &peer_credential_token, &exception))
+  {
+    EXCEPTION_ERROR(sc, &exception, "Failed to return peer credential token");
+  }
+no_credentials:
+  ddsi_handshake_release(handshake);
+no_handshake:
+  q_omg_shallow_free_DataHolder(&permissions_token);
+  return permissions_hdl;
 }
 
-void q_omg_security_deregister_remote_participant (struct proxy_participant *proxypp)
+static void send_participant_crypto_tokens(struct participant *pp, struct proxy_participant *proxypp, DDS_Security_ParticipantCryptoHandle local_crypto, DDS_Security_ParticipantCryptoHandle remote_crypto)
 {
-  DDSRT_UNUSED_ARG (proxypp);
+  struct dds_security_context *sc = q_omg_security_get_secure_context(pp);
+  DDS_Security_SecurityException exception = DDS_SECURITY_EXCEPTION_INIT;
+  DDS_Security_ParticipantCryptoTokenSeq tokens = DDS_SECURITY_SEQUENCE_INIT;
+  bool r;
+
+  r = sc->crypto_context->crypto_key_exchange->create_local_participant_crypto_tokens(sc->crypto_context->crypto_key_exchange, &tokens, local_crypto, remote_crypto, &exception);
+  if (!r)
+    EXCEPTION_ERROR(sc, &exception, "Failed to create local participant crypto tokens "PGUIDFMT" for remote participant "PGUIDFMT,  PGUID(pp->e.guid), PGUID(proxypp->e.guid));
+  else if (tokens._length > 0)
+  {
+    nn_dataholderseq_t tholder;
+
+    q_omg_shallow_copyout_DataHolderSeq(&tholder, &tokens);
+    write_crypto_participant_tokens(pp, proxypp, &tholder);
+    q_omg_shallow_free_nn_dataholderseq(&tholder);
+
+    if (!sc->crypto_context->crypto_key_exchange->return_crypto_tokens(sc->crypto_context->crypto_key_exchange, &tokens, &exception))
+      EXCEPTION_ERROR(sc, &exception, "Failed to return local participant crypto tokens "PGUIDFMT" for remote participant "PGUIDFMT, PGUID(pp->e.guid), PGUID(proxypp->e.guid));
+  }
+}
+
+static int64_t get_permissions_handle(struct participant *pp, struct proxy_participant *proxypp)
+{
+  int64_t hdl = 0;
+  struct proxypp_pp_match *pm;
+
+  ddsrt_mutex_lock(&proxypp->sec_attr->lock);
+  pm = ddsrt_avl_lookup(&proxypp_pp_treedef, &proxypp->sec_attr->participants, &pp->sec_attr->crypto_handle);
+  if (pm)
+    hdl = pm->permissions_handle;
+  ddsrt_mutex_unlock(&proxypp->sec_attr->lock);
+
+  return hdl;
+}
+
+void q_omg_security_init_remote_participant(struct proxy_participant *proxypp)
+{
+  proxypp->sec_attr = ddsrt_malloc(sizeof(*proxypp->sec_attr));
+  ddsrt_mutex_init(&proxypp->sec_attr->lock);
+  ddsrt_avl_init (&proxypp_pp_treedef, &proxypp->sec_attr->participants);
+  proxypp->sec_attr->sc = proxypp->e.gv->security_context;
+  proxypp->sec_attr->remote_identity_handle = 0;
+  proxypp->sec_attr->crypto_handle = 0;
+  proxypp->sec_attr->initialized = false;
+}
+
+void q_omg_security_remote_participant_set_initialized(struct proxy_participant *proxypp)
+{
+  if (proxypp->sec_attr)
+  {
+    ddsrt_mutex_lock(&proxypp->sec_attr->lock);
+    proxypp->sec_attr->initialized = true;
+    ddsrt_mutex_unlock(&proxypp->sec_attr->lock);
+  }
+}
+
+bool q_omg_security_remote_participant_is_initialized(struct proxy_participant *proxypp)
+{
+  bool initialized = false;
+
+  if (proxypp->sec_attr)
+  {
+    ddsrt_mutex_lock(&proxypp->sec_attr->lock);
+    initialized = proxypp->sec_attr->initialized;
+    ddsrt_mutex_unlock(&proxypp->sec_attr->lock);
+  }
+  return initialized;
+}
+
+static bool proxypp_is_authenticated(const struct proxy_participant *proxypp)
+{
+  bool authenticated = false;
+
+  if (proxypp->sec_attr)
+  {
+    ddsrt_mutex_lock(&proxypp->sec_attr->lock);
+    authenticated = !ddsrt_avl_is_empty(&proxypp->sec_attr->participants);
+    ddsrt_mutex_unlock(&proxypp->sec_attr->lock);
+  }
+  return authenticated;
+}
+
+static void match_proxypp_pp(struct participant *pp, struct proxy_participant *proxypp, DDS_Security_PermissionsHandle permissions_handle, DDS_Security_SharedSecretHandle shared_secret_handle)
+{
+  struct proxypp_pp_match *pm;
+  struct pp_proxypp_match *pc;
+
+  pm = proxypp_pp_match_new(pp, permissions_handle, shared_secret_handle);
+  ddsrt_mutex_lock(&proxypp->sec_attr->lock);
+  ddsrt_avl_insert(&proxypp_pp_treedef, &proxypp->sec_attr->participants, pm);
+  ddsrt_mutex_unlock(&proxypp->sec_attr->lock);
+
+  pc = pp_proxypp_match_new(proxypp, proxypp->sec_attr->crypto_handle);
+
+  ddsrt_mutex_lock(&pp->sec_attr->lock);
+  ddsrt_avl_cinsert(&pp_proxypp_treedef, &pp->sec_attr->proxy_participants, pc);
+  ddsrt_mutex_unlock(&pp->sec_attr->lock);
+}
+
+bool q_omg_security_register_remote_participant(struct participant *pp, struct proxy_participant *proxypp, int64_t shared_secret)
+{
+  bool ret = true;
+  struct ddsi_domaingv *gv = pp->e.gv;
+  struct dds_security_context *sc = q_omg_security_get_secure_context(pp);
+  DDS_Security_SecurityException exception = DDS_SECURITY_EXCEPTION_INIT;
+  DDS_Security_ParticipantCryptoHandle crypto_handle;
+  int64_t permissions_handle;
+  bool notify_handshake = false;
+
+  permissions_handle = check_remote_participant_permissions(gv->config.domainId, pp, proxypp, proxypp->sec_attr->remote_identity_handle);
+  if (permissions_handle == 0)
+    return false;
+
+  GVTRACE("register remote participant "PGUIDFMT" with "PGUIDFMT"\n", PGUID(proxypp->e.guid), PGUID(pp->e.guid));
+
+  crypto_handle = sc->crypto_context->crypto_key_factory->register_matched_remote_participant(
+      sc->crypto_context->crypto_key_factory, pp->sec_attr->crypto_handle, proxypp->sec_attr->remote_identity_handle, permissions_handle, shared_secret, &exception);
+  if (crypto_handle == DDS_SECURITY_HANDLE_NIL)
+  {
+    EXCEPTION_ERROR(sc, &exception, "Failed to register matched remote participant "PGUIDFMT" with participant "PGUIDFMT, PGUID(proxypp->e.guid), PGUID(pp->e.guid));
+    ret = false;
+    goto register_failed;
+  }
+
+  ddsrt_mutex_lock(&pp->e.lock);
+
+  proxypp->sec_attr->crypto_handle = crypto_handle;
+
+  GVTRACE("match pp->crypto=%"PRId64" proxypp->crypto=%"PRId64"\n", pp->sec_attr->crypto_handle, crypto_handle);
+  match_proxypp_pp(pp, proxypp, permissions_handle, shared_secret);
+
+  GVTRACE("create proxypp-pp match pp="PGUIDFMT" proxypp="PGUIDFMT" lidh=%"PRId64, PGUID(pp->e.guid), PGUID(proxypp->e.guid), pp->sec_attr->local_identity_handle);
+
+  if (proxypp_is_rtps_protected(proxypp))
+  {
+    struct security_entity_match *m = find_or_create_entity_match(gv->security_matches, &proxypp->e.guid, &pp->e.guid);
+    m->crypto_handle = crypto_handle;
+    if (m->tokens)
+    {
+      ret = sc->crypto_context->crypto_key_exchange->set_remote_participant_crypto_tokens(sc->crypto_context->crypto_key_exchange, pp->sec_attr->crypto_handle, crypto_handle, m->tokens, &exception);
+      if (ret)
+      {
+        struct security_entity_match *mx;
+        mx = remove_entity_match(proxypp->e.gv->security_matches, &proxypp->e.guid, &pp->e.guid);
+        assert(mx == m);
+        (void)mx;
+        entity_match_free(m);
+        GVTRACE("set participant tokens src("PGUIDFMT") to dst("PGUIDFMT") (by registering remote)\n", PGUID(proxypp->e.guid), PGUID(pp->e.guid));
+      }
+      else
+      {
+        EXCEPTION_ERROR(sc, &exception, "Failed to set remote participant crypto tokens "PGUIDFMT" --> "PGUIDFMT, PGUID(proxypp->e.guid), PGUID(pp->e.guid));
+        ret = false;
+      }
+    }
+    else
+      notify_handshake = true;
+  }
+  ddsrt_mutex_unlock(&pp->e.lock);
+
+  if (notify_handshake)
+    notify_handshake_recv_token(pp, proxypp);
+
+register_failed:
+  return ret;
+}
+
+void q_omg_security_deregister_remote_participant(struct proxy_participant *proxypp)
+{
+  struct ddsi_domaingv *gv = proxypp->e.gv;
+  DDS_Security_SecurityException exception = DDS_SECURITY_EXCEPTION_INIT;
+
+  if (proxypp->sec_attr) {
+    dds_security_context *sc = proxypp->sec_attr->sc;
+    struct proxypp_pp_match *pm;
+    struct participant *pp;
+
+    pm = ddsrt_avl_find_min(&proxypp_pp_treedef, &proxypp->sec_attr->participants);
+    while (pm)
+    {
+      struct proxypp_pp_match *next = ddsrt_avl_find_succ(&proxypp_pp_treedef, &proxypp->sec_attr->participants, pm);
+
+      ddsrt_avl_delete(&proxypp_pp_treedef, &proxypp->sec_attr->participants, pm);
+      pp = entidx_lookup_participant_guid(gv->entity_index, &pm->pp_guid);
+      if (pp)
+        pp_proxypp_unrelate(sc, pp, &proxypp->e.guid);
+      proxypp_pp_match_free(sc, pm);
+      pm = next;
+    }
+
+    if (proxypp->sec_attr->crypto_handle != DDS_SECURITY_HANDLE_NIL)
+    {
+        if (!sc->crypto_context->crypto_key_factory->unregister_participant(sc->crypto_context->crypto_key_factory, proxypp->sec_attr->crypto_handle, &exception))
+            EXCEPTION_ERROR(sc, &exception, "2:Failed to return remote crypto handle");
+    }
+
+    if (proxypp->sec_attr->remote_identity_handle != DDS_SECURITY_HANDLE_NIL)
+    {
+        if (!sc->authentication_context->return_identity_handle(sc->authentication_context, proxypp->sec_attr->remote_identity_handle, &exception))
+            EXCEPTION_ERROR(sc, &exception, "Failed to return remote identity handle");
+    }
+
+    ddsrt_mutex_destroy(&proxypp->sec_attr->lock);
+    ddsrt_free(proxypp->sec_attr);
+    proxypp->sec_attr = NULL;
+  }
 }
 
 bool is_proxy_participant_deletion_allowed (struct ddsi_domaingv * const gv, const struct ddsi_guid *guid, const ddsi_entityid_t pwr_entityid)
@@ -421,98 +1797,103 @@ bool is_proxy_participant_deletion_allowed (struct ddsi_domaingv * const gv, con
     GVLOGDISC (" unknown");
     return false;
   }
-  return (!q_omg_proxyparticipant_is_authenticated (proxypp));
+
+  return (!proxypp_is_authenticated(proxypp));
 }
 
-/* ask to access control security plugin for the remote participant permissions */
-int64_t q_omg_security_check_remote_participant_permissions (uint32_t domain_id, struct participant *pp, struct proxy_participant *proxypp)
+bool q_omg_is_similar_participant_security_info(struct participant *pp, struct proxy_participant *proxypp)
 {
-  DDSRT_UNUSED_ARG (domain_id);
-  DDSRT_UNUSED_ARG (pp);
-  DDSRT_UNUSED_ARG (proxypp);
+  bool matching;
+  nn_security_info_t pp_security_info;
+
+  if (!q_omg_get_participant_security_info(pp, &pp_security_info))
+    return false;
+
+  matching = SECURITY_INFO_COMPATIBLE(pp_security_info, proxypp->security_info, NN_PARTICIPANT_SECURITY_ATTRIBUTES_FLAG_IS_VALID);
+  if (!matching) {
+    DDS_CLOG (DDS_LC_WARNING, &pp->e.gv->logconfig, "match remote_participant "PGUIDFMT" with participant "PGUIDFMT" security_attributes mismatch: 0x%08x.0x%08x - 0x%08x.0x%08x\n",
+        PGUID(proxypp->e.guid), PGUID(pp->e.guid),
+        proxypp->security_info.security_attributes, proxypp->security_info.plugin_security_attributes,
+        pp_security_info.security_attributes, pp_security_info.plugin_security_attributes);
+  } else {
+    /* We previously checked for attribute compatibility. That doesn't
+     * mean equal, because compatibility depends on the valid flag.
+     * Some products don't properly send the attributes, in which case
+     * the valid flag is 0. To be able to support these product, assume
+     * that the attributes are the same. If there is actually a mismatch,
+     * communication will fail at a later moment anyway. */
+    if (!SECURITY_ATTR_IS_VALID(proxypp->security_info.security_attributes)) {
+      proxypp->security_info.security_attributes = pp_security_info.security_attributes;
+    }
+    if (!SECURITY_ATTR_IS_VALID(proxypp->security_info.plugin_security_attributes)) {
+      proxypp->security_info.plugin_security_attributes = pp_security_info.plugin_security_attributes;
+    }
+  }
+  assert(matching);
+  return matching;
+}
+
+void q_omg_security_set_participant_crypto_tokens(struct participant *pp, struct proxy_participant *proxypp, const nn_dataholderseq_t *tokens)
+{
+  struct ddsi_domaingv *gv = pp->e.gv;
+  struct dds_security_context *sc = q_omg_security_get_secure_context(pp);
+  DDS_Security_SecurityException exception = DDS_SECURITY_EXCEPTION_INIT;
+  struct proxypp_pp_match *pm;
+  DDS_Security_DatawriterCryptoTokenSeq *tseq;
+  struct security_entity_match *m;
+
+  if (!sc)
+    return;
+
+  ddsrt_mutex_lock(&proxypp->sec_attr->lock);
+  pm = ddsrt_avl_lookup (&proxypp_pp_treedef, &proxypp->sec_attr->participants, &pp->sec_attr->crypto_handle);
+  ddsrt_mutex_unlock(&proxypp->sec_attr->lock);
+
+  ddsrt_mutex_lock(&pp->e.lock);
+  m = find_or_create_entity_match(gv->security_matches, &proxypp->e.guid, &pp->e.guid);
+
+  tseq = DDS_Security_DataHolderSeq_alloc();
+  q_omg_copyin_DataHolderSeq(tseq, tokens);
+
+  if (!pm)
+  {
+    GVTRACE("remember participant tokens src("PGUIDFMT") dst("PGUIDFMT")\n", PGUID(proxypp->e.guid), PGUID(pp->e.guid));
+    m->tokens = tseq;
+  }
+  else
+  {
+    if (sc->crypto_context->crypto_key_exchange->set_remote_participant_crypto_tokens(sc->crypto_context->crypto_key_exchange, pp->sec_attr->crypto_handle, proxypp->sec_attr->crypto_handle, tseq, &exception))
+    {
+      m->matched= true;
+      GVTRACE("set participant tokens src("PGUIDFMT") dst("PGUIDFMT")\n", PGUID(proxypp->e.guid), PGUID(pp->e.guid));
+      DDS_Security_DataHolderSeq_free(tseq);
+    }
+    else
+      EXCEPTION_ERROR(sc, &exception, "Failed to set remote participant crypto tokens "PGUIDFMT" for participant "PGUIDFMT, PGUID(proxypp->e.guid), PGUID(pp->e.guid));
+  }
+  ddsrt_mutex_unlock(&pp->e.lock);
+
+  notify_handshake_recv_token(pp, proxypp);
+}
+
+void q_omg_security_participant_send_tokens(struct participant *pp, struct proxy_participant *proxypp)
+{
+  if (proxypp->sec_attr->crypto_handle != 0)
+    send_participant_crypto_tokens(pp, proxypp, pp->sec_attr->crypto_handle, proxypp->sec_attr->crypto_handle);
+}
+
+int64_t q_omg_security_get_remote_participant_handle(struct proxy_participant *proxypp)
+{
+  if (proxypp->sec_attr)
+    return proxypp->sec_attr->crypto_handle;
+
   return 0;
 }
 
-bool q_omg_is_similar_participant_security_info (struct participant *pp, struct proxy_participant *proxypp)
+void set_proxy_participant_security_info(struct proxy_participant *proxypp, const ddsi_plist_t *plist)
 {
-  DDSRT_UNUSED_ARG (pp);
-  DDSRT_UNUSED_ARG (proxypp);
-  return true;
-}
-
-bool q_omg_security_check_create_participant (struct participant *pp, uint32_t domain_id)
-{
-  DDSRT_UNUSED_ARG (pp);
-  DDSRT_UNUSED_ARG (domain_id);
-  return true;
-}
-
-void q_omg_security_participant_send_tokens (struct participant *pp, struct proxy_participant *proxypp)
-{
-  DDSRT_UNUSED_ARG (pp);
-  DDSRT_UNUSED_ARG (proxypp);
-}
-
-bool q_omg_security_match_remote_writer_enabled (struct reader *rd, struct proxy_writer *pwr)
-{
-  DDSRT_UNUSED_ARG (rd);
-  DDSRT_UNUSED_ARG (pwr);
-  assert (rd);
-  assert (pwr);
-  return true;
-}
-
-bool q_omg_security_match_remote_reader_enabled (struct writer *wr, struct proxy_reader *prd)
-{
-  DDSRT_UNUSED_ARG (wr);
-  DDSRT_UNUSED_ARG (prd);
-  assert (wr);
-  assert (prd);
-  return true;
-}
-
-bool q_omg_security_check_remote_writer_permissions (const struct proxy_writer *pwr, uint32_t domain_id, struct participant *pp)
-{
-  DDSRT_UNUSED_ARG (pwr);
-  DDSRT_UNUSED_ARG (domain_id);
-  DDSRT_UNUSED_ARG (pp);
-  assert (pwr);
-  assert (pp);
-  assert (pwr->c.proxypp);
-  return true;
-}
-
-bool q_omg_security_check_remote_reader_permissions (const struct proxy_reader *prd, uint32_t domain_id, struct participant *pp)
-{
-  DDSRT_UNUSED_ARG (prd);
-  DDSRT_UNUSED_ARG (domain_id);
-  DDSRT_UNUSED_ARG (pp);
-  assert (prd);
-  assert (pp);
-  assert (prd->c.proxypp);
-  return true;
-}
-
-bool q_omg_security_is_remote_rtps_protected (const struct proxy_participant *proxy_pp, ddsi_entityid_t entityid)
-{
-  /* TODO: Handshake */
-  DDSRT_UNUSED_ARG (proxy_pp);
-  DDSRT_UNUSED_ARG (entityid);
-  return false;
-}
-
-bool q_omg_security_is_local_rtps_protected (const struct participant *pp, ddsi_entityid_t entityid)
-{
-  /* TODO: Handshake */
-  DDSRT_UNUSED_ARG (pp);
-  DDSRT_UNUSED_ARG (entityid);
-  return false;
-}
-
-void set_proxy_participant_security_info (struct proxy_participant *proxypp, const ddsi_plist_t *plist)
-{
-  assert (proxypp);
-  assert (plist);
+  assert(proxypp);
+  assert(plist);
   if (plist->present & PP_PARTICIPANT_SECURITY_INFO) {
     proxypp->security_info.security_attributes = plist->participant_security_info.security_attributes;
     proxypp->security_info.plugin_security_attributes = plist->participant_security_info.plugin_security_attributes;
@@ -522,7 +1903,300 @@ void set_proxy_participant_security_info (struct proxy_participant *proxypp, con
   }
 }
 
-static void q_omg_get_proxy_endpoint_security_info (const struct entity_common *entity, nn_security_info_t *proxypp_sec_info, const ddsi_plist_t *plist, nn_security_info_t *info)
+bool q_omg_writer_is_discovery_protected(const struct writer *wr)
+{
+  assert (wr != NULL);
+  return wr->sec_attr != NULL && wr->sec_attr->attr.is_discovery_protected;
+}
+
+bool q_omg_writer_is_submessage_protected(const struct writer *wr)
+{
+  assert (wr != NULL);
+  return wr->sec_attr != NULL && wr->sec_attr->attr.is_submessage_protected;
+}
+
+bool q_omg_writer_is_payload_protected(const struct writer *wr)
+{
+  assert (wr != NULL);
+  return wr->sec_attr != NULL && wr->sec_attr->attr.is_payload_protected;
+}
+
+bool q_omg_security_check_remote_writer_permissions(const struct proxy_writer *pwr, uint32_t domain_id, struct participant *pp)
+{
+  struct ddsi_domaingv *gv = pp->e.gv;
+  struct dds_security_context *sc = q_omg_security_get_secure_context(pp);
+  DDS_Security_SecurityException exception = DDS_SECURITY_EXCEPTION_INIT;
+  DDS_Security_PublicationBuiltinTopicDataSecure publication_data;
+  bool ok = true;
+
+  if (!sc)
+    return true;
+
+  if (!q_omg_proxy_participant_is_secure(pwr->c.proxypp))
+  {
+    if (q_omg_participant_allow_unauthenticated(pp))
+    {
+      GVTRACE (" allow non-secure remote writer "PGUIDFMT, PGUID (pwr->e.guid));
+      return true;
+    }
+    else
+    {
+      GVWARNING("Non secure remote writer "PGUIDFMT" is not allowed.", PGUID(pwr->e.guid));
+      return false;
+    }
+  }
+
+  if (SECURITY_INFO_IS_WRITE_PROTECTED(pwr->security_info))
+  {
+    DDS_Security_PermissionsHandle permissions_handle;
+
+    if ((permissions_handle = get_permissions_handle(pp, pwr->c.proxypp)) != 0)
+    {
+      GVTRACE("Secure remote writer "PGUIDFMT" proxypp does not have permissions handle yet\n", PGUID(pwr->e.guid));
+      return false;
+    }
+    else
+    {
+      q_omg_shallow_copy_PublicationBuiltinTopicDataSecure(&publication_data, &pwr->e.guid, pwr->c.xqos, &pwr->security_info);
+      ok = sc->access_control_context->check_remote_datawriter(sc->access_control_context, permissions_handle, (int)domain_id, &publication_data, &exception);
+      q_omg_shallow_free_PublicationBuiltinTopicDataSecure(&publication_data);
+      if (!ok)
+      {
+        if (!is_topic_discovery_protected(pp->sec_attr->permissions_handle, sc->access_control_context, publication_data.topic_name))
+          EXCEPTION_ERROR(sc, &exception, "Access control does not allow remote writer "PGUIDFMT": %s", PGUID(pwr->e.guid));
+        else
+          DDS_Security_Exception_reset(&exception);
+      }
+    }
+  }
+
+  return ok;
+}
+
+static void send_reader_crypto_tokens(struct reader *rd, struct proxy_writer *pwr, DDS_Security_DatareaderCryptoHandle local_crypto, DDS_Security_DatawriterCryptoHandle remote_crypto)
+{
+  struct dds_security_context *sc = q_omg_security_get_secure_context(rd->c.pp);
+  struct ddsi_domaingv *gv = rd->e.gv;
+  DDS_Security_SecurityException exception = DDS_SECURITY_EXCEPTION_INIT;
+  DDS_Security_DatawriterCryptoTokenSeq tokens = {0, 0, NULL};
+  bool r;
+
+  GVTRACE("send reader tokens "PGUIDFMT" to writer "PGUIDFMT"\n", PGUID(rd->e.guid), PGUID(pwr->e.guid));
+
+  r = sc->crypto_context->crypto_key_exchange->create_local_datareader_crypto_tokens(sc->crypto_context->crypto_key_exchange, &tokens, local_crypto, remote_crypto, &exception);
+  if (!r)
+    EXCEPTION_ERROR(sc, &exception,"Failed to create local reader crypto tokens "PGUIDFMT" for remote writer "PGUIDFMT, PGUID(rd->e.guid), PGUID(pwr->e.guid));
+  else if (tokens._length > 0)
+  {
+    nn_dataholderseq_t tholder;
+
+    q_omg_shallow_copyout_DataHolderSeq(&tholder, &tokens);
+    write_crypto_reader_tokens(rd, pwr, &tholder);
+    q_omg_shallow_free_nn_dataholderseq(&tholder);
+
+    if (!sc->crypto_context->crypto_key_exchange->return_crypto_tokens(sc->crypto_context->crypto_key_exchange, &tokens, &exception))
+      EXCEPTION_ERROR(sc, &exception, "Failed to return local reader crypto tokens "PGUIDFMT" for remote writer "PGUIDFMT, PGUID(rd->e.guid), PGUID(pwr->e.guid));
+  }
+}
+
+static bool q_omg_security_register_remote_writer_match(struct proxy_writer *pwr, struct reader *rd, int64_t *crypto_handle)
+{
+  struct participant *pp = rd->c.pp;
+  struct proxy_participant *proxypp = pwr->c.proxypp;
+  struct ddsi_domaingv *gv = pp->e.gv;
+  struct dds_security_context *sc = q_omg_security_get_secure_context(pp);
+  DDS_Security_SecurityException exception = DDS_SECURITY_EXCEPTION_INIT;
+  struct proxypp_pp_match *pm;
+  struct security_entity_match *match;
+  bool send_tokens = false;
+
+  ddsrt_mutex_lock(&proxypp->sec_attr->lock);
+  pm = ddsrt_avl_lookup(&proxypp_pp_treedef, &proxypp->sec_attr->participants, &pp->sec_attr->crypto_handle);
+  ddsrt_mutex_unlock(&proxypp->sec_attr->lock);
+
+  if (!pm)
+    return false;
+
+  /* TODO: the security_entity_match should be removed after the the received tokens are stored in the plugin.
+   * Currently the security_entity_match is also used to detect if a match between a reader and writer has
+   * already been completed.
+   */
+  ddsrt_mutex_lock(&rd->e.lock);
+  match = find_or_create_entity_match(gv->security_matches, &pwr->e.guid, &rd->e.guid);
+  if (match->matched)
+    *crypto_handle = match->crypto_handle;
+  else
+  {
+    /* Generate writer crypto info. */
+    match->crypto_handle = sc->crypto_context->crypto_key_factory->register_matched_remote_datawriter(
+        sc->crypto_context->crypto_key_factory, rd->sec_attr->crypto_handle, proxypp->sec_attr->crypto_handle, pm->shared_secret, &exception);
+
+    *crypto_handle = match->crypto_handle;
+
+    if (match->crypto_handle == 0)
+      EXCEPTION_ERROR(sc, &exception, "Failed to register remote writer "PGUIDFMT" with reader "PGUIDFMT, PGUID(pwr->e.guid), PGUID(rd->e.guid));
+    else if (rd->e.guid.entityid.u == NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_VOLATILE_SECURE_READER)
+    {
+      /* The builtin ParticipantVolatileSecure endpoints do not exchange tokens.
+       * Simulate that we already got them. */
+      match->matched = true;
+      GVTRACE(" volatile secure reader: proxypp_crypto=%"PRId64" rd_crypto=%"PRId64" pwr_crypto=%"PRId64"\n", proxypp->sec_attr->crypto_handle, rd->sec_attr->crypto_handle, match->crypto_handle);
+    }
+    else
+    {
+      send_tokens = true;
+      if (match->tokens)
+      {
+        if (sc->crypto_context->crypto_key_exchange->set_remote_datawriter_crypto_tokens(
+            sc->crypto_context->crypto_key_exchange, rd->sec_attr->crypto_handle, match->crypto_handle, match->tokens, &exception))
+        {
+          match->matched = true;
+          DDS_Security_DataHolderSeq_free(match->tokens);
+          match->tokens = NULL;
+          GVTRACE("match_remote_writer "PGUIDFMT" with reader "PGUIDFMT": tokens available\n", PGUID(pwr->e.guid), PGUID(rd->e.guid));
+        }
+        else
+          EXCEPTION_ERROR(sc, &exception, "Failed to set remote writer crypto tokens "PGUIDFMT" --> "PGUIDFMT, PGUID(pwr->e.guid), PGUID(rd->e.guid));
+      }
+    }
+  }
+  ddsrt_mutex_unlock(&rd->e.lock);
+
+  if (send_tokens)
+    (void)send_reader_crypto_tokens(rd, pwr, rd->sec_attr->crypto_handle, match->crypto_handle);
+
+  return match->matched;
+}
+
+bool q_omg_security_match_remote_writer_enabled(struct reader *rd, struct proxy_writer *pwr, int64_t *crypto_handle)
+{
+  struct ddsi_domaingv *gv = rd->e.gv;
+  nn_security_info_t info;
+
+  if (!rd->sec_attr)
+    return true;
+
+  /*
+   * Check if the security settings match by checking the attributes.
+   *
+   * The attributes will be 0 when security is not enabled for the related
+   * federation or the security configuration told that this endpoint should
+   * not be protected.
+   *
+   * This can mean that an unprotected endpoint of a secure federation can
+   * connect to an endpoint of a non-secure federation. However, that will
+   * be blocked by q_omg_security_check_remote_writer_permissions() if
+   * q_omg_participant_allow_unauthenticated() returns FALSE there.
+   */
+  (void)q_omg_get_reader_security_info(rd, &info);
+  if (!SECURITY_INFO_COMPATIBLE(pwr->security_info, info, NN_ENDPOINT_SECURITY_ATTRIBUTES_FLAG_IS_VALID))
+  {
+    GVWARNING("match_remote_writer "PGUIDFMT" with reader "PGUIDFMT" security_attributes mismatch: 0x%08x.0x%08x - 0x%08x.0x%08x\n",
+                PGUID(pwr->e.guid), PGUID(rd->e.guid),
+                pwr->security_info.security_attributes, pwr->security_info.plugin_security_attributes,
+                info.security_attributes, info.plugin_security_attributes);
+    return false;
+  }
+
+  if ((!rd->sec_attr->attr.is_payload_protected ) && (!rd->sec_attr->attr.is_submessage_protected))
+    return true;
+
+  if (!q_omg_proxy_participant_is_secure(pwr->c.proxypp))
+  {
+    /* Remote proxy was downgraded to a non-secure participant,
+     * but the local endpoint is protected. */
+    return false;
+  }
+
+  /* We previously checked for attribute compatibility. That doesn't
+   * mean equal, because compatibility depends on the valid flag.
+   * Some products don't properly send the attributes, in which case
+   * the valid flag is 0. To be able to support these product, assume
+   * that the attributes are the same. If there is actually a mismatch,
+   * communication will fail at a later moment anyway. */
+  if (!SECURITY_ATTR_IS_VALID(pwr->security_info.security_attributes)) {
+    pwr->security_info.security_attributes = info.security_attributes;
+  }
+  if (!SECURITY_ATTR_IS_VALID(pwr->security_info.plugin_security_attributes)) {
+    pwr->security_info.plugin_security_attributes = info.plugin_security_attributes;
+  }
+
+  return q_omg_security_register_remote_writer_match(pwr, rd, crypto_handle);
+}
+
+void q_omg_security_deregister_remote_writer_match(const struct ddsi_domaingv *gv, const ddsi_guid_t *rd_guid, struct rd_pwr_match *m)
+{
+  struct dds_security_context *sc = gv->security_context;
+  DDS_Security_SecurityException exception = DDS_SECURITY_EXCEPTION_INIT;
+  struct security_entity_match *match = NULL;
+
+  if (m->crypto_handle != 0)
+  {
+    match = remove_entity_match(gv->security_matches, &m->pwr_guid, rd_guid);
+    if (match)
+    {
+      assert(match->crypto_handle == m->crypto_handle);
+      if (!sc->crypto_context->crypto_key_factory->unregister_datawriter(sc->crypto_context->crypto_key_factory, match->crypto_handle, &exception))
+        EXCEPTION_ERROR(sc, &exception, "Failed to unregster remote writer "PGUIDFMT" for reader "PGUIDFMT, PGUID(m->pwr_guid), PGUID(*rd_guid));
+      entity_match_free(match);
+    }
+  }
+}
+
+bool q_omg_security_check_remote_reader_permissions(const struct proxy_reader *prd, uint32_t domain_id, struct participant *pp)
+{
+  struct ddsi_domaingv *gv = pp->e.gv;
+  struct dds_security_context *sc = q_omg_security_get_secure_context(pp);
+  DDS_Security_SecurityException exception = DDS_SECURITY_EXCEPTION_INIT;
+  bool ok = true;
+
+  if (!sc)
+    return true;
+
+  if (!q_omg_proxy_participant_is_secure(prd->c.proxypp))
+  {
+    if (q_omg_participant_allow_unauthenticated(pp))
+    {
+      GVTRACE (" allow non-secure remote reader "PGUIDFMT, PGUID (prd->e.guid));
+      return true;
+    }
+    else
+    {
+      GVWARNING("Non secure remote reader "PGUIDFMT" is not allowed.", PGUID(prd->e.guid));
+      return false;
+    }
+  }
+
+  if (SECURITY_INFO_IS_READ_PROTECTED(prd->security_info))
+  {
+    DDS_Security_PermissionsHandle permissions_handle;
+
+    if ((permissions_handle = get_permissions_handle(pp, prd->c.proxypp)) != 0)
+    {
+      GVTRACE("Secure remote reader "PGUIDFMT" proxypp does not have permissions handle yet\n", PGUID(prd->e.guid));
+      return false;
+    }
+    else
+    {
+      DDS_Security_SubscriptionBuiltinTopicDataSecure subscription_data;
+
+      q_omg_shallow_copy_SubscriptionBuiltinTopicDataSecure(&subscription_data, &prd->e.guid, prd->c.xqos, &prd->security_info);
+      ok = sc->access_control_context->check_remote_datareader(sc->access_control_context, permissions_handle, (int)domain_id, &subscription_data, false, &exception);
+      q_omg_shallow_free_SubscriptionBuiltinTopicDataSecure(&subscription_data);
+      if (!ok)
+      {
+        if (!is_topic_discovery_protected(pp->sec_attr->permissions_handle, sc->access_control_context, subscription_data.topic_name))
+          EXCEPTION_ERROR(sc, &exception, "Access control does not allow remote reader "PGUIDFMT": %s", PGUID(prd->e.guid));
+        else
+          DDS_Security_Exception_reset(&exception);
+      }
+    }
+  }
+
+  return ok;
+}
+
+static void q_omg_get_proxy_endpoint_security_info(const struct entity_common *entity, nn_security_info_t *proxypp_sec_info, const ddsi_plist_t *plist, nn_security_info_t *info)
 {
   const bool proxypp_info_available =
     (proxypp_sec_info->security_attributes != 0 || proxypp_sec_info->plugin_security_attributes != 0);
@@ -600,120 +2274,821 @@ static void q_omg_get_proxy_endpoint_security_info (const struct entity_common *
   }
 }
 
-void set_proxy_reader_security_info (struct proxy_reader *prd, const ddsi_plist_t *plist)
+void q_omg_get_proxy_reader_security_info(struct proxy_reader *prd, const ddsi_plist_t *plist, nn_security_info_t *info)
+{
+  q_omg_get_proxy_endpoint_security_info(&(prd->e), &(prd->c.proxypp->security_info), plist, info);
+}
+
+void set_proxy_reader_security_info(struct proxy_reader *prd, const ddsi_plist_t *plist)
 {
   assert (prd);
   q_omg_get_proxy_endpoint_security_info (&prd->e, &prd->c.proxypp->security_info, plist, &prd->c.security_info);
 }
 
-void set_proxy_writer_security_info (struct proxy_writer *pwr, const ddsi_plist_t *plist)
+
+void q_omg_get_proxy_writer_security_info(struct proxy_writer *pwr, const ddsi_plist_t *plist, nn_security_info_t *info)
+{
+  q_omg_get_proxy_endpoint_security_info(&(pwr->e), &(pwr->c.proxypp->security_info), plist, info);
+}
+
+void set_proxy_writer_security_info(struct proxy_writer *pwr, const ddsi_plist_t *plist)
 {
   assert (pwr);
   q_omg_get_proxy_endpoint_security_info (&pwr->e, &pwr->c.proxypp->security_info, plist, &pwr->c.security_info);
 }
 
-
-static bool q_omg_security_encode_datareader_submessage (struct reader *rd, const ddsi_guid_prefix_t *dst_prefix, const unsigned char *src_buf, size_t src_len, unsigned char **dst_buf, size_t *dst_len)
+void q_omg_security_deregister_remote_reader_match(const struct ddsi_domaingv *gv, const ddsi_guid_t *wr_guid, struct wr_prd_match *m)
 {
-  /* TODO: Use proper keys to actually encode (need key-exchange). */
-  DDSRT_UNUSED_ARG (rd);
-  DDSRT_UNUSED_ARG (dst_prefix);
-  DDSRT_UNUSED_ARG (src_buf);
-  DDSRT_UNUSED_ARG (src_len);
-  DDSRT_UNUSED_ARG (dst_buf);
-  DDSRT_UNUSED_ARG (dst_len);
-  return false;
+  struct dds_security_context *sc = gv->security_context;
+  DDS_Security_SecurityException exception = DDS_SECURITY_EXCEPTION_INIT;
+  struct security_entity_match *match = NULL;
+
+  if (m->crypto_handle)
+  {
+    match = remove_entity_match(gv->security_matches, &m->prd_guid, wr_guid);
+    if (match)
+    {
+      assert(match->crypto_handle == m->crypto_handle);
+
+      if (!sc->crypto_context->crypto_key_factory->unregister_datareader(sc->crypto_context->crypto_key_factory, match->crypto_handle, &exception))
+        EXCEPTION_ERROR(sc, &exception, "Failed to unregister remote reader "PGUIDFMT" for writer "PGUIDFMT, PGUID(m->prd_guid), PGUID(*wr_guid));
+      entity_match_free(match);
+    }
+  }
+}
+
+static void send_writer_crypto_tokens(struct writer *wr, struct proxy_reader *prd, DDS_Security_DatawriterCryptoHandle local_crypto, DDS_Security_DatareaderCryptoHandle remote_crypto)
+{
+  struct dds_security_context *sc = q_omg_security_get_secure_context(wr->c.pp);
+  struct ddsi_domaingv *gv = wr->e.gv;
+  DDS_Security_SecurityException exception = DDS_SECURITY_EXCEPTION_INIT;
+  DDS_Security_DatawriterCryptoTokenSeq tokens = {0, 0, NULL};
+  bool r;
+
+  GVTRACE("send writer tokens "PGUIDFMT" to reader "PGUIDFMT"\n", PGUID(wr->e.guid), PGUID(prd->e.guid));
+
+  r = sc->crypto_context->crypto_key_exchange->create_local_datawriter_crypto_tokens(sc->crypto_context->crypto_key_exchange, &tokens, local_crypto, remote_crypto, &exception);
+  if (!r)
+    EXCEPTION_ERROR(sc, &exception,"Failed to create local writer crypto tokens "PGUIDFMT" for remote reader "PGUIDFMT, PGUID(wr->e.guid), PGUID(prd->e.guid));
+  else if (tokens._length > 0)
+  {
+    nn_dataholderseq_t tholder;
+
+    q_omg_shallow_copyout_DataHolderSeq(&tholder, &tokens);
+    write_crypto_writer_tokens(wr, prd, &tholder);
+    q_omg_shallow_free_nn_dataholderseq(&tholder);
+
+    if (!sc->crypto_context->crypto_key_exchange->return_crypto_tokens(sc->crypto_context->crypto_key_exchange, &tokens, &exception))
+      EXCEPTION_ERROR(sc, &exception, "Failed to return local writer crypto tokens "PGUIDFMT" for remote reader "PGUIDFMT, PGUID(wr->e.guid), PGUID(prd->e.guid));
+  }
+}
+
+static bool q_omg_security_register_remote_reader_match(struct proxy_reader *prd, struct writer *wr, int64_t *crypto_handle)
+{
+  struct participant *pp = wr->c.pp;
+  struct proxy_participant *proxypp = prd->c.proxypp;
+  struct ddsi_domaingv *gv = pp->e.gv;
+  struct dds_security_context *sc = q_omg_security_get_secure_context(pp);
+  DDS_Security_SecurityException exception = DDS_SECURITY_EXCEPTION_INIT;
+  struct proxypp_pp_match *pm;
+  struct security_entity_match *match;
+  bool send_tokens = false;
+
+  *crypto_handle = 0;
+
+  ddsrt_mutex_lock(&proxypp->sec_attr->lock);
+  pm = ddsrt_avl_lookup(&proxypp_pp_treedef, &proxypp->sec_attr->participants, &pp->sec_attr->crypto_handle);
+  ddsrt_mutex_unlock(&proxypp->sec_attr->lock);
+  if (!pm)
+    return false;
+
+  /* TODO: the security_entity_match should be removed after the the received tokens are stored in the plugin.
+   * Currently the security_entity_match is also used to detect if a match between a reader and writer has
+   * already been completed.
+   */
+  ddsrt_mutex_lock(&wr->e.lock);
+  match = find_or_create_entity_match(gv->security_matches, &prd->e.guid, &wr->e.guid);
+  if (match->matched)
+    *crypto_handle = match->crypto_handle;
+  else
+  {
+    /* Generate writer crypto info. */
+    match->crypto_handle = sc->crypto_context->crypto_key_factory->register_matched_remote_datareader(
+        sc->crypto_context->crypto_key_factory, wr->sec_attr->crypto_handle, proxypp->sec_attr->crypto_handle, pm->shared_secret, false, &exception);
+
+    *crypto_handle = match->crypto_handle;
+
+    if (match->crypto_handle == 0)
+      EXCEPTION_ERROR(sc, &exception, "Failed to register remote reader "PGUIDFMT" with writer "PGUIDFMT, PGUID(prd->e.guid), PGUID(wr->e.guid));
+    else if (wr->e.guid.entityid.u == NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_VOLATILE_SECURE_WRITER)
+    {
+      /* The builtin ParticipantVolatileSecure endpoints do not exchange tokens.
+       * Simulate that we already got them. */
+      match->matched = true;
+      GVTRACE(" volatile secure writer: proxypp_crypto=%"PRId64" wr_crypto=%"PRId64" prd_crypto=%"PRId64"\n", proxypp->sec_attr->crypto_handle, wr->sec_attr->crypto_handle, match->crypto_handle);
+    }
+    else
+    {
+      send_tokens = true;
+      if (match->tokens)
+      {
+        if (sc->crypto_context->crypto_key_exchange->set_remote_datareader_crypto_tokens(
+            sc->crypto_context->crypto_key_exchange, wr->sec_attr->crypto_handle, match->crypto_handle, match->tokens, &exception))
+        {
+          match->matched = true;
+          DDS_Security_DataHolderSeq_free(match->tokens);
+          match->tokens = NULL;;
+          GVTRACE("match_remote_reader "PGUIDFMT" with writer "PGUIDFMT": tokens available\n", PGUID(prd->e.guid), PGUID(wr->e.guid));
+        }
+        else
+          EXCEPTION_ERROR(sc, &exception, "Failed to set remote reader crypto tokens "PGUIDFMT" --> "PGUIDFMT, PGUID(prd->e.guid), PGUID(wr->e.guid));
+      }
+      else if (!wr->sec_attr->attr.is_submessage_protected)
+        match->matched = true;
+    }
+  }
+  ddsrt_mutex_unlock(&wr->e.lock);
+
+  if (send_tokens)
+    (void)send_writer_crypto_tokens(wr, prd, wr->sec_attr->crypto_handle, match->crypto_handle);
+
+  return match->matched;
+}
+
+bool q_omg_security_match_remote_reader_enabled(struct writer *wr, struct proxy_reader *prd, int64_t *crypto_handle)
+{
+  struct ddsi_domaingv *gv = wr->e.gv;
+  nn_security_info_t info;
+
+  if (!wr->sec_attr)
+    return true;
+
+  /*
+   * Check if the security settings match by checking the attributes.
+   *
+   * The attributes will be 0 when security is not enabled for the related
+   * federation or the security configuration told that this endpoint should
+   * not be protected.
+   *
+   * This can mean that an unprotected endpoint of a secure federation can
+   * connect to an endpoint of a non-secure federation. However, that will
+   * be blocked by q_omg_security_check_remote_reader_permissions() if
+   * q_omg_participant_allow_unauthenticated() returns FALSE there.
+   */
+  (void)q_omg_get_writer_security_info(wr, &info);
+  if (!SECURITY_INFO_COMPATIBLE(prd->security_info, info, NN_ENDPOINT_SECURITY_ATTRIBUTES_FLAG_IS_VALID))
+  {
+    GVWARNING("match_remote_reader "PGUIDFMT" with writer "PGUIDFMT" security_attributes mismatch: 0x%08x.0x%08x - 0x%08x.0x%08x\n",
+        PGUID(prd->e.guid), PGUID(wr->e.guid),
+        prd->security_info.security_attributes, prd->security_info.plugin_security_attributes,
+        info.security_attributes, info.plugin_security_attributes);
+    return false;
+  }
+
+  if (!wr->sec_attr->attr.is_submessage_protected  && !wr->sec_attr->attr.is_payload_protected)
+    return true;
+
+  if (!q_omg_proxy_participant_is_secure(prd->c.proxypp))
+  {
+    /* Remote proxy was downgraded to a non-secure participant,
+     * but the local endpoint is protected. */
+    return false;
+  }
+
+  /* We previously checked for attribute compatibility. That doesn't
+   * mean equal, because compatibility depends on the valid flag.
+   * Some products don't properly send the attributes, in which case
+   * the valid flag is 0. To be able to support these product, assume
+   * that the attributes are the same. If there is actually a mismatch,
+   * communication will fail at a later moment anyway. */
+  if (!SECURITY_ATTR_IS_VALID(prd->security_info.security_attributes)) {
+    prd->security_info.security_attributes = info.security_attributes;
+  }
+  if (!SECURITY_ATTR_IS_VALID(prd->security_info.plugin_security_attributes)) {
+    prd->security_info.plugin_security_attributes = info.plugin_security_attributes;
+  }
+
+  return q_omg_security_register_remote_reader_match(prd, wr, crypto_handle);
+}
+
+void q_omg_security_set_remote_writer_crypto_tokens(struct reader *rd, const ddsi_guid_t *pwr_guid, const nn_dataholderseq_t *tokens)
+{
+  struct dds_security_context *sc = q_omg_security_get_secure_context(rd->c.pp);
+  struct ddsi_domaingv *gv = rd->e.gv;
+  DDS_Security_SecurityException exception = DDS_SECURITY_EXCEPTION_INIT;
+  struct security_entity_match *match;
+  struct proxy_writer *pwr = NULL;
+
+  if (!sc)
+     return;
+
+  ddsrt_mutex_lock(&rd->e.lock);
+  match = find_or_create_entity_match(gv->security_matches, pwr_guid, &rd->e.guid);
+  if (match->matched)
+  {
+    ddsrt_mutex_unlock(&rd->e.lock);
+    return;
+  }
+
+  DDS_Security_DatawriterCryptoTokenSeq * tseq = DDS_Security_DataHolderSeq_alloc();
+  q_omg_copyin_DataHolderSeq(tseq, tokens);
+
+  if ((pwr = entidx_lookup_proxy_writer_guid(gv->entity_index, pwr_guid)) == NULL || match->crypto_handle == 0 )
+  {
+    GVTRACE("remember writer tokens src("PGUIDFMT") dst("PGUIDFMT")\n", PGUID(*pwr_guid), PGUID(rd->e.guid));
+    match->tokens = tseq;
+  }
+  else
+  {
+    if (sc->crypto_context->crypto_key_exchange->set_remote_datawriter_crypto_tokens(sc->crypto_context->crypto_key_exchange, rd->sec_attr->crypto_handle, match->crypto_handle, tseq, &exception))
+    {
+      GVTRACE("set_remote_writer_crypto_tokens "PGUIDFMT" with reader "PGUIDFMT"\n", PGUID(pwr->e.guid), PGUID(rd->e.guid));
+      match->matched = true;
+      DDS_Security_DataHolderSeq_free(tseq);
+    }
+    else
+      EXCEPTION_ERROR(sc, &exception, "Failed to set remote writer crypto tokens "PGUIDFMT" for reader "PGUIDFMT, PGUID(pwr->e.guid), PGUID(rd->e.guid));
+  }
+  ddsrt_mutex_unlock(&rd->e.lock);
+
+  if (match->matched)
+    connect_reader_with_proxy_writer_secure(rd, pwr, now_mt (), match->crypto_handle);
+
+  if (pwr)
+    notify_handshake_recv_token(rd->c.pp, pwr->c.proxypp);
+}
+
+void q_omg_security_set_remote_reader_crypto_tokens(struct writer *wr, const ddsi_guid_t *prd_guid, const nn_dataholderseq_t *tokens)
+{
+  struct dds_security_context *sc = q_omg_security_get_secure_context(wr->c.pp);
+  struct ddsi_domaingv *gv = wr->e.gv;
+  DDS_Security_SecurityException exception = DDS_SECURITY_EXCEPTION_INIT;
+  struct security_entity_match *match;
+  struct proxy_reader *prd = NULL;
+
+  if (!sc)
+     return;
+
+  ddsrt_mutex_lock(&wr->e.lock);
+  match = find_or_create_entity_match(gv->security_matches, prd_guid, &wr->e.guid);
+  if (match->matched)
+  {
+    ddsrt_mutex_unlock(&wr->e.lock);
+    return;
+  }
+
+  DDS_Security_DatawriterCryptoTokenSeq *tseq = DDS_Security_DataHolderSeq_alloc();
+  q_omg_copyin_DataHolderSeq(tseq, tokens);
+
+  if (((prd = entidx_lookup_proxy_reader_guid(gv->entity_index, prd_guid)) == NULL) || (match->crypto_handle == 0))
+  {
+    GVTRACE("remember reader tokens src("PGUIDFMT") dst("PGUIDFMT")\n", PGUID(*prd_guid), PGUID(wr->e.guid));
+    match->tokens = tseq;
+  }
+  else
+  {
+    if (sc->crypto_context->crypto_key_exchange->set_remote_datareader_crypto_tokens(sc->crypto_context->crypto_key_exchange, wr->sec_attr->crypto_handle, match->crypto_handle, tseq, &exception))
+    {
+      GVTRACE("set_remote_reader_crypto_tokens "PGUIDFMT" with writer "PGUIDFMT"\n", PGUID(prd->e.guid), PGUID(wr->e.guid));
+      match->matched = true;
+      DDS_Security_DataHolderSeq_free(tseq);
+    }
+    else
+      EXCEPTION_ERROR(sc, &exception, "Failed to set remote reader crypto tokens "PGUIDFMT" for writer "PGUIDFMT, PGUID(prd->e.guid), PGUID(wr->e.guid));
+  }
+  ddsrt_mutex_unlock(&wr->e.lock);
+
+  if (match->matched)
+    connect_writer_with_proxy_reader_secure(wr, prd, now_mt (), match->crypto_handle);
+
+  if (prd)
+    notify_handshake_recv_token(wr->c.pp, prd->c.proxypp);
+}
+
+bool q_omg_reader_is_discovery_protected(const struct reader *rd)
+{
+  assert (rd != NULL);
+  return rd->sec_attr != NULL && rd->sec_attr->attr.is_discovery_protected;
+}
+
+static bool q_omg_security_encode_datareader_submessage(struct reader *rd, const ddsi_guid_prefix_t *dst_prefix, const unsigned char *src_buf, size_t src_len, unsigned char **dst_buf, size_t *dst_len)
+{
+  DDS_Security_SecurityException ex = DDS_SECURITY_EXCEPTION_INIT;
+  struct rd_pwr_match *m;
+  ddsrt_avl_iter_t it;
+  DDS_Security_DatareaderCryptoHandleSeq hdls = { 0, 0, NULL };
+  DDS_Security_OctetSeq encoded_buffer;
+  DDS_Security_OctetSeq plain_buffer;
+  bool result = false;
+  int32_t idx = 0;
+
+  assert (rd);
+  assert (src_len <= UINT32_MAX);
+  assert (src_buf);
+  assert (dst_len);
+  assert (dst_buf);
+  assert (rd->sec_attr);
+  assert (q_omg_reader_is_submessage_protected (rd));
+
+  const struct ddsi_domaingv *gv = rd->e.gv;
+  const struct dds_security_context *sc = q_omg_security_get_secure_context (rd->c.pp);
+  assert (sc);
+
+  GVTRACE (" encode_datareader_submessage "PGUIDFMT" %s/%s", PGUID (rd->e.guid), get_reader_topic_name (rd), rd->topic ? rd->topic->type_name : "(null)");
+  // FIXME: print_buf(src_buf, src_len, "q_omg_security_encode_datareader_submessage(SOURCE)");
+
+  ddsrt_mutex_lock (&rd->e.lock);
+  hdls._buffer = DDS_Security_DatawriterCryptoHandleSeq_allocbuf (rd->num_writers);
+  hdls._maximum = rd->num_writers;
+  for (m = ddsrt_avl_iter_first (&rd_writers_treedef, &rd->writers, &it); m; m = ddsrt_avl_iter_next (&it))
+  {
+    if (m->crypto_handle && (!dst_prefix || guid_prefix_eq (&m->pwr_guid.prefix, dst_prefix)))
+      hdls._buffer[idx++] = m->crypto_handle;
+  }
+  ddsrt_mutex_unlock (&rd->e.lock);
+
+  if ((hdls._length = (DDS_Security_unsigned_long) idx) == 0)
+  {
+    GVTRACE ("Submsg encoding failed for datareader "PGUIDFMT" %s/%s: no matching writers\n", PGUID (rd->e.guid),
+        get_reader_topic_name (rd), rd->topic ? rd->topic->type_name : "(null)");
+    goto err_enc_drd_subm;
+  }
+
+  memset (&encoded_buffer, 0, sizeof (encoded_buffer));
+  plain_buffer._buffer = (DDS_Security_octet*) src_buf;
+  plain_buffer._length = (uint32_t) src_len;
+  plain_buffer._maximum = (uint32_t) src_len;
+
+  if (!(result = sc->crypto_context->crypto_transform->encode_datareader_submessage (
+      sc->crypto_context->crypto_transform, &encoded_buffer, &plain_buffer, rd->sec_attr->crypto_handle, &hdls, &ex)))
+  {
+    GVWARNING ("Submsg encoding failed for datareader "PGUIDFMT" %s/%s: %s", PGUID (rd->e.guid), get_reader_topic_name (rd),
+        rd->topic ? rd->topic->type_name : "(null)", ex.message ? ex.message : "Unknown error");
+    GVTRACE ("\n");
+    DDS_Security_Exception_reset (&ex);
+    goto err_enc_drd_subm;
+  }
+  assert (encoded_buffer._buffer);
+  *dst_buf = encoded_buffer._buffer;
+  *dst_len = encoded_buffer._length;
+  // FIXME: print_buf (*dst_buf, *dst_len, "q_omg_security_encode_datareader_submessage(DEST)");
+  goto end_enc_drd_subm;
+
+err_enc_drd_subm:
+  *dst_buf = NULL;
+  *dst_len = 0;
+
+end_enc_drd_subm:
+  DDS_Security_DatawriterCryptoHandleSeq_freebuf (&hdls);
+  return result;
 }
 
 static bool q_omg_security_encode_datawriter_submessage (struct writer *wr, const ddsi_guid_prefix_t *dst_prefix, const unsigned char *src_buf, size_t src_len, unsigned char **dst_buf, size_t *dst_len)
 {
-  /* TODO: Use proper keys to actually encode (need key-exchange). */
-  DDSRT_UNUSED_ARG (wr);
-  DDSRT_UNUSED_ARG (dst_prefix);
-  DDSRT_UNUSED_ARG (src_buf);
-  DDSRT_UNUSED_ARG (src_len);
-  DDSRT_UNUSED_ARG (dst_buf);
-  DDSRT_UNUSED_ARG (dst_len);
-  return false;
+  DDS_Security_SecurityException ex = DDS_SECURITY_EXCEPTION_INIT;
+  struct wr_prd_match *m;
+  ddsrt_avl_iter_t it;
+  DDS_Security_DatareaderCryptoHandleSeq hdls = { 0, 0, NULL };
+  DDS_Security_OctetSeq encoded_buffer;
+  DDS_Security_OctetSeq plain_buffer;
+  bool result = false;
+  int32_t idx = 0;
+
+  assert (wr);
+  assert (src_len <= UINT32_MAX);
+  assert (src_buf);
+  assert (dst_len);
+  assert (dst_buf);
+  assert (wr->sec_attr);
+  assert (q_omg_writer_is_submessage_protected (wr));
+  ASSERT_MUTEX_HELD (wr->e.lock);
+
+  const struct ddsi_domaingv *gv = wr->e.gv;
+  const struct dds_security_context *sc = q_omg_security_get_secure_context (wr->c.pp);
+  assert (sc);
+
+  GVTRACE (" encode_datawriter_submessage "PGUIDFMT" %s/%s", PGUID (wr->e.guid), get_writer_topic_name (wr), wr->topic ? wr->topic->type_name : "(null)");
+
+  // FIXME: print_buf(src_buf, src_len, "q_omg_security_encode_datawriter_submessage(SOURCE)");
+
+  hdls._buffer = DDS_Security_DatareaderCryptoHandleSeq_allocbuf (wr->num_readers);
+  hdls._maximum = wr->num_readers;
+  for (m = ddsrt_avl_iter_first (&wr_readers_treedef, &wr->readers, &it); m; m = ddsrt_avl_iter_next (&it))
+  {
+    if (m->crypto_handle && (!dst_prefix || guid_prefix_eq (&m->prd_guid.prefix, dst_prefix)))
+      hdls._buffer[idx++] = m->crypto_handle;
+  }
+
+  if ((hdls._length = (DDS_Security_unsigned_long) idx) == 0)
+  {
+    GVTRACE ("Submsg encoding failed for datawriter "PGUIDFMT" %s/%s: no matching readers\n", PGUID (wr->e.guid),
+        get_writer_topic_name (wr), wr->topic ? wr->topic->type_name : "(null)");
+    goto err_enc_dwr_subm;
+  }
+
+  memset (&encoded_buffer, 0, sizeof (encoded_buffer));
+  plain_buffer._buffer = (DDS_Security_octet*) src_buf;
+  plain_buffer._length = (uint32_t) src_len;
+  plain_buffer._maximum = (uint32_t) src_len;
+  result = true;
+  idx = 0;
+  while (result && idx < (int32_t)hdls._length)
+  {
+    /* If the plugin thinks a new call is unnecessary, the index will be set to the size of the hdls sequence. */
+    result = sc->crypto_context->crypto_transform->encode_datawriter_submessage (sc->crypto_context->crypto_transform,
+        &encoded_buffer, &plain_buffer, wr->sec_attr->crypto_handle, &hdls, &idx, &ex);
+
+    /* With a possible second call to encode, the plain buffer should be NULL. */
+    plain_buffer._buffer = NULL;
+    plain_buffer._length = 0;
+    plain_buffer._maximum = 0;
+  }
+
+  if (!result)
+  {
+    GVWARNING ("Submsg encoding failed for datawriter "PGUIDFMT" %s/%s: %s", PGUID (wr->e.guid), get_writer_topic_name (wr),
+        wr->topic ? wr->topic->type_name : "(null)", ex.message ? ex.message : "Unknown error");
+    GVTRACE ("\n");
+    DDS_Security_Exception_reset (&ex);
+    goto err_enc_dwr_subm;
+  }
+
+  assert (encoded_buffer._buffer);
+  *dst_buf = encoded_buffer._buffer;
+  *dst_len = encoded_buffer._length;
+  // FIXME: print_buf (*dst_buf, *dst_len, "q_omg_security_encode_datawriter_submessage(DEST)");
+  goto end_enc_dwr_subm;
+
+err_enc_dwr_subm:
+  *dst_buf = NULL;
+  *dst_len = 0;
+
+end_enc_dwr_subm:
+  DDS_Security_DatareaderCryptoHandleSeq_freebuf (&hdls);
+  return result;
 }
 
-static bool q_omg_security_decode_submessage (const ddsi_guid_prefix_t * const src_prefix, const ddsi_guid_prefix_t * const dst_prefix, const unsigned char *src_buf, size_t src_len, unsigned char **dst_buf, size_t *dst_len)
+static bool q_omg_security_decode_submessage (const struct ddsi_domaingv *gv, const ddsi_guid_prefix_t * const src_prefix, const ddsi_guid_prefix_t * const dst_prefix, const unsigned char *src_buf, size_t src_len, unsigned char **dst_buf, size_t *dst_len)
 {
-  /* TODO: Use proper keys to actually decode (need key-exchange). */
-  DDSRT_UNUSED_ARG (src_prefix);
-  DDSRT_UNUSED_ARG (dst_prefix);
-  DDSRT_UNUSED_ARG (src_buf);
-  DDSRT_UNUSED_ARG (src_len);
-  DDSRT_UNUSED_ARG (dst_buf);
-  DDSRT_UNUSED_ARG (dst_len);
-  return false;
+  DDS_Security_SecurityException ex = DDS_SECURITY_EXCEPTION_INIT;
+  struct dds_security_context *sc = gv->security_context;
+  DDS_Security_SecureSubmessageCategory_t cat = 0;
+  DDS_Security_DatawriterCryptoHandle pp_crypto_hdl = DDS_SECURITY_HANDLE_NIL;
+  DDS_Security_DatawriterCryptoHandle proxypp_crypto_hdl = DDS_SECURITY_HANDLE_NIL;
+  DDS_Security_DatawriterCryptoHandle wr_crypto_hdl = DDS_SECURITY_HANDLE_NIL;
+  DDS_Security_DatareaderCryptoHandle rd_crypto_hdl = DDS_SECURITY_HANDLE_NIL;
+  DDS_Security_OctetSeq encoded_buffer;
+  DDS_Security_OctetSeq plain_buffer;
+  struct participant *pp = NULL;
+  struct proxy_participant *proxypp;
+  ddsi_guid_t proxypp_guid, pp_guid  = { .prefix= {.u = {0,0,0} }, .entityid.u = 0 };
+  bool result;
+
+  assert (src_len <= UINT32_MAX);
+  assert (src_buf);
+  assert (dst_len);
+  assert (dst_buf);
+
+  // FIXME: print_buf(src_buf, src_len, "q_omg_security_decode_submessage(SOURCE)");
+
+  proxypp_guid.prefix = *src_prefix;
+  proxypp_guid.entityid.u = NN_ENTITYID_PARTICIPANT;
+  if (!(proxypp = entidx_lookup_proxy_participant_guid (gv->entity_index, &proxypp_guid)))
+  {
+    GVTRACE (" Unknown remote participant "PGUIDFMT" for decoding submsg\n", PGUID (proxypp_guid));
+    return false;
+  }
+  if (!proxypp->sec_attr)
+  {
+    GVTRACE (" Remote participant "PGUIDFMT" not secure for decoding submsg\n", PGUID (proxypp_guid));
+    return false;
+  }
+  proxypp_crypto_hdl = proxypp->sec_attr->crypto_handle;
+
+  if (proxypp_crypto_hdl == DDS_SECURITY_HANDLE_NIL)
+  {
+    GVTRACE (" Remote participant "PGUIDFMT" not matched yet for decoding submsg\n", PGUID (proxypp_guid));
+    return false;
+  }
+
+  if (dst_prefix && !guid_prefix_zero (dst_prefix))
+  {
+    pp_guid.prefix = *dst_prefix;
+    pp_guid.entityid.u = NN_ENTITYID_PARTICIPANT;
+    if (!(pp = entidx_lookup_participant_guid (gv->entity_index, &pp_guid)))
+      return false;
+    pp_crypto_hdl = pp->sec_attr->crypto_handle;
+  }
+
+  GVTRACE(" decode: pp_crypto=%"PRId64" proxypp_crypto=%"PRId64"\n", pp_crypto_hdl, proxypp_crypto_hdl);
+  /* Prepare buffers. */
+  memset (&plain_buffer, 0, sizeof (plain_buffer));
+  encoded_buffer._buffer = (DDS_Security_octet*) src_buf;
+  encoded_buffer._length = (uint32_t) src_len;
+  encoded_buffer._maximum = (uint32_t) src_len;
+
+  /* Determine how the RTPS sub-message was encoded. */
+  assert (sc);
+  result = sc->crypto_context->crypto_transform->preprocess_secure_submsg (sc->crypto_context->crypto_transform, &wr_crypto_hdl, &rd_crypto_hdl,
+      &cat, &encoded_buffer, pp_crypto_hdl, proxypp_crypto_hdl, &ex);
+  GVTRACE ( "decode_submessage: pp("PGUIDFMT") proxypp("PGUIDFMT"), cat(%d)", PGUID (pp_guid), PGUID (proxypp_guid), (int) cat);
+  if (!result)
+  {
+    GVTRACE (" Pre-process submsg failed: %s\n", ex.message ? ex.message : "Unknown error");
+    DDS_Security_Exception_reset (&ex);
+    return false;
+  }
+
+  switch (cat)
+  {
+  case DDS_SECURITY_DATAWRITER_SUBMESSAGE:
+    result = sc->crypto_context->crypto_transform->decode_datawriter_submessage(sc->crypto_context->crypto_transform, &plain_buffer, &encoded_buffer, rd_crypto_hdl, wr_crypto_hdl, &ex);
+    break;
+  case DDS_SECURITY_DATAREADER_SUBMESSAGE:
+    result = sc->crypto_context->crypto_transform->decode_datareader_submessage(sc->crypto_context->crypto_transform, &plain_buffer, &encoded_buffer, wr_crypto_hdl, rd_crypto_hdl, &ex);
+    break;
+  case DDS_SECURITY_INFO_SUBMESSAGE:
+    /* No decoding needed.
+     * TODO: Is DDS_SECURITY_INFO_SUBMESSAGE even possible when there's a SMID_SEC_PREFIX?
+     *
+     * This function is only called when there is a prefix. If it is possible,
+     * then I might have a problem because the further parsing expects a new
+     * buffer (without the security sub-messages).
+     *
+     */
+    result = true;
+    break;
+  default:
+    result = false;
+    break;
+  }
+
+  if (!result)
+  {
+    GVTRACE (" Submsg decoding failed: %s\n", ex.message ? ex.message : "Unknown error");
+    DDS_Security_Exception_reset (&ex);
+    *dst_buf = NULL;
+    *dst_len = 0;
+    return false;
+  }
+
+  assert (plain_buffer._buffer);
+  *dst_buf = plain_buffer._buffer;
+  *dst_len = plain_buffer._length;
+  // FIXME: print_buf(*dst_buf, *dst_len, "q_omg_security_decode_submessage(DEST-DATAWRITER)");
+  return true;
 }
 
 static bool q_omg_security_encode_serialized_payload (const struct writer *wr, const unsigned char *src_buf, size_t src_len, unsigned char **dst_buf, size_t *dst_len)
 {
-  /* TODO: Use proper keys to actually encode (need key-exchange). */
-  DDSRT_UNUSED_ARG (wr);
-  DDSRT_UNUSED_ARG (src_buf);
-  DDSRT_UNUSED_ARG (src_len);
-  DDSRT_UNUSED_ARG (dst_buf);
-  DDSRT_UNUSED_ARG (dst_len);
-  return false;
+  DDS_Security_SecurityException ex = DDS_SECURITY_EXCEPTION_INIT;
+  DDS_Security_OctetSeq extra_inline_qos;
+  DDS_Security_OctetSeq encoded_buffer;
+  DDS_Security_OctetSeq plain_buffer;
+
+  assert (wr);
+  assert (src_buf);
+  assert (src_len <= UINT32_MAX);
+  assert (dst_buf);
+  assert (dst_len);
+  assert (wr->sec_attr);
+  assert (q_omg_writer_is_payload_protected (wr));
+
+  const struct ddsi_domaingv *gv = wr->e.gv;
+  const struct dds_security_context *sc = q_omg_security_get_secure_context (wr->c.pp);
+  assert (sc);
+
+  // FIXME: print_buf(src_buf, src_len, "q_omg_security_encode_serialized_payload(SOURCE)");
+
+  GVTRACE (" encode_payload "PGUIDFMT" %s/%s\n", PGUID (wr->e.guid), wr->topic ? wr->topic->name : "(null)", wr->topic ? wr->topic->type_name : "(null)");
+
+  memset (&extra_inline_qos, 0, sizeof (extra_inline_qos));
+  memset (&encoded_buffer, 0, sizeof (encoded_buffer));
+  plain_buffer._buffer = (DDS_Security_octet *) src_buf;
+  plain_buffer._length = (uint32_t) src_len;
+  plain_buffer._maximum = (uint32_t) src_len;
+
+  if (!sc->crypto_context->crypto_transform->encode_serialized_payload (sc->crypto_context->crypto_transform,
+      &encoded_buffer, &extra_inline_qos, &plain_buffer, wr->sec_attr->crypto_handle, &ex))
+  {
+    GVERROR ("Payload encoding failed for datawriter "PGUIDFMT": %s\n", PGUID (wr->e.guid), ex.message ? ex.message : "Unknown error");
+    DDS_Security_Exception_reset (&ex);
+    *dst_buf = NULL;
+    *dst_len = 0;
+    return false;
+  }
+
+  *dst_buf = encoded_buffer._buffer;
+  *dst_len = encoded_buffer._length;
+  // FIXME: print_buf(*dst_buf, *dst_len, "q_omg_security_encode_serialized_payload(DEST)");
+
+  return true;
 }
 
 static bool q_omg_security_decode_serialized_payload (struct proxy_writer *pwr, const unsigned char *src_buf, size_t src_len, unsigned char **dst_buf, size_t *dst_len)
 {
-  /* TODO: Use proper keys to actually decode (need key-exchange). */
-  DDSRT_UNUSED_ARG (pwr);
-  DDSRT_UNUSED_ARG (src_buf);
-  DDSRT_UNUSED_ARG (src_len);
-  DDSRT_UNUSED_ARG (dst_buf);
-  DDSRT_UNUSED_ARG (dst_len);
-  return false;
+  DDS_Security_SecurityException ex = DDS_SECURITY_EXCEPTION_INIT;
+  DDS_Security_OctetSeq extra_inline_qos;
+  DDS_Security_OctetSeq encoded_buffer;
+  DDS_Security_OctetSeq plain_buffer;
+  struct pwr_rd_match *pwr_rd_match;
+  struct reader *rd;
+  ddsrt_avl_iter_t it;
+
+  assert (pwr);
+  assert (src_buf);
+  assert (src_len <= UINT32_MAX);
+  assert (dst_buf);
+  assert (dst_len);
+
+  const struct ddsi_domaingv *gv = pwr->e.gv;
+  const struct dds_security_context *sc = q_omg_security_get_secure_context_from_proxypp (pwr->c.proxypp);
+  assert (sc);
+
+  // FIXME: print_buf(src_buf, src_len, "q_omg_security_decode_serialized_payload(SOURCE)");
+
+  *dst_buf = NULL;
+  *dst_len = 0;
+  GVTRACE ("decode_payload "PGUIDFMT"", PGUID (pwr->e.guid));
+
+  /* Only one reader is enough to decrypt the data, so use only the first match. */
+  ddsrt_mutex_lock (&pwr->e.lock);
+  pwr_rd_match = ddsrt_avl_iter_first (&pwr_readers_treedef, &pwr->readers, &it);
+  ddsrt_mutex_unlock (&pwr->e.lock);
+  if (!pwr_rd_match)
+  {
+    GVTRACE (" Payload decoding failed for from remote datawriter "PGUIDFMT": no local reader\n", PGUID (pwr->e.guid));
+    return false;
+  }
+  if (!pwr_rd_match->crypto_handle)
+  {
+    GVTRACE (" Payload decoding from datawriter "PGUIDFMT": no crypto handle\n", PGUID (pwr->e.guid));
+    return false;
+  }
+  if (!(rd = entidx_lookup_reader_guid (gv->entity_index, &pwr_rd_match->rd_guid)))
+  {
+    GVTRACE (" No datareader "PGUIDFMT" for decoding data from datawriter "PGUIDFMT"", PGUID (pwr_rd_match->rd_guid), PGUID (pwr->e.guid));
+    return false;
+  }
+
+  memset (&extra_inline_qos, 0, sizeof (extra_inline_qos));
+  memset (&plain_buffer, 0, sizeof (plain_buffer));
+  encoded_buffer._buffer  = (DDS_Security_octet *) src_buf;
+  encoded_buffer._length  = (uint32_t) src_len;
+  encoded_buffer._maximum = (uint32_t) src_len;
+  if (!sc->crypto_context->crypto_transform->decode_serialized_payload (sc->crypto_context->crypto_transform,
+      &plain_buffer, &encoded_buffer, &extra_inline_qos, rd->sec_attr->crypto_handle, pwr_rd_match->crypto_handle, &ex))
+  {
+    GVTRACE (" Payload decoding failed for datareader "PGUIDFMT" from datawriter "PGUIDFMT": %s\n", PGUID (pwr_rd_match->rd_guid), PGUID (pwr->e.guid), ex.message ? ex.message : "Unknown error");
+    DDS_Security_Exception_reset (&ex);
+    return false;
+  }
+  *dst_buf = plain_buffer._buffer;
+  *dst_len = plain_buffer._length;
+  // FIXME: print_buf(*dst_buf, *dst_len, "q_omg_security_decode_serialized_payload(DEST)");
+  return true;
 }
 
-bool q_omg_security_encode_rtps_message (int64_t src_handle, ddsi_guid_t *src_guid, const unsigned char *src_buf, size_t src_len, unsigned char **dst_buf, size_t *dst_len, int64_t dst_handle)
+bool q_omg_security_encode_rtps_message (const struct ddsi_domaingv *gv, int64_t src_handle, const ddsi_guid_t *src_guid, const unsigned char *src_buf, size_t src_len, unsigned char **dst_buf, size_t *dst_len, int64_t dst_handle)
 {
-  /* TODO: Use proper keys to actually encode (need key-exchange). */
-  DDSRT_UNUSED_ARG (src_handle);
-  DDSRT_UNUSED_ARG (src_guid);
-  DDSRT_UNUSED_ARG (src_buf);
-  DDSRT_UNUSED_ARG (src_len);
-  DDSRT_UNUSED_ARG (dst_buf);
-  DDSRT_UNUSED_ARG (dst_len);
-  DDSRT_UNUSED_ARG (dst_handle);
-  return false;
+  struct dds_security_context *sc = gv->security_context;
+  DDS_Security_SecurityException ex = DDS_SECURITY_EXCEPTION_INIT;
+  DDS_Security_ParticipantCryptoHandleSeq hdls = { 0, 0, NULL };
+  DDS_Security_OctetSeq encoded_buffer;
+  DDS_Security_OctetSeq plain_buffer;
+  struct participant_sec_attributes *pp_attr = NULL;
+  bool result = false;
+  int32_t idx = 0;
+
+  assert (src_buf);
+  assert (src_len <= UINT32_MAX);
+  assert (dst_buf);
+  assert (dst_len);
+
+  if (dst_handle != 0)
+  {
+    hdls._buffer = (DDS_Security_long_long *) &dst_handle;
+    hdls._length = hdls._maximum = 1;
+  }
+  else if ((pp_attr = participant_index_find(sc, src_handle)) != NULL)
+  {
+    if (SECURITY_INFO_USE_RTPS_AUTHENTICATION(pp_attr->attr))
+    {
+      if (get_matched_proxypp_crypto_handles(pp_attr, &hdls) == 0)
+        return false;
+    }
+    else
+    {
+      if ((dst_handle = get_first_matched_proxypp_crypto_handle(pp_attr)) != DDS_SECURITY_HANDLE_NIL)
+      {
+        hdls._buffer = (DDS_Security_long_long *) &dst_handle;
+        hdls._length = hdls._maximum = 1;
+      }
+    }
+  }
+  else
+    return false;
+
+  GVTRACE (" ] encode_rtps_message ["PGUIDFMT, PGUID (*src_guid));
+
+  if (hdls._length > 0)
+  {
+    memset (&encoded_buffer, 0, sizeof (encoded_buffer));
+    plain_buffer._buffer = (DDS_Security_octet *) src_buf;
+    plain_buffer._length = (uint32_t) src_len;
+    plain_buffer._maximum = (uint32_t) src_len;
+
+    result = true;
+    idx = 0;
+    while (result && idx < (int32_t) hdls._length)
+    {
+      /* If the plugin thinks a new call is unnecessary, the index will be set to the size of the hdls sequence. */
+      result = sc->crypto_context->crypto_transform->encode_rtps_message (sc->crypto_context->crypto_transform,
+          &encoded_buffer, &plain_buffer, src_handle, &hdls, &idx, &ex);
+
+      /* With a possible second call to encode, the plain buffer should be NULL. */
+      plain_buffer._buffer = NULL;
+      plain_buffer._length = 0;
+      plain_buffer._maximum = 0;
+    }
+
+    if (!result)
+    {
+      GVTRACE ("]\n");
+      GVTRACE ("encoding rtps message for participant "PGUIDFMT" failed: %s", PGUID (*src_guid), ex.message ? ex.message : "Unknown error");
+      GVTRACE ("[");
+      DDS_Security_Exception_reset (&ex);
+      *dst_buf = NULL;
+      *dst_len = 0;
+    }
+    else
+    {
+      assert (encoded_buffer._buffer);
+      *dst_buf = encoded_buffer._buffer;
+      *dst_len = encoded_buffer._length;
+    }
+  }
+
+  if (dst_handle == DDS_SECURITY_HANDLE_NIL)
+    ddsrt_free(hdls._buffer);
+
+  return result;
 }
 
 static bool q_omg_security_decode_rtps_message (struct proxy_participant *proxypp, const unsigned char *src_buf, size_t src_len, unsigned char **dst_buf, size_t *dst_len)
 {
-  /* TODO: Use proper keys to actually decode (need key-exchange). */
-  DDSRT_UNUSED_ARG (proxypp);
-  DDSRT_UNUSED_ARG (src_buf);
-  DDSRT_UNUSED_ARG (src_len);
-  DDSRT_UNUSED_ARG (dst_buf);
-  DDSRT_UNUSED_ARG (dst_len);
-  return false;
+  DDS_Security_SecurityException ex = DDS_SECURITY_EXCEPTION_INIT;
+  struct dds_security_context *sc;
+  DDS_Security_OctetSeq encoded_buffer;
+  DDS_Security_OctetSeq plain_buffer = {0, 0, NULL};
+  ddsrt_avl_iter_t it;
+
+  assert (proxypp);
+  assert (src_buf);
+  assert (src_len <= UINT32_MAX);
+  assert (dst_buf);
+  assert (dst_len);
+
+  const struct ddsi_domaingv *gv = proxypp->e.gv;
+  GVTRACE ("decode_rtps_message from "PGUIDFMT"\n", PGUID (proxypp->e.guid));
+
+  *dst_buf = NULL;
+  *dst_len = 0;
+  encoded_buffer._buffer = (DDS_Security_octet *) src_buf;
+  encoded_buffer._length = (uint32_t) src_len;
+  encoded_buffer._maximum = (uint32_t) src_len;
+
+  ddsrt_mutex_lock (&proxypp->sec_attr->lock);
+  for (struct proxypp_pp_match *pm = ddsrt_avl_iter_first (&proxypp_pp_treedef, &proxypp->sec_attr->participants, &it); pm; pm = ddsrt_avl_iter_next (&it))
+  {
+    sc = q_omg_security_get_secure_context_from_proxypp(proxypp);
+    assert (sc);
+    if (!sc->crypto_context->crypto_transform->decode_rtps_message (sc->crypto_context->crypto_transform, &plain_buffer, &encoded_buffer, pm->pp_crypto_handle, proxypp->sec_attr->crypto_handle, &ex))
+    {
+      if (ex.code == DDS_SECURITY_ERR_INVALID_CRYPTO_RECEIVER_SIGN_CODE)
+        continue; /* Could be caused by 'with_origin_authentication' being used, so try next match */
+      GVTRACE ("decoding rtps message from remote participant "PGUIDFMT" failed: %s\n", PGUID (proxypp->e.guid), ex.message ? ex.message : "Unknown error");
+      DDS_Security_Exception_reset (&ex);
+      ddsrt_mutex_unlock (&proxypp->sec_attr->lock);
+      return false;
+    }
+    *dst_buf = plain_buffer._buffer;
+    *dst_len = plain_buffer._length;
+  }
+  ddsrt_mutex_unlock (&proxypp->sec_attr->lock);
+  if (*dst_buf == NULL)
+  {
+    GVTRACE ("No match found for remote participant "PGUIDFMT" for decoding rtps message\n", PGUID (proxypp->e.guid));
+    return false;
+  }
+
+  return true;
 }
 
-static bool q_omg_writer_is_payload_protected (const struct writer *wr)
+bool q_omg_reader_is_submessage_protected(const struct reader *rd)
 {
-  /* TODO: Local registration. */
-  DDSRT_UNUSED_ARG (wr);
-  return false;
-}
-
-static bool q_omg_writer_is_submessage_protected (struct writer *wr)
-{
-  /* TODO: Local registration. */
-  DDSRT_UNUSED_ARG (wr);
-  return false;
-}
-
-static bool q_omg_reader_is_submessage_protected (struct reader *rd)
-{
-  /* TODO: Local registration. */
-  DDSRT_UNUSED_ARG (rd);
-  return false;
+  assert (rd != NULL);
+  return rd->sec_attr != NULL && rd->sec_attr->attr.is_submessage_protected;
 }
 
 bool encode_payload (struct writer *wr, ddsrt_iovec_t *vec, unsigned char **buf)
@@ -735,7 +3110,6 @@ bool encode_payload (struct writer *wr, ddsrt_iovec_t *vec, unsigned char **buf)
   return true;
 }
 
-
 static bool decode_payload (const struct ddsi_domaingv *gv, struct nn_rsample_info *sampleinfo, unsigned char *payloadp, uint32_t *payloadsz, size_t *submsg_len)
 {
   assert (payloadp);
@@ -757,8 +3131,8 @@ static bool decode_payload (const struct ddsi_domaingv *gv, struct nn_rsample_in
   size_t dst_len = 0;
   if (!q_omg_security_decode_serialized_payload (sampleinfo->pwr, payloadp, *payloadsz, &dst_buf, &dst_len))
   {
-    GVWARNING ("decode_payload: failed to decrypt data from "PGUIDFMT"", PGUID (sampleinfo->pwr->e.guid));
-    return false;
+    GVTRACE ("decode_payload: failed to decrypt data from "PGUIDFMT"\n", PGUID (sampleinfo->pwr->e.guid));
+    return true;
   }
 
   /* Expect result to always fit into the original buffer. */
@@ -803,10 +3177,7 @@ void encode_datareader_submsg (struct nn_xmsg *msg, struct nn_xmsg_marker sm_mar
   struct reader * const rd = entidx_lookup_reader_guid (pwr->e.gv->entity_index, rd_guid);
   /* surely a reader can only be protected if the participant has security enabled? */
   if (rd == NULL || !q_omg_reader_is_submessage_protected (rd))
-  {
-    assert (rd == NULL || !q_omg_participant_is_secure (rd->c.pp));
     return;
-  }
   assert (q_omg_participant_is_secure (rd->c.pp));
 
   unsigned char *src_buf;
@@ -835,11 +3206,12 @@ void encode_datareader_submsg (struct nn_xmsg *msg, struct nn_xmsg_marker sm_mar
 
 void encode_datawriter_submsg (struct nn_xmsg *msg, struct nn_xmsg_marker sm_marker, struct writer *wr)
 {
-  /* Only encode when needed.  Surely a writer can only be protected if the participant has security enabled? */
-  assert (!q_omg_writer_is_submessage_protected (wr) || q_omg_participant_is_secure (wr->c.pp));
   if (!q_omg_writer_is_submessage_protected (wr))
     return;
 
+  /* Only encode when needed.  Surely a writer can only be protected if the participant has security enabled? */
+  assert (q_omg_participant_is_secure (wr->c.pp));
+
   unsigned char *src_buf;
   size_t src_len;
   unsigned char *dst_buf;
@@ -974,7 +3346,7 @@ static bool decode_SecPrefix_patched_hdr_flags (const struct receiver_state *rst
   /* Decode all three submessages. */
   unsigned char *dst_buf;
   size_t dst_len;
-  const bool decoded = q_omg_security_decode_submessage (src_prefix, dst_prefix, submsg, totalsize, &dst_buf, &dst_len);
+  const bool decoded = q_omg_security_decode_submessage (rst->gv, src_prefix, dst_prefix, submsg, totalsize, &dst_buf, &dst_len);
   if (decoded && dst_buf)
   {
     /*
@@ -1057,7 +3429,7 @@ static nn_rtps_msg_state_t check_rtps_message_is_secure (struct ddsi_domaingv *g
     GVTRACE ("received encoded rtps message from unknown participant\n");
     return NN_RTPS_MSG_STATE_ERROR;
   }
-  else if (!q_omg_proxyparticipant_is_authenticated (*proxypp))
+  else if (!proxypp_is_authenticated (*proxypp))
   {
     GVTRACE ("received encoded rtps message from unauthenticated participant\n");
     return NN_RTPS_MSG_STATE_ERROR;
@@ -1147,6 +3519,7 @@ decode_rtps_message (
 
 ssize_t
 secure_conn_write(
+    const struct ddsi_domaingv *gv,
     ddsi_tran_conn_t conn,
     const nn_locator_t *dst,
     size_t niov,
@@ -1211,7 +3584,7 @@ secure_conn_write(
   }
 
   ssize_t ret = -1;
-  if (!q_omg_security_encode_rtps_message (sec_info->src_pp_handle, &guid, srcbuf, srclen, &dstbuf, &dstlen, dst_handle))
+  if (!q_omg_security_encode_rtps_message (gv, sec_info->src_pp_handle, &guid, srcbuf, srclen, &dstbuf, &dstlen, dst_handle))
     ret = -1;
   else
   {
@@ -1250,33 +3623,66 @@ secure_conn_write(
   return ret;
 }
 
+bool q_omg_plist_keyhash_is_protected(const ddsi_plist_t *plist)
+{
+  assert(plist);
+  if (plist->present & PP_ENDPOINT_SECURITY_INFO)
+  {
+    unsigned attr = plist->endpoint_security_info.security_attributes;
+    return attr & NN_ENDPOINT_SECURITY_ATTRIBUTES_FLAG_IS_VALID &&
+           attr & NN_ENDPOINT_SECURITY_ATTRIBUTES_FLAG_IS_KEY_PROTECTED;
+  }
+  return false;
+}
+
+bool q_omg_is_endpoint_protected(const ddsi_plist_t *plist)
+{
+  assert(plist);
+  return plist->present & PP_ENDPOINT_SECURITY_INFO &&
+         !SECURITY_INFO_CLEAR(plist->endpoint_security_info, NN_ENDPOINT_SECURITY_ATTRIBUTES_FLAG_IS_VALID);
+}
+
+void q_omg_log_endpoint_protection(struct ddsi_domaingv * const gv, const ddsi_plist_t *plist)
+{
+  GVLOGDISC (" p(");
+  if (plist->present & PP_ENDPOINT_SECURITY_INFO)
+    GVLOGDISC ("0x%08x.0x%08x", plist->endpoint_security_info.security_attributes, plist->endpoint_security_info.plugin_security_attributes);
+  else
+    GVLOGDISC ("open");
+  GVLOGDISC (")");
+}
+
 #else /* DDSI_INCLUDE_SECURITY */
 
 #include "dds/ddsi/ddsi_security_omg.h"
 
-extern inline bool q_omg_participant_is_secure(UNUSED_ARG(const struct participant *pp));
-extern inline bool q_omg_proxy_participant_is_secure(const struct proxy_participant *proxypp);
 extern inline bool q_omg_security_enabled(void);
 
-extern inline bool q_omg_participant_is_secure(
-  UNUSED_ARG(const struct participant *pp));
+extern inline bool q_omg_participant_is_access_protected(UNUSED_ARG(const struct participant *pp));
+extern inline bool q_omg_participant_is_rtps_protected(UNUSED_ARG(const struct participant *pp));
+extern inline bool q_omg_participant_is_liveliness_protected(UNUSED_ARG(const struct participant *pp));
+extern inline bool q_omg_participant_is_secure(UNUSED_ARG(const struct participant *pp));
+extern inline bool q_omg_proxy_participant_is_secure(UNUSED_ARG(const struct proxy_participant *proxypp));
 
-extern inline unsigned determine_subscription_writer(
-  UNUSED_ARG(const struct reader *rd));
+extern inline unsigned determine_subscription_writer(UNUSED_ARG(const struct reader *rd));
 
-extern inline bool q_omg_security_match_remote_writer_enabled(UNUSED_ARG(struct reader *rd), UNUSED_ARG(struct proxy_writer *pwr));
-extern inline bool q_omg_security_match_remote_reader_enabled(UNUSED_ARG(struct writer *wr), UNUSED_ARG(struct proxy_reader *prd));
+extern inline bool q_omg_security_match_remote_writer_enabled(UNUSED_ARG(struct reader *rd), UNUSED_ARG(struct proxy_writer *pwr), UNUSED_ARG(int64_t *crypto_handle));
+extern inline bool q_omg_security_match_remote_reader_enabled(UNUSED_ARG(struct writer *wr), UNUSED_ARG(struct proxy_reader *prd), UNUSED_ARG(int64_t *crypto_handle));
 
+extern inline bool q_omg_writer_is_discovery_protected(UNUSED_ARG(const struct writer *wr));
+extern inline bool q_omg_writer_is_submessage_protected(UNUSED_ARG(const struct writer *wr));
+extern inline bool q_omg_writer_is_payload_protected(UNUSED_ARG(const struct writer *wr));
+
+extern inline void q_omg_get_proxy_writer_security_info(UNUSED_ARG(struct proxy_writer *pwr), UNUSED_ARG(const ddsi_plist_t *plist), UNUSED_ARG(nn_security_info_t *info));
 extern inline bool q_omg_security_check_remote_writer_permissions(UNUSED_ARG(const struct proxy_writer *pwr), UNUSED_ARG(uint32_t domain_id), UNUSED_ARG(struct participant *pp));
+extern inline void q_omg_security_deregister_remote_writer_match(UNUSED_ARG(const struct proxy_writer *pwr), UNUSED_ARG(const struct reader *rd), UNUSED_ARG(struct rd_pwr_match *match));
+extern inline void q_omg_get_proxy_reader_security_info(UNUSED_ARG(struct proxy_reader *prd), UNUSED_ARG(const ddsi_plist_t *plist), UNUSED_ARG(nn_security_info_t *info));
 extern inline bool q_omg_security_check_remote_reader_permissions(UNUSED_ARG(const struct proxy_reader *prd), UNUSED_ARG(uint32_t domain_id), UNUSED_ARG(struct participant *par));
+extern inline void q_omg_security_deregister_remote_reader_match(UNUSED_ARG(const struct proxy_reader *prd), UNUSED_ARG(const struct writer *wr), UNUSED_ARG(struct wr_prd_match *match));
 
-extern inline unsigned determine_publication_writer(
-  UNUSED_ARG(const struct writer *wr));
+extern inline unsigned determine_publication_writer(UNUSED_ARG(const struct writer *wr));
 
-extern inline bool is_proxy_participant_deletion_allowed(
-  UNUSED_ARG(struct ddsi_domaingv * const gv),
-  UNUSED_ARG(const struct ddsi_guid *guid),
-  UNUSED_ARG(const ddsi_entityid_t pwr_entityid));
+extern inline bool is_proxy_participant_deletion_allowed(UNUSED_ARG(struct ddsi_domaingv * const gv), UNUSED_ARG(const struct ddsi_guid *guid), UNUSED_ARG(const ddsi_entityid_t pwr_entityid));
 
 extern inline bool q_omg_is_similar_participant_security_info(UNUSED_ARG(struct participant *pp), UNUSED_ARG(struct proxy_participant *proxypp));
 
@@ -1284,29 +3690,43 @@ extern inline bool q_omg_participant_allow_unauthenticated(UNUSED_ARG(struct par
 
 extern inline bool q_omg_security_check_create_participant(UNUSED_ARG(struct participant *pp), UNUSED_ARG(uint32_t domain_id));
 
+extern inline void q_omg_security_deregister_participant(UNUSED_ARG(struct participant *pp));
+
+extern inline bool q_omg_security_check_create_topic(UNUSED_ARG(const struct ddsi_domaingv *gv), UNUSED_ARG(const ddsi_guid_t *pp_guid), UNUSED_ARG(const char *topic_name), UNUSED_ARG(const struct dds_qos *qos));
+
+extern inline int64_t q_omg_security_get_local_participant_handle(UNUSED_ARG(const struct participant *pp));
+
+extern inline bool q_omg_security_check_create_writer(UNUSED_ARG(struct participant *pp), UNUSED_ARG(uint32_t domain_id), UNUSED_ARG(const char *topic_name), UNUSED_ARG(const struct dds_qos *writer_qos));
+
+extern inline void q_omg_security_register_writer(UNUSED_ARG(struct writer *wr));
+
+extern inline void q_omg_security_deregister_writer(UNUSED_ARG(struct writer *wr));
+
+extern inline bool q_omg_security_check_create_reader(UNUSED_ARG(struct participant *pp), UNUSED_ARG(uint32_t domain_id), UNUSED_ARG(const char *topic_name), UNUSED_ARG(const struct dds_qos *reader_qos));
+
+extern inline void q_omg_security_register_reader(UNUSED_ARG(struct reader *rd));
+
+extern inline void q_omg_security_deregister_reader(UNUSED_ARG(struct reader *rd));
+
+extern inline bool q_omg_security_is_remote_rtps_protected(UNUSED_ARG(const struct proxy_participant *proxypp), UNUSED_ARG(ddsi_entityid_t entityid));
+
 /* initialize the proxy participant security attributes */
 extern inline void q_omg_security_init_remote_participant(UNUSED_ARG(struct proxy_participant *proxypp));
 
 /* ask to access control security plugin for the remote participant permissions */
 extern inline int64_t q_omg_security_check_remote_participant_permissions(UNUSED_ARG(uint32_t domain_id), UNUSED_ARG(struct participant *pp), UNUSED_ARG(struct proxy_participant *proxypp));
 
-extern inline void q_omg_security_register_remote_participant(UNUSED_ARG(struct participant *pp), UNUSED_ARG(struct proxy_participant *proxypp), UNUSED_ARG(int64_t shared_secret), UNUSED_ARG(int64_t proxy_permissions));
+extern inline bool q_omg_security_register_remote_participant(UNUSED_ARG(struct participant *pp), UNUSED_ARG(struct proxy_participant *proxypp), UNUSED_ARG(int64_t identity_handle), UNUSED_ARG(int64_t shared_secret));
 
 extern inline void q_omg_security_deregister_remote_participant(UNUSED_ARG(struct proxy_participant *proxypp));
 
 extern inline void q_omg_security_participant_send_tokens(UNUSED_ARG(struct participant *pp), UNUSED_ARG(struct proxy_participant *proxypp));
 
-extern inline void set_proxy_participant_security_info(
-  UNUSED_ARG(struct proxy_participant *prd),
-  UNUSED_ARG(const ddsi_plist_t *plist));
+extern inline void set_proxy_participant_security_info(UNUSED_ARG(struct proxy_participant *prd), UNUSED_ARG(const ddsi_plist_t *plist));
 
-extern inline void set_proxy_reader_security_info(
-  UNUSED_ARG(struct proxy_reader *prd),
-  UNUSED_ARG(const ddsi_plist_t *plist));
+extern inline void set_proxy_reader_security_info(UNUSED_ARG(struct proxy_reader *prd), UNUSED_ARG(const ddsi_plist_t *plist));
 
-extern inline void set_proxy_writer_security_info(
-  UNUSED_ARG(struct proxy_writer *pwr),
-  UNUSED_ARG(const ddsi_plist_t *plist));
+extern inline void set_proxy_writer_security_info(UNUSED_ARG(struct proxy_writer *pwr), UNUSED_ARG(const ddsi_plist_t *plist));
 
 extern inline bool decode_Data(
   UNUSED_ARG(const struct ddsi_domaingv *gv),
@@ -1359,4 +3779,17 @@ extern inline nn_rtps_msg_state_t decode_rtps_message(
   UNUSED_ARG(struct nn_rbufpool *rbpool),
   UNUSED_ARG(bool isstream));
 
+extern inline int64_t q_omg_security_get_remote_participant_handle(UNUSED_ARG(struct proxy_participant *proxypp));
+
+extern inline bool q_omg_reader_is_discovery_protected(UNUSED_ARG(const struct reader *rd));
+
+extern inline bool q_omg_reader_is_submessage_protected(UNUSED_ARG(const struct reader *rd));
+
+extern inline bool q_omg_plist_keyhash_is_protected(UNUSED_ARG(const ddsi_plist_t *plist));
+
+extern inline bool q_omg_is_endpoint_protected(UNUSED_ARG(const ddsi_plist_t *plist));
+
+extern inline void q_omg_log_endpoint_protection(UNUSED_ARG(struct ddsi_domaingv * const gv), UNUSED_ARG(const ddsi_plist_t *plist));
+
+
 #endif /* DDSI_INCLUDE_SECURITY */
diff --git a/src/core/ddsi/src/ddsi_security_util.c b/src/core/ddsi/src/ddsi_security_util.c
new file mode 100644
index 0000000..388fb4e
--- /dev/null
+++ b/src/core/ddsi/src/ddsi_security_util.c
@@ -0,0 +1,708 @@
+/*
+ * Copyright(c) 2006 to 2018 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+
+#ifdef DDSI_INCLUDE_SECURITY
+
+#include <string.h>
+#include <stdarg.h>
+
+#include "dds/ddsrt/heap.h"
+#include "dds/ddsrt/string.h"
+#include "dds/ddsrt/bswap.h"
+
+#include "dds/ddsi/ddsi_security_util.h"
+
+void
+g_omg_shallow_copy_StringSeq(
+    DDS_Security_StringSeq *dst,
+    const ddsi_stringseq_t *src)
+{
+  unsigned i;
+  assert(dst);
+  assert(src);
+
+  dst->_length  = src->n;
+  dst->_maximum = src->n;
+  dst->_buffer  = NULL;
+  if (src->n > 0)
+  {
+    dst->_buffer = ddsrt_malloc(src->n * sizeof(DDS_Security_string));
+    for (i = 0; i < src->n; i++)
+      dst->_buffer[i] = src->strs[i];
+  }
+}
+
+void
+g_omg_shallow_free_StringSeq(
+    DDS_Security_StringSeq *obj)
+{
+  if (obj)
+    ddsrt_free(obj->_buffer);
+}
+
+void
+q_omg_copy_PropertySeq(
+    DDS_Security_PropertySeq *dst,
+    const dds_propertyseq_t *src)
+{
+  uint32_t i;
+
+  if (src)
+  {
+    dst->_length = dst->_maximum = src->n;
+    if (src->n > 0)
+      dst->_buffer = DDS_Security_PropertySeq_allocbuf(src->n);
+    else
+      dst->_buffer = NULL;
+
+    for (i = 0; i < src->n; i++)
+    {
+      dst->_buffer[i].name =  src->props->name ? ddsrt_strdup(src->props->name) : ddsrt_strdup("");
+      dst->_buffer[i].value = src->props->value ? ddsrt_strdup(src->props->value) : ddsrt_strdup("");
+    }
+  }
+  else
+    memset(dst, 0, sizeof(*dst));
+}
+
+void
+q_omg_shallow_copyin_PropertySeq(
+   DDS_Security_PropertySeq *dst,
+   const dds_propertyseq_t *src)
+{
+  unsigned i;
+  assert(dst);
+  assert(src);
+
+  dst->_length  = src->n;
+  dst->_maximum = src->n;
+  dst->_buffer  = NULL;
+
+  if (src->n > 0)
+  {
+    dst->_buffer = ddsrt_malloc(src->n * sizeof(DDS_Security_Property_t));
+    for (i = 0; i < src->n; i++)
+    {
+      dst->_buffer[i].name      = src->props[i].name;
+      dst->_buffer[i].value     = src->props[i].value;
+      dst->_buffer[i].propagate = src->props[i].propagate;
+    }
+  }
+}
+
+void
+q_omg_shallow_copyout_PropertySeq(
+    dds_propertyseq_t *dst,
+    const DDS_Security_PropertySeq *src)
+{
+  unsigned i;
+  assert(dst);
+  assert(src);
+
+  dst->n = src->_length;
+  dst->props = NULL;
+
+  if (src->_length > 0)
+  {
+    dst->props = ddsrt_malloc(src->_length * sizeof(dds_property_t));
+    for (i = 0; i < src->_length; i++)
+    {
+      dst->props[i].name      = src->_buffer[i].name;
+      dst->props[i].value     = src->_buffer[i].value;
+//      dst->props[i].propagate = src->_buffer[i].propagate;
+      dst->props[i].propagate = true;
+    }
+  }
+}
+
+void
+q_omg_shallow_free_PropertySeq(
+    DDS_Security_PropertySeq *obj)
+{
+  assert(obj);
+  ddsrt_free(obj->_buffer);
+  obj->_length = 0;
+  obj->_maximum = 0;
+  obj->_buffer = NULL;
+}
+
+static void
+q_omg_shallow_free_dds_propertyseq(
+    dds_propertyseq_t *obj)
+{
+  ddsrt_free(obj->props);
+  obj->n = 0;
+  obj->props = NULL;
+}
+
+void
+q_omg_shallow_copyin_BinaryPropertySeq(
+    DDS_Security_BinaryPropertySeq *dst,
+    const dds_binarypropertyseq_t *src)
+{
+  unsigned i;
+  assert(dst);
+  assert(src);
+
+  dst->_length  = src->n;
+  dst->_maximum = src->n;
+  dst->_buffer  = NULL;
+
+  if (src->n > 0)
+  {
+    dst->_buffer = ddsrt_malloc(src->n * sizeof(DDS_Security_BinaryProperty_t));
+    for (i = 0; i < src->n; i++)
+    {
+      dst->_buffer[i].name           = src->props[i].name;
+      dst->_buffer[i].value._length  = src->props[i].value.length;
+      dst->_buffer[i].value._maximum = src->props[i].value.length;
+      dst->_buffer[i].value._buffer  = src->props[i].value.value;
+//      dst->_buffer[i].propagate      = src->props[i].propagate;
+      dst->_buffer[i].propagate      = true;
+    }
+  }
+}
+
+void
+q_omg_shallow_copyout_BinaryPropertySeq(
+    dds_binarypropertyseq_t *dst,
+    const DDS_Security_BinaryPropertySeq *src)
+{
+  unsigned i;
+  assert(dst);
+  assert(src);
+
+  dst->n  = src->_length;
+  dst->props  = NULL;
+
+  if (src->_length > 0)
+  {
+    dst->props = ddsrt_malloc(src->_length * sizeof(dds_binaryproperty_t));
+    for (i = 0; i < src->_length; i++)
+    {
+      dst->props[i].name         = src->_buffer[i].name;
+      dst->props[i].value.length = src->_buffer[i].value._length;
+      dst->props[i].value.value  = src->_buffer[i].value._buffer;
+      dst->props[i].propagate    = src->_buffer[i].propagate;
+    }
+  }
+}
+
+void
+q_omg_shallow_free_BinaryPropertySeq(
+    DDS_Security_BinaryPropertySeq *obj)
+{
+  ddsrt_free(obj->_buffer);
+  obj->_length = 0;
+  obj->_maximum = 0;
+  obj->_buffer = NULL;
+}
+
+static void
+q_omg_shallow_free_dds_binarypropertyseq(
+    dds_binarypropertyseq_t *obj)
+{
+  ddsrt_free(obj->props);
+  obj->n = 0;
+  obj->props = NULL;
+}
+
+void
+q_omg_shallow_copy_PropertyQosPolicy(
+    DDS_Security_PropertyQosPolicy *dst,
+    const dds_property_qospolicy_t *src)
+{
+    assert(dst);
+    assert(src);
+    q_omg_shallow_copyin_PropertySeq(&(dst->value), &(src->value));
+    q_omg_shallow_copyin_BinaryPropertySeq(&(dst->binary_value), &(src->binary_value));
+}
+
+void
+q_omg_shallow_copy_security_qos(
+    DDS_Security_Qos *dst,
+    const struct dds_qos *src)
+{
+  assert(src);
+  assert(dst);
+
+  /* DataTags not supported yet. */
+  memset(&(dst->data_tags), 0, sizeof(DDS_Security_DataTagQosPolicy));
+
+  if (src->present & QP_PROPERTY_LIST)
+    q_omg_shallow_copy_PropertyQosPolicy(&(dst->property), &(src->property));
+  else
+    memset(&(dst->property), 0, sizeof(DDS_Security_PropertyQosPolicy));
+}
+
+void
+q_omg_shallow_free_PropertyQosPolicy(
+    DDS_Security_PropertyQosPolicy *obj)
+{
+  q_omg_shallow_free_PropertySeq(&(obj->value));
+  q_omg_shallow_free_BinaryPropertySeq(&(obj->binary_value));
+}
+
+void
+q_omg_shallow_free_security_qos(
+    DDS_Security_Qos *obj)
+{
+  q_omg_shallow_free_PropertyQosPolicy(&(obj->property));
+}
+
+void
+q_omg_security_dataholder_copyin(
+    nn_dataholder_t *dh,
+    const DDS_Security_DataHolder *holder)
+{
+  uint32_t i;
+
+  dh->class_id = holder->class_id ? ddsrt_strdup(holder->class_id) : NULL;
+  dh->properties.n = holder->properties._length;
+  dh->properties.props = dh->properties.n ? ddsrt_malloc(dh->properties.n * sizeof(dds_property_t)) : NULL;
+  for (i = 0; i < dh->properties.n; i++)
+  {
+    DDS_Security_Property_t *prop = &(holder->properties._buffer[i]);
+    dh->properties.props[i].name = prop->name ? ddsrt_strdup(prop->name) : NULL;
+    dh->properties.props[i].value = prop->value ? ddsrt_strdup(prop->value) : NULL;
+    dh->properties.props[i].propagate = prop->propagate;
+  }
+  dh->binary_properties.n = holder->binary_properties._length;
+  dh->binary_properties.props = dh->binary_properties.n ? ddsrt_malloc(dh->binary_properties.n * sizeof(dds_binaryproperty_t)) : NULL;
+  for (i = 0; i < dh->binary_properties.n; i++)
+  {
+    DDS_Security_BinaryProperty_t *prop = &(holder->binary_properties._buffer[i]);
+    dh->binary_properties.props[i].name = prop->name ? ddsrt_strdup(prop->name) : NULL;
+    dh->binary_properties.props[i].value.length = prop->value._length;
+    if (dh->binary_properties.props[i].value.length)
+    {
+      dh->binary_properties.props[i].value.value = ddsrt_malloc(prop->value._length);
+      memcpy(dh->binary_properties.props[i].value.value, prop->value._buffer, prop->value._length);
+    }
+    else
+    {
+      dh->binary_properties.props[i].value.value = NULL;
+    }
+    dh->binary_properties.props[i].propagate = prop->propagate;
+  }
+}
+
+void
+q_omg_security_dataholder_copyout(
+    DDS_Security_DataHolder *holder,
+    const nn_dataholder_t *dh)
+{
+  uint32_t i;
+
+  holder->class_id = dh->class_id ? ddsrt_strdup(dh->class_id) : NULL;
+  holder->properties._length = holder->properties._maximum = dh->properties.n;
+  holder->properties._buffer = dh->properties.n ? DDS_Security_PropertySeq_allocbuf(dh->properties.n) : NULL;
+  for (i = 0; i < dh->properties.n; i++)
+  {
+    dds_property_t *props = &(dh->properties.props[i]);
+    holder->properties._buffer[i].name = props->name ? ddsrt_strdup(props->name) : NULL;
+    holder->properties._buffer[i].value = props->value ? ddsrt_strdup(props->value) : NULL;
+    holder->properties._buffer[i].propagate = props->propagate;
+  }
+  holder->binary_properties._length = holder->binary_properties._maximum = dh->binary_properties.n;
+  holder->binary_properties._buffer = dh->binary_properties.n ? DDS_Security_BinaryPropertySeq_allocbuf(dh->binary_properties.n) : NULL;
+  for (i = 0; i < dh->binary_properties.n; i++)
+  {
+    dds_binaryproperty_t *props = &(dh->binary_properties.props[i]);
+    holder->binary_properties._buffer[i].name = props->name ? ddsrt_strdup(props->name) : NULL;
+    holder->binary_properties._buffer[i].value._length = holder->binary_properties._buffer[i].value._maximum = props->value.length;
+    if (props->value.length)
+    {
+      holder->binary_properties._buffer[i].value._buffer = ddsrt_malloc(props->value.length);
+      memcpy(holder->binary_properties._buffer[i].value._buffer, props->value.value, props->value.length);
+    }
+    else
+    {
+      holder->binary_properties._buffer[i].value._buffer= NULL;
+    }
+    holder->binary_properties._buffer[i].propagate = props->propagate;
+  }
+}
+
+void
+q_omg_shallow_copyin_DataHolder(
+    DDS_Security_DataHolder *dst,
+    const nn_dataholder_t *src)
+{
+    assert(dst);
+    assert(src);
+    dst->class_id = src->class_id;
+    q_omg_shallow_copyin_PropertySeq(&dst->properties, &src->properties);
+    q_omg_shallow_copyin_BinaryPropertySeq(&dst->binary_properties, &src->binary_properties);
+}
+
+void
+q_omg_shallow_copyout_DataHolder(
+    nn_dataholder_t *dst,
+    const DDS_Security_DataHolder *src)
+{
+    assert(dst);
+    assert(src);
+    dst->class_id = src->class_id;
+    q_omg_shallow_copyout_PropertySeq(&dst->properties, &src->properties);
+    q_omg_shallow_copyout_BinaryPropertySeq(&dst->binary_properties, &src->binary_properties);
+}
+
+void
+q_omg_shallow_free_DataHolder(
+    DDS_Security_DataHolder *obj)
+{
+    q_omg_shallow_free_PropertySeq(&obj->properties);
+    q_omg_shallow_free_BinaryPropertySeq(&obj->binary_properties);
+}
+
+void
+q_omg_shallow_free_nn_dataholder(
+    nn_dataholder_t *holder)
+{
+  q_omg_shallow_free_dds_propertyseq(&holder->properties);
+  q_omg_shallow_free_dds_binarypropertyseq(&holder->binary_properties);
+}
+
+void
+q_omg_shallow_copyin_DataHolderSeq(
+    DDS_Security_DataHolderSeq *dst,
+    const nn_dataholderseq_t *src)
+{
+  unsigned i;
+
+  dst->_length  = src->n;
+  dst->_maximum = src->n;
+  dst->_buffer  = NULL;
+
+  if (src->n > 0)
+  {
+    dst->_buffer = ddsrt_malloc(src->n * sizeof(DDS_Security_DataHolder));
+    for (i = 0; i < src->n; i++)
+    {
+      q_omg_shallow_copyin_DataHolder(&dst->_buffer[i], &src->tags[i]);
+    }
+  }
+}
+
+void
+q_omg_copyin_DataHolderSeq(
+    DDS_Security_DataHolderSeq *dst,
+    const nn_dataholderseq_t *src)
+{
+  unsigned i;
+
+  dst->_length  = src->n;
+  dst->_maximum = src->n;
+  dst->_buffer  = NULL;
+
+  if (src->n > 0)
+  {
+    dst->_buffer = ddsrt_malloc(src->n * sizeof(DDS_Security_DataHolder));
+    for (i = 0; i < src->n; i++)
+    {
+      q_omg_security_dataholder_copyout(&dst->_buffer[i], &src->tags[i]);
+    }
+  }
+}
+
+
+
+void
+q_omg_shallow_copyout_DataHolderSeq(
+    nn_dataholderseq_t  *dst,
+    const DDS_Security_DataHolderSeq *src)
+{
+  unsigned i;
+
+  dst->n  = src->_length;
+  dst->tags  = NULL;
+
+  if (src->_length > 0)
+  {
+    dst->tags = ddsrt_malloc(src->_length * sizeof(nn_dataholder_t));
+    for (i = 0; i < src->_length; i++)
+    {
+      q_omg_shallow_copyout_DataHolder(&dst->tags[i], &src->_buffer[i]);
+    }
+  }
+}
+
+void
+q_omg_shallow_free_DataHolderSeq(
+    DDS_Security_DataHolderSeq *obj)
+{
+  unsigned i;
+
+  for (i = 0; i  < obj->_length; i++)
+  {
+    q_omg_shallow_free_DataHolder(&(obj->_buffer[i]));
+  }
+}
+
+void
+q_omg_shallow_free_nn_dataholderseq(
+    nn_dataholderseq_t *obj)
+{
+  unsigned i;
+
+  for (i = 0; i  < obj->n; i++)
+  {
+    q_omg_shallow_free_nn_dataholder(&(obj->tags[i]));
+  }
+  if (obj->n > 0)
+    ddsrt_free(obj->tags);
+}
+
+static DDS_Security_Duration_t convert_duration(dds_duration_t d)
+{
+  DDS_Security_Duration_t sd;
+
+  if (d == DDS_INFINITY)
+  {
+    sd.sec = INT32_MAX;
+    sd.nanosec = INT32_MAX;
+  }
+  else
+  {
+    sd.sec = ((int)(d/DDS_NSECS_IN_SEC));
+    sd.nanosec = ((uint32_t)((d)%DDS_NSECS_IN_SEC));
+  }
+  return sd;
+}
+
+static void
+g_omg_shallow_copy_octSeq(
+    DDS_Security_OctetSeq *dst,
+    const ddsi_octetseq_t *src)
+{
+  dst->_length  = src->length;
+  dst->_maximum = src->length;
+  dst->_buffer  = src->value;
+}
+
+static void
+g_omg_shallow_free_octSeq(
+    DDS_Security_OctetSeq *obj)
+{
+  DDSRT_UNUSED_ARG(obj);
+  /* Nothing to free. */
+}
+
+void
+q_omg_shallow_copy_ParticipantBuiltinTopicDataSecure(
+    DDS_Security_ParticipantBuiltinTopicDataSecure *dst,
+    const ddsi_guid_t *guid,
+    const ddsi_plist_t *plist)
+{
+  assert(dst);
+  assert(guid);
+  assert(plist);
+
+  memset(dst, 0, sizeof(DDS_Security_ParticipantBuiltinTopicDataSecure));
+
+  /* The participant guid is the key. */
+  dst->key[0] = guid->prefix.u[0];
+  dst->key[1] = guid->prefix.u[1];
+  dst->key[2] = guid->prefix.u[2];
+
+  /* Copy the DDS_Security_OctetSeq content (length, pointer, etc), not the buffer content. */
+  if (plist->qos.present & QP_USER_DATA)
+    memcpy(&(dst->user_data.value), &(plist->qos.user_data.value), sizeof(DDS_Security_OctetSeq));
+  /* Tokens are actually DataHolders. */
+  if (plist->present & PP_IDENTITY_TOKEN)
+    q_omg_shallow_copyin_DataHolder(&(dst->identity_token), &(plist->identity_token));
+  if (plist->present & PP_PERMISSIONS_TOKEN)
+    q_omg_shallow_copyin_DataHolder(&(dst->permissions_token), &(plist->permissions_token));
+  if (plist->present & PP_IDENTITY_STATUS_TOKEN)
+    q_omg_shallow_copyin_DataHolder(&(dst->identity_status_token), &(plist->identity_status_token));
+  if (plist->qos.present & QP_PROPERTY_LIST)
+    q_omg_shallow_copy_PropertyQosPolicy(&(dst->property), &(plist->qos.property));
+  if (plist->present & PP_PARTICIPANT_SECURITY_INFO)
+  {
+    dst->security_info.participant_security_attributes = plist->participant_security_info.security_attributes;
+    dst->security_info.plugin_participant_security_attributes = plist->participant_security_info.plugin_security_attributes;
+  }
+}
+
+void
+q_omg_shallow_free_ParticipantBuiltinTopicDataSecure(
+    DDS_Security_ParticipantBuiltinTopicDataSecure *obj)
+{
+  assert(obj);
+  q_omg_shallow_free_DataHolder(&(obj->identity_token));
+  q_omg_shallow_free_DataHolder(&(obj->permissions_token));
+  q_omg_shallow_free_DataHolder(&(obj->identity_status_token));
+  q_omg_shallow_free_PropertyQosPolicy(&(obj->property));
+}
+
+void
+q_omg_shallow_copy_SubscriptionBuiltinTopicDataSecure(
+    DDS_Security_SubscriptionBuiltinTopicDataSecure *dst,
+    const ddsi_guid_t *guid,
+    const struct dds_qos *qos,
+    const nn_security_info_t *secinfo)
+{
+  memset(dst, 0, sizeof(DDS_Security_SubscriptionBuiltinTopicDataSecure));
+
+  /* Keys are inspired by write_builtin_topic_copyin_subscriptionInfo() */
+  dst->key[0] = ddsrt_toBE4u(guid->prefix.u[0]);
+  dst->key[1] = ddsrt_toBE4u(guid->prefix.u[1]);
+  dst->key[2] = ddsrt_toBE4u(guid->prefix.u[2]);
+
+  dst->participant_key[0] = ddsrt_toBE4u(guid->prefix.u[0]);
+  dst->participant_key[1] = ddsrt_toBE4u(guid->prefix.u[1]);
+  dst->participant_key[2] = ddsrt_toBE4u(guid->prefix.u[2]);
+
+  if (qos->present & QP_TOPIC_NAME)
+    dst->topic_name = (DDS_Security_string)qos->topic_name;
+  if (qos->present & QP_TYPE_NAME)
+    dst->type_name  = (DDS_Security_string)qos->type_name;
+
+  dst->security_info.endpoint_security_mask = secinfo->security_attributes;
+  dst->security_info.plugin_endpoint_security_mask = secinfo->plugin_security_attributes;
+
+  if (qos->present & QP_DURABILITY)
+    dst->durability.kind = (DDS_Security_DurabilityQosPolicyKind)qos->durability.kind;
+  if (qos->present & QP_DEADLINE)
+    dst->deadline.period = convert_duration(qos->deadline.deadline);
+  if (qos->present & QP_LATENCY_BUDGET)
+    dst->latency_budget.duration = convert_duration(qos->latency_budget.duration);
+  if (qos->present & QP_LIVELINESS)
+  {
+    dst->liveliness.kind = (DDS_Security_LivelinessQosPolicyKind)qos->liveliness.kind;
+    dst->liveliness.lease_duration = convert_duration(qos->liveliness.lease_duration);
+  }
+  if (qos->present & QP_OWNERSHIP)
+    dst->ownership.kind = qos->ownership.kind == DDS_OWNERSHIP_SHARED ? DDS_SECURITY_SHARED_OWNERSHIP_QOS : DDS_SECURITY_EXCLUSIVE_OWNERSHIP_QOS;
+  if (qos->present & QP_DESTINATION_ORDER)
+    dst->destination_order.kind = (DDS_Security_DestinationOrderQosPolicyKind)qos->destination_order.kind;
+  if (qos->present & QP_PRESENTATION)
+  {
+    dst->presentation.access_scope = (DDS_Security_PresentationQosPolicyAccessScopeKind)qos->presentation.access_scope;
+    dst->presentation.coherent_access = qos->presentation.coherent_access;
+    dst->presentation.ordered_access = qos->presentation.ordered_access;
+  }
+  if (qos->present & QP_TIME_BASED_FILTER)
+    dst->time_based_filter.minimum_separation = convert_duration(qos->time_based_filter.minimum_separation);
+  if (qos->present & QP_RELIABILITY)
+  {
+    dst->reliability.kind               = (DDS_Security_ReliabilityQosPolicyKind)(qos->reliability.kind);
+    dst->reliability.max_blocking_time  = convert_duration(qos->reliability.max_blocking_time);
+    dst->reliability.synchronous        = 0;
+  }
+  if (qos->present & QP_PARTITION)
+    g_omg_shallow_copy_StringSeq(&dst->partition.name, &qos->partition);
+  if (qos->present & QP_USER_DATA)
+    g_omg_shallow_copy_octSeq(&dst->user_data.value, &qos->user_data);
+  if (qos->present & QP_TOPIC_DATA)
+    g_omg_shallow_copy_octSeq(&dst->topic_data.value, &qos->topic_data);
+  if (qos->present & QP_GROUP_DATA)
+    g_omg_shallow_copy_octSeq(&dst->group_data.value, &qos->group_data);
+
+  /* The dst->data_tags is not supported yet. It is memset to 0, so ok. */
+}
+
+void
+q_omg_shallow_free_SubscriptionBuiltinTopicDataSecure(
+    DDS_Security_SubscriptionBuiltinTopicDataSecure *obj)
+{
+  g_omg_shallow_free_octSeq(&obj->user_data.value);
+  g_omg_shallow_free_octSeq(&obj->topic_data.value);
+  g_omg_shallow_free_octSeq(&obj->group_data.value);
+  g_omg_shallow_free_StringSeq(&obj->partition.name);
+}
+
+void
+q_omg_shallow_copy_PublicationBuiltinTopicDataSecure(
+    DDS_Security_PublicationBuiltinTopicDataSecure *dst,
+    const ddsi_guid_t *guid,
+    const struct dds_qos *qos,
+    const nn_security_info_t *secinfo)
+{
+
+  memset(dst, 0, sizeof(DDS_Security_PublicationBuiltinTopicDataSecure));
+
+  /* Keys are inspired by write_builtin_topic_copyin_subscriptionInfo() */
+  dst->key[0] = ddsrt_toBE4u(guid->prefix.u[0]);
+  dst->key[1] = ddsrt_toBE4u(guid->prefix.u[1]);
+  dst->key[2] = ddsrt_toBE4u(guid->prefix.u[2]);
+
+  dst->participant_key[0] = ddsrt_toBE4u(guid->prefix.u[0]);
+  dst->participant_key[1] = ddsrt_toBE4u(guid->prefix.u[1]);
+  dst->participant_key[2] = ddsrt_toBE4u(guid->prefix.u[2]);
+
+  if (qos->present & QP_TOPIC_NAME)
+    dst->topic_name = (DDS_Security_string)qos->topic_name;
+  if (qos->present & QP_TYPE_NAME)
+    dst->type_name  = (DDS_Security_string)qos->type_name;
+
+  dst->security_info.endpoint_security_mask = secinfo->security_attributes;
+  dst->security_info.plugin_endpoint_security_mask = secinfo->plugin_security_attributes;
+
+  if (qos->present & QP_DURABILITY)
+    dst->durability.kind = (DDS_Security_DurabilityQosPolicyKind)qos->durability.kind;
+  if (qos->present & QP_DEADLINE)
+    dst->deadline.period = convert_duration(qos->deadline.deadline);
+  if (qos->present & QP_LATENCY_BUDGET)
+    dst->latency_budget.duration = convert_duration(qos->latency_budget.duration);
+  if (qos->present & QP_LIVELINESS)
+  {
+    dst->liveliness.kind = (DDS_Security_LivelinessQosPolicyKind)qos->liveliness.kind;
+    dst->liveliness.lease_duration = convert_duration(qos->liveliness.lease_duration);
+  }
+  if (qos->present & QP_OWNERSHIP)
+    dst->ownership.kind = qos->ownership.kind == DDS_OWNERSHIP_SHARED ? DDS_SECURITY_SHARED_OWNERSHIP_QOS : DDS_SECURITY_EXCLUSIVE_OWNERSHIP_QOS;
+  if (qos->present & QP_DESTINATION_ORDER)
+    dst->destination_order.kind = (DDS_Security_DestinationOrderQosPolicyKind)qos->destination_order.kind;
+  if (qos->present & QP_PRESENTATION)
+  {
+    dst->presentation.access_scope = (DDS_Security_PresentationQosPolicyAccessScopeKind)qos->presentation.access_scope;
+    dst->presentation.coherent_access = qos->presentation.coherent_access;
+    dst->presentation.ordered_access = qos->presentation.ordered_access;
+  }
+  if (qos->present & QP_OWNERSHIP_STRENGTH)
+    dst->ownership_strength.value = qos->ownership_strength.value;
+  if (qos->present & QP_RELIABILITY)
+  {
+    dst->reliability.kind              = (DDS_Security_ReliabilityQosPolicyKind)(qos->reliability.kind);
+    dst->reliability.max_blocking_time = convert_duration(qos->reliability.max_blocking_time);
+    dst->reliability.synchronous       = 0;
+  }
+  if (qos->present & QP_LIFESPAN)
+    dst->lifespan.duration = convert_duration(qos->lifespan.duration);
+  if (qos->present & QP_PARTITION)
+    g_omg_shallow_copy_StringSeq(&dst->partition.name, &qos->partition);
+  if (qos->present & QP_USER_DATA)
+    g_omg_shallow_copy_octSeq(&dst->user_data.value, &qos->user_data);
+
+  if (qos->present & QP_TOPIC_DATA)
+    g_omg_shallow_copy_octSeq(&dst->topic_data.value, &qos->topic_data);
+  if (qos->present & QP_GROUP_DATA)
+    g_omg_shallow_copy_octSeq(&dst->group_data.value, &qos->group_data);
+
+  /* The dst->data_tags is not supported yet. It is memset to 0, so ok. */
+}
+
+void
+q_omg_shallow_free_PublicationBuiltinTopicDataSecure(
+    DDS_Security_PublicationBuiltinTopicDataSecure *obj)
+{
+  g_omg_shallow_free_octSeq(&obj->user_data.value);
+  g_omg_shallow_free_octSeq(&obj->topic_data.value);
+  g_omg_shallow_free_octSeq(&obj->group_data.value);
+  g_omg_shallow_free_StringSeq(&obj->partition.name);
+}
+
+
+
+#endif /* DDSI_INCLUDE_SECURITY */
diff --git a/src/core/ddsi/src/q_ddsi_discovery.c b/src/core/ddsi/src/q_ddsi_discovery.c
index 05cdea6..589276a 100644
--- a/src/core/ddsi/src/q_ddsi_discovery.c
+++ b/src/core/ddsi/src/q_ddsi_discovery.c
@@ -45,6 +45,9 @@
 #include "dds/ddsi/q_feature_check.h"
 #include "dds/ddsi/ddsi_security_omg.h"
 #include "dds/ddsi/ddsi_pmd.h"
+#ifdef DDSI_INCLUDE_SECURITY
+#include "dds/ddsi/ddsi_security_exchange.h"
+#endif
 
 static int get_locator (const struct ddsi_domaingv *gv, nn_locator_t *loc, const nn_locators_t *locs, int uc_same_subnet)
 {
@@ -184,37 +187,13 @@ static int write_mpayload (struct writer *wr, int alive, nn_parameterid_t keypar
   return write_sample_nogc_notk (ts1, NULL, wr, serdata);
 }
 
-int spdp_write (struct participant *pp)
+void get_participant_builtin_topic_data(const struct participant *pp, struct nn_xmsg *mpayload, bool be)
 {
-  struct nn_xmsg *mpayload;
   struct nn_locators_one def_uni_loc_one, def_multi_loc_one, meta_uni_loc_one, meta_multi_loc_one;
   ddsi_plist_t ps;
-  struct writer *wr;
   size_t size;
   char node[64];
   uint64_t qosdiff;
-  int ret;
-
-  if (pp->e.onlylocal) {
-      /* This topic is only locally available. */
-      return 0;
-  }
-
-  ETRACE (pp, "spdp_write("PGUIDFMT")\n", PGUID (pp->e.guid));
-
-  if ((wr = get_builtin_writer (pp, NN_ENTITYID_SPDP_BUILTIN_PARTICIPANT_WRITER)) == NULL)
-  {
-    ETRACE (pp, "spdp_write("PGUIDFMT") - builtin participant writer not found\n", PGUID (pp->e.guid));
-    return 0;
-  }
-
-  /* First create a fake message for the payload: we can add plists to
-     xmsgs easily, but not to serdata.  But it is rather easy to copy
-     the payload of an xmsg over to a serdata ...  Expected size isn't
-     terribly important, the msg will grow as needed, address space is
-     essentially meaningless because we only use the message to
-     construct the payload. */
-  mpayload = nn_xmsg_new (pp->e.gv->xmsgpool, &pp->e.guid, NULL, 0, NN_XMSG_KIND_DATA);
 
   ddsi_plist_init_empty (&ps);
   ps.present |= PP_PARTICIPANT_GUID | PP_BUILTIN_ENDPOINT_SET |
@@ -321,6 +300,210 @@ int spdp_write (struct participant *pp)
     ETRACE (pp, "spdp_write("PGUIDFMT") - internals: %s\n", PGUID (pp->e.guid), ps.prismtech_participant_version_info.internals);
   }
 
+#ifdef DDSI_INCLUDE_SECURITY
+  /* Add Security specific information. */
+  if (q_omg_get_participant_security_info(pp, &(ps.participant_security_info))) {
+    ps.present |= PP_PARTICIPANT_SECURITY_INFO;
+    ps.aliased |= PP_PARTICIPANT_SECURITY_INFO;
+  }
+#endif
+
+  /* Participant QoS's insofar as they are set, different from the default, and mapped to the SPDP data, rather than to the PrismTech-specific CMParticipant endpoint.  Currently, that means just USER_DATA. */
+  qosdiff = ddsi_xqos_delta (&pp->plist->qos, &pp->e.gv->default_plist_pp.qos, QP_USER_DATA);
+  if (pp->e.gv->config.explicitly_publish_qos_set_to_default)
+    qosdiff |= ~QP_UNRECOGNIZED_INCOMPATIBLE_MASK;
+
+  assert (ps.qos.present == 0);
+  ddsi_plist_addtomsg_bo (mpayload, &ps, ~(uint64_t)0, 0, be);
+  ddsi_plist_addtomsg_bo (mpayload, pp->plist, 0, qosdiff, be);
+#ifdef DDSI_INCLUDE_SECURITY
+  if (q_omg_participant_is_secure(pp))
+     ddsi_plist_addtomsg_bo (mpayload, pp->plist, PP_IDENTITY_TOKEN | PP_PERMISSIONS_TOKEN, 0, be);
+#endif
+  nn_xmsg_addpar_sentinel_bo (mpayload, be);
+  ddsi_plist_fini (&ps);
+}
+
+int spdp_write (struct participant *pp)
+{
+  struct nn_xmsg *mpayload;
+  struct writer *wr;
+  int ret;
+
+  if (pp->e.onlylocal) {
+      /* This topic is only locally available. */
+      return 0;
+  }
+
+  ETRACE (pp, "spdp_write("PGUIDFMT")\n", PGUID (pp->e.guid));
+
+  if ((wr = get_builtin_writer (pp, NN_ENTITYID_SPDP_BUILTIN_PARTICIPANT_WRITER)) == NULL)
+  {
+    ETRACE (pp, "spdp_write("PGUIDFMT") - builtin participant writer not found\n", PGUID (pp->e.guid));
+    return 0;
+  }
+
+  /* First create a fake message for the payload: we can add plists to
+     xmsgs easily, but not to serdata.  But it is rather easy to copy
+     the payload of an xmsg over to a serdata ...  Expected size isn't
+     terribly important, the msg will grow as needed, address space is
+     essentially meaningless because we only use the message to
+     construct the payload. */
+  mpayload = nn_xmsg_new (pp->e.gv->xmsgpool, &pp->e.guid, pp, 0, NN_XMSG_KIND_DATA);
+  get_participant_builtin_topic_data(pp, mpayload, false);
+  ret = write_mpayload (wr, 1, PID_PARTICIPANT_GUID, mpayload);
+  nn_xmsg_free (mpayload);
+  return ret;
+}
+
+
+
+#if 0
+int spdp_write (struct participant *pp)
+{
+  struct nn_xmsg *mpayload;
+  struct nn_locators_one def_uni_loc_one, def_multi_loc_one, meta_uni_loc_one, meta_multi_loc_one;
+  ddsi_plist_t ps;
+  struct writer *wr;
+  size_t size;
+  char node[64];
+  uint64_t qosdiff;
+  int ret;
+
+  if (pp->e.onlylocal) {
+      /* This topic is only locally available. */
+      return 0;
+  }
+
+  ETRACE (pp, "spdp_write("PGUIDFMT")\n", PGUID (pp->e.guid));
+
+  if ((wr = get_builtin_writer (pp, NN_ENTITYID_SPDP_BUILTIN_PARTICIPANT_WRITER)) == NULL)
+  {
+    ETRACE (pp, "spdp_write("PGUIDFMT") - builtin participant writer not found\n", PGUID (pp->e.guid));
+    return 0;
+  }
+
+  /* First create a fake message for the payload: we can add plists to
+     xmsgs easily, but not to serdata.  But it is rather easy to copy
+     the payload of an xmsg over to a serdata ...  Expected size isn't
+     terribly important, the msg will grow as needed, address space is
+     essentially meaningless because we only use the message to
+     construct the payload. */
+  mpayload = nn_xmsg_new (pp->e.gv->xmsgpool, &pp->e.guid, pp, 0, NN_XMSG_KIND_DATA);
+
+  ddsi_plist_init_empty (&ps);
+  ps.present |= PP_PARTICIPANT_GUID | PP_BUILTIN_ENDPOINT_SET |
+    PP_PROTOCOL_VERSION | PP_VENDORID | PP_PARTICIPANT_LEASE_DURATION |
+    PP_DOMAIN_ID;
+  ps.participant_guid = pp->e.guid;
+  ps.builtin_endpoint_set = pp->bes;
+  ps.protocol_version.major = RTPS_MAJOR;
+  ps.protocol_version.minor = RTPS_MINOR;
+  ps.vendorid = NN_VENDORID_ECLIPSE;
+  ps.domain_id = pp->e.gv->config.extDomainId.value;
+  /* Be sure not to send a DOMAIN_TAG when it is the default (an empty)
+     string: it is an "incompatible-if-unrecognized" parameter, and so
+     implementations that don't understand the parameter will refuse to
+     discover us, and so sending the default would break backwards
+     compatibility. */
+  if (strcmp (pp->e.gv->config.domainTag, "") != 0)
+  {
+    ps.present |= PP_DOMAIN_TAG;
+    ps.aliased |= PP_DOMAIN_TAG;
+    ps.domain_tag = pp->e.gv->config.domainTag;
+  }
+  ps.default_unicast_locators.n = 1;
+  ps.default_unicast_locators.first =
+    ps.default_unicast_locators.last = &def_uni_loc_one;
+  ps.metatraffic_unicast_locators.n = 1;
+  ps.metatraffic_unicast_locators.first =
+    ps.metatraffic_unicast_locators.last = &meta_uni_loc_one;
+  def_uni_loc_one.next = NULL;
+  meta_uni_loc_one.next = NULL;
+
+  if (pp->e.gv->config.many_sockets_mode == MSM_MANY_UNICAST)
+  {
+    def_uni_loc_one.loc = pp->m_locator;
+    meta_uni_loc_one.loc = pp->m_locator;
+  }
+  else
+  {
+    def_uni_loc_one.loc = pp->e.gv->loc_default_uc;
+    meta_uni_loc_one.loc = pp->e.gv->loc_meta_uc;
+  }
+
+  if (pp->e.gv->config.publish_uc_locators)
+  {
+    ps.present |= PP_DEFAULT_UNICAST_LOCATOR | PP_METATRAFFIC_UNICAST_LOCATOR;
+    ps.aliased |= PP_DEFAULT_UNICAST_LOCATOR | PP_METATRAFFIC_UNICAST_LOCATOR;
+  }
+
+  if (pp->e.gv->config.allowMulticast)
+  {
+    int include = 0;
+#ifdef DDSI_INCLUDE_SSM
+    /* Note that if the default multicast address is an SSM address,
+       we will simply advertise it. The recipients better understand
+       it means the writers will publish to address and the readers
+       favour SSM. */
+    if (ddsi_is_ssm_mcaddr (pp->e.gv, &pp->e.gv->loc_default_mc))
+      include = (pp->e.gv->config.allowMulticast & AMC_SSM) != 0;
+    else
+      include = (pp->e.gv->config.allowMulticast & AMC_ASM) != 0;
+#else
+    if (pp->e.gv->config.allowMulticast & AMC_ASM)
+      include = 1;
+#endif
+    if (include)
+    {
+      ps.present |= PP_DEFAULT_MULTICAST_LOCATOR | PP_METATRAFFIC_MULTICAST_LOCATOR;
+      ps.aliased |= PP_DEFAULT_MULTICAST_LOCATOR | PP_METATRAFFIC_MULTICAST_LOCATOR;
+      ps.default_multicast_locators.n = 1;
+      ps.default_multicast_locators.first =
+      ps.default_multicast_locators.last = &def_multi_loc_one;
+      ps.metatraffic_multicast_locators.n = 1;
+      ps.metatraffic_multicast_locators.first =
+      ps.metatraffic_multicast_locators.last = &meta_multi_loc_one;
+      def_multi_loc_one.next = NULL;
+      def_multi_loc_one.loc = pp->e.gv->loc_default_mc;
+      meta_multi_loc_one.next = NULL;
+      meta_multi_loc_one.loc = pp->e.gv->loc_meta_mc;
+    }
+  }
+  ps.participant_lease_duration = pp->lease_duration;
+
+  /* Add PrismTech specific version information */
+  {
+    ps.present |= PP_PRISMTECH_PARTICIPANT_VERSION_INFO;
+    memset (&ps.prismtech_participant_version_info, 0, sizeof (ps.prismtech_participant_version_info));
+    ps.prismtech_participant_version_info.version = 0;
+    ps.prismtech_participant_version_info.flags =
+      NN_PRISMTECH_FL_DDSI2_PARTICIPANT_FLAG |
+      NN_PRISMTECH_FL_PTBES_FIXED_0 |
+      NN_PRISMTECH_FL_SUPPORTS_STATUSINFOX;
+    if (pp->e.gv->config.besmode == BESMODE_MINIMAL)
+      ps.prismtech_participant_version_info.flags |= NN_PRISMTECH_FL_MINIMAL_BES_MODE;
+    ddsrt_mutex_lock (&pp->e.gv->privileged_pp_lock);
+    if (pp->is_ddsi2_pp)
+      ps.prismtech_participant_version_info.flags |= NN_PRISMTECH_FL_PARTICIPANT_IS_DDSI2;
+    ddsrt_mutex_unlock (&pp->e.gv->privileged_pp_lock);
+
+    if (ddsrt_gethostname(node, sizeof(node)-1) < 0)
+      (void) ddsrt_strlcpy (node, "unknown", sizeof (node));
+    size = strlen(node) + strlen(DDS_VERSION) + strlen(DDS_HOST_NAME) + strlen(DDS_TARGET_NAME) + 4; /* + ///'\0' */
+    ps.prismtech_participant_version_info.internals = ddsrt_malloc(size);
+    (void) snprintf(ps.prismtech_participant_version_info.internals, size, "%s/%s/%s/%s", node, DDS_VERSION, DDS_HOST_NAME, DDS_TARGET_NAME);
+    ETRACE (pp, "spdp_write("PGUIDFMT") - internals: %s\n", PGUID (pp->e.guid), ps.prismtech_participant_version_info.internals);
+  }
+
+#ifdef DDSI_INCLUDE_SECURITY
+  /* Add Security specific information. */
+  if (q_omg_get_participant_security_info(pp, &(ps.participant_security_info))) {
+    ps.present |= PP_PARTICIPANT_SECURITY_INFO;
+    ps.aliased |= PP_PARTICIPANT_SECURITY_INFO;
+  }
+#endif
+
   /* Participant QoS's insofar as they are set, different from the default, and mapped to the SPDP data, rather than to the PrismTech-specific CMParticipant endpoint.  Currently, that means just USER_DATA. */
   qosdiff = ddsi_xqos_delta (&pp->plist->qos, &pp->e.gv->default_plist_pp.qos, QP_USER_DATA);
   if (pp->e.gv->config.explicitly_publish_qos_set_to_default)
@@ -329,6 +512,10 @@ int spdp_write (struct participant *pp)
   assert (ps.qos.present == 0);
   ddsi_plist_addtomsg (mpayload, &ps, ~(uint64_t)0, 0);
   ddsi_plist_addtomsg (mpayload, pp->plist, 0, qosdiff);
+#ifdef DDSI_INCLUDE_SECURITY
+  if (q_omg_participant_is_secure(pp))
+    ddsi_plist_addtomsg (mpayload, pp->plist, PP_IDENTITY_TOKEN | PP_PERMISSIONS_TOKEN, 0);
+#endif
   nn_xmsg_addpar_sentinel (mpayload);
   ddsi_plist_fini (&ps);
 
@@ -336,6 +523,7 @@ int spdp_write (struct participant *pp)
   nn_xmsg_free (mpayload);
   return ret;
 }
+#endif
 
 static int spdp_dispose_unregister_with_wr (struct participant *pp, unsigned entityid)
 {
@@ -352,7 +540,7 @@ static int spdp_dispose_unregister_with_wr (struct participant *pp, unsigned ent
     return 0;
   }
 
-  mpayload = nn_xmsg_new (pp->e.gv->xmsgpool, &pp->e.guid, NULL, 0, NN_XMSG_KIND_DATA);
+  mpayload = nn_xmsg_new (pp->e.gv->xmsgpool, &pp->e.guid, pp, 0, NN_XMSG_KIND_DATA);
   ddsi_plist_init_empty (&ps);
   ps.present |= PP_PARTICIPANT_GUID;
   ps.participant_guid = pp->e.guid;
@@ -1009,7 +1197,7 @@ static int sedp_write_endpoint
      the QoS and other settings. So the header fields aren't really
      important, except that they need to be set to reasonable things
      or it'll crash */
-  mpayload = nn_xmsg_new (gv->xmsgpool, &wr->e.guid, NULL, 0, NN_XMSG_KIND_DATA);
+  mpayload = nn_xmsg_new (gv->xmsgpool, &wr->e.guid, wr->c.pp, 0, NN_XMSG_KIND_DATA);
   ddsi_plist_addtomsg (mpayload, &ps, ~(uint64_t)0, ~(uint64_t)0);
   if (xqos) ddsi_xqos_addtomsg (mpayload, xqos, qosdiff);
   nn_xmsg_addpar_sentinel (mpayload);
@@ -1268,6 +1456,12 @@ static void handle_SEDP_alive (const struct receiver_state *rst, seqno_t seq, dd
     E ("******* AARGH - it expects inline QoS ********\n", err);
   }
 
+  q_omg_log_endpoint_protection(gv, datap);
+  if (q_omg_is_endpoint_protected(datap) && !q_omg_proxy_participant_is_secure(pp))
+  {
+    E (" remote endpoint is protected while local federation is not secure\n", err);
+  }
+
   if (is_writer)
   {
     pwr = entidx_lookup_proxy_writer_guid (gv->entity_index, &datap->endpoint_guid);
@@ -1472,7 +1666,7 @@ int sedp_write_topic (struct participant *pp, const struct ddsi_plist *datap)
 
   sedp_wr = get_sedp_writer (pp, NN_ENTITYID_SEDP_BUILTIN_TOPIC_WRITER);
 
-  mpayload = nn_xmsg_new (sedp_wr->e.gv->xmsgpool, &sedp_wr->e.guid, NULL, 0, NN_XMSG_KIND_DATA);
+  mpayload = nn_xmsg_new (sedp_wr->e.gv->xmsgpool, &sedp_wr->e.guid, pp, 0, NN_XMSG_KIND_DATA);
   delta = ddsi_xqos_delta (&datap->qos, &sedp_wr->e.gv->default_xqos_tp, ~(uint64_t)0);
   if (sedp_wr->e.gv->config.explicitly_publish_qos_set_to_default)
     delta |= ~QP_UNRECOGNIZED_INCOMPATIBLE_MASK;
@@ -1718,10 +1912,10 @@ int builtins_dqueue_handler (const struct nn_rsample_info *sampleinfo, const str
       break;
 #ifdef DDSI_INCLUDE_SECURITY
     case NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_STATELESS_MESSAGE_WRITER:
-      /* TODO: Handshake */
+      handle_auth_handshake_message(sampleinfo->rst, srcguid.entityid, timestamp, statusinfo, datap, datasz);
       break;
     case NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_VOLATILE_SECURE_WRITER:
-      /* TODO: Key exchange */
+      handle_crypto_exchange_message(sampleinfo->rst, srcguid.entityid, timestamp, statusinfo, datap, datasz);
       break;
 #endif
     default:
diff --git a/src/core/ddsi/src/q_entity.c b/src/core/ddsi/src/q_entity.c
index 72df23f..ab60485 100644
--- a/src/core/ddsi/src/q_entity.c
+++ b/src/core/ddsi/src/q_entity.c
@@ -109,7 +109,7 @@ static void unref_participant (struct participant *pp, const struct ddsi_guid *g
 static struct entity_common *entity_common_from_proxy_endpoint_common (const struct proxy_endpoint_common *c);
 
 #ifdef DDSI_INCLUDE_SECURITY
-static void handshake_end_cb(struct ddsi_domaingv const * const gv, struct ddsi_handshake *handshake, const struct ddsi_guid *lpguid, const struct ddsi_guid *ppguid, enum ddsi_handshake_state result);
+static void handshake_end_cb(struct ddsi_handshake *handshake, struct participant *pp, struct proxy_participant *proxypp, enum ddsi_handshake_state result);
 static void downgrade_to_nonsecure(struct proxy_participant *proxypp);
 #endif
 
@@ -217,6 +217,13 @@ static int is_builtin_volatile_endpoint (ddsi_entityid_t id)
   }
   return 0;
 }
+#else
+
+static int is_builtin_volatile_endpoint (ddsi_entityid_t id)
+{
+  DDSRT_UNUSED_ARG(id);
+  return 0;
+}
 
 #endif
 
@@ -637,14 +644,14 @@ static void connect_participant_secure(struct ddsi_domaingv *gv, struct particip
 
   if (q_omg_participant_is_secure(pp))
   {
+    q_omg_security_participant_set_initialized(pp);
+
     entidx_enum_proxy_participant_init (&it, gv->entity_index);
     while ((proxypp = entidx_enum_proxy_participant_next (&it)) != NULL)
     {
       /* Do not start handshaking when security info doesn't match. */
-      if (q_omg_is_similar_participant_security_info(pp, proxypp))
-      {
+      if (q_omg_security_remote_participant_is_initialized(proxypp) && q_omg_is_similar_participant_security_info(pp, proxypp))
         ddsi_handshake_register(pp, proxypp, handshake_end_cb);
-      }
     }
     entidx_enum_proxy_participant_fini (&it);
   }
@@ -743,7 +750,7 @@ static void participant_remove_wr_lease_locked (struct participant * pp, struct
   }
 }
 
-dds_return_t new_participant_guid (const ddsi_guid_t *ppguid, struct ddsi_domaingv *gv, unsigned flags, const ddsi_plist_t *plist)
+dds_return_t new_participant_guid (ddsi_guid_t *ppguid, struct ddsi_domaingv *gv, unsigned flags, const ddsi_plist_t *plist)
 {
   struct participant *pp;
   ddsi_guid_t subguid, group_guid;
@@ -806,6 +813,7 @@ dds_return_t new_participant_guid (const ddsi_guid_t *ppguid, struct ddsi_domain
   ddsi_plist_mergein_missing (pp->plist, &gv->default_local_plist_pp, ~(uint64_t)0, ~(uint64_t)0);
 
 #ifdef DDSI_INCLUDE_SECURITY
+  pp->sec_attr = NULL;
   /*
    * if there there are security properties check them .
    * if there are no security properties, then merge from security configuration if there is
@@ -876,6 +884,7 @@ dds_return_t new_participant_guid (const ddsi_guid_t *ppguid, struct ddsi_domain
       ret = DDS_RETCODE_NOT_ALLOWED_BY_SECURITY;
       goto not_allowed;
     }
+    *ppguid = pp->e.guid;
   }
 #endif
 
@@ -1257,6 +1266,9 @@ static void unref_participant (struct participant *pp, const struct ddsi_guid *g
          while longer for it to wakeup. */
       ddsi_conn_free (pp->m_conn);
     }
+#ifdef DDSI_INCLUDE_SECURITY
+    q_omg_security_deregister_participant(pp);
+#endif
     ddsi_plist_fini (pp->plist);
     ddsrt_free (pp->plist);
     ddsrt_mutex_destroy (&pp->refc_lock);
@@ -1735,19 +1747,30 @@ void rebuild_or_clear_writer_addrsets (struct ddsi_domaingv *gv, int rebuild)
   GVLOGDISC ("rebuild_or_delete_writer_addrsets(%d) done\n", rebuild);
 }
 
-static void free_wr_prd_match (struct wr_prd_match *m)
+static void free_wr_prd_match (const struct ddsi_domaingv *gv, const ddsi_guid_t *wr_guid, struct wr_prd_match *m)
 {
   if (m)
   {
+#ifdef DDSI_INCLUDE_SECURITY
+    q_omg_security_deregister_remote_reader_match (gv, wr_guid, m);
+#else
+    (void) gv;
+    (void) wr_guid;
+#endif
     nn_lat_estim_fini (&m->hb_to_ack_latency);
     ddsrt_free (m);
   }
 }
 
-static void free_rd_pwr_match (struct ddsi_domaingv *gv, struct rd_pwr_match *m)
+static void free_rd_pwr_match (struct ddsi_domaingv *gv, const ddsi_guid_t *rd_guid, struct rd_pwr_match *m)
 {
   if (m)
   {
+#ifdef DDSI_INCLUDE_SECURITY
+    q_omg_security_deregister_remote_writer_match (gv, rd_guid, m);
+#else
+    (void) rd_guid;
+#endif
 #ifdef DDSI_INCLUDE_SSM
     if (!is_unspec_locator (&m->ssm_mc_loc))
     {
@@ -1756,7 +1779,8 @@ static void free_rd_pwr_match (struct ddsi_domaingv *gv, struct rd_pwr_match *m)
       if (ddsi_leave_mc (gv, gv->mship, gv->data_conn_mc, &m->ssm_src_loc, &m->ssm_mc_loc) < 0)
         GVWARNING ("failed to leave network partition ssm group\n");
     }
-#else
+#endif
+#if !(defined DDSI_INCLUDE_SECURITY || defined DDSI_INCLUDE_SSM)
     (void) gv;
 #endif
     ddsrt_free (m);
@@ -1829,8 +1853,10 @@ static void writer_drop_connection (const struct ddsi_guid *wr_guid, const struc
       ddsrt_avl_delete (&wr_readers_treedef, &wr->readers, m);
       rebuild_writer_addrset (wr);
       remove_acked_messages (wr, &whcst, &deferred_free_list);
+      wr->num_readers--;
       wr->num_reliable_readers -= m->is_reliable;
     }
+
     ddsrt_mutex_unlock (&wr->e.lock);
     if (m != NULL && wr->status_cb)
     {
@@ -1841,7 +1867,7 @@ static void writer_drop_connection (const struct ddsi_guid *wr_guid, const struc
       (wr->status_cb) (wr->status_cb_entity, &data);
     }
     whc_free_deferred_free_list (wr->whc, deferred_free_list);
-    free_wr_prd_match (m);
+    free_wr_prd_match (wr->e.gv, &wr->e.guid, m);
   }
 }
 
@@ -1981,7 +2007,11 @@ static void reader_drop_connection (const struct ddsi_guid *rd_guid, const struc
     struct rd_pwr_match *m;
     ddsrt_mutex_lock (&rd->e.lock);
     if ((m = ddsrt_avl_lookup (&rd_writers_treedef, &rd->writers, &pwr->e.guid)) != NULL)
+    {
       ddsrt_avl_delete (&rd_writers_treedef, &rd->writers, m);
+      rd->num_writers--;
+    }
+
     ddsrt_mutex_unlock (&rd->e.lock);
     if (m != NULL)
     {
@@ -2005,7 +2035,7 @@ static void reader_drop_connection (const struct ddsi_guid *rd_guid, const struc
         (rd->status_cb) (rd->status_cb_entity, &data);
       }
     }
-    free_rd_pwr_match (pwr->e.gv, m);
+    free_rd_pwr_match (pwr->e.gv, &rd->e.guid, m);
   }
 }
 
@@ -2122,7 +2152,7 @@ static void proxy_reader_drop_connection (const struct ddsi_guid *prd_guid, stru
   }
 }
 
-static void writer_add_connection (struct writer *wr, struct proxy_reader *prd)
+static void writer_add_connection (struct writer *wr, struct proxy_reader *prd, int64_t crypto_handle)
 {
   struct wr_prd_match *m = ddsrt_malloc (sizeof (*m));
   ddsrt_avl_ipath_t path;
@@ -2134,6 +2164,11 @@ static void writer_add_connection (struct writer *wr, struct proxy_reader *prd)
   m->all_have_replied_to_hb = 0;
   m->non_responsive_count = 0;
   m->rexmit_requests = 0;
+#ifdef DDSI_INCLUDE_SECURITY
+  m->crypto_handle = crypto_handle;
+#else
+  DDSRT_UNUSED_ARG(crypto_handle);
+#endif
   /* m->demoted: see below */
   ddsrt_mutex_lock (&prd->e.lock);
   if (prd->deleting)
@@ -2179,6 +2214,7 @@ static void writer_add_connection (struct writer *wr, struct proxy_reader *prd)
               PGUID (wr->e.guid), PGUID (prd->e.guid), m->seq);
     ddsrt_avl_insert_ipath (&wr_readers_treedef, &wr->readers, m, &path);
     rebuild_writer_addrset (wr);
+    wr->num_readers++;
     wr->num_reliable_readers += m->is_reliable;
     ddsrt_mutex_unlock (&wr->e.lock);
 
@@ -2275,7 +2311,7 @@ static void writer_add_local_connection (struct writer *wr, struct reader *rd)
   }
 }
 
-static void reader_add_connection (struct reader *rd, struct proxy_writer *pwr, nn_count_t *init_count, const struct alive_state *alive_state)
+static void reader_add_connection (struct reader *rd, struct proxy_writer *pwr, nn_count_t *init_count, const struct alive_state *alive_state, int64_t crypto_handle)
 {
   struct rd_pwr_match *m = ddsrt_malloc (sizeof (*m));
   ddsrt_avl_ipath_t path;
@@ -2283,6 +2319,11 @@ static void reader_add_connection (struct reader *rd, struct proxy_writer *pwr,
   m->pwr_guid = pwr->e.guid;
   m->pwr_alive = alive_state->alive;
   m->pwr_alive_vclock = alive_state->vclock;
+#ifdef DDSI_INCLUDE_SECURITY
+  m->crypto_handle = crypto_handle;
+#else
+  DDSRT_UNUSED_ARG(crypto_handle);
+#endif
 
   ddsrt_mutex_lock (&rd->e.lock);
 
@@ -2307,7 +2348,9 @@ static void reader_add_connection (struct reader *rd, struct proxy_writer *pwr,
   {
     ELOGDISC (rd, "  reader_add_connection(pwr "PGUIDFMT" rd "PGUIDFMT")\n",
               PGUID (pwr->e.guid), PGUID (rd->e.guid));
+
     ddsrt_avl_insert_ipath (&rd_writers_treedef, &rd->writers, m, &path);
+    rd->num_writers++;
     ddsrt_mutex_unlock (&rd->e.lock);
 
 #ifdef DDSI_INCLUDE_SSM
@@ -2390,7 +2433,7 @@ static void reader_add_local_connection (struct reader *rd, struct writer *wr, c
   }
 }
 
-static void proxy_writer_add_connection (struct proxy_writer *pwr, struct reader *rd, nn_mtime_t tnow, nn_count_t init_count)
+static void proxy_writer_add_connection (struct proxy_writer *pwr, struct reader *rd, nn_mtime_t tnow, nn_count_t init_count, int64_t crypto_handle)
 {
   struct pwr_rd_match *m = ddsrt_malloc (sizeof (*m));
   ddsrt_avl_ipath_t path;
@@ -2428,6 +2471,12 @@ static void proxy_writer_add_connection (struct proxy_writer *pwr, struct reader
   m->last_seq = 0;
   m->filtered = 0;
 
+#ifdef DDSI_INCLUDE_SECURITY
+  m->crypto_handle = crypto_handle;
+#else
+  DDSRT_UNUSED_ARG(crypto_handle);
+#endif
+
   /* These can change as a consequence of handling data and/or
      discovery activities. The safe way of dealing with them is to
      lock the proxy writer */
@@ -2525,12 +2574,18 @@ already_matched:
 
 
 
-static void proxy_reader_add_connection (struct proxy_reader *prd, struct writer *wr)
+static void proxy_reader_add_connection (struct proxy_reader *prd, struct writer *wr, int64_t crypto_handle)
 {
   struct prd_wr_match *m = ddsrt_malloc (sizeof (*m));
   ddsrt_avl_ipath_t path;
 
   m->wr_guid = wr->e.guid;
+#ifdef DDSI_INCLUDE_SECURITY
+  m->crypto_handle = crypto_handle;
+#else
+  DDSRT_UNUSED_ARG(crypto_handle);
+#endif
+
   ddsrt_mutex_lock (&prd->e.lock);
   if (ddsrt_avl_lookup_ipath (&prd_writers_treedef, &prd->writers, &wr->e.guid, &path))
   {
@@ -2547,6 +2602,7 @@ static void proxy_reader_add_connection (struct proxy_reader *prd, struct writer
     ddsrt_avl_insert_ipath (&prd_writers_treedef, &prd->writers, m, &path);
     ddsrt_mutex_unlock (&prd->e.lock);
     qxev_prd_entityid (prd, &wr->e.guid);
+
   }
 }
 
@@ -2680,14 +2736,14 @@ static bool topickind_qos_match_p_lock (struct entity_common *rd, const dds_qos_
   return ret;
 }
 
-void connect_writer_with_proxy_reader_secure(struct writer *wr, struct proxy_reader *prd, nn_mtime_t tnow)
+void connect_writer_with_proxy_reader_secure(struct writer *wr, struct proxy_reader *prd, nn_mtime_t tnow, int64_t crypto_handle)
 {
   DDSRT_UNUSED_ARG(tnow);
-  proxy_reader_add_connection (prd, wr);
-  writer_add_connection (wr, prd);
+  proxy_reader_add_connection (prd, wr, crypto_handle);
+  writer_add_connection (wr, prd, crypto_handle);
 }
 
-void connect_reader_with_proxy_writer_secure(struct reader *rd, struct proxy_writer *pwr, nn_mtime_t tnow)
+void connect_reader_with_proxy_writer_secure(struct reader *rd, struct proxy_writer *pwr, nn_mtime_t tnow, int64_t crypto_handle)
 {
   nn_count_t init_count;
   struct alive_state alive_state;
@@ -2696,8 +2752,8 @@ void connect_reader_with_proxy_writer_secure(struct reader *rd, struct proxy_wri
      sensible, but that may be outdated by the time the reader gets added to the writer's list
      of matching readers. */
   proxy_writer_get_alive_state (pwr, &alive_state);
-  reader_add_connection (rd, pwr, &init_count,  &alive_state);
-  proxy_writer_add_connection (pwr, rd, tnow, init_count);
+  reader_add_connection (rd, pwr, &init_count,  &alive_state, crypto_handle);
+  proxy_writer_add_connection (pwr, rd, tnow, init_count, crypto_handle);
 
   /* Once everything is set up: update with the latest state, any updates to the alive state
      happening in parallel will cause this to become a no-op. */
@@ -2710,6 +2766,8 @@ static void connect_writer_with_proxy_reader (struct writer *wr, struct proxy_re
   const int isb0 = (is_builtin_entityid (wr->e.guid.entityid, NN_VENDORID_ECLIPSE) != 0);
   const int isb1 = (is_builtin_entityid (prd->e.guid.entityid, prd->c.vendor) != 0);
   dds_qos_policy_id_t reason;
+  int64_t crypto_handle;
+
   DDSRT_UNUSED_ARG(tnow);
   if (isb0 != isb1)
     return;
@@ -2726,15 +2784,15 @@ static void connect_writer_with_proxy_reader (struct writer *wr, struct proxy_re
     EELOGDISC (&wr->e, "connect_writer_with_proxy_reader (wr "PGUIDFMT") with (prd "PGUIDFMT") not allowed by security\n",
                    PGUID (wr->e.guid), PGUID (prd->e.guid));
   }
-  else if (!q_omg_security_match_remote_reader_enabled (wr, prd))
+  else if (!q_omg_security_match_remote_reader_enabled (wr, prd, &crypto_handle))
   {
     EELOGDISC (&wr->e, "connect_writer_with_proxy_reader (wr "PGUIDFMT") with (prd "PGUIDFMT") waiting for approval by security\n",
                      PGUID (wr->e.guid), PGUID (prd->e.guid));
   }
   else
   {
-    proxy_reader_add_connection (prd, wr);
-    writer_add_connection (wr, prd);
+    proxy_reader_add_connection (prd, wr, crypto_handle);
+    writer_add_connection (wr, prd, crypto_handle);
   }
 }
 
@@ -2745,6 +2803,8 @@ static void connect_proxy_writer_with_reader (struct proxy_writer *pwr, struct r
   dds_qos_policy_id_t reason;
   nn_count_t init_count;
   struct alive_state alive_state;
+  int64_t crypto_handle;
+
   if (isb0 != isb1)
     return;
   if (rd->e.onlylocal)
@@ -2760,7 +2820,7 @@ static void connect_proxy_writer_with_reader (struct proxy_writer *pwr, struct r
     EELOGDISC (&rd->e, "connect_proxy_writer_with_reader (pwr "PGUIDFMT") with (rd "PGUIDFMT") not allowed by security\n",
         PGUID (pwr->e.guid), PGUID (rd->e.guid));
   }
-  else if (!q_omg_security_match_remote_writer_enabled(rd, pwr))
+  else if (!q_omg_security_match_remote_writer_enabled(rd, pwr, &crypto_handle))
   {
     EELOGDISC (&rd->e, "connect_proxy_writer_with_reader (pwr "PGUIDFMT") with  (rd "PGUIDFMT") waiting for approval by security\n",
         PGUID (pwr->e.guid), PGUID (rd->e.guid));
@@ -2771,8 +2831,8 @@ static void connect_proxy_writer_with_reader (struct proxy_writer *pwr, struct r
        sensible, but that may be outdated by the time the reader gets added to the writer's list
        of matching readers. */
     proxy_writer_get_alive_state (pwr, &alive_state);
-    reader_add_connection (rd, pwr, &init_count, &alive_state);
-    proxy_writer_add_connection (pwr, rd, tnow, init_count);
+    reader_add_connection (rd, pwr, &init_count, &alive_state, crypto_handle);
+    proxy_writer_add_connection (pwr, rd, tnow, init_count, crypto_handle);
 
     /* Once everything is set up: update with the latest state, any updates to the alive state
        happening in parallel will cause this to become a no-op. */
@@ -3108,7 +3168,7 @@ static void update_proxy_participant_endpoint_matching (struct proxy_participant
     enum entity_kind mkind;
 
     guid.entityid = endpoint_ids[i];
-    if ((e = entidx_lookup_guid_untyped(proxypp->e.gv->entity_index, &guid)) == NULL)
+    if ((e = entidx_lookup_guid_untyped(entidx, &guid)) == NULL)
       continue;
 
     mkind = generic_do_match_mkind (e->kind, false);
@@ -3119,10 +3179,10 @@ static void update_proxy_participant_endpoint_matching (struct proxy_participant
       struct match_entities_range_key max;
       const char *tp = entity_topic_name (e);
 
-      entidx_enum_init_topic_w_prefix (&it, entidx, mkind, tp, &pp->e.guid.prefix, &max);
+      entidx_enum_init_topic(&it, entidx, mkind, tp, &max);
       while ((em = entidx_enum_next_max (&it, &max)) != NULL)
       {
-        if (&pp->e == get_entity_parent(e))
+        if (&pp->e == get_entity_parent(em))
           generic_do_match_connect (e, em, tnow, false);
       }
       entidx_enum_fini (&it);
@@ -3498,6 +3558,7 @@ static void new_writer_guid_common_init (struct writer *wr, const struct ddsi_se
   wr->retransmitting = 0;
   wr->t_rexmit_end.v = 0;
   wr->t_whc_high_upd.v = 0;
+  wr->num_readers = 0;
   wr->num_reliable_readers = 0;
   wr->num_acks_received = 0;
   wr->num_nacks_received = 0;
@@ -3511,6 +3572,9 @@ static void new_writer_guid_common_init (struct writer *wr, const struct ddsi_se
 
   wr->status_cb = status_cb;
   wr->status_cb_entity = status_entity;
+#ifdef DDSI_INCLUDE_SECURITY
+  wr->sec_attr = NULL;
+#endif
 
   /* Copy QoS, merging in defaults */
 
@@ -3646,8 +3710,7 @@ static void new_writer_guid_common_init (struct writer *wr, const struct ddsi_se
     wr->whc_low = wr->e.gv->config.whc_lowwater_mark;
     wr->whc_high = wr->e.gv->config.whc_init_highwater_mark.value;
   }
-  assert (!(wr->e.guid.entityid.u == NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_VOLATILE_SECURE_WRITER)
-          ||
+  assert (!(is_builtin_entityid(wr->e.guid.entityid, NN_VENDORID_ECLIPSE) && !is_builtin_volatile_endpoint(wr->e.guid.entityid)) ||
            (wr->whc_low == wr->whc_high && wr->whc_low == INT32_MAX));
 
   /* Connection admin */
@@ -3679,6 +3742,10 @@ static dds_return_t new_writer_guid (struct writer **wr_out, const struct ddsi_g
   endpoint_common_init (&wr->e, &wr->c, pp->e.gv, EK_WRITER, guid, group_guid, pp, onlylocal);
   new_writer_guid_common_init(wr, topic, xqos, whc, status_cb, status_entity);
 
+#ifdef DDSI_INCLUDE_SECURITY
+  q_omg_security_register_writer(wr);
+#endif
+
   /* entity_index needed for protocol handling, so add it before we send
    out our first message.  Also: needed for matching, and swapping
    the order if hash insert & matching creates a window during which
@@ -3745,6 +3812,16 @@ dds_return_t new_writer (struct writer **wr_out, struct ddsi_domaingv *gv, struc
     return DDS_RETCODE_BAD_PARAMETER;
   }
 
+#ifdef DDSI_INCLUDE_SECURITY
+  /* Check if DDS Security is enabled */
+  if (q_omg_participant_is_secure (pp))
+  {
+    /* ask to access control security plugin for create writer permissions */
+    if (!q_omg_security_check_create_writer (pp, gv->config.domainId, topic->name, xqos))
+      return DDS_RETCODE_NOT_ALLOWED_BY_SECURITY;
+  }
+#endif
+
   /* participant can't be freed while we're mucking around cos we are
      awake and do not touch the thread's vtime (entidx_lookup already
      verifies we're awake) */
@@ -3811,7 +3888,7 @@ static void gc_delete_writer (struct gcreq *gcreq)
     struct wr_prd_match *m = ddsrt_avl_root_non_empty (&wr_readers_treedef, &wr->readers);
     ddsrt_avl_delete (&wr_readers_treedef, &wr->readers, m);
     proxy_reader_drop_connection (&m->prd_guid, wr);
-    free_wr_prd_match (m);
+    free_wr_prd_match (wr->e.gv, &wr->e.guid, m);
   }
   while (!ddsrt_avl_is_empty (&wr->local_readers))
   {
@@ -3835,6 +3912,9 @@ static void gc_delete_writer (struct gcreq *gcreq)
   if (wr->status_cb)
     (wr->status_cb) (wr->status_cb_entity, NULL);
 
+#ifdef DDSI_INCLUDE_SECURITY
+  q_omg_security_deregister_writer(wr);
+#endif
 #ifdef DDSI_INCLUDE_SSM
   if (wr->ssm_as)
     unref_addrset (wr->ssm_as);
@@ -3956,6 +4036,9 @@ dds_return_t delete_writer_nolinger (struct ddsi_domaingv *gv, const struct ddsi
     return DDS_RETCODE_BAD_PARAMETER;
   }
   GVLOGDISC ("delete_writer_nolinger(guid "PGUIDFMT") ...\n", PGUID (*guid));
+#ifdef DDSI_INCLUDE_SECURITY
+  q_omg_security_deregister_writer(wr);
+#endif
   ddsrt_mutex_lock (&wr->e.lock);
   delete_writer_nolinger_locked (wr);
   ddsrt_mutex_unlock (&wr->e.lock);
@@ -4174,8 +4257,12 @@ static dds_return_t new_reader_guid
   rd->ddsi2direct_cb = 0;
   rd->ddsi2direct_cbarg = 0;
   rd->init_acknack_count = 0;
+  rd->num_writers = 0;
 #ifdef DDSI_INCLUDE_SSM
   rd->favours_ssm = 0;
+#endif
+#ifdef DDSI_INCLUDE_SECURITY
+  rd->sec_attr = NULL;
 #endif
   if (topic == NULL)
   {
@@ -4191,6 +4278,10 @@ static dds_return_t new_reader_guid
   }
   assert (rd->xqos->present & QP_LIVELINESS);
 
+#ifdef DDSI_INCLUDE_SECURITY
+  q_omg_security_register_reader(rd);
+#endif
+
 #ifdef DDSI_INCLUDE_NETWORK_PARTITIONS
   rd->as = new_addrset ();
   if (pp->e.gv->config.allowMulticast & ~AMC_SPDP)
@@ -4282,6 +4373,17 @@ dds_return_t new_reader
     GVLOGDISC ("new_reader - participant "PGUIDFMT" not found\n", PGUID (*ppguid));
     return DDS_RETCODE_BAD_PARAMETER;
   }
+
+#ifdef DDSI_INCLUDE_SECURITY
+  /* Check if DDS Security is enabled */
+  if (q_omg_participant_is_secure (pp))
+  {
+    /* ask to access control security plugin for create writer permissions */
+    if (!q_omg_security_check_create_reader (pp, gv->config.domainId, topic->name, xqos))
+      return DDS_RETCODE_NOT_ALLOWED_BY_SECURITY;
+  }
+#endif
+
   rdguid->prefix = pp->e.guid.prefix;
   kind = topic->topickind_no_key ? NN_ENTITYID_KIND_READER_NO_KEY : NN_ENTITYID_KIND_READER_WITH_KEY;
   if ((rc = pp_allocate_entityid (&rdguid->entityid, kind, pp)) < 0)
@@ -4301,7 +4403,7 @@ static void gc_delete_reader (struct gcreq *gcreq)
     struct rd_pwr_match *m = ddsrt_avl_root_non_empty (&rd_writers_treedef, &rd->writers);
     ddsrt_avl_delete (&rd_writers_treedef, &rd->writers, m);
     proxy_writer_drop_connection (&m->pwr_guid, rd);
-    free_rd_pwr_match (rd->e.gv, m);
+    free_rd_pwr_match (rd->e.gv, &rd->e.guid, m);
   }
   while (!ddsrt_avl_is_empty (&rd->local_writers))
   {
@@ -4311,6 +4413,10 @@ static void gc_delete_reader (struct gcreq *gcreq)
     free_rd_wr_match (m);
   }
 
+#ifdef DDSI_INCLUDE_SECURITY
+  q_omg_security_deregister_reader(rd);
+#endif
+
   if (!is_builtin_entityid (rd->e.guid.entityid, NN_VENDORID_ECLIPSE))
     sedp_dispose_unregister_reader (rd);
 #ifdef DDSI_INCLUDE_NETWORK_PARTITIONS
@@ -4353,6 +4459,9 @@ dds_return_t delete_reader (struct ddsi_domaingv *gv, const struct ddsi_guid *gu
   GVLOGDISC ("delete_reader_guid(guid "PGUIDFMT") ...\n", PGUID (*guid));
   builtintopic_write (rd->e.gv->builtin_topic_interface, &rd->e, now(), false);
   entidx_remove_reader_guid (gv->entity_index, rd);
+#ifdef DDSI_INCLUDE_SECURITY
+  q_omg_security_deregister_reader(rd);
+#endif
   gcreq_reader (rd);
   return 0;
 }
@@ -4639,58 +4748,34 @@ static void proxy_participant_remove_pwr_lease_locked (struct proxy_participant
 
 #ifdef DDSI_INCLUDE_SECURITY
 
-void handshake_end_cb
-(
-  struct ddsi_domaingv const * const gv,
-  struct ddsi_handshake *handshake,
-  const struct ddsi_guid *lpguid,
-  const struct ddsi_guid *ppguid,
-  enum ddsi_handshake_state result)
+void handshake_end_cb(struct ddsi_handshake *handshake, struct participant *pp, struct proxy_participant *proxypp, enum ddsi_handshake_state result)
 {
-  struct proxy_participant *proxypp;
-  struct participant *pp;
+  const struct ddsi_domaingv * const gv = pp->e.gv;
   int64_t shared_secret;
-  int64_t permissions_hdl;
-
-  assert(handshake);
-  assert(lpguid);
-  assert(ppguid);
-
-  assert(gv);
-
-  proxypp = entidx_lookup_proxy_participant_guid (gv->entity_index, ppguid);
-  if (!proxypp)
-    return;
-
-  pp = entidx_lookup_participant_guid (gv->entity_index, lpguid);
-  if (!pp)
-    return;
 
   switch(result)
   {
   case STATE_HANDSHAKE_PROCESSED:
     shared_secret = ddsi_handshake_get_shared_secret(handshake);
-    DDS_CLOG (DDS_LC_DISCOVERY, &gv->logconfig, "handshake (lguid="PGUIDFMT" rguid="PGUIDFMT") processed\n", PGUID (*lpguid), PGUID (*ppguid));
-    permissions_hdl = q_omg_security_check_remote_participant_permissions(gv->config.domainId, pp, proxypp);
-    if (permissions_hdl != 0) {
-      q_omg_security_register_remote_participant(pp, proxypp, shared_secret, permissions_hdl);
+    DDS_CLOG (DDS_LC_DISCOVERY, &gv->logconfig, "handshake (lguid="PGUIDFMT" rguid="PGUIDFMT") processed\n", PGUID (pp->e.guid), PGUID (proxypp->e.guid));
+    if (q_omg_security_register_remote_participant(pp, proxypp, shared_secret)) {
       match_volatile_secure_endpoints(pp, proxypp);
     }
     break;
 
   case STATE_HANDSHAKE_SEND_TOKENS:
-    DDS_CLOG (DDS_LC_DISCOVERY, &gv->logconfig, "handshake (lguid="PGUIDFMT" rguid="PGUIDFMT") send tokens\n", PGUID (*lpguid), PGUID (*ppguid));
+    DDS_CLOG (DDS_LC_DISCOVERY, &gv->logconfig, "handshake (lguid="PGUIDFMT" rguid="PGUIDFMT") send tokens\n", PGUID (pp->e.guid), PGUID (proxypp->e.guid));
     q_omg_security_participant_send_tokens(pp, proxypp);
     break;
 
   case STATE_HANDSHAKE_OK:
-    DDS_CLOG (DDS_LC_DISCOVERY, &gv->logconfig, "handshake (lguid="PGUIDFMT" rguid="PGUIDFMT") succeeded\n", PGUID (*lpguid), PGUID (*ppguid));
+    DDS_CLOG (DDS_LC_DISCOVERY, &gv->logconfig, "handshake (lguid="PGUIDFMT" rguid="PGUIDFMT") succeeded\n", PGUID (pp->e.guid), PGUID (proxypp->e.guid));
     update_proxy_participant_endpoint_matching(proxypp, pp);
     ddsi_handshake_remove(pp, proxypp, handshake);
     break;
 
   case STATE_HANDSHAKE_TIMED_OUT:
-    DDS_CERROR (&gv->logconfig, "handshake (lguid="PGUIDFMT" rguid="PGUIDFMT") failed: (%d) Timed out\n", PGUID (*lpguid), PGUID (*ppguid), (int)result);
+    DDS_CERROR (&gv->logconfig, "handshake (lguid="PGUIDFMT" rguid="PGUIDFMT") failed: (%d) Timed out\n", PGUID (pp->e.guid), PGUID (proxypp->e.guid), (int)result);
     if (q_omg_participant_allow_unauthenticated(pp)) {
       downgrade_to_nonsecure(proxypp);
       update_proxy_participant_endpoint_matching(proxypp, pp);
@@ -4698,7 +4783,7 @@ void handshake_end_cb
     ddsi_handshake_remove(pp, proxypp, handshake);
     break;
   case STATE_HANDSHAKE_FAILED:
-    DDS_CERROR (&gv->logconfig, "handshake (lguid="PGUIDFMT" rguid="PGUIDFMT") failed: (%d) Failed\n", PGUID (*lpguid), PGUID (*ppguid), (int)result);
+    DDS_CERROR (&gv->logconfig, "handshake (lguid="PGUIDFMT" rguid="PGUIDFMT") failed: (%d) Failed\n", PGUID (pp->e.guid), PGUID (proxypp->e.guid), (int)result);
     if (q_omg_participant_allow_unauthenticated(pp)) {
       downgrade_to_nonsecure(proxypp);
       update_proxy_participant_endpoint_matching(proxypp, pp);
@@ -4706,7 +4791,7 @@ void handshake_end_cb
     ddsi_handshake_remove(pp, proxypp, handshake);
     break;
   default:
-    DDS_CERROR (&gv->logconfig, "handshake (lguid="PGUIDFMT" rguid="PGUIDFMT") failed: (%d) Unknown failure\n", PGUID (*lpguid), PGUID (*ppguid), (int)result);
+    DDS_CERROR (&gv->logconfig, "handshake (lguid="PGUIDFMT" rguid="PGUIDFMT") failed: (%d) Unknown failure\n", PGUID (pp->e.guid), PGUID (proxypp->e.guid), (int)result);
     ddsi_handshake_remove(pp, proxypp, handshake);
     break;
   }
@@ -4729,22 +4814,37 @@ static int proxy_participant_check_security_info(struct ddsi_domaingv *gv, struc
   return r;
 }
 
-
 static void proxy_participant_create_handshakes(struct ddsi_domaingv *gv, struct proxy_participant *proxypp)
 {
   struct participant *pp;
   struct entidx_enum_participant est;
 
+  q_omg_security_remote_participant_set_initialized(proxypp);
+
   entidx_enum_participant_init (&est, gv->entity_index);
   while (((pp = entidx_enum_participant_next (&est)) != NULL)) {
-    if (q_omg_participant_is_secure(pp))
-    {
+    if (q_omg_security_participant_is_initialized(pp))
       ddsi_handshake_register(pp, proxypp, handshake_end_cb);
-    }
   }
   entidx_enum_participant_fini(&est);
 }
 
+static void disconnect_proxy_participant_secure(struct proxy_participant *proxypp)
+{
+  struct participant *pp;
+  struct entidx_enum_participant it;
+  struct ddsi_domaingv * const gv = proxypp->e.gv;
+
+  if (q_omg_proxy_participant_is_secure(proxypp))
+  {
+    entidx_enum_participant_init (&it, gv->entity_index);
+    while ((pp = entidx_enum_participant_next (&it)) != NULL)
+    {
+      ddsi_handshake_remove(pp, proxypp, NULL);
+    }
+    entidx_enum_participant_fini (&it);
+  }
+}
 #endif
 
 static void free_proxy_participant(struct proxy_participant *proxypp)
@@ -4765,6 +4865,7 @@ static void free_proxy_participant(struct proxy_participant *proxypp)
     lease_free (proxypp->lease);
   }
 #ifdef DDSI_INCLUDE_SECURITY
+  disconnect_proxy_participant_secure(proxypp);
   q_omg_security_deregister_remote_participant(proxypp);
 #endif
   unref_addrset (proxypp->as_default);
@@ -4870,7 +4971,6 @@ void new_proxy_participant (struct ddsi_domaingv *gv, const struct ddsi_guid *pp
   ddsrt_avl_init (&proxypp_groups_treedef, &proxypp->groups);
 
 #ifdef DDSI_INCLUDE_SECURITY
-  proxypp->remote_identity_handle = 0;
   proxypp->sec_attr = NULL;
   set_proxy_participant_security_info (proxypp, plist);
   if (is_secure)
@@ -4879,7 +4979,7 @@ void new_proxy_participant (struct ddsi_domaingv *gv, const struct ddsi_guid *pp
     /* check if the proxy participant has a match with a local participant */
     if (!proxy_participant_check_security_info (gv, proxypp))
     {
-      GVWARNING ("Remote secure participant "PGUIDFMT" not allowed\n", PGUID (*ppguid));
+ //     GVWARNING ("Remote secure participant "PGUIDFMT" not allowed\n", PGUID (*ppguid));
       free_proxy_participant (proxypp);
       return;
     }
@@ -4903,7 +5003,9 @@ void new_proxy_participant (struct ddsi_domaingv *gv, const struct ddsi_guid *pp
 
 #ifdef DDSI_INCLUDE_SECURITY
   if (is_secure)
+  {
     proxy_participant_create_handshakes (gv, proxypp);
+  }
 #endif
 }
 
@@ -5399,7 +5501,10 @@ int new_proxy_writer (struct ddsi_domaingv *gv, const struct ddsi_guid *ppguid,
   pwr->ddsi2direct_cb = 0;
   pwr->ddsi2direct_cbarg = 0;
 
+#ifdef DDSI_INCLUDE_SECURITY
   set_proxy_writer_security_info(pwr, plist);
+  q_omg_get_proxy_writer_security_info(pwr, plist, &(pwr->security_info));
+#endif
 
   local_reader_ary_init (&pwr->rdary);
 
@@ -5678,11 +5783,14 @@ int new_proxy_reader (struct ddsi_domaingv *gv, const struct ddsi_guid *ppguid,
 #endif
   prd->is_fict_trans_reader = 0;
 
+#ifdef DDSI_INCLUDE_SECURITY
   set_proxy_reader_security_info(prd, plist);
+#endif
 
   ddsrt_avl_init (&prd_writers_treedef, &prd->writers);
 
 #ifdef DDSI_INCLUDE_SECURITY
+  q_omg_get_proxy_reader_security_info(prd, plist, &(prd->security_info));
   if (prd->e.guid.entityid.u == NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_VOLATILE_SECURE_READER)
     prd->filter = volatile_secure_data_filter;
   else
@@ -5762,7 +5870,6 @@ static void gc_delete_proxy_reader (struct gcreq *gcreq)
     writer_drop_connection (&m->wr_guid, prd);
     free_prd_wr_match (m);
   }
-
   proxy_endpoint_common_fini (&prd->e, &prd->c);
   ddsrt_free (prd);
 }
diff --git a/src/core/ddsi/src/q_init.c b/src/core/ddsi/src/q_init.c
index a140b33..ed8e8e2 100644
--- a/src/core/ddsi/src/q_init.c
+++ b/src/core/ddsi/src/q_init.c
@@ -57,6 +57,7 @@
 #include "dds/ddsi/ddsi_raweth.h"
 #include "dds/ddsi/ddsi_mcgroup.h"
 #include "dds/ddsi/ddsi_serdata_default.h"
+#include "dds/ddsi/ddsi_security_omg.h"
 
 #include "dds/ddsi/ddsi_tkmap.h"
 #include "dds__whc.h"
@@ -1131,7 +1132,7 @@ int rtps_init (struct ddsi_domaingv *gv)
   add_property_to_xqos(&gv->builtin_volatile_xqos_rd, "dds.sec.builtin_endpoint_name", "BuiltinParticipantVolatileMessageSecureReader");
   add_property_to_xqos(&gv->builtin_volatile_xqos_wr, "dds.sec.builtin_endpoint_name", "BuiltinParticipantVolatileMessageSecureWriter");
 
-  q_omg_security_init( &gv->security_context, &gv->logconfig );
+  q_omg_security_init(gv);
 #endif
 
   ddsrt_mutex_init (&gv->sertopics_lock);
@@ -1482,7 +1483,7 @@ err_unicast_sockets:
   ddsi_xqos_fini (&gv->builtin_volatile_xqos_wr);
   ddsi_xqos_fini (&gv->builtin_volatile_xqos_rd);
 
-  q_omg_security_deinit( &gv->security_context );
+  q_omg_security_deinit (gv);
 #endif
   ddsi_xqos_fini (&gv->builtin_endpoint_xqos_wr);
   ddsi_xqos_fini (&gv->builtin_endpoint_xqos_rd);
@@ -1838,7 +1839,7 @@ void rtps_fini (struct ddsi_domaingv *gv)
   ddsi_xqos_fini (&gv->builtin_volatile_xqos_wr);
   ddsi_xqos_fini (&gv->builtin_volatile_xqos_rd);
 
-  q_omg_security_deinit( &gv->security_context);
+  q_omg_security_deinit (gv);
 #endif
   ddsi_xqos_fini (&gv->builtin_endpoint_xqos_wr);
   ddsi_xqos_fini (&gv->builtin_endpoint_xqos_rd);
diff --git a/src/core/ddsi/src/q_misc.c b/src/core/ddsi/src/q_misc.c
index 06a6a2c..dac4cbe 100644
--- a/src/core/ddsi/src/q_misc.c
+++ b/src/core/ddsi/src/q_misc.c
@@ -42,6 +42,11 @@ int WildcardOverlap(char * p1, char * p2)
 }
 #endif
 
+bool guid_prefix_zero (const ddsi_guid_prefix_t *a)
+{
+  return a->u[0] == 0 && a->u[1] == 0 && a->u[2] == 0;
+}
+
 int guid_prefix_eq (const ddsi_guid_prefix_t *a, const ddsi_guid_prefix_t *b)
 {
   return a->u[0] == b->u[0] && a->u[1] == b->u[1] && a->u[2] == b->u[2];
diff --git a/src/core/ddsi/src/q_receive.c b/src/core/ddsi/src/q_receive.c
index 7cc6f7b..640436b 100644
--- a/src/core/ddsi/src/q_receive.c
+++ b/src/core/ddsi/src/q_receive.c
@@ -80,11 +80,6 @@ static void deliver_user_data_synchronously (struct nn_rsample_chain *sc, const
 
 static void maybe_set_reader_in_sync (struct proxy_writer *pwr, struct pwr_rd_match *wn, seqno_t last_deliv_seq)
 {
-  if (wn->filtered)
-  {
-    wn->in_sync = PRMSS_OUT_OF_SYNC;
-    return;
-  }
   switch (wn->in_sync)
   {
     case PRMSS_SYNC:
@@ -99,12 +94,15 @@ static void maybe_set_reader_in_sync (struct proxy_writer *pwr, struct pwr_rd_ma
       }
       break;
     case PRMSS_OUT_OF_SYNC:
-      assert (nn_reorder_next_seq (wn->u.not_in_sync.reorder) <= nn_reorder_next_seq (pwr->reorder));
-      if (pwr->have_seen_heartbeat && nn_reorder_next_seq (wn->u.not_in_sync.reorder) == nn_reorder_next_seq (pwr->reorder))
+      if (!wn->filtered)
       {
-        ETRACE (pwr, " msr_in_sync("PGUIDFMT" out-of-sync to tlcatchup)", PGUID (wn->rd_guid));
-        wn->in_sync = PRMSS_TLCATCHUP;
-        maybe_set_reader_in_sync (pwr, wn, last_deliv_seq);
+        assert (nn_reorder_next_seq (wn->u.not_in_sync.reorder) <= nn_reorder_next_seq (pwr->reorder));
+        if (pwr->have_seen_heartbeat && nn_reorder_next_seq (wn->u.not_in_sync.reorder) == nn_reorder_next_seq (pwr->reorder))
+        {
+          ETRACE (pwr, " msr_in_sync("PGUIDFMT" out-of-sync to tlcatchup)", PGUID (wn->rd_guid));
+          wn->in_sync = PRMSS_TLCATCHUP;
+          maybe_set_reader_in_sync (pwr, wn, last_deliv_seq);
+        }
       }
       break;
   }
@@ -1929,6 +1927,12 @@ static struct ddsi_serdata *remote_make_sample (struct ddsi_tkmap_instance **tk,
       failmsg = "no content";
     else if (!(qos->present & PP_KEYHASH))
       failmsg = "qos present but without keyhash";
+    else if (q_omg_plist_keyhash_is_protected(qos))
+    {
+      /* If the keyhash is protected, then it is forced to be an actual MD5
+       * hash. This means the keyhash can't be decoded into a sample. */
+      failmsg = "keyhash is protected";
+    }
     else if ((sample = ddsi_serdata_from_keyhash (topic, &qos->keyhash)) == NULL)
       failmsg = "keyhash is MD5 and can't be converted to key value";
     else
@@ -3018,7 +3022,7 @@ static int handle_submsg_sequence
       case SMID_SEC_PREFIX:
         state = "parse:sec_prefix";
         {
-          GVTRACE ("SEC_PREFIX");
+          GVTRACE ("SEC_PREFIX ");
           if (!decode_SecPrefix(rst, submsg, submsg_size, end, &rst->src_guid_prefix, &rst->dst_guid_prefix, byteswap))
             goto malformed;
         }
diff --git a/src/core/ddsi/src/q_transmit.c b/src/core/ddsi/src/q_transmit.c
index 063d2a1..cdc7485 100644
--- a/src/core/ddsi/src/q_transmit.c
+++ b/src/core/ddsi/src/q_transmit.c
@@ -867,7 +867,7 @@ static void transmit_sample_unlocks_wr (struct nn_xpack *xp, struct writer *wr,
   assert((wr->heartbeat_xevent != NULL) == (whcst != NULL));
 
   sz = ddsi_serdata_size (serdata);
-  if (sz > gv->config.fragment_size || !isnew || plist != NULL || prd != NULL)
+  if (sz > gv->config.fragment_size || !isnew || plist != NULL || prd != NULL || q_omg_writer_is_submessage_protected(wr))
   {
     uint32_t nfrags;
     ddsrt_mutex_unlock (&wr->e.lock);
diff --git a/src/core/ddsi/src/q_xevent.c b/src/core/ddsi/src/q_xevent.c
index 41b91a7..3b3e22a 100644
--- a/src/core/ddsi/src/q_xevent.c
+++ b/src/core/ddsi/src/q_xevent.c
@@ -104,7 +104,8 @@ enum xeventkind_nt
 {
   XEVK_MSG,
   XEVK_MSG_REXMIT,
-  XEVK_ENTITYID
+  XEVK_ENTITYID,
+  XEVK_NT_CALLBACK
 };
 
 struct untimed_listelem {
@@ -131,6 +132,10 @@ struct xevent_nt
       /* xmsg is self-contained / relies on reference counts */
       struct nn_xmsg *msg;
     } entityid;
+    struct {
+      void (*cb) (void *arg);
+      void *arg;
+    } callback;
   } u;
 };
 
@@ -972,12 +977,16 @@ static void handle_xevk_acknack (struct nn_xpack *xp, struct xevent *ev, nn_mtim
 
   if (addrset_any_uc (pwr->c.as, &loc) || addrset_any_mc (pwr->c.as, &loc))
   {
+    struct participant *pp = NULL;
     seqno_t nack_seq;
 
-    struct participant *pp = NULL;
-    struct reader *rd = entidx_lookup_reader_guid(pwr->e.gv->entity_index, &ev->u.acknack.rd_guid);
-    if (rd)
-      pp = rd->c.pp;
+    if (q_omg_proxy_participant_is_secure(pwr->c.proxypp))
+    {
+      struct reader *rd = entidx_lookup_reader_guid(pwr->e.gv->entity_index, &ev->u.acknack.rd_guid);
+
+      if (rd)
+        pp = rd->c.pp;
+    }
 
     if ((msg = nn_xmsg_new (gv->xmsgpool, &ev->u.acknack.rd_guid, pp, ACKNACK_SIZE_MAX, NN_XMSG_KIND_CONTROL)) == NULL)
       goto outofmem;
@@ -1303,6 +1312,9 @@ static void handle_individual_xevent_nt (struct xevent_nt *xev, struct nn_xpack
     case XEVK_ENTITYID:
       handle_xevk_entityid (xp, xev);
       break;
+    case XEVK_NT_CALLBACK:
+      xev->u.callback.cb (xev->u.callback.arg);
+      break;
   }
   ddsrt_free (xev);
 }
@@ -1459,6 +1471,18 @@ void qxev_msg (struct xeventq *evq, struct nn_xmsg *msg)
   ddsrt_mutex_unlock (&evq->lock);
 }
 
+void qxev_nt_callback (struct xeventq *evq, void (*cb) (void *arg), void *arg)
+{
+  struct xevent_nt *ev;
+  assert (evq);
+  ddsrt_mutex_lock (&evq->lock);
+  ev = qxev_common_nt (evq, XEVK_NT_CALLBACK);
+  ev->u.callback.cb = cb;
+  ev->u.callback.arg = arg;
+  qxev_insert_nt (ev);
+  ddsrt_mutex_unlock (&evq->lock);
+}
+
 void qxev_prd_entityid (struct proxy_reader *prd, const ddsi_guid_t *guid)
 {
   struct ddsi_domaingv * const gv = prd->e.gv;
diff --git a/src/core/ddsi/src/q_xmsg.c b/src/core/ddsi/src/q_xmsg.c
index 695c47d..93a70a2 100644
--- a/src/core/ddsi/src/q_xmsg.c
+++ b/src/core/ddsi/src/q_xmsg.c
@@ -920,22 +920,31 @@ void nn_xmsg_setwriterseq_fragid (struct nn_xmsg *msg, const ddsi_guid_t *wrguid
   msg->kindspecific.data.wrfragid = wrfragid;
 }
 
-void *nn_xmsg_addpar (struct nn_xmsg *m, nn_parameterid_t pid, size_t len)
+void *nn_xmsg_addpar_bo (struct nn_xmsg *m, nn_parameterid_t pid, size_t len, bool be)
 {
+#define BO2U(x)  (be ? ddsrt_toBE2u((x)) : (x))
+
   const size_t len4 = (len + 3) & ~(size_t)3; /* must alloc a multiple of 4 */
   nn_parameter_t *phdr;
   char *p;
   assert (len4 < UINT16_MAX); /* FIXME: return error */
   m->have_params = 1;
   phdr = nn_xmsg_append (m, NULL, sizeof (nn_parameter_t) + len4);
-  phdr->parameterid = pid;
-  phdr->length = (uint16_t) len4;
+  phdr->parameterid = BO2U(pid);
+  phdr->length = BO2U((uint16_t) len4);
   p = (char *) (phdr + 1);
   /* zero out padding bytes added to satisfy parameter alignment: this way
      valgrind can tell us where we forgot to initialize something */
   while (len < len4)
     p[len++] = 0;
   return p;
+
+#undef BO2U
+}
+
+void *nn_xmsg_addpar (struct nn_xmsg *m, nn_parameterid_t pid, size_t len)
+{
+  return nn_xmsg_addpar_bo(m, pid, len, false);
 }
 
 void nn_xmsg_addpar_keyhash (struct nn_xmsg *m, const struct ddsi_serdata *serdata, bool force_md5)
@@ -974,6 +983,11 @@ void nn_xmsg_addpar_sentinel (struct nn_xmsg * m)
   nn_xmsg_addpar (m, PID_SENTINEL, 0);
 }
 
+void nn_xmsg_addpar_sentinel_bo (struct nn_xmsg * m, bool be)
+{
+  nn_xmsg_addpar_bo (m, PID_SENTINEL, 0, be);
+}
+
 int nn_xmsg_addpar_sentinel_ifparam (struct nn_xmsg * m)
 {
   if (m->have_params)
@@ -1188,6 +1202,7 @@ static ssize_t nn_xpack_send_rtps(struct nn_xpack * xp, const nn_locator_t *loc)
   if (xp->sec_info.use_rtps_encoding)
   {
     ret = secure_conn_write(
+                      xp->gv,
                       xp->conn,
                       loc,
                       xp->niov,
diff --git a/src/security/builtin_plugins/access_control/src/access_control_parser.c b/src/security/builtin_plugins/access_control/src/access_control_parser.c
index fbf106c..efd72ef 100644
--- a/src/security/builtin_plugins/access_control/src/access_control_parser.c
+++ b/src/security/builtin_plugins/access_control/src/access_control_parser.c
@@ -958,8 +958,10 @@ static int permissions_element_open_cb(void *varg, uintptr_t parentinfo, uintptr
   {
     parser->current = new_element(ELEMENT_KIND_IGNORED, parser->current, sizeof(struct element));
     /*if this is the first element in the IGNORED branch, then give warning for the user*/
+#if 0
     if (parser->current->parent->kind != ELEMENT_KIND_IGNORED)
       printf("Warning: Unsupported element \"%s\" has been ignored in permissions file.\n", name);
+#endif
   }
   else
   {
diff --git a/src/security/builtin_plugins/authentication/src/auth_utils.c b/src/security/builtin_plugins/authentication/src/auth_utils.c
index 54b2224..d2ec77a 100644
--- a/src/security/builtin_plugins/authentication/src/auth_utils.c
+++ b/src/security/builtin_plugins/authentication/src/auth_utils.c
@@ -1225,7 +1225,8 @@ get_trusted_ca_list ( const char* trusted_ca_dir,
                         if( loading_result == DDS_SECURITY_VALIDATION_OK ){
                             ca_buffer_array[ca_buffer_array_size] = identityCA;
                             ca_buffer_array_size++;
-
+                        } else {
+                          DDS_Security_Exception_reset(ex);
                         }
                     }
                 }
diff --git a/src/security/builtin_plugins/authentication/src/authentication.c b/src/security/builtin_plugins/authentication/src/authentication.c
index 09d3425..63f4a60 100644
--- a/src/security/builtin_plugins/authentication/src/authentication.c
+++ b/src/security/builtin_plugins/authentication/src/authentication.c
@@ -21,7 +21,6 @@
 #include <openssl/evp.h>
 #include "authentication.h"
 #include "dds/ddsrt/heap.h"
-#include "dds/ddsrt/avl.h"
 #include "dds/security/dds_security_api.h"
 #include "dds/security/core/dds_security_timed_cb.h"
 
@@ -120,8 +119,8 @@ typedef enum {
 typedef enum {
   CREATEDREQUEST,
   CREATEDREPLY
-} CreatedHandshakeStep_t;
 
+} CreatedHandshakeStep_t;
 
 typedef struct SecurityObject SecurityObject;
 
@@ -130,6 +129,7 @@ typedef void (*SecurityObjectDestructor)(SecurityObject *obj);
 struct SecurityObject {
     int64_t handle;
     SecurityObjectKind_t kind;
+    SecurityObjectDestructor destructor;
 };
 
 
@@ -146,35 +146,6 @@ struct SecurityObject {
 
 #define SECURITY_OBJECT_VALID(o,k)    security_object_valid((SecurityObject *)(o), k)
 
-struct LocalIdentityInfo;
-struct HandshakeInfo;
-
-typedef struct RemoteIdentityInfo {
-    SecurityObject _parent;
-    uint32_t refc;
-    DDS_Security_GUID_t guid;
-    X509 *identityCert;
-    AuthenticationAlgoKind_t dsignAlgoKind;
-    AuthenticationAlgoKind_t kagreeAlgoKind;
-    DDS_Security_IdentityToken *remoteIdentityToken;
-    DDS_Security_OctetSeq pdata;
-    char *permissionsDocument;
-} RemoteIdentityInfo;
-
-/* This structure contains the relation between a local and a remote identity
- * The handle for this object is the same as the handle of the associated
- * local identity object. The IdentityRelation object will be stored with the
- * remote identity.
- */
-typedef struct IdentityRelation {
-    SecurityObject _parent;
-    ddsrt_avl_node_t avlnode;
-    struct LocalIdentityInfo *localIdentity;
-    struct RemoteIdentityInfo *remoteIdentity;
-    AuthenticationChallenge *lchallenge;
-    AuthenticationChallenge *rchallenge;
-    struct HandshakeInfo *handshake;
-} IdentityRelation;
 
 typedef struct LocalIdentityInfo {
     SecurityObject _parent;
@@ -188,12 +159,36 @@ typedef struct LocalIdentityInfo {
     AuthenticationAlgoKind_t dsignAlgoKind;
     AuthenticationAlgoKind_t kagreeAlgoKind;
     char *permissionsDocument;
-    ddsrt_avl_tree_t relations; /* contains the IdentityRelation objects */
 } LocalIdentityInfo;
 
+typedef struct RemoteIdentityInfo {
+    SecurityObject _parent;
+    DDS_Security_GUID_t guid;
+    X509 *identityCert;
+    AuthenticationAlgoKind_t dsignAlgoKind;
+    AuthenticationAlgoKind_t kagreeAlgoKind;
+    DDS_Security_IdentityToken *remoteIdentityToken;
+    DDS_Security_OctetSeq pdata;
+    char *permissionsDocument;
+    struct ddsrt_hh *linkHash; /* contains the IdentityRelation objects */
+} RemoteIdentityInfo;
+
+
+/* This structure contains the relation between a local and a remote identity
+ * The handle for this object is the same as the handle of the associated
+ * local identity object. The IdentityRelation object will be stored with the
+ * remote identity.
+ */
+typedef struct IdentityRelation {
+    SecurityObject _parent;
+    LocalIdentityInfo *localIdentity;
+    RemoteIdentityInfo *remoteIdentity;
+    AuthenticationChallenge *lchallenge;
+    AuthenticationChallenge *rchallenge;
+} IdentityRelation;
+
 typedef struct HandshakeInfo {
     SecurityObject _parent;
-    ddsrt_avl_node_t avlnode;
     IdentityRelation *relation;
     HashValue_t hash_c1;
     HashValue_t hash_c2;
@@ -208,7 +203,6 @@ typedef struct dds_security_authentication_impl {
     ddsrt_mutex_t lock;
     struct ddsrt_hh *objectHash;
     struct ddsrt_hh *remoteGuidHash;
-    struct ddsrt_hh *handshakes;
     struct dds_security_timed_cb_data *timed_callbacks;
     struct dds_security_timed_dispatcher_t *dispatcher;
     X509Seq trustedCAList;
@@ -221,11 +215,6 @@ typedef struct {
 } validity_cb_info;
 
 
-static int compare_relation (const void *va, const void *vb);
-
-const ddsrt_avl_treedef_t relations_treedef =
-    DDSRT_AVL_TREEDEF_INITIALIZER_INDKEY (offsetof (struct IdentityRelation, avlnode), offsetof (struct IdentityRelation, remoteIdentity), compare_relation, 0);
-
 static bool
 security_object_valid(
     SecurityObject *obj,
@@ -233,7 +222,14 @@ security_object_valid(
 {
     if (!obj) return false;
     if (obj->kind != kind) return false;
-    if ((uintptr_t)obj->handle != (uintptr_t)obj) return false;
+    if (kind == SECURITY_OBJECT_KIND_IDENTITY_RELATION) {
+        IdentityRelation *relation = (IdentityRelation *)obj;
+        if (!relation->localIdentity || !relation->remoteIdentity || (ddsrt_address)obj->handle != (ddsrt_address)relation->localIdentity) {
+            return false;
+        }
+    } else if ((ddsrt_address)obj->handle != (ddsrt_address)obj) {
+        return false;
+    }
     return true;
 }
 
@@ -269,31 +265,20 @@ security_object_find(
 
     template.handle = handle;
 
-    return (SecurityObject *) ddsrt_hh_lookup(hh, &template);
-}
-
-static int compare_relation (const void *va, const void *vb)
-{
-    const struct RemoteIdentityInfo * ha = va;
-    const struct RemoteIdentityInfo * hb = vb;
-
-    if (IDENTITY_HANDLE(ha) < IDENTITY_HANDLE(hb)) {
-        return -1;
-    } else if (IDENTITY_HANDLE(ha) > IDENTITY_HANDLE(hb)) {
-        return 1;
-    }
-   return 0;
+    return (SecurityObject *) ddsrt_hh_lookup(hh, &template);;
 }
 
 static void
 security_object_init(
     SecurityObject *obj,
-    SecurityObjectKind_t kind)
+    SecurityObjectKind_t kind,
+    SecurityObjectDestructor destructor)
 {
     assert(obj);
 
     obj->kind = kind;
-    obj->handle = (int64_t)(uintptr_t)obj;
+    obj->handle = (int64_t)(ddsrt_address)obj;
+    obj->destructor = destructor;
 }
 
 static void
@@ -304,8 +289,25 @@ security_object_deinit(
     assert(obj);
     obj->handle = DDS_SECURITY_HANDLE_NIL;
     obj->kind = SECURITY_OBJECT_KIND_UNKNOWN;
+    obj->destructor = NULL;
 }
 
+static void
+security_object_free(
+    SecurityObject *obj)
+{
+    assert(obj);
+    if (obj && obj->destructor) {
+        obj->destructor(obj);
+    }
+}
+
+static void
+localIdentityInfoFree(
+    SecurityObject *obj);
+
+
+
 static LocalIdentityInfo *
 localIdentityInfoNew(
         DDS_Security_DomainId domainId,
@@ -327,7 +329,10 @@ localIdentityInfoNew(
     identity = ddsrt_malloc(sizeof(*identity));
     memset(identity, 0, sizeof(*identity));
 
-    security_object_init((SecurityObject *)identity, SECURITY_OBJECT_KIND_LOCAL_IDENTITY);
+    security_object_init((SecurityObject *)identity, SECURITY_OBJECT_KIND_LOCAL_IDENTITY, localIdentityInfoFree);
+
+
+
 
     identity->domainId = domainId;
     identity->identityCert = identityCert;
@@ -340,33 +345,31 @@ localIdentityInfoNew(
     memcpy(&identity->candidateGUID, candidate_participant_guid, sizeof(DDS_Security_GUID_t));
     memcpy(&identity->adjustedGUID, adjusted_participant_guid, sizeof(DDS_Security_GUID_t));
 
-    ddsrt_avl_init(&relations_treedef, &identity->relations);
-
     return identity;
 }
 
 static void
 localIdentityInfoFree(
-    LocalIdentityInfo *info)
+    SecurityObject *obj)
 {
-    CHECK_OBJECT_KIND(info, SECURITY_OBJECT_KIND_LOCAL_IDENTITY);
+    LocalIdentityInfo *identity = (LocalIdentityInfo *)obj;
 
-    if (info) {
-        assert(ddsrt_avl_is_empty(&info->relations));
-        ddsrt_avl_free(&relations_treedef, &info->relations, NULL);
-        if (info->identityCert) {
-            X509_free(info->identityCert);
+    CHECK_OBJECT_KIND(obj, SECURITY_OBJECT_KIND_LOCAL_IDENTITY);
+
+    if (identity) {
+        if (identity->identityCert) {
+            X509_free(identity->identityCert);
         }
-        if (info->identityCA) {
-            X509_free(info->identityCA);
+        if (identity->identityCA) {
+            X509_free(identity->identityCA);
         }
-        if (info->privateKey) {
-            EVP_PKEY_free(info->privateKey);
+        if (identity->privateKey) {
+            EVP_PKEY_free(identity->privateKey);
         }
-        ddsrt_free(info->pdata._buffer);
-        ddsrt_free(info->permissionsDocument);
-        security_object_deinit((SecurityObject *)info);
-        ddsrt_free(info);
+        ddsrt_free(identity->pdata._buffer);
+        ddsrt_free(identity->permissionsDocument);
+        security_object_deinit((SecurityObject *)identity);
+        ddsrt_free(identity);
     }
 }
 
@@ -405,6 +408,10 @@ find_remote_identity_by_guid(
     return (RemoteIdentityInfo *) ddsrt_hh_lookup(hh, &template);
 }
 
+static void
+remoteIdentityInfoFree(
+    SecurityObject *obj);
+
 static RemoteIdentityInfo *
 remoteIdentityInfoNew(
         const DDS_Security_GUID_t *guid,
@@ -418,39 +425,47 @@ remoteIdentityInfoNew(
     identity = ddsrt_malloc(sizeof(*identity));
     memset(identity, 0, sizeof(*identity));
 
-    security_object_init((SecurityObject *)identity, SECURITY_OBJECT_KIND_REMOTE_IDENTITY);
+    security_object_init((SecurityObject *)identity, SECURITY_OBJECT_KIND_REMOTE_IDENTITY, remoteIdentityInfoFree);
 
     memcpy(&identity->guid, guid, sizeof(DDS_Security_GUID_t));
-    identity->refc = 0;
     identity->remoteIdentityToken = DDS_Security_DataHolder_alloc();
     DDS_Security_DataHolder_copy(identity->remoteIdentityToken, remote_identity_token);
     identity->identityCert = NULL;
     identity->dsignAlgoKind = AUTH_ALGO_KIND_UNKNOWN;
     identity->kagreeAlgoKind = AUTH_ALGO_KIND_UNKNOWN;
     identity->permissionsDocument = ddsrt_strdup("");
+    identity->linkHash = ddsrt_hh_new(32, security_object_hash, security_object_equal);
 
     return identity;
 }
 
 static void
 remoteIdentityInfoFree(
-    RemoteIdentityInfo *info)
+    SecurityObject *obj)
 {
-    CHECK_OBJECT_KIND(info, SECURITY_OBJECT_KIND_REMOTE_IDENTITY);
+    RemoteIdentityInfo *identity = (RemoteIdentityInfo *)obj;
 
-    if (info) {
-        assert(info->refc == 0);
-        if (info->identityCert) {
-            X509_free(info->identityCert);
+    CHECK_OBJECT_KIND(obj, SECURITY_OBJECT_KIND_REMOTE_IDENTITY);
+
+    if (identity) {
+        if (identity->identityCert) {
+            X509_free(identity->identityCert);
         }
-        DDS_Security_DataHolder_free(info->remoteIdentityToken);
-        ddsrt_free(info->pdata._buffer);
-        ddsrt_free(info->permissionsDocument);
-        security_object_deinit((SecurityObject *)info);
-        ddsrt_free(info);
+        DDS_Security_DataHolder_free(identity->remoteIdentityToken);
+
+        ddsrt_hh_free(identity->linkHash);
+
+        ddsrt_free(identity->pdata._buffer);
+        ddsrt_free(identity->permissionsDocument);
+        security_object_deinit((SecurityObject *)identity);
+        ddsrt_free(identity);
     }
 }
 
+static void
+identityRelationFree(
+    SecurityObject *obj);
+
 /* The IdentityRelation provides the association between a local and a remote
  * identity. This object manages the challenges which are created for
  * each association between a local and a remote identity.
@@ -474,23 +489,24 @@ identityRelationNew(
     relation = ddsrt_malloc(sizeof(*relation));
     memset(relation, 0, sizeof(*relation));
 
-    security_object_init((SecurityObject *)relation, SECURITY_OBJECT_KIND_IDENTITY_RELATION);
+    security_object_init((SecurityObject *)relation, SECURITY_OBJECT_KIND_IDENTITY_RELATION, identityRelationFree);
+    relation->_parent.handle = SECURITY_OBJECT_HANDLE(localIdentity);
 
     relation->localIdentity = localIdentity;
     relation->remoteIdentity = remoteIdentity;
-    remoteIdentity->refc++;
     relation->lchallenge = lchallenge;
     relation->rchallenge = rchallenge;
-    relation->handshake = NULL;
 
     return relation;
 }
 
 static void
 identityRelationFree(
-    IdentityRelation *relation)
+    SecurityObject *obj)
 {
-    CHECK_OBJECT_KIND(relation, SECURITY_OBJECT_KIND_IDENTITY_RELATION);
+    IdentityRelation *relation = (IdentityRelation *)obj;
+
+    CHECK_OBJECT_KIND(obj, SECURITY_OBJECT_KIND_IDENTITY_RELATION);
 
     if (relation) {
         ddsrt_free(relation->lchallenge);
@@ -500,16 +516,27 @@ identityRelationFree(
     }
 }
 
+static void
+handshakeInfoFree(
+    SecurityObject *obj);
+
 static HandshakeInfo *
 handshakeInfoNew(
+    LocalIdentityInfo *localIdentity,
+    RemoteIdentityInfo *remoteIdentity,
     IdentityRelation *relation)
 {
     HandshakeInfo *handshake;
 
+    assert(localIdentity);
+    assert(remoteIdentity);
+
+    DDSRT_UNUSED_ARG(localIdentity);
+    DDSRT_UNUSED_ARG(remoteIdentity);
     handshake = ddsrt_malloc(sizeof(*handshake));
     memset(handshake, 0, sizeof(*handshake));
 
-    security_object_init((SecurityObject *)handshake, SECURITY_OBJECT_KIND_HANDSHAKE);
+    security_object_init((SecurityObject *)handshake, SECURITY_OBJECT_KIND_HANDSHAKE, handshakeInfoFree);
 
     handshake->relation = relation;
     handshake->shared_secret_handle_impl = NULL;
@@ -519,14 +546,13 @@ handshakeInfoNew(
 
 static void
 handshakeInfoFree(
-    HandshakeInfo *handshake)
+    SecurityObject *obj)
 {
-    CHECK_OBJECT_KIND(handshake, SECURITY_OBJECT_KIND_HANDSHAKE);
+    HandshakeInfo *handshake = (HandshakeInfo *)obj;
+
+    CHECK_OBJECT_KIND(obj, SECURITY_OBJECT_KIND_HANDSHAKE);
 
     if (handshake) {
-        assert(handshake->relation && handshake->relation->handshake == handshake);
-        handshake->relation->handshake = NULL;
-
         if (handshake->ldh) {
             EVP_PKEY_free(handshake->ldh);
         }
@@ -542,6 +568,48 @@ handshakeInfoFree(
     }
 }
 
+static IdentityRelation *
+find_identity_relation(
+    const RemoteIdentityInfo *remote,
+    int64_t lid)
+{
+    return (IdentityRelation *)security_object_find(remote->linkHash, lid);
+}
+
+static void
+remove_identity_relation(
+    RemoteIdentityInfo *remote,
+    IdentityRelation *relation)
+{
+    (void)ddsrt_hh_remove(remote->linkHash, relation);
+    security_object_free((SecurityObject *) relation);
+}
+
+static HandshakeInfo *
+find_handshake(
+    const dds_security_authentication_impl *auth,
+    int64_t localId,
+    int64_t remoteId)
+{
+    struct ddsrt_hh_iter it;
+    SecurityObject *obj;
+    IdentityRelation *relation;
+    HandshakeInfo *found = NULL;
+
+    for (obj = ddsrt_hh_iter_first(auth->objectHash, &it); obj && !found; obj = ddsrt_hh_iter_next(&it)) {
+        if (obj->kind == SECURITY_OBJECT_KIND_HANDSHAKE) {
+            relation = ((HandshakeInfo *)obj)->relation;
+            assert(relation);
+            if ((SECURITY_OBJECT_HANDLE(relation->localIdentity) == localId) &&
+                (SECURITY_OBJECT_HANDLE(relation->remoteIdentity) == remoteId)) {
+                found = (HandshakeInfo *)obj;
+            }
+        }
+    }
+
+    return found;
+}
+
 static char *
 get_authentication_class_id(
     void)
@@ -1287,6 +1355,8 @@ fill_auth_request_token(
     token->binary_properties._buffer->value._length = len;
     token->binary_properties._buffer->value._buffer = ddsrt_malloc(len);
     memcpy(token->binary_properties._buffer->value._buffer, challenge->value, len);
+    token->binary_properties._buffer->propagate = true;
+
 }
 
 DDS_Security_ValidationResult_t
@@ -1303,10 +1373,11 @@ validate_remote_identity(
     DDS_Security_ValidationResult_t result = DDS_SECURITY_VALIDATION_OK;
     dds_security_authentication_impl *impl = (dds_security_authentication_impl *) instance;
     SecurityObject *obj;
-    LocalIdentityInfo *linfo;
-    RemoteIdentityInfo *rinfo;
-    IdentityRelation *relation = NULL;
+    LocalIdentityInfo *localIdent;
+    RemoteIdentityInfo *remoteIdent;
+    IdentityRelation *relation;
     AuthenticationChallenge *lchallenge = NULL, *rchallenge = NULL;
+    int r;
 
     /* validate provided arguments */
     if (!instance || !remote_identity_handle || !local_auth_request_token || !remote_identity_token || !remote_participant_guid) {
@@ -1321,10 +1392,10 @@ validate_remote_identity(
         DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "validate_remote_identity: Invalid handle provided");
         goto err_inv_handle;
     }
-    linfo = (LocalIdentityInfo *) obj;
+    localIdent = (LocalIdentityInfo *) obj;
 
     /* Check if the provided remote_identity_token is compatible */
-    result = validate_remote_identity_token(linfo, remote_identity_token, ex);
+    result = validate_remote_identity_token(localIdent, remote_identity_token, ex);
     if (result != DDS_SECURITY_VALIDATION_OK) {
         goto err_remote_identity_token;
     }
@@ -1349,29 +1420,30 @@ validate_remote_identity(
      */
 
     /* Check if the remote identity has already been validated by a previous validation request. */
-    rinfo = find_remote_identity_by_guid(impl->remoteGuidHash, remote_participant_guid);
-    if (!rinfo) {
-        rinfo = remoteIdentityInfoNew(remote_participant_guid, remote_identity_token);
-        (void)ddsrt_hh_add(impl->remoteGuidHash, rinfo);
-        relation = identityRelationNew(linfo, rinfo, lchallenge, rchallenge);
-        (void)ddsrt_hh_add(impl->objectHash, relation);
-        ddsrt_avl_insert(&relations_treedef, &linfo->relations, relation);
+    remoteIdent = find_remote_identity_by_guid(impl->remoteGuidHash, remote_participant_guid);
+    if (!remoteIdent) {
+        remoteIdent = remoteIdentityInfoNew(remote_participant_guid, remote_identity_token);
+        (void)ddsrt_hh_add(impl->objectHash, remoteIdent);
+        (void)ddsrt_hh_add(impl->remoteGuidHash, remoteIdent);
+        relation = identityRelationNew(localIdent, remoteIdent, lchallenge, rchallenge);
+        (void)ddsrt_hh_add(remoteIdent->linkHash, relation);
     } else {
-        ddsrt_avl_ipath_t path;
         /* When the remote identity has already been validated before,
            check if the remote identity token matches with the existing one
          */
-        if (!DDS_Security_DataHolder_equal(rinfo->remoteIdentityToken, remote_identity_token)) {
+        if (!DDS_Security_DataHolder_equal(remoteIdent->remoteIdentityToken, remote_identity_token)) {
             result = DDS_SECURITY_VALIDATION_FAILED;
             DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result,
                     "validate_remote_identity: remote_identity_token does not match with previously received one");
             goto err_inv_duplicate;
         }
-        relation = ddsrt_avl_lookup_ipath(&relations_treedef, &linfo->relations, rinfo, &path);
+
+        relation = find_identity_relation(remoteIdent, SECURITY_OBJECT_HANDLE(localIdent));
         if (!relation) {
-            relation = identityRelationNew(linfo, rinfo, lchallenge, rchallenge);
-            (void)ddsrt_hh_add(impl->objectHash, relation);
-            ddsrt_avl_insert_ipath(&relations_treedef, &linfo->relations, relation, &path);
+            relation = identityRelationNew(localIdent, remoteIdent, lchallenge, rchallenge);
+            r = ddsrt_hh_add(remoteIdent->linkHash, relation);
+            assert(r);
+            (void)r;
         } else {
             if (remote_auth_request_token) {
                 assert(rchallenge);
@@ -1392,9 +1464,9 @@ validate_remote_identity(
         DDS_Security_set_token_nil(local_auth_request_token);
     }
 
-    *remote_identity_handle = IDENTITY_HANDLE(relation);
+    *remote_identity_handle = IDENTITY_HANDLE(remoteIdent);;
 
-    if (memcmp(&linfo->adjustedGUID, &rinfo->guid, sizeof(DDS_Security_GUID_t)) < 0) {
+    if (memcmp(&localIdent->adjustedGUID, &remoteIdent->guid, sizeof(DDS_Security_GUID_t)) < 0) {
         result = DDS_SECURITY_VALIDATION_PENDING_HANDSHAKE_REQUEST;
     } else {
         result = DDS_SECURITY_VALIDATION_PENDING_HANDSHAKE_MESSAGE;
@@ -1429,7 +1501,8 @@ begin_handshake_request(
     HandshakeInfo *handshake = NULL;
     IdentityRelation *relation = NULL;
     SecurityObject *obj;
-    LocalIdentityInfo *linfo;
+    LocalIdentityInfo *localIdent;
+    RemoteIdentityInfo *remoteIdent;
     EVP_PKEY *dhkey;
     DDS_Security_BinaryProperty_t *tokens;
     DDS_Security_BinaryProperty_t *c_id;
@@ -1460,47 +1533,50 @@ begin_handshake_request(
                 "begin_handshake_request: Invalid initiator_identity_handle provided");
         goto err_inv_handle;
     }
-    linfo = (LocalIdentityInfo *) obj;
+    localIdent = (LocalIdentityInfo *) obj;
 
     obj = security_object_find(impl->objectHash, replier_identity_handle);
-    if (!obj || !security_object_valid(obj, SECURITY_OBJECT_KIND_IDENTITY_RELATION)) {
+    if (!obj || !security_object_valid(obj, SECURITY_OBJECT_KIND_REMOTE_IDENTITY)) {
         DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED,
                 "begin_handshake_request: Invalid replier_identity_handle provided");
         goto err_inv_handle;
     }
-    relation = (IdentityRelation *)obj;
-    handshake = relation->handshake;
+    remoteIdent = (RemoteIdentityInfo *)obj;
 
-    result = get_certificate_contents(linfo->identityCert, &certData, &certDataSize, ex);
+    result = get_certificate_contents(localIdent->identityCert, &certData, &certDataSize, ex);
     if (result != DDS_SECURITY_VALIDATION_OK) {
         goto err_alloc_cid;
     }
 
+    handshake = find_handshake(impl, SECURITY_OBJECT_HANDLE(localIdent), SECURITY_OBJECT_HANDLE(remoteIdent));
     if (!handshake) {
-        handshake = handshakeInfoNew(relation);
+        relation = find_identity_relation(remoteIdent, SECURITY_OBJECT_HANDLE(localIdent));
+        assert(relation);
+        handshake = handshakeInfoNew(localIdent, remoteIdent, relation);
         handshake->created_in = CREATEDREQUEST;
-        relation->handshake = handshake;
-        (void)ddsrt_hh_add(impl->handshakes, handshake);
+        (void)ddsrt_hh_add(impl->objectHash, handshake);
         created = 1;
+    } else {
+        relation = handshake->relation;
+        assert(relation);
     }
 
-    assert(handshake->relation == relation);
-
     if (!handshake->ldh) {
-        result = generate_dh_keys(&dhkey, linfo->kagreeAlgoKind, ex);
+        result = generate_dh_keys(&dhkey, localIdent->kagreeAlgoKind, ex);
         if (result != DDS_SECURITY_VALIDATION_OK) {
             goto err_gen_dh_keys;
         }
+
         handshake->ldh = dhkey;
     }
 
-    result = dh_public_key_to_oct(handshake->ldh, linfo->kagreeAlgoKind, &dhPubKeyData, &dhPubKeyDataSize, ex);
+    result = dh_public_key_to_oct(handshake->ldh, localIdent->kagreeAlgoKind, &dhPubKeyData, &dhPubKeyDataSize, ex);
     if (result != DDS_SECURITY_VALIDATION_OK) {
         goto err_get_public_key;
     }
 
-    if (linfo->pdata._length == 0) {
-        DDS_Security_OctetSeq_copy(&linfo->pdata, serialized_local_participant_data);
+    if (localIdent->pdata._length == 0) {
+        DDS_Security_OctetSeq_copy(&localIdent->pdata, serialized_local_participant_data);
     }
 
     tokens = DDS_Security_BinaryPropertySeq_allocbuf(8);
@@ -1517,8 +1593,8 @@ begin_handshake_request(
     DDS_Security_BinaryProperty_set_by_ref(c_id, "c.id", certData, certDataSize);
 
     /* Store the permission document in the c.perm property */
-    if (linfo->permissionsDocument) {
-        DDS_Security_BinaryProperty_set_by_string(c_perm, "c.perm", linfo->permissionsDocument);
+    if (localIdent->permissionsDocument) {
+        DDS_Security_BinaryProperty_set_by_string(c_perm, "c.perm", localIdent->permissionsDocument);
     } else {
       DDS_Security_BinaryProperty_set_by_string(c_perm, "c.perm", "");
     }
@@ -1527,10 +1603,10 @@ begin_handshake_request(
     DDS_Security_BinaryProperty_set_by_value(c_pdata, "c.pdata", serialized_local_participant_data->_buffer, serialized_local_participant_data->_length);
 
     /* Set the used signing algorithm descriptor in c.dsign_algo */
-    DDS_Security_BinaryProperty_set_by_string(c_dsign_algo, "c.dsign_algo", get_dsign_algo(linfo->dsignAlgoKind));
+    DDS_Security_BinaryProperty_set_by_string(c_dsign_algo, "c.dsign_algo", get_dsign_algo(localIdent->dsignAlgoKind));
 
     /* Set the used key algorithm descriptor in c.kagree_algo */
-    DDS_Security_BinaryProperty_set_by_string(c_kagree_algo, "c.kagree_algo", get_kagree_algo(linfo->kagreeAlgoKind));
+    DDS_Security_BinaryProperty_set_by_string(c_kagree_algo, "c.kagree_algo", get_kagree_algo(localIdent->kagreeAlgoKind));
 
     /* Calculate the hash_c1 */
     {
@@ -1551,6 +1627,8 @@ begin_handshake_request(
     /* Set the challenge in challenge1 property */
     DDS_Security_BinaryProperty_set_by_value(challenge, "challenge1", relation->lchallenge->value, sizeof(AuthenticationChallenge));
 
+    (void)ddsrt_hh_add(impl->objectHash, handshake);
+
     ddsrt_mutex_unlock(&impl->lock);
 
     handshake_message->class_id = ddsrt_strdup(AUTH_HANDSHAKE_REQUEST_TOKEN_ID);
@@ -1565,8 +1643,8 @@ begin_handshake_request(
 err_get_public_key:
 err_gen_dh_keys:
     if (created) {
-        (void)ddsrt_hh_remove(impl->handshakes, handshake);
-        handshakeInfoFree(handshake);
+        (void)ddsrt_hh_remove(impl->objectHash, handshake);
+        security_object_free((SecurityObject *)handshake);
     }
 err_alloc_cid:
     ddsrt_free(certData);
@@ -2424,8 +2502,8 @@ begin_handshake_reply(
     HandshakeInfo *handshake = NULL;
     IdentityRelation *relation = NULL;
     SecurityObject *obj;
-    LocalIdentityInfo *linfo;
-    RemoteIdentityInfo *rinfo;
+    LocalIdentityInfo *localIdent;
+    RemoteIdentityInfo *remoteIdent;
     EVP_PKEY *dhkeyLocal = NULL;
     DDS_Security_BinaryProperty_t *tokens;
     DDS_Security_BinaryProperty_t *c_id;
@@ -2469,40 +2547,41 @@ begin_handshake_reply(
                 "begin_handshake_reply: Invalid replier_identity_handle provided");
         goto err_inv_handle;
     }
-    linfo = (LocalIdentityInfo *) obj;
+    localIdent = (LocalIdentityInfo *) obj;
 
     obj = security_object_find(impl->objectHash, initiator_identity_handle);
-    if (!obj || !security_object_valid(obj, SECURITY_OBJECT_KIND_IDENTITY_RELATION)) {
+    if (!obj || !security_object_valid(obj, SECURITY_OBJECT_KIND_REMOTE_IDENTITY)) {
         DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED,
                 "begin_handshake_reply: Invalid initiator_identity_handle provided");
         goto err_inv_handle;
     }
-    relation = (IdentityRelation *)obj;
-    rinfo = relation->remoteIdentity;
-    handshake = relation->handshake;
+    remoteIdent = (RemoteIdentityInfo *)obj;
 
+    handshake = find_handshake(impl, SECURITY_OBJECT_HANDLE(localIdent), SECURITY_OBJECT_HANDLE(remoteIdent));
     if (!handshake) {
-        handshake = handshakeInfoNew(relation);
-        relation->handshake = handshake;
+        relation = find_identity_relation(remoteIdent, SECURITY_OBJECT_HANDLE(localIdent));
+        assert(relation);
+        handshake = handshakeInfoNew(localIdent, remoteIdent, relation);
         handshake->created_in = CREATEDREPLY;
-        (void)ddsrt_hh_add(impl->handshakes, handshake);
+        (void)ddsrt_hh_add(impl->objectHash, handshake);
         created = 1;
+    } else {
+        relation = handshake->relation;
+        assert(relation);
     }
 
-    assert(handshake->relation == relation);
-
     result = validate_handshake_request_token(handshake_message_in, handshake, &(impl->trustedCAList), ex);
     if (result != DDS_SECURITY_VALIDATION_OK) {
         goto err_inv_token;
     }
 
-    result = get_certificate_contents(linfo->identityCert, &certData, &certDataSize, ex);
+    result = get_certificate_contents(localIdent->identityCert, &certData, &certDataSize, ex);
     if (result != DDS_SECURITY_VALIDATION_OK) {
         goto err_alloc_cid;
     }
 
     if (!handshake->ldh) {
-        result = generate_dh_keys(&dhkeyLocal, rinfo->kagreeAlgoKind, ex);
+        result = generate_dh_keys(&dhkeyLocal, remoteIdent->kagreeAlgoKind, ex);
         if (result != DDS_SECURITY_VALIDATION_OK) {
             goto err_gen_dh_keys;
         }
@@ -2511,13 +2590,13 @@ begin_handshake_reply(
         EVP_PKEY_copy_parameters(handshake->rdh, handshake->ldh);
     }
 
-    result = dh_public_key_to_oct(handshake->ldh, rinfo->kagreeAlgoKind, &dhPubKeyData, &dhPubKeyDataSize, ex);
+    result = dh_public_key_to_oct(handshake->ldh, remoteIdent->kagreeAlgoKind, &dhPubKeyData, &dhPubKeyDataSize, ex);
     if (result != DDS_SECURITY_VALIDATION_OK) {
         goto err_get_public_key;
     }
 
-    if (linfo->pdata._length == 0) {
-        DDS_Security_OctetSeq_copy(&linfo->pdata, serialized_local_participant_data);
+    if (localIdent->pdata._length == 0) {
+        DDS_Security_OctetSeq_copy(&localIdent->pdata, serialized_local_participant_data);
     }
 
     hash_c1_ref = DDS_Security_DataHolder_find_binary_property(handshake_message_in, "hash_c1");
@@ -2543,8 +2622,8 @@ begin_handshake_reply(
     certData = NULL;
 
     /* Store the permission document in the c.perm property */
-    if (linfo->permissionsDocument) {
-        DDS_Security_BinaryProperty_set_by_string(c_perm, "c.perm", linfo->permissionsDocument);
+    if (localIdent->permissionsDocument) {
+        DDS_Security_BinaryProperty_set_by_string(c_perm, "c.perm", localIdent->permissionsDocument);
     } else {
         DDS_Security_BinaryProperty_set_by_string(c_perm, "c.perm", "");
     }
@@ -2553,10 +2632,10 @@ begin_handshake_reply(
     DDS_Security_BinaryProperty_set_by_value(c_pdata, "c.pdata", serialized_local_participant_data->_buffer, serialized_local_participant_data->_length);
 
     /* Set the used signing algorithm descriptor in c.dsign_algo */
-    DDS_Security_BinaryProperty_set_by_string(c_dsign_algo, "c.dsign_algo", get_dsign_algo(linfo->dsignAlgoKind));
+    DDS_Security_BinaryProperty_set_by_string(c_dsign_algo, "c.dsign_algo", get_dsign_algo(localIdent->dsignAlgoKind));
 
     /* Set the used key algorithm descriptor in c.kagree_algo */
-    DDS_Security_BinaryProperty_set_by_string(c_kagree_algo, "c.kagree_algo", get_kagree_algo(rinfo->kagreeAlgoKind));
+    DDS_Security_BinaryProperty_set_by_string(c_kagree_algo, "c.kagree_algo", get_kagree_algo(remoteIdent->kagreeAlgoKind));
 
     /* Calculate the hash_c2 */
     {
@@ -2609,7 +2688,7 @@ begin_handshake_reply(
         binary_properties[4] = dh1;
         binary_properties[5] = hash_c1_val;
 
-        result = create_signature(linfo->privateKey, binary_properties, HANDSHAKE_SIGNATURE_CONTENT_SIZE , &sign, &signlen, ex);
+        result = create_signature(localIdent->privateKey, binary_properties, HANDSHAKE_SIGNATURE_CONTENT_SIZE , &sign, &signlen, ex);
 
         DDS_Security_BinaryProperty_free(hash_c1_val);
         DDS_Security_BinaryProperty_free(hash_c2_val);
@@ -2620,12 +2699,15 @@ begin_handshake_reply(
         DDS_Security_BinaryProperty_set_by_ref(signature, "signature", sign, (uint32_t)signlen);
     }
 
+    (void)ddsrt_hh_add(impl->objectHash, handshake);
+
     handshake_message_out->class_id = ddsrt_strdup(AUTH_HANDSHAKE_REPLY_TOKEN_ID);
     handshake_message_out->binary_properties._length = tokenSize;
     handshake_message_out->binary_properties._buffer = tokens;
 
     ddsrt_mutex_unlock(&impl->lock);
 
+
     *handshake_handle = HANDSHAKE_HANDLE(handshake);
 
     if (result == DDS_SECURITY_VALIDATION_OK) {
@@ -2642,8 +2724,8 @@ err_gen_dh_keys:
 err_alloc_cid:
 err_inv_token:
     if (created) {
-        (void)ddsrt_hh_remove(impl->handshakes, handshake);
-        handshakeInfoFree(handshake);
+        (void)ddsrt_hh_remove(impl->objectHash, handshake);
+        security_object_free((SecurityObject *)handshake);
     }
 err_inv_handle:
     ddsrt_mutex_unlock(&impl->lock);
@@ -2651,6 +2733,7 @@ err_bad_param:
     return DDS_SECURITY_VALIDATION_FAILED;
 }
 
+
 static bool
 generate_shared_secret(
     const HandshakeInfo *handshake,
@@ -2716,6 +2799,9 @@ fail_ctx_new:
     return result;
 }
 
+
+
+
 DDS_Security_ValidationResult_t
 process_handshake(
         dds_security_authentication *instance,
@@ -2759,7 +2845,7 @@ process_handshake(
 
     ddsrt_mutex_lock(&impl->lock);
 
-    obj = security_object_find(impl->handshakes, handshake_handle);
+    obj = security_object_find(impl->objectHash, handshake_handle);
     if (!obj || !security_object_valid(obj, SECURITY_OBJECT_KIND_HANDSHAKE)) {
         DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT,
         DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED,
@@ -2847,6 +2933,7 @@ process_handshake(
                             challenge2_ref->value._length);
         }
 
+
         /* Calculate the signature */
         {
            const DDS_Security_BinaryProperty_t * binary_properties[ HANDSHAKE_SIGNATURE_CONTENT_SIZE ];
@@ -2895,10 +2982,12 @@ process_handshake(
             goto err_inv_token;
         }
 
+
         challenge2_ref_for_shared_secret = (DDS_Security_octet*)(handshake->relation->lchallenge);
         challenge1_ref_for_shared_secret = (DDS_Security_octet*)(handshake->relation->rchallenge);
 
         result =  DDS_SECURITY_VALIDATION_OK;
+
         break;
     default:
         ddsrt_mutex_unlock(&impl->lock);
@@ -2931,9 +3020,10 @@ process_handshake(
           goto err_invalid_expiry;
         } else if( certExpiry != DDS_NEVER ){
             add_validity_end_trigger( impl,
-                            IDENTITY_HANDLE( handshake->relation ),
+                            IDENTITY_HANDLE( handshake->relation->remoteIdentity ),
                             certExpiry);
         }
+
     }
 
     ddsrt_mutex_unlock(&impl->lock);
@@ -2971,14 +3061,14 @@ DDS_Security_SharedSecretHandle get_shared_secret(
     }
 
     ddsrt_mutex_lock(&impl->lock);
-    obj = security_object_find(impl->handshakes, handshake_handle);
+    obj = security_object_find(impl->objectHash, handshake_handle);
     if (!obj || !security_object_valid(obj, SECURITY_OBJECT_KIND_HANDSHAKE)) {
        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "return_handshake_handle: Invalid handle provided");
        goto err_invalid_handle;
     }
 
     ddsrt_mutex_unlock(&impl->lock);
-    return (DDS_Security_SharedSecretHandle)(uintptr_t)((HandshakeInfo*)obj)->shared_secret_handle_impl;
+    return (DDS_Security_SharedSecretHandle)(ddsrt_address)((HandshakeInfo*)obj)->shared_secret_handle_impl;
 
 
     err_invalid_handle:
@@ -3011,7 +3101,7 @@ get_authenticated_peer_credential_token(
 
     ddsrt_mutex_lock(&impl->lock);
 
-    handshake = (HandshakeInfo *) security_object_find(impl->handshakes, handshake_handle);
+    handshake = (HandshakeInfo *) security_object_find(impl->objectHash, handshake_handle);
     if (!handshake || !SECURITY_OBJECT_VALID(handshake, SECURITY_OBJECT_KIND_HANDSHAKE)) {
         DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT,
                 DDS_SECURITY_ERR_INVALID_PARAMETER_CODE, 0,
@@ -3136,15 +3226,18 @@ return_handshake_handle(dds_security_authentication *instance,
     }
 
     ddsrt_mutex_lock(&impl->lock);
-    obj = security_object_find(impl->handshakes, handshake_handle);
+    obj = security_object_find(impl->objectHash, handshake_handle);
     if (!obj || !security_object_valid(obj, SECURITY_OBJECT_KIND_HANDSHAKE)) {
         DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "return_handshake_handle: Invalid handle provided");
         goto err_invalid_handle;
     }
     handshake = (HandshakeInfo *)obj;
 
-    (void)ddsrt_hh_remove(impl->handshakes, handshake);
-    handshakeInfoFree(handshake);
+    assert(handshake->relation);
+
+    (void)ddsrt_hh_remove(impl->objectHash, obj);
+    security_object_free((SecurityObject *)handshake);
+
     ddsrt_mutex_unlock(&impl->lock);
 
     return true;
@@ -3155,63 +3248,56 @@ err_bad_param:
     return false;
 }
 
-static void
-release_remote_info(
-     dds_security_authentication_impl *impl,
-     RemoteIdentityInfo *info)
-{
-    if (--info->refc == 0) {
-        (void)ddsrt_hh_remove(impl->remoteGuidHash, info);
-        remoteIdentityInfoFree(info);
-    }
-}
 
 static void
 invalidate_local_related_objects(
      dds_security_authentication_impl *impl,
-     LocalIdentityInfo *linfo)
+     LocalIdentityInfo *localIdent)
 {
-    IdentityRelation *relation;
+    struct ddsrt_hh_iter it;
+    SecurityObject *obj;
 
-    relation = ddsrt_avl_find_min(&relations_treedef, &linfo->relations);
-    while (relation) {
-        IdentityRelation *next = ddsrt_avl_find_succ(&relations_treedef, &linfo->relations, relation);
+    for (obj = ddsrt_hh_iter_first(impl->objectHash, &it); obj != NULL; obj = ddsrt_hh_iter_next(&it)) {
+        if (obj->kind == SECURITY_OBJECT_KIND_REMOTE_IDENTITY) {
+            RemoteIdentityInfo *remoteIdent = (RemoteIdentityInfo *)obj;
+            IdentityRelation *relation;
+            HandshakeInfo *handshake;
 
-        assert(relation->remoteIdentity);
+            handshake = find_handshake(impl, SECURITY_OBJECT_HANDLE(localIdent), SECURITY_OBJECT_HANDLE(remoteIdent));
+            if (handshake) {
+                (void)ddsrt_hh_remove(impl->objectHash, handshake);
+                security_object_free((SecurityObject *) handshake);
+            }
 
-        if (relation->handshake) {
-            (void)ddsrt_hh_remove(impl->handshakes, relation->handshake);
-            handshakeInfoFree(relation->handshake);
+            relation = find_identity_relation(remoteIdent, SECURITY_OBJECT_HANDLE(localIdent));
+            if (relation) {
+                remove_identity_relation(remoteIdent, relation);
+            }
         }
-        release_remote_info(impl, relation->remoteIdentity);
-        ddsrt_avl_delete(&relations_treedef, &linfo->relations, relation);
-        (void)ddsrt_hh_remove(impl->objectHash, relation);
-        identityRelationFree(relation);
-        relation = next;
     }
-    (void)ddsrt_hh_remove(impl->objectHash, linfo);
-    localIdentityInfoFree(linfo);
 }
 
 static void
 invalidate_remote_related_objects(
     dds_security_authentication_impl *impl,
-    IdentityRelation *relation)
+    RemoteIdentityInfo *remoteIdentity)
 {
-    assert(relation->remoteIdentity);
-    assert(relation->localIdentity);
+    struct ddsrt_hh_iter it;
+    IdentityRelation *relation;
+    HandshakeInfo *handshake;
 
-    if (relation->handshake) {
-        (void)ddsrt_hh_remove(impl->handshakes, relation->handshake);
-        handshakeInfoFree(relation->handshake);
+    for (relation = ddsrt_hh_iter_first(remoteIdentity->linkHash, &it); relation != NULL; relation = ddsrt_hh_iter_next(&it)) {
+        handshake = find_handshake(impl, SECURITY_OBJECT_HANDLE(relation->localIdentity), SECURITY_OBJECT_HANDLE(remoteIdentity));
+        if (handshake) {
+            (void)ddsrt_hh_remove(impl->objectHash, handshake);
+            security_object_free((SecurityObject *) handshake);
+        }
+
+        (void)ddsrt_hh_remove(remoteIdentity->linkHash, relation);
+        security_object_free((SecurityObject *) relation);
     }
-    release_remote_info(impl, relation->remoteIdentity);
-    ddsrt_avl_delete(&relations_treedef, &relation->localIdentity->relations, relation);
-    (void)ddsrt_hh_remove(impl->objectHash, relation);
-    identityRelationFree(relation);
 }
 
-
 DDS_Security_boolean
 return_identity_handle(
         dds_security_authentication *instance,
@@ -3221,8 +3307,8 @@ return_identity_handle(
     DDS_Security_boolean result = true;
     dds_security_authentication_impl *impl = (dds_security_authentication_impl *) instance;
     SecurityObject *obj;
-    LocalIdentityInfo *linfo;
-    IdentityRelation *relation;
+    LocalIdentityInfo *localIdent;
+    RemoteIdentityInfo *remoteIdent;
 
     /* validate provided arguments */
     if (!instance || !identity_handle) {
@@ -3245,12 +3331,17 @@ return_identity_handle(
 
     switch (obj->kind) {
     case SECURITY_OBJECT_KIND_LOCAL_IDENTITY:
-        linfo = (LocalIdentityInfo *) obj;
-        invalidate_local_related_objects(impl, linfo);
+        localIdent = (LocalIdentityInfo *) obj;
+        invalidate_local_related_objects(impl, localIdent);
+        (void)ddsrt_hh_remove(impl->objectHash, obj);
+        security_object_free(obj);
         break;
-    case SECURITY_OBJECT_KIND_IDENTITY_RELATION:
-        relation = (IdentityRelation *) obj;
-        invalidate_remote_related_objects(impl, relation);
+    case SECURITY_OBJECT_KIND_REMOTE_IDENTITY:
+        remoteIdent = (RemoteIdentityInfo *) obj;
+        invalidate_remote_related_objects(impl, remoteIdent);
+        (void)ddsrt_hh_remove(impl->remoteGuidHash, remoteIdent);
+        (void)ddsrt_hh_remove(impl->objectHash, obj);
+        security_object_free(obj);
         break;
     default:
         DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "return_identity_handle: Invalid handle provided");
@@ -3259,6 +3350,7 @@ return_identity_handle(
     }
 
     ddsrt_mutex_unlock(&impl->lock);
+
     return result;
 
 err_invalid_handle:
@@ -3279,8 +3371,10 @@ DDS_Security_boolean return_sharedsecret_handle(
     return true;
 }
 
-int32_t init_authentication( const char *argument, void **context)
+int32_t
+init_authentication( const char *argument, void **context)
 {
+
     dds_security_authentication_impl *authentication;
 
     DDSRT_UNUSED_ARG(argument);
@@ -3296,31 +3390,51 @@ int32_t init_authentication( const char *argument, void **context)
 
     /* assign the interface functions */
     authentication->base.validate_local_identity = &validate_local_identity;
+
     authentication->base.get_identity_token = &get_identity_token;
+
     authentication->base.get_identity_status_token = &get_identity_status_token;
-    authentication->base.set_permissions_credential_and_token = &set_permissions_credential_and_token;
+
+    authentication->base.set_permissions_credential_and_token =
+            &set_permissions_credential_and_token;
+
     authentication->base.validate_remote_identity = &validate_remote_identity;
+
     authentication->base.begin_handshake_request = &begin_handshake_request;
+
     authentication->base.begin_handshake_reply = &begin_handshake_reply;
+
     authentication->base.process_handshake = &process_handshake;
+
     authentication->base.get_shared_secret = &get_shared_secret;
-    authentication->base.get_authenticated_peer_credential_token = &get_authenticated_peer_credential_token;
+
+    authentication->base.get_authenticated_peer_credential_token =
+            &get_authenticated_peer_credential_token;
+
     authentication->base.set_listener = &set_listener;
+
     authentication->base.return_identity_token = &return_identity_token;
-    authentication->base.return_identity_status_token = &return_identity_status_token;
-    authentication->base.return_authenticated_peer_credential_token = &return_authenticated_peer_credential_token;
+
+    authentication->base.return_identity_status_token =
+            &return_identity_status_token;
+
+    authentication->base.return_authenticated_peer_credential_token =
+            &return_authenticated_peer_credential_token;
+
     authentication->base.return_handshake_handle = &return_handshake_handle;
+
     authentication->base.return_identity_handle = &return_identity_handle;
+
     authentication->base.return_sharedsecret_handle = &return_sharedsecret_handle;
 
     ddsrt_mutex_init(&authentication->lock);
 
     authentication->objectHash = ddsrt_hh_new(32, security_object_hash, security_object_equal);
     authentication->remoteGuidHash = ddsrt_hh_new(32, remote_guid_hash, remote_guid_equal);
-    authentication->handshakes = ddsrt_hh_new(32, security_object_hash, security_object_equal);
 
     memset( &authentication->trustedCAList, 0, sizeof(X509Seq));
 
+
     /* Initialize openssl */
     OpenSSL_add_all_algorithms();
     OpenSSL_add_all_ciphers();
@@ -3343,8 +3457,6 @@ err_mutex_failed:
 int32_t finalize_authentication(void *instance)
 {
     dds_security_authentication_impl *authentication = instance;
-    LocalIdentityInfo *linfo;
-    IdentityRelation *relation;
 
     if( authentication ){
         ddsrt_mutex_lock(&authentication->lock);
@@ -3352,37 +3464,25 @@ int32_t finalize_authentication(void *instance)
         dds_security_timed_dispatcher_free(authentication->timed_callbacks, authentication->dispatcher);
         dds_security_timed_cb_free(authentication->timed_callbacks);
 
-        if (authentication->objectHash) {
-            struct ddsrt_hh_iter it;
-            SecurityObject *obj;
-            for (obj = ddsrt_hh_iter_first(authentication->objectHash, &it); obj != NULL; obj = ddsrt_hh_iter_next(&it)) {
-                switch (obj->kind) {
-                case SECURITY_OBJECT_KIND_LOCAL_IDENTITY:
-                    linfo = (LocalIdentityInfo *) obj;
-                    invalidate_local_related_objects(authentication, linfo);
-                    break;
-                case SECURITY_OBJECT_KIND_IDENTITY_RELATION:
-                    relation = (IdentityRelation *) obj;
-                    invalidate_remote_related_objects(authentication, relation);
-                    break;
-                default:
-                    break;
-                }
-            }
-            ddsrt_hh_free(authentication->objectHash);
-        }
-
         if (authentication->remoteGuidHash) {
             ddsrt_hh_free(authentication->remoteGuidHash);
         }
 
-        if (authentication->handshakes) {
-            ddsrt_hh_free(authentication->handshakes);
+        if (authentication->objectHash) {
+            struct ddsrt_hh_iter it;
+            SecurityObject *obj;
+            for (obj = ddsrt_hh_iter_first(authentication->objectHash, &it); obj != NULL; obj = ddsrt_hh_iter_next(&it)) {
+                security_object_free(obj);
+            }
+            ddsrt_hh_free(authentication->objectHash);
         }
 
         free_ca_list_contents(&(authentication->trustedCAList));
+
         ddsrt_mutex_unlock(&authentication->lock);
+
         ddsrt_mutex_destroy(&authentication->lock);
+
         ddsrt_free((dds_security_authentication_impl*) instance);
     }
 
diff --git a/src/security/builtin_plugins/cryptographic/src/crypto_key_exchange.c b/src/security/builtin_plugins/cryptographic/src/crypto_key_exchange.c
index f002ad7..59d19af 100644
--- a/src/security/builtin_plugins/cryptographic/src/crypto_key_exchange.c
+++ b/src/security/builtin_plugins/cryptographic/src/crypto_key_exchange.c
@@ -71,21 +71,35 @@ static bool check_not_data_empty(const DDS_Security_OctetSeq *seq)
   return false;
 }
 
-static bool check_crypto_keymaterial(const DDS_Security_KeyMaterial_AES_GCM_GMAC *keymat)
+static bool check_crypto_keymaterial(
+    const dds_security_crypto_key_exchange_impl *impl,
+    const DDS_Security_KeyMaterial_AES_GCM_GMAC *keymat,
+    const int64_t handle)
 {
-  bool status;
-
+  bool status = false;
   uint32_t transform_kind = CRYPTO_TRANSFORM_KIND(keymat->transformation_kind);
   uint32_t key_sz = CRYPTO_KEY_SIZE_BYTES(transform_kind);
 
-  status = (transform_kind >= CRYPTO_TRANSFORMATION_KIND_AES128_GMAC && transform_kind <= CRYPTO_TRANSFORMATION_KIND_AES256_GCM &&
-    keymat->master_salt._length == key_sz && keymat->master_salt._buffer != NULL && check_not_data_empty(&keymat->master_salt) &&
-    keymat->master_sender_key._length == key_sz && keymat->master_sender_key._buffer != NULL && check_not_data_empty(&keymat->master_sender_key));
-
-  if (status && CRYPTO_TRANSFORM_ID(keymat->receiver_specific_key_id))
+  if (transform_kind != CRYPTO_TRANSFORMATION_KIND_NONE)
   {
-    status = (keymat->master_receiver_specific_key._length == key_sz &&
-      keymat->master_receiver_specific_key._buffer != NULL && check_not_data_empty(&keymat->master_receiver_specific_key));
+    status = (transform_kind <= CRYPTO_TRANSFORMATION_KIND_AES256_GCM &&
+        keymat->master_salt._length == key_sz && keymat->master_salt._buffer != NULL && check_not_data_empty(&keymat->master_salt) &&
+        keymat->master_sender_key._length == key_sz && keymat->master_sender_key._buffer != NULL && check_not_data_empty(&keymat->master_sender_key));
+
+    if (status && CRYPTO_TRANSFORM_ID(keymat->receiver_specific_key_id))
+    {
+      status = (keymat->master_receiver_specific_key._length == key_sz &&
+          keymat->master_receiver_specific_key._buffer != NULL && check_not_data_empty(&keymat->master_receiver_specific_key));
+    }
+  }
+  else
+  {
+    const dds_security_crypto_key_factory *factory;
+    DDS_Security_ProtectionKind kind;
+
+    factory = cryptography_get_crypto_key_factory(impl->crypto);
+    if (crypto_factory_get_protection_kind(factory, handle, &kind))
+      status = (kind == DDS_SECURITY_PROTECTION_KIND_NONE);
   }
 
   return status;
@@ -179,12 +193,34 @@ create_local_participant_crypto_tokens(
   tokens->_buffer[0].binary_properties._buffer[0].value._length =
       tokens->_buffer[0].binary_properties._buffer[0].value._maximum = length;
   tokens->_buffer[0].binary_properties._buffer[0].value._buffer = buffer;
+  tokens->_buffer[0].binary_properties._buffer[0].propagate = true;
   return true;
 
 fail_invalid_arg:
   return false;
 }
 
+
+static DDS_Security_boolean
+allow_empty_tokens(
+    const dds_security_crypto_key_exchange_impl *impl,
+    const DDS_Security_ParticipantCryptoTokenSeq *tokens,
+    const int64_t handle)
+{
+  const dds_security_crypto_key_factory *factory;
+  DDS_Security_ProtectionKind kind;
+
+  if (tokens->_length > 0)
+    return false;
+
+  factory = cryptography_get_crypto_key_factory(impl->crypto);
+  if (crypto_factory_get_protection_kind(factory, handle, &kind))
+    return (kind == DDS_SECURITY_PROTECTION_KIND_NONE);
+
+  return false;
+}
+
+
 static DDS_Security_boolean
 set_remote_participant_crypto_tokens(
     dds_security_crypto_key_exchange *instance,
@@ -207,6 +243,9 @@ set_remote_participant_crypto_tokens(
     return false;
   }
 
+  if (allow_empty_tokens(impl, tokens, remote_id))
+    return true;
+
   if (!check_crypto_tokens(tokens))
   {
     DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_CRYPTO_ARGUMENT_CODE, 0,
@@ -229,7 +268,7 @@ set_remote_participant_crypto_tokens(
         "set_remote_participant_crypto_tokens: " DDS_SECURITY_ERR_INVALID_CRYPTO_TOKEN_MESSAGE);
     result = false;
   }
-  else if (!check_crypto_keymaterial(&remote_key_mat))
+  else if (!check_crypto_keymaterial(impl, &remote_key_mat, remote_id))
   {
     DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_CRYPTO_TOKEN_CODE, 0,
         "set_remote_participant_crypto_tokens: " DDS_SECURITY_ERR_INVALID_CRYPTO_TOKEN_MESSAGE);
@@ -290,6 +329,7 @@ create_local_datawriter_crypto_tokens(
     tokens->_buffer[i].binary_properties._buffer[0].value._length =
         tokens->_buffer[i].binary_properties._buffer[0].value._maximum = length;
     tokens->_buffer[i].binary_properties._buffer[0].value._buffer = buffer;
+    tokens->_buffer[i].binary_properties._buffer[0].propagate = true;
     CRYPTO_OBJECT_RELEASE(key_mat[i]);
   }
 
@@ -317,6 +357,9 @@ set_remote_datawriter_crypto_tokens(
     return false;
   }
 
+  if (allow_empty_tokens(impl, tokens, remote_writer_handle))
+    return true;
+
   if (!check_crypto_tokens(tokens))
   {
     DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_CRYPTO_ARGUMENT_CODE, 0,
@@ -347,7 +390,7 @@ set_remote_datawriter_crypto_tokens(
           "set_remote_datawriter_crypto_tokens: " DDS_SECURITY_ERR_INVALID_CRYPTO_TOKEN_MESSAGE);
       result = false;
     }
-    else if (!check_crypto_keymaterial(&remote_key_mat[i]))
+    else if (!check_crypto_keymaterial(impl, &remote_key_mat[i], remote_writer_handle))
     {
       DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_CRYPTO_TOKEN_CODE, 0,
           "set_remote_datawriter_crypto_tokens: " DDS_SECURITY_ERR_INVALID_CRYPTO_TOKEN_MESSAGE);
@@ -409,6 +452,7 @@ create_local_datareader_crypto_tokens(
     tokens->_buffer[0].binary_properties._buffer[0].value._length =
         tokens->_buffer[0].binary_properties._buffer[0].value._maximum = length;
     tokens->_buffer[0].binary_properties._buffer[0].value._buffer = buffer;
+    tokens->_buffer[0].binary_properties._buffer[0].propagate = true;
 
     CRYPTO_OBJECT_RELEASE(key_mat);
   }
@@ -444,6 +488,9 @@ set_remote_datareader_crypto_tokens(
     return false;
   }
 
+  if (allow_empty_tokens(impl, tokens, remote_reader_handle))
+    return true;
+
   if (!check_crypto_tokens(tokens))
   {
     DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_CRYPTO_ARGUMENT_CODE, 0,
@@ -466,7 +513,7 @@ set_remote_datareader_crypto_tokens(
         "set_remote_datareader_crypto_tokens: " DDS_SECURITY_ERR_INVALID_CRYPTO_TOKEN_MESSAGE);
     result = false;
   }
-  else if (!check_crypto_keymaterial(&remote_key_mat))
+  else if (!check_crypto_keymaterial(impl, &remote_key_mat, remote_reader_handle))
   {
     DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_CRYPTO_TOKEN_CODE, 0,
         "set_remote_datareader_crypto_tokens: " DDS_SECURITY_ERR_INVALID_CRYPTO_TOKEN_MESSAGE);
diff --git a/src/security/builtin_plugins/cryptographic/src/crypto_key_factory.c b/src/security/builtin_plugins/cryptographic/src/crypto_key_factory.c
index e77c99c..61e3f9e 100644
--- a/src/security/builtin_plugins/cryptographic/src/crypto_key_factory.c
+++ b/src/security/builtin_plugins/cryptographic/src/crypto_key_factory.c
@@ -245,6 +245,7 @@ remove_relation_from_keymaterial(
     CryptoObject *remote_crypto)
 {
   endpoint_relation *relation;
+
   relation = crypto_endpoint_relation_find_by_crypto(key_material->endpoint_relations, local_crypto, remote_crypto);
   if (relation)
   {
@@ -258,24 +259,21 @@ remove_remote_writer_relation(
     dds_security_crypto_key_factory_impl *implementation,
     remote_datawriter_crypto *remote_writer)
 {
-  local_datareader_crypto *local_reader;
   remote_participant_crypto *remote_participant;
   participant_key_material *key_material;
 
+  DDSRT_UNUSED_ARG(implementation);
+
   assert(remote_writer);
   remote_participant = remote_writer->participant;
   assert(remote_participant);
-  local_reader = (local_datareader_crypto *)crypto_object_table_find(implementation->crypto_objects, remote_writer->local_reader_handle);
-  if (local_reader)
+
+  key_material = (participant_key_material *)crypto_object_table_find(
+      remote_participant->key_material, CRYPTO_OBJECT_HANDLE(remote_writer->local_reader->participant));
+  if (key_material)
   {
-    key_material = (participant_key_material *)crypto_object_table_find(
-        remote_participant->key_material, CRYPTO_OBJECT_HANDLE(local_reader->participant));
-    if (key_material)
-    {
-      remove_relation_from_keymaterial(key_material, (CryptoObject *)local_reader, (CryptoObject *)remote_writer);
-      CRYPTO_OBJECT_RELEASE(key_material);
-    }
-    CRYPTO_OBJECT_RELEASE(local_reader);
+    remove_relation_from_keymaterial(key_material, (CryptoObject *)remote_writer->local_reader, (CryptoObject *)remote_writer);
+    CRYPTO_OBJECT_RELEASE(key_material);
   }
 }
 
@@ -284,24 +282,21 @@ remove_remote_reader_relation(
     dds_security_crypto_key_factory_impl *implementation,
     remote_datareader_crypto *remote_reader)
 {
-  local_datawriter_crypto *local_writer;
   remote_participant_crypto *remote_participant;
   participant_key_material *key_material;
 
+  DDSRT_UNUSED_ARG(implementation);
+
   assert(remote_reader);
   remote_participant = remote_reader->participant;
   assert(remote_participant);
-  local_writer = (local_datawriter_crypto *)crypto_object_table_find(implementation->crypto_objects, remote_reader->local_writer_handle);
-  if (local_writer)
+
+  key_material = (participant_key_material *)crypto_object_table_find(
+      remote_participant->key_material, CRYPTO_OBJECT_HANDLE(remote_reader->local_writer->participant));
+  if (key_material)
   {
-    key_material = (participant_key_material *)crypto_object_table_find(
-        remote_participant->key_material, CRYPTO_OBJECT_HANDLE(local_writer->participant));
-    if (key_material)
-    {
-      remove_relation_from_keymaterial(key_material, (CryptoObject *)local_writer, (CryptoObject *)remote_reader);
-      CRYPTO_OBJECT_RELEASE(key_material);
-    }
-    CRYPTO_OBJECT_RELEASE(local_writer);
+    remove_relation_from_keymaterial(key_material, (CryptoObject *)remote_reader->local_writer, (CryptoObject *)remote_reader);
+    CRYPTO_OBJECT_RELEASE(key_material);
   }
 }
 
@@ -562,6 +557,7 @@ register_local_datawriter(
   crypto_object_table_insert(implementation->crypto_objects, (CryptoObject *)writer_crypto);
   CRYPTO_OBJECT_RELEASE(participant_crypto);
   CRYPTO_OBJECT_RELEASE(writer_crypto);
+
   return writer_crypto->_parent.handle;
 
 err_random_generation:
@@ -619,7 +615,7 @@ register_matched_remote_datareader(
   data_protectionKind = local_writer->data_protectionKind;
   metadata_protectionKind = local_writer->metadata_protectionKind;
 
-  reader_crypto = crypto_remote_datareader_crypto__new(remote_participant, metadata_protectionKind, data_protectionKind, local_datawriter_crypto_handle);
+  reader_crypto = crypto_remote_datareader_crypto__new(remote_participant, metadata_protectionKind, data_protectionKind, local_writer);
 
   /* check if the writer is BuiltinParticipantVolatileMessageSecureWriter */
   if (local_writer->is_builtin_participant_volatile_message_secure_writer)
@@ -667,6 +663,7 @@ register_matched_remote_datareader(
   CRYPTO_OBJECT_RELEASE(remote_participant);
   CRYPTO_OBJECT_RELEASE(local_writer);
   CRYPTO_OBJECT_RELEASE(reader_crypto);
+
   return DATAREADER_CRYPTO_HANDLE(reader_crypto);
 
 err_random_generation:
@@ -736,6 +733,7 @@ register_local_datareader(
   crypto_object_table_insert(implementation->crypto_objects, (CryptoObject *)reader_crypto);
   CRYPTO_OBJECT_RELEASE(participant_crypto);
   CRYPTO_OBJECT_RELEASE(reader_crypto);
+
   return DATAREADER_CRYPTO_HANDLE(reader_crypto);
 
 err_random_generation:
@@ -786,8 +784,7 @@ register_matched_remote_datawriter(
     goto err_invalid_parameter;
   }
 
-  writer_crypto = crypto_remote_datawriter_crypto__new(remote_participant, local_reader->metadata_protectionKind,
-      local_reader->data_protectionKind, local_datareader_crypto_handle);
+  writer_crypto = crypto_remote_datawriter_crypto__new(remote_participant, local_reader->metadata_protectionKind, local_reader->data_protectionKind, local_reader);
 
   /* check if the writer is BuiltinParticipantVolatileMessageSecureWriter */
   if (local_reader->is_builtin_participant_volatile_message_secure_reader)
@@ -833,6 +830,7 @@ register_matched_remote_datawriter(
   CRYPTO_OBJECT_RELEASE(remote_participant);
   CRYPTO_OBJECT_RELEASE(local_reader);
   CRYPTO_OBJECT_RELEASE(writer_crypto);
+
   return DATAREADER_CRYPTO_HANDLE(writer_crypto);
 
 err_random_generation:
@@ -983,6 +981,51 @@ void dds_security_crypto_key_factory__dealloc(dds_security_crypto_key_factory *i
   ddsrt_free(implementation);
 }
 
+
+bool
+crypto_factory_get_protection_kind(
+    const dds_security_crypto_key_factory *factory,
+    int64_t handle,
+    DDS_Security_ProtectionKind *kind)
+{
+  const dds_security_crypto_key_factory_impl *impl = (const dds_security_crypto_key_factory_impl *)factory;
+  CryptoObject *obj;
+  bool result = true;
+
+  obj = crypto_object_table_find(impl->crypto_objects, handle);
+  if (!obj)
+  {
+    return false;
+  }
+
+  switch (obj->kind)
+  {
+  case CRYPTO_OBJECT_KIND_LOCAL_CRYPTO:
+    *kind = ((local_participant_crypto *)obj)->rtps_protection_kind;
+    break;
+  case CRYPTO_OBJECT_KIND_REMOTE_CRYPTO:
+    *kind = ((remote_participant_crypto *)obj)->rtps_protection_kind;
+    break;
+  case CRYPTO_OBJECT_KIND_LOCAL_WRITER_CRYPTO:
+    *kind = ((local_datawriter_crypto *)obj)->metadata_protectionKind;
+    break;
+  case CRYPTO_OBJECT_KIND_REMOTE_WRITER_CRYPTO:
+    *kind = ((remote_datawriter_crypto *)obj)->metadata_protectionKind;
+    break;
+  case CRYPTO_OBJECT_KIND_LOCAL_READER_CRYPTO:
+    *kind = ((local_datareader_crypto *)obj)->metadata_protectionKind;
+    break;
+  case CRYPTO_OBJECT_KIND_REMOTE_READER_CRYPTO:
+    *kind = ((remote_datareader_crypto *)obj)->metadata_protectionKind;
+    break;
+  default:
+    result = false;
+    break;
+  }
+  CRYPTO_OBJECT_RELEASE(obj);
+  return result;
+}
+
 bool
 crypto_factory_get_participant_crypto_tokens(
     const dds_security_crypto_key_factory *factory,
@@ -1110,7 +1153,7 @@ crypto_factory_get_datawriter_crypto_tokens(
     goto err_inv_remote;
   }
 
-  if (remote_reader_crypto->local_writer_handle != local_writer_handle)
+  if (CRYPTO_OBJECT_HANDLE(remote_reader_crypto->local_writer) != local_writer_handle)
   {
     DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_CODE, 0,
         DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_MESSAGE);
@@ -1180,7 +1223,7 @@ crypto_factory_set_datawriter_crypto_tokens(
     goto err_inv_local;
   }
 
-  if (remote_writer_crypto->local_reader_handle != local_reader_handle)
+  if (CRYPTO_OBJECT_HANDLE(remote_writer_crypto->local_reader) != local_reader_handle)
   {
     DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_CODE, 0,
         DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_MESSAGE);
@@ -1254,7 +1297,7 @@ crypto_factory_get_datareader_crypto_tokens(
     goto err_inv_remote;
   }
 
-  if (remote_writer_crypto->local_reader_handle != local_reader_handle)
+  if (CRYPTO_OBJECT_HANDLE(remote_writer_crypto->local_reader) != local_reader_handle)
   {
     DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_CODE, 0,
         DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_MESSAGE);
@@ -1317,7 +1360,7 @@ crypto_factory_set_datareader_crypto_tokens(
     goto err_inv_local;
   }
 
-  if (remote_reader_crypto->local_writer_handle != local_writer_handle)
+  if (CRYPTO_OBJECT_HANDLE(remote_reader_crypto->local_writer) != local_writer_handle)
   {
     DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_CODE, 0,
         DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_MESSAGE);
@@ -1582,7 +1625,7 @@ crypto_factory_get_remote_writer_key_material(
         DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_MESSAGE);
     goto err_inv_crypto;
   }
-  if (writer_crypto->local_reader_handle != reader_id)
+  if (CRYPTO_OBJECT_HANDLE(writer_crypto->local_reader) != reader_id)
   {
     DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_CODE, 0,
         DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_MESSAGE);
@@ -1646,7 +1689,7 @@ crypto_factory_get_remote_reader_key_material(
                                DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_MESSAGE);
     goto err_inv_crypto;
   }
-  if (reader_crypto->local_writer_handle != writer_id)
+  if (CRYPTO_OBJECT_HANDLE(reader_crypto->local_writer) != writer_id)
   {
     DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT,
                                DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_CODE, 0,
diff --git a/src/security/builtin_plugins/cryptographic/src/crypto_key_factory.h b/src/security/builtin_plugins/cryptographic/src/crypto_key_factory.h
index 5818b37..2fec8d7 100644
--- a/src/security/builtin_plugins/cryptographic/src/crypto_key_factory.h
+++ b/src/security/builtin_plugins/cryptographic/src/crypto_key_factory.h
@@ -29,6 +29,11 @@ int generate_key_pairs(
     char **private_key,
     char **public_key);
 
+bool crypto_factory_get_protection_kind(
+    const dds_security_crypto_key_factory *factory,
+    int64_t handle,
+    DDS_Security_ProtectionKind *kind);
+
 bool crypto_factory_get_participant_crypto_tokens(
     const dds_security_crypto_key_factory *factory,
     DDS_Security_ParticipantCryptoHandle local_id,
diff --git a/src/security/builtin_plugins/cryptographic/src/crypto_objects.c b/src/security/builtin_plugins/cryptographic/src/crypto_objects.c
index 8fa9a06..86b1ea0 100644
--- a/src/security/builtin_plugins/cryptographic/src/crypto_objects.c
+++ b/src/security/builtin_plugins/cryptographic/src/crypto_objects.c
@@ -11,6 +11,7 @@
  */
 #include <assert.h>
 #include <string.h>
+#include <stdio.h>
 #include "dds/ddsrt/heap.h"
 #include "dds/ddsrt/hopscotch.h"
 #include "dds/ddsrt/types.h"
@@ -63,7 +64,9 @@ void crypto_object_free(CryptoObject *obj)
 CryptoObject * crypto_object_keep(CryptoObject *obj)
 {
   if (obj)
+  {
     ddsrt_atomic_inc32(&obj->refcount);
+  }
   return obj;
 }
 
@@ -455,6 +458,7 @@ static void remote_datawriter_crypto__free(CryptoObject *obj)
     CRYPTO_OBJECT_RELEASE(datawriter_crypto->reader2writer_key_material);
     CRYPTO_OBJECT_RELEASE(datawriter_crypto->writer2reader_key_material[0]);
     CRYPTO_OBJECT_RELEASE(datawriter_crypto->writer2reader_key_material[1]);
+    CRYPTO_OBJECT_RELEASE(datawriter_crypto->local_reader);
     CRYPTO_OBJECT_RELEASE(datawriter_crypto->participant);
     crypto_object_deinit((CryptoObject *)datawriter_crypto);
     ddsrt_free(datawriter_crypto);
@@ -462,14 +466,14 @@ static void remote_datawriter_crypto__free(CryptoObject *obj)
 }
 
 remote_datawriter_crypto * crypto_remote_datawriter_crypto__new(const remote_participant_crypto *participant,
-    DDS_Security_ProtectionKind meta_protection, DDS_Security_BasicProtectionKind data_protection, DDS_Security_DatareaderCryptoHandle local_reader_handle)
+    DDS_Security_ProtectionKind meta_protection, DDS_Security_BasicProtectionKind data_protection, local_datareader_crypto *local_reader)
 {
   remote_datawriter_crypto *writer_crypto = ddsrt_calloc(1, sizeof(*writer_crypto));
   crypto_object_init((CryptoObject *)writer_crypto, CRYPTO_OBJECT_KIND_REMOTE_WRITER_CRYPTO, remote_datawriter_crypto__free);
   writer_crypto->participant = (remote_participant_crypto *)CRYPTO_OBJECT_KEEP(participant);
   writer_crypto->metadata_protectionKind = meta_protection;
   writer_crypto->data_protectionKind = data_protection;
-  writer_crypto->local_reader_handle = local_reader_handle;
+  writer_crypto->local_reader = (local_datareader_crypto *)CRYPTO_OBJECT_KEEP(local_reader);
   writer_crypto->is_builtin_participant_volatile_message_secure_writer = false;
 
   return writer_crypto;
@@ -514,6 +518,7 @@ static void remote_datareader_crypto__free(CryptoObject *obj)
     CRYPTO_OBJECT_RELEASE(datareader_crypto->reader2writer_key_material);
     CRYPTO_OBJECT_RELEASE(datareader_crypto->writer2reader_key_material_message);
     CRYPTO_OBJECT_RELEASE(datareader_crypto->writer2reader_key_material_payload);
+    CRYPTO_OBJECT_RELEASE(datareader_crypto->local_writer);
     CRYPTO_OBJECT_RELEASE(datareader_crypto->participant);
     crypto_object_deinit((CryptoObject *)datareader_crypto);
     ddsrt_free(datareader_crypto);
@@ -521,14 +526,14 @@ static void remote_datareader_crypto__free(CryptoObject *obj)
 }
 
 remote_datareader_crypto *crypto_remote_datareader_crypto__new(const remote_participant_crypto *participant, DDS_Security_ProtectionKind metadata_protectionKind,
-    DDS_Security_BasicProtectionKind data_protectionKind, DDS_Security_DatawriterCryptoHandle local_writer_handle)
+    DDS_Security_BasicProtectionKind data_protectionKind, local_datawriter_crypto *local_writer)
 {
   remote_datareader_crypto *reader_crypto = ddsrt_calloc(1, sizeof(*reader_crypto));
   crypto_object_init((CryptoObject *)reader_crypto, CRYPTO_OBJECT_KIND_REMOTE_READER_CRYPTO, remote_datareader_crypto__free);
   reader_crypto->participant = (remote_participant_crypto *)CRYPTO_OBJECT_KEEP(participant);
   reader_crypto->metadata_protectionKind = metadata_protectionKind;
   reader_crypto->data_protectionKind = data_protectionKind;
-  reader_crypto->local_writer_handle = local_writer_handle;
+  reader_crypto->local_writer = (local_datawriter_crypto *)CRYPTO_OBJECT_KEEP(local_writer);
   reader_crypto->is_builtin_participant_volatile_message_secure_reader = false;
 
   return reader_crypto;
diff --git a/src/security/builtin_plugins/cryptographic/src/crypto_objects.h b/src/security/builtin_plugins/cryptographic/src/crypto_objects.h
index 3edb6a4..9a55570 100644
--- a/src/security/builtin_plugins/cryptographic/src/crypto_objects.h
+++ b/src/security/builtin_plugins/cryptographic/src/crypto_objects.h
@@ -165,7 +165,7 @@ typedef struct remote_datawriter_crypto
   master_key_material *reader2writer_key_material;
   master_key_material *writer2reader_key_material[2];
   session_key_material *reader_session; /* reference to the session key used by the reader */
-  DDS_Security_DatareaderCryptoHandle local_reader_handle;
+  struct local_datareader_crypto *local_reader;
   bool is_builtin_participant_volatile_message_secure_writer;
 } remote_datawriter_crypto;
 
@@ -190,7 +190,7 @@ typedef struct remote_datareader_crypto
   master_key_material *writer2reader_key_material_message;
   master_key_material *writer2reader_key_material_payload;
   session_key_material *writer_session; /* reference to the session key used by the writer */
-  DDS_Security_DatawriterCryptoHandle local_writer_handle;
+  local_datawriter_crypto *local_writer;
   bool is_builtin_participant_volatile_message_secure_reader;
 } remote_datareader_crypto;
 
@@ -257,7 +257,7 @@ crypto_remote_datareader_crypto__new(
     const remote_participant_crypto *participant,
     DDS_Security_ProtectionKind metadata_protectionKind,
     DDS_Security_BasicProtectionKind data_protectionKind,
-    DDS_Security_DatawriterCryptoHandle local_writer_handle);
+    local_datawriter_crypto *local_writer);
 
 local_datareader_crypto *
 crypto_local_datareader_crypto__new(
@@ -270,7 +270,7 @@ crypto_remote_datawriter_crypto__new(
     const remote_participant_crypto *participant,
     DDS_Security_ProtectionKind meta_protection,
     DDS_Security_BasicProtectionKind data_protection,
-    DDS_Security_DatareaderCryptoHandle local_reader_handle);
+    local_datareader_crypto *local_reader);
 
 CryptoObject *
 crypto_object_keep(
diff --git a/src/security/builtin_plugins/tests/set_remote_datareader_crypto_tokens/src/set_remote_datareader_crypto_tokens_utests.c b/src/security/builtin_plugins/tests/set_remote_datareader_crypto_tokens/src/set_remote_datareader_crypto_tokens_utests.c
index c8297bb..68e3448 100644
--- a/src/security/builtin_plugins/tests/set_remote_datareader_crypto_tokens/src/set_remote_datareader_crypto_tokens_utests.c
+++ b/src/security/builtin_plugins/tests/set_remote_datareader_crypto_tokens/src/set_remote_datareader_crypto_tokens_utests.c
@@ -149,6 +149,7 @@ register_local_datawriter(void)
   memset(&datawriter_security_attributes, 0, sizeof(DDS_Security_EndpointSecurityAttributes));
 
   datawriter_security_attributes.is_discovery_protected = true;
+  datawriter_security_attributes.is_submessage_protected = true;
 
   local_writer_crypto =
       crypto->crypto_key_factory->register_local_datawriter(
diff --git a/src/security/builtin_plugins/tests/set_remote_datawriter_crypto_tokens/src/set_remote_datawriter_crypto_tokens_utests.c b/src/security/builtin_plugins/tests/set_remote_datawriter_crypto_tokens/src/set_remote_datawriter_crypto_tokens_utests.c
index 90c8112..a223604 100644
--- a/src/security/builtin_plugins/tests/set_remote_datawriter_crypto_tokens/src/set_remote_datawriter_crypto_tokens_utests.c
+++ b/src/security/builtin_plugins/tests/set_remote_datawriter_crypto_tokens/src/set_remote_datawriter_crypto_tokens_utests.c
@@ -141,6 +141,7 @@ static int register_local_datareader(void)
   memset(&datareader_properties, 0, sizeof(datareader_properties));
   memset(&datareader_security_attributes, 0, sizeof(datareader_security_attributes));
   datareader_security_attributes.is_discovery_protected = true;
+  datareader_security_attributes.is_submessage_protected = true;
 
   local_reader_crypto =
       crypto->crypto_key_factory->register_local_datareader(
diff --git a/src/security/core/CMakeLists.txt b/src/security/core/CMakeLists.txt
index 8719946..41ea708 100644
--- a/src/security/core/CMakeLists.txt
+++ b/src/security/core/CMakeLists.txt
@@ -53,7 +53,8 @@ target_include_directories(security_core
 
 if(BUILD_TESTING)
   add_subdirectory(tests)
-  add_subdirectory(tests/plugin_loading)
+# Temporarily disabled because needs refractoring w.r.t. security implementation
+#  add_subdirectory(tests/plugin_loading)
 endif()
 
 install(
diff --git a/src/security/core/include/dds/security/core/dds_security_utils.h b/src/security/core/include/dds/security/core/dds_security_utils.h
index a66c4d3..d6a745e 100644
--- a/src/security/core/include/dds/security/core/dds_security_utils.h
+++ b/src/security/core/include/dds/security/core/dds_security_utils.h
@@ -26,8 +26,8 @@ typedef DDS_Security_long_long DDS_Security_Handle;
 typedef DDS_Security_LongLongSeq DDS_Security_HandleSeq;
 
 #define DDS_SECURITY_SEQUENCE_INIT   {0, 0, NULL}
-#define DDS_SECURITY_TOKEN_INIT {NULL, DDS_SECURITY_SEQUENCE_INIT, DDS_SECURITY_SEQUENCE_INIT}
-
+#define DDS_SECURITY_TOKEN_INIT      {NULL, DDS_SECURITY_SEQUENCE_INIT, DDS_SECURITY_SEQUENCE_INIT}
+#define DDS_SECURITY_EXCEPTION_INIT  {NULL, 0, 0}
 
 typedef enum {
     DDS_SECURITY_CONFIG_ITEM_PREFIX_UNKNOWN,
diff --git a/src/security/core/src/dds_security_fsm.c b/src/security/core/src/dds_security_fsm.c
index ce1a2bb..8685ed0 100644
--- a/src/security/core/src/dds_security_fsm.c
+++ b/src/security/core/src/dds_security_fsm.c
@@ -49,7 +49,8 @@ struct dds_security_fsm
 {
   struct dds_security_fsm *next_fsm;
   struct dds_security_fsm *prev_fsm;
-  bool active;
+  bool busy;
+  bool deleting;
   struct dds_security_fsm_control *control;
   const dds_security_fsm_transition *transitions;
   uint32_t size;
@@ -69,8 +70,10 @@ struct dds_security_fsm_control
   struct ddsi_domaingv *gv;
   struct dds_security_fsm *first_fsm;
   struct dds_security_fsm *last_fsm;
-  struct fsm_event *event_queue;
+  struct fsm_event *first_event;
+  struct fsm_event *last_event;
   ddsrt_fibheap_t timers;
+  ddsrt_thread_t tid;
   bool running;
 };
 
@@ -86,6 +89,68 @@ static int compare_timer_event (const void *va, const void *vb)
   return (a->endtime == b->endtime) ? 0 : (a->endtime < b->endtime) ? -1 : 1;
 }
 
+static void append_event(struct dds_security_fsm_control *control, struct fsm_event *event)
+{
+  event->next = NULL;
+  event->prev = control->last_event;
+  if (control->last_event)
+    control->last_event->next = event;
+  else
+    control->first_event = event;
+  control->last_event = event;
+}
+
+static void insert_event(struct dds_security_fsm_control *control, struct fsm_event *event)
+{
+  event->prev = NULL;
+  event->next = control->first_event;
+  if (control->first_event)
+    control->first_event->prev = event;
+  else
+    control->last_event = event;
+  control->first_event = event;
+}
+
+static struct fsm_event *get_event(struct dds_security_fsm_control *control)
+{
+  struct fsm_event *event = control->first_event;
+
+  if (event)
+  {
+    control->first_event = event->next;
+    if (event->next)
+        event->next->prev = NULL;
+    else
+      control->last_event = NULL;
+    event->next = NULL;
+    event->prev = NULL;
+  }
+  return event;
+}
+
+static void remove_events(struct dds_security_fsm_control *control, struct dds_security_fsm *fsm)
+{
+  struct fsm_event *event = control->first_event;
+
+  while (event)
+  {
+    struct fsm_event *next = event->next;
+    if (event->fsm == fsm)
+    {
+      if (event->prev)
+        event->prev->next = event->next;
+      else
+        control->first_event = event->next;
+      if (event->next)
+        event->next->prev = event->prev;
+      else
+        control->last_event = event->prev;
+      ddsrt_free(event);
+    }
+    event = next;
+  }
+}
+
 static void fsm_dispatch (struct dds_security_fsm *fsm, int event_id, bool lifo)
 {
   struct dds_security_fsm_control *control = fsm->control;
@@ -103,26 +168,10 @@ static void fsm_dispatch (struct dds_security_fsm *fsm, int event_id, bool lifo)
   event->next = NULL;
   event->prev = NULL;
 
-  if (lifo) {
-    /* Insert event at the top of the event list */
-    if (control->event_queue) {
-       control->event_queue->prev = event;
-    }
-    event->next = control->event_queue;
-    control->event_queue = event;
-  } else {
-    /* Insert FIFO event */
-    if (control->event_queue) {
-      struct fsm_event *last = control->event_queue;
-      while (last->next != NULL ) {
-        last = last->next;
-      }
-      last->next = event;
-      event->prev = last;
-    } else {
-      control->event_queue = event;
-    }
-  }
+  if (lifo)
+    insert_event(control, event);
+  else
+    append_event(control, event);
 }
 
 static void set_state_timer (struct dds_security_fsm *fsm)
@@ -142,16 +191,18 @@ static void clear_state_timer (struct dds_security_fsm *fsm)
 {
   struct dds_security_fsm_control *control = fsm->control;
 
-  if (fsm->current && fsm->state_timeout_event.endtime != DDS_NEVER)
+  if (fsm->state_timeout_event.endtime != DDS_NEVER)
     ddsrt_fibheap_delete (&timer_events_fhdef, &control->timers, &fsm->state_timeout_event);
+  fsm->state_timeout_event.endtime = DDS_NEVER;
 }
 
 static void clear_overall_timer (struct dds_security_fsm *fsm)
 {
   struct dds_security_fsm_control *control = fsm->control;
 
-  if (fsm->current && fsm->overall_timeout_event.endtime != DDS_NEVER)
+  if (fsm->overall_timeout_event.endtime != DDS_NEVER)
     ddsrt_fibheap_delete (&timer_events_fhdef, &control->timers, &fsm->overall_timeout_event);
+  fsm->overall_timeout_event.endtime = DDS_NEVER;
 }
 
 static dds_time_t first_timeout (struct dds_security_fsm_control *control)
@@ -185,57 +236,57 @@ static void fsm_state_change (struct thread_state1 *ts1, struct dds_security_fsm
   int event_id = event->event_id;
   uint32_t i;
 
-  if (fsm->active)
+  if (fsm->debug_func)
+    fsm->debug_func (fsm, DDS_SECURITY_FSM_DEBUG_ACT_HANDLING, fsm->current, event_id, fsm->arg);
+
+  for (i = 0; i < fsm->size; i++)
   {
-    if (fsm->debug_func)
-      fsm->debug_func (fsm, DDS_SECURITY_FSM_DEBUG_ACT_HANDLING, fsm->current, event_id, fsm->arg);
-
-    for (i = 0; i < fsm->size; i++)
+    if ((fsm->transitions[i].begin == fsm->current) && (fsm->transitions[i].event_id == event_id))
     {
-      if ((fsm->transitions[i].begin == fsm->current) && (fsm->transitions[i].event_id == event_id))
-      {
-        clear_state_timer (fsm);
-        fsm->current = fsm->transitions[i].end;
-        set_state_timer (fsm);
+      clear_state_timer (fsm);
+      fsm->current = fsm->transitions[i].end;
+      set_state_timer (fsm);
+      fsm->busy = true;
 
-        ddsrt_mutex_unlock (&control->lock);
+      ddsrt_mutex_unlock (&control->lock);
 
-        thread_state_asleep (ts1);
-        if (fsm->transitions[i].func)
-          fsm->transitions[i].func (fsm, fsm->arg);
-        if (fsm->current && fsm->current->func)
-          fsm->current->func (fsm, fsm->arg);
+      thread_state_awake (ts1, control->gv);
+      if (fsm->transitions[i].func)
+        fsm->transitions[i].func (fsm, fsm->arg);
+      if (fsm->current && fsm->current->func)
+        fsm->current->func (fsm, fsm->arg);
 
-        thread_state_awake (ts1, control->gv);
-        ddsrt_mutex_lock (&control->lock);
+      thread_state_asleep (ts1);
+      ddsrt_mutex_lock (&control->lock);
+      fsm->busy = false;
+      if (!fsm->deleting)
         fsm_check_auto_state_change (fsm);
-        break;
-      }
+      else
+        ddsrt_cond_broadcast(&control->cond);
+      break;
     }
   }
-  else if (event_id == DDS_SECURITY_FSM_EVENT_DELETE)
-    fsm_delete (control, fsm);
-
 }
 
 static void fsm_handle_timeout (struct dds_security_fsm_control *control, struct fsm_timer_event *timer_event)
 {
   struct dds_security_fsm *fsm = timer_event->fsm;
 
-  if (fsm->active)
+  switch (timer_event->kind)
   {
-    switch (timer_event->kind)
-    {
-    case FSM_TIMEOUT_STATE:
-      fsm_dispatch (fsm, DDS_SECURITY_FSM_EVENT_TIMEOUT, true);
-      break;
-    case FSM_TIMEOUT_OVERALL:
-      ddsrt_mutex_unlock (&control->lock);
-      if (fsm->overall_timeout_action)
-        fsm->overall_timeout_action (fsm, fsm->arg);
-      ddsrt_mutex_lock (&control->lock);
-      break;
-    }
+  case FSM_TIMEOUT_STATE:
+    fsm_dispatch (fsm, DDS_SECURITY_FSM_EVENT_TIMEOUT, true);
+    break;
+  case FSM_TIMEOUT_OVERALL:
+    fsm->busy = true;
+    ddsrt_mutex_unlock (&control->lock);
+    if (fsm->overall_timeout_action)
+      fsm->overall_timeout_action (fsm, fsm->arg);
+    ddsrt_mutex_lock (&control->lock);
+    fsm->busy = false;
+    if (fsm->deleting)
+      ddsrt_cond_broadcast(&control->cond);
+    break;
   }
 
   /* mark timer event as being processed */
@@ -245,17 +296,16 @@ static void fsm_handle_timeout (struct dds_security_fsm_control *control, struct
 static uint32_t handle_events (struct dds_security_fsm_control *control)
 {
   struct thread_state1 * const ts1 = lookup_thread_state ();
+  struct fsm_event *event;
+
+  control->tid = ddsrt_thread_self();
+
   thread_state_awake (ts1, control->gv);
   ddsrt_mutex_lock (&control->lock);
   while (control->running)
   {
-    if (control->event_queue)
+    if ((event = get_event(control)) != NULL)
     {
-      struct fsm_event *event = control->event_queue;
-
-      control->event_queue = event->next;
-      if (control->event_queue)
-        control->event_queue->prev = NULL;
       fsm_state_change (ts1, control, event);
       ddsrt_free (event);
     }
@@ -288,7 +338,7 @@ void dds_security_fsm_set_timeout (struct dds_security_fsm *fsm, dds_security_fs
   assert(timeout > 0);
 
   ddsrt_mutex_lock (&fsm->control->lock);
-  if (fsm->active)
+  if (!fsm->deleting)
   {
     if (timeout != DDS_NEVER)
     {
@@ -297,7 +347,7 @@ void dds_security_fsm_set_timeout (struct dds_security_fsm *fsm, dds_security_fs
       fsm->overall_timeout_event.endtime = ddsrt_time_add_duration(dds_time(), timeout);
       ddsrt_fibheap_insert (&timer_events_fhdef, &fsm->control->timers, &fsm->overall_timeout_event);
       if (fsm->overall_timeout_event.endtime < first_timeout(fsm->control))
-        ddsrt_cond_signal (&fsm->control->cond);
+        ddsrt_cond_broadcast (&fsm->control->cond);
     }
     else
       clear_overall_timer (fsm);
@@ -311,10 +361,10 @@ void dds_security_fsm_dispatch (struct dds_security_fsm *fsm, int32_t event_id,
   assert(fsm->control);
 
   ddsrt_mutex_lock (&fsm->control->lock);
-  if (fsm->active)
+  if (!fsm->deleting)
   {
     fsm_dispatch (fsm, event_id, prio);
-    ddsrt_cond_signal (&fsm->control->cond);
+    ddsrt_cond_broadcast (&fsm->control->cond);
   }
   ddsrt_mutex_unlock (&fsm->control->lock);
 }
@@ -324,7 +374,6 @@ const dds_security_fsm_state * dds_security_fsm_current_state (struct dds_securi
   const dds_security_fsm_state *state;
 
   assert(fsm);
-  assert(fsm->active);
 
   ddsrt_mutex_lock (&fsm->control->lock);
   state = fsm->current;
@@ -407,7 +456,8 @@ struct dds_security_fsm * dds_security_fsm_create (struct dds_security_fsm_contr
     fsm->overall_timeout_event.kind = FSM_TIMEOUT_OVERALL;
     fsm->overall_timeout_event.endtime = DDS_NEVER;
     fsm->overall_timeout_event.fsm = fsm;
-    fsm->active = true;
+    fsm->busy = false;
+    fsm->deleting = false;
     fsm->next_fsm = NULL;
     fsm->prev_fsm = NULL;
     fsm->control = control;
@@ -425,16 +475,17 @@ dds_security_fsm_start (struct dds_security_fsm *fsm)
   dds_security_fsm_dispatch(fsm, DDS_SECURITY_FSM_EVENT_AUTO, false);
 }
 
-static void fsm_deactivate (struct dds_security_fsm *fsm, bool gen_del_event)
+static void fsm_deactivate (struct dds_security_fsm_control *control, struct dds_security_fsm *fsm)
 {
-  if (fsm->active)
+  fsm->deleting = true;
+  remove_events(control, fsm);
+  clear_state_timer (fsm);
+  clear_overall_timer (fsm);
+  fsm->current = NULL;
+  if (!ddsrt_thread_equal(control->tid, ddsrt_thread_self()))
   {
-    fsm->active = false;
-    clear_state_timer (fsm);
-    clear_overall_timer (fsm);
-    fsm->current = NULL;
-    if (gen_del_event)
-      fsm_dispatch (fsm, DDS_SECURITY_FSM_EVENT_DELETE, false);
+    while (fsm->busy)
+      ddsrt_cond_wait(&control->cond, &control->lock);
   }
 }
 
@@ -447,14 +498,14 @@ void dds_security_fsm_free (struct dds_security_fsm *fsm)
 
   control = fsm->control;
   ddsrt_mutex_lock (&control->lock);
-  fsm_deactivate (fsm, true);
+  fsm_deactivate (control, fsm);
   ddsrt_mutex_unlock (&control->lock);
 }
 
 static void fsm_delete (struct dds_security_fsm_control *control, struct dds_security_fsm *fsm)
 {
-  fsm_deactivate (fsm, false);
   remove_fsm_from_list (control, fsm);
+  fsm_deactivate (control, fsm);
   ddsrt_free(fsm);
 }
 
@@ -464,7 +515,8 @@ struct dds_security_fsm_control * dds_security_fsm_control_create (struct ddsi_d
 
   control = ddsrt_malloc (sizeof(*control));
   control->running = false;
-  control->event_queue = NULL;
+  control->first_event = NULL;
+  control->last_event = NULL;
   control->first_fsm = NULL;
   control->last_fsm = NULL;
   control->gv = gv;
@@ -486,12 +538,11 @@ void dds_security_fsm_control_free (struct dds_security_fsm_control *control)
   while ((fsm = control->first_fsm) != NULL)
   {
     control->first_fsm = fsm->next_fsm;
-    fsm_deactivate (fsm, false);
-    ddsrt_free (fsm);
+    fsm_delete (control, fsm);
   }
-  while ((event = control->event_queue) != NULL)
+  while ((event = control->first_event) != NULL)
   {
-    control->event_queue = event->next;
+    control->first_event = event->next;
     ddsrt_free (event);
   }
 
@@ -520,7 +571,7 @@ void dds_security_fsm_control_stop (struct dds_security_fsm_control *control)
 
   ddsrt_mutex_lock (&control->lock);
   control->running = false;
-  ddsrt_cond_signal (&control->cond);
+  ddsrt_cond_broadcast (&control->cond);
   ddsrt_mutex_unlock (&control->lock);
 
   join_thread (control->ts);
diff --git a/src/security/core/src/dds_security_utils.c b/src/security/core/src/dds_security_utils.c
index 42610af..ea5a7d8 100644
--- a/src/security/core/src/dds_security_utils.c
+++ b/src/security/core/src/dds_security_utils.c
@@ -124,6 +124,7 @@ DDS_Security_BinaryProperty_set_by_value(
     bp->name = ddsrt_strdup(name);
     bp->value._length = length;
     bp->value._maximum = length;
+    bp->propagate = true;
     if (length) {
         bp->value._buffer = ddsrt_malloc(length);
         memcpy(bp->value._buffer, data, length);
@@ -164,6 +165,7 @@ DDS_Security_BinaryProperty_set_by_ref(
     bp->value._length = length;
     bp->value._maximum = length;
     bp->value._buffer = data;
+    bp->propagate = true;
 }
 
 DDS_Security_BinaryPropertySeq *
@@ -840,7 +842,7 @@ DDS_Security_Exception_set_with_openssl_error(
 
 void
 DDS_Security_Exception_reset(
-     DDS_Security_SecurityException *ex)
+    DDS_Security_SecurityException *ex)
 {
     if (ex) {
         if (ex->message) {
@@ -855,7 +857,9 @@ DDS_Security_Exception_clean(
      DDS_Security_SecurityException *ex)
 {
     if (ex) {
-        memset(ex, 0, sizeof(DDS_Security_SecurityException));
+      ex->code = 0;
+      ex->minor_code = 0;
+      ex->message = NULL;
     }
 }
 
diff --git a/src/security/core/tests/plugin_loading/plugin_loading.c b/src/security/core/tests/plugin_loading/plugin_loading.c
index b3d145d..09c6c0b 100644
--- a/src/security/core/tests/plugin_loading/plugin_loading.c
+++ b/src/security/core/tests/plugin_loading/plugin_loading.c
@@ -20,6 +20,7 @@
 #include "dds/ddsrt/cdtors.h"
 #include "dds/ddsrt/environ.h"
 #include "dds/ddsrt/heap.h"
+#include "plugin_mock_common.h"
 //#include "dds/ddsi/ddsi_security_omg.h"
 
 #define FORCE_ENV
@@ -87,7 +88,7 @@ static uint32_t found;
 static void logger(void *ptr, const dds_log_data_t *data) {
   char **expected = (char **) ptr;
   if (print_log) {
-    printf("%s\n", data->message);
+    fputs(data->message, stdout);
   }
   for (uint32_t i = 0; expected[i] != NULL; i++) {
       if (patmatch(expected[i], data->message)) {
@@ -112,9 +113,9 @@ CU_Test(ddssec_security_plugin_loading, all_ok, .init = ddsrt_init, .fini = ddsr
           "<DDSSecurity>"
             "<Authentication>"
               "<Library path=\"dds_security_authentication_all_ok\" initFunction=\"init_authentication\" finalizeFunction=\"finalize_authentication\" />"
-              "<IdentityCertificate>testtext_IdentityCertificate_testtext</IdentityCertificate>"
-              "<IdentityCA>testtext_IdentityCA_testtext</IdentityCA>"
-              "<PrivateKey>testtext_PrivateKey_testtext</PrivateKey>"
+              "<IdentityCertificate>"TEST_IDENTITY_CERTIFICATE_ALL_OK"</IdentityCertificate>"
+              "<IdentityCA>"TEST_CA_CERTIFICATE_ALL_OK"</IdentityCA>"
+              "<PrivateKey>"TEST_PRIVATE_KEY_ALL_OK"</PrivateKey>"
               "<Password>testtext_Password_testtext</Password>"
               "<TrustedCADirectory>testtext_Dir_testtext</TrustedCADirectory>"
             "</Authentication>"
@@ -469,7 +470,7 @@ CU_Test(ddssec_security_plugin_loading, no_library_in_path, .init = ddsrt_init,
 #else
   dds_delete(participant);
 #endif
-  
+
   CU_ASSERT_FATAL(found == 0xd || found == 0xe);
 
   dds_delete(participant);
@@ -551,13 +552,13 @@ CU_Test(ddssec_security_plugin_loading, all_ok_with_props, .init = ddsrt_init, .
 
   dds_entity_t participant;
   dds_qos_t * qos;
-  
-  
+
+
   /* Set up the trace sinks to detect the config parsing. */
   dds_set_log_mask(DDS_LC_INFO);
   dds_set_log_sink(&logger, (void*)log_expected);
   dds_set_trace_sink(&logger, (void*)log_expected);
-  
+
   /* Create the qos */
   unsigned char bvalue[3] = { 0x01, 0x02, 0x03 };
   CU_ASSERT_FATAL ((qos = dds_create_qos()) != NULL);
diff --git a/src/security/core/tests/plugin_loading/plugin_mock/authentication_all_ok/mock_authentication.c b/src/security/core/tests/plugin_loading/plugin_mock/authentication_all_ok/mock_authentication.c
index cfe680a..03f9666 100644
--- a/src/security/core/tests/plugin_loading/plugin_mock/authentication_all_ok/mock_authentication.c
+++ b/src/security/core/tests/plugin_loading/plugin_mock/authentication_all_ok/mock_authentication.c
@@ -28,6 +28,11 @@ typedef struct dds_security_authentication_impl {
   int id; //sample internal member
 } dds_security_authentication_impl;
 
+
+static const char *test_identity_certificate = TEST_IDENTITY_CERTIFICATE_ALL_OK;
+static const char *test_ca_certificate       = TEST_CA_CERTIFICATE_ALL_OK;
+static const char *test_private_key          = TEST_PRIVATE_KEY_ALL_OK;
+
 DDS_Security_ValidationResult_t validate_local_identity(
     dds_security_authentication *instance,
      DDS_Security_IdentityHandle *local_identity_handle,
@@ -76,14 +81,17 @@ DDS_Security_ValidationResult_t validate_local_identity(
   }
 
   if( strcmp(identity_certificate, test_identity_certificate) != 0){
-
+    printf("identity received=%s\n", identity_certificate);
+    printf("identity expected=%s\n", test_identity_certificate);
     result = DDS_SECURITY_VALIDATION_FAILED;
     printf("FAILED: Could not get identity_certificate value properly\n");
   }
   else if( strcmp(identity_ca, test_ca_certificate) != 0){
+    printf("ca received=%s\n", identity_ca);
+    printf("ca expected=%s\n", test_ca_certificate);
     printf("FAILED: Could not get identity_ca value properly\n");
     result = DDS_SECURITY_VALIDATION_FAILED;
-  }else if( strcmp(private_key, test_privatekey) != 0){
+  }else if( strcmp(private_key, test_private_key) != 0){
     printf("FAILED: Could not get private_key value properly\n");
     result = DDS_SECURITY_VALIDATION_FAILED;
   }
diff --git a/src/security/core/tests/plugin_loading/plugin_mock/authentication_all_ok/mock_authentication.h b/src/security/core/tests/plugin_loading/plugin_mock/authentication_all_ok/mock_authentication.h
index 56d297c..bb4479f 100644
--- a/src/security/core/tests/plugin_loading/plugin_mock/authentication_all_ok/mock_authentication.h
+++ b/src/security/core/tests/plugin_loading/plugin_mock/authentication_all_ok/mock_authentication.h
@@ -9,6 +9,7 @@
 #define SECURITY_BUILTIN_PLUGINS_AUTHENTICATION_H_
 
 #include "dds/security/authentication_all_ok_export.h"
+#include "../../plugin_mock_common.h"
 
 SECURITY_EXPORT int32_t
 init_authentication(const char *argument, void **context);
@@ -16,83 +17,6 @@ init_authentication(const char *argument, void **context);
 SECURITY_EXPORT int32_t
 finalize_authentication(void *context);
 
-char *test_identity_certificate="data:,-----BEGIN CERTIFICATE-----\n\
-MIIDYDCCAkigAwIBAgIBBDANBgkqhkiG9w0BAQsFADByMQswCQYDVQQGEwJOTDEL\n\
-MAkGA1UECBMCT1YxEzARBgNVBAoTCkFETGluayBJU1QxGTAXBgNVBAMTEElkZW50\n\
-aXR5IENBIFRlc3QxJjAkBgkqhkiG9w0BCQEWF2luZm9AaXN0LmFkbGlua3RlY2gu\n\
-Y29tMB4XDTE4MDMxMjAwMDAwMFoXDTI3MDMxMTIzNTk1OVowdTELMAkGA1UEBhMC\n\
-TkwxCzAJBgNVBAgTAk9WMRAwDgYDVQQKEwdBRExpbmsgMREwDwYDVQQLEwhJU1Qg\n\
-VGVzdDETMBEGA1UEAxMKQWxpY2UgVGVzdDEfMB0GCSqGSIb3DQEJARYQYWxpY2VA\n\
-YWRsaW5rLmlzdDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBANBW+tEZ\n\
-Baw7EQCEXyzH9n7IkZ8PQIKe8hG1LAOGYOF/oUYQZJO/HxbWoC4rFqOC20+A6is6\n\
-kFwr1Zzp/Wurk9CrFXo5Nomi6ActH6LUM57nYqN68w6U38z/XkQxVY/ESZ5dySfD\n\
-9Q1C8R+zdE8gwbimdYmwX7ioz336nghM2CoAHPDRthQeJupl8x4V7isOltr9CGx8\n\
-+imJXbGr39OK6u87cNLeu23sUkOIC0lSRMIqIQK3oJtHS70J2qecXdqp9MhE7Xky\n\
-/GPlI8ptQ1gJ8A3cAOvtI9mtMJMszs2EKWTLfeTcmfJHKKhKjvCgDdh3Jan4x5YP\n\
-Yg7HG6H+ceOUkMMCAwEAATANBgkqhkiG9w0BAQsFAAOCAQEAkvuqZzyJ3Nu4/Eo5\n\
-kD0nVgYGBUl7cspu+636q39zPSrxLEDMUWz+u8oXLpyGcgiZ8lZulPTV8dmOn+3C\n\
-Vg55c5C+gbnbX3MDyb3wB17296RmxYf6YNul4sFOmj6+g2i+Dw9WH0PBCVKbA84F\n\
-jR3Gx2Pfoifor3DvT0YFSsjNIRt090u4dQglbIb6cWEafC7O24t5jFhGPvJ7L9SE\n\
-gB0Drh/HmKTVuaqaRkoOKkKaKuWoXsszK1ZFda1DHommnR5LpYPsDRQ2fVM4EuBF\n\
-By03727uneuG8HLuNcLEV9H0i7LxtyfFkyCPUQvWG5jehb7xPOz/Ml26NAwwjlTJ\n\
-xEEFrw==\n\
------END CERTIFICATE-----";
-
-char *test_ca_certificate="data:,-----BEGIN CERTIFICATE-----\n\
-MIIEKTCCAxGgAwIBAgIBATANBgkqhkiG9w0BAQsFADByMQswCQYDVQQGEwJOTDEL\n\
-MAkGA1UECBMCT1YxEzARBgNVBAoTCkFETGluayBJU1QxGTAXBgNVBAMTEElkZW50\n\
-aXR5IENBIFRlc3QxJjAkBgkqhkiG9w0BCQEWF2luZm9AaXN0LmFkbGlua3RlY2gu\n\
-Y29tMB4XDTE4MDMxMjAwMDAwMFoXDTI3MDMxMTIzNTk1OVowcjELMAkGA1UEBhMC\n\
-TkwxCzAJBgNVBAgTAk9WMRMwEQYDVQQKEwpBRExpbmsgSVNUMRkwFwYDVQQDExBJ\n\
-ZGVudGl0eSBDQSBUZXN0MSYwJAYJKoZIhvcNAQkBFhdpbmZvQGlzdC5hZGxpbmt0\n\
-ZWNoLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBANa/ENFfGVXg\n\
-bPLTzBdDfiZQcp5dWZ//Pb8ErFOJu8uosVHFv8t69dgjHgNHB4OsjmjnR7GfKUZT\n\
-0cMvWJnjsC7DDlBwFET9rj4k40n96bbVCH9I7+tNhsoqzc6Eu+5h4sk7VfNGTM2Z\n\
-SyCd4GiSZRuA44rRbhXI7/LDpr4hY5J9ZDo5AM9ZyoLAoh774H3CZWD67S35XvUs\n\
-72dzE6uKG/vxBbvZ7eW2GLO6ewa9UxlnLVMPfJdpkp/xYXwwcPW2+2YXCge1ujxs\n\
-tjrOQJ5HUySh6DkE/kZpx8zwYWm9AaCrsvCIX1thsqgvKy+U5v1FS1L58eGc6s//\n\
-9yMgNhU29R0CAwEAAaOByTCBxjAMBgNVHRMEBTADAQH/MB0GA1UdDgQWBBRNVUJN\n\
-FzhJPReYT4QSx6dK53CXCTAfBgNVHSMEGDAWgBRNVUJNFzhJPReYT4QSx6dK53CX\n\
-CTAPBgNVHQ8BAf8EBQMDB/+AMGUGA1UdJQEB/wRbMFkGCCsGAQUFBwMBBggrBgEF\n\
-BQcDAgYIKwYBBQUHAwMGCCsGAQUFBwMEBggrBgEFBQcDCAYIKwYBBQUHAwkGCCsG\n\
-AQUFBwMNBggrBgEFBQcDDgYHKwYBBQIDBTANBgkqhkiG9w0BAQsFAAOCAQEAcOLF\n\
-ZYdJguj0uxeXB8v3xnUr1AWz9+gwg0URdfNLU2KvF2lsb/uznv6168b3/FcPgezN\n\
-Ihl9GqB+RvGwgXS/1UelCGbQiIUdsNxk246P4uOGPIyW32RoJcYPWZcpY+cw11tQ\n\
-NOnk994Y5/8ad1DmcxVLLqq5kwpXGWQufV1zOONq8B+mCvcVAmM4vkyF/de56Lwa\n\
-sAMpk1p77uhaDnuq2lIR4q3QHX2wGctFid5Q375DRscFQteY01r/dtwBBrMn0wuL\n\
-AMNx9ZGD+zAoOUaslpIlEQ+keAxk3jgGMWFMxF81YfhEnXzevSQXWpyek86XUyFL\n\
-O9IAQi5pa15gXjSbUg==\n\
------END CERTIFICATE-----";
-
-char *test_privatekey = "data:,-----BEGIN RSA PRIVATE KEY-----\n\
-MIIEowIBAAKCAQEA0Fb60RkFrDsRAIRfLMf2fsiRnw9Agp7yEbUsA4Zg4X+hRhBk\n\
-k78fFtagLisWo4LbT4DqKzqQXCvVnOn9a6uT0KsVejk2iaLoBy0fotQznudio3rz\n\
-DpTfzP9eRDFVj8RJnl3JJ8P1DULxH7N0TyDBuKZ1ibBfuKjPffqeCEzYKgAc8NG2\n\
-FB4m6mXzHhXuKw6W2v0IbHz6KYldsavf04rq7ztw0t67bexSQ4gLSVJEwiohAreg\n\
-m0dLvQnap5xd2qn0yETteTL8Y+Ujym1DWAnwDdwA6+0j2a0wkyzOzYQpZMt95NyZ\n\
-8kcoqEqO8KAN2HclqfjHlg9iDscbof5x45SQwwIDAQABAoIBAG0dYPeqd0IhHWJ7\n\
-8azufbchLMN1pX/D51xG2uptssfnpHuhkkufSZUYi4QipRS2ME6PYhWJ8pmTi6lH\n\
-E6cUkbI0KGd/F4U2gPdhNrR9Fxwea5bbifkVF7Gx/ZkRjZJiZ3w9+mCNTQbJDKhh\n\
-wITAzzT6WYznhvqbzzBX1fTa6kv0GAQtX7aHKM+XIwkhX2gzU5TU80bvH8aMrT05\n\
-tAMGQqkUeRnpo0yucBl4VmTZzd/+X/d2UyXR0my15jE5iH5o+p+E6qTRE9D+MGUd\n\
-MQ6Ftj0Untqy1lcog1ZLL6zPlnwcD4jgY5VCYDgvabnrSwymOJapPLsAEdWdq+U5\n\
-ec44BMECgYEA/+3qPUrd4XxA517qO3fCGBvf2Gkr7w5ZDeATOTHGuD8QZeK0nxPl\n\
-CWhRjdgkqo0fyf1cjczL5XgYayo+YxkO1Z4RUU+8lJAHlVx9izOQo+MTQfkwH4BK\n\
-LYlHxMoHJwAOXXoE+dmBaDh5xT0mDUGU750r763L6EFovE4qRBn9hxkCgYEA0GWz\n\
-rpOPNxb419WxG9npoQYdCZ5IbmEOGDH3ReggVzWHmW8sqtkqTZm5srcyDpqAc1Gu\n\
-paUveMblEBbU+NFJjLWOfwB5PCp8jsrqRgCQSxolShiVkc3Vu3oyzMus9PDge1eo\n\
-9mwVGO7ojQKWRu/WVAakENPaAjeyyhv4dqSNnjsCgYEAlwe8yszqoY1k8+U0T0G+\n\
-HeIdOCXgkmOiNCj+zyrLvaEhuS6PLq1b5TBVqGJcSPWdQ+MrglbQIKu9pUg5ptt7\n\
-wJ5WU+i9PeK9Ruxc/g/BFKYFkFJQjtZzb+nqm3wpul8zGwDN/O/ZiTqCyd3rHbmM\n\
-/dZ/viKPCZHIEBAEq0m3LskCgYBndzcAo+5k8ZjWwBfQth5SfhCIp/daJgGzbYtR\n\
-P/BenAsY2KOap3tjT8Fsw5usuHSxzIojX6H0Gvu7Qzq11mLn43Q+BeQrRQTWeFRc\n\
-MQdy4iZFZXNNEp7dF8yE9VKHwdgSJPGUdxD6chMvf2tRCN6mlS171VLV6wVvZvez\n\
-H/vX5QKBgD2Dq/NHpjCpAsECP9awmNF5Akn5WJbRGmegwXIih2mOtgtYYDeuQyxY\n\
-ZCrdJFfIUjUVPagshEmUklKhkYMYpzy2PQDVtaVcm6UNFroxT5h+J+KDs1LN1H8G\n\
-LsASrzyAg8EpRulwXEfLrWKiu9DKv8bMEgO4Ovgz8zTKJZIFhcac\n\
------END RSA PRIVATE KEY-----";
-
-
 DDS_Security_ValidationResult_t
 validate_local_identity(
         dds_security_authentication *instance,
diff --git a/src/security/core/tests/plugin_loading/plugin_mock_common.h b/src/security/core/tests/plugin_loading/plugin_mock_common.h
new file mode 100644
index 0000000..3fe2768
--- /dev/null
+++ b/src/security/core/tests/plugin_loading/plugin_mock_common.h
@@ -0,0 +1,98 @@
+/*
+ * Copyright(c) 2006 to 2019 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+
+#ifndef PLUGIN_MOCK_COMMON_H_
+#define PLUGIN_MOCK_COMMON_H_
+
+#define TEST_IDENTITY_CERTIFICATE_ALL_OK "testtext_IdentityCertificate_testtext"
+#define TEST_CA_CERTIFICATE_ALL_OK       "testtext_IdentityCA_testtext"
+#define TEST_PRIVATE_KEY_ALL_OK          "testtext_PrivateKey_testtext"
+
+#define TEST_IDENTITY_CERTIFICATE "data:,-----BEGIN CERTIFICATE-----\n\
+MIIDYDCCAkigAwIBAgIBBDANBgkqhkiG9w0BAQsFADByMQswCQYDVQQGEwJOTDEL\n\
+MAkGA1UECBMCT1YxEzARBgNVBAoTCkFETGluayBJU1QxGTAXBgNVBAMTEElkZW50\n\
+aXR5IENBIFRlc3QxJjAkBgkqhkiG9w0BCQEWF2luZm9AaXN0LmFkbGlua3RlY2gu\n\
+Y29tMB4XDTE4MDMxMjAwMDAwMFoXDTI3MDMxMTIzNTk1OVowdTELMAkGA1UEBhMC\n\
+TkwxCzAJBgNVBAgTAk9WMRAwDgYDVQQKEwdBRExpbmsgMREwDwYDVQQLEwhJU1Qg\n\
+VGVzdDETMBEGA1UEAxMKQWxpY2UgVGVzdDEfMB0GCSqGSIb3DQEJARYQYWxpY2VA\n\
+YWRsaW5rLmlzdDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBANBW+tEZ\n\
+Baw7EQCEXyzH9n7IkZ8PQIKe8hG1LAOGYOF/oUYQZJO/HxbWoC4rFqOC20+A6is6\n\
+kFwr1Zzp/Wurk9CrFXo5Nomi6ActH6LUM57nYqN68w6U38z/XkQxVY/ESZ5dySfD\n\
+9Q1C8R+zdE8gwbimdYmwX7ioz336nghM2CoAHPDRthQeJupl8x4V7isOltr9CGx8\n\
++imJXbGr39OK6u87cNLeu23sUkOIC0lSRMIqIQK3oJtHS70J2qecXdqp9MhE7Xky\n\
+/GPlI8ptQ1gJ8A3cAOvtI9mtMJMszs2EKWTLfeTcmfJHKKhKjvCgDdh3Jan4x5YP\n\
+Yg7HG6H+ceOUkMMCAwEAATANBgkqhkiG9w0BAQsFAAOCAQEAkvuqZzyJ3Nu4/Eo5\n\
+kD0nVgYGBUl7cspu+636q39zPSrxLEDMUWz+u8oXLpyGcgiZ8lZulPTV8dmOn+3C\n\
+Vg55c5C+gbnbX3MDyb3wB17296RmxYf6YNul4sFOmj6+g2i+Dw9WH0PBCVKbA84F\n\
+jR3Gx2Pfoifor3DvT0YFSsjNIRt090u4dQglbIb6cWEafC7O24t5jFhGPvJ7L9SE\n\
+gB0Drh/HmKTVuaqaRkoOKkKaKuWoXsszK1ZFda1DHommnR5LpYPsDRQ2fVM4EuBF\n\
+By03727uneuG8HLuNcLEV9H0i7LxtyfFkyCPUQvWG5jehb7xPOz/Ml26NAwwjlTJ\n\
+xEEFrw==\n\
+-----END CERTIFICATE-----"
+
+#define TEST_CA_CERTIFICATE_ALL "data:,-----BEGIN CERTIFICATE-----\n\
+MIIEKTCCAxGgAwIBAgIBATANBgkqhkiG9w0BAQsFADByMQswCQYDVQQGEwJOTDEL\n\
+MAkGA1UECBMCT1YxEzARBgNVBAoTCkFETGluayBJU1QxGTAXBgNVBAMTEElkZW50\n\
+aXR5IENBIFRlc3QxJjAkBgkqhkiG9w0BCQEWF2luZm9AaXN0LmFkbGlua3RlY2gu\n\
+Y29tMB4XDTE4MDMxMjAwMDAwMFoXDTI3MDMxMTIzNTk1OVowcjELMAkGA1UEBhMC\n\
+TkwxCzAJBgNVBAgTAk9WMRMwEQYDVQQKEwpBRExpbmsgSVNUMRkwFwYDVQQDExBJ\n\
+ZGVudGl0eSBDQSBUZXN0MSYwJAYJKoZIhvcNAQkBFhdpbmZvQGlzdC5hZGxpbmt0\n\
+ZWNoLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBANa/ENFfGVXg\n\
+bPLTzBdDfiZQcp5dWZ//Pb8ErFOJu8uosVHFv8t69dgjHgNHB4OsjmjnR7GfKUZT\n\
+0cMvWJnjsC7DDlBwFET9rj4k40n96bbVCH9I7+tNhsoqzc6Eu+5h4sk7VfNGTM2Z\n\
+SyCd4GiSZRuA44rRbhXI7/LDpr4hY5J9ZDo5AM9ZyoLAoh774H3CZWD67S35XvUs\n\
+72dzE6uKG/vxBbvZ7eW2GLO6ewa9UxlnLVMPfJdpkp/xYXwwcPW2+2YXCge1ujxs\n\
+tjrOQJ5HUySh6DkE/kZpx8zwYWm9AaCrsvCIX1thsqgvKy+U5v1FS1L58eGc6s//\n\
+9yMgNhU29R0CAwEAAaOByTCBxjAMBgNVHRMEBTADAQH/MB0GA1UdDgQWBBRNVUJN\n\
+FzhJPReYT4QSx6dK53CXCTAfBgNVHSMEGDAWgBRNVUJNFzhJPReYT4QSx6dK53CX\n\
+CTAPBgNVHQ8BAf8EBQMDB/+AMGUGA1UdJQEB/wRbMFkGCCsGAQUFBwMBBggrBgEF\n\
+BQcDAgYIKwYBBQUHAwMGCCsGAQUFBwMEBggrBgEFBQcDCAYIKwYBBQUHAwkGCCsG\n\
+AQUFBwMNBggrBgEFBQcDDgYHKwYBBQIDBTANBgkqhkiG9w0BAQsFAAOCAQEAcOLF\n\
+ZYdJguj0uxeXB8v3xnUr1AWz9+gwg0URdfNLU2KvF2lsb/uznv6168b3/FcPgezN\n\
+Ihl9GqB+RvGwgXS/1UelCGbQiIUdsNxk246P4uOGPIyW32RoJcYPWZcpY+cw11tQ\n\
+NOnk994Y5/8ad1DmcxVLLqq5kwpXGWQufV1zOONq8B+mCvcVAmM4vkyF/de56Lwa\n\
+sAMpk1p77uhaDnuq2lIR4q3QHX2wGctFid5Q375DRscFQteY01r/dtwBBrMn0wuL\n\
+AMNx9ZGD+zAoOUaslpIlEQ+keAxk3jgGMWFMxF81YfhEnXzevSQXWpyek86XUyFL\n\
+O9IAQi5pa15gXjSbUg==\n\
+-----END CERTIFICATE-----"
+
+#define TEST_PRIVATE_KEY_ALL "data:,-----BEGIN RSA PRIVATE KEY-----\n\
+MIIEowIBAAKCAQEA0Fb60RkFrDsRAIRfLMf2fsiRnw9Agp7yEbUsA4Zg4X+hRhBk\n\
+k78fFtagLisWo4LbT4DqKzqQXCvVnOn9a6uT0KsVejk2iaLoBy0fotQznudio3rz\n\
+DpTfzP9eRDFVj8RJnl3JJ8P1DULxH7N0TyDBuKZ1ibBfuKjPffqeCEzYKgAc8NG2\n\
+FB4m6mXzHhXuKw6W2v0IbHz6KYldsavf04rq7ztw0t67bexSQ4gLSVJEwiohAreg\n\
+m0dLvQnap5xd2qn0yETteTL8Y+Ujym1DWAnwDdwA6+0j2a0wkyzOzYQpZMt95NyZ\n\
+8kcoqEqO8KAN2HclqfjHlg9iDscbof5x45SQwwIDAQABAoIBAG0dYPeqd0IhHWJ7\n\
+8azufbchLMN1pX/D51xG2uptssfnpHuhkkufSZUYi4QipRS2ME6PYhWJ8pmTi6lH\n\
+E6cUkbI0KGd/F4U2gPdhNrR9Fxwea5bbifkVF7Gx/ZkRjZJiZ3w9+mCNTQbJDKhh\n\
+wITAzzT6WYznhvqbzzBX1fTa6kv0GAQtX7aHKM+XIwkhX2gzU5TU80bvH8aMrT05\n\
+tAMGQqkUeRnpo0yucBl4VmTZzd/+X/d2UyXR0my15jE5iH5o+p+E6qTRE9D+MGUd\n\
+MQ6Ftj0Untqy1lcog1ZLL6zPlnwcD4jgY5VCYDgvabnrSwymOJapPLsAEdWdq+U5\n\
+ec44BMECgYEA/+3qPUrd4XxA517qO3fCGBvf2Gkr7w5ZDeATOTHGuD8QZeK0nxPl\n\
+CWhRjdgkqo0fyf1cjczL5XgYayo+YxkO1Z4RUU+8lJAHlVx9izOQo+MTQfkwH4BK\n\
+LYlHxMoHJwAOXXoE+dmBaDh5xT0mDUGU750r763L6EFovE4qRBn9hxkCgYEA0GWz\n\
+rpOPNxb419WxG9npoQYdCZ5IbmEOGDH3ReggVzWHmW8sqtkqTZm5srcyDpqAc1Gu\n\
+paUveMblEBbU+NFJjLWOfwB5PCp8jsrqRgCQSxolShiVkc3Vu3oyzMus9PDge1eo\n\
+9mwVGO7ojQKWRu/WVAakENPaAjeyyhv4dqSNnjsCgYEAlwe8yszqoY1k8+U0T0G+\n\
+HeIdOCXgkmOiNCj+zyrLvaEhuS6PLq1b5TBVqGJcSPWdQ+MrglbQIKu9pUg5ptt7\n\
+wJ5WU+i9PeK9Ruxc/g/BFKYFkFJQjtZzb+nqm3wpul8zGwDN/O/ZiTqCyd3rHbmM\n\
+/dZ/viKPCZHIEBAEq0m3LskCgYBndzcAo+5k8ZjWwBfQth5SfhCIp/daJgGzbYtR\n\
+P/BenAsY2KOap3tjT8Fsw5usuHSxzIojX6H0Gvu7Qzq11mLn43Q+BeQrRQTWeFRc\n\
+MQdy4iZFZXNNEp7dF8yE9VKHwdgSJPGUdxD6chMvf2tRCN6mlS171VLV6wVvZvez\n\
+H/vX5QKBgD2Dq/NHpjCpAsECP9awmNF5Akn5WJbRGmegwXIih2mOtgtYYDeuQyxY\n\
+ZCrdJFfIUjUVPagshEmUklKhkYMYpzy2PQDVtaVcm6UNFroxT5h+J+KDs1LN1H8G\n\
+LsASrzyAg8EpRulwXEfLrWKiu9DKv8bMEgO4Ovgz8zTKJZIFhcac\n\
+-----END RSA PRIVATE KEY-----"
+
+
+
+#endif
diff --git a/src/security/core/tests/plugin_loading/security_config.c b/src/security/core/tests/plugin_loading/security_config.c
index 3c91f60..dbd0806 100644
--- a/src/security/core/tests/plugin_loading/security_config.c
+++ b/src/security/core/tests/plugin_loading/security_config.c
@@ -21,6 +21,7 @@
 #include "dds/ddsrt/heap.h"
 #include "dds/ddsi/q_misc.h"
 #include "dds/ddsi/ddsi_xqos.h"
+#include "plugin_mock_common.h"
 
 #include "dds/security/dds_security_api_defs.h"
 
@@ -50,9 +51,9 @@
   "0:\"dds.sec.access.library.path\":\""ac"\","                         \
   "0:\"dds.sec.access.library.init\":\"init_access_control\","          \
   "0:\"dds.sec.access.library.finalize\":\"finalize_access_control\","  \
-  "0:\"dds.sec.auth.identity_ca\":\"testtext_IdentityCA_testtext\","    \
-  "0:\"dds.sec.auth.private_key\":\"testtext_PrivateKey_testtext\","    \
-  "0:\"dds.sec.auth.identity_certificate\":\"testtext_IdentityCertificate_testtext\"," \
+  "0:\"dds.sec.auth.identity_ca\":\"" TEST_CA_CERTIFICATE_ALL_OK "\","  \
+  "0:\"dds.sec.auth.private_key\":\"" TEST_PRIVATE_KEY_ALL_OK "\","     \
+  "0:\"dds.sec.auth.identity_certificate\":\"" TEST_IDENTITY_CERTIFICATE_ALL_OK "\"," \
   "0:\"dds.sec.access.permissions_ca\":\"file:Permissions_CA.pem\","    \
   "0:\"dds.sec.access.governance\":\"file:Governance.p7s\","            \
   "0:\"dds.sec.access.permissions\":\"file:Permissions.p7s\""           \
@@ -206,9 +207,9 @@ CU_Test(ddsc_security_config, all, .init = ddsrt_init, .fini = ddsrt_fini)
     "config: Domain/DDSSecurity/Authentication/Library[@path]: "MOCKLIB_PATH("dds_security_authentication_all_ok")"*",
     "config: Domain/DDSSecurity/Authentication/Library[@initFunction]: init_authentication*",
     "config: Domain/DDSSecurity/Authentication/Library[@finalizeFunction]: finalize_authentication*",
-    "config: Domain/DDSSecurity/Authentication/IdentityCertificate/#text: testtext_IdentityCertificate_testtext*",
-    "config: Domain/DDSSecurity/Authentication/IdentityCA/#text: testtext_IdentityCA_testtext*",
-    "config: Domain/DDSSecurity/Authentication/PrivateKey/#text: testtext_PrivateKey_testtext*",
+    "config: Domain/DDSSecurity/Authentication/IdentityCertificate/#text: "TEST_IDENTITY_CERTIFICATE_ALL_OK"*",
+    "config: Domain/DDSSecurity/Authentication/IdentityCA/#text: "TEST_CA_CERTIFICATE_ALL_OK"*",
+    "config: Domain/DDSSecurity/Authentication/PrivateKey/#text: "TEST_PRIVATE_KEY_ALL_OK"*",
     "config: Domain/DDSSecurity/Authentication/Password/#text: testtext_Password_testtext*",
     "config: Domain/DDSSecurity/Authentication/TrustedCADirectory/#text: testtext_Dir_testtext*",
     "config: Domain/DDSSecurity/AccessControl/Library/#text: "MOCKLIB_PATH("dds_security_access_control_all_ok")"*",
@@ -233,9 +234,9 @@ CU_Test(ddsc_security_config, all, .init = ddsrt_init, .fini = ddsrt_fini)
     "    <DDSSecurity>"
     "      <Authentication>"
     "        "MOCKLIB_ELEM_AUTH("dds_security_authentication_all_ok")
-    "        <IdentityCertificate>testtext_IdentityCertificate_testtext</IdentityCertificate>"
-    "        <IdentityCA>testtext_IdentityCA_testtext</IdentityCA>"
-    "        <PrivateKey>testtext_PrivateKey_testtext</PrivateKey>"
+    "        <IdentityCertificate>"TEST_IDENTITY_CERTIFICATE_ALL_OK"</IdentityCertificate>"
+    "        <IdentityCA>"TEST_CA_CERTIFICATE_ALL_OK"</IdentityCA>"
+    "        <PrivateKey>"TEST_PRIVATE_KEY_ALL_OK"</PrivateKey>"
     "        <Password>testtext_Password_testtext</Password>"
     "        <TrustedCADirectory>testtext_Dir_testtext</TrustedCADirectory>"
     "      </Authentication>"
@@ -281,9 +282,9 @@ CU_Test(ddsc_security_config, security, .init = ddsrt_init, .fini = ddsrt_fini)
     "config: Domain/DDSSecurity/Authentication/Library[@path]: "MOCKLIB_PATH("dds_security_authentication_all_ok")"*",
     "config: Domain/DDSSecurity/Authentication/Library[@initFunction]: init_authentication*",
     "config: Domain/DDSSecurity/Authentication/Library[@finalizeFunction]: finalize_authentication*",
-    "config: Domain/DDSSecurity/Authentication/IdentityCertificate/#text: testtext_IdentityCertificate_testtext*",
-    "config: Domain/DDSSecurity/Authentication/IdentityCA/#text: testtext_IdentityCA_testtext*",
-    "config: Domain/DDSSecurity/Authentication/PrivateKey/#text: testtext_PrivateKey_testtext*",
+    "config: Domain/DDSSecurity/Authentication/IdentityCertificate/#text: "TEST_IDENTITY_CERTIFICATE_ALL_OK"*",
+    "config: Domain/DDSSecurity/Authentication/IdentityCA/#text: "TEST_CA_CERTIFICATE_ALL_OK"*",
+    "config: Domain/DDSSecurity/Authentication/PrivateKey/#text: "TEST_PRIVATE_KEY_ALL_OK"*",
     "config: Domain/DDSSecurity/Authentication/Password/#text:  {}*",
     "config: Domain/DDSSecurity/Authentication/TrustedCADirectory/#text:  {}*",
     "config: Domain/DDSSecurity/AccessControl/Library/#text: "MOCKLIB_PATH("dds_security_access_control_all_ok")"*",
@@ -307,9 +308,9 @@ CU_Test(ddsc_security_config, security, .init = ddsrt_init, .fini = ddsrt_fini)
     "<DDSSecurity>"
     "  <Authentication>"
     "    "MOCKLIB_ELEM_AUTH("dds_security_authentication_all_ok")
-    "    <IdentityCertificate>testtext_IdentityCertificate_testtext</IdentityCertificate>"
-    "    <IdentityCA>testtext_IdentityCA_testtext</IdentityCA>"
-    "    <PrivateKey>testtext_PrivateKey_testtext</PrivateKey>"
+    "    <IdentityCertificate>"TEST_IDENTITY_CERTIFICATE_ALL_OK"</IdentityCertificate>"
+    "    <IdentityCA>"TEST_CA_CERTIFICATE_ALL_OK"</IdentityCA>"
+    "    <PrivateKey>"TEST_PRIVATE_KEY_ALL_OK"</PrivateKey>"
     "  </Authentication>"
     "  <Cryptographic>"
     "    "MOCKLIB_ELEM_CRYPTO("dds_security_cryptography_all_ok")
@@ -351,9 +352,9 @@ CU_Test(ddsc_security_config, deprecated, .init = ddsrt_init, .fini = ddsrt_fini
     "config: Domain/DDSSecurity/Authentication/Library[@path]: "MOCKLIB_PATH("dds_security_authentication_all_ok")"*",
     "config: Domain/DDSSecurity/Authentication/Library[@initFunction]: init_authentication*",
     "config: Domain/DDSSecurity/Authentication/Library[@finalizeFunction]: finalize_authentication*",
-    "config: Domain/DDSSecurity/Authentication/IdentityCertificate/#text: testtext_IdentityCertificate_testtext*",
-    "config: Domain/DDSSecurity/Authentication/IdentityCA/#text: testtext_IdentityCA_testtext*",
-    "config: Domain/DDSSecurity/Authentication/PrivateKey/#text: testtext_PrivateKey_testtext*",
+    "config: Domain/DDSSecurity/Authentication/IdentityCertificate/#text: "TEST_IDENTITY_CERTIFICATE_ALL_OK"*",
+    "config: Domain/DDSSecurity/Authentication/IdentityCA/#text: "TEST_CA_CERTIFICATE_ALL_OK"*",
+    "config: Domain/DDSSecurity/Authentication/PrivateKey/#text: "TEST_PRIVATE_KEY_ALL_OK"*",
     "config: Domain/DDSSecurity/Authentication/Password/#text: testtext_Password_testtext*",
     "config: Domain/DDSSecurity/Authentication/TrustedCADirectory/#text: testtext_Dir_testtext*",
     "config: Domain/DDSSecurity/AccessControl/Library/#text: "MOCKLIB_PATH("dds_security_access_control_all_ok")"*",
@@ -378,9 +379,9 @@ CU_Test(ddsc_security_config, deprecated, .init = ddsrt_init, .fini = ddsrt_fini
     "    <DDSSecurity>"
     "      <Authentication>"
     "        "MOCKLIB_ELEM_AUTH("dds_security_authentication_all_ok")
-    "        <IdentityCertificate>testtext_IdentityCertificate_testtext</IdentityCertificate>"
-    "        <IdentityCA>testtext_IdentityCA_testtext</IdentityCA>"
-    "        <PrivateKey>testtext_PrivateKey_testtext</PrivateKey>"
+    "        <IdentityCertificate>"TEST_IDENTITY_CERTIFICATE_ALL_OK"</IdentityCertificate>"
+    "        <IdentityCA>"TEST_CA_CERTIFICATE_ALL_OK"</IdentityCA>"
+    "        <PrivateKey>"TEST_PRIVATE_KEY_ALL_OK"</PrivateKey>"
     "        <Password>testtext_Password_testtext</Password>"
     "        <TrustedCADirectory>testtext_Dir_testtext</TrustedCADirectory>"
     "      </Authentication>"
@@ -448,9 +449,9 @@ CU_Test(ddsc_security_config, qos, .init = ddsrt_init, .fini = ddsrt_fini)
   dds_qset_prop(qos, "dds.sec.access.library.path", ""MOCKLIB_PATH("dds_security_access_control_all_ok")"");
   dds_qset_prop(qos, "dds.sec.access.library.init", "init_access_control");
   dds_qset_prop(qos, "dds.sec.access.library.finalize", "finalize_access_control");
-  dds_qset_prop(qos, "dds.sec.auth.identity_ca", "testtext_IdentityCA_testtext");
-  dds_qset_prop(qos, "dds.sec.auth.private_key", "testtext_PrivateKey_testtext");
-  dds_qset_prop(qos, "dds.sec.auth.identity_certificate", "testtext_IdentityCertificate_testtext");
+  dds_qset_prop(qos, "dds.sec.auth.identity_ca", TEST_CA_CERTIFICATE_ALL_OK);
+  dds_qset_prop(qos, "dds.sec.auth.private_key", TEST_PRIVATE_KEY_ALL_OK);
+  dds_qset_prop(qos, "dds.sec.auth.identity_certificate", TEST_IDENTITY_CERTIFICATE_ALL_OK);
   dds_qset_prop(qos, "dds.sec.access.permissions_ca", "file:Permissions_CA.pem");
   dds_qset_prop(qos, "dds.sec.access.governance", "file:Governance.p7s");
   dds_qset_prop(qos, "dds.sec.access.permissions", "file:Permissions.p7s");
@@ -494,6 +495,7 @@ CU_Test(ddsc_security_config, qos_props, .init = ddsrt_init, .fini = ddsrt_fini)
      PARTICIPANT_QOS_ALL_OK to work, the order must match that one */
   unsigned char bvalue[3] = { 0x01, 0x02, 0x03 };
   CU_ASSERT_FATAL((qos = dds_create_qos()) != NULL);
+
   dds_qset_prop(qos, "dds.sec.auth.library.path", ""MOCKLIB_PATH("dds_security_authentication_all_ok")"");
   dds_qset_prop(qos, "dds.sec.auth.library.init", "init_authentication");
   dds_qset_prop(qos, "dds.sec.auth.library.finalize", "finalize_authentication");
@@ -503,9 +505,9 @@ CU_Test(ddsc_security_config, qos_props, .init = ddsrt_init, .fini = ddsrt_fini)
   dds_qset_prop(qos, "dds.sec.access.library.path", ""MOCKLIB_PATH("dds_security_access_control_all_ok")"");
   dds_qset_prop(qos, "dds.sec.access.library.init", "init_access_control");
   dds_qset_prop(qos, "dds.sec.access.library.finalize", "finalize_access_control");
-  dds_qset_prop(qos, "dds.sec.auth.identity_ca", "testtext_IdentityCA_testtext");
-  dds_qset_prop(qos, "dds.sec.auth.private_key", "testtext_PrivateKey_testtext");
-  dds_qset_prop(qos, "dds.sec.auth.identity_certificate", "testtext_IdentityCertificate_testtext");
+  dds_qset_prop(qos, "dds.sec.auth.identity_ca", TEST_CA_CERTIFICATE_ALL_OK);
+  dds_qset_prop(qos, "dds.sec.auth.private_key", TEST_PRIVATE_KEY_ALL_OK);
+  dds_qset_prop(qos, "dds.sec.auth.identity_certificate", TEST_IDENTITY_CERTIFICATE_ALL_OK);
   dds_qset_prop(qos, "dds.sec.access.permissions_ca", "file:Permissions_CA.pem");
   dds_qset_prop(qos, "dds.sec.access.governance", "file:Governance.p7s");
   dds_qset_prop(qos, "dds.sec.access.permissions", "file:Permissions.p7s");
@@ -514,7 +516,6 @@ CU_Test(ddsc_security_config, qos_props, .init = ddsrt_init, .fini = ddsrt_fini)
 
   dds_qset_prop(qos, "test.prop1", "testtext_value1_testtext");
   dds_qset_prop(qos, "test.prop2", "testtext_value2_testtext");
-
   dds_qset_bprop(qos, "test.bprop1", bvalue, 3);
 
   /* Create participant with security config in qos. */
@@ -546,9 +547,9 @@ CU_Test(ddsc_security_config, config_qos, .init = ddsrt_init, .fini = ddsrt_fini
     "<Tracing><Verbosity>finest</></>"
     "<DDSSecurity>"
     "  <Authentication>"
-    "    <IdentityCertificate>testtext_IdentityCertificate_testtext</IdentityCertificate>"
-    "    <IdentityCA>testtext_IdentityCA_testtext</IdentityCA>"
-    "    <PrivateKey>testtext_PrivateKey_testtext</PrivateKey>"
+    "    <IdentityCertificate>"TEST_IDENTITY_CERTIFICATE_ALL_OK"</IdentityCertificate>"
+    "    <IdentityCA>"TEST_CA_CERTIFICATE_ALL_OK"</IdentityCA>"
+    "    <PrivateKey>"TEST_PRIVATE_KEY_ALL_OK"</PrivateKey>"
     "  </Authentication>"
     "  <AccessControl>"
     "    <Governance>file:Governance.p7s</Governance>"
@@ -572,9 +573,9 @@ CU_Test(ddsc_security_config, config_qos, .init = ddsrt_init, .fini = ddsrt_fini
   dds_qset_prop(qos, "dds.sec.access.library.path", ""MOCKLIB_PATH("dds_security_access_control_all_ok")"");
   dds_qset_prop(qos, "dds.sec.access.library.init", "init_access_control");
   dds_qset_prop(qos, "dds.sec.access.library.finalize", "finalize_access_control");
-  dds_qset_prop(qos, "dds.sec.auth.identity_ca", "testtext_IdentityCA_testtext");
-  dds_qset_prop(qos, "dds.sec.auth.private_key", "testtext_PrivateKey_testtext");
-  dds_qset_prop(qos, "dds.sec.auth.identity_certificate", "testtext_IdentityCertificate_testtext");
+  dds_qset_prop(qos, "dds.sec.auth.identity_ca", TEST_CA_CERTIFICATE_ALL_OK);
+  dds_qset_prop(qos, "dds.sec.auth.private_key", TEST_PRIVATE_KEY_ALL_OK);
+  dds_qset_prop(qos, "dds.sec.auth.identity_certificate", TEST_IDENTITY_CERTIFICATE_ALL_OK);
   dds_qset_prop(qos, "dds.sec.access.permissions_ca", "file:Permissions_CA.pem");
   dds_qset_prop(qos, "dds.sec.access.governance", "file:Governance.p7s");
   dds_qset_prop(qos, "dds.sec.access.permissions", "file:Permissions.p7s");
@@ -614,9 +615,9 @@ CU_Test(ddsc_security_config, other_prop, .init = ddsrt_init, .fini = ddsrt_fini
     "<DDSSecurity>"
     "  <Authentication>"
     "    "MOCKLIB_ELEM_AUTH("dds_security_authentication_all_ok")
-    "    <IdentityCertificate>testtext_IdentityCertificate_testtext</IdentityCertificate>"
-    "    <IdentityCA>testtext_IdentityCA_testtext</IdentityCA>"
-    "    <PrivateKey>testtext_PrivateKey_testtext</PrivateKey>"
+    "    <IdentityCertificate>"TEST_IDENTITY_CERTIFICATE_ALL_OK"</IdentityCertificate>"
+    "    <IdentityCA>"TEST_CA_CERTIFICATE_ALL_OK"</IdentityCA>"
+    "    <PrivateKey>"TEST_PRIVATE_KEY_ALL_OK"</PrivateKey>"
     "    <Password>testtext_Password_testtext</Password>"
     "    <TrustedCADirectory>testtext_Dir_testtext</TrustedCADirectory>"
     "  </Authentication>"
@@ -685,9 +686,9 @@ CU_Test(ddsc_security_config, qos_invalid, .init = ddsrt_init, .fini = ddsrt_fin
     "<Tracing><Verbosity>finest</></>"
     "<DDSSecurity>"
     "  <Authentication>"
-    "    <IdentityCertificate>testtext_IdentityCertificate_testtext</IdentityCertificate>"
-    "    <IdentityCA>testtext_IdentityCA_testtext</IdentityCA>"
-    "    <PrivateKey>testtext_PrivateKey_testtext</PrivateKey>"
+    "    <IdentityCertificate>"TEST_IDENTITY_CERTIFICATE_ALL_OK"</IdentityCertificate>"
+    "    <IdentityCA>"TEST_CA_CERTIFICATE_ALL_OK"</IdentityCA>"
+    "    <PrivateKey>"TEST_PRIVATE_KEY_ALL_OK"</PrivateKey>"
     "  </Authentication>"
     "  <AccessControl>"
     "    <Governance>file:Governance.p7s</Governance>"
diff --git a/src/security/core/tests/tc_fsm.c b/src/security/core/tests/tc_fsm.c
index c2c7647..5489d19 100644
--- a/src/security/core/tests/tc_fsm.c
+++ b/src/security/core/tests/tc_fsm.c
@@ -369,16 +369,19 @@ static const uint32_t TransitionsSize = sizeof(Transitions)/sizeof(Transitions[0
  **********************************************************************/
 
 typedef enum {
-    eventToTimeout, eventToEnd,
+    eventToTimeout, eventToInterupt, eventToEnd,
 } timeout_events;
 
+struct fsm_timeout_arg {
+  int id;
+};
+
 static struct dds_security_fsm *fsm_timeout;
 static uint32_t visited_timeout = 0;
 static uint32_t correct_fsm_timeout = 0;
 static uint32_t correct_arg_timeout = 0;
-static ddsrt_cond_t stop_timeout_cond;
-static ddsrt_mutex_t stop_timeout_cond_mutex;
-static uint32_t stop_timeout_cond_cnt = 0;
+static struct fsm_timeout_arg fsm_arg = { .id = FSM_AUTH_ARG };
+
 
 /* The functions called from the state-machine. */
 static void doInterupt(struct dds_security_fsm *fsm, void *arg)
@@ -393,24 +396,15 @@ static void doInterupt(struct dds_security_fsm *fsm, void *arg)
 
 static void doTimeout(struct dds_security_fsm *fsm, void *arg)
 {
-  dds_duration_t delay4 = 4 * DDS_NSECS_IN_SEC;
-
   DDSRT_UNUSED_ARG(arg);
 
   if (DB_TC_PRINT_DEBUG) {
-    printf("Transition >>>> %s %d\n", __FUNCTION__, stop_timeout_cond_cnt);
+    printf("Transition >>>> %s\n", __FUNCTION__);
   }
   visited_timeout |= 1UL << 1;
 
-  stop_timeout_cond_cnt++;
-  ddsrt_mutex_lock(&stop_timeout_cond_mutex);
-  (void) ddsrt_cond_waitfor(&stop_timeout_cond, &stop_timeout_cond_mutex,
-                            delay4);
-  ddsrt_mutex_unlock(&stop_timeout_cond_mutex);
-  stop_timeout_cond_cnt--;
-
   if (DB_TC_PRINT_DEBUG) {
-    printf("Transition <<<< %s %d\n", __FUNCTION__, stop_timeout_cond_cnt);
+    printf("Transition <<<< %s\n", __FUNCTION__);
   }
 
   dds_security_fsm_dispatch(fsm, eventToTimeout, false);
@@ -418,7 +412,7 @@ static void doTimeout(struct dds_security_fsm *fsm, void *arg)
 
 static void TimeoutCallback(struct dds_security_fsm *fsm, void *arg)
 {
-  int *fsm_arg;
+  struct fsm_timeout_arg *farg = arg;
 
   if (DB_TC_PRINT_DEBUG) {
     printf("TimeoutCallback\n");
@@ -426,10 +420,8 @@ static void TimeoutCallback(struct dds_security_fsm *fsm, void *arg)
 
   visited_timeout |= 1UL << 2;
 
-  if (arg != NULL) {
-    fsm_arg = (int *) arg;
-
-    if (*fsm_arg == FSM_AUTH_ARG) {
+  if (farg != NULL) {
+    if (farg->id == FSM_AUTH_ARG) {
       correct_arg_timeout = 1;
     } else {
       correct_arg_timeout = 0;
@@ -452,14 +444,17 @@ static void TimeoutCallback2(struct dds_security_fsm *fsm, void *arg)
   visited_timeout |= 1UL << 3;
 }
 
-static dds_security_fsm_state StateTimeout  = {doTimeout,  0};static int fsm_arg = FSM_AUTH_ARG;
+static dds_security_fsm_state StateInitial     = {doTimeout,  0};
+static dds_security_fsm_state StateWaitTimeout = {NULL, DDS_SECS(4)};
+static dds_security_fsm_state StateInterupt    = {doInterupt, 0};
 
-static dds_security_fsm_state StateInterupt = {doInterupt, 0};
 
 static const dds_security_fsm_transition TimeoutTransitions[] = {
-    {NULL,          DDS_SECURITY_FSM_EVENT_AUTO, NULL, &StateTimeout},  // NULL state is the start state
-    {&StateTimeout, eventToTimeout,              NULL, &StateInterupt},
-    {&StateInterupt,eventToEnd,                  NULL, NULL},           // Reaching NULL means end of state-diagram
+    {NULL,              DDS_SECURITY_FSM_EVENT_AUTO,    NULL, &StateInitial},  // NULL state is the start state
+    {&StateInitial,     eventToTimeout,                 NULL, &StateWaitTimeout},
+    {&StateWaitTimeout, DDS_SECURITY_FSM_EVENT_TIMEOUT, NULL, &StateInterupt},
+    {&StateWaitTimeout, eventToInterupt,                NULL, &StateInterupt},
+    {&StateInterupt,    eventToEnd,                     NULL, NULL},           // Reaching NULL means end of state-diagram
 };
 static const uint32_t TimeoutTransitionsSize = sizeof(TimeoutTransitions)/sizeof(TimeoutTransitions[0]);
 
@@ -541,16 +536,10 @@ static void fsm_control_init(void)
 
   rc = dds_security_fsm_control_start (g_fsm_control, NULL);
   CU_ASSERT_FATAL(rc == 0);
-
-  ddsrt_mutex_init(&stop_timeout_cond_mutex);
-  ddsrt_cond_init(&stop_timeout_cond);
 }
 
 static void fsm_control_fini(void)
 {
-  ddsrt_cond_destroy(&stop_timeout_cond);
-  ddsrt_mutex_destroy(&stop_timeout_cond_mutex);
-
   dds_security_fsm_control_stop(g_fsm_control);
   dds_security_fsm_control_free(g_fsm_control);
 
@@ -697,12 +686,10 @@ CU_Test(ddssec_fsm, timeout, .init = fsm_control_init, .fini = fsm_control_fini)
     timeout--;
   }
   CU_ASSERT(timeout > 0);
-  CU_ASSERT(
-          CHECK_BIT(visited_timeout, 0) && CHECK_BIT(visited_timeout, 1) && CHECK_BIT(visited_timeout, 2));
+  CU_ASSERT(CHECK_BIT(visited_timeout, 0) && CHECK_BIT(visited_timeout, 1) && CHECK_BIT(visited_timeout, 2));
   CU_ASSERT(correct_arg_timeout && correct_fsm_timeout);
 
   dds_security_fsm_free(fsm_timeout);
-
 }
 
 /**
@@ -740,10 +727,6 @@ CU_Test(ddssec_fsm, double_timeout, .init = fsm_control_init, .fini = fsm_contro
   CU_ASSERT(CHECK_BIT(visited_timeout, 3));
   dds_security_fsm_free(fsm_timeout);
   dds_security_fsm_free(fsm_timeout2);
-  ddsrt_mutex_lock(&stop_timeout_cond_mutex);
-  ddsrt_cond_signal(&stop_timeout_cond);
-  ddsrt_mutex_unlock(&stop_timeout_cond_mutex);
-
 }
 
 /**
@@ -840,15 +823,5 @@ CU_Test(ddssec_fsm, delete_with_timeout, .init = fsm_control_init, .fini = fsm_c
   }
 
   dds_security_fsm_free(fsm_timeout);
-  dds_sleepfor(100 * DDS_NSECS_IN_MSEC);
-
-  /* Just for safety to be certain that the condition isn't used anymore before destroying it. */
-  while (stop_timeout_cond_cnt > 0) {
-    dds_time_t d = DDS_NSECS_IN_SEC;
-    ddsrt_cond_signal(&stop_timeout_cond);
-    dds_sleepfor(d);
-  }
-
-
 }
 

From 1dad535bc09aa9b0c0074baba49e25f9475d6707 Mon Sep 17 00:00:00 2001
From: Marcel Jordense <marcel.jordense@adlinktech.com>
Date: Fri, 28 Feb 2020 18:01:58 +0100
Subject: [PATCH 105/238] Correct misplaced lock

Signed-off-by: Marcel Jordense <marcel.jordense@adlinktech.com>
---
 src/core/ddsi/src/ddsi_security_exchange.c |  4 ++--
 src/core/ddsi/src/ddsi_security_omg.c      |  5 ++---
 src/core/ddsi/src/q_receive.c              | 23 ++++++++++++----------
 3 files changed, 17 insertions(+), 15 deletions(-)

diff --git a/src/core/ddsi/src/ddsi_security_exchange.c b/src/core/ddsi/src/ddsi_security_exchange.c
index c583f71..e510e2c 100644
--- a/src/core/ddsi/src/ddsi_security_exchange.c
+++ b/src/core/ddsi/src/ddsi_security_exchange.c
@@ -296,10 +296,10 @@ static bool write_crypto_exchange_message(const struct participant *pp, const dd
   };
   serdata = ddsi_serdata_from_sample (gv->rawcdr_topic, SDK_DATA, &raw);
   tk = ddsi_tkmap_lookup_instance_ref (gv->m_tkmap, serdata);
-  ddsrt_mutex_unlock (&wr->e.lock);
-  ddsrt_free(data);
 
   r = write_sample_p2p_wrlock_held(wr, seq, NULL, serdata, tk, prd);
+  ddsrt_mutex_unlock (&wr->e.lock);
+  ddsrt_free(data);
   ddsi_tkmap_instance_unref (gv->m_tkmap, tk);
   ddsi_serdata_unref (serdata);
 
diff --git a/src/core/ddsi/src/ddsi_security_omg.c b/src/core/ddsi/src/ddsi_security_omg.c
index 8e3808d..7204515 100644
--- a/src/core/ddsi/src/ddsi_security_omg.c
+++ b/src/core/ddsi/src/ddsi_security_omg.c
@@ -1829,7 +1829,6 @@ bool q_omg_is_similar_participant_security_info(struct participant *pp, struct p
       proxypp->security_info.plugin_security_attributes = pp_security_info.plugin_security_attributes;
     }
   }
-  assert(matching);
   return matching;
 }
 
@@ -2504,10 +2503,10 @@ void q_omg_security_set_remote_writer_crypto_tokens(struct reader *rd, const dds
     {
       GVTRACE("set_remote_writer_crypto_tokens "PGUIDFMT" with reader "PGUIDFMT"\n", PGUID(pwr->e.guid), PGUID(rd->e.guid));
       match->matched = true;
-      DDS_Security_DataHolderSeq_free(tseq);
     }
     else
       EXCEPTION_ERROR(sc, &exception, "Failed to set remote writer crypto tokens "PGUIDFMT" for reader "PGUIDFMT, PGUID(pwr->e.guid), PGUID(rd->e.guid));
+    DDS_Security_DataHolderSeq_free(tseq);
   }
   ddsrt_mutex_unlock(&rd->e.lock);
 
@@ -2551,10 +2550,10 @@ void q_omg_security_set_remote_reader_crypto_tokens(struct writer *wr, const dds
     {
       GVTRACE("set_remote_reader_crypto_tokens "PGUIDFMT" with writer "PGUIDFMT"\n", PGUID(prd->e.guid), PGUID(wr->e.guid));
       match->matched = true;
-      DDS_Security_DataHolderSeq_free(tseq);
     }
     else
       EXCEPTION_ERROR(sc, &exception, "Failed to set remote reader crypto tokens "PGUIDFMT" for writer "PGUIDFMT, PGUID(prd->e.guid), PGUID(wr->e.guid));
+    DDS_Security_DataHolderSeq_free(tseq);
   }
   ddsrt_mutex_unlock(&wr->e.lock);
 
diff --git a/src/core/ddsi/src/q_receive.c b/src/core/ddsi/src/q_receive.c
index 640436b..7a5f9a7 100644
--- a/src/core/ddsi/src/q_receive.c
+++ b/src/core/ddsi/src/q_receive.c
@@ -1649,23 +1649,26 @@ static int handle_InfoTS (const struct receiver_state *rst, const InfoTS_t *msg,
 static int handle_one_gap (struct proxy_writer *pwr, struct pwr_rd_match *wn, seqno_t a, seqno_t b, struct nn_rdata *gap, int *refc_adjust)
 {
   struct nn_rsample_chain sc;
-  nn_reorder_result_t res;
+  nn_reorder_result_t res = 0;
   int gap_was_valuable = 0;
   ASSERT_MUTEX_HELD (&pwr->e.lock);
 
   /* Clean up the defrag admin: no fragments of a missing sample will
      be arriving in the future */
   if (!(wn && wn->filtered))
-     nn_defrag_notegap (pwr->defrag, a, b);
-
-  /* Primary reorder: the gap message may cause some samples to become
-     deliverable. */
-  if ((res = nn_reorder_gap (&sc, pwr->reorder, gap, a, b, refc_adjust)) > 0)
   {
-    if (pwr->deliver_synchronously)
-      deliver_user_data_synchronously (&sc, NULL);
-    else
-      nn_dqueue_enqueue (pwr->dqueue, &sc, res);
+    nn_defrag_notegap (pwr->defrag, a, b);
+
+    /* Primary reorder: the gap message may cause some samples to become
+     deliverable. */
+
+    if ((res = nn_reorder_gap (&sc, pwr->reorder, gap, a, b, refc_adjust)) > 0)
+    {
+      if (pwr->deliver_synchronously)
+        deliver_user_data_synchronously (&sc, NULL);
+      else
+        nn_dqueue_enqueue (pwr->dqueue, &sc, res);
+    }
   }
 
   /* If the result was REJECT or TOO_OLD, then this gap didn't add

From a0b4245600c7af3efedc610b543c4bcd083387a8 Mon Sep 17 00:00:00 2001
From: Erik Boasson <eb@ilities.com>
Date: Tue, 3 Mar 2020 12:41:47 +0100
Subject: [PATCH 106/238] Fix FSM timeout test race

Signed-off-by: Erik Boasson <eb@ilities.com>
---
 src/security/core/tests/tc_fsm.c | 212 +++++++++++--------------------
 1 file changed, 71 insertions(+), 141 deletions(-)

diff --git a/src/security/core/tests/tc_fsm.c b/src/security/core/tests/tc_fsm.c
index 5489d19..666a641 100644
--- a/src/security/core/tests/tc_fsm.c
+++ b/src/security/core/tests/tc_fsm.c
@@ -29,11 +29,21 @@
 #define DB_TC_PRINT_DEBUG  (true)
 
 static dds_entity_t g_participant = 0;
+static ddsrt_mutex_t g_lock;
 static struct dds_security_fsm_control *g_fsm_control = NULL;
 static const dds_duration_t msec100 = DDS_MSECS(100);
 
 //static int fsm_arg = FSM_AUTH_ARG;
 
+#define DO_SIMPLE(name, var, bit) static void name(struct dds_security_fsm *fsm, void *arg) { \
+  DDSRT_UNUSED_ARG(fsm); \
+  DDSRT_UNUSED_ARG(arg); \
+  if (DB_TC_PRINT_DEBUG) \
+    printf("Transition %s\n", __FUNCTION__); \
+  ddsrt_mutex_lock(&g_lock); \
+  visited_##var |= 1u << (bit); \
+  ddsrt_mutex_unlock(&g_lock); \
+}
 
 
 /**********************************************************************
@@ -136,6 +146,7 @@ static void a(struct dds_security_fsm *fsm, void *arg)
     printf("[%p] Transition %s\n", fsm, __FUNCTION__);
   }
 
+  ddsrt_mutex_lock (&g_lock);
   if (arg != NULL) {
     fsm_arg = (int *) arg;
 
@@ -151,71 +162,17 @@ static void a(struct dds_security_fsm *fsm, void *arg)
   } else {
     correct_fsm = 0;
   }
-  visited_auth |= 1UL << 0;
+  visited_auth |= 1u << 0;
+  ddsrt_mutex_unlock (&g_lock);
 }
 
-static void b(struct dds_security_fsm *fsm, void *arg)
-{
-  DDSRT_UNUSED_ARG(fsm);
-  DDSRT_UNUSED_ARG(arg);
-  if (DB_TC_PRINT_DEBUG)
-    printf("[%p] Transition %s\n", fsm, __FUNCTION__);
-  visited_auth |= 1UL << 1;
-}
-
-static void c(struct dds_security_fsm *fsm, void *arg)
-{
-  DDSRT_UNUSED_ARG(fsm);
-  DDSRT_UNUSED_ARG(arg);
-  if (DB_TC_PRINT_DEBUG)
-    printf("[%p] Transition %s\n", fsm, __FUNCTION__);
-  visited_auth |= 1UL << 2;
-}
-
-static void d(struct dds_security_fsm *fsm, void *arg)
-{
-  DDSRT_UNUSED_ARG(fsm);
-  DDSRT_UNUSED_ARG(arg);
-  if (DB_TC_PRINT_DEBUG)
-    printf("[%p] Transition %s\n", fsm, __FUNCTION__);
-  visited_auth |= 1UL << 3;
-}
-
-static void e(struct dds_security_fsm *fsm, void *arg)
-{
-  DDSRT_UNUSED_ARG(fsm);
-  DDSRT_UNUSED_ARG(arg);
-  if (DB_TC_PRINT_DEBUG)
-    printf("[%p] Transition %s\n", fsm, __FUNCTION__);
-  visited_auth |= 1UL << 4;
-}
-
-static void f(struct dds_security_fsm *fsm, void *arg)
-{
-  DDSRT_UNUSED_ARG(fsm);
-  DDSRT_UNUSED_ARG(arg);
-  if (DB_TC_PRINT_DEBUG)
-    printf("[%p] Transition %s\n", fsm, __FUNCTION__);
-  visited_auth |= 1UL << 5;
-}
-
-static void g(struct dds_security_fsm *fsm, void *arg)
-{
-  DDSRT_UNUSED_ARG(fsm);
-  DDSRT_UNUSED_ARG(arg);
-  if (DB_TC_PRINT_DEBUG)
-    printf("[%p] Transition %s\n", fsm, __FUNCTION__);
-  visited_auth |= 1UL << 6;
-}
-
-static void h(struct dds_security_fsm *fsm, void *arg)
-{
-  DDSRT_UNUSED_ARG(fsm);
-  DDSRT_UNUSED_ARG(arg);
-  if (DB_TC_PRINT_DEBUG)
-    printf("[%p] Transition %s\n", fsm, __FUNCTION__);
-  visited_auth |= 1UL << 7;
-}
+DO_SIMPLE(b, auth, 1)
+DO_SIMPLE(c, auth, 2)
+DO_SIMPLE(d, auth, 3)
+DO_SIMPLE(e, auth, 4)
+DO_SIMPLE(f, auth, 5)
+DO_SIMPLE(g, auth, 6)
+DO_SIMPLE(h, auth, 7)
 
 #define SHM_MSG_RECEIVED (PluginReturn_MAX + 1)
 
@@ -279,33 +236,9 @@ static uint32_t visited_test = 0;
 static int do_stuff_counter = 0;
 static int do_other_stuff_counter = 0;
 
-/* The functions called from the state-machine. */
-static void doStart(struct dds_security_fsm *fsm, void *arg)
-{
-  DDSRT_UNUSED_ARG(fsm);
-  DDSRT_UNUSED_ARG(arg);
-  if (DB_TC_PRINT_DEBUG)
-    printf("Transition %s\n", __FUNCTION__);
-  visited_test |= 1UL << 0;
-}
-
-static void doRestart(struct dds_security_fsm *fsm, void *arg)
-{
-  DDSRT_UNUSED_ARG(fsm);
-  DDSRT_UNUSED_ARG(arg);
-  if (DB_TC_PRINT_DEBUG)
-    printf("Transition %s\n", __FUNCTION__);
-  visited_test |= 1UL << 1;
-}
-
-static void doEventStuff(struct dds_security_fsm *fsm, void *arg)
-{
-  DDSRT_UNUSED_ARG(fsm);
-  DDSRT_UNUSED_ARG(arg);
-  if (DB_TC_PRINT_DEBUG)
-    printf("Transition %s\n", __FUNCTION__);
-  visited_test |= 1UL << 4;
-}
+DO_SIMPLE(doStart, test, 0)
+DO_SIMPLE(doRestart, test, 1)
+DO_SIMPLE(doEventStuff, test, 4)
 
 static void doStuff(struct dds_security_fsm *fsm, void *arg)
 {
@@ -315,7 +248,9 @@ static void doStuff(struct dds_security_fsm *fsm, void *arg)
   if (DB_TC_PRINT_DEBUG) {
     printf("Transition %s - %d\n", __FUNCTION__, do_stuff_counter);
   }
-  visited_test |= 1UL << 2;
+  ddsrt_mutex_lock (&g_lock);
+  visited_test |= 1u << 2;
+  ddsrt_mutex_unlock (&g_lock);
 
   if (do_stuff_counter < 2) {
     dds_security_fsm_dispatch(fsm, eventZ, false);
@@ -333,7 +268,10 @@ static void doOtherStuff(struct dds_security_fsm *fsm, void *arg)
   if (DB_TC_PRINT_DEBUG) {
     printf("Transition %s - %d\n", __FUNCTION__, do_other_stuff_counter);
   }
-  visited_test |= 1UL << 3;
+  ddsrt_mutex_lock (&g_lock);
+  visited_test |= 1u << 3;
+  ddsrt_mutex_unlock (&g_lock);
+
   if (do_other_stuff_counter == 0) {
     dds_security_fsm_dispatch(fsm, DDS_SECURITY_FSM_EVENT_AUTO, false);
   }
@@ -382,17 +320,8 @@ static uint32_t correct_fsm_timeout = 0;
 static uint32_t correct_arg_timeout = 0;
 static struct fsm_timeout_arg fsm_arg = { .id = FSM_AUTH_ARG };
 
-
-/* The functions called from the state-machine. */
-static void doInterupt(struct dds_security_fsm *fsm, void *arg)
-{
-  DDSRT_UNUSED_ARG(fsm);
-  DDSRT_UNUSED_ARG(arg);
-  if (DB_TC_PRINT_DEBUG) {
-    printf("Transition %s\n", __FUNCTION__);
-  }
-  visited_timeout |= 1UL << 0;
-}
+DO_SIMPLE(doInterrupt, timeout, 0)
+DO_SIMPLE(TimeoutCallback2, timeout, 3)
 
 static void doTimeout(struct dds_security_fsm *fsm, void *arg)
 {
@@ -401,7 +330,9 @@ static void doTimeout(struct dds_security_fsm *fsm, void *arg)
   if (DB_TC_PRINT_DEBUG) {
     printf("Transition >>>> %s\n", __FUNCTION__);
   }
-  visited_timeout |= 1UL << 1;
+  ddsrt_mutex_lock (&g_lock);
+  visited_timeout |= 1u << 1;
+  ddsrt_mutex_unlock (&g_lock);
 
   if (DB_TC_PRINT_DEBUG) {
     printf("Transition <<<< %s\n", __FUNCTION__);
@@ -418,7 +349,8 @@ static void TimeoutCallback(struct dds_security_fsm *fsm, void *arg)
     printf("TimeoutCallback\n");
   }
 
-  visited_timeout |= 1UL << 2;
+  ddsrt_mutex_lock (&g_lock);
+  visited_timeout |= 1u << 2;
 
   if (farg != NULL) {
     if (farg->id == FSM_AUTH_ARG) {
@@ -432,21 +364,12 @@ static void TimeoutCallback(struct dds_security_fsm *fsm, void *arg)
   } else {
     correct_fsm_timeout = 0;
   }
-}
-
-static void TimeoutCallback2(struct dds_security_fsm *fsm, void *arg)
-{
-  DDSRT_UNUSED_ARG(fsm);
-  DDSRT_UNUSED_ARG(arg);
-  if (DB_TC_PRINT_DEBUG) {
-    printf("TimeoutCallback2\n");
-  }
-  visited_timeout |= 1UL << 3;
+  ddsrt_mutex_unlock (&g_lock);
 }
 
 static dds_security_fsm_state StateInitial     = {doTimeout,  0};
 static dds_security_fsm_state StateWaitTimeout = {NULL, DDS_SECS(4)};
-static dds_security_fsm_state StateInterupt    = {doInterupt, 0};
+static dds_security_fsm_state StateInterupt    = {doInterrupt, 0};
 
 
 static const dds_security_fsm_transition TimeoutTransitions[] = {
@@ -515,9 +438,6 @@ static dds_security_fsm_transition ParallelTimeoutTransitions_3[] = {
 };
 static const uint32_t ParallelTimeoutTransitionsSize_3 = sizeof(ParallelTimeoutTransitions_3) / sizeof(ParallelTimeoutTransitions_3[0]);
 
-
-
-
 static void fsm_control_init(void)
 {
   dds_return_t rc;
@@ -526,6 +446,8 @@ static void fsm_control_init(void)
   g_participant = dds_create_participant(DDS_DOMAIN_DEFAULT, NULL, NULL);
   CU_ASSERT_FATAL(g_participant > 0);
 
+  ddsrt_mutex_init (&g_lock);
+
   rc = dds_entity_pin(g_participant, &e);
   CU_ASSERT_FATAL(rc == 0);
 
@@ -542,6 +464,7 @@ static void fsm_control_fini(void)
 {
   dds_security_fsm_control_stop(g_fsm_control);
   dds_security_fsm_control_free(g_fsm_control);
+  ddsrt_mutex_destroy (&g_lock);
 
   dds_delete(g_participant);
 }
@@ -582,10 +505,9 @@ CU_Test(ddssec_fsm, create, .init = fsm_control_init, .fini = fsm_control_fini)
   }
   CU_ASSERT(timeout > 0);
 
-  CU_ASSERT(
-          CHECK_BIT(visited_auth, 0) && CHECK_BIT(visited_auth, 1) && CHECK_BIT(visited_auth, 2) &&
-          CHECK_BIT(visited_auth, 3) && CHECK_BIT(visited_auth, 4) && CHECK_BIT(visited_auth, 5) &&
-          CHECK_BIT(visited_auth, 6) && CHECK_BIT(visited_auth, 7));
+  ddsrt_mutex_lock (&g_lock);
+  CU_ASSERT(visited_auth == 0xff);
+  ddsrt_mutex_unlock (&g_lock);
 
   /*
    * "Check correct callback parameter passing (from fsm to user defined methods) ");
@@ -594,7 +516,9 @@ CU_Test(ddssec_fsm, create, .init = fsm_control_init, .fini = fsm_control_fini)
   dds_security_fsm_free(fsm_auth);
 
   /* Check whether timeout callback has NOT been invoked */
+  ddsrt_mutex_lock (&g_lock);
   CU_ASSERT(visited_timeout == 0);
+  ddsrt_mutex_unlock (&g_lock);
 }
 
 /*
@@ -638,10 +562,9 @@ CU_Test(ddssec_fsm, multiple, .init = fsm_control_init, .fini = fsm_control_fini
   CU_ASSERT_FATAL(timeout > 0);
 
   // not all bits are set since we're running the state machine a second time
-  CU_ASSERT_FATAL(
-          CHECK_BIT(visited_auth, 0) && !CHECK_BIT(visited_auth, 1) && CHECK_BIT(visited_auth, 2) &&
-          !CHECK_BIT(visited_auth, 3) && CHECK_BIT(visited_auth, 4) && !CHECK_BIT(visited_auth, 5) &&
-          CHECK_BIT(visited_auth, 6) && !CHECK_BIT(visited_auth, 7));
+  ddsrt_mutex_lock (&g_lock);
+  CU_ASSERT_FATAL(visited_auth == 0x55);
+  ddsrt_mutex_unlock (&g_lock);
 
   /* Wait for the last state to occur */
   timeout = 100; /* 10 sec */
@@ -651,9 +574,9 @@ CU_Test(ddssec_fsm, multiple, .init = fsm_control_init, .fini = fsm_control_fini
   }
   CU_ASSERT_FATAL(timeout > 0);
 
-  CU_ASSERT(
-          CHECK_BIT(visited_test, 0) && CHECK_BIT(visited_test, 1) && CHECK_BIT(visited_test, 2) &&
-          CHECK_BIT(visited_test, 3));
+  ddsrt_mutex_lock (&g_lock);
+  CU_ASSERT(visited_test == 0x1f);
+  ddsrt_mutex_unlock (&g_lock);
 
   dds_security_fsm_free(fsm_auth);
   dds_security_fsm_free(fsm_test);
@@ -668,6 +591,8 @@ CU_Test(ddssec_fsm, timeout, .init = fsm_control_init, .fini = fsm_control_fini)
   dds_time_t delay1 = DDS_SECS(1);
   int timeout;
 
+  visited_timeout = 0;
+
   /*
    * Test timeout monitoring of state machines
    */
@@ -681,13 +606,17 @@ CU_Test(ddssec_fsm, timeout, .init = fsm_control_init, .fini = fsm_control_fini)
 
   // Wait for the last state to occur
   timeout = 100; /* 10 sec */
-  while ((dds_security_fsm_current_state(fsm_timeout) != &StateInterupt) && (timeout > 0)) {
+  ddsrt_mutex_lock (&g_lock);
+  while (visited_timeout != 0x7 && (timeout > 0)) {
+    ddsrt_mutex_unlock (&g_lock);
     dds_sleepfor(100 * DDS_NSECS_IN_MSEC);
     timeout--;
+    ddsrt_mutex_lock (&g_lock);
   }
   CU_ASSERT(timeout > 0);
-  CU_ASSERT(CHECK_BIT(visited_timeout, 0) && CHECK_BIT(visited_timeout, 1) && CHECK_BIT(visited_timeout, 2));
+  CU_ASSERT(visited_timeout == 0x7);
   CU_ASSERT(correct_arg_timeout && correct_fsm_timeout);
+  ddsrt_mutex_unlock (&g_lock);
 
   dds_security_fsm_free(fsm_timeout);
 }
@@ -713,18 +642,15 @@ CU_Test(ddssec_fsm, double_timeout, .init = fsm_control_init, .fini = fsm_contro
   dds_security_fsm_start(fsm_timeout);
   dds_security_fsm_start(fsm_timeout2);
   timeout = 100; /* 10 sec */
-  while ((CHECK_BIT(visited_timeout, 2) == 0) && (timeout > 0)) {
+  ddsrt_mutex_lock (&g_lock);
+  while (visited_timeout != 0xf && (timeout > 0)) {
+    ddsrt_mutex_unlock (&g_lock);
     dds_sleepfor(100 * DDS_NSECS_IN_MSEC);
     timeout--;
+    ddsrt_mutex_lock (&g_lock);
   }
-  CU_ASSERT(CHECK_BIT(visited_timeout, 2));
-//  dds_security_fsm_cleanup(fsm_timeout);
-  timeout = 100; /* 10 sec */
-  while ((CHECK_BIT(visited_timeout, 3) == 0) && (timeout > 0)) {
-    dds_sleepfor(100 * DDS_NSECS_IN_MSEC);
-    timeout--;
-  }
-  CU_ASSERT(CHECK_BIT(visited_timeout, 3));
+  CU_ASSERT(visited_timeout == 0xf);
+  ddsrt_mutex_unlock (&g_lock);
   dds_security_fsm_free(fsm_timeout);
   dds_security_fsm_free(fsm_timeout2);
 }
@@ -817,10 +743,14 @@ CU_Test(ddssec_fsm, delete_with_timeout, .init = fsm_control_init, .fini = fsm_c
 
   /* Wait until we're in the timeout function. */
   timeout = 100; /* 10 sec */
+  ddsrt_mutex_lock (&g_lock);
   while ((visited_timeout == 0) && (timeout > 0)) {
+    ddsrt_mutex_unlock (&g_lock);
     dds_sleepfor(100 * DDS_NSECS_IN_MSEC);
     timeout--;
+    ddsrt_mutex_lock (&g_lock);
   }
+  ddsrt_mutex_unlock (&g_lock);
 
   dds_security_fsm_free(fsm_timeout);
 }

From 7049469289d771f43ce0943bcb0c8b4318e0446b Mon Sep 17 00:00:00 2001
From: Dennis Potman <dennis.potman@adlinktech.com>
Date: Sat, 29 Feb 2020 11:39:23 +0100
Subject: [PATCH 107/238] Update security documentation

An update for the security documentation that is part of the CycloneDDS
manual:
- added openssl commands for creating a set of CA and identity certificates
- code fragment for setting security by qos and example of xml security config
- commands for signing governance and permissions documents using openssl

Signed-off-by: Dennis Potman <dennis.potman@adlinktech.com>
---
 docs/manual/_static/example_governance.xml  |  29 ++
 docs/manual/_static/example_permissions.xml |  39 ++
 docs/manual/_static/security_by_config.xml  |  19 +
 docs/manual/_static/security_by_qos.c       |  21 +
 docs/manual/index.rst                       |   1 +
 docs/manual/security.rst                    | 422 ++++++++++++++------
 6 files changed, 401 insertions(+), 130 deletions(-)
 create mode 100644 docs/manual/_static/example_governance.xml
 create mode 100644 docs/manual/_static/example_permissions.xml
 create mode 100644 docs/manual/_static/security_by_config.xml
 create mode 100644 docs/manual/_static/security_by_qos.c

diff --git a/docs/manual/_static/example_governance.xml b/docs/manual/_static/example_governance.xml
new file mode 100644
index 0000000..b0cb32e
--- /dev/null
+++ b/docs/manual/_static/example_governance.xml
@@ -0,0 +1,29 @@
+<?xml version="1.0" encoding=\"utf-8\"?>
+<dds xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="https://www.omg.org/spec/DDS-SECURITY/20170901/omg_shared_ca_governance.xsd">
+  <domain_access_rules>
+    <domain_rule>
+      <domains>
+        <id_range>
+          <min>0</min>
+          <max>230</max>
+        </id_range>
+      </domains>
+      <allow_unauthenticated_participants>false</allow_unauthenticated_participants>
+      <enable_join_access_control>true</enable_join_access_control>
+      <discovery_protection_kind>NONE</discovery_protection_kind>
+      <liveliness_protection_kind>NONE</liveliness_protection_kind>
+      <rtps_protection_kind>NONE</rtps_protection_kind>
+      <topic_access_rules>
+        <topic_rule>
+          <topic_expression>*</topic_expression>
+          <enable_discovery_protection>true</enable_discovery_protection>
+          <enable_liveliness_protection>true</enable_liveliness_protection>
+          <enable_read_access_control>true</enable_read_access_control>
+          <enable_write_access_control>true</enable_write_access_control>
+          <metadata_protection_kind>SIGN</metadata_protection_kind>
+          <data_protection_kind>ENCRYPT</data_protection_kind>
+        </topic_rule>
+      </topic_access_rules>
+    </domain_rule>
+  </domain_access_rules>
+</dds>
diff --git a/docs/manual/_static/example_permissions.xml b/docs/manual/_static/example_permissions.xml
new file mode 100644
index 0000000..4610555
--- /dev/null
+++ b/docs/manual/_static/example_permissions.xml
@@ -0,0 +1,39 @@
+<?xml version="1.0" encoding="utf-8" ?>
+<dds xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+     xsi:noNamespaceSchemaLocation="https://www.omg.org/spec/DDS-SECURITY/20170901/omg_shared_ca_permissions.xsd">
+  <permissions>
+    <grant name="default_permissions">
+      <subject_name>emailAddress=alice@cycloneddssecurity.adlinktech.com,CN=Alice Example,O=Example Organization,OU=Organizational Unit Name,L=Locality Name,ST=OV,C=NL</subject_name>
+      <validity>
+        <!-- Format is CCYY-MM-DDThh:mm:ss[Z|(+|-)hh:mm] in GMT -->
+        <not_before>2020-01-01T01:00:00</not_before>
+        <not_after>2120-01-01T01:00:00</not_after>
+      </validity>
+      <allow_rule>
+        <domains>
+          <id_range>
+            <min>0</min>
+            <max>230</max>
+          </id_range>
+        </domains>
+        <publish>
+          <topics>
+            <topic>*</topic>
+          </topics>
+          <partitions>
+            <partition>*</partition>
+          </partitions>
+        </publish>
+        <subscribe>
+          <topics>
+            <topic>*</topic>
+          </topics>
+          <partitions>
+            <partition>*</partition>
+          </partitions>
+        </subscribe>
+      </allow_rule>
+      <default>DENY</default>
+    </grant>
+  </permissions>
+</dds>
\ No newline at end of file
diff --git a/docs/manual/_static/security_by_config.xml b/docs/manual/_static/security_by_config.xml
new file mode 100644
index 0000000..947fe78
--- /dev/null
+++ b/docs/manual/_static/security_by_config.xml
@@ -0,0 +1,19 @@
+<Domain id="any">
+  <DDSSecurity>
+    <Authentication>
+      <Library initFunction="init_authentication" finalizeFunction="finalize_authentication" path="dds_security_auth"/>
+      <IdentityCA>file:/path/to/example_id_ca_cert.pem</IdentityCA>
+      <IdentityCertificate>file:/path/to/example_alice_cert.pem</IdentityCertificate>
+      <PrivateKey>file:/path/to/example_alice_priv_key.pem</PrivateKey>
+    </Authentication>
+    <Cryptographic>
+      <Library initFunction="init_crypto" finalizeFunction="finalize_crypto" path="dds_security_crypto"/>
+    </Cryptographic>
+    <AccessControl>
+      <Library initFunction="init_access_control" finalizeFunction="finalize_access_control" path="dds_security_ac"/>
+      <PermissionsCA>file:/path/to/example_perm_ca_cert.pem</PermissionsCA>
+      <Governance>file:/path/to/example_governance.p7s</Governance>
+      <Permissions>file:/path/to/example_permissions.p7s</Permissions>
+    </AccessControl>
+  </DDSSecurity>
+</Domain>
diff --git a/docs/manual/_static/security_by_qos.c b/docs/manual/_static/security_by_qos.c
new file mode 100644
index 0000000..86eea84
--- /dev/null
+++ b/docs/manual/_static/security_by_qos.c
@@ -0,0 +1,21 @@
+dds_qos_t * qos = dds_create_qos();
+
+dds_qset_prop(qos, "dds.sec.auth.library.path", "dds_security_auth");
+dds_qset_prop(qos, "dds.sec.auth.library.init", "init_authentication");
+dds_qset_prop(qos, "dds.sec.auth.library.finalize", "finalize_authentication");
+dds_qset_prop(qos, "dds.sec.auth.identity_ca", "file:/path/to/example_id_ca_cert.pem");
+dds_qset_prop(qos, "dds.sec.auth.private_key", "file:/path/to/example_alice_priv_key.pem");
+dds_qset_prop(qos, "dds.sec.auth.identity_certificate", "file:/path/to/example_alice_cert.pem");
+
+dds_qset_prop(qos, "dds.sec.crypto.library.path", "dds_security_crypto");
+dds_qset_prop(qos, "dds.sec.crypto.library.init", "init_crypto");
+dds_qset_prop(qos, "dds.sec.crypto.library.finalize", "finalize_crypto");
+
+dds_qset_prop(qos, "dds.sec.access.library.path", "dds_security_ac");
+dds_qset_prop(qos, "dds.sec.access.library.init", "init_access_control");
+dds_qset_prop(qos, "dds.sec.access.library.finalize", "finalize_access_control");
+dds_qset_prop(qos, "dds.sec.access.permissions_ca", "file:/path/to/example_perm_ca_cert.pem");
+dds_qset_prop(qos, "dds.sec.access.governance", "file:/path/to/example_governance.p7s");
+dds_qset_prop(qos, "dds.sec.access.permissions", "file:/path/to/example_permissions.p7s");
+
+dds_entity_t participant = dds_create_participant(0, qos, NULL);
diff --git a/docs/manual/index.rst b/docs/manual/index.rst
index 0d729a9..9def6b8 100644
--- a/docs/manual/index.rst
+++ b/docs/manual/index.rst
@@ -21,6 +21,7 @@ Welcome to Eclipse Cyclone DDS's documentation!
    GettingStartedGuide/index
    ddsc
    config
+   security
 
 Indices and tables
 ==================
diff --git a/docs/manual/security.rst b/docs/manual/security.rst
index b8ae578..5311b85 100644
--- a/docs/manual/security.rst
+++ b/docs/manual/security.rst
@@ -4,7 +4,7 @@
 DDS Security
 ############
 
-CycloneDDS is (will be) compliant with The Object Management Group (OMG) DDS Security specification.
+CycloneDDS is compliant with The Object Management Group (OMG) DDS Security specification.
 
 This specification defines the Security Model and Service Plugin Interface (SPI) architecture for
 compliant DDS implementations. The DDS Security Model is enforced by the invocation of these SPIs
@@ -109,25 +109,28 @@ ID CA gets Alice's subject information and public key and generates an IdentityC
 Alice's certificate includes her public key and certificate of ID CA; so that her certificate can
 be verified if it is really issued by ID CA.
 
-Access Control is configured with governance and permissions files.
-Governance file defines the security behavior of domains and topics.
-Permissions file contains the permissions of the domain participant, topics, readers and writers,
-binds them to identity certificate by subject name (distinguished name).
+Access Control is configured with governance and permissions files. Governance file defines the
+security behavior of domains and topics. Permissions file contains the permissions of the domain
+participant, topics, readers and writers, binds them to identity certificate by subject name
+(distinguished name).
 
 Governance files and Permissions files are signed by Permission CA. Signed documents also
 contains Permissions CA certificate; so that they can be verified if they are really issued
 by Permissions CA.
 
-Authenticated participants handshakes with each other and generates a shared key by Diffie-Hellman
-key exchange. This shared key is used for encrypting/decrypting data with AES.
+Authenticated participants perform a handshake with each other and generate a shared key by
+Diffie-Hellman key exchange. This shared key is used for encrypting/decrypting data with AES.
 
 During the handshake Alice checks Bob's certificate and Bob's Permissions file if they are really
 issued by the ID CA certificate and Permissions CA Certificate that **she** has. Also Bob checks
 Alice's certificate and Alice's Permissions file if they are really issued by the ID CA certificate
 and Permissions CA that **he** has.
-Permissions file can contain  permissions for several identities; so subject name of identity
+Permissions files can contain permissions for several identities; so subject name of identity
 certificate exist in permissions file to establish a binding between identity and its permissions.
 
+There are several ways to set up the certificates and signed configuration files to be used with
+Cyclone DDS Security. One of them is using OpenSSL, which is described in section
+`Creating certificates using OpenSSL`_.
 
 *************
 Configuration
@@ -142,29 +145,21 @@ The configuration of DDS Security is split up into two parts.
 - `Plugins Configuration`_
 - `Access Control Configuration`_
 
-This section explains the configuration in details. However, you can see a concrete example on
-security section of Example Readme file.
-
-.. _`Plugins Configuration`:
-
 
 Plugins Configuration
 *********************
 
-TODO: Update to reflect the configuration through QoS policies.
+CycloneDDS gets the security configuration from DDS2I XML configuration elements or from
+the participant QoS policies as stated in the DDS Security specification.
 
-| CyclonDDS gets the plugin configuration from DDS2I configuration elements or the Participant QoS
-  Policies as stated in the DDS Security specification.
-
-| This behavior allows applications to use DDS Security without update. Only supplying a new
-  configuration with DDS Security enabled is enough to switch from a non-secure to a secure
-  deployment. However, the same DDS Security configuration is forced upon all the participants
-  within the federation.
-
-| The configuration options are bundled in the ``DDSSecurity`` configuration section in DDS2I.
-
-| Every DDS Security plugin has its own configuration sub-section.
+This behavior allows applications to use DDS Security without recompiling the binaries.
+Only supplying a new configuration with DDS Security enabled is enough to switch from a
+non-secure to a secure deployment. The configuration is at domain level, which means
+that all participants created for that domain receive the same DDS security settings.
 
+The configuration options for a domain are bundled in the ``DDSSecurity`` configuration
+section in the CycloneDDS configuration. Every DDS Security plugin has its own configuration
+sub-section.
 
 .. _`Authentication Properties`:
 
@@ -172,35 +167,31 @@ TODO: Update to reflect the configuration through QoS policies.
 Authentication Properties
 =========================
 
-| To authenticate CycloneDDS, it has to be configured with IdentityCertificate
-  (DDSSecurity/Authentication/IdentityCertificate - see Configuration Guide - DDS Security).
-  This IdentityCertificate is used to authenticate all participants of that particular
-  CycloneDDS domain.
+To enable authentication for a node, it has to be configured with an identity certificate
+(``DDSSecurity/Authentication/IdentityCertificate``). This identity certificate is used to
+authenticate all participants of that particular CycloneDDS domain. Associated with the
+identity certificate is the corresponding private key
+(``DDSSecurity/Authentication/PrivateKey``). The private key may either be a 2048-bit RSA
+or a 256-bit Elliptic Curve Key with a prime256v1 curve.
 
-| Associated with the IdentityCertificate is the corresponding PrivateKey
-  (DDSSecurity/Authentication/PrivateKey).
-  The PrivateKey may either be a 2048-bit RSA or a 256-bit Elliptic Curve Key with
-  a prime256v1 curve.
+The certificate of identity CA, which is the issuer of the node's identity certificate,
+is configured in ``DDSSecurity/Authentication/IdentityCA``. The public key of the
+identity CA (as part of its certificate) shall either be a 2048-bit RSA key or a 256-bit
+Elliptic Curve Key for the prime256v1 curve. The identity CA certificate can be a
+self-signed certificate.
 
-| IdentityCA (DDSSecurity/Authentication/IdentityCA) is the certificate of Identity Certificate
-  Authority (CA) which is the issuer of the IdentityCertificate.  The public key of the
-  IdentityCA shall either be a 2048-bit RSA key or a 256-bit Elliptic Curve Key for the prime256v1
-  curve. The identity_ca can be a self-signed certificate.
+The identity certificate, private key and the identity CA should be a X509 document in PEM
+format. It may either be specified directly in the configuration file (as CDATA, prefixed
+with ``data:,``) or the configuration file should contain a reference to a corresponding
+file (prefixed with ``file:``).
 
-| Currently the IdentityCertificate, IdentityCA and PrivateKey should be a X509 document in pem
-  format.
-  It may either be specified directly in the configuration file or the configuration file should
-  contain a reference to a corresponding file.
-
-| Optionally the PrivateKey could be protected by a password (DDSSecurity/Authentication/Password).
-
-| Furthermore the CycloneDDS configuration allows to configure a directory containing additional
-  IdentityCA's
-  which are used to verify the identity certificates that are received by remote instances
-  (DDSSecurity/Authentication/TrustedCADirectory). This option allows to use more than one identity
-  CA throughout the system. TrustedCADirectory is an extension to DDS Security specification; so it
-  can not be used when communicating with other vendors.
+Optionally the private key could be protected by a password
+(``DDSSecurity/Authentication/Password``).
 
+Furthermore the CycloneDDS configuration allows to configure a directory containing additional
+identity CA's which are used to verify the identity certificates that are received by remote instances
+(``DDSSecurity/Authentication/TrustedCADirectory``). This option allows to use more than one identity
+CA throughout the system.
 
 .. _`Access Control Properties`:
 
@@ -208,11 +199,11 @@ Authentication Properties
 Access Control Properties
 =========================
 
-Governance Document (DDSSecurity/AccessControl/Governance),
-Permissions Document (DDSSecurity/AccessControl/Permissions) and
-Permissions CA Certificate (DDSSecurity/AccessControl/PermissionsCA) are required for access
-control plugin. See DDS Security section of Configuration Guide for property descriptions. They
-can be provided by data itself (with CDATA) or path to file on disk.
+A governance document (``DDSSecurity/AccessControl/Governance``), a permissions document
+(``DDSSecurity/AccessControl/Permissions``) and the permissions CA certificate
+(``DDSSecurity/AccessControl/PermissionsCA``) are required for the access control plugin.
+Similar to the authentication plugin properties, these values can be provided as CDATA or
+by using a path to a file.
 
 
 .. _`Cryptography Properties`:
@@ -221,7 +212,7 @@ can be provided by data itself (with CDATA) or path to file on disk.
 Cryptography Properties
 =======================
 
-Cryptography plugin has no property
+The cryptography plugin has no properties in the configuration.
 
 
 .. _`Access Control Configuration`:
@@ -229,15 +220,15 @@ Cryptography plugin has no property
 Access Control Configuration
 ****************************
 
-| Access Control configuration consists of Governance document and Permissions document.
-  Both governance and permissions files must be signed by the Permissions CA in S/MIME format.
-  Participants use their own permissions CA to validate remote permissions. So, all permissions CA
-  Certificates must be same for all participants.
+Access Control configuration consists of Governance document and Permissions document.
+Both governance and permissions files must be signed by the Permissions CA in S/MIME format.
+Participants use their own permissions CA to validate remote permissions. So, all permissions CA
+Certificates must be same for all participants.
 
-| The signed document should use S/MIME version 3.2 format as defined in IETF RFC 5761 using
-  SignedData Content Type (section 2.4.2 of IETF RFC 5761) formatted as multipart/signed (section
-  3.4.3 of IETF RFC 5761). This corresponds to the mime-type application/pkcs7-signature.
-  Additionally the signer certificate should be be included within the signature.
+The signed document should use S/MIME version 3.2 format as defined in IETF RFC 5761 using
+SignedData Content Type (section 2.4.2 of IETF RFC 5761) formatted as multipart/signed (section
+3.4.3 of IETF RFC 5761). This corresponds to the mime-type application/pkcs7-signature.
+Additionally the signer certificate should be be included within the signature.
 
 
 ===================
@@ -245,10 +236,12 @@ Governance Document
 ===================
 
 Governance document defines the security behavior of domains and topics. It is an XML document and
-its format is specified in OMG DDS Security Version 1.1 Section 9.4.1.2.3
+its format is specified in OMG DDS Security Version 1.1 Section 9.4.1.2.3.
 
-The attributes that specified in Governance document must match with the remote one for
-establishing communication.
+This section describes the properties that can be specified in a permissions document. An example
+of a governance document is provided in `Create a signed governance document`_. The options
+that are specified in Governance document must match with the remote node to establishing
+communication.
 
 
 Protection Kinds
@@ -345,9 +338,8 @@ Topic Attributes
 
 There are different settings for different domain ranges. The domain rules are evaluated in the
 same order as they appear in the document. A rule only applies to a particular DomainParticipant
-if the domain Section matches the DDS domain_id to
-which the DomainParticipant belongs. If multiple rules match, the first rule that matches is the
-only one that applies.
+if the domain Section matches the DDS domain_id to which the participant belongs. If multiple
+rules match, the first rule that matches is the only one that applies.
 
 The topic access rules are evaluated in the same order as they appear within the
 <topic_access_rules> Section. If multiple rules match the first rule that matches is the only one
@@ -378,6 +370,9 @@ The permissions document is an XML document containing the permissions of the do
 and binding them to the subject name of the DomainParticipant as defined in the identity
 certificate. Its format is specified in OMG DDS Security Version 1.1 Section 9.4.1.3.
 
+This section describes the properties that can be specified in a permissions document. An example
+of a permissions document is provided in `Creating a signed permissions document`_.
+
 
 Validity period
 ===============
@@ -394,20 +389,19 @@ The subject name must match with Identity Certificate subject. It is checked dur
 participant and during handshake with remote participant. Use the following openssl command to get
 subject name from identity certificate:
 
-``openssl x509 -noout -subject -nameopt RFC2253 -in <identity_certificate_file.crt>``
+``openssl x509 -noout -subject -nameopt RFC2253 -in <identity_certificate_file.pem>``
 
 
 Rules
 =====
 
-DomainParticipant permissions are defined by set of rules.
-
-The rules are applied in the same order that appear in the document. If the criteria for the rule
-matches the domain_id join and/or publish or subscribe operation that is being attempted, then the
-allow or deny decision is applied. If the criteria for a rule does not match the operation being
-attempted, the evaluation shall proceed to the next rule. If all rules have been examined without
-a match, then the decision specified by the “default” rule is applied. The default rule, if
-present, must appear after all allow and deny rules. If the default rule is not present, the
+Participant permissions are defined by set of rules. The rules are applied in the same order
+that appear in the document. If the criteria for the rule matches the domain_id join and/or publish
+or subscribe operation that is being attempted, then the allow or deny decision is applied.
+If the criteria for a rule does not match the operation being attempted, the evaluation
+shall proceed to the next rule. If all rules have been examined without a match, then the
+decision specified by the “default” rule is applied. The default rule, if present, must
+appear after all allow and deny rules. If the default rule is not present, the
 implied default decision is DENY. The matching criteria for each rule specify the domain_id,
 topics (published and subscribed), the partitions (published and subscribed), and the data-tags
 associated with the DataWriter and DataReader.
@@ -420,11 +414,11 @@ the expressions with the <topics> section).
 `fnmatch pattern matching`_ can be used for topic expressions and partition expressions.
 
 
-Interactions with DDS Security
-******************************
+Logging and tracing
+*******************
 
-DDS Security provides the responses through CycloneDDS error and info log. Users can get
-messages for:
+The security implementation uses the standard logging and tracing mechanism in CycloneDDS.
+The following is written to log and trace:
 
 - Configuration errors such as plugin library files, certificate files, governance and permissions
   files that can not be found on filesystem.
@@ -433,17 +427,16 @@ messages for:
   readers and writers.
 - Integrity errors such as Permissions file-Permissions CA and Identity Cert-Identity CA integrity.
 
-Local subscription, publication and topic permission errors are written to error log.
-Remote participation, subscription and publication permission errors are written to info log as
-warning message.
+Local subscription, publication and topic permission errors are written as errors.
+Remote participation, subscription and publication permission errors are written to log as
+warning messages.
 
 
 Data Communication And Handshake Process
-*******************************************
+****************************************
 
-Authentication handshake between participants starts after participant discovery.
-If a reader and a writer created during that period, their match will be delayed until after the
-handshake succeeds.
+Authentication handshake between participants starts after participant discovery. If a reader and
+a writer created during that period, their match will be delayed until after the handshake succeeds.
 This means, during the handshake process, volatile data will be lost, just like there is no reader.
 
 After publication match, the encryption / decryption keys are exchanged between reader and writer.
@@ -452,12 +445,11 @@ resent.
 
 
 DDS Secure Discovery
-******************************
+********************
 
 Just like normal operation, DDSI will discover local and remote participants, topics, readers and
-writers.
-However, when DDS Security is enabled, it is more complex and will take a longer time (especially
-due to the handshaking that has to happen).
+writers. However, when DDS Security is enabled, it is more complex and will take a longer time
+(due to the handshaking that is required).
 
 With every new node in the system, the discovery takes exponentially longer. This can become a
 problem if the system contains a number of slow platforms or is large.
@@ -467,30 +459,199 @@ Internal/SquashParticipants configuration.
 
 
 Proprietary builtin endpoints
-******************************
+*****************************
 
-| The DDS standard contains some builtin endpoints. A few are added by the DDS Security
-  specification. The behaviour of all these builtin endpoints are specified (and thus are be
-  handled by the plugins that implement the DDS Security specification), meaning that they
-  don't have to be present in the Governance or Permissions documents and the users don't
-  have to be bothered with them.
-|
-| A few of these builtin endpoints slave according to the <discovery_protection_kind> within
-  the Governance document. In short, related submessages are protected according to the value
-  of <discovery_protection_kind>. This protects meta information that is send during the
-  discovery phase.
+The DDS standard contains some builtin endpoints. A few are added by the DDS Security
+specification. The behaviour of all these builtin endpoints are specified (and thus are be
+handled by the plugins that implement the DDS Security specification), meaning that they
+don't have to be present in the Governance or Permissions documents and the users don't
+have to be bothered with them.
+
+A few of these builtin endpoints slave according to the <discovery_protection_kind> within
+the Governance document. In short, related submessages are protected according to the value
+of <discovery_protection_kind>. This protects meta information that is send during the
+discovery phase.
 
 
 *******************
 DataTag Permissions
 *******************
 
-| Data Tags provide an extra (optional) level of identification. This can mean f.i. that
-  a certain reader is not allowed to read data from writer A but it is allowed to read from
-  writer B (all the same topic).
-|
-| This optional feature is not yet supported.
+Data Tags provide an extra (optional) level of identification. This can mean f.i. that
+a certain reader is not allowed to read data from writer A but it is allowed to read from
+writer B (all the same topic).
 
+This optional feature is not yet supported.
+
+
+.. _`Example configuration`:
+
+*********************
+Example configuration
+*********************
+
+This sections show an example configuration for DDS Security in Cyclone DDS. First step is
+creating the required CA and identity certificates. Then a governance and permissions document
+is created to configure access control. Next an example configuration (XML) that
+is using these assets is shown, and a code fragment that shows how to set the security
+properties by using the participant QoS.
+
+
+.. _`Creating certificates using OpenSSL`:
+
+Creating certificates using OpenSSL
+***********************************
+
+This section describes how to generate a set of CA and identity certificates using OpenSSL,
+and how to use OpenSSL to sign the governance and access control configuration files.
+
+First step is generation of the CA for identity management (authentication). First we create the
+private key for the CA by:
+
+.. code-block:: bash
+
+  openssl genrsa -out example_id_ca_priv_key.pem 2048
+
+Next we can generate the certificate for the identity CA (which is in this case a self-signed
+certificate):
+
+.. code-block:: bash
+
+  openssl req -x509 -key example_id_ca_priv_key.pem -out example_id_ca_cert.pem -days 3650 -subj "/C=NL/ST=OV/L=Locality Name/OU=Example OU/O=Example ID CA Organization/CN=Example ID CA/emailAddress=authority@cycloneddssecurity.adlinktech.com"
+
+We repeat these steps for generating the private key of the permissions CA (used for
+signing the AccessControl configiguration files):
+
+.. code-block:: bash
+
+  openssl genrsa -out example_perm_ca_priv_key.pem 2048
+
+And the self-signed certificate for the permissions CA:
+
+.. code-block:: bash
+
+  openssl req -x509 -key example_perm_ca_priv_key.pem -out example_perm_ca_cert.pem -days 3650 -subj "/C=NL/ST=OV/L=Locality Name/OU=Example OU/O=Example CA Organization/CN=Example Permissions CA/emailAddress=authority@cycloneddssecurity.adlinktech.com"
+
+==============================
+Create an Identity Certificate
+==============================
+
+Now that we have set up the CA for identity management, we can create an identity certificate
+signed by this CA and the private key corresponding to this identity. Here we are creating
+a private key and certificate for identity named Alice. These steps need to be repeated for each
+identity in the system.
+
+Generating the private key for Alice's identity:
+
+.. code-block:: bash
+
+  openssl genrsa -out example_alice_priv_key.pem 2048
+
+Now we create a 'certificate signing request' (CSR) to request the identity CA to generate a certificate:
+
+.. code-block:: bash
+
+  openssl req -new -key example_alice_priv_key.pem -out example_alice.csr -subj "/C=NL/ST=OV/L=Locality Name/OU=Organizational Unit Name/O=Example Organization/CN=Alice Example/emailAddress=alice@cycloneddssecurity.adlinktech.com"
+
+Next Alice's identity certificate is created:
+
+.. code-block:: bash
+
+  openssl x509 -req -CA example_id_ca_cert.pem -CAkey example_id_ca_priv_key.pem -CAcreateserial -days 3650 -in example_alice.csr -out example_alice_cert.pem
+
+
+Now the file 'example_alice_cert.pem' can be used as ``IdentityCertificate`` in the DDS Security
+authentication configuration and 'example_alice_priv_key.pem' for the ``PrivateKey`` setting. The
+certificate of the CA used for signing this identity, 'example_id_ca_cert.pem' in this example,
+should be used for the ``IdentityCA`` configuration setting.
+
+
+.. _`Create a signed governance document`:
+
+===================================
+Create a signed governance document
+===================================
+
+An example of a governance document that is using signing for submessage and encrypted payload:
+
+.. literalinclude:: _static/example_governance.xml
+    :linenos:
+    :language: xml
+
+As mentioned before, the governance document needs to be signed by the permissions CA
+that was created above. This can be done by using this openssl command:
+
+.. code-block:: bash
+
+  openssl smime -sign -in example_governance.xml -text -out example_governance.p7s -signer example_perm_ca_cert.pem -inkey example_perm_ca_priv_key.pem
+
+
+.. _`Creating a signed permissions document`:
+
+======================================
+Creating a signed permissions document
+======================================
+
+The permissions document is an XML document that contains the permissions of the participant and
+binds them to the subject name of the identity certificate (distinguished name) for the participant
+as defined in the DDS:Auth:PKI-DH authentication plugin.
+
+An example of a permissions document:
+
+.. literalinclude:: _static/example_permissions.xml
+    :linenos:
+    :language: xml
+
+This document also needs to be signed by the permissions CA:
+
+.. code-block:: bash
+
+  openssl smime -sign -in example_permissions.xml -text -out example_permissions.p7s -signer example_perm_ca_cert.pem -inkey example_perm_ca_priv_key.pem
+
+
+Example DDS Security configuration
+**********************************
+
+With the above steps we have all certificates and documents that are required when configuring
+security. In the next two sections, both configuring security by properties and configuring
+security by DDS configuration are covered.
+
+======================================
+Security properties in participant QoS
+======================================
+
+This code fragment shows how to set the security properties to a QoS object and use this QoS
+when creating a participant:
+
+.. literalinclude:: _static/security_by_qos.c
+    :linenos:
+    :language: c
+
+
+===========================================
+Configure security in Cyclone configuration
+===========================================
+
+As an alternative for using the QoS, security settings can also be applied using the CycloneDDS
+configuration XML. In case both QoS and the configuration XML contain security settings, the values
+from the QoS will be used and the security settings in the configuration XML are ignored.
+
+The following XML fragment shows how to set security settings through configuration:
+
+.. literalinclude:: _static/security_by_config.xml
+    :linenos:
+    :language: xml
+
+To use this configuration file for an application, set the CYCLONEDDS_URI environment
+variable to this config file:
+
+.. code-block:: bash
+
+  export CYCLONEDDS_URI=/path/to/secure_config.xml
+
+Bacause this example configuration uses the attribute ``id=any`` for the ``domain`` element, any participant
+that is created (which implicitly creates a domain) in an application using this configuration gets
+these security settings.
 
 ***************************
 External Plugin Development
@@ -502,7 +663,7 @@ The plugins are loaded in the run-time. However, you can also implement your own
 implementing the given API according to OMG DDS Security specification.
 You can implement all of the plugins or just one of them.
 
-| The followings are the key points for implementing you own plugin:
+The followings are the key points for implementing you own plugin:
 
 
 Interface
@@ -516,24 +677,23 @@ dds_security_api_cryptography.h header files accordingly.
 Init and Finalize
 *****************
 
-| A plugin should have an init and a finalize functions. plugin_init and plugin_finalize
-  interfaces are given in dds_security_api.h header file and function should be same as in
-  configuration file.
-| Init function is called once, just after the plugin is loaded. Finalize function is
-  called once, just before the plugin is unloaded.
-
+A plugin should have an init and a finalize functions. plugin_init and plugin_finalize
+interfaces are given in dds_security_api.h header file and function should be same as in
+configuration file.
+Init function is called once, just after the plugin is loaded. Finalize function is
+called once, just before the plugin is unloaded.
 
 Inter Plugin Communication
 **************************
 
-| There is a shared object (*DDS_Security_SharedSecretHandle*) within authentication and
-  cryptography plugins. If you want to implement only one of them and use the builtin for the
-  other one, you have to get or provide the shared object properly.
-| *DDS_Security_SharedSecretHandle* is the integer representation of
-  *DDS_Security_SharedSecretHandleImpl* struct object. Cryptography plugin gets the
-  *DDS_Security_SharedSecretHandle* from authentication plugin and casts to
-  *DDS_Security_SharedSecretHandleImpl* struct. Then all needed information can be retieved
-  through *DDS_Security_SharedSecretHandleImpl* struct:
+There is a shared object (*DDS_Security_SharedSecretHandle*) within authentication and
+cryptography plugins. If you want to implement only one of them and use the builtin for the
+other one, you have to get or provide the shared object properly.
+*DDS_Security_SharedSecretHandle* is the integer representation of
+*DDS_Security_SharedSecretHandleImpl* struct object. Cryptography plugin gets the
+*DDS_Security_SharedSecretHandle* from authentication plugin and casts to
+*DDS_Security_SharedSecretHandleImpl* struct. Then all needed information can be retieved
+through *DDS_Security_SharedSecretHandleImpl* struct:
 
 ::
 
@@ -549,9 +709,9 @@ Inter Plugin Communication
 Error Codes
 ***********
 
-| Most of the plugin functions have parameter for reporting exception. The following exception
-  codes should be used in the reported exception data according to the situation.
-  dds_security_api_err.h header file contains the code and message constants.
+Most of the plugin functions have parameter for reporting exception. The following exception
+codes should be used in the reported exception data according to the situation.
+dds_security_api_err.h header file contains the code and message constants.
 
 +-------+----------------------------------------------------------------+
 | Code  |            Message                                             |
@@ -638,9 +798,11 @@ Error Codes
 +-------+----------------------------------------------------------------+
 | 149   | Could not find valid grant in permissions                      |
 +-------+----------------------------------------------------------------+
-| 150   | Permissions of subject (%s) outside validity date: %s - %s     |
+| 150   | Unsupported URI type: %s                                       |
 +-------+----------------------------------------------------------------+
-| 151   | Unsupported URI type: %s                                       |
+| 151   | The payload is not aligned at 4 bytes                          |
++-------+----------------------------------------------------------------+
+| 200   | Undefined Error Message                                        |
 +-------+----------------------------------------------------------------+
 
 .. EoF

From 24e42fd658c087e9eb019c8b45429251c44140cb Mon Sep 17 00:00:00 2001
From: eboasson <eb@ilities.com>
Date: Tue, 3 Mar 2020 16:14:33 +0100
Subject: [PATCH 108/238] Fix a few typos in security documentation

Signed-off-by: Erik Boasson <eb@ilities.com>
---
 docs/manual/security.rst | 37 ++++++++++++++-----------------------
 1 file changed, 14 insertions(+), 23 deletions(-)

diff --git a/docs/manual/security.rst b/docs/manual/security.rst
index 5311b85..078a013 100644
--- a/docs/manual/security.rst
+++ b/docs/manual/security.rst
@@ -42,9 +42,6 @@ authentication and Diffie-Hellman is used for key exchange. AccessControl use Pe
 signed by shared Certificate Authority. Cryptography uses AES-GCM (AES using Galois Counter Mode)
 for encryption and AES-GMAC for message authentication.
 
-The plugins are accessed by the DDSI2 service when DDS Security is enabled by supplying the
-security configuration within the XML configuration or Participant QoS.
-
 Security plugins are dynamically loaded where the locations are defined in CycloneDDS
 configuration or Participant QoS settings.
 
@@ -149,7 +146,7 @@ The configuration of DDS Security is split up into two parts.
 Plugins Configuration
 *********************
 
-CycloneDDS gets the security configuration from DDS2I XML configuration elements or from
+CycloneDDS gets the security configuration from XML configuration elements or from
 the participant QoS policies as stated in the DDS Security specification.
 
 This behavior allows applications to use DDS Security without recompiling the binaries.
@@ -188,10 +185,10 @@ file (prefixed with ``file:``).
 Optionally the private key could be protected by a password
 (``DDSSecurity/Authentication/Password``).
 
-Furthermore the CycloneDDS configuration allows to configure a directory containing additional
-identity CA's which are used to verify the identity certificates that are received by remote instances
-(``DDSSecurity/Authentication/TrustedCADirectory``). This option allows to use more than one identity
-CA throughout the system.
+Furthermore the CycloneDDS configuration allows configuring a directory containing additional
+identity CA's which are used to verify the identity certificates that are received from remote instances
+(``DDSSecurity/Authentication/TrustedCADirectory``). This option allows multiple identity
+CAs throughout the system.
 
 .. _`Access Control Properties`:
 
@@ -223,7 +220,7 @@ Access Control Configuration
 Access Control configuration consists of Governance document and Permissions document.
 Both governance and permissions files must be signed by the Permissions CA in S/MIME format.
 Participants use their own permissions CA to validate remote permissions. So, all permissions CA
-Certificates must be same for all participants.
+Certificates must be the same for all participants.
 
 The signed document should use S/MIME version 3.2 format as defined in IETF RFC 5761 using
 SignedData Content Type (section 2.4.2 of IETF RFC 5761) formatted as multipart/signed (section
@@ -235,8 +232,8 @@ Additionally the signer certificate should be be included within the signature.
 Governance Document
 ===================
 
-Governance document defines the security behavior of domains and topics. It is an XML document and
-its format is specified in OMG DDS Security Version 1.1 Section 9.4.1.2.3.
+The Governance document defines the security behavior of domains and topics. It is an XML document
+and its format is specified in OMG DDS Security Version 1.1 Section 9.4.1.2.3.
 
 This section describes the properties that can be specified in a permissions document. An example
 of a governance document is provided in `Create a signed governance document`_. The options
@@ -377,9 +374,8 @@ of a permissions document is provided in `Creating a signed permissions document
 Validity period
 ===============
 
-It is checked before creating participant; expired permissions document results with DDSI shutdown.
-Validity period is also checked during handshake with remote participant; expired remote
-permissions document prevents communications to be established.
+It is checked before creating participant. Validity period is also checked during handshake with
+remote participant; expired remote permissions document prevents communications to be established.
 
 
 Subject Name
@@ -447,15 +443,10 @@ resent.
 DDS Secure Discovery
 ********************
 
-Just like normal operation, DDSI will discover local and remote participants, topics, readers and
-writers. However, when DDS Security is enabled, it is more complex and will take a longer time
-(due to the handshaking that is required).
-
-With every new node in the system, the discovery takes exponentially longer. This can become a
-problem if the system contains a number of slow platforms or is large.
-
-The Security discovery performance can be increased quite a bit by using the DDSI
-Internal/SquashParticipants configuration.
+Just like normal operation, Cyclone DDS discovers remote participants, topics, readers and writers.
+However, when DDS Security is enabled, it is more complex and will take a longer time (due to the
+handshaking that is required). The effort to perform discovery grows quadratically in the number of
+nodes. This can become a problem if the system contains a number of slow platforms or is large.
 
 
 Proprietary builtin endpoints

From b3c5a8d4fcf43e9c75780feb6b89a9beb2ed89f7 Mon Sep 17 00:00:00 2001
From: Dennis Potman <dennis.potman@adlinktech.com>
Date: Mon, 24 Feb 2020 14:03:25 +0100
Subject: [PATCH 109/238] Refactored expand_vars so that a custom lookup
 function can be used, which makes it usable for replacing tags by values
 other than environment variables

Signed-off-by: Dennis Potman <dennis.potman@adlinktech.com>
---
 src/core/ddsc/src/dds_participant.c           |  2 +-
 src/core/ddsc/tests/config.c                  |  2 +-
 src/core/ddsc/tests/participant.c             |  2 +-
 src/ddsrt/CMakeLists.txt                      |  3 +-
 src/ddsrt/include/dds/ddsrt/environ.h         |  3 +-
 src/ddsrt/include/dds/ddsrt/expand_vars.h     | 78 +++++++++++++++++++
 src/ddsrt/src/environ.c                       | 59 ++++++++++++++
 src/ddsrt/src/environ/posix/environ.c         |  2 +-
 src/ddsrt/src/environ/solaris2.6/environ.c    |  2 +-
 src/ddsrt/src/environ/windows/environ.c       |  2 +-
 .../src/{expand_envvars.c => expand_vars.c}   | 62 ++++++---------
 src/ddsrt/src/xmlparser.c                     |  6 +-
 src/ddsrt/tests/environ.c                     |  4 +-
 src/ddsrt/tests/process_app.c                 |  2 +-
 14 files changed, 180 insertions(+), 49 deletions(-)
 create mode 100644 src/ddsrt/include/dds/ddsrt/expand_vars.h
 create mode 100644 src/ddsrt/src/environ.c
 rename src/ddsrt/src/{expand_envvars.c => expand_vars.c} (72%)

diff --git a/src/core/ddsc/src/dds_participant.c b/src/core/ddsc/src/dds_participant.c
index 3cbb48d..5d84fb8 100644
--- a/src/core/ddsc/src/dds_participant.c
+++ b/src/core/ddsc/src/dds_participant.c
@@ -96,7 +96,7 @@ dds_entity_t dds_create_participant (const dds_domainid_t domain, const dds_qos_
   dds_participant * pp;
   ddsi_plist_t plist;
   dds_qos_t *new_qos = NULL;
-  char *config = "";
+  const char *config = "";
 
   /* Make sure DDS instance is initialized. */
   if ((ret = dds_init ()) < 0)
diff --git a/src/core/ddsc/tests/config.c b/src/core/ddsc/tests/config.c
index a7d2bec..546062a 100644
--- a/src/core/ddsc/tests/config.c
+++ b/src/core/ddsc/tests/config.c
@@ -29,7 +29,7 @@
 
 static void config__check_env (const char *env_variable, const char *expected_value)
 {
-  char *env_uri = NULL;
+  const char *env_uri = NULL;
   ddsrt_getenv (env_variable, &env_uri);
 #ifdef FORCE_ENV
   {
diff --git a/src/core/ddsc/tests/participant.c b/src/core/ddsc/tests/participant.c
index 6100f5d..70697a5 100644
--- a/src/core/ddsc/tests/participant.c
+++ b/src/core/ddsc/tests/participant.c
@@ -111,7 +111,7 @@ CU_Test(ddsc_participant, create_with_conf_no_env) {
     ddsrt_setenv(DDS_PROJECT_NAME_NOSPACE_CAPS"_URI", CONFIG_ENV_SIMPLE_UDP);
     ddsrt_setenv("MAX_PARTICIPANTS", CONFIG_ENV_MAX_PARTICIPANTS);
 
-    char * env_uri = NULL;
+    const char * env_uri = NULL;
     ddsrt_getenv(DDS_PROJECT_NAME_NOSPACE_CAPS"_URI", &env_uri);
     CU_ASSERT_PTR_NOT_EQUAL_FATAL(env_uri, NULL);
 
diff --git a/src/ddsrt/CMakeLists.txt b/src/ddsrt/CMakeLists.txt
index 6efefdd..b81f86b 100644
--- a/src/ddsrt/CMakeLists.txt
+++ b/src/ddsrt/CMakeLists.txt
@@ -131,7 +131,8 @@ list(APPEND sources
   "${source_path}/strtol.c"
   "${source_path}/mh3.c"
   "${source_path}/avl.c"
-  "${source_path}/expand_envvars.c"
+  "${source_path}/environ.c"
+  "${source_path}/expand_vars.c"
   "${source_path}/fibheap.c"
   "${source_path}/hopscotch.c"
   "${source_path}/thread_pool.c"
diff --git a/src/ddsrt/include/dds/ddsrt/environ.h b/src/ddsrt/include/dds/ddsrt/environ.h
index d5d895e..dd65f01 100644
--- a/src/ddsrt/include/dds/ddsrt/environ.h
+++ b/src/ddsrt/include/dds/ddsrt/environ.h
@@ -14,6 +14,7 @@
 
 #include "dds/export.h"
 #include "dds/ddsrt/attributes.h"
+#include "dds/ddsrt/expand_vars.h"
 #include "dds/ddsrt/retcode.h"
 
 #if defined(__cplusplus)
@@ -42,7 +43,7 @@ extern "C" {
 DDS_EXPORT dds_return_t
 ddsrt_getenv(
   const char *name,
-  char **value)
+  const char **value)
 ddsrt_nonnull_all;
 
 /**
diff --git a/src/ddsrt/include/dds/ddsrt/expand_vars.h b/src/ddsrt/include/dds/ddsrt/expand_vars.h
new file mode 100644
index 0000000..78b2326
--- /dev/null
+++ b/src/ddsrt/include/dds/ddsrt/expand_vars.h
@@ -0,0 +1,78 @@
+/*
+ * Copyright(c) 2006 to 2018 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+#ifndef DDSRT_EXPAND_VARS_H
+#define DDSRT_EXPAND_VARS_H
+
+#include "dds/export.h"
+#include "dds/ddsrt/attributes.h"
+#include "dds/ddsrt/retcode.h"
+
+#if defined(__cplusplus)
+extern "C" {
+#endif
+
+typedef const char * (*expand_lookup_fn)(const char *name, void *data);
+
+/**
+ * @brief Expand variables within string.
+ *
+ * Expands ${X}, ${X:-Y}, ${X:+Y}, ${X:?Y} forms, but not $X.
+ *
+ * The result string should be freed with ddsrt_free().
+ *
+ * @param[in]  string  String to expand.
+ * @param[in]  lookup  Lookup function to retrieve replacement value
+ * @param[in]  data    Data passed to lookup function
+ *
+ * @returns Allocated char*.
+ *
+ * @retval NULL
+ *             Expansion failed.
+ * @retval Pointer
+ *             Copy of the string argument with the variables expanded.
+ */
+DDS_EXPORT char*
+ddsrt_expand_vars(
+  const char *string,
+  expand_lookup_fn lookup,
+  void * data);
+
+/**
+ * @brief Expand variables within string.
+ *
+ * Expands $X, ${X}, ${X:-Y}, ${X:+Y}, ${X:?Y} forms, $ and \
+ * can be escaped with \.
+ *
+ * The result string should be freed with ddsrt_free().
+ *
+ * @param[in]  string  String to expand.
+ * @param[in]  lookup  Lookup function to retrieve replacement value
+ * @param[in]  data    Data passed to lookup function
+ *
+ * @returns Allocated char*.
+ *
+ * @retval NULL
+ *             Expansion failed.
+ * @retval Pointer
+ *             Copy of the string argument with the variables expanded.
+ */
+DDS_EXPORT char*
+ddsrt_expand_vars_sh(
+  const char *string,
+  expand_lookup_fn lookup,
+  void * data);
+
+#if defined(__cplusplus)
+}
+#endif
+
+#endif /* DDSRT_EXPAND_VARS_H */
diff --git a/src/ddsrt/src/environ.c b/src/ddsrt/src/environ.c
new file mode 100644
index 0000000..501d92b
--- /dev/null
+++ b/src/ddsrt/src/environ.c
@@ -0,0 +1,59 @@
+/*
+ * Copyright(c) 2006 to 2018 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+#include <stdio.h>
+#include <ctype.h>
+#include <stdlib.h>
+#include <assert.h>
+#include <string.h>
+
+#include "dds/ddsrt/expand_vars.h"
+#include "dds/ddsrt/environ.h"
+#include "dds/ddsrt/heap.h"
+#include "dds/ddsrt/log.h"
+#include "dds/ddsrt/string.h"
+#include "dds/ddsrt/process.h"
+
+struct expand_env_data
+{
+    uint32_t domid;
+    char idstr[20];
+};
+
+static const char * expand_lookup_env(const char *name, void * data)
+{
+    const char *env = NULL;
+    struct expand_env_data * env_data = data;
+
+    if (ddsrt_getenv (name, &env) == DDS_RETCODE_OK) {
+        /* ok */
+    } else if (strcmp (name, "$") == 0 || strcmp (name, "CYCLONEDDS_PID") == 0) {
+        (void) snprintf (env_data->idstr, sizeof (env_data->idstr), "%"PRIdPID, ddsrt_getpid ());
+        env = env_data->idstr;
+    } else if (strcmp (name, "CYCLONEDDS_DOMAIN_ID") == 0 && env_data->domid != UINT32_MAX) {
+        (void) snprintf (env_data->idstr, sizeof (env_data->idstr), "%"PRIu32, env_data->domid);
+        env = env_data->idstr;
+    }
+    return env;
+}
+
+char *ddsrt_expand_envvars_sh (const char *src0, uint32_t domid)
+{
+    struct expand_env_data env = { .domid = domid, .idstr = "" };
+    return ddsrt_expand_vars_sh(src0, &expand_lookup_env, &env);
+}
+
+char *ddsrt_expand_envvars (const char *src0, uint32_t domid)
+{
+    struct expand_env_data env = { .domid = domid, .idstr = "" };
+    return ddsrt_expand_vars(src0, &expand_lookup_env, &env);
+}
+
diff --git a/src/ddsrt/src/environ/posix/environ.c b/src/ddsrt/src/environ/posix/environ.c
index 1f8b84f..c2e61a9 100644
--- a/src/ddsrt/src/environ/posix/environ.c
+++ b/src/ddsrt/src/environ/posix/environ.c
@@ -24,7 +24,7 @@ isenvvar(const char *name)
 }
 
 dds_return_t
-ddsrt_getenv(const char *name, char **value)
+ddsrt_getenv(const char *name, const char **value)
 {
   char *env;
 
diff --git a/src/ddsrt/src/environ/solaris2.6/environ.c b/src/ddsrt/src/environ/solaris2.6/environ.c
index 83f0d8f..07d113a 100644
--- a/src/ddsrt/src/environ/solaris2.6/environ.c
+++ b/src/ddsrt/src/environ/solaris2.6/environ.c
@@ -27,7 +27,7 @@ isenvvar(const char *name)
 }
 
 dds_return_t
-ddsrt_getenv(const char *name, char **value)
+ddsrt_getenv(const char *name, const char **value)
 {
   char *env;
 
diff --git a/src/ddsrt/src/environ/windows/environ.c b/src/ddsrt/src/environ/windows/environ.c
index a5b2f90..7589545 100644
--- a/src/ddsrt/src/environ/windows/environ.c
+++ b/src/ddsrt/src/environ/windows/environ.c
@@ -26,7 +26,7 @@ isenvvar(const char *name)
 
 DDSRT_WARNING_MSVC_OFF(4996)
 dds_return_t
-ddsrt_getenv(const char *name, char **value)
+ddsrt_getenv(const char *name, const char **value)
 {
   char *env;
 
diff --git a/src/ddsrt/src/expand_envvars.c b/src/ddsrt/src/expand_vars.c
similarity index 72%
rename from src/ddsrt/src/expand_envvars.c
rename to src/ddsrt/src/expand_vars.c
index faa166a..e0396bd 100644
--- a/src/ddsrt/src/expand_envvars.c
+++ b/src/ddsrt/src/expand_vars.c
@@ -15,13 +15,13 @@
 #include <assert.h>
 #include <string.h>
 
-#include "dds/ddsrt/environ.h"
+#include "dds/ddsrt/expand_vars.h"
 #include "dds/ddsrt/heap.h"
 #include "dds/ddsrt/log.h"
 #include "dds/ddsrt/string.h"
 #include "dds/ddsrt/process.h"
 
-typedef char * (*expand_fn)(const char *src0, uint32_t domid);
+typedef char * (*expand_fn)(const char *src0, expand_lookup_fn lookup, void * data);
 
 static void expand_append (char **dst, size_t *sz, size_t *pos, char c)
 {
@@ -33,46 +33,33 @@ static void expand_append (char **dst, size_t *sz, size_t *pos, char c)
     (*pos)++;
 }
 
-static char *expand_env (const char *name, char op, const char *alt, expand_fn expand, uint32_t domid)
+static char *expand_var (const char *name, char op, const char *alt, expand_fn expand, expand_lookup_fn lookup, void * data)
 {
-    char idstr[20];
-    char *env = NULL;
-    dds_return_t ret;
-
-    if ((ret = ddsrt_getenv (name, &env)) == DDS_RETCODE_OK) {
-        /* ok */
-    } else if (strcmp (name, "$") == 0 || strcmp (name, "CYCLONEDDS_PID") == 0) {
-        (void) snprintf (idstr, sizeof (idstr), "%"PRIdPID, ddsrt_getpid ());
-        env = idstr;
-    } else if (strcmp (name, "CYCLONEDDS_DOMAIN_ID") == 0 && domid != UINT32_MAX) {
-        (void) snprintf (idstr, sizeof (idstr), "%"PRIu32, domid);
-        env = idstr;
-    }
-
+    const char *val = lookup (name, data);
     switch (op)
     {
         case 0:
-            return ddsrt_strdup (env ? env : "");
+            return ddsrt_strdup (val ? val : "");
         case '-':
-            return env && *env ? ddsrt_strdup (env) : expand (alt, domid);
+            return val && *val ? ddsrt_strdup (val) : expand (alt, lookup, data);
         case '?':
-            if (env && *env) {
-                return ddsrt_strdup (env);
+            if (val && *val) {
+                return ddsrt_strdup (val);
             } else {
-                char *altx = expand (alt, domid);
-                DDS_ILOG (DDS_LC_ERROR, domid, "%s: %s\n", name, altx);
+                char *altx = expand (alt, lookup, data);
+                DDS_LOG (DDS_LC_ERROR, "%s: %s\n", name, altx);
                 ddsrt_free (altx);
                 return NULL;
             }
         case '+':
-            return env && *env ? expand (alt, domid) : ddsrt_strdup ("");
+            return val && *val ? expand (alt, lookup, data) : ddsrt_strdup ("");
         default:
             abort ();
             return NULL;
     }
 }
 
-static char *expand_envbrace (const char **src, expand_fn expand, uint32_t domid)
+static char *expand_varbrace (const char **src, expand_fn expand, expand_lookup_fn lookup, void * data)
 {
     const char *start = *src + 1;
     char *name, *x;
@@ -89,7 +76,7 @@ static char *expand_envbrace (const char **src, expand_fn expand, uint32_t domid
     name[*src - start] = 0;
     if (**src == '}') {
         (*src)++;
-        x = expand_env (name, 0, NULL, expand, domid);
+        x = expand_var (name, 0, NULL, expand, lookup, data);
         ddsrt_free (name);
         return x;
     } else {
@@ -133,7 +120,7 @@ static char *expand_envbrace (const char **src, expand_fn expand, uint32_t domid
         memcpy (alt, altstart, (size_t) (*src - altstart));
         alt[*src - altstart] = 0;
         (*src)++;
-        x = expand_env (name, op, alt, expand, domid);
+        x = expand_var (name, op, alt, expand, lookup, data);
         ddsrt_free (alt);
         ddsrt_free (name);
         return x;
@@ -143,7 +130,7 @@ err:
     return NULL;
 }
 
-static char *expand_envsimple (const char **src, expand_fn expand, uint32_t domid)
+static char *expand_varsimple (const char **src, expand_fn expand, expand_lookup_fn lookup, void * data)
 {
     const char *start = *src;
     char *name, *x;
@@ -154,22 +141,22 @@ static char *expand_envsimple (const char **src, expand_fn expand, uint32_t domi
     name = ddsrt_malloc ((size_t) (*src - start) + 1);
     memcpy (name, start, (size_t) (*src - start));
     name[*src - start] = 0;
-    x = expand_env (name, 0, NULL, expand, domid);
+    x = expand_var (name, 0, NULL, expand, lookup, data);
     ddsrt_free (name);
     return x;
 }
 
-static char *expand_envchar (const char **src, expand_fn expand, uint32_t domid)
+static char *expand_varchar (const char **src, expand_fn expand, expand_lookup_fn lookup, void * data)
 {
     char name[2];
     assert (**src);
     name[0] = **src;
     name[1] = 0;
     (*src)++;
-    return expand_env (name, 0, NULL, expand, domid);
+    return expand_var (name, 0, NULL, expand, lookup, data);
 }
 
-char *ddsrt_expand_envvars_sh (const char *src0, uint32_t domid)
+char *ddsrt_expand_vars_sh (const char *src0, expand_lookup_fn lookup, void * data)
 {
     /* Expands $X, ${X}, ${X:-Y}, ${X:+Y}, ${X:?Y} forms; $ and \ can be escaped with \ */
     const char *src = src0;
@@ -192,11 +179,11 @@ char *ddsrt_expand_envvars_sh (const char *src0, uint32_t domid)
                 ddsrt_free(dst);
                 return NULL;
             } else if (*src == '{') {
-                x = expand_envbrace (&src, &ddsrt_expand_envvars_sh, domid);
+                x = expand_varbrace (&src, &ddsrt_expand_vars_sh, lookup, data);
             } else if (isalnum ((unsigned char) *src) || *src == '_') {
-                x = expand_envsimple (&src, &ddsrt_expand_envvars_sh, domid);
+                x = expand_varsimple (&src, &ddsrt_expand_vars_sh, lookup, data);
             } else {
-                x = expand_envchar (&src, &ddsrt_expand_envvars_sh, domid);
+                x = expand_varchar (&src, &ddsrt_expand_vars_sh, lookup, data);
             }
             if (x == NULL) {
                 ddsrt_free(dst);
@@ -215,7 +202,7 @@ char *ddsrt_expand_envvars_sh (const char *src0, uint32_t domid)
     return dst;
 }
 
-char *ddsrt_expand_envvars (const char *src0, uint32_t domid)
+char *ddsrt_expand_vars (const char *src0, expand_lookup_fn lookup, void * data)
 {
     /* Expands ${X}, ${X:-Y}, ${X:+Y}, ${X:?Y} forms, but not $X */
     const char *src = src0;
@@ -225,7 +212,7 @@ char *ddsrt_expand_envvars (const char *src0, uint32_t domid)
         if (*src == '$' && *(src + 1) == '{') {
             char *x, *xp;
             src++;
-            x = expand_envbrace (&src, &ddsrt_expand_envvars, domid);
+            x = expand_varbrace (&src, &ddsrt_expand_vars, lookup, data);
             if (x == NULL) {
                 ddsrt_free(dst);
                 return NULL;
@@ -242,3 +229,4 @@ char *ddsrt_expand_envvars (const char *src0, uint32_t domid)
     expand_append (&dst, &sz, &pos, 0);
     return dst;
 }
+
diff --git a/src/ddsrt/src/xmlparser.c b/src/ddsrt/src/xmlparser.c
index 873aa0d..8820b71 100644
--- a/src/ddsrt/src/xmlparser.c
+++ b/src/ddsrt/src/xmlparser.c
@@ -27,9 +27,12 @@
 #define TOK_CLOSE_TAG -5
 #define TOK_SHORTHAND_CLOSE_TAG -6
 #define TOK_ERROR -7
+#define TOK_CDATA -8
 
 #define NOMARKER (~(size_t)0)
 
+static const char *cdata_magic = "<![CDATA[";
+
 struct ddsrt_xmlp_state {
     size_t cbufp; /* current position in cbuf */
     size_t cbufn; /* number of bytes in cbuf (cbufp <= cbufn) */
@@ -559,6 +562,8 @@ static int next_token (struct ddsrt_xmlp_state *st, char **payload)
         } else if (peek_chars (st, "<?", 1)) {
             processing_instruction (st, "?>");
             return next_token (st, payload);
+        } else if (peek_chars (st, cdata_magic, 0)) {
+            tok = TOK_CDATA;
         } else if (peek_chars (st, "<!", 1)) {
             processing_instruction (st, ">");
             return next_token (st, payload);
@@ -652,7 +657,6 @@ static int parse_element (struct ddsrt_xmlp_state *st, uintptr_t parentinfo)
                 }
             } else {
                 /* text */
-                static const char *cdata_magic = "<![CDATA[";
                 char *content;
                 int cmt = 0;
                 rewind_to_input_marker (st);
diff --git a/src/ddsrt/tests/environ.c b/src/ddsrt/tests/environ.c
index 0a11334..564445b 100644
--- a/src/ddsrt/tests/environ.c
+++ b/src/ddsrt/tests/environ.c
@@ -26,7 +26,7 @@ CU_Theory((const char *name), ddsrt_environ, bad_name)
   dds_return_t rc;
   static const char value[] = "bar";
   static char dummy[] = "foobar";
-  char *ptr;
+  const char *ptr;
 
   rc = ddsrt_setenv(name, value);
   CU_ASSERT_EQUAL(rc, DDS_RETCODE_BAD_PARAMETER);
@@ -71,7 +71,7 @@ CU_Test(ddsrt_environ, getenv)
   static const char name[] = "foo";
   static const char value[] = "bar";
   static char dummy[] = "foobar";
-  char *ptr;
+  const char *ptr;
 
   /* Ensure "not found" is returned. */
   rc = ddsrt_unsetenv(name);
diff --git a/src/ddsrt/tests/process_app.c b/src/ddsrt/tests/process_app.c
index 1613391..9251a72 100644
--- a/src/ddsrt/tests/process_app.c
+++ b/src/ddsrt/tests/process_app.c
@@ -57,7 +57,7 @@ static int test_pid(void)
 static int test_env(void)
 {
   int ret = TEST_EXIT_FAILURE;
-  char *envptr = NULL;
+  const char *envptr = NULL;
   if (ddsrt_getenv(TEST_ENV_VAR_NAME, &envptr) == DDS_RETCODE_OK) {
     printf(" Process: env %s=%s.\n", TEST_ENV_VAR_NAME, envptr);
     if (strcmp(envptr, TEST_ENV_VAR_VALUE) == 0) {

From 323de40cbaef5df379939f1e18f6f9e3e2dbed45 Mon Sep 17 00:00:00 2001
From: Dennis Potman <dennis.potman@adlinktech.com>
Date: Wed, 26 Feb 2020 10:17:01 +0100
Subject: [PATCH 110/238] Moved add_definitions in cmake files to /src/ so that
 all components and tests use the same definitions when compiling sources

Signed-off-by: Dennis Potman <dennis.potman@adlinktech.com>
---
 src/CMakeLists.txt                            | 36 +++++++++++++++++
 src/core/CMakeLists.txt                       | 40 ++-----------------
 src/security/CMakeLists.txt                   |  9 ++---
 .../access_control/CMakeLists.txt             |  2 -
 .../cryptographic/CMakeLists.txt              |  2 -
 .../builtin_plugins/tests/CMakeLists.txt      |  1 -
 6 files changed, 44 insertions(+), 46 deletions(-)

diff --git a/src/CMakeLists.txt b/src/CMakeLists.txt
index b21ad73..ee0b287 100644
--- a/src/CMakeLists.txt
+++ b/src/CMakeLists.txt
@@ -16,11 +16,47 @@ if(NOT ${PROJECT_NAME} STREQUAL "CycloneDDS")
   message(FATAL_ERROR "Top-level CMakeLists.txt was moved to the top-level directory.  Please run cmake on ${dir} instead of ${CMAKE_CURRENT_LIST_DIR}")
 endif()
 
+add_definitions(-DDDSI_INCLUDE_NETWORK_PARTITIONS -DDDSI_INCLUDE_SSM)
+
+# OpenSSL is huge, raising the RSS by 1MB or so, and moreover find_package(OpenSSL) causes
+# trouble on some older CMake versions that otherwise work fine, so provide an option to avoid
+# all OpenSSL related things.
+#
+# Historically the option was DDSC_ENABLE_OPENSSL so make some allowance for those who are
+# currently relying on it.
+option(ENABLE_SSL "Enable openssl support" ON)
+option(DDSC_ENABLE_OPENSSL "Deprecated: please use ENABLE_SSL instead" ON)
+if(NOT DDSC_ENABLE_OPENSSL)
+  message(ERROR "DDSC_ENABLE_OPENSSL is deprecated, please use ENABLE_SSL instead")
+  set(ENABLE_SSL OFF)
+endif()
+
+if(ENABLE_SSL)
+  find_package(OpenSSL)
+  if(OPENSSL_FOUND)
+    add_definitions(-DDDSI_INCLUDE_SSL)
+    message(STATUS "Building with OpenSSL support")
+  else()
+    message(STATUS "Building without OpenSSL support")
+  endif()
+endif()
 
 # Support the OMG DDS Security within ddsc adds quite a bit of code.
 option(ENABLE_SECURITY "Enable OMG DDS Security support" ON)
 if(NOT ENABLE_SECURITY)
   message(STATUS "Building without OMG DDS Security support")
+else()
+  add_definitions(-DDDSI_INCLUDE_SECURITY)
+endif()
+
+option(ENABLE_LIFESPAN "Enable Lifespan QoS support" ON)
+if(ENABLE_LIFESPAN)
+  add_definitions(-DDDSI_INCLUDE_LIFESPAN)
+endif()
+
+option(ENABLE_DEADLINE_MISSED "Enable Deadline Missed QoS support" ON)
+if(ENABLE_DEADLINE_MISSED)
+  add_definitions(-DDDSI_INCLUDE_DEADLINE_MISSED)
 endif()
 
 add_subdirectory(ddsrt)
diff --git a/src/core/CMakeLists.txt b/src/core/CMakeLists.txt
index 9da094a..b2fbfe6 100644
--- a/src/core/CMakeLists.txt
+++ b/src/core/CMakeLists.txt
@@ -25,47 +25,15 @@ else()
   add_library(ddsc)
 endif()
 
-add_definitions(-DDDSI_INCLUDE_NETWORK_PARTITIONS -DDDSI_INCLUDE_SSM)
-
-option(ENABLE_LIFESPAN "Enable Lifespan QoS support" ON)
-if(ENABLE_LIFESPAN)
-  add_definitions(-DDDSI_INCLUDE_LIFESPAN)
-endif()
-
-option(ENABLE_DEADLINE_MISSED "Enable Deadline Missed QoS support" ON)
-if(ENABLE_DEADLINE_MISSED)
-  add_definitions(-DDDSI_INCLUDE_DEADLINE_MISSED)
-endif()
-
-# OpenSSL is huge, raising the RSS by 1MB or so, and moreover find_package(OpenSSL) causes
-# trouble on some older CMake versions that otherwise work fine, so provide an option to avoid
-# all OpenSSL related things.
-#
-# Historically the option was DDSC_ENABLE_OPENSSL so make some allowance for those who are
-# currently relying on it.
-option(ENABLE_SSL "Enable openssl support" ON)
-option(DDSC_ENABLE_OPENSSL "Deprecated: please use ENABLE_SSL instead" ON)
-if(NOT DDSC_ENABLE_OPENSSL)
-  message(ERROR "DDSC_ENABLE_OPENSSL is deprecated, please use ENABLE_SSL instead")
-  set(ENABLE_SSL OFF)
-endif()
-if(ENABLE_SSL)
-  find_package(OpenSSL)
-  if(OPENSSL_FOUND)
-    add_definitions(-DDDSI_INCLUDE_SSL)
-    target_link_libraries(ddsc PRIVATE OpenSSL::SSL)
-    if(CMAKE_GENERATOR MATCHES "Visual Studio")
-      set_target_properties(ddsc PROPERTIES LINK_FLAGS "/ignore:4099")
-    endif()
-    message(STATUS "Building with OpenSSL support")
-  else()
-    message(STATUS "Building without OpenSSL support")
+if(ENABLE_SSL AND OPENSSL_FOUND)
+  target_link_libraries(ddsc PRIVATE OpenSSL::SSL)
+  if(CMAKE_GENERATOR MATCHES "Visual Studio")
+    set_target_properties(ddsc PROPERTIES LINK_FLAGS "/ignore:4099")
   endif()
 endif()
 
 # Support the OMG DDS Security within ddsc adds quite a bit of code.
 if(ENABLE_SECURITY)
-  add_definitions(-DDDSI_INCLUDE_SECURITY)
   target_link_libraries(ddsc PRIVATE security_core)
   target_include_directories(
     ddsc PUBLIC
diff --git a/src/security/CMakeLists.txt b/src/security/CMakeLists.txt
index 3b2d8f9..b96c7da 100644
--- a/src/security/CMakeLists.txt
+++ b/src/security/CMakeLists.txt
@@ -11,12 +11,11 @@
 #
 cmake_minimum_required(VERSION 3.7)
 
-if( ENABLE_SECURITY )
-    add_definitions(-DDDSI_INCLUDE_SECURITY)
-    add_subdirectory(api)
-    add_subdirectory(core)
+if(ENABLE_SECURITY)
+  add_subdirectory(api)
+  add_subdirectory(core)
 
-  if ( ENABLE_SSL)
+  if(ENABLE_SSL)
     add_subdirectory(builtin_plugins)
   endif()
 endif()
\ No newline at end of file
diff --git a/src/security/builtin_plugins/access_control/CMakeLists.txt b/src/security/builtin_plugins/access_control/CMakeLists.txt
index c0cee0a..e882b2c 100644
--- a/src/security/builtin_plugins/access_control/CMakeLists.txt
+++ b/src/security/builtin_plugins/access_control/CMakeLists.txt
@@ -11,8 +11,6 @@
 #
 include (GenerateExportHeader)
 
-find_package(OpenSSL)
-
 PREPEND(srcs_accesscontrol "${CMAKE_CURRENT_LIST_DIR}/src"
     access_control_objects.c
     access_control_parser.c
diff --git a/src/security/builtin_plugins/cryptographic/CMakeLists.txt b/src/security/builtin_plugins/cryptographic/CMakeLists.txt
index 3be3010..a1eb46e 100644
--- a/src/security/builtin_plugins/cryptographic/CMakeLists.txt
+++ b/src/security/builtin_plugins/cryptographic/CMakeLists.txt
@@ -11,8 +11,6 @@
 #
 include (GenerateExportHeader)
 
-find_package(OpenSSL)
-
 PREPEND(srcs_cryptographic "${CMAKE_CURRENT_LIST_DIR}/src"
     crypto_cipher.c
     crypto_key_exchange
diff --git a/src/security/builtin_plugins/tests/CMakeLists.txt b/src/security/builtin_plugins/tests/CMakeLists.txt
index ac56a7f..d2a8af1 100644
--- a/src/security/builtin_plugins/tests/CMakeLists.txt
+++ b/src/security/builtin_plugins/tests/CMakeLists.txt
@@ -10,7 +10,6 @@
 # SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
 #
 include(CUnit)
-find_package(OpenSSL)
 
 set(security_auth_test_sources
     "common/src/loader.c"

From 1cf472ea06df198bdc13e2dfb84883f7c4e0511d Mon Sep 17 00:00:00 2001
From: Dennis Potman <dennis.potman@adlinktech.com>
Date: Mon, 24 Feb 2020 14:08:56 +0100
Subject: [PATCH 111/238] Refactored tests for security core: introduced
 generic wrappers for security plugins and updated plugin loading tests to use
 these instead of specific wrappers per test. Added test for securing
 communication ad handshake fail (using different identity CAs)

Signed-off-by: Dennis Potman <dennis.potman@adlinktech.com>
---
 .../ddsi/include/dds/ddsi/ddsi_security_omg.h |   3 +-
 src/core/ddsi/src/ddsi_security_omg.c         |   7 +
 src/security/CMakeLists.txt                   |   2 +-
 .../access_control/CMakeLists.txt             |  12 +-
 .../authentication/CMakeLists.txt             |  21 +-
 .../authentication/src/authentication.c       |   2 +-
 .../cryptographic/CMakeLists.txt              |  11 +-
 .../builtin_plugins/tests/CMakeLists.txt      |  19 +-
 src/security/core/CMakeLists.txt              |  12 +-
 .../dds/security/core/dds_security_utils.h    |   3 +-
 src/security/core/src/dds_security_utils.c    |   4 +-
 src/security/core/tests/CMakeLists.txt        |  79 +-
 src/security/core/tests/SecurityCoreTests.idl |  18 +
 src/security/core/tests/authentication.c      | 119 +++
 .../tests/common/access_control_wrapper.c     | 551 +++++++++++
 .../tests/common/access_control_wrapper.h     |  26 +
 .../tests/common/authentication_wrapper.c     | 566 +++++++++++
 .../tests/common/authentication_wrapper.h     |  38 +
 .../core/tests/common/config_env.h.in         |  27 +
 .../core/tests/common/cryptography_wrapper.c  | 728 ++++++++++++++
 .../core/tests/common/cryptography_wrapper.h  |  39 +
 src/security/core/tests/common/etc/create_p7s |  36 +
 .../tests/common/etc/default_governance.p7s   | 120 +++
 .../tests/common/etc/default_governance.xml   |  62 ++
 .../tests/common/etc/default_permissions.p7s  |  97 ++
 .../tests/common/etc/default_permissions.xml  |  39 +
 .../common/etc/default_permissions_ca.pem     |  26 +
 .../common/etc/default_permissions_ca_key.pem |  27 +
 .../core/tests/common/handshake_test_utils.c  | 232 +++++
 .../core/tests/common/handshake_test_utils.h  |  48 +
 .../core/tests/common/plugin_wrapper_msg_q.c  | 134 +++
 .../core/tests/common/plugin_wrapper_msg_q.h  |  62 ++
 .../tests/common/security_config_test_utils.c | 156 +++
 .../tests/common/security_config_test_utils.h |  28 +
 .../core/tests/common/test_identity.h         | 184 ++++
 src/security/core/tests/config.c              | 631 ++++++++++++
 src/security/core/tests/dds_security_core.c   |   8 +-
 src/security/core/tests/handshake.c           |  99 ++
 src/security/core/tests/plugin_loading.c      | 646 +++++++++++++
 .../core/tests/plugin_loading/CMakeLists.txt  |  85 --
 .../core/tests/plugin_loading/config_env.h.in |  25 -
 .../tests/plugin_loading/plugin_loading.c     | 911 ------------------
 .../mock_access_control.c                     | 597 ------------
 .../mock_access_control.h                     | 281 ------
 .../mock_access_control.c                     | 600 ------------
 .../mock_access_control.h                     | 280 ------
 .../mock_authentication.c                     | 404 --------
 .../mock_authentication.h                     | 137 ---
 .../mock_authentication.c                     | 353 -------
 .../mock_authentication.h                     | 136 ---
 .../mock_authentication.c                     | 394 --------
 .../mock_authentication.h                     | 264 -----
 .../mock_authentication.c                     | 347 -------
 .../mock_authentication.h                     | 217 -----
 .../mock_authentication.c                     | 402 --------
 .../mock_authentication.h                     | 218 -----
 .../cryptography_all_ok/mock_cryptography.c   | 667 -------------
 .../cryptography_all_ok/mock_cryptography.h   |  21 -
 .../mock_cryptography.c                       | 656 -------------
 .../mock_cryptography.h                       |  26 -
 .../tests/plugin_loading/security_config.c    | 724 --------------
 .../core/tests/secure_communication.c         | 481 +++++++++
 62 files changed, 5335 insertions(+), 7813 deletions(-)
 create mode 100644 src/security/core/tests/SecurityCoreTests.idl
 create mode 100644 src/security/core/tests/authentication.c
 create mode 100644 src/security/core/tests/common/access_control_wrapper.c
 create mode 100644 src/security/core/tests/common/access_control_wrapper.h
 create mode 100644 src/security/core/tests/common/authentication_wrapper.c
 create mode 100644 src/security/core/tests/common/authentication_wrapper.h
 create mode 100644 src/security/core/tests/common/config_env.h.in
 create mode 100644 src/security/core/tests/common/cryptography_wrapper.c
 create mode 100644 src/security/core/tests/common/cryptography_wrapper.h
 create mode 100755 src/security/core/tests/common/etc/create_p7s
 create mode 100644 src/security/core/tests/common/etc/default_governance.p7s
 create mode 100644 src/security/core/tests/common/etc/default_governance.xml
 create mode 100644 src/security/core/tests/common/etc/default_permissions.p7s
 create mode 100644 src/security/core/tests/common/etc/default_permissions.xml
 create mode 100644 src/security/core/tests/common/etc/default_permissions_ca.pem
 create mode 100644 src/security/core/tests/common/etc/default_permissions_ca_key.pem
 create mode 100644 src/security/core/tests/common/handshake_test_utils.c
 create mode 100644 src/security/core/tests/common/handshake_test_utils.h
 create mode 100644 src/security/core/tests/common/plugin_wrapper_msg_q.c
 create mode 100644 src/security/core/tests/common/plugin_wrapper_msg_q.h
 create mode 100644 src/security/core/tests/common/security_config_test_utils.c
 create mode 100644 src/security/core/tests/common/security_config_test_utils.h
 create mode 100644 src/security/core/tests/common/test_identity.h
 create mode 100644 src/security/core/tests/config.c
 create mode 100644 src/security/core/tests/handshake.c
 create mode 100644 src/security/core/tests/plugin_loading.c
 delete mode 100644 src/security/core/tests/plugin_loading/CMakeLists.txt
 delete mode 100644 src/security/core/tests/plugin_loading/config_env.h.in
 delete mode 100644 src/security/core/tests/plugin_loading/plugin_loading.c
 delete mode 100644 src/security/core/tests/plugin_loading/plugin_mock/access_control_all_ok/mock_access_control.c
 delete mode 100644 src/security/core/tests/plugin_loading/plugin_mock/access_control_all_ok/mock_access_control.h
 delete mode 100644 src/security/core/tests/plugin_loading/plugin_mock/access_control_missing_function/mock_access_control.c
 delete mode 100644 src/security/core/tests/plugin_loading/plugin_mock/access_control_missing_function/mock_access_control.h
 delete mode 100644 src/security/core/tests/plugin_loading/plugin_mock/authentication_all_ok/mock_authentication.c
 delete mode 100644 src/security/core/tests/plugin_loading/plugin_mock/authentication_all_ok/mock_authentication.h
 delete mode 100644 src/security/core/tests/plugin_loading/plugin_mock/authentication_all_ok_other/mock_authentication.c
 delete mode 100644 src/security/core/tests/plugin_loading/plugin_mock/authentication_all_ok_other/mock_authentication.h
 delete mode 100644 src/security/core/tests/plugin_loading/plugin_mock/authentication_finalize_error/mock_authentication.c
 delete mode 100644 src/security/core/tests/plugin_loading/plugin_mock/authentication_finalize_error/mock_authentication.h
 delete mode 100644 src/security/core/tests/plugin_loading/plugin_mock/authentication_init_error/mock_authentication.c
 delete mode 100644 src/security/core/tests/plugin_loading/plugin_mock/authentication_init_error/mock_authentication.h
 delete mode 100644 src/security/core/tests/plugin_loading/plugin_mock/authentication_missing_function/mock_authentication.c
 delete mode 100644 src/security/core/tests/plugin_loading/plugin_mock/authentication_missing_function/mock_authentication.h
 delete mode 100644 src/security/core/tests/plugin_loading/plugin_mock/cryptography_all_ok/mock_cryptography.c
 delete mode 100644 src/security/core/tests/plugin_loading/plugin_mock/cryptography_all_ok/mock_cryptography.h
 delete mode 100644 src/security/core/tests/plugin_loading/plugin_mock/cryptography_missing_function/mock_cryptography.c
 delete mode 100644 src/security/core/tests/plugin_loading/plugin_mock/cryptography_missing_function/mock_cryptography.h
 delete mode 100644 src/security/core/tests/plugin_loading/security_config.c
 create mode 100644 src/security/core/tests/secure_communication.c

diff --git a/src/core/ddsi/include/dds/ddsi/ddsi_security_omg.h b/src/core/ddsi/include/dds/ddsi/ddsi_security_omg.h
index 534a762..674cd3f 100644
--- a/src/core/ddsi/include/dds/ddsi/ddsi_security_omg.h
+++ b/src/core/ddsi/include/dds/ddsi/ddsi_security_omg.h
@@ -123,6 +123,8 @@ struct reader_sec_attributes {
 
 struct dds_security_authentication *q_omg_participant_get_authentication(const struct participant *pp);
 
+DDS_EXPORT struct dds_security_cryptography *q_omg_participant_get_cryptography(const struct participant *pp);
+
 void q_omg_log_exception(const struct ddsrt_log_cfg *lc, uint32_t cat, DDS_Security_SecurityException *exception, const char *file, uint32_t line, const char *func, const char *fmt, ...);
 
 /**
@@ -1083,7 +1085,6 @@ void q_omg_security_deinit( struct ddsi_domaingv *gv );
 
 bool q_omg_is_security_loaded(  struct dds_security_context *sc );
 
-
 #else /* DDSI_INCLUDE_SECURITY */
 
 #include "dds/ddsi/q_unused.h"
diff --git a/src/core/ddsi/src/ddsi_security_omg.c b/src/core/ddsi/src/ddsi_security_omg.c
index 7204515..16da442 100644
--- a/src/core/ddsi/src/ddsi_security_omg.c
+++ b/src/core/ddsi/src/ddsi_security_omg.c
@@ -559,6 +559,13 @@ get_first_matched_proxypp_crypto_handle(struct participant_sec_attributes *attr)
   return handle;
 }
 
+struct dds_security_cryptography *q_omg_participant_get_cryptography(const struct participant *pp)
+{
+  if (pp && pp->e.gv->security_context && q_omg_is_security_loaded(pp->e.gv->security_context))
+    return pp->e.gv->security_context->crypto_context;
+  return NULL;
+}
+
 bool q_omg_is_security_loaded (dds_security_context *sc)
 {
   return (sc->crypto_context != NULL || sc->authentication_context != NULL || sc->access_control_context != NULL);
diff --git a/src/security/CMakeLists.txt b/src/security/CMakeLists.txt
index b96c7da..fd9af5d 100644
--- a/src/security/CMakeLists.txt
+++ b/src/security/CMakeLists.txt
@@ -18,4 +18,4 @@ if(ENABLE_SECURITY)
   if(ENABLE_SSL)
     add_subdirectory(builtin_plugins)
   endif()
-endif()
\ No newline at end of file
+endif()
diff --git a/src/security/builtin_plugins/access_control/CMakeLists.txt b/src/security/builtin_plugins/access_control/CMakeLists.txt
index e882b2c..e0ffc78 100644
--- a/src/security/builtin_plugins/access_control/CMakeLists.txt
+++ b/src/security/builtin_plugins/access_control/CMakeLists.txt
@@ -26,16 +26,12 @@ generate_export_header(
         EXPORT_FILE_NAME "${CMAKE_CURRENT_BINARY_DIR}/include/dds/security/export.h"
 )
 
-add_definitions(-DDDSI_INCLUDE_SSL)
-
 target_link_libraries(dds_security_ac PUBLIC ddsc)
 target_link_libraries(dds_security_ac PUBLIC OpenSSL::SSL)
-
-target_sources(dds_security_ac
-    PRIVATE
-        ${srcs_accesscontrol}
-)
-
+if(CMAKE_GENERATOR MATCHES "Visual Studio")
+  set_target_properties(dds_security_ac PROPERTIES LINK_FLAGS "/ignore:4099")
+endif()
+target_sources(dds_security_ac PRIVATE ${srcs_accesscontrol})
 target_include_directories(dds_security_ac
     PUBLIC
         "$<BUILD_INTERFACE:$<TARGET_PROPERTY:security_api,INTERFACE_INCLUDE_DIRECTORIES>>"
diff --git a/src/security/builtin_plugins/authentication/CMakeLists.txt b/src/security/builtin_plugins/authentication/CMakeLists.txt
index 9dc9b53..91455c5 100644
--- a/src/security/builtin_plugins/authentication/CMakeLists.txt
+++ b/src/security/builtin_plugins/authentication/CMakeLists.txt
@@ -15,7 +15,7 @@ PREPEND(srcs_authentication "${CMAKE_CURRENT_LIST_DIR}/src"
     authentication.c
     auth_utils.c
 )
- 
+
 PREPEND(hdrs_private_authentication "${CMAKE_CURRENT_LIST_DIR}/src"
     auth_defs.h
     authentication.h
@@ -31,21 +31,12 @@ generate_export_header(
         EXPORT_FILE_NAME "${CMAKE_CURRENT_BINARY_DIR}/include/dds/security/export.h"
 )
 
-
-
-find_package(OpenSSL )
-
-add_definitions(-DDDSI_INCLUDE_SSL)
-
 target_link_libraries(dds_security_auth PUBLIC ddsc)
 target_link_libraries(dds_security_auth PUBLIC OpenSSL::SSL)
-
-target_sources(dds_security_auth
-    PRIVATE
-        ${srcs_authentication}
-
-)
-
+if(CMAKE_GENERATOR MATCHES "Visual Studio")
+  set_target_properties(dds_security_auth PROPERTIES LINK_FLAGS "/ignore:4099")
+endif()
+target_sources(dds_security_auth PRIVATE ${srcs_authentication})
 target_include_directories(dds_security_auth
     PUBLIC
         "$<BUILD_INTERFACE:$<TARGET_PROPERTY:security_api,INTERFACE_INCLUDE_DIRECTORIES>>"
@@ -55,7 +46,7 @@ target_include_directories(dds_security_auth
 )
 
 install(
-  TARGETS 
+  TARGETS
   EXPORT "${PROJECT_NAME}"
   RUNTIME DESTINATION "${CMAKE_INSTALL_BINDIR}" COMPONENT lib
   LIBRARY DESTINATION "${CMAKE_INSTALL_LIBDIR}" COMPONENT lib
diff --git a/src/security/builtin_plugins/authentication/src/authentication.c b/src/security/builtin_plugins/authentication/src/authentication.c
index 63f4a60..d6139d9 100644
--- a/src/security/builtin_plugins/authentication/src/authentication.c
+++ b/src/security/builtin_plugins/authentication/src/authentication.c
@@ -23,7 +23,7 @@
 #include "dds/ddsrt/heap.h"
 #include "dds/security/dds_security_api.h"
 #include "dds/security/core/dds_security_timed_cb.h"
-
+#include "dds/security/core/dds_security_utils.h"
 
 #if OPENSLL_VERSION_NUMBER >= 0x10002000L
 #define AUTH_INCLUDE_EC
diff --git a/src/security/builtin_plugins/cryptographic/CMakeLists.txt b/src/security/builtin_plugins/cryptographic/CMakeLists.txt
index a1eb46e..3cae998 100644
--- a/src/security/builtin_plugins/cryptographic/CMakeLists.txt
+++ b/src/security/builtin_plugins/cryptographic/CMakeLists.txt
@@ -29,15 +29,12 @@ generate_export_header(
         EXPORT_FILE_NAME "${CMAKE_CURRENT_BINARY_DIR}/include/dds/security/export.h"
 )
 
-add_definitions(-DDDSI_INCLUDE_SSL)
-
 target_link_libraries(dds_security_crypto PUBLIC ddsc)
 target_link_libraries(dds_security_crypto PUBLIC OpenSSL::SSL)
-
-target_sources(dds_security_crypto
-    PRIVATE
-        ${srcs_cryptographic}
-)
+if(CMAKE_GENERATOR MATCHES "Visual Studio")
+  set_target_properties(dds_security_crypto PROPERTIES LINK_FLAGS "/ignore:4099")
+endif()
+target_sources(dds_security_crypto PRIVATE ${srcs_cryptographic})
 
 target_include_directories(dds_security_crypto
     PUBLIC
diff --git a/src/security/builtin_plugins/tests/CMakeLists.txt b/src/security/builtin_plugins/tests/CMakeLists.txt
index d2a8af1..60a9704 100644
--- a/src/security/builtin_plugins/tests/CMakeLists.txt
+++ b/src/security/builtin_plugins/tests/CMakeLists.txt
@@ -60,6 +60,7 @@ set(security_crypto_test_sources
 )
 
 add_cunit_executable(cunit_security_plugins ${security_auth_test_sources} ${security_ac_test_sources} ${security_crypto_test_sources})
+
 target_include_directories(
   cunit_security_plugins PRIVATE
   "$<BUILD_INTERFACE:${CMAKE_BINARY_DIR}/src/include/>"
@@ -69,15 +70,10 @@ target_include_directories(
   "$<BUILD_INTERFACE:${CMAKE_CURRENT_LIST_DIR}>"
   "$<BUILD_INTERFACE:${CMAKE_CURRENT_BINARY_DIR}>"
 )
-target_link_libraries(cunit_security_plugins PRIVATE ddsc security_api)
-
-if(OPENSSL_FOUND)
-target_link_libraries(cunit_security_plugins PRIVATE ddsc dds_security_ac)
-target_link_libraries(cunit_security_plugins PRIVATE ddsc dds_security_crypto)
-  target_link_libraries(cunit_security_plugins PRIVATE OpenSSL::SSL)
-
-else()
-  message(FATAL_ERROR "To build with openssl support, set ENABLE_OPENSSL to ON")
+target_link_libraries(cunit_security_plugins PRIVATE ddsc security_api dds_security_ac dds_security_crypto)
+target_link_libraries(cunit_security_plugins PRIVATE OpenSSL::SSL)
+if(CMAKE_GENERATOR MATCHES "Visual Studio")
+  set_target_properties(cunit_security_plugins PROPERTIES LINK_FLAGS "/ignore:4099")
 endif()
 
 target_include_directories(
@@ -91,11 +87,6 @@ target_include_directories(
       "$<BUILD_INTERFACE:${CMAKE_CURRENT_BINARY_DIR}>"
 )
 
-
-
 set(CUnit_builtin_plugins_tests_dir "${CMAKE_CURRENT_LIST_DIR}")
 set(CUnit_build_dir "${CMAKE_CURRENT_BINARY_DIR}")
-
 configure_file("config_env.h.in" "config_env.h")
-
-
diff --git a/src/security/core/CMakeLists.txt b/src/security/core/CMakeLists.txt
index 41ea708..19f4823 100644
--- a/src/security/core/CMakeLists.txt
+++ b/src/security/core/CMakeLists.txt
@@ -17,7 +17,7 @@ PREPEND(srcs_security_core "${CMAKE_CURRENT_LIST_DIR}/src"
     dds_security_fsm.c
     dds_security_timed_cb.c
 )
- 
+
 PREPEND(hdrs_public_security_core "${CMAKE_CURRENT_LIST_DIR}/include/security/core"
     dds_security_serialize.h
     dds_security_types.h
@@ -35,12 +35,7 @@ endif()
 
 add_library(security_core INTERFACE)
 
-
-target_sources(security_core
-    INTERFACE
-        ${srcs_security_core}
-
-)
+target_sources(security_core INTERFACE ${srcs_security_core})
 
 target_include_directories(security_core
     INTERFACE
@@ -49,12 +44,9 @@ target_include_directories(security_core
         "$<BUILD_INTERFACE:$<TARGET_PROPERTY:ddsrt,INTERFACE_INCLUDE_DIRECTORIES>>"
         "$<BUILD_INTERFACE:$<TARGET_PROPERTY:ddsc,INTERFACE_INCLUDE_DIRECTORIES>>"
 )
-#target_link_libraries(security_core PRIVATE ddsrt security_api)
 
 if(BUILD_TESTING)
   add_subdirectory(tests)
-# Temporarily disabled because needs refractoring w.r.t. security implementation
-#  add_subdirectory(tests/plugin_loading)
 endif()
 
 install(
diff --git a/src/security/core/include/dds/security/core/dds_security_utils.h b/src/security/core/include/dds/security/core/dds_security_utils.h
index d6a745e..c9cbf0e 100644
--- a/src/security/core/include/dds/security/core/dds_security_utils.h
+++ b/src/security/core/include/dds/security/core/dds_security_utils.h
@@ -271,7 +271,7 @@ DDS_Security_Exception_set(
         ...);
 
 
-#if DDSI_INCLUDE_SSL
+#ifdef DDSI_INCLUDE_SSL
 DDS_EXPORT void
 DDS_Security_Exception_set_with_openssl_error(
          DDS_Security_SecurityException *ex,
@@ -279,7 +279,6 @@ DDS_Security_Exception_set_with_openssl_error(
          int code,
          int minor_code,
          const char *fmt);
-
 #endif
 
 DDS_EXPORT void
diff --git a/src/security/core/src/dds_security_utils.c b/src/security/core/src/dds_security_utils.c
index ea5a7d8..3c04c60 100644
--- a/src/security/core/src/dds_security_utils.c
+++ b/src/security/core/src/dds_security_utils.c
@@ -22,7 +22,7 @@
 #include "dds/ddsrt/string.h"
 #include "dds/ddsrt/misc.h"
 
-#if DDSI_INCLUDE_SSL
+#ifdef DDSI_INCLUDE_SSL
 #include <openssl/bio.h>
 #include <openssl/err.h>
 #endif
@@ -806,7 +806,7 @@ DDS_Security_Exception_set(
     ex->minor_code = minor_code;
 }
 
-#if DDSI_INCLUDE_SSL
+#ifdef DDSI_INCLUDE_SSL
 DDS_EXPORT void
 DDS_Security_Exception_set_with_openssl_error(
     DDS_Security_SecurityException *ex,
diff --git a/src/security/core/tests/CMakeLists.txt b/src/security/core/tests/CMakeLists.txt
index d240583..9fcc0c0 100644
--- a/src/security/core/tests/CMakeLists.txt
+++ b/src/security/core/tests/CMakeLists.txt
@@ -12,14 +12,78 @@
 include (GenerateExportHeader)
 include (CUnit)
 
+idlc_generate(SecurityCoreTests SecurityCoreTests.idl)
+
+function(add_wrapper libname linklibs)
+  set(srcs_wrapper
+    "${CMAKE_CURRENT_LIST_DIR}/common/${libname}_wrapper.c"
+    "${CMAKE_CURRENT_LIST_DIR}/common/plugin_wrapper_msg_q.c")
+  add_library("dds_security_${libname}_wrapper" SHARED "")
+  if(CMAKE_GENERATOR MATCHES "Visual Studio")
+    set_target_properties("dds_security_${libname}_wrapper" PROPERTIES LINK_FLAGS "/ignore:4099")
+  endif()
+
+  generate_export_header(
+    "dds_security_${libname}_wrapper"
+    BASE_NAME SECURITY
+    EXPORT_FILE_NAME "${CMAKE_CURRENT_BINARY_DIR}/include/dds/security/${libname}_wrapper_export.h")
+
+  set_target_properties(
+    "dds_security_${libname}_wrapper"
+    PROPERTIES
+    RUNTIME_OUTPUT_DIRECTORY                ${CMAKE_CURRENT_BINARY_DIR}
+    RUNTIME_OUTPUT_DIRECTORY_DEBUG          ${CMAKE_CURRENT_BINARY_DIR}
+    RUNTIME_OUTPUT_DIRECTORY_RELEASE        ${CMAKE_CURRENT_BINARY_DIR}
+    RUNTIME_OUTPUT_DIRECTORY_RELWITHDEBINFO ${CMAKE_CURRENT_BINARY_DIR}
+    RUNTIME_OUTPUT_DIRECTORY_MINSIZEREL     ${CMAKE_CURRENT_BINARY_DIR}
+    LIBRARY_OUTPUT_DIRECTORY                ${CMAKE_CURRENT_BINARY_DIR}
+    LIBRARY_OUTPUT_DIRECTORY_DEBUG          ${CMAKE_CURRENT_BINARY_DIR}
+    LIBRARY_OUTPUT_DIRECTORY_RELEASE        ${CMAKE_CURRENT_BINARY_DIR}
+    LIBRARY_OUTPUT_DIRECTORY_RELWITHDEBINFO ${CMAKE_CURRENT_BINARY_DIR}
+    LIBRARY_OUTPUT_DIRECTORY_MINSIZEREL     ${CMAKE_CURRENT_BINARY_DIR})
+
+  if(APPLE)
+    set_target_properties("dds_security_${libname}_wrapper" PROPERTIES LINK_FLAGS "-undefined dynamic_lookup")
+  endif()
+
+  target_link_libraries("dds_security_${libname}_wrapper" PUBLIC ddsc ${linklibs})
+  target_sources("dds_security_${libname}_wrapper" PRIVATE ${srcs_wrapper})
+  target_include_directories("dds_security_${libname}_wrapper"
+    PUBLIC
+      "$<BUILD_INTERFACE:$<TARGET_PROPERTY:security_api,INTERFACE_INCLUDE_DIRECTORIES>>"
+      "$<BUILD_INTERFACE:$<TARGET_PROPERTY:security_core,INTERFACE_INCLUDE_DIRECTORIES>>"
+      "$<BUILD_INTERFACE:$<TARGET_PROPERTY:ddsrt,INTERFACE_INCLUDE_DIRECTORIES>>"
+      "$<BUILD_INTERFACE:${CMAKE_CURRENT_BINARY_DIR}/include>"
+      "$<BUILD_INTERFACE:${CMAKE_CURRENT_SOURCE_DIR}/../../../core/ddsi/include>"
+      "$<BUILD_INTERFACE:${CMAKE_CURRENT_SOURCE_DIR}/../../../core/ddsc/src>")
+endfunction()
+
 set(security_core_test_sources
     "tc_fsm.c"
     "dds_security_core.c"
     "security_utils.c"
-  )
+)
+
+if(ENABLE_SSL)
+  add_wrapper(access_control "")
+  add_wrapper(authentication dds_security_auth)
+  add_wrapper(cryptography dds_security_crypto)
+
+  list(APPEND security_core_test_sources
+    "common/security_config_test_utils.c"
+    "common/handshake_test_utils.c"
+    "authentication.c"
+    "config.c"
+    "handshake.c"
+    "plugin_loading.c"
+    "secure_communication.c"
+  )
+endif()
 
-add_definitions(-DDDSI_INCLUDE_SECURITY)
 add_cunit_executable(cunit_security_core ${security_core_test_sources})
+if(CMAKE_GENERATOR MATCHES "Visual Studio")
+  set_target_properties(cunit_security_core PROPERTIES LINK_FLAGS "/ignore:4099")
+endif()
 
 target_include_directories(
   cunit_security_core PRIVATE
@@ -33,6 +97,15 @@ target_include_directories(
         "$<BUILD_INTERFACE:${CMAKE_CURRENT_SOURCE_DIR}/../../../core/ddsc/src>"
  )
 
+set(common_etc_dir "${CMAKE_CURRENT_SOURCE_DIR}/common/etc")
+set(plugin_wrapper_lib_dir "${CMAKE_CURRENT_BINARY_DIR}")
+file(TO_NATIVE_PATH "/" file_path_sep)
+string(REPLACE "\\" "\\\\" file_path_sep ${file_path_sep})
+configure_file("common/config_env.h.in" "common/config_env.h")
 
-target_link_libraries(cunit_security_core PRIVATE ddsc security_api)
+target_link_libraries(cunit_security_core PRIVATE ddsc security_api SecurityCoreTests)
+if(ENABLE_SSL)
+  target_link_libraries(cunit_security_core PRIVATE dds_security_auth dds_security_ac dds_security_crypto dds_security_authentication_wrapper dds_security_cryptography_wrapper)
+  target_link_libraries(cunit_security_core PRIVATE OpenSSL::SSL)
+endif()
 target_include_directories(cunit_security_core PRIVATE "${CMAKE_CURRENT_BINARY_DIR}")
diff --git a/src/security/core/tests/SecurityCoreTests.idl b/src/security/core/tests/SecurityCoreTests.idl
new file mode 100644
index 0000000..1eb6700
--- /dev/null
+++ b/src/security/core/tests/SecurityCoreTests.idl
@@ -0,0 +1,18 @@
+/*
+ * Copyright(c) 2006 to 2018 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+module SecurityCoreTests {
+    struct Type1 {
+        long	id; //@Key
+        long    value;
+    };
+#pragma keylist Type1 id
+};
diff --git a/src/security/core/tests/authentication.c b/src/security/core/tests/authentication.c
new file mode 100644
index 0000000..e981648
--- /dev/null
+++ b/src/security/core/tests/authentication.c
@@ -0,0 +1,119 @@
+/*
+ * Copyright(c) 2006 to 2020 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+#include <stdlib.h>
+#include <assert.h>
+
+#include "dds/dds.h"
+#include "CUnit/Test.h"
+
+#include "dds/version.h"
+#include "dds/ddsrt/cdtors.h"
+#include "dds/ddsrt/environ.h"
+#include "dds/ddsrt/heap.h"
+#include "dds/ddsrt/string.h"
+#include "dds/ddsi/q_config.h"
+#include "dds/ddsi/ddsi_domaingv.h"
+#include "dds/ddsi/q_misc.h"
+#include "dds/ddsi/ddsi_xqos.h"
+
+#include "dds/security/dds_security_api.h"
+
+#include "common/config_env.h"
+#include "common/authentication_wrapper.h"
+#include "common/handshake_test_utils.h"
+#include "common/security_config_test_utils.h"
+#include "common/test_identity.h"
+
+static const char *config =
+    "${CYCLONEDDS_URI}${CYCLONEDDS_URI:+,}"
+    "<Discovery><ExternalDomainId>0</ExternalDomainId></Discovery>"
+    "<Domain id=\"any\">"
+    "  <Tracing><Verbosity>finest</></>"
+    "  <DDSSecurity>"
+    "    <Authentication>"
+    "      <Library finalizeFunction=\"finalize_test_authentication_wrapped\" initFunction=\"init_test_authentication_wrapped\" path=\"" WRAPPERLIB_PATH("dds_security_authentication_wrapper") "\"/>"
+    "      <IdentityCertificate>${TEST_IDENTITY_CERTIFICATE}</IdentityCertificate>"
+    "      <PrivateKey>${TEST_IDENTITY_PRIVATE_KEY}</PrivateKey>"
+    "      <IdentityCA>${TEST_IDENTITY_CA_CERTIFICATE}</IdentityCA>"
+    "      <Password>testtext_Password_testtext</Password>"
+    "      <TrustedCADirectory>.</TrustedCADirectory>"
+    "    </Authentication>"
+    "    <AccessControl>"
+    "      <Library finalizeFunction=\"finalize_access_control\" initFunction=\"init_access_control\"/>"
+    "      <Governance>file:" COMMON_ETC_PATH("default_governance.p7s") "</Governance>"
+    "      <PermissionsCA>file:" COMMON_ETC_PATH("default_permissions_ca.pem") "</PermissionsCA>"
+    "      <Permissions>file:" COMMON_ETC_PATH("default_permissions.p7s") "</Permissions>"
+    "    </AccessControl>"
+    "    <Cryptographic>"
+    "      <Library finalizeFunction=\"finalize_crypto\" initFunction=\"init_crypto\"/>"
+    "    </Cryptographic>"
+    "  </DDSSecurity>"
+    "</Domain>";
+
+#define DDS_DOMAINID1 0
+#define DDS_DOMAINID2 1
+
+static dds_entity_t g_domain1 = 0;
+static dds_entity_t g_participant1 = 0;
+
+static dds_entity_t g_domain2 = 0;
+static dds_entity_t g_participant2 = 0;
+
+static void authentication_init(void)
+{
+  struct kvp governance_vars[] = {
+    { "ALLOW_UNAUTH_PP", "false" },
+    { "ENABLE_JOIN_AC", "true" },
+    { NULL, NULL }
+  };
+  char * gov_config_signed = get_governance_config (governance_vars);
+
+  struct kvp config_vars1[] = {
+    { "GOVERNANCE_DATA", gov_config_signed },
+    { "TEST_IDENTITY_CERTIFICATE", TEST_IDENTITY_CERTIFICATE },
+    { "TEST_IDENTITY_PRIVATE_KEY", TEST_IDENTITY_PRIVATE_KEY },
+    { "TEST_IDENTITY_CA_CERTIFICATE", TEST_IDENTITY_CA_CERTIFICATE },
+    { NULL, NULL }
+  };
+  struct kvp config_vars2[] = {
+    { "GOVERNANCE_DATA", gov_config_signed },
+    { "TEST_IDENTITY_CERTIFICATE", TEST_IDENTITY2_CERTIFICATE },
+    { "TEST_IDENTITY_PRIVATE_KEY", TEST_IDENTITY2_PRIVATE_KEY },
+    { "TEST_IDENTITY_CA_CERTIFICATE", TEST_IDENTITY_CA2_CERTIFICATE },
+    { NULL, NULL }
+  };
+
+  char *conf1 = ddsrt_expand_vars (config, &expand_lookup_vars_env, config_vars1);
+  char *conf2 = ddsrt_expand_vars (config, &expand_lookup_vars_env, config_vars2);
+  g_domain1 = dds_create_domain (DDS_DOMAINID1, conf1);
+  g_domain2 = dds_create_domain (DDS_DOMAINID2, conf2);
+  dds_free (conf1);
+  dds_free (conf2);
+  ddsrt_free (gov_config_signed);
+
+  CU_ASSERT_FATAL ((g_participant1 = dds_create_participant (DDS_DOMAINID1, NULL, NULL)) > 0);
+  CU_ASSERT_FATAL ((g_participant2 = dds_create_participant (DDS_DOMAINID2, NULL, NULL)) > 0);
+}
+
+static void authentication_fini(void)
+{
+  CU_ASSERT_EQUAL_FATAL (dds_delete (g_participant1), DDS_RETCODE_OK);
+  CU_ASSERT_EQUAL_FATAL (dds_delete (g_participant2), DDS_RETCODE_OK);
+  CU_ASSERT_EQUAL_FATAL (dds_delete (g_domain1), DDS_RETCODE_OK);
+  CU_ASSERT_EQUAL_FATAL (dds_delete (g_domain2), DDS_RETCODE_OK);
+}
+
+CU_Test(ddssec_authentication, different_ca, .init = authentication_init, .fini = authentication_fini)
+{
+  validate_handshake (DDS_DOMAINID1, true, NULL, true, "error: unable to get local issuer certificate");
+  validate_handshake (DDS_DOMAINID2, true, NULL, true, "error: unable to get local issuer certificate");
+}
diff --git a/src/security/core/tests/common/access_control_wrapper.c b/src/security/core/tests/common/access_control_wrapper.c
new file mode 100644
index 0000000..83b88f6
--- /dev/null
+++ b/src/security/core/tests/common/access_control_wrapper.c
@@ -0,0 +1,551 @@
+/*
+ * Copyright(c) 2006 to 2020 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+#include <string.h>
+#include <stdio.h>
+#include "dds/dds.h"
+#include "dds/ddsrt/heap.h"
+#include "dds/ddsrt/sync.h"
+#include "dds/ddsrt/string.h"
+#include "dds/ddsi/ddsi_domaingv.h"
+#include "dds/security/dds_security_api.h"
+#include "dds/security/core/dds_security_utils.h"
+#include "access_control_wrapper.h"
+
+enum ac_plugin_mode {
+  PLUGIN_MODE_ALL_OK,
+  PLUGIN_MODE_MISSING_FUNC
+};
+
+/**
+ * Implementation structure for storing encapsulated members of the instance
+ * while giving only the interface definition to user
+ */
+struct dds_security_access_control_impl {
+  dds_security_access_control base;
+  enum ac_plugin_mode mode;
+};
+
+static DDS_Security_PermissionsHandle validate_local_permissions(
+    dds_security_access_control *instance,
+    const dds_security_authentication *auth_plugin,
+    const DDS_Security_IdentityHandle identity,
+    const DDS_Security_DomainId domain_id,
+    const DDS_Security_Qos *participant_qos,
+    DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(auth_plugin);
+  DDSRT_UNUSED_ARG(auth_plugin);
+  DDSRT_UNUSED_ARG(identity);
+  DDSRT_UNUSED_ARG(domain_id);
+  DDSRT_UNUSED_ARG(participant_qos);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+  return 1;
+}
+
+static DDS_Security_PermissionsHandle validate_remote_permissions(
+    dds_security_access_control *instance,
+    const dds_security_authentication *auth_plugin,
+    const DDS_Security_IdentityHandle local_identity_handle,
+    const DDS_Security_IdentityHandle remote_identity_handle,
+    const DDS_Security_PermissionsToken *remote_permissions_token,
+    const DDS_Security_AuthenticatedPeerCredentialToken *remote_credential_token,
+    DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(auth_plugin);
+  DDSRT_UNUSED_ARG(local_identity_handle);
+  DDSRT_UNUSED_ARG(remote_identity_handle);
+  DDSRT_UNUSED_ARG(remote_permissions_token);
+  DDSRT_UNUSED_ARG(remote_credential_token);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+  return 0;
+}
+
+static DDS_Security_boolean check_create_participant( dds_security_access_control *instance,
+    const DDS_Security_PermissionsHandle permissions_handle,
+    const DDS_Security_DomainId domain_id,
+    const DDS_Security_Qos *participant_qos,
+    DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(permissions_handle);
+  DDSRT_UNUSED_ARG(domain_id);
+  DDSRT_UNUSED_ARG(participant_qos);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+  return true;
+}
+
+static DDS_Security_boolean check_create_datawriter( dds_security_access_control *instance,
+    const DDS_Security_PermissionsHandle permissions_handle,
+    const DDS_Security_DomainId domain_id,
+    const char *topic_name,
+    const DDS_Security_Qos *writer_qos,
+    const DDS_Security_PartitionQosPolicy *partition,
+    const DDS_Security_DataTags *data_tag,
+    DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(permissions_handle);
+  DDSRT_UNUSED_ARG(domain_id);
+  DDSRT_UNUSED_ARG(topic_name);
+  DDSRT_UNUSED_ARG(writer_qos);
+  DDSRT_UNUSED_ARG(partition);
+  DDSRT_UNUSED_ARG(data_tag);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+  return true;
+}
+
+static DDS_Security_boolean check_create_datareader( dds_security_access_control *instance,
+    const DDS_Security_PermissionsHandle permissions_handle,
+    const DDS_Security_DomainId domain_id,
+    const char *topic_name,
+    const DDS_Security_Qos *reader_qos,
+    const DDS_Security_PartitionQosPolicy *partition,
+    const DDS_Security_DataTags *data_tag,
+    DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(permissions_handle);
+  DDSRT_UNUSED_ARG(domain_id);
+  DDSRT_UNUSED_ARG(topic_name);
+  DDSRT_UNUSED_ARG(reader_qos);
+  DDSRT_UNUSED_ARG(partition);
+  DDSRT_UNUSED_ARG(data_tag);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+  return true;
+}
+
+static DDS_Security_boolean check_create_topic( dds_security_access_control *instance,
+    const DDS_Security_PermissionsHandle permissions_handle,
+    const DDS_Security_DomainId domain_id,
+    const char *topic_name,
+    const DDS_Security_Qos *qos,
+    DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(permissions_handle);
+  DDSRT_UNUSED_ARG(domain_id);
+  DDSRT_UNUSED_ARG(topic_name);
+  DDSRT_UNUSED_ARG(qos);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+  return true;
+}
+
+static DDS_Security_boolean check_local_datawriter_register_instance(
+    dds_security_access_control *instance,
+    const DDS_Security_PermissionsHandle permissions_handle,
+    const DDS_Security_Entity *writer,
+    const DDS_Security_DynamicData *key,
+    DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(permissions_handle);
+  DDSRT_UNUSED_ARG(writer);
+  DDSRT_UNUSED_ARG(key);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+  return true;
+}
+
+static DDS_Security_boolean check_local_datawriter_dispose_instance(
+    dds_security_access_control *instance,
+    const DDS_Security_PermissionsHandle permissions_handle,
+    const DDS_Security_Entity *writer,
+    const DDS_Security_DynamicData key,
+    DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(permissions_handle);
+  DDSRT_UNUSED_ARG(writer);
+  DDSRT_UNUSED_ARG(key);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+  return true;
+}
+
+static DDS_Security_boolean check_remote_participant( dds_security_access_control *instance,
+    const DDS_Security_PermissionsHandle permissions_handle,
+    const DDS_Security_DomainId domain_id,
+    const DDS_Security_ParticipantBuiltinTopicDataSecure *participant_data,
+    DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(permissions_handle);
+  DDSRT_UNUSED_ARG(domain_id);
+  DDSRT_UNUSED_ARG(participant_data);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+  return true;
+}
+
+static DDS_Security_boolean check_remote_datawriter( dds_security_access_control *instance,
+    const DDS_Security_PermissionsHandle permissions_handle,
+    const DDS_Security_DomainId domain_id,
+    const DDS_Security_PublicationBuiltinTopicDataSecure *publication_data,
+    DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(permissions_handle);
+  DDSRT_UNUSED_ARG(domain_id);
+  DDSRT_UNUSED_ARG(publication_data);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+  return true;
+}
+
+static DDS_Security_boolean check_remote_datareader( dds_security_access_control *instance,
+    const DDS_Security_PermissionsHandle permissions_handle,
+    const DDS_Security_DomainId domain_id,
+    const DDS_Security_SubscriptionBuiltinTopicDataSecure *subscription_data,
+    DDS_Security_boolean *relay_only, DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(permissions_handle);
+  DDSRT_UNUSED_ARG(domain_id);
+  DDSRT_UNUSED_ARG(subscription_data);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+  *relay_only = false;
+  return true;
+}
+
+static DDS_Security_boolean check_remote_topic( dds_security_access_control *instance,
+    const DDS_Security_PermissionsHandle permissions_handle,
+    const DDS_Security_DomainId domain_id,
+    const DDS_Security_TopicBuiltinTopicData *topic_data,
+    DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(permissions_handle);
+  DDSRT_UNUSED_ARG(domain_id);
+  DDSRT_UNUSED_ARG(topic_data);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+  return true;
+}
+
+static DDS_Security_boolean check_local_datawriter_match(
+    dds_security_access_control *instance,
+    const DDS_Security_PermissionsHandle writer_permissions_handle,
+    const DDS_Security_PermissionsHandle reader_permissions_handle,
+    const DDS_Security_PublicationBuiltinTopicDataSecure *publication_data,
+    const DDS_Security_SubscriptionBuiltinTopicDataSecure *subscription_data,
+    DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(writer_permissions_handle);
+  DDSRT_UNUSED_ARG(reader_permissions_handle);
+  DDSRT_UNUSED_ARG(publication_data);
+  DDSRT_UNUSED_ARG(subscription_data);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+  return true;
+}
+
+static DDS_Security_boolean check_local_datareader_match(
+    dds_security_access_control *instance,
+    const DDS_Security_PermissionsHandle reader_permissions_handle,
+    const DDS_Security_PermissionsHandle writer_permissions_handle,
+    const DDS_Security_SubscriptionBuiltinTopicDataSecure *subscription_data,
+    const DDS_Security_PublicationBuiltinTopicDataSecure *publication_data,
+    DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(reader_permissions_handle);
+  DDSRT_UNUSED_ARG(writer_permissions_handle);
+  DDSRT_UNUSED_ARG(subscription_data);
+  DDSRT_UNUSED_ARG(publication_data);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+  return true;
+}
+
+static DDS_Security_boolean check_remote_datawriter_register_instance(
+    dds_security_access_control *instance,
+    const DDS_Security_PermissionsHandle permissions_handle,
+    const DDS_Security_Entity *reader,
+    const DDS_Security_InstanceHandle publication_handle,
+    const DDS_Security_DynamicData key,
+    const DDS_Security_InstanceHandle instance_handle,
+    DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(permissions_handle);
+  DDSRT_UNUSED_ARG(reader);
+  DDSRT_UNUSED_ARG(publication_handle);
+  DDSRT_UNUSED_ARG(key);
+  DDSRT_UNUSED_ARG(instance_handle);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+  return true;
+}
+
+static DDS_Security_boolean check_remote_datawriter_dispose_instance(
+    dds_security_access_control *instance,
+    const DDS_Security_PermissionsHandle permissions_handle,
+    const DDS_Security_Entity *reader,
+    const DDS_Security_InstanceHandle publication_handle,
+    const DDS_Security_DynamicData key,
+    DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(permissions_handle);
+  DDSRT_UNUSED_ARG(reader);
+  DDSRT_UNUSED_ARG(publication_handle);
+  DDSRT_UNUSED_ARG(key);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+  return true;
+}
+
+static DDS_Security_boolean get_permissions_token(
+    dds_security_access_control *instance,
+    DDS_Security_PermissionsToken *permissions_token,
+    const DDS_Security_PermissionsHandle handle,
+    DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(handle);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+  memset(permissions_token, 0, sizeof(*permissions_token));
+  permissions_token->class_id = ddsrt_strdup("");
+  return true;
+}
+
+static DDS_Security_boolean get_permissions_credential_token(
+    dds_security_access_control *instance,
+    DDS_Security_PermissionsCredentialToken *permissions_credential_token,
+    const DDS_Security_PermissionsHandle handle,
+    DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(permissions_credential_token);
+  DDSRT_UNUSED_ARG(handle);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+  return true;
+}
+
+static DDS_Security_boolean set_listener( dds_security_access_control *instance,
+    const dds_security_access_control_listener *listener,
+    DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(listener);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+  return true;
+}
+
+static DDS_Security_boolean return_permissions_token( dds_security_access_control *instance,
+    const DDS_Security_PermissionsToken *token,
+    DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+  ddsrt_free (token->class_id);
+  return true;
+}
+
+static DDS_Security_boolean return_permissions_credential_token(
+    dds_security_access_control *instance,
+    const DDS_Security_PermissionsCredentialToken *permissions_credential_token,
+    DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(permissions_credential_token);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+  return true;
+}
+
+static DDS_Security_boolean get_participant_sec_attributes(
+    dds_security_access_control *instance,
+    const DDS_Security_PermissionsHandle permissions_handle,
+    DDS_Security_ParticipantSecurityAttributes *attributes,
+    DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(permissions_handle);
+  DDSRT_UNUSED_ARG(attributes);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+  return true;
+}
+
+static DDS_Security_boolean get_topic_sec_attributes( dds_security_access_control *instance,
+    const DDS_Security_PermissionsHandle permissions_handle,
+    const char *topic_name,
+    DDS_Security_TopicSecurityAttributes *attributes,
+    DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(permissions_handle);
+  DDSRT_UNUSED_ARG(topic_name);
+  DDSRT_UNUSED_ARG(attributes);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+  return true;
+}
+
+static DDS_Security_boolean get_datawriter_sec_attributes(
+    dds_security_access_control *instance,
+    const DDS_Security_PermissionsHandle permissions_handle,
+    const char *topic_name,
+    const DDS_Security_PartitionQosPolicy *partition,
+    const DDS_Security_DataTagQosPolicy *data_tag,
+    DDS_Security_EndpointSecurityAttributes *attributes,
+    DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(permissions_handle);
+  DDSRT_UNUSED_ARG(topic_name);
+  DDSRT_UNUSED_ARG(partition);
+  DDSRT_UNUSED_ARG(data_tag);
+  DDSRT_UNUSED_ARG(attributes);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+  return true;
+}
+
+static DDS_Security_boolean get_datareader_sec_attributes(
+    dds_security_access_control *instance,
+    const DDS_Security_PermissionsHandle permissions_handle,
+    const char *topic_name,
+    const DDS_Security_PartitionQosPolicy *partition,
+    const DDS_Security_DataTagQosPolicy *data_tag,
+    DDS_Security_EndpointSecurityAttributes *attributes,
+    DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(permissions_handle);
+  DDSRT_UNUSED_ARG(topic_name);
+  DDSRT_UNUSED_ARG(partition);
+  DDSRT_UNUSED_ARG(data_tag);
+  DDSRT_UNUSED_ARG(attributes);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+  return true;
+}
+
+static DDS_Security_boolean return_participant_sec_attributes(
+    dds_security_access_control *instance,
+    const DDS_Security_ParticipantSecurityAttributes *attributes,
+    DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(attributes);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+  return true;
+}
+
+static DDS_Security_boolean return_topic_sec_attributes(
+    dds_security_access_control *instance,
+    const DDS_Security_TopicSecurityAttributes *attributes,
+    DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(attributes);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+  return true;
+}
+
+static DDS_Security_boolean return_datawriter_sec_attributes(
+    dds_security_access_control *instance,
+    const DDS_Security_EndpointSecurityAttributes *attributes,
+    DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(attributes);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+  return true;
+}
+
+static DDS_Security_boolean return_datareader_sec_attributes(
+    dds_security_access_control *instance,
+    const DDS_Security_EndpointSecurityAttributes *attributes,
+    DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(attributes);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+  return true;
+}
+
+static DDS_Security_boolean return_permissions_handle(
+    dds_security_access_control *instance,
+    const DDS_Security_PermissionsHandle permissions_handle,
+    DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(permissions_handle);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+  return true;
+}
+
+
+static struct dds_security_access_control_impl * init_test_access_control_common()
+{
+  struct dds_security_access_control_impl *impl = ddsrt_malloc(sizeof(*impl));
+  memset(impl, 0, sizeof(*impl));
+  impl->base.validate_local_permissions = &validate_local_permissions;
+  impl->base.validate_remote_permissions = &validate_remote_permissions;
+  impl->base.check_create_participant = &check_create_participant;
+  impl->base.check_create_datawriter = &check_create_datawriter;
+  impl->base.check_create_datareader = &check_create_datareader;
+  impl->base.check_create_topic = &check_create_topic;
+  impl->base.check_local_datawriter_register_instance = &check_local_datawriter_register_instance;
+  impl->base.check_local_datawriter_dispose_instance = &check_local_datawriter_dispose_instance;
+  impl->base.check_remote_participant = &check_remote_participant;
+  impl->base.check_remote_datawriter = &check_remote_datawriter;
+  impl->base.check_remote_datareader = &check_remote_datareader;
+  impl->base.check_remote_topic = &check_remote_topic;
+  impl->base.check_local_datawriter_match = &check_local_datawriter_match;
+  impl->base.check_local_datareader_match = &check_local_datareader_match;
+  impl->base.check_remote_datawriter_register_instance = &check_remote_datawriter_register_instance;
+  impl->base.check_remote_datawriter_dispose_instance = &check_remote_datawriter_dispose_instance;
+  impl->base.get_permissions_token = &get_permissions_token;
+  impl->base.get_permissions_credential_token = &get_permissions_credential_token;
+  impl->base.set_listener = &set_listener;
+  impl->base.return_permissions_token = &return_permissions_token;
+  impl->base.return_permissions_credential_token = &return_permissions_credential_token;
+  impl->base.get_participant_sec_attributes = &get_participant_sec_attributes;
+  impl->base.get_topic_sec_attributes = &get_topic_sec_attributes;
+  impl->base.get_datawriter_sec_attributes = &get_datawriter_sec_attributes;
+  impl->base.get_datareader_sec_attributes = &get_datareader_sec_attributes;
+  impl->base.return_participant_sec_attributes = &return_participant_sec_attributes;
+  impl->base.return_topic_sec_attributes = &return_topic_sec_attributes;
+  impl->base.return_datawriter_sec_attributes = &return_datawriter_sec_attributes;
+  impl->base.return_datareader_sec_attributes = &return_datareader_sec_attributes;
+  impl->base.return_permissions_handle = &return_permissions_handle;
+  return impl;
+}
+
+int32_t init_test_access_control_all_ok(const char *argument, void **context)
+{
+  DDSRT_UNUSED_ARG(argument);
+  DDSRT_UNUSED_ARG(context);
+  struct dds_security_access_control_impl *impl = init_test_access_control_common();
+  impl->mode = PLUGIN_MODE_ALL_OK;
+  *context = impl;
+  return 0;
+}
+
+int32_t finalize_test_access_control_all_ok(void *context)
+{
+  assert(((struct dds_security_access_control_impl *)context)->mode == PLUGIN_MODE_ALL_OK);
+  ddsrt_free(context);
+  return 0;
+}
+
+int32_t init_test_access_control_missing_func(const char *argument, void **context)
+{
+  DDSRT_UNUSED_ARG(argument);
+  DDSRT_UNUSED_ARG(context);
+  struct dds_security_access_control_impl *impl = init_test_access_control_common();
+  impl->base.check_create_datareader = NULL;
+  impl->mode = PLUGIN_MODE_MISSING_FUNC;
+  *context = impl;
+  return 0;
+}
+
+int32_t finalize_test_access_control_missing_func(void *context)
+{
+  assert(((struct dds_security_access_control_impl *)context)->mode == PLUGIN_MODE_MISSING_FUNC);
+  ddsrt_free(context);
+  return 0;
+}
+
diff --git a/src/security/core/tests/common/access_control_wrapper.h b/src/security/core/tests/common/access_control_wrapper.h
new file mode 100644
index 0000000..70c9c2c
--- /dev/null
+++ b/src/security/core/tests/common/access_control_wrapper.h
@@ -0,0 +1,26 @@
+/*
+ * Copyright(c) 2006 to 2020 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+#ifndef SECURITY_CORE_TEST_ACCESS_CONTROL_WRAPPER_H_
+#define SECURITY_CORE_TEST_ACCESS_CONTROL_WRAPPER_H_
+
+#include "dds/security/dds_security_api.h"
+#include "dds/security/access_control_wrapper_export.h"
+
+/* Init in all-ok mode: all functions return success without calling the actual plugin */
+SECURITY_EXPORT int32_t init_test_access_control_all_ok(const char *argument, void **context);
+SECURITY_EXPORT int32_t finalize_test_access_control_all_ok(void *context);
+
+/* Init in missing function mode: one of the function pointers is null */
+SECURITY_EXPORT int32_t init_test_access_control_missing_func(const char *argument, void **context);
+SECURITY_EXPORT int32_t finalize_test_access_control_missing_func(void *context);
+
+#endif /* SECURITY_CORE_TEST_ACCESS_CONTROL_WRAPPER_H_ */
diff --git a/src/security/core/tests/common/authentication_wrapper.c b/src/security/core/tests/common/authentication_wrapper.c
new file mode 100644
index 0000000..b794a3e
--- /dev/null
+++ b/src/security/core/tests/common/authentication_wrapper.c
@@ -0,0 +1,566 @@
+/*
+ * Copyright(c) 2006 to 2020 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+#include <string.h>
+#include <stdio.h>
+#include "dds/dds.h"
+#include "dds/ddsrt/heap.h"
+#include "dds/ddsrt/sync.h"
+#include "dds/ddsrt/string.h"
+#include "dds/ddsi/ddsi_domaingv.h"
+#include "dds/security/dds_security_api.h"
+#include "dds/security/core/dds_security_utils.h"
+#include "authentication_wrapper.h"
+#include "test_identity.h"
+#include "plugin_wrapper_msg_q.h"
+
+int32_t init_authentication(const char *argument, void **context);
+int32_t finalize_authentication(void *context);
+
+enum auth_plugin_mode {
+  PLUGIN_MODE_ALL_OK,
+  PLUGIN_MODE_WRAPPED,
+  PLUGIN_MODE_MISSING_FUNC,
+  PLUGIN_MODE_INIT_FAIL
+};
+
+/**
+ * Implementation structure for storing encapsulated members of the instance
+ * while giving only the interface definition to user
+ */
+struct dds_security_authentication_impl
+{
+  dds_security_authentication base;
+  dds_security_authentication *instance;
+  struct message_queue msg_queue;
+  const struct ddsi_domaingv *gv;
+  enum auth_plugin_mode mode;
+};
+
+static struct dds_security_authentication_impl **auth_impl;
+static size_t auth_impl_count = 0;
+
+static const char *test_identity_certificate = TEST_IDENTITY_CERTIFICATE_DUMMY;
+static const char *test_private_key          = TEST_IDENTITY_PRIVATE_KEY_DUMMY;
+static const char *test_ca_certificate       = TEST_IDENTITY_CA_CERTIFICATE_DUMMY;
+
+static DDS_Security_ValidationResult_t test_validate_local_identity_all_ok(
+    DDS_Security_GUID_t *adjusted_participant_guid,
+    const DDS_Security_Qos *participant_qos,
+    const DDS_Security_GUID_t *candidate_participant_guid)
+{
+  DDS_Security_ValidationResult_t result = DDS_SECURITY_VALIDATION_OK;
+  char *identity_ca = NULL;
+  char *identity_certificate = NULL;
+  char *private_key = NULL;
+
+  memcpy(adjusted_participant_guid, candidate_participant_guid, sizeof(*adjusted_participant_guid));
+  for (unsigned i = 0; i < participant_qos->property.value._length; i++)
+  {
+    printf("%s\n", participant_qos->property.value._buffer[i].name);
+    if (!strcmp(participant_qos->property.value._buffer[i].name, "dds.sec.auth.private_key"))
+      private_key = participant_qos->property.value._buffer[i].value;
+    else if (!strcmp(participant_qos->property.value._buffer[i].name, "dds.sec.auth.identity_ca"))
+      identity_ca = participant_qos->property.value._buffer[i].value;
+    else if (!strcmp(participant_qos->property.value._buffer[i].name, "dds.sec.auth.identity_certificate"))
+      identity_certificate = participant_qos->property.value._buffer[i].value;
+  }
+
+  if (strcmp(identity_certificate, test_identity_certificate))
+  {
+    printf("identity received=%s\n", identity_certificate);
+    printf("identity expected=%s\n", test_identity_certificate);
+    result = DDS_SECURITY_VALIDATION_FAILED;
+    printf("FAILED: Could not get identity_certificate value properly\n");
+  }
+  else if (strcmp(identity_ca, test_ca_certificate))
+  {
+    printf("ca received=%s\n", identity_ca);
+    printf("ca expected=%s\n", test_ca_certificate);
+    printf("FAILED: Could not get identity_ca value properly\n");
+    result = DDS_SECURITY_VALIDATION_FAILED;
+  }
+  else if (strcmp(private_key, test_private_key))
+  {
+    printf("FAILED: Could not get private_key value properly\n");
+    result = DDS_SECURITY_VALIDATION_FAILED;
+  }
+  if (result == DDS_SECURITY_VALIDATION_OK)
+    printf("DDS_SECURITY_VALIDATION_OK\n");
+
+  return result;
+}
+
+static DDS_Security_ValidationResult_t test_validate_local_identity(
+    dds_security_authentication *instance,
+    DDS_Security_IdentityHandle *local_identity_handle,
+    DDS_Security_GUID_t *adjusted_participant_guid,
+    const DDS_Security_DomainId domain_id,
+    const DDS_Security_Qos *participant_qos,
+    const DDS_Security_GUID_t *candidate_participant_guid,
+    DDS_Security_SecurityException *ex)
+{
+  struct dds_security_authentication_impl *impl = (struct dds_security_authentication_impl *)instance;
+  switch (impl->mode)
+  {
+    case PLUGIN_MODE_WRAPPED:
+    {
+      DDS_Security_ValidationResult_t result = impl->instance->validate_local_identity(
+          impl->instance, local_identity_handle, adjusted_participant_guid, domain_id, participant_qos, candidate_participant_guid, ex);
+      add_message(&impl->msg_queue, MESSAGE_KIND_VALIDATE_LOCAL_IDENTITY, *local_identity_handle,
+          0, 0, adjusted_participant_guid, NULL, result, ex ? ex->message : "", NULL, instance);
+      return result;
+    }
+    case PLUGIN_MODE_ALL_OK:
+    default:
+      return test_validate_local_identity_all_ok(adjusted_participant_guid, participant_qos, candidate_participant_guid);
+  }
+}
+
+static DDS_Security_boolean test_get_identity_token(dds_security_authentication *instance,
+    DDS_Security_IdentityToken *identity_token,
+    const DDS_Security_IdentityHandle handle,
+    DDS_Security_SecurityException *ex)
+{
+  struct dds_security_authentication_impl *impl = (struct dds_security_authentication_impl *)instance;
+  switch (impl->mode)
+  {
+    case PLUGIN_MODE_WRAPPED:
+      return impl->instance->get_identity_token(impl->instance, identity_token, handle, ex);
+
+    case PLUGIN_MODE_ALL_OK:
+    default:
+    {
+      memset(identity_token, 0, sizeof(*identity_token));
+      identity_token->class_id = ddsrt_strdup("");
+      return true;
+    }
+  }
+}
+
+static DDS_Security_boolean test_get_identity_status_token(
+    dds_security_authentication *instance,
+    DDS_Security_IdentityStatusToken *identity_status_token,
+    const DDS_Security_IdentityHandle handle,
+    DDS_Security_SecurityException *ex)
+{
+  struct dds_security_authentication_impl *impl = (struct dds_security_authentication_impl *)instance;
+  switch (impl->mode)
+  {
+    case PLUGIN_MODE_WRAPPED:
+      return impl->instance->get_identity_status_token(impl->instance, identity_status_token, handle, ex);
+    case PLUGIN_MODE_ALL_OK:
+    default:
+      return true;
+  }
+}
+
+static DDS_Security_boolean test_set_permissions_credential_and_token(
+    dds_security_authentication *instance,
+    const DDS_Security_IdentityHandle handle,
+    const DDS_Security_PermissionsCredentialToken *permissions_credential,
+    const DDS_Security_PermissionsToken *permissions_token,
+    DDS_Security_SecurityException *ex)
+{
+  struct dds_security_authentication_impl *impl = (struct dds_security_authentication_impl *)instance;
+  switch (impl->mode)
+  {
+    case PLUGIN_MODE_WRAPPED:
+      return impl->instance->set_permissions_credential_and_token(impl->instance, handle, permissions_credential, permissions_token, ex);
+    case PLUGIN_MODE_ALL_OK:
+    default:
+      return true;
+  }
+}
+
+static DDS_Security_ValidationResult_t test_validate_remote_identity(
+    dds_security_authentication *instance,
+    DDS_Security_IdentityHandle *remote_identity_handle,
+    DDS_Security_AuthRequestMessageToken *local_auth_request_token,
+    const DDS_Security_AuthRequestMessageToken *remote_auth_request_token,
+    const DDS_Security_IdentityHandle local_identity_handle,
+    const DDS_Security_IdentityToken *remote_identity_token,
+    const DDS_Security_GUID_t *remote_participant_guid,
+    DDS_Security_SecurityException *ex)
+{
+  struct dds_security_authentication_impl *impl = (struct dds_security_authentication_impl *)instance;
+  switch (impl->mode)
+  {
+    case PLUGIN_MODE_WRAPPED:
+    {
+      DDS_Security_ValidationResult_t result = impl->instance->validate_remote_identity(
+        impl->instance, remote_identity_handle, local_auth_request_token, remote_auth_request_token,
+        local_identity_handle, remote_identity_token, remote_participant_guid, ex);
+      add_message(&impl->msg_queue, MESSAGE_KIND_VALIDATE_REMOTE_IDENTITY, local_identity_handle,
+          *remote_identity_handle, 0, NULL, remote_participant_guid, result, ex ? ex->message : "", local_auth_request_token, instance);
+      return result;
+    }
+
+    case PLUGIN_MODE_ALL_OK:
+    default:
+      return DDS_SECURITY_VALIDATION_OK;
+  }
+}
+
+static DDS_Security_ValidationResult_t test_begin_handshake_request(
+    dds_security_authentication *instance,
+    DDS_Security_HandshakeHandle *handshake_handle,
+    DDS_Security_HandshakeMessageToken *handshake_message,
+    const DDS_Security_IdentityHandle initiator_identity_handle,
+    const DDS_Security_IdentityHandle replier_identity_handle,
+    const DDS_Security_OctetSeq *serialized_local_participant_data,
+    DDS_Security_SecurityException *ex)
+{
+  struct dds_security_authentication_impl *impl = (struct dds_security_authentication_impl *)instance;
+  switch (impl->mode)
+  {
+    case PLUGIN_MODE_WRAPPED:
+    {
+      DDS_Security_ValidationResult_t result = impl->instance->begin_handshake_request(
+        impl->instance, handshake_handle, handshake_message, initiator_identity_handle,
+        replier_identity_handle, serialized_local_participant_data, ex);
+      add_message(&impl->msg_queue, MESSAGE_KIND_BEGIN_HANDSHAKE_REQUEST, initiator_identity_handle,
+          replier_identity_handle, *handshake_handle, NULL, NULL, result, ex ? ex->message : "", handshake_message, instance);
+      return result;
+    }
+
+    case PLUGIN_MODE_ALL_OK:
+    default:
+      return DDS_SECURITY_VALIDATION_OK;
+  }
+}
+
+static DDS_Security_ValidationResult_t test_begin_handshake_reply(
+    dds_security_authentication *instance,
+    DDS_Security_HandshakeHandle *handshake_handle,
+    DDS_Security_HandshakeMessageToken *handshake_message_out,
+    const DDS_Security_HandshakeMessageToken *handshake_message_in,
+    const DDS_Security_IdentityHandle initiator_identity_handle,
+    const DDS_Security_IdentityHandle replier_identity_handle,
+    const DDS_Security_OctetSeq *serialized_local_participant_data,
+    DDS_Security_SecurityException *ex)
+{
+  struct dds_security_authentication_impl *impl = (struct dds_security_authentication_impl *)instance;
+  switch (impl->mode)
+  {
+    case PLUGIN_MODE_WRAPPED:
+    {
+      DDS_Security_ValidationResult_t result = impl->instance->begin_handshake_reply(
+        impl->instance, handshake_handle, handshake_message_out, handshake_message_in,
+        initiator_identity_handle, replier_identity_handle, serialized_local_participant_data, ex);
+      add_message(&impl->msg_queue, MESSAGE_KIND_BEGIN_HANDSHAKE_REPLY, replier_identity_handle,
+          initiator_identity_handle, *handshake_handle, NULL, NULL, result, ex ? ex->message : "", handshake_message_out, instance);
+      return result;
+    }
+
+    case PLUGIN_MODE_ALL_OK:
+    default:
+      return DDS_SECURITY_VALIDATION_OK;
+  }
+}
+
+static DDS_Security_ValidationResult_t test_process_handshake(
+    dds_security_authentication *instance,
+    DDS_Security_HandshakeMessageToken *handshake_message_out,
+    const DDS_Security_HandshakeMessageToken *handshake_message_in,
+    const DDS_Security_HandshakeHandle handshake_handle,
+    DDS_Security_SecurityException *ex)
+{
+  struct dds_security_authentication_impl *impl = (struct dds_security_authentication_impl *)instance;
+  switch (impl->mode)
+  {
+    case PLUGIN_MODE_WRAPPED:
+    {
+      DDS_Security_ValidationResult_t result = impl->instance->process_handshake(impl->instance, handshake_message_out, handshake_message_in, handshake_handle, ex);
+      add_message(&impl->msg_queue, MESSAGE_KIND_PROCESS_HANDSHAKE, 0, 0, handshake_handle,
+          NULL, NULL, result, ex ? ex->message : "", handshake_message_out, instance);
+      return result;
+    }
+
+    case PLUGIN_MODE_ALL_OK:
+    default:
+      return DDS_SECURITY_VALIDATION_OK;
+  }
+}
+
+static DDS_Security_SharedSecretHandle test_get_shared_secret(
+    dds_security_authentication *instance,
+    const DDS_Security_HandshakeHandle handshake_handle,
+    DDS_Security_SecurityException *ex)
+{
+  struct dds_security_authentication_impl *impl = (struct dds_security_authentication_impl *)instance;
+  switch (impl->mode)
+  {
+    case PLUGIN_MODE_WRAPPED:
+      return impl->instance->get_shared_secret(impl->instance, handshake_handle, ex);
+    case PLUGIN_MODE_ALL_OK:
+    default:
+      return 0;
+  }
+}
+
+static DDS_Security_boolean test_get_authenticated_peer_credential_token(
+    dds_security_authentication *instance,
+    DDS_Security_AuthenticatedPeerCredentialToken *peer_credential_token,
+    const DDS_Security_HandshakeHandle handshake_handle,
+    DDS_Security_SecurityException *ex)
+{
+  struct dds_security_authentication_impl *impl = (struct dds_security_authentication_impl *)instance;
+  switch (impl->mode)
+  {
+    case PLUGIN_MODE_WRAPPED:
+      return impl->instance->get_authenticated_peer_credential_token(impl->instance, peer_credential_token, handshake_handle, ex);
+    case PLUGIN_MODE_ALL_OK:
+    default:
+      return true;
+  }
+}
+
+static DDS_Security_boolean test_set_listener(dds_security_authentication *instance,
+    const dds_security_authentication_listener *listener,
+    DDS_Security_SecurityException *ex)
+{
+  struct dds_security_authentication_impl *impl = (struct dds_security_authentication_impl *)instance;
+  switch (impl->mode)
+  {
+    case PLUGIN_MODE_WRAPPED:
+      return impl->instance->set_listener(impl->instance, listener, ex);
+    case PLUGIN_MODE_ALL_OK:
+    default:
+      return true;
+  }
+}
+
+static DDS_Security_boolean test_return_identity_token(dds_security_authentication *instance,
+    const DDS_Security_IdentityToken *token,
+    DDS_Security_SecurityException *ex)
+{
+  struct dds_security_authentication_impl *impl = (struct dds_security_authentication_impl *)instance;
+  switch (impl->mode)
+  {
+    case PLUGIN_MODE_WRAPPED:
+      return impl->instance->return_identity_token(impl->instance, token, ex);
+    case PLUGIN_MODE_ALL_OK:
+    default:
+      if (token->class_id)
+        ddsrt_free (token->class_id);
+      return true;
+  }
+}
+
+static DDS_Security_boolean test_return_identity_status_token(
+    dds_security_authentication *instance,
+    const DDS_Security_IdentityStatusToken *token,
+    DDS_Security_SecurityException *ex)
+{
+  struct dds_security_authentication_impl *impl = (struct dds_security_authentication_impl *)instance;
+  switch (impl->mode)
+  {
+    case PLUGIN_MODE_WRAPPED:
+      return impl->instance->return_identity_status_token(impl->instance, token, ex);
+    case PLUGIN_MODE_ALL_OK:
+    default:
+      return true;
+  }
+}
+
+static DDS_Security_boolean test_return_authenticated_peer_credential_token(
+    dds_security_authentication *instance,
+    const DDS_Security_AuthenticatedPeerCredentialToken *peer_credential_token,
+    DDS_Security_SecurityException *ex)
+{
+  struct dds_security_authentication_impl *impl = (struct dds_security_authentication_impl *)instance;
+  switch (impl->mode)
+  {
+    case PLUGIN_MODE_WRAPPED:
+      return impl->instance->return_authenticated_peer_credential_token(impl->instance, peer_credential_token, ex);
+    case PLUGIN_MODE_ALL_OK:
+    default:
+      return true;
+  }
+}
+
+static DDS_Security_boolean test_return_handshake_handle(dds_security_authentication *instance,
+    const DDS_Security_HandshakeHandle handshake_handle,
+    DDS_Security_SecurityException *ex)
+{
+  struct dds_security_authentication_impl *impl = (struct dds_security_authentication_impl *)instance;
+  switch (impl->mode)
+  {
+    case PLUGIN_MODE_WRAPPED:
+      return impl->instance->return_handshake_handle(impl->instance, handshake_handle, ex);
+    case PLUGIN_MODE_ALL_OK:
+    default:
+      return true;
+  }
+}
+
+static DDS_Security_boolean test_return_identity_handle(
+    dds_security_authentication *instance,
+    const DDS_Security_IdentityHandle identity_handle,
+    DDS_Security_SecurityException *ex)
+{
+  struct dds_security_authentication_impl *impl = (struct dds_security_authentication_impl *)instance;
+  switch (impl->mode)
+  {
+    case PLUGIN_MODE_WRAPPED:
+      return impl->instance->return_identity_handle(impl->instance, identity_handle, ex);
+    default:
+      return true;
+  }
+}
+
+static DDS_Security_boolean test_return_sharedsecret_handle(
+    dds_security_authentication *instance,
+    const DDS_Security_SharedSecretHandle sharedsecret_handle,
+    DDS_Security_SecurityException *ex)
+{
+  struct dds_security_authentication_impl *impl = (struct dds_security_authentication_impl *)instance;
+  switch (impl->mode)
+  {
+    case PLUGIN_MODE_WRAPPED:
+      return impl->instance->return_sharedsecret_handle(impl->instance, sharedsecret_handle, ex);
+    case PLUGIN_MODE_ALL_OK:
+    default:
+      return true;
+  }
+}
+
+static struct dds_security_authentication_impl * get_impl_for_domain(dds_domainid_t domain_id)
+{
+  for (size_t i = 0; i < auth_impl_count; i++)
+  {
+    if (auth_impl[i]->gv->config.domainId == domain_id)
+    {
+      assert(auth_impl[i]);
+      return auth_impl[i];
+    }
+  }
+  return NULL;
+}
+
+struct message * test_authentication_plugin_take_msg(dds_domainid_t domain_id, message_kind_t kind, DDS_Security_IdentityHandle lidHandle, DDS_Security_IdentityHandle ridHandle, DDS_Security_IdentityHandle hsHandle, dds_duration_t timeout)
+{
+  struct dds_security_authentication_impl *impl = get_impl_for_domain(domain_id);
+  assert(impl);
+  return take_message(&impl->msg_queue, kind, lidHandle, ridHandle, hsHandle, timeout);
+}
+
+void test_authentication_plugin_release_msg(struct message *msg)
+{
+  delete_message(msg);
+}
+
+static struct dds_security_authentication_impl * init_test_authentication_common()
+{
+  struct dds_security_authentication_impl * impl = ddsrt_malloc(sizeof(*impl));
+  memset(impl, 0, sizeof(*impl));
+  impl->base.validate_local_identity = &test_validate_local_identity;
+  impl->base.get_identity_token = &test_get_identity_token;
+  impl->base.get_identity_status_token = &test_get_identity_status_token;
+  impl->base.set_permissions_credential_and_token = &test_set_permissions_credential_and_token;
+  impl->base.validate_remote_identity = &test_validate_remote_identity;
+  impl->base.begin_handshake_request = &test_begin_handshake_request;
+  impl->base.begin_handshake_reply = &test_begin_handshake_reply;
+  impl->base.process_handshake = &test_process_handshake;
+  impl->base.get_shared_secret = &test_get_shared_secret;
+  impl->base.get_authenticated_peer_credential_token = &test_get_authenticated_peer_credential_token;
+  impl->base.set_listener = &test_set_listener;
+  impl->base.return_identity_token = &test_return_identity_token;
+  impl->base.return_identity_status_token = &test_return_identity_status_token;
+  impl->base.return_authenticated_peer_credential_token = &test_return_authenticated_peer_credential_token;
+  impl->base.return_handshake_handle = &test_return_handshake_handle;
+  impl->base.return_identity_handle = &test_return_identity_handle;
+  impl->base.return_sharedsecret_handle = &test_return_sharedsecret_handle;
+  return impl;
+}
+
+int32_t init_test_authentication_all_ok(const char *argument, void **context)
+{
+  DDSRT_UNUSED_ARG(argument);
+  DDSRT_UNUSED_ARG(context);
+  struct dds_security_authentication_impl *impl = init_test_authentication_common();
+  impl->mode = PLUGIN_MODE_ALL_OK;
+  *context = impl;
+  return 0;
+}
+
+int32_t finalize_test_authentication_all_ok(void *context)
+{
+  assert(((struct dds_security_authentication_impl *)context)->mode == PLUGIN_MODE_ALL_OK);
+  ddsrt_free(context);
+  return 0;
+}
+
+int32_t init_test_authentication_missing_func(const char *argument, void **context)
+{
+  DDSRT_UNUSED_ARG(argument);
+  DDSRT_UNUSED_ARG(context);
+  struct dds_security_authentication_impl *impl = init_test_authentication_common();
+  impl->base.get_shared_secret = NULL;
+  impl->mode = PLUGIN_MODE_MISSING_FUNC;
+  *context = impl;
+  return 0;
+}
+
+int32_t finalize_test_authentication_missing_func(void *context)
+{
+  assert(((struct dds_security_authentication_impl *)context)->mode == PLUGIN_MODE_MISSING_FUNC);
+  ddsrt_free(context);
+  return 0;
+}
+
+int32_t init_test_authentication_init_error(const char *argument, void **context)
+{
+  DDSRT_UNUSED_ARG(argument);
+  DDSRT_UNUSED_ARG(context);
+  return 1;
+}
+
+int32_t finalize_test_authentication_init_error(void *context)
+{
+  DDSRT_UNUSED_ARG(context);
+  return 0;
+}
+
+int32_t init_test_authentication_wrapped(const char *argument, void **context)
+{
+  int32_t ret;
+  struct dds_security_authentication_impl *impl = init_test_authentication_common();
+  impl->mode = PLUGIN_MODE_WRAPPED;
+
+  init_message_queue(&impl->msg_queue);
+  struct thread_state1 * const ts1 = lookup_thread_state ();
+  struct ddsi_domaingv const * const gv = ddsrt_atomic_ldvoidp (&ts1->gv);
+  impl->gv = gv;
+
+  ret = init_authentication(argument, (void **)&impl->instance);
+
+  auth_impl_count++;
+  auth_impl = ddsrt_realloc(auth_impl, auth_impl_count * sizeof(*auth_impl));
+  auth_impl[auth_impl_count - 1] = impl;
+
+  *context = impl;
+  return ret;
+}
+
+int32_t finalize_test_authentication_wrapped(void *context)
+{
+  int32_t ret;
+  struct dds_security_authentication_impl *impl = context;
+  assert(impl->mode == PLUGIN_MODE_WRAPPED);
+  deinit_message_queue(&impl->msg_queue);
+  ret = finalize_authentication(impl->instance);
+  ddsrt_free(context);
+  auth_impl_count--;
+  return ret;
+}
+
diff --git a/src/security/core/tests/common/authentication_wrapper.h b/src/security/core/tests/common/authentication_wrapper.h
new file mode 100644
index 0000000..be4854a
--- /dev/null
+++ b/src/security/core/tests/common/authentication_wrapper.h
@@ -0,0 +1,38 @@
+/*
+ * Copyright(c) 2006 to 2020 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+#ifndef SECURITY_CORE_TEST_AUTHENTICATION_WRAPPER_H_
+#define SECURITY_CORE_TEST_AUTHENTICATION_WRAPPER_H_
+
+#include "dds/security/dds_security_api.h"
+#include "dds/security/authentication_wrapper_export.h"
+#include "plugin_wrapper_msg_q.h"
+
+/* Init in wrapper mode */
+SECURITY_EXPORT int32_t init_test_authentication_wrapped(const char *argument, void **context);
+SECURITY_EXPORT int32_t finalize_test_authentication_wrapped(void *context);
+
+/* Init in all-ok mode: all functions return success without calling the actual plugin */
+SECURITY_EXPORT int32_t init_test_authentication_all_ok(const char *argument, void **context);
+SECURITY_EXPORT int32_t finalize_test_authentication_all_ok(void *context);
+
+/* Init in missing function mode: one of the function pointers is null */
+SECURITY_EXPORT int32_t init_test_authentication_missing_func(const char *argument, void **context);
+SECURITY_EXPORT int32_t finalize_test_authentication_missing_func(void *context);
+
+/* Init function fails */
+SECURITY_EXPORT int32_t init_test_authentication_init_error(const char *argument, void **context);
+SECURITY_EXPORT int32_t finalize_test_authentication_init_error(void *context);
+
+SECURITY_EXPORT struct message * test_authentication_plugin_take_msg(dds_domainid_t domain_id, message_kind_t kind, DDS_Security_IdentityHandle lidHandle, DDS_Security_IdentityHandle ridHandle, DDS_Security_IdentityHandle hsHandle, dds_duration_t timeout);
+SECURITY_EXPORT void test_authentication_plugin_release_msg(struct message *msg);
+
+#endif /* SECURITY_CORE_TEST_AUTHENTICATION_WRAPPER_H_ */
diff --git a/src/security/core/tests/common/config_env.h.in b/src/security/core/tests/common/config_env.h.in
new file mode 100644
index 0000000..a3773f1
--- /dev/null
+++ b/src/security/core/tests/common/config_env.h.in
@@ -0,0 +1,27 @@
+/*
+ * Copyright(c) 2006 to 2020 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+#ifndef CONFIG_ENV_H
+#define CONFIG_ENV_H
+
+#define FILE_PATH_SEP             "@file_path_sep@"
+#define COMMON_ETC_DIR            "@common_etc_dir@"
+#define PLUGIN_WRAPPER_LIB_DIR    "@plugin_wrapper_lib_dir@"
+#define PLUGIN_WRAPPER_LIB_PREFIX "@CMAKE_SHARED_LIBRARY_PREFIX@"
+#define PLUGIN_WRAPPER_LIB_SUFFIX "@CMAKE_SHARED_LIBRARY_SUFFIX@"
+
+#define WRAPPERLIB_PATH(name) \
+  PLUGIN_WRAPPER_LIB_DIR FILE_PATH_SEP PLUGIN_WRAPPER_LIB_PREFIX name PLUGIN_WRAPPER_LIB_SUFFIX
+
+#define COMMON_ETC_PATH(name) \
+  COMMON_ETC_DIR FILE_PATH_SEP name
+
+#endif /* CONFIG_ENV_H */
diff --git a/src/security/core/tests/common/cryptography_wrapper.c b/src/security/core/tests/common/cryptography_wrapper.c
new file mode 100644
index 0000000..ad9346b
--- /dev/null
+++ b/src/security/core/tests/common/cryptography_wrapper.c
@@ -0,0 +1,728 @@
+/*
+ * Copyright(c) 2006 to 2020 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+#include <string.h>
+#include <stdio.h>
+#include "dds/dds.h"
+#include "dds/ddsrt/heap.h"
+#include "dds/ddsrt/sync.h"
+#include "dds/ddsrt/string.h"
+#include "dds/ddsi/ddsi_domaingv.h"
+#include "dds/security/dds_security_api.h"
+#include "dds/security/dds_security_api_defs.h"
+#include "dds/security/core/dds_security_utils.h"
+#include "cryptography_wrapper.h"
+
+int32_t init_crypto(const char *argument, void **context);
+int32_t finalize_crypto(void *context);
+
+enum crypto_plugin_mode {
+  PLUGIN_MODE_ALL_OK,
+  PLUGIN_MODE_MISSING_FUNC,
+  PLUGIN_MODE_WRAPPED
+};
+
+struct dds_security_crypto_key_exchange_impl {
+  struct dds_security_crypto_key_exchange base;
+  struct dds_security_crypto_key_exchange *instance;
+  struct dds_security_cryptography_impl *parent;
+};
+
+struct dds_security_crypto_key_factory_impl {
+  struct dds_security_crypto_key_factory base;
+  struct dds_security_crypto_key_factory *instance;
+  struct dds_security_cryptography_impl *parent;
+};
+
+struct dds_security_crypto_transform_impl {
+  struct dds_security_crypto_transform base;
+  struct dds_security_crypto_transform *instance;
+  struct dds_security_cryptography_impl *parent;
+};
+
+struct dds_security_cryptography_impl {
+  struct dds_security_cryptography base;
+  struct dds_security_cryptography *instance;
+  struct dds_security_crypto_transform_impl transform_wrap;
+  struct dds_security_crypto_key_factory_impl factory_wrap;
+  struct dds_security_crypto_key_exchange_impl exchange_wrap;
+  enum crypto_plugin_mode mode;
+  DDS_Security_ProtectionKind rtps_protection_kind;
+  DDS_Security_ProtectionKind metadata_protection_kind;
+  DDS_Security_BasicProtectionKind payload_protection_kind;
+};
+
+static DDS_Security_ParticipantCryptoHandle g_local_participant_handle = 0;
+
+void set_protection_kinds(
+  struct dds_security_cryptography_impl * impl,
+  DDS_Security_ProtectionKind rtps_protection_kind,
+  DDS_Security_ProtectionKind metadata_protection_kind,
+  DDS_Security_BasicProtectionKind payload_protection_kind)
+{
+  assert(impl);
+  impl->rtps_protection_kind = rtps_protection_kind;
+  impl->metadata_protection_kind = metadata_protection_kind;
+  impl->payload_protection_kind = payload_protection_kind;
+}
+
+static unsigned char * find_buffer_match(unsigned char *input, size_t input_len, unsigned char *match, size_t match_len)
+{
+  if (match_len <= input_len && match_len > 0 && input_len > 0)
+  {
+    unsigned char *match_end = match + match_len;
+    unsigned char *i = input;
+    while (i <= input + input_len - match_len)
+    {
+      unsigned char *m = match, *j = i;
+      while (*m == *j && j < input + input_len)
+      {
+        j++;
+        if (++m == match_end)
+          return i;
+      }
+      i++;
+    }
+  }
+  return NULL;
+}
+
+static bool check_buffers(const DDS_Security_OctetSeq *encoded_buffer, const DDS_Security_OctetSeq *plain_buffer, bool expect_encrypted, DDS_Security_SecurityException *ex)
+{
+  unsigned char *m = find_buffer_match (encoded_buffer->_buffer, encoded_buffer->_length,
+    plain_buffer->_buffer, plain_buffer->_length);
+  if ((m == NULL) != expect_encrypted)
+  {
+    ex->code = 1;
+    ex->message = ddsrt_strdup (expect_encrypted ?
+      "Expect encryption, but clear payload found after encoding." : "Expect only signature, but clear payload was not found in source after decoding.");
+    return false;
+  }
+  return true;
+}
+
+static DDS_Security_long_long check_handle(DDS_Security_long_long handle)
+{
+  /* Assume that handle, which actually is a pointer, has a value that is likely to be
+     a valid memory address and not a value returned by the mock implementation. */
+  assert (handle == 0 || handle > 4096);
+  return handle;
+}
+
+static bool expect_encrypted_buffer (DDS_Security_ProtectionKind pk)
+{
+  return pk == DDS_SECURITY_PROTECTION_KIND_ENCRYPT || pk == DDS_SECURITY_PROTECTION_KIND_ENCRYPT_WITH_ORIGIN_AUTHENTICATION;
+}
+
+/**
+ * Crypto key exchange
+ */
+static DDS_Security_boolean create_local_participant_crypto_tokens(
+    dds_security_crypto_key_exchange *instance,
+    DDS_Security_ParticipantCryptoTokenSeq *local_participant_crypto_tokens,
+    const DDS_Security_ParticipantCryptoHandle local_participant_crypto,
+    const DDS_Security_ParticipantCryptoHandle remote_participant_crypto,
+    DDS_Security_SecurityException *ex)
+{
+  struct dds_security_crypto_key_exchange_impl *impl = (struct dds_security_crypto_key_exchange_impl *)instance;
+  switch (impl->parent->mode)
+  {
+    case PLUGIN_MODE_WRAPPED:
+      return impl->instance->create_local_participant_crypto_tokens (impl->instance, local_participant_crypto_tokens,
+        local_participant_crypto, remote_participant_crypto, ex);
+    default:
+      return true;
+  }
+}
+
+static DDS_Security_boolean set_remote_participant_crypto_tokens(
+    dds_security_crypto_key_exchange *instance,
+    const DDS_Security_ParticipantCryptoHandle local_participant_crypto,
+    const DDS_Security_ParticipantCryptoHandle remote_participant_crypto,
+    const DDS_Security_ParticipantCryptoTokenSeq *remote_participant_tokens,
+    DDS_Security_SecurityException *ex)
+{
+  struct dds_security_crypto_key_exchange_impl *impl = (struct dds_security_crypto_key_exchange_impl *)instance;
+  switch (impl->parent->mode)
+  {
+    case PLUGIN_MODE_WRAPPED:
+      return impl->instance->set_remote_participant_crypto_tokens (impl->instance, check_handle (local_participant_crypto),
+        check_handle (remote_participant_crypto), remote_participant_tokens, ex);
+    default:
+      return true;
+  }
+}
+
+static DDS_Security_boolean create_local_datawriter_crypto_tokens(
+    dds_security_crypto_key_exchange *instance,
+    DDS_Security_DatawriterCryptoTokenSeq *local_datawriter_crypto_tokens,
+    const DDS_Security_DatawriterCryptoHandle local_datawriter_crypto,
+    const DDS_Security_DatareaderCryptoHandle remote_datareader_crypto,
+    DDS_Security_SecurityException *ex)
+{
+  struct dds_security_crypto_key_exchange_impl *impl = (struct dds_security_crypto_key_exchange_impl *)instance;
+  switch (impl->parent->mode)
+  {
+    case PLUGIN_MODE_WRAPPED:
+      return impl->instance->create_local_datawriter_crypto_tokens (impl->instance, local_datawriter_crypto_tokens,
+        check_handle (local_datawriter_crypto), check_handle (remote_datareader_crypto), ex);
+    default:
+      return true;
+  }
+}
+
+static DDS_Security_boolean set_remote_datawriter_crypto_tokens(
+    dds_security_crypto_key_exchange *instance,
+    const DDS_Security_DatareaderCryptoHandle local_datareader_crypto,
+    const DDS_Security_DatawriterCryptoHandle remote_datawriter_crypto,
+    const DDS_Security_DatawriterCryptoTokenSeq *remote_datawriter_tokens,
+    DDS_Security_SecurityException *ex)
+{
+  struct dds_security_crypto_key_exchange_impl *impl = (struct dds_security_crypto_key_exchange_impl *)instance;
+  switch (impl->parent->mode)
+  {
+    case PLUGIN_MODE_WRAPPED:
+      return impl->instance->set_remote_datawriter_crypto_tokens (impl->instance, check_handle (local_datareader_crypto),
+        check_handle (remote_datawriter_crypto), remote_datawriter_tokens, ex);
+    default:
+      return true;
+  }
+}
+
+static DDS_Security_boolean create_local_datareader_crypto_tokens(
+    dds_security_crypto_key_exchange *instance,
+    DDS_Security_DatareaderCryptoTokenSeq *local_datareader_cryto_tokens,
+    const DDS_Security_DatareaderCryptoHandle local_datareader_crypto,
+    const DDS_Security_DatawriterCryptoHandle remote_datawriter_crypto,
+    DDS_Security_SecurityException *ex)
+{
+  struct dds_security_crypto_key_exchange_impl *impl = (struct dds_security_crypto_key_exchange_impl *)instance;
+  switch (impl->parent->mode)
+  {
+    case PLUGIN_MODE_WRAPPED:
+      return impl->instance->create_local_datareader_crypto_tokens (impl->instance, local_datareader_cryto_tokens,
+        check_handle (local_datareader_crypto), check_handle (remote_datawriter_crypto), ex);
+    default:
+      return true;
+  }
+}
+
+static DDS_Security_boolean set_remote_datareader_crypto_tokens(
+    dds_security_crypto_key_exchange *instance,
+    const DDS_Security_DatawriterCryptoHandle local_datawriter_crypto,
+    const DDS_Security_DatareaderCryptoHandle remote_datareader_crypto,
+    const DDS_Security_DatareaderCryptoTokenSeq *remote_datareader_tokens,
+    DDS_Security_SecurityException *ex)
+{
+  struct dds_security_crypto_key_exchange_impl *impl = (struct dds_security_crypto_key_exchange_impl *)instance;
+  switch (impl->parent->mode)
+  {
+    case PLUGIN_MODE_WRAPPED:
+      return impl->instance->set_remote_datareader_crypto_tokens (impl->instance, check_handle (local_datawriter_crypto),
+        check_handle (remote_datareader_crypto), remote_datareader_tokens, ex);
+    default:
+      return true;
+  }
+}
+
+static DDS_Security_boolean return_crypto_tokens(
+    dds_security_crypto_key_exchange *instance,
+    DDS_Security_CryptoTokenSeq *crypto_tokens,
+    DDS_Security_SecurityException *ex)
+{
+  struct dds_security_crypto_key_exchange_impl *impl = (struct dds_security_crypto_key_exchange_impl *)instance;
+  switch (impl->parent->mode)
+  {
+    case PLUGIN_MODE_WRAPPED:
+      return impl->instance->return_crypto_tokens (impl->instance, crypto_tokens, ex);
+    default:
+      return true;
+  }
+}
+
+/**
+ * Crypto key factory
+ */
+static DDS_Security_ParticipantCryptoHandle register_local_participant(
+    dds_security_crypto_key_factory *instance,
+    const DDS_Security_IdentityHandle participant_identity,
+    const DDS_Security_PermissionsHandle participant_permissions,
+    const DDS_Security_PropertySeq *participant_properties,
+    const DDS_Security_ParticipantSecurityAttributes *participant_security_attributes,
+    DDS_Security_SecurityException *ex)
+{
+  struct dds_security_crypto_key_factory_impl *impl = (struct dds_security_crypto_key_factory_impl *)instance;
+  switch (impl->parent->mode)
+  {
+    case PLUGIN_MODE_WRAPPED:
+      return check_handle (impl->instance->register_local_participant (impl->instance, check_handle (participant_identity),
+        check_handle (participant_permissions), participant_properties, participant_security_attributes, ex));
+    default:
+      return ++g_local_participant_handle;
+  }
+}
+
+static DDS_Security_ParticipantCryptoHandle register_matched_remote_participant(
+    dds_security_crypto_key_factory *instance,
+    const DDS_Security_ParticipantCryptoHandle local_participant_crypto_handle,
+    const DDS_Security_IdentityHandle remote_participant_identity,
+    const DDS_Security_PermissionsHandle remote_participant_permissions,
+    const DDS_Security_SharedSecretHandle shared_secret,
+    DDS_Security_SecurityException *ex)
+{
+  struct dds_security_crypto_key_factory_impl *impl = (struct dds_security_crypto_key_factory_impl *)instance;
+  switch (impl->parent->mode)
+  {
+    case PLUGIN_MODE_WRAPPED:
+      return check_handle (impl->instance->register_matched_remote_participant (impl->instance, local_participant_crypto_handle,
+        remote_participant_identity, remote_participant_permissions, shared_secret, ex));
+    default:
+      return 0;
+  }
+}
+
+static DDS_Security_DatawriterCryptoHandle register_local_datawriter(
+    dds_security_crypto_key_factory *instance,
+    const DDS_Security_ParticipantCryptoHandle participant_crypto,
+    const DDS_Security_PropertySeq *datawriter_properties,
+    const DDS_Security_EndpointSecurityAttributes *datawriter_security_attributes,
+    DDS_Security_SecurityException *ex)
+{
+  struct dds_security_crypto_key_factory_impl *impl = (struct dds_security_crypto_key_factory_impl *)instance;
+  switch (impl->parent->mode)
+  {
+    case PLUGIN_MODE_WRAPPED:
+      return check_handle (impl->instance->register_local_datawriter (impl->instance, check_handle (participant_crypto),
+        datawriter_properties, datawriter_security_attributes, ex));
+    default:
+      return 0;
+  }
+}
+
+static DDS_Security_DatareaderCryptoHandle register_matched_remote_datareader(
+    dds_security_crypto_key_factory *instance,
+    const DDS_Security_DatawriterCryptoHandle local_datawriter_crypto_handle,
+    const DDS_Security_ParticipantCryptoHandle remote_participant_crypto,
+    const DDS_Security_SharedSecretHandle shared_secret,
+    const DDS_Security_boolean relay_only,
+    DDS_Security_SecurityException *ex)
+{
+  struct dds_security_crypto_key_factory_impl *impl = (struct dds_security_crypto_key_factory_impl *)instance;
+  switch (impl->parent->mode)
+  {
+    case PLUGIN_MODE_WRAPPED:
+      return check_handle (impl->instance->register_matched_remote_datareader (impl->instance, check_handle (local_datawriter_crypto_handle),
+        check_handle (remote_participant_crypto), check_handle (shared_secret), relay_only, ex));
+    default:
+      return 0;
+  }
+}
+
+static DDS_Security_DatareaderCryptoHandle register_local_datareader(
+    dds_security_crypto_key_factory *instance,
+    const DDS_Security_ParticipantCryptoHandle participant_crypto,
+    const DDS_Security_PropertySeq *datareader_properties,
+    const DDS_Security_EndpointSecurityAttributes *datareader_security_attributes,
+    DDS_Security_SecurityException *ex)
+{
+  struct dds_security_crypto_key_factory_impl *impl = (struct dds_security_crypto_key_factory_impl *)instance;
+  switch (impl->parent->mode)
+  {
+    case PLUGIN_MODE_WRAPPED:
+      return check_handle (impl->instance->register_local_datareader (impl->instance, check_handle (participant_crypto),
+        datareader_properties, datareader_security_attributes, ex));
+    default:
+      return 0;
+  }
+}
+
+static DDS_Security_DatawriterCryptoHandle register_matched_remote_datawriter(
+    dds_security_crypto_key_factory *instance,
+    const DDS_Security_DatareaderCryptoHandle local_datareader_crypto_handle,
+    const DDS_Security_ParticipantCryptoHandle remote_participant_crypt,
+    const DDS_Security_SharedSecretHandle shared_secret,
+    DDS_Security_SecurityException *ex)
+{
+  struct dds_security_crypto_key_factory_impl *impl = (struct dds_security_crypto_key_factory_impl *)instance;
+  switch (impl->parent->mode)
+  {
+    case PLUGIN_MODE_WRAPPED:
+      return check_handle (impl->instance->register_matched_remote_datawriter (impl->instance, check_handle (local_datareader_crypto_handle),
+        check_handle (remote_participant_crypt), shared_secret, ex));
+    default:
+      return 1;
+  }
+}
+
+static DDS_Security_boolean unregister_participant(
+    dds_security_crypto_key_factory *instance,
+    const DDS_Security_ParticipantCryptoHandle participant_crypto_handle,
+    DDS_Security_SecurityException *ex)
+{
+  struct dds_security_crypto_key_factory_impl *impl = (struct dds_security_crypto_key_factory_impl *)instance;
+  switch (impl->parent->mode)
+  {
+    case PLUGIN_MODE_WRAPPED:
+      return impl->instance->unregister_participant (impl->instance, check_handle (participant_crypto_handle), ex);
+    default:
+      return true;
+  }
+}
+
+static DDS_Security_boolean unregister_datawriter(
+    dds_security_crypto_key_factory *instance,
+    const DDS_Security_DatawriterCryptoHandle datawriter_crypto_handle,
+    DDS_Security_SecurityException *ex)
+{
+  struct dds_security_crypto_key_factory_impl *impl = (struct dds_security_crypto_key_factory_impl *)instance;
+  switch (impl->parent->mode)
+  {
+    case PLUGIN_MODE_WRAPPED:
+      return impl->instance->unregister_datawriter (impl->instance, check_handle (datawriter_crypto_handle), ex);
+    default:
+      return true;
+  }
+}
+
+static DDS_Security_boolean unregister_datareader(
+    dds_security_crypto_key_factory *instance,
+    const DDS_Security_DatareaderCryptoHandle datareader_crypto_handle,
+    DDS_Security_SecurityException *ex)
+{
+  struct dds_security_crypto_key_factory_impl *impl = (struct dds_security_crypto_key_factory_impl *)instance;
+  switch (impl->parent->mode)
+  {
+    case PLUGIN_MODE_WRAPPED:
+      return impl->instance->unregister_datareader (impl->instance, check_handle (datareader_crypto_handle), ex);
+    default:
+      return true;
+  }
+}
+
+/**
+ * Crypto transform
+ */
+static DDS_Security_boolean encode_serialized_payload(
+    dds_security_crypto_transform *instance,
+    DDS_Security_OctetSeq *encoded_buffer,
+    DDS_Security_OctetSeq *extra_inline_qos,
+    const DDS_Security_OctetSeq *plain_buffer,
+    const DDS_Security_DatawriterCryptoHandle sending_datawriter_crypto,
+    DDS_Security_SecurityException *ex)
+{
+  struct dds_security_crypto_transform_impl *impl = (struct dds_security_crypto_transform_impl *)instance;
+  switch (impl->parent->mode)
+  {
+    case PLUGIN_MODE_WRAPPED:
+      if (!impl->instance->encode_serialized_payload (impl->instance, encoded_buffer,
+          extra_inline_qos, plain_buffer, check_handle (sending_datawriter_crypto), ex))
+        return false;
+      return check_buffers (encoded_buffer, plain_buffer, impl->parent->payload_protection_kind == DDS_SECURITY_BASICPROTECTION_KIND_ENCRYPT, ex);
+    default:
+      return true;
+  }
+}
+
+static DDS_Security_boolean encode_datawriter_submessage(
+    dds_security_crypto_transform *instance,
+    DDS_Security_OctetSeq *encoded_rtps_submessage,
+    const DDS_Security_OctetSeq *plain_rtps_submessage,
+    const DDS_Security_DatawriterCryptoHandle sending_datawriter_crypto,
+    const DDS_Security_DatareaderCryptoHandleSeq *receiving_datareader_crypto_list,
+    int32_t *receiving_datareader_crypto_list_index,
+    DDS_Security_SecurityException *ex)
+{
+  struct dds_security_crypto_transform_impl *impl = (struct dds_security_crypto_transform_impl *)instance;
+  switch (impl->parent->mode)
+  {
+    case PLUGIN_MODE_WRAPPED:
+      if (!impl->instance->encode_datawriter_submessage (impl->instance, encoded_rtps_submessage,
+        plain_rtps_submessage, check_handle (sending_datawriter_crypto), receiving_datareader_crypto_list, receiving_datareader_crypto_list_index, ex))
+        return false;
+      return expect_encrypted_buffer (impl->parent->metadata_protection_kind) ?
+        check_buffers (encoded_rtps_submessage, plain_rtps_submessage, true, ex) : true;
+    default:
+      return true;
+  }
+}
+
+static DDS_Security_boolean encode_datareader_submessage(
+    dds_security_crypto_transform *instance,
+    DDS_Security_OctetSeq *encoded_rtps_submessage,
+    const DDS_Security_OctetSeq *plain_rtps_submessage,
+    const DDS_Security_DatareaderCryptoHandle sending_datareader_crypto,
+    const DDS_Security_DatawriterCryptoHandleSeq *receiving_datawriter_crypto_list,
+    DDS_Security_SecurityException *ex)
+{
+  struct dds_security_crypto_transform_impl *impl = (struct dds_security_crypto_transform_impl *)instance;
+  switch (impl->parent->mode)
+  {
+    case PLUGIN_MODE_WRAPPED:
+      if (!impl->instance->encode_datareader_submessage (impl->instance, encoded_rtps_submessage,
+        plain_rtps_submessage, check_handle (sending_datareader_crypto), receiving_datawriter_crypto_list, ex))
+        return false;
+      return expect_encrypted_buffer (impl->parent->metadata_protection_kind) ?
+        check_buffers (encoded_rtps_submessage, plain_rtps_submessage, true, ex) : true;
+    default:
+      return true;
+  }
+}
+
+static DDS_Security_boolean encode_rtps_message(
+    dds_security_crypto_transform *instance,
+    DDS_Security_OctetSeq *encoded_rtps_message,
+    const DDS_Security_OctetSeq *plain_rtps_message,
+    const DDS_Security_ParticipantCryptoHandle sending_participant_crypto,
+    const DDS_Security_ParticipantCryptoHandleSeq *receiving_participant_crypto_list,
+    int32_t *receiving_participant_crypto_list_index,
+    DDS_Security_SecurityException *ex)
+{
+  struct dds_security_crypto_transform_impl *impl = (struct dds_security_crypto_transform_impl *)instance;
+  switch (impl->parent->mode)
+  {
+    case PLUGIN_MODE_WRAPPED:
+      if (!impl->instance->encode_rtps_message (impl->instance, encoded_rtps_message,
+          plain_rtps_message, check_handle (sending_participant_crypto), receiving_participant_crypto_list, receiving_participant_crypto_list_index, ex))
+        return false;
+      return expect_encrypted_buffer (impl->parent->rtps_protection_kind) ?
+        check_buffers (encoded_rtps_message, plain_rtps_message, true, ex) : true;
+    default:
+      return true;
+  }
+}
+
+static DDS_Security_boolean decode_rtps_message(
+    dds_security_crypto_transform *instance,
+    DDS_Security_OctetSeq *plain_buffer,
+    const DDS_Security_OctetSeq *encoded_buffer,
+    const DDS_Security_ParticipantCryptoHandle receiving_participant_crypto,
+    const DDS_Security_ParticipantCryptoHandle sending_participant_crypto,
+    DDS_Security_SecurityException *ex)
+{
+  struct dds_security_crypto_transform_impl *impl = (struct dds_security_crypto_transform_impl *)instance;
+  switch (impl->parent->mode)
+  {
+    case PLUGIN_MODE_WRAPPED:
+      if (!impl->instance->decode_rtps_message (impl->instance, plain_buffer, encoded_buffer,
+          check_handle (receiving_participant_crypto), check_handle (sending_participant_crypto), ex))
+        return false;
+      return expect_encrypted_buffer (impl->parent->rtps_protection_kind) ?
+        check_buffers (encoded_buffer, plain_buffer, true, ex) : true;
+    default:
+      return true;
+  }
+}
+
+static DDS_Security_boolean preprocess_secure_submsg(
+    dds_security_crypto_transform *instance,
+    DDS_Security_DatawriterCryptoHandle *datawriter_crypto,
+    DDS_Security_DatareaderCryptoHandle *datareader_crypto,
+    DDS_Security_SecureSubmessageCategory_t *secure_submessage_category,
+    const DDS_Security_OctetSeq *encoded_rtps_submessage,
+    const DDS_Security_ParticipantCryptoHandle receiving_participant_crypto,
+    const DDS_Security_ParticipantCryptoHandle sending_participant_crypto,
+    DDS_Security_SecurityException *ex)
+{
+  struct dds_security_crypto_transform_impl *impl = (struct dds_security_crypto_transform_impl *)instance;
+  switch (impl->parent->mode)
+  {
+    case PLUGIN_MODE_WRAPPED:
+      return impl->instance->preprocess_secure_submsg (impl->instance, datawriter_crypto, datareader_crypto,
+        secure_submessage_category, encoded_rtps_submessage, check_handle (receiving_participant_crypto), check_handle (sending_participant_crypto), ex);
+    default:
+      return true;
+  }
+}
+
+static DDS_Security_boolean decode_datawriter_submessage(
+    dds_security_crypto_transform *instance,
+    DDS_Security_OctetSeq *plain_rtps_submessage,
+    const DDS_Security_OctetSeq *encoded_rtps_submessage,
+    const DDS_Security_DatareaderCryptoHandle receiving_datareader_crypto,
+    const DDS_Security_DatawriterCryptoHandle sending_datawriter_crypto,
+    DDS_Security_SecurityException *ex)
+{
+  struct dds_security_crypto_transform_impl *impl = (struct dds_security_crypto_transform_impl *)instance;
+  switch (impl->parent->mode)
+  {
+    case PLUGIN_MODE_WRAPPED:
+      if (!impl->instance->decode_datawriter_submessage (impl->instance, plain_rtps_submessage,
+          encoded_rtps_submessage, check_handle (receiving_datareader_crypto), check_handle (sending_datawriter_crypto), ex))
+        return false;
+      return expect_encrypted_buffer (impl->parent->metadata_protection_kind) ?
+        check_buffers (encoded_rtps_submessage, plain_rtps_submessage, true, ex) : true;
+    default:
+      return true;
+  }
+}
+
+static DDS_Security_boolean decode_datareader_submessage(
+    dds_security_crypto_transform *instance,
+    DDS_Security_OctetSeq *plain_rtps_submessage,
+    const DDS_Security_OctetSeq *encoded_rtps_submessage,
+    const DDS_Security_DatawriterCryptoHandle receiving_datawriter_crypto,
+    const DDS_Security_DatareaderCryptoHandle sending_datareader_crypto,
+    DDS_Security_SecurityException *ex)
+{
+  struct dds_security_crypto_transform_impl *impl = (struct dds_security_crypto_transform_impl *)instance;
+  switch (impl->parent->mode)
+  {
+    case PLUGIN_MODE_WRAPPED:
+      if (!impl->instance->decode_datareader_submessage (impl->instance, plain_rtps_submessage,
+          encoded_rtps_submessage, check_handle (receiving_datawriter_crypto), check_handle (sending_datareader_crypto), ex))
+        return false;
+      return expect_encrypted_buffer (impl->parent->metadata_protection_kind) ?
+        check_buffers (encoded_rtps_submessage, plain_rtps_submessage, true, ex) : true;
+    default:
+      return true;
+  }
+}
+
+static DDS_Security_boolean decode_serialized_payload(
+    dds_security_crypto_transform *instance,
+    DDS_Security_OctetSeq *plain_buffer,
+    const DDS_Security_OctetSeq *encoded_buffer,
+    const DDS_Security_OctetSeq *inline_qos,
+    const DDS_Security_DatareaderCryptoHandle receiving_datareader_crypto,
+    const DDS_Security_DatawriterCryptoHandle sending_datawriter_crypto,
+    DDS_Security_SecurityException *ex)
+{
+  struct dds_security_crypto_transform_impl *impl = (struct dds_security_crypto_transform_impl *)instance;
+  switch (impl->parent->mode)
+  {
+    case PLUGIN_MODE_WRAPPED:
+      if (!impl->instance->decode_serialized_payload(impl->instance, plain_buffer, encoded_buffer,
+          inline_qos, check_handle (receiving_datareader_crypto), check_handle (sending_datawriter_crypto), ex))
+        return false;
+      return check_buffers(encoded_buffer, plain_buffer, impl->parent->payload_protection_kind == DDS_SECURITY_BASICPROTECTION_KIND_ENCRYPT, ex);
+    default:
+      return true;
+  }
+}
+
+/**
+ * Init and finalize functions
+ */
+static struct dds_security_cryptography_impl * init_test_cryptography_common(const char *argument, bool wrapped)
+{
+  struct dds_security_cryptography_impl *impl = (struct dds_security_cryptography_impl*) ddsrt_malloc(sizeof(*impl));
+  memset(impl, 0, sizeof(*impl));
+
+  if (wrapped)
+  {
+    if (init_crypto(argument, (void **)&impl->instance) != DDS_SECURITY_SUCCESS)
+      return NULL;
+
+    impl->transform_wrap.instance = impl->instance->crypto_transform;
+    impl->factory_wrap.instance = impl->instance->crypto_key_factory;
+    impl->exchange_wrap.instance = impl->instance->crypto_key_exchange;
+  }
+
+  impl->base.crypto_transform = (dds_security_crypto_transform *)&impl->transform_wrap;
+  impl->base.crypto_key_factory = (dds_security_crypto_key_factory *)&impl->factory_wrap;
+  impl->base.crypto_key_exchange = (dds_security_crypto_key_exchange *)&impl->exchange_wrap;
+
+  impl->transform_wrap.parent = impl;
+  impl->factory_wrap.parent = impl;
+  impl->exchange_wrap.parent = impl;
+
+  impl->factory_wrap.base.register_local_participant = &register_local_participant;
+  impl->factory_wrap.base.register_matched_remote_participant = &register_matched_remote_participant;
+  impl->factory_wrap.base.register_local_datawriter = &register_local_datawriter;
+  impl->factory_wrap.base.register_matched_remote_datareader = &register_matched_remote_datareader;
+  impl->factory_wrap.base.register_local_datareader = &register_local_datareader;
+  impl->factory_wrap.base.register_matched_remote_datawriter = &register_matched_remote_datawriter;
+  impl->factory_wrap.base.unregister_participant = &unregister_participant;
+  impl->factory_wrap.base.unregister_datawriter = &unregister_datawriter;
+  impl->factory_wrap.base.unregister_datareader = &unregister_datareader;
+
+  impl->exchange_wrap.base.create_local_participant_crypto_tokens = &create_local_participant_crypto_tokens;
+  impl->exchange_wrap.base.set_remote_participant_crypto_tokens = &set_remote_participant_crypto_tokens;
+  impl->exchange_wrap.base.create_local_datawriter_crypto_tokens = &create_local_datawriter_crypto_tokens;
+  impl->exchange_wrap.base.set_remote_datawriter_crypto_tokens = &set_remote_datawriter_crypto_tokens;
+  impl->exchange_wrap.base.create_local_datareader_crypto_tokens = &create_local_datareader_crypto_tokens;
+  impl->exchange_wrap.base.set_remote_datareader_crypto_tokens = &set_remote_datareader_crypto_tokens;
+  impl->exchange_wrap.base.return_crypto_tokens = &return_crypto_tokens;
+
+  impl->transform_wrap.base.encode_datawriter_submessage = &encode_datawriter_submessage;
+  impl->transform_wrap.base.encode_datareader_submessage = &encode_datareader_submessage;
+  impl->transform_wrap.base.encode_rtps_message = &encode_rtps_message;
+  impl->transform_wrap.base.decode_rtps_message = &decode_rtps_message;
+  impl->transform_wrap.base.preprocess_secure_submsg = &preprocess_secure_submsg;
+  impl->transform_wrap.base.decode_datawriter_submessage = &decode_datawriter_submessage;
+  impl->transform_wrap.base.decode_datareader_submessage = &decode_datareader_submessage;
+  impl->transform_wrap.base.decode_serialized_payload = &decode_serialized_payload;
+  impl->transform_wrap.base.encode_serialized_payload = &encode_serialized_payload;
+
+  return impl;
+}
+
+static int32_t finalize_test_cryptography_common(struct dds_security_cryptography_impl * impl, bool wrapped)
+{
+  int32_t ret;
+  if (wrapped && (ret = finalize_crypto(impl->instance)) != DDS_SECURITY_SUCCESS)
+    return ret;
+  ddsrt_free(impl);
+  return DDS_SECURITY_SUCCESS;
+}
+
+int32_t init_test_cryptography_all_ok(const char *argument, void **context)
+{
+  struct dds_security_cryptography_impl *impl = init_test_cryptography_common(argument, false);
+  if (!impl)
+    return DDS_SECURITY_FAILED;
+  impl->mode = PLUGIN_MODE_ALL_OK;
+  *context = impl;
+  return DDS_SECURITY_SUCCESS;
+}
+
+int32_t finalize_test_cryptography_all_ok(void *context)
+{
+  struct dds_security_cryptography_impl* impl = (struct dds_security_cryptography_impl*) context;
+  assert(impl->mode == PLUGIN_MODE_ALL_OK);
+  return finalize_test_cryptography_common(impl, false);
+}
+
+int32_t init_test_cryptography_missing_func(const char *argument, void **context)
+{
+  struct dds_security_cryptography_impl *impl = init_test_cryptography_common(argument, false);
+  if (!impl)
+    return DDS_SECURITY_FAILED;
+  impl->base.crypto_key_exchange->set_remote_participant_crypto_tokens = NULL;
+  impl->mode = PLUGIN_MODE_MISSING_FUNC;
+  *context = impl;
+  return DDS_SECURITY_SUCCESS;
+}
+
+int32_t finalize_test_cryptography_missing_func(void *context)
+{
+  struct dds_security_cryptography_impl* impl = (struct dds_security_cryptography_impl*) context;
+  assert(impl->mode == PLUGIN_MODE_MISSING_FUNC);
+  return finalize_test_cryptography_common(impl, false);
+}
+
+int32_t init_test_cryptography_wrapped(const char *argument, void **context)
+{
+  struct dds_security_cryptography_impl *impl = init_test_cryptography_common(argument, true);
+  if (!impl)
+    return DDS_SECURITY_FAILED;
+  impl->mode = PLUGIN_MODE_WRAPPED;
+  *context = impl;
+  return DDS_SECURITY_SUCCESS;
+}
+
+int32_t finalize_test_cryptography_wrapped(void *context)
+{
+  struct dds_security_cryptography_impl* impl = (struct dds_security_cryptography_impl*) context;
+  assert(impl->mode == PLUGIN_MODE_WRAPPED);
+  return finalize_test_cryptography_common(impl, true);
+}
+
diff --git a/src/security/core/tests/common/cryptography_wrapper.h b/src/security/core/tests/common/cryptography_wrapper.h
new file mode 100644
index 0000000..9fd17d1
--- /dev/null
+++ b/src/security/core/tests/common/cryptography_wrapper.h
@@ -0,0 +1,39 @@
+/*
+ * Copyright(c) 2006 to 2020 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+#ifndef SECURITY_CORE_TEST_CRYPTO_WRAPPER_H_
+#define SECURITY_CORE_TEST_CRYPTO_WRAPPER_H_
+
+#include "dds/security/dds_security_api.h"
+#include "dds/security/dds_security_api_defs.h"
+#include "dds/security/cryptography_wrapper_export.h"
+
+struct dds_security_cryptography_impl;
+
+SECURITY_EXPORT void set_protection_kinds(
+  struct dds_security_cryptography_impl * impl,
+  DDS_Security_ProtectionKind rtps_protection_kind,
+  DDS_Security_ProtectionKind metadata_protection_kind,
+  DDS_Security_BasicProtectionKind payload_protection_kind);
+
+/* Init in all-ok mode: all functions return success without calling the actual plugin */
+SECURITY_EXPORT int32_t init_test_cryptography_all_ok(const char *argument, void **context);
+SECURITY_EXPORT int32_t finalize_test_cryptography_all_ok(void *context);
+
+/* Init in missing function mode: one of the function pointers is null */
+SECURITY_EXPORT int32_t init_test_cryptography_missing_func(const char *argument, void **context);
+SECURITY_EXPORT int32_t finalize_test_cryptography_missing_func(void *context);
+
+/* Init in wrapper mode */
+SECURITY_EXPORT int32_t init_test_cryptography_wrapped(const char *argument, void **context);
+SECURITY_EXPORT int32_t finalize_test_cryptography_wrapped(void *context);
+
+#endif /* SECURITY_CORE_TEST_CRYPTO_WRAPPER_H_ */
diff --git a/src/security/core/tests/common/etc/create_p7s b/src/security/core/tests/common/etc/create_p7s
new file mode 100755
index 0000000..904e7bd
--- /dev/null
+++ b/src/security/core/tests/common/etc/create_p7s
@@ -0,0 +1,36 @@
+#!/usr/bin/env bash
+
+# Argument
+if [ -z "$1" ]
+then
+    echo "This script can be used for signing Permissions and Governance file list. Can be called from any directory"
+    echo "Expected a filename list with or without the .xml extension"
+    echo "PERMISSION_CA_CERT and PERMISSION_CA_KEY environment variables are used for signing if they are set"
+    exit
+fi
+
+# Location of the pem files is the same as this script location.
+PEM_LOCATION="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null && pwd )"
+if [ -v PERMISSION_CA_CERT ] && [ -v PERMISSION_CA_KEY ] ; then
+    echo "Using custom permission key and certificate"
+    echo "PERMISSION_CA_CERT: $PERMISSION_CA_CERT"
+    echo "PERMISSION_CA_KEY: $PERMISSION_CA_KEY"
+else
+    PERMISSION_CA_CERT=${PEM_LOCATION}/default_permissions_ca.pem
+    PERMISSION_CA_KEY=${PEM_LOCATION}/default_permissions_ca_key.pem
+fi
+
+# Do all given files.
+for filename in "$@"
+do
+    if [ ${filename:${#filename}-4:4} == ".xml" ] ; then
+        BASE_FILE_NAME=${filename:0:-4}
+        echo $BASE_FILE_NAME
+    else
+        BASE_FILE_NAME=$filename
+    fi
+
+    # Create the p7s file(s)
+    openssl smime -sign -in "${BASE_FILE_NAME}.xml" -text -out "${BASE_FILE_NAME}.p7s" -signer "$PERMISSION_CA_CERT" -inkey "$PERMISSION_CA_KEY"
+done
+
diff --git a/src/security/core/tests/common/etc/default_governance.p7s b/src/security/core/tests/common/etc/default_governance.p7s
new file mode 100644
index 0000000..0fae1eb
--- /dev/null
+++ b/src/security/core/tests/common/etc/default_governance.p7s
@@ -0,0 +1,120 @@
+MIME-Version: 1.0
+Content-Type: multipart/signed; protocol="application/x-pkcs7-signature"; micalg="sha-256"; boundary="----53BB1E1533C543713994C321F5A9998F"
+
+This is an S/MIME signed message
+
+------53BB1E1533C543713994C321F5A9998F
+Content-Type: text/plain
+
+<?xml version="1.0" encoding="utf-8"?>
+<dds xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xsi:noNamespaceSchemaLocation="https://www.omg.org/spec/DDS-SECURITY/20170901/omg_shared_ca_governance.xsd">
+    <domain_access_rules>
+        <domain_rule>
+            <domains>
+                <!-- All domains -->
+                <id_range>
+                    <min>0</min>
+                    <max>230</max>
+                </id_range>
+            </domains>
+
+            <!-- DomainParticipant that cann not authenticate or fail the authentication should be
+                 allowed to join the domain and see any any discovery data that are configured as "unprotected"
+                 and topics that are configured as "unprotected" -->
+            <allow_unauthenticated_participants>false</allow_unauthenticated_participants>
+
+            <!--  Only and any authenticated DomainParticipant should be allowed to join the domain and
+                  see the discovery data without checking access control  -->
+            <enable_join_access_control>true</enable_join_access_control>
+
+            <!-- Discovery information should be protected with encryption followed by MAC (Message Authentication Codes) -->
+            <discovery_protection_kind>ENCRYPT</discovery_protection_kind>
+
+            <!--  Liveliness messages are also encrypted -->
+            <liveliness_protection_kind>ENCRYPT</liveliness_protection_kind>
+
+            <!-- Whole RTPS message is protected -->
+            <rtps_protection_kind>ENCRYPT</rtps_protection_kind>
+
+            <topic_access_rules>
+                <topic_rule>
+                    <!-- All (non-builtin) topics -->
+                    <topic_expression>*</topic_expression>
+
+                    <!-- The discovery information on specific Topics should be sent
+                         using the secure (protected) discovery writers -->
+                    <enable_discovery_protection>true</enable_discovery_protection>
+
+                    <!-- Liveliness QoS data is protected -->
+                    <enable_liveliness_protection>true</enable_liveliness_protection>
+
+                    <!-- The read access to all topics should be open to all. -->
+                    <enable_read_access_control>true</enable_read_access_control>
+
+                    <!-- The write access to all topics should be open to all. -->
+                    <enable_write_access_control>true</enable_write_access_control>
+
+                    <!-- Whole RTPS sub-message is protected. This includes metadata information
+                         like sequence numbers, heartbeats, key hashes, gaps,
+                         acknowledgment messages, etc. It also includes th possible payload. -->
+                    <metadata_protection_kind>ENCRYPT</metadata_protection_kind>
+
+                    <!-- The payload data sent on the Topic (serialized application level data) should be
+                         protected with Encrypt then MAC. -->
+                    <data_protection_kind>ENCRYPT</data_protection_kind>
+                </topic_rule>
+            </topic_access_rules>
+        </domain_rule>
+    </domain_access_rules>
+</dds>
+
+------53BB1E1533C543713994C321F5A9998F
+Content-Type: application/x-pkcs7-signature; name="smime.p7s"
+Content-Transfer-Encoding: base64
+Content-Disposition: attachment; filename="smime.p7s"
+
+MIIHoQYJKoZIhvcNAQcCoIIHkjCCB44CAQExDzANBglghkgBZQMEAgEFADALBgkq
+hkiG9w0BBwGgggRzMIIEbzCCA1egAwIBAgIUfoby6818hlJQ+41KUHiM6BZll/0w
+DQYJKoZIhvcNAQELBQAwgcYxCzAJBgNVBAYTAk5MMQswCQYDVQQIDAJPVjEWMBQG
+A1UEBwwNTG9jYWxpdHkgTmFtZTETMBEGA1UECwwKRXhhbXBsZSBPVTEgMB4GA1UE
+CgwXRXhhbXBsZSBDQSBPcmdhbml6YXRpb24xHzAdBgNVBAMMFkV4YW1wbGUgUGVy
+bWlzc2lvbnMgQ0ExOjA4BgkqhkiG9w0BCQEWK2F1dGhvcml0eUBjeWNsb25lZGRz
+c2VjdXJpdHkuYWRsaW5rdGVjaC5jb20wHhcNMjAwMjI3MTM0ODA5WhcNMzAwMjI0
+MTM0ODA5WjCBxjELMAkGA1UEBhMCTkwxCzAJBgNVBAgMAk9WMRYwFAYDVQQHDA1M
+b2NhbGl0eSBOYW1lMRMwEQYDVQQLDApFeGFtcGxlIE9VMSAwHgYDVQQKDBdFeGFt
+cGxlIENBIE9yZ2FuaXphdGlvbjEfMB0GA1UEAwwWRXhhbXBsZSBQZXJtaXNzaW9u
+cyBDQTE6MDgGCSqGSIb3DQEJARYrYXV0aG9yaXR5QGN5Y2xvbmVkZHNzZWN1cml0
+eS5hZGxpbmt0ZWNoLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEB
+ANNWwyrW3J+TCyaZH77q+29GGqFsYP5rv9cpcL/TMDNccsPYY+1RA1K+zMRYo1LG
+8VdJNtJlhxE+tmEbKxsVUTtoj8zbLVU4P4g0gIh6U7LMv5lUEZ3XYKWvYrbZTFMo
+f2rXQYGXPO7pFnvbNAbnMiLmagRKxKJ91kq4utuMG3U6rkCA7i2S8cEISNO3gIpF
+a0IZJ8yS8wDlKa/LGxL90BYasLsSA6tw/69OIiUUYqpMRD+xxyyTkMO37VjmdiFL
+Ha/dxO8HH0t3Q0U0AgZP9uwYTgZpN+2UEFnjv3BDIydc3Wa0UaSdxLtHXMPvg3sR
+uH9CTqr4Le7/3uTYehYKgd0CAwEAAaNTMFEwHQYDVR0OBBYEFFi4pK986ZSB0BLi
+Mm8ivu6AUxYPMB8GA1UdIwQYMBaAFFi4pK986ZSB0BLiMm8ivu6AUxYPMA8GA1Ud
+EwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAHYLaJVWrLHg+62jC8yIz9db
+ECIroX9Gb7Ll937HMum6Hj4wlImrifMVV3iORWBrBLvtTtn0Zno3mwfjLRQtkjOi
+h71eJT+6//B7CT7noULJYVq8IRGErbKtmXULnxTajFApzO0v4hSu7rWj/Jfhil0T
+X7QgKNpgKzjYodWz3oGGtchxvw3+v9wdIWD5Cj0bk/VMCQCaBV0anvyga7d4k8/z
+PF7nW2Z9jNfKsVD1piFa+Yd4zN6XOPPKiFXfLD7ht9i2gG25iS+d95tKg1DfjnRD
+7u0BJSOAPerxGtN/wf43qY1XzUoE2FBJ9QJGOA/02ffaUMOwSzICF/ShctH+Knkx
+ggLyMIIC7gIBATCB3zCBxjELMAkGA1UEBhMCTkwxCzAJBgNVBAgMAk9WMRYwFAYD
+VQQHDA1Mb2NhbGl0eSBOYW1lMRMwEQYDVQQLDApFeGFtcGxlIE9VMSAwHgYDVQQK
+DBdFeGFtcGxlIENBIE9yZ2FuaXphdGlvbjEfMB0GA1UEAwwWRXhhbXBsZSBQZXJt
+aXNzaW9ucyBDQTE6MDgGCSqGSIb3DQEJARYrYXV0aG9yaXR5QGN5Y2xvbmVkZHNz
+ZWN1cml0eS5hZGxpbmt0ZWNoLmNvbQIUfoby6818hlJQ+41KUHiM6BZll/0wDQYJ
+YIZIAWUDBAIBBQCggeQwGAYJKoZIhvcNAQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG
+9w0BCQUxDxcNMjAwMjI3MTM0ODM0WjAvBgkqhkiG9w0BCQQxIgQgEOdJRhNPEiPV
+hgGuWuTP8V074cDixAzQ31XymGEq0asweQYJKoZIhvcNAQkPMWwwajALBglghkgB
+ZQMEASowCwYJYIZIAWUDBAEWMAsGCWCGSAFlAwQBAjAKBggqhkiG9w0DBzAOBggq
+hkiG9w0DAgICAIAwDQYIKoZIhvcNAwICAUAwBwYFKw4DAgcwDQYIKoZIhvcNAwIC
+ASgwDQYJKoZIhvcNAQEBBQAEggEAKGHnKKHlTdyGgbduE/dvtq4CteGtJJFE1z/Y
+aG5xKd8NeInFIvMtGEoxp+hum1uh0819XRyHbOA5FUSB8y1HXNqqnfe6YwscD6Ds
+Ux/nYtUrDuckZp+F1ulzsHe/lq7khtVaweck9YHt0iKUszn2fea774bR/ZjdZ0Fr
++6DBKLBR8XOlYK7m0HOjlOoN4O0qTCh100001884C0O75KXnOEGA6saf9epOwL0Z
+LitRo9Evh20IvYlOzzDS5ddQqtOPgMDhq1dO8Mra4KKmYc6vj2gsNzQag0l0LkQa
+lRQ/3YFTD0vAt09DzqUehNOZbr9pOYZYbP/z/Ov7zrb0+kPGzQ==
+
+------53BB1E1533C543713994C321F5A9998F--
+
diff --git a/src/security/core/tests/common/etc/default_governance.xml b/src/security/core/tests/common/etc/default_governance.xml
new file mode 100644
index 0000000..7d3e314
--- /dev/null
+++ b/src/security/core/tests/common/etc/default_governance.xml
@@ -0,0 +1,62 @@
+<?xml version="1.0" encoding="utf-8"?>
+<dds xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xsi:noNamespaceSchemaLocation="https://www.omg.org/spec/DDS-SECURITY/20170901/omg_shared_ca_governance.xsd">
+    <domain_access_rules>
+        <domain_rule>
+            <domains>
+                <!-- All domains -->
+                <id_range>
+                    <min>0</min>
+                    <max>230</max>
+                </id_range>
+            </domains>
+
+            <!-- DomainParticipant that cann not authenticate or fail the authentication should be
+                 allowed to join the domain and see any any discovery data that are configured as "unprotected"
+                 and topics that are configured as "unprotected" -->
+            <allow_unauthenticated_participants>false</allow_unauthenticated_participants>
+
+            <!--  Only and any authenticated DomainParticipant should be allowed to join the domain and
+                  see the discovery data without checking access control  -->
+            <enable_join_access_control>true</enable_join_access_control>
+
+            <!-- Discovery information should be protected with encryption followed by MAC (Message Authentication Codes) -->
+            <discovery_protection_kind>ENCRYPT</discovery_protection_kind>
+
+            <!--  Liveliness messages are also encrypted -->
+            <liveliness_protection_kind>ENCRYPT</liveliness_protection_kind>
+
+            <!-- Whole RTPS message is protected -->
+            <rtps_protection_kind>ENCRYPT</rtps_protection_kind>
+
+            <topic_access_rules>
+                <topic_rule>
+                    <!-- All (non-builtin) topics -->
+                    <topic_expression>*</topic_expression>
+
+                    <!-- The discovery information on specific Topics should be sent
+                         using the secure (protected) discovery writers -->
+                    <enable_discovery_protection>true</enable_discovery_protection>
+
+                    <!-- Liveliness QoS data is protected -->
+                    <enable_liveliness_protection>true</enable_liveliness_protection>
+
+                    <!-- The read access to all topics should be open to all. -->
+                    <enable_read_access_control>true</enable_read_access_control>
+
+                    <!-- The write access to all topics should be open to all. -->
+                    <enable_write_access_control>true</enable_write_access_control>
+
+                    <!-- Whole RTPS sub-message is protected. This includes metadata information
+                         like sequence numbers, heartbeats, key hashes, gaps,
+                         acknowledgment messages, etc. It also includes th possible payload. -->
+                    <metadata_protection_kind>ENCRYPT</metadata_protection_kind>
+
+                    <!-- The payload data sent on the Topic (serialized application level data) should be
+                         protected with Encrypt then MAC. -->
+                    <data_protection_kind>ENCRYPT</data_protection_kind>
+                </topic_rule>
+            </topic_access_rules>
+        </domain_rule>
+    </domain_access_rules>
+</dds>
diff --git a/src/security/core/tests/common/etc/default_permissions.p7s b/src/security/core/tests/common/etc/default_permissions.p7s
new file mode 100644
index 0000000..3417eac
--- /dev/null
+++ b/src/security/core/tests/common/etc/default_permissions.p7s
@@ -0,0 +1,97 @@
+MIME-Version: 1.0
+Content-Type: multipart/signed; protocol="application/x-pkcs7-signature"; micalg="sha-256"; boundary="----024D6D35BD8D71C15552DF3E23F615BB"
+
+This is an S/MIME signed message
+
+------024D6D35BD8D71C15552DF3E23F615BB
+Content-Type: text/plain
+
+<?xml version="1.0" encoding="utf-8"?>
+<dds xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xsi:noNamespaceSchemaLocation="https://www.omg.org/spec/DDS-SECURITY/20170901/omg_shared_ca_permissions.xsd">
+    <permissions>
+        <grant name="default_permissions">
+            <subject_name>emailAddress=alice@cycloneddssecurity.adlinktech.com,CN=Alice Example,O=Example Organization,OU=Organizational Unit Name,L=Locality Name,ST=OV,C=NL</subject_name>
+            <validity>
+                <!-- Format is CCYY-MM-DDThh:mm:ss[Z|(+|-)hh:mm] in GMT -->
+                <not_before>2015-09-15T01:00:00</not_before>
+                <not_after>2115-09-15T01:00:00</not_after>
+            </validity>
+            <allow_rule>
+                <domains>
+                    <id_range>
+                        <min>0</min>
+                        <max>230</max>
+                    </id_range>
+                </domains>
+                <publish>
+                    <topics>
+                        <topic>*</topic>
+                    </topics>
+                    <partitions>
+                        <partition>*</partition>
+                    </partitions>
+                </publish>
+                <subscribe>
+                    <topics>
+                        <topic>*</topic>
+                    </topics>
+                    <partitions>
+                        <partition>*</partition>
+                    </partitions>
+                </subscribe>
+            </allow_rule>
+            <default>DENY</default>
+        </grant>
+    </permissions>
+</dds>
+
+------024D6D35BD8D71C15552DF3E23F615BB
+Content-Type: application/x-pkcs7-signature; name="smime.p7s"
+Content-Transfer-Encoding: base64
+Content-Disposition: attachment; filename="smime.p7s"
+
+MIIHoQYJKoZIhvcNAQcCoIIHkjCCB44CAQExDzANBglghkgBZQMEAgEFADALBgkq
+hkiG9w0BBwGgggRzMIIEbzCCA1egAwIBAgIUfoby6818hlJQ+41KUHiM6BZll/0w
+DQYJKoZIhvcNAQELBQAwgcYxCzAJBgNVBAYTAk5MMQswCQYDVQQIDAJPVjEWMBQG
+A1UEBwwNTG9jYWxpdHkgTmFtZTETMBEGA1UECwwKRXhhbXBsZSBPVTEgMB4GA1UE
+CgwXRXhhbXBsZSBDQSBPcmdhbml6YXRpb24xHzAdBgNVBAMMFkV4YW1wbGUgUGVy
+bWlzc2lvbnMgQ0ExOjA4BgkqhkiG9w0BCQEWK2F1dGhvcml0eUBjeWNsb25lZGRz
+c2VjdXJpdHkuYWRsaW5rdGVjaC5jb20wHhcNMjAwMjI3MTM0ODA5WhcNMzAwMjI0
+MTM0ODA5WjCBxjELMAkGA1UEBhMCTkwxCzAJBgNVBAgMAk9WMRYwFAYDVQQHDA1M
+b2NhbGl0eSBOYW1lMRMwEQYDVQQLDApFeGFtcGxlIE9VMSAwHgYDVQQKDBdFeGFt
+cGxlIENBIE9yZ2FuaXphdGlvbjEfMB0GA1UEAwwWRXhhbXBsZSBQZXJtaXNzaW9u
+cyBDQTE6MDgGCSqGSIb3DQEJARYrYXV0aG9yaXR5QGN5Y2xvbmVkZHNzZWN1cml0
+eS5hZGxpbmt0ZWNoLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEB
+ANNWwyrW3J+TCyaZH77q+29GGqFsYP5rv9cpcL/TMDNccsPYY+1RA1K+zMRYo1LG
+8VdJNtJlhxE+tmEbKxsVUTtoj8zbLVU4P4g0gIh6U7LMv5lUEZ3XYKWvYrbZTFMo
+f2rXQYGXPO7pFnvbNAbnMiLmagRKxKJ91kq4utuMG3U6rkCA7i2S8cEISNO3gIpF
+a0IZJ8yS8wDlKa/LGxL90BYasLsSA6tw/69OIiUUYqpMRD+xxyyTkMO37VjmdiFL
+Ha/dxO8HH0t3Q0U0AgZP9uwYTgZpN+2UEFnjv3BDIydc3Wa0UaSdxLtHXMPvg3sR
+uH9CTqr4Le7/3uTYehYKgd0CAwEAAaNTMFEwHQYDVR0OBBYEFFi4pK986ZSB0BLi
+Mm8ivu6AUxYPMB8GA1UdIwQYMBaAFFi4pK986ZSB0BLiMm8ivu6AUxYPMA8GA1Ud
+EwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAHYLaJVWrLHg+62jC8yIz9db
+ECIroX9Gb7Ll937HMum6Hj4wlImrifMVV3iORWBrBLvtTtn0Zno3mwfjLRQtkjOi
+h71eJT+6//B7CT7noULJYVq8IRGErbKtmXULnxTajFApzO0v4hSu7rWj/Jfhil0T
+X7QgKNpgKzjYodWz3oGGtchxvw3+v9wdIWD5Cj0bk/VMCQCaBV0anvyga7d4k8/z
+PF7nW2Z9jNfKsVD1piFa+Yd4zN6XOPPKiFXfLD7ht9i2gG25iS+d95tKg1DfjnRD
+7u0BJSOAPerxGtN/wf43qY1XzUoE2FBJ9QJGOA/02ffaUMOwSzICF/ShctH+Knkx
+ggLyMIIC7gIBATCB3zCBxjELMAkGA1UEBhMCTkwxCzAJBgNVBAgMAk9WMRYwFAYD
+VQQHDA1Mb2NhbGl0eSBOYW1lMRMwEQYDVQQLDApFeGFtcGxlIE9VMSAwHgYDVQQK
+DBdFeGFtcGxlIENBIE9yZ2FuaXphdGlvbjEfMB0GA1UEAwwWRXhhbXBsZSBQZXJt
+aXNzaW9ucyBDQTE6MDgGCSqGSIb3DQEJARYrYXV0aG9yaXR5QGN5Y2xvbmVkZHNz
+ZWN1cml0eS5hZGxpbmt0ZWNoLmNvbQIUfoby6818hlJQ+41KUHiM6BZll/0wDQYJ
+YIZIAWUDBAIBBQCggeQwGAYJKoZIhvcNAQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG
+9w0BCQUxDxcNMjAwMjI3MTM1MDU2WjAvBgkqhkiG9w0BCQQxIgQgLVEvOwNNW9+x
++KKNuY51LjFOBF441MR89lv8fK5pDKMweQYJKoZIhvcNAQkPMWwwajALBglghkgB
+ZQMEASowCwYJYIZIAWUDBAEWMAsGCWCGSAFlAwQBAjAKBggqhkiG9w0DBzAOBggq
+hkiG9w0DAgICAIAwDQYIKoZIhvcNAwICAUAwBwYFKw4DAgcwDQYIKoZIhvcNAwIC
+ASgwDQYJKoZIhvcNAQEBBQAEggEAxDaQlT3KGO3Z69Dgh1JAnkR8fEW+SK/pRls0
+du8ZemKaeLAgwwS9rbMh+6YJqsYWrp1LWjxNI3oJqTp1RvcRzJJXF48nkP+Oe1jY
+2KX9wx5LthmrT/573EvZHkXsx7mBu3Ar2etm4iE3lqkblEiynTNfy4XmJBNdB+u8
+cTzzm6J9372FK3iu5Od9yVDV33Ys/OHBI8GYcrK9RBKovkctr2fK+RJHaVqrDy3y
+oE03GAaFr8brL2g9WlWRsE3nuRvPXppsz32kUWvHLUfEpGbq1K/9C137JSgVHNX2
+atfV404PDWdFqL/JMSdc8RIJTzY6I2Bwrg8z1912DkYD5KPuOA==
+
+------024D6D35BD8D71C15552DF3E23F615BB--
+
diff --git a/src/security/core/tests/common/etc/default_permissions.xml b/src/security/core/tests/common/etc/default_permissions.xml
new file mode 100644
index 0000000..74e3c9f
--- /dev/null
+++ b/src/security/core/tests/common/etc/default_permissions.xml
@@ -0,0 +1,39 @@
+<?xml version="1.0" encoding="utf-8"?>
+<dds xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xsi:noNamespaceSchemaLocation="https://www.omg.org/spec/DDS-SECURITY/20170901/omg_shared_ca_permissions.xsd">
+    <permissions>
+        <grant name="default_permissions">
+            <subject_name>emailAddress=alice@cycloneddssecurity.adlinktech.com,CN=Alice Example,O=Example Organization,OU=Organizational Unit Name,L=Locality Name,ST=OV,C=NL</subject_name>
+            <validity>
+                <!-- Format is CCYY-MM-DDThh:mm:ss[Z|(+|-)hh:mm] in GMT -->
+                <not_before>2015-09-15T01:00:00</not_before>
+                <not_after>2115-09-15T01:00:00</not_after>
+            </validity>
+            <allow_rule>
+                <domains>
+                    <id_range>
+                        <min>0</min>
+                        <max>230</max>
+                    </id_range>
+                </domains>
+                <publish>
+                    <topics>
+                        <topic>*</topic>
+                    </topics>
+                    <partitions>
+                        <partition>*</partition>
+                    </partitions>
+                </publish>
+                <subscribe>
+                    <topics>
+                        <topic>*</topic>
+                    </topics>
+                    <partitions>
+                        <partition>*</partition>
+                    </partitions>
+                </subscribe>
+            </allow_rule>
+            <default>DENY</default>
+        </grant>
+    </permissions>
+</dds>
diff --git a/src/security/core/tests/common/etc/default_permissions_ca.pem b/src/security/core/tests/common/etc/default_permissions_ca.pem
new file mode 100644
index 0000000..377a1e5
--- /dev/null
+++ b/src/security/core/tests/common/etc/default_permissions_ca.pem
@@ -0,0 +1,26 @@
+-----BEGIN CERTIFICATE-----
+MIIEbzCCA1egAwIBAgIUfoby6818hlJQ+41KUHiM6BZll/0wDQYJKoZIhvcNAQEL
+BQAwgcYxCzAJBgNVBAYTAk5MMQswCQYDVQQIDAJPVjEWMBQGA1UEBwwNTG9jYWxp
+dHkgTmFtZTETMBEGA1UECwwKRXhhbXBsZSBPVTEgMB4GA1UECgwXRXhhbXBsZSBD
+QSBPcmdhbml6YXRpb24xHzAdBgNVBAMMFkV4YW1wbGUgUGVybWlzc2lvbnMgQ0Ex
+OjA4BgkqhkiG9w0BCQEWK2F1dGhvcml0eUBjeWNsb25lZGRzc2VjdXJpdHkuYWRs
+aW5rdGVjaC5jb20wHhcNMjAwMjI3MTM0ODA5WhcNMzAwMjI0MTM0ODA5WjCBxjEL
+MAkGA1UEBhMCTkwxCzAJBgNVBAgMAk9WMRYwFAYDVQQHDA1Mb2NhbGl0eSBOYW1l
+MRMwEQYDVQQLDApFeGFtcGxlIE9VMSAwHgYDVQQKDBdFeGFtcGxlIENBIE9yZ2Fu
+aXphdGlvbjEfMB0GA1UEAwwWRXhhbXBsZSBQZXJtaXNzaW9ucyBDQTE6MDgGCSqG
+SIb3DQEJARYrYXV0aG9yaXR5QGN5Y2xvbmVkZHNzZWN1cml0eS5hZGxpbmt0ZWNo
+LmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBANNWwyrW3J+TCyaZ
+H77q+29GGqFsYP5rv9cpcL/TMDNccsPYY+1RA1K+zMRYo1LG8VdJNtJlhxE+tmEb
+KxsVUTtoj8zbLVU4P4g0gIh6U7LMv5lUEZ3XYKWvYrbZTFMof2rXQYGXPO7pFnvb
+NAbnMiLmagRKxKJ91kq4utuMG3U6rkCA7i2S8cEISNO3gIpFa0IZJ8yS8wDlKa/L
+GxL90BYasLsSA6tw/69OIiUUYqpMRD+xxyyTkMO37VjmdiFLHa/dxO8HH0t3Q0U0
+AgZP9uwYTgZpN+2UEFnjv3BDIydc3Wa0UaSdxLtHXMPvg3sRuH9CTqr4Le7/3uTY
+ehYKgd0CAwEAAaNTMFEwHQYDVR0OBBYEFFi4pK986ZSB0BLiMm8ivu6AUxYPMB8G
+A1UdIwQYMBaAFFi4pK986ZSB0BLiMm8ivu6AUxYPMA8GA1UdEwEB/wQFMAMBAf8w
+DQYJKoZIhvcNAQELBQADggEBAHYLaJVWrLHg+62jC8yIz9dbECIroX9Gb7Ll937H
+Mum6Hj4wlImrifMVV3iORWBrBLvtTtn0Zno3mwfjLRQtkjOih71eJT+6//B7CT7n
+oULJYVq8IRGErbKtmXULnxTajFApzO0v4hSu7rWj/Jfhil0TX7QgKNpgKzjYodWz
+3oGGtchxvw3+v9wdIWD5Cj0bk/VMCQCaBV0anvyga7d4k8/zPF7nW2Z9jNfKsVD1
+piFa+Yd4zN6XOPPKiFXfLD7ht9i2gG25iS+d95tKg1DfjnRD7u0BJSOAPerxGtN/
+wf43qY1XzUoE2FBJ9QJGOA/02ffaUMOwSzICF/ShctH+Knk=
+-----END CERTIFICATE-----
diff --git a/src/security/core/tests/common/etc/default_permissions_ca_key.pem b/src/security/core/tests/common/etc/default_permissions_ca_key.pem
new file mode 100644
index 0000000..e68bae1
--- /dev/null
+++ b/src/security/core/tests/common/etc/default_permissions_ca_key.pem
@@ -0,0 +1,27 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIIEpAIBAAKCAQEA01bDKtbcn5MLJpkfvur7b0YaoWxg/mu/1ylwv9MwM1xyw9hj
+7VEDUr7MxFijUsbxV0k20mWHET62YRsrGxVRO2iPzNstVTg/iDSAiHpTssy/mVQR
+nddgpa9ittlMUyh/atdBgZc87ukWe9s0BucyIuZqBErEon3WSri624wbdTquQIDu
+LZLxwQhI07eAikVrQhknzJLzAOUpr8sbEv3QFhqwuxIDq3D/r04iJRRiqkxEP7HH
+LJOQw7ftWOZ2IUsdr93E7wcfS3dDRTQCBk/27BhOBmk37ZQQWeO/cEMjJ1zdZrRR
+pJ3Eu0dcw++DexG4f0JOqvgt7v/e5Nh6FgqB3QIDAQABAoIBABFHMKGZ+2OYc/rt
+3eiP8YqBYr/7ylpCmOaQXsVwEKrCTiew00qdqvXi337V+FRWK3kFZVQCNO61/9ck
+j3uhXIjM3aTT7nrfJGKQWEnQJnOhxbBVbTNIXoBtPFbSoSjTUMd9Xb+oi7TEna/2
+leRSloi/6b78FeNrAlANlklIxR3qTjRSxjGYVfukCWsKq3uFfWM4Wp9N1B1gsyRo
+/SH2jOu0XTLNdajggtBKcFoqxVIiaetERKVRRid7pW0zwuYS5Zwv5Wtl3XMbUuAn
+VGesMeCKAGpwkLjmvXKBE5setnd7cWBKdVKddYDkzbDvU7X6QEHFnac6m6OQ2P62
+QfkO94ECgYEA70tV55AreDnPQEpf698ZjA8pYvF90GfGx/Y4oYWU/s0IlD6Pfbsr
+qkRu+1I+SUNZWARhirXmJzuOmJYUQRteCEq+6RPJzn5Jl9MtipOBAjI0h589dbAB
+8m/BRk+bEZKCXLgVa0TyZ/gd/wDBxB+qd+bPep8nAl4krMWK9W1+DLECgYEA4hfP
+EwUPMwHrGlq0oRUA08ssQ8XxVCKWeS3cLAJjO6EdJyIUm/8S/UZPBPeSkGyZeld+
+fY7z9ZV0HA338p5BYYDCqgJC6b5Ud5UV0yLkq01v6b0H3nSjTPcbA61l9laN0vhm
+QJ/xTiAHgsGBbOx2VtwDoE8T1AbAaamcapqNYu0CgYAXCiPdRc5JpxdDU2Xk6fgl
+uhf8BNBeTn+fJR/SvW/ZEJiw3U0nh+vuWuRsokCJAUkK5nEVz+m3AU77dgfBNQda
+uQeknVki3pnrWlPaMdWMBpV0MWrTd/zYANaVFHkTug1/K+I0D9FfHU6WDNabMYlS
+PhDf947j9XiGggadFsu6IQKBgQC6dgpIVFbZqU5cuMvZQToicaA68Kd7zN6uZ7z5
+6qouRkyFtpyqnq3pha+rmAYe6AGXnUrrgBcAxdYxQO/o/s1K/WcN0LmgjmCZErIi
+I9fU0xNmAIjZ1PXMhsqXuMyrYWyrvkKOL5pR5SZsluwHieh68A5pim3+4eaT/dbL
+MFVEbQKBgQDfkeApSfKATXJpYIV/tiGjmRkkYoZ6NVar92npjlb72jaA4V0gHmuD
+9ttypXOJPB/5zMa5uL6drp3CLv/GcWekUiUUXuyKQpcxZWqxf/leh9gTgGDAH/k4
+4+zX4HLEzTmoOc0cqzi4w6pTIj29BOV5QpnnyUGyvj8NGNSdFvZFSQ==
+-----END RSA PRIVATE KEY-----
diff --git a/src/security/core/tests/common/handshake_test_utils.c b/src/security/core/tests/common/handshake_test_utils.c
new file mode 100644
index 0000000..5385fe5
--- /dev/null
+++ b/src/security/core/tests/common/handshake_test_utils.c
@@ -0,0 +1,232 @@
+/*
+ * Copyright(c) 2006 to 2020 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+#include <stdlib.h>
+#include <assert.h>
+
+#include "CUnit/Test.h"
+#include "dds/dds.h"
+#include "dds/ddsrt/string.h"
+#include "dds/ddsrt/heap.h"
+#include "dds/security/dds_security_api.h"
+#include "authentication_wrapper.h"
+#include "handshake_test_utils.h"
+
+#define TIMEOUT DDS_SECS(2)
+
+struct Identity localIdentityList[MAX_LOCAL_IDENTITIES];
+int numLocal = 0;
+
+struct Identity remoteIdentityList[MAX_REMOTE_IDENTITIES];
+int numRemote = 0;
+
+struct Handshake handshakeList[MAX_HANDSHAKES];
+int numHandshake = 0;
+
+static void add_local_identity(DDS_Security_IdentityHandle handle, DDS_Security_GUID_t *guid)
+{
+  printf("add local identity %"PRId64"\n", handle);
+  localIdentityList[numLocal].handle = handle;
+  memcpy(&localIdentityList[numLocal].guid, guid, sizeof(DDS_Security_GUID_t));
+  numLocal++;
+}
+
+static int find_local_identity(DDS_Security_IdentityHandle handle)
+{
+  for (int i = 0; i < (int)numLocal; i++)
+  {
+    if (localIdentityList[i].handle == handle)
+      return i;
+  }
+  return -1;
+}
+
+static int find_remote_identity(DDS_Security_IdentityHandle handle)
+{
+  for (int i = 0; i < numRemote; i++)
+  {
+    if (remoteIdentityList[i].handle == handle)
+      return i;
+  }
+  return -1;
+}
+
+static void add_remote_identity(DDS_Security_IdentityHandle handle, DDS_Security_GUID_t *guid)
+{
+  if (find_remote_identity(handle) < 0)
+  {
+    printf("add remote identity %"PRId64"\n", handle);
+    remoteIdentityList[numRemote].handle = handle;
+    memcpy(&remoteIdentityList[numRemote].guid, guid, sizeof(DDS_Security_GUID_t));
+    numRemote++;
+  }
+}
+
+static void clear_stores(void)
+{
+  numLocal = 0;
+  numRemote = 0;
+  numHandshake = 0;
+}
+
+static void add_handshake(DDS_Security_HandshakeHandle handle, int isRequest, DDS_Security_IdentityHandle lHandle, DDS_Security_IdentityHandle rHandle, DDS_Security_ValidationResult_t result)
+{
+  printf("add handshake %"PRId64"\n", handle);
+  handshakeList[numHandshake].handle = handle;
+  handshakeList[numHandshake].isRequest = isRequest;
+  handshakeList[numHandshake].handshakeResult = result;
+  handshakeList[numHandshake].lidx = find_local_identity(lHandle);
+  handshakeList[numHandshake].ridx = find_remote_identity(rHandle);
+  handshakeList[numHandshake].finalResult = DDS_SECURITY_VALIDATION_FAILED;
+  numHandshake++;
+}
+
+static int find_handshake(DDS_Security_HandshakeHandle handle)
+{
+  for (int i = 0; i < numHandshake; i++)
+  {
+    if (handshakeList[i].handle == handle)
+      return i;
+  }
+  return -1;
+}
+
+static char * get_validation_result_str(DDS_Security_ValidationResult_t result)
+{
+  switch (result)
+  {
+    case DDS_SECURITY_VALIDATION_OK:
+      return "ok";
+    case DDS_SECURITY_VALIDATION_PENDING_RETRY:
+      return "pending retry";
+    case DDS_SECURITY_VALIDATION_PENDING_HANDSHAKE_REQUEST:
+      return "handshake request";
+    case DDS_SECURITY_VALIDATION_PENDING_HANDSHAKE_MESSAGE:
+      return "handshake message";
+    case DDS_SECURITY_VALIDATION_OK_FINAL_MESSAGE:
+      return "ok final";
+    default:
+    case DDS_SECURITY_VALIDATION_FAILED:
+      return "failed";
+  }
+}
+
+static bool handle_process_message(dds_domainid_t domain_id, DDS_Security_IdentityHandle handshake)
+{
+  struct message *msg;
+  bool result = false;
+  if ((msg = test_authentication_plugin_take_msg(domain_id, MESSAGE_KIND_PROCESS_HANDSHAKE, 0, 0, handshake, TIMEOUT)))
+  {
+    int idx;
+    if ((idx = find_handshake(msg->hsHandle)) >= 0)
+    {
+      printf("set handshake %"PRId64" final result to '%s'\n", msg->hsHandle, get_validation_result_str(msg->result));
+      handshakeList[idx].finalResult = msg->result;
+      result = true;
+    }
+    test_authentication_plugin_release_msg(msg);
+  }
+  return result;
+}
+
+static bool handle_begin_handshake_request(dds_domainid_t domain_id, DDS_Security_IdentityHandle lid, DDS_Security_IdentityHandle rid, char ** err_msg)
+{
+  struct message *msg;
+  bool result = false;
+  printf("handle begin handshake request %"PRId64"<->%"PRId64"\n", lid, rid);
+  if ((msg = test_authentication_plugin_take_msg(domain_id, MESSAGE_KIND_BEGIN_HANDSHAKE_REQUEST, lid, rid, 0, TIMEOUT)))
+  {
+    add_handshake(msg->hsHandle, 1, msg->lidHandle, msg->ridHandle, msg->result);
+    if (msg->result == DDS_SECURITY_VALIDATION_OK)
+      result = handle_process_message(domain_id, msg->hsHandle);
+    else if (msg->result == DDS_SECURITY_VALIDATION_FAILED && err_msg)
+      *err_msg = ddsrt_strdup (msg->err_msg);
+    test_authentication_plugin_release_msg(msg);
+  }
+  return result;
+}
+
+static bool handle_begin_handshake_reply(dds_domainid_t domain_id, DDS_Security_IdentityHandle lid, DDS_Security_IdentityHandle rid, char ** err_msg)
+{
+  struct message *msg;
+  bool result = false;
+  printf("handle begin handshake reply %"PRId64"<->%"PRId64"\n", lid, rid);
+  if ((msg = test_authentication_plugin_take_msg(domain_id, MESSAGE_KIND_BEGIN_HANDSHAKE_REPLY, lid, rid, 0, TIMEOUT)))
+  {
+    add_handshake(msg->hsHandle, 0, msg->lidHandle, msg->ridHandle, msg->result);
+    if (msg->result == DDS_SECURITY_VALIDATION_OK)
+      result = handle_process_message(domain_id, msg->hsHandle);
+    else if (msg->result == DDS_SECURITY_VALIDATION_FAILED && err_msg)
+      *err_msg = ddsrt_strdup (msg->err_msg);
+    test_authentication_plugin_release_msg(msg);
+  }
+  return result;
+}
+
+static bool handle_validate_remote_identity(dds_domainid_t domain_id, DDS_Security_IdentityHandle lid, int count, bool * is_hs_requester, char ** err_msg_req, char ** err_msg_reply)
+{
+  bool result = true;
+  struct message *msg;
+  assert(is_hs_requester);
+  while (count-- > 0 && result && (msg = test_authentication_plugin_take_msg(domain_id, MESSAGE_KIND_VALIDATE_REMOTE_IDENTITY, lid, 0, 0, TIMEOUT)))
+  {
+    add_remote_identity(msg->ridHandle, &msg->rguid);
+    if (msg->result == DDS_SECURITY_VALIDATION_PENDING_HANDSHAKE_REQUEST)
+    {
+      result = handle_begin_handshake_request(domain_id, lid, msg->ridHandle, err_msg_req);
+      *is_hs_requester = true;
+    }
+    else if (msg->result == DDS_SECURITY_VALIDATION_PENDING_HANDSHAKE_MESSAGE)
+    {
+      result = handle_begin_handshake_reply(domain_id, lid, msg->ridHandle, err_msg_reply);
+      *is_hs_requester = false;
+    }
+    else
+      result = false;
+
+    test_authentication_plugin_release_msg(msg);
+  }
+  return result;
+}
+
+void validate_handshake(dds_domainid_t domain_id, bool exp_req_fail, const char * exp_req_msg, bool exp_reply_fail, const char * exp_reply_msg)
+{
+  printf("validate handshake for domain %d\n", domain_id);
+  clear_stores();
+
+  struct message *msg = test_authentication_plugin_take_msg (domain_id, MESSAGE_KIND_VALIDATE_LOCAL_IDENTITY, 0, 0, 0, TIMEOUT);
+  CU_ASSERT_FATAL (msg != NULL);
+  add_local_identity (msg->lidHandle, &msg->lguid);
+  test_authentication_plugin_release_msg (msg);
+  bool is_requester = false;
+  char * err_msg_req = NULL, *err_msg_reply = NULL;
+  bool ret = handle_validate_remote_identity (domain_id, localIdentityList[0].handle, 1, &is_requester, &err_msg_req, &err_msg_reply);
+  CU_ASSERT_FATAL ((is_requester && ret != exp_req_fail) || (!is_requester && ret != exp_reply_fail));
+  if (ret)
+  {
+    DDS_Security_ValidationResult_t exp_result = is_requester ? DDS_SECURITY_VALIDATION_OK_FINAL_MESSAGE : DDS_SECURITY_VALIDATION_OK;
+    CU_ASSERT_EQUAL_FATAL (handshakeList[0].finalResult, exp_result);
+  }
+  else if (is_requester && exp_req_msg)
+  {
+    CU_ASSERT_FATAL (err_msg_req && strstr(err_msg_req, exp_req_msg) != NULL);
+  }
+  else if (!is_requester && exp_reply_msg)
+  {
+    CU_ASSERT_FATAL (err_msg_reply && strstr(err_msg_reply, exp_reply_msg) != NULL);
+  }
+  if (err_msg_req)
+    ddsrt_free (err_msg_req);
+  if (err_msg_reply)
+    ddsrt_free (err_msg_reply);
+  printf ("finished validate handshake for domain %d\n\n", domain_id);
+}
+
diff --git a/src/security/core/tests/common/handshake_test_utils.h b/src/security/core/tests/common/handshake_test_utils.h
new file mode 100644
index 0000000..9ca8afb
--- /dev/null
+++ b/src/security/core/tests/common/handshake_test_utils.h
@@ -0,0 +1,48 @@
+/*
+ * Copyright(c) 2006 to 2020 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+#ifndef SECURITY_CORE_HANDSHAKE_TEST_UTILS_H_
+#define SECURITY_CORE_HANDSHAKE_TEST_UTILS_H_
+
+#include "dds/dds.h"
+#include "dds/ddsrt/sync.h"
+
+#include "dds/security/dds_security_api.h"
+
+#define MAX_LOCAL_IDENTITIES 8
+#define MAX_REMOTE_IDENTITIES 8
+#define MAX_HANDSHAKES 32
+#define TIMEOUT DDS_SECS(2)
+
+union guid {
+  DDS_Security_GUID_t g;
+  unsigned u[4];
+};
+
+struct Identity
+{
+  DDS_Security_IdentityHandle handle;
+  union guid guid;
+};
+
+struct Handshake
+{
+  DDS_Security_HandshakeHandle handle;
+  int isRequest;
+  int lidx;
+  int ridx;
+  DDS_Security_ValidationResult_t handshakeResult;
+  DDS_Security_ValidationResult_t finalResult;
+};
+
+void validate_handshake(dds_domainid_t domain_id, bool exp_req_fail, const char * exp_req_msg, bool exp_reply_fail, const char * exp_reply_msg);
+
+#endif /* SECURITY_CORE_HANDSHAKE_TEST_UTILS_H_ */
diff --git a/src/security/core/tests/common/plugin_wrapper_msg_q.c b/src/security/core/tests/common/plugin_wrapper_msg_q.c
new file mode 100644
index 0000000..3ecad82
--- /dev/null
+++ b/src/security/core/tests/common/plugin_wrapper_msg_q.c
@@ -0,0 +1,134 @@
+/*
+ * Copyright(c) 2006 to 2020 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+#include <string.h>
+#include <stdio.h>
+#include "dds/dds.h"
+#include "dds/ddsrt/heap.h"
+#include "dds/ddsrt/sync.h"
+#include "dds/ddsrt/string.h"
+#include "dds/ddsi/ddsi_domaingv.h"
+#include "dds/security/dds_security_api.h"
+#include "dds/security/core/dds_security_utils.h"
+#include "plugin_wrapper_msg_q.h"
+
+void insert_message(struct message_queue *queue, struct message *msg)
+{
+  ddsrt_mutex_lock(&queue->lock);
+  if (!queue->head)
+    queue->head = msg;
+  else
+    queue->tail->next = msg;
+  queue->tail = msg;
+
+  ddsrt_cond_signal(&queue->cond);
+  ddsrt_mutex_unlock(&queue->lock);
+}
+
+void add_message(struct message_queue *queue, message_kind_t kind, DDS_Security_IdentityHandle lidHandle, DDS_Security_IdentityHandle ridHandle, DDS_Security_IdentityHandle hsHandle,
+    const DDS_Security_GUID_t *lguid, const DDS_Security_GUID_t *rguid, DDS_Security_ValidationResult_t result, const char * err_msg,
+    const DDS_Security_DataHolder *token, void *instance)
+{
+  struct message *msg = ddsrt_malloc(sizeof(*msg));
+  memset(msg, 0, sizeof(*msg));
+  msg->kind = kind;
+  msg->lidHandle = lidHandle;
+  msg->ridHandle = ridHandle;
+  msg->hsHandle = hsHandle;
+  msg->result = result;
+  msg->err_msg = ddsrt_strdup (err_msg ? err_msg : "");
+  if (lguid)
+    memcpy(&msg->lguid, lguid, sizeof(msg->lguid));
+  if (rguid)
+    memcpy(&msg->rguid, rguid, sizeof(msg->rguid));
+  if (token)
+    DDS_Security_DataHolder_copy(&msg->token, token);
+  msg->instance = instance;
+
+  insert_message(queue, msg);
+}
+
+void delete_message(struct message *msg)
+{
+  if (msg)
+  {
+    DDS_Security_DataHolder_deinit(&msg->token);
+    ddsrt_free(msg->err_msg);
+    ddsrt_free(msg);
+  }
+}
+
+void init_message_queue(struct message_queue *queue)
+{
+  queue->head = NULL;
+  queue->tail = NULL;
+  ddsrt_mutex_init(&queue->lock);
+  ddsrt_cond_init(&queue->cond);
+}
+
+void deinit_message_queue(struct message_queue *queue)
+{
+  struct message *msg = queue->head;
+  while (msg)
+  {
+    queue->head = msg->next;
+    delete_message(msg);
+    msg = queue->head;
+  }
+  ddsrt_cond_destroy(&queue->cond);
+  ddsrt_mutex_destroy(&queue->lock);
+}
+
+int message_matched(struct message *msg, message_kind_t kind, DDS_Security_IdentityHandle lidHandle, DDS_Security_IdentityHandle ridHandle, DDS_Security_IdentityHandle hsHandle)
+{
+  return msg->kind == kind &&
+    (!lidHandle || msg->lidHandle == lidHandle) &&
+    (!ridHandle || msg->ridHandle == ridHandle) &&
+    (!hsHandle || msg->hsHandle == hsHandle);
+}
+
+struct message * take_message(struct message_queue *queue, message_kind_t kind, DDS_Security_IdentityHandle lidHandle, DDS_Security_IdentityHandle ridHandle, DDS_Security_IdentityHandle hsHandle, dds_duration_t timeout)
+{
+  struct message *msg = NULL, *cur, *prev;
+  int r = 1;
+  ddsrt_mutex_lock(&queue->lock);
+  do
+  {
+    cur = queue->head;
+    prev = NULL;
+    while (cur && !msg)
+    {
+      if (message_matched(cur, kind, lidHandle, ridHandle, hsHandle))
+      {
+        msg = cur;
+        if (prev)
+          prev->next = msg->next;
+        else
+          queue->head = msg->next;
+        if (queue->tail == msg)
+          queue->tail = prev;
+      }
+      else
+      {
+        prev = cur;
+        cur = cur->next;
+      }
+    }
+    if (!msg)
+    {
+      if (!ddsrt_cond_waitfor(&queue->cond, &queue->lock, timeout))
+        r = 0;
+    }
+  } while (r && !msg);
+
+  ddsrt_mutex_unlock(&queue->lock);
+  return msg;
+}
diff --git a/src/security/core/tests/common/plugin_wrapper_msg_q.h b/src/security/core/tests/common/plugin_wrapper_msg_q.h
new file mode 100644
index 0000000..32ec557
--- /dev/null
+++ b/src/security/core/tests/common/plugin_wrapper_msg_q.h
@@ -0,0 +1,62 @@
+/*
+ * Copyright(c) 2006 to 2020 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+#ifndef SECURITY_CORE_PLUGIN_WRAPPER_MSG_Q_H_
+#define SECURITY_CORE_PLUGIN_WRAPPER_MSG_Q_H_
+
+#include "dds/dds.h"
+#include "dds/ddsrt/sync.h"
+
+#include "dds/security/dds_security_api.h"
+
+typedef enum {
+    MESSAGE_KIND_VALIDATE_LOCAL_IDENTITY,
+    MESSAGE_KIND_VALIDATE_REMOTE_IDENTITY,
+    MESSAGE_KIND_BEGIN_HANDSHAKE_REQUEST,
+    MESSAGE_KIND_BEGIN_HANDSHAKE_REPLY,
+    MESSAGE_KIND_PROCESS_HANDSHAKE
+} message_kind_t;
+
+struct message {
+    message_kind_t kind;
+    DDS_Security_IdentityHandle lidHandle;
+    DDS_Security_IdentityHandle ridHandle;
+    DDS_Security_IdentityHandle hsHandle;
+    DDS_Security_GUID_t lguid;
+    DDS_Security_GUID_t rguid;
+    DDS_Security_ValidationResult_t result;
+    char * err_msg;
+    DDS_Security_DataHolder token;
+    void *instance;
+    struct message *next;
+};
+
+struct message_queue {
+    ddsrt_mutex_t lock;
+    ddsrt_cond_t cond;
+    struct message *head;
+    struct message *tail;
+};
+
+struct dds_security_authentication_impl;
+
+void insert_message(struct message_queue *queue, struct message *msg);
+void add_message(struct message_queue *queue, message_kind_t kind, DDS_Security_IdentityHandle lidHandle, DDS_Security_IdentityHandle ridHandle, DDS_Security_IdentityHandle hsHandle,
+    const DDS_Security_GUID_t *lguid, const DDS_Security_GUID_t *rguid, DDS_Security_ValidationResult_t result, const char * err_msg,
+    const DDS_Security_DataHolder *token, void *instance);
+void delete_message(struct message *msg);
+void init_message_queue(struct message_queue *queue);
+void deinit_message_queue(struct message_queue *queue);
+int message_matched(struct message *msg, message_kind_t kind, DDS_Security_IdentityHandle lidHandle, DDS_Security_IdentityHandle ridHandle, DDS_Security_IdentityHandle hsHandle);
+struct message * take_message(struct message_queue *queue, message_kind_t kind, DDS_Security_IdentityHandle lidHandle, DDS_Security_IdentityHandle ridHandle, DDS_Security_IdentityHandle hsHandle, dds_duration_t timeout);
+
+
+#endif /* SECURITY_CORE_PLUGIN_WRAPPER_MSG_Q_H_ */
diff --git a/src/security/core/tests/common/security_config_test_utils.c b/src/security/core/tests/common/security_config_test_utils.c
new file mode 100644
index 0000000..c67a4d8
--- /dev/null
+++ b/src/security/core/tests/common/security_config_test_utils.c
@@ -0,0 +1,156 @@
+/*
+ * Copyright(c) 2006 to 2020 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+
+#include <stdlib.h>
+#include <string.h>
+#include <openssl/asn1.h>
+#include <openssl/bio.h>
+#include <openssl/conf.h>
+#include <openssl/err.h>
+#include <openssl/pem.h>
+#include <openssl/x509.h>
+
+#include "CUnit/Test.h"
+#include "dds/dds.h"
+#include "dds/ddsrt/environ.h"
+#include "dds/ddsrt/expand_vars.h"
+#include "dds/ddsrt/heap.h"
+#include "dds/ddsrt/string.h"
+#include "common/config_env.h"
+#include "security_config_test_utils.h"
+
+static const char *governance_xml =
+    "<?xml version=\"1.0\" encoding=\"utf-8\"?>"
+    "<dds xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" xsi:noNamespaceSchemaLocation=\"https://www.omg.org/spec/DDS-SECURITY/20170901/omg_shared_ca_governance.xsd\">"
+    "  <domain_access_rules>"
+    "    <domain_rule>"
+    "      <domains>"
+    "        <id_range>"
+    "          <min>0</min>"
+    "          <max>230</max>"
+    "        </id_range>"
+    "      </domains>"
+    "      <allow_unauthenticated_participants>${ALLOW_UNAUTH_PP:-false}</allow_unauthenticated_participants>"
+    "      <enable_join_access_control>${ENABLE_JOIN_AC:-false}</enable_join_access_control>"
+    "      <discovery_protection_kind>${DISCOVERY_PROTECTION_KIND:-NONE}</discovery_protection_kind>"
+    "      <liveliness_protection_kind>${LIVELINESS_PROTECTION_KIND:-NONE}</liveliness_protection_kind>"
+    "      <rtps_protection_kind>${RTPS_PROTECTION_KIND:-NONE}</rtps_protection_kind>"
+    "      <topic_access_rules>"
+    "        <topic_rule>"
+    "          <topic_expression>*</topic_expression>"
+    "          <enable_discovery_protection>${ENABLE_DISC_PROTECTION:-false}</enable_discovery_protection>"
+    "          <enable_liveliness_protection>${ENABLE_LIVELINESS_PROTECTION:-false}</enable_liveliness_protection>"
+    "          <enable_read_access_control>${ENABLE_READ_AC:-false}</enable_read_access_control>"
+    "          <enable_write_access_control>${ENABLE_WRITE_AC:-false}</enable_write_access_control>"
+    "          <metadata_protection_kind>${METADATA_PROTECTION_KIND:-NONE}</metadata_protection_kind>"
+    "          <data_protection_kind>${DATA_PROTECTION_KIND:-NONE}</data_protection_kind>"
+    "        </topic_rule>"
+    "      </topic_access_rules>"
+    "    </domain_rule>"
+    "  </domain_access_rules>"
+    "</dds>";
+
+const char * expand_lookup_vars(const char *name, void * data)
+{
+  const struct kvp *vars = (struct kvp *)data;
+  for (uint32_t i = 0; vars[i].key != NULL; i++)
+  {
+    if (!strcmp(vars[i].key, name))
+      return vars[i].value;
+  }
+  return NULL;
+}
+
+const char * expand_lookup_vars_env(const char *name, void * data)
+{
+  const char *env;
+  if ((env = expand_lookup_vars (name, data)))
+    return env;
+  return ((ddsrt_getenv(name, &env)) == DDS_RETCODE_OK) ? env : NULL;
+}
+
+static char * smime_sign(char * ca_cert_path, char * ca_priv_key_path, const char * data)
+{
+  // Read CA certificate
+  BIO *ca_cert_bio = BIO_new (BIO_s_file ());
+  if (BIO_read_filename (ca_cert_bio, ca_cert_path) <= 0)
+  {
+      printf ("Error reading CA certificate file %s\n", ca_cert_path);
+      CU_ASSERT_FATAL (false);
+  }
+
+  // Read CA private key
+  BIO *ca_priv_key_bio = BIO_new (BIO_s_file ());
+  if (BIO_read_filename (ca_priv_key_bio, ca_priv_key_path) <= 0)
+  {
+      printf ("Error reading CA private key file %s\n", ca_priv_key_path);
+      CU_ASSERT_FATAL (false);
+  }
+
+  // Create Openssl certificate and private key from the BIO's
+  X509 *ca_cert = PEM_read_bio_X509_AUX (ca_cert_bio, NULL, NULL, NULL);
+  EVP_PKEY* ca_priv_key = PEM_read_bio_PrivateKey (ca_priv_key_bio, NULL, 0, NULL);
+
+  // Read the data
+  BIO *data_bio = BIO_new (BIO_s_mem ());
+  if (BIO_puts (data_bio, data) <= 0) {
+      printf ("Error getting configuration data for signing\n");
+      CU_ASSERT_FATAL (false);
+  }
+
+  // Create the data signing object
+  PKCS7 *signed_data = PKCS7_sign (ca_cert, ca_priv_key, NULL, data_bio, PKCS7_DETACHED | PKCS7_STREAM | PKCS7_TEXT);
+  if (!signed_data) {
+      printf ("Error signing configuration data\n");
+      CU_ASSERT_FATAL (false);
+  }
+
+  // Create BIO for writing output
+  BIO *output_bio = BIO_new (BIO_s_mem ());
+  if (!SMIME_write_PKCS7 (output_bio, signed_data, data_bio, PKCS7_DETACHED | PKCS7_STREAM | PKCS7_TEXT)) {
+      printf ("Error writing signed XML configuration\n");
+      CU_ASSERT_FATAL (false);
+  }
+
+  // Get string
+  char *output_tmp = NULL;
+  size_t output_sz = (size_t)BIO_get_mem_data (output_bio, &output_tmp);
+  char * output = ddsrt_malloc(output_sz + 1);
+  memcpy(output, output_tmp, output_sz);
+  output[output_sz] = 0;
+
+  BIO_free (output_bio);
+  PKCS7_free (signed_data);
+  BIO_free (data_bio);
+  EVP_PKEY_free (ca_priv_key);
+  X509_free (ca_cert);
+  BIO_free (ca_priv_key_bio);
+  BIO_free (ca_cert_bio);
+
+  return output;
+}
+
+static char *get_signed_governance_data(const char *gov_xml)
+{
+  return smime_sign (
+    COMMON_ETC_PATH("default_permissions_ca.pem"),
+    COMMON_ETC_PATH("default_permissions_ca_key.pem"),
+    gov_xml);
+}
+
+char * get_governance_config(struct kvp *config_vars)
+{
+  char * config = ddsrt_expand_vars(governance_xml, &expand_lookup_vars, config_vars);
+  char * config_signed = get_signed_governance_data(config);
+  ddsrt_free (config);
+  return config_signed;
+}
diff --git a/src/security/core/tests/common/security_config_test_utils.h b/src/security/core/tests/common/security_config_test_utils.h
new file mode 100644
index 0000000..d2c8635
--- /dev/null
+++ b/src/security/core/tests/common/security_config_test_utils.h
@@ -0,0 +1,28 @@
+/*
+ * Copyright(c) 2006 to 2020 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+#ifndef SECURITY_CORE_TEST_SECURITY_CONFIG_TEST_UTILS_H_
+#define SECURITY_CORE_TEST_SECURITY_CONFIG_TEST_UTILS_H_
+
+#include <stdlib.h>
+#include "dds/ddsrt/environ.h"
+
+struct kvp {
+  const char *key;
+  const char *value;
+};
+
+const char * expand_lookup_vars (const char *name, void * data);
+const char * expand_lookup_vars_env (const char *name, void * data);
+
+char * get_governance_config (struct kvp *config_vars);
+
+#endif /* SECURITY_CORE_TEST_SECURITY_CONFIG_TEST_UTILS_H_ */
diff --git a/src/security/core/tests/common/test_identity.h b/src/security/core/tests/common/test_identity.h
new file mode 100644
index 0000000..2fbcd3b
--- /dev/null
+++ b/src/security/core/tests/common/test_identity.h
@@ -0,0 +1,184 @@
+/*
+ * Copyright(c) 2006 to 2019 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+
+#ifndef PLUGIN_SECURITY_CORE_TEST_IDENTITY_H_
+#define PLUGIN_SECURITY_CORE_TEST_IDENTITY_H_
+
+#define TEST_IDENTITY_CERTIFICATE_DUMMY "testtext_IdentityCertificate_testtext"
+#define TEST_IDENTITY_PRIVATE_KEY_DUMMY "testtext_PrivateKey_testtext"
+#define TEST_IDENTITY_CA_CERTIFICATE_DUMMY "testtext_IdentityCA_testtext"
+
+#define TEST_IDENTITY_CERTIFICATE "data:,-----BEGIN CERTIFICATE-----\n\
+MIIEDTCCAvUCFHZ4yXyk/9yeMxgHs6Ib0bLKhXYuMA0GCSqGSIb3DQEBCwUAMIHA\n\
+MQswCQYDVQQGEwJOTDELMAkGA1UECAwCT1YxFjAUBgNVBAcMDUxvY2FsaXR5IE5h\n\
+bWUxEzARBgNVBAsMCkV4YW1wbGUgT1UxIzAhBgNVBAoMGkV4YW1wbGUgSUQgQ0Eg\n\
+T3JnYW5pemF0aW9uMRYwFAYDVQQDDA1FeGFtcGxlIElEIENBMTowOAYJKoZIhvcN\n\
+AQkBFithdXRob3JpdHlAY3ljbG9uZWRkc3NlY3VyaXR5LmFkbGlua3RlY2guY29t\n\
+MB4XDTIwMDIyNzE5MjQwMVoXDTMwMDIyNDE5MjQwMVowgcQxCzAJBgNVBAYTAk5M\n\
+MQswCQYDVQQIDAJPVjEWMBQGA1UEBwwNTG9jYWxpdHkgTmFtZTEhMB8GA1UECwwY\n\
+T3JnYW5pemF0aW9uYWwgVW5pdCBOYW1lMR0wGwYDVQQKDBRFeGFtcGxlIE9yZ2Fu\n\
+aXphdGlvbjEWMBQGA1UEAwwNQWxpY2UgRXhhbXBsZTE2MDQGCSqGSIb3DQEJARYn\n\
+YWxpY2VAY3ljbG9uZWRkc3NlY3VyaXR5LmFkbGlua3RlY2guY29tMIIBIjANBgkq\n\
+hkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA5mEhLZIP2ko1bRJyJCwbnvhIpXFv6GOh\n\
+nvuS5v8tsTju40O62NNQmKT/my1QVKiUu7OoWZtLNBebgxgJ851eQ4TBRXy/f2jG\n\
+kLPYM22dohLTblVCpGutn+Itw3QRM3nkne7Sk8O6FP6NH6Y+7gkjxy5kI3GvhuIC\n\
+uBIzAV4dHK+hPlCn/Z+W33W71/ZAmnmI+2GaWiu5tjAQyFcmqWbi0BD7TWqBqidZ\n\
+2n7LTImUtp8NrYLfhzvgNLr9BZe7uf+T3mgdwcHtfi98GA94Lo6lqGeygiwig746\n\
+Y5uW4c6whsbd6riJ8FG1l8O86Ump4bSKChxjeoTLj4M4KX615kYa4QIDAQABMA0G\n\
+CSqGSIb3DQEBCwUAA4IBAQAM2g7v3FaA+d1zDkvDF5emCRL+R9H8pgimEOENrZTV\n\
+iK/kl8Hm7xkO7/LZ3y/kXpQpth8FtFS6LsZBAXPYabfADeDFVImnOD6UbWewwHQR\n\
+01gxkmYL/1nco/g3AsX/Ledh2ihwClGp+d6vNm5xF+Gw8Ux0YvH/aHy4RKg7mE/S\n\
+nonfHWRlT2tw1OtohTVhmBn00Jvj0IzSAiNvpmZHVRLYL9JRb5awYSX5XGetpoFM\n\
+VwzWIaZ06idvCtPKTfP71jJypV3+I2g5PNqranbuMv5nNAKZq1QlSB07f2Z1VIu6\n\
+6jeSZSADfm73qnE2Kj1PiZkPn0Wu+K24GXCvdILATcUS\n\
+-----END CERTIFICATE-----"
+
+#define TEST_IDENTITY_PRIVATE_KEY "data:,-----BEGIN RSA PRIVATE KEY-----\n\
+MIIEpQIBAAKCAQEA5mEhLZIP2ko1bRJyJCwbnvhIpXFv6GOhnvuS5v8tsTju40O6\n\
+2NNQmKT/my1QVKiUu7OoWZtLNBebgxgJ851eQ4TBRXy/f2jGkLPYM22dohLTblVC\n\
+pGutn+Itw3QRM3nkne7Sk8O6FP6NH6Y+7gkjxy5kI3GvhuICuBIzAV4dHK+hPlCn\n\
+/Z+W33W71/ZAmnmI+2GaWiu5tjAQyFcmqWbi0BD7TWqBqidZ2n7LTImUtp8NrYLf\n\
+hzvgNLr9BZe7uf+T3mgdwcHtfi98GA94Lo6lqGeygiwig746Y5uW4c6whsbd6riJ\n\
+8FG1l8O86Ump4bSKChxjeoTLj4M4KX615kYa4QIDAQABAoIBAAtNMoJ4ytxLjaln\n\
+IUBTBZvb1DyBfxroYFJbRw6b8BLklxuBBBaE70w9s+hZ5bnxdzJqEtUqgBrzGYbp\n\
+0/smeixXw99zyjUm367Tk8SaGQSNZd/gwN8uBRt1zgbrl7htv2BcCeqDzIohHq0x\n\
+y56DxkSMKw9uEU1NoxKCmgv0IPt6LlvjCwFhDv8iLu4lvu61F+ovVYIM6UXJJH0G\n\
+bHcJ1XnFBj5jCJFAWZRq7KxBgc4K3DlG+J7JcGEz89ZnZfGwcIiLqJ4rbU7E0ZE8\n\
+LslIHOwodtMDReIRWl6wEYmvd3mQizTXj2EWlRywQ/P3yFlxuHsGxPtRxdWoyXDc\n\
+Ii7GZK0CgYEA9KA+uEAMA5jZK0h1EMFoTiOIRe0x8CjlrHg4l0zU0ElcMeUXwoci\n\
+XqM0sjARiNgqkcMaONCb5bKgyxncWyWcamUxgp+bi2FUQIlBKHb56TCioPP0zzc6\n\
+yCiQ2cA8QW9PjL0WScJz3bCzeXrQceGZenDpPyphYE7SIUaRAOlMTMMCgYEA8RdP\n\
+QfYbOrcwgZB8ZycFE7lpZibe7Wh4UI1b/ipNZKcncr2pOZR+gVNv6eDQbV4z9xZY\n\
+5K6oU3rUcFHf0ZAi9xIpNzcq9q4+qOGO2OCEZX5tewXjKw9rwyDPUbv3yToFyZ9w\n\
+YwEKLfUgnYzpd5qn2NXa/pAZIoTh5ILF+EezD4sCgYEAr2lg0BoNA19NCn5wg01M\n\
+kAtmok3Nq1qIJr4mRkfvqlOQaq7N9M2V1arOFJ/nUus+yzrNyMO9pl4Kctjea/Vy\n\
+TdC2SeZNUQq/sW86a9u0pIQdebC1cQk3e2OrSplQG9PHhTHpk4Z+Mw+MAqYQZjjR\n\
+Jz1j48lt/fNHNlk1jSO9dKUCgYEAuYkJuqZuMBJ4Zs1Nn4ic1KAUp8N0Pdnu9XbD\n\
+++aMJtCogBnLWH+Zl2chsigL3o7niNiO0nZDHfNh94pap4i4D9HPHCn9i1du60Ki\n\
+Tu8BlKXmFQ3j0+iLMuBWC/2O5DId8BseP2K2dcW2MukVZrEDSNDTNqKoZTNEMDof\n\
+pkFvYJ8CgYEA6du9DFFZzIp5tuSIfVqCq5oxiNrRGJ/EpJEneBexrX56cC90sqLM\n\
+ecxDkgEVC592b004K1mjak3w6O0jYozQM1uvve38nZyMgtbMo3ORCtAO6Xszj8Oj\n\
+yNw1+km1Zy6EWdFEMciEFlbRwWVmDfE/um9LZsSWbmuWAOTww9GBDhc=\n\
+-----END RSA PRIVATE KEY-----"
+
+
+#define TEST_IDENTITY_CA_CERTIFICATE "data:,-----BEGIN CERTIFICATE-----\n\
+MIIEYzCCA0ugAwIBAgIUOp5yaGGuh0vaQTZHVPkX5jHoc/4wDQYJKoZIhvcNAQEL\n\
+BQAwgcAxCzAJBgNVBAYTAk5MMQswCQYDVQQIDAJPVjEWMBQGA1UEBwwNTG9jYWxp\n\
+dHkgTmFtZTETMBEGA1UECwwKRXhhbXBsZSBPVTEjMCEGA1UECgwaRXhhbXBsZSBJ\n\
+RCBDQSBPcmdhbml6YXRpb24xFjAUBgNVBAMMDUV4YW1wbGUgSUQgQ0ExOjA4Bgkq\n\
+hkiG9w0BCQEWK2F1dGhvcml0eUBjeWNsb25lZGRzc2VjdXJpdHkuYWRsaW5rdGVj\n\
+aC5jb20wHhcNMjAwMjI3MTkyMjA1WhcNMzAwMjI0MTkyMjA1WjCBwDELMAkGA1UE\n\
+BhMCTkwxCzAJBgNVBAgMAk9WMRYwFAYDVQQHDA1Mb2NhbGl0eSBOYW1lMRMwEQYD\n\
+VQQLDApFeGFtcGxlIE9VMSMwIQYDVQQKDBpFeGFtcGxlIElEIENBIE9yZ2FuaXph\n\
+dGlvbjEWMBQGA1UEAwwNRXhhbXBsZSBJRCBDQTE6MDgGCSqGSIb3DQEJARYrYXV0\n\
+aG9yaXR5QGN5Y2xvbmVkZHNzZWN1cml0eS5hZGxpbmt0ZWNoLmNvbTCCASIwDQYJ\n\
+KoZIhvcNAQEBBQADggEPADCCAQoCggEBALKhk7JXUpqJphyOC6oOI00LH49WTtO2\n\
+GCgDyJhcRYYAm7APMtmEDH+zptvd34N4eSu03Dc65cB/XN4Lbi2TjolVvKz0hHjz\n\
+tzmQT5jTgb1UkJX4NjKGw+RrYe9Ls0kfoAL2kvb12kmd1Oj4TIKMZP9TCrz7Vw8m\n\
+cZKQxZ56bLys6cU2XdiTp3v+Ef/vMll4+DINj4ZAMWL3CkT+q1G6ZxHRpFlsIyhc\n\
+Q1wX6gxUoY6cQdBA7TehKCCEWz4L1KM1A18ZmCHmjTniU0ssLoiAzsQs4b6Fnw8Z\n\
+MLFj8ocwzN5g66gJJWGofakXqX/V24KbGl54WX2X7FYU0tGzR234DXcCAwEAAaNT\n\
+MFEwHQYDVR0OBBYEFGeCcK8B74QWCuuCjlSUzOBBUTF5MB8GA1UdIwQYMBaAFGeC\n\
+cK8B74QWCuuCjlSUzOBBUTF5MA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQEL\n\
+BQADggEBAJQeMc4XzMFnpQKCb58rzRs3Wt9FmZZS4O596sHxMEewTkEHm5gLYMzF\n\
+9JYEdUiLoTurQuIr0KgPi+Q3kliQdLfrVPbdWTmlUDZARR5ir5d1gGHST6qnb3Xi\n\
+mG+7nwle9R/hLrtPio+gYRgwJEiS55f6p0/E1wDcc+6numvjCRQ/CGIiJfwD/R+d\n\
+pv93YLEfuliZttfBc/apIu6OL4chxF+3QgSw1ltV5nXXqDTGHMRZENkp3Yiolumc\n\
+6smL4uA7Q812pVcENi3MLjdJgBS/8DcSBQHspVuXugaKKPDMkJnD0IyLWc8vLXh4\n\
+O7JdDrmusJAZA9RsTkinl3DuPfF34Sk=\n\
+-----END CERTIFICATE-----"
+
+
+#define TEST_IDENTITY2_CERTIFICATE "data:,-----BEGIN CERTIFICATE-----\n\
+MIIEDjCCAvYCFDEZQzcfGKK8IKNyH+AdNSjdyVgnMA0GCSqGSIb3DQEBCwUAMIHF\n\
+MQswCQYDVQQGEwJOTDELMAkGA1UECAwCT1YxFjAUBgNVBAcMDUxvY2FsaXR5IE5h\n\
+bWUxEzARBgNVBAsMCkV4YW1wbGUgT1UxJTAjBgNVBAoMHEV4YW1wbGUgSUQgQ0Eg\n\
+MiBPcmdhbml6YXRpb24xGDAWBgNVBAMMD0V4YW1wbGUgSUQgQ0EgMjE7MDkGCSqG\n\
+SIb3DQEJARYsYXV0aG9yaXR5MkBjeWNsb25lZGRzc2VjdXJpdHkuYWRsaW5rdGVj\n\
+aC5jb20wHhcNMjAwMjI3MTkyNjIwWhcNMzAwMjI0MTkyNjIwWjCBwDELMAkGA1UE\n\
+BhMCTkwxCzAJBgNVBAgMAk9WMRYwFAYDVQQHDA1Mb2NhbGl0eSBOYW1lMSEwHwYD\n\
+VQQLDBhPcmdhbml6YXRpb25hbCBVbml0IE5hbWUxHTAbBgNVBAoMFEV4YW1wbGUg\n\
+T3JnYW5pemF0aW9uMRQwEgYDVQQDDAtCb2IgRXhhbXBsZTE0MDIGCSqGSIb3DQEJ\n\
+ARYlYm9iQGN5Y2xvbmVkZHNzZWN1cml0eS5hZGxpbmt0ZWNoLmNvbTCCASIwDQYJ\n\
+KoZIhvcNAQEBBQADggEPADCCAQoCggEBAMAQM9eN0zjTTdZALCTijog0oqx/kqnW\n\
+VtVWjV/c34OyPvUuH/DNRH6Cr0fI76UiooLD9nfvHe52X8oZH8WqNW7m7g7dMliu\n\
+DJD3yVpdLRmTTgl40ES8MTqmdb2y8ut70MJf5nUz0EQs9lXvnT0ru0B2CfyubiPt\n\
+aLSfyDoVBkRLbfzeqaNEQe7Ta6mQKZOckb6BHcaInb9GYEsU+OyOHuf2tCVNnRIH\n\
+ALiTPbA7rRS/J7ICS904/qz7w6km9Ta/oYQI5n0np64L+HqgtYZgIlVURW9grg2p\n\
+BuaX+xnJdRZbLQ0YYs+Gpmc1Vnykd+c2b0KP7zyHf8WFk9vV5W1ah2sCAwEAATAN\n\
+BgkqhkiG9w0BAQsFAAOCAQEA1RHDhLZf/UOR+azuH2lvD7ioSGRtdaOdJchSPdMk\n\
+v1q74PsHgm4/QAadVPdzvaIVV9kDfo6kGMzh+dCtq69EqVOavw1WUDo/NfuVSbgA\n\
+W7yeA39o3ROMO9UgbE5T3BPLq/XSXdIisP9OA4uXCnt22JELJaSv4m59FHg5gnQ7\n\
+2qOWRM7hi/+cQwescE+lDRw7PUzW8SS1HkQA1DmdtIIpWVuvYj7EPUNQX3jIetn8\n\
+AuPUgPJObxJhxJSC4p5qy37pYZHiNH1wG/+BDHgZo3wNwFsWqxabKziGB8XU3INc\n\
+USI3GDWM2jjElMSnDCj4ChM5wFbwWrqwdOEzeGWBWbo3hQ==\n\
+-----END CERTIFICATE-----"
+
+#define TEST_IDENTITY2_PRIVATE_KEY "data:,-----BEGIN RSA PRIVATE KEY-----\n\
+MIIEpQIBAAKCAQEAwBAz143TONNN1kAsJOKOiDSirH+SqdZW1VaNX9zfg7I+9S4f\n\
+8M1EfoKvR8jvpSKigsP2d+8d7nZfyhkfxao1bubuDt0yWK4MkPfJWl0tGZNOCXjQ\n\
+RLwxOqZ1vbLy63vQwl/mdTPQRCz2Ve+dPSu7QHYJ/K5uI+1otJ/IOhUGREtt/N6p\n\
+o0RB7tNrqZApk5yRvoEdxoidv0ZgSxT47I4e5/a0JU2dEgcAuJM9sDutFL8nsgJL\n\
+3Tj+rPvDqSb1Nr+hhAjmfSenrgv4eqC1hmAiVVRFb2CuDakG5pf7Gcl1FlstDRhi\n\
+z4amZzVWfKR35zZvQo/vPId/xYWT29XlbVqHawIDAQABAoIBAFNm9cw15zI2+AcA\n\
+yOqfgzt8d+OmZl7gF8b+lde6B0meHp7Dj9U2nfa98zWd+QrhtmZIiH/eU0YZG1Gc\n\
+hWKFnjxxhZDo1xMRSZ2uLD7UVWBUyj9suiwO+OW6IUjmK3y8wJOXp3DftiHU0IfS\n\
+zJoiombEm2Ohr2xkjOJavE0UkisXQauc3K5AKv9coW9W6hzZf330Sm4sokmC5D3B\n\
+GcO/Keof2k2sFuv56wXPi9eGuXCEB2trhHhrxqncvb/fbRwpG1ELQsvZBnyuNNnY\n\
+FQcLYl52gkttP6EGvRPw1DFbQwsAJKnXBC7ddJaAl+JoKYAcGTt0+mRm0Z8ltzWl\n\
+c6uZQsECgYEA4NGiUMNq9kSn/6tQyPcsrphJ5uobu/svLaBipZ0vv2yQP3wQ5NPA\n\
+06KjwSm8gg8BLi0LCKplSxY09TwgUsc9unRkDTQ/eflgjdGA76lFKOjvLQdutxn7\n\
+eYNbx81WMY6E6n4y6K+2szpqW+Ds1At4ORRvweJWdFyc01bTqWNeuYsCgYEA2rOO\n\
+Ye6H2VixUfXzXwevBd4QyFJITW46WqnbYDFcUzf9pYBZfZoHU0YJqolDIhHhtHnG\n\
+soRi0Uk5P9D7Lvu+ZHAGQJrdmNELOMoqMNOqXcAdvK44qLLMwaLC8PS2zDIATrhZ\n\
+nc0TbeZJC8MynfIpxDsBVVMOa8u4eHRFdpk8ZaECgYEAlzuuCtJKQ7vPn2dpAqdz\n\
+gUekfxeA7KV+CR1Y/ruMgSLQrkQRQT1I+5Tuv2QKERty2dMnFv85AJfBrC50N/sb\n\
+hTAClfdNtAmTcBM8vvuJMInxSsMzMSzjQ8yfkvqIPvH2a5/VMz3wkwR6w6+84K+O\n\
+gidDPpO5QLGENY6097+G2x0CgYEAk7cdX0YGGaZPNiWiOLhu3c6slTEGRs5BucTq\n\
+OGF+k3LI7kTvrOchNXyjwLyvTE65nPV3YFIMkIEdmt3jGkvMv/fuMSqoq7PeGYBq\n\
+2MnOUz4Ul8Ew4bjKlasCck9HPEo1bPYVCYFfMyaMhdZU1NugnDqiXugXYHWb5jfa\n\
+Rw2e/qECgYEA3PvLLHklsRts6P37iSwUmDnkiopSSPfVdGXpDDGD/RbLpG6cSLRm\n\
+uh5n9+nxa2YXi0+LMLQvGpCSWk2k2qaRPpe2mahy9yAYrLhfDDcuGpSvw5BBJ3qw\n\
+mi1HgIUzXZTRBNamYCltJWYnN0hOlSL6vcHgeJ9y1gSDh0QqB2BG8HY=\n\
+-----END RSA PRIVATE KEY-----"
+
+
+#define TEST_IDENTITY_CA2_CERTIFICATE "data:,-----BEGIN CERTIFICATE-----\n\
+MIIEbTCCA1WgAwIBAgIUL0mSpPRgzveYTJ8UHSmOIwkIjjYwDQYJKoZIhvcNAQEL\n\
+BQAwgcUxCzAJBgNVBAYTAk5MMQswCQYDVQQIDAJPVjEWMBQGA1UEBwwNTG9jYWxp\n\
+dHkgTmFtZTETMBEGA1UECwwKRXhhbXBsZSBPVTElMCMGA1UECgwcRXhhbXBsZSBJ\n\
+RCBDQSAyIE9yZ2FuaXphdGlvbjEYMBYGA1UEAwwPRXhhbXBsZSBJRCBDQSAyMTsw\n\
+OQYJKoZIhvcNAQkBFixhdXRob3JpdHkyQGN5Y2xvbmVkZHNzZWN1cml0eS5hZGxp\n\
+bmt0ZWNoLmNvbTAeFw0yMDAyMjcxNjI3MjRaFw0zMDAyMjQxNjI3MjRaMIHFMQsw\n\
+CQYDVQQGEwJOTDELMAkGA1UECAwCT1YxFjAUBgNVBAcMDUxvY2FsaXR5IE5hbWUx\n\
+EzARBgNVBAsMCkV4YW1wbGUgT1UxJTAjBgNVBAoMHEV4YW1wbGUgSUQgQ0EgMiBP\n\
+cmdhbml6YXRpb24xGDAWBgNVBAMMD0V4YW1wbGUgSUQgQ0EgMjE7MDkGCSqGSIb3\n\
+DQEJARYsYXV0aG9yaXR5MkBjeWNsb25lZGRzc2VjdXJpdHkuYWRsaW5rdGVjaC5j\n\
+b20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDk+ewDf871kPgBqXkm\n\
+UEXdf/vqWWoKx3KfJ4N3Gq4vt/cDOMs0xakpqr5uxm787AvbOui4P8QmT8naLhAA\n\
+TvHtNGg2LV0ZQtLcVVFsXXsBYDUEbLJYmCBtJU8zSfLLzgtN+z9nVqLthAcVyGhZ\n\
+iEkCfXKS4XzwjFUxgrXUM1VSiHHz8DbreQFDTF8mVavZ75HjieuHz1OcSaoIHCIF\n\
+mhPDlxRR/qZpc3Y52NZMNRHVPj4Tmc3N4H2eneeoG7nVn0MgNuqbssezeQtUOOoH\n\
+DgPGp3xzd8XQxaF5hVIM9E7aL77kw5v4gwccjL5xWC72zzxC3c1ltmbaEcwhHGsu\n\
+MR4lAgMBAAGjUzBRMB0GA1UdDgQWBBTTpmGTY5teWrZBA8Sd7kL5Lg/JmjAfBgNV\n\
+HSMEGDAWgBTTpmGTY5teWrZBA8Sd7kL5Lg/JmjAPBgNVHRMBAf8EBTADAQH/MA0G\n\
+CSqGSIb3DQEBCwUAA4IBAQCbelDJr9sVsYgQSp4yzSOSop5DSOWCweBF56NatcbY\n\
+3HUYc4iaH4NcB04WFkUl2XmqVCAM0zbmV0q4HoQikTK5PBHmwxuuD2HhPDWtMeFR\n\
+W96BjzGVpV27yaNIPvLwjTVV+A72r4vRvufiFhrMCovRwlWgHY6+gXKfrtyljTZ0\n\
+m1mENHOJOQWDXFAXP5yiehSMKy/izKvQ1G1hLErYMMc+sdgF/9X2KaudnTakTW0d\n\
+44kXUFKSU7mqV44D12unxCNODclznd31tiJ+70U39AXlR2BzwBzyFzPCh5JYtMog\n\
+TwbdLY3LN40gpkDUxIIH115D7ujUKNd8s2gmSHOCm1ar\n\
+-----END CERTIFICATE-----"
+
+
+#endif /* PLUGIN_SECURITY_CORE_TEST_IDENTITY_H_ */
diff --git a/src/security/core/tests/config.c b/src/security/core/tests/config.c
new file mode 100644
index 0000000..6bfc918
--- /dev/null
+++ b/src/security/core/tests/config.c
@@ -0,0 +1,631 @@
+/*
+ * Copyright(c) 2006 to 2020 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+#include <stdlib.h>
+
+#include "dds/dds.h"
+#include "CUnit/Test.h"
+#include "dds/version.h"
+#include "dds/ddsrt/cdtors.h"
+#include "dds/ddsrt/environ.h"
+#include "dds/ddsrt/heap.h"
+#include "dds/ddsi/q_misc.h"
+#include "dds/ddsi/ddsi_xqos.h"
+#include "dds/security/dds_security_api_defs.h"
+#include "common/config_env.h"
+#include "common/test_identity.h"
+
+#define PROPLIST(init_auth, fin_auth, init_crypto, fin_crypto, init_ac, fin_ac, perm_ca, gov, perm, pre_str, post_str, binprops)         \
+  "property_list={" pre_str                                             \
+  "0:\"dds.sec.auth.library.path\":\""WRAPPERLIB_PATH("dds_security_authentication_wrapper")"\","                         \
+  "0:\"dds.sec.auth.library.init\":\""init_auth"\","            \
+  "0:\"dds.sec.auth.library.finalize\":\""fin_auth"\","    \
+  "0:\"dds.sec.crypto.library.path\":\""WRAPPERLIB_PATH("dds_security_cryptography_wrapper")"\","                     \
+  "0:\"dds.sec.crypto.library.init\":\""init_crypto"\","                  \
+  "0:\"dds.sec.crypto.library.finalize\":\""fin_crypto"\","          \
+  "0:\"dds.sec.access.library.path\":\""WRAPPERLIB_PATH("dds_security_access_control_wrapper")"\","                         \
+  "0:\"dds.sec.access.library.init\":\""init_ac"\","          \
+  "0:\"dds.sec.access.library.finalize\":\""fin_ac"\","  \
+  "0:\"dds.sec.auth.identity_ca\":\"" TEST_IDENTITY_CA_CERTIFICATE_DUMMY "\","  \
+  "0:\"dds.sec.auth.private_key\":\"" TEST_IDENTITY_PRIVATE_KEY_DUMMY "\","     \
+  "0:\"dds.sec.auth.identity_certificate\":\"" TEST_IDENTITY_CERTIFICATE_DUMMY "\"," \
+  "0:\"dds.sec.access.permissions_ca\":\""perm_ca"\","    \
+  "0:\"dds.sec.access.governance\":\""gov"\","            \
+  "0:\"dds.sec.access.permissions\":\""perm"\""           \
+  post_str "}:{" binprops "}"
+#define PARTICIPANT_QOS(init_auth, fin_auth, init_crypto, fin_crypto, init_ac, fin_ac, perm_ca, gov, perm, pre_str, post_str, binprops)  \
+  "PARTICIPANT * QOS={*" PROPLIST (init_auth, fin_auth, init_crypto, fin_crypto, init_ac, fin_ac, perm_ca, gov, perm, pre_str, post_str, binprops) "*"
+#define PARTICIPANT_QOS_ALL_OK(pre_str, post_str, binprops)             \
+  PARTICIPANT_QOS ("init_test_authentication_all_ok", "finalize_test_authentication_all_ok", \
+                   "init_test_cryptography_all_ok", "finalize_test_cryptography_all_ok", \
+                   "init_test_access_control_all_ok", "finalize_test_access_control_all_ok", \
+                   "file:Permissions_CA.pem", "file:Governance.p7s", "file:Permissions.p7s", \
+                   pre_str, post_str, binprops)
+
+/*
+ * The 'found' variable will contain flags related to the expected log
+ * messages that were received.
+ * Using flags will allow to show that when message isn't received,
+ * which one it was.
+ */
+static uint32_t found;
+
+static void logger(void *ptr, const dds_log_data_t *data)
+{
+  char **expected = (char**)ptr;
+  fputs (data->message, stdout);
+  for (uint32_t i = 0; expected[i] != NULL; i++) {
+    if (ddsi2_patmatch(expected[i], data->message)) {
+      found |= (uint32_t)(1 << i);
+    }
+  }
+}
+
+static void set_logger_exp(const void * log_expected)
+{
+  found = 0;
+  dds_set_log_mask(DDS_LC_FATAL|DDS_LC_ERROR|DDS_LC_WARNING|DDS_LC_CONFIG);
+  dds_set_log_sink(&logger, (void*)log_expected);
+  dds_set_trace_sink(&logger, (void*)log_expected);
+}
+
+static void reset_logger()
+{
+  dds_set_log_sink(NULL, NULL);
+  dds_set_trace_sink(NULL, NULL);
+}
+
+/* Expected traces when creating domain with an empty security element.  We need to
+   test this one here to be sure that it refuses to start when security is configured
+   but the implementation doesn't include support for it. */
+CU_Test(ddssec_config, empty, .init = ddsrt_init, .fini = ddsrt_fini)
+{
+  dds_entity_t domain;
+  const char *log_expected[] = {
+    "config: //CycloneDDS/Domain/DDSSecurity/Authentication/IdentityCertificate/#text: element missing in configuration*",
+    "config: //CycloneDDS/Domain/DDSSecurity/Authentication/IdentityCA/#text: element missing in configuration*",
+    "config: //CycloneDDS/Domain/DDSSecurity/Authentication/PrivateKey/#text: element missing in configuration*",
+    NULL
+  };
+
+  set_logger_exp(log_expected);
+  domain = dds_create_domain(0, "<DDSSecurity/>");
+  CU_ASSERT_EQUAL_FATAL(domain, DDS_RETCODE_ERROR);
+  reset_logger();
+
+  /* All traces should have been provided. */
+  CU_ASSERT_FATAL(found == 0x7);
+}
+
+/* Create domain without security element, there shouldn't
+   be traces that mention security. */
+CU_Test(ddssec_config, non, .init = ddsrt_init, .fini = ddsrt_fini)
+{
+  dds_entity_t domain;
+  const char *log_expected[] = {
+    "*Security*",
+    NULL
+  };
+
+  set_logger_exp(log_expected);
+  domain = dds_create_domain(0, "<Tracing><Verbosity>finest</></>");
+  CU_ASSERT_FATAL(domain > 0);
+  dds_delete(domain);
+  reset_logger();
+
+  /* No security traces should have been provided. */
+  CU_ASSERT_FATAL(found == 0x0);
+}
+
+/* Expected traces when creating domain with the security elements. */
+CU_Test(ddssec_config, missing, .init = ddsrt_init, .fini = ddsrt_fini)
+{
+  dds_entity_t domain;
+  const char *log_expected[] = {
+    "config: //CycloneDDS/Domain/DDSSecurity/Authentication/IdentityCertificate/#text: element missing in configuration*",
+    "config: //CycloneDDS/Domain/DDSSecurity/Authentication/IdentityCA/#text: element missing in configuration*",
+    "config: //CycloneDDS/Domain/DDSSecurity/Authentication/PrivateKey/#text: element missing in configuration*",
+    NULL
+  };
+
+  /* IdentityCertificate, IdentityCA and PrivateKey values or elements are missing. */
+  const char *sec_config =
+    "<Domain id=\"any\">"
+    "  <Tracing><Verbosity>finest</></>"
+    "  <DDSSecurity>"
+    "    <Authentication>"
+    "      <Library initFunction=\"init_test_authentication_all_ok\" finalizeFunction=\"finalize_test_authentication_all_ok\" path=\"" WRAPPERLIB_PATH("dds_security_authentication_wrapper") "\"/>"
+    "      <IdentityCertificate></IdentityCertificate>"
+    "      <PrivateKey></PrivateKey>"
+    "      <Password>testtext_Password_testtext</Password>"
+    "    </Authentication>"
+    "  </DDSSecurity>"
+    "</Domain>";
+
+  set_logger_exp(log_expected);
+  domain = dds_create_domain(0, sec_config);
+  CU_ASSERT_EQUAL_FATAL(domain, DDS_RETCODE_ERROR);
+  reset_logger();
+
+  /* All traces should have been provided. */
+  CU_ASSERT_FATAL(found == 0x7);
+}
+
+/* Expected traces when creating domain with the security elements. */
+CU_Test(ddssec_config, all, .init = ddsrt_init, .fini = ddsrt_fini)
+{
+  dds_entity_t domain, participant;
+  const char *log_expected[] = {
+    "config: Domain/DDSSecurity/Authentication/Library/#text: "WRAPPERLIB_PATH("dds_security_authentication_wrapper")"*",
+    "config: Domain/DDSSecurity/Authentication/Library[@path]: "WRAPPERLIB_PATH("dds_security_authentication_wrapper")"*",
+    "config: Domain/DDSSecurity/Authentication/Library[@initFunction]: init_test_authentication_all_ok*",
+    "config: Domain/DDSSecurity/Authentication/Library[@finalizeFunction]: finalize_test_authentication_all_ok*",
+    "config: Domain/DDSSecurity/Authentication/IdentityCertificate/#text: "TEST_IDENTITY_CERTIFICATE_DUMMY"*",
+    "config: Domain/DDSSecurity/Authentication/IdentityCA/#text: "TEST_IDENTITY_CA_CERTIFICATE_DUMMY"*",
+    "config: Domain/DDSSecurity/Authentication/PrivateKey/#text: "TEST_IDENTITY_PRIVATE_KEY_DUMMY"*",
+    "config: Domain/DDSSecurity/Authentication/Password/#text: testtext_Password_testtext*",
+    "config: Domain/DDSSecurity/Authentication/TrustedCADirectory/#text: testtext_Dir_testtext*",
+    "config: Domain/DDSSecurity/AccessControl/Library/#text: "WRAPPERLIB_PATH("dds_security_access_control_wrapper")"*",
+    "config: Domain/DDSSecurity/AccessControl/Library[@path]: "WRAPPERLIB_PATH("dds_security_access_control_wrapper")"*",
+    "config: Domain/DDSSecurity/AccessControl/Library[@initFunction]: init_test_access_control_all_ok*",
+    "config: Domain/DDSSecurity/AccessControl/Library[@finalizeFunction]: finalize_test_access_control_all_ok*",
+    "config: Domain/DDSSecurity/AccessControl/PermissionsCA/#text: file:Permissions_CA.pem*",
+    "config: Domain/DDSSecurity/AccessControl/Governance/#text: file:Governance.p7s*",
+    "config: Domain/DDSSecurity/AccessControl/Permissions/#text: file:Permissions.p7s*",
+    "config: Domain/DDSSecurity/Cryptographic/Library/#text: "WRAPPERLIB_PATH("dds_security_cryptography_wrapper")"*",
+    "config: Domain/DDSSecurity/Cryptographic/Library[@path]: "WRAPPERLIB_PATH("dds_security_cryptography_wrapper")"*",
+    "config: Domain/DDSSecurity/Cryptographic/Library[@initFunction]: init_test_cryptography_all_ok*",
+    "config: Domain/DDSSecurity/Cryptographic/Library[@finalizeFunction]: finalize_test_cryptography_all_ok*",
+    /* The config should have been parsed into the participant QoS. */
+    PARTICIPANT_QOS_ALL_OK ("", ",0:\"dds.sec.auth.password\":\"testtext_Password_testtext\",0:\"dds.sec.auth.trusted_ca_dir\":\"testtext_Dir_testtext\"", ""),
+    NULL
+  };
+
+  const char *sec_config =
+    "<"DDS_PROJECT_NAME">"
+    "  <Domain id=\"any\">"
+    "    <Tracing><Verbosity>finest</></>"
+    "    <DDSSecurity>"
+    "      <Authentication>"
+    "        <Library initFunction=\"init_test_authentication_all_ok\" finalizeFunction=\"finalize_test_authentication_all_ok\" path=\"" WRAPPERLIB_PATH("dds_security_authentication_wrapper") "\"/>"
+    "        <IdentityCertificate>"TEST_IDENTITY_CERTIFICATE_DUMMY"</IdentityCertificate>"
+    "        <IdentityCA>"TEST_IDENTITY_CA_CERTIFICATE_DUMMY"</IdentityCA>"
+    "        <PrivateKey>"TEST_IDENTITY_PRIVATE_KEY_DUMMY"</PrivateKey>"
+    "        <Password>testtext_Password_testtext</Password>"
+    "        <TrustedCADirectory>testtext_Dir_testtext</TrustedCADirectory>"
+    "      </Authentication>"
+    "      <Cryptographic>"
+    "        <Library initFunction=\"init_test_cryptography_all_ok\" finalizeFunction=\"finalize_test_cryptography_all_ok\" path=\"" WRAPPERLIB_PATH("dds_security_cryptography_wrapper") "\"/>"
+    "      </Cryptographic>"
+    "      <AccessControl>"
+    "        <Library initFunction=\"init_test_access_control_all_ok\" finalizeFunction=\"finalize_test_access_control_all_ok\" path=\"" WRAPPERLIB_PATH("dds_security_access_control_wrapper") "\"/>"
+    "        <Governance>file:Governance.p7s</Governance>"
+    "        <PermissionsCA>file:Permissions_CA.pem</PermissionsCA>"
+    "        <Permissions>file:Permissions.p7s</Permissions>"
+    "      </AccessControl>"
+    "    </DDSSecurity>"
+    "  </Domain>"
+    "</"DDS_PROJECT_NAME">";
+
+  set_logger_exp(log_expected);
+  domain = dds_create_domain(0, sec_config);
+  CU_ASSERT_FATAL(domain > 0);
+  participant = dds_create_participant(0, NULL, NULL);
+  CU_ASSERT_FATAL(participant > 0);
+  dds_delete(participant);
+  dds_delete(domain);
+  reset_logger();
+
+  /* All traces should have been provided. */
+  printf("found: %x\n", found);
+  CU_ASSERT_FATAL(found == 0x1fffff);
+}
+
+/* Expected traces when creating participant with the security elements. */
+CU_Test(ddssec_config, security, .init = ddsrt_init, .fini = ddsrt_fini)
+{
+  dds_entity_t domain, participant;
+  const char *log_expected[] = {
+    "config: Domain/DDSSecurity/Authentication/Library/#text: "WRAPPERLIB_PATH("dds_security_authentication_wrapper")"*",
+    "config: Domain/DDSSecurity/Authentication/Library[@path]: "WRAPPERLIB_PATH("dds_security_authentication_wrapper")"*",
+    "config: Domain/DDSSecurity/Authentication/Library[@initFunction]: init_test_authentication_all_ok*",
+    "config: Domain/DDSSecurity/Authentication/Library[@finalizeFunction]: finalize_test_authentication_all_ok*",
+    "config: Domain/DDSSecurity/Authentication/IdentityCertificate/#text: "TEST_IDENTITY_CERTIFICATE_DUMMY"*",
+    "config: Domain/DDSSecurity/Authentication/IdentityCA/#text: "TEST_IDENTITY_CA_CERTIFICATE_DUMMY"*",
+    "config: Domain/DDSSecurity/Authentication/PrivateKey/#text: "TEST_IDENTITY_PRIVATE_KEY_DUMMY"*",
+    "config: Domain/DDSSecurity/Authentication/Password/#text:  {}*",
+    "config: Domain/DDSSecurity/Authentication/TrustedCADirectory/#text:  {}*",
+    "config: Domain/DDSSecurity/AccessControl/Library/#text: "WRAPPERLIB_PATH("dds_security_access_control_wrapper")"*",
+    "config: Domain/DDSSecurity/AccessControl/Library[@path]: "WRAPPERLIB_PATH("dds_security_access_control_wrapper")"*",
+    "config: Domain/DDSSecurity/AccessControl/Library[@initFunction]: init_test_access_control_all_ok*",
+    "config: Domain/DDSSecurity/AccessControl/Library[@finalizeFunction]: finalize_test_access_control_all_ok*",
+    "config: Domain/DDSSecurity/AccessControl/PermissionsCA/#text: file:Permissions_CA.pem*",
+    "config: Domain/DDSSecurity/AccessControl/Governance/#text: file:Governance.p7s*",
+    "config: Domain/DDSSecurity/AccessControl/Permissions/#text: file:Permissions.p7s*",
+    "config: Domain/DDSSecurity/Cryptographic/Library/#text: "WRAPPERLIB_PATH("dds_security_cryptography_wrapper")"*",
+    "config: Domain/DDSSecurity/Cryptographic/Library[@path]: "WRAPPERLIB_PATH("dds_security_cryptography_wrapper")"*",
+    "config: Domain/DDSSecurity/Cryptographic/Library[@initFunction]: init_test_cryptography_all_ok*",
+    "config: Domain/DDSSecurity/Cryptographic/Library[@finalizeFunction]: finalize_test_cryptography_all_ok*",
+    /* The config should have been parsed into the participant QoS. */
+    PARTICIPANT_QOS_ALL_OK ("", ",0:\"dds.sec.auth.password\":\"\",0:\"dds.sec.auth.trusted_ca_dir\":\"\"", ""),
+    NULL
+  };
+
+  const char *sec_config =
+    "<Domain id=\"any\">"
+    "  <DDSSecurity>"
+    "    <Authentication>"
+    "      <Library initFunction=\"init_test_authentication_all_ok\" finalizeFunction=\"finalize_test_authentication_all_ok\" path=\"" WRAPPERLIB_PATH("dds_security_authentication_wrapper") "\"/>"
+    "      <IdentityCertificate>"TEST_IDENTITY_CERTIFICATE_DUMMY"</IdentityCertificate>"
+    "      <IdentityCA>"TEST_IDENTITY_CA_CERTIFICATE_DUMMY"</IdentityCA>"
+    "      <PrivateKey>"TEST_IDENTITY_PRIVATE_KEY_DUMMY"</PrivateKey>"
+    "    </Authentication>"
+    "    <Cryptographic>"
+    "      <Library initFunction=\"init_test_cryptography_all_ok\" finalizeFunction=\"finalize_test_cryptography_all_ok\" path=\"" WRAPPERLIB_PATH("dds_security_cryptography_wrapper") "\"/>"
+    "    </Cryptographic>"
+    "    <AccessControl>"
+    "      <Library initFunction=\"init_test_access_control_all_ok\" finalizeFunction=\"finalize_test_access_control_all_ok\" path=\"" WRAPPERLIB_PATH("dds_security_access_control_wrapper") "\"/>"
+    "      <Governance>file:Governance.p7s</Governance>"
+    "      <PermissionsCA>file:Permissions_CA.pem</PermissionsCA>"
+    "      <Permissions>file:Permissions.p7s</Permissions>"
+    "    </AccessControl>"
+    "  </DDSSecurity>"
+    "  <Tracing><Verbosity>finest</></>"
+    "</Domain>";
+
+  set_logger_exp(log_expected);
+  domain = dds_create_domain(0, sec_config);
+  CU_ASSERT_FATAL(domain > 0);
+  participant = dds_create_participant(0, NULL, NULL);
+  CU_ASSERT_FATAL(participant > 0);
+  dds_delete(participant);
+  dds_delete(domain);
+  reset_logger();
+
+  /* All traces should have been provided. */
+  CU_ASSERT_FATAL(found == 0x1fffff);
+}
+
+/* Expected traces when creating domain with the security elements. */
+CU_Test(ddssec_config, deprecated, .init = ddsrt_init, .fini = ddsrt_fini)
+{
+  dds_entity_t domain, participant;
+  const char *log_expected[] = {
+    "config: Domain/DDSSecurity/Authentication/Library/#text: "WRAPPERLIB_PATH("dds_security_authentication_wrapper")"*",
+    "config: Domain/DDSSecurity/Authentication/Library[@path]: "WRAPPERLIB_PATH("dds_security_authentication_wrapper")"*",
+    "config: Domain/DDSSecurity/Authentication/Library[@initFunction]: init_test_authentication_all_ok*",
+    "config: Domain/DDSSecurity/Authentication/Library[@finalizeFunction]: finalize_test_authentication_all_ok*",
+    "config: Domain/DDSSecurity/Authentication/IdentityCertificate/#text: "TEST_IDENTITY_CERTIFICATE_DUMMY"*",
+    "config: Domain/DDSSecurity/Authentication/IdentityCA/#text: "TEST_IDENTITY_CA_CERTIFICATE_DUMMY"*",
+    "config: Domain/DDSSecurity/Authentication/PrivateKey/#text: "TEST_IDENTITY_PRIVATE_KEY_DUMMY"*",
+    "config: Domain/DDSSecurity/Authentication/Password/#text: testtext_Password_testtext*",
+    "config: Domain/DDSSecurity/Authentication/TrustedCADirectory/#text: testtext_Dir_testtext*",
+    "config: Domain/DDSSecurity/AccessControl/Library/#text: "WRAPPERLIB_PATH("dds_security_access_control_wrapper")"*",
+    "config: Domain/DDSSecurity/AccessControl/Library[@path]: "WRAPPERLIB_PATH("dds_security_access_control_wrapper")"*",
+    "config: Domain/DDSSecurity/AccessControl/Library[@initFunction]: init_test_access_control_all_ok*",
+    "config: Domain/DDSSecurity/AccessControl/Library[@finalizeFunction]: finalize_test_access_control_all_ok*",
+    "config: Domain/DDSSecurity/AccessControl/PermissionsCA/#text: file:Permissions_CA.pem*",
+    "config: Domain/DDSSecurity/AccessControl/Governance/#text: file:Governance.p7s*",
+    "config: Domain/DDSSecurity/AccessControl/Permissions/#text: file:Permissions.p7s*",
+    "config: Domain/DDSSecurity/Cryptographic/Library/#text: "WRAPPERLIB_PATH("dds_security_cryptography_wrapper")"*",
+    "config: Domain/DDSSecurity/Cryptographic/Library[@path]: "WRAPPERLIB_PATH("dds_security_cryptography_wrapper")"*",
+    "config: Domain/DDSSecurity/Cryptographic/Library[@initFunction]: init_test_cryptography_all_ok*",
+    "config: Domain/DDSSecurity/Cryptographic/Library[@finalizeFunction]: finalize_test_cryptography_all_ok*",
+    /* The config should have been parsed into the participant QoS. */
+    PARTICIPANT_QOS_ALL_OK ("", ",0:\"dds.sec.auth.password\":\"testtext_Password_testtext\",0:\"dds.sec.auth.trusted_ca_dir\":\"testtext_Dir_testtext\"", ""),
+    NULL
+  };
+
+  const char *sec_config =
+    "<"DDS_PROJECT_NAME">"
+    "  <Domain id=\"any\">"
+    "    <DDSSecurity>"
+    "      <Authentication>"
+    "        <Library initFunction=\"init_test_authentication_all_ok\" finalizeFunction=\"finalize_test_authentication_all_ok\" path=\"" WRAPPERLIB_PATH("dds_security_authentication_wrapper") "\"/>"
+    "        <IdentityCertificate>"TEST_IDENTITY_CERTIFICATE_DUMMY"</IdentityCertificate>"
+    "        <IdentityCA>"TEST_IDENTITY_CA_CERTIFICATE_DUMMY"</IdentityCA>"
+    "        <PrivateKey>"TEST_IDENTITY_PRIVATE_KEY_DUMMY"</PrivateKey>"
+    "        <Password>testtext_Password_testtext</Password>"
+    "        <TrustedCADirectory>testtext_Dir_testtext</TrustedCADirectory>"
+    "      </Authentication>"
+    "      <Cryptographic>"
+    "        <Library initFunction=\"init_test_cryptography_all_ok\" finalizeFunction=\"finalize_test_cryptography_all_ok\" path=\"" WRAPPERLIB_PATH("dds_security_cryptography_wrapper") "\"/>"
+    "      </Cryptographic>"
+    "      <AccessControl>"
+    "        <Library initFunction=\"init_test_access_control_all_ok\" finalizeFunction=\"finalize_test_access_control_all_ok\" path=\"" WRAPPERLIB_PATH("dds_security_access_control_wrapper") "\"/>"
+    "        <Governance>file:Governance.p7s</Governance>"
+    "        <PermissionsCA>file:Permissions_CA.pem</PermissionsCA>"
+    "        <Permissions>file:Permissions.p7s</Permissions>"
+    "      </AccessControl>"
+    "    </DDSSecurity>"
+    "    <Tracing><Verbosity>finest</></>"
+    "  </Domain>"
+    "</"DDS_PROJECT_NAME">";
+
+  set_logger_exp(log_expected);
+  domain = dds_create_domain(0, sec_config);
+  CU_ASSERT_FATAL(domain > 0);
+  participant = dds_create_participant(0, NULL, NULL);
+  CU_ASSERT_FATAL(participant > 0);
+  dds_delete(participant);
+  dds_delete(domain);
+  reset_logger();
+
+  /* All traces should have been provided. */
+  CU_ASSERT_FATAL(found == 0x1fffff);
+}
+
+/* Expected traces when creating participant with the security elements. */
+CU_Test(ddssec_config, qos, .init = ddsrt_init, .fini = ddsrt_fini)
+{
+  dds_entity_t domain, participant;
+  dds_qos_t * qos;
+  const char *log_expected[] = {
+    /* The config should have been parsed into the participant QoS. */
+    PARTICIPANT_QOS_ALL_OK ("", ",0:\"dds.sec.auth.password\":\"testtext_Password_testtext\",0:\"dds.sec.auth.trusted_ca_dir\":\"file:/test/dir\"", ""),
+    NULL
+  };
+
+  /* Create the qos */
+  CU_ASSERT_FATAL((qos = dds_create_qos()) != NULL);
+  dds_qset_prop(qos, "dds.sec.auth.library.path", ""WRAPPERLIB_PATH("dds_security_authentication_wrapper")"");
+  dds_qset_prop(qos, "dds.sec.auth.library.init", "init_test_authentication_all_ok");
+  dds_qset_prop(qos, "dds.sec.auth.library.finalize", "finalize_test_authentication_all_ok");
+  dds_qset_prop(qos, "dds.sec.crypto.library.path", ""WRAPPERLIB_PATH("dds_security_cryptography_wrapper")"");
+  dds_qset_prop(qos, "dds.sec.crypto.library.init", "init_test_cryptography_all_ok");
+  dds_qset_prop(qos, "dds.sec.crypto.library.finalize", "finalize_test_cryptography_all_ok");
+  dds_qset_prop(qos, "dds.sec.access.library.path", ""WRAPPERLIB_PATH("dds_security_access_control_wrapper")"");
+  dds_qset_prop(qos, "dds.sec.access.library.init", "init_test_access_control_all_ok");
+  dds_qset_prop(qos, "dds.sec.access.library.finalize", "finalize_test_access_control_all_ok");
+  dds_qset_prop(qos, "dds.sec.auth.identity_ca", ""TEST_IDENTITY_CA_CERTIFICATE_DUMMY"");
+  dds_qset_prop(qos, "dds.sec.auth.private_key", ""TEST_IDENTITY_PRIVATE_KEY_DUMMY"");
+  dds_qset_prop(qos, "dds.sec.auth.identity_certificate", ""TEST_IDENTITY_CERTIFICATE_DUMMY"");
+  dds_qset_prop(qos, "dds.sec.access.permissions_ca", "file:Permissions_CA.pem");
+  dds_qset_prop(qos, "dds.sec.access.governance", "file:Governance.p7s");
+  dds_qset_prop(qos, "dds.sec.access.permissions", "file:Permissions.p7s");
+  dds_qset_prop(qos, "dds.sec.auth.password", "testtext_Password_testtext");
+  dds_qset_prop(qos, "dds.sec.auth.trusted_ca_dir", "file:/test/dir");
+
+  set_logger_exp(log_expected);
+  domain = dds_create_domain(0, "<Tracing><Verbosity>finest</></>");
+  CU_ASSERT_FATAL(domain > 0);
+  participant = dds_create_participant(0, qos, NULL);
+  CU_ASSERT_FATAL(participant > 0);
+  dds_delete(participant);
+  dds_delete_qos(qos);
+  dds_delete(domain);
+  reset_logger();
+
+  /* All traces should have been provided. */
+  CU_ASSERT_FATAL(found == 0x1);
+}
+
+/* Expected traces when creating participant with the security elements. */
+CU_Test(ddssec_config, qos_props, .init = ddsrt_init, .fini = ddsrt_fini)
+{
+  dds_entity_t domain, participant;
+  dds_qos_t * qos;
+  const char *log_expected[] = {
+    /* The config should have been parsed into the participant QoS. */
+    PARTICIPANT_QOS_ALL_OK ("", ",0:\"dds.sec.auth.password\":\"testtext_Password_testtext\",0:\"dds.sec.auth.trusted_ca_dir\":\"file:/test/dir\",0:\"test.prop1\":\"testtext_value1_testtext\",0:\"test.prop2\":\"testtext_value2_testtext\"",
+                            "0:\"test.bprop1\":3<1,2,3>"),
+    NULL
+  };
+
+  /* Create the qos */
+  unsigned char bvalue[3] = { 0x01, 0x02, 0x03 };
+  CU_ASSERT_FATAL((qos = dds_create_qos()) != NULL);
+  dds_qset_prop(qos, "dds.sec.auth.library.path", ""WRAPPERLIB_PATH("dds_security_authentication_wrapper")"");
+  dds_qset_prop(qos, "dds.sec.auth.library.init", "init_test_authentication_all_ok");
+  dds_qset_prop(qos, "dds.sec.auth.library.finalize", "finalize_test_authentication_all_ok");
+  dds_qset_prop(qos, "dds.sec.crypto.library.path", ""WRAPPERLIB_PATH("dds_security_cryptography_wrapper")"");
+  dds_qset_prop(qos, "dds.sec.crypto.library.init", "init_test_cryptography_all_ok");
+  dds_qset_prop(qos, "dds.sec.crypto.library.finalize", "finalize_test_cryptography_all_ok");
+  dds_qset_prop(qos, "dds.sec.access.library.path", ""WRAPPERLIB_PATH("dds_security_access_control_wrapper")"");
+  dds_qset_prop(qos, "dds.sec.access.library.init", "init_test_access_control_all_ok");
+  dds_qset_prop(qos, "dds.sec.access.library.finalize", "finalize_test_access_control_all_ok");
+  dds_qset_prop(qos, "dds.sec.auth.identity_ca", TEST_IDENTITY_CA_CERTIFICATE_DUMMY);
+  dds_qset_prop(qos, "dds.sec.auth.private_key", TEST_IDENTITY_PRIVATE_KEY_DUMMY);
+  dds_qset_prop(qos, "dds.sec.auth.identity_certificate", TEST_IDENTITY_CERTIFICATE_DUMMY);
+  dds_qset_prop(qos, "dds.sec.access.permissions_ca", "file:Permissions_CA.pem");
+  dds_qset_prop(qos, "dds.sec.access.governance", "file:Governance.p7s");
+  dds_qset_prop(qos, "dds.sec.access.permissions", "file:Permissions.p7s");
+  dds_qset_prop(qos, "dds.sec.auth.password", "testtext_Password_testtext");
+  dds_qset_prop(qos, "dds.sec.auth.trusted_ca_dir", "file:/test/dir");
+  dds_qset_prop(qos, "test.prop1", "testtext_value1_testtext");
+  dds_qset_prop(qos, "test.prop2", "testtext_value2_testtext");
+  dds_qset_bprop(qos, "test.bprop1", bvalue, 3);
+
+  set_logger_exp(log_expected);
+  domain = dds_create_domain(0, "<Tracing><Verbosity>finest</></>");
+  CU_ASSERT_FATAL(domain > 0);
+  participant = dds_create_participant(0, qos, NULL);
+  CU_ASSERT_FATAL(participant > 0);
+  dds_delete(participant);
+  dds_delete_qos(qos);
+  dds_delete(domain);
+  reset_logger();
+
+  /* All traces should have been provided. */
+  CU_ASSERT_FATAL(found == 0x1);
+}
+
+/* Expect qos settings used when creating participant with config security elements and qos. */
+CU_Test(ddssec_config, config_qos, .init = ddsrt_init, .fini = ddsrt_fini)
+{
+  dds_entity_t domain, participant;
+  dds_qos_t * qos;
+  const char *log_expected[] = {
+    /* The security settings from qos properties should have been parsed into the participant QoS. */
+    "new_participant(*): using security settings from QoS*",
+    PARTICIPANT_QOS ("init_test_authentication_all_ok", "finalize_test_authentication_all_ok", \
+                   "init_test_cryptography_all_ok", "finalize_test_cryptography_all_ok", \
+                   "init_test_access_control_all_ok", "finalize_test_access_control_all_ok", \
+                   "file:QOS_Permissions_CA.pem", "file:QOS_Governance.p7s", "file:QOS_Permissions.p7s", \
+                   "", "", ""),
+    NULL
+  };
+
+  const char *sec_config =
+    "<Tracing><Verbosity>finest</></>"
+    "<DDSSecurity>"
+    "  <Authentication>"
+    "    <IdentityCertificate>"TEST_IDENTITY_CERTIFICATE_DUMMY"</IdentityCertificate>"
+    "    <IdentityCA>"TEST_IDENTITY_CA_CERTIFICATE_DUMMY"</IdentityCA>"
+    "    <PrivateKey>"TEST_IDENTITY_PRIVATE_KEY_DUMMY"</PrivateKey>"
+    "  </Authentication>"
+    "  <AccessControl>"
+    "    <Governance>file:Governance.p7s</Governance>"
+    "    <PermissionsCA>file:Permissions_CA.pem</PermissionsCA>"
+    "    <Permissions>file:Permissions.p7s</Permissions>"
+    "  </AccessControl>"
+    "</DDSSecurity>";
+
+  CU_ASSERT_FATAL((qos = dds_create_qos()) != NULL);
+  dds_qset_prop(qos, DDS_SEC_PROP_AUTH_LIBRARY_PATH, WRAPPERLIB_PATH("dds_security_authentication_wrapper"));
+  dds_qset_prop(qos, DDS_SEC_PROP_AUTH_LIBRARY_INIT, "init_test_authentication_all_ok");
+  dds_qset_prop(qos, DDS_SEC_PROP_AUTH_LIBRARY_FINALIZE, "finalize_test_authentication_all_ok");
+  dds_qset_prop(qos, DDS_SEC_PROP_CRYPTO_LIBRARY_PATH, WRAPPERLIB_PATH("dds_security_cryptography_wrapper"));
+  dds_qset_prop(qos, DDS_SEC_PROP_CRYPTO_LIBRARY_INIT, "init_test_cryptography_all_ok");
+  dds_qset_prop(qos, DDS_SEC_PROP_CRYPTO_LIBRARY_FINALIZE, "finalize_test_cryptography_all_ok");
+  dds_qset_prop(qos, DDS_SEC_PROP_ACCESS_LIBRARY_PATH, WRAPPERLIB_PATH("dds_security_access_control_wrapper"));
+  dds_qset_prop(qos, DDS_SEC_PROP_ACCESS_LIBRARY_INIT, "init_test_access_control_all_ok");
+  dds_qset_prop(qos, DDS_SEC_PROP_ACCESS_LIBRARY_FINALIZE, "finalize_test_access_control_all_ok");
+  dds_qset_prop(qos, "dds.sec.auth.identity_ca", TEST_IDENTITY_CA_CERTIFICATE_DUMMY);
+  dds_qset_prop(qos, "dds.sec.auth.private_key", TEST_IDENTITY_PRIVATE_KEY_DUMMY);
+  dds_qset_prop(qos, "dds.sec.auth.identity_certificate", TEST_IDENTITY_CERTIFICATE_DUMMY);
+  dds_qset_prop(qos, "dds.sec.access.permissions_ca", "file:QOS_Permissions_CA.pem");
+  dds_qset_prop(qos, "dds.sec.access.governance", "file:QOS_Governance.p7s");
+  dds_qset_prop(qos, "dds.sec.access.permissions", "file:QOS_Permissions.p7s");
+
+  set_logger_exp(log_expected);
+  domain = dds_create_domain(0, sec_config);
+  CU_ASSERT_FATAL(domain > 0);
+  participant = dds_create_participant(0, qos, NULL);
+  CU_ASSERT_FATAL (participant > 0);
+  dds_delete(participant);
+  dds_delete_qos(qos);
+  dds_delete(domain);
+  reset_logger();
+
+  /* All traces should have been provided. */
+  CU_ASSERT_FATAL(found == 0x3);
+}
+
+/* Expect config used when creating participant with config security elements and
+   qos containing only non-security properties. */
+CU_Test(ddssec_config, other_prop, .init = ddsrt_init, .fini = ddsrt_fini)
+{
+  dds_entity_t domain, participant;
+  dds_qos_t * qos;
+  const char *log_expected[] = {
+    /* The security settings from config should have been parsed into the participant QoS. */
+    PARTICIPANT_QOS_ALL_OK ("0:\"test.dds.sec.prop1\":\"testtext_value1_testtext\",", ",0:\"dds.sec.auth.password\":\"testtext_Password_testtext\",0:\"dds.sec.auth.trusted_ca_dir\":\"testtext_Dir_testtext\"", ""),
+    NULL
+  };
+
+  const char *sec_config =
+    "<Tracing><Verbosity>finest</></>"
+    "<DDSSecurity>"
+    "  <Authentication>"
+    "    <Library initFunction=\"init_test_authentication_all_ok\" finalizeFunction=\"finalize_test_authentication_all_ok\" path=\"" WRAPPERLIB_PATH("dds_security_authentication_wrapper") "\"/>"
+    "    <IdentityCertificate>"TEST_IDENTITY_CERTIFICATE_DUMMY"</IdentityCertificate>"
+    "    <IdentityCA>"TEST_IDENTITY_CA_CERTIFICATE_DUMMY"</IdentityCA>"
+    "    <PrivateKey>"TEST_IDENTITY_PRIVATE_KEY_DUMMY"</PrivateKey>"
+    "    <Password>testtext_Password_testtext</Password>"
+    "    <TrustedCADirectory>testtext_Dir_testtext</TrustedCADirectory>"
+    "  </Authentication>"
+    "  <Cryptographic>"
+    "    <Library initFunction=\"init_test_cryptography_all_ok\" finalizeFunction=\"finalize_test_cryptography_all_ok\" path=\"" WRAPPERLIB_PATH("dds_security_cryptography_wrapper") "\"/>"
+    "  </Cryptographic>"
+    "  <AccessControl>"
+    "    <Library initFunction=\"init_test_access_control_all_ok\" finalizeFunction=\"finalize_test_access_control_all_ok\" path=\"" WRAPPERLIB_PATH("dds_security_access_control_wrapper") "\"/>"
+    "    <Governance>file:Governance.p7s</Governance>"
+    "    <PermissionsCA>file:Permissions_CA.pem</PermissionsCA>"
+    "    <Permissions>file:Permissions.p7s</Permissions>"
+    "  </AccessControl>"
+    "</DDSSecurity>";
+
+  CU_ASSERT_FATAL((qos = dds_create_qos()) != NULL);
+  dds_qset_prop(qos, "test.dds.sec.prop1", "testtext_value1_testtext");
+
+  set_logger_exp(log_expected);
+  domain = dds_create_domain(0, sec_config);
+  CU_ASSERT_FATAL(domain > 0);
+  participant = dds_create_participant(0, qos, NULL);
+  CU_ASSERT_FATAL (participant > 0);
+  dds_delete(participant);
+  dds_delete_qos(qos);
+  dds_delete(domain);
+  reset_logger();
+
+  /* All traces should have been provided. */
+  CU_ASSERT_FATAL(found == 0x1);
+}
+
+/* Expected traces when creating participant with the security elements. */
+CU_Test(ddssec_config, qos_invalid, .init = ddsrt_init, .fini = ddsrt_fini)
+{
+  dds_entity_t domain, participant;
+  dds_qos_t * qos;
+  const char *log_expected[] = {
+    /* The config should have been parsed into the participant QoS. */
+    "new_participant(*): using security settings from QoS*",
+    "new_participant(*): required security property dds.sec.auth.identity_ca missing in Property QoS*",
+    "new_participant(*): required security property dds.sec.auth.private_key missing in Property QoS*",
+    "new_participant(*): required security property dds.sec.auth.identity_certificate missing in Property QoS*",
+    "new_participant(*): required security property dds.sec.access.permissions_ca missing in Property QoS*",
+    "new_participant(*): required security property dds.sec.access.governance missing in Property QoS*",
+    "new_participant(*): required security property dds.sec.access.permissions missing in Property QoS*",
+    "new_participant(*): required security property dds.sec.auth.library.path missing in Property QoS*",
+    "new_participant(*): required security property dds.sec.auth.library.init missing in Property QoS*",
+    "new_participant(*): required security property dds.sec.auth.library.finalize missing in Property QoS*",
+    "new_participant(*): required security property dds.sec.crypto.library.path missing in Property QoS*",
+    "new_participant(*): required security property dds.sec.crypto.library.init missing in Property QoS*",
+    "new_participant(*): required security property dds.sec.crypto.library.finalize missing in Property QoS*",
+    "new_participant(*): required security property dds.sec.access.library.path missing in Property QoS*",
+    "new_participant(*): required security property dds.sec.access.library.init missing in Property QoS*",
+    "new_participant(*): required security property dds.sec.access.library.finalize missing in Property QoS*",
+    NULL
+  };
+
+  const char *sec_config =
+    "<Tracing><Verbosity>finest</></>"
+    "<DDSSecurity>"
+    "  <Authentication>"
+    "    <IdentityCertificate>"TEST_IDENTITY_CERTIFICATE_DUMMY"</IdentityCertificate>"
+    "    <IdentityCA>"TEST_IDENTITY_CA_CERTIFICATE_DUMMY"</IdentityCA>"
+    "    <PrivateKey>"TEST_IDENTITY_PRIVATE_KEY_DUMMY"</PrivateKey>"
+    "  </Authentication>"
+    "  <AccessControl>"
+    "    <Governance>file:Governance.p7s</Governance>"
+    "    <PermissionsCA>file:Permissions_CA.pem</PermissionsCA>"
+    "    <Permissions>file:Permissions.p7s</Permissions>"
+    "  </AccessControl>"
+    "</DDSSecurity>";
+
+  set_logger_exp(log_expected);
+
+  CU_ASSERT_FATAL((qos = dds_create_qos()) != NULL);
+  dds_qset_prop(qos, "dds.sec.dummy", "testtext_dummy_testtext");
+
+  /* Create participant with security config in qos. */
+  domain = dds_create_domain(0, sec_config);
+  CU_ASSERT_FATAL(domain > 0);
+  participant = dds_create_participant(0, qos, NULL);
+  CU_ASSERT_EQUAL_FATAL(participant, DDS_RETCODE_ERROR);
+  dds_delete_qos(qos);
+  dds_delete(domain);
+  reset_logger();
+
+  /* All traces should have been provided. */
+  CU_ASSERT_FATAL(found == 0xffff);
+}
diff --git a/src/security/core/tests/dds_security_core.c b/src/security/core/tests/dds_security_core.c
index ac494c2..aef1e4f 100644
--- a/src/security/core/tests/dds_security_core.c
+++ b/src/security/core/tests/dds_security_core.c
@@ -291,7 +291,7 @@ CU_Test(dds_security_timed_cb, test_create_dispatcher)
     /*************************************************************************
      * Check if adding callbacks succeeds
      *************************************************************************/
-    
+
     /* The last argument is a sequence number in which
      * the callbacks are expected to be called. */
     /* We can only really check if it crashes or not... */
@@ -299,7 +299,7 @@ CU_Test(dds_security_timed_cb, test_create_dispatcher)
     dds_security_timed_dispatcher_add(tcb, d2, tc__callback, past,    (void*)0);
     dds_security_timed_dispatcher_add(tcb, d2, tc__callback, present, (void*)2);
     dds_security_timed_dispatcher_add(tcb, d1, tc__callback, future,  (void*)7);
-        
+
     CU_PASS("Added callbacks")
 
     /*************************************************************************
@@ -308,7 +308,7 @@ CU_Test(dds_security_timed_cb, test_create_dispatcher)
     d3 = dds_security_timed_dispatcher_new(tcb);
     d4 = dds_security_timed_dispatcher_new(tcb);
     d5 = dds_security_timed_dispatcher_new(tcb);
-    
+
     CU_ASSERT_PTR_NOT_NULL_FATAL(d3);
     CU_ASSERT_PTR_NOT_NULL_FATAL(d4);
     CU_ASSERT_PTR_NOT_NULL_FATAL(d5);
@@ -351,7 +351,7 @@ CU_Test(dds_security_timed_cb, test_create_dispatcher)
     /*************************************************************************
      * Check if timeout callbacks are triggered in the right sequence
      *************************************************************************/
-    
+
     int idx;
     int timeout = 200; /* 2 seconds */
 
diff --git a/src/security/core/tests/handshake.c b/src/security/core/tests/handshake.c
new file mode 100644
index 0000000..6de2876
--- /dev/null
+++ b/src/security/core/tests/handshake.c
@@ -0,0 +1,99 @@
+/*
+ * Copyright(c) 2006 to 2020 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+#include <stdlib.h>
+#include <assert.h>
+
+#include "dds/dds.h"
+#include "CUnit/Test.h"
+
+#include "dds/version.h"
+#include "dds/ddsrt/cdtors.h"
+#include "dds/ddsrt/environ.h"
+#include "dds/ddsrt/heap.h"
+#include "dds/ddsrt/string.h"
+#include "dds/ddsi/q_config.h"
+#include "dds/ddsi/ddsi_domaingv.h"
+#include "dds/ddsi/q_misc.h"
+#include "dds/ddsi/ddsi_xqos.h"
+
+#include "dds/security/dds_security_api.h"
+
+#include "common/config_env.h"
+#include "common/authentication_wrapper.h"
+#include "common/plugin_wrapper_msg_q.h"
+#include "common/handshake_test_utils.h"
+#include "common/test_identity.h"
+
+static const char *config =
+    "${CYCLONEDDS_URI}${CYCLONEDDS_URI:+,}"
+    "<Discovery><ExternalDomainId>0</ExternalDomainId></Discovery>"
+    "<Domain id=\"any\">"
+    "  <Tracing><Verbosity>finest</></>"
+    "  <DDSSecurity>"
+    "    <Authentication>"
+    "      <Library finalizeFunction=\"finalize_test_authentication_wrapped\" initFunction=\"init_test_authentication_wrapped\" path=\"" WRAPPERLIB_PATH("dds_security_authentication_wrapper") "\"/>"
+    "      <IdentityCertificate>"TEST_IDENTITY_CERTIFICATE"</IdentityCertificate>"
+    "      <PrivateKey>"TEST_IDENTITY_PRIVATE_KEY"</PrivateKey>"
+    "      <IdentityCA>"TEST_IDENTITY_CA_CERTIFICATE"</IdentityCA>"
+    "      <Password>testtext_Password_testtext</Password>"
+    "      <TrustedCADirectory>.</TrustedCADirectory>"
+    "    </Authentication>"
+    "    <AccessControl>"
+    "      <Library finalizeFunction=\"finalize_access_control\" initFunction=\"init_access_control\"/>"
+    "      <Governance>file:" COMMON_ETC_PATH("default_governance.p7s") "</Governance>"
+    "      <PermissionsCA>file:" COMMON_ETC_PATH("default_permissions_ca.pem") "</PermissionsCA>"
+    "      <Permissions>file:" COMMON_ETC_PATH("default_permissions.p7s") "</Permissions>"
+    "    </AccessControl>"
+    "    <Cryptographic>"
+    "      <Library finalizeFunction=\"finalize_crypto\" initFunction=\"init_crypto\"/>"
+    "    </Cryptographic>"
+    "  </DDSSecurity>"
+    "</Domain>";
+
+#define DDS_DOMAINID_PART1 0
+#define DDS_DOMAINID_PART2 1
+
+static dds_entity_t g_part1_domain = 0;
+static dds_entity_t g_part1_participant = 0;
+
+static dds_entity_t g_part2_domain = 0;
+static dds_entity_t g_part2_participant = 0;
+
+static void handshake_init(void)
+{
+  /* Domains for pub and sub use a different domain id, but the portgain setting
+   * in configuration is 0, so that both domains will map to the same port number.
+   * This allows to create two domains in a single test process. */
+  char *conf_part1 = ddsrt_expand_envvars(config, DDS_DOMAINID_PART1);
+  char *conf_part2 = ddsrt_expand_envvars(config, DDS_DOMAINID_PART2);
+  g_part1_domain = dds_create_domain(DDS_DOMAINID_PART1, conf_part1);
+  g_part2_domain = dds_create_domain(DDS_DOMAINID_PART2, conf_part2);
+  dds_free(conf_part1);
+  dds_free(conf_part2);
+
+  CU_ASSERT_FATAL((g_part1_participant = dds_create_participant(DDS_DOMAINID_PART1, NULL, NULL)) > 0);
+  CU_ASSERT_FATAL((g_part2_participant = dds_create_participant(DDS_DOMAINID_PART2, NULL, NULL)) > 0);
+}
+
+static void handshake_fini(void)
+{
+  CU_ASSERT_EQUAL_FATAL(dds_delete(g_part1_participant), DDS_RETCODE_OK);
+  CU_ASSERT_EQUAL_FATAL(dds_delete(g_part2_participant), DDS_RETCODE_OK);
+  CU_ASSERT_EQUAL_FATAL(dds_delete(g_part1_domain), DDS_RETCODE_OK);
+  CU_ASSERT_EQUAL_FATAL(dds_delete(g_part2_domain), DDS_RETCODE_OK);
+}
+
+CU_Test(ddssec_handshake, happy_day, .init = handshake_init, .fini = handshake_fini)
+{
+  validate_handshake(DDS_DOMAINID_PART1, false, NULL, false, NULL);
+  validate_handshake(DDS_DOMAINID_PART2, false, NULL, false, NULL);
+}
diff --git a/src/security/core/tests/plugin_loading.c b/src/security/core/tests/plugin_loading.c
new file mode 100644
index 0000000..f6aa141
--- /dev/null
+++ b/src/security/core/tests/plugin_loading.c
@@ -0,0 +1,646 @@
+/*
+ * Copyright(c) 2006 to 2019 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+#include <stdlib.h>
+#include "CUnit/Test.h"
+#include "dds/dds.h"
+#include "dds/ddsrt/cdtors.h"
+#include "dds/ddsrt/environ.h"
+#include "dds/ddsrt/heap.h"
+#include "dds/ddsi/q_misc.h"
+#include "dds/security/dds_security_api_defs.h"
+#include "common/config_env.h"
+#include "common/test_identity.h"
+
+#define MAX_PARTICIPANTS_VARIABLE "MAX_PARTICIPANTS"
+
+static uint32_t found;
+
+static void logger(void *ptr, const dds_log_data_t *data)
+{
+  char **expected = (char **)ptr;
+  fputs(data->message, stdout);
+  for (uint32_t i = 0; expected[i] != NULL; i++)
+  {
+    if (ddsi2_patmatch(expected[i], data->message))
+    {
+      found |= (uint32_t)(1 << i);
+    }
+  }
+}
+
+static void set_logger_exp(const void *log_expected)
+{
+  found = 0;
+  dds_set_log_mask(DDS_LC_FATAL | DDS_LC_ERROR | DDS_LC_WARNING | DDS_LC_CONFIG);
+  dds_set_log_sink(&logger, (void *)log_expected);
+  dds_set_trace_sink(&logger, (void *)log_expected);
+}
+
+static void reset_logger()
+{
+  dds_set_log_sink(NULL, NULL);
+  dds_set_trace_sink(NULL, NULL);
+}
+
+CU_Test(ddssec_security_plugin_loading, all_ok, .init = ddsrt_init, .fini = ddsrt_fini)
+{
+  dds_entity_t domain, participant;
+  const char *log_expected[] = {
+      "DDS Security plugins have been loaded*",
+      NULL};
+
+  const char *sec_config =
+      "<Domain id=\"any\">"
+      "  <Tracing><Verbosity>finest</></>"
+      "  <DDSSecurity>"
+      "    <Authentication>"
+      "      <Library initFunction=\"init_test_authentication_all_ok\" finalizeFunction=\"finalize_test_authentication_all_ok\" path=\"" WRAPPERLIB_PATH("dds_security_authentication_wrapper") "\"/>"
+      "      <IdentityCertificate>"TEST_IDENTITY_CERTIFICATE_DUMMY"</IdentityCertificate>"
+      "      <IdentityCA>"TEST_IDENTITY_CA_CERTIFICATE_DUMMY"</IdentityCA>"
+      "      <PrivateKey>"TEST_IDENTITY_PRIVATE_KEY_DUMMY"</PrivateKey>"
+      "      <Password>testtext_Password_testtext</Password>"
+      "      <TrustedCADirectory>testtext_Dir_testtext</TrustedCADirectory>"
+      "    </Authentication>"
+      "    <Cryptographic>"
+      "      <Library initFunction=\"init_test_cryptography_all_ok\" finalizeFunction=\"finalize_test_cryptography_all_ok\" path=\"" WRAPPERLIB_PATH("dds_security_cryptography_wrapper") "\"/>"
+      "    </Cryptographic>"
+      "    <AccessControl>"
+      "      <Library initFunction=\"init_test_access_control_all_ok\" finalizeFunction=\"finalize_test_access_control_all_ok\" path=\"" WRAPPERLIB_PATH("dds_security_access_control_wrapper") "\"/>"
+      "      <Governance>file:Governance.p7s</Governance>"
+      "      <PermissionsCA>file:Permissions_CA.pem</PermissionsCA>"
+      "      <Permissions>file:Permissions.p7s</Permissions>"
+      "    </AccessControl>"
+      "  </DDSSecurity>"
+      "</Domain>";
+
+  set_logger_exp(log_expected);
+  domain = dds_create_domain(0, sec_config);
+  CU_ASSERT_FATAL(domain > 0);
+  participant = dds_create_participant(0, NULL, NULL);
+  CU_ASSERT_FATAL(participant > 0);
+  dds_delete(participant);
+  dds_delete(domain);
+  reset_logger();
+
+  CU_ASSERT_FATAL(found == 0x1);
+}
+
+CU_Test(ddssec_security_plugin_loading, missing_finalize, .init = ddsrt_init, .fini = ddsrt_fini)
+{
+  dds_entity_t domain, participant;
+  const char *log_expected[] = {
+      "Could not find the function: finalize_test_authentication_NON_EXISTING_FUNC*",
+      "Could not load Authentication plugin*",
+      NULL};
+
+  const char *sec_config =
+      "<Domain id=\"any\">"
+      "  <Tracing><Verbosity>finest</></>"
+      "  <DDSSecurity>"
+      "    <Authentication>"
+      "      <Library initFunction=\"init_test_authentication_all_ok\" finalizeFunction=\"finalize_test_authentication_NON_EXISTING_FUNC\" path=\"" WRAPPERLIB_PATH("dds_security_authentication_wrapper") "\"/>"
+      "      <IdentityCertificate>"TEST_IDENTITY_CERTIFICATE_DUMMY"</IdentityCertificate>"
+      "      <IdentityCA>"TEST_IDENTITY_CA_CERTIFICATE_DUMMY"</IdentityCA>"
+      "      <PrivateKey>"TEST_IDENTITY_PRIVATE_KEY_DUMMY"</PrivateKey>"
+      "      <Password>testtext_Password_testtext</Password>"
+      "      <TrustedCADirectory>testtext_Dir_testtext</TrustedCADirectory>"
+      "    </Authentication>"
+      "    <Cryptographic>"
+      "      <Library initFunction=\"init_test_cryptography_all_ok\" finalizeFunction=\"finalize_test_cryptography_all_ok\" path=\"" WRAPPERLIB_PATH("dds_security_cryptography_wrapper") "\"/>"
+      "    </Cryptographic>"
+      "    <AccessControl>"
+      "      <Library initFunction=\"init_test_access_control_all_ok\" finalizeFunction=\"finalize_test_access_control_all_ok\" path=\"" WRAPPERLIB_PATH("dds_security_access_control_wrapper") "\"/>"
+      "      <Governance>file:Governance.p7s</Governance>"
+      "      <PermissionsCA>file:Permissions_CA.pem</PermissionsCA>"
+      "      <Permissions>file:Permissions.p7s</Permissions>"
+      "    </AccessControl>"
+      "  </DDSSecurity>"
+      "</Domain>";
+
+  set_logger_exp(log_expected);
+  domain = dds_create_domain(0, sec_config);
+  CU_ASSERT_FATAL(domain > 0);
+  participant = dds_create_participant(0, NULL, NULL);
+  CU_ASSERT_EQUAL_FATAL(participant, DDS_RETCODE_ERROR);
+  dds_delete(domain);
+  reset_logger();
+
+  CU_ASSERT_FATAL(found == 0x3);
+}
+
+CU_Test(ddssec_security_plugin_loading, authentication_missing_function, .init = ddsrt_init, .fini = ddsrt_fini)
+{
+  dds_entity_t domain, participant;
+  const char *log_expected[] = {
+      "Could not find the function for Authentication: get_shared_secret*",
+      "Could not load security*",
+      NULL};
+
+  const char *sec_config =
+      "<Domain id=\"any\">"
+      "  <Tracing><Verbosity>finest</></>"
+      "  <DDSSecurity>"
+      "    <Authentication>"
+      "      <Library initFunction=\"init_test_authentication_missing_func\" finalizeFunction=\"finalize_test_authentication_missing_func\" path=\"" WRAPPERLIB_PATH("dds_security_authentication_wrapper") "\"/>"
+      "      <IdentityCertificate>"TEST_IDENTITY_CERTIFICATE_DUMMY"</IdentityCertificate>"
+      "      <IdentityCA>"TEST_IDENTITY_CA_CERTIFICATE_DUMMY"</IdentityCA>"
+      "      <PrivateKey>"TEST_IDENTITY_PRIVATE_KEY_DUMMY"</PrivateKey>"
+      "      <Password>testtext_Password_testtext</Password>"
+      "      <TrustedCADirectory>testtext_Dir_testtext</TrustedCADirectory>"
+      "    </Authentication>"
+      "    <Cryptographic>"
+      "      <Library initFunction=\"init_test_cryptography_all_ok\" finalizeFunction=\"finalize_test_cryptography_all_ok\" path=\"" WRAPPERLIB_PATH("dds_security_cryptography_wrapper") "\"/>"
+      "    </Cryptographic>"
+      "    <AccessControl>"
+      "      <Library initFunction=\"init_test_access_control_all_ok\" finalizeFunction=\"finalize_test_access_control_all_ok\" path=\"" WRAPPERLIB_PATH("dds_security_access_control_wrapper") "\"/>"
+      "      <Governance>file:Governance.p7s</Governance>"
+      "      <PermissionsCA>file:Permissions_CA.pem</PermissionsCA>"
+      "      <Permissions>file:Permissions.p7s</Permissions>"
+      "    </AccessControl>"
+      "  </DDSSecurity>"
+      "</Domain>";
+
+  set_logger_exp(log_expected);
+  domain = dds_create_domain(0, sec_config);
+  CU_ASSERT_FATAL(domain > 0);
+  participant = dds_create_participant(0, NULL, NULL);
+  CU_ASSERT_EQUAL_FATAL(participant, DDS_RETCODE_ERROR);
+  dds_delete(domain);
+  reset_logger();
+
+  CU_ASSERT_FATAL(found == 0x3);
+}
+
+CU_Test(ddssec_security_plugin_loading, access_control_missing_function, .init = ddsrt_init, .fini = ddsrt_fini)
+{
+  dds_entity_t domain, participant;
+  const char *log_expected[] = {
+      "Could not find the function for Access Control: check_create_datareader*",
+      "Could not load security*",
+      NULL};
+
+  const char *sec_config =
+      "<Domain id=\"any\">"
+      "  <Tracing><Verbosity>finest</></>"
+      "  <DDSSecurity>"
+      "    <Authentication>"
+      "      <Library initFunction=\"init_test_authentication_all_ok\" finalizeFunction=\"finalize_test_authentication_all_ok\" path=\"" WRAPPERLIB_PATH("dds_security_authentication_wrapper") "\"/>"
+      "      <IdentityCertificate>"TEST_IDENTITY_CERTIFICATE_DUMMY"</IdentityCertificate>"
+      "      <IdentityCA>"TEST_IDENTITY_CA_CERTIFICATE_DUMMY"</IdentityCA>"
+      "      <PrivateKey>"TEST_IDENTITY_PRIVATE_KEY_DUMMY"</PrivateKey>"
+      "      <Password>testtext_Password_testtext</Password>"
+      "      <TrustedCADirectory>testtext_Dir_testtext</TrustedCADirectory>"
+      "    </Authentication>"
+      "    <Cryptographic>"
+      "      <Library initFunction=\"init_test_cryptography_all_ok\" finalizeFunction=\"finalize_test_cryptography_all_ok\" path=\"" WRAPPERLIB_PATH("dds_security_cryptography_wrapper") "\"/>"
+      "    </Cryptographic>"
+      "    <AccessControl>"
+      "      <Library initFunction=\"init_test_access_control_missing_func\" finalizeFunction=\"finalize_test_access_control_missing_func\" path=\"" WRAPPERLIB_PATH("dds_security_access_control_wrapper") "\"/>"
+      "      <Governance>file:Governance.p7s</Governance>"
+      "      <PermissionsCA>file:Permissions_CA.pem</PermissionsCA>"
+      "      <Permissions>file:Permissions.p7s</Permissions>"
+      "    </AccessControl>"
+      "  </DDSSecurity>"
+      "</Domain>";
+
+  set_logger_exp(log_expected);
+  domain = dds_create_domain(0, sec_config);
+  CU_ASSERT_FATAL(domain > 0);
+  participant = dds_create_participant(0, NULL, NULL);
+  CU_ASSERT_EQUAL_FATAL(participant, DDS_RETCODE_ERROR);
+  dds_delete(domain);
+  reset_logger();
+
+  CU_ASSERT_FATAL(found == 0x3);
+}
+
+CU_Test(ddssec_security_plugin_loading, cryptography_missing_function, .init = ddsrt_init, .fini = ddsrt_fini)
+{
+  dds_entity_t domain, participant;
+  const char *log_expected[] = {
+      "Could not find the function for Cryptographic: set_remote_participant_crypto_tokens*",
+      "Could not load security*",
+      NULL};
+
+  const char *sec_config =
+      "<Domain id=\"any\">"
+      "  <Tracing><Verbosity>finest</></>"
+      "  <DDSSecurity>"
+      "    <Authentication>"
+      "      <Library initFunction=\"init_test_authentication_all_ok\" finalizeFunction=\"finalize_test_authentication_all_ok\" path=\"" WRAPPERLIB_PATH("dds_security_authentication_wrapper") "\"/>"
+      "      <IdentityCertificate>"TEST_IDENTITY_CERTIFICATE_DUMMY"</IdentityCertificate>"
+      "      <IdentityCA>"TEST_IDENTITY_CA_CERTIFICATE_DUMMY"</IdentityCA>"
+      "      <PrivateKey>"TEST_IDENTITY_PRIVATE_KEY_DUMMY"</PrivateKey>"
+      "      <Password>testtext_Password_testtext</Password>"
+      "      <TrustedCADirectory>testtext_Dir_testtext</TrustedCADirectory>"
+      "    </Authentication>"
+      "    <Cryptographic>"
+      "      <Library initFunction=\"init_test_cryptography_missing_func\" finalizeFunction=\"finalize_test_cryptography_missing_func\" path=\"" WRAPPERLIB_PATH("dds_security_cryptography_wrapper") "\"/>"
+      "    </Cryptographic>"
+      "    <AccessControl>"
+      "      <Library initFunction=\"init_test_access_control_all_ok\" finalizeFunction=\"finalize_test_access_control_all_ok\" path=\"" WRAPPERLIB_PATH("dds_security_access_control_wrapper") "\"/>"
+      "      <Governance>file:Governance.p7s</Governance>"
+      "      <PermissionsCA>file:Permissions_CA.pem</PermissionsCA>"
+      "      <Permissions>file:Permissions.p7s</Permissions>"
+      "    </AccessControl>"
+      "  </DDSSecurity>"
+      "</Domain>";
+
+  set_logger_exp(log_expected);
+  domain = dds_create_domain(0, sec_config);
+  CU_ASSERT_FATAL(domain > 0);
+  participant = dds_create_participant(0, NULL, NULL);
+  CU_ASSERT_EQUAL_FATAL(participant, DDS_RETCODE_ERROR);
+  dds_delete(domain);
+  reset_logger();
+
+  CU_ASSERT_FATAL(found == 0x3);
+}
+
+CU_Test(ddssec_security_plugin_loading, no_library_in_path, .init = ddsrt_init, .fini = ddsrt_fini)
+{
+  dds_entity_t domain, participant;
+  const char *log_expected[] = {
+      "Could not load Authentication library: " WRAPPERLIB_PATH("dds_security_authentication_wrapper_INVALID") ": cannot open shared object file: No such file or directory*",
+      "Could not load Authentication library: dlopen(" WRAPPERLIB_PATH("dds_security_authentication_wrapper_INVALID") "*",
+      "Could not load Authentication library: The specified module could not be found.*",
+      "Could not load Authentication plugin*",
+      "Could not load security*",
+      NULL};
+
+  const char *sec_config =
+      "<Domain id=\"any\">"
+      "  <Tracing><Verbosity>finest</></>"
+      "  <DDSSecurity>"
+      "    <Authentication>"
+      "      <Library initFunction=\"init_test_authentication_all_ok\" finalizeFunction=\"finalize_test_authentication_all_ok\" path=\"" WRAPPERLIB_PATH("dds_security_authentication_wrapper_INVALID") "\"/>"
+      "      <IdentityCertificate>"TEST_IDENTITY_CERTIFICATE_DUMMY"</IdentityCertificate>"
+      "      <IdentityCA>"TEST_IDENTITY_CA_CERTIFICATE_DUMMY"</IdentityCA>"
+      "      <PrivateKey>"TEST_IDENTITY_PRIVATE_KEY_DUMMY"</PrivateKey>"
+      "      <Password>testtext_Password_testtext</Password>"
+      "      <TrustedCADirectory>testtext_Dir_testtext</TrustedCADirectory>"
+      "    </Authentication>"
+      "    <Cryptographic>"
+      "      <Library initFunction=\"init_test_cryptography_all_ok\" finalizeFunction=\"finalize_test_cryptography_all_ok\" path=\"" WRAPPERLIB_PATH("dds_security_cryptography_wrapper") "\"/>"
+      "    </Cryptographic>"
+      "    <AccessControl>"
+      "      <Library initFunction=\"init_test_access_control_all_ok\" finalizeFunction=\"finalize_test_access_control_all_ok\" path=\"" WRAPPERLIB_PATH("dds_security_access_control_wrapper") "\"/>"
+      "      <Governance>file:Governance.p7s</Governance>"
+      "      <PermissionsCA>file:Permissions_CA.pem</PermissionsCA>"
+      "      <Permissions>file:Permissions.p7s</Permissions>"
+      "    </AccessControl>"
+      "  </DDSSecurity>"
+      "</Domain>";
+
+  set_logger_exp(log_expected);
+  domain = dds_create_domain(0, sec_config);
+  CU_ASSERT_FATAL(domain > 0);
+  participant = dds_create_participant(0, NULL, NULL);
+  CU_ASSERT_EQUAL_FATAL(participant, DDS_RETCODE_ERROR);
+  dds_delete(domain);
+  reset_logger();
+
+  CU_ASSERT_FATAL(found == 0x19 || found == 0x1a || found == 0x1c);
+}
+
+CU_Test(ddssec_security_plugin_loading, init_error, .init = ddsrt_init, .fini = ddsrt_fini)
+{
+  dds_entity_t domain, participant;
+  const char *log_expected[] = {
+      "Error occured while initializing Authentication plugin*",
+      "Could not load Authentication plugin*",
+      "Could not load security*",
+      NULL};
+
+  const char *sec_config =
+      "<Domain id=\"any\">"
+      "  <Tracing><Verbosity>finest</></>"
+      "  <DDSSecurity>"
+      "    <Authentication>"
+      "      <Library initFunction=\"init_test_authentication_init_error\" finalizeFunction=\"finalize_test_authentication_init_error\" path=\"" WRAPPERLIB_PATH("dds_security_authentication_wrapper") "\"/>"
+      "      <IdentityCertificate>"TEST_IDENTITY_CERTIFICATE_DUMMY"</IdentityCertificate>"
+      "      <IdentityCA>"TEST_IDENTITY_CA_CERTIFICATE_DUMMY"</IdentityCA>"
+      "      <PrivateKey>"TEST_IDENTITY_PRIVATE_KEY_DUMMY"</PrivateKey>"
+      "      <Password>testtext_Password_testtext</Password>"
+      "      <TrustedCADirectory>testtext_Dir_testtext</TrustedCADirectory>"
+      "    </Authentication>"
+      "    <Cryptographic>"
+      "      <Library initFunction=\"init_test_cryptography_all_ok\" finalizeFunction=\"finalize_test_cryptography_all_ok\" path=\"" WRAPPERLIB_PATH("dds_security_cryptography_wrapper") "\"/>"
+      "    </Cryptographic>"
+      "    <AccessControl>"
+      "      <Library initFunction=\"init_test_access_control_all_ok\" finalizeFunction=\"finalize_test_access_control_all_ok\" path=\"" WRAPPERLIB_PATH("dds_security_access_control_wrapper") "\"/>"
+      "      <Governance>file:Governance.p7s</Governance>"
+      "      <PermissionsCA>file:Permissions_CA.pem</PermissionsCA>"
+      "      <Permissions>file:Permissions.p7s</Permissions>"
+      "    </AccessControl>"
+      "  </DDSSecurity>"
+      "</Domain>";
+
+  set_logger_exp(log_expected);
+  domain = dds_create_domain(0, sec_config);
+  CU_ASSERT_FATAL(domain > 0);
+  participant = dds_create_participant(0, NULL, NULL);
+  CU_ASSERT_EQUAL_FATAL(participant, DDS_RETCODE_ERROR);
+  dds_delete(domain);
+  reset_logger();
+
+  CU_ASSERT_FATAL(found == 0x7);
+}
+
+CU_Test(ddssec_security_plugin_loading, all_ok_with_props, .init = ddsrt_init, .fini = ddsrt_fini)
+{
+  dds_entity_t domain, participant;
+  dds_qos_t *qos;
+  const char *log_expected[] = {
+      "DDS Security plugins have been loaded*",
+      NULL};
+
+  unsigned char bvalue[3] = {0x01, 0x02, 0x03};
+  CU_ASSERT_FATAL((qos = dds_create_qos()) != NULL);
+  dds_qset_prop(qos, "test.prop1", "testtext_value1_testtext");
+  dds_qset_prop(qos, DDS_SEC_PROP_AUTH_IDENTITY_CA, "testtext_IdentityCA_testtext");
+  dds_qset_prop(qos, DDS_SEC_PROP_AUTH_PRIV_KEY, "testtext_PrivateKey_testtext");
+  dds_qset_prop(qos, DDS_SEC_PROP_AUTH_IDENTITY_CERT, "testtext_IdentityCertificate_testtext");
+  dds_qset_prop(qos, DDS_SEC_PROP_ACCESS_PERMISSIONS_CA, "file:Permissions_CA.pem");
+  dds_qset_prop(qos, DDS_SEC_PROP_ACCESS_GOVERNANCE, "file:Governance.p7s");
+  dds_qset_prop(qos, DDS_SEC_PROP_ACCESS_PERMISSIONS, "file:Permissions.p7s");
+  dds_qset_prop(qos, DDS_SEC_PROP_AUTH_PASSWORD, "testtext_Password_testtext");
+  dds_qset_prop(qos, DDS_SEC_PROP_ACCESS_TRUSTED_CA_DIR, "file:/test/dir");
+
+  dds_qset_prop(qos, DDS_SEC_PROP_AUTH_LIBRARY_PATH, WRAPPERLIB_PATH("dds_security_authentication_wrapper"));
+  dds_qset_prop(qos, DDS_SEC_PROP_AUTH_LIBRARY_INIT, "init_test_authentication_all_ok");
+  dds_qset_prop(qos, DDS_SEC_PROP_AUTH_LIBRARY_FINALIZE, "finalize_test_authentication_all_ok");
+  dds_qset_prop(qos, DDS_SEC_PROP_CRYPTO_LIBRARY_PATH, WRAPPERLIB_PATH("dds_security_cryptography_wrapper"));
+  dds_qset_prop(qos, DDS_SEC_PROP_CRYPTO_LIBRARY_INIT, "init_test_cryptography_all_ok");
+  dds_qset_prop(qos, DDS_SEC_PROP_CRYPTO_LIBRARY_FINALIZE, "finalize_test_cryptography_all_ok");
+  dds_qset_prop(qos, DDS_SEC_PROP_ACCESS_LIBRARY_PATH, WRAPPERLIB_PATH("dds_security_access_control_wrapper"));
+  dds_qset_prop(qos, DDS_SEC_PROP_ACCESS_LIBRARY_INIT, "init_test_access_control_all_ok");
+  dds_qset_prop(qos, DDS_SEC_PROP_ACCESS_LIBRARY_FINALIZE, "finalize_test_access_control_all_ok");
+
+  dds_qset_prop(qos, "test.prop2", "testtext_value2_testtext");
+  dds_qset_prop(qos, DDS_SEC_PROP_AUTH_IDENTITY_CA, "testtext_IdentityCA_testtext");
+  dds_qset_bprop(qos, "test.bprop1", bvalue, 3);
+
+  set_logger_exp(log_expected);
+  domain = dds_create_domain(0, "<Tracing><Verbosity>finest</></>");
+  CU_ASSERT_FATAL(domain > 0);
+  participant = dds_create_participant(0, qos, NULL);
+  CU_ASSERT_FATAL(participant > 0);
+  dds_delete(participant);
+  dds_delete(domain);
+  dds_delete_qos(qos);
+  reset_logger();
+
+  CU_ASSERT_FATAL(found == 0x1);
+}
+
+CU_Test(ddssec_security_plugin_loading, missing_plugin_property_with_props, .init = ddsrt_init, .fini = ddsrt_fini)
+{
+  dds_entity_t domain, participant;
+  dds_qos_t *qos;
+  const char *log_expected[] = {
+      "*using security settings from QoS*",
+      "*required security property dds.sec.auth.library.init missing in Property QoS*",
+      NULL};
+
+  unsigned char bvalue[3] = {0x01, 0x02, 0x03};
+  CU_ASSERT_FATAL((qos = dds_create_qos()) != NULL);
+  dds_qset_prop(qos, "test.prop1", "testtext_value1_testtext");
+  dds_qset_prop(qos, DDS_SEC_PROP_AUTH_IDENTITY_CA, "testtext_IdentityCA_testtext");
+  dds_qset_prop(qos, DDS_SEC_PROP_AUTH_PRIV_KEY, "testtext_PrivateKey_testtext");
+  dds_qset_prop(qos, DDS_SEC_PROP_AUTH_IDENTITY_CERT, "testtext_IdentityCertificate_testtext");
+  dds_qset_prop(qos, DDS_SEC_PROP_ACCESS_PERMISSIONS_CA, "file:Permissions_CA.pem");
+  dds_qset_prop(qos, DDS_SEC_PROP_ACCESS_GOVERNANCE, "file:Governance.p7s");
+  dds_qset_prop(qos, DDS_SEC_PROP_ACCESS_PERMISSIONS, "file:Permissions.p7s");
+  dds_qset_prop(qos, DDS_SEC_PROP_AUTH_PASSWORD, "testtext_Password_testtext");
+  dds_qset_prop(qos, DDS_SEC_PROP_ACCESS_TRUSTED_CA_DIR, "file:/test/dir");
+
+  dds_qset_prop(qos, DDS_SEC_PROP_AUTH_LIBRARY_PATH, "dds_security_authentication_all_ok");
+  // missing: dds_qset_prop(qos, DDS_SEC_PROP_AUTH_LIBRARY_INIT, "init_authentication");
+  dds_qset_prop(qos, DDS_SEC_PROP_AUTH_LIBRARY_FINALIZE, "finalize_authentication");
+  dds_qset_prop(qos, DDS_SEC_PROP_CRYPTO_LIBRARY_PATH, "dds_security_cryptography_all_ok");
+  dds_qset_prop(qos, DDS_SEC_PROP_CRYPTO_LIBRARY_INIT, "init_crypto");
+  dds_qset_prop(qos, DDS_SEC_PROP_CRYPTO_LIBRARY_FINALIZE, "finalize_crypto");
+  dds_qset_prop(qos, DDS_SEC_PROP_ACCESS_LIBRARY_PATH, "dds_security_access_control_all_ok");
+  dds_qset_prop(qos, DDS_SEC_PROP_ACCESS_LIBRARY_INIT, "init_access_control");
+  dds_qset_prop(qos, DDS_SEC_PROP_ACCESS_LIBRARY_FINALIZE, "finalize_access_control");
+
+  dds_qset_prop(qos, "test.prop2", "testtext_value2_testtext");
+  dds_qset_prop(qos, DDS_SEC_PROP_AUTH_IDENTITY_CA, "testtext_IdentityCA_testtext");
+  dds_qset_bprop(qos, "test.bprop1", bvalue, 3);
+
+  set_logger_exp(log_expected);
+  domain = dds_create_domain(0, "<Tracing><Verbosity>finest</></>");
+  CU_ASSERT_FATAL(domain > 0);
+  participant = dds_create_participant(0, qos, NULL);
+  CU_ASSERT_EQUAL_FATAL(participant, DDS_RETCODE_ERROR);
+  dds_delete_qos(qos);
+  dds_delete(domain);
+  reset_logger();
+
+  CU_ASSERT_FATAL(found == 0x3);
+}
+
+CU_Test(ddssec_security_plugin_loading, empty_plugin_property_with_props, .init = ddsrt_init, .fini = ddsrt_fini)
+{
+  dds_entity_t domain, participant;
+  dds_qos_t *qos;
+  const char *log_expected[] = {
+      "*using security settings from QoS*",
+      "*required security property dds.sec.auth.library.finalize missing in Property QoS*",
+      NULL};
+
+  unsigned char bvalue[3] = {0x01, 0x02, 0x03};
+  CU_ASSERT_FATAL((qos = dds_create_qos()) != NULL);
+  dds_qset_prop(qos, "test.prop1", "testtext_value1_testtext");
+  dds_qset_prop(qos, DDS_SEC_PROP_AUTH_IDENTITY_CA, "testtext_IdentityCA_testtext");
+  dds_qset_prop(qos, DDS_SEC_PROP_AUTH_PRIV_KEY, "testtext_PrivateKey_testtext");
+  dds_qset_prop(qos, DDS_SEC_PROP_AUTH_IDENTITY_CERT, "testtext_IdentityCertificate_testtext");
+  dds_qset_prop(qos, DDS_SEC_PROP_ACCESS_PERMISSIONS_CA, "file:Permissions_CA.pem");
+  dds_qset_prop(qos, DDS_SEC_PROP_ACCESS_GOVERNANCE, "file:Governance.p7s");
+  dds_qset_prop(qos, DDS_SEC_PROP_ACCESS_PERMISSIONS, "file:Permissions.p7s");
+  dds_qset_prop(qos, DDS_SEC_PROP_AUTH_PASSWORD, "testtext_Password_testtext");
+  dds_qset_prop(qos, DDS_SEC_PROP_ACCESS_TRUSTED_CA_DIR, "file:/test/dir");
+
+  dds_qset_prop(qos, DDS_SEC_PROP_AUTH_LIBRARY_PATH, "dds_security_authentication_all_ok");
+  dds_qset_prop(qos, DDS_SEC_PROP_AUTH_LIBRARY_INIT, "init_authentication");
+  dds_qset_prop(qos, DDS_SEC_PROP_AUTH_LIBRARY_FINALIZE, "");
+  dds_qset_prop(qos, DDS_SEC_PROP_CRYPTO_LIBRARY_PATH, "dds_security_cryptography_all_ok");
+  dds_qset_prop(qos, DDS_SEC_PROP_CRYPTO_LIBRARY_INIT, "init_crypto");
+  dds_qset_prop(qos, DDS_SEC_PROP_CRYPTO_LIBRARY_FINALIZE, "finalize_crypto");
+  dds_qset_prop(qos, DDS_SEC_PROP_ACCESS_LIBRARY_PATH, "dds_security_access_control_all_ok");
+  dds_qset_prop(qos, DDS_SEC_PROP_ACCESS_LIBRARY_INIT, "init_access_control");
+  dds_qset_prop(qos, DDS_SEC_PROP_ACCESS_LIBRARY_FINALIZE, "finalize_access_control");
+
+  dds_qset_prop(qos, "test.prop2", "testtext_value2_testtext");
+  dds_qset_prop(qos, DDS_SEC_PROP_AUTH_IDENTITY_CA, "testtext_IdentityCA_testtext");
+  dds_qset_bprop(qos, "test.bprop1", bvalue, 3);
+
+  set_logger_exp(log_expected);
+  domain = dds_create_domain(0, "<Tracing><Verbosity>finest</></>");
+  CU_ASSERT_FATAL(domain > 0);
+  participant = dds_create_participant(DDS_DOMAIN_DEFAULT, qos, NULL);
+  CU_ASSERT_EQUAL_FATAL(participant, DDS_RETCODE_ERROR);
+  dds_delete_qos(qos);
+  dds_delete(domain);
+  reset_logger();
+
+  CU_ASSERT_FATAL(found == 0x3);
+}
+
+CU_Test(ddssec_security_plugin_loading, missing_security_property_with_props, .init = ddsrt_init, .fini = ddsrt_fini)
+{
+  dds_entity_t domain, participant;
+  dds_qos_t *qos;
+  const char *log_expected[] = {
+      "*using security settings from QoS*",
+      "*required security property dds.sec.access.permissions missing in Property QoS*",
+      NULL};
+
+  unsigned char bvalue[3] = {0x01, 0x02, 0x03};
+  CU_ASSERT_FATAL((qos = dds_create_qos()) != NULL);
+  dds_qset_prop(qos, "test.prop1", "testtext_value1_testtext");
+  dds_qset_prop(qos, DDS_SEC_PROP_AUTH_IDENTITY_CA, "testtext_IdentityCA_testtext");
+  dds_qset_prop(qos, DDS_SEC_PROP_AUTH_PRIV_KEY, "testtext_PrivateKey_testtext");
+  dds_qset_prop(qos, DDS_SEC_PROP_AUTH_IDENTITY_CERT, "testtext_IdentityCertificate_testtext");
+  dds_qset_prop(qos, DDS_SEC_PROP_ACCESS_PERMISSIONS_CA, "file:Permissions_CA.pem");
+  dds_qset_prop(qos, DDS_SEC_PROP_ACCESS_GOVERNANCE, "file:Governance.p7s");
+  /* we ignore permissions for testing
+  //dds_qset_prop (qos, DDS_SEC_PROP_ACCESS_PERMISSIONS, "file:Permissions.p7s"); */
+  dds_qset_prop(qos, DDS_SEC_PROP_AUTH_PASSWORD, "testtext_Password_testtext");
+  dds_qset_prop(qos, DDS_SEC_PROP_ACCESS_TRUSTED_CA_DIR, "file:/test/dir");
+
+  dds_qset_prop(qos, DDS_SEC_PROP_AUTH_LIBRARY_PATH, "dds_security_authentication_all_ok");
+  dds_qset_prop(qos, DDS_SEC_PROP_AUTH_LIBRARY_INIT, "init_authentication");
+  dds_qset_prop(qos, DDS_SEC_PROP_AUTH_LIBRARY_FINALIZE, "finalize_authentication");
+  dds_qset_prop(qos, DDS_SEC_PROP_CRYPTO_LIBRARY_PATH, "dds_security_cryptography_all_ok");
+  dds_qset_prop(qos, DDS_SEC_PROP_CRYPTO_LIBRARY_INIT, "init_crypto");
+  dds_qset_prop(qos, DDS_SEC_PROP_CRYPTO_LIBRARY_FINALIZE, "finalize_crypto");
+  dds_qset_prop(qos, DDS_SEC_PROP_ACCESS_LIBRARY_PATH, "dds_security_access_control_all_ok");
+  dds_qset_prop(qos, DDS_SEC_PROP_ACCESS_LIBRARY_INIT, "init_access_control");
+  dds_qset_prop(qos, DDS_SEC_PROP_ACCESS_LIBRARY_FINALIZE, "finalize_access_control");
+
+  dds_qset_prop(qos, "test.prop2", "testtext_value2_testtext");
+  dds_qset_prop(qos, DDS_SEC_PROP_AUTH_IDENTITY_CA, "testtext_IdentityCA_testtext");
+  dds_qset_bprop(qos, "test.bprop1", bvalue, 3);
+
+  set_logger_exp(log_expected);
+  domain = dds_create_domain(0, "<Tracing><Verbosity>finest</></>");
+  CU_ASSERT_FATAL(domain > 0);
+  participant = dds_create_participant(DDS_DOMAIN_DEFAULT, qos, NULL);
+  CU_ASSERT_EQUAL_FATAL(participant, DDS_RETCODE_ERROR);
+  dds_delete_qos(qos);
+  dds_delete(domain);
+  reset_logger();
+
+  CU_ASSERT_FATAL(found == 0x3);
+}
+
+CU_Test(ddssec_security_plugin_loading, multiple_domains_different_config, .init = ddsrt_init, .fini = ddsrt_fini)
+{
+  dds_entity_t domain1, domain2, participant1, participant2, participant3;
+  dds_qos_t *qos;
+  const char *log_expected[] = {
+      "*using security settings from configuration*",
+      "*using security settings from QoS*",
+      "DDS Security plugins have been loaded*",
+      "*security is already loaded for this domain*",
+      NULL};
+
+  const char *sec_config =
+      "<Domain id=\"1\">"
+      "  <Tracing><Verbosity>finest</></>"
+      "  <DDSSecurity>"
+      "    <Authentication>"
+      "      <Library initFunction=\"init_test_authentication_all_ok\" finalizeFunction=\"finalize_test_authentication_all_ok\" path=\"" WRAPPERLIB_PATH("dds_security_authentication_wrapper") "\"/>"
+      "      <IdentityCertificate>"TEST_IDENTITY_CERTIFICATE_DUMMY"</IdentityCertificate>"
+      "      <IdentityCA>"TEST_IDENTITY_CA_CERTIFICATE_DUMMY"</IdentityCA>"
+      "      <PrivateKey>"TEST_IDENTITY_PRIVATE_KEY_DUMMY"</PrivateKey>"
+      "      <Password>testtext_Password_testtext</Password>"
+      "      <TrustedCADirectory>testtext_Dir_testtext</TrustedCADirectory>"
+      "    </Authentication>"
+      "    <Cryptographic>"
+      "      <Library initFunction=\"init_test_cryptography_all_ok\" finalizeFunction=\"finalize_test_cryptography_all_ok\" path=\"" WRAPPERLIB_PATH("dds_security_cryptography_wrapper") "\"/>"
+      "    </Cryptographic>"
+      "    <AccessControl>"
+      "      <Library initFunction=\"init_test_access_control_all_ok\" finalizeFunction=\"finalize_test_access_control_all_ok\" path=\"" WRAPPERLIB_PATH("dds_security_access_control_wrapper") "\"/>"
+      "      <Governance>file:Governance.p7s</Governance>"
+      "      <PermissionsCA>file:Permissions_CA.pem</PermissionsCA>"
+      "      <Permissions>file:Permissions.p7s</Permissions>"
+      "    </AccessControl>"
+      "  </DDSSecurity>"
+      "</Domain>"
+      "<Domain id=\"2\">"
+      "  <Tracing><Verbosity>finest</></>"
+      "  <DDSSecurity>"
+      "    <Authentication>"
+      "      <Library initFunction=\"init_test_authentication_all_ok\" finalizeFunction=\"finalize_test_authentication_all_ok\" path=\"" WRAPPERLIB_PATH("dds_security_authentication_wrapper") "\"/>"
+      "      <IdentityCertificate>"TEST_IDENTITY_CERTIFICATE_DUMMY"</IdentityCertificate>"
+      "      <IdentityCA>"TEST_IDENTITY_CA_CERTIFICATE_DUMMY"</IdentityCA>"
+      "      <PrivateKey>"TEST_IDENTITY_PRIVATE_KEY_DUMMY"</PrivateKey>"
+      "      <Password>testtext_Password_testtext</Password>"
+      "      <TrustedCADirectory>testtext_Dir_testtext</TrustedCADirectory>"
+      "    </Authentication>"
+      "    <Cryptographic>"
+      "      <Library initFunction=\"init_test_cryptography_all_ok\" finalizeFunction=\"finalize_test_cryptography_all_ok\" path=\"" WRAPPERLIB_PATH("dds_security_cryptography_wrapper") "\"/>"
+      "    </Cryptographic>"
+      "    <AccessControl>"
+      "      <Library initFunction=\"init_test_access_control_all_ok\" finalizeFunction=\"finalize_test_access_control_all_ok\" path=\"" WRAPPERLIB_PATH("dds_security_access_control_wrapper") "\"/>"
+      "      <Governance>file:Governance.p7s</Governance>"
+      "      <PermissionsCA>file:Permissions_CA.pem</PermissionsCA>"
+      "      <Permissions>file:Permissions.p7s</Permissions>"
+      "    </AccessControl>"
+      "  </DDSSecurity>"
+      "</Domain>";
+
+  set_logger_exp(log_expected);
+
+  domain1 = dds_create_domain(1, sec_config);
+  CU_ASSERT_FATAL(domain1 > 0);
+  domain2 = dds_create_domain(2, sec_config);
+  CU_ASSERT_FATAL(domain2 > 0);
+
+  /* Create the qos */
+  CU_ASSERT_FATAL((qos = dds_create_qos()) != NULL);
+  dds_qset_prop(qos, DDS_SEC_PROP_AUTH_IDENTITY_CA, "testtext_IdentityCA_testtext");
+  dds_qset_prop(qos, DDS_SEC_PROP_AUTH_PRIV_KEY, "testtext_PrivateKey_testtext");
+  dds_qset_prop(qos, DDS_SEC_PROP_AUTH_IDENTITY_CERT, "testtext_IdentityCertificate_testtext");
+  dds_qset_prop(qos, DDS_SEC_PROP_ACCESS_PERMISSIONS_CA, "file:Permissions_CA.pem");
+  dds_qset_prop(qos, DDS_SEC_PROP_ACCESS_GOVERNANCE, "file:Governance.p7s");
+  dds_qset_prop(qos, DDS_SEC_PROP_ACCESS_PERMISSIONS, "file:Permissions.p7s");
+  dds_qset_prop(qos, DDS_SEC_PROP_AUTH_PASSWORD, "testtext_Password_testtext");
+  dds_qset_prop(qos, DDS_SEC_PROP_ACCESS_TRUSTED_CA_DIR, "file:/test/dir");
+
+  dds_qset_prop(qos, DDS_SEC_PROP_AUTH_LIBRARY_PATH, WRAPPERLIB_PATH("dds_security_authentication_wrapper"));
+  dds_qset_prop(qos, DDS_SEC_PROP_AUTH_LIBRARY_INIT, "init_test_authentication_all_ok");
+  dds_qset_prop(qos, DDS_SEC_PROP_AUTH_LIBRARY_FINALIZE, "finalize_test_authentication_all_ok");
+  dds_qset_prop(qos, DDS_SEC_PROP_AUTH_IDENTITY_CA, "testtext_IdentityCA_testtext");
+  dds_qset_prop(qos, DDS_SEC_PROP_CRYPTO_LIBRARY_PATH, WRAPPERLIB_PATH("dds_security_cryptography_wrapper"));
+  dds_qset_prop(qos, DDS_SEC_PROP_CRYPTO_LIBRARY_INIT, "init_test_cryptography_all_ok");
+  dds_qset_prop(qos, DDS_SEC_PROP_CRYPTO_LIBRARY_FINALIZE, "finalize_test_cryptography_all_ok");
+  dds_qset_prop(qos, DDS_SEC_PROP_ACCESS_LIBRARY_PATH, WRAPPERLIB_PATH("dds_security_access_control_wrapper"));
+  dds_qset_prop(qos, DDS_SEC_PROP_ACCESS_LIBRARY_INIT, "init_test_access_control_all_ok");
+  dds_qset_prop(qos, DDS_SEC_PROP_ACCESS_LIBRARY_FINALIZE, "finalize_test_access_control_all_ok");
+
+  participant1 = dds_create_participant(1, NULL, NULL);
+  participant2 = dds_create_participant(2, NULL, NULL);
+  participant3 = dds_create_participant(2, qos, NULL);
+  CU_ASSERT_FATAL(participant1 > 0);
+  CU_ASSERT_FATAL(participant2 > 0);
+  CU_ASSERT_FATAL(participant3 > 0);
+  dds_delete_qos(qos);
+  dds_delete(domain1);
+  dds_delete(domain2);
+  reset_logger();
+
+  CU_ASSERT_FATAL(found == 0xf);
+}
diff --git a/src/security/core/tests/plugin_loading/CMakeLists.txt b/src/security/core/tests/plugin_loading/CMakeLists.txt
deleted file mode 100644
index 0eda38b..0000000
--- a/src/security/core/tests/plugin_loading/CMakeLists.txt
+++ /dev/null
@@ -1,85 +0,0 @@
- #
-# Copyright(c) 2006 to 2019 ADLINK Technology Limited and others
-#
-# This program and the accompanying materials are made available under the
-# terms of the Eclipse Public License v. 2.0 which is available at
-# http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
-# v. 1.0 which is available at
-# http://www.eclipse.org/org/documents/edl-v10.php.
-#
-# SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
-#
-include(GenerateExportHeader)
-include(CUnit)
-
-set(security_plugin_loading_test_sources
-  "security_config.c"
-  "plugin_loading.c")
-
-add_cunit_executable(cunit_security_plugin_loading ${security_plugin_loading_test_sources})
-target_include_directories(
-  cunit_security_plugin_loading PRIVATE
-  "$<BUILD_INTERFACE:${CMAKE_BINARY_DIR}/src/include/>"
-  "$<BUILD_INTERFACE:$<TARGET_PROPERTY:ddsrt,INTERFACE_INCLUDE_DIRECTORIES>>"
-  "$<BUILD_INTERFACE:$<TARGET_PROPERTY:ddsc,INTERFACE_INCLUDE_DIRECTORIES>>"
-  "$<BUILD_INTERFACE:${CMAKE_CURRENT_LIST_DIR}>"
-  "$<BUILD_INTERFACE:${CMAKE_CURRENT_BINARY_DIR}>"
-  "$<BUILD_INTERFACE:${CMAKE_CURRENT_LIST_DIR}/../../../../core/ddsi/include>")
-
-target_link_libraries(cunit_security_plugin_loading PRIVATE ddsc security_api)
-target_include_directories(cunit_security_plugin_loading PRIVATE "${CMAKE_CURRENT_BINARY_DIR}")
-
-set(CUnit_plugin_mock_dir ".")
-
-# Let the cunit application know the location and name of the library.
-configure_file("config_env.h.in" "config_env.h")
-
-function(add_mock libname casename)
-  PREPEND(srcs_mock_authentication_all_ok "${CMAKE_CURRENT_LIST_DIR}/plugin_mock/${casename}"
-    "mock_${libname}.c")
-  add_library("dds_security_${casename}" SHARED "")
-  
-  generate_export_header(
-    "dds_security_${casename}"
-    BASE_NAME SECURITY
-    EXPORT_FILE_NAME "${CMAKE_CURRENT_BINARY_DIR}/include/dds/security/${casename}_export.h")
-  
-  set_target_properties(
-    "dds_security_${casename}"
-    PROPERTIES
-    RUNTIME_OUTPUT_DIRECTORY                ${CMAKE_CURRENT_BINARY_DIR}
-    RUNTIME_OUTPUT_DIRECTORY_DEBUG          ${CMAKE_CURRENT_BINARY_DIR}
-    RUNTIME_OUTPUT_DIRECTORY_RELEASE        ${CMAKE_CURRENT_BINARY_DIR}
-    RUNTIME_OUTPUT_DIRECTORY_RELWITHDEBINFO ${CMAKE_CURRENT_BINARY_DIR}
-    RUNTIME_OUTPUT_DIRECTORY_MINSIZEREL     ${CMAKE_CURRENT_BINARY_DIR}
-    LIBRARY_OUTPUT_DIRECTORY                ${CMAKE_CURRENT_BINARY_DIR}
-    LIBRARY_OUTPUT_DIRECTORY_DEBUG          ${CMAKE_CURRENT_BINARY_DIR}
-    LIBRARY_OUTPUT_DIRECTORY_RELEASE        ${CMAKE_CURRENT_BINARY_DIR}
-    LIBRARY_OUTPUT_DIRECTORY_RELWITHDEBINFO ${CMAKE_CURRENT_BINARY_DIR}
-    LIBRARY_OUTPUT_DIRECTORY_MINSIZEREL     ${CMAKE_CURRENT_BINARY_DIR})
-
-  #find_package(OpenSSL )
-  #target_link_libraries("dds_security_${casename}" PUBLIC OpenSSL::SSL)
-  target_link_libraries("dds_security_${casename}" PUBLIC ddsc)
-  
-  target_sources("dds_security_${casename}"
-    PRIVATE
-      ${srcs_mock_authentication_all_ok})
-  target_include_directories("dds_security_${casename}"
-    PUBLIC
-      "$<BUILD_INTERFACE:$<TARGET_PROPERTY:security_api,INTERFACE_INCLUDE_DIRECTORIES>>"
-      "$<BUILD_INTERFACE:$<TARGET_PROPERTY:security_core,INTERFACE_INCLUDE_DIRECTORIES>>"
-      "$<BUILD_INTERFACE:$<TARGET_PROPERTY:ddsrt,INTERFACE_INCLUDE_DIRECTORIES>>"
-      "$<BUILD_INTERFACE:${CMAKE_CURRENT_BINARY_DIR}/include>")
-endfunction()
-
-#PLUGIN MOCKS
-add_mock(authentication authentication_all_ok)
-add_mock(authentication authentication_all_ok_other)
-add_mock(authentication authentication_missing_function)
-add_mock(authentication authentication_finalize_error)
-add_mock(access_control access_control_all_ok)
-add_mock(access_control access_control_missing_function)
-add_mock(cryptography cryptography_all_ok)
-add_mock(cryptography cryptography_missing_function)
-add_mock(authentication authentication_init_error)
diff --git a/src/security/core/tests/plugin_loading/config_env.h.in b/src/security/core/tests/plugin_loading/config_env.h.in
deleted file mode 100644
index 6d05734..0000000
--- a/src/security/core/tests/plugin_loading/config_env.h.in
+++ /dev/null
@@ -1,25 +0,0 @@
-/*
- * Copyright(c) 2006 to 2019 ADLINK Technology Limited and others
- *
- * This program and the accompanying materials are made available under the
- * terms of the Eclipse Public License v. 2.0 which is available at
- * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
- * v. 1.0 which is available at
- * http://www.eclipse.org/org/documents/edl-v10.php.
- *
- * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
- */
-#ifndef CONFIG_ENV_H
-#define CONFIG_ENV_H
-
-#define CONFIG_ENV_PLUGIN_MOCK_DIR "@CUnit_plugin_mock_dir@"
-#define TEST_LIB_DIR    "@test_lib_dir@"
-#define TEST_LIB_SEP    "@test_lib_sep@"
-#define TEST_LIB_SUFFIX "@CMAKE_SHARED_LIBRARY_SUFFIX@"
-#define TEST_LIB_PREFIX "@CMAKE_SHARED_LIBRARY_PREFIX@"
-#define CONFIG_PLUGIN_MOCK_DIR          "@test_lib_dir@"
-#define CONFIG_LIB_SUFFIX "@CMAKE_SHARED_LIBRARY_SUFFIX@"
-#define CONFIG_LIB_PREFIX "@CMAKE_SHARED_LIBRARY_PREFIX@"
-#define CONFIG_LIB_SEP    "@test_lib_sep@"
-
-#endif /* CONFIG_ENV_H */
diff --git a/src/security/core/tests/plugin_loading/plugin_loading.c b/src/security/core/tests/plugin_loading/plugin_loading.c
deleted file mode 100644
index 09c6c0b..0000000
--- a/src/security/core/tests/plugin_loading/plugin_loading.c
+++ /dev/null
@@ -1,911 +0,0 @@
-/*
- * Copyright(c) 2006 to 2019 ADLINK Technology Limited and others
- *
- * This program and the accompanying materials are made available under the
- * terms of the Eclipse Public License v. 2.0 which is available at
- * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
- * v. 1.0 which is available at
- * http://www.eclipse.org/org/documents/edl-v10.php.
- *
- * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
- */
-#include <stdlib.h>
-#include <dds/security/dds_security_api_defs.h>
-
-#include "dds/dds.h"
-#include "CUnit/Test.h"
-#include "config_env.h"
-
-#include "dds/version.h"
-#include "dds/ddsrt/cdtors.h"
-#include "dds/ddsrt/environ.h"
-#include "dds/ddsrt/heap.h"
-#include "plugin_mock_common.h"
-//#include "dds/ddsi/ddsi_security_omg.h"
-
-#define FORCE_ENV
-
-#define URI_VARIABLE DDS_PROJECT_NAME_NOSPACE_CAPS"_URI"
-#define MAX_PARTICIPANTS_VARIABLE "MAX_PARTICIPANTS"
-static bool print_log=true;
-
-static int patmatch (const char *pat, const char *str)
-{
-  while (*pat)
-  {
-    if (*pat == '?')
-    {
-      /* any character will do */
-      if (*str++ == 0)
-      {
-        return 0;
-      }
-      pat++;
-    }
-    else if (*pat == '*')
-    {
-      /* collapse a sequence of wildcards, requiring as many
-       characters in str as there are ?s in the sequence */
-      while (*pat == '*' || *pat == '?')
-      {
-        if (*pat == '?' && *str++ == 0)
-        {
-          return 0;
-        }
-        pat++;
-      }
-      /* try matching on all positions where str matches pat */
-      while (*str)
-      {
-        if (*str == *pat && patmatch (pat+1, str+1))
-        {
-          return 1;
-        }
-        str++;
-      }
-      return *pat == 0;
-    }
-    else
-    {
-      /* only an exact match */
-      if (*str++ != *pat++)
-      {
-        return 0;
-      }
-    }
-  }
-  return *str == 0;
-}
-
-
-/*
- * The 'found' variable will contain flags related to the expected log
- * messages that were received.
- * Using flags will allow to show that when message isn't received,
- * which one it was.
- */
-static uint32_t found;
-static void logger(void *ptr, const dds_log_data_t *data) {
-  char **expected = (char **) ptr;
-  if (print_log) {
-    fputs(data->message, stdout);
-  }
-  for (uint32_t i = 0; expected[i] != NULL; i++) {
-      if (patmatch(expected[i], data->message)) {
-          found |= (uint32_t)(1 << i);
-      }
-  }
-}
-
-
-CU_Test(ddssec_security_plugin_loading, all_ok, .init = ddsrt_init, .fini = ddsrt_fini) {
-
-    /* Expected traces when creating participant with the security elements. */
-    const char *log_expected[] = {
-        "DDS Security plugins have been loaded*",
-        NULL
-    };
-
-    const char *sec_config =
-      "<"DDS_PROJECT_NAME">"
-        "<Domain id=\"any\">"
-          "<Tracing><Verbosity>finest</></>"
-          "<DDSSecurity>"
-            "<Authentication>"
-              "<Library path=\"dds_security_authentication_all_ok\" initFunction=\"init_authentication\" finalizeFunction=\"finalize_authentication\" />"
-              "<IdentityCertificate>"TEST_IDENTITY_CERTIFICATE_ALL_OK"</IdentityCertificate>"
-              "<IdentityCA>"TEST_CA_CERTIFICATE_ALL_OK"</IdentityCA>"
-              "<PrivateKey>"TEST_PRIVATE_KEY_ALL_OK"</PrivateKey>"
-              "<Password>testtext_Password_testtext</Password>"
-              "<TrustedCADirectory>testtext_Dir_testtext</TrustedCADirectory>"
-            "</Authentication>"
-            "<Cryptographic>"
-              "<Library path=\"dds_security_cryptography_all_ok\" initFunction=\"init_crypto\" finalizeFunction=\"finalize_crypto\"/>"
-            "</Cryptographic>"
-            "<AccessControl>"
-              "<Library path=\"dds_security_access_control_all_ok\" initFunction=\"init_access_control\" finalizeFunction=\"finalize_access_control\"/>"
-              "<Governance>file:Governance.p7s</Governance>"
-              "<PermissionsCA>file:Permissions_CA.pem</PermissionsCA>"
-              "<Permissions>file:Permissions.p7s</Permissions>"
-            "</AccessControl>"
-          "</DDSSecurity>"
-        "</Domain>"
-      "</"DDS_PROJECT_NAME">";
-
-
-    dds_entity_t participant;
-
-    /* Set up the trace sinks to detect the config parsing. */
-    dds_set_log_mask(DDS_LC_FATAL|DDS_LC_ERROR|DDS_LC_WARNING|DDS_LC_INFO| DDS_LC_TRACE);
-    dds_set_log_sink(&logger, (void*)log_expected);
-    dds_set_trace_sink(&logger, (void*)log_expected);
-
-    /* Create participant with security elements. */
-    found = 0;
-    ddsrt_setenv(URI_VARIABLE, sec_config);
-    participant = dds_create_participant(DDS_DOMAIN_DEFAULT, NULL, NULL);
-    dds_set_log_sink(NULL,NULL);
-    dds_set_trace_sink(NULL,NULL);
-    ddsrt_setenv(URI_VARIABLE, "");
-    CU_ASSERT_FATAL(found == 0x1);
-
-
-    dds_delete(participant);
-
-}
-
-CU_Test(ddssec_security_plugin_loading, missing_finalize, .init = ddsrt_init, .fini = ddsrt_fini) {
-
-    /* Expected traces when creating participant with the security elements. */
-  const char *log_expected[] = {
-      "Could not find the function: finalize_authentication*",
-      "Could not load Authentication plugin*",
-      NULL
-  };
-
-  const char *sec_config =
-    "<"DDS_PROJECT_NAME">"
-      "<Domain id=\"any\">"
-        "<Tracing><Verbosity>finest</></>"
-        "<DDSSecurity>"
-          "<Authentication>"
-            "<Library path=\"dds_security_authentication_finalize_error\" initFunction=\"init_authentication\" finalizeFunction=\"finalize_authentication\" />"
-            "<IdentityCertificate>testtext_IdentityCertificate_testtext</IdentityCertificate>"
-            "<IdentityCA>testtext_IdentityCA_testtext</IdentityCA>"
-            "<PrivateKey>testtext_PrivateKey_testtext</PrivateKey>"
-            "<Password>testtext_Password_testtext</Password>"
-            "<TrustedCADirectory>testtext_Dir_testtext</TrustedCADirectory>"
-          "</Authentication>"
-          "<Cryptographic>"
-            "<Library path=\"dds_security_cryptography_all_ok\" initFunction=\"init_crypto\" finalizeFunction=\"finalize_crypto\"/>"
-          "</Cryptographic>"
-          "<AccessControl>"
-            "<Library path=\"dds_security_access_control_all_ok\" initFunction=\"init_access_control\" finalizeFunction=\"finalize_access_control\"/>"
-            "<Governance>file:Governance.p7s</Governance>"
-            "<PermissionsCA>file:Permissions_CA.pem</PermissionsCA>"
-            "<Permissions>file:Permissions.p7s</Permissions>"
-          "</AccessControl>"
-        "</DDSSecurity>"
-      "</Domain>"
-    "</"DDS_PROJECT_NAME">";
-
-
-    dds_entity_t participant;
-
-    /* Set up the trace sinks to detect the config parsing. */
-    dds_set_log_mask(DDS_LC_FATAL|DDS_LC_ERROR|DDS_LC_WARNING|DDS_LC_CONFIG);
-    dds_set_log_sink(&logger, (void*)log_expected);
-    dds_set_trace_sink(&logger, (void*)log_expected);
-
-    /* Create participant with security elements. */
-    found = 0;
-    ddsrt_setenv(URI_VARIABLE, sec_config);
-    participant = dds_create_participant(DDS_DOMAIN_DEFAULT, NULL, NULL);
-    dds_set_log_sink( NULL, NULL );
-    dds_set_trace_sink(NULL, NULL);
-    ddsrt_setenv(URI_VARIABLE, "");
-#ifdef PR304_MERGED
-    /* It is better dds to return DDS_RETCODE_NOT_ALLOWED_BY_SECURITY instead of DDS_RETCODE_ERROR
-    CU_ASSERT_FATAL( participant == DDS_RETCODE_NOT_ALLOWED_BY_SECURITY ); */
-    CU_ASSERT_FATAL( participant == DDS_RETCODE_ERROR );
-#else
-    dds_delete(participant);
-#endif
-    CU_ASSERT_FATAL(found == 0x3);
-
-}
-
-
-CU_Test(ddssec_security_plugin_loading, authentication_missing_function, .init = ddsrt_init, .fini = ddsrt_fini) {
-
-  /* Expected traces when creating participant with the security elements. */
-  const char *log_expected[] = {
-          "Could not find the function for Authentication: get_shared_secret*",
-          "Could not load security*",
-          NULL
-  };
-
-  const char *sec_config =
-          "<"DDS_PROJECT_NAME">"
-            "<Domain id=\"any\">"
-            "<Tracing><Verbosity>finest</></>"
-            "<DDSSecurity>"
-              "<Authentication>"
-                "<Library path=\"dds_security_authentication_missing_function\" initFunction=\"init_authentication\" finalizeFunction=\"finalize_authentication\" />"
-                "<IdentityCertificate>testtext_IdentityCertificate_testtext</IdentityCertificate>"
-                "<IdentityCA>testtext_IdentityCA_testtext</IdentityCA>"
-                "<PrivateKey>testtext_PrivateKey_testtext</PrivateKey>"
-                "<Password>testtext_Password_testtext</Password>"
-                "<TrustedCADirectory>testtext_Dir_testtext</TrustedCADirectory>"
-              "</Authentication>"
-              "<Cryptographic>"
-                "<Library path=\"dds_security_cryptography_all_ok\" initFunction=\"init_crypto\" finalizeFunction=\"finalize_crypto\"/>"
-              "</Cryptographic>"
-              "<AccessControl>"
-                "<Library path=\"dds_security_access_control_all_ok\" initFunction=\"init_access_control\" finalizeFunction=\"finalize_access_control\"/>"
-                "<Governance>file:Governance.p7s</Governance>"
-                "<PermissionsCA>file:Permissions_CA.pem</PermissionsCA>"
-                "<Permissions>file:Permissions.p7s</Permissions>"
-              "</AccessControl>"
-            "</DDSSecurity>"
-          "</Domain>"
-          "</"DDS_PROJECT_NAME">";
-
-
-  dds_entity_t participant;
-
-  /* Set up the trace sinks to detect the config parsing. */
-  dds_set_log_mask(DDS_LC_ERROR);
-  dds_set_log_sink(&logger, (void*)log_expected);
-  dds_set_trace_sink(&logger, (void*)log_expected);
-
-  /* Create participant with security elements. */
-  found = 0;
-  ddsrt_setenv(URI_VARIABLE, sec_config);
-  print_log = true;
-  participant = dds_create_participant(DDS_DOMAIN_DEFAULT, NULL, NULL);
-  dds_set_log_sink(NULL, NULL);
-  dds_set_trace_sink(NULL, NULL);
-  ddsrt_setenv(URI_VARIABLE, "");
-#ifdef PR304_MERGED
-  /* It is better dds to return DDS_RETCODE_NOT_ALLOWED_BY_SECURITY instead of DDS_RETCODE_ERROR
-    CU_ASSERT_FATAL( participant == DDS_RETCODE_NOT_ALLOWED_BY_SECURITY ); */
-    CU_ASSERT_FATAL( participant == DDS_RETCODE_ERROR );
-#else
-  dds_delete(participant);
-#endif
-  CU_ASSERT_FATAL(found == 0x3);
-
-
-}
-
-
-CU_Test(ddssec_security_plugin_loading, access_control_missing_function, .init = ddsrt_init, .fini = ddsrt_fini) {
-
-  /* Expected traces when creating participant with the security elements. */
-  const char *log_expected[] = {
-          "Could not find the function for Access Control: check_create_datareader*",
-          "Could not load security*",
-          NULL
-  };
-
-  const char *sec_config =
-          "<"DDS_PROJECT_NAME">"
-          "<Domain id=\"any\">"
-          "<Tracing><Verbosity>finest</></>"
-          "<DDSSecurity>"
-          "<Authentication>"
-          "<Library path=\"dds_security_authentication_all_ok\" initFunction=\"init_authentication\" finalizeFunction=\"finalize_authentication\" />"
-          "<IdentityCertificate>testtext_IdentityCertificate_testtext</IdentityCertificate>"
-          "<IdentityCA>testtext_IdentityCA_testtext</IdentityCA>"
-          "<PrivateKey>testtext_PrivateKey_testtext</PrivateKey>"
-          "<Password>testtext_Password_testtext</Password>"
-          "<TrustedCADirectory>testtext_Dir_testtext</TrustedCADirectory>"
-          "</Authentication>"
-          "<Cryptographic>"
-          "<Library path=\"dds_security_cryptography_all_ok\" initFunction=\"init_crypto\" finalizeFunction=\"finalize_crypto\"/>"
-          "</Cryptographic>"
-          "<AccessControl>"
-          "<Library path=\"dds_security_access_control_missing_function\" initFunction=\"init_access_control\" finalizeFunction=\"finalize_access_control\"/>"
-          "<Governance>file:Governance.p7s</Governance>"
-          "<PermissionsCA>file:Permissions_CA.pem</PermissionsCA>"
-          "<Permissions>file:Permissions.p7s</Permissions>"
-          "</AccessControl>"
-          "</DDSSecurity>"
-          "</Domain>"
-          "</"DDS_PROJECT_NAME">";
-
-
-  dds_entity_t participant;
-
-  /* Set up the trace sinks to detect the config parsing. */
-  dds_set_log_mask(DDS_LC_FATAL|DDS_LC_ERROR);
-  dds_set_log_sink(&logger, (void*)log_expected);
-  dds_set_trace_sink(&logger, (void*)log_expected);
-
-  /* Create participant with security elements. */
-  found = 0;
-  ddsrt_setenv(URI_VARIABLE, sec_config);
-  participant = dds_create_participant(DDS_DOMAIN_DEFAULT, NULL, NULL);
-  ddsrt_setenv(URI_VARIABLE, "");
-  dds_set_log_sink(NULL, NULL);
-  dds_set_trace_sink(NULL, NULL);
-
-#ifdef PR304_MERGED
-  /* It is better dds to return DDS_RETCODE_NOT_ALLOWED_BY_SECURITY instead of DDS_RETCODE_ERROR
-    CU_ASSERT_FATAL( participant == DDS_RETCODE_NOT_ALLOWED_BY_SECURITY ); */
-    CU_ASSERT_FATAL( participant == DDS_RETCODE_ERROR );
-#else
-  dds_delete(participant);
-#endif
-  CU_ASSERT_FATAL(found == 0x3);
-
-
-
-}
-
-
-CU_Test(ddssec_security_plugin_loading, cryptography_missing_function, .init = ddsrt_init, .fini = ddsrt_fini) {
-
-  /* Expected traces when creating participant with the security elements. */
-  const char *log_expected[] = {
-          "Could not find the function for Cryptographic: set_remote_participant_crypto_tokens*",
-          "Could not load security*",
-          NULL
-  };
-
-  const char *sec_config =
-          "<"DDS_PROJECT_NAME">"
-          "<Domain id=\"any\">"
-          "<Tracing><Verbosity>finest</></>"
-          "<DDSSecurity>"
-          "<Authentication>"
-          "<Library path=\"dds_security_authentication_all_ok\" initFunction=\"init_authentication\" finalizeFunction=\"finalize_authentication\" />"
-          "<IdentityCertificate>testtext_IdentityCertificate_testtext</IdentityCertificate>"
-          "<IdentityCA>testtext_IdentityCA_testtext</IdentityCA>"
-          "<PrivateKey>testtext_PrivateKey_testtext</PrivateKey>"
-          "<Password>testtext_Password_testtext</Password>"
-          "<TrustedCADirectory>testtext_Dir_testtext</TrustedCADirectory>"
-          "</Authentication>"
-          "<Cryptographic>"
-          "<Library path=\"dds_security_cryptography_missing_function\" initFunction=\"init_crypto\" finalizeFunction=\"finalize_crypto\"/>"
-          "</Cryptographic>"
-          "<AccessControl>"
-          "<Library path=\"dds_security_access_control_all_ok\" initFunction=\"init_access_control\" finalizeFunction=\"finalize_access_control\"/>"
-          "<Governance>file:Governance.p7s</Governance>"
-          "<PermissionsCA>file:Permissions_CA.pem</PermissionsCA>"
-          "<Permissions>file:Permissions.p7s</Permissions>"
-          "</AccessControl>"
-          "</DDSSecurity>"
-          "</Domain>"
-          "</"DDS_PROJECT_NAME">";
-
-
-  dds_entity_t participant;
-
-  /* Set up the trace sinks to detect the config parsing. */
-  dds_set_log_mask(DDS_LC_FATAL|DDS_LC_ERROR|DDS_LC_WARNING);
-  dds_set_log_sink(&logger, (void*)log_expected);
-  dds_set_trace_sink(&logger, (void*)log_expected);
-
-  /* Create participant with security elements. */
-  found = 0;
-  ddsrt_setenv(URI_VARIABLE, sec_config);
-  participant = dds_create_participant(DDS_DOMAIN_DEFAULT, NULL, NULL);
-  ddsrt_setenv(URI_VARIABLE, "");
-  dds_set_log_sink(NULL, NULL);
-  dds_set_trace_sink(NULL, NULL);
-
-#ifdef PR304_MERGED
-  /* It is better dds to return DDS_RETCODE_NOT_ALLOWED_BY_SECURITY instead of DDS_RETCODE_ERROR
-    CU_ASSERT_FATAL( participant == DDS_RETCODE_NOT_ALLOWED_BY_SECURITY ); */
-    CU_ASSERT_FATAL( participant == DDS_RETCODE_ERROR );
-#else
-  dds_delete(participant);
-#endif
-  CU_ASSERT_FATAL(found == 0x3);
-
-
-
-}
-
-
-CU_Test(ddssec_security_plugin_loading, no_library_in_path, .init = ddsrt_init, .fini = ddsrt_fini) {
-
-  /* Expected traces when creating participant with the security elements. */
-  const char *log_expected[] = {
-          "Could not load Authentication library: no_library_in_path: cannot open shared object file: No such file or directory*",
-          "Could not load Authentication library: *not*found*",
-          "Could not load Authentication plugin*",
-          "Could not load security*",
-          NULL
-  };
-
-  const char *sec_config =
-          "<"DDS_PROJECT_NAME">"
-            "<Domain id=\"any\">"
-              "<Tracing><Verbosity>finest</></>"
-              "<DDSSecurity>"
-                "<Authentication>"
-                  "<Library path=\"no_library_in_path\" initFunction=\"init_authentication\" finalizeFunction=\"finalize_authentication\" />"
-                  "<IdentityCertificate>testtext_IdentityCertificate_testtext</IdentityCertificate>"
-                  "<IdentityCA>testtext_IdentityCA_testtext</IdentityCA>"
-                  "<PrivateKey>testtext_PrivateKey_testtext</PrivateKey>"
-                  "<Password>testtext_Password_testtext</Password>"
-                  "<TrustedCADirectory>testtext_Dir_testtext</TrustedCADirectory>"
-                "</Authentication>"
-                "<Cryptographic>"
-                  "<Library path=\"dds_security_cryptography_all_ok\" initFunction=\"init_crypto\" finalizeFunction=\"finalize_crypto\"/>"
-                "</Cryptographic>"
-                "<AccessControl>"
-                  "<Library path=\"dds_security_access_control_all_ok\" initFunction=\"init_access_control\" finalizeFunction=\"finalize_access_control\"/>"
-                  "<Governance>file:Governance.p7s</Governance>"
-                  "<PermissionsCA>file:Permissions_CA.pem</PermissionsCA>"
-                  "<Permissions>file:Permissions.p7s</Permissions>"
-                "</AccessControl>"
-              "</DDSSecurity>"
-            "</Domain>"
-          "</"DDS_PROJECT_NAME">";
-
-
-  dds_entity_t participant;
-
-  /* Set up the trace sinks to detect the config parsing. */
-  dds_set_log_mask(DDS_LC_FATAL|DDS_LC_ERROR|DDS_LC_WARNING|DDS_LC_INFO| DDS_LC_TRACE);
-  dds_set_log_sink(&logger, (void*)log_expected);
-  dds_set_trace_sink(&logger, (void*)log_expected);
-
-  /* Create participant with security elements. */
-  found = 0;
-  ddsrt_setenv(URI_VARIABLE, sec_config);
-  participant = dds_create_participant(DDS_DOMAIN_DEFAULT, NULL, NULL);
-  ddsrt_setenv(URI_VARIABLE, "");
-  dds_set_log_sink(NULL, NULL);
-  dds_set_trace_sink(NULL, NULL);
-
-#ifdef PR304_MERGED
-  /* It is better dds to return DDS_RETCODE_NOT_ALLOWED_BY_SECURITY instead of DDS_RETCODE_ERROR
-    CU_ASSERT_FATAL( participant == DDS_RETCODE_NOT_ALLOWED_BY_SECURITY ); */
-    CU_ASSERT_FATAL( participant == DDS_RETCODE_ERROR );
-#else
-  dds_delete(participant);
-#endif
-
-  CU_ASSERT_FATAL(found == 0xd || found == 0xe);
-
-  dds_delete(participant);
-
-}
-
-
-CU_Test(ddssec_security_plugin_loading, init_error, .init = ddsrt_init, .fini = ddsrt_fini) {
-
-  /* Expected traces when creating participant with the security elements. */
-  const char *log_expected[] = {
-          "Error occured while initializing Authentication plugin*",
-          "Could not load Authentication plugin*",
-          "Could not load security*",
-          NULL
-  };
-
-  const char *sec_config =
-          "<"DDS_PROJECT_NAME">"
-            "<Domain id=\"any\">"
-              "<Tracing><Verbosity>finest</></>"
-              "<DDSSecurity>"
-                "<Authentication>"
-                  "<Library path=\"dds_security_authentication_init_error\" initFunction=\"init_authentication\" finalizeFunction=\"finalize_authentication\" />"
-                  "<IdentityCertificate>testtext_IdentityCertificate_testtext</IdentityCertificate>"
-                  "<IdentityCA>testtext_IdentityCA_testtext</IdentityCA>"
-                  "<PrivateKey>testtext_PrivateKey_testtext</PrivateKey>"
-                  "<Password>testtext_Password_testtext</Password>"
-                  "<TrustedCADirectory>testtext_Dir_testtext</TrustedCADirectory>"
-                "</Authentication>"
-                "<Cryptographic>"
-                  "<Library path=\"dds_security_cryptography_all_ok\" initFunction=\"init_crypto\" finalizeFunction=\"finalize_crypto\"/>"
-                "</Cryptographic>"
-                "<AccessControl>"
-                  "<Library path=\"dds_security_access_control_all_ok\" initFunction=\"init_access_control\" finalizeFunction=\"finalize_access_control\"/>"
-                  "<Governance>file:Governance.p7s</Governance>"
-                  "<PermissionsCA>file:Permissions_CA.pem</PermissionsCA>"
-                  "<Permissions>file:Permissions.p7s</Permissions>"
-                "</AccessControl>"
-              "</DDSSecurity>"
-            "</Domain>"
-          "</"DDS_PROJECT_NAME">";
-
-
-  dds_entity_t participant;
-
-  /* Set up the trace sinks to detect the config parsing. */
-  dds_set_log_mask(DDS_LC_FATAL|DDS_LC_ERROR|DDS_LC_WARNING|DDS_LC_INFO| DDS_LC_TRACE);
-  dds_set_log_sink(&logger, (void*)log_expected);
-  dds_set_trace_sink(&logger, (void*)log_expected);
-
-  /* Create participant with security elements. */
-  found = 0;
-  ddsrt_setenv(URI_VARIABLE, sec_config);
-  participant = dds_create_participant(DDS_DOMAIN_DEFAULT, NULL, NULL);
-  ddsrt_setenv(URI_VARIABLE, "");
-  dds_set_log_sink(NULL, NULL);
-  dds_set_trace_sink(NULL, NULL);
-
-#ifdef PR304_MERGED
-  /* It is better dds to return DDS_RETCODE_NOT_ALLOWED_BY_SECURITY instead of DDS_RETCODE_ERROR
-    CU_ASSERT_FATAL( participant == DDS_RETCODE_NOT_ALLOWED_BY_SECURITY ); */
-    CU_ASSERT_FATAL( participant == DDS_RETCODE_ERROR );
-#else
-  dds_delete(participant);
-#endif
-  CU_ASSERT_FATAL(found == 0x7);
-
-
-  dds_delete(participant);
-
-}
-CU_Test(ddssec_security_plugin_loading, all_ok_with_props, .init = ddsrt_init, .fini = ddsrt_fini) {
-  /* Expected traces when creating participant with the security elements. */
-  const char *log_expected[] = {
-          "DDS Security plugins have been loaded*",
-          NULL
-  };
-
-  dds_entity_t participant;
-  dds_qos_t * qos;
-
-
-  /* Set up the trace sinks to detect the config parsing. */
-  dds_set_log_mask(DDS_LC_INFO);
-  dds_set_log_sink(&logger, (void*)log_expected);
-  dds_set_trace_sink(&logger, (void*)log_expected);
-
-  /* Create the qos */
-  unsigned char bvalue[3] = { 0x01, 0x02, 0x03 };
-  CU_ASSERT_FATAL ((qos = dds_create_qos()) != NULL);
-  dds_qset_prop (qos, "test.prop1", "testtext_value1_testtext");
-  dds_qset_prop (qos, DDS_SEC_PROP_AUTH_IDENTITY_CA, "testtext_IdentityCA_testtext");
-  dds_qset_prop (qos, DDS_SEC_PROP_AUTH_PRIV_KEY, "testtext_PrivateKey_testtext");
-  dds_qset_prop (qos, DDS_SEC_PROP_AUTH_IDENTITY_CERT, "testtext_IdentityCertificate_testtext");
-  dds_qset_prop (qos, DDS_SEC_PROP_ACCESS_PERMISSIONS_CA, "file:Permissions_CA.pem");
-  dds_qset_prop (qos, DDS_SEC_PROP_ACCESS_GOVERNANCE, "file:Governance.p7s");
-  dds_qset_prop (qos, DDS_SEC_PROP_ACCESS_PERMISSIONS, "file:Permissions.p7s");
-  dds_qset_prop (qos, DDS_SEC_PROP_AUTH_PASSWORD, "testtext_Password_testtext");
-  dds_qset_prop (qos, DDS_SEC_PROP_ACCESS_TRUSTED_CA_DIR, "file:/test/dir");
-
-  dds_qset_prop (qos, DDS_SEC_PROP_AUTH_LIBRARY_PATH, "dds_security_authentication_all_ok");
-  dds_qset_prop (qos, DDS_SEC_PROP_AUTH_LIBRARY_INIT, "init_authentication");
-  dds_qset_prop (qos, DDS_SEC_PROP_AUTH_LIBRARY_FINALIZE, "finalize_authentication");
-  dds_qset_prop (qos, DDS_SEC_PROP_CRYPTO_LIBRARY_PATH, "dds_security_cryptography_all_ok");
-  dds_qset_prop (qos, DDS_SEC_PROP_CRYPTO_LIBRARY_INIT, "init_crypto");
-  dds_qset_prop (qos, DDS_SEC_PROP_CRYPTO_LIBRARY_FINALIZE, "finalize_crypto");
-  dds_qset_prop (qos, DDS_SEC_PROP_ACCESS_LIBRARY_PATH, "dds_security_access_control_all_ok");
-  dds_qset_prop (qos, DDS_SEC_PROP_ACCESS_LIBRARY_INIT, "init_access_control");
-  dds_qset_prop (qos, DDS_SEC_PROP_ACCESS_LIBRARY_FINALIZE, "finalize_access_control");
-
-  dds_qset_prop (qos, "test.prop2", "testtext_value2_testtext");
-
-  dds_qset_prop (qos, DDS_SEC_PROP_AUTH_IDENTITY_CA, "testtext_IdentityCA_testtext");
-
-  dds_qset_bprop (qos, "test.bprop1", bvalue, 3);
-
-  /* Create participant with security config in qos. */
-  found = 0;
-  ddsrt_setenv(URI_VARIABLE, "<Tracing><Verbosity>finest</></>");
-  CU_ASSERT_FATAL ((participant = dds_create_participant(DDS_DOMAIN_DEFAULT, qos, NULL)) > 0);
-  ddsrt_setenv(URI_VARIABLE, "");
-  dds_set_log_sink(NULL, NULL);
-  dds_set_trace_sink(NULL, NULL);
-
-  dds_delete(participant);
-  dds_delete_qos(qos);
-  CU_ASSERT_FATAL(found == 0x1);
-}
-
-
-
-CU_Test(ddssec_security_plugin_loading, missing_plugin_property_with_props, .init = ddsrt_init, .fini = ddsrt_fini) {
-  /* Expected traces when creating participant with the security elements. */
-  const char *log_expected[] = {
-          "*using security settings from QoS*",
-          "*required security property dds.sec.auth.library.init missing in Property QoS*",
-          NULL
-  };
-
-  dds_entity_t participant;
-  dds_qos_t * qos;
-
-  /* Set up the trace sinks to detect the config parsing. */
-  dds_set_log_mask(DDS_LC_INFO|DDS_LC_ERROR);
-  dds_set_log_sink(&logger, (void*)log_expected);
-  dds_set_trace_sink(&logger, (void*)log_expected);
-
-  /* Create the qos */
-  unsigned char bvalue[3] = { 0x01, 0x02, 0x03 };
-  CU_ASSERT_FATAL ((qos = dds_create_qos()) != NULL);
-  dds_qset_prop (qos, "test.prop1", "testtext_value1_testtext");
-  dds_qset_prop (qos, DDS_SEC_PROP_AUTH_IDENTITY_CA, "testtext_IdentityCA_testtext");
-  dds_qset_prop (qos, DDS_SEC_PROP_AUTH_PRIV_KEY, "testtext_PrivateKey_testtext");
-  dds_qset_prop (qos, DDS_SEC_PROP_AUTH_IDENTITY_CERT, "testtext_IdentityCertificate_testtext");
-  dds_qset_prop (qos, DDS_SEC_PROP_ACCESS_PERMISSIONS_CA, "file:Permissions_CA.pem");
-  dds_qset_prop (qos, DDS_SEC_PROP_ACCESS_GOVERNANCE, "file:Governance.p7s");
-  dds_qset_prop (qos, DDS_SEC_PROP_ACCESS_PERMISSIONS, "file:Permissions.p7s");
-  dds_qset_prop (qos, DDS_SEC_PROP_AUTH_PASSWORD, "testtext_Password_testtext");
-  dds_qset_prop (qos, DDS_SEC_PROP_ACCESS_TRUSTED_CA_DIR, "file:/test/dir");
-
-  dds_qset_prop (qos, DDS_SEC_PROP_AUTH_LIBRARY_PATH, "dds_security_authentication_all_ok");
-  dds_qset_prop (qos, DDS_SEC_PROP_AUTH_LIBRARY_FINALIZE, "finalize_authentication");
-  dds_qset_prop (qos, DDS_SEC_PROP_CRYPTO_LIBRARY_PATH, "dds_security_cryptography_all_ok");
-  dds_qset_prop (qos, DDS_SEC_PROP_CRYPTO_LIBRARY_INIT, "init_crypto");
-  dds_qset_prop (qos, DDS_SEC_PROP_CRYPTO_LIBRARY_FINALIZE, "finalize_crypto");
-  dds_qset_prop (qos, DDS_SEC_PROP_ACCESS_LIBRARY_PATH, "dds_security_access_control_all_ok");
-  dds_qset_prop (qos, DDS_SEC_PROP_ACCESS_LIBRARY_INIT, "init_access_control");
-  dds_qset_prop (qos, DDS_SEC_PROP_ACCESS_LIBRARY_FINALIZE, "finalize_access_control");
-
-  dds_qset_prop (qos, "test.prop2", "testtext_value2_testtext");
-  dds_qset_prop (qos, DDS_SEC_PROP_AUTH_IDENTITY_CA, "testtext_IdentityCA_testtext");
-  dds_qset_bprop (qos, "test.bprop1", bvalue, 3);
-
-  /* Create participant with security config in qos. */
-  found = 0;
-  ddsrt_setenv(URI_VARIABLE, "<Tracing><Verbosity>finest</></>");
-  participant = dds_create_participant(DDS_DOMAIN_DEFAULT, qos, NULL);
-  dds_set_log_sink(NULL, NULL);
-  dds_set_trace_sink(NULL, NULL);
-  ddsrt_setenv(URI_VARIABLE, "");
-#ifdef PR304_MERGED
-  /* It is better dds to return DDS_RETCODE_NOT_ALLOWED_BY_SECURITY instead of DDS_RETCODE_ERROR
-    CU_ASSERT_FATAL( participant == DDS_RETCODE_NOT_ALLOWED_BY_SECURITY ); */
-    CU_ASSERT_FATAL( participant == DDS_RETCODE_ERROR );
-#else
-  dds_delete(participant);
-#endif
-  CU_ASSERT_FATAL(found == 0x3);
-  dds_delete_qos(qos);
-}
-
-
-
-CU_Test(ddssec_security_plugin_loading, empty_plugin_property_with_props, .init = ddsrt_init, .fini = ddsrt_fini) {
-  /* Expected traces when creating participant with the security elements. */
-  const char *log_expected[] = {
-          "*using security settings from QoS*",
-          "*required security property dds.sec.auth.library.finalize missing in Property QoS*",
-          NULL
-  };
-
-  dds_entity_t participant;
-  dds_qos_t * qos;
-
-  /* Set up the trace sinks to detect the config parsing. */
-  dds_set_log_mask(DDS_LC_INFO|DDS_LC_ERROR);
-  dds_set_log_sink(&logger, (void*)log_expected);
-  dds_set_trace_sink(&logger, (void*)log_expected);
-
-  /* Create the qos */
-  unsigned char bvalue[3] = { 0x01, 0x02, 0x03 };
-  CU_ASSERT_FATAL ((qos = dds_create_qos()) != NULL);
-  dds_qset_prop (qos, "test.prop1", "testtext_value1_testtext");
-  dds_qset_prop (qos, DDS_SEC_PROP_AUTH_IDENTITY_CA, "testtext_IdentityCA_testtext");
-  dds_qset_prop (qos, DDS_SEC_PROP_AUTH_PRIV_KEY, "testtext_PrivateKey_testtext");
-  dds_qset_prop (qos, DDS_SEC_PROP_AUTH_IDENTITY_CERT, "testtext_IdentityCertificate_testtext");
-  dds_qset_prop (qos, DDS_SEC_PROP_ACCESS_PERMISSIONS_CA, "file:Permissions_CA.pem");
-  dds_qset_prop (qos, DDS_SEC_PROP_ACCESS_GOVERNANCE, "file:Governance.p7s");
-  dds_qset_prop (qos, DDS_SEC_PROP_ACCESS_PERMISSIONS, "file:Permissions.p7s");
-  dds_qset_prop (qos, DDS_SEC_PROP_AUTH_PASSWORD, "testtext_Password_testtext");
-  dds_qset_prop (qos, DDS_SEC_PROP_ACCESS_TRUSTED_CA_DIR, "file:/test/dir");
-
-  dds_qset_prop (qos, DDS_SEC_PROP_AUTH_LIBRARY_PATH, "dds_security_authentication_all_ok");
-  dds_qset_prop (qos, DDS_SEC_PROP_AUTH_LIBRARY_INIT, "init_authentication");
-  dds_qset_prop (qos, DDS_SEC_PROP_AUTH_LIBRARY_FINALIZE, "");
-  dds_qset_prop (qos, DDS_SEC_PROP_CRYPTO_LIBRARY_PATH, "dds_security_cryptography_all_ok");
-  dds_qset_prop (qos, DDS_SEC_PROP_CRYPTO_LIBRARY_INIT, "init_crypto");
-  dds_qset_prop (qos, DDS_SEC_PROP_CRYPTO_LIBRARY_FINALIZE, "finalize_crypto");
-  dds_qset_prop (qos, DDS_SEC_PROP_ACCESS_LIBRARY_PATH, "dds_security_access_control_all_ok");
-  dds_qset_prop (qos, DDS_SEC_PROP_ACCESS_LIBRARY_INIT, "init_access_control");
-  dds_qset_prop (qos, DDS_SEC_PROP_ACCESS_LIBRARY_FINALIZE, "finalize_access_control");
-
-  dds_qset_prop (qos, "test.prop2", "testtext_value2_testtext");
-  dds_qset_prop (qos, DDS_SEC_PROP_AUTH_IDENTITY_CA, "testtext_IdentityCA_testtext");
-  dds_qset_bprop (qos, "test.bprop1", bvalue, 3);
-
-  /* Create participant with security config in qos. */
-  found = 0;
-  ddsrt_setenv(URI_VARIABLE, "<Tracing><Verbosity>finest</></>");
-  participant = dds_create_participant(DDS_DOMAIN_DEFAULT, qos, NULL);
-  dds_set_log_sink(NULL, NULL);
-  dds_set_trace_sink(NULL, NULL);
-  ddsrt_setenv(URI_VARIABLE, "");
-#ifdef PR304_MERGED
-  /* It is better dds to return DDS_RETCODE_NOT_ALLOWED_BY_SECURITY instead of DDS_RETCODE_ERROR
-    CU_ASSERT_FATAL( participant == DDS_RETCODE_NOT_ALLOWED_BY_SECURITY ); */
-    CU_ASSERT_FATAL( participant == DDS_RETCODE_ERROR );
-#else
-  dds_delete(participant);
-#endif
-  CU_ASSERT_FATAL(found == 0x3);
-  dds_delete_qos(qos);
-}
-
-
-CU_Test(ddssec_security_plugin_loading, missing_security_property_with_props, .init = ddsrt_init, .fini = ddsrt_fini) {
-  /* Expected traces when creating participant with the security elements. */
-  const char *log_expected[] = {
-          "*using security settings from QoS*",
-          "*required security property dds.sec.access.permissions missing in Property QoS*",
-          NULL
-  };
-
-
-  dds_entity_t participant;
-  dds_qos_t * qos;
-
-  /* Set up the trace sinks to detect the config parsing. */
-  dds_set_log_mask(DDS_LC_INFO|DDS_LC_ERROR);
-  dds_set_log_sink(&logger, (void*)log_expected);
-  dds_set_trace_sink(&logger, (void*)log_expected);
-
-  /* Create the qos */
-  unsigned char bvalue[3] = { 0x01, 0x02, 0x03 };
-  CU_ASSERT_FATAL ((qos = dds_create_qos()) != NULL);
-  dds_qset_prop (qos, "test.prop1", "testtext_value1_testtext");
-  dds_qset_prop (qos, DDS_SEC_PROP_AUTH_IDENTITY_CA, "testtext_IdentityCA_testtext");
-  dds_qset_prop (qos, DDS_SEC_PROP_AUTH_PRIV_KEY, "testtext_PrivateKey_testtext");
-  dds_qset_prop (qos, DDS_SEC_PROP_AUTH_IDENTITY_CERT, "testtext_IdentityCertificate_testtext");
-  dds_qset_prop (qos, DDS_SEC_PROP_ACCESS_PERMISSIONS_CA, "file:Permissions_CA.pem");
-  dds_qset_prop (qos, DDS_SEC_PROP_ACCESS_GOVERNANCE, "file:Governance.p7s");
-  /* we ignore permissions for testing
-  //dds_qset_prop (qos, DDS_SEC_PROP_ACCESS_PERMISSIONS, "file:Permissions.p7s"); */
-  dds_qset_prop (qos, DDS_SEC_PROP_AUTH_PASSWORD, "testtext_Password_testtext");
-  dds_qset_prop (qos, DDS_SEC_PROP_ACCESS_TRUSTED_CA_DIR, "file:/test/dir");
-
-  dds_qset_prop (qos, DDS_SEC_PROP_AUTH_LIBRARY_PATH, "dds_security_authentication_all_ok");
-  dds_qset_prop (qos, DDS_SEC_PROP_AUTH_LIBRARY_INIT, "init_authentication");
-  dds_qset_prop (qos, DDS_SEC_PROP_AUTH_LIBRARY_FINALIZE, "finalize_authentication");
-  dds_qset_prop (qos, DDS_SEC_PROP_CRYPTO_LIBRARY_PATH, "dds_security_cryptography_all_ok");
-  dds_qset_prop (qos, DDS_SEC_PROP_CRYPTO_LIBRARY_INIT, "init_crypto");
-  dds_qset_prop (qos, DDS_SEC_PROP_CRYPTO_LIBRARY_FINALIZE, "finalize_crypto");
-  dds_qset_prop (qos, DDS_SEC_PROP_ACCESS_LIBRARY_PATH, "dds_security_access_control_all_ok");
-  dds_qset_prop (qos, DDS_SEC_PROP_ACCESS_LIBRARY_INIT, "init_access_control");
-  dds_qset_prop (qos, DDS_SEC_PROP_ACCESS_LIBRARY_FINALIZE, "finalize_access_control");
-
-  dds_qset_prop (qos, "test.prop2", "testtext_value2_testtext");
-  dds_qset_prop (qos, DDS_SEC_PROP_AUTH_IDENTITY_CA, "testtext_IdentityCA_testtext");
-  dds_qset_bprop (qos, "test.bprop1", bvalue, 3);
-
-  /* Create participant with security config in qos. */
-  found = 0;
-  ddsrt_setenv(URI_VARIABLE, "<Tracing><Verbosity>finest</></>");
-  participant = dds_create_participant(DDS_DOMAIN_DEFAULT, qos, NULL);
-  dds_set_log_sink(NULL, NULL);
-  dds_set_trace_sink(NULL, NULL);
-  ddsrt_setenv(URI_VARIABLE, "");
-#ifdef PR304_MERGED
-  /* It is better dds to return DDS_RETCODE_NOT_ALLOWED_BY_SECURITY instead of DDS_RETCODE_ERROR
-    CU_ASSERT_FATAL( participant == DDS_RETCODE_NOT_ALLOWED_BY_SECURITY ); */
-    CU_ASSERT_FATAL( participant == DDS_RETCODE_ERROR );
-#else
-  dds_delete(participant);
-#endif
-  CU_ASSERT_FATAL(found == 0x3);
-  dds_delete_qos(qos);
-}
-
-
-
-
-CU_Test(ddssec_security_plugin_loading, multiple_domains_different_config, .init = ddsrt_init, .fini = ddsrt_fini) {
-  /* Expected traces when creating participant with the security elements. */
-  const char *log_expected[] = {
-          "*using security settings from configuration*",
-          "*using security settings from QoS*",
-          "DDS Security plugins have been loaded*",
-          "*security is already loaded for this domain*",
-          NULL
-  };
-
-  const char *sec_config =
-        "<"DDS_PROJECT_NAME">"
-          "<Domain id=\"1\">"
-            "<Tracing><Verbosity>finest</></>"
-            "<DDSSecurity>"
-              "<Authentication>"
-                "<Library path=\"dds_security_authentication_all_ok\" initFunction=\"init_authentication\" finalizeFunction=\"finalize_authentication\" />"
-                "<IdentityCertificate>testtext_IdentityCertificate_testtext</IdentityCertificate>"
-                "<IdentityCA>testtext_IdentityCA_testtext</IdentityCA>"
-                "<PrivateKey>testtext_PrivateKey_testtext</PrivateKey>"
-                "<Password>testtext_Password_testtext</Password>"
-                "<TrustedCADirectory>testtext_Dir_testtext</TrustedCADirectory>"
-              "</Authentication>"
-              "<Cryptographic>"
-                "<Library path=\"dds_security_cryptography_all_ok\" initFunction=\"init_crypto\" finalizeFunction=\"finalize_crypto\"/>"
-              "</Cryptographic>"
-              "<AccessControl>"
-                "<Library path=\"dds_security_access_control_all_ok\" initFunction=\"init_access_control\" finalizeFunction=\"finalize_access_control\"/>"
-                "<Governance>file:Governance.p7s</Governance>"
-                "<PermissionsCA>file:Permissions_CA.pem</PermissionsCA>"
-                "<Permissions>file:Permissions.p7s</Permissions>"
-              "</AccessControl>"
-            "</DDSSecurity>"
-          "</Domain>"
-          "<Domain id=\"2\">"
-            "<Tracing><Verbosity>finest</></>"
-            "<DDSSecurity>"
-              "<Authentication>"
-                "<Library path=\"dds_security_authentication_invalid\" initFunction=\"init_authentication\" finalizeFunction=\"finalize_authentication\" />"
-                "<IdentityCertificate>testtext_IdentityCertificate_testtext</IdentityCertificate>"
-                "<IdentityCA>testtext_IdentityCA_testtext</IdentityCA>"
-                "<PrivateKey>testtext_PrivateKey_testtext</PrivateKey>"
-                "<Password>testtext_Password_testtext</Password>"
-                "<TrustedCADirectory>testtext_Dir_testtext</TrustedCADirectory>"
-              "</Authentication>"
-              "<Cryptographic>"
-                "<Library path=\"dds_security_cryptography_invalid\" initFunction=\"init_crypto\" finalizeFunction=\"finalize_crypto\"/>"
-              "</Cryptographic>"
-              "<AccessControl>"
-                "<Library path=\"dds_security_access_control_invalid\" initFunction=\"init_access_control\" finalizeFunction=\"finalize_access_control\"/>"
-                "<Governance>file:Governance.p7s</Governance>"
-                "<PermissionsCA>file:Permissions_CA.pem</PermissionsCA>"
-                "<Permissions>file:Permissions.p7s</Permissions>"
-              "</AccessControl>"
-            "</DDSSecurity>"
-          "</Domain>"
-        "</"DDS_PROJECT_NAME">";
-
-
-  dds_entity_t participant1, participant2, participant3;
-  dds_qos_t * qos;
-
-  /* Set up the trace sinks to detect the config parsing. */
-  dds_set_log_mask(DDS_LC_INFO|DDS_LC_ERROR);
-  dds_set_log_sink(&logger, (void*)log_expected);
-  dds_set_trace_sink(&logger, (void*)log_expected);
-
-  /* Create the qos */
-  unsigned char bvalue[3] = { 0x01, 0x02, 0x03 };
-  CU_ASSERT_FATAL ((qos = dds_create_qos()) != NULL);
-  dds_qset_prop (qos, "test.prop1", "testtext_value1_testtext");
-  dds_qset_prop (qos, DDS_SEC_PROP_AUTH_IDENTITY_CA, "testtext_IdentityCA_testtext");
-  dds_qset_prop (qos, DDS_SEC_PROP_AUTH_PRIV_KEY, "testtext_PrivateKey_testtext");
-  dds_qset_prop (qos, DDS_SEC_PROP_AUTH_IDENTITY_CERT, "testtext_IdentityCertificate_testtext");
-  dds_qset_prop (qos, DDS_SEC_PROP_ACCESS_PERMISSIONS_CA, "file:Permissions_CA.pem");
-  dds_qset_prop (qos, DDS_SEC_PROP_ACCESS_GOVERNANCE, "file:Governance.p7s");
-  dds_qset_prop (qos, DDS_SEC_PROP_ACCESS_PERMISSIONS, "file:Permissions.p7s");
-  dds_qset_prop (qos, DDS_SEC_PROP_AUTH_PASSWORD, "testtext_Password_testtext");
-  dds_qset_prop (qos, DDS_SEC_PROP_ACCESS_TRUSTED_CA_DIR, "file:/test/dir");
-
-  dds_qset_prop (qos, DDS_SEC_PROP_AUTH_LIBRARY_PATH, "dds_security_authentication_all_ok_other");
-  dds_qset_prop (qos, DDS_SEC_PROP_AUTH_LIBRARY_INIT, "init_authentication");
-  dds_qset_prop (qos, DDS_SEC_PROP_AUTH_LIBRARY_FINALIZE, "finalize_authentication");
-  dds_qset_prop (qos, DDS_SEC_PROP_CRYPTO_LIBRARY_PATH, "dds_security_cryptography_all_ok");
-  dds_qset_prop (qos, DDS_SEC_PROP_CRYPTO_LIBRARY_INIT, "init_crypto");
-  dds_qset_prop (qos, DDS_SEC_PROP_CRYPTO_LIBRARY_FINALIZE, "finalize_crypto");
-  dds_qset_prop (qos, DDS_SEC_PROP_ACCESS_LIBRARY_PATH, "dds_security_access_control_all_ok");
-  dds_qset_prop (qos, DDS_SEC_PROP_ACCESS_LIBRARY_INIT, "init_access_control");
-  dds_qset_prop (qos, DDS_SEC_PROP_ACCESS_LIBRARY_FINALIZE, "finalize_access_control");
-
-  dds_qset_prop (qos, "test.prop2", "testtext_value2_testtext");
-  dds_qset_prop (qos, DDS_SEC_PROP_AUTH_IDENTITY_CA, "testtext_IdentityCA_testtext");
-  dds_qset_bprop (qos, "test.bprop1", bvalue, 3);
-
-  /* Create participant with security config in qos. */
-  found = 0;
-  print_log = true;
-  ddsrt_setenv(URI_VARIABLE, sec_config);
-  participant1 = dds_create_participant(1, NULL, NULL);
-  participant2 = dds_create_participant(2, qos, NULL);
-  participant3 = dds_create_participant(2, NULL, NULL);
-  dds_set_log_sink(NULL, NULL);
-  dds_set_trace_sink(NULL, NULL);
-  ddsrt_setenv(URI_VARIABLE, "");
-#ifdef PR304_MERGED
-  /* It is better dds to return DDS_RETCODE_NOT_ALLOWED_BY_SECURITY instead of DDS_RETCODE_ERROR
-    CU_ASSERT_FATAL( participant1 == DDS_RETCODE_NOT_ALLOWED_BY_SECURITY ); */
-    CU_ASSERT_FATAL( participant1 == DDS_RETCODE_ERROR );
-#else
-  dds_delete(participant1);
-  dds_delete(participant2);
-  dds_delete(participant3);
-#endif
-  CU_ASSERT_FATAL(found == 0xf);
-  dds_delete_qos(qos);
-}
diff --git a/src/security/core/tests/plugin_loading/plugin_mock/access_control_all_ok/mock_access_control.c b/src/security/core/tests/plugin_loading/plugin_mock/access_control_all_ok/mock_access_control.c
deleted file mode 100644
index 322c465..0000000
--- a/src/security/core/tests/plugin_loading/plugin_mock/access_control_all_ok/mock_access_control.c
+++ /dev/null
@@ -1,597 +0,0 @@
-/*
- * Copyright(c) 2006 to 2019 ADLINK Technology Limited and others
- *
- * This program and the accompanying materials are made available under the
- * terms of the Eclipse Public License v. 2.0 which is available at
- * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
- * v. 1.0 which is available at
- * http://www.eclipse.org/org/documents/edl-v10.php.
- *
- * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
- */
-#include "dds/security/dds_security_api.h"
-#include "dds/ddsrt/heap.h"
-#include "dds/ddsrt/misc.h"
-#include "mock_access_control.h"
-#include <stdio.h>
-#include <string.h>
-#include <stdbool.h>
-
-/**
- * Implementation structure for storing encapsulated members of the instance
- * while giving only the interface definition to user
- */
-
-typedef struct dds_security_access_control_impl {
-  dds_security_access_control base;
-  int member;
-} dds_security_access_control_impl;
-
-/**
- * Function implementations
- */
-
-DDS_Security_PermissionsHandle validate_local_permissions(
-     dds_security_access_control *instance,
-     const dds_security_authentication *auth_plugin,
-     const DDS_Security_IdentityHandle identity,
-     const DDS_Security_DomainId domain_id,
-     const DDS_Security_Qos *participant_qos,
-    DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(auth_plugin);
-  DDSRT_UNUSED_ARG(auth_plugin);
-  DDSRT_UNUSED_ARG(identity);
-  DDSRT_UNUSED_ARG(domain_id);
-  DDSRT_UNUSED_ARG(participant_qos);
-  DDSRT_UNUSED_ARG(ex);
-  DDSRT_UNUSED_ARG(instance);
-
-  return 1;
-}
-
-DDS_Security_PermissionsHandle validate_remote_permissions(
-     dds_security_access_control *instance,
-     const dds_security_authentication *auth_plugin,
-     const DDS_Security_IdentityHandle local_identity_handle,
-     const DDS_Security_IdentityHandle remote_identity_handle,
-     const DDS_Security_PermissionsToken *remote_permissions_token,
-     const DDS_Security_AuthenticatedPeerCredentialToken *remote_credential_token,
-    DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(auth_plugin);
-  DDSRT_UNUSED_ARG(local_identity_handle);
-  DDSRT_UNUSED_ARG(remote_identity_handle);
-  DDSRT_UNUSED_ARG(remote_permissions_token);
-  DDSRT_UNUSED_ARG(remote_credential_token);
-  DDSRT_UNUSED_ARG(ex);
-  DDSRT_UNUSED_ARG(instance);
-
-  return 0;
-}
-
-DDS_Security_boolean check_create_participant( dds_security_access_control *instance,
-     const DDS_Security_PermissionsHandle permissions_handle,
-     const DDS_Security_DomainId domain_id,  const DDS_Security_Qos *participant_qos,
-    DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(permissions_handle);
-  DDSRT_UNUSED_ARG(domain_id);
-  DDSRT_UNUSED_ARG(participant_qos);
-  DDSRT_UNUSED_ARG(ex);
-  DDSRT_UNUSED_ARG(instance);
-
-  return true;
-}
-
-DDS_Security_boolean check_create_datawriter( dds_security_access_control *instance,
-     const DDS_Security_PermissionsHandle permissions_handle,
-     const DDS_Security_DomainId domain_id,  const char *topic_name,
-     const DDS_Security_Qos *writer_qos,
-     const DDS_Security_PartitionQosPolicy *partition,
-     const DDS_Security_DataTags *data_tag,
-    DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(permissions_handle);
-  DDSRT_UNUSED_ARG(domain_id);
-  DDSRT_UNUSED_ARG(topic_name);
-  DDSRT_UNUSED_ARG(writer_qos);
-  DDSRT_UNUSED_ARG(partition);
-  DDSRT_UNUSED_ARG(data_tag);
-  DDSRT_UNUSED_ARG(ex);
-  DDSRT_UNUSED_ARG(instance);
-
-  return true;
-}
-
-DDS_Security_boolean check_create_datareader( dds_security_access_control *instance,
-     const DDS_Security_PermissionsHandle permissions_handle,
-     const DDS_Security_DomainId domain_id,  const char *topic_name,
-     const DDS_Security_Qos *reader_qos,
-     const DDS_Security_PartitionQosPolicy *partition,
-     const DDS_Security_DataTags *data_tag,
-    DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(permissions_handle);
-  DDSRT_UNUSED_ARG(domain_id);
-  DDSRT_UNUSED_ARG(topic_name);
-  DDSRT_UNUSED_ARG(reader_qos);
-  DDSRT_UNUSED_ARG(partition);
-  DDSRT_UNUSED_ARG(data_tag);
-  DDSRT_UNUSED_ARG(ex);
-  DDSRT_UNUSED_ARG(instance);
-
-  return true;
-}
-
-DDS_Security_boolean check_create_topic( dds_security_access_control *instance,
-     const DDS_Security_PermissionsHandle permissions_handle,
-     const DDS_Security_DomainId domain_id,  const char *topic_name,
-     const DDS_Security_Qos *qos, DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(permissions_handle);
-  DDSRT_UNUSED_ARG(domain_id);
-  DDSRT_UNUSED_ARG(topic_name);
-  DDSRT_UNUSED_ARG(qos);
-  DDSRT_UNUSED_ARG(ex);
-  DDSRT_UNUSED_ARG(instance);
-
-  return true;
-}
-
-DDS_Security_boolean check_local_datawriter_register_instance(
-     dds_security_access_control *instance,
-     const DDS_Security_PermissionsHandle permissions_handle,
-     const DDS_Security_Entity *writer,  const DDS_Security_DynamicData *key,
-    DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(permissions_handle);
-  DDSRT_UNUSED_ARG(writer);
-  DDSRT_UNUSED_ARG(key);
-  DDSRT_UNUSED_ARG(ex);
-  DDSRT_UNUSED_ARG(instance);
-
-  return true;
-}
-
-DDS_Security_boolean check_local_datawriter_dispose_instance(
-     dds_security_access_control *instance,
-     const DDS_Security_PermissionsHandle permissions_handle,
-     const DDS_Security_Entity *writer,  const DDS_Security_DynamicData key,
-    DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(permissions_handle);
-  DDSRT_UNUSED_ARG(writer);
-  DDSRT_UNUSED_ARG(key);
-  DDSRT_UNUSED_ARG(ex);
-  DDSRT_UNUSED_ARG(instance);
-
-  return true;
-}
-
-DDS_Security_boolean check_remote_participant( dds_security_access_control *instance,
-     const DDS_Security_PermissionsHandle permissions_handle,
-     const DDS_Security_DomainId domain_id,
-     const DDS_Security_ParticipantBuiltinTopicDataSecure *participant_data,
-    DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(permissions_handle);
-  DDSRT_UNUSED_ARG(domain_id);
-  DDSRT_UNUSED_ARG(participant_data);
-  DDSRT_UNUSED_ARG(ex);
-  DDSRT_UNUSED_ARG(instance);
-
-  return true;
-}
-
-DDS_Security_boolean check_remote_datawriter( dds_security_access_control *instance,
-     const DDS_Security_PermissionsHandle permissions_handle,
-     const DDS_Security_DomainId domain_id,
-     const DDS_Security_PublicationBuiltinTopicDataSecure *publication_data,
-    DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(permissions_handle);
-  DDSRT_UNUSED_ARG(domain_id);
-  DDSRT_UNUSED_ARG(publication_data);
-  DDSRT_UNUSED_ARG(ex);
-  DDSRT_UNUSED_ARG(instance);
-
-  return true;
-}
-
-DDS_Security_boolean check_remote_datareader( dds_security_access_control *instance,
-     const DDS_Security_PermissionsHandle permissions_handle,
-     const DDS_Security_DomainId domain_id,
-     const DDS_Security_SubscriptionBuiltinTopicDataSecure *subscription_data,
-    DDS_Security_boolean *relay_only, DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(permissions_handle);
-  DDSRT_UNUSED_ARG(domain_id);
-  DDSRT_UNUSED_ARG(subscription_data);
-  DDSRT_UNUSED_ARG(ex);
-  DDSRT_UNUSED_ARG(instance);
-
-  *relay_only = false;
-
-  return true;
-}
-
-DDS_Security_boolean check_remote_topic( dds_security_access_control *instance,
-     const DDS_Security_PermissionsHandle permissions_handle,
-     const DDS_Security_DomainId domain_id,
-     const DDS_Security_TopicBuiltinTopicData *topic_data,
-    DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(permissions_handle);
-  DDSRT_UNUSED_ARG(domain_id);
-  DDSRT_UNUSED_ARG(topic_data);
-  DDSRT_UNUSED_ARG(ex);
-  DDSRT_UNUSED_ARG(instance);
-
-  return true;
-}
-
-DDS_Security_boolean check_local_datawriter_match(
-     dds_security_access_control *instance,
-     const DDS_Security_PermissionsHandle writer_permissions_handle,
-     const DDS_Security_PermissionsHandle reader_permissions_handle,
-     const DDS_Security_PublicationBuiltinTopicDataSecure *publication_data,
-     const DDS_Security_SubscriptionBuiltinTopicDataSecure *subscription_data,
-    DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(writer_permissions_handle);
-  DDSRT_UNUSED_ARG(reader_permissions_handle);
-  DDSRT_UNUSED_ARG(publication_data);
-  DDSRT_UNUSED_ARG(subscription_data);
-  DDSRT_UNUSED_ARG(ex);
-  DDSRT_UNUSED_ARG(instance);
-
-  return true;
-}
-
-DDS_Security_boolean check_local_datareader_match(
-     dds_security_access_control *instance,
-     const DDS_Security_PermissionsHandle reader_permissions_handle,
-     const DDS_Security_PermissionsHandle writer_permissions_handle,
-     const DDS_Security_SubscriptionBuiltinTopicDataSecure *subscription_data,
-     const DDS_Security_PublicationBuiltinTopicDataSecure *publication_data,
-    DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(reader_permissions_handle);
-  DDSRT_UNUSED_ARG(writer_permissions_handle);
-  DDSRT_UNUSED_ARG(subscription_data);
-  DDSRT_UNUSED_ARG(publication_data);
-  DDSRT_UNUSED_ARG(ex);
-  DDSRT_UNUSED_ARG(instance);
-
-  return true;
-}
-
-DDS_Security_boolean check_remote_datawriter_register_instance(
-     dds_security_access_control *instance,
-     const DDS_Security_PermissionsHandle permissions_handle,
-     const DDS_Security_Entity *reader,
-     const DDS_Security_InstanceHandle publication_handle,
-     const DDS_Security_DynamicData key,
-     const DDS_Security_InstanceHandle instance_handle,
-    DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(permissions_handle);
-  DDSRT_UNUSED_ARG(reader);
-  DDSRT_UNUSED_ARG(publication_handle);
-  DDSRT_UNUSED_ARG(key);
-  DDSRT_UNUSED_ARG(instance_handle);
-  DDSRT_UNUSED_ARG(ex);
-  DDSRT_UNUSED_ARG(instance);
-
-  return true;
-}
-
-DDS_Security_boolean check_remote_datawriter_dispose_instance(
-     dds_security_access_control *instance,
-     const DDS_Security_PermissionsHandle permissions_handle,
-     const DDS_Security_Entity *reader,
-     const DDS_Security_InstanceHandle publication_handle,
-     const DDS_Security_DynamicData key,
-    DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(permissions_handle);
-  DDSRT_UNUSED_ARG(reader);
-  DDSRT_UNUSED_ARG(publication_handle);
-  DDSRT_UNUSED_ARG(key);
-  DDSRT_UNUSED_ARG(ex);
-  DDSRT_UNUSED_ARG(instance);
-
-  return true;
-}
-
-DDS_Security_boolean get_permissions_token( dds_security_access_control *instance,
-    DDS_Security_PermissionsToken *permissions_token,
-     const DDS_Security_PermissionsHandle handle,
-    DDS_Security_SecurityException *ex)
-{
-
-  DDSRT_UNUSED_ARG(permissions_token);
-  DDSRT_UNUSED_ARG(handle);
-  DDSRT_UNUSED_ARG(ex);
-  DDSRT_UNUSED_ARG(instance);
-
-  return true;
-}
-
-DDS_Security_boolean get_permissions_credential_token(
-     dds_security_access_control *instance,
-    DDS_Security_PermissionsCredentialToken *permissions_credential_token,
-     const DDS_Security_PermissionsHandle handle,
-    DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(permissions_credential_token);
-  DDSRT_UNUSED_ARG(handle);
-  DDSRT_UNUSED_ARG(ex);
-  DDSRT_UNUSED_ARG(instance);
-
-  return true;
-}
-
-DDS_Security_boolean set_listener( dds_security_access_control *instance,
-     const dds_security_access_control_listener *listener,
-    DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(listener);
-  DDSRT_UNUSED_ARG(ex);
-  DDSRT_UNUSED_ARG(instance);
-
-  return true;
-}
-
-DDS_Security_boolean return_permissions_token( dds_security_access_control *instance,
-     const DDS_Security_PermissionsToken *token,
-    DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(token);
-  DDSRT_UNUSED_ARG(ex);
-  DDSRT_UNUSED_ARG(instance);
-
-  return true;
-}
-
-DDS_Security_boolean return_permissions_credential_token(
-     dds_security_access_control *instance,
-     const DDS_Security_PermissionsCredentialToken *permissions_credential_token,
-    DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(permissions_credential_token);
-  DDSRT_UNUSED_ARG(ex);
-  DDSRT_UNUSED_ARG(instance);
-
-  return true;
-}
-
-DDS_Security_boolean get_participant_sec_attributes(
-     dds_security_access_control *instance,
-     const DDS_Security_PermissionsHandle permissions_handle,
-    DDS_Security_ParticipantSecurityAttributes *attributes,
-    DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(permissions_handle);
-  DDSRT_UNUSED_ARG(attributes);
-  DDSRT_UNUSED_ARG(ex);
-  DDSRT_UNUSED_ARG(instance);
-
-  return true;
-}
-
-DDS_Security_boolean get_topic_sec_attributes( dds_security_access_control *instance,
-     const DDS_Security_PermissionsHandle permissions_handle,
-     const char *topic_name,
-    DDS_Security_TopicSecurityAttributes *attributes,
-    DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(permissions_handle);
-  DDSRT_UNUSED_ARG(topic_name);
-  DDSRT_UNUSED_ARG(attributes);
-  DDSRT_UNUSED_ARG(ex);
-  DDSRT_UNUSED_ARG(instance);
-
-  return true;
-}
-
-DDS_Security_boolean get_datawriter_sec_attributes(
-     dds_security_access_control *instance,
-     const DDS_Security_PermissionsHandle permissions_handle,
-     const char *topic_name,
-     const DDS_Security_PartitionQosPolicy *partition,
-     const DDS_Security_DataTagQosPolicy *data_tag,
-    DDS_Security_EndpointSecurityAttributes *attributes,
-    DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(permissions_handle);
-  DDSRT_UNUSED_ARG(topic_name);
-  DDSRT_UNUSED_ARG(partition);
-  DDSRT_UNUSED_ARG(data_tag);
-  DDSRT_UNUSED_ARG(attributes);
-  DDSRT_UNUSED_ARG(ex);
-  DDSRT_UNUSED_ARG(instance);
-
-  return true;
-}
-
-DDS_Security_boolean get_datareader_sec_attributes(
-     dds_security_access_control *instance,
-     const DDS_Security_PermissionsHandle permissions_handle,
-     const char *topic_name,
-     const DDS_Security_PartitionQosPolicy *partition,
-     const DDS_Security_DataTagQosPolicy *data_tag,
-    DDS_Security_EndpointSecurityAttributes *attributes,
-    DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(permissions_handle);
-  DDSRT_UNUSED_ARG(topic_name);
-  DDSRT_UNUSED_ARG(partition);
-  DDSRT_UNUSED_ARG(data_tag);
-  DDSRT_UNUSED_ARG(attributes);
-  DDSRT_UNUSED_ARG(ex);
-  DDSRT_UNUSED_ARG(instance);
-
-  return true;
-}
-
-DDS_Security_boolean return_participant_sec_attributes(
-     dds_security_access_control *instance,
-     const DDS_Security_ParticipantSecurityAttributes *attributes,
-    DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(attributes);
-  DDSRT_UNUSED_ARG(ex);
-  DDSRT_UNUSED_ARG(instance);
-
-  return true;
-}
-
-DDS_Security_boolean return_topic_sec_attributes(
-     dds_security_access_control *instance,
-     const DDS_Security_TopicSecurityAttributes *attributes,
-    DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(attributes);
-  DDSRT_UNUSED_ARG(ex);
-  DDSRT_UNUSED_ARG(instance);
-
-  return true;
-}
-
-DDS_Security_boolean return_datawriter_sec_attributes(
-     dds_security_access_control *instance,
-     const DDS_Security_EndpointSecurityAttributes *attributes,
-    DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(attributes);
-  DDSRT_UNUSED_ARG(ex);
-  DDSRT_UNUSED_ARG(instance);
-
-  return true;
-}
-
-DDS_Security_boolean return_datareader_sec_attributes(
-     dds_security_access_control *instance,
-     const DDS_Security_EndpointSecurityAttributes *attributes,
-    DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(attributes);
-  DDSRT_UNUSED_ARG(ex);
-  DDSRT_UNUSED_ARG(instance);
-
-  return true;
-}
-
-DDS_Security_boolean return_permissions_handle(
-     dds_security_access_control *instance,
-     const DDS_Security_PermissionsHandle permissions_handle,
-    DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(permissions_handle);
-  DDSRT_UNUSED_ARG(ex);
-  DDSRT_UNUSED_ARG(instance);
-
-  return true;
-}
-
- int32_t init_access_control(  const char *argument, void **context)
-{
-
-  dds_security_access_control *access_control;
-
-  DDSRT_UNUSED_ARG(argument);
-
-  //allocate new instance
-  access_control = ddsrt_malloc(sizeof(dds_security_access_control));
-  memset(access_control, 0, sizeof(dds_security_access_control));
-
-  //assign the interface functions
-  access_control->validate_local_permissions = &validate_local_permissions;
-
-  access_control->validate_remote_permissions = &validate_remote_permissions;
-
-  access_control->check_create_participant = &check_create_participant;
-
-  access_control->check_create_datawriter = &check_create_datawriter;
-
-  access_control->check_create_datareader = &check_create_datareader;
-
-  access_control->check_create_topic = &check_create_topic;
-
-  access_control->check_local_datawriter_register_instance =
-      &check_local_datawriter_register_instance;
-
-  access_control->check_local_datawriter_dispose_instance =
-      &check_local_datawriter_dispose_instance;
-
-  access_control->check_remote_participant = &check_remote_participant;
-
-  access_control->check_remote_datawriter = &check_remote_datawriter;
-
-  access_control->check_remote_datareader = &check_remote_datareader;
-
-  access_control->check_remote_topic = &check_remote_topic;
-
-  access_control->check_local_datawriter_match = &check_local_datawriter_match;
-
-  access_control->check_local_datareader_match = &check_local_datareader_match;
-
-  access_control->check_remote_datawriter_register_instance =
-      &check_remote_datawriter_register_instance;
-
-  access_control->check_remote_datawriter_dispose_instance =
-      &check_remote_datawriter_dispose_instance;
-
-  access_control->get_permissions_token = &get_permissions_token;
-
-  access_control->get_permissions_credential_token =
-      &get_permissions_credential_token;
-
-  access_control->set_listener = &set_listener;
-
-  access_control->return_permissions_token = &return_permissions_token;
-
-  access_control->return_permissions_credential_token =
-      &return_permissions_credential_token;
-
-  access_control->get_participant_sec_attributes =
-      &get_participant_sec_attributes;
-
-  access_control->get_topic_sec_attributes = &get_topic_sec_attributes;
-
-  access_control->get_datawriter_sec_attributes =
-      &get_datawriter_sec_attributes;
-
-  access_control->get_datareader_sec_attributes =
-      &get_datareader_sec_attributes;
-
-  access_control->return_participant_sec_attributes =
-      &return_participant_sec_attributes;
-
-  access_control->return_topic_sec_attributes =
-       &return_topic_sec_attributes;
-
-  access_control->return_datawriter_sec_attributes =
-      &return_datawriter_sec_attributes;
-
-  access_control->return_datareader_sec_attributes =
-      &return_datareader_sec_attributes;
-
-  access_control->return_permissions_handle =
-        &return_permissions_handle;
-
-  //return the instance
-  *context = access_control;
-  return 0;
-}
-
- int32_t finalize_access_control(  void *context)
-{
-
-  DDSRT_UNUSED_ARG(context);
-
-  ddsrt_free((dds_security_access_control*) context);
-  return 0;
-}
diff --git a/src/security/core/tests/plugin_loading/plugin_mock/access_control_all_ok/mock_access_control.h b/src/security/core/tests/plugin_loading/plugin_mock/access_control_all_ok/mock_access_control.h
deleted file mode 100644
index 07eb595..0000000
--- a/src/security/core/tests/plugin_loading/plugin_mock/access_control_all_ok/mock_access_control.h
+++ /dev/null
@@ -1,281 +0,0 @@
-/*
- * Copyright(c) 2006 to 2019 ADLINK Technology Limited and others
- *
- * This program and the accompanying materials are made available under the
- * terms of the Eclipse Public License v. 2.0 which is available at
- * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
- * v. 1.0 which is available at
- * http://www.eclipse.org/org/documents/edl-v10.php.
- *
- * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
- */
-
-#ifndef SECURITY_ACCESS_CONTROL_ALLOK_H_
-#define SECURITY_BUILTIN_PLUGINS_AUTHENTICATION_H_
-
-#include "dds/security/access_control_all_ok_export.h"
-#include "dds/security/dds_security_api.h"
-
-SECURITY_EXPORT int32_t
-init_access_control(const char *argument, void **context);
-
-SECURITY_EXPORT int32_t
-finalize_access_control(void *context);
-
-
-/**
- * AccessControl Interface
- */
-
-DDS_Security_PermissionsHandle
-validate_local_permissions
-        ( dds_security_access_control *instance,
-          const dds_security_authentication *auth_plugin,
-          const DDS_Security_IdentityHandle identity,
-          const DDS_Security_DomainId domain_id,
-          const DDS_Security_Qos *participant_qos,
-          DDS_Security_SecurityException *ex);
-
-DDS_Security_PermissionsHandle
-validate_remote_permissions
-        ( dds_security_access_control *instance,
-          const dds_security_authentication *auth_plugin,
-          const DDS_Security_IdentityHandle local_identity_handle,
-          const DDS_Security_IdentityHandle remote_identity_handle,
-          const DDS_Security_PermissionsToken *remote_permissions_token,
-          const DDS_Security_AuthenticatedPeerCredentialToken *remote_credential_token,
-          DDS_Security_SecurityException *ex);
-
-DDS_Security_boolean
-check_create_participant
-        ( dds_security_access_control *instance,
-          const DDS_Security_PermissionsHandle permissions_handle,
-          const DDS_Security_DomainId domain_id,
-          const DDS_Security_Qos *participant_qos,
-          DDS_Security_SecurityException *ex);
-
-DDS_Security_boolean
-check_create_datawriter
-        ( dds_security_access_control *instance,
-          const DDS_Security_PermissionsHandle permissions_handle,
-          const DDS_Security_DomainId domain_id,
-          const DDS_Security_char *topic_name,
-          const DDS_Security_Qos *writer_qos,
-          const DDS_Security_PartitionQosPolicy *partition,
-          const DDS_Security_DataTags *data_tag,
-          DDS_Security_SecurityException *ex);
-
-DDS_Security_boolean
-check_create_datareader
-        ( dds_security_access_control *instance,
-          const DDS_Security_PermissionsHandle permissions_handle,
-          const DDS_Security_DomainId domain_id,
-          const DDS_Security_char *topic_name,
-          const DDS_Security_Qos *reader_qos,
-          const DDS_Security_PartitionQosPolicy *partition,
-          const DDS_Security_DataTags *data_tag,
-          DDS_Security_SecurityException *ex);
-
-
-DDS_Security_boolean
-check_create_topic
-        ( dds_security_access_control *instance,
-          const DDS_Security_PermissionsHandle permissions_handle,
-          const DDS_Security_DomainId domain_id,
-          const DDS_Security_char *topic_name,
-          const DDS_Security_Qos *topic_qos,
-          DDS_Security_SecurityException *ex);
-
-DDS_Security_boolean
-check_local_datawriter_register_instance
-        ( dds_security_access_control *instance,
-          const DDS_Security_PermissionsHandle permissions_handle,
-          const DDS_Security_Entity *writer,
-          const DDS_Security_DynamicData *key,
-          DDS_Security_SecurityException *ex);
-
-DDS_Security_boolean
-check_local_datawriter_dispose_instance
-        ( dds_security_access_control *instance,
-          const DDS_Security_PermissionsHandle permissions_handle,
-          const DDS_Security_Entity *writer,
-          const DDS_Security_DynamicData key,
-          DDS_Security_SecurityException *ex);
-
-DDS_Security_boolean
-check_remote_participant
-        ( dds_security_access_control *instance,
-          const DDS_Security_PermissionsHandle permissions_handle,
-          const DDS_Security_DomainId domain_id,
-          const DDS_Security_ParticipantBuiltinTopicDataSecure *participant_data,
-          DDS_Security_SecurityException *ex);
-
-DDS_Security_boolean
-check_remote_datawriter
-        ( dds_security_access_control *instance,
-          const DDS_Security_PermissionsHandle permissions_handle,
-          const DDS_Security_DomainId domain_id,
-          const DDS_Security_PublicationBuiltinTopicDataSecure *publication_data,
-          DDS_Security_SecurityException *ex);
-
-DDS_Security_boolean
-check_remote_datareader
-        ( dds_security_access_control *instance,
-          const DDS_Security_PermissionsHandle permissions_handle,
-          const DDS_Security_DomainId domain_id,
-          const DDS_Security_SubscriptionBuiltinTopicDataSecure *subscription_data,
-          DDS_Security_boolean *relay_only,
-          DDS_Security_SecurityException *ex);
-
-DDS_Security_boolean
-check_remote_topic
-        ( dds_security_access_control *instance,
-          const DDS_Security_PermissionsHandle permissions_handle,
-          const DDS_Security_DomainId domain_id,
-          const DDS_Security_TopicBuiltinTopicData *topic_data,
-          DDS_Security_SecurityException *ex);
-
-
-DDS_Security_boolean
-check_local_datawriter_match
-        ( dds_security_access_control *instance,
-          const DDS_Security_PermissionsHandle writer_permissions_handle,
-          const DDS_Security_PermissionsHandle reader_permissions_handle,
-          const DDS_Security_PublicationBuiltinTopicDataSecure *publication_data,
-          const DDS_Security_SubscriptionBuiltinTopicDataSecure *subscription_data,
-          DDS_Security_SecurityException *ex);
-
-
-DDS_Security_boolean
-check_local_datareader_match
-        ( dds_security_access_control *instance,
-          const DDS_Security_PermissionsHandle reader_permissions_handle,
-          const DDS_Security_PermissionsHandle writer_permissions_handle,
-          const DDS_Security_SubscriptionBuiltinTopicDataSecure *subscription_data,
-          const DDS_Security_PublicationBuiltinTopicDataSecure *publication_data,
-          DDS_Security_SecurityException *ex);
-
-DDS_Security_boolean
-check_remote_datawriter_register_instance
-        ( dds_security_access_control *instance,
-          const DDS_Security_PermissionsHandle permissions_handle,
-          const DDS_Security_Entity *reader,
-          const DDS_Security_InstanceHandle publication_handle,
-          const DDS_Security_DynamicData key,
-          const DDS_Security_InstanceHandle instance_handle,
-          DDS_Security_SecurityException *ex);
-
-DDS_Security_boolean
-check_remote_datawriter_dispose_instance
-        ( dds_security_access_control *instance,
-          const DDS_Security_PermissionsHandle permissions_handle,
-          const DDS_Security_Entity *reader,
-          const DDS_Security_InstanceHandle publication_handle,
-          const DDS_Security_DynamicData key,
-          DDS_Security_SecurityException *ex);
-
-DDS_Security_boolean
-get_permissions_token
-        ( dds_security_access_control *instance,
-          DDS_Security_PermissionsToken *permissions_token,
-          const DDS_Security_PermissionsHandle handle,
-          DDS_Security_SecurityException *ex);
-
-DDS_Security_boolean
-get_permissions_credential_token
-        ( dds_security_access_control *instance,
-          DDS_Security_PermissionsCredentialToken *permissions_credential_token,
-          const DDS_Security_PermissionsHandle handle,
-          DDS_Security_SecurityException *ex);
-
-DDS_Security_boolean
-set_listener
-        ( dds_security_access_control *instance,
-          const dds_security_access_control_listener *listener,
-          DDS_Security_SecurityException *ex);
-
-DDS_Security_boolean
-return_permissions_token
-        ( dds_security_access_control *instance,
-          const DDS_Security_PermissionsToken *token,
-          DDS_Security_SecurityException *ex);
-
-DDS_Security_boolean
-return_permissions_credential_token
-        ( dds_security_access_control *instance,
-          const DDS_Security_PermissionsCredentialToken *permissions_credential_token,
-          DDS_Security_SecurityException *ex);
-
-DDS_Security_boolean
-get_participant_sec_attributes
-        ( dds_security_access_control *instance,
-          const DDS_Security_PermissionsHandle permissions_handle,
-          DDS_Security_ParticipantSecurityAttributes *attributes,
-          DDS_Security_SecurityException *ex);
-
-
-DDS_Security_boolean
-get_topic_sec_attributes
-        ( dds_security_access_control *instance,
-          const DDS_Security_PermissionsHandle permissions_handle,
-          const DDS_Security_char *topic_name,
-          DDS_Security_TopicSecurityAttributes *attributes,
-          DDS_Security_SecurityException *ex);
-
-
-DDS_Security_boolean
-get_datawriter_sec_attributes
-        ( dds_security_access_control *instance,
-          const DDS_Security_PermissionsHandle permissions_handle,
-          const DDS_Security_char *topic_name,
-          const DDS_Security_PartitionQosPolicy *partition,
-          const DDS_Security_DataTagQosPolicy *data_tag,
-          DDS_Security_EndpointSecurityAttributes *attributes,
-          DDS_Security_SecurityException *ex);
-
-
-DDS_Security_boolean
-get_datareader_sec_attributes
-        ( dds_security_access_control *instance,
-          const DDS_Security_PermissionsHandle permissions_handle,
-          const DDS_Security_char *topic_name,
-          const DDS_Security_PartitionQosPolicy *partition,
-          const DDS_Security_DataTagQosPolicy *data_tag,
-          DDS_Security_EndpointSecurityAttributes *attributes,
-          DDS_Security_SecurityException *ex);
-
-
-DDS_Security_boolean
-return_participant_sec_attributes
-        ( dds_security_access_control *instance,
-          const DDS_Security_ParticipantSecurityAttributes *attributes,
-          DDS_Security_SecurityException *ex);
-
-DDS_Security_boolean
-return_topic_sec_attributes
-        ( dds_security_access_control *instance,
-          const DDS_Security_TopicSecurityAttributes *attributes,
-          DDS_Security_SecurityException *ex);
-
-DDS_Security_boolean
-return_datawriter_sec_attributes
-        ( dds_security_access_control *instance,
-          const DDS_Security_EndpointSecurityAttributes *attributes,
-          DDS_Security_SecurityException *ex);
-
-
-DDS_Security_boolean
-return_datareader_sec_attributes
-        ( dds_security_access_control *instance,
-          const DDS_Security_EndpointSecurityAttributes *attributes,
-          DDS_Security_SecurityException *ex);
-
-DDS_Security_boolean
-return_permissions_handle
-        ( dds_security_access_control *instance,
-          const DDS_Security_PermissionsHandle permissions_handle,
-          DDS_Security_SecurityException *ex);
-
-
-
-#endif /* SECURITY_BUILTIN_PLUGINS_AUTHENTICATION_H_ */
diff --git a/src/security/core/tests/plugin_loading/plugin_mock/access_control_missing_function/mock_access_control.c b/src/security/core/tests/plugin_loading/plugin_mock/access_control_missing_function/mock_access_control.c
deleted file mode 100644
index a28e7e7..0000000
--- a/src/security/core/tests/plugin_loading/plugin_mock/access_control_missing_function/mock_access_control.c
+++ /dev/null
@@ -1,600 +0,0 @@
-/*
- * Copyright(c) 2006 to 2019 ADLINK Technology Limited and others
- *
- * This program and the accompanying materials are made available under the
- * terms of the Eclipse Public License v. 2.0 which is available at
- * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
- * v. 1.0 which is available at
- * http://www.eclipse.org/org/documents/edl-v10.php.
- *
- * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
- */
-#include "dds/security/dds_security_api.h"
-#include "dds/ddsrt/heap.h"
-#include "dds/ddsrt/misc.h"
-#include "mock_access_control.h"
-#include <stdio.h>
-#include <string.h>
-#include <stdbool.h>
-
-/**
- * Implementation structure for storing encapsulated members of the instance
- * while giving only the interface definition to user
- */
-
-typedef struct dds_security_access_control_impl {
-  dds_security_access_control base;
-  int member;
-} dds_security_access_control_impl;
-
-/**
- * Function implementations
- */
-
-DDS_Security_PermissionsHandle validate_local_permissions(
-     dds_security_access_control *instance,
-     const dds_security_authentication *auth_plugin,
-     const DDS_Security_IdentityHandle identity,
-     const DDS_Security_DomainId domain_id,
-     const DDS_Security_Qos *participant_qos,
-    DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(auth_plugin);
-  DDSRT_UNUSED_ARG(auth_plugin);
-  DDSRT_UNUSED_ARG(identity);
-  DDSRT_UNUSED_ARG(domain_id);
-  DDSRT_UNUSED_ARG(participant_qos);
-  DDSRT_UNUSED_ARG(ex);
-  DDSRT_UNUSED_ARG(instance);
-
-  return 1;
-}
-
-DDS_Security_PermissionsHandle validate_remote_permissions(
-     dds_security_access_control *instance,
-     const dds_security_authentication *auth_plugin,
-     const DDS_Security_IdentityHandle local_identity_handle,
-     const DDS_Security_IdentityHandle remote_identity_handle,
-     const DDS_Security_PermissionsToken *remote_permissions_token,
-     const DDS_Security_AuthenticatedPeerCredentialToken *remote_credential_token,
-    DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(auth_plugin);
-  DDSRT_UNUSED_ARG(local_identity_handle);
-  DDSRT_UNUSED_ARG(remote_identity_handle);
-  DDSRT_UNUSED_ARG(remote_permissions_token);
-  DDSRT_UNUSED_ARG(remote_credential_token);
-  DDSRT_UNUSED_ARG(ex);
-  DDSRT_UNUSED_ARG(instance);
-
-  return 0;
-}
-
-DDS_Security_boolean check_create_participant( dds_security_access_control *instance,
-     const DDS_Security_PermissionsHandle permissions_handle,
-     const DDS_Security_DomainId domain_id,  const DDS_Security_Qos *participant_qos,
-    DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(permissions_handle);
-  DDSRT_UNUSED_ARG(domain_id);
-  DDSRT_UNUSED_ARG(participant_qos);
-  DDSRT_UNUSED_ARG(ex);
-  DDSRT_UNUSED_ARG(instance);
-
-  return true;
-}
-
-DDS_Security_boolean check_create_datawriter( dds_security_access_control *instance,
-     const DDS_Security_PermissionsHandle permissions_handle,
-     const DDS_Security_DomainId domain_id,  const char *topic_name,
-     const DDS_Security_Qos *writer_qos,
-     const DDS_Security_PartitionQosPolicy *partition,
-     const DDS_Security_DataTags *data_tag,
-    DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(permissions_handle);
-  DDSRT_UNUSED_ARG(domain_id);
-  DDSRT_UNUSED_ARG(topic_name);
-  DDSRT_UNUSED_ARG(writer_qos);
-  DDSRT_UNUSED_ARG(partition);
-  DDSRT_UNUSED_ARG(data_tag);
-  DDSRT_UNUSED_ARG(ex);
-  DDSRT_UNUSED_ARG(instance);
-
-  return true;
-}
-
-DDS_Security_boolean check_create_datareader( dds_security_access_control *instance,
-     const DDS_Security_PermissionsHandle permissions_handle,
-     const DDS_Security_DomainId domain_id,  const char *topic_name,
-     const DDS_Security_Qos *reader_qos,
-     const DDS_Security_PartitionQosPolicy *partition,
-     const DDS_Security_DataTags *data_tag,
-    DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(permissions_handle);
-  DDSRT_UNUSED_ARG(domain_id);
-  DDSRT_UNUSED_ARG(topic_name);
-  DDSRT_UNUSED_ARG(reader_qos);
-  DDSRT_UNUSED_ARG(partition);
-  DDSRT_UNUSED_ARG(data_tag);
-  DDSRT_UNUSED_ARG(ex);
-  DDSRT_UNUSED_ARG(instance);
-
-  return true;
-}
-
-DDS_Security_boolean check_create_topic( dds_security_access_control *instance,
-     const DDS_Security_PermissionsHandle permissions_handle,
-     const DDS_Security_DomainId domain_id,  const char *topic_name,
-     const DDS_Security_Qos *qos, DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(permissions_handle);
-  DDSRT_UNUSED_ARG(domain_id);
-  DDSRT_UNUSED_ARG(topic_name);
-  DDSRT_UNUSED_ARG(qos);
-  DDSRT_UNUSED_ARG(ex);
-  DDSRT_UNUSED_ARG(instance);
-
-  return true;
-}
-
-DDS_Security_boolean check_local_datawriter_register_instance(
-     dds_security_access_control *instance,
-     const DDS_Security_PermissionsHandle permissions_handle,
-     const DDS_Security_Entity *writer,  const DDS_Security_DynamicData *key,
-    DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(permissions_handle);
-  DDSRT_UNUSED_ARG(writer);
-  DDSRT_UNUSED_ARG(key);
-  DDSRT_UNUSED_ARG(ex);
-  DDSRT_UNUSED_ARG(instance);
-
-  return true;
-}
-
-DDS_Security_boolean check_local_datawriter_dispose_instance(
-     dds_security_access_control *instance,
-     const DDS_Security_PermissionsHandle permissions_handle,
-     const DDS_Security_Entity *writer,  const DDS_Security_DynamicData key,
-    DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(permissions_handle);
-  DDSRT_UNUSED_ARG(writer);
-  DDSRT_UNUSED_ARG(key);
-  DDSRT_UNUSED_ARG(ex);
-  DDSRT_UNUSED_ARG(instance);
-
-  return true;
-}
-
-DDS_Security_boolean check_remote_participant( dds_security_access_control *instance,
-     const DDS_Security_PermissionsHandle permissions_handle,
-     const DDS_Security_DomainId domain_id,
-     const DDS_Security_ParticipantBuiltinTopicDataSecure *participant_data,
-    DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(permissions_handle);
-  DDSRT_UNUSED_ARG(domain_id);
-  DDSRT_UNUSED_ARG(participant_data);
-  DDSRT_UNUSED_ARG(ex);
-  DDSRT_UNUSED_ARG(instance);
-
-  return true;
-}
-
-DDS_Security_boolean check_remote_datawriter( dds_security_access_control *instance,
-     const DDS_Security_PermissionsHandle permissions_handle,
-     const DDS_Security_DomainId domain_id,
-     const DDS_Security_PublicationBuiltinTopicDataSecure *publication_data,
-    DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(permissions_handle);
-  DDSRT_UNUSED_ARG(domain_id);
-  DDSRT_UNUSED_ARG(publication_data);
-  DDSRT_UNUSED_ARG(ex);
-  DDSRT_UNUSED_ARG(instance);
-
-  return true;
-}
-
-DDS_Security_boolean check_remote_datareader( dds_security_access_control *instance,
-     const DDS_Security_PermissionsHandle permissions_handle,
-     const DDS_Security_DomainId domain_id,
-     const DDS_Security_SubscriptionBuiltinTopicDataSecure *subscription_data,
-    DDS_Security_boolean *relay_only, DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(permissions_handle);
-  DDSRT_UNUSED_ARG(domain_id);
-  DDSRT_UNUSED_ARG(subscription_data);
-  DDSRT_UNUSED_ARG(ex);
-  DDSRT_UNUSED_ARG(instance);
-
-  *relay_only = false;
-
-  return true;
-}
-
-DDS_Security_boolean check_remote_topic( dds_security_access_control *instance,
-     const DDS_Security_PermissionsHandle permissions_handle,
-     const DDS_Security_DomainId domain_id,
-     const DDS_Security_TopicBuiltinTopicData *topic_data,
-    DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(permissions_handle);
-  DDSRT_UNUSED_ARG(domain_id);
-  DDSRT_UNUSED_ARG(topic_data);
-  DDSRT_UNUSED_ARG(ex);
-  DDSRT_UNUSED_ARG(instance);
-
-  return true;
-}
-
-DDS_Security_boolean check_local_datawriter_match(
-     dds_security_access_control *instance,
-     const DDS_Security_PermissionsHandle writer_permissions_handle,
-     const DDS_Security_PermissionsHandle reader_permissions_handle,
-     const DDS_Security_PublicationBuiltinTopicDataSecure *publication_data,
-     const DDS_Security_SubscriptionBuiltinTopicDataSecure *subscription_data,
-    DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(writer_permissions_handle);
-  DDSRT_UNUSED_ARG(reader_permissions_handle);
-  DDSRT_UNUSED_ARG(publication_data);
-  DDSRT_UNUSED_ARG(subscription_data);
-  DDSRT_UNUSED_ARG(ex);
-  DDSRT_UNUSED_ARG(instance);
-
-  return true;
-}
-
-DDS_Security_boolean check_local_datareader_match(
-     dds_security_access_control *instance,
-     const DDS_Security_PermissionsHandle reader_permissions_handle,
-     const DDS_Security_PermissionsHandle writer_permissions_handle,
-     const DDS_Security_SubscriptionBuiltinTopicDataSecure *subscription_data,
-     const DDS_Security_PublicationBuiltinTopicDataSecure *publication_data,
-    DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(reader_permissions_handle);
-  DDSRT_UNUSED_ARG(writer_permissions_handle);
-  DDSRT_UNUSED_ARG(subscription_data);
-  DDSRT_UNUSED_ARG(publication_data);
-  DDSRT_UNUSED_ARG(ex);
-  DDSRT_UNUSED_ARG(instance);
-
-  return true;
-}
-
-DDS_Security_boolean check_remote_datawriter_register_instance(
-     dds_security_access_control *instance,
-     const DDS_Security_PermissionsHandle permissions_handle,
-     const DDS_Security_Entity *reader,
-     const DDS_Security_InstanceHandle publication_handle,
-     const DDS_Security_DynamicData key,
-     const DDS_Security_InstanceHandle instance_handle,
-    DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(permissions_handle);
-  DDSRT_UNUSED_ARG(reader);
-  DDSRT_UNUSED_ARG(publication_handle);
-  DDSRT_UNUSED_ARG(key);
-  DDSRT_UNUSED_ARG(instance_handle);
-  DDSRT_UNUSED_ARG(ex);
-  DDSRT_UNUSED_ARG(instance);
-
-  return true;
-}
-
-DDS_Security_boolean check_remote_datawriter_dispose_instance(
-     dds_security_access_control *instance,
-     const DDS_Security_PermissionsHandle permissions_handle,
-     const DDS_Security_Entity *reader,
-     const DDS_Security_InstanceHandle publication_handle,
-     const DDS_Security_DynamicData key,
-    DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(permissions_handle);
-  DDSRT_UNUSED_ARG(reader);
-  DDSRT_UNUSED_ARG(publication_handle);
-  DDSRT_UNUSED_ARG(key);
-  DDSRT_UNUSED_ARG(ex);
-  DDSRT_UNUSED_ARG(instance);
-
-  return true;
-}
-
-DDS_Security_boolean get_permissions_token( dds_security_access_control *instance,
-    DDS_Security_PermissionsToken *permissions_token,
-     const DDS_Security_PermissionsHandle handle,
-    DDS_Security_SecurityException *ex)
-{
-
-  DDSRT_UNUSED_ARG(permissions_token);
-  DDSRT_UNUSED_ARG(handle);
-  DDSRT_UNUSED_ARG(ex);
-  DDSRT_UNUSED_ARG(instance);
-
-  return true;
-}
-
-DDS_Security_boolean get_permissions_credential_token(
-     dds_security_access_control *instance,
-    DDS_Security_PermissionsCredentialToken *permissions_credential_token,
-     const DDS_Security_PermissionsHandle handle,
-    DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(permissions_credential_token);
-  DDSRT_UNUSED_ARG(handle);
-  DDSRT_UNUSED_ARG(ex);
-  DDSRT_UNUSED_ARG(instance);
-
-  return true;
-}
-
-DDS_Security_boolean set_listener( dds_security_access_control *instance,
-     const dds_security_access_control_listener *listener,
-    DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(listener);
-  DDSRT_UNUSED_ARG(ex);
-  DDSRT_UNUSED_ARG(instance);
-
-  return true;
-}
-
-DDS_Security_boolean return_permissions_token( dds_security_access_control *instance,
-     const DDS_Security_PermissionsToken *token,
-    DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(token);
-  DDSRT_UNUSED_ARG(ex);
-  DDSRT_UNUSED_ARG(instance);
-
-  return true;
-}
-
-DDS_Security_boolean return_permissions_credential_token(
-     dds_security_access_control *instance,
-     const DDS_Security_PermissionsCredentialToken *permissions_credential_token,
-    DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(permissions_credential_token);
-  DDSRT_UNUSED_ARG(ex);
-  DDSRT_UNUSED_ARG(instance);
-
-  return true;
-}
-
-DDS_Security_boolean get_participant_sec_attributes(
-     dds_security_access_control *instance,
-     const DDS_Security_PermissionsHandle permissions_handle,
-    DDS_Security_ParticipantSecurityAttributes *attributes,
-    DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(permissions_handle);
-  DDSRT_UNUSED_ARG(attributes);
-  DDSRT_UNUSED_ARG(ex);
-  DDSRT_UNUSED_ARG(instance);
-
-  return true;
-}
-
-DDS_Security_boolean get_topic_sec_attributes( dds_security_access_control *instance,
-     const DDS_Security_PermissionsHandle permissions_handle,
-     const char *topic_name,
-    DDS_Security_TopicSecurityAttributes *attributes,
-    DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(permissions_handle);
-  DDSRT_UNUSED_ARG(topic_name);
-  DDSRT_UNUSED_ARG(attributes);
-  DDSRT_UNUSED_ARG(ex);
-  DDSRT_UNUSED_ARG(instance);
-
-  return true;
-}
-
-DDS_Security_boolean get_datawriter_sec_attributes(
-     dds_security_access_control *instance,
-     const DDS_Security_PermissionsHandle permissions_handle,
-     const char *topic_name,
-     const DDS_Security_PartitionQosPolicy *partition,
-     const DDS_Security_DataTagQosPolicy *data_tag,
-    DDS_Security_EndpointSecurityAttributes *attributes,
-    DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(permissions_handle);
-  DDSRT_UNUSED_ARG(topic_name);
-  DDSRT_UNUSED_ARG(partition);
-  DDSRT_UNUSED_ARG(data_tag);
-  DDSRT_UNUSED_ARG(attributes);
-  DDSRT_UNUSED_ARG(ex);
-  DDSRT_UNUSED_ARG(instance);
-
-  return true;
-}
-
-DDS_Security_boolean get_datareader_sec_attributes(
-     dds_security_access_control *instance,
-     const DDS_Security_PermissionsHandle permissions_handle,
-     const char *topic_name,
-     const DDS_Security_PartitionQosPolicy *partition,
-     const DDS_Security_DataTagQosPolicy *data_tag,
-    DDS_Security_EndpointSecurityAttributes *attributes,
-    DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(permissions_handle);
-  DDSRT_UNUSED_ARG(topic_name);
-  DDSRT_UNUSED_ARG(partition);
-  DDSRT_UNUSED_ARG(data_tag);
-  DDSRT_UNUSED_ARG(attributes);
-  DDSRT_UNUSED_ARG(ex);
-  DDSRT_UNUSED_ARG(instance);
-
-  return true;
-}
-
-DDS_Security_boolean return_participant_sec_attributes(
-     dds_security_access_control *instance,
-     const DDS_Security_ParticipantSecurityAttributes *attributes,
-    DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(attributes);
-  DDSRT_UNUSED_ARG(ex);
-  DDSRT_UNUSED_ARG(instance);
-
-  return true;
-}
-
-DDS_Security_boolean return_topic_sec_attributes(
-     dds_security_access_control *instance,
-     const DDS_Security_TopicSecurityAttributes *attributes,
-    DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(attributes);
-  DDSRT_UNUSED_ARG(ex);
-  DDSRT_UNUSED_ARG(instance);
-
-  return true;
-}
-
-DDS_Security_boolean return_datawriter_sec_attributes(
-     dds_security_access_control *instance,
-     const DDS_Security_EndpointSecurityAttributes *attributes,
-    DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(attributes);
-  DDSRT_UNUSED_ARG(ex);
-  DDSRT_UNUSED_ARG(instance);
-
-  return true;
-}
-
-DDS_Security_boolean return_datareader_sec_attributes(
-     dds_security_access_control *instance,
-     const DDS_Security_EndpointSecurityAttributes *attributes,
-    DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(attributes);
-  DDSRT_UNUSED_ARG(ex);
-  DDSRT_UNUSED_ARG(instance);
-
-  return true;
-}
-
-DDS_Security_boolean return_permissions_handle(
-     dds_security_access_control *instance,
-     const DDS_Security_PermissionsHandle permissions_handle,
-    DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(permissions_handle);
-  DDSRT_UNUSED_ARG(ex);
-  DDSRT_UNUSED_ARG(instance);
-
-  return true;
-}
-
-int32_t init_access_control(  const char *argument, void **context)
-{
-
-  dds_security_access_control *access_control;
-
-  DDSRT_UNUSED_ARG(argument);
-
-  //allocate new instance
-  access_control = ddsrt_malloc(sizeof(dds_security_access_control));
-  memset(access_control, 0, sizeof(dds_security_access_control));
-
-  //assign the interface functions
-  access_control->validate_local_permissions = &validate_local_permissions;
-
-  access_control->validate_remote_permissions = &validate_remote_permissions;
-
-  access_control->check_create_participant = &check_create_participant;
-
-  access_control->check_create_datawriter = &check_create_datawriter;
-
-  /* removed the function assignment
-   access_control->check_create_datareader = &check_create_datareader;
-
-   */
-
-  access_control->check_create_topic = &check_create_topic;
-
-  access_control->check_local_datawriter_register_instance =
-      &check_local_datawriter_register_instance;
-
-  access_control->check_local_datawriter_dispose_instance =
-      &check_local_datawriter_dispose_instance;
-
-  access_control->check_remote_participant = &check_remote_participant;
-
-  access_control->check_remote_datawriter = &check_remote_datawriter;
-
-  access_control->check_remote_datareader = &check_remote_datareader;
-
-  access_control->check_remote_topic = &check_remote_topic;
-
-  access_control->check_local_datawriter_match = &check_local_datawriter_match;
-
-  access_control->check_local_datareader_match = &check_local_datareader_match;
-
-  access_control->check_remote_datawriter_register_instance =
-      &check_remote_datawriter_register_instance;
-
-  access_control->check_remote_datawriter_dispose_instance =
-      &check_remote_datawriter_dispose_instance;
-
-  access_control->get_permissions_token = &get_permissions_token;
-
-  access_control->get_permissions_credential_token =
-      &get_permissions_credential_token;
-
-  access_control->set_listener = &set_listener;
-
-  access_control->return_permissions_token = &return_permissions_token;
-
-  access_control->return_permissions_credential_token =
-      &return_permissions_credential_token;
-
-  access_control->get_participant_sec_attributes =
-      &get_participant_sec_attributes;
-
-  access_control->get_topic_sec_attributes = &get_topic_sec_attributes;
-
-  access_control->get_datawriter_sec_attributes =
-      &get_datawriter_sec_attributes;
-
-  access_control->get_datareader_sec_attributes =
-      &get_datareader_sec_attributes;
-
-  access_control->return_participant_sec_attributes =
-      &return_participant_sec_attributes;
-
-  access_control->return_topic_sec_attributes =
-       &return_topic_sec_attributes;
-
-  access_control->return_datawriter_sec_attributes =
-      &return_datawriter_sec_attributes;
-
-  access_control->return_datareader_sec_attributes =
-      &return_datareader_sec_attributes;
-
-  access_control->return_permissions_handle =
-        &return_permissions_handle;
-
-  //return the instance
-  *context = access_control;
-  return 0;
-}
-
- int32_t finalize_access_control(  void *context)
-{
-
-  DDSRT_UNUSED_ARG(context);
-
-  ddsrt_free((dds_security_access_control*) context);
-  return 0;
-}
diff --git a/src/security/core/tests/plugin_loading/plugin_mock/access_control_missing_function/mock_access_control.h b/src/security/core/tests/plugin_loading/plugin_mock/access_control_missing_function/mock_access_control.h
deleted file mode 100644
index 89d87c0..0000000
--- a/src/security/core/tests/plugin_loading/plugin_mock/access_control_missing_function/mock_access_control.h
+++ /dev/null
@@ -1,280 +0,0 @@
-/*
- * Copyright(c) 2006 to 2019 ADLINK Technology Limited and others
- *
- * This program and the accompanying materials are made available under the
- * terms of the Eclipse Public License v. 2.0 which is available at
- * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
- * v. 1.0 which is available at
- * http://www.eclipse.org/org/documents/edl-v10.php.
- *
- * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
- */
-#ifndef SECURITY_ACCESS_CONTROL_ALLOK_H_
-#define SECURITY_BUILTIN_PLUGINS_AUTHENTICATION_H_
-
-#include "dds/security/access_control_missing_function_export.h"
-#include "dds/security/dds_security_api.h"
-
-SECURITY_EXPORT int32_t
-init_access_control(const char *argument, void **context);
-
-SECURITY_EXPORT int32_t
-finalize_access_control(void *context);
-
-
-/**
- * AccessControl Interface
- */
-
-DDS_Security_PermissionsHandle
-validate_local_permissions
-        ( dds_security_access_control *instance,
-          const dds_security_authentication *auth_plugin,
-          const DDS_Security_IdentityHandle identity,
-          const DDS_Security_DomainId domain_id,
-          const DDS_Security_Qos *participant_qos,
-          DDS_Security_SecurityException *ex);
-
-DDS_Security_PermissionsHandle
-validate_remote_permissions
-        ( dds_security_access_control *instance,
-          const dds_security_authentication *auth_plugin,
-          const DDS_Security_IdentityHandle local_identity_handle,
-          const DDS_Security_IdentityHandle remote_identity_handle,
-          const DDS_Security_PermissionsToken *remote_permissions_token,
-          const DDS_Security_AuthenticatedPeerCredentialToken *remote_credential_token,
-          DDS_Security_SecurityException *ex);
-
-DDS_Security_boolean
-check_create_participant
-        ( dds_security_access_control *instance,
-          const DDS_Security_PermissionsHandle permissions_handle,
-          const DDS_Security_DomainId domain_id,
-          const DDS_Security_Qos *participant_qos,
-          DDS_Security_SecurityException *ex);
-
-DDS_Security_boolean
-check_create_datawriter
-        ( dds_security_access_control *instance,
-          const DDS_Security_PermissionsHandle permissions_handle,
-          const DDS_Security_DomainId domain_id,
-          const DDS_Security_char *topic_name,
-          const DDS_Security_Qos *writer_qos,
-          const DDS_Security_PartitionQosPolicy *partition,
-          const DDS_Security_DataTags *data_tag,
-          DDS_Security_SecurityException *ex);
-
-DDS_Security_boolean
-check_create_datareader
-        ( dds_security_access_control *instance,
-          const DDS_Security_PermissionsHandle permissions_handle,
-          const DDS_Security_DomainId domain_id,
-          const DDS_Security_char *topic_name,
-          const DDS_Security_Qos *reader_qos,
-          const DDS_Security_PartitionQosPolicy *partition,
-          const DDS_Security_DataTags *data_tag,
-          DDS_Security_SecurityException *ex);
-
-
-DDS_Security_boolean
-check_create_topic
-        ( dds_security_access_control *instance,
-          const DDS_Security_PermissionsHandle permissions_handle,
-          const DDS_Security_DomainId domain_id,
-          const DDS_Security_char *topic_name,
-          const DDS_Security_Qos *topic_qos,
-          DDS_Security_SecurityException *ex);
-
-DDS_Security_boolean
-check_local_datawriter_register_instance
-        ( dds_security_access_control *instance,
-          const DDS_Security_PermissionsHandle permissions_handle,
-          const DDS_Security_Entity *writer,
-          const DDS_Security_DynamicData *key,
-          DDS_Security_SecurityException *ex);
-
-DDS_Security_boolean
-check_local_datawriter_dispose_instance
-        ( dds_security_access_control *instance,
-          const DDS_Security_PermissionsHandle permissions_handle,
-          const DDS_Security_Entity *writer,
-          const DDS_Security_DynamicData key,
-          DDS_Security_SecurityException *ex);
-
-DDS_Security_boolean
-check_remote_participant
-        ( dds_security_access_control *instance,
-          const DDS_Security_PermissionsHandle permissions_handle,
-          const DDS_Security_DomainId domain_id,
-          const DDS_Security_ParticipantBuiltinTopicDataSecure *participant_data,
-          DDS_Security_SecurityException *ex);
-
-DDS_Security_boolean
-check_remote_datawriter
-        ( dds_security_access_control *instance,
-          const DDS_Security_PermissionsHandle permissions_handle,
-          const DDS_Security_DomainId domain_id,
-          const DDS_Security_PublicationBuiltinTopicDataSecure *publication_data,
-          DDS_Security_SecurityException *ex);
-
-DDS_Security_boolean
-check_remote_datareader
-        ( dds_security_access_control *instance,
-          const DDS_Security_PermissionsHandle permissions_handle,
-          const DDS_Security_DomainId domain_id,
-          const DDS_Security_SubscriptionBuiltinTopicDataSecure *subscription_data,
-          DDS_Security_boolean *relay_only,
-          DDS_Security_SecurityException *ex);
-
-DDS_Security_boolean
-check_remote_topic
-        ( dds_security_access_control *instance,
-          const DDS_Security_PermissionsHandle permissions_handle,
-          const DDS_Security_DomainId domain_id,
-          const DDS_Security_TopicBuiltinTopicData *topic_data,
-          DDS_Security_SecurityException *ex);
-
-
-DDS_Security_boolean
-check_local_datawriter_match
-        ( dds_security_access_control *instance,
-          const DDS_Security_PermissionsHandle writer_permissions_handle,
-          const DDS_Security_PermissionsHandle reader_permissions_handle,
-          const DDS_Security_PublicationBuiltinTopicDataSecure *publication_data,
-          const DDS_Security_SubscriptionBuiltinTopicDataSecure *subscription_data,
-          DDS_Security_SecurityException *ex);
-
-
-DDS_Security_boolean
-check_local_datareader_match
-        ( dds_security_access_control *instance,
-          const DDS_Security_PermissionsHandle reader_permissions_handle,
-          const DDS_Security_PermissionsHandle writer_permissions_handle,
-          const DDS_Security_SubscriptionBuiltinTopicDataSecure *subscription_data,
-          const DDS_Security_PublicationBuiltinTopicDataSecure *publication_data,
-          DDS_Security_SecurityException *ex);
-
-DDS_Security_boolean
-check_remote_datawriter_register_instance
-        ( dds_security_access_control *instance,
-          const DDS_Security_PermissionsHandle permissions_handle,
-          const DDS_Security_Entity *reader,
-          const DDS_Security_InstanceHandle publication_handle,
-          const DDS_Security_DynamicData key,
-          const DDS_Security_InstanceHandle instance_handle,
-          DDS_Security_SecurityException *ex);
-
-DDS_Security_boolean
-check_remote_datawriter_dispose_instance
-        ( dds_security_access_control *instance,
-          const DDS_Security_PermissionsHandle permissions_handle,
-          const DDS_Security_Entity *reader,
-          const DDS_Security_InstanceHandle publication_handle,
-          const DDS_Security_DynamicData key,
-          DDS_Security_SecurityException *ex);
-
-DDS_Security_boolean
-get_permissions_token
-        ( dds_security_access_control *instance,
-          DDS_Security_PermissionsToken *permissions_token,
-          const DDS_Security_PermissionsHandle handle,
-          DDS_Security_SecurityException *ex);
-
-DDS_Security_boolean
-get_permissions_credential_token
-        ( dds_security_access_control *instance,
-          DDS_Security_PermissionsCredentialToken *permissions_credential_token,
-          const DDS_Security_PermissionsHandle handle,
-          DDS_Security_SecurityException *ex);
-
-DDS_Security_boolean
-set_listener
-        ( dds_security_access_control *instance,
-          const dds_security_access_control_listener *listener,
-          DDS_Security_SecurityException *ex);
-
-DDS_Security_boolean
-return_permissions_token
-        ( dds_security_access_control *instance,
-          const DDS_Security_PermissionsToken *token,
-          DDS_Security_SecurityException *ex);
-
-DDS_Security_boolean
-return_permissions_credential_token
-        ( dds_security_access_control *instance,
-          const DDS_Security_PermissionsCredentialToken *permissions_credential_token,
-          DDS_Security_SecurityException *ex);
-
-DDS_Security_boolean
-get_participant_sec_attributes
-        ( dds_security_access_control *instance,
-          const DDS_Security_PermissionsHandle permissions_handle,
-          DDS_Security_ParticipantSecurityAttributes *attributes,
-          DDS_Security_SecurityException *ex);
-
-
-DDS_Security_boolean
-get_topic_sec_attributes
-        ( dds_security_access_control *instance,
-          const DDS_Security_PermissionsHandle permissions_handle,
-          const DDS_Security_char *topic_name,
-          DDS_Security_TopicSecurityAttributes *attributes,
-          DDS_Security_SecurityException *ex);
-
-
-DDS_Security_boolean
-get_datawriter_sec_attributes
-        ( dds_security_access_control *instance,
-          const DDS_Security_PermissionsHandle permissions_handle,
-          const DDS_Security_char *topic_name,
-          const DDS_Security_PartitionQosPolicy *partition,
-          const DDS_Security_DataTagQosPolicy *data_tag,
-          DDS_Security_EndpointSecurityAttributes *attributes,
-          DDS_Security_SecurityException *ex);
-
-
-DDS_Security_boolean
-get_datareader_sec_attributes
-        ( dds_security_access_control *instance,
-          const DDS_Security_PermissionsHandle permissions_handle,
-          const DDS_Security_char *topic_name,
-          const DDS_Security_PartitionQosPolicy *partition,
-          const DDS_Security_DataTagQosPolicy *data_tag,
-          DDS_Security_EndpointSecurityAttributes *attributes,
-          DDS_Security_SecurityException *ex);
-
-
-DDS_Security_boolean
-return_participant_sec_attributes
-        ( dds_security_access_control *instance,
-          const DDS_Security_ParticipantSecurityAttributes *attributes,
-          DDS_Security_SecurityException *ex);
-
-DDS_Security_boolean
-return_topic_sec_attributes
-        ( dds_security_access_control *instance,
-          const DDS_Security_TopicSecurityAttributes *attributes,
-          DDS_Security_SecurityException *ex);
-
-DDS_Security_boolean
-return_datawriter_sec_attributes
-        ( dds_security_access_control *instance,
-          const DDS_Security_EndpointSecurityAttributes *attributes,
-          DDS_Security_SecurityException *ex);
-
-
-DDS_Security_boolean
-return_datareader_sec_attributes
-        ( dds_security_access_control *instance,
-          const DDS_Security_EndpointSecurityAttributes *attributes,
-          DDS_Security_SecurityException *ex);
-
-DDS_Security_boolean
-return_permissions_handle
-        ( dds_security_access_control *instance,
-          const  DDS_Security_PermissionsHandle permissions_handle,
-          DDS_Security_SecurityException *ex);
-
-
-
-#endif /* SECURITY_BUILTIN_PLUGINS_AUTHENTICATION_H_ */
diff --git a/src/security/core/tests/plugin_loading/plugin_mock/authentication_all_ok/mock_authentication.c b/src/security/core/tests/plugin_loading/plugin_mock/authentication_all_ok/mock_authentication.c
deleted file mode 100644
index 03f9666..0000000
--- a/src/security/core/tests/plugin_loading/plugin_mock/authentication_all_ok/mock_authentication.c
+++ /dev/null
@@ -1,404 +0,0 @@
-/*
- * Copyright(c) 2006 to 2019 ADLINK Technology Limited and others
- *
- * This program and the accompanying materials are made available under the
- * terms of the Eclipse Public License v. 2.0 which is available at
- * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
- * v. 1.0 which is available at
- * http://www.eclipse.org/org/documents/edl-v10.php.
- *
- * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
- */
-
-#include "dds/security/dds_security_api.h"
-#include "dds/ddsrt/heap.h"
-#include "dds/ddsrt/misc.h"
-#include "mock_authentication.h"
-#include <stdio.h>
-#include <string.h>
-#include <stdbool.h>
-
-/**
- * Implementation structure for storing encapsulated members of the instance
- * while giving only the interface definition to user
- */
-
-typedef struct dds_security_authentication_impl {
-  dds_security_authentication base;
-  int id; //sample internal member
-} dds_security_authentication_impl;
-
-
-static const char *test_identity_certificate = TEST_IDENTITY_CERTIFICATE_ALL_OK;
-static const char *test_ca_certificate       = TEST_CA_CERTIFICATE_ALL_OK;
-static const char *test_private_key          = TEST_PRIVATE_KEY_ALL_OK;
-
-DDS_Security_ValidationResult_t validate_local_identity(
-    dds_security_authentication *instance,
-     DDS_Security_IdentityHandle *local_identity_handle,
-     DDS_Security_GUID_t *adjusted_participant_guid,
-    const DDS_Security_DomainId domain_id,
-    const DDS_Security_Qos *participant_qos,
-    const DDS_Security_GUID_t *candidate_participant_guid,
-     DDS_Security_SecurityException *ex)
-{
-
-  unsigned i;
-  DDS_Security_ValidationResult_t result=DDS_SECURITY_VALIDATION_OK;
-  dds_security_authentication_impl *implementation =
-      (dds_security_authentication_impl *) instance;
-  char *identity_ca = NULL;
-  char *identity_certificate = NULL;
-  char *private_key = NULL;
-
-  DDSRT_UNUSED_ARG(local_identity_handle);
-  DDSRT_UNUSED_ARG(adjusted_participant_guid);
-  DDSRT_UNUSED_ARG(domain_id);
-  DDSRT_UNUSED_ARG(participant_qos);
-  DDSRT_UNUSED_ARG(candidate_participant_guid);
-  DDSRT_UNUSED_ARG(ex);
-  DDSRT_UNUSED_ARG(instance);
-
-  implementation->id = 2;
-
-  memcpy(adjusted_participant_guid, candidate_participant_guid, sizeof(DDS_Security_GUID_t));
-
-  for( i=0; i< participant_qos->property.value._length; i++)
-  {
-
-    //printf("%s: %s",participant_qos->property.value._buffer[i].name, participant_qos->property.value._buffer[i].value);
-    printf("%s\n",participant_qos->property.value._buffer[i].name);
-    if( strcmp(participant_qos->property.value._buffer[i].name, "dds.sec.auth.private_key") == 0)
-    {
-      private_key = participant_qos->property.value._buffer[i].value;
-    } else if( strcmp(participant_qos->property.value._buffer[i].name, "dds.sec.auth.identity_ca") == 0)
-    {
-      identity_ca = participant_qos->property.value._buffer[i].value;
-    } else if( strcmp(participant_qos->property.value._buffer[i].name, "dds.sec.auth.identity_certificate") == 0)
-    {
-      identity_certificate = participant_qos->property.value._buffer[i].value;
-    }
-  }
-
-  if( strcmp(identity_certificate, test_identity_certificate) != 0){
-    printf("identity received=%s\n", identity_certificate);
-    printf("identity expected=%s\n", test_identity_certificate);
-    result = DDS_SECURITY_VALIDATION_FAILED;
-    printf("FAILED: Could not get identity_certificate value properly\n");
-  }
-  else if( strcmp(identity_ca, test_ca_certificate) != 0){
-    printf("ca received=%s\n", identity_ca);
-    printf("ca expected=%s\n", test_ca_certificate);
-    printf("FAILED: Could not get identity_ca value properly\n");
-    result = DDS_SECURITY_VALIDATION_FAILED;
-  }else if( strcmp(private_key, test_private_key) != 0){
-    printf("FAILED: Could not get private_key value properly\n");
-    result = DDS_SECURITY_VALIDATION_FAILED;
-  }
-
-  if( result == DDS_SECURITY_VALIDATION_OK )
-  {
-    printf("DDS_SECURITY_VALIDATION_OK\n");
-  }
-
-
-  return result;
-}
-
-DDS_Security_boolean get_identity_token(dds_security_authentication *instance,
-     DDS_Security_IdentityToken *identity_token,
-    const DDS_Security_IdentityHandle handle,
-     DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(identity_token);
-  DDSRT_UNUSED_ARG(handle);
-  DDSRT_UNUSED_ARG(ex);
-  DDSRT_UNUSED_ARG(instance);
-
-  memset(identity_token, 0, sizeof(*identity_token));
-
-  return true;
-}
-
-DDS_Security_boolean get_identity_status_token(
-    dds_security_authentication *instance,
-     DDS_Security_IdentityStatusToken *identity_status_token,
-    const DDS_Security_IdentityHandle handle,
-     DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(identity_status_token);
-  DDSRT_UNUSED_ARG(handle);
-  DDSRT_UNUSED_ARG(ex);
-  DDSRT_UNUSED_ARG(instance);
-
-  return true;
-}
-
-DDS_Security_boolean set_permissions_credential_and_token(
-    dds_security_authentication *instance,
-    const DDS_Security_IdentityHandle handle,
-    const DDS_Security_PermissionsCredentialToken *permissions_credential,
-    const DDS_Security_PermissionsToken *permissions_token,
-     DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(handle);
-  DDSRT_UNUSED_ARG(permissions_credential);
-  DDSRT_UNUSED_ARG(permissions_token);
-  DDSRT_UNUSED_ARG(ex);
-  DDSRT_UNUSED_ARG(instance);
-
-  return true;
-}
-
-DDS_Security_ValidationResult_t validate_remote_identity(
-    dds_security_authentication *instance,
-     DDS_Security_IdentityHandle *remote_identity_handle,
-     DDS_Security_AuthRequestMessageToken *local_auth_request_token,
-    const DDS_Security_AuthRequestMessageToken *remote_auth_request_token,
-    const DDS_Security_IdentityHandle local_identity_handle,
-    const DDS_Security_IdentityToken *remote_identity_token,
-    const DDS_Security_GUID_t *remote_participant_guid,
-     DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(remote_identity_handle);
-  DDSRT_UNUSED_ARG(local_auth_request_token);
-  DDSRT_UNUSED_ARG(remote_auth_request_token);
-  DDSRT_UNUSED_ARG(local_identity_handle);
-  DDSRT_UNUSED_ARG(remote_identity_token);
-  DDSRT_UNUSED_ARG(remote_participant_guid);
-  DDSRT_UNUSED_ARG(ex);
-  DDSRT_UNUSED_ARG(instance);
-
-  return DDS_SECURITY_VALIDATION_OK;
-}
-
-DDS_Security_ValidationResult_t begin_handshake_request(
-    dds_security_authentication *instance,
-     DDS_Security_HandshakeHandle *handshake_handle,
-     DDS_Security_HandshakeMessageToken *handshake_message,
-    const DDS_Security_IdentityHandle initiator_identity_handle,
-    const DDS_Security_IdentityHandle replier_identity_handle,
-    const DDS_Security_OctetSeq *serialized_local_participant_data,
-     DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(handshake_handle);
-  DDSRT_UNUSED_ARG(handshake_message);
-  DDSRT_UNUSED_ARG(initiator_identity_handle);
-  DDSRT_UNUSED_ARG(replier_identity_handle);
-  DDSRT_UNUSED_ARG(serialized_local_participant_data);
-  DDSRT_UNUSED_ARG(ex);
-  DDSRT_UNUSED_ARG(instance);
-
-  return DDS_SECURITY_VALIDATION_OK;
-}
-
-DDS_Security_ValidationResult_t begin_handshake_reply(
-    dds_security_authentication *instance,
-     DDS_Security_HandshakeHandle *handshake_handle,
-     DDS_Security_HandshakeMessageToken *handshake_message_out,
-    const DDS_Security_HandshakeMessageToken *handshake_message_in,
-    const DDS_Security_IdentityHandle initiator_identity_handle,
-    const DDS_Security_IdentityHandle replier_identity_handle,
-    const DDS_Security_OctetSeq *serialized_local_participant_data,
-     DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(handshake_handle);
-  DDSRT_UNUSED_ARG(handshake_message_out);
-  DDSRT_UNUSED_ARG(handshake_message_in);
-  DDSRT_UNUSED_ARG(initiator_identity_handle);
-  DDSRT_UNUSED_ARG(replier_identity_handle);
-  DDSRT_UNUSED_ARG(serialized_local_participant_data);
-  DDSRT_UNUSED_ARG(ex);
-  DDSRT_UNUSED_ARG(instance);
-
-  return DDS_SECURITY_VALIDATION_OK;
-}
-
-DDS_Security_ValidationResult_t process_handshake(
-    dds_security_authentication *instance,
-     DDS_Security_HandshakeMessageToken *handshake_message_out,
-    const DDS_Security_HandshakeMessageToken *handshake_message_in,
-    const DDS_Security_HandshakeHandle handshake_handle,
-     DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(handshake_message_out);
-  DDSRT_UNUSED_ARG(handshake_message_in);
-  DDSRT_UNUSED_ARG(handshake_handle);
-  DDSRT_UNUSED_ARG(ex);
-  DDSRT_UNUSED_ARG(instance);
-
-  return DDS_SECURITY_VALIDATION_OK;
-}
-
-DDS_Security_SharedSecretHandle get_shared_secret(
-    dds_security_authentication *instance,
-    const DDS_Security_HandshakeHandle handshake_handle,
-     DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(handshake_handle);
-  DDSRT_UNUSED_ARG(ex);
-  DDSRT_UNUSED_ARG(instance);
-
-  return 0;
-}
-
-DDS_Security_boolean get_authenticated_peer_credential_token(
-    dds_security_authentication *instance,
-     DDS_Security_AuthenticatedPeerCredentialToken *peer_credential_token,
-    const DDS_Security_HandshakeHandle handshake_handle,
-     DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(peer_credential_token);
-  DDSRT_UNUSED_ARG(handshake_handle);
-  DDSRT_UNUSED_ARG(ex);
-  DDSRT_UNUSED_ARG(instance);
-
-  return true;
-}
-
-DDS_Security_boolean set_listener(dds_security_authentication *instance,
-    const dds_security_authentication_listener *listener,
-     DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(listener);
-  DDSRT_UNUSED_ARG(ex);
-  DDSRT_UNUSED_ARG(instance);
-
-  return true;
-}
-
-DDS_Security_boolean return_identity_token(dds_security_authentication *instance,
-    const DDS_Security_IdentityToken *token,
-     DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(token);
-  DDSRT_UNUSED_ARG(ex);
-  DDSRT_UNUSED_ARG(instance);
-
-  return true;
-}
-
-DDS_Security_boolean return_identity_status_token(
-    dds_security_authentication *instance,
-    const DDS_Security_IdentityStatusToken *token,
-     DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(token);
-  DDSRT_UNUSED_ARG(ex);
-  DDSRT_UNUSED_ARG(instance);
-
-  return true;
-}
-
-DDS_Security_boolean return_authenticated_peer_credential_token(
-    dds_security_authentication *instance,
-    const DDS_Security_AuthenticatedPeerCredentialToken *peer_credential_token,
-     DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(peer_credential_token);
-  DDSRT_UNUSED_ARG(ex);
-  DDSRT_UNUSED_ARG(instance);
-
-  return true;
-}
-
-DDS_Security_boolean return_handshake_handle(dds_security_authentication *instance,
-    const DDS_Security_HandshakeHandle handshake_handle,
-     DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(handshake_handle);
-  DDSRT_UNUSED_ARG(ex);
-  DDSRT_UNUSED_ARG(instance);
-
-  return true;
-}
-
-DDS_Security_boolean return_identity_handle(dds_security_authentication *instance,
-    const DDS_Security_IdentityHandle identity_handle,
-     DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(identity_handle);
-  DDSRT_UNUSED_ARG(ex);
-  DDSRT_UNUSED_ARG(instance);
-
-  return true;
-}
-
-DDS_Security_boolean return_sharedsecret_handle(
-    dds_security_authentication *instance,
-    const DDS_Security_SharedSecretHandle sharedsecret_handle,
-     DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(sharedsecret_handle);
-  DDSRT_UNUSED_ARG(ex);
-  DDSRT_UNUSED_ARG(instance);
-
-  return true;
-}
-
-int32_t init_authentication( const char *argument,  void **context)
-{
-
-  dds_security_authentication_impl *authentication;
-
-  DDSRT_UNUSED_ARG(argument);
-
-  //allocate implementation wrapper
-  authentication = (dds_security_authentication_impl*) ddsrt_malloc(
-      sizeof(dds_security_authentication_impl));
-  memset(authentication, 0, sizeof(dds_security_authentication_impl));
-
-  //assign the interface functions
-  authentication->base.validate_local_identity = &validate_local_identity;
-
-  authentication->base.get_identity_token = &get_identity_token;
-
-  authentication->base.get_identity_status_token = &get_identity_status_token;
-
-  authentication->base.set_permissions_credential_and_token =
-      &set_permissions_credential_and_token;
-
-  authentication->base.validate_remote_identity = &validate_remote_identity;
-
-  authentication->base.begin_handshake_request = &begin_handshake_request;
-
-  authentication->base.begin_handshake_reply = &begin_handshake_reply;
-
-  authentication->base.process_handshake = &process_handshake;
-
-  authentication->base.get_shared_secret = &get_shared_secret;
-
-  authentication->base.get_authenticated_peer_credential_token =
-      &get_authenticated_peer_credential_token;
-
-  authentication->base.set_listener = &set_listener;
-
-  authentication->base.return_identity_token = &return_identity_token;
-
-  authentication->base.return_identity_status_token =
-      &return_identity_status_token;
-
-  authentication->base.return_authenticated_peer_credential_token =
-      &return_authenticated_peer_credential_token;
-
-  authentication->base.return_handshake_handle = &return_handshake_handle;
-
-  authentication->base.return_identity_handle = &return_identity_handle;
-
-  authentication->base.return_sharedsecret_handle = &return_sharedsecret_handle;
-
-  //prepare implementation wrapper
-  authentication->id = 1;
-
-  //return the instance
-  *context = authentication;
-  return 0;
-}
-
-int32_t finalize_authentication(void *instance)
-{
-
-  ddsrt_free((dds_security_authentication_impl*) instance);
-
-  return 0;
-}
diff --git a/src/security/core/tests/plugin_loading/plugin_mock/authentication_all_ok/mock_authentication.h b/src/security/core/tests/plugin_loading/plugin_mock/authentication_all_ok/mock_authentication.h
deleted file mode 100644
index bb4479f..0000000
--- a/src/security/core/tests/plugin_loading/plugin_mock/authentication_all_ok/mock_authentication.h
+++ /dev/null
@@ -1,137 +0,0 @@
-/*
- * authentication.h
- *
- *  Created on: Jan 15, 2018
- *      Author: kurtulus oksuztepe
- */
-
-#ifndef SECURITY_BUILTIN_PLUGINS_AUTHENTICATION_H_
-#define SECURITY_BUILTIN_PLUGINS_AUTHENTICATION_H_
-
-#include "dds/security/authentication_all_ok_export.h"
-#include "../../plugin_mock_common.h"
-
-SECURITY_EXPORT int32_t
-init_authentication(const char *argument, void **context);
-
-SECURITY_EXPORT int32_t
-finalize_authentication(void *context);
-
-DDS_Security_ValidationResult_t
-validate_local_identity(
-        dds_security_authentication *instance,
-        DDS_Security_IdentityHandle *local_identity_handle,
-        DDS_Security_GUID_t *adjusted_participant_guid,
-        const DDS_Security_DomainId domain_id,
-        const DDS_Security_Qos *participant_qos,
-        const DDS_Security_GUID_t *candidate_participant_guid,
-
-        DDS_Security_SecurityException *ex);
-DDS_Security_boolean
-get_identity_token(dds_security_authentication *instance,
-                   DDS_Security_IdentityToken *identity_token,
-                   const DDS_Security_IdentityHandle handle,
-                   DDS_Security_SecurityException *ex);
-DDS_Security_boolean
-set_permissions_credential_and_token(
-        dds_security_authentication *instance,
-        const DDS_Security_IdentityHandle handle,
-        const DDS_Security_PermissionsCredentialToken *permissions_credential,
-        const DDS_Security_PermissionsToken *permissions_token,
-        DDS_Security_SecurityException *ex);
-
-DDS_Security_ValidationResult_t
-validate_remote_identity(
-        dds_security_authentication *instance,
-        DDS_Security_IdentityHandle *remote_identity_handle,
-        DDS_Security_AuthRequestMessageToken *local_auth_request_token,
-        const DDS_Security_AuthRequestMessageToken *remote_auth_request_token,
-        const DDS_Security_IdentityHandle local_identity_handle,
-        const DDS_Security_IdentityToken *remote_identity_token,
-        const DDS_Security_GUID_t *remote_participant_guid,
-        DDS_Security_SecurityException *ex);
-
-DDS_Security_ValidationResult_t
-begin_handshake_request(
-        dds_security_authentication *instance,
-        DDS_Security_HandshakeHandle *handshake_handle,
-        DDS_Security_HandshakeMessageToken *handshake_message,
-        const DDS_Security_IdentityHandle initiator_identity_handle,
-        const DDS_Security_IdentityHandle replier_identity_handle,
-        const DDS_Security_OctetSeq *serialized_local_participant_data,
-        DDS_Security_SecurityException *ex);
-
-DDS_Security_ValidationResult_t
-begin_handshake_reply(
-        dds_security_authentication *instance,
-        DDS_Security_HandshakeHandle *handshake_handle,
-        DDS_Security_HandshakeMessageToken *handshake_message_out,
-        const DDS_Security_HandshakeMessageToken *handshake_message_in,
-        const DDS_Security_IdentityHandle initiator_identity_handle,
-        const DDS_Security_IdentityHandle replier_identity_handle,
-        const DDS_Security_OctetSeq *serialized_local_participant_data,
-        DDS_Security_SecurityException *ex);
-
-DDS_Security_ValidationResult_t
-process_handshake(
-        dds_security_authentication *instance,
-        DDS_Security_HandshakeMessageToken *handshake_message_out,
-        const DDS_Security_HandshakeMessageToken *handshake_message_in,
-        const DDS_Security_HandshakeHandle handshake_handle,
-        DDS_Security_SecurityException *ex);
-
-DDS_Security_SharedSecretHandle get_shared_secret(
-        dds_security_authentication *instance,
-        const DDS_Security_HandshakeHandle handshake_handle,
-        DDS_Security_SecurityException *ex);
-
-DDS_Security_boolean
-get_authenticated_peer_credential_token(
-        dds_security_authentication *instance,
-        DDS_Security_AuthenticatedPeerCredentialToken *peer_credential_token,
-        const DDS_Security_HandshakeHandle handshake_handle,
-        DDS_Security_SecurityException *ex);
-
-
-DDS_Security_boolean get_identity_status_token(
-        dds_security_authentication *instance,
-        DDS_Security_IdentityStatusToken *identity_status_token,
-        const DDS_Security_IdentityHandle handle,
-        DDS_Security_SecurityException *ex);
-
-DDS_Security_boolean set_listener(dds_security_authentication *instance,
-                                  const dds_security_authentication_listener *listener,
-                                  DDS_Security_SecurityException *ex);
-
-DDS_Security_boolean return_identity_token(dds_security_authentication *instance,
-                                           const DDS_Security_IdentityToken *token,
-                                           DDS_Security_SecurityException *ex);
-
-DDS_Security_boolean return_identity_status_token(
-        dds_security_authentication *instance,
-        const DDS_Security_IdentityStatusToken *token,
-        DDS_Security_SecurityException *ex);
-
-DDS_Security_boolean return_authenticated_peer_credential_token(
-        dds_security_authentication *instance,
-        const DDS_Security_AuthenticatedPeerCredentialToken *peer_credential_token,
-        DDS_Security_SecurityException *ex);
-
-DDS_Security_boolean
-return_handshake_handle(dds_security_authentication *instance,
-                        const DDS_Security_HandshakeHandle handshake_handle,
-                        DDS_Security_SecurityException *ex);
-DDS_Security_boolean
-return_identity_handle(
-        dds_security_authentication *instance,
-        const DDS_Security_IdentityHandle identity_handle,
-        DDS_Security_SecurityException *ex);
-
-DDS_Security_boolean return_sharedsecret_handle(
-        dds_security_authentication *instance,
-        const DDS_Security_SharedSecretHandle sharedsecret_handle,
-        DDS_Security_SecurityException *ex);
-
-
-
-#endif /* SECURITY_BUILTIN_PLUGINS_AUTHENTICATION_H_ */
diff --git a/src/security/core/tests/plugin_loading/plugin_mock/authentication_all_ok_other/mock_authentication.c b/src/security/core/tests/plugin_loading/plugin_mock/authentication_all_ok_other/mock_authentication.c
deleted file mode 100644
index ff367c5..0000000
--- a/src/security/core/tests/plugin_loading/plugin_mock/authentication_all_ok_other/mock_authentication.c
+++ /dev/null
@@ -1,353 +0,0 @@
-/*
- * Copyright(c) 2006 to 2019 ADLINK Technology Limited and others
- *
- * This program and the accompanying materials are made available under the
- * terms of the Eclipse Public License v. 2.0 which is available at
- * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
- * v. 1.0 which is available at
- * http://www.eclipse.org/org/documents/edl-v10.php.
- *
- * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
- */
-
-#include "dds/security/dds_security_api.h"
-#include "dds/ddsrt/heap.h"
-#include "dds/ddsrt/misc.h"
-#include "dds/ddsrt/string.h"
-#include "mock_authentication.h"
-#include <stdio.h>
-#include <string.h>
-#include <stdbool.h>
-
-/**
- * Implementation structure for storing encapsulated members of the instance
- * while giving only the interface definition to user
- */
-
-typedef struct dds_security_authentication_impl {
-  dds_security_authentication base;
-  int id; //sample internal member
-} dds_security_authentication_impl;
-
-DDS_Security_ValidationResult_t validate_local_identity(
-    dds_security_authentication *instance,
-     DDS_Security_IdentityHandle *local_identity_handle,
-     DDS_Security_GUID_t *adjusted_participant_guid,
-    const DDS_Security_DomainId domain_id,
-    const DDS_Security_Qos *participant_qos,
-    const DDS_Security_GUID_t *candidate_participant_guid,
-     DDS_Security_SecurityException *ex)
-{
-
-  DDSRT_UNUSED_ARG(local_identity_handle);
-  DDSRT_UNUSED_ARG(adjusted_participant_guid);
-  DDSRT_UNUSED_ARG(domain_id);
-  DDSRT_UNUSED_ARG(participant_qos);
-  DDSRT_UNUSED_ARG(candidate_participant_guid);
-  DDSRT_UNUSED_ARG(ex);
-  DDSRT_UNUSED_ARG(instance);
-
-  ex->message = ddsrt_strdup("Certificate expired");
-  ex->code = DDS_SECURITY_ERR_CERT_EXPIRED_CODE;
-  ex->minor_code = 0;
-
-  return DDS_SECURITY_VALIDATION_FAILED;
-}
-
-DDS_Security_boolean get_identity_token(dds_security_authentication *instance,
-     DDS_Security_IdentityToken *identity_token,
-    const DDS_Security_IdentityHandle handle,
-     DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(identity_token);
-  DDSRT_UNUSED_ARG(handle);
-  DDSRT_UNUSED_ARG(ex);
-  DDSRT_UNUSED_ARG(instance);
-
-  memset(identity_token, 0, sizeof(*identity_token));
-
-  return true;
-}
-
-DDS_Security_boolean get_identity_status_token(
-    dds_security_authentication *instance,
-     DDS_Security_IdentityStatusToken *identity_status_token,
-    const DDS_Security_IdentityHandle handle,
-     DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(identity_status_token);
-  DDSRT_UNUSED_ARG(handle);
-  DDSRT_UNUSED_ARG(ex);
-  DDSRT_UNUSED_ARG(instance);
-
-  return true;
-}
-
-DDS_Security_boolean set_permissions_credential_and_token(
-    dds_security_authentication *instance,
-    const DDS_Security_IdentityHandle handle,
-    const DDS_Security_PermissionsCredentialToken *permissions_credential,
-    const DDS_Security_PermissionsToken *permissions_token,
-     DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(handle);
-  DDSRT_UNUSED_ARG(permissions_credential);
-  DDSRT_UNUSED_ARG(permissions_token);
-  DDSRT_UNUSED_ARG(ex);
-  DDSRT_UNUSED_ARG(instance);
-
-  return true;
-}
-
-DDS_Security_ValidationResult_t validate_remote_identity(
-    dds_security_authentication *instance,
-     DDS_Security_IdentityHandle *remote_identity_handle,
-     DDS_Security_AuthRequestMessageToken *local_auth_request_token,
-    const DDS_Security_AuthRequestMessageToken *remote_auth_request_token,
-    const DDS_Security_IdentityHandle local_identity_handle,
-    const DDS_Security_IdentityToken *remote_identity_token,
-    const DDS_Security_GUID_t *remote_participant_guid,
-     DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(remote_identity_handle);
-  DDSRT_UNUSED_ARG(local_auth_request_token);
-  DDSRT_UNUSED_ARG(remote_auth_request_token);
-  DDSRT_UNUSED_ARG(local_identity_handle);
-  DDSRT_UNUSED_ARG(remote_identity_token);
-  DDSRT_UNUSED_ARG(remote_participant_guid);
-  DDSRT_UNUSED_ARG(ex);
-  DDSRT_UNUSED_ARG(instance);
-
-  return DDS_SECURITY_VALIDATION_OK;
-}
-
-DDS_Security_ValidationResult_t begin_handshake_request(
-    dds_security_authentication *instance,
-     DDS_Security_HandshakeHandle *handshake_handle,
-     DDS_Security_HandshakeMessageToken *handshake_message,
-    const DDS_Security_IdentityHandle initiator_identity_handle,
-    const DDS_Security_IdentityHandle replier_identity_handle,
-    const DDS_Security_OctetSeq *serialized_local_participant_data,
-     DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(handshake_handle);
-  DDSRT_UNUSED_ARG(handshake_message);
-  DDSRT_UNUSED_ARG(initiator_identity_handle);
-  DDSRT_UNUSED_ARG(replier_identity_handle);
-  DDSRT_UNUSED_ARG(serialized_local_participant_data);
-  DDSRT_UNUSED_ARG(ex);
-  DDSRT_UNUSED_ARG(instance);
-
-  return DDS_SECURITY_VALIDATION_OK;
-}
-
-DDS_Security_ValidationResult_t begin_handshake_reply(
-    dds_security_authentication *instance,
-     DDS_Security_HandshakeHandle *handshake_handle,
-     DDS_Security_HandshakeMessageToken *handshake_message_out,
-    const DDS_Security_HandshakeMessageToken *handshake_message_in,
-    const DDS_Security_IdentityHandle initiator_identity_handle,
-    const DDS_Security_IdentityHandle replier_identity_handle,
-    const DDS_Security_OctetSeq *serialized_local_participant_data,
-     DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(handshake_handle);
-  DDSRT_UNUSED_ARG(handshake_message_out);
-  DDSRT_UNUSED_ARG(handshake_message_in);
-  DDSRT_UNUSED_ARG(initiator_identity_handle);
-  DDSRT_UNUSED_ARG(replier_identity_handle);
-  DDSRT_UNUSED_ARG(serialized_local_participant_data);
-  DDSRT_UNUSED_ARG(ex);
-  DDSRT_UNUSED_ARG(instance);
-
-  return DDS_SECURITY_VALIDATION_OK;
-}
-
-DDS_Security_ValidationResult_t process_handshake(
-    dds_security_authentication *instance,
-     DDS_Security_HandshakeMessageToken *handshake_message_out,
-    const DDS_Security_HandshakeMessageToken *handshake_message_in,
-    const DDS_Security_HandshakeHandle handshake_handle,
-     DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(handshake_message_out);
-  DDSRT_UNUSED_ARG(handshake_message_in);
-  DDSRT_UNUSED_ARG(handshake_handle);
-  DDSRT_UNUSED_ARG(ex);
-  DDSRT_UNUSED_ARG(instance);
-
-  return DDS_SECURITY_VALIDATION_OK;
-}
-
-DDS_Security_SharedSecretHandle get_shared_secret(
-    dds_security_authentication *instance,
-    const DDS_Security_HandshakeHandle handshake_handle,
-     DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(handshake_handle);
-  DDSRT_UNUSED_ARG(ex);
-  DDSRT_UNUSED_ARG(instance);
-
-  return 0;
-}
-
-DDS_Security_boolean get_authenticated_peer_credential_token(
-    dds_security_authentication *instance,
-     DDS_Security_AuthenticatedPeerCredentialToken *peer_credential_token,
-    const DDS_Security_HandshakeHandle handshake_handle,
-     DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(peer_credential_token);
-  DDSRT_UNUSED_ARG(handshake_handle);
-  DDSRT_UNUSED_ARG(ex);
-  DDSRT_UNUSED_ARG(instance);
-
-  return true;
-}
-
-DDS_Security_boolean set_listener(dds_security_authentication *instance,
-    const dds_security_authentication_listener *listener,
-     DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(listener);
-  DDSRT_UNUSED_ARG(ex);
-  DDSRT_UNUSED_ARG(instance);
-
-  return true;
-}
-
-DDS_Security_boolean return_identity_token(dds_security_authentication *instance,
-    const DDS_Security_IdentityToken *token,
-     DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(token);
-  DDSRT_UNUSED_ARG(ex);
-  DDSRT_UNUSED_ARG(instance);
-
-  return true;
-}
-
-DDS_Security_boolean return_identity_status_token(
-    dds_security_authentication *instance,
-    const DDS_Security_IdentityStatusToken *token,
-     DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(token);
-  DDSRT_UNUSED_ARG(ex);
-  DDSRT_UNUSED_ARG(instance);
-
-  return true;
-}
-
-DDS_Security_boolean return_authenticated_peer_credential_token(
-    dds_security_authentication *instance,
-    const DDS_Security_AuthenticatedPeerCredentialToken *peer_credential_token,
-     DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(peer_credential_token);
-  DDSRT_UNUSED_ARG(ex);
-  DDSRT_UNUSED_ARG(instance);
-
-  return true;
-}
-
-DDS_Security_boolean return_handshake_handle(dds_security_authentication *instance,
-    const DDS_Security_HandshakeHandle handshake_handle,
-     DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(handshake_handle);
-  DDSRT_UNUSED_ARG(ex);
-  DDSRT_UNUSED_ARG(instance);
-
-  return true;
-}
-
-DDS_Security_boolean return_identity_handle(dds_security_authentication *instance,
-    const DDS_Security_IdentityHandle identity_handle,
-     DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(identity_handle);
-  DDSRT_UNUSED_ARG(ex);
-  DDSRT_UNUSED_ARG(instance);
-
-  return true;
-}
-
-DDS_Security_boolean return_sharedsecret_handle(
-    dds_security_authentication *instance,
-    const DDS_Security_SharedSecretHandle sharedsecret_handle,
-     DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(sharedsecret_handle);
-  DDSRT_UNUSED_ARG(ex);
-  DDSRT_UNUSED_ARG(instance);
-
-  return true;
-}
-
-int32_t init_authentication( const char *argument,  void **context)
-{
-
-  dds_security_authentication_impl *authentication;
-
-  DDSRT_UNUSED_ARG(argument);
-
-  //allocate implementation wrapper
-  authentication = (dds_security_authentication_impl*) ddsrt_malloc(
-      sizeof(dds_security_authentication_impl));
-  memset(authentication, 0, sizeof(dds_security_authentication_impl));
-
-  //assign the interface functions
-  authentication->base.validate_local_identity = &validate_local_identity;
-
-  authentication->base.get_identity_token = &get_identity_token;
-
-  authentication->base.get_identity_status_token = &get_identity_status_token;
-
-  authentication->base.set_permissions_credential_and_token =
-      &set_permissions_credential_and_token;
-
-  authentication->base.validate_remote_identity = &validate_remote_identity;
-
-  authentication->base.begin_handshake_request = &begin_handshake_request;
-
-  authentication->base.begin_handshake_reply = &begin_handshake_reply;
-
-  authentication->base.process_handshake = &process_handshake;
-
-  authentication->base.get_shared_secret = &get_shared_secret;
-
-  authentication->base.get_authenticated_peer_credential_token =
-      &get_authenticated_peer_credential_token;
-
-  authentication->base.set_listener = &set_listener;
-
-  authentication->base.return_identity_token = &return_identity_token;
-
-  authentication->base.return_identity_status_token =
-      &return_identity_status_token;
-
-  authentication->base.return_authenticated_peer_credential_token =
-      &return_authenticated_peer_credential_token;
-
-  authentication->base.return_handshake_handle = &return_handshake_handle;
-
-  authentication->base.return_identity_handle = &return_identity_handle;
-
-  authentication->base.return_sharedsecret_handle = &return_sharedsecret_handle;
-
-  //prepare implementation wrapper
-  authentication->id = 1;
-
-  //return the instance
-  *context = authentication;
-  return 0;
-}
-
-int32_t finalize_authentication(void *instance)
-{
-
-  ddsrt_free((dds_security_authentication_impl*) instance);
-
-  return 0;
-}
diff --git a/src/security/core/tests/plugin_loading/plugin_mock/authentication_all_ok_other/mock_authentication.h b/src/security/core/tests/plugin_loading/plugin_mock/authentication_all_ok_other/mock_authentication.h
deleted file mode 100644
index c6a416f..0000000
--- a/src/security/core/tests/plugin_loading/plugin_mock/authentication_all_ok_other/mock_authentication.h
+++ /dev/null
@@ -1,136 +0,0 @@
-/*
- * authentication.h
- *
- *  Created on: Jan 15, 2018
- *      Author: kurtulus oksuztepe
- */
-
-#ifndef SECURITY_BUILTIN_PLUGINS_AUTHENTICATION_H_
-#define SECURITY_BUILTIN_PLUGINS_AUTHENTICATION_H_
-
-#include "dds/security/authentication_all_ok_other_export.h"
-
-SECURITY_EXPORT int32_t
-init_authentication(const char *argument, void **context);
-
-SECURITY_EXPORT int32_t
-finalize_authentication(void *context);
-
-DDS_Security_ValidationResult_t
-validate_local_identity(
-        dds_security_authentication *instance,
-        DDS_Security_IdentityHandle *local_identity_handle,
-        DDS_Security_GUID_t *adjusted_participant_guid,
-        const DDS_Security_DomainId domain_id,
-        const DDS_Security_Qos *participant_qos,
-        const DDS_Security_GUID_t *candidate_participant_guid,
-
-        DDS_Security_SecurityException *ex);
-DDS_Security_boolean
-get_identity_token(dds_security_authentication *instance,
-                   DDS_Security_IdentityToken *identity_token,
-                   const DDS_Security_IdentityHandle handle,
-                   DDS_Security_SecurityException *ex);
-DDS_Security_boolean
-set_permissions_credential_and_token(
-        dds_security_authentication *instance,
-        const DDS_Security_IdentityHandle handle,
-        const DDS_Security_PermissionsCredentialToken *permissions_credential,
-        const DDS_Security_PermissionsToken *permissions_token,
-        DDS_Security_SecurityException *ex);
-
-DDS_Security_ValidationResult_t
-validate_remote_identity(
-        dds_security_authentication *instance,
-        DDS_Security_IdentityHandle *remote_identity_handle,
-        DDS_Security_AuthRequestMessageToken *local_auth_request_token,
-        const DDS_Security_AuthRequestMessageToken *remote_auth_request_token,
-        const DDS_Security_IdentityHandle local_identity_handle,
-        const DDS_Security_IdentityToken *remote_identity_token,
-        const DDS_Security_GUID_t *remote_participant_guid,
-        DDS_Security_SecurityException *ex);
-
-DDS_Security_ValidationResult_t
-begin_handshake_request(
-        dds_security_authentication *instance,
-        DDS_Security_HandshakeHandle *handshake_handle,
-        DDS_Security_HandshakeMessageToken *handshake_message,
-        const DDS_Security_IdentityHandle initiator_identity_handle,
-        const DDS_Security_IdentityHandle replier_identity_handle,
-        const DDS_Security_OctetSeq *serialized_local_participant_data,
-        DDS_Security_SecurityException *ex);
-
-DDS_Security_ValidationResult_t
-begin_handshake_reply(
-        dds_security_authentication *instance,
-        DDS_Security_HandshakeHandle *handshake_handle,
-        DDS_Security_HandshakeMessageToken *handshake_message_out,
-        const DDS_Security_HandshakeMessageToken *handshake_message_in,
-        const DDS_Security_IdentityHandle initiator_identity_handle,
-        const DDS_Security_IdentityHandle replier_identity_handle,
-        const DDS_Security_OctetSeq *serialized_local_participant_data,
-        DDS_Security_SecurityException *ex);
-
-DDS_Security_ValidationResult_t
-process_handshake(
-        dds_security_authentication *instance,
-        DDS_Security_HandshakeMessageToken *handshake_message_out,
-        const DDS_Security_HandshakeMessageToken *handshake_message_in,
-        const DDS_Security_HandshakeHandle handshake_handle,
-        DDS_Security_SecurityException *ex);
-
-DDS_Security_SharedSecretHandle get_shared_secret(
-        dds_security_authentication *instance,
-        const DDS_Security_HandshakeHandle handshake_handle,
-        DDS_Security_SecurityException *ex);
-
-DDS_Security_boolean
-get_authenticated_peer_credential_token(
-        dds_security_authentication *instance,
-        DDS_Security_AuthenticatedPeerCredentialToken *peer_credential_token,
-        const DDS_Security_HandshakeHandle handshake_handle,
-        DDS_Security_SecurityException *ex);
-
-
-DDS_Security_boolean get_identity_status_token(
-        dds_security_authentication *instance,
-        DDS_Security_IdentityStatusToken *identity_status_token,
-        const DDS_Security_IdentityHandle handle,
-        DDS_Security_SecurityException *ex);
-
-DDS_Security_boolean set_listener(dds_security_authentication *instance,
-                                  const dds_security_authentication_listener *listener,
-                                  DDS_Security_SecurityException *ex);
-
-DDS_Security_boolean return_identity_token(dds_security_authentication *instance,
-                                           const DDS_Security_IdentityToken *token,
-                                           DDS_Security_SecurityException *ex);
-
-DDS_Security_boolean return_identity_status_token(
-        dds_security_authentication *instance,
-        const DDS_Security_IdentityStatusToken *token,
-        DDS_Security_SecurityException *ex);
-
-DDS_Security_boolean return_authenticated_peer_credential_token(
-        dds_security_authentication *instance,
-        const DDS_Security_AuthenticatedPeerCredentialToken *peer_credential_token,
-        DDS_Security_SecurityException *ex);
-
-DDS_Security_boolean
-return_handshake_handle(dds_security_authentication *instance,
-                        const DDS_Security_HandshakeHandle handshake_handle,
-                        DDS_Security_SecurityException *ex);
-DDS_Security_boolean
-return_identity_handle(
-        dds_security_authentication *instance,
-        const DDS_Security_IdentityHandle identity_handle,
-        DDS_Security_SecurityException *ex);
-
-DDS_Security_boolean return_sharedsecret_handle(
-        dds_security_authentication *instance,
-        const DDS_Security_SharedSecretHandle sharedsecret_handle,
-        DDS_Security_SecurityException *ex);
-
-
-
-#endif /* SECURITY_BUILTIN_PLUGINS_AUTHENTICATION_H_ */
diff --git a/src/security/core/tests/plugin_loading/plugin_mock/authentication_finalize_error/mock_authentication.c b/src/security/core/tests/plugin_loading/plugin_mock/authentication_finalize_error/mock_authentication.c
deleted file mode 100644
index 68f53ad..0000000
--- a/src/security/core/tests/plugin_loading/plugin_mock/authentication_finalize_error/mock_authentication.c
+++ /dev/null
@@ -1,394 +0,0 @@
-/*
- * Copyright(c) 2006 to 2019 ADLINK Technology Limited and others
- *
- * This program and the accompanying materials are made available under the
- * terms of the Eclipse Public License v. 2.0 which is available at
- * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
- * v. 1.0 which is available at
- * http://www.eclipse.org/org/documents/edl-v10.php.
- *
- * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
- */
-
-#include "dds/security/dds_security_api.h"
-#include "dds/ddsrt/heap.h"
-#include "dds/ddsrt/misc.h"
-#include "mock_authentication.h"
-#include <stdio.h>
-#include <assert.h>
-#include <string.h>
-#include <stdbool.h>
-
-/**
- * Implementation structure for storing encapsulated members of the instance
- * while giving only the interface definition to user
- */
-
-typedef struct dds_security_authentication_impl {
-  dds_security_authentication base;
-  int id; //sample internal member
-} dds_security_authentication_impl;
-
-DDS_Security_ValidationResult_t validate_local_identity(
-     dds_security_authentication *instance,
-     DDS_Security_IdentityHandle *local_identity_handle,
-     DDS_Security_GUID_t *adjusted_participant_guid,
-     const DDS_Security_DomainId domain_id,
-     const DDS_Security_Qos *participant_qos,
-     const DDS_Security_GUID_t *candidate_participant_guid,
-     DDS_Security_SecurityException *ex)
-{
-
-  unsigned i;
-  DDS_Security_ValidationResult_t result=DDS_SECURITY_VALIDATION_OK;
-  dds_security_authentication_impl *implementation =
-      (dds_security_authentication_impl *) instance;
-  char *identity_ca=NULL;
-  char *identity_certificate=NULL;
-  char *private_key=NULL;
-
-  DDSRT_UNUSED_ARG(local_identity_handle);
-  DDSRT_UNUSED_ARG(adjusted_participant_guid);
-  DDSRT_UNUSED_ARG(domain_id);
-  DDSRT_UNUSED_ARG(participant_qos);
-  DDSRT_UNUSED_ARG(candidate_participant_guid);
-  DDSRT_UNUSED_ARG(ex);
-  DDSRT_UNUSED_ARG(instance);
-
-  implementation->id = 2;
-
-  for( i=0; i< participant_qos->property.value._length; i++)
-  {
-
-    printf("%s: %s",participant_qos->property.value._buffer[i].name, participant_qos->property.value._buffer[i].value);
-    if( strcmp(participant_qos->property.value._buffer[i].name, "dds.sec.auth.private_key") == 0)
-    {
-      private_key = participant_qos->property.value._buffer[i].value;
-    } else if( strcmp(participant_qos->property.value._buffer[i].name, "dds.sec.auth.identity_ca") == 0)
-    {
-      identity_ca = participant_qos->property.value._buffer[i].value;
-    } else if( strcmp(participant_qos->property.value._buffer[i].name, "dds.sec.auth.identity_certificate") == 0)
-    {
-      identity_certificate = participant_qos->property.value._buffer[i].value;
-    }
-  }
-
-  /* for Clang's static analyzer */
-  assert(identity_certificate != NULL);
-  assert(identity_ca != NULL);
-  assert(private_key != NULL);
-
-  if( strcmp(identity_certificate, test_identity_certificate) != 0){
-
-    result = DDS_SECURITY_VALIDATION_FAILED;
-    printf("FAILED: Could not get identity_certificate value properly\n");
-  }
-  else if( strcmp(identity_ca, test_ca_certificate) != 0){
-    printf("FAILED: Could not get identity_ca value properly\n");
-    result = DDS_SECURITY_VALIDATION_FAILED;
-  }else if( strcmp(private_key, test_privatekey) != 0){
-    printf("FAILED: Could not get private_key value properly\n");
-    result = DDS_SECURITY_VALIDATION_FAILED;
-  }
-
-
-  return result;
-}
-
-DDS_Security_boolean get_identity_token( dds_security_authentication *instance,
-    DDS_Security_IdentityToken *identity_token,
-     const DDS_Security_IdentityHandle handle,
-    DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(identity_token);
-  DDSRT_UNUSED_ARG(handle);
-  DDSRT_UNUSED_ARG(ex);
-  DDSRT_UNUSED_ARG(instance);
-
-  memset(identity_token, 0, sizeof(*identity_token));
-
-  return true;
-}
-
-DDS_Security_boolean get_identity_status_token(
-     dds_security_authentication *instance,
-    DDS_Security_IdentityStatusToken *identity_status_token,
-     const DDS_Security_IdentityHandle handle,
-    DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(identity_status_token);
-  DDSRT_UNUSED_ARG(handle);
-  DDSRT_UNUSED_ARG(ex);
-  DDSRT_UNUSED_ARG(instance);
-
-  return true;
-}
-
-DDS_Security_boolean set_permissions_credential_and_token(
-     dds_security_authentication *instance,
-     const DDS_Security_IdentityHandle handle,
-     const DDS_Security_PermissionsCredentialToken *permissions_credential,
-     const DDS_Security_PermissionsToken *permissions_token,
-    DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(handle);
-  DDSRT_UNUSED_ARG(permissions_credential);
-  DDSRT_UNUSED_ARG(permissions_token);
-  DDSRT_UNUSED_ARG(ex);
-  DDSRT_UNUSED_ARG(instance);
-
-  return true;
-}
-
-DDS_Security_ValidationResult_t validate_remote_identity(
-     dds_security_authentication *instance,
-    DDS_Security_IdentityHandle *remote_identity_handle,
-    DDS_Security_AuthRequestMessageToken *local_auth_request_token,
-     const DDS_Security_AuthRequestMessageToken *remote_auth_request_token,
-     const DDS_Security_IdentityHandle local_identity_handle,
-     const DDS_Security_IdentityToken *remote_identity_token,
-     const DDS_Security_GUID_t *remote_participant_guid,
-    DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(remote_identity_handle);
-  DDSRT_UNUSED_ARG(local_auth_request_token);
-  DDSRT_UNUSED_ARG(remote_auth_request_token);
-  DDSRT_UNUSED_ARG(local_identity_handle);
-  DDSRT_UNUSED_ARG(remote_identity_token);
-  DDSRT_UNUSED_ARG(remote_participant_guid);
-  DDSRT_UNUSED_ARG(ex);
-  DDSRT_UNUSED_ARG(instance);
-
-  return DDS_SECURITY_VALIDATION_OK;
-}
-
-DDS_Security_ValidationResult_t begin_handshake_request(
-     dds_security_authentication *instance,
-    DDS_Security_HandshakeHandle *handshake_handle,
-    DDS_Security_HandshakeMessageToken *handshake_message,
-     const DDS_Security_IdentityHandle initiator_identity_handle,
-     const DDS_Security_IdentityHandle replier_identity_handle,
-     const DDS_Security_OctetSeq *serialized_local_participant_data,
-    DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(handshake_handle);
-  DDSRT_UNUSED_ARG(handshake_message);
-  DDSRT_UNUSED_ARG(initiator_identity_handle);
-  DDSRT_UNUSED_ARG(replier_identity_handle);
-  DDSRT_UNUSED_ARG(serialized_local_participant_data);
-  DDSRT_UNUSED_ARG(ex);
-  DDSRT_UNUSED_ARG(instance);
-
-  return DDS_SECURITY_VALIDATION_OK;
-}
-
-DDS_Security_ValidationResult_t begin_handshake_reply(
-     dds_security_authentication *instance,
-    DDS_Security_HandshakeHandle *handshake_handle,
-    DDS_Security_HandshakeMessageToken *handshake_message_out,
-     const DDS_Security_HandshakeMessageToken *handshake_message_in,
-     const DDS_Security_IdentityHandle initiator_identity_handle,
-     const DDS_Security_IdentityHandle replier_identity_handle,
-     const DDS_Security_OctetSeq *serialized_local_participant_data,
-    DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(handshake_handle);
-  DDSRT_UNUSED_ARG(handshake_message_out);
-  DDSRT_UNUSED_ARG(handshake_message_in);
-  DDSRT_UNUSED_ARG(initiator_identity_handle);
-  DDSRT_UNUSED_ARG(replier_identity_handle);
-  DDSRT_UNUSED_ARG(serialized_local_participant_data);
-  DDSRT_UNUSED_ARG(ex);
-  DDSRT_UNUSED_ARG(instance);
-
-  return DDS_SECURITY_VALIDATION_OK;
-}
-
-DDS_Security_ValidationResult_t process_handshake(
-     dds_security_authentication *instance,
-    DDS_Security_HandshakeMessageToken *handshake_message_out,
-     const DDS_Security_HandshakeMessageToken *handshake_message_in,
-     const DDS_Security_HandshakeHandle handshake_handle,
-    DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(handshake_message_out);
-  DDSRT_UNUSED_ARG(handshake_message_in);
-  DDSRT_UNUSED_ARG(handshake_handle);
-  DDSRT_UNUSED_ARG(ex);
-  DDSRT_UNUSED_ARG(instance);
-
-  return DDS_SECURITY_VALIDATION_OK;
-}
-
-DDS_Security_SharedSecretHandle get_shared_secret(
-     dds_security_authentication *instance,
-     const DDS_Security_HandshakeHandle handshake_handle,
-    DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(handshake_handle);
-  DDSRT_UNUSED_ARG(ex);
-  DDSRT_UNUSED_ARG(instance);
-
-  return 0;
-}
-
-DDS_Security_boolean get_authenticated_peer_credential_token(
-     dds_security_authentication *instance,
-    DDS_Security_AuthenticatedPeerCredentialToken *peer_credential_token,
-     const DDS_Security_HandshakeHandle handshake_handle,
-    DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(peer_credential_token);
-  DDSRT_UNUSED_ARG(handshake_handle);
-  DDSRT_UNUSED_ARG(ex);
-  DDSRT_UNUSED_ARG(instance);
-
-  return true;
-}
-
-DDS_Security_boolean set_listener( dds_security_authentication *instance,
-     const dds_security_authentication_listener *listener,
-    DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(listener);
-  DDSRT_UNUSED_ARG(ex);
-  DDSRT_UNUSED_ARG(instance);
-
-  return true;
-}
-
-DDS_Security_boolean return_identity_token( dds_security_authentication *instance,
-     const DDS_Security_IdentityToken *token,
-    DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(token);
-  DDSRT_UNUSED_ARG(ex);
-  DDSRT_UNUSED_ARG(instance);
-
-  return true;
-}
-
-DDS_Security_boolean return_identity_status_token(
-     dds_security_authentication *instance,
-     const DDS_Security_IdentityStatusToken *token,
-    DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(token);
-  DDSRT_UNUSED_ARG(ex);
-  DDSRT_UNUSED_ARG(instance);
-
-  return true;
-}
-
-DDS_Security_boolean return_authenticated_peer_credential_token(
-     dds_security_authentication *instance,
-     const DDS_Security_AuthenticatedPeerCredentialToken *peer_credential_token,
-    DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(peer_credential_token);
-  DDSRT_UNUSED_ARG(ex);
-  DDSRT_UNUSED_ARG(instance);
-
-  return true;
-}
-
-DDS_Security_boolean return_handshake_handle( dds_security_authentication *instance,
-     const DDS_Security_HandshakeHandle handshake_handle,
-    DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(handshake_handle);
-  DDSRT_UNUSED_ARG(ex);
-  DDSRT_UNUSED_ARG(instance);
-
-  return true;
-}
-
-DDS_Security_boolean return_identity_handle( dds_security_authentication *instance,
-     const DDS_Security_IdentityHandle identity_handle,
-    DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(identity_handle);
-  DDSRT_UNUSED_ARG(ex);
-  DDSRT_UNUSED_ARG(instance);
-
-  return true;
-}
-
-DDS_Security_boolean return_sharedsecret_handle(
-     dds_security_authentication *instance,
-     const DDS_Security_SharedSecretHandle sharedsecret_handle,
-    DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(sharedsecret_handle);
-  DDSRT_UNUSED_ARG(ex);
-  DDSRT_UNUSED_ARG(instance);
-
-  return true;
-}
-
-int32_t init_authentication(  const char *argument, void **context)
-{
-
-  dds_security_authentication_impl *authentication;
-  DDSRT_UNUSED_ARG(argument);
-
-  //allocate implementation wrapper
-  authentication = (dds_security_authentication_impl*) ddsrt_malloc(
-      sizeof(dds_security_authentication_impl));
-  memset(authentication, 0, sizeof(dds_security_authentication_impl));
-
-  //assign the interface functions
-  authentication->base.validate_local_identity = &validate_local_identity;
-
-  authentication->base.get_identity_token = &get_identity_token;
-
-  authentication->base.get_identity_status_token = &get_identity_status_token;
-
-  authentication->base.set_permissions_credential_and_token =
-      &set_permissions_credential_and_token;
-
-  authentication->base.validate_remote_identity = &validate_remote_identity;
-
-  authentication->base.begin_handshake_request = &begin_handshake_request;
-
-  authentication->base.begin_handshake_reply = &begin_handshake_reply;
-
-  authentication->base.process_handshake = &process_handshake;
-
-  authentication->base.get_shared_secret = &get_shared_secret;
-
-  authentication->base.get_authenticated_peer_credential_token =
-      &get_authenticated_peer_credential_token;
-
-  authentication->base.set_listener = &set_listener;
-
-  authentication->base.return_identity_token = &return_identity_token;
-
-  authentication->base.return_identity_status_token =
-      &return_identity_status_token;
-
-  authentication->base.return_authenticated_peer_credential_token =
-      &return_authenticated_peer_credential_token;
-
-  authentication->base.return_handshake_handle = &return_handshake_handle;
-
-  authentication->base.return_identity_handle = &return_identity_handle;
-
-  authentication->base.return_sharedsecret_handle = &return_sharedsecret_handle;
-
-  //prepare implementation wrapper
-  authentication->id = 1;
-
-  //return the instance
-  *context = authentication;
-  return 0;
-}
-
-/* wrong finalize function name for test purposes */
-int32_t finalize_authentication_WRONG_NAME( void *instance)
-{
-
-  ddsrt_free((dds_security_authentication_impl*) instance);
-
-  return 0;
-}
diff --git a/src/security/core/tests/plugin_loading/plugin_mock/authentication_finalize_error/mock_authentication.h b/src/security/core/tests/plugin_loading/plugin_mock/authentication_finalize_error/mock_authentication.h
deleted file mode 100644
index d7c0e09..0000000
--- a/src/security/core/tests/plugin_loading/plugin_mock/authentication_finalize_error/mock_authentication.h
+++ /dev/null
@@ -1,264 +0,0 @@
-/*
- * authentication.h
- *
- *  Created on: Jan 15, 2018
- *      Author: kurtulus oksuztepe
- */
-
-#ifndef SECURITY_BUILTIN_PLUGINS_AUTHENTICATION_H_
-#define SECURITY_BUILTIN_PLUGINS_AUTHENTICATION_H_
-
-
-#include "dds/security/authentication_finalize_error_export.h"
-
-SECURITY_EXPORT int32_t
-init_authentication(const char *argument, void **context);
-
-SECURITY_EXPORT int32_t
-finalize_authentication_WRONG_NAME(void *context);
-
-char *test_identity_certificate="data:,-----BEGIN CERTIFICATE-----\n\
-MIIGJzCCBA+gAwIBAgIBATANBgkqhkiG9w0BAQUFADCBsjELMAkGA1UEBhMCRlIx\n\
-DzANBgNVBAgMBkFsc2FjZTETMBEGA1UEBwwKU3RyYXNib3VyZzEYMBYGA1UECgwP\n\
-d3d3LmZyZWVsYW4ub3JnMRAwDgYDVQQLDAdmcmVlbGFuMS0wKwYDVQQDDCRGcmVl\n\
-bGFuIFNhbXBsZSBDZXJ0aWZpY2F0ZSBBdXRob3JpdHkxIjAgBgkqhkiG9w0BCQEW\n\
-E2NvbnRhY3RAZnJlZWxhbi5vcmcwHhcNMTIwNDI3MTAzMTE4WhcNMjIwNDI1MTAz\n\
-MTE4WjB+MQswCQYDVQQGEwJGUjEPMA0GA1UECAwGQWxzYWNlMRgwFgYDVQQKDA93\n\
-d3cuZnJlZWxhbi5vcmcxEDAOBgNVBAsMB2ZyZWVsYW4xDjAMBgNVBAMMBWFsaWNl\n\
-MSIwIAYJKoZIhvcNAQkBFhNjb250YWN0QGZyZWVsYW4ub3JnMIICIjANBgkqhkiG\n\
-9w0BAQEFAAOCAg8AMIICCgKCAgEA3W29+ID6194bH6ejLrIC4hb2Ugo8v6ZC+Mrc\n\
-k2dNYMNPjcOKABvxxEtBamnSaeU/IY7FC/giN622LEtV/3oDcrua0+yWuVafyxmZ\n\
-yTKUb4/GUgafRQPf/eiX9urWurtIK7XgNGFNUjYPq4dSJQPPhwCHE/LKAykWnZBX\n\
-RrX0Dq4XyApNku0IpjIjEXH+8ixE12wH8wt7DEvdO7T3N3CfUbaITl1qBX+Nm2Z6\n\
-q4Ag/u5rl8NJfXg71ZmXA3XOj7zFvpyapRIZcPmkvZYn7SMCp8dXyXHPdpSiIWL2\n\
-uB3KiO4JrUYvt2GzLBUThp+lNSZaZ/Q3yOaAAUkOx+1h08285Pi+P8lO+H2Xic4S\n\
-vMq1xtLg2bNoPC5KnbRfuFPuUD2/3dSiiragJ6uYDLOyWJDivKGt/72OVTEPAL9o\n\
-6T2pGZrwbQuiFGrGTMZOvWMSpQtNl+tCCXlT4mWqJDRwuMGrI4DnnGzt3IKqNwS4\n\
-Qyo9KqjMIPwnXZAmWPm3FOKe4sFwc5fpawKO01JZewDsYTDxVj+cwXwFxbE2yBiF\n\
-z2FAHwfopwaH35p3C6lkcgP2k/zgAlnBluzACUI+MKJ/G0gv/uAhj1OHJQ3L6kn1\n\
-SpvQ41/ueBjlunExqQSYD7GtZ1Kg8uOcq2r+WISE3Qc9MpQFFkUVllmgWGwYDuN3\n\
-Zsez95kCAwEAAaN7MHkwCQYDVR0TBAIwADAsBglghkgBhvhCAQ0EHxYdT3BlblNT\n\
-TCBHZW5lcmF0ZWQgQ2VydGlmaWNhdGUwHQYDVR0OBBYEFFlfyRO6G8y5qEFKikl5\n\
-ajb2fT7XMB8GA1UdIwQYMBaAFCNsLT0+KV14uGw+quK7Lh5sh/JTMA0GCSqGSIb3\n\
-DQEBBQUAA4ICAQAT5wJFPqervbja5+90iKxi1d0QVtVGB+z6aoAMuWK+qgi0vgvr\n\
-mu9ot2lvTSCSnRhjeiP0SIdqFMORmBtOCFk/kYDp9M/91b+vS+S9eAlxrNCB5VOf\n\
-PqxEPp/wv1rBcE4GBO/c6HcFon3F+oBYCsUQbZDKSSZxhDm3mj7pb67FNbZbJIzJ\n\
-70HDsRe2O04oiTx+h6g6pW3cOQMgIAvFgKN5Ex727K4230B0NIdGkzuj4KSML0NM\n\
-slSAcXZ41OoSKNjy44BVEZv0ZdxTDrRM4EwJtNyggFzmtTuV02nkUj1bYYYC5f0L\n\
-ADr6s0XMyaNk8twlWYlYDZ5uKDpVRVBfiGcq0uJIzIvemhuTrofh8pBQQNkPRDFT\n\
-Rq1iTo1Ihhl3/Fl1kXk1WR3jTjNb4jHX7lIoXwpwp767HAPKGhjQ9cFbnHMEtkro\n\
-RlJYdtRq5mccDtwT0GFyoJLLBZdHHMHJz0F9H7FNk2tTQQMhK5MVYwg+LIaee586\n\
-CQVqfbscp7evlgjLW98H+5zylRHAgoH2G79aHljNKMp9BOuq6SnEglEsiWGVtu2l\n\
-hnx8SB3sVJZHeer8f/UQQwqbAO+Kdy70NmbSaqaVtp8jOxLiidWkwSyRTsuU6D8i\n\
-DiH5uEqBXExjrj0FslxcVKdVj5glVcSmkLwZKbEU1OKwleT/iXFhvooWhQ==\n\
------END CERTIFICATE-----";
-
-char *test_ca_certificate="data:,-----BEGIN CERTIFICATE-----\n\
-MIIGOTCCBCGgAwIBAgIJAOE/vJd8EB24MA0GCSqGSIb3DQEBBQUAMIGyMQswCQYD\n\
-VQQGEwJGUjEPMA0GA1UECAwGQWxzYWNlMRMwEQYDVQQHDApTdHJhc2JvdXJnMRgw\n\
-FgYDVQQKDA93d3cuZnJlZWxhbi5vcmcxEDAOBgNVBAsMB2ZyZWVsYW4xLTArBgNV\n\
-BAMMJEZyZWVsYW4gU2FtcGxlIENlcnRpZmljYXRlIEF1dGhvcml0eTEiMCAGCSqG\n\
-SIb3DQEJARYTY29udGFjdEBmcmVlbGFuLm9yZzAeFw0xMjA0MjcxMDE3NDRaFw0x\n\
-MjA1MjcxMDE3NDRaMIGyMQswCQYDVQQGEwJGUjEPMA0GA1UECAwGQWxzYWNlMRMw\n\
-EQYDVQQHDApTdHJhc2JvdXJnMRgwFgYDVQQKDA93d3cuZnJlZWxhbi5vcmcxEDAO\n\
-BgNVBAsMB2ZyZWVsYW4xLTArBgNVBAMMJEZyZWVsYW4gU2FtcGxlIENlcnRpZmlj\n\
-YXRlIEF1dGhvcml0eTEiMCAGCSqGSIb3DQEJARYTY29udGFjdEBmcmVlbGFuLm9y\n\
-ZzCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAODp+8oQcK+MTuWPZVxJ\n\
-ZR75paK4zcUngupYXWSGWFXPTV7vssFk6vInePArTL+T9KwHfiZ29Pp3UbzDlysY\n\
-Kz9f9Ae50jGD6xVPwXgQ/VI979GyFXzhiEMtSYykF04tBJiDl2/FZxbHPpNxC39t\n\
-14kwuDqBin9N/ZbT5+45tbbS8ziXS+QgL5hD2q2eYCWayrGEt1Y+jDAdHDHmGnZ8\n\
-d4hbgILJAs3IInOCDjC4c1gwHFb8G4QHHTwVhjhqpkq2hQHgzWBC1l2Dku/oDYev\n\
-Zu/pfpTo3z6+NOYBrUWseQmIuG+DGMQA9KOuSQveyTywBm4G4vZKn0sCu1/v2+9T\n\
-BGv41tgS/Yf6oeeQVrbS4RFY1r9qTK6DW9wkTTesa4xoDKQrWjSJ7+aa8tvBXLGX\n\
-x2xdRNWLeRMuGBSOihwXmDr+rCJRauT7pItN5X+uWNTX1ofNksQSUMaFJ5K7L0LU\n\
-iQqU2Yyt/8UphdVZL4EFkGSA13UDWtb9mM1hY0h65LlSYwCchEphrtI9cuV+ITrS\n\
-NcN6cP/dqDx1/jWd6dqjNu7+dugwX5elQS9uUYCFmugR5s1m2eeBg3QuC7gZLE0N\n\
-NbgS7oSxKJe9KeOcw68jHWfBKsCfBfQ4fU2t/ntMybT3hCdEMQu4dgM5Tyw/UeFq\n\
-0SaJyTl+G1bTzS0FW6uUp6NLAgMBAAGjUDBOMB0GA1UdDgQWBBQjbC09PildeLhs\n\
-Pqriuy4ebIfyUzAfBgNVHSMEGDAWgBQjbC09PildeLhsPqriuy4ebIfyUzAMBgNV\n\
-HRMEBTADAQH/MA0GCSqGSIb3DQEBBQUAA4ICAQCwRJpJCgp7S+k9BT6X3kBefonE\n\
-EOYtyWXBPpuyG3Qlm1rdhc66DCGForDmTxjMmHYtNmAVnM37ILW7MoflWrAkaY19\n\
-gv88Fzwa5e6rWK4fTSpiEOc5WB2A3HPN9wJnhQXt1WWMDD7jJSLxLIwFqkzpDbDE\n\
-9122TtnIbmKNv0UQpzPV3Ygbqojy6eZHUOT05NaOT7vviv5QwMAH5WeRfiCys8CG\n\
-Sno/o830OniEHvePTYswLlX22LyfSHeoTQCCI8pocytl7IwARKCvBgeFqvPrMiqP\n\
-ch16FiU9II8KaMgpebrUSz3J1BApOOd1LBd42BeTAkNSxjRvbh8/lDWfnE7ODbKc\n\
-b6Ad3V9flFb5OBZH4aTi6QfrDnBmbLgLL8o/MLM+d3Kg94XRU9LjC2rjivQ6MC53\n\
-EnWNobcJFY+soXsJokGtFxKgIx8XrhF5GOsT2f1pmMlYL4cjlU0uWkPOOkhq8tIp\n\
-R8cBYphzXu1v6h2AaZLRq184e30ZO98omKyQoQ2KAm5AZayRrZZtjvEZPNamSuVQ\n\
-iPe3o/4tyQGq+jEMAEjLlDECu0dEa6RFntcbBPMBP3wZwE2bI9GYgvyaZd63DNdm\n\
-Xd65m0mmfOWYttfrDT3Q95YP54nHpIxKBw1eFOzrnXOqbKVmJ/1FDP2yWeooKVLf\n\
-KvbxUcDaVvXB0EU0bg==\n\
------END CERTIFICATE-----";
-
-char *test_privatekey = "data:,-----BEGIN RSA PRIVATE KEY-----\n\
-MIIJKQIBAAKCAgEA3W29+ID6194bH6ejLrIC4hb2Ugo8v6ZC+Mrck2dNYMNPjcOK\n\
-ABvxxEtBamnSaeU/IY7FC/giN622LEtV/3oDcrua0+yWuVafyxmZyTKUb4/GUgaf\n\
-RQPf/eiX9urWurtIK7XgNGFNUjYPq4dSJQPPhwCHE/LKAykWnZBXRrX0Dq4XyApN\n\
-ku0IpjIjEXH+8ixE12wH8wt7DEvdO7T3N3CfUbaITl1qBX+Nm2Z6q4Ag/u5rl8NJ\n\
-fXg71ZmXA3XOj7zFvpyapRIZcPmkvZYn7SMCp8dXyXHPdpSiIWL2uB3KiO4JrUYv\n\
-t2GzLBUThp+lNSZaZ/Q3yOaAAUkOx+1h08285Pi+P8lO+H2Xic4SvMq1xtLg2bNo\n\
-PC5KnbRfuFPuUD2/3dSiiragJ6uYDLOyWJDivKGt/72OVTEPAL9o6T2pGZrwbQui\n\
-FGrGTMZOvWMSpQtNl+tCCXlT4mWqJDRwuMGrI4DnnGzt3IKqNwS4Qyo9KqjMIPwn\n\
-XZAmWPm3FOKe4sFwc5fpawKO01JZewDsYTDxVj+cwXwFxbE2yBiFz2FAHwfopwaH\n\
-35p3C6lkcgP2k/zgAlnBluzACUI+MKJ/G0gv/uAhj1OHJQ3L6kn1SpvQ41/ueBjl\n\
-unExqQSYD7GtZ1Kg8uOcq2r+WISE3Qc9MpQFFkUVllmgWGwYDuN3Zsez95kCAwEA\n\
-AQKCAgBymEHxouau4z6MUlisaOn/Ej0mVi/8S1JrqakgDB1Kj6nTRzhbOBsWKJBR\n\
-PzTrIv5aIqYtvJwQzrDyGYcHMaEpNpg5Rz716jPGi5hAPRH+7pyHhO/Watv4bvB+\n\
-lCjO+O+v12+SDC1U96+CaQUFLQSw7H/7vfH4UsJmhvX0HWSSWFzsZRCiklOgl1/4\n\
-vlNgB7MU/c7bZLyor3ZuWQh8Q6fgRSQj0kp1T/78RrwDl8r7xG4gW6vj6F6m+9bg\n\
-ro5Zayu3qxqJhWVvR3OPvm8pVa4hIJR5J5Jj3yZNOwdOX/Saiv6tEx7MvB5bGQlC\n\
-6co5SIEPPZ/FNC1Y/PNOWrb/Q4GW1AScdICZu7wIkKzWAJCo59A8Luv5FV8vm4R2\n\
-4JkyB6kXcVfowrjYXqDF/UX0ddDLLGF96ZStte3PXX8PQWY89FZuBkGw6NRZInHi\n\
-xinN2V8cm7Cw85d9Ez2zEGB4KC7LI+JgLQtdg3XvbdfhOi06eGjgK2mwfOqT8Sq+\n\
-v9POIJXTNEI3fi3dB86af/8OXRtOrAa1mik2msDI1Goi7cKQbC3fz/p1ISQCptvs\n\
-YvNwstDDutkA9o9araQy5b0LC6w5k+CSdVNbd8O2EUd0OBOUjblHKvdZ3Voz8EDF\n\
-ywYimmNGje1lK8nh2ndpja5q3ipDs1hKg5UujoGfei2gn0ch5QKCAQEA8O+IHOOu\n\
-T/lUgWspophE0Y1aUJQPqgK3EiKB84apwLfz2eAPSBff2dCN7Xp6s//u0fo41LE5\n\
-P0ds/5eu9PDlNF6HH5H3OYpV/57v5O2OSBQdB/+3TmNmQGYJCSzouIS3YNOUPQ1z\n\
-FFvRateN91BW7wKFHr0+M4zG6ezfutAQywWNoce7oGaYTT8z/yWXqmFidDqng5w5\n\
-6d8t40ScozIVacGug+lRi8lbTC+3Tp0r+la66h49upged3hFOvGXIOybvYcE98K2\n\
-GpNl9cc4q6O1WLdR7QC91ZNflKOKE8fALLZ/stEXL0p2bixbSnbIdxOEUch/iQhM\n\
-chxlsRFLjxV1dwKCAQEA60X6LyefIlXzU3PA+gIRYV0g8FOxzxXfvqvYeyOGwDaa\n\
-p/Ex50z76jIJK8wlW5Ei7U6xsxxw3E9DLH7Sf3H4KiGouBVIdcv9+IR0LcdYPR9V\n\
-oCQ1Mm5a7fjnm/FJwTokdgWGSwmFTH7/jGcNHZ8lumlRFCj6VcLT/nRxM6dgIXSo\n\
-w1D9QGC9V+e6KOZ6VR5xK0h8pOtkqoGrbFLu26GPBSuguPJXt0fwJt9PAG+6VvxJ\n\
-89NLML/n+g2/jVKXhfTT1Mbb3Fx4lnbLnkP+JrvYIaoQ1PZNggILYCUGJJTLtqOT\n\
-gkg1S41/X8EFg671kAB6ZYPbd5WnL14Xp0a9MOB/bwKCAQEA6WVAl6u/al1/jTdA\n\
-R+/1ioHB4Zjsa6bhrUGcXUowGy6XnJG+e/oUsS2kr04cm03sDaC1eOSNLk2Euzw3\n\
-EbRidI61mtGNikIF+PAAN+YgFJbXYK5I5jjIDs5JJohIkKaP9c5AJbxnpGslvLg/\n\
-IDrFXBc22YY9QTa4YldCi/eOrP0eLIANs95u3zXAqwPBnh1kgG9pYsbuGy5Fh4kp\n\
-q7WSpLYo1kQo6J8QQAdhLVh4B7QIsU7GQYGm0djCR81Mt2o9nCW1nEUUnz32YVay\n\
-ASM/Q0eip1I2kzSGPLkHww2XjjjkD1cZfIhHnYZ+kO3sV92iKo9tbFOLqmbz48l7\n\
-RoplFQKCAQEA6i+DcoCL5A+N3tlvkuuQBUw/xzhn2uu5BP/kwd2A+b7gfp6Uv9lf\n\
-P6SCgHf6D4UOMQyN0O1UYdb71ESAnp8BGF7cpC97KtXcfQzK3+53JJAWGQsxcHts\n\
-Q0foss6gTZfkRx4EqJhXeOdI06aX5Y5ObZj7PYf0dn0xqyyYqYPHKkYG3jO1gelJ\n\
-T0C3ipKv3h4pI55Jg5dTYm0kBvUeELxlsg3VM4L2UNdocikBaDvOTVte+Taut12u\n\
-OLaKns9BR/OFD1zJ6DSbS5n/4A9p4YBFCG1Rx8lLKUeDrzXrQWpiw+9amunpMsUr\n\
-rlJhfMwgXjA7pOR1BjmOapXMEZNWKlqsPQKCAQByVDxIwMQczUFwQMXcu2IbA3Z8\n\
-Czhf66+vQWh+hLRzQOY4hPBNceUiekpHRLwdHaxSlDTqB7VPq+2gSkVrCX8/XTFb\n\
-SeVHTYE7iy0Ckyme+2xcmsl/DiUHfEy+XNcDgOutS5MnWXANqMQEoaLW+NPLI3Lu\n\
-V1sCMYTd7HN9tw7whqLg18wB1zomSMVGT4DkkmAzq4zSKI1FNYp8KA3OE1Emwq+0\n\
-wRsQuawQVLCUEP3To6kYOwTzJq7jhiUK6FnjLjeTrNQSVdoqwoJrlTAHgXVV3q7q\n\
-v3TGd3xXD9yQIjmugNgxNiwAZzhJs/ZJy++fPSJ1XQxbd9qPghgGoe/ff6G7\n\
------END RSA PRIVATE KEY-----";
-
-
-
-DDS_Security_ValidationResult_t
-validate_local_identity(
-        dds_security_authentication *instance,
-        DDS_Security_IdentityHandle *local_identity_handle,
-        DDS_Security_GUID_t *adjusted_participant_guid,
-        const DDS_Security_DomainId domain_id,
-        const DDS_Security_Qos *participant_qos,
-        const DDS_Security_GUID_t *candidate_participant_guid,
-
-        DDS_Security_SecurityException *ex);
-DDS_Security_boolean
-get_identity_token(dds_security_authentication *instance,
-                   DDS_Security_IdentityToken *identity_token,
-                   const DDS_Security_IdentityHandle handle,
-                   DDS_Security_SecurityException *ex);
-DDS_Security_boolean
-set_permissions_credential_and_token(
-        dds_security_authentication *instance,
-        const DDS_Security_IdentityHandle handle,
-        const DDS_Security_PermissionsCredentialToken *permissions_credential,
-        const DDS_Security_PermissionsToken *permissions_token,
-        DDS_Security_SecurityException *ex);
-
-DDS_Security_ValidationResult_t
-validate_remote_identity(
-        dds_security_authentication *instance,
-        DDS_Security_IdentityHandle *remote_identity_handle,
-        DDS_Security_AuthRequestMessageToken *local_auth_request_token,
-        const DDS_Security_AuthRequestMessageToken *remote_auth_request_token,
-        const DDS_Security_IdentityHandle local_identity_handle,
-        const DDS_Security_IdentityToken *remote_identity_token,
-        const DDS_Security_GUID_t *remote_participant_guid,
-        DDS_Security_SecurityException *ex);
-
-DDS_Security_ValidationResult_t
-begin_handshake_request(
-        dds_security_authentication *instance,
-        DDS_Security_HandshakeHandle *handshake_handle,
-        DDS_Security_HandshakeMessageToken *handshake_message,
-        const DDS_Security_IdentityHandle initiator_identity_handle,
-        const DDS_Security_IdentityHandle replier_identity_handle,
-        const DDS_Security_OctetSeq *serialized_local_participant_data,
-        DDS_Security_SecurityException *ex);
-
-DDS_Security_ValidationResult_t
-begin_handshake_reply(
-        dds_security_authentication *instance,
-        DDS_Security_HandshakeHandle *handshake_handle,
-        DDS_Security_HandshakeMessageToken *handshake_message_out,
-        const DDS_Security_HandshakeMessageToken *handshake_message_in,
-        const DDS_Security_IdentityHandle initiator_identity_handle,
-        const DDS_Security_IdentityHandle replier_identity_handle,
-        const DDS_Security_OctetSeq *serialized_local_participant_data,
-        DDS_Security_SecurityException *ex);
-
-DDS_Security_ValidationResult_t
-process_handshake(
-        dds_security_authentication *instance,
-        DDS_Security_HandshakeMessageToken *handshake_message_out,
-        const DDS_Security_HandshakeMessageToken *handshake_message_in,
-        const DDS_Security_HandshakeHandle handshake_handle,
-        DDS_Security_SecurityException *ex);
-
-DDS_Security_SharedSecretHandle get_shared_secret(
-        dds_security_authentication *instance,
-        const DDS_Security_HandshakeHandle handshake_handle,
-        DDS_Security_SecurityException *ex);
-
-DDS_Security_boolean
-get_authenticated_peer_credential_token(
-        dds_security_authentication *instance,
-        DDS_Security_AuthenticatedPeerCredentialToken *peer_credential_token,
-        const DDS_Security_HandshakeHandle handshake_handle,
-        DDS_Security_SecurityException *ex);
-
-
-DDS_Security_boolean get_identity_status_token(
-        dds_security_authentication *instance,
-        DDS_Security_IdentityStatusToken *identity_status_token,
-        const DDS_Security_IdentityHandle handle,
-        DDS_Security_SecurityException *ex);
-
-DDS_Security_boolean set_listener(dds_security_authentication *instance,
-                                  const dds_security_authentication_listener *listener,
-                                  DDS_Security_SecurityException *ex);
-
-DDS_Security_boolean return_identity_token(dds_security_authentication *instance,
-                                           const DDS_Security_IdentityToken *token,
-                                           DDS_Security_SecurityException *ex);
-
-DDS_Security_boolean return_identity_status_token(
-        dds_security_authentication *instance,
-        const DDS_Security_IdentityStatusToken *token,
-        DDS_Security_SecurityException *ex);
-
-DDS_Security_boolean return_authenticated_peer_credential_token(
-        dds_security_authentication *instance,
-        const DDS_Security_AuthenticatedPeerCredentialToken *peer_credential_token,
-        DDS_Security_SecurityException *ex);
-
-DDS_Security_boolean
-return_handshake_handle(dds_security_authentication *instance,
-                        const DDS_Security_HandshakeHandle handshake_handle,
-                        DDS_Security_SecurityException *ex);
-DDS_Security_boolean
-return_identity_handle(
-        dds_security_authentication *instance,
-        const DDS_Security_IdentityHandle identity_handle,
-        DDS_Security_SecurityException *ex);
-
-DDS_Security_boolean return_sharedsecret_handle(
-        dds_security_authentication *instance,
-        const DDS_Security_SharedSecretHandle sharedsecret_handle,
-        DDS_Security_SecurityException *ex);
-
-
-
-#endif /* SECURITY_BUILTIN_PLUGINS_AUTHENTICATION_H_ */
diff --git a/src/security/core/tests/plugin_loading/plugin_mock/authentication_init_error/mock_authentication.c b/src/security/core/tests/plugin_loading/plugin_mock/authentication_init_error/mock_authentication.c
deleted file mode 100644
index d42e4f5..0000000
--- a/src/security/core/tests/plugin_loading/plugin_mock/authentication_init_error/mock_authentication.c
+++ /dev/null
@@ -1,347 +0,0 @@
-/*
- * Copyright(c) 2006 to 2019 ADLINK Technology Limited and others
- *
- * This program and the accompanying materials are made available under the
- * terms of the Eclipse Public License v. 2.0 which is available at
- * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
- * v. 1.0 which is available at
- * http://www.eclipse.org/org/documents/edl-v10.php.
- *
- * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
- */
-
-#include "dds/security/dds_security_api.h"
-#include "dds/ddsrt/heap.h"
-#include "dds/ddsrt/misc.h"
-#include "mock_authentication.h"
-#include <stdio.h>
-#include <string.h>
-#include <stdbool.h>
-
-/**
- * Implementation structure for storing encapsulated members of the instance
- * while giving only the interface definition to user
- */
-
-typedef struct dds_security_authentication_impl {
-  dds_security_authentication base;
-  int id; //sample internal member
-} dds_security_authentication_impl;
-
-DDS_Security_ValidationResult_t validate_local_identity(
-    dds_security_authentication *instance,
-     DDS_Security_IdentityHandle *local_identity_handle,
-     DDS_Security_GUID_t *adjusted_participant_guid,
-    const DDS_Security_DomainId domain_id,
-    const DDS_Security_Qos *participant_qos,
-    const DDS_Security_GUID_t *candidate_participant_guid,
-     DDS_Security_SecurityException *ex)
-{
-
-  unsigned i;
-  DDS_Security_ValidationResult_t result=DDS_SECURITY_VALIDATION_OK;
-  dds_security_authentication_impl *implementation =
-      (dds_security_authentication_impl *) instance;
-  char *identity_ca = NULL;
-  char *identity_certificate = NULL;
-  char *private_key = NULL;
-
-  DDSRT_UNUSED_ARG(local_identity_handle);
-  DDSRT_UNUSED_ARG(adjusted_participant_guid);
-  DDSRT_UNUSED_ARG(domain_id);
-  DDSRT_UNUSED_ARG(participant_qos);
-  DDSRT_UNUSED_ARG(candidate_participant_guid);
-  DDSRT_UNUSED_ARG(ex);
-  DDSRT_UNUSED_ARG(instance);
-
-  implementation->id = 2;
-
-  memcpy(adjusted_participant_guid, candidate_participant_guid, sizeof(DDS_Security_GUID_t));
-
-  for( i=0; i< participant_qos->property.value._length; i++)
-  {
-
-    //printf("%s: %s",participant_qos->property.value._buffer[i].name, participant_qos->property.value._buffer[i].value);
-    printf("%s\n",participant_qos->property.value._buffer[i].name);
-    if( strcmp(participant_qos->property.value._buffer[i].name, "dds.sec.auth.private_key") == 0)
-    {
-      private_key = participant_qos->property.value._buffer[i].value;
-    } else if( strcmp(participant_qos->property.value._buffer[i].name, "dds.sec.auth.identity_ca") == 0)
-    {
-      identity_ca = participant_qos->property.value._buffer[i].value;
-    } else if( strcmp(participant_qos->property.value._buffer[i].name, "dds.sec.auth.identity_certificate") == 0)
-    {
-      identity_certificate = participant_qos->property.value._buffer[i].value;
-    }
-  }
-
-  if( strcmp(identity_certificate, test_identity_certificate) != 0){
-
-    result = DDS_SECURITY_VALIDATION_FAILED;
-    printf("FAILED: Could not get identity_certificate value properly\n");
-  }
-  else if( strcmp(identity_ca, test_ca_certificate) != 0){
-    printf("FAILED: Could not get identity_ca value properly\n");
-    result = DDS_SECURITY_VALIDATION_FAILED;
-  }else if( strcmp(private_key, test_privatekey) != 0){
-    printf("FAILED: Could not get private_key value properly\n");
-    result = DDS_SECURITY_VALIDATION_FAILED;
-  }
-
-  if( result == DDS_SECURITY_VALIDATION_OK )
-  {
-    printf("DDS_SECURITY_VALIDATION_OK\n");
-  }
-
-
-  return result;
-}
-
-DDS_Security_boolean get_identity_token(dds_security_authentication *instance,
-     DDS_Security_IdentityToken *identity_token,
-    const DDS_Security_IdentityHandle handle,
-     DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(identity_token);
-  DDSRT_UNUSED_ARG(handle);
-  DDSRT_UNUSED_ARG(ex);
-  DDSRT_UNUSED_ARG(instance);
-
-  memset(identity_token, 0, sizeof(*identity_token));
-
-  return true;
-}
-
-DDS_Security_boolean get_identity_status_token(
-    dds_security_authentication *instance,
-     DDS_Security_IdentityStatusToken *identity_status_token,
-    const DDS_Security_IdentityHandle handle,
-     DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(identity_status_token);
-  DDSRT_UNUSED_ARG(handle);
-  DDSRT_UNUSED_ARG(ex);
-  DDSRT_UNUSED_ARG(instance);
-
-  return true;
-}
-
-DDS_Security_boolean set_permissions_credential_and_token(
-    dds_security_authentication *instance,
-    const DDS_Security_IdentityHandle handle,
-    const DDS_Security_PermissionsCredentialToken *permissions_credential,
-    const DDS_Security_PermissionsToken *permissions_token,
-     DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(handle);
-  DDSRT_UNUSED_ARG(permissions_credential);
-  DDSRT_UNUSED_ARG(permissions_token);
-  DDSRT_UNUSED_ARG(ex);
-  DDSRT_UNUSED_ARG(instance);
-
-  return true;
-}
-
-DDS_Security_ValidationResult_t validate_remote_identity(
-    dds_security_authentication *instance,
-     DDS_Security_IdentityHandle *remote_identity_handle,
-     DDS_Security_AuthRequestMessageToken *local_auth_request_token,
-    const DDS_Security_AuthRequestMessageToken *remote_auth_request_token,
-    const DDS_Security_IdentityHandle local_identity_handle,
-    const DDS_Security_IdentityToken *remote_identity_token,
-    const DDS_Security_GUID_t *remote_participant_guid,
-     DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(remote_identity_handle);
-  DDSRT_UNUSED_ARG(local_auth_request_token);
-  DDSRT_UNUSED_ARG(remote_auth_request_token);
-  DDSRT_UNUSED_ARG(local_identity_handle);
-  DDSRT_UNUSED_ARG(remote_identity_token);
-  DDSRT_UNUSED_ARG(remote_participant_guid);
-  DDSRT_UNUSED_ARG(ex);
-  DDSRT_UNUSED_ARG(instance);
-
-  return DDS_SECURITY_VALIDATION_OK;
-}
-
-DDS_Security_ValidationResult_t begin_handshake_request(
-    dds_security_authentication *instance,
-     DDS_Security_HandshakeHandle *handshake_handle,
-     DDS_Security_HandshakeMessageToken *handshake_message,
-    const DDS_Security_IdentityHandle initiator_identity_handle,
-    const DDS_Security_IdentityHandle replier_identity_handle,
-    const DDS_Security_OctetSeq *serialized_local_participant_data,
-     DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(handshake_handle);
-  DDSRT_UNUSED_ARG(handshake_message);
-  DDSRT_UNUSED_ARG(initiator_identity_handle);
-  DDSRT_UNUSED_ARG(replier_identity_handle);
-  DDSRT_UNUSED_ARG(serialized_local_participant_data);
-  DDSRT_UNUSED_ARG(ex);
-  DDSRT_UNUSED_ARG(instance);
-
-  return DDS_SECURITY_VALIDATION_OK;
-}
-
-DDS_Security_ValidationResult_t begin_handshake_reply(
-    dds_security_authentication *instance,
-     DDS_Security_HandshakeHandle *handshake_handle,
-     DDS_Security_HandshakeMessageToken *handshake_message_out,
-    const DDS_Security_HandshakeMessageToken *handshake_message_in,
-    const DDS_Security_IdentityHandle initiator_identity_handle,
-    const DDS_Security_IdentityHandle replier_identity_handle,
-    const DDS_Security_OctetSeq *serialized_local_participant_data,
-     DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(handshake_handle);
-  DDSRT_UNUSED_ARG(handshake_message_out);
-  DDSRT_UNUSED_ARG(handshake_message_in);
-  DDSRT_UNUSED_ARG(initiator_identity_handle);
-  DDSRT_UNUSED_ARG(replier_identity_handle);
-  DDSRT_UNUSED_ARG(serialized_local_participant_data);
-  DDSRT_UNUSED_ARG(ex);
-  DDSRT_UNUSED_ARG(instance);
-
-  return DDS_SECURITY_VALIDATION_OK;
-}
-
-DDS_Security_ValidationResult_t process_handshake(
-    dds_security_authentication *instance,
-     DDS_Security_HandshakeMessageToken *handshake_message_out,
-    const DDS_Security_HandshakeMessageToken *handshake_message_in,
-    const DDS_Security_HandshakeHandle handshake_handle,
-     DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(handshake_message_out);
-  DDSRT_UNUSED_ARG(handshake_message_in);
-  DDSRT_UNUSED_ARG(handshake_handle);
-  DDSRT_UNUSED_ARG(ex);
-  DDSRT_UNUSED_ARG(instance);
-
-  return DDS_SECURITY_VALIDATION_OK;
-}
-
-DDS_Security_SharedSecretHandle get_shared_secret(
-    dds_security_authentication *instance,
-    const DDS_Security_HandshakeHandle handshake_handle,
-     DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(handshake_handle);
-  DDSRT_UNUSED_ARG(ex);
-  DDSRT_UNUSED_ARG(instance);
-
-  return 0;
-}
-
-DDS_Security_boolean get_authenticated_peer_credential_token(
-    dds_security_authentication *instance,
-     DDS_Security_AuthenticatedPeerCredentialToken *peer_credential_token,
-    const DDS_Security_HandshakeHandle handshake_handle,
-     DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(peer_credential_token);
-  DDSRT_UNUSED_ARG(handshake_handle);
-  DDSRT_UNUSED_ARG(ex);
-  DDSRT_UNUSED_ARG(instance);
-
-  return true;
-}
-
-DDS_Security_boolean set_listener(dds_security_authentication *instance,
-    const dds_security_authentication_listener *listener,
-     DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(listener);
-  DDSRT_UNUSED_ARG(ex);
-  DDSRT_UNUSED_ARG(instance);
-
-  return true;
-}
-
-DDS_Security_boolean return_identity_token(dds_security_authentication *instance,
-    const DDS_Security_IdentityToken *token,
-     DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(token);
-  DDSRT_UNUSED_ARG(ex);
-  DDSRT_UNUSED_ARG(instance);
-
-  return true;
-}
-
-DDS_Security_boolean return_identity_status_token(
-    dds_security_authentication *instance,
-    const DDS_Security_IdentityStatusToken *token,
-     DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(token);
-  DDSRT_UNUSED_ARG(ex);
-  DDSRT_UNUSED_ARG(instance);
-
-  return true;
-}
-
-DDS_Security_boolean return_authenticated_peer_credential_token(
-    dds_security_authentication *instance,
-    const DDS_Security_AuthenticatedPeerCredentialToken *peer_credential_token,
-     DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(peer_credential_token);
-  DDSRT_UNUSED_ARG(ex);
-  DDSRT_UNUSED_ARG(instance);
-
-  return true;
-}
-
-DDS_Security_boolean return_handshake_handle(dds_security_authentication *instance,
-    const DDS_Security_HandshakeHandle handshake_handle,
-     DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(handshake_handle);
-  DDSRT_UNUSED_ARG(ex);
-  DDSRT_UNUSED_ARG(instance);
-
-  return true;
-}
-
-DDS_Security_boolean return_identity_handle(dds_security_authentication *instance,
-    const DDS_Security_IdentityHandle identity_handle,
-     DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(identity_handle);
-  DDSRT_UNUSED_ARG(ex);
-  DDSRT_UNUSED_ARG(instance);
-
-  return true;
-}
-
-DDS_Security_boolean return_sharedsecret_handle(
-    dds_security_authentication *instance,
-    const DDS_Security_SharedSecretHandle sharedsecret_handle,
-     DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(sharedsecret_handle);
-  DDSRT_UNUSED_ARG(ex);
-  DDSRT_UNUSED_ARG(instance);
-
-  return true;
-}
-
-int32_t init_authentication( const char *argument,  void **context)
-{
-
-  DDSRT_UNUSED_ARG(argument);
-  DDSRT_UNUSED_ARG(context);
-
-  /* return error code for test purposes */
-  return 1;
-}
-
-int32_t finalize_authentication(void *instance)
-{
-
-  ddsrt_free((dds_security_authentication_impl*) instance);
-
-  return 0;
-}
diff --git a/src/security/core/tests/plugin_loading/plugin_mock/authentication_init_error/mock_authentication.h b/src/security/core/tests/plugin_loading/plugin_mock/authentication_init_error/mock_authentication.h
deleted file mode 100644
index faceace..0000000
--- a/src/security/core/tests/plugin_loading/plugin_mock/authentication_init_error/mock_authentication.h
+++ /dev/null
@@ -1,217 +0,0 @@
-/*
- * Copyright(c) 2006 to 2019 ADLINK Technology Limited and others
- *
- * This program and the accompanying materials are made available under the
- * terms of the Eclipse Public License v. 2.0 which is available at
- * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
- * v. 1.0 which is available at
- * http://www.eclipse.org/org/documents/edl-v10.php.
- *
- * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
- */
-#ifndef SECURITY_BUILTIN_PLUGINS_AUTHENTICATION_H_
-#define SECURITY_BUILTIN_PLUGINS_AUTHENTICATION_H_
-
-#include "dds/security/authentication_init_error_export.h"
-
-SECURITY_EXPORT int32_t
-init_authentication(const char *argument, void **context);
-
-SECURITY_EXPORT int32_t
-finalize_authentication(void *context);
-
-char *test_identity_certificate="data:,-----BEGIN CERTIFICATE-----\n\
-MIIDYDCCAkigAwIBAgIBBDANBgkqhkiG9w0BAQsFADByMQswCQYDVQQGEwJOTDEL\n\
-MAkGA1UECBMCT1YxEzARBgNVBAoTCkFETGluayBJU1QxGTAXBgNVBAMTEElkZW50\n\
-aXR5IENBIFRlc3QxJjAkBgkqhkiG9w0BCQEWF2luZm9AaXN0LmFkbGlua3RlY2gu\n\
-Y29tMB4XDTE4MDMxMjAwMDAwMFoXDTI3MDMxMTIzNTk1OVowdTELMAkGA1UEBhMC\n\
-TkwxCzAJBgNVBAgTAk9WMRAwDgYDVQQKEwdBRExpbmsgMREwDwYDVQQLEwhJU1Qg\n\
-VGVzdDETMBEGA1UEAxMKQWxpY2UgVGVzdDEfMB0GCSqGSIb3DQEJARYQYWxpY2VA\n\
-YWRsaW5rLmlzdDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBANBW+tEZ\n\
-Baw7EQCEXyzH9n7IkZ8PQIKe8hG1LAOGYOF/oUYQZJO/HxbWoC4rFqOC20+A6is6\n\
-kFwr1Zzp/Wurk9CrFXo5Nomi6ActH6LUM57nYqN68w6U38z/XkQxVY/ESZ5dySfD\n\
-9Q1C8R+zdE8gwbimdYmwX7ioz336nghM2CoAHPDRthQeJupl8x4V7isOltr9CGx8\n\
-+imJXbGr39OK6u87cNLeu23sUkOIC0lSRMIqIQK3oJtHS70J2qecXdqp9MhE7Xky\n\
-/GPlI8ptQ1gJ8A3cAOvtI9mtMJMszs2EKWTLfeTcmfJHKKhKjvCgDdh3Jan4x5YP\n\
-Yg7HG6H+ceOUkMMCAwEAATANBgkqhkiG9w0BAQsFAAOCAQEAkvuqZzyJ3Nu4/Eo5\n\
-kD0nVgYGBUl7cspu+636q39zPSrxLEDMUWz+u8oXLpyGcgiZ8lZulPTV8dmOn+3C\n\
-Vg55c5C+gbnbX3MDyb3wB17296RmxYf6YNul4sFOmj6+g2i+Dw9WH0PBCVKbA84F\n\
-jR3Gx2Pfoifor3DvT0YFSsjNIRt090u4dQglbIb6cWEafC7O24t5jFhGPvJ7L9SE\n\
-gB0Drh/HmKTVuaqaRkoOKkKaKuWoXsszK1ZFda1DHommnR5LpYPsDRQ2fVM4EuBF\n\
-By03727uneuG8HLuNcLEV9H0i7LxtyfFkyCPUQvWG5jehb7xPOz/Ml26NAwwjlTJ\n\
-xEEFrw==\n\
------END CERTIFICATE-----";
-
-char *test_ca_certificate="data:,-----BEGIN CERTIFICATE-----\n\
-MIIEKTCCAxGgAwIBAgIBATANBgkqhkiG9w0BAQsFADByMQswCQYDVQQGEwJOTDEL\n\
-MAkGA1UECBMCT1YxEzARBgNVBAoTCkFETGluayBJU1QxGTAXBgNVBAMTEElkZW50\n\
-aXR5IENBIFRlc3QxJjAkBgkqhkiG9w0BCQEWF2luZm9AaXN0LmFkbGlua3RlY2gu\n\
-Y29tMB4XDTE4MDMxMjAwMDAwMFoXDTI3MDMxMTIzNTk1OVowcjELMAkGA1UEBhMC\n\
-TkwxCzAJBgNVBAgTAk9WMRMwEQYDVQQKEwpBRExpbmsgSVNUMRkwFwYDVQQDExBJ\n\
-ZGVudGl0eSBDQSBUZXN0MSYwJAYJKoZIhvcNAQkBFhdpbmZvQGlzdC5hZGxpbmt0\n\
-ZWNoLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBANa/ENFfGVXg\n\
-bPLTzBdDfiZQcp5dWZ//Pb8ErFOJu8uosVHFv8t69dgjHgNHB4OsjmjnR7GfKUZT\n\
-0cMvWJnjsC7DDlBwFET9rj4k40n96bbVCH9I7+tNhsoqzc6Eu+5h4sk7VfNGTM2Z\n\
-SyCd4GiSZRuA44rRbhXI7/LDpr4hY5J9ZDo5AM9ZyoLAoh774H3CZWD67S35XvUs\n\
-72dzE6uKG/vxBbvZ7eW2GLO6ewa9UxlnLVMPfJdpkp/xYXwwcPW2+2YXCge1ujxs\n\
-tjrOQJ5HUySh6DkE/kZpx8zwYWm9AaCrsvCIX1thsqgvKy+U5v1FS1L58eGc6s//\n\
-9yMgNhU29R0CAwEAAaOByTCBxjAMBgNVHRMEBTADAQH/MB0GA1UdDgQWBBRNVUJN\n\
-FzhJPReYT4QSx6dK53CXCTAfBgNVHSMEGDAWgBRNVUJNFzhJPReYT4QSx6dK53CX\n\
-CTAPBgNVHQ8BAf8EBQMDB/+AMGUGA1UdJQEB/wRbMFkGCCsGAQUFBwMBBggrBgEF\n\
-BQcDAgYIKwYBBQUHAwMGCCsGAQUFBwMEBggrBgEFBQcDCAYIKwYBBQUHAwkGCCsG\n\
-AQUFBwMNBggrBgEFBQcDDgYHKwYBBQIDBTANBgkqhkiG9w0BAQsFAAOCAQEAcOLF\n\
-ZYdJguj0uxeXB8v3xnUr1AWz9+gwg0URdfNLU2KvF2lsb/uznv6168b3/FcPgezN\n\
-Ihl9GqB+RvGwgXS/1UelCGbQiIUdsNxk246P4uOGPIyW32RoJcYPWZcpY+cw11tQ\n\
-NOnk994Y5/8ad1DmcxVLLqq5kwpXGWQufV1zOONq8B+mCvcVAmM4vkyF/de56Lwa\n\
-sAMpk1p77uhaDnuq2lIR4q3QHX2wGctFid5Q375DRscFQteY01r/dtwBBrMn0wuL\n\
-AMNx9ZGD+zAoOUaslpIlEQ+keAxk3jgGMWFMxF81YfhEnXzevSQXWpyek86XUyFL\n\
-O9IAQi5pa15gXjSbUg==\n\
------END CERTIFICATE-----";
-
-char *test_privatekey = "data:,-----BEGIN RSA PRIVATE KEY-----\n\
-MIIEowIBAAKCAQEA0Fb60RkFrDsRAIRfLMf2fsiRnw9Agp7yEbUsA4Zg4X+hRhBk\n\
-k78fFtagLisWo4LbT4DqKzqQXCvVnOn9a6uT0KsVejk2iaLoBy0fotQznudio3rz\n\
-DpTfzP9eRDFVj8RJnl3JJ8P1DULxH7N0TyDBuKZ1ibBfuKjPffqeCEzYKgAc8NG2\n\
-FB4m6mXzHhXuKw6W2v0IbHz6KYldsavf04rq7ztw0t67bexSQ4gLSVJEwiohAreg\n\
-m0dLvQnap5xd2qn0yETteTL8Y+Ujym1DWAnwDdwA6+0j2a0wkyzOzYQpZMt95NyZ\n\
-8kcoqEqO8KAN2HclqfjHlg9iDscbof5x45SQwwIDAQABAoIBAG0dYPeqd0IhHWJ7\n\
-8azufbchLMN1pX/D51xG2uptssfnpHuhkkufSZUYi4QipRS2ME6PYhWJ8pmTi6lH\n\
-E6cUkbI0KGd/F4U2gPdhNrR9Fxwea5bbifkVF7Gx/ZkRjZJiZ3w9+mCNTQbJDKhh\n\
-wITAzzT6WYznhvqbzzBX1fTa6kv0GAQtX7aHKM+XIwkhX2gzU5TU80bvH8aMrT05\n\
-tAMGQqkUeRnpo0yucBl4VmTZzd/+X/d2UyXR0my15jE5iH5o+p+E6qTRE9D+MGUd\n\
-MQ6Ftj0Untqy1lcog1ZLL6zPlnwcD4jgY5VCYDgvabnrSwymOJapPLsAEdWdq+U5\n\
-ec44BMECgYEA/+3qPUrd4XxA517qO3fCGBvf2Gkr7w5ZDeATOTHGuD8QZeK0nxPl\n\
-CWhRjdgkqo0fyf1cjczL5XgYayo+YxkO1Z4RUU+8lJAHlVx9izOQo+MTQfkwH4BK\n\
-LYlHxMoHJwAOXXoE+dmBaDh5xT0mDUGU750r763L6EFovE4qRBn9hxkCgYEA0GWz\n\
-rpOPNxb419WxG9npoQYdCZ5IbmEOGDH3ReggVzWHmW8sqtkqTZm5srcyDpqAc1Gu\n\
-paUveMblEBbU+NFJjLWOfwB5PCp8jsrqRgCQSxolShiVkc3Vu3oyzMus9PDge1eo\n\
-9mwVGO7ojQKWRu/WVAakENPaAjeyyhv4dqSNnjsCgYEAlwe8yszqoY1k8+U0T0G+\n\
-HeIdOCXgkmOiNCj+zyrLvaEhuS6PLq1b5TBVqGJcSPWdQ+MrglbQIKu9pUg5ptt7\n\
-wJ5WU+i9PeK9Ruxc/g/BFKYFkFJQjtZzb+nqm3wpul8zGwDN/O/ZiTqCyd3rHbmM\n\
-/dZ/viKPCZHIEBAEq0m3LskCgYBndzcAo+5k8ZjWwBfQth5SfhCIp/daJgGzbYtR\n\
-P/BenAsY2KOap3tjT8Fsw5usuHSxzIojX6H0Gvu7Qzq11mLn43Q+BeQrRQTWeFRc\n\
-MQdy4iZFZXNNEp7dF8yE9VKHwdgSJPGUdxD6chMvf2tRCN6mlS171VLV6wVvZvez\n\
-H/vX5QKBgD2Dq/NHpjCpAsECP9awmNF5Akn5WJbRGmegwXIih2mOtgtYYDeuQyxY\n\
-ZCrdJFfIUjUVPagshEmUklKhkYMYpzy2PQDVtaVcm6UNFroxT5h+J+KDs1LN1H8G\n\
-LsASrzyAg8EpRulwXEfLrWKiu9DKv8bMEgO4Ovgz8zTKJZIFhcac\n\
------END RSA PRIVATE KEY-----";
-
-
-DDS_Security_ValidationResult_t
-validate_local_identity(
-        dds_security_authentication *instance,
-        DDS_Security_IdentityHandle *local_identity_handle,
-        DDS_Security_GUID_t *adjusted_participant_guid,
-        const DDS_Security_DomainId domain_id,
-        const DDS_Security_Qos *participant_qos,
-        const DDS_Security_GUID_t *candidate_participant_guid,
-
-        DDS_Security_SecurityException *ex);
-DDS_Security_boolean
-get_identity_token(dds_security_authentication *instance,
-                   DDS_Security_IdentityToken *identity_token,
-                   const DDS_Security_IdentityHandle handle,
-                   DDS_Security_SecurityException *ex);
-DDS_Security_boolean
-set_permissions_credential_and_token(
-        dds_security_authentication *instance,
-        const DDS_Security_IdentityHandle handle,
-        const DDS_Security_PermissionsCredentialToken *permissions_credential,
-        const DDS_Security_PermissionsToken *permissions_token,
-        DDS_Security_SecurityException *ex);
-
-DDS_Security_ValidationResult_t
-validate_remote_identity(
-        dds_security_authentication *instance,
-        DDS_Security_IdentityHandle *remote_identity_handle,
-        DDS_Security_AuthRequestMessageToken *local_auth_request_token,
-        const DDS_Security_AuthRequestMessageToken *remote_auth_request_token,
-        const DDS_Security_IdentityHandle local_identity_handle,
-        const DDS_Security_IdentityToken *remote_identity_token,
-        const DDS_Security_GUID_t *remote_participant_guid,
-        DDS_Security_SecurityException *ex);
-
-DDS_Security_ValidationResult_t
-begin_handshake_request(
-        dds_security_authentication *instance,
-        DDS_Security_HandshakeHandle *handshake_handle,
-        DDS_Security_HandshakeMessageToken *handshake_message,
-        const DDS_Security_IdentityHandle initiator_identity_handle,
-        const DDS_Security_IdentityHandle replier_identity_handle,
-        const DDS_Security_OctetSeq *serialized_local_participant_data,
-        DDS_Security_SecurityException *ex);
-
-DDS_Security_ValidationResult_t
-begin_handshake_reply(
-        dds_security_authentication *instance,
-        DDS_Security_HandshakeHandle *handshake_handle,
-        DDS_Security_HandshakeMessageToken *handshake_message_out,
-        const DDS_Security_HandshakeMessageToken *handshake_message_in,
-        const DDS_Security_IdentityHandle initiator_identity_handle,
-        const DDS_Security_IdentityHandle replier_identity_handle,
-        const DDS_Security_OctetSeq *serialized_local_participant_data,
-        DDS_Security_SecurityException *ex);
-
-DDS_Security_ValidationResult_t
-process_handshake(
-        dds_security_authentication *instance,
-        DDS_Security_HandshakeMessageToken *handshake_message_out,
-        const DDS_Security_HandshakeMessageToken *handshake_message_in,
-        const DDS_Security_HandshakeHandle handshake_handle,
-        DDS_Security_SecurityException *ex);
-
-DDS_Security_SharedSecretHandle get_shared_secret(
-        dds_security_authentication *instance,
-        const DDS_Security_HandshakeHandle handshake_handle,
-        DDS_Security_SecurityException *ex);
-
-DDS_Security_boolean
-get_authenticated_peer_credential_token(
-        dds_security_authentication *instance,
-        DDS_Security_AuthenticatedPeerCredentialToken *peer_credential_token,
-        const DDS_Security_HandshakeHandle handshake_handle,
-        DDS_Security_SecurityException *ex);
-
-
-DDS_Security_boolean get_identity_status_token(
-        dds_security_authentication *instance,
-        DDS_Security_IdentityStatusToken *identity_status_token,
-        const DDS_Security_IdentityHandle handle,
-        DDS_Security_SecurityException *ex);
-
-DDS_Security_boolean set_listener(dds_security_authentication *instance,
-                                  const dds_security_authentication_listener *listener,
-                                  DDS_Security_SecurityException *ex);
-
-DDS_Security_boolean return_identity_token(dds_security_authentication *instance,
-                                           const DDS_Security_IdentityToken *token,
-                                           DDS_Security_SecurityException *ex);
-
-DDS_Security_boolean return_identity_status_token(
-        dds_security_authentication *instance,
-        const DDS_Security_IdentityStatusToken *token,
-        DDS_Security_SecurityException *ex);
-
-DDS_Security_boolean return_authenticated_peer_credential_token(
-        dds_security_authentication *instance,
-        const DDS_Security_AuthenticatedPeerCredentialToken *peer_credential_token,
-        DDS_Security_SecurityException *ex);
-
-DDS_Security_boolean
-return_handshake_handle(dds_security_authentication *instance,
-                        const DDS_Security_HandshakeHandle handshake_handle,
-                        DDS_Security_SecurityException *ex);
-DDS_Security_boolean
-return_identity_handle(
-        dds_security_authentication *instance,
-        const DDS_Security_IdentityHandle identity_handle,
-        DDS_Security_SecurityException *ex);
-
-DDS_Security_boolean return_sharedsecret_handle(
-        dds_security_authentication *instance,
-        const DDS_Security_SharedSecretHandle sharedsecret_handle,
-        DDS_Security_SecurityException *ex);
-
-
-
-#endif /* SECURITY_BUILTIN_PLUGINS_AUTHENTICATION_H_ */
diff --git a/src/security/core/tests/plugin_loading/plugin_mock/authentication_missing_function/mock_authentication.c b/src/security/core/tests/plugin_loading/plugin_mock/authentication_missing_function/mock_authentication.c
deleted file mode 100644
index c80c8d1..0000000
--- a/src/security/core/tests/plugin_loading/plugin_mock/authentication_missing_function/mock_authentication.c
+++ /dev/null
@@ -1,402 +0,0 @@
-/*
- * authentication.c
- *
- *  Created on: Jan 12, 2018
- *      Author: kurtulus oksuztepe
- *
- *  Description: This file implements the Authentication interface for DDS Security 1.2
- *
- */
-
-#include "dds/security/dds_security_api.h"
-#include "dds/ddsrt/heap.h"
-#include "dds/ddsrt/misc.h"
-#include "mock_authentication.h"
-#include <stdio.h>
-#include <assert.h>
-#include <string.h>
-#include <stdbool.h>
-
-/**
- * Implementation structure for storing encapsulated members of the instance
- * while giving only the interface definition to user
- */
-
-typedef struct dds_security_authentication_impl {
-  dds_security_authentication base;
-  int id; //sample internal member
-} dds_security_authentication_impl;
-
-DDS_Security_ValidationResult_t validate_local_identity(
-    dds_security_authentication *instance,
-     DDS_Security_IdentityHandle *local_identity_handle,
-     DDS_Security_GUID_t *adjusted_participant_guid,
-    const DDS_Security_DomainId domain_id,
-    const DDS_Security_Qos *participant_qos,
-    const DDS_Security_GUID_t *candidate_participant_guid,
-     DDS_Security_SecurityException *ex)
-{
-
-  unsigned i;
-  DDS_Security_ValidationResult_t result=DDS_SECURITY_VALIDATION_OK;
-  dds_security_authentication_impl *implementation =
-      (dds_security_authentication_impl *) instance;
-  char *identity_ca = NULL;
-  char *identity_certificate = NULL;
-  char *private_key = NULL;
-
-  DDSRT_UNUSED_ARG(local_identity_handle);
-  DDSRT_UNUSED_ARG(adjusted_participant_guid);
-  DDSRT_UNUSED_ARG(domain_id);
-  DDSRT_UNUSED_ARG(participant_qos);
-  DDSRT_UNUSED_ARG(candidate_participant_guid);
-  DDSRT_UNUSED_ARG(ex);
-  DDSRT_UNUSED_ARG(instance);
-
-  implementation->id = 2;
-
-  memcpy(adjusted_participant_guid, candidate_participant_guid, sizeof(DDS_Security_GUID_t));
-
-  for( i=0; i< participant_qos->property.value._length; i++)
-  {
-
-    //printf("%s: %s",participant_qos->property.value._buffer[i].name, participant_qos->property.value._buffer[i].value);
-    printf("%s\n",participant_qos->property.value._buffer[i].name);
-    if( strcmp(participant_qos->property.value._buffer[i].name, "dds.sec.auth.private_key") == 0)
-    {
-      private_key = participant_qos->property.value._buffer[i].value;
-    } else if( strcmp(participant_qos->property.value._buffer[i].name, "dds.sec.auth.identity_ca") == 0)
-    {
-      identity_ca = participant_qos->property.value._buffer[i].value;
-    } else if( strcmp(participant_qos->property.value._buffer[i].name, "dds.sec.auth.identity_certificate") == 0)
-    {
-      identity_certificate = participant_qos->property.value._buffer[i].value;
-    }
-  }
-
-  /* for Clang's static analyzer */
-  assert(identity_certificate != NULL);
-  assert(identity_ca != NULL);
-  assert(private_key != NULL);
-
-  if( strcmp(identity_certificate, test_identity_certificate) != 0){
-
-    result = DDS_SECURITY_VALIDATION_FAILED;
-    printf("FAILED: Could not get identity_certificate value properly\n");
-  }
-  else if( strcmp(identity_ca, test_ca_certificate) != 0){
-    printf("FAILED: Could not get identity_ca value properly\n");
-    result = DDS_SECURITY_VALIDATION_FAILED;
-  }else if( strcmp(private_key, test_privatekey) != 0){
-    printf("FAILED: Could not get private_key value properly\n");
-    result = DDS_SECURITY_VALIDATION_FAILED;
-  }
-
-  if( result == DDS_SECURITY_VALIDATION_OK )
-  {
-    printf("DDS_SECURITY_VALIDATION_OK\n");
-  }
-
-
-  return result;
-}
-
-DDS_Security_boolean get_identity_token(dds_security_authentication *instance,
-     DDS_Security_IdentityToken *identity_token,
-    const DDS_Security_IdentityHandle handle,
-     DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(identity_token);
-  DDSRT_UNUSED_ARG(handle);
-  DDSRT_UNUSED_ARG(ex);
-  DDSRT_UNUSED_ARG(instance);
-
-  memset(identity_token, 0, sizeof(*identity_token));
-
-  return true;
-}
-
-DDS_Security_boolean get_identity_status_token(
-    dds_security_authentication *instance,
-     DDS_Security_IdentityStatusToken *identity_status_token,
-    const DDS_Security_IdentityHandle handle,
-     DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(identity_status_token);
-  DDSRT_UNUSED_ARG(handle);
-  DDSRT_UNUSED_ARG(ex);
-  DDSRT_UNUSED_ARG(instance);
-
-  return true;
-}
-
-DDS_Security_boolean set_permissions_credential_and_token(
-    dds_security_authentication *instance,
-    const DDS_Security_IdentityHandle handle,
-    const DDS_Security_PermissionsCredentialToken *permissions_credential,
-    const DDS_Security_PermissionsToken *permissions_token,
-     DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(handle);
-  DDSRT_UNUSED_ARG(permissions_credential);
-  DDSRT_UNUSED_ARG(permissions_token);
-  DDSRT_UNUSED_ARG(ex);
-  DDSRT_UNUSED_ARG(instance);
-
-  return true;
-}
-
-DDS_Security_ValidationResult_t validate_remote_identity(
-    dds_security_authentication *instance,
-     DDS_Security_IdentityHandle *remote_identity_handle,
-     DDS_Security_AuthRequestMessageToken *local_auth_request_token,
-    const DDS_Security_AuthRequestMessageToken *remote_auth_request_token,
-    const DDS_Security_IdentityHandle local_identity_handle,
-    const DDS_Security_IdentityToken *remote_identity_token,
-    const DDS_Security_GUID_t *remote_participant_guid,
-     DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(remote_identity_handle);
-  DDSRT_UNUSED_ARG(local_auth_request_token);
-  DDSRT_UNUSED_ARG(remote_auth_request_token);
-  DDSRT_UNUSED_ARG(local_identity_handle);
-  DDSRT_UNUSED_ARG(remote_identity_token);
-  DDSRT_UNUSED_ARG(remote_participant_guid);
-  DDSRT_UNUSED_ARG(ex);
-  DDSRT_UNUSED_ARG(instance);
-
-  return DDS_SECURITY_VALIDATION_OK;
-}
-
-DDS_Security_ValidationResult_t begin_handshake_request(
-    dds_security_authentication *instance,
-     DDS_Security_HandshakeHandle *handshake_handle,
-     DDS_Security_HandshakeMessageToken *handshake_message,
-    const DDS_Security_IdentityHandle initiator_identity_handle,
-    const DDS_Security_IdentityHandle replier_identity_handle,
-    const DDS_Security_OctetSeq *serialized_local_participant_data,
-     DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(handshake_handle);
-  DDSRT_UNUSED_ARG(handshake_message);
-  DDSRT_UNUSED_ARG(initiator_identity_handle);
-  DDSRT_UNUSED_ARG(replier_identity_handle);
-  DDSRT_UNUSED_ARG(serialized_local_participant_data);
-  DDSRT_UNUSED_ARG(ex);
-  DDSRT_UNUSED_ARG(instance);
-
-  return DDS_SECURITY_VALIDATION_OK;
-}
-
-DDS_Security_ValidationResult_t begin_handshake_reply(
-    dds_security_authentication *instance,
-     DDS_Security_HandshakeHandle *handshake_handle,
-     DDS_Security_HandshakeMessageToken *handshake_message_out,
-    const DDS_Security_HandshakeMessageToken *handshake_message_in,
-    const DDS_Security_IdentityHandle initiator_identity_handle,
-    const DDS_Security_IdentityHandle replier_identity_handle,
-    const DDS_Security_OctetSeq *serialized_local_participant_data,
-     DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(handshake_handle);
-  DDSRT_UNUSED_ARG(handshake_message_out);
-  DDSRT_UNUSED_ARG(handshake_message_in);
-  DDSRT_UNUSED_ARG(initiator_identity_handle);
-  DDSRT_UNUSED_ARG(replier_identity_handle);
-  DDSRT_UNUSED_ARG(serialized_local_participant_data);
-  DDSRT_UNUSED_ARG(ex);
-  DDSRT_UNUSED_ARG(instance);
-
-  return DDS_SECURITY_VALIDATION_OK;
-}
-
-DDS_Security_ValidationResult_t process_handshake(
-    dds_security_authentication *instance,
-     DDS_Security_HandshakeMessageToken *handshake_message_out,
-    const DDS_Security_HandshakeMessageToken *handshake_message_in,
-    const DDS_Security_HandshakeHandle handshake_handle,
-     DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(handshake_message_out);
-  DDSRT_UNUSED_ARG(handshake_message_in);
-  DDSRT_UNUSED_ARG(handshake_handle);
-  DDSRT_UNUSED_ARG(ex);
-  DDSRT_UNUSED_ARG(instance);
-
-  return DDS_SECURITY_VALIDATION_OK;
-}
-
-DDS_Security_SharedSecretHandle get_shared_secret(
-    dds_security_authentication *instance,
-    const DDS_Security_HandshakeHandle handshake_handle,
-     DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(handshake_handle);
-  DDSRT_UNUSED_ARG(ex);
-  DDSRT_UNUSED_ARG(instance);
-
-  return 0;
-}
-
-DDS_Security_boolean get_authenticated_peer_credential_token(
-    dds_security_authentication *instance,
-     DDS_Security_AuthenticatedPeerCredentialToken *peer_credential_token,
-    const DDS_Security_HandshakeHandle handshake_handle,
-     DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(peer_credential_token);
-  DDSRT_UNUSED_ARG(handshake_handle);
-  DDSRT_UNUSED_ARG(ex);
-  DDSRT_UNUSED_ARG(instance);
-
-  return true;
-}
-
-DDS_Security_boolean set_listener(dds_security_authentication *instance,
-    const dds_security_authentication_listener *listener,
-     DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(listener);
-  DDSRT_UNUSED_ARG(ex);
-  DDSRT_UNUSED_ARG(instance);
-
-  return true;
-}
-
-DDS_Security_boolean return_identity_token(dds_security_authentication *instance,
-    const DDS_Security_IdentityToken *token,
-     DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(token);
-  DDSRT_UNUSED_ARG(ex);
-  DDSRT_UNUSED_ARG(instance);
-
-  return true;
-}
-
-DDS_Security_boolean return_identity_status_token(
-    dds_security_authentication *instance,
-    const DDS_Security_IdentityStatusToken *token,
-     DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(token);
-  DDSRT_UNUSED_ARG(ex);
-  DDSRT_UNUSED_ARG(instance);
-
-  return true;
-}
-
-DDS_Security_boolean return_authenticated_peer_credential_token(
-    dds_security_authentication *instance,
-    const DDS_Security_AuthenticatedPeerCredentialToken *peer_credential_token,
-     DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(peer_credential_token);
-  DDSRT_UNUSED_ARG(ex);
-  DDSRT_UNUSED_ARG(instance);
-
-  return true;
-}
-
-DDS_Security_boolean return_handshake_handle(dds_security_authentication *instance,
-    const DDS_Security_HandshakeHandle handshake_handle,
-     DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(handshake_handle);
-  DDSRT_UNUSED_ARG(ex);
-  DDSRT_UNUSED_ARG(instance);
-
-  return true;
-}
-
-DDS_Security_boolean return_identity_handle(dds_security_authentication *instance,
-    const DDS_Security_IdentityHandle identity_handle,
-     DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(identity_handle);
-  DDSRT_UNUSED_ARG(ex);
-  DDSRT_UNUSED_ARG(instance);
-
-  return true;
-}
-
-DDS_Security_boolean return_sharedsecret_handle(
-    dds_security_authentication *instance,
-    const DDS_Security_SharedSecretHandle sharedsecret_handle,
-     DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(sharedsecret_handle);
-  DDSRT_UNUSED_ARG(ex);
-  DDSRT_UNUSED_ARG(instance);
-
-  return true;
-}
-
-int32_t init_authentication( const char *argument,  void **context)
-{
-
-  dds_security_authentication_impl *authentication;
-
-  DDSRT_UNUSED_ARG(argument);
-
-  //allocate implementation wrapper
-  authentication = (dds_security_authentication_impl*) ddsrt_malloc(
-      sizeof(dds_security_authentication_impl));
-  memset(authentication, 0, sizeof(dds_security_authentication_impl));
-
-  //assign the interface functions
-  authentication->base.validate_local_identity = &validate_local_identity;
-
-  authentication->base.get_identity_token = &get_identity_token;
-
-  authentication->base.get_identity_status_token = &get_identity_status_token;
-
-  authentication->base.set_permissions_credential_and_token =
-      &set_permissions_credential_and_token;
-
-  authentication->base.validate_remote_identity = &validate_remote_identity;
-
-  authentication->base.begin_handshake_request = &begin_handshake_request;
-
-  authentication->base.begin_handshake_reply = &begin_handshake_reply;
-
-  authentication->base.process_handshake = &process_handshake;
-
-  /*   missing function
-  authentication->base.get_shared_secret = &get_shared_secret;
-  */
-
-  authentication->base.get_authenticated_peer_credential_token =
-      &get_authenticated_peer_credential_token;
-
-  authentication->base.set_listener = &set_listener;
-
-  authentication->base.return_identity_token = &return_identity_token;
-
-  authentication->base.return_identity_status_token =
-      &return_identity_status_token;
-
-  authentication->base.return_authenticated_peer_credential_token =
-      &return_authenticated_peer_credential_token;
-
-  authentication->base.return_handshake_handle = &return_handshake_handle;
-
-  authentication->base.return_identity_handle = &return_identity_handle;
-
-  authentication->base.return_sharedsecret_handle = &return_sharedsecret_handle;
-
-  //prepare implementation wrapper
-  authentication->id = 1;
-
-  //return the instance
-  *context = authentication;
-  return 0;
-}
-
-int32_t finalize_authentication(void *instance)
-{
-
-  ddsrt_free((dds_security_authentication_impl*) instance);
-
-  return 0;
-}
diff --git a/src/security/core/tests/plugin_loading/plugin_mock/authentication_missing_function/mock_authentication.h b/src/security/core/tests/plugin_loading/plugin_mock/authentication_missing_function/mock_authentication.h
deleted file mode 100644
index d3854b1..0000000
--- a/src/security/core/tests/plugin_loading/plugin_mock/authentication_missing_function/mock_authentication.h
+++ /dev/null
@@ -1,218 +0,0 @@
-/*
- * Copyright(c) 2006 to 2019 ADLINK Technology Limited and others
- *
- * This program and the accompanying materials are made available under the
- * terms of the Eclipse Public License v. 2.0 which is available at
- * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
- * v. 1.0 which is available at
- * http://www.eclipse.org/org/documents/edl-v10.php.
- *
- * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
- */
-
-#ifndef SECURITY_BUILTIN_PLUGINS_AUTHENTICATION_H_
-#define SECURITY_BUILTIN_PLUGINS_AUTHENTICATION_H_
-
-#include "dds/security/authentication_missing_function_export.h"
-
-SECURITY_EXPORT int32_t
-init_authentication(const char *argument, void **context);
-
-SECURITY_EXPORT int32_t
-finalize_authentication(void *context);
-
-char *test_identity_certificate="data:,-----BEGIN CERTIFICATE-----\n\
-MIIDYDCCAkigAwIBAgIBBDANBgkqhkiG9w0BAQsFADByMQswCQYDVQQGEwJOTDEL\n\
-MAkGA1UECBMCT1YxEzARBgNVBAoTCkFETGluayBJU1QxGTAXBgNVBAMTEElkZW50\n\
-aXR5IENBIFRlc3QxJjAkBgkqhkiG9w0BCQEWF2luZm9AaXN0LmFkbGlua3RlY2gu\n\
-Y29tMB4XDTE4MDMxMjAwMDAwMFoXDTI3MDMxMTIzNTk1OVowdTELMAkGA1UEBhMC\n\
-TkwxCzAJBgNVBAgTAk9WMRAwDgYDVQQKEwdBRExpbmsgMREwDwYDVQQLEwhJU1Qg\n\
-VGVzdDETMBEGA1UEAxMKQWxpY2UgVGVzdDEfMB0GCSqGSIb3DQEJARYQYWxpY2VA\n\
-YWRsaW5rLmlzdDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBANBW+tEZ\n\
-Baw7EQCEXyzH9n7IkZ8PQIKe8hG1LAOGYOF/oUYQZJO/HxbWoC4rFqOC20+A6is6\n\
-kFwr1Zzp/Wurk9CrFXo5Nomi6ActH6LUM57nYqN68w6U38z/XkQxVY/ESZ5dySfD\n\
-9Q1C8R+zdE8gwbimdYmwX7ioz336nghM2CoAHPDRthQeJupl8x4V7isOltr9CGx8\n\
-+imJXbGr39OK6u87cNLeu23sUkOIC0lSRMIqIQK3oJtHS70J2qecXdqp9MhE7Xky\n\
-/GPlI8ptQ1gJ8A3cAOvtI9mtMJMszs2EKWTLfeTcmfJHKKhKjvCgDdh3Jan4x5YP\n\
-Yg7HG6H+ceOUkMMCAwEAATANBgkqhkiG9w0BAQsFAAOCAQEAkvuqZzyJ3Nu4/Eo5\n\
-kD0nVgYGBUl7cspu+636q39zPSrxLEDMUWz+u8oXLpyGcgiZ8lZulPTV8dmOn+3C\n\
-Vg55c5C+gbnbX3MDyb3wB17296RmxYf6YNul4sFOmj6+g2i+Dw9WH0PBCVKbA84F\n\
-jR3Gx2Pfoifor3DvT0YFSsjNIRt090u4dQglbIb6cWEafC7O24t5jFhGPvJ7L9SE\n\
-gB0Drh/HmKTVuaqaRkoOKkKaKuWoXsszK1ZFda1DHommnR5LpYPsDRQ2fVM4EuBF\n\
-By03727uneuG8HLuNcLEV9H0i7LxtyfFkyCPUQvWG5jehb7xPOz/Ml26NAwwjlTJ\n\
-xEEFrw==\n\
------END CERTIFICATE-----";
-
-char *test_ca_certificate="data:,-----BEGIN CERTIFICATE-----\n\
-MIIEKTCCAxGgAwIBAgIBATANBgkqhkiG9w0BAQsFADByMQswCQYDVQQGEwJOTDEL\n\
-MAkGA1UECBMCT1YxEzARBgNVBAoTCkFETGluayBJU1QxGTAXBgNVBAMTEElkZW50\n\
-aXR5IENBIFRlc3QxJjAkBgkqhkiG9w0BCQEWF2luZm9AaXN0LmFkbGlua3RlY2gu\n\
-Y29tMB4XDTE4MDMxMjAwMDAwMFoXDTI3MDMxMTIzNTk1OVowcjELMAkGA1UEBhMC\n\
-TkwxCzAJBgNVBAgTAk9WMRMwEQYDVQQKEwpBRExpbmsgSVNUMRkwFwYDVQQDExBJ\n\
-ZGVudGl0eSBDQSBUZXN0MSYwJAYJKoZIhvcNAQkBFhdpbmZvQGlzdC5hZGxpbmt0\n\
-ZWNoLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBANa/ENFfGVXg\n\
-bPLTzBdDfiZQcp5dWZ//Pb8ErFOJu8uosVHFv8t69dgjHgNHB4OsjmjnR7GfKUZT\n\
-0cMvWJnjsC7DDlBwFET9rj4k40n96bbVCH9I7+tNhsoqzc6Eu+5h4sk7VfNGTM2Z\n\
-SyCd4GiSZRuA44rRbhXI7/LDpr4hY5J9ZDo5AM9ZyoLAoh774H3CZWD67S35XvUs\n\
-72dzE6uKG/vxBbvZ7eW2GLO6ewa9UxlnLVMPfJdpkp/xYXwwcPW2+2YXCge1ujxs\n\
-tjrOQJ5HUySh6DkE/kZpx8zwYWm9AaCrsvCIX1thsqgvKy+U5v1FS1L58eGc6s//\n\
-9yMgNhU29R0CAwEAAaOByTCBxjAMBgNVHRMEBTADAQH/MB0GA1UdDgQWBBRNVUJN\n\
-FzhJPReYT4QSx6dK53CXCTAfBgNVHSMEGDAWgBRNVUJNFzhJPReYT4QSx6dK53CX\n\
-CTAPBgNVHQ8BAf8EBQMDB/+AMGUGA1UdJQEB/wRbMFkGCCsGAQUFBwMBBggrBgEF\n\
-BQcDAgYIKwYBBQUHAwMGCCsGAQUFBwMEBggrBgEFBQcDCAYIKwYBBQUHAwkGCCsG\n\
-AQUFBwMNBggrBgEFBQcDDgYHKwYBBQIDBTANBgkqhkiG9w0BAQsFAAOCAQEAcOLF\n\
-ZYdJguj0uxeXB8v3xnUr1AWz9+gwg0URdfNLU2KvF2lsb/uznv6168b3/FcPgezN\n\
-Ihl9GqB+RvGwgXS/1UelCGbQiIUdsNxk246P4uOGPIyW32RoJcYPWZcpY+cw11tQ\n\
-NOnk994Y5/8ad1DmcxVLLqq5kwpXGWQufV1zOONq8B+mCvcVAmM4vkyF/de56Lwa\n\
-sAMpk1p77uhaDnuq2lIR4q3QHX2wGctFid5Q375DRscFQteY01r/dtwBBrMn0wuL\n\
-AMNx9ZGD+zAoOUaslpIlEQ+keAxk3jgGMWFMxF81YfhEnXzevSQXWpyek86XUyFL\n\
-O9IAQi5pa15gXjSbUg==\n\
------END CERTIFICATE-----";
-
-char *test_privatekey = "data:,-----BEGIN RSA PRIVATE KEY-----\n\
-MIIEowIBAAKCAQEA0Fb60RkFrDsRAIRfLMf2fsiRnw9Agp7yEbUsA4Zg4X+hRhBk\n\
-k78fFtagLisWo4LbT4DqKzqQXCvVnOn9a6uT0KsVejk2iaLoBy0fotQznudio3rz\n\
-DpTfzP9eRDFVj8RJnl3JJ8P1DULxH7N0TyDBuKZ1ibBfuKjPffqeCEzYKgAc8NG2\n\
-FB4m6mXzHhXuKw6W2v0IbHz6KYldsavf04rq7ztw0t67bexSQ4gLSVJEwiohAreg\n\
-m0dLvQnap5xd2qn0yETteTL8Y+Ujym1DWAnwDdwA6+0j2a0wkyzOzYQpZMt95NyZ\n\
-8kcoqEqO8KAN2HclqfjHlg9iDscbof5x45SQwwIDAQABAoIBAG0dYPeqd0IhHWJ7\n\
-8azufbchLMN1pX/D51xG2uptssfnpHuhkkufSZUYi4QipRS2ME6PYhWJ8pmTi6lH\n\
-E6cUkbI0KGd/F4U2gPdhNrR9Fxwea5bbifkVF7Gx/ZkRjZJiZ3w9+mCNTQbJDKhh\n\
-wITAzzT6WYznhvqbzzBX1fTa6kv0GAQtX7aHKM+XIwkhX2gzU5TU80bvH8aMrT05\n\
-tAMGQqkUeRnpo0yucBl4VmTZzd/+X/d2UyXR0my15jE5iH5o+p+E6qTRE9D+MGUd\n\
-MQ6Ftj0Untqy1lcog1ZLL6zPlnwcD4jgY5VCYDgvabnrSwymOJapPLsAEdWdq+U5\n\
-ec44BMECgYEA/+3qPUrd4XxA517qO3fCGBvf2Gkr7w5ZDeATOTHGuD8QZeK0nxPl\n\
-CWhRjdgkqo0fyf1cjczL5XgYayo+YxkO1Z4RUU+8lJAHlVx9izOQo+MTQfkwH4BK\n\
-LYlHxMoHJwAOXXoE+dmBaDh5xT0mDUGU750r763L6EFovE4qRBn9hxkCgYEA0GWz\n\
-rpOPNxb419WxG9npoQYdCZ5IbmEOGDH3ReggVzWHmW8sqtkqTZm5srcyDpqAc1Gu\n\
-paUveMblEBbU+NFJjLWOfwB5PCp8jsrqRgCQSxolShiVkc3Vu3oyzMus9PDge1eo\n\
-9mwVGO7ojQKWRu/WVAakENPaAjeyyhv4dqSNnjsCgYEAlwe8yszqoY1k8+U0T0G+\n\
-HeIdOCXgkmOiNCj+zyrLvaEhuS6PLq1b5TBVqGJcSPWdQ+MrglbQIKu9pUg5ptt7\n\
-wJ5WU+i9PeK9Ruxc/g/BFKYFkFJQjtZzb+nqm3wpul8zGwDN/O/ZiTqCyd3rHbmM\n\
-/dZ/viKPCZHIEBAEq0m3LskCgYBndzcAo+5k8ZjWwBfQth5SfhCIp/daJgGzbYtR\n\
-P/BenAsY2KOap3tjT8Fsw5usuHSxzIojX6H0Gvu7Qzq11mLn43Q+BeQrRQTWeFRc\n\
-MQdy4iZFZXNNEp7dF8yE9VKHwdgSJPGUdxD6chMvf2tRCN6mlS171VLV6wVvZvez\n\
-H/vX5QKBgD2Dq/NHpjCpAsECP9awmNF5Akn5WJbRGmegwXIih2mOtgtYYDeuQyxY\n\
-ZCrdJFfIUjUVPagshEmUklKhkYMYpzy2PQDVtaVcm6UNFroxT5h+J+KDs1LN1H8G\n\
-LsASrzyAg8EpRulwXEfLrWKiu9DKv8bMEgO4Ovgz8zTKJZIFhcac\n\
------END RSA PRIVATE KEY-----";
-
-
-DDS_Security_ValidationResult_t
-validate_local_identity(
-        dds_security_authentication *instance,
-        DDS_Security_IdentityHandle *local_identity_handle,
-        DDS_Security_GUID_t *adjusted_participant_guid,
-        const DDS_Security_DomainId domain_id,
-        const DDS_Security_Qos *participant_qos,
-        const DDS_Security_GUID_t *candidate_participant_guid,
-
-        DDS_Security_SecurityException *ex);
-DDS_Security_boolean
-get_identity_token(dds_security_authentication *instance,
-                   DDS_Security_IdentityToken *identity_token,
-                   const DDS_Security_IdentityHandle handle,
-                   DDS_Security_SecurityException *ex);
-DDS_Security_boolean
-set_permissions_credential_and_token(
-        dds_security_authentication *instance,
-        const DDS_Security_IdentityHandle handle,
-        const DDS_Security_PermissionsCredentialToken *permissions_credential,
-        const DDS_Security_PermissionsToken *permissions_token,
-        DDS_Security_SecurityException *ex);
-
-DDS_Security_ValidationResult_t
-validate_remote_identity(
-        dds_security_authentication *instance,
-        DDS_Security_IdentityHandle *remote_identity_handle,
-        DDS_Security_AuthRequestMessageToken *local_auth_request_token,
-        const DDS_Security_AuthRequestMessageToken *remote_auth_request_token,
-        const DDS_Security_IdentityHandle local_identity_handle,
-        const DDS_Security_IdentityToken *remote_identity_token,
-        const DDS_Security_GUID_t *remote_participant_guid,
-        DDS_Security_SecurityException *ex);
-
-DDS_Security_ValidationResult_t
-begin_handshake_request(
-        dds_security_authentication *instance,
-        DDS_Security_HandshakeHandle *handshake_handle,
-        DDS_Security_HandshakeMessageToken *handshake_message,
-        const DDS_Security_IdentityHandle initiator_identity_handle,
-        const DDS_Security_IdentityHandle replier_identity_handle,
-        const DDS_Security_OctetSeq *serialized_local_participant_data,
-        DDS_Security_SecurityException *ex);
-
-DDS_Security_ValidationResult_t
-begin_handshake_reply(
-        dds_security_authentication *instance,
-        DDS_Security_HandshakeHandle *handshake_handle,
-        DDS_Security_HandshakeMessageToken *handshake_message_out,
-        const DDS_Security_HandshakeMessageToken *handshake_message_in,
-        const DDS_Security_IdentityHandle initiator_identity_handle,
-        const DDS_Security_IdentityHandle replier_identity_handle,
-        const DDS_Security_OctetSeq *serialized_local_participant_data,
-        DDS_Security_SecurityException *ex);
-
-DDS_Security_ValidationResult_t
-process_handshake(
-        dds_security_authentication *instance,
-        DDS_Security_HandshakeMessageToken *handshake_message_out,
-        const DDS_Security_HandshakeMessageToken *handshake_message_in,
-        const DDS_Security_HandshakeHandle handshake_handle,
-        DDS_Security_SecurityException *ex);
-
-DDS_Security_SharedSecretHandle get_shared_secret(
-        dds_security_authentication *instance,
-        const DDS_Security_HandshakeHandle handshake_handle,
-        DDS_Security_SecurityException *ex);
-
-DDS_Security_boolean
-get_authenticated_peer_credential_token(
-        dds_security_authentication *instance,
-        DDS_Security_AuthenticatedPeerCredentialToken *peer_credential_token,
-        const DDS_Security_HandshakeHandle handshake_handle,
-        DDS_Security_SecurityException *ex);
-
-
-DDS_Security_boolean get_identity_status_token(
-        dds_security_authentication *instance,
-        DDS_Security_IdentityStatusToken *identity_status_token,
-        const DDS_Security_IdentityHandle handle,
-        DDS_Security_SecurityException *ex);
-
-DDS_Security_boolean set_listener(dds_security_authentication *instance,
-                                  const dds_security_authentication_listener *listener,
-                                  DDS_Security_SecurityException *ex);
-
-DDS_Security_boolean return_identity_token(dds_security_authentication *instance,
-                                           const DDS_Security_IdentityToken *token,
-                                           DDS_Security_SecurityException *ex);
-
-DDS_Security_boolean return_identity_status_token(
-        dds_security_authentication *instance,
-        const DDS_Security_IdentityStatusToken *token,
-        DDS_Security_SecurityException *ex);
-
-DDS_Security_boolean return_authenticated_peer_credential_token(
-        dds_security_authentication *instance,
-        const DDS_Security_AuthenticatedPeerCredentialToken *peer_credential_token,
-        DDS_Security_SecurityException *ex);
-
-DDS_Security_boolean
-return_handshake_handle(dds_security_authentication *instance,
-                        const DDS_Security_HandshakeHandle handshake_handle,
-                        DDS_Security_SecurityException *ex);
-DDS_Security_boolean
-return_identity_handle(
-        dds_security_authentication *instance,
-        const DDS_Security_IdentityHandle identity_handle,
-        DDS_Security_SecurityException *ex);
-
-DDS_Security_boolean return_sharedsecret_handle(
-        dds_security_authentication *instance,
-        const DDS_Security_SharedSecretHandle sharedsecret_handle,
-        DDS_Security_SecurityException *ex);
-
-
-
-#endif /* SECURITY_BUILTIN_PLUGINS_AUTHENTICATION_H_ */
diff --git a/src/security/core/tests/plugin_loading/plugin_mock/cryptography_all_ok/mock_cryptography.c b/src/security/core/tests/plugin_loading/plugin_mock/cryptography_all_ok/mock_cryptography.c
deleted file mode 100644
index 7f664bf..0000000
--- a/src/security/core/tests/plugin_loading/plugin_mock/cryptography_all_ok/mock_cryptography.c
+++ /dev/null
@@ -1,667 +0,0 @@
-/*
- * Copyright(c) 2006 to 2019 ADLINK Technology Limited and others
- *
- * This program and the accompanying materials are made available under the
- * terms of the Eclipse Public License v. 2.0 which is available at
- * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
- * v. 1.0 which is available at
- * http://www.eclipse.org/org/documents/edl-v10.php.
- *
- * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
- */
-
-#include "dds/security/dds_security_api.h"
-#include "dds/ddsrt/heap.h"
-#include "dds/ddsrt/misc.h"
-#include <stdio.h>
-#include <string.h>
-#include <stdbool.h>
-#include "mock_cryptography.h"
-/**
- * Implementation structure for storing encapsulated members of the instance
- * while giving only the interface definition to user
- */
-
-typedef struct dds_security_cryptography_impl {
-  dds_security_cryptography base;
-  int member;
-} dds_security_cryptography_impl;
-
-
-dds_security_crypto_key_exchange* dds_security_crypto_key_exchange__alloc(void);
-void dds_security_crypto_key_exchange__dealloc(
-    dds_security_crypto_key_exchange* instance);
-
-dds_security_crypto_key_factory* dds_security_crypto_key_factory__alloc(void);
-void dds_security_crypto_key_factory__dealloc(
-    dds_security_crypto_key_factory* instance);
-
-/**
- * CryptoTransform Interface
- */
-
-/*
- * Allocation function for implementer structure (with internal variables) transparently.
- *
- */
-
-dds_security_crypto_transform* dds_security_crypto_transform__alloc(void);
-void dds_security_crypto_transform__dealloc(
-    dds_security_crypto_transform* instance);
-
-
-int32_t init_crypto(  const char *argument, void **context)
-{
-
-  dds_security_cryptography_impl *cryptography;
-
-  dds_security_crypto_key_exchange *crypto_key_exchange;
-  dds_security_crypto_key_factory *crypto_key_factory;
-  dds_security_crypto_transform *crypto_transform;
-
-
-  DDSRT_UNUSED_ARG(argument);
-
-  //allocate new instance
-  cryptography = (dds_security_cryptography_impl*) ddsrt_malloc(
-      sizeof(dds_security_cryptography_impl));
-
-  //assign the sub components
-  crypto_key_exchange = dds_security_crypto_key_exchange__alloc();
-  crypto_key_factory = dds_security_crypto_key_factory__alloc();
-  crypto_transform = dds_security_crypto_transform__alloc();
-
-
-  cryptography->base.crypto_key_exchange = crypto_key_exchange;
-  cryptography->base.crypto_key_factory = crypto_key_factory;
-  cryptography->base.crypto_transform = crypto_transform;
-
-  //return the instance
-  *context = cryptography;
-  return 0;
-}
-
-int32_t finalize_crypto( void *instance)
-{
-
-  dds_security_cryptography_impl* instance_impl =
-      (dds_security_cryptography_impl*) instance;
-
-  //deallocate components
-  dds_security_crypto_key_exchange__dealloc(
-      instance_impl->base.crypto_key_exchange);
-  dds_security_crypto_key_factory__dealloc(
-      instance_impl->base.crypto_key_factory);
-  dds_security_crypto_transform__dealloc(instance_impl->base.crypto_transform);
-  //deallocate cryptography
-  ddsrt_free(instance_impl);
-
-  return 0;
-}
-
-
-
-
-
-
-/**
- * Implementation structure for storing encapsulated members of the instance
- * while giving only the interface definition to user
- */
-
-typedef struct dds_security_crypto_key_exchange_impl {
-  dds_security_crypto_key_exchange base;
-  int member;
-} dds_security_crypto_key_exchange_impl;
-
-/**
- * Function implementations
- */
-static DDS_Security_boolean create_local_participant_crypto_tokens(
-     dds_security_crypto_key_exchange *instance,
-    DDS_Security_ParticipantCryptoTokenSeq *local_participant_crypto_tokens,
-     const DDS_Security_ParticipantCryptoHandle local_participant_crypto,
-     const DDS_Security_ParticipantCryptoHandle remote_participant_crypto,
-    DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(instance);
-  DDSRT_UNUSED_ARG(local_participant_crypto_tokens);
-  DDSRT_UNUSED_ARG(local_participant_crypto);
-  DDSRT_UNUSED_ARG(remote_participant_crypto);
-  DDSRT_UNUSED_ARG(ex);
-  return true;
-
-}
-
-static DDS_Security_boolean set_remote_participant_crypto_tokens(
-     dds_security_crypto_key_exchange *instance,
-     const DDS_Security_ParticipantCryptoHandle local_participant_crypto,
-     const DDS_Security_ParticipantCryptoHandle remote_participant_crypto,
-     const DDS_Security_ParticipantCryptoTokenSeq *remote_participant_tokens,
-    DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(instance);
-  DDSRT_UNUSED_ARG(local_participant_crypto);
-  DDSRT_UNUSED_ARG(remote_participant_crypto);
-  DDSRT_UNUSED_ARG(remote_participant_tokens);
-  DDSRT_UNUSED_ARG(ex);
-
-  return true;
-}
-
-static DDS_Security_boolean create_local_datawriter_crypto_tokens(
-     dds_security_crypto_key_exchange *instance,
-    DDS_Security_DatawriterCryptoTokenSeq *local_datawriter_crypto_tokens,
-     const DDS_Security_DatawriterCryptoHandle local_datawriter_crypto,
-     const DDS_Security_DatareaderCryptoHandle remote_datareader_crypto,
-    DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(instance);
-  DDSRT_UNUSED_ARG(local_datawriter_crypto_tokens);
-  DDSRT_UNUSED_ARG(local_datawriter_crypto);
-  DDSRT_UNUSED_ARG(remote_datareader_crypto);
-  DDSRT_UNUSED_ARG(ex);
-
-  return true;
-}
-
-static DDS_Security_boolean set_remote_datawriter_crypto_tokens(
-     dds_security_crypto_key_exchange *instance,
-     const DDS_Security_DatareaderCryptoHandle local_datareader_crypto,
-     const DDS_Security_DatawriterCryptoHandle remote_datawriter_crypto,
-     const DDS_Security_DatawriterCryptoTokenSeq *remote_datawriter_tokens,
-    DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(instance);
-  DDSRT_UNUSED_ARG(local_datareader_crypto);
-  DDSRT_UNUSED_ARG(remote_datawriter_crypto);
-  DDSRT_UNUSED_ARG(remote_datawriter_tokens);
-  DDSRT_UNUSED_ARG(ex);
-
-  return true;
-}
-
-static DDS_Security_boolean create_local_datareader_crypto_tokens(
-     dds_security_crypto_key_exchange *instance,
-    DDS_Security_DatareaderCryptoTokenSeq *local_datareader_cryto_tokens,
-     const DDS_Security_DatareaderCryptoHandle local_datareader_crypto,
-     const DDS_Security_DatawriterCryptoHandle remote_datawriter_crypto,
-    DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(instance);
-  DDSRT_UNUSED_ARG(local_datareader_cryto_tokens);
-  DDSRT_UNUSED_ARG(local_datareader_crypto);
-  DDSRT_UNUSED_ARG(remote_datawriter_crypto);
-  DDSRT_UNUSED_ARG(ex);
-
-  return true;
-}
-
-static DDS_Security_boolean set_remote_datareader_crypto_tokens(
-     dds_security_crypto_key_exchange *instance,
-     const DDS_Security_DatawriterCryptoHandle local_datawriter_crypto,
-     const DDS_Security_DatareaderCryptoHandle remote_datareader_crypto,
-     const DDS_Security_DatareaderCryptoTokenSeq *remote_datareader_tokens,
-    DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(instance);
-  DDSRT_UNUSED_ARG(local_datawriter_crypto);
-  DDSRT_UNUSED_ARG(remote_datareader_crypto);
-  DDSRT_UNUSED_ARG(remote_datareader_tokens);
-  DDSRT_UNUSED_ARG(ex);
-
-  return true;
-}
-
-static DDS_Security_boolean return_crypto_tokens(
-     dds_security_crypto_key_exchange *instance,
-     DDS_Security_CryptoTokenSeq *crypto_tokens,
-    DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(instance);
-  DDSRT_UNUSED_ARG(crypto_tokens);
-  DDSRT_UNUSED_ARG(ex);
-
-  return true;
-}
-
-dds_security_crypto_key_exchange* dds_security_crypto_key_exchange__alloc(void)
-{
-  dds_security_crypto_key_exchange_impl *instance;
-  instance = (dds_security_crypto_key_exchange_impl*) ddsrt_malloc(
-      sizeof(dds_security_crypto_key_exchange_impl));
-
-  instance->base.create_local_participant_crypto_tokens =
-      &create_local_participant_crypto_tokens;
-
-  instance->base.set_remote_participant_crypto_tokens =
-      &set_remote_participant_crypto_tokens;
-
-  instance->base.create_local_datawriter_crypto_tokens =
-      &create_local_datawriter_crypto_tokens;
-
-  instance->base.set_remote_datawriter_crypto_tokens =
-      &set_remote_datawriter_crypto_tokens;
-
-  instance->base.create_local_datareader_crypto_tokens =
-      &create_local_datareader_crypto_tokens;
-
-  instance->base.set_remote_datareader_crypto_tokens =
-      &set_remote_datareader_crypto_tokens;
-
-  instance->base.return_crypto_tokens = &return_crypto_tokens;
-
-  return (dds_security_crypto_key_exchange*) instance;
-}
-
-void dds_security_crypto_key_exchange__dealloc(
-    dds_security_crypto_key_exchange* instance)
-{
-
-  ddsrt_free((dds_security_crypto_key_exchange_impl*) instance);
-}
-
-
-
-/**
- * Implementation structure for storing encapsulated members of the instance
- * while giving only the interface definition to user
- */
-
-typedef struct dds_security_crypto_key_factory_impl {
-  dds_security_crypto_key_factory base;
-  int member;
-} dds_security_crypto_key_factory_impl;
-
-/**
- * Function implementations
- */
-
-static DDS_Security_ParticipantCryptoHandle register_local_participant(
-     dds_security_crypto_key_factory *instance,
-     const DDS_Security_IdentityHandle participant_identity,
-     const DDS_Security_PermissionsHandle participant_permissions,
-     const DDS_Security_PropertySeq *participant_properties,
-     const DDS_Security_ParticipantSecurityAttributes *participant_security_attributes,
-    DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(instance);
-  DDSRT_UNUSED_ARG(participant_identity);
-  DDSRT_UNUSED_ARG(participant_permissions);
-  DDSRT_UNUSED_ARG(participant_properties);
-  DDSRT_UNUSED_ARG(participant_security_attributes);
-  DDSRT_UNUSED_ARG(ex);
-  return 0;
-}
-
-static DDS_Security_ParticipantCryptoHandle register_matched_remote_participant(
-     dds_security_crypto_key_factory *instance,
-     const DDS_Security_ParticipantCryptoHandle local_participant_crypto_handle,
-     const DDS_Security_IdentityHandle remote_participant_identity,
-     const DDS_Security_PermissionsHandle remote_participant_permissions,
-     const DDS_Security_SharedSecretHandle shared_secret,
-    DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(instance);
-  DDSRT_UNUSED_ARG(local_participant_crypto_handle);
-  DDSRT_UNUSED_ARG(remote_participant_identity);
-  DDSRT_UNUSED_ARG(remote_participant_permissions);
-  DDSRT_UNUSED_ARG(shared_secret);
-  DDSRT_UNUSED_ARG(ex);
-  return 0;
-}
-
-static DDS_Security_DatawriterCryptoHandle register_local_datawriter(
-     dds_security_crypto_key_factory *instance,
-     const DDS_Security_ParticipantCryptoHandle participant_crypto,
-     const DDS_Security_PropertySeq *datawriter_properties,
-     const DDS_Security_EndpointSecurityAttributes *datawriter_security_attributes,
-    DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(instance);
-  DDSRT_UNUSED_ARG(participant_crypto);
-  DDSRT_UNUSED_ARG(datawriter_properties);
-  DDSRT_UNUSED_ARG(datawriter_security_attributes);
-  DDSRT_UNUSED_ARG(ex);
-  return 0;
-}
-
-static DDS_Security_DatareaderCryptoHandle register_matched_remote_datareader(
-     dds_security_crypto_key_factory *instance,
-     const DDS_Security_DatawriterCryptoHandle local_datawritert_crypto_handle,
-     const DDS_Security_ParticipantCryptoHandle remote_participant_crypto,
-     const DDS_Security_SharedSecretHandle shared_secret,
-     const DDS_Security_boolean relay_only,
-    DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(instance);
-  DDSRT_UNUSED_ARG(local_datawritert_crypto_handle);
-  DDSRT_UNUSED_ARG(remote_participant_crypto);
-  DDSRT_UNUSED_ARG(shared_secret);
-  DDSRT_UNUSED_ARG(relay_only);
-  DDSRT_UNUSED_ARG(ex);
-  return 0;
-}
-
-static DDS_Security_DatareaderCryptoHandle register_local_datareader(
-     dds_security_crypto_key_factory *instance,
-     const DDS_Security_ParticipantCryptoHandle participant_crypto,
-     const DDS_Security_PropertySeq *datareader_properties,
-     const DDS_Security_EndpointSecurityAttributes *datareader_security_attributes,
-    DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(instance);
-  DDSRT_UNUSED_ARG(participant_crypto);
-  DDSRT_UNUSED_ARG(datareader_properties);
-  DDSRT_UNUSED_ARG(datareader_security_attributes);
-  DDSRT_UNUSED_ARG(ex);
-
-  return 0;
-}
-
-static DDS_Security_DatawriterCryptoHandle register_matched_remote_datawriter(
-     dds_security_crypto_key_factory *instance,
-     const DDS_Security_DatareaderCryptoHandle local_datareader_crypto_handle,
-     const DDS_Security_ParticipantCryptoHandle remote_participant_crypt,
-     const DDS_Security_SharedSecretHandle shared_secret,
-    DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(instance);
-  DDSRT_UNUSED_ARG(local_datareader_crypto_handle);
-  DDSRT_UNUSED_ARG(remote_participant_crypt);
-  DDSRT_UNUSED_ARG(shared_secret);
-  DDSRT_UNUSED_ARG(ex);
-  return true;
-}
-
-static DDS_Security_boolean unregister_participant(
-     dds_security_crypto_key_factory *instance,
-     const DDS_Security_ParticipantCryptoHandle participant_crypto_handle,
-    DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(instance);
-  DDSRT_UNUSED_ARG(participant_crypto_handle);
-  DDSRT_UNUSED_ARG(ex);
-  return true;
-}
-
-static DDS_Security_boolean unregister_datawriter(
-     dds_security_crypto_key_factory *instance,
-     const DDS_Security_DatawriterCryptoHandle datawriter_crypto_handle,
-    DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(instance);
-  DDSRT_UNUSED_ARG(datawriter_crypto_handle);
-  DDSRT_UNUSED_ARG(ex);
-  return true;
-}
-
-static DDS_Security_boolean unregister_datareader(
-     dds_security_crypto_key_factory *instance,
-     const DDS_Security_DatareaderCryptoHandle datareader_crypto_handle,
-    DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(instance);
-  DDSRT_UNUSED_ARG(datareader_crypto_handle);
-  DDSRT_UNUSED_ARG(ex);
-  return true;
-}
-
-dds_security_crypto_key_factory* dds_security_crypto_key_factory__alloc(void)
-{
-  dds_security_crypto_key_factory_impl *instance;
-  instance = (dds_security_crypto_key_factory_impl*) ddsrt_malloc(
-      sizeof(dds_security_crypto_key_factory_impl));
-
-  instance->base.register_local_participant = &register_local_participant;
-
-  instance->base.register_matched_remote_participant =
-      &register_matched_remote_participant;
-
-  instance->base.register_local_datawriter = &register_local_datawriter;
-
-  instance->base.register_matched_remote_datareader =
-      &register_matched_remote_datareader;
-
-  instance->base.register_local_datareader = &register_local_datareader;
-
-  instance->base.register_matched_remote_datawriter =
-      &register_matched_remote_datawriter;
-
-  instance->base.unregister_participant = &unregister_participant;
-
-  instance->base.unregister_datawriter = &unregister_datawriter;
-
-  instance->base.unregister_datareader = &unregister_datareader;
-
-  return (dds_security_crypto_key_factory*) instance;
-}
-
-void dds_security_crypto_key_factory__dealloc(
-    dds_security_crypto_key_factory* instance)
-{
-
-  ddsrt_free((dds_security_crypto_key_factory_impl*) instance);
-}
-
-
-
-/**
- * Implementation structure for storing encapsulated members of the instance
- * while giving only the interface definition to user
- */
-
-typedef struct dds_security_crypto_transform_impl {
-  dds_security_crypto_transform base;
-  int member;
-} dds_security_crypto_transform_impl;
-
-/**
- * Function implementations
- */
-static DDS_Security_boolean encode_serialized_payload(
-     dds_security_crypto_transform *instance,
-    DDS_Security_OctetSeq *encoded_buffer,
-    DDS_Security_OctetSeq *extra_inline_qos,
-     const DDS_Security_OctetSeq *plain_buffer,
-     const DDS_Security_DatawriterCryptoHandle sending_datawriter_crypto,
-    DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(instance);
-  DDSRT_UNUSED_ARG(encoded_buffer);
-  DDSRT_UNUSED_ARG(extra_inline_qos);
-  DDSRT_UNUSED_ARG(plain_buffer);
-  DDSRT_UNUSED_ARG(sending_datawriter_crypto);
-  DDSRT_UNUSED_ARG(ex);
-
-  return true;
-}
-
-static DDS_Security_boolean encode_datawriter_submessage(
-     dds_security_crypto_transform *instance,
-    DDS_Security_OctetSeq *encoded_rtps_submessage,
-     const DDS_Security_OctetSeq *plain_rtps_submessage,
-     const DDS_Security_DatawriterCryptoHandle sending_datawriter_crypto,
-     const DDS_Security_DatareaderCryptoHandleSeq *receiving_datareader_crypto_list,
-    int32_t *receiving_datareader_crypto_list_index,
-    DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(instance);
-  DDSRT_UNUSED_ARG(encoded_rtps_submessage);
-  DDSRT_UNUSED_ARG(plain_rtps_submessage);
-  DDSRT_UNUSED_ARG(sending_datawriter_crypto);
-  DDSRT_UNUSED_ARG(receiving_datareader_crypto_list);
-  DDSRT_UNUSED_ARG(receiving_datareader_crypto_list_index);
-  DDSRT_UNUSED_ARG(ex);
-
-  return true;
-}
-
-static DDS_Security_boolean encode_datareader_submessage(
-     dds_security_crypto_transform *instance,
-    DDS_Security_OctetSeq *encoded_rtps_submessage,
-     const DDS_Security_OctetSeq *plain_rtps_submessage,
-     const DDS_Security_DatareaderCryptoHandle sending_datareader_crypto,
-     const DDS_Security_DatawriterCryptoHandleSeq *receiving_datawriter_crypto_list,
-    DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(instance);
-  DDSRT_UNUSED_ARG(encoded_rtps_submessage);
-  DDSRT_UNUSED_ARG(plain_rtps_submessage);
-  DDSRT_UNUSED_ARG(sending_datareader_crypto);
-  DDSRT_UNUSED_ARG(receiving_datawriter_crypto_list);
-  DDSRT_UNUSED_ARG(ex);
-
-  return true;
-}
-
-static DDS_Security_boolean encode_rtps_message(  dds_security_crypto_transform *instance,
-    DDS_Security_OctetSeq *encoded_rtps_message,
-     const DDS_Security_OctetSeq *plain_rtps_message,
-     const DDS_Security_ParticipantCryptoHandle sending_participant_crypto,
-     const DDS_Security_ParticipantCryptoHandleSeq *receiving_participant_crypto_list,
-    int32_t *receiving_participant_crypto_list_index,
-    DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(instance);
-  DDSRT_UNUSED_ARG(encoded_rtps_message);
-  DDSRT_UNUSED_ARG(plain_rtps_message);
-  DDSRT_UNUSED_ARG(sending_participant_crypto);
-  DDSRT_UNUSED_ARG(receiving_participant_crypto_list);
-  DDSRT_UNUSED_ARG(receiving_participant_crypto_list_index);
-  DDSRT_UNUSED_ARG(ex);
-
-  return true;
-}
-
-static DDS_Security_boolean decode_rtps_message(  dds_security_crypto_transform *instance,
-    DDS_Security_OctetSeq *plain_buffer,  const DDS_Security_OctetSeq *encoded_buffer,
-     const DDS_Security_ParticipantCryptoHandle receiving_participant_crypto,
-     const DDS_Security_ParticipantCryptoHandle sending_participant_crypto,
-    DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(instance);
-  DDSRT_UNUSED_ARG(plain_buffer);
-  DDSRT_UNUSED_ARG(encoded_buffer);
-  DDSRT_UNUSED_ARG(receiving_participant_crypto);
-  DDSRT_UNUSED_ARG(sending_participant_crypto);
-  DDSRT_UNUSED_ARG(ex);
-
-  return true;
-}
-
-
-static DDS_Security_boolean preprocess_secure_submsg(
-     dds_security_crypto_transform *instance,
-    DDS_Security_DatawriterCryptoHandle *datawriter_crypto,
-    DDS_Security_DatareaderCryptoHandle *datareader_crypto,
-    DDS_Security_SecureSubmessageCategory_t *secure_submessage_category,
-     const DDS_Security_OctetSeq *encoded_rtps_submessage,
-     const DDS_Security_ParticipantCryptoHandle receiving_participant_crypto,
-     const DDS_Security_ParticipantCryptoHandle sending_participant_crypto,
-    DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(instance);
-  DDSRT_UNUSED_ARG(datawriter_crypto);
-  DDSRT_UNUSED_ARG(datareader_crypto);
-  DDSRT_UNUSED_ARG(secure_submessage_category);
-  DDSRT_UNUSED_ARG(encoded_rtps_submessage);
-  DDSRT_UNUSED_ARG(receiving_participant_crypto);
-  DDSRT_UNUSED_ARG(sending_participant_crypto);
-  DDSRT_UNUSED_ARG(ex);
-
-  return true;
-}
-
-static DDS_Security_boolean decode_datawriter_submessage(
-     dds_security_crypto_transform *instance,
-    DDS_Security_OctetSeq *plain_rtps_submessage,
-     const DDS_Security_OctetSeq *encoded_rtps_submessage,
-     const DDS_Security_DatareaderCryptoHandle receiving_datareader_crypto,
-     const DDS_Security_DatawriterCryptoHandle sending_datawriter_crypto,
-    DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(instance);
-  DDSRT_UNUSED_ARG(plain_rtps_submessage);
-  DDSRT_UNUSED_ARG(encoded_rtps_submessage);
-  DDSRT_UNUSED_ARG(receiving_datareader_crypto);
-  DDSRT_UNUSED_ARG(sending_datawriter_crypto);
-  DDSRT_UNUSED_ARG(ex);
-
-  return true;
-}
-
-static DDS_Security_boolean decode_datareader_submessage(
-     dds_security_crypto_transform *instance,
-    DDS_Security_OctetSeq *plain_rtps_message,
-     const DDS_Security_OctetSeq *encoded_rtps_message,
-     const DDS_Security_DatawriterCryptoHandle receiving_datawriter_crypto,
-     const DDS_Security_DatareaderCryptoHandle sending_datareader_crypto,
-    DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(instance);
-  DDSRT_UNUSED_ARG(plain_rtps_message);
-  DDSRT_UNUSED_ARG(encoded_rtps_message);
-  DDSRT_UNUSED_ARG(receiving_datawriter_crypto);
-  DDSRT_UNUSED_ARG(sending_datareader_crypto);
-  DDSRT_UNUSED_ARG(ex);
-
-  return true;
-}
-
-static DDS_Security_boolean decode_serialized_payload(
-     dds_security_crypto_transform *instance,
-    DDS_Security_OctetSeq *plain_buffer,  const DDS_Security_OctetSeq *encoded_buffer,
-     const DDS_Security_OctetSeq *inline_qos,
-     const DDS_Security_DatareaderCryptoHandle receiving_datareader_crypto,
-     const DDS_Security_DatawriterCryptoHandle sending_datawriter_crypto,
-    DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(instance);
-  DDSRT_UNUSED_ARG(plain_buffer);
-  DDSRT_UNUSED_ARG(encoded_buffer);
-  DDSRT_UNUSED_ARG(inline_qos);
-  DDSRT_UNUSED_ARG(receiving_datareader_crypto);
-  DDSRT_UNUSED_ARG(sending_datawriter_crypto);
-  DDSRT_UNUSED_ARG(ex);
-
-  return true;
-}
-
-dds_security_crypto_transform* dds_security_crypto_transform__alloc(void)
-{
-  dds_security_crypto_transform_impl *instance;
-  instance = (dds_security_crypto_transform_impl*) ddsrt_malloc(
-      sizeof(dds_security_crypto_transform_impl));
-
-  memset( instance, 0, sizeof(dds_security_crypto_transform_impl));
-
-  instance->base.encode_datawriter_submessage = &encode_datawriter_submessage;
-
-  instance->base.encode_datareader_submessage = &encode_datareader_submessage;
-
-  instance->base.encode_rtps_message = &encode_rtps_message;
-
-  instance->base.decode_rtps_message = &decode_rtps_message;
-
-  instance->base.preprocess_secure_submsg = &preprocess_secure_submsg;
-
-  instance->base.decode_datawriter_submessage = &decode_datawriter_submessage;
-
-  instance->base.decode_datareader_submessage = &decode_datareader_submessage;
-
-  instance->base.decode_serialized_payload = &decode_serialized_payload;
-
-  instance->base.encode_serialized_payload = &encode_serialized_payload;
-
-  return (dds_security_crypto_transform*) instance;
-}
-
-void dds_security_crypto_transform__dealloc(
-    dds_security_crypto_transform* instance)
-{
-
-  ddsrt_free((dds_security_crypto_transform_impl*) instance);
-}
-
-
diff --git a/src/security/core/tests/plugin_loading/plugin_mock/cryptography_all_ok/mock_cryptography.h b/src/security/core/tests/plugin_loading/plugin_mock/cryptography_all_ok/mock_cryptography.h
deleted file mode 100644
index e532a94..0000000
--- a/src/security/core/tests/plugin_loading/plugin_mock/cryptography_all_ok/mock_cryptography.h
+++ /dev/null
@@ -1,21 +0,0 @@
-/*
- * authentication.h
- *
- *  Created on: Jan 15, 2018
- *      Author: kurtulus oksuztepe
- */
-
-#ifndef SECURITY_CRYPTO_OK_H_
-#define SECURITY_CRYPTO_OK_H_
-
-#include "dds/security/cryptography_all_ok_export.h"
-#include "dds/security/dds_security_api.h"
-
-SECURITY_EXPORT int32_t
-init_crypto(const char *argument, void **context);
-
-SECURITY_EXPORT int32_t
-finalize_crypto(void *context);
-
-
-#endif /* SECURITY_CRYPTO_OK_H_ */
diff --git a/src/security/core/tests/plugin_loading/plugin_mock/cryptography_missing_function/mock_cryptography.c b/src/security/core/tests/plugin_loading/plugin_mock/cryptography_missing_function/mock_cryptography.c
deleted file mode 100644
index 3a72441..0000000
--- a/src/security/core/tests/plugin_loading/plugin_mock/cryptography_missing_function/mock_cryptography.c
+++ /dev/null
@@ -1,656 +0,0 @@
-/*
- * Copyright(c) 2006 to 2019 ADLINK Technology Limited and others
- *
- * This program and the accompanying materials are made available under the
- * terms of the Eclipse Public License v. 2.0 which is available at
- * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
- * v. 1.0 which is available at
- * http://www.eclipse.org/org/documents/edl-v10.php.
- *
- * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
- */
-
-#include "dds/security/dds_security_api.h"
-#include "dds/ddsrt/heap.h"
-#include "dds/ddsrt/misc.h"
-#include <stdio.h>
-#include <string.h>
-#include <stdbool.h>
-#include "mock_cryptography.h"
-/**
- * Implementation structure for storing encapsulated members of the instance
- * while giving only the interface definition to user
- */
-
-typedef struct dds_security_cryptography_impl {
-  dds_security_cryptography base;
-  int member;
-} dds_security_cryptography_impl;
-
-
-dds_security_crypto_key_exchange* dds_security_crypto_key_exchange__alloc(void);
-void dds_security_crypto_key_exchange__dealloc(
-    dds_security_crypto_key_exchange* instance);
-
-dds_security_crypto_key_factory* dds_security_crypto_key_factory__alloc(void);
-void dds_security_crypto_key_factory__dealloc(
-    dds_security_crypto_key_factory* instance);
-
-/**
- * CryptoTransform Interface
- */
-
-/*
- * Allocation function for implementer structure (with internal variables) transparently.
- *
- */
-
-dds_security_crypto_transform* dds_security_crypto_transform__alloc(void);
-void dds_security_crypto_transform__dealloc(
-    dds_security_crypto_transform* instance);
-
-
-int32_t init_crypto(  const char *argument, void **context)
-{
-
-  dds_security_cryptography_impl *cryptography;
-
-  dds_security_crypto_key_exchange *crypto_key_exchange;
-  dds_security_crypto_key_factory *crypto_key_factory;
-  dds_security_crypto_transform *crypto_transform;
-
-
-  DDSRT_UNUSED_ARG(argument);
-
-  //allocate new instance
-  cryptography = (dds_security_cryptography_impl*) ddsrt_malloc(
-      sizeof(dds_security_cryptography_impl));
-
-  memset( cryptography, 0, sizeof(dds_security_cryptography_impl));
-  //assign the sub components
-  crypto_key_exchange = dds_security_crypto_key_exchange__alloc();
-  crypto_key_factory = dds_security_crypto_key_factory__alloc();
-  crypto_transform = dds_security_crypto_transform__alloc();
-
-
-  cryptography->base.crypto_key_exchange = crypto_key_exchange;
-  cryptography->base.crypto_key_factory = crypto_key_factory;
-  cryptography->base.crypto_transform = crypto_transform;
-
-  //return the instance
-  *context = cryptography;
-  return 0;
-}
-
-int32_t finalize_crypto( void *instance)
-{
-
-  dds_security_cryptography_impl* instance_impl =
-      (dds_security_cryptography_impl*) instance;
-
-  //deallocate components
-  dds_security_crypto_key_exchange__dealloc(
-      instance_impl->base.crypto_key_exchange);
-  dds_security_crypto_key_factory__dealloc(
-      instance_impl->base.crypto_key_factory);
-  dds_security_crypto_transform__dealloc(instance_impl->base.crypto_transform);
-  //deallocate cryptography
-  ddsrt_free(instance_impl);
-
-  return 0;
-}
-
-
-
-
-
-
-/**
- * Implementation structure for storing encapsulated members of the instance
- * while giving only the interface definition to user
- */
-
-typedef struct dds_security_crypto_key_exchange_impl {
-  dds_security_crypto_key_exchange base;
-  int member;
-} dds_security_crypto_key_exchange_impl;
-
-/**
- * Function implementations
- */
-static DDS_Security_boolean create_local_participant_crypto_tokens(
-     dds_security_crypto_key_exchange *instance,
-    DDS_Security_ParticipantCryptoTokenSeq *local_participant_crypto_tokens,
-     const DDS_Security_ParticipantCryptoHandle local_participant_crypto,
-     const DDS_Security_ParticipantCryptoHandle remote_participant_crypto,
-    DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(instance);
-  DDSRT_UNUSED_ARG(local_participant_crypto_tokens);
-  DDSRT_UNUSED_ARG(local_participant_crypto);
-  DDSRT_UNUSED_ARG(remote_participant_crypto);
-  DDSRT_UNUSED_ARG(ex);
-  return true;
-
-}
-
-static DDS_Security_boolean create_local_datawriter_crypto_tokens(
-     dds_security_crypto_key_exchange *instance,
-    DDS_Security_DatawriterCryptoTokenSeq *local_datawriter_crypto_tokens,
-     const DDS_Security_DatawriterCryptoHandle local_datawriter_crypto,
-     const DDS_Security_DatareaderCryptoHandle remote_datareader_crypto,
-    DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(instance);
-  DDSRT_UNUSED_ARG(local_datawriter_crypto_tokens);
-  DDSRT_UNUSED_ARG(local_datawriter_crypto);
-  DDSRT_UNUSED_ARG(remote_datareader_crypto);
-  DDSRT_UNUSED_ARG(ex);
-
-  return true;
-}
-
-static DDS_Security_boolean set_remote_datawriter_crypto_tokens(
-     dds_security_crypto_key_exchange *instance,
-     const DDS_Security_DatareaderCryptoHandle local_datareader_crypto,
-     const DDS_Security_DatawriterCryptoHandle remote_datawriter_crypto,
-     const DDS_Security_DatawriterCryptoTokenSeq *remote_datawriter_tokens,
-    DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(instance);
-  DDSRT_UNUSED_ARG(local_datareader_crypto);
-  DDSRT_UNUSED_ARG(remote_datawriter_crypto);
-  DDSRT_UNUSED_ARG(remote_datawriter_tokens);
-  DDSRT_UNUSED_ARG(ex);
-
-  return true;
-}
-
-static DDS_Security_boolean create_local_datareader_crypto_tokens(
-     dds_security_crypto_key_exchange *instance,
-    DDS_Security_DatareaderCryptoTokenSeq *local_datareader_cryto_tokens,
-     const DDS_Security_DatareaderCryptoHandle local_datareader_crypto,
-     const DDS_Security_DatawriterCryptoHandle remote_datawriter_crypto,
-    DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(instance);
-  DDSRT_UNUSED_ARG(local_datareader_cryto_tokens);
-  DDSRT_UNUSED_ARG(local_datareader_crypto);
-  DDSRT_UNUSED_ARG(remote_datawriter_crypto);
-  DDSRT_UNUSED_ARG(ex);
-
-  return true;
-}
-
-static DDS_Security_boolean set_remote_datareader_crypto_tokens(
-     dds_security_crypto_key_exchange *instance,
-     const DDS_Security_DatawriterCryptoHandle local_datawriter_crypto,
-     const DDS_Security_DatareaderCryptoHandle remote_datareader_crypto,
-     const DDS_Security_DatareaderCryptoTokenSeq *remote_datareader_tokens,
-    DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(instance);
-  DDSRT_UNUSED_ARG(local_datawriter_crypto);
-  DDSRT_UNUSED_ARG(remote_datareader_crypto);
-  DDSRT_UNUSED_ARG(remote_datareader_tokens);
-  DDSRT_UNUSED_ARG(ex);
-
-  return true;
-}
-
-static DDS_Security_boolean return_crypto_tokens(
-     dds_security_crypto_key_exchange *instance,
-     DDS_Security_CryptoTokenSeq *crypto_tokens,
-    DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(instance);
-  DDSRT_UNUSED_ARG(crypto_tokens);
-  DDSRT_UNUSED_ARG(ex);
-
-  return true;
-}
-
-dds_security_crypto_key_exchange* dds_security_crypto_key_exchange__alloc(void)
-{
-  dds_security_crypto_key_exchange_impl *instance;
-  instance = (dds_security_crypto_key_exchange_impl*) ddsrt_malloc(
-      sizeof(dds_security_crypto_key_exchange_impl));
-
-  memset( instance, 0, sizeof(dds_security_crypto_key_exchange_impl));
-
-  instance->base.create_local_participant_crypto_tokens =
-      &create_local_participant_crypto_tokens;
-
-  /* Do not assign it for testing purposes
-    instance->base.set_remote_participant_crypto_tokens =
-        &set_remote_participant_crypto_tokens;
-  */
-
-  instance->base.create_local_datawriter_crypto_tokens =
-      &create_local_datawriter_crypto_tokens;
-
-  instance->base.set_remote_datawriter_crypto_tokens =
-      &set_remote_datawriter_crypto_tokens;
-
-  instance->base.create_local_datareader_crypto_tokens =
-      &create_local_datareader_crypto_tokens;
-
-  instance->base.set_remote_datareader_crypto_tokens =
-      &set_remote_datareader_crypto_tokens;
-
-  instance->base.return_crypto_tokens = &return_crypto_tokens;
-
-  return (dds_security_crypto_key_exchange*) instance;
-}
-
-void dds_security_crypto_key_exchange__dealloc(
-    dds_security_crypto_key_exchange* instance)
-{
-
-  ddsrt_free((dds_security_crypto_key_exchange_impl*) instance);
-}
-
-
-
-/**
- * Implementation structure for storing encapsulated members of the instance
- * while giving only the interface definition to user
- */
-
-typedef struct dds_security_crypto_key_factory_impl {
-  dds_security_crypto_key_factory base;
-  int member;
-} dds_security_crypto_key_factory_impl;
-
-/**
- * Function implementations
- */
-
-static DDS_Security_ParticipantCryptoHandle register_local_participant(
-     dds_security_crypto_key_factory *instance,
-     const DDS_Security_IdentityHandle participant_identity,
-     const DDS_Security_PermissionsHandle participant_permissions,
-     const DDS_Security_PropertySeq *participant_properties,
-     const DDS_Security_ParticipantSecurityAttributes *participant_security_attributes,
-    DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(instance);
-  DDSRT_UNUSED_ARG(participant_identity);
-  DDSRT_UNUSED_ARG(participant_permissions);
-  DDSRT_UNUSED_ARG(participant_properties);
-  DDSRT_UNUSED_ARG(participant_security_attributes);
-  DDSRT_UNUSED_ARG(ex);
-  return 0;
-}
-
-static DDS_Security_ParticipantCryptoHandle register_matched_remote_participant(
-     dds_security_crypto_key_factory *instance,
-     const DDS_Security_ParticipantCryptoHandle local_participant_crypto_handle,
-     const DDS_Security_IdentityHandle remote_participant_identity,
-     const DDS_Security_PermissionsHandle remote_participant_permissions,
-     const DDS_Security_SharedSecretHandle shared_secret,
-    DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(instance);
-  DDSRT_UNUSED_ARG(local_participant_crypto_handle);
-  DDSRT_UNUSED_ARG(remote_participant_identity);
-  DDSRT_UNUSED_ARG(remote_participant_permissions);
-  DDSRT_UNUSED_ARG(shared_secret);
-  DDSRT_UNUSED_ARG(ex);
-  return 0;
-}
-
-static DDS_Security_DatawriterCryptoHandle register_local_datawriter(
-     dds_security_crypto_key_factory *instance,
-     const DDS_Security_ParticipantCryptoHandle participant_crypto,
-     const DDS_Security_PropertySeq *datawriter_properties,
-     const DDS_Security_EndpointSecurityAttributes *datawriter_security_attributes,
-    DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(instance);
-  DDSRT_UNUSED_ARG(participant_crypto);
-  DDSRT_UNUSED_ARG(datawriter_properties);
-  DDSRT_UNUSED_ARG(datawriter_security_attributes);
-  DDSRT_UNUSED_ARG(ex);
-  return 0;
-}
-
-static DDS_Security_DatareaderCryptoHandle register_matched_remote_datareader(
-     dds_security_crypto_key_factory *instance,
-     const DDS_Security_DatawriterCryptoHandle local_datawritert_crypto_handle,
-     const DDS_Security_ParticipantCryptoHandle remote_participant_crypto,
-     const DDS_Security_SharedSecretHandle shared_secret,
-     const DDS_Security_boolean relay_only,
-    DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(instance);
-  DDSRT_UNUSED_ARG(local_datawritert_crypto_handle);
-  DDSRT_UNUSED_ARG(remote_participant_crypto);
-  DDSRT_UNUSED_ARG(shared_secret);
-  DDSRT_UNUSED_ARG(relay_only);
-  DDSRT_UNUSED_ARG(ex);
-  return 0;
-}
-
-static DDS_Security_DatareaderCryptoHandle register_local_datareader(
-     dds_security_crypto_key_factory *instance,
-     const DDS_Security_ParticipantCryptoHandle participant_crypto,
-     const DDS_Security_PropertySeq *datareader_properties,
-     const DDS_Security_EndpointSecurityAttributes *datareader_security_attributes,
-    DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(instance);
-  DDSRT_UNUSED_ARG(participant_crypto);
-  DDSRT_UNUSED_ARG(datareader_properties);
-  DDSRT_UNUSED_ARG(datareader_security_attributes);
-  DDSRT_UNUSED_ARG(ex);
-
-  return 0;
-}
-
-static DDS_Security_DatawriterCryptoHandle register_matched_remote_datawriter(
-     dds_security_crypto_key_factory *instance,
-     const DDS_Security_DatareaderCryptoHandle local_datareader_crypto_handle,
-     const DDS_Security_ParticipantCryptoHandle remote_participant_crypt,
-     const DDS_Security_SharedSecretHandle shared_secret,
-    DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(instance);
-  DDSRT_UNUSED_ARG(local_datareader_crypto_handle);
-  DDSRT_UNUSED_ARG(remote_participant_crypt);
-  DDSRT_UNUSED_ARG(shared_secret);
-  DDSRT_UNUSED_ARG(ex);
-  return true;
-}
-
-static DDS_Security_boolean unregister_participant(
-     dds_security_crypto_key_factory *instance,
-     const DDS_Security_ParticipantCryptoHandle participant_crypto_handle,
-    DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(instance);
-  DDSRT_UNUSED_ARG(participant_crypto_handle);
-  DDSRT_UNUSED_ARG(ex);
-  return true;
-}
-
-static DDS_Security_boolean unregister_datawriter(
-     dds_security_crypto_key_factory *instance,
-     const DDS_Security_DatawriterCryptoHandle datawriter_crypto_handle,
-    DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(instance);
-  DDSRT_UNUSED_ARG(datawriter_crypto_handle);
-  DDSRT_UNUSED_ARG(ex);
-  return true;
-}
-
-static DDS_Security_boolean unregister_datareader(
-     dds_security_crypto_key_factory *instance,
-     const DDS_Security_DatareaderCryptoHandle datareader_crypto_handle,
-    DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(instance);
-  DDSRT_UNUSED_ARG(datareader_crypto_handle);
-  DDSRT_UNUSED_ARG(ex);
-  return true;
-}
-
-dds_security_crypto_key_factory* dds_security_crypto_key_factory__alloc(void)
-{
-  dds_security_crypto_key_factory_impl *instance;
-  instance = (dds_security_crypto_key_factory_impl*) ddsrt_malloc(
-      sizeof(dds_security_crypto_key_factory_impl));
-
-  memset( instance, 0, sizeof(dds_security_crypto_key_factory_impl));
-  instance->base.register_local_participant = &register_local_participant;
-
-  instance->base.register_matched_remote_participant =
-      &register_matched_remote_participant;
-
-  instance->base.register_local_datawriter = &register_local_datawriter;
-
-  instance->base.register_matched_remote_datareader =
-      &register_matched_remote_datareader;
-
-  instance->base.register_local_datareader = &register_local_datareader;
-
-  instance->base.register_matched_remote_datawriter =
-      &register_matched_remote_datawriter;
-
-  instance->base.unregister_participant = &unregister_participant;
-
-  instance->base.unregister_datawriter = &unregister_datawriter;
-
-  instance->base.unregister_datareader = &unregister_datareader;
-
-  return (dds_security_crypto_key_factory*) instance;
-}
-
-void dds_security_crypto_key_factory__dealloc(
-    dds_security_crypto_key_factory* instance)
-{
-
-  ddsrt_free((dds_security_crypto_key_factory_impl*) instance);
-}
-
-
-
-/**
- * Implementation structure for storing encapsulated members of the instance
- * while giving only the interface definition to user
- */
-
-typedef struct dds_security_crypto_transform_impl {
-  dds_security_crypto_transform base;
-  int member;
-} dds_security_crypto_transform_impl;
-
-/**
- * Function implementations
- */
-static DDS_Security_boolean encode_serialized_payload(
-     dds_security_crypto_transform *instance,
-    DDS_Security_OctetSeq *encoded_buffer,
-    DDS_Security_OctetSeq *extra_inline_qos,
-     const DDS_Security_OctetSeq *plain_buffer,
-     const DDS_Security_DatawriterCryptoHandle sending_datawriter_crypto,
-    DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(instance);
-  DDSRT_UNUSED_ARG(encoded_buffer);
-  DDSRT_UNUSED_ARG(extra_inline_qos);
-  DDSRT_UNUSED_ARG(plain_buffer);
-  DDSRT_UNUSED_ARG(sending_datawriter_crypto);
-  DDSRT_UNUSED_ARG(ex);
-
-  return true;
-}
-
-static DDS_Security_boolean encode_datawriter_submessage(
-     dds_security_crypto_transform *instance,
-    DDS_Security_OctetSeq *encoded_rtps_submessage,
-     const DDS_Security_OctetSeq *plain_rtps_submessage,
-     const DDS_Security_DatawriterCryptoHandle sending_datawriter_crypto,
-     const DDS_Security_DatareaderCryptoHandleSeq *receiving_datareader_crypto_list,
-    int32_t *receiving_datareader_crypto_list_index,
-    DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(instance);
-  DDSRT_UNUSED_ARG(encoded_rtps_submessage);
-  DDSRT_UNUSED_ARG(plain_rtps_submessage);
-  DDSRT_UNUSED_ARG(sending_datawriter_crypto);
-  DDSRT_UNUSED_ARG(receiving_datareader_crypto_list);
-  DDSRT_UNUSED_ARG(receiving_datareader_crypto_list_index);
-  DDSRT_UNUSED_ARG(ex);
-
-  return true;
-}
-
-static DDS_Security_boolean encode_datareader_submessage(
-     dds_security_crypto_transform *instance,
-    DDS_Security_OctetSeq *encoded_rtps_submessage,
-     const DDS_Security_OctetSeq *plain_rtps_submessage,
-     const DDS_Security_DatareaderCryptoHandle sending_datareader_crypto,
-     const DDS_Security_DatawriterCryptoHandleSeq *receiving_datawriter_crypto_list,
-    DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(instance);
-  DDSRT_UNUSED_ARG(encoded_rtps_submessage);
-  DDSRT_UNUSED_ARG(plain_rtps_submessage);
-  DDSRT_UNUSED_ARG(sending_datareader_crypto);
-  DDSRT_UNUSED_ARG(receiving_datawriter_crypto_list);
-  DDSRT_UNUSED_ARG(ex);
-
-  return true;
-}
-
-static DDS_Security_boolean encode_rtps_message(  dds_security_crypto_transform *instance,
-    DDS_Security_OctetSeq *encoded_rtps_message,
-     const DDS_Security_OctetSeq *plain_rtps_message,
-     const DDS_Security_ParticipantCryptoHandle sending_participant_crypto,
-     const DDS_Security_ParticipantCryptoHandleSeq *receiving_participant_crypto_list,
-    int32_t *receiving_participant_crypto_list_index,
-    DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(instance);
-  DDSRT_UNUSED_ARG(encoded_rtps_message);
-  DDSRT_UNUSED_ARG(plain_rtps_message);
-  DDSRT_UNUSED_ARG(sending_participant_crypto);
-  DDSRT_UNUSED_ARG(receiving_participant_crypto_list);
-  DDSRT_UNUSED_ARG(receiving_participant_crypto_list_index);
-  DDSRT_UNUSED_ARG(ex);
-
-  return true;
-}
-
-static DDS_Security_boolean decode_rtps_message(  dds_security_crypto_transform *instance,
-    DDS_Security_OctetSeq *plain_buffer,  const DDS_Security_OctetSeq *encoded_buffer,
-     const DDS_Security_ParticipantCryptoHandle receiving_participant_crypto,
-     const DDS_Security_ParticipantCryptoHandle sending_participant_crypto,
-    DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(instance);
-  DDSRT_UNUSED_ARG(plain_buffer);
-  DDSRT_UNUSED_ARG(encoded_buffer);
-  DDSRT_UNUSED_ARG(receiving_participant_crypto);
-  DDSRT_UNUSED_ARG(sending_participant_crypto);
-  DDSRT_UNUSED_ARG(ex);
-
-  return true;
-}
-
-static DDS_Security_boolean preprocess_secure_submsg(
-     dds_security_crypto_transform *instance,
-    DDS_Security_DatawriterCryptoHandle *datawriter_crypto,
-    DDS_Security_DatareaderCryptoHandle *datareader_crypto,
-    DDS_Security_SecureSubmessageCategory_t *secure_submessage_category,
-     const DDS_Security_OctetSeq *encoded_rtps_submessage,
-     const DDS_Security_ParticipantCryptoHandle receiving_participant_crypto,
-     const DDS_Security_ParticipantCryptoHandle sending_participant_crypto,
-    DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(instance);
-  DDSRT_UNUSED_ARG(datawriter_crypto);
-  DDSRT_UNUSED_ARG(datareader_crypto);
-  DDSRT_UNUSED_ARG(secure_submessage_category);
-  DDSRT_UNUSED_ARG(encoded_rtps_submessage);
-  DDSRT_UNUSED_ARG(receiving_participant_crypto);
-  DDSRT_UNUSED_ARG(sending_participant_crypto);
-  DDSRT_UNUSED_ARG(ex);
-
-  return true;
-}
-
-static DDS_Security_boolean decode_datawriter_submessage(
-     dds_security_crypto_transform *instance,
-    DDS_Security_OctetSeq *plain_rtps_submessage,
-     const DDS_Security_OctetSeq *encoded_rtps_submessage,
-     const DDS_Security_DatareaderCryptoHandle receiving_datareader_crypto,
-     const DDS_Security_DatawriterCryptoHandle sending_datawriter_crypto,
-    DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(instance);
-  DDSRT_UNUSED_ARG(plain_rtps_submessage);
-  DDSRT_UNUSED_ARG(encoded_rtps_submessage);
-  DDSRT_UNUSED_ARG(receiving_datareader_crypto);
-  DDSRT_UNUSED_ARG(sending_datawriter_crypto);
-  DDSRT_UNUSED_ARG(ex);
-
-  return true;
-}
-
-static DDS_Security_boolean decode_datareader_submessage(
-     dds_security_crypto_transform *instance,
-    DDS_Security_OctetSeq *plain_rtps_message,
-     const DDS_Security_OctetSeq *encoded_rtps_message,
-     const DDS_Security_DatawriterCryptoHandle receiving_datawriter_crypto,
-     const DDS_Security_DatareaderCryptoHandle sending_datareader_crypto,
-    DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(instance);
-  DDSRT_UNUSED_ARG(plain_rtps_message);
-  DDSRT_UNUSED_ARG(encoded_rtps_message);
-  DDSRT_UNUSED_ARG(receiving_datawriter_crypto);
-  DDSRT_UNUSED_ARG(sending_datareader_crypto);
-  DDSRT_UNUSED_ARG(ex);
-
-  return true;
-}
-
-static DDS_Security_boolean decode_serialized_payload(
-     dds_security_crypto_transform *instance,
-    DDS_Security_OctetSeq *plain_buffer,  const DDS_Security_OctetSeq *encoded_buffer,
-     const DDS_Security_OctetSeq *inline_qos,
-     const DDS_Security_DatareaderCryptoHandle receiving_datareader_crypto,
-     const DDS_Security_DatawriterCryptoHandle sending_datawriter_crypto,
-    DDS_Security_SecurityException *ex)
-{
-  DDSRT_UNUSED_ARG(instance);
-  DDSRT_UNUSED_ARG(plain_buffer);
-  DDSRT_UNUSED_ARG(encoded_buffer);
-  DDSRT_UNUSED_ARG(inline_qos);
-  DDSRT_UNUSED_ARG(receiving_datareader_crypto);
-  DDSRT_UNUSED_ARG(sending_datawriter_crypto);
-  DDSRT_UNUSED_ARG(ex);
-
-  return true;
-}
-
-dds_security_crypto_transform* dds_security_crypto_transform__alloc(void)
-{
-  dds_security_crypto_transform_impl *instance;
-  instance = (dds_security_crypto_transform_impl*) ddsrt_malloc(
-      sizeof(dds_security_crypto_transform_impl));
-
-
-
-  instance->base.encode_datawriter_submessage = &encode_datawriter_submessage;
-
-  instance->base.encode_datareader_submessage = &encode_datareader_submessage;
-
-  instance->base.encode_rtps_message = &encode_rtps_message;
-
-  instance->base.decode_rtps_message = &decode_rtps_message;
-
-  instance->base.preprocess_secure_submsg = &preprocess_secure_submsg;
-
-  instance->base.decode_datawriter_submessage = &decode_datawriter_submessage;
-
-  instance->base.decode_datareader_submessage = &decode_datareader_submessage;
-
-  instance->base.decode_serialized_payload = &decode_serialized_payload;
-
-  instance->base.encode_serialized_payload = &encode_serialized_payload;
-
-  return (dds_security_crypto_transform*) instance;
-}
-
-void dds_security_crypto_transform__dealloc(
-    dds_security_crypto_transform* instance)
-{
-
-  ddsrt_free((dds_security_crypto_transform_impl*) instance);
-}
-
-
diff --git a/src/security/core/tests/plugin_loading/plugin_mock/cryptography_missing_function/mock_cryptography.h b/src/security/core/tests/plugin_loading/plugin_mock/cryptography_missing_function/mock_cryptography.h
deleted file mode 100644
index 2908eeb..0000000
--- a/src/security/core/tests/plugin_loading/plugin_mock/cryptography_missing_function/mock_cryptography.h
+++ /dev/null
@@ -1,26 +0,0 @@
-/*
- * Copyright(c) 2006 to 2019 ADLINK Technology Limited and others
- *
- * This program and the accompanying materials are made available under the
- * terms of the Eclipse Public License v. 2.0 which is available at
- * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
- * v. 1.0 which is available at
- * http://www.eclipse.org/org/documents/edl-v10.php.
- *
- * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
- */
-
-#ifndef SECURITY_CRYPTO_MISSING_H_
-#define SECURITY_CRYPTO_MISSING_H_
-
-#include "dds/security/cryptography_missing_function_export.h"
-#include "dds/security/dds_security_api.h"
-
-SECURITY_EXPORT int32_t
-init_crypto(const char *argument, void **context);
-
-SECURITY_EXPORT int32_t
-finalize_crypto(void *context);
-
-
-#endif /* SECURITY_CRYPTO_MISSING_H_ */
diff --git a/src/security/core/tests/plugin_loading/security_config.c b/src/security/core/tests/plugin_loading/security_config.c
deleted file mode 100644
index dbd0806..0000000
--- a/src/security/core/tests/plugin_loading/security_config.c
+++ /dev/null
@@ -1,724 +0,0 @@
-/*
- * Copyright(c) 2006 to 2018 ADLINK Technology Limited and others
- *
- * This program and the accompanying materials are made available under the
- * terms of the Eclipse Public License v. 2.0 which is available at
- * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
- * v. 1.0 which is available at
- * http://www.eclipse.org/org/documents/edl-v10.php.
- *
- * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
- */
-#include <stdlib.h>
-
-#include "dds/dds.h"
-#include "CUnit/Test.h"
-#include "config_env.h"
-
-#include "dds/version.h"
-#include "dds/ddsrt/cdtors.h"
-#include "dds/ddsrt/environ.h"
-#include "dds/ddsrt/heap.h"
-#include "dds/ddsi/q_misc.h"
-#include "dds/ddsi/ddsi_xqos.h"
-#include "plugin_mock_common.h"
-
-#include "dds/security/dds_security_api_defs.h"
-
-#define MOCKLIB_PATH(name) \
-  CONFIG_PLUGIN_MOCK_DIR CONFIG_LIB_SEP CONFIG_LIB_PREFIX name CONFIG_LIB_SUFFIX
-#define MOCKLIB_ELEM_AUTH(name) \
-  "<Library path=\"" MOCKLIB_PATH(name) "\"" \
-  " initFunction=\"init_authentication\"" \
-  " finalizeFunction=\"finalize_authentication\" />"
-#define MOCKLIB_ELEM_CRYPTO(name) \
-  "<Library path=\"" MOCKLIB_PATH(name) "\"" \
-  " initFunction=\"init_crypto\"" \
-  " finalizeFunction=\"finalize_crypto\" />"
-#define MOCKLIB_ELEM_ACCESS_CONTROL(name) \
-  "<Library path=\"" MOCKLIB_PATH(name) "\"" \
-  " initFunction=\"init_access_control\"" \
-  " finalizeFunction=\"finalize_access_control\" />"
-
-#define PROPLIST(auth, crypto, ac, pre_str, post_str, binprops)         \
-  "property_list={" pre_str                                             \
-  "0:\"dds.sec.auth.library.path\":\""auth"\","                         \
-  "0:\"dds.sec.auth.library.init\":\"init_authentication\","            \
-  "0:\"dds.sec.auth.library.finalize\":\"finalize_authentication\","    \
-  "0:\"dds.sec.crypto.library.path\":\""crypto"\","                     \
-  "0:\"dds.sec.crypto.library.init\":\"init_crypto\","                  \
-  "0:\"dds.sec.crypto.library.finalize\":\"finalize_crypto\","          \
-  "0:\"dds.sec.access.library.path\":\""ac"\","                         \
-  "0:\"dds.sec.access.library.init\":\"init_access_control\","          \
-  "0:\"dds.sec.access.library.finalize\":\"finalize_access_control\","  \
-  "0:\"dds.sec.auth.identity_ca\":\"" TEST_CA_CERTIFICATE_ALL_OK "\","  \
-  "0:\"dds.sec.auth.private_key\":\"" TEST_PRIVATE_KEY_ALL_OK "\","     \
-  "0:\"dds.sec.auth.identity_certificate\":\"" TEST_IDENTITY_CERTIFICATE_ALL_OK "\"," \
-  "0:\"dds.sec.access.permissions_ca\":\"file:Permissions_CA.pem\","    \
-  "0:\"dds.sec.access.governance\":\"file:Governance.p7s\","            \
-  "0:\"dds.sec.access.permissions\":\"file:Permissions.p7s\""           \
-  post_str "}:{" binprops "}"
-#define PARTICIPANT_QOS(auth, crypto, ac, pre_str, post_str, binprops)  \
-  "PARTICIPANT * QOS={*" PROPLIST (auth, crypto, ac, pre_str, post_str, binprops) "*"
-#define PARTICIPANT_QOS_ALL_OK(pre_str, post_str, binprops)             \
-  PARTICIPANT_QOS (MOCKLIB_PATH ("dds_security_authentication_all_ok"), \
-                   MOCKLIB_PATH ("dds_security_cryptography_all_ok"),   \
-                   MOCKLIB_PATH ("dds_security_access_control_all_ok"), \
-                   pre_str, post_str, binprops)
-
-#define URI_VARIABLE DDS_PROJECT_NAME_NOSPACE_CAPS"_URI"
-
-/*
- * The 'found' variable will contain flags related to the expected log
- * messages that were received.
- * Using flags will allow to show that when message isn't received,
- * which one it was.
- */
-static uint32_t found;
-
-static void logger(void *ptr, const dds_log_data_t *data)
-{
-  char **expected = (char**)ptr;
-  fputs (data->message, stdout);
-  for (uint32_t i = 0; expected[i] != NULL; i++) {
-    if (ddsi2_patmatch(expected[i], data->message)) {
-      found |= (uint32_t)(1 << i);
-    }
-  }
-}
-
-
-CU_Test(ddsc_security_config, empty, .init = ddsrt_init, .fini = ddsrt_fini)
-{
-  /* Expected traces when creating participant with an empty security element.  We need to
-     test this one here to be sure that it refuses to start when security is configured
-     but the implementation doesn't include support for it. */
-  const char *log_expected[] = {
-    "config: //CycloneDDS/Domain/DDSSecurity/Authentication/IdentityCertificate/#text: element missing in configuration*",
-    "config: //CycloneDDS/Domain/DDSSecurity/Authentication/IdentityCA/#text: element missing in configuration*",
-    "config: //CycloneDDS/Domain/DDSSecurity/Authentication/PrivateKey/#text: element missing in configuration*",
-    NULL
-  };
-
-  dds_entity_t participant;
-
-  /* Set up the trace sinks to detect the config parsing. */
-  dds_set_log_mask(DDS_LC_FATAL|DDS_LC_ERROR|DDS_LC_WARNING|DDS_LC_CONFIG);
-  dds_set_log_sink(&logger, (void*)log_expected);
-  dds_set_trace_sink(&logger, (void*)log_expected);
-
-  /* Create participant with an empty security element. */
-  found = 0;
-  ddsrt_setenv(URI_VARIABLE, "<DDSSecurity/>");
-  participant = dds_create_participant(DDS_DOMAIN_DEFAULT, NULL, NULL);
-  ddsrt_setenv(URI_VARIABLE, "");
-  CU_ASSERT_FATAL(participant < 0);
-  dds_set_log_sink(NULL, NULL);
-  dds_set_trace_sink(NULL, NULL);
-
-  /* All traces should have been provided. */
-  CU_ASSERT_FATAL(found == 0x7);
-}
-
-CU_Test(ddsc_security_config, non, .init = ddsrt_init, .fini = ddsrt_fini)
-{
-  /* There shouldn't be traces that mention security. */
-  const char *log_expected[] = {
-    "*Security*",
-    NULL
-  };
-
-  dds_entity_t participant;
-
-  /* Set up the trace sinks to detect the config parsing. */
-  dds_set_log_mask(DDS_LC_FATAL|DDS_LC_ERROR|DDS_LC_WARNING|DDS_LC_CONFIG);
-  dds_set_log_sink(&logger, (void*)log_expected);
-  dds_set_trace_sink(&logger, (void*)log_expected);
-
-  /* Create participant with an empty security element. */
-  found = 0;
-  ddsrt_setenv(URI_VARIABLE, "<Tracing><Verbosity>finest</></>");
-  participant = dds_create_participant(DDS_DOMAIN_DEFAULT, NULL, NULL);
-  ddsrt_setenv(URI_VARIABLE, "");
-  CU_ASSERT_FATAL(participant > 0);
-  dds_delete(participant);
-  dds_set_log_sink(NULL, NULL);
-  dds_set_trace_sink(NULL, NULL);
-
-  /* No security traces should have been provided. */
-  CU_ASSERT_FATAL(found == 0x0);
-}
-
-CU_Test(ddsc_security_config, missing, .init = ddsrt_init, .fini = ddsrt_fini)
-{
-  /* Expected traces when creating participant with the security elements. */
-  const char *log_expected[] = {
-    "config: //CycloneDDS/Domain/DDSSecurity/Authentication/IdentityCertificate/#text: element missing in configuration*",
-    "config: //CycloneDDS/Domain/DDSSecurity/Authentication/IdentityCA/#text: element missing in configuration*",
-    "config: //CycloneDDS/Domain/DDSSecurity/Authentication/PrivateKey/#text: element missing in configuration*",
-    NULL
-  };
-
-  /* IdentityCertificate, IdentityCA and PrivateKey values or elements are missing. */
-  const char *sec_config =
-    "<Tracing><Verbosity>finest</></>"
-    "<DDSSecurity>"
-    "  <Authentication>"
-    "    "MOCKLIB_ELEM_AUTH("dds_security_authentication_all_ok")
-    "    <IdentityCertificate></IdentityCertificate>"
-    "    <PrivateKey></PrivateKey>"
-    "    <Password>testtext_Password_testtext</Password>"
-    "  </Authentication>"
-    "  <Cryptographic>"
-    "    "MOCKLIB_ELEM_CRYPTO("dds_security_cryptography_all_ok")
-    "  </Cryptographic>"
-    "  <AccessControl>"
-    "    "MOCKLIB_ELEM_ACCESS_CONTROL("dds_security_access_control_all_ok")
-    "    <Governance>file:Governance.p7s</Governance>"
-    "    <PermissionsCA>file:Permissions_CA.pem</PermissionsCA>"
-    "    <Permissions>file:Permissions.p7s</Permissions>"
-    "  </AccessControl>"
-    "</DDSSecurity>";
-
-  dds_entity_t participant;
-
-  /* Set up the trace sinks to detect the config parsing. */
-  dds_set_log_mask(DDS_LC_FATAL|DDS_LC_ERROR|DDS_LC_WARNING|DDS_LC_CONFIG);
-  dds_set_log_sink(&logger, (void*)log_expected);
-  dds_set_trace_sink(&logger, (void*)log_expected);
-
-  /* Create participant with an empty security element. */
-  found = 0;
-  ddsrt_setenv(URI_VARIABLE, sec_config);
-  participant = dds_create_participant(DDS_DOMAIN_DEFAULT, NULL, NULL);
-  ddsrt_setenv(URI_VARIABLE, "");
-  CU_ASSERT_FATAL(participant < 0);
-  dds_set_log_sink(NULL, NULL);
-  dds_set_trace_sink(NULL, NULL);
-  /* All traces should have been provided. */
-  CU_ASSERT_FATAL(found == 0x7);
-}
-
-CU_Test(ddsc_security_config, all, .init = ddsrt_init, .fini = ddsrt_fini)
-{
-  /* Expected traces when creating participant with the security elements. */
-  const char *log_expected[] = {
-    "config: Domain/DDSSecurity/Authentication/Library/#text: "MOCKLIB_PATH("dds_security_authentication_all_ok")"*",
-    "config: Domain/DDSSecurity/Authentication/Library[@path]: "MOCKLIB_PATH("dds_security_authentication_all_ok")"*",
-    "config: Domain/DDSSecurity/Authentication/Library[@initFunction]: init_authentication*",
-    "config: Domain/DDSSecurity/Authentication/Library[@finalizeFunction]: finalize_authentication*",
-    "config: Domain/DDSSecurity/Authentication/IdentityCertificate/#text: "TEST_IDENTITY_CERTIFICATE_ALL_OK"*",
-    "config: Domain/DDSSecurity/Authentication/IdentityCA/#text: "TEST_CA_CERTIFICATE_ALL_OK"*",
-    "config: Domain/DDSSecurity/Authentication/PrivateKey/#text: "TEST_PRIVATE_KEY_ALL_OK"*",
-    "config: Domain/DDSSecurity/Authentication/Password/#text: testtext_Password_testtext*",
-    "config: Domain/DDSSecurity/Authentication/TrustedCADirectory/#text: testtext_Dir_testtext*",
-    "config: Domain/DDSSecurity/AccessControl/Library/#text: "MOCKLIB_PATH("dds_security_access_control_all_ok")"*",
-    "config: Domain/DDSSecurity/AccessControl/Library[@path]: "MOCKLIB_PATH("dds_security_access_control_all_ok")"*",
-    "config: Domain/DDSSecurity/AccessControl/Library[@initFunction]: init_access_control*",
-    "config: Domain/DDSSecurity/AccessControl/Library[@finalizeFunction]: finalize_access_control*",
-    "config: Domain/DDSSecurity/AccessControl/PermissionsCA/#text: file:Permissions_CA.pem*",
-    "config: Domain/DDSSecurity/AccessControl/Governance/#text: file:Governance.p7s*",
-    "config: Domain/DDSSecurity/AccessControl/Permissions/#text: file:Permissions.p7s*",
-    "config: Domain/DDSSecurity/Cryptographic/Library/#text: "MOCKLIB_PATH("dds_security_cryptography_all_ok")"*",
-    "config: Domain/DDSSecurity/Cryptographic/Library[@path]: "MOCKLIB_PATH("dds_security_cryptography_all_ok")"*",
-    "config: Domain/DDSSecurity/Cryptographic/Library[@initFunction]: init_crypto*",
-    "config: Domain/DDSSecurity/Cryptographic/Library[@finalizeFunction]: finalize_crypto*",
-    /* The config should have been parsed into the participant QoS. */
-    PARTICIPANT_QOS_ALL_OK ("", ",0:\"dds.sec.auth.password\":\"testtext_Password_testtext\",0:\"dds.sec.auth.trusted_ca_dir\":\"testtext_Dir_testtext\"", ""),
-    NULL
-  };
-  const char *sec_config =
-    "<"DDS_PROJECT_NAME">"
-    "  <Domain id=\"any\">"
-    "    <Tracing><Verbosity>finest</></>"
-    "    <DDSSecurity>"
-    "      <Authentication>"
-    "        "MOCKLIB_ELEM_AUTH("dds_security_authentication_all_ok")
-    "        <IdentityCertificate>"TEST_IDENTITY_CERTIFICATE_ALL_OK"</IdentityCertificate>"
-    "        <IdentityCA>"TEST_CA_CERTIFICATE_ALL_OK"</IdentityCA>"
-    "        <PrivateKey>"TEST_PRIVATE_KEY_ALL_OK"</PrivateKey>"
-    "        <Password>testtext_Password_testtext</Password>"
-    "        <TrustedCADirectory>testtext_Dir_testtext</TrustedCADirectory>"
-    "      </Authentication>"
-    "      <Cryptographic>"
-    "        "MOCKLIB_ELEM_CRYPTO("dds_security_cryptography_all_ok")
-    "      </Cryptographic>"
-    "      <AccessControl>"
-    "        "MOCKLIB_ELEM_ACCESS_CONTROL("dds_security_access_control_all_ok")
-    "        <Governance>file:Governance.p7s</Governance>"
-    "        <PermissionsCA>file:Permissions_CA.pem</PermissionsCA>"
-    "        <Permissions>file:Permissions.p7s</Permissions>"
-    "      </AccessControl>"
-    "    </DDSSecurity>"
-    "  </Domain>"
-    "</"DDS_PROJECT_NAME">";
-
-  dds_entity_t participant;
-
-  /* Set up the trace sinks to detect the config parsing. */
-  dds_set_log_mask(DDS_LC_FATAL|DDS_LC_ERROR|DDS_LC_WARNING|DDS_LC_CONFIG);
-  dds_set_log_sink(&logger, (void*)log_expected);
-  dds_set_trace_sink(&logger, (void*)log_expected);
-
-  /* Create participant with security elements. */
-  found = 0;
-  ddsrt_setenv(URI_VARIABLE, sec_config);
-  participant = dds_create_participant(DDS_DOMAIN_DEFAULT, NULL, NULL);
-  CU_ASSERT_FATAL(participant > 0);
-  ddsrt_setenv(URI_VARIABLE, "");
-  dds_delete(participant);
-  dds_set_log_sink(NULL, NULL);
-  dds_set_trace_sink(NULL, NULL);
-
-  /* All traces should have been provided. */
-  CU_ASSERT_FATAL(found == 0x1fffff);
-}
-
-CU_Test(ddsc_security_config, security, .init = ddsrt_init, .fini = ddsrt_fini)
-{
-  /* Expected traces when creating participant with the security elements. */
-  const char *log_expected[] = {
-    "config: Domain/DDSSecurity/Authentication/Library/#text: "MOCKLIB_PATH("dds_security_authentication_all_ok")"*",
-    "config: Domain/DDSSecurity/Authentication/Library[@path]: "MOCKLIB_PATH("dds_security_authentication_all_ok")"*",
-    "config: Domain/DDSSecurity/Authentication/Library[@initFunction]: init_authentication*",
-    "config: Domain/DDSSecurity/Authentication/Library[@finalizeFunction]: finalize_authentication*",
-    "config: Domain/DDSSecurity/Authentication/IdentityCertificate/#text: "TEST_IDENTITY_CERTIFICATE_ALL_OK"*",
-    "config: Domain/DDSSecurity/Authentication/IdentityCA/#text: "TEST_CA_CERTIFICATE_ALL_OK"*",
-    "config: Domain/DDSSecurity/Authentication/PrivateKey/#text: "TEST_PRIVATE_KEY_ALL_OK"*",
-    "config: Domain/DDSSecurity/Authentication/Password/#text:  {}*",
-    "config: Domain/DDSSecurity/Authentication/TrustedCADirectory/#text:  {}*",
-    "config: Domain/DDSSecurity/AccessControl/Library/#text: "MOCKLIB_PATH("dds_security_access_control_all_ok")"*",
-    "config: Domain/DDSSecurity/AccessControl/Library[@path]: "MOCKLIB_PATH("dds_security_access_control_all_ok")"*",
-    "config: Domain/DDSSecurity/AccessControl/Library[@initFunction]: init_access_control*",
-    "config: Domain/DDSSecurity/AccessControl/Library[@finalizeFunction]: finalize_access_control*",
-    "config: Domain/DDSSecurity/AccessControl/PermissionsCA/#text: file:Permissions_CA.pem*",
-    "config: Domain/DDSSecurity/AccessControl/Governance/#text: file:Governance.p7s*",
-    "config: Domain/DDSSecurity/AccessControl/Permissions/#text: file:Permissions.p7s*",
-    "config: Domain/DDSSecurity/Cryptographic/Library/#text: "MOCKLIB_PATH("dds_security_cryptography_all_ok")"*",
-    "config: Domain/DDSSecurity/Cryptographic/Library[@path]: "MOCKLIB_PATH("dds_security_cryptography_all_ok")"*",
-    "config: Domain/DDSSecurity/Cryptographic/Library[@initFunction]: init_crypto*",
-    "config: Domain/DDSSecurity/Cryptographic/Library[@finalizeFunction]: finalize_crypto*",
-    /* The config should have been parsed into the participant QoS. */
-    PARTICIPANT_QOS_ALL_OK ("", ",0:\"dds.sec.auth.password\":\"\",0:\"dds.sec.auth.trusted_ca_dir\":\"\"", ""),
-    NULL
-  };
-
-  const char *sec_config =
-    "<Tracing><Verbosity>finest</></>"
-    "<DDSSecurity>"
-    "  <Authentication>"
-    "    "MOCKLIB_ELEM_AUTH("dds_security_authentication_all_ok")
-    "    <IdentityCertificate>"TEST_IDENTITY_CERTIFICATE_ALL_OK"</IdentityCertificate>"
-    "    <IdentityCA>"TEST_CA_CERTIFICATE_ALL_OK"</IdentityCA>"
-    "    <PrivateKey>"TEST_PRIVATE_KEY_ALL_OK"</PrivateKey>"
-    "  </Authentication>"
-    "  <Cryptographic>"
-    "    "MOCKLIB_ELEM_CRYPTO("dds_security_cryptography_all_ok")
-    "  </Cryptographic>"
-    "  <AccessControl>"
-    "    "MOCKLIB_ELEM_ACCESS_CONTROL("dds_security_access_control_all_ok")
-    "    <Governance>file:Governance.p7s</Governance>"
-    "    <PermissionsCA>file:Permissions_CA.pem</PermissionsCA>"
-    "    <Permissions>file:Permissions.p7s</Permissions>"
-    "  </AccessControl>"
-    "</DDSSecurity>";
-
-  dds_entity_t participant;
-
-  /* Set up the trace sinks to detect the config parsing. */
-  dds_set_log_mask(DDS_LC_FATAL|DDS_LC_ERROR|DDS_LC_WARNING|DDS_LC_CONFIG);
-  dds_set_log_sink(&logger, (void*)log_expected);
-  dds_set_trace_sink(&logger, (void*)log_expected);
-
-  /* Create participant with security elements. */
-  found = 0;
-  ddsrt_setenv(URI_VARIABLE, sec_config);
-  participant = dds_create_participant(DDS_DOMAIN_DEFAULT, NULL, NULL);
-  CU_ASSERT_FATAL(participant > 0);
-  ddsrt_setenv(URI_VARIABLE, "");
-  dds_delete(participant);
-  dds_set_log_sink(NULL, NULL);
-  dds_set_trace_sink(NULL, NULL);
-
-  /* All traces should have been provided. */
-  CU_ASSERT_FATAL(found == 0x1fffff);
-}
-
-CU_Test(ddsc_security_config, deprecated, .init = ddsrt_init, .fini = ddsrt_fini)
-{
-  /* Expected traces when creating participant with the security elements. */
-  const char *log_expected[] = {
-    "config: Domain/DDSSecurity/Authentication/Library/#text: "MOCKLIB_PATH("dds_security_authentication_all_ok")"*",
-    "config: Domain/DDSSecurity/Authentication/Library[@path]: "MOCKLIB_PATH("dds_security_authentication_all_ok")"*",
-    "config: Domain/DDSSecurity/Authentication/Library[@initFunction]: init_authentication*",
-    "config: Domain/DDSSecurity/Authentication/Library[@finalizeFunction]: finalize_authentication*",
-    "config: Domain/DDSSecurity/Authentication/IdentityCertificate/#text: "TEST_IDENTITY_CERTIFICATE_ALL_OK"*",
-    "config: Domain/DDSSecurity/Authentication/IdentityCA/#text: "TEST_CA_CERTIFICATE_ALL_OK"*",
-    "config: Domain/DDSSecurity/Authentication/PrivateKey/#text: "TEST_PRIVATE_KEY_ALL_OK"*",
-    "config: Domain/DDSSecurity/Authentication/Password/#text: testtext_Password_testtext*",
-    "config: Domain/DDSSecurity/Authentication/TrustedCADirectory/#text: testtext_Dir_testtext*",
-    "config: Domain/DDSSecurity/AccessControl/Library/#text: "MOCKLIB_PATH("dds_security_access_control_all_ok")"*",
-    "config: Domain/DDSSecurity/AccessControl/Library[@path]: "MOCKLIB_PATH("dds_security_access_control_all_ok")"*",
-    "config: Domain/DDSSecurity/AccessControl/Library[@initFunction]: init_access_control*",
-    "config: Domain/DDSSecurity/AccessControl/Library[@finalizeFunction]: finalize_access_control*",
-    "config: Domain/DDSSecurity/AccessControl/PermissionsCA/#text: file:Permissions_CA.pem*",
-    "config: Domain/DDSSecurity/AccessControl/Governance/#text: file:Governance.p7s*",
-    "config: Domain/DDSSecurity/AccessControl/Permissions/#text: file:Permissions.p7s*",
-    "config: Domain/DDSSecurity/Cryptographic/Library/#text: "MOCKLIB_PATH("dds_security_cryptography_all_ok")"*",
-    "config: Domain/DDSSecurity/Cryptographic/Library[@path]: "MOCKLIB_PATH("dds_security_cryptography_all_ok")"*",
-    "config: Domain/DDSSecurity/Cryptographic/Library[@initFunction]: init_crypto*",
-    "config: Domain/DDSSecurity/Cryptographic/Library[@finalizeFunction]: finalize_crypto*",
-    /* The config should have been parsed into the participant QoS. */
-    PARTICIPANT_QOS_ALL_OK ("", ",0:\"dds.sec.auth.password\":\"testtext_Password_testtext\",0:\"dds.sec.auth.trusted_ca_dir\":\"testtext_Dir_testtext\"", ""),
-    NULL
-  };
-
-  const char *sec_config =
-    "<"DDS_PROJECT_NAME">"
-    "  <Domain id=\"any\">"
-    "    <DDSSecurity>"
-    "      <Authentication>"
-    "        "MOCKLIB_ELEM_AUTH("dds_security_authentication_all_ok")
-    "        <IdentityCertificate>"TEST_IDENTITY_CERTIFICATE_ALL_OK"</IdentityCertificate>"
-    "        <IdentityCA>"TEST_CA_CERTIFICATE_ALL_OK"</IdentityCA>"
-    "        <PrivateKey>"TEST_PRIVATE_KEY_ALL_OK"</PrivateKey>"
-    "        <Password>testtext_Password_testtext</Password>"
-    "        <TrustedCADirectory>testtext_Dir_testtext</TrustedCADirectory>"
-    "      </Authentication>"
-    "      <Cryptographic>"
-    "        "MOCKLIB_ELEM_CRYPTO("dds_security_cryptography_all_ok")
-    "      </Cryptographic>"
-    "      <AccessControl>"
-    "        "MOCKLIB_ELEM_ACCESS_CONTROL("dds_security_access_control_all_ok")
-    "        <Governance>file:Governance.p7s</Governance>"
-    "        <PermissionsCA>file:Permissions_CA.pem</PermissionsCA>"
-    "        <Permissions>file:Permissions.p7s</Permissions>"
-    "      </AccessControl>"
-    "    </DDSSecurity>"
-    "    <Tracing><Verbosity>finest</></>"
-    "  </Domain>"
-    "</"DDS_PROJECT_NAME">";
-
-  dds_entity_t participant;
-
-  /* Set up the trace sinks to detect the config parsing. */
-  dds_set_log_mask(DDS_LC_FATAL|DDS_LC_ERROR|DDS_LC_WARNING|DDS_LC_CONFIG);
-  dds_set_log_sink(&logger, (void*)log_expected);
-  dds_set_trace_sink(&logger, (void*)log_expected);
-
-  /* Create participant with security elements. */
-  found = 0;
-  ddsrt_setenv(URI_VARIABLE, sec_config);
-  participant = dds_create_participant(DDS_DOMAIN_DEFAULT, NULL, NULL);
-  CU_ASSERT_FATAL(participant > 0);
-  ddsrt_setenv(URI_VARIABLE, "");
-  dds_delete(participant);
-  dds_set_log_sink(NULL, NULL);
-  dds_set_trace_sink(NULL, NULL);
-
-  /* All traces should have been provided. */
-  CU_ASSERT_FATAL(found == 0x1fffff);
-}
-
-CU_Test(ddsc_security_config, qos, .init = ddsrt_init, .fini = ddsrt_fini)
-{
-  /* Expected traces when creating participant with the security elements. */
-  const char *log_expected[] = {
-    /* The config should have been parsed into the participant QoS. */
-    PARTICIPANT_QOS_ALL_OK ("", ",0:\"dds.sec.auth.password\":\"testtext_Password_testtext\",0:\"dds.sec.auth.trusted_ca_dir\":\"file:/test/dir\"", ""),
-    NULL
-  };
-
-  dds_entity_t participant;
-  dds_qos_t * qos;
-
-  /* Set up the trace sinks to detect the config parsing. */
-  dds_set_log_mask(DDS_LC_FATAL|DDS_LC_ERROR|DDS_LC_WARNING|DDS_LC_CONFIG);
-  dds_set_log_sink(&logger, (void*)log_expected);
-  dds_set_trace_sink(&logger, (void*)log_expected);
-
-  /* Create the qos -- the properties are dumped in the order in which they are set, so for
-     PARTICIPANT_QOS_ALL_OK to work, the order must match that one */
-  CU_ASSERT_FATAL((qos = dds_create_qos()) != NULL);
-  dds_qset_prop(qos, "dds.sec.auth.library.path", ""MOCKLIB_PATH("dds_security_authentication_all_ok")"");
-  dds_qset_prop(qos, "dds.sec.auth.library.init", "init_authentication");
-  dds_qset_prop(qos, "dds.sec.auth.library.finalize", "finalize_authentication");
-  dds_qset_prop(qos, "dds.sec.crypto.library.path", ""MOCKLIB_PATH("dds_security_cryptography_all_ok")"");
-  dds_qset_prop(qos, "dds.sec.crypto.library.init", "init_crypto");
-  dds_qset_prop(qos, "dds.sec.crypto.library.finalize", "finalize_crypto");
-  dds_qset_prop(qos, "dds.sec.access.library.path", ""MOCKLIB_PATH("dds_security_access_control_all_ok")"");
-  dds_qset_prop(qos, "dds.sec.access.library.init", "init_access_control");
-  dds_qset_prop(qos, "dds.sec.access.library.finalize", "finalize_access_control");
-  dds_qset_prop(qos, "dds.sec.auth.identity_ca", TEST_CA_CERTIFICATE_ALL_OK);
-  dds_qset_prop(qos, "dds.sec.auth.private_key", TEST_PRIVATE_KEY_ALL_OK);
-  dds_qset_prop(qos, "dds.sec.auth.identity_certificate", TEST_IDENTITY_CERTIFICATE_ALL_OK);
-  dds_qset_prop(qos, "dds.sec.access.permissions_ca", "file:Permissions_CA.pem");
-  dds_qset_prop(qos, "dds.sec.access.governance", "file:Governance.p7s");
-  dds_qset_prop(qos, "dds.sec.access.permissions", "file:Permissions.p7s");
-  dds_qset_prop(qos, "dds.sec.auth.password", "testtext_Password_testtext");
-  dds_qset_prop(qos, "dds.sec.auth.trusted_ca_dir", "file:/test/dir");
-
-  /* Create participant with security config in qos. */
-  found = 0;
-  ddsrt_setenv(URI_VARIABLE, "<Tracing><Verbosity>finest</></>");
-  participant = dds_create_participant(DDS_DOMAIN_DEFAULT, qos, NULL);
-  CU_ASSERT_FATAL(participant > 0);
-  ddsrt_setenv(URI_VARIABLE, "");
-  dds_delete(participant);
-  dds_delete_qos(qos);
-  dds_set_log_sink(NULL, NULL);
-  dds_set_trace_sink(NULL, NULL);
-
-  /* All traces should have been provided. */
-  CU_ASSERT_FATAL(found == 0x1);
-}
-
-CU_Test(ddsc_security_config, qos_props, .init = ddsrt_init, .fini = ddsrt_fini)
-{
-  /* Expected traces when creating participant with the security elements. */
-  const char *log_expected[] = {
-    /* The config should have been parsed into the participant QoS. */
-    PARTICIPANT_QOS_ALL_OK ("", ",0:\"dds.sec.auth.password\":\"testtext_Password_testtext\",0:\"dds.sec.auth.trusted_ca_dir\":\"file:/test/dir\",0:\"test.prop1\":\"testtext_value1_testtext\",0:\"test.prop2\":\"testtext_value2_testtext\"",
-                            "0:\"test.bprop1\":3<1,2,3>"),
-    NULL
-  };
-
-  dds_entity_t participant;
-  dds_qos_t * qos;
-
-  /* Set up the trace sinks to detect the config parsing. */
-  dds_set_log_mask(DDS_LC_FATAL | DDS_LC_ERROR | DDS_LC_WARNING | DDS_LC_CONFIG);
-  dds_set_log_sink(&logger, (void*)log_expected);
-  dds_set_trace_sink(&logger, (void*)log_expected);
-
-  /* Create the qos -- the properties are dumped in the order in which they are set, so for
-     PARTICIPANT_QOS_ALL_OK to work, the order must match that one */
-  unsigned char bvalue[3] = { 0x01, 0x02, 0x03 };
-  CU_ASSERT_FATAL((qos = dds_create_qos()) != NULL);
-
-  dds_qset_prop(qos, "dds.sec.auth.library.path", ""MOCKLIB_PATH("dds_security_authentication_all_ok")"");
-  dds_qset_prop(qos, "dds.sec.auth.library.init", "init_authentication");
-  dds_qset_prop(qos, "dds.sec.auth.library.finalize", "finalize_authentication");
-  dds_qset_prop(qos, "dds.sec.crypto.library.path", ""MOCKLIB_PATH("dds_security_cryptography_all_ok")"");
-  dds_qset_prop(qos, "dds.sec.crypto.library.init", "init_crypto");
-  dds_qset_prop(qos, "dds.sec.crypto.library.finalize", "finalize_crypto");
-  dds_qset_prop(qos, "dds.sec.access.library.path", ""MOCKLIB_PATH("dds_security_access_control_all_ok")"");
-  dds_qset_prop(qos, "dds.sec.access.library.init", "init_access_control");
-  dds_qset_prop(qos, "dds.sec.access.library.finalize", "finalize_access_control");
-  dds_qset_prop(qos, "dds.sec.auth.identity_ca", TEST_CA_CERTIFICATE_ALL_OK);
-  dds_qset_prop(qos, "dds.sec.auth.private_key", TEST_PRIVATE_KEY_ALL_OK);
-  dds_qset_prop(qos, "dds.sec.auth.identity_certificate", TEST_IDENTITY_CERTIFICATE_ALL_OK);
-  dds_qset_prop(qos, "dds.sec.access.permissions_ca", "file:Permissions_CA.pem");
-  dds_qset_prop(qos, "dds.sec.access.governance", "file:Governance.p7s");
-  dds_qset_prop(qos, "dds.sec.access.permissions", "file:Permissions.p7s");
-  dds_qset_prop(qos, "dds.sec.auth.password", "testtext_Password_testtext");
-  dds_qset_prop(qos, "dds.sec.auth.trusted_ca_dir", "file:/test/dir");
-
-  dds_qset_prop(qos, "test.prop1", "testtext_value1_testtext");
-  dds_qset_prop(qos, "test.prop2", "testtext_value2_testtext");
-  dds_qset_bprop(qos, "test.bprop1", bvalue, 3);
-
-  /* Create participant with security config in qos. */
-  found = 0;
-  ddsrt_setenv(URI_VARIABLE, "<Tracing><Verbosity>finest</></>");
-  participant = dds_create_participant(DDS_DOMAIN_DEFAULT, qos, NULL);
-  CU_ASSERT_FATAL(participant > 0);
-  ddsrt_setenv(URI_VARIABLE, "");
-  dds_delete(participant);
-  dds_set_log_sink(NULL, NULL);
-  dds_set_trace_sink(NULL, NULL);
-  dds_delete_qos(qos);
-
-  /* All traces should have been provided. */
-  CU_ASSERT_FATAL(found == 0x1);
-}
-
-CU_Test(ddsc_security_config, config_qos, .init = ddsrt_init, .fini = ddsrt_fini)
-{
-  /* Expect qos settings used when creating participant with config security elements and qos. */
-  const char *log_expected[] = {
-    /* The security settings from qos properties should have been parsed into the participant QoS. */
-    "new_participant(*): using security settings from QoS*",
-    PARTICIPANT_QOS_ALL_OK ("", "", ""),
-    NULL
-  };
-
-  const char *sec_config =
-    "<Tracing><Verbosity>finest</></>"
-    "<DDSSecurity>"
-    "  <Authentication>"
-    "    <IdentityCertificate>"TEST_IDENTITY_CERTIFICATE_ALL_OK"</IdentityCertificate>"
-    "    <IdentityCA>"TEST_CA_CERTIFICATE_ALL_OK"</IdentityCA>"
-    "    <PrivateKey>"TEST_PRIVATE_KEY_ALL_OK"</PrivateKey>"
-    "  </Authentication>"
-    "  <AccessControl>"
-    "    <Governance>file:Governance.p7s</Governance>"
-    "    <PermissionsCA>file:Permissions_CA.pem</PermissionsCA>"
-    "    <Permissions>file:Permissions.p7s</Permissions>"
-    "  </AccessControl>"
-    "</DDSSecurity>";
-
-  dds_entity_t participant;
-  dds_qos_t * qos;
-
-  /* Create the qos -- the properties are dumped in the order in which they are set, so for
-     PARTICIPANT_QOS_ALL_OK to work, the order must match that one */
-  CU_ASSERT_FATAL((qos = dds_create_qos()) != NULL);
-  dds_qset_prop(qos, "dds.sec.auth.library.path", ""MOCKLIB_PATH("dds_security_authentication_all_ok")"");
-  dds_qset_prop(qos, "dds.sec.auth.library.init", "init_authentication");
-  dds_qset_prop(qos, "dds.sec.auth.library.finalize", "finalize_authentication");
-  dds_qset_prop(qos, "dds.sec.crypto.library.path", ""MOCKLIB_PATH("dds_security_cryptography_all_ok")"");
-  dds_qset_prop(qos, "dds.sec.crypto.library.init", "init_crypto");
-  dds_qset_prop(qos, "dds.sec.crypto.library.finalize", "finalize_crypto");
-  dds_qset_prop(qos, "dds.sec.access.library.path", ""MOCKLIB_PATH("dds_security_access_control_all_ok")"");
-  dds_qset_prop(qos, "dds.sec.access.library.init", "init_access_control");
-  dds_qset_prop(qos, "dds.sec.access.library.finalize", "finalize_access_control");
-  dds_qset_prop(qos, "dds.sec.auth.identity_ca", TEST_CA_CERTIFICATE_ALL_OK);
-  dds_qset_prop(qos, "dds.sec.auth.private_key", TEST_PRIVATE_KEY_ALL_OK);
-  dds_qset_prop(qos, "dds.sec.auth.identity_certificate", TEST_IDENTITY_CERTIFICATE_ALL_OK);
-  dds_qset_prop(qos, "dds.sec.access.permissions_ca", "file:Permissions_CA.pem");
-  dds_qset_prop(qos, "dds.sec.access.governance", "file:Governance.p7s");
-  dds_qset_prop(qos, "dds.sec.access.permissions", "file:Permissions.p7s");
-
-  /* Set up the trace sinks to detect the config parsing. */
-  dds_set_log_mask(DDS_LC_FATAL | DDS_LC_ERROR | DDS_LC_WARNING | DDS_LC_CONFIG);
-  dds_set_log_sink(&logger, (void*)log_expected);
-  dds_set_trace_sink(&logger, (void*)log_expected);
-
-  /* Create participant with security elements. */
-  found = 0;
-  ddsrt_setenv(URI_VARIABLE, sec_config);
-  participant = dds_create_participant(DDS_DOMAIN_DEFAULT, qos, NULL);
-  CU_ASSERT_FATAL (participant > 0);
-  ddsrt_setenv(URI_VARIABLE, "");
-  dds_delete(participant);
-  dds_set_log_sink(NULL, NULL);
-  dds_set_trace_sink(NULL, NULL);
-  dds_delete_qos(qos);
-
-  /* All traces should have been provided. */
-  CU_ASSERT_FATAL(found == 0x3);
-}
-
-CU_Test(ddsc_security_config, other_prop, .init = ddsrt_init, .fini = ddsrt_fini)
-{
-  /* Expect config used when creating participant with config security elements and
-   * qos containing only non-security properties. */
-  const char *log_expected[] = {
-    /* The security settings from config should have been parsed into the participant QoS. */
-    PARTICIPANT_QOS_ALL_OK ("0:\"test.dds.sec.prop1\":\"testtext_value1_testtext\",", ",0:\"dds.sec.auth.password\":\"testtext_Password_testtext\",0:\"dds.sec.auth.trusted_ca_dir\":\"testtext_Dir_testtext\"", ""),
-    NULL
-  };
-
-  const char *sec_config =
-    "<Tracing><Verbosity>finest</></>"
-    "<DDSSecurity>"
-    "  <Authentication>"
-    "    "MOCKLIB_ELEM_AUTH("dds_security_authentication_all_ok")
-    "    <IdentityCertificate>"TEST_IDENTITY_CERTIFICATE_ALL_OK"</IdentityCertificate>"
-    "    <IdentityCA>"TEST_CA_CERTIFICATE_ALL_OK"</IdentityCA>"
-    "    <PrivateKey>"TEST_PRIVATE_KEY_ALL_OK"</PrivateKey>"
-    "    <Password>testtext_Password_testtext</Password>"
-    "    <TrustedCADirectory>testtext_Dir_testtext</TrustedCADirectory>"
-    "  </Authentication>"
-    "  <Cryptographic>"
-    "    "MOCKLIB_ELEM_CRYPTO("dds_security_cryptography_all_ok")
-    "  </Cryptographic>"
-    "  <AccessControl>"
-    "    "MOCKLIB_ELEM_ACCESS_CONTROL("dds_security_access_control_all_ok")
-    "    <Governance>file:Governance.p7s</Governance>"
-    "    <PermissionsCA>file:Permissions_CA.pem</PermissionsCA>"
-    "    <Permissions>file:Permissions.p7s</Permissions>"
-    "  </AccessControl>"
-    "</DDSSecurity>";
-
-  dds_entity_t participant;
-  dds_qos_t * qos;
-
-  CU_ASSERT_FATAL((qos = dds_create_qos()) != NULL);
-  dds_qset_prop(qos, "test.dds.sec.prop1", "testtext_value1_testtext");
-
-  /* Set up the trace sinks to detect the config parsing. */
-  dds_set_log_mask(DDS_LC_FATAL | DDS_LC_ERROR | DDS_LC_WARNING | DDS_LC_CONFIG);
-  dds_set_log_sink(&logger, (void*)log_expected);
-  dds_set_trace_sink(&logger, (void*)log_expected);
-
-  /* Create participant with security elements. */
-  found = 0;
-  ddsrt_setenv(URI_VARIABLE, sec_config);
-  participant = dds_create_participant(DDS_DOMAIN_DEFAULT, qos, NULL);
-  CU_ASSERT_FATAL (participant > 0);
-  ddsrt_setenv(URI_VARIABLE, "");
-  dds_delete(participant);
-  dds_set_log_sink(NULL, NULL);
-  dds_set_trace_sink(NULL, NULL);
-  dds_delete_qos(qos);
-
-  /* All traces should have been provided. */
-  CU_ASSERT_FATAL(found == 0x1);
-}
-
-CU_Test(ddsc_security_config, qos_invalid, .init = ddsrt_init, .fini = ddsrt_fini)
-{
-  /* Expected traces when creating participant with the security elements. */
-  const char *log_expected[] = {
-    /* The config should have been parsed into the participant QoS. */
-    "new_participant(*): using security settings from QoS*",
-    "new_participant(*): required security property dds.sec.auth.identity_ca missing in Property QoS*",
-    "new_participant(*): required security property dds.sec.auth.private_key missing in Property QoS*",
-    "new_participant(*): required security property dds.sec.auth.identity_certificate missing in Property QoS*",
-    "new_participant(*): required security property dds.sec.access.permissions_ca missing in Property QoS*",
-    "new_participant(*): required security property dds.sec.access.governance missing in Property QoS*",
-    "new_participant(*): required security property dds.sec.access.permissions missing in Property QoS*",
-    "new_participant(*): required security property dds.sec.auth.library.path missing in Property QoS*",
-    "new_participant(*): required security property dds.sec.auth.library.init missing in Property QoS*",
-    "new_participant(*): required security property dds.sec.auth.library.finalize missing in Property QoS*",
-    "new_participant(*): required security property dds.sec.crypto.library.path missing in Property QoS*",
-    "new_participant(*): required security property dds.sec.crypto.library.init missing in Property QoS*",
-    "new_participant(*): required security property dds.sec.crypto.library.finalize missing in Property QoS*",
-    "new_participant(*): required security property dds.sec.access.library.path missing in Property QoS*",
-    "new_participant(*): required security property dds.sec.access.library.init missing in Property QoS*",
-    "new_participant(*): required security property dds.sec.access.library.finalize missing in Property QoS*",
-    NULL
-  };
-
-  const char *sec_config =
-    "<Tracing><Verbosity>finest</></>"
-    "<DDSSecurity>"
-    "  <Authentication>"
-    "    <IdentityCertificate>"TEST_IDENTITY_CERTIFICATE_ALL_OK"</IdentityCertificate>"
-    "    <IdentityCA>"TEST_CA_CERTIFICATE_ALL_OK"</IdentityCA>"
-    "    <PrivateKey>"TEST_PRIVATE_KEY_ALL_OK"</PrivateKey>"
-    "  </Authentication>"
-    "  <AccessControl>"
-    "    <Governance>file:Governance.p7s</Governance>"
-    "    <PermissionsCA>file:Permissions_CA.pem</PermissionsCA>"
-    "    <Permissions>file:Permissions.p7s</Permissions>"
-    "  </AccessControl>"
-    "</DDSSecurity>";
-
-  dds_entity_t participant;
-  dds_qos_t * qos;
-
-  /* Set up the trace sinks to detect the config parsing. */
-  dds_set_log_mask(DDS_LC_FATAL | DDS_LC_ERROR | DDS_LC_WARNING | DDS_LC_CONFIG);
-  dds_set_log_sink(&logger, (void*)log_expected);
-  dds_set_trace_sink(&logger, (void*)log_expected);
-
-  /* Create the qos */
-  CU_ASSERT_FATAL((qos = dds_create_qos()) != NULL);
-  dds_qset_prop(qos, "dds.sec.dummy", "testtext_dummy_testtext");
-
-  /* Create participant with security config in qos. */
-  found = 0;
-  ddsrt_setenv(URI_VARIABLE, sec_config);
-  participant = dds_create_participant(DDS_DOMAIN_DEFAULT, qos, NULL);
-  dds_delete_qos(qos);
-  CU_ASSERT_EQUAL_FATAL(participant, DDS_RETCODE_ERROR);
-  ddsrt_setenv(URI_VARIABLE, "");
-
-  /* All traces should have been provided. */
-  CU_ASSERT_FATAL(found == 0xffff);
-  dds_set_log_sink(NULL, NULL);
-  dds_set_trace_sink(NULL, NULL);
-}
diff --git a/src/security/core/tests/secure_communication.c b/src/security/core/tests/secure_communication.c
new file mode 100644
index 0000000..c8ac8df
--- /dev/null
+++ b/src/security/core/tests/secure_communication.c
@@ -0,0 +1,481 @@
+/*
+ * Copyright(c) 2006 to 2020 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+#include <stdlib.h>
+#include <assert.h>
+
+#include "dds/dds.h"
+#include "CUnit/Test.h"
+#include "CUnit/Theory.h"
+
+#include "dds/version.h"
+#include "dds/ddsrt/cdtors.h"
+#include "dds/ddsrt/environ.h"
+#include "dds/ddsrt/heap.h"
+#include "dds/ddsrt/string.h"
+#include "dds/ddsrt/threads.h"
+#include "dds/ddsrt/process.h"
+#include "dds/ddsi/q_config.h"
+#include "dds/ddsi/ddsi_domaingv.h"
+#include "dds/ddsi/q_misc.h"
+#include "dds/ddsi/ddsi_xqos.h"
+#include "dds/ddsi/q_entity.h"
+#include "dds/ddsi/ddsi_entity_index.h"
+#include "dds/ddsi/ddsi_security_omg.h"
+#include "dds__entity.h"
+#include "dds/security/dds_security_api.h"
+
+#include "common/config_env.h"
+#include "common/test_identity.h"
+#include "common/security_config_test_utils.h"
+#include "common/cryptography_wrapper.h"
+
+#include "SecurityCoreTests.h"
+
+#define PK_N DDS_SECURITY_PROTECTION_KIND_NONE
+#define PK_S DDS_SECURITY_PROTECTION_KIND_SIGN
+#define PK_SOA DDS_SECURITY_PROTECTION_KIND_SIGN_WITH_ORIGIN_AUTHENTICATION
+#define PK_E DDS_SECURITY_PROTECTION_KIND_ENCRYPT
+#define PK_EOA DDS_SECURITY_PROTECTION_KIND_ENCRYPT_WITH_ORIGIN_AUTHENTICATION
+#define BPK_N DDS_SECURITY_BASICPROTECTION_KIND_NONE
+#define BPK_S DDS_SECURITY_BASICPROTECTION_KIND_SIGN
+#define BPK_E DDS_SECURITY_BASICPROTECTION_KIND_ENCRYPT
+
+static const char *config =
+    "${CYCLONEDDS_URI}${CYCLONEDDS_URI:+,}"
+    "<Discovery><ExternalDomainId>0</ExternalDomainId></Discovery>"
+    "<Domain id=\"any\">"
+    "  <DDSSecurity>"
+    "    <Authentication>"
+    "      <Library finalizeFunction=\"finalize_authentication\" initFunction=\"init_authentication\" />"
+    "      <IdentityCertificate>"TEST_IDENTITY_CERTIFICATE"</IdentityCertificate>"
+    "      <PrivateKey>"TEST_IDENTITY_PRIVATE_KEY"</PrivateKey>"
+    "      <IdentityCA>"TEST_IDENTITY_CA_CERTIFICATE"</IdentityCA>"
+    "      <Password></Password>"
+    "      <TrustedCADirectory>.</TrustedCADirectory>"
+    "    </Authentication>"
+    "    <AccessControl>"
+    "      <Library finalizeFunction=\"finalize_access_control\" initFunction=\"init_access_control\"/>"
+    "      <Governance><![CDATA[data:,${GOVERNANCE_DATA}]]></Governance>"
+    "      <PermissionsCA>file:" COMMON_ETC_PATH("default_permissions_ca.pem") "</PermissionsCA>"
+    "      <Permissions>file:" COMMON_ETC_PATH("default_permissions.p7s") "</Permissions>"
+    "    </AccessControl>"
+    "    <Cryptographic>"
+    "      <Library finalizeFunction=\"${CRYPTO_FINI}\" initFunction=\"${CRYPTO_INIT}\" path=\"" WRAPPERLIB_PATH("dds_security_cryptography_wrapper") "\"/>"
+    "    </Cryptographic>"
+    "  </DDSSecurity>"
+    "</Domain>";
+
+#define DDS_DOMAINID_PUB 0
+#define DDS_DOMAINID_SUB 10
+
+#define MAX_DOMAINS 10
+#define MAX_PARTICIPANTS 10
+
+const char * g_pk_none = "NONE";
+const char * g_pk_sign = "SIGN";
+const char * g_pk_encrypt = "ENCRYPT";
+const char * g_pk_sign_oa = "SIGN_WITH_ORIGIN_AUTHENTICATION";
+const char * g_pk_encrypt_oa = "ENCRYPT_WITH_ORIGIN_AUTHENTICATION";
+
+uint32_t g_topic_nr = 0;
+
+static dds_entity_t g_pub_domains[MAX_DOMAINS];
+static dds_entity_t g_pub_participants[MAX_DOMAINS * MAX_PARTICIPANTS];
+static dds_entity_t g_pub_publishers[MAX_DOMAINS * MAX_PARTICIPANTS];
+
+static dds_entity_t g_sub_domains[MAX_DOMAINS];
+static dds_entity_t g_sub_participants[MAX_DOMAINS * MAX_PARTICIPANTS];
+static dds_entity_t g_sub_subscribers[MAX_DOMAINS * MAX_PARTICIPANTS];
+
+struct domain_sec_config {
+  DDS_Security_ProtectionKind discovery_pk;
+  DDS_Security_ProtectionKind liveliness_pk;
+  DDS_Security_ProtectionKind rtps_pk;
+  DDS_Security_ProtectionKind metadata_pk;
+  DDS_Security_BasicProtectionKind payload_pk;
+};
+
+
+static struct dds_security_cryptography_impl * get_crypto_context(dds_entity_t participant)
+{
+  struct dds_entity *pp_entity = NULL;
+  struct participant *pp;
+  struct dds_security_cryptography_impl *context;
+  dds_return_t ret;
+
+  ret = dds_entity_lock (participant, DDS_KIND_PARTICIPANT, &pp_entity);
+  CU_ASSERT_EQUAL_FATAL (ret, 0);
+  thread_state_awake (lookup_thread_state(), &pp_entity->m_domain->gv);
+  pp = entidx_lookup_participant_guid (pp_entity->m_domain->gv.entity_index, &pp_entity->m_guid);
+  CU_ASSERT_FATAL (pp != NULL);
+  context = (struct dds_security_cryptography_impl *) q_omg_participant_get_cryptography (pp);
+  thread_state_asleep (lookup_thread_state ());
+  dds_entity_unlock (pp_entity);
+  return context;
+}
+
+static const char * pk_to_str(DDS_Security_ProtectionKind pk)
+{
+  switch (pk)
+  {
+    case DDS_SECURITY_PROTECTION_KIND_NONE: return g_pk_none;
+    case DDS_SECURITY_PROTECTION_KIND_SIGN: return g_pk_sign;
+    case DDS_SECURITY_PROTECTION_KIND_ENCRYPT: return g_pk_encrypt;
+    case DDS_SECURITY_PROTECTION_KIND_SIGN_WITH_ORIGIN_AUTHENTICATION: return g_pk_sign_oa;
+    case DDS_SECURITY_PROTECTION_KIND_ENCRYPT_WITH_ORIGIN_AUTHENTICATION: return g_pk_encrypt_oa;
+  }
+  assert (false);
+  return NULL;
+}
+
+static const char * bpk_to_str(DDS_Security_BasicProtectionKind bpk)
+{
+  switch (bpk)
+  {
+    case DDS_SECURITY_BASICPROTECTION_KIND_NONE: return g_pk_none;
+    case DDS_SECURITY_BASICPROTECTION_KIND_SIGN: return g_pk_sign;
+    case DDS_SECURITY_BASICPROTECTION_KIND_ENCRYPT: return g_pk_encrypt;
+  }
+  assert (false);
+  return NULL;
+}
+
+static void print_config_vars(struct kvp *vars)
+{
+  for (uint32_t i = 0; vars[i].key != NULL; i++)
+    printf("%s=%s; ", vars[i].key, vars[i].value);
+}
+
+static char *create_topic_name(const char *prefix, uint32_t nr, char *name, size_t size)
+{
+  ddsrt_pid_t pid = ddsrt_getpid ();
+  ddsrt_tid_t tid = ddsrt_gettid ();
+  (void)snprintf(name, size, "%s%d_pid%" PRIdPID "_tid%" PRIdTID "", prefix, nr, pid, tid);
+  return name;
+}
+
+static dds_entity_t create_pp (dds_domainid_t domain_id, const struct domain_sec_config * domain_config)
+{
+  dds_entity_t pp = dds_create_participant (domain_id, NULL, NULL);
+  CU_ASSERT_FATAL (pp > 0);
+  struct dds_security_cryptography_impl * crypto_context = get_crypto_context (pp);
+  CU_ASSERT_FATAL (crypto_context != NULL);
+  set_protection_kinds (crypto_context, domain_config->rtps_pk, domain_config->metadata_pk, domain_config->payload_pk);
+  return pp;
+}
+
+typedef dds_entity_t (*pubsub_create_fn)(dds_entity_t, const dds_qos_t *qos, const dds_listener_t *listener);
+
+static void create_dom_pp_pubsub(dds_domainid_t domain_id_base, const char * domain_conf, const struct domain_sec_config * domain_sec_config,
+    size_t n_dom, size_t n_pp, dds_entity_t * doms, dds_entity_t * pps, dds_entity_t * pubsubs, pubsub_create_fn pubsub_create)
+{
+  for (size_t d = 0; d < n_dom; d++)
+  {
+    doms[d] = dds_create_domain (domain_id_base + (uint32_t)d, domain_conf);
+    CU_ASSERT_FATAL (doms[d] > 0);
+    for (size_t p = 0; p < n_pp; p++)
+    {
+      size_t pp_index = d * n_pp + p;
+      pps[pp_index] = create_pp (domain_id_base + (uint32_t)d, domain_sec_config);
+      pubsubs[pp_index] = pubsub_create (pps[pp_index], NULL, NULL);
+      CU_ASSERT_FATAL (pubsubs[pp_index] > 0);
+    }
+  }
+}
+
+static void test_init(const struct domain_sec_config * domain_config, size_t n_sub_domains, size_t n_sub_participants, size_t n_pub_domains, size_t n_pub_participants)
+{
+  assert (n_sub_domains < MAX_DOMAINS);
+  assert (n_sub_participants < MAX_PARTICIPANTS);
+  assert (n_pub_domains < MAX_DOMAINS);
+  assert (n_pub_participants < MAX_PARTICIPANTS);
+
+  struct kvp governance_vars[] = {
+    { "DISCOVERY_PROTECTION_KIND", pk_to_str (domain_config->discovery_pk) },
+    { "LIVELINESS_PROTECTION_KIND", pk_to_str (domain_config->liveliness_pk) },
+    { "RTPS_PROTECTION_KIND", pk_to_str (domain_config->rtps_pk) },
+    { "METADATA_PROTECTION_KIND", pk_to_str (domain_config->metadata_pk) },
+    { "DATA_PROTECTION_KIND", bpk_to_str (domain_config->payload_pk) },
+    { NULL, NULL }
+  };
+
+  printf("Governance configuration: ");
+  print_config_vars(governance_vars);
+  printf("\n");
+
+  char * gov_config_signed = get_governance_config (governance_vars);
+
+  struct kvp config_vars[] = {
+    { "GOVERNANCE_DATA", gov_config_signed },
+    { "CRYPTO_INIT", "init_test_cryptography_wrapped" },
+    { "CRYPTO_FINI", "finalize_test_cryptography_wrapped" },
+    { NULL, NULL }
+  };
+
+  char *conf_pub = ddsrt_expand_vars (config, &expand_lookup_vars_env, config_vars);
+  create_dom_pp_pubsub (DDS_DOMAINID_PUB, conf_pub, domain_config, n_pub_domains, n_pub_participants,
+      g_pub_domains, g_pub_participants, g_pub_publishers, &dds_create_publisher);
+  dds_free (conf_pub);
+
+  char *conf_sub = ddsrt_expand_vars (config, &expand_lookup_vars_env, config_vars);
+  create_dom_pp_pubsub (DDS_DOMAINID_SUB, conf_sub, domain_config, n_sub_domains, n_sub_participants,
+      g_sub_domains, g_sub_participants, g_sub_subscribers, &dds_create_subscriber);
+  dds_free (conf_sub);
+
+  dds_free (gov_config_signed);
+}
+
+static void test_fini(size_t n_sub_domain, size_t n_pub_domain)
+{
+  dds_return_t ret;
+  for (size_t d = 0; d < n_pub_domain; d++)
+  {
+    ret = dds_delete (g_pub_domains[d]);
+    CU_ASSERT_EQUAL_FATAL (ret, DDS_RETCODE_OK);
+  }
+  for (size_t d = 0; d < n_sub_domain; d++)
+  {
+    ret = dds_delete (g_sub_domains[d]);
+    CU_ASSERT_EQUAL_FATAL (ret, DDS_RETCODE_OK);
+  }
+  printf("Test finished\n");
+}
+
+static void sync_writer_to_readers(dds_entity_t pub_participant, dds_entity_t writer, size_t n_exp_rd)
+{
+  size_t found = 0;
+  dds_attach_t triggered;
+  dds_return_t ret;
+  dds_entity_t waitset_wr = dds_create_waitset (pub_participant);
+  CU_ASSERT_FATAL (waitset_wr > 0);
+
+  /* Sync writer to reader. */
+  ret = dds_waitset_attach (waitset_wr, writer, writer);
+  CU_ASSERT_EQUAL_FATAL (ret, DDS_RETCODE_OK);
+  while (true)
+  {
+    ret = dds_waitset_wait (waitset_wr, &triggered, 1, DDS_SECS(5));
+    CU_ASSERT_FATAL(ret >= 1);
+    CU_ASSERT_EQUAL_FATAL (writer, (dds_entity_t)(intptr_t) triggered);
+    if ((found += (size_t)ret) >= n_exp_rd)
+      break;
+  };
+  dds_delete (waitset_wr);
+}
+
+static void reader_wait_for_data(dds_entity_t sub_participant, dds_entity_t reader)
+{
+  dds_attach_t triggered;
+  dds_return_t ret;
+  dds_entity_t waitset_rd = dds_create_waitset (sub_participant);
+  CU_ASSERT_FATAL (waitset_rd > 0);
+
+  ret = dds_waitset_attach (waitset_rd, reader, reader);
+  CU_ASSERT_EQUAL_FATAL (ret, DDS_RETCODE_OK);
+  ret = dds_waitset_wait (waitset_rd, &triggered, 1, DDS_SECS(5));
+  CU_ASSERT_EQUAL_FATAL (ret, 1);
+  CU_ASSERT_EQUAL_FATAL (reader, (dds_entity_t)(intptr_t)triggered);
+  dds_delete (waitset_rd);
+}
+
+typedef dds_entity_t (*ep_create_fn)(dds_entity_t, dds_entity_t, const dds_qos_t *qos, const dds_listener_t *listener);
+
+static void create_eps (dds_entity_t **endpoints, dds_entity_t **topics, size_t n_dom, size_t n_pp, size_t n_eps, const char * topic_name, const dds_entity_t * pps, const dds_qos_t * qos, ep_create_fn ep_create, unsigned status_mask)
+{
+  *topics = ddsrt_malloc (n_dom * n_pp * sizeof (dds_entity_t));
+  *endpoints = ddsrt_malloc (n_dom * n_pp * n_eps * sizeof (dds_entity_t));
+  for (size_t d = 0; d < n_dom; d++)
+  {
+    for (size_t p = 0; p < n_pp; p++)
+    {
+      size_t pp_index = d * n_pp + p;
+      (*topics)[pp_index] = dds_create_topic (pps[pp_index], &SecurityCoreTests_Type1_desc, topic_name, NULL, NULL);
+      CU_ASSERT_FATAL ((*topics)[pp_index] > 0);
+      for (size_t e = 0; e < n_eps; e++)
+      {
+        size_t ep_index = pp_index * n_eps + e;
+        (*endpoints)[ep_index] = ep_create (pps[pp_index], (*topics)[pp_index], qos, NULL);
+        CU_ASSERT_FATAL ((*endpoints)[ep_index] > 0);
+        dds_return_t ret = dds_set_status_mask ((*endpoints)[ep_index], status_mask);
+        CU_ASSERT_EQUAL_FATAL (ret, DDS_RETCODE_OK);
+      }
+    }
+  }
+}
+
+static void test_write_read(struct domain_sec_config *domain_config,
+    size_t n_sub_domains, size_t n_sub_participants, size_t n_readers,
+    size_t n_pub_domains, size_t n_pub_participants, size_t n_writers)
+{
+  dds_entity_t *writers, *readers, *writer_topics, *reader_topics;
+  dds_qos_t *qos;
+  SecurityCoreTests_Type1 sample = { 0, 1 };
+  SecurityCoreTests_Type1 rd_sample;
+  void * samples[] = { &rd_sample };
+  dds_sample_info_t info[1];
+  dds_return_t ret;
+  char name[100];
+
+  printf("Testing: %"PRIuSIZE" subscriber domains, %"PRIuSIZE" pp per domain, %"PRIuSIZE" rd per pp; %"PRIuSIZE" publishing domains, %"PRIuSIZE" pp per domain, %"PRIuSIZE" wr per pp\n",
+      n_sub_domains, n_sub_participants, n_readers, n_pub_domains, n_pub_participants, n_writers);
+  test_init(domain_config, n_sub_domains, n_sub_participants, n_pub_domains, n_pub_participants);
+
+  create_topic_name("ddssec_secure_communication_", g_topic_nr++, name, sizeof name);
+
+  qos = dds_create_qos ();
+  CU_ASSERT_FATAL (qos != NULL);
+  dds_qset_history (qos, DDS_HISTORY_KEEP_ALL, -1);
+  dds_qset_durability (qos, DDS_DURABILITY_TRANSIENT_LOCAL);
+  dds_qset_reliability (qos, DDS_RELIABILITY_RELIABLE, DDS_INFINITY);
+
+  create_eps (&writers, &writer_topics, n_pub_domains, n_pub_participants, n_writers, name, g_pub_participants, qos, &dds_create_writer, DDS_PUBLICATION_MATCHED_STATUS);
+  create_eps (&readers, &reader_topics, n_sub_domains, n_sub_participants, n_readers, name, g_sub_participants, qos, &dds_create_reader, DDS_DATA_AVAILABLE_STATUS);
+
+  for (size_t d = 0; d < n_pub_domains; d++)
+  {
+    for (size_t p = 0; p < n_pub_participants; p++)
+    {
+      size_t pp_index = d * n_pub_participants + p;
+      for (size_t w = 0; w < n_writers; w++)
+      {
+        size_t wr_index = pp_index * n_writers + w;
+        sync_writer_to_readers (g_pub_participants[pp_index], writers[wr_index], n_sub_domains * n_sub_participants * n_readers);
+        sample.id = (int32_t) wr_index;
+        printf("writer %"PRId32" writing sample %d\n", writers[wr_index], sample.id);
+        ret = dds_write (writers[wr_index], &sample);
+        CU_ASSERT_EQUAL_FATAL (ret, DDS_RETCODE_OK);
+      }
+    }
+  }
+
+  for (size_t d = 0; d < n_sub_domains; d++)
+  {
+    for (size_t p = 0; p < n_sub_participants; p++)
+    {
+      size_t pp_index = d * n_sub_participants + p;
+      for (size_t r = 0; r < n_readers; r++)
+      {
+        size_t rd_index = pp_index * n_readers + r;
+        size_t n_samples = n_pub_domains * n_pub_participants * n_writers;
+        while (n_samples > 0)
+        {
+          ret = dds_take (readers[rd_index], samples, info, 1, 1);
+          if (ret == 0)
+          {
+            reader_wait_for_data (g_sub_participants[pp_index], readers[rd_index]);
+            continue;
+          }
+          printf("reader %"PRId32" received sample %d\n", readers[rd_index], rd_sample.id);
+          CU_ASSERT_EQUAL_FATAL (ret, 1);
+          CU_ASSERT_EQUAL_FATAL (rd_sample.value, 1);
+          n_samples--;
+        }
+      }
+    }
+  }
+
+  /* Cleanup */
+  dds_delete_qos (qos);
+  test_fini (n_sub_domains, n_pub_domains);
+  ddsrt_free (readers);
+  ddsrt_free (writers);
+  ddsrt_free (reader_topics);
+  ddsrt_free (writer_topics);
+}
+
+static void test_discovery_liveliness_protection(DDS_Security_ProtectionKind discovery_pk, DDS_Security_ProtectionKind liveliness_pk)
+{
+  struct domain_sec_config domain_config = { discovery_pk, liveliness_pk, PK_N, PK_N, BPK_N };
+  /* FIXME: add more asserts in wrapper or test instead of just testing communication */
+  test_write_read (&domain_config, 1, 1, 1, 1, 1, 1);
+}
+
+static void test_data_protection_kind(DDS_Security_ProtectionKind rtps_pk, DDS_Security_ProtectionKind metadata_pk, DDS_Security_BasicProtectionKind payload_pk)
+{
+  struct domain_sec_config domain_config = { PK_N, PK_N, rtps_pk, metadata_pk, payload_pk };
+  test_write_read (&domain_config, 1, 1, 1, 1, 1, 1);
+}
+
+static void test_multiple_readers(size_t n_dom, size_t n_pp, size_t n_rd, DDS_Security_ProtectionKind metadata_pk, DDS_Security_BasicProtectionKind payload_pk)
+{
+  struct domain_sec_config domain_config = { PK_N, PK_N, PK_N, metadata_pk, payload_pk };
+  test_write_read (&domain_config, n_dom, n_pp, n_rd, 1, 1, 1);
+}
+
+static void test_multiple_writers(size_t n_rd_dom, size_t n_rd, size_t n_wr_dom, size_t n_wr, DDS_Security_ProtectionKind metadata_pk)
+{
+  struct domain_sec_config domain_config = { PK_N, PK_N, PK_N, metadata_pk, BPK_N };
+  test_write_read (&domain_config, n_rd_dom, 1, n_rd, n_wr_dom, 1, n_wr);
+}
+
+CU_Test(ddssec_secure_communication, protection_kinds, .timeout = 120)
+{
+  DDS_Security_ProtectionKind rtps_pk[] = { PK_N, PK_S, PK_E };
+  DDS_Security_ProtectionKind metadata_pk[] = { PK_N, PK_S, PK_E };
+  DDS_Security_BasicProtectionKind payload_pk[] = { BPK_N, BPK_S, BPK_E };
+  for (size_t rtps = 0; rtps < sizeof (rtps_pk) / sizeof (rtps_pk[0]); rtps++)
+  {
+    for (size_t metadata = 0; metadata < sizeof (metadata_pk) / sizeof (metadata_pk[0]); metadata++)
+    {
+      for (size_t payload = 0; payload < sizeof (payload_pk) / sizeof (payload_pk[0]); payload++)
+      {
+        test_data_protection_kind (rtps_pk[rtps], metadata_pk[metadata], payload_pk[payload]);
+      }
+    }
+  }
+}
+
+CU_Test(ddssec_secure_communication, discovery_liveliness_protection, .timeout = 60)
+{
+  DDS_Security_ProtectionKind discovery_pk[] = { PK_N, PK_S, PK_E };
+  DDS_Security_ProtectionKind liveliness_pk[] = { PK_N, PK_S, PK_E };
+  for (size_t disc = 0; disc < sizeof (discovery_pk) / sizeof (discovery_pk[0]); disc++)
+  {
+    for (size_t liveliness = 0; liveliness < sizeof (liveliness_pk) / sizeof (liveliness_pk[0]); liveliness++)
+    {
+      test_discovery_liveliness_protection (discovery_pk[disc], liveliness_pk[liveliness]);
+    }
+  }
+}
+
+CU_TheoryDataPoints(ddssec_secure_communication, multiple_readers) = {
+    CU_DataPoints(size_t, 1, 1, 1, 3), /* number of domains */
+    CU_DataPoints(size_t, 1, 3, 1, 3), /* number of participants per domain */
+    CU_DataPoints(size_t, 3, 1, 3, 3), /* number of readers per participant */
+};
+CU_Theory((size_t n_dom, size_t n_pp, size_t n_rd), ddssec_secure_communication, multiple_readers, .timeout = 60)
+{
+  DDS_Security_ProtectionKind metadata_pk[] = { PK_N, PK_SOA, PK_EOA };
+  DDS_Security_BasicProtectionKind payload_pk[] = { BPK_N, BPK_S, BPK_E };
+  for (size_t metadata = 0; metadata < sizeof (metadata_pk) / sizeof (metadata_pk[0]); metadata++)
+  {
+    for (size_t payload = 0; payload < sizeof (payload_pk) / sizeof (payload_pk[0]); payload++)
+    {
+      test_multiple_readers (n_dom, n_pp, n_rd, metadata_pk[metadata], payload_pk[payload]);
+    }
+  }
+}
+
+CU_TheoryDataPoints(ddssec_secure_communication, multiple_readers_writers) = {
+    CU_DataPoints(size_t, 1, 1, 2), /* number of reader domains */
+    CU_DataPoints(size_t, 1, 3, 3), /* number of readers per domain */
+    CU_DataPoints(size_t, 1, 1, 2), /* number of writer domains */
+    CU_DataPoints(size_t, 1, 3, 3), /* number of writers per domain */
+};
+CU_Theory((size_t n_rd_dom, size_t n_rd, size_t n_wr_dom, size_t n_wr), ddssec_secure_communication, multiple_readers_writers, .timeout = 60)
+{
+  DDS_Security_ProtectionKind metadata_pk[] = { PK_SOA, PK_EOA };
+  for (size_t metadata = 0; metadata < sizeof (metadata_pk) / sizeof (metadata_pk[0]); metadata++)
+  {
+    test_multiple_writers (n_rd_dom, n_rd, n_wr_dom, n_wr, metadata_pk[metadata]);
+  }
+}

From 6c9e50cf3ae7c3a7aa5ffef3fc042da67d000d71 Mon Sep 17 00:00:00 2001
From: Dennis Potman <dennis.potman@adlinktech.com>
Date: Mon, 2 Mar 2020 10:55:19 +0100
Subject: [PATCH 112/238] Fix for empty trusted CA dir

Trusted CA dir in security configuration is optional, but participant
creation currently fails if no or empty dir is provided. This commit
fixes this issue and adds some tests for various trusted_ca_dir values.

Signed-off-by: Dennis Potman <dennis.potman@adlinktech.com>
---
 src/ddsrt/src/filesystem/posix/filesystem.c   |  7 +--
 .../authentication/src/authentication.c       | 10 +---
 src/security/core/tests/authentication.c      | 57 +++++++++++++++----
 src/security/core/tests/handshake.c           |  2 -
 4 files changed, 53 insertions(+), 23 deletions(-)

diff --git a/src/ddsrt/src/filesystem/posix/filesystem.c b/src/ddsrt/src/filesystem/posix/filesystem.c
index 11b57ce..1db647c 100644
--- a/src/ddsrt/src/filesystem/posix/filesystem.c
+++ b/src/ddsrt/src/filesystem/posix/filesystem.c
@@ -87,14 +87,14 @@ char * ddsrt_file_normalize(const char *filepath)
     char *normPtr;
 
     norm = NULL;
-    if ((filepath != NULL) && (*filepath != '\0')) {
-        norm = ddsrt_malloc(strlen(filepath) + 1);
+    if (filepath != NULL) {
+        norm = ddsrt_malloc (strlen (filepath) + 1);
         /* replace any / or \ by DDSRT_FILESEPCHAR */
         fpPtr = (char *) filepath;
         normPtr = norm;
         while (*fpPtr != '\0') {
             *normPtr = *fpPtr;
-            if ((*fpPtr == '/') || (*fpPtr == '\\')) {
+            if (*fpPtr == '/' || *fpPtr == '\\') {
                 *normPtr = DDSRT_FILESEPCHAR;
                 normPtr++;
             } else {
@@ -106,7 +106,6 @@ char * ddsrt_file_normalize(const char *filepath)
         }
         *normPtr = '\0';
     }
-
     return norm;
 }
 
diff --git a/src/security/builtin_plugins/authentication/src/authentication.c b/src/security/builtin_plugins/authentication/src/authentication.c
index d6139d9..4d317d7 100644
--- a/src/security/builtin_plugins/authentication/src/authentication.c
+++ b/src/security/builtin_plugins/authentication/src/authentication.c
@@ -980,17 +980,13 @@ validate_local_identity(
 
     password = DDS_Security_Property_get_value(&participant_qos->property.value, PROPERTY_PASSWORD);
 
-
     trusted_ca_dir = DDS_Security_Property_get_value(&participant_qos->property.value, PROPERTY_TRUSTED_CA_DIR);
-
-    if( trusted_ca_dir ){
-        result = get_trusted_ca_list(trusted_ca_dir, &(implementation->trustedCAList), ex );
-        if (result != DDS_SECURITY_VALIDATION_OK) {
+    if (trusted_ca_dir && *trusted_ca_dir != '\0')
+    {
+        if ((result = get_trusted_ca_list (trusted_ca_dir, &(implementation->trustedCAList), ex)) != DDS_SECURITY_VALIDATION_OK)
             goto err_inv_trusted_ca_dir;
-        }
     }
 
-
     result = load_X509_certificate(identityCaPEM, &identityCA, ex);
     if (result != DDS_SECURITY_VALIDATION_OK) {
         goto err_inv_identity_ca;
diff --git a/src/security/core/tests/authentication.c b/src/security/core/tests/authentication.c
index e981648..c1e022d 100644
--- a/src/security/core/tests/authentication.c
+++ b/src/security/core/tests/authentication.c
@@ -14,6 +14,7 @@
 
 #include "dds/dds.h"
 #include "CUnit/Test.h"
+#include "CUnit/Theory.h"
 
 #include "dds/version.h"
 #include "dds/ddsrt/cdtors.h"
@@ -44,8 +45,7 @@ static const char *config =
     "      <IdentityCertificate>${TEST_IDENTITY_CERTIFICATE}</IdentityCertificate>"
     "      <PrivateKey>${TEST_IDENTITY_PRIVATE_KEY}</PrivateKey>"
     "      <IdentityCA>${TEST_IDENTITY_CA_CERTIFICATE}</IdentityCA>"
-    "      <Password>testtext_Password_testtext</Password>"
-    "      <TrustedCADirectory>.</TrustedCADirectory>"
+    "      ${TRUSTED_CA_DIR:+<TrustedCADir>}${TRUSTED_CA_DIR}${TRUSTED_CA_DIR:+</TrustedCADir>}"
     "    </Authentication>"
     "    <AccessControl>"
     "      <Library finalizeFunction=\"finalize_access_control\" initFunction=\"init_access_control\"/>"
@@ -61,6 +61,7 @@ static const char *config =
 
 #define DDS_DOMAINID1 0
 #define DDS_DOMAINID2 1
+#define MAX_ADDITIONAL_CONF 255
 
 static dds_entity_t g_domain1 = 0;
 static dds_entity_t g_participant1 = 0;
@@ -68,7 +69,7 @@ static dds_entity_t g_participant1 = 0;
 static dds_entity_t g_domain2 = 0;
 static dds_entity_t g_participant2 = 0;
 
-static void authentication_init(void)
+static void authentication_init(bool different_ca, const char * trusted_ca_dir, bool exp_pp_fail)
 {
   struct kvp governance_vars[] = {
     { "ALLOW_UNAUTH_PP", "false" },
@@ -82,38 +83,74 @@ static void authentication_init(void)
     { "TEST_IDENTITY_CERTIFICATE", TEST_IDENTITY_CERTIFICATE },
     { "TEST_IDENTITY_PRIVATE_KEY", TEST_IDENTITY_PRIVATE_KEY },
     { "TEST_IDENTITY_CA_CERTIFICATE", TEST_IDENTITY_CA_CERTIFICATE },
+    { "TRUSTED_CA_DIR", trusted_ca_dir },
     { NULL, NULL }
   };
+
   struct kvp config_vars2[] = {
     { "GOVERNANCE_DATA", gov_config_signed },
     { "TEST_IDENTITY_CERTIFICATE", TEST_IDENTITY2_CERTIFICATE },
     { "TEST_IDENTITY_PRIVATE_KEY", TEST_IDENTITY2_PRIVATE_KEY },
     { "TEST_IDENTITY_CA_CERTIFICATE", TEST_IDENTITY_CA2_CERTIFICATE },
+    { "TRUSTED_CA_DIR", trusted_ca_dir },
     { NULL, NULL }
   };
 
   char *conf1 = ddsrt_expand_vars (config, &expand_lookup_vars_env, config_vars1);
   char *conf2 = ddsrt_expand_vars (config, &expand_lookup_vars_env, config_vars2);
   g_domain1 = dds_create_domain (DDS_DOMAINID1, conf1);
-  g_domain2 = dds_create_domain (DDS_DOMAINID2, conf2);
+  g_domain2 = dds_create_domain (DDS_DOMAINID2, different_ca ? conf2 : conf1);
   dds_free (conf1);
   dds_free (conf2);
   ddsrt_free (gov_config_signed);
 
-  CU_ASSERT_FATAL ((g_participant1 = dds_create_participant (DDS_DOMAINID1, NULL, NULL)) > 0);
-  CU_ASSERT_FATAL ((g_participant2 = dds_create_participant (DDS_DOMAINID2, NULL, NULL)) > 0);
+  g_participant1 = dds_create_participant (DDS_DOMAINID1, NULL, NULL);
+  g_participant2 = dds_create_participant (DDS_DOMAINID2, NULL, NULL);
+  if (exp_pp_fail)
+  {
+    CU_ASSERT_FATAL (g_participant1 <= 0);
+    CU_ASSERT_FATAL (g_participant2 <= 0);
+  }
+  else
+  {
+    CU_ASSERT_FATAL (g_participant1 > 0);
+    CU_ASSERT_FATAL (g_participant2 > 0);
+  }
 }
 
-static void authentication_fini(void)
+static void authentication_fini(bool delete_pp)
 {
-  CU_ASSERT_EQUAL_FATAL (dds_delete (g_participant1), DDS_RETCODE_OK);
-  CU_ASSERT_EQUAL_FATAL (dds_delete (g_participant2), DDS_RETCODE_OK);
+  if (delete_pp)
+  {
+    CU_ASSERT_EQUAL_FATAL (dds_delete (g_participant1), DDS_RETCODE_OK);
+    CU_ASSERT_EQUAL_FATAL (dds_delete (g_participant2), DDS_RETCODE_OK);
+  }
   CU_ASSERT_EQUAL_FATAL (dds_delete (g_domain1), DDS_RETCODE_OK);
   CU_ASSERT_EQUAL_FATAL (dds_delete (g_domain2), DDS_RETCODE_OK);
 }
 
-CU_Test(ddssec_authentication, different_ca, .init = authentication_init, .fini = authentication_fini)
+CU_Test(ddssec_authentication, different_ca)
 {
+  authentication_init (true, NULL, false);
   validate_handshake (DDS_DOMAINID1, true, NULL, true, "error: unable to get local issuer certificate");
   validate_handshake (DDS_DOMAINID2, true, NULL, true, "error: unable to get local issuer certificate");
+  authentication_fini (true);
+}
+
+
+CU_TheoryDataPoints(ddssec_authentication, trusted_ca_dir) = {
+    CU_DataPoints(const char *, "",    ".",   "/nonexisting", NULL),
+    CU_DataPoints(bool,         false, false, true,           false)
+};
+
+CU_Theory((const char * ca_dir, bool exp_fail), ddssec_authentication, trusted_ca_dir)
+{
+  printf("Testing custom CA dir: %s\n", ca_dir);
+  authentication_init (false, ca_dir, exp_fail);
+  if (!exp_fail)
+  {
+    validate_handshake (DDS_DOMAINID1, false, NULL, false, NULL);
+    validate_handshake (DDS_DOMAINID2, false, NULL, false, NULL);
+  }
+  authentication_fini (!exp_fail);
 }
diff --git a/src/security/core/tests/handshake.c b/src/security/core/tests/handshake.c
index 6de2876..2eb52fc 100644
--- a/src/security/core/tests/handshake.c
+++ b/src/security/core/tests/handshake.c
@@ -44,8 +44,6 @@ static const char *config =
     "      <IdentityCertificate>"TEST_IDENTITY_CERTIFICATE"</IdentityCertificate>"
     "      <PrivateKey>"TEST_IDENTITY_PRIVATE_KEY"</PrivateKey>"
     "      <IdentityCA>"TEST_IDENTITY_CA_CERTIFICATE"</IdentityCA>"
-    "      <Password>testtext_Password_testtext</Password>"
-    "      <TrustedCADirectory>.</TrustedCADirectory>"
     "    </Authentication>"
     "    <AccessControl>"
     "      <Library finalizeFunction=\"finalize_access_control\" initFunction=\"init_access_control\"/>"

From 28aa06915e11f17c8e29f39df25cd7793460d88b Mon Sep 17 00:00:00 2001
From: Dennis Potman <dennis.potman@adlinktech.com>
Date: Mon, 2 Mar 2020 13:05:05 +0100
Subject: [PATCH 113/238] Fixed bug in handshake happy-day test

Signed-off-by: Dennis Potman <dennis.potman@adlinktech.com>
---
 src/security/core/tests/common/handshake_test_utils.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/src/security/core/tests/common/handshake_test_utils.c b/src/security/core/tests/common/handshake_test_utils.c
index 5385fe5..6d2e494 100644
--- a/src/security/core/tests/common/handshake_test_utils.c
+++ b/src/security/core/tests/common/handshake_test_utils.c
@@ -145,9 +145,9 @@ static bool handle_begin_handshake_request(dds_domainid_t domain_id, DDS_Securit
   if ((msg = test_authentication_plugin_take_msg(domain_id, MESSAGE_KIND_BEGIN_HANDSHAKE_REQUEST, lid, rid, 0, TIMEOUT)))
   {
     add_handshake(msg->hsHandle, 1, msg->lidHandle, msg->ridHandle, msg->result);
-    if (msg->result == DDS_SECURITY_VALIDATION_OK)
+    if (msg->result != DDS_SECURITY_VALIDATION_FAILED)
       result = handle_process_message(domain_id, msg->hsHandle);
-    else if (msg->result == DDS_SECURITY_VALIDATION_FAILED && err_msg)
+    else if (err_msg)
       *err_msg = ddsrt_strdup (msg->err_msg);
     test_authentication_plugin_release_msg(msg);
   }
@@ -162,9 +162,9 @@ static bool handle_begin_handshake_reply(dds_domainid_t domain_id, DDS_Security_
   if ((msg = test_authentication_plugin_take_msg(domain_id, MESSAGE_KIND_BEGIN_HANDSHAKE_REPLY, lid, rid, 0, TIMEOUT)))
   {
     add_handshake(msg->hsHandle, 0, msg->lidHandle, msg->ridHandle, msg->result);
-    if (msg->result == DDS_SECURITY_VALIDATION_OK)
+    if (msg->result != DDS_SECURITY_VALIDATION_FAILED)
       result = handle_process_message(domain_id, msg->hsHandle);
-    else if (msg->result == DDS_SECURITY_VALIDATION_FAILED && err_msg)
+    else if (err_msg)
       *err_msg = ddsrt_strdup (msg->err_msg);
     test_authentication_plugin_release_msg(msg);
   }

From 8f464e0c99ddea7c13d6f6ff7ca7c2b0a71a76fb Mon Sep 17 00:00:00 2001
From: Dennis Potman <dennis.potman@adlinktech.com>
Date: Mon, 2 Mar 2020 14:58:31 +0100
Subject: [PATCH 114/238] Fix writer-reader sync in secure_communication tests

Signed-off-by: Dennis Potman <dennis.potman@adlinktech.com>
---
 src/security/core/tests/secure_communication.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/src/security/core/tests/secure_communication.c b/src/security/core/tests/secure_communication.c
index c8ac8df..54882e4 100644
--- a/src/security/core/tests/secure_communication.c
+++ b/src/security/core/tests/secure_communication.c
@@ -252,11 +252,11 @@ static void test_fini(size_t n_sub_domain, size_t n_pub_domain)
 
 static void sync_writer_to_readers(dds_entity_t pub_participant, dds_entity_t writer, size_t n_exp_rd)
 {
-  size_t found = 0;
   dds_attach_t triggered;
   dds_return_t ret;
   dds_entity_t waitset_wr = dds_create_waitset (pub_participant);
   CU_ASSERT_FATAL (waitset_wr > 0);
+  dds_publication_matched_status_t pub_matched;
 
   /* Sync writer to reader. */
   ret = dds_waitset_attach (waitset_wr, writer, writer);
@@ -264,9 +264,11 @@ static void sync_writer_to_readers(dds_entity_t pub_participant, dds_entity_t wr
   while (true)
   {
     ret = dds_waitset_wait (waitset_wr, &triggered, 1, DDS_SECS(5));
-    CU_ASSERT_FATAL(ret >= 1);
+    CU_ASSERT_FATAL (ret >= 1);
     CU_ASSERT_EQUAL_FATAL (writer, (dds_entity_t)(intptr_t) triggered);
-    if ((found += (size_t)ret) >= n_exp_rd)
+    ret = dds_get_publication_matched_status(writer, &pub_matched);
+    CU_ASSERT_EQUAL_FATAL (ret, DDS_RETCODE_OK);
+    if (pub_matched.total_count >= n_exp_rd)
       break;
   };
   dds_delete (waitset_wr);

From ea10dbd8e162c95aa96a56298837d75c789839ba Mon Sep 17 00:00:00 2001
From: Dennis Potman <dennis.potman@adlinktech.com>
Date: Tue, 3 Mar 2020 12:14:39 +0100
Subject: [PATCH 115/238] Fixes in security core tests: add check that all
 provided vars are used in variable expansion for test configs, add note on
 concurrency in authentication wrapper, replace assert by cunit assert in
 crypto wrapper

Signed-off-by: Dennis Potman <dennis.potman@adlinktech.com>
---
 src/security/core/tests/CMakeLists.txt        |  5 ++-
 src/security/core/tests/authentication.c      | 34 +++++++----------
 .../tests/common/authentication_wrapper.c     | 37 ++++++++++++++-----
 .../core/tests/common/cryptography_wrapper.c  | 11 +++---
 .../tests/common/security_config_test_utils.c | 20 +++++++++-
 .../tests/common/security_config_test_utils.h |  2 +
 .../core/tests/secure_communication.c         | 24 ++++++------
 7 files changed, 83 insertions(+), 50 deletions(-)

diff --git a/src/security/core/tests/CMakeLists.txt b/src/security/core/tests/CMakeLists.txt
index 9fcc0c0..af2b446 100644
--- a/src/security/core/tests/CMakeLists.txt
+++ b/src/security/core/tests/CMakeLists.txt
@@ -46,6 +46,9 @@ function(add_wrapper libname linklibs)
     set_target_properties("dds_security_${libname}_wrapper" PROPERTIES LINK_FLAGS "-undefined dynamic_lookup")
   endif()
 
+  target_link_libraries("dds_security_${libname}_wrapper" PRIVATE CUnit)
+  target_include_directories("dds_security_${libname}_wrapper" PRIVATE "${CUNIT_DIR}/include")
+
   target_link_libraries("dds_security_${libname}_wrapper" PUBLIC ddsc ${linklibs})
   target_sources("dds_security_${libname}_wrapper" PRIVATE ${srcs_wrapper})
   target_include_directories("dds_security_${libname}_wrapper"
@@ -87,7 +90,7 @@ endif()
 
 target_include_directories(
   cunit_security_core PRIVATE
-  "$<BUILD_INTERFACE:${CMAKE_BINARY_DIR}/src/include/>"
+        "$<BUILD_INTERFACE:${CMAKE_BINARY_DIR}/src/include/>"
         "$<BUILD_INTERFACE:$<TARGET_PROPERTY:ddsrt,INTERFACE_INCLUDE_DIRECTORIES>>"
         "$<BUILD_INTERFACE:$<TARGET_PROPERTY:ddsc,INTERFACE_INCLUDE_DIRECTORIES>>"
         "$<BUILD_INTERFACE:$<TARGET_PROPERTY:security_core,INTERFACE_INCLUDE_DIRECTORIES>>"
diff --git a/src/security/core/tests/authentication.c b/src/security/core/tests/authentication.c
index c1e022d..1ed8ce6 100644
--- a/src/security/core/tests/authentication.c
+++ b/src/security/core/tests/authentication.c
@@ -38,7 +38,7 @@ static const char *config =
     "${CYCLONEDDS_URI}${CYCLONEDDS_URI:+,}"
     "<Discovery><ExternalDomainId>0</ExternalDomainId></Discovery>"
     "<Domain id=\"any\">"
-    "  <Tracing><Verbosity>finest</></>"
+    "  <Tracing><Verbosity>config</></>"
     "  <DDSSecurity>"
     "    <Authentication>"
     "      <Library finalizeFunction=\"finalize_test_authentication_wrapped\" initFunction=\"init_test_authentication_wrapped\" path=\"" WRAPPERLIB_PATH("dds_security_authentication_wrapper") "\"/>"
@@ -71,38 +71,30 @@ static dds_entity_t g_participant2 = 0;
 
 static void authentication_init(bool different_ca, const char * trusted_ca_dir, bool exp_pp_fail)
 {
-  struct kvp governance_vars[] = {
-    { "ALLOW_UNAUTH_PP", "false" },
-    { "ENABLE_JOIN_AC", "true" },
-    { NULL, NULL }
-  };
-  char * gov_config_signed = get_governance_config (governance_vars);
-
   struct kvp config_vars1[] = {
-    { "GOVERNANCE_DATA", gov_config_signed },
-    { "TEST_IDENTITY_CERTIFICATE", TEST_IDENTITY_CERTIFICATE },
-    { "TEST_IDENTITY_PRIVATE_KEY", TEST_IDENTITY_PRIVATE_KEY },
-    { "TEST_IDENTITY_CA_CERTIFICATE", TEST_IDENTITY_CA_CERTIFICATE },
-    { "TRUSTED_CA_DIR", trusted_ca_dir },
-    { NULL, NULL }
+    { "TEST_IDENTITY_CERTIFICATE", TEST_IDENTITY_CERTIFICATE, 1 },
+    { "TEST_IDENTITY_PRIVATE_KEY", TEST_IDENTITY_PRIVATE_KEY, 1 },
+    { "TEST_IDENTITY_CA_CERTIFICATE", TEST_IDENTITY_CA_CERTIFICATE, 1 },
+    { "TRUSTED_CA_DIR", trusted_ca_dir, 3 },
+    { NULL, NULL, 0 }
   };
 
   struct kvp config_vars2[] = {
-    { "GOVERNANCE_DATA", gov_config_signed },
-    { "TEST_IDENTITY_CERTIFICATE", TEST_IDENTITY2_CERTIFICATE },
-    { "TEST_IDENTITY_PRIVATE_KEY", TEST_IDENTITY2_PRIVATE_KEY },
-    { "TEST_IDENTITY_CA_CERTIFICATE", TEST_IDENTITY_CA2_CERTIFICATE },
-    { "TRUSTED_CA_DIR", trusted_ca_dir },
-    { NULL, NULL }
+    { "TEST_IDENTITY_CERTIFICATE", TEST_IDENTITY2_CERTIFICATE, 1 },
+    { "TEST_IDENTITY_PRIVATE_KEY", TEST_IDENTITY2_PRIVATE_KEY, 1 },
+    { "TEST_IDENTITY_CA_CERTIFICATE", TEST_IDENTITY_CA2_CERTIFICATE, 1 },
+    { "TRUSTED_CA_DIR", trusted_ca_dir, 3 },
+    { NULL, NULL, 0 }
   };
 
   char *conf1 = ddsrt_expand_vars (config, &expand_lookup_vars_env, config_vars1);
   char *conf2 = ddsrt_expand_vars (config, &expand_lookup_vars_env, config_vars2);
+  CU_ASSERT_EQUAL_FATAL (expand_lookup_unmatched (config_vars1), 0);
+  CU_ASSERT_EQUAL_FATAL (expand_lookup_unmatched (config_vars2), 0);
   g_domain1 = dds_create_domain (DDS_DOMAINID1, conf1);
   g_domain2 = dds_create_domain (DDS_DOMAINID2, different_ca ? conf2 : conf1);
   dds_free (conf1);
   dds_free (conf2);
-  ddsrt_free (gov_config_signed);
 
   g_participant1 = dds_create_participant (DDS_DOMAINID1, NULL, NULL);
   g_participant2 = dds_create_participant (DDS_DOMAINID2, NULL, NULL);
diff --git a/src/security/core/tests/common/authentication_wrapper.c b/src/security/core/tests/common/authentication_wrapper.c
index b794a3e..0ab9882 100644
--- a/src/security/core/tests/common/authentication_wrapper.c
+++ b/src/security/core/tests/common/authentication_wrapper.c
@@ -46,7 +46,8 @@ struct dds_security_authentication_impl
 };
 
 static struct dds_security_authentication_impl **auth_impl;
-static size_t auth_impl_count = 0;
+static size_t auth_impl_idx = 0;
+static size_t auth_impl_use = 0;
 
 static const char *test_identity_certificate = TEST_IDENTITY_CERTIFICATE_DUMMY;
 static const char *test_private_key          = TEST_IDENTITY_PRIVATE_KEY_DUMMY;
@@ -436,11 +437,10 @@ static DDS_Security_boolean test_return_sharedsecret_handle(
 
 static struct dds_security_authentication_impl * get_impl_for_domain(dds_domainid_t domain_id)
 {
-  for (size_t i = 0; i < auth_impl_count; i++)
+  for (size_t i = 0; i < auth_impl_idx; i++)
   {
-    if (auth_impl[i]->gv->config.domainId == domain_id)
+    if (auth_impl[i] && auth_impl[i]->gv->config.domainId == domain_id)
     {
-      assert(auth_impl[i]);
       return auth_impl[i];
     }
   }
@@ -531,6 +531,10 @@ int32_t finalize_test_authentication_init_error(void *context)
   return 0;
 }
 
+/**
+ * Init and fini functions for using wrapped mode for the authentication plugin.
+ * These functions assumes that there are no concurrent calls, as the static
+ * variables used here are not protected by a lock. */
 int32_t init_test_authentication_wrapped(const char *argument, void **context)
 {
   int32_t ret;
@@ -544,10 +548,10 @@ int32_t init_test_authentication_wrapped(const char *argument, void **context)
 
   ret = init_authentication(argument, (void **)&impl->instance);
 
-  auth_impl_count++;
-  auth_impl = ddsrt_realloc(auth_impl, auth_impl_count * sizeof(*auth_impl));
-  auth_impl[auth_impl_count - 1] = impl;
-
+  auth_impl_idx++;
+  auth_impl = ddsrt_realloc(auth_impl, auth_impl_idx * sizeof(*auth_impl));
+  auth_impl[auth_impl_idx - 1] = impl;
+  auth_impl_use++;
   *context = impl;
   return ret;
 }
@@ -559,8 +563,23 @@ int32_t finalize_test_authentication_wrapped(void *context)
   assert(impl->mode == PLUGIN_MODE_WRAPPED);
   deinit_message_queue(&impl->msg_queue);
   ret = finalize_authentication(impl->instance);
+
+  size_t idx;
+  for (idx = 0; idx < auth_impl_idx; idx++)
+    if (auth_impl[idx] == impl)
+      break;
+  assert (idx < auth_impl_idx);
+  auth_impl[idx] = NULL;
+
   ddsrt_free(context);
-  auth_impl_count--;
+
+  if (--auth_impl_use == 0)
+  {
+    ddsrt_free (auth_impl);
+    auth_impl = NULL;
+    auth_impl_idx = 0;
+  }
+
   return ret;
 }
 
diff --git a/src/security/core/tests/common/cryptography_wrapper.c b/src/security/core/tests/common/cryptography_wrapper.c
index ad9346b..f220c5c 100644
--- a/src/security/core/tests/common/cryptography_wrapper.c
+++ b/src/security/core/tests/common/cryptography_wrapper.c
@@ -11,6 +11,7 @@
  */
 #include <string.h>
 #include <stdio.h>
+#include "CUnit/Test.h"
 #include "dds/dds.h"
 #include "dds/ddsrt/heap.h"
 #include "dds/ddsrt/sync.h"
@@ -74,15 +75,15 @@ void set_protection_kinds(
   impl->payload_protection_kind = payload_protection_kind;
 }
 
-static unsigned char * find_buffer_match(unsigned char *input, size_t input_len, unsigned char *match, size_t match_len)
+static unsigned char * find_buffer_match(const unsigned char *input, size_t input_len, const unsigned char *match, size_t match_len)
 {
   if (match_len <= input_len && match_len > 0 && input_len > 0)
   {
-    unsigned char *match_end = match + match_len;
-    unsigned char *i = input;
+    const unsigned char *match_end = match + match_len;
+    unsigned char *i = (unsigned char *) input;
     while (i <= input + input_len - match_len)
     {
-      unsigned char *m = match, *j = i;
+      unsigned char *m = (unsigned char *) match, *j = i;
       while (*m == *j && j < input + input_len)
       {
         j++;
@@ -113,7 +114,7 @@ static DDS_Security_long_long check_handle(DDS_Security_long_long handle)
 {
   /* Assume that handle, which actually is a pointer, has a value that is likely to be
      a valid memory address and not a value returned by the mock implementation. */
-  assert (handle == 0 || handle > 4096);
+  CU_ASSERT_FATAL (handle == 0 || handle > 4096);
   return handle;
 }
 
diff --git a/src/security/core/tests/common/security_config_test_utils.c b/src/security/core/tests/common/security_config_test_utils.c
index c67a4d8..c6e939b 100644
--- a/src/security/core/tests/common/security_config_test_utils.c
+++ b/src/security/core/tests/common/security_config_test_utils.c
@@ -61,11 +61,14 @@ static const char *governance_xml =
 
 const char * expand_lookup_vars(const char *name, void * data)
 {
-  const struct kvp *vars = (struct kvp *)data;
+  struct kvp *vars = (struct kvp *)data;
   for (uint32_t i = 0; vars[i].key != NULL; i++)
   {
     if (!strcmp(vars[i].key, name))
+    {
+      vars[i].count--;
       return vars[i].value;
+    }
   }
   return NULL;
 }
@@ -78,6 +81,21 @@ const char * expand_lookup_vars_env(const char *name, void * data)
   return ((ddsrt_getenv(name, &env)) == DDS_RETCODE_OK) ? env : NULL;
 }
 
+int32_t expand_lookup_unmatched (const struct kvp * lookup_table)
+{
+  int32_t unmatched = 0;
+  for (uint32_t i = 0; lookup_table[i].key != NULL; i++)
+  {
+    int32_t c = lookup_table[i].count;
+    if (c > 0 && unmatched >= INT32_MAX - c)
+      return INT32_MAX;
+    if (c < 0 && unmatched <= INT32_MIN - c)
+      return INT32_MIN;
+    unmatched += c;
+  }
+  return unmatched;
+}
+
 static char * smime_sign(char * ca_cert_path, char * ca_priv_key_path, const char * data)
 {
   // Read CA certificate
diff --git a/src/security/core/tests/common/security_config_test_utils.h b/src/security/core/tests/common/security_config_test_utils.h
index d2c8635..ab14b7f 100644
--- a/src/security/core/tests/common/security_config_test_utils.h
+++ b/src/security/core/tests/common/security_config_test_utils.h
@@ -18,10 +18,12 @@
 struct kvp {
   const char *key;
   const char *value;
+  int32_t count;
 };
 
 const char * expand_lookup_vars (const char *name, void * data);
 const char * expand_lookup_vars_env (const char *name, void * data);
+int32_t expand_lookup_unmatched (const struct kvp * lookup_table);
 
 char * get_governance_config (struct kvp *config_vars);
 
diff --git a/src/security/core/tests/secure_communication.c b/src/security/core/tests/secure_communication.c
index 54882e4..9270a57 100644
--- a/src/security/core/tests/secure_communication.c
+++ b/src/security/core/tests/secure_communication.c
@@ -69,7 +69,7 @@ static const char *config =
     "      <Permissions>file:" COMMON_ETC_PATH("default_permissions.p7s") "</Permissions>"
     "    </AccessControl>"
     "    <Cryptographic>"
-    "      <Library finalizeFunction=\"${CRYPTO_FINI}\" initFunction=\"${CRYPTO_INIT}\" path=\"" WRAPPERLIB_PATH("dds_security_cryptography_wrapper") "\"/>"
+    "      <Library finalizeFunction=\"finalize_test_cryptography_wrapped\" initFunction=\"init_test_cryptography_wrapped\" path=\"" WRAPPERLIB_PATH("dds_security_cryptography_wrapper") "\"/>"
     "    </Cryptographic>"
     "  </DDSSecurity>"
     "</Domain>";
@@ -200,12 +200,12 @@ static void test_init(const struct domain_sec_config * domain_config, size_t n_s
   assert (n_pub_participants < MAX_PARTICIPANTS);
 
   struct kvp governance_vars[] = {
-    { "DISCOVERY_PROTECTION_KIND", pk_to_str (domain_config->discovery_pk) },
-    { "LIVELINESS_PROTECTION_KIND", pk_to_str (domain_config->liveliness_pk) },
-    { "RTPS_PROTECTION_KIND", pk_to_str (domain_config->rtps_pk) },
-    { "METADATA_PROTECTION_KIND", pk_to_str (domain_config->metadata_pk) },
-    { "DATA_PROTECTION_KIND", bpk_to_str (domain_config->payload_pk) },
-    { NULL, NULL }
+    { "DISCOVERY_PROTECTION_KIND", pk_to_str (domain_config->discovery_pk), 1 },
+    { "LIVELINESS_PROTECTION_KIND", pk_to_str (domain_config->liveliness_pk), 1 },
+    { "RTPS_PROTECTION_KIND", pk_to_str (domain_config->rtps_pk), 1 },
+    { "METADATA_PROTECTION_KIND", pk_to_str (domain_config->metadata_pk), 1 },
+    { "DATA_PROTECTION_KIND", bpk_to_str (domain_config->payload_pk), 1 },
+    { NULL, NULL, 0 }
   };
 
   printf("Governance configuration: ");
@@ -215,10 +215,8 @@ static void test_init(const struct domain_sec_config * domain_config, size_t n_s
   char * gov_config_signed = get_governance_config (governance_vars);
 
   struct kvp config_vars[] = {
-    { "GOVERNANCE_DATA", gov_config_signed },
-    { "CRYPTO_INIT", "init_test_cryptography_wrapped" },
-    { "CRYPTO_FINI", "finalize_test_cryptography_wrapped" },
-    { NULL, NULL }
+    { "GOVERNANCE_DATA", gov_config_signed, 1 },
+    { NULL, NULL, 0 }
   };
 
   char *conf_pub = ddsrt_expand_vars (config, &expand_lookup_vars_env, config_vars);
@@ -454,7 +452,7 @@ CU_TheoryDataPoints(ddssec_secure_communication, multiple_readers) = {
     CU_DataPoints(size_t, 1, 3, 1, 3), /* number of participants per domain */
     CU_DataPoints(size_t, 3, 1, 3, 3), /* number of readers per participant */
 };
-CU_Theory((size_t n_dom, size_t n_pp, size_t n_rd), ddssec_secure_communication, multiple_readers, .timeout = 60)
+CU_Theory((size_t n_dom, size_t n_pp, size_t n_rd), ddssec_secure_communication, multiple_readers, .timeout = 60, .disabled = true)
 {
   DDS_Security_ProtectionKind metadata_pk[] = { PK_N, PK_SOA, PK_EOA };
   DDS_Security_BasicProtectionKind payload_pk[] = { BPK_N, BPK_S, BPK_E };
@@ -473,7 +471,7 @@ CU_TheoryDataPoints(ddssec_secure_communication, multiple_readers_writers) = {
     CU_DataPoints(size_t, 1, 1, 2), /* number of writer domains */
     CU_DataPoints(size_t, 1, 3, 3), /* number of writers per domain */
 };
-CU_Theory((size_t n_rd_dom, size_t n_rd, size_t n_wr_dom, size_t n_wr), ddssec_secure_communication, multiple_readers_writers, .timeout = 60)
+CU_Theory((size_t n_rd_dom, size_t n_rd, size_t n_wr_dom, size_t n_wr), ddssec_secure_communication, multiple_readers_writers, .timeout = 60, .disabled = true)
 {
   DDS_Security_ProtectionKind metadata_pk[] = { PK_SOA, PK_EOA };
   for (size_t metadata = 0; metadata < sizeof (metadata_pk) / sizeof (metadata_pk[0]); metadata++)

From e7f5ae354c425199135deb71e5b9e2f129267378 Mon Sep 17 00:00:00 2001
From: Dennis Potman <dennis.potman@adlinktech.com>
Date: Wed, 4 Mar 2020 11:14:51 +0100
Subject: [PATCH 116/238] Fix security handshake test

Isolate domains by using unique tags when running tests that are using security handshake.
And updated coding style and some minor refactoring in fsm and timed_cb tests.

Signed-off-by: Dennis Potman <dennis.potman@adlinktech.com>
---
 src/security/core/tests/CMakeLists.txt        |   6 +-
 src/security/core/tests/authentication.c      |  10 +-
 .../core/tests/common/config_env.h.in         |   2 +-
 src/security/core/tests/dds_security_core.c   | 546 -------------
 src/security/core/tests/fsm.c                 | 581 ++++++++++++++
 src/security/core/tests/handshake.c           |  38 +-
 .../core/tests/secure_communication.c         |   9 +-
 src/security/core/tests/tc_fsm.c              | 757 ------------------
 src/security/core/tests/timed_cb.c            | 374 +++++++++
 9 files changed, 990 insertions(+), 1333 deletions(-)
 delete mode 100644 src/security/core/tests/dds_security_core.c
 create mode 100644 src/security/core/tests/fsm.c
 delete mode 100644 src/security/core/tests/tc_fsm.c
 create mode 100644 src/security/core/tests/timed_cb.c

diff --git a/src/security/core/tests/CMakeLists.txt b/src/security/core/tests/CMakeLists.txt
index af2b446..5618269 100644
--- a/src/security/core/tests/CMakeLists.txt
+++ b/src/security/core/tests/CMakeLists.txt
@@ -62,8 +62,8 @@ function(add_wrapper libname linklibs)
 endfunction()
 
 set(security_core_test_sources
-    "tc_fsm.c"
-    "dds_security_core.c"
+    "fsm.c"
+    "timed_cb.c"
     "security_utils.c"
 )
 
@@ -102,8 +102,6 @@ target_include_directories(
 
 set(common_etc_dir "${CMAKE_CURRENT_SOURCE_DIR}/common/etc")
 set(plugin_wrapper_lib_dir "${CMAKE_CURRENT_BINARY_DIR}")
-file(TO_NATIVE_PATH "/" file_path_sep)
-string(REPLACE "\\" "\\\\" file_path_sep ${file_path_sep})
 configure_file("common/config_env.h.in" "common/config_env.h")
 
 target_link_libraries(cunit_security_core PRIVATE ddsc security_api SecurityCoreTests)
diff --git a/src/security/core/tests/authentication.c b/src/security/core/tests/authentication.c
index 1ed8ce6..2d13079 100644
--- a/src/security/core/tests/authentication.c
+++ b/src/security/core/tests/authentication.c
@@ -19,6 +19,7 @@
 #include "dds/version.h"
 #include "dds/ddsrt/cdtors.h"
 #include "dds/ddsrt/environ.h"
+#include "dds/ddsrt/process.h"
 #include "dds/ddsrt/heap.h"
 #include "dds/ddsrt/string.h"
 #include "dds/ddsi/q_config.h"
@@ -36,8 +37,11 @@
 
 static const char *config =
     "${CYCLONEDDS_URI}${CYCLONEDDS_URI:+,}"
-    "<Discovery><ExternalDomainId>0</ExternalDomainId></Discovery>"
     "<Domain id=\"any\">"
+    "  <Discovery>"
+    "    <ExternalDomainId>0</ExternalDomainId>"
+    "    <Tag>\\${CYCLONEDDS_PID}</Tag>"
+    "  </Discovery>"
     "  <Tracing><Verbosity>config</></>"
     "  <DDSSecurity>"
     "    <Authentication>"
@@ -87,8 +91,8 @@ static void authentication_init(bool different_ca, const char * trusted_ca_dir,
     { NULL, NULL, 0 }
   };
 
-  char *conf1 = ddsrt_expand_vars (config, &expand_lookup_vars_env, config_vars1);
-  char *conf2 = ddsrt_expand_vars (config, &expand_lookup_vars_env, config_vars2);
+  char *conf1 = ddsrt_expand_vars_sh (config, &expand_lookup_vars_env, config_vars1);
+  char *conf2 = ddsrt_expand_vars_sh (config, &expand_lookup_vars_env, config_vars2);
   CU_ASSERT_EQUAL_FATAL (expand_lookup_unmatched (config_vars1), 0);
   CU_ASSERT_EQUAL_FATAL (expand_lookup_unmatched (config_vars2), 0);
   g_domain1 = dds_create_domain (DDS_DOMAINID1, conf1);
diff --git a/src/security/core/tests/common/config_env.h.in b/src/security/core/tests/common/config_env.h.in
index a3773f1..d4811fc 100644
--- a/src/security/core/tests/common/config_env.h.in
+++ b/src/security/core/tests/common/config_env.h.in
@@ -12,7 +12,7 @@
 #ifndef CONFIG_ENV_H
 #define CONFIG_ENV_H
 
-#define FILE_PATH_SEP             "@file_path_sep@"
+#define FILE_PATH_SEP             "/"
 #define COMMON_ETC_DIR            "@common_etc_dir@"
 #define PLUGIN_WRAPPER_LIB_DIR    "@plugin_wrapper_lib_dir@"
 #define PLUGIN_WRAPPER_LIB_PREFIX "@CMAKE_SHARED_LIBRARY_PREFIX@"
diff --git a/src/security/core/tests/dds_security_core.c b/src/security/core/tests/dds_security_core.c
deleted file mode 100644
index aef1e4f..0000000
--- a/src/security/core/tests/dds_security_core.c
+++ /dev/null
@@ -1,546 +0,0 @@
-/*
- * Copyright(c) 2019 ADLINK Technology Limited and others
- *
- * This program and the accompanying materials are made available under the
- * terms of the Eclipse Public License v. 2.0 which is available at
- * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
- * v. 1.0 which is available at
- * http://www.eclipse.org/org/documents/edl-v10.php.
- *
- * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
- */
-
-#include <stdio.h>
-#include "CUnit/Test.h"
-
-#include "dds/security/core/dds_security_timed_cb.h"
-#include "dds/ddsrt/misc.h"
-
-#define SEQ_SIZE (16)
-
-typedef struct {
-    struct dds_security_timed_dispatcher_t *d;
-    dds_security_timed_cb_kind kind;
-    void *listener;
-    void *arg;
-    dds_time_t time;
-} tc__sequence_data;
-
-static int g_sequence_idx = 0;
-static tc__sequence_data g_sequence_array[SEQ_SIZE];
-
-static void simple_callback(struct dds_security_timed_dispatcher_t *d,
-        dds_security_timed_cb_kind kind,
-        void *listener,
-        void *arg)
-{
-    DDSRT_UNUSED_ARG(d);
-    DDSRT_UNUSED_ARG(kind);
-    DDSRT_UNUSED_ARG(listener);
-
-    if (*((bool *)arg) == false)
-    {
-        *((bool *)arg) = true;
-    }
-    else
-    {
-        *((bool *)arg) = false;
-    }
-}
-
-static int g_order_callback_idx = 0;
-static void* g_order_callback[2] = {(void*)NULL, (void*)NULL};
-static void order_callback(struct dds_security_timed_dispatcher_t *d,
-        dds_security_timed_cb_kind kind,
-        void *listener,
-        void *arg)
-{
-    DDSRT_UNUSED_ARG(d);
-    DDSRT_UNUSED_ARG(kind);
-    DDSRT_UNUSED_ARG(listener);
-
-    g_order_callback[g_order_callback_idx] = arg;
-    g_order_callback_idx++;
-}
-
-static void
-tc__callback(
-        struct dds_security_timed_dispatcher_t *d,
-        dds_security_timed_cb_kind kind,
-        void *listener,
-        void *arg)
-{
-    if (g_sequence_idx < SEQ_SIZE) {
-        g_sequence_array[g_sequence_idx].d = d;
-        g_sequence_array[g_sequence_idx].arg = arg;
-        g_sequence_array[g_sequence_idx].kind = kind;
-        g_sequence_array[g_sequence_idx].listener = listener;
-        g_sequence_array[g_sequence_idx].time = dds_time();
-    }
-    g_sequence_idx++;
-}
-
-CU_Test(dds_security_timed_cb, simple_test)
-{
-    struct dds_security_timed_cb_data *tcb = dds_security_timed_cb_new();
-    struct dds_security_timed_dispatcher_t *d1 = NULL;
-    static bool test_var = false;
-
-    dds_time_t now     = dds_time();
-    dds_time_t future  = now + DDS_SECS(2);
-
-    d1 = dds_security_timed_dispatcher_new(tcb);
-
-    CU_ASSERT_PTR_NOT_NULL_FATAL(d1);
-
-    dds_security_timed_dispatcher_add(tcb, d1, simple_callback, future, (void*)&test_var);
-
-    dds_security_timed_dispatcher_enable(tcb, d1, (void*)NULL);
-
-    CU_ASSERT_FALSE_FATAL(test_var);
-
-    dds_sleepfor(DDS_MSECS(500));
-
-    CU_ASSERT_FALSE_FATAL(test_var);
-
-    dds_sleepfor(DDS_SECS(2));
-
-    CU_ASSERT_TRUE_FATAL(test_var);
-
-    dds_security_timed_dispatcher_free(tcb, d1);
-
-    dds_security_timed_cb_free(tcb);
-}
-
-CU_Test(dds_security_timed_cb, simple_order)
-{
-    struct dds_security_timed_cb_data *tcb = dds_security_timed_cb_new();
-    struct dds_security_timed_dispatcher_t *d1 = NULL;
-    dds_time_t future;
-    dds_time_t future2;
-
-    d1 = dds_security_timed_dispatcher_new(tcb);
-    CU_ASSERT_PTR_NOT_NULL_FATAL(d1);
-    future  = dds_time() + DDS_MSECS(20);
-    future2  = future;
-    dds_security_timed_dispatcher_add(tcb, d1, order_callback, future, (void*)1);
-    dds_security_timed_dispatcher_add(tcb, d1, order_callback, future2, (void*)2);
-    dds_security_timed_dispatcher_enable(tcb, d1, (void*)&g_order_callback);
-    dds_sleepfor(DDS_MSECS(10));
-
-    dds_security_timed_dispatcher_free(tcb, d1);
-
-    CU_ASSERT_EQUAL_FATAL(g_order_callback[0], (void*)1);
-    CU_ASSERT_EQUAL_FATAL(g_order_callback[1], (void*)2);
-
-    dds_security_timed_cb_free(tcb);
-}
-
-CU_Test(dds_security_timed_cb, test_enabled_and_disabled)
-{
-    struct dds_security_timed_cb_data *tcb = dds_security_timed_cb_new();
-    struct dds_security_timed_dispatcher_t *d1 = NULL;
-    static bool test_var = false;
-
-    dds_time_t now     = dds_time();
-    dds_time_t future  = now + DDS_SECS(2);
-
-    d1 = dds_security_timed_dispatcher_new(tcb);
-
-    CU_ASSERT_PTR_NOT_NULL_FATAL(d1);
-
-    dds_security_timed_dispatcher_add(tcb, d1, simple_callback, future, (void*)&test_var);
-
-    dds_security_timed_dispatcher_enable(tcb, d1, (void*)NULL);
-
-    CU_ASSERT_FALSE(test_var);
-
-    dds_security_timed_dispatcher_disable(tcb, d1);
-
-    dds_sleepfor(DDS_MSECS(500));
-
-    CU_ASSERT_FALSE(test_var);
-
-    dds_sleepfor(DDS_SECS(2));
-
-    CU_ASSERT_FALSE(test_var);
-
-    dds_security_timed_dispatcher_free(tcb, d1);
-
-    dds_security_timed_cb_free(tcb);
-}
-
-CU_Test(dds_security_timed_cb, simple_test_with_future)
-{
-    struct dds_security_timed_cb_data *tcb = dds_security_timed_cb_new();
-    struct dds_security_timed_dispatcher_t *d1 = NULL;
-    static bool test_var = false;
-
-    dds_time_t now     = dds_time();
-    dds_time_t future  = now + DDS_SECS(2);
-    dds_time_t far_future  = now + DDS_SECS(10);
-
-    d1 = dds_security_timed_dispatcher_new(tcb);
-
-    CU_ASSERT_PTR_NOT_NULL_FATAL(d1);
-
-    dds_security_timed_dispatcher_enable(tcb, d1, (void*)NULL);
-
-    dds_security_timed_dispatcher_add(tcb, d1, simple_callback, future, (void*)&test_var);
-    dds_security_timed_dispatcher_add(tcb, d1, simple_callback, far_future, (void*)&test_var);
-
-    CU_ASSERT_FALSE_FATAL(test_var);
-
-    dds_sleepfor(DDS_MSECS(500));
-
-    CU_ASSERT_FALSE_FATAL(test_var);
-
-    dds_sleepfor(DDS_SECS(2));
-
-    CU_ASSERT_TRUE_FATAL(test_var);
-
-    dds_security_timed_dispatcher_free(tcb, d1);
-
-    dds_security_timed_cb_free(tcb);
-}
-
-CU_Test(dds_security_timed_cb, test_multiple_dispatchers)
-{
-    struct dds_security_timed_cb_data *tcb = dds_security_timed_cb_new();
-    struct dds_security_timed_dispatcher_t *d1 = NULL;
-    struct dds_security_timed_dispatcher_t *d2 = NULL;
-    static bool test_var = false;
-
-    dds_time_t now     = dds_time();
-    dds_time_t future  = now + DDS_SECS(2);
-    dds_time_t far_future  = now + DDS_SECS(10);
-
-    d1 = dds_security_timed_dispatcher_new(tcb);
-    d2 = dds_security_timed_dispatcher_new(tcb);
-
-    CU_ASSERT_PTR_NOT_NULL_FATAL(d1);
-
-    dds_security_timed_dispatcher_enable(tcb, d1, (void*)NULL);
-    dds_security_timed_dispatcher_enable(tcb, d2, (void*)NULL);
-
-    dds_security_timed_dispatcher_free(tcb, d2);
-
-    dds_security_timed_dispatcher_add(tcb, d1, simple_callback, future, (void*)&test_var);
-    dds_security_timed_dispatcher_add(tcb, d1, simple_callback, far_future, (void*)&test_var);
-
-    CU_ASSERT_FALSE_FATAL(test_var);
-
-    dds_sleepfor(DDS_MSECS(500));
-
-    CU_ASSERT_FALSE_FATAL(test_var);
-
-    dds_sleepfor(DDS_SECS(2));
-
-    CU_ASSERT_TRUE_FATAL(test_var);
-
-    dds_security_timed_dispatcher_free(tcb, d1);
-
-    dds_security_timed_cb_free(tcb);
-}
-
-CU_Test(dds_security_timed_cb, test_not_enabled_multiple_dispatchers)
-{
-    struct dds_security_timed_cb_data *tcb = dds_security_timed_cb_new();
-    struct dds_security_timed_dispatcher_t *d1 = NULL;
-    struct dds_security_timed_dispatcher_t *d2 = NULL;
-
-    d1 = dds_security_timed_dispatcher_new(tcb);
-    d2 = dds_security_timed_dispatcher_new(tcb);
-
-    CU_ASSERT_PTR_NOT_NULL_FATAL(d1);
-    CU_ASSERT_PTR_NOT_NULL_FATAL(d2);
-
-    dds_security_timed_dispatcher_free(tcb, d2);
-
-    dds_security_timed_dispatcher_free(tcb, d1);
-
-    dds_security_timed_cb_free(tcb);
-
-    CU_PASS("Timed callbacks enabled and disabled without add");
-}
-
-CU_Test(dds_security_timed_cb, test_create_dispatcher)
-{
-    struct dds_security_timed_cb_data *tcb = dds_security_timed_cb_new();
-    struct dds_security_timed_dispatcher_t *d1 = NULL;
-    struct dds_security_timed_dispatcher_t *d2 = NULL;
-    struct dds_security_timed_dispatcher_t *d3 = NULL;
-    struct dds_security_timed_dispatcher_t *d4 = NULL;
-    struct dds_security_timed_dispatcher_t *d5 = NULL;
-    bool ok = false;
-
-    dds_time_t now     = dds_time();
-    dds_time_t past    = now - DDS_SECS(1);
-    dds_time_t present = now + DDS_SECS(1);
-    dds_time_t future  = present + DDS_SECS(1);
-    dds_time_t future2 = future + DDS_SECS(10);
-
-    /*************************************************************************
-     * Check if dispatchers can be created
-     *************************************************************************/
-    d1 = dds_security_timed_dispatcher_new(tcb);
-    d2 = dds_security_timed_dispatcher_new(tcb);
-    CU_ASSERT_PTR_NOT_NULL_FATAL(d1);
-    CU_ASSERT_PTR_NOT_NULL_FATAL(d2);
-
-    /*************************************************************************
-     * Check if adding callbacks succeeds
-     *************************************************************************/
-
-    /* The last argument is a sequence number in which
-     * the callbacks are expected to be called. */
-    /* We can only really check if it crashes or not... */
-    dds_security_timed_dispatcher_add(tcb, d1, tc__callback, present, (void*)1);
-    dds_security_timed_dispatcher_add(tcb, d2, tc__callback, past,    (void*)0);
-    dds_security_timed_dispatcher_add(tcb, d2, tc__callback, present, (void*)2);
-    dds_security_timed_dispatcher_add(tcb, d1, tc__callback, future,  (void*)7);
-
-    CU_PASS("Added callbacks")
-
-    /*************************************************************************
-     * Check if dispatchers can be created
-     *************************************************************************/
-    d3 = dds_security_timed_dispatcher_new(tcb);
-    d4 = dds_security_timed_dispatcher_new(tcb);
-    d5 = dds_security_timed_dispatcher_new(tcb);
-
-    CU_ASSERT_PTR_NOT_NULL_FATAL(d3);
-    CU_ASSERT_PTR_NOT_NULL_FATAL(d4);
-    CU_ASSERT_PTR_NOT_NULL_FATAL(d5);
-
-
-    /*************************************************************************
-     * Check if enabling dispatchers succeeds
-     *************************************************************************/
-
-    /* The sleeps are added to get the timing between
-        * 'present' and 'past' callbacks right. */
-    /* We can only really check if it crashes or not... */
-    dds_sleepfor(DDS_MSECS(600));
-    dds_security_timed_dispatcher_enable(tcb, d1, (void*)NULL);
-    dds_security_timed_dispatcher_enable(tcb, d2, (void*)  d2);
-    dds_security_timed_dispatcher_enable(tcb, d3, (void*)NULL);
-    /* Specifically not enabling d4 and d5. */
-    dds_sleepfor(DDS_MSECS(600));
-    CU_PASS("Enabled dds_security_timed_dispatchers.");
-
-    /*************************************************************************
-     * Check if adding callbacks succeeds
-     *************************************************************************/
-
-    /* The last argument is a sequence number in which
-        * the callbacks are expected to be called. */
-    /* We can only really check if it crashes or not... */
-    dds_security_timed_dispatcher_add(tcb, d4, tc__callback, past,    (void*)99);
-    dds_security_timed_dispatcher_add(tcb, d2, tc__callback, future,  (void*) 8);
-    dds_security_timed_dispatcher_add(tcb, d3, tc__callback, future2, (void*) 9);
-    dds_security_timed_dispatcher_add(tcb, d1, tc__callback, past,    (void*) 3);
-    dds_security_timed_dispatcher_add(tcb, d1, tc__callback, future2, (void*)10);
-    dds_security_timed_dispatcher_add(tcb, d1, tc__callback, present, (void*) 4);
-    dds_security_timed_dispatcher_add(tcb, d2, tc__callback, present, (void*) 5);
-    dds_security_timed_dispatcher_add(tcb, d1, tc__callback, future,  (void*) 6);
-    dds_security_timed_dispatcher_add(tcb, d3, tc__callback, future2, (void*)11);
-    CU_PASS("Added callbacks.");
-
-
-    /*************************************************************************
-     * Check if timeout callbacks are triggered in the right sequence
-     *************************************************************************/
-
-    int idx;
-    int timeout = 200; /* 2 seconds */
-
-    /* Wait for the callbacks to have been triggered.
-        * Ignore the ones in the far future. */
-    while ((g_sequence_idx < 8) && (timeout > 0)) {
-        dds_sleepfor(DDS_MSECS(10));
-        timeout--;
-    }
-
-    /* Print and check sequence of triggered callbacks. */
-    for (idx = 0; (idx < g_sequence_idx) && (idx < SEQ_SIZE); idx++) {
-        int seq = (int)(long long)(g_sequence_array[idx].arg);
-        struct dds_security_timed_dispatcher_t *expected_d;
-        void *expected_l;
-
-        /*
-            * Sequence checks.
-            */
-        if ((seq == 1) || (seq == 6) || (seq == 3) || (seq == 10) || (seq == 4) || (seq == 7)) {
-            expected_d = d1;
-            expected_l = NULL;
-        } else if ((seq == 0) || (seq == 2) || (seq == 8) || (seq == 5)) {
-            expected_d = d2;
-            expected_l = d2;
-        } else if (seq == 9) {
-            expected_d = d3;
-            expected_l = NULL;
-        } else if (seq == 99) {
-            expected_d = d4;
-            expected_l = NULL;
-            CU_FAIL("Unexpected callback on a disabled dispatcher");
-            ok = false;
-        } else {
-            expected_d = NULL;
-            expected_l = NULL;
-            CU_FAIL(sprintf("Unknown sequence idx received %d", seq));
-            ok = false;
-        }
-
-        if (seq != idx) {
-            /* 6 and 7 order may be mixed since the order is not defined for same time stamp */
-            if (!((seq == 6 && idx == 7) || (seq == 7 && idx == 6)))
-            {
-                printf("Unexpected sequence ordering %d vs %d\n", seq, idx);
-                CU_FAIL("Unexpected sequence ordering");
-                ok = false;
-            }
-        }
-        if (seq > 8) {
-            CU_FAIL(sprintf("Unexpected sequence idx %d of the far future", seq));
-            ok = false;
-        }
-        if (idx > 8) {
-            CU_FAIL(sprintf("Too many callbacks %d", idx));
-            ok = false;
-        }
-
-        /*
-         * Callback contents checks.
-         */
-        if (expected_d != NULL) {
-            if (g_sequence_array[idx].d != expected_d) {
-                printf("Unexpected dispatcher %p vs %p\n", g_sequence_array[idx].d, expected_d);
-                CU_FAIL("Unexpected dispatcher");
-                ok = false;
-            }
-            if (g_sequence_array[idx].listener != expected_l) {
-                CU_FAIL(sprintf("Unexpected listener %p vs %p", g_sequence_array[idx].listener, expected_l));
-                ok = false;
-            }
-        }
-
-        /*
-         * Callback kind check.
-         */
-        if (g_sequence_array[idx].kind != DDS_SECURITY_TIMED_CB_KIND_TIMEOUT) {
-            CU_FAIL(sprintf("Unexpected kind %d vs %d", (int)g_sequence_array[idx].kind, (int)DDS_SECURITY_TIMED_CB_KIND_TIMEOUT));
-            ok = false;
-        }
-    }
-    if (g_sequence_idx < 8) {
-        CU_FAIL(sprintf("Received %d callbacks, while 9 are expected",
-                                g_sequence_idx + 1));
-        ok = false;
-    }
-    if (ok) {
-        CU_FAIL(sprintf("Received timeout callbacks."));
-    }
-
-    /* Reset callback index to catch the deletion ones. */
-    g_sequence_idx = 0;
-
-
-    /*************************************************************************
-     * Check if deleting succeeds with dispatchers in different states
-     *************************************************************************/
-    /* We can only really check if it crashes or not... */
-    if (d1) {
-        dds_security_timed_dispatcher_free(tcb, d1);
-    }
-    if (d2) {
-        dds_security_timed_dispatcher_free(tcb, d2);
-    }
-    if (d3) {
-        dds_security_timed_dispatcher_free(tcb, d3);
-    }
-    if (d4) {
-        dds_security_timed_dispatcher_free(tcb, d4);
-    }
-    if (d5) {
-        dds_security_timed_dispatcher_free(tcb, d5);
-    }
-    CU_PASS("Deleted dispatchers.");
-
-
-    /*************************************************************************
-     * Check if deletion callbacks are triggered
-     *************************************************************************/
-    if (ok) {
-        timeout = 200; /* 2 seconds */
-
-        /* Wait for the callbacks to have been triggered.
-         * Ignore the ones in the far future. */
-        while ((g_sequence_idx < 4) && (timeout > 0)) {
-            dds_sleepfor(DDS_MSECS(10));
-            timeout--;
-        }
-
-        /* Print and check sequence of triggered callbacks. */
-        for (idx = 0; (idx < g_sequence_idx) && (idx < SEQ_SIZE); idx++) {
-            int seq = (int)(long long)(g_sequence_array[idx].arg);
-            struct dds_security_timed_dispatcher_t *expected_d;
-
-            /*
-             * Human (somewhat) readable format.
-             */
-            // tc__sequence_data_print(&(g_sequence_array[idx]));
-
-            /*
-             * Sequence checks.
-             */
-            if (seq == 99) {
-                expected_d = d4;
-            } else if ((seq == 9) || (seq == 11)) {
-                expected_d = d3;
-            } else if (seq == 10) {
-                expected_d = d1;
-            } else {
-                expected_d = NULL;
-                CU_FAIL(sprintf("Unexpected sequence idx received %d", seq));
-                ok = false;
-            }
-            if (idx > 4) {
-                CU_FAIL(sprintf("Too many callbacks %d", idx));
-                ok = false;
-            }
-
-            /*
-             * Callback contents checks.
-             */
-            if (expected_d != NULL) {
-                if (g_sequence_array[idx].d != expected_d) {
-                    CU_FAIL(sprintf("Unexpected dispatcher %p vs %p", g_sequence_array[idx].d, expected_d));
-                    ok = false;
-                }
-                if (g_sequence_array[idx].listener != NULL) {
-                    CU_FAIL(sprintf("Unexpected listener %p vs NULL", g_sequence_array[idx].listener));
-                    ok = false;
-                }
-            }
-
-            /*
-             * Callback kind check.
-             */
-            if (g_sequence_array[idx].kind != DDS_SECURITY_TIMED_CB_KIND_DELETE) {
-                CU_FAIL(sprintf("Unexpected kind %d vs %d", (int)g_sequence_array[idx].kind, (int)DDS_SECURITY_TIMED_CB_KIND_TIMEOUT));
-                ok = false;
-            }
-        }
-        if (g_sequence_idx < 4) {
-            CU_FAIL(sprintf("Received %d callbacks, while 3 are expected",
-                                    g_sequence_idx + 1));
-            ok = false;
-        }
-        if (ok) {
-            CU_PASS("Received deletion callbacks.");
-        }
-    }
-
-    dds_security_timed_cb_free(tcb);
-}
diff --git a/src/security/core/tests/fsm.c b/src/security/core/tests/fsm.c
new file mode 100644
index 0000000..e947dfe
--- /dev/null
+++ b/src/security/core/tests/fsm.c
@@ -0,0 +1,581 @@
+/*
+ * Copyright(c) 2006 to 2018 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+#include <stdio.h>
+#include <stdbool.h>
+#include "CUnit/CUnit.h"
+#include "CUnit/Test.h"
+
+#include "dds/ddsrt/sync.h"
+#include "dds/ddsrt/misc.h"
+#include "dds/dds.h"
+#include "dds__types.h"
+#include "dds__entity.h"
+#include "dds/security/core/dds_security_fsm.h"
+
+#define CHECK_BIT(var, pos) ((var) & (1<<(pos)))
+#define FSM_AUTH_ARG 10
+
+static dds_entity_t g_participant = 0;
+static ddsrt_mutex_t g_lock;
+static struct dds_security_fsm_control *g_fsm_control = NULL;
+
+#define DO_SIMPLE(name, var, bit) static void name(struct dds_security_fsm *fsm, void *arg) { \
+  DDSRT_UNUSED_ARG(fsm); \
+  DDSRT_UNUSED_ARG(arg); \
+  printf("Transition %s\n", __FUNCTION__); \
+  ddsrt_mutex_lock(&g_lock); \
+  visited_##var |= 1u << (bit); \
+  ddsrt_mutex_unlock(&g_lock); \
+}
+
+typedef enum {
+  VALIDATION_PENDING_RETRY,
+  VALIDATION_FAILED,
+  VALIDATION_OK,
+  VALIDATION_OK_FINAL_MESSAGE,
+  VALIDATION_PENDING_HANDSHAKE_MESSAGE,
+  VALIDATION_PENDING_HANDSHAKE_REQUEST,
+  plugin_ret_MAX
+} plugin_ret;
+
+static struct dds_security_fsm *fsm_auth;
+static uint32_t visited_auth = 0;
+static uint32_t correct_fsm = 0;
+static uint32_t correct_arg = 0;
+static int validate_remote_identity_first = 1;
+static int begin_handshake_reply_first = 1;
+
+
+static plugin_ret validate_remote_identity(void)
+{
+  printf("validate_remote_identity - %d\n", validate_remote_identity_first);
+  if (validate_remote_identity_first)
+  {
+    validate_remote_identity_first = 0;
+    return VALIDATION_PENDING_RETRY;
+  }
+  return VALIDATION_PENDING_HANDSHAKE_MESSAGE;
+}
+
+static plugin_ret begin_handshake_reply(void)
+{
+  printf("begin_handshake_reply - %d\n", begin_handshake_reply_first);
+  if (begin_handshake_reply_first)
+  {
+    begin_handshake_reply_first = 0;
+    return VALIDATION_PENDING_RETRY;
+  }
+  return VALIDATION_OK_FINAL_MESSAGE;
+}
+
+static plugin_ret get_shared_secret(void)
+{
+  return VALIDATION_OK;
+}
+
+/* State actions */
+static void fsm_validate_remote_identity(struct dds_security_fsm *fsm, void *arg)
+{
+  DDSRT_UNUSED_ARG(arg);
+  plugin_ret ret = validate_remote_identity();
+  printf("[%p] State %s (ret %d)\n", fsm, __FUNCTION__, (int) ret);
+  dds_security_fsm_dispatch(fsm, (int32_t) ret, false);
+}
+
+static void fsm_begin_handshake_reply(struct dds_security_fsm *fsm, void *arg)
+{
+  DDSRT_UNUSED_ARG(arg);
+  plugin_ret ret = begin_handshake_reply();
+  if (ret == VALIDATION_OK_FINAL_MESSAGE)
+    ret = get_shared_secret();
+  printf("[%p] State %s (ret %d)\n", fsm, __FUNCTION__, (int) ret);
+  dds_security_fsm_dispatch(fsm, (int32_t) ret, false);
+}
+
+/* A few states from the handshake state-machine. */
+static dds_security_fsm_state StateValidateRemoteIdentity = {fsm_validate_remote_identity, 0};
+static dds_security_fsm_state StateValRemIdentityRetryWait = {NULL, 100000000};
+static dds_security_fsm_state StateHandshakeInitMessageWait = {NULL, 0};
+static dds_security_fsm_state state_beginHandshakeReply = {fsm_begin_handshake_reply, 0};
+static dds_security_fsm_state state_beginHsReplyWait = {NULL, 100000000};
+
+static void a(struct dds_security_fsm *fsm, void *arg)
+{
+  printf("[%p] Transition %s\n", fsm, __FUNCTION__);
+  ddsrt_mutex_lock (&g_lock);
+  if (arg != NULL)
+    correct_arg = *((int *)arg) == FSM_AUTH_ARG ? 1 : 0;
+  correct_fsm = (fsm == fsm_auth) ? 1 : 0;
+  visited_auth |= 1u << 0;
+  ddsrt_mutex_unlock (&g_lock);
+}
+
+DO_SIMPLE(b, auth, 1)
+DO_SIMPLE(c, auth, 2)
+DO_SIMPLE(d, auth, 3)
+DO_SIMPLE(e, auth, 4)
+DO_SIMPLE(f, auth, 5)
+DO_SIMPLE(g, auth, 6)
+DO_SIMPLE(h, auth, 7)
+
+#define SHM_MSG_RECEIVED (plugin_ret_MAX + 1)
+
+/*
+ * .--.
+ * |##|--------------------------------------.
+ * '--'       a()                            v
+ *                 .----------------------------------------------------.
+ *                 |            StateValidateRemoteIdentity             |
+ *                 |----------------------------------------------------|
+ *         .------>| fsm_validate_remote_identity()                     |
+ *         |       |    - dispatch VALIDATION_PENDING_RETRY             |
+ *    100ms|       |    - dispatch VALIDATION_PENDING_HANDSHAKE_MESSAGE |
+ *    d()  |       '----------------------------------------------------'
+ *         |          VALIDATION_PENDING_RETRY|  | VALIDATION_PENDING_HANDSHAKE_MESSAGE
+ *         |          b()                     |  | c()
+ *         |                                  |  |
+ * .------------------------------.           |  |       .-------------------------------.
+ * | StateValRemIdentityRetryWait |           |  |       | StateHandshakeInitMessageWait |
+ * |------------------------------|<----------'  '------>|-------------------------------|
+ * '------------------------------'                      '-------------------------------'
+ *                                                SHM_MSG_RECEIVED  |
+ *                                                e()               |
+ *                                                                  v
+ *                                      .----------------------------------------.
+ *          VALIDATION_PENDING_RETRY    |        state_beginHandshakeReply        |
+ *          f()                         |----------------------------------------|
+ *            .-------------------------| fsm_begin_handshake_reply()            |
+ *            |                         |    - dispatch VALIDATION_PENDING_RETRY |
+ *            v                         |    - dispatch VALIDATION_OK            |
+ * .-----------------------.    100ms   '----------------------------------------'
+ * | state_beginHsReplyWait |    h()                ^        VALIDATION_OK |
+ * |-----------------------|-----------------------'        g()           |
+ * '-----------------------'                                              v
+ *                                                                       .-.
+ *                                                                       '-'
+ */
+static dds_security_fsm_transition HandshakeTransistions[] = {
+    {NULL,                           DDS_SECURITY_FSM_EVENT_AUTO,          a, &StateValidateRemoteIdentity}, // NULL state is the start state
+    {&StateValidateRemoteIdentity,   VALIDATION_PENDING_RETRY,             b, &StateValRemIdentityRetryWait},
+    {&StateValidateRemoteIdentity,   VALIDATION_PENDING_HANDSHAKE_MESSAGE, c, &StateHandshakeInitMessageWait},
+    {&StateValRemIdentityRetryWait,  DDS_SECURITY_FSM_EVENT_TIMEOUT,       d, &StateValidateRemoteIdentity},
+    {&StateHandshakeInitMessageWait, SHM_MSG_RECEIVED,                     e, &state_beginHandshakeReply},
+    {&state_beginHandshakeReply,      VALIDATION_PENDING_RETRY,             f, &state_beginHsReplyWait},
+    {&state_beginHandshakeReply,      VALIDATION_OK,                        g, NULL}, // Reaching NULL means end of state-diagram
+    {&state_beginHsReplyWait,         DDS_SECURITY_FSM_EVENT_TIMEOUT,       h, &state_beginHandshakeReply}
+};
+static const uint32_t HandshakeTransistionsSize = sizeof(HandshakeTransistions)/sizeof(HandshakeTransistions[0]);
+
+
+/* Example State Machine properties and methods */
+typedef enum {
+    eventX, eventY, eventZ,
+} test_events;
+
+static struct dds_security_fsm *fsm_test;
+static uint32_t visited_test = 0;
+static int do_stuff_counter = 0;
+static int do_other_stuff_counter = 0;
+
+DO_SIMPLE(do_start, test, 0)
+DO_SIMPLE(do_restart, test, 1)
+DO_SIMPLE(do_event_stuff, test, 4)
+
+static void do_stuff(struct dds_security_fsm *fsm, void *arg)
+{
+  DDSRT_UNUSED_ARG(fsm);
+  DDSRT_UNUSED_ARG(arg);
+  printf("Transition %s - %d\n", __FUNCTION__, do_stuff_counter);
+  ddsrt_mutex_lock (&g_lock);
+  visited_test |= 1u << 2;
+  ddsrt_mutex_unlock (&g_lock);
+  if (do_stuff_counter < 2)
+    dds_security_fsm_dispatch(fsm, eventZ, false);
+  else if (do_stuff_counter == 2)
+    dds_security_fsm_dispatch(fsm, eventY, false);
+  ++do_stuff_counter;
+}
+
+static void do_other_stuff(struct dds_security_fsm *fsm, void *arg)
+{
+  DDSRT_UNUSED_ARG(fsm);
+  DDSRT_UNUSED_ARG(arg);
+  printf("Transition %s - %d\n", __FUNCTION__, do_other_stuff_counter);
+  ddsrt_mutex_lock (&g_lock);
+  visited_test |= 1u << 3;
+  ddsrt_mutex_unlock (&g_lock);
+  if (do_other_stuff_counter == 0)
+    dds_security_fsm_dispatch(fsm, DDS_SECURITY_FSM_EVENT_AUTO, false);
+  else if (do_other_stuff_counter == 1)
+    dds_security_fsm_dispatch(fsm, eventY, false);
+  else if (do_other_stuff_counter == 2)
+    dds_security_fsm_dispatch(fsm, eventX, false);
+  ++do_other_stuff_counter;
+}
+
+static dds_security_fsm_state state_a = {do_stuff, 0};
+static dds_security_fsm_state state_b = {do_stuff, 100000000};
+static dds_security_fsm_state state_c = {NULL, 0};
+static dds_security_fsm_state state_d = {do_other_stuff, 0};
+
+static dds_security_fsm_transition Transitions[] = {
+    {NULL,     DDS_SECURITY_FSM_EVENT_AUTO, do_start,       &state_a}, // NULL state is the start state
+    {&state_a, eventZ,                      NULL,           &state_b},
+    {&state_a, eventY,                      do_other_stuff, &state_c},
+    {&state_b, eventX,                      NULL,           NULL}, // Reaching NULL means end of state-diagram
+    {&state_b, eventZ,                      do_restart,     &state_a},
+    {&state_c, DDS_SECURITY_FSM_EVENT_AUTO, do_event_stuff, &state_d},
+    {&state_d, eventY,                      do_event_stuff, &state_d},
+    {&state_d, eventX,                      do_stuff,       NULL}, // Reaching NULL means end of sttimeoutate-diagram
+};
+static const uint32_t TransitionsSize = sizeof(Transitions)/sizeof(Transitions[0]);
+
+
+/* Timeout State Machine properties and methods */
+typedef enum {
+    event_to_timeout, event_to_interrupt, event_to_end,
+} timeout_events;
+
+struct fsm_timeout_arg {
+  int id;
+};
+
+static struct dds_security_fsm *fsm_timeout;
+static uint32_t visited_timeout = 0;
+static uint32_t correct_fsm_timeout = 0;
+static uint32_t correct_arg_timeout = 0;
+static struct fsm_timeout_arg fsm_arg = { .id = FSM_AUTH_ARG };
+
+DO_SIMPLE(do_interrupt, timeout, 0)
+DO_SIMPLE(timeout_cb2, timeout, 3)
+
+static void do_timeout(struct dds_security_fsm *fsm, void *arg)
+{
+  DDSRT_UNUSED_ARG(arg);
+  printf("Transition >>>> %s\n", __FUNCTION__);
+  ddsrt_mutex_lock (&g_lock);
+  visited_timeout |= 1u << 1;
+  ddsrt_mutex_unlock (&g_lock);
+  printf("Transition <<<< %s\n", __FUNCTION__);
+  dds_security_fsm_dispatch(fsm, event_to_timeout, false);
+}
+
+static void timeout_cb(struct dds_security_fsm *fsm, void *arg)
+{
+  struct fsm_timeout_arg *farg = arg;
+  printf("timeout_cb\n");
+  ddsrt_mutex_lock (&g_lock);
+  visited_timeout |= 1u << 2;
+  if (farg != NULL)
+    correct_arg_timeout = farg->id == FSM_AUTH_ARG ? 1 : 0;
+  correct_fsm_timeout =  fsm == fsm_timeout ? 1 : 0;
+  ddsrt_mutex_unlock (&g_lock);
+}
+
+static dds_security_fsm_state state_initial      = {do_timeout, 0};
+static dds_security_fsm_state state_wait_timeout = {NULL, DDS_SECS(4)};
+static dds_security_fsm_state state_interrupt    = {do_interrupt, 0};
+
+static const dds_security_fsm_transition timeout_transitions[] = {
+    {NULL,                DDS_SECURITY_FSM_EVENT_AUTO,    NULL, &state_initial},  // NULL state is the start state
+    {&state_initial,      event_to_timeout,               NULL, &state_wait_timeout},
+    {&state_wait_timeout, DDS_SECURITY_FSM_EVENT_TIMEOUT, NULL, &state_interrupt},
+    {&state_wait_timeout, event_to_interrupt,             NULL, &state_interrupt},
+    {&state_interrupt,    event_to_end,                   NULL, NULL},           // Reaching NULL means end of state-diagram
+};
+static const uint32_t timeout_transitionsSize = sizeof(timeout_transitions)/sizeof(timeout_transitions[0]);
+
+/* Parallel Timeout State Machines properties and methods */
+static struct dds_security_fsm *fsm_timeout1;
+static struct dds_security_fsm *fsm_timeout2;
+static struct dds_security_fsm *fsm_timeout3;
+
+static dds_time_t time0 = 0;
+static dds_time_t time1 = 0;
+static dds_time_t time2 = 0;
+static dds_time_t time3 = 0;
+
+static void state_par_time1(struct dds_security_fsm *fsm, void *arg)
+{
+  DDSRT_UNUSED_ARG(fsm);
+  DDSRT_UNUSED_ARG(arg);
+  time1 = dds_time();
+}
+
+static void state_par_time2(struct dds_security_fsm *fsm, void *arg)
+{
+  DDSRT_UNUSED_ARG(fsm);
+  DDSRT_UNUSED_ARG(arg);
+  time2 = dds_time();
+}
+
+static void state_par_time3(struct dds_security_fsm *fsm, void *arg)
+{
+  DDSRT_UNUSED_ARG(fsm);
+  DDSRT_UNUSED_ARG(arg);
+  time3 = dds_time();
+}
+
+static dds_security_fsm_state state_par_timeout1 = {NULL, DDS_SECS(1)};
+static dds_security_fsm_state state_par_timeout2 = {NULL, DDS_SECS(2)};
+static dds_security_fsm_state state_par_timeout3 = {NULL, DDS_SECS(1)};
+
+static dds_security_fsm_transition parallel_timeout_transitions_1[] = {
+    {NULL,                DDS_SECURITY_FSM_EVENT_AUTO,    NULL,             &state_par_timeout1}, // NULL state is the startfsm_control_thread state
+    {&state_par_timeout1, DDS_SECURITY_FSM_EVENT_TIMEOUT, &state_par_time1, NULL},              // Reaching NULL means end of state-diagram
+};
+static const uint32_t parallel_timeout_transitionsSize_1 = sizeof(parallel_timeout_transitions_1) / sizeof(parallel_timeout_transitions_1[0]);
+
+static dds_security_fsm_transition parallel_timeout_transitions_2[] = {
+    {NULL,                DDS_SECURITY_FSM_EVENT_AUTO,    NULL,             &state_par_timeout2}, // NULL state is the start state
+    {&state_par_timeout2, DDS_SECURITY_FSM_EVENT_TIMEOUT, &state_par_time2, NULL},              // Reaching NULL means end of state-diagram
+};
+static const uint32_t parallel_timeout_transitionsSize_2 = sizeof(parallel_timeout_transitions_2) / sizeof(parallel_timeout_transitions_2[0]);
+
+static dds_security_fsm_transition parallel_timeout_transitions_3[] = {
+    {NULL,                DDS_SECURITY_FSM_EVENT_AUTO,    NULL,             &state_par_timeout3}, // NULL state is the start state
+    {&state_par_timeout3, DDS_SECURITY_FSM_EVENT_TIMEOUT, &state_par_time3, NULL},              // Reaching NULL means end of state-diagram
+};
+static const uint32_t parallel_timeout_transitionsSize_3 = sizeof(parallel_timeout_transitions_3) / sizeof(parallel_timeout_transitions_3[0]);
+
+static void fsm_control_init(void)
+{
+  struct dds_entity *e;
+  g_participant = dds_create_participant(DDS_DOMAIN_DEFAULT, NULL, NULL);
+  CU_ASSERT_FATAL(g_participant > 0);
+  ddsrt_mutex_init(&g_lock);
+  dds_return_t rc = dds_entity_pin(g_participant, &e);
+  CU_ASSERT_FATAL(rc == 0);
+  g_fsm_control = dds_security_fsm_control_create(&e->m_domain->gv);
+  CU_ASSERT_FATAL(g_fsm_control != NULL);
+  dds_entity_unpin(e);
+  rc = dds_security_fsm_control_start(g_fsm_control, NULL);
+  CU_ASSERT_EQUAL_FATAL(rc, 0);
+}
+
+static void fsm_control_fini(void)
+{
+  dds_security_fsm_control_stop(g_fsm_control);
+  dds_security_fsm_control_free(g_fsm_control);
+  ddsrt_mutex_destroy (&g_lock);
+  dds_delete(g_participant);
+}
+
+CU_Test(ddssec_fsm, create, .init = fsm_control_init, .fini = fsm_control_fini)
+{
+  /* Test single running state machine. Check creation of a single State Machine */
+  fsm_auth = dds_security_fsm_create(g_fsm_control, HandshakeTransistions, HandshakeTransistionsSize, &fsm_arg);
+  CU_ASSERT_FATAL(fsm_auth != NULL)
+
+  /* set a delay that doesn't expire. Should be terminate when fsm is freed. */
+  dds_security_fsm_set_timeout(fsm_auth, timeout_cb, DDS_SECS(30));
+  dds_security_fsm_start(fsm_auth);
+
+  int n = 100;
+  while (dds_security_fsm_current_state(fsm_auth) != &StateHandshakeInitMessageWait && n-- > 0)
+    dds_sleepfor(DDS_MSECS(100));
+  CU_ASSERT(n > 0);
+  dds_security_fsm_dispatch(fsm_auth, SHM_MSG_RECEIVED, false);
+
+  n = 100;
+  while (dds_security_fsm_current_state(fsm_auth) != NULL && n-- > 0)
+    dds_sleepfor(DDS_MSECS(100));
+  CU_ASSERT(n > 0);
+
+  ddsrt_mutex_lock (&g_lock);
+  CU_ASSERT(visited_auth == 0xff);
+  ddsrt_mutex_unlock (&g_lock);
+
+  /* Check correct callback parameter passing (from fsm to user defined methods) */
+  CU_ASSERT(correct_arg && correct_fsm);
+  dds_security_fsm_free(fsm_auth);
+
+  /* Check whether timeout callback has NOT been invoked */
+  ddsrt_mutex_lock (&g_lock);
+  CU_ASSERT(visited_timeout == 0);
+  ddsrt_mutex_unlock (&g_lock);
+}
+
+/* Test multiple (2) running state machines */
+CU_Test(ddssec_fsm, multiple, .init = fsm_control_init, .fini = fsm_control_fini)
+{
+  validate_remote_identity_first = 0;
+  begin_handshake_reply_first = 0;
+  visited_auth = 0;
+  visited_test = 0;
+
+  fsm_auth = dds_security_fsm_create(g_fsm_control, HandshakeTransistions, HandshakeTransistionsSize, NULL);
+  CU_ASSERT_FATAL(fsm_auth != NULL);
+
+  fsm_test = dds_security_fsm_create(g_fsm_control, Transitions, TransitionsSize, NULL);
+  CU_ASSERT_FATAL(fsm_test != NULL);
+
+  dds_security_fsm_start(fsm_auth);
+  dds_security_fsm_start(fsm_test);
+
+  /* Check the results of multiple running State Machines */
+  int n = 100; /* 10 sec */
+  while (dds_security_fsm_current_state(fsm_auth) != &StateHandshakeInitMessageWait && n-- > 0)
+    dds_sleepfor(DDS_MSECS(100));
+  CU_ASSERT_FATAL(n > 0);
+
+  n = 100; /* 10 sec */
+  dds_security_fsm_dispatch(fsm_auth, SHM_MSG_RECEIVED, false);
+  while (dds_security_fsm_current_state(fsm_auth) != NULL && n-- > 0)
+    dds_sleepfor(DDS_MSECS(100));
+  CU_ASSERT_FATAL(n > 0);
+
+  // not all bits are set since we're running the state machine a second time
+  ddsrt_mutex_lock (&g_lock);
+  CU_ASSERT_FATAL(visited_auth == 0x55);
+  ddsrt_mutex_unlock (&g_lock);
+
+  /* Wait for the last state to occur */
+  n = 100; /* 10 sec */
+  while (dds_security_fsm_current_state(fsm_test) != NULL && n-- > 0)
+    dds_sleepfor(DDS_MSECS(100));
+  CU_ASSERT_FATAL(n > 0);
+
+  ddsrt_mutex_lock (&g_lock);
+  CU_ASSERT(visited_test == 0x1f);
+  ddsrt_mutex_unlock (&g_lock);
+
+  dds_security_fsm_free(fsm_auth);
+  dds_security_fsm_free(fsm_test);
+
+}
+
+/**
+ * Check creation of State Machine for timeout purposes
+ */
+CU_Test(ddssec_fsm, timeout, .init = fsm_control_init, .fini = fsm_control_fini)
+{
+  visited_timeout = 0;
+  /* Test timeout monitoring of state machines */
+  fsm_timeout = dds_security_fsm_create(g_fsm_control, timeout_transitions, timeout_transitionsSize, &fsm_arg);
+  CU_ASSERT(fsm_timeout != NULL);
+  dds_security_fsm_set_timeout(fsm_timeout, timeout_cb, DDS_SECS(1));
+  dds_security_fsm_start(fsm_timeout);
+
+  int n = 100; /* 10 sec */
+  ddsrt_mutex_lock (&g_lock);
+  while (visited_timeout != 0x7 && n-- > 0)
+  {
+    ddsrt_mutex_unlock (&g_lock);
+    dds_sleepfor(DDS_MSECS(100));
+    ddsrt_mutex_lock (&g_lock);
+  }
+  CU_ASSERT(n > 0);
+  CU_ASSERT(visited_timeout == 0x7);
+  CU_ASSERT(correct_arg_timeout && correct_fsm_timeout);
+  ddsrt_mutex_unlock (&g_lock);
+  dds_security_fsm_free(fsm_timeout);
+}
+
+/* Check the double global timeout */
+CU_Test(ddssec_fsm, double_timeout, .init = fsm_control_init, .fini = fsm_control_fini)
+{
+  visited_timeout = 0;
+  fsm_timeout = dds_security_fsm_create(g_fsm_control, timeout_transitions, timeout_transitionsSize, &fsm_arg);
+  CU_ASSERT(fsm_timeout != NULL);
+
+  fsm_timeout2 = dds_security_fsm_create(g_fsm_control, timeout_transitions, timeout_transitionsSize, &fsm_arg);
+  CU_ASSERT(fsm_timeout2 != NULL);
+
+  dds_security_fsm_set_timeout(fsm_timeout, timeout_cb, DDS_SECS(1));
+  dds_security_fsm_set_timeout(fsm_timeout2, timeout_cb2, DDS_SECS(2));
+  dds_security_fsm_start(fsm_timeout);
+  dds_security_fsm_start(fsm_timeout2);
+  int n = 100;
+  ddsrt_mutex_lock (&g_lock);
+  while (visited_timeout != 0xf && n-- > 0)
+  {
+    ddsrt_mutex_unlock (&g_lock);
+    dds_sleepfor(DDS_MSECS(100));
+    ddsrt_mutex_lock (&g_lock);
+  }
+  CU_ASSERT(visited_timeout == 0xf);
+  ddsrt_mutex_unlock (&g_lock);
+  dds_security_fsm_free(fsm_timeout);
+  dds_security_fsm_free(fsm_timeout2);
+}
+
+/* Check parallel state timeouts */
+CU_Test(ddssec_fsm, parallel_timeout, .init = fsm_control_init, .fini = fsm_control_fini)
+{
+  visited_timeout = 0;
+
+  fsm_timeout1 = dds_security_fsm_create(g_fsm_control, parallel_timeout_transitions_1, parallel_timeout_transitionsSize_1, &fsm_arg);
+  CU_ASSERT_FATAL(fsm_timeout1 != NULL);
+  fsm_timeout2 = dds_security_fsm_create(g_fsm_control, parallel_timeout_transitions_2, parallel_timeout_transitionsSize_2, &fsm_arg);
+  CU_ASSERT_FATAL(fsm_timeout2 != NULL);
+  fsm_timeout3 = dds_security_fsm_create(g_fsm_control, parallel_timeout_transitions_3, parallel_timeout_transitionsSize_3, &fsm_arg);
+  CU_ASSERT_FATAL(fsm_timeout3 != NULL);
+
+  time0 = dds_time();
+  dds_security_fsm_start(fsm_timeout1);
+  dds_security_fsm_start(fsm_timeout2);
+  dds_security_fsm_start(fsm_timeout3);
+
+  int n = 300;
+  while (((dds_security_fsm_current_state(fsm_timeout1) == NULL)
+          || (dds_security_fsm_current_state(fsm_timeout2) == NULL)
+          || (dds_security_fsm_current_state(fsm_timeout3) == NULL)) && n-- > 0)
+  {
+    dds_sleepfor(DDS_MSECS(100));
+  }
+  while (((dds_security_fsm_current_state(fsm_timeout1) != NULL)
+          || (dds_security_fsm_current_state(fsm_timeout2) != NULL)
+          || (dds_security_fsm_current_state(fsm_timeout3) != NULL)) && n-- > 0)
+  {
+    dds_sleepfor(DDS_MSECS(100));
+  }
+
+  dds_duration_t delta1 = time1 - time0;
+  dds_duration_t delta2 = time2 - time0;
+  dds_duration_t delta3 = time3 - time0;
+  printf("time0 %"PRId64"\n", time0);
+  printf("time1 %"PRId64", delta1 %"PRId64"\n", time1, delta1);
+  printf("time2 %"PRId64", delta2 %"PRId64"\n", time2, delta2);
+  printf("time3 %"PRId64", delta3 %"PRId64"\n", time3, delta3);
+  CU_ASSERT(delta1 > DDS_MSECS(750));
+  CU_ASSERT(delta1 < DDS_MSECS(1250));
+  CU_ASSERT(delta2 > DDS_MSECS(1750));
+  CU_ASSERT(delta2 < DDS_MSECS(2250));
+  CU_ASSERT(delta3 > DDS_MSECS(750));
+  CU_ASSERT(delta3 < DDS_MSECS(1250));
+
+  dds_security_fsm_free(fsm_timeout1);
+  dds_security_fsm_free(fsm_timeout2);
+  dds_security_fsm_free(fsm_timeout3);
+}
+
+/* Delete with event timeout */
+CU_Test(ddssec_fsm, delete_with_timeout, .init = fsm_control_init, .fini = fsm_control_fini)
+{
+  fsm_timeout = dds_security_fsm_create(g_fsm_control, timeout_transitions, timeout_transitionsSize, &fsm_arg);
+  CU_ASSERT (fsm_timeout != NULL)
+  visited_timeout = 0;
+  dds_security_fsm_start(fsm_timeout);
+
+  int n = 100;
+  ddsrt_mutex_lock (&g_lock);
+  while (visited_timeout == 0 && n-- > 0)
+  {
+    ddsrt_mutex_unlock (&g_lock);
+    dds_sleepfor(DDS_MSECS(100));
+    ddsrt_mutex_lock (&g_lock);
+  }
+  ddsrt_mutex_unlock (&g_lock);
+  dds_security_fsm_free(fsm_timeout);
+}
+
diff --git a/src/security/core/tests/handshake.c b/src/security/core/tests/handshake.c
index 2eb52fc..0408bb9 100644
--- a/src/security/core/tests/handshake.c
+++ b/src/security/core/tests/handshake.c
@@ -35,9 +35,12 @@
 
 static const char *config =
     "${CYCLONEDDS_URI}${CYCLONEDDS_URI:+,}"
-    "<Discovery><ExternalDomainId>0</ExternalDomainId></Discovery>"
     "<Domain id=\"any\">"
-    "  <Tracing><Verbosity>finest</></>"
+    "  <Discovery>"
+    "    <ExternalDomainId>0</ExternalDomainId>"
+    "    <Tag>\\${CYCLONEDDS_PID}</Tag>"
+    "  </Discovery>"
+    "  <Tracing><Verbosity>config</></>"
     "  <DDSSecurity>"
     "    <Authentication>"
     "      <Library finalizeFunction=\"finalize_test_authentication_wrapped\" initFunction=\"init_test_authentication_wrapped\" path=\"" WRAPPERLIB_PATH("dds_security_authentication_wrapper") "\"/>"
@@ -68,30 +71,27 @@ static dds_entity_t g_part2_participant = 0;
 
 static void handshake_init(void)
 {
-  /* Domains for pub and sub use a different domain id, but the portgain setting
-   * in configuration is 0, so that both domains will map to the same port number.
-   * This allows to create two domains in a single test process. */
-  char *conf_part1 = ddsrt_expand_envvars(config, DDS_DOMAINID_PART1);
-  char *conf_part2 = ddsrt_expand_envvars(config, DDS_DOMAINID_PART2);
-  g_part1_domain = dds_create_domain(DDS_DOMAINID_PART1, conf_part1);
-  g_part2_domain = dds_create_domain(DDS_DOMAINID_PART2, conf_part2);
-  dds_free(conf_part1);
-  dds_free(conf_part2);
+  char *conf_part1 = ddsrt_expand_envvars_sh (config, DDS_DOMAINID_PART1);
+  char *conf_part2 = ddsrt_expand_envvars_sh (config, DDS_DOMAINID_PART2);
+  g_part1_domain = dds_create_domain (DDS_DOMAINID_PART1, conf_part1);
+  g_part2_domain = dds_create_domain (DDS_DOMAINID_PART2, conf_part2);
+  dds_free (conf_part1);
+  dds_free (conf_part2);
 
-  CU_ASSERT_FATAL((g_part1_participant = dds_create_participant(DDS_DOMAINID_PART1, NULL, NULL)) > 0);
-  CU_ASSERT_FATAL((g_part2_participant = dds_create_participant(DDS_DOMAINID_PART2, NULL, NULL)) > 0);
+  CU_ASSERT_FATAL ((g_part1_participant = dds_create_participant (DDS_DOMAINID_PART1, NULL, NULL)) > 0);
+  CU_ASSERT_FATAL ((g_part2_participant = dds_create_participant (DDS_DOMAINID_PART2, NULL, NULL)) > 0);
 }
 
 static void handshake_fini(void)
 {
-  CU_ASSERT_EQUAL_FATAL(dds_delete(g_part1_participant), DDS_RETCODE_OK);
-  CU_ASSERT_EQUAL_FATAL(dds_delete(g_part2_participant), DDS_RETCODE_OK);
-  CU_ASSERT_EQUAL_FATAL(dds_delete(g_part1_domain), DDS_RETCODE_OK);
-  CU_ASSERT_EQUAL_FATAL(dds_delete(g_part2_domain), DDS_RETCODE_OK);
+  CU_ASSERT_EQUAL_FATAL (dds_delete (g_part1_participant), DDS_RETCODE_OK);
+  CU_ASSERT_EQUAL_FATAL (dds_delete (g_part2_participant), DDS_RETCODE_OK);
+  CU_ASSERT_EQUAL_FATAL (dds_delete (g_part1_domain), DDS_RETCODE_OK);
+  CU_ASSERT_EQUAL_FATAL (dds_delete (g_part2_domain), DDS_RETCODE_OK);
 }
 
 CU_Test(ddssec_handshake, happy_day, .init = handshake_init, .fini = handshake_fini)
 {
-  validate_handshake(DDS_DOMAINID_PART1, false, NULL, false, NULL);
-  validate_handshake(DDS_DOMAINID_PART2, false, NULL, false, NULL);
+  validate_handshake (DDS_DOMAINID_PART1, false, NULL, false, NULL);
+  validate_handshake (DDS_DOMAINID_PART2, false, NULL, false, NULL);
 }
diff --git a/src/security/core/tests/secure_communication.c b/src/security/core/tests/secure_communication.c
index 9270a57..978aa62 100644
--- a/src/security/core/tests/secure_communication.c
+++ b/src/security/core/tests/secure_communication.c
@@ -51,8 +51,11 @@
 
 static const char *config =
     "${CYCLONEDDS_URI}${CYCLONEDDS_URI:+,}"
-    "<Discovery><ExternalDomainId>0</ExternalDomainId></Discovery>"
     "<Domain id=\"any\">"
+    "  <Discovery>"
+    "    <ExternalDomainId>0</ExternalDomainId>"
+    "    <Tag>\\${CYCLONEDDS_PID}</Tag>"
+    "  </Discovery>"
     "  <DDSSecurity>"
     "    <Authentication>"
     "      <Library finalizeFunction=\"finalize_authentication\" initFunction=\"init_authentication\" />"
@@ -219,12 +222,12 @@ static void test_init(const struct domain_sec_config * domain_config, size_t n_s
     { NULL, NULL, 0 }
   };
 
-  char *conf_pub = ddsrt_expand_vars (config, &expand_lookup_vars_env, config_vars);
+  char *conf_pub = ddsrt_expand_vars_sh (config, &expand_lookup_vars_env, config_vars);
   create_dom_pp_pubsub (DDS_DOMAINID_PUB, conf_pub, domain_config, n_pub_domains, n_pub_participants,
       g_pub_domains, g_pub_participants, g_pub_publishers, &dds_create_publisher);
   dds_free (conf_pub);
 
-  char *conf_sub = ddsrt_expand_vars (config, &expand_lookup_vars_env, config_vars);
+  char *conf_sub = ddsrt_expand_vars_sh (config, &expand_lookup_vars_env, config_vars);
   create_dom_pp_pubsub (DDS_DOMAINID_SUB, conf_sub, domain_config, n_sub_domains, n_sub_participants,
       g_sub_domains, g_sub_participants, g_sub_subscribers, &dds_create_subscriber);
   dds_free (conf_sub);
diff --git a/src/security/core/tests/tc_fsm.c b/src/security/core/tests/tc_fsm.c
deleted file mode 100644
index 666a641..0000000
--- a/src/security/core/tests/tc_fsm.c
+++ /dev/null
@@ -1,757 +0,0 @@
-/*
- * Copyright(c) 2006 to 2018 ADLINK Technology Limited and others
- *
- * This program and the accompanying materials are made available under the
- * terms of the Eclipse Public License v. 2.0 which is available at
- * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
- * v. 1.0 which is available at
- * http://www.eclipse.org/org/documents/edl-v10.php.
- *
- * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
- */
-#include <stdio.h>
-#include <stdbool.h>
-
-#include "dds/ddsrt/sync.h"
-#include "dds/ddsrt/misc.h"
-
-#include "CUnit/CUnit.h"
-#include "CUnit/Test.h"
-#include "dds/dds.h"
-#include "dds__types.h"
-#include "dds__entity.h"
-#include "dds/security/core/dds_security_fsm.h"
-
-#define CHECK_BIT(var, pos) ((var) & (1<<(pos)))
-
-#define FSM_AUTH_ARG 10
-
-#define DB_TC_PRINT_DEBUG  (true)
-
-static dds_entity_t g_participant = 0;
-static ddsrt_mutex_t g_lock;
-static struct dds_security_fsm_control *g_fsm_control = NULL;
-static const dds_duration_t msec100 = DDS_MSECS(100);
-
-//static int fsm_arg = FSM_AUTH_ARG;
-
-#define DO_SIMPLE(name, var, bit) static void name(struct dds_security_fsm *fsm, void *arg) { \
-  DDSRT_UNUSED_ARG(fsm); \
-  DDSRT_UNUSED_ARG(arg); \
-  if (DB_TC_PRINT_DEBUG) \
-    printf("Transition %s\n", __FUNCTION__); \
-  ddsrt_mutex_lock(&g_lock); \
-  visited_##var |= 1u << (bit); \
-  ddsrt_mutex_unlock(&g_lock); \
-}
-
-
-/**********************************************************************
- * Authentication State Machine properties and methods
- **********************************************************************/
-
-typedef enum {
-    VALIDATION_PENDING_RETRY,
-    VALIDATION_FAILED,
-    VALIDATION_OK,
-    VALIDATION_OK_FINAL_MESSAGE,
-    VALIDATION_PENDING_HANDSHAKE_MESSAGE,
-    VALIDATION_PENDING_HANDSHAKE_REQUEST,
-    PluginReturn_MAX
-} PluginReturn;
-
-static struct dds_security_fsm *fsm_auth;
-static uint32_t visited_auth = 0;
-static uint32_t correct_fsm = 0;
-static uint32_t correct_arg = 0;
-static int validate_remote_identity_first = 1;
-static int begin_handshake_reply_first = 1;
-
-
-static PluginReturn validate_remote_identity(void)
-{
-  if (DB_TC_PRINT_DEBUG) {
-    printf("validate_remote_identity - %d\n", validate_remote_identity_first);
-  }
-  if (validate_remote_identity_first) {
-    validate_remote_identity_first = 0;
-    return VALIDATION_PENDING_RETRY;
-  }
-  return VALIDATION_PENDING_HANDSHAKE_MESSAGE;
-}
-
-static PluginReturn begin_handshake_reply(void)
-{
-  if (DB_TC_PRINT_DEBUG) {
-    printf("begin_handshake_reply - %d\n", begin_handshake_reply_first);
-  }
-  if (begin_handshake_reply_first) {
-    begin_handshake_reply_first = 0;
-    return VALIDATION_PENDING_RETRY;
-  }
-  return VALIDATION_OK_FINAL_MESSAGE;
-}
-
-static PluginReturn get_shared_secret(void)
-{
-  return VALIDATION_OK;
-}
-
-/* State actions. */
-static void fsm_validate_remote_identity(struct dds_security_fsm *fsm, void *arg)
-{
-  PluginReturn ret;
-
-  DDSRT_UNUSED_ARG(arg);
-
-  ret = validate_remote_identity();
-
-  if (DB_TC_PRINT_DEBUG) {
-    printf("[%p] State %s (ret %d)\n", fsm, __FUNCTION__, (int) ret);
-  }
-
-  dds_security_fsm_dispatch(fsm, (int32_t) ret, false);
-}
-
-static void fsm_begin_handshake_reply(struct dds_security_fsm *fsm, void *arg)
-{
-  PluginReturn ret;
-
-  DDSRT_UNUSED_ARG(arg);
-
-  ret = begin_handshake_reply();
-  if (ret == VALIDATION_OK_FINAL_MESSAGE) {
-    ret = get_shared_secret();
-  }
-
-  if (DB_TC_PRINT_DEBUG) {
-    printf("[%p] State %s (ret %d)\n", fsm, __FUNCTION__, (int) ret);
-  }
-
-  dds_security_fsm_dispatch(fsm, (int32_t) ret, false);
-}
-
-/* A few states from the handshake state-machine. */
-static dds_security_fsm_state StateValidateRemoteIdentity = {fsm_validate_remote_identity, 0};
-static dds_security_fsm_state StateValRemIdentityRetryWait = {NULL, 100000000};
-static dds_security_fsm_state StateHandshakeInitMessageWait = {NULL, 0};
-static dds_security_fsm_state StateBeginHandshakeReply = {fsm_begin_handshake_reply, 0};
-static dds_security_fsm_state StateBeginHsReplyWait = {NULL, 100000000};
-
-static void a(struct dds_security_fsm *fsm, void *arg)
-{
-  int *fsm_arg;
-
-  if (DB_TC_PRINT_DEBUG) {
-    printf("[%p] Transition %s\n", fsm, __FUNCTION__);
-  }
-
-  ddsrt_mutex_lock (&g_lock);
-  if (arg != NULL) {
-    fsm_arg = (int *) arg;
-
-    if (*fsm_arg == FSM_AUTH_ARG) {
-      correct_arg = 1;
-    } else {
-      correct_arg = 0;
-    }
-  }
-
-  if (fsm == fsm_auth) {
-    correct_fsm = 1;
-  } else {
-    correct_fsm = 0;
-  }
-  visited_auth |= 1u << 0;
-  ddsrt_mutex_unlock (&g_lock);
-}
-
-DO_SIMPLE(b, auth, 1)
-DO_SIMPLE(c, auth, 2)
-DO_SIMPLE(d, auth, 3)
-DO_SIMPLE(e, auth, 4)
-DO_SIMPLE(f, auth, 5)
-DO_SIMPLE(g, auth, 6)
-DO_SIMPLE(h, auth, 7)
-
-#define SHM_MSG_RECEIVED (PluginReturn_MAX + 1)
-
-/*
- * .--.
- * |##|--------------------------------------.
- * '--'       a()                            v
- *                 .----------------------------------------------------.
- *                 |            StateValidateRemoteIdentity             |
- *                 |----------------------------------------------------|
- *         .------>| fsm_validate_remote_identity()                     |
- *         |       |    - dispatch VALIDATION_PENDING_RETRY             |
- *    100ms|       |    - dispatch VALIDATION_PENDING_HANDSHAKE_MESSAGE |
- *    d()  |       '----------------------------------------------------'
- *         |          VALIDATION_PENDING_RETRY|  | VALIDATION_PENDING_HANDSHAKE_MESSAGE
- *         |          b()                     |  | c()
- *         |                                  |  |
- * .------------------------------.           |  |       .-------------------------------.
- * | StateValRemIdentityRetryWait |           |  |       | StateHandshakeInitMessageWait |
- * |------------------------------|<----------'  '------>|-------------------------------|
- * '------------------------------'                      '-------------------------------'
- *                                                SHM_MSG_RECEIVED  |
- *                                                e()               |
- *                                                                  v
- *                                      .----------------------------------------.
- *          VALIDATION_PENDING_RETRY    |        StateBeginHandshakeReply        |
- *          f()                         |----------------------------------------|
- *            .-------------------------| fsm_begin_handshake_reply()            |
- *            |                         |    - dispatch VALIDATION_PENDING_RETRY |
- *            v                         |    - dispatch VALIDATION_OK            |
- * .-----------------------.    100ms   '----------------------------------------'
- * | StateBeginHsReplyWait |    h()                ^        VALIDATION_OK |
- * |-----------------------|-----------------------'        g()           |
- * '-----------------------'                                              v
- *                                                                       .-.
- *                                                                       '-'
- */
-static dds_security_fsm_transition HandshakeTransistions[] = {
-    {NULL,                           DDS_SECURITY_FSM_EVENT_AUTO,          a, &StateValidateRemoteIdentity}, // NULL state is the start state
-    {&StateValidateRemoteIdentity,   VALIDATION_PENDING_RETRY,             b, &StateValRemIdentityRetryWait},
-    {&StateValidateRemoteIdentity,   VALIDATION_PENDING_HANDSHAKE_MESSAGE, c, &StateHandshakeInitMessageWait},
-    {&StateValRemIdentityRetryWait,  DDS_SECURITY_FSM_EVENT_TIMEOUT,       d, &StateValidateRemoteIdentity},
-    {&StateHandshakeInitMessageWait, SHM_MSG_RECEIVED,                     e, &StateBeginHandshakeReply},
-    {&StateBeginHandshakeReply,      VALIDATION_PENDING_RETRY,             f, &StateBeginHsReplyWait},
-    {&StateBeginHandshakeReply,      VALIDATION_OK,                        g, NULL}, // Reaching NULL means end of state-diagram
-    {&StateBeginHsReplyWait,         DDS_SECURITY_FSM_EVENT_TIMEOUT,       h, &StateBeginHandshakeReply}
-};
-static const uint32_t HandshakeTransistionsSize = sizeof(HandshakeTransistions)/sizeof(HandshakeTransistions[0]);
-
-
-/**********************************************************************
- * Example State Machine properties and methods
- **********************************************************************/
-
-typedef enum {
-    eventX, eventY, eventZ,
-} test_events;
-
-static struct dds_security_fsm *fsm_test;
-static uint32_t visited_test = 0;
-static int do_stuff_counter = 0;
-static int do_other_stuff_counter = 0;
-
-DO_SIMPLE(doStart, test, 0)
-DO_SIMPLE(doRestart, test, 1)
-DO_SIMPLE(doEventStuff, test, 4)
-
-static void doStuff(struct dds_security_fsm *fsm, void *arg)
-{
-  DDSRT_UNUSED_ARG(fsm);
-  DDSRT_UNUSED_ARG(arg);
-
-  if (DB_TC_PRINT_DEBUG) {
-    printf("Transition %s - %d\n", __FUNCTION__, do_stuff_counter);
-  }
-  ddsrt_mutex_lock (&g_lock);
-  visited_test |= 1u << 2;
-  ddsrt_mutex_unlock (&g_lock);
-
-  if (do_stuff_counter < 2) {
-    dds_security_fsm_dispatch(fsm, eventZ, false);
-  } else if (do_stuff_counter == 2) {
-    dds_security_fsm_dispatch(fsm, eventY, false);
-  }
-  ++do_stuff_counter;
-}
-
-static void doOtherStuff(struct dds_security_fsm *fsm, void *arg)
-{
-  DDSRT_UNUSED_ARG(fsm);
-  DDSRT_UNUSED_ARG(arg);
-
-  if (DB_TC_PRINT_DEBUG) {
-    printf("Transition %s - %d\n", __FUNCTION__, do_other_stuff_counter);
-  }
-  ddsrt_mutex_lock (&g_lock);
-  visited_test |= 1u << 3;
-  ddsrt_mutex_unlock (&g_lock);
-
-  if (do_other_stuff_counter == 0) {
-    dds_security_fsm_dispatch(fsm, DDS_SECURITY_FSM_EVENT_AUTO, false);
-  }
-
-  if (do_other_stuff_counter == 1) {
-    dds_security_fsm_dispatch(fsm, eventY, false);
-  } else if (do_other_stuff_counter == 2) {
-    dds_security_fsm_dispatch(fsm, eventX, false);
-  }
-  ++do_other_stuff_counter;
-}
-
-static dds_security_fsm_state StateA = {doStuff,      0};
-static dds_security_fsm_state StateB = {doStuff,      100000000};
-static dds_security_fsm_state StateC = {NULL,         0};
-static dds_security_fsm_state StateD = {doOtherStuff, 0};
-
-static dds_security_fsm_transition Transitions[] = {
-    {NULL,    DDS_SECURITY_FSM_EVENT_AUTO, doStart,      &StateA}, // NULL state is the start state
-    {&StateA, eventZ,                      NULL,         &StateB},
-    {&StateA, eventY,                      doOtherStuff, &StateC},
-    {&StateB, eventX,                      NULL,         NULL}, // Reaching NULL means end of state-diagram
-    {&StateB, eventZ,                      doRestart,    &StateA},
-    {&StateC, DDS_SECURITY_FSM_EVENT_AUTO, doEventStuff, &StateD},
-    {&StateD, eventY,                      doEventStuff, &StateD},
-    {&StateD, eventX,                      doStuff,      NULL}, // Reaching NULL means end of sttimeoutate-diagram
-};
-static const uint32_t TransitionsSize = sizeof(Transitions)/sizeof(Transitions[0]);
-
-
-/**********************************************************************
- * Timeout State Machine properties and methods
- **********************************************************************/
-
-typedef enum {
-    eventToTimeout, eventToInterupt, eventToEnd,
-} timeout_events;
-
-struct fsm_timeout_arg {
-  int id;
-};
-
-static struct dds_security_fsm *fsm_timeout;
-static uint32_t visited_timeout = 0;
-static uint32_t correct_fsm_timeout = 0;
-static uint32_t correct_arg_timeout = 0;
-static struct fsm_timeout_arg fsm_arg = { .id = FSM_AUTH_ARG };
-
-DO_SIMPLE(doInterrupt, timeout, 0)
-DO_SIMPLE(TimeoutCallback2, timeout, 3)
-
-static void doTimeout(struct dds_security_fsm *fsm, void *arg)
-{
-  DDSRT_UNUSED_ARG(arg);
-
-  if (DB_TC_PRINT_DEBUG) {
-    printf("Transition >>>> %s\n", __FUNCTION__);
-  }
-  ddsrt_mutex_lock (&g_lock);
-  visited_timeout |= 1u << 1;
-  ddsrt_mutex_unlock (&g_lock);
-
-  if (DB_TC_PRINT_DEBUG) {
-    printf("Transition <<<< %s\n", __FUNCTION__);
-  }
-
-  dds_security_fsm_dispatch(fsm, eventToTimeout, false);
-}
-
-static void TimeoutCallback(struct dds_security_fsm *fsm, void *arg)
-{
-  struct fsm_timeout_arg *farg = arg;
-
-  if (DB_TC_PRINT_DEBUG) {
-    printf("TimeoutCallback\n");
-  }
-
-  ddsrt_mutex_lock (&g_lock);
-  visited_timeout |= 1u << 2;
-
-  if (farg != NULL) {
-    if (farg->id == FSM_AUTH_ARG) {
-      correct_arg_timeout = 1;
-    } else {
-      correct_arg_timeout = 0;
-    }
-  }
-  if (fsm == fsm_timeout) {
-    correct_fsm_timeout = 1;
-  } else {
-    correct_fsm_timeout = 0;
-  }
-  ddsrt_mutex_unlock (&g_lock);
-}
-
-static dds_security_fsm_state StateInitial     = {doTimeout,  0};
-static dds_security_fsm_state StateWaitTimeout = {NULL, DDS_SECS(4)};
-static dds_security_fsm_state StateInterupt    = {doInterrupt, 0};
-
-
-static const dds_security_fsm_transition TimeoutTransitions[] = {
-    {NULL,              DDS_SECURITY_FSM_EVENT_AUTO,    NULL, &StateInitial},  // NULL state is the start state
-    {&StateInitial,     eventToTimeout,                 NULL, &StateWaitTimeout},
-    {&StateWaitTimeout, DDS_SECURITY_FSM_EVENT_TIMEOUT, NULL, &StateInterupt},
-    {&StateWaitTimeout, eventToInterupt,                NULL, &StateInterupt},
-    {&StateInterupt,    eventToEnd,                     NULL, NULL},           // Reaching NULL means end of state-diagram
-};
-static const uint32_t TimeoutTransitionsSize = sizeof(TimeoutTransitions)/sizeof(TimeoutTransitions[0]);
-
-
-/**********************************************************************
- * Parallel Timeout State Machines properties and methods
- **********************************************************************/
-
-static struct dds_security_fsm *fsm_timeout1;
-static struct dds_security_fsm *fsm_timeout2;
-static struct dds_security_fsm *fsm_timeout3;
-
-static dds_time_t time0 = 0;
-static dds_time_t time1 = 0;
-static dds_time_t time2 = 0;
-static dds_time_t time3 = 0;
-
-static void StateParTime1(struct dds_security_fsm *fsm, void *arg)
-{
-  DDSRT_UNUSED_ARG(fsm);
-  DDSRT_UNUSED_ARG(arg);
-  time1 = dds_time();
-}
-
-static void StateParTime2(struct dds_security_fsm *fsm, void *arg)
-{
-  DDSRT_UNUSED_ARG(fsm);
-  DDSRT_UNUSED_ARG(arg);
-  time2 = dds_time();
-}
-
-static void StateParTime3(struct dds_security_fsm *fsm, void *arg)
-{
-  DDSRT_UNUSED_ARG(fsm);
-  DDSRT_UNUSED_ARG(arg);
-  time3 = dds_time();
-}
-
-static dds_security_fsm_state StateParTimeout1 = {NULL, DDS_SECS(1)};
-static dds_security_fsm_state StateParTimeout2 = {NULL, DDS_SECS(2)};
-static dds_security_fsm_state StateParTimeout3 = {NULL, DDS_SECS(1)};
-
-static dds_security_fsm_transition ParallelTimeoutTransitions_1[] = {
-    {NULL,              DDS_SECURITY_FSM_EVENT_AUTO,    NULL,           &StateParTimeout1}, // NULL state is the startfsm_control_thread state
-    {&StateParTimeout1, DDS_SECURITY_FSM_EVENT_TIMEOUT, &StateParTime1, NULL},              // Reaching NULL means end of state-diagram
-};
-static const uint32_t ParallelTimeoutTransitionsSize_1 = sizeof(ParallelTimeoutTransitions_1) / sizeof(ParallelTimeoutTransitions_1[0]);
-
-static dds_security_fsm_transition ParallelTimeoutTransitions_2[] = {
-    {NULL,              DDS_SECURITY_FSM_EVENT_AUTO,    NULL,           &StateParTimeout2}, // NULL state is the start state
-    {&StateParTimeout2, DDS_SECURITY_FSM_EVENT_TIMEOUT, &StateParTime2, NULL},              // Reaching NULL means end of state-diagram
-};
-static const uint32_t ParallelTimeoutTransitionsSize_2 = sizeof(ParallelTimeoutTransitions_2) / sizeof(ParallelTimeoutTransitions_2[0]);
-
-static dds_security_fsm_transition ParallelTimeoutTransitions_3[] = {
-    {NULL,              DDS_SECURITY_FSM_EVENT_AUTO,    NULL,           &StateParTimeout3}, // NULL state is the start state
-    {&StateParTimeout3, DDS_SECURITY_FSM_EVENT_TIMEOUT, &StateParTime3, NULL},              // Reaching NULL means end of state-diagram
-};
-static const uint32_t ParallelTimeoutTransitionsSize_3 = sizeof(ParallelTimeoutTransitions_3) / sizeof(ParallelTimeoutTransitions_3[0]);
-
-static void fsm_control_init(void)
-{
-  dds_return_t rc;
-  struct dds_entity *e;
-
-  g_participant = dds_create_participant(DDS_DOMAIN_DEFAULT, NULL, NULL);
-  CU_ASSERT_FATAL(g_participant > 0);
-
-  ddsrt_mutex_init (&g_lock);
-
-  rc = dds_entity_pin(g_participant, &e);
-  CU_ASSERT_FATAL(rc == 0);
-
-  g_fsm_control = dds_security_fsm_control_create (&e->m_domain->gv);
-  CU_ASSERT_FATAL (g_fsm_control != NULL);
-
-  dds_entity_unpin (e);
-
-  rc = dds_security_fsm_control_start (g_fsm_control, NULL);
-  CU_ASSERT_FATAL(rc == 0);
-}
-
-static void fsm_control_fini(void)
-{
-  dds_security_fsm_control_stop(g_fsm_control);
-  dds_security_fsm_control_free(g_fsm_control);
-  ddsrt_mutex_destroy (&g_lock);
-
-  dds_delete(g_participant);
-}
-
-CU_Test(ddssec_fsm, create, .init = fsm_control_init, .fini = fsm_control_fini)
-{
-  dds_time_t delay30 = DDS_SECS(30);
-  int timeout;
-
-  /*
-   * Test single running state machine
-   * Check creation of a single State Machine
-   */
-  fsm_auth = dds_security_fsm_create(g_fsm_control, HandshakeTransistions, HandshakeTransistionsSize, &fsm_arg);
-  CU_ASSERT_FATAL(fsm_auth != NULL)
-
-  // set a delay that doesn't expire. Should be terminate when fsm is freed.
-  dds_security_fsm_set_timeout(fsm_auth, TimeoutCallback, delay30);
-  dds_security_fsm_start(fsm_auth);
-
-  /**
-   * Check the result of one running State Machine
-   */
-
-  // Wait for the last state to occur
-  timeout = 100; /* 10 sec */
-  while ((dds_security_fsm_current_state(fsm_auth) != &StateHandshakeInitMessageWait) && (timeout > 0)) {
-    dds_sleepfor(msec100);
-    timeout--;
-  }
-  CU_ASSERT(timeout > 0);
-  dds_security_fsm_dispatch(fsm_auth, SHM_MSG_RECEIVED, false);
-
-  timeout = 100; /* 10 sec */
-  while ((dds_security_fsm_current_state(fsm_auth) != NULL) && (timeout > 0)) {
-    dds_sleepfor(msec100);
-    timeout--;
-  }
-  CU_ASSERT(timeout > 0);
-
-  ddsrt_mutex_lock (&g_lock);
-  CU_ASSERT(visited_auth == 0xff);
-  ddsrt_mutex_unlock (&g_lock);
-
-  /*
-   * "Check correct callback parameter passing (from fsm to user defined methods) ");
-   */
-  CU_ASSERT(correct_arg && correct_fsm);
-  dds_security_fsm_free(fsm_auth);
-
-  /* Check whether timeout callback has NOT been invoked */
-  ddsrt_mutex_lock (&g_lock);
-  CU_ASSERT(visited_timeout == 0);
-  ddsrt_mutex_unlock (&g_lock);
-}
-
-/*
- * Test multiple (2) running state machines
- */
-CU_Test(ddssec_fsm, multiple, .init = fsm_control_init, .fini = fsm_control_fini)
-{
-  int timeout;
-
-  /*Check creation of multiple (2) State Machines*/
-  validate_remote_identity_first = 0;
-  begin_handshake_reply_first = 0;
-  visited_auth = 0;
-  visited_test = 0;
-
-  fsm_auth = dds_security_fsm_create(g_fsm_control, HandshakeTransistions, HandshakeTransistionsSize, NULL);
-  CU_ASSERT_FATAL(fsm_auth != NULL);
-
-  fsm_test = dds_security_fsm_create(g_fsm_control, Transitions, TransitionsSize, NULL);
-  CU_ASSERT_FATAL(fsm_test != NULL);
-
-  dds_security_fsm_start(fsm_auth);
-  dds_security_fsm_start(fsm_test);
-
-  /* Check the results of multiple running State Machines */
-
-  /* Wait for the last state to occur */
-  timeout = 100; /* 10 sec */
-  while ((dds_security_fsm_current_state(fsm_auth) != &StateHandshakeInitMessageWait) && (timeout > 0)) {
-    dds_sleepfor(100 * DDS_NSECS_IN_MSEC);
-    timeout--;
-  }
-  CU_ASSERT_FATAL(timeout > 0);
-
-  timeout = 100; /* 10 sec */
-  dds_security_fsm_dispatch(fsm_auth, SHM_MSG_RECEIVED, false);
-  while ((dds_security_fsm_current_state(fsm_auth) != NULL) && (timeout > 0)) {
-    dds_sleepfor(100 * DDS_NSECS_IN_MSEC);
-    timeout--;
-  }
-  CU_ASSERT_FATAL(timeout > 0);
-
-  // not all bits are set since we're running the state machine a second time
-  ddsrt_mutex_lock (&g_lock);
-  CU_ASSERT_FATAL(visited_auth == 0x55);
-  ddsrt_mutex_unlock (&g_lock);
-
-  /* Wait for the last state to occur */
-  timeout = 100; /* 10 sec */
-  while ((dds_security_fsm_current_state(fsm_test) != NULL) && timeout > 0) {
-    dds_sleepfor(100 * DDS_NSECS_IN_MSEC);
-    timeout--;
-  }
-  CU_ASSERT_FATAL(timeout > 0);
-
-  ddsrt_mutex_lock (&g_lock);
-  CU_ASSERT(visited_test == 0x1f);
-  ddsrt_mutex_unlock (&g_lock);
-
-  dds_security_fsm_free(fsm_auth);
-  dds_security_fsm_free(fsm_test);
-
-}
-
-/**
- * Check creation of State Machine for timeout purposes
- */
-CU_Test(ddssec_fsm, timeout, .init = fsm_control_init, .fini = fsm_control_fini)
-{
-  dds_time_t delay1 = DDS_SECS(1);
-  int timeout;
-
-  visited_timeout = 0;
-
-  /*
-   * Test timeout monitoring of state machines
-   */
-  fsm_timeout = dds_security_fsm_create(g_fsm_control, TimeoutTransitions, TimeoutTransitionsSize, &fsm_arg);
-  CU_ASSERT(fsm_timeout != NULL);
-
-  dds_security_fsm_set_timeout(fsm_timeout, TimeoutCallback, delay1);
-  dds_security_fsm_start(fsm_timeout);
-
-  /*Check the result of the running State Machine for timeout purposes*/
-
-  // Wait for the last state to occur
-  timeout = 100; /* 10 sec */
-  ddsrt_mutex_lock (&g_lock);
-  while (visited_timeout != 0x7 && (timeout > 0)) {
-    ddsrt_mutex_unlock (&g_lock);
-    dds_sleepfor(100 * DDS_NSECS_IN_MSEC);
-    timeout--;
-    ddsrt_mutex_lock (&g_lock);
-  }
-  CU_ASSERT(timeout > 0);
-  CU_ASSERT(visited_timeout == 0x7);
-  CU_ASSERT(correct_arg_timeout && correct_fsm_timeout);
-  ddsrt_mutex_unlock (&g_lock);
-
-  dds_security_fsm_free(fsm_timeout);
-}
-
-/**
- * Check the double global timeout
- */
-CU_Test(ddssec_fsm, double_timeout, .init = fsm_control_init, .fini = fsm_control_fini)
-{
-  dds_time_t delay1 = DDS_SECS(1);
-  dds_time_t delay2 = DDS_SECS(2);
-  int timeout;
-
-  visited_timeout = 0;
-  fsm_timeout = dds_security_fsm_create(g_fsm_control, TimeoutTransitions, TimeoutTransitionsSize, &fsm_arg);
-  CU_ASSERT(fsm_timeout != NULL);
-
-  fsm_timeout2 = dds_security_fsm_create(g_fsm_control, TimeoutTransitions, TimeoutTransitionsSize, &fsm_arg);
-  CU_ASSERT(fsm_timeout2 != NULL);
-
-  dds_security_fsm_set_timeout(fsm_timeout, TimeoutCallback, delay1);
-  dds_security_fsm_set_timeout(fsm_timeout2, TimeoutCallback2, delay2);
-  dds_security_fsm_start(fsm_timeout);
-  dds_security_fsm_start(fsm_timeout2);
-  timeout = 100; /* 10 sec */
-  ddsrt_mutex_lock (&g_lock);
-  while (visited_timeout != 0xf && (timeout > 0)) {
-    ddsrt_mutex_unlock (&g_lock);
-    dds_sleepfor(100 * DDS_NSECS_IN_MSEC);
-    timeout--;
-    ddsrt_mutex_lock (&g_lock);
-  }
-  CU_ASSERT(visited_timeout == 0xf);
-  ddsrt_mutex_unlock (&g_lock);
-  dds_security_fsm_free(fsm_timeout);
-  dds_security_fsm_free(fsm_timeout2);
-}
-
-/**
- * Check parallel state timeouts
- */
-CU_Test(ddssec_fsm, parallel_timeout, .init = fsm_control_init, .fini = fsm_control_fini)
-{
-  dds_duration_t delta1;
-  dds_duration_t delta2;
-  dds_duration_t delta3;
-  int timeout;
-
-  visited_timeout = 0;
-
-  fsm_timeout1 = dds_security_fsm_create(g_fsm_control, ParallelTimeoutTransitions_1, ParallelTimeoutTransitionsSize_1, &fsm_arg);
-  CU_ASSERT_FATAL(fsm_timeout1 != NULL);
-
-  fsm_timeout2 = dds_security_fsm_create(g_fsm_control, ParallelTimeoutTransitions_2, ParallelTimeoutTransitionsSize_2, &fsm_arg);
-  CU_ASSERT_FATAL(fsm_timeout2 != NULL);
-
-  fsm_timeout3 = dds_security_fsm_create(g_fsm_control, ParallelTimeoutTransitions_3, ParallelTimeoutTransitionsSize_3, &fsm_arg);
-  CU_ASSERT_FATAL(fsm_timeout3 != NULL);
-
-  time0 = dds_time();
-  dds_security_fsm_start(fsm_timeout1);
-  dds_security_fsm_start(fsm_timeout2);
-  dds_security_fsm_start(fsm_timeout3);
-
-  /* Wait for both to end. */
-  timeout = 300; /* 10 sec */
-  /* First, they have to be started. */
-  while (((dds_security_fsm_current_state(fsm_timeout1) == NULL)
-          || (dds_security_fsm_current_state(fsm_timeout2) == NULL)
-          || (dds_security_fsm_current_state(fsm_timeout3) == NULL)) && (timeout > 0)) {
-    dds_sleepfor(100 * DDS_NSECS_IN_MSEC);
-    timeout--;
-  }
-
-  /* Then, they have to have ended. */
-  while (((dds_security_fsm_current_state(fsm_timeout1) != NULL)
-          || (dds_security_fsm_current_state(fsm_timeout2) != NULL)
-          || (dds_security_fsm_current_state(fsm_timeout3) != NULL)) && (timeout > 0)) {
-    dds_sleepfor(100 * DDS_NSECS_IN_MSEC);
-    timeout--;
-  }
-
-  /*
-   * There should be about 1 second difference between all times:
-   *      time1 = time0 + 1
-   *      time2 = time0 + 2
-   *      time3 = time0 + 1
-   */
-  delta1 = time1 - time0;
-  delta2 = time2 - time0;
-  delta3 = time3 - time0;
-  printf("Time0 %" PRId64 "\n", time0);
-  printf("Time1 %" PRId64 "\n", time1);
-  printf("Time2 %" PRId64 "\n", time2);
-  printf("Time3 %" PRId64 "\n", time3);
-  printf("Delta1 %" PRId64 "\n", delta1);
-  printf("Delta2 %" PRId64 "\n", delta2);
-  printf("Delta3 %" PRId64 "\n", delta3);
-  CU_ASSERT(delta1 > 750 * DDS_NSECS_IN_MSEC);
-  CU_ASSERT(delta1 < 1250 * DDS_NSECS_IN_MSEC);
-  CU_ASSERT(delta2 > 1750 * DDS_NSECS_IN_MSEC);
-  CU_ASSERT(delta2 < 2250 * DDS_NSECS_IN_MSEC);
-  CU_ASSERT(delta3 > 750 * DDS_NSECS_IN_MSEC);
-  CU_ASSERT(delta3 < 1250 * DDS_NSECS_IN_MSEC);
-
-  dds_security_fsm_free(fsm_timeout1);
-  dds_security_fsm_free(fsm_timeout2);
-  dds_security_fsm_free(fsm_timeout3);
-
-}
-
-/**
- * Delete with event timeout
- */
-CU_Test(ddssec_fsm, delete_with_timeout, .init = fsm_control_init, .fini = fsm_control_fini)
-{
-  int timeout;
-
-  fsm_timeout = dds_security_fsm_create(g_fsm_control, TimeoutTransitions, TimeoutTransitionsSize, &fsm_arg);
-  CU_ASSERT (fsm_timeout != NULL)
-
-  visited_timeout = 0;
-  dds_security_fsm_start(fsm_timeout);
-
-  /* Wait until we're in the timeout function. */
-  timeout = 100; /* 10 sec */
-  ddsrt_mutex_lock (&g_lock);
-  while ((visited_timeout == 0) && (timeout > 0)) {
-    ddsrt_mutex_unlock (&g_lock);
-    dds_sleepfor(100 * DDS_NSECS_IN_MSEC);
-    timeout--;
-    ddsrt_mutex_lock (&g_lock);
-  }
-  ddsrt_mutex_unlock (&g_lock);
-
-  dds_security_fsm_free(fsm_timeout);
-}
-
diff --git a/src/security/core/tests/timed_cb.c b/src/security/core/tests/timed_cb.c
new file mode 100644
index 0000000..6b01a9e
--- /dev/null
+++ b/src/security/core/tests/timed_cb.c
@@ -0,0 +1,374 @@
+/*
+ * Copyright(c) 2019 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+
+#include <stdio.h>
+#include "CUnit/Test.h"
+
+#include "dds/security/core/dds_security_timed_cb.h"
+#include "dds/ddsrt/misc.h"
+
+#define SEQ_SIZE (16)
+
+typedef struct
+{
+  struct dds_security_timed_dispatcher_t *d;
+  dds_security_timed_cb_kind kind;
+  void *listener;
+  void *arg;
+  dds_time_t time;
+} test_sequence_data;
+
+static int g_sequence_idx = 0;
+static test_sequence_data g_sequence_array[SEQ_SIZE];
+
+static void simple_callback(struct dds_security_timed_dispatcher_t *d, dds_security_timed_cb_kind kind, void *listener, void *arg)
+{
+  DDSRT_UNUSED_ARG(d);
+  DDSRT_UNUSED_ARG(kind);
+  DDSRT_UNUSED_ARG(listener);
+  *((bool *)arg) = !(*((bool *)arg));
+}
+
+static int g_order_callback_idx = 0;
+static void *g_order_callback[2] = {(void *)NULL, (void *)NULL};
+static void order_callback(struct dds_security_timed_dispatcher_t *d, dds_security_timed_cb_kind kind, void *listener, void *arg)
+{
+  DDSRT_UNUSED_ARG(d);
+  DDSRT_UNUSED_ARG(kind);
+  DDSRT_UNUSED_ARG(listener);
+  g_order_callback[g_order_callback_idx] = arg;
+  g_order_callback_idx++;
+}
+
+static void test_callback(struct dds_security_timed_dispatcher_t *d, dds_security_timed_cb_kind kind, void *listener, void *arg)
+{
+  if (g_sequence_idx < SEQ_SIZE)
+  {
+    g_sequence_array[g_sequence_idx].d = d;
+    g_sequence_array[g_sequence_idx].arg = arg;
+    g_sequence_array[g_sequence_idx].kind = kind;
+    g_sequence_array[g_sequence_idx].listener = listener;
+    g_sequence_array[g_sequence_idx].time = dds_time();
+  }
+  g_sequence_idx++;
+}
+
+CU_Test(ddssec_timed_cb, simple_test)
+{
+  struct dds_security_timed_cb_data *tcb = dds_security_timed_cb_new();
+  static bool test_var = false;
+  dds_time_t future = dds_time() + DDS_SECS(2);
+  struct dds_security_timed_dispatcher_t *d1 = dds_security_timed_dispatcher_new(tcb);
+  CU_ASSERT_PTR_NOT_NULL_FATAL(d1);
+  dds_security_timed_dispatcher_add(tcb, d1, simple_callback, future, (void *)&test_var);
+  dds_security_timed_dispatcher_enable(tcb, d1, (void *)NULL);
+  CU_ASSERT_FALSE_FATAL(test_var);
+  dds_sleepfor(DDS_MSECS(500));
+  CU_ASSERT_FALSE_FATAL(test_var);
+  dds_sleepfor(DDS_SECS(2));
+  CU_ASSERT_TRUE_FATAL(test_var);
+  dds_security_timed_dispatcher_free(tcb, d1);
+  dds_security_timed_cb_free(tcb);
+}
+
+CU_Test(ddssec_timed_cb, simple_order)
+{
+  struct dds_security_timed_cb_data *tcb = dds_security_timed_cb_new();
+  struct dds_security_timed_dispatcher_t *d1 = dds_security_timed_dispatcher_new(tcb);
+  CU_ASSERT_PTR_NOT_NULL_FATAL(d1);
+  dds_time_t future = dds_time() + DDS_MSECS(20), future2 = future;
+  dds_security_timed_dispatcher_add(tcb, d1, order_callback, future, (void *)1);
+  dds_security_timed_dispatcher_add(tcb, d1, order_callback, future2, (void *)2);
+  dds_security_timed_dispatcher_enable(tcb, d1, (void *)&g_order_callback);
+  dds_sleepfor(DDS_MSECS(10));
+  dds_security_timed_dispatcher_free(tcb, d1);
+  CU_ASSERT_EQUAL_FATAL(g_order_callback[0], (void *)1);
+  CU_ASSERT_EQUAL_FATAL(g_order_callback[1], (void *)2);
+  dds_security_timed_cb_free(tcb);
+}
+
+CU_Test(ddssec_timed_cb, test_enabled_and_disabled)
+{
+  struct dds_security_timed_cb_data *tcb = dds_security_timed_cb_new();
+  static bool test_var = false;
+  dds_time_t future = dds_time() + DDS_SECS(2);
+  struct dds_security_timed_dispatcher_t *d1 = dds_security_timed_dispatcher_new(tcb);
+  CU_ASSERT_PTR_NOT_NULL_FATAL(d1);
+  dds_security_timed_dispatcher_add(tcb, d1, simple_callback, future, (void *)&test_var);
+  dds_security_timed_dispatcher_enable(tcb, d1, (void *)NULL);
+  CU_ASSERT_FALSE(test_var);
+  dds_security_timed_dispatcher_disable(tcb, d1);
+  dds_sleepfor(DDS_MSECS(500));
+  CU_ASSERT_FALSE(test_var);
+  dds_sleepfor(DDS_SECS(2));
+  CU_ASSERT_FALSE(test_var);
+  dds_security_timed_dispatcher_free(tcb, d1);
+  dds_security_timed_cb_free(tcb);
+}
+
+CU_Test(ddssec_timed_cb, simple_test_with_future)
+{
+  struct dds_security_timed_cb_data *tcb = dds_security_timed_cb_new();
+  static bool test_var = false;
+  dds_time_t now = dds_time(), future = now + DDS_SECS(2), far_future = now + DDS_SECS(10);
+  struct dds_security_timed_dispatcher_t *d1 = dds_security_timed_dispatcher_new(tcb);
+  CU_ASSERT_PTR_NOT_NULL_FATAL(d1);
+  dds_security_timed_dispatcher_enable(tcb, d1, (void *)NULL);
+  dds_security_timed_dispatcher_add(tcb, d1, simple_callback, future, (void *)&test_var);
+  dds_security_timed_dispatcher_add(tcb, d1, simple_callback, far_future, (void *)&test_var);
+  CU_ASSERT_FALSE_FATAL(test_var);
+  dds_sleepfor(DDS_MSECS(500));
+  CU_ASSERT_FALSE_FATAL(test_var);
+  dds_sleepfor(DDS_SECS(2));
+  CU_ASSERT_TRUE_FATAL(test_var);
+  dds_security_timed_dispatcher_free(tcb, d1);
+  dds_security_timed_cb_free(tcb);
+}
+
+CU_Test(ddssec_timed_cb, test_multiple_dispatchers)
+{
+  struct dds_security_timed_cb_data *tcb = dds_security_timed_cb_new();
+  static bool test_var = false;
+  dds_time_t now = dds_time(), future = now + DDS_SECS(2), far_future = now + DDS_SECS(10);
+  struct dds_security_timed_dispatcher_t *d1 = dds_security_timed_dispatcher_new(tcb);
+  struct dds_security_timed_dispatcher_t *d2 = dds_security_timed_dispatcher_new(tcb);
+  CU_ASSERT_PTR_NOT_NULL_FATAL(d1);
+  dds_security_timed_dispatcher_enable(tcb, d1, (void *)NULL);
+  dds_security_timed_dispatcher_enable(tcb, d2, (void *)NULL);
+  dds_security_timed_dispatcher_free(tcb, d2);
+  dds_security_timed_dispatcher_add(tcb, d1, simple_callback, future, (void *)&test_var);
+  dds_security_timed_dispatcher_add(tcb, d1, simple_callback, far_future, (void *)&test_var);
+  CU_ASSERT_FALSE_FATAL(test_var);
+  dds_sleepfor(DDS_MSECS(500));
+  CU_ASSERT_FALSE_FATAL(test_var);
+  dds_sleepfor(DDS_SECS(2));
+  CU_ASSERT_TRUE_FATAL(test_var);
+  dds_security_timed_dispatcher_free(tcb, d1);
+  dds_security_timed_cb_free(tcb);
+}
+
+CU_Test(ddssec_timed_cb, test_not_enabled_multiple_dispatchers)
+{
+  struct dds_security_timed_cb_data *tcb = dds_security_timed_cb_new();
+  struct dds_security_timed_dispatcher_t *d1 = dds_security_timed_dispatcher_new(tcb);
+  struct dds_security_timed_dispatcher_t *d2 = dds_security_timed_dispatcher_new(tcb);
+  CU_ASSERT_PTR_NOT_NULL_FATAL(d1);
+  CU_ASSERT_PTR_NOT_NULL_FATAL(d2);
+  dds_security_timed_dispatcher_free(tcb, d2);
+  dds_security_timed_dispatcher_free(tcb, d1);
+  dds_security_timed_cb_free(tcb);
+}
+
+CU_Test(ddssec_timed_cb, test_create_dispatcher)
+{
+  struct dds_security_timed_cb_data *tcb = dds_security_timed_cb_new();
+  struct dds_security_timed_dispatcher_t *d1 = NULL;
+  struct dds_security_timed_dispatcher_t *d2 = NULL;
+  struct dds_security_timed_dispatcher_t *d3 = NULL;
+  struct dds_security_timed_dispatcher_t *d4 = NULL;
+  struct dds_security_timed_dispatcher_t *d5 = NULL;
+
+  dds_time_t now = dds_time();
+  dds_time_t past = now - DDS_SECS(1);
+  dds_time_t present = now + DDS_SECS(1);
+  dds_time_t future = present + DDS_SECS(1);
+  dds_time_t future2 = future + DDS_SECS(10);
+
+  d1 = dds_security_timed_dispatcher_new(tcb);
+  d2 = dds_security_timed_dispatcher_new(tcb);
+  CU_ASSERT_PTR_NOT_NULL_FATAL(d1);
+  CU_ASSERT_PTR_NOT_NULL_FATAL(d2);
+
+  /* The last argument is a sequence number in which
+     the callbacks are expected to be called. */
+  dds_security_timed_dispatcher_add(tcb, d1, test_callback, present, (void *)1);
+  dds_security_timed_dispatcher_add(tcb, d2, test_callback, past, (void *)0);
+  dds_security_timed_dispatcher_add(tcb, d2, test_callback, present, (void *)2);
+  dds_security_timed_dispatcher_add(tcb, d1, test_callback, future, (void *)7);
+
+  d3 = dds_security_timed_dispatcher_new(tcb);
+  d4 = dds_security_timed_dispatcher_new(tcb);
+  d5 = dds_security_timed_dispatcher_new(tcb);
+
+  CU_ASSERT_PTR_NOT_NULL_FATAL(d3);
+  CU_ASSERT_PTR_NOT_NULL_FATAL(d4);
+  CU_ASSERT_PTR_NOT_NULL_FATAL(d5);
+
+  /* The sleeps are added to get the timing between 'present' and 'past' callbacks right. */
+  dds_sleepfor(DDS_MSECS(600));
+  dds_security_timed_dispatcher_enable(tcb, d1, (void *)NULL);
+  dds_security_timed_dispatcher_enable(tcb, d2, (void *)d2);
+  dds_security_timed_dispatcher_enable(tcb, d3, (void *)NULL);
+  /* Specifically not enabling d4 and d5. */
+  dds_sleepfor(DDS_MSECS(600));
+
+  /* The last argument is a sequence number in which the callbacks are expected to be called. */
+  dds_security_timed_dispatcher_add(tcb, d4, test_callback, past, (void *)99);
+  dds_security_timed_dispatcher_add(tcb, d2, test_callback, future, (void *)8);
+  dds_security_timed_dispatcher_add(tcb, d3, test_callback, future2, (void *)9);
+  dds_security_timed_dispatcher_add(tcb, d1, test_callback, past, (void *)3);
+  dds_security_timed_dispatcher_add(tcb, d1, test_callback, future2, (void *)10);
+  dds_security_timed_dispatcher_add(tcb, d1, test_callback, present, (void *)4);
+  dds_security_timed_dispatcher_add(tcb, d2, test_callback, present, (void *)5);
+  dds_security_timed_dispatcher_add(tcb, d1, test_callback, future, (void *)6);
+  dds_security_timed_dispatcher_add(tcb, d3, test_callback, future2, (void *)11);
+
+  int idx;
+  int n = 200;
+
+  /* Wait for the callbacks to have been triggered. Ignore the ones in the far future. */
+  while (g_sequence_idx < 8 && n-- > 0)
+    dds_sleepfor(DDS_MSECS(10));
+
+  /* Print and check sequence of triggered callbacks. */
+  for (idx = 0; idx < g_sequence_idx && idx < SEQ_SIZE; idx++)
+  {
+    int seq = (int)(long long)(g_sequence_array[idx].arg);
+    struct dds_security_timed_dispatcher_t *expected_d;
+    void *expected_l;
+
+    if (seq == 1 || seq == 6 || seq == 3 || seq == 10 || seq == 4 || seq == 7)
+    {
+      expected_d = d1;
+      expected_l = NULL;
+    }
+    else if (seq == 0 || seq == 2 || seq == 8 || seq == 5)
+    {
+      expected_d = d2;
+      expected_l = d2;
+    }
+    else if (seq == 9)
+    {
+      expected_d = d3;
+      expected_l = NULL;
+    }
+    else if (seq == 99)
+    {
+      expected_d = d4;
+      expected_l = NULL;
+      CU_FAIL_FATAL("Unexpected callback on a disabled dispatcher");
+    }
+    else
+    {
+      expected_d = NULL;
+      expected_l = NULL;
+      CU_FAIL_FATAL(sprintf("Unknown sequence idx received %d", seq));
+    }
+
+    if (seq != idx)
+    {
+      /* 6 and 7 order may be mixed since the order is not defined for same time stamp */
+      if (!((seq == 6 && idx == 7) || (seq == 7 && idx == 6)))
+      {
+        CU_FAIL_FATAL(sprintf("Unexpected sequence ordering %d vs %d\n", seq, idx));
+      }
+    }
+    if (seq > 8)
+    {
+      CU_FAIL_FATAL(sprintf("Unexpected sequence idx %d of the far future", seq));
+    }
+    if (idx > 8)
+    {
+      CU_FAIL_FATAL(sprintf("Too many callbacks %d", idx));
+    }
+
+    /* Callback contents checks. */
+    if (expected_d != NULL)
+    {
+      if (g_sequence_array[idx].d != expected_d)
+      {
+        CU_FAIL_FATAL(sprintf("Unexpected dispatcher %p vs %p\n", g_sequence_array[idx].d, expected_d));
+      }
+      if (g_sequence_array[idx].listener != expected_l)
+      {
+        CU_FAIL_FATAL(sprintf("Unexpected listener %p vs %p", g_sequence_array[idx].listener, expected_l));
+      }
+    }
+
+    /* Callback kind check. */
+    if (g_sequence_array[idx].kind != DDS_SECURITY_TIMED_CB_KIND_TIMEOUT)
+    {
+      CU_FAIL_FATAL(sprintf("Unexpected kind %d vs %d", (int)g_sequence_array[idx].kind, (int)DDS_SECURITY_TIMED_CB_KIND_TIMEOUT));
+    }
+  }
+  if (g_sequence_idx < 8)
+  {
+    CU_FAIL_FATAL(sprintf("Received %d callbacks, while 9 are expected", g_sequence_idx + 1));
+  }
+
+  /* Reset callback index to catch the deletion ones. */
+  g_sequence_idx = 0;
+
+  /* Check if deleting succeeds with dispatchers in different states */
+  if (d1)
+    dds_security_timed_dispatcher_free(tcb, d1);
+  if (d2)
+    dds_security_timed_dispatcher_free(tcb, d2);
+  if (d3)
+    dds_security_timed_dispatcher_free(tcb, d3);
+  if (d4)
+    dds_security_timed_dispatcher_free(tcb, d4);
+  if (d5)
+    dds_security_timed_dispatcher_free(tcb, d5);
+
+  /* Wait for the callbacks to have been triggered. Ignore the ones in the far future. */
+  n = 200;
+  while (g_sequence_idx < 4 && n-- > 0)
+    dds_sleepfor(DDS_MSECS(10));
+
+  /* Print and check sequence of triggered callbacks. */
+  for (idx = 0; (idx < g_sequence_idx) && (idx < SEQ_SIZE); idx++)
+  {
+    int seq = (int)(long long)(g_sequence_array[idx].arg);
+    struct dds_security_timed_dispatcher_t *expected_d;
+    if (seq == 99)
+      expected_d = d4;
+    else if (seq == 9 || seq == 11)
+      expected_d = d3;
+    else if (seq == 10)
+      expected_d = d1;
+    else
+    {
+      expected_d = NULL;
+      CU_FAIL_FATAL(sprintf("Unexpected sequence idx received %d", seq));
+    }
+    if (idx > 4)
+    {
+      CU_FAIL_FATAL(sprintf("Too many callbacks %d", idx));
+    }
+
+    /* Callback contents checks. */
+    if (expected_d != NULL)
+    {
+      if (g_sequence_array[idx].d != expected_d)
+      {
+        CU_FAIL_FATAL(sprintf("Unexpected dispatcher %p vs %p", g_sequence_array[idx].d, expected_d));
+      }
+      if (g_sequence_array[idx].listener != NULL)
+      {
+        CU_FAIL_FATAL(sprintf("Unexpected listener %p vs NULL", g_sequence_array[idx].listener));
+      }
+    }
+
+    /* Callback kind check. */
+    if (g_sequence_array[idx].kind != DDS_SECURITY_TIMED_CB_KIND_DELETE)
+    {
+      CU_FAIL_FATAL(sprintf("Unexpected kind %d vs %d", (int)g_sequence_array[idx].kind, (int)DDS_SECURITY_TIMED_CB_KIND_TIMEOUT));
+    }
+  }
+  if (g_sequence_idx < 4)
+  {
+    CU_FAIL_FATAL(sprintf("Received %d callbacks, while 3 are expected", g_sequence_idx + 1));
+  }
+
+  dds_security_timed_cb_free(tcb);
+}

From 9cc128c2951b2523dd12f7d36acd15ba0dcd7da6 Mon Sep 17 00:00:00 2001
From: Dennis Potman <dennis.potman@adlinktech.com>
Date: Thu, 5 Mar 2020 11:12:40 +0100
Subject: [PATCH 117/238] Remove setting the tracing verbosity in tests and
 make configs in security core tests more consistent

Signed-off-by: Dennis Potman <dennis.potman@adlinktech.com>
---
 src/security/core/tests/authentication.c |   1 -
 src/security/core/tests/config.c         | 239 +++++++++++++----------
 src/security/core/tests/handshake.c      |   1 -
 src/security/core/tests/plugin_loading.c | 138 ++++++++-----
 4 files changed, 226 insertions(+), 153 deletions(-)

diff --git a/src/security/core/tests/authentication.c b/src/security/core/tests/authentication.c
index 2d13079..afab49b 100644
--- a/src/security/core/tests/authentication.c
+++ b/src/security/core/tests/authentication.c
@@ -42,7 +42,6 @@ static const char *config =
     "    <ExternalDomainId>0</ExternalDomainId>"
     "    <Tag>\\${CYCLONEDDS_PID}</Tag>"
     "  </Discovery>"
-    "  <Tracing><Verbosity>config</></>"
     "  <DDSSecurity>"
     "    <Authentication>"
     "      <Library finalizeFunction=\"finalize_test_authentication_wrapped\" initFunction=\"init_test_authentication_wrapped\" path=\"" WRAPPERLIB_PATH("dds_security_authentication_wrapper") "\"/>"
diff --git a/src/security/core/tests/config.c b/src/security/core/tests/config.c
index 6bfc918..6cb404d 100644
--- a/src/security/core/tests/config.c
+++ b/src/security/core/tests/config.c
@@ -50,6 +50,15 @@
                    "file:Permissions_CA.pem", "file:Governance.p7s", "file:Permissions.p7s", \
                    pre_str, post_str, binprops)
 
+static const char *default_config =
+    "<Domain id=\"any\">"
+    "  <Discovery>"
+    "    <Tag>${CYCLONEDDS_PID}</Tag>"
+    "  </Discovery>"
+    "  <Tracing><Verbosity>finest</></>"
+    "</Domain>";
+
+
 /*
  * The 'found' variable will contain flags related to the expected log
  * messages that were received.
@@ -96,8 +105,17 @@ CU_Test(ddssec_config, empty, .init = ddsrt_init, .fini = ddsrt_fini)
     NULL
   };
 
+  const char *sec_config =
+    "<Domain id=\"any\">"
+    "  <Discovery>"
+    "    <Tag>${CYCLONEDDS_PID}</Tag>"
+    "  </Discovery>"
+    "  <Tracing><Verbosity>config</></>"
+    "  <DDSSecurity />"
+    "</Domain>";
+
   set_logger_exp(log_expected);
-  domain = dds_create_domain(0, "<DDSSecurity/>");
+  domain = dds_create_domain(0, sec_config);
   CU_ASSERT_EQUAL_FATAL(domain, DDS_RETCODE_ERROR);
   reset_logger();
 
@@ -116,7 +134,7 @@ CU_Test(ddssec_config, non, .init = ddsrt_init, .fini = ddsrt_fini)
   };
 
   set_logger_exp(log_expected);
-  domain = dds_create_domain(0, "<Tracing><Verbosity>finest</></>");
+  domain = dds_create_domain(0, default_config);
   CU_ASSERT_FATAL(domain > 0);
   dds_delete(domain);
   reset_logger();
@@ -139,6 +157,9 @@ CU_Test(ddssec_config, missing, .init = ddsrt_init, .fini = ddsrt_fini)
   /* IdentityCertificate, IdentityCA and PrivateKey values or elements are missing. */
   const char *sec_config =
     "<Domain id=\"any\">"
+    "  <Discovery>"
+    "    <Tag>${CYCLONEDDS_PID}</Tag>"
+    "  </Discovery>"
     "  <Tracing><Verbosity>finest</></>"
     "  <DDSSecurity>"
     "    <Authentication>"
@@ -190,30 +211,31 @@ CU_Test(ddssec_config, all, .init = ddsrt_init, .fini = ddsrt_fini)
   };
 
   const char *sec_config =
-    "<"DDS_PROJECT_NAME">"
-    "  <Domain id=\"any\">"
-    "    <Tracing><Verbosity>finest</></>"
-    "    <DDSSecurity>"
-    "      <Authentication>"
-    "        <Library initFunction=\"init_test_authentication_all_ok\" finalizeFunction=\"finalize_test_authentication_all_ok\" path=\"" WRAPPERLIB_PATH("dds_security_authentication_wrapper") "\"/>"
-    "        <IdentityCertificate>"TEST_IDENTITY_CERTIFICATE_DUMMY"</IdentityCertificate>"
-    "        <IdentityCA>"TEST_IDENTITY_CA_CERTIFICATE_DUMMY"</IdentityCA>"
-    "        <PrivateKey>"TEST_IDENTITY_PRIVATE_KEY_DUMMY"</PrivateKey>"
-    "        <Password>testtext_Password_testtext</Password>"
-    "        <TrustedCADirectory>testtext_Dir_testtext</TrustedCADirectory>"
-    "      </Authentication>"
-    "      <Cryptographic>"
-    "        <Library initFunction=\"init_test_cryptography_all_ok\" finalizeFunction=\"finalize_test_cryptography_all_ok\" path=\"" WRAPPERLIB_PATH("dds_security_cryptography_wrapper") "\"/>"
-    "      </Cryptographic>"
-    "      <AccessControl>"
-    "        <Library initFunction=\"init_test_access_control_all_ok\" finalizeFunction=\"finalize_test_access_control_all_ok\" path=\"" WRAPPERLIB_PATH("dds_security_access_control_wrapper") "\"/>"
-    "        <Governance>file:Governance.p7s</Governance>"
-    "        <PermissionsCA>file:Permissions_CA.pem</PermissionsCA>"
-    "        <Permissions>file:Permissions.p7s</Permissions>"
-    "      </AccessControl>"
-    "    </DDSSecurity>"
-    "  </Domain>"
-    "</"DDS_PROJECT_NAME">";
+    "<Domain id=\"any\">"
+    "  <Discovery>"
+    "    <Tag>${CYCLONEDDS_PID}</Tag>"
+    "  </Discovery>"
+    "  <Tracing><Verbosity>finest</></>"
+    "  <DDSSecurity>"
+    "    <Authentication>"
+    "      <Library initFunction=\"init_test_authentication_all_ok\" finalizeFunction=\"finalize_test_authentication_all_ok\" path=\"" WRAPPERLIB_PATH("dds_security_authentication_wrapper") "\"/>"
+    "      <IdentityCertificate>"TEST_IDENTITY_CERTIFICATE_DUMMY"</IdentityCertificate>"
+    "      <IdentityCA>"TEST_IDENTITY_CA_CERTIFICATE_DUMMY"</IdentityCA>"
+    "      <PrivateKey>"TEST_IDENTITY_PRIVATE_KEY_DUMMY"</PrivateKey>"
+    "      <Password>testtext_Password_testtext</Password>"
+    "      <TrustedCADirectory>testtext_Dir_testtext</TrustedCADirectory>"
+    "    </Authentication>"
+    "    <Cryptographic>"
+    "      <Library initFunction=\"init_test_cryptography_all_ok\" finalizeFunction=\"finalize_test_cryptography_all_ok\" path=\"" WRAPPERLIB_PATH("dds_security_cryptography_wrapper") "\"/>"
+    "    </Cryptographic>"
+    "    <AccessControl>"
+    "      <Library initFunction=\"init_test_access_control_all_ok\" finalizeFunction=\"finalize_test_access_control_all_ok\" path=\"" WRAPPERLIB_PATH("dds_security_access_control_wrapper") "\"/>"
+    "      <Governance>file:Governance.p7s</Governance>"
+    "      <PermissionsCA>file:Permissions_CA.pem</PermissionsCA>"
+    "      <Permissions>file:Permissions.p7s</Permissions>"
+    "    </AccessControl>"
+    "  </DDSSecurity>"
+    "</Domain>";
 
   set_logger_exp(log_expected);
   domain = dds_create_domain(0, sec_config);
@@ -261,6 +283,10 @@ CU_Test(ddssec_config, security, .init = ddsrt_init, .fini = ddsrt_fini)
 
   const char *sec_config =
     "<Domain id=\"any\">"
+    "  <Discovery>"
+    "    <Tag>${CYCLONEDDS_PID}</Tag>"
+    "  </Discovery>"
+    "  <Tracing><Verbosity>finest</></>"
     "  <DDSSecurity>"
     "    <Authentication>"
     "      <Library initFunction=\"init_test_authentication_all_ok\" finalizeFunction=\"finalize_test_authentication_all_ok\" path=\"" WRAPPERLIB_PATH("dds_security_authentication_wrapper") "\"/>"
@@ -278,7 +304,6 @@ CU_Test(ddssec_config, security, .init = ddsrt_init, .fini = ddsrt_fini)
     "      <Permissions>file:Permissions.p7s</Permissions>"
     "    </AccessControl>"
     "  </DDSSecurity>"
-    "  <Tracing><Verbosity>finest</></>"
     "</Domain>";
 
   set_logger_exp(log_expected);
@@ -325,30 +350,31 @@ CU_Test(ddssec_config, deprecated, .init = ddsrt_init, .fini = ddsrt_fini)
   };
 
   const char *sec_config =
-    "<"DDS_PROJECT_NAME">"
-    "  <Domain id=\"any\">"
-    "    <DDSSecurity>"
-    "      <Authentication>"
-    "        <Library initFunction=\"init_test_authentication_all_ok\" finalizeFunction=\"finalize_test_authentication_all_ok\" path=\"" WRAPPERLIB_PATH("dds_security_authentication_wrapper") "\"/>"
-    "        <IdentityCertificate>"TEST_IDENTITY_CERTIFICATE_DUMMY"</IdentityCertificate>"
-    "        <IdentityCA>"TEST_IDENTITY_CA_CERTIFICATE_DUMMY"</IdentityCA>"
-    "        <PrivateKey>"TEST_IDENTITY_PRIVATE_KEY_DUMMY"</PrivateKey>"
-    "        <Password>testtext_Password_testtext</Password>"
-    "        <TrustedCADirectory>testtext_Dir_testtext</TrustedCADirectory>"
-    "      </Authentication>"
-    "      <Cryptographic>"
-    "        <Library initFunction=\"init_test_cryptography_all_ok\" finalizeFunction=\"finalize_test_cryptography_all_ok\" path=\"" WRAPPERLIB_PATH("dds_security_cryptography_wrapper") "\"/>"
-    "      </Cryptographic>"
-    "      <AccessControl>"
-    "        <Library initFunction=\"init_test_access_control_all_ok\" finalizeFunction=\"finalize_test_access_control_all_ok\" path=\"" WRAPPERLIB_PATH("dds_security_access_control_wrapper") "\"/>"
-    "        <Governance>file:Governance.p7s</Governance>"
-    "        <PermissionsCA>file:Permissions_CA.pem</PermissionsCA>"
-    "        <Permissions>file:Permissions.p7s</Permissions>"
-    "      </AccessControl>"
-    "    </DDSSecurity>"
-    "    <Tracing><Verbosity>finest</></>"
-    "  </Domain>"
-    "</"DDS_PROJECT_NAME">";
+    "<Domain id=\"any\">"
+    "  <Discovery>"
+    "    <Tag>${CYCLONEDDS_PID}</Tag>"
+    "  </Discovery>"
+    "  <Tracing><Verbosity>finest</></>"
+    "  <DDSSecurity>"
+    "    <Authentication>"
+    "      <Library initFunction=\"init_test_authentication_all_ok\" finalizeFunction=\"finalize_test_authentication_all_ok\" path=\"" WRAPPERLIB_PATH("dds_security_authentication_wrapper") "\"/>"
+    "      <IdentityCertificate>"TEST_IDENTITY_CERTIFICATE_DUMMY"</IdentityCertificate>"
+    "      <IdentityCA>"TEST_IDENTITY_CA_CERTIFICATE_DUMMY"</IdentityCA>"
+    "      <PrivateKey>"TEST_IDENTITY_PRIVATE_KEY_DUMMY"</PrivateKey>"
+    "      <Password>testtext_Password_testtext</Password>"
+    "      <TrustedCADirectory>testtext_Dir_testtext</TrustedCADirectory>"
+    "    </Authentication>"
+    "    <Cryptographic>"
+    "      <Library initFunction=\"init_test_cryptography_all_ok\" finalizeFunction=\"finalize_test_cryptography_all_ok\" path=\"" WRAPPERLIB_PATH("dds_security_cryptography_wrapper") "\"/>"
+    "    </Cryptographic>"
+    "    <AccessControl>"
+    "      <Library initFunction=\"init_test_access_control_all_ok\" finalizeFunction=\"finalize_test_access_control_all_ok\" path=\"" WRAPPERLIB_PATH("dds_security_access_control_wrapper") "\"/>"
+    "      <Governance>file:Governance.p7s</Governance>"
+    "      <PermissionsCA>file:Permissions_CA.pem</PermissionsCA>"
+    "      <Permissions>file:Permissions.p7s</Permissions>"
+    "    </AccessControl>"
+    "  </DDSSecurity>"
+    "</Domain>";
 
   set_logger_exp(log_expected);
   domain = dds_create_domain(0, sec_config);
@@ -395,7 +421,7 @@ CU_Test(ddssec_config, qos, .init = ddsrt_init, .fini = ddsrt_fini)
   dds_qset_prop(qos, "dds.sec.auth.trusted_ca_dir", "file:/test/dir");
 
   set_logger_exp(log_expected);
-  domain = dds_create_domain(0, "<Tracing><Verbosity>finest</></>");
+  domain = dds_create_domain(0, default_config);
   CU_ASSERT_FATAL(domain > 0);
   participant = dds_create_participant(0, qos, NULL);
   CU_ASSERT_FATAL(participant > 0);
@@ -445,7 +471,7 @@ CU_Test(ddssec_config, qos_props, .init = ddsrt_init, .fini = ddsrt_fini)
   dds_qset_bprop(qos, "test.bprop1", bvalue, 3);
 
   set_logger_exp(log_expected);
-  domain = dds_create_domain(0, "<Tracing><Verbosity>finest</></>");
+  domain = dds_create_domain(0, default_config);
   CU_ASSERT_FATAL(domain > 0);
   participant = dds_create_participant(0, qos, NULL);
   CU_ASSERT_FATAL(participant > 0);
@@ -475,19 +501,24 @@ CU_Test(ddssec_config, config_qos, .init = ddsrt_init, .fini = ddsrt_fini)
   };
 
   const char *sec_config =
-    "<Tracing><Verbosity>finest</></>"
-    "<DDSSecurity>"
-    "  <Authentication>"
-    "    <IdentityCertificate>"TEST_IDENTITY_CERTIFICATE_DUMMY"</IdentityCertificate>"
-    "    <IdentityCA>"TEST_IDENTITY_CA_CERTIFICATE_DUMMY"</IdentityCA>"
-    "    <PrivateKey>"TEST_IDENTITY_PRIVATE_KEY_DUMMY"</PrivateKey>"
-    "  </Authentication>"
-    "  <AccessControl>"
-    "    <Governance>file:Governance.p7s</Governance>"
-    "    <PermissionsCA>file:Permissions_CA.pem</PermissionsCA>"
-    "    <Permissions>file:Permissions.p7s</Permissions>"
-    "  </AccessControl>"
-    "</DDSSecurity>";
+    "<Domain id=\"any\">"
+    "  <Discovery>"
+    "    <Tag>${CYCLONEDDS_PID}</Tag>"
+    "  </Discovery>"
+    "  <Tracing><Verbosity>finest</></>"
+    "  <DDSSecurity>"
+    "    <Authentication>"
+    "      <IdentityCertificate>"TEST_IDENTITY_CERTIFICATE_DUMMY"</IdentityCertificate>"
+    "      <IdentityCA>"TEST_IDENTITY_CA_CERTIFICATE_DUMMY"</IdentityCA>"
+    "      <PrivateKey>"TEST_IDENTITY_PRIVATE_KEY_DUMMY"</PrivateKey>"
+    "    </Authentication>"
+    "    <AccessControl>"
+    "      <Governance>file:Governance.p7s</Governance>"
+    "      <PermissionsCA>file:Permissions_CA.pem</PermissionsCA>"
+    "      <Permissions>file:Permissions.p7s</Permissions>"
+    "    </AccessControl>"
+    "  </DDSSecurity>"
+    "</Domain>";
 
   CU_ASSERT_FATAL((qos = dds_create_qos()) != NULL);
   dds_qset_prop(qos, DDS_SEC_PROP_AUTH_LIBRARY_PATH, WRAPPERLIB_PATH("dds_security_authentication_wrapper"));
@@ -533,26 +564,31 @@ CU_Test(ddssec_config, other_prop, .init = ddsrt_init, .fini = ddsrt_fini)
   };
 
   const char *sec_config =
-    "<Tracing><Verbosity>finest</></>"
-    "<DDSSecurity>"
-    "  <Authentication>"
-    "    <Library initFunction=\"init_test_authentication_all_ok\" finalizeFunction=\"finalize_test_authentication_all_ok\" path=\"" WRAPPERLIB_PATH("dds_security_authentication_wrapper") "\"/>"
-    "    <IdentityCertificate>"TEST_IDENTITY_CERTIFICATE_DUMMY"</IdentityCertificate>"
-    "    <IdentityCA>"TEST_IDENTITY_CA_CERTIFICATE_DUMMY"</IdentityCA>"
-    "    <PrivateKey>"TEST_IDENTITY_PRIVATE_KEY_DUMMY"</PrivateKey>"
-    "    <Password>testtext_Password_testtext</Password>"
-    "    <TrustedCADirectory>testtext_Dir_testtext</TrustedCADirectory>"
-    "  </Authentication>"
-    "  <Cryptographic>"
-    "    <Library initFunction=\"init_test_cryptography_all_ok\" finalizeFunction=\"finalize_test_cryptography_all_ok\" path=\"" WRAPPERLIB_PATH("dds_security_cryptography_wrapper") "\"/>"
-    "  </Cryptographic>"
-    "  <AccessControl>"
-    "    <Library initFunction=\"init_test_access_control_all_ok\" finalizeFunction=\"finalize_test_access_control_all_ok\" path=\"" WRAPPERLIB_PATH("dds_security_access_control_wrapper") "\"/>"
-    "    <Governance>file:Governance.p7s</Governance>"
-    "    <PermissionsCA>file:Permissions_CA.pem</PermissionsCA>"
-    "    <Permissions>file:Permissions.p7s</Permissions>"
-    "  </AccessControl>"
-    "</DDSSecurity>";
+    "<Domain id=\"any\">"
+    "  <Discovery>"
+    "    <Tag>${CYCLONEDDS_PID}</Tag>"
+    "  </Discovery>"
+    "  <Tracing><Verbosity>finest</></>"
+    "  <DDSSecurity>"
+    "    <Authentication>"
+    "      <Library initFunction=\"init_test_authentication_all_ok\" finalizeFunction=\"finalize_test_authentication_all_ok\" path=\"" WRAPPERLIB_PATH("dds_security_authentication_wrapper") "\"/>"
+    "      <IdentityCertificate>"TEST_IDENTITY_CERTIFICATE_DUMMY"</IdentityCertificate>"
+    "      <IdentityCA>"TEST_IDENTITY_CA_CERTIFICATE_DUMMY"</IdentityCA>"
+    "      <PrivateKey>"TEST_IDENTITY_PRIVATE_KEY_DUMMY"</PrivateKey>"
+    "      <Password>testtext_Password_testtext</Password>"
+    "      <TrustedCADirectory>testtext_Dir_testtext</TrustedCADirectory>"
+    "    </Authentication>"
+    "    <Cryptographic>"
+    "      <Library initFunction=\"init_test_cryptography_all_ok\" finalizeFunction=\"finalize_test_cryptography_all_ok\" path=\"" WRAPPERLIB_PATH("dds_security_cryptography_wrapper") "\"/>"
+    "    </Cryptographic>"
+    "    <AccessControl>"
+    "      <Library initFunction=\"init_test_access_control_all_ok\" finalizeFunction=\"finalize_test_access_control_all_ok\" path=\"" WRAPPERLIB_PATH("dds_security_access_control_wrapper") "\"/>"
+    "      <Governance>file:Governance.p7s</Governance>"
+    "      <PermissionsCA>file:Permissions_CA.pem</PermissionsCA>"
+    "      <Permissions>file:Permissions.p7s</Permissions>"
+    "    </AccessControl>"
+    "  </DDSSecurity>"
+    "</Domain>";
 
   CU_ASSERT_FATAL((qos = dds_create_qos()) != NULL);
   dds_qset_prop(qos, "test.dds.sec.prop1", "testtext_value1_testtext");
@@ -598,19 +634,24 @@ CU_Test(ddssec_config, qos_invalid, .init = ddsrt_init, .fini = ddsrt_fini)
   };
 
   const char *sec_config =
-    "<Tracing><Verbosity>finest</></>"
-    "<DDSSecurity>"
-    "  <Authentication>"
-    "    <IdentityCertificate>"TEST_IDENTITY_CERTIFICATE_DUMMY"</IdentityCertificate>"
-    "    <IdentityCA>"TEST_IDENTITY_CA_CERTIFICATE_DUMMY"</IdentityCA>"
-    "    <PrivateKey>"TEST_IDENTITY_PRIVATE_KEY_DUMMY"</PrivateKey>"
-    "  </Authentication>"
-    "  <AccessControl>"
-    "    <Governance>file:Governance.p7s</Governance>"
-    "    <PermissionsCA>file:Permissions_CA.pem</PermissionsCA>"
-    "    <Permissions>file:Permissions.p7s</Permissions>"
-    "  </AccessControl>"
-    "</DDSSecurity>";
+    "<Domain id=\"any\">"
+    "  <Discovery>"
+    "    <Tag>${CYCLONEDDS_PID}</Tag>"
+    "  </Discovery>"
+    "  <Tracing><Verbosity>finest</></>"
+    "  <DDSSecurity>"
+    "    <Authentication>"
+    "      <IdentityCertificate>"TEST_IDENTITY_CERTIFICATE_DUMMY"</IdentityCertificate>"
+    "      <IdentityCA>"TEST_IDENTITY_CA_CERTIFICATE_DUMMY"</IdentityCA>"
+    "      <PrivateKey>"TEST_IDENTITY_PRIVATE_KEY_DUMMY"</PrivateKey>"
+    "    </Authentication>"
+    "    <AccessControl>"
+    "      <Governance>file:Governance.p7s</Governance>"
+    "      <PermissionsCA>file:Permissions_CA.pem</PermissionsCA>"
+    "      <Permissions>file:Permissions.p7s</Permissions>"
+    "    </AccessControl>"
+    "  </DDSSecurity>"
+    "</Domain>";
 
   set_logger_exp(log_expected);
 
diff --git a/src/security/core/tests/handshake.c b/src/security/core/tests/handshake.c
index 0408bb9..5534434 100644
--- a/src/security/core/tests/handshake.c
+++ b/src/security/core/tests/handshake.c
@@ -40,7 +40,6 @@ static const char *config =
     "    <ExternalDomainId>0</ExternalDomainId>"
     "    <Tag>\\${CYCLONEDDS_PID}</Tag>"
     "  </Discovery>"
-    "  <Tracing><Verbosity>config</></>"
     "  <DDSSecurity>"
     "    <Authentication>"
     "      <Library finalizeFunction=\"finalize_test_authentication_wrapped\" initFunction=\"init_test_authentication_wrapped\" path=\"" WRAPPERLIB_PATH("dds_security_authentication_wrapper") "\"/>"
diff --git a/src/security/core/tests/plugin_loading.c b/src/security/core/tests/plugin_loading.c
index f6aa141..8e09cc5 100644
--- a/src/security/core/tests/plugin_loading.c
+++ b/src/security/core/tests/plugin_loading.c
@@ -24,6 +24,14 @@
 
 static uint32_t found;
 
+static const char *default_config =
+    "<Domain id=\"any\">"
+    "  <Discovery>"
+    "    <Tag>${CYCLONEDDS_PID}</Tag>"
+    "  </Discovery>"
+    "  <Tracing><Verbosity>finest</></>"
+    "</Domain>";
+
 static void logger(void *ptr, const dds_log_data_t *data)
 {
   char **expected = (char **)ptr;
@@ -60,6 +68,9 @@ CU_Test(ddssec_security_plugin_loading, all_ok, .init = ddsrt_init, .fini = ddsr
 
   const char *sec_config =
       "<Domain id=\"any\">"
+      "  <Discovery>"
+      "    <Tag>${CYCLONEDDS_PID}</Tag>"
+      "  </Discovery>"
       "  <Tracing><Verbosity>finest</></>"
       "  <DDSSecurity>"
       "    <Authentication>"
@@ -75,9 +86,9 @@ CU_Test(ddssec_security_plugin_loading, all_ok, .init = ddsrt_init, .fini = ddsr
       "    </Cryptographic>"
       "    <AccessControl>"
       "      <Library initFunction=\"init_test_access_control_all_ok\" finalizeFunction=\"finalize_test_access_control_all_ok\" path=\"" WRAPPERLIB_PATH("dds_security_access_control_wrapper") "\"/>"
-      "      <Governance>file:Governance.p7s</Governance>"
-      "      <PermissionsCA>file:Permissions_CA.pem</PermissionsCA>"
-      "      <Permissions>file:Permissions.p7s</Permissions>"
+      "      <Governance></Governance>"
+      "      <PermissionsCA></PermissionsCA>"
+      "      <Permissions></Permissions>"
       "    </AccessControl>"
       "  </DDSSecurity>"
       "</Domain>";
@@ -104,7 +115,10 @@ CU_Test(ddssec_security_plugin_loading, missing_finalize, .init = ddsrt_init, .f
 
   const char *sec_config =
       "<Domain id=\"any\">"
-      "  <Tracing><Verbosity>finest</></>"
+      "  <Discovery>"
+      "    <Tag>${CYCLONEDDS_PID}</Tag>"
+      "  </Discovery>"
+      "  <Tracing><Verbosity>warning</></>"
       "  <DDSSecurity>"
       "    <Authentication>"
       "      <Library initFunction=\"init_test_authentication_all_ok\" finalizeFunction=\"finalize_test_authentication_NON_EXISTING_FUNC\" path=\"" WRAPPERLIB_PATH("dds_security_authentication_wrapper") "\"/>"
@@ -119,9 +133,9 @@ CU_Test(ddssec_security_plugin_loading, missing_finalize, .init = ddsrt_init, .f
       "    </Cryptographic>"
       "    <AccessControl>"
       "      <Library initFunction=\"init_test_access_control_all_ok\" finalizeFunction=\"finalize_test_access_control_all_ok\" path=\"" WRAPPERLIB_PATH("dds_security_access_control_wrapper") "\"/>"
-      "      <Governance>file:Governance.p7s</Governance>"
-      "      <PermissionsCA>file:Permissions_CA.pem</PermissionsCA>"
-      "      <Permissions>file:Permissions.p7s</Permissions>"
+      "      <Governance></Governance>"
+      "      <PermissionsCA></PermissionsCA>"
+      "      <Permissions></Permissions>"
       "    </AccessControl>"
       "  </DDSSecurity>"
       "</Domain>";
@@ -147,7 +161,10 @@ CU_Test(ddssec_security_plugin_loading, authentication_missing_function, .init =
 
   const char *sec_config =
       "<Domain id=\"any\">"
-      "  <Tracing><Verbosity>finest</></>"
+      "  <Discovery>"
+      "    <Tag>${CYCLONEDDS_PID}</Tag>"
+      "  </Discovery>"
+      "  <Tracing><Verbosity>warning</></>"
       "  <DDSSecurity>"
       "    <Authentication>"
       "      <Library initFunction=\"init_test_authentication_missing_func\" finalizeFunction=\"finalize_test_authentication_missing_func\" path=\"" WRAPPERLIB_PATH("dds_security_authentication_wrapper") "\"/>"
@@ -162,9 +179,9 @@ CU_Test(ddssec_security_plugin_loading, authentication_missing_function, .init =
       "    </Cryptographic>"
       "    <AccessControl>"
       "      <Library initFunction=\"init_test_access_control_all_ok\" finalizeFunction=\"finalize_test_access_control_all_ok\" path=\"" WRAPPERLIB_PATH("dds_security_access_control_wrapper") "\"/>"
-      "      <Governance>file:Governance.p7s</Governance>"
-      "      <PermissionsCA>file:Permissions_CA.pem</PermissionsCA>"
-      "      <Permissions>file:Permissions.p7s</Permissions>"
+      "      <Governance></Governance>"
+      "      <PermissionsCA></PermissionsCA>"
+      "      <Permissions></Permissions>"
       "    </AccessControl>"
       "  </DDSSecurity>"
       "</Domain>";
@@ -190,7 +207,10 @@ CU_Test(ddssec_security_plugin_loading, access_control_missing_function, .init =
 
   const char *sec_config =
       "<Domain id=\"any\">"
-      "  <Tracing><Verbosity>finest</></>"
+      "  <Discovery>"
+      "    <Tag>${CYCLONEDDS_PID}</Tag>"
+      "  </Discovery>"
+      "  <Tracing><Verbosity>warning</></>"
       "  <DDSSecurity>"
       "    <Authentication>"
       "      <Library initFunction=\"init_test_authentication_all_ok\" finalizeFunction=\"finalize_test_authentication_all_ok\" path=\"" WRAPPERLIB_PATH("dds_security_authentication_wrapper") "\"/>"
@@ -205,9 +225,9 @@ CU_Test(ddssec_security_plugin_loading, access_control_missing_function, .init =
       "    </Cryptographic>"
       "    <AccessControl>"
       "      <Library initFunction=\"init_test_access_control_missing_func\" finalizeFunction=\"finalize_test_access_control_missing_func\" path=\"" WRAPPERLIB_PATH("dds_security_access_control_wrapper") "\"/>"
-      "      <Governance>file:Governance.p7s</Governance>"
-      "      <PermissionsCA>file:Permissions_CA.pem</PermissionsCA>"
-      "      <Permissions>file:Permissions.p7s</Permissions>"
+      "      <Governance></Governance>"
+      "      <PermissionsCA></PermissionsCA>"
+      "      <Permissions></Permissions>"
       "    </AccessControl>"
       "  </DDSSecurity>"
       "</Domain>";
@@ -233,7 +253,10 @@ CU_Test(ddssec_security_plugin_loading, cryptography_missing_function, .init = d
 
   const char *sec_config =
       "<Domain id=\"any\">"
-      "  <Tracing><Verbosity>finest</></>"
+      "  <Discovery>"
+      "    <Tag>${CYCLONEDDS_PID}</Tag>"
+      "  </Discovery>"
+      "  <Tracing><Verbosity>warning</></>"
       "  <DDSSecurity>"
       "    <Authentication>"
       "      <Library initFunction=\"init_test_authentication_all_ok\" finalizeFunction=\"finalize_test_authentication_all_ok\" path=\"" WRAPPERLIB_PATH("dds_security_authentication_wrapper") "\"/>"
@@ -248,9 +271,9 @@ CU_Test(ddssec_security_plugin_loading, cryptography_missing_function, .init = d
       "    </Cryptographic>"
       "    <AccessControl>"
       "      <Library initFunction=\"init_test_access_control_all_ok\" finalizeFunction=\"finalize_test_access_control_all_ok\" path=\"" WRAPPERLIB_PATH("dds_security_access_control_wrapper") "\"/>"
-      "      <Governance>file:Governance.p7s</Governance>"
-      "      <PermissionsCA>file:Permissions_CA.pem</PermissionsCA>"
-      "      <Permissions>file:Permissions.p7s</Permissions>"
+      "      <Governance></Governance>"
+      "      <PermissionsCA></PermissionsCA>"
+      "      <Permissions></Permissions>"
       "    </AccessControl>"
       "  </DDSSecurity>"
       "</Domain>";
@@ -279,7 +302,10 @@ CU_Test(ddssec_security_plugin_loading, no_library_in_path, .init = ddsrt_init,
 
   const char *sec_config =
       "<Domain id=\"any\">"
-      "  <Tracing><Verbosity>finest</></>"
+      "  <Discovery>"
+      "    <Tag>${CYCLONEDDS_PID}</Tag>"
+      "  </Discovery>"
+      "  <Tracing><Verbosity>warning</></>"
       "  <DDSSecurity>"
       "    <Authentication>"
       "      <Library initFunction=\"init_test_authentication_all_ok\" finalizeFunction=\"finalize_test_authentication_all_ok\" path=\"" WRAPPERLIB_PATH("dds_security_authentication_wrapper_INVALID") "\"/>"
@@ -294,9 +320,9 @@ CU_Test(ddssec_security_plugin_loading, no_library_in_path, .init = ddsrt_init,
       "    </Cryptographic>"
       "    <AccessControl>"
       "      <Library initFunction=\"init_test_access_control_all_ok\" finalizeFunction=\"finalize_test_access_control_all_ok\" path=\"" WRAPPERLIB_PATH("dds_security_access_control_wrapper") "\"/>"
-      "      <Governance>file:Governance.p7s</Governance>"
-      "      <PermissionsCA>file:Permissions_CA.pem</PermissionsCA>"
-      "      <Permissions>file:Permissions.p7s</Permissions>"
+      "      <Governance></Governance>"
+      "      <PermissionsCA></PermissionsCA>"
+      "      <Permissions></Permissions>"
       "    </AccessControl>"
       "  </DDSSecurity>"
       "</Domain>";
@@ -323,7 +349,10 @@ CU_Test(ddssec_security_plugin_loading, init_error, .init = ddsrt_init, .fini =
 
   const char *sec_config =
       "<Domain id=\"any\">"
-      "  <Tracing><Verbosity>finest</></>"
+      "  <Discovery>"
+      "    <Tag>${CYCLONEDDS_PID}</Tag>"
+      "  </Discovery>"
+      "  <Tracing><Verbosity>warning</></>"
       "  <DDSSecurity>"
       "    <Authentication>"
       "      <Library initFunction=\"init_test_authentication_init_error\" finalizeFunction=\"finalize_test_authentication_init_error\" path=\"" WRAPPERLIB_PATH("dds_security_authentication_wrapper") "\"/>"
@@ -338,9 +367,9 @@ CU_Test(ddssec_security_plugin_loading, init_error, .init = ddsrt_init, .fini =
       "    </Cryptographic>"
       "    <AccessControl>"
       "      <Library initFunction=\"init_test_access_control_all_ok\" finalizeFunction=\"finalize_test_access_control_all_ok\" path=\"" WRAPPERLIB_PATH("dds_security_access_control_wrapper") "\"/>"
-      "      <Governance>file:Governance.p7s</Governance>"
-      "      <PermissionsCA>file:Permissions_CA.pem</PermissionsCA>"
-      "      <Permissions>file:Permissions.p7s</Permissions>"
+      "      <Governance></Governance>"
+      "      <PermissionsCA></PermissionsCA>"
+      "      <Permissions></Permissions>"
       "    </AccessControl>"
       "  </DDSSecurity>"
       "</Domain>";
@@ -370,9 +399,9 @@ CU_Test(ddssec_security_plugin_loading, all_ok_with_props, .init = ddsrt_init, .
   dds_qset_prop(qos, DDS_SEC_PROP_AUTH_IDENTITY_CA, "testtext_IdentityCA_testtext");
   dds_qset_prop(qos, DDS_SEC_PROP_AUTH_PRIV_KEY, "testtext_PrivateKey_testtext");
   dds_qset_prop(qos, DDS_SEC_PROP_AUTH_IDENTITY_CERT, "testtext_IdentityCertificate_testtext");
-  dds_qset_prop(qos, DDS_SEC_PROP_ACCESS_PERMISSIONS_CA, "file:Permissions_CA.pem");
-  dds_qset_prop(qos, DDS_SEC_PROP_ACCESS_GOVERNANCE, "file:Governance.p7s");
-  dds_qset_prop(qos, DDS_SEC_PROP_ACCESS_PERMISSIONS, "file:Permissions.p7s");
+  dds_qset_prop(qos, DDS_SEC_PROP_ACCESS_PERMISSIONS_CA, "file:");
+  dds_qset_prop(qos, DDS_SEC_PROP_ACCESS_GOVERNANCE, "file:");
+  dds_qset_prop(qos, DDS_SEC_PROP_ACCESS_PERMISSIONS, "file:");
   dds_qset_prop(qos, DDS_SEC_PROP_AUTH_PASSWORD, "testtext_Password_testtext");
   dds_qset_prop(qos, DDS_SEC_PROP_ACCESS_TRUSTED_CA_DIR, "file:/test/dir");
 
@@ -391,7 +420,7 @@ CU_Test(ddssec_security_plugin_loading, all_ok_with_props, .init = ddsrt_init, .
   dds_qset_bprop(qos, "test.bprop1", bvalue, 3);
 
   set_logger_exp(log_expected);
-  domain = dds_create_domain(0, "<Tracing><Verbosity>finest</></>");
+  domain = dds_create_domain(0, default_config);
   CU_ASSERT_FATAL(domain > 0);
   participant = dds_create_participant(0, qos, NULL);
   CU_ASSERT_FATAL(participant > 0);
@@ -418,9 +447,9 @@ CU_Test(ddssec_security_plugin_loading, missing_plugin_property_with_props, .ini
   dds_qset_prop(qos, DDS_SEC_PROP_AUTH_IDENTITY_CA, "testtext_IdentityCA_testtext");
   dds_qset_prop(qos, DDS_SEC_PROP_AUTH_PRIV_KEY, "testtext_PrivateKey_testtext");
   dds_qset_prop(qos, DDS_SEC_PROP_AUTH_IDENTITY_CERT, "testtext_IdentityCertificate_testtext");
-  dds_qset_prop(qos, DDS_SEC_PROP_ACCESS_PERMISSIONS_CA, "file:Permissions_CA.pem");
-  dds_qset_prop(qos, DDS_SEC_PROP_ACCESS_GOVERNANCE, "file:Governance.p7s");
-  dds_qset_prop(qos, DDS_SEC_PROP_ACCESS_PERMISSIONS, "file:Permissions.p7s");
+  dds_qset_prop(qos, DDS_SEC_PROP_ACCESS_PERMISSIONS_CA, "file:");
+  dds_qset_prop(qos, DDS_SEC_PROP_ACCESS_GOVERNANCE, "file:");
+  dds_qset_prop(qos, DDS_SEC_PROP_ACCESS_PERMISSIONS, "file:");
   dds_qset_prop(qos, DDS_SEC_PROP_AUTH_PASSWORD, "testtext_Password_testtext");
   dds_qset_prop(qos, DDS_SEC_PROP_ACCESS_TRUSTED_CA_DIR, "file:/test/dir");
 
@@ -439,7 +468,7 @@ CU_Test(ddssec_security_plugin_loading, missing_plugin_property_with_props, .ini
   dds_qset_bprop(qos, "test.bprop1", bvalue, 3);
 
   set_logger_exp(log_expected);
-  domain = dds_create_domain(0, "<Tracing><Verbosity>finest</></>");
+  domain = dds_create_domain(0, default_config);
   CU_ASSERT_FATAL(domain > 0);
   participant = dds_create_participant(0, qos, NULL);
   CU_ASSERT_EQUAL_FATAL(participant, DDS_RETCODE_ERROR);
@@ -466,8 +495,8 @@ CU_Test(ddssec_security_plugin_loading, empty_plugin_property_with_props, .init
   dds_qset_prop(qos, DDS_SEC_PROP_AUTH_PRIV_KEY, "testtext_PrivateKey_testtext");
   dds_qset_prop(qos, DDS_SEC_PROP_AUTH_IDENTITY_CERT, "testtext_IdentityCertificate_testtext");
   dds_qset_prop(qos, DDS_SEC_PROP_ACCESS_PERMISSIONS_CA, "file:Permissions_CA.pem");
-  dds_qset_prop(qos, DDS_SEC_PROP_ACCESS_GOVERNANCE, "file:Governance.p7s");
-  dds_qset_prop(qos, DDS_SEC_PROP_ACCESS_PERMISSIONS, "file:Permissions.p7s");
+  dds_qset_prop(qos, DDS_SEC_PROP_ACCESS_GOVERNANCE, "file:");
+  dds_qset_prop(qos, DDS_SEC_PROP_ACCESS_PERMISSIONS, "file:");
   dds_qset_prop(qos, DDS_SEC_PROP_AUTH_PASSWORD, "testtext_Password_testtext");
   dds_qset_prop(qos, DDS_SEC_PROP_ACCESS_TRUSTED_CA_DIR, "file:/test/dir");
 
@@ -486,7 +515,7 @@ CU_Test(ddssec_security_plugin_loading, empty_plugin_property_with_props, .init
   dds_qset_bprop(qos, "test.bprop1", bvalue, 3);
 
   set_logger_exp(log_expected);
-  domain = dds_create_domain(0, "<Tracing><Verbosity>finest</></>");
+  domain = dds_create_domain(0, default_config);
   CU_ASSERT_FATAL(domain > 0);
   participant = dds_create_participant(DDS_DOMAIN_DEFAULT, qos, NULL);
   CU_ASSERT_EQUAL_FATAL(participant, DDS_RETCODE_ERROR);
@@ -512,10 +541,9 @@ CU_Test(ddssec_security_plugin_loading, missing_security_property_with_props, .i
   dds_qset_prop(qos, DDS_SEC_PROP_AUTH_IDENTITY_CA, "testtext_IdentityCA_testtext");
   dds_qset_prop(qos, DDS_SEC_PROP_AUTH_PRIV_KEY, "testtext_PrivateKey_testtext");
   dds_qset_prop(qos, DDS_SEC_PROP_AUTH_IDENTITY_CERT, "testtext_IdentityCertificate_testtext");
-  dds_qset_prop(qos, DDS_SEC_PROP_ACCESS_PERMISSIONS_CA, "file:Permissions_CA.pem");
-  dds_qset_prop(qos, DDS_SEC_PROP_ACCESS_GOVERNANCE, "file:Governance.p7s");
-  /* we ignore permissions for testing
-  //dds_qset_prop (qos, DDS_SEC_PROP_ACCESS_PERMISSIONS, "file:Permissions.p7s"); */
+  dds_qset_prop(qos, DDS_SEC_PROP_ACCESS_PERMISSIONS_CA, "file:");
+  dds_qset_prop(qos, DDS_SEC_PROP_ACCESS_GOVERNANCE, "file:");
+  //dds_qset_prop (qos, DDS_SEC_PROP_ACCESS_PERMISSIONS, "file:");
   dds_qset_prop(qos, DDS_SEC_PROP_AUTH_PASSWORD, "testtext_Password_testtext");
   dds_qset_prop(qos, DDS_SEC_PROP_ACCESS_TRUSTED_CA_DIR, "file:/test/dir");
 
@@ -534,7 +562,7 @@ CU_Test(ddssec_security_plugin_loading, missing_security_property_with_props, .i
   dds_qset_bprop(qos, "test.bprop1", bvalue, 3);
 
   set_logger_exp(log_expected);
-  domain = dds_create_domain(0, "<Tracing><Verbosity>finest</></>");
+  domain = dds_create_domain(0, default_config);
   CU_ASSERT_FATAL(domain > 0);
   participant = dds_create_participant(DDS_DOMAIN_DEFAULT, qos, NULL);
   CU_ASSERT_EQUAL_FATAL(participant, DDS_RETCODE_ERROR);
@@ -558,6 +586,9 @@ CU_Test(ddssec_security_plugin_loading, multiple_domains_different_config, .init
 
   const char *sec_config =
       "<Domain id=\"1\">"
+      "  <Discovery>"
+      "    <Tag>${CYCLONEDDS_PID}</Tag>"
+      "  </Discovery>"
       "  <Tracing><Verbosity>finest</></>"
       "  <DDSSecurity>"
       "    <Authentication>"
@@ -573,14 +604,17 @@ CU_Test(ddssec_security_plugin_loading, multiple_domains_different_config, .init
       "    </Cryptographic>"
       "    <AccessControl>"
       "      <Library initFunction=\"init_test_access_control_all_ok\" finalizeFunction=\"finalize_test_access_control_all_ok\" path=\"" WRAPPERLIB_PATH("dds_security_access_control_wrapper") "\"/>"
-      "      <Governance>file:Governance.p7s</Governance>"
-      "      <PermissionsCA>file:Permissions_CA.pem</PermissionsCA>"
-      "      <Permissions>file:Permissions.p7s</Permissions>"
+      "      <Governance></Governance>"
+      "      <PermissionsCA></PermissionsCA>"
+      "      <Permissions></Permissions>"
       "    </AccessControl>"
       "  </DDSSecurity>"
       "</Domain>"
       "<Domain id=\"2\">"
       "  <Tracing><Verbosity>finest</></>"
+      "  <Discovery>"
+      "    <Tag>${CYCLONEDDS_PID}</Tag>"
+      "  </Discovery>"
       "  <DDSSecurity>"
       "    <Authentication>"
       "      <Library initFunction=\"init_test_authentication_all_ok\" finalizeFunction=\"finalize_test_authentication_all_ok\" path=\"" WRAPPERLIB_PATH("dds_security_authentication_wrapper") "\"/>"
@@ -595,9 +629,9 @@ CU_Test(ddssec_security_plugin_loading, multiple_domains_different_config, .init
       "    </Cryptographic>"
       "    <AccessControl>"
       "      <Library initFunction=\"init_test_access_control_all_ok\" finalizeFunction=\"finalize_test_access_control_all_ok\" path=\"" WRAPPERLIB_PATH("dds_security_access_control_wrapper") "\"/>"
-      "      <Governance>file:Governance.p7s</Governance>"
-      "      <PermissionsCA>file:Permissions_CA.pem</PermissionsCA>"
-      "      <Permissions>file:Permissions.p7s</Permissions>"
+      "      <Governance></Governance>"
+      "      <PermissionsCA></PermissionsCA>"
+      "      <Permissions></Permissions>"
       "    </AccessControl>"
       "  </DDSSecurity>"
       "</Domain>";
@@ -614,9 +648,9 @@ CU_Test(ddssec_security_plugin_loading, multiple_domains_different_config, .init
   dds_qset_prop(qos, DDS_SEC_PROP_AUTH_IDENTITY_CA, "testtext_IdentityCA_testtext");
   dds_qset_prop(qos, DDS_SEC_PROP_AUTH_PRIV_KEY, "testtext_PrivateKey_testtext");
   dds_qset_prop(qos, DDS_SEC_PROP_AUTH_IDENTITY_CERT, "testtext_IdentityCertificate_testtext");
-  dds_qset_prop(qos, DDS_SEC_PROP_ACCESS_PERMISSIONS_CA, "file:Permissions_CA.pem");
-  dds_qset_prop(qos, DDS_SEC_PROP_ACCESS_GOVERNANCE, "file:Governance.p7s");
-  dds_qset_prop(qos, DDS_SEC_PROP_ACCESS_PERMISSIONS, "file:Permissions.p7s");
+  dds_qset_prop(qos, DDS_SEC_PROP_ACCESS_PERMISSIONS_CA, "file:");
+  dds_qset_prop(qos, DDS_SEC_PROP_ACCESS_GOVERNANCE, "file:");
+  dds_qset_prop(qos, DDS_SEC_PROP_ACCESS_PERMISSIONS, "file:");
   dds_qset_prop(qos, DDS_SEC_PROP_AUTH_PASSWORD, "testtext_Password_testtext");
   dds_qset_prop(qos, DDS_SEC_PROP_ACCESS_TRUSTED_CA_DIR, "file:/test/dir");
 

From b8537c0d0993ed5b011e8110afadeffac5eba513 Mon Sep 17 00:00:00 2001
From: Dennis Potman <dennis.potman@adlinktech.com>
Date: Thu, 5 Mar 2020 11:14:46 +0100
Subject: [PATCH 118/238] Add test in secure_communication suite to validate
 that payload/submsg/rtps-msg does not contain secret when using encryption
 protection kind

Signed-off-by: Dennis Potman <dennis.potman@adlinktech.com>
---
 src/security/core/tests/SecurityCoreTests.idl |   6 +
 .../core/tests/common/cryptography_wrapper.c  |  79 ++++++---
 .../core/tests/common/cryptography_wrapper.h  |   2 +
 .../core/tests/secure_communication.c         | 157 ++++++++++++++----
 4 files changed, 187 insertions(+), 57 deletions(-)

diff --git a/src/security/core/tests/SecurityCoreTests.idl b/src/security/core/tests/SecurityCoreTests.idl
index 1eb6700..8e2290c 100644
--- a/src/security/core/tests/SecurityCoreTests.idl
+++ b/src/security/core/tests/SecurityCoreTests.idl
@@ -15,4 +15,10 @@ module SecurityCoreTests {
         long    value;
     };
 #pragma keylist Type1 id
+
+    struct Type2 {
+        long    id; //@Key
+        string  text;
+    };
+#pragma keylist Type2 id
 };
diff --git a/src/security/core/tests/common/cryptography_wrapper.c b/src/security/core/tests/common/cryptography_wrapper.c
index f220c5c..fcb3ed9 100644
--- a/src/security/core/tests/common/cryptography_wrapper.c
+++ b/src/security/core/tests/common/cryptography_wrapper.c
@@ -59,6 +59,7 @@ struct dds_security_cryptography_impl {
   DDS_Security_ProtectionKind rtps_protection_kind;
   DDS_Security_ProtectionKind metadata_protection_kind;
   DDS_Security_BasicProtectionKind payload_protection_kind;
+  const char * encrypted_secret;
 };
 
 static DDS_Security_ParticipantCryptoHandle g_local_participant_handle = 0;
@@ -75,6 +76,12 @@ void set_protection_kinds(
   impl->payload_protection_kind = payload_protection_kind;
 }
 
+void set_encrypted_secret(struct dds_security_cryptography_impl * impl, const char * secret)
+{
+  assert(impl);
+  impl->encrypted_secret = secret;
+}
+
 static unsigned char * find_buffer_match(const unsigned char *input, size_t input_len, const unsigned char *match, size_t match_len)
 {
   if (match_len <= input_len && match_len > 0 && input_len > 0)
@@ -423,15 +430,46 @@ static DDS_Security_boolean encode_serialized_payload(
   switch (impl->parent->mode)
   {
     case PLUGIN_MODE_WRAPPED:
+    {
       if (!impl->instance->encode_serialized_payload (impl->instance, encoded_buffer,
           extra_inline_qos, plain_buffer, check_handle (sending_datawriter_crypto), ex))
         return false;
+      if (impl->parent->encrypted_secret && (impl->parent->payload_protection_kind == DDS_SECURITY_BASICPROTECTION_KIND_ENCRYPT
+          || expect_encrypted_buffer (impl->parent->metadata_protection_kind)
+          || expect_encrypted_buffer (impl->parent->rtps_protection_kind)))
+      {
+        if (find_buffer_match (encoded_buffer->_buffer, encoded_buffer->_length, (const unsigned char *) impl->parent->encrypted_secret, strlen (impl->parent->encrypted_secret)) != NULL)
+        {
+          ex->code = 1;
+          ex->message = ddsrt_strdup ("Expect encryption, but found secret in payload after encoding");
+          return false;
+        }
+      }
       return check_buffers (encoded_buffer, plain_buffer, impl->parent->payload_protection_kind == DDS_SECURITY_BASICPROTECTION_KIND_ENCRYPT, ex);
+    }
     default:
       return true;
   }
 }
 
+static DDS_Security_boolean check_buffer_submsg(
+    struct dds_security_crypto_transform_impl *impl,
+    DDS_Security_OctetSeq *encoded_rtps_submessage,
+    const DDS_Security_OctetSeq *plain_rtps_submessage,
+    DDS_Security_SecurityException *ex)
+{
+  bool exp_enc = expect_encrypted_buffer (impl->parent->metadata_protection_kind) || expect_encrypted_buffer (impl->parent->rtps_protection_kind);
+  if (exp_enc
+      && impl->parent->encrypted_secret
+      && find_buffer_match (encoded_rtps_submessage->_buffer, encoded_rtps_submessage->_length, (const unsigned char *) impl->parent->encrypted_secret, strlen (impl->parent->encrypted_secret)) != NULL)
+  {
+    ex->code = 1;
+    ex->message = ddsrt_strdup ("Expect encryption, but found secret in submessage after encoding");
+    return false;
+  }
+  return expect_encrypted_buffer (impl->parent->metadata_protection_kind) ? check_buffers (encoded_rtps_submessage, plain_rtps_submessage, true, ex) : true;
+}
+
 static DDS_Security_boolean encode_datawriter_submessage(
     dds_security_crypto_transform *instance,
     DDS_Security_OctetSeq *encoded_rtps_submessage,
@@ -448,8 +486,7 @@ static DDS_Security_boolean encode_datawriter_submessage(
       if (!impl->instance->encode_datawriter_submessage (impl->instance, encoded_rtps_submessage,
         plain_rtps_submessage, check_handle (sending_datawriter_crypto), receiving_datareader_crypto_list, receiving_datareader_crypto_list_index, ex))
         return false;
-      return expect_encrypted_buffer (impl->parent->metadata_protection_kind) ?
-        check_buffers (encoded_rtps_submessage, plain_rtps_submessage, true, ex) : true;
+      return check_buffer_submsg(impl, encoded_rtps_submessage, plain_rtps_submessage, ex);
     default:
       return true;
   }
@@ -470,8 +507,7 @@ static DDS_Security_boolean encode_datareader_submessage(
       if (!impl->instance->encode_datareader_submessage (impl->instance, encoded_rtps_submessage,
         plain_rtps_submessage, check_handle (sending_datareader_crypto), receiving_datawriter_crypto_list, ex))
         return false;
-      return expect_encrypted_buffer (impl->parent->metadata_protection_kind) ?
-        check_buffers (encoded_rtps_submessage, plain_rtps_submessage, true, ex) : true;
+      return check_buffer_submsg(impl, encoded_rtps_submessage, plain_rtps_submessage, ex);
     default:
       return true;
   }
@@ -493,6 +529,14 @@ static DDS_Security_boolean encode_rtps_message(
       if (!impl->instance->encode_rtps_message (impl->instance, encoded_rtps_message,
           plain_rtps_message, check_handle (sending_participant_crypto), receiving_participant_crypto_list, receiving_participant_crypto_list_index, ex))
         return false;
+      if (impl->parent->encrypted_secret
+          && expect_encrypted_buffer (impl->parent->rtps_protection_kind)
+          && find_buffer_match (encoded_rtps_message->_buffer, encoded_rtps_message->_length, (const unsigned char *) impl->parent->encrypted_secret, strlen (impl->parent->encrypted_secret)) != NULL)
+      {
+        ex->code = 1;
+        ex->message = ddsrt_strdup ("Expect encryption, but found secret in RTPS message after encoding");
+        return false;
+      }
       return expect_encrypted_buffer (impl->parent->rtps_protection_kind) ?
         check_buffers (encoded_rtps_message, plain_rtps_message, true, ex) : true;
     default:
@@ -512,11 +556,8 @@ static DDS_Security_boolean decode_rtps_message(
   switch (impl->parent->mode)
   {
     case PLUGIN_MODE_WRAPPED:
-      if (!impl->instance->decode_rtps_message (impl->instance, plain_buffer, encoded_buffer,
-          check_handle (receiving_participant_crypto), check_handle (sending_participant_crypto), ex))
-        return false;
-      return expect_encrypted_buffer (impl->parent->rtps_protection_kind) ?
-        check_buffers (encoded_buffer, plain_buffer, true, ex) : true;
+      return impl->instance->decode_rtps_message (impl->instance, plain_buffer, encoded_buffer,
+          check_handle (receiving_participant_crypto), check_handle (sending_participant_crypto), ex);
     default:
       return true;
   }
@@ -555,11 +596,8 @@ static DDS_Security_boolean decode_datawriter_submessage(
   switch (impl->parent->mode)
   {
     case PLUGIN_MODE_WRAPPED:
-      if (!impl->instance->decode_datawriter_submessage (impl->instance, plain_rtps_submessage,
-          encoded_rtps_submessage, check_handle (receiving_datareader_crypto), check_handle (sending_datawriter_crypto), ex))
-        return false;
-      return expect_encrypted_buffer (impl->parent->metadata_protection_kind) ?
-        check_buffers (encoded_rtps_submessage, plain_rtps_submessage, true, ex) : true;
+      return impl->instance->decode_datawriter_submessage (impl->instance, plain_rtps_submessage,
+          encoded_rtps_submessage, check_handle (receiving_datareader_crypto), check_handle (sending_datawriter_crypto), ex);
     default:
       return true;
   }
@@ -577,11 +615,8 @@ static DDS_Security_boolean decode_datareader_submessage(
   switch (impl->parent->mode)
   {
     case PLUGIN_MODE_WRAPPED:
-      if (!impl->instance->decode_datareader_submessage (impl->instance, plain_rtps_submessage,
-          encoded_rtps_submessage, check_handle (receiving_datawriter_crypto), check_handle (sending_datareader_crypto), ex))
-        return false;
-      return expect_encrypted_buffer (impl->parent->metadata_protection_kind) ?
-        check_buffers (encoded_rtps_submessage, plain_rtps_submessage, true, ex) : true;
+      return impl->instance->decode_datareader_submessage (impl->instance, plain_rtps_submessage,
+          encoded_rtps_submessage, check_handle (receiving_datawriter_crypto), check_handle (sending_datareader_crypto), ex);
     default:
       return true;
   }
@@ -600,10 +635,8 @@ static DDS_Security_boolean decode_serialized_payload(
   switch (impl->parent->mode)
   {
     case PLUGIN_MODE_WRAPPED:
-      if (!impl->instance->decode_serialized_payload(impl->instance, plain_buffer, encoded_buffer,
-          inline_qos, check_handle (receiving_datareader_crypto), check_handle (sending_datawriter_crypto), ex))
-        return false;
-      return check_buffers(encoded_buffer, plain_buffer, impl->parent->payload_protection_kind == DDS_SECURITY_BASICPROTECTION_KIND_ENCRYPT, ex);
+      return impl->instance->decode_serialized_payload(impl->instance, plain_buffer, encoded_buffer,
+          inline_qos, check_handle (receiving_datareader_crypto), check_handle (sending_datawriter_crypto), ex);
     default:
       return true;
   }
diff --git a/src/security/core/tests/common/cryptography_wrapper.h b/src/security/core/tests/common/cryptography_wrapper.h
index 9fd17d1..42ed1ef 100644
--- a/src/security/core/tests/common/cryptography_wrapper.h
+++ b/src/security/core/tests/common/cryptography_wrapper.h
@@ -24,6 +24,8 @@ SECURITY_EXPORT void set_protection_kinds(
   DDS_Security_ProtectionKind metadata_protection_kind,
   DDS_Security_BasicProtectionKind payload_protection_kind);
 
+SECURITY_EXPORT void set_encrypted_secret(struct dds_security_cryptography_impl * impl, const char * secret);
+
 /* Init in all-ok mode: all functions return success without calling the actual plugin */
 SECURITY_EXPORT int32_t init_test_cryptography_all_ok(const char *argument, void **context);
 SECURITY_EXPORT int32_t finalize_test_cryptography_all_ok(void *context);
diff --git a/src/security/core/tests/secure_communication.c b/src/security/core/tests/secure_communication.c
index 978aa62..039174a 100644
--- a/src/security/core/tests/secure_communication.c
+++ b/src/security/core/tests/secure_communication.c
@@ -105,8 +105,13 @@ struct domain_sec_config {
   DDS_Security_ProtectionKind rtps_pk;
   DDS_Security_ProtectionKind metadata_pk;
   DDS_Security_BasicProtectionKind payload_pk;
+  const char * payload_secret;
 };
 
+typedef void (*set_crypto_params_fn)(struct dds_security_cryptography_impl *, const struct domain_sec_config *);
+typedef dds_entity_t (*pubsub_create_fn)(dds_entity_t, const dds_qos_t *qos, const dds_listener_t *listener);
+typedef dds_entity_t (*ep_create_fn)(dds_entity_t, dds_entity_t, const dds_qos_t *qos, const dds_listener_t *listener);
+
 
 static struct dds_security_cryptography_impl * get_crypto_context(dds_entity_t participant)
 {
@@ -158,6 +163,16 @@ static void print_config_vars(struct kvp *vars)
     printf("%s=%s; ", vars[i].key, vars[i].value);
 }
 
+static dds_qos_t *get_qos()
+{
+  dds_qos_t * qos = dds_create_qos ();
+  CU_ASSERT_FATAL (qos != NULL);
+  dds_qset_history (qos, DDS_HISTORY_KEEP_ALL, -1);
+  dds_qset_durability (qos, DDS_DURABILITY_TRANSIENT_LOCAL);
+  dds_qset_reliability (qos, DDS_RELIABILITY_RELIABLE, DDS_INFINITY);
+  return qos;
+}
+
 static char *create_topic_name(const char *prefix, uint32_t nr, char *name, size_t size)
 {
   ddsrt_pid_t pid = ddsrt_getpid ();
@@ -166,20 +181,20 @@ static char *create_topic_name(const char *prefix, uint32_t nr, char *name, size
   return name;
 }
 
-static dds_entity_t create_pp (dds_domainid_t domain_id, const struct domain_sec_config * domain_config)
+static dds_entity_t create_pp (dds_domainid_t domain_id, const struct domain_sec_config * domain_config, set_crypto_params_fn set_crypto_params)
 {
   dds_entity_t pp = dds_create_participant (domain_id, NULL, NULL);
   CU_ASSERT_FATAL (pp > 0);
   struct dds_security_cryptography_impl * crypto_context = get_crypto_context (pp);
   CU_ASSERT_FATAL (crypto_context != NULL);
-  set_protection_kinds (crypto_context, domain_config->rtps_pk, domain_config->metadata_pk, domain_config->payload_pk);
+  if (set_crypto_params)
+    set_crypto_params (crypto_context, domain_config);
   return pp;
 }
 
-typedef dds_entity_t (*pubsub_create_fn)(dds_entity_t, const dds_qos_t *qos, const dds_listener_t *listener);
 
 static void create_dom_pp_pubsub(dds_domainid_t domain_id_base, const char * domain_conf, const struct domain_sec_config * domain_sec_config,
-    size_t n_dom, size_t n_pp, dds_entity_t * doms, dds_entity_t * pps, dds_entity_t * pubsubs, pubsub_create_fn pubsub_create)
+    size_t n_dom, size_t n_pp, dds_entity_t * doms, dds_entity_t * pps, dds_entity_t * pubsubs, pubsub_create_fn pubsub_create, set_crypto_params_fn set_crypto_params)
 {
   for (size_t d = 0; d < n_dom; d++)
   {
@@ -188,14 +203,14 @@ static void create_dom_pp_pubsub(dds_domainid_t domain_id_base, const char * dom
     for (size_t p = 0; p < n_pp; p++)
     {
       size_t pp_index = d * n_pp + p;
-      pps[pp_index] = create_pp (domain_id_base + (uint32_t)d, domain_sec_config);
+      pps[pp_index] = create_pp (domain_id_base + (uint32_t)d, domain_sec_config, set_crypto_params);
       pubsubs[pp_index] = pubsub_create (pps[pp_index], NULL, NULL);
       CU_ASSERT_FATAL (pubsubs[pp_index] > 0);
     }
   }
 }
 
-static void test_init(const struct domain_sec_config * domain_config, size_t n_sub_domains, size_t n_sub_participants, size_t n_pub_domains, size_t n_pub_participants)
+static void test_init(const struct domain_sec_config * domain_config, size_t n_sub_domains, size_t n_sub_participants, size_t n_pub_domains, size_t n_pub_participants, set_crypto_params_fn set_crypto_params)
 {
   assert (n_sub_domains < MAX_DOMAINS);
   assert (n_sub_participants < MAX_PARTICIPANTS);
@@ -224,12 +239,12 @@ static void test_init(const struct domain_sec_config * domain_config, size_t n_s
 
   char *conf_pub = ddsrt_expand_vars_sh (config, &expand_lookup_vars_env, config_vars);
   create_dom_pp_pubsub (DDS_DOMAINID_PUB, conf_pub, domain_config, n_pub_domains, n_pub_participants,
-      g_pub_domains, g_pub_participants, g_pub_publishers, &dds_create_publisher);
+      g_pub_domains, g_pub_participants, g_pub_publishers, &dds_create_publisher, set_crypto_params);
   dds_free (conf_pub);
 
   char *conf_sub = ddsrt_expand_vars_sh (config, &expand_lookup_vars_env, config_vars);
   create_dom_pp_pubsub (DDS_DOMAINID_SUB, conf_sub, domain_config, n_sub_domains, n_sub_participants,
-      g_sub_domains, g_sub_participants, g_sub_subscribers, &dds_create_subscriber);
+      g_sub_domains, g_sub_participants, g_sub_subscribers, &dds_create_subscriber, set_crypto_params);
   dds_free (conf_sub);
 
   dds_free (gov_config_signed);
@@ -290,9 +305,8 @@ static void reader_wait_for_data(dds_entity_t sub_participant, dds_entity_t read
   dds_delete (waitset_rd);
 }
 
-typedef dds_entity_t (*ep_create_fn)(dds_entity_t, dds_entity_t, const dds_qos_t *qos, const dds_listener_t *listener);
-
-static void create_eps (dds_entity_t **endpoints, dds_entity_t **topics, size_t n_dom, size_t n_pp, size_t n_eps, const char * topic_name, const dds_entity_t * pps, const dds_qos_t * qos, ep_create_fn ep_create, unsigned status_mask)
+static void create_eps (dds_entity_t **endpoints, dds_entity_t **topics, size_t n_dom, size_t n_pp, size_t n_eps, const char * topic_name, const dds_topic_descriptor_t *topic_descriptor,
+    const dds_entity_t * pps, const dds_qos_t * qos, ep_create_fn ep_create, unsigned status_mask)
 {
   *topics = ddsrt_malloc (n_dom * n_pp * sizeof (dds_entity_t));
   *endpoints = ddsrt_malloc (n_dom * n_pp * n_eps * sizeof (dds_entity_t));
@@ -301,7 +315,7 @@ static void create_eps (dds_entity_t **endpoints, dds_entity_t **topics, size_t
     for (size_t p = 0; p < n_pp; p++)
     {
       size_t pp_index = d * n_pp + p;
-      (*topics)[pp_index] = dds_create_topic (pps[pp_index], &SecurityCoreTests_Type1_desc, topic_name, NULL, NULL);
+      (*topics)[pp_index] = dds_create_topic (pps[pp_index], topic_descriptor, topic_name, NULL, NULL);
       CU_ASSERT_FATAL ((*topics)[pp_index] > 0);
       for (size_t e = 0; e < n_eps; e++)
       {
@@ -315,9 +329,16 @@ static void create_eps (dds_entity_t **endpoints, dds_entity_t **topics, size_t
   }
 }
 
+static void free_eps(dds_entity_t *endpoints, dds_entity_t *topics)
+{
+  ddsrt_free (endpoints);
+  ddsrt_free (topics);
+}
+
 static void test_write_read(struct domain_sec_config *domain_config,
     size_t n_sub_domains, size_t n_sub_participants, size_t n_readers,
-    size_t n_pub_domains, size_t n_pub_participants, size_t n_writers)
+    size_t n_pub_domains, size_t n_pub_participants, size_t n_writers,
+    set_crypto_params_fn set_crypto_params)
 {
   dds_entity_t *writers, *readers, *writer_topics, *reader_topics;
   dds_qos_t *qos;
@@ -330,18 +351,13 @@ static void test_write_read(struct domain_sec_config *domain_config,
 
   printf("Testing: %"PRIuSIZE" subscriber domains, %"PRIuSIZE" pp per domain, %"PRIuSIZE" rd per pp; %"PRIuSIZE" publishing domains, %"PRIuSIZE" pp per domain, %"PRIuSIZE" wr per pp\n",
       n_sub_domains, n_sub_participants, n_readers, n_pub_domains, n_pub_participants, n_writers);
-  test_init(domain_config, n_sub_domains, n_sub_participants, n_pub_domains, n_pub_participants);
+  test_init(domain_config, n_sub_domains, n_sub_participants, n_pub_domains, n_pub_participants, set_crypto_params);
 
   create_topic_name("ddssec_secure_communication_", g_topic_nr++, name, sizeof name);
 
-  qos = dds_create_qos ();
-  CU_ASSERT_FATAL (qos != NULL);
-  dds_qset_history (qos, DDS_HISTORY_KEEP_ALL, -1);
-  dds_qset_durability (qos, DDS_DURABILITY_TRANSIENT_LOCAL);
-  dds_qset_reliability (qos, DDS_RELIABILITY_RELIABLE, DDS_INFINITY);
-
-  create_eps (&writers, &writer_topics, n_pub_domains, n_pub_participants, n_writers, name, g_pub_participants, qos, &dds_create_writer, DDS_PUBLICATION_MATCHED_STATUS);
-  create_eps (&readers, &reader_topics, n_sub_domains, n_sub_participants, n_readers, name, g_sub_participants, qos, &dds_create_reader, DDS_DATA_AVAILABLE_STATUS);
+  qos = get_qos ();
+  create_eps (&writers, &writer_topics, n_pub_domains, n_pub_participants, n_writers, name, &SecurityCoreTests_Type1_desc, g_pub_participants, qos, &dds_create_writer, DDS_PUBLICATION_MATCHED_STATUS);
+  create_eps (&readers, &reader_topics, n_sub_domains, n_sub_participants, n_readers, name, &SecurityCoreTests_Type1_desc, g_sub_participants, qos, &dds_create_reader, DDS_DATA_AVAILABLE_STATUS);
 
   for (size_t d = 0; d < n_pub_domains; d++)
   {
@@ -389,35 +405,91 @@ static void test_write_read(struct domain_sec_config *domain_config,
   /* Cleanup */
   dds_delete_qos (qos);
   test_fini (n_sub_domains, n_pub_domains);
-  ddsrt_free (readers);
-  ddsrt_free (writers);
-  ddsrt_free (reader_topics);
-  ddsrt_free (writer_topics);
+  free_eps (readers, reader_topics);
+  free_eps (writers, writer_topics);
+}
+
+static void set_encryption_parameters_basic(struct dds_security_cryptography_impl * crypto_context, const struct domain_sec_config *domain_config)
+{
+  set_protection_kinds (crypto_context, domain_config->rtps_pk, domain_config->metadata_pk, domain_config->payload_pk);
+}
+
+static void set_encryption_parameters_secret(struct dds_security_cryptography_impl * crypto_context, const struct domain_sec_config *domain_config)
+{
+  set_encrypted_secret (crypto_context, domain_config->payload_secret);
 }
 
 static void test_discovery_liveliness_protection(DDS_Security_ProtectionKind discovery_pk, DDS_Security_ProtectionKind liveliness_pk)
 {
-  struct domain_sec_config domain_config = { discovery_pk, liveliness_pk, PK_N, PK_N, BPK_N };
+  struct domain_sec_config domain_config = { discovery_pk, liveliness_pk, PK_N, PK_N, BPK_N, NULL };
   /* FIXME: add more asserts in wrapper or test instead of just testing communication */
-  test_write_read (&domain_config, 1, 1, 1, 1, 1, 1);
+  test_write_read (&domain_config, 1, 1, 1, 1, 1, 1, NULL);
 }
 
 static void test_data_protection_kind(DDS_Security_ProtectionKind rtps_pk, DDS_Security_ProtectionKind metadata_pk, DDS_Security_BasicProtectionKind payload_pk)
 {
-  struct domain_sec_config domain_config = { PK_N, PK_N, rtps_pk, metadata_pk, payload_pk };
-  test_write_read (&domain_config, 1, 1, 1, 1, 1, 1);
+  struct domain_sec_config domain_config = { PK_N, PK_N, rtps_pk, metadata_pk, payload_pk, NULL };
+  test_write_read (&domain_config, 1, 1, 1, 1, 1, 1, &set_encryption_parameters_basic);
 }
 
 static void test_multiple_readers(size_t n_dom, size_t n_pp, size_t n_rd, DDS_Security_ProtectionKind metadata_pk, DDS_Security_BasicProtectionKind payload_pk)
 {
-  struct domain_sec_config domain_config = { PK_N, PK_N, PK_N, metadata_pk, payload_pk };
-  test_write_read (&domain_config, n_dom, n_pp, n_rd, 1, 1, 1);
+  struct domain_sec_config domain_config = { PK_N, PK_N, PK_N, metadata_pk, payload_pk, NULL };
+  test_write_read (&domain_config, n_dom, n_pp, n_rd, 1, 1, 1, NULL);
 }
 
 static void test_multiple_writers(size_t n_rd_dom, size_t n_rd, size_t n_wr_dom, size_t n_wr, DDS_Security_ProtectionKind metadata_pk)
 {
-  struct domain_sec_config domain_config = { PK_N, PK_N, PK_N, metadata_pk, BPK_N };
-  test_write_read (&domain_config, n_rd_dom, 1, n_rd, n_wr_dom, 1, n_wr);
+  struct domain_sec_config domain_config = { PK_N, PK_N, PK_N, metadata_pk, BPK_N, NULL };
+  test_write_read (&domain_config, n_rd_dom, 1, n_rd, n_wr_dom, 1, n_wr, NULL);
+}
+
+static void test_payload_secret(DDS_Security_ProtectionKind rtps_pk, DDS_Security_ProtectionKind metadata_pk, DDS_Security_BasicProtectionKind payload_pk)
+{
+  dds_entity_t *writers, *readers, *writer_topics, *reader_topics;
+  const char * secret = "my_test_secret";
+  dds_qos_t *qos;
+  SecurityCoreTests_Type2 sample;
+  SecurityCoreTests_Type2 rd_sample = {0, NULL};
+  void * samples[] = { &rd_sample };
+  dds_sample_info_t info[1];
+  dds_return_t ret;
+  char name[100];
+  struct domain_sec_config domain_config = { PK_N, PK_N, rtps_pk, metadata_pk, payload_pk, secret };
+
+  size_t payload_sz = 100 * strlen (secret) + 1;
+  sample.id = 1;
+  sample.text = ddsrt_malloc (payload_sz);
+  for (size_t n = 0; n < 100; n++)
+    memcpy (sample.text + n * strlen (secret), secret, strlen (secret));
+  sample.text[payload_sz - 1] = '\0';
+
+  test_init (&domain_config, 1, 1, 1, 1, &set_encryption_parameters_secret);
+  create_topic_name ("ddssec_secure_communication_", g_topic_nr++, name, sizeof name);
+  qos = get_qos ();
+  create_eps (&writers, &writer_topics, 1, 1, 1, name, &SecurityCoreTests_Type2_desc, g_pub_participants, qos, &dds_create_writer, DDS_PUBLICATION_MATCHED_STATUS);
+  create_eps (&readers, &reader_topics, 1, 1, 1, name, &SecurityCoreTests_Type2_desc, g_sub_participants, qos, &dds_create_reader, DDS_DATA_AVAILABLE_STATUS);
+  dds_delete_qos (qos);
+  sync_writer_to_readers (g_pub_participants[0], writers[0], 1);
+  ret = dds_write (writers[0], &sample);
+  CU_ASSERT_EQUAL_FATAL (ret, DDS_RETCODE_OK);
+
+  while (true)
+  {
+    if ((ret = dds_take (readers[0], samples, info, 1, 1)) == 0)
+    {
+      reader_wait_for_data (g_sub_participants[0], readers[0]);
+      continue;
+    }
+    CU_ASSERT_EQUAL_FATAL (ret, 1);
+    break;
+  }
+
+  test_fini (1, 1);
+  free_eps (readers, reader_topics);
+  free_eps (writers, writer_topics);
+  ddsrt_free (rd_sample.text);
+  ddsrt_free (sample.text);
 }
 
 CU_Test(ddssec_secure_communication, protection_kinds, .timeout = 120)
@@ -450,6 +522,23 @@ CU_Test(ddssec_secure_communication, discovery_liveliness_protection, .timeout =
   }
 }
 
+CU_Test(ddssec_secure_communication, check_encrypted_secret, .timeout = 60)
+{
+  DDS_Security_ProtectionKind rtps_pk[] = { PK_N, PK_E, PK_EOA };
+  DDS_Security_ProtectionKind metadata_pk[] = { PK_N, PK_E, PK_EOA };
+  DDS_Security_BasicProtectionKind payload_pk[] = { BPK_N, BPK_E };
+  for (size_t rtps = 0; rtps < sizeof (rtps_pk) / sizeof (rtps_pk[0]); rtps++)
+  {
+    for (size_t metadata = 0; metadata < sizeof (metadata_pk) / sizeof (metadata_pk[0]); metadata++)
+    {
+      for (size_t payload = 0; payload < sizeof (payload_pk) / sizeof (payload_pk[0]); payload++)
+      {
+        test_payload_secret (rtps_pk[rtps], metadata_pk[metadata], payload_pk[payload]);
+      }
+    }
+  }
+}
+
 CU_TheoryDataPoints(ddssec_secure_communication, multiple_readers) = {
     CU_DataPoints(size_t, 1, 1, 1, 3), /* number of domains */
     CU_DataPoints(size_t, 1, 3, 1, 3), /* number of participants per domain */

From 8ca17805380787aff9bff6deb2b3196f0baaabff Mon Sep 17 00:00:00 2001
From: Marcel Jordense <marcel.jordense@adlinktech.com>
Date: Wed, 4 Mar 2020 18:34:30 +0100
Subject: [PATCH 119/238] Correct problem with cleanup of security handshake

Signed-off-by: Marcel Jordense <marcel.jordense@adlinktech.com>
---
 .../ddsi/include/dds/ddsi/ddsi_handshake.h    |  3 +-
 src/core/ddsi/src/ddsi_handshake.c            | 23 ++++++++----
 src/core/ddsi/src/q_entity.c                  | 30 ++++++++--------
 src/core/ddsi/src/q_transmit.c                |  7 +++-
 .../dds/security/core/dds_security_fsm.h      | 18 ++++++++++
 src/security/core/src/dds_security_fsm.c      | 35 +++++++++----------
 6 files changed, 74 insertions(+), 42 deletions(-)

diff --git a/src/core/ddsi/include/dds/ddsi/ddsi_handshake.h b/src/core/ddsi/include/dds/ddsi/ddsi_handshake.h
index f473d0f..307eb72 100644
--- a/src/core/ddsi/include/dds/ddsi/ddsi_handshake.h
+++ b/src/core/ddsi/include/dds/ddsi/ddsi_handshake.h
@@ -131,10 +131,9 @@ void ddsi_handshake_register(struct participant *pp, struct proxy_participant *p
  *
  * @param[in] pp         The local participant.
  * @param[in] proxypp    The remote participant.
- * @param[in] handshake  The handshake.
  *
  */
-void ddsi_handshake_remove(struct participant *pp, struct proxy_participant *proxypp, struct ddsi_handshake *handshake);
+void ddsi_handshake_remove(struct participant *pp, struct proxy_participant *proxypp);
 
 /**
  * @brief Searches for the handshake associated with the specified participants
diff --git a/src/core/ddsi/src/ddsi_handshake.c b/src/core/ddsi/src/ddsi_handshake.c
index 5d1b967..847c796 100644
--- a/src/core/ddsi/src/ddsi_handshake.c
+++ b/src/core/ddsi/src/ddsi_handshake.c
@@ -21,6 +21,7 @@
 #include "dds/ddsi/ddsi_entity_index.h"
 #include "dds/ddsi/ddsi_plist.h"
 #include "dds/ddsi/q_entity.h"
+#include "dds/ddsi/q_gc.h"
 #include "dds/security/dds_security_api_types.h"
 #include "dds/security/dds_security_api.h"
 #include "dds/ddsi/ddsi_security_omg.h"
@@ -991,6 +992,7 @@ void ddsi_handshake_release(struct ddsi_handshake *handshake)
     DDS_Security_DataHolder_free(handshake->handshake_message_out);
     DDS_Security_DataHolder_free(handshake->remote_auth_request_token);
     DDS_Security_OctetSeq_deinit(&handshake->pdata);
+    dds_security_fsm_free(handshake->fsm);
     ddsrt_mutex_destroy(&handshake->lock);
     ddsrt_free(handshake);
   }
@@ -1146,22 +1148,31 @@ static struct ddsi_handshake * ddsi_handshake_find_locked(
   return ddsrt_avl_lookup(&handshake_treedef, &hsadmin->handshakes, &handles);
 }
 
-void ddsi_handshake_remove(struct participant *pp, struct proxy_participant *proxypp, struct ddsi_handshake *handshake)
+static void gc_delete_handshale (struct gcreq *gcreq)
+{
+  struct ddsi_handshake *handshake = gcreq->arg;
+
+  ddsi_handshake_release(handshake);
+  gcreq_free(gcreq);
+}
+
+void ddsi_handshake_remove(struct participant *pp, struct proxy_participant *proxypp)
 {
   struct ddsi_hsadmin *hsadmin = pp->e.gv->hsadmin;
+  struct ddsi_handshake *handshake = NULL;
 
   ddsrt_mutex_lock(&hsadmin->lock);
-  if (!handshake)
-    handshake = ddsi_handshake_find_locked(hsadmin, pp, proxypp);
+  handshake = ddsi_handshake_find_locked(hsadmin, pp, proxypp);
   if (handshake)
   {
+    struct gcreq *gcreq = gcreq_new (pp->e.gv->gcreq_queue, gc_delete_handshale);
     ddsrt_avl_delete(&handshake_treedef, &hsadmin->handshakes, handshake);
     ddsrt_atomic_st32(&handshake->deleting, 1);
+    dds_security_fsm_stop(handshake->fsm);
+    gcreq->arg = handshake;
+    gcreq_enqueue (gcreq);
   }
   ddsrt_mutex_unlock(&hsadmin->lock);
-  if (handshake && handshake->fsm)
-    dds_security_fsm_free(handshake->fsm);
-  ddsi_handshake_release(handshake);
 }
 
 struct ddsi_handshake * ddsi_handshake_find(struct participant *pp, struct proxy_participant *proxypp)
diff --git a/src/core/ddsi/src/q_entity.c b/src/core/ddsi/src/q_entity.c
index ab60485..69b75b5 100644
--- a/src/core/ddsi/src/q_entity.c
+++ b/src/core/ddsi/src/q_entity.c
@@ -668,7 +668,7 @@ static void disconnect_participant_secure(struct participant *pp)
     entidx_enum_proxy_participant_init (&it, gv->entity_index);
     while ((proxypp = entidx_enum_proxy_participant_next (&it)) != NULL)
     {
-      ddsi_handshake_remove(pp, proxypp, NULL);
+      ddsi_handshake_remove(pp, proxypp);
     }
     entidx_enum_proxy_participant_fini (&it);
   }
@@ -3102,19 +3102,21 @@ static void match_volatile_secure_endpoints (struct participant *pp, struct prox
 
   guid = pp->e.guid;
   guid.entityid.u = NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_VOLATILE_SECURE_READER;
-  rd = entidx_lookup_reader_guid (pp->e.gv->entity_index, &guid);
-  assert(rd);
+  if ((rd = entidx_lookup_reader_guid (pp->e.gv->entity_index, &guid)) == NULL)
+    return;
+
   guid.entityid.u = NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_VOLATILE_SECURE_WRITER;
-  wr = entidx_lookup_writer_guid (pp->e.gv->entity_index, &guid);
-  assert(wr);
+  if ((wr = entidx_lookup_writer_guid (pp->e.gv->entity_index, &guid)) == NULL)
+    return;
 
   guid = proxypp->e.guid;
   guid.entityid.u = NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_VOLATILE_SECURE_READER;
-  prd = entidx_lookup_proxy_reader_guid (pp->e.gv->entity_index, &guid);
-  assert(rd);
+  if ((prd = entidx_lookup_proxy_reader_guid (pp->e.gv->entity_index, &guid)) == NULL)
+    return;
+
   guid.entityid.u = NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_VOLATILE_SECURE_WRITER;
-  pwr = entidx_lookup_proxy_writer_guid (pp->e.gv->entity_index, &guid);
-  assert(wr);
+  if ((pwr = entidx_lookup_proxy_writer_guid (pp->e.gv->entity_index, &guid)) == NULL)
+    return;
 
   connect_proxy_writer_with_reader_wrapper(&pwr->e, &rd->e, tnow);
   connect_writer_with_proxy_reader_wrapper(&wr->e, &prd->e, tnow);
@@ -4771,7 +4773,7 @@ void handshake_end_cb(struct ddsi_handshake *handshake, struct participant *pp,
   case STATE_HANDSHAKE_OK:
     DDS_CLOG (DDS_LC_DISCOVERY, &gv->logconfig, "handshake (lguid="PGUIDFMT" rguid="PGUIDFMT") succeeded\n", PGUID (pp->e.guid), PGUID (proxypp->e.guid));
     update_proxy_participant_endpoint_matching(proxypp, pp);
-    ddsi_handshake_remove(pp, proxypp, handshake);
+    ddsi_handshake_remove(pp, proxypp);
     break;
 
   case STATE_HANDSHAKE_TIMED_OUT:
@@ -4780,7 +4782,7 @@ void handshake_end_cb(struct ddsi_handshake *handshake, struct participant *pp,
       downgrade_to_nonsecure(proxypp);
       update_proxy_participant_endpoint_matching(proxypp, pp);
     }
-    ddsi_handshake_remove(pp, proxypp, handshake);
+    ddsi_handshake_remove(pp, proxypp);
     break;
   case STATE_HANDSHAKE_FAILED:
     DDS_CERROR (&gv->logconfig, "handshake (lguid="PGUIDFMT" rguid="PGUIDFMT") failed: (%d) Failed\n", PGUID (pp->e.guid), PGUID (proxypp->e.guid), (int)result);
@@ -4788,11 +4790,11 @@ void handshake_end_cb(struct ddsi_handshake *handshake, struct participant *pp,
       downgrade_to_nonsecure(proxypp);
       update_proxy_participant_endpoint_matching(proxypp, pp);
     }
-    ddsi_handshake_remove(pp, proxypp, handshake);
+    ddsi_handshake_remove(pp, proxypp);
     break;
   default:
     DDS_CERROR (&gv->logconfig, "handshake (lguid="PGUIDFMT" rguid="PGUIDFMT") failed: (%d) Unknown failure\n", PGUID (pp->e.guid), PGUID (proxypp->e.guid), (int)result);
-    ddsi_handshake_remove(pp, proxypp, handshake);
+    ddsi_handshake_remove(pp, proxypp);
     break;
   }
 }
@@ -4840,7 +4842,7 @@ static void disconnect_proxy_participant_secure(struct proxy_participant *proxyp
     entidx_enum_participant_init (&it, gv->entity_index);
     while ((pp = entidx_enum_participant_next (&it)) != NULL)
     {
-      ddsi_handshake_remove(pp, proxypp, NULL);
+      ddsi_handshake_remove(pp, proxypp);
     }
     entidx_enum_participant_fini (&it);
   }
diff --git a/src/core/ddsi/src/q_transmit.c b/src/core/ddsi/src/q_transmit.c
index cdc7485..774e4f8 100644
--- a/src/core/ddsi/src/q_transmit.c
+++ b/src/core/ddsi/src/q_transmit.c
@@ -1159,7 +1159,7 @@ static int maybe_grow_whc (struct writer *wr)
 int write_sample_p2p_wrlock_held(struct writer *wr, seqno_t seq, struct ddsi_plist *plist, struct ddsi_serdata *serdata, struct ddsi_tkmap_instance *tk, struct proxy_reader *prd)
 {
   struct ddsi_domaingv * const gv = wr->e.gv;
-  int r;
+  int r = 0;
   nn_mtime_t tnow;
   int rexmit = 1;
   struct wr_prd_match *wprd = NULL;
@@ -1170,10 +1170,14 @@ int write_sample_p2p_wrlock_held(struct writer *wr, seqno_t seq, struct ddsi_pli
   serdata->twrite = tnow;
   serdata->timestamp = now();
 
+
   if (prd->filter)
   {
     if ((wprd = ddsrt_avl_lookup (&wr_readers_treedef, &wr->readers, &prd->e.guid)) != NULL)
     {
+      if (wprd->seq == MAX_SEQ_NUMBER)
+        goto prd_is_deleting;
+
       rexmit = prd->filter(wr, prd, serdata);
       /* determine if gap has to added */
       if (rexmit)
@@ -1212,6 +1216,7 @@ int write_sample_p2p_wrlock_held(struct writer *wr, seqno_t seq, struct ddsi_pli
       writer_hbcontrol_note_asyncwrite(wr, tnow);
   }
 
+prd_is_deleting:
   return r;
 }
 
diff --git a/src/security/core/include/dds/security/core/dds_security_fsm.h b/src/security/core/include/dds/security/core/dds_security_fsm.h
index 503c5f6..96f24d9 100644
--- a/src/security/core/include/dds/security/core/dds_security_fsm.h
+++ b/src/security/core/include/dds/security/core/dds_security_fsm.h
@@ -147,6 +147,24 @@ dds_security_fsm_dispatch(struct dds_security_fsm *fsm, int32_t event_id, bool p
 DDS_EXPORT const dds_security_fsm_state*
 dds_security_fsm_current_state(struct dds_security_fsm *fsm);
 
+/**
+ * Stops the state machine.
+ * Stops all running timeouts and events and cleaning all memory
+ * related to this machine.
+ *
+ * When calling this from another thread, then it may block until
+ * a possible concurrent event has finished. After this call, the
+ * fsm may not be used anymore.
+ *
+ * When in the fsm action callback function context, this will
+ * not block. It will garbage collect when the event has been
+ * handled.
+ *
+ * @param fsm   The state machine to b stopped
+ */
+DDS_EXPORT void
+dds_security_fsm_stop(struct dds_security_fsm *fsm);
+
 /**
  * Free the state machine.
  * Stops all running timeouts and events and cleaning all memory
diff --git a/src/security/core/src/dds_security_fsm.c b/src/security/core/src/dds_security_fsm.c
index 8685ed0..e2b9436 100644
--- a/src/security/core/src/dds_security_fsm.c
+++ b/src/security/core/src/dds_security_fsm.c
@@ -49,7 +49,6 @@ struct dds_security_fsm
 {
   struct dds_security_fsm *next_fsm;
   struct dds_security_fsm *prev_fsm;
-  bool busy;
   bool deleting;
   struct dds_security_fsm_control *control;
   const dds_security_fsm_transition *transitions;
@@ -73,7 +72,6 @@ struct dds_security_fsm_control
   struct fsm_event *first_event;
   struct fsm_event *last_event;
   ddsrt_fibheap_t timers;
-  ddsrt_thread_t tid;
   bool running;
 };
 
@@ -230,7 +228,7 @@ static void fsm_check_auto_state_change (struct dds_security_fsm *fsm)
   }
 }
 
-static void fsm_state_change (struct thread_state1 *ts1, struct dds_security_fsm_control *control, struct fsm_event *event)
+static void fsm_state_change (struct dds_security_fsm_control *control, struct fsm_event *event)
 {
   struct dds_security_fsm *fsm = event->fsm;
   int event_id = event->event_id;
@@ -246,19 +244,15 @@ static void fsm_state_change (struct thread_state1 *ts1, struct dds_security_fsm
       clear_state_timer (fsm);
       fsm->current = fsm->transitions[i].end;
       set_state_timer (fsm);
-      fsm->busy = true;
 
       ddsrt_mutex_unlock (&control->lock);
 
-      thread_state_awake (ts1, control->gv);
       if (fsm->transitions[i].func)
         fsm->transitions[i].func (fsm, fsm->arg);
       if (fsm->current && fsm->current->func)
         fsm->current->func (fsm, fsm->arg);
 
-      thread_state_asleep (ts1);
       ddsrt_mutex_lock (&control->lock);
-      fsm->busy = false;
       if (!fsm->deleting)
         fsm_check_auto_state_change (fsm);
       else
@@ -278,12 +272,10 @@ static void fsm_handle_timeout (struct dds_security_fsm_control *control, struct
     fsm_dispatch (fsm, DDS_SECURITY_FSM_EVENT_TIMEOUT, true);
     break;
   case FSM_TIMEOUT_OVERALL:
-    fsm->busy = true;
     ddsrt_mutex_unlock (&control->lock);
     if (fsm->overall_timeout_action)
       fsm->overall_timeout_action (fsm, fsm->arg);
     ddsrt_mutex_lock (&control->lock);
-    fsm->busy = false;
     if (fsm->deleting)
       ddsrt_cond_broadcast(&control->cond);
     break;
@@ -298,15 +290,13 @@ static uint32_t handle_events (struct dds_security_fsm_control *control)
   struct thread_state1 * const ts1 = lookup_thread_state ();
   struct fsm_event *event;
 
-  control->tid = ddsrt_thread_self();
-
   thread_state_awake (ts1, control->gv);
   ddsrt_mutex_lock (&control->lock);
   while (control->running)
   {
     if ((event = get_event(control)) != NULL)
     {
-      fsm_state_change (ts1, control, event);
+      fsm_state_change (control, event);
       ddsrt_free (event);
     }
     else
@@ -456,7 +446,6 @@ struct dds_security_fsm * dds_security_fsm_create (struct dds_security_fsm_contr
     fsm->overall_timeout_event.kind = FSM_TIMEOUT_OVERALL;
     fsm->overall_timeout_event.endtime = DDS_NEVER;
     fsm->overall_timeout_event.fsm = fsm;
-    fsm->busy = false;
     fsm->deleting = false;
     fsm->next_fsm = NULL;
     fsm->prev_fsm = NULL;
@@ -482,14 +471,9 @@ static void fsm_deactivate (struct dds_security_fsm_control *control, struct dds
   clear_state_timer (fsm);
   clear_overall_timer (fsm);
   fsm->current = NULL;
-  if (!ddsrt_thread_equal(control->tid, ddsrt_thread_self()))
-  {
-    while (fsm->busy)
-      ddsrt_cond_wait(&control->cond, &control->lock);
-  }
 }
 
-void dds_security_fsm_free (struct dds_security_fsm *fsm)
+void dds_security_fsm_stop (struct dds_security_fsm *fsm)
 {
   struct dds_security_fsm_control *control;
 
@@ -509,6 +493,19 @@ static void fsm_delete (struct dds_security_fsm_control *control, struct dds_sec
   ddsrt_free(fsm);
 }
 
+void dds_security_fsm_free (struct dds_security_fsm *fsm)
+{
+  struct dds_security_fsm_control *control;
+
+  assert(fsm);
+  assert(fsm->control);
+
+  control = fsm->control;
+  ddsrt_mutex_lock (&control->lock);
+  fsm_delete (control, fsm);
+  ddsrt_mutex_unlock (&control->lock);
+}
+
 struct dds_security_fsm_control * dds_security_fsm_control_create (struct ddsi_domaingv *gv)
 {
   struct dds_security_fsm_control *control;

From 0a9d391c64640c8e616c1887ce695dec4e4b3b1d Mon Sep 17 00:00:00 2001
From: Dennis Potman <dennis.potman@adlinktech.com>
Date: Thu, 5 Mar 2020 13:13:24 +0100
Subject: [PATCH 120/238] Fixed logging in find_own_ip

Signed-off-by: Dennis Potman <dennis.potman@adlinktech.com>
---
 src/core/ddsi/src/q_nwif.c               |   4 +-
 src/security/core/tests/access_control.c | 136 +++++++++++++++++++++++
 2 files changed, 138 insertions(+), 2 deletions(-)
 create mode 100644 src/security/core/tests/access_control.c

diff --git a/src/core/ddsi/src/q_nwif.c b/src/core/ddsi/src/q_nwif.c
index 7b96a2f..5ee10a1 100644
--- a/src/core/ddsi/src/q_nwif.c
+++ b/src/core/ddsi/src/q_nwif.c
@@ -482,10 +482,10 @@ int find_own_ip (struct ddsi_domaingv *gv, const char *requested_address)
     switch (ifa->type)
     {
       case DDSRT_IFTYPE_WIFI:
-        DDS_LOG(DDS_LC_CONFIG, " wireless");
+        GVLOG (DDS_LC_CONFIG, " wireless");
         break;
       case DDSRT_IFTYPE_WIRED:
-        DDS_LOG(DDS_LC_CONFIG, " wired");
+        GVLOG (DDS_LC_CONFIG, " wired");
         break;
       case DDSRT_IFTYPE_UNKNOWN:
         break;
diff --git a/src/security/core/tests/access_control.c b/src/security/core/tests/access_control.c
new file mode 100644
index 0000000..0b25a90
--- /dev/null
+++ b/src/security/core/tests/access_control.c
@@ -0,0 +1,136 @@
+/*
+ * Copyright(c) 2006 to 2020 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+#include <stdlib.h>
+#include <assert.h>
+
+#include "dds/dds.h"
+#include "CUnit/Test.h"
+#include "CUnit/Theory.h"
+
+#include "dds/version.h"
+#include "dds/ddsrt/cdtors.h"
+#include "dds/ddsrt/environ.h"
+#include "dds/ddsrt/process.h"
+#include "dds/ddsrt/heap.h"
+#include "dds/ddsrt/string.h"
+#include "dds/ddsi/q_config.h"
+#include "dds/ddsi/ddsi_domaingv.h"
+#include "dds/ddsi/q_misc.h"
+#include "dds/ddsi/ddsi_xqos.h"
+
+#include "dds/security/dds_security_api.h"
+
+#include "common/config_env.h"
+#include "common/access_control_wrapper.h"
+#include "common/security_config_test_utils.h"
+#include "common/test_identity.h"
+
+static const char *config =
+    "${CYCLONEDDS_URI}${CYCLONEDDS_URI:+,}"
+    "<Domain id=\"any\">"
+    "  <Discovery>"
+    "    <ExternalDomainId>0</ExternalDomainId>"
+    "    <Tag>\\${CYCLONEDDS_PID}</Tag>"
+    "  </Discovery>"
+    "  <DDSSecurity>"
+    "    <Authentication>"
+    "      <Library finalizeFunction=\"finalize_test_authentication_wrapped\" initFunction=\"init_test_authentication_wrapped\" path=\"" WRAPPERLIB_PATH("dds_security_authentication_wrapper") "\"/>"
+    "      <IdentityCertificate>" TEST_IDENTITY_CERTIFICATE "</IdentityCertificate>"
+    "      <PrivateKey>" TEST_IDENTITY_PRIVATE_KEY "</PrivateKey>"
+    "      <IdentityCA>" TEST_IDENTITY_CA_CERTIFICATE "</IdentityCA>"
+    "    </Authentication>"
+    "    <AccessControl>"
+    "      <Library finalizeFunction=\"finalize_access_control\" initFunction=\"init_access_control\"/>"
+    "      <Governance>${TEST_GOVERNANCE}</Governance>"
+    "      <PermissionsCA>${TEST_PERMISSIONS_CA}</PermissionsCA>"
+    "      <Permissions>${TEST_PERMISSIONS}</Permissions>"
+    "    </AccessControl>"
+    "    <Cryptographic>"
+    "      <Library finalizeFunction=\"finalize_crypto\" initFunction=\"init_crypto\"/>"
+    "    </Cryptographic>"
+    "  </DDSSecurity>"
+    "</Domain>";
+
+#define DDS_DOMAINID1 0
+#define DDS_DOMAINID2 1
+
+static dds_entity_t g_domain1 = 0;
+static dds_entity_t g_participant1 = 0;
+
+static dds_entity_t g_domain2 = 0;
+static dds_entity_t g_participant2 = 0;
+
+static void access_control_init(const char * gov, const char * perm, const char * ca, bool exp_pp_fail)
+{
+  struct kvp config_vars[] = {
+    { "TEST_GOVERNANCE", gov, 1 },
+    { "TEST_PERMISSIONS", perm, 1 },
+    { "TEST_PERMISSIONS_CA", ca, 1 },
+    { NULL, NULL, 0 }
+  };
+
+  char *conf = ddsrt_expand_vars_sh (config, &expand_lookup_vars_env, config_vars);
+  CU_ASSERT_EQUAL_FATAL (expand_lookup_unmatched (config_vars), 0);
+  g_domain1 = dds_create_domain (DDS_DOMAINID1, conf);
+  g_domain2 = dds_create_domain (DDS_DOMAINID2, conf);
+  dds_free (conf);
+
+  g_participant1 = dds_create_participant (DDS_DOMAINID1, NULL, NULL);
+  g_participant2 = dds_create_participant (DDS_DOMAINID2, NULL, NULL);
+  if (exp_pp_fail)
+  {
+    CU_ASSERT_FATAL (g_participant1 <= 0);
+    CU_ASSERT_FATAL (g_participant2 <= 0);
+  }
+  else
+  {
+    CU_ASSERT_FATAL (g_participant1 > 0);
+    CU_ASSERT_FATAL (g_participant2 > 0);
+  }
+}
+
+static void access_control_fini(bool delete_pp)
+{
+  if (delete_pp)
+  {
+    CU_ASSERT_EQUAL_FATAL (dds_delete (g_participant1), DDS_RETCODE_OK);
+    CU_ASSERT_EQUAL_FATAL (dds_delete (g_participant2), DDS_RETCODE_OK);
+  }
+  CU_ASSERT_EQUAL_FATAL (dds_delete (g_domain1), DDS_RETCODE_OK);
+  CU_ASSERT_EQUAL_FATAL (dds_delete (g_domain2), DDS_RETCODE_OK);
+}
+
+
+#define PF_F "file:"
+#define PF_D "data:,"
+#define GOV_F PF_F COMMON_ETC_PATH("default_governance.p7s")
+#define GOV_FNE PF_F COMMON_ETC_PATH("default_governance_non_existing.p7s")
+#define GOV_DI PF_D COMMON_ETC_PATH("default_governance.p7s")
+#define PERM_F PF_F COMMON_ETC_PATH("default_permissions.p7s")
+#define PERM_FNE PF_F COMMON_ETC_PATH("default_permissions_non_existing.p7s")
+#define PERM_DI PF_D COMMON_ETC_PATH("default_permissions.p7s")
+#define CA_F PF_F COMMON_ETC_PATH("default_permissions_ca.pem")
+#define CA_FNE PF_F COMMON_ETC_PATH("default_permissions_ca_non_existing.pem")
+#define CA_DI PF_D COMMON_ETC_PATH("default_permissions_ca.pem")
+#define CA_D TEST_PERMISSIONS_CA_CERTIFICATE
+
+CU_TheoryDataPoints(ddssec_access_control, config_parameters) = {
+    CU_DataPoints(const char *, GOV_F,  GOV_FNE,  GOV_FNE, GOV_F,    GOV_F,  "",     GOV_F, GOV_F,  GOV_DI, GOV_F),
+    CU_DataPoints(const char *, PERM_F, PERM_FNE, PERM_F,  PERM_FNE, PERM_F, PERM_F, "",    PERM_F, PERM_F, PERM_F),
+    CU_DataPoints(const char *, CA_F,   CA_FNE,   CA_F,    CA_F,     CA_FNE, CA_F,   CA_F,  "",     CA_F,   CA_D),
+    CU_DataPoints(bool,         false,  true,     true,    true,     true,   true,   true,  true,   true,   false)
+};
+CU_Theory((const char * gov, const char * perm, const char * ca, bool exp_fail), ddssec_access_control, config_parameters)
+{
+  access_control_init (gov, perm, ca, exp_fail);
+  access_control_fini (!exp_fail);
+}

From ea91e17a62342bc6902b04a627e4aca3d2a806cf Mon Sep 17 00:00:00 2001
From: Erik Boasson <eb@ilities.com>
Date: Sat, 29 Feb 2020 17:18:47 +0100
Subject: [PATCH 121/238] Rename nn_keyhash to ddsi_keyhash

Signed-off-by: Erik Boasson <eb@ilities.com>
---
 src/core/ddsc/src/dds_builtin.c               |  4 +--
 src/core/ddsc/src/dds_serdata_builtintopic.c  |  2 +-
 src/core/ddsi/CMakeLists.txt                  |  1 +
 src/core/ddsi/include/dds/ddsi/ddsi_keyhash.h | 27 +++++++++++++++++++
 src/core/ddsi/include/dds/ddsi/ddsi_plist.h   |  7 ++---
 src/core/ddsi/include/dds/ddsi/ddsi_serdata.h | 10 +++----
 src/core/ddsi/src/ddsi_plist.c                | 20 +++++++-------
 src/core/ddsi/src/ddsi_serdata.c              |  4 +--
 src/core/ddsi/src/ddsi_serdata_default.c      |  6 ++---
 src/core/ddsi/src/q_ddsi_discovery.c          |  2 +-
 src/core/ddsi/src/q_xmsg.c                    |  2 +-
 11 files changed, 55 insertions(+), 30 deletions(-)
 create mode 100644 src/core/ddsi/include/dds/ddsi/ddsi_keyhash.h

diff --git a/src/core/ddsc/src/dds_builtin.c b/src/core/ddsc/src/dds_builtin.c
index b7068c4..f4a52af 100644
--- a/src/core/ddsc/src/dds_builtin.c
+++ b/src/core/ddsc/src/dds_builtin.c
@@ -176,7 +176,7 @@ static struct ddsi_tkmap_instance *dds__builtin_get_tkmap_entry (const struct dd
   struct dds_domain *domain = vdomain;
   struct ddsi_tkmap_instance *tk;
   struct ddsi_serdata *sd;
-  struct nn_keyhash kh;
+  struct ddsi_keyhash kh;
   memcpy (&kh, guid, sizeof (kh));
   /* any random builtin topic will do (provided it has a GUID for a key), because what matters is the "class" of the topic, not the actual topic; also, this is called early in the initialisation of the entity with this GUID, which simply causes serdata_from_keyhash to create a key-only serdata because the key lookup fails. */
   sd = ddsi_serdata_from_keyhash (domain->builtin_participant_topic, &kh);
@@ -191,7 +191,7 @@ struct ddsi_serdata *dds__builtin_make_sample (const struct entity_common *e, nn
   struct dds_domain *dom = e->gv->builtin_topic_interface->arg;
   struct ddsi_sertopic *topic = NULL;
   struct ddsi_serdata *serdata;
-  struct nn_keyhash keyhash;
+  struct ddsi_keyhash keyhash;
   switch (e->kind)
   {
     case EK_PARTICIPANT:
diff --git a/src/core/ddsc/src/dds_serdata_builtintopic.c b/src/core/ddsc/src/dds_serdata_builtintopic.c
index 84063f0..12af5e0 100644
--- a/src/core/ddsc/src/dds_serdata_builtintopic.c
+++ b/src/core/ddsc/src/dds_serdata_builtintopic.c
@@ -126,7 +126,7 @@ static void from_entity_pwr (struct ddsi_serdata_builtintopic *d, const struct p
   assert (d->xqos.present & QP_TYPE_NAME);
 }
 
-static struct ddsi_serdata *ddsi_serdata_builtin_from_keyhash (const struct ddsi_sertopic *tpcmn, const nn_keyhash_t *keyhash)
+static struct ddsi_serdata *ddsi_serdata_builtin_from_keyhash (const struct ddsi_sertopic *tpcmn, const ddsi_keyhash_t *keyhash)
 {
   /* FIXME: not quite elegant to manage the creation of a serdata for a built-in topic via this function, but I also find it quite unelegant to let from_sample read straight from the underlying internal entity, and to_sample convert to the external format ... I could claim the internal entity is the "serialised form", but that forces wrapping it in a fragchain in one way or another, which, though possible, is also a bit lacking in elegance. */
   const struct ddsi_sertopic_builtintopic *tp = (const struct ddsi_sertopic_builtintopic *)tpcmn;
diff --git a/src/core/ddsi/CMakeLists.txt b/src/core/ddsi/CMakeLists.txt
index 4c466bd..ab200f3 100644
--- a/src/core/ddsi/CMakeLists.txt
+++ b/src/core/ddsi/CMakeLists.txt
@@ -98,6 +98,7 @@ PREPEND(hdrs_private_ddsi "${CMAKE_CURRENT_LIST_DIR}/include/dds/ddsi"
     ddsi_builtin_topic_if.h
     ddsi_rhc.h
     ddsi_guid.h
+    ddsi_keyhash.h
     ddsi_entity_index.h
     ddsi_deadline.h
     ddsi_deliver_locally.h
diff --git a/src/core/ddsi/include/dds/ddsi/ddsi_keyhash.h b/src/core/ddsi/include/dds/ddsi/ddsi_keyhash.h
new file mode 100644
index 0000000..bbb60a1
--- /dev/null
+++ b/src/core/ddsi/include/dds/ddsi/ddsi_keyhash.h
@@ -0,0 +1,27 @@
+/*
+ * Copyright(c) 2020 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+#ifndef DDSI_KEYHASH_H
+#define DDSI_KEYHASH_H
+
+#if defined (__cplusplus)
+extern "C" {
+#endif
+
+typedef struct ddsi_keyhash {
+  unsigned char value[16];
+} ddsi_keyhash_t;
+
+#if defined (__cplusplus)
+}
+#endif
+
+#endif
diff --git a/src/core/ddsi/include/dds/ddsi/ddsi_plist.h b/src/core/ddsi/include/dds/ddsi/ddsi_plist.h
index 4f8b07f..227067a 100644
--- a/src/core/ddsi/include/dds/ddsi/ddsi_plist.h
+++ b/src/core/ddsi/include/dds/ddsi/ddsi_plist.h
@@ -14,6 +14,7 @@
 
 #include "dds/ddsi/q_feature_check.h"
 #include "dds/ddsi/ddsi_xqos.h"
+#include "dds/ddsi/ddsi_keyhash.h"
 #include "dds/ddsi/ddsi_tran.h" /* FIXME: eliminate */
 
 #if defined (__cplusplus)
@@ -97,10 +98,6 @@ typedef uint32_t nn_ipv4address_t;
 
 typedef uint32_t nn_port_t;
 
-typedef struct nn_keyhash {
-  unsigned char value[16];
-} nn_keyhash_t;
-
 #ifdef DDSI_INCLUDE_SECURITY
 typedef struct nn_tag {
   char *name;
@@ -218,7 +215,7 @@ typedef struct ddsi_plist {
   uint32_t builtin_endpoint_set;
   /* int type_max_size_serialized; */
   char *entity_name;
-  nn_keyhash_t keyhash;
+  ddsi_keyhash_t keyhash;
   uint32_t statusinfo;
   nn_prismtech_participant_version_info_t prismtech_participant_version_info;
   char *type_description;
diff --git a/src/core/ddsi/include/dds/ddsi/ddsi_serdata.h b/src/core/ddsi/include/dds/ddsi/ddsi_serdata.h
index 4ff9ff0..db3b87a 100644
--- a/src/core/ddsi/include/dds/ddsi/ddsi_serdata.h
+++ b/src/core/ddsi/include/dds/ddsi/ddsi_serdata.h
@@ -15,13 +15,13 @@
 #include "dds/ddsrt/sockets.h"
 #include "dds/ddsi/q_time.h"
 #include "dds/ddsi/ddsi_sertopic.h"
+#include "dds/ddsi/ddsi_keyhash.h"
 
 #if defined (__cplusplus)
 extern "C" {
 #endif
 
 struct nn_rdata;
-struct nn_keyhash;
 
 enum ddsi_serdata_kind {
   SDK_EMPTY,
@@ -65,7 +65,7 @@ typedef struct ddsi_serdata * (*ddsi_serdata_from_ser_t) (const struct ddsi_sert
 typedef struct ddsi_serdata * (*ddsi_serdata_from_ser_iov_t) (const struct ddsi_sertopic *topic, enum ddsi_serdata_kind kind, ddsrt_msg_iovlen_t niov, const ddsrt_iovec_t *iov, size_t size);
 
 /* Construct a serdata from a keyhash (an SDK_KEY by definition) */
-typedef struct ddsi_serdata * (*ddsi_serdata_from_keyhash_t) (const struct ddsi_sertopic *topic, const struct nn_keyhash *keyhash);
+typedef struct ddsi_serdata * (*ddsi_serdata_from_keyhash_t) (const struct ddsi_sertopic *topic, const struct ddsi_keyhash *keyhash);
 
 /* Construct a serdata from an application sample
    - "kind" is KEY or DATA depending on the operation invoked by the application;
@@ -138,7 +138,7 @@ typedef size_t (*ddsi_serdata_print_t) (const struct ddsi_sertopic *topic, const
 /* Add keyhash (from serdata) to buffer (forcing md5 when necessary).
    - key needs to be set within serdata (can already be md5)
    - buf needs to be at least 16 bytes large */
-typedef void (*ddsi_serdata_get_keyhash_t) (const struct ddsi_serdata *d, struct nn_keyhash *buf, bool force_md5);
+typedef void (*ddsi_serdata_get_keyhash_t) (const struct ddsi_serdata *d, struct ddsi_keyhash *buf, bool force_md5);
 
 struct ddsi_serdata_ops {
   ddsi_serdata_eqkey_t eqkey;
@@ -187,7 +187,7 @@ DDS_EXPORT inline struct ddsi_serdata *ddsi_serdata_from_ser_iov (const struct d
   return topic->serdata_ops->from_ser_iov (topic, kind, niov, iov, size);
 }
 
-DDS_EXPORT inline struct ddsi_serdata *ddsi_serdata_from_keyhash (const struct ddsi_sertopic *topic, const struct nn_keyhash *keyhash) {
+DDS_EXPORT inline struct ddsi_serdata *ddsi_serdata_from_keyhash (const struct ddsi_sertopic *topic, const struct ddsi_keyhash *keyhash) {
   return topic->serdata_ops->from_keyhash (topic, keyhash);
 }
 
@@ -237,7 +237,7 @@ DDS_EXPORT inline bool ddsi_serdata_print_topicless (const struct ddsi_sertopic
   }
 }
 
-DDS_EXPORT inline void ddsi_serdata_get_keyhash (const struct ddsi_serdata *d, struct nn_keyhash *buf, bool force_md5) {
+DDS_EXPORT inline void ddsi_serdata_get_keyhash (const struct ddsi_serdata *d, struct ddsi_keyhash *buf, bool force_md5) {
   d->ops->get_keyhash (d, buf, force_md5);
 }
 
diff --git a/src/core/ddsi/src/ddsi_plist.c b/src/core/ddsi/src/ddsi_plist.c
index 9722e02..a421e4c 100644
--- a/src/core/ddsi/src/ddsi_plist.c
+++ b/src/core/ddsi/src/ddsi_plist.c
@@ -487,7 +487,7 @@ static size_t ser_generic_srcsize (const enum pserop * __restrict desc)
       case Xb: case Xbx2: SIMPLE (Xb, unsigned char); break;
       case XbCOND: SIMPLE (XbCOND, unsigned char); break;
       case XG: SIMPLE (XG, ddsi_guid_t); break;
-      case XK: SIMPLE (XK, nn_keyhash_t); break;
+      case XK: SIMPLE (XK, ddsi_keyhash_t); break;
       case XbPROP: SIMPLE (XbPROP, unsigned char); break;
       case XQ: SIMPLE (XQ, ddsi_octetseq_t); break;
       case Xopt: break;
@@ -531,7 +531,7 @@ static bool fini_generic_embeddable (void * __restrict dst, size_t * __restrict
       case Xb: case Xbx2: SIMPLE (Xb, unsigned char); break;
       case XbCOND: SIMPLE (XbCOND, unsigned char); break;
       case XG: SIMPLE (XG, ddsi_guid_t); break;
-      case XK: SIMPLE (XK, nn_keyhash_t); break;
+      case XK: SIMPLE (XK, ddsi_keyhash_t); break;
       case XbPROP: SIMPLE (XbPROP, unsigned char); break;
       case XQ:
       {
@@ -564,7 +564,7 @@ static size_t pserop_memalign (enum pserop op)
     case XO: case XQ: return alignof (ddsi_octetseq_t);
     case XS: return alignof (char *);
     case XG: return alignof (ddsi_guid_t);
-    case XK: return alignof (nn_keyhash_t);
+    case XK: return alignof (ddsi_keyhash_t);
     case Xb: case Xbx2: return 1;
     case Xo: case Xox2: return 1;
     case XbCOND: case XbPROP: return 1;
@@ -705,7 +705,7 @@ static dds_return_t deser_generic_r (void * __restrict dst, size_t * __restrict
         break;
       }
       case XK: { /* keyhash */
-        nn_keyhash_t * const x = deser_generic_dst (dst, dstoff, alignof (nn_keyhash_t));
+        ddsi_keyhash_t * const x = deser_generic_dst (dst, dstoff, alignof (ddsi_keyhash_t));
         if (dd->bufsz - *srcoff < sizeof (*x))
           goto fail;
         memcpy (x, dd->buf + *srcoff, sizeof (*x));
@@ -817,7 +817,7 @@ static void ser_generic_size_embeddable (size_t *dstoff, const void *src, size_t
       case Xb: case Xbx2: SIMPLE1 (Xb, unsigned char); break;
       case XbCOND: SIMPLE1 (XbCOND, unsigned char); break;
       case XG: SIMPLE1 (XG, ddsi_guid_t); break;
-      case XK: SIMPLE1 (XK, nn_keyhash_t); break;
+      case XK: SIMPLE1 (XK, ddsi_keyhash_t); break;
       case XbPROP: /* "propagate" boolean: when 'false'; no serialisation; no size; force early out */
                COMPLEX (XbPROP, unsigned char, if (! *x) return); break;
       case XQ: COMPLEX (XQ, ddsi_octetseq_t, {
@@ -973,7 +973,7 @@ static dds_return_t ser_generic_embeddable (char * const data, size_t *dstoff, c
         break;
       }
       case XK: { /* keyhash */
-        nn_keyhash_t const * const x = deser_generic_src (src, &srcoff, alignof (nn_keyhash_t));
+        ddsi_keyhash_t const * const x = deser_generic_src (src, &srcoff, alignof (ddsi_keyhash_t));
         char * const p = data + *dstoff;
         memcpy (p, x, sizeof (*x));
         *dstoff += sizeof (*x);
@@ -1055,7 +1055,7 @@ static dds_return_t unalias_generic (void * __restrict dst, size_t * __restrict
       case XbCOND: SIMPLE (XbCOND, unsigned char); break;
       case XbPROP: SIMPLE (XbPROP, unsigned char); break;
       case XG: SIMPLE (XG, ddsi_guid_t); break;
-      case XK: SIMPLE (XK, nn_keyhash_t); break;
+      case XK: SIMPLE (XK, ddsi_keyhash_t); break;
       case XQ: COMPLEX (XQ, ddsi_octetseq_t, if (x->length) {
         const size_t elem_size = ser_generic_srcsize (desc + 1);
         if (gen_seq_aliased)
@@ -1149,7 +1149,7 @@ static dds_return_t valid_generic (const void *src, size_t srcoff, const enum ps
       case XbCOND: SIMPLE (XbCOND, unsigned char, *x == 0 || *x == 1); break;
       case XbPROP: SIMPLE (XbPROP, unsigned char, *x == 0 || *x == 1); break;
       case XG: TRIVIAL (XG, ddsi_guid_t); break;
-      case XK: TRIVIAL (XK, nn_keyhash_t); break;
+      case XK: TRIVIAL (XK, ddsi_keyhash_t); break;
       case XQ: COMPLEX (XQ, ddsi_octetseq_t, {
         if ((x->length == 0) != (x->value == NULL))
           return DDS_RETCODE_BAD_PARAMETER;
@@ -1213,7 +1213,7 @@ static bool equal_generic (const void *srcx, const void *srcy, size_t srcoff, co
         break;
       case XbPROP: TRIVIAL (XbPROP, unsigned char); break;
       case XG: SIMPLE (XG, ddsi_guid_t, memcmp (x, y, sizeof (*x)) == 0); break;
-      case XK: SIMPLE (XK, nn_keyhash_t, memcmp (x, y, sizeof (*x)) == 0); break;
+      case XK: SIMPLE (XK, ddsi_keyhash_t, memcmp (x, y, sizeof (*x)) == 0); break;
       case XQ: COMPLEX (XQ, ddsi_octetseq_t, {
         if (x->length != y->length)
           return false;
@@ -1393,7 +1393,7 @@ static bool print_generic1 (char * __restrict *buf, size_t * __restrict bufsize,
         break;
       }
       case XK: { /* keyhash */
-        nn_keyhash_t const * const x = deser_generic_src (src, &srcoff, alignof (nn_keyhash_t));
+        ddsi_keyhash_t const * const x = deser_generic_src (src, &srcoff, alignof (ddsi_keyhash_t));
         if (!prtf (buf, bufsize, "%s{%02x%02x%02x%02x:%02x%02x%02x%02x:%02x%02x%02x%02x:%02x%02x%02x%02x}", sep,
                    x->value[0], x->value[1], x->value[2], x->value[3], x->value[4], x->value[5], x->value[6], x->value[7],
                    x->value[8], x->value[9], x->value[10], x->value[11], x->value[12], x->value[13], x->value[14], x->value[15]))
diff --git a/src/core/ddsi/src/ddsi_serdata.c b/src/core/ddsi/src/ddsi_serdata.c
index 97e43c2..d1f5fa6 100644
--- a/src/core/ddsi/src/ddsi_serdata.c
+++ b/src/core/ddsi/src/ddsi_serdata.c
@@ -37,7 +37,7 @@ extern inline void ddsi_serdata_unref (struct ddsi_serdata *serdata);
 extern inline uint32_t ddsi_serdata_size (const struct ddsi_serdata *d);
 extern inline struct ddsi_serdata *ddsi_serdata_from_ser (const struct ddsi_sertopic *topic, enum ddsi_serdata_kind kind, const struct nn_rdata *fragchain, size_t size);
 extern inline struct ddsi_serdata *ddsi_serdata_from_ser_iov (const struct ddsi_sertopic *topic, enum ddsi_serdata_kind kind, ddsrt_msg_iovlen_t niov, const ddsrt_iovec_t *iov, size_t size);
-extern inline struct ddsi_serdata *ddsi_serdata_from_keyhash (const struct ddsi_sertopic *topic, const struct nn_keyhash *keyhash);
+extern inline struct ddsi_serdata *ddsi_serdata_from_keyhash (const struct ddsi_sertopic *topic, const struct ddsi_keyhash *keyhash);
 extern inline struct ddsi_serdata *ddsi_serdata_from_sample (const struct ddsi_sertopic *topic, enum ddsi_serdata_kind kind, const void *sample);
 extern inline struct ddsi_serdata *ddsi_serdata_to_topicless (const struct ddsi_serdata *d);
 extern inline void ddsi_serdata_to_ser (const struct ddsi_serdata *d, size_t off, size_t sz, void *buf);
@@ -48,4 +48,4 @@ extern inline bool ddsi_serdata_topicless_to_sample (const struct ddsi_sertopic
 extern inline bool ddsi_serdata_eqkey (const struct ddsi_serdata *a, const struct ddsi_serdata *b);
 extern inline bool ddsi_serdata_print (const struct ddsi_serdata *d, char *buf, size_t size);
 extern inline bool ddsi_serdata_print_topicless (const struct ddsi_sertopic *topic, const struct ddsi_serdata *d, char *buf, size_t size);
-extern inline void ddsi_serdata_get_keyhash (const struct ddsi_serdata *d, struct nn_keyhash *buf, bool force_md5);
+extern inline void ddsi_serdata_get_keyhash (const struct ddsi_serdata *d, struct ddsi_keyhash *buf, bool force_md5);
diff --git a/src/core/ddsi/src/ddsi_serdata_default.c b/src/core/ddsi/src/ddsi_serdata_default.c
index f89e30c..bd49d4b 100644
--- a/src/core/ddsi/src/ddsi_serdata_default.c
+++ b/src/core/ddsi/src/ddsi_serdata_default.c
@@ -346,7 +346,7 @@ static struct ddsi_serdata *serdata_default_from_ser_iov_nokey (const struct dds
   return fix_serdata_default_nokey (d, tpcmn->serdata_basehash);
 }
 
-static struct ddsi_serdata *ddsi_serdata_from_keyhash_cdr (const struct ddsi_sertopic *tpcmn, const nn_keyhash_t *keyhash)
+static struct ddsi_serdata *ddsi_serdata_from_keyhash_cdr (const struct ddsi_sertopic *tpcmn, const ddsi_keyhash_t *keyhash)
 {
   /* FIXME: not quite sure this is correct, though a check against a specially hacked OpenSplice suggests it is */
   const struct ddsi_sertopic_default *tp = (const struct ddsi_sertopic_default *)tpcmn;
@@ -374,7 +374,7 @@ static struct ddsi_serdata *ddsi_serdata_from_keyhash_cdr (const struct ddsi_ser
   }
 }
 
-static struct ddsi_serdata *ddsi_serdata_from_keyhash_cdr_nokey (const struct ddsi_sertopic *tpcmn, const nn_keyhash_t *keyhash)
+static struct ddsi_serdata *ddsi_serdata_from_keyhash_cdr_nokey (const struct ddsi_sertopic *tpcmn, const ddsi_keyhash_t *keyhash)
 {
   const struct ddsi_sertopic_default *tp = (const struct ddsi_sertopic_default *)tpcmn;
   struct ddsi_serdata_default *d = serdata_default_new(tp, SDK_KEY);
@@ -700,7 +700,7 @@ static size_t serdata_default_print_raw (const struct ddsi_sertopic *sertopic_co
   return (size_t) snprintf (buf, size, "(blob)");
 }
 
-static void serdata_default_get_keyhash (const struct ddsi_serdata *serdata_common, struct nn_keyhash *buf, bool force_md5)
+static void serdata_default_get_keyhash (const struct ddsi_serdata *serdata_common, struct ddsi_keyhash *buf, bool force_md5)
 {
   const struct ddsi_serdata_default *d = (const struct ddsi_serdata_default *)serdata_common;
   assert(buf);
diff --git a/src/core/ddsi/src/q_ddsi_discovery.c b/src/core/ddsi/src/q_ddsi_discovery.c
index 589276a..04f2660 100644
--- a/src/core/ddsi/src/q_ddsi_discovery.c
+++ b/src/core/ddsi/src/q_ddsi_discovery.c
@@ -1874,7 +1874,7 @@ int builtins_dqueue_handler (const struct nn_rsample_info *sampleinfo, const str
           break;
       }
       keyhash_payload.p_endpoint_guid.parameterid = pid;
-      keyhash_payload.p_endpoint_guid.length = sizeof (nn_keyhash_t);
+      keyhash_payload.p_endpoint_guid.length = sizeof (ddsi_keyhash_t);
       memcpy (keyhash_payload.kh, &qos.keyhash, sizeof (qos.keyhash));
       keyhash_payload.p_sentinel.parameterid = PID_SENTINEL;
       keyhash_payload.p_sentinel.length = 0;
diff --git a/src/core/ddsi/src/q_xmsg.c b/src/core/ddsi/src/q_xmsg.c
index 93a70a2..5d90709 100644
--- a/src/core/ddsi/src/q_xmsg.c
+++ b/src/core/ddsi/src/q_xmsg.c
@@ -952,7 +952,7 @@ void nn_xmsg_addpar_keyhash (struct nn_xmsg *m, const struct ddsi_serdata *serda
   if (serdata->kind != SDK_EMPTY)
   {
     char *p = nn_xmsg_addpar (m, PID_KEYHASH, 16);
-    ddsi_serdata_get_keyhash(serdata, (struct nn_keyhash*)p, force_md5);
+    ddsi_serdata_get_keyhash(serdata, (struct ddsi_keyhash*)p, force_md5);
   }
 }
 

From e58f4dc344bc0c656ab2a95eb163876433c581b1 Mon Sep 17 00:00:00 2001
From: Erik Boasson <eb@ilities.com>
Date: Sat, 29 Feb 2020 17:19:01 +0100
Subject: [PATCH 122/238] Fix macro for checking serdata has get_keyhash

Signed-off-by: Erik Boasson <eb@ilities.com>
---
 src/core/ddsi/include/dds/ddsi/ddsi_serdata.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/core/ddsi/include/dds/ddsi/ddsi_serdata.h b/src/core/ddsi/include/dds/ddsi/ddsi_serdata.h
index db3b87a..ce65c6e 100644
--- a/src/core/ddsi/include/dds/ddsi/ddsi_serdata.h
+++ b/src/core/ddsi/include/dds/ddsi/ddsi_serdata.h
@@ -160,7 +160,7 @@ struct ddsi_serdata_ops {
 
 #define DDSI_SERDATA_HAS_PRINT 1
 #define DDSI_SERDATA_HAS_FROM_SER_IOV 1
-#define DDSI_SERDATA_HAS_ADD_KEYHASH 1
+#define DDSI_SERDATA_HAS_GET_KEYHASH 1
 
 DDS_EXPORT void ddsi_serdata_init (struct ddsi_serdata *d, const struct ddsi_sertopic *tp, enum ddsi_serdata_kind kind);
 

From 9fe51ef3fb795d798f57c0f79569b29ed55a623a Mon Sep 17 00:00:00 2001
From: Sid Faber <sid.faber@canonical.com>
Date: Tue, 10 Mar 2020 13:55:03 +0000
Subject: [PATCH 123/238] Install security plugins

Security plugins are built but not installed.  Add target to CMakeLists.txt
for three security plugins.

Signed-off-by: Sid Faber <sid.faber@canonical.com>
---
 src/security/builtin_plugins/access_control/CMakeLists.txt | 2 +-
 src/security/builtin_plugins/authentication/CMakeLists.txt | 2 +-
 src/security/builtin_plugins/cryptographic/CMakeLists.txt  | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/src/security/builtin_plugins/access_control/CMakeLists.txt b/src/security/builtin_plugins/access_control/CMakeLists.txt
index e0ffc78..e7bf471 100644
--- a/src/security/builtin_plugins/access_control/CMakeLists.txt
+++ b/src/security/builtin_plugins/access_control/CMakeLists.txt
@@ -41,7 +41,7 @@ target_include_directories(dds_security_ac
 )
 
 install(
-  TARGETS
+  TARGETS dds_security_ac
   EXPORT "${PROJECT_NAME}"
   RUNTIME DESTINATION "${CMAKE_INSTALL_BINDIR}" COMPONENT lib
   LIBRARY DESTINATION "${CMAKE_INSTALL_LIBDIR}" COMPONENT lib
diff --git a/src/security/builtin_plugins/authentication/CMakeLists.txt b/src/security/builtin_plugins/authentication/CMakeLists.txt
index 91455c5..d6cb40c 100644
--- a/src/security/builtin_plugins/authentication/CMakeLists.txt
+++ b/src/security/builtin_plugins/authentication/CMakeLists.txt
@@ -46,7 +46,7 @@ target_include_directories(dds_security_auth
 )
 
 install(
-  TARGETS
+  TARGETS dds_security_auth
   EXPORT "${PROJECT_NAME}"
   RUNTIME DESTINATION "${CMAKE_INSTALL_BINDIR}" COMPONENT lib
   LIBRARY DESTINATION "${CMAKE_INSTALL_LIBDIR}" COMPONENT lib
diff --git a/src/security/builtin_plugins/cryptographic/CMakeLists.txt b/src/security/builtin_plugins/cryptographic/CMakeLists.txt
index 3cae998..e7d97f5 100644
--- a/src/security/builtin_plugins/cryptographic/CMakeLists.txt
+++ b/src/security/builtin_plugins/cryptographic/CMakeLists.txt
@@ -45,7 +45,7 @@ target_include_directories(dds_security_crypto
 )
 
 install(
-  TARGETS
+  TARGETS dds_security_crypto
   EXPORT "${PROJECT_NAME}"
   RUNTIME DESTINATION "${CMAKE_INSTALL_BINDIR}" COMPONENT lib
   LIBRARY DESTINATION "${CMAKE_INSTALL_LIBDIR}" COMPONENT lib

From f11dd50810f4f48e2dac9ebe871dbccf67607540 Mon Sep 17 00:00:00 2001
From: Marcel Jordense <marcel.jordense@adlinktech.com>
Date: Tue, 10 Mar 2020 15:54:10 +0100
Subject: [PATCH 124/238] Set volatile secure reader initially out-of-sync

Signed-off-by: Marcel Jordense <marcel.jordense@adlinktech.com>
---
 src/core/ddsi/src/ddsi_security_exchange.c | 2 ++
 src/core/ddsi/src/q_entity.c               | 2 +-
 src/core/ddsi/src/q_receive.c              | 2 +-
 3 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/src/core/ddsi/src/ddsi_security_exchange.c b/src/core/ddsi/src/ddsi_security_exchange.c
index e510e2c..b475ad4 100644
--- a/src/core/ddsi/src/ddsi_security_exchange.c
+++ b/src/core/ddsi/src/ddsi_security_exchange.c
@@ -280,6 +280,8 @@ static bool write_crypto_exchange_message(const struct participant *pp, const dd
   nn_participant_generic_message_init(&pmg, &wr->e.guid, seq, dst_pguid, dst_eguid, src_eguid, classid, tokens, NULL);
   nn_participant_generic_message_serialize(&pmg, &data, &len);
 
+  nn_participant_generic_message_log(gv, &pmg, 0);
+
   /* Get the key value. */
   ddsrt_md5_state_t md5st;
   ddsrt_md5_byte_t digest[16];
diff --git a/src/core/ddsi/src/q_entity.c b/src/core/ddsi/src/q_entity.c
index 69b75b5..d7b5c46 100644
--- a/src/core/ddsi/src/q_entity.c
+++ b/src/core/ddsi/src/q_entity.c
@@ -2480,7 +2480,7 @@ static void proxy_writer_add_connection (struct proxy_writer *pwr, struct reader
   /* These can change as a consequence of handling data and/or
      discovery activities. The safe way of dealing with them is to
      lock the proxy writer */
-  if (is_builtin_entityid (rd->e.guid.entityid, NN_VENDORID_ECLIPSE) && !ddsrt_avl_is_empty (&pwr->readers))
+  if (is_builtin_entityid (rd->e.guid.entityid, NN_VENDORID_ECLIPSE) && !ddsrt_avl_is_empty (&pwr->readers) && !pwr->filtered)
   {
     /* builtins really don't care about multiple copies or anything */
     m->in_sync = PRMSS_SYNC;
diff --git a/src/core/ddsi/src/q_receive.c b/src/core/ddsi/src/q_receive.c
index 7a5f9a7..cdf7e2d 100644
--- a/src/core/ddsi/src/q_receive.c
+++ b/src/core/ddsi/src/q_receive.c
@@ -2300,7 +2300,7 @@ static void handle_regular (struct receiver_state *rst, nn_etime_t tnow, struct
             if (rres2 > 0)
             {
               if (!pwr->deliver_synchronously)
-                nn_dqueue_enqueue (pwr->dqueue, &sc, rres2);
+                nn_dqueue_enqueue1 (pwr->dqueue, &wn->rd_guid, &sc, rres2);
               else
                 deliver_user_data_synchronously (&sc, &wn->rd_guid);
             }

From 6507859f36db25af1c56ad7d1aa3296860084eec Mon Sep 17 00:00:00 2001
From: Marcel Jordense <marcel.jordense@adlinktech.com>
Date: Fri, 13 Mar 2020 17:49:59 +0100
Subject: [PATCH 125/238] Correct handling of identity certificates with EC key

Signed-off-by: Marcel Jordense <marcel.jordense@adlinktech.com>
---
 .../authentication/src/auth_utils.c           | 22 +++++++++++--------
 1 file changed, 13 insertions(+), 9 deletions(-)

diff --git a/src/security/builtin_plugins/authentication/src/auth_utils.c b/src/security/builtin_plugins/authentication/src/auth_utils.c
index d2ec77a..ef9d768 100644
--- a/src/security/builtin_plugins/authentication/src/auth_utils.c
+++ b/src/security/builtin_plugins/authentication/src/auth_utils.c
@@ -1288,10 +1288,12 @@ create_asymmetrical_signature(
         goto err_sign;
     }
 
-    if (EVP_PKEY_CTX_set_rsa_padding(kctx, RSA_PKCS1_PSS_PADDING) < 1) {
-        result = DDS_SECURITY_VALIDATION_FAILED;
-        DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result, "Failed to initialize signing context: ");
-        goto err_sign;
+    if (EVP_PKEY_id(pkey) == EVP_PKEY_RSA) {
+        if (EVP_PKEY_CTX_set_rsa_padding(kctx, RSA_PKCS1_PSS_PADDING) < 1) {
+            result = DDS_SECURITY_VALIDATION_FAILED;
+            DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result, "Failed to initialize signing context: ");
+            goto err_sign;
+         }
     }
 
     if (EVP_DigestSignUpdate(mdctx, data, dataLen) != 1) {
@@ -1345,11 +1347,13 @@ validate_asymmetrical_signature(
         goto err_verify;
     }
 
-    if (EVP_PKEY_CTX_set_rsa_padding(kctx, RSA_PKCS1_PSS_PADDING) < 1) {
-         result = DDS_SECURITY_VALIDATION_FAILED;
-         DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result, "Failed to initialize signing context: ");
-         goto err_verify;
-     }
+    if (EVP_PKEY_id(pkey) == EVP_PKEY_RSA) {
+        if (EVP_PKEY_CTX_set_rsa_padding(kctx, RSA_PKCS1_PSS_PADDING) < 1) {
+            result = DDS_SECURITY_VALIDATION_FAILED;
+            DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result, "Failed to initialize signing context: ");
+            goto err_verify;
+        }
+    }
 
     if (EVP_DigestVerifyUpdate(mdctx, data, dataLen) != 1) {
         result = DDS_SECURITY_VALIDATION_FAILED;

From 4a6b13412609ba910cb3978539c8e4839ba7af8f Mon Sep 17 00:00:00 2001
From: Erik Boasson <eb@ilities.com>
Date: Sat, 14 Mar 2020 10:16:25 +0100
Subject: [PATCH 126/238] Fix passing of "relay_only" in check/register reader

* access-control check_remote_datareader has "relay_only" as an out
  parameter, so should pass in an address instead of "false";

* value of "relay_only" returned by check_remote_datareader must be
  passed to crypto register_matched_remote_datareader

Signed-off-by: Erik Boasson <eb@ilities.com>
---
 .../ddsi/include/dds/ddsi/ddsi_security_omg.h | 20 +++++++++-------
 src/core/ddsi/src/ddsi_security_omg.c         | 24 ++++++++++++-------
 src/core/ddsi/src/q_entity.c                  |  5 ++--
 3 files changed, 30 insertions(+), 19 deletions(-)

diff --git a/src/core/ddsi/include/dds/ddsi/ddsi_security_omg.h b/src/core/ddsi/include/dds/ddsi/ddsi_security_omg.h
index 674cd3f..30e2c4a 100644
--- a/src/core/ddsi/include/dds/ddsi/ddsi_security_omg.h
+++ b/src/core/ddsi/include/dds/ddsi/ddsi_security_omg.h
@@ -768,15 +768,17 @@ bool q_omg_reader_is_submessage_protected(const struct reader *rd);
  * This function will check with the access control plugin if the remote reader
  * is allowed to communicate with this participant.
  *
- * @param[in] prd       The remote reader.
- * @param[in] domain_id The domain id.
- * @param[in] pp        The local participant.
+ * @param[in] prd         The remote reader.
+ * @param[in] domain_id   The domain id.
+ * @param[in] pp          The local participant.
+ * @param[out] relay_only The "relay_only" value returned by the access control
+ *                        operation check_remote_datareader()
  *
  * @returns bool
  * @retval true   The remote reader is allowed to communicate.
- * @retval false  Otherwise.
+ * @retval false  Otherwise; relay_only is unspecified.
  */
-bool q_omg_security_check_remote_reader_permissions(const struct proxy_reader *prd, uint32_t domain_id, struct participant *pp);
+bool q_omg_security_check_remote_reader_permissions(const struct proxy_reader *prd, uint32_t domain_id, struct participant *pp, bool *relay_only);
 
 /**
  * @brief Check it the local writer is allowed to communicate with the remote reader.
@@ -793,13 +795,15 @@ bool q_omg_security_check_remote_reader_permissions(const struct proxy_reader *p
  *
  * @param[in] wr              The local writer.
  * @param[in] prd             The remote reader.
+ * @param[in] relay_only      The "relay_only" returned by access control
+ *                            operation check_remote_datareader()
  * @param[out] crypto_handle  The crypto handle associated with the match.
  *
  * @returns bool
  * @retval true   The local writer and remote reader are allowed to communicate.
  * @retval false  Otherwise.
  */
-bool q_omg_security_match_remote_reader_enabled(struct writer *wr, struct proxy_reader *prd, int64_t *crypto_handle);
+bool q_omg_security_match_remote_reader_enabled(struct writer *wr, struct proxy_reader *prd, bool relay_only, int64_t *crypto_handle);
 
 /**
  * @brief Release the security information associated with the match between a writer and
@@ -1226,7 +1230,7 @@ inline bool q_omg_security_match_remote_writer_enabled(UNUSED_ARG(struct reader
   return true;
 }
 
-inline bool q_omg_security_match_remote_reader_enabled(UNUSED_ARG(struct writer *wr), UNUSED_ARG(struct proxy_reader *prd), UNUSED_ARG(int64_t *crypto_handle))
+inline bool q_omg_security_match_remote_reader_enabled(UNUSED_ARG(struct writer *wr), UNUSED_ARG(struct proxy_reader *prd), UNUSED_ARG(bool relay_only), UNUSED_ARG(int64_t *crypto_handle))
 {
   return true;
 }
@@ -1274,7 +1278,7 @@ inline bool q_omg_reader_is_submessage_protected(UNUSED_ARG(const struct reader
 }
 
 
-inline bool q_omg_security_check_remote_reader_permissions(UNUSED_ARG(const struct proxy_reader *prd), UNUSED_ARG(uint32_t domain_id), UNUSED_ARG(struct participant *pp))
+inline bool q_omg_security_check_remote_reader_permissions(UNUSED_ARG(const struct proxy_reader *prd), UNUSED_ARG(uint32_t domain_id), UNUSED_ARG(struct participant *pp), UNUSED_ARG(bool *relay_only))
 {
   return true;
 }
diff --git a/src/core/ddsi/src/ddsi_security_omg.c b/src/core/ddsi/src/ddsi_security_omg.c
index 16da442..7539ea5 100644
--- a/src/core/ddsi/src/ddsi_security_omg.c
+++ b/src/core/ddsi/src/ddsi_security_omg.c
@@ -2149,13 +2149,16 @@ void q_omg_security_deregister_remote_writer_match(const struct ddsi_domaingv *g
   }
 }
 
-bool q_omg_security_check_remote_reader_permissions(const struct proxy_reader *prd, uint32_t domain_id, struct participant *pp)
+bool q_omg_security_check_remote_reader_permissions(const struct proxy_reader *prd, uint32_t domain_id, struct participant *pp, bool *relay_only)
 {
   struct ddsi_domaingv *gv = pp->e.gv;
   struct dds_security_context *sc = q_omg_security_get_secure_context(pp);
   DDS_Security_SecurityException exception = DDS_SECURITY_EXCEPTION_INIT;
   bool ok = true;
 
+  /* relay_only is meaningless in all cases except the one where the access control plugin says otherwise */
+  *relay_only = false;
+
   if (!sc)
     return true;
 
@@ -2185,11 +2188,14 @@ bool q_omg_security_check_remote_reader_permissions(const struct proxy_reader *p
     else
     {
       DDS_Security_SubscriptionBuiltinTopicDataSecure subscription_data;
+      DDS_Security_boolean sec_relay_only;
 
       q_omg_shallow_copy_SubscriptionBuiltinTopicDataSecure(&subscription_data, &prd->e.guid, prd->c.xqos, &prd->security_info);
-      ok = sc->access_control_context->check_remote_datareader(sc->access_control_context, permissions_handle, (int)domain_id, &subscription_data, false, &exception);
+      ok = sc->access_control_context->check_remote_datareader(sc->access_control_context, permissions_handle, (int)domain_id, &subscription_data, &sec_relay_only, &exception);
       q_omg_shallow_free_SubscriptionBuiltinTopicDataSecure(&subscription_data);
-      if (!ok)
+      if (ok)
+        *relay_only = !!sec_relay_only;
+      else
       {
         if (!is_topic_discovery_protected(pp->sec_attr->permissions_handle, sc->access_control_context, subscription_data.topic_name))
           EXCEPTION_ERROR(sc, &exception, "Access control does not allow remote reader "PGUIDFMT": %s", PGUID(prd->e.guid));
@@ -2349,7 +2355,7 @@ static void send_writer_crypto_tokens(struct writer *wr, struct proxy_reader *pr
   }
 }
 
-static bool q_omg_security_register_remote_reader_match(struct proxy_reader *prd, struct writer *wr, int64_t *crypto_handle)
+static bool q_omg_security_register_remote_reader_match(struct proxy_reader *prd, struct writer *wr, int64_t *crypto_handle, bool relay_only)
 {
   struct participant *pp = wr->c.pp;
   struct proxy_participant *proxypp = prd->c.proxypp;
@@ -2380,7 +2386,7 @@ static bool q_omg_security_register_remote_reader_match(struct proxy_reader *prd
   {
     /* Generate writer crypto info. */
     match->crypto_handle = sc->crypto_context->crypto_key_factory->register_matched_remote_datareader(
-        sc->crypto_context->crypto_key_factory, wr->sec_attr->crypto_handle, proxypp->sec_attr->crypto_handle, pm->shared_secret, false, &exception);
+        sc->crypto_context->crypto_key_factory, wr->sec_attr->crypto_handle, proxypp->sec_attr->crypto_handle, pm->shared_secret, relay_only, &exception);
 
     *crypto_handle = match->crypto_handle;
 
@@ -2421,7 +2427,7 @@ static bool q_omg_security_register_remote_reader_match(struct proxy_reader *prd
   return match->matched;
 }
 
-bool q_omg_security_match_remote_reader_enabled(struct writer *wr, struct proxy_reader *prd, int64_t *crypto_handle)
+bool q_omg_security_match_remote_reader_enabled(struct writer *wr, struct proxy_reader *prd, bool relay_only, int64_t *crypto_handle)
 {
   struct ddsi_domaingv *gv = wr->e.gv;
   nn_security_info_t info;
@@ -2474,7 +2480,7 @@ bool q_omg_security_match_remote_reader_enabled(struct writer *wr, struct proxy_
     prd->security_info.plugin_security_attributes = info.plugin_security_attributes;
   }
 
-  return q_omg_security_register_remote_reader_match(prd, wr, crypto_handle);
+  return q_omg_security_register_remote_reader_match(prd, wr, crypto_handle, relay_only);
 }
 
 void q_omg_security_set_remote_writer_crypto_tokens(struct reader *rd, const ddsi_guid_t *pwr_guid, const nn_dataholderseq_t *tokens)
@@ -3673,7 +3679,7 @@ extern inline bool q_omg_proxy_participant_is_secure(UNUSED_ARG(const struct pro
 extern inline unsigned determine_subscription_writer(UNUSED_ARG(const struct reader *rd));
 
 extern inline bool q_omg_security_match_remote_writer_enabled(UNUSED_ARG(struct reader *rd), UNUSED_ARG(struct proxy_writer *pwr), UNUSED_ARG(int64_t *crypto_handle));
-extern inline bool q_omg_security_match_remote_reader_enabled(UNUSED_ARG(struct writer *wr), UNUSED_ARG(struct proxy_reader *prd), UNUSED_ARG(int64_t *crypto_handle));
+extern inline bool q_omg_security_match_remote_reader_enabled(UNUSED_ARG(struct writer *wr), UNUSED_ARG(struct proxy_reader *prd), UNUSED_ARG(bool relay_only), UNUSED_ARG(int64_t *crypto_handle));
 
 extern inline bool q_omg_writer_is_discovery_protected(UNUSED_ARG(const struct writer *wr));
 extern inline bool q_omg_writer_is_submessage_protected(UNUSED_ARG(const struct writer *wr));
@@ -3683,7 +3689,7 @@ extern inline void q_omg_get_proxy_writer_security_info(UNUSED_ARG(struct proxy_
 extern inline bool q_omg_security_check_remote_writer_permissions(UNUSED_ARG(const struct proxy_writer *pwr), UNUSED_ARG(uint32_t domain_id), UNUSED_ARG(struct participant *pp));
 extern inline void q_omg_security_deregister_remote_writer_match(UNUSED_ARG(const struct proxy_writer *pwr), UNUSED_ARG(const struct reader *rd), UNUSED_ARG(struct rd_pwr_match *match));
 extern inline void q_omg_get_proxy_reader_security_info(UNUSED_ARG(struct proxy_reader *prd), UNUSED_ARG(const ddsi_plist_t *plist), UNUSED_ARG(nn_security_info_t *info));
-extern inline bool q_omg_security_check_remote_reader_permissions(UNUSED_ARG(const struct proxy_reader *prd), UNUSED_ARG(uint32_t domain_id), UNUSED_ARG(struct participant *par));
+extern inline bool q_omg_security_check_remote_reader_permissions(UNUSED_ARG(const struct proxy_reader *prd), UNUSED_ARG(uint32_t domain_id), UNUSED_ARG(struct participant *par), UNUSED_ARG(bool *relay_only));
 extern inline void q_omg_security_deregister_remote_reader_match(UNUSED_ARG(const struct proxy_reader *prd), UNUSED_ARG(const struct writer *wr), UNUSED_ARG(struct wr_prd_match *match));
 
 extern inline unsigned determine_publication_writer(UNUSED_ARG(const struct writer *wr));
diff --git a/src/core/ddsi/src/q_entity.c b/src/core/ddsi/src/q_entity.c
index d7b5c46..474b8a5 100644
--- a/src/core/ddsi/src/q_entity.c
+++ b/src/core/ddsi/src/q_entity.c
@@ -2767,6 +2767,7 @@ static void connect_writer_with_proxy_reader (struct writer *wr, struct proxy_re
   const int isb1 = (is_builtin_entityid (prd->e.guid.entityid, prd->c.vendor) != 0);
   dds_qos_policy_id_t reason;
   int64_t crypto_handle;
+  bool relay_only;
 
   DDSRT_UNUSED_ARG(tnow);
   if (isb0 != isb1)
@@ -2779,12 +2780,12 @@ static void connect_writer_with_proxy_reader (struct writer *wr, struct proxy_re
     return;
   }
 
-  if (!q_omg_security_check_remote_reader_permissions (prd, wr->e.gv->config.domainId, wr->c.pp))
+  if (!q_omg_security_check_remote_reader_permissions (prd, wr->e.gv->config.domainId, wr->c.pp, &relay_only))
   {
     EELOGDISC (&wr->e, "connect_writer_with_proxy_reader (wr "PGUIDFMT") with (prd "PGUIDFMT") not allowed by security\n",
                    PGUID (wr->e.guid), PGUID (prd->e.guid));
   }
-  else if (!q_omg_security_match_remote_reader_enabled (wr, prd, &crypto_handle))
+  else if (!q_omg_security_match_remote_reader_enabled (wr, prd, relay_only, &crypto_handle))
   {
     EELOGDISC (&wr->e, "connect_writer_with_proxy_reader (wr "PGUIDFMT") with (prd "PGUIDFMT") waiting for approval by security\n",
                      PGUID (wr->e.guid), PGUID (prd->e.guid));

From 0354b42cdcacd26b25405099fcb8426a5c05fa67 Mon Sep 17 00:00:00 2001
From: Erik Boasson <eb@ilities.com>
Date: Sat, 14 Mar 2020 10:19:55 +0100
Subject: [PATCH 127/238] Check for permissions handle by testing for != 0

The test gates access-control plugin invocation and with the inverted
condition all remote readers/writers requiring access control are
blocked eiter because of the permissions handle, or because a NIL handle
is passed to the access control plugin.

Signed-off-by: Erik Boasson <eb@ilities.com>
---
 src/core/ddsi/src/ddsi_security_omg.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/core/ddsi/src/ddsi_security_omg.c b/src/core/ddsi/src/ddsi_security_omg.c
index 7539ea5..06b6dab 100644
--- a/src/core/ddsi/src/ddsi_security_omg.c
+++ b/src/core/ddsi/src/ddsi_security_omg.c
@@ -1956,7 +1956,7 @@ bool q_omg_security_check_remote_writer_permissions(const struct proxy_writer *p
   {
     DDS_Security_PermissionsHandle permissions_handle;
 
-    if ((permissions_handle = get_permissions_handle(pp, pwr->c.proxypp)) != 0)
+    if ((permissions_handle = get_permissions_handle(pp, pwr->c.proxypp)) == 0)
     {
       GVTRACE("Secure remote writer "PGUIDFMT" proxypp does not have permissions handle yet\n", PGUID(pwr->e.guid));
       return false;
@@ -2180,7 +2180,7 @@ bool q_omg_security_check_remote_reader_permissions(const struct proxy_reader *p
   {
     DDS_Security_PermissionsHandle permissions_handle;
 
-    if ((permissions_handle = get_permissions_handle(pp, prd->c.proxypp)) != 0)
+    if ((permissions_handle = get_permissions_handle(pp, prd->c.proxypp)) == 0)
     {
       GVTRACE("Secure remote reader "PGUIDFMT" proxypp does not have permissions handle yet\n", PGUID(prd->e.guid));
       return false;

From 3ea2cea318d760aebaf43b99b73b441955fb91b5 Mon Sep 17 00:00:00 2001
From: Dennis Potman <45659984+dennis-adlink@users.noreply.github.com>
Date: Wed, 18 Mar 2020 10:01:20 +0100
Subject: [PATCH 128/238] Code formatting fixes and clean-up authentication
 plugin (#439)

* Fix code formatting, fix for memory leak in validate_handshake_reply_token and
make error handling and return values more consistent with the other two
plugins.

Signed-off-by: Dennis Potman <dennis.potman@adlinktech.com>

* Processed review comments: fixed memory leaks and more consistent error handling and function returns

Signed-off-by: Dennis Potman <dennis.potman@adlinktech.com>

* Fix trusted ca dir max exceeded

Signed-off-by: Dennis Potman <dennis.potman@adlinktech.com>
---
 docs/manual/security.rst                      |    2 +
 .../dds/security/dds_security_api_err.h       |    2 +
 .../authentication/src/auth_utils.c           | 1961 +++----
 .../authentication/src/auth_utils.h           |  186 +-
 .../authentication/src/authentication.c       | 5021 +++++++----------
 .../authentication/src/authentication.h       |  152 +-
 6 files changed, 2914 insertions(+), 4410 deletions(-)

diff --git a/docs/manual/security.rst b/docs/manual/security.rst
index 078a013..725de07 100644
--- a/docs/manual/security.rst
+++ b/docs/manual/security.rst
@@ -793,6 +793,8 @@ dds_security_api_err.h header file contains the code and message constants.
 +-------+----------------------------------------------------------------+
 | 151   | The payload is not aligned at 4 bytes                          |
 +-------+----------------------------------------------------------------+
+| 152   | Cannot open trusted CA directory: maximum number exceeded      |
++-------+----------------------------------------------------------------+
 | 200   | Undefined Error Message                                        |
 +-------+----------------------------------------------------------------+
 
diff --git a/src/security/api/include/dds/security/dds_security_api_err.h b/src/security/api/include/dds/security/dds_security_api_err.h
index 9246ba5..b93cc62 100644
--- a/src/security/api/include/dds/security/dds_security_api_err.h
+++ b/src/security/api/include/dds/security/dds_security_api_err.h
@@ -106,6 +106,8 @@ extern "C" {
 #define DDS_SECURITY_ERR_URI_TYPE_NOT_SUPPORTED_MESSAGE "Unsupported URI type: %s"
 #define DDS_SECURITY_ERR_INVALID_CRYPTO_DATA_NOT_ALIGNED_CODE 151
 #define DDS_SECURITY_ERR_INVALID_CRYPTO_DATA_NOT_ALIGNED_MESSAGE "The payload is not aligned at 4 bytes"
+#define DDS_SECURITY_ERR_TRUSTED_CA_DIR_MAX_EXCEEDED_CODE 152
+#define DDS_SECURITY_ERR_TRUSTED_CA_DIR_MAX_EXCEEDED_MESSAGE "Cannot open trusted CA directory: maximum number of CA directories (%d) exceeded"
 
 #define DDS_SECURITY_ERR_UNDEFINED_CODE 200
 #define DDS_SECURITY_ERR_UNDEFINED_MESSAGE "Undefined Error Message"
diff --git a/src/security/builtin_plugins/authentication/src/auth_utils.c b/src/security/builtin_plugins/authentication/src/auth_utils.c
index ef9d768..54e94b2 100644
--- a/src/security/builtin_plugins/authentication/src/auth_utils.c
+++ b/src/security/builtin_plugins/authentication/src/auth_utils.c
@@ -10,6 +10,8 @@
  * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
  */
 
+#include <assert.h>
+#include <string.h>
 #include <openssl/bn.h>
 #include <openssl/asn1.h>
 #include <openssl/x509.h>
@@ -18,6 +20,7 @@
 #include <openssl/bio.h>
 #include <openssl/err.h>
 #include <openssl/evp.h>
+#include <openssl/rand.h>
 #if OPENSSL_VERSION_NUMBER >= 0x1000200fL
 #define AUTH_INCLUDE_EC
 #include <openssl/ec.h>
@@ -27,15 +30,17 @@
 #else
 #error "OpenSSL version is not supported"
 #endif
-#include <openssl/rand.h>
 #include "dds/ddsrt/time.h"
 #include "dds/ddsrt/heap.h"
 #include "dds/ddsrt/filesystem.h"
 #include "dds/ddsrt/retcode.h"
+#include "dds/ddsrt/heap.h"
+#include "dds/ddsrt/atomics.h"
+#include "dds/ddsrt/string.h"
+#include "dds/ddsrt/io.h"
 #include "dds/security/dds_security_api_defs.h"
 #include "dds/security/core/dds_security_utils.h"
-#include <assert.h>
-
+#include "auth_utils.h"
 
 /* There is a problem when compiling on windows w.r.t. X509_NAME.
  * The windows api already defines the type X509_NAME which
@@ -46,1329 +51,999 @@
 #undef X509_NAME
 #endif
 
-#include "dds/ddsrt/heap.h"
-#include "dds/ddsrt/atomics.h"
-#include "dds/ddsrt/string.h"
-#include "dds/ddsrt/io.h"
-#include "dds/security/core/dds_security_utils.h"
-#include <string.h>
-#include "auth_utils.h"
-
 #define MAX_TRUSTED_CA 100
 
-char *
-get_openssl_error_message(
-        void)
+char *get_openssl_error_message(void)
 {
-    BIO *bio = BIO_new(BIO_s_mem());
-    char *msg;
-    char *buf = NULL;
-    size_t len; /*BIO_get_mem_data requires long int */
+  char *msg, *buf = NULL;
+  size_t len;
+  BIO *bio = BIO_new(BIO_s_mem());
+  if (!bio)
+    return ddsrt_strdup("BIO_new failed");
 
-    if (bio) {
-        ERR_print_errors(bio);
-        len = (size_t)BIO_get_mem_data (bio, &buf);
-        msg = ddsrt_malloc(len + 1);
-        memcpy(msg, buf, len);
-        msg[len] = '\0';
-        BIO_free(bio);
-    } else {
-        msg = ddsrt_strdup("BIO_new failed");
-    }
-
-    return msg;
+  ERR_print_errors(bio);
+  len = (size_t)BIO_get_mem_data(bio, &buf);
+  msg = ddsrt_malloc(len + 1);
+  memcpy(msg, buf, len);
+  msg[len] = '\0';
+  BIO_free(bio);
+  return msg;
 }
 
-char *
-get_certificate_subject_name(
-        X509 *cert,
-        DDS_Security_SecurityException *ex)
+char *get_certificate_subject_name(X509 *cert, DDS_Security_SecurityException *ex)
 {
-    X509_NAME *name;
-    char *subject = NULL;
-    char *subject_openssl = NULL;
-
-    assert(cert);
-
-    name = X509_get_subject_name(cert);
-    if (!name) {
-        goto err_get_subject;
-    }
-    
-    subject_openssl = X509_NAME_oneline( name, NULL, 0 );
-    subject = ddsrt_strdup( subject_openssl );
-    OPENSSL_free( subject_openssl );
-
-    return subject;
-
-err_get_subject:
+  X509_NAME *name;
+  assert(cert);
+  if (!(name = X509_get_subject_name(cert)))
+  {
     DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "X509_get_subject_name failed : ");
     return NULL;
+  }
+  char *subject_openssl = X509_NAME_oneline(name, NULL, 0);
+  char *subject = ddsrt_strdup(subject_openssl);
+  OPENSSL_free(subject_openssl);
+  return subject;
 }
 
-dds_time_t
-get_certificate_expiry(
-    const X509 *cert)
+dds_time_t get_certificate_expiry(const X509 *cert)
 {
-    dds_time_t expiry = DDS_TIME_INVALID;
-    ASN1_TIME *asn1;
-
-    assert(cert);
-
-    asn1 = X509_get_notAfter(cert);
-    if (asn1 != NULL) {
-        int days;
-        int seconds;
-        if (ASN1_TIME_diff(&days, &seconds, NULL, asn1) == 1 ) {
-            static const dds_duration_t secs_in_day = 86400;
-            const dds_time_t now = dds_time();
-            const int64_t max_valid_days_to_wait = (INT64_MAX - now) / DDS_NSECS_IN_SEC / secs_in_day;
-
-            if ( days < max_valid_days_to_wait ){
-                dds_duration_t delta = ((dds_duration_t)seconds + ((dds_duration_t)days * secs_in_day)) * DDS_NSECS_IN_SEC;
-                expiry = now + delta;
-            } else {
-                return DDS_NEVER;
-            }
-        }
+  assert(cert);
+  ASN1_TIME *asn1 = X509_get_notAfter(cert);
+  if (asn1 != NULL)
+  {
+    int days, seconds;
+    if (ASN1_TIME_diff(&days, &seconds, NULL, asn1) == 1)
+    {
+      static const dds_duration_t secs_in_day = 86400;
+      const dds_time_t now = dds_time();
+      const int64_t max_valid_days_to_wait = (INT64_MAX - now) / DDS_NSECS_IN_SEC / secs_in_day;
+      if (days < max_valid_days_to_wait)
+      {
+        dds_duration_t delta = ((dds_duration_t)seconds + ((dds_duration_t)days * secs_in_day)) * DDS_NSECS_IN_SEC;
+        return now + delta;
+      }
+      return DDS_NEVER;
     }
-
-    return expiry;
+  }
+  return DDS_TIME_INVALID;
 }
 
-DDS_Security_ValidationResult_t
-get_subject_name_DER_encoded(
-        const X509 *cert,
-        unsigned char **buffer,
-        size_t *size,
-        DDS_Security_SecurityException *ex)
+DDS_Security_ValidationResult_t get_subject_name_DER_encoded(const X509 *cert, unsigned char **buffer, size_t *size, DDS_Security_SecurityException *ex)
 {
-    unsigned char *tmp = NULL;
-    DDS_Security_ValidationResult_t result = DDS_SECURITY_VALIDATION_FAILED;
-    int32_t sz;
-    X509_NAME *name;
+  unsigned char *tmp = NULL;
+  int32_t sz;
+  X509_NAME *name;
 
-    assert(cert);
-    assert(buffer);
-    assert(size);
+  assert(cert);
+  assert(buffer);
+  assert(size);
 
-    *size = 0;
+  *size = 0;
+  if (!(name = X509_get_subject_name((X509 *)cert)))
+  {
+    DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "X509_get_subject_name failed : ");
+    return DDS_SECURITY_VALIDATION_FAILED;
+  }
+  if ((sz = i2d_X509_NAME(name, &tmp)) <= 0)
+  {
+    DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "i2d_X509_NAME failed : ");
+    return DDS_SECURITY_VALIDATION_FAILED;
+  }
 
-    name = X509_get_subject_name((X509 *)cert);
-    if (name) {
-        sz = i2d_X509_NAME(name, &tmp);
-        if (sz > 0) {
-            *size = (size_t)sz;
-            *buffer = ddsrt_malloc(*size);
-            memcpy(*buffer, tmp, *size);
-            OPENSSL_free(tmp);
-            result = DDS_SECURITY_VALIDATION_OK;
-        } else if (sz < 0) {
-            DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "i2d_X509_NAME failed : ");
-        }
-    } else {
-        DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "X509_get_subject_name failed : ");
-    }
-
-    return result;
+  *size = (size_t)sz;
+  *buffer = ddsrt_malloc(*size);
+  memcpy(*buffer, tmp, *size);
+  OPENSSL_free(tmp);
+  return DDS_SECURITY_VALIDATION_OK;
 }
 
-
-static DDS_Security_ValidationResult_t
-check_key_type_and_size(
-    EVP_PKEY *key,
-    int isPrivate,
-    DDS_Security_SecurityException *ex)
+static DDS_Security_ValidationResult_t check_key_type_and_size(EVP_PKEY *key, int isPrivate, DDS_Security_SecurityException *ex)
 {
-    DDS_Security_ValidationResult_t result = DDS_SECURITY_VALIDATION_OK;
-    const char *sub = isPrivate ? "private key" : "certificate";
-
-    assert(key);
-
-    switch (EVP_PKEY_id(key)) {
-    case EVP_PKEY_RSA:
-        if (EVP_PKEY_bits(key) != 2048) {
-            result = DDS_SECURITY_VALIDATION_FAILED;
-            DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result, "RSA %s has unsupported key size (%d)", sub, EVP_PKEY_bits(key));
-        } else if (isPrivate) {
-            RSA *rsaKey = EVP_PKEY_get1_RSA(key);
-            if (rsaKey) {
-                if (RSA_check_key(rsaKey) != 1) {
-                    result = DDS_SECURITY_VALIDATION_FAILED;
-                    DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result, "RSA key not correct : ");
-                }
-            }
-            RSA_free(rsaKey);
-        }
-        break;
-    case EVP_PKEY_EC:
-        if (EVP_PKEY_bits(key) != 256) {
-            result = DDS_SECURITY_VALIDATION_FAILED;
-            DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result, "EC %s has unsupported key size (%d)", sub, EVP_PKEY_bits(key));
-        } else {
-            EC_KEY *ecKey = EVP_PKEY_get1_EC_KEY(key);
-            if (ecKey) {
-                if (EC_KEY_check_key(ecKey) != 1) {
-                    result = DDS_SECURITY_VALIDATION_FAILED;
-                    DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result, "EC key not correct : ");
-                }
-            }
-            EC_KEY_free(ecKey);
-        }
-        break;
-    default:
-        result = DDS_SECURITY_VALIDATION_FAILED;
-        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result, "%s has not supported type", sub);
-        break;
+  const char *sub = isPrivate ? "private key" : "certificate";
+  assert(key);
+  switch (EVP_PKEY_id(key))
+  {
+  case EVP_PKEY_RSA:
+    if (EVP_PKEY_bits(key) != 2048)
+    {
+      DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "RSA %s has unsupported key size (%d)", sub, EVP_PKEY_bits(key));
+      return DDS_SECURITY_VALIDATION_FAILED;
     }
+    if (isPrivate)
+    {
+      RSA *rsaKey = EVP_PKEY_get0_RSA(key);
+      if (rsaKey && RSA_check_key(rsaKey) != 1)
+      {
+        DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "RSA key not correct : ");
+        return DDS_SECURITY_VALIDATION_FAILED;
+      }
+    }
+    return DDS_SECURITY_VALIDATION_OK;
 
-    return result;
+  case EVP_PKEY_EC:
+    if (EVP_PKEY_bits(key) != 256)
+    {
+      DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "EC %s has unsupported key size (%d)", sub, EVP_PKEY_bits(key));
+      return DDS_SECURITY_VALIDATION_FAILED;
+    }
+    EC_KEY *ecKey = EVP_PKEY_get0_EC_KEY(key);
+    if (ecKey && EC_KEY_check_key(ecKey) != 1)
+    {
+      DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "EC key not correct : ");
+      return DDS_SECURITY_VALIDATION_FAILED;
+    }
+    return DDS_SECURITY_VALIDATION_OK;
+
+  default:
+    DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "%s has not supported type", sub);
+    return DDS_SECURITY_VALIDATION_FAILED;
+  }
 }
 
-static DDS_Security_ValidationResult_t
-check_certificate_type_and_size(
-    X509 *cert,
-    DDS_Security_SecurityException *ex)
+static DDS_Security_ValidationResult_t check_certificate_type_and_size(X509 *cert, DDS_Security_SecurityException *ex)
 {
-    EVP_PKEY *pkey;
-    DDS_Security_ValidationResult_t result = DDS_SECURITY_VALIDATION_OK;
-
-    assert(cert);
-
-    pkey = X509_get_pubkey(cert);
-    if (pkey) {
-        result = check_key_type_and_size(pkey, false, ex);
-    } else {
-        result = DDS_SECURITY_VALIDATION_FAILED;
-        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result, "X509_get_pubkey failed");
-    }
-    EVP_PKEY_free(pkey);
-
-    return result;
+  assert(cert);
+  EVP_PKEY *pkey = X509_get_pubkey(cert);
+  if (!pkey)
+  {
+    DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "X509_get_pubkey failed");
+    return DDS_SECURITY_VALIDATION_FAILED;
+  }
+  DDS_Security_ValidationResult_t result = check_key_type_and_size(pkey, false, ex);
+  EVP_PKEY_free(pkey);
+  return result;
 }
 
-DDS_Security_ValidationResult_t
-check_certificate_expiry(
-    const X509 *cert,
-    DDS_Security_SecurityException *ex)
+DDS_Security_ValidationResult_t check_certificate_expiry(const X509 *cert, DDS_Security_SecurityException *ex)
 {
-    DDS_Security_ValidationResult_t result = DDS_SECURITY_VALIDATION_OK;
-
-    assert(cert);
-
-    if( X509_cmp_current_time(X509_get_notBefore( cert )) == 0 ){
-        result = DDS_SECURITY_VALIDATION_FAILED;
-        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_CERT_STARTDATE_IN_FUTURE_CODE, (int)result, DDS_SECURITY_ERR_CERT_STARTDATE_IN_FUTURE_MESSAGE);
-
-    }
-    if( X509_cmp_current_time(X509_get_notAfter( cert )) == 0 ){
-        result = DDS_SECURITY_VALIDATION_FAILED;
-        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_CERT_EXPIRED_CODE, (int)result, DDS_SECURITY_ERR_CERT_EXPIRED_MESSAGE);
-
-    }
-
-    return result;
+  assert(cert);
+  if (X509_cmp_current_time(X509_get_notBefore(cert)) == 0)
+  {
+    DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_CERT_STARTDATE_IN_FUTURE_CODE, DDS_SECURITY_VALIDATION_FAILED, DDS_SECURITY_ERR_CERT_STARTDATE_IN_FUTURE_MESSAGE);
+    return DDS_SECURITY_VALIDATION_FAILED;
+  }
+  if (X509_cmp_current_time(X509_get_notAfter(cert)) == 0)
+  {
+    DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_CERT_EXPIRED_CODE, DDS_SECURITY_VALIDATION_FAILED, DDS_SECURITY_ERR_CERT_EXPIRED_MESSAGE);
+    return DDS_SECURITY_VALIDATION_FAILED;
+  }
+  return DDS_SECURITY_VALIDATION_OK;
 }
 
-
-DDS_Security_ValidationResult_t
-load_X509_certificate_from_data(
-        const char *data,
-        int len,
-        X509 **x509Cert,
-        DDS_Security_SecurityException *ex)
+DDS_Security_ValidationResult_t load_X509_certificate_from_data(const char *data, int len, X509 **x509Cert, DDS_Security_SecurityException *ex)
 {
-    DDS_Security_ValidationResult_t result = DDS_SECURITY_VALIDATION_OK;
-    BIO *bio;
+  BIO *bio;
+  assert(data);
+  assert(len >= 0);
+  assert(x509Cert);
 
-    assert(data);
-    assert(len >= 0);
-    assert(x509Cert);
-
-    /* load certificate in buffer */
-    bio = BIO_new_mem_buf((void *) data, len);
-    if (!bio) {
-        result = DDS_SECURITY_VALIDATION_FAILED;
-        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result, "BIO_new_mem_buf failed");
-        goto err_bio_alloc;
-    }
-
-    *x509Cert = PEM_read_bio_X509(bio, NULL, NULL, NULL);
-    if (!(*x509Cert)) {
-        result = DDS_SECURITY_VALIDATION_FAILED;
-        DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result, "Failed to parse certificate: ");
-        goto err_cert_read;
-    }
-
-    /* check authentication algorithm */
-    if( get_auhentication_algo_kind( *x509Cert ) == AUTH_ALGO_KIND_UNKNOWN ){
-        result = DDS_SECURITY_VALIDATION_FAILED;
-        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_CERT_AUTH_ALGO_KIND_UNKNOWN_CODE, (int)result,
-                        DDS_SECURITY_ERR_CERT_AUTH_ALGO_KIND_UNKNOWN_MESSAGE);
-		    X509_free(*x509Cert);
-        goto err_cert_read;
-    }
-
-err_cert_read:
+  if (!(bio = BIO_new_mem_buf((void *)data, len)))
+  {
+    DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "BIO_new_mem_buf failed");
+    return DDS_SECURITY_VALIDATION_FAILED;
+  }
+  if (!(*x509Cert = PEM_read_bio_X509(bio, NULL, NULL, NULL)))
+  {
+    DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "Failed to parse certificate: ");
     BIO_free(bio);
-err_bio_alloc:
-    return result;
+    return DDS_SECURITY_VALIDATION_FAILED;
+  }
+  BIO_free(bio);
+
+  if (get_authentication_algo_kind(*x509Cert) == AUTH_ALGO_KIND_UNKNOWN)
+  {
+    DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_CERT_AUTH_ALGO_KIND_UNKNOWN_CODE, DDS_SECURITY_VALIDATION_FAILED, DDS_SECURITY_ERR_CERT_AUTH_ALGO_KIND_UNKNOWN_MESSAGE);
+    X509_free(*x509Cert);
+    return DDS_SECURITY_VALIDATION_FAILED;
+  }
+
+  return DDS_SECURITY_VALIDATION_OK;
 }
 
-
-
-DDS_Security_ValidationResult_t
-load_X509_certificate_from_file(
-        const char *filename,
-        X509 **x509Cert,
-        DDS_Security_SecurityException *ex)
+DDS_Security_ValidationResult_t load_X509_certificate_from_file(const char *filename, X509 **x509Cert, DDS_Security_SecurityException *ex)
 {
-    DDS_Security_ValidationResult_t result = DDS_SECURITY_VALIDATION_OK;
-    FILE *file_ptr;
+  assert(filename);
+  assert(x509Cert);
 
-    assert(filename);
-    assert(x509Cert);
-
-    /*check the file*/
   DDSRT_WARNING_MSVC_OFF(4996);
-    file_ptr = fopen( filename, "r");
+  FILE *file_ptr = fopen(filename, "r");
   DDSRT_WARNING_MSVC_ON(4996);
 
-    if( file_ptr == NULL ){
-        result = DDS_SECURITY_VALIDATION_FAILED;
-        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_FILE_PATH_CODE, (int)result, DDS_SECURITY_ERR_INVALID_FILE_PATH_MESSAGE, filename);
-        goto err_invalid_path;
-    }
+  if (file_ptr == NULL)
+  {
+    DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_FILE_PATH_CODE, DDS_SECURITY_VALIDATION_FAILED, DDS_SECURITY_ERR_INVALID_FILE_PATH_MESSAGE, filename);
+    return DDS_SECURITY_VALIDATION_FAILED;
+  }
+  if (!(*x509Cert = PEM_read_X509(file_ptr, NULL, NULL, NULL)))
+  {
+    DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "Failed to parse certificate: ");
+    (void)fclose(file_ptr);
+    return DDS_SECURITY_VALIDATION_FAILED;
+  }
+  (void)fclose(file_ptr);
 
-    /*load certificate from file*/
-    *x509Cert = PEM_read_X509(file_ptr,NULL,NULL,NULL);
-    if (!(*x509Cert)) {
-        result = DDS_SECURITY_VALIDATION_FAILED;
-        DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result, "Failed to parse certificate: ");
-        goto err_invalid_content;
-    }
+  if (get_authentication_algo_kind(*x509Cert) == AUTH_ALGO_KIND_UNKNOWN)
+  {
+    DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_CERT_AUTH_ALGO_KIND_UNKNOWN_CODE, DDS_SECURITY_VALIDATION_FAILED, DDS_SECURITY_ERR_CERT_AUTH_ALGO_KIND_UNKNOWN_MESSAGE);
+    X509_free(*x509Cert);
+    return DDS_SECURITY_VALIDATION_FAILED;
+  }
 
-    /* check authentication algorithm */
-    if( get_auhentication_algo_kind( *x509Cert ) == AUTH_ALGO_KIND_UNKNOWN ){
-        result = DDS_SECURITY_VALIDATION_FAILED;
-        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_CERT_AUTH_ALGO_KIND_UNKNOWN_CODE, (int)result,
-                        DDS_SECURITY_ERR_CERT_AUTH_ALGO_KIND_UNKNOWN_MESSAGE);
-		    X509_free(*x509Cert);
-        goto err_invalid_content;
-    }
-
-
-err_invalid_content:
-    (void)fclose( file_ptr );
-err_invalid_path:
-
-    return result;
+  return DDS_SECURITY_VALIDATION_OK;
 }
 
-static DDS_Security_ValidationResult_t
-load_private_key_from_data(
-        const char *data,
-        const char *password,
-        EVP_PKEY **privateKey,
-        DDS_Security_SecurityException *ex)
+static DDS_Security_ValidationResult_t load_private_key_from_data(const char *data, const char *password, EVP_PKEY **privateKey, DDS_Security_SecurityException *ex)
 {
-    DDS_Security_ValidationResult_t result = DDS_SECURITY_VALIDATION_OK;
-    BIO *bio;
-    const char *pw = (password ? password : "");
+  BIO *bio;
+  assert(data);
+  assert(privateKey);
 
-    assert(data);
-    assert(privateKey);
-
-    /* load certificate in buffer */
-    bio = BIO_new_mem_buf((void *) data, -1);
-    if (!bio) {
-        result = DDS_SECURITY_VALIDATION_FAILED;
-        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result, "BIO_new_mem_buf failed");
-        goto err_bio_alloc;
-    }
-
-    *privateKey = PEM_read_bio_PrivateKey(bio, NULL, NULL, (void *)pw);
-    if (!(*privateKey)) {
-        result = DDS_SECURITY_VALIDATION_FAILED;
-        DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result, "Failed to parse private key: ");
-        goto err_key_read;
-    }
-
-err_key_read:
+  if (!(bio = BIO_new_mem_buf((void *)data, -1)))
+  {
+    DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "BIO_new_mem_buf failed");
+    return DDS_SECURITY_VALIDATION_FAILED;
+  }
+  if (!(*privateKey = PEM_read_bio_PrivateKey(bio, NULL, NULL, (void *)(password ? password : ""))))
+  {
+    DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "Failed to parse private key: ");
     BIO_free(bio);
-err_bio_alloc:
-    return result;
+    return DDS_SECURITY_VALIDATION_FAILED;
+  }
+
+  BIO_free(bio);
+  return DDS_SECURITY_VALIDATION_OK;
 }
 
-
-static DDS_Security_ValidationResult_t
-load_private_key_from_file(
-        const char *filepath,
-        const char *password,
-        EVP_PKEY **privateKey,
-        DDS_Security_SecurityException *ex)
+static DDS_Security_ValidationResult_t load_private_key_from_file(const char *filepath, const char *password, EVP_PKEY **privateKey, DDS_Security_SecurityException *ex)
 {
-    DDS_Security_ValidationResult_t result = DDS_SECURITY_VALIDATION_OK;
-    const char *pw = (password ? password : "");
-    FILE *file_ptr;
+  FILE *file_ptr;
+  assert(filepath);
+  assert(privateKey);
 
-    assert(filepath);
-    assert(privateKey);
-
-    /*check the file*/
   DDSRT_WARNING_MSVC_OFF(4996);
-    file_ptr = fopen( filepath, "r");
+  file_ptr = fopen(filepath, "r");
   DDSRT_WARNING_MSVC_ON(4996);
+  if (file_ptr == NULL)
+  {
+    DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_FILE_PATH_CODE, DDS_SECURITY_VALIDATION_FAILED, DDS_SECURITY_ERR_INVALID_FILE_PATH_MESSAGE, filepath);
+    return DDS_SECURITY_VALIDATION_FAILED;
+  }
+  if (!(*privateKey = PEM_read_PrivateKey(file_ptr, NULL, NULL, (void *)(password ? password : ""))))
+  {
+    DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "Failed to parse certificate: ");
+    (void)fclose(file_ptr);
+    return DDS_SECURITY_VALIDATION_FAILED;
+  }
 
-    if( file_ptr == NULL ){
-        result = DDS_SECURITY_VALIDATION_FAILED;
-        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_FILE_PATH_CODE, (int)result, DDS_SECURITY_ERR_INVALID_FILE_PATH_MESSAGE, filepath);
-        goto err_invalid_path;
-    }
-
-    /*load private key from file*/
-    *privateKey = PEM_read_PrivateKey(file_ptr, NULL, NULL, (void *)pw);
-    if (!(*privateKey)) {
-        result = DDS_SECURITY_VALIDATION_FAILED;
-        DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result, "Failed to parse certificate: ");
-        goto err_invalid_content;
-    }
-
-err_invalid_content:
-    (void)fclose( file_ptr );
-err_invalid_path:
-
-    return result;
+  (void)fclose(file_ptr);
+  return DDS_SECURITY_VALIDATION_OK;
 }
 
-
 /*
  * Gets the URI string (as referred in DDS Security spec) and returns the URI type
  * data: data part of the URI. Typically It contains different format according to URI type.
  */
-AuthConfItemPrefix_t
-get_conf_item_type(
-        const char *str,
-        char **data)
+AuthConfItemPrefix_t get_conf_item_type(const char *str, char **data)
 {
-    AuthConfItemPrefix_t kind = AUTH_CONF_ITEM_PREFIX_UNKNOWN;
-    const char *AUTH_CONF_FILE_PREFIX    = "file:";
-    const char *AUTH_CONF_DATA_PREFIX   = "data:,";
-    const char *AUTH_CONF_PKCS11_PREFIX = "pkcs11:";
-    size_t AUTH_CONF_FILE_PREFIX_LEN    = strlen(AUTH_CONF_FILE_PREFIX);
-    size_t AUTH_CONF_DATA_PREFIX_LEN   = strlen(AUTH_CONF_DATA_PREFIX);
-    size_t AUTH_CONF_PKCS11_PREFIX_LEN = strlen(AUTH_CONF_PKCS11_PREFIX);
-    char *ptr;
+  const char *f = "file:", *d = "data:,", *p = "pkcs11:";
+  size_t sf = strlen(f), sd = strlen(d), sp = strlen(p);
+  assert(str);
+  assert(data);
 
-    assert(str);
-    assert(data);
+  char *ptr = ddssec_strchrs(str, " \t", false);
+  if (strncmp(ptr, f, sf) == 0)
+  {
+    size_t e = strncmp(ptr + sf, "//", 2) == 0 ? 2 : 0;
+    *data = ddsrt_strdup(ptr + sf + e);
+    return AUTH_CONF_ITEM_PREFIX_FILE;
+  }
+  if (strncmp(ptr, d, sd) == 0)
+  {
+    *data = ddsrt_strdup(ptr + sd);
+    return AUTH_CONF_ITEM_PREFIX_DATA;
+  }
+  if (strncmp(ptr, p, sp) == 0)
+  {
+    *data = ddsrt_strdup(ptr + sp);
+    return AUTH_CONF_ITEM_PREFIX_PKCS11;
+  }
 
-    ptr = ddssec_strchrs(str, " \t", false);
-
-    if (strncmp(ptr, AUTH_CONF_FILE_PREFIX, AUTH_CONF_FILE_PREFIX_LEN) == 0) {
-        const char *DOUBLE_SLASH   = "//";
-        size_t DOUBLE_SLASH_LEN = 2;
-        if (strncmp(&(ptr[AUTH_CONF_FILE_PREFIX_LEN]), DOUBLE_SLASH, DOUBLE_SLASH_LEN) == 0) {
-            *data = ddsrt_strdup(&(ptr[AUTH_CONF_FILE_PREFIX_LEN + DOUBLE_SLASH_LEN]));
-        } else {
-            *data = ddsrt_strdup(&(ptr[AUTH_CONF_FILE_PREFIX_LEN]));
-        }
-        kind = AUTH_CONF_ITEM_PREFIX_FILE;
-    } else if (strncmp(ptr, AUTH_CONF_DATA_PREFIX, AUTH_CONF_DATA_PREFIX_LEN) == 0) {
-        kind = AUTH_CONF_ITEM_PREFIX_DATA;
-        *data = ddsrt_strdup(&(ptr[AUTH_CONF_DATA_PREFIX_LEN]));
-    } else if (strncmp(ptr, AUTH_CONF_PKCS11_PREFIX, AUTH_CONF_PKCS11_PREFIX_LEN) == 0) {
-        kind = AUTH_CONF_ITEM_PREFIX_PKCS11;
-        *data = ddsrt_strdup(&(ptr[AUTH_CONF_PKCS11_PREFIX_LEN]));
-    }
-
-    return kind;
+  return AUTH_CONF_ITEM_PREFIX_UNKNOWN;
 }
 
-DDS_Security_ValidationResult_t
-load_X509_certificate(
-        const char *data,
-        X509 **x509Cert,
-        DDS_Security_SecurityException *ex)
+DDS_Security_ValidationResult_t load_X509_certificate(const char *data, X509 **x509Cert, DDS_Security_SecurityException *ex)
 {
-    DDS_Security_ValidationResult_t result = DDS_SECURITY_VALIDATION_OK;
-    char *contents = NULL;
+  DDS_Security_ValidationResult_t result;
+  char *contents = NULL;
+  assert(data);
+  assert(x509Cert);
 
-    assert(data);
-    assert(x509Cert);
+  switch (get_conf_item_type(data, &contents))
+  {
+  case AUTH_CONF_ITEM_PREFIX_FILE:
+    result = load_X509_certificate_from_file(contents, x509Cert, ex);
+    break;
+  case AUTH_CONF_ITEM_PREFIX_DATA:
+    result = load_X509_certificate_from_data(contents, (int)strlen(contents), x509Cert, ex);
+    break;
+  case AUTH_CONF_ITEM_PREFIX_PKCS11:
+    result = DDS_SECURITY_VALIDATION_FAILED;
+    DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result, "Certificate pkcs11 format currently not supported:\n%s", data);
+    break;
+  default:
+    result = DDS_SECURITY_VALIDATION_FAILED;
+    DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result, "Specified certificate has wrong format:\n%s", data);
+    break;
+  }
+  ddsrt_free(contents);
 
-    switch (get_conf_item_type(data, &contents)) {
-    case AUTH_CONF_ITEM_PREFIX_FILE:
-        result = load_X509_certificate_from_file(contents, x509Cert, ex);
-        break;
-    case AUTH_CONF_ITEM_PREFIX_DATA:
-        result = load_X509_certificate_from_data(contents, (int)strlen(contents), x509Cert, ex);
-        break;
-    case AUTH_CONF_ITEM_PREFIX_PKCS11:
-        result = DDS_SECURITY_VALIDATION_FAILED;
-        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result, "Certificate pkcs11 format currently not supported:\n%s", data);
-        break;
-    default:
-        result = DDS_SECURITY_VALIDATION_FAILED;
-        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result, "Specified certificate has wrong format:\n%s", data);
-        break;
+  if (result == DDS_SECURITY_VALIDATION_OK)
+  {
+    if (check_certificate_type_and_size(*x509Cert, ex) != DDS_SECURITY_VALIDATION_OK ||
+        check_certificate_expiry(*x509Cert, ex) != DDS_SECURITY_VALIDATION_OK)
+    {
+      result = DDS_SECURITY_VALIDATION_FAILED;
+      X509_free(*x509Cert);
     }
-    ddsrt_free(contents);
-
-    if (result == DDS_SECURITY_VALIDATION_OK) {
-        if ( check_certificate_type_and_size(*x509Cert, ex) != DDS_SECURITY_VALIDATION_OK ||
-             check_certificate_expiry(*x509Cert, ex) != DDS_SECURITY_VALIDATION_OK
-                        ) {
-            result = DDS_SECURITY_VALIDATION_FAILED;
-            X509_free(*x509Cert);
-        }
-    }
-    return result;
+  }
+  return result;
 }
 
-DDS_Security_ValidationResult_t
-load_X509_private_key(
-        const char *data,
-        const char *password,
-        EVP_PKEY **privateKey,
-        DDS_Security_SecurityException *ex)
+DDS_Security_ValidationResult_t load_X509_private_key(const char *data, const char *password, EVP_PKEY **privateKey, DDS_Security_SecurityException *ex)
 {
-    DDS_Security_ValidationResult_t result = DDS_SECURITY_VALIDATION_OK;
-    char *contents = NULL;
+  DDS_Security_ValidationResult_t result;
+  char *contents = NULL;
+  assert(data);
+  assert(privateKey);
 
-    assert(data);
-    assert(privateKey);
+  switch (get_conf_item_type(data, &contents))
+  {
+  case AUTH_CONF_ITEM_PREFIX_FILE:
+    result = load_private_key_from_file(contents, password, privateKey, ex);
+    break;
+  case AUTH_CONF_ITEM_PREFIX_DATA:
+    result = load_private_key_from_data(contents, password, privateKey, ex);
+    break;
+  case AUTH_CONF_ITEM_PREFIX_PKCS11:
+    result = DDS_SECURITY_VALIDATION_FAILED;
+    DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result, "PrivateKey pkcs11 format currently not supported:\n%s", data);
+    break;
+  default:
+    result = DDS_SECURITY_VALIDATION_FAILED;
+    DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result, "Specified PrivateKey has wrong format:\n%s", data);
+    break;
+  }
+  ddsrt_free(contents);
 
-    switch (get_conf_item_type(data, &contents)) {
-    case AUTH_CONF_ITEM_PREFIX_FILE:
-        result = load_private_key_from_file(contents, password, privateKey, ex);
-        break;
-    case AUTH_CONF_ITEM_PREFIX_DATA:
-        result = load_private_key_from_data(contents, password, privateKey, ex);
-        break;
-    case AUTH_CONF_ITEM_PREFIX_PKCS11:
-        result = DDS_SECURITY_VALIDATION_FAILED;
-        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result, "PrivateKey pkcs11 format currently not supported:\n%s", data);
-        break;
-    default:
-        result = DDS_SECURITY_VALIDATION_FAILED;
-        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result, "Specified PrivateKey has wrong format:\n%s", data);
-        break;
+  if (result == DDS_SECURITY_VALIDATION_OK)
+  {
+    if (check_key_type_and_size(*privateKey, true, ex) != DDS_SECURITY_VALIDATION_OK)
+    {
+      result = DDS_SECURITY_VALIDATION_FAILED;
+      EVP_PKEY_free(*privateKey);
     }
-    ddsrt_free(contents);
+  }
 
-    if (result == DDS_SECURITY_VALIDATION_OK) {
-        if ((result = check_key_type_and_size(*privateKey, true, ex)) != DDS_SECURITY_VALIDATION_OK) {
-            EVP_PKEY_free(*privateKey);
-        }
-    }
-
-    return result;
+  return result;
 }
 
-DDS_Security_ValidationResult_t
-verify_certificate(
-        X509 *identityCert,
-        X509 *identityCa,
-        DDS_Security_SecurityException *ex)
+DDS_Security_ValidationResult_t verify_certificate(X509 *identityCert, X509 *identityCa, DDS_Security_SecurityException *ex)
 {
-    DDS_Security_ValidationResult_t result = DDS_SECURITY_VALIDATION_OK;
-    int r;
-    X509_STORE *store;
-    X509_STORE_CTX *ctx;
+  X509_STORE_CTX *ctx;
+  X509_STORE *store;
+  assert(identityCert);
+  assert(identityCa);
 
+  /* Currently only a self signed indentiyCa is supported. Verification of against a certificate chain is not yet supported */
+  /* Verification of the certificate expiry using a CRL is not yet supported */
 
-
-    assert(identityCert);
-    assert(identityCa);
-
-    /* Currently only a self signed indentiyCa is supported */
-    /* Verification of against a certificate chain is not yet supported */
-    /* Verification of the certificate expiry using a CRL is not yet supported */
-
-    store = X509_STORE_new();
-
-
-    if (!store) {
-        DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result, "X509_STORE_new failed : ");
-        goto err_store_new;
-    }
-
-    if (X509_STORE_add_cert(store, identityCa) != 1) {
-        DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result, "X509_STORE_add_cert failed : ");
-        goto err_add_cert;
-    }
-
-    ctx = X509_STORE_CTX_new();
-    if (!ctx) {
-         DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result, "X509_STORE_CTX_new failed : ");
-         goto err_ctx_new;
-    }
-
-    if (X509_STORE_CTX_init(ctx, store, identityCert, NULL) != 1) {
-        DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result, "X509_STORE_CTX_init failed : ");
-        goto err_ctx_init;
-    }
-
-    r = X509_verify_cert(ctx);
-    if (r != 1) {
-        const char *msg = X509_verify_cert_error_string(X509_STORE_CTX_get_error(ctx));
-        char *subject = NULL;
-
-        result = DDS_SECURITY_VALIDATION_FAILED;
-        subject = get_certificate_subject_name(identityCert, NULL);
-        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result,
-                "Certificate not valid: error: %s subject: %s", msg, subject ? subject : "not found");
-        ddsrt_free(subject);
-    }
+  if (!(store = X509_STORE_new()))
+  {
+    DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "X509_STORE_new failed : ");
+    goto err_store_new;
+  }
+  if (X509_STORE_add_cert(store, identityCa) != 1)
+  {
+    DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "X509_STORE_add_cert failed : ");
+    goto err_add_cert;
+  }
+  if (!(ctx = X509_STORE_CTX_new()))
+  {
+    DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "X509_STORE_CTX_new failed : ");
+    goto err_ctx_new;
+  }
+  if (X509_STORE_CTX_init(ctx, store, identityCert, NULL) != 1)
+  {
+    DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "X509_STORE_CTX_init failed : ");
+    goto err_ctx_init;
+  }
+  if (X509_verify_cert(ctx) != 1)
+  {
+    const char *msg = X509_verify_cert_error_string(X509_STORE_CTX_get_error(ctx));
+    char *subject = get_certificate_subject_name(identityCert, NULL);
+    DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "Certificate not valid: error: %s; subject: %s", msg, subject ? subject : "[not found]");
+    ddsrt_free(subject);
+    goto err_ctx_init;
+  }
+  X509_STORE_CTX_free(ctx);
+  X509_STORE_free(store);
+  return DDS_SECURITY_VALIDATION_OK;
 
 err_ctx_init:
-    X509_STORE_CTX_free(ctx);
+  X509_STORE_CTX_free(ctx);
 err_ctx_new:
 err_add_cert:
-    X509_STORE_free(store);
+  X509_STORE_free(store);
 err_store_new:
-    return result;
+  return DDS_SECURITY_VALIDATION_FAILED;
 }
 
-AuthenticationAlgoKind_t
-get_auhentication_algo_kind(
-        X509 *cert)
+AuthenticationAlgoKind_t get_authentication_algo_kind(X509 *cert)
 {
-    AuthenticationAlgoKind_t kind = AUTH_ALGO_KIND_UNKNOWN;
-    EVP_PKEY *pkey;
-
-    assert(cert);
-
-    pkey = X509_get_pubkey(cert);
-
-    if (pkey) {
-        switch (EVP_PKEY_id(pkey)) {
-        case EVP_PKEY_RSA:
-             if (EVP_PKEY_bits(pkey) == 2048) {
-                 kind = AUTH_ALGO_KIND_RSA_2048;
-             }
-        break;
-        case EVP_PKEY_EC:
-            if (EVP_PKEY_bits(pkey) == 256) {
-                kind = AUTH_ALGO_KIND_EC_PRIME256V1;
-            }
-            break;
-        default:
-        break;
-        }
-        EVP_PKEY_free(pkey);
+  AuthenticationAlgoKind_t kind = AUTH_ALGO_KIND_UNKNOWN;
+  assert(cert);
+  EVP_PKEY *pkey = X509_get_pubkey(cert);
+  if (pkey)
+  {
+    switch (EVP_PKEY_id(pkey))
+    {
+    case EVP_PKEY_RSA:
+      if (EVP_PKEY_bits(pkey) == 2048)
+        kind = AUTH_ALGO_KIND_RSA_2048;
+      break;
+    case EVP_PKEY_EC:
+      if (EVP_PKEY_bits(pkey) == 256)
+        kind = AUTH_ALGO_KIND_EC_PRIME256V1;
+      break;
     }
-
-    return kind;
+    EVP_PKEY_free(pkey);
+  }
+  return kind;
 }
 
-AuthenticationChallenge *
-generate_challenge(
-        DDS_Security_SecurityException *ex)
+AuthenticationChallenge * generate_challenge(DDS_Security_SecurityException *ex)
 {
-    AuthenticationChallenge *result;
-
-    result = ddsrt_malloc(sizeof(*result));
-    if (RAND_bytes(result->value, sizeof(result->value)) < 0 ) {
-
-        DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED,
-                "Failed to generate a 256 bit random number ");
-        ddsrt_free(result);
-        result = NULL;
-    }
-
-    return result;
+  AuthenticationChallenge *result = ddsrt_malloc(sizeof(*result));
+  if (RAND_bytes(result->value, sizeof(result->value)) < 0)
+  {
+    DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "Failed to generate a 256 bit random number ");
+    ddsrt_free(result);
+    return NULL;
+  }
+  return result;
 }
 
-DDS_Security_ValidationResult_t
-get_certificate_contents(
-        X509 *cert,
-        unsigned char **data,
-        uint32_t *size,
-        DDS_Security_SecurityException *ex)
+DDS_Security_ValidationResult_t get_certificate_contents(X509 *cert, unsigned char **data, uint32_t *size, DDS_Security_SecurityException *ex)
 {
-    DDS_Security_ValidationResult_t result = DDS_SECURITY_VALIDATION_OK;
-    BIO *bio = NULL;
-    size_t sz;
-    char *ptr;
+  BIO *bio = NULL;
+  char *ptr;
+  if ((bio = BIO_new(BIO_s_mem())) == NULL)
+  {
+    DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "BIO_new_mem_buf failed");
+    return DDS_SECURITY_VALIDATION_FAILED;
+  }
+  if (!PEM_write_bio_X509(bio, cert))
+  {
+    DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "PEM_write_bio_X509 failed: ");
+    BIO_free(bio);
+    return DDS_SECURITY_VALIDATION_FAILED;
+  }
 
-    if ((bio = BIO_new(BIO_s_mem())) == NULL) {
-        result = DDS_SECURITY_VALIDATION_FAILED;
-        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE,  (int)result, "BIO_new_mem_buf failed");
-    } else if (!PEM_write_bio_X509(bio, cert)) {
-        result = DDS_SECURITY_VALIDATION_FAILED;
-        DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE,  (int)result, "PEM_write_bio_X509 failed: ");
-    } else {
-        sz = (size_t)BIO_get_mem_data(bio, &ptr);
-        *data = ddsrt_malloc(sz +1);
-        memcpy(*data, ptr, sz);
-        (*data)[sz] = '\0';
-        *size = (uint32_t)sz;
-    }
-
-    if (bio) BIO_free(bio);
-
-    return result;
+  size_t sz = (size_t)BIO_get_mem_data(bio, &ptr);
+  *data = ddsrt_malloc(sz + 1);
+  memcpy(*data, ptr, sz);
+  (*data)[sz] = '\0';
+  *size = (uint32_t)sz;
+  BIO_free(bio);
+  return DDS_SECURITY_VALIDATION_OK;
 }
 
-static DDS_Security_ValidationResult_t
-get_rsa_dh_parameters(
-    EVP_PKEY **params,
-    DDS_Security_SecurityException *ex)
+static DDS_Security_ValidationResult_t get_rsa_dh_parameters(EVP_PKEY **params, DDS_Security_SecurityException *ex)
 {
-    DDS_Security_ValidationResult_t result = DDS_SECURITY_VALIDATION_OK;
-    DH *dh = NULL;
+  DH *dh = NULL;
+  *params = NULL;
+  if ((*params = EVP_PKEY_new()) == NULL)
+  {
+    DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "Failed to allocate DH generation parameters: ");
+    return DDS_SECURITY_VALIDATION_FAILED;
+  }
+  if ((dh = DH_get_2048_256()) == NULL)
+  {
+    DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "Failed to allocate DH parameter using DH_get_2048_256: ");
+    EVP_PKEY_free(*params);
+    return DDS_SECURITY_VALIDATION_FAILED;
+  }
+  if (EVP_PKEY_set1_DH(*params, dh) <= 0)
+  {
+    DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "Failed to set DH generation parameters using EVP_PKEY_set1_DH: ");
+    EVP_PKEY_free(*params);
+    DH_free(dh);
+    return DDS_SECURITY_VALIDATION_FAILED;
+  }
 
-    *params = NULL;
-
-    if ((*params = EVP_PKEY_new()) == NULL) {
-        result = DDS_SECURITY_VALIDATION_FAILED;
-        DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE,  (int)result,
-                "Failed to allocate DH generation parameters: ");
-    } else if ((dh = DH_get_2048_256()) == NULL) {
-        result = DDS_SECURITY_VALIDATION_FAILED;
-        DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE,  (int)result,
-                "Failed to allocate DH parameter using DH_get_2048_256: ");
-    } else if (EVP_PKEY_set1_DH(*params, dh) <= 0) {
-        result = DDS_SECURITY_VALIDATION_FAILED;
-        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE,  (int)result,
-                "Failed to set DH generation parameters using EVP_PKEY_set1_DH: ");
-        EVP_PKEY_free(*params);
-    }
-
-    if (dh) DH_free(dh);
-
-    return result;
+  DH_free(dh);
+  return DDS_SECURITY_VALIDATION_OK;
 }
 
-static DDS_Security_ValidationResult_t
-get_ec_dh_parameters(
-    EVP_PKEY **params,
-    DDS_Security_SecurityException *ex)
+static DDS_Security_ValidationResult_t get_ec_dh_parameters(EVP_PKEY **params, DDS_Security_SecurityException *ex)
 {
-    DDS_Security_ValidationResult_t result = DDS_SECURITY_VALIDATION_OK;
-    EVP_PKEY_CTX *pctx = NULL;
+  EVP_PKEY_CTX *pctx = NULL;
+  if ((pctx = EVP_PKEY_CTX_new_id(EVP_PKEY_EC, NULL)) == NULL)
+  {
+    DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "Failed to allocate DH parameter context: ");
+    return DDS_SECURITY_VALIDATION_FAILED;
+  }
+  if (EVP_PKEY_paramgen_init(pctx) <= 0)
+  {
+    DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "Failed to initialize DH generation context: ");
+    EVP_PKEY_CTX_free(pctx);
+    return DDS_SECURITY_VALIDATION_FAILED;
+  }
+  if (EVP_PKEY_CTX_set_ec_paramgen_curve_nid(pctx, NID_X9_62_prime256v1) <= 0)
+  {
+    DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "Failed to set DH generation parameter generation method: ");
+    EVP_PKEY_CTX_free(pctx);
+    return DDS_SECURITY_VALIDATION_FAILED;
+  }
+  if (EVP_PKEY_paramgen(pctx, params) <= 0)
+  {
+    char *msg = get_openssl_error_message();
+    DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "Failed to generate DH parameters: ");
+    ddsrt_free(msg);
+    EVP_PKEY_CTX_free(pctx);
+    return DDS_SECURITY_VALIDATION_FAILED;
+  }
 
-    if ((pctx = EVP_PKEY_CTX_new_id(EVP_PKEY_EC, NULL)) == NULL) {
-        result = DDS_SECURITY_VALIDATION_FAILED;
-        DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE,  (int)result,
-                "Failed to allocate DH parameter context: ");
-    } else if (EVP_PKEY_paramgen_init(pctx) <= 0) {
-        result = DDS_SECURITY_VALIDATION_FAILED;
-        DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE,  (int)result,
-                "Failed to initialize DH generation context: ");
-    } else if (EVP_PKEY_CTX_set_ec_paramgen_curve_nid(pctx, NID_X9_62_prime256v1) <= 0) {
-        result = DDS_SECURITY_VALIDATION_FAILED;
-        DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE,  (int)result,
-                "Failed to set DH generation parameter generation method: ");
-    } else if (EVP_PKEY_paramgen(pctx, params) <= 0) {
-        char *msg = get_openssl_error_message();
-        result = DDS_SECURITY_VALIDATION_FAILED;
-        DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE,  (int)result,
-                "Failed to generate DH parameters: ");
-        ddsrt_free(msg);
-    }
-
-    if (pctx) EVP_PKEY_CTX_free(pctx);
-
-    return result;
+  EVP_PKEY_CTX_free(pctx);
+  return DDS_SECURITY_VALIDATION_OK;
 }
 
-
-DDS_Security_ValidationResult_t
-generate_dh_keys(
-    EVP_PKEY **dhkey,
-    AuthenticationAlgoKind_t authKind,
-    DDS_Security_SecurityException *ex)
+DDS_Security_ValidationResult_t generate_dh_keys(EVP_PKEY **dhkey, AuthenticationAlgoKind_t authKind, DDS_Security_SecurityException *ex)
 {
-    DDS_Security_ValidationResult_t result = DDS_SECURITY_VALIDATION_FAILED;
-    EVP_PKEY *params = NULL;
-    EVP_PKEY_CTX *kctx = NULL;
+  EVP_PKEY *params = NULL;
+  EVP_PKEY_CTX *kctx = NULL;
+  *dhkey = NULL;
+  switch (authKind)
+  {
+  case AUTH_ALGO_KIND_RSA_2048:
+    if (get_rsa_dh_parameters(&params, ex) != DDS_SECURITY_VALIDATION_OK)
+      goto failed;
+    break;
+  case AUTH_ALGO_KIND_EC_PRIME256V1:
+    if (get_ec_dh_parameters(&params, ex) != DDS_SECURITY_VALIDATION_OK)
+      goto failed;
+    break;
+  default:
+    assert(0);
+    goto failed;
+  }
 
-    *dhkey = NULL;
+  if ((kctx = EVP_PKEY_CTX_new(params, NULL)) == NULL)
+  {
+    DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "Failed to allocate DH generation context: ");
+    goto failed_params;
+  }
+  if (EVP_PKEY_keygen_init(kctx) <= 0)
+  {
+    DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "Failed to initialize DH generation context: ");
+    goto failed_kctx;
+  }
+  if (EVP_PKEY_keygen(kctx, dhkey) <= 0)
+  {
+    DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "Failed to generate DH key pair: ");
+    goto failed_kctx;
+  }
+  EVP_PKEY_CTX_free(kctx);
+  EVP_PKEY_free(params);
+  return DDS_SECURITY_VALIDATION_OK;
 
-    switch(authKind) {
-    case AUTH_ALGO_KIND_RSA_2048:
-        result = get_rsa_dh_parameters(&params, ex);
-        break;
-    case AUTH_ALGO_KIND_EC_PRIME256V1:
-        result = get_ec_dh_parameters(&params, ex);
-        break;
-    default:
-        assert(0);
-        break;
-    }
-
-    if (result != DDS_SECURITY_VALIDATION_OK) {
-        return result;
-    } else if ((kctx = EVP_PKEY_CTX_new(params, NULL)) == NULL) {
-        result = DDS_SECURITY_VALIDATION_FAILED;
-        DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE,  (int)result,
-                "Failed to allocate DH generation context: ");
-    } else if (EVP_PKEY_keygen_init(kctx) <= 0) {
-        result = DDS_SECURITY_VALIDATION_FAILED;
-        DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE,  (int)result,
-                "Failed to initialize DH generation context: ");
-    } else if (EVP_PKEY_keygen(kctx, dhkey) <= 0) {
-        result = DDS_SECURITY_VALIDATION_FAILED;
-        DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE,  (int)result,
-                "Failed to generate DH key pair: ");
-    }
-
-    if (kctx) EVP_PKEY_CTX_free(kctx);
-    if (params) EVP_PKEY_free(params);
-
-    return result;
+failed_kctx:
+  EVP_PKEY_CTX_free(kctx);
+failed_params:
+  EVP_PKEY_free(params);
+failed:
+  return DDS_SECURITY_VALIDATION_FAILED;
 }
 
-static const BIGNUM *
-dh_get_public_key(
-    DH *dhkey)
+static const BIGNUM *dh_get_public_key(DH *dhkey)
 {
 #ifdef AUTH_INCLUDE_DH_ACCESSORS
-    const BIGNUM *pubkey, *privkey;
-    DH_get0_key(dhkey, &pubkey, &privkey);
-    return pubkey;
+  const BIGNUM *pubkey, *privkey;
+  DH_get0_key(dhkey, &pubkey, &privkey);
+  return pubkey;
 #else
-    return dhkey->pub_key;
+  return dhkey->pub_key;
 #endif
 }
 
-static int
-dh_set_public_key(
-    DH *dhkey,
-    BIGNUM *pubkey)
+static int dh_set_public_key(DH *dhkey, BIGNUM *pubkey)
 {
 #ifdef AUTH_INCLUDE_DH_ACCESSORS
-    return DH_set0_key(dhkey, pubkey, NULL);
+  return DH_set0_key(dhkey, pubkey, NULL);
 #else
-    dhkey->pub_key = pubkey;
+  dhkey->pub_key = pubkey;
 #endif
-    return 1;
+  return 1;
 }
 
-static DDS_Security_ValidationResult_t
-dh_public_key_to_oct_modp(
-    EVP_PKEY *pkey,
-    unsigned char **buffer,
-    uint32_t *length,
-    DDS_Security_SecurityException *ex)
+static DDS_Security_ValidationResult_t dh_public_key_to_oct_modp(EVP_PKEY *pkey, unsigned char **buffer, uint32_t *length, DDS_Security_SecurityException *ex)
 {
-    DDS_Security_ValidationResult_t result = DDS_SECURITY_VALIDATION_OK;
-    DH *dhkey;
-    ASN1_INTEGER *asn1int;
-
-    *buffer = NULL;
-
-    dhkey = EVP_PKEY_get1_DH(pkey);
-    if (!dhkey) {
-        result = DDS_SECURITY_VALIDATION_FAILED;
-        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result, "Failed to get DH key from PKEY: ");
-        goto fail_get_dhkey;
-    }
-
-    asn1int = BN_to_ASN1_INTEGER(dh_get_public_key(dhkey), NULL);
-    if (!asn1int) {
-        result = DDS_SECURITY_VALIDATION_FAILED;
-        DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result, "Failed to convert DH key to ASN1 integer: ");
-        goto fail_get_asn1int;
-    }
-
-    *length = (uint32_t) i2d_ASN1_INTEGER(asn1int, buffer);
-
-    ASN1_INTEGER_free(asn1int);
-
-fail_get_asn1int:
+  DH *dhkey;
+  ASN1_INTEGER *asn1int;
+  *buffer = NULL;
+  if (!(dhkey = EVP_PKEY_get1_DH(pkey)))
+  {
+    DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "Failed to get DH key from PKEY: ");
+    return DDS_SECURITY_VALIDATION_FAILED;
+  }
+  if (!(asn1int = BN_to_ASN1_INTEGER(dh_get_public_key(dhkey), NULL)))
+  {
+    DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "Failed to convert DH key to ASN1 integer: ");
     DH_free(dhkey);
-fail_get_dhkey:
-    return result;
+    return DDS_SECURITY_VALIDATION_FAILED;
+  }
+  *length = (uint32_t)i2d_ASN1_INTEGER(asn1int, buffer);
+  ASN1_INTEGER_free(asn1int);
+  DH_free(dhkey);
+  return DDS_SECURITY_VALIDATION_OK;
 }
 
-static DDS_Security_ValidationResult_t
-dh_public_key_to_oct_ecdh(
-    EVP_PKEY *pkey,
-    unsigned char **buffer,
-    uint32_t *length,
-    DDS_Security_SecurityException *ex)
+static DDS_Security_ValidationResult_t dh_public_key_to_oct_ecdh(EVP_PKEY *pkey, unsigned char **buffer, uint32_t *length, DDS_Security_SecurityException *ex)
 {
-    DDS_Security_ValidationResult_t result = DDS_SECURITY_VALIDATION_OK;
-    EC_KEY *eckey;
-    const EC_GROUP *group;
-    const EC_POINT *point;
-    size_t sz;
+  EC_KEY *eckey;
+  const EC_GROUP *group;
+  const EC_POINT *point;
+  size_t sz;
 
-    eckey = EVP_PKEY_get1_EC_KEY(pkey);
-    if (!eckey) {
-        result = DDS_SECURITY_VALIDATION_FAILED;
-        DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result, "Failed to get EC key from PKEY: ");
-        goto fail_get_eckey;
-    }
-
-    point = EC_KEY_get0_public_key(eckey);
-    if (!point) {
-        result = DDS_SECURITY_VALIDATION_FAILED;
-        DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result, "Failed to get public key from ECKEY: ");
-        goto fail_get_point;
-    }
-
-    group = EC_KEY_get0_group(eckey);
-    if (!group) {
-        result = DDS_SECURITY_VALIDATION_FAILED;
-        DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result, "Failed to get group from ECKEY: ");
-        goto fail_get_group;
-    }
-
-    sz = EC_POINT_point2oct(group, point, POINT_CONVERSION_UNCOMPRESSED, NULL, 0, NULL);
-    if (sz == 0) {
-        result = DDS_SECURITY_VALIDATION_FAILED;
-        DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result, "Failed to serialize public EC key: ");
-        goto fail_point2oct1;
-    }
-
-    *buffer = ddsrt_malloc(sz);
-
-    *length = (uint32_t)EC_POINT_point2oct(group, point, POINT_CONVERSION_UNCOMPRESSED, *buffer, sz, NULL);
-    if (*length == 0) {
-        result = DDS_SECURITY_VALIDATION_FAILED;
-        DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result, "Failed to serialize public EC key: ");
-        goto fail_point2oct2;
-    }
-
-    EC_KEY_free(eckey);
-
-    return result;
-
-fail_point2oct2:
+  if (!(eckey = EVP_PKEY_get1_EC_KEY(pkey)))
+  {
+    DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "Failed to get EC key from PKEY: ");
+    goto failed_key;
+  }
+  if (!(point = EC_KEY_get0_public_key(eckey)))
+  {
+    DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "Failed to get public key from ECKEY: ");
+    goto failed;
+  }
+  if (!(group = EC_KEY_get0_group(eckey)))
+  {
+    DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "Failed to get group from ECKEY: ");
+    goto failed;
+  }
+  if ((sz = EC_POINT_point2oct(group, point, POINT_CONVERSION_UNCOMPRESSED, NULL, 0, NULL)) == 0)
+  {
+    DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "Failed to serialize public EC key: ");
+    goto failed;
+  }
+  *buffer = ddsrt_malloc(sz);
+  if ((*length = (uint32_t)EC_POINT_point2oct(group, point, POINT_CONVERSION_UNCOMPRESSED, *buffer, sz, NULL)) == 0)
+  {
+    DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "Failed to serialize public EC key: ");
     ddsrt_free(*buffer);
-fail_point2oct1:
-fail_get_group:
-fail_get_point:
-fail_get_eckey:
-    EC_KEY_free(eckey);
-    return result;
+    goto failed;
+  }
+  EC_KEY_free(eckey);
+  return DDS_SECURITY_VALIDATION_OK;
+
+failed:
+  EC_KEY_free(eckey);
+failed_key:
+  return DDS_SECURITY_VALIDATION_FAILED;
 }
 
-DDS_Security_ValidationResult_t
-dh_public_key_to_oct(
-    EVP_PKEY *pkey,
-    AuthenticationAlgoKind_t algo,
-    unsigned char **buffer,
-    uint32_t *length,
-    DDS_Security_SecurityException *ex)
+DDS_Security_ValidationResult_t dh_public_key_to_oct(EVP_PKEY *pkey, AuthenticationAlgoKind_t algo, unsigned char **buffer, uint32_t *length, DDS_Security_SecurityException *ex)
 {
-    DDS_Security_ValidationResult_t result = DDS_SECURITY_VALIDATION_OK;
-
-    assert(pkey);
-    assert(buffer);
-    assert(length);
-
-    switch (algo) {
-    case AUTH_ALGO_KIND_RSA_2048:
-        result = dh_public_key_to_oct_modp(pkey, buffer, length, ex);
-        break;
-    case AUTH_ALGO_KIND_EC_PRIME256V1:
-        result = dh_public_key_to_oct_ecdh(pkey, buffer, length, ex);
-        break;
-    default:
-        assert(0);
-        result = DDS_SECURITY_VALIDATION_FAILED;
-        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result, "Invalid key algorithm specified");
-        break;
-    }
-
-    return result;
+  assert(pkey);
+  assert(buffer);
+  assert(length);
+  switch (algo)
+  {
+  case AUTH_ALGO_KIND_RSA_2048:
+    return dh_public_key_to_oct_modp(pkey, buffer, length, ex);
+  case AUTH_ALGO_KIND_EC_PRIME256V1:
+    return dh_public_key_to_oct_ecdh(pkey, buffer, length, ex);
+  default:
+    assert(0);
+    DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "Invalid key algorithm specified");
+    return DDS_SECURITY_VALIDATION_FAILED;
+  }
 }
 
-static DDS_Security_ValidationResult_t
-dh_oct_to_public_key_modp(
-    EVP_PKEY **pkey,
-    const unsigned char *keystr,
-    uint32_t size,
-    DDS_Security_SecurityException *ex)
+static DDS_Security_ValidationResult_t dh_oct_to_public_key_modp(EVP_PKEY **pkey, const unsigned char *keystr, uint32_t size, DDS_Security_SecurityException *ex)
 {
-    DDS_Security_ValidationResult_t result = DDS_SECURITY_VALIDATION_OK;
-    DH *dhkey;
-    ASN1_INTEGER *asn1int;
-    BIGNUM *pubkey;
+  DH *dhkey;
+  ASN1_INTEGER *asn1int;
+  BIGNUM *pubkey;
 
-    *pkey = EVP_PKEY_new();
-    if (!(*pkey)) {
-        result = DDS_SECURITY_VALIDATION_FAILED;
-        DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result, "Failed to convert octet sequence to ASN1 integer: ");
-        goto fail_alloc_pkey;
-    }
+  if (!(*pkey = EVP_PKEY_new()))
+  {
+    DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "Failed to convert octet sequence to ASN1 integer: ");
+    goto fail_alloc_pkey;
+  }
+  if (!(asn1int = d2i_ASN1_INTEGER(NULL, (const unsigned char **)&keystr, size)))
+  {
+    DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "Failed to convert octet sequence to ASN1 integer: ");
+    goto fail_get_asn1int;
+  }
+  if (!(pubkey = ASN1_INTEGER_to_BN(asn1int, NULL)))
+  {
+    DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "Failed to convert ASN1 integer to BIGNUM: ");
+    goto fail_get_pubkey;
+  }
 
-    asn1int = d2i_ASN1_INTEGER(NULL, (const unsigned char **)&keystr, size);
-    if (!asn1int) {
-        result = DDS_SECURITY_VALIDATION_FAILED;
-        DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result, "Failed to convert octet sequence to ASN1 integer: ");
-        goto fail_get_asn1int;
-    }
-
-    pubkey = ASN1_INTEGER_to_BN(asn1int, NULL);
-    if (!pubkey) {
-        result = DDS_SECURITY_VALIDATION_FAILED;
-        DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result, "Failed to convert ASN1 integer to BIGNUM: ");
-        goto fail_get_pubkey;
-    }
-
-    dhkey = DH_get_2048_256();
-
-    if (dh_set_public_key(dhkey, pubkey) == 0) {
-        result = DDS_SECURITY_VALIDATION_FAILED;
-        DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result, "Failed to set DH public key: ");
-    } else if (EVP_PKEY_set1_DH(*pkey, dhkey) == 0) {
-        result = DDS_SECURITY_VALIDATION_FAILED;
-        DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result, "Failed to convert DH to PKEY: ");
-    }
-
-    ASN1_INTEGER_free(asn1int);
+  dhkey = DH_get_2048_256();
+  if (dh_set_public_key(dhkey, pubkey) == 0)
+  {
+    DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "Failed to set DH public key: ");
+    goto fail_get_pubkey;
+  }
+  if (EVP_PKEY_set1_DH(*pkey, dhkey) == 0)
+  {
+    DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "Failed to convert DH to PKEY: ");
     DH_free(dhkey);
-
-    return result;
+    goto fail_get_pubkey;
+  }
+  ASN1_INTEGER_free(asn1int);
+  DH_free(dhkey);
+  return DDS_SECURITY_VALIDATION_OK;
 
 fail_get_pubkey:
-    ASN1_INTEGER_free(asn1int);
+  ASN1_INTEGER_free(asn1int);
 fail_get_asn1int:
-    EVP_PKEY_free(*pkey);
+  EVP_PKEY_free(*pkey);
 fail_alloc_pkey:
-    return result;
+  return DDS_SECURITY_VALIDATION_FAILED;
 }
 
-static DDS_Security_ValidationResult_t
-dh_oct_to_public_key_ecdh(
-    EVP_PKEY **pkey,
-    const unsigned char *keystr,
-    uint32_t size,
-    DDS_Security_SecurityException *ex)
+static DDS_Security_ValidationResult_t dh_oct_to_public_key_ecdh(EVP_PKEY **pkey, const unsigned char *keystr, uint32_t size, DDS_Security_SecurityException *ex)
 {
-    DDS_Security_ValidationResult_t result = DDS_SECURITY_VALIDATION_OK;
-    EC_KEY *eckey;
-    EC_GROUP *group;
-    EC_POINT *point;
-
-    group = EC_GROUP_new_by_curve_name(NID_X9_62_prime256v1);
-    if (!group) {
-        result = DDS_SECURITY_VALIDATION_FAILED;
-        DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result, "Failed to allocate EC group: ");
-        goto fail_alloc_group;
-    }
-
-    point = EC_POINT_new(group);
-    if (!point) {
-        result = DDS_SECURITY_VALIDATION_FAILED;
-        DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result, "Failed to allocate EC point: ");
-        goto fail_alloc_point;
-    }
-
-
-    if (EC_POINT_oct2point(group, point, keystr, size, NULL) != 1) {
-        result = DDS_SECURITY_VALIDATION_FAILED;
-        DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result, "Failed to deserialize EC public key to EC point: ");
-        goto fail_oct2point;
-    }
-
-    eckey = EC_KEY_new();
-    if (!eckey) {
-        result = DDS_SECURITY_VALIDATION_FAILED;
-        DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result, "Failed to allocate EC KEY: ");
-        goto fail_alloc_eckey;
-    }
-
-    if (EC_KEY_set_group(eckey, group) != 1) {
-        result = DDS_SECURITY_VALIDATION_FAILED;
-        DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result, "Failed to convert octet sequence to ASN1 integer: ");
-        goto fail_eckey_set_group;
-    }
-
-    if (EC_KEY_set_public_key(eckey, point) != 1) {
-        result = DDS_SECURITY_VALIDATION_FAILED;
-        DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result, "Failed to set EC public key: ");
-        goto fail_eckey_set_pubkey;
-    }
-
-    *pkey = EVP_PKEY_new();
-    if (!(*pkey)) {
-        result = DDS_SECURITY_VALIDATION_FAILED;
-        DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result, "Failed to allocate EVP key: ");
-        goto fail_alloc_pkey;
-    }
-
-    if (EVP_PKEY_set1_EC_KEY(*pkey, eckey) != 1) {
-        result = DDS_SECURITY_VALIDATION_FAILED;
-        DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result, "Failed to set EVP key to EC public key: ");
-        goto fail_pkey_set_eckey;
-    }
-
-    EC_KEY_free(eckey);
-    EC_POINT_free(point);
-    EC_GROUP_free(group);
-
-    return result;
+  EC_KEY *eckey;
+  EC_GROUP *group;
+  EC_POINT *point;
+  if (!(group = EC_GROUP_new_by_curve_name(NID_X9_62_prime256v1)))
+  {
+    DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "Failed to allocate EC group: ");
+    goto fail_alloc_group;
+  }
+  if (!(point = EC_POINT_new(group)))
+  {
+    DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "Failed to allocate EC point: ");
+    goto fail_alloc_point;
+  }
+  if (EC_POINT_oct2point(group, point, keystr, size, NULL) != 1)
+  {
+    DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "Failed to deserialize EC public key to EC point: ");
+    goto fail_oct2point;
+  }
+  if (!(eckey = EC_KEY_new()))
+  {
+    DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "Failed to allocate EC KEY: ");
+    goto fail_alloc_eckey;
+  }
+  if (EC_KEY_set_group(eckey, group) != 1)
+  {
+    DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "Failed to set EC group: ");
+    goto fail_eckey_set;
+  }
+  if (EC_KEY_set_public_key(eckey, point) != 1)
+  {
+    DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "Failed to set EC public key: ");
+    goto fail_eckey_set;
+  }
+  if (!(*pkey = EVP_PKEY_new()))
+  {
+    DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "Failed to allocate EVP key: ");
+    goto fail_alloc_pkey;
+  }
+  if (EVP_PKEY_set1_EC_KEY(*pkey, eckey) != 1)
+  {
+    DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "Failed to set EVP key to EC public key: ");
+    goto fail_pkey_set_eckey;
+  }
+  EC_KEY_free(eckey);
+  EC_POINT_free(point);
+  EC_GROUP_free(group);
+  return DDS_SECURITY_VALIDATION_OK;
 
 fail_pkey_set_eckey:
-    EVP_PKEY_free(*pkey);
+  EVP_PKEY_free(*pkey);
 fail_alloc_pkey:
-fail_eckey_set_pubkey:
-fail_eckey_set_group:
-    EC_KEY_free(eckey);
+fail_eckey_set:
+  EC_KEY_free(eckey);
 fail_alloc_eckey:
 fail_oct2point:
-    EC_POINT_free(point);
+  EC_POINT_free(point);
 fail_alloc_point:
-    EC_GROUP_free(group);
+  EC_GROUP_free(group);
 fail_alloc_group:
-    return result;
+  return DDS_SECURITY_VALIDATION_FAILED;
 }
 
-DDS_Security_ValidationResult_t
-dh_oct_to_public_key(
-    EVP_PKEY **data,
-    AuthenticationAlgoKind_t algo,
-    const unsigned char *str,
-    uint32_t size,
-    DDS_Security_SecurityException *ex)
+DDS_Security_ValidationResult_t dh_oct_to_public_key(EVP_PKEY **data, AuthenticationAlgoKind_t algo, const unsigned char *str, uint32_t size, DDS_Security_SecurityException *ex)
 {
-    DDS_Security_ValidationResult_t result = DDS_SECURITY_VALIDATION_OK;
-
-    assert(data);
-    assert(str);
-
-    switch (algo) {
-    case AUTH_ALGO_KIND_RSA_2048:
-        result = dh_oct_to_public_key_modp(data, str, size, ex);
-        break;
-    case AUTH_ALGO_KIND_EC_PRIME256V1:
-        result = dh_oct_to_public_key_ecdh(data, str, size, ex);
-        break;
-    default:
-        assert(0);
-        result = DDS_SECURITY_VALIDATION_FAILED;
-        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result, "Invalid key algorithm specified");
-        break;
-    }
-
-    return result;
+  assert(data);
+  assert(str);
+  switch (algo)
+  {
+  case AUTH_ALGO_KIND_RSA_2048:
+    return dh_oct_to_public_key_modp(data, str, size, ex);
+  case AUTH_ALGO_KIND_EC_PRIME256V1:
+    return dh_oct_to_public_key_ecdh(data, str, size, ex);
+  default:
+    assert(0);
+    DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "Invalid key algorithm specified");
+    return DDS_SECURITY_VALIDATION_FAILED;
+  }
 }
 
-/*
- * Allocates and return a NULL terminated string from given char array with the given size.
- */
-char *
-string_from_data(
-    const unsigned char *data,
-    uint32_t size)
+char *string_from_data(const unsigned char *data, uint32_t size)
 {
-    char *str = NULL;
-
-    if (size > 0 && data) {
-        str = ddsrt_malloc(size+1);
-        memcpy(str, data, size);
-        str[size] = '\0';
-    }
-
-    return str;
+  char *str = NULL;
+  if (size > 0 && data)
+  {
+    str = ddsrt_malloc(size + 1);
+    memcpy(str, data, size);
+    str[size] = '\0';
+  }
+  return str;
 }
 
-void
-free_ca_list_contents( X509Seq *ca_list)
+void free_ca_list_contents(X509Seq *ca_list)
 {
-    unsigned i;
-    if( ca_list->buffer != NULL && ca_list->length > 0){
-        for (i = 0; i < ca_list->length; ++i) {
-            X509_free(ca_list->buffer[i]);
-        }
-        ddsrt_free ( ca_list->buffer );
-    }
-    ca_list->buffer = NULL;
-    ca_list->length = 0;
+  unsigned i;
+  if (ca_list->buffer != NULL && ca_list->length > 0)
+  {
+    for (i = 0; i < ca_list->length; ++i)
+      X509_free(ca_list->buffer[i]);
+    ddsrt_free(ca_list->buffer);
+  }
+  ca_list->buffer = NULL;
+  ca_list->length = 0;
 }
 
-DDS_Security_ValidationResult_t
-get_trusted_ca_list ( const char* trusted_ca_dir,
-                X509Seq *ca_list,
-                DDS_Security_SecurityException *ex){
-
-
-    DDS_Security_ValidationResult_t loading_result = DDS_RETCODE_OK;
-
-    dds_return_t        r;
-    ddsrt_dir_handle_t     d_descr;
-    struct ddsrt_dirent d_entry;
-    struct ddsrt_stat status;
-    char *full_file_path;
-    char *trusted_ca_dir_normalized;
-
-    X509 *ca_buffer_array[MAX_TRUSTED_CA]; /*max trusted CA size */
-    unsigned ca_buffer_array_size=0;
-    unsigned i;
-    trusted_ca_dir_normalized  = ddsrt_file_normalize(trusted_ca_dir);
-
-    r = ddsrt_opendir(trusted_ca_dir_normalized, &d_descr);
-    ddsrt_free ( trusted_ca_dir_normalized );
-    if (r == DDS_RETCODE_OK && ca_buffer_array_size < MAX_TRUSTED_CA) { /* accessable */
-        r = ddsrt_readdir(d_descr, &d_entry);
-        while (r == DDS_RETCODE_OK) {
-            ddsrt_asprintf(&full_file_path, "%s%s%s", trusted_ca_dir, ddsrt_file_sep(), d_entry.d_name);
-            if (ddsrt_stat (full_file_path, &status) == DDS_RETCODE_OK) { /* accessable */
-                if ((strcmp(d_entry.d_name, ".") != 0) &&
-                    (strcmp(d_entry.d_name, "..") != 0)) {
-                    char * filename = ddsrt_file_normalize(full_file_path);
-
-                    if(filename){
-                        X509 *identityCA;
-                        loading_result = load_X509_certificate_from_file( filename, &identityCA, ex);
-
-                        ddsrt_free(filename);
-
-                        if( loading_result == DDS_SECURITY_VALIDATION_OK ){
-                            ca_buffer_array[ca_buffer_array_size] = identityCA;
-                            ca_buffer_array_size++;
-                        } else {
-                          DDS_Security_Exception_reset(ex);
-                        }
-                    }
-                }
-            }
-            r = ddsrt_readdir(d_descr, &d_entry);
-
-            ddsrt_free(full_file_path);
-        }
-
-        ddsrt_closedir (d_descr);
-
-        /* deallocate given ca_list if it is not NULL */
-        free_ca_list_contents(ca_list);
-
-        /*copy CAs to out parameter as HASH*/
-        if( ca_buffer_array_size > 0 ){
-            ca_list->buffer = ddsrt_malloc( ca_buffer_array_size * sizeof(X509 * ) );
-            for (i = 0; i < ca_buffer_array_size; ++i) {
-                ca_list->buffer[i] = ca_buffer_array[i];
-
-            }
-
-        }
-        ca_list->length = ca_buffer_array_size;
-
-        return DDS_SECURITY_VALIDATION_OK;
-
-    }
-    else{
-        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_TRUSTED_CA_DIR_CODE, 0, DDS_SECURITY_ERR_INVALID_TRUSTED_CA_DIR_MESSAGE);
-        return DDS_SECURITY_VALIDATION_FAILED;
-    }
-
-    return loading_result;
-}
-
-DDS_Security_ValidationResult_t
-create_asymmetrical_signature(
-        EVP_PKEY *pkey,
-        const unsigned char *data,
-        const size_t dataLen,
-        unsigned char **signature,
-        size_t *signatureLen,
-        DDS_Security_SecurityException *ex)
+DDS_Security_ValidationResult_t get_trusted_ca_list(const char *trusted_ca_dir, X509Seq *ca_list, DDS_Security_SecurityException *ex)
 {
-    DDS_Security_ValidationResult_t result = DDS_SECURITY_VALIDATION_OK;
-    EVP_MD_CTX *mdctx = NULL;
-    EVP_PKEY_CTX *kctx = NULL;
+  ddsrt_dir_handle_t d_descr;
+  struct ddsrt_dirent d_entry;
+  struct ddsrt_stat status;
+  X509 *ca_buf[MAX_TRUSTED_CA];
+  unsigned ca_cnt = 0;
+  char *tca_dir_norm = ddsrt_file_normalize(trusted_ca_dir);
+  dds_return_t ret = ddsrt_opendir(tca_dir_norm, &d_descr);
+  ddsrt_free(tca_dir_norm);
+  if (ret != DDS_RETCODE_OK)
+  {
+    DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_TRUSTED_CA_DIR_CODE, 0, DDS_SECURITY_ERR_INVALID_TRUSTED_CA_DIR_MESSAGE);
+    return DDS_SECURITY_VALIDATION_FAILED;
+  }
 
-    if (!(mdctx = EVP_MD_CTX_create())) {
-        result = DDS_SECURITY_VALIDATION_FAILED;
-        DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result, "Failed to create signing context: ");
-        goto err_create_ctx;
+  char *fpath, *fname;
+  X509 *ca;
+  bool failed = false;
+  while (!failed && ddsrt_readdir(d_descr, &d_entry) == DDS_RETCODE_OK)
+  {
+    ddsrt_asprintf(&fpath, "%s%s%s", trusted_ca_dir, ddsrt_file_sep(), d_entry.d_name);
+    if (ddsrt_stat(fpath, &status) == DDS_RETCODE_OK
+      && strcmp(d_entry.d_name, ".") != 0 && strcmp(d_entry.d_name, "..") != 0
+      && (fname = ddsrt_file_normalize(fpath)) != NULL)
+    {
+      if (ca_cnt >= MAX_TRUSTED_CA)
+      {
+        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_TRUSTED_CA_DIR_MAX_EXCEEDED_CODE, 0, DDS_SECURITY_ERR_TRUSTED_CA_DIR_MAX_EXCEEDED_MESSAGE, MAX_TRUSTED_CA);
+        failed = true;
+      }
+      else if (load_X509_certificate_from_file(fname, &ca, ex) == DDS_SECURITY_VALIDATION_OK)
+        ca_buf[ca_cnt++] = ca;
+      else
+        DDS_Security_Exception_reset(ex);
+      ddsrt_free(fname);
     }
+    ddsrt_free(fpath);
+  }
+  ddsrt_closedir(d_descr);
 
-    if (EVP_DigestSignInit(mdctx, &kctx, EVP_sha256(), NULL, pkey) != 1) {
-        result = DDS_SECURITY_VALIDATION_FAILED;
-        DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result, "Failed to initialize signing context: ");
-        goto err_sign;
+  if (!failed)
+  {
+    free_ca_list_contents(ca_list);
+    if (ca_cnt > 0)
+    {
+      ca_list->buffer = ddsrt_malloc(ca_cnt * sizeof(X509 *));
+      for (unsigned i = 0; i < ca_cnt; ++i)
+        ca_list->buffer[i] = ca_buf[i];
     }
+    ca_list->length = ca_cnt;
+  }
+  return failed ? DDS_SECURITY_VALIDATION_FAILED : DDS_SECURITY_VALIDATION_OK;
+}
 
-    if (EVP_PKEY_id(pkey) == EVP_PKEY_RSA) {
-        if (EVP_PKEY_CTX_set_rsa_padding(kctx, RSA_PKCS1_PSS_PADDING) < 1) {
-            result = DDS_SECURITY_VALIDATION_FAILED;
-            DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result, "Failed to initialize signing context: ");
-            goto err_sign;
-         }
-    }
+DDS_Security_ValidationResult_t create_asymmetrical_signature(EVP_PKEY *pkey, const unsigned char *data, const size_t dataLen,
+    unsigned char **signature, size_t *signatureLen, DDS_Security_SecurityException *ex)
+{
+  EVP_MD_CTX *mdctx = NULL;
+  EVP_PKEY_CTX *kctx = NULL;
 
-    if (EVP_DigestSignUpdate(mdctx, data, dataLen) != 1) {
-        result = DDS_SECURITY_VALIDATION_FAILED;
-        DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result, "Failed to update signing context: ");
-        goto err_sign;
-    }
-
-    if (EVP_DigestSignFinal(mdctx, NULL, signatureLen) != 1) {
-        result = DDS_SECURITY_VALIDATION_FAILED;
-        DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result, "Failed to finalize signing context: ");
-        goto err_sign;
-    }
-
-    *signature = ddsrt_malloc(sizeof(unsigned char) * (*signatureLen));
-    assert(*signature != NULL);
-    if (EVP_DigestSignFinal(mdctx, *signature, signatureLen) != 1) {
-        result = DDS_SECURITY_VALIDATION_FAILED;
-        DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result, "Failed to finalize signing context: ");
-        ddsrt_free(*signature);
+  if (!(mdctx = EVP_MD_CTX_create()))
+  {
+    DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "Failed to create signing context: ");
+    goto err_create_ctx;
+  }
+  if (EVP_DigestSignInit(mdctx, &kctx, EVP_sha256(), NULL, pkey) != 1)
+  {
+    DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "Failed to initialize signing context: ");
+    goto err_sign;
+  }
+  if (EVP_PKEY_id(pkey) == EVP_PKEY_RSA)
+  {
+    if (EVP_PKEY_CTX_set_rsa_padding(kctx, RSA_PKCS1_PSS_PADDING) < 1)
+    {
+      DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "Failed to initialize signing context: ");
+      goto err_sign;
     }
+  }
+  if (EVP_DigestSignUpdate(mdctx, data, dataLen) != 1)
+  {
+    DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "Failed to update signing context: ");
+    goto err_sign;
+  }
+  if (EVP_DigestSignFinal(mdctx, NULL, signatureLen) != 1)
+  {
+    DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "Failed to finalize signing context: ");
+    goto err_sign;
+  }
+  *signature = ddsrt_malloc(sizeof(unsigned char) * (*signatureLen));
+  if (EVP_DigestSignFinal(mdctx, *signature, signatureLen) != 1)
+  {
+    DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "Failed to finalize signing context: ");
+    ddsrt_free(*signature);
+    goto err_sign;
+  }
+  EVP_MD_CTX_destroy(mdctx);
+  return DDS_SECURITY_VALIDATION_OK;
 
 err_sign:
-    EVP_MD_CTX_destroy(mdctx);
+  EVP_MD_CTX_destroy(mdctx);
 err_create_ctx:
-    return result;
+  return DDS_SECURITY_VALIDATION_FAILED;
 }
 
-DDS_Security_ValidationResult_t
-validate_asymmetrical_signature(
-        EVP_PKEY *pkey,
-        const unsigned char *data,
-        const size_t dataLen,
-        const unsigned char *signature,
-        const size_t signatureLen,
-        DDS_Security_SecurityException *ex)
+DDS_Security_ValidationResult_t validate_asymmetrical_signature(EVP_PKEY *pkey, const unsigned char *data, const size_t dataLen,
+    const unsigned char *signature, const size_t signatureLen, DDS_Security_SecurityException *ex)
 {
-    DDS_Security_ValidationResult_t result = DDS_SECURITY_VALIDATION_OK;
-    EVP_MD_CTX *mdctx = NULL;
-    EVP_PKEY_CTX *kctx = NULL;
-
-    if (!(mdctx = EVP_MD_CTX_create())) {
-        result = DDS_SECURITY_VALIDATION_FAILED;
-        DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result, "Failed to create verify context: ");
-        goto err_create_ctx;
-    }
-
-    if (EVP_DigestVerifyInit(mdctx, &kctx, EVP_sha256(), NULL, pkey) != 1) {
-        result = DDS_SECURITY_VALIDATION_FAILED;
-        DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result, "Failed to initialize verify context: ");
-        goto err_verify;
-    }
-
-    if (EVP_PKEY_id(pkey) == EVP_PKEY_RSA) {
-        if (EVP_PKEY_CTX_set_rsa_padding(kctx, RSA_PKCS1_PSS_PADDING) < 1) {
-            result = DDS_SECURITY_VALIDATION_FAILED;
-            DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result, "Failed to initialize signing context: ");
-            goto err_verify;
-        }
-    }
-
-    if (EVP_DigestVerifyUpdate(mdctx, data, dataLen) != 1) {
-        result = DDS_SECURITY_VALIDATION_FAILED;
-        DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result, "Failed to update verify context: ");
-        goto err_verify;
-    }
-
-    if (EVP_DigestVerifyFinal(mdctx, signature, signatureLen) != 1) {
-        result = DDS_SECURITY_VALIDATION_FAILED;
-        DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result, "Failed to finalize verify context: ");
-        goto err_verify;
+  EVP_MD_CTX *mdctx = NULL;
+  EVP_PKEY_CTX *kctx = NULL;
+  if (!(mdctx = EVP_MD_CTX_create()))
+  {
+    DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "Failed to create verify context: ");
+    goto err_create_ctx;
+  }
+  if (EVP_DigestVerifyInit(mdctx, &kctx, EVP_sha256(), NULL, pkey) != 1)
+  {
+    DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "Failed to initialize verify context: ");
+    goto err_verify;
+  }
+  if (EVP_PKEY_id(pkey) == EVP_PKEY_RSA)
+  {
+    if (EVP_PKEY_CTX_set_rsa_padding(kctx, RSA_PKCS1_PSS_PADDING) < 1)
+    {
+      DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "Failed to initialize signing context: ");
+      goto err_verify;
     }
+  }
+  if (EVP_DigestVerifyUpdate(mdctx, data, dataLen) != 1)
+  {
+    DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "Failed to update verify context: ");
+    goto err_verify;
+  }
+  if (EVP_DigestVerifyFinal(mdctx, signature, signatureLen) != 1)
+  {
+    DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "Failed to finalize verify context: ");
+    goto err_verify;
+  }
+  EVP_MD_CTX_destroy(mdctx);
+  return DDS_SECURITY_VALIDATION_OK;
 
 err_verify:
-    EVP_MD_CTX_destroy(mdctx);
+  EVP_MD_CTX_destroy(mdctx);
 err_create_ctx:
-    return result;
+  return DDS_SECURITY_VALIDATION_FAILED;
 }
diff --git a/src/security/builtin_plugins/authentication/src/auth_utils.h b/src/security/builtin_plugins/authentication/src/auth_utils.h
index b08df38..bbde1ba 100644
--- a/src/security/builtin_plugins/authentication/src/auth_utils.h
+++ b/src/security/builtin_plugins/authentication/src/auth_utils.h
@@ -42,34 +42,21 @@ typedef struct {
 } X509Seq;
 
 typedef unsigned char HashValue_t[SHA256_DIGEST_LENGTH];
-/*typedef struct HashValue {
-    unsigned char value[SHA256_DIGEST_LENGTH];
-} HashValue_t;
-*/
 
 /* Return a string that contains an openssl error description
  * When a openssl function returns an error this function can be
  * used to retrieve a descriptive error string.
  * Note that the returned string should be freed.
  */
-char *
-get_openssl_error_message(
-        void);
+char * get_openssl_error_message(void);
 
 /* Return the subject name of contained in a X509 certificate
  * Note that the returned string should be freed.
  */
-char*
-get_certificate_subject_name(
-        X509 *cert,
-        DDS_Security_SecurityException *ex);
+char * get_certificate_subject_name(X509 *cert, DDS_Security_SecurityException *ex);
 
-/* Return the expiry date of contained in a X509 certificate
- *
- */
-dds_time_t
-get_certificate_expiry(
-    const X509 *cert);
+/* Return the expiry date of contained in a X509 certificate */
+dds_time_t get_certificate_expiry(const X509 *cert);
 
 /* Return the subject name of a X509 certificate DER
  * encoded. The DER encoded subject name is returned in
@@ -78,63 +65,19 @@ get_certificate_expiry(
  *
  * return length of allocated buffer or -1 on error
  */
-DDS_Security_ValidationResult_t
-get_subject_name_DER_encoded(
-        const X509 *cert,
-        unsigned char **buffer,
-        size_t *size,
-        DDS_Security_SecurityException *ex);
+DDS_Security_ValidationResult_t get_subject_name_DER_encoded(const X509 *cert, unsigned char **buffer, size_t *size, DDS_Security_SecurityException *ex);
 
+/* Load a X509 certificate for the provided data (PEM format) */
+DDS_Security_ValidationResult_t load_X509_certificate_from_data(const char *data, int len, X509 **x509Cert, DDS_Security_SecurityException *ex);
 
-/* Load a X509 certificate for the provided data.
- *
- * data     : certificate in PEM format
- * x509Cert : the openssl X509 return value
- */
-DDS_Security_ValidationResult_t
-load_X509_certificate_from_data(
-        const char *data,
-        int len,
-        X509 **x509Cert,
-        DDS_Security_SecurityException *ex);
+/* Load a X509 certificate for the provided data (certificate uri) */
+DDS_Security_ValidationResult_t load_X509_certificate(const char *data, X509 **x509Cert, DDS_Security_SecurityException *ex);
 
+/* Load a X509 certificate for the provided file */
+DDS_Security_ValidationResult_t load_X509_certificate_from_file(const char *filename, X509 **x509Cert, DDS_Security_SecurityException *ex);
 
-/* Load a X509 certificate for the provided data.
- *
- * data     : URI of the certificate. URI format is defined in DDS Security spec 9.3.1
-
- * x509Cert : the openssl X509 return value
- */
-DDS_Security_ValidationResult_t
-load_X509_certificate(
-        const char *data,
-        X509 **x509Cert,
-        DDS_Security_SecurityException *ex);
-
-
-/* Load a X509 certificate for the provided file.
- *
- * filename : path of the file that contains PEM formatted certificate
- * x509Cert : the openssl X509 return value
- */
-DDS_Security_ValidationResult_t
-load_X509_certificate_from_file(
-        const char *filename,
-        X509 **x509Cert,
-        DDS_Security_SecurityException *ex);
-
-/* Load a Private Key for the provided data.
- *
- * data       : URI of the private key. URI format is defined in DDS Security spec 9.3.1
- * privateKey : the openssl EVP_PKEY return value
- */
-DDS_Security_ValidationResult_t
-load_X509_private_key(
-        const char *data,
-        const char *password,
-        EVP_PKEY **privateKey,
-        DDS_Security_SecurityException *ex);
-
+/* Load a Private Key for the provided data (private key uri) */
+DDS_Security_ValidationResult_t load_X509_private_key(const char *data, const char *password, EVP_PKEY **privateKey, DDS_Security_SecurityException *ex);
 
 /* Validate an identity certificate against the identityCA
  * The provided identity certificate is checked if it is
@@ -144,95 +87,20 @@ load_X509_private_key(
  *       The function does not yet check a CLR or ocsp
  *       for expiry of identity certificate.
  */
-DDS_Security_ValidationResult_t
-verify_certificate(
-        X509 *identityCert,
-        X509 *identityCa,
-        DDS_Security_SecurityException *ex);
+DDS_Security_ValidationResult_t verify_certificate(X509 *identityCert, X509 *identityCa, DDS_Security_SecurityException *ex);
 
-DDS_Security_ValidationResult_t
-check_certificate_expiry(
-    const X509 *cert,
-    DDS_Security_SecurityException *ex);
-
-AuthenticationAlgoKind_t
-get_auhentication_algo_kind(
-        X509 *cert);
-
-AuthenticationChallenge *
-generate_challenge(
-        DDS_Security_SecurityException *ex);
-
-DDS_Security_ValidationResult_t
-get_certificate_contents(
-        X509 *cert,
-        unsigned char **data,
-        uint32_t *size,
-        DDS_Security_SecurityException *ex);
-
-DDS_Security_ValidationResult_t
-generate_dh_keys(
-    EVP_PKEY **dhkey,
-    AuthenticationAlgoKind_t authKind,
-    DDS_Security_SecurityException *ex);
-
-DDS_Security_ValidationResult_t
-dh_public_key_to_oct(
-    EVP_PKEY *pkey,
-    AuthenticationAlgoKind_t algo,
-    unsigned char **buffer,
-    uint32_t *length,
-    DDS_Security_SecurityException *ex);
-
-DDS_Security_ValidationResult_t
-dh_oct_to_public_key(
-    EVP_PKEY **data,
-    AuthenticationAlgoKind_t algo,
-    const unsigned char *str,
-    uint32_t size,
-    DDS_Security_SecurityException *ex);
-
-
-AuthConfItemPrefix_t
-get_conf_item_type(
-        const char *str,
-        char **data);
-
-/*
- * Frees the contents of theCA list.
- */
-void
-free_ca_list_contents(
-     X509Seq *ca_list);
-
-DDS_Security_ValidationResult_t
-get_trusted_ca_list (
-    const char* trusted_ca_dir,
-    X509Seq *ca_list,
-    DDS_Security_SecurityException *ex);
-
-char *
-string_from_data(
-    const unsigned char *data,
-    uint32_t size);
-
-
-DDS_Security_ValidationResult_t
-create_asymmetrical_signature(
-        EVP_PKEY *pkey,
-        const unsigned char *data,
-        const size_t dataLen,
-        unsigned char **signature,
-        size_t *signatureLen,
-        DDS_Security_SecurityException *ex);
-
-DDS_Security_ValidationResult_t
-validate_asymmetrical_signature(
-        EVP_PKEY *pkey,
-        const unsigned char *data,
-        const size_t dataLen,
-        const unsigned char *signature,
-        const size_t signatureLen,
-        DDS_Security_SecurityException *ex);
+DDS_Security_ValidationResult_t check_certificate_expiry(const X509 *cert, DDS_Security_SecurityException *ex);
+AuthenticationAlgoKind_t get_authentication_algo_kind(X509 *cert);
+AuthenticationChallenge *generate_challenge(DDS_Security_SecurityException *ex);
+DDS_Security_ValidationResult_t get_certificate_contents(X509 *cert, unsigned char **data, uint32_t *size, DDS_Security_SecurityException *ex);
+DDS_Security_ValidationResult_t generate_dh_keys(EVP_PKEY **dhkey, AuthenticationAlgoKind_t authKind, DDS_Security_SecurityException *ex);
+DDS_Security_ValidationResult_t dh_public_key_to_oct(EVP_PKEY *pkey, AuthenticationAlgoKind_t algo, unsigned char **buffer, uint32_t *length, DDS_Security_SecurityException *ex);
+DDS_Security_ValidationResult_t dh_oct_to_public_key(EVP_PKEY **data, AuthenticationAlgoKind_t algo, const unsigned char *str, uint32_t size, DDS_Security_SecurityException *ex);
+AuthConfItemPrefix_t get_conf_item_type(const char *str, char **data);
+void free_ca_list_contents(X509Seq *ca_list);
+DDS_Security_ValidationResult_t get_trusted_ca_list(const char* trusted_ca_dir, X509Seq *ca_list, DDS_Security_SecurityException *ex);
+char * string_from_data(const unsigned char *data, uint32_t size);
+DDS_Security_ValidationResult_t create_asymmetrical_signature(EVP_PKEY *pkey, const unsigned char *data, const size_t dataLen, unsigned char **signature, size_t *signatureLen, DDS_Security_SecurityException *ex);
+DDS_Security_ValidationResult_t validate_asymmetrical_signature(EVP_PKEY *pkey, const unsigned char *data, const size_t dataLen, const unsigned char *signature, const size_t signatureLen, DDS_Security_SecurityException *ex);
 
 #endif /* AUTH_UTILS_H */
diff --git a/src/security/builtin_plugins/authentication/src/authentication.c b/src/security/builtin_plugins/authentication/src/authentication.c
index 4d317d7..79f03bd 100644
--- a/src/security/builtin_plugins/authentication/src/authentication.c
+++ b/src/security/builtin_plugins/authentication/src/authentication.c
@@ -10,7 +10,9 @@
  * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
  */
 
-
+#include <assert.h>
+#include <stdbool.h>
+#include <string.h>
 #include <openssl/bn.h>
 #include <openssl/asn1.h>
 #include <openssl/x509.h>
@@ -19,12 +21,6 @@
 #include <openssl/bio.h>
 #include <openssl/err.h>
 #include <openssl/evp.h>
-#include "authentication.h"
-#include "dds/ddsrt/heap.h"
-#include "dds/security/dds_security_api.h"
-#include "dds/security/core/dds_security_timed_cb.h"
-#include "dds/security/core/dds_security_utils.h"
-
 #if OPENSLL_VERSION_NUMBER >= 0x10002000L
 #define AUTH_INCLUDE_EC
 #include <openssl/ec.h>
@@ -40,431 +36,356 @@
 #undef X509_NAME
 #endif
 
-#include "dds/security/dds_security_api.h"
-#include "dds/security/dds_security_api_types.h"
+#include "dds/ddsrt/heap.h"
 #include "dds/ddsrt/atomics.h"
-#include "stdbool.h"
-#include <string.h>
 #include "dds/ddsrt/string.h"
 #include "dds/ddsrt/sync.h"
 #include "dds/ddsrt/hopscotch.h"
-
+#include "dds/security/dds_security_api.h"
+#include "dds/security/core/dds_security_timed_cb.h"
+#include "dds/security/core/dds_security_utils.h"
+#include "dds/security/dds_security_api.h"
+#include "dds/security/dds_security_api_types.h"
 #include "dds/security/core/shared_secret.h"
 #include "dds/security/core/dds_security_utils.h"
 #include "dds/security/core/dds_security_serialize.h"
 #include "auth_utils.h"
-#include <assert.h>
+#include "authentication.h"
 
 #ifndef EVP_PKEY_id
 #define EVP_PKEY_id(k) ((k)->type)
 #endif
 
 #if OPENSSL_VERSION_NUMBER >= 0x10000000L && OPENSSL_VERSION_NUMBER < 0x10100000L
-#define REMOVE_THREAD_STATE()     ERR_remove_thread_state(NULL);
+#define REMOVE_THREAD_STATE() ERR_remove_thread_state(NULL);
 #elif OPENSSL_VERSION_NUMBER < 0x10000000L
-#define REMOVE_THREAD_STATE()     ERR_remove_state(0);
+#define REMOVE_THREAD_STATE() ERR_remove_state(0);
 #else
 #define REMOVE_THREAD_STATE()
 #endif
 
-
 #define HANDSHAKE_SIGNATURE_CONTENT_SIZE 6
+#define ADJUSTED_GUID_PREFIX_FLAG 0x80
 
-static const char * AUTH_PROTOCOL_CLASS                 = "DDS:Auth:PKI-DH";
-static const unsigned AUTH_PROTOCOL_VERSION_MAJOR       = 1;
-static const unsigned AUTH_PROTOCOL_VERSION_MINOR       = 0;
+static const char *AUTH_PROTOCOL_CLASS = "DDS:Auth:PKI-DH";
+static const unsigned AUTH_PROTOCOL_VERSION_MAJOR = 1;
+static const unsigned AUTH_PROTOCOL_VERSION_MINOR = 0;
 
-static const char * AUTH_REQUEST_TOKEN_CLASS_ID         = "DDS:Auth:PKI-DH:1.0+AuthReq";
-static const char * AUTH_REQUEST_TOKEN_FUTURE_PROP_NAME = "future_challenge";
+static const char *AUTH_REQUEST_TOKEN_CLASS_ID = "DDS:Auth:PKI-DH:1.0+AuthReq";
+static const char *AUTH_REQUEST_TOKEN_FUTURE_PROP_NAME = "future_challenge";
 
-static const char * PROPERTY_IDENTITY_CA                = "dds.sec.auth.identity_ca";
-static const char * PROPERTY_PRIVATE_KEY                = "dds.sec.auth.private_key";
-static const char * PROPERTY_PASSWORD                   = "dds.sec.auth.password";
-static const char * PROPERTY_IDENTITY_CERT              = "dds.sec.auth.identity_certificate";
-static const char * PROPERTY_TRUSTED_CA_DIR             = "dds.sec.auth.trusted_ca_dir";
+static const char *PROPERTY_IDENTITY_CA = "dds.sec.auth.identity_ca";
+static const char *PROPERTY_PRIVATE_KEY = "dds.sec.auth.private_key";
+static const char *PROPERTY_PASSWORD = "dds.sec.auth.password";
+static const char *PROPERTY_IDENTITY_CERT = "dds.sec.auth.identity_certificate";
+static const char *PROPERTY_TRUSTED_CA_DIR = "dds.sec.auth.trusted_ca_dir";
 
-static const char * PROPERTY_CERT_SUBJECT_NAME          = "dds.cert.sn";
-static const char * PROPERTY_CERT_ALGORITHM             = "dds.cert.algo";
-static const char * PROPERTY_CA_SUBJECT_NAME            = "dds.ca.sn";
-static const char * PROPERTY_CA_ALGORITHM               = "dds.ca.aglo";
+static const char *PROPERTY_CERT_SUBJECT_NAME = "dds.cert.sn";
+static const char *PROPERTY_CERT_ALGORITHM = "dds.cert.algo";
+static const char *PROPERTY_CA_SUBJECT_NAME = "dds.ca.sn";
+static const char *PROPERTY_CA_ALGORITHM = "dds.ca.aglo";
 
-static const char * AUTH_HANDSHAKE_REQUEST_TOKEN_ID     = "DDS:Auth:PKI-DH:1.0+Req";
-static const char * AUTH_HANDSHAKE_REPLY_TOKEN_ID       = "DDS:Auth:PKI-DH:1.0+Reply";
+static const char *AUTH_HANDSHAKE_REQUEST_TOKEN_ID = "DDS:Auth:PKI-DH:1.0+Req";
+static const char *AUTH_HANDSHAKE_REPLY_TOKEN_ID = "DDS:Auth:PKI-DH:1.0+Reply";
 
-static const char * AUTH_HANDSHAKE_FINAL_TOKEN_ID       = "DDS:Auth:PKI-DH:1.0+Final";
+static const char *AUTH_HANDSHAKE_FINAL_TOKEN_ID = "DDS:Auth:PKI-DH:1.0+Final";
 
-static const char * AUTH_DSIG_ALGO_RSA_2048_SHA256_IDENT   = "RSASSA-PSS-SHA256";
-static const char * AUTH_DSIG_ALGO_ECDSA_SHA256_IDENT      = "ECDSA-SHA256";
-static const char * AUTH_KAGREE_ALGO_RSA_2048_SHA256_IDENT = "DH+MODP-2048-256";
-static const char * AUTH_KAGREE_ALGO_ECDH_PRIME256V1_IDENT = "ECDH+prime256v1-CEUM";
+static const char *AUTH_DSIG_ALGO_RSA_2048_SHA256_IDENT = "RSASSA-PSS-SHA256";
+static const char *AUTH_DSIG_ALGO_ECDSA_SHA256_IDENT = "ECDSA-SHA256";
+static const char *AUTH_KAGREE_ALGO_RSA_2048_SHA256_IDENT = "DH+MODP-2048-256";
+static const char *AUTH_KAGREE_ALGO_ECDH_PRIME256V1_IDENT = "ECDH+prime256v1-CEUM";
 
+static const char *ACCESS_PERMISSIONS_CREDENTIAL_TOKEN_ID = "DDS:Access:PermissionsCredential";
+static const char *ACCESS_PROPERTY_PERMISSION_DOCUMENT = "dds.perm.cert";
 
-static const char * ACCESS_PERMISSIONS_CREDENTIAL_TOKEN_ID = "DDS:Access:PermissionsCredential";
-static const char * ACCESS_PROPERTY_PERMISSION_DOCUMENT    = "dds.perm.cert";
-
-
-/**
- * Implementation structure for storing encapsulated members of the instance
- * while giving only the interface definition to user
- */
-
-typedef enum {
-    SECURITY_OBJECT_KIND_UNKNOWN,
-    SECURITY_OBJECT_KIND_LOCAL_IDENTITY,
-    SECURITY_OBJECT_KIND_REMOTE_IDENTITY,
-    SECURITY_OBJECT_KIND_IDENTITY_RELATION,
-    SECURITY_OBJECT_KIND_HANDSHAKE
+typedef enum
+{
+  SECURITY_OBJECT_KIND_UNKNOWN,
+  SECURITY_OBJECT_KIND_LOCAL_IDENTITY,
+  SECURITY_OBJECT_KIND_REMOTE_IDENTITY,
+  SECURITY_OBJECT_KIND_IDENTITY_RELATION,
+  SECURITY_OBJECT_KIND_HANDSHAKE
 } SecurityObjectKind_t;
 
-typedef enum {
+typedef enum
+{
   CREATEDREQUEST,
   CREATEDREPLY
-
 } CreatedHandshakeStep_t;
 
 typedef struct SecurityObject SecurityObject;
-
 typedef void (*SecurityObjectDestructor)(SecurityObject *obj);
 
-struct SecurityObject {
-    int64_t handle;
-    SecurityObjectKind_t kind;
-    SecurityObjectDestructor destructor;
+struct SecurityObject
+{
+  int64_t handle;
+  SecurityObjectKind_t kind;
+  SecurityObjectDestructor destructor;
 };
 
-
 #ifndef NDEBUG
-#define CHECK_OBJECT_KIND(o,k) assert(security_object_valid((SecurityObject *)(o), k))
+#define CHECK_OBJECT_KIND(o, k) assert(security_object_valid((SecurityObject *)(o), k))
 #else
-#define CHECK_OBJECT_KIND(o,k)
+#define CHECK_OBJECT_KIND(o, k)
 #endif
 
-#define SECURITY_OBJECT(o)            ((SecurityObject *)(o))
-#define SECURITY_OBJECT_HANDLE(o)     (SECURITY_OBJECT(o)->handle)
-#define IDENTITY_HANDLE(o)            ((DDS_Security_IdentityHandle) SECURITY_OBJECT_HANDLE(o))
-#define HANDSHAKE_HANDLE(o)           ((DDS_Security_HandshakeHandle) SECURITY_OBJECT_HANDLE(o))
+#define SECURITY_OBJECT(o) ((SecurityObject *)(o))
+#define SECURITY_OBJECT_HANDLE(o) (SECURITY_OBJECT(o)->handle)
+#define IDENTITY_HANDLE(o) ((DDS_Security_IdentityHandle)SECURITY_OBJECT_HANDLE(o))
+#define HANDSHAKE_HANDLE(o) ((DDS_Security_HandshakeHandle)SECURITY_OBJECT_HANDLE(o))
 
-#define SECURITY_OBJECT_VALID(o,k)    security_object_valid((SecurityObject *)(o), k)
+#define SECURITY_OBJECT_VALID(o, k) security_object_valid((SecurityObject *)(o), k)
 
-
-typedef struct LocalIdentityInfo {
-    SecurityObject _parent;
-    DDS_Security_DomainId domainId;
-    DDS_Security_GUID_t candidateGUID;
-    DDS_Security_GUID_t adjustedGUID;
-    X509 *identityCert;
-    X509 *identityCA;
-    EVP_PKEY *privateKey;
-    DDS_Security_OctetSeq pdata;
-    AuthenticationAlgoKind_t dsignAlgoKind;
-    AuthenticationAlgoKind_t kagreeAlgoKind;
-    char *permissionsDocument;
+typedef struct LocalIdentityInfo
+{
+  SecurityObject _parent;
+  DDS_Security_DomainId domainId;
+  DDS_Security_GUID_t candidateGUID;
+  DDS_Security_GUID_t adjustedGUID;
+  X509 *identityCert;
+  X509 *identityCA;
+  EVP_PKEY *privateKey;
+  DDS_Security_OctetSeq pdata;
+  AuthenticationAlgoKind_t dsignAlgoKind;
+  AuthenticationAlgoKind_t kagreeAlgoKind;
+  char *permissionsDocument;
 } LocalIdentityInfo;
 
-typedef struct RemoteIdentityInfo {
-    SecurityObject _parent;
-    DDS_Security_GUID_t guid;
-    X509 *identityCert;
-    AuthenticationAlgoKind_t dsignAlgoKind;
-    AuthenticationAlgoKind_t kagreeAlgoKind;
-    DDS_Security_IdentityToken *remoteIdentityToken;
-    DDS_Security_OctetSeq pdata;
-    char *permissionsDocument;
-    struct ddsrt_hh *linkHash; /* contains the IdentityRelation objects */
+typedef struct RemoteIdentityInfo
+{
+  SecurityObject _parent;
+  DDS_Security_GUID_t guid;
+  X509 *identityCert;
+  AuthenticationAlgoKind_t dsignAlgoKind;
+  AuthenticationAlgoKind_t kagreeAlgoKind;
+  DDS_Security_IdentityToken *remoteIdentityToken;
+  DDS_Security_OctetSeq pdata;
+  char *permissionsDocument;
+  struct ddsrt_hh *linkHash; /* contains the IdentityRelation objects */
 } RemoteIdentityInfo;
 
-
 /* This structure contains the relation between a local and a remote identity
  * The handle for this object is the same as the handle of the associated
  * local identity object. The IdentityRelation object will be stored with the
  * remote identity.
  */
-typedef struct IdentityRelation {
-    SecurityObject _parent;
-    LocalIdentityInfo *localIdentity;
-    RemoteIdentityInfo *remoteIdentity;
-    AuthenticationChallenge *lchallenge;
-    AuthenticationChallenge *rchallenge;
+typedef struct IdentityRelation
+{
+  SecurityObject _parent;
+  LocalIdentityInfo *localIdentity;
+  RemoteIdentityInfo *remoteIdentity;
+  AuthenticationChallenge *lchallenge;
+  AuthenticationChallenge *rchallenge;
 } IdentityRelation;
 
-typedef struct HandshakeInfo {
-    SecurityObject _parent;
-    IdentityRelation *relation;
-    HashValue_t hash_c1;
-    HashValue_t hash_c2;
-    EVP_PKEY *ldh;
-    EVP_PKEY *rdh;
-    DDS_Security_SharedSecretHandleImpl *shared_secret_handle_impl;
-    CreatedHandshakeStep_t created_in;
+typedef struct HandshakeInfo
+{
+  SecurityObject _parent;
+  IdentityRelation *relation;
+  HashValue_t hash_c1;
+  HashValue_t hash_c2;
+  EVP_PKEY *ldh;
+  EVP_PKEY *rdh;
+  DDS_Security_SharedSecretHandleImpl *shared_secret_handle_impl;
+  CreatedHandshakeStep_t created_in;
 } HandshakeInfo;
 
-typedef struct dds_security_authentication_impl {
-    dds_security_authentication base;
-    ddsrt_mutex_t lock;
-    struct ddsrt_hh *objectHash;
-    struct ddsrt_hh *remoteGuidHash;
-    struct dds_security_timed_cb_data *timed_callbacks;
-    struct dds_security_timed_dispatcher_t *dispatcher;
-    X509Seq trustedCAList;
+typedef struct dds_security_authentication_impl
+{
+  dds_security_authentication base;
+  ddsrt_mutex_t lock;
+  struct ddsrt_hh *objectHash;
+  struct ddsrt_hh *remoteGuidHash;
+  struct dds_security_timed_cb_data *timed_callbacks;
+  struct dds_security_timed_dispatcher_t *dispatcher;
+  X509Seq trustedCAList;
 } dds_security_authentication_impl;
 
 /* data type for timer dispatcher */
-typedef struct {
-    dds_security_authentication_impl *auth;
-    DDS_Security_IdentityHandle hdl;
+typedef struct
+{
+  dds_security_authentication_impl *auth;
+  DDS_Security_IdentityHandle hdl;
 } validity_cb_info;
 
-
-static bool
-security_object_valid(
-    SecurityObject *obj,
-    SecurityObjectKind_t kind)
+static bool security_object_valid(SecurityObject *obj, SecurityObjectKind_t kind)
 {
-    if (!obj) return false;
-    if (obj->kind != kind) return false;
-    if (kind == SECURITY_OBJECT_KIND_IDENTITY_RELATION) {
-        IdentityRelation *relation = (IdentityRelation *)obj;
-        if (!relation->localIdentity || !relation->remoteIdentity || (ddsrt_address)obj->handle != (ddsrt_address)relation->localIdentity) {
-            return false;
-        }
-    } else if ((ddsrt_address)obj->handle != (ddsrt_address)obj) {
-        return false;
-    }
-    return true;
+  if (!obj || obj->kind != kind)
+    return false;
+  if (kind == SECURITY_OBJECT_KIND_IDENTITY_RELATION)
+  {
+    IdentityRelation *relation = (IdentityRelation *)obj;
+    if (!relation->localIdentity || !relation->remoteIdentity || (ddsrt_address)obj->handle != (ddsrt_address)relation->localIdentity)
+      return false;
+  }
+  else if ((ddsrt_address)obj->handle != (ddsrt_address)obj)
+    return false;
+  return true;
 }
 
-static uint32_t
-security_object_hash (
-    const void *obj)
+static uint32_t security_object_hash(const void *obj)
 {
-    const SecurityObject *object = obj;
-#define UINT64_CONST(x, y, z) (((uint64_t) (x) * 1000000 + (y)) * 1000000 + (z))
-    const uint64_t c = UINT64_CONST (16292676, 669999, 574021);
-#undef UINT64_CONST
-    const uint32_t x = (uint32_t) object->handle;
-    return (unsigned) ((x * c) >> 32);
+  const SecurityObject *object = obj;
+  const uint64_t c = UINT64_C (16292676669999574021);
+  const uint32_t x = (uint32_t)object->handle;
+  return (uint32_t)((x * c) >> 32);
 }
 
-static int
-security_object_equal (
-    const void *ha,
-    const void *hb)
+static int security_object_equal(const void *ha, const void *hb)
 {
-    const SecurityObject *la = ha;
-    const SecurityObject *lb = hb;
-
-    return la->handle == lb->handle;
+  const SecurityObject *la = ha;
+  const SecurityObject *lb = hb;
+  return la->handle == lb->handle;
 }
 
-static SecurityObject *
-security_object_find(
-    const struct ddsrt_hh *hh,
-    int64_t handle)
+static SecurityObject *security_object_find(const struct ddsrt_hh *hh, int64_t handle)
 {
-    struct SecurityObject template;
-
-    template.handle = handle;
-
-    return (SecurityObject *) ddsrt_hh_lookup(hh, &template);;
+  struct SecurityObject template;
+  template.handle = handle;
+  return (SecurityObject *)ddsrt_hh_lookup(hh, &template);
 }
 
-static void
-security_object_init(
-    SecurityObject *obj,
-    SecurityObjectKind_t kind,
-    SecurityObjectDestructor destructor)
+static void security_object_init(SecurityObject *obj, SecurityObjectKind_t kind, SecurityObjectDestructor destructor)
 {
-    assert(obj);
-
-    obj->kind = kind;
-    obj->handle = (int64_t)(ddsrt_address)obj;
-    obj->destructor = destructor;
+  assert(obj);
+  obj->kind = kind;
+  obj->handle = (int64_t)(ddsrt_address)obj;
+  obj->destructor = destructor;
 }
 
-static void
-security_object_deinit(
-    SecurityObject *obj)
-
+static void security_object_deinit(SecurityObject *obj)
 {
-    assert(obj);
-    obj->handle = DDS_SECURITY_HANDLE_NIL;
-    obj->kind = SECURITY_OBJECT_KIND_UNKNOWN;
-    obj->destructor = NULL;
+  assert(obj);
+  obj->handle = DDS_SECURITY_HANDLE_NIL;
+  obj->kind = SECURITY_OBJECT_KIND_UNKNOWN;
+  obj->destructor = NULL;
 }
 
-static void
-security_object_free(
-    SecurityObject *obj)
+static void security_object_free(SecurityObject *obj)
 {
-    assert(obj);
-    if (obj && obj->destructor) {
-        obj->destructor(obj);
-    }
+  assert(obj);
+  if (obj && obj->destructor)
+    obj->destructor(obj);
 }
 
-static void
-localIdentityInfoFree(
-    SecurityObject *obj);
-
-
-
-static LocalIdentityInfo *
-localIdentityInfoNew(
-        DDS_Security_DomainId domainId,
-        X509 *identityCert,
-        X509 *identityCa,
-        EVP_PKEY *privateKey,
-        const DDS_Security_GUID_t *candidate_participant_guid,
-        const DDS_Security_GUID_t *adjusted_participant_guid)
+static void local_identity_info_free(SecurityObject *obj)
 {
-    LocalIdentityInfo *identity = NULL;
-
-    assert(identityCert);
-    assert(identityCa);
-    assert(privateKey);
-    assert(candidate_participant_guid);
-    assert(adjusted_participant_guid);
-    assert(sizeof(DDS_Security_IdentityHandle) == 8);
-
-    identity = ddsrt_malloc(sizeof(*identity));
-    memset(identity, 0, sizeof(*identity));
-
-    security_object_init((SecurityObject *)identity, SECURITY_OBJECT_KIND_LOCAL_IDENTITY, localIdentityInfoFree);
-
-
-
-
-    identity->domainId = domainId;
-    identity->identityCert = identityCert;
-    identity->identityCA = identityCa;
-    identity->privateKey = privateKey;
-    identity->permissionsDocument = NULL;
-    identity->dsignAlgoKind = get_auhentication_algo_kind(identityCert);
-    identity->kagreeAlgoKind = AUTH_ALGO_KIND_EC_PRIME256V1;
-
-    memcpy(&identity->candidateGUID, candidate_participant_guid, sizeof(DDS_Security_GUID_t));
-    memcpy(&identity->adjustedGUID, adjusted_participant_guid, sizeof(DDS_Security_GUID_t));
-
-    return identity;
+  LocalIdentityInfo *identity = (LocalIdentityInfo *)obj;
+  CHECK_OBJECT_KIND(obj, SECURITY_OBJECT_KIND_LOCAL_IDENTITY);
+  if (identity)
+  {
+    if (identity->identityCert)
+      X509_free(identity->identityCert);
+    if (identity->identityCA)
+      X509_free(identity->identityCA);
+    if (identity->privateKey)
+      EVP_PKEY_free(identity->privateKey);
+    ddsrt_free(identity->pdata._buffer);
+    ddsrt_free(identity->permissionsDocument);
+    security_object_deinit((SecurityObject *)identity);
+    ddsrt_free(identity);
+  }
 }
 
-static void
-localIdentityInfoFree(
-    SecurityObject *obj)
+static LocalIdentityInfo *local_identity_info_new(DDS_Security_DomainId domainId, X509 *identityCert, X509 *identityCa, EVP_PKEY *privateKey, const DDS_Security_GUID_t *candidate_participant_guid, const DDS_Security_GUID_t *adjusted_participant_guid)
 {
-    LocalIdentityInfo *identity = (LocalIdentityInfo *)obj;
+  LocalIdentityInfo *identity = NULL;
+  assert(identityCert);
+  assert(identityCa);
+  assert(privateKey);
+  assert(candidate_participant_guid);
+  assert(adjusted_participant_guid);
+  assert(sizeof(DDS_Security_IdentityHandle) == 8);
 
-    CHECK_OBJECT_KIND(obj, SECURITY_OBJECT_KIND_LOCAL_IDENTITY);
+  identity = ddsrt_malloc(sizeof(*identity));
+  memset(identity, 0, sizeof(*identity));
 
-    if (identity) {
-        if (identity->identityCert) {
-            X509_free(identity->identityCert);
-        }
-        if (identity->identityCA) {
-            X509_free(identity->identityCA);
-        }
-        if (identity->privateKey) {
-            EVP_PKEY_free(identity->privateKey);
-        }
-        ddsrt_free(identity->pdata._buffer);
-        ddsrt_free(identity->permissionsDocument);
-        security_object_deinit((SecurityObject *)identity);
-        ddsrt_free(identity);
-    }
+  security_object_init((SecurityObject *)identity, SECURITY_OBJECT_KIND_LOCAL_IDENTITY, local_identity_info_free);
+
+  identity->domainId = domainId;
+  identity->identityCert = identityCert;
+  identity->identityCA = identityCa;
+  identity->privateKey = privateKey;
+  identity->permissionsDocument = NULL;
+  identity->dsignAlgoKind = get_authentication_algo_kind(identityCert);
+  identity->kagreeAlgoKind = AUTH_ALGO_KIND_EC_PRIME256V1;
+
+  memcpy(&identity->candidateGUID, candidate_participant_guid, sizeof(DDS_Security_GUID_t));
+  memcpy(&identity->adjustedGUID, adjusted_participant_guid, sizeof(DDS_Security_GUID_t));
+
+  return identity;
 }
 
-static uint32_t
-remote_guid_hash (
-        const void *obj)
+static uint32_t remote_guid_hash(const void *obj)
 {
-    const RemoteIdentityInfo *identity = obj;
-    uint32_t tmp[4];
-
-    memcpy(tmp, &identity->guid, sizeof(tmp));
-
-    return (tmp[0]^tmp[1]^tmp[2]^tmp[3]);
+  const RemoteIdentityInfo *identity = obj;
+  uint32_t tmp[4];
+  memcpy(tmp, &identity->guid, sizeof(tmp));
+  return (tmp[0] ^ tmp[1] ^ tmp[2] ^ tmp[3]);
 }
 
-static int
-remote_guid_equal (
-        const void *ha,
-        const void *hb)
+static int remote_guid_equal(const void *ha, const void *hb)
 {
-    const RemoteIdentityInfo *la = ha;
-    const RemoteIdentityInfo *lb = hb;
-
-    return memcmp(&la->guid, &lb->guid, sizeof(la->guid)) == 0;
+  const RemoteIdentityInfo *la = ha;
+  const RemoteIdentityInfo *lb = hb;
+  return memcmp(&la->guid, &lb->guid, sizeof(la->guid)) == 0;
 }
 
-static RemoteIdentityInfo *
-find_remote_identity_by_guid(
-        const struct ddsrt_hh *hh,
-        const DDS_Security_GUID_t *guid)
+static RemoteIdentityInfo *find_remote_identity_by_guid(const struct ddsrt_hh *hh, const DDS_Security_GUID_t *guid)
 {
-    struct RemoteIdentityInfo template;
-
-    memcpy(&template.guid, guid, sizeof(*guid));
-
-    return (RemoteIdentityInfo *) ddsrt_hh_lookup(hh, &template);
+  struct RemoteIdentityInfo template;
+  memcpy(&template.guid, guid, sizeof(*guid));
+  return (RemoteIdentityInfo *)ddsrt_hh_lookup(hh, &template);
 }
 
-static void
-remoteIdentityInfoFree(
-    SecurityObject *obj);
-
-static RemoteIdentityInfo *
-remoteIdentityInfoNew(
-        const DDS_Security_GUID_t *guid,
-        const DDS_Security_IdentityToken *remote_identity_token)
+static void remote_identity_info_free(SecurityObject *obj)
 {
-    RemoteIdentityInfo *identity = NULL;
-
-    assert(guid);
-    assert(remote_identity_token);
-
-    identity = ddsrt_malloc(sizeof(*identity));
-    memset(identity, 0, sizeof(*identity));
-
-    security_object_init((SecurityObject *)identity, SECURITY_OBJECT_KIND_REMOTE_IDENTITY, remoteIdentityInfoFree);
-
-    memcpy(&identity->guid, guid, sizeof(DDS_Security_GUID_t));
-    identity->remoteIdentityToken = DDS_Security_DataHolder_alloc();
-    DDS_Security_DataHolder_copy(identity->remoteIdentityToken, remote_identity_token);
-    identity->identityCert = NULL;
-    identity->dsignAlgoKind = AUTH_ALGO_KIND_UNKNOWN;
-    identity->kagreeAlgoKind = AUTH_ALGO_KIND_UNKNOWN;
-    identity->permissionsDocument = ddsrt_strdup("");
-    identity->linkHash = ddsrt_hh_new(32, security_object_hash, security_object_equal);
-
-    return identity;
+  RemoteIdentityInfo *identity = (RemoteIdentityInfo *)obj;
+  CHECK_OBJECT_KIND(obj, SECURITY_OBJECT_KIND_REMOTE_IDENTITY);
+  if (identity)
+  {
+    if (identity->identityCert)
+      X509_free(identity->identityCert);
+    DDS_Security_DataHolder_free(identity->remoteIdentityToken);
+    ddsrt_hh_free(identity->linkHash);
+    ddsrt_free(identity->pdata._buffer);
+    ddsrt_free(identity->permissionsDocument);
+    security_object_deinit((SecurityObject *)identity);
+    ddsrt_free(identity);
+  }
 }
 
-static void
-remoteIdentityInfoFree(
-    SecurityObject *obj)
+static RemoteIdentityInfo *remote_identity_info_new(const DDS_Security_GUID_t *guid, const DDS_Security_IdentityToken *remote_identity_token)
 {
-    RemoteIdentityInfo *identity = (RemoteIdentityInfo *)obj;
+  assert(guid);
+  assert(remote_identity_token);
 
-    CHECK_OBJECT_KIND(obj, SECURITY_OBJECT_KIND_REMOTE_IDENTITY);
-
-    if (identity) {
-        if (identity->identityCert) {
-            X509_free(identity->identityCert);
-        }
-        DDS_Security_DataHolder_free(identity->remoteIdentityToken);
-
-        ddsrt_hh_free(identity->linkHash);
-
-        ddsrt_free(identity->pdata._buffer);
-        ddsrt_free(identity->permissionsDocument);
-        security_object_deinit((SecurityObject *)identity);
-        ddsrt_free(identity);
-    }
+  RemoteIdentityInfo *identity = ddsrt_malloc(sizeof(*identity));
+  memset(identity, 0, sizeof(*identity));
+  security_object_init((SecurityObject *)identity, SECURITY_OBJECT_KIND_REMOTE_IDENTITY, remote_identity_info_free);
+  memcpy(&identity->guid, guid, sizeof(DDS_Security_GUID_t));
+  identity->remoteIdentityToken = DDS_Security_DataHolder_alloc();
+  DDS_Security_DataHolder_copy(identity->remoteIdentityToken, remote_identity_token);
+  identity->identityCert = NULL;
+  identity->dsignAlgoKind = AUTH_ALGO_KIND_UNKNOWN;
+  identity->kagreeAlgoKind = AUTH_ALGO_KIND_UNKNOWN;
+  identity->permissionsDocument = ddsrt_strdup("");
+  identity->linkHash = ddsrt_hh_new(32, security_object_hash, security_object_equal);
+  return identity;
 }
 
-static void
-identityRelationFree(
-    SecurityObject *obj);
+static void identity_relation_free(SecurityObject *obj)
+{
+  IdentityRelation *relation = (IdentityRelation *)obj;
+  CHECK_OBJECT_KIND(obj, SECURITY_OBJECT_KIND_IDENTITY_RELATION);
+  if (relation)
+  {
+    ddsrt_free(relation->lchallenge);
+    ddsrt_free(relation->rchallenge);
+    security_object_deinit((SecurityObject *)relation);
+    ddsrt_free(relation);
+  }
+}
 
 /* The IdentityRelation provides the association between a local and a remote
  * identity. This object manages the challenges which are created for
@@ -474,1462 +395,1056 @@ identityRelationFree(
  * The rchallenge is the challenge received from the remote identity it may be set when
  * an auth_request_message_token is received from the remote identity,
  */
-static IdentityRelation *
-identityRelationNew(
-    LocalIdentityInfo *localIdentity,
-    RemoteIdentityInfo *remoteIdentity,
-    AuthenticationChallenge *lchallenge,
-    AuthenticationChallenge *rchallenge)
+static IdentityRelation *identity_relation_new(LocalIdentityInfo *localIdentity, RemoteIdentityInfo *remoteIdentity, AuthenticationChallenge *lchallenge, AuthenticationChallenge *rchallenge)
 {
-    IdentityRelation *relation;
-
-    assert(localIdentity);
-    assert(remoteIdentity);
-
-    relation = ddsrt_malloc(sizeof(*relation));
-    memset(relation, 0, sizeof(*relation));
-
-    security_object_init((SecurityObject *)relation, SECURITY_OBJECT_KIND_IDENTITY_RELATION, identityRelationFree);
-    relation->_parent.handle = SECURITY_OBJECT_HANDLE(localIdentity);
-
-    relation->localIdentity = localIdentity;
-    relation->remoteIdentity = remoteIdentity;
-    relation->lchallenge = lchallenge;
-    relation->rchallenge = rchallenge;
-
-    return relation;
+  IdentityRelation *relation;
+  assert(localIdentity);
+  assert(remoteIdentity);
+  relation = ddsrt_malloc(sizeof(*relation));
+  memset(relation, 0, sizeof(*relation));
+  security_object_init((SecurityObject *)relation, SECURITY_OBJECT_KIND_IDENTITY_RELATION, identity_relation_free);
+  relation->_parent.handle = SECURITY_OBJECT_HANDLE(localIdentity);
+  relation->localIdentity = localIdentity;
+  relation->remoteIdentity = remoteIdentity;
+  relation->lchallenge = lchallenge;
+  relation->rchallenge = rchallenge;
+  return relation;
 }
 
-static void
-identityRelationFree(
-    SecurityObject *obj)
+static void handshake_info_free(SecurityObject *obj)
 {
-    IdentityRelation *relation = (IdentityRelation *)obj;
-
-    CHECK_OBJECT_KIND(obj, SECURITY_OBJECT_KIND_IDENTITY_RELATION);
-
-    if (relation) {
-        ddsrt_free(relation->lchallenge);
-        ddsrt_free(relation->rchallenge);
-        security_object_deinit((SecurityObject *)relation);
-        ddsrt_free(relation);
+  CHECK_OBJECT_KIND(obj, SECURITY_OBJECT_KIND_HANDSHAKE);
+  HandshakeInfo *handshake = (HandshakeInfo *)obj;
+  if (handshake)
+  {
+    if (handshake->ldh)
+      EVP_PKEY_free(handshake->ldh);
+    if (handshake->rdh)
+      EVP_PKEY_free(handshake->rdh);
+    if (handshake->shared_secret_handle_impl)
+    {
+      ddsrt_free(handshake->shared_secret_handle_impl->shared_secret);
+      ddsrt_free(handshake->shared_secret_handle_impl);
     }
+    security_object_deinit((SecurityObject *)handshake);
+    ddsrt_free(handshake);
+  }
 }
 
-static void
-handshakeInfoFree(
-    SecurityObject *obj);
-
-static HandshakeInfo *
-handshakeInfoNew(
-    LocalIdentityInfo *localIdentity,
-    RemoteIdentityInfo *remoteIdentity,
-    IdentityRelation *relation)
+static HandshakeInfo *handshake_info_new(LocalIdentityInfo *localIdentity, RemoteIdentityInfo *remoteIdentity, IdentityRelation *relation)
 {
-    HandshakeInfo *handshake;
-
-    assert(localIdentity);
-    assert(remoteIdentity);
-
-    DDSRT_UNUSED_ARG(localIdentity);
-    DDSRT_UNUSED_ARG(remoteIdentity);
-    handshake = ddsrt_malloc(sizeof(*handshake));
-    memset(handshake, 0, sizeof(*handshake));
-
-    security_object_init((SecurityObject *)handshake, SECURITY_OBJECT_KIND_HANDSHAKE, handshakeInfoFree);
-
-    handshake->relation = relation;
-    handshake->shared_secret_handle_impl = NULL;
-
-    return handshake;
+  assert(localIdentity);
+  assert(remoteIdentity);
+  DDSRT_UNUSED_ARG(localIdentity);
+  DDSRT_UNUSED_ARG(remoteIdentity);
+  HandshakeInfo *handshake = ddsrt_malloc(sizeof(*handshake));
+  memset(handshake, 0, sizeof(*handshake));
+  security_object_init((SecurityObject *)handshake, SECURITY_OBJECT_KIND_HANDSHAKE, handshake_info_free);
+  handshake->relation = relation;
+  handshake->shared_secret_handle_impl = NULL;
+  return handshake;
 }
 
-static void
-handshakeInfoFree(
-    SecurityObject *obj)
+static IdentityRelation *find_identity_relation(const RemoteIdentityInfo *remote, int64_t lid)
 {
-    HandshakeInfo *handshake = (HandshakeInfo *)obj;
+  return (IdentityRelation *)security_object_find(remote->linkHash, lid);
+}
 
-    CHECK_OBJECT_KIND(obj, SECURITY_OBJECT_KIND_HANDSHAKE);
+static void remove_identity_relation(RemoteIdentityInfo *remote, IdentityRelation *relation)
+{
+  (void)ddsrt_hh_remove(remote->linkHash, relation);
+  security_object_free((SecurityObject *)relation);
+}
 
-    if (handshake) {
-        if (handshake->ldh) {
-            EVP_PKEY_free(handshake->ldh);
-        }
-        if (handshake->rdh) {
-            EVP_PKEY_free(handshake->rdh);
-        }
-        if(handshake->shared_secret_handle_impl) {
-            ddsrt_free( handshake->shared_secret_handle_impl->shared_secret);
-            ddsrt_free( handshake->shared_secret_handle_impl );
-        }
-        security_object_deinit((SecurityObject *)handshake);
-        ddsrt_free(handshake);
+static HandshakeInfo *find_handshake(const dds_security_authentication_impl *auth, int64_t localId, int64_t remoteId)
+{
+  struct ddsrt_hh_iter it;
+  SecurityObject *obj;
+  for (obj = ddsrt_hh_iter_first(auth->objectHash, &it); obj; obj = ddsrt_hh_iter_next(&it))
+  {
+    if (obj->kind == SECURITY_OBJECT_KIND_HANDSHAKE)
+    {
+      IdentityRelation *relation = ((HandshakeInfo *)obj)->relation;
+      assert(relation);
+      if (SECURITY_OBJECT_HANDLE(relation->localIdentity) == localId && SECURITY_OBJECT_HANDLE(relation->remoteIdentity) == remoteId)
+        return (HandshakeInfo *)obj;
     }
+  }
+  return NULL;
 }
 
-static IdentityRelation *
-find_identity_relation(
-    const RemoteIdentityInfo *remote,
-    int64_t lid)
+static char * get_authentication_class_id(void)
 {
-    return (IdentityRelation *)security_object_find(remote->linkHash, lid);
+  size_t sz = strlen(AUTH_PROTOCOL_CLASS) + 5;
+  char *classId = ddsrt_malloc(sz);
+  snprintf(classId, sz, "%s:%1u.%1u", AUTH_PROTOCOL_CLASS, AUTH_PROTOCOL_VERSION_MAJOR, AUTH_PROTOCOL_VERSION_MINOR);
+  return classId;
 }
 
-static void
-remove_identity_relation(
-    RemoteIdentityInfo *remote,
-    IdentityRelation *relation)
+static const char *get_authentication_algo(AuthenticationAlgoKind_t kind)
 {
-    (void)ddsrt_hh_remove(remote->linkHash, relation);
-    security_object_free((SecurityObject *) relation);
+  switch (kind)
+  {
+  case AUTH_ALGO_KIND_RSA_2048:
+    return "RSA-2048";
+  case AUTH_ALGO_KIND_EC_PRIME256V1:
+    return "EC-prime256v1";
+  default:
+    assert(0);
+    return "";
+  }
 }
 
-static HandshakeInfo *
-find_handshake(
-    const dds_security_authentication_impl *auth,
-    int64_t localId,
-    int64_t remoteId)
+static const char *get_dsign_algo(AuthenticationAlgoKind_t kind)
 {
-    struct ddsrt_hh_iter it;
-    SecurityObject *obj;
-    IdentityRelation *relation;
-    HandshakeInfo *found = NULL;
-
-    for (obj = ddsrt_hh_iter_first(auth->objectHash, &it); obj && !found; obj = ddsrt_hh_iter_next(&it)) {
-        if (obj->kind == SECURITY_OBJECT_KIND_HANDSHAKE) {
-            relation = ((HandshakeInfo *)obj)->relation;
-            assert(relation);
-            if ((SECURITY_OBJECT_HANDLE(relation->localIdentity) == localId) &&
-                (SECURITY_OBJECT_HANDLE(relation->remoteIdentity) == remoteId)) {
-                found = (HandshakeInfo *)obj;
-            }
-        }
-    }
-
-    return found;
+  switch (kind)
+  {
+  case AUTH_ALGO_KIND_RSA_2048:
+    return AUTH_DSIG_ALGO_RSA_2048_SHA256_IDENT;
+  case AUTH_ALGO_KIND_EC_PRIME256V1:
+    return AUTH_DSIG_ALGO_ECDSA_SHA256_IDENT;
+  default:
+    assert(0);
+    return "";
+  }
 }
 
-static char *
-get_authentication_class_id(
-    void)
+static const char *get_kagree_algo(AuthenticationAlgoKind_t kind)
 {
-    char *classId;
-    size_t sz;
-
-    sz = strlen(AUTH_PROTOCOL_CLASS) + 5;
-
-    classId = ddsrt_malloc(sz);
-    snprintf(classId, sz, "%s:%1u.%1u", AUTH_PROTOCOL_CLASS, AUTH_PROTOCOL_VERSION_MAJOR, AUTH_PROTOCOL_VERSION_MINOR);
-
-    return classId;
+  switch (kind)
+  {
+  case AUTH_ALGO_KIND_RSA_2048:
+    return AUTH_KAGREE_ALGO_RSA_2048_SHA256_IDENT;
+  case AUTH_ALGO_KIND_EC_PRIME256V1:
+    return AUTH_KAGREE_ALGO_ECDH_PRIME256V1_IDENT;
+  default:
+    assert(0);
+    return "";
+  }
 }
 
-static const char *
-get_authentication_algo(
-        AuthenticationAlgoKind_t kind)
+static AuthenticationAlgoKind_t get_dsign_algo_from_string(const char *name)
 {
-    const char *result;
-    switch (kind) {
-    case AUTH_ALGO_KIND_RSA_2048:
-        result = "RSA-2048";
-        break;
-    case AUTH_ALGO_KIND_EC_PRIME256V1:
-        result = "EC-prime256v1";
-        break;
-    default:
-        assert(0);
-        result = "";
-        break;
-    }
-
-    return result;
+  if (name)
+  {
+    if (strcmp(AUTH_DSIG_ALGO_RSA_2048_SHA256_IDENT, name) == 0)
+      return AUTH_ALGO_KIND_RSA_2048;
+    if (strcmp(AUTH_DSIG_ALGO_ECDSA_SHA256_IDENT, name) == 0)
+      return AUTH_ALGO_KIND_EC_PRIME256V1;
+  }
+  return AUTH_ALGO_KIND_UNKNOWN;
 }
 
-static const char *
-get_dsign_algo(
-        AuthenticationAlgoKind_t kind)
+static AuthenticationAlgoKind_t get_kagree_algo_from_string(const char *name)
 {
-    const char *result;
-    switch (kind) {
-    case AUTH_ALGO_KIND_RSA_2048:
-        result = AUTH_DSIG_ALGO_RSA_2048_SHA256_IDENT;
-        break;
-    case AUTH_ALGO_KIND_EC_PRIME256V1:
-        result = AUTH_DSIG_ALGO_ECDSA_SHA256_IDENT;
-        break;
-    default:
-        assert(0);
-        result = "";
-        break;
-    }
-
-    return result;
+  if (name)
+  {
+    if (strcmp(AUTH_KAGREE_ALGO_RSA_2048_SHA256_IDENT, name) == 0)
+      return AUTH_ALGO_KIND_RSA_2048;
+    if (strcmp(AUTH_KAGREE_ALGO_ECDH_PRIME256V1_IDENT, name) == 0)
+      return AUTH_ALGO_KIND_EC_PRIME256V1;
+  }
+  return AUTH_ALGO_KIND_UNKNOWN;
 }
 
-static const char *
-get_kagree_algo(
-        AuthenticationAlgoKind_t kind)
+static void free_binary_properties(DDS_Security_BinaryProperty_t *seq, uint32_t length)
 {
-    const char *result;
-    switch (kind) {
-    case AUTH_ALGO_KIND_RSA_2048:
-        result = AUTH_KAGREE_ALGO_RSA_2048_SHA256_IDENT;
-        break;
-    case AUTH_ALGO_KIND_EC_PRIME256V1:
-        result = AUTH_KAGREE_ALGO_ECDH_PRIME256V1_IDENT;
-        break;
-    default:
-        assert(0);
-        result = "";
-        break;
-    }
-
-    return result;
+  assert(seq);
+  for (uint32_t i = 0; i < length; i++)
+  {
+    ddsrt_free(seq[i].name);
+    ddsrt_free(seq[i].value._buffer);
+  }
+  ddsrt_free(seq);
 }
 
-static AuthenticationAlgoKind_t
-get_dsign_algo_from_string(
-    const char *name)
+static void get_hash_binary_property_seq(const DDS_Security_BinaryPropertySeq *seq, unsigned char hash[SHA256_DIGEST_LENGTH])
 {
-    AuthenticationAlgoKind_t algoKind = AUTH_ALGO_KIND_UNKNOWN;
-
-    if (name) {
-        if (strcmp(AUTH_DSIG_ALGO_RSA_2048_SHA256_IDENT, name) == 0) {
-            algoKind = AUTH_ALGO_KIND_RSA_2048;
-        } else if (strcmp(AUTH_DSIG_ALGO_ECDSA_SHA256_IDENT, name) == 0) {
-            algoKind = AUTH_ALGO_KIND_EC_PRIME256V1;
-        }
-    }
-
-    return algoKind;
+  unsigned char *buffer;
+  size_t size;
+  DDS_Security_Serializer serializer = DDS_Security_Serializer_new(4096, 4096);
+  DDS_Security_Serialize_BinaryPropertySeq(serializer, seq);
+  DDS_Security_Serializer_buffer(serializer, &buffer, &size);
+  SHA256(buffer, size, hash);
+  ddsrt_free(buffer);
+  DDS_Security_Serializer_free(serializer);
 }
 
-static AuthenticationAlgoKind_t
-get_kagree_algo_from_string(
-    const char *name)
+static DDS_Security_ValidationResult_t create_signature(EVP_PKEY *pkey, const DDS_Security_BinaryProperty_t **binary_properties,
+    const uint32_t binary_properties_length, unsigned char **signature, size_t *signatureLen, DDS_Security_SecurityException *ex)
 {
-    AuthenticationAlgoKind_t algoKind = AUTH_ALGO_KIND_UNKNOWN;
+  DDS_Security_ValidationResult_t result;
+  unsigned char *buffer;
+  size_t size;
+  DDS_Security_Serializer serializer = DDS_Security_Serializer_new(4096, 4096);
 
-    if (name) {
-        if (strcmp(AUTH_KAGREE_ALGO_RSA_2048_SHA256_IDENT, name) == 0) {
-            algoKind = AUTH_ALGO_KIND_RSA_2048;
-        } else if (strcmp(AUTH_KAGREE_ALGO_ECDH_PRIME256V1_IDENT, name) == 0) {
-            algoKind = AUTH_ALGO_KIND_EC_PRIME256V1;
-        }
-    }
+  DDS_Security_Serialize_BinaryPropertyArray(serializer, binary_properties, binary_properties_length);
+  DDS_Security_Serializer_buffer(serializer, &buffer, &size);
 
-    return algoKind;
+  result = create_asymmetrical_signature(pkey, buffer, size, signature, signatureLen, ex);
+  ddsrt_free(buffer);
+  DDS_Security_Serializer_free(serializer);
+
+  return result;
 }
 
-static void
-free_binary_properties(
-    DDS_Security_BinaryProperty_t *seq,
-    uint32_t length)
+static DDS_Security_ValidationResult_t validate_signature(EVP_PKEY *pkey, const DDS_Security_BinaryProperty_t **properties,
+    const uint32_t properties_length, unsigned char *signature, size_t signatureLen, DDS_Security_SecurityException *ex)
 {
-    uint32_t i;
-    assert (seq);
-    for (i = 0; i < length; i++) {
-        ddsrt_free(seq[i].name);
-        ddsrt_free(seq[i].value._buffer);
-    }
-    ddsrt_free(seq);
+  DDS_Security_ValidationResult_t result;
+  unsigned char *buffer;
+  size_t size;
+  DDS_Security_Serializer serializer = DDS_Security_Serializer_new(4096, 4096);
+
+  DDS_Security_Serialize_BinaryPropertyArray(serializer, properties, properties_length);
+  DDS_Security_Serializer_buffer(serializer, &buffer, &size);
+
+  result = validate_asymmetrical_signature(pkey, buffer, size, signature, signatureLen, ex);
+  ddsrt_free(buffer);
+  DDS_Security_Serializer_free(serializer);
+
+  return result;
 }
 
-static void
-get_hash_binary_property_seq(
-    const DDS_Security_BinaryPropertySeq *seq,
-    unsigned char hash[SHA256_DIGEST_LENGTH])
+static DDS_Security_ValidationResult_t compute_hash_value(HashValue_t value, const DDS_Security_BinaryProperty_t **properties,
+    const uint32_t properties_length, DDS_Security_SecurityException *ex)
 {
-    DDS_Security_Serializer serializer;
-    unsigned char *buffer;
-    size_t size;
-
-    serializer = DDS_Security_Serializer_new(4096, 4096);
-
-    DDS_Security_Serialize_BinaryPropertySeq(serializer, seq);
-    DDS_Security_Serializer_buffer(serializer, &buffer, &size);
-    SHA256(buffer, size, hash);
-    ddsrt_free(buffer);
-    DDS_Security_Serializer_free(serializer);
+  DDSRT_UNUSED_ARG(ex);
+  unsigned char *buffer;
+  size_t size;
+  DDS_Security_Serializer serializer = DDS_Security_Serializer_new(4096, 4096);
+  DDS_Security_Serialize_BinaryPropertyArray(serializer, properties, properties_length);
+  DDS_Security_Serializer_buffer(serializer, &buffer, &size);
+  SHA256(buffer, size, value);
+  ddsrt_free(buffer);
+  DDS_Security_Serializer_free(serializer);
+  return DDS_SECURITY_VALIDATION_OK;
 }
 
-static DDS_Security_ValidationResult_t
-create_signature(
-    EVP_PKEY *pkey,
-    const DDS_Security_BinaryProperty_t **binary_properties,
-    const uint32_t binary_properties_length,
-    unsigned char **signature,
-    size_t *signatureLen,
-    DDS_Security_SecurityException *ex)
+static DDS_Security_BinaryProperty_t *hash_value_to_binary_property(const char *name, HashValue_t hash)
 {
-    DDS_Security_ValidationResult_t result;
-    DDS_Security_Serializer serializer;
-    unsigned char *buffer;
-    size_t size;
-
-    serializer = DDS_Security_Serializer_new(4096, 4096);
-
-    DDS_Security_Serialize_BinaryPropertyArray(serializer,binary_properties, binary_properties_length);
-    DDS_Security_Serializer_buffer(serializer, &buffer, &size);
-
-    result = create_asymmetrical_signature(pkey, buffer, size, signature, signatureLen, ex);
-    ddsrt_free(buffer);
-    DDS_Security_Serializer_free(serializer);
-
-    return result;
+  DDS_Security_BinaryProperty_t *bp = DDS_Security_BinaryProperty_alloc();
+  DDS_Security_BinaryProperty_set_by_value(bp, name, hash, sizeof(HashValue_t));
+  return bp;
 }
 
-static DDS_Security_ValidationResult_t
-validate_signature(
-    EVP_PKEY *pkey,
-    const DDS_Security_BinaryProperty_t **properties,
-    const uint32_t properties_length,
-    unsigned char *signature,
-    size_t signatureLen,
-    DDS_Security_SecurityException *ex)
+static void validity_callback(struct dds_security_timed_dispatcher_t *d, dds_security_timed_cb_kind kind, void *listener, void *arg)
 {
-    DDS_Security_ValidationResult_t result;
-    DDS_Security_Serializer serializer;
-    unsigned char *buffer;
-    size_t size;
-
-    serializer = DDS_Security_Serializer_new(4096, 4096);
-
-    DDS_Security_Serialize_BinaryPropertyArray(serializer, properties, properties_length);
-    DDS_Security_Serializer_buffer(serializer, &buffer, &size);
-
-    result = validate_asymmetrical_signature(pkey, buffer, size, signature, signatureLen, ex);
-    ddsrt_free(buffer);
-    DDS_Security_Serializer_free(serializer);
-
-    return result;
+  DDSRT_UNUSED_ARG(d);
+  assert(d);
+  assert(arg);
+  validity_cb_info *info = arg;
+  if (kind == DDS_SECURITY_TIMED_CB_KIND_TIMEOUT)
+  {
+    assert(listener);
+    dds_security_authentication_listener *auth_listener = (dds_security_authentication_listener *)listener;
+    if (auth_listener->on_revoke_identity)
+      auth_listener->on_revoke_identity(auth_listener, (dds_security_authentication *)info->auth, info->hdl);
+  }
+  ddsrt_free(arg);
 }
 
-static DDS_Security_ValidationResult_t
-compute_hash_value(
-    HashValue_t value,
-    const DDS_Security_BinaryProperty_t **properties,
-    const uint32_t properties_length,
-    DDS_Security_SecurityException *ex)
+static void add_validity_end_trigger(dds_security_authentication_impl *auth, const DDS_Security_IdentityHandle identity_handle, dds_time_t end)
 {
-    DDS_Security_ValidationResult_t result = DDS_SECURITY_VALIDATION_OK;
-    DDS_Security_Serializer serializer;
-    unsigned char *buffer;
-    size_t size;
-
-    DDSRT_UNUSED_ARG(ex);
-
-    serializer = DDS_Security_Serializer_new(4096, 4096);
-
-    DDS_Security_Serialize_BinaryPropertyArray(serializer, properties, properties_length);
-    DDS_Security_Serializer_buffer(serializer, &buffer, &size);
-    SHA256(buffer, size, value);
-    ddsrt_free(buffer);
-    DDS_Security_Serializer_free(serializer);
-
-    return result;
+  validity_cb_info *arg = ddsrt_malloc(sizeof(validity_cb_info));
+  arg->auth = auth;
+  arg->hdl = identity_handle;
+  dds_security_timed_dispatcher_add(auth->timed_callbacks, auth->dispatcher, validity_callback, end, (void *)arg);
 }
 
-static DDS_Security_BinaryProperty_t *
-hash_value_to_binary_property(
-    const char *name,
-    HashValue_t hash)
+static DDS_Security_ValidationResult_t get_adjusted_participant_guid(X509 *cert, const DDS_Security_GUID_t *candidate, DDS_Security_GUID_t *adjusted, DDS_Security_SecurityException *ex)
 {
-    DDS_Security_BinaryProperty_t *bp = DDS_Security_BinaryProperty_alloc();
+  unsigned char high[SHA256_DIGEST_LENGTH], low[SHA256_DIGEST_LENGTH];
+  unsigned char *subject = NULL;
+  size_t size = 0;
 
-    DDS_Security_BinaryProperty_set_by_value(bp, name, hash, sizeof(HashValue_t));
+  assert(cert);
+  assert(candidate);
+  assert(adjusted);
 
-    return bp;
-}
+  if (get_subject_name_DER_encoded(cert, &subject, &size, ex) != DDS_SECURITY_VALIDATION_OK)
+    return DDS_SECURITY_VALIDATION_FAILED;
 
-static void
-validity_callback(struct dds_security_timed_dispatcher_t *d,
-                  dds_security_timed_cb_kind kind,
-                  void *listener,
-                  void *arg)
-{
-    validity_cb_info *info = arg;
-
-    DDSRT_UNUSED_ARG(d);
-    assert(d);
-    assert(arg);
-
-    if (kind == DDS_SECURITY_TIMED_CB_KIND_TIMEOUT) {
-        assert(listener);
-        dds_security_authentication_listener *auth_listener = (dds_security_authentication_listener*)listener;
-        if (auth_listener->on_revoke_identity) {
-            auth_listener->on_revoke_identity(auth_listener,
-                                               (dds_security_authentication*)info->auth,
-                                               info->hdl);
-
-        }
-    }
-    ddsrt_free(arg);
-}
-
-
-static void
-add_validity_end_trigger(dds_security_authentication_impl *auth,
-                         const DDS_Security_IdentityHandle identity_handle,
-                         dds_time_t end)
-{
-    validity_cb_info *arg = ddsrt_malloc(sizeof(validity_cb_info));
-    arg->auth = auth;
-    arg->hdl = identity_handle;
-    dds_security_timed_dispatcher_add(auth->timed_callbacks, auth->dispatcher,
-                            validity_callback,
-                            end,
-                            (void*)arg);
-}
-
-
-
-#define ADJUSTED_GUID_PREFIX_FLAG 0x80
-
-static DDS_Security_ValidationResult_t
-get_adjusted_participant_guid(
-        X509 *cert,
-        const DDS_Security_GUID_t *candidate,
-        DDS_Security_GUID_t *adjusted,
-        DDS_Security_SecurityException *ex)
-{
-    DDS_Security_ValidationResult_t result = DDS_SECURITY_VALIDATION_FAILED;
-    unsigned char high[SHA256_DIGEST_LENGTH], low[SHA256_DIGEST_LENGTH];
-    unsigned char *subject = NULL;
-    size_t size=0;
-
-    assert(cert);
-    assert(candidate);
-    assert(adjusted);
-
-    result = get_subject_name_DER_encoded(cert, &subject, &size, ex);
-    if ( result == DDS_SECURITY_VALIDATION_OK ) {
-      DDS_Security_octet hb = ADJUSTED_GUID_PREFIX_FLAG;
-      int i;
-
-      SHA256(subject, size, high);
-      SHA256(&candidate->prefix[0], sizeof(DDS_Security_GuidPrefix_t), low);
-
-      adjusted->entityId = candidate->entityId;
-      for (i = 0; i < 6; i++) {
-        adjusted->prefix[i] = hb | high[i] >> 1;
-        hb = (DDS_Security_octet) (high[i] << 7);
-      }
-      for (i = 0; i < 6; i++) {
-        adjusted->prefix[i + 6] = low[i];
-      }
-      ddsrt_free(subject);
-    }
-
-    return result;
+  DDS_Security_octet hb = ADJUSTED_GUID_PREFIX_FLAG;
+  SHA256(subject, size, high);
+  SHA256(&candidate->prefix[0], sizeof(DDS_Security_GuidPrefix_t), low);
+  adjusted->entityId = candidate->entityId;
+  for (int i = 0; i < 6; i++)
+  {
+    adjusted->prefix[i] = hb | high[i] >> 1;
+    hb = (DDS_Security_octet)(high[i] << 7);
+  }
+  for (int i = 0; i < 6; i++)
+    adjusted->prefix[i + 6] = low[i];
+  ddsrt_free(subject);
+  return DDS_SECURITY_VALIDATION_OK;
 }
 #undef ADJUSTED_GUID_PREFIX_FLAG
 
-DDS_Security_ValidationResult_t
-validate_local_identity(
-        dds_security_authentication *instance,
-        DDS_Security_IdentityHandle *local_identity_handle,
-        DDS_Security_GUID_t *adjusted_participant_guid,
-        const DDS_Security_DomainId domain_id,
-        const DDS_Security_Qos *participant_qos,
-        const DDS_Security_GUID_t *candidate_participant_guid,
-        DDS_Security_SecurityException *ex)
+DDS_Security_ValidationResult_t validate_local_identity(dds_security_authentication *instance, DDS_Security_IdentityHandle *local_identity_handle,
+    DDS_Security_GUID_t *adjusted_participant_guid, const DDS_Security_DomainId domain_id, const DDS_Security_Qos *participant_qos,
+    const DDS_Security_GUID_t *candidate_participant_guid, DDS_Security_SecurityException *ex)
 {
-    DDS_Security_ValidationResult_t result = DDS_SECURITY_VALIDATION_OK;
-    dds_security_authentication_impl *implementation = (dds_security_authentication_impl *) instance;
-    LocalIdentityInfo *identity;
-    char *identityCertPEM;
-    char *identityCaPEM;
-    char *privateKeyPEM;
-    char *password;
-    X509 *identityCert;
-    X509 *identityCA;
-    EVP_PKEY *privateKey;
-    char *trusted_ca_dir;
-    unsigned i;
-    dds_time_t certExpiry = DDS_TIME_INVALID;
+  dds_security_authentication_impl *implementation = (dds_security_authentication_impl *)instance;
+  LocalIdentityInfo *identity;
+  char *identityCertPEM, *identityCaPEM, *privateKeyPEM, *password, *trusted_ca_dir;
+  X509 *identityCert, *identityCA;
+  EVP_PKEY *privateKey;
+  dds_time_t certExpiry = DDS_TIME_INVALID;
 
-    /* validate provided arguments */
-    if (!instance || !local_identity_handle || !adjusted_participant_guid || !participant_qos || !candidate_participant_guid) {
-        result = DDS_SECURITY_VALIDATION_FAILED;
-        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result, "validate_local_identity: Invalid parameter provided");
-        goto err_bad_param;
-    }
+  if (!instance || !local_identity_handle || !adjusted_participant_guid || !participant_qos || !candidate_participant_guid)
+  {
+    DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "validate_local_identity: Invalid parameter provided");
+    goto err_bad_param;
+  }
 
-    identityCertPEM = DDS_Security_Property_get_value(&participant_qos->property.value, PROPERTY_IDENTITY_CERT);
-    if (!identityCertPEM) {
-        result = DDS_SECURITY_VALIDATION_FAILED;
-        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result, "validate_local_identity: missing property '%s'", PROPERTY_IDENTITY_CERT);
-        goto err_no_identity_cert;
-    }
+  if (!(identityCertPEM = DDS_Security_Property_get_value(&participant_qos->property.value, PROPERTY_IDENTITY_CERT)))
+  {
+    DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "validate_local_identity: missing property '%s'", PROPERTY_IDENTITY_CERT);
+    goto err_no_identity_cert;
+  }
 
-    identityCaPEM = DDS_Security_Property_get_value(&participant_qos->property.value, PROPERTY_IDENTITY_CA);
-    if (!identityCaPEM) {
-        result = DDS_SECURITY_VALIDATION_FAILED;
-        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result, "validate_local_identity: missing property '%s'", PROPERTY_IDENTITY_CA);
-        goto err_no_identity_ca;
-    }
+  if (!(identityCaPEM = DDS_Security_Property_get_value(&participant_qos->property.value, PROPERTY_IDENTITY_CA)))
+  {
+    DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "validate_local_identity: missing property '%s'", PROPERTY_IDENTITY_CA);
+    goto err_no_identity_ca;
+  }
 
-    privateKeyPEM = DDS_Security_Property_get_value(&participant_qos->property.value, PROPERTY_PRIVATE_KEY);
-    if (!privateKeyPEM) {
-        result = DDS_SECURITY_VALIDATION_FAILED;
-        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result, "validate_local_identity: missing property '%s'", PROPERTY_PRIVATE_KEY);
-        goto err_no_private_key;
-    }
+  if (!(privateKeyPEM = DDS_Security_Property_get_value(&participant_qos->property.value, PROPERTY_PRIVATE_KEY)))
+  {
+    DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "validate_local_identity: missing property '%s'", PROPERTY_PRIVATE_KEY);
+    goto err_no_private_key;
+  }
 
-    password = DDS_Security_Property_get_value(&participant_qos->property.value, PROPERTY_PASSWORD);
+  password = DDS_Security_Property_get_value(&participant_qos->property.value, PROPERTY_PASSWORD);
 
-    trusted_ca_dir = DDS_Security_Property_get_value(&participant_qos->property.value, PROPERTY_TRUSTED_CA_DIR);
-    if (trusted_ca_dir && *trusted_ca_dir != '\0')
+  trusted_ca_dir = DDS_Security_Property_get_value(&participant_qos->property.value, PROPERTY_TRUSTED_CA_DIR);
+  if (trusted_ca_dir && strlen(trusted_ca_dir) > 0)
+  {
+    if (get_trusted_ca_list(trusted_ca_dir, &(implementation->trustedCAList), ex) != DDS_SECURITY_VALIDATION_OK)
+      goto err_inv_trusted_ca_dir;
+  }
+
+  if (load_X509_certificate(identityCaPEM, &identityCA, ex) != DDS_SECURITY_VALIDATION_OK)
+    goto err_inv_identity_ca;
+
+  /* check for CA if listed in trusted CA files */
+  if (implementation->trustedCAList.length > 0)
+  {
+    const EVP_MD *digest = EVP_get_digestbyname("sha1");
+    uint32_t size;
+    unsigned char hash_buffer[20], hash_buffer_trusted[20];
+    DDS_Security_ValidationResult_t result = DDS_SECURITY_VALIDATION_FAILED;
+
+    X509_digest(identityCA, digest, hash_buffer, &size);
+    for (unsigned i = 0; i < implementation->trustedCAList.length; ++i)
     {
-        if ((result = get_trusted_ca_list (trusted_ca_dir, &(implementation->trustedCAList), ex)) != DDS_SECURITY_VALIDATION_OK)
-            goto err_inv_trusted_ca_dir;
+      X509_digest(implementation->trustedCAList.buffer[i], digest, hash_buffer_trusted, &size);
+      if (memcmp(hash_buffer_trusted, hash_buffer, 20) == 0)
+      {
+        result = DDS_SECURITY_VALIDATION_OK;
+        break;
+      }
     }
-
-    result = load_X509_certificate(identityCaPEM, &identityCA, ex);
-    if (result != DDS_SECURITY_VALIDATION_OK) {
-        goto err_inv_identity_ca;
+    if (result != DDS_SECURITY_VALIDATION_OK)
+    {
+      DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_CA_NOT_TRUSTED_CODE, DDS_SECURITY_VALIDATION_FAILED, DDS_SECURITY_ERR_CA_NOT_TRUSTED_MESSAGE);
+      goto err_identity_ca_not_trusted;
     }
+  }
+  if (load_X509_certificate(identityCertPEM, &identityCert, ex) != DDS_SECURITY_VALIDATION_OK)
+    goto err_inv_identity_cert;
 
+  if (load_X509_private_key(privateKeyPEM, password, &privateKey, ex) != DDS_SECURITY_VALIDATION_OK)
+    goto err_inv_private_key;
 
-    /*check for  CA if listed in trusted CA files*/
-    if( implementation->trustedCAList.length != 0 ){
-        const EVP_MD *digest = EVP_get_digestbyname("sha1");
-        uint32_t size;
-        unsigned char hash_buffer[20];
-        unsigned char hash_buffer_trusted[20];
-        result = DDS_SECURITY_VALIDATION_FAILED;
-        X509_digest(identityCA, digest, hash_buffer, &size);
-        for (i = 0; i < implementation->trustedCAList.length; ++i) {
-            X509_digest(implementation->trustedCAList.buffer[i], digest, hash_buffer_trusted, &size);
-            if( memcmp( hash_buffer_trusted, hash_buffer,20 ) == 0){
-                result = DDS_SECURITY_VALIDATION_OK;
-                break;
-            }
-        }
+  if (verify_certificate(identityCert, identityCA, ex) != DDS_SECURITY_VALIDATION_OK)
+    goto err_verification_failed;
 
-        if (result != DDS_SECURITY_VALIDATION_OK) { /*not trusted*/
-            DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_CA_NOT_TRUSTED_CODE, (int)result, DDS_SECURITY_ERR_CA_NOT_TRUSTED_MESSAGE);
-            goto err_identity_ca_not_trusted;
-        }
-    }
-    result = load_X509_certificate(identityCertPEM, &identityCert, ex);
-    if (result != DDS_SECURITY_VALIDATION_OK) {
-        goto err_inv_identity_cert;
-    }
+  if (get_adjusted_participant_guid(identityCert, candidate_participant_guid, adjusted_participant_guid, ex) != DDS_SECURITY_VALIDATION_OK)
+    goto err_adj_guid_failed;
 
-    result = load_X509_private_key(privateKeyPEM, password, &privateKey, ex);
-    if (result != DDS_SECURITY_VALIDATION_OK) {
-        goto err_inv_private_key;
-    }
+  ddsrt_free(password);
+  ddsrt_free(privateKeyPEM);
+  ddsrt_free(identityCaPEM);
+  ddsrt_free(identityCertPEM);
+  ddsrt_free(trusted_ca_dir);
 
-    result = verify_certificate(identityCert, identityCA, ex);
-    if (result != DDS_SECURITY_VALIDATION_OK) {
-        goto err_verification_failed;
-    }
+  identity = local_identity_info_new(domain_id, identityCert, identityCA, privateKey, candidate_participant_guid, adjusted_participant_guid);
+  *local_identity_handle = IDENTITY_HANDLE(identity);
 
-    result = get_adjusted_participant_guid(identityCert, candidate_participant_guid, adjusted_participant_guid, ex);
-    if (result != DDS_SECURITY_VALIDATION_OK) {
-        goto err_adj_guid_failed;
-    }
+  if ((certExpiry = get_certificate_expiry(identityCert)) == DDS_TIME_INVALID)
+  {
+    DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "Expiry date of the certificate is invalid");
+    goto err_verification_failed;
+  }
+  else if (certExpiry != DDS_NEVER)
+    add_validity_end_trigger(implementation, *local_identity_handle, certExpiry);
 
-    ddsrt_free(password);
-    ddsrt_free(privateKeyPEM);
-    ddsrt_free(identityCaPEM);
-    ddsrt_free(identityCertPEM);
-    ddsrt_free(trusted_ca_dir);
-
-    identity = localIdentityInfoNew(domain_id, identityCert, identityCA, privateKey, candidate_participant_guid, adjusted_participant_guid);
-
-    *local_identity_handle = IDENTITY_HANDLE(identity);
-
-    /* setup expiry listener */
-    certExpiry = get_certificate_expiry( identityCert );
-
-    if( certExpiry == DDS_TIME_INVALID ){
-      DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result, "Expiry date of the certificate is invalid");
-      goto err_verification_failed;
-    } else if ( certExpiry != DDS_NEVER ){
-      add_validity_end_trigger( implementation,
-                                *local_identity_handle,
-                                certExpiry);
-    }
-
-
-    ddsrt_mutex_lock(&implementation->lock);
-    (void)ddsrt_hh_add(implementation->objectHash, identity);
-
-    ddsrt_mutex_unlock(&implementation->lock);
-
-    return result;
+  ddsrt_mutex_lock(&implementation->lock);
+  (void)ddsrt_hh_add(implementation->objectHash, identity);
+  ddsrt_mutex_unlock(&implementation->lock);
+  return DDS_SECURITY_VALIDATION_OK;
 
 err_adj_guid_failed:
 err_verification_failed:
-    EVP_PKEY_free(privateKey);
+  EVP_PKEY_free(privateKey);
 err_inv_private_key:
-    X509_free(identityCert);
+  X509_free(identityCert);
 err_inv_identity_cert:
 err_identity_ca_not_trusted:
-    X509_free(identityCA);
+  X509_free(identityCA);
 err_inv_identity_ca:
 err_inv_trusted_ca_dir:
-    ddsrt_free(password);
-    ddsrt_free(privateKeyPEM);
-    ddsrt_free(trusted_ca_dir);
+  ddsrt_free(password);
+  ddsrt_free(privateKeyPEM);
+  ddsrt_free(trusted_ca_dir);
 err_no_private_key:
-    ddsrt_free(identityCaPEM);
+  ddsrt_free(identityCaPEM);
 err_no_identity_ca:
-    ddsrt_free(identityCertPEM);
+  ddsrt_free(identityCertPEM);
 err_no_identity_cert:
 err_bad_param:
-    return DDS_SECURITY_VALIDATION_FAILED;
+  return DDS_SECURITY_VALIDATION_FAILED;
 }
 
-DDS_Security_boolean
-get_identity_token(dds_security_authentication *instance,
-        DDS_Security_IdentityToken *identity_token,
-        const DDS_Security_IdentityHandle handle,
-        DDS_Security_SecurityException *ex)
+DDS_Security_boolean get_identity_token(dds_security_authentication *instance, DDS_Security_IdentityToken *identity_token, const DDS_Security_IdentityHandle handle, DDS_Security_SecurityException *ex)
 {
-    dds_security_authentication_impl *impl = (dds_security_authentication_impl *) instance;
-    SecurityObject *obj;
-    LocalIdentityInfo *identity;
-    char *snCert, *snCA;
+  dds_security_authentication_impl *impl = (dds_security_authentication_impl *)instance;
+  SecurityObject *obj;
+  LocalIdentityInfo *identity;
+  char *snCert, *snCA;
 
-    memset(identity_token, 0, sizeof(*identity_token));
+  if (!instance || !identity_token)
+  {
+    DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "get_identity_token: Invalid parameter provided");
+    goto err_bad_param;
+  }
+  memset(identity_token, 0, sizeof(*identity_token));
 
-    /* validate provided arguments */
-    if (!instance || !identity_token) {
-        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "get_identity_token: Invalid parameter provided");
-        goto err_bad_param;
-    }
+  ddsrt_mutex_lock(&impl->lock);
 
-    ddsrt_mutex_lock(&impl->lock);
+  obj = security_object_find(impl->objectHash, handle);
+  if (!obj || !security_object_valid(obj, SECURITY_OBJECT_KIND_LOCAL_IDENTITY))
+  {
+    DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "get_identity_token: Invalid handle provided");
+    goto err_inv_handle;
+  }
+  identity = (LocalIdentityInfo *)obj;
+  if (!(snCert = get_certificate_subject_name(identity->identityCert, ex)))
+    goto err_sn_cert;
+  if (!(snCA = get_certificate_subject_name(identity->identityCA, ex)))
+    goto err_sn_ca;
 
-    obj = security_object_find(impl->objectHash, handle);
-    if (!obj || !security_object_valid(obj, SECURITY_OBJECT_KIND_LOCAL_IDENTITY)) {
-        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "get_identity_token: Invalid handle provided");
-        goto err_inv_handle;
-    }
-    identity = (LocalIdentityInfo *)obj;
+  identity_token->class_id = get_authentication_class_id();
+  identity_token->properties._length = 4;
+  identity_token->properties._buffer = DDS_Security_PropertySeq_allocbuf(4);
+  identity_token->properties._buffer[0].name = ddsrt_strdup(PROPERTY_CERT_SUBJECT_NAME);
+  identity_token->properties._buffer[0].value = snCert;
+  identity_token->properties._buffer[1].name = ddsrt_strdup(PROPERTY_CERT_ALGORITHM);
+  identity_token->properties._buffer[1].value = ddsrt_strdup(get_authentication_algo(get_authentication_algo_kind(identity->identityCert)));
+  identity_token->properties._buffer[2].name = ddsrt_strdup(PROPERTY_CA_SUBJECT_NAME);
+  identity_token->properties._buffer[2].value = snCA;
+  identity_token->properties._buffer[3].name = ddsrt_strdup(PROPERTY_CA_ALGORITHM);
+  identity_token->properties._buffer[3].value = ddsrt_strdup(get_authentication_algo(get_authentication_algo_kind(identity->identityCA)));
 
-    snCert = get_certificate_subject_name(identity->identityCert, ex);
+  ddsrt_mutex_unlock(&impl->lock);
 
-    if (!snCert) {
-        goto err_sn_cert;
-    }
-
-    snCA = get_certificate_subject_name(identity->identityCA, ex);
-    if (!snCA) {
-        goto err_sn_ca;
-    }
-
-    identity_token->class_id = get_authentication_class_id();
-    identity_token->properties._length = 4;
-    identity_token->properties._buffer = DDS_Security_PropertySeq_allocbuf(4);
-
-    identity_token->properties._buffer[0].name = ddsrt_strdup(PROPERTY_CERT_SUBJECT_NAME);
-    identity_token->properties._buffer[0].value = snCert;
-
-    identity_token->properties._buffer[1].name = ddsrt_strdup(PROPERTY_CERT_ALGORITHM);
-    identity_token->properties._buffer[1].value = ddsrt_strdup(get_authentication_algo(get_auhentication_algo_kind(identity->identityCert)));
-
-    identity_token->properties._buffer[2].name = ddsrt_strdup(PROPERTY_CA_SUBJECT_NAME);
-    identity_token->properties._buffer[2].value = snCA;
-
-    identity_token->properties._buffer[3].name = ddsrt_strdup(PROPERTY_CA_ALGORITHM);
-    identity_token->properties._buffer[3].value = ddsrt_strdup(get_authentication_algo(get_auhentication_algo_kind(identity->identityCA)));
-
-    ddsrt_mutex_unlock(&impl->lock);
-
-    return true;
+  return true;
 
 err_sn_ca:
-    ddsrt_free(snCert);
+  ddsrt_free(snCert);
 err_sn_cert:
 err_inv_handle:
-    ddsrt_mutex_unlock(&impl->lock);
+  ddsrt_mutex_unlock(&impl->lock);
 err_bad_param:
+  return false;
+}
+
+DDS_Security_boolean get_identity_status_token(dds_security_authentication *instance, DDS_Security_IdentityStatusToken *identity_status_token, const DDS_Security_IdentityHandle handle, DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(identity_status_token);
+  DDSRT_UNUSED_ARG(handle);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+  return true;
+}
+
+DDS_Security_boolean set_permissions_credential_and_token(dds_security_authentication *instance, const DDS_Security_IdentityHandle handle,
+    const DDS_Security_PermissionsCredentialToken *permissions_credential, const DDS_Security_PermissionsToken *permissions_token, DDS_Security_SecurityException *ex)
+{
+  dds_security_authentication_impl *impl = (dds_security_authentication_impl *)instance;
+  LocalIdentityInfo *identity;
+
+  if (!instance || handle == DDS_SECURITY_HANDLE_NIL || !permissions_credential || !permissions_token)
+  {
+    DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "get_identity_token: Invalid parameter provided");
     return false;
-}
+  }
 
-DDS_Security_boolean get_identity_status_token(
-        dds_security_authentication *instance,
-        DDS_Security_IdentityStatusToken *identity_status_token,
-        const DDS_Security_IdentityHandle handle,
-        DDS_Security_SecurityException *ex)
-{
-    DDSRT_UNUSED_ARG(identity_status_token);
-    DDSRT_UNUSED_ARG(handle);
-    DDSRT_UNUSED_ARG(ex);
-    DDSRT_UNUSED_ARG(instance);
+  if (!permissions_credential->class_id || strcmp(permissions_credential->class_id, ACCESS_PERMISSIONS_CREDENTIAL_TOKEN_ID) != 0)
+  {
+    DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "get_identity_token: Invalid parameter provided");
+    return false;
+  }
 
-    return true;
-}
-
-DDS_Security_boolean
-set_permissions_credential_and_token(
-        dds_security_authentication *instance,
-        const DDS_Security_IdentityHandle handle,
-        const DDS_Security_PermissionsCredentialToken *permissions_credential,
-        const DDS_Security_PermissionsToken *permissions_token,
-        DDS_Security_SecurityException *ex)
-{
-    dds_security_authentication_impl *impl = (dds_security_authentication_impl *) instance;
-    LocalIdentityInfo *identity;
-
-    /* validate provided arguments */
-    if ((!instance)                         ||
-        (handle == DDS_SECURITY_HANDLE_NIL) ||
-        (!permissions_credential)           ||
-        (!permissions_token)                ){
-        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT,
-                DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "get_identity_token: Invalid parameter provided");
-        return false;
-    }
-
-    if (!permissions_credential->class_id ||
-        (strcmp(permissions_credential->class_id, ACCESS_PERMISSIONS_CREDENTIAL_TOKEN_ID) != 0)) {
-        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT,
-                DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "get_identity_token: Invalid parameter provided");
-        return false;
-    }
-
-    if ((permissions_credential->properties._length == 0) ||
-        (permissions_credential->properties._buffer[0].name == NULL) ||
-        (strcmp(permissions_credential->properties._buffer[0].name, ACCESS_PROPERTY_PERMISSION_DOCUMENT) != 0)) {
-        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT,
-                DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "get_identity_token: Invalid parameter provided");
-        return false;
-    }
-
-    ddsrt_mutex_lock(&impl->lock);
-
-    identity = (LocalIdentityInfo *)security_object_find(impl->objectHash, handle);
-    if (!identity || !SECURITY_OBJECT_VALID(identity, SECURITY_OBJECT_KIND_LOCAL_IDENTITY)) {
-        ddsrt_mutex_unlock(&impl->lock);
-        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "get_identity_token: Invalid handle provided");
-        return false;
-    }
-
-    if (permissions_credential->properties._buffer[0].value) {
-        identity->permissionsDocument = ddsrt_strdup(permissions_credential->properties._buffer[0].value);
-    } else {
-        identity->permissionsDocument = ddsrt_strdup("");
-    }
+  if (permissions_credential->properties._length == 0 || permissions_credential->properties._buffer[0].name == NULL
+      || strcmp(permissions_credential->properties._buffer[0].name, ACCESS_PROPERTY_PERMISSION_DOCUMENT) != 0)
+  {
+    DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "get_identity_token: Invalid parameter provided");
+    return false;
+  }
 
+  ddsrt_mutex_lock(&impl->lock);
+  identity = (LocalIdentityInfo *)security_object_find(impl->objectHash, handle);
+  if (!identity || !SECURITY_OBJECT_VALID(identity, SECURITY_OBJECT_KIND_LOCAL_IDENTITY))
+  {
     ddsrt_mutex_unlock(&impl->lock);
+    DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "get_identity_token: Invalid handle provided");
+    return false;
+  }
+  identity->permissionsDocument = ddsrt_strdup(permissions_credential->properties._buffer[0].value ? permissions_credential->properties._buffer[0].value : "");
+  ddsrt_mutex_unlock(&impl->lock);
 
-    return true;
+  return true;
 }
 
-
-static DDS_Security_ValidationResult_t
-validate_remote_identity_token(
-    const LocalIdentityInfo *localIdent,
-    const DDS_Security_IdentityToken *token,
-    DDS_Security_SecurityException *ex)
+static DDS_Security_ValidationResult_t validate_remote_identity_token(const LocalIdentityInfo *localIdent, const DDS_Security_IdentityToken *token, DDS_Security_SecurityException *ex)
 {
-    DDS_Security_ValidationResult_t result = DDS_SECURITY_VALIDATION_OK;
-
-    DDSRT_UNUSED_ARG(localIdent);
-
-    if (token->class_id) {
-        size_t sz = strlen(AUTH_PROTOCOL_CLASS);
-
-        if (strncmp(AUTH_PROTOCOL_CLASS, token->class_id, sz) == 0) {
-            char *ptr = &token->class_id[sz];
-            char postfix[2];
-            unsigned major, minor;
-
-      DDSRT_WARNING_MSVC_OFF(4996);
-            if (sscanf(ptr, ":%u.%u%1s", &major, &minor, postfix) == 2) {
-      DDSRT_WARNING_MSVC_ON(4996);
-                if (major == AUTH_PROTOCOL_VERSION_MAJOR) {
-                } else {
-                    result = DDS_SECURITY_VALIDATION_FAILED;
-                    DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result, "remote identity token: version %u.%u not supported", major, minor);
-                }
-            } else {
-                result = DDS_SECURITY_VALIDATION_FAILED;
-                DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE,  (int)result, "remote identity token: class_id has wrong format");
-            }
-        } else {
-            result = DDS_SECURITY_VALIDATION_FAILED;
-            DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result, "remote identity token: class_id='%s' not supported", token->class_id);
-        }
-    } else {
-        result = DDS_SECURITY_VALIDATION_FAILED;
-        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result, "remote identity token: class_id is empty");
-    }
-
-    return result;
-}
-
-static DDS_Security_ValidationResult_t
-validate_auth_request_token(
-        const DDS_Security_IdentityToken *token,
-        AuthenticationChallenge **challenge,
-        DDS_Security_SecurityException *ex)
-{
-    uint32_t index;
-    int found = 0;
-
-    assert(token);
-
-    if (!token->class_id) {
-        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED,
-                "AuthRequestMessageToken invalid: missing class_id");
-        goto err_inv_token;
-    }
-
-    if (strncmp(token->class_id, AUTH_REQUEST_TOKEN_CLASS_ID, strlen(AUTH_REQUEST_TOKEN_CLASS_ID)) != 0) {
-        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED,
-                "AuthRequestMessageToken invalid: class_id '%s' is invalid", token->class_id);
-        goto err_inv_token;
-    }
-
-    if (!token->binary_properties._buffer) {
-        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE,  DDS_SECURITY_VALIDATION_FAILED,
-                "AuthRequestMessageToken invalid: properties are missing");
-        goto err_inv_token;
-    }
-
-    for (index = 0; index < token->binary_properties._length; index++) {
-        size_t len = strlen(AUTH_REQUEST_TOKEN_FUTURE_PROP_NAME);
-        if (token->binary_properties._buffer[index].name &&
-            (strncmp(token->binary_properties._buffer[index].name, AUTH_REQUEST_TOKEN_FUTURE_PROP_NAME, len) == 0)) {
-            found = 1;
-            break;
-        }
-    }
-
-    if (!found) {
-        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED,
-                 "AuthRequestMessageToken invalid: future_challenge not found");
-        goto err_inv_token;
-    }
-
-    if (token->binary_properties._buffer[index].value._length != sizeof(AuthenticationChallenge)) {
-        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED,
-                       "AuthRequestMessageToken invalid: future_challenge invalid size");
-        goto err_inv_token;
-    }
-
-    if (!token->binary_properties._buffer[index].value._buffer) {
-        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED,
-                       "AuthRequestMessageToken invalid: future_challenge invalid size");
-        goto err_inv_token;
-    }
-
-    if (challenge) {
-        *challenge = ddsrt_malloc(sizeof(AuthenticationChallenge));
-        memcpy(*challenge, &token->binary_properties._buffer[index].value._buffer[0], sizeof(AuthenticationChallenge));
-    }
-
-    return DDS_SECURITY_VALIDATION_OK;
-
-err_inv_token:
+  DDSRT_UNUSED_ARG(localIdent);
+  if (!token->class_id)
+  {
+    DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "remote identity token: class_id is empty");
     return DDS_SECURITY_VALIDATION_FAILED;
+  }
+
+  size_t sz = strlen(AUTH_PROTOCOL_CLASS);
+  if (strncmp(AUTH_PROTOCOL_CLASS, token->class_id, sz) != 0)
+  {
+    DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "remote identity token: class_id='%s' not supported", token->class_id);
+    return DDS_SECURITY_VALIDATION_FAILED;
+  }
+
+  char *ptr = &token->class_id[sz];
+  unsigned major, minor;
+  char postfix[2];
+  DDSRT_WARNING_MSVC_OFF(4996);
+  if (sscanf(ptr, ":%u.%u%1s", &major, &minor, postfix) != 2)
+  {
+    DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "remote identity token: class_id has wrong format");
+    return DDS_SECURITY_VALIDATION_FAILED;
+  }
+  DDSRT_WARNING_MSVC_ON(4996);
+
+  if (major != AUTH_PROTOCOL_VERSION_MAJOR)
+  {
+    DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "remote identity token: version %u.%u not supported", major, minor);
+    return DDS_SECURITY_VALIDATION_FAILED;
+  }
+
+  return DDS_SECURITY_VALIDATION_OK;
 }
 
-static void
-fill_auth_request_token(
-    DDS_Security_AuthRequestMessageToken *token,
-    AuthenticationChallenge *challenge)
+static DDS_Security_ValidationResult_t validate_auth_request_token(const DDS_Security_IdentityToken *token, AuthenticationChallenge **challenge, DDS_Security_SecurityException *ex)
 {
-    uint32_t len = sizeof(challenge->value);
+  uint32_t index;
+  int found = 0;
+  assert(token);
+  if (!token->class_id)
+  {
+    DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "AuthRequestMessageToken invalid: missing class_id");
+    return DDS_SECURITY_VALIDATION_FAILED;
+  }
+  if (strncmp(token->class_id, AUTH_REQUEST_TOKEN_CLASS_ID, strlen(AUTH_REQUEST_TOKEN_CLASS_ID)) != 0)
+  {
+    DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "AuthRequestMessageToken invalid: class_id '%s' is invalid", token->class_id);
+    return DDS_SECURITY_VALIDATION_FAILED;
+  }
+  if (!token->binary_properties._buffer)
+  {
+    DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "AuthRequestMessageToken invalid: properties are missing");
+    return DDS_SECURITY_VALIDATION_FAILED;
+  }
 
-    DDS_Security_DataHolder_deinit(token);
+  for (index = 0; index < token->binary_properties._length; index++)
+  {
+    size_t len = strlen(AUTH_REQUEST_TOKEN_FUTURE_PROP_NAME);
+    if (token->binary_properties._buffer[index].name && strncmp(token->binary_properties._buffer[index].name, AUTH_REQUEST_TOKEN_FUTURE_PROP_NAME, len) == 0)
+    {
+      found = 1;
+      break;
+    }
+  }
+  if (!found)
+  {
+    DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "AuthRequestMessageToken invalid: future_challenge not found");
+    return DDS_SECURITY_VALIDATION_FAILED;
+  }
 
-    token->class_id = ddsrt_strdup(AUTH_REQUEST_TOKEN_CLASS_ID);
-    token->binary_properties._length = 1;
-    token->binary_properties._buffer = DDS_Security_BinaryPropertySeq_allocbuf(1);
-    token->binary_properties._buffer->name = ddsrt_strdup(AUTH_REQUEST_TOKEN_FUTURE_PROP_NAME);
+  if (token->binary_properties._buffer[index].value._length != sizeof(AuthenticationChallenge)
+      || !token->binary_properties._buffer[index].value._buffer)
+  {
+    DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "AuthRequestMessageToken invalid: future_challenge invalid size");
+    return DDS_SECURITY_VALIDATION_FAILED;
+  }
 
-    token->binary_properties._buffer->value._length = len;
-    token->binary_properties._buffer->value._buffer = ddsrt_malloc(len);
-    memcpy(token->binary_properties._buffer->value._buffer, challenge->value, len);
-    token->binary_properties._buffer->propagate = true;
+  if (challenge)
+  {
+    *challenge = ddsrt_malloc(sizeof(AuthenticationChallenge));
+    memcpy(*challenge, &token->binary_properties._buffer[index].value._buffer[0], sizeof(AuthenticationChallenge));
+  }
 
+  return DDS_SECURITY_VALIDATION_OK;
 }
 
-DDS_Security_ValidationResult_t
-validate_remote_identity(
-        dds_security_authentication *instance,
-        DDS_Security_IdentityHandle *remote_identity_handle,
-        DDS_Security_AuthRequestMessageToken *local_auth_request_token,
-        const DDS_Security_AuthRequestMessageToken *remote_auth_request_token,
-        const DDS_Security_IdentityHandle local_identity_handle,
-        const DDS_Security_IdentityToken *remote_identity_token,
-        const DDS_Security_GUID_t *remote_participant_guid,
-        DDS_Security_SecurityException *ex)
+static void fill_auth_request_token(DDS_Security_AuthRequestMessageToken *token, AuthenticationChallenge *challenge)
 {
-    DDS_Security_ValidationResult_t result = DDS_SECURITY_VALIDATION_OK;
-    dds_security_authentication_impl *impl = (dds_security_authentication_impl *) instance;
-    SecurityObject *obj;
-    LocalIdentityInfo *localIdent;
-    RemoteIdentityInfo *remoteIdent;
-    IdentityRelation *relation;
-    AuthenticationChallenge *lchallenge = NULL, *rchallenge = NULL;
-    int r;
+  uint32_t len = sizeof(challenge->value);
+  DDS_Security_DataHolder_deinit(token);
+  token->class_id = ddsrt_strdup(AUTH_REQUEST_TOKEN_CLASS_ID);
+  token->binary_properties._length = 1;
+  token->binary_properties._buffer = DDS_Security_BinaryPropertySeq_allocbuf(1);
+  token->binary_properties._buffer->name = ddsrt_strdup(AUTH_REQUEST_TOKEN_FUTURE_PROP_NAME);
+  token->binary_properties._buffer->value._length = len;
+  token->binary_properties._buffer->value._buffer = ddsrt_malloc(len);
+  memcpy(token->binary_properties._buffer->value._buffer, challenge->value, len);
+  token->binary_properties._buffer->propagate = true;
+}
 
-    /* validate provided arguments */
-    if (!instance || !remote_identity_handle || !local_auth_request_token || !remote_identity_token || !remote_participant_guid) {
-        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "validate_remote_identity: Invalid parameter provided");
-        goto err_bad_param;
+DDS_Security_ValidationResult_t validate_remote_identity(dds_security_authentication *instance, DDS_Security_IdentityHandle *remote_identity_handle,
+    DDS_Security_AuthRequestMessageToken *local_auth_request_token, const DDS_Security_AuthRequestMessageToken *remote_auth_request_token, const DDS_Security_IdentityHandle local_identity_handle,
+    const DDS_Security_IdentityToken *remote_identity_token, const DDS_Security_GUID_t *remote_participant_guid, DDS_Security_SecurityException *ex)
+{
+  dds_security_authentication_impl *impl = (dds_security_authentication_impl *)instance;
+  SecurityObject *obj;
+  LocalIdentityInfo *localIdent;
+  RemoteIdentityInfo *remoteIdent;
+  IdentityRelation *relation;
+  AuthenticationChallenge *lchallenge = NULL, *rchallenge = NULL;
+
+  if (!instance || !remote_identity_handle || !local_auth_request_token || !remote_identity_token || !remote_participant_guid)
+  {
+    DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "validate_remote_identity: Invalid parameter provided");
+    goto err_bad_param;
+  }
+
+  ddsrt_mutex_lock(&impl->lock);
+  obj = security_object_find(impl->objectHash, local_identity_handle);
+  if (!obj || !security_object_valid(obj, SECURITY_OBJECT_KIND_LOCAL_IDENTITY))
+  {
+    DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "validate_remote_identity: Invalid handle provided");
+    goto err_inv_handle;
+  }
+  localIdent = (LocalIdentityInfo *)obj;
+
+  if (validate_remote_identity_token(localIdent, remote_identity_token, ex) != DDS_SECURITY_VALIDATION_OK)
+    goto err_remote_identity_token;
+
+  /* When the remote_auth_request_token is not null, check if it's contents is valid and set the futureChallenge from the data contained in the remote_auth_request_token. */
+  if (remote_auth_request_token)
+  {
+    if (validate_auth_request_token(remote_auth_request_token, &rchallenge, ex) != DDS_SECURITY_VALIDATION_OK)
+      goto err_inv_auth_req_token;
+  }
+
+  if ((lchallenge = generate_challenge(ex)) == NULL)
+    goto err_alloc_challenge;
+
+  /* The validate_remote_identity will also create a handshake structure which contains the relation between
+     a local an remote identity. This handshake structure is inserted in the remote identity structure. */
+
+  /* Check if the remote identity has already been validated by a previous validation request. */
+  if (!(remoteIdent = find_remote_identity_by_guid(impl->remoteGuidHash, remote_participant_guid)))
+  {
+    remoteIdent = remote_identity_info_new(remote_participant_guid, remote_identity_token);
+    (void)ddsrt_hh_add(impl->objectHash, remoteIdent);
+    (void)ddsrt_hh_add(impl->remoteGuidHash, remoteIdent);
+    relation = identity_relation_new(localIdent, remoteIdent, lchallenge, rchallenge);
+    (void)ddsrt_hh_add(remoteIdent->linkHash, relation);
+  }
+  else
+  {
+    /* When the remote identity has already been validated before, check if the remote identity token matches with the existing one */
+    if (!DDS_Security_DataHolder_equal(remoteIdent->remoteIdentityToken, remote_identity_token))
+    {
+      DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "validate_remote_identity: remote_identity_token does not match with previously received one");
+      goto err_inv_duplicate;
     }
 
-    ddsrt_mutex_lock(&impl->lock);
-
-    obj = security_object_find(impl->objectHash, local_identity_handle);
-    if (!obj || !security_object_valid(obj, SECURITY_OBJECT_KIND_LOCAL_IDENTITY)) {
-        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "validate_remote_identity: Invalid handle provided");
-        goto err_inv_handle;
+    if (!(relation = find_identity_relation(remoteIdent, SECURITY_OBJECT_HANDLE(localIdent))))
+    {
+      relation = identity_relation_new(localIdent, remoteIdent, lchallenge, rchallenge);
+      int r = ddsrt_hh_add(remoteIdent->linkHash, relation);
+      assert(r);
+      (void)r;
     }
-    localIdent = (LocalIdentityInfo *) obj;
-
-    /* Check if the provided remote_identity_token is compatible */
-    result = validate_remote_identity_token(localIdent, remote_identity_token, ex);
-    if (result != DDS_SECURITY_VALIDATION_OK) {
-        goto err_remote_identity_token;
+    else
+    {
+      if (remote_auth_request_token)
+      {
+        assert(rchallenge);
+        ddsrt_free(relation->rchallenge);
+        relation->rchallenge = rchallenge;
+      }
+      ddsrt_free(lchallenge);
     }
+  }
 
-    /* When the remote_auth_request_token is not null, check if it's contents is valid and
-     * set the futureChallenge from the data contained in the remote_auth_request_token.
-     */
-    if (remote_auth_request_token) {
-        result  = validate_auth_request_token(remote_auth_request_token, &rchallenge, ex);
-        if (result != DDS_SECURITY_VALIDATION_OK) {
-            goto err_inv_auth_req_token;
-        }
-    }
+  ddsrt_mutex_unlock(&impl->lock);
 
-    if ((lchallenge = generate_challenge(ex)) == NULL) {
-        goto err_alloc_challenge;
-    }
+  if (!remote_auth_request_token)
+  {
+    /* Create local_auth_request_token with contents set to the challenge */
+    fill_auth_request_token(local_auth_request_token, relation->lchallenge);
+  }
+  else
+  {
+    /* Set local_auth_request token to TokenNil */
+    DDS_Security_set_token_nil(local_auth_request_token);
+  }
 
-    /* The validate_remote_identity will also create a handshake structure which contains the
-     * relation between an local an remote identity. This handshake structure is inserted in
-     * the remote identity structure.
-     */
-
-    /* Check if the remote identity has already been validated by a previous validation request. */
-    remoteIdent = find_remote_identity_by_guid(impl->remoteGuidHash, remote_participant_guid);
-    if (!remoteIdent) {
-        remoteIdent = remoteIdentityInfoNew(remote_participant_guid, remote_identity_token);
-        (void)ddsrt_hh_add(impl->objectHash, remoteIdent);
-        (void)ddsrt_hh_add(impl->remoteGuidHash, remoteIdent);
-        relation = identityRelationNew(localIdent, remoteIdent, lchallenge, rchallenge);
-        (void)ddsrt_hh_add(remoteIdent->linkHash, relation);
-    } else {
-        /* When the remote identity has already been validated before,
-           check if the remote identity token matches with the existing one
-         */
-        if (!DDS_Security_DataHolder_equal(remoteIdent->remoteIdentityToken, remote_identity_token)) {
-            result = DDS_SECURITY_VALIDATION_FAILED;
-            DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result,
-                    "validate_remote_identity: remote_identity_token does not match with previously received one");
-            goto err_inv_duplicate;
-        }
-
-        relation = find_identity_relation(remoteIdent, SECURITY_OBJECT_HANDLE(localIdent));
-        if (!relation) {
-            relation = identityRelationNew(localIdent, remoteIdent, lchallenge, rchallenge);
-            r = ddsrt_hh_add(remoteIdent->linkHash, relation);
-            assert(r);
-            (void)r;
-        } else {
-            if (remote_auth_request_token) {
-                assert(rchallenge);
-                ddsrt_free(relation->rchallenge);
-                relation->rchallenge = rchallenge;
-            }
-            ddsrt_free(lchallenge);
-        }
-    }
-
-    ddsrt_mutex_unlock(&impl->lock);
-
-    if (!remote_auth_request_token) {
-        /* Create local_auth_request_token with contents set to the challenge */
-        fill_auth_request_token(local_auth_request_token, relation->lchallenge);
-    } else {
-        /* Set local_auth_request token to TokenNil */
-        DDS_Security_set_token_nil(local_auth_request_token);
-    }
-
-    *remote_identity_handle = IDENTITY_HANDLE(remoteIdent);;
-
-    if (memcmp(&localIdent->adjustedGUID, &remoteIdent->guid, sizeof(DDS_Security_GUID_t)) < 0) {
-        result = DDS_SECURITY_VALIDATION_PENDING_HANDSHAKE_REQUEST;
-    } else {
-        result = DDS_SECURITY_VALIDATION_PENDING_HANDSHAKE_MESSAGE;
-    }
-
-    return result;
+  *remote_identity_handle = IDENTITY_HANDLE(remoteIdent);
+  return memcmp(&localIdent->adjustedGUID, &remoteIdent->guid, sizeof(DDS_Security_GUID_t)) < 0 ?
+    DDS_SECURITY_VALIDATION_PENDING_HANDSHAKE_REQUEST : DDS_SECURITY_VALIDATION_PENDING_HANDSHAKE_MESSAGE;
 
 err_inv_duplicate:
-    ddsrt_free(lchallenge);
+  ddsrt_free(lchallenge);
 err_alloc_challenge:
-    ddsrt_free(rchallenge);
+  ddsrt_free(rchallenge);
 err_inv_auth_req_token:
 err_remote_identity_token:
 err_inv_handle:
-    ddsrt_mutex_unlock(&impl->lock);
+  ddsrt_mutex_unlock(&impl->lock);
 err_bad_param:
-    return DDS_SECURITY_VALIDATION_FAILED;
+  return DDS_SECURITY_VALIDATION_FAILED;
 }
 
-DDS_Security_ValidationResult_t
-begin_handshake_request(
-        dds_security_authentication *instance,
-        DDS_Security_HandshakeHandle *handshake_handle,
-        DDS_Security_HandshakeMessageToken *handshake_message,
-        const DDS_Security_IdentityHandle initiator_identity_handle,
-        const DDS_Security_IdentityHandle replier_identity_handle,
-        const DDS_Security_OctetSeq *serialized_local_participant_data,
-        DDS_Security_SecurityException *ex)
+DDS_Security_ValidationResult_t begin_handshake_request(dds_security_authentication *instance, DDS_Security_HandshakeHandle *handshake_handle,
+    DDS_Security_HandshakeMessageToken *handshake_message, const DDS_Security_IdentityHandle initiator_identity_handle, const DDS_Security_IdentityHandle replier_identity_handle,
+    const DDS_Security_OctetSeq *serialized_local_participant_data, DDS_Security_SecurityException *ex)
 {
-    DDS_Security_ValidationResult_t result = DDS_SECURITY_VALIDATION_OK;
-    dds_security_authentication_impl *impl = (dds_security_authentication_impl *) instance;
-    HandshakeInfo *handshake = NULL;
-    IdentityRelation *relation = NULL;
-    SecurityObject *obj;
-    LocalIdentityInfo *localIdent;
-    RemoteIdentityInfo *remoteIdent;
-    EVP_PKEY *dhkey;
-    DDS_Security_BinaryProperty_t *tokens;
-    DDS_Security_BinaryProperty_t *c_id;
-    DDS_Security_BinaryProperty_t *c_perm;
-    DDS_Security_BinaryProperty_t *c_pdata;
-    DDS_Security_BinaryProperty_t *c_dsign_algo;
-    DDS_Security_BinaryProperty_t *c_kagree_algo;
-    DDS_Security_BinaryProperty_t *hash_c1;
-    DDS_Security_BinaryProperty_t *dh1;
-    DDS_Security_BinaryProperty_t *challenge;
-    unsigned char *certData;
-    unsigned char *dhPubKeyData = NULL;
-    uint32_t certDataSize, dhPubKeyDataSize;
-    int created = 0;
+  dds_security_authentication_impl *impl = (dds_security_authentication_impl *)instance;
+  HandshakeInfo *handshake = NULL;
+  IdentityRelation *relation = NULL;
+  SecurityObject *obj;
+  LocalIdentityInfo *localIdent;
+  RemoteIdentityInfo *remoteIdent;
+  EVP_PKEY *dhkey;
+  DDS_Security_BinaryProperty_t *tokens, *c_id, *c_perm, *c_pdata, *c_dsign_algo, *c_kagree_algo, *hash_c1, *dh1, *challenge;
+  unsigned char *certData, *dhPubKeyData = NULL;
+  uint32_t certDataSize, dhPubKeyDataSize;
+  int created = 0;
 
-    /* validate provided arguments */
-    if (!instance || !handshake_handle || !handshake_message || !serialized_local_participant_data) {
-        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED,
-                "begin_handshake_request: Invalid parameter provided");
-        goto err_bad_param;
-    }
+  if (!instance || !handshake_handle || !handshake_message || !serialized_local_participant_data)
+  {
+    DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "begin_handshake_request: Invalid parameter provided");
+    goto err_bad_param;
+  }
 
-    ddsrt_mutex_lock(&impl->lock);
+  ddsrt_mutex_lock(&impl->lock);
 
-    obj = security_object_find(impl->objectHash, initiator_identity_handle);
-    if (!obj || !security_object_valid(obj, SECURITY_OBJECT_KIND_LOCAL_IDENTITY)) {
-        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED,
-                "begin_handshake_request: Invalid initiator_identity_handle provided");
-        goto err_inv_handle;
-    }
-    localIdent = (LocalIdentityInfo *) obj;
+  obj = security_object_find(impl->objectHash, initiator_identity_handle);
+  if (!obj || !security_object_valid(obj, SECURITY_OBJECT_KIND_LOCAL_IDENTITY))
+  {
+    DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "begin_handshake_request: Invalid initiator_identity_handle provided");
+    goto err_inv_handle;
+  }
+  localIdent = (LocalIdentityInfo *)obj;
 
-    obj = security_object_find(impl->objectHash, replier_identity_handle);
-    if (!obj || !security_object_valid(obj, SECURITY_OBJECT_KIND_REMOTE_IDENTITY)) {
-        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED,
-                "begin_handshake_request: Invalid replier_identity_handle provided");
-        goto err_inv_handle;
-    }
-    remoteIdent = (RemoteIdentityInfo *)obj;
+  obj = security_object_find(impl->objectHash, replier_identity_handle);
+  if (!obj || !security_object_valid(obj, SECURITY_OBJECT_KIND_REMOTE_IDENTITY))
+  {
+    DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "begin_handshake_request: Invalid replier_identity_handle provided");
+    goto err_inv_handle;
+  }
+  remoteIdent = (RemoteIdentityInfo *)obj;
 
-    result = get_certificate_contents(localIdent->identityCert, &certData, &certDataSize, ex);
-    if (result != DDS_SECURITY_VALIDATION_OK) {
-        goto err_alloc_cid;
-    }
-
-    handshake = find_handshake(impl, SECURITY_OBJECT_HANDLE(localIdent), SECURITY_OBJECT_HANDLE(remoteIdent));
-    if (!handshake) {
-        relation = find_identity_relation(remoteIdent, SECURITY_OBJECT_HANDLE(localIdent));
-        assert(relation);
-        handshake = handshakeInfoNew(localIdent, remoteIdent, relation);
-        handshake->created_in = CREATEDREQUEST;
-        (void)ddsrt_hh_add(impl->objectHash, handshake);
-        created = 1;
-    } else {
-        relation = handshake->relation;
-        assert(relation);
-    }
-
-    if (!handshake->ldh) {
-        result = generate_dh_keys(&dhkey, localIdent->kagreeAlgoKind, ex);
-        if (result != DDS_SECURITY_VALIDATION_OK) {
-            goto err_gen_dh_keys;
-        }
-
-        handshake->ldh = dhkey;
-    }
-
-    result = dh_public_key_to_oct(handshake->ldh, localIdent->kagreeAlgoKind, &dhPubKeyData, &dhPubKeyDataSize, ex);
-    if (result != DDS_SECURITY_VALIDATION_OK) {
-        goto err_get_public_key;
-    }
-
-    if (localIdent->pdata._length == 0) {
-        DDS_Security_OctetSeq_copy(&localIdent->pdata, serialized_local_participant_data);
-    }
-
-    tokens = DDS_Security_BinaryPropertySeq_allocbuf(8);
-    c_id = &tokens[0];
-    c_perm = &tokens[1];
-    c_pdata = &tokens[2];
-    c_dsign_algo = &tokens[3];
-    c_kagree_algo = &tokens[4];
-    hash_c1 = &tokens[5];
-    dh1 = &tokens[6];
-    challenge = &tokens[7];
-
-    /* Store the Identity Certificate associated with the local identify in c.id property */
-    DDS_Security_BinaryProperty_set_by_ref(c_id, "c.id", certData, certDataSize);
-
-    /* Store the permission document in the c.perm property */
-    if (localIdent->permissionsDocument) {
-        DDS_Security_BinaryProperty_set_by_string(c_perm, "c.perm", localIdent->permissionsDocument);
-    } else {
-      DDS_Security_BinaryProperty_set_by_string(c_perm, "c.perm", "");
-    }
-
-    /* Store the provided local_participant_data in the c.pdata property */
-    DDS_Security_BinaryProperty_set_by_value(c_pdata, "c.pdata", serialized_local_participant_data->_buffer, serialized_local_participant_data->_length);
-
-    /* Set the used signing algorithm descriptor in c.dsign_algo */
-    DDS_Security_BinaryProperty_set_by_string(c_dsign_algo, "c.dsign_algo", get_dsign_algo(localIdent->dsignAlgoKind));
-
-    /* Set the used key algorithm descriptor in c.kagree_algo */
-    DDS_Security_BinaryProperty_set_by_string(c_kagree_algo, "c.kagree_algo", get_kagree_algo(localIdent->kagreeAlgoKind));
-
-    /* Calculate the hash_c1 */
-    {
-        DDS_Security_BinaryPropertySeq bseq;
-
-        bseq._length = 5;
-        bseq._buffer = tokens;
-
-        get_hash_binary_property_seq(&bseq, handshake->hash_c1);
-        DDS_Security_BinaryProperty_set_by_value(hash_c1, "hash_c1", handshake->hash_c1, sizeof(HashValue_t));
-    }
-
-    /* Set the DH public key associated with the local participant in dh1 property */
-    assert(dhPubKeyData);
-    assert(dhPubKeyDataSize < 1200);
-    DDS_Security_BinaryProperty_set_by_ref(dh1, "dh1", dhPubKeyData, dhPubKeyDataSize);
-
-    /* Set the challenge in challenge1 property */
-    DDS_Security_BinaryProperty_set_by_value(challenge, "challenge1", relation->lchallenge->value, sizeof(AuthenticationChallenge));
+  if (get_certificate_contents(localIdent->identityCert, &certData, &certDataSize, ex) != DDS_SECURITY_VALIDATION_OK)
+    goto err_alloc_cid;
 
+  if (!(handshake = find_handshake(impl, SECURITY_OBJECT_HANDLE(localIdent), SECURITY_OBJECT_HANDLE(remoteIdent))))
+  {
+    relation = find_identity_relation(remoteIdent, SECURITY_OBJECT_HANDLE(localIdent));
+    assert(relation);
+    handshake = handshake_info_new(localIdent, remoteIdent, relation);
+    handshake->created_in = CREATEDREQUEST;
     (void)ddsrt_hh_add(impl->objectHash, handshake);
+    created = 1;
+  }
+  else
+  {
+    relation = handshake->relation;
+    assert(relation);
+  }
 
-    ddsrt_mutex_unlock(&impl->lock);
+  if (!handshake->ldh)
+  {
+    if (generate_dh_keys(&dhkey, localIdent->kagreeAlgoKind, ex) != DDS_SECURITY_VALIDATION_OK)
+      goto err_gen_dh_keys;
+    handshake->ldh = dhkey;
+  }
 
-    handshake_message->class_id = ddsrt_strdup(AUTH_HANDSHAKE_REQUEST_TOKEN_ID);
-    handshake_message->properties._length  = 0;
-    handshake_message->properties._buffer  = NULL;
-    handshake_message->binary_properties._length = 8;
-    handshake_message->binary_properties._buffer = tokens;
-    *handshake_handle = HANDSHAKE_HANDLE(handshake);
+  if (dh_public_key_to_oct(handshake->ldh, localIdent->kagreeAlgoKind, &dhPubKeyData, &dhPubKeyDataSize, ex) != DDS_SECURITY_VALIDATION_OK)
+    goto err_get_public_key;
 
-    return DDS_SECURITY_VALIDATION_PENDING_HANDSHAKE_MESSAGE;
+  if (localIdent->pdata._length == 0)
+    DDS_Security_OctetSeq_copy(&localIdent->pdata, serialized_local_participant_data);
+
+  tokens = DDS_Security_BinaryPropertySeq_allocbuf(8);
+  c_id = &tokens[0];
+  c_perm = &tokens[1];
+  c_pdata = &tokens[2];
+  c_dsign_algo = &tokens[3];
+  c_kagree_algo = &tokens[4];
+  hash_c1 = &tokens[5];
+  dh1 = &tokens[6];
+  challenge = &tokens[7];
+
+  DDS_Security_BinaryProperty_set_by_ref(c_id, "c.id", certData, certDataSize);
+  DDS_Security_BinaryProperty_set_by_string(c_perm, "c.perm", localIdent->permissionsDocument ? localIdent->permissionsDocument : "");
+  DDS_Security_BinaryProperty_set_by_value(c_pdata, "c.pdata", serialized_local_participant_data->_buffer, serialized_local_participant_data->_length);
+  DDS_Security_BinaryProperty_set_by_string(c_dsign_algo, "c.dsign_algo", get_dsign_algo(localIdent->dsignAlgoKind));
+  DDS_Security_BinaryProperty_set_by_string(c_kagree_algo, "c.kagree_algo", get_kagree_algo(localIdent->kagreeAlgoKind));
+
+  {
+    DDS_Security_BinaryPropertySeq bseq = { ._length = 5, ._buffer = tokens };
+    get_hash_binary_property_seq(&bseq, handshake->hash_c1);
+    DDS_Security_BinaryProperty_set_by_value(hash_c1, "hash_c1", handshake->hash_c1, sizeof(HashValue_t));
+  }
+
+  /* Set the DH public key associated with the local participant in dh1 property */
+  assert(dhPubKeyData);
+  assert(dhPubKeyDataSize < 1200);
+  DDS_Security_BinaryProperty_set_by_ref(dh1, "dh1", dhPubKeyData, dhPubKeyDataSize);
+
+  /* Set the challenge in challenge1 property */
+  DDS_Security_BinaryProperty_set_by_value(challenge, "challenge1", relation->lchallenge->value, sizeof(AuthenticationChallenge));
+
+  (void)ddsrt_hh_add(impl->objectHash, handshake);
+
+  ddsrt_mutex_unlock(&impl->lock);
+
+  handshake_message->class_id = ddsrt_strdup(AUTH_HANDSHAKE_REQUEST_TOKEN_ID);
+  handshake_message->properties._length = 0;
+  handshake_message->properties._buffer = NULL;
+  handshake_message->binary_properties._length = 8;
+  handshake_message->binary_properties._buffer = tokens;
+  *handshake_handle = HANDSHAKE_HANDLE(handshake);
+
+  return DDS_SECURITY_VALIDATION_PENDING_HANDSHAKE_MESSAGE;
 
 err_get_public_key:
 err_gen_dh_keys:
-    if (created) {
-        (void)ddsrt_hh_remove(impl->objectHash, handshake);
-        security_object_free((SecurityObject *)handshake);
-    }
+  if (created)
+  {
+    (void)ddsrt_hh_remove(impl->objectHash, handshake);
+    security_object_free((SecurityObject *)handshake);
+  }
 err_alloc_cid:
-    ddsrt_free(certData);
+  ddsrt_free(certData);
 err_inv_handle:
-    ddsrt_mutex_unlock(&impl->lock);
+  ddsrt_mutex_unlock(&impl->lock);
 err_bad_param:
-    return DDS_SECURITY_VALIDATION_FAILED;
+  return DDS_SECURITY_VALIDATION_FAILED;
 }
 
-static DDS_Security_ValidationResult_t
-validate_pdata(
-    const DDS_Security_OctetSeq *seq,
-    X509 *cert,
-    DDS_Security_SecurityException *ex)
+static DDS_Security_ValidationResult_t validate_pdata(const DDS_Security_OctetSeq *seq, X509 *cert, DDS_Security_SecurityException *ex)
 {
-    DDS_Security_ValidationResult_t result = DDS_SECURITY_VALIDATION_OK;
-    DDS_Security_Deserializer deserializer;
-    DDS_Security_ParticipantBuiltinTopicData *pdata;
-    DDS_Security_GUID_t cguid, aguid;
+  DDS_Security_ParticipantBuiltinTopicData *pdata;
+  DDS_Security_GUID_t cguid, aguid;
+  DDS_Security_Deserializer deserializer = DDS_Security_Deserializer_new(seq->_buffer, seq->_length);
+  if (!deserializer)
+  {
+    DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "begin_handshake_reply: c.pdata invalid encoding");
+    goto failed_deser;
+  }
 
-    deserializer = DDS_Security_Deserializer_new(seq->_buffer, seq->_length);
-    if (!deserializer) {
-        result = DDS_SECURITY_VALIDATION_FAILED;
-        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result,
-                "begin_handshake_reply: c.pdata invalid encoding");
-        goto err_invalid_data;
-    }
+  pdata = DDS_Security_ParticipantBuiltinTopicData_alloc();
+  if (!DDS_Security_Deserialize_ParticipantBuiltinTopicData(deserializer, pdata, ex))
+    goto failed;
 
-    pdata = DDS_Security_ParticipantBuiltinTopicData_alloc();
+  memset(&cguid, 0, sizeof(DDS_Security_GUID_t));
+  if (get_adjusted_participant_guid(cert, &cguid, &aguid, ex) != DDS_SECURITY_VALIDATION_OK)
+    goto failed;
 
-    if (!DDS_Security_Deserialize_ParticipantBuiltinTopicData(deserializer, pdata, ex)) {
-        result = DDS_SECURITY_VALIDATION_FAILED;
-        goto err_incorrect_data;
-    }
+  DDS_Security_BuiltinTopicKey_t key;
+  DDS_Security_BuiltinTopicKeyBE(key, pdata->key);
+  if (memcmp(key, aguid.prefix, 6) != 0)
+  {
+    DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "begin_handshake_reply: c.pdata contains incorrect participant guid");
+    goto failed;
+  }
+  DDS_Security_ParticipantBuiltinTopicData_free(pdata);
+  DDS_Security_Deserializer_free(deserializer);
+  return DDS_SECURITY_VALIDATION_OK;
 
-    memset(&cguid, 0, sizeof(DDS_Security_GUID_t));
-    result = get_adjusted_participant_guid(cert, &cguid, &aguid, ex);
-    if (result == DDS_SECURITY_VALIDATION_OK) {
-        DDS_Security_BuiltinTopicKey_t key;
-        DDS_Security_BuiltinTopicKeyBE(key, pdata->key);
-        if (memcmp(key, aguid.prefix, 6) != 0) {
-            result = DDS_SECURITY_VALIDATION_FAILED;
-              DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result,
-                      "begin_handshake_reply: c.pdata contains incorrect participant guid");
-        }
-    }
-
-err_incorrect_data:
-    DDS_Security_ParticipantBuiltinTopicData_free(pdata);
-    DDS_Security_Deserializer_free(deserializer);
-err_invalid_data:
-    return result;
+failed:
+  DDS_Security_ParticipantBuiltinTopicData_free(pdata);
+  DDS_Security_Deserializer_free(deserializer);
+failed_deser:
+  return DDS_SECURITY_VALIDATION_FAILED;
 }
 
-static DDS_Security_ValidationResult_t
-validate_handshake_request_token(
-    const DDS_Security_HandshakeMessageToken *token,
-    HandshakeInfo *handshake,
-    X509Seq *trusted_ca_list,
-    DDS_Security_SecurityException *ex)
+static DDS_Security_ValidationResult_t validate_handshake_request_token(const DDS_Security_HandshakeMessageToken *token, HandshakeInfo *handshake, X509Seq *trusted_ca_list, DDS_Security_SecurityException *ex)
 {
+  IdentityRelation *relation = handshake->relation;
+  X509 *identityCert;
+  const DDS_Security_BinaryProperty_t *c_id, *c_perm, *c_pdata, *c_dsign_algo, *c_kagree_algo, *dh1, *challenge, *hash_c1;
+  EVP_PKEY *pdhkey = NULL;
+  AuthenticationAlgoKind_t dsignAlgoKind, kagreeAlgoKind;
+
+  assert(relation);
+
+  if (!token->class_id || strncmp(AUTH_HANDSHAKE_REQUEST_TOKEN_ID, token->class_id, strlen(AUTH_HANDSHAKE_REQUEST_TOKEN_ID)) != 0)
+  {
+    DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "begin_handshake_reply: HandshakeMessageToken incorrect class_id: %s (expected %s)", token->class_id ? token->class_id : "NULL", AUTH_HANDSHAKE_REQUEST_TOKEN_ID);
+    goto err_inv_class_id;
+  }
+
+  /* Check presents of mandatory properties: c.i, c.perm, c.pdata, c.dsign_algo, c.kagree_algo, dh1, challenge1 */
+  c_id = DDS_Security_DataHolder_find_binary_property(token, "c.id");
+  if (!c_id || c_id->value._length == 0 || c_id->value._buffer == NULL)
+  {
+    DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "begin_handshake_reply: HandshakeMessageToken property c.id missing");
+    goto err_no_c_id;
+  }
+
+  if (load_X509_certificate_from_data((char *)c_id->value._buffer, (int)c_id->value._length, &identityCert, ex) != DDS_SECURITY_VALIDATION_OK)
+    goto err_identity_cert_load;
+
+  {
     DDS_Security_ValidationResult_t result = DDS_SECURITY_VALIDATION_OK;
-    IdentityRelation *relation = handshake->relation;
-    X509 *identityCert;
-    const DDS_Security_BinaryProperty_t *c_id;
-    const DDS_Security_BinaryProperty_t *c_perm;
-    const DDS_Security_BinaryProperty_t *c_pdata;
-    const DDS_Security_BinaryProperty_t *c_dsign_algo;
-    const DDS_Security_BinaryProperty_t *c_kagree_algo;
-    const DDS_Security_BinaryProperty_t *dh1;
-    const DDS_Security_BinaryProperty_t *challenge;
-    const DDS_Security_BinaryProperty_t *hash_c1;
-    EVP_PKEY *pdhkey = NULL;
-    AuthenticationAlgoKind_t dsignAlgoKind;
-    AuthenticationAlgoKind_t kagreeAlgoKind;
-    unsigned i;
-
-    assert(relation);
-
-    /* Check class_id */
-    if (!token->class_id ||
-        (strncmp(AUTH_HANDSHAKE_REQUEST_TOKEN_ID, token->class_id, strlen(AUTH_HANDSHAKE_REQUEST_TOKEN_ID)) != 0)) {
-        result = DDS_SECURITY_VALIDATION_FAILED;
-        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result,
-                "begin_handshake_reply: HandshakeMessageToken incorrect class_id: %s (expected %s)", token->class_id ? token->class_id: "NULL", AUTH_HANDSHAKE_REQUEST_TOKEN_ID);
-        goto err_inv_class_id;
-    }
-
-    /* Check presents of mandatory properties
-     * - c.id
-     * - c.perm
-     * - c.pdata
-     * - c.dsign_algo
-     * - c.kagree_algo
-     * - dh1
-     * - challenge1
-     */
-    c_id = DDS_Security_DataHolder_find_binary_property(token, "c.id");
-    if (!c_id || (c_id->value._length == 0) || (c_id->value._buffer == NULL)) {
-        result = DDS_SECURITY_VALIDATION_FAILED;
-        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result,
-                "begin_handshake_reply: HandshakeMessageToken property c.id missing");
-        goto err_no_c_id;
-    }
-
-    result = load_X509_certificate_from_data((char*)c_id->value._buffer, (int)c_id->value._length, &identityCert, ex);
-    if (result != DDS_SECURITY_VALIDATION_OK) {
-        goto err_identity_cert_load;
-    }
-
-    if( trusted_ca_list->length == 0 ){ //no trusted set. check with local CA
-        result = verify_certificate(identityCert, relation->localIdentity->identityCA, ex);
-    }
-    else{
-        /* Make sure we have a clean exception, in case it was uninitialized. */
-        DDS_Security_Exception_clean(ex);
-        for (i = 0; i < trusted_ca_list->length; ++i) {
-            /* We'll only return the exception of the last one, if it failed. */
-            DDS_Security_Exception_reset(ex);
-            result = verify_certificate(identityCert, trusted_ca_list->buffer[i], ex);
-            if (result == DDS_SECURITY_VALIDATION_OK) {
-                break;
-            }
-        }
-    }
-
-    if (result != DDS_SECURITY_VALIDATION_OK) {
-        goto err_inv_identity_cert;
-    }
-
-    result = check_certificate_expiry( identityCert, ex);
-    if (result != DDS_SECURITY_VALIDATION_OK) {
-        goto err_inv_identity_cert;
-    }
-
-    c_perm = DDS_Security_DataHolder_find_binary_property(token, "c.perm");
-    if (!c_perm) {
-        result = DDS_SECURITY_VALIDATION_FAILED;
-        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result,
-                "begin_handshake_reply: HandshakeMessageToken property c.perm missing");
-        goto err_no_c_perm;
-    }
-
-    if (c_perm->value._length > 0) {
-        ddsrt_free(relation->remoteIdentity->permissionsDocument);
-        relation->remoteIdentity->permissionsDocument = string_from_data(c_perm->value._buffer, c_perm->value._length);
-    }
-
-    c_pdata = DDS_Security_DataHolder_find_binary_property(token, "c.pdata");
-    if (!c_pdata) {
-        result = DDS_SECURITY_VALIDATION_FAILED;
-        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result,
-                "begin_handshake_reply: HandshakeMessageToken property c.pdata missing");
-        goto err_no_c_pdata;
-    }
-
-    result = validate_pdata(&c_pdata->value, identityCert, ex);
-    if (result != DDS_SECURITY_VALIDATION_OK) {
-        goto err_inv_pdata;
-    }
-
-    c_dsign_algo = DDS_Security_DataHolder_find_binary_property(token, "c.dsign_algo");
-    if (!c_dsign_algo) {
-        result = DDS_SECURITY_VALIDATION_FAILED;
-        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result,
-                "begin_handshake_reply: HandshakeMessageToken property c.dsign_algo missing");
-        goto err_no_c_dsign_algo;
-    }
-
-    dsignAlgoKind = get_dsign_algo_from_string((const char *)c_dsign_algo->value._buffer);
-    if (dsignAlgoKind == AUTH_ALGO_KIND_UNKNOWN) {
-        result = DDS_SECURITY_VALIDATION_FAILED;
-        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result,
-                "begin_handshake_reply: HandshakeMessageToken property c.dsign_algo not supported");
-        goto err_no_c_dsign_algo;
-    }
-
-    c_kagree_algo = DDS_Security_DataHolder_find_binary_property(token, "c.kagree_algo");
-    if (!c_kagree_algo) {
-        result = DDS_SECURITY_VALIDATION_FAILED;
-        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result,
-                "begin_handshake_reply: HandshakeMessageToken property c.kagree_algo missing");
-        goto err_no_c_kagree_algo;
-    }
-
-    kagreeAlgoKind = get_kagree_algo_from_string((const char *)c_kagree_algo->value._buffer);
-    if (kagreeAlgoKind == AUTH_ALGO_KIND_UNKNOWN) {
-        result = DDS_SECURITY_VALIDATION_FAILED;
-        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result,
-                "begin_handshake_reply: HandshakeMessageToken property c.kagree_algo not support");
-        goto err_no_c_kagree_algo;
-    }
-
-    dh1 = DDS_Security_DataHolder_find_binary_property(token, "dh1");
-    if (!dh1 || dh1->value._length == 0 || dh1->value._buffer == NULL) {
-        result = DDS_SECURITY_VALIDATION_FAILED;
-        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result,
-                "begin_handshake_reply: HandshakeMessageToken property dh1 missing");
-        goto err_no_dh;
-    }
-
-    result = dh_oct_to_public_key(&pdhkey, kagreeAlgoKind, dh1->value._buffer, dh1->value._length, ex);
-    if (result != DDS_SECURITY_VALIDATION_OK) {
-        goto err_no_dh;
-    }
-
-    challenge = DDS_Security_DataHolder_find_binary_property(token, "challenge1");
-    if (!challenge) {
-        result = DDS_SECURITY_VALIDATION_FAILED;
-        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result,
-                "begin_handshake_reply: HandshakeMessageToken property challenge1 missing");
-        goto err_no_challenge;
-    }
-
-    if (challenge->value._length != sizeof(AuthenticationChallenge) || challenge->value._buffer == NULL) {
-        result = DDS_SECURITY_VALIDATION_FAILED;
-        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result,
-                "begin_handshake_reply: HandshakeMessageToken property challenge1 invalid");
-        goto err_no_challenge;
-    }
-
-    /* When validate_remote_identity was provided with a remote_auth_request_token
-     * then the future_challenge in the remote identity was set and the challenge1
-     * property of the handshake_request_token should be the same as the
-     * future_challenge stored in the remote identity.
-     */
-    if (relation->rchallenge) {
-        if (memcmp(relation->rchallenge->value, challenge->value._buffer, sizeof(AuthenticationChallenge)) != 0) {
-            result = DDS_SECURITY_VALIDATION_FAILED;
-             DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result,
-                     "begin_handshake_reply: HandshakeMessageToken property challenge1 does not match future_challenge");
-             goto err_no_challenge;
-        }
-    } else {
-        if (challenge->value._length == sizeof(relation->rchallenge->value)) {
-            relation->rchallenge = ddsrt_malloc(sizeof(AuthenticationChallenge));
-            memcpy(relation->rchallenge, challenge->value._buffer, challenge->value._length);
-        } else {
-            result = DDS_SECURITY_VALIDATION_FAILED;
-            DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result,
-                    "begin_handshake_reply: HandshakeMessageToken property challenge1 invalid (incorrect size)");
-            goto err_no_challenge;
-        }
-    }
-
-    /* Compute the hash_c1 value */
+    if (trusted_ca_list->length == 0)
+      result = verify_certificate(identityCert, relation->localIdentity->identityCA, ex);
+    else
     {
-        const DDS_Security_BinaryProperty_t * binary_properties[5];
-
-        binary_properties[0] = c_id;
-        binary_properties[1] = c_perm;
-        binary_properties[2] = c_pdata;
-        binary_properties[3] = c_dsign_algo;
-        binary_properties[4] = c_kagree_algo;
-
-        (void)compute_hash_value(&handshake->hash_c1[0], binary_properties, 5, NULL);
+      DDS_Security_Exception_clean(ex);
+      for (unsigned i = 0; i < trusted_ca_list->length; ++i)
+      {
+        DDS_Security_Exception_reset(ex);
+        if ((result = verify_certificate(identityCert, trusted_ca_list->buffer[i], ex)) == DDS_SECURITY_VALIDATION_OK)
+          break;
+      }
     }
+    if (result != DDS_SECURITY_VALIDATION_OK)
+      goto err_inv_identity_cert;
+  }
 
-    hash_c1 = DDS_Security_DataHolder_find_binary_property(token, "hash_c1");
-    if (hash_c1) {
-        if ((hash_c1->value._length == sizeof(HashValue_t)) &&
-            (memcmp(hash_c1->value._buffer, &handshake->hash_c1, sizeof(HashValue_t)) == 0)) {
-        } else {
-            result = DDS_SECURITY_VALIDATION_FAILED;
-            DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result,
-                    "begin_handshake_reply: HandshakeMessageToken property hash_c1 invalid (incorrect size)");
-            goto err_inv_hash_c1;
-        }
+  if (check_certificate_expiry(identityCert, ex) != DDS_SECURITY_VALIDATION_OK)
+    goto err_inv_identity_cert;
+
+  if (!(c_perm = DDS_Security_DataHolder_find_binary_property(token, "c.perm")))
+  {
+    DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "begin_handshake_reply: HandshakeMessageToken property c.perm missing");
+    goto err_no_c_perm;
+  }
+  if (c_perm->value._length > 0)
+  {
+    ddsrt_free(relation->remoteIdentity->permissionsDocument);
+    relation->remoteIdentity->permissionsDocument = string_from_data(c_perm->value._buffer, c_perm->value._length);
+  }
+
+  if (!(c_pdata = DDS_Security_DataHolder_find_binary_property(token, "c.pdata")))
+  {
+    DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "begin_handshake_reply: HandshakeMessageToken property c.pdata missing");
+    goto err_no_c_pdata;
+  }
+  if (validate_pdata(&c_pdata->value, identityCert, ex) != DDS_SECURITY_VALIDATION_OK)
+    goto err_inv_pdata;
+
+  if (!(c_dsign_algo = DDS_Security_DataHolder_find_binary_property(token, "c.dsign_algo")))
+  {
+    DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "begin_handshake_reply: HandshakeMessageToken property c.dsign_algo missing");
+    goto err_no_c_dsign_algo;
+  }
+
+  if ((dsignAlgoKind = get_dsign_algo_from_string((const char *)c_dsign_algo->value._buffer)) == AUTH_ALGO_KIND_UNKNOWN)
+  {
+    DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "begin_handshake_reply: HandshakeMessageToken property c.dsign_algo not supported");
+    goto err_no_c_dsign_algo;
+  }
+
+  if (!(c_kagree_algo = DDS_Security_DataHolder_find_binary_property(token, "c.kagree_algo")))
+  {
+    DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "begin_handshake_reply: HandshakeMessageToken property c.kagree_algo missing");
+    goto err_no_c_kagree_algo;
+  }
+
+  if ((kagreeAlgoKind = get_kagree_algo_from_string((const char *)c_kagree_algo->value._buffer)) == AUTH_ALGO_KIND_UNKNOWN)
+  {
+    DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "begin_handshake_reply: HandshakeMessageToken property c.kagree_algo not support");
+    goto err_no_c_kagree_algo;
+  }
+
+  dh1 = DDS_Security_DataHolder_find_binary_property(token, "dh1");
+  if (!dh1 || dh1->value._length == 0 || dh1->value._buffer == NULL)
+  {
+    DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "begin_handshake_reply: HandshakeMessageToken property dh1 missing");
+    goto err_no_dh;
+  }
+  if (dh_oct_to_public_key(&pdhkey, kagreeAlgoKind, dh1->value._buffer, dh1->value._length, ex) != DDS_SECURITY_VALIDATION_OK)
+    goto err_no_dh;
+
+  if (!(challenge = DDS_Security_DataHolder_find_binary_property(token, "challenge1")))
+  {
+    DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "begin_handshake_reply: HandshakeMessageToken property challenge1 missing");
+    goto err_no_challenge;
+  }
+  if (challenge->value._length != sizeof(AuthenticationChallenge) || challenge->value._buffer == NULL)
+  {
+    DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "begin_handshake_reply: HandshakeMessageToken property challenge1 invalid");
+    goto err_no_challenge;
+  }
+
+  /* When validate_remote_identity was provided with a remote_auth_request_token then the future_challenge in the remote identity was set and the challenge1
+     property of the handshake_request_token should be the same as the future_challenge stored in the remote identity. */
+  if (relation->rchallenge)
+  {
+    if (memcmp(relation->rchallenge->value, challenge->value._buffer, sizeof(AuthenticationChallenge)) != 0)
+    {
+      DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "begin_handshake_reply: HandshakeMessageToken property challenge1 does not match future_challenge");
+      goto err_no_challenge;
     }
-
-    if (!relation->remoteIdentity->identityCert) {
-        relation->remoteIdentity->identityCert = identityCert;
-    } else {
-        X509_free(relation->remoteIdentity->identityCert);
-        relation->remoteIdentity->identityCert = identityCert;
+  }
+  else
+  {
+    if (challenge->value._length == sizeof(relation->rchallenge->value))
+    {
+      relation->rchallenge = ddsrt_malloc(sizeof(AuthenticationChallenge));
+      memcpy(relation->rchallenge, challenge->value._buffer, challenge->value._length);
     }
+    else
+    {
+      DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "begin_handshake_reply: HandshakeMessageToken property challenge1 invalid (incorrect size)");
+      goto err_no_challenge;
+    }
+  }
 
-    relation->remoteIdentity->dsignAlgoKind = dsignAlgoKind;
-    relation->remoteIdentity->kagreeAlgoKind = kagreeAlgoKind;
+  {
+    const DDS_Security_BinaryProperty_t *binary_properties[] = { c_id, c_perm, c_pdata, c_dsign_algo, c_kagree_algo };
+    (void)compute_hash_value(&handshake->hash_c1[0], binary_properties, 5, NULL);
+  }
+  if ((hash_c1 = DDS_Security_DataHolder_find_binary_property(token, "hash_c1")))
+  {
+    if (hash_c1->value._length != sizeof(HashValue_t) || memcmp(hash_c1->value._buffer, &handshake->hash_c1, sizeof(HashValue_t)) != 0)
+    {
+      DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "begin_handshake_reply: HandshakeMessageToken property hash_c1 invalid (incorrect size)");
+      goto err_inv_hash_c1;
+    }
+  }
 
-    DDS_Security_OctetSeq_copy(&relation->remoteIdentity->pdata, &c_pdata->value);
-
-    handshake->rdh = pdhkey;
-
-    return result;
+  if (relation->remoteIdentity->identityCert)
+    X509_free(relation->remoteIdentity->identityCert);
+  relation->remoteIdentity->identityCert = identityCert;
+  relation->remoteIdentity->dsignAlgoKind = dsignAlgoKind;
+  relation->remoteIdentity->kagreeAlgoKind = kagreeAlgoKind;
+  DDS_Security_OctetSeq_copy(&relation->remoteIdentity->pdata, &c_pdata->value);
+  handshake->rdh = pdhkey;
+  return DDS_SECURITY_VALIDATION_OK;
 
 err_inv_hash_c1:
 err_no_challenge:
-    EVP_PKEY_free(pdhkey);
+  EVP_PKEY_free(pdhkey);
 err_no_dh:
 err_no_c_kagree_algo:
 err_no_c_dsign_algo:
@@ -1937,349 +1452,243 @@ err_inv_pdata:
 err_no_c_pdata:
 err_no_c_perm:
 err_inv_identity_cert:
-    X509_free(identityCert);
+  X509_free(identityCert);
 err_identity_cert_load:
 err_no_c_id:
 err_inv_class_id:
-    return result;
+  return DDS_SECURITY_VALIDATION_FAILED;
 }
 
-
-static DDS_Security_ValidationResult_t
-validate_handshake_reply_token(
-    const DDS_Security_HandshakeMessageToken *token,
-    HandshakeInfo *handshake,
-    EVP_PKEY **pdhkey,
-    X509Seq *trusted_ca_list,
-    DDS_Security_SecurityException *ex)
+static DDS_Security_ValidationResult_t validate_handshake_reply_token(const DDS_Security_HandshakeMessageToken *token, HandshakeInfo *handshake, EVP_PKEY **pdhkey, X509Seq *trusted_ca_list, DDS_Security_SecurityException *ex)
 {
+  IdentityRelation *relation = handshake->relation;
+  X509 *identityCert;
+  EVP_PKEY *public_key;
+  const DDS_Security_BinaryProperty_t *c_id, *c_perm, *c_pdata, *c_dsign_algo, *c_kagree_algo, *dh1, *dh2, *hash_c1, *hash_c2, *challenge1, *challenge2, *signature;
+  AuthenticationAlgoKind_t dsignAlgoKind, kagreeAlgoKind;
+
+  assert(relation);
+
+  if (!token->class_id || strncmp(AUTH_HANDSHAKE_REPLY_TOKEN_ID, token->class_id, strlen(AUTH_HANDSHAKE_REPLY_TOKEN_ID)) != 0)
+  {
+    DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "process_handshake: HandshakeMessageToken incorrect class_id: %s (expected %s)", token->class_id ? token->class_id : "NULL", AUTH_HANDSHAKE_REPLY_TOKEN_ID);
+    goto err_inv_class_id;
+  }
+
+  /* Check presents of mandatory properties: c.id, c.perm, c.pdata, c.dsign_algo, c.kagree_algo, challenge1, dh2, challenge2, signature */
+  c_id = DDS_Security_DataHolder_find_binary_property(token, "c.id");
+  if (!c_id || (c_id->value._length == 0) || (c_id->value._buffer == NULL))
+  {
+    DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "process_handshake: HandshakeMessageToken property c.id missing");
+    goto err_no_c_id;
+  }
+
+  /* Verify Identity Certificate */
+  if (load_X509_certificate_from_data((char *)c_id->value._buffer, (int)c_id->value._length, &identityCert, ex) != DDS_SECURITY_VALIDATION_OK)
+    goto err_identity_cert_load;
+
+  {
     DDS_Security_ValidationResult_t result = DDS_SECURITY_VALIDATION_OK;
-    IdentityRelation *relation = handshake->relation;
-    X509 *identityCert;
-    EVP_PKEY *public_key;
-    const DDS_Security_BinaryProperty_t *c_id;
-    const DDS_Security_BinaryProperty_t *c_perm;
-    const DDS_Security_BinaryProperty_t *c_pdata;
-    const DDS_Security_BinaryProperty_t *c_dsign_algo;
-    const DDS_Security_BinaryProperty_t *c_kagree_algo;
-    const DDS_Security_BinaryProperty_t *dh1;
-    const DDS_Security_BinaryProperty_t *dh2;
-    const DDS_Security_BinaryProperty_t *hash_c1;
-    const DDS_Security_BinaryProperty_t *hash_c2;
-    const DDS_Security_BinaryProperty_t *challenge1;
-    const DDS_Security_BinaryProperty_t *challenge2;
-    const DDS_Security_BinaryProperty_t *signature;
-    AuthenticationAlgoKind_t dsignAlgoKind;
-    AuthenticationAlgoKind_t kagreeAlgoKind;
-
-    unsigned i;
-
-    assert(relation);
-
-    /* Check class_id */
-    if (!token->class_id ||
-        (strncmp(AUTH_HANDSHAKE_REPLY_TOKEN_ID, token->class_id, strlen(AUTH_HANDSHAKE_REPLY_TOKEN_ID)) != 0)) {
-        result = DDS_SECURITY_VALIDATION_FAILED;
-        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result,
-                "process_handshake: HandshakeMessageToken incorrect class_id: %s (expected %s)", token->class_id ? token->class_id: "NULL", AUTH_HANDSHAKE_REPLY_TOKEN_ID);
-        goto err_inv_class_id;
-    }
-
-    /* Check presents of mandatory properties
-     * - c.id
-     * - c.perm
-     * - c.pdata
-     * - c.dsign_algo
-     * - c.kagree_algo
-     * - challenge1
-     * - dh2
-     * - challenge2
-     * - signature
-     */
-    c_id = DDS_Security_DataHolder_find_binary_property(token, "c.id");
-    if (!c_id || (c_id->value._length == 0) || (c_id->value._buffer == NULL)) {
-        result = DDS_SECURITY_VALIDATION_FAILED;
-        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result,
-                "process_handshake: HandshakeMessageToken property c.id missing");
-        goto err_no_c_id;
-    }
-
-    /* Verify Identity Certificate */
-    result = load_X509_certificate_from_data((char*)c_id->value._buffer, (int)c_id->value._length, &identityCert, ex);
-    if (result != DDS_SECURITY_VALIDATION_OK ) {
-        goto err_identity_cert_load;
-    }
-
-    if( trusted_ca_list->length == 0 ){ //no trusted set. check with local CA
-        result = verify_certificate(identityCert, relation->localIdentity->identityCA, ex);
-    }
-    else{
-        /* Make sure we have a clean exception, in case it was uninitialized. */
-        DDS_Security_Exception_clean(ex);
-        for (i = 0; i < trusted_ca_list->length; ++i) {
-            /* We'll only return the exception of the last one, if it failed. */
-            DDS_Security_Exception_reset(ex);
-            result = verify_certificate(identityCert, trusted_ca_list->buffer[i], ex);
-            if (result == DDS_SECURITY_VALIDATION_OK) {
-                break;
-            }
-        }
-    }
-
-    if (result != DDS_SECURITY_VALIDATION_OK) {
-        goto err_inv_identity_cert;
-    }
-
-    result = check_certificate_expiry( identityCert, ex);
-    if (result != DDS_SECURITY_VALIDATION_OK) {
-        goto err_inv_identity_cert;
-    }
-
-    c_perm = DDS_Security_DataHolder_find_binary_property(token, "c.perm");
-    if (!c_perm) {
-        result = DDS_SECURITY_VALIDATION_FAILED;
-        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result,
-                "process_handshake: HandshakeMessageToken property c.perm missing");
-        goto err_no_c_perm;
-    }
-
-    if (c_perm->value._length > 0) {
-        ddsrt_free(relation->remoteIdentity->permissionsDocument);
-        relation->remoteIdentity->permissionsDocument = string_from_data(c_perm->value._buffer, c_perm->value._length);
-    }
-
-    c_pdata = DDS_Security_DataHolder_find_binary_property(token, "c.pdata");
-    if (!c_pdata) {
-        result = DDS_SECURITY_VALIDATION_FAILED;
-        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result,
-                "process_handshake: HandshakeMessageToken property c.pdata missing");
-        goto err_no_c_pdata;
-    }
-
-    result = validate_pdata(&c_pdata->value, identityCert, ex);
-    if (result != DDS_SECURITY_VALIDATION_OK) {
-        goto err_inv_pdata;
-    }
-
-    c_dsign_algo = DDS_Security_DataHolder_find_binary_property(token, "c.dsign_algo");
-    if (!c_dsign_algo) {
-        result = DDS_SECURITY_VALIDATION_FAILED;
-        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result,
-                "process_handshake: HandshakeMessageToken property c.dsign_algo missing");
-        goto err_no_c_dsign_algo;
-    }
-
-    dsignAlgoKind = get_dsign_algo_from_string((const char *)c_dsign_algo->value._buffer);
-    if (dsignAlgoKind == AUTH_ALGO_KIND_UNKNOWN) {
-        result = DDS_SECURITY_VALIDATION_FAILED;
-        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result,
-                "process_handshake: HandshakeMessageToken property c.dsign_algo not supported");
-        goto err_no_c_dsign_algo;
-    }
-
-    c_kagree_algo = DDS_Security_DataHolder_find_binary_property(token, "c.kagree_algo");
-    if (!c_kagree_algo) {
-        result = DDS_SECURITY_VALIDATION_FAILED;
-        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result,
-                "process_handshake: HandshakeMessageToken property c.kagree_algo missing");
-        goto err_no_c_kagree_algo;
-    }
-
-    kagreeAlgoKind = get_kagree_algo_from_string((const char *)c_kagree_algo->value._buffer);
-    if (kagreeAlgoKind == AUTH_ALGO_KIND_UNKNOWN) {
-        result = DDS_SECURITY_VALIDATION_FAILED;
-        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result,
-                "process_handshake: HandshakeMessageToken property c.kagree_algo not support");
-        goto err_no_c_kagree_algo;
-    }
-
-    /* dh1 is optional  */
-    dh1 = DDS_Security_DataHolder_find_binary_property(token, "dh1");
-    DDSRT_UNUSED_ARG(dh1); /*print it for integration purposes */
-
-    dh2 = DDS_Security_DataHolder_find_binary_property(token, "dh2");
-    if (!dh2 || dh2->value._length == 0 || dh2->value._buffer == NULL) {
-        result = DDS_SECURITY_VALIDATION_FAILED;
-        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result,
-                "process_handshake: HandshakeMessageToken property dh2 missing");
-        goto err_no_dh;
-    }
-
-    hash_c1 = DDS_Security_DataHolder_find_binary_property(token, "hash_c1");
-    if (hash_c1) {
-        if ((hash_c1->value._length == sizeof(HashValue_t)) &&
-                (memcmp(hash_c1->value._buffer, handshake->hash_c1, sizeof(HashValue_t)) == 0)) {
-        } else {
-            result = DDS_SECURITY_VALIDATION_FAILED;
-            DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result,
-                    "begin_handshake_reply: HandshakeMessageToken property hash_c1 invalid");
-            goto err_inv_hash_c1;
-        }
-    }
-
-    /* Compute the hash_c2 value */
+    if (trusted_ca_list->length == 0)
+      result = verify_certificate(identityCert, relation->localIdentity->identityCA, ex);
+    else
     {
-        const DDS_Security_BinaryProperty_t * binary_properties[5];
-
-        binary_properties[0] = c_id;
-        binary_properties[1] = c_perm;
-        binary_properties[2] = c_pdata;
-        binary_properties[3] = c_dsign_algo;
-        binary_properties[4] = c_kagree_algo;
-
-        (void)compute_hash_value(&handshake->hash_c2[0], binary_properties, 5, NULL);
+      DDS_Security_Exception_clean(ex);
+      for (unsigned i = 0; i < trusted_ca_list->length; ++i)
+      {
+        DDS_Security_Exception_reset(ex);
+        result = verify_certificate(identityCert, trusted_ca_list->buffer[i], ex);
+        if (result == DDS_SECURITY_VALIDATION_OK)
+          break;
+      }
     }
+    if (result != DDS_SECURITY_VALIDATION_OK)
+      goto err_inv_identity_cert;
+  }
 
-    hash_c2 = DDS_Security_DataHolder_find_binary_property(token, "hash_c2");
-    if (hash_c2) {
-        if ((hash_c2->value._length == sizeof(HashValue_t)) &&
-            (memcmp(hash_c2->value._buffer, handshake->hash_c2, sizeof(HashValue_t)) == 0)) {
-        } else {
-            result = DDS_SECURITY_VALIDATION_FAILED;
-            DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result,
-                    "begin_handshake_reply: HandshakeMessageToken property hash_c2 invalid");
-            goto err_inv_hash_c2;
-        }
+  if (check_certificate_expiry(identityCert, ex) != DDS_SECURITY_VALIDATION_OK)
+    goto err_inv_identity_cert;
+
+  if (!(c_perm = DDS_Security_DataHolder_find_binary_property(token, "c.perm")))
+  {
+    DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "process_handshake: HandshakeMessageToken property c.perm missing");
+    goto err_no_c_perm;
+  }
+  if (c_perm->value._length > 0)
+  {
+    ddsrt_free(relation->remoteIdentity->permissionsDocument);
+    relation->remoteIdentity->permissionsDocument = string_from_data(c_perm->value._buffer, c_perm->value._length);
+  }
+
+  if (!(c_pdata = DDS_Security_DataHolder_find_binary_property(token, "c.pdata")))
+  {
+    DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "process_handshake: HandshakeMessageToken property c.pdata missing");
+    goto err_no_c_pdata;
+  }
+  if (validate_pdata(&c_pdata->value, identityCert, ex) != DDS_SECURITY_VALIDATION_OK)
+    goto err_inv_pdata;
+
+  if (!(c_dsign_algo = DDS_Security_DataHolder_find_binary_property(token, "c.dsign_algo")))
+  {
+    DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "process_handshake: HandshakeMessageToken property c.dsign_algo missing");
+    goto err_no_c_dsign_algo;
+  }
+
+  if ((dsignAlgoKind = get_dsign_algo_from_string((const char *)c_dsign_algo->value._buffer)) == AUTH_ALGO_KIND_UNKNOWN)
+  {
+    DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "process_handshake: HandshakeMessageToken property c.dsign_algo not supported");
+    goto err_no_c_dsign_algo;
+  }
+
+  if (!(c_kagree_algo = DDS_Security_DataHolder_find_binary_property(token, "c.kagree_algo")))
+  {
+    DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "process_handshake: HandshakeMessageToken property c.kagree_algo missing");
+    goto err_no_c_kagree_algo;
+  }
+
+  if ((kagreeAlgoKind = get_kagree_algo_from_string((const char *)c_kagree_algo->value._buffer)) == AUTH_ALGO_KIND_UNKNOWN)
+  {
+    DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "process_handshake: HandshakeMessageToken property c.kagree_algo not support");
+    goto err_no_c_kagree_algo;
+  }
+
+  /* dh1 is optional  */
+  dh1 = DDS_Security_DataHolder_find_binary_property(token, "dh1");
+  DDSRT_UNUSED_ARG(dh1);
+
+  dh2 = DDS_Security_DataHolder_find_binary_property(token, "dh2");
+  if (!dh2 || dh2->value._length == 0 || dh2->value._buffer == NULL)
+  {
+    DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "process_handshake: HandshakeMessageToken property dh2 missing");
+    goto err_no_dh;
+  }
+
+  if ((hash_c1 = DDS_Security_DataHolder_find_binary_property(token, "hash_c1")))
+  {
+    if (hash_c1->value._length != sizeof(HashValue_t) || memcmp(hash_c1->value._buffer, handshake->hash_c1, sizeof(HashValue_t)) != 0)
+    {
+      DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "begin_handshake_reply: HandshakeMessageToken property hash_c1 invalid");
+      goto err_inv_hash_c1;
     }
+  }
 
-    signature = DDS_Security_DataHolder_find_binary_property(token, "signature");
-    if (!signature || signature->value._length == 0 || signature->value._buffer == NULL) {
-        result = DDS_SECURITY_VALIDATION_FAILED;
-        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result,
-                "process_handshake: HandshakeMessageToken property signature missing");
-        goto err_no_signature;
+  {
+    const DDS_Security_BinaryProperty_t *binary_properties[] = { c_id, c_perm, c_pdata, c_dsign_algo, c_kagree_algo };
+    (void)compute_hash_value(&handshake->hash_c2[0], binary_properties, 5, NULL);
+  }
+
+  if ((hash_c2 = DDS_Security_DataHolder_find_binary_property(token, "hash_c2")))
+  {
+    if (hash_c2->value._length != sizeof(HashValue_t) || memcmp(hash_c2->value._buffer, handshake->hash_c2, sizeof(HashValue_t)) != 0)
+    {
+      DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "begin_handshake_reply: HandshakeMessageToken property hash_c2 invalid");
+      goto err_inv_hash_c2;
     }
+  }
 
-    *pdhkey = NULL;
-    result = dh_oct_to_public_key(pdhkey, kagreeAlgoKind, dh2->value._buffer, dh2->value._length, ex);
-    if (result != DDS_SECURITY_VALIDATION_OK) {
-        goto err_inv_dh;
+  signature = DDS_Security_DataHolder_find_binary_property(token, "signature");
+  if (!signature || signature->value._length == 0 || signature->value._buffer == NULL)
+  {
+    DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "process_handshake: HandshakeMessageToken property signature missing");
+    goto err_no_signature;
+  }
+
+  *pdhkey = NULL;
+  if (dh_oct_to_public_key(pdhkey, kagreeAlgoKind, dh2->value._buffer, dh2->value._length, ex) != DDS_SECURITY_VALIDATION_OK)
+    goto err_inv_dh;
+
+  if (!(challenge1 = DDS_Security_DataHolder_find_binary_property(token, "challenge1")))
+  {
+    DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "process_handshake: HandshakeMessageToken property challenge1 missing");
+    goto err_no_challenge;
+  }
+  if (challenge1->value._length != sizeof(AuthenticationChallenge) || challenge1->value._buffer == NULL)
+  {
+    DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "process_handshake: HandshakeMessageToken property challenge1 invalid");
+    goto err_no_challenge;
+  }
+
+  if (!(challenge2 = DDS_Security_DataHolder_find_binary_property(token, "challenge2")))
+  {
+    DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "process_handshake: HandshakeMessageToken property challenge2 missing");
+    goto err_no_challenge;
+  }
+  if (challenge2->value._length != sizeof(AuthenticationChallenge) || challenge2->value._buffer == NULL)
+  {
+    DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "process_handshake: HandshakeMessageToken property challenge2 invalid");
+    goto err_no_challenge;
+  }
+
+  /* When validate_remote_identity was provided with a remote_auth_request_token then the future_challenge in the remote identity was set and the challenge2
+     property of the handshake_reply_token should be the same as the future_challenge stored in the remote identity. */
+  if (relation->rchallenge)
+  {
+    if (memcmp(relation->rchallenge->value, challenge2->value._buffer, sizeof(AuthenticationChallenge)) != 0)
+    {
+      DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "process_handshake: HandshakeMessageToken property challenge2 does not match future_challenge");
+      goto err_no_challenge;
     }
-
-    challenge1 = DDS_Security_DataHolder_find_binary_property(token, "challenge1");
-    if (!challenge1) {
-        result = DDS_SECURITY_VALIDATION_FAILED;
-        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result,
-                "process_handshake: HandshakeMessageToken property challenge1 missing");
-        goto err_no_challenge;
+  }
+  else
+  {
+    if (challenge2->value._length == sizeof(relation->rchallenge->value))
+    {
+      relation->rchallenge = ddsrt_malloc(sizeof(AuthenticationChallenge));
+      memcpy(relation->rchallenge, challenge2->value._buffer, challenge2->value._length);
     }
-
-    if (challenge1->value._length != sizeof(AuthenticationChallenge) || challenge1->value._buffer == NULL) {
-        result = DDS_SECURITY_VALIDATION_FAILED;
-        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result,
-                "process_handshake: HandshakeMessageToken property challenge1 invalid");
-        goto err_no_challenge;
+    else
+    {
+      DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "process_handshake: HandshakeMessageToken property challenge2 invalid (incorrect size)");
+      goto err_no_challenge;
     }
+  }
 
-
-    challenge2 = DDS_Security_DataHolder_find_binary_property(token, "challenge2");
-    if (!challenge2) {
-        result = DDS_SECURITY_VALIDATION_FAILED;
-        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result,
-                "process_handshake: HandshakeMessageToken property challenge2 missing");
-        goto err_no_challenge;
+  if (relation->lchallenge)
+  {
+    if (memcmp(relation->lchallenge->value, challenge1->value._buffer, sizeof(AuthenticationChallenge)) != 0)
+    {
+      DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "process_handshake: HandshakeMessageToken property challenge1 does not match future_challenge");
+      goto err_no_challenge;
     }
+  }
+  else
+  {
+    DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "process_handshake: No future challenge exists for this token");
+    goto err_no_challenge;
+  }
 
-    if (challenge2->value._length != sizeof(AuthenticationChallenge) || challenge2->value._buffer == NULL) {
-        result = DDS_SECURITY_VALIDATION_FAILED;
-        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result,
-                "process_handshake: HandshakeMessageToken property challenge2 invalid");
-        goto err_no_challenge;
-    }
-    /* When validate_remote_identity was provided with a remote_auth_request_token
-     * then the future_challenge in the remote identity was set and the challenge2
-     * property of the handshake_reply_token should be the same as the
-     * future_challenge stored in the remote identity.
-     */
+  /* TODO: check if an identity certificate was already associated with the remote identity and when that is the case both should be the same */
+  if (relation->remoteIdentity->identityCert)
+    X509_free(relation->remoteIdentity->identityCert);
+  relation->remoteIdentity->identityCert = identityCert;
+  relation->remoteIdentity->dsignAlgoKind = dsignAlgoKind;
+  relation->remoteIdentity->kagreeAlgoKind = kagreeAlgoKind;
 
+  if ((public_key = X509_get_pubkey(relation->remoteIdentity->identityCert)))
+  {
+    DDS_Security_BinaryProperty_t *hash_c1_val = hash_value_to_binary_property("hash_c1", handshake->hash_c1);
+    DDS_Security_BinaryProperty_t *hash_c2_val = hash_value_to_binary_property("hash_c2", handshake->hash_c2);
+    const DDS_Security_BinaryProperty_t *properties[HANDSHAKE_SIGNATURE_CONTENT_SIZE] = { hash_c2_val, challenge2, dh2, challenge1, dh1, hash_c1_val };
+    DDS_Security_ValidationResult_t result = validate_signature(public_key, properties, HANDSHAKE_SIGNATURE_CONTENT_SIZE, signature->value._buffer, signature->value._length, ex);
+    EVP_PKEY_free(public_key);
+    DDS_Security_BinaryProperty_free(hash_c1_val);
+    DDS_Security_BinaryProperty_free(hash_c2_val);
+    if (result != DDS_SECURITY_VALIDATION_OK)
+      goto err_inv_signature;
+  }
+  else
+  {
+    DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "X509_get_pubkey failed");
+    goto err_inv_signature;
+  }
 
-
-    if (relation->rchallenge) {
-        if (memcmp(relation->rchallenge->value, challenge2->value._buffer, sizeof(AuthenticationChallenge)) != 0) {
-            result = DDS_SECURITY_VALIDATION_FAILED;
-             DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result,
-                     "process_handshake: HandshakeMessageToken property challenge2 does not match future_challenge");
-             goto err_no_challenge;
-        }
-    } else {
-        if (challenge2->value._length == sizeof(relation->rchallenge->value)) {
-            relation->rchallenge = ddsrt_malloc(sizeof(AuthenticationChallenge));
-            memcpy(relation->rchallenge, challenge2->value._buffer, challenge2->value._length);
-        } else {
-            result = DDS_SECURITY_VALIDATION_FAILED;
-              DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result,
-                      "process_handshake: HandshakeMessageToken property challenge2 invalid (incorrect size)");
-              goto err_no_challenge;
-        }
-    }
-
-
-    if (relation->lchallenge) {
-        if (memcmp(relation->lchallenge->value, challenge1->value._buffer, sizeof(AuthenticationChallenge)) != 0) {
-            result = DDS_SECURITY_VALIDATION_FAILED;
-            DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result,
-                 "process_handshake: HandshakeMessageToken property challenge1 does not match future_challenge");
-            goto err_no_challenge;
-        }
-    } else {
-        result = DDS_SECURITY_VALIDATION_FAILED;
-        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result,
-             "process_handshake: No future challenge exists for this token");
-        goto err_no_challenge;
-    }
-
-
-    /* TODO: check if an identity certificate was already associated with the remote identity and
-     * when that is the case both should be the same
-     */
-    if (!relation->remoteIdentity->identityCert) {
-        relation->remoteIdentity->identityCert = identityCert;
-    } else {
-        X509_free(relation->remoteIdentity->identityCert);
-        relation->remoteIdentity->identityCert = identityCert;
-    }
-
-    relation->remoteIdentity->dsignAlgoKind = dsignAlgoKind;
-    relation->remoteIdentity->kagreeAlgoKind = kagreeAlgoKind;
-
-
-    public_key = X509_get_pubkey(relation->remoteIdentity->identityCert);
-    if (public_key) {
-        /*prepare properties*/
-        const DDS_Security_BinaryProperty_t *properties[HANDSHAKE_SIGNATURE_CONTENT_SIZE];
-        DDS_Security_BinaryProperty_t *hash_c1_val = hash_value_to_binary_property("hash_c1", handshake->hash_c1);
-        DDS_Security_BinaryProperty_t *hash_c2_val = hash_value_to_binary_property("hash_c2", handshake->hash_c2);
-
-        properties[0] = hash_c2_val;
-        properties[1] = challenge2;
-        properties[2] = dh2;
-        properties[3] = challenge1;
-        properties[4] = dh1;
-        properties[5] = hash_c1_val;
-
-        result = validate_signature(public_key,properties, HANDSHAKE_SIGNATURE_CONTENT_SIZE, signature->value._buffer,signature->value._length, ex);
-
-        EVP_PKEY_free(public_key);
-        DDS_Security_BinaryProperty_free(hash_c1_val);
-        DDS_Security_BinaryProperty_free(hash_c2_val);
-
-        if( result != DDS_SECURITY_VALIDATION_OK) {
-            goto err_inv_signature;
-        }
-    } else {
-        result = DDS_SECURITY_VALIDATION_FAILED;
-        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result, "X509_get_pubkey failed");
-        goto err_inv_identity_cert;
-    }
-
-
-    DDS_Security_OctetSeq_copy(&relation->remoteIdentity->pdata, &c_pdata->value);
-
-    return result;
+  DDS_Security_OctetSeq_copy(&relation->remoteIdentity->pdata, &c_pdata->value);
+  return DDS_SECURITY_VALIDATION_OK;
 
 err_inv_signature:
 err_no_challenge:
 err_inv_dh:
+  EVP_PKEY_free(*pdhkey);
 err_no_signature:
 err_inv_hash_c2:
 err_inv_hash_c1:
@@ -2290,1203 +1699,847 @@ err_inv_pdata:
 err_no_c_pdata:
 err_no_c_perm:
 err_inv_identity_cert:
-    X509_free(identityCert);
+  X509_free(identityCert);
 err_identity_cert_load:
 err_no_c_id:
 err_inv_class_id:
-    return result;
+  return DDS_SECURITY_VALIDATION_FAILED;
 }
 
-
-static DDS_Security_ValidationResult_t
-validate_handshake_final_token(
-    const DDS_Security_HandshakeMessageToken *token,
-    HandshakeInfo *handshake,
-    DDS_Security_SecurityException *ex)
+static DDS_Security_ValidationResult_t validate_handshake_final_token(const DDS_Security_HandshakeMessageToken *token, HandshakeInfo *handshake, DDS_Security_SecurityException *ex)
 {
-    DDS_Security_ValidationResult_t result = DDS_SECURITY_VALIDATION_OK;
-    IdentityRelation *relation = handshake->relation;
-    const DDS_Security_BinaryProperty_t *dh1;
-    const DDS_Security_BinaryProperty_t *dh2;
-    const DDS_Security_BinaryProperty_t *hash_c1;
-    const DDS_Security_BinaryProperty_t *hash_c2;
-    const DDS_Security_BinaryProperty_t *challenge1;
-    const DDS_Security_BinaryProperty_t *challenge2;
-    const DDS_Security_BinaryProperty_t *signature;
-    EVP_PKEY *public_key;
+  IdentityRelation *relation = handshake->relation;
+  const DDS_Security_BinaryProperty_t *dh1, *dh2, *hash_c1, *hash_c2, *challenge1, *challenge2, *signature;
+  EVP_PKEY *public_key;
 
+  assert(relation);
+
+  if (!token->class_id || strncmp(AUTH_HANDSHAKE_FINAL_TOKEN_ID, token->class_id, strlen(AUTH_HANDSHAKE_FINAL_TOKEN_ID)) != 0)
+  {
+    DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "process_handshake: HandshakeMessageToken incorrect class_id: %s (expected %s)", token->class_id ? token->class_id : "NULL", AUTH_HANDSHAKE_FINAL_TOKEN_ID);
+    goto failed;
+  }
+
+  /* Check presents of mandatory properties: challenge1, challenge2, signature */
+
+  /* dh1 and dh2 are optional  */
+  dh1 = DDS_Security_DataHolder_find_binary_property(token, "dh1");
+  DDSRT_UNUSED_ARG(dh1);
+  dh2 = DDS_Security_DataHolder_find_binary_property(token, "dh2");
+  DDSRT_UNUSED_ARG(dh2);
+
+  /* hash_c1 is optional  */
+  if ((hash_c1 = DDS_Security_DataHolder_find_binary_property(token, "hash_c1")))
+  {
+    if (hash_c1->value._length != sizeof(HashValue_t) || memcmp(hash_c1->value._buffer, handshake->hash_c1, sizeof(HashValue_t)) != 0)
+    {
+      DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "begin_handshake_reply: HandshakeMessageToken property hash_c1 invalid");
+      goto failed;
+    }
+  }
+
+  /* hash_c2 is optional  */
+  if ((hash_c2 = DDS_Security_DataHolder_find_binary_property(token, "hash_c2")))
+  {
+    if (hash_c2->value._length != sizeof(HashValue_t) || memcmp(hash_c2->value._buffer, handshake->hash_c2, sizeof(HashValue_t)) != 0)
+    {
+      DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "begin_handshake_reply: HandshakeMessageToken property hash_c2 invalid");
+      goto failed;
+    }
+  }
+
+  if (!(challenge1 = DDS_Security_DataHolder_find_binary_property(token, "challenge1")))
+  {
+    DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "process_handshake: HandshakeMessageToken property challenge1 missing");
+    goto failed;
+  }
+  if (challenge1->value._length != sizeof(AuthenticationChallenge) || challenge1->value._buffer == NULL)
+  {
+    DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "process_handshake: HandshakeMessageToken property challenge1 invalid");
+    goto failed;
+  }
+
+  if (!(challenge2 = DDS_Security_DataHolder_find_binary_property(token, "challenge2")))
+  {
+    DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "process_handshake: HandshakeMessageToken property challenge2 missing");
+    goto failed;
+  }
+  if (challenge2->value._length != sizeof(AuthenticationChallenge) || challenge2->value._buffer == NULL)
+  {
+    DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "process_handshake: HandshakeMessageToken property challenge2 invalid");
+    goto failed;
+  }
+
+  /* When validate_remote_identity was provided with a remote_auth_request_token then the future_challenge in the remote identity was set and the challenge1
+     property of the handshake_reply_token should be the same as the future_challenge stored in the remote identity. */
+  if (relation->rchallenge)
+  {
+    if (memcmp(relation->rchallenge->value, challenge1->value._buffer, sizeof(AuthenticationChallenge)) != 0)
+    {
+      DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "process_handshake: HandshakeMessageToken property challenge1 does not match future_challenge");
+      goto failed;
+    }
+  }
+  else
+  {
+    DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "process_handshake: No challenge exists to check challenge1 in the token.");
+    goto failed;
+  }
+
+  if (relation->lchallenge)
+  {
+    if (memcmp(relation->lchallenge->value, challenge2->value._buffer, sizeof(AuthenticationChallenge)) != 0)
+    {
+      DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "process_handshake: HandshakeMessageToken property challenge2 does not match future_challenge");
+      goto failed;
+    }
+  }
+  else
+  {
+    DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "process_handshake: No challenge exists to check challenge2 in the token.");
+    goto failed;
+  }
+
+  if (!(signature = DDS_Security_DataHolder_find_binary_property(token, "signature")))
+  {
+    DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "process_handshake: HandshakeMessageToken property signature missing");
+    goto failed;
+  }
+
+  /* Validate signature */
+  if ((public_key = X509_get_pubkey(relation->remoteIdentity->identityCert)))
+  {
+    DDS_Security_BinaryProperty_t *hash_c1_val = hash_value_to_binary_property("hash_c1", handshake->hash_c1);
+    DDS_Security_BinaryProperty_t *hash_c2_val = hash_value_to_binary_property("hash_c2", handshake->hash_c2);
+    const DDS_Security_BinaryProperty_t *properties[HANDSHAKE_SIGNATURE_CONTENT_SIZE] = { hash_c1_val, challenge1, dh1, challenge2, dh2, hash_c2_val };
+    DDS_Security_ValidationResult_t result = validate_signature(public_key, properties, HANDSHAKE_SIGNATURE_CONTENT_SIZE, signature->value._buffer, signature->value._length, ex);
+    EVP_PKEY_free(public_key);
+    DDS_Security_BinaryProperty_free(hash_c1_val);
+    DDS_Security_BinaryProperty_free(hash_c2_val);
+    if (result != DDS_SECURITY_VALIDATION_OK)
+      goto failed;
+  }
+  else
+  {
+    DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "X509_get_pubkey failed");
+    goto failed;
+  }
+  return DDS_SECURITY_VALIDATION_OK;
+
+failed:
+  return DDS_SECURITY_VALIDATION_FAILED;
+}
+
+DDS_Security_ValidationResult_t begin_handshake_reply(dds_security_authentication *instance, DDS_Security_HandshakeHandle *handshake_handle,
+    DDS_Security_HandshakeMessageToken *handshake_message_out, const DDS_Security_HandshakeMessageToken *handshake_message_in,
+    const DDS_Security_IdentityHandle initiator_identity_handle, const DDS_Security_IdentityHandle replier_identity_handle,
+    const DDS_Security_OctetSeq *serialized_local_participant_data, DDS_Security_SecurityException *ex)
+{
+  dds_security_authentication_impl *impl = (dds_security_authentication_impl *)instance;
+  HandshakeInfo *handshake = NULL;
+  IdentityRelation *relation = NULL;
+  SecurityObject *obj;
+  LocalIdentityInfo *localIdent;
+  RemoteIdentityInfo *remoteIdent;
+  EVP_PKEY *dhkeyLocal = NULL;
+  DDS_Security_BinaryProperty_t *tokens, *c_id, *c_perm, *c_pdata, *c_dsign_algo, *c_kagree_algo, *hash_c1, *hash_c2, *dh1, *dh2, *challenge1, *challenge2, *signature;
+  const DDS_Security_BinaryProperty_t *hash_c1_ref, *dh1_ref;
+  unsigned char *certData, *dhPubKeyData;
+  uint32_t certDataSize, dhPubKeyDataSize, tokenSize;
+  int created = 0;
+
+  if (!instance || !handshake_handle || !handshake_message_out || !handshake_message_in || !serialized_local_participant_data)
+  {
+    DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "begin_handshake_reply: Invalid parameter provided");
+    goto err_bad_param;
+  }
+
+  if (serialized_local_participant_data->_length == 0 || serialized_local_participant_data->_buffer == NULL)
+  {
+    DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "begin_handshake_reply: Invalid parameter provided");
+    goto err_bad_param;
+  }
+
+  ddsrt_mutex_lock(&impl->lock);
+
+  obj = security_object_find(impl->objectHash, replier_identity_handle);
+  if (!obj || !security_object_valid(obj, SECURITY_OBJECT_KIND_LOCAL_IDENTITY))
+  {
+    DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "begin_handshake_reply: Invalid replier_identity_handle provided");
+    goto err_inv_handle;
+  }
+  localIdent = (LocalIdentityInfo *)obj;
+
+  obj = security_object_find(impl->objectHash, initiator_identity_handle);
+  if (!obj || !security_object_valid(obj, SECURITY_OBJECT_KIND_REMOTE_IDENTITY))
+  {
+    DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "begin_handshake_reply: Invalid initiator_identity_handle provided");
+    goto err_inv_handle;
+  }
+  remoteIdent = (RemoteIdentityInfo *)obj;
+  if (!(handshake = find_handshake(impl, SECURITY_OBJECT_HANDLE(localIdent), SECURITY_OBJECT_HANDLE(remoteIdent))))
+  {
+    relation = find_identity_relation(remoteIdent, SECURITY_OBJECT_HANDLE(localIdent));
     assert(relation);
+    handshake = handshake_info_new(localIdent, remoteIdent, relation);
+    handshake->created_in = CREATEDREPLY;
+    (void)ddsrt_hh_add(impl->objectHash, handshake);
+    created = 1;
+  }
+  else
+  {
+    relation = handshake->relation;
+    assert(relation);
+  }
 
-    /* Check class_id */
-    if (!token->class_id ||
-        (strncmp(AUTH_HANDSHAKE_FINAL_TOKEN_ID, token->class_id, strlen(AUTH_HANDSHAKE_FINAL_TOKEN_ID)) != 0)) {
-        result = DDS_SECURITY_VALIDATION_FAILED;
-        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result,
-                "process_handshake: HandshakeMessageToken incorrect class_id: %s (expected %s)", token->class_id ? token->class_id: "NULL", AUTH_HANDSHAKE_FINAL_TOKEN_ID);
-        goto err_inv_class_id;
-    }
+  if (validate_handshake_request_token(handshake_message_in, handshake, &(impl->trustedCAList), ex) != DDS_SECURITY_VALIDATION_OK)
+    goto err_inv_token;
+  if (get_certificate_contents(localIdent->identityCert, &certData, &certDataSize, ex) != DDS_SECURITY_VALIDATION_OK)
+    goto err_alloc_cid;
 
-    /* Check presents of mandatory properties
-     * - challenge1
-     * - challenge2
-     * - signature
-     */
+  if (!handshake->ldh)
+  {
+    if (generate_dh_keys(&dhkeyLocal, remoteIdent->kagreeAlgoKind, ex) != DDS_SECURITY_VALIDATION_OK)
+      goto err_gen_dh_keys;
 
+    handshake->ldh = dhkeyLocal;
+    EVP_PKEY_copy_parameters(handshake->rdh, handshake->ldh);
+  }
 
-    /* dh1 is optional  */
-    dh1 = DDS_Security_DataHolder_find_binary_property(token, "dh1");
+  if (dh_public_key_to_oct(handshake->ldh, remoteIdent->kagreeAlgoKind, &dhPubKeyData, &dhPubKeyDataSize, ex) != DDS_SECURITY_VALIDATION_OK)
+    goto err_get_public_key;
 
-    DDSRT_UNUSED_ARG(dh1); /*print it for integration purposes */
+  if (localIdent->pdata._length == 0)
+    DDS_Security_OctetSeq_copy(&localIdent->pdata, serialized_local_participant_data);
 
-    /* dh2 is optional  */
-    dh2 = DDS_Security_DataHolder_find_binary_property(token, "dh2");
-    DDSRT_UNUSED_ARG(dh2); /*print it for integration purposes */
+  hash_c1_ref = DDS_Security_DataHolder_find_binary_property(handshake_message_in, "hash_c1");
+  tokenSize = hash_c1_ref ? 12 : 11;
 
-    /* hash_c1 is optional  */
-    hash_c1 = DDS_Security_DataHolder_find_binary_property(token, "hash_c1");
-    if (hash_c1) {
-        if ((hash_c1->value._length == sizeof(HashValue_t)) &&
-                (memcmp(hash_c1->value._buffer, handshake->hash_c1, sizeof(HashValue_t)) == 0)) {
-        } else {
-            result = DDS_SECURITY_VALIDATION_FAILED;
-            DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result,
-                    "begin_handshake_reply: HandshakeMessageToken property hash_c1 invalid");
-            goto err_inv_hash_c1;
-        }
-    }
+  tokens = DDS_Security_BinaryPropertySeq_allocbuf(tokenSize);
+  c_id = &tokens[0];
+  c_perm = &tokens[1];
+  c_pdata = &tokens[2];
+  c_dsign_algo = &tokens[3];
+  c_kagree_algo = &tokens[4];
+  signature = &tokens[5];
+  hash_c2 = &tokens[6];
+  challenge2 = &tokens[7];
+  dh2 = &tokens[8];
+  challenge1 = &tokens[9];
+  dh1 = &tokens[10];
+  hash_c1 = hash_c1_ref ? &tokens[11] : NULL;
 
-    /* hash_c2 is optional  */
-    hash_c2 = DDS_Security_DataHolder_find_binary_property(token, "hash_c2");
-    if (hash_c2) {
-        if ((hash_c2->value._length == sizeof(HashValue_t)) &&
-            (memcmp(hash_c2->value._buffer, handshake->hash_c2, sizeof(HashValue_t)) == 0)) {
-        } else {
-            result = DDS_SECURITY_VALIDATION_FAILED;
-            DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result,
-                    "begin_handshake_reply: HandshakeMessageToken property hash_c2 invalid");
-            goto err_inv_hash_c2;
-        }
-    }
+  /* Store the Identity Certificate associated with the local identify in c.id property */
+  DDS_Security_BinaryProperty_set_by_ref(c_id, "c.id", certData, certDataSize);
+  certData = NULL;
+  DDS_Security_BinaryProperty_set_by_string(c_perm, "c.perm", localIdent->permissionsDocument ? localIdent->permissionsDocument : "");
+  DDS_Security_BinaryProperty_set_by_value(c_pdata, "c.pdata", serialized_local_participant_data->_buffer, serialized_local_participant_data->_length);
+  DDS_Security_BinaryProperty_set_by_string(c_dsign_algo, "c.dsign_algo", get_dsign_algo(localIdent->dsignAlgoKind));
+  DDS_Security_BinaryProperty_set_by_string(c_kagree_algo, "c.kagree_algo", get_kagree_algo(remoteIdent->kagreeAlgoKind));
 
-    challenge1 = DDS_Security_DataHolder_find_binary_property(token, "challenge1");
-    if (!challenge1) {
-        result = DDS_SECURITY_VALIDATION_FAILED;
-        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result,
-                "process_handshake: HandshakeMessageToken property challenge1 missing");
-        goto err_no_challenge;
-    }
+  /* Calculate the hash_c2 */
+  {
+    DDS_Security_BinaryPropertySeq bseq = { ._length = 5, ._buffer = tokens };
+    get_hash_binary_property_seq(&bseq, handshake->hash_c2);
+    DDS_Security_BinaryProperty_set_by_value(hash_c2, "hash_c2", handshake->hash_c2, sizeof(HashValue_t));
+  }
 
-    if (challenge1->value._length != sizeof(AuthenticationChallenge) || challenge1->value._buffer == NULL) {
-        result = DDS_SECURITY_VALIDATION_FAILED;
-        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result,
-                "process_handshake: HandshakeMessageToken property challenge1 invalid");
-        goto err_no_challenge;
-    }
+  /* Set the DH public key associated with the local participant in dh2 property */
+  DDS_Security_BinaryProperty_set_by_ref(dh2, "dh2", dhPubKeyData, dhPubKeyDataSize);
 
+  /* Set the DH public key associated with the local participant in hash_c1 property */
+  if (hash_c1)
+    DDS_Security_BinaryProperty_set_by_value(hash_c1, "hash_c1", hash_c1_ref->value._buffer, hash_c1_ref->value._length);
 
-    challenge2 = DDS_Security_DataHolder_find_binary_property(token, "challenge2");
-    if (!challenge2) {
-        result = DDS_SECURITY_VALIDATION_FAILED;
-        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result,
-                "process_handshake: HandshakeMessageToken property challenge2 missing");
-        goto err_no_challenge;
-    }
+  /* Set the DH public key associated with the local participant in dh1 property */
+  if (dh1)
+  {
+    dh1_ref = DDS_Security_DataHolder_find_binary_property(handshake_message_in, "dh1");
+    if (dh1_ref)
+      DDS_Security_BinaryProperty_set_by_value(dh1, "dh1", dh1_ref->value._buffer, dh1_ref->value._length);
+  }
 
-    if (challenge2->value._length != sizeof(AuthenticationChallenge) || challenge2->value._buffer == NULL) {
-        result = DDS_SECURITY_VALIDATION_FAILED;
-        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result,
-                "process_handshake: HandshakeMessageToken property challenge2 invalid");
-        goto err_no_challenge;
-    }
+  assert(relation->rchallenge);
+  DDS_Security_BinaryProperty_set_by_value(challenge1, "challenge1", relation->rchallenge->value, sizeof(AuthenticationChallenge));
+  assert(relation->lchallenge);
+  DDS_Security_BinaryProperty_set_by_value(challenge2, "challenge2", relation->lchallenge->value, sizeof(AuthenticationChallenge));
 
-    /* When validate_remote_identity was provided with a remote_auth_request_token
-     * then the future_challenge in the remote identity was set and the challenge1
-     * property of the handshake_reply_token should be the same as the
-     * future_challenge stored in the remote identity.
-     */
+  /* Calculate the signature */
+  {
+    unsigned char *sign;
+    size_t signlen;
+    DDS_Security_BinaryProperty_t *hash_c1_val = hash_value_to_binary_property("hash_c1", handshake->hash_c1);
+    DDS_Security_BinaryProperty_t *hash_c2_val = hash_value_to_binary_property("hash_c2", handshake->hash_c2);
+    const DDS_Security_BinaryProperty_t *binary_properties[HANDSHAKE_SIGNATURE_CONTENT_SIZE] = { hash_c2_val, challenge2, dh2, challenge1, dh1, hash_c1_val };
+    DDS_Security_ValidationResult_t result = create_signature(localIdent->privateKey, binary_properties, HANDSHAKE_SIGNATURE_CONTENT_SIZE, &sign, &signlen, ex);
+    DDS_Security_BinaryProperty_free(hash_c1_val);
+    DDS_Security_BinaryProperty_free(hash_c2_val);
+    if (result != DDS_SECURITY_VALIDATION_OK)
+      goto err_signature;
+    DDS_Security_BinaryProperty_set_by_ref(signature, "signature", sign, (uint32_t)signlen);
+  }
 
+  (void)ddsrt_hh_add(impl->objectHash, handshake);
+  handshake_message_out->class_id = ddsrt_strdup(AUTH_HANDSHAKE_REPLY_TOKEN_ID);
+  handshake_message_out->binary_properties._length = tokenSize;
+  handshake_message_out->binary_properties._buffer = tokens;
 
+  ddsrt_mutex_unlock(&impl->lock);
 
-    if (relation->rchallenge) {
-        if (memcmp(relation->rchallenge->value, challenge1->value._buffer, sizeof(AuthenticationChallenge)) != 0) {
-            result = DDS_SECURITY_VALIDATION_FAILED;
-             DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result,
-                     "process_handshake: HandshakeMessageToken property challenge1 does not match future_challenge");
-             goto err_no_challenge;
-        }
-    } else {
-        result = DDS_SECURITY_VALIDATION_FAILED;
-        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result,
-             "process_handshake: No challenge exists to check challenge1 in the token.");
-        goto err_no_challenge;
-    }
+  *handshake_handle = HANDSHAKE_HANDLE(handshake);
+  return DDS_SECURITY_VALIDATION_PENDING_HANDSHAKE_MESSAGE;
 
-    if (relation->lchallenge) {
-        if (memcmp(relation->lchallenge->value, challenge2->value._buffer, sizeof(AuthenticationChallenge)) != 0) {
-            result = DDS_SECURITY_VALIDATION_FAILED;
-             DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result,
-                     "process_handshake: HandshakeMessageToken property challenge2 does not match future_challenge");
-             goto err_no_challenge;
-        }
-    } else {
-        result = DDS_SECURITY_VALIDATION_FAILED;
-        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result,
-             "process_handshake: No challenge exists to check challenge2 in the token.");
-        goto err_no_challenge;
-    }
-
-    signature = DDS_Security_DataHolder_find_binary_property(token, "signature");
-    if (!signature) {
-        result = DDS_SECURITY_VALIDATION_FAILED;
-        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result,
-                "process_handshake: HandshakeMessageToken property signature missing");
-        goto err_no_challenge;
-    }
-
-    /* Validate signature */
-    public_key = X509_get_pubkey(relation->remoteIdentity->identityCert);
-    if (public_key) {
-        /*prepare properties*/
-        const DDS_Security_BinaryProperty_t *properties[HANDSHAKE_SIGNATURE_CONTENT_SIZE];
-        DDS_Security_BinaryProperty_t *hash_c1_val = hash_value_to_binary_property("hash_c1", handshake->hash_c1);
-        DDS_Security_BinaryProperty_t *hash_c2_val = hash_value_to_binary_property("hash_c2", handshake->hash_c2);
-
-        properties[0] = hash_c1_val;
-        properties[1] = challenge1;
-        properties[2] = dh1;
-        properties[3] = challenge2;
-        properties[4] = dh2;
-        properties[5] = hash_c2_val;
-
-        result = validate_signature(public_key,properties, HANDSHAKE_SIGNATURE_CONTENT_SIZE ,signature->value._buffer,signature->value._length,ex );
-
-        EVP_PKEY_free(public_key);
-        DDS_Security_BinaryProperty_free(hash_c1_val);
-        DDS_Security_BinaryProperty_free(hash_c2_val);
-
-        if (result != DDS_SECURITY_VALIDATION_OK) {
-            goto err_inv_signature;
-        }
-    } else {
-        result = DDS_SECURITY_VALIDATION_FAILED;
-        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result, "X509_get_pubkey failed");
-        goto err_inv_identity_cert;
-    }
-
-err_inv_hash_c2:
-err_inv_hash_c1:
-err_no_challenge:
-err_inv_class_id:
-err_inv_identity_cert:
-err_inv_signature:
-    return result;
+err_signature:
+  free_binary_properties(tokens, tokenSize);
+err_get_public_key:
+err_gen_dh_keys:
+  ddsrt_free(certData);
+err_alloc_cid:
+err_inv_token:
+  if (created)
+  {
+    (void)ddsrt_hh_remove(impl->objectHash, handshake);
+    security_object_free((SecurityObject *)handshake);
+  }
+err_inv_handle:
+  ddsrt_mutex_unlock(&impl->lock);
+err_bad_param:
+  return DDS_SECURITY_VALIDATION_FAILED;
 }
 
-DDS_Security_ValidationResult_t
-begin_handshake_reply(
-        dds_security_authentication *instance,
-        DDS_Security_HandshakeHandle *handshake_handle,
-        DDS_Security_HandshakeMessageToken *handshake_message_out,
-        const DDS_Security_HandshakeMessageToken *handshake_message_in,
-        const DDS_Security_IdentityHandle initiator_identity_handle,
-        const DDS_Security_IdentityHandle replier_identity_handle,
-        const DDS_Security_OctetSeq *serialized_local_participant_data,
-        DDS_Security_SecurityException *ex)
+static bool generate_shared_secret(const HandshakeInfo *handshake, unsigned char **shared_secret, DDS_Security_long *length, DDS_Security_SecurityException *ex)
 {
-    DDS_Security_ValidationResult_t result = DDS_SECURITY_VALIDATION_OK;
-    dds_security_authentication_impl *impl = (dds_security_authentication_impl *) instance;
-    HandshakeInfo *handshake = NULL;
-    IdentityRelation *relation = NULL;
-    SecurityObject *obj;
-    LocalIdentityInfo *localIdent;
-    RemoteIdentityInfo *remoteIdent;
-    EVP_PKEY *dhkeyLocal = NULL;
-    DDS_Security_BinaryProperty_t *tokens;
-    DDS_Security_BinaryProperty_t *c_id;
-    DDS_Security_BinaryProperty_t *c_perm;
-    DDS_Security_BinaryProperty_t *c_pdata;
-    DDS_Security_BinaryProperty_t *c_dsign_algo;
-    DDS_Security_BinaryProperty_t *c_kagree_algo;
-    DDS_Security_BinaryProperty_t *hash_c1;
-    const DDS_Security_BinaryProperty_t *hash_c1_ref;
-    DDS_Security_BinaryProperty_t *hash_c2;
-    DDS_Security_BinaryProperty_t *dh1;
-    const DDS_Security_BinaryProperty_t *dh1_ref;
-    DDS_Security_BinaryProperty_t *dh2;
-    DDS_Security_BinaryProperty_t *challenge1;
-    DDS_Security_BinaryProperty_t *challenge2;
-    DDS_Security_BinaryProperty_t *signature;
-    unsigned char *certData;
-    unsigned char *dhPubKeyData;
-    uint32_t certDataSize, dhPubKeyDataSize;
-    uint32_t tokenSize, idx;
-    int created = 0;
+  EVP_PKEY_CTX *ctx;
+  size_t skeylen;
+  unsigned char *secret = NULL;
+  *shared_secret = NULL;
 
-    /* validate provided arguments */
-    if (!instance || !handshake_handle || !handshake_message_out || !handshake_message_in || !serialized_local_participant_data) {
-        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED,
-                "begin_handshake_reply: Invalid parameter provided");
-        goto err_bad_param;
-    }
+  if (!(ctx = EVP_PKEY_CTX_new(handshake->ldh, NULL /* no engine */)))
+  {
+    DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "process_handshake: Shared secret failed to create context: ");
+    goto fail_ctx_new;
+  }
 
-    if ((serialized_local_participant_data->_length == 0) || (serialized_local_participant_data->_buffer == NULL)) {
-        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED,
-                "begin_handshake_reply: Invalid parameter provided");
-        goto err_bad_param;
-    }
+  if (EVP_PKEY_derive_init(ctx) <= 0)
+  {
+    DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "process_handshake: Shared secret failed to initialize context: ");
+    goto fail_derive;
+  }
+  if (EVP_PKEY_derive_set_peer(ctx, handshake->rdh) <= 0)
+  {
+    DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "process_handshake: Shared secret failed to set peer key: ");
+    goto fail_derive;
+  }
 
-    ddsrt_mutex_lock(&impl->lock);
+  /* Determine buffer length */
+  if (EVP_PKEY_derive(ctx, NULL, &skeylen) <= 0)
+  {
+    DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "process_handshake:  Shared secret failed to determine key length: ");
+    goto fail_derive;
+  }
 
-    obj = security_object_find(impl->objectHash, replier_identity_handle);
-    if (!obj || !security_object_valid(obj, SECURITY_OBJECT_KIND_LOCAL_IDENTITY)) {
-        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED,
-                "begin_handshake_reply: Invalid replier_identity_handle provided");
-        goto err_inv_handle;
-    }
-    localIdent = (LocalIdentityInfo *) obj;
+  secret = ddsrt_malloc(skeylen);
+  if (EVP_PKEY_derive(ctx, secret, &skeylen) <= 0)
+  {
+    DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "process_handshake: Could not compute the shared secret: ");
+    goto fail_derive;
+  }
 
-    obj = security_object_find(impl->objectHash, initiator_identity_handle);
-    if (!obj || !security_object_valid(obj, SECURITY_OBJECT_KIND_REMOTE_IDENTITY)) {
-        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED,
-                "begin_handshake_reply: Invalid initiator_identity_handle provided");
-        goto err_inv_handle;
-    }
-    remoteIdent = (RemoteIdentityInfo *)obj;
+  *shared_secret = ddsrt_malloc(SHA256_DIGEST_LENGTH);
+  *length = SHA256_DIGEST_LENGTH;
+  SHA256(secret, skeylen, *shared_secret);
+  ddsrt_free(secret);
+  EVP_PKEY_CTX_free(ctx);
+  return true;
 
-    handshake = find_handshake(impl, SECURITY_OBJECT_HANDLE(localIdent), SECURITY_OBJECT_HANDLE(remoteIdent));
-    if (!handshake) {
-        relation = find_identity_relation(remoteIdent, SECURITY_OBJECT_HANDLE(localIdent));
-        assert(relation);
-        handshake = handshakeInfoNew(localIdent, remoteIdent, relation);
-        handshake->created_in = CREATEDREPLY;
-        (void)ddsrt_hh_add(impl->objectHash, handshake);
-        created = 1;
-    } else {
-        relation = handshake->relation;
-        assert(relation);
-    }
+fail_derive:
+  ddsrt_free(secret);
+  EVP_PKEY_CTX_free(ctx);
+fail_ctx_new:
+  return false;
+}
 
-    result = validate_handshake_request_token(handshake_message_in, handshake, &(impl->trustedCAList), ex);
-    if (result != DDS_SECURITY_VALIDATION_OK) {
-        goto err_inv_token;
-    }
+DDS_Security_ValidationResult_t process_handshake(dds_security_authentication *instance, DDS_Security_HandshakeMessageToken *handshake_message_out,
+    const DDS_Security_HandshakeMessageToken *handshake_message_in, const DDS_Security_HandshakeHandle handshake_handle, DDS_Security_SecurityException *ex)
+{
+  DDS_Security_ValidationResult_t hs_result = DDS_SECURITY_VALIDATION_OK;
+  dds_security_authentication_impl *impl = (dds_security_authentication_impl *)instance;
+  HandshakeInfo *handshake = NULL;
+  IdentityRelation *relation = NULL;
+  SecurityObject *obj;
+  EVP_PKEY *dhkeyRemote = NULL;
+  DDS_Security_BinaryProperty_t *tokens = NULL, *hash_c1 = NULL, *hash_c2 = NULL, *dh1, *dh2, *challenge1, *challenge2, *signature;
+  const DDS_Security_BinaryProperty_t *hash_c1_ref, *hash_c2_ref, *challenge1_ref, *challenge2_ref, *dh1_ref, *dh2_ref;
+  uint32_t tokenSize = 0, idx;
+  DDS_Security_octet *challenge1_ref_for_shared_secret, *challenge2_ref_for_shared_secret;
 
-    result = get_certificate_contents(localIdent->identityCert, &certData, &certDataSize, ex);
-    if (result != DDS_SECURITY_VALIDATION_OK) {
-        goto err_alloc_cid;
-    }
+  /* validate provided arguments */
+  if (!instance || !handshake_handle || !handshake_message_out || !handshake_message_in)
+  {
+    DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "process_handshake: Invalid parameter provided");
+    goto err_bad_param;
+  }
 
-    if (!handshake->ldh) {
-        result = generate_dh_keys(&dhkeyLocal, remoteIdent->kagreeAlgoKind, ex);
-        if (result != DDS_SECURITY_VALIDATION_OK) {
-            goto err_gen_dh_keys;
-        }
+  memset(handshake_message_out, 0, sizeof(DDS_Security_HandshakeMessageToken));
 
-        handshake->ldh = dhkeyLocal;
-        EVP_PKEY_copy_parameters(handshake->rdh, handshake->ldh);
-    }
+  ddsrt_mutex_lock(&impl->lock);
+  obj = security_object_find(impl->objectHash, handshake_handle);
+  if (!obj || !security_object_valid(obj, SECURITY_OBJECT_KIND_HANDSHAKE))
+  {
+    DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "process_handshake: Invalid replier_identity_handle provided");
+    goto err_inv_handle;
+  }
+  handshake = (HandshakeInfo *)obj;
+  relation = handshake->relation;
+  assert(relation);
 
-    result = dh_public_key_to_oct(handshake->ldh, remoteIdent->kagreeAlgoKind, &dhPubKeyData, &dhPubKeyDataSize, ex);
-    if (result != DDS_SECURITY_VALIDATION_OK) {
-        goto err_get_public_key;
-    }
+  /* check if the handle created by a handshake_request or handshake_reply */
+  switch (handshake->created_in)
+  {
+  case CREATEDREQUEST:
+    /* The source of the handshake_handle is a begin_handshake_request function. So, handshake_message_in is from a remote begin_handshake_reply function */
+    /* Verify Message Token contents according to Spec 9.3.2.5.2 (Reply Message)  */
+    if (validate_handshake_reply_token(handshake_message_in, handshake, &dhkeyRemote, &(impl->trustedCAList), ex) != DDS_SECURITY_VALIDATION_OK)
+      goto err_inv_token;
 
-    if (localIdent->pdata._length == 0) {
-        DDS_Security_OctetSeq_copy(&localIdent->pdata, serialized_local_participant_data);
-    }
+    handshake->rdh = dhkeyRemote;
+    EVP_PKEY_copy_parameters(handshake->rdh, handshake->ldh);
 
+    /* Prepare HandshakeFinalMessageToken */
     hash_c1_ref = DDS_Security_DataHolder_find_binary_property(handshake_message_in, "hash_c1");
-    tokenSize = hash_c1_ref ? 12 : 11;
-
+    hash_c2_ref = DDS_Security_DataHolder_find_binary_property(handshake_message_in, "hash_c2");
+    dh1_ref = DDS_Security_DataHolder_find_binary_property(handshake_message_in, "dh1");
+    dh2_ref = DDS_Security_DataHolder_find_binary_property(handshake_message_in, "dh2");
+    challenge1_ref = DDS_Security_DataHolder_find_binary_property(handshake_message_in, "challenge1");
+    challenge2_ref = DDS_Security_DataHolder_find_binary_property(handshake_message_in, "challenge2");
+    tokenSize = 3; /* challenge1, challenge2 and signature are in already */
+    if (hash_c1_ref) tokenSize++;
+    if (hash_c2_ref) tokenSize++;
+    if (dh1_ref) tokenSize++;
+    if (dh2_ref) tokenSize++;
     tokens = DDS_Security_BinaryPropertySeq_allocbuf(tokenSize);
     idx = 0;
-    c_id = &tokens[idx++];
-    c_perm = &tokens[idx++];
-    c_pdata = &tokens[idx++];
-    c_dsign_algo = &tokens[idx++];
-    c_kagree_algo = &tokens[idx++];
     signature = &tokens[idx++];
-    hash_c2 = &tokens[idx++];
+    hash_c2 = hash_c2_ref ? &tokens[idx++] : NULL;
     challenge2 = &tokens[idx++];
-    dh2 = &tokens[idx++];
+    dh2 = dh2_ref ? &tokens[idx++] : NULL;
     challenge1 = &tokens[idx++];
-    dh1 = &tokens[idx++];
+    dh1 = dh1_ref ? &tokens[idx++] : NULL;
     hash_c1 = hash_c1_ref ? &tokens[idx++] : NULL;
 
-    /* Store the Identity Certificate associated with the local identify in c.id property */
-    DDS_Security_BinaryProperty_set_by_ref(c_id, "c.id", certData, certDataSize);
-    certData = NULL;
-
-    /* Store the permission document in the c.perm property */
-    if (localIdent->permissionsDocument) {
-        DDS_Security_BinaryProperty_set_by_string(c_perm, "c.perm", localIdent->permissionsDocument);
-    } else {
-        DDS_Security_BinaryProperty_set_by_string(c_perm, "c.perm", "");
-    }
-
-    /* Store the provided local_participant_data in the c.pdata property */
-    DDS_Security_BinaryProperty_set_by_value(c_pdata, "c.pdata", serialized_local_participant_data->_buffer, serialized_local_participant_data->_length);
-
-    /* Set the used signing algorithm descriptor in c.dsign_algo */
-    DDS_Security_BinaryProperty_set_by_string(c_dsign_algo, "c.dsign_algo", get_dsign_algo(localIdent->dsignAlgoKind));
-
-    /* Set the used key algorithm descriptor in c.kagree_algo */
-    DDS_Security_BinaryProperty_set_by_string(c_kagree_algo, "c.kagree_algo", get_kagree_algo(remoteIdent->kagreeAlgoKind));
-
-    /* Calculate the hash_c2 */
-    {
-        DDS_Security_BinaryPropertySeq bseq;
-
-        bseq._length = 5;
-        bseq._buffer = tokens;
-
-        get_hash_binary_property_seq(&bseq, handshake->hash_c2);
-        DDS_Security_BinaryProperty_set_by_value(hash_c2, "hash_c2", handshake->hash_c2, sizeof(HashValue_t));
-    }
-
-    /* Set the DH public key associated with the local participant in dh2 property */
-    DDS_Security_BinaryProperty_set_by_ref(dh2, "dh2", dhPubKeyData, dhPubKeyDataSize);
-
-    /* Set the DH public key associated with the local participant in hash_c1 property */
-    if (hash_c1) {
-        DDS_Security_BinaryProperty_set_by_value(hash_c1, "hash_c1", hash_c1_ref->value._buffer, hash_c1_ref->value._length);
-    }
-
-    /* Set the DH public key associated with the local participant in dh1 property */
-    if (dh1) {
-        dh1_ref = DDS_Security_DataHolder_find_binary_property(handshake_message_in, "dh1");
-        if (dh1_ref) {
-            DDS_Security_BinaryProperty_set_by_value(dh1, "dh1", dh1_ref->value._buffer, dh1_ref->value._length);
-        }
-    }
-
-    /* Set the challenge in challenge1 property */
-    assert(relation->rchallenge);
-    DDS_Security_BinaryProperty_set_by_value(challenge1, "challenge1", relation->rchallenge->value, sizeof(AuthenticationChallenge));
-
-    /* Set the challenge in challenge2 property */
+    if (hash_c1)
+      DDS_Security_BinaryProperty_set_by_value(hash_c1, "hash_c1", hash_c1_ref->value._buffer, hash_c1_ref->value._length);
+    if (hash_c2)
+      DDS_Security_BinaryProperty_set_by_value(hash_c2, "hash_c2", hash_c2_ref->value._buffer, hash_c2_ref->value._length);
+    if (dh1)
+      DDS_Security_BinaryProperty_set_by_value(dh1, "dh1", dh1_ref->value._buffer, dh1_ref->value._length);
+    if (dh2)
+      DDS_Security_BinaryProperty_set_by_value(dh2, "dh2", dh2_ref->value._buffer, dh2_ref->value._length);
     assert(relation->lchallenge);
-
-    DDS_Security_BinaryProperty_set_by_value(challenge2, "challenge2", relation->lchallenge->value, sizeof(AuthenticationChallenge));
+    if (challenge1 && challenge1_ref)
+      DDS_Security_BinaryProperty_set_by_value(challenge1, "challenge1", challenge1_ref->value._buffer, challenge1_ref->value._length);
+    assert(relation->rchallenge);
+    if (challenge2 && challenge2_ref)
+      DDS_Security_BinaryProperty_set_by_value(challenge2, "challenge2", challenge2_ref->value._buffer, challenge2_ref->value._length);
 
     /* Calculate the signature */
     {
-        unsigned char *sign;
-        size_t signlen;
-        const DDS_Security_BinaryProperty_t * binary_properties[ HANDSHAKE_SIGNATURE_CONTENT_SIZE ];
-        DDS_Security_BinaryProperty_t *hash_c1_val = hash_value_to_binary_property("hash_c1", handshake->hash_c1);
-        DDS_Security_BinaryProperty_t *hash_c2_val = hash_value_to_binary_property("hash_c2", handshake->hash_c2);
-
-        binary_properties[0] = hash_c2_val;
-        binary_properties[1] = challenge2;
-        binary_properties[2] = dh2;
-        binary_properties[3] = challenge1;
-        binary_properties[4] = dh1;
-        binary_properties[5] = hash_c1_val;
-
-        result = create_signature(localIdent->privateKey, binary_properties, HANDSHAKE_SIGNATURE_CONTENT_SIZE , &sign, &signlen, ex);
-
-        DDS_Security_BinaryProperty_free(hash_c1_val);
-        DDS_Security_BinaryProperty_free(hash_c2_val);
-
-        if (result != DDS_SECURITY_VALIDATION_OK) {
-            goto err_signature;
-        }
-        DDS_Security_BinaryProperty_set_by_ref(signature, "signature", sign, (uint32_t)signlen);
+      unsigned char *sign;
+      size_t signlen;
+      DDS_Security_BinaryProperty_t *hash_c1_val = hash_value_to_binary_property("hash_c1", handshake->hash_c1);
+      DDS_Security_BinaryProperty_t *hash_c2_val = hash_value_to_binary_property("hash_c2", handshake->hash_c2);
+      const DDS_Security_BinaryProperty_t *binary_properties[HANDSHAKE_SIGNATURE_CONTENT_SIZE] = { hash_c1_val, challenge1, dh1, challenge2, dh2, hash_c2_val };
+      DDS_Security_ValidationResult_t result = create_signature(relation->localIdentity->privateKey, binary_properties, HANDSHAKE_SIGNATURE_CONTENT_SIZE, &sign, &signlen, ex);
+      DDS_Security_BinaryProperty_free(hash_c1_val);
+      DDS_Security_BinaryProperty_free(hash_c2_val);
+      if (result != DDS_SECURITY_VALIDATION_OK)
+        goto err_signature;
+      DDS_Security_BinaryProperty_set_by_ref(signature, "signature", sign, (uint32_t)signlen);
     }
 
-    (void)ddsrt_hh_add(impl->objectHash, handshake);
-
-    handshake_message_out->class_id = ddsrt_strdup(AUTH_HANDSHAKE_REPLY_TOKEN_ID);
+    handshake_message_out->class_id = ddsrt_strdup(AUTH_HANDSHAKE_FINAL_TOKEN_ID);
     handshake_message_out->binary_properties._length = tokenSize;
     handshake_message_out->binary_properties._buffer = tokens;
+    challenge1_ref_for_shared_secret = (DDS_Security_octet *)(handshake->relation->lchallenge);
+    challenge2_ref_for_shared_secret = (DDS_Security_octet *)(handshake->relation->rchallenge);
+    hs_result = DDS_SECURITY_VALIDATION_OK_FINAL_MESSAGE;
+    break;
 
+  case CREATEDREPLY:
+    /* The source of the handshake_handle is a begin_handshake_reply function So, handshake_message_in is from a remote process_handshake function */
+    /* Verify Message Token contents according to Spec 9.3.2.5.3 (Final Message)   */
+    if (validate_handshake_final_token(handshake_message_in, handshake, ex) != DDS_SECURITY_VALIDATION_OK)
+      goto err_inv_token;
+    challenge2_ref_for_shared_secret = (DDS_Security_octet *)(handshake->relation->lchallenge);
+    challenge1_ref_for_shared_secret = (DDS_Security_octet *)(handshake->relation->rchallenge);
+    hs_result = DDS_SECURITY_VALIDATION_OK;
+    break;
+
+  default:
     ddsrt_mutex_unlock(&impl->lock);
+    goto err_bad_param;
+  }
 
+  {
+    DDS_Security_long shared_secret_length;
+    unsigned char *shared_secret;
+    if (!generate_shared_secret(handshake, &shared_secret, &shared_secret_length, ex))
+      goto err_openssl;
+    handshake->shared_secret_handle_impl = ddsrt_malloc(sizeof(DDS_Security_SharedSecretHandleImpl));
+    handshake->shared_secret_handle_impl->shared_secret = shared_secret;
+    handshake->shared_secret_handle_impl->shared_secret_size = shared_secret_length;
+    memcpy(handshake->shared_secret_handle_impl->challenge1, challenge1_ref_for_shared_secret, DDS_SECURITY_AUTHENTICATION_CHALLENGE_SIZE);
+    memcpy(handshake->shared_secret_handle_impl->challenge2, challenge2_ref_for_shared_secret, DDS_SECURITY_AUTHENTICATION_CHALLENGE_SIZE);
+  }
 
-    *handshake_handle = HANDSHAKE_HANDLE(handshake);
-
-    if (result == DDS_SECURITY_VALIDATION_OK) {
-        result = DDS_SECURITY_VALIDATION_PENDING_HANDSHAKE_MESSAGE;
-    }
-
-    return result;
-
-err_signature:
-    free_binary_properties(tokens, tokenSize);
-err_get_public_key:
-err_gen_dh_keys:
-    ddsrt_free(certData);
-err_alloc_cid:
-err_inv_token:
-    if (created) {
-        (void)ddsrt_hh_remove(impl->objectHash, handshake);
-        security_object_free((SecurityObject *)handshake);
-    }
-err_inv_handle:
-    ddsrt_mutex_unlock(&impl->lock);
-err_bad_param:
-    return DDS_SECURITY_VALIDATION_FAILED;
-}
-
-
-static bool
-generate_shared_secret(
-    const HandshakeInfo *handshake,
-    unsigned char **shared_secret,
-    DDS_Security_long *length,
-    DDS_Security_SecurityException *ex)
-{
-    bool result = false;
-    EVP_PKEY_CTX *ctx;
-    size_t skeylen;
-    unsigned char *secret = NULL;
-
-    *shared_secret = NULL;
-
-    ctx = EVP_PKEY_CTX_new( handshake->ldh, NULL /* no engine */);
-    if (!ctx)
+  {
+    /* setup expiry listener */
+    dds_time_t cert_exp = get_certificate_expiry(handshake->relation->remoteIdentity->identityCert);
+    if (cert_exp == DDS_TIME_INVALID)
     {
-        DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED,
-                        "process_handshake: Shared secret failed to create context: ");
-        goto fail_ctx_new;
+      DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "Expiry date of the certificate is invalid");
+      goto err_invalid_expiry;
     }
-
-    if (EVP_PKEY_derive_init(ctx) <= 0)
-    {
-      DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED,
-                        "process_handshake: Shared secret failed to initialize context: ");
-        goto fail_derive;
-    }
-    if (EVP_PKEY_derive_set_peer(ctx, handshake->rdh) <= 0)
-    {
-      DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED,
-                        "process_handshake: Shared secret failed to set peer key: ");
-        goto fail_derive;
-    }
-
-    /* Determine buffer length */
-    if (EVP_PKEY_derive(ctx, NULL, &skeylen) <= 0)
-    {
-      DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED,
-                        "process_handshake:  Shared secret failed to determine key length: ");
-        goto fail_derive;
-    }
-
-    secret = ddsrt_malloc(skeylen);
-    if (EVP_PKEY_derive(ctx, secret, &skeylen) <= 0)
-    {
-      DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED,
-                "process_handshake: Could not compute the shared secret: ");
-        goto fail_derive;
-    }
-
-    *shared_secret = ddsrt_malloc(SHA256_DIGEST_LENGTH);
-    *length = SHA256_DIGEST_LENGTH;
-
-    SHA256(secret, skeylen, *shared_secret);
-
-    result = true;
-
-fail_derive:
-    ddsrt_free(secret);
-    EVP_PKEY_CTX_free(ctx);
-fail_ctx_new:
-    return result;
-}
-
-
-
-
-DDS_Security_ValidationResult_t
-process_handshake(
-        dds_security_authentication *instance,
-        DDS_Security_HandshakeMessageToken *handshake_message_out,
-        const DDS_Security_HandshakeMessageToken *handshake_message_in,
-        const DDS_Security_HandshakeHandle handshake_handle,
-        DDS_Security_SecurityException *ex)
-{
-    DDS_Security_ValidationResult_t result = DDS_SECURITY_VALIDATION_OK;
-    dds_security_authentication_impl *impl = (dds_security_authentication_impl *) instance;
-    HandshakeInfo *handshake = NULL;
-    IdentityRelation *relation = NULL;
-    SecurityObject *obj;
-    EVP_PKEY *dhkeyRemote = NULL;
-    DDS_Security_BinaryProperty_t *tokens = NULL;
-    DDS_Security_BinaryProperty_t *hash_c1 = NULL;
-    const DDS_Security_BinaryProperty_t *hash_c1_ref;
-    const DDS_Security_BinaryProperty_t *hash_c2_ref;
-    const DDS_Security_BinaryProperty_t *challenge1_ref;
-    const DDS_Security_BinaryProperty_t *challenge2_ref;
-    const DDS_Security_BinaryProperty_t *dh1_ref;
-    const DDS_Security_BinaryProperty_t *dh2_ref;
-    DDS_Security_BinaryProperty_t *hash_c2 = NULL;
-    DDS_Security_BinaryProperty_t *dh1;
-    DDS_Security_BinaryProperty_t *dh2;
-    DDS_Security_BinaryProperty_t *challenge1;
-    DDS_Security_BinaryProperty_t *challenge2;
-    DDS_Security_BinaryProperty_t *signature;
-    uint32_t tokenSize=0, idx;
-    DDS_Security_octet * challenge1_ref_for_shared_secret, *challenge2_ref_for_shared_secret;
-
-    /* validate provided arguments */
-    if (!instance || !handshake_handle || !handshake_message_out || !handshake_message_in) {
-        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT,
-        DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED,
-                        "process_handshake: Invalid parameter provided");
-        goto err_bad_param;
-    }
-
-    memset(handshake_message_out, 0, sizeof(DDS_Security_HandshakeMessageToken));
-
-    ddsrt_mutex_lock(&impl->lock);
-
-    obj = security_object_find(impl->objectHash, handshake_handle);
-    if (!obj || !security_object_valid(obj, SECURITY_OBJECT_KIND_HANDSHAKE)) {
-        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT,
-        DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED,
-                        "process_handshake: Invalid replier_identity_handle provided");
-        goto err_inv_handle;
-    }
-    handshake = (HandshakeInfo *) obj;
-    relation = handshake->relation;
-    assert(relation);
-
-    /* check if the handle created by a handshake_request or handshake_reply */
-
-    switch (handshake->created_in) {
-    case CREATEDREQUEST:
-        /* The source of the handshake_handle is a begin_handshake_request function
-         * So, handshake_message_in should have been came from a remote begin_handshake_reply function
-         */
-        /* Verify Message Token contents according to Spec 9.3.2.5.2 (Reply Message)  */
-        result = validate_handshake_reply_token(handshake_message_in, handshake, &dhkeyRemote, &(impl->trustedCAList), ex);
-        if (result != DDS_SECURITY_VALIDATION_OK) {
-            goto err_inv_token;
-        }
-
-        /*set received remote DH (dh2) */
-        handshake->rdh = dhkeyRemote;
-
-        EVP_PKEY_copy_parameters(handshake->rdh, handshake->ldh);
-
-        /* Prepare HandshakeFinalMessageToken */
-
-        /* Get references from message_in */
-        hash_c1_ref = DDS_Security_DataHolder_find_binary_property(handshake_message_in, "hash_c1");
-        hash_c2_ref = DDS_Security_DataHolder_find_binary_property(handshake_message_in, "hash_c2");
-        dh1_ref = DDS_Security_DataHolder_find_binary_property(handshake_message_in, "dh1");
-        dh2_ref = DDS_Security_DataHolder_find_binary_property(handshake_message_in, "dh2");
-        challenge1_ref = DDS_Security_DataHolder_find_binary_property(handshake_message_in,
-                        "challenge1");
-        challenge2_ref = DDS_Security_DataHolder_find_binary_property(handshake_message_in,
-                        "challenge2");
-
-        tokenSize = 3; /* challenge1, challenge2 and signature are already exist */
-        if (hash_c1_ref)
-            tokenSize++;
-        if (hash_c2_ref)
-            tokenSize++;
-        if (dh1_ref)
-            tokenSize++;
-        if (dh2_ref)
-            tokenSize++;
-
-        tokens = DDS_Security_BinaryPropertySeq_allocbuf(tokenSize);
-        idx = 0;
-        signature = &tokens[idx++];
-        hash_c2 = hash_c2_ref ? &tokens[idx++] : NULL;
-        challenge2 = &tokens[idx++];
-        dh2 = dh2_ref ? &tokens[idx++] : NULL;
-        challenge1 = &tokens[idx++];
-        dh1 = dh1_ref ? &tokens[idx++] : NULL;
-        hash_c1 = hash_c1_ref ? &tokens[idx++] : NULL;
-
-        if (hash_c1) {
-            DDS_Security_BinaryProperty_set_by_value(hash_c1, "hash_c1", hash_c1_ref->value._buffer,
-                            hash_c1_ref->value._length);
-        }
-        if (hash_c2) {
-            DDS_Security_BinaryProperty_set_by_value(hash_c2, "hash_c2", hash_c2_ref->value._buffer,
-                            hash_c2_ref->value._length);
-        }
-        if (dh1) {
-            DDS_Security_BinaryProperty_set_by_value(dh1, "dh1", dh1_ref->value._buffer,
-                            dh1_ref->value._length);
-        }
-        if (dh2) {
-            DDS_Security_BinaryProperty_set_by_value(dh2, "dh2", dh2_ref->value._buffer,
-                            dh2_ref->value._length);
-        }
-        assert(relation->lchallenge);
-        if (challenge1 && challenge1_ref) {
-            DDS_Security_BinaryProperty_set_by_value(challenge1, "challenge1", challenge1_ref->value._buffer,
-                            challenge1_ref->value._length);
-        }
-        assert(relation->rchallenge);
-        if (challenge2 && challenge2_ref) {
-            DDS_Security_BinaryProperty_set_by_value(challenge2, "challenge2", challenge2_ref->value._buffer,
-                            challenge2_ref->value._length);
-        }
-
-
-        /* Calculate the signature */
-        {
-           const DDS_Security_BinaryProperty_t * binary_properties[ HANDSHAKE_SIGNATURE_CONTENT_SIZE ];
-           DDS_Security_BinaryProperty_t *hash_c1_val = hash_value_to_binary_property("hash_c1", handshake->hash_c1);
-           DDS_Security_BinaryProperty_t *hash_c2_val = hash_value_to_binary_property("hash_c2", handshake->hash_c2);
-           unsigned char *sign;
-           size_t signlen;
-
-           binary_properties[0] = hash_c1_val;
-           binary_properties[1] = challenge1;
-           binary_properties[2] = dh1;
-           binary_properties[3] = challenge2;
-           binary_properties[4] = dh2;
-           binary_properties[5] = hash_c2_val;
-
-           result = create_signature(relation->localIdentity->privateKey, binary_properties, HANDSHAKE_SIGNATURE_CONTENT_SIZE, &sign, &signlen, ex);
-
-           DDS_Security_BinaryProperty_free(hash_c1_val);
-           DDS_Security_BinaryProperty_free(hash_c2_val);
-
-           if (result != DDS_SECURITY_VALIDATION_OK) {
-               goto err_signature;
-           }
-
-           DDS_Security_BinaryProperty_set_by_ref(signature, "signature", sign, (uint32_t)signlen);
-        }
-
-        handshake_message_out->class_id = ddsrt_strdup(AUTH_HANDSHAKE_FINAL_TOKEN_ID);
-        handshake_message_out->binary_properties._length = tokenSize;
-        handshake_message_out->binary_properties._buffer = tokens;
-
-        challenge1_ref_for_shared_secret = (DDS_Security_octet*)(handshake->relation->lchallenge);
-        challenge2_ref_for_shared_secret = (DDS_Security_octet*)(handshake->relation->rchallenge);
-
-        result =  DDS_SECURITY_VALIDATION_OK_FINAL_MESSAGE;
-
-        break;
-    case CREATEDREPLY:
-        /* The source of the handshake_handle is a begin_handshake_reply function
-         * So, handshake_message_in should have been came from a remote process_handshake function
-         */
-
-        /* Verify Message Token contents according to Spec 9.3.2.5.3 (Final Message)   */
-        result = validate_handshake_final_token(handshake_message_in, handshake, ex);
-        if (result != DDS_SECURITY_VALIDATION_OK) {
-            goto err_inv_token;
-        }
-
-
-        challenge2_ref_for_shared_secret = (DDS_Security_octet*)(handshake->relation->lchallenge);
-        challenge1_ref_for_shared_secret = (DDS_Security_octet*)(handshake->relation->rchallenge);
-
-        result =  DDS_SECURITY_VALIDATION_OK;
-
-        break;
-    default:
-        ddsrt_mutex_unlock(&impl->lock);
-        goto err_bad_param;
-    }
-
-    /* Compute shared secret */
-    {
-        DDS_Security_long shared_secret_length;
-        unsigned char *shared_secret;
-
-        if (!generate_shared_secret(handshake, &shared_secret, &shared_secret_length, ex)) {
-            goto err_openssl;
-        }
-
-        handshake->shared_secret_handle_impl = ddsrt_malloc( sizeof(DDS_Security_SharedSecretHandleImpl));
-        handshake->shared_secret_handle_impl->shared_secret = shared_secret;
-        handshake->shared_secret_handle_impl->shared_secret_size = shared_secret_length;
-
-        /* put references to challenge1 and challenge2 into shared secret object */
-        memcpy( handshake->shared_secret_handle_impl->challenge1, challenge1_ref_for_shared_secret, DDS_SECURITY_AUTHENTICATION_CHALLENGE_SIZE);
-        memcpy( handshake->shared_secret_handle_impl->challenge2, challenge2_ref_for_shared_secret, DDS_SECURITY_AUTHENTICATION_CHALLENGE_SIZE);
-    }
-
-    { /* setup expiry listener */
-        dds_time_t certExpiry = get_certificate_expiry( handshake->relation->remoteIdentity->identityCert );
-
-        if( certExpiry == DDS_TIME_INVALID ){
-          DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, (int)result, "Expiry date of the certificate is invalid");
-          goto err_invalid_expiry;
-        } else if( certExpiry != DDS_NEVER ){
-            add_validity_end_trigger( impl,
-                            IDENTITY_HANDLE( handshake->relation->remoteIdentity ),
-                            certExpiry);
-        }
-
-    }
-
-    ddsrt_mutex_unlock(&impl->lock);
-
-    return result;
+    else if (cert_exp != DDS_NEVER)
+      add_validity_end_trigger(impl, IDENTITY_HANDLE(handshake->relation->remoteIdentity), cert_exp);
+  }
+  ddsrt_mutex_unlock(&impl->lock);
+  return hs_result;
 
 err_invalid_expiry:
-    ddsrt_free( handshake->shared_secret_handle_impl->shared_secret );
-    ddsrt_free( handshake->shared_secret_handle_impl );
+  ddsrt_free(handshake->shared_secret_handle_impl->shared_secret);
+  ddsrt_free(handshake->shared_secret_handle_impl);
+  handshake->shared_secret_handle_impl = NULL;
 err_openssl:
 err_signature:
-    if (handshake_message_out->class_id) {
-        DDS_Security_DataHolder_deinit(handshake_message_out);
-    }
+  if (handshake_message_out->class_id)
+    DDS_Security_DataHolder_deinit(handshake_message_out);
 err_inv_token:
 err_inv_handle:
-    ddsrt_mutex_unlock(&impl->lock);
+  ddsrt_mutex_unlock(&impl->lock);
 err_bad_param:
-    return DDS_SECURITY_VALIDATION_FAILED;
+  return DDS_SECURITY_VALIDATION_FAILED;
 }
 
-DDS_Security_SharedSecretHandle get_shared_secret(
-        dds_security_authentication *instance,
-        const DDS_Security_HandshakeHandle handshake_handle,
-        DDS_Security_SecurityException *ex)
+DDS_Security_SharedSecretHandle get_shared_secret(dds_security_authentication *instance, const DDS_Security_HandshakeHandle handshake_handle, DDS_Security_SecurityException *ex)
 {
+  dds_security_authentication_impl *impl = (dds_security_authentication_impl *)instance;
+  SecurityObject *obj;
 
-    dds_security_authentication_impl *impl = (dds_security_authentication_impl *) instance;
-    SecurityObject *obj;
+  if (!instance || !handshake_handle)
+  {
+    DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "return_handshake_handle: Invalid parameter provided");
+    goto err_bad_param;
+  }
+  ddsrt_mutex_lock(&impl->lock);
+  obj = security_object_find(impl->objectHash, handshake_handle);
+  if (!obj || !security_object_valid(obj, SECURITY_OBJECT_KIND_HANDSHAKE))
+  {
+    DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "return_handshake_handle: Invalid handle provided");
+    goto err_invalid_handle;
+  }
+  ddsrt_mutex_unlock(&impl->lock);
+  return (DDS_Security_SharedSecretHandle)(ddsrt_address)((HandshakeInfo *)obj)->shared_secret_handle_impl;
 
-    /* validate provided arguments */
-    if (!instance || !handshake_handle) {
-       DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "return_handshake_handle: Invalid parameter provided");
-       goto err_bad_param;
-    }
-
-    ddsrt_mutex_lock(&impl->lock);
-    obj = security_object_find(impl->objectHash, handshake_handle);
-    if (!obj || !security_object_valid(obj, SECURITY_OBJECT_KIND_HANDSHAKE)) {
-       DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "return_handshake_handle: Invalid handle provided");
-       goto err_invalid_handle;
-    }
-
-    ddsrt_mutex_unlock(&impl->lock);
-    return (DDS_Security_SharedSecretHandle)(ddsrt_address)((HandshakeInfo*)obj)->shared_secret_handle_impl;
-
-
-    err_invalid_handle:
-        ddsrt_mutex_unlock(&impl->lock);
-    err_bad_param:
-    return DDS_SECURITY_HANDLE_NIL;
+err_invalid_handle:
+  ddsrt_mutex_unlock(&impl->lock);
+err_bad_param:
+  return DDS_SECURITY_HANDLE_NIL;
 }
 
-DDS_Security_boolean
-get_authenticated_peer_credential_token(
-        dds_security_authentication *instance,
-        DDS_Security_AuthenticatedPeerCredentialToken *peer_credential_token,
-        const DDS_Security_HandshakeHandle handshake_handle,
-        DDS_Security_SecurityException *ex)
+DDS_Security_boolean get_authenticated_peer_credential_token(dds_security_authentication *instance, DDS_Security_AuthenticatedPeerCredentialToken *peer_credential_token,
+    const DDS_Security_HandshakeHandle handshake_handle, DDS_Security_SecurityException *ex)
 {
-    dds_security_authentication_impl *impl = (dds_security_authentication_impl *) instance;
-    HandshakeInfo *handshake = NULL;
-    X509 *identity_cert;
-    char *permissions_doc;
-    unsigned char *cert_data;
-    uint32_t cert_data_size;
+  dds_security_authentication_impl *impl = (dds_security_authentication_impl *)instance;
+  HandshakeInfo *handshake = NULL;
+  X509 *identity_cert;
+  char *permissions_doc;
+  unsigned char *cert_data;
+  uint32_t cert_data_size;
 
-    /* validate provided arguments */
-    if (!instance || !handshake_handle || !peer_credential_token) {
-        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT,
-                DDS_SECURITY_ERR_INVALID_PARAMETER_CODE, 0,
-                DDS_SECURITY_ERR_INVALID_PARAMETER_MESSAGE);
-        return false;
-    }
+  if (!instance || !handshake_handle || !peer_credential_token)
+  {
+    DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_PARAMETER_CODE, 0, DDS_SECURITY_ERR_INVALID_PARAMETER_MESSAGE);
+    return false;
+  }
 
-    ddsrt_mutex_lock(&impl->lock);
+  ddsrt_mutex_lock(&impl->lock);
 
-    handshake = (HandshakeInfo *) security_object_find(impl->objectHash, handshake_handle);
-    if (!handshake || !SECURITY_OBJECT_VALID(handshake, SECURITY_OBJECT_KIND_HANDSHAKE)) {
-        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT,
-                DDS_SECURITY_ERR_INVALID_PARAMETER_CODE, 0,
-                DDS_SECURITY_ERR_INVALID_PARAMETER_MESSAGE);
-        goto err_inv_handle;
-    }
+  handshake = (HandshakeInfo *)security_object_find(impl->objectHash, handshake_handle);
+  if (!handshake || !SECURITY_OBJECT_VALID(handshake, SECURITY_OBJECT_KIND_HANDSHAKE))
+  {
+    DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_PARAMETER_CODE, 0, DDS_SECURITY_ERR_INVALID_PARAMETER_MESSAGE);
+    goto err_inv_handle;
+  }
 
-    identity_cert = handshake->relation->remoteIdentity->identityCert;
-    if (!identity_cert) {
-         DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT,
-                 DDS_SECURITY_ERR_OPERATION_NOT_PERMITTED_CODE, 0,
-                 DDS_SECURITY_ERR_OPERATION_NOT_PERMITTED_MESSAGE);
-         goto err_missing_attr;
-     }
+  if (!(identity_cert = handshake->relation->remoteIdentity->identityCert))
+  {
+    DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_OPERATION_NOT_PERMITTED_CODE, 0, DDS_SECURITY_ERR_OPERATION_NOT_PERMITTED_MESSAGE);
+    goto err_missing_attr;
+  }
 
-    permissions_doc = handshake->relation->remoteIdentity->permissionsDocument;
-    if (!permissions_doc) {
-        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT,
-                DDS_SECURITY_ERR_MISSING_REMOTE_PERMISSIONS_DOCUMENT_CODE, 0,
-                DDS_SECURITY_ERR_MISSING_REMOTE_PERMISSIONS_DOCUMENT_MESSAGE);
-        goto err_missing_attr;
-    }
+  if (!(permissions_doc = handshake->relation->remoteIdentity->permissionsDocument))
+  {
+    DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_MISSING_REMOTE_PERMISSIONS_DOCUMENT_CODE, 0, DDS_SECURITY_ERR_MISSING_REMOTE_PERMISSIONS_DOCUMENT_MESSAGE);
+    goto err_missing_attr;
+  }
 
-    if (get_certificate_contents(identity_cert, &cert_data, &cert_data_size, ex) != DDS_SECURITY_VALIDATION_OK) {
-        goto err_alloc_cid;
-    }
+  if (get_certificate_contents(identity_cert, &cert_data, &cert_data_size, ex) != DDS_SECURITY_VALIDATION_OK)
+    goto err_alloc_cid;
 
-    memset(peer_credential_token, 0, sizeof(*peer_credential_token));
-
-    peer_credential_token->class_id = get_authentication_class_id();
-
-    peer_credential_token->properties._length = 2;
-    peer_credential_token->properties._buffer = DDS_Security_PropertySeq_allocbuf(peer_credential_token->properties._length);
-
-    peer_credential_token->properties._buffer[0].name = ddsrt_strdup("c.id");
-    peer_credential_token->properties._buffer[0].value = (char *)cert_data;
-    peer_credential_token->properties._buffer[0].propagate = false;
-
-    peer_credential_token->properties._buffer[1].name = ddsrt_strdup("c.perm");
-    peer_credential_token->properties._buffer[1].value = ddsrt_strdup(permissions_doc);
-    peer_credential_token->properties._buffer[1].propagate = false;
-
-    ddsrt_mutex_unlock(&impl->lock);
-
-    return true;
+  memset(peer_credential_token, 0, sizeof(*peer_credential_token));
+  peer_credential_token->class_id = get_authentication_class_id();
+  peer_credential_token->properties._length = 2;
+  peer_credential_token->properties._buffer = DDS_Security_PropertySeq_allocbuf(peer_credential_token->properties._length);
+  peer_credential_token->properties._buffer[0].name = ddsrt_strdup("c.id");
+  peer_credential_token->properties._buffer[0].value = (char *)cert_data;
+  peer_credential_token->properties._buffer[0].propagate = false;
+  peer_credential_token->properties._buffer[1].name = ddsrt_strdup("c.perm");
+  peer_credential_token->properties._buffer[1].value = ddsrt_strdup(permissions_doc);
+  peer_credential_token->properties._buffer[1].propagate = false;
+  ddsrt_mutex_unlock(&impl->lock);
+  return true;
 
 err_alloc_cid:
 err_missing_attr:
 err_inv_handle:
-    ddsrt_mutex_unlock(&impl->lock);
+  ddsrt_mutex_unlock(&impl->lock);
+  return false;
+}
+
+DDS_Security_boolean set_listener(dds_security_authentication *instance, const dds_security_authentication_listener *listener, DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(ex);
+  dds_security_authentication_impl *auth = (dds_security_authentication_impl *)instance;
+  if (listener)
+    dds_security_timed_dispatcher_enable(auth->timed_callbacks, auth->dispatcher, (void *)listener);
+  else
+    dds_security_timed_dispatcher_disable(auth->timed_callbacks, auth->dispatcher);
+  return true;
+}
+
+DDS_Security_boolean return_identity_token(dds_security_authentication *instance, const DDS_Security_IdentityToken *token, DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(token);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+  return true;
+}
+
+DDS_Security_boolean return_identity_status_token(dds_security_authentication *instance, const DDS_Security_IdentityStatusToken *token, DDS_Security_SecurityException *ex)
+{
+  DDSRT_UNUSED_ARG(token);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+  return true;
+}
+
+DDS_Security_boolean return_authenticated_peer_credential_token(dds_security_authentication *instance, const DDS_Security_AuthenticatedPeerCredentialToken *peer_credential_token, DDS_Security_SecurityException *ex)
+{
+  if (!instance || !peer_credential_token)
+  {
+    DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_PARAMETER_CODE, 0, DDS_SECURITY_ERR_INVALID_PARAMETER_MESSAGE);
     return false;
+  }
+  DDS_Security_DataHolder_deinit((DDS_Security_DataHolder *)peer_credential_token);
+  return true;
 }
 
-DDS_Security_boolean set_listener(dds_security_authentication *instance,
-        const dds_security_authentication_listener *listener,
-        DDS_Security_SecurityException *ex)
+DDS_Security_boolean return_handshake_handle(dds_security_authentication *instance, const DDS_Security_HandshakeHandle handshake_handle, DDS_Security_SecurityException *ex)
 {
-    dds_security_authentication_impl *auth = (dds_security_authentication_impl*)instance;
+  dds_security_authentication_impl *impl = (dds_security_authentication_impl *)instance;
 
-    DDSRT_UNUSED_ARG(ex);
+  if (!instance || !handshake_handle)
+  {
+    DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "return_handshake_handle: Invalid parameter provided");
+    goto err_bad_param;
+  }
 
-    if (listener) {
-        dds_security_timed_dispatcher_enable(auth->timed_callbacks, auth->dispatcher, (void*)listener);
-    } else {
-        dds_security_timed_dispatcher_disable(auth->timed_callbacks, auth->dispatcher);
+  ddsrt_mutex_lock(&impl->lock);
+  SecurityObject *obj = security_object_find(impl->objectHash, handshake_handle);
+  if (!obj || !security_object_valid(obj, SECURITY_OBJECT_KIND_HANDSHAKE))
+  {
+    DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "return_handshake_handle: Invalid handle provided");
+    goto err_invalid_handle;
+  }
+  HandshakeInfo *handshake = (HandshakeInfo *)obj;
+  assert(handshake->relation);
+  (void)ddsrt_hh_remove(impl->objectHash, obj);
+  security_object_free((SecurityObject *)handshake);
+  ddsrt_mutex_unlock(&impl->lock);
+  return true;
+
+err_invalid_handle:
+  ddsrt_mutex_unlock(&impl->lock);
+err_bad_param:
+  return false;
+}
+
+static void invalidate_local_related_objects(dds_security_authentication_impl *impl, LocalIdentityInfo *localIdent)
+{
+  struct ddsrt_hh_iter it;
+  SecurityObject *obj;
+
+  for (obj = ddsrt_hh_iter_first(impl->objectHash, &it); obj != NULL; obj = ddsrt_hh_iter_next(&it))
+  {
+    if (obj->kind == SECURITY_OBJECT_KIND_REMOTE_IDENTITY)
+    {
+      RemoteIdentityInfo *remoteIdent = (RemoteIdentityInfo *)obj;
+      HandshakeInfo *handshake = find_handshake(impl, SECURITY_OBJECT_HANDLE(localIdent), SECURITY_OBJECT_HANDLE(remoteIdent));
+      if (handshake)
+      {
+        (void)ddsrt_hh_remove(impl->objectHash, handshake);
+        security_object_free((SecurityObject *)handshake);
+      }
+      IdentityRelation *relation = find_identity_relation(remoteIdent, SECURITY_OBJECT_HANDLE(localIdent));
+      if (relation)
+        remove_identity_relation(remoteIdent, relation);
     }
-
-    return true;
+  }
 }
 
-DDS_Security_boolean return_identity_token(dds_security_authentication *instance,
-        const DDS_Security_IdentityToken *token,
-        DDS_Security_SecurityException *ex)
+static void invalidate_remote_related_objects(dds_security_authentication_impl *impl, RemoteIdentityInfo *remoteIdentity)
 {
-    DDSRT_UNUSED_ARG(token);
-    DDSRT_UNUSED_ARG(ex);
-    DDSRT_UNUSED_ARG(instance);
-
-    return true;
-}
-
-DDS_Security_boolean return_identity_status_token(
-        dds_security_authentication *instance,
-        const DDS_Security_IdentityStatusToken *token,
-        DDS_Security_SecurityException *ex)
-{
-    DDSRT_UNUSED_ARG(token);
-    DDSRT_UNUSED_ARG(ex);
-    DDSRT_UNUSED_ARG(instance);
-
-    return true;
-}
-
-DDS_Security_boolean return_authenticated_peer_credential_token(
-        dds_security_authentication *instance,
-        const DDS_Security_AuthenticatedPeerCredentialToken *peer_credential_token,
-        DDS_Security_SecurityException *ex)
-{
-    if ((!instance) || (!peer_credential_token)) {
-        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_PARAMETER_CODE, 0, DDS_SECURITY_ERR_INVALID_PARAMETER_MESSAGE);
-        return false;
+  struct ddsrt_hh_iter it;
+  for (IdentityRelation *relation = ddsrt_hh_iter_first(remoteIdentity->linkHash, &it); relation != NULL; relation = ddsrt_hh_iter_next(&it))
+  {
+    HandshakeInfo *handshake = find_handshake(impl, SECURITY_OBJECT_HANDLE(relation->localIdentity), SECURITY_OBJECT_HANDLE(remoteIdentity));
+    if (handshake)
+    {
+      (void)ddsrt_hh_remove(impl->objectHash, handshake);
+      security_object_free((SecurityObject *)handshake);
     }
-
-    DDS_Security_DataHolder_deinit((DDS_Security_DataHolder *)peer_credential_token);
-
-    return true;
+    (void)ddsrt_hh_remove(remoteIdentity->linkHash, relation);
+    security_object_free((SecurityObject *)relation);
+  }
 }
 
-DDS_Security_boolean
-return_handshake_handle(dds_security_authentication *instance,
-        const DDS_Security_HandshakeHandle handshake_handle,
-        DDS_Security_SecurityException *ex)
+DDS_Security_boolean return_identity_handle(dds_security_authentication *instance, const DDS_Security_IdentityHandle identity_handle, DDS_Security_SecurityException *ex)
 {
-    dds_security_authentication_impl *impl = (dds_security_authentication_impl *) instance;
-    SecurityObject *obj;
-    HandshakeInfo *handshake;
+  dds_security_authentication_impl *impl = (dds_security_authentication_impl *)instance;
+  SecurityObject *obj;
+  LocalIdentityInfo *localIdent;
+  RemoteIdentityInfo *remoteIdent;
 
-    /* validate provided arguments */
-    if (!instance || !handshake_handle) {
-        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "return_handshake_handle: Invalid parameter provided");
-        goto err_bad_param;
-    }
-
-    ddsrt_mutex_lock(&impl->lock);
-    obj = security_object_find(impl->objectHash, handshake_handle);
-    if (!obj || !security_object_valid(obj, SECURITY_OBJECT_KIND_HANDSHAKE)) {
-        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "return_handshake_handle: Invalid handle provided");
-        goto err_invalid_handle;
-    }
-    handshake = (HandshakeInfo *)obj;
-
-    assert(handshake->relation);
+  if (!instance || !identity_handle)
+  {
+    DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "return_identity_handle: Invalid parameter provided");
+    goto err_bad_param;
+  }
 
+  /* Currently the implementation of the handle does not provide information about the kind of handle. In this case a valid handle could refer to a LocalIdentityObject or a RemoteIdentityObject */
+  ddsrt_mutex_lock(&impl->lock);
+  if (!(obj = security_object_find(impl->objectHash, identity_handle)))
+  {
+    DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "return_identity_handle: Invalid handle provided");
+    goto failed;
+  }
+  switch (obj->kind)
+  {
+  case SECURITY_OBJECT_KIND_LOCAL_IDENTITY:
+    localIdent = (LocalIdentityInfo *)obj;
+    invalidate_local_related_objects(impl, localIdent);
     (void)ddsrt_hh_remove(impl->objectHash, obj);
-    security_object_free((SecurityObject *)handshake);
+    security_object_free(obj);
+    break;
+  case SECURITY_OBJECT_KIND_REMOTE_IDENTITY:
+    remoteIdent = (RemoteIdentityInfo *)obj;
+    invalidate_remote_related_objects(impl, remoteIdent);
+    (void)ddsrt_hh_remove(impl->remoteGuidHash, remoteIdent);
+    (void)ddsrt_hh_remove(impl->objectHash, obj);
+    security_object_free(obj);
+    break;
+  default:
+    DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "return_identity_handle: Invalid handle provided");
+    goto failed;
+  }
+  ddsrt_mutex_unlock(&impl->lock);
+  return true;
 
-    ddsrt_mutex_unlock(&impl->lock);
-
-    return true;
-
-err_invalid_handle:
-    ddsrt_mutex_unlock(&impl->lock);
+failed:
+  ddsrt_mutex_unlock(&impl->lock);
 err_bad_param:
-    return false;
+  return false;
 }
 
-
-static void
-invalidate_local_related_objects(
-     dds_security_authentication_impl *impl,
-     LocalIdentityInfo *localIdent)
+DDS_Security_boolean return_sharedsecret_handle(dds_security_authentication *instance, const DDS_Security_SharedSecretHandle sharedsecret_handle, DDS_Security_SecurityException *ex)
 {
-    struct ddsrt_hh_iter it;
-    SecurityObject *obj;
-
-    for (obj = ddsrt_hh_iter_first(impl->objectHash, &it); obj != NULL; obj = ddsrt_hh_iter_next(&it)) {
-        if (obj->kind == SECURITY_OBJECT_KIND_REMOTE_IDENTITY) {
-            RemoteIdentityInfo *remoteIdent = (RemoteIdentityInfo *)obj;
-            IdentityRelation *relation;
-            HandshakeInfo *handshake;
-
-            handshake = find_handshake(impl, SECURITY_OBJECT_HANDLE(localIdent), SECURITY_OBJECT_HANDLE(remoteIdent));
-            if (handshake) {
-                (void)ddsrt_hh_remove(impl->objectHash, handshake);
-                security_object_free((SecurityObject *) handshake);
-            }
-
-            relation = find_identity_relation(remoteIdent, SECURITY_OBJECT_HANDLE(localIdent));
-            if (relation) {
-                remove_identity_relation(remoteIdent, relation);
-            }
-        }
-    }
+  DDSRT_UNUSED_ARG(sharedsecret_handle);
+  DDSRT_UNUSED_ARG(ex);
+  DDSRT_UNUSED_ARG(instance);
+  return true;
 }
 
-static void
-invalidate_remote_related_objects(
-    dds_security_authentication_impl *impl,
-    RemoteIdentityInfo *remoteIdentity)
+int32_t init_authentication(const char *argument, void **context)
 {
-    struct ddsrt_hh_iter it;
-    IdentityRelation *relation;
-    HandshakeInfo *handshake;
+  DDSRT_UNUSED_ARG(argument);
+  dds_security_authentication_impl *authentication;
 
-    for (relation = ddsrt_hh_iter_first(remoteIdentity->linkHash, &it); relation != NULL; relation = ddsrt_hh_iter_next(&it)) {
-        handshake = find_handshake(impl, SECURITY_OBJECT_HANDLE(relation->localIdentity), SECURITY_OBJECT_HANDLE(remoteIdentity));
-        if (handshake) {
-            (void)ddsrt_hh_remove(impl->objectHash, handshake);
-            security_object_free((SecurityObject *) handshake);
-        }
+  authentication = (dds_security_authentication_impl *)ddsrt_malloc(sizeof(dds_security_authentication_impl));
+  memset(authentication, 0, sizeof(dds_security_authentication_impl));
 
-        (void)ddsrt_hh_remove(remoteIdentity->linkHash, relation);
-        security_object_free((SecurityObject *) relation);
-    }
-}
+  authentication->timed_callbacks = dds_security_timed_cb_new();
+  authentication->dispatcher = dds_security_timed_dispatcher_new(authentication->timed_callbacks);
 
-DDS_Security_boolean
-return_identity_handle(
-        dds_security_authentication *instance,
-        const DDS_Security_IdentityHandle identity_handle,
-        DDS_Security_SecurityException *ex)
-{
-    DDS_Security_boolean result = true;
-    dds_security_authentication_impl *impl = (dds_security_authentication_impl *) instance;
-    SecurityObject *obj;
-    LocalIdentityInfo *localIdent;
-    RemoteIdentityInfo *remoteIdent;
+  authentication->base.validate_local_identity = &validate_local_identity;
+  authentication->base.get_identity_token = &get_identity_token;
+  authentication->base.get_identity_status_token = &get_identity_status_token;
+  authentication->base.set_permissions_credential_and_token = &set_permissions_credential_and_token;
+  authentication->base.validate_remote_identity = &validate_remote_identity;
+  authentication->base.begin_handshake_request = &begin_handshake_request;
+  authentication->base.begin_handshake_reply = &begin_handshake_reply;
+  authentication->base.process_handshake = &process_handshake;
+  authentication->base.get_shared_secret = &get_shared_secret;
+  authentication->base.get_authenticated_peer_credential_token = &get_authenticated_peer_credential_token;
+  authentication->base.set_listener = &set_listener;
+  authentication->base.return_identity_token = &return_identity_token;
+  authentication->base.return_identity_status_token = &return_identity_status_token;
+  authentication->base.return_authenticated_peer_credential_token = &return_authenticated_peer_credential_token;
+  authentication->base.return_handshake_handle = &return_handshake_handle;
+  authentication->base.return_identity_handle = &return_identity_handle;
+  authentication->base.return_sharedsecret_handle = &return_sharedsecret_handle;
+  ddsrt_mutex_init(&authentication->lock);
+  authentication->objectHash = ddsrt_hh_new(32, security_object_hash, security_object_equal);
+  authentication->remoteGuidHash = ddsrt_hh_new(32, remote_guid_hash, remote_guid_equal);
+  memset(&authentication->trustedCAList, 0, sizeof(X509Seq));
 
-    /* validate provided arguments */
-    if (!instance || !identity_handle) {
-        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "return_identity_handle: Invalid parameter provided");
-        goto err_bad_param;
-    }
+  OpenSSL_add_all_algorithms();
+  OpenSSL_add_all_ciphers();
+  OpenSSL_add_all_digests();
+  ERR_load_BIO_strings();
+  ERR_load_crypto_strings();
 
-    /* Currently the implementation of the handle does not provide information
-     * about the kind of handle. In this case a valid handle could refer to a
-     * LocalIdentityObject or a RemoteIdentityObject
-     */
-
-    ddsrt_mutex_lock(&impl->lock);
-
-    obj = security_object_find(impl->objectHash, identity_handle);
-    if (!obj) {
-        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "return_identity_handle: Invalid handle provided");
-        goto err_invalid_handle;
-    }
-
-    switch (obj->kind) {
-    case SECURITY_OBJECT_KIND_LOCAL_IDENTITY:
-        localIdent = (LocalIdentityInfo *) obj;
-        invalidate_local_related_objects(impl, localIdent);
-        (void)ddsrt_hh_remove(impl->objectHash, obj);
-        security_object_free(obj);
-        break;
-    case SECURITY_OBJECT_KIND_REMOTE_IDENTITY:
-        remoteIdent = (RemoteIdentityInfo *) obj;
-        invalidate_remote_related_objects(impl, remoteIdent);
-        (void)ddsrt_hh_remove(impl->remoteGuidHash, remoteIdent);
-        (void)ddsrt_hh_remove(impl->objectHash, obj);
-        security_object_free(obj);
-        break;
-    default:
-        DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "return_identity_handle: Invalid handle provided");
-        result = false;
-        break;
-    }
-
-    ddsrt_mutex_unlock(&impl->lock);
-
-    return result;
-
-err_invalid_handle:
-    ddsrt_mutex_unlock(&impl->lock);
-err_bad_param:
-    return false;
-}
-
-DDS_Security_boolean return_sharedsecret_handle(
-        dds_security_authentication *instance,
-        const DDS_Security_SharedSecretHandle sharedsecret_handle,
-        DDS_Security_SecurityException *ex)
-{
-    DDSRT_UNUSED_ARG(sharedsecret_handle);
-    DDSRT_UNUSED_ARG(ex);
-    DDSRT_UNUSED_ARG(instance);
-
-    return true;
-}
-
-int32_t
-init_authentication( const char *argument, void **context)
-{
-
-    dds_security_authentication_impl *authentication;
-
-    DDSRT_UNUSED_ARG(argument);
-
-    /* allocate implementation wrapper */
-    authentication = (dds_security_authentication_impl*) ddsrt_malloc(
-      sizeof(dds_security_authentication_impl));
-    memset(authentication, 0, sizeof(dds_security_authentication_impl));
-
-    /* assign dispatcher to be notified when a validity date ends */
-    authentication->timed_callbacks = dds_security_timed_cb_new();
-    authentication->dispatcher = dds_security_timed_dispatcher_new(authentication->timed_callbacks);
-
-    /* assign the interface functions */
-    authentication->base.validate_local_identity = &validate_local_identity;
-
-    authentication->base.get_identity_token = &get_identity_token;
-
-    authentication->base.get_identity_status_token = &get_identity_status_token;
-
-    authentication->base.set_permissions_credential_and_token =
-            &set_permissions_credential_and_token;
-
-    authentication->base.validate_remote_identity = &validate_remote_identity;
-
-    authentication->base.begin_handshake_request = &begin_handshake_request;
-
-    authentication->base.begin_handshake_reply = &begin_handshake_reply;
-
-    authentication->base.process_handshake = &process_handshake;
-
-    authentication->base.get_shared_secret = &get_shared_secret;
-
-    authentication->base.get_authenticated_peer_credential_token =
-            &get_authenticated_peer_credential_token;
-
-    authentication->base.set_listener = &set_listener;
-
-    authentication->base.return_identity_token = &return_identity_token;
-
-    authentication->base.return_identity_status_token =
-            &return_identity_status_token;
-
-    authentication->base.return_authenticated_peer_credential_token =
-            &return_authenticated_peer_credential_token;
-
-    authentication->base.return_handshake_handle = &return_handshake_handle;
-
-    authentication->base.return_identity_handle = &return_identity_handle;
-
-    authentication->base.return_sharedsecret_handle = &return_sharedsecret_handle;
-
-    ddsrt_mutex_init(&authentication->lock);
-
-    authentication->objectHash = ddsrt_hh_new(32, security_object_hash, security_object_equal);
-    authentication->remoteGuidHash = ddsrt_hh_new(32, remote_guid_hash, remote_guid_equal);
-
-    memset( &authentication->trustedCAList, 0, sizeof(X509Seq));
-
-
-    /* Initialize openssl */
-    OpenSSL_add_all_algorithms();
-    OpenSSL_add_all_ciphers();
-    OpenSSL_add_all_digests();
-    ERR_load_BIO_strings();
-    ERR_load_crypto_strings();
-
-    //return the instance
-    *context = authentication;
-    return 0;
-
-/*    we can not get ddsrt_mutex_init result. So ignore the lines below */
-#if MUTEX_INIT_RESULT_IMPLEMENTED
-err_mutex_failed:
-    ddsrt_free(authentication);
-    return -1;
-#endif
+  *context = authentication;
+  return 0;
 }
 
 int32_t finalize_authentication(void *instance)
 {
-    dds_security_authentication_impl *authentication = instance;
-
-    if( authentication ){
-        ddsrt_mutex_lock(&authentication->lock);
-
-        dds_security_timed_dispatcher_free(authentication->timed_callbacks, authentication->dispatcher);
-        dds_security_timed_cb_free(authentication->timed_callbacks);
-
-        if (authentication->remoteGuidHash) {
-            ddsrt_hh_free(authentication->remoteGuidHash);
-        }
-
-        if (authentication->objectHash) {
-            struct ddsrt_hh_iter it;
-            SecurityObject *obj;
-            for (obj = ddsrt_hh_iter_first(authentication->objectHash, &it); obj != NULL; obj = ddsrt_hh_iter_next(&it)) {
-                security_object_free(obj);
-            }
-            ddsrt_hh_free(authentication->objectHash);
-        }
-
-        free_ca_list_contents(&(authentication->trustedCAList));
-
-        ddsrt_mutex_unlock(&authentication->lock);
-
-        ddsrt_mutex_destroy(&authentication->lock);
-
-        ddsrt_free((dds_security_authentication_impl*) instance);
+  dds_security_authentication_impl *authentication = instance;
+  if (authentication)
+  {
+    ddsrt_mutex_lock(&authentication->lock);
+    dds_security_timed_dispatcher_free(authentication->timed_callbacks, authentication->dispatcher);
+    dds_security_timed_cb_free(authentication->timed_callbacks);
+    if (authentication->remoteGuidHash)
+      ddsrt_hh_free(authentication->remoteGuidHash);
+    if (authentication->objectHash)
+    {
+      struct ddsrt_hh_iter it;
+      for (SecurityObject *obj = ddsrt_hh_iter_first(authentication->objectHash, &it); obj != NULL; obj = ddsrt_hh_iter_next(&it))
+        security_object_free(obj);
+      ddsrt_hh_free(authentication->objectHash);
     }
+    free_ca_list_contents(&(authentication->trustedCAList));
+    ddsrt_mutex_unlock(&authentication->lock);
+    ddsrt_mutex_destroy(&authentication->lock);
+    ddsrt_free((dds_security_authentication_impl *)instance);
+  }
 
-    RAND_cleanup();
-    EVP_cleanup();
-    CRYPTO_cleanup_all_ex_data();
-    REMOVE_THREAD_STATE();
-    ERR_free_strings();
-
-    return 0;
+  RAND_cleanup();
+  EVP_cleanup();
+  CRYPTO_cleanup_all_ex_data();
+  REMOVE_THREAD_STATE();
+  ERR_free_strings();
+  return 0;
 }
diff --git a/src/security/builtin_plugins/authentication/src/authentication.h b/src/security/builtin_plugins/authentication/src/authentication.h
index dcbcfd6..4e56a12 100644
--- a/src/security/builtin_plugins/authentication/src/authentication.h
+++ b/src/security/builtin_plugins/authentication/src/authentication.h
@@ -10,7 +10,6 @@
  * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
  */
 
-
 #ifndef SECURITY_BUILTIN_PLUGINS_AUTHENTICATION_H_
 #define SECURITY_BUILTIN_PLUGINS_AUTHENTICATION_H_
 
@@ -18,129 +17,34 @@
 #include "dds/security/dds_security_api.h"
 #include "dds/security/export.h"
 
-SECURITY_EXPORT int32_t
-init_authentication(const char *argument, void **context);
-
-SECURITY_EXPORT int32_t
-finalize_authentication(void *context);
-
-
-
-
-DDS_Security_ValidationResult_t
-validate_local_identity(
-        dds_security_authentication *instance,
-        DDS_Security_IdentityHandle *local_identity_handle,
-        DDS_Security_GUID_t *adjusted_participant_guid,
-        const DDS_Security_DomainId domain_id,
-        const DDS_Security_Qos *participant_qos,
-        const DDS_Security_GUID_t *candidate_participant_guid,
-
-        DDS_Security_SecurityException *ex);
-DDS_Security_boolean
-get_identity_token(dds_security_authentication *instance,
-                   DDS_Security_IdentityToken *identity_token,
-                   const DDS_Security_IdentityHandle handle,
-                   DDS_Security_SecurityException *ex);
-DDS_Security_boolean
-set_permissions_credential_and_token(
-        dds_security_authentication *instance,
-        const DDS_Security_IdentityHandle handle,
-        const DDS_Security_PermissionsCredentialToken *permissions_credential,
-        const DDS_Security_PermissionsToken *permissions_token,
-        DDS_Security_SecurityException *ex);
-
-DDS_Security_ValidationResult_t
-validate_remote_identity(
-        dds_security_authentication *instance,
-        DDS_Security_IdentityHandle *remote_identity_handle,
-        DDS_Security_AuthRequestMessageToken *local_auth_request_token,
-        const DDS_Security_AuthRequestMessageToken *remote_auth_request_token,
-        const DDS_Security_IdentityHandle local_identity_handle,
-        const DDS_Security_IdentityToken *remote_identity_token,
-        const DDS_Security_GUID_t *remote_participant_guid,
-        DDS_Security_SecurityException *ex);
-
-DDS_Security_ValidationResult_t
-begin_handshake_request(
-        dds_security_authentication *instance,
-        DDS_Security_HandshakeHandle *handshake_handle,
-        DDS_Security_HandshakeMessageToken *handshake_message,
-        const DDS_Security_IdentityHandle initiator_identity_handle,
-        const DDS_Security_IdentityHandle replier_identity_handle,
-        const DDS_Security_OctetSeq *serialized_local_participant_data,
-        DDS_Security_SecurityException *ex);
-
-DDS_Security_ValidationResult_t
-begin_handshake_reply(
-        dds_security_authentication *instance,
-        DDS_Security_HandshakeHandle *handshake_handle,
-        DDS_Security_HandshakeMessageToken *handshake_message_out,
-        const DDS_Security_HandshakeMessageToken *handshake_message_in,
-        const DDS_Security_IdentityHandle initiator_identity_handle,
-        const DDS_Security_IdentityHandle replier_identity_handle,
-        const DDS_Security_OctetSeq *serialized_local_participant_data,
-        DDS_Security_SecurityException *ex);
-
-DDS_Security_ValidationResult_t
-process_handshake(
-        dds_security_authentication *instance,
-        DDS_Security_HandshakeMessageToken *handshake_message_out,
-        const DDS_Security_HandshakeMessageToken *handshake_message_in,
-        const DDS_Security_HandshakeHandle handshake_handle,
-        DDS_Security_SecurityException *ex);
-
-DDS_Security_SharedSecretHandle get_shared_secret(
-        dds_security_authentication *instance,
-        const DDS_Security_HandshakeHandle handshake_handle,
-        DDS_Security_SecurityException *ex);
-
-DDS_Security_boolean
-get_authenticated_peer_credential_token(
-        dds_security_authentication *instance,
-        DDS_Security_AuthenticatedPeerCredentialToken *peer_credential_token,
-        const DDS_Security_HandshakeHandle handshake_handle,
-        DDS_Security_SecurityException *ex);
-
-
-DDS_Security_boolean get_identity_status_token(
-        dds_security_authentication *instance,
-        DDS_Security_IdentityStatusToken *identity_status_token,
-        const DDS_Security_IdentityHandle handle,
-        DDS_Security_SecurityException *ex);
-
-DDS_Security_boolean set_listener(dds_security_authentication *instance,
-                                  const dds_security_authentication_listener *listener,
-                                  DDS_Security_SecurityException *ex);
-
-DDS_Security_boolean return_identity_token(dds_security_authentication *instance,
-                                           const DDS_Security_IdentityToken *token,
-                                           DDS_Security_SecurityException *ex);
-
-DDS_Security_boolean return_identity_status_token(
-        dds_security_authentication *instance,
-        const DDS_Security_IdentityStatusToken *token,
-        DDS_Security_SecurityException *ex);
-
-DDS_Security_boolean return_authenticated_peer_credential_token(
-        dds_security_authentication *instance,
-        const DDS_Security_AuthenticatedPeerCredentialToken *peer_credential_token,
-        DDS_Security_SecurityException *ex);
-
-DDS_Security_boolean
-return_handshake_handle(dds_security_authentication *instance,
-                        const DDS_Security_HandshakeHandle handshake_handle,
-                        DDS_Security_SecurityException *ex);
-DDS_Security_boolean
-return_identity_handle(
-        dds_security_authentication *instance,
-        const DDS_Security_IdentityHandle identity_handle,
-        DDS_Security_SecurityException *ex);
-
-DDS_Security_boolean return_sharedsecret_handle(
-        dds_security_authentication *instance,
-        const DDS_Security_SharedSecretHandle sharedsecret_handle,
-        DDS_Security_SecurityException *ex);
+SECURITY_EXPORT int32_t init_authentication(const char *argument, void **context);
+SECURITY_EXPORT int32_t finalize_authentication(void *context);
 
+DDS_Security_ValidationResult_t validate_local_identity(dds_security_authentication *instance, DDS_Security_IdentityHandle *local_identity_handle, DDS_Security_GUID_t *adjusted_participant_guid,
+    const DDS_Security_DomainId domain_id, const DDS_Security_Qos *participant_qos, const DDS_Security_GUID_t *candidate_participant_guid, DDS_Security_SecurityException *ex);
+DDS_Security_boolean get_identity_token(dds_security_authentication *instance, DDS_Security_IdentityToken *identity_token, const DDS_Security_IdentityHandle handle, DDS_Security_SecurityException *ex);
+DDS_Security_boolean set_permissions_credential_and_token(dds_security_authentication *instance, const DDS_Security_IdentityHandle handle, const DDS_Security_PermissionsCredentialToken *permissions_credential,
+    const DDS_Security_PermissionsToken *permissions_token, DDS_Security_SecurityException *ex);
+DDS_Security_ValidationResult_t validate_remote_identity(dds_security_authentication *instance, DDS_Security_IdentityHandle *remote_identity_handle, DDS_Security_AuthRequestMessageToken *local_auth_request_token,
+    const DDS_Security_AuthRequestMessageToken *remote_auth_request_token, const DDS_Security_IdentityHandle local_identity_handle, const DDS_Security_IdentityToken *remote_identity_token,
+    const DDS_Security_GUID_t *remote_participant_guid, DDS_Security_SecurityException *ex);
+DDS_Security_ValidationResult_t begin_handshake_request(dds_security_authentication *instance, DDS_Security_HandshakeHandle *handshake_handle, DDS_Security_HandshakeMessageToken *handshake_message,
+    const DDS_Security_IdentityHandle initiator_identity_handle, const DDS_Security_IdentityHandle replier_identity_handle, const DDS_Security_OctetSeq *serialized_local_participant_data, DDS_Security_SecurityException *ex);
+DDS_Security_ValidationResult_t begin_handshake_reply(dds_security_authentication *instance, DDS_Security_HandshakeHandle *handshake_handle, DDS_Security_HandshakeMessageToken *handshake_message_out,
+    const DDS_Security_HandshakeMessageToken *handshake_message_in, const DDS_Security_IdentityHandle initiator_identity_handle, const DDS_Security_IdentityHandle replier_identity_handle,
+    const DDS_Security_OctetSeq *serialized_local_participant_data, DDS_Security_SecurityException *ex);
+DDS_Security_ValidationResult_t process_handshake(dds_security_authentication *instance, DDS_Security_HandshakeMessageToken *handshake_message_out, const DDS_Security_HandshakeMessageToken *handshake_message_in,
+    const DDS_Security_HandshakeHandle handshake_handle, DDS_Security_SecurityException *ex);
+DDS_Security_SharedSecretHandle get_shared_secret(dds_security_authentication *instance, const DDS_Security_HandshakeHandle handshake_handle, DDS_Security_SecurityException *ex);
+DDS_Security_boolean get_authenticated_peer_credential_token(dds_security_authentication *instance, DDS_Security_AuthenticatedPeerCredentialToken *peer_credential_token,
+    const DDS_Security_HandshakeHandle handshake_handle, DDS_Security_SecurityException *ex);
+DDS_Security_boolean get_identity_status_token(dds_security_authentication *instance, DDS_Security_IdentityStatusToken *identity_status_token, const DDS_Security_IdentityHandle handle, DDS_Security_SecurityException *ex);
+DDS_Security_boolean set_listener(dds_security_authentication *instance, const dds_security_authentication_listener *listener, DDS_Security_SecurityException *ex);
+DDS_Security_boolean return_identity_token(dds_security_authentication *instance, const DDS_Security_IdentityToken *token, DDS_Security_SecurityException *ex);
+DDS_Security_boolean return_identity_status_token(dds_security_authentication *instance, const DDS_Security_IdentityStatusToken *token, DDS_Security_SecurityException *ex);
+DDS_Security_boolean return_authenticated_peer_credential_token(dds_security_authentication *instance, const DDS_Security_AuthenticatedPeerCredentialToken *peer_credential_token, DDS_Security_SecurityException *ex);
+DDS_Security_boolean return_handshake_handle(dds_security_authentication *instance, const DDS_Security_HandshakeHandle handshake_handle, DDS_Security_SecurityException *ex);
+DDS_Security_boolean return_identity_handle(dds_security_authentication *instance, const DDS_Security_IdentityHandle identity_handle, DDS_Security_SecurityException *ex);
+DDS_Security_boolean return_sharedsecret_handle(dds_security_authentication *instance, const DDS_Security_SharedSecretHandle sharedsecret_handle, DDS_Security_SecurityException *ex);
 
 #endif /* SECURITY_BUILTIN_PLUGINS_AUTHENTICATION_H_ */

From 0768ad59edfacc203db8f047c2321472a2c243e8 Mon Sep 17 00:00:00 2001
From: Dennis Potman <45659984+dennis-adlink@users.noreply.github.com>
Date: Fri, 20 Mar 2020 13:44:27 +0100
Subject: [PATCH 129/238] Remove duplicated code in authentication plugin
 (#442)

* Remove duplicated code in authentication plugin

Signed-off-by: Dennis Potman <dennis.potman@adlinktech.com>

* Fix build warnings

Signed-off-by: Dennis Potman <dennis.potman@adlinktech.com>

* Fix memory leak and call create_validate_asymmetrical_signature directly from create_validate_signature_impl

Signed-off-by: Dennis Potman <dennis.potman@adlinktech.com>

* Fix refcount issue (assert in openssl) for identity cert in hs remote info

Signed-off-by: Dennis Potman <dennis.potman@adlinktech.com>

* Refactoring of validate_handshake_token function

Co-authored-by: Erik Boasson <eb@ilities.com>
Signed-off-by: Dennis Potman <dennis.potman@adlinktech.com>
---
 .../authentication/src/auth_utils.c           |  84 +-
 .../authentication/src/auth_utils.h           |   4 +-
 .../authentication/src/authentication.c       | 802 ++++++------------
 .../dds/security/core/dds_security_utils.h    |  12 +-
 src/security/core/src/dds_security_utils.c    |  73 +-
 5 files changed, 348 insertions(+), 627 deletions(-)

diff --git a/src/security/builtin_plugins/authentication/src/auth_utils.c b/src/security/builtin_plugins/authentication/src/auth_utils.c
index 54e94b2..e79a951 100644
--- a/src/security/builtin_plugins/authentication/src/auth_utils.c
+++ b/src/security/builtin_plugins/authentication/src/auth_utils.c
@@ -956,94 +956,54 @@ DDS_Security_ValidationResult_t get_trusted_ca_list(const char *trusted_ca_dir,
   return failed ? DDS_SECURITY_VALIDATION_FAILED : DDS_SECURITY_VALIDATION_OK;
 }
 
-DDS_Security_ValidationResult_t create_asymmetrical_signature(EVP_PKEY *pkey, const unsigned char *data, const size_t dataLen,
+DDS_Security_ValidationResult_t create_validate_asymmetrical_signature(bool create, EVP_PKEY *pkey, const unsigned char *data, const size_t dataLen,
     unsigned char **signature, size_t *signatureLen, DDS_Security_SecurityException *ex)
 {
   EVP_MD_CTX *mdctx = NULL;
   EVP_PKEY_CTX *kctx = NULL;
-
   if (!(mdctx = EVP_MD_CTX_create()))
   {
-    DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "Failed to create signing context: ");
-    goto err_create_ctx;
+    DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "Failed to create digest context: ");
+    return DDS_SECURITY_VALIDATION_FAILED;
   }
-  if (EVP_DigestSignInit(mdctx, &kctx, EVP_sha256(), NULL, pkey) != 1)
+  if ((create ? EVP_DigestSignInit(mdctx, &kctx, EVP_sha256(), NULL, pkey) : EVP_DigestVerifyInit(mdctx, &kctx, EVP_sha256(), NULL, pkey)) != 1)
   {
-    DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "Failed to initialize signing context: ");
-    goto err_sign;
+    DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "Failed to initialize digest context: ");
+    goto err;
   }
   if (EVP_PKEY_id(pkey) == EVP_PKEY_RSA)
   {
     if (EVP_PKEY_CTX_set_rsa_padding(kctx, RSA_PKCS1_PSS_PADDING) < 1)
     {
-      DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "Failed to initialize signing context: ");
-      goto err_sign;
+      DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "Failed to initialize digest context: ");
+      goto err;
     }
   }
-  if (EVP_DigestSignUpdate(mdctx, data, dataLen) != 1)
+  if ((create ? EVP_DigestSignUpdate(mdctx, data, dataLen) : EVP_DigestVerifyUpdate(mdctx, data, dataLen)) != 1)
   {
-    DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "Failed to update signing context: ");
-    goto err_sign;
+    DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "Failed to update digest context: ");
+    goto err;
   }
-  if (EVP_DigestSignFinal(mdctx, NULL, signatureLen) != 1)
+  if (create)
   {
-    DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "Failed to finalize signing context: ");
-    goto err_sign;
-  }
-  *signature = ddsrt_malloc(sizeof(unsigned char) * (*signatureLen));
-  if (EVP_DigestSignFinal(mdctx, *signature, signatureLen) != 1)
-  {
-    DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "Failed to finalize signing context: ");
-    ddsrt_free(*signature);
-    goto err_sign;
-  }
-  EVP_MD_CTX_destroy(mdctx);
-  return DDS_SECURITY_VALIDATION_OK;
-
-err_sign:
-  EVP_MD_CTX_destroy(mdctx);
-err_create_ctx:
-  return DDS_SECURITY_VALIDATION_FAILED;
-}
-
-DDS_Security_ValidationResult_t validate_asymmetrical_signature(EVP_PKEY *pkey, const unsigned char *data, const size_t dataLen,
-    const unsigned char *signature, const size_t signatureLen, DDS_Security_SecurityException *ex)
-{
-  EVP_MD_CTX *mdctx = NULL;
-  EVP_PKEY_CTX *kctx = NULL;
-  if (!(mdctx = EVP_MD_CTX_create()))
-  {
-    DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "Failed to create verify context: ");
-    goto err_create_ctx;
-  }
-  if (EVP_DigestVerifyInit(mdctx, &kctx, EVP_sha256(), NULL, pkey) != 1)
-  {
-    DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "Failed to initialize verify context: ");
-    goto err_verify;
-  }
-  if (EVP_PKEY_id(pkey) == EVP_PKEY_RSA)
-  {
-    if (EVP_PKEY_CTX_set_rsa_padding(kctx, RSA_PKCS1_PSS_PADDING) < 1)
+    if (EVP_DigestSignFinal(mdctx, NULL, signatureLen) != 1)
     {
-      DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "Failed to initialize signing context: ");
-      goto err_verify;
+      DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "Failed to finalize digest context: ");
+      goto err;
     }
+    *signature = ddsrt_malloc(sizeof(unsigned char) * (*signatureLen));
   }
-  if (EVP_DigestVerifyUpdate(mdctx, data, dataLen) != 1)
+  if ((create ? EVP_DigestSignFinal(mdctx, *signature, signatureLen) : EVP_DigestVerifyFinal(mdctx, *signature, *signatureLen)) != 1)
   {
-    DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "Failed to update verify context: ");
-    goto err_verify;
-  }
-  if (EVP_DigestVerifyFinal(mdctx, signature, signatureLen) != 1)
-  {
-    DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "Failed to finalize verify context: ");
-    goto err_verify;
+    DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "Failed to finalize digest context: ");
+    if (create)
+      ddsrt_free(*signature);
+    goto err;
   }
   EVP_MD_CTX_destroy(mdctx);
   return DDS_SECURITY_VALIDATION_OK;
 
-err_verify:
+err:
   EVP_MD_CTX_destroy(mdctx);
-err_create_ctx:
   return DDS_SECURITY_VALIDATION_FAILED;
 }
diff --git a/src/security/builtin_plugins/authentication/src/auth_utils.h b/src/security/builtin_plugins/authentication/src/auth_utils.h
index bbde1ba..52ca1f7 100644
--- a/src/security/builtin_plugins/authentication/src/auth_utils.h
+++ b/src/security/builtin_plugins/authentication/src/auth_utils.h
@@ -100,7 +100,7 @@ AuthConfItemPrefix_t get_conf_item_type(const char *str, char **data);
 void free_ca_list_contents(X509Seq *ca_list);
 DDS_Security_ValidationResult_t get_trusted_ca_list(const char* trusted_ca_dir, X509Seq *ca_list, DDS_Security_SecurityException *ex);
 char * string_from_data(const unsigned char *data, uint32_t size);
-DDS_Security_ValidationResult_t create_asymmetrical_signature(EVP_PKEY *pkey, const unsigned char *data, const size_t dataLen, unsigned char **signature, size_t *signatureLen, DDS_Security_SecurityException *ex);
-DDS_Security_ValidationResult_t validate_asymmetrical_signature(EVP_PKEY *pkey, const unsigned char *data, const size_t dataLen, const unsigned char *signature, const size_t signatureLen, DDS_Security_SecurityException *ex);
+DDS_Security_ValidationResult_t create_validate_asymmetrical_signature(bool create, EVP_PKEY *pkey, const unsigned char *data, const size_t dataLen,
+    unsigned char **signature, size_t *signatureLen, DDS_Security_SecurityException *ex);
 
 #endif /* AUTH_UTILS_H */
diff --git a/src/security/builtin_plugins/authentication/src/authentication.c b/src/security/builtin_plugins/authentication/src/authentication.c
index 79f03bd..951e07e 100644
--- a/src/security/builtin_plugins/authentication/src/authentication.c
+++ b/src/security/builtin_plugins/authentication/src/authentication.c
@@ -570,40 +570,33 @@ static void get_hash_binary_property_seq(const DDS_Security_BinaryPropertySeq *s
   DDS_Security_Serializer_free(serializer);
 }
 
-static DDS_Security_ValidationResult_t create_signature(EVP_PKEY *pkey, const DDS_Security_BinaryProperty_t **binary_properties,
-    const uint32_t binary_properties_length, unsigned char **signature, size_t *signatureLen, DDS_Security_SecurityException *ex)
+static DDS_Security_ValidationResult_t create_validate_signature_impl(bool create, EVP_PKEY *pkey, const DDS_Security_BinaryProperty_t **bprops,
+    const uint32_t n_bprops, unsigned char **signature, size_t *signature_len, DDS_Security_SecurityException *ex)
 {
   DDS_Security_ValidationResult_t result;
   unsigned char *buffer;
   size_t size;
   DDS_Security_Serializer serializer = DDS_Security_Serializer_new(4096, 4096);
-
-  DDS_Security_Serialize_BinaryPropertyArray(serializer, binary_properties, binary_properties_length);
+  DDS_Security_Serialize_BinaryPropertyArray(serializer, bprops, n_bprops);
   DDS_Security_Serializer_buffer(serializer, &buffer, &size);
-
-  result = create_asymmetrical_signature(pkey, buffer, size, signature, signatureLen, ex);
+  result = create_validate_asymmetrical_signature(create, pkey, buffer, size, signature, signature_len, ex);
   ddsrt_free(buffer);
   DDS_Security_Serializer_free(serializer);
-
   return result;
 }
 
-static DDS_Security_ValidationResult_t validate_signature(EVP_PKEY *pkey, const DDS_Security_BinaryProperty_t **properties,
-    const uint32_t properties_length, unsigned char *signature, size_t signatureLen, DDS_Security_SecurityException *ex)
+static DDS_Security_ValidationResult_t create_signature(EVP_PKEY *pkey, const DDS_Security_BinaryProperty_t **bprops,
+    const uint32_t n_bprops, unsigned char **signature, size_t *signature_len, DDS_Security_SecurityException *ex)
 {
-  DDS_Security_ValidationResult_t result;
-  unsigned char *buffer;
-  size_t size;
-  DDS_Security_Serializer serializer = DDS_Security_Serializer_new(4096, 4096);
+  return create_validate_signature_impl(true, pkey, bprops, n_bprops, signature, signature_len, ex);
+}
 
-  DDS_Security_Serialize_BinaryPropertyArray(serializer, properties, properties_length);
-  DDS_Security_Serializer_buffer(serializer, &buffer, &size);
-
-  result = validate_asymmetrical_signature(pkey, buffer, size, signature, signatureLen, ex);
-  ddsrt_free(buffer);
-  DDS_Security_Serializer_free(serializer);
-
-  return result;
+static DDS_Security_ValidationResult_t validate_signature(EVP_PKEY *pkey, const DDS_Security_BinaryProperty_t **bprops,
+    const uint32_t n_bprops, const unsigned char *signature, size_t signature_len, DDS_Security_SecurityException *ex)
+{
+  unsigned char *s = (unsigned char *)signature;
+  size_t s_len = signature_len;
+  return create_validate_signature_impl(false, pkey, bprops, n_bprops, &s, &s_len, ex);
 }
 
 static DDS_Security_ValidationResult_t compute_hash_value(HashValue_t value, const DDS_Security_BinaryProperty_t **properties,
@@ -1089,19 +1082,12 @@ DDS_Security_ValidationResult_t validate_remote_identity(dds_security_authentica
       ddsrt_free(lchallenge);
     }
   }
-
   ddsrt_mutex_unlock(&impl->lock);
 
   if (!remote_auth_request_token)
-  {
-    /* Create local_auth_request_token with contents set to the challenge */
     fill_auth_request_token(local_auth_request_token, relation->lchallenge);
-  }
   else
-  {
-    /* Set local_auth_request token to TokenNil */
     DDS_Security_set_token_nil(local_auth_request_token);
-  }
 
   *remote_identity_handle = IDENTITY_HANDLE(remoteIdent);
   return memcmp(&localIdent->adjustedGUID, &remoteIdent->guid, sizeof(DDS_Security_GUID_t)) < 0 ?
@@ -1206,6 +1192,7 @@ DDS_Security_ValidationResult_t begin_handshake_request(dds_security_authenticat
   DDS_Security_BinaryProperty_set_by_string(c_dsign_algo, "c.dsign_algo", get_dsign_algo(localIdent->dsignAlgoKind));
   DDS_Security_BinaryProperty_set_by_string(c_kagree_algo, "c.kagree_algo", get_kagree_algo(localIdent->kagreeAlgoKind));
 
+  /* Todo: including hash_c1 is optional (conform spec); add a configuration option to leave it out */
   {
     DDS_Security_BinaryPropertySeq bseq = { ._length = 5, ._buffer = tokens };
     get_hash_binary_property_seq(&bseq, handshake->hash_c1);
@@ -1285,549 +1272,314 @@ failed_deser:
   return DDS_SECURITY_VALIDATION_FAILED;
 }
 
-static DDS_Security_ValidationResult_t validate_handshake_request_token(const DDS_Security_HandshakeMessageToken *token, HandshakeInfo *handshake, X509Seq *trusted_ca_list, DDS_Security_SecurityException *ex)
+enum handshake_token_type
 {
-  IdentityRelation *relation = handshake->relation;
-  X509 *identityCert;
-  const DDS_Security_BinaryProperty_t *c_id, *c_perm, *c_pdata, *c_dsign_algo, *c_kagree_algo, *dh1, *challenge, *hash_c1;
-  EVP_PKEY *pdhkey = NULL;
-  AuthenticationAlgoKind_t dsignAlgoKind, kagreeAlgoKind;
+  HS_TOKEN_REQ,
+  HS_TOKEN_REPLY,
+  HS_TOKEN_FINAL
+};
 
-  assert(relation);
+static DDS_Security_ValidationResult_t set_exception (DDS_Security_SecurityException *ex, const char *fmt, ...)
+  ddsrt_attribute_format ((printf, 2, 3)) ddsrt_attribute_warn_unused_result;
 
-  if (!token->class_id || strncmp(AUTH_HANDSHAKE_REQUEST_TOKEN_ID, token->class_id, strlen(AUTH_HANDSHAKE_REQUEST_TOKEN_ID)) != 0)
-  {
-    DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "begin_handshake_reply: HandshakeMessageToken incorrect class_id: %s (expected %s)", token->class_id ? token->class_id : "NULL", AUTH_HANDSHAKE_REQUEST_TOKEN_ID);
-    goto err_inv_class_id;
-  }
-
-  /* Check presents of mandatory properties: c.i, c.perm, c.pdata, c.dsign_algo, c.kagree_algo, dh1, challenge1 */
-  c_id = DDS_Security_DataHolder_find_binary_property(token, "c.id");
-  if (!c_id || c_id->value._length == 0 || c_id->value._buffer == NULL)
-  {
-    DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "begin_handshake_reply: HandshakeMessageToken property c.id missing");
-    goto err_no_c_id;
-  }
-
-  if (load_X509_certificate_from_data((char *)c_id->value._buffer, (int)c_id->value._length, &identityCert, ex) != DDS_SECURITY_VALIDATION_OK)
-    goto err_identity_cert_load;
-
-  {
-    DDS_Security_ValidationResult_t result = DDS_SECURITY_VALIDATION_OK;
-    if (trusted_ca_list->length == 0)
-      result = verify_certificate(identityCert, relation->localIdentity->identityCA, ex);
-    else
-    {
-      DDS_Security_Exception_clean(ex);
-      for (unsigned i = 0; i < trusted_ca_list->length; ++i)
-      {
-        DDS_Security_Exception_reset(ex);
-        if ((result = verify_certificate(identityCert, trusted_ca_list->buffer[i], ex)) == DDS_SECURITY_VALIDATION_OK)
-          break;
-      }
-    }
-    if (result != DDS_SECURITY_VALIDATION_OK)
-      goto err_inv_identity_cert;
-  }
-
-  if (check_certificate_expiry(identityCert, ex) != DDS_SECURITY_VALIDATION_OK)
-    goto err_inv_identity_cert;
-
-  if (!(c_perm = DDS_Security_DataHolder_find_binary_property(token, "c.perm")))
-  {
-    DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "begin_handshake_reply: HandshakeMessageToken property c.perm missing");
-    goto err_no_c_perm;
-  }
-  if (c_perm->value._length > 0)
-  {
-    ddsrt_free(relation->remoteIdentity->permissionsDocument);
-    relation->remoteIdentity->permissionsDocument = string_from_data(c_perm->value._buffer, c_perm->value._length);
-  }
-
-  if (!(c_pdata = DDS_Security_DataHolder_find_binary_property(token, "c.pdata")))
-  {
-    DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "begin_handshake_reply: HandshakeMessageToken property c.pdata missing");
-    goto err_no_c_pdata;
-  }
-  if (validate_pdata(&c_pdata->value, identityCert, ex) != DDS_SECURITY_VALIDATION_OK)
-    goto err_inv_pdata;
-
-  if (!(c_dsign_algo = DDS_Security_DataHolder_find_binary_property(token, "c.dsign_algo")))
-  {
-    DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "begin_handshake_reply: HandshakeMessageToken property c.dsign_algo missing");
-    goto err_no_c_dsign_algo;
-  }
-
-  if ((dsignAlgoKind = get_dsign_algo_from_string((const char *)c_dsign_algo->value._buffer)) == AUTH_ALGO_KIND_UNKNOWN)
-  {
-    DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "begin_handshake_reply: HandshakeMessageToken property c.dsign_algo not supported");
-    goto err_no_c_dsign_algo;
-  }
-
-  if (!(c_kagree_algo = DDS_Security_DataHolder_find_binary_property(token, "c.kagree_algo")))
-  {
-    DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "begin_handshake_reply: HandshakeMessageToken property c.kagree_algo missing");
-    goto err_no_c_kagree_algo;
-  }
-
-  if ((kagreeAlgoKind = get_kagree_algo_from_string((const char *)c_kagree_algo->value._buffer)) == AUTH_ALGO_KIND_UNKNOWN)
-  {
-    DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "begin_handshake_reply: HandshakeMessageToken property c.kagree_algo not support");
-    goto err_no_c_kagree_algo;
-  }
-
-  dh1 = DDS_Security_DataHolder_find_binary_property(token, "dh1");
-  if (!dh1 || dh1->value._length == 0 || dh1->value._buffer == NULL)
-  {
-    DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "begin_handshake_reply: HandshakeMessageToken property dh1 missing");
-    goto err_no_dh;
-  }
-  if (dh_oct_to_public_key(&pdhkey, kagreeAlgoKind, dh1->value._buffer, dh1->value._length, ex) != DDS_SECURITY_VALIDATION_OK)
-    goto err_no_dh;
-
-  if (!(challenge = DDS_Security_DataHolder_find_binary_property(token, "challenge1")))
-  {
-    DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "begin_handshake_reply: HandshakeMessageToken property challenge1 missing");
-    goto err_no_challenge;
-  }
-  if (challenge->value._length != sizeof(AuthenticationChallenge) || challenge->value._buffer == NULL)
-  {
-    DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "begin_handshake_reply: HandshakeMessageToken property challenge1 invalid");
-    goto err_no_challenge;
-  }
-
-  /* When validate_remote_identity was provided with a remote_auth_request_token then the future_challenge in the remote identity was set and the challenge1
-     property of the handshake_request_token should be the same as the future_challenge stored in the remote identity. */
-  if (relation->rchallenge)
-  {
-    if (memcmp(relation->rchallenge->value, challenge->value._buffer, sizeof(AuthenticationChallenge)) != 0)
-    {
-      DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "begin_handshake_reply: HandshakeMessageToken property challenge1 does not match future_challenge");
-      goto err_no_challenge;
-    }
-  }
-  else
-  {
-    if (challenge->value._length == sizeof(relation->rchallenge->value))
-    {
-      relation->rchallenge = ddsrt_malloc(sizeof(AuthenticationChallenge));
-      memcpy(relation->rchallenge, challenge->value._buffer, challenge->value._length);
-    }
-    else
-    {
-      DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "begin_handshake_reply: HandshakeMessageToken property challenge1 invalid (incorrect size)");
-      goto err_no_challenge;
-    }
-  }
-
-  {
-    const DDS_Security_BinaryProperty_t *binary_properties[] = { c_id, c_perm, c_pdata, c_dsign_algo, c_kagree_algo };
-    (void)compute_hash_value(&handshake->hash_c1[0], binary_properties, 5, NULL);
-  }
-  if ((hash_c1 = DDS_Security_DataHolder_find_binary_property(token, "hash_c1")))
-  {
-    if (hash_c1->value._length != sizeof(HashValue_t) || memcmp(hash_c1->value._buffer, &handshake->hash_c1, sizeof(HashValue_t)) != 0)
-    {
-      DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "begin_handshake_reply: HandshakeMessageToken property hash_c1 invalid (incorrect size)");
-      goto err_inv_hash_c1;
-    }
-  }
-
-  if (relation->remoteIdentity->identityCert)
-    X509_free(relation->remoteIdentity->identityCert);
-  relation->remoteIdentity->identityCert = identityCert;
-  relation->remoteIdentity->dsignAlgoKind = dsignAlgoKind;
-  relation->remoteIdentity->kagreeAlgoKind = kagreeAlgoKind;
-  DDS_Security_OctetSeq_copy(&relation->remoteIdentity->pdata, &c_pdata->value);
-  handshake->rdh = pdhkey;
-  return DDS_SECURITY_VALIDATION_OK;
-
-err_inv_hash_c1:
-err_no_challenge:
-  EVP_PKEY_free(pdhkey);
-err_no_dh:
-err_no_c_kagree_algo:
-err_no_c_dsign_algo:
-err_inv_pdata:
-err_no_c_pdata:
-err_no_c_perm:
-err_inv_identity_cert:
-  X509_free(identityCert);
-err_identity_cert_load:
-err_no_c_id:
-err_inv_class_id:
+static DDS_Security_ValidationResult_t set_exception (DDS_Security_SecurityException *ex, const char *fmt, ...)
+{
+  va_list ap;
+  va_start (ap, fmt);
+  DDS_Security_Exception_vset (ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, fmt, ap);
+  va_end (ap);
   return DDS_SECURITY_VALIDATION_FAILED;
 }
 
-static DDS_Security_ValidationResult_t validate_handshake_reply_token(const DDS_Security_HandshakeMessageToken *token, HandshakeInfo *handshake, EVP_PKEY **pdhkey, X509Seq *trusted_ca_list, DDS_Security_SecurityException *ex)
+static const DDS_Security_BinaryProperty_t *find_required_binprop (const DDS_Security_HandshakeMessageToken *token, const char *name, DDS_Security_SecurityException *ex)
 {
-  IdentityRelation *relation = handshake->relation;
-  X509 *identityCert;
-  EVP_PKEY *public_key;
-  const DDS_Security_BinaryProperty_t *c_id, *c_perm, *c_pdata, *c_dsign_algo, *c_kagree_algo, *dh1, *dh2, *hash_c1, *hash_c2, *challenge1, *challenge2, *signature;
-  AuthenticationAlgoKind_t dsignAlgoKind, kagreeAlgoKind;
-
-  assert(relation);
-
-  if (!token->class_id || strncmp(AUTH_HANDSHAKE_REPLY_TOKEN_ID, token->class_id, strlen(AUTH_HANDSHAKE_REPLY_TOKEN_ID)) != 0)
+  DDS_Security_ValidationResult_t result;
+  const DDS_Security_BinaryProperty_t *prop = DDS_Security_DataHolder_find_binary_property (token, name);
+  if (prop == NULL)
   {
-    DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "process_handshake: HandshakeMessageToken incorrect class_id: %s (expected %s)", token->class_id ? token->class_id : "NULL", AUTH_HANDSHAKE_REPLY_TOKEN_ID);
-    goto err_inv_class_id;
+    result = set_exception (ex, "process_handshake: HandshakeMessageToken property %s missing", name);
+    (void) result;
+    return NULL;
   }
-
-  /* Check presents of mandatory properties: c.id, c.perm, c.pdata, c.dsign_algo, c.kagree_algo, challenge1, dh2, challenge2, signature */
-  c_id = DDS_Security_DataHolder_find_binary_property(token, "c.id");
-  if (!c_id || (c_id->value._length == 0) || (c_id->value._buffer == NULL))
+  else if (prop->value._length > INT_MAX)
   {
-    DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "process_handshake: HandshakeMessageToken property c.id missing");
-    goto err_no_c_id;
+    result = set_exception (ex, "process_handshake: HandshakeMessageToken property %s has unsupported size (%"PRIu32" bytes)", name, prop->value._length);
+    (void) result;
+    return NULL;
   }
-
-  /* Verify Identity Certificate */
-  if (load_X509_certificate_from_data((char *)c_id->value._buffer, (int)c_id->value._length, &identityCert, ex) != DDS_SECURITY_VALIDATION_OK)
-    goto err_identity_cert_load;
-
-  {
-    DDS_Security_ValidationResult_t result = DDS_SECURITY_VALIDATION_OK;
-    if (trusted_ca_list->length == 0)
-      result = verify_certificate(identityCert, relation->localIdentity->identityCA, ex);
-    else
-    {
-      DDS_Security_Exception_clean(ex);
-      for (unsigned i = 0; i < trusted_ca_list->length; ++i)
-      {
-        DDS_Security_Exception_reset(ex);
-        result = verify_certificate(identityCert, trusted_ca_list->buffer[i], ex);
-        if (result == DDS_SECURITY_VALIDATION_OK)
-          break;
-      }
-    }
-    if (result != DDS_SECURITY_VALIDATION_OK)
-      goto err_inv_identity_cert;
-  }
-
-  if (check_certificate_expiry(identityCert, ex) != DDS_SECURITY_VALIDATION_OK)
-    goto err_inv_identity_cert;
-
-  if (!(c_perm = DDS_Security_DataHolder_find_binary_property(token, "c.perm")))
-  {
-    DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "process_handshake: HandshakeMessageToken property c.perm missing");
-    goto err_no_c_perm;
-  }
-  if (c_perm->value._length > 0)
-  {
-    ddsrt_free(relation->remoteIdentity->permissionsDocument);
-    relation->remoteIdentity->permissionsDocument = string_from_data(c_perm->value._buffer, c_perm->value._length);
-  }
-
-  if (!(c_pdata = DDS_Security_DataHolder_find_binary_property(token, "c.pdata")))
-  {
-    DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "process_handshake: HandshakeMessageToken property c.pdata missing");
-    goto err_no_c_pdata;
-  }
-  if (validate_pdata(&c_pdata->value, identityCert, ex) != DDS_SECURITY_VALIDATION_OK)
-    goto err_inv_pdata;
-
-  if (!(c_dsign_algo = DDS_Security_DataHolder_find_binary_property(token, "c.dsign_algo")))
-  {
-    DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "process_handshake: HandshakeMessageToken property c.dsign_algo missing");
-    goto err_no_c_dsign_algo;
-  }
-
-  if ((dsignAlgoKind = get_dsign_algo_from_string((const char *)c_dsign_algo->value._buffer)) == AUTH_ALGO_KIND_UNKNOWN)
-  {
-    DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "process_handshake: HandshakeMessageToken property c.dsign_algo not supported");
-    goto err_no_c_dsign_algo;
-  }
-
-  if (!(c_kagree_algo = DDS_Security_DataHolder_find_binary_property(token, "c.kagree_algo")))
-  {
-    DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "process_handshake: HandshakeMessageToken property c.kagree_algo missing");
-    goto err_no_c_kagree_algo;
-  }
-
-  if ((kagreeAlgoKind = get_kagree_algo_from_string((const char *)c_kagree_algo->value._buffer)) == AUTH_ALGO_KIND_UNKNOWN)
-  {
-    DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "process_handshake: HandshakeMessageToken property c.kagree_algo not support");
-    goto err_no_c_kagree_algo;
-  }
-
-  /* dh1 is optional  */
-  dh1 = DDS_Security_DataHolder_find_binary_property(token, "dh1");
-  DDSRT_UNUSED_ARG(dh1);
-
-  dh2 = DDS_Security_DataHolder_find_binary_property(token, "dh2");
-  if (!dh2 || dh2->value._length == 0 || dh2->value._buffer == NULL)
-  {
-    DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "process_handshake: HandshakeMessageToken property dh2 missing");
-    goto err_no_dh;
-  }
-
-  if ((hash_c1 = DDS_Security_DataHolder_find_binary_property(token, "hash_c1")))
-  {
-    if (hash_c1->value._length != sizeof(HashValue_t) || memcmp(hash_c1->value._buffer, handshake->hash_c1, sizeof(HashValue_t)) != 0)
-    {
-      DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "begin_handshake_reply: HandshakeMessageToken property hash_c1 invalid");
-      goto err_inv_hash_c1;
-    }
-  }
-
-  {
-    const DDS_Security_BinaryProperty_t *binary_properties[] = { c_id, c_perm, c_pdata, c_dsign_algo, c_kagree_algo };
-    (void)compute_hash_value(&handshake->hash_c2[0], binary_properties, 5, NULL);
-  }
-
-  if ((hash_c2 = DDS_Security_DataHolder_find_binary_property(token, "hash_c2")))
-  {
-    if (hash_c2->value._length != sizeof(HashValue_t) || memcmp(hash_c2->value._buffer, handshake->hash_c2, sizeof(HashValue_t)) != 0)
-    {
-      DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "begin_handshake_reply: HandshakeMessageToken property hash_c2 invalid");
-      goto err_inv_hash_c2;
-    }
-  }
-
-  signature = DDS_Security_DataHolder_find_binary_property(token, "signature");
-  if (!signature || signature->value._length == 0 || signature->value._buffer == NULL)
-  {
-    DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "process_handshake: HandshakeMessageToken property signature missing");
-    goto err_no_signature;
-  }
-
-  *pdhkey = NULL;
-  if (dh_oct_to_public_key(pdhkey, kagreeAlgoKind, dh2->value._buffer, dh2->value._length, ex) != DDS_SECURITY_VALIDATION_OK)
-    goto err_inv_dh;
-
-  if (!(challenge1 = DDS_Security_DataHolder_find_binary_property(token, "challenge1")))
-  {
-    DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "process_handshake: HandshakeMessageToken property challenge1 missing");
-    goto err_no_challenge;
-  }
-  if (challenge1->value._length != sizeof(AuthenticationChallenge) || challenge1->value._buffer == NULL)
-  {
-    DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "process_handshake: HandshakeMessageToken property challenge1 invalid");
-    goto err_no_challenge;
-  }
-
-  if (!(challenge2 = DDS_Security_DataHolder_find_binary_property(token, "challenge2")))
-  {
-    DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "process_handshake: HandshakeMessageToken property challenge2 missing");
-    goto err_no_challenge;
-  }
-  if (challenge2->value._length != sizeof(AuthenticationChallenge) || challenge2->value._buffer == NULL)
-  {
-    DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "process_handshake: HandshakeMessageToken property challenge2 invalid");
-    goto err_no_challenge;
-  }
-
-  /* When validate_remote_identity was provided with a remote_auth_request_token then the future_challenge in the remote identity was set and the challenge2
-     property of the handshake_reply_token should be the same as the future_challenge stored in the remote identity. */
-  if (relation->rchallenge)
-  {
-    if (memcmp(relation->rchallenge->value, challenge2->value._buffer, sizeof(AuthenticationChallenge)) != 0)
-    {
-      DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "process_handshake: HandshakeMessageToken property challenge2 does not match future_challenge");
-      goto err_no_challenge;
-    }
-  }
-  else
-  {
-    if (challenge2->value._length == sizeof(relation->rchallenge->value))
-    {
-      relation->rchallenge = ddsrt_malloc(sizeof(AuthenticationChallenge));
-      memcpy(relation->rchallenge, challenge2->value._buffer, challenge2->value._length);
-    }
-    else
-    {
-      DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "process_handshake: HandshakeMessageToken property challenge2 invalid (incorrect size)");
-      goto err_no_challenge;
-    }
-  }
-
-  if (relation->lchallenge)
-  {
-    if (memcmp(relation->lchallenge->value, challenge1->value._buffer, sizeof(AuthenticationChallenge)) != 0)
-    {
-      DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "process_handshake: HandshakeMessageToken property challenge1 does not match future_challenge");
-      goto err_no_challenge;
-    }
-  }
-  else
-  {
-    DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "process_handshake: No future challenge exists for this token");
-    goto err_no_challenge;
-  }
-
-  /* TODO: check if an identity certificate was already associated with the remote identity and when that is the case both should be the same */
-  if (relation->remoteIdentity->identityCert)
-    X509_free(relation->remoteIdentity->identityCert);
-  relation->remoteIdentity->identityCert = identityCert;
-  relation->remoteIdentity->dsignAlgoKind = dsignAlgoKind;
-  relation->remoteIdentity->kagreeAlgoKind = kagreeAlgoKind;
-
-  if ((public_key = X509_get_pubkey(relation->remoteIdentity->identityCert)))
-  {
-    DDS_Security_BinaryProperty_t *hash_c1_val = hash_value_to_binary_property("hash_c1", handshake->hash_c1);
-    DDS_Security_BinaryProperty_t *hash_c2_val = hash_value_to_binary_property("hash_c2", handshake->hash_c2);
-    const DDS_Security_BinaryProperty_t *properties[HANDSHAKE_SIGNATURE_CONTENT_SIZE] = { hash_c2_val, challenge2, dh2, challenge1, dh1, hash_c1_val };
-    DDS_Security_ValidationResult_t result = validate_signature(public_key, properties, HANDSHAKE_SIGNATURE_CONTENT_SIZE, signature->value._buffer, signature->value._length, ex);
-    EVP_PKEY_free(public_key);
-    DDS_Security_BinaryProperty_free(hash_c1_val);
-    DDS_Security_BinaryProperty_free(hash_c2_val);
-    if (result != DDS_SECURITY_VALIDATION_OK)
-      goto err_inv_signature;
-  }
-  else
-  {
-    DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "X509_get_pubkey failed");
-    goto err_inv_signature;
-  }
-
-  DDS_Security_OctetSeq_copy(&relation->remoteIdentity->pdata, &c_pdata->value);
-  return DDS_SECURITY_VALIDATION_OK;
-
-err_inv_signature:
-err_no_challenge:
-err_inv_dh:
-  EVP_PKEY_free(*pdhkey);
-err_no_signature:
-err_inv_hash_c2:
-err_inv_hash_c1:
-err_no_dh:
-err_no_c_kagree_algo:
-err_no_c_dsign_algo:
-err_inv_pdata:
-err_no_c_pdata:
-err_no_c_perm:
-err_inv_identity_cert:
-  X509_free(identityCert);
-err_identity_cert_load:
-err_no_c_id:
-err_inv_class_id:
-  return DDS_SECURITY_VALIDATION_FAILED;
+  return prop;
 }
 
-static DDS_Security_ValidationResult_t validate_handshake_final_token(const DDS_Security_HandshakeMessageToken *token, HandshakeInfo *handshake, DDS_Security_SecurityException *ex)
+static const DDS_Security_BinaryProperty_t *find_required_nonempty_binprop (const DDS_Security_HandshakeMessageToken *token, const char *name, DDS_Security_SecurityException *ex)
 {
-  IdentityRelation *relation = handshake->relation;
-  const DDS_Security_BinaryProperty_t *dh1, *dh2, *hash_c1, *hash_c2, *challenge1, *challenge2, *signature;
-  EVP_PKEY *public_key;
-
-  assert(relation);
-
-  if (!token->class_id || strncmp(AUTH_HANDSHAKE_FINAL_TOKEN_ID, token->class_id, strlen(AUTH_HANDSHAKE_FINAL_TOKEN_ID)) != 0)
+  DDS_Security_ValidationResult_t result;
+  const DDS_Security_BinaryProperty_t *prop = find_required_binprop (token, name, ex);
+  if (prop != NULL && (prop->value._length == 0 || prop->value._buffer == NULL))
   {
-    DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "process_handshake: HandshakeMessageToken incorrect class_id: %s (expected %s)", token->class_id ? token->class_id : "NULL", AUTH_HANDSHAKE_FINAL_TOKEN_ID);
-    goto failed;
+    // FIXME: _buffer == NULL check must go, that should've been guaranteed before
+    result = set_exception (ex, "process_handshake: HandshakeMessageToken property %s is empty", name);
+    (void) result;
+    return NULL;
   }
+  return prop;
+}
 
-  /* Check presents of mandatory properties: challenge1, challenge2, signature */
-
-  /* dh1 and dh2 are optional  */
-  dh1 = DDS_Security_DataHolder_find_binary_property(token, "dh1");
-  DDSRT_UNUSED_ARG(dh1);
-  dh2 = DDS_Security_DataHolder_find_binary_property(token, "dh2");
-  DDSRT_UNUSED_ARG(dh2);
-
-  /* hash_c1 is optional  */
-  if ((hash_c1 = DDS_Security_DataHolder_find_binary_property(token, "hash_c1")))
+static const DDS_Security_BinaryProperty_t *find_required_binprop_exactsize (const DDS_Security_HandshakeMessageToken *token, const char *name, size_t size, DDS_Security_SecurityException *ex)
+{
+  DDS_Security_ValidationResult_t result;
+  const DDS_Security_BinaryProperty_t *prop = find_required_binprop (token, name, ex);
+  if (prop != NULL && prop->value._length != size)
   {
-    if (hash_c1->value._length != sizeof(HashValue_t) || memcmp(hash_c1->value._buffer, handshake->hash_c1, sizeof(HashValue_t)) != 0)
+    result = set_exception (ex, "process_handshake: HandshakeMessageToken property %s has wrong size (%"PRIu32" while expecting %"PRIuSIZE")", name, prop->value._length, size);
+    (void) result;
+    return NULL;
+  }
+  return prop;
+}
+
+static X509 *load_X509_certificate_from_binprop (const DDS_Security_BinaryProperty_t *prop, X509 *own_ca, const X509Seq *trusted_ca_list, DDS_Security_SecurityException *ex)
+{
+  X509 *cert;
+
+  if (load_X509_certificate_from_data ((char *) prop->value._buffer, (int) prop->value._length, &cert, ex) != DDS_SECURITY_VALIDATION_OK)
+    return NULL;
+
+  DDS_Security_ValidationResult_t result = DDS_SECURITY_VALIDATION_FAILED;
+  if (trusted_ca_list->length == 0)
+    result = verify_certificate (cert, own_ca, ex);
+  else
+  {
+    DDS_Security_Exception_clean (ex);
+    for (unsigned i = 0; i < trusted_ca_list->length; ++i)
     {
-      DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "begin_handshake_reply: HandshakeMessageToken property hash_c1 invalid");
-      goto failed;
+      DDS_Security_Exception_reset (ex);
+      if ((result = verify_certificate (cert, trusted_ca_list->buffer[i], ex)) == DDS_SECURITY_VALIDATION_OK)
+        break;
     }
   }
-
-  /* hash_c2 is optional  */
-  if ((hash_c2 = DDS_Security_DataHolder_find_binary_property(token, "hash_c2")))
+  if (result != DDS_SECURITY_VALIDATION_OK || check_certificate_expiry (cert, ex) != DDS_SECURITY_VALIDATION_OK)
   {
-    if (hash_c2->value._length != sizeof(HashValue_t) || memcmp(hash_c2->value._buffer, handshake->hash_c2, sizeof(HashValue_t)) != 0)
+    X509_free (cert);
+    return NULL;
+  }
+  return cert;
+}
+
+static DDS_Security_ValidationResult_t validate_handshake_token_impl (const DDS_Security_HandshakeMessageToken *token, enum handshake_token_type token_type,
+    HandshakeInfo *handshake, EVP_PKEY **pdhkey_reply, X509Seq *trusted_ca_list, EVP_PKEY **pdhkey_req, X509 **identityCert, DDS_Security_SecurityException *ex)
+{
+  IdentityRelation * const relation = handshake->relation;
+  const DDS_Security_BinaryProperty_t *c_pdata = NULL;
+  AuthenticationAlgoKind_t dsignAlgoKind = AUTH_ALGO_KIND_UNKNOWN, kagreeAlgoKind = AUTH_ALGO_KIND_UNKNOWN;
+  const DDS_Security_BinaryProperty_t *dh1 = NULL, *dh2 = NULL;
+  const DDS_Security_BinaryProperty_t *hash_c1 = NULL, *hash_c2 = NULL;
+  const DDS_Security_BinaryProperty_t *challenge1 = NULL, *challenge2 = NULL;
+  const DDS_Security_BinaryProperty_t *signature = NULL;
+  const char *token_class_id = NULL;
+
+  assert (relation);
+  assert (pdhkey_req == NULL || *pdhkey_req == NULL);
+  assert (pdhkey_reply == NULL || *pdhkey_reply == NULL);
+  assert (pdhkey_req == NULL || token_type == HS_TOKEN_REQ);
+  assert (pdhkey_reply == NULL || token_type == HS_TOKEN_REPLY);
+
+  switch (token_type)
+  {
+    case HS_TOKEN_REQ: token_class_id = AUTH_HANDSHAKE_REQUEST_TOKEN_ID; break;
+    case HS_TOKEN_REPLY: token_class_id = AUTH_HANDSHAKE_REPLY_TOKEN_ID; break;
+    case HS_TOKEN_FINAL: token_class_id = AUTH_HANDSHAKE_FINAL_TOKEN_ID; break;
+  }
+  assert (token_class_id);
+
+  if (!token->class_id || strncmp (token_class_id, token->class_id, strlen (token_class_id)) != 0)
+    return set_exception (ex, "process_handshake: HandshakeMessageToken incorrect class_id: %s (expected %s)", token->class_id ? token->class_id : "NULL", token_class_id);
+
+  if (token_type == HS_TOKEN_REQ || token_type == HS_TOKEN_REPLY)
+  {
+    const DDS_Security_BinaryProperty_t *c_id, *c_perm, *c_dsign_algo, *c_kagree_algo;
+
+    if ((c_id = find_required_nonempty_binprop (token, "c.id", ex)) == NULL)
+      return DDS_SECURITY_VALIDATION_FAILED;
+    if ((*identityCert = load_X509_certificate_from_binprop (c_id, relation->localIdentity->identityCA, trusted_ca_list, ex)) == NULL)
+      return DDS_SECURITY_VALIDATION_FAILED;
+
+    if ((c_perm = find_required_binprop (token, "c.perm", ex)) == NULL)
+      return DDS_SECURITY_VALIDATION_FAILED;
+    if (c_perm->value._length > 0)
     {
-      DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "begin_handshake_reply: HandshakeMessageToken property hash_c2 invalid");
-      goto failed;
+      ddsrt_free (relation->remoteIdentity->permissionsDocument);
+      relation->remoteIdentity->permissionsDocument = string_from_data (c_perm->value._buffer, c_perm->value._length);
     }
+
+    if ((c_pdata = find_required_binprop (token, "c.pdata", ex)) == NULL)
+      return DDS_SECURITY_VALIDATION_FAILED;
+    if (validate_pdata (&c_pdata->value, *identityCert, ex) != DDS_SECURITY_VALIDATION_OK)
+      return DDS_SECURITY_VALIDATION_FAILED;
+
+    if ((c_dsign_algo = find_required_nonempty_binprop (token, "c.dsign_algo", ex)) == NULL)
+      return DDS_SECURITY_VALIDATION_FAILED;
+    if ((dsignAlgoKind = get_dsign_algo_from_string ((const char *) c_dsign_algo->value._buffer)) == AUTH_ALGO_KIND_UNKNOWN)
+      return set_exception (ex, "process_handshake: HandshakeMessageToken property c.dsign_algo not supported");
+
+    if ((c_kagree_algo = find_required_nonempty_binprop (token, "c.kagree_algo", ex)) == NULL)
+      return DDS_SECURITY_VALIDATION_FAILED;
+    if ((kagreeAlgoKind = get_kagree_algo_from_string ((const char *) c_kagree_algo->value._buffer)) == AUTH_ALGO_KIND_UNKNOWN)
+      return set_exception (ex, "process_handshake: HandshakeMessageToken property c.kagree_algo not supported");
+
+    /* calculate the hash value and set in handshake hash_c1 (req) or hash_c2 (reply) */
+    const DDS_Security_BinaryProperty_t *binary_properties[] = { c_id, c_perm, c_pdata, c_dsign_algo, c_kagree_algo };
+    (void) compute_hash_value ((token_type == HS_TOKEN_REQ) ? handshake->hash_c1 : handshake->hash_c2, binary_properties, 5, NULL);
   }
 
-  if (!(challenge1 = DDS_Security_DataHolder_find_binary_property(token, "challenge1")))
+  if ((dh1 = find_required_nonempty_binprop (token, "dh1", ex)) == NULL)
+    return DDS_SECURITY_VALIDATION_FAILED;
+  if ((challenge1 = find_required_binprop_exactsize (token, "challenge1", sizeof (AuthenticationChallenge), ex)) == NULL)
+    return DDS_SECURITY_VALIDATION_FAILED;
+  if (token_type == HS_TOKEN_REQ)
   {
-    DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "process_handshake: HandshakeMessageToken property challenge1 missing");
-    goto failed;
-  }
-  if (challenge1->value._length != sizeof(AuthenticationChallenge) || challenge1->value._buffer == NULL)
-  {
-    DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "process_handshake: HandshakeMessageToken property challenge1 invalid");
-    goto failed;
+    if (dh_oct_to_public_key (pdhkey_req, kagreeAlgoKind, dh1->value._buffer, dh1->value._length, ex) != DDS_SECURITY_VALIDATION_OK)
+      return DDS_SECURITY_VALIDATION_FAILED;
   }
 
-  if (!(challenge2 = DDS_Security_DataHolder_find_binary_property(token, "challenge2")))
+  if (token_type == HS_TOKEN_REPLY || token_type == HS_TOKEN_FINAL)
   {
-    DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "process_handshake: HandshakeMessageToken property challenge2 missing");
-    goto failed;
+    if ((dh2 = find_required_nonempty_binprop (token, "dh2", ex)) == NULL)
+      return DDS_SECURITY_VALIDATION_FAILED;
+    if ((challenge2 = find_required_binprop_exactsize (token, "challenge2", sizeof (AuthenticationChallenge), ex)) == NULL)
+      return DDS_SECURITY_VALIDATION_FAILED;
+    if ((signature = find_required_nonempty_binprop (token, "signature", ex)) == NULL)
+      return DDS_SECURITY_VALIDATION_FAILED;
   }
-  if (challenge2->value._length != sizeof(AuthenticationChallenge) || challenge2->value._buffer == NULL)
+  if (token_type == HS_TOKEN_REPLY)
   {
-    DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "process_handshake: HandshakeMessageToken property challenge2 invalid");
-    goto failed;
+    if (dh_oct_to_public_key (pdhkey_reply, kagreeAlgoKind, dh2->value._buffer, dh2->value._length, ex) != DDS_SECURITY_VALIDATION_OK)
+      return DDS_SECURITY_VALIDATION_FAILED;
   }
 
-  /* When validate_remote_identity was provided with a remote_auth_request_token then the future_challenge in the remote identity was set and the challenge1
-     property of the handshake_reply_token should be the same as the future_challenge stored in the remote identity. */
+  /* When validate_remote_identity was provided with a remote_auth_request_token then the future_challenge in
+     the remote identity was set and the challenge(1|2) property of the handshake_(request|reply|final)_token
+     should be the same as the future_challenge stored in the remote identity. */
+  const DDS_Security_BinaryProperty_t *rc = (token_type == HS_TOKEN_REPLY) ? challenge2 : challenge1;
   if (relation->rchallenge)
   {
-    if (memcmp(relation->rchallenge->value, challenge1->value._buffer, sizeof(AuthenticationChallenge)) != 0)
+    if (memcmp (relation->rchallenge->value, rc->value._buffer, sizeof (AuthenticationChallenge)) != 0)
+      return set_exception (ex, "process_handshake: HandshakeMessageToken property challenge%d does not match future_challenge", (token_type == HS_TOKEN_REPLY) ? 2 : 1);
+  }
+  else if (token_type != HS_TOKEN_FINAL)
+  {
+    relation->rchallenge = ddsrt_memdup (rc->value._buffer, sizeof (AuthenticationChallenge));
+  }
+
+  /* From DDS Security spec: inclusion of the hash_c1 property is optional. Its only purpose is to
+     facilitate troubleshoot interoperability problems. */
+  if ((hash_c1 = DDS_Security_DataHolder_find_binary_property (token, "hash_c1")))
+  {
+    /* hash_c1 should be set during req or reply token validation */
+    assert (handshake->hash_c1 != NULL);
+    if (hash_c1->value._length != sizeof (HashValue_t) || memcmp (hash_c1->value._buffer, handshake->hash_c1, sizeof (HashValue_t)) != 0)
+      return set_exception (ex, "process_handshake: HandshakeMessageToken property hash_c1 invalid");
+  }
+
+  if (token_type == HS_TOKEN_REPLY || token_type == HS_TOKEN_FINAL)
+  {
+    /* hash_c2 should be set during reply token validation */
+    assert (handshake->hash_c2 != NULL);
+
+    /* From DDS Security spec: inclusion of the hash_c2 property is optional. Its only purpose is to
+       facilitate troubleshoot interoperability problems. */
+    if ((hash_c2 = DDS_Security_DataHolder_find_binary_property (token, "hash_c2")))
     {
-      DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "process_handshake: HandshakeMessageToken property challenge1 does not match future_challenge");
-      goto failed;
+      if (hash_c2->value._length != sizeof (HashValue_t) || memcmp (hash_c2->value._buffer, handshake->hash_c2, sizeof (HashValue_t)) != 0)
+        return set_exception (ex, "process_handshake: HandshakeMessageToken property hash_c2 invalid");
     }
-  }
-  else
-  {
-    DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "process_handshake: No challenge exists to check challenge1 in the token.");
-    goto failed;
+    if (relation->lchallenge == NULL)
+      return set_exception (ex, "process_handshake: No future challenge exists for this token");
+    const DDS_Security_BinaryProperty_t *lc = (token_type == HS_TOKEN_REPLY) ? challenge1 : challenge2;
+    if (memcmp (relation->lchallenge->value, lc->value._buffer, sizeof (AuthenticationChallenge)) != 0)
+      return set_exception (ex, "process_handshake: HandshakeMessageToken property challenge1 does not match future_challenge");
   }
 
-  if (relation->lchallenge)
+  if (token_type == HS_TOKEN_REQ)
   {
-    if (memcmp(relation->lchallenge->value, challenge2->value._buffer, sizeof(AuthenticationChallenge)) != 0)
-    {
-      DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "process_handshake: HandshakeMessageToken property challenge2 does not match future_challenge");
-      goto failed;
-    }
-  }
-  else
-  {
-    DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "process_handshake: No challenge exists to check challenge2 in the token.");
-    goto failed;
+    if (!EVP_PKEY_up_ref (*pdhkey_req))
+      return set_exception (ex, "process_handshake: failed to increment refcount of DH key");
+    handshake->rdh = *pdhkey_req;
   }
 
-  if (!(signature = DDS_Security_DataHolder_find_binary_property(token, "signature")))
+  if (token_type == HS_TOKEN_REQ || token_type == HS_TOKEN_REPLY)
   {
-    DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "process_handshake: HandshakeMessageToken property signature missing");
-    goto failed;
+    assert (*identityCert != NULL);
+    assert (dsignAlgoKind != AUTH_ALGO_KIND_UNKNOWN);
+    assert (kagreeAlgoKind != AUTH_ALGO_KIND_UNKNOWN);
+    assert (c_pdata != NULL);
+
+    /* TODO: check if an identity certificate was already associated with the remote identity and when that is the case both should be the same */
+    if (relation->remoteIdentity->identityCert)
+      X509_free (relation->remoteIdentity->identityCert);
+    if (!X509_up_ref (*identityCert))
+      return set_exception (ex, "process_handshake: failed to increment refcount of identity certificate");
+    relation->remoteIdentity->identityCert = *identityCert;
+    relation->remoteIdentity->dsignAlgoKind = dsignAlgoKind;
+    relation->remoteIdentity->kagreeAlgoKind = kagreeAlgoKind;
+    DDS_Security_OctetSeq_copy (&relation->remoteIdentity->pdata, &c_pdata->value);
   }
 
-  /* Validate signature */
-  if ((public_key = X509_get_pubkey(relation->remoteIdentity->identityCert)))
+  if (token_type == HS_TOKEN_REPLY || token_type == HS_TOKEN_FINAL)
   {
-    DDS_Security_BinaryProperty_t *hash_c1_val = hash_value_to_binary_property("hash_c1", handshake->hash_c1);
-    DDS_Security_BinaryProperty_t *hash_c2_val = hash_value_to_binary_property("hash_c2", handshake->hash_c2);
-    const DDS_Security_BinaryProperty_t *properties[HANDSHAKE_SIGNATURE_CONTENT_SIZE] = { hash_c1_val, challenge1, dh1, challenge2, dh2, hash_c2_val };
-    DDS_Security_ValidationResult_t result = validate_signature(public_key, properties, HANDSHAKE_SIGNATURE_CONTENT_SIZE, signature->value._buffer, signature->value._length, ex);
-    EVP_PKEY_free(public_key);
-    DDS_Security_BinaryProperty_free(hash_c1_val);
-    DDS_Security_BinaryProperty_free(hash_c2_val);
+    EVP_PKEY *public_key;
+    if ((public_key = X509_get_pubkey (relation->remoteIdentity->identityCert)) == NULL)
+      return set_exception (ex, "X509_get_pubkey failed");
+
+    DDS_Security_BinaryProperty_t hash_c1_val = {
+      .name = "hash_c1", .value = { ._length = sizeof (handshake->hash_c1), ._buffer = handshake->hash_c1 }
+    };
+    DDS_Security_BinaryProperty_t hash_c2_val = {
+      .name = "hash_c2", .value = { ._length = sizeof (handshake->hash_c2), ._buffer = handshake->hash_c2 }
+    };
+    const DDS_Security_BinaryProperty_t **properties;
+    if (token_type == HS_TOKEN_REPLY)
+      properties = (const DDS_Security_BinaryProperty_t *[]) { &hash_c2_val, challenge2, dh2, challenge1, dh1, &hash_c1_val };
+    else
+      properties = (const DDS_Security_BinaryProperty_t *[]) { &hash_c1_val, challenge1, dh1, challenge2, dh2, &hash_c2_val };
+    const DDS_Security_ValidationResult_t result = validate_signature (public_key, properties, 6, signature->value._buffer, signature->value._length, ex);
+    EVP_PKEY_free (public_key);
     if (result != DDS_SECURITY_VALIDATION_OK)
-      goto failed;
+      return result;
   }
-  else
-  {
-    DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "X509_get_pubkey failed");
-    goto failed;
-  }
-  return DDS_SECURITY_VALIDATION_OK;
 
-failed:
-  return DDS_SECURITY_VALIDATION_FAILED;
+  return DDS_SECURITY_VALIDATION_OK;
+}
+
+static DDS_Security_ValidationResult_t validate_handshake_token(const DDS_Security_HandshakeMessageToken *token, enum handshake_token_type token_type, HandshakeInfo *handshake,
+    EVP_PKEY **pdhkey_reply, X509Seq *trusted_ca_list, DDS_Security_SecurityException *ex)
+{
+  X509 *identityCert = NULL;
+  EVP_PKEY *pdhkey_req = NULL;
+
+  const DDS_Security_ValidationResult_t ret = validate_handshake_token_impl (token, token_type, handshake, pdhkey_reply, trusted_ca_list,
+    (token_type == HS_TOKEN_REQ) ? &pdhkey_req : NULL, &identityCert, ex);
+
+  if (ret != DDS_SECURITY_VALIDATION_OK)
+  {
+    IdentityRelation *relation = handshake->relation;
+    if (relation->remoteIdentity->identityCert)
+    {
+      X509_free (relation->remoteIdentity->identityCert);
+      relation->remoteIdentity->identityCert = NULL;
+    }
+    if (pdhkey_reply && *pdhkey_reply)
+      EVP_PKEY_free (*pdhkey_reply);
+  }
+
+  if (pdhkey_req)
+    EVP_PKEY_free (pdhkey_req);
+  if (identityCert)
+  {
+    /* free id cert also when validation succeeded, because the refcount was increased
+       when assigning this cert to relation->remoteIdentity  */
+    X509_free (identityCert);
+  }
+  return ret;
 }
 
 DDS_Security_ValidationResult_t begin_handshake_reply(dds_security_authentication *instance, DDS_Security_HandshakeHandle *handshake_handle,
@@ -1892,7 +1644,7 @@ DDS_Security_ValidationResult_t begin_handshake_reply(dds_security_authenticatio
     assert(relation);
   }
 
-  if (validate_handshake_request_token(handshake_message_in, handshake, &(impl->trustedCAList), ex) != DDS_SECURITY_VALIDATION_OK)
+  if (validate_handshake_token(handshake_message_in, HS_TOKEN_REQ, handshake, NULL, &(impl->trustedCAList), ex) != DDS_SECURITY_VALIDATION_OK)
     goto err_inv_token;
   if (get_certificate_contents(localIdent->identityCert, &certData, &certDataSize, ex) != DDS_SECURITY_VALIDATION_OK)
     goto err_alloc_cid;
@@ -1937,7 +1689,7 @@ DDS_Security_ValidationResult_t begin_handshake_reply(dds_security_authenticatio
   DDS_Security_BinaryProperty_set_by_string(c_dsign_algo, "c.dsign_algo", get_dsign_algo(localIdent->dsignAlgoKind));
   DDS_Security_BinaryProperty_set_by_string(c_kagree_algo, "c.kagree_algo", get_kagree_algo(remoteIdent->kagreeAlgoKind));
 
-  /* Calculate the hash_c2 */
+  /* Todo: including hash_c2 is optional (conform spec); add a configuration option to leave it out */
   {
     DDS_Security_BinaryPropertySeq bseq = { ._length = 5, ._buffer = tokens };
     get_hash_binary_property_seq(&bseq, handshake->hash_c2);
@@ -2099,7 +1851,7 @@ DDS_Security_ValidationResult_t process_handshake(dds_security_authentication *i
   case CREATEDREQUEST:
     /* The source of the handshake_handle is a begin_handshake_request function. So, handshake_message_in is from a remote begin_handshake_reply function */
     /* Verify Message Token contents according to Spec 9.3.2.5.2 (Reply Message)  */
-    if (validate_handshake_reply_token(handshake_message_in, handshake, &dhkeyRemote, &(impl->trustedCAList), ex) != DDS_SECURITY_VALIDATION_OK)
+    if (validate_handshake_token(handshake_message_in, HS_TOKEN_REPLY, handshake, &dhkeyRemote, &(impl->trustedCAList), ex) != DDS_SECURITY_VALIDATION_OK)
       goto err_inv_token;
 
     handshake->rdh = dhkeyRemote;
@@ -2168,7 +1920,7 @@ DDS_Security_ValidationResult_t process_handshake(dds_security_authentication *i
   case CREATEDREPLY:
     /* The source of the handshake_handle is a begin_handshake_reply function So, handshake_message_in is from a remote process_handshake function */
     /* Verify Message Token contents according to Spec 9.3.2.5.3 (Final Message)   */
-    if (validate_handshake_final_token(handshake_message_in, handshake, ex) != DDS_SECURITY_VALIDATION_OK)
+    if (validate_handshake_token(handshake_message_in, HS_TOKEN_FINAL, handshake, NULL, NULL, ex) != DDS_SECURITY_VALIDATION_OK)
       goto err_inv_token;
     challenge2_ref_for_shared_secret = (DDS_Security_octet *)(handshake->relation->lchallenge);
     challenge1_ref_for_shared_secret = (DDS_Security_octet *)(handshake->relation->rchallenge);
diff --git a/src/security/core/include/dds/security/core/dds_security_utils.h b/src/security/core/include/dds/security/core/dds_security_utils.h
index c9cbf0e..c61829a 100644
--- a/src/security/core/include/dds/security/core/dds_security_utils.h
+++ b/src/security/core/include/dds/security/core/dds_security_utils.h
@@ -14,6 +14,7 @@
 #define DSCMN_SECURITY_UTILS_H_
 
 #include <stddef.h>
+#include <stdarg.h>
 #include <stdint.h>
 #include <stdbool.h>
 #include "dds/export.h"
@@ -261,6 +262,15 @@ DDS_EXPORT void
 DDS_Security_HandleSeq_deinit(
          DDS_Security_HandleSeq *seq);
 
+DDS_EXPORT void
+DDS_Security_Exception_vset(
+         DDS_Security_SecurityException *ex,
+         const char *context,
+         int code,
+         int minor_code,
+         const char *fmt,
+         va_list ap);
+
 DDS_EXPORT void
 DDS_Security_Exception_set(
          DDS_Security_SecurityException *ex,
@@ -268,7 +278,7 @@ DDS_Security_Exception_set(
          int code,
          int minor_code,
          const char *fmt,
-        ...);
+         ...);
 
 
 #ifdef DDSI_INCLUDE_SSL
diff --git a/src/security/core/src/dds_security_utils.c b/src/security/core/src/dds_security_utils.c
index 3c04c60..723a383 100644
--- a/src/security/core/src/dds_security_utils.c
+++ b/src/security/core/src/dds_security_utils.c
@@ -760,50 +760,49 @@ DDS_Security_HandleSeq_deinit(
     DDS_Security_HandleSeq_freebuf(seq);
 }
 
-
-
-
-void
-DDS_Security_Exception_set(
-     DDS_Security_SecurityException *ex,
-     const char *context,
-     int code,
-     int minor_code,
-     const char *fmt,
-    ...)
+void DDS_Security_Exception_vset (DDS_Security_SecurityException *ex, const char *context, int code, int minor_code, const char *fmt, va_list args1)
 {
-    int32_t ret;
-    size_t len;
-    char buf[1] = { '\0' };
-    char *str = NULL;
-    va_list args1, args2;
+  int32_t ret;
+  size_t len;
+  char buf[1] = { '\0' };
+  char *str = NULL;
+  va_list args2;
 
-    assert(context);
-    assert(fmt);
-    assert(ex);
-    DDSRT_UNUSED_ARG( context );
+  assert(context);
+  assert(fmt);
+  assert(ex);
+  DDSRT_UNUSED_ARG( context );
 
-    va_start(args1, fmt);
-    va_copy(args2, args1);
+  va_copy(args2, args1);
 
-    if ((ret = vsnprintf(buf, sizeof(buf), fmt, args1)) >= 0) {
-        len = (size_t)ret; /* +1 for null byte */
-        if ((str = ddsrt_malloc(len + 1)) == NULL) {
-            assert(false);
-        } else if ((ret = vsnprintf(str, len + 1, fmt, args2)) >= 0) {
-            assert((size_t) ret == len);
-        } else {
-            ddsrt_free(str);
-            str = NULL;
-        }
+  if ((ret = vsnprintf(buf, sizeof(buf), fmt, args1)) >= 0) {
+    len = (size_t)ret; /* +1 for null byte */
+    if ((str = ddsrt_malloc(len + 1)) == NULL) {
+      assert(false);
+    } else if ((ret = vsnprintf(str, len + 1, fmt, args2)) >= 0) {
+      assert((size_t) ret == len);
+    } else {
+      ddsrt_free(str);
+      str = NULL;
     }
+  }
 
-    va_end(args1);
-    va_end(args2);
+  va_end(args1);
 
-    ex->message = str;
-    ex->code = code;
-    ex->minor_code = minor_code;
+  ex->message = str;
+  ex->code = code;
+  ex->minor_code = minor_code;
+}
+
+void DDS_Security_Exception_set (DDS_Security_SecurityException *ex, const char *context, int code, int minor_code, const char *fmt, ...)
+{
+  va_list args1;
+  assert(context);
+  assert(fmt);
+  assert(ex);
+  va_start(args1, fmt);
+  DDS_Security_Exception_vset (ex, context, code, minor_code, fmt, args1);
+  va_end(args1);
 }
 
 #ifdef DDSI_INCLUDE_SSL

From cec8aea6c9b479b0428310dbf2b5fe14bee5855b Mon Sep 17 00:00:00 2001
From: Erik Boasson <eb@ilities.com>
Date: Mon, 23 Mar 2020 08:13:51 +0100
Subject: [PATCH 130/238] Compound literals go out of scope, too

Signed-off-by: Erik Boasson <eb@ilities.com>
---
 .../builtin_plugins/authentication/src/authentication.c  | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/src/security/builtin_plugins/authentication/src/authentication.c b/src/security/builtin_plugins/authentication/src/authentication.c
index 951e07e..7e15f05 100644
--- a/src/security/builtin_plugins/authentication/src/authentication.c
+++ b/src/security/builtin_plugins/authentication/src/authentication.c
@@ -1536,12 +1536,13 @@ static DDS_Security_ValidationResult_t validate_handshake_token_impl (const DDS_
     DDS_Security_BinaryProperty_t hash_c2_val = {
       .name = "hash_c2", .value = { ._length = sizeof (handshake->hash_c2), ._buffer = handshake->hash_c2 }
     };
-    const DDS_Security_BinaryProperty_t **properties;
+    DDS_Security_ValidationResult_t result;
     if (token_type == HS_TOKEN_REPLY)
-      properties = (const DDS_Security_BinaryProperty_t *[]) { &hash_c2_val, challenge2, dh2, challenge1, dh1, &hash_c1_val };
+      result = validate_signature (public_key, (const DDS_Security_BinaryProperty_t *[]) {
+        &hash_c2_val, challenge2, dh2, challenge1, dh1, &hash_c1_val }, 6, signature->value._buffer, signature->value._length, ex);
     else
-      properties = (const DDS_Security_BinaryProperty_t *[]) { &hash_c1_val, challenge1, dh1, challenge2, dh2, &hash_c2_val };
-    const DDS_Security_ValidationResult_t result = validate_signature (public_key, properties, 6, signature->value._buffer, signature->value._length, ex);
+      result = validate_signature (public_key, (const DDS_Security_BinaryProperty_t *[]) {
+        &hash_c1_val, challenge1, dh1, challenge2, dh2, &hash_c2_val }, 6, signature->value._buffer, signature->value._length, ex);
     EVP_PKEY_free (public_key);
     if (result != DDS_SECURITY_VALIDATION_OK)
       return result;

From bf23dee70af4756186855665b2845666f06913d2 Mon Sep 17 00:00:00 2001
From: Dennis Potman <dennis.potman@adlinktech.com>
Date: Tue, 24 Mar 2020 21:24:16 +0100
Subject: [PATCH 131/238] Fix in access control identity subject compare

Fixed a bug in the subject compare function for identity subjects, that
could cause using the incorrect permission grant in case multiple grants
are provided in the permissions configuration of the access control plugin.

Signed-off-by: Dennis Potman <dennis.potman@adlinktech.com>
---
 .../builtin_plugins/access_control/src/access_control_utils.c   | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/security/builtin_plugins/access_control/src/access_control_utils.c b/src/security/builtin_plugins/access_control/src/access_control_utils.c
index 6c56d9e..ca80d77 100644
--- a/src/security/builtin_plugins/access_control/src/access_control_utils.c
+++ b/src/security/builtin_plugins/access_control/src/access_control_utils.c
@@ -282,7 +282,7 @@ bool ac_check_subjects_are_equal(const char *permissions_sn, const char *identit
     if (name_idsn == NULL || tok_idsn == NULL)
       goto check_subj_equal_failed;
     value_pmsn = DDS_Security_Property_get_value(&prop_pmsn, name_idsn);
-    if (value_pmsn == NULL || strcmp(value_pmsn, value_pmsn) != 0)
+    if (value_pmsn == NULL || strcmp(tok_idsn, value_pmsn) != 0)
     {
       ddsrt_free(value_pmsn);
       goto check_subj_equal_failed;

From d03587fcea25d8d739f8ff81f6ad3c151dbc5ee2 Mon Sep 17 00:00:00 2001
From: Dennis Potman <dennis.potman@adlinktech.com>
Date: Wed, 25 Mar 2020 08:47:51 +0100
Subject: [PATCH 132/238] Add identity bob to default test permissions xml

Signed-off-by: Dennis Potman <dennis.potman@adlinktech.com>
---
 .../tests/common/etc/default_permissions.p7s  | 59 +++++++++++++++----
 .../tests/common/etc/default_permissions.xml  | 35 ++++++++++-
 2 files changed, 80 insertions(+), 14 deletions(-)

diff --git a/src/security/core/tests/common/etc/default_permissions.p7s b/src/security/core/tests/common/etc/default_permissions.p7s
index 3417eac..ddc97bc 100644
--- a/src/security/core/tests/common/etc/default_permissions.p7s
+++ b/src/security/core/tests/common/etc/default_permissions.p7s
@@ -1,16 +1,16 @@
 MIME-Version: 1.0
-Content-Type: multipart/signed; protocol="application/x-pkcs7-signature"; micalg="sha-256"; boundary="----024D6D35BD8D71C15552DF3E23F615BB"
+Content-Type: multipart/signed; protocol="application/x-pkcs7-signature"; micalg="sha-256"; boundary="----A38CC2CF99C9B2ECE7711B9937B56A67"
 
 This is an S/MIME signed message
 
-------024D6D35BD8D71C15552DF3E23F615BB
+------A38CC2CF99C9B2ECE7711B9937B56A67
 Content-Type: text/plain
 
 <?xml version="1.0" encoding="utf-8"?>
 <dds xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
     xsi:noNamespaceSchemaLocation="https://www.omg.org/spec/DDS-SECURITY/20170901/omg_shared_ca_permissions.xsd">
     <permissions>
-        <grant name="default_permissions">
+        <grant name="alice_permissions">
             <subject_name>emailAddress=alice@cycloneddssecurity.adlinktech.com,CN=Alice Example,O=Example Organization,OU=Organizational Unit Name,L=Locality Name,ST=OV,C=NL</subject_name>
             <validity>
                 <!-- Format is CCYY-MM-DDThh:mm:ss[Z|(+|-)hh:mm] in GMT -->
@@ -43,10 +43,43 @@ Content-Type: text/plain
             </allow_rule>
             <default>DENY</default>
         </grant>
+        <grant name="bob_permissions">
+            <subject_name>emailAddress=bob@cycloneddssecurity.adlinktech.com,CN=Bob Example,O=Example Organization,OU=Organizational Unit Name,L=Locality Name,ST=OV,C=NL</subject_name>
+            <validity>
+                <!-- Format is CCYY-MM-DDThh:mm:ss[Z|(+|-)hh:mm] in GMT -->
+                <not_before>2015-09-15T01:00:00</not_before>
+                <not_after>2115-09-15T01:00:00</not_after>
+            </validity>
+            <allow_rule>
+                <domains>
+                    <id_range>
+                        <min>0</min>
+                        <max>230</max>
+                    </id_range>
+                </domains>
+                <publish>
+                    <topics>
+                        <topic>*</topic>
+                    </topics>
+                    <partitions>
+                        <partition>*</partition>
+                    </partitions>
+                </publish>
+                <subscribe>
+                    <topics>
+                        <topic>*</topic>
+                    </topics>
+                    <partitions>
+                        <partition>*</partition>
+                    </partitions>
+                </subscribe>
+            </allow_rule>
+            <default>DENY</default>
+        </grant>
     </permissions>
 </dds>
 
-------024D6D35BD8D71C15552DF3E23F615BB
+------A38CC2CF99C9B2ECE7711B9937B56A67
 Content-Type: application/x-pkcs7-signature; name="smime.p7s"
 Content-Transfer-Encoding: base64
 Content-Disposition: attachment; filename="smime.p7s"
@@ -82,16 +115,16 @@ DBdFeGFtcGxlIENBIE9yZ2FuaXphdGlvbjEfMB0GA1UEAwwWRXhhbXBsZSBQZXJt
 aXNzaW9ucyBDQTE6MDgGCSqGSIb3DQEJARYrYXV0aG9yaXR5QGN5Y2xvbmVkZHNz
 ZWN1cml0eS5hZGxpbmt0ZWNoLmNvbQIUfoby6818hlJQ+41KUHiM6BZll/0wDQYJ
 YIZIAWUDBAIBBQCggeQwGAYJKoZIhvcNAQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG
-9w0BCQUxDxcNMjAwMjI3MTM1MDU2WjAvBgkqhkiG9w0BCQQxIgQgLVEvOwNNW9+x
-+KKNuY51LjFOBF441MR89lv8fK5pDKMweQYJKoZIhvcNAQkPMWwwajALBglghkgB
+9w0BCQUxDxcNMjAwMzI1MDczMTM5WjAvBgkqhkiG9w0BCQQxIgQg3FQPbVj9xFlc
+/eoZaddhdX1BXlKZyENrbh7DcCwklVwweQYJKoZIhvcNAQkPMWwwajALBglghkgB
 ZQMEASowCwYJYIZIAWUDBAEWMAsGCWCGSAFlAwQBAjAKBggqhkiG9w0DBzAOBggq
 hkiG9w0DAgICAIAwDQYIKoZIhvcNAwICAUAwBwYFKw4DAgcwDQYIKoZIhvcNAwIC
-ASgwDQYJKoZIhvcNAQEBBQAEggEAxDaQlT3KGO3Z69Dgh1JAnkR8fEW+SK/pRls0
-du8ZemKaeLAgwwS9rbMh+6YJqsYWrp1LWjxNI3oJqTp1RvcRzJJXF48nkP+Oe1jY
-2KX9wx5LthmrT/573EvZHkXsx7mBu3Ar2etm4iE3lqkblEiynTNfy4XmJBNdB+u8
-cTzzm6J9372FK3iu5Od9yVDV33Ys/OHBI8GYcrK9RBKovkctr2fK+RJHaVqrDy3y
-oE03GAaFr8brL2g9WlWRsE3nuRvPXppsz32kUWvHLUfEpGbq1K/9C137JSgVHNX2
-atfV404PDWdFqL/JMSdc8RIJTzY6I2Bwrg8z1912DkYD5KPuOA==
+ASgwDQYJKoZIhvcNAQEBBQAEggEAWJxDp9TDqXKazAlIj9SZ8mQXhhGoTDeqZbxE
+Bs561dHUmQVtA2S85TWGiCffKqWj3wlF5GwZNneYEV1deE3LZFa0o1+/VpeIBSGO
+Qs1xKS7zx8IkGok3k88bh+eohDrgpzdLWkZeJ4P7J/3JmCMFdTXuCpuQYhRIrXO0
+pq4ueV2qGyCN6GZS2PC88GV0xeoS62Vj1Xze8omfgDI7KCPhKz6gJSEFUUqIzg7p
+Zhqm15qorUoBVXcvMwaG95/xZVfcZzMbmJB/nhwd9KYu9ImkGj6ssSbgr3VR4OkQ
+gQUib4aVQJQgBaWEPrgSjRkAp9rMB7R9IW6p2auMA/Gd/kbd7g==
 
-------024D6D35BD8D71C15552DF3E23F615BB--
+------A38CC2CF99C9B2ECE7711B9937B56A67--
 
diff --git a/src/security/core/tests/common/etc/default_permissions.xml b/src/security/core/tests/common/etc/default_permissions.xml
index 74e3c9f..5802a3e 100644
--- a/src/security/core/tests/common/etc/default_permissions.xml
+++ b/src/security/core/tests/common/etc/default_permissions.xml
@@ -2,7 +2,7 @@
 <dds xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
     xsi:noNamespaceSchemaLocation="https://www.omg.org/spec/DDS-SECURITY/20170901/omg_shared_ca_permissions.xsd">
     <permissions>
-        <grant name="default_permissions">
+        <grant name="alice_permissions">
             <subject_name>emailAddress=alice@cycloneddssecurity.adlinktech.com,CN=Alice Example,O=Example Organization,OU=Organizational Unit Name,L=Locality Name,ST=OV,C=NL</subject_name>
             <validity>
                 <!-- Format is CCYY-MM-DDThh:mm:ss[Z|(+|-)hh:mm] in GMT -->
@@ -35,5 +35,38 @@
             </allow_rule>
             <default>DENY</default>
         </grant>
+        <grant name="bob_permissions">
+            <subject_name>emailAddress=bob@cycloneddssecurity.adlinktech.com,CN=Bob Example,O=Example Organization,OU=Organizational Unit Name,L=Locality Name,ST=OV,C=NL</subject_name>
+            <validity>
+                <!-- Format is CCYY-MM-DDThh:mm:ss[Z|(+|-)hh:mm] in GMT -->
+                <not_before>2015-09-15T01:00:00</not_before>
+                <not_after>2115-09-15T01:00:00</not_after>
+            </validity>
+            <allow_rule>
+                <domains>
+                    <id_range>
+                        <min>0</min>
+                        <max>230</max>
+                    </id_range>
+                </domains>
+                <publish>
+                    <topics>
+                        <topic>*</topic>
+                    </topics>
+                    <partitions>
+                        <partition>*</partition>
+                    </partitions>
+                </publish>
+                <subscribe>
+                    <topics>
+                        <topic>*</topic>
+                    </topics>
+                    <partitions>
+                        <partition>*</partition>
+                    </partitions>
+                </subscribe>
+            </allow_rule>
+            <default>DENY</default>
+        </grant>
     </permissions>
 </dds>

From 4fe9cf290da8e4cbbd79c3c26078256fc5bf29c1 Mon Sep 17 00:00:00 2001
From: Erik Boasson <eb@ilities.com>
Date: Mon, 23 Mar 2020 17:26:18 +0100
Subject: [PATCH 133/238] Add DDS_HAS_PROPERTY_LIST_QOS feature test macro

If set, dds_q{set,get}_{prop,bprop} are available.

Signed-off-by: Erik Boasson <eb@ilities.com>
---
 src/core/ddsc/include/dds/ddsc/dds_public_qos.h | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/src/core/ddsc/include/dds/ddsc/dds_public_qos.h b/src/core/ddsc/include/dds/ddsc/dds_public_qos.h
index 9ce40f0..4146960 100644
--- a/src/core/ddsc/include/dds/ddsc/dds_public_qos.h
+++ b/src/core/ddsc/include/dds/ddsc/dds_public_qos.h
@@ -23,6 +23,11 @@
 #include "dds/export.h"
 #include "dds/ddsc/dds_public_qosdefs.h"
 
+/* Whether or not the "property list" QoS setting is supported in this version.  If it is,
+   the "dds.sec." properties are treated specially, preventing the accidental creation of
+   an non-secure participant by an implementation built without support for DDS Security. */
+#define DDS_HAS_PROPERTY_LIST_QOS 1
+
 #if defined (__cplusplus)
 extern "C" {
 #endif

From d4e9300dadb1d600aa639ee20a188439dc25a701 Mon Sep 17 00:00:00 2001
From: Erik Boasson <eb@ilities.com>
Date: Mon, 23 Mar 2020 17:27:29 +0100
Subject: [PATCH 134/238] Do not silently ignore security QoS settings

When built without support for DDS Security, any attempt to create a
participant QoS settings in the security name space (those prefixed by
"dds.sec.") must fail.

Signed-off-by: Erik Boasson <eb@ilities.com>
---
 src/core/ddsc/tests/config.c                  |  40 +++
 .../ddsi/include/dds/ddsi/ddsi_security_omg.h |   9 +-
 src/core/ddsi/include/dds/ddsi/ddsi_xqos.h    |   4 +-
 src/core/ddsi/src/ddsi_plist.c                |  26 +-
 src/core/ddsi/src/ddsi_security_omg.c         |  12 +-
 src/core/ddsi/src/q_entity.c                  | 291 +++++++++---------
 6 files changed, 226 insertions(+), 156 deletions(-)

diff --git a/src/core/ddsc/tests/config.c b/src/core/ddsc/tests/config.c
index 546062a..159a4ac 100644
--- a/src/core/ddsc/tests/config.c
+++ b/src/core/ddsc/tests/config.c
@@ -141,3 +141,43 @@ CU_Test(ddsc_security_config, empty, .init = ddsrt_init, .fini = ddsrt_fini)
   CU_ASSERT_FATAL(found == 0x7);
 #endif
 }
+
+CU_Test(ddsc_security_qos, empty, .init = ddsrt_init, .fini = ddsrt_fini)
+{
+  /* Expected traces when creating participant with some (not all) security QoS
+     settings.  We need to test this one here to be sure that it also refuses to
+     start when security is configured but the implementation doesn't include
+     support for it. */
+  const char *log_expected[] = {
+#ifdef DDSI_INCLUDE_SECURITY
+    "new_participant(*): using security settings from QoS*",
+    "new_participant(*): required security property * missing*",
+#endif
+    NULL
+  };
+
+  /* Set up the trace sinks to detect the config parsing. */
+  dds_set_log_mask (DDS_LC_FATAL|DDS_LC_ERROR|DDS_LC_WARNING|DDS_LC_CONFIG);
+  dds_set_log_sink (&logger, (void *) log_expected);
+  dds_set_trace_sink (&logger, (void *) log_expected);
+
+  /* Create participant with incomplete/nonsensical security configuration: this should always fail */
+  found = 0;
+  dds_qos_t *qos = dds_create_qos ();
+  dds_qset_prop (qos, "dds.sec.nonsense", "");
+  dds_entity_t domain = dds_create_domain (0, "<Tracing><Category>trace</Category>");
+  CU_ASSERT_FATAL (domain > 0);
+  dds_entity_t participant = dds_create_participant (0, qos, NULL);
+  dds_delete_qos (qos);
+  CU_ASSERT_FATAL (participant < 0);
+  (void) dds_delete (domain);
+  dds_set_log_sink (NULL, NULL);
+  dds_set_trace_sink (NULL, NULL);
+
+  /* All traces should have been provided. */
+#ifndef DDSI_INCLUDE_SECURITY
+  CU_ASSERT_FATAL (found == 0x0);
+#else
+  CU_ASSERT_FATAL (found == 0x3);
+#endif
+}
diff --git a/src/core/ddsi/include/dds/ddsi/ddsi_security_omg.h b/src/core/ddsi/include/dds/ddsi/ddsi_security_omg.h
index 30e2c4a..7eaaee1 100644
--- a/src/core/ddsi/include/dds/ddsi/ddsi_security_omg.h
+++ b/src/core/ddsi/include/dds/ddsi/ddsi_security_omg.h
@@ -184,11 +184,12 @@ bool q_omg_proxy_participant_is_secure(const struct proxy_participant *proxypp);
  * @param[in] pp         The participant to check if alloweed by security.
  * #param[in] domain_id  The domain_id
  *
- * @returns bool
- * @retval true   Participant is allowed
- * @retval false  Participant is not allowed
+ * @returns dds_return_t
+ * @retval DDS_RETCODE_OK   Participant is allowed
+ * @retval DDS_RETCODE_NOT_ALLOWED_BY_SECURITY
+ *                          Participant is not allowed
  */
-bool q_omg_security_check_create_participant(struct participant *pp, uint32_t domain_id);
+dds_return_t q_omg_security_check_create_participant(struct participant *pp, uint32_t domain_id);
 
 void q_omg_security_participant_set_initialized(struct participant *pp);
 
diff --git a/src/core/ddsi/include/dds/ddsi/ddsi_xqos.h b/src/core/ddsi/include/dds/ddsi/ddsi_xqos.h
index fac06d4..b7e803a 100644
--- a/src/core/ddsi/include/dds/ddsi/ddsi_xqos.h
+++ b/src/core/ddsi/include/dds/ddsi/ddsi_xqos.h
@@ -322,7 +322,9 @@ DDS_EXPORT void ddsi_xqos_addtomsg (struct nn_xmsg *m, const dds_qos_t *xqos, ui
 DDS_EXPORT void ddsi_xqos_log (uint32_t cat, const struct ddsrt_log_cfg *logcfg, const dds_qos_t *xqos);
 DDS_EXPORT size_t ddsi_xqos_print (char * __restrict buf, size_t bufsize, const dds_qos_t *xqos);
 DDS_EXPORT dds_qos_t *ddsi_xqos_dup (const dds_qos_t *src);
-DDS_EXPORT bool ddsi_xqos_has_prop (const dds_qos_t *xqos, const char *pname, bool startswith, bool check_non_empty);
+DDS_EXPORT bool ddsi_xqos_has_prop_prefix (const dds_qos_t *xqos, const char *nameprefix);
+DDS_EXPORT bool ddsi_xqos_find_prop (const dds_qos_t *xqos, const char *name, const char **value);
+
 #ifdef DDSI_INCLUDE_SECURITY
 struct omg_security_configuration_type;
 DDS_EXPORT void ddsi_xqos_mergein_security_config (dds_qos_t *xqos, const struct omg_security_configuration_type *cfg);
diff --git a/src/core/ddsi/src/ddsi_plist.c b/src/core/ddsi/src/ddsi_plist.c
index ea032ad..f440276 100644
--- a/src/core/ddsi/src/ddsi_plist.c
+++ b/src/core/ddsi/src/ddsi_plist.c
@@ -3179,16 +3179,30 @@ dds_qos_t * ddsi_xqos_dup (const dds_qos_t *src)
   return dst;
 }
 
-bool ddsi_xqos_has_prop (const dds_qos_t *xqos, const char *pname, bool startswith, bool check_non_empty)
+bool ddsi_xqos_has_prop_prefix (const dds_qos_t *xqos, const char *nameprefix)
 {
   if (!(xqos->present & QP_PROPERTY_LIST))
     return false;
+  const size_t len = strlen (nameprefix);
+  for (uint32_t i = 0; i < xqos->property.value.n; i++)
+  {
+    if (strncmp (xqos->property.value.props[i].name, nameprefix, len) == 0)
+      return true;
+  }
+  return false;
+}
 
-  for (uint32_t i = 0; i < xqos->property.value.n; i++) {
-    if (startswith && (strncmp(xqos->property.value.props[i].name, pname, strlen(pname)) == 0)) {
-      return !check_non_empty || strlen(xqos->property.value.props[i].value) != 0;
-    } else if (!startswith && (strcmp(xqos->property.value.props[i].name, pname) == 0)) {
-      return !check_non_empty || strlen(xqos->property.value.props[i].value) != 0;
+bool ddsi_xqos_find_prop (const dds_qos_t *xqos, const char *name, const char **value)
+{
+  if (!(xqos->present & QP_PROPERTY_LIST))
+    return false;
+  for (uint32_t i = 0; i < xqos->property.value.n; i++)
+  {
+    if (strcmp (xqos->property.value.props[i].name, name) == 0)
+    {
+      if (value)
+        *value = xqos->property.value.props[i].value;
+      return true;
     }
   }
   return false;
diff --git a/src/core/ddsi/src/ddsi_security_omg.c b/src/core/ddsi/src/ddsi_security_omg.c
index 64ec164..2dd78ab 100644
--- a/src/core/ddsi/src/ddsi_security_omg.c
+++ b/src/core/ddsi/src/ddsi_security_omg.c
@@ -844,9 +844,9 @@ bool q_omg_participant_allow_unauthenticated(struct participant *pp)
   return ((pp->sec_attr != NULL) && pp->sec_attr->attr.allow_unauthenticated_participants);
 }
 
-bool q_omg_security_check_create_participant(struct participant *pp, uint32_t domain_id)
+dds_return_t q_omg_security_check_create_participant(struct participant *pp, uint32_t domain_id)
 {
-  bool allowed = false;
+  dds_return_t ret = DDS_RETCODE_NOT_ALLOWED_BY_SECURITY;
   struct dds_security_context *sc = q_omg_security_get_secure_context(pp);
   DDS_Security_IdentityHandle identity_handle = DDS_SECURITY_HANDLE_NIL;
   DDS_Security_SecurityException exception = DDS_SECURITY_EXCEPTION_INIT;
@@ -860,7 +860,7 @@ bool q_omg_security_check_create_participant(struct participant *pp, uint32_t do
   ddsi_guid_t adjusted_guid;
 
   if (!sc)
-    return true;
+    return DDS_RETCODE_OK;
 
   /* Validate local identity */
   ETRACE (pp, "validate_local_identity: candidate_guid: "PGUIDFMT" ", PGUID (pp->e.guid));
@@ -953,7 +953,7 @@ bool q_omg_security_check_create_participant(struct participant *pp, uint32_t do
 
   ETRACE (pp, "\n");
 
-  allowed = true;
+  ret = DDS_RETCODE_OK;
 
 no_crypto:
 no_sec_attr:
@@ -963,11 +963,11 @@ no_credentials:
   if (credential_token.class_id)
     (void)sc->access_control_context->return_permissions_credential_token(sc->access_control_context, &credential_token, NULL);
 not_allowed:
-  if (!allowed)
+  if (ret != DDS_RETCODE_OK)
     participant_sec_attributes_free(sec_attr);
 validation_failed:
   q_omg_shallow_free_security_qos(&par_qos);
-  return allowed;
+  return ret;
 }
 
 void q_omg_security_participant_set_initialized(struct participant *pp)
diff --git a/src/core/ddsi/src/q_entity.c b/src/core/ddsi/src/q_entity.c
index 5136dc8..614ad98 100644
--- a/src/core/ddsi/src/q_entity.c
+++ b/src/core/ddsi/src/q_entity.c
@@ -204,7 +204,6 @@ int is_builtin_endpoint (ddsi_entityid_t id, nn_vendorid_t vendorid)
 }
 
 #ifdef DDSI_INCLUDE_SECURITY
-
 static int is_builtin_volatile_endpoint (ddsi_entityid_t id)
 {
   switch (id.u) {
@@ -217,13 +216,13 @@ static int is_builtin_volatile_endpoint (ddsi_entityid_t id)
   return 0;
 }
 #else
-
+#ifndef NDEBUG
 static int is_builtin_volatile_endpoint (ddsi_entityid_t id)
 {
   DDSRT_UNUSED_ARG(id);
   return 0;
 }
-
+#endif
 #endif
 
 bool is_local_orphan_endpoint (const struct entity_common *e)
@@ -633,9 +632,63 @@ static void add_security_builtin_endpoints(struct participant *pp, ddsi_guid_t *
 }
 #endif
 
+static void add_builtin_endpoints(struct participant *pp, ddsi_guid_t *subguid, const ddsi_guid_t *group_guid, struct ddsi_domaingv *gv, bool add_writers, bool add_readers)
+{
+  if (add_writers)
+  {
+    struct whc_writer_info *wrinfo = whc_make_wrinfo (NULL, &gv->builtin_endpoint_xqos_wr);
+
+    /* SEDP writers: */
+    subguid->entityid = to_entityid (NN_ENTITYID_SEDP_BUILTIN_SUBSCRIPTIONS_WRITER);
+    new_writer_guid (NULL, subguid, group_guid, pp, NULL, &gv->builtin_endpoint_xqos_wr, whc_new(gv, wrinfo), NULL, NULL);
+    pp->bes |= NN_DISC_BUILTIN_ENDPOINT_SUBSCRIPTION_ANNOUNCER;
+
+    subguid->entityid = to_entityid (NN_ENTITYID_SEDP_BUILTIN_PUBLICATIONS_WRITER);
+    new_writer_guid (NULL, subguid, group_guid, pp, NULL, &gv->builtin_endpoint_xqos_wr, whc_new(gv, wrinfo), NULL, NULL);
+    pp->bes |= NN_DISC_BUILTIN_ENDPOINT_PUBLICATION_ANNOUNCER;
+
+    /* PMD writer: */
+    subguid->entityid = to_entityid (NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_MESSAGE_WRITER);
+    new_writer_guid (NULL, subguid, group_guid, pp, NULL, &gv->builtin_endpoint_xqos_wr, whc_new(gv, wrinfo), NULL, NULL);
+    pp->bes |= NN_BUILTIN_ENDPOINT_PARTICIPANT_MESSAGE_DATA_WRITER;
+
+    if (gv->config.do_topic_discovery)
+    {
+      subguid->entityid = to_entityid (NN_ENTITYID_SEDP_BUILTIN_TOPIC_WRITER);
+      new_writer_guid (NULL, subguid, group_guid, pp, NULL, &gv->builtin_endpoint_xqos_wr, whc_new(gv, wrinfo), NULL, NULL);
+      pp->bes |= NN_DISC_BUILTIN_ENDPOINT_TOPIC_ANNOUNCER;
+    }
+
+    whc_free_wrinfo (wrinfo);
+  }
+
+  /* SPDP, SEDP, PMD readers: */
+  if (add_readers)
+  {
+    subguid->entityid = to_entityid (NN_ENTITYID_SPDP_BUILTIN_PARTICIPANT_READER);
+    new_reader_guid (NULL, subguid, group_guid, pp, NULL, &gv->spdp_endpoint_xqos, NULL, NULL, NULL);
+    pp->bes |= NN_DISC_BUILTIN_ENDPOINT_PARTICIPANT_DETECTOR;
+
+    subguid->entityid = to_entityid (NN_ENTITYID_SEDP_BUILTIN_SUBSCRIPTIONS_READER);
+    new_reader_guid (NULL, subguid, group_guid, pp, NULL, &gv->builtin_endpoint_xqos_rd, NULL, NULL, NULL);
+    pp->bes |= NN_DISC_BUILTIN_ENDPOINT_SUBSCRIPTION_DETECTOR;
+
+    subguid->entityid = to_entityid (NN_ENTITYID_SEDP_BUILTIN_PUBLICATIONS_READER);
+    new_reader_guid (NULL, subguid, group_guid, pp, NULL, &gv->builtin_endpoint_xqos_rd, NULL, NULL, NULL);
+    pp->bes |= NN_DISC_BUILTIN_ENDPOINT_PUBLICATION_DETECTOR;
+
+    subguid->entityid = to_entityid (NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_MESSAGE_READER);
+    new_reader_guid (NULL, subguid, group_guid, pp, NULL, &gv->builtin_endpoint_xqos_rd, NULL, NULL, NULL);
+    pp->bes |= NN_BUILTIN_ENDPOINT_PARTICIPANT_MESSAGE_DATA_READER;
+  }
 
 #ifdef DDSI_INCLUDE_SECURITY
+  if (q_omg_participant_is_secure (pp))
+    add_security_builtin_endpoints (pp, subguid, group_guid, gv, add_writers, add_readers);
+#endif
+}
 
+#ifdef DDSI_INCLUDE_SECURITY
 static void connect_participant_secure(struct ddsi_domaingv *gv, struct participant *pp)
 {
   struct proxy_participant *proxypp;
@@ -749,6 +802,81 @@ static void participant_remove_wr_lease_locked (struct participant * pp, struct
   }
 }
 
+#ifdef DDSI_INCLUDE_SECURITY
+static dds_return_t check_and_load_security_config (struct ddsi_domaingv * const gv, const ddsi_guid_t *ppguid, dds_qos_t *qos)
+{
+  /* If some security properties (name starts with dds.sec. conform DDS Security spec 7.2.4.1)
+     are present in the QoS, all must be and they will be used.  If none are, take the settings
+     from the configuration if it has them.  When no security configuration exists anywhere,
+     create an unsecured participant.
+
+     This may modify "qos" */
+  if (ddsi_xqos_has_prop_prefix (qos, "dds.sec."))
+  {
+    char const * const req[] = {
+      DDS_SEC_PROP_AUTH_IDENTITY_CA,
+      DDS_SEC_PROP_AUTH_PRIV_KEY,
+      DDS_SEC_PROP_AUTH_IDENTITY_CERT,
+      DDS_SEC_PROP_ACCESS_PERMISSIONS_CA,
+      DDS_SEC_PROP_ACCESS_GOVERNANCE,
+      DDS_SEC_PROP_ACCESS_PERMISSIONS,
+
+      DDS_SEC_PROP_AUTH_LIBRARY_PATH,
+      DDS_SEC_PROP_AUTH_LIBRARY_INIT,
+      DDS_SEC_PROP_AUTH_LIBRARY_FINALIZE,
+      DDS_SEC_PROP_CRYPTO_LIBRARY_PATH,
+      DDS_SEC_PROP_CRYPTO_LIBRARY_INIT,
+      DDS_SEC_PROP_CRYPTO_LIBRARY_FINALIZE,
+      DDS_SEC_PROP_ACCESS_LIBRARY_PATH,
+      DDS_SEC_PROP_ACCESS_LIBRARY_INIT,
+      DDS_SEC_PROP_ACCESS_LIBRARY_FINALIZE
+    };
+    GVLOGDISC ("new_participant("PGUIDFMT"): using security settings from QoS\n", PGUID (*ppguid));
+
+    /* check if all required security properties exist in qos; report all missing ones, not just the first */
+    dds_return_t ret = DDS_RETCODE_OK;
+    for (size_t i = 0; i < sizeof(req) / sizeof(req[0]); i++)
+    {
+      const char *value;
+      if (!ddsi_xqos_find_prop (qos, req[i], &value) || strlen (value) == 0)
+      {
+        GVERROR ("new_participant("PGUIDFMT"): required security property %s missing in Property QoS\n", PGUID (*ppguid), req[i]);
+        ret = DDS_RETCODE_PRECONDITION_NOT_MET;
+      }
+    }
+    if (ret != DDS_RETCODE_OK)
+      return ret;
+  }
+  else if (gv->config.omg_security_configuration)
+  {
+    /* For security, configuration can be provided through the configuration.  However, the specification
+       (and the plugins) expect it to be in the QoS, so merge it in. */
+    GVLOGDISC ("new_participant("PGUIDFMT"): using security settings from configuration\n", PGUID (*ppguid));
+    ddsi_xqos_mergein_security_config (qos, &gv->config.omg_security_configuration->cfg);
+  }
+  else
+  {
+    /* No security configuration */
+    return DDS_RETCODE_OK;
+  }
+
+  if (q_omg_is_security_loaded (gv->security_context))
+  {
+    GVLOGDISC ("new_participant("PGUIDFMT"): security is already loaded for this domain\n", PGUID (*ppguid));
+    return DDS_RETCODE_OK;
+  }
+  else if (q_omg_security_load (gv->security_context, qos) < 0)
+  {
+    GVERROR ("Could not load security\n");
+    return DDS_RETCODE_NOT_ALLOWED_BY_SECURITY;
+  }
+  else
+  {
+    return DDS_RETCODE_OK;
+  }
+}
+#endif
+
 dds_return_t new_participant_guid (ddsi_guid_t *ppguid, struct ddsi_domaingv *gv, unsigned flags, const ddsi_plist_t *plist)
 {
   struct participant *pp;
@@ -828,77 +956,18 @@ dds_return_t new_participant_guid (ddsi_guid_t *ppguid, struct ddsi_domaingv *gv
 
 #ifdef DDSI_INCLUDE_SECURITY
   pp->sec_attr = NULL;
-  /*
-   * if there there are security properties check them .
-   * if there are no security properties, then merge from security configuration if there is
-   */
-  /* check for existing security properties (name starts with dds.sec. conform DDS Security spec 7.2.4.1)
-   * and return if any is found */
+  if ((ret = check_and_load_security_config (gv, ppguid, &pp->plist->qos)) != DDS_RETCODE_OK)
+    goto not_allowed;
+  if ((ret = q_omg_security_check_create_participant (pp, gv->config.domainId)) != DDS_RETCODE_OK)
+    goto not_allowed;
+  *ppguid = pp->e.guid;
+#else
+  if (ddsi_xqos_has_prop_prefix (&pp->plist->qos, "dds.sec."))
   {
-    bool ready_to_load_security = false;
-    if (ddsi_xqos_has_prop(&pp->plist->qos, "dds.sec.", true, false)) {
-      char *req[] = {DDS_SEC_PROP_AUTH_IDENTITY_CA,
-                     DDS_SEC_PROP_AUTH_PRIV_KEY,
-                     DDS_SEC_PROP_AUTH_IDENTITY_CERT,
-                     DDS_SEC_PROP_ACCESS_PERMISSIONS_CA,
-                     DDS_SEC_PROP_ACCESS_GOVERNANCE,
-                     DDS_SEC_PROP_ACCESS_PERMISSIONS,
-
-                     DDS_SEC_PROP_AUTH_LIBRARY_PATH,
-                     DDS_SEC_PROP_AUTH_LIBRARY_INIT,
-                     DDS_SEC_PROP_AUTH_LIBRARY_FINALIZE,
-                     DDS_SEC_PROP_CRYPTO_LIBRARY_PATH,
-                     DDS_SEC_PROP_CRYPTO_LIBRARY_INIT,
-                     DDS_SEC_PROP_CRYPTO_LIBRARY_FINALIZE,
-                     DDS_SEC_PROP_ACCESS_LIBRARY_PATH,
-                     DDS_SEC_PROP_ACCESS_LIBRARY_INIT,
-                     DDS_SEC_PROP_ACCESS_LIBRARY_FINALIZE};
-      GVLOGDISC ("new_participant("
-                         PGUIDFMT
-                         "): using security settings from QoS\n", PGUID(*ppguid));
-
-      /* check if all required security properties exist in qos */
-      for (size_t i = 0; i < sizeof(req) / sizeof(req[0]); i++) {
-        if (!ddsi_xqos_has_prop(&pp->plist->qos, req[i], false, true)) {
-          GVERROR ("new_participant("
-                           PGUIDFMT
-                           "): required security property %s missing in Property QoS\n", PGUID(*ppguid), req[i]);
-          ret = DDS_RETCODE_PRECONDITION_NOT_MET;
-        }
-      }
-      if (ret == DDS_RETCODE_OK) {
-        ready_to_load_security = true;
-      } else {
-        goto new_pp_err_secprop;
-      }
-    } else if (gv->config.omg_security_configuration) {
-      /* For security, configuration can be provided through the configuration.
-       * However, the specification (and the plugins) expect it to be in the QoS. */
-      GVLOGDISC ("new_participant("
-                         PGUIDFMT
-                         "): using security settings from configuration\n", PGUID(*ppguid));
-      ddsi_xqos_mergein_security_config(&pp->plist->qos, &gv->config.omg_security_configuration->cfg);
-      ready_to_load_security = true;
-    }
-
-    if( q_omg_is_security_loaded( gv->security_context ) == false ){
-      if (ready_to_load_security && q_omg_security_load(gv->security_context, &pp->plist->qos) < 0) {
-        GVERROR("Could not load security\n");
-        ret = DDS_RETCODE_NOT_ALLOWED_BY_SECURITY;
-        goto new_pp_err_secprop;
-      }
-    } else {
-      GVLOGDISC ("new_participant("
-                               PGUIDFMT
-                               "): security is already loaded for this domain\n", PGUID(*ppguid));
-    }
-
-    if (!q_omg_security_check_create_participant (pp, gv->config.domainId))
-    {
-      ret = DDS_RETCODE_NOT_ALLOWED_BY_SECURITY;
-      goto not_allowed;
-    }
-    *ppguid = pp->e.guid;
+    /* disallow creating a participant with a security configuration if there is support for security
+       has been left out */
+    ret = DDS_RETCODE_NOT_ALLOWED_BY_SECURITY;
+    goto not_allowed;
   }
 #endif
 
@@ -927,9 +996,7 @@ dds_return_t new_participant_guid (ddsi_guid_t *ppguid, struct ddsi_domaingv *gv
   subguid.prefix = pp->e.guid.prefix;
   memset (&group_guid, 0, sizeof (group_guid));
 
-  /* SPDP writer */
-  /* Note: skip SEDP <=> skip SPDP because of the way ddsi_discovery.c does things
-     currently.  */
+  /* SPDP is very much special and must be done first */
   if (!(flags & RTPS_PF_NO_BUILTIN_WRITERS))
   {
     subguid.entityid = to_entityid (NN_ENTITYID_SPDP_BUILTIN_PARTICIPANT_WRITER);
@@ -938,70 +1005,15 @@ dds_return_t new_participant_guid (ddsi_guid_t *ppguid, struct ddsi_domaingv *gv
     whc_free_wrinfo (wrinfo);
     /* But we need the as_disc address set for SPDP, because we need to
        send it to everyone regardless of the existence of readers. */
-    force_as_disc_address(gv, &subguid);
+    force_as_disc_address (gv, &subguid);
     pp->bes |= NN_DISC_BUILTIN_ENDPOINT_PARTICIPANT_ANNOUNCER;
   }
 
   /* Make it globally visible, else the endpoint matching won't work. */
   entidx_insert_participant_guid (gv->entity_index, pp);
 
-  /* SEDP writers: */
-  wrinfo = whc_make_wrinfo (NULL, &gv->builtin_endpoint_xqos_wr);
-  if (!(flags & RTPS_PF_NO_BUILTIN_WRITERS))
-  {
-    subguid.entityid = to_entityid (NN_ENTITYID_SEDP_BUILTIN_SUBSCRIPTIONS_WRITER);
-    new_writer_guid (NULL, &subguid, &group_guid, pp, NULL, &gv->builtin_endpoint_xqos_wr, whc_new(gv, wrinfo), NULL, NULL);
-    pp->bes |= NN_DISC_BUILTIN_ENDPOINT_SUBSCRIPTION_ANNOUNCER;
-
-    subguid.entityid = to_entityid (NN_ENTITYID_SEDP_BUILTIN_PUBLICATIONS_WRITER);
-    new_writer_guid (NULL, &subguid, &group_guid, pp, NULL, &gv->builtin_endpoint_xqos_wr, whc_new(gv, wrinfo), NULL, NULL);
-    pp->bes |= NN_DISC_BUILTIN_ENDPOINT_PUBLICATION_ANNOUNCER;
-  }
-
-  if (gv->config.do_topic_discovery)
-  {
-    /* TODO: make this one configurable, we don't want all participants to publish all topics (or even just those that they use themselves) */
-    subguid.entityid = to_entityid (NN_ENTITYID_SEDP_BUILTIN_TOPIC_WRITER);
-    new_writer_guid (NULL, &subguid, &group_guid, pp, NULL, &gv->builtin_endpoint_xqos_wr, whc_new(gv, wrinfo), NULL, NULL);
-    pp->bes |= NN_DISC_BUILTIN_ENDPOINT_TOPIC_ANNOUNCER;
-  }
-
-  /* PMD writer: */
-  if (!(flags & RTPS_PF_NO_BUILTIN_WRITERS))
-  {
-    subguid.entityid = to_entityid (NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_MESSAGE_WRITER);
-    new_writer_guid (NULL, &subguid, &group_guid, pp, NULL, &gv->builtin_endpoint_xqos_wr, whc_new(gv, wrinfo), NULL, NULL);
-    pp->bes |= NN_BUILTIN_ENDPOINT_PARTICIPANT_MESSAGE_DATA_WRITER;
-  }
-
-  whc_free_wrinfo (wrinfo);
-
-  /* SPDP, SEDP, PMD readers: */
-  if (!(flags & RTPS_PF_NO_BUILTIN_READERS))
-  {
-    subguid.entityid = to_entityid (NN_ENTITYID_SPDP_BUILTIN_PARTICIPANT_READER);
-    new_reader_guid (NULL, &subguid, &group_guid, pp, NULL, &gv->spdp_endpoint_xqos, NULL, NULL, NULL);
-    pp->bes |= NN_DISC_BUILTIN_ENDPOINT_PARTICIPANT_DETECTOR;
-
-    subguid.entityid = to_entityid (NN_ENTITYID_SEDP_BUILTIN_SUBSCRIPTIONS_READER);
-    new_reader_guid (NULL, &subguid, &group_guid, pp, NULL, &gv->builtin_endpoint_xqos_rd, NULL, NULL, NULL);
-    pp->bes |= NN_DISC_BUILTIN_ENDPOINT_SUBSCRIPTION_DETECTOR;
-
-    subguid.entityid = to_entityid (NN_ENTITYID_SEDP_BUILTIN_PUBLICATIONS_READER);
-    new_reader_guid (NULL, &subguid, &group_guid, pp, NULL, &gv->builtin_endpoint_xqos_rd, NULL, NULL, NULL);
-    pp->bes |= NN_DISC_BUILTIN_ENDPOINT_PUBLICATION_DETECTOR;
-
-    subguid.entityid = to_entityid (NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_MESSAGE_READER);
-    new_reader_guid (NULL, &subguid, &group_guid, pp, NULL, &gv->builtin_endpoint_xqos_rd, NULL, NULL, NULL);
-    pp->bes |= NN_BUILTIN_ENDPOINT_PARTICIPANT_MESSAGE_DATA_READER;
-  }
-
-#ifdef DDSI_INCLUDE_SECURITY
-  if (q_omg_participant_is_secure(pp))
-  {
-    add_security_builtin_endpoints(pp, &subguid, &group_guid, gv, !(flags & RTPS_PF_NO_BUILTIN_WRITERS), !(flags & RTPS_PF_NO_BUILTIN_READERS));
-  }
-#endif
+  /* add all built-in endpoints other than the SPDP writer */
+  add_builtin_endpoints (pp, &subguid, &group_guid, gv, !(flags & RTPS_PF_NO_BUILTIN_WRITERS), !(flags & RTPS_PF_NO_BUILTIN_READERS));
 
   /* If the participant doesn't have the full set of builtin writers
      it depends on the privileged participant, which must exist, hence
@@ -1009,7 +1021,8 @@ dds_return_t new_participant_guid (ddsi_guid_t *ppguid, struct ddsi_domaingv *gv
      If it is the privileged participant, set the global variable
      pointing to it.
      Except when the participant is only locally available. */
-  if (!(flags & RTPS_PF_ONLY_LOCAL)) {
+  if (!(flags & RTPS_PF_ONLY_LOCAL))
+  {
     ddsrt_mutex_lock (&gv->privileged_pp_lock);
     if ((pp->bes & builtin_writers_besmask) != builtin_writers_besmask)
     {
@@ -1066,16 +1079,16 @@ dds_return_t new_participant_guid (ddsi_guid_t *ppguid, struct ddsi_domaingv *gv
   }
 
 #ifdef DDSI_INCLUDE_SECURITY
-  if (q_omg_participant_is_secure(pp))
+  if (q_omg_participant_is_secure (pp))
   {
     connect_participant_secure (gv, pp);
   }
 #endif
   return ret;
 
-#ifdef DDSI_INCLUDE_SECURITY
 not_allowed:
-new_pp_err_secprop:
+  if (ppconn)
+    ddsi_conn_free (ppconn);
   ddsi_plist_fini (pp->plist);
   ddsrt_free (pp->plist);
   inverse_uint32_set_fini (&pp->avail_entityids.x);
@@ -1085,7 +1098,6 @@ new_pp_err_secprop:
   ddsrt_mutex_lock (&gv->participant_set_lock);
   gv->nparticipants--;
   ddsrt_mutex_unlock (&gv->participant_set_lock);
-#endif
 new_pp_err:
   return ret;
 }
@@ -4886,6 +4898,7 @@ void new_proxy_participant (struct ddsi_domaingv *gv, const struct ddsi_guid *pp
   const bool is_secure = ((bes & NN_DISC_BUILTIN_ENDPOINT_PARTICIPANT_SECURE_ANNOUNCER) != 0);
   assert (!is_secure || (plist->present & PP_IDENTITY_TOKEN));
   assert (is_secure || (bes & ~NN_BES_MASK_NON_SECURITY) == 0);
+  (void) is_secure;
 
   assert (ppguid->entityid.u == NN_ENTITYID_PARTICIPANT);
   assert (entidx_lookup_proxy_participant_guid (gv->entity_index, ppguid) == NULL);

From ecbd585f12fd11e9efe689b6dce6a578fd0665cd Mon Sep 17 00:00:00 2001
From: Erik Boasson <eb@ilities.com>
Date: Wed, 25 Mar 2020 10:39:44 +0100
Subject: [PATCH 135/238] Generate header with compile-time features

Currently:

* DDS_HAS_SECURITY for DDS Security support
* DDS_HAS_LIFESPAN for lifespan QoS support
* DDS_HAS_DEADLINE_MISSED for "deadline missed" event support

These are defined to 1 if support for the feature is included in the
build and left undefined if it isn't.

Signed-off-by: Erik Boasson <eb@ilities.com>
---
 src/CMakeLists.txt              | 20 ++++++++++++++++++++
 src/core/ddsc/include/dds/dds.h |  1 +
 src/features.h.in               | 24 ++++++++++++++++++++++++
 3 files changed, 45 insertions(+)
 create mode 100644 src/features.h.in

diff --git a/src/CMakeLists.txt b/src/CMakeLists.txt
index ee0b287..9e5f5c7 100644
--- a/src/CMakeLists.txt
+++ b/src/CMakeLists.txt
@@ -16,6 +16,26 @@ if(NOT ${PROJECT_NAME} STREQUAL "CycloneDDS")
   message(FATAL_ERROR "Top-level CMakeLists.txt was moved to the top-level directory.  Please run cmake on ${dir} instead of ${CMAKE_CURRENT_LIST_DIR}")
 endif()
 
+# Generate a header file listing compile-time options relevant to the API.  Define to
+# "1" if enabled so that the generated features.h ends up having either
+#
+# - #define DDS_HAS_SECURITY 1
+# or
+# - /* #undef DDS_HAS_SECURITY */
+#
+# which caters both for those who prefer #ifdef DDS_HAS_SECURITY and for those who prefer
+# #if DDS_HAS_SECURITY.
+if(ENABLE_SECURITY)
+  set(DDS_HAS_SECURITY "1")
+endif()
+if(ENABLE_LIFESPAN)
+  set(DDS_HAS_LIFESPAN "1")
+endif()
+if(ENABLE_DEADLINE_MISSED)
+  set(DDS_HAS_DEADLINE_MISSED "1")
+endif()
+configure_file(features.h.in "${CMAKE_CURRENT_BINARY_DIR}/core/include/dds/features.h")
+
 add_definitions(-DDDSI_INCLUDE_NETWORK_PARTITIONS -DDDSI_INCLUDE_SSM)
 
 # OpenSSL is huge, raising the RSS by 1MB or so, and moreover find_package(OpenSSL) causes
diff --git a/src/core/ddsc/include/dds/dds.h b/src/core/ddsc/include/dds/dds.h
index b50f1d0..aa2f139 100644
--- a/src/core/ddsc/include/dds/dds.h
+++ b/src/core/ddsc/include/dds/dds.h
@@ -25,6 +25,7 @@
 #endif
 
 #include "dds/export.h"
+#include "dds/features.h"
 
 /**
  * Handle to an entity. A valid entity handle will always have a positive
diff --git a/src/features.h.in b/src/features.h.in
new file mode 100644
index 0000000..636f19f
--- /dev/null
+++ b/src/features.h.in
@@ -0,0 +1,24 @@
+/*
+ * Copyright(c) 2020 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+#ifndef _DDS_PUBLIC_FEATURES_H_
+#define _DDS_PUBLIC_FEATURES_H_
+
+/* Whether or not support for DDS Security is included */
+#cmakedefine DDS_HAS_SECURITY @DDS_HAS_SECURITY@
+
+/* Whether or not support for the lifespan QoS is included */
+#cmakedefine DDS_HAS_LIFESPAN @DDS_HAS_LIFESPAN@
+
+/* Whether or not support for generating "deadline missed" events is included */
+#cmakedefine DDS_HAS_DEADLINE_MISSED @DDS_HAS_DEADLINE_MISSED@
+
+#endif

From d82b7fdd73258fc8be53a18e7cd99589bf3baa2e Mon Sep 17 00:00:00 2001
From: Erik Boasson <eb@ilities.com>
Date: Wed, 25 Mar 2020 14:48:35 +0100
Subject: [PATCH 136/238] Return PRECONDITION_NOT_MET if security not supported

As opposed to NOT_ALLOWED_BY_SECURITY.  There is a meaningful
difference between something being disallowed and something being
impossible.

Co-Authored-By: Kyle Fazzari <github@status.e4ward.com>
Signed-off-by: Erik Boasson <eb@ilities.com>
---
 src/core/ddsc/include/dds/dds.h | 16 +++++++++++++++-
 src/core/ddsi/src/q_entity.c    |  2 +-
 2 files changed, 16 insertions(+), 2 deletions(-)

diff --git a/src/core/ddsc/include/dds/dds.h b/src/core/ddsc/include/dds/dds.h
index aa2f139..7e36253 100644
--- a/src/core/ddsc/include/dds/dds.h
+++ b/src/core/ddsc/include/dds/dds.h
@@ -739,8 +739,22 @@ dds_set_listener(dds_entity_t entity, const dds_listener_t * listener);
  *
  * @retval >0
  *             A valid participant handle.
+ * @retval DDS_RETCODE_NOT_ALLOWED_BY_SECURITY
+ *             An invalid DDS Security configuration was specified (whether
+ *             that be missing or incorrect entries, expired certificates,
+ *             or anything else related to the security settings and
+ *             implementation).
+ * @retval DDS_RETCODE_PRECONDITION_NOT_MET
+ *             Some security properties specified in the QoS, but the Cyclone
+ *             build does not include support for DDS Security.
+ * @retval DDS_RETCODE_OUT_OF_RESOURCES
+ *             Some resource limit (maximum participants, memory, handles,
+ *             &c.) prevented creation of the participant.
  * @retval DDS_RETCODE_ERROR
- *             An internal error has occurred.
+ *             The "CYCLONEDDS_URI" environment variable lists non-existent
+ *             or invalid configuration files, or contains invalid embedded
+ *             configuration items; or an unspecified internal error has
+ *             occurred.
  */
 DDS_EXPORT dds_entity_t
 dds_create_participant(
diff --git a/src/core/ddsi/src/q_entity.c b/src/core/ddsi/src/q_entity.c
index 614ad98..242cb28 100644
--- a/src/core/ddsi/src/q_entity.c
+++ b/src/core/ddsi/src/q_entity.c
@@ -966,7 +966,7 @@ dds_return_t new_participant_guid (ddsi_guid_t *ppguid, struct ddsi_domaingv *gv
   {
     /* disallow creating a participant with a security configuration if there is support for security
        has been left out */
-    ret = DDS_RETCODE_NOT_ALLOWED_BY_SECURITY;
+    ret = DDS_RETCODE_PRECONDITION_NOT_MET;
     goto not_allowed;
   }
 #endif

From a77fe10a040c3994c41884d1cfa04d4643627f5e Mon Sep 17 00:00:00 2001
From: Marcel Jordense <marcel.jordense@adlinktech.com>
Date: Tue, 24 Mar 2020 19:15:36 +0100
Subject: [PATCH 137/238] Add index on receiver specific key to improve
 verification of origin authentication signing

Signed-off-by: Marcel Jordense <marcel.jordense@adlinktech.com>
---
 src/core/ddsi/src/ddsi_security_omg.c         |  20 +-
 .../access_control/src/access_control.c       |   1 +
 .../src/access_control_objects.c              |   7 +-
 .../cryptographic/src/crypto_defs.h           |   8 +
 .../cryptographic/src/crypto_key_factory.c    | 452 +++++++++++-------
 .../cryptographic/src/crypto_key_factory.h    |  10 +
 .../cryptographic/src/crypto_objects.c        | 331 ++++++++++---
 .../cryptographic/src/crypto_objects.h        | 117 ++++-
 .../cryptographic/src/crypto_transform.c      |  60 +--
 .../src/decode_datareader_submessage_utests.c |   4 +-
 .../src/decode_datawriter_submessage_utests.c |   4 +-
 .../src/decode_rtps_message_utests.c          |   2 +
 .../src/encode_datareader_submessage_utests.c |   4 +-
 .../src/encode_datawriter_submessage_utests.c |   4 +-
 .../src/encode_rtps_message_utests.c          |  30 +-
 .../src/preprocess_secure_submsg_utests.c     |   2 +
 .../src/register_local_datareader_utests.c    |  24 +-
 .../src/register_local_datawriter_utests.c    |  24 +-
 .../core/tests/secure_communication.c         |   8 +-
 19 files changed, 753 insertions(+), 359 deletions(-)

diff --git a/src/core/ddsi/src/ddsi_security_omg.c b/src/core/ddsi/src/ddsi_security_omg.c
index 2dd78ab..40768d9 100644
--- a/src/core/ddsi/src/ddsi_security_omg.c
+++ b/src/core/ddsi/src/ddsi_security_omg.c
@@ -389,7 +389,16 @@ static void proxypp_pp_match_free(struct dds_security_context *sc, struct proxyp
   if (pm->permissions_handle != DDS_SECURITY_HANDLE_NIL)
   {
     if (!sc->access_control_context->return_permissions_handle(sc->access_control_context, pm->permissions_handle, &exception))
+    {
+      /* FIXME: enable exception warning when access control is updated to return a permission handle for each
+       * matching local and remote participant.
+       */
+#if 0
       EXCEPTION_ERROR(sc, &exception, "Failed to return remote permissions handle");
+#else
+      DDS_Security_Exception_reset(&exception);
+#endif
+    }
   }
   ddsrt_free(pm);
 }
@@ -1011,6 +1020,8 @@ static void cleanup_participant_sec_attributes(void *arg)
   if ((attr = participant_index_remove(sc, info->crypto_handle)) == NULL)
     return;
 
+  GVTRACE("cleanup participant "PGUIDFMT" security attributes\n", PGUID(attr->pp_guid));
+
   pm = ddsrt_avl_cfind_min(&pp_proxypp_treedef, &attr->proxy_participants);
   while (pm)
   {
@@ -1041,7 +1052,8 @@ static void cleanup_participant_sec_attributes(void *arg)
       EXCEPTION_ERROR(sc, &exception, "Failed to return participant security attributes");
   }
 
-  (void)sc->crypto_context->crypto_key_factory->unregister_participant(sc->crypto_context->crypto_key_factory, attr->crypto_handle, NULL);
+  if (!sc->crypto_context->crypto_key_factory->unregister_participant(sc->crypto_context->crypto_key_factory, attr->crypto_handle, &exception))
+    EXCEPTION_ERROR(sc, &exception, "Failed to unregister participant");
 
   ddsrt_avl_cfree(&pp_proxypp_treedef, &attr->proxy_participants, NULL);
   ddsrt_mutex_unlock(&attr->lock);
@@ -1702,7 +1714,7 @@ bool q_omg_security_register_remote_participant(struct participant *pp, struct p
 
   proxypp->sec_attr->crypto_handle = crypto_handle;
 
-  GVTRACE("match pp->crypto=%"PRId64" proxypp->crypto=%"PRId64"\n", pp->sec_attr->crypto_handle, crypto_handle);
+  GVTRACE("match pp->crypto=%"PRId64" proxypp->crypto=%"PRId64" permissions=%"PRId64"\n", pp->sec_attr->crypto_handle, crypto_handle, permissions_handle);
   match_proxypp_pp(pp, proxypp, permissions_handle, shared_secret);
 
   GVTRACE("create proxypp-pp match pp="PGUIDFMT" proxypp="PGUIDFMT" lidh=%"PRId64, PGUID(pp->e.guid), PGUID(proxypp->e.guid), pp->sec_attr->local_identity_handle);
@@ -2031,7 +2043,7 @@ static bool q_omg_security_register_remote_writer_match(struct proxy_writer *pwr
   match = find_or_create_entity_match(gv->security_matches, &pwr->e.guid, &rd->e.guid);
   if (match->matched)
     *crypto_handle = match->crypto_handle;
-  else
+  else if (match->crypto_handle == 0)
   {
     /* Generate writer crypto info. */
     match->crypto_handle = sc->crypto_context->crypto_key_factory->register_matched_remote_datawriter(
@@ -2382,7 +2394,7 @@ static bool q_omg_security_register_remote_reader_match(struct proxy_reader *prd
   match = find_or_create_entity_match(gv->security_matches, &prd->e.guid, &wr->e.guid);
   if (match->matched)
     *crypto_handle = match->crypto_handle;
-  else
+  else if (match->crypto_handle == 0)
   {
     /* Generate writer crypto info. */
     match->crypto_handle = sc->crypto_context->crypto_key_factory->register_matched_remote_datareader(
diff --git a/src/security/builtin_plugins/access_control/src/access_control.c b/src/security/builtin_plugins/access_control/src/access_control.c
index d26b761..1728a9b 100644
--- a/src/security/builtin_plugins/access_control/src/access_control.c
+++ b/src/security/builtin_plugins/access_control/src/access_control.c
@@ -2381,6 +2381,7 @@ check_and_create_remote_participant_rights(
   permissions = ddsrt_malloc(sizeof(remote_permissions));
   permissions->ref_cnt = 0;
   permissions->permissions_tree = NULL;
+  permissions->remote_permissions_token_class_id = NULL;
   if (!ac_parse_permissions_xml(permissions_xml, &(permissions->permissions_tree), ex))
   {
     ddsrt_free(permissions);
diff --git a/src/security/builtin_plugins/access_control/src/access_control_objects.c b/src/security/builtin_plugins/access_control/src/access_control_objects.c
index cee88cb..8988061 100644
--- a/src/security/builtin_plugins/access_control/src/access_control_objects.c
+++ b/src/security/builtin_plugins/access_control/src/access_control_objects.c
@@ -270,9 +270,12 @@ ac_remote_participant_access_rights_new(
   rights->local_rights = (local_participant_access_rights *)ACCESS_CONTROL_OBJECT_KEEP(local_rights);
   if (rights->permissions)
   {
-    rights->permissions->remote_permissions_token_class_id = ddsrt_strdup(remote_permissions_token->class_id);
     rights->permissions->ref_cnt++;
-    rights->identity_subject_name = ddsrt_strdup(identity_subject);
+    if (rights->permissions->remote_permissions_token_class_id == NULL)
+    {
+      rights->permissions->remote_permissions_token_class_id = ddsrt_strdup(remote_permissions_token->class_id);
+      rights->identity_subject_name = ddsrt_strdup(identity_subject);
+    }
   }
   else
   {
diff --git a/src/security/builtin_plugins/cryptographic/src/crypto_defs.h b/src/security/builtin_plugins/cryptographic/src/crypto_defs.h
index 5947f29..0d2a983 100644
--- a/src/security/builtin_plugins/cryptographic/src/crypto_defs.h
+++ b/src/security/builtin_plugins/cryptographic/src/crypto_defs.h
@@ -12,8 +12,10 @@
 #ifndef CRYPTO_DEFS_H
 #define CRYPTO_DEFS_H
 
+#include "dds/security/core/dds_security_types.h"
 #include "dds/security/dds_security_api.h"
 
+
 #define DDS_CRYPTO_PLUGIN_CONTEXT "Cryptographic"
 
 #define CRYPTO_HMAC_SIZE 16
@@ -111,4 +113,10 @@ typedef enum RTPS_Message_Type
   RTPS_Message_Type_SRTPS_POSTFIX = 0x34
 } RTPS_Message_Type;
 
+struct receiver_specific_mac
+{
+  DDS_Security_CryptoTransformKeyId receiver_mac_key_id;
+  crypto_hmac_t receiver_mac;
+};
+
 #endif /* CRYPTO_DEFS_H */
diff --git a/src/security/builtin_plugins/cryptographic/src/crypto_key_factory.c b/src/security/builtin_plugins/cryptographic/src/crypto_key_factory.c
index 61e3f9e..02ba273 100644
--- a/src/security/builtin_plugins/cryptographic/src/crypto_key_factory.c
+++ b/src/security/builtin_plugins/cryptographic/src/crypto_key_factory.c
@@ -238,66 +238,38 @@ attribute_to_data_protection_kind(
   return kind;
 }
 
-static void
-remove_relation_from_keymaterial(
-    const participant_key_material *key_material,
-    CryptoObject *local_crypto,
-    CryptoObject *remote_crypto)
-{
-  endpoint_relation *relation;
-
-  relation = crypto_endpoint_relation_find_by_crypto(key_material->endpoint_relations, local_crypto, remote_crypto);
-  if (relation)
-  {
-    crypto_object_table_remove_object(key_material->endpoint_relations, (CryptoObject *)relation);
-    CRYPTO_OBJECT_RELEASE(relation);
-  }
-}
-
 static void
 remove_remote_writer_relation(
     dds_security_crypto_key_factory_impl *implementation,
-    remote_datawriter_crypto *remote_writer)
+    remote_datawriter_crypto *rmt_wr)
 {
-  remote_participant_crypto *remote_participant;
-  participant_key_material *key_material;
+  remote_participant_crypto *rmt_pp;
 
   DDSRT_UNUSED_ARG(implementation);
 
-  assert(remote_writer);
-  remote_participant = remote_writer->participant;
-  assert(remote_participant);
+  assert(rmt_wr);
+  rmt_pp = rmt_wr->participant;
+  assert(rmt_pp);
 
-  key_material = (participant_key_material *)crypto_object_table_find(
-      remote_participant->key_material, CRYPTO_OBJECT_HANDLE(remote_writer->local_reader->participant));
-  if (key_material)
-  {
-    remove_relation_from_keymaterial(key_material, (CryptoObject *)remote_writer->local_reader, (CryptoObject *)remote_writer);
-    CRYPTO_OBJECT_RELEASE(key_material);
-  }
+  if (rmt_wr->writer2reader_key_material[0])
+    crypto_remove_endpoint_relation(rmt_pp, (CryptoObject *)rmt_wr->local_reader, rmt_wr->writer2reader_key_material[0]->sender_key_id);
 }
 
 static void
 remove_remote_reader_relation(
     dds_security_crypto_key_factory_impl *implementation,
-    remote_datareader_crypto *remote_reader)
+    remote_datareader_crypto *rmt_rd)
 {
-  remote_participant_crypto *remote_participant;
-  participant_key_material *key_material;
+  remote_participant_crypto *rmt_pp;
 
   DDSRT_UNUSED_ARG(implementation);
 
-  assert(remote_reader);
-  remote_participant = remote_reader->participant;
-  assert(remote_participant);
+  assert(rmt_rd);
+  rmt_pp = rmt_rd->participant;
+  assert(rmt_pp);
 
-  key_material = (participant_key_material *)crypto_object_table_find(
-      remote_participant->key_material, CRYPTO_OBJECT_HANDLE(remote_reader->local_writer->participant));
-  if (key_material)
-  {
-    remove_relation_from_keymaterial(key_material, (CryptoObject *)remote_reader->local_writer, (CryptoObject *)remote_reader);
-    CRYPTO_OBJECT_RELEASE(key_material);
-  }
+  if (rmt_rd->reader2writer_key_material)
+    crypto_remove_endpoint_relation(rmt_pp, (CryptoObject *)rmt_rd->local_writer, rmt_rd->reader2writer_key_material->sender_key_id);
 }
 
 /**
@@ -388,8 +360,8 @@ register_matched_remote_participant(
 {
   /* declarations */
   dds_security_crypto_key_factory_impl *implementation = (dds_security_crypto_key_factory_impl *)instance;
-  remote_participant_crypto *participant_crypto;
-  local_participant_crypto *local_participant_crypto_ref;
+  remote_participant_crypto *rmt_pp_crypto;
+  local_participant_crypto *loc_pp_crypto;
   DDS_Security_SecurityException exception;
   participant_key_material *key_material;
 
@@ -414,8 +386,8 @@ register_matched_remote_participant(
 
   /* Check if local_participant_crypto_handle exists in the map */
 
-  local_participant_crypto_ref = (local_participant_crypto *)crypto_object_table_find(implementation->crypto_objects, local_participant_crypto_handle);
-  if (local_participant_crypto_ref == NULL)
+  loc_pp_crypto = (local_participant_crypto *)crypto_object_table_find(implementation->crypto_objects, local_participant_crypto_handle);
+  if (loc_pp_crypto == NULL)
   {
     DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_CODE, 0,
         DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_MESSAGE);
@@ -428,23 +400,22 @@ register_matched_remote_participant(
     crypto_object_table_walk(implementation->crypto_objects, resolve_remote_participant_by_id, &arg);
     if (arg.pprmte)
     {
-      participant_crypto = arg.pprmte;
+      rmt_pp_crypto = arg.pprmte;
     }
     else
     {
-      participant_crypto = crypto_remote_participant_crypto__new(remote_participant_identity);
-      crypto_object_table_insert(implementation->crypto_objects, (CryptoObject *)participant_crypto);
+      rmt_pp_crypto = crypto_remote_participant_crypto__new(remote_participant_identity);
+      crypto_object_table_insert(implementation->crypto_objects, (CryptoObject *)rmt_pp_crypto);
     }
   }
 
-  key_material = (participant_key_material *)crypto_object_table_find(participant_crypto->key_material, local_participant_crypto_ref->_parent.handle);
-
+  key_material = crypto_remote_participant_lookup_keymat(rmt_pp_crypto, PARTICIPANT_CRYPTO_HANDLE(loc_pp_crypto));
   if (!key_material)
   {
-    key_material = crypto_participant_key_material_new(local_participant_crypto_ref);
+    key_material = crypto_participant_key_material_new(loc_pp_crypto, rmt_pp_crypto);
 
     /* set remote participant keymaterial with local keymaterial values */
-    crypto_master_key_material_set(key_material->local_P2P_key_material, local_participant_crypto_ref->key_material);
+    crypto_master_key_material_set(key_material->local_P2P_key_material, loc_pp_crypto->key_material);
 
     if (!calculate_kx_keys(shared_secret, key_material->P2P_kx_key_material, &exception))
       goto fail_calc_key;
@@ -453,8 +424,8 @@ register_matched_remote_participant(
     key_material->P2P_reader_session = crypto_session_key_material_new(key_material->P2P_kx_key_material);
 
     /* if we do not have OriginAuthentication, receiver specific info remains empty/NULL */
-    if ((local_participant_crypto_ref->rtps_protection_kind == DDS_SECURITY_PROTECTION_KIND_ENCRYPT_WITH_ORIGIN_AUTHENTICATION) ||
-        (local_participant_crypto_ref->rtps_protection_kind == DDS_SECURITY_PROTECTION_KIND_SIGN_WITH_ORIGIN_AUTHENTICATION))
+    if ((loc_pp_crypto->rtps_protection_kind == DDS_SECURITY_PROTECTION_KIND_ENCRYPT_WITH_ORIGIN_AUTHENTICATION) ||
+        (loc_pp_crypto->rtps_protection_kind == DDS_SECURITY_PROTECTION_KIND_SIGN_WITH_ORIGIN_AUTHENTICATION))
     {
       if (RAND_bytes(key_material->local_P2P_key_material->master_receiver_specific_key, (int)CRYPTO_KEY_SIZE_BYTES(key_material->local_P2P_key_material->transformation_kind)) < 0)
       {
@@ -464,25 +435,26 @@ register_matched_remote_participant(
       }
       key_material->local_P2P_key_material->receiver_specific_key_id = ddsrt_atomic_inc32_ov(&implementation->next_key_id);
     }
-    participant_crypto->session = (session_key_material *)CRYPTO_OBJECT_KEEP(local_participant_crypto_ref->session);
+    rmt_pp_crypto->session = (session_key_material *)CRYPTO_OBJECT_KEEP(loc_pp_crypto->session);
 
-    crypto_object_table_insert(participant_crypto->key_material, (CryptoObject *)key_material);
+    crypto_local_participant_add_keymat(loc_pp_crypto, key_material);
+    crypto_remote_participant_add_keymat(rmt_pp_crypto, key_material);
   }
 
-  participant_crypto->rtps_protection_kind = local_participant_crypto_ref->rtps_protection_kind; /* Same as local  */
+  rmt_pp_crypto->rtps_protection_kind = loc_pp_crypto->rtps_protection_kind; /* Same as local  */
 
   CRYPTO_OBJECT_RELEASE(key_material);
-  CRYPTO_OBJECT_RELEASE(participant_crypto);
-  CRYPTO_OBJECT_RELEASE(local_participant_crypto_ref);
+  CRYPTO_OBJECT_RELEASE(rmt_pp_crypto);
+  CRYPTO_OBJECT_RELEASE(loc_pp_crypto);
 
-  return PARTICIPANT_CRYPTO_HANDLE(participant_crypto);
+  return PARTICIPANT_CRYPTO_HANDLE(rmt_pp_crypto);
 
 /* error cases*/
 err_random_generation:
 fail_calc_key:
   CRYPTO_OBJECT_RELEASE(key_material);
-  CRYPTO_OBJECT_RELEASE(participant_crypto);
-  CRYPTO_OBJECT_RELEASE(local_participant_crypto_ref);
+  CRYPTO_OBJECT_RELEASE(rmt_pp_crypto);
+  CRYPTO_OBJECT_RELEASE(loc_pp_crypto);
 err_invalid_argument:
   return DDS_SECURITY_HANDLE_NIL;
 }
@@ -502,8 +474,6 @@ register_local_datawriter(
   DDS_Security_ProtectionKind metadata_protection;
   DDS_Security_BasicProtectionKind data_protection;
 
-  memset(ex, 0, sizeof(*ex));
-
   if (participant_crypto_handle == DDS_SECURITY_HANDLE_NIL)
   {
     DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_CODE, 0,
@@ -582,8 +552,6 @@ register_matched_remote_datareader(
   DDS_Security_ProtectionKind metadata_protectionKind;
   DDS_Security_BasicProtectionKind data_protectionKind;
 
-  memset(ex, 0, sizeof(*ex));
-
   DDSRT_UNUSED_ARG(shared_secret);
   DDSRT_UNUSED_ARG(relay_only);
 
@@ -620,9 +588,7 @@ register_matched_remote_datareader(
   /* check if the writer is BuiltinParticipantVolatileMessageSecureWriter */
   if (local_writer->is_builtin_participant_volatile_message_secure_writer)
   {
-    participant_key_material *key_material;
-
-    key_material = (participant_key_material *)crypto_object_table_find(remote_participant->key_material, CRYPTO_OBJECT_HANDLE(local_writer->participant));
+    participant_key_material *key_material = crypto_remote_participant_lookup_keymat(remote_participant, CRYPTO_OBJECT_HANDLE(local_writer->participant));
     assert(key_material);
 
     reader_crypto->reader2writer_key_material = (master_key_material *)CRYPTO_OBJECT_KEEP(key_material->P2P_kx_key_material);
@@ -729,6 +695,11 @@ register_local_datareader(
       reader_crypto->reader_session = crypto_session_key_material_new(reader_crypto->reader_key_material);
     }
   }
+  else
+  {
+    participant_crypto->builtin_reader = reader_crypto;
+
+  }
 
   crypto_object_table_insert(implementation->crypto_objects, (CryptoObject *)reader_crypto);
   CRYPTO_OBJECT_RELEASE(participant_crypto);
@@ -789,10 +760,7 @@ register_matched_remote_datawriter(
   /* check if the writer is BuiltinParticipantVolatileMessageSecureWriter */
   if (local_reader->is_builtin_participant_volatile_message_secure_reader)
   {
-    participant_key_material *key_material;
-    endpoint_relation *relation;
-
-    key_material = (participant_key_material *)crypto_object_table_find(remote_participant->key_material, CRYPTO_OBJECT_HANDLE(local_reader->participant));
+    participant_key_material *key_material = crypto_remote_participant_lookup_keymat(remote_participant, CRYPTO_OBJECT_HANDLE(local_reader->participant));
     assert(key_material);
 
     writer_crypto->reader2writer_key_material = (master_key_material *)CRYPTO_OBJECT_KEEP(key_material->P2P_kx_key_material);
@@ -801,8 +769,9 @@ register_matched_remote_datawriter(
     writer_crypto->reader_session = (session_key_material *)CRYPTO_OBJECT_KEEP(key_material->P2P_reader_session);
     writer_crypto->is_builtin_participant_volatile_message_secure_writer = true;
 
-    relation = crypto_endpoint_relation_new(DDS_SECURITY_DATAWRITER_SUBMESSAGE, 0, (CryptoObject *)local_reader, (CryptoObject *)writer_crypto);
-    crypto_object_table_insert(key_material->endpoint_relations, (CryptoObject *)relation);
+    key_relation * relation = crypto_key_relation_new(DDS_SECURITY_DATAWRITER_SUBMESSAGE, 0, (CryptoObject *)local_reader, (CryptoObject *)writer_crypto, NULL);
+
+    crypto_insert_endpoint_relation(remote_participant, relation);
     CRYPTO_OBJECT_RELEASE(relation);
     CRYPTO_OBJECT_RELEASE(key_material);
   }
@@ -847,29 +816,81 @@ unregister_participant(
     const DDS_Security_ParticipantCryptoHandle participant_crypto_handle,
     DDS_Security_SecurityException *ex)
 {
+  dds_security_crypto_key_factory_impl *implementation = (dds_security_crypto_key_factory_impl *)instance;
   DDS_Security_boolean result = false;
   CryptoObject *obj;
-  dds_security_crypto_key_factory_impl *implementation = (dds_security_crypto_key_factory_impl *)instance;
+  local_participant_crypto *loc_pp_crypto;
+  remote_participant_crypto *rmt_pp_crypto;
+  participant_key_material *keymat;
+  DDS_Security_ParticipantCryptoHandle *handles = NULL;
+  size_t num, i;
 
   if ((obj = crypto_object_table_find(implementation->crypto_objects, participant_crypto_handle)) != NULL)
   {
-    if ((obj->kind == CRYPTO_OBJECT_KIND_LOCAL_CRYPTO) || (obj->kind == CRYPTO_OBJECT_KIND_REMOTE_CRYPTO))
+    switch (obj->kind)
     {
+    case CRYPTO_OBJECT_KIND_LOCAL_CRYPTO:
+    {
+      loc_pp_crypto = (local_participant_crypto *)obj;
+
+      num = crypto_local_participnant_get_matching(loc_pp_crypto, &handles);
+      for (i = 0; i < num; i++)
+      {
+        if ((keymat = crypto_local_participant_remove_keymat(loc_pp_crypto, handles[i])) != NULL)
+          CRYPTO_OBJECT_RELEASE(keymat);
+
+        if ((rmt_pp_crypto = (remote_participant_crypto *)crypto_object_table_find(implementation->crypto_objects, handles[i])) != NULL)
+        {
+          if ((keymat = crypto_remote_participant_remove_keymat(rmt_pp_crypto, participant_crypto_handle)) != NULL)
+          {
+            if (keymat->remote_key_material && keymat->remote_key_material->receiver_specific_key_id != 0)
+              crypto_remove_specific_key_relation(rmt_pp_crypto, keymat->remote_key_material->receiver_specific_key_id);
+            CRYPTO_OBJECT_RELEASE(keymat);
+          }
+          CRYPTO_OBJECT_RELEASE(rmt_pp_crypto);
+        }
+      }
+      ddsrt_free(handles);
       crypto_object_table_remove_object(implementation->crypto_objects, obj);
       result = true;
     }
-    else
+    break;
+    case CRYPTO_OBJECT_KIND_REMOTE_CRYPTO:
     {
-      DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_CODE, 0,
-          DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_MESSAGE);
+      rmt_pp_crypto = (remote_participant_crypto *)obj;
+
+      num = crypto_remote_participnant_get_matching(rmt_pp_crypto, &handles);
+      for (i = 0; i < num; i++)
+      {
+        if ((keymat = crypto_remote_participant_remove_keymat(rmt_pp_crypto, handles[i])) != NULL)
+        {
+          if (keymat->remote_key_material && keymat->remote_key_material->receiver_specific_key_id != 0)
+            crypto_remove_specific_key_relation(rmt_pp_crypto, keymat->remote_key_material->receiver_specific_key_id);
+          CRYPTO_OBJECT_RELEASE(keymat);
+        }
+
+        if ((loc_pp_crypto = (local_participant_crypto *)crypto_object_table_find(implementation->crypto_objects, handles[i])) != NULL)
+        {
+          if ((keymat = crypto_local_participant_remove_keymat(loc_pp_crypto, participant_crypto_handle)) != NULL)
+            CRYPTO_OBJECT_RELEASE(keymat);
+          CRYPTO_OBJECT_RELEASE(loc_pp_crypto);
+        }
+      }
+      ddsrt_free(handles);
+      crypto_object_table_remove_object(implementation->crypto_objects, obj);
+      result = true;
+    }
+    break;
+    default:
+    {
+      DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_CODE, 0, DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_MESSAGE);
+    }
+    break;
     }
     CRYPTO_OBJECT_RELEASE(obj);
   }
   else
-  {
-    DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_CODE, 0,
-        DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_MESSAGE);
-  }
+    DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_CODE, 0, DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_MESSAGE);
 
   return result;
 }
@@ -887,25 +908,30 @@ unregister_datawriter(
   /* check if the handle is applicable*/
   if ((obj = crypto_object_table_find(implementation->crypto_objects, datawriter_crypto_handle)) != NULL)
   {
-    if ((obj->kind == CRYPTO_OBJECT_KIND_LOCAL_WRITER_CRYPTO) || (obj->kind == CRYPTO_OBJECT_KIND_REMOTE_WRITER_CRYPTO))
+    switch (obj->kind)
     {
-      if (obj->kind == CRYPTO_OBJECT_KIND_REMOTE_WRITER_CRYPTO)
-        remove_remote_writer_relation(implementation, (remote_datawriter_crypto *)obj);
+    case CRYPTO_OBJECT_KIND_LOCAL_WRITER_CRYPTO:
+      crypto_object_table_remove_object(implementation->crypto_objects, obj);
+      result = true;
+      break;
+    case CRYPTO_OBJECT_KIND_REMOTE_WRITER_CRYPTO:
+    {
+      remote_datawriter_crypto *rmt_wr = (remote_datawriter_crypto *)obj;
+      remove_remote_writer_relation(implementation, rmt_wr);
+      if (rmt_wr->writer2reader_key_material[0] && rmt_wr->writer2reader_key_material[0]->receiver_specific_key_id != 0)
+        crypto_remove_specific_key_relation(rmt_wr->participant, rmt_wr->writer2reader_key_material[0]->receiver_specific_key_id);
       crypto_object_table_remove_object(implementation->crypto_objects, obj);
       result = true;
     }
-    else
-    {
-      DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_CODE, 0,
-          DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_MESSAGE);
+    break;
+    default:
+      DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_CODE, 0, DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_MESSAGE);
+      break;
     }
     CRYPTO_OBJECT_RELEASE(obj);
   }
   else
-  {
-    DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_CODE, 0,
-        DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_MESSAGE);
-  }
+    DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_CODE, 0, DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_MESSAGE);
 
   return result;
 }
@@ -923,25 +949,30 @@ unregister_datareader(
   /* check if the handle is applicable*/
   if ((obj = crypto_object_table_find(implementation->crypto_objects, datareader_crypto_handle)) != NULL)
   {
-    if ((obj->kind == CRYPTO_OBJECT_KIND_LOCAL_READER_CRYPTO) || (obj->kind == CRYPTO_OBJECT_KIND_REMOTE_READER_CRYPTO))
+    switch (obj->kind)
     {
-      if (obj->kind == CRYPTO_OBJECT_KIND_REMOTE_READER_CRYPTO)
-        remove_remote_reader_relation(implementation, (remote_datareader_crypto *)obj);
+    case CRYPTO_OBJECT_KIND_LOCAL_READER_CRYPTO:
+      crypto_object_table_remove_object(implementation->crypto_objects, obj);
+      result = true;
+      break;
+    case CRYPTO_OBJECT_KIND_REMOTE_READER_CRYPTO:
+    {
+      remote_datareader_crypto *rmt_rd = (remote_datareader_crypto *)obj;
+      remove_remote_reader_relation(implementation, rmt_rd);
+      if (rmt_rd->reader2writer_key_material && rmt_rd->reader2writer_key_material->receiver_specific_key_id != 0)
+        crypto_remove_specific_key_relation(rmt_rd->participant, rmt_rd->reader2writer_key_material->receiver_specific_key_id);
       crypto_object_table_remove_object(implementation->crypto_objects, obj);
       result = true;
     }
-    else
-    {
-      DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_CODE, 0,
-          DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_MESSAGE);
+    break;
+    default:
+      DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_CODE, 0, DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_MESSAGE);
+      break;
     }
     CRYPTO_OBJECT_RELEASE(obj);
   }
   else
-  {
-    DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_CODE, 0,
-        DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_MESSAGE);
-  }
+    DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_CODE, 0, DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_MESSAGE);
 
   return result;
 }
@@ -1040,6 +1071,7 @@ crypto_factory_get_participant_crypto_tokens(
   dds_security_crypto_key_factory_impl *impl = (dds_security_crypto_key_factory_impl *)factory;
   remote_participant_crypto *remote_crypto = (remote_participant_crypto *)crypto_object_table_find(impl->crypto_objects, remote_id);
   bool result = false;
+
   if (!remote_crypto)
   {
     DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_CODE, 0,
@@ -1053,7 +1085,7 @@ crypto_factory_get_participant_crypto_tokens(
     goto err_remote;
   }
 
-  if (!(*pp_key_material = (participant_key_material *)crypto_object_table_find(remote_crypto->key_material, local_id)))
+  if (!(*pp_key_material = (participant_key_material *)crypto_remote_participant_lookup_keymat(remote_crypto, local_id)))
   {
     DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_CODE, 0,
         DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_MESSAGE);
@@ -1096,12 +1128,26 @@ crypto_factory_set_participant_crypto_tokens(
     goto err_inv_remote;
   }
 
-  key_material = (participant_key_material *)crypto_object_table_find(remote_crypto->key_material, local_id);
+  key_material = crypto_remote_participant_lookup_keymat(remote_crypto, local_id);
   if (key_material)
   {
     if (!key_material->remote_key_material)
       key_material->remote_key_material = crypto_master_key_material_new(CRYPTO_TRANSFORMATION_KIND_NONE);
     crypto_token_copy(key_material->remote_key_material, remote_key_mat);
+
+    uint32_t specific_key = key_material->remote_key_material->receiver_specific_key_id;
+    if (specific_key != 0)
+    {
+      key_relation *relation = crypto_find_specific_key_relation(remote_crypto, specific_key);
+      if (!relation)
+      {
+        local_participant_crypto *local_crypto = (local_participant_crypto *)crypto_object_table_find(impl->crypto_objects, local_id);
+        relation = crypto_key_relation_new(0, specific_key, CRYPTO_OBJECT(local_crypto), CRYPTO_OBJECT(remote_crypto), key_material->remote_key_material);
+        crypto_insert_specific_key_relation(remote_crypto, relation);
+        CRYPTO_OBJECT_RELEASE(local_crypto);
+      }
+      CRYPTO_OBJECT_RELEASE(relation);
+    }
     CRYPTO_OBJECT_RELEASE(key_material);
   }
   else
@@ -1189,8 +1235,7 @@ crypto_factory_set_datawriter_crypto_tokens(
   remote_datawriter_crypto *remote_writer_crypto;
   local_datareader_crypto *local_reader_crypto;
   master_key_material *writer_master_key[2] = {NULL, NULL};
-  participant_key_material *keys;
-  endpoint_relation *relation;
+  key_relation *relation;
   uint32_t key_id, i;
 
   assert (num_key_mat > 0);
@@ -1246,16 +1291,24 @@ crypto_factory_set_datawriter_crypto_tokens(
   else
     remote_writer_crypto->writer2reader_key_material[1] = (master_key_material *)CRYPTO_OBJECT_KEEP(writer_master_key[0]);
 
-  keys = (participant_key_material *)crypto_object_table_find(
-      remote_writer_crypto->participant->key_material, CRYPTO_OBJECT_HANDLE(local_reader_crypto->participant));
-  assert(keys);
-
   key_id = remote_writer_crypto->writer2reader_key_material[0]->sender_key_id;
 
-  relation = crypto_endpoint_relation_new(DDS_SECURITY_DATAWRITER_SUBMESSAGE, key_id, (CryptoObject *)local_reader_crypto, (CryptoObject *)remote_writer_crypto);
-  crypto_object_table_insert(keys->endpoint_relations, (CryptoObject *)relation);
+  relation = crypto_key_relation_new(DDS_SECURITY_DATAWRITER_SUBMESSAGE, key_id, (CryptoObject *)local_reader_crypto, (CryptoObject *)remote_writer_crypto, NULL);
+  crypto_insert_endpoint_relation(remote_writer_crypto->participant, relation);
   CRYPTO_OBJECT_RELEASE(relation);
-  CRYPTO_OBJECT_RELEASE(keys);
+
+  uint32_t specific_key = remote_writer_crypto->writer2reader_key_material[0]->receiver_specific_key_id;
+  if (specific_key != 0)
+  {
+    relation = crypto_find_specific_key_relation(remote_writer_crypto->participant, specific_key);
+    if (!relation)
+    {
+      relation = crypto_key_relation_new(0, specific_key, CRYPTO_OBJECT(local_reader_crypto), CRYPTO_OBJECT(remote_writer_crypto), remote_writer_crypto->writer2reader_key_material[0]);
+      crypto_insert_specific_key_relation(remote_writer_crypto->participant, relation);
+    }
+    CRYPTO_OBJECT_RELEASE(relation);
+  }
+
   result = true;
 
 err_inv_local:
@@ -1328,8 +1381,7 @@ crypto_factory_set_datareader_crypto_tokens(
   bool result = false;
   remote_datareader_crypto *remote_reader_crypto;
   local_datawriter_crypto *local_writer_crypto;
-  participant_key_material *keys;
-  endpoint_relation *relation;
+  key_relation *relation;
   uint32_t key_id;
 
   remote_reader_crypto = (remote_datareader_crypto *)crypto_object_table_find(impl->crypto_objects, remote_reader_handle);
@@ -1373,23 +1425,30 @@ crypto_factory_set_datareader_crypto_tokens(
   remote_reader_crypto->reader2writer_key_material = crypto_master_key_material_new(CRYPTO_TRANSFORMATION_KIND_NONE);
   crypto_token_copy(remote_reader_crypto->reader2writer_key_material, key_mat);
 
-  keys = (participant_key_material *)crypto_object_table_find(
-      remote_reader_crypto->participant->key_material, CRYPTO_OBJECT_HANDLE(local_writer_crypto->participant));
-  assert(keys);
-
   key_id = remote_reader_crypto->reader2writer_key_material->sender_key_id;
 
-  relation = crypto_endpoint_relation_new(DDS_SECURITY_DATAREADER_SUBMESSAGE, key_id, (CryptoObject *)local_writer_crypto, (CryptoObject *)remote_reader_crypto);
-  crypto_object_table_insert(keys->endpoint_relations, (CryptoObject *)relation);
+  relation = crypto_key_relation_new(DDS_SECURITY_DATAREADER_SUBMESSAGE, key_id, (CryptoObject *)local_writer_crypto, (CryptoObject *)remote_reader_crypto, NULL);
+  crypto_insert_endpoint_relation(remote_reader_crypto->participant, relation);
   CRYPTO_OBJECT_RELEASE(relation);
-  CRYPTO_OBJECT_RELEASE(keys);
+
+  uint32_t specific_key = remote_reader_crypto->reader2writer_key_material->receiver_specific_key_id;
+  if (specific_key != 0)
+  {
+    relation = crypto_find_specific_key_relation(remote_reader_crypto->participant, specific_key);
+    if (!relation)
+    {
+      relation = crypto_key_relation_new(0, specific_key, CRYPTO_OBJECT(local_writer_crypto), CRYPTO_OBJECT(remote_reader_crypto), remote_reader_crypto->reader2writer_key_material);
+      crypto_insert_specific_key_relation(remote_reader_crypto->participant, relation);
+    }
+    CRYPTO_OBJECT_RELEASE(relation);
+  }
+
   result = true;
 
 err_inv_local:
   CRYPTO_OBJECT_RELEASE(local_writer_crypto);
 err_inv_remote:
   CRYPTO_OBJECT_RELEASE(remote_reader_crypto);
-
   return result;
 }
 
@@ -1494,7 +1553,7 @@ crypto_factory_get_local_participant_data_key_material(
   result = true;
 
 err_inv_crypto:
-  CRYPTO_OBJECT_RELEASE(CRYPTO_OBJECT(participant_crypto));
+  CRYPTO_OBJECT_RELEASE(participant_crypto);
 err_no_crypto:
   return result;
 }
@@ -1587,9 +1646,7 @@ crypto_factory_get_reader_key_material(
     result = true;
   }
   else
-  {
     result = get_local_volatile_sec_reader_key_material(impl, writer_id, session_key, protection_kind, ex);
-  }
 
 err_inv_crypto:
   CRYPTO_OBJECT_RELEASE(reader_crypto);
@@ -1656,6 +1713,7 @@ crypto_factory_get_remote_writer_key_material(
 err_inv_crypto:
   CRYPTO_OBJECT_RELEASE(writer_crypto);
 err_no_crypto:
+
   return result;
 }
 
@@ -1805,25 +1863,6 @@ err_no_crypto:
   return result;
 }
 
-struct collect_remote_participant_keys_args
-{
-  uint32_t key_id;
-  endpoint_relation *relation;
-};
-
-/* Currently only collecting the first only */
-static int
-collect_remote_participant_keys(
-    CryptoObject *obj,
-    void *arg)
-{
-  participant_key_material *keys = (participant_key_material *)obj;
-  struct collect_remote_participant_keys_args *info = arg;
-
-  info->relation = crypto_endpoint_relation_find_by_key(keys->endpoint_relations, info->key_id);
-  return (info->relation) ? 0 : 1;
-}
-
 bool
 crypto_factory_get_endpoint_relation(
     const dds_security_crypto_key_factory *factory,
@@ -1837,20 +1876,20 @@ crypto_factory_get_endpoint_relation(
 {
   bool result = false;
   dds_security_crypto_key_factory_impl *impl = (dds_security_crypto_key_factory_impl *)factory;
-  remote_participant_crypto *remote_pp_crypto;
-  local_participant_crypto *local_pp_crypto = NULL;
-  participant_key_material *keys = NULL;
-  endpoint_relation *relation = NULL;
+  remote_participant_crypto *rmt_pp;
+  local_participant_crypto *loc_pp = NULL;
+  local_datareader_crypto *loc_rd = NULL;
+  key_relation *relation = NULL;
 
-  remote_pp_crypto = (remote_participant_crypto *)crypto_object_table_find(impl->crypto_objects, remote_participant_handle);
-  if (!remote_pp_crypto)
+  rmt_pp = (remote_participant_crypto *)crypto_object_table_find(impl->crypto_objects, remote_participant_handle);
+  if (!rmt_pp)
   {
     DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT,
                                DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_CODE, 0,
                                DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_MESSAGE);
     goto invalid_handle;
   }
-  else if (!CRYPTO_OBJECT_VALID(remote_pp_crypto, CRYPTO_OBJECT_KIND_REMOTE_CRYPTO))
+  else if (!CRYPTO_OBJECT_VALID(rmt_pp, CRYPTO_OBJECT_KIND_REMOTE_CRYPTO))
   {
     DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT,
                                DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_CODE, 0,
@@ -1858,40 +1897,27 @@ crypto_factory_get_endpoint_relation(
     goto invalid_handle;
   }
 
-  if (local_participant_handle != DDS_SECURITY_HANDLE_NIL)
+  if (key_id == 0 && local_participant_handle != DDS_SECURITY_HANDLE_NIL)
   {
-    local_pp_crypto = (local_participant_crypto *)crypto_object_table_find(impl->crypto_objects, local_participant_handle);
-    if (!local_pp_crypto)
+    loc_pp = (local_participant_crypto *)crypto_object_table_find(impl->crypto_objects, local_participant_handle);
+    if (!loc_pp)
     {
       DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT,
-                                 DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_CODE, 0,
-                                 DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_MESSAGE);
+          DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_CODE, 0,
+          DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_MESSAGE);
       goto invalid_handle;
     }
-    else if (!CRYPTO_OBJECT_VALID(local_pp_crypto, CRYPTO_OBJECT_KIND_LOCAL_CRYPTO))
+    else if (!CRYPTO_OBJECT_VALID(loc_pp, CRYPTO_OBJECT_KIND_LOCAL_CRYPTO))
     {
       DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT,
-                                 DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_CODE, 0,
-                                 DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_MESSAGE);
+          DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_CODE, 0,
+          DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_MESSAGE);
       goto invalid_handle;
     }
-    keys = (participant_key_material *)crypto_object_table_find(remote_pp_crypto->key_material, local_participant_handle);
-  }
-
-  if (keys)
-  {
-    relation = crypto_endpoint_relation_find_by_key(keys->endpoint_relations, key_id);
-    CRYPTO_OBJECT_RELEASE(keys);
-  }
-  else
-  {
-    struct collect_remote_participant_keys_args args = {key_id, NULL};
-    /* FIXME: Returning arbitrary local-remote relation will not work in Cyclone,
-     * because participants can have different security settings */
-    crypto_object_table_walk(remote_pp_crypto->key_material, collect_remote_participant_keys, &args);
-    relation = args.relation;
+    loc_rd = loc_pp->builtin_reader;
   }
 
+  relation = crypto_find_endpoint_relation(rmt_pp, CRYPTO_OBJECT(loc_rd), key_id);
   if (!relation)
   {
     DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT,
@@ -1900,6 +1926,8 @@ crypto_factory_get_endpoint_relation(
     goto invalid_handle;
   }
 
+  assert(key_id == relation->key_id);
+
   *category = relation->kind;
   *remote_handle = CRYPTO_OBJECT_HANDLE(relation->remote_crypto);
   *local_handle = CRYPTO_OBJECT_HANDLE(relation->local_crypto);
@@ -1907,8 +1935,66 @@ crypto_factory_get_endpoint_relation(
 
 invalid_handle:
   CRYPTO_OBJECT_RELEASE(relation);
-  CRYPTO_OBJECT_RELEASE(local_pp_crypto);
-  CRYPTO_OBJECT_RELEASE(remote_pp_crypto);
-
+  CRYPTO_OBJECT_RELEASE(loc_pp);
+  CRYPTO_OBJECT_RELEASE(rmt_pp);
+  return result;
+}
+
+bool
+crypto_factory_get_specific_keymat(
+    const dds_security_crypto_key_factory *factory,
+    CryptoObjectKind_t kind,
+    DDS_Security_Handle rmt_handle,
+    const struct receiver_specific_mac * const mac_list,
+    uint32_t num_mac,
+    uint32_t *index,
+    master_key_material **key_mat)
+{
+  dds_security_crypto_key_factory_impl *impl = (dds_security_crypto_key_factory_impl *)factory;
+  CryptoObject *obj;
+  remote_participant_crypto *rmt_pp = NULL;
+  remote_datawriter_crypto *rmt_wr = NULL;
+  remote_datareader_crypto *rmt_rd = NULL;
+  key_relation *relation = NULL;
+  bool result = false;
+
+  obj = crypto_object_table_find(impl->crypto_objects, rmt_handle);
+  if (!obj)
+    return false;
+
+  switch (kind)
+  {
+  case CRYPTO_OBJECT_KIND_REMOTE_CRYPTO:
+    rmt_pp = (remote_participant_crypto *)obj;
+    break;
+  case CRYPTO_OBJECT_KIND_REMOTE_WRITER_CRYPTO:
+    rmt_wr = (remote_datawriter_crypto *)obj;
+    rmt_pp = rmt_wr->participant;
+    break;
+  case CRYPTO_OBJECT_KIND_REMOTE_READER_CRYPTO:
+    rmt_rd = (remote_datareader_crypto *)obj;
+    rmt_pp = rmt_rd->participant;
+    break;
+  default:
+    goto invalid_handle;
+    break;
+  }
+
+  for (uint32_t i = 0; i < num_mac; i++)
+  {
+    uint32_t key_id = CRYPTO_TRANSFORM_ID(mac_list[i].receiver_mac_key_id);
+    relation = crypto_find_specific_key_relation(rmt_pp, key_id);
+    if (relation)
+    {
+      *index = i;
+      *key_mat = CRYPTO_OBJECT_KEEP(relation->key_material);
+      result = true;
+      break;
+    }
+  }
+
+invalid_handle:
+  CRYPTO_OBJECT_RELEASE(relation);
+  CRYPTO_OBJECT_RELEASE(obj);
   return result;
 }
diff --git a/src/security/builtin_plugins/cryptographic/src/crypto_key_factory.h b/src/security/builtin_plugins/cryptographic/src/crypto_key_factory.h
index 2fec8d7..3e49766 100644
--- a/src/security/builtin_plugins/cryptographic/src/crypto_key_factory.h
+++ b/src/security/builtin_plugins/cryptographic/src/crypto_key_factory.h
@@ -148,4 +148,14 @@ bool crypto_factory_get_endpoint_relation(
     DDS_Security_SecureSubmessageCategory_t *category,
     DDS_Security_SecurityException *ex);
 
+bool
+crypto_factory_get_specific_keymat(
+    const dds_security_crypto_key_factory *factory,
+    CryptoObjectKind_t kind,
+    DDS_Security_Handle rmt_handle,
+    const struct receiver_specific_mac * const mac_list,
+    uint32_t num_mac,
+    uint32_t *index,
+    master_key_material **key_mat);
+
 #endif /* CRYPTO_KEY_FACTORY_H */
diff --git a/src/security/builtin_plugins/cryptographic/src/crypto_objects.c b/src/security/builtin_plugins/cryptographic/src/crypto_objects.c
index 86b1ea0..075744e 100644
--- a/src/security/builtin_plugins/cryptographic/src/crypto_objects.c
+++ b/src/security/builtin_plugins/cryptographic/src/crypto_objects.c
@@ -18,6 +18,64 @@
 #include "crypto_objects.h"
 #include "crypto_utils.h"
 
+static int compare_participant_handle(const void *va, const void *vb);
+static int compare_endpoint_relation (const void *va, const void *vb);
+static int compare_relation_key (const void *va, const void *vb);
+static void key_relation_free(CryptoObject *obj);
+
+const ddsrt_avl_ctreedef_t loc_pp_keymat_treedef =
+  DDSRT_AVL_CTREEDEF_INITIALIZER (offsetof (struct participant_key_material, loc_avlnode), offsetof (struct participant_key_material, rmt_pp_handle), compare_participant_handle, 0);
+
+const ddsrt_avl_ctreedef_t rmt_pp_keymat_treedef =
+  DDSRT_AVL_CTREEDEF_INITIALIZER (offsetof (struct participant_key_material, rmt_avlnode), offsetof (struct participant_key_material, loc_pp_handle), compare_participant_handle, 0);
+
+const ddsrt_avl_treedef_t endpoint_relation_treedef =
+  DDSRT_AVL_TREEDEF_INITIALIZER (offsetof (struct key_relation, avlnode), 0, compare_endpoint_relation, 0);
+
+const ddsrt_avl_treedef_t specific_key_treedef =
+  DDSRT_AVL_TREEDEF_INITIALIZER (offsetof (struct key_relation, avlnode), offsetof (struct key_relation, key_id), compare_relation_key, 0);
+
+
+static int compare_participant_handle(const void *va, const void *vb)
+{
+  const DDS_Security_ParticipantCryptoHandle *ha = va;
+  const DDS_Security_ParticipantCryptoHandle *hb = vb;
+
+  if (*ha > *hb)
+    return 1;
+  else if (*ha < *hb)
+    return -1;
+  return 0;
+}
+
+static int compare_endpoint_relation (const void *va, const void *vb)
+{
+  const key_relation *ra = va;
+  const key_relation *rb = vb;
+  int r;
+
+  r = (int)(ra->key_id - rb->key_id);
+  if (r != 0 || ra->local_crypto == 0 || rb->local_crypto == 0)
+  {
+    return r;
+  }
+
+  if (ra->local_crypto > rb->local_crypto)
+    return 1;
+  else if (ra->local_crypto < rb->local_crypto)
+    return -1;
+  else
+    return 0;
+}
+
+static int compare_relation_key (const void *va, const void *vb)
+{
+  const uint32_t *ka = va;
+  const uint32_t *kb = vb;
+
+  return (int)(*ka - *kb);
+}
+
 bool crypto_object_valid(CryptoObject *obj, CryptoObjectKind_t kind)
 {
   return (obj && obj->kind == kind && obj->handle == (int64_t)(uintptr_t)obj);
@@ -57,16 +115,15 @@ static void crypto_object_deinit(CryptoObject *obj)
 
 void crypto_object_free(CryptoObject *obj)
 {
+
   if (obj && obj->destructor)
     obj->destructor(obj);
 }
 
-CryptoObject * crypto_object_keep(CryptoObject *obj)
+void * crypto_object_keep(CryptoObject *obj)
 {
   if (obj)
-  {
     ddsrt_atomic_inc32(&obj->refcount);
-  }
   return obj;
 }
 
@@ -76,26 +133,6 @@ void crypto_object_release(CryptoObject *obj)
     crypto_object_free(obj);
 }
 
-static uint32_t participant_key_material_hash(const void *obj)
-{
-  const participant_key_material *object = obj;
-  return (uint32_t)object->pp_local_handle;
-}
-
-static int participant_key_material_equal(const void *ha, const void *hb)
-{
-  const participant_key_material *la = ha;
-  const participant_key_material *lb = hb;
-  return la->pp_local_handle == lb->pp_local_handle;
-}
-
-static CryptoObject * participant_key_material_find(const struct CryptoObjectTable *table, const void *arg)
-{
-  struct participant_key_material template;
-  template.pp_local_handle = *(int64_t *)arg;
-  return crypto_object_table_find_by_template(table, &template);
-}
-
 CryptoObject * crypto_object_table_find_by_template(const struct CryptoObjectTable *table, const void *template)
 {
   return (CryptoObject *)ddsrt_hh_lookup(table->htab, template);
@@ -301,7 +338,7 @@ session_key_material * crypto_session_key_material_new(master_key_material *mast
   session->init_vector_suffix = crypto_get_random_uint64();
   session->max_blocks_per_session = INT64_MAX; /* FIXME: should be a config parameter */
   session->block_counter = session->max_blocks_per_session;
-  session->master_key_material = (master_key_material *)CRYPTO_OBJECT_KEEP(master_key);
+  session->master_key_material = CRYPTO_OBJECT_KEEP(master_key);
 
   return session;
 }
@@ -321,7 +358,9 @@ static void local_participant_crypto__free(CryptoObject *obj)
     CHECK_CRYPTO_OBJECT_KIND (obj, CRYPTO_OBJECT_KIND_LOCAL_CRYPTO);
     CRYPTO_OBJECT_RELEASE (participant_crypto->session);
     CRYPTO_OBJECT_RELEASE (participant_crypto->key_material);
+    ddsrt_avl_cfree(&loc_pp_keymat_treedef, &participant_crypto->key_material_table, 0);
     crypto_object_deinit ((CryptoObject *)participant_crypto);
+    ddsrt_mutex_init(&participant_crypto->lock);
     ddsrt_free (participant_crypto);
   }
 }
@@ -333,6 +372,9 @@ local_participant_crypto * crypto_local_participant_crypto__new(DDS_Security_Ide
   local_participant_crypto *participant_crypto = ddsrt_calloc (1, sizeof(*participant_crypto));
   participant_crypto->identity_handle = participant_identity;
   crypto_object_init ((CryptoObject *)participant_crypto, CRYPTO_OBJECT_KIND_LOCAL_CRYPTO, local_participant_crypto__free);
+  ddsrt_mutex_init(&participant_crypto->lock);
+  ddsrt_avl_cinit(&loc_pp_keymat_treedef, &participant_crypto->key_material_table);
+
   return participant_crypto;
 }
 
@@ -344,8 +386,11 @@ static void remote_participant_crypto__free(CryptoObject *obj)
   if (participant_crypto)
   {
     CRYPTO_OBJECT_RELEASE (participant_crypto->session);
-    crypto_object_table_free (participant_crypto->key_material);
+    ddsrt_avl_cfree(&rmt_pp_keymat_treedef, &participant_crypto->key_material_table, 0);
     crypto_object_deinit ((CryptoObject *)participant_crypto);
+    ddsrt_avl_free(&endpoint_relation_treedef, &participant_crypto->relation_index, 0);
+    ddsrt_avl_free(&specific_key_treedef, &participant_crypto->specific_key_index, 0);
+    ddsrt_mutex_destroy(&participant_crypto->lock);
     ddsrt_free(participant_crypto);
   }
 }
@@ -356,7 +401,10 @@ remote_participant_crypto * crypto_remote_participant_crypto__new(DDS_Security_I
   remote_participant_crypto *participant_crypto = ddsrt_calloc (1, sizeof(*participant_crypto));
   crypto_object_init ((CryptoObject *)participant_crypto, CRYPTO_OBJECT_KIND_REMOTE_CRYPTO, remote_participant_crypto__free);
   participant_crypto->identity_handle = participant_identity;
-  participant_crypto->key_material = crypto_object_table_new (participant_key_material_hash, participant_key_material_equal, participant_key_material_find);
+  ddsrt_avl_cinit(&rmt_pp_keymat_treedef, &participant_crypto->key_material_table);
+  ddsrt_mutex_init(&participant_crypto->lock);
+  ddsrt_avl_init(&endpoint_relation_treedef, &participant_crypto->relation_index);
+  ddsrt_avl_init(&specific_key_treedef, &participant_crypto->specific_key_index);
 
   return participant_crypto;
 }
@@ -373,29 +421,129 @@ static void participant_key_material_free(CryptoObject *obj)
     CRYPTO_OBJECT_RELEASE(keymaterial->P2P_kx_key_material);
     CRYPTO_OBJECT_RELEASE(keymaterial->local_P2P_key_material);
     CRYPTO_OBJECT_RELEASE(keymaterial->remote_key_material);
-    crypto_object_table_free(keymaterial->endpoint_relations);
     crypto_object_deinit((CryptoObject *)keymaterial);
     ddsrt_free(keymaterial);
   }
 }
 
-participant_key_material * crypto_participant_key_material_new(const local_participant_crypto *pplocal)
+participant_key_material * crypto_participant_key_material_new(const local_participant_crypto *loc_pp_crypto, const remote_participant_crypto *rmt_pp_crypto)
 {
   participant_key_material *keymaterial = ddsrt_calloc(1, sizeof(*keymaterial));
   crypto_object_init((CryptoObject *)keymaterial, CRYPTO_OBJECT_KIND_PARTICIPANT_KEY_MATERIAL, participant_key_material_free);
-  keymaterial->pp_local_handle = pplocal->_parent.handle;
-  keymaterial->endpoint_relations = crypto_object_table_new(NULL, NULL, NULL);
+  keymaterial->loc_pp_handle = PARTICIPANT_CRYPTO_HANDLE(loc_pp_crypto);
+  keymaterial->rmt_pp_handle = PARTICIPANT_CRYPTO_HANDLE(rmt_pp_crypto);
   keymaterial->local_P2P_key_material = crypto_master_key_material_new(CRYPTO_TRANSFORMATION_KIND_NONE);
   keymaterial->P2P_kx_key_material = crypto_master_key_material_new(CRYPTO_TRANSFORMATION_KIND_AES256_GCM); /* as defined in table 67 of the DDS Security spec v1.1 */
 
   return keymaterial;
 }
 
-static void endpoint_relation_free(CryptoObject *obj)
+void crypto_local_participant_add_keymat(local_participant_crypto *loc_pp_crypto, participant_key_material *keymat)
 {
-  endpoint_relation *relation = (endpoint_relation *)obj;
+  ddsrt_mutex_lock(&loc_pp_crypto->lock);
+  ddsrt_avl_cinsert(&loc_pp_keymat_treedef, &loc_pp_crypto->key_material_table, CRYPTO_OBJECT_KEEP(keymat));
+  ddsrt_mutex_unlock(&loc_pp_crypto->lock);
+}
+
+participant_key_material * crypto_local_participant_remove_keymat(local_participant_crypto *loc_pp_crypto, DDS_Security_ParticipantCryptoHandle rmt_pp_handle)
+{
+  participant_key_material *keymat;
+  ddsrt_avl_dpath_t dpath;
+
+  ddsrt_mutex_lock(&loc_pp_crypto->lock);
+  keymat = ddsrt_avl_clookup_dpath(&loc_pp_keymat_treedef, &loc_pp_crypto->key_material_table, &rmt_pp_handle, &dpath);
+  if (keymat)
+    ddsrt_avl_cdelete_dpath(&loc_pp_keymat_treedef, &loc_pp_crypto->key_material_table, keymat, &dpath);
+  ddsrt_mutex_unlock(&loc_pp_crypto->lock);
+
+  return keymat;
+}
+
+participant_key_material * crypto_local_participant_lookup_keymat(local_participant_crypto *loc_pp_crypto, DDS_Security_ParticipantCryptoHandle rmt_pp_handle)
+{
+  participant_key_material *keymat;
+
+  ddsrt_mutex_lock(&loc_pp_crypto->lock);
+  keymat = CRYPTO_OBJECT_KEEP(ddsrt_avl_clookup(&loc_pp_keymat_treedef, &loc_pp_crypto->key_material_table, &rmt_pp_handle));
+  ddsrt_mutex_unlock(&loc_pp_crypto->lock);
+
+  return keymat;
+}
+
+void crypto_remote_participant_add_keymat(remote_participant_crypto *rmt_pp_crypto, participant_key_material *keymat)
+{
+  ddsrt_mutex_lock(&rmt_pp_crypto->lock);
+  ddsrt_avl_cinsert(&rmt_pp_keymat_treedef, &rmt_pp_crypto->key_material_table, CRYPTO_OBJECT_KEEP(keymat));
+  ddsrt_mutex_unlock(&rmt_pp_crypto->lock);
+}
+
+participant_key_material * crypto_remote_participant_remove_keymat(remote_participant_crypto *rmt_pp_crypto, DDS_Security_ParticipantCryptoHandle loc_pp_handle)
+{
+  participant_key_material *keymat;
+  ddsrt_avl_dpath_t dpath;
+
+  ddsrt_mutex_lock(&rmt_pp_crypto->lock);
+  keymat = ddsrt_avl_clookup_dpath(&rmt_pp_keymat_treedef, &rmt_pp_crypto->key_material_table, &loc_pp_handle, &dpath);
+  if (keymat)
+    ddsrt_avl_cdelete_dpath(&rmt_pp_keymat_treedef, &rmt_pp_crypto->key_material_table, keymat, &dpath);
+  ddsrt_mutex_unlock(&rmt_pp_crypto->lock);
+
+  return keymat;
+}
+
+participant_key_material * crypto_remote_participant_lookup_keymat(remote_participant_crypto *rmt_pp_crypto, DDS_Security_ParticipantCryptoHandle loc_pp_handle)
+{
+  participant_key_material *keymat;
+
+  ddsrt_mutex_lock(&rmt_pp_crypto->lock);
+  keymat = CRYPTO_OBJECT_KEEP(ddsrt_avl_clookup(&rmt_pp_keymat_treedef, &rmt_pp_crypto->key_material_table, &loc_pp_handle));
+  ddsrt_mutex_unlock(&rmt_pp_crypto->lock);
+
+  return keymat;
+}
+
+size_t crypto_local_participnant_get_matching(local_participant_crypto *loc_pp_crypto, DDS_Security_ParticipantCryptoHandle **handles)
+{
+  participant_key_material *keymat;
+  ddsrt_avl_citer_t it;
+  size_t num, i;
+
+  ddsrt_mutex_lock(&loc_pp_crypto->lock);
+  num = ddsrt_avl_ccount(&loc_pp_crypto->key_material_table);
+  if (num > 0)
+  {
+    *handles = ddsrt_malloc(num * sizeof(DDS_Security_ParticipantCryptoHandle));
+    for (i = 0, keymat = ddsrt_avl_citer_first(&loc_pp_keymat_treedef, &loc_pp_crypto->key_material_table, &it); i < num && keymat; i++, keymat = ddsrt_avl_citer_next(&it))
+      (*handles)[i] = keymat->rmt_pp_handle;
+  }
+  ddsrt_mutex_unlock(&loc_pp_crypto->lock);
+  return num;
+}
+
+size_t crypto_remote_participnant_get_matching(remote_participant_crypto *rmt_pp_crypto, DDS_Security_ParticipantCryptoHandle **handles)
+{
+  participant_key_material *keymat;
+  ddsrt_avl_citer_t it;
+  size_t num, i;
+
+  ddsrt_mutex_lock(&rmt_pp_crypto->lock);
+  num = ddsrt_avl_ccount(&rmt_pp_crypto->key_material_table);
+  if (num > 0)
+  {
+    *handles = ddsrt_malloc(num * sizeof(DDS_Security_ParticipantCryptoHandle));
+    for (i = 0, keymat = ddsrt_avl_citer_first(&rmt_pp_keymat_treedef, &rmt_pp_crypto->key_material_table, &it); i < num && keymat; i++, keymat = ddsrt_avl_citer_next(&it))
+      (*handles)[i] = keymat->loc_pp_handle;
+  }
+  ddsrt_mutex_unlock(&rmt_pp_crypto->lock);
+  return num;
+}
+
+static void key_relation_free(CryptoObject *obj)
+{
+  key_relation *relation = (key_relation *)obj;
   if (relation)
   {
+    CRYPTO_OBJECT_RELEASE(relation->key_material);
     CRYPTO_OBJECT_RELEASE(relation->local_crypto);
     CRYPTO_OBJECT_RELEASE(relation->remote_crypto);
     crypto_object_deinit((CryptoObject *)relation);
@@ -403,16 +551,17 @@ static void endpoint_relation_free(CryptoObject *obj)
   }
 }
 
-endpoint_relation * crypto_endpoint_relation_new(DDS_Security_SecureSubmessageCategory_t kind,
-    uint32_t key_id, CryptoObject *local_crypto, CryptoObject *remote_crypto)
+key_relation * crypto_key_relation_new(DDS_Security_SecureSubmessageCategory_t kind,
+    uint32_t key_id, CryptoObject *local_crypto, CryptoObject *remote_crypto, master_key_material *keymat)
 {
-  endpoint_relation *relation = ddsrt_malloc(sizeof(*relation));
-  crypto_object_init((CryptoObject *)relation, CRYPTO_OBJECT_KIND_ENDPOINT_RELATION, endpoint_relation_free);
+  key_relation *relation = ddsrt_malloc(sizeof(*relation));
+  crypto_object_init((CryptoObject *)relation, CRYPTO_OBJECT_KIND_RELATION, key_relation_free);
 
   relation->kind = kind;
   relation->key_id = key_id;
   relation->local_crypto = CRYPTO_OBJECT_KEEP(local_crypto);
   relation->remote_crypto = CRYPTO_OBJECT_KEEP(remote_crypto);
+  relation->key_material = (master_key_material *)CRYPTO_OBJECT_KEEP(keymat);
 
   return relation;
 }
@@ -539,60 +688,90 @@ remote_datareader_crypto *crypto_remote_datareader_crypto__new(const remote_part
   return reader_crypto;
 }
 
-
-typedef struct endpoint_relation_find_arg
+void crypto_insert_endpoint_relation(
+    remote_participant_crypto *rpc,
+    key_relation *relation)
 {
-  CryptoObject *found;
-  CryptoObject *local_crypto;
-  CryptoObject *remote_crypto;
-  uint32_t key_id;
-} endpoint_relation_find_arg;
+  ddsrt_mutex_lock(&rpc->lock);
+  ddsrt_avl_insert(&endpoint_relation_treedef, &rpc->relation_index, CRYPTO_OBJECT_KEEP(relation));
+  ddsrt_mutex_unlock(&rpc->lock);
+}
 
-static int endpoint_relation_cmp_key(CryptoObject *obj, void *arg)
+void crypto_remove_endpoint_relation(
+    remote_participant_crypto *rpc,
+    CryptoObject *lch,
+    uint32_t key_id)
 {
-  const endpoint_relation *rel = (const endpoint_relation *)obj;
-  endpoint_relation_find_arg *find_arg = (endpoint_relation_find_arg *)arg;
+  key_relation template;
+  key_relation *relation;
+  ddsrt_avl_dpath_t dpath;
 
-  if (rel->key_id == find_arg->key_id)
+  template.key_id = key_id;
+  template.local_crypto = lch;
+
+  ddsrt_mutex_lock(&rpc->lock);
+  relation =  ddsrt_avl_lookup_dpath(&endpoint_relation_treedef, &rpc->relation_index, &template, &dpath);
+  if (relation)
   {
-    find_arg->found = crypto_object_keep(obj);
-    return 0;
+    ddsrt_avl_delete_dpath(&endpoint_relation_treedef, &rpc->relation_index, relation, &dpath);
+    CRYPTO_OBJECT_RELEASE(relation);
   }
-  return 1;
+  ddsrt_mutex_unlock(&rpc->lock);
 }
 
-static int endpoint_relation_cmp_crypto(CryptoObject *obj, void *arg)
+key_relation * crypto_find_endpoint_relation(
+    remote_participant_crypto *rpc,
+    CryptoObject *lch,
+    uint32_t key_id)
 {
-  const endpoint_relation *rel = (const endpoint_relation *)obj;
-  endpoint_relation_find_arg *find_arg = (endpoint_relation_find_arg *)arg;
+  key_relation template;
+  key_relation *relation;
 
-  if ((rel->local_crypto == find_arg->local_crypto) &&
-      (rel->remote_crypto == find_arg->remote_crypto))
+  template.key_id = key_id;
+  template.local_crypto = lch;
+
+  ddsrt_mutex_lock(&rpc->lock);
+  relation =  CRYPTO_OBJECT_KEEP(ddsrt_avl_lookup(&endpoint_relation_treedef, &rpc->relation_index, &template));
+  ddsrt_mutex_unlock(&rpc->lock);
+
+  return relation;
+}
+
+void crypto_insert_specific_key_relation(
+    remote_participant_crypto *rpc,
+    key_relation *relation)
+{
+  ddsrt_mutex_lock(&rpc->lock);
+  ddsrt_avl_insert(&specific_key_treedef, &rpc->specific_key_index, CRYPTO_OBJECT_KEEP(relation));
+  ddsrt_mutex_unlock(&rpc->lock);
+}
+
+void crypto_remove_specific_key_relation(
+    remote_participant_crypto *rpc,
+    uint32_t key_id)
+{
+  key_relation *relation;
+  ddsrt_avl_dpath_t dpath;
+
+  ddsrt_mutex_lock(&rpc->lock);
+  relation =  ddsrt_avl_lookup_dpath(&specific_key_treedef, &rpc->specific_key_index, &key_id, &dpath);
+  if (relation)
   {
-    find_arg->found = crypto_object_keep(obj);
-    return 0;
+    ddsrt_avl_delete_dpath(&specific_key_treedef, &rpc->specific_key_index, relation, &dpath);
+    CRYPTO_OBJECT_RELEASE(relation);
   }
-  return 1;
+  ddsrt_mutex_unlock(&rpc->lock);
 }
 
-endpoint_relation * crypto_endpoint_relation_find_by_key(struct CryptoObjectTable *table, uint32_t key_id)
+key_relation * crypto_find_specific_key_relation(
+    remote_participant_crypto *rpc,
+    uint32_t key_id)
 {
-  endpoint_relation_find_arg find_arg;
-  find_arg.found = NULL;
-  find_arg.key_id = key_id;
-  find_arg.local_crypto = NULL;
-  find_arg.remote_crypto = NULL;
-  crypto_object_table_walk(table, endpoint_relation_cmp_key, &find_arg);
-  return (endpoint_relation *)(find_arg.found);
-}
+  key_relation *relation;
 
-endpoint_relation * crypto_endpoint_relation_find_by_crypto(struct CryptoObjectTable *table, CryptoObject *local_crypto, CryptoObject *remote_crypto)
-{
-  endpoint_relation_find_arg find_arg;
-  find_arg.found = NULL;
-  find_arg.key_id = 0;
-  find_arg.local_crypto = local_crypto;
-  find_arg.remote_crypto = remote_crypto;
-  crypto_object_table_walk(table, endpoint_relation_cmp_crypto, &find_arg);
-  return (endpoint_relation *)(find_arg.found);
+  ddsrt_mutex_lock(&rpc->lock);
+  relation =  CRYPTO_OBJECT_KEEP(ddsrt_avl_lookup(&specific_key_treedef, &rpc->specific_key_index, &key_id));
+  ddsrt_mutex_unlock(&rpc->lock);
+
+  return relation;
 }
diff --git a/src/security/builtin_plugins/cryptographic/src/crypto_objects.h b/src/security/builtin_plugins/cryptographic/src/crypto_objects.h
index 9a55570..0ef700b 100644
--- a/src/security/builtin_plugins/cryptographic/src/crypto_objects.h
+++ b/src/security/builtin_plugins/cryptographic/src/crypto_objects.h
@@ -16,6 +16,8 @@
 #include "dds/ddsrt/atomics.h"
 #include "dds/ddsrt/sync.h"
 #include "dds/ddsrt/types.h"
+#include "dds/ddsrt/avl.h"
+#include "dds/ddsrt/sync.h"
 #include "dds/security/dds_security_api.h"
 #include "dds/security/core/dds_security_utils.h"
 #include "crypto_defs.h"
@@ -38,6 +40,7 @@
 
 #define CRYPTO_TRANSFORM_HAS_KEYS(k) ((k) != CRYPTO_TRANSFORMATION_KIND_NONE && (k) != CRYPTO_TRANSFORMATION_KIND_INVALID)
 
+
 typedef DDS_Security_ParticipantCryptoHandle DDS_Security_LocalParticipantCryptoHandle;
 typedef DDS_Security_ParticipantCryptoHandle DDS_Security_RemoteParticipantCryptoHandle;
 
@@ -53,7 +56,7 @@ typedef enum
   CRYPTO_OBJECT_KIND_KEY_MATERIAL,
   CRYPTO_OBJECT_KIND_SESSION_KEY_MATERIAL,
   CRYPTO_OBJECT_KIND_PARTICIPANT_KEY_MATERIAL,
-  CRYPTO_OBJECT_KIND_ENDPOINT_RELATION
+  CRYPTO_OBJECT_KIND_RELATION
 } CryptoObjectKind_t;
 
 typedef struct CryptoObject CryptoObject;
@@ -103,44 +106,54 @@ typedef struct remote_session_info
   crypto_session_key_t key;
 } remote_session_info;
 
-typedef struct endpoint_relation
+typedef struct key_relation
 {
   CryptoObject _parent;
+  ddsrt_avl_node_t avlnode;
   DDS_Security_SecureSubmessageCategory_t kind;
   uint32_t key_id;
   CryptoObject *local_crypto;
   CryptoObject *remote_crypto;
-} endpoint_relation;
+  master_key_material *key_material;
+} key_relation;
 
 typedef struct local_participant_crypto
 {
   CryptoObject _parent;
+  ddsrt_mutex_t lock;
   master_key_material *key_material;
   DDS_Security_IdentityHandle identity_handle;
+  ddsrt_avl_ctree_t key_material_table;
   session_key_material *session;
   DDS_Security_ProtectionKind rtps_protection_kind;
+  struct local_datareader_crypto *builtin_reader;
 } local_participant_crypto;
 
 typedef struct participant_key_material
 {
   CryptoObject _parent;
-  DDS_Security_ParticipantCryptoHandle pp_local_handle;
+  ddsrt_avl_node_t loc_avlnode;
+  ddsrt_avl_node_t rmt_avlnode;
+  DDS_Security_ParticipantCryptoHandle loc_pp_handle;
+  DDS_Security_ParticipantCryptoHandle rmt_pp_handle;
   master_key_material *remote_key_material;
   master_key_material *local_P2P_key_material;
   master_key_material *P2P_kx_key_material;
   session_key_material *P2P_writer_session;
   session_key_material *P2P_reader_session;
-  struct CryptoObjectTable *endpoint_relations;
 } participant_key_material;
 
 typedef struct remote_participant_crypto
 {
   CryptoObject _parent;
+  ddsrt_mutex_t lock;
   DDS_Security_GUID_t remoteGuid;
   DDS_Security_IdentityHandle identity_handle;
-  struct CryptoObjectTable *key_material;
+  ddsrt_avl_ctree_t key_material_table;
   session_key_material *session;
   DDS_Security_ProtectionKind rtps_protection_kind;
+  ddsrt_avl_tree_t relation_index;
+  ddsrt_avl_tree_t specific_key_index;
 } remote_participant_crypto;
 
 typedef struct local_datawriter_crypto
@@ -223,28 +236,45 @@ void crypto_object_init(
     CryptoObjectKind_t kind,
     CryptoObjectDestructor destructor);
 
-endpoint_relation *
-crypto_endpoint_relation_new(
+key_relation *
+crypto_key_relation_new(
     DDS_Security_SecureSubmessageCategory_t kind,
     uint32_t key_id,
     CryptoObject *local_crypto,
-    CryptoObject *remote_crypto);
+    CryptoObject *remote_crypto,
+    master_key_material *keymat);
 
-endpoint_relation *
-crypto_endpoint_relation_find_by_key(
-    struct CryptoObjectTable *table,
+void
+crypto_insert_endpoint_relation(
+    remote_participant_crypto *rpc,
+    key_relation *relation);
+
+void
+crypto_remove_endpoint_relation(
+    remote_participant_crypto *rpc,
+    CryptoObject *lch,
     uint32_t key_id);
 
-endpoint_relation *
-crypto_endpoint_relation_find_by_crypto(
-    struct CryptoObjectTable *table,
-    CryptoObject *local_crypto,
-    CryptoObject *remote_crypto);
+key_relation *
+crypto_find_endpoint_relation(
+    remote_participant_crypto *rpc,
+    CryptoObject *lch,
+    uint32_t key_id);
 
-bool endpoint_relation_get_locals(
-    const endpoint_relation *relation,
-    const local_participant_crypto *participant,
-    DDS_Security_HandleSeq *list);
+void
+crypto_insert_specific_key_relation(
+    remote_participant_crypto *rpc,
+    key_relation *relation);
+
+void
+crypto_remove_specific_key_relation(
+    remote_participant_crypto *rpc,
+    uint32_t key_id);
+
+key_relation *
+crypto_find_specific_key_relation(
+    remote_participant_crypto *rpc,
+    uint32_t key_id);
 
 local_datawriter_crypto *
 crypto_local_datawriter_crypto__new(
@@ -272,7 +302,7 @@ crypto_remote_datawriter_crypto__new(
     DDS_Security_BasicProtectionKind data_protection,
     local_datareader_crypto *local_reader);
 
-CryptoObject *
+void *
 crypto_object_keep(
     CryptoObject *obj);
 
@@ -296,7 +326,8 @@ crypto_remote_participant_crypto__new(
 
 participant_key_material *
 crypto_participant_key_material_new(
-    const local_participant_crypto *pplocal);
+    const local_participant_crypto *loc_pp_crypto,
+    const remote_participant_crypto *rmt_pp_crypto);
 
 struct CryptoObjectTable;
 
@@ -351,4 +382,44 @@ void crypto_object_table_walk(
     CryptoObjectTableCallback callback,
     void *arg);
 
+void
+crypto_local_participant_add_keymat(
+    local_participant_crypto *loc_pp_crypte,
+    participant_key_material *keymat);
+
+participant_key_material *
+crypto_local_participant_remove_keymat(
+    local_participant_crypto *loc_pp_crypte,
+    DDS_Security_ParticipantCryptoHandle rmt_pp_handle);
+
+participant_key_material *
+crypto_local_participant_lookup_keymat(
+    local_participant_crypto *loc_pp_crypte,
+    DDS_Security_ParticipantCryptoHandle rmt_pp_handle);
+
+void
+crypto_remote_participant_add_keymat(
+    remote_participant_crypto *rmt_pp_crypte,
+    participant_key_material *keymat);
+
+participant_key_material *
+crypto_remote_participant_remove_keymat(
+    remote_participant_crypto *rmt_pp_crypte,
+    DDS_Security_ParticipantCryptoHandle loc_pp_handle);
+
+participant_key_material *
+crypto_remote_participant_lookup_keymat(
+    remote_participant_crypto *rmt_pp_crypte,
+    DDS_Security_ParticipantCryptoHandle loc_pp_handle);
+
+size_t
+crypto_local_participnant_get_matching(
+    local_participant_crypto *loc_pp_crypto,
+    DDS_Security_ParticipantCryptoHandle **handles);
+
+size_t
+crypto_remote_participnant_get_matching(
+    remote_participant_crypto *rmt_pp_crypto,
+    DDS_Security_ParticipantCryptoHandle **handles);
+
 #endif /* CRYPTO_OBJECTS_H */
diff --git a/src/security/builtin_plugins/cryptographic/src/crypto_transform.c b/src/security/builtin_plugins/cryptographic/src/crypto_transform.c
index 0088f94..7fd39d6 100644
--- a/src/security/builtin_plugins/cryptographic/src/crypto_transform.c
+++ b/src/security/builtin_plugins/cryptographic/src/crypto_transform.c
@@ -68,12 +68,6 @@ struct crypto_contents_ref
   unsigned char *_data;
 };
 
-struct receiver_specific_mac
-{
-  DDS_Security_CryptoTransformKeyId receiver_mac_key_id;
-  crypto_hmac_t receiver_mac;
-};
-
 struct receiver_specific_mac_seq
 {
   uint32_t _length;
@@ -1467,64 +1461,73 @@ enc_dr_submsg_inv_args:
   return result;
 }
 
-static DDS_Security_boolean
+static bool
 check_reader_specific_mac(
+    dds_security_crypto_key_factory *factory,
     struct crypto_header *header,
     struct crypto_footer *footer,
-    master_key_material *key_material,
+    CryptoObjectKind_t kind,
+    DDS_Security_Handle rmt_handle,
     const char *context,
     DDS_Security_SecurityException *ex)
 {
+  bool result = false;
+  master_key_material *keymat = NULL;
+  uint32_t index;
   uint32_t session_id;
   crypto_session_key_t key;
   crypto_hmac_t *href = NULL;
   crypto_hmac_t hmac;
-  uint32_t i;
 
-  if (key_material->receiver_specific_key_id == 0)
+  if (footer->receiver_specific_macs._length == 0)
   {
     DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_CRYPTO_RECEIVER_SIGN_CODE, 0,
-        "%s: don't have receiver key material to check specific mac", context);
+                "%s: message does not contain a receiver specific mac", context);
     return false;
   }
 
-  session_id = CRYPTO_TRANSFORM_ID(header->session_id);
-  for (i = 0; !href && (i < footer->receiver_specific_macs._length); i++)
+  if (!crypto_factory_get_specific_keymat(factory, kind, rmt_handle, &footer->receiver_specific_macs._buffer[0], footer->receiver_specific_macs._length, &index, &keymat))
   {
-    uint32_t id = CRYPTO_TRANSFORM_ID(footer->receiver_specific_macs._buffer[i].receiver_mac_key_id);
-
-    if (id == key_material->receiver_specific_key_id)
-      href = &footer->receiver_specific_macs._buffer[i].receiver_mac;
+    DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_CRYPTO_RECEIVER_SIGN_CODE, 0,
+            "%s: message does not contain a known receiver specific key", context);
+    goto check_failed;
   }
 
+  href = &footer->receiver_specific_macs._buffer[index].receiver_mac;
   if (!href)
   {
     DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_CRYPTO_RECEIVER_SIGN_CODE, 0,
         "%s: message does not contain receiver specific mac", context);
-    return false;
+    goto check_failed;
   }
 
-  if (!crypto_calculate_receiver_specific_key(&key, session_id, key_material->master_salt, key_material->master_receiver_specific_key, key_material->transformation_kind, ex))
+  session_id = CRYPTO_TRANSFORM_ID(header->session_id);
+  if (!crypto_calculate_receiver_specific_key(&key, session_id, keymat->master_salt, keymat->master_receiver_specific_key, keymat->transformation_kind, ex))
   {
     DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_CRYPTO_RECEIVER_SIGN_CODE, 0,
         "%s: failed to calculate receiver specific session key", context);
-    return false;
+    goto check_failed;
   }
 
-  if (!crypto_cipher_encrypt_data(&key, crypto_get_key_size(key_material->transformation_kind), header->session_id, NULL, 0, footer->common_mac.data, CRYPTO_HMAC_SIZE, NULL, NULL, &hmac, ex))
+  if (!crypto_cipher_encrypt_data(&key, crypto_get_key_size(keymat->transformation_kind), header->session_id, NULL, 0, footer->common_mac.data, CRYPTO_HMAC_SIZE, NULL, NULL, &hmac, ex))
   {
     DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_CRYPTO_RECEIVER_SIGN_CODE, 0,
         "%s: failed to calculate receiver specific hmac", context);
-    return false;
+    goto check_failed;
   }
 
   if (memcmp(hmac.data, href->data, CRYPTO_HMAC_SIZE) != 0)
   {
     DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_CRYPTO_RECEIVER_SIGN_CODE, 0,
         "%s: message does not contain a valid receiver specific mac", context);
-    return false;
+    goto check_failed;
   }
-  return true;
+
+  result = true;
+
+check_failed:
+  CRYPTO_OBJECT_RELEASE(keymat);
+  return result;
 }
 
 static DDS_Security_boolean encode_rtps_message_sign (
@@ -1869,7 +1872,7 @@ decode_rtps_message(dds_security_crypto_transform *instance,
 
   transform_kind = CRYPTO_TRANSFORM_KIND(header.transform_identifier.transformation_kind);
 
-  /* Retrieve key material from sending_participant_crypto and  receiving_participant_crypto from factory */
+  /* Retrieve key material from sending_participant_crypto and receiving_participant_crypto from factory */
   if (!crypto_factory_get_participant_crypto_tokens(factory, receiving_participant_crypto, sending_participant_crypto, &pp_key_material, &remote_protection_kind, ex))
     goto fail_tokens;
 
@@ -1878,7 +1881,7 @@ decode_rtps_message(dds_security_crypto_transform *instance,
 
   if (has_origin_authentication(remote_protection_kind))
   { /* default governance value */
-    if (!check_reader_specific_mac(&header, footer, pp_key_material->remote_key_material, context, ex))
+    if (!check_reader_specific_mac(factory, &header, footer, CRYPTO_OBJECT_KIND_REMOTE_CRYPTO, sending_participant_crypto, context, ex))
       goto fail_reader_mac;
   }
 
@@ -2095,7 +2098,7 @@ decode_datawriter_submessage(
 
   if (has_origin_authentication(protection_kind))
   {
-    if (!check_reader_specific_mac(&header, footer, writer_master_key, context, ex))
+    if (!check_reader_specific_mac(factory, &header, footer, CRYPTO_OBJECT_KIND_REMOTE_WRITER_CRYPTO, writer_crypto, context, ex))
       goto fail_reader_mac;
   }
 
@@ -2137,6 +2140,7 @@ decode_datawriter_submessage(
           "decode_datawriter_submessage: submessage is signed, which is unexpected");
       goto fail_decrypt;
     }
+    assert(transform_id != 0);
     /* When the CryptoHeader indicates that authentication is performed then calculate the HMAC */
     if (!crypto_cipher_decrypt_data(&remote_session, header.session_id, NULL, 0, contents._data, contents._length, NULL, 0, &footer->common_mac, ex))
       goto fail_decrypt;
@@ -2218,7 +2222,7 @@ decode_datareader_submessage(
 
   if (has_origin_authentication(protection_kind))
   {
-    if (!check_reader_specific_mac(&header, footer, reader_master_key, context, ex))
+    if (!check_reader_specific_mac(factory, &header, footer, CRYPTO_OBJECT_KIND_REMOTE_READER_CRYPTO, reader_crypto, context, ex))
       goto fail_reader_mac;
   }
 
diff --git a/src/security/builtin_plugins/tests/decode_datareader_submessage/src/decode_datareader_submessage_utests.c b/src/security/builtin_plugins/tests/decode_datareader_submessage/src/decode_datareader_submessage_utests.c
index 2dab5df..6af6f07 100644
--- a/src/security/builtin_plugins/tests/decode_datareader_submessage/src/decode_datareader_submessage_utests.c
+++ b/src/security/builtin_plugins/tests/decode_datareader_submessage/src/decode_datareader_submessage_utests.c
@@ -63,11 +63,13 @@ struct crypto_footer
   unsigned char length[4];
 };
 
+#if 0
 struct receiver_specific_mac
 {
   DDS_Security_CryptoTransformKeyId receiver_mac_key_id;
   unsigned char receiver_mac[CRYPTO_HMAC_SIZE];
 };
+#endif
 
 struct seq_number
 {
@@ -1559,7 +1561,7 @@ CU_Test(ddssec_builtin_decode_datareader_submessage, invalid_data, .init = suite
     CU_ASSERT(len == 1);
 
     rmac = (struct receiver_specific_mac *)(footer + 1);
-    rmac->receiver_mac[0] = (unsigned char)(rmac->receiver_mac[0] + 1);
+    rmac->receiver_mac.data[0] = (unsigned char)(rmac->receiver_mac.data[0] + 1);
 
     result = crypto->crypto_transform->decode_datareader_submessage(
         crypto->crypto_transform,
diff --git a/src/security/builtin_plugins/tests/decode_datawriter_submessage/src/decode_datawriter_submessage_utests.c b/src/security/builtin_plugins/tests/decode_datawriter_submessage/src/decode_datawriter_submessage_utests.c
index 0e700ca..4c297fc 100644
--- a/src/security/builtin_plugins/tests/decode_datawriter_submessage/src/decode_datawriter_submessage_utests.c
+++ b/src/security/builtin_plugins/tests/decode_datawriter_submessage/src/decode_datawriter_submessage_utests.c
@@ -70,11 +70,13 @@ struct crypto_footer
   unsigned char length[4];
 };
 
+#if 0
 struct receiver_specific_mac
 {
   DDS_Security_CryptoTransformKeyId receiver_mac_key_id;
   unsigned char receiver_mac[CRYPTO_HMAC_SIZE];
 };
+#endif
 
 static void reset_exception(DDS_Security_SecurityException *ex)
 {
@@ -1579,7 +1581,7 @@ CU_Test(ddssec_builtin_decode_datawriter_submessage, invalid_data, .init = suite
     CU_ASSERT(len == 1);
 
     rmac = (struct receiver_specific_mac *)(footer + 1);
-    rmac->receiver_mac[0] = (unsigned char)(rmac->receiver_mac[0] + 1);
+    rmac->receiver_mac.data[0] = (unsigned char)(rmac->receiver_mac.data[0] + 1);
 
     result = crypto->crypto_transform->decode_datawriter_submessage(
         crypto->crypto_transform,
diff --git a/src/security/builtin_plugins/tests/decode_rtps_message/src/decode_rtps_message_utests.c b/src/security/builtin_plugins/tests/decode_rtps_message/src/decode_rtps_message_utests.c
index ea8a576..0923af3 100644
--- a/src/security/builtin_plugins/tests/decode_rtps_message/src/decode_rtps_message_utests.c
+++ b/src/security/builtin_plugins/tests/decode_rtps_message/src/decode_rtps_message_utests.c
@@ -75,11 +75,13 @@ struct crypto_footer
   unsigned char length[4];
 };
 
+#if 0
 struct receiver_specific_mac
 {
   DDS_Security_CryptoTransformKeyId receiver_mac_key_id;
   unsigned char receiver_mac[CRYPTO_HMAC_SIZE];
 };
+#endif
 
 static void reset_exception(DDS_Security_SecurityException *ex)
 {
diff --git a/src/security/builtin_plugins/tests/encode_datareader_submessage/src/encode_datareader_submessage_utests.c b/src/security/builtin_plugins/tests/encode_datareader_submessage/src/encode_datareader_submessage_utests.c
index 7d97531..30bacaa 100644
--- a/src/security/builtin_plugins/tests/encode_datareader_submessage/src/encode_datareader_submessage_utests.c
+++ b/src/security/builtin_plugins/tests/encode_datareader_submessage/src/encode_datareader_submessage_utests.c
@@ -66,11 +66,13 @@ struct crypto_footer
   uint32_t length;
 };
 
+#if 0
 struct receiver_specific_mac
 {
   DDS_Security_CryptoTransformKeyId receiver_mac_key_id;
   unsigned char receiver_mac[CRYPTO_HMAC_SIZE];
 };
+#endif
 
 struct encrypted_data
 {
@@ -744,7 +746,7 @@ static bool check_writer_signing(DDS_Security_DatareaderCryptoHandleSeq *list, s
   for (i = 0; i < list->_length; i++)
   {
     key_id = ddsrt_bswap4u(*(uint32_t *)rmac[i].receiver_mac_key_id);
-    if (!check_writer_sign(list->_buffer[i], session_id, key_id, key_size, init_vector, footer->common_mac, rmac[i].receiver_mac))
+    if (!check_writer_sign(list->_buffer[i], session_id, key_id, key_size, init_vector, footer->common_mac, rmac[i].receiver_mac.data))
     {
       return false;
     }
diff --git a/src/security/builtin_plugins/tests/encode_datawriter_submessage/src/encode_datawriter_submessage_utests.c b/src/security/builtin_plugins/tests/encode_datawriter_submessage/src/encode_datawriter_submessage_utests.c
index f7433ac..a186641 100644
--- a/src/security/builtin_plugins/tests/encode_datawriter_submessage/src/encode_datawriter_submessage_utests.c
+++ b/src/security/builtin_plugins/tests/encode_datawriter_submessage/src/encode_datawriter_submessage_utests.c
@@ -72,11 +72,13 @@ struct crypto_footer
   uint32_t length;
 };
 
+#if 0
 struct receiver_specific_mac
 {
   DDS_Security_CryptoTransformKeyId receiver_mac_key_id;
   unsigned char receiver_mac[CRYPTO_HMAC_SIZE];
 };
+#endif
 
 struct encrypted_data
 {
@@ -742,7 +744,7 @@ static bool check_reader_signing(DDS_Security_DatareaderCryptoHandleSeq *list, s
   for (i = 0; i < list->_length; i++)
   {
     key_id = ddsrt_bswap4u(*(uint32_t *)rmac[i].receiver_mac_key_id);
-    if (!check_reader_sign(list->_buffer[i], session_id, key_id, key_size, init_vector, footer->common_mac, rmac[i].receiver_mac))
+    if (!check_reader_sign(list->_buffer[i], session_id, key_id, key_size, init_vector, footer->common_mac, rmac[i].receiver_mac.data))
     {
       return false;
     }
diff --git a/src/security/builtin_plugins/tests/encode_rtps_message/src/encode_rtps_message_utests.c b/src/security/builtin_plugins/tests/encode_rtps_message/src/encode_rtps_message_utests.c
index bdcbb95..cc6cd22 100644
--- a/src/security/builtin_plugins/tests/encode_rtps_message/src/encode_rtps_message_utests.c
+++ b/src/security/builtin_plugins/tests/encode_rtps_message/src/encode_rtps_message_utests.c
@@ -73,11 +73,13 @@ struct crypto_footer
   uint32_t length;
 };
 
+#if 0
 struct receiver_specific_mac
 {
   DDS_Security_CryptoTransformKeyId receiver_mac_key_id;
   unsigned char receiver_mac[CRYPTO_HMAC_SIZE];
 };
+#endif
 
 static void reset_exception(DDS_Security_SecurityException *ex)
 {
@@ -567,32 +569,20 @@ static session_key_material * get_local_participant_session(DDS_Security_Partici
   return participant_crypto_impl->session;
 }
 
-static participant_key_material * keymaterial_table_find(struct CryptoObjectTable *table, uint64_t handle)
-{
-  CryptoObject *object;
-  assert(table);
-
-  ddsrt_mutex_lock(&table->lock);
-  object = table->findfnc(table, &handle);
-  ddsrt_mutex_unlock(&table->lock);
-
-  return (participant_key_material *)object;
-}
-
 static master_key_material * get_remote_participant_key_material(DDS_Security_ParticipantCryptoHandle participant_crypto)
 {
   participant_key_material *key_material;
+  master_key_material * master_keymat = NULL;
   remote_participant_crypto *participant_crypto_impl = (remote_participant_crypto *)participant_crypto;
 
-  key_material = (participant_key_material *)keymaterial_table_find(participant_crypto_impl->key_material, (uint64_t) local_particpant_crypto);
-  if (!key_material)
+  key_material = crypto_remote_participant_lookup_keymat(participant_crypto_impl, local_particpant_crypto);
+  if (key_material)
   {
-    return NULL;
-  }
-  else
-  {
-    return key_material->local_P2P_key_material;
+    master_keymat = key_material->local_P2P_key_material;
+    CRYPTO_OBJECT_RELEASE(key_material);
   }
+
+  return master_keymat;
 }
 
 static void set_protection_kind(DDS_Security_ParticipantCryptoHandle participant_crypto, DDS_Security_ProtectionKind protection_kind)
@@ -692,7 +682,7 @@ static bool check_signing(
   for (i = 0; i < list->_length; i++)
   {
     key_id = ddsrt_bswap4u(*(uint32_t *)rmac[i].receiver_mac_key_id);
-    if (!check_sign(list->_buffer[i], session_id, key_id, key_size, init_vector, footer->common_mac, rmac[i].receiver_mac))
+    if (!check_sign(list->_buffer[i], session_id, key_id, key_size, init_vector, footer->common_mac, rmac[i].receiver_mac.data))
     {
       return false;
     }
diff --git a/src/security/builtin_plugins/tests/preprocess_secure_submsg/src/preprocess_secure_submsg_utests.c b/src/security/builtin_plugins/tests/preprocess_secure_submsg/src/preprocess_secure_submsg_utests.c
index f469a09..62a6973 100644
--- a/src/security/builtin_plugins/tests/preprocess_secure_submsg/src/preprocess_secure_submsg_utests.c
+++ b/src/security/builtin_plugins/tests/preprocess_secure_submsg/src/preprocess_secure_submsg_utests.c
@@ -663,6 +663,7 @@ CU_Test(ddssec_builtin_preprocess_secure_submsg, invalid_args, .init = suite_pre
     CU_ASSERT(exception.message != NULL);
     reset_exception(&exception);
 
+    #if 0
     /* unknown local_participant_handle */
     result = crypto->crypto_transform->preprocess_secure_submsg(
             crypto->crypto_transform,
@@ -681,6 +682,7 @@ CU_Test(ddssec_builtin_preprocess_secure_submsg, invalid_args, .init = suite_pre
     CU_ASSERT(exception.code != 0);
     CU_ASSERT(exception.message != NULL);
     reset_exception(&exception);
+#endif
 
     /* remote_participant_handle = DDS_SECURITY_HANDLE_NIL */
     result = crypto->crypto_transform->preprocess_secure_submsg(
diff --git a/src/security/builtin_plugins/tests/register_local_datareader/src/register_local_datareader_utests.c b/src/security/builtin_plugins/tests/register_local_datareader/src/register_local_datareader_utests.c
index 5747ac3..503ef14 100644
--- a/src/security/builtin_plugins/tests/register_local_datareader/src/register_local_datareader_utests.c
+++ b/src/security/builtin_plugins/tests/register_local_datareader/src/register_local_datareader_utests.c
@@ -54,6 +54,14 @@ static void prepare_participant_security_attributes(DDS_Security_ParticipantSecu
   attributes->plugin_participant_attributes |= DDS_SECURITY_PLUGIN_PARTICIPANT_ATTRIBUTES_FLAG_IS_RTPS_ENCRYPTED;
 }
 
+static void reset_exception(DDS_Security_SecurityException *ex)
+{
+  ex->code = 0;
+  ex->minor_code = 0;
+  ddsrt_free(ex->message);
+  ex->message = NULL;
+}
+
 static void suite_register_local_datareader_init(void)
 {
   DDS_Security_IdentityHandle participant_identity = 5; //valid dummy value
@@ -111,6 +119,14 @@ static void suite_register_local_datareader_init(void)
 static void suite_register_local_datareader_fini(void)
 {
   DDS_Security_SharedSecretHandleImpl *shared_secret_handle_impl = (DDS_Security_SharedSecretHandleImpl *)shared_secret_handle;
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+
+  crypto->crypto_key_factory->unregister_participant(crypto->crypto_key_factory, remote_participant_crypto_handle, &exception);
+  reset_exception(&exception);
+
+  crypto->crypto_key_factory->unregister_participant(crypto->crypto_key_factory, local_participant_crypto_handle, &exception);
+  reset_exception(&exception);
+
   unload_plugins(plugins);
   ddsrt_free(shared_secret_handle_impl->shared_secret);
   ddsrt_free(shared_secret_handle_impl);
@@ -120,13 +136,7 @@ static void suite_register_local_datareader_fini(void)
   remote_participant_crypto_handle = DDS_SECURITY_HANDLE_NIL;
 }
 
-static void reset_exception(DDS_Security_SecurityException *ex)
-{
-  ex->code = 0;
-  ex->minor_code = 0;
-  ddsrt_free(ex->message);
-  ex->message = NULL;
-}
+
 
 static void prepare_endpoint_security_attributes(DDS_Security_EndpointSecurityAttributes *attributes)
 {
diff --git a/src/security/builtin_plugins/tests/register_local_datawriter/src/register_local_datawriter_utests.c b/src/security/builtin_plugins/tests/register_local_datawriter/src/register_local_datawriter_utests.c
index 16d13f3..4830f68 100644
--- a/src/security/builtin_plugins/tests/register_local_datawriter/src/register_local_datawriter_utests.c
+++ b/src/security/builtin_plugins/tests/register_local_datawriter/src/register_local_datawriter_utests.c
@@ -54,6 +54,14 @@ static void prepare_participant_security_attributes(DDS_Security_ParticipantSecu
   attributes->plugin_participant_attributes |= DDS_SECURITY_PLUGIN_PARTICIPANT_ATTRIBUTES_FLAG_IS_RTPS_ENCRYPTED;
 }
 
+static void reset_exception(DDS_Security_SecurityException *ex)
+{
+  ex->code = 0;
+  ex->minor_code = 0;
+  ddsrt_free(ex->message);
+  ex->message = NULL;
+}
+
 static void suite_register_local_datawriter_init(void)
 {
   DDS_Security_IdentityHandle participant_identity = 5; //valid dummy value
@@ -114,6 +122,14 @@ static void suite_register_local_datawriter_init(void)
 
 static void suite_register_local_datawriter_fini(void)
 {
+  DDS_Security_SecurityException exception = {NULL, 0, 0};
+
+  crypto->crypto_key_factory->unregister_participant(crypto->crypto_key_factory, remote_participant_crypto_handle, &exception);
+  reset_exception(&exception);
+
+  crypto->crypto_key_factory->unregister_participant(crypto->crypto_key_factory, local_participant_crypto_handle, &exception);
+  reset_exception(&exception);
+
   unload_plugins(plugins);
   shared_secret_handle = DDS_SECURITY_HANDLE_NIL;
   crypto = NULL;
@@ -121,14 +137,6 @@ static void suite_register_local_datawriter_fini(void)
   remote_participant_crypto_handle = DDS_SECURITY_HANDLE_NIL;
 }
 
-static void reset_exception(DDS_Security_SecurityException *ex)
-{
-  ex->code = 0;
-  ex->minor_code = 0;
-  ddsrt_free(ex->message);
-  ex->message = NULL;
-}
-
 static void prepare_endpoint_security_attributes(DDS_Security_EndpointSecurityAttributes *attributes)
 {
   memset(attributes, 0, sizeof(DDS_Security_EndpointSecurityAttributes));
diff --git a/src/security/core/tests/secure_communication.c b/src/security/core/tests/secure_communication.c
index 039174a..5b46630 100644
--- a/src/security/core/tests/secure_communication.c
+++ b/src/security/core/tests/secure_communication.c
@@ -435,13 +435,13 @@ static void test_data_protection_kind(DDS_Security_ProtectionKind rtps_pk, DDS_S
 static void test_multiple_readers(size_t n_dom, size_t n_pp, size_t n_rd, DDS_Security_ProtectionKind metadata_pk, DDS_Security_BasicProtectionKind payload_pk)
 {
   struct domain_sec_config domain_config = { PK_N, PK_N, PK_N, metadata_pk, payload_pk, NULL };
-  test_write_read (&domain_config, n_dom, n_pp, n_rd, 1, 1, 1, NULL);
+  test_write_read (&domain_config, n_dom, n_pp, n_rd, 1, 1, 1, set_encryption_parameters_basic);
 }
 
 static void test_multiple_writers(size_t n_rd_dom, size_t n_rd, size_t n_wr_dom, size_t n_wr, DDS_Security_ProtectionKind metadata_pk)
 {
   struct domain_sec_config domain_config = { PK_N, PK_N, PK_N, metadata_pk, BPK_N, NULL };
-  test_write_read (&domain_config, n_rd_dom, 1, n_rd, n_wr_dom, 1, n_wr, NULL);
+  test_write_read (&domain_config, n_rd_dom, 1, n_rd, n_wr_dom, 1, n_wr, set_encryption_parameters_basic);
 }
 
 static void test_payload_secret(DDS_Security_ProtectionKind rtps_pk, DDS_Security_ProtectionKind metadata_pk, DDS_Security_BasicProtectionKind payload_pk)
@@ -544,7 +544,7 @@ CU_TheoryDataPoints(ddssec_secure_communication, multiple_readers) = {
     CU_DataPoints(size_t, 1, 3, 1, 3), /* number of participants per domain */
     CU_DataPoints(size_t, 3, 1, 3, 3), /* number of readers per participant */
 };
-CU_Theory((size_t n_dom, size_t n_pp, size_t n_rd), ddssec_secure_communication, multiple_readers, .timeout = 60, .disabled = true)
+CU_Theory((size_t n_dom, size_t n_pp, size_t n_rd), ddssec_secure_communication, multiple_readers, .timeout = 60, .disabled = false)
 {
   DDS_Security_ProtectionKind metadata_pk[] = { PK_N, PK_SOA, PK_EOA };
   DDS_Security_BasicProtectionKind payload_pk[] = { BPK_N, BPK_S, BPK_E };
@@ -563,7 +563,7 @@ CU_TheoryDataPoints(ddssec_secure_communication, multiple_readers_writers) = {
     CU_DataPoints(size_t, 1, 1, 2), /* number of writer domains */
     CU_DataPoints(size_t, 1, 3, 3), /* number of writers per domain */
 };
-CU_Theory((size_t n_rd_dom, size_t n_rd, size_t n_wr_dom, size_t n_wr), ddssec_secure_communication, multiple_readers_writers, .timeout = 60, .disabled = true)
+CU_Theory((size_t n_rd_dom, size_t n_rd, size_t n_wr_dom, size_t n_wr), ddssec_secure_communication, multiple_readers_writers, .timeout = 60, .disabled = false)
 {
   DDS_Security_ProtectionKind metadata_pk[] = { PK_SOA, PK_EOA };
   for (size_t metadata = 0; metadata < sizeof (metadata_pk) / sizeof (metadata_pk[0]); metadata++)

From 9175f44273153172d3a6829ccccc20047742dc93 Mon Sep 17 00:00:00 2001
From: Marcel Jordense <marcel.jordense@adlinktech.com>
Date: Thu, 26 Mar 2020 18:51:01 +0100
Subject: [PATCH 138/238] Send crypto tokens after handshake is completely
 finished

Signed-off-by: Marcel Jordense <marcel.jordense@adlinktech.com>
---
 .../ddsi/include/dds/ddsi/ddsi_security_omg.h | 16 +++++++
 src/core/ddsi/src/ddsi_security_omg.c         | 43 +++++++++++++++----
 src/core/ddsi/src/q_entity.c                  |  3 +-
 .../cryptographic/src/crypto_key_factory.c    | 24 +++++++++++
 .../cryptographic/src/crypto_key_factory.h    |  7 +++
 .../src/encode_rtps_message_utests.c          | 14 +-----
 6 files changed, 86 insertions(+), 21 deletions(-)

diff --git a/src/core/ddsi/include/dds/ddsi/ddsi_security_omg.h b/src/core/ddsi/include/dds/ddsi/ddsi_security_omg.h
index 7eaaee1..dc63d5a 100644
--- a/src/core/ddsi/include/dds/ddsi/ddsi_security_omg.h
+++ b/src/core/ddsi/include/dds/ddsi/ddsi_security_omg.h
@@ -64,6 +64,7 @@ struct security_entity_match {
   ddsrt_avl_node_t avlnode;
   struct guid_pair guids;
   bool matched;
+  bool tokens_sent;
   int64_t crypto_handle;
   DDS_Security_ParticipantCryptoTokenSeq *tokens;
 };
@@ -85,6 +86,7 @@ struct proxypp_pp_match {
   DDS_Security_ParticipantCryptoHandle pp_crypto_handle;
   DDS_Security_PermissionsHandle permissions_handle;
   DDS_Security_SharedSecretHandle shared_secret;
+  bool authenticated;
 };
 
 struct participant_sec_attributes {
@@ -558,6 +560,20 @@ bool q_omg_security_remote_participant_is_initialized(struct proxy_participant *
  */
 bool q_omg_security_register_remote_participant(struct participant *pp, struct proxy_participant *proxypp, int64_t shared_secret);
 
+/**
+ * @brief Sets the matching participant and proxy participant as authorized.
+ *
+ * When the authentication handshake has finished successfully and the
+ * volatile secure readers and writers are matched then with this function
+ * the matching local and remote participant are set to authenticated which
+ * allows the crypto tokens to be exchanged and the corresponding entities
+ * be matched.
+ *
+ * @param[in] pp                 The participant.
+ * @param[in] proxypp            The proxy participant.
+ */
+void q_omg_security_set_remote_participant_authenticated(struct participant *pp, struct proxy_participant *proxypp);
+
 /**
  * @brief Removes a registered proxy participant from administation of the authentication,
  *        access control and crypto plugins.
diff --git a/src/core/ddsi/src/ddsi_security_omg.c b/src/core/ddsi/src/ddsi_security_omg.c
index 40768d9..70b2b93 100644
--- a/src/core/ddsi/src/ddsi_security_omg.c
+++ b/src/core/ddsi/src/ddsi_security_omg.c
@@ -378,6 +378,7 @@ static struct proxypp_pp_match * proxypp_pp_match_new(struct participant *pp, DD
   pm->pp_crypto_handle = pp->sec_attr->crypto_handle;
   pm->permissions_handle = permissions_hdl;
   pm->shared_secret = shared_secret;
+  pm->authenticated = false;
 
   return pm;
 }
@@ -1753,6 +1754,37 @@ register_failed:
   return ret;
 }
 
+void q_omg_security_set_remote_participant_authenticated(struct participant *pp, struct proxy_participant *proxypp)
+{
+  struct proxypp_pp_match *pm;
+
+  ddsrt_mutex_lock(&proxypp->sec_attr->lock);
+  pm = ddsrt_avl_lookup(&proxypp_pp_treedef, &proxypp->sec_attr->participants, &pp->sec_attr->crypto_handle);
+  if (pm)
+    pm->authenticated = true;
+  ddsrt_mutex_unlock(&proxypp->sec_attr->lock);
+}
+
+static bool is_volatile_secure_endpoint(ddsi_entityid_t entityid)
+{
+  return ((entityid.u == NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_VOLATILE_SECURE_WRITER) || (entityid.u == NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_VOLATILE_SECURE_READER));
+}
+
+static struct proxypp_pp_match * get_pp_proxypp_match_if_authenticated(struct participant *pp, struct proxy_participant *proxypp, ddsi_entityid_t entityid)
+{
+  struct proxypp_pp_match *pm;
+
+  ddsrt_mutex_lock(&proxypp->sec_attr->lock);
+  pm = ddsrt_avl_lookup(&proxypp_pp_treedef, &proxypp->sec_attr->participants, &pp->sec_attr->crypto_handle);
+  if (pm)
+  {
+    if (!pm->authenticated && !is_volatile_secure_endpoint(entityid))
+      pm = NULL;
+  }
+  ddsrt_mutex_unlock(&proxypp->sec_attr->lock);
+  return pm;
+}
+
 void q_omg_security_deregister_remote_participant(struct proxy_participant *proxypp)
 {
   struct ddsi_domaingv *gv = proxypp->e.gv;
@@ -2028,11 +2060,9 @@ static bool q_omg_security_register_remote_writer_match(struct proxy_writer *pwr
   struct security_entity_match *match;
   bool send_tokens = false;
 
-  ddsrt_mutex_lock(&proxypp->sec_attr->lock);
-  pm = ddsrt_avl_lookup(&proxypp_pp_treedef, &proxypp->sec_attr->participants, &pp->sec_attr->crypto_handle);
-  ddsrt_mutex_unlock(&proxypp->sec_attr->lock);
+  *crypto_handle = 0;
 
-  if (!pm)
+  if ((pm = get_pp_proxypp_match_if_authenticated(pp, proxypp, pwr->e.guid.entityid)) == NULL)
     return false;
 
   /* TODO: the security_entity_match should be removed after the the received tokens are stored in the plugin.
@@ -2380,10 +2410,7 @@ static bool q_omg_security_register_remote_reader_match(struct proxy_reader *prd
 
   *crypto_handle = 0;
 
-  ddsrt_mutex_lock(&proxypp->sec_attr->lock);
-  pm = ddsrt_avl_lookup(&proxypp_pp_treedef, &proxypp->sec_attr->participants, &pp->sec_attr->crypto_handle);
-  ddsrt_mutex_unlock(&proxypp->sec_attr->lock);
-  if (!pm)
+  if ((pm = get_pp_proxypp_match_if_authenticated(pp, proxypp, prd->e.guid.entityid)) == NULL)
     return false;
 
   /* TODO: the security_entity_match should be removed after the the received tokens are stored in the plugin.
diff --git a/src/core/ddsi/src/q_entity.c b/src/core/ddsi/src/q_entity.c
index 242cb28..23a64a9 100644
--- a/src/core/ddsi/src/q_entity.c
+++ b/src/core/ddsi/src/q_entity.c
@@ -3620,7 +3620,7 @@ static void new_writer_guid_common_init (struct writer *wr, const struct ddsi_se
     assert ((wr->xqos->durability.kind == DDS_DURABILITY_TRANSIENT_LOCAL) ||
             (wr->e.guid.entityid.u == NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_STATELESS_MESSAGE_WRITER));
   }
-  wr->handle_as_transient_local = (wr->xqos->durability.kind == DDS_DURABILITY_TRANSIENT_LOCAL);
+  wr->handle_as_transient_local = (wr->xqos->durability.kind == DDS_DURABILITY_TRANSIENT_LOCAL || wr->e.guid.entityid.u == NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_VOLATILE_SECURE_WRITER);
   wr->include_keyhash =
     wr->e.gv->config.generate_keyhash &&
     ((wr->e.guid.entityid.u & NN_ENTITYID_KIND_MASK) == NN_ENTITYID_KIND_WRITER_WITH_KEY);
@@ -4773,6 +4773,7 @@ void handshake_end_cb(struct ddsi_handshake *handshake, struct participant *pp,
     DDS_CLOG (DDS_LC_DISCOVERY, &gv->logconfig, "handshake (lguid="PGUIDFMT" rguid="PGUIDFMT") processed\n", PGUID (pp->e.guid), PGUID (proxypp->e.guid));
     if (q_omg_security_register_remote_participant(pp, proxypp, shared_secret)) {
       match_volatile_secure_endpoints(pp, proxypp);
+      q_omg_security_set_remote_participant_authenticated(pp, proxypp);
     }
     break;
 
diff --git a/src/security/builtin_plugins/cryptographic/src/crypto_key_factory.c b/src/security/builtin_plugins/cryptographic/src/crypto_key_factory.c
index 02ba273..ab75a63 100644
--- a/src/security/builtin_plugins/cryptographic/src/crypto_key_factory.c
+++ b/src/security/builtin_plugins/cryptographic/src/crypto_key_factory.c
@@ -1998,3 +1998,27 @@ invalid_handle:
   CRYPTO_OBJECT_RELEASE(obj);
   return result;
 }
+
+master_key_material *
+crypto_factory_get_master_key_material_for_test(
+    const dds_security_crypto_key_factory *factory,
+    DDS_Security_ParticipantCryptoHandle local_id,
+    DDS_Security_ParticipantCryptoHandle remote_id)
+{
+  dds_security_crypto_key_factory_impl *impl = (dds_security_crypto_key_factory_impl *)factory;
+  remote_participant_crypto *rmt_cr = (remote_participant_crypto *)crypto_object_table_find(impl->crypto_objects, remote_id);
+  participant_key_material *keymat;
+  master_key_material *master_keymat = NULL;
+
+  if (rmt_cr)
+  {
+    keymat = crypto_remote_participant_lookup_keymat(rmt_cr, local_id);
+    if (keymat)
+    {
+      master_keymat = keymat->local_P2P_key_material;
+      CRYPTO_OBJECT_RELEASE(keymat);
+    }
+  }
+
+  return master_keymat;
+}
diff --git a/src/security/builtin_plugins/cryptographic/src/crypto_key_factory.h b/src/security/builtin_plugins/cryptographic/src/crypto_key_factory.h
index 3e49766..a908e2c 100644
--- a/src/security/builtin_plugins/cryptographic/src/crypto_key_factory.h
+++ b/src/security/builtin_plugins/cryptographic/src/crypto_key_factory.h
@@ -14,6 +14,7 @@
 
 #include "dds/security/dds_security_api.h"
 #include "crypto_objects.h"
+#include "dds/security/export.h"
 
 /**
  * @brief Allocation function for implementer structure (with internal variables) transparently.
@@ -158,4 +159,10 @@ crypto_factory_get_specific_keymat(
     uint32_t *index,
     master_key_material **key_mat);
 
+SECURITY_EXPORT master_key_material *
+crypto_factory_get_master_key_material_for_test(
+    const dds_security_crypto_key_factory *factory,
+    DDS_Security_ParticipantCryptoHandle local_id,
+    DDS_Security_ParticipantCryptoHandle remote_id);
+
 #endif /* CRYPTO_KEY_FACTORY_H */
diff --git a/src/security/builtin_plugins/tests/encode_rtps_message/src/encode_rtps_message_utests.c b/src/security/builtin_plugins/tests/encode_rtps_message/src/encode_rtps_message_utests.c
index cc6cd22..ea77f41 100644
--- a/src/security/builtin_plugins/tests/encode_rtps_message/src/encode_rtps_message_utests.c
+++ b/src/security/builtin_plugins/tests/encode_rtps_message/src/encode_rtps_message_utests.c
@@ -28,6 +28,7 @@
 #include "CUnit/Test.h"
 #include "common/src/loader.h"
 #include "common/src/crypto_helper.h"
+#include "crypto_key_factory.h"
 #include "crypto_objects.h"
 #include "crypto_utils.h"
 
@@ -571,18 +572,7 @@ static session_key_material * get_local_participant_session(DDS_Security_Partici
 
 static master_key_material * get_remote_participant_key_material(DDS_Security_ParticipantCryptoHandle participant_crypto)
 {
-  participant_key_material *key_material;
-  master_key_material * master_keymat = NULL;
-  remote_participant_crypto *participant_crypto_impl = (remote_participant_crypto *)participant_crypto;
-
-  key_material = crypto_remote_participant_lookup_keymat(participant_crypto_impl, local_particpant_crypto);
-  if (key_material)
-  {
-    master_keymat = key_material->local_P2P_key_material;
-    CRYPTO_OBJECT_RELEASE(key_material);
-  }
-
-  return master_keymat;
+  return crypto_factory_get_master_key_material_for_test(crypto->crypto_key_factory, local_particpant_crypto, participant_crypto);
 }
 
 static void set_protection_kind(DDS_Security_ParticipantCryptoHandle participant_crypto, DDS_Security_ProtectionKind protection_kind)

From fa0c6777d4497f2b6bef35a24d5e532a9c56a866 Mon Sep 17 00:00:00 2001
From: Marcel Jordense <marcel.jordense@adlinktech.com>
Date: Fri, 27 Mar 2020 14:51:13 +0100
Subject: [PATCH 139/238] Remove setting volatile secure writer to incorrect
 state

Signed-off-by: Marcel Jordense <marcel.jordense@adlinktech.com>
---
 src/core/ddsi/src/q_entity.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/core/ddsi/src/q_entity.c b/src/core/ddsi/src/q_entity.c
index 23a64a9..f0fff03 100644
--- a/src/core/ddsi/src/q_entity.c
+++ b/src/core/ddsi/src/q_entity.c
@@ -3620,7 +3620,7 @@ static void new_writer_guid_common_init (struct writer *wr, const struct ddsi_se
     assert ((wr->xqos->durability.kind == DDS_DURABILITY_TRANSIENT_LOCAL) ||
             (wr->e.guid.entityid.u == NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_STATELESS_MESSAGE_WRITER));
   }
-  wr->handle_as_transient_local = (wr->xqos->durability.kind == DDS_DURABILITY_TRANSIENT_LOCAL || wr->e.guid.entityid.u == NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_VOLATILE_SECURE_WRITER);
+  wr->handle_as_transient_local = (wr->xqos->durability.kind == DDS_DURABILITY_TRANSIENT_LOCAL);
   wr->include_keyhash =
     wr->e.gv->config.generate_keyhash &&
     ((wr->e.guid.entityid.u & NN_ENTITYID_KIND_MASK) == NN_ENTITYID_KIND_WRITER_WITH_KEY);

From c8d8d2f8e692037cb33e7c45291cc4c24dc5bd26 Mon Sep 17 00:00:00 2001
From: Erik Boasson <eb@ilities.com>
Date: Thu, 26 Mar 2020 20:21:56 +0100
Subject: [PATCH 140/238] Stop threads doing handshake processing earlier

In particular before the state they depend on gets torn down.

Signed-off-by: Erik Boasson <eb@ilities.com>
---
 .../ddsi/include/dds/ddsi/ddsi_handshake.h    |  7 ++++
 .../ddsi/include/dds/ddsi/ddsi_security_omg.h |  6 ++--
 src/core/ddsi/src/ddsi_handshake.c            | 32 +++++++++----------
 src/core/ddsi/src/ddsi_security_omg.c         |  5 +++
 src/core/ddsi/src/q_init.c                    | 14 +++++---
 5 files changed, 38 insertions(+), 26 deletions(-)

diff --git a/src/core/ddsi/include/dds/ddsi/ddsi_handshake.h b/src/core/ddsi/include/dds/ddsi/ddsi_handshake.h
index 307eb72..a76f009 100644
--- a/src/core/ddsi/include/dds/ddsi/ddsi_handshake.h
+++ b/src/core/ddsi/include/dds/ddsi/ddsi_handshake.h
@@ -168,6 +168,13 @@ struct ddsi_handshake * ddsi_handshake_find(struct participant *pp, struct proxy
  */
 void ddsi_handshake_admin_init(struct ddsi_domaingv *gv);
 
+/**
+* @brief Stop handshake background processing.
+*
+* @param[in] gv         The global parameters
+*/
+void ddsi_handshake_admin_stop(struct ddsi_domaingv *gv);
+
 /**
  * @brief Deinitialze the handshake administration.
  *
diff --git a/src/core/ddsi/include/dds/ddsi/ddsi_security_omg.h b/src/core/ddsi/include/dds/ddsi/ddsi_security_omg.h
index dc63d5a..32946ba 100644
--- a/src/core/ddsi/include/dds/ddsi/ddsi_security_omg.h
+++ b/src/core/ddsi/include/dds/ddsi/ddsi_security_omg.h
@@ -1102,6 +1102,8 @@ dds_return_t q_omg_security_load( struct dds_security_context *security_context,
 
 void q_omg_security_init( struct ddsi_domaingv *gv );
 
+void q_omg_security_stop (struct ddsi_domaingv *gv);
+
 void q_omg_security_deinit( struct ddsi_domaingv *gv );
 
 bool q_omg_is_security_loaded(  struct dds_security_context *sc );
@@ -1395,10 +1397,6 @@ inline dds_return_t q_omg_security_load( UNUSED_ARG( struct dds_security_context
   return DDS_RETCODE_ERROR;
 }
 
-inline void q_omg_security_init( UNUSED_ARG( struct dds_security_context *sc) ) {}
-
-inline void q_omg_security_deinit( UNUSED_ARG( struct dds_security_context *sc) ) {}
-
 inline bool q_omg_is_security_loaded(  UNUSED_ARG( struct dds_security_context *sc )) { return false; }
 
 inline void q_omg_security_deregister_remote_reader_match(UNUSED_ARG(const struct proxy_reader *prd), UNUSED_ARG(const struct writer *wr), UNUSED_ARG(struct wr_prd_match *match))
diff --git a/src/core/ddsi/src/ddsi_handshake.c b/src/core/ddsi/src/ddsi_handshake.c
index 847c796..b23d214 100644
--- a/src/core/ddsi/src/ddsi_handshake.c
+++ b/src/core/ddsi/src/ddsi_handshake.c
@@ -1120,21 +1120,6 @@ static void release_handshake(void *arg)
   ddsi_handshake_release((struct ddsi_handshake *)arg);
 }
 
-static void ddsi_handshake_admin_delete(struct ddsi_hsadmin *hsadmin)
-{
-  if (hsadmin)
-  {
-    ddsrt_mutex_destroy(&hsadmin->lock);
-    ddsrt_avl_free(&handshake_treedef, &hsadmin->handshakes, release_handshake);
-    if (hsadmin->fsm_control)
-    {
-      dds_security_fsm_control_stop(hsadmin->fsm_control);
-      dds_security_fsm_control_free(hsadmin->fsm_control);
-    }
-    ddsrt_free(hsadmin);
-  }
-}
-
 static struct ddsi_handshake * ddsi_handshake_find_locked(
     struct ddsi_hsadmin *hsadmin,
     struct participant *pp,
@@ -1213,10 +1198,23 @@ void ddsi_handshake_admin_init(struct ddsi_domaingv *gv)
 
 void ddsi_handshake_admin_deinit(struct ddsi_domaingv *gv)
 {
-  assert(gv);
-  ddsi_handshake_admin_delete(gv->hsadmin);
+  struct ddsi_hsadmin *hsadmin = gv->hsadmin;
+  if (hsadmin)
+  {
+    ddsrt_mutex_destroy(&hsadmin->lock);
+    ddsrt_avl_free(&handshake_treedef, &hsadmin->handshakes, release_handshake);
+    if (hsadmin->fsm_control)
+      dds_security_fsm_control_free(hsadmin->fsm_control);
+    ddsrt_free(hsadmin);
+  }
 }
 
+void ddsi_handshake_admin_stop(struct ddsi_domaingv *gv)
+{
+  struct ddsi_hsadmin *hsadmin = gv->hsadmin;
+  if (hsadmin && hsadmin->fsm_control)
+    dds_security_fsm_control_stop(hsadmin->fsm_control);
+}
 
 #else
 
diff --git a/src/core/ddsi/src/ddsi_security_omg.c b/src/core/ddsi/src/ddsi_security_omg.c
index 70b2b93..46a0d0b 100644
--- a/src/core/ddsi/src/ddsi_security_omg.c
+++ b/src/core/ddsi/src/ddsi_security_omg.c
@@ -623,6 +623,11 @@ static void release_plugins (dds_security_context *sc)
   sc->crypto_context = NULL;
 }
 
+void q_omg_security_stop (struct ddsi_domaingv *gv)
+{
+  ddsi_handshake_admin_stop(gv);
+}
+
 void q_omg_security_deinit (struct ddsi_domaingv *gv)
 {
   dds_security_context *sc = gv->security_context;
diff --git a/src/core/ddsi/src/q_init.c b/src/core/ddsi/src/q_init.c
index 6e756e0..859be30 100644
--- a/src/core/ddsi/src/q_init.c
+++ b/src/core/ddsi/src/q_init.c
@@ -1518,12 +1518,12 @@ err_unicast_sockets:
   ddsrt_hh_free (gv->sertopics);
   ddsrt_mutex_destroy (&gv->sertopics_lock);
 #ifdef DDSI_INCLUDE_SECURITY
+  q_omg_security_stop (gv); // should be a no-op as it starts lazily
+  q_omg_security_deinit (gv);
   ddsi_xqos_fini (&gv->builtin_stateless_xqos_wr);
   ddsi_xqos_fini (&gv->builtin_stateless_xqos_rd);
   ddsi_xqos_fini (&gv->builtin_volatile_xqos_wr);
   ddsi_xqos_fini (&gv->builtin_volatile_xqos_rd);
-
-  q_omg_security_deinit (gv);
 #endif
   ddsi_xqos_fini (&gv->builtin_endpoint_xqos_wr);
   ddsi_xqos_fini (&gv->builtin_endpoint_xqos_rd);
@@ -1749,6 +1749,12 @@ void rtps_stop (struct ddsi_domaingv *gv)
     thread_state_asleep (ts1);
   }
 
+  /* Stop background (handshake) processing in security implementation,
+     do this only once we know no new events will be coming in. */
+#if DDSI_INCLUDE_SECURITY
+  q_omg_security_stop (gv);
+#endif
+
   /* Wait until all participants are really gone => by then we can be
      certain that no new GC requests will be added, short of what we
      do here */
@@ -1854,7 +1860,6 @@ void rtps_fini (struct ddsi_domaingv *gv)
   }
 
   ddsi_tkmap_free (gv->m_tkmap);
-
   entity_index_free (gv->entity_index);
   gv->entity_index = NULL;
   deleted_participants_admin_free (gv->deleted_participants);
@@ -1873,12 +1878,11 @@ void rtps_fini (struct ddsi_domaingv *gv)
   ddsrt_mutex_destroy (&gv->sertopics_lock);
 
 #ifdef DDSI_INCLUDE_SECURITY
+  q_omg_security_deinit (gv);
   ddsi_xqos_fini (&gv->builtin_stateless_xqos_wr);
   ddsi_xqos_fini (&gv->builtin_stateless_xqos_rd);
   ddsi_xqos_fini (&gv->builtin_volatile_xqos_wr);
   ddsi_xqos_fini (&gv->builtin_volatile_xqos_rd);
-
-  q_omg_security_deinit (gv);
 #endif
   ddsi_xqos_fini (&gv->builtin_endpoint_xqos_wr);
   ddsi_xqos_fini (&gv->builtin_endpoint_xqos_rd);

From b18fd395d3d96d745589b99e232a79007ed92865 Mon Sep 17 00:00:00 2001
From: eboasson <eb@ilities.com>
Date: Mon, 30 Mar 2020 10:32:58 +0200
Subject: [PATCH 141/238] Do not rewrite secure messages in retransmit queue
 (#456)

* Do not rewrite secure messages in retransmit queue

Messages to be retransmitted spend some time on a transmit queue, and
are subject to the rewriting of the destination information to reduce
the number of outgoing copies.  Self-evidently, altering the message
header does not sit well with encryption and/or authentication of
messages.

The way the rewriting works is that the offset of the "reader entity id"
in the DATA submessage is saved on message construction (the GUID prefix
is at a fixed location), so that it can be read and possibly zero'd out
later.  The crypto transformations move the message around and it so
happens that it can end up pointing to the key id in the encoded
message.  Zeroing that one out leads to uninterpretable messages.

This commit adds a message/event kind to distinguish between retransmit
that may and retransmit that may not be merged (and thus rewritten) and
gets used when the crypto plugin is invoked to transform a message.

Signed-off-by: Erik Boasson <eb@ilities.com>

* Update comment on changing REXMIT to REXMIT_NOMERGE

Signed-off-by: Erik Boasson <eb@ilities.com>
---
 src/core/ddsi/include/dds/ddsi/q_xmsg.h |  3 ++-
 src/core/ddsi/src/q_xevent.c            | 29 +++++++++++++++++++------
 src/core/ddsi/src/q_xmsg.c              | 19 ++++++++++++++++
 3 files changed, 43 insertions(+), 8 deletions(-)

diff --git a/src/core/ddsi/include/dds/ddsi/q_xmsg.h b/src/core/ddsi/include/dds/ddsi/q_xmsg.h
index 2b423a2..0a282fe 100644
--- a/src/core/ddsi/include/dds/ddsi/q_xmsg.h
+++ b/src/core/ddsi/include/dds/ddsi/q_xmsg.h
@@ -43,7 +43,8 @@ struct nn_xmsg_marker {
 enum nn_xmsg_kind {
   NN_XMSG_KIND_CONTROL,
   NN_XMSG_KIND_DATA,
-  NN_XMSG_KIND_DATA_REXMIT
+  NN_XMSG_KIND_DATA_REXMIT,
+  NN_XMSG_KIND_DATA_REXMIT_NOMERGE
 };
 
 /* XMSGPOOL */
diff --git a/src/core/ddsi/src/q_xevent.c b/src/core/ddsi/src/q_xevent.c
index a248eaf..ae6de3c 100644
--- a/src/core/ddsi/src/q_xevent.c
+++ b/src/core/ddsi/src/q_xevent.c
@@ -103,6 +103,7 @@ enum xeventkind_nt
 {
   XEVK_MSG,
   XEVK_MSG_REXMIT,
+  XEVK_MSG_REXMIT_NOMERGE,
   XEVK_ENTITYID,
   XEVK_NT_CALLBACK
 };
@@ -126,7 +127,7 @@ struct xevent_nt
       struct nn_xmsg *msg;
       size_t queued_rexmit_bytes;
       ddsrt_avl_node_t msg_avlnode;
-    } msg_rexmit;
+    } msg_rexmit; /* and msg_rexmit_nomerge */
     struct {
       /* xmsg is self-contained / relies on reference counts */
       struct nn_xmsg *msg;
@@ -178,7 +179,7 @@ static void update_rexmit_counts (struct xeventq *evq, struct xevent_nt *ev)
 #if 0
   EVQTRACE ("ZZZ(%p,%"PRIuSIZE")", (void *) ev, ev->u.msg_rexmit.queued_rexmit_bytes);
 #endif
-  assert (ev->kind == XEVK_MSG_REXMIT);
+  assert (ev->kind == XEVK_MSG_REXMIT || ev->kind == XEVK_MSG_REXMIT_NOMERGE);
   assert (ev->u.msg_rexmit.queued_rexmit_bytes <= evq->queued_rexmit_bytes);
   assert (evq->queued_rexmit_msgs > 0);
   evq->queued_rexmit_bytes -= ev->u.msg_rexmit.queued_rexmit_bytes;
@@ -205,9 +206,20 @@ static void trace_msg (UNUSED_ARG (struct xeventq *evq), UNUSED_ARG (const char
 
 static struct xevent_nt *lookup_msg (struct xeventq *evq, struct nn_xmsg *msg)
 {
-  assert (nn_xmsg_kind (msg) == NN_XMSG_KIND_DATA_REXMIT);
-  trace_msg (evq, "lookup-msg", msg);
-  return ddsrt_avl_lookup (&msg_xevents_treedef, &evq->msg_xevents, msg);
+  switch (nn_xmsg_kind (msg))
+  {
+    case NN_XMSG_KIND_CONTROL:
+    case NN_XMSG_KIND_DATA:
+      assert (0);
+      return NULL;
+    case NN_XMSG_KIND_DATA_REXMIT:
+      trace_msg (evq, "lookup-msg", msg);
+      return ddsrt_avl_lookup (&msg_xevents_treedef, &evq->msg_xevents, msg);
+    case NN_XMSG_KIND_DATA_REXMIT_NOMERGE:
+      return NULL;
+  }
+  assert (0);
+  return NULL;
 }
 
 static void remember_msg (struct xeventq *evq, struct xevent_nt *ev)
@@ -1324,6 +1336,7 @@ static void handle_individual_xevent_nt (struct xevent_nt *xev, struct nn_xpack
       handle_xevk_msg (xp, xev);
       break;
     case XEVK_MSG_REXMIT:
+    case XEVK_MSG_REXMIT_NOMERGE:
       handle_xevk_msg_rexmit (xp, xev);
       break;
     case XEVK_ENTITYID:
@@ -1563,7 +1576,7 @@ int qxev_msg_rexmit_wrlock_held (struct xeventq *evq, struct nn_xmsg *msg, int f
   struct xevent_nt *ev;
 
   assert (evq);
-  assert (nn_xmsg_kind (msg) == NN_XMSG_KIND_DATA_REXMIT);
+  assert (nn_xmsg_kind (msg) == NN_XMSG_KIND_DATA_REXMIT || nn_xmsg_kind (msg) == NN_XMSG_KIND_DATA_REXMIT_NOMERGE);
   ddsrt_mutex_lock (&evq->lock);
   if ((ev = lookup_msg (evq, msg)) != NULL && nn_xmsg_merge_rexmit_destinations_wrlock_held (gv, ev->u.msg_rexmit.msg, msg))
   {
@@ -1587,7 +1600,9 @@ int qxev_msg_rexmit_wrlock_held (struct xeventq *evq, struct nn_xmsg *msg, int f
   }
   else
   {
-    ev = qxev_common_nt (evq, XEVK_MSG_REXMIT);
+    const enum xeventkind_nt kind =
+      (nn_xmsg_kind (msg) == NN_XMSG_KIND_DATA_REXMIT) ? XEVK_MSG_REXMIT : XEVK_MSG_REXMIT_NOMERGE;
+    ev = qxev_common_nt (evq, kind);
     ev->u.msg_rexmit.msg = msg;
     ev->u.msg_rexmit.queued_rexmit_bytes = msg_size;
     evq->queued_rexmit_bytes += msg_size;
diff --git a/src/core/ddsi/src/q_xmsg.c b/src/core/ddsi/src/q_xmsg.c
index d450100..70c70e5 100644
--- a/src/core/ddsi/src/q_xmsg.c
+++ b/src/core/ddsi/src/q_xmsg.c
@@ -429,6 +429,7 @@ static int submsg_is_compatible (const struct nn_xmsg *msg, SubmessageKind_t smk
       break;
     case NN_XMSG_KIND_DATA:
     case NN_XMSG_KIND_DATA_REXMIT:
+    case NN_XMSG_KIND_DATA_REXMIT_NOMERGE:
       switch (smkind)
       {
         case SMID_PAD:
@@ -551,6 +552,12 @@ void nn_xmsg_submsg_remove(struct nn_xmsg *msg, struct nn_xmsg_marker sm_marker)
 {
   /* Just reset the message size to the start of the current sub-message. */
   msg->sz = sm_marker.offset;
+
+  /* Deleting the submessage means the readerId offset in a DATA_REXMIT message is no
+     longer valid.  Converting the message kind to a _NOMERGE one ensures no subsequent
+     operation will assume its validity. */
+  if (msg->kind == NN_XMSG_KIND_DATA_REXMIT)
+    msg->kind = NN_XMSG_KIND_DATA_REXMIT_NOMERGE;
 }
 
 void nn_xmsg_submsg_replace(struct nn_xmsg *msg, struct nn_xmsg_marker sm_marker, unsigned char *new_submsg, size_t new_len)
@@ -573,6 +580,17 @@ void nn_xmsg_submsg_replace(struct nn_xmsg *msg, struct nn_xmsg_marker sm_marker
 
   /* Replace the sub-message. */
   memcpy(msg->data->payload + sm_marker.offset, new_submsg, new_len);
+
+  /* The replacement submessage may have undergone any transformation and so the readerId
+     offset in a DATA_REXMIT message is potentially no longer valid.  Converting the
+     message kind to a _NOMERGE one ensures no subsequent operation will assume its
+     validity.  This is used by the security implementation when encrypting and/or signing
+     messages and apart from the offset possibly no longer being valid (for which one
+     might conceivably be able to correct), there is also the issue that it may now be
+     meaningless junk or that rewriting it would make the receiver reject it as having
+     been tampered with. */
+  if (msg->kind == NN_XMSG_KIND_DATA_REXMIT)
+    msg->kind = NN_XMSG_KIND_DATA_REXMIT_NOMERGE;
 }
 
 void nn_xmsg_submsg_append_refd_payload(struct nn_xmsg *msg, struct nn_xmsg_marker sm_marker)
@@ -1614,6 +1632,7 @@ int nn_xpack_addmsg (struct nn_xpack *xp, struct nn_xmsg *m, const uint32_t flag
       break;
     case NN_XMSG_KIND_DATA:
     case NN_XMSG_KIND_DATA_REXMIT:
+    case NN_XMSG_KIND_DATA_REXMIT_NOMERGE:
       GVTRACE ("%s("PGUIDFMT":#%"PRId64"/%u)",
                (m->kind == NN_XMSG_KIND_DATA) ? "data" : "rexmit",
                PGUID (m->kindspecific.data.wrguid),

From 4f3cbf7a1cea74ad7f9216923c008016598dd3ce Mon Sep 17 00:00:00 2001
From: Erik Boasson <eb@ilities.com>
Date: Mon, 23 Mar 2020 11:59:43 +0100
Subject: [PATCH 142/238] Clean up representation of discovery messages

* Remove the "plist" and "rawcdr" abuse of the "serdata_default" sample
  representation.

* Introduce a new "plist" topic type and a new "pserop" topic type.  The
  former represents parameter lists as used in discovery, the second
  arbitrary samples using the serialiser in ddsi_plist.c.

* Introduce sertopics for each of the built-in "topics" used by the DDSI
  discovery protocol using the two new topic types, and reference these
  in the readers/writers used in discovery.

* Construct and deconstruct the discovery message by using the
  conversion routines for these sample types, rather than fiddling with,
  e.g., the baroque interface for adding parameter lists to messages.

* As a consequence, it introduces standardized logging of received and
  transmitted discovery data and eliminates the annoying "(null)/(null)"
  and "(blob)" descriptions in the trace.

* Limits the dumping of octet sequences in discovery data to the first
  100 bytes to make the embedded certificates and permissions
  documents (somewhat) manageable.

* Eliminates the (many) null pointer checks on reader/writer topics.

* Fixes the printing of nested sequences in discovery data (not used
  before) and the formatting of GUIDs.

Various interfaces remain unchanged and so while this removes cruft from
the core code, it moves some of it into the conversion routines for the
new topic types.

It also now allocates some memory when processing incoming discovery
data, whereas before it had no need to do so.  Allowing for aliasing of
data in the new sertopics and adding a way to initialize these specific
types on the stack (both minor changes) suffices for eliminating those
allocations.

Signed-off-by: Erik Boasson <eb@ilities.com>

Check actual topic type before "downcasting"

Signed-off-by: Erik Boasson <eb@ilities.com>

Free the memory we own and is actually allocated

Signed-off-by: Erik Boasson <eb@ilities.com>

Ignore logging newlines if nothing is buffered

Signed-off-by: Erik Boasson <eb@ilities.com>

Suffix data with "(trunc)" one byte earlier

The sample printing code changed over time and now stops as soon as it
can once it has filled up the buffer.  As the return value is simply the
number of bytes written, if that number is equal to buffer size less
one (because of the terminating nul) it may or may not have been
truncated, but the likelihood is that it has been.  So add the "(trunc)"
suffix once that point has been reached.

Signed-off-by: Erik Boasson <eb@ilities.com>
---
 docs/manual/options.md                        |  10 +-
 etc/cyclonedds.rnc                            |   5 -
 etc/cyclonedds.xsd                            |   7 -
 src/core/ddsc/src/dds_topic.c                 |  20 +-
 src/core/ddsi/CMakeLists.txt                  |   6 +
 .../ddsi/include/dds/ddsi/ddsi_domaingv.h     |  14 +-
 src/core/ddsi/include/dds/ddsi/ddsi_plist.h   |   2 +-
 .../include/dds/ddsi/ddsi_plist_generic.h     |   3 +
 src/core/ddsi/include/dds/ddsi/ddsi_pmd.h     |  18 +-
 .../include/dds/ddsi/ddsi_security_exchange.h |   4 +-
 .../ddsi/include/dds/ddsi/ddsi_security_msg.h |   1 +
 .../include/dds/ddsi/ddsi_serdata_default.h   |   3 +-
 .../include/dds/ddsi/ddsi_serdata_plist.h     |  76 ++
 .../include/dds/ddsi/ddsi_serdata_pserop.h    |  78 ++
 src/core/ddsi/include/dds/ddsi/q_config.h     |   2 -
 .../ddsi/include/dds/ddsi/q_ddsi_discovery.h  |   8 +-
 src/core/ddsi/include/dds/ddsi/q_entity.h     |   4 +-
 src/core/ddsi/include/dds/ddsi/q_protocol.h   |  12 +-
 src/core/ddsi/src/ddsi_entity_index.c         |  47 +-
 src/core/ddsi/src/ddsi_plist.c                |  86 ++-
 src/core/ddsi/src/ddsi_pmd.c                  | 117 ++-
 src/core/ddsi/src/ddsi_security_exchange.c    | 271 ++-----
 src/core/ddsi/src/ddsi_security_msg.c         |   3 +-
 src/core/ddsi/src/ddsi_security_omg.c         |  97 +--
 src/core/ddsi/src/ddsi_serdata_default.c      | 153 ----
 src/core/ddsi/src/ddsi_serdata_plist.c        | 303 ++++++++
 src/core/ddsi/src/ddsi_serdata_pserop.c       | 297 ++++++++
 src/core/ddsi/src/ddsi_sertopic.c             |  26 +-
 src/core/ddsi/src/ddsi_sertopic_plist.c       |  95 +++
 src/core/ddsi/src/ddsi_sertopic_pserop.c      | 118 +++
 src/core/ddsi/src/q_config.c                  |   2 -
 src/core/ddsi/src/q_ddsi_discovery.c          | 670 +++++-------------
 src/core/ddsi/src/q_entity.c                  |  69 +-
 src/core/ddsi/src/q_init.c                    |  78 +-
 src/core/ddsi/src/q_receive.c                 |   2 +-
 src/core/ddsi/src/q_transmit.c                |   8 +-
 src/core/ddsi/src/q_xevent.c                  |   8 +-
 src/ddsrt/src/log.c                           |  18 +-
 38 files changed, 1489 insertions(+), 1252 deletions(-)
 create mode 100644 src/core/ddsi/include/dds/ddsi/ddsi_serdata_plist.h
 create mode 100644 src/core/ddsi/include/dds/ddsi/ddsi_serdata_pserop.h
 create mode 100644 src/core/ddsi/src/ddsi_serdata_plist.c
 create mode 100644 src/core/ddsi/src/ddsi_serdata_pserop.c
 create mode 100644 src/core/ddsi/src/ddsi_sertopic_plist.c
 create mode 100644 src/core/ddsi/src/ddsi_sertopic_pserop.c

diff --git a/docs/manual/options.md b/docs/manual/options.md
index 1ebf816..b343bf1 100644
--- a/docs/manual/options.md
+++ b/docs/manual/options.md
@@ -451,7 +451,7 @@ The default value is: "dds_security_crypto".
 
 
 ### //CycloneDDS/Domain/Discovery
-Children: [DSGracePeriod](#cycloneddsdomaindiscoverydsgraceperiod), [DefaultMulticastAddress](#cycloneddsdomaindiscoverydefaultmulticastaddress), [EnableTopicDiscovery](#cycloneddsdomaindiscoveryenabletopicdiscovery), [ExternalDomainId](#cycloneddsdomaindiscoveryexternaldomainid), [MaxAutoParticipantIndex](#cycloneddsdomaindiscoverymaxautoparticipantindex), [ParticipantIndex](#cycloneddsdomaindiscoveryparticipantindex), [Peers](#cycloneddsdomaindiscoverypeers), [Ports](#cycloneddsdomaindiscoveryports), [SPDPInterval](#cycloneddsdomaindiscoveryspdpinterval), [SPDPMulticastAddress](#cycloneddsdomaindiscoveryspdpmulticastaddress), [Tag](#cycloneddsdomaindiscoverytag)
+Children: [DSGracePeriod](#cycloneddsdomaindiscoverydsgraceperiod), [DefaultMulticastAddress](#cycloneddsdomaindiscoverydefaultmulticastaddress), [ExternalDomainId](#cycloneddsdomaindiscoveryexternaldomainid), [MaxAutoParticipantIndex](#cycloneddsdomaindiscoverymaxautoparticipantindex), [ParticipantIndex](#cycloneddsdomaindiscoveryparticipantindex), [Peers](#cycloneddsdomaindiscoverypeers), [Ports](#cycloneddsdomaindiscoveryports), [SPDPInterval](#cycloneddsdomaindiscoveryspdpinterval), [SPDPMulticastAddress](#cycloneddsdomaindiscoveryspdpmulticastaddress), [Tag](#cycloneddsdomaindiscoverytag)
 
 
 The Discovery element allows specifying various parameters related to the
@@ -482,14 +482,6 @@ Discovery/SPDPMulticastAddress.
 The default value is: "auto".
 
 
-#### //CycloneDDS/Domain/Discovery/EnableTopicDiscovery
-Boolean
-
-Do not use.
-
-The default value is: "true".
-
-
 #### //CycloneDDS/Domain/Discovery/ExternalDomainId
 Text
 
diff --git a/etc/cyclonedds.rnc b/etc/cyclonedds.rnc
index 7088cb5..1ee2c4d 100644
--- a/etc/cyclonedds.rnc
+++ b/etc/cyclonedds.rnc
@@ -407,11 +407,6 @@ Discovery/SPDPMulticastAddress.</p><p>The default value is:
           text
         }?
         & [ a:documentation [ xml:lang="en" """
-<p>Do not use.</p><p>The default value is: &quot;true&quot;.</p>""" ] ]
-        element EnableTopicDiscovery {
-          xsd:boolean
-        }?
-        & [ a:documentation [ xml:lang="en" """
 <p>An override for the domain id, to be used in discovery and for
 determining the port number mapping. This allows creating multiple
 domains in a single process while making them appear as a single domain
diff --git a/etc/cyclonedds.xsd b/etc/cyclonedds.xsd
index ad9cb88..d552a5c 100644
--- a/etc/cyclonedds.xsd
+++ b/etc/cyclonedds.xsd
@@ -522,7 +522,6 @@ the discovery of peers.&lt;/p&gt;</xs:documentation>
       <xs:all>
         <xs:element minOccurs="0" ref="config:DSGracePeriod"/>
         <xs:element minOccurs="0" ref="config:DefaultMulticastAddress"/>
-        <xs:element minOccurs="0" ref="config:EnableTopicDiscovery"/>
         <xs:element minOccurs="0" ref="config:ExternalDomainId"/>
         <xs:element minOccurs="0" ref="config:MaxAutoParticipantIndex"/>
         <xs:element minOccurs="0" ref="config:ParticipantIndex"/>
@@ -556,12 +555,6 @@ Discovery/SPDPMulticastAddress.&lt;/p&gt;&lt;p&gt;The default value is:
 &amp;quot;auto&amp;quot;.&lt;/p&gt;</xs:documentation>
     </xs:annotation>
   </xs:element>
-  <xs:element name="EnableTopicDiscovery" type="xs:boolean">
-    <xs:annotation>
-      <xs:documentation>
-&lt;p&gt;Do not use.&lt;/p&gt;&lt;p&gt;The default value is: &amp;quot;true&amp;quot;.&lt;/p&gt;</xs:documentation>
-    </xs:annotation>
-  </xs:element>
   <xs:element name="ExternalDomainId" type="xs:string">
     <xs:annotation>
       <xs:documentation>
diff --git a/src/core/ddsc/src/dds_topic.c b/src/core/ddsc/src/dds_topic.c
index 7a8ad16..a07b4e3 100644
--- a/src/core/ddsc/src/dds_topic.c
+++ b/src/core/ddsc/src/dds_topic.c
@@ -247,6 +247,7 @@ static dds_return_t lookup_and_check_ktopic (struct dds_ktopic **ktp_out, dds_pa
 
 static dds_entity_t create_topic_pp_locked (struct dds_participant *pp, struct dds_ktopic *ktp, bool implicit, struct ddsi_sertopic *sertopic_registered, const dds_listener_t *listener, const ddsi_plist_t *sedp_plist)
 {
+  (void) sedp_plist;
   dds_entity_t hdl;
   dds_topic *tp = dds_alloc (sizeof (*tp));
   hdl = dds_entity_init (&tp->m_entity, &pp->m_entity, DDS_KIND_TOPIC, implicit, NULL, listener, DDS_TOPIC_STATUS_MASK);
@@ -254,25 +255,6 @@ static dds_entity_t create_topic_pp_locked (struct dds_participant *pp, struct d
   dds_entity_register_child (&pp->m_entity, &tp->m_entity);
   tp->m_ktopic = ktp;
   tp->m_stopic = sertopic_registered;
-
-  /* Publish Topic */
-  if (sedp_plist)
-  {
-    struct participant *ddsi_pp;
-    ddsi_plist_t plist;
-
-    thread_state_awake (lookup_thread_state (), &pp->m_entity.m_domain->gv);
-    ddsi_pp = entidx_lookup_participant_guid (pp->m_entity.m_domain->gv.entity_index, &pp->m_entity.m_guid);
-    assert (ddsi_pp);
-
-    ddsi_plist_init_empty (&plist);
-    ddsi_plist_mergein_missing (&plist, sedp_plist, ~(uint64_t)0, ~(uint64_t)0);
-    ddsi_xqos_mergein_missing (&plist.qos, ktp->qos, ~(uint64_t)0);
-    sedp_write_topic (ddsi_pp, &plist);
-    ddsi_plist_fini (&plist);
-    thread_state_asleep (lookup_thread_state ());
-  }
-
   dds_entity_init_complete (&tp->m_entity);
   return hdl;
 }
diff --git a/src/core/ddsi/CMakeLists.txt b/src/core/ddsi/CMakeLists.txt
index 6ef3f88..e20181a 100644
--- a/src/core/ddsi/CMakeLists.txt
+++ b/src/core/ddsi/CMakeLists.txt
@@ -24,8 +24,12 @@ PREPEND(srcs_ddsi "${CMAKE_CURRENT_LIST_DIR}/src"
     ddsi_handshake.c
     ddsi_serdata.c
     ddsi_serdata_default.c
+    ddsi_serdata_pserop.c
+    ddsi_serdata_plist.c
     ddsi_sertopic.c
     ddsi_sertopic_default.c
+    ddsi_sertopic_pserop.c
+    ddsi_sertopic_plist.c
     ddsi_iid.c
     ddsi_tkmap.c
     ddsi_vendor.c
@@ -91,6 +95,8 @@ PREPEND(hdrs_private_ddsi "${CMAKE_CURRENT_LIST_DIR}/include/dds/ddsi"
     ddsi_serdata.h
     ddsi_sertopic.h
     ddsi_serdata_default.h
+    ddsi_serdata_pserop.h
+    ddsi_serdata_plist.h
     ddsi_iid.h
     ddsi_tkmap.h
     ddsi_vendor.h
diff --git a/src/core/ddsi/include/dds/ddsi/ddsi_domaingv.h b/src/core/ddsi/include/dds/ddsi/ddsi_domaingv.h
index ed0dc0a..0deb8ea 100644
--- a/src/core/ddsi/include/dds/ddsi/ddsi_domaingv.h
+++ b/src/core/ddsi/include/dds/ddsi/ddsi_domaingv.h
@@ -294,8 +294,18 @@ struct ddsi_domaingv {
      transmit queue*/
   struct serdatapool *serpool;
   struct nn_xmsgpool *xmsgpool;
-  struct ddsi_sertopic *plist_topic; /* used for all discovery data */
-  struct ddsi_sertopic *rawcdr_topic; /* used for participant message data */
+  struct ddsi_sertopic *spdp_topic; /* key = participant GUID */
+  struct ddsi_sertopic *sedp_reader_topic; /* key = endpoint GUID */
+  struct ddsi_sertopic *sedp_writer_topic; /* key = endpoint GUID */
+  struct ddsi_sertopic *pmd_topic; /* participant message data */
+#ifdef DDSI_INCLUDE_SECURITY
+  struct ddsi_sertopic *spdp_secure_topic; /* key = participant GUID */
+  struct ddsi_sertopic *sedp_reader_secure_topic; /* key = endpoint GUID */
+  struct ddsi_sertopic *sedp_writer_secure_topic; /* key = endpoint GUID */
+  struct ddsi_sertopic *pmd_secure_topic; /* participant message data */
+  struct ddsi_sertopic *pgm_stateless_topic; /* participant generic message */
+  struct ddsi_sertopic *pgm_volatile_topic; /* participant generic message */
+#endif
 
   ddsrt_mutex_t sendq_lock;
   ddsrt_cond_t sendq_cond;
diff --git a/src/core/ddsi/include/dds/ddsi/ddsi_plist.h b/src/core/ddsi/include/dds/ddsi/ddsi_plist.h
index bd3a998..3f8c283 100644
--- a/src/core/ddsi/include/dds/ddsi/ddsi_plist.h
+++ b/src/core/ddsi/include/dds/ddsi/ddsi_plist.h
@@ -311,7 +311,7 @@ struct nn_rsample_info;
 struct nn_rdata;
 
 DDS_EXPORT unsigned char *ddsi_plist_quickscan (struct nn_rsample_info *dest, const struct nn_rmsg *rmsg, const ddsi_plist_src_t *src);
-DDS_EXPORT const unsigned char *ddsi_plist_findparam_native_unchecked (const void *src, nn_parameterid_t pid);
+DDS_EXPORT dds_return_t ddsi_plist_findparam_checking (const void *buf, size_t bufsz, uint16_t encoding, nn_parameterid_t needle, void **needlep, size_t *needlesz);
 
 #if defined (__cplusplus)
 }
diff --git a/src/core/ddsi/include/dds/ddsi/ddsi_plist_generic.h b/src/core/ddsi/include/dds/ddsi/ddsi_plist_generic.h
index 481aa6c..6408942 100644
--- a/src/core/ddsi/include/dds/ddsi/ddsi_plist_generic.h
+++ b/src/core/ddsi/include/dds/ddsi/ddsi_plist_generic.h
@@ -19,6 +19,7 @@
 #include "dds/export.h"
 
 #include "dds/ddsrt/attributes.h"
+#include "dds/ddsrt/retcode.h"
 
 #if defined (__cplusplus)
 extern "C" {
@@ -48,9 +49,11 @@ enum pserop {
 DDS_EXPORT void plist_fini_generic (void * __restrict dst, const enum pserop *desc, bool aliased);
 DDS_EXPORT dds_return_t plist_deser_generic (void * __restrict dst, const void * __restrict src, size_t srcsize, bool bswap, const enum pserop * __restrict desc);
 DDS_EXPORT dds_return_t plist_ser_generic (void **dst, size_t *dstsize, const void *src, const enum pserop * __restrict desc);
+DDS_EXPORT dds_return_t plist_ser_generic_be (void **dst, size_t *dstsize, const void *src, const enum pserop * __restrict desc);
 DDS_EXPORT dds_return_t plist_unalias_generic (void * __restrict dst, const enum pserop * __restrict desc);
 DDS_EXPORT bool plist_equal_generic (const void *srcx, const void *srcy, const enum pserop * __restrict desc);
 DDS_EXPORT size_t plist_memsize_generic (const enum pserop * __restrict desc);
+DDS_EXPORT size_t plist_print_generic (char * __restrict buf, size_t bufsize, const void * __restrict src, const enum pserop * __restrict desc);
 
 #if defined (__cplusplus)
 }
diff --git a/src/core/ddsi/include/dds/ddsi/ddsi_pmd.h b/src/core/ddsi/include/dds/ddsi/ddsi_pmd.h
index 0948247..40cf62a 100644
--- a/src/core/ddsi/include/dds/ddsi/ddsi_pmd.h
+++ b/src/core/ddsi/include/dds/ddsi/ddsi_pmd.h
@@ -12,7 +12,12 @@
 #ifndef DDSI_PMD_H
 #define DDSI_PMD_H
 
+#include <stdint.h>
 #include "dds/ddsrt/time.h"
+#include "dds/ddsi/ddsi_serdata.h"
+#include "dds/ddsi/ddsi_plist_generic.h"
+#include "dds/ddsi/ddsi_guid.h"
+#include "dds/ddsi/ddsi_xqos.h"
 
 #if defined (__cplusplus)
 extern "C" {
@@ -25,9 +30,20 @@ struct nn_xpack;
 struct participant;
 struct receiver_state;
 
+typedef struct ParticipantMessageData {
+  ddsi_guid_prefix_t participantGuidPrefix;
+  uint32_t kind; /* really 4 octets */
+  ddsi_octetseq_t value;
+} ParticipantMessageData_t;
+
+extern const enum pserop participant_message_data_ops[];
+extern size_t participant_message_data_nops;
+extern const enum pserop participant_message_data_ops_key[];
+extern size_t participant_message_data_nops_key;
+
 void write_pmd_message_guid (struct ddsi_domaingv * const gv, struct ddsi_guid *pp_guid, unsigned pmd_kind);
 void write_pmd_message (struct thread_state1 * const ts1, struct nn_xpack *xp, struct participant *pp, unsigned pmd_kind);
-void handle_pmd_message (const struct receiver_state *rst, ddsrt_wctime_t timestamp, uint32_t statusinfo, const void *vdata, uint32_t len);
+void handle_pmd_message (const struct receiver_state *rst, struct ddsi_serdata *sample_common);
 
 #if defined (__cplusplus)
 }
diff --git a/src/core/ddsi/include/dds/ddsi/ddsi_security_exchange.h b/src/core/ddsi/include/dds/ddsi/ddsi_security_exchange.h
index b271e7e..07268d0 100644
--- a/src/core/ddsi/include/dds/ddsi/ddsi_security_exchange.h
+++ b/src/core/ddsi/include/dds/ddsi/ddsi_security_exchange.h
@@ -29,8 +29,8 @@ extern "C" {
 #define GMCLASSID_SECURITY_DATAREADER_CRYPTO_TOKENS     "dds.sec.datareader_crypto_tokens"
 
 bool write_auth_handshake_message(const struct participant *pp, const struct proxy_participant *proxypp, nn_dataholderseq_t *mdata, bool request, const nn_message_identity_t *related_message_id);
-void handle_auth_handshake_message(const struct receiver_state *rst, ddsi_entityid_t wr_entity_id, ddsrt_wctime_t timestamp,  unsigned statusinfo, const void *vdata, size_t len);
-void handle_crypto_exchange_message(const struct receiver_state *rst, ddsi_entityid_t wr_entity_id, ddsrt_wctime_t timestamp, unsigned statusinfo, const void *vdata, unsigned len);
+void handle_auth_handshake_message(const struct receiver_state *rst, ddsi_entityid_t wr_entity_id, struct ddsi_serdata *sample);
+void handle_crypto_exchange_message(const struct receiver_state *rst, struct ddsi_serdata *sample);
 void auth_get_serialized_participant_data(struct participant *pp, ddsi_octetseq_t *seq);
 bool write_crypto_participant_tokens(const struct participant *pp, const struct proxy_participant *proxypp, const nn_dataholderseq_t *tokens);
 bool write_crypto_writer_tokens(const struct writer *wr, const struct proxy_reader *prd, const nn_dataholderseq_t *tokens);
diff --git a/src/core/ddsi/include/dds/ddsi/ddsi_security_msg.h b/src/core/ddsi/include/dds/ddsi/ddsi_security_msg.h
index 072a3eb..99c5c31 100644
--- a/src/core/ddsi/include/dds/ddsi/ddsi_security_msg.h
+++ b/src/core/ddsi/include/dds/ddsi/ddsi_security_msg.h
@@ -95,6 +95,7 @@ nn_participant_generic_message_serialize(
    size_t *len);
 
 DDS_EXPORT extern const enum pserop pserop_participant_generic_message[];
+DDS_EXPORT extern const size_t pserop_participant_generic_message_nops;
 
 DDS_EXPORT int
 volatile_secure_data_filter(
diff --git a/src/core/ddsi/include/dds/ddsi/ddsi_serdata_default.h b/src/core/ddsi/include/dds/ddsi/ddsi_serdata_default.h
index 0eed3d6..50c9744 100644
--- a/src/core/ddsi/include/dds/ddsi/ddsi_serdata_default.h
+++ b/src/core/ddsi/include/dds/ddsi/ddsi_serdata_default.h
@@ -18,6 +18,7 @@
 #include "dds/ddsrt/avl.h"
 #include "dds/ddsi/ddsi_serdata.h"
 #include "dds/ddsi/ddsi_sertopic.h"
+#include "dds/ddsi/ddsi_plist_generic.h"
 
 #include "dds/dds.h"
 
@@ -136,8 +137,6 @@ extern DDS_EXPORT const struct ddsi_sertopic_ops ddsi_sertopic_ops_default;
 
 extern DDS_EXPORT const struct ddsi_serdata_ops ddsi_serdata_ops_cdr;
 extern DDS_EXPORT const struct ddsi_serdata_ops ddsi_serdata_ops_cdr_nokey;
-extern DDS_EXPORT const struct ddsi_serdata_ops ddsi_serdata_ops_plist;
-extern DDS_EXPORT const struct ddsi_serdata_ops ddsi_serdata_ops_rawcdr;
 
 struct serdatapool * ddsi_serdatapool_new (void);
 void ddsi_serdatapool_free (struct serdatapool * pool);
diff --git a/src/core/ddsi/include/dds/ddsi/ddsi_serdata_plist.h b/src/core/ddsi/include/dds/ddsi/ddsi_serdata_plist.h
new file mode 100644
index 0000000..1ceee87
--- /dev/null
+++ b/src/core/ddsi/include/dds/ddsi/ddsi_serdata_plist.h
@@ -0,0 +1,76 @@
+/*
+ * Copyright(c) 2006 to 2018 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+#ifndef DDSI_SERDATA_PLIST_H
+#define DDSI_SERDATA_PLIST_H
+
+#include "dds/ddsi/q_protocol.h" /* for nn_parameterid_t */
+#include "dds/ddsi/ddsi_keyhash.h"
+#include "dds/ddsi/ddsi_serdata.h"
+#include "dds/ddsi/ddsi_sertopic.h"
+
+#include "dds/dds.h"
+
+#if defined (__cplusplus)
+extern "C" {
+#endif
+
+/* There is an alignment requirement on the raw data (it must be at
+   offset mod 8 for the conversion to/from a dds_stream to work).
+   So we define two types: one without any additional padding, and
+   one where the appropriate amount of padding is inserted */
+#define DDSI_SERDATA_PLIST_PREPAD     \
+  struct ddsi_serdata c;              \
+  uint32_t pos;                       \
+  uint32_t size;                      \
+  nn_vendorid_t vendorid;             \
+  nn_protocol_version_t protoversion; \
+  ddsi_keyhash_t keyhash
+#define DDSI_SERDATA_PLIST_POSTPAD    \
+  uint16_t identifier;                \
+  uint16_t options;                   \
+  char data[]
+
+struct ddsi_serdata_plist_unpadded {
+  DDSI_SERDATA_PLIST_PREPAD;
+  DDSI_SERDATA_PLIST_POSTPAD;
+};
+
+#ifdef __GNUC__
+#define DDSI_SERDATA_PLIST_PAD(n) ((n) % 8)
+#else
+#define DDSI_SERDATA_PLIST_PAD(n) (n)
+#endif
+
+struct ddsi_serdata_plist {
+  DDSI_SERDATA_PLIST_PREPAD;
+  char pad[DDSI_SERDATA_PLIST_PAD (8 - (offsetof (struct ddsi_serdata_plist_unpadded, data) % 8))];
+  DDSI_SERDATA_PLIST_POSTPAD;
+};
+
+#undef DDSI_SERDATA_PLIST_PAD
+#undef DDSI_SERDATA_PLIST_POSTPAD
+#undef DDSI_SERDATA_PLIST_PREPAD
+
+struct ddsi_sertopic_plist {
+  struct ddsi_sertopic c;
+  uint16_t native_encoding_identifier; /* PL_CDR_(LE|BE) */
+  nn_parameterid_t keyparam;
+};
+
+extern DDS_EXPORT const struct ddsi_sertopic_ops ddsi_sertopic_ops_plist;
+extern DDS_EXPORT const struct ddsi_serdata_ops ddsi_serdata_ops_plist;
+
+#if defined (__cplusplus)
+}
+#endif
+
+#endif
diff --git a/src/core/ddsi/include/dds/ddsi/ddsi_serdata_pserop.h b/src/core/ddsi/include/dds/ddsi/ddsi_serdata_pserop.h
new file mode 100644
index 0000000..6771a07
--- /dev/null
+++ b/src/core/ddsi/include/dds/ddsi/ddsi_serdata_pserop.h
@@ -0,0 +1,78 @@
+/*
+ * Copyright(c) 2006 to 2018 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+#ifndef DDSI_SERDATA_PSEROP_H
+#define DDSI_SERDATA_PSEROP_H
+
+#include "dds/ddsi/ddsi_serdata.h"
+#include "dds/ddsi/ddsi_sertopic.h"
+#include "dds/ddsi/ddsi_plist_generic.h"
+
+#include "dds/dds.h"
+
+#if defined (__cplusplus)
+extern "C" {
+#endif
+
+/* There is an alignment requirement on the raw data (it must be at
+   offset mod 8 for the conversion to/from a dds_stream to work).
+   So we define two types: one without any additional padding, and
+   one where the appropriate amount of padding is inserted */
+#define DDSI_SERDATA_PSEROP_PREPAD    \
+  struct ddsi_serdata c;              \
+  void *sample;                       \
+  bool keyless; /*cached from topic*/ \
+  uint32_t pos;                       \
+  uint32_t size
+#define DDSI_SERDATA_PSEROP_POSTPAD   \
+  uint16_t identifier;                \
+  uint16_t options;                   \
+  char data[]
+
+struct ddsi_serdata_pserop_unpadded {
+  DDSI_SERDATA_PSEROP_PREPAD;
+  DDSI_SERDATA_PSEROP_POSTPAD;
+};
+
+#ifdef __GNUC__
+#define DDSI_SERDATA_PSEROP_PAD(n) ((n) % 8)
+#else
+#define DDSI_SERDATA_PSEROP_PAD(n) (n)
+#endif
+
+struct ddsi_serdata_pserop {
+  DDSI_SERDATA_PSEROP_PREPAD;
+  char pad[DDSI_SERDATA_PSEROP_PAD (8 - (offsetof (struct ddsi_serdata_pserop_unpadded, data) % 8))];
+  DDSI_SERDATA_PSEROP_POSTPAD;
+};
+
+#undef DDSI_SERDATA_PSEROP_PAD
+#undef DDSI_SERDATA_PSEROP_POSTPAD
+#undef DDSI_SERDATA_PSEROP_PREPAD
+
+struct ddsi_sertopic_pserop {
+  struct ddsi_sertopic c;
+  uint16_t native_encoding_identifier; /* CDR_(LE|BE) */
+  size_t memsize;
+  size_t nops;
+  const enum pserop *ops;
+  size_t nops_key;
+  const enum pserop *ops_key; /* NULL <=> no key; != NULL <=> 16-byte key at offset 0 */
+};
+
+extern DDS_EXPORT const struct ddsi_sertopic_ops ddsi_sertopic_ops_pserop;
+extern DDS_EXPORT const struct ddsi_serdata_ops ddsi_serdata_ops_pserop;
+
+#if defined (__cplusplus)
+}
+#endif
+
+#endif
diff --git a/src/core/ddsi/include/dds/ddsi/q_config.h b/src/core/ddsi/include/dds/ddsi/q_config.h
index 16c8149..dfc16bd 100644
--- a/src/core/ddsi/include/dds/ddsi/q_config.h
+++ b/src/core/ddsi/include/dds/ddsi/q_config.h
@@ -261,8 +261,6 @@ struct config
 
   unsigned delivery_queue_maxsamples;
 
-  int do_topic_discovery;
-
   uint32_t max_msg_size;
   uint32_t fragment_size;
 
diff --git a/src/core/ddsi/include/dds/ddsi/q_ddsi_discovery.h b/src/core/ddsi/include/dds/ddsi/q_ddsi_discovery.h
index e18dde9..3b71125 100644
--- a/src/core/ddsi/include/dds/ddsi/q_ddsi_discovery.h
+++ b/src/core/ddsi/include/dds/ddsi/q_ddsi_discovery.h
@@ -25,7 +25,11 @@ struct nn_rsample_info;
 struct nn_rdata;
 struct ddsi_plist;
 
-void get_participant_builtin_topic_data(const struct participant *pp, struct nn_xmsg *mpayload, bool be);
+struct participant_builtin_topic_data_locators {
+  struct nn_locators_one def_uni_loc_one, def_multi_loc_one, meta_uni_loc_one, meta_multi_loc_one;
+};
+
+void get_participant_builtin_topic_data (const struct participant *pp, ddsi_plist_t *dst, struct participant_builtin_topic_data_locators *locs);
 
 int spdp_write (struct participant *pp);
 int spdp_dispose_unregister (struct participant *pp);
@@ -35,8 +39,6 @@ int sedp_write_reader (struct reader *rd);
 int sedp_dispose_unregister_writer (struct writer *wr);
 int sedp_dispose_unregister_reader (struct reader *rd);
 
-int sedp_write_topic (struct participant *pp, const struct ddsi_plist *datap);
-
 int builtins_dqueue_handler (const struct nn_rsample_info *sampleinfo, const struct nn_rdata *fragchain, const ddsi_guid_t *rdguid, void *qarg);
 
 #if defined (__cplusplus)
diff --git a/src/core/ddsi/include/dds/ddsi/q_entity.h b/src/core/ddsi/include/dds/ddsi/q_entity.h
index 6e2b17f..86e8826 100644
--- a/src/core/ddsi/include/dds/ddsi/q_entity.h
+++ b/src/core/ddsi/include/dds/ddsi/q_entity.h
@@ -291,7 +291,7 @@ struct writer
   struct addrset *ssm_as;
 #endif
   uint32_t alive_vclock; /* virtual clock counting transitions between alive/not-alive */
-  const struct ddsi_sertopic * topic; /* topic, but may be NULL for built-ins */
+  const struct ddsi_sertopic * topic; /* topic */
   struct addrset *as; /* set of addresses to publish to */
   struct addrset *as_group; /* alternate case, used for SPDP, when using Cloud with multiple bootstrap locators */
   struct xevent *heartbeat_xevent; /* timed event for "periodically" publishing heartbeats when unack'd data present, NULL <=> unreliable */
@@ -350,7 +350,7 @@ struct reader
 #ifdef DDSI_INCLUDE_NETWORK_PARTITIONS
   struct addrset *as;
 #endif
-  const struct ddsi_sertopic * topic; /* topic is NULL for built-in readers */
+  const struct ddsi_sertopic * topic; /* topic */
   uint32_t num_writers; /* total number of matching PROXY writers */
   ddsrt_avl_tree_t writers; /* all matching PROXY writers, see struct rd_pwr_match */
   ddsrt_avl_tree_t local_writers; /* all matching LOCAL writers, see struct rd_wr_match */
diff --git a/src/core/ddsi/include/dds/ddsi/q_protocol.h b/src/core/ddsi/include/dds/ddsi/q_protocol.h
index 9fcda7f..688a8a1 100644
--- a/src/core/ddsi/include/dds/ddsi/q_protocol.h
+++ b/src/core/ddsi/include/dds/ddsi/q_protocol.h
@@ -203,7 +203,7 @@ typedef uint16_t nn_parameterid_t; /* spec says short */
 typedef struct nn_parameter {
   nn_parameterid_t parameterid;
   uint16_t length; /* spec says signed short */
-  /* char value[]; O! how I long for C99 */
+  /* char value[] */
 } nn_parameter_t;
 
 typedef struct Data_DataFrag_common {
@@ -318,18 +318,10 @@ typedef union Submessage {
   NackFrag_t nackfrag;
 } Submessage_t;
 
-DDSRT_WARNING_MSVC_OFF(4200)
-typedef struct ParticipantMessageData {
-  ddsi_guid_prefix_t participantGuidPrefix;
-  uint32_t kind; /* really 4 octets */
-  uint32_t length;
-  char value[];
-} ParticipantMessageData_t;
-DDSRT_WARNING_MSVC_ON(4200)
 #define PARTICIPANT_MESSAGE_DATA_KIND_UNKNOWN 0x0u
 #define PARTICIPANT_MESSAGE_DATA_KIND_AUTOMATIC_LIVELINESS_UPDATE 0x1u
 #define PARTICIPANT_MESSAGE_DATA_KIND_MANUAL_LIVELINESS_UPDATE 0x2u
-#define PARTICIPANT_MESSAGE_DATA_VENDER_SPECIFIC_KIND_FLAG 0x8000000u
+#define PARTICIPANT_MESSAGE_DATA_VENDOR_SPECIFIC_KIND_FLAG 0x8000000u
 
 #define PID_VENDORSPECIFIC_FLAG 0x8000u
 #define PID_UNRECOGNIZED_INCOMPATIBLE_FLAG 0x4000u
diff --git a/src/core/ddsi/src/ddsi_entity_index.c b/src/core/ddsi/src/ddsi_entity_index.c
index e23c922..fd40aae 100644
--- a/src/core/ddsi/src/ddsi_entity_index.c
+++ b/src/core/ddsi/src/ddsi_entity_index.c
@@ -70,20 +70,6 @@ static int entity_guid_eq_wrapper (const void *a, const void *b)
   return entity_guid_eq (a, b);
 }
 
-static int all_entities_compare_isbuiltin (const struct entity_common *e, nn_vendorid_t vendor)
-{
-  const unsigned char *guid_bytes = (const unsigned char *) &e->guid;
-  if (guid_bytes[0] != 0 && guid_bytes[0] != 0xff)
-    return is_builtin_endpoint (e->guid.entityid, vendor);
-  else
-  {
-    for (size_t i = 1; i < sizeof (e->guid); i++)
-      if (guid_bytes[i] != guid_bytes[0])
-        return is_builtin_endpoint (e->guid.entityid, vendor) && !is_local_orphan_endpoint (e);
-    return 0;
-  }
-}
-
 static int all_entities_compare (const void *va, const void *vb)
 {
   const struct entity_common *a = va;
@@ -104,28 +90,20 @@ static int all_entities_compare (const void *va, const void *vb)
     case EK_WRITER: {
       const struct writer *wra = va;
       const struct writer *wrb = vb;
-      if (!all_entities_compare_isbuiltin (a, NN_VENDORID_ECLIPSE)) {
-        assert ((wra->xqos->present & QP_TOPIC_NAME) && wra->xqos->topic_name);
-        tp_a = wra->xqos->topic_name;
-      }
-      if (!all_entities_compare_isbuiltin (b, NN_VENDORID_ECLIPSE)) {
-        assert ((wrb->xqos->present & QP_TOPIC_NAME) && wrb->xqos->topic_name);
-        tp_b = wrb->xqos->topic_name;
-      }
+      assert ((wra->xqos->present & QP_TOPIC_NAME) && wra->xqos->topic_name);
+      assert ((wrb->xqos->present & QP_TOPIC_NAME) && wrb->xqos->topic_name);
+      tp_a = wra->xqos->topic_name;
+      tp_b = wrb->xqos->topic_name;
       break;
     }
 
     case EK_READER: {
       const struct reader *rda = va;
       const struct reader *rdb = vb;
-      if (!all_entities_compare_isbuiltin (a, NN_VENDORID_ECLIPSE)) {
-        assert ((rda->xqos->present & QP_TOPIC_NAME) && rda->xqos->topic_name);
-        tp_a = rda->xqos->topic_name;
-      }
-      if (!all_entities_compare_isbuiltin (b, NN_VENDORID_ECLIPSE)) {
-        assert ((rdb->xqos->present & QP_TOPIC_NAME) && rdb->xqos->topic_name);
-        tp_b = rdb->xqos->topic_name;
-      }
+      assert ((rda->xqos->present & QP_TOPIC_NAME) && rda->xqos->topic_name);
+      assert ((rdb->xqos->present & QP_TOPIC_NAME) && rdb->xqos->topic_name);
+      tp_a = rda->xqos->topic_name;
+      tp_b = rdb->xqos->topic_name;
       break;
     }
 
@@ -133,14 +111,11 @@ static int all_entities_compare (const void *va, const void *vb)
     case EK_PROXY_READER: {
       const struct generic_proxy_endpoint *ga = va;
       const struct generic_proxy_endpoint *gb = vb;
-      if (!all_entities_compare_isbuiltin (a, ga->c.vendor)) {
-        assert ((ga->c.xqos->present & QP_TOPIC_NAME) && ga->c.xqos->topic_name);
+      /* built-in reader/writer proxies don't have topic name set */
+      if (ga->c.xqos->present & QP_TOPIC_NAME)
         tp_a = ga->c.xqos->topic_name;
-      }
-      if (!all_entities_compare_isbuiltin (b, gb->c.vendor)) {
-        assert ((gb->c.xqos->present & QP_TOPIC_NAME) && gb->c.xqos->topic_name);
+      if (gb->c.xqos->present & QP_TOPIC_NAME)
         tp_b = gb->c.xqos->topic_name;
-      }
       break;
     }
   }
diff --git a/src/core/ddsi/src/ddsi_plist.c b/src/core/ddsi/src/ddsi_plist.c
index f440276..cd91486 100644
--- a/src/core/ddsi/src/ddsi_plist.c
+++ b/src/core/ddsi/src/ddsi_plist.c
@@ -1028,6 +1028,19 @@ dds_return_t plist_ser_generic (void **dst, size_t *dstsize, const void *src, co
   return ret;
 }
 
+dds_return_t plist_ser_generic_be (void **dst, size_t *dstsize, const void *src, const enum pserop * __restrict desc)
+{
+  const size_t srcoff = 0;
+  size_t dstoff = 0;
+  dds_return_t ret;
+  *dstsize = ser_generic_size (src, srcoff, desc);
+  if ((*dst = ddsrt_malloc (*dstsize == 0 ? 1 : *dstsize)) == NULL)
+    return DDS_RETCODE_OUT_OF_RESOURCES;
+  ret = ser_generic_embeddable (*dst, &dstoff, src, srcoff, desc, true);
+  assert (dstoff == *dstsize);
+  return ret;
+}
+
 static dds_return_t unalias_generic (void * __restrict dst, size_t * __restrict dstoff, bool gen_seq_aliased, const enum pserop * __restrict desc)
 {
 #define COMPLEX(basecase_, type_, ...) do {                      \
@@ -1249,7 +1262,14 @@ static uint32_t isprint_runlen (uint32_t n, const unsigned char *xs)
 
 static bool prtf_octetseq (char * __restrict *buf, size_t * __restrict bufsize, uint32_t n, const unsigned char *xs)
 {
+  /* Truncate octet sequences: 100 is arbitrary but experience suggests it is
+     usually enough, and truncating it helps a lot when printing handshake
+     messages during authentication. */
+  const uint32_t lim = 100;
+  bool trunc = (n > lim);
   uint32_t i = 0;
+  if (trunc)
+    n = lim;
   while (i < n)
   {
     uint32_t m = isprint_runlen (n - i, xs);
@@ -1272,7 +1292,7 @@ static bool prtf_octetseq (char * __restrict *buf, size_t * __restrict bufsize,
       }
     }
   }
-  return true;
+  return trunc ? prtf (buf, bufsize, "...") : true;
 }
 
 static bool print_generic1 (char * __restrict *buf, size_t * __restrict bufsize, const void *src, size_t srcoff, const enum pserop * __restrict desc, const char *sep)
@@ -1387,7 +1407,7 @@ static bool print_generic1 (char * __restrict *buf, size_t * __restrict bufsize,
       }
       case XG: { /* GUID */
         ddsi_guid_t const * const x = deser_generic_src (src, &srcoff, alignof (ddsi_guid_t));
-        if (!prtf (buf, bufsize, "%s"PGUIDFMT, sep, PGUID (*x)))
+        if (!prtf (buf, bufsize, "%s{"PGUIDFMT"}", sep, PGUID (*x)))
           return false;
         srcoff += sizeof (*x);
         break;
@@ -1415,14 +1435,13 @@ static bool print_generic1 (char * __restrict *buf, size_t * __restrict bufsize,
         if (!prtf (buf, bufsize, "}"))
           return false;
         srcoff += sizeof (*x);
-        while (*++desc != XSTOP) { }
         break;
       }
       case Xopt:
         break;
     }
     sep = ":";
-    desc++;
+    desc = pserop_advance(desc);
   }
 }
 
@@ -2845,20 +2864,47 @@ dds_return_t ddsi_plist_init_frommsg (ddsi_plist_t *dest, char **nextafterplist,
   return DDS_RETCODE_BAD_PARAMETER;
 }
 
-const unsigned char *ddsi_plist_findparam_native_unchecked (const void *src, nn_parameterid_t pid)
+dds_return_t ddsi_plist_findparam_checking (const void *buf, size_t bufsz, uint16_t encoding, nn_parameterid_t needle, void **needlep, size_t *needlesz)
 {
-  /* Scans the parameter list starting at src looking just for pid, returning NULL if not found;
-     no further checking is done and the input is assumed to valid and in native format.  Clearly
-     this is only to be used for internally generated data -- to precise, for grabbing the key
-     value from discovery data that is being sent out. */
-  const nn_parameter_t *par = src;
-  while (par->parameterid != pid)
+  /* set needle to PID_SENTINEL if all you want to do is scan the structure */
+  assert (needle == PID_SENTINEL || (needlep != NULL && needlesz != NULL));
+  bool bswap;
+  if (needlep)
+    *needlep = NULL;
+  switch (encoding)
   {
-    if (par->parameterid == PID_SENTINEL)
-      return NULL;
-    par = (const nn_parameter_t *) ((const char *) (par + 1) + par->length);
+    case PL_CDR_LE:
+      bswap = (DDSRT_ENDIAN != DDSRT_LITTLE_ENDIAN);
+      break;
+    case PL_CDR_BE:
+      bswap = (DDSRT_ENDIAN != DDSRT_BIG_ENDIAN);
+      break;
+    default:
+      return DDS_RETCODE_BAD_PARAMETER;
   }
-  return (unsigned char *) (par + 1);
+  const unsigned char *pl = buf;
+  const unsigned char *endp = pl + bufsz;
+  while (pl + sizeof (nn_parameter_t) <= endp)
+  {
+    const nn_parameter_t *par = (const nn_parameter_t *) pl;
+    nn_parameterid_t pid;
+    uint16_t length;
+    pid = (nn_parameterid_t) (bswap ? ddsrt_bswap2u (par->parameterid) : par->parameterid);
+    length = (uint16_t) (bswap ? ddsrt_bswap2u (par->length) : par->length);
+    pl += sizeof (*par);
+
+    if (pid == PID_SENTINEL)
+      return (needlep && *needlep == NULL) ? DDS_RETCODE_NOT_FOUND : DDS_RETCODE_OK;
+    else if (length > (size_t) (endp - pl) || (length % 4) != 0 /* DDSI 9.4.2.11 */)
+      return DDS_RETCODE_BAD_PARAMETER;
+    else if (pid == needle)
+    {
+      *needlep = (void *) pl;
+      *needlesz = length;
+    }
+    pl += length;
+  }
+  return DDS_RETCODE_BAD_PARAMETER;
 }
 
 unsigned char *ddsi_plist_quickscan (struct nn_rsample_info *dest, const struct nn_rmsg *rmsg, const ddsi_plist_src_t *src)
@@ -3379,6 +3425,9 @@ static void plist_or_xqos_print (char * __restrict *buf, size_t * __restrict buf
   /* shift == 0: plist, shift > 0: just qos */
   const char *sep = "";
   uint64_t pw, qw;
+  if (*bufsize == 0)
+    return;
+  (*buf)[0] = 0;
   if (shift > 0)
   {
     const dds_qos_t *qos = src;
@@ -3464,3 +3513,10 @@ void ddsi_plist_log (uint32_t cat, const struct ddsrt_log_cfg *logcfg, const dds
 {
   plist_or_xqos_log (cat, logcfg, plist, 0, ~(uint64_t)0, ~(uint64_t)0);
 }
+
+size_t plist_print_generic (char * __restrict buf, size_t bufsize, const void * __restrict src, const enum pserop * __restrict desc)
+{
+  const size_t bufsize_in = bufsize;
+  (void) print_generic (&buf, &bufsize, src, 0, desc);
+  return bufsize_in - bufsize;
+}
diff --git a/src/core/ddsi/src/ddsi_pmd.c b/src/core/ddsi/src/ddsi_pmd.c
index 9e7db55..dd19eee 100644
--- a/src/core/ddsi/src/ddsi_pmd.c
+++ b/src/core/ddsi/src/ddsi_pmd.c
@@ -14,6 +14,7 @@
 #include "dds/ddsi/ddsi_pmd.h"
 #include "dds/ddsi/ddsi_serdata.h"
 #include "dds/ddsi/ddsi_serdata_default.h"
+#include "dds/ddsi/ddsi_serdata_pserop.h"
 #include "dds/ddsi/ddsi_tkmap.h"
 #include "dds/ddsi/q_bswap.h"
 #include "dds/ddsi/q_entity.h"
@@ -30,20 +31,13 @@
 
 #include "dds/ddsi/sysdeps.h"
 
-static void debug_print_rawdata (const struct ddsi_domaingv *gv, const char *msg, const void *data, size_t len)
-{
-  const unsigned char *c = data;
-  size_t i;
-  GVTRACE ("%s<", msg);
-  for (i = 0; i < len; i++)
-  {
-    if (32 < c[i] && c[i] <= 127)
-      GVTRACE ("%s%c", (i > 0 && (i%4) == 0) ? " " : "", c[i]);
-    else
-      GVTRACE ("%s\\x%02x", (i > 0 && (i%4) == 0) ? " " : "", c[i]);
-  }
-  GVTRACE (">");
-}
+/* note: treating guid prefix + kind as if it were a GUID because that matches
+   the octet-sequence/sequence-of-uint32 distinction between the specified wire
+   representation and the internal representation */
+const enum pserop participant_message_data_ops[] = { XG, XO, XSTOP };
+size_t participant_message_data_nops = sizeof (participant_message_data_ops) / sizeof (participant_message_data_ops[0]);
+const enum pserop participant_message_data_ops_key[] = { XG, XSTOP };
+size_t participant_message_data_nops_key = sizeof (participant_message_data_ops_key) / sizeof (participant_message_data_ops_key[0]);
 
 void write_pmd_message_guid (struct ddsi_domaingv * const gv, struct ddsi_guid *pp_guid, unsigned pmd_kind)
 {
@@ -67,10 +61,8 @@ void write_pmd_message (struct thread_state1 * const ts1, struct nn_xpack *xp, s
 #define PMD_DATA_LENGTH 1
   struct ddsi_domaingv * const gv = pp->e.gv;
   struct writer *wr;
-  union {
-    ParticipantMessageData_t pmd;
-    char pad[offsetof (ParticipantMessageData_t, value) + PMD_DATA_LENGTH];
-  } u;
+  unsigned char data[PMD_DATA_LENGTH] = { 0 };
+  ParticipantMessageData_t pmd;
   struct ddsi_serdata *serdata;
   struct ddsi_tkmap_instance *tk;
 
@@ -80,18 +72,11 @@ void write_pmd_message (struct thread_state1 * const ts1, struct nn_xpack *xp, s
     return;
   }
 
-  u.pmd.participantGuidPrefix = nn_hton_guid_prefix (pp->e.guid.prefix);
-  u.pmd.kind = ddsrt_toBE4u (pmd_kind);
-  u.pmd.length = PMD_DATA_LENGTH;
-  memset (u.pmd.value, 0, u.pmd.length);
-
-  struct ddsi_rawcdr_sample raw = {
-    .blob = &u,
-    .size = offsetof (ParticipantMessageData_t, value) + PMD_DATA_LENGTH,
-    .key = &u.pmd,
-    .keysize = 16
-  };
-  serdata = ddsi_serdata_from_sample (gv->rawcdr_topic, SDK_DATA, &raw);
+  pmd.participantGuidPrefix = pp->e.guid.prefix;
+  pmd.kind = pmd_kind;
+  pmd.value.length = (uint32_t) sizeof (data);
+  pmd.value.value = data;
+  serdata = ddsi_serdata_from_sample (gv->pmd_topic, SDK_DATA, &pmd);
   serdata->timestamp = ddsrt_time_wallclock ();
 
   tk = ddsi_tkmap_lookup_instance_ref (gv->m_tkmap, serdata);
@@ -100,66 +85,44 @@ void write_pmd_message (struct thread_state1 * const ts1, struct nn_xpack *xp, s
 #undef PMD_DATA_LENGTH
 }
 
-void handle_pmd_message (const struct receiver_state *rst, ddsrt_wctime_t timestamp, uint32_t statusinfo, const void *vdata, uint32_t len)
+void handle_pmd_message (const struct receiver_state *rst, struct ddsi_serdata *sample_common)
 {
-  const struct CDRHeader *data = vdata; /* built-ins not deserialized (yet) */
-  const int bswap = (data->identifier == CDR_LE) ^ (DDSRT_ENDIAN == DDSRT_LITTLE_ENDIAN);
+  /* use sample with knowledge of internal representation: there's a deserialized sample inside already */
+  const struct ddsi_serdata_pserop *sample = (const struct ddsi_serdata_pserop *) sample_common;
   struct proxy_participant *proxypp;
   ddsi_guid_t ppguid;
   struct lease *l;
-  RSTTRACE (" PMD ST%x", statusinfo);
-  if (data->identifier != CDR_LE && data->identifier != CDR_BE)
+  RSTTRACE (" PMD ST%x", sample->c.statusinfo);
+  switch (sample->c.statusinfo & (NN_STATUSINFO_DISPOSE | NN_STATUSINFO_UNREGISTER))
   {
-    RSTTRACE (" PMD data->identifier %u !?\n", ntohs (data->identifier));
-    return;
-  }
-
-  switch (statusinfo & (NN_STATUSINFO_DISPOSE | NN_STATUSINFO_UNREGISTER))
-  {
-    case 0:
-      if (offsetof (ParticipantMessageData_t, value) > len - sizeof (struct CDRHeader))
-        debug_print_rawdata (rst->gv, " SHORT1", data, len);
-      else
+    case 0: {
+      const ParticipantMessageData_t *pmd = sample->sample;
+      RSTTRACE (" pp %"PRIx32":%"PRIx32":%"PRIx32" kind %"PRIu32" data %"PRIu32, PGUIDPREFIX (pmd->participantGuidPrefix), pmd->kind, pmd->value.length);
+      ppguid.prefix = pmd->participantGuidPrefix;
+      ppguid.entityid.u = NN_ENTITYID_PARTICIPANT;
+      if ((proxypp = entidx_lookup_proxy_participant_guid (rst->gv->entity_index, &ppguid)) == NULL)
+        RSTTRACE (" PPunknown");
+      else if (pmd->kind == PARTICIPANT_MESSAGE_DATA_KIND_MANUAL_LIVELINESS_UPDATE &&
+               (l = ddsrt_atomic_ldvoidp (&proxypp->minl_man)) != NULL)
       {
-        const ParticipantMessageData_t *pmd = (ParticipantMessageData_t *) (data + 1);
-        ddsi_guid_prefix_t p = nn_ntoh_guid_prefix (pmd->participantGuidPrefix);
-        uint32_t kind = ntohl (pmd->kind);
-        uint32_t length = bswap ? ddsrt_bswap4u (pmd->length) : pmd->length;
-        RSTTRACE (" pp %"PRIx32":%"PRIx32":%"PRIx32" kind %u data %u", p.u[0], p.u[1], p.u[2], kind, length);
-        if (len - sizeof (struct CDRHeader) - offsetof (ParticipantMessageData_t, value) < length)
-          debug_print_rawdata (rst->gv, " SHORT2", pmd->value, len - sizeof (struct CDRHeader) - offsetof (ParticipantMessageData_t, value));
-        else
-          debug_print_rawdata (rst->gv, "", pmd->value, length);
-        ppguid.prefix = p;
-        ppguid.entityid.u = NN_ENTITYID_PARTICIPANT;
-        if ((proxypp = entidx_lookup_proxy_participant_guid (rst->gv->entity_index, &ppguid)) == NULL)
-          RSTTRACE (" PPunknown");
-        else if (kind == PARTICIPANT_MESSAGE_DATA_KIND_MANUAL_LIVELINESS_UPDATE &&
-                 (l = ddsrt_atomic_ldvoidp (&proxypp->minl_man)) != NULL)
-        {
-          /* Renew lease for entity with shortest manual-by-participant lease */
-          lease_renew (l, ddsrt_time_elapsed ());
-        }
+        /* Renew lease for entity with shortest manual-by-participant lease */
+        lease_renew (l, ddsrt_time_elapsed ());
       }
       break;
+    }
 
     case NN_STATUSINFO_DISPOSE:
     case NN_STATUSINFO_UNREGISTER:
-    case NN_STATUSINFO_DISPOSE | NN_STATUSINFO_UNREGISTER:
-      /* Serialized key; BE or LE doesn't matter as both fields are
-         defined as octets.  */
-      if (len < sizeof (struct CDRHeader) + sizeof (ddsi_guid_prefix_t))
-        debug_print_rawdata (rst->gv, " SHORT3", data, len);
+    case NN_STATUSINFO_DISPOSE | NN_STATUSINFO_UNREGISTER: {
+      const ParticipantMessageData_t *pmd = sample->sample;
+      ppguid.prefix = pmd->participantGuidPrefix;
+      ppguid.entityid.u = NN_ENTITYID_PARTICIPANT;
+      if (delete_proxy_participant_by_guid (rst->gv, &ppguid, sample->c.timestamp, 0) < 0)
+        RSTTRACE (" unknown");
       else
-      {
-        ppguid.prefix = nn_ntoh_guid_prefix (*((ddsi_guid_prefix_t *) (data + 1)));
-        ppguid.entityid.u = NN_ENTITYID_PARTICIPANT;
-        if (delete_proxy_participant_by_guid (rst->gv, &ppguid, timestamp, 0) < 0)
-          RSTTRACE (" unknown");
-        else
-          RSTTRACE (" delete");
-      }
+        RSTTRACE (" delete");
       break;
+    }
   }
   RSTTRACE ("\n");
 }
diff --git a/src/core/ddsi/src/ddsi_security_exchange.c b/src/core/ddsi/src/ddsi_security_exchange.c
index 45a6aed..6d8061d 100644
--- a/src/core/ddsi/src/ddsi_security_exchange.c
+++ b/src/core/ddsi/src/ddsi_security_exchange.c
@@ -22,6 +22,7 @@
 #include "dds/ddsi/ddsi_serdata_default.h"
 #include "dds/ddsi/ddsi_security_omg.h"
 #include "dds/ddsi/ddsi_handshake.h"
+#include "dds/ddsi/ddsi_serdata_pserop.h"
 #include "dds/ddsi/q_ddsi_discovery.h"
 #include "dds/ddsi/ddsi_tkmap.h"
 #include "dds/ddsi/q_xmsg.h"
@@ -29,79 +30,11 @@
 #include "dds/ddsi/q_log.h"
 #include "dds/ddsi/q_bswap.h"
 
-//#define SECURITY_LOG_MESSAGE_DATA
-
-#ifdef SECURITY_LOG_MESSAGE_DATA
-static void nn_property_seq_log(struct ddsi_domaingv *gv, const dds_propertyseq_t *seq)
-{
-  uint32_t i;
-
-  GVTRACE("{");
-  for (i = 0; i < seq->n; i++) {
-    GVTRACE("n=%s,v=%s", seq->props[i].name, seq->props[i].value);
-  }
-  GVTRACE("}");
-}
-
-static void nn_binary_property_seq_log(struct ddsi_domaingv *gv, const dds_binarypropertyseq_t *seq)
-{
-  uint32_t i;
-
-  GVTRACE("{");
-  for (i = 0; i < seq->n; i++) {
-    uint32_t j;
-    GVTRACE("n=%s,v={", seq->props[i].name);
-    for (j = 0; j < seq->props[i].value.length; j++) {
-      GVTRACE("%02x", seq->props[i].value.value[j]);
-    }
-    GVTRACE("}");
-  }
-  GVTRACE("}");
-}
-
-static void nn_dataholder_seq_log(struct ddsi_domaingv *gv, const char *prefix, const nn_dataholderseq_t *dhseq)
-{
-  uint32_t i;
-
-  GVTRACE("%s={", prefix);
-  for (i = 0; i < dhseq->n; i++) {
-    GVTRACE("cid=%s,", dhseq->tags[i].class_id);
-    nn_property_seq_log(gv, &dhseq->tags[i].properties);
-    GVTRACE(",");
-    nn_binary_property_seq_log(gv, &dhseq->tags[i].binary_properties);
-  }
-  GVTRACE("}");
-}
-#endif
-
-static void nn_participant_generic_message_log(struct ddsi_domaingv *gv, const struct nn_participant_generic_message *msg, int conv)
-{
-  ddsi_guid_t spguid = conv ? nn_ntoh_guid(msg->message_identity.source_guid ): msg->message_identity.source_guid;
-  ddsi_guid_t rmguid = conv ? nn_ntoh_guid(msg->related_message_identity.source_guid) : msg->related_message_identity.source_guid;
-  ddsi_guid_t dpguid = conv ? nn_ntoh_guid(msg->destination_participant_guid) : msg->destination_participant_guid;
-  ddsi_guid_t deguid = conv ? nn_ntoh_guid(msg->destination_endpoint_guid) : msg->destination_endpoint_guid;
-  ddsi_guid_t seguid = conv ? nn_ntoh_guid(msg->source_endpoint_guid) : msg->source_endpoint_guid;
-
-  GVTRACE (" msg=");
-  GVTRACE("mi=" PGUIDFMT "#%" PRId64 ",", PGUID(spguid), msg->message_identity.sequence_number);
-  GVTRACE("rmi=" PGUIDFMT "#%" PRId64 ",", PGUID(rmguid), msg->related_message_identity.sequence_number);
-  GVTRACE("dpg=" PGUIDFMT ",", PGUID(dpguid));
-  GVTRACE("deg=" PGUIDFMT ",", PGUID(deguid));
-  GVTRACE("seg=" PGUIDFMT ",", PGUID(seguid));
-  GVTRACE("cid=%s", msg->message_class_id);
-#ifdef SECURITY_LOG_MESSAGE_DATA
-  nn_dataholder_seq_log(gv, ",mdata", &msg->message_data);
-#endif
-  GVTRACE ("\n");
-}
-
 bool write_auth_handshake_message(const struct participant *pp, const struct proxy_participant *proxypp, nn_dataholderseq_t *mdata, bool request, const nn_message_identity_t *related_message_id)
 {
   struct ddsi_domaingv *gv = pp->e.gv;
   struct nn_participant_generic_message pmg;
   struct ddsi_serdata *serdata;
-  unsigned char *blob;
-  size_t len;
   struct writer *wr;
   int64_t seq;
   struct proxy_reader *prd;
@@ -129,27 +62,10 @@ bool write_auth_handshake_message(const struct participant *pp, const struct pro
     nn_participant_generic_message_init(&pmg, &wr->e.guid, seq, &proxypp->e.guid, NULL, NULL, DDS_SECURITY_AUTH_HANDSHAKE, mdata, related_message_id);
   }
 
-  if (nn_participant_generic_message_serialize(&pmg, &blob, &len) != DDS_RETCODE_OK)
-    return false;
-
-  GVTRACE("write_handshake("PGUIDFMT" --> "PGUIDFMT")(lguid="PGUIDFMT" rguid="PGUIDFMT") ",
-      PGUID (wr->e.guid), PGUID (prd_guid),
-      PGUID (pp->e.guid), PGUID (proxypp->e.guid));
-  nn_participant_generic_message_log(gv, &pmg, 1);
-
-  struct ddsi_rawcdr_sample raw = {
-      .blob = blob,
-      .size = len,
-      .key = NULL,
-      .keysize = 0
-  };
-  serdata = ddsi_serdata_from_sample (gv->rawcdr_topic, SDK_DATA, &raw);
+  serdata = ddsi_serdata_from_sample (wr->topic, SDK_DATA, &pmg);
   serdata->timestamp = ddsrt_time_wallclock ();
-
   result = enqueue_sample_wrlock_held (wr, seq, NULL, serdata, prd, 1) == 0;
   ddsi_serdata_unref (serdata);
-  dds_free(blob);
-
   ddsrt_mutex_unlock (&wr->e.lock);
   nn_participant_generic_message_deinit(&pmg);
 
@@ -159,71 +75,53 @@ bool write_auth_handshake_message(const struct participant *pp, const struct pro
 void auth_get_serialized_participant_data(struct participant *pp, ddsi_octetseq_t *seq)
 {
   struct nn_xmsg *mpayload;
+  ddsi_plist_t ps;
+  struct participant_builtin_topic_data_locators locs;
   size_t sz;
   char *payload;
-
   mpayload = nn_xmsg_new (pp->e.gv->xmsgpool, &pp->e.guid, pp, 0, NN_XMSG_KIND_DATA);
-
-  get_participant_builtin_topic_data(pp, mpayload, true);
+  get_participant_builtin_topic_data (pp, &ps, &locs);
+  ddsi_plist_addtomsg_bo (mpayload, &ps, ~(uint64_t)0, ~(uint64_t)0, true);
+  nn_xmsg_addpar_sentinel_bo (mpayload, true);
+  ddsi_plist_fini (&ps);
   payload = nn_xmsg_payload (&sz, mpayload);
-
-  seq->length = (uint32_t)sz;
-  seq->value = ddsrt_malloc(sz);
-  memcpy(seq->value, payload, sz);
+  seq->length = (uint32_t) sz;
+  seq->value = ddsrt_malloc (sz);
+  memcpy (seq->value, payload, sz);
   nn_xmsg_free (mpayload);
 }
 
-void handle_auth_handshake_message(const struct receiver_state *rst, ddsi_entityid_t wr_entity_id, ddsrt_wctime_t timestamp, unsigned statusinfo, const void *vdata, size_t len)
+void handle_auth_handshake_message(const struct receiver_state *rst, ddsi_entityid_t wr_entity_id, struct ddsi_serdata *sample_common)
 {
-  const struct CDRHeader *hdr = vdata; /* built-ins not deserialized (yet) */
-  const bool bswap = (hdr->identifier == CDR_LE) ^ DDSRT_LITTLE_ENDIAN;
-  const void *data = (void *) (hdr + 1);
-  size_t size = (len - sizeof(struct CDRHeader));
-  struct nn_participant_generic_message msg;
+  const struct ddsi_serdata_pserop *sample = (const struct ddsi_serdata_pserop *) sample_common;
+  const struct nn_participant_generic_message *msg = sample->sample;
   struct participant *pp = NULL;
   struct proxy_writer *pwr = NULL;
   ddsi_guid_t guid;
-  ddsi_guid_t *pwr_guid;
+  const ddsi_guid_t *pwr_guid;
   struct ddsi_handshake *handshake;
 
   DDSRT_UNUSED_ARG(wr_entity_id);
-  DDSRT_UNUSED_ARG(timestamp);
 
-  RSTTRACE ("recv_handshake ST%x", statusinfo);
-  if ((hdr->identifier != CDR_LE) && (hdr->identifier != PL_CDR_LE) &&
-      (hdr->identifier != CDR_BE) && (hdr->identifier != PL_CDR_BE))
+  if (msg->message_identity.source_guid.entityid.u == NN_ENTITYID_PARTICIPANT)
   {
-    RSTTRACE (" data->identifier %d !?\n", ntohs (hdr->identifier));
-    return;
-  }
-
-  if (nn_participant_generic_message_deseralize(&msg, data, size, bswap) < 0)
-  {
-    RSTTRACE ("deserialize failed\n");
-    goto err_deser;
-  }
-
-  nn_participant_generic_message_log(rst->gv, &msg, 0);
-
-  if (msg.message_identity.source_guid.entityid.u == NN_ENTITYID_PARTICIPANT)
-  {
-    guid = msg.message_identity.source_guid;
+    guid = msg->message_identity.source_guid;
     guid.entityid.u = NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_STATELESS_MESSAGE_WRITER;
-    pwr_guid= &guid;
+    pwr_guid = &guid;
   }
-  else if (msg.message_identity.source_guid.entityid.u == NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_STATELESS_MESSAGE_WRITER)
+  else if (msg->message_identity.source_guid.entityid.u == NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_STATELESS_MESSAGE_WRITER)
   {
-    pwr_guid= &msg.message_identity.source_guid;
+    pwr_guid = &msg->message_identity.source_guid;
   }
   else
   {
     RSTTRACE ("invalid source entity id\n");
-    goto invalid_source;
+    return;
   }
 
-  if ((pp = entidx_lookup_participant_guid(rst->gv->entity_index, &msg.destination_participant_guid)) == NULL)
+  if ((pp = entidx_lookup_participant_guid(rst->gv->entity_index, &msg->destination_participant_guid)) == NULL)
   {
-    RSTTRACE ("destination participant ("PGUIDFMT") not found\n", PGUID(msg.destination_participant_guid));
+    RSTTRACE ("destination participant ("PGUIDFMT") not found\n", PGUID (msg->destination_participant_guid));
   }
   else if ((pwr = entidx_lookup_proxy_writer_guid(rst->gv->entity_index, pwr_guid)) == NULL)
   {
@@ -235,15 +133,10 @@ void handle_auth_handshake_message(const struct receiver_state *rst, ddsi_entity
   }
   else
   {
-//    RSTTRACE (" ("PGUIDFMT" --> "PGUIDFMT")\n", PGUID (pwr->c.proxypp->e.guid), PGUID (pp->e.guid));
-    ddsi_handshake_handle_message(handshake, pp, pwr->c.proxypp, &msg);
-    ddsi_handshake_release(handshake);
+    //RSTTRACE (" ("PGUIDFMT" --> "PGUIDFMT")\n", PGUID (pwr->c.proxypp->e.guid), PGUID (pp->e.guid));
+    ddsi_handshake_handle_message (handshake, pp, pwr->c.proxypp, msg);
+    ddsi_handshake_release (handshake);
   }
-
-invalid_source:
-  nn_participant_generic_message_deinit(&msg);
-err_deser:
-  return;
 }
 
 static bool write_crypto_exchange_message(const struct participant *pp, const ddsi_guid_t *dst_pguid, const ddsi_guid_t *src_eguid, const ddsi_guid_t *dst_eguid, const char *classid, const nn_dataholderseq_t *tokens)
@@ -254,8 +147,6 @@ static bool write_crypto_exchange_message(const struct participant *pp, const dd
   struct ddsi_serdata *serdata;
   struct proxy_reader *prd;
   ddsi_guid_t prd_guid;
-  unsigned char *data;
-  size_t len;
   struct writer *wr;
   seqno_t seq;
   int r;
@@ -278,30 +169,11 @@ static bool write_crypto_exchange_message(const struct participant *pp, const dd
 
   /* Get serialized message. */
   nn_participant_generic_message_init(&pmg, &wr->e.guid, seq, dst_pguid, dst_eguid, src_eguid, classid, tokens, NULL);
-  nn_participant_generic_message_serialize(&pmg, &data, &len);
-
-  nn_participant_generic_message_log(gv, &pmg, 0);
-
-  /* Get the key value. */
-  ddsrt_md5_state_t md5st;
-  ddsrt_md5_byte_t digest[16];
-  ddsrt_md5_init (&md5st);
-  ddsrt_md5_append (&md5st, (const ddsrt_md5_byte_t *)data, sizeof (nn_message_identity_t));
-  ddsrt_md5_finish (&md5st, digest);
-
-  /* Write the sample. */
-  struct ddsi_rawcdr_sample raw = {
-    .blob = data,
-    .size = len,
-    .key = digest,
-    .keysize = 16
-  };
-  serdata = ddsi_serdata_from_sample (gv->rawcdr_topic, SDK_DATA, &raw);
+  serdata = ddsi_serdata_from_sample (wr->topic, SDK_DATA, &pmg);
+  serdata->timestamp = ddsrt_time_wallclock ();
   tk = ddsi_tkmap_lookup_instance_ref (gv->m_tkmap, serdata);
-
   r = write_sample_p2p_wrlock_held(wr, seq, NULL, serdata, tk, prd);
   ddsrt_mutex_unlock (&wr->e.lock);
-  ddsrt_free(data);
   ddsi_tkmap_instance_unref (gv->m_tkmap, tk);
   ddsi_serdata_unref (serdata);
 
@@ -331,86 +203,51 @@ bool write_crypto_reader_tokens(const struct reader *rd, const struct proxy_writ
   return write_crypto_exchange_message(pp, &proxypp->e.guid, &rd->e.guid, &pwr->e.guid, GMCLASSID_SECURITY_DATAREADER_CRYPTO_TOKENS, tokens);
 }
 
-void handle_crypto_exchange_message(const struct receiver_state *rst, ddsi_entityid_t wr_entity_id, ddsrt_wctime_t timestamp, unsigned statusinfo, const void *vdata, unsigned len)
+void handle_crypto_exchange_message(const struct receiver_state *rst, struct ddsi_serdata *sample_common)
 {
-  struct ddsi_domaingv *gv = rst->gv;
-  const struct CDRHeader *hdr = vdata; /* built-ins not deserialized (yet) */
-  const int bswap = (hdr->identifier == CDR_LE) ^ DDSRT_LITTLE_ENDIAN;
-  const void *data = (void *) (hdr + 1);
-  unsigned size = (unsigned)(len - sizeof(struct CDRHeader));
-  struct nn_participant_generic_message msg;
-  ddsi_guid_t rd_guid;
-  ddsi_guid_t pwr_guid;
+  struct ddsi_domaingv * const gv = rst->gv;
+  const struct ddsi_serdata_pserop *sample = (const struct ddsi_serdata_pserop *) sample_common;
+  const struct nn_participant_generic_message *msg = sample->sample;
   ddsi_guid_t proxypp_guid;
-  struct participant *pp;
-  struct proxy_participant *proxypp;
 
-  DDSRT_UNUSED_ARG(timestamp);
-
-  rd_guid.prefix = rst->dst_guid_prefix;
-  rd_guid.entityid.u = NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_VOLATILE_SECURE_READER;
-  pwr_guid.prefix = rst->src_guid_prefix;
-  pwr_guid.entityid = wr_entity_id;
-
-  GVTRACE ("recv crypto tokens ("PGUIDFMT" --> "PGUIDFMT") ST%x", PGUID (pwr_guid), PGUID (rd_guid), statusinfo);
-
-  memset(&msg, 0, sizeof(msg));
-  if (nn_participant_generic_message_deseralize(&msg, data, size, bswap) < 0)
-    goto deser_msg_failed;
-
-  nn_participant_generic_message_log(gv, &msg, 0);
-
-  if (!msg.message_class_id)
-  {
-    ddsi_guid_t guid;
-    guid.prefix = rst->dst_guid_prefix;
-    guid.entityid.u = NN_ENTITYID_PARTICIPANT;
-    GVWARNING("participant "PGUIDFMT" received a crypto exchange message with empty class_id", PGUID(guid));
-    goto invalid_msg;
-  }
-
-  proxypp_guid.prefix = msg.message_identity.source_guid.prefix;
+  proxypp_guid.prefix = msg->message_identity.source_guid.prefix;
   proxypp_guid.entityid.u = NN_ENTITYID_PARTICIPANT;
 
-  if (strcmp(GMCLASSID_SECURITY_PARTICIPANT_CRYPTO_TOKENS, msg.message_class_id) == 0)
+  if (strcmp(GMCLASSID_SECURITY_PARTICIPANT_CRYPTO_TOKENS, msg->message_class_id) == 0)
   {
-    pp = entidx_lookup_participant_guid(gv->entity_index, &msg.destination_participant_guid);
+    struct participant * const pp = entidx_lookup_participant_guid(gv->entity_index, &msg->destination_participant_guid);
     if (!pp)
     {
-      GVWARNING("received a crypto exchange message from "PGUIDFMT" with participant unknown "PGUIDFMT, PGUID(proxypp_guid), PGUID(msg.destination_participant_guid));
-      goto invalid_msg;
+      GVWARNING("received a crypto exchange message from "PGUIDFMT" with participant unknown "PGUIDFMT, PGUID(proxypp_guid), PGUID(msg->destination_participant_guid));
+      return;
     }
-    proxypp = entidx_lookup_proxy_participant_guid(gv->entity_index, &proxypp_guid);
+    struct proxy_participant *proxypp = entidx_lookup_proxy_participant_guid(gv->entity_index, &proxypp_guid);
     if (!proxypp)
     {
-      GVWARNING("received a crypto exchange message from "PGUIDFMT" with proxy participant unknown "PGUIDFMT, PGUID(proxypp_guid), PGUID(msg.destination_participant_guid));
-      goto invalid_msg;
+      GVWARNING("received a crypto exchange message from "PGUIDFMT" with proxy participant unknown "PGUIDFMT, PGUID(proxypp_guid), PGUID(msg->destination_participant_guid));
+      return;
     }
-    q_omg_security_set_participant_crypto_tokens(pp, proxypp, &msg.message_data);
+    q_omg_security_set_participant_crypto_tokens(pp, proxypp, &msg->message_data);
   }
-  else if (strcmp(GMCLASSID_SECURITY_DATAWRITER_CRYPTO_TOKENS, msg.message_class_id) == 0)
+  else if (strcmp(GMCLASSID_SECURITY_DATAWRITER_CRYPTO_TOKENS, msg->message_class_id) == 0)
   {
-    struct reader *rd;
-
-    rd = entidx_lookup_reader_guid(gv->entity_index, &msg.destination_endpoint_guid);
+    struct reader * const rd = entidx_lookup_reader_guid(gv->entity_index, &msg->destination_endpoint_guid);
     if (!rd)
     {
-      GVWARNING("received a crypto exchange message from "PGUIDFMT" with reader unknown "PGUIDFMT, PGUID(proxypp_guid), PGUID(msg.destination_participant_guid));
-      goto invalid_msg;
+      GVWARNING("received a crypto exchange message from "PGUIDFMT" with reader unknown "PGUIDFMT, PGUID(proxypp_guid), PGUID(msg->destination_participant_guid));
+      return;
     }
-    q_omg_security_set_remote_writer_crypto_tokens(rd, &msg.source_endpoint_guid, &msg.message_data);
+    q_omg_security_set_remote_writer_crypto_tokens(rd, &msg->source_endpoint_guid, &msg->message_data);
   }
-  else if (strcmp(GMCLASSID_SECURITY_DATAREADER_CRYPTO_TOKENS, msg.message_class_id) == 0)
+  else if (strcmp(GMCLASSID_SECURITY_DATAREADER_CRYPTO_TOKENS, msg->message_class_id) == 0)
   {
-    struct writer *wr;
-
-    wr = entidx_lookup_writer_guid(gv->entity_index, &msg.destination_endpoint_guid);
+    struct writer * const wr = entidx_lookup_writer_guid(gv->entity_index, &msg->destination_endpoint_guid);
     if (!wr)
     {
-      GVWARNING("received a crypto exchange message from "PGUIDFMT" with writer unknown "PGUIDFMT, PGUID(proxypp_guid), PGUID(msg.destination_participant_guid));
-      goto invalid_msg;
+      GVWARNING("received a crypto exchange message from "PGUIDFMT" with writer unknown "PGUIDFMT, PGUID(proxypp_guid), PGUID(msg->destination_participant_guid));
+      return;
     }
-    q_omg_security_set_remote_reader_crypto_tokens(wr, &msg.source_endpoint_guid, &msg.message_data);
+    q_omg_security_set_remote_reader_crypto_tokens(wr, &msg->source_endpoint_guid, &msg->message_data);
   }
   else
   {
@@ -419,12 +256,6 @@ void handle_crypto_exchange_message(const struct receiver_state *rst, ddsi_entit
     guid.entityid.u = NN_ENTITYID_PARTICIPANT;
     GVWARNING("participant "PGUIDFMT" received a crypto exchange message with unknown class_id", PGUID(guid));
   }
-
-invalid_msg:
-  nn_participant_generic_message_deinit(&msg);
-deser_msg_failed:
-  return;
 }
 
-
 #endif /* DDSI_INCLUDE_SECURITY */
diff --git a/src/core/ddsi/src/ddsi_security_msg.c b/src/core/ddsi/src/ddsi_security_msg.c
index 8838327..ce44537 100644
--- a/src/core/ddsi/src/ddsi_security_msg.c
+++ b/src/core/ddsi/src/ddsi_security_msg.c
@@ -25,7 +25,6 @@
 #include "dds/ddsi/ddsi_plist.h"
 #include "dds/security/core/dds_security_utils.h"
 
-
 const enum pserop pserop_participant_generic_message[] =
 {
   /* nn_participant_generic_message */
@@ -47,7 +46,7 @@ const enum pserop pserop_participant_generic_message[] =
   XSTOP,
   XSTOP                /* end                                            */
 };
-
+const size_t pserop_participant_generic_message_nops = sizeof (pserop_participant_generic_message) / sizeof (pserop_participant_generic_message[0]);
 
 static void
 alias_simple_sequence(ddsi_octetseq_t *dst, const ddsi_octetseq_t *src, size_t elem_size)
diff --git a/src/core/ddsi/src/ddsi_security_omg.c b/src/core/ddsi/src/ddsi_security_omg.c
index 46a0d0b..c046a72 100644
--- a/src/core/ddsi/src/ddsi_security_omg.c
+++ b/src/core/ddsi/src/ddsi_security_omg.c
@@ -762,61 +762,6 @@ error:
   return DDS_RETCODE_ERROR;
 }
 
-static const char * get_builtin_topic_name(ddsi_entityid_t id)
-{
-  switch (id.u) {
-  case NN_ENTITYID_SEDP_BUILTIN_TOPIC_WRITER:
-  case NN_ENTITYID_SEDP_BUILTIN_TOPIC_READER:
-    return "DCPSTopic";
-    break;
-  case NN_ENTITYID_SEDP_BUILTIN_PUBLICATIONS_WRITER:
-  case NN_ENTITYID_SEDP_BUILTIN_PUBLICATIONS_READER:
-    return "DCPSPublication";
-    break;
-  case NN_ENTITYID_SEDP_BUILTIN_SUBSCRIPTIONS_WRITER:
-  case NN_ENTITYID_SEDP_BUILTIN_SUBSCRIPTIONS_READER:
-    return "DCPSSubscription";
-    break;
-  case NN_ENTITYID_SPDP_BUILTIN_PARTICIPANT_WRITER:
-  case NN_ENTITYID_SPDP_BUILTIN_PARTICIPANT_READER:
-    return "DCPSParticipant";
-    break;
-  case NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_MESSAGE_WRITER:
-  case NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_MESSAGE_READER:
-    return "DCPSParticipantMessage";
-    break;
-  case NN_ENTITYID_SEDP_BUILTIN_PUBLICATIONS_SECURE_WRITER:
-  case NN_ENTITYID_SEDP_BUILTIN_PUBLICATIONS_SECURE_READER:
-    return "DCPSPublicationsSecure";
-    break;
-  case NN_ENTITYID_SEDP_BUILTIN_SUBSCRIPTIONS_SECURE_WRITER:
-  case NN_ENTITYID_SEDP_BUILTIN_SUBSCRIPTIONS_SECURE_READER:
-    return "DCPSSubscriptionsSecure";
-    break;
-  case NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_STATELESS_MESSAGE_WRITER:
-  case NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_STATELESS_MESSAGE_READER:
-    return "DCPSParticipantStatelessMessage";
-    break;
-  case NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_MESSAGE_SECURE_WRITER:
-  case NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_MESSAGE_SECURE_READER:
-    return "DCPSParticipantMessageSecure";
-    break;
-  case NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_VOLATILE_SECURE_WRITER:
-  case NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_VOLATILE_SECURE_READER:
-    return "DCPSParticipantVolatileMessageSecure";
-    break;
-  case NN_ENTITYID_SPDP_RELIABLE_BUILTIN_PARTICIPANT_SECURE_WRITER:
-  case NN_ENTITYID_SPDP_RELIABLE_BUILTIN_PARTICIPANT_SECURE_READER:
-    return "DCPSParticipantsSecure";
-    break;
-  default:
-    return "(null)";
-    break;
-  }
-
-  return NULL;
-}
-
 static void notify_handshake_recv_token(struct participant *pp, struct proxy_participant *proxypp)
 {
   struct ddsi_handshake *handshake;
@@ -828,22 +773,6 @@ static void notify_handshake_recv_token(struct participant *pp, struct proxy_par
   }
 }
 
-static const char * get_reader_topic_name(struct reader *rd)
-{
-  if (rd->topic) {
-    return rd->topic->name;
-  }
-  return get_builtin_topic_name(rd->e.guid.entityid);
-}
-
-static const char * get_writer_topic_name(struct writer *wr)
-{
-  if (wr->topic) {
-    return wr->topic->name;
-  }
-  return get_builtin_topic_name(wr->e.guid.entityid);
-}
-
 bool q_omg_participant_is_secure(const struct participant *pp)
 {
   return ((pp->sec_attr != NULL) && (pp->sec_attr->crypto_handle != DDS_SECURITY_HANDLE_NIL));
@@ -1292,7 +1221,6 @@ void q_omg_security_register_writer(struct writer *wr)
   DDS_Security_SecurityException exception = DDS_SECURITY_EXCEPTION_INIT;
   DDS_Security_PartitionQosPolicy partitions;
   DDS_Security_PropertySeq properties;
-  const char *topic_name;
 
   if (!sc)
     return;
@@ -1303,8 +1231,7 @@ void q_omg_security_register_writer(struct writer *wr)
     memset(&(partitions), 0, sizeof(DDS_Security_PartitionQosPolicy));
 
   wr->sec_attr = writer_sec_attributes_new();
-  topic_name = get_writer_topic_name(wr);
-  if (!sc->access_control_context->get_datawriter_sec_attributes(sc->access_control_context, pp->sec_attr->permissions_handle, topic_name, &partitions, NULL, &wr->sec_attr->attr, &exception))
+  if (!sc->access_control_context->get_datawriter_sec_attributes(sc->access_control_context, pp->sec_attr->permissions_handle, wr->topic->name, &partitions, NULL, &wr->sec_attr->attr, &exception))
   {
     EXCEPTION_ERROR(sc, &exception, "Failed to retrieve writer security attributes");
     goto no_attr;
@@ -1413,7 +1340,6 @@ void q_omg_security_register_reader(struct reader *rd)
   DDS_Security_SecurityException exception = DDS_SECURITY_EXCEPTION_INIT;
   DDS_Security_PartitionQosPolicy partitions;
   DDS_Security_PropertySeq properties;
-  const char *topic_name;
 
   if (!sc)
     return;
@@ -1425,8 +1351,7 @@ void q_omg_security_register_reader(struct reader *rd)
 
   rd->sec_attr = reader_sec_attributes_new();
 
-  topic_name = get_reader_topic_name(rd);
-  if (!sc->access_control_context->get_datareader_sec_attributes(sc->access_control_context, pp->sec_attr->permissions_handle, topic_name, &partitions, NULL, &rd->sec_attr->attr, &exception))
+  if (!sc->access_control_context->get_datareader_sec_attributes(sc->access_control_context, pp->sec_attr->permissions_handle, rd->topic->name, &partitions, NULL, &rd->sec_attr->attr, &exception))
   {
     EXCEPTION_ERROR(sc, &exception, "Failed to retrieve reader security attributes");
     goto no_attr;
@@ -2650,7 +2575,7 @@ static bool q_omg_security_encode_datareader_submessage(struct reader *rd, const
   const struct dds_security_context *sc = q_omg_security_get_secure_context (rd->c.pp);
   assert (sc);
 
-  GVTRACE (" encode_datareader_submessage "PGUIDFMT" %s/%s", PGUID (rd->e.guid), get_reader_topic_name (rd), rd->topic ? rd->topic->type_name : "(null)");
+  GVTRACE (" encode_datareader_submessage "PGUIDFMT" %s/%s", PGUID (rd->e.guid), rd->topic->name, rd->topic->type_name);
   // FIXME: print_buf(src_buf, src_len, "q_omg_security_encode_datareader_submessage(SOURCE)");
 
   ddsrt_mutex_lock (&rd->e.lock);
@@ -2665,8 +2590,7 @@ static bool q_omg_security_encode_datareader_submessage(struct reader *rd, const
 
   if ((hdls._length = (DDS_Security_unsigned_long) idx) == 0)
   {
-    GVTRACE ("Submsg encoding failed for datareader "PGUIDFMT" %s/%s: no matching writers\n", PGUID (rd->e.guid),
-        get_reader_topic_name (rd), rd->topic ? rd->topic->type_name : "(null)");
+    GVTRACE ("Submsg encoding failed for datareader "PGUIDFMT" %s/%s: no matching writers\n", PGUID (rd->e.guid), rd->topic->name, rd->topic->type_name);
     goto err_enc_drd_subm;
   }
 
@@ -2678,8 +2602,8 @@ static bool q_omg_security_encode_datareader_submessage(struct reader *rd, const
   if (!(result = sc->crypto_context->crypto_transform->encode_datareader_submessage (
       sc->crypto_context->crypto_transform, &encoded_buffer, &plain_buffer, rd->sec_attr->crypto_handle, &hdls, &ex)))
   {
-    GVWARNING ("Submsg encoding failed for datareader "PGUIDFMT" %s/%s: %s", PGUID (rd->e.guid), get_reader_topic_name (rd),
-        rd->topic ? rd->topic->type_name : "(null)", ex.message ? ex.message : "Unknown error");
+    GVWARNING ("Submsg encoding failed for datareader "PGUIDFMT" %s/%s: %s", PGUID (rd->e.guid), rd->topic->name,
+        rd->topic->type_name, ex.message ? ex.message : "Unknown error");
     GVTRACE ("\n");
     DDS_Security_Exception_reset (&ex);
     goto err_enc_drd_subm;
@@ -2723,7 +2647,7 @@ static bool q_omg_security_encode_datawriter_submessage (struct writer *wr, cons
   const struct dds_security_context *sc = q_omg_security_get_secure_context (wr->c.pp);
   assert (sc);
 
-  GVTRACE (" encode_datawriter_submessage "PGUIDFMT" %s/%s", PGUID (wr->e.guid), get_writer_topic_name (wr), wr->topic ? wr->topic->type_name : "(null)");
+  GVTRACE (" encode_datawriter_submessage "PGUIDFMT" %s/%s", PGUID (wr->e.guid), wr->topic->name, wr->topic->type_name);
 
   // FIXME: print_buf(src_buf, src_len, "q_omg_security_encode_datawriter_submessage(SOURCE)");
 
@@ -2738,7 +2662,7 @@ static bool q_omg_security_encode_datawriter_submessage (struct writer *wr, cons
   if ((hdls._length = (DDS_Security_unsigned_long) idx) == 0)
   {
     GVTRACE ("Submsg encoding failed for datawriter "PGUIDFMT" %s/%s: no matching readers\n", PGUID (wr->e.guid),
-        get_writer_topic_name (wr), wr->topic ? wr->topic->type_name : "(null)");
+        wr->topic->name, wr->topic->type_name);
     goto err_enc_dwr_subm;
   }
 
@@ -2762,8 +2686,7 @@ static bool q_omg_security_encode_datawriter_submessage (struct writer *wr, cons
 
   if (!result)
   {
-    GVWARNING ("Submsg encoding failed for datawriter "PGUIDFMT" %s/%s: %s", PGUID (wr->e.guid), get_writer_topic_name (wr),
-        wr->topic ? wr->topic->type_name : "(null)", ex.message ? ex.message : "Unknown error");
+    GVWARNING ("Submsg encoding failed for datawriter "PGUIDFMT" %s/%s: %s", PGUID (wr->e.guid), wr->topic->name, wr->topic->type_name, ex.message ? ex.message : "Unknown error");
     GVTRACE ("\n");
     DDS_Security_Exception_reset (&ex);
     goto err_enc_dwr_subm;
@@ -2916,7 +2839,7 @@ static bool q_omg_security_encode_serialized_payload (const struct writer *wr, c
 
   // FIXME: print_buf(src_buf, src_len, "q_omg_security_encode_serialized_payload(SOURCE)");
 
-  GVTRACE (" encode_payload "PGUIDFMT" %s/%s\n", PGUID (wr->e.guid), wr->topic ? wr->topic->name : "(null)", wr->topic ? wr->topic->type_name : "(null)");
+  GVTRACE (" encode_payload "PGUIDFMT" %s/%s\n", PGUID (wr->e.guid), wr->topic->name, wr->topic->type_name);
 
   memset (&extra_inline_qos, 0, sizeof (extra_inline_qos));
   memset (&encoded_buffer, 0, sizeof (encoded_buffer));
diff --git a/src/core/ddsi/src/ddsi_serdata_default.c b/src/core/ddsi/src/ddsi_serdata_default.c
index bd49d4b..4a37c91 100644
--- a/src/core/ddsi/src/ddsi_serdata_default.c
+++ b/src/core/ddsi/src/ddsi_serdata_default.c
@@ -461,92 +461,6 @@ static struct ddsi_serdata *serdata_default_from_sample_cdr_nokey (const struct
   return fix_serdata_default_nokey (d, tpcmn->serdata_basehash);
 }
 
-static struct ddsi_serdata *serdata_default_from_sample_plist (const struct ddsi_sertopic *tpcmn, enum ddsi_serdata_kind kind, const void *vsample)
-{
-  /* Currently restricted to DDSI discovery data (XTypes will need a rethink of the default representation and that may result in discovery data being moved to that new representation), and that means: keys are either GUIDs or an unbounded string for topics, for which MD5 is acceptable. Furthermore, these things don't get written very often, so scanning the parameter list to get the key value out is good enough for now. And at least it keeps the DDSI discovery data writing out of the internals of the sample representation */
-  const struct ddsi_sertopic_default *tp = (const struct ddsi_sertopic_default *)tpcmn;
-  const struct ddsi_plist_sample *sample = vsample;
-  struct ddsi_serdata_default *d = serdata_default_new(tp, kind);
-  if (d == NULL)
-    return NULL;
-  serdata_default_append_blob (&d, 1, sample->size, sample->blob);
-  const unsigned char *rawkey = ddsi_plist_findparam_native_unchecked (sample->blob, sample->keyparam);
-#ifndef NDEBUG
-  size_t keysize;
-#endif
-  assert(rawkey);
-  switch (sample->keyparam)
-  {
-    case PID_PARTICIPANT_GUID:
-    case PID_ENDPOINT_GUID:
-    case PID_GROUP_GUID:
-      d->keyhash.m_set = 1;
-      d->keyhash.m_iskey = 1;
-      d->keyhash.m_keysize = sizeof(d->keyhash.m_hash);
-      memcpy (d->keyhash.m_hash, rawkey, 16);
-#ifndef NDEBUG
-      keysize = 16;
-#endif
-      break;
-
-    case PID_TOPIC_NAME: {
-      const char *topic_name = (const char *) (rawkey + sizeof(uint32_t));
-      uint32_t topic_name_sz;
-      uint32_t topic_name_sz_BE;
-      ddsrt_md5_state_t md5st;
-      ddsrt_md5_byte_t digest[16];
-      topic_name_sz = (uint32_t) strlen (topic_name) + 1;
-      topic_name_sz_BE = ddsrt_toBE4u (topic_name_sz);
-      d->keyhash.m_set = 1;
-      d->keyhash.m_iskey = 0;
-      d->keyhash.m_keysize = sizeof(d->keyhash.m_hash);
-      ddsrt_md5_init (&md5st);
-      ddsrt_md5_append (&md5st, (const ddsrt_md5_byte_t *) &topic_name_sz_BE, sizeof (topic_name_sz_BE));
-      ddsrt_md5_append (&md5st, (const ddsrt_md5_byte_t *) topic_name, topic_name_sz);
-      ddsrt_md5_finish (&md5st, digest);
-      memcpy (d->keyhash.m_hash, digest, 16);
-#ifndef NDEBUG
-      keysize = sizeof (uint32_t) + topic_name_sz;
-#endif
-      break;
-    }
-
-    default:
-      abort();
-  }
-
-  /* if it is supposed to be just a key, rawkey must be be the first field and followed only by a sentinel */
-  assert (kind != SDK_KEY || rawkey == (const unsigned char *)sample->blob + sizeof (nn_parameter_t));
-  assert (kind != SDK_KEY || sample->size == sizeof (nn_parameter_t) + alignup_size (keysize, 4) + sizeof (nn_parameter_t));
-  return fix_serdata_default (d, tp->c.serdata_basehash);
-}
-
-static struct ddsi_serdata *serdata_default_from_sample_rawcdr (const struct ddsi_sertopic *tpcmn, enum ddsi_serdata_kind kind, const void *vsample)
-{
-  /* Currently restricted to DDSI discovery data (XTypes will need a rethink of the default representation and that may result in discovery data being moved to that new representation), and that means: keys are either GUIDs or an unbounded string for topics, for which MD5 is acceptable. Furthermore, these things don't get written very often, so scanning the parameter list to get the key value out is good enough for now. And at least it keeps the DDSI discovery data writing out of the internals of the sample representation */
-  const struct ddsi_sertopic_default *tp = (const struct ddsi_sertopic_default *)tpcmn;
-  const struct ddsi_rawcdr_sample *sample = vsample;
-  struct ddsi_serdata_default *d = serdata_default_new(tp, kind);
-  if (d == NULL)
-    return NULL;
-  assert (sample->keysize <= 16);
-  serdata_default_append_blob (&d, 1, sample->size, sample->blob);
-  serdata_default_append_aligned (&d, 0, 4);
-  d->keyhash.m_set = 1;
-  d->keyhash.m_iskey = 1;
-  if (sample->keysize == 0)
-  {
-    d->keyhash.m_keysize = 0;
-    return fix_serdata_default_nokey (d, tp->c.serdata_basehash);
-  }
-  else
-  {
-    memcpy (&d->keyhash.m_hash, sample->key, sample->keysize);
-    d->keyhash.m_keysize = (unsigned)sample->keysize & 0x1f;
-    return fix_serdata_default (d, tp->c.serdata_basehash);
-  }
-}
-
 static struct ddsi_serdata *serdata_default_to_topicless (const struct ddsi_serdata *serdata_common)
 {
   const struct ddsi_serdata_default *d = (const struct ddsi_serdata_default *)serdata_common;
@@ -669,37 +583,6 @@ static size_t serdata_default_print_cdr (const struct ddsi_sertopic *sertopic_co
     return dds_stream_print_sample (&is, tp, buf, size);
 }
 
-static size_t serdata_default_print_plist (const struct ddsi_sertopic *sertopic_common, const struct ddsi_serdata *serdata_common, char *buf, size_t size)
-{
-  const struct ddsi_serdata_default *d = (const struct ddsi_serdata_default *)serdata_common;
-  const struct ddsi_sertopic_default *tp = (const struct ddsi_sertopic_default *)sertopic_common;
-  ddsi_plist_src_t src;
-  ddsi_plist_t tmp;
-  src.buf = (const unsigned char *) d->data;
-  src.bufsz = d->pos;
-  src.encoding = d->hdr.identifier;
-  src.factory = tp->c.gv->m_factory;
-  src.logconfig = &tp->c.gv->logconfig;
-  src.protocol_version.major = RTPS_MAJOR;
-  src.protocol_version.minor = RTPS_MINOR;
-  src.strict = false;
-  src.vendorid = NN_VENDORID_ECLIPSE;
-  if (ddsi_plist_init_frommsg (&tmp, NULL, ~(uint64_t)0, ~(uint64_t)0, &src) < 0)
-    return (size_t) snprintf (buf, size, "(unparseable-plist)");
-  else
-  {
-    size_t ret = ddsi_plist_print (buf, size, &tmp);
-    ddsi_plist_fini (&tmp);
-    return ret;
-  }
-}
-
-static size_t serdata_default_print_raw (const struct ddsi_sertopic *sertopic_common, const struct ddsi_serdata *serdata_common, char *buf, size_t size)
-{
-  (void)sertopic_common; (void)serdata_common;
-  return (size_t) snprintf (buf, size, "(blob)");
-}
-
 static void serdata_default_get_keyhash (const struct ddsi_serdata *serdata_common, struct ddsi_keyhash *buf, bool force_md5)
 {
   const struct ddsi_serdata_default *d = (const struct ddsi_serdata_default *)serdata_common;
@@ -753,39 +636,3 @@ const struct ddsi_serdata_ops ddsi_serdata_ops_cdr_nokey = {
   .print = serdata_default_print_cdr,
   .get_keyhash = serdata_default_get_keyhash
 };
-
-const struct ddsi_serdata_ops ddsi_serdata_ops_plist = {
-  .get_size = serdata_default_get_size,
-  .eqkey = serdata_default_eqkey,
-  .free = serdata_default_free,
-  .from_ser = serdata_default_from_ser,
-  .from_ser_iov = serdata_default_from_ser_iov,
-  .from_keyhash = 0,
-  .from_sample = serdata_default_from_sample_plist,
-  .to_ser = serdata_default_to_ser,
-  .to_sample = 0,
-  .to_ser_ref = serdata_default_to_ser_ref,
-  .to_ser_unref = serdata_default_to_ser_unref,
-  .to_topicless = serdata_default_to_topicless,
-  .topicless_to_sample = 0,
-  .print = serdata_default_print_plist,
-  .get_keyhash = serdata_default_get_keyhash
-};
-
-const struct ddsi_serdata_ops ddsi_serdata_ops_rawcdr = {
-  .get_size = serdata_default_get_size,
-  .eqkey = serdata_default_eqkey,
-  .free = serdata_default_free,
-  .from_ser = serdata_default_from_ser,
-  .from_ser_iov = serdata_default_from_ser_iov,
-  .from_keyhash = 0,
-  .from_sample = serdata_default_from_sample_rawcdr,
-  .to_ser = serdata_default_to_ser,
-  .to_sample = 0,
-  .to_ser_ref = serdata_default_to_ser_ref,
-  .to_ser_unref = serdata_default_to_ser_unref,
-  .to_topicless = serdata_default_to_topicless,
-  .topicless_to_sample = 0,
-  .print = serdata_default_print_raw,
-  .get_keyhash = serdata_default_get_keyhash
-};
diff --git a/src/core/ddsi/src/ddsi_serdata_plist.c b/src/core/ddsi/src/ddsi_serdata_plist.c
new file mode 100644
index 0000000..225f9e9
--- /dev/null
+++ b/src/core/ddsi/src/ddsi_serdata_plist.c
@@ -0,0 +1,303 @@
+/*
+ * Copyright(c) 2020 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+#include <stdlib.h>
+#include <ctype.h>
+#include <assert.h>
+#include <string.h>
+
+#include "dds/ddsrt/heap.h"
+#include "dds/ddsrt/log.h"
+#include "dds/ddsrt/md5.h"
+#include "dds/ddsrt/mh3.h"
+#include "dds/ddsi/q_bswap.h"
+#include "dds/ddsi/q_config.h"
+#include "dds/ddsi/q_freelist.h"
+#include "dds/ddsi/ddsi_tkmap.h"
+#include "dds/ddsi/ddsi_cdrstream.h"
+#include "dds/ddsi/q_radmin.h"
+#include "dds/ddsi/ddsi_domaingv.h"
+#include "dds/ddsi/ddsi_serdata_plist.h"
+#include "dds/ddsi/q_xmsg.h"
+
+static uint32_t serdata_plist_get_size (const struct ddsi_serdata *dcmn)
+{
+  const struct ddsi_serdata_plist *d = (const struct ddsi_serdata_plist *) dcmn;
+  return 4 + d->pos; // FIXME: +4 for CDR header should be eliminated
+}
+
+static bool serdata_plist_eqkey (const struct ddsi_serdata *acmn, const struct ddsi_serdata *bcmn)
+{
+  const struct ddsi_serdata_plist *a = (const struct ddsi_serdata_plist *) acmn;
+  const struct ddsi_serdata_plist *b = (const struct ddsi_serdata_plist *) bcmn;
+  return memcmp (&a->keyhash, &b->keyhash, sizeof (a->keyhash)) == 0;
+}
+
+static void serdata_plist_free (struct ddsi_serdata *dcmn)
+{
+  struct ddsi_serdata_plist *d = (struct ddsi_serdata_plist *) dcmn;
+  ddsrt_free (d);
+}
+
+static struct ddsi_serdata_plist *serdata_plist_new (const struct ddsi_sertopic_plist *tp, enum ddsi_serdata_kind kind, size_t size, const void *cdr_header)
+{
+  /* FIXME: check whether this really is the correct maximum: offsets are relative
+     to the CDR header, but there are also some places that use a serdata as-if it
+     were a stream, and those use offsets (m_index) relative to the start of the
+     serdata */
+  if (size < 4 || size > UINT32_MAX - offsetof (struct ddsi_serdata_plist, identifier))
+    return NULL;
+  struct ddsi_serdata_plist *d = ddsrt_malloc (sizeof (*d) + size);
+  if (d == NULL)
+    return NULL;
+  ddsi_serdata_init (&d->c, &tp->c, kind);
+  d->pos = 0;
+  d->size = (uint32_t) size;
+  // FIXME: vendorid/protoversion are not available when creating a serdata
+  // these should be overruled by the one creating the serdata
+  d->vendorid = NN_VENDORID_UNKNOWN;
+  d->protoversion.major = RTPS_MAJOR;
+  d->protoversion.minor = RTPS_MINOR;
+  const uint16_t *hdrsrc = cdr_header;
+  d->identifier = hdrsrc[0];
+  d->options = hdrsrc[1];
+  if (d->identifier != PL_CDR_LE && d->identifier != PL_CDR_BE)
+  {
+    ddsrt_free (d);
+    return NULL;
+  }
+  return d;
+}
+
+static struct ddsi_serdata *serdata_plist_fix (const struct ddsi_sertopic_plist *tp, struct ddsi_serdata_plist *d)
+{
+  assert (tp->keyparam != PID_SENTINEL);
+  void *needlep;
+  size_t needlesz;
+  if (ddsi_plist_findparam_checking (d->data, d->pos, d->identifier, tp->keyparam, &needlep, &needlesz) != DDS_RETCODE_OK)
+  {
+    ddsrt_free (d);
+    return NULL;
+  }
+  assert (needlep);
+  if (needlesz != sizeof (d->keyhash))
+  {
+    ddsrt_free (d);
+    return NULL;
+  }
+  memcpy (&d->keyhash, needlep, 16);
+  d->c.hash = ddsrt_mh3 (&d->keyhash, sizeof (d->keyhash), 0) ^ tp->c.serdata_basehash;
+  return &d->c;
+}
+
+static struct ddsi_serdata *serdata_plist_from_ser (const struct ddsi_sertopic *tpcmn, enum ddsi_serdata_kind kind, const struct nn_rdata *fragchain, size_t size)
+{
+  const struct ddsi_sertopic_plist *tp = (const struct ddsi_sertopic_plist *) tpcmn;
+  struct ddsi_serdata_plist *d = serdata_plist_new (tp, kind, size, NN_RMSG_PAYLOADOFF (fragchain->rmsg, NN_RDATA_PAYLOAD_OFF (fragchain)));
+  uint32_t off = 4; /* must skip the CDR header */
+  assert (fragchain->min == 0);
+  assert (fragchain->maxp1 >= off); /* CDR header must be in first fragment */
+  while (fragchain)
+  {
+    assert (fragchain->min <= off);
+    assert (fragchain->maxp1 <= size);
+    if (fragchain->maxp1 > off)
+    {
+      /* only copy if this fragment adds data */
+      const unsigned char *payload = NN_RMSG_PAYLOADOFF (fragchain->rmsg, NN_RDATA_PAYLOAD_OFF (fragchain));
+      uint32_t n = fragchain->maxp1 - off;
+      memcpy (d->data + d->pos, payload + off - fragchain->min, n);
+      d->pos += n;
+      off = fragchain->maxp1;
+    }
+    fragchain = fragchain->nextfrag;
+  }
+  return serdata_plist_fix (tp, d);
+}
+
+static struct ddsi_serdata *serdata_plist_from_ser_iov (const struct ddsi_sertopic *tpcmn, enum ddsi_serdata_kind kind, ddsrt_msg_iovlen_t niov, const ddsrt_iovec_t *iov, size_t size)
+{
+  const struct ddsi_sertopic_plist *tp = (const struct ddsi_sertopic_plist *) tpcmn;
+  assert (niov >= 1);
+  struct ddsi_serdata_plist *d = serdata_plist_new (tp, kind, size, iov[0].iov_base);
+  memcpy (d->data + d->pos, (const char *) iov[0].iov_base + 4, iov[0].iov_len - 4);
+  d->pos += (uint32_t) iov[0].iov_len - 4;
+  for (ddsrt_msg_iovlen_t i = 1; i < niov; i++)
+  {
+    memcpy (d->data + d->pos, (const char *) iov[i].iov_base, iov[i].iov_len);
+    d->pos += (uint32_t) iov[i].iov_len;
+  }
+  return serdata_plist_fix (tp, d);
+}
+
+static struct ddsi_serdata *serdata_plist_from_keyhash (const struct ddsi_sertopic *tpcmn, const ddsi_keyhash_t *keyhash)
+{
+  const struct ddsi_sertopic_plist *tp = (const struct ddsi_sertopic_plist *) tpcmn;
+  const struct { uint16_t identifier, options; nn_parameter_t par; ddsi_keyhash_t kh; } in = {
+    .identifier = CDR_BE,
+    .options = 0,
+    .par = {
+      .parameterid = ddsrt_toBE2u (tp->keyparam),
+      .length = sizeof (*keyhash)
+    },
+    *keyhash
+  };
+  const ddsrt_iovec_t iov = { .iov_base = (void *) &in, .iov_len = sizeof (in) };
+  return serdata_plist_from_ser_iov (tpcmn, SDK_KEY, 1, &iov, sizeof (in) - 4);
+}
+
+static bool serdata_plist_topicless_to_sample (const struct ddsi_sertopic *topic_common, const struct ddsi_serdata *serdata_common, void *sample, void **bufptr, void *buflim)
+{
+  const struct ddsi_serdata_plist *d = (const struct ddsi_serdata_plist *)serdata_common;
+  const struct ddsi_sertopic_plist *tp = (const struct ddsi_sertopic_plist *) topic_common;
+  struct ddsi_domaingv * const gv = tp->c.gv;
+  if (bufptr) abort(); else { (void)buflim; } /* FIXME: haven't implemented that bit yet! */
+  ddsi_plist_src_t src = {
+    .buf = (const unsigned char *) d->data,
+    .bufsz = d->pos,
+    .encoding = d->identifier,
+    .factory = gv->m_factory,
+    .logconfig = &gv->logconfig,
+    .protocol_version = d->protoversion,
+    .strict = NN_STRICT_P (gv->config),
+    .vendorid = d->vendorid
+  };
+  const dds_return_t rc = ddsi_plist_init_frommsg (sample, NULL, ~(uint64_t)0, ~(uint64_t)0, &src);
+  // FIXME: need a more informative return type
+  if (rc != DDS_RETCODE_OK && rc != DDS_RETCODE_UNSUPPORTED)
+    GVWARNING ("SPDP (vendor %u.%u): invalid qos/parameters\n", src.vendorid.id[0], src.vendorid.id[1]);
+  return (rc == DDS_RETCODE_OK);
+}
+
+static bool serdata_plist_to_sample (const struct ddsi_serdata *serdata_common, void *sample, void **bufptr, void *buflim)
+{
+  /* the "plist" topics only differ in the parameter that is used as the key value */
+  return serdata_plist_topicless_to_sample (serdata_common->topic, serdata_common, sample, bufptr, buflim);
+}
+
+static void serdata_plist_to_ser (const struct ddsi_serdata *serdata_common, size_t off, size_t sz, void *buf)
+{
+  const struct ddsi_serdata_plist *d = (const struct ddsi_serdata_plist *)serdata_common;
+  memcpy (buf, (char *) &d->identifier + off, sz);
+}
+
+static struct ddsi_serdata *serdata_plist_to_ser_ref (const struct ddsi_serdata *serdata_common, size_t off, size_t sz, ddsrt_iovec_t *ref)
+{
+  const struct ddsi_serdata_plist *d = (const struct ddsi_serdata_plist *)serdata_common;
+  ref->iov_base = (char *) &d->identifier + off;
+  ref->iov_len = (ddsrt_iov_len_t) sz;
+  return ddsi_serdata_ref (serdata_common);
+}
+
+static void serdata_plist_to_ser_unref (struct ddsi_serdata *serdata_common, const ddsrt_iovec_t *ref)
+{
+  (void) ref;
+  ddsi_serdata_unref (serdata_common);
+}
+
+static struct ddsi_serdata *serdata_plist_from_sample (const struct ddsi_sertopic *tpcmn, enum ddsi_serdata_kind kind, const void *sample)
+{
+  const struct ddsi_sertopic_plist *tp = (const struct ddsi_sertopic_plist *)tpcmn;
+  const struct { uint16_t identifier, options; } header = { tp->native_encoding_identifier, 0 };
+  const ddsi_guid_t nullguid = { .prefix = { .u = { 0,0,0 } }, .entityid = { .u = 0 } };
+
+  // FIXME: key must not require byteswapping (GUIDs are ok)
+  // FIXME: rework plist stuff so it doesn't need an nn_xmsg
+  struct nn_xmsg *mpayload = nn_xmsg_new (tp->c.gv->xmsgpool, &nullguid, NULL, 0, NN_XMSG_KIND_DATA);
+  memcpy (nn_xmsg_append (mpayload, NULL, 4), &header, 4);
+  ddsi_plist_addtomsg (mpayload, sample, ~(uint64_t)0, ~(uint64_t)0);
+  nn_xmsg_addpar_sentinel (mpayload);
+
+  size_t sz;
+  unsigned char *blob = nn_xmsg_payload (&sz, mpayload);
+#ifndef NDEBUG
+  void *needle;
+  size_t needlesz;
+  assert (ddsi_plist_findparam_checking (blob + 4, sz, header.identifier, tp->keyparam, &needle, &needlesz) == DDS_RETCODE_OK);
+  assert (needle && needlesz == 16);
+#endif
+  ddsrt_iovec_t iov = { .iov_base = blob, .iov_len = (ddsrt_iov_len_t) sz };
+  struct ddsi_serdata *d = serdata_plist_from_ser_iov (tpcmn, kind, 1, &iov, sz - 4);
+  nn_xmsg_free (mpayload);
+
+  /* we know the vendor when we construct a serdata from a sample */
+  struct ddsi_serdata_plist *d_plist = (struct ddsi_serdata_plist *) d;
+  d_plist->vendorid = NN_VENDORID_ECLIPSE;
+  return d;
+}
+
+static struct ddsi_serdata *serdata_plist_to_topicless (const struct ddsi_serdata *serdata_common)
+{
+  const struct ddsi_serdata_plist *d = (const struct ddsi_serdata_plist *) serdata_common;
+  const struct ddsi_sertopic_plist *tp = (const struct ddsi_sertopic_plist *) d->c.topic;
+  ddsrt_iovec_t iov = { .iov_base = (char *) &d->identifier, .iov_len = 4 + d->pos };
+  struct ddsi_serdata *dcmn_tl = serdata_plist_from_ser_iov (&tp->c, SDK_KEY, 1, &iov, d->pos);
+  assert (dcmn_tl != NULL);
+  dcmn_tl->topic = NULL;
+  return dcmn_tl;
+}
+
+static void serdata_plist_get_keyhash (const struct ddsi_serdata *serdata_common, struct ddsi_keyhash *buf, bool force_md5)
+{
+  const struct ddsi_serdata_plist *d = (const struct ddsi_serdata_plist *)serdata_common;
+  if (!force_md5)
+    memcpy (buf, &d->keyhash, 16);
+  else
+  {
+    ddsrt_md5_state_t md5st;
+    ddsrt_md5_init (&md5st);
+    ddsrt_md5_append (&md5st, (ddsrt_md5_byte_t *) &d->keyhash, 16);
+    ddsrt_md5_finish (&md5st, (ddsrt_md5_byte_t *) buf->value);
+  }
+}
+
+static size_t serdata_plist_print_plist (const struct ddsi_sertopic *sertopic_common, const struct ddsi_serdata *serdata_common, char *buf, size_t size)
+{
+  const struct ddsi_serdata_plist *d = (const struct ddsi_serdata_plist *) serdata_common;
+  const struct ddsi_sertopic_plist *tp = (const struct ddsi_sertopic_plist *) sertopic_common;
+  ddsi_plist_src_t src = {
+    .buf = (const unsigned char *) d->data,
+    .bufsz = d->pos,
+    .encoding = d->identifier,
+    .factory = tp->c.gv->m_factory,
+    .logconfig = &tp->c.gv->logconfig,
+    .protocol_version = d->protoversion,
+    .strict = false,
+    .vendorid = d->vendorid
+  };
+  ddsi_plist_t tmp;
+  if (ddsi_plist_init_frommsg (&tmp, NULL, ~(uint64_t)0, ~(uint64_t)0, &src) < 0)
+    return (size_t) snprintf (buf, size, "(unparseable-plist)");
+  else
+  {
+    size_t ret = ddsi_plist_print (buf, size, &tmp);
+    ddsi_plist_fini (&tmp);
+    return ret;
+  }
+}
+
+const struct ddsi_serdata_ops ddsi_serdata_ops_plist = {
+  .get_size = serdata_plist_get_size,
+  .eqkey = serdata_plist_eqkey,
+  .free = serdata_plist_free,
+  .from_ser = serdata_plist_from_ser,
+  .from_ser_iov = serdata_plist_from_ser_iov,
+  .from_keyhash = serdata_plist_from_keyhash,
+  .from_sample = serdata_plist_from_sample,
+  .to_ser = serdata_plist_to_ser,
+  .to_sample = serdata_plist_to_sample,
+  .to_ser_ref = serdata_plist_to_ser_ref,
+  .to_ser_unref = serdata_plist_to_ser_unref,
+  .to_topicless = serdata_plist_to_topicless,
+  .topicless_to_sample = serdata_plist_topicless_to_sample,
+  .print = serdata_plist_print_plist,
+  .get_keyhash = serdata_plist_get_keyhash
+};
diff --git a/src/core/ddsi/src/ddsi_serdata_pserop.c b/src/core/ddsi/src/ddsi_serdata_pserop.c
new file mode 100644
index 0000000..a3df6d2
--- /dev/null
+++ b/src/core/ddsi/src/ddsi_serdata_pserop.c
@@ -0,0 +1,297 @@
+/*
+ * Copyright(c) 2020 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+#include <stdlib.h>
+#include <ctype.h>
+#include <assert.h>
+#include <string.h>
+
+#include "dds/ddsrt/heap.h"
+#include "dds/ddsrt/log.h"
+#include "dds/ddsrt/md5.h"
+#include "dds/ddsrt/mh3.h"
+#include "dds/ddsi/q_bswap.h"
+#include "dds/ddsi/q_config.h"
+#include "dds/ddsi/q_freelist.h"
+#include "dds/ddsi/ddsi_tkmap.h"
+#include "dds/ddsi/ddsi_cdrstream.h"
+#include "dds/ddsi/q_radmin.h"
+#include "dds/ddsi/ddsi_domaingv.h"
+#include "dds/ddsi/ddsi_serdata_pserop.h"
+
+static uint32_t serdata_pserop_get_size (const struct ddsi_serdata *dcmn)
+{
+  const struct ddsi_serdata_pserop *d = (const struct ddsi_serdata_pserop *) dcmn;
+  return 4 + d->pos; // FIXME: +4 for CDR header should be eliminated
+}
+
+static bool serdata_pserop_eqkey (const struct ddsi_serdata *acmn, const struct ddsi_serdata *bcmn)
+{
+  const struct ddsi_serdata_pserop *a = (const struct ddsi_serdata_pserop *) acmn;
+  const struct ddsi_serdata_pserop *b = (const struct ddsi_serdata_pserop *) bcmn;
+  if (a->keyless != b->keyless)
+    return false;
+  else if (a->keyless)
+    return true;
+  else
+    return memcmp (a->sample, b->sample, 16) == 0;
+}
+
+static void serdata_pserop_free (struct ddsi_serdata *dcmn)
+{
+  struct ddsi_serdata_pserop *d = (struct ddsi_serdata_pserop *) dcmn;
+  const struct ddsi_sertopic_pserop *tp = (const struct ddsi_sertopic_pserop *) d->c.topic;
+  if (d->c.kind == SDK_DATA)
+    plist_fini_generic (d->sample, tp->ops, true);
+  if (d->sample)
+    ddsrt_free (d->sample);
+  ddsrt_free (d);
+}
+
+static struct ddsi_serdata_pserop *serdata_pserop_new (const struct ddsi_sertopic_pserop *tp, enum ddsi_serdata_kind kind, size_t size, const void *cdr_header)
+{
+  /* FIXME: check whether this really is the correct maximum: offsets are relative
+     to the CDR header, but there are also some places that use a serdata as-if it
+     were a stream, and those use offsets (m_index) relative to the start of the
+     serdata */
+  assert (kind != SDK_EMPTY);
+  if (size < 4 || size > UINT32_MAX - offsetof (struct ddsi_serdata_pserop, identifier))
+    return NULL;
+  struct ddsi_serdata_pserop *d = ddsrt_malloc (sizeof (*d) + size);
+  if (d == NULL)
+    return NULL;
+  ddsi_serdata_init (&d->c, &tp->c, kind);
+  d->keyless = (tp->ops_key == NULL);
+  d->pos = 0;
+  d->size = (uint32_t) size;
+  const uint16_t *hdrsrc = cdr_header;
+  d->identifier = hdrsrc[0];
+  d->options = hdrsrc[1];
+  assert (d->identifier == CDR_LE || d->identifier == CDR_BE);
+  if (kind == SDK_KEY && d->keyless)
+    d->sample = NULL;
+  else if ((d->sample = ddsrt_malloc ((kind == SDK_DATA) ? tp->memsize : 16)) == NULL)
+  {
+    ddsrt_free (d);
+    return NULL;
+  }
+  return d;
+}
+
+static struct ddsi_serdata *serdata_pserop_fix (const struct ddsi_sertopic_pserop *tp, struct ddsi_serdata_pserop *d)
+{
+  const bool needs_bswap = (d->identifier != tp->native_encoding_identifier);
+  const enum pserop *ops = (d->c.kind == SDK_DATA) ? tp->ops : tp->ops_key;
+  d->c.hash = tp->c.serdata_basehash;
+  if (ops != NULL)
+  {
+    assert (d->pos >= 16 && tp->memsize >= 16);
+    if (plist_deser_generic (d->sample, d->data, d->pos, needs_bswap, (d->c.kind == SDK_DATA) ? tp->ops : tp->ops_key) < 0)
+    {
+      ddsrt_free (d->sample);
+      ddsrt_free (d);
+      return NULL;
+    }
+    if (tp->ops_key)
+    {
+      assert (d->pos >= 16 && tp->memsize >= 16);
+      d->c.hash ^= ddsrt_mh3 (d->sample, 16, 0);
+    }
+  }
+  return &d->c;
+}
+
+static struct ddsi_serdata *serdata_pserop_from_ser (const struct ddsi_sertopic *tpcmn, enum ddsi_serdata_kind kind, const struct nn_rdata *fragchain, size_t size)
+{
+  const struct ddsi_sertopic_pserop *tp = (const struct ddsi_sertopic_pserop *)tpcmn;
+  struct ddsi_serdata_pserop *d = serdata_pserop_new (tp, kind, size, NN_RMSG_PAYLOADOFF (fragchain->rmsg, NN_RDATA_PAYLOAD_OFF (fragchain)));
+  uint32_t off = 4; /* must skip the CDR header */
+  assert (fragchain->min == 0);
+  assert (fragchain->maxp1 >= off); /* CDR header must be in first fragment */
+  while (fragchain)
+  {
+    assert (fragchain->min <= off);
+    assert (fragchain->maxp1 <= size);
+    if (fragchain->maxp1 > off)
+    {
+      /* only copy if this fragment adds data */
+      const unsigned char *payload = NN_RMSG_PAYLOADOFF (fragchain->rmsg, NN_RDATA_PAYLOAD_OFF (fragchain));
+      uint32_t n = fragchain->maxp1 - off;
+      memcpy (d->data + d->pos, payload + off - fragchain->min, n);
+      d->pos += n;
+      off = fragchain->maxp1;
+    }
+    fragchain = fragchain->nextfrag;
+  }
+  return serdata_pserop_fix (tp, d);
+}
+
+static struct ddsi_serdata *serdata_pserop_from_ser_iov (const struct ddsi_sertopic *tpcmn, enum ddsi_serdata_kind kind, ddsrt_msg_iovlen_t niov, const ddsrt_iovec_t *iov, size_t size)
+{
+  const struct ddsi_sertopic_pserop *tp = (const struct ddsi_sertopic_pserop *)tpcmn;
+  assert (niov >= 1);
+  struct ddsi_serdata_pserop *d = serdata_pserop_new (tp, kind, size, iov[0].iov_base);
+  const uint16_t *hdrsrc = (uint16_t *) iov[0].iov_base;
+  d->identifier = hdrsrc[0];
+  d->options = hdrsrc[1];
+  assert (d->identifier == CDR_LE || d->identifier == CDR_BE);
+  memcpy (d->data + d->pos, (const char *) iov[0].iov_base + 4, iov[0].iov_len - 4);
+  d->pos += (uint32_t) iov[0].iov_len - 4;
+  for (ddsrt_msg_iovlen_t i = 1; i < niov; i++)
+  {
+    memcpy (d->data + d->pos, (const char *) iov[i].iov_base, iov[i].iov_len);
+    d->pos += (uint32_t) iov[i].iov_len;
+  }
+  return serdata_pserop_fix (tp, d);
+}
+
+static struct ddsi_serdata *serdata_pserop_from_keyhash (const struct ddsi_sertopic *tpcmn, const ddsi_keyhash_t *keyhash)
+{
+  const struct { uint16_t identifier, options; ddsi_keyhash_t kh; } in = { CDR_BE, 0, *keyhash };
+  const ddsrt_iovec_t iov = { .iov_base = (void *) &in, .iov_len = sizeof (in) };
+  return serdata_pserop_from_ser_iov (tpcmn, SDK_KEY, 1, &iov, sizeof (in) - 4);
+}
+
+static bool serdata_pserop_to_sample (const struct ddsi_serdata *serdata_common, void *sample, void **bufptr, void *buflim)
+{
+  const struct ddsi_serdata_pserop *d = (const struct ddsi_serdata_pserop *)serdata_common;
+  const struct ddsi_sertopic_pserop *tp = (const struct ddsi_sertopic_pserop *) d->c.topic;
+  if (bufptr) abort(); else { (void)buflim; } /* FIXME: haven't implemented that bit yet! */
+  if (d->c.kind == SDK_KEY)
+    memcpy (sample, d->sample, 16);
+  else
+  {
+    dds_return_t x;
+    x = plist_deser_generic (sample, d->data, d->pos, d->identifier != tp->native_encoding_identifier, tp->ops);
+    plist_unalias_generic (sample, tp->ops);
+    assert (x >= 0);
+    (void) x;
+  }
+  return true; /* FIXME: can't conversion to sample fail? */
+}
+
+static void serdata_pserop_to_ser (const struct ddsi_serdata *serdata_common, size_t off, size_t sz, void *buf)
+{
+  const struct ddsi_serdata_pserop *d = (const struct ddsi_serdata_pserop *)serdata_common;
+  memcpy (buf, (char *) &d->identifier + off, sz);
+}
+
+static struct ddsi_serdata *serdata_pserop_to_ser_ref (const struct ddsi_serdata *serdata_common, size_t off, size_t sz, ddsrt_iovec_t *ref)
+{
+  const struct ddsi_serdata_pserop *d = (const struct ddsi_serdata_pserop *)serdata_common;
+  ref->iov_base = (char *) &d->identifier + off;
+  ref->iov_len = (ddsrt_iov_len_t) sz;
+  return ddsi_serdata_ref (serdata_common);
+}
+
+static void serdata_pserop_to_ser_unref (struct ddsi_serdata *serdata_common, const ddsrt_iovec_t *ref)
+{
+  (void) ref;
+  ddsi_serdata_unref (serdata_common);
+}
+
+static struct ddsi_serdata *serdata_pserop_from_sample (const struct ddsi_sertopic *tpcmn, enum ddsi_serdata_kind kind, const void *sample)
+{
+  const struct ddsi_sertopic_pserop *tp = (const struct ddsi_sertopic_pserop *)tpcmn;
+  const struct { uint16_t identifier, options; } header = { tp->native_encoding_identifier, 0 };
+  if (kind == SDK_KEY && tp->ops_key == NULL)
+    return serdata_pserop_fix (tp, serdata_pserop_new (tp, kind, 0, &header));
+  else
+  {
+    void *data;
+    size_t size;
+    if (plist_ser_generic (&data, &size, sample, (kind == SDK_DATA) ? tp->ops : tp->ops_key) < 0)
+      return NULL;
+    const size_t size4 = (size + 3) & ~(size_t)3;
+    struct ddsi_serdata_pserop *d = serdata_pserop_new (tp, kind, size4, &header);
+    assert (tp->ops_key == NULL || (size >= 16 && tp->memsize >= 16));
+    memcpy (d->data, data, size);
+    memset (d->data + size, 0, size4 - size);
+    d->pos = (uint32_t) size;
+    ddsrt_free (data); // FIXME: shouldn't allocate twice & copy
+    // FIXME: and then this silly thing deserialises it immediately again -- perhaps it should be a bit lazier
+    return serdata_pserop_fix (tp, d);
+  }
+}
+
+static struct ddsi_serdata *serdata_pserop_to_topicless (const struct ddsi_serdata *serdata_common)
+{
+  const struct ddsi_serdata_pserop *d = (const struct ddsi_serdata_pserop *)serdata_common;
+  const struct ddsi_sertopic_pserop *tp = (const struct ddsi_sertopic_pserop *)d->c.topic;
+  ddsrt_iovec_t iov = { .iov_base = (char *) &d->identifier, .iov_len = (ddsrt_iov_len_t) (4 + d->pos) };
+  struct ddsi_serdata *dcmn_tl = serdata_pserop_from_ser_iov (&tp->c, SDK_KEY, 1, &iov, iov.iov_len);
+  assert (dcmn_tl != NULL);
+  dcmn_tl->topic = NULL;
+  return dcmn_tl;
+}
+
+static bool serdata_pserop_topicless_to_sample (const struct ddsi_sertopic *topic_common, const struct ddsi_serdata *serdata_common, void *sample, void **bufptr, void *buflim)
+{
+  const struct ddsi_serdata_pserop *d = (const struct ddsi_serdata_pserop *)serdata_common;
+  const struct ddsi_sertopic_pserop *tp = (const struct ddsi_sertopic_pserop *)topic_common;
+  if (bufptr) abort(); else { (void)buflim; } /* FIXME: haven't implemented that bit yet! */
+  if (tp->ops_key)
+    memcpy (sample, d->sample, 16);
+  return true;
+}
+
+static void serdata_pserop_get_keyhash (const struct ddsi_serdata *serdata_common, struct ddsi_keyhash *buf, bool force_md5)
+{
+  const struct ddsi_serdata_pserop *d = (const struct ddsi_serdata_pserop *)serdata_common;
+  const struct ddsi_sertopic_pserop *tp = (const struct ddsi_sertopic_pserop *)d->c.topic;
+  if (tp->ops_key == NULL)
+    memset (buf, 0, 16);
+  else
+  {
+    /* need big-endian representation for key hash, so be lazy & re-serialize
+       (and yes, it costs another malloc ...); note that key at offset 0 implies
+       ops_key is a prefix of ops */
+    void *be;
+    size_t besize;
+    (void) plist_ser_generic_be (&be, &besize, d->sample, tp->ops_key);
+    assert (besize == 16); /* that's the deal with keys for now */
+    if (!force_md5)
+      memcpy (buf, be, 16);
+    else
+    {
+      ddsrt_md5_state_t md5st;
+      ddsrt_md5_init (&md5st);
+      ddsrt_md5_append (&md5st, (ddsrt_md5_byte_t *) be, 16);
+      ddsrt_md5_finish (&md5st, (ddsrt_md5_byte_t *) buf->value);
+    }
+    ddsrt_free (be);
+  }
+}
+
+static size_t serdata_pserop_print_pserop (const struct ddsi_sertopic *sertopic_common, const struct ddsi_serdata *serdata_common, char *buf, size_t size)
+{
+  const struct ddsi_serdata_pserop *d = (const struct ddsi_serdata_pserop *)serdata_common;
+  const struct ddsi_sertopic_pserop *tp = (const struct ddsi_sertopic_pserop *)sertopic_common;
+  return plist_print_generic (buf, size, d->sample, tp->ops);
+}
+
+const struct ddsi_serdata_ops ddsi_serdata_ops_pserop = {
+  .get_size = serdata_pserop_get_size,
+  .eqkey = serdata_pserop_eqkey,
+  .free = serdata_pserop_free,
+  .from_ser = serdata_pserop_from_ser,
+  .from_ser_iov = serdata_pserop_from_ser_iov,
+  .from_keyhash = serdata_pserop_from_keyhash,
+  .from_sample = serdata_pserop_from_sample,
+  .to_ser = serdata_pserop_to_ser,
+  .to_sample = serdata_pserop_to_sample,
+  .to_ser_ref = serdata_pserop_to_ser_ref,
+  .to_ser_unref = serdata_pserop_to_ser_unref,
+  .to_topicless = serdata_pserop_to_topicless,
+  .topicless_to_sample = serdata_pserop_topicless_to_sample,
+  .print = serdata_pserop_print_pserop,
+  .get_keyhash = serdata_pserop_get_keyhash
+};
diff --git a/src/core/ddsi/src/ddsi_sertopic.c b/src/core/ddsi/src/ddsi_sertopic.c
index 04052cc..8c58c8f 100644
--- a/src/core/ddsi/src/ddsi_sertopic.c
+++ b/src/core/ddsi/src/ddsi_sertopic.c
@@ -56,8 +56,7 @@ uint32_t ddsi_sertopic_hash (const struct ddsi_sertopic *a)
 struct ddsi_sertopic *ddsi_sertopic_ref (const struct ddsi_sertopic *sertopic_const)
 {
   struct ddsi_sertopic *sertopic = (struct ddsi_sertopic *) sertopic_const;
-  if (sertopic)
-    ddsrt_atomic_inc32 (&sertopic->refc);
+  ddsrt_atomic_inc32 (&sertopic->refc);
   return sertopic;
 }
 
@@ -68,7 +67,7 @@ struct ddsi_sertopic *ddsi_sertopic_lookup_locked (struct ddsi_domaingv *gv, con
   if (sertopic != NULL)
     assert (sertopic->gv != NULL);
 #endif
-  return ddsi_sertopic_ref (sertopic);
+  return sertopic ? ddsi_sertopic_ref (sertopic) : NULL;
 }
 
 void ddsi_sertopic_register_locked (struct ddsi_domaingv *gv, struct ddsi_sertopic *sertopic)
@@ -84,21 +83,18 @@ void ddsi_sertopic_register_locked (struct ddsi_domaingv *gv, struct ddsi_sertop
 
 void ddsi_sertopic_unref (struct ddsi_sertopic *sertopic)
 {
-  if (sertopic)
+  if (ddsrt_atomic_dec32_ov (&sertopic->refc) == 1)
   {
-    if (ddsrt_atomic_dec32_ov (&sertopic->refc) == 1)
+    /* if registered, drop from set of registered sertopics */
+    if (sertopic->gv)
     {
-      /* if registered, drop from set of registered sertopics */
-      if (sertopic->gv)
-      {
-        ddsrt_mutex_lock (&sertopic->gv->sertopics_lock);
-        (void) ddsrt_hh_remove (sertopic->gv->sertopics, sertopic);
-        ddsrt_mutex_unlock (&sertopic->gv->sertopics_lock);
-        sertopic->gv = NULL;
-      }
-
-      ddsi_sertopic_free (sertopic);
+      ddsrt_mutex_lock (&sertopic->gv->sertopics_lock);
+      (void) ddsrt_hh_remove (sertopic->gv->sertopics, sertopic);
+      ddsrt_mutex_unlock (&sertopic->gv->sertopics_lock);
+      sertopic->gv = NULL;
     }
+
+    ddsi_sertopic_free (sertopic);
   }
 }
 
diff --git a/src/core/ddsi/src/ddsi_sertopic_plist.c b/src/core/ddsi/src/ddsi_sertopic_plist.c
new file mode 100644
index 0000000..f9f98b0
--- /dev/null
+++ b/src/core/ddsi/src/ddsi_sertopic_plist.c
@@ -0,0 +1,95 @@
+/*
+ * Copyright(c) 2020 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+#include <stddef.h>
+#include <ctype.h>
+#include <assert.h>
+#include <string.h>
+
+#include "dds/ddsrt/mh3.h"
+#include "dds/ddsrt/heap.h"
+#include "dds/ddsi/ddsi_plist.h"
+#include "dds/ddsi/ddsi_sertopic.h"
+#include "dds/ddsi/ddsi_serdata_plist.h"
+
+static bool sertopic_plist_equal (const struct ddsi_sertopic *acmn, const struct ddsi_sertopic *bcmn)
+{
+  const struct ddsi_sertopic_plist *a = (struct ddsi_sertopic_plist *) acmn;
+  const struct ddsi_sertopic_plist *b = (struct ddsi_sertopic_plist *) bcmn;
+  if (a->native_encoding_identifier != b->native_encoding_identifier)
+    return false;
+  if (a->keyparam != b->keyparam)
+    return false;
+  return true;
+}
+
+static uint32_t sertopic_plist_hash (const struct ddsi_sertopic *tpcmn)
+{
+  const struct ddsi_sertopic_plist *tp = (struct ddsi_sertopic_plist *) tpcmn;
+  uint32_t h = 0;
+  h = ddsrt_mh3 (&tp->native_encoding_identifier, sizeof (tp->native_encoding_identifier), h);
+  h = ddsrt_mh3 (&tp->keyparam, sizeof (tp->keyparam), h);
+  return h;
+}
+
+static void sertopic_plist_free (struct ddsi_sertopic *tpcmn)
+{
+  struct ddsi_sertopic_plist *tp = (struct ddsi_sertopic_plist *) tpcmn;
+  ddsi_sertopic_fini (&tp->c);
+  ddsrt_free (tp);
+}
+
+static void sertopic_plist_zero_samples (const struct ddsi_sertopic *sertopic_common, void *sample, size_t count)
+{
+  (void) sertopic_common;
+  ddsi_plist_t *xs = sample;
+  for (size_t i = 0; i < count; i++)
+    ddsi_plist_init_empty (&xs[i]);
+}
+
+static void sertopic_plist_realloc_samples (void **ptrs, const struct ddsi_sertopic *sertopic_common, void *old, size_t oldcount, size_t count)
+{
+  (void) sertopic_common;
+  ddsi_plist_t *new = (oldcount == count) ? old : dds_realloc (old, count * sizeof (ddsi_plist_t));
+  if (new)
+  {
+    for (size_t i = count; i < oldcount; i++)
+      ddsi_plist_init_empty (&new[i]);
+    for (size_t i = 0; i < count; i++)
+      ptrs[i] = &new[i];
+  }
+}
+
+static void sertopic_plist_free_samples (const struct ddsi_sertopic *sertopic_common, void **ptrs, size_t count, dds_free_op_t op)
+{
+  (void) sertopic_common;
+  if (count > 0)
+  {
+#ifndef NDEBUG
+    for (size_t i = 0, off = 0; i < count; i++, off += sizeof (ddsi_plist_t))
+      assert ((char *)ptrs[i] == (char *)ptrs[0] + off);
+#endif
+    ddsi_plist_t *xs = ptrs[0];
+    for (size_t i = 0; i < count; i++)
+      ddsi_plist_fini (&xs[i]);
+    if (op & DDS_FREE_ALL_BIT)
+      dds_free (ptrs[0]);
+  }
+}
+
+const struct ddsi_sertopic_ops ddsi_sertopic_ops_plist = {
+  .equal = sertopic_plist_equal,
+  .hash = sertopic_plist_hash,
+  .free = sertopic_plist_free,
+  .zero_samples = sertopic_plist_zero_samples,
+  .realloc_samples = sertopic_plist_realloc_samples,
+  .free_samples = sertopic_plist_free_samples
+};
diff --git a/src/core/ddsi/src/ddsi_sertopic_pserop.c b/src/core/ddsi/src/ddsi_sertopic_pserop.c
new file mode 100644
index 0000000..c8ebdb9
--- /dev/null
+++ b/src/core/ddsi/src/ddsi_sertopic_pserop.c
@@ -0,0 +1,118 @@
+/*
+ * Copyright(c) 2020 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+#include <stddef.h>
+#include <ctype.h>
+#include <assert.h>
+#include <string.h>
+
+#include "dds/ddsrt/md5.h"
+#include "dds/ddsrt/mh3.h"
+#include "dds/ddsrt/heap.h"
+#include "dds/ddsi/q_bswap.h"
+#include "dds/ddsi/q_config.h"
+#include "dds/ddsi/q_freelist.h"
+#include "dds/ddsi/ddsi_plist_generic.h"
+#include "dds/ddsi/ddsi_sertopic.h"
+#include "dds/ddsi/ddsi_serdata_pserop.h"
+
+static bool sertopic_pserop_equal (const struct ddsi_sertopic *acmn, const struct ddsi_sertopic *bcmn)
+{
+  const struct ddsi_sertopic_pserop *a = (struct ddsi_sertopic_pserop *) acmn;
+  const struct ddsi_sertopic_pserop *b = (struct ddsi_sertopic_pserop *) bcmn;
+  if (a->native_encoding_identifier != b->native_encoding_identifier)
+    return false;
+  if (a->memsize != b->memsize)
+    return false;
+  if (a->nops != b->nops)
+    return false;
+  assert (a->nops > 0);
+  if (memcmp (a->ops, b->ops, a->nops * sizeof (*a->ops)) != 0)
+    return false;
+  if (a->nops_key != b->nops_key)
+    return false;
+  if (a->ops_key && memcmp (a->ops_key, b->ops_key, a->nops_key * sizeof (*a->ops_key)) != 0)
+    return false;
+  return true;
+}
+
+static uint32_t sertopic_pserop_hash (const struct ddsi_sertopic *tpcmn)
+{
+  const struct ddsi_sertopic_pserop *tp = (struct ddsi_sertopic_pserop *) tpcmn;
+  uint32_t h = 0;
+  h = ddsrt_mh3 (&tp->native_encoding_identifier, sizeof (tp->native_encoding_identifier), h);
+  h = ddsrt_mh3 (&tp->memsize, sizeof (tp->memsize), h);
+  h = ddsrt_mh3 (&tp->nops, sizeof (tp->nops), h);
+  h = ddsrt_mh3 (tp->ops, tp->nops * sizeof (*tp->ops), h);
+  h = ddsrt_mh3 (&tp->nops_key, sizeof (tp->nops_key), h);
+  if (tp->ops_key)
+    h = ddsrt_mh3 (tp->ops_key, tp->nops_key * sizeof (*tp->ops_key), h);
+  return h;
+}
+
+static void sertopic_pserop_free (struct ddsi_sertopic *tpcmn)
+{
+  struct ddsi_sertopic_pserop *tp = (struct ddsi_sertopic_pserop *) tpcmn;
+  ddsi_sertopic_fini (&tp->c);
+  ddsrt_free (tp);
+}
+
+static void sertopic_pserop_zero_samples (const struct ddsi_sertopic *sertopic_common, void *sample, size_t count)
+{
+  const struct ddsi_sertopic_pserop *tp = (const struct ddsi_sertopic_pserop *)sertopic_common;
+  memset (sample, 0, tp->memsize * count);
+}
+
+static void sertopic_pserop_realloc_samples (void **ptrs, const struct ddsi_sertopic *sertopic_common, void *old, size_t oldcount, size_t count)
+{
+  const struct ddsi_sertopic_pserop *tp = (const struct ddsi_sertopic_pserop *)sertopic_common;
+  const size_t size = tp->memsize;
+  char *new = (oldcount == count) ? old : dds_realloc (old, size * count);
+  if (new && count > oldcount)
+    memset (new + size * oldcount, 0, size * (count - oldcount));
+  for (size_t i = 0; i < count; i++)
+  {
+    void *ptr = (char *) new + i * size;
+    ptrs[i] = ptr;
+  }
+}
+
+static void sertopic_pserop_free_samples (const struct ddsi_sertopic *sertopic_common, void **ptrs, size_t count, dds_free_op_t op)
+{
+  if (count > 0)
+  {
+    const struct ddsi_sertopic_pserop *tp = (const struct ddsi_sertopic_pserop *)sertopic_common;
+    const size_t size = tp->memsize;
+#ifndef NDEBUG
+    for (size_t i = 0, off = 0; i < count; i++, off += size)
+      assert ((char *)ptrs[i] == (char *)ptrs[0] + off);
+#endif
+    char *ptr = ptrs[0];
+    for (size_t i = 0; i < count; i++)
+    {
+      plist_fini_generic (ptr, tp->ops, false);
+      ptr += size;
+    }
+    if (op & DDS_FREE_ALL_BIT)
+    {
+      dds_free (ptrs[0]);
+    }
+  }
+}
+
+const struct ddsi_sertopic_ops ddsi_sertopic_ops_pserop = {
+  .equal = sertopic_pserop_equal,
+  .hash = sertopic_pserop_hash,
+  .free = sertopic_pserop_free,
+  .zero_samples = sertopic_pserop_zero_samples,
+  .realloc_samples = sertopic_pserop_realloc_samples,
+  .free_samples = sertopic_pserop_free_samples
+};
diff --git a/src/core/ddsi/src/q_config.c b/src/core/ddsi/src/q_config.c
index 2739e6b..515a4c6 100644
--- a/src/core/ddsi/src/q_config.c
+++ b/src/core/ddsi/src/q_config.c
@@ -863,8 +863,6 @@ static const struct cfgelem discovery_cfgelems[] = {
     BLURB("<p>This element specifies the interval between spontaneous transmissions of participant discovery packets.</p>") },
   { LEAF("DefaultMulticastAddress"), 1, "auto", ABSOFF(defaultMulticastAddressString), 0, uf_networkAddress, 0, pf_networkAddress,
     BLURB("<p>This element specifies the default multicast address for all traffic other than participant discovery packets. It defaults to Discovery/SPDPMulticastAddress.</p>") },
-  { LEAF("EnableTopicDiscovery"), 1, "true", ABSOFF(do_topic_discovery), 0, uf_boolean, 0, pf_boolean,
-    BLURB("<p>Do not use.</p>") },
   { GROUP("Ports", discovery_ports_cfgelems),
     BLURB("<p>The Ports element allows specifying various parameters related to the port numbers used for discovery. These all have default values specified by the DDSI 2.1 specification and rarely need to be changed.</p>") },
   END_MARKER
diff --git a/src/core/ddsi/src/q_ddsi_discovery.c b/src/core/ddsi/src/q_ddsi_discovery.c
index 29421d3..865a8dc 100644
--- a/src/core/ddsi/src/q_ddsi_discovery.c
+++ b/src/core/ddsi/src/q_ddsi_discovery.c
@@ -32,6 +32,7 @@
 #include "dds/ddsi/q_xevent.h"
 #include "dds/ddsi/q_addrset.h"
 #include "dds/ddsi/q_ddsi_discovery.h"
+#include "dds/ddsi/ddsi_serdata_plist.h"
 
 #include "dds/ddsi/q_radmin.h"
 #include "dds/ddsi/ddsi_entity_index.h"
@@ -175,36 +176,22 @@ static void maybe_add_pp_as_meta_to_as_disc (struct ddsi_domaingv *gv, const str
   }
 }
 
-static int write_mpayload (struct writer *wr, int alive, nn_parameterid_t keyparam, struct nn_xmsg *mpayload)
+void get_participant_builtin_topic_data (const struct participant *pp, ddsi_plist_t *dst, struct participant_builtin_topic_data_locators *locs)
 {
-  struct thread_state1 * const ts1 = lookup_thread_state ();
-  struct ddsi_plist_sample plist_sample;
-  struct ddsi_serdata *serdata;
-  nn_xmsg_payload_to_plistsample (&plist_sample, keyparam, mpayload);
-  serdata = ddsi_serdata_from_sample (wr->e.gv->plist_topic, alive ? SDK_DATA : SDK_KEY, &plist_sample);
-  serdata->statusinfo = alive ? 0 : NN_STATUSINFO_DISPOSE | NN_STATUSINFO_UNREGISTER;
-  serdata->timestamp = ddsrt_time_wallclock ();
-  return write_sample_nogc_notk (ts1, NULL, wr, serdata);
-}
-
-void get_participant_builtin_topic_data(const struct participant *pp, struct nn_xmsg *mpayload, bool be)
-{
-  struct nn_locators_one def_uni_loc_one, def_multi_loc_one, meta_uni_loc_one, meta_multi_loc_one;
-  ddsi_plist_t ps;
   size_t size;
   char node[64];
   uint64_t qosdiff;
 
-  ddsi_plist_init_empty (&ps);
-  ps.present |= PP_PARTICIPANT_GUID | PP_BUILTIN_ENDPOINT_SET |
+  ddsi_plist_init_empty (dst);
+  dst->present |= PP_PARTICIPANT_GUID | PP_BUILTIN_ENDPOINT_SET |
     PP_PROTOCOL_VERSION | PP_VENDORID | PP_PARTICIPANT_LEASE_DURATION |
     PP_DOMAIN_ID;
-  ps.participant_guid = pp->e.guid;
-  ps.builtin_endpoint_set = pp->bes;
-  ps.protocol_version.major = RTPS_MAJOR;
-  ps.protocol_version.minor = RTPS_MINOR;
-  ps.vendorid = NN_VENDORID_ECLIPSE;
-  ps.domain_id = pp->e.gv->config.extDomainId.value;
+  dst->participant_guid = pp->e.guid;
+  dst->builtin_endpoint_set = pp->bes;
+  dst->protocol_version.major = RTPS_MAJOR;
+  dst->protocol_version.minor = RTPS_MINOR;
+  dst->vendorid = NN_VENDORID_ECLIPSE;
+  dst->domain_id = pp->e.gv->config.extDomainId.value;
   /* Be sure not to send a DOMAIN_TAG when it is the default (an empty)
      string: it is an "incompatible-if-unrecognized" parameter, and so
      implementations that don't understand the parameter will refuse to
@@ -212,34 +199,34 @@ void get_participant_builtin_topic_data(const struct participant *pp, struct nn_
      compatibility. */
   if (strcmp (pp->e.gv->config.domainTag, "") != 0)
   {
-    ps.present |= PP_DOMAIN_TAG;
-    ps.aliased |= PP_DOMAIN_TAG;
-    ps.domain_tag = pp->e.gv->config.domainTag;
+    dst->present |= PP_DOMAIN_TAG;
+    dst->aliased |= PP_DOMAIN_TAG;
+    dst->domain_tag = pp->e.gv->config.domainTag;
   }
-  ps.default_unicast_locators.n = 1;
-  ps.default_unicast_locators.first =
-    ps.default_unicast_locators.last = &def_uni_loc_one;
-  ps.metatraffic_unicast_locators.n = 1;
-  ps.metatraffic_unicast_locators.first =
-    ps.metatraffic_unicast_locators.last = &meta_uni_loc_one;
-  def_uni_loc_one.next = NULL;
-  meta_uni_loc_one.next = NULL;
+  dst->default_unicast_locators.n = 1;
+  dst->default_unicast_locators.first =
+    dst->default_unicast_locators.last = &locs->def_uni_loc_one;
+  dst->metatraffic_unicast_locators.n = 1;
+  dst->metatraffic_unicast_locators.first =
+    dst->metatraffic_unicast_locators.last = &locs->meta_uni_loc_one;
+  locs->def_uni_loc_one.next = NULL;
+  locs->meta_uni_loc_one.next = NULL;
 
   if (pp->e.gv->config.many_sockets_mode == MSM_MANY_UNICAST)
   {
-    def_uni_loc_one.loc = pp->m_locator;
-    meta_uni_loc_one.loc = pp->m_locator;
+    locs->def_uni_loc_one.loc = pp->m_locator;
+    locs->meta_uni_loc_one.loc = pp->m_locator;
   }
   else
   {
-    def_uni_loc_one.loc = pp->e.gv->loc_default_uc;
-    meta_uni_loc_one.loc = pp->e.gv->loc_meta_uc;
+    locs->def_uni_loc_one.loc = pp->e.gv->loc_default_uc;
+    locs->meta_uni_loc_one.loc = pp->e.gv->loc_meta_uc;
   }
 
   if (pp->e.gv->config.publish_uc_locators)
   {
-    ps.present |= PP_DEFAULT_UNICAST_LOCATOR | PP_METATRAFFIC_UNICAST_LOCATOR;
-    ps.aliased |= PP_DEFAULT_UNICAST_LOCATOR | PP_METATRAFFIC_UNICAST_LOCATOR;
+    dst->present |= PP_DEFAULT_UNICAST_LOCATOR | PP_METATRAFFIC_UNICAST_LOCATOR;
+    dst->aliased |= PP_DEFAULT_UNICAST_LOCATOR | PP_METATRAFFIC_UNICAST_LOCATOR;
   }
 
   if (pp->e.gv->config.allowMulticast)
@@ -260,51 +247,51 @@ void get_participant_builtin_topic_data(const struct participant *pp, struct nn_
 #endif
     if (include)
     {
-      ps.present |= PP_DEFAULT_MULTICAST_LOCATOR | PP_METATRAFFIC_MULTICAST_LOCATOR;
-      ps.aliased |= PP_DEFAULT_MULTICAST_LOCATOR | PP_METATRAFFIC_MULTICAST_LOCATOR;
-      ps.default_multicast_locators.n = 1;
-      ps.default_multicast_locators.first =
-      ps.default_multicast_locators.last = &def_multi_loc_one;
-      ps.metatraffic_multicast_locators.n = 1;
-      ps.metatraffic_multicast_locators.first =
-      ps.metatraffic_multicast_locators.last = &meta_multi_loc_one;
-      def_multi_loc_one.next = NULL;
-      def_multi_loc_one.loc = pp->e.gv->loc_default_mc;
-      meta_multi_loc_one.next = NULL;
-      meta_multi_loc_one.loc = pp->e.gv->loc_meta_mc;
+      dst->present |= PP_DEFAULT_MULTICAST_LOCATOR | PP_METATRAFFIC_MULTICAST_LOCATOR;
+      dst->aliased |= PP_DEFAULT_MULTICAST_LOCATOR | PP_METATRAFFIC_MULTICAST_LOCATOR;
+      dst->default_multicast_locators.n = 1;
+      dst->default_multicast_locators.first =
+      dst->default_multicast_locators.last = &locs->def_multi_loc_one;
+      dst->metatraffic_multicast_locators.n = 1;
+      dst->metatraffic_multicast_locators.first =
+      dst->metatraffic_multicast_locators.last = &locs->meta_multi_loc_one;
+      locs->def_multi_loc_one.next = NULL;
+      locs->def_multi_loc_one.loc = pp->e.gv->loc_default_mc;
+      locs->meta_multi_loc_one.next = NULL;
+      locs->meta_multi_loc_one.loc = pp->e.gv->loc_meta_mc;
     }
   }
-  ps.participant_lease_duration = pp->lease_duration;
+  dst->participant_lease_duration = pp->lease_duration;
 
   /* Add Adlink specific version information */
   {
-    ps.present |= PP_ADLINK_PARTICIPANT_VERSION_INFO;
-    memset (&ps.adlink_participant_version_info, 0, sizeof (ps.adlink_participant_version_info));
-    ps.adlink_participant_version_info.version = 0;
-    ps.adlink_participant_version_info.flags =
+    dst->present |= PP_ADLINK_PARTICIPANT_VERSION_INFO;
+    memset (&dst->adlink_participant_version_info, 0, sizeof (dst->adlink_participant_version_info));
+    dst->adlink_participant_version_info.version = 0;
+    dst->adlink_participant_version_info.flags =
       NN_ADLINK_FL_DDSI2_PARTICIPANT_FLAG |
       NN_ADLINK_FL_PTBES_FIXED_0 |
       NN_ADLINK_FL_SUPPORTS_STATUSINFOX;
     if (pp->e.gv->config.besmode == BESMODE_MINIMAL)
-      ps.adlink_participant_version_info.flags |= NN_ADLINK_FL_MINIMAL_BES_MODE;
+      dst->adlink_participant_version_info.flags |= NN_ADLINK_FL_MINIMAL_BES_MODE;
     ddsrt_mutex_lock (&pp->e.gv->privileged_pp_lock);
     if (pp->is_ddsi2_pp)
-      ps.adlink_participant_version_info.flags |= NN_ADLINK_FL_PARTICIPANT_IS_DDSI2;
+      dst->adlink_participant_version_info.flags |= NN_ADLINK_FL_PARTICIPANT_IS_DDSI2;
     ddsrt_mutex_unlock (&pp->e.gv->privileged_pp_lock);
 
     if (ddsrt_gethostname(node, sizeof(node)-1) < 0)
       (void) ddsrt_strlcpy (node, "unknown", sizeof (node));
     size = strlen(node) + strlen(DDS_VERSION) + strlen(DDS_HOST_NAME) + strlen(DDS_TARGET_NAME) + 4; /* + ///'\0' */
-    ps.adlink_participant_version_info.internals = ddsrt_malloc(size);
-    (void) snprintf(ps.adlink_participant_version_info.internals, size, "%s/%s/%s/%s", node, DDS_VERSION, DDS_HOST_NAME, DDS_TARGET_NAME);
-    ETRACE (pp, "spdp_write("PGUIDFMT") - internals: %s\n", PGUID (pp->e.guid), ps.adlink_participant_version_info.internals);
+    dst->adlink_participant_version_info.internals = ddsrt_malloc(size);
+    (void) snprintf(dst->adlink_participant_version_info.internals, size, "%s/%s/%s/%s", node, DDS_VERSION, DDS_HOST_NAME, DDS_TARGET_NAME);
+    ETRACE (pp, "spdp_write("PGUIDFMT") - internals: %s\n", PGUID (pp->e.guid), dst->adlink_participant_version_info.internals);
   }
 
 #ifdef DDSI_INCLUDE_SECURITY
   /* Add Security specific information. */
-  if (q_omg_get_participant_security_info(pp, &(ps.participant_security_info))) {
-    ps.present |= PP_PARTICIPANT_SECURITY_INFO;
-    ps.aliased |= PP_PARTICIPANT_SECURITY_INFO;
+  if (q_omg_get_participant_security_info(pp, &(dst->participant_security_info))) {
+    dst->present |= PP_PARTICIPANT_SECURITY_INFO;
+    dst->aliased |= PP_PARTICIPANT_SECURITY_INFO;
   }
 #endif
 
@@ -313,62 +300,28 @@ void get_participant_builtin_topic_data(const struct participant *pp, struct nn_
   if (pp->e.gv->config.explicitly_publish_qos_set_to_default)
     qosdiff |= ~QP_UNRECOGNIZED_INCOMPATIBLE_MASK;
 
-  assert (ps.qos.present == 0);
-  ddsi_plist_addtomsg_bo (mpayload, &ps, ~(uint64_t)0, 0, be);
-  ddsi_plist_addtomsg_bo (mpayload, pp->plist, 0, qosdiff, be);
+  assert (dst->qos.present == 0);
+  ddsi_plist_mergein_missing (dst, pp->plist, 0, qosdiff);
 #ifdef DDSI_INCLUDE_SECURITY
   if (q_omg_participant_is_secure(pp))
-     ddsi_plist_addtomsg_bo (mpayload, pp->plist, PP_IDENTITY_TOKEN | PP_PERMISSIONS_TOKEN, 0, be);
+    ddsi_plist_mergein_missing (dst, pp->plist, PP_IDENTITY_TOKEN | PP_PERMISSIONS_TOKEN, 0);
 #endif
-  nn_xmsg_addpar_sentinel_bo (mpayload, be);
-  ddsi_plist_fini (&ps);
+}
+
+static int write_and_fini_plist (struct writer *wr, ddsi_plist_t *ps, bool alive)
+{
+  struct ddsi_serdata *serdata = ddsi_serdata_from_sample (wr->topic, alive ? SDK_DATA : SDK_KEY, ps);
+  ddsi_plist_fini (ps);
+  serdata->statusinfo = alive ? 0 : (NN_STATUSINFO_DISPOSE | NN_STATUSINFO_UNREGISTER);
+  serdata->timestamp = ddsrt_time_wallclock ();
+  return write_sample_nogc_notk (lookup_thread_state (), NULL, wr, serdata);
 }
 
 int spdp_write (struct participant *pp)
 {
-  struct nn_xmsg *mpayload;
   struct writer *wr;
-  int ret;
-
-  if (pp->e.onlylocal) {
-      /* This topic is only locally available. */
-      return 0;
-  }
-
-  ETRACE (pp, "spdp_write("PGUIDFMT")\n", PGUID (pp->e.guid));
-
-  if ((wr = get_builtin_writer (pp, NN_ENTITYID_SPDP_BUILTIN_PARTICIPANT_WRITER)) == NULL)
-  {
-    ETRACE (pp, "spdp_write("PGUIDFMT") - builtin participant writer not found\n", PGUID (pp->e.guid));
-    return 0;
-  }
-
-  /* First create a fake message for the payload: we can add plists to
-     xmsgs easily, but not to serdata.  But it is rather easy to copy
-     the payload of an xmsg over to a serdata ...  Expected size isn't
-     terribly important, the msg will grow as needed, address space is
-     essentially meaningless because we only use the message to
-     construct the payload. */
-  mpayload = nn_xmsg_new (pp->e.gv->xmsgpool, &pp->e.guid, pp, 0, NN_XMSG_KIND_DATA);
-  get_participant_builtin_topic_data(pp, mpayload, false);
-  ret = write_mpayload (wr, 1, PID_PARTICIPANT_GUID, mpayload);
-  nn_xmsg_free (mpayload);
-  return ret;
-}
-
-
-
-#if 0
-int spdp_write (struct participant *pp)
-{
-  struct nn_xmsg *mpayload;
-  struct nn_locators_one def_uni_loc_one, def_multi_loc_one, meta_uni_loc_one, meta_multi_loc_one;
   ddsi_plist_t ps;
-  struct writer *wr;
-  size_t size;
-  char node[64];
-  uint64_t qosdiff;
-  int ret;
+  struct participant_builtin_topic_data_locators locs;
 
   if (pp->e.onlylocal) {
       /* This topic is only locally available. */
@@ -383,154 +336,14 @@ int spdp_write (struct participant *pp)
     return 0;
   }
 
-  /* First create a fake message for the payload: we can add plists to
-     xmsgs easily, but not to serdata.  But it is rather easy to copy
-     the payload of an xmsg over to a serdata ...  Expected size isn't
-     terribly important, the msg will grow as needed, address space is
-     essentially meaningless because we only use the message to
-     construct the payload. */
-  mpayload = nn_xmsg_new (pp->e.gv->xmsgpool, &pp->e.guid, pp, 0, NN_XMSG_KIND_DATA);
-
-  ddsi_plist_init_empty (&ps);
-  ps.present |= PP_PARTICIPANT_GUID | PP_BUILTIN_ENDPOINT_SET |
-    PP_PROTOCOL_VERSION | PP_VENDORID | PP_PARTICIPANT_LEASE_DURATION |
-    PP_DOMAIN_ID;
-  ps.participant_guid = pp->e.guid;
-  ps.builtin_endpoint_set = pp->bes;
-  ps.protocol_version.major = RTPS_MAJOR;
-  ps.protocol_version.minor = RTPS_MINOR;
-  ps.vendorid = NN_VENDORID_ECLIPSE;
-  ps.domain_id = pp->e.gv->config.extDomainId.value;
-  /* Be sure not to send a DOMAIN_TAG when it is the default (an empty)
-     string: it is an "incompatible-if-unrecognized" parameter, and so
-     implementations that don't understand the parameter will refuse to
-     discover us, and so sending the default would break backwards
-     compatibility. */
-  if (strcmp (pp->e.gv->config.domainTag, "") != 0)
-  {
-    ps.present |= PP_DOMAIN_TAG;
-    ps.aliased |= PP_DOMAIN_TAG;
-    ps.domain_tag = pp->e.gv->config.domainTag;
-  }
-  ps.default_unicast_locators.n = 1;
-  ps.default_unicast_locators.first =
-    ps.default_unicast_locators.last = &def_uni_loc_one;
-  ps.metatraffic_unicast_locators.n = 1;
-  ps.metatraffic_unicast_locators.first =
-    ps.metatraffic_unicast_locators.last = &meta_uni_loc_one;
-  def_uni_loc_one.next = NULL;
-  meta_uni_loc_one.next = NULL;
-
-  if (pp->e.gv->config.many_sockets_mode == MSM_MANY_UNICAST)
-  {
-    def_uni_loc_one.loc = pp->m_locator;
-    meta_uni_loc_one.loc = pp->m_locator;
-  }
-  else
-  {
-    def_uni_loc_one.loc = pp->e.gv->loc_default_uc;
-    meta_uni_loc_one.loc = pp->e.gv->loc_meta_uc;
-  }
-
-  if (pp->e.gv->config.publish_uc_locators)
-  {
-    ps.present |= PP_DEFAULT_UNICAST_LOCATOR | PP_METATRAFFIC_UNICAST_LOCATOR;
-    ps.aliased |= PP_DEFAULT_UNICAST_LOCATOR | PP_METATRAFFIC_UNICAST_LOCATOR;
-  }
-
-  if (pp->e.gv->config.allowMulticast)
-  {
-    int include = 0;
-#ifdef DDSI_INCLUDE_SSM
-    /* Note that if the default multicast address is an SSM address,
-       we will simply advertise it. The recipients better understand
-       it means the writers will publish to address and the readers
-       favour SSM. */
-    if (ddsi_is_ssm_mcaddr (pp->e.gv, &pp->e.gv->loc_default_mc))
-      include = (pp->e.gv->config.allowMulticast & AMC_SSM) != 0;
-    else
-      include = (pp->e.gv->config.allowMulticast & AMC_ASM) != 0;
-#else
-    if (pp->e.gv->config.allowMulticast & AMC_ASM)
-      include = 1;
-#endif
-    if (include)
-    {
-      ps.present |= PP_DEFAULT_MULTICAST_LOCATOR | PP_METATRAFFIC_MULTICAST_LOCATOR;
-      ps.aliased |= PP_DEFAULT_MULTICAST_LOCATOR | PP_METATRAFFIC_MULTICAST_LOCATOR;
-      ps.default_multicast_locators.n = 1;
-      ps.default_multicast_locators.first =
-      ps.default_multicast_locators.last = &def_multi_loc_one;
-      ps.metatraffic_multicast_locators.n = 1;
-      ps.metatraffic_multicast_locators.first =
-      ps.metatraffic_multicast_locators.last = &meta_multi_loc_one;
-      def_multi_loc_one.next = NULL;
-      def_multi_loc_one.loc = pp->e.gv->loc_default_mc;
-      meta_multi_loc_one.next = NULL;
-      meta_multi_loc_one.loc = pp->e.gv->loc_meta_mc;
-    }
-  }
-  ps.participant_lease_duration = pp->lease_duration;
-
-  /* Add Adlink specific version information */
-  {
-    ps.present |= PP_ADLINK_PARTICIPANT_VERSION_INFO;
-    memset (&ps.adlink_participant_version_info, 0, sizeof (ps.adlink_participant_version_info));
-    ps.adlink_participant_version_info.version = 0;
-    ps.adlink_participant_version_info.flags =
-      NN_ADLINK_FL_DDSI2_PARTICIPANT_FLAG |
-      NN_ADLINK_FL_PTBES_FIXED_0 |
-      NN_ADLINK_FL_SUPPORTS_STATUSINFOX;
-    if (pp->e.gv->config.besmode == BESMODE_MINIMAL)
-      ps.adlink_participant_version_info.flags |= NN_ADLINK_FL_MINIMAL_BES_MODE;
-    ddsrt_mutex_lock (&pp->e.gv->privileged_pp_lock);
-    if (pp->is_ddsi2_pp)
-      ps.adlink_participant_version_info.flags |= NN_ADLINK_FL_PARTICIPANT_IS_DDSI2;
-    ddsrt_mutex_unlock (&pp->e.gv->privileged_pp_lock);
-
-    if (ddsrt_gethostname(node, sizeof(node)-1) < 0)
-      (void) ddsrt_strlcpy (node, "unknown", sizeof (node));
-    size = strlen(node) + strlen(DDS_VERSION) + strlen(DDS_HOST_NAME) + strlen(DDS_TARGET_NAME) + 4; /* + ///'\0' */
-    ps.adlink_participant_version_info.internals = ddsrt_malloc(size);
-    (void) snprintf(ps.adlink_participant_version_info.internals, size, "%s/%s/%s/%s", node, DDS_VERSION, DDS_HOST_NAME, DDS_TARGET_NAME);
-    ETRACE (pp, "spdp_write("PGUIDFMT") - internals: %s\n", PGUID (pp->e.guid), ps.adlink_participant_version_info.internals);
-  }
-
-#ifdef DDSI_INCLUDE_SECURITY
-  /* Add Security specific information. */
-  if (q_omg_get_participant_security_info(pp, &(ps.participant_security_info))) {
-    ps.present |= PP_PARTICIPANT_SECURITY_INFO;
-    ps.aliased |= PP_PARTICIPANT_SECURITY_INFO;
-  }
-#endif
-
-  /* Participant QoS's insofar as they are set, different from the default.  Currently, that means just USER_DATA. */
-  qosdiff = ddsi_xqos_delta (&pp->plist->qos, &pp->e.gv->default_plist_pp.qos, QP_USER_DATA);
-  if (pp->e.gv->config.explicitly_publish_qos_set_to_default)
-    qosdiff |= ~QP_UNRECOGNIZED_INCOMPATIBLE_MASK;
-
-  assert (ps.qos.present == 0);
-  ddsi_plist_addtomsg (mpayload, &ps, ~(uint64_t)0, 0);
-  ddsi_plist_addtomsg (mpayload, pp->plist, 0, qosdiff);
-#ifdef DDSI_INCLUDE_SECURITY
-  if (q_omg_participant_is_secure(pp))
-    ddsi_plist_addtomsg (mpayload, pp->plist, PP_IDENTITY_TOKEN | PP_PERMISSIONS_TOKEN, 0);
-#endif
-  nn_xmsg_addpar_sentinel (mpayload);
-  ddsi_plist_fini (&ps);
-
-  ret = write_mpayload (wr, 1, PID_PARTICIPANT_GUID, mpayload);
-  nn_xmsg_free (mpayload);
-  return ret;
+  get_participant_builtin_topic_data (pp, &ps, &locs);
+  return write_and_fini_plist (wr, &ps, true);
 }
-#endif
 
 static int spdp_dispose_unregister_with_wr (struct participant *pp, unsigned entityid)
 {
-  struct nn_xmsg *mpayload;
   ddsi_plist_t ps;
   struct writer *wr;
-  int ret;
 
   if ((wr = get_builtin_writer (pp, entityid)) == NULL)
   {
@@ -540,17 +353,10 @@ static int spdp_dispose_unregister_with_wr (struct participant *pp, unsigned ent
     return 0;
   }
 
-  mpayload = nn_xmsg_new (pp->e.gv->xmsgpool, &pp->e.guid, pp, 0, NN_XMSG_KIND_DATA);
   ddsi_plist_init_empty (&ps);
   ps.present |= PP_PARTICIPANT_GUID;
   ps.participant_guid = pp->e.guid;
-  ddsi_plist_addtomsg (mpayload, &ps, ~(uint64_t)0, ~(uint64_t)0);
-  nn_xmsg_addpar_sentinel (mpayload);
-  ddsi_plist_fini (&ps);
-
-  ret = write_mpayload (wr, 0, PID_PARTICIPANT_GUID, mpayload);
-  nn_xmsg_free (mpayload);
-  return ret;
+  return write_and_fini_plist (wr, &ps, false);
 }
 
 int spdp_dispose_unregister (struct participant *pp)
@@ -1016,46 +822,23 @@ static int handle_SPDP_alive (const struct receiver_state *rst, seqno_t seq, dds
   return 1;
 }
 
-static void handle_SPDP (const struct receiver_state *rst, ddsi_entityid_t pwr_entityid, seqno_t seq, ddsrt_wctime_t timestamp, unsigned statusinfo, const void *vdata, uint32_t len)
+static void handle_SPDP (const struct receiver_state *rst, ddsi_entityid_t pwr_entityid, seqno_t seq, const struct ddsi_serdata *serdata)
 {
   struct ddsi_domaingv * const gv = rst->gv;
-  const struct CDRHeader *data = vdata; /* built-ins not deserialized (yet) */
-  if (data == NULL)
+  ddsi_plist_t decoded_data;
+  if (ddsi_serdata_to_sample (serdata, &decoded_data, NULL, NULL))
   {
-    RSTTRACE ("SPDP ST%x no payload?\n", statusinfo);
-    return;
-  }
-  else
-  {
-    ddsi_plist_t decoded_data;
-    ddsi_plist_src_t src;
     int interesting = 0;
-    dds_return_t plist_ret;
-    src.protocol_version = rst->protocol_version;
-    src.vendorid = rst->vendor;
-    src.encoding = data->identifier;
-    src.buf = (unsigned char *) data + 4;
-    src.bufsz = len - 4;
-    src.strict = NN_STRICT_P (gv->config);
-    src.factory = gv->m_factory;
-    src.logconfig = &gv->logconfig;
-    if ((plist_ret = ddsi_plist_init_frommsg (&decoded_data, NULL, ~(uint64_t)0, ~(uint64_t)0, &src)) < 0)
-    {
-      if (plist_ret != DDS_RETCODE_UNSUPPORTED)
-        GVWARNING ("SPDP (vendor %u.%u): invalid qos/parameters\n", src.vendorid.id[0], src.vendorid.id[1]);
-      return;
-    }
-
-    switch (statusinfo & (NN_STATUSINFO_DISPOSE | NN_STATUSINFO_UNREGISTER))
+    switch (serdata->statusinfo & (NN_STATUSINFO_DISPOSE | NN_STATUSINFO_UNREGISTER))
     {
       case 0:
-        interesting = handle_SPDP_alive (rst, seq, timestamp, &decoded_data);
+        interesting = handle_SPDP_alive (rst, seq, serdata->timestamp, &decoded_data);
         break;
 
       case NN_STATUSINFO_DISPOSE:
       case NN_STATUSINFO_UNREGISTER:
       case (NN_STATUSINFO_DISPOSE | NN_STATUSINFO_UNREGISTER):
-        interesting = handle_SPDP_dead (rst, pwr_entityid, timestamp, &decoded_data, statusinfo);
+        interesting = handle_SPDP_dead (rst, pwr_entityid, serdata->timestamp, &decoded_data, serdata->statusinfo);
         break;
     }
 
@@ -1115,10 +898,8 @@ static int sedp_write_endpoint
 {
   struct ddsi_domaingv * const gv = wr->e.gv;
   const dds_qos_t *defqos = is_writer_entityid (epguid->entityid) ? &gv->default_xqos_wr : &gv->default_xqos_rd;
-  struct nn_xmsg *mpayload;
   uint64_t qosdiff;
   ddsi_plist_t ps;
-  int ret;
 
   ddsi_plist_init_empty (&ps);
   ps.present |= PP_ENDPOINT_GUID;
@@ -1193,20 +974,9 @@ static int sedp_write_endpoint
     }
   }
 
-  /* The message is only a temporary thing, used only for encoding
-     the QoS and other settings. So the header fields aren't really
-     important, except that they need to be set to reasonable things
-     or it'll crash */
-  mpayload = nn_xmsg_new (gv->xmsgpool, &wr->e.guid, wr->c.pp, 0, NN_XMSG_KIND_DATA);
-  ddsi_plist_addtomsg (mpayload, &ps, ~(uint64_t)0, ~(uint64_t)0);
-  if (xqos) ddsi_xqos_addtomsg (mpayload, xqos, qosdiff);
-  nn_xmsg_addpar_sentinel (mpayload);
-  ddsi_plist_fini (&ps);
-
-  GVLOGDISC ("sedp: write for "PGUIDFMT" via "PGUIDFMT"\n", PGUID (*epguid), PGUID (wr->e.guid));
-  ret = write_mpayload (wr, alive, PID_ENDPOINT_GUID, mpayload);
-  nn_xmsg_free (mpayload);
-  return ret;
+  if (xqos)
+    ddsi_xqos_mergein_missing (&ps.qos, xqos, qosdiff);
+  return write_and_fini_plist (wr, &ps, alive);
 }
 
 static struct writer *get_sedp_writer (const struct participant *pp, unsigned entityid)
@@ -1597,145 +1367,39 @@ static void handle_SEDP_dead (const struct receiver_state *rst, ddsi_plist_t *da
   GVLOGDISC (" %s\n", (res < 0) ? " unknown" : " delete");
 }
 
-static void handle_SEDP (const struct receiver_state *rst, seqno_t seq, ddsrt_wctime_t timestamp, unsigned statusinfo, const void *vdata, uint32_t len)
+static void handle_SEDP (const struct receiver_state *rst, seqno_t seq, struct ddsi_serdata *serdata)
 {
-  struct ddsi_domaingv * const gv = rst->gv;
-  const struct CDRHeader *data = vdata; /* built-ins not deserialized (yet) */
-  GVLOGDISC ("SEDP ST%x", statusinfo);
-  if (data == NULL)
+  ddsi_plist_t decoded_data;
+  if (ddsi_serdata_to_sample (serdata, &decoded_data, NULL, NULL))
   {
-    GVLOGDISC (" no payload?\n");
-    return;
-  }
-  else
-  {
-    ddsi_plist_t decoded_data;
-    ddsi_plist_src_t src;
-    dds_return_t plist_ret;
-    src.protocol_version = rst->protocol_version;
-    src.vendorid = rst->vendor;
-    src.encoding = data->identifier;
-    src.buf = (unsigned char *) data + 4;
-    src.bufsz = len - 4;
-    src.strict = NN_STRICT_P (gv->config);
-    src.factory = gv->m_factory;
-    src.logconfig = &gv->logconfig;
-    if ((plist_ret = ddsi_plist_init_frommsg (&decoded_data, NULL, ~(uint64_t)0, ~(uint64_t)0, &src)) < 0)
-    {
-      if (plist_ret != DDS_RETCODE_UNSUPPORTED)
-        GVWARNING ("SEDP (vendor %u.%u): invalid qos/parameters\n", src.vendorid.id[0], src.vendorid.id[1]);
-      return;
-    }
-
-    switch (statusinfo & (NN_STATUSINFO_DISPOSE | NN_STATUSINFO_UNREGISTER))
+    switch (serdata->statusinfo & (NN_STATUSINFO_DISPOSE | NN_STATUSINFO_UNREGISTER))
     {
       case 0:
-        handle_SEDP_alive (rst, seq, &decoded_data, &rst->src_guid_prefix, rst->vendor, timestamp);
+        handle_SEDP_alive (rst, seq, &decoded_data, &rst->src_guid_prefix, rst->vendor, serdata->timestamp);
         break;
-
       case NN_STATUSINFO_DISPOSE:
       case NN_STATUSINFO_UNREGISTER:
       case (NN_STATUSINFO_DISPOSE | NN_STATUSINFO_UNREGISTER):
-        handle_SEDP_dead (rst, &decoded_data, timestamp);
+        handle_SEDP_dead (rst, &decoded_data, serdata->timestamp);
         break;
     }
-
     ddsi_plist_fini (&decoded_data);
   }
 }
 
 /******************************************************************************
- ***
- *** Topics
- ***
  *****************************************************************************/
 
-int sedp_write_topic (struct participant *pp, const struct ddsi_plist *datap)
-{
-  struct writer *sedp_wr;
-  struct nn_xmsg *mpayload;
-  uint64_t delta;
-  int ret;
-
-  assert (datap->qos.present & QP_TOPIC_NAME);
-
-  if (pp->e.onlylocal) {
-      /* This topic is only locally available. */
-      return 0;
-  }
-
-  sedp_wr = get_sedp_writer (pp, NN_ENTITYID_SEDP_BUILTIN_TOPIC_WRITER);
-
-  mpayload = nn_xmsg_new (sedp_wr->e.gv->xmsgpool, &sedp_wr->e.guid, pp, 0, NN_XMSG_KIND_DATA);
-  delta = ddsi_xqos_delta (&datap->qos, &sedp_wr->e.gv->default_xqos_tp, ~(uint64_t)0);
-  if (sedp_wr->e.gv->config.explicitly_publish_qos_set_to_default)
-    delta |= ~QP_UNRECOGNIZED_INCOMPATIBLE_MASK;
-  ddsi_plist_addtomsg (mpayload, datap, ~(uint64_t)0, delta);
-  nn_xmsg_addpar_sentinel (mpayload);
-
-  ETRACE (pp, "sedp: write topic %s via "PGUIDFMT"\n", datap->qos.topic_name, PGUID (sedp_wr->e.guid));
-  ret = write_mpayload (sedp_wr, 1, PID_TOPIC_NAME, mpayload);
-  nn_xmsg_free (mpayload);
-  return ret;
-}
-
-
-/******************************************************************************
- *****************************************************************************/
-
-/* FIXME: defragment is a copy of the one in q_receive.c, but the deserialised should be enhanced to handle fragmented data (and arguably the processing here should be built on proper data readers) */
-static int defragment (unsigned char **datap, const struct nn_rdata *fragchain, uint32_t sz)
-{
-  if (fragchain->nextfrag == NULL)
-  {
-    *datap = NN_RMSG_PAYLOADOFF (fragchain->rmsg, NN_RDATA_PAYLOAD_OFF (fragchain));
-    return 0;
-  }
-  else
-  {
-    unsigned char *buf;
-    uint32_t off = 0;
-    buf = ddsrt_malloc (sz);
-    while (fragchain)
-    {
-      assert (fragchain->min <= off);
-      assert (fragchain->maxp1 <= sz);
-      if (fragchain->maxp1 > off)
-      {
-        /* only copy if this fragment adds data */
-        const unsigned char *payload = NN_RMSG_PAYLOADOFF (fragchain->rmsg, NN_RDATA_PAYLOAD_OFF (fragchain));
-        memcpy (buf + off, payload + off - fragchain->min, fragchain->maxp1 - off);
-        off = fragchain->maxp1;
-      }
-      fragchain = fragchain->nextfrag;
-    }
-    *datap = buf;
-    return 1;
-  }
-}
-
 int builtins_dqueue_handler (const struct nn_rsample_info *sampleinfo, const struct nn_rdata *fragchain, UNUSED_ARG (const ddsi_guid_t *rdguid), UNUSED_ARG (void *qarg))
 {
   struct ddsi_domaingv * const gv = sampleinfo->rst->gv;
   struct proxy_writer *pwr;
-  struct {
-    struct CDRHeader cdr;
-    nn_parameter_t p_endpoint_guid;
-    char kh[16];
-    nn_parameter_t p_sentinel;
-  } keyhash_payload;
   unsigned statusinfo;
   int need_keyhash;
   ddsi_guid_t srcguid;
   Data_DataFrag_common_t *msg;
   unsigned char data_smhdr_flags;
   ddsi_plist_t qos;
-  unsigned char *datap;
-  int needs_free;
-  uint32_t datasz = sampleinfo->size;
-  ddsrt_wctime_t timestamp;
-
-  needs_free = defragment (&datap, fragchain, sampleinfo->size);
 
   /* Luckily, most of the Data and DataFrag headers are the same - and
      in particular, all that we care about here is the same.  The
@@ -1770,7 +1434,7 @@ int builtins_dqueue_handler (const struct nn_rsample_info *sampleinfo, const str
      consequently expect to need the keyhash.  Then, if sampleinfo
      says it is a complex qos, or the keyhash is required, extract all
      we need from the inline qos. */
-  need_keyhash = (datasz == 0 || (data_smhdr_flags & (DATA_FLAG_KEYFLAG | DATA_FLAG_DATAFLAG)) == 0);
+  need_keyhash = (sampleinfo->size == 0 || (data_smhdr_flags & (DATA_FLAG_KEYFLAG | DATA_FLAG_DATAFLAG)) == 0);
   if (!(sampleinfo->complex_qos || need_keyhash))
   {
     ddsi_plist_init_empty (&qos);
@@ -1809,113 +1473,117 @@ int builtins_dqueue_handler (const struct nn_rsample_info *sampleinfo, const str
     goto done_upd_deliv;
   }
 
-  /* Built-ins still do their own deserialization (SPDP <=> pwr ==
-     NULL)). */
-  if (statusinfo == 0)
+  /* proxy writers don't reference a topic object, SPDP doesn't have matched readers
+     but all the GUIDs are known, so be practical and map that */
+  const struct ddsi_sertopic *topic;
+  switch (srcguid.entityid.u)
   {
-    if (datasz == 0 || !(data_smhdr_flags & DATA_FLAG_DATAFLAG))
-    {
-      GVWARNING ("data(builtin, vendor %u.%u): "PGUIDFMT" #%"PRId64": built-in data but no payload\n",
-                 sampleinfo->rst->vendor.id[0], sampleinfo->rst->vendor.id[1],
-                 PGUID (srcguid), sampleinfo->seq);
-      goto done_upd_deliv;
-    }
+    case NN_ENTITYID_SPDP_BUILTIN_PARTICIPANT_WRITER:
+      topic = gv->spdp_topic;
+      break;
+    case NN_ENTITYID_SEDP_BUILTIN_PUBLICATIONS_WRITER:
+      topic = gv->sedp_writer_topic;
+      break;
+    case NN_ENTITYID_SEDP_BUILTIN_SUBSCRIPTIONS_WRITER:
+      topic = gv->sedp_reader_topic;
+      break;
+    case NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_MESSAGE_WRITER:
+      topic = gv->pmd_topic;
+      break;
+#ifdef DDSI_INCLUDE_SECURITY
+    case NN_ENTITYID_SPDP_RELIABLE_BUILTIN_PARTICIPANT_SECURE_WRITER:
+      topic = gv->spdp_secure_topic;
+      break;
+    case NN_ENTITYID_SEDP_BUILTIN_PUBLICATIONS_SECURE_WRITER:
+      topic = gv->sedp_writer_secure_topic;
+      break;
+    case NN_ENTITYID_SEDP_BUILTIN_SUBSCRIPTIONS_SECURE_WRITER:
+      topic = gv->sedp_reader_secure_topic;
+      break;
+    case NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_MESSAGE_SECURE_WRITER:
+      topic = gv->pmd_secure_topic;
+      break;
+    case NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_STATELESS_MESSAGE_WRITER:
+      topic = gv->pgm_stateless_topic;
+      break;
+    case NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_VOLATILE_SECURE_WRITER:
+      topic = gv->pgm_volatile_topic;
+      break;
+#endif
+    default:
+      topic = NULL;
+      break;
   }
-  else if (datasz)
+  if (topic == NULL)
   {
-    /* Raw data must be full payload for write, just keys for
-       dispose and unregister. First has been checked; the second
-       hasn't been checked fully yet. */
-    if (!(data_smhdr_flags & DATA_FLAG_KEYFLAG))
-    {
-      GVWARNING ("data(builtin, vendor %u.%u): "PGUIDFMT" #%"PRId64": dispose/unregister of built-in data but payload not just key\n",
-                 sampleinfo->rst->vendor.id[0], sampleinfo->rst->vendor.id[1],
-                 PGUID (srcguid), sampleinfo->seq);
-      goto done_upd_deliv;
-    }
+    /* unrecognized source entity id => ignore */
+    goto done_upd_deliv;
   }
+
+  struct ddsi_serdata *d;
+  if (data_smhdr_flags & DATA_FLAG_DATAFLAG)
+    d = ddsi_serdata_from_ser (topic, SDK_DATA, fragchain, sampleinfo->size);
+  else if (data_smhdr_flags & DATA_FLAG_KEYFLAG)
+    d = ddsi_serdata_from_ser (topic, SDK_KEY, fragchain, sampleinfo->size);
   else if ((qos.present & PP_KEYHASH) && !NN_STRICT_P(gv->config))
-  {
-    /* For SPDP/SEDP, fake a parameter list with just a keyhash.  For
-       PMD, just use the keyhash directly.  Too hard to fix everything
-       at the same time ... */
-    if (srcguid.entityid.u == NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_MESSAGE_WRITER)
-    {
-      datap = qos.keyhash.value;
-      datasz = sizeof (qos.keyhash);
-    }
-    else
-    {
-      nn_parameterid_t pid;
-      keyhash_payload.cdr.identifier = (DDSRT_ENDIAN == DDSRT_LITTLE_ENDIAN ? PL_CDR_LE : PL_CDR_BE);
-      keyhash_payload.cdr.options = 0;
-      switch (srcguid.entityid.u)
-      {
-        case NN_ENTITYID_SPDP_BUILTIN_PARTICIPANT_WRITER:
-        case NN_ENTITYID_SPDP_RELIABLE_BUILTIN_PARTICIPANT_SECURE_WRITER:
-          pid = PID_PARTICIPANT_GUID;
-          break;
-        case NN_ENTITYID_SEDP_BUILTIN_PUBLICATIONS_WRITER:
-        case NN_ENTITYID_SEDP_BUILTIN_SUBSCRIPTIONS_WRITER:
-        case NN_ENTITYID_SEDP_BUILTIN_PUBLICATIONS_SECURE_WRITER:
-        case NN_ENTITYID_SEDP_BUILTIN_SUBSCRIPTIONS_SECURE_WRITER:
-          pid = PID_ENDPOINT_GUID;
-          break;
-        case NN_ENTITYID_SEDP_BUILTIN_TOPIC_WRITER:
-        case NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_MESSAGE_WRITER:
-          /* placeholders */
-          pid = PID_ENDPOINT_GUID;
-          break;
-        default:
-          GVLOGDISC ("data(builtin, vendor %u.%u): "PGUIDFMT" #%"PRId64": mapping keyhash to ENDPOINT_GUID",
-                     sampleinfo->rst->vendor.id[0], sampleinfo->rst->vendor.id[1],
-                     PGUID (srcguid), sampleinfo->seq);
-          pid = PID_ENDPOINT_GUID;
-          break;
-      }
-      keyhash_payload.p_endpoint_guid.parameterid = pid;
-      keyhash_payload.p_endpoint_guid.length = sizeof (ddsi_keyhash_t);
-      memcpy (keyhash_payload.kh, &qos.keyhash, sizeof (qos.keyhash));
-      keyhash_payload.p_sentinel.parameterid = PID_SENTINEL;
-      keyhash_payload.p_sentinel.length = 0;
-      datap = (unsigned char *) &keyhash_payload;
-      datasz = sizeof (keyhash_payload);
-    }
-  }
+    d = ddsi_serdata_from_keyhash (topic, &qos.keyhash);
   else
   {
-    GVWARNING ("data(builtin, vendor %u.%u): "PGUIDFMT" #%"PRId64": dispose/unregister with no content\n",
+    GVLOGDISC ("data(builtin, vendor %u.%u): "PGUIDFMT" #%"PRId64": missing payload\n",
                sampleinfo->rst->vendor.id[0], sampleinfo->rst->vendor.id[1],
                PGUID (srcguid), sampleinfo->seq);
     goto done_upd_deliv;
   }
 
-  if (sampleinfo->timestamp.v != DDSRT_WCTIME_INVALID.v)
-    timestamp = sampleinfo->timestamp;
-  else
-    timestamp = ddsrt_time_wallclock ();
+  d->timestamp = (sampleinfo->timestamp.v != DDSRT_WCTIME_INVALID.v) ? sampleinfo->timestamp : ddsrt_time_wallclock ();
+  d->statusinfo = statusinfo;
+  // set protocol version & vendor id for plist types
+  // FIXME: find a better way then fixing these up afterward
+  if (d->ops == &ddsi_serdata_ops_plist)
+  {
+    struct ddsi_serdata_plist *d_plist = (struct ddsi_serdata_plist *) d;
+    d_plist->protoversion = sampleinfo->rst->protocol_version;
+    d_plist->vendorid = sampleinfo->rst->vendor;
+  }
+
+  if (gv->logconfig.c.mask & DDS_LC_TRACE)
+  {
+    ddsi_guid_t guid;
+    char tmp[2048];
+    size_t res = 0;
+    tmp[0] = 0;
+    if (gv->logconfig.c.mask & DDS_LC_CONTENT)
+      res = ddsi_serdata_print (d, tmp, sizeof (tmp));
+    if (pwr) guid = pwr->e.guid; else memset (&guid, 0, sizeof (guid));
+    GVTRACE ("data(builtin, vendor %u.%u): "PGUIDFMT" #%"PRId64": ST%x %s/%s:%s%s\n",
+             sampleinfo->rst->vendor.id[0], sampleinfo->rst->vendor.id[1],
+             PGUID (guid), sampleinfo->seq, statusinfo, d->topic->name, d->topic->type_name,
+             tmp, res < sizeof (tmp) - 1 ? "" : "(trunc)");
+  }
+
   switch (srcguid.entityid.u)
   {
     case NN_ENTITYID_SPDP_BUILTIN_PARTICIPANT_WRITER:
     case NN_ENTITYID_SPDP_RELIABLE_BUILTIN_PARTICIPANT_SECURE_WRITER:
-      handle_SPDP (sampleinfo->rst, srcguid.entityid, sampleinfo->seq, timestamp, statusinfo, datap, datasz);
+      handle_SPDP (sampleinfo->rst, srcguid.entityid, sampleinfo->seq, d);
       break;
     case NN_ENTITYID_SEDP_BUILTIN_PUBLICATIONS_WRITER:
     case NN_ENTITYID_SEDP_BUILTIN_SUBSCRIPTIONS_WRITER:
     case NN_ENTITYID_SEDP_BUILTIN_PUBLICATIONS_SECURE_WRITER:
     case NN_ENTITYID_SEDP_BUILTIN_SUBSCRIPTIONS_SECURE_WRITER:
-      handle_SEDP (sampleinfo->rst, sampleinfo->seq, timestamp, statusinfo, datap, datasz);
+      handle_SEDP (sampleinfo->rst, sampleinfo->seq, d);
       break;
     case NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_MESSAGE_WRITER:
-    case NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_MESSAGE_SECURE_WRITER:
-      handle_pmd_message (sampleinfo->rst, timestamp, statusinfo, datap, datasz);
+    case NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_MESSAGE_SECURE_WRITER: {
+      handle_pmd_message (sampleinfo->rst, d);
       break;
+    }
 #ifdef DDSI_INCLUDE_SECURITY
     case NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_STATELESS_MESSAGE_WRITER:
-      handle_auth_handshake_message(sampleinfo->rst, srcguid.entityid, timestamp, statusinfo, datap, datasz);
+      handle_auth_handshake_message(sampleinfo->rst, srcguid.entityid, d);
       break;
     case NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_VOLATILE_SECURE_WRITER:
-      handle_crypto_exchange_message(sampleinfo->rst, srcguid.entityid, timestamp, statusinfo, datap, datasz);
+      handle_crypto_exchange_message(sampleinfo->rst, d);
       break;
 #endif
     default:
@@ -1925,9 +1593,9 @@ int builtins_dqueue_handler (const struct nn_rsample_info *sampleinfo, const str
       break;
   }
 
+  ddsi_serdata_unref (d);
+
  done_upd_deliv:
-  if (needs_free)
-    ddsrt_free (datap);
   if (pwr)
   {
     /* No proxy writer for SPDP */
diff --git a/src/core/ddsi/src/q_entity.c b/src/core/ddsi/src/q_entity.c
index f0fff03..5f76314 100644
--- a/src/core/ddsi/src/q_entity.c
+++ b/src/core/ddsi/src/q_entity.c
@@ -563,7 +563,7 @@ static void add_security_builtin_endpoints(struct participant *pp, ddsi_guid_t *
 
     subguid->entityid = to_entityid (NN_ENTITYID_SPDP_RELIABLE_BUILTIN_PARTICIPANT_SECURE_WRITER);
     wrinfo = whc_make_wrinfo (NULL, &gv->builtin_endpoint_xqos_wr);
-    new_writer_guid (NULL, subguid, group_guid, pp, NULL, &gv->builtin_endpoint_xqos_wr, whc_new(gv, wrinfo), NULL, NULL);
+    new_writer_guid (NULL, subguid, group_guid, pp, gv->spdp_secure_topic, &gv->builtin_endpoint_xqos_wr, whc_new(gv, wrinfo), NULL, NULL);
     whc_free_wrinfo (wrinfo);
     /* But we need the as_disc address set for SPDP, because we need to
        send it to everyone regardless of the existence of readers. */
@@ -572,28 +572,28 @@ static void add_security_builtin_endpoints(struct participant *pp, ddsi_guid_t *
 
     subguid->entityid = to_entityid (NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_STATELESS_MESSAGE_WRITER);
     wrinfo = whc_make_wrinfo (NULL, &gv->builtin_stateless_xqos_wr);
-    new_writer_guid (NULL, subguid, group_guid, pp, NULL, &gv->builtin_stateless_xqos_wr, whc_new(gv, wrinfo), NULL, NULL);
+    new_writer_guid (NULL, subguid, group_guid, pp, gv->pgm_stateless_topic, &gv->builtin_stateless_xqos_wr, whc_new(gv, wrinfo), NULL, NULL);
     whc_free_wrinfo (wrinfo);
     pp->bes |= NN_BUILTIN_ENDPOINT_PARTICIPANT_STATELESS_MESSAGE_ANNOUNCER;
 
     subguid->entityid = to_entityid (NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_VOLATILE_SECURE_WRITER);
     wrinfo = whc_make_wrinfo (NULL, &gv->builtin_volatile_xqos_wr);
-    new_writer_guid (NULL, subguid, group_guid, pp, NULL, &gv->builtin_volatile_xqos_wr, whc_new(gv, wrinfo), NULL, NULL);
+    new_writer_guid (NULL, subguid, group_guid, pp, gv->pgm_volatile_topic, &gv->builtin_volatile_xqos_wr, whc_new(gv, wrinfo), NULL, NULL);
     whc_free_wrinfo (wrinfo);
     pp->bes |= NN_BUILTIN_ENDPOINT_PARTICIPANT_VOLATILE_SECURE_ANNOUNCER;
 
     wrinfo = whc_make_wrinfo (NULL, &gv->builtin_endpoint_xqos_wr);
 
     subguid->entityid = to_entityid (NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_MESSAGE_SECURE_WRITER);
-    new_writer_guid (NULL, subguid, group_guid, pp, NULL, &gv->builtin_endpoint_xqos_wr, whc_new(gv, wrinfo), NULL, NULL);
+    new_writer_guid (NULL, subguid, group_guid, pp, gv->pmd_secure_topic, &gv->builtin_endpoint_xqos_wr, whc_new(gv, wrinfo), NULL, NULL);
     pp->bes |= NN_BUILTIN_ENDPOINT_PARTICIPANT_MESSAGE_SECURE_ANNOUNCER;
 
     subguid->entityid = to_entityid (NN_ENTITYID_SEDP_BUILTIN_PUBLICATIONS_SECURE_WRITER);
-    new_writer_guid (NULL, subguid, group_guid, pp, NULL, &gv->builtin_endpoint_xqos_wr, whc_new(gv, wrinfo), NULL, NULL);
+    new_writer_guid (NULL, subguid, group_guid, pp, gv->sedp_writer_secure_topic, &gv->builtin_endpoint_xqos_wr, whc_new(gv, wrinfo), NULL, NULL);
     pp->bes |= NN_BUILTIN_ENDPOINT_PUBLICATION_MESSAGE_SECURE_ANNOUNCER;
 
     subguid->entityid = to_entityid (NN_ENTITYID_SEDP_BUILTIN_SUBSCRIPTIONS_SECURE_WRITER);
-    new_writer_guid (NULL, subguid, group_guid, pp, NULL, &gv->builtin_endpoint_xqos_wr, whc_new(gv, wrinfo), NULL, NULL);
+    new_writer_guid (NULL, subguid, group_guid, pp, gv->sedp_reader_secure_topic, &gv->builtin_endpoint_xqos_wr, whc_new(gv, wrinfo), NULL, NULL);
     pp->bes |= NN_BUILTIN_ENDPOINT_SUBSCRIPTION_MESSAGE_SECURE_ANNOUNCER;
 
     whc_free_wrinfo (wrinfo);
@@ -602,11 +602,11 @@ static void add_security_builtin_endpoints(struct participant *pp, ddsi_guid_t *
   if (add_readers)
   {
     subguid->entityid = to_entityid (NN_ENTITYID_SEDP_BUILTIN_SUBSCRIPTIONS_SECURE_READER);
-    new_reader_guid (NULL, subguid, group_guid, pp, NULL, &gv->builtin_endpoint_xqos_rd, NULL, NULL, NULL);
+    new_reader_guid (NULL, subguid, group_guid, pp, gv->sedp_reader_secure_topic, &gv->builtin_endpoint_xqos_rd, NULL, NULL, NULL);
     pp->bes |= NN_BUILTIN_ENDPOINT_SUBSCRIPTION_MESSAGE_SECURE_DETECTOR;
 
     subguid->entityid = to_entityid (NN_ENTITYID_SEDP_BUILTIN_PUBLICATIONS_SECURE_READER);
-    new_reader_guid (NULL, subguid, group_guid, pp, NULL, &gv->builtin_endpoint_xqos_rd, NULL, NULL, NULL);
+    new_reader_guid (NULL, subguid, group_guid, pp, gv->sedp_writer_secure_topic, &gv->builtin_endpoint_xqos_rd, NULL, NULL, NULL);
     pp->bes |= NN_BUILTIN_ENDPOINT_PUBLICATION_MESSAGE_SECURE_DETECTOR;
   }
 
@@ -615,19 +615,19 @@ static void add_security_builtin_endpoints(struct participant *pp, ddsi_guid_t *
    * besmode flag setting, because all participant do require authentication.
    */
   subguid->entityid = to_entityid (NN_ENTITYID_SPDP_RELIABLE_BUILTIN_PARTICIPANT_SECURE_READER);
-  new_reader_guid (NULL, subguid, group_guid, pp, NULL, &gv->builtin_endpoint_xqos_rd, NULL, NULL, NULL);
+  new_reader_guid (NULL, subguid, group_guid, pp, gv->spdp_secure_topic, &gv->builtin_endpoint_xqos_rd, NULL, NULL, NULL);
   pp->bes |= NN_DISC_BUILTIN_ENDPOINT_PARTICIPANT_SECURE_DETECTOR;
 
   subguid->entityid = to_entityid (NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_VOLATILE_SECURE_READER);
-  new_reader_guid (NULL, subguid, group_guid, pp, NULL, &gv->builtin_volatile_xqos_rd, NULL, NULL, NULL);
+  new_reader_guid (NULL, subguid, group_guid, pp, gv->pgm_volatile_topic, &gv->builtin_volatile_xqos_rd, NULL, NULL, NULL);
   pp->bes |= NN_BUILTIN_ENDPOINT_PARTICIPANT_VOLATILE_SECURE_DETECTOR;
 
   subguid->entityid = to_entityid (NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_STATELESS_MESSAGE_READER);
-  new_reader_guid (NULL, subguid, group_guid, pp, NULL, &gv->builtin_stateless_xqos_rd, NULL, NULL, NULL);
+  new_reader_guid (NULL, subguid, group_guid, pp, gv->pgm_stateless_topic, &gv->builtin_stateless_xqos_rd, NULL, NULL, NULL);
   pp->bes |= NN_BUILTIN_ENDPOINT_PARTICIPANT_STATELESS_MESSAGE_DETECTOR;
 
   subguid->entityid = to_entityid (NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_MESSAGE_SECURE_READER);
-  new_reader_guid (NULL, subguid, group_guid, pp, NULL, &gv->builtin_endpoint_xqos_rd, NULL, NULL, NULL);
+  new_reader_guid (NULL, subguid, group_guid, pp, gv->pmd_secure_topic, &gv->builtin_endpoint_xqos_rd, NULL, NULL, NULL);
   pp->bes |= NN_BUILTIN_ENDPOINT_PARTICIPANT_MESSAGE_SECURE_DETECTOR;
 }
 #endif
@@ -640,25 +640,18 @@ static void add_builtin_endpoints(struct participant *pp, ddsi_guid_t *subguid,
 
     /* SEDP writers: */
     subguid->entityid = to_entityid (NN_ENTITYID_SEDP_BUILTIN_SUBSCRIPTIONS_WRITER);
-    new_writer_guid (NULL, subguid, group_guid, pp, NULL, &gv->builtin_endpoint_xqos_wr, whc_new(gv, wrinfo), NULL, NULL);
+    new_writer_guid (NULL, subguid, group_guid, pp, gv->sedp_reader_topic, &gv->builtin_endpoint_xqos_wr, whc_new(gv, wrinfo), NULL, NULL);
     pp->bes |= NN_DISC_BUILTIN_ENDPOINT_SUBSCRIPTION_ANNOUNCER;
 
     subguid->entityid = to_entityid (NN_ENTITYID_SEDP_BUILTIN_PUBLICATIONS_WRITER);
-    new_writer_guid (NULL, subguid, group_guid, pp, NULL, &gv->builtin_endpoint_xqos_wr, whc_new(gv, wrinfo), NULL, NULL);
+    new_writer_guid (NULL, subguid, group_guid, pp, gv->sedp_writer_topic, &gv->builtin_endpoint_xqos_wr, whc_new(gv, wrinfo), NULL, NULL);
     pp->bes |= NN_DISC_BUILTIN_ENDPOINT_PUBLICATION_ANNOUNCER;
 
     /* PMD writer: */
     subguid->entityid = to_entityid (NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_MESSAGE_WRITER);
-    new_writer_guid (NULL, subguid, group_guid, pp, NULL, &gv->builtin_endpoint_xqos_wr, whc_new(gv, wrinfo), NULL, NULL);
+    new_writer_guid (NULL, subguid, group_guid, pp, gv->pmd_topic, &gv->builtin_endpoint_xqos_wr, whc_new(gv, wrinfo), NULL, NULL);
     pp->bes |= NN_BUILTIN_ENDPOINT_PARTICIPANT_MESSAGE_DATA_WRITER;
 
-    if (gv->config.do_topic_discovery)
-    {
-      subguid->entityid = to_entityid (NN_ENTITYID_SEDP_BUILTIN_TOPIC_WRITER);
-      new_writer_guid (NULL, subguid, group_guid, pp, NULL, &gv->builtin_endpoint_xqos_wr, whc_new(gv, wrinfo), NULL, NULL);
-      pp->bes |= NN_DISC_BUILTIN_ENDPOINT_TOPIC_ANNOUNCER;
-    }
-
     whc_free_wrinfo (wrinfo);
   }
 
@@ -666,19 +659,19 @@ static void add_builtin_endpoints(struct participant *pp, ddsi_guid_t *subguid,
   if (add_readers)
   {
     subguid->entityid = to_entityid (NN_ENTITYID_SPDP_BUILTIN_PARTICIPANT_READER);
-    new_reader_guid (NULL, subguid, group_guid, pp, NULL, &gv->spdp_endpoint_xqos, NULL, NULL, NULL);
+    new_reader_guid (NULL, subguid, group_guid, pp, gv->spdp_topic, &gv->spdp_endpoint_xqos, NULL, NULL, NULL);
     pp->bes |= NN_DISC_BUILTIN_ENDPOINT_PARTICIPANT_DETECTOR;
 
     subguid->entityid = to_entityid (NN_ENTITYID_SEDP_BUILTIN_SUBSCRIPTIONS_READER);
-    new_reader_guid (NULL, subguid, group_guid, pp, NULL, &gv->builtin_endpoint_xqos_rd, NULL, NULL, NULL);
+    new_reader_guid (NULL, subguid, group_guid, pp, gv->sedp_reader_topic, &gv->builtin_endpoint_xqos_rd, NULL, NULL, NULL);
     pp->bes |= NN_DISC_BUILTIN_ENDPOINT_SUBSCRIPTION_DETECTOR;
 
     subguid->entityid = to_entityid (NN_ENTITYID_SEDP_BUILTIN_PUBLICATIONS_READER);
-    new_reader_guid (NULL, subguid, group_guid, pp, NULL, &gv->builtin_endpoint_xqos_rd, NULL, NULL, NULL);
+    new_reader_guid (NULL, subguid, group_guid, pp, gv->sedp_writer_topic, &gv->builtin_endpoint_xqos_rd, NULL, NULL, NULL);
     pp->bes |= NN_DISC_BUILTIN_ENDPOINT_PUBLICATION_DETECTOR;
 
     subguid->entityid = to_entityid (NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_MESSAGE_READER);
-    new_reader_guid (NULL, subguid, group_guid, pp, NULL, &gv->builtin_endpoint_xqos_rd, NULL, NULL, NULL);
+    new_reader_guid (NULL, subguid, group_guid, pp, gv->pmd_topic, &gv->builtin_endpoint_xqos_rd, NULL, NULL, NULL);
     pp->bes |= NN_BUILTIN_ENDPOINT_PARTICIPANT_MESSAGE_DATA_READER;
   }
 
@@ -1001,7 +994,7 @@ dds_return_t new_participant_guid (ddsi_guid_t *ppguid, struct ddsi_domaingv *gv
   {
     subguid.entityid = to_entityid (NN_ENTITYID_SPDP_BUILTIN_PARTICIPANT_WRITER);
     wrinfo = whc_make_wrinfo (NULL, &gv->spdp_endpoint_xqos);
-    new_writer_guid (NULL, &subguid, &group_guid, pp, NULL, &gv->spdp_endpoint_xqos, whc_new(gv, wrinfo), NULL, NULL);
+    new_writer_guid (NULL, &subguid, &group_guid, pp, gv->spdp_topic, &gv->spdp_endpoint_xqos, whc_new(gv, wrinfo), NULL, NULL);
     whc_free_wrinfo (wrinfo);
     /* But we need the as_disc address set for SPDP, because we need to
        send it to everyone regardless of the existence of readers. */
@@ -2590,9 +2583,6 @@ already_matched:
   return;
 }
 
-
-
-
 static void proxy_reader_add_connection (struct proxy_reader *prd, struct writer *wr, int64_t crypto_handle)
 {
   struct prd_wr_match *m = ddsrt_malloc (sizeof (*m));
@@ -2615,7 +2605,6 @@ static void proxy_reader_add_connection (struct proxy_reader *prd, struct writer
   }
   else
   {
-    assert (wr->topic || is_builtin_endpoint (wr->e.guid.entityid, NN_VENDORID_ECLIPSE));
     ELOGDISC (prd, "  proxy_reader_add_connection(wr "PGUIDFMT" prd "PGUIDFMT")\n",
               PGUID (wr->e.guid), PGUID (prd->e.guid));
     ddsrt_avl_insert_ipath (&prd_writers_treedef, &prd->writers, m, &path);
@@ -2920,7 +2909,6 @@ static void connect_writer_with_proxy_reader_wrapper (struct entity_common *vwr,
   struct proxy_reader *prd = (struct proxy_reader *) vprd;
   assert (wr->e.kind == EK_WRITER);
   assert (prd->e.kind == EK_PROXY_READER);
-  assert (is_builtin_endpoint (wr->e.guid.entityid, NN_VENDORID_ECLIPSE) == is_builtin_endpoint (prd->e.guid.entityid, prd->c.vendor));
   connect_writer_with_proxy_reader (wr, prd, tnow);
 }
 
@@ -2930,7 +2918,6 @@ static void connect_proxy_writer_with_reader_wrapper (struct entity_common *vpwr
   struct reader *rd = (struct reader *) vrd;
   assert (pwr->e.kind == EK_PROXY_WRITER);
   assert (rd->e.kind == EK_READER);
-  assert (is_builtin_endpoint (rd->e.guid.entityid, NN_VENDORID_ECLIPSE) == is_builtin_endpoint (pwr->e.guid.entityid, pwr->c.vendor));
   connect_proxy_writer_with_reader (pwr, rd, tnow);
 }
 
@@ -2940,8 +2927,6 @@ static void connect_writer_with_reader_wrapper (struct entity_common *vwr, struc
   struct reader *rd = (struct reader *) vrd;
   assert (wr->e.kind == EK_WRITER);
   assert (rd->e.kind == EK_READER);
-  assert (!is_builtin_endpoint (wr->e.guid.entityid, NN_VENDORID_ECLIPSE) || is_local_orphan_endpoint (&wr->e));
-  assert (!is_builtin_endpoint (rd->e.guid.entityid, NN_VENDORID_ECLIPSE));
   connect_writer_with_reader (wr, rd, tnow);
 }
 
@@ -3234,7 +3219,7 @@ static void new_reader_writer_common (const struct ddsrt_log_cfg *logcfg, const
 {
   const char *partition = "(default)";
   const char *partition_suffix = "";
-  assert (is_builtin_entityid (guid->entityid, NN_VENDORID_ECLIPSE) ? (topic == NULL) : (topic != NULL));
+  assert (topic != NULL);
   if (is_builtin_entityid (guid->entityid, NN_VENDORID_ECLIPSE))
   {
     /* continue printing it as not being in a partition, the actual
@@ -3252,8 +3237,8 @@ static void new_reader_writer_common (const struct ddsrt_log_cfg *logcfg, const
             is_writer_entityid (guid->entityid) ? "writer" : "reader",
             PGUID (*guid),
             partition, partition_suffix,
-            topic ? topic->name : "(null)",
-            topic ? topic->type_name : "(null)");
+            topic->name,
+            topic->type_name);
 }
 
 static void endpoint_common_init (struct entity_common *e, struct endpoint_common *c, struct ddsi_domaingv *gv, enum entity_kind kind, const struct ddsi_guid *guid, const struct ddsi_guid *group_guid, struct participant *pp, bool onlylocal)
@@ -3282,12 +3267,12 @@ static void endpoint_common_fini (struct entity_common *e, struct endpoint_commo
 
 static int set_topic_type_name (dds_qos_t *xqos, const struct ddsi_sertopic * topic)
 {
-  if (!(xqos->present & QP_TYPE_NAME) && topic)
+  if (!(xqos->present & QP_TYPE_NAME))
   {
     xqos->present |= QP_TYPE_NAME;
     xqos->type_name = ddsrt_strdup (topic->type_name);
   }
-  if (!(xqos->present & QP_TOPIC_NAME) && topic)
+  if (!(xqos->present & QP_TOPIC_NAME))
   {
     xqos->present |= QP_TOPIC_NAME;
     xqos->topic_name = ddsrt_strdup (topic->name);
@@ -3754,7 +3739,7 @@ static dds_return_t new_writer_guid (struct writer **wr_out, const struct ddsi_g
    delete_participant won't interfere with our ability to address
    the participant */
 
-  const bool onlylocal = topic && builtintopic_is_builtintopic (pp->e.gv->builtin_topic_interface, topic);
+  const bool onlylocal = builtintopic_is_builtintopic (pp->e.gv->builtin_topic_interface, topic);
   endpoint_common_init (&wr->e, &wr->c, pp->e.gv, EK_WRITER, guid, group_guid, pp, onlylocal);
   new_writer_guid_common_init(wr, topic, xqos, whc, status_cb, status_entity);
 
@@ -4241,7 +4226,7 @@ static dds_return_t new_reader_guid
   if (rd_out)
     *rd_out = rd;
 
-  const bool onlylocal = topic && builtintopic_is_builtintopic (pp->e.gv->builtin_topic_interface, topic);
+  const bool onlylocal = builtintopic_is_builtintopic (pp->e.gv->builtin_topic_interface, topic);
   endpoint_common_init (&rd->e, &rd->c, pp->e.gv, EK_READER, guid, group_guid, pp, onlylocal);
 
   /* Copy QoS, merging in defaults */
diff --git a/src/core/ddsi/src/q_init.c b/src/core/ddsi/src/q_init.c
index 859be30..cabcf49 100644
--- a/src/core/ddsi/src/q_init.c
+++ b/src/core/ddsi/src/q_init.c
@@ -50,6 +50,7 @@
 #include "dds/ddsi/q_debmon.h"
 #include "dds/ddsi/q_init.h"
 #include "dds/ddsi/ddsi_threadmon.h"
+#include "dds/ddsi/ddsi_pmd.h"
 
 #include "dds/ddsi/ddsi_tran.h"
 #include "dds/ddsi/ddsi_udp.h"
@@ -57,6 +58,8 @@
 #include "dds/ddsi/ddsi_raweth.h"
 #include "dds/ddsi/ddsi_mcgroup.h"
 #include "dds/ddsi/ddsi_serdata_default.h"
+#include "dds/ddsi/ddsi_serdata_pserop.h"
+#include "dds/ddsi/ddsi_serdata_plist.h"
 #include "dds/ddsi/ddsi_security_omg.h"
 
 #include "dds/ddsi/ddsi_tkmap.h"
@@ -788,38 +791,75 @@ static void wait_for_receive_threads (struct ddsi_domaingv *gv)
   }
 }
 
-static struct ddsi_sertopic *make_special_topic (const char *name, struct serdatapool *serpool, uint16_t enc_id, const struct ddsi_serdata_ops *ops)
+static struct ddsi_sertopic *make_special_topic_pserop (const char *name, const char *typename, size_t memsize, size_t nops, const enum pserop *ops, size_t nops_key, const enum pserop *ops_key)
 {
-  /* FIXME: two things (at least)
-     - it claims there is a key, but the underlying type description is missing
-       that only works as long as it ends up comparing the keyhash field ...
-       the keyhash field should be eliminated; but this can simply be moved over to an alternate
-       topic class, it need not use the "default" one, that's mere expediency
-     - initialising/freeing them here, in this manner, is not very clean
-       it should be moved to somewhere in the topic implementation
-       (kinda natural if they stop being "default" ones) */
-  struct ddsi_sertopic_default *st = ddsrt_malloc (sizeof (*st));
+  struct ddsi_sertopic_pserop *st = ddsrt_malloc (sizeof (*st));
   memset (st, 0, sizeof (*st));
-  ddsi_sertopic_init (&st->c, name, name, &ddsi_sertopic_ops_default, ops, false);
-  st->native_encoding_identifier = enc_id;
-  st->serpool = serpool;
+  ddsi_sertopic_init (&st->c, name, typename, &ddsi_sertopic_ops_pserop, &ddsi_serdata_ops_pserop, nops_key == 0);
+  st->native_encoding_identifier = (DDSRT_ENDIAN == DDSRT_LITTLE_ENDIAN) ? CDR_LE : CDR_BE;
+  st->memsize = memsize;
+  st->nops = nops;
+  st->ops = ops;
+  st->nops_key = nops_key;
+  st->ops_key = ops_key;
+  return (struct ddsi_sertopic *) st;
+}
+
+static struct ddsi_sertopic *make_special_topic_plist (const char *name, const char *typename, nn_parameterid_t keyparam)
+{
+  struct ddsi_sertopic_plist *st = ddsrt_malloc (sizeof (*st));
+  memset (st, 0, sizeof (*st));
+  ddsi_sertopic_init (&st->c, name, typename, &ddsi_sertopic_ops_plist, &ddsi_serdata_ops_plist, false);
+  st->native_encoding_identifier = (DDSRT_ENDIAN == DDSRT_LITTLE_ENDIAN) ? PL_CDR_LE : PL_CDR_BE;
+  st->keyparam = keyparam;
   return (struct ddsi_sertopic *) st;
 }
 
 static void free_special_topics (struct ddsi_domaingv *gv)
 {
-  ddsi_sertopic_unref (gv->plist_topic);
-  ddsi_sertopic_unref (gv->rawcdr_topic);
+#ifdef DDSI_INCLUDE_SECURITY
+  ddsi_sertopic_unref (gv->pgm_volatile_topic);
+  ddsi_sertopic_unref (gv->pgm_stateless_topic);
+  ddsi_sertopic_unref (gv->pmd_secure_topic);
+  ddsi_sertopic_unref (gv->spdp_secure_topic);
+  ddsi_sertopic_unref (gv->sedp_reader_secure_topic);
+  ddsi_sertopic_unref (gv->sedp_writer_secure_topic);
+#endif
+  ddsi_sertopic_unref (gv->pmd_topic);
+  ddsi_sertopic_unref (gv->spdp_topic);
+  ddsi_sertopic_unref (gv->sedp_reader_topic);
+  ddsi_sertopic_unref (gv->sedp_writer_topic);
 }
 
 static void make_special_topics (struct ddsi_domaingv *gv)
 {
-  gv->plist_topic = make_special_topic ("plist", gv->serpool, DDSRT_ENDIAN == DDSRT_LITTLE_ENDIAN ? PL_CDR_LE : PL_CDR_BE, &ddsi_serdata_ops_plist);
-  gv->rawcdr_topic = make_special_topic ("rawcdr", gv->serpool, DDSRT_ENDIAN == DDSRT_LITTLE_ENDIAN ? CDR_LE : CDR_BE, &ddsi_serdata_ops_rawcdr);
+  gv->spdp_topic = make_special_topic_plist ("DCPSParticipant", "ParticipantBuiltinTopicData", PID_PARTICIPANT_GUID);
+  gv->sedp_reader_topic = make_special_topic_plist ("DCPSSubscription", "SubscriptionBuiltinTopicData", PID_ENDPOINT_GUID);
+  gv->sedp_writer_topic = make_special_topic_plist ("DCPSPublication", "PublicationBuiltinTopicData", PID_ENDPOINT_GUID);
+  gv->pmd_topic = make_special_topic_pserop ("DCPSParticipantMessage", "ParticipantMessageData", sizeof (ParticipantMessageData_t), participant_message_data_nops, participant_message_data_ops, participant_message_data_nops_key, participant_message_data_ops_key);
+
+#ifdef DDSI_INCLUDE_SECURITY
+  gv->spdp_secure_topic = make_special_topic_plist ("DCPSParticipantsSecure", "ParticipantBuiltinTopicDataSecure", PID_PARTICIPANT_GUID);
+  gv->sedp_reader_secure_topic = make_special_topic_plist ("DCPSSubscriptionsSecure", "SubscriptionBuiltinTopicDataSecure", PID_ENDPOINT_GUID);
+  gv->sedp_writer_secure_topic = make_special_topic_plist ("DCPSPublicationsSecure", "PublicationBuiltinTopicDataSecure", PID_ENDPOINT_GUID);
+  gv->pmd_secure_topic = make_special_topic_pserop ("DCPSParticipantMessageSecure", "ParticipantMessageDataSecure", sizeof (ParticipantMessageData_t), participant_message_data_nops, participant_message_data_ops, participant_message_data_nops_key, participant_message_data_ops_key);
+  gv->pgm_stateless_topic = make_special_topic_pserop ("DCPSParticipantStatelessMessage", "ParticipantStatelessMessage", sizeof (nn_participant_generic_message_t), pserop_participant_generic_message_nops, pserop_participant_generic_message, 0, NULL);
+  gv->pgm_volatile_topic = make_special_topic_pserop ("DCPSParticipantVolatileMessageSecure", "ParticipantVolatileMessageSecure", sizeof (nn_participant_generic_message_t), pserop_participant_generic_message_nops, pserop_participant_generic_message, 0, NULL);
+#endif
 
   ddsrt_mutex_lock (&gv->sertopics_lock);
-  ddsi_sertopic_register_locked (gv, gv->plist_topic);
-  ddsi_sertopic_register_locked (gv, gv->rawcdr_topic);
+  ddsi_sertopic_register_locked (gv, gv->spdp_topic);
+  ddsi_sertopic_register_locked (gv, gv->sedp_reader_topic);
+  ddsi_sertopic_register_locked (gv, gv->sedp_writer_topic);
+  ddsi_sertopic_register_locked (gv, gv->pmd_topic);
+#ifdef DDSI_INCLUDE_SECURITY
+  ddsi_sertopic_register_locked (gv, gv->spdp_secure_topic);
+  ddsi_sertopic_register_locked (gv, gv->sedp_reader_secure_topic);
+  ddsi_sertopic_register_locked (gv, gv->sedp_writer_secure_topic);
+  ddsi_sertopic_register_locked (gv, gv->pmd_secure_topic);
+  ddsi_sertopic_register_locked (gv, gv->pgm_stateless_topic);
+  ddsi_sertopic_register_locked (gv, gv->pgm_volatile_topic);
+#endif
   ddsrt_mutex_unlock (&gv->sertopics_lock);
 
   /* register increments refcount (which is reasonable), but at some point
diff --git a/src/core/ddsi/src/q_receive.c b/src/core/ddsi/src/q_receive.c
index 9f3f143..f85403c 100644
--- a/src/core/ddsi/src/q_receive.c
+++ b/src/core/ddsi/src/q_receive.c
@@ -1976,7 +1976,7 @@ static struct ddsi_serdata *remote_make_sample (struct ddsi_tkmap_instance **tk,
       GVTRACE ("data(application, vendor %u.%u): "PGUIDFMT" #%"PRId64": ST%x %s/%s:%s%s",
                sampleinfo->rst->vendor.id[0], sampleinfo->rst->vendor.id[1],
                PGUID (guid), sampleinfo->seq, statusinfo, topic->name, topic->type_name,
-               tmp, res < sizeof (tmp) ? "" : "(trunc)");
+               tmp, res < sizeof (tmp) - 1 ? "" : "(trunc)");
     }
   }
   return sample;
diff --git a/src/core/ddsi/src/q_transmit.c b/src/core/ddsi/src/q_transmit.c
index 7b1f451..2b27d54 100644
--- a/src/core/ddsi/src/q_transmit.c
+++ b/src/core/ddsi/src/q_transmit.c
@@ -966,8 +966,6 @@ static int insert_sample_in_whc (struct writer *wr, seqno_t seq, struct ddsi_pli
   {
     char ppbuf[1024];
     int tmp;
-    const char *tname = wr->topic ? wr->topic->name : "(null)";
-    const char *ttname = wr->topic ? wr->topic->type_name : "(null)";
     ppbuf[0] = '\0';
     tmp = sizeof (ppbuf) - 1;
     if (wr->e.gv->logconfig.c.mask & DDS_LC_CONTENT)
@@ -975,7 +973,7 @@ static int insert_sample_in_whc (struct writer *wr, seqno_t seq, struct ddsi_pli
     ETRACE (wr, "write_sample "PGUIDFMT" #%"PRId64, PGUID (wr->e.guid), seq);
     if (plist != 0 && (plist->present & PP_COHERENT_SET))
       ETRACE (wr, " C#%"PRId64"", fromSN (plist->coherent_set_seqno));
-    ETRACE (wr, ": ST%"PRIu32" %s/%s:%s%s\n", serdata->statusinfo, tname, ttname, ppbuf, tmp < (int) sizeof (ppbuf) ? "" : " (trunc)");
+    ETRACE (wr, ": ST%"PRIu32" %s/%s:%s%s\n", serdata->statusinfo, wr->topic->name, wr->topic->type_name, ppbuf, tmp < (int) sizeof (ppbuf) ? "" : " (trunc)");
   }
 
   assert (wr->reliable || have_reliable_subs (wr) == 0);
@@ -1235,13 +1233,11 @@ static int write_sample_eot (struct thread_state1 * const ts1, struct nn_xpack *
   {
     char ppbuf[1024];
     int tmp;
-    const char *tname = wr->topic ? wr->topic->name : "(null)";
-    const char *ttname = wr->topic ? wr->topic->type_name : "(null)";
     ppbuf[0] = '\0';
     tmp = sizeof (ppbuf) - 1;
     GVWARNING ("dropping oversize (%"PRIu32" > %"PRIu32") sample from local writer "PGUIDFMT" %s/%s:%s%s\n",
                ddsi_serdata_size (serdata), gv->config.max_sample_size,
-               PGUID (wr->e.guid), tname, ttname, ppbuf,
+               PGUID (wr->e.guid), wr->topic->name, wr->topic->type_name, ppbuf,
                tmp < (int) sizeof (ppbuf) ? "" : " (trunc)");
     r = DDS_RETCODE_BAD_PARAMETER;
     goto drop;
diff --git a/src/core/ddsi/src/q_xevent.c b/src/core/ddsi/src/q_xevent.c
index ae6de3c..3c4ff83 100644
--- a/src/core/ddsi/src/q_xevent.c
+++ b/src/core/ddsi/src/q_xevent.c
@@ -1099,15 +1099,9 @@ static bool resend_spdp_sample_by_guid_key (struct writer *wr, const ddsi_guid_t
   ddsi_plist_init_empty (&ps);
   ps.present |= PP_PARTICIPANT_GUID;
   ps.participant_guid = *guid;
-  struct nn_xmsg *mpayload = nn_xmsg_new (gv->xmsgpool, guid, wr->c.pp, 0, NN_XMSG_KIND_DATA);
-  ddsi_plist_addtomsg (mpayload, &ps, ~(uint64_t)0, ~(uint64_t)0);
-  nn_xmsg_addpar_sentinel (mpayload);
+  struct ddsi_serdata *sd = ddsi_serdata_from_sample (gv->spdp_topic, SDK_KEY, &ps);
   ddsi_plist_fini (&ps);
-  struct ddsi_plist_sample plist_sample;
-  nn_xmsg_payload_to_plistsample (&plist_sample, PID_PARTICIPANT_GUID, mpayload);
-  struct ddsi_serdata *sd = ddsi_serdata_from_sample (gv->plist_topic, SDK_KEY, &plist_sample);
   struct whc_borrowed_sample sample;
-  nn_xmsg_free (mpayload);
 
   ddsrt_mutex_lock (&wr->e.lock);
   sample_found = whc_borrow_sample_key (wr->whc, sd, &sample);
diff --git a/src/ddsrt/src/log.c b/src/ddsrt/src/log.c
index f426b90..bf20966 100644
--- a/src/ddsrt/src/log.c
+++ b/src/ddsrt/src/log.c
@@ -215,10 +215,6 @@ static void vlog1 (const struct ddsrt_log_cfg_impl *cfg, uint32_t cat, uint32_t
      used with the global one. */
   assert (domid == cfg->c.domid || cfg == &logconfig);
 
-  if (*fmt == 0) {
-    return;
-  }
-
   lb = &log_buffer;
 
   /* Thread-local buffer is always initialized with all zeroes. The pos
@@ -227,6 +223,20 @@ static void vlog1 (const struct ddsrt_log_cfg_impl *cfg, uint32_t cat, uint32_t
     lb->pos = BUF_OFFSET;
     lb->buf[lb->pos] = 0;
   }
+
+  /* drop any prefix of new lines if there is current no data in the buffer:
+     there are some tricky problems in tracing some details depending on
+     enabled categories (like which subset of discovery related data gets
+     traced), and it sometimes helps to be able to trace just a newline
+     knowing it won't have any effect if nothing is buffered */
+  if (lb->pos == BUF_OFFSET) {
+    while (*fmt == '\n')
+      fmt++;
+  }
+  if (*fmt == 0) {
+    return;
+  }
+
   nrem = sizeof (lb->buf) - lb->pos;
   if (nrem > 0) {
     n = vsnprintf (lb->buf + lb->pos, nrem, fmt, ap);

From 99df0956e798c4d219d52b47fbc682c5e4ba144b Mon Sep 17 00:00:00 2001
From: Erik Boasson <eb@ilities.com>
Date: Tue, 31 Mar 2020 16:27:21 +0200
Subject: [PATCH 143/238] Crypto endpoint relation compare routines cleanup

* Trying not to assume an int is at least 32 bits.

* Technically speaking, comparing "unrelated" addresses is undefined
  behaviour which can be avoided by a cast to uintptr_t.

* The early out if either local_crypto == 0 does work in context,
  provided the nodes in tree never have local_crypto == 0.  That implies
  crypto_insert_endpoint_relation must never have a 0 in there, which I
  think the callers do respect.  Still I think it is better to not hide
  these assumptions in the compare function and address the problem in
  the lookup function instead.

These changes likely make the code fractionally slower, but I do think
they improve clarity.

Signed-off-by: Erik Boasson <eb@ilities.com>
---
 .../cryptographic/src/crypto_objects.c        | 42 +++++++------------
 .../core/tests/secure_communication.c         |  2 +-
 2 files changed, 17 insertions(+), 27 deletions(-)

diff --git a/src/security/builtin_plugins/cryptographic/src/crypto_objects.c b/src/security/builtin_plugins/cryptographic/src/crypto_objects.c
index 075744e..17929af 100644
--- a/src/security/builtin_plugins/cryptographic/src/crypto_objects.c
+++ b/src/security/builtin_plugins/cryptographic/src/crypto_objects.c
@@ -52,17 +52,13 @@ static int compare_endpoint_relation (const void *va, const void *vb)
 {
   const key_relation *ra = va;
   const key_relation *rb = vb;
-  int r;
-
-  r = (int)(ra->key_id - rb->key_id);
-  if (r != 0 || ra->local_crypto == 0 || rb->local_crypto == 0)
-  {
-    return r;
-  }
-
-  if (ra->local_crypto > rb->local_crypto)
+  if (ra->key_id > rb->key_id)
     return 1;
-  else if (ra->local_crypto < rb->local_crypto)
+  else if (ra->key_id < rb->key_id)
+    return -1;
+  else if ((uintptr_t) ra->local_crypto > (uintptr_t) rb->local_crypto)
+    return 1;
+  else if ((uintptr_t) ra->local_crypto < (uintptr_t) rb->local_crypto)
     return -1;
   else
     return 0;
@@ -72,8 +68,7 @@ static int compare_relation_key (const void *va, const void *vb)
 {
   const uint32_t *ka = va;
   const uint32_t *kb = vb;
-
-  return (int)(*ka - *kb);
+  return (*ka == *kb) ? 0 : (*ka < *kb) ? -1 : 1;
 }
 
 bool crypto_object_valid(CryptoObject *obj, CryptoObjectKind_t kind)
@@ -692,6 +687,7 @@ void crypto_insert_endpoint_relation(
     remote_participant_crypto *rpc,
     key_relation *relation)
 {
+  assert (relation->local_crypto != NULL && relation->remote_crypto != NULL);
   ddsrt_mutex_lock(&rpc->lock);
   ddsrt_avl_insert(&endpoint_relation_treedef, &rpc->relation_index, CRYPTO_OBJECT_KEEP(relation));
   ddsrt_mutex_unlock(&rpc->lock);
@@ -702,15 +698,11 @@ void crypto_remove_endpoint_relation(
     CryptoObject *lch,
     uint32_t key_id)
 {
-  key_relation template;
+  const key_relation template = { .key_id = key_id, .local_crypto = lch };
   key_relation *relation;
   ddsrt_avl_dpath_t dpath;
-
-  template.key_id = key_id;
-  template.local_crypto = lch;
-
   ddsrt_mutex_lock(&rpc->lock);
-  relation =  ddsrt_avl_lookup_dpath(&endpoint_relation_treedef, &rpc->relation_index, &template, &dpath);
+  relation = ddsrt_avl_lookup_dpath(&endpoint_relation_treedef, &rpc->relation_index, &template, &dpath);
   if (relation)
   {
     ddsrt_avl_delete_dpath(&endpoint_relation_treedef, &rpc->relation_index, relation, &dpath);
@@ -724,16 +716,14 @@ key_relation * crypto_find_endpoint_relation(
     CryptoObject *lch,
     uint32_t key_id)
 {
-  key_relation template;
-  key_relation *relation;
-
-  template.key_id = key_id;
-  template.local_crypto = lch;
-
+  const key_relation template = { .key_id = key_id, .local_crypto = lch };
+  key_relation *relation, *cand;
   ddsrt_mutex_lock(&rpc->lock);
-  relation =  CRYPTO_OBJECT_KEEP(ddsrt_avl_lookup(&endpoint_relation_treedef, &rpc->relation_index, &template));
+  if ((cand = ddsrt_avl_lookup_succ_eq (&endpoint_relation_treedef, &rpc->relation_index, &template)) == NULL || cand->key_id != key_id)
+    relation = NULL;
+  else
+    relation = CRYPTO_OBJECT_KEEP (cand);
   ddsrt_mutex_unlock(&rpc->lock);
-
   return relation;
 }
 
diff --git a/src/security/core/tests/secure_communication.c b/src/security/core/tests/secure_communication.c
index 5b46630..10769e0 100644
--- a/src/security/core/tests/secure_communication.c
+++ b/src/security/core/tests/secure_communication.c
@@ -544,7 +544,7 @@ CU_TheoryDataPoints(ddssec_secure_communication, multiple_readers) = {
     CU_DataPoints(size_t, 1, 3, 1, 3), /* number of participants per domain */
     CU_DataPoints(size_t, 3, 1, 3, 3), /* number of readers per participant */
 };
-CU_Theory((size_t n_dom, size_t n_pp, size_t n_rd), ddssec_secure_communication, multiple_readers, .timeout = 60, .disabled = false)
+CU_Theory((size_t n_dom, size_t n_pp, size_t n_rd), ddssec_secure_communication, multiple_readers, .timeout = 90, .disabled = false)
 {
   DDS_Security_ProtectionKind metadata_pk[] = { PK_N, PK_SOA, PK_EOA };
   DDS_Security_BasicProtectionKind payload_pk[] = { BPK_N, BPK_S, BPK_E };

From f792b3ceed6f2cc932ac76435d7fc6f434b4f2ef Mon Sep 17 00:00:00 2001
From: Marcel Jordense <marcel.jordense@adlinktech.com>
Date: Mon, 6 Apr 2020 17:01:38 +0200
Subject: [PATCH 144/238] Store security info of the proxy endpoints in the
 common part

Signed-off-by: Marcel Jordense <marcel.jordense@adlinktech.com>
---
 .../ddsi/include/dds/ddsi/ddsi_security_omg.h | 54 ++++-----------
 src/core/ddsi/include/dds/ddsi/q_entity.h     |  6 --
 src/core/ddsi/src/ddsi_security_omg.c         | 65 ++++++-------------
 src/core/ddsi/src/q_entity.c                  | 16 +----
 4 files changed, 33 insertions(+), 108 deletions(-)

diff --git a/src/core/ddsi/include/dds/ddsi/ddsi_security_omg.h b/src/core/ddsi/include/dds/ddsi/ddsi_security_omg.h
index 32946ba..6d5efcb 100644
--- a/src/core/ddsi/include/dds/ddsi/ddsi_security_omg.h
+++ b/src/core/ddsi/include/dds/ddsi/ddsi_security_omg.h
@@ -624,27 +624,6 @@ int64_t q_omg_security_get_remote_participant_handle(struct proxy_participant *p
  */
 void q_omg_security_set_participant_crypto_tokens(struct participant *pp, struct proxy_participant *proxypp, const nn_dataholderseq_t *tokens);
 
-/**
- * @brief Set security information, depending on plist and proxy participant,
- * into the given proxy writer.
- *
- * @param[in] pwr      Proxy writer to set security info on.
- * @param[in] plist    Paramater list, possibly contains security info.
- */
-void set_proxy_writer_security_info(struct proxy_writer *pwr, const ddsi_plist_t *plist);
-
-/**
- * @brief Determine the security settings associated with the remote writer.
- *
- * From the security information contained in the parameter list from the remote writer
- * the corresponding security settings are determined and returned in the info parameter.
- *
- * @param[in] pwr       The remote writer.
- * @param[in] plist     The parameter list from the remote writer.
- * @param[out] info     The security settings associated with the remote writer.
- */
-void q_omg_get_proxy_writer_security_info(struct proxy_writer *pwr, const ddsi_plist_t *plist, nn_security_info_t *info);
-
 /**
  * @brief Check if the writer has the is_discovery_protected flag set
  *
@@ -739,27 +718,6 @@ void q_omg_security_deregister_remote_writer_match(const struct ddsi_domaingv *g
  */
 void q_omg_security_set_remote_writer_crypto_tokens(struct reader *rd, const ddsi_guid_t *pwr_guid, const nn_dataholderseq_t *tokens);
 
-/**
- * @brief Set security information, depending on plist and proxy participant,
- * into the given proxy reader.
- *
- * @param[in] prd      Proxy reader to set security info on.
- * @param[in] plist    Paramater list, possibly contains security info.
- */
-void set_proxy_reader_security_info(struct proxy_reader *prd, const ddsi_plist_t *plist);
-
-/**
- * @brief Determine the security settings associated with the remote reader.
- *
- * From the security information contained in the parameter list from the remote reader
- * the corresponding security settings are determined and returned in the info parameter.
- *
- * @param[in] prd       The remote reader.
- * @param[in] plist     The parameter list from the remote reader.
- * @param[out] info     The security settings associated with the remote reader.
- */
-void q_omg_get_proxy_reader_security_info(struct proxy_reader *prd, const ddsi_plist_t *plist, nn_security_info_t *info);
-
 /**
  * @brief Check if the reader has the is_discovery_protected flag set
  *
@@ -797,6 +755,18 @@ bool q_omg_reader_is_submessage_protected(const struct reader *rd);
  */
 bool q_omg_security_check_remote_reader_permissions(const struct proxy_reader *prd, uint32_t domain_id, struct participant *pp, bool *relay_only);
 
+
+/**
+ * @brief Set security information, depending on plist and proxy participant,
+ * into the given proxy endpoint.
+ *
+ * @param[in] entity            The endpoint common attributes.
+ * @param[in] proxypp_sec_info  The security info of the proxy participant
+ * @param[in] plist             Paramater list which may contain security info.
+ * @param[in] info              The proxy endpoint security info to be set.
+ */
+void q_omg_get_proxy_endpoint_security_info(const struct entity_common *entity, nn_security_info_t *proxypp_sec_info, const ddsi_plist_t *plist, nn_security_info_t *info);
+
 /**
  * @brief Check it the local writer is allowed to communicate with the remote reader.
  *
diff --git a/src/core/ddsi/include/dds/ddsi/q_entity.h b/src/core/ddsi/include/dds/ddsi/q_entity.h
index 86e8826..a6f6543 100644
--- a/src/core/ddsi/include/dds/ddsi/q_entity.h
+++ b/src/core/ddsi/include/dds/ddsi/q_entity.h
@@ -455,9 +455,6 @@ struct proxy_writer {
   ddsi2direct_directread_cb_t ddsi2direct_cb;
   void *ddsi2direct_cbarg;
   struct lease *lease;
-#ifdef DDSI_INCLUDE_SECURITY
-  nn_security_info_t security_info;
-#endif
 };
 
 
@@ -473,9 +470,6 @@ struct proxy_reader {
 #endif
   ddsrt_avl_tree_t writers; /* matching LOCAL writers */
   filter_fn_t filter;
-#ifdef DDSI_INCLUDE_SECURITY
-  nn_security_info_t security_info;
-#endif
 };
 
 DDS_EXPORT extern const ddsrt_avl_treedef_t wr_readers_treedef;
diff --git a/src/core/ddsi/src/ddsi_security_omg.c b/src/core/ddsi/src/ddsi_security_omg.c
index c046a72..0fc64d1 100644
--- a/src/core/ddsi/src/ddsi_security_omg.c
+++ b/src/core/ddsi/src/ddsi_security_omg.c
@@ -1926,7 +1926,7 @@ bool q_omg_security_check_remote_writer_permissions(const struct proxy_writer *p
     }
   }
 
-  if (SECURITY_INFO_IS_WRITE_PROTECTED(pwr->security_info))
+  if (SECURITY_INFO_IS_WRITE_PROTECTED(pwr->c.security_info))
   {
     DDS_Security_PermissionsHandle permissions_handle;
 
@@ -1937,7 +1937,7 @@ bool q_omg_security_check_remote_writer_permissions(const struct proxy_writer *p
     }
     else
     {
-      q_omg_shallow_copy_PublicationBuiltinTopicDataSecure(&publication_data, &pwr->e.guid, pwr->c.xqos, &pwr->security_info);
+      q_omg_shallow_copy_PublicationBuiltinTopicDataSecure(&publication_data, &pwr->e.guid, pwr->c.xqos, &pwr->c.security_info);
       ok = sc->access_control_context->check_remote_datawriter(sc->access_control_context, permissions_handle, (int)domain_id, &publication_data, &exception);
       q_omg_shallow_free_PublicationBuiltinTopicDataSecure(&publication_data);
       if (!ok)
@@ -2067,11 +2067,11 @@ bool q_omg_security_match_remote_writer_enabled(struct reader *rd, struct proxy_
    * q_omg_participant_allow_unauthenticated() returns FALSE there.
    */
   (void)q_omg_get_reader_security_info(rd, &info);
-  if (!SECURITY_INFO_COMPATIBLE(pwr->security_info, info, NN_ENDPOINT_SECURITY_ATTRIBUTES_FLAG_IS_VALID))
+  if (!SECURITY_INFO_COMPATIBLE(pwr->c.security_info, info, NN_ENDPOINT_SECURITY_ATTRIBUTES_FLAG_IS_VALID))
   {
     GVWARNING("match_remote_writer "PGUIDFMT" with reader "PGUIDFMT" security_attributes mismatch: 0x%08x.0x%08x - 0x%08x.0x%08x\n",
                 PGUID(pwr->e.guid), PGUID(rd->e.guid),
-                pwr->security_info.security_attributes, pwr->security_info.plugin_security_attributes,
+                pwr->c.security_info.security_attributes, pwr->c.security_info.plugin_security_attributes,
                 info.security_attributes, info.plugin_security_attributes);
     return false;
   }
@@ -2092,11 +2092,11 @@ bool q_omg_security_match_remote_writer_enabled(struct reader *rd, struct proxy_
    * the valid flag is 0. To be able to support these product, assume
    * that the attributes are the same. If there is actually a mismatch,
    * communication will fail at a later moment anyway. */
-  if (!SECURITY_ATTR_IS_VALID(pwr->security_info.security_attributes)) {
-    pwr->security_info.security_attributes = info.security_attributes;
+  if (!SECURITY_ATTR_IS_VALID(pwr->c.security_info.security_attributes)) {
+    pwr->c.security_info.security_attributes = info.security_attributes;
   }
-  if (!SECURITY_ATTR_IS_VALID(pwr->security_info.plugin_security_attributes)) {
-    pwr->security_info.plugin_security_attributes = info.plugin_security_attributes;
+  if (!SECURITY_ATTR_IS_VALID(pwr->c.security_info.plugin_security_attributes)) {
+    pwr->c.security_info.plugin_security_attributes = info.plugin_security_attributes;
   }
 
   return q_omg_security_register_remote_writer_match(pwr, rd, crypto_handle);
@@ -2148,7 +2148,7 @@ bool q_omg_security_check_remote_reader_permissions(const struct proxy_reader *p
     }
   }
 
-  if (SECURITY_INFO_IS_READ_PROTECTED(prd->security_info))
+  if (SECURITY_INFO_IS_READ_PROTECTED(prd->c.security_info))
   {
     DDS_Security_PermissionsHandle permissions_handle;
 
@@ -2162,7 +2162,7 @@ bool q_omg_security_check_remote_reader_permissions(const struct proxy_reader *p
       DDS_Security_SubscriptionBuiltinTopicDataSecure subscription_data;
       DDS_Security_boolean sec_relay_only;
 
-      q_omg_shallow_copy_SubscriptionBuiltinTopicDataSecure(&subscription_data, &prd->e.guid, prd->c.xqos, &prd->security_info);
+      q_omg_shallow_copy_SubscriptionBuiltinTopicDataSecure(&subscription_data, &prd->e.guid, prd->c.xqos, &prd->c.security_info);
       ok = sc->access_control_context->check_remote_datareader(sc->access_control_context, permissions_handle, (int)domain_id, &subscription_data, &sec_relay_only, &exception);
       q_omg_shallow_free_SubscriptionBuiltinTopicDataSecure(&subscription_data);
       if (ok)
@@ -2180,11 +2180,14 @@ bool q_omg_security_check_remote_reader_permissions(const struct proxy_reader *p
   return ok;
 }
 
-static void q_omg_get_proxy_endpoint_security_info(const struct entity_common *entity, nn_security_info_t *proxypp_sec_info, const ddsi_plist_t *plist, nn_security_info_t *info)
+void q_omg_get_proxy_endpoint_security_info(const struct entity_common *entity, nn_security_info_t *proxypp_sec_info, const ddsi_plist_t *plist, nn_security_info_t *info)
 {
   const bool proxypp_info_available =
     (proxypp_sec_info->security_attributes != 0 || proxypp_sec_info->plugin_security_attributes != 0);
 
+  info->security_attributes = 0;
+  info->plugin_security_attributes = 0;
+
   /*
    * If Security info is present, use that.
    * Otherwise, use the specified values for the secure builtin endpoints.
@@ -2251,34 +2254,6 @@ static void q_omg_get_proxy_endpoint_security_info(const struct entity_common *e
       NN_ENDPOINT_SECURITY_ATTRIBUTES_FLAG_IS_VALID | NN_ENDPOINT_SECURITY_ATTRIBUTES_FLAG_IS_SUBMESSAGE_PROTECTED;
     info->plugin_security_attributes = 0;
   }
-  else
-  {
-    info->security_attributes = 0;
-    info->plugin_security_attributes = 0;
-  }
-}
-
-void q_omg_get_proxy_reader_security_info(struct proxy_reader *prd, const ddsi_plist_t *plist, nn_security_info_t *info)
-{
-  q_omg_get_proxy_endpoint_security_info(&(prd->e), &(prd->c.proxypp->security_info), plist, info);
-}
-
-void set_proxy_reader_security_info(struct proxy_reader *prd, const ddsi_plist_t *plist)
-{
-  assert (prd);
-  q_omg_get_proxy_endpoint_security_info (&prd->e, &prd->c.proxypp->security_info, plist, &prd->c.security_info);
-}
-
-
-void q_omg_get_proxy_writer_security_info(struct proxy_writer *pwr, const ddsi_plist_t *plist, nn_security_info_t *info)
-{
-  q_omg_get_proxy_endpoint_security_info(&(pwr->e), &(pwr->c.proxypp->security_info), plist, info);
-}
-
-void set_proxy_writer_security_info(struct proxy_writer *pwr, const ddsi_plist_t *plist)
-{
-  assert (pwr);
-  q_omg_get_proxy_endpoint_security_info (&pwr->e, &pwr->c.proxypp->security_info, plist, &pwr->c.security_info);
 }
 
 void q_omg_security_deregister_remote_reader_match(const struct ddsi_domaingv *gv, const ddsi_guid_t *wr_guid, struct wr_prd_match *m)
@@ -2417,11 +2392,11 @@ bool q_omg_security_match_remote_reader_enabled(struct writer *wr, struct proxy_
    * q_omg_participant_allow_unauthenticated() returns FALSE there.
    */
   (void)q_omg_get_writer_security_info(wr, &info);
-  if (!SECURITY_INFO_COMPATIBLE(prd->security_info, info, NN_ENDPOINT_SECURITY_ATTRIBUTES_FLAG_IS_VALID))
+  if (!SECURITY_INFO_COMPATIBLE(prd->c.security_info, info, NN_ENDPOINT_SECURITY_ATTRIBUTES_FLAG_IS_VALID))
   {
     GVWARNING("match_remote_reader "PGUIDFMT" with writer "PGUIDFMT" security_attributes mismatch: 0x%08x.0x%08x - 0x%08x.0x%08x\n",
         PGUID(prd->e.guid), PGUID(wr->e.guid),
-        prd->security_info.security_attributes, prd->security_info.plugin_security_attributes,
+        prd->c.security_info.security_attributes, prd->c.security_info.plugin_security_attributes,
         info.security_attributes, info.plugin_security_attributes);
     return false;
   }
@@ -2442,11 +2417,11 @@ bool q_omg_security_match_remote_reader_enabled(struct writer *wr, struct proxy_
    * the valid flag is 0. To be able to support these product, assume
    * that the attributes are the same. If there is actually a mismatch,
    * communication will fail at a later moment anyway. */
-  if (!SECURITY_ATTR_IS_VALID(prd->security_info.security_attributes)) {
-    prd->security_info.security_attributes = info.security_attributes;
+  if (!SECURITY_ATTR_IS_VALID(prd->c.security_info.security_attributes)) {
+    prd->c.security_info.security_attributes = info.security_attributes;
   }
-  if (!SECURITY_ATTR_IS_VALID(prd->security_info.plugin_security_attributes)) {
-    prd->security_info.plugin_security_attributes = info.plugin_security_attributes;
+  if (!SECURITY_ATTR_IS_VALID(prd->c.security_info.plugin_security_attributes)) {
+    prd->c.security_info.plugin_security_attributes = info.plugin_security_attributes;
   }
 
   return q_omg_security_register_remote_reader_match(prd, wr, crypto_handle, relay_only);
diff --git a/src/core/ddsi/src/q_entity.c b/src/core/ddsi/src/q_entity.c
index 7c1ff62..569fb01 100644
--- a/src/core/ddsi/src/q_entity.c
+++ b/src/core/ddsi/src/q_entity.c
@@ -4475,9 +4475,6 @@ dds_return_t delete_reader (struct ddsi_domaingv *gv, const struct ddsi_guid *gu
   GVLOGDISC ("delete_reader_guid(guid "PGUIDFMT") ...\n", PGUID (*guid));
   builtintopic_write (rd->e.gv->builtin_topic_interface, &rd->e, ddsrt_time_wallclock(), false);
   entidx_remove_reader_guid (gv->entity_index, rd);
-#ifdef DDSI_INCLUDE_SECURITY
-  q_omg_security_deregister_reader(rd);
-#endif
   gcreq_reader (rd);
   return 0;
 }
@@ -5369,8 +5366,7 @@ static int proxy_endpoint_common_init (struct entity_common *e, struct proxy_end
     memset (&c->group_guid, 0, sizeof (c->group_guid));
 
 #ifdef DDSI_INCLUDE_SECURITY
-  c->security_info.security_attributes = 0;
-  c->security_info.plugin_security_attributes = 0;
+  q_omg_get_proxy_endpoint_security_info(e, &proxypp->security_info, plist, &c->security_info);
 #endif
 
   if ((ret = ref_proxy_participant (proxypp, c)) != DDS_RETCODE_OK)
@@ -5516,11 +5512,6 @@ int new_proxy_writer (struct ddsi_domaingv *gv, const struct ddsi_guid *ppguid,
   pwr->ddsi2direct_cb = 0;
   pwr->ddsi2direct_cbarg = 0;
 
-#ifdef DDSI_INCLUDE_SECURITY
-  set_proxy_writer_security_info(pwr, plist);
-  q_omg_get_proxy_writer_security_info(pwr, plist, &(pwr->security_info));
-#endif
-
   local_reader_ary_init (&pwr->rdary);
 
   /* locking the entity prevents matching while the built-in topic hasn't been published yet */
@@ -5798,14 +5789,9 @@ int new_proxy_reader (struct ddsi_domaingv *gv, const struct ddsi_guid *ppguid,
 #endif
   prd->is_fict_trans_reader = 0;
 
-#ifdef DDSI_INCLUDE_SECURITY
-  set_proxy_reader_security_info(prd, plist);
-#endif
-
   ddsrt_avl_init (&prd_writers_treedef, &prd->writers);
 
 #ifdef DDSI_INCLUDE_SECURITY
-  q_omg_get_proxy_reader_security_info(prd, plist, &(prd->security_info));
   if (prd->e.guid.entityid.u == NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_VOLATILE_SECURE_READER)
     prd->filter = volatile_secure_data_filter;
   else

From b6640d86b024ebb3f9258ab3c205104c40676eda Mon Sep 17 00:00:00 2001
From: Marcel Jordense <marcel.jordense@adlinktech.com>
Date: Mon, 6 Apr 2020 17:33:52 +0200
Subject: [PATCH 145/238] Correct length of encrypted submessage body

Signed-off-by: Marcel Jordense <marcel.jordense@adlinktech.com>
---
 .../cryptographic/src/crypto_transform.c      | 23 +++++++++----------
 1 file changed, 11 insertions(+), 12 deletions(-)

diff --git a/src/security/builtin_plugins/cryptographic/src/crypto_transform.c b/src/security/builtin_plugins/cryptographic/src/crypto_transform.c
index 7fd39d6..21c3e1c 100644
--- a/src/security/builtin_plugins/cryptographic/src/crypto_transform.c
+++ b/src/security/builtin_plugins/cryptographic/src/crypto_transform.c
@@ -1103,7 +1103,7 @@ encode_datawriter_submessage_encrypt (
         */
 
   size = 2 * sizeof(struct submsg_header) + sizeof(struct crypto_header) + sizeof(struct crypto_footer) + ALIGN4(plain_submsg->_length);
-  size += reader_crypto_list->_length * CRYPTO_HMAC_SIZE;
+  size += reader_crypto_list->_length * sizeof(struct receiver_specific_mac);
   /* assure that the buffer contains enough memory to accommodate the encrypted payload */
   if (is_encryption_required(session->master_key_material->transformation_kind))
     size += sizeof(struct submsg_header) + sizeof(uint32_t) + CRYPTO_ENCRYPTION_MAX_PADDING;
@@ -1150,9 +1150,9 @@ encode_datawriter_submessage_encrypt (
 
     /* adjust the length of the body submessage when needed */
     encrypted->length = ddsrt_toBE4u(payload_len);
-    if (payload_len + sizeof(encrypted->length) > plain_submsg->_length)
+    if (payload_len > plain_submsg->_length)
     {
-      size_t inc = payload_len + sizeof(encrypted->length) - plain_submsg->_length;
+      size_t inc = payload_len - plain_submsg->_length;
       body->length = (uint16_t)(body->length + inc);
       data._length += (uint32_t)inc;
     }
@@ -1182,7 +1182,9 @@ encode_datawriter_submessage_encrypt (
   footer->receiver_specific_macs._length = 0;
 
   *encoded_submsg = data;
-  if (has_origin_authentication(protection_kind))
+  if (!has_origin_authentication(protection_kind))
+    *index = (int32_t) reader_crypto_list->_length;
+  else
   {
     if (reader_crypto_list->_length != 0)
     {
@@ -1191,10 +1193,7 @@ encode_datawriter_submessage_encrypt (
       (*index)++;
     }
   }
-  else
-  {
-    *index = (int32_t) reader_crypto_list->_length;
-  }
+
   result = true;
 
 enc_dw_submsg_fail:
@@ -1357,7 +1356,7 @@ encode_datareader_submessage(
      */
 
   size = 2 * sizeof(struct submsg_header) + sizeof(struct crypto_header) + sizeof(struct crypto_footer) + ALIGN4(plain_submsg->_length);
-  size += writer_crypto_list->_length * CRYPTO_HMAC_SIZE;
+  size += writer_crypto_list->_length * sizeof(struct receiver_specific_mac);
   /* assure that the buffer contains enough memory to accommodate the encrypted payload */
   if (is_encryption_required(session->master_key_material->transformation_kind))
     size += sizeof(struct submsg_header) + sizeof(uint32_t) + CRYPTO_ENCRYPTION_MAX_PADDING;
@@ -1405,9 +1404,9 @@ encode_datareader_submessage(
 
     /* adjust the length of the body submessage when needed */
     encrypted->length = ddsrt_toBE4u(payload_len);
-    if (payload_len + sizeof(encrypted->length) > plain_submsg->_length)
+    if (payload_len > plain_submsg->_length)
     {
-      size_t inc = payload_len + sizeof(encrypted->length) - plain_submsg->_length;
+      size_t inc = payload_len - plain_submsg->_length;
       body->length = (uint16_t)(body->length + inc);
       data._length += (uint32_t)inc;
     }
@@ -1641,7 +1640,7 @@ static DDS_Security_boolean encode_rtps_message_encrypt (
 
   size = RTPS_HEADER_SIZE; /* RTPS Header */
   size += 2 * sizeof(struct submsg_header) + sizeof(struct crypto_header) + sizeof(struct crypto_footer) + ALIGN4(plain_rtps_message->_length);
-  size += receiving_participant_crypto_list->_length * CRYPTO_HMAC_SIZE;
+  size += receiving_participant_crypto_list->_length * sizeof(struct receiver_specific_mac);
   size += sizeof(struct submsg_header) + RTPS_HEADER_SIZE; /* INFO_SRC */
 
   if (is_encryption_required(session->master_key_material->transformation_kind))

From cb1d06b442f9cb718a5f1944ec0ca34f0d3cad4f Mon Sep 17 00:00:00 2001
From: Marcel Jordense <marcel.jordense@adlinktech.com>
Date: Tue, 7 Apr 2020 11:01:53 +0200
Subject: [PATCH 146/238] Freeing the writer security attributes should be done
 by the gc

Signed-off-by: Marcel Jordense <marcel.jordense@adlinktech.com>
---
 src/core/ddsi/src/q_entity.c | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/src/core/ddsi/src/q_entity.c b/src/core/ddsi/src/q_entity.c
index 569fb01..826124f 100644
--- a/src/core/ddsi/src/q_entity.c
+++ b/src/core/ddsi/src/q_entity.c
@@ -4052,9 +4052,7 @@ dds_return_t delete_writer_nolinger (struct ddsi_domaingv *gv, const struct ddsi
     return DDS_RETCODE_BAD_PARAMETER;
   }
   GVLOGDISC ("delete_writer_nolinger(guid "PGUIDFMT") ...\n", PGUID (*guid));
-#ifdef DDSI_INCLUDE_SECURITY
-  q_omg_security_deregister_writer(wr);
-#endif
+
   ddsrt_mutex_lock (&wr->e.lock);
   delete_writer_nolinger_locked (wr);
   ddsrt_mutex_unlock (&wr->e.lock);

From 9c09eca2e951bc5e95e154d28e64f7c23dcf3a7e Mon Sep 17 00:00:00 2001
From: Erik Boasson <eb@ilities.com>
Date: Wed, 1 Apr 2020 13:02:03 +0200
Subject: [PATCH 147/238] Do not assume string in algo binary property

Interpretation of the c.dsign_algo and c.kagree_algo properties must not
assume the binary property to be a null-terminated string.

Signed-off-by: Erik Boasson <eb@ilities.com>
---
 .../authentication/src/authentication.c       | 38 ++++++++++---------
 1 file changed, 21 insertions(+), 17 deletions(-)

diff --git a/src/security/builtin_plugins/authentication/src/authentication.c b/src/security/builtin_plugins/authentication/src/authentication.c
index 7e15f05..14eb2c3 100644
--- a/src/security/builtin_plugins/authentication/src/authentication.c
+++ b/src/security/builtin_plugins/authentication/src/authentication.c
@@ -523,27 +523,31 @@ static const char *get_kagree_algo(AuthenticationAlgoKind_t kind)
   }
 }
 
-static AuthenticationAlgoKind_t get_dsign_algo_from_string(const char *name)
+static bool str_octseq_equal (const char *str, const DDS_Security_OctetSeq *binstr)
 {
-  if (name)
-  {
-    if (strcmp(AUTH_DSIG_ALGO_RSA_2048_SHA256_IDENT, name) == 0)
+  size_t i;
+  for (i = 0; str[i] && i < binstr->_length; i++)
+    if ((unsigned char) str[i] != binstr->_buffer[i])
+      return false;
+  /* allow zero-termination in binstr */
+  return (str[i] == 0 && (i == binstr->_length || binstr->_buffer[i] == 0));
+}
+
+static AuthenticationAlgoKind_t get_dsign_algo_from_octseq(const DDS_Security_OctetSeq *name)
+{
+  if (str_octseq_equal(AUTH_DSIG_ALGO_RSA_2048_SHA256_IDENT, name))
       return AUTH_ALGO_KIND_RSA_2048;
-    if (strcmp(AUTH_DSIG_ALGO_ECDSA_SHA256_IDENT, name) == 0)
-      return AUTH_ALGO_KIND_EC_PRIME256V1;
-  }
+  if (str_octseq_equal(AUTH_DSIG_ALGO_ECDSA_SHA256_IDENT, name))
+    return AUTH_ALGO_KIND_EC_PRIME256V1;
   return AUTH_ALGO_KIND_UNKNOWN;
 }
 
-static AuthenticationAlgoKind_t get_kagree_algo_from_string(const char *name)
+static AuthenticationAlgoKind_t get_kagree_algo_from_octseq(const DDS_Security_OctetSeq *name)
 {
-  if (name)
-  {
-    if (strcmp(AUTH_KAGREE_ALGO_RSA_2048_SHA256_IDENT, name) == 0)
-      return AUTH_ALGO_KIND_RSA_2048;
-    if (strcmp(AUTH_KAGREE_ALGO_ECDH_PRIME256V1_IDENT, name) == 0)
-      return AUTH_ALGO_KIND_EC_PRIME256V1;
-  }
+  if (str_octseq_equal(AUTH_KAGREE_ALGO_RSA_2048_SHA256_IDENT, name))
+    return AUTH_ALGO_KIND_RSA_2048;
+  if (str_octseq_equal(AUTH_KAGREE_ALGO_ECDH_PRIME256V1_IDENT, name))
+    return AUTH_ALGO_KIND_EC_PRIME256V1;
   return AUTH_ALGO_KIND_UNKNOWN;
 }
 
@@ -1418,12 +1422,12 @@ static DDS_Security_ValidationResult_t validate_handshake_token_impl (const DDS_
 
     if ((c_dsign_algo = find_required_nonempty_binprop (token, "c.dsign_algo", ex)) == NULL)
       return DDS_SECURITY_VALIDATION_FAILED;
-    if ((dsignAlgoKind = get_dsign_algo_from_string ((const char *) c_dsign_algo->value._buffer)) == AUTH_ALGO_KIND_UNKNOWN)
+    if ((dsignAlgoKind = get_dsign_algo_from_octseq (&c_dsign_algo->value)) == AUTH_ALGO_KIND_UNKNOWN)
       return set_exception (ex, "process_handshake: HandshakeMessageToken property c.dsign_algo not supported");
 
     if ((c_kagree_algo = find_required_nonempty_binprop (token, "c.kagree_algo", ex)) == NULL)
       return DDS_SECURITY_VALIDATION_FAILED;
-    if ((kagreeAlgoKind = get_kagree_algo_from_string ((const char *) c_kagree_algo->value._buffer)) == AUTH_ALGO_KIND_UNKNOWN)
+    if ((kagreeAlgoKind = get_kagree_algo_from_octseq (&c_kagree_algo->value)) == AUTH_ALGO_KIND_UNKNOWN)
       return set_exception (ex, "process_handshake: HandshakeMessageToken property c.kagree_algo not supported");
 
     /* calculate the hash value and set in handshake hash_c1 (req) or hash_c2 (reply) */

From eb7e5e3a8781c966e91262cfbd84de2dc2b475d4 Mon Sep 17 00:00:00 2001
From: Erik Boasson <eb@ilities.com>
Date: Tue, 7 Apr 2020 10:27:39 +0200
Subject: [PATCH 148/238] Disallow junk after optional terminator in
 string/binprop compare

Signed-off-by: Erik Boasson <eb@ilities.com>
---
 .../builtin_plugins/authentication/src/authentication.c     | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/src/security/builtin_plugins/authentication/src/authentication.c b/src/security/builtin_plugins/authentication/src/authentication.c
index 14eb2c3..127357a 100644
--- a/src/security/builtin_plugins/authentication/src/authentication.c
+++ b/src/security/builtin_plugins/authentication/src/authentication.c
@@ -529,8 +529,10 @@ static bool str_octseq_equal (const char *str, const DDS_Security_OctetSeq *bins
   for (i = 0; str[i] && i < binstr->_length; i++)
     if ((unsigned char) str[i] != binstr->_buffer[i])
       return false;
-  /* allow zero-termination in binstr */
-  return (str[i] == 0 && (i == binstr->_length || binstr->_buffer[i] == 0));
+  /* allow zero-termination in binstr, but disallow anything other than a single \0 */
+  return (str[i] == 0 &&
+          (i == binstr->_length ||
+           (i+1 == binstr->_length && binstr->_buffer[i] == 0)));
 }
 
 static AuthenticationAlgoKind_t get_dsign_algo_from_octseq(const DDS_Security_OctetSeq *name)

From 52edbe94e98e8d2c1ef98610ef30f3bcb2f8d774 Mon Sep 17 00:00:00 2001
From: Erik Boasson <eb@ilities.com>
Date: Wed, 8 Apr 2020 11:35:49 +0200
Subject: [PATCH 149/238] plist handling of invalid input and keyhashes

This fixes some issues with the new discovery data ("plist" topics)
discovered on interoperating with some other DDS implementations:

* The interpretation of a keyhash as if it were a valid sample was wrong
  in various ways: inconsistent endianness, incorrect encoding
  identifier and a missing sentinel.  As Cyclone follows the spec and
  always provides a well-formed payload, the problem only surfaces when
  interoperating with implementations that expect the recipient to make
  do with a keyhash.

* Various paths failed to check for failure causing potential null
  pointer dereferences.

Signed-off-by: Erik Boasson <eb@ilities.com>
---
 src/core/ddsi/src/ddsi_serdata_plist.c | 16 ++++++++++++----
 src/core/ddsi/src/q_ddsi_discovery.c   |  7 +++++++
 2 files changed, 19 insertions(+), 4 deletions(-)

diff --git a/src/core/ddsi/src/ddsi_serdata_plist.c b/src/core/ddsi/src/ddsi_serdata_plist.c
index 225f9e9..528fa81 100644
--- a/src/core/ddsi/src/ddsi_serdata_plist.c
+++ b/src/core/ddsi/src/ddsi_serdata_plist.c
@@ -102,6 +102,8 @@ static struct ddsi_serdata *serdata_plist_from_ser (const struct ddsi_sertopic *
 {
   const struct ddsi_sertopic_plist *tp = (const struct ddsi_sertopic_plist *) tpcmn;
   struct ddsi_serdata_plist *d = serdata_plist_new (tp, kind, size, NN_RMSG_PAYLOADOFF (fragchain->rmsg, NN_RDATA_PAYLOAD_OFF (fragchain)));
+  if (d == NULL)
+    return NULL;
   uint32_t off = 4; /* must skip the CDR header */
   assert (fragchain->min == 0);
   assert (fragchain->maxp1 >= off); /* CDR header must be in first fragment */
@@ -128,6 +130,8 @@ static struct ddsi_serdata *serdata_plist_from_ser_iov (const struct ddsi_sertop
   const struct ddsi_sertopic_plist *tp = (const struct ddsi_sertopic_plist *) tpcmn;
   assert (niov >= 1);
   struct ddsi_serdata_plist *d = serdata_plist_new (tp, kind, size, iov[0].iov_base);
+  if (d == NULL)
+    return NULL;
   memcpy (d->data + d->pos, (const char *) iov[0].iov_base + 4, iov[0].iov_len - 4);
   d->pos += (uint32_t) iov[0].iov_len - 4;
   for (ddsrt_msg_iovlen_t i = 1; i < niov; i++)
@@ -141,14 +145,18 @@ static struct ddsi_serdata *serdata_plist_from_ser_iov (const struct ddsi_sertop
 static struct ddsi_serdata *serdata_plist_from_keyhash (const struct ddsi_sertopic *tpcmn, const ddsi_keyhash_t *keyhash)
 {
   const struct ddsi_sertopic_plist *tp = (const struct ddsi_sertopic_plist *) tpcmn;
-  const struct { uint16_t identifier, options; nn_parameter_t par; ddsi_keyhash_t kh; } in = {
-    .identifier = CDR_BE,
+  const struct { uint16_t identifier, options; nn_parameter_t par; ddsi_keyhash_t kh; nn_parameter_t sentinel; } in = {
+    .identifier = PL_CDR_BE,
     .options = 0,
     .par = {
       .parameterid = ddsrt_toBE2u (tp->keyparam),
-      .length = sizeof (*keyhash)
+      .length = ddsrt_toBE2u ((uint16_t) sizeof (*keyhash))
     },
-    *keyhash
+    .kh = *keyhash,
+    .sentinel = {
+      .parameterid = ddsrt_toBE2u (PID_SENTINEL),
+      .length = 0
+    }
   };
   const ddsrt_iovec_t iov = { .iov_base = (void *) &in, .iov_len = sizeof (in) };
   return serdata_plist_from_ser_iov (tpcmn, SDK_KEY, 1, &iov, sizeof (in) - 4);
diff --git a/src/core/ddsi/src/q_ddsi_discovery.c b/src/core/ddsi/src/q_ddsi_discovery.c
index 865a8dc..f8ee6eb 100644
--- a/src/core/ddsi/src/q_ddsi_discovery.c
+++ b/src/core/ddsi/src/q_ddsi_discovery.c
@@ -1534,6 +1534,13 @@ int builtins_dqueue_handler (const struct nn_rsample_info *sampleinfo, const str
                PGUID (srcguid), sampleinfo->seq);
     goto done_upd_deliv;
   }
+  if (d == NULL)
+  {
+    GVLOG (DDS_LC_DISCOVERY | DDS_LC_WARNING, "data(builtin, vendor %u.%u): "PGUIDFMT" #%"PRId64": deserialization failed\n",
+           sampleinfo->rst->vendor.id[0], sampleinfo->rst->vendor.id[1],
+           PGUID (srcguid), sampleinfo->seq);
+    goto done_upd_deliv;
+  }
 
   d->timestamp = (sampleinfo->timestamp.v != DDSRT_WCTIME_INVALID.v) ? sampleinfo->timestamp : ddsrt_time_wallclock ();
   d->statusinfo = statusinfo;

From e88552123c4c3c4164fb909b798b3d6147d2de9d Mon Sep 17 00:00:00 2001
From: Erik Boasson <eb@ilities.com>
Date: Wed, 8 Apr 2020 11:42:53 +0200
Subject: [PATCH 150/238] Peers may have a secure announcer without using
 security

There exist implementations that advertise security-related
built-endpoints regardless of whether the participant has security
configured.  Therefore, the test whether security is enabled for the
participant cannot simply be the presence of such an endpoint, because
the absence of an IDENTITY_TOKEN in the data is then considered an
error.

This commit simply changes the check to requiring the presence of the
endpoint and the presence of the IDENTITY_TOKEN.

Signed-off-by: Erik Boasson <eb@ilities.com>
---
 src/core/ddsi/src/q_ddsi_discovery.c | 8 ++------
 1 file changed, 2 insertions(+), 6 deletions(-)

diff --git a/src/core/ddsi/src/q_ddsi_discovery.c b/src/core/ddsi/src/q_ddsi_discovery.c
index f8ee6eb..98db5b0 100644
--- a/src/core/ddsi/src/q_ddsi_discovery.c
+++ b/src/core/ddsi/src/q_ddsi_discovery.c
@@ -638,16 +638,12 @@ static int handle_SPDP_alive (const struct receiver_state *rst, seqno_t seq, dds
     }
   }
 
-  const bool is_secure = (datap->builtin_endpoint_set & NN_DISC_BUILTIN_ENDPOINT_PARTICIPANT_SECURE_ANNOUNCER) != 0;
+  const bool is_secure = ((datap->builtin_endpoint_set & NN_DISC_BUILTIN_ENDPOINT_PARTICIPANT_SECURE_ANNOUNCER) != 0 &&
+                          (datap->present & PP_IDENTITY_TOKEN));
   /* Make sure we don't create any security builtin endpoint when it's considered unsecure. */
   if (!is_secure)
     builtin_endpoint_set &= NN_BES_MASK_NON_SECURITY;
   GVLOGDISC ("SPDP ST0 "PGUIDFMT" bes %x%s NEW", PGUID (datap->participant_guid), builtin_endpoint_set, is_secure ? " (secure)" : "");
-  if (is_secure && !(datap->present & PP_IDENTITY_TOKEN))
-  {
-    GVLOGDISC (" identity token missing\n");
-    return 0;
-  }
 
   if (datap->present & PP_PARTICIPANT_LEASE_DURATION)
   {

From 1fd4ab290fcd11ad78f63e9070dd9cfcc8ec6ff3 Mon Sep 17 00:00:00 2001
From: Erik Boasson <eb@ilities.com>
Date: Wed, 8 Apr 2020 22:12:34 +0200
Subject: [PATCH 151/238] Do not build security tests if BUILD_IDLC=NO

Signed-off-by: Erik Boasson <eb@ilities.com>
---
 src/security/core/CMakeLists.txt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/security/core/CMakeLists.txt b/src/security/core/CMakeLists.txt
index 19f4823..7765227 100644
--- a/src/security/core/CMakeLists.txt
+++ b/src/security/core/CMakeLists.txt
@@ -45,7 +45,7 @@ target_include_directories(security_core
         "$<BUILD_INTERFACE:$<TARGET_PROPERTY:ddsc,INTERFACE_INCLUDE_DIRECTORIES>>"
 )
 
-if(BUILD_TESTING)
+if(BUILD_TESTING AND BUILD_IDLC)
   add_subdirectory(tests)
 endif()
 

From b2b9630c38b556530001168ce8177e85b56876c3 Mon Sep 17 00:00:00 2001
From: Dennis Potman <dennis.potman@adlinktech.com>
Date: Sun, 5 Apr 2020 20:54:24 +0200
Subject: [PATCH 152/238] Prevent time-out in handshake

The security handshake is started when a node receives an SPDP message. The
SPDP receiver will reply with an SPDP, followed by a dds.sec.auth_request.
Because the initial SPDP sender will receive the auth_request immediately
after (or even before) the SPDP reply message, that node may not have finished
(or not even started) matching the remote writers and therefore it drops
the auth_request message. This results in a time-out in the handshake
process, and the auth_request has to be re-send. To avoid this, a short
(rather arbitrarily chosen, based on local testing) sleep is introduced
before the auth_request message is sent.

Signed-off-by: Dennis Potman <dennis.potman@adlinktech.com>
---
 src/core/ddsi/src/ddsi_handshake.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/src/core/ddsi/src/ddsi_handshake.c b/src/core/ddsi/src/ddsi_handshake.c
index b23d214..61f8477 100644
--- a/src/core/ddsi/src/ddsi_handshake.c
+++ b/src/core/ddsi/src/ddsi_handshake.c
@@ -553,7 +553,15 @@ static void func_validate_remote_identity(struct dds_security_fsm *fsm, void *ar
    * to be send.
    */
   if (handshake->local_auth_request_token.class_id && strlen(handshake->local_auth_request_token.class_id) != 0)
+  {
+    /* A short sleep to give the remote node some time for matching the
+       BuiltinParticipantStatelessMessageWriter, so that it won't drop the
+       sample we're sending (that would result in a time-out and the
+       handshake taking 1s longer than required) */
+    dds_sleepfor (DDS_MSECS(10));
+    HSTRACE("FSM: validate_remote_identity: send_handshake_message AUTH_REQUEST\n");
     (void)send_handshake_message(handshake, &handshake->local_auth_request_token, pp, proxypp, 1);
+  }
 
 validation_failed:
 ident_token_missing:

From 3a838f6912bb8be74b08a5ccfb5966ad465789dd Mon Sep 17 00:00:00 2001
From: Dennis Potman <dennis.potman@adlinktech.com>
Date: Mon, 6 Apr 2020 14:46:27 +0200
Subject: [PATCH 153/238] Replace sleep in func_validate_remote_identity by an
 FSM wait-state before state_validate_remote_identity

Signed-off-by: Dennis Potman <dennis.potman@adlinktech.com>
---
 src/core/ddsi/src/ddsi_handshake.c | 31 ++++++++++++++++++++++--------
 1 file changed, 23 insertions(+), 8 deletions(-)

diff --git a/src/core/ddsi/src/ddsi_handshake.c b/src/core/ddsi/src/ddsi_handshake.c
index 61f8477..9f105fd 100644
--- a/src/core/ddsi/src/ddsi_handshake.c
+++ b/src/core/ddsi/src/ddsi_handshake.c
@@ -141,6 +141,7 @@ static bool validate_handshake(struct ddsi_handshake *handshake, struct particip
 #define RESEND_TIMEOUT          DDS_SECS(1)
 #define SEND_TOKENS_TIMEOUT     DDS_MSECS(100)
 #define AUTHENTICATION_TIMEOUT  DDS_SECS(100)
+#define INITIAL_DELAY           DDS_MSECS(10)
 
 static void func_validate_remote_identity     (struct dds_security_fsm *fsm, void *arg);
 static void func_handshake_init_message_resend(struct dds_security_fsm *fsm, void *arg);
@@ -153,6 +154,7 @@ static void func_validation_failed            (struct dds_security_fsm *fsm, voi
 static void func_send_crypto_tokens_final     (struct dds_security_fsm *fsm, void *arg);
 static void func_send_crypto_tokens           (struct dds_security_fsm *fsm, void *arg);
 
+static dds_security_fsm_state state_initial_delay                       = { NULL,                      INITIAL_DELAY };
 static dds_security_fsm_state state_validate_remote_identity            = { func_validate_remote_identity,         0 };
 static dds_security_fsm_state state_validate_remote_identity_retry_wait = { NULL,                      RETRY_TIMEOUT };
 static dds_security_fsm_state state_handshake_init_message_resend       = { func_handshake_init_message_resend,    0 };
@@ -192,6 +194,7 @@ static void q_handshake_fsm_debug(
 
 
   if      (current == NULL)                                        state = "NULL";
+  else if (current == &state_initial_delay)                        state = "state_initial_delay";
   else if (current == &state_validate_remote_identity)             state = "state_validate_remote_identity";
   else if (current == &state_validate_remote_identity_retry_wait)  state = "state_validate_remote_identity_retry_wait";
   else if (current == &state_handshake_init_message_resend)        state = "state_handshake_init_message_resend";
@@ -250,6 +253,15 @@ static void q_handshake_fsm_debug(
 
                             [START]
                                |
+                     .---------------------.
+                     | state_initial_delay |
+                     |---------------------|
+                     | initial_delay       |
+                     '---------------------'
+                               |
+                            TIMEOUT
+                 EVENT_RECEIVED_MESSAGE_REQUEST
+                               |
                                v
                .---------------------------------.
                | state_validate_remote_identity  |
@@ -367,6 +379,17 @@ VALIDATION_FAILED |                                         |
 static const dds_security_fsm_transition handshake_transistions [] =
 {   /* Start */
     { NULL,                                 EVENT_AUTO,                                 NULL,
+                                            &state_initial_delay                           },
+    /* initial delay: a short delay to give the remote node some time for matching the
+       BuiltinParticipantStatelessMessageWriter, so that it won't drop the auth_request
+       we're sending (that would result in a time-out and the handshake taking longer
+       than required). For the node that receives the auth_request, the transition for
+       the event EVENT_RECEIVED_MESSAGE_REQUEST is added, because that node may receive the
+       auth_request during this delay and can continue immediately (as the sender already
+       waited for this delay before sending the request) */
+    { &state_initial_delay,                 EVENT_TIMEOUT,                              NULL,
+                                            &state_validate_remote_identity                },
+    { &state_initial_delay,                 EVENT_RECEIVED_MESSAGE_REQUEST,             NULL,
                                             &state_validate_remote_identity                },
     /* validate remote identity */
     { &state_validate_remote_identity,      EVENT_VALIDATION_PENDING_RETRY,             NULL,
@@ -553,15 +576,7 @@ static void func_validate_remote_identity(struct dds_security_fsm *fsm, void *ar
    * to be send.
    */
   if (handshake->local_auth_request_token.class_id && strlen(handshake->local_auth_request_token.class_id) != 0)
-  {
-    /* A short sleep to give the remote node some time for matching the
-       BuiltinParticipantStatelessMessageWriter, so that it won't drop the
-       sample we're sending (that would result in a time-out and the
-       handshake taking 1s longer than required) */
-    dds_sleepfor (DDS_MSECS(10));
-    HSTRACE("FSM: validate_remote_identity: send_handshake_message AUTH_REQUEST\n");
     (void)send_handshake_message(handshake, &handshake->local_auth_request_token, pp, proxypp, 1);
-  }
 
 validation_failed:
 ident_token_missing:

From 1e484a3c6ff604ed472015e4dca39dfcfb440996 Mon Sep 17 00:00:00 2001
From: Dennis Potman <dennis.potman@adlinktech.com>
Date: Mon, 6 Apr 2020 22:38:36 +0200
Subject: [PATCH 154/238] Introduced a new state in handshake fsm that combines
 validate_remote_entity and begin_handshake_reply into a single step, which is
 used in case a auth_request message is received during the initial delay when
 starting the handshake process

Signed-off-by: Dennis Potman <dennis.potman@adlinktech.com>
---
 src/core/ddsi/src/ddsi_handshake.c | 386 ++++++++++++++++-------------
 1 file changed, 219 insertions(+), 167 deletions(-)

diff --git a/src/core/ddsi/src/ddsi_handshake.c b/src/core/ddsi/src/ddsi_handshake.c
index 9f105fd..7040450 100644
--- a/src/core/ddsi/src/ddsi_handshake.c
+++ b/src/core/ddsi/src/ddsi_handshake.c
@@ -143,18 +143,20 @@ static bool validate_handshake(struct ddsi_handshake *handshake, struct particip
 #define AUTHENTICATION_TIMEOUT  DDS_SECS(100)
 #define INITIAL_DELAY           DDS_MSECS(10)
 
-static void func_validate_remote_identity     (struct dds_security_fsm *fsm, void *arg);
-static void func_handshake_init_message_resend(struct dds_security_fsm *fsm, void *arg);
-static void func_begin_handshake_reply        (struct dds_security_fsm *fsm, void *arg);
-static void func_begin_handshake_request      (struct dds_security_fsm *fsm, void *arg);
-static void func_process_handshake            (struct dds_security_fsm *fsm, void *arg);
-static void func_handshake_message_resend     (struct dds_security_fsm *fsm, void *arg);
-static void func_validation_ok                (struct dds_security_fsm *fsm, void *arg);
-static void func_validation_failed            (struct dds_security_fsm *fsm, void *arg);
-static void func_send_crypto_tokens_final     (struct dds_security_fsm *fsm, void *arg);
-static void func_send_crypto_tokens           (struct dds_security_fsm *fsm, void *arg);
+static void func_validate_remote_and_begin_reply (struct dds_security_fsm *fsm, void *arg);
+static void func_validate_remote_identity        (struct dds_security_fsm *fsm, void *arg);
+static void func_handshake_init_message_resend   (struct dds_security_fsm *fsm, void *arg);
+static void func_begin_handshake_reply           (struct dds_security_fsm *fsm, void *arg);
+static void func_begin_handshake_request         (struct dds_security_fsm *fsm, void *arg);
+static void func_process_handshake               (struct dds_security_fsm *fsm, void *arg);
+static void func_handshake_message_resend        (struct dds_security_fsm *fsm, void *arg);
+static void func_validation_ok                   (struct dds_security_fsm *fsm, void *arg);
+static void func_validation_failed               (struct dds_security_fsm *fsm, void *arg);
+static void func_send_crypto_tokens_final        (struct dds_security_fsm *fsm, void *arg);
+static void func_send_crypto_tokens              (struct dds_security_fsm *fsm, void *arg);
 
 static dds_security_fsm_state state_initial_delay                       = { NULL,                      INITIAL_DELAY };
+static dds_security_fsm_state state_validate_remote_and_begin_reply     = { func_validate_remote_and_begin_reply,  0 };
 static dds_security_fsm_state state_validate_remote_identity            = { func_validate_remote_identity,         0 };
 static dds_security_fsm_state state_validate_remote_identity_retry_wait = { NULL,                      RETRY_TIMEOUT };
 static dds_security_fsm_state state_handshake_init_message_resend       = { func_handshake_init_message_resend,    0 };
@@ -195,6 +197,7 @@ static void q_handshake_fsm_debug(
 
   if      (current == NULL)                                        state = "NULL";
   else if (current == &state_initial_delay)                        state = "state_initial_delay";
+  else if (current == &state_validate_remote_and_begin_reply)      state = "state_validate_remote_and_begin_reply";
   else if (current == &state_validate_remote_identity)             state = "state_validate_remote_identity";
   else if (current == &state_validate_remote_identity_retry_wait)  state = "state_validate_remote_identity_retry_wait";
   else if (current == &state_handshake_init_message_resend)        state = "state_handshake_init_message_resend";
@@ -249,124 +252,126 @@ static void q_handshake_fsm_debug(
 
 
 /************************************************************************************************************
- Inspiration from https://confluence.prismtech.com/display/VC/Authentication?preview=/30379826/34340895/PT_StateMachine_3g.gif
-
                             [START]
                                |
-                     .---------------------.
-                     | state_initial_delay |
-                     |---------------------|
-                     | initial_delay       |
-                     '---------------------'
-                               |
-                            TIMEOUT
-                 EVENT_RECEIVED_MESSAGE_REQUEST
-                               |
-                               v
-               .---------------------------------.
-               | state_validate_remote_identity  |
-  .------------|---------------------------------|----------.--------------------.
-  |            | func_validate_remote_identity() |          |                    |
-  |            '---------------------------------'          |  VALIDATION_PENDING_HANDSHAKE_MESSAGE
-VALIDATION_FAILED             ^  | VALIDATION_PENDING_RETRY |                    |
-VALIDATION_OK                 |  |                          |                    |
-  |                   TIMEOUT |  v                          |                    v
-  |       .-------------------------------------------.     |  .-----------------------------------.
-  |       | state_validate_remote_identity_retry_wait |     |  | state_handshake_init_message_wait |<---------------.
-  |       |-------------------------------------------|     |  |-----------------------------------|           AUTO |
-  |       | retry_timeout                             |     |  | resend_timeout                    |---------.      |
-  |       '-------------------------------------------'     |  '-----------------------------------' TIMEOUT |      |
-  |                                                         |                    |                           |      |
-  |                     .-----------------------------------'                    |                           |      |
-  |                     |      VALIDATION_PENDING_HANDSHAKE_REQUEST              |                           v      |
-  |                     |                                                        |       .--------------------------------------.
-  |                     v                                      RECEIVED_MESSAGE_REQUEST  | state_handshake_init_message_resend  |
-  |    .--------------------------------.                                        |       |--------------------------------------|
-  |    | state_begin_handshake_request  | VALIDATION_PENDING_RETRY               |       | func_handshake_init_message_resend() |
-  |    |--------------------------------|------------.                           |       '--------------------------------------'
-  |    | func_begin_handshake_request() |            |                           |                           ^
-  |    '--------------------------------'            |                           |                           |
-  |        |            |        ^                   |                           |                           |
-  |        |            |        | TIMEOUT           v                           |                           |
-  | VALIDATION_FAILED   |      .------------------------------------------.      |                           |
-  | VALIDATION_OK       |      | state_begin_handshake_request_retry_wait |      |                           |
-  |        |            |      |------------------------------------------|      |                           |
-  |--------'            |      | retry_timeout                            |      |                           |
-  |                     |      '------------------------------------------'      |                           |
-  |                     |                                                        v                  VALIDATION_FAILED
-  |                     |                                        .------------------------------.            |
-  |   VALIDATION_PENDING_HANDSHAKE_MESSAGE                       | state_begin_handshake_reply  |------------'
-  |                     |                                .-------|------------------------------|
-  |                     |                                |       | func_begin_handshake_reply() |------------.
-  |                     |                                |       '------------------------------'            |
-  |                     |                                |       VALIDATION_OK |              ^     VALIDATION_PENDING_RETRY
-  |                     |                                |                     |              |              |
-  |                     |     VALIDATION_PENDING_HANDSHAKE_MESSAGE             v              | TIMEOUT      |
-  |                     |                                |         goto state_validation_ok   |              |
-  |                     |                                v                                    |              v
-  |                     |                .------------------------------.            .------------------------------------------.
-  |                     |                | state_handshake_message_wait |            | state_begin_handshake_reply_retry_wait   |
-  |                     .--------------->|------------------------------|-------.    |------------------------------------------|
-  |                     |                | resend_timeout               |       |    | retry_timeout                            |
-  |                     |                '------------------------------'       |    '------------------------------------------'
-  |                     | AUTO                           |          ^           |
-  |                     |                        TIMEOUT |          |           |
-  |    .---------------------------------.               |          |           | RECEIVED_MESSAGE_REPLY
-  |    | state_handshake_message_resend  |               |  VALIDATION_FAILED   | RECEIVED_MESSAGE_FINAL
-  |    |---------------------------------|<--------------'          |           |
-  |    | func_handshake_message_resend() |                          |           v
-  |    '---------------------------------'                        .--------------------------.
-  |                                                               | state_process_handshake  |
-  |                              .--------------------------------|--------------------------|--------------------------.
-  |                              |            .------------------>| func_process_handshake() |                          |
-  |                              |            |                   '--------------------------'                          |
-  |                              |            |                                 |                                       |
-  |          VALIDATION_PENDING_RETRY      TIMEOUT                VALIDATION_OK |                                       |
-  |                              v            |                                 v                                       |
-  |           .------------------------------------.            .-------------------------------.                       |
-  |           | state_process_handshake_retry_wait |            | state_send_crypto_tokens_wait |                       |
-  |           |------------------------------------|            |-------------------------------|                       |
-  |           | retry_timeout                      |            | send_tokens_timeout           |                       |
-  |           '------------------------------------'            '-------------------------------'                       |
-  |                                                                     |              |              VALIDATION_OK_FINAL_MESSAGE
-  |                                                       .-------------'              '---------.                      |
-  |                                                       | RECV_CRYPTO_TOKENS           TIMEOUT |                      |
-  |                                                       v                                      v                      |
-  |                                      .---------------------------------.       .---------------------------.        |
-  |                                      | state_send_crypto_tokens_final  |       | state_send_crypto_tokens  |        |
-  |                       .--------------|---------------------------------|       |---------------------------|        |
-  |                       |              | func_send_crypto_tokens_final() |       | func_send_crypto_tokens() |        |
-  |                       |              '---------------------------------'       '---------------------------'        |
-  |                       |                               ^                                      |                      |
-  |                   VALIDATION_OK                       |       .--------------------.   VALIDATION_OK_FINAL_MESSAGE  |
-  |                       |                       TIMEOUT |       | RECV_CRYPTO_TOKENS |         |                      |
-  |                       |                               |       v                    |         v                      |
-  |                       |            .-------------------------------------.     .--------------------------.         |
-  |                       |            | state_send_crypto_tokens_final_wait |     | state_wait_crypto_tokens |<--------'
-  |                       |            |-------------------------------------|     |--------------------------|
-  |                       |            | send_tokens_timeout                 |     |                          |---------.
-  |                       |            '-------------------------------------'     '--------------------------'         |
-  |                       |                               ^                              |               ^              |
-  |                       |                               |                  RECEIVED_MESSAGE_REPLY     AUTO      VALIDATION_OK
-  |                       |                      RECV_CRYPTO_TOKENS                      v               |              |
-  |                       |                               |                     .---------------------------------.     |
-  |                       |                               |                     |  state_handshake_final_resend   |     |
-  |                       |                               '---------------------|---------------------------------|     |
-  | VALIDATION_OK         |                                                     | func_handshake_message_resend() |     |
-  |---------------------------------------------------------.                   '---------------------------------'     |
-  |                                                         |                                                           |
-  '---------------.                                         |                                                           |
-VALIDATION_FAILED |                                         |                                                           |
-                  v                                         v                                                           |
-            .--------------------------.               .----------------------.                                         |
-            | state_validation_failed  |               | state_validation_ok  |                                         |
-            |--------------------------|               |----------------------|<----------------------------------------'
-            | func_validation_failed() |               | func_validation_ok() |
-            '--------------------------'               '----------------------'
-                          |                                       |
-                          v                                       v
-                        [END]                                   [END]
-
+                     .---------------------.                                .----------------------------------------.
+                     | state_initial_delay |                                | state_validate_remote_and_begin_reply  |
+                     |---------------------|------------------------------->|----------------------------------------|------------------.
+                     | initial_delay       |    RECEIVED_MESSAGE_REQUEST    | func_validate_remote_and_begin_reply() |                  |
+                     '---------------------'                                '----------------------------------------'                  |
+                               |                                                                                              VALIDATION_PENDING_RETRY
+                            TIMEOUT                                                                                     VALIDATION_PENDING_HANDSHAKE_MESSAGE
+                               |                                                                                                 VALIDATION_OK
+                               v                                                                                                 VALIDATION_FAILED
+               .---------------------------------.                                                                                      |
+               | state_validate_remote_identity  |                                                                                      |
+  .------------|---------------------------------|----------.--------------------.                                                      |
+  |            | func_validate_remote_identity() |          |                    |                                                      |
+  |            '---------------------------------'          |  VALIDATION_PENDING_HANDSHAKE_MESSAGE                                     |
+VALIDATION_FAILED             ^  | VALIDATION_PENDING_RETRY |                    |                                                      |
+VALIDATION_OK                 |  |                          |                    |                                                      |
+  |                   TIMEOUT |  v                          |                    v                                                      |
+  |       .-------------------------------------------.     |  .-----------------------------------.                                    |
+  |       | state_validate_remote_identity_retry_wait |     |  | state_handshake_init_message_wait |<---------------.                   |
+  |       |-------------------------------------------|     |  |-----------------------------------|           AUTO |                   |
+  |       | retry_timeout                             |     |  | resend_timeout                    |---------.      |                   |
+  |       '-------------------------------------------'     |  '-----------------------------------' TIMEOUT |      |                   |
+  |                                                         |                    |                           |      |                   |
+  |                     .-----------------------------------'                    |                           |      |                   |
+  |                     |      VALIDATION_PENDING_HANDSHAKE_REQUEST              |                           v      |                   |
+  |                     |                                                        |       .--------------------------------------.       |
+  |                     v                                      RECEIVED_MESSAGE_REQUEST  | state_handshake_init_message_resend  |       |
+  |    .--------------------------------.                                        |       |--------------------------------------|       |
+  |    | state_begin_handshake_request  | VALIDATION_PENDING_RETRY               |       | func_handshake_init_message_resend() |       |
+  |    |--------------------------------|------------.                           |       '--------------------------------------'       |
+  |    | func_begin_handshake_request() |            |                           |                           ^                          |
+  |    '--------------------------------'            |                           |                           |                          |
+  |        |            |        ^                   |                           |                           |                          |
+  |        |            |        | TIMEOUT           v                           |                           |                          |
+  | VALIDATION_FAILED   |      .------------------------------------------.      |                           |                          |
+  | VALIDATION_OK       |      | state_begin_handshake_request_retry_wait |      |                           |                          |
+  |        |            |      |------------------------------------------|      |                           |                          |
+  |--------'            |      | retry_timeout                            |      |                           |                          |
+  |                     |      '------------------------------------------'      |                           |                          |
+  |                     |                                                        v                  VALIDATION_FAILED                   |
+  |                     |                                        .------------------------------.            |                          |
+  |   VALIDATION_PENDING_HANDSHAKE_MESSAGE                       | state_begin_handshake_reply  |------------'                          |
+  |                     |                                .-------|------------------------------|                                       |
+  |                     |                                |       | func_begin_handshake_reply() |------------.                          |
+  |                     |                                |       '------------------------------'            |                          |
+  |                     |                                |       VALIDATION_OK |              ^     VALIDATION_PENDING_RETRY            |
+  |                     |                                |                     |              |              |                          |
+  |                     |                                |                     |              |              | VALIDATION_PENDING_RETRY |
+  |                     |     VALIDATION_PENDING_HANDSHAKE_MESSAGE             v              | TIMEOUT      |--------------------------|
+  |                     |                                |         goto state_validation_ok   |              |                          |
+  |                     |                                v                                    |              v                          |
+  |                     |                .------------------------------.            .------------------------------------------.       |
+  |                     |                | state_handshake_message_wait |<--------.  | state_begin_handshake_reply_retry_wait   |       |
+  |                     .--------------->|------------------------------|------.  |  |------------------------------------------|       |
+  |                     |                | resend_timeout               |      |  |  | retry_timeout                            |       |
+  |                     |                '------------------------------'      |  |  '------------------------------------------'       |
+  |                     |                                |          ^          |  |                                                     |
+  |                     | AUTO                           |          |          |  |        VALIDATION_PENDING_HANDSHAKE_MESSAGE         |
+  |                     |                                |          |          |  '-----------------------------------------------------|
+  |                     |                        TIMEOUT |          |          |                                                        |
+  |    .---------------------------------.               |          |          | RECEIVED_MESSAGE_REPLY                                 |
+  |    | state_handshake_message_resend  |               |  VALIDATION_FAILED  | RECEIVED_MESSAGE_FINAL                                 |
+  |    |---------------------------------|<--------------'          |          |                                                        |
+  |    | func_handshake_message_resend() |                          |          v                                                        |
+  |    '---------------------------------'                        .--------------------------.                                          |
+  |                                                               | state_process_handshake  |                                          |
+  |                              .--------------------------------|--------------------------|--------------------------.               |
+  |                              |            .------------------>| func_process_handshake() |                          |               |
+  |                              |            |                   '--------------------------'                          |               |
+  |                              |            |                                 |                                       |               |
+  |          VALIDATION_PENDING_RETRY      TIMEOUT                VALIDATION_OK |                                       |               |
+  |                              v            |                                 v                                       |               |
+  |           .------------------------------------.            .-------------------------------.                       |               |
+  |           | state_process_handshake_retry_wait |            | state_send_crypto_tokens_wait |                       |               |
+  |           |------------------------------------|            |-------------------------------|                       |               |
+  |           | retry_timeout                      |            | send_tokens_timeout           |                       |               |
+  |           '------------------------------------'            '-------------------------------'                       |               |
+  |                                                                     |              |              VALIDATION_OK_FINAL_MESSAGE       |
+  |                                                       .-------------'              '---------.                      |               |
+  |                                                       | RECV_CRYPTO_TOKENS           TIMEOUT |                      |               |
+  |                                                       v                                      v                      |               |
+  |                                      .---------------------------------.       .---------------------------.        |               |
+  |                                      | state_send_crypto_tokens_final  |       | state_send_crypto_tokens  |        |               |
+  |                       .--------------|---------------------------------|       |---------------------------|        |               |
+  |                       |              | func_send_crypto_tokens_final() |       | func_send_crypto_tokens() |        |               |
+  |                       |              '---------------------------------'       '---------------------------'        |               |
+  |                       |                               ^                                      |                      |               |
+  |                   VALIDATION_OK                       |       .--------------------.   VALIDATION_OK_FINAL_MESSAGE  |               |
+  |                       |                       TIMEOUT |       | RECV_CRYPTO_TOKENS |         |                      |               |
+  |                       |                               |       v                    |         v                      |               |
+  |                       |            .-------------------------------------.     .--------------------------.         |               |
+  |                       |            | state_send_crypto_tokens_final_wait |     | state_wait_crypto_tokens |<--------'               |
+  |                       |            |-------------------------------------|     |--------------------------|                         |
+  |                       |            | send_tokens_timeout                 |     |                          |---------.               |
+  |                       |            '-------------------------------------'     '--------------------------'         |               |
+  |                       |                               ^                              |               ^              |               |
+  |                       |                               |                  RECEIVED_MESSAGE_REPLY     AUTO      VALIDATION_OK         |
+  |                       |                      RECV_CRYPTO_TOKENS                      v               |              |               |
+  |                       |                               |                     .---------------------------------.     |               |
+  |                       |                               |                     |  state_handshake_final_resend   |     |               |
+  |                       |                               '---------------------|---------------------------------|     |               |
+  | VALIDATION_OK         |                                                     | func_handshake_message_resend() |     |               |
+  |---------------------------------------------------------.                   '---------------------------------'     |               |
+  |                                                         |                                                           |               |
+  '---------------.                                         |                                                           |               |
+VALIDATION_FAILED |                                         |                                                           |               |
+                  v                                         v                                                           |               |
+            .--------------------------.               .----------------------.                                         |               |
+            | state_validation_failed  |               | state_validation_ok  |                                         |               |
+            |--------------------------|               |----------------------|<----------------------------------------'               |
+            | func_validation_failed() |               | func_validation_ok() |                                                         |
+            '--------------------------'               '----------------------'                                                         |
+                          |         ^                              |       ^                                                            |
+                          v         |                              v       | VALIDATION_OK                                              |
+                        [END]       |                            [END]     |                                                            |
+                                    |                                      |                                                            |
+                                    |       VALIDATION_FAILED              |                                                            |
+                                    '---------------------------------------------------------------------------------------------------'
 
  .----------------------------------------.
  | state_begin_handshake_reply_retry_wait |
@@ -390,7 +395,16 @@ static const dds_security_fsm_transition handshake_transistions [] =
     { &state_initial_delay,                 EVENT_TIMEOUT,                              NULL,
                                             &state_validate_remote_identity                },
     { &state_initial_delay,                 EVENT_RECEIVED_MESSAGE_REQUEST,             NULL,
-                                            &state_validate_remote_identity                },
+                                            &state_validate_remote_and_begin_reply         },
+    /* validate remote and begin reply */
+    { &state_validate_remote_and_begin_reply, EVENT_VALIDATION_PENDING_RETRY,             NULL,
+                                            &state_begin_handshake_reply_retry_wait          },
+    { &state_validate_remote_and_begin_reply, EVENT_VALIDATION_FAILED,                    NULL,
+                                            &state_handshake_init_message_resend             },
+    { &state_validate_remote_and_begin_reply, EVENT_VALIDATION_OK,                        NULL,
+                                            &state_validation_ok                             },
+    { &state_validate_remote_and_begin_reply, EVENT_VALIDATION_PENDING_HANDSHAKE_MESSAGE, NULL,
+                                            &state_handshake_message_wait                    },
     /* validate remote identity */
     { &state_validate_remote_identity,      EVENT_VALIDATION_PENDING_RETRY,             NULL,
                                             &state_validate_remote_identity_retry_wait     },
@@ -520,22 +534,14 @@ static bool send_handshake_message(const struct ddsi_handshake *handshake, DDS_S
   return ret;
 }
 
-static void func_validate_remote_identity(struct dds_security_fsm *fsm, void *arg)
+static DDS_Security_ValidationResult_t validate_remote_identity_impl(struct ddsi_handshake *handshake, dds_security_authentication *auth,
+    struct participant *pp, struct proxy_participant *proxypp)
 {
   DDS_Security_ValidationResult_t ret;
-  DDS_Security_SecurityException exception = {0};
-  struct ddsi_handshake *handshake = (struct ddsi_handshake*)arg;
-  dds_security_authentication *auth = handshake->auth;
-  struct participant *pp;
-  struct proxy_participant *proxypp;
   DDS_Security_IdentityToken remote_identity_token;
   int64_t remote_identity_handle;
   ddsi_guid_t remote_guid;
-
-  if (!validate_handshake(handshake, &pp, &proxypp))
-    return;
-
-  TRACE_FUNC(fsm);
+  DDS_Security_SecurityException exception = {0};
 
   if (!(proxypp->plist->present & PP_IDENTITY_TOKEN))
   {
@@ -578,9 +584,25 @@ static void func_validate_remote_identity(struct dds_security_fsm *fsm, void *ar
   if (handshake->local_auth_request_token.class_id && strlen(handshake->local_auth_request_token.class_id) != 0)
     (void)send_handshake_message(handshake, &handshake->local_auth_request_token, pp, proxypp, 1);
 
-validation_failed:
 ident_token_missing:
-  /* Use return value as state machine event. */
+validation_failed:
+  return ret;
+}
+
+static void func_validate_remote_identity(struct dds_security_fsm *fsm, void *arg)
+{
+  DDS_Security_ValidationResult_t ret;
+  struct ddsi_handshake *handshake = (struct ddsi_handshake*)arg;
+  dds_security_authentication *auth = handshake->auth;
+  struct participant *pp;
+  struct proxy_participant *proxypp;
+
+  if (!validate_handshake(handshake, &pp, &proxypp))
+    return;
+
+  TRACE_FUNC(fsm);
+
+  ret = validate_remote_identity_impl(handshake, auth, pp, proxypp);
   dds_security_fsm_dispatch(fsm, (int32_t)ret, true);
 }
 
@@ -603,19 +625,11 @@ static void func_handshake_init_message_resend(struct dds_security_fsm *fsm, voi
     (void)send_handshake_message(handshake, &handshake->local_auth_request_token, pp, proxypp, 1);
 }
 
-static void func_begin_handshake_reply(struct dds_security_fsm *fsm, void *arg)
+static DDS_Security_ValidationResult_t begin_handshake_reply_impl(struct ddsi_handshake *handshake, dds_security_authentication *auth,
+    struct participant *pp, struct proxy_participant *proxypp)
 {
   DDS_Security_ValidationResult_t ret;
   DDS_Security_SecurityException exception = {0};
-  struct ddsi_handshake *handshake = arg;
-  dds_security_authentication *auth = handshake->auth;
-  struct participant *pp;
-  struct proxy_participant *proxypp;
-
-  if (!validate_handshake(handshake, &pp, &proxypp))
-     return;
-
-  TRACE_FUNC(fsm);
 
   ddsrt_mutex_lock(&handshake->lock);
 
@@ -632,31 +646,26 @@ static void func_begin_handshake_reply(struct dds_security_fsm *fsm, void *arg)
   HSTRACE("FSM: begin_handshake_reply (lguid="PGUIDFMT" rguid="PGUIDFMT") ret=%d\n", PGUID (pp->e.guid), PGUID (proxypp->e.guid), ret);
 
   /* Trace a failed handshake. */
-  if ((ret != DDS_SECURITY_VALIDATION_OK                       ) &&
-      (ret != DDS_SECURITY_VALIDATION_OK_FINAL_MESSAGE         ) &&
-      (ret != DDS_SECURITY_VALIDATION_PENDING_RETRY            ) &&
-      (ret != DDS_SECURITY_VALIDATION_PENDING_HANDSHAKE_MESSAGE))
+  if (ret != DDS_SECURITY_VALIDATION_OK
+      && ret != DDS_SECURITY_VALIDATION_OK_FINAL_MESSAGE
+      && ret != DDS_SECURITY_VALIDATION_PENDING_RETRY
+      && ret != DDS_SECURITY_VALIDATION_PENDING_HANDSHAKE_MESSAGE)
   {
     HSEXCEPTION(&exception, "Begin handshake reply failed");
-    ret = DDS_SECURITY_VALIDATION_FAILED;
     goto handshake_failed;
   }
 
-  if (ret == DDS_SECURITY_VALIDATION_PENDING_HANDSHAKE_MESSAGE) {
-    if (!send_handshake_message(handshake, handshake->handshake_message_out, pp, proxypp, 0)) {
-      ret = DDS_SECURITY_VALIDATION_FAILED;
+  if (ret == DDS_SECURITY_VALIDATION_PENDING_HANDSHAKE_MESSAGE)
+  {
+    if (!send_handshake_message(handshake, handshake->handshake_message_out, pp, proxypp, 0))
       goto handshake_failed;
-    }
   }
   else if (ret == DDS_SECURITY_VALIDATION_OK_FINAL_MESSAGE)
   {
     if (send_handshake_message(handshake, handshake->handshake_message_out, pp, proxypp, 0))
       ret = DDS_SECURITY_VALIDATION_OK;
     else
-    {
-      ret = DDS_SECURITY_VALIDATION_FAILED;
       goto handshake_failed;
-    }
   }
 
   if (ret == DDS_SECURITY_VALIDATION_OK)
@@ -665,18 +674,61 @@ static void func_begin_handshake_reply(struct dds_security_fsm *fsm, void *arg)
     if (handshake->shared_secret == DDS_SECURITY_HANDLE_NIL)
     {
       HSEXCEPTION(&exception, "Getting shared secret failed");
-      ret = DDS_SECURITY_VALIDATION_FAILED;
       goto handshake_failed;
     }
   }
-
-  dds_security_fsm_dispatch(fsm, (int32_t)ret, true);
-  return;
+  return ret;
 
 handshake_failed:
   DDS_Security_DataHolder_free(handshake->handshake_message_out);
   handshake->handshake_message_out = NULL;
-  /* Use return value as state machine event. */
+  return DDS_SECURITY_VALIDATION_FAILED;
+}
+
+static void func_begin_handshake_reply(struct dds_security_fsm *fsm, void *arg)
+{
+  DDS_Security_ValidationResult_t ret;
+  struct ddsi_handshake *handshake = arg;
+  dds_security_authentication *auth = handshake->auth;
+  struct participant *pp;
+  struct proxy_participant *proxypp;
+
+  if (!validate_handshake(handshake, &pp, &proxypp))
+     return;
+
+  TRACE_FUNC(fsm);
+
+  ret = begin_handshake_reply_impl(handshake, auth, pp, proxypp);
+  dds_security_fsm_dispatch(fsm, (int32_t)ret, true);
+}
+
+static void func_validate_remote_and_begin_reply(struct dds_security_fsm *fsm, void *arg)
+{
+  DDS_Security_ValidationResult_t ret;
+  struct ddsi_handshake *handshake = arg;
+  dds_security_authentication *auth = handshake->auth;
+  struct participant *pp;
+  struct proxy_participant *proxypp;
+
+  if (!validate_handshake(handshake, &pp, &proxypp))
+    return;
+
+  TRACE_FUNC(fsm);
+
+  ret = validate_remote_identity_impl(handshake, auth, pp, proxypp);
+  /* In the only path to this state an auth_request is received so the result
+     of validate_remote_identity should be PENDING_HANDSHAKE_MESSAGE, or failed
+     in case of an error. */
+  if (ret != DDS_SECURITY_VALIDATION_FAILED)
+  {
+    if (ret != DDS_SECURITY_VALIDATION_PENDING_HANDSHAKE_MESSAGE)
+    {
+      HSWARNING("func_validate_remote_and_begin_reply: invalid result %d from validate_remote_identity", ret);
+      ret = DDS_SECURITY_VALIDATION_FAILED;
+    }
+    else
+      ret = begin_handshake_reply_impl(handshake, auth, pp, proxypp);
+  }
   dds_security_fsm_dispatch(fsm, (int32_t)ret, true);
 }
 

From 829e33ac82a1b064fa67e730e277046fe5b21ea2 Mon Sep 17 00:00:00 2001
From: Dennis Potman <dennis.potman@adlinktech.com>
Date: Tue, 7 Apr 2020 13:05:06 +0200
Subject: [PATCH 155/238] Remove unused field from struct ddsi_handshake

Signed-off-by: Dennis Potman <dennis.potman@adlinktech.com>
---
 src/core/ddsi/src/ddsi_handshake.c | 2 --
 1 file changed, 2 deletions(-)

diff --git a/src/core/ddsi/src/ddsi_handshake.c b/src/core/ddsi/src/ddsi_handshake.c
index 7040450..72da225 100644
--- a/src/core/ddsi/src/ddsi_handshake.c
+++ b/src/core/ddsi/src/ddsi_handshake.c
@@ -91,7 +91,6 @@ struct ddsi_handshake
   DDS_Security_AuthRequestMessageToken *remote_auth_request_token;
   DDS_Security_OctetSeq pdata;
   int64_t shared_secret;
-  int handled_handshake_message;
 };
 
 struct ddsi_hsadmin {
@@ -1139,7 +1138,6 @@ void ddsi_handshake_handle_message(struct ddsi_handshake *handshake, const struc
     DDS_Security_DataHolder_deinit(&handshake->handshake_message_in_token);
     q_omg_security_dataholder_copyout(&handshake->handshake_message_in_token, &msg->message_data.tags[0]);
     memcpy(&handshake->handshake_message_in_id, &msg->message_identity, sizeof(handshake->handshake_message_in_id));
-    handshake->handled_handshake_message = 0;
     dds_security_fsm_dispatch(handshake->fsm, event, false);
     ddsrt_mutex_unlock(&handshake->lock);
   }

From 534eac2a11f58aff0e670e189b6aebc1adb0a32a Mon Sep 17 00:00:00 2001
From: Marcel Jordense <marcel.jordense@adlinktech.com>
Date: Fri, 3 Apr 2020 13:42:16 +0200
Subject: [PATCH 156/238] Remove temporarily stored crypto handles and tokens
 after entities are matched

Signed-off-by: Marcel Jordense <marcel.jordense@adlinktech.com>
---
 .../ddsi/include/dds/ddsi/ddsi_domaingv.h     |   1 -
 .../ddsi/include/dds/ddsi/ddsi_security_omg.h |  61 +-
 src/core/ddsi/src/ddsi_security_omg.c         | 646 ++++++++++--------
 src/core/ddsi/src/q_entity.c                  |   6 +
 src/core/ddsi/src/q_init.c                    |  15 +-
 5 files changed, 439 insertions(+), 290 deletions(-)

diff --git a/src/core/ddsi/include/dds/ddsi/ddsi_domaingv.h b/src/core/ddsi/include/dds/ddsi/ddsi_domaingv.h
index 0deb8ea..68f040e 100644
--- a/src/core/ddsi/include/dds/ddsi/ddsi_domaingv.h
+++ b/src/core/ddsi/include/dds/ddsi/ddsi_domaingv.h
@@ -329,7 +329,6 @@ struct ddsi_domaingv {
   /* security globals */
 #ifdef DDSI_INCLUDE_SECURITY
   struct dds_security_context *security_context;
-  struct dds_security_match_index *security_matches;
   struct ddsi_hsadmin *hsadmin;
 #endif
 
diff --git a/src/core/ddsi/include/dds/ddsi/ddsi_security_omg.h b/src/core/ddsi/include/dds/ddsi/ddsi_security_omg.h
index 6d5efcb..ff81274 100644
--- a/src/core/ddsi/include/dds/ddsi/ddsi_security_omg.h
+++ b/src/core/ddsi/include/dds/ddsi/ddsi_security_omg.h
@@ -55,24 +55,10 @@ typedef struct nn_msg_sec_info {
   int64_t dst_pp_handle;
 } nn_msg_sec_info_t;
 
-struct guid_pair {
-  ddsi_guid_t src;
-  ddsi_guid_t dst;
-};
 
-struct security_entity_match {
-  ddsrt_avl_node_t avlnode;
-  struct guid_pair guids;
-  bool matched;
-  bool tokens_sent;
-  int64_t crypto_handle;
-  DDS_Security_ParticipantCryptoTokenSeq *tokens;
-};
 
-struct dds_security_match_index {
-  ddsrt_mutex_t lock;
-  ddsrt_avl_tree_t matches;
-};
+
+
 
 struct pp_proxypp_match {
   ddsrt_avl_node_t avlnode;
@@ -718,6 +704,36 @@ void q_omg_security_deregister_remote_writer_match(const struct ddsi_domaingv *g
  */
 void q_omg_security_set_remote_writer_crypto_tokens(struct reader *rd, const ddsi_guid_t *pwr_guid, const nn_dataholderseq_t *tokens);
 
+/**
+ * @brief Release all the security resources associated with the remote writer.
+ *
+ * Cleanup security resource associated with the remote writer.
+ *
+ * @param[in] pwr       The remote writer.
+ */
+void q_omg_security_deregister_remote_writer(const struct proxy_writer *pwr);
+
+/**
+ * @brief Set security information, depending on plist and proxy participant,
+ * into the given proxy reader.
+ *
+ * @param[in] prd      Proxy reader to set security info on.
+ * @param[in] plist    Paramater list, possibly contains security info.
+ */
+void set_proxy_reader_security_info(struct proxy_reader *prd, const ddsi_plist_t *plist);
+
+/**
+ * @brief Determine the security settings associated with the remote reader.
+ *
+ * From the security information contained in the parameter list from the remote reader
+ * the corresponding security settings are determined and returned in the info parameter.
+ *
+ * @param[in] prd       The remote reader.
+ * @param[in] plist     The parameter list from the remote reader.
+ * @param[out] info     The security settings associated with the remote reader.
+ */
+void q_omg_get_proxy_reader_security_info(struct proxy_reader *prd, const ddsi_plist_t *plist, nn_security_info_t *info);
+
 /**
  * @brief Check if the reader has the is_discovery_protected flag set
  *
@@ -820,6 +836,15 @@ void q_omg_security_deregister_remote_reader_match(const struct ddsi_domaingv *g
  */
 void q_omg_security_set_remote_reader_crypto_tokens(struct writer *wr, const ddsi_guid_t *prd_guid, const nn_dataholderseq_t *tokens);
 
+/**
+ * @brief Release all the security resources associated with the remote reader.
+ *
+ * Cleanup security resource associated with the remote reader.
+ *
+ * @param[in] prd       The remote reader.
+ */
+void q_omg_security_deregister_remote_reader(const struct proxy_reader *prd);
+
 /**
  * @brief Encode RTPS message.
  *
@@ -1074,7 +1099,9 @@ void q_omg_security_init( struct ddsi_domaingv *gv );
 
 void q_omg_security_stop (struct ddsi_domaingv *gv);
 
-void q_omg_security_deinit( struct ddsi_domaingv *gv );
+void q_omg_security_deinit (struct dds_security_context *sc );
+
+void q_omg_security_free (struct ddsi_domaingv *gv);
 
 bool q_omg_is_security_loaded(  struct dds_security_context *sc );
 
diff --git a/src/core/ddsi/src/ddsi_security_omg.c b/src/core/ddsi/src/ddsi_security_omg.c
index 0fc64d1..057cdf4 100644
--- a/src/core/ddsi/src/ddsi_security_omg.c
+++ b/src/core/ddsi/src/ddsi_security_omg.c
@@ -48,6 +48,11 @@
 #define AC_NAME "Access Control"
 #define CRYPTO_NAME "Cryptographic"
 
+/* TODO: This constant which determines the time pending matches are maintained
+ * and not used should be made a configurable parameter,
+ */
+#define PENDING_MATCH_EXPIRY_TIME 300
+
 #define EXCEPTION_LOG(sc,e,cat, ...) \
   q_omg_log_exception(sc->logcfg, cat, e, __FILE__, __LINE__, DDS_FUNCTION, __VA_ARGS__)
 
@@ -157,6 +162,43 @@ struct participant_sec_index {
   ddsrt_avl_ctree_t participants;
 };
 
+/* The pending _match_index uses an avl tree to store pending_match's where the
+ * guid_pair is used as the key. The remote_guid is the primary key and
+ * the local_guid is the secondary key. The use of the remote_guid as the primary key
+ * is used in the function clear_pending_matches_by_remote_guid to clear the
+ * pending matches associated with a remote entity.
+ *
+ * The table containing the pending matches is protected by the pending_match_index:lock.
+ * It is allowed to access the fields (crypto_handle and tokens) of a pending_match outside
+ * the pending_match_index:lock provided that the pending_match is protected by the
+ * lock of the entity corresponding to the local_guid.
+ * A pending_match is either created when registering and matching an remote entity and
+ * the corresponding crypto tokens are not available or when the crypto tokens associated
+ * with a remote entity are received but it has not yet been discovered.
+ */
+struct guid_pair {
+  ddsi_guid_t remote_guid;
+  ddsi_guid_t local_guid;
+};
+
+struct pending_match {
+  ddsrt_avl_node_t avlnode;
+  ddsrt_fibheap_node_t heapnode;
+  struct guid_pair guids;
+  enum entity_kind kind;
+  int64_t crypto_handle;
+  DDS_Security_ParticipantCryptoTokenSeq *tokens;
+  ddsrt_mtime_t expiry;
+};
+
+struct pending_match_index {
+  ddsrt_mutex_t lock;
+  const struct ddsi_domaingv *gv;
+  ddsrt_avl_tree_t pending_matches;
+  ddsrt_fibheap_t expiry_timers;
+  struct xevent *evt;
+};
+
 struct dds_security_context {
   dds_security_plugin auth_plugin;
   dds_security_plugin ac_plugin;
@@ -168,6 +210,7 @@ struct dds_security_context {
   ddsrt_mutex_t omg_security_lock;
   uint32_t next_plugin_id;
 
+  struct pending_match_index security_matches;
   struct participant_sec_index partiticpant_index;
 
   const struct ddsrt_log_cfg *logcfg;
@@ -178,15 +221,20 @@ typedef struct dds_security_context dds_security_context;
 static int compare_guid(const void *va, const void *vb);
 static int compare_crypto_handle (const void *va, const void *vb);
 static int compare_guid_pair(const void *va, const void *vb);
+static int compare_pending_match_exptime (const void *va, const void *vb);
+
 
 const ddsrt_avl_ctreedef_t pp_proxypp_treedef =
     DDSRT_AVL_CTREEDEF_INITIALIZER (offsetof (struct pp_proxypp_match, avlnode), offsetof (struct pp_proxypp_match, proxypp_guid), compare_guid, 0);
 const ddsrt_avl_treedef_t proxypp_pp_treedef =
   DDSRT_AVL_TREEDEF_INITIALIZER (offsetof (struct proxypp_pp_match, avlnode), offsetof (struct proxypp_pp_match, pp_crypto_handle), compare_crypto_handle, 0);
-const ddsrt_avl_treedef_t entity_match_treedef =
-  DDSRT_AVL_TREEDEF_INITIALIZER (offsetof (struct security_entity_match, avlnode), offsetof (struct security_entity_match, guids), compare_guid_pair, 0);
 const ddsrt_avl_ctreedef_t participant_index_treedef =
     DDSRT_AVL_CTREEDEF_INITIALIZER (offsetof (struct participant_sec_attributes, avlnode), offsetof (struct participant_sec_attributes, crypto_handle), compare_crypto_handle, 0);
+const ddsrt_avl_treedef_t pending_match_index_treedef =
+  DDSRT_AVL_TREEDEF_INITIALIZER (offsetof (struct pending_match, avlnode), offsetof (struct pending_match, guids), compare_guid_pair, 0);
+
+const ddsrt_fibheap_def_t pending_match_expiry_fhdef = DDSRT_FIBHEAPDEF_INITIALIZER(offsetof (struct pending_match, heapnode), compare_pending_match_exptime);
+
 
 static int compare_crypto_handle (const void *va, const void *vb)
 {
@@ -211,15 +259,22 @@ static int compare_guid(const void *va, const void *vb)
 
 static int compare_guid_pair(const void *va, const void *vb)
 {
-  const struct guid_pair *na = va;
-  const struct guid_pair *nb = vb;
+  const struct guid_pair *gpa = va;
+  const struct guid_pair *gpb = vb;
   int r;
 
-  if ((r = guid_compare(&na->src, &nb->src)) == 0)
-    r = guid_compare(&na->dst, &nb->dst);
+  if ((r = guid_compare(&gpa->remote_guid, &gpb->remote_guid)) == 0)
+    r = guid_compare(&gpa->local_guid, &gpb->local_guid);
   return r;
 }
 
+static int compare_pending_match_exptime (const void *va, const void *vb)
+{
+  const struct pending_match *ma = va;
+  const struct pending_match *mb = vb;
+  return (ma->expiry.v == mb->expiry.v) ? 0 : (ma->expiry.v < mb->expiry.v) ? -1 : 1;
+}
+
 static struct dds_security_context * q_omg_security_get_secure_context(const struct participant *pp)
 {
   if (pp && pp->e.gv->security_context && q_omg_is_security_loaded(pp->e.gv->security_context))
@@ -258,97 +313,164 @@ void q_omg_log_exception(const struct ddsrt_log_cfg *lc, uint32_t cat, DDS_Secur
   DDS_Security_Exception_reset(exception);
 }
 
-static struct security_entity_match * entity_match_new(const ddsi_guid_t *src, const ddsi_guid_t *dst)
+static void free_pending_match(struct pending_match *match)
 {
-  struct security_entity_match *match;
-
-  match = ddsrt_malloc(sizeof(*match));
-  match->guids.src = *src;
-  match->guids.dst = *dst;
-  match->matched = false;
-  match->crypto_handle = 0;
-  match->tokens = NULL;
-
-  return match;
-}
-
-static void entity_match_free(struct security_entity_match *match)
-{
-  if (match) {
-    if (match->tokens)
-      DDS_Security_ParticipantCryptoTokenSeq_free(match->tokens);
+  if (match)
+  {
+    DDS_Security_ParticipantCryptoTokenSeq_free(match->tokens);
     ddsrt_free(match);
   }
 }
 
-static struct security_entity_match * find_entity_match_locked(struct dds_security_match_index *list, const ddsi_guid_t *src, const ddsi_guid_t *dst)
+static void pending_match_expiry_cb(struct xevent *xev, void *varg, ddsrt_mtime_t tnow);
+
+static struct pending_match * find_or_create_pending_entity_match(struct pending_match_index *index, enum entity_kind kind, const ddsi_guid_t *remote_guid, const ddsi_guid_t *local_guid, int64_t crypto_handle, DDS_Security_ParticipantCryptoTokenSeq *tokens)
 {
-  struct guid_pair guids;
+  struct guid_pair guids = { .remote_guid = *remote_guid, .local_guid = *local_guid};
+  struct pending_match *match;
+  ddsrt_avl_ipath_t ipath;
 
-  guids.src = *src;
-  guids.dst = *dst;
-
-  return ddsrt_avl_lookup(&entity_match_treedef, &list->matches, &guids);
-}
-
-static struct security_entity_match * find_or_create_entity_match(struct dds_security_match_index *list, const ddsi_guid_t *src, const ddsi_guid_t *dst)
-{
-  struct security_entity_match *match;
-
-  ddsrt_mutex_lock(&list->lock);
-  match = find_entity_match_locked(list, src, dst);
-  if (!match)
+  ddsrt_mutex_lock(&index->lock);
+  if ((match = ddsrt_avl_lookup_ipath(&pending_match_index_treedef, &index->pending_matches, &guids, &ipath)) == NULL)
   {
-    match = entity_match_new(src, dst);
-    ddsrt_avl_insert(&entity_match_treedef, &list->matches, match);
+    match = ddsrt_malloc(sizeof(*match));
+    match->crypto_handle = 0;
+    match->tokens = NULL;
+    match->guids = guids;
+    match->kind = kind;
+    match->expiry = DDSRT_MTIME_NEVER;
+    ddsrt_avl_insert_ipath(&pending_match_index_treedef, &index->pending_matches, match, &ipath);
   }
-  ddsrt_mutex_unlock(&list->lock);
+
+  if (crypto_handle)
+    match->crypto_handle = crypto_handle;
+
+  if (tokens)
+  {
+    match->tokens = tokens;
+    match->expiry = ddsrt_mtime_add_duration(ddsrt_time_monotonic(), DDS_SECS(PENDING_MATCH_EXPIRY_TIME));
+    ddsrt_fibheap_insert(&pending_match_expiry_fhdef, &index->expiry_timers, match);
+    (void)resched_xevent_if_earlier(index->evt, match->expiry);
+  }
+  ddsrt_mutex_unlock(&index->lock);
 
   return match;
 }
 
-static struct security_entity_match * remove_entity_match(struct dds_security_match_index *list, const ddsi_guid_t *src, const ddsi_guid_t *dst)
+static void unregister_and_free_pending_match(dds_security_context *sc, struct pending_match *match)
 {
-  struct security_entity_match *match;
-  struct guid_pair guids;
-  ddsrt_avl_dpath_t path;
+  if (match->crypto_handle != 0)
+  {
+    DDS_Security_SecurityException exception = DDS_SECURITY_EXCEPTION_INIT;
+    const char *ename;
+    bool r = true;
 
-  guids.src = *src;
-  guids.dst = *dst;
+    switch (match->kind)
+    {
+    case EK_PROXY_PARTICIPANT:
+      break;
+    case EK_PROXY_READER:
+      ename = "reader";
+      r = sc->crypto_context->crypto_key_factory->unregister_datareader(sc->crypto_context->crypto_key_factory, match->crypto_handle, &exception);
+      break;
+    case EK_PROXY_WRITER:
+      ename = "writer";
+      r = sc->crypto_context->crypto_key_factory->unregister_datawriter(sc->crypto_context->crypto_key_factory, match->crypto_handle, &exception);
+      break;
+    default:
+      assert(0);
+      break;
+    }
+    if (!r)
+      EXCEPTION_ERROR(sc, &exception, "Failed to unregister remote %s crypto "PGUIDFMT" related to "PGUIDFMT, ename, PGUID(match->guids.remote_guid), PGUID(match->guids.local_guid));
+  }
+  free_pending_match(match);
+}
 
-  ddsrt_mutex_lock(&list->lock);
-  match = ddsrt_avl_lookup_dpath(&entity_match_treedef, &list->matches, &guids, &path);
+static void delete_pending_match(struct pending_match_index *index, struct pending_match *match)
+{
+  ddsrt_mutex_lock(&index->lock);
+  ddsrt_avl_delete(&pending_match_index_treedef, &index->pending_matches, match);
+  if (match->expiry.v != DDS_NEVER)
+    ddsrt_fibheap_delete(&pending_match_expiry_fhdef, &index->expiry_timers, match);
+  free_pending_match(match);
+  ddsrt_mutex_unlock(&index->lock);
+}
+
+static void pending_match_expiry_cb(struct xevent *xev, void *varg, ddsrt_mtime_t tnow)
+{
+  struct pending_match_index *index = varg;
+
+  ddsrt_mutex_lock(&index->lock);
+  struct pending_match *match = ddsrt_fibheap_min(&pending_match_expiry_fhdef, &index->expiry_timers);
+  while (match && match->expiry.v <= tnow.v)
+  {
+    ddsrt_fibheap_delete(&pending_match_expiry_fhdef, &index->expiry_timers, match);
+    ddsrt_avl_delete(&pending_match_index_treedef, &index->pending_matches, match);
+    unregister_and_free_pending_match(index->gv->security_context, match);
+    match = ddsrt_fibheap_min(&pending_match_expiry_fhdef, &index->expiry_timers);
+  }
   if (match)
-    ddsrt_avl_delete_dpath(&entity_match_treedef, &list->matches, match, &path);
-  ddsrt_mutex_unlock(&list->lock);
-
-  return match;
+    resched_xevent_if_earlier(xev, match->expiry);
+  ddsrt_mutex_unlock(&index->lock);
 }
 
-static struct dds_security_match_index * security_match_index_new(void)
+static void clear_pending_matches_by_local_guid(dds_security_context *sc, struct pending_match_index *index, const ddsi_guid_t *local_guid)
 {
-  struct dds_security_match_index *list;
+  struct pending_match *match;
 
-  list  = ddsrt_malloc (sizeof(*list));
-  ddsrt_mutex_init (&list->lock);
-  ddsrt_avl_init (&entity_match_treedef, &list->matches);
-  return list;
-}
-
-static void entity_match_free_wrapper(void *arg)
-{
-  struct security_entity_match *match = arg;
-  entity_match_free(match);
-}
-
-static void security_match_index_free(struct dds_security_match_index *list)
-{
-  if (list)
+  ddsrt_mutex_lock(&index->lock);
+  match = ddsrt_avl_find_min(&pending_match_index_treedef, &index->pending_matches);
+  while (match)
   {
-    ddsrt_avl_free (&entity_match_treedef, &list->matches, entity_match_free_wrapper);
-    ddsrt_mutex_destroy(&list->lock);
-    ddsrt_free(list);
+    struct pending_match *next = ddsrt_avl_find_succ(&pending_match_index_treedef, &index->pending_matches, match);
+    if (guid_compare(&match->guids.local_guid, local_guid) == 0)
+    {
+      ddsrt_avl_delete(&pending_match_index_treedef, &index->pending_matches, match);
+      if (match->expiry.v != DDS_NEVER)
+        ddsrt_fibheap_delete(&pending_match_expiry_fhdef, &index->expiry_timers, match);
+      next = ddsrt_avl_lookup_succ(&pending_match_index_treedef, &index->pending_matches, &match->guids);
+      unregister_and_free_pending_match(sc, match);
+    }
+    match = next;
   }
+  ddsrt_mutex_unlock(&index->lock);
+}
+
+static void clear_pending_matches_by_remote_guid(dds_security_context *sc, struct pending_match_index *index, const ddsi_guid_t *remote_guid)
+{
+  struct guid_pair template = { .remote_guid = *remote_guid, .local_guid = {.prefix.u = {0, 0, 0}, .entityid.u = 0} };
+  struct pending_match *match;
+
+  ddsrt_mutex_lock(&index->lock);
+  match = ddsrt_avl_lookup_succ(&pending_match_index_treedef, &index->pending_matches, &template);
+  while (match && guid_compare(&match->guids.remote_guid, remote_guid) == 0)
+  {
+    struct pending_match *next = ddsrt_avl_lookup_succ(&pending_match_index_treedef, &index->pending_matches, &match->guids);
+    ddsrt_avl_delete(&pending_match_index_treedef, &index->pending_matches, match);
+    if (match->expiry.v != DDS_NEVER)
+      ddsrt_fibheap_delete(&pending_match_expiry_fhdef, &index->expiry_timers, match);
+    unregister_and_free_pending_match(sc, match);
+    match = next;
+  }
+  ddsrt_mutex_unlock(&index->lock);
+}
+
+static void pending_match_index_init(const struct ddsi_domaingv *gv, struct pending_match_index *index)
+{
+  ddsrt_mutex_init(&index->lock);
+  ddsrt_avl_init(&pending_match_index_treedef, &index->pending_matches);
+  ddsrt_fibheap_init(&pending_match_expiry_fhdef, &index->expiry_timers);
+  index->gv = gv;
+  index->evt = qxev_callback(gv->xevents, DDSRT_MTIME_NEVER, pending_match_expiry_cb, index);;
+}
+
+static void pending_match_index_deinit(struct pending_match_index *index)
+{
+  delete_xevent_callback(index->evt);
+  ddsrt_mutex_destroy(&index->lock);
+  assert(ddsrt_avl_is_empty(&index->pending_matches));
+  ddsrt_avl_free(&pending_match_index_treedef, &index->pending_matches, 0);
 }
 
 static struct pp_proxypp_match * pp_proxypp_match_new(struct proxy_participant *proxypp, DDS_Security_ParticipantCryptoHandle proxypp_crypto_handle)
@@ -420,16 +542,12 @@ static void pp_proxypp_unrelate(struct dds_security_context *sc, struct particip
 
 static void proxypp_pp_unrelate(struct dds_security_context *sc, struct proxy_participant *proxypp, const ddsi_guid_t *pp_guid, int64_t pp_crypto_handle)
 {
+  DDSRT_UNUSED_ARG(pp_guid);
   if (proxypp->sec_attr)
   {
     struct proxypp_pp_match *pm;
-    struct security_entity_match *match;
     ddsrt_avl_dpath_t dpath;
 
-    match = remove_entity_match(proxypp->e.gv->security_matches, &proxypp->e.guid, pp_guid);
-    if (match)
-      entity_match_free(match);
-
     ddsrt_mutex_lock(&proxypp->sec_attr->lock);
     if ((pm = ddsrt_avl_lookup_dpath(&proxypp_pp_treedef, &proxypp->sec_attr->participants, &pp_crypto_handle, &dpath)) != NULL)
     {
@@ -594,12 +712,12 @@ void q_omg_security_init (struct ddsi_domaingv *gv)
 
   ddsrt_mutex_init(&sc->partiticpant_index.lock);
   ddsrt_avl_cinit(&participant_index_treedef, &sc->partiticpant_index.participants);
+  pending_match_index_init(gv, &sc->security_matches);
 
   ddsrt_mutex_init (&sc->omg_security_lock);
   sc->logcfg = &gv->logconfig;
 
   gv->security_context = sc;
-  gv->security_matches = security_match_index_new();
 
   ddsi_handshake_admin_init(gv);
 }
@@ -628,27 +746,24 @@ void q_omg_security_stop (struct ddsi_domaingv *gv)
   ddsi_handshake_admin_stop(gv);
 }
 
-void q_omg_security_deinit (struct ddsi_domaingv *gv)
+void q_omg_security_deinit (struct dds_security_context *sc)
+{
+  pending_match_index_deinit(&sc->security_matches);
+}
+
+void q_omg_security_free (struct ddsi_domaingv *gv)
 {
   dds_security_context *sc = gv->security_context;
 
-  assert (gv->security_context != NULL);
-
   ddsrt_avl_cfree(&participant_index_treedef, &sc->partiticpant_index.participants, 0);
   ddsrt_mutex_destroy(&sc->partiticpant_index.lock);
 
-  if (gv->security_context->authentication_context != NULL && gv->security_context->access_control_context != NULL && gv->security_context->crypto_context != NULL){
-    release_plugins (gv->security_context);
+  if (sc->authentication_context != NULL && sc->access_control_context != NULL && sc->crypto_context != NULL){
+    release_plugins (sc);
   }
-
   ddsi_handshake_admin_deinit(gv);
-
-  security_match_index_free(gv->security_matches);
-  gv->security_matches = NULL;
-
-  ddsrt_mutex_destroy (&gv->security_context->omg_security_lock);
-
-  ddsrt_free(gv->security_context);
+  ddsrt_mutex_destroy (&sc->omg_security_lock);
+  ddsrt_free(sc);
   gv->security_context = NULL;
 }
 
@@ -1018,6 +1133,8 @@ void q_omg_security_deregister_participant(struct participant *pp)
     qxev_nt_callback(pp->e.gv->xevents, cleanup_participant_sec_attributes, arg);
   }
 
+  clear_pending_matches_by_local_guid(sc, &sc->security_matches, &pp->e.guid);
+
   pp->sec_attr = NULL;
 }
 
@@ -1270,6 +1387,8 @@ void q_omg_security_deregister_writer(struct writer *wr)
 
   if (wr->sec_attr)
   {
+    clear_pending_matches_by_local_guid(sc, &sc->security_matches, &wr->e.guid);
+
     if (wr->sec_attr->crypto_handle != DDS_SECURITY_HANDLE_NIL)
     {
       if (!sc->crypto_context->crypto_key_factory->unregister_datawriter(sc->crypto_context->crypto_key_factory, wr->sec_attr->crypto_handle, &exception))
@@ -1388,6 +1507,9 @@ void q_omg_security_deregister_reader(struct reader *rd)
   if (rd->sec_attr)
   {
     assert(sc);
+
+    clear_pending_matches_by_local_guid(sc, &sc->security_matches, &rd->e.guid);
+
     if (rd->sec_attr->crypto_handle != DDS_SECURITY_HANDLE_NIL)
     {
       if (!sc->crypto_context->crypto_key_factory->unregister_datareader(sc->crypto_context->crypto_key_factory, rd->sec_attr->crypto_handle, &exception))
@@ -1648,29 +1770,19 @@ bool q_omg_security_register_remote_participant(struct participant *pp, struct p
   GVTRACE("match pp->crypto=%"PRId64" proxypp->crypto=%"PRId64" permissions=%"PRId64"\n", pp->sec_attr->crypto_handle, crypto_handle, permissions_handle);
   match_proxypp_pp(pp, proxypp, permissions_handle, shared_secret);
 
-  GVTRACE("create proxypp-pp match pp="PGUIDFMT" proxypp="PGUIDFMT" lidh=%"PRId64, PGUID(pp->e.guid), PGUID(proxypp->e.guid), pp->sec_attr->local_identity_handle);
+  GVTRACE(" create proxypp-pp match pp="PGUIDFMT" proxypp="PGUIDFMT" lidh=%"PRId64"\n", PGUID(pp->e.guid), PGUID(proxypp->e.guid), pp->sec_attr->local_identity_handle);
 
   if (proxypp_is_rtps_protected(proxypp))
   {
-    struct security_entity_match *m = find_or_create_entity_match(gv->security_matches, &proxypp->e.guid, &pp->e.guid);
-    m->crypto_handle = crypto_handle;
-    if (m->tokens)
+    struct pending_match *match = find_or_create_pending_entity_match(&sc->security_matches, EK_PROXY_PARTICIPANT, &proxypp->e.guid, &pp->e.guid, crypto_handle, NULL);
+    if (match->tokens)
     {
-      ret = sc->crypto_context->crypto_key_exchange->set_remote_participant_crypto_tokens(sc->crypto_context->crypto_key_exchange, pp->sec_attr->crypto_handle, crypto_handle, m->tokens, &exception);
-      if (ret)
-      {
-        struct security_entity_match *mx;
-        mx = remove_entity_match(proxypp->e.gv->security_matches, &proxypp->e.guid, &pp->e.guid);
-        assert(mx == m);
-        (void)mx;
-        entity_match_free(m);
-        GVTRACE("set participant tokens src("PGUIDFMT") to dst("PGUIDFMT") (by registering remote)\n", PGUID(proxypp->e.guid), PGUID(pp->e.guid));
-      }
+      ret = sc->crypto_context->crypto_key_exchange->set_remote_participant_crypto_tokens(sc->crypto_context->crypto_key_exchange, pp->sec_attr->crypto_handle, crypto_handle, match->tokens, &exception);
+      if (!ret)
+        EXCEPTION_ERROR(sc, &exception, " Failed to set remote participant crypto tokens "PGUIDFMT" --> "PGUIDFMT, PGUID(proxypp->e.guid), PGUID(pp->e.guid));
       else
-      {
-        EXCEPTION_ERROR(sc, &exception, "Failed to set remote participant crypto tokens "PGUIDFMT" --> "PGUIDFMT, PGUID(proxypp->e.guid), PGUID(pp->e.guid));
-        ret = false;
-      }
+        GVTRACE(" set participant tokens src("PGUIDFMT") to dst("PGUIDFMT") (by registering remote)\n", PGUID(proxypp->e.guid), PGUID(pp->e.guid));
+      delete_pending_match(&sc->security_matches, match);
     }
     else
       notify_handshake = true;
@@ -1738,6 +1850,8 @@ void q_omg_security_deregister_remote_participant(struct proxy_participant *prox
       pm = next;
     }
 
+    clear_pending_matches_by_remote_guid(sc, &sc->security_matches, &proxypp->e.guid);
+
     if (proxypp->sec_attr->crypto_handle != DDS_SECURITY_HANDLE_NIL)
     {
         if (!sc->crypto_context->crypto_key_factory->unregister_participant(sc->crypto_context->crypto_key_factory, proxypp->sec_attr->crypto_handle, &exception))
@@ -1820,36 +1934,33 @@ void q_omg_security_set_participant_crypto_tokens(struct participant *pp, struct
   DDS_Security_SecurityException exception = DDS_SECURITY_EXCEPTION_INIT;
   struct proxypp_pp_match *pm;
   DDS_Security_DatawriterCryptoTokenSeq *tseq;
-  struct security_entity_match *m;
 
   if (!sc)
     return;
 
+  tseq = DDS_Security_DataHolderSeq_alloc();
+  q_omg_copyin_DataHolderSeq(tseq, tokens);
+
   ddsrt_mutex_lock(&proxypp->sec_attr->lock);
   pm = ddsrt_avl_lookup (&proxypp_pp_treedef, &proxypp->sec_attr->participants, &pp->sec_attr->crypto_handle);
   ddsrt_mutex_unlock(&proxypp->sec_attr->lock);
 
   ddsrt_mutex_lock(&pp->e.lock);
-  m = find_or_create_entity_match(gv->security_matches, &proxypp->e.guid, &pp->e.guid);
-
-  tseq = DDS_Security_DataHolderSeq_alloc();
-  q_omg_copyin_DataHolderSeq(tseq, tokens);
 
   if (!pm)
   {
     GVTRACE("remember participant tokens src("PGUIDFMT") dst("PGUIDFMT")\n", PGUID(proxypp->e.guid), PGUID(pp->e.guid));
-    m->tokens = tseq;
+    (void)find_or_create_pending_entity_match(&sc->security_matches, EK_PROXY_PARTICIPANT, &proxypp->e.guid, &pp->e.guid, 0, tseq);
   }
   else
   {
     if (sc->crypto_context->crypto_key_exchange->set_remote_participant_crypto_tokens(sc->crypto_context->crypto_key_exchange, pp->sec_attr->crypto_handle, proxypp->sec_attr->crypto_handle, tseq, &exception))
     {
-      m->matched= true;
-      GVTRACE("set participant tokens src("PGUIDFMT") dst("PGUIDFMT")\n", PGUID(proxypp->e.guid), PGUID(pp->e.guid));
+      GVTRACE(" set participant tokens src("PGUIDFMT") dst("PGUIDFMT")\n", PGUID(proxypp->e.guid), PGUID(pp->e.guid));
       DDS_Security_DataHolderSeq_free(tseq);
     }
     else
-      EXCEPTION_ERROR(sc, &exception, "Failed to set remote participant crypto tokens "PGUIDFMT" for participant "PGUIDFMT, PGUID(proxypp->e.guid), PGUID(pp->e.guid));
+      EXCEPTION_ERROR(sc, &exception, " Failed to set remote participant crypto tokens "PGUIDFMT" for participant "PGUIDFMT, PGUID(proxypp->e.guid), PGUID(pp->e.guid));
   }
   ddsrt_mutex_unlock(&pp->e.lock);
 
@@ -1986,64 +2097,68 @@ static bool q_omg_security_register_remote_writer_match(struct proxy_writer *pwr
   struct ddsi_domaingv *gv = pp->e.gv;
   struct dds_security_context *sc = q_omg_security_get_secure_context(pp);
   DDS_Security_SecurityException exception = DDS_SECURITY_EXCEPTION_INIT;
-  struct proxypp_pp_match *pm;
-  struct security_entity_match *match;
+  struct proxypp_pp_match *proxypp_match;
+  struct rd_pwr_match *match;
   bool send_tokens = false;
+  bool allowed = false;
 
-  *crypto_handle = 0;
-
-  if ((pm = get_pp_proxypp_match_if_authenticated(pp, proxypp, pwr->e.guid.entityid)) == NULL)
+  if ((proxypp_match = get_pp_proxypp_match_if_authenticated(pp, proxypp, pwr->e.guid.entityid)) == NULL)
     return false;
 
-  /* TODO: the security_entity_match should be removed after the the received tokens are stored in the plugin.
-   * Currently the security_entity_match is also used to detect if a match between a reader and writer has
-   * already been completed.
-   */
   ddsrt_mutex_lock(&rd->e.lock);
-  match = find_or_create_entity_match(gv->security_matches, &pwr->e.guid, &rd->e.guid);
-  if (match->matched)
-    *crypto_handle = match->crypto_handle;
-  else if (match->crypto_handle == 0)
+  if ((match = ddsrt_avl_lookup (&rd_writers_treedef, &rd->writers, &pwr->e.guid)) != NULL)
+    allowed = true;
+  else if (rd->e.guid.entityid.u == NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_VOLATILE_SECURE_READER)
   {
-    /* Generate writer crypto info. */
-    match->crypto_handle = sc->crypto_context->crypto_key_factory->register_matched_remote_datawriter(
-        sc->crypto_context->crypto_key_factory, rd->sec_attr->crypto_handle, proxypp->sec_attr->crypto_handle, pm->shared_secret, &exception);
+    /* The builtin ParticipantVolatileSecure endpoints do not exchange tokens.
+     * Simulate that we already got them. */
 
-    *crypto_handle = match->crypto_handle;
-
-    if (match->crypto_handle == 0)
-      EXCEPTION_ERROR(sc, &exception, "Failed to register remote writer "PGUIDFMT" with reader "PGUIDFMT, PGUID(pwr->e.guid), PGUID(rd->e.guid));
-    else if (rd->e.guid.entityid.u == NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_VOLATILE_SECURE_READER)
+    *crypto_handle = sc->crypto_context->crypto_key_factory->register_matched_remote_datawriter(
+        sc->crypto_context->crypto_key_factory, rd->sec_attr->crypto_handle, proxypp->sec_attr->crypto_handle, proxypp_match->shared_secret, &exception);
+    if (*crypto_handle != 0)
     {
-      /* The builtin ParticipantVolatileSecure endpoints do not exchange tokens.
-       * Simulate that we already got them. */
-      match->matched = true;
-      GVTRACE(" volatile secure reader: proxypp_crypto=%"PRId64" rd_crypto=%"PRId64" pwr_crypto=%"PRId64"\n", proxypp->sec_attr->crypto_handle, rd->sec_attr->crypto_handle, match->crypto_handle);
+      GVTRACE(" volatile secure reader: proxypp_crypto=%"PRId64" rd_crypto=%"PRId64" pwr_crypto=%"PRId64"\n", proxypp->sec_attr->crypto_handle, rd->sec_attr->crypto_handle, *crypto_handle);
+      allowed = true;
     }
     else
+      EXCEPTION_ERROR(sc, &exception, "Failed to register remote writer "PGUIDFMT" with reader "PGUIDFMT, PGUID(pwr->e.guid), PGUID(rd->e.guid));
+  }
+  else
+  {
+    struct pending_match *pending_match = find_or_create_pending_entity_match(&sc->security_matches, EK_PROXY_WRITER, &pwr->e.guid, &rd->e.guid, 0, NULL);
+
+    /* Generate writer crypto info. */
+    if (pending_match->crypto_handle == 0)
     {
-      send_tokens = true;
-      if (match->tokens)
+      *crypto_handle = sc->crypto_context->crypto_key_factory->register_matched_remote_datawriter(
+          sc->crypto_context->crypto_key_factory, rd->sec_attr->crypto_handle, proxypp->sec_attr->crypto_handle, proxypp_match->shared_secret, &exception);
+      if (*crypto_handle == 0)
+        EXCEPTION_ERROR(sc, &exception, "Failed to register remote writer "PGUIDFMT" with reader "PGUIDFMT, PGUID(pwr->e.guid), PGUID(rd->e.guid));
+      else
       {
-        if (sc->crypto_context->crypto_key_exchange->set_remote_datawriter_crypto_tokens(
-            sc->crypto_context->crypto_key_exchange, rd->sec_attr->crypto_handle, match->crypto_handle, match->tokens, &exception))
+        pending_match->crypto_handle = *crypto_handle;
+        send_tokens = true;
+        if (pending_match->tokens)
         {
-          match->matched = true;
-          DDS_Security_DataHolderSeq_free(match->tokens);
-          match->tokens = NULL;
-          GVTRACE("match_remote_writer "PGUIDFMT" with reader "PGUIDFMT": tokens available\n", PGUID(pwr->e.guid), PGUID(rd->e.guid));
+          if (!sc->crypto_context->crypto_key_exchange->set_remote_datawriter_crypto_tokens(
+              sc->crypto_context->crypto_key_exchange, rd->sec_attr->crypto_handle, *crypto_handle, pending_match->tokens, &exception))
+            EXCEPTION_ERROR(sc, &exception, "Failed to set remote writer crypto tokens "PGUIDFMT" --> "PGUIDFMT, PGUID(pwr->e.guid), PGUID(rd->e.guid));
+          else
+          {
+            GVTRACE("match_remote_writer "PGUIDFMT" with reader "PGUIDFMT": tokens available\n", PGUID(pwr->e.guid), PGUID(rd->e.guid));
+            allowed = true;
+          }
+          delete_pending_match(&sc->security_matches, pending_match);
         }
-        else
-          EXCEPTION_ERROR(sc, &exception, "Failed to set remote writer crypto tokens "PGUIDFMT" --> "PGUIDFMT, PGUID(pwr->e.guid), PGUID(rd->e.guid));
       }
     }
   }
   ddsrt_mutex_unlock(&rd->e.lock);
 
   if (send_tokens)
-    (void)send_reader_crypto_tokens(rd, pwr, rd->sec_attr->crypto_handle, match->crypto_handle);
+    (void)send_reader_crypto_tokens(rd, pwr, rd->sec_attr->crypto_handle, *crypto_handle);
 
-  return match->matched;
+  return allowed;
 }
 
 bool q_omg_security_match_remote_writer_enabled(struct reader *rd, struct proxy_writer *pwr, int64_t *crypto_handle)
@@ -2051,6 +2166,8 @@ bool q_omg_security_match_remote_writer_enabled(struct reader *rd, struct proxy_
   struct ddsi_domaingv *gv = rd->e.gv;
   nn_security_info_t info;
 
+  *crypto_handle = 0;
+
   if (!rd->sec_attr)
     return true;
 
@@ -2106,21 +2223,23 @@ void q_omg_security_deregister_remote_writer_match(const struct ddsi_domaingv *g
 {
   struct dds_security_context *sc = gv->security_context;
   DDS_Security_SecurityException exception = DDS_SECURITY_EXCEPTION_INIT;
-  struct security_entity_match *match = NULL;
 
   if (m->crypto_handle != 0)
   {
-    match = remove_entity_match(gv->security_matches, &m->pwr_guid, rd_guid);
-    if (match)
-    {
-      assert(match->crypto_handle == m->crypto_handle);
-      if (!sc->crypto_context->crypto_key_factory->unregister_datawriter(sc->crypto_context->crypto_key_factory, match->crypto_handle, &exception))
-        EXCEPTION_ERROR(sc, &exception, "Failed to unregster remote writer "PGUIDFMT" for reader "PGUIDFMT, PGUID(m->pwr_guid), PGUID(*rd_guid));
-      entity_match_free(match);
-    }
+    if (!sc->crypto_context->crypto_key_factory->unregister_datawriter(sc->crypto_context->crypto_key_factory, m->crypto_handle, &exception))
+      EXCEPTION_ERROR(sc, &exception, "Failed to unregister remote writer "PGUIDFMT" for reader "PGUIDFMT, PGUID(m->pwr_guid), PGUID(*rd_guid));
   }
 }
 
+void q_omg_security_deregister_remote_writer(const struct proxy_writer *pwr)
+{
+  struct ddsi_domaingv *gv = pwr->e.gv;
+  struct dds_security_context *sc = gv->security_context;
+
+  if (q_omg_proxy_participant_is_secure(pwr->c.proxypp))
+    clear_pending_matches_by_remote_guid(sc, &sc->security_matches, &pwr->e.guid);
+}
+
 bool q_omg_security_check_remote_reader_permissions(const struct proxy_reader *prd, uint32_t domain_id, struct participant *pp, bool *relay_only)
 {
   struct ddsi_domaingv *gv = pp->e.gv;
@@ -2260,22 +2379,23 @@ void q_omg_security_deregister_remote_reader_match(const struct ddsi_domaingv *g
 {
   struct dds_security_context *sc = gv->security_context;
   DDS_Security_SecurityException exception = DDS_SECURITY_EXCEPTION_INIT;
-  struct security_entity_match *match = NULL;
 
-  if (m->crypto_handle)
+  if (m->crypto_handle != 0)
   {
-    match = remove_entity_match(gv->security_matches, &m->prd_guid, wr_guid);
-    if (match)
-    {
-      assert(match->crypto_handle == m->crypto_handle);
-
-      if (!sc->crypto_context->crypto_key_factory->unregister_datareader(sc->crypto_context->crypto_key_factory, match->crypto_handle, &exception))
-        EXCEPTION_ERROR(sc, &exception, "Failed to unregister remote reader "PGUIDFMT" for writer "PGUIDFMT, PGUID(m->prd_guid), PGUID(*wr_guid));
-      entity_match_free(match);
-    }
+    if (!sc->crypto_context->crypto_key_factory->unregister_datareader(sc->crypto_context->crypto_key_factory, m->crypto_handle, &exception))
+      EXCEPTION_ERROR(sc, &exception, "Failed to unregister remote reader "PGUIDFMT" for writer "PGUIDFMT, PGUID(m->prd_guid), PGUID(*wr_guid));
   }
 }
 
+void q_omg_security_deregister_remote_reader(const struct proxy_reader *prd)
+{
+  struct ddsi_domaingv *gv = prd->e.gv;
+  struct dds_security_context *sc = gv->security_context;
+
+  if (q_omg_proxy_participant_is_secure(prd->c.proxypp))
+    clear_pending_matches_by_remote_guid(sc, &sc->security_matches, &prd->e.guid);
+}
+
 static void send_writer_crypto_tokens(struct writer *wr, struct proxy_reader *prd, DDS_Security_DatawriterCryptoHandle local_crypto, DDS_Security_DatareaderCryptoHandle remote_crypto)
 {
   struct dds_security_context *sc = q_omg_security_get_secure_context(wr->c.pp);
@@ -2309,66 +2429,70 @@ static bool q_omg_security_register_remote_reader_match(struct proxy_reader *prd
   struct ddsi_domaingv *gv = pp->e.gv;
   struct dds_security_context *sc = q_omg_security_get_secure_context(pp);
   DDS_Security_SecurityException exception = DDS_SECURITY_EXCEPTION_INIT;
-  struct proxypp_pp_match *pm;
-  struct security_entity_match *match;
+  struct proxypp_pp_match *proxypp_match;
+  struct wr_prd_match *match;
   bool send_tokens = false;
+  bool allowed = false;
 
-  *crypto_handle = 0;
-
-  if ((pm = get_pp_proxypp_match_if_authenticated(pp, proxypp, prd->e.guid.entityid)) == NULL)
+  if ((proxypp_match = get_pp_proxypp_match_if_authenticated(pp, proxypp, prd->e.guid.entityid)) == NULL)
     return false;
 
-  /* TODO: the security_entity_match should be removed after the the received tokens are stored in the plugin.
-   * Currently the security_entity_match is also used to detect if a match between a reader and writer has
-   * already been completed.
-   */
   ddsrt_mutex_lock(&wr->e.lock);
-  match = find_or_create_entity_match(gv->security_matches, &prd->e.guid, &wr->e.guid);
-  if (match->matched)
-    *crypto_handle = match->crypto_handle;
-  else if (match->crypto_handle == 0)
+  if ((match = ddsrt_avl_lookup (&wr_readers_treedef, &wr->readers, &prd->e.guid)) != NULL)
+    allowed = true;
+  else if (wr->e.guid.entityid.u == NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_VOLATILE_SECURE_WRITER || !wr->sec_attr->attr.is_submessage_protected)
   {
-    /* Generate writer crypto info. */
-    match->crypto_handle = sc->crypto_context->crypto_key_factory->register_matched_remote_datareader(
-        sc->crypto_context->crypto_key_factory, wr->sec_attr->crypto_handle, proxypp->sec_attr->crypto_handle, pm->shared_secret, relay_only, &exception);
+    /* The builtin ParticipantVolatileSecure endpoints do not exchange tokens.
+     * Simulate that we already got them. */
 
-    *crypto_handle = match->crypto_handle;
-
-    if (match->crypto_handle == 0)
-      EXCEPTION_ERROR(sc, &exception, "Failed to register remote reader "PGUIDFMT" with writer "PGUIDFMT, PGUID(prd->e.guid), PGUID(wr->e.guid));
-    else if (wr->e.guid.entityid.u == NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_VOLATILE_SECURE_WRITER)
+    *crypto_handle = sc->crypto_context->crypto_key_factory->register_matched_remote_datareader(
+        sc->crypto_context->crypto_key_factory, wr->sec_attr->crypto_handle, proxypp->sec_attr->crypto_handle, proxypp_match->shared_secret, relay_only, &exception);
+    if (*crypto_handle != 0)
     {
-      /* The builtin ParticipantVolatileSecure endpoints do not exchange tokens.
-       * Simulate that we already got them. */
-      match->matched = true;
-      GVTRACE(" volatile secure writer: proxypp_crypto=%"PRId64" wr_crypto=%"PRId64" prd_crypto=%"PRId64"\n", proxypp->sec_attr->crypto_handle, wr->sec_attr->crypto_handle, match->crypto_handle);
+      GVTRACE(" match_remote_reader: proxypp_crypto=%"PRId64" wr_crypto=%"PRId64" prd_crypto=%"PRId64"\n", proxypp->sec_attr->crypto_handle, wr->sec_attr->crypto_handle, *crypto_handle);
+      send_tokens = (wr->e.guid.entityid.u != NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_VOLATILE_SECURE_WRITER);
+      allowed = true;
     }
     else
+      EXCEPTION_ERROR(sc, &exception, "Failed to register remote reader "PGUIDFMT" with writer "PGUIDFMT, PGUID(prd->e.guid), PGUID(wr->e.guid));
+  }
+  else
+  {
+    struct pending_match *pending_match = find_or_create_pending_entity_match(&sc->security_matches, EK_PROXY_READER, &prd->e.guid, &wr->e.guid, 0, NULL);
+
+    /* Generate writer crypto info. */
+    if (pending_match->crypto_handle == 0)
     {
-      send_tokens = true;
-      if (match->tokens)
+      *crypto_handle = sc->crypto_context->crypto_key_factory->register_matched_remote_datareader(
+          sc->crypto_context->crypto_key_factory, wr->sec_attr->crypto_handle, proxypp->sec_attr->crypto_handle, proxypp_match->shared_secret, relay_only, &exception);
+      if (*crypto_handle == 0)
+        EXCEPTION_ERROR(sc, &exception, "Failed to register remote reader "PGUIDFMT" with writer "PGUIDFMT, PGUID(prd->e.guid), PGUID(wr->e.guid));
+      else
       {
-        if (sc->crypto_context->crypto_key_exchange->set_remote_datareader_crypto_tokens(
-            sc->crypto_context->crypto_key_exchange, wr->sec_attr->crypto_handle, match->crypto_handle, match->tokens, &exception))
+        pending_match->crypto_handle = *crypto_handle;
+        send_tokens = true;
+        GVTRACE(" register_remote_reader_match: proxypp_crypto=%"PRId64" wr_crypto=%"PRId64" prd_crypto=%"PRId64"\n", proxypp->sec_attr->crypto_handle, wr->sec_attr->crypto_handle, *crypto_handle);
+        if (pending_match->tokens)
         {
-          match->matched = true;
-          DDS_Security_DataHolderSeq_free(match->tokens);
-          match->tokens = NULL;;
-          GVTRACE("match_remote_reader "PGUIDFMT" with writer "PGUIDFMT": tokens available\n", PGUID(prd->e.guid), PGUID(wr->e.guid));
+          if (!sc->crypto_context->crypto_key_exchange->set_remote_datareader_crypto_tokens(
+              sc->crypto_context->crypto_key_exchange, wr->sec_attr->crypto_handle, *crypto_handle, pending_match->tokens, &exception))
+            EXCEPTION_ERROR(sc, &exception, "Failed to set remote reader crypto tokens "PGUIDFMT" --> "PGUIDFMT, PGUID(prd->e.guid), PGUID(wr->e.guid));
+          else
+          {
+            GVTRACE(" match_remote_reader "PGUIDFMT" with writer "PGUIDFMT": tokens available\n", PGUID(prd->e.guid), PGUID(wr->e.guid));
+            allowed = true;
+          }
+          delete_pending_match(&sc->security_matches, pending_match);
         }
-        else
-          EXCEPTION_ERROR(sc, &exception, "Failed to set remote reader crypto tokens "PGUIDFMT" --> "PGUIDFMT, PGUID(prd->e.guid), PGUID(wr->e.guid));
       }
-      else if (!wr->sec_attr->attr.is_submessage_protected)
-        match->matched = true;
     }
   }
   ddsrt_mutex_unlock(&wr->e.lock);
 
   if (send_tokens)
-    (void)send_writer_crypto_tokens(wr, prd, wr->sec_attr->crypto_handle, match->crypto_handle);
+    (void)send_writer_crypto_tokens(wr, prd, wr->sec_attr->crypto_handle, *crypto_handle);
 
-  return match->matched;
+  return allowed;
 }
 
 bool q_omg_security_match_remote_reader_enabled(struct writer *wr, struct proxy_reader *prd, bool relay_only, int64_t *crypto_handle)
@@ -2376,6 +2500,8 @@ bool q_omg_security_match_remote_reader_enabled(struct writer *wr, struct proxy_
   struct ddsi_domaingv *gv = wr->e.gv;
   nn_security_info_t info;
 
+  *crypto_handle = 0;
+
   if (!wr->sec_attr)
     return true;
 
@@ -2432,43 +2558,35 @@ void q_omg_security_set_remote_writer_crypto_tokens(struct reader *rd, const dds
   struct dds_security_context *sc = q_omg_security_get_secure_context(rd->c.pp);
   struct ddsi_domaingv *gv = rd->e.gv;
   DDS_Security_SecurityException exception = DDS_SECURITY_EXCEPTION_INIT;
-  struct security_entity_match *match;
+  struct pending_match *match;
   struct proxy_writer *pwr = NULL;
+  int64_t crypto_handle = 0;
 
   if (!sc)
      return;
 
-  ddsrt_mutex_lock(&rd->e.lock);
-  match = find_or_create_entity_match(gv->security_matches, pwr_guid, &rd->e.guid);
-  if (match->matched)
-  {
-    ddsrt_mutex_unlock(&rd->e.lock);
-    return;
-  }
-
   DDS_Security_DatawriterCryptoTokenSeq * tseq = DDS_Security_DataHolderSeq_alloc();
   q_omg_copyin_DataHolderSeq(tseq, tokens);
 
-  if ((pwr = entidx_lookup_proxy_writer_guid(gv->entity_index, pwr_guid)) == NULL || match->crypto_handle == 0 )
-  {
+  ddsrt_mutex_lock(&rd->e.lock);
+  match = find_or_create_pending_entity_match(&sc->security_matches, EK_PROXY_WRITER, pwr_guid, &rd->e.guid, 0, tseq);
+  if ((pwr = entidx_lookup_proxy_writer_guid(gv->entity_index, pwr_guid)) == NULL || match->crypto_handle == 0)
     GVTRACE("remember writer tokens src("PGUIDFMT") dst("PGUIDFMT")\n", PGUID(*pwr_guid), PGUID(rd->e.guid));
-    match->tokens = tseq;
-  }
   else
   {
-    if (sc->crypto_context->crypto_key_exchange->set_remote_datawriter_crypto_tokens(sc->crypto_context->crypto_key_exchange, rd->sec_attr->crypto_handle, match->crypto_handle, tseq, &exception))
+    if (!sc->crypto_context->crypto_key_exchange->set_remote_datawriter_crypto_tokens(sc->crypto_context->crypto_key_exchange, rd->sec_attr->crypto_handle, match->crypto_handle, tseq, &exception))
+      EXCEPTION_ERROR(sc, &exception, "Failed to set remote writer crypto tokens "PGUIDFMT" for reader "PGUIDFMT, PGUID(pwr->e.guid), PGUID(rd->e.guid));
+    else
     {
       GVTRACE("set_remote_writer_crypto_tokens "PGUIDFMT" with reader "PGUIDFMT"\n", PGUID(pwr->e.guid), PGUID(rd->e.guid));
-      match->matched = true;
+      crypto_handle = match->crypto_handle;
     }
-    else
-      EXCEPTION_ERROR(sc, &exception, "Failed to set remote writer crypto tokens "PGUIDFMT" for reader "PGUIDFMT, PGUID(pwr->e.guid), PGUID(rd->e.guid));
-    DDS_Security_DataHolderSeq_free(tseq);
+    delete_pending_match(&sc->security_matches, match);
   }
   ddsrt_mutex_unlock(&rd->e.lock);
 
-  if (match->matched)
-    connect_reader_with_proxy_writer_secure(rd, pwr, ddsrt_time_monotonic (), match->crypto_handle);
+  if (crypto_handle != 0)
+    connect_reader_with_proxy_writer_secure(rd, pwr, ddsrt_time_monotonic (), crypto_handle);
 
   if (pwr)
     notify_handshake_recv_token(rd->c.pp, pwr->c.proxypp);
@@ -2479,46 +2597,38 @@ void q_omg_security_set_remote_reader_crypto_tokens(struct writer *wr, const dds
   struct dds_security_context *sc = q_omg_security_get_secure_context(wr->c.pp);
   struct ddsi_domaingv *gv = wr->e.gv;
   DDS_Security_SecurityException exception = DDS_SECURITY_EXCEPTION_INIT;
-  struct security_entity_match *match;
+  struct pending_match *match;
   struct proxy_reader *prd = NULL;
+  int64_t crypto_handle = 0;
 
   if (!sc)
-     return;
-
-  ddsrt_mutex_lock(&wr->e.lock);
-  match = find_or_create_entity_match(gv->security_matches, prd_guid, &wr->e.guid);
-  if (match->matched)
-  {
-    ddsrt_mutex_unlock(&wr->e.lock);
     return;
-  }
 
-  DDS_Security_DatawriterCryptoTokenSeq *tseq = DDS_Security_DataHolderSeq_alloc();
-  q_omg_copyin_DataHolderSeq(tseq, tokens);
+   DDS_Security_DatawriterCryptoTokenSeq *tseq = DDS_Security_DataHolderSeq_alloc();
+   q_omg_copyin_DataHolderSeq(tseq, tokens);
 
-  if (((prd = entidx_lookup_proxy_reader_guid(gv->entity_index, prd_guid)) == NULL) || (match->crypto_handle == 0))
-  {
-    GVTRACE("remember reader tokens src("PGUIDFMT") dst("PGUIDFMT")\n", PGUID(*prd_guid), PGUID(wr->e.guid));
-    match->tokens = tseq;
-  }
-  else
-  {
-    if (sc->crypto_context->crypto_key_exchange->set_remote_datareader_crypto_tokens(sc->crypto_context->crypto_key_exchange, wr->sec_attr->crypto_handle, match->crypto_handle, tseq, &exception))
-    {
-      GVTRACE("set_remote_reader_crypto_tokens "PGUIDFMT" with writer "PGUIDFMT"\n", PGUID(prd->e.guid), PGUID(wr->e.guid));
-      match->matched = true;
-    }
-    else
-      EXCEPTION_ERROR(sc, &exception, "Failed to set remote reader crypto tokens "PGUIDFMT" for writer "PGUIDFMT, PGUID(prd->e.guid), PGUID(wr->e.guid));
-    DDS_Security_DataHolderSeq_free(tseq);
-  }
-  ddsrt_mutex_unlock(&wr->e.lock);
+   ddsrt_mutex_lock(&wr->e.lock);
+   match = find_or_create_pending_entity_match(&sc->security_matches, EK_PROXY_READER, prd_guid, &wr->e.guid, 0, tseq);
+   if (((prd = entidx_lookup_proxy_reader_guid(gv->entity_index, prd_guid)) == NULL) || (match->crypto_handle == 0))
+     GVTRACE("remember reader tokens src("PGUIDFMT") dst("PGUIDFMT")\n", PGUID(*prd_guid), PGUID(wr->e.guid));
+   else
+   {
+     if (!sc->crypto_context->crypto_key_exchange->set_remote_datareader_crypto_tokens(sc->crypto_context->crypto_key_exchange, wr->sec_attr->crypto_handle, match->crypto_handle, tseq, &exception))
+       EXCEPTION_ERROR(sc, &exception, "Failed to set remote reader crypto tokens "PGUIDFMT" for writer "PGUIDFMT, PGUID(prd->e.guid), PGUID(wr->e.guid));
+     else
+     {
+       GVTRACE("set_remote_reader_crypto_tokens "PGUIDFMT" with writer "PGUIDFMT"\n", PGUID(prd->e.guid), PGUID(wr->e.guid));
+       crypto_handle = match->crypto_handle;
+     }
+     delete_pending_match(&sc->security_matches, match);
+   }
+   ddsrt_mutex_unlock(&wr->e.lock);
 
-  if (match->matched)
-    connect_writer_with_proxy_reader_secure(wr, prd, ddsrt_time_monotonic (), match->crypto_handle);
+   if (crypto_handle != 0)
+     connect_writer_with_proxy_reader_secure(wr, prd, ddsrt_time_monotonic (), crypto_handle);
 
-  if (prd)
-    notify_handshake_recv_token(wr->c.pp, prd->c.proxypp);
+   if (prd)
+     notify_handshake_recv_token(wr->c.pp, prd->c.proxypp);
 }
 
 bool q_omg_reader_is_discovery_protected(const struct reader *rd)
diff --git a/src/core/ddsi/src/q_entity.c b/src/core/ddsi/src/q_entity.c
index 826124f..dfd2433 100644
--- a/src/core/ddsi/src/q_entity.c
+++ b/src/core/ddsi/src/q_entity.c
@@ -5638,6 +5638,9 @@ static void gc_delete_proxy_writer (struct gcreq *gcreq)
   local_reader_ary_fini (&pwr->rdary);
   if (pwr->c.xqos->liveliness.lease_duration != DDS_INFINITY)
     lease_free (pwr->lease);
+#ifdef DDSI_INCLUDE_SECURITY
+  q_omg_security_deregister_remote_writer(pwr);
+#endif
   proxy_endpoint_common_fini (&pwr->e, &pwr->c);
   nn_defrag_free (pwr->defrag);
   nn_reorder_free (pwr->reorder);
@@ -5869,6 +5872,9 @@ static void gc_delete_proxy_reader (struct gcreq *gcreq)
     writer_drop_connection (&m->wr_guid, prd);
     free_prd_wr_match (m);
   }
+#ifdef DDSI_INCLUDE_SECURITY
+  q_omg_security_deregister_remote_reader(prd);
+#endif
   proxy_endpoint_common_fini (&prd->e, &prd->c);
   ddsrt_free (prd);
 }
diff --git a/src/core/ddsi/src/q_init.c b/src/core/ddsi/src/q_init.c
index cabcf49..46571cc 100644
--- a/src/core/ddsi/src/q_init.c
+++ b/src/core/ddsi/src/q_init.c
@@ -1199,8 +1199,6 @@ int rtps_init (struct ddsi_domaingv *gv)
    * the entities (see DDS Security spec chapter 8.8.8.1). */
   add_property_to_xqos(&gv->builtin_volatile_xqos_rd, "dds.sec.builtin_endpoint_name", "BuiltinParticipantVolatileMessageSecureReader");
   add_property_to_xqos(&gv->builtin_volatile_xqos_wr, "dds.sec.builtin_endpoint_name", "BuiltinParticipantVolatileMessageSecureWriter");
-
-  q_omg_security_init(gv);
 #endif
 
   ddsrt_mutex_init (&gv->sertopics_lock);
@@ -1470,6 +1468,10 @@ int rtps_init (struct ddsi_domaingv *gv)
 #endif
   );
 
+#ifdef DDSI_INCLUDE_SECURITY
+  q_omg_security_init(gv);
+#endif
+
   gv->as_disc = new_addrset ();
   if (gv->config.allowMulticast & AMC_SPDP)
     add_to_addrset (gv, gv->as_disc, &gv->loc_spdp_mc);
@@ -1559,7 +1561,8 @@ err_unicast_sockets:
   ddsrt_mutex_destroy (&gv->sertopics_lock);
 #ifdef DDSI_INCLUDE_SECURITY
   q_omg_security_stop (gv); // should be a no-op as it starts lazily
-  q_omg_security_deinit (gv);
+  q_omg_security_deinit(gv->security_context);
+  q_omg_security_free (gv);
   ddsi_xqos_fini (&gv->builtin_stateless_xqos_wr);
   ddsi_xqos_fini (&gv->builtin_stateless_xqos_rd);
   ddsi_xqos_fini (&gv->builtin_volatile_xqos_wr);
@@ -1835,6 +1838,10 @@ void rtps_fini (struct ddsi_domaingv *gv)
   nn_dqueue_free (gv->user_dqueue);
 #endif
 
+#ifdef DDSI_INCLUDE_SECURITY
+  q_omg_security_deinit (gv->security_context);
+#endif
+
   xeventq_free (gv->xevents);
 
   if (gv->config.xpack_send_async)
@@ -1918,7 +1925,7 @@ void rtps_fini (struct ddsi_domaingv *gv)
   ddsrt_mutex_destroy (&gv->sertopics_lock);
 
 #ifdef DDSI_INCLUDE_SECURITY
-  q_omg_security_deinit (gv);
+  q_omg_security_free (gv);
   ddsi_xqos_fini (&gv->builtin_stateless_xqos_wr);
   ddsi_xqos_fini (&gv->builtin_stateless_xqos_rd);
   ddsi_xqos_fini (&gv->builtin_volatile_xqos_wr);

From a6a9d1f7c166790384ee4139288af80a0c1d35db Mon Sep 17 00:00:00 2001
From: Dennis Potman <dennis.potman@adlinktech.com>
Date: Wed, 11 Mar 2020 13:17:39 +0100
Subject: [PATCH 157/238] Security core tests: new tests and refactoring

Refactoring security core tests and adding more tests:
- Dynamically generate ca and identity certificates in authentication tests, so that certificate expiry is tested.
Added writing/reading samples to these tests to ensure that nodes can (or cannot) communicate in a specific test case
- Secure communication tests: improved the validation of encryption in wrapper
- Added test for access control plugin settings
- Replaced the in-code test identities (and included ca private keys), added an additional identity

Signed-off-by: Dennis Potman <dennis.potman@adlinktech.com>
---
 src/security/core/tests/CMakeLists.txt        |   2 +
 src/security/core/tests/access_control.c      |  63 +--
 src/security/core/tests/authentication.c      | 380 +++++++++++++++---
 src/security/core/tests/common/cert_utils.c   | 142 +++++++
 src/security/core/tests/common/cert_utils.h   |  20 +
 .../core/tests/common/cryptography_wrapper.c  |  79 +++-
 .../core/tests/common/cryptography_wrapper.h  |   7 +
 .../core/tests/common/handshake_test_utils.c  | 199 +++++----
 .../core/tests/common/handshake_test_utils.h  |  14 +-
 .../tests/common/security_config_test_utils.c |  81 +++-
 .../tests/common/security_config_test_utils.h |   4 +-
 .../core/tests/common/test_identity.h         | 284 ++++++++++---
 src/security/core/tests/handshake.c           |  10 +-
 .../core/tests/secure_communication.c         |  40 +-
 14 files changed, 1083 insertions(+), 242 deletions(-)
 create mode 100644 src/security/core/tests/common/cert_utils.c
 create mode 100644 src/security/core/tests/common/cert_utils.h

diff --git a/src/security/core/tests/CMakeLists.txt b/src/security/core/tests/CMakeLists.txt
index 5618269..639b84b 100644
--- a/src/security/core/tests/CMakeLists.txt
+++ b/src/security/core/tests/CMakeLists.txt
@@ -75,7 +75,9 @@ if(ENABLE_SSL)
   list(APPEND security_core_test_sources
     "common/security_config_test_utils.c"
     "common/handshake_test_utils.c"
+    "common/cert_utils.c"
     "authentication.c"
+    "access_control.c"
     "config.c"
     "handshake.c"
     "plugin_loading.c"
diff --git a/src/security/core/tests/access_control.c b/src/security/core/tests/access_control.c
index 0b25a90..061dfef 100644
--- a/src/security/core/tests/access_control.c
+++ b/src/security/core/tests/access_control.c
@@ -44,15 +44,15 @@ static const char *config =
     "  <DDSSecurity>"
     "    <Authentication>"
     "      <Library finalizeFunction=\"finalize_test_authentication_wrapped\" initFunction=\"init_test_authentication_wrapped\" path=\"" WRAPPERLIB_PATH("dds_security_authentication_wrapper") "\"/>"
-    "      <IdentityCertificate>" TEST_IDENTITY_CERTIFICATE "</IdentityCertificate>"
-    "      <PrivateKey>" TEST_IDENTITY_PRIVATE_KEY "</PrivateKey>"
-    "      <IdentityCA>" TEST_IDENTITY_CA_CERTIFICATE "</IdentityCA>"
+    "      <IdentityCertificate>data:," TEST_IDENTITY1_CERTIFICATE "</IdentityCertificate>"
+    "      <PrivateKey>data:," TEST_IDENTITY1_PRIVATE_KEY "</PrivateKey>"
+    "      <IdentityCA>data:," TEST_IDENTITY_CA1_CERTIFICATE "</IdentityCA>"
     "    </Authentication>"
     "    <AccessControl>"
     "      <Library finalizeFunction=\"finalize_access_control\" initFunction=\"init_access_control\"/>"
-    "      <Governance>${TEST_GOVERNANCE}</Governance>"
-    "      <PermissionsCA>${TEST_PERMISSIONS_CA}</PermissionsCA>"
-    "      <Permissions>${TEST_PERMISSIONS}</Permissions>"
+    "      ${INCL_GOV:+<Governance>}${TEST_GOVERNANCE}${INCL_GOV:+</Governance>}"
+    "      ${INCL_PERM_CA:+<PermissionsCA>}${TEST_PERMISSIONS_CA}${INCL_PERM_CA:+</PermissionsCA>}"
+    "      ${INCL_PERM:+<Permissions>}${TEST_PERMISSIONS}${INCL_PERM:+</Permissions>}"
     "    </AccessControl>"
     "    <Cryptographic>"
     "      <Library finalizeFunction=\"finalize_crypto\" initFunction=\"init_crypto\"/>"
@@ -69,9 +69,12 @@ static dds_entity_t g_participant1 = 0;
 static dds_entity_t g_domain2 = 0;
 static dds_entity_t g_participant2 = 0;
 
-static void access_control_init(const char * gov, const char * perm, const char * ca, bool exp_pp_fail)
+static void access_control_init(bool incl_gov, const char * gov, bool incl_perm, const char * perm, bool incl_ca, const char * ca, bool exp_pp_fail)
 {
   struct kvp config_vars[] = {
+    { "INCL_GOV", incl_gov ? "1" : "", 2 },
+    { "INCL_PERM", incl_perm ? "1" : "", 2 },
+    { "INCL_PERM_CA", incl_ca ? "1" : "", 2 },
     { "TEST_GOVERNANCE", gov, 1 },
     { "TEST_PERMISSIONS", perm, 1 },
     { "TEST_PERMISSIONS_CA", ca, 1 },
@@ -86,16 +89,8 @@ static void access_control_init(const char * gov, const char * perm, const char
 
   g_participant1 = dds_create_participant (DDS_DOMAINID1, NULL, NULL);
   g_participant2 = dds_create_participant (DDS_DOMAINID2, NULL, NULL);
-  if (exp_pp_fail)
-  {
-    CU_ASSERT_FATAL (g_participant1 <= 0);
-    CU_ASSERT_FATAL (g_participant2 <= 0);
-  }
-  else
-  {
-    CU_ASSERT_FATAL (g_participant1 > 0);
-    CU_ASSERT_FATAL (g_participant2 > 0);
-  }
+  CU_ASSERT_EQUAL_FATAL (exp_pp_fail, g_participant1 <= 0);
+  CU_ASSERT_EQUAL_FATAL (exp_pp_fail, g_participant2 <= 0);
 }
 
 static void access_control_fini(bool delete_pp)
@@ -121,16 +116,34 @@ static void access_control_fini(bool delete_pp)
 #define CA_F PF_F COMMON_ETC_PATH("default_permissions_ca.pem")
 #define CA_FNE PF_F COMMON_ETC_PATH("default_permissions_ca_non_existing.pem")
 #define CA_DI PF_D COMMON_ETC_PATH("default_permissions_ca.pem")
-#define CA_D TEST_PERMISSIONS_CA_CERTIFICATE
+#define CA_D PF_D TEST_PERMISSIONS_CA_CERTIFICATE
 
-CU_TheoryDataPoints(ddssec_access_control, config_parameters) = {
-    CU_DataPoints(const char *, GOV_F,  GOV_FNE,  GOV_FNE, GOV_F,    GOV_F,  "",     GOV_F, GOV_F,  GOV_DI, GOV_F),
-    CU_DataPoints(const char *, PERM_F, PERM_FNE, PERM_F,  PERM_FNE, PERM_F, PERM_F, "",    PERM_F, PERM_F, PERM_F),
-    CU_DataPoints(const char *, CA_F,   CA_FNE,   CA_F,    CA_F,     CA_FNE, CA_F,   CA_F,  "",     CA_F,   CA_D),
-    CU_DataPoints(bool,         false,  true,     true,    true,     true,   true,   true,  true,   true,   false)
+CU_TheoryDataPoints(ddssec_access_control, config_parameters_file) = {
+    CU_DataPoints(const char *,
+    /*                         */"existing files",
+    /*                          |      */"non-existing files",
+    /*                          |       |        */"non-existing governance file",
+    /*                          |       |         |       */"non-existing permissions file",
+    /*                          |       |         |        |        */"non-existing permissions ca file",
+    /*                          |       |         |        |         |      */"empty governance",
+    /*                          |       |         |        |         |       |      */"empty permissions",
+    /*                          |       |         |        |         |       |       |     */"empty permissions ca",
+    /*                          |       |         |        |         |       |       |      |      */"all empty",
+    /*                          |       |         |        |         |       |       |      |       |     */"invalid governance uri type",
+    /*                          |       |         |        |         |       |       |      |       |      |      */"permissions ca type data",
+    /*                          |       |         |        |         |       |       |      |       |      |       |      */"no governance element",
+    /*                          |       |         |        |         |       |       |      |       |      |       |       |      */"no permissions element",
+    /*                          |       |         |        |         |       |       |      |       |      |       |       |       |     */"no permissions ca element"),
+    CU_DataPoints(const char *, GOV_F,  GOV_FNE,  GOV_FNE, GOV_F,    GOV_F,  "",     GOV_F, GOV_F,  "",    GOV_DI, GOV_F,  "",     GOV_F, GOV_F),   // Governance config
+    CU_DataPoints(const char *, PERM_F, PERM_FNE, PERM_F,  PERM_FNE, PERM_F, PERM_F, "",    PERM_F, "",    PERM_F, PERM_F, PERM_F, "",    PERM_F),  // Permissions config
+    CU_DataPoints(const char *, CA_F,   CA_FNE,   CA_F,    CA_F,     CA_FNE, CA_F,   CA_F,  "",     "",    CA_F,   CA_D,   CA_F,   CA_F,  ""),      // Permissions CA
+    CU_DataPoints(bool,         true,   true,     true,    true,     true,   true,   true,  true,   true,  true,   true,   false,  false, false),   // include empty config elements
+    CU_DataPoints(bool,         false,  true,     true,    true,     true,   true,   true,  true,   false, true,   false,  true,   true,  true)     // expect failure
 };
-CU_Theory((const char * gov, const char * perm, const char * ca, bool exp_fail), ddssec_access_control, config_parameters)
+CU_Theory((const char * test_descr, const char * gov, const char * perm, const char * ca, bool incl_empty_els, bool exp_fail),
+    ddssec_access_control, config_parameters_file)
 {
-  access_control_init (gov, perm, ca, exp_fail);
+  printf("running test config_parameters_file: %s\n", test_descr);
+  access_control_init (incl_empty_els || strlen (gov), gov, incl_empty_els || strlen (perm), perm, incl_empty_els || strlen (ca), ca, exp_fail);
   access_control_fini (!exp_fail);
 }
diff --git a/src/security/core/tests/authentication.c b/src/security/core/tests/authentication.c
index afab49b..a23f203 100644
--- a/src/security/core/tests/authentication.c
+++ b/src/security/core/tests/authentication.c
@@ -34,6 +34,22 @@
 #include "common/handshake_test_utils.h"
 #include "common/security_config_test_utils.h"
 #include "common/test_identity.h"
+#include "common/cert_utils.h"
+#include "common/security_config_test_utils.h"
+
+#include "SecurityCoreTests.h"
+
+
+#define ID1 TEST_IDENTITY1_CERTIFICATE
+#define ID1K TEST_IDENTITY1_PRIVATE_KEY
+#define ID2 TEST_IDENTITY2_CERTIFICATE
+#define ID2K TEST_IDENTITY2_PRIVATE_KEY
+#define ID3 TEST_IDENTITY3_CERTIFICATE
+#define ID3K TEST_IDENTITY3_PRIVATE_KEY
+#define CA1 TEST_IDENTITY_CA1_CERTIFICATE
+#define CA1K TEST_IDENTITY_CA1_PRIVATE_KEY
+#define CA2 TEST_IDENTITY_CA2_CERTIFICATE
+#define CA2K TEST_IDENTITY_CA2_PRIVATE_KEY
 
 static const char *config =
     "${CYCLONEDDS_URI}${CYCLONEDDS_URI:+,}"
@@ -45,16 +61,16 @@ static const char *config =
     "  <DDSSecurity>"
     "    <Authentication>"
     "      <Library finalizeFunction=\"finalize_test_authentication_wrapped\" initFunction=\"init_test_authentication_wrapped\" path=\"" WRAPPERLIB_PATH("dds_security_authentication_wrapper") "\"/>"
-    "      <IdentityCertificate>${TEST_IDENTITY_CERTIFICATE}</IdentityCertificate>"
-    "      <PrivateKey>${TEST_IDENTITY_PRIVATE_KEY}</PrivateKey>"
-    "      <IdentityCA>${TEST_IDENTITY_CA_CERTIFICATE}</IdentityCA>"
+    "      <IdentityCertificate>data:,${TEST_IDENTITY_CERTIFICATE}</IdentityCertificate>"
+    "      <PrivateKey>data:,${TEST_IDENTITY_PRIVATE_KEY}</PrivateKey>"
+    "      <IdentityCA>data:,${TEST_IDENTITY_CA_CERTIFICATE}</IdentityCA>"
     "      ${TRUSTED_CA_DIR:+<TrustedCADir>}${TRUSTED_CA_DIR}${TRUSTED_CA_DIR:+</TrustedCADir>}"
     "    </Authentication>"
     "    <AccessControl>"
     "      <Library finalizeFunction=\"finalize_access_control\" initFunction=\"init_access_control\"/>"
-    "      <Governance>file:" COMMON_ETC_PATH("default_governance.p7s") "</Governance>"
+    "      <Governance><![CDATA[${GOVERNANCE_CONFIG}]]></Governance>"
     "      <PermissionsCA>file:" COMMON_ETC_PATH("default_permissions_ca.pem") "</PermissionsCA>"
-    "      <Permissions>file:" COMMON_ETC_PATH("default_permissions.p7s") "</Permissions>"
+    "      <Permissions><![CDATA[${PERM_CONFIG}]]></Permissions>"
     "    </AccessControl>"
     "    <Cryptographic>"
     "      <Library finalizeFunction=\"finalize_crypto\" initFunction=\"init_crypto\"/>"
@@ -64,29 +80,59 @@ static const char *config =
 
 #define DDS_DOMAINID1 0
 #define DDS_DOMAINID2 1
-#define MAX_ADDITIONAL_CONF 255
 
-static dds_entity_t g_domain1 = 0;
-static dds_entity_t g_participant1 = 0;
+#define DEF_PERM_CONF "file:" COMMON_ETC_PATH("default_permissions.p7s")
 
-static dds_entity_t g_domain2 = 0;
-static dds_entity_t g_participant2 = 0;
+static dds_entity_t g_domain1;
+static dds_entity_t g_participant1;
+static dds_entity_t g_pub;
+static dds_entity_t g_pub_tp;
+static dds_entity_t g_wr;
 
-static void authentication_init(bool different_ca, const char * trusted_ca_dir, bool exp_pp_fail)
+static dds_entity_t g_domain2;
+static dds_entity_t g_participant2;
+static dds_entity_t g_sub;
+static dds_entity_t g_sub_tp;
+static dds_entity_t g_rd;
+
+static uint32_t g_topic_nr = 0;
+
+static void authentication_init(
+    const char * id1_cert, const char * id1_key, const char * id1_ca,
+    const char * id2_cert, const char * id2_key, const char * id2_ca,
+    const char * trusted_ca_dir, const char * perm_config,
+    bool exp_pp1_fail, bool exp_pp2_fail)
 {
+  if (perm_config == NULL)
+    perm_config = DEF_PERM_CONF;
+
+  struct kvp governance_vars[] = {
+    { "DISCOVERY_PROTECTION_KIND", "NONE", 1 },
+    { "LIVELINESS_PROTECTION_KIND", "NONE", 1 },
+    { "RTPS_PROTECTION_KIND", "NONE", 1 },
+    { "METADATA_PROTECTION_KIND", "NONE", 1 },
+    { "DATA_PROTECTION_KIND", "NONE", 1 },
+    { NULL, NULL, 0 }
+  };
+  char * gov_config_signed = get_governance_config (governance_vars, true);
+
   struct kvp config_vars1[] = {
-    { "TEST_IDENTITY_CERTIFICATE", TEST_IDENTITY_CERTIFICATE, 1 },
-    { "TEST_IDENTITY_PRIVATE_KEY", TEST_IDENTITY_PRIVATE_KEY, 1 },
-    { "TEST_IDENTITY_CA_CERTIFICATE", TEST_IDENTITY_CA_CERTIFICATE, 1 },
+    { "TEST_IDENTITY_CERTIFICATE", id1_cert, 1 },
+    { "TEST_IDENTITY_PRIVATE_KEY", id1_key, 1 },
+    { "TEST_IDENTITY_CA_CERTIFICATE", id1_ca, 1 },
     { "TRUSTED_CA_DIR", trusted_ca_dir, 3 },
+    { "PERM_CONFIG", perm_config, 1 },
+    { "GOVERNANCE_CONFIG", gov_config_signed, 1 },
     { NULL, NULL, 0 }
   };
 
   struct kvp config_vars2[] = {
-    { "TEST_IDENTITY_CERTIFICATE", TEST_IDENTITY2_CERTIFICATE, 1 },
-    { "TEST_IDENTITY_PRIVATE_KEY", TEST_IDENTITY2_PRIVATE_KEY, 1 },
-    { "TEST_IDENTITY_CA_CERTIFICATE", TEST_IDENTITY_CA2_CERTIFICATE, 1 },
+    { "TEST_IDENTITY_CERTIFICATE", id2_cert, 1 },
+    { "TEST_IDENTITY_PRIVATE_KEY", id2_key, 1 },
+    { "TEST_IDENTITY_CA_CERTIFICATE", id2_ca, 1 },
     { "TRUSTED_CA_DIR", trusted_ca_dir, 3 },
+    { "PERM_CONFIG", perm_config, 1 },
+    { "GOVERNANCE_CONFIG", gov_config_signed, 1 },
     { NULL, NULL, 0 }
   };
 
@@ -95,57 +141,301 @@ static void authentication_init(bool different_ca, const char * trusted_ca_dir,
   CU_ASSERT_EQUAL_FATAL (expand_lookup_unmatched (config_vars1), 0);
   CU_ASSERT_EQUAL_FATAL (expand_lookup_unmatched (config_vars2), 0);
   g_domain1 = dds_create_domain (DDS_DOMAINID1, conf1);
-  g_domain2 = dds_create_domain (DDS_DOMAINID2, different_ca ? conf2 : conf1);
-  dds_free (conf1);
-  dds_free (conf2);
-
+  g_domain2 = dds_create_domain (DDS_DOMAINID2, conf2);
   g_participant1 = dds_create_participant (DDS_DOMAINID1, NULL, NULL);
   g_participant2 = dds_create_participant (DDS_DOMAINID2, NULL, NULL);
-  if (exp_pp_fail)
-  {
-    CU_ASSERT_FATAL (g_participant1 <= 0);
-    CU_ASSERT_FATAL (g_participant2 <= 0);
-  }
-  else
-  {
-    CU_ASSERT_FATAL (g_participant1 > 0);
-    CU_ASSERT_FATAL (g_participant2 > 0);
-  }
+  CU_ASSERT_EQUAL_FATAL (exp_pp1_fail, g_participant1 <= 0);
+  CU_ASSERT_EQUAL_FATAL (exp_pp2_fail, g_participant2 <= 0);
+
+  ddsrt_free (gov_config_signed);
+  ddsrt_free (conf1);
+  ddsrt_free (conf2);
 }
 
-static void authentication_fini(bool delete_pp)
+static char *create_topic_name(const char *prefix, uint32_t nr, char *name, size_t size)
 {
-  if (delete_pp)
+  ddsrt_pid_t pid = ddsrt_getpid ();
+  ddsrt_tid_t tid = ddsrt_gettid ();
+  (void)snprintf(name, size, "%s%d_pid%" PRIdPID "_tid%" PRIdTID "", prefix, nr, pid, tid);
+  return name;
+}
+
+static void sync_writer_to_reader()
+{
+  dds_attach_t triggered;
+  dds_return_t ret;
+  dds_entity_t waitset_wr = dds_create_waitset (g_participant1);
+  CU_ASSERT_FATAL (waitset_wr > 0);
+  dds_publication_matched_status_t pub_matched;
+
+  /* Sync writer to reader. */
+  ret = dds_waitset_attach (waitset_wr, g_wr, g_wr);
+  CU_ASSERT_EQUAL_FATAL (ret, DDS_RETCODE_OK);
+  while (true)
   {
-    CU_ASSERT_EQUAL_FATAL (dds_delete (g_participant1), DDS_RETCODE_OK);
-    CU_ASSERT_EQUAL_FATAL (dds_delete (g_participant2), DDS_RETCODE_OK);
+    ret = dds_waitset_wait (waitset_wr, &triggered, 1, DDS_SECS(5));
+    CU_ASSERT_FATAL (ret >= 1);
+    CU_ASSERT_EQUAL_FATAL (g_wr, (dds_entity_t)(intptr_t) triggered);
+    ret = dds_get_publication_matched_status(g_wr, &pub_matched);
+    CU_ASSERT_EQUAL_FATAL (ret, DDS_RETCODE_OK);
+    if (pub_matched.total_count >= 1)
+      break;
+  };
+  dds_delete (waitset_wr);
+}
+
+static void reader_wait_for_data()
+{
+  dds_attach_t triggered;
+  dds_return_t ret;
+  dds_entity_t waitset_rd = dds_create_waitset (g_participant2);
+  CU_ASSERT_FATAL (waitset_rd > 0);
+
+  ret = dds_waitset_attach (waitset_rd, g_rd, g_rd);
+  CU_ASSERT_EQUAL_FATAL (ret, DDS_RETCODE_OK);
+  ret = dds_waitset_wait (waitset_rd, &triggered, 1, DDS_SECS(5));
+  CU_ASSERT_EQUAL_FATAL (ret, 1);
+  CU_ASSERT_EQUAL_FATAL (g_rd, (dds_entity_t)(intptr_t)triggered);
+  dds_delete (waitset_rd);
+}
+
+static void rd_wr_init()
+{
+  char name[100];
+  dds_qos_t * qos = dds_create_qos ();
+  CU_ASSERT_FATAL (qos != NULL);
+  dds_qset_history (qos, DDS_HISTORY_KEEP_ALL, -1);
+  dds_qset_durability (qos, DDS_DURABILITY_TRANSIENT_LOCAL);
+  dds_qset_reliability (qos, DDS_RELIABILITY_RELIABLE, DDS_INFINITY);
+
+  create_topic_name("ddssec_authentication_", g_topic_nr++, name, sizeof (name));
+  g_pub = dds_create_publisher (g_participant1, NULL, NULL);
+  CU_ASSERT_FATAL (g_pub > 0);
+  g_sub = dds_create_subscriber (g_participant2, NULL, NULL);
+  CU_ASSERT_FATAL (g_sub > 0);
+  g_pub_tp = dds_create_topic (g_participant1, &SecurityCoreTests_Type1_desc, name, NULL, NULL);
+  CU_ASSERT_FATAL (g_pub_tp > 0);
+  g_sub_tp = dds_create_topic (g_participant2, &SecurityCoreTests_Type1_desc, name, NULL, NULL);
+  CU_ASSERT_FATAL (g_sub_tp > 0);
+  g_wr = dds_create_writer (g_pub, g_pub_tp, qos, NULL);
+  CU_ASSERT_FATAL (g_wr > 0);
+  dds_set_status_mask (g_wr, DDS_PUBLICATION_MATCHED_STATUS);
+  g_rd = dds_create_reader (g_sub, g_sub_tp, qos, NULL);
+  CU_ASSERT_FATAL (g_rd > 0);
+  dds_set_status_mask (g_rd, DDS_DATA_AVAILABLE_STATUS);
+  sync_writer_to_reader();
+  dds_delete_qos (qos);
+}
+
+static void write_read(dds_duration_t dur, bool exp_write_fail, bool exp_read_fail)
+{
+  SecurityCoreTests_Type1 sample = { 1, 1 };
+  SecurityCoreTests_Type1 rd_sample;
+  void * samples[] = { &rd_sample };
+  dds_sample_info_t info[1];
+  dds_return_t ret;
+  dds_time_t tend = dds_time () + dur;
+  bool write_fail = false, read_fail = false;
+
+  rd_wr_init ();
+  do
+  {
+    ret = dds_write (g_wr, &sample);
+    if (ret != DDS_RETCODE_OK)
+      write_fail = true;
+    while (true)
+    {
+      if ((ret = dds_take (g_rd, samples, info, 1, 1)) == 0)
+      {
+        reader_wait_for_data ();
+        continue;
+      }
+      else if (ret < 0)
+      {
+        read_fail = true;
+        break;
+      }
+      CU_ASSERT_EQUAL_FATAL (ret, 1);
+      break;
+    }
+    dds_sleepfor (DDS_MSECS (1));
   }
+  while (dds_time() < tend && !write_fail && !read_fail);
+  CU_ASSERT_EQUAL_FATAL (write_fail, exp_write_fail);
+  CU_ASSERT_EQUAL_FATAL (read_fail, exp_read_fail);
+}
+
+static void authentication_fini(bool delete_pp1, bool delete_pp2)
+{
+  if (delete_pp1)
+    CU_ASSERT_EQUAL_FATAL (dds_delete (g_participant1), DDS_RETCODE_OK);
+  if (delete_pp2)
+    CU_ASSERT_EQUAL_FATAL (dds_delete (g_participant2), DDS_RETCODE_OK);
   CU_ASSERT_EQUAL_FATAL (dds_delete (g_domain1), DDS_RETCODE_OK);
   CU_ASSERT_EQUAL_FATAL (dds_delete (g_domain2), DDS_RETCODE_OK);
 }
 
-CU_Test(ddssec_authentication, different_ca)
+#define FM_CA "error: unable to get local issuer certificate"
+#define FM_INVK "Failed to finalize verify context"
+CU_TheoryDataPoints(ddssec_authentication, id_ca_certs) = {
+    CU_DataPoints(const char *,
+    /*                         */"valid ID1-ID1",
+    /*                          |     */"non-trusted remote CA ID1(CA1)-ID2(CA2)",
+    /*                          |      |     */"valid ID1-ID3",
+    /*                          |      |      |     */"invalid ca ID1(CA1)-ID1(CA2)",
+    /*                          |      |      |      |     */"invalid remote key ID3(K1)"),
+    CU_DataPoints(const char *, ID1,   ID2,   ID3,   ID1,   ID3),      /* Identity for domain 2 */
+    CU_DataPoints(const char *, ID1K,  ID2K,  ID3K,  ID1K,  ID1K),     /* Private key for domain 2 identity */
+    CU_DataPoints(const char *, CA1,   CA2,   CA1,   CA2,   CA1),      /* CA for domain 2 identity */
+    CU_DataPoints(bool,         false, false, false, false, false),    /* expect create participant1 fails */
+    CU_DataPoints(bool,         false, false, false, true,  false),    /* expect create participant2 fails */
+    CU_DataPoints(bool,         false, false, false, true,  false),    /* expect validate local failed for domain 2 */
+    CU_DataPoints(const char *, NULL,  NULL,  NULL,  FM_CA, NULL),     /* expected error message for validate local failed */
+    CU_DataPoints(bool,         false, true,  false, false, true),     /* expect handshake request failed */
+    CU_DataPoints(const char *, NULL,  NULL,  NULL,  NULL,  FM_INVK),  /* expected error message for handshake request failed */
+    CU_DataPoints(bool,         false, true,  false, true,  true),     /* expect handshake reply failed */
+    CU_DataPoints(const char *, NULL,  FM_CA, NULL,  FM_CA, NULL)      /* expected error message for handshake reply failed */
+};
+#undef FM_CA
+#undef FM_INVK
+
+static void validate_hs(struct Handshake *hs, bool exp_fail_hs_req, const char * fail_hs_req_msg, bool exp_fail_hs_reply, const char * fail_hs_reply_msg)
 {
-  authentication_init (true, NULL, false);
-  validate_handshake (DDS_DOMAINID1, true, NULL, true, "error: unable to get local issuer certificate");
-  validate_handshake (DDS_DOMAINID2, true, NULL, true, "error: unable to get local issuer certificate");
-  authentication_fini (true);
+  DDS_Security_ValidationResult_t exp_result = hs->node_type == HSN_REQUESTER ? DDS_SECURITY_VALIDATION_OK_FINAL_MESSAGE : DDS_SECURITY_VALIDATION_OK;
+  if (hs->node_type == HSN_REQUESTER)
+  {
+    CU_ASSERT_EQUAL_FATAL (hs->finalResult, exp_fail_hs_req ? DDS_SECURITY_VALIDATION_FAILED : exp_result);
+    if (exp_fail_hs_req)
+    {
+      if (fail_hs_req_msg == NULL)
+      {
+        CU_ASSERT_EQUAL_FATAL (hs->err_msg, NULL);
+      }
+      else
+      {
+        CU_ASSERT_FATAL (hs->err_msg != NULL);
+        CU_ASSERT_FATAL (strstr(hs->err_msg, fail_hs_req_msg) != NULL);
+      }
+    }
+  }
+  else if (hs->node_type == HSN_REPLIER)
+  {
+    CU_ASSERT_EQUAL_FATAL (hs->finalResult, exp_fail_hs_reply ? DDS_SECURITY_VALIDATION_FAILED : exp_result);
+    if (exp_fail_hs_reply)
+    {
+      if (fail_hs_reply_msg == NULL)
+      {
+        CU_ASSERT_EQUAL_FATAL (hs->err_msg, NULL);
+      }
+      else
+      {
+        CU_ASSERT_FATAL (hs->err_msg != NULL);
+        CU_ASSERT_FATAL (strstr(hs->err_msg, fail_hs_reply_msg) != NULL);
+      }
+    }
+  }
 }
 
+CU_Theory((const char * test_descr, const char * id2, const char *key2, const char *ca2,
+    bool exp_fail_pp1, bool exp_fail_pp2,
+    bool exp_fail_local, const char * fail_local_msg,
+    bool exp_fail_hs_req, const char * fail_hs_req_msg,
+    bool exp_fail_hs_reply, const char * fail_hs_reply_msg),
+    ddssec_authentication, id_ca_certs)
+{
+  struct Handshake *hs_list;
+  int nhs;
+  printf("running test id_ca_certs: %s\n", test_descr);
+  authentication_init (ID1, ID1K, CA1, id2, key2, ca2, NULL, NULL, exp_fail_pp1, exp_fail_pp2);
+
+  // Domain 1
+  validate_handshake (DDS_DOMAINID1, false, NULL, &hs_list, &nhs);
+  for (int n = 0; n < nhs; n++)
+    validate_hs (&hs_list[n], exp_fail_hs_req, fail_hs_req_msg, exp_fail_hs_reply, fail_hs_reply_msg);
+  handshake_list_fini (hs_list, nhs);
+
+  // Domain 2
+  validate_handshake (DDS_DOMAINID2, exp_fail_local, fail_local_msg, &hs_list, &nhs);
+  for (int n = 0; n < nhs; n++)
+    validate_hs (&hs_list[n], exp_fail_hs_req, fail_hs_req_msg, exp_fail_hs_reply, fail_hs_reply_msg);
+  handshake_list_fini (hs_list, nhs);
+
+  authentication_fini (!exp_fail_pp1, !exp_fail_pp2);
+}
 
 CU_TheoryDataPoints(ddssec_authentication, trusted_ca_dir) = {
     CU_DataPoints(const char *, "",    ".",   "/nonexisting", NULL),
     CU_DataPoints(bool,         false, false, true,           false)
 };
-
 CU_Theory((const char * ca_dir, bool exp_fail), ddssec_authentication, trusted_ca_dir)
 {
   printf("Testing custom CA dir: %s\n", ca_dir);
-  authentication_init (false, ca_dir, exp_fail);
+  authentication_init (ID1, ID1K, CA1, ID1, ID1K, CA1, ca_dir, NULL, exp_fail, exp_fail);
   if (!exp_fail)
   {
-    validate_handshake (DDS_DOMAINID1, false, NULL, false, NULL);
-    validate_handshake (DDS_DOMAINID2, false, NULL, false, NULL);
+    validate_handshake_nofail (DDS_DOMAINID1);
+    validate_handshake_nofail (DDS_DOMAINID2);
   }
-  authentication_fini (!exp_fail);
+  authentication_fini (!exp_fail, !exp_fail);
 }
+
+#define M(n) ((n)*60)
+#define H(n) (M(n)*60)
+#define D(n) (H(n)*24)
+CU_TheoryDataPoints(ddssec_authentication, expired_cert) = {
+    CU_DataPoints(const char *,
+    /*                      */"all valid 1d",
+    /*                       |     */"ca expired",
+    /*                       |      |     */"id1 expired",
+    /*                       |      |      |     */"id2 expired",
+    /*                       |      |      |      |     */"ca and id1 1min valid",
+    /*                       |      |      |      |      |     */"id1 and id2 1s valid, delay 1100ms",
+    /*                       |      |      |      |      |      |     */"id1 valid after 1s, delay 1100ms",
+    /*                       |      |      |      |      |      |      |    *//*"ca and id1 expire during session"*/),
+    CU_DataPoints(int32_t,   0,     -M(1), 0,     0,     0,     0,     0,     /*0*/     ),   /* CA1 not before */
+    CU_DataPoints(int32_t,   D(1),  0,     D(1),  D(1),  M(1),  D(1),  D(1),  /*2*/     ),  /* CA1 not after */
+    CU_DataPoints(int32_t,   0,     0,     -D(1), 0,     0,     0,     1,     /*0*/     ),  /* ID1 not before */
+    CU_DataPoints(int32_t,   D(1),  D(1),  0,     D(1),  M(1),  1,     D(1),  /*2*/     ),  /* ID1 not after */
+    CU_DataPoints(bool,      false, true,  true,  false, false, true,  false, /*false*/ ),  /* expect validate local ID1 fail */
+    CU_DataPoints(int32_t,   0,     0,     0,     -D(1), 0,     0,     0,     /*0*/     ),  /* ID2 not before */
+    CU_DataPoints(int32_t,   D(1),  D(1),  D(1),  0,     D(1),  1,     D(1),  /*D(1)*/  ),  /* ID2 not after */
+    CU_DataPoints(bool,      false, true,  false, true,  false, true,  false, /*false*/ ),  /* expect validate local ID2 fail */
+    CU_DataPoints(uint32_t,  0,     0,     0,     0,     0,     1100,  1100,  /*0*/     ),  /* delay (ms) after generating certificate */
+    CU_DataPoints(uint32_t,  1,     0,     0,     0,     1,     0,     1,     /*3500*/  ),  /* write/read data during x ms */
+    CU_DataPoints(bool,      false, false, false, false, false, false, false, /*true*/  ),  /* expect read data failure */
+};
+CU_Theory(
+  (const char * test_descr, int32_t ca_not_before, int32_t ca_not_after,
+    int32_t id1_not_before, int32_t id1_not_after, bool id1_local_fail,
+    int32_t id2_not_before, int32_t id2_not_after, bool id2_local_fail,
+    uint32_t delay, uint32_t write_read_dur, bool exp_read_fail),
+  ddssec_authentication, expired_cert)
+{
+  char *ca, *id1, *id2, *id1_subj, *id2_subj;
+  printf("running test expired_cert: %s\n", test_descr);
+  ca = generate_ca ("ca1", CA1K, ca_not_before, ca_not_after);
+  id1 = generate_identity (ca, CA1K, "id1", ID1K, id1_not_before, id1_not_after, &id1_subj);
+  id2 = generate_identity (ca, CA1K, "id2", ID1K, id2_not_before, id2_not_after, &id2_subj);
+  dds_sleepfor (DDS_MSECS (delay));
+
+  char * grants[] = { get_permissions_grant ("id1", id1_subj), get_permissions_grant ("id2", id2_subj) };
+  char * perm_config = get_permissions_config (grants, 2, true);
+  authentication_init (id1, ID1K, ca, id2, ID1K, ca, NULL, perm_config, id1_local_fail, id2_local_fail);
+  validate_handshake (DDS_DOMAINID1, id1_local_fail, NULL, NULL, NULL);
+  validate_handshake (DDS_DOMAINID2, id2_local_fail, NULL, NULL, NULL);
+  if (write_read_dur > 0)
+    write_read (DDS_MSECS (write_read_dur), false, exp_read_fail);
+  authentication_fini (!id1_local_fail, !id2_local_fail);
+  ddsrt_free (grants[0]);
+  ddsrt_free (grants[1]);
+  ddsrt_free (perm_config);
+  ddsrt_free (ca);
+  ddsrt_free (id1_subj);
+  ddsrt_free (id2_subj);
+  ddsrt_free (id1);
+  ddsrt_free (id2);
+}
+#undef D
+#undef H
+#undef M
+
diff --git a/src/security/core/tests/common/cert_utils.c b/src/security/core/tests/common/cert_utils.c
new file mode 100644
index 0000000..f2e7386
--- /dev/null
+++ b/src/security/core/tests/common/cert_utils.c
@@ -0,0 +1,142 @@
+/*
+ * Copyright(c) 2006 to 2020 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+
+#include <stdlib.h>
+#include <string.h>
+#include <openssl/asn1.h>
+#include <openssl/bio.h>
+#include <openssl/conf.h>
+#include <openssl/err.h>
+#include <openssl/pem.h>
+#include <openssl/x509.h>
+
+#include "dds/ddsrt/heap.h"
+#include "dds/ddsrt/string.h"
+#include "CUnit/Test.h"
+#include "cert_utils.h"
+
+#define MAX_EMAIL 255
+#define EMAIL_HOST "cycloneddssecurity.adlinktech.com"
+
+static X509 * get_x509(int not_valid_before, int not_valid_after, const char * cn, const char * email)
+{
+  X509 * cert = X509_new ();
+  CU_ASSERT_FATAL (cert != NULL);
+  ASN1_INTEGER_set (X509_get_serialNumber (cert), 1);
+  X509_gmtime_adj (X509_get_notBefore (cert), not_valid_before);
+  X509_gmtime_adj (X509_get_notAfter (cert), not_valid_after);
+
+  X509_NAME * name = X509_get_subject_name (cert);
+  X509_NAME_add_entry_by_txt (name, "C",  MBSTRING_ASC, (unsigned char *) "NL", -1, -1, 0);
+  X509_NAME_add_entry_by_txt (name, "O",  MBSTRING_ASC, (unsigned char *) "Example Organization", -1, -1, 0);
+  X509_NAME_add_entry_by_txt (name, "CN", MBSTRING_ASC, (unsigned char *) cn, -1, -1, 0);
+  X509_NAME_add_entry_by_txt (name, "emailAddress", MBSTRING_ASC, (unsigned char *) email, -1, -1, 0);
+  return cert;
+}
+
+static char * get_x509_data(X509 * cert)
+{
+  // Create BIO for writing output
+  BIO *output_bio = BIO_new (BIO_s_mem ());
+  if (!PEM_write_bio_X509 (output_bio, cert)) {
+    printf ("Error writing certificate\n");
+    CU_ASSERT_FATAL (false);
+  }
+
+  // Get string
+  char *output_tmp = NULL;
+  size_t output_sz = (size_t) BIO_get_mem_data (output_bio, &output_tmp);
+  char * output = ddsrt_malloc (output_sz + 1);
+  memcpy (output, output_tmp, output_sz);
+  output[output_sz] = 0;
+  BIO_free (output_bio);
+
+  return output;
+}
+
+static EVP_PKEY * get_priv_key(const char * priv_key_str)
+{
+  BIO *pkey_bio = BIO_new_mem_buf (priv_key_str, -1);
+  EVP_PKEY *priv_key = PEM_read_bio_PrivateKey (pkey_bio, NULL, NULL, 0);
+  CU_ASSERT_FATAL (priv_key != NULL);
+  BIO_free (pkey_bio);
+  return priv_key;
+}
+
+static X509 * get_cert(const char * cert_str)
+{
+  BIO *cert_bio = BIO_new_mem_buf (cert_str, -1);
+  X509 *cert = PEM_read_bio_X509 (cert_bio, NULL, NULL, 0);
+  CU_ASSERT_FATAL (cert != NULL);
+  BIO_free (cert_bio);
+  return cert;
+}
+
+char * generate_ca(const char *ca_name, const char * ca_priv_key_str, int not_valid_before, int not_valid_after)
+{
+  EVP_PKEY *ca_priv_key = get_priv_key (ca_priv_key_str);
+
+  char * email = malloc (MAX_EMAIL);
+  snprintf(email, MAX_EMAIL, "%s@%s" , ca_name, EMAIL_HOST);
+  X509 * ca_cert = get_x509 (not_valid_before, not_valid_after, ca_name, email);
+  ddsrt_free (email);
+
+  X509_set_pubkey (ca_cert, ca_priv_key);
+  X509_set_issuer_name (ca_cert, X509_get_subject_name (ca_cert)); /* self-signed */
+  X509_sign (ca_cert, ca_priv_key, EVP_sha1 ());
+  char * output = get_x509_data (ca_cert);
+
+  EVP_PKEY_free (ca_priv_key);
+  X509_free (ca_cert);
+
+  return output;
+}
+
+char * generate_identity(const char * ca_cert_str, const char * ca_priv_key_str, const char * name, const char * priv_key_str, int not_valid_before, int not_valid_after, char ** subject)
+{
+  X509 *ca_cert = get_cert (ca_cert_str);
+  EVP_PKEY *ca_key_pkey = get_priv_key (ca_priv_key_str);
+  EVP_PKEY *id_pkey = get_priv_key (priv_key_str);
+  EVP_PKEY *ca_cert_pkey = X509_get_pubkey (ca_cert);
+  X509_REQ *csr =  X509_REQ_new ();
+  X509_REQ_set_pubkey (csr, id_pkey);
+  X509_REQ_sign (csr, id_pkey, EVP_sha256 ());
+
+  char * email = malloc (MAX_EMAIL);
+  snprintf(email, MAX_EMAIL, "%s@%s" , name, EMAIL_HOST);
+  X509 * cert = get_x509 (not_valid_before, not_valid_after, name, email);
+  ddsrt_free (email);
+
+  EVP_PKEY *csr_pkey = X509_REQ_get_pubkey (csr);
+  X509_set_pubkey (cert, csr_pkey);
+  X509_set_issuer_name (cert, X509_get_subject_name (ca_cert));
+  X509_sign (cert, ca_key_pkey, EVP_sha256 ());
+  char * output = get_x509_data (cert);
+
+  if (subject)
+  {
+    X509_NAME *subj_name = X509_get_subject_name (cert);
+    char * subj_openssl = X509_NAME_oneline (subj_name, NULL, 0);
+    *subject = ddsrt_strdup (subj_openssl);
+    OPENSSL_free (subj_openssl);
+  }
+
+  X509_REQ_free (csr);
+  EVP_PKEY_free (id_pkey);
+  EVP_PKEY_free (ca_cert_pkey);
+  EVP_PKEY_free (ca_key_pkey);
+  EVP_PKEY_free (csr_pkey);
+  X509_free (cert);
+  X509_free (ca_cert);
+
+  return output;
+}
diff --git a/src/security/core/tests/common/cert_utils.h b/src/security/core/tests/common/cert_utils.h
new file mode 100644
index 0000000..f6f9e92
--- /dev/null
+++ b/src/security/core/tests/common/cert_utils.h
@@ -0,0 +1,20 @@
+/*
+ * Copyright(c) 2006 to 2020 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+#ifndef SECURITY_CORE_TEST_CERT_UTILS_H_
+#define SECURITY_CORE_TEST_CERT_UTILS_H_
+
+#include <stdlib.h>
+
+char * generate_ca(const char *ca_name, const char * ca_priv_key_str, int not_valid_before, int not_valid_after);
+char * generate_identity(const char * ca_cert_str, const char * ca_priv_key_str, const char * name, const char * priv_key_str, int not_valid_before, int not_valid_after, char ** subject);
+
+#endif /* SECURITY_CORE_TEST_CERT_UTILS_H_ */
diff --git a/src/security/core/tests/common/cryptography_wrapper.c b/src/security/core/tests/common/cryptography_wrapper.c
index fcb3ed9..7af5c1b 100644
--- a/src/security/core/tests/common/cryptography_wrapper.c
+++ b/src/security/core/tests/common/cryptography_wrapper.c
@@ -56,9 +56,16 @@ struct dds_security_cryptography_impl {
   struct dds_security_crypto_key_factory_impl factory_wrap;
   struct dds_security_crypto_key_exchange_impl exchange_wrap;
   enum crypto_plugin_mode mode;
+  bool protection_kinds_set;
+  bool disc_protection_kinds_set;
   DDS_Security_ProtectionKind rtps_protection_kind;
   DDS_Security_ProtectionKind metadata_protection_kind;
   DDS_Security_BasicProtectionKind payload_protection_kind;
+  DDS_Security_ProtectionKind disc_protection_kind;
+  DDS_Security_ProtectionKind liveliness_protection_kind;
+  const char * pp_secret;
+  const char * groupdata_secret;
+  const char * ep_secret;
   const char * encrypted_secret;
 };
 
@@ -74,6 +81,7 @@ void set_protection_kinds(
   impl->rtps_protection_kind = rtps_protection_kind;
   impl->metadata_protection_kind = metadata_protection_kind;
   impl->payload_protection_kind = payload_protection_kind;
+  impl->protection_kinds_set = true;
 }
 
 void set_encrypted_secret(struct dds_security_cryptography_impl * impl, const char * secret)
@@ -82,6 +90,25 @@ void set_encrypted_secret(struct dds_security_cryptography_impl * impl, const ch
   impl->encrypted_secret = secret;
 }
 
+void set_disc_protection_kinds(
+  struct dds_security_cryptography_impl * impl,
+  DDS_Security_ProtectionKind disc_protection_kind,
+  DDS_Security_ProtectionKind liveliness_protection_kind)
+{
+  assert(impl);
+  impl->disc_protection_kind = disc_protection_kind;
+  impl->liveliness_protection_kind = liveliness_protection_kind;
+  impl->disc_protection_kinds_set = true;
+}
+
+void set_entity_data_secret(struct dds_security_cryptography_impl * impl, const char * pp_secret, const char * groupdata_secret, const char * ep_secret)
+{
+  assert(impl);
+  impl->pp_secret = pp_secret;
+  impl->groupdata_secret = groupdata_secret;
+  impl->ep_secret = ep_secret;
+}
+
 static unsigned char * find_buffer_match(const unsigned char *input, size_t input_len, const unsigned char *match, size_t match_len)
 {
   if (match_len <= input_len && match_len > 0 && input_len > 0)
@@ -434,9 +461,11 @@ static DDS_Security_boolean encode_serialized_payload(
       if (!impl->instance->encode_serialized_payload (impl->instance, encoded_buffer,
           extra_inline_qos, plain_buffer, check_handle (sending_datawriter_crypto), ex))
         return false;
-      if (impl->parent->encrypted_secret && (impl->parent->payload_protection_kind == DDS_SECURITY_BASICPROTECTION_KIND_ENCRYPT
-          || expect_encrypted_buffer (impl->parent->metadata_protection_kind)
-          || expect_encrypted_buffer (impl->parent->rtps_protection_kind)))
+      if (impl->parent->protection_kinds_set
+          && impl->parent->encrypted_secret
+          && (impl->parent->payload_protection_kind == DDS_SECURITY_BASICPROTECTION_KIND_ENCRYPT
+              || expect_encrypted_buffer (impl->parent->metadata_protection_kind)
+              || expect_encrypted_buffer (impl->parent->rtps_protection_kind)))
       {
         if (find_buffer_match (encoded_buffer->_buffer, encoded_buffer->_length, (const unsigned char *) impl->parent->encrypted_secret, strlen (impl->parent->encrypted_secret)) != NULL)
         {
@@ -445,7 +474,7 @@ static DDS_Security_boolean encode_serialized_payload(
           return false;
         }
       }
-      return check_buffers (encoded_buffer, plain_buffer, impl->parent->payload_protection_kind == DDS_SECURITY_BASICPROTECTION_KIND_ENCRYPT, ex);
+      return !impl->parent->protection_kinds_set || check_buffers (encoded_buffer, plain_buffer, impl->parent->payload_protection_kind == DDS_SECURITY_BASICPROTECTION_KIND_ENCRYPT, ex);
     }
     default:
       return true;
@@ -458,16 +487,15 @@ static DDS_Security_boolean check_buffer_submsg(
     const DDS_Security_OctetSeq *plain_rtps_submessage,
     DDS_Security_SecurityException *ex)
 {
-  bool exp_enc = expect_encrypted_buffer (impl->parent->metadata_protection_kind) || expect_encrypted_buffer (impl->parent->rtps_protection_kind);
-  if (exp_enc
-      && impl->parent->encrypted_secret
-      && find_buffer_match (encoded_rtps_submessage->_buffer, encoded_rtps_submessage->_length, (const unsigned char *) impl->parent->encrypted_secret, strlen (impl->parent->encrypted_secret)) != NULL)
+  bool exp_enc = impl->parent->protection_kinds_set && (expect_encrypted_buffer (impl->parent->metadata_protection_kind) || expect_encrypted_buffer (impl->parent->rtps_protection_kind));
+  if (exp_enc && impl->parent->encrypted_secret && find_buffer_match (encoded_rtps_submessage->_buffer, encoded_rtps_submessage->_length, (const unsigned char *) impl->parent->encrypted_secret, strlen (impl->parent->encrypted_secret)) != NULL)
   {
     ex->code = 1;
     ex->message = ddsrt_strdup ("Expect encryption, but found secret in submessage after encoding");
     return false;
   }
-  return expect_encrypted_buffer (impl->parent->metadata_protection_kind) ? check_buffers (encoded_rtps_submessage, plain_rtps_submessage, true, ex) : true;
+
+  return impl->parent->protection_kinds_set && expect_encrypted_buffer (impl->parent->metadata_protection_kind) ? check_buffers (encoded_rtps_submessage, plain_rtps_submessage, true, ex) : true;
 }
 
 static DDS_Security_boolean encode_datawriter_submessage(
@@ -486,7 +514,33 @@ static DDS_Security_boolean encode_datawriter_submessage(
       if (!impl->instance->encode_datawriter_submessage (impl->instance, encoded_rtps_submessage,
         plain_rtps_submessage, check_handle (sending_datawriter_crypto), receiving_datareader_crypto_list, receiving_datareader_crypto_list_index, ex))
         return false;
-      return check_buffer_submsg(impl, encoded_rtps_submessage, plain_rtps_submessage, ex);
+      if (!check_buffer_submsg(impl, encoded_rtps_submessage, plain_rtps_submessage, ex))
+        return false;
+
+      if (impl->parent->disc_protection_kinds_set && expect_encrypted_buffer (impl->parent->disc_protection_kind))
+      {
+        if (impl->parent->pp_secret && find_buffer_match (plain_rtps_submessage->_buffer, plain_rtps_submessage->_length, (const unsigned char *) impl->parent->pp_secret, strlen (impl->parent->pp_secret)) != NULL)
+        {
+          ex->code = 1;
+          ex->message = ddsrt_strdup ("Expect discovery encryption, but found participant userdata secret in submessage after encoding");
+          return false;
+        }
+        if (impl->parent->groupdata_secret && find_buffer_match (plain_rtps_submessage->_buffer, plain_rtps_submessage->_length, (const unsigned char *) impl->parent->groupdata_secret, strlen (impl->parent->groupdata_secret)) != NULL)
+        {
+          ex->code = 1;
+          ex->message = ddsrt_strdup ("Expect discovery encryption, but found publisher/subscriber groupdata secret in submessage after encoding");
+          return false;
+        }
+        if (impl->parent->ep_secret && find_buffer_match (plain_rtps_submessage->_buffer, plain_rtps_submessage->_length, (const unsigned char *) impl->parent->ep_secret, strlen (impl->parent->ep_secret)) != NULL)
+        {
+          ex->code = 1;
+          ex->message = ddsrt_strdup ("Expect discovery encryption, but found reader/writer userdata secret in submessage after encoding");
+          return false;
+        }
+      }
+      return true;
+
+
     default:
       return true;
   }
@@ -529,7 +583,8 @@ static DDS_Security_boolean encode_rtps_message(
       if (!impl->instance->encode_rtps_message (impl->instance, encoded_rtps_message,
           plain_rtps_message, check_handle (sending_participant_crypto), receiving_participant_crypto_list, receiving_participant_crypto_list_index, ex))
         return false;
-      if (impl->parent->encrypted_secret
+      if (impl->parent->protection_kinds_set
+          && impl->parent->encrypted_secret
           && expect_encrypted_buffer (impl->parent->rtps_protection_kind)
           && find_buffer_match (encoded_rtps_message->_buffer, encoded_rtps_message->_length, (const unsigned char *) impl->parent->encrypted_secret, strlen (impl->parent->encrypted_secret)) != NULL)
       {
@@ -537,7 +592,7 @@ static DDS_Security_boolean encode_rtps_message(
         ex->message = ddsrt_strdup ("Expect encryption, but found secret in RTPS message after encoding");
         return false;
       }
-      return expect_encrypted_buffer (impl->parent->rtps_protection_kind) ?
+      return impl->parent->protection_kinds_set && expect_encrypted_buffer (impl->parent->rtps_protection_kind) ?
         check_buffers (encoded_rtps_message, plain_rtps_message, true, ex) : true;
     default:
       return true;
diff --git a/src/security/core/tests/common/cryptography_wrapper.h b/src/security/core/tests/common/cryptography_wrapper.h
index 42ed1ef..44e0501 100644
--- a/src/security/core/tests/common/cryptography_wrapper.h
+++ b/src/security/core/tests/common/cryptography_wrapper.h
@@ -26,6 +26,13 @@ SECURITY_EXPORT void set_protection_kinds(
 
 SECURITY_EXPORT void set_encrypted_secret(struct dds_security_cryptography_impl * impl, const char * secret);
 
+SECURITY_EXPORT void set_disc_protection_kinds(
+  struct dds_security_cryptography_impl * impl,
+  DDS_Security_ProtectionKind disc_protection_kind,
+  DDS_Security_ProtectionKind liveliness_protection_kind);
+
+SECURITY_EXPORT void set_entity_data_secret(struct dds_security_cryptography_impl * impl, const char * pp_secret, const char * groupdata_secret, const char * ep_secret);
+
 /* Init in all-ok mode: all functions return success without calling the actual plugin */
 SECURITY_EXPORT int32_t init_test_cryptography_all_ok(const char *argument, void **context);
 SECURITY_EXPORT int32_t finalize_test_cryptography_all_ok(void *context);
diff --git a/src/security/core/tests/common/handshake_test_utils.c b/src/security/core/tests/common/handshake_test_utils.c
index 6d2e494..6385de2 100644
--- a/src/security/core/tests/common/handshake_test_utils.c
+++ b/src/security/core/tests/common/handshake_test_utils.c
@@ -31,6 +31,33 @@ int numRemote = 0;
 struct Handshake handshakeList[MAX_HANDSHAKES];
 int numHandshake = 0;
 
+static char * get_validation_result_str(DDS_Security_ValidationResult_t result)
+{
+  switch (result)
+  {
+    case DDS_SECURITY_VALIDATION_OK: return "OK";
+    case DDS_SECURITY_VALIDATION_PENDING_RETRY: return "PENDING_RETRY";
+    case DDS_SECURITY_VALIDATION_PENDING_HANDSHAKE_REQUEST: return "PENDING_HANDSHAKE_REQUEST";
+    case DDS_SECURITY_VALIDATION_PENDING_HANDSHAKE_MESSAGE: return "PENDING_HANDSHAKE_MESSAGE";
+    case DDS_SECURITY_VALIDATION_OK_FINAL_MESSAGE: return "OK_FINAL_MESSAGE";
+    case DDS_SECURITY_VALIDATION_FAILED: return "FAILED";
+  }
+  abort ();
+  return "";
+}
+
+static char * get_node_type_str(enum hs_node_type node_type)
+{
+  switch (node_type)
+  {
+    case HSN_UNDEFINED: return "UNDEFINED";
+    case HSN_REQUESTER: return "REQUESTER";
+    case HSN_REPLIER: return "REPLIER";
+  }
+  abort ();
+  return "";
+}
+
 static void add_local_identity(DDS_Security_IdentityHandle handle, DDS_Security_GUID_t *guid)
 {
   printf("add local identity %"PRId64"\n", handle);
@@ -77,16 +104,18 @@ static void clear_stores(void)
   numHandshake = 0;
 }
 
-static void add_handshake(DDS_Security_HandshakeHandle handle, int isRequest, DDS_Security_IdentityHandle lHandle, DDS_Security_IdentityHandle rHandle, DDS_Security_ValidationResult_t result)
+static struct Handshake *add_handshake(enum hs_node_type node_type, DDS_Security_IdentityHandle lHandle, DDS_Security_IdentityHandle rHandle)
 {
-  printf("add handshake %"PRId64"\n", handle);
-  handshakeList[numHandshake].handle = handle;
-  handshakeList[numHandshake].isRequest = isRequest;
-  handshakeList[numHandshake].handshakeResult = result;
+  printf("add handshake %"PRId64"-%"PRId64"\n", lHandle, rHandle);
+  handshakeList[numHandshake].handle = -1;
+  handshakeList[numHandshake].node_type = node_type;
+  handshakeList[numHandshake].handshakeResult = DDS_SECURITY_VALIDATION_FAILED;
   handshakeList[numHandshake].lidx = find_local_identity(lHandle);
   handshakeList[numHandshake].ridx = find_remote_identity(rHandle);
   handshakeList[numHandshake].finalResult = DDS_SECURITY_VALIDATION_FAILED;
+  handshakeList[numHandshake].err_msg = NULL;
   numHandshake++;
+  return &handshakeList[numHandshake - 1];
 }
 
 static int find_handshake(DDS_Security_HandshakeHandle handle)
@@ -99,134 +128,144 @@ static int find_handshake(DDS_Security_HandshakeHandle handle)
   return -1;
 }
 
-static char * get_validation_result_str(DDS_Security_ValidationResult_t result)
-{
-  switch (result)
-  {
-    case DDS_SECURITY_VALIDATION_OK:
-      return "ok";
-    case DDS_SECURITY_VALIDATION_PENDING_RETRY:
-      return "pending retry";
-    case DDS_SECURITY_VALIDATION_PENDING_HANDSHAKE_REQUEST:
-      return "handshake request";
-    case DDS_SECURITY_VALIDATION_PENDING_HANDSHAKE_MESSAGE:
-      return "handshake message";
-    case DDS_SECURITY_VALIDATION_OK_FINAL_MESSAGE:
-      return "ok final";
-    default:
-    case DDS_SECURITY_VALIDATION_FAILED:
-      return "failed";
-  }
-}
-
-static bool handle_process_message(dds_domainid_t domain_id, DDS_Security_IdentityHandle handshake)
+static void handle_process_message(dds_domainid_t domain_id, DDS_Security_IdentityHandle handshake)
 {
   struct message *msg;
-  bool result = false;
   if ((msg = test_authentication_plugin_take_msg(domain_id, MESSAGE_KIND_PROCESS_HANDSHAKE, 0, 0, handshake, TIMEOUT)))
   {
     int idx;
     if ((idx = find_handshake(msg->hsHandle)) >= 0)
     {
-      printf("set handshake %"PRId64" final result to '%s'\n", msg->hsHandle, get_validation_result_str(msg->result));
+      printf("set handshake %"PRId64" final result to '%s' (errmsg: %s)\n", msg->hsHandle, get_validation_result_str(msg->result), msg->err_msg);
       handshakeList[idx].finalResult = msg->result;
-      result = true;
+      handshakeList[idx].err_msg = ddsrt_strdup (msg->err_msg);
     }
     test_authentication_plugin_release_msg(msg);
   }
-  return result;
 }
 
-static bool handle_begin_handshake_request(dds_domainid_t domain_id, DDS_Security_IdentityHandle lid, DDS_Security_IdentityHandle rid, char ** err_msg)
+static void handle_begin_handshake_request(dds_domainid_t domain_id, struct Handshake *hs, DDS_Security_IdentityHandle lid, DDS_Security_IdentityHandle rid)
 {
   struct message *msg;
-  bool result = false;
   printf("handle begin handshake request %"PRId64"<->%"PRId64"\n", lid, rid);
   if ((msg = test_authentication_plugin_take_msg(domain_id, MESSAGE_KIND_BEGIN_HANDSHAKE_REQUEST, lid, rid, 0, TIMEOUT)))
   {
-    add_handshake(msg->hsHandle, 1, msg->lidHandle, msg->ridHandle, msg->result);
+    hs->handle = msg->hsHandle;
+    hs->handshakeResult = msg->result;
     if (msg->result != DDS_SECURITY_VALIDATION_FAILED)
-      result = handle_process_message(domain_id, msg->hsHandle);
-    else if (err_msg)
-      *err_msg = ddsrt_strdup (msg->err_msg);
+      handle_process_message(domain_id, msg->hsHandle);
+    else
+      hs->err_msg = ddsrt_strdup (msg->err_msg);
     test_authentication_plugin_release_msg(msg);
   }
-  return result;
 }
 
-static bool handle_begin_handshake_reply(dds_domainid_t domain_id, DDS_Security_IdentityHandle lid, DDS_Security_IdentityHandle rid, char ** err_msg)
+static void handle_begin_handshake_reply(dds_domainid_t domain_id, struct Handshake *hs, DDS_Security_IdentityHandle lid, DDS_Security_IdentityHandle rid)
 {
   struct message *msg;
-  bool result = false;
   printf("handle begin handshake reply %"PRId64"<->%"PRId64"\n", lid, rid);
   if ((msg = test_authentication_plugin_take_msg(domain_id, MESSAGE_KIND_BEGIN_HANDSHAKE_REPLY, lid, rid, 0, TIMEOUT)))
   {
-    add_handshake(msg->hsHandle, 0, msg->lidHandle, msg->ridHandle, msg->result);
+    hs->handle = msg->hsHandle;
+    hs->handshakeResult = msg->result;
     if (msg->result != DDS_SECURITY_VALIDATION_FAILED)
-      result = handle_process_message(domain_id, msg->hsHandle);
-    else if (err_msg)
-      *err_msg = ddsrt_strdup (msg->err_msg);
+      handle_process_message(domain_id, msg->hsHandle);
+    else
+      hs->err_msg = ddsrt_strdup (msg->err_msg);
     test_authentication_plugin_release_msg(msg);
   }
-  return result;
 }
 
-static bool handle_validate_remote_identity(dds_domainid_t domain_id, DDS_Security_IdentityHandle lid, int count, bool * is_hs_requester, char ** err_msg_req, char ** err_msg_reply)
+static void handle_validate_remote_identity(dds_domainid_t domain_id, DDS_Security_IdentityHandle lid, int count)
 {
-  bool result = true;
   struct message *msg;
-  assert(is_hs_requester);
-  while (count-- > 0 && result && (msg = test_authentication_plugin_take_msg(domain_id, MESSAGE_KIND_VALIDATE_REMOTE_IDENTITY, lid, 0, 0, TIMEOUT)))
+  while (count-- > 0 && (msg = test_authentication_plugin_take_msg(domain_id, MESSAGE_KIND_VALIDATE_REMOTE_IDENTITY, lid, 0, 0, TIMEOUT)))
   {
+    struct Handshake *hs;
     add_remote_identity(msg->ridHandle, &msg->rguid);
+    hs = add_handshake(HSN_UNDEFINED, lid, msg->ridHandle);
     if (msg->result == DDS_SECURITY_VALIDATION_PENDING_HANDSHAKE_REQUEST)
     {
-      result = handle_begin_handshake_request(domain_id, lid, msg->ridHandle, err_msg_req);
-      *is_hs_requester = true;
+      hs->node_type = HSN_REQUESTER;
+      handle_begin_handshake_request(domain_id, hs, lid, msg->ridHandle);
     }
     else if (msg->result == DDS_SECURITY_VALIDATION_PENDING_HANDSHAKE_MESSAGE)
     {
-      result = handle_begin_handshake_reply(domain_id, lid, msg->ridHandle, err_msg_reply);
-      *is_hs_requester = false;
+      hs->node_type = HSN_REPLIER;
+      handle_begin_handshake_reply(domain_id, hs, lid, msg->ridHandle);
     }
     else
-      result = false;
-
+    {
+      printf("validate remote failed\n");
+    }
     test_authentication_plugin_release_msg(msg);
   }
-  return result;
 }
 
-void validate_handshake(dds_domainid_t domain_id, bool exp_req_fail, const char * exp_req_msg, bool exp_reply_fail, const char * exp_reply_msg)
+static void handle_validate_local_identity(dds_domainid_t domain_id, bool exp_localid_fail, const char * exp_localid_msg)
+{
+ struct message *msg = test_authentication_plugin_take_msg (domain_id, MESSAGE_KIND_VALIDATE_LOCAL_IDENTITY, 0, 0, 0, TIMEOUT);
+  CU_ASSERT_FATAL (msg != NULL);
+  CU_ASSERT_FATAL ((msg->result == DDS_SECURITY_VALIDATION_OK) != exp_localid_fail);
+  if (exp_localid_fail && exp_localid_msg)
+  {
+    printf("validate_local_identity failed as expected (msg: %s)\n", msg->err_msg);
+    CU_ASSERT_FATAL (msg->err_msg && strstr(msg->err_msg, exp_localid_msg) != NULL);
+  }
+  else
+    add_local_identity (msg->lidHandle, &msg->lguid);
+  test_authentication_plugin_release_msg (msg);
+}
+
+void validate_handshake(dds_domainid_t domain_id, bool exp_localid_fail, const char * exp_localid_msg, struct Handshake *hs_list[], int *nhs)
 {
-  printf("validate handshake for domain %d\n", domain_id);
   clear_stores();
 
-  struct message *msg = test_authentication_plugin_take_msg (domain_id, MESSAGE_KIND_VALIDATE_LOCAL_IDENTITY, 0, 0, 0, TIMEOUT);
-  CU_ASSERT_FATAL (msg != NULL);
-  add_local_identity (msg->lidHandle, &msg->lguid);
-  test_authentication_plugin_release_msg (msg);
-  bool is_requester = false;
-  char * err_msg_req = NULL, *err_msg_reply = NULL;
-  bool ret = handle_validate_remote_identity (domain_id, localIdentityList[0].handle, 1, &is_requester, &err_msg_req, &err_msg_reply);
-  CU_ASSERT_FATAL ((is_requester && ret != exp_req_fail) || (!is_requester && ret != exp_reply_fail));
-  if (ret)
+  if (nhs)
+    *nhs = 0;
+  if (hs_list)
+    *hs_list = NULL;
+
+  handle_validate_local_identity(domain_id, exp_localid_fail, exp_localid_msg);
+  if (!exp_localid_fail)
   {
-    DDS_Security_ValidationResult_t exp_result = is_requester ? DDS_SECURITY_VALIDATION_OK_FINAL_MESSAGE : DDS_SECURITY_VALIDATION_OK;
-    CU_ASSERT_EQUAL_FATAL (handshakeList[0].finalResult, exp_result);
+    handle_validate_remote_identity (domain_id, localIdentityList[0].handle, 1);
+    for (int n = 0; n < numHandshake; n++)
+    {
+      struct Handshake *hs = &handshakeList[n];
+      printf("Result: hs %"PRId64", node type %s, final result %s\n", hs->handle, get_node_type_str(hs->node_type), get_validation_result_str(hs->finalResult));
+      if (hs->err_msg && strlen (hs->err_msg))
+        printf("- err_msg: %s\n", hs->err_msg);
+    }
+    if (nhs)
+      *nhs = numHandshake;
+    if (hs_list)
+      *hs_list = handshakeList;
+    else
+      handshake_list_fini(handshakeList, numHandshake);
   }
-  else if (is_requester && exp_req_msg)
-  {
-    CU_ASSERT_FATAL (err_msg_req && strstr(err_msg_req, exp_req_msg) != NULL);
-  }
-  else if (!is_requester && exp_reply_msg)
-  {
-    CU_ASSERT_FATAL (err_msg_reply && strstr(err_msg_reply, exp_reply_msg) != NULL);
-  }
-  if (err_msg_req)
-    ddsrt_free (err_msg_req);
-  if (err_msg_reply)
-    ddsrt_free (err_msg_reply);
   printf ("finished validate handshake for domain %d\n\n", domain_id);
 }
 
+void validate_handshake_nofail (dds_domainid_t domain_id)
+{
+  struct Handshake *hs_list;
+  int nhs;
+  validate_handshake (domain_id, false, NULL, &hs_list, &nhs);
+  for (int n = 0; n < nhs; n++)
+  {
+    struct Handshake hs = hs_list[n];
+    DDS_Security_ValidationResult_t exp_result = hs.node_type == HSN_REQUESTER ? DDS_SECURITY_VALIDATION_OK_FINAL_MESSAGE : DDS_SECURITY_VALIDATION_OK;
+    CU_ASSERT_EQUAL_FATAL (hs.finalResult, exp_result);
+  }
+  handshake_list_fini (hs_list, nhs);
+}
+
+void handshake_list_fini(struct Handshake *hs_list, int nhs)
+{
+  for (int n = 0; n < nhs; n++)
+  {
+    struct Handshake hs = hs_list[n];
+    ddsrt_free (hs.err_msg);
+  }
+}
\ No newline at end of file
diff --git a/src/security/core/tests/common/handshake_test_utils.h b/src/security/core/tests/common/handshake_test_utils.h
index 9ca8afb..0ae3a59 100644
--- a/src/security/core/tests/common/handshake_test_utils.h
+++ b/src/security/core/tests/common/handshake_test_utils.h
@@ -27,6 +27,13 @@ union guid {
   unsigned u[4];
 };
 
+enum hs_node_type
+{
+  HSN_UNDEFINED,
+  HSN_REQUESTER,
+  HSN_REPLIER
+};
+
 struct Identity
 {
   DDS_Security_IdentityHandle handle;
@@ -36,13 +43,16 @@ struct Identity
 struct Handshake
 {
   DDS_Security_HandshakeHandle handle;
-  int isRequest;
+  enum hs_node_type node_type;
   int lidx;
   int ridx;
   DDS_Security_ValidationResult_t handshakeResult;
   DDS_Security_ValidationResult_t finalResult;
+  char * err_msg;
 };
 
-void validate_handshake(dds_domainid_t domain_id, bool exp_req_fail, const char * exp_req_msg, bool exp_reply_fail, const char * exp_reply_msg);
+void validate_handshake(dds_domainid_t domain_id, bool exp_localid_fail, const char * exp_localid_msg, struct Handshake *hs_list[], int *nhs);
+void validate_handshake_nofail (dds_domainid_t domain_id);
+void handshake_list_fini(struct Handshake *hs_list, int nhs);
 
 #endif /* SECURITY_CORE_HANDSHAKE_TEST_UTILS_H_ */
diff --git a/src/security/core/tests/common/security_config_test_utils.c b/src/security/core/tests/common/security_config_test_utils.c
index c6e939b..ef9f0f8 100644
--- a/src/security/core/tests/common/security_config_test_utils.c
+++ b/src/security/core/tests/common/security_config_test_utils.c
@@ -25,6 +25,7 @@
 #include "dds/ddsrt/expand_vars.h"
 #include "dds/ddsrt/heap.h"
 #include "dds/ddsrt/string.h"
+#include "dds/ddsrt/io.h"
 #include "common/config_env.h"
 #include "security_config_test_utils.h"
 
@@ -59,6 +60,33 @@ static const char *governance_xml =
     "  </domain_access_rules>"
     "</dds>";
 
+static const char *permissions_xml_grant =
+    "    <grant name=\"${GRANT_NAME}\">"
+    "      <subject_name>${SUBJECT_NAME}</subject_name>"
+    "      <validity><not_before>2015-09-15T01:00:00</not_before><not_after>2115-09-15T01:00:00</not_after></validity>"
+    "      <allow_rule>"
+    "        <domains><id_range><min>0</min><max>230</max></id_range></domains>"
+    "        <publish>"
+    "          <topics><topic>*</topic></topics>"
+    "          <partitions><partition>*</partition></partitions>"
+    "        </publish>"
+    "        <subscribe>"
+    "          <topics><topic>*</topic></topics>"
+    "          <partitions><partition>*</partition></partitions>"
+    "        </subscribe>"
+    "      </allow_rule>"
+    "      <default>DENY</default>"
+    "    </grant>";
+
+static const char *permissions_xml =
+    "<?xml version=\"1.0\" encoding=\"utf-8\"?>"
+    "<dds xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" xsi:noNamespaceSchemaLocation=\"https://www.omg.org/spec/DDS-SECURITY/20170901/omg_shared_ca_permissions.xsd\">"
+    "  <permissions>"
+    "    ${GRANTS}"
+    "  </permissions>"
+    "</dds>";
+
+
 const char * expand_lookup_vars(const char *name, void * data)
 {
   struct kvp *vars = (struct kvp *)data;
@@ -157,18 +185,59 @@ static char * smime_sign(char * ca_cert_path, char * ca_priv_key_path, const cha
   return output;
 }
 
-static char *get_signed_governance_data(const char *gov_xml)
+static char *get_signed_data(const char *data)
 {
   return smime_sign (
     COMMON_ETC_PATH("default_permissions_ca.pem"),
     COMMON_ETC_PATH("default_permissions_ca_key.pem"),
-    gov_xml);
+    data);
 }
 
-char * get_governance_config(struct kvp *config_vars)
+static char * prefix_data (char * config_signed, bool add_prefix)
 {
-  char * config = ddsrt_expand_vars(governance_xml, &expand_lookup_vars, config_vars);
-  char * config_signed = get_signed_governance_data(config);
-  ddsrt_free (config);
+  if (add_prefix)
+  {
+    char * tmp = config_signed;
+    ddsrt_asprintf (&config_signed, "data:,%s", tmp);
+    ddsrt_free (tmp);
+  }
   return config_signed;
 }
+
+char * get_governance_config(struct kvp *config_vars, bool add_prefix)
+{
+  char * config = ddsrt_expand_vars (governance_xml, &expand_lookup_vars, config_vars);
+  char * config_signed = get_signed_data (config);
+  ddsrt_free (config);
+  return prefix_data (config_signed, add_prefix);
+}
+
+char * get_permissions_grant(const char * name, const char * subject)
+{
+  struct kvp vars[] = {
+    { "GRANT_NAME", name, 1 },
+    { "SUBJECT_NAME", subject, 1 },
+    { NULL, NULL, 0 }
+  };
+  return ddsrt_expand_vars (permissions_xml_grant, &expand_lookup_vars, vars);
+}
+
+char * get_permissions_config(char * grants[], size_t ngrants, bool add_prefix)
+{
+  char *grants_str = NULL;
+  for (size_t n = 0; n < ngrants; n++)
+  {
+    char * tmp = grants_str;
+    ddsrt_asprintf (&grants_str, "%s%s", grants_str ? grants_str : "", grants[n]);
+    ddsrt_free (tmp);
+  }
+  struct kvp vars[] = {
+    { "GRANTS", grants_str, 1 },
+    { NULL, NULL, 0}
+  };
+  char *config = ddsrt_expand_vars (permissions_xml, &expand_lookup_vars, vars);
+  char *config_signed = get_signed_data (config);
+  ddsrt_free (grants_str);
+  ddsrt_free (config);
+  return prefix_data (config_signed, add_prefix);
+}
diff --git a/src/security/core/tests/common/security_config_test_utils.h b/src/security/core/tests/common/security_config_test_utils.h
index ab14b7f..056b4d5 100644
--- a/src/security/core/tests/common/security_config_test_utils.h
+++ b/src/security/core/tests/common/security_config_test_utils.h
@@ -25,6 +25,8 @@ const char * expand_lookup_vars (const char *name, void * data);
 const char * expand_lookup_vars_env (const char *name, void * data);
 int32_t expand_lookup_unmatched (const struct kvp * lookup_table);
 
-char * get_governance_config (struct kvp *config_vars);
+char * get_governance_config (struct kvp *config_vars, bool add_prefix);
+char * get_permissions_grant(const char * name, const char * subject);
+char * get_permissions_config(char * grants[], size_t ngrants, bool add_prefix);
 
 #endif /* SECURITY_CORE_TEST_SECURITY_CONFIG_TEST_UTILS_H_ */
diff --git a/src/security/core/tests/common/test_identity.h b/src/security/core/tests/common/test_identity.h
index 2fbcd3b..30bb916 100644
--- a/src/security/core/tests/common/test_identity.h
+++ b/src/security/core/tests/common/test_identity.h
@@ -17,7 +17,178 @@
 #define TEST_IDENTITY_PRIVATE_KEY_DUMMY "testtext_PrivateKey_testtext"
 #define TEST_IDENTITY_CA_CERTIFICATE_DUMMY "testtext_IdentityCA_testtext"
 
-#define TEST_IDENTITY_CERTIFICATE "data:,-----BEGIN CERTIFICATE-----\n\
+// Identity CAs
+#define TEST_IDENTITY_CA1_CERTIFICATE "-----BEGIN CERTIFICATE-----\n\
+MIIEYzCCA0ugAwIBAgIUOp5yaGGuh0vaQTZHVPkX5jHoc/4wDQYJKoZIhvcNAQEL\n\
+BQAwgcAxCzAJBgNVBAYTAk5MMQswCQYDVQQIDAJPVjEWMBQGA1UEBwwNTG9jYWxp\n\
+dHkgTmFtZTETMBEGA1UECwwKRXhhbXBsZSBPVTEjMCEGA1UECgwaRXhhbXBsZSBJ\n\
+RCBDQSBPcmdhbml6YXRpb24xFjAUBgNVBAMMDUV4YW1wbGUgSUQgQ0ExOjA4Bgkq\n\
+hkiG9w0BCQEWK2F1dGhvcml0eUBjeWNsb25lZGRzc2VjdXJpdHkuYWRsaW5rdGVj\n\
+aC5jb20wHhcNMjAwMjI3MTkyMjA1WhcNMzAwMjI0MTkyMjA1WjCBwDELMAkGA1UE\n\
+BhMCTkwxCzAJBgNVBAgMAk9WMRYwFAYDVQQHDA1Mb2NhbGl0eSBOYW1lMRMwEQYD\n\
+VQQLDApFeGFtcGxlIE9VMSMwIQYDVQQKDBpFeGFtcGxlIElEIENBIE9yZ2FuaXph\n\
+dGlvbjEWMBQGA1UEAwwNRXhhbXBsZSBJRCBDQTE6MDgGCSqGSIb3DQEJARYrYXV0\n\
+aG9yaXR5QGN5Y2xvbmVkZHNzZWN1cml0eS5hZGxpbmt0ZWNoLmNvbTCCASIwDQYJ\n\
+KoZIhvcNAQEBBQADggEPADCCAQoCggEBALKhk7JXUpqJphyOC6oOI00LH49WTtO2\n\
+GCgDyJhcRYYAm7APMtmEDH+zptvd34N4eSu03Dc65cB/XN4Lbi2TjolVvKz0hHjz\n\
+tzmQT5jTgb1UkJX4NjKGw+RrYe9Ls0kfoAL2kvb12kmd1Oj4TIKMZP9TCrz7Vw8m\n\
+cZKQxZ56bLys6cU2XdiTp3v+Ef/vMll4+DINj4ZAMWL3CkT+q1G6ZxHRpFlsIyhc\n\
+Q1wX6gxUoY6cQdBA7TehKCCEWz4L1KM1A18ZmCHmjTniU0ssLoiAzsQs4b6Fnw8Z\n\
+MLFj8ocwzN5g66gJJWGofakXqX/V24KbGl54WX2X7FYU0tGzR234DXcCAwEAAaNT\n\
+MFEwHQYDVR0OBBYEFGeCcK8B74QWCuuCjlSUzOBBUTF5MB8GA1UdIwQYMBaAFGeC\n\
+cK8B74QWCuuCjlSUzOBBUTF5MA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQEL\n\
+BQADggEBAJQeMc4XzMFnpQKCb58rzRs3Wt9FmZZS4O596sHxMEewTkEHm5gLYMzF\n\
+9JYEdUiLoTurQuIr0KgPi+Q3kliQdLfrVPbdWTmlUDZARR5ir5d1gGHST6qnb3Xi\n\
+mG+7nwle9R/hLrtPio+gYRgwJEiS55f6p0/E1wDcc+6numvjCRQ/CGIiJfwD/R+d\n\
+pv93YLEfuliZttfBc/apIu6OL4chxF+3QgSw1ltV5nXXqDTGHMRZENkp3Yiolumc\n\
+6smL4uA7Q812pVcENi3MLjdJgBS/8DcSBQHspVuXugaKKPDMkJnD0IyLWc8vLXh4\n\
+O7JdDrmusJAZA9RsTkinl3DuPfF34Sk=\n\
+-----END CERTIFICATE-----"
+
+#define TEST_IDENTITY_CA1_PRIVATE_KEY "-----BEGIN RSA PRIVATE KEY-----\n\
+MIIEowIBAAKCAQEAsqGTsldSmommHI4Lqg4jTQsfj1ZO07YYKAPImFxFhgCbsA8y\n\
+2YQMf7Om293fg3h5K7TcNzrlwH9c3gtuLZOOiVW8rPSEePO3OZBPmNOBvVSQlfg2\n\
+MobD5Gth70uzSR+gAvaS9vXaSZ3U6PhMgoxk/1MKvPtXDyZxkpDFnnpsvKzpxTZd\n\
+2JOne/4R/+8yWXj4Mg2PhkAxYvcKRP6rUbpnEdGkWWwjKFxDXBfqDFShjpxB0EDt\n\
+N6EoIIRbPgvUozUDXxmYIeaNOeJTSywuiIDOxCzhvoWfDxkwsWPyhzDM3mDrqAkl\n\
+Yah9qRepf9XbgpsaXnhZfZfsVhTS0bNHbfgNdwIDAQABAoIBAAylo+9cf1yxojEj\n\
+XXAM0DMENpfPZIVYvx0WJ32iCsoSAPPWH6OG1du0vHuUmd6VCP8vLug6I0odulV+\n\
+Oa7AY7cVeuZD6Z0mpDJPJVOMpgLhmdsEV9H7+KKTd7uZgHgM5SdQjdcuUOYlZo2Y\n\
+BtK3Xe810ezPXrqT3jaiSVuPD2PMO/LH3S+MSynHUZdou+NEr0S5FyX7HT2SUvPg\n\
+nEG5KUSE32/1Rnho9BacWKQ/HAoBiS+jMRHOPwu1Q/qS/QLw8HRDEuEoXlVYoNMc\n\
+il0r3M25COZVJVJecBqXHAWZqCBsqmNXs2hU1bh8VVKl/CMkG3W+IAR7XzMmw6bi\n\
+ZYAvgQECgYEA3pIeB8WptYv7hU0I1FZMfyhwLZDRSTZMlObTIXXsdSVKEllBwKAW\n\
+N0G84cyl7q+tOio63tbk1rQRi21O0wTrt16j+0SqDIYy59QhqXhiKAko+nf7cSpy\n\
+8h+k+HF5HpxsxcwYPiwO1SywPJ4TuDLIRHXXqschRzNtATrqCBtNeBsCgYEAzXX5\n\
+cQfMORsg0Z/K0d/U8JLdK0dnqsjwKt+9L7BAGOSv9Xxf4OT+vK3AlzkTUUOztXy7\n\
+3YzpSrHy1Dzu57Dv83BgCFPJxa7jKX4/n+SFYjqxcQVSziQAJjyaa0JsxYkxWC0K\n\
+IXg8MXYcgwHL6k/PYblQCJw8Lgtf8J2DtXhZTdUCgYAvt/4uRmfLX7bObqS8+b+u\n\
+55mde1YTr0ueBRsxKlpHB3apFm/tf6UjtblsY/cThKDMPq+ehU5M5hB45zemMIDl\n\
+MKpRvfgDdWZGpAmPjxrkYIpjoQPM0IASf0xcY9/G+1yqz8ZG1iVb+RfT90RdEq4z\n\
+V1yk5cqxvEnboKj6kff7DwKBgQCXnqbcVZ/MyIs4ho4awO4YNpkGNiR3cN9jFEc9\n\
+aPh0Jlb/drAee37M6AAG2LS7tJVqqcjNXw5N8/G509mNmxIH+Pa1TnfI7R1v4l27\n\
+dd1EtwF44S/RNdnyXaiq3JL+VxbV9i7SsjLhYUL7HplHqWvltuYr5He4luZO3z5x\n\
+7YUhnQKBgHmjhmSEPPxZLjPcYJ/z2opXalPJ5OObJ6nM6X4T5LvfhSnANdeeM6yj\n\
+gigRY8UlnNYzC5iSt17/VuMeta7I8GaVNUu7WU72Q7sYYlrXevdgl/0OFYayXHlB\n\
+sSo6yb9za+C2+5olHEZvs7dIzwDcveoEatds/X4VNrULEwaGbZR0\n\
+-----END RSA PRIVATE KEY-----"
+
+#define TEST_IDENTITY_CA2_CERTIFICATE "-----BEGIN CERTIFICATE-----\n\
+MIIEbTCCA1WgAwIBAgIUL0mSpPRgzveYTJ8UHSmOIwkIjjYwDQYJKoZIhvcNAQEL\n\
+BQAwgcUxCzAJBgNVBAYTAk5MMQswCQYDVQQIDAJPVjEWMBQGA1UEBwwNTG9jYWxp\n\
+dHkgTmFtZTETMBEGA1UECwwKRXhhbXBsZSBPVTElMCMGA1UECgwcRXhhbXBsZSBJ\n\
+RCBDQSAyIE9yZ2FuaXphdGlvbjEYMBYGA1UEAwwPRXhhbXBsZSBJRCBDQSAyMTsw\n\
+OQYJKoZIhvcNAQkBFixhdXRob3JpdHkyQGN5Y2xvbmVkZHNzZWN1cml0eS5hZGxp\n\
+bmt0ZWNoLmNvbTAeFw0yMDAyMjcxNjI3MjRaFw0zMDAyMjQxNjI3MjRaMIHFMQsw\n\
+CQYDVQQGEwJOTDELMAkGA1UECAwCT1YxFjAUBgNVBAcMDUxvY2FsaXR5IE5hbWUx\n\
+EzARBgNVBAsMCkV4YW1wbGUgT1UxJTAjBgNVBAoMHEV4YW1wbGUgSUQgQ0EgMiBP\n\
+cmdhbml6YXRpb24xGDAWBgNVBAMMD0V4YW1wbGUgSUQgQ0EgMjE7MDkGCSqGSIb3\n\
+DQEJARYsYXV0aG9yaXR5MkBjeWNsb25lZGRzc2VjdXJpdHkuYWRsaW5rdGVjaC5j\n\
+b20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDk+ewDf871kPgBqXkm\n\
+UEXdf/vqWWoKx3KfJ4N3Gq4vt/cDOMs0xakpqr5uxm787AvbOui4P8QmT8naLhAA\n\
+TvHtNGg2LV0ZQtLcVVFsXXsBYDUEbLJYmCBtJU8zSfLLzgtN+z9nVqLthAcVyGhZ\n\
+iEkCfXKS4XzwjFUxgrXUM1VSiHHz8DbreQFDTF8mVavZ75HjieuHz1OcSaoIHCIF\n\
+mhPDlxRR/qZpc3Y52NZMNRHVPj4Tmc3N4H2eneeoG7nVn0MgNuqbssezeQtUOOoH\n\
+DgPGp3xzd8XQxaF5hVIM9E7aL77kw5v4gwccjL5xWC72zzxC3c1ltmbaEcwhHGsu\n\
+MR4lAgMBAAGjUzBRMB0GA1UdDgQWBBTTpmGTY5teWrZBA8Sd7kL5Lg/JmjAfBgNV\n\
+HSMEGDAWgBTTpmGTY5teWrZBA8Sd7kL5Lg/JmjAPBgNVHRMBAf8EBTADAQH/MA0G\n\
+CSqGSIb3DQEBCwUAA4IBAQCbelDJr9sVsYgQSp4yzSOSop5DSOWCweBF56NatcbY\n\
+3HUYc4iaH4NcB04WFkUl2XmqVCAM0zbmV0q4HoQikTK5PBHmwxuuD2HhPDWtMeFR\n\
+W96BjzGVpV27yaNIPvLwjTVV+A72r4vRvufiFhrMCovRwlWgHY6+gXKfrtyljTZ0\n\
+m1mENHOJOQWDXFAXP5yiehSMKy/izKvQ1G1hLErYMMc+sdgF/9X2KaudnTakTW0d\n\
+44kXUFKSU7mqV44D12unxCNODclznd31tiJ+70U39AXlR2BzwBzyFzPCh5JYtMog\n\
+TwbdLY3LN40gpkDUxIIH115D7ujUKNd8s2gmSHOCm1ar\n\
+-----END CERTIFICATE-----"
+
+#define TEST_IDENTITY_CA2_PRIVATE_KEY "-----BEGIN RSA PRIVATE KEY-----\n\
+MIIEogIBAAKCAQEA5PnsA3/O9ZD4Aal5JlBF3X/76llqCsdynyeDdxquL7f3AzjL\n\
+NMWpKaq+bsZu/OwL2zrouD/EJk/J2i4QAE7x7TRoNi1dGULS3FVRbF17AWA1BGyy\n\
+WJggbSVPM0nyy84LTfs/Z1ai7YQHFchoWYhJAn1ykuF88IxVMYK11DNVUohx8/A2\n\
+63kBQ0xfJlWr2e+R44nrh89TnEmqCBwiBZoTw5cUUf6maXN2OdjWTDUR1T4+E5nN\n\
+zeB9np3nqBu51Z9DIDbqm7LHs3kLVDjqBw4Dxqd8c3fF0MWheYVSDPRO2i++5MOb\n\
++IMHHIy+cVgu9s88Qt3NZbZm2hHMIRxrLjEeJQIDAQABAoIBABBUirKNMPNujWGA\n\
+9rT20KTFde/2xItUQiZ7qPKbooSguCswp71xw2jHVqGL4WqEYywVfXd2hMS+uASp\n\
+eFatSq/CJxSGE7ezflpcc1wpJpaoh99y6R1MbDOcj5N22KwUW9YJ7zGtih0qZ170\n\
+VgzcnWhiDgPPtRtqxsCrM9CYgKNMGU6M9CFPX3PKDudKVU5fmi9bhtCqQaLhImbs\n\
+aQO3y4yI0af4KSQSur+eqeB/z7V39BEo1LfqaVQd1e9ItEYnTg8TaSaCshS4H8UG\n\
+Yx/pGhnxgn8+5LFL2K635Mb99OLb0hUwIOAbuoAuTlKijit0uGEJe/+DjbkcgZ5d\n\
+VB9I8UECgYEA/56Em8M6N6mTUN3WN+U8NSLltjSIL8kemK30dJ56aUsTiy4h0jNa\n\
+Jda7BeRPQcf9pnQpgFkV7XoKIbfTIqOhqD8XAvJL4//+VMmH2q/R2Xf6e0/CIEUe\n\
+3K74QyRVazx+tt+NOafCwjU9bA7ebjwQVsb+dPAS6kOWxTCZFzCgFk0CgYEA5VE+\n\
+U/C8D9zmJjL1uc4XkBNAg/dQNybQ9DX2Ku5dKME6yg4u7Lxnl3X9asvtQAsUeOPa\n\
+dKGkQ8NZfnSvXYd04n/FTRohFCaYz3RWIbo/q4KCsnJk6uAUM9YFeQGqZdEjO3Mu\n\
+Yk1uhHFl+C4Q/InzYEs+QwtMOS7XVMa5vm6OQzkCgYAR+xKU6ly0AaetLo2dDPD5\n\
+Q+UotfVGdz1BvCrP8T3nHjLXvXz/jkEvHDW3qmGw3OKIzO8Gaj3SoJ0J1iZx71S1\n\
+wwpZWLXh6eX4DN0Tkv6N75SdC/U50+Lh3yTzhCDGFFFNh9glUBmxE5Gogjs/QdZc\n\
+ZE8N5r1N4Uc/w7VhHjiEmQKBgHMA2pQ4P+horRdtKSTEwbZkoU9NYXI3SkWfJlSD\n\
+dD7zISuiD1B0cDNaXfwIR3R92geCpdUmF35QYvpzRFtQioLo9ybiusIjVTF9M5D4\n\
+mePGsQsTKZ9NP3R7mgUEm9MyHkw7SIDOOmW7hRsA503vVRnuwkvXR6PJ5P3EJ/Tj\n\
+9v6pAoGAfVTCJkf0aZ7KjV5GQ33l8uH9dEBzRJ4xOjGpeVBTm+L5N4ejcrQ4p9t0\n\
+JQr8hQHEp7tnHZ9H8DuIIQVDUJdrRa1qO+TNQiOdPLRNofXHuFDNIoj4+bP5ISnL\n\
+dImrEylWjCLbiiOpIbBmAQLb55xYsFzkdRCW3AlmldSVUW96yfU=\n\
+-----END RSA PRIVATE KEY-----"
+
+// Permissions CAs
+#define TEST_PERMISSIONS_CA_CERTIFICATE "-----BEGIN CERTIFICATE-----\n\
+MIIEbzCCA1egAwIBAgIUfoby6818hlJQ+41KUHiM6BZll/0wDQYJKoZIhvcNAQEL\n\
+BQAwgcYxCzAJBgNVBAYTAk5MMQswCQYDVQQIDAJPVjEWMBQGA1UEBwwNTG9jYWxp\n\
+dHkgTmFtZTETMBEGA1UECwwKRXhhbXBsZSBPVTEgMB4GA1UECgwXRXhhbXBsZSBD\n\
+QSBPcmdhbml6YXRpb24xHzAdBgNVBAMMFkV4YW1wbGUgUGVybWlzc2lvbnMgQ0Ex\n\
+OjA4BgkqhkiG9w0BCQEWK2F1dGhvcml0eUBjeWNsb25lZGRzc2VjdXJpdHkuYWRs\n\
+aW5rdGVjaC5jb20wHhcNMjAwMjI3MTM0ODA5WhcNMzAwMjI0MTM0ODA5WjCBxjEL\n\
+MAkGA1UEBhMCTkwxCzAJBgNVBAgMAk9WMRYwFAYDVQQHDA1Mb2NhbGl0eSBOYW1l\n\
+MRMwEQYDVQQLDApFeGFtcGxlIE9VMSAwHgYDVQQKDBdFeGFtcGxlIENBIE9yZ2Fu\n\
+aXphdGlvbjEfMB0GA1UEAwwWRXhhbXBsZSBQZXJtaXNzaW9ucyBDQTE6MDgGCSqG\n\
+SIb3DQEJARYrYXV0aG9yaXR5QGN5Y2xvbmVkZHNzZWN1cml0eS5hZGxpbmt0ZWNo\n\
+LmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBANNWwyrW3J+TCyaZ\n\
+H77q+29GGqFsYP5rv9cpcL/TMDNccsPYY+1RA1K+zMRYo1LG8VdJNtJlhxE+tmEb\n\
+KxsVUTtoj8zbLVU4P4g0gIh6U7LMv5lUEZ3XYKWvYrbZTFMof2rXQYGXPO7pFnvb\n\
+NAbnMiLmagRKxKJ91kq4utuMG3U6rkCA7i2S8cEISNO3gIpFa0IZJ8yS8wDlKa/L\n\
+GxL90BYasLsSA6tw/69OIiUUYqpMRD+xxyyTkMO37VjmdiFLHa/dxO8HH0t3Q0U0\n\
+AgZP9uwYTgZpN+2UEFnjv3BDIydc3Wa0UaSdxLtHXMPvg3sRuH9CTqr4Le7/3uTY\n\
+ehYKgd0CAwEAAaNTMFEwHQYDVR0OBBYEFFi4pK986ZSB0BLiMm8ivu6AUxYPMB8G\n\
+A1UdIwQYMBaAFFi4pK986ZSB0BLiMm8ivu6AUxYPMA8GA1UdEwEB/wQFMAMBAf8w\n\
+DQYJKoZIhvcNAQELBQADggEBAHYLaJVWrLHg+62jC8yIz9dbECIroX9Gb7Ll937H\n\
+Mum6Hj4wlImrifMVV3iORWBrBLvtTtn0Zno3mwfjLRQtkjOih71eJT+6//B7CT7n\n\
+oULJYVq8IRGErbKtmXULnxTajFApzO0v4hSu7rWj/Jfhil0TX7QgKNpgKzjYodWz\n\
+3oGGtchxvw3+v9wdIWD5Cj0bk/VMCQCaBV0anvyga7d4k8/zPF7nW2Z9jNfKsVD1\n\
+piFa+Yd4zN6XOPPKiFXfLD7ht9i2gG25iS+d95tKg1DfjnRD7u0BJSOAPerxGtN/\n\
+wf43qY1XzUoE2FBJ9QJGOA/02ffaUMOwSzICF/ShctH+Knk=\n\
+-----END CERTIFICATE-----"
+
+#define TEST_PERMISSIONS_CA_PRIVATE_KEY "-----BEGIN RSA PRIVATE KEY-----\n\
+MIIEpAIBAAKCAQEA01bDKtbcn5MLJpkfvur7b0YaoWxg/mu/1ylwv9MwM1xyw9hj\n\
+7VEDUr7MxFijUsbxV0k20mWHET62YRsrGxVRO2iPzNstVTg/iDSAiHpTssy/mVQR\n\
+nddgpa9ittlMUyh/atdBgZc87ukWe9s0BucyIuZqBErEon3WSri624wbdTquQIDu\n\
+LZLxwQhI07eAikVrQhknzJLzAOUpr8sbEv3QFhqwuxIDq3D/r04iJRRiqkxEP7HH\n\
+LJOQw7ftWOZ2IUsdr93E7wcfS3dDRTQCBk/27BhOBmk37ZQQWeO/cEMjJ1zdZrRR\n\
+pJ3Eu0dcw++DexG4f0JOqvgt7v/e5Nh6FgqB3QIDAQABAoIBABFHMKGZ+2OYc/rt\n\
+3eiP8YqBYr/7ylpCmOaQXsVwEKrCTiew00qdqvXi337V+FRWK3kFZVQCNO61/9ck\n\
+j3uhXIjM3aTT7nrfJGKQWEnQJnOhxbBVbTNIXoBtPFbSoSjTUMd9Xb+oi7TEna/2\n\
+leRSloi/6b78FeNrAlANlklIxR3qTjRSxjGYVfukCWsKq3uFfWM4Wp9N1B1gsyRo\n\
+/SH2jOu0XTLNdajggtBKcFoqxVIiaetERKVRRid7pW0zwuYS5Zwv5Wtl3XMbUuAn\n\
+VGesMeCKAGpwkLjmvXKBE5setnd7cWBKdVKddYDkzbDvU7X6QEHFnac6m6OQ2P62\n\
+QfkO94ECgYEA70tV55AreDnPQEpf698ZjA8pYvF90GfGx/Y4oYWU/s0IlD6Pfbsr\n\
+qkRu+1I+SUNZWARhirXmJzuOmJYUQRteCEq+6RPJzn5Jl9MtipOBAjI0h589dbAB\n\
+8m/BRk+bEZKCXLgVa0TyZ/gd/wDBxB+qd+bPep8nAl4krMWK9W1+DLECgYEA4hfP\n\
+EwUPMwHrGlq0oRUA08ssQ8XxVCKWeS3cLAJjO6EdJyIUm/8S/UZPBPeSkGyZeld+\n\
+fY7z9ZV0HA338p5BYYDCqgJC6b5Ud5UV0yLkq01v6b0H3nSjTPcbA61l9laN0vhm\n\
+QJ/xTiAHgsGBbOx2VtwDoE8T1AbAaamcapqNYu0CgYAXCiPdRc5JpxdDU2Xk6fgl\n\
+uhf8BNBeTn+fJR/SvW/ZEJiw3U0nh+vuWuRsokCJAUkK5nEVz+m3AU77dgfBNQda\n\
+uQeknVki3pnrWlPaMdWMBpV0MWrTd/zYANaVFHkTug1/K+I0D9FfHU6WDNabMYlS\n\
+PhDf947j9XiGggadFsu6IQKBgQC6dgpIVFbZqU5cuMvZQToicaA68Kd7zN6uZ7z5\n\
+6qouRkyFtpyqnq3pha+rmAYe6AGXnUrrgBcAxdYxQO/o/s1K/WcN0LmgjmCZErIi\n\
+I9fU0xNmAIjZ1PXMhsqXuMyrYWyrvkKOL5pR5SZsluwHieh68A5pim3+4eaT/dbL\n\
+MFVEbQKBgQDfkeApSfKATXJpYIV/tiGjmRkkYoZ6NVar92npjlb72jaA4V0gHmuD\n\
+9ttypXOJPB/5zMa5uL6drp3CLv/GcWekUiUUXuyKQpcxZWqxf/leh9gTgGDAH/k4\n\
+4+zX4HLEzTmoOc0cqzi4w6pTIj29BOV5QpnnyUGyvj8NGNSdFvZFSQ==\n\
+-----END RSA PRIVATE KEY-----"
+
+
+// Identities
+
+// created with TEST_IDENTITY_CA1_CERTIFICATE
+#define TEST_IDENTITY1_CERTIFICATE "-----BEGIN CERTIFICATE-----\n\
 MIIEDTCCAvUCFHZ4yXyk/9yeMxgHs6Ib0bLKhXYuMA0GCSqGSIb3DQEBCwUAMIHA\n\
 MQswCQYDVQQGEwJOTDELMAkGA1UECAwCT1YxFjAUBgNVBAcMDUxvY2FsaXR5IE5h\n\
 bWUxEzARBgNVBAsMCkV4YW1wbGUgT1UxIzAhBgNVBAoMGkV4YW1wbGUgSUQgQ0Eg\n\
@@ -42,7 +213,7 @@ VwzWIaZ06idvCtPKTfP71jJypV3+I2g5PNqranbuMv5nNAKZq1QlSB07f2Z1VIu6\n\
 6jeSZSADfm73qnE2Kj1PiZkPn0Wu+K24GXCvdILATcUS\n\
 -----END CERTIFICATE-----"
 
-#define TEST_IDENTITY_PRIVATE_KEY "data:,-----BEGIN RSA PRIVATE KEY-----\n\
+#define TEST_IDENTITY1_PRIVATE_KEY "-----BEGIN RSA PRIVATE KEY-----\n\
 MIIEpQIBAAKCAQEA5mEhLZIP2ko1bRJyJCwbnvhIpXFv6GOhnvuS5v8tsTju40O6\n\
 2NNQmKT/my1QVKiUu7OoWZtLNBebgxgJ851eQ4TBRXy/f2jGkLPYM22dohLTblVC\n\
 pGutn+Itw3QRM3nkne7Sk8O6FP6NH6Y+7gkjxy5kI3GvhuICuBIzAV4dHK+hPlCn\n\
@@ -71,35 +242,8 @@ yNw1+km1Zy6EWdFEMciEFlbRwWVmDfE/um9LZsSWbmuWAOTww9GBDhc=\n\
 -----END RSA PRIVATE KEY-----"
 
 
-#define TEST_IDENTITY_CA_CERTIFICATE "data:,-----BEGIN CERTIFICATE-----\n\
-MIIEYzCCA0ugAwIBAgIUOp5yaGGuh0vaQTZHVPkX5jHoc/4wDQYJKoZIhvcNAQEL\n\
-BQAwgcAxCzAJBgNVBAYTAk5MMQswCQYDVQQIDAJPVjEWMBQGA1UEBwwNTG9jYWxp\n\
-dHkgTmFtZTETMBEGA1UECwwKRXhhbXBsZSBPVTEjMCEGA1UECgwaRXhhbXBsZSBJ\n\
-RCBDQSBPcmdhbml6YXRpb24xFjAUBgNVBAMMDUV4YW1wbGUgSUQgQ0ExOjA4Bgkq\n\
-hkiG9w0BCQEWK2F1dGhvcml0eUBjeWNsb25lZGRzc2VjdXJpdHkuYWRsaW5rdGVj\n\
-aC5jb20wHhcNMjAwMjI3MTkyMjA1WhcNMzAwMjI0MTkyMjA1WjCBwDELMAkGA1UE\n\
-BhMCTkwxCzAJBgNVBAgMAk9WMRYwFAYDVQQHDA1Mb2NhbGl0eSBOYW1lMRMwEQYD\n\
-VQQLDApFeGFtcGxlIE9VMSMwIQYDVQQKDBpFeGFtcGxlIElEIENBIE9yZ2FuaXph\n\
-dGlvbjEWMBQGA1UEAwwNRXhhbXBsZSBJRCBDQTE6MDgGCSqGSIb3DQEJARYrYXV0\n\
-aG9yaXR5QGN5Y2xvbmVkZHNzZWN1cml0eS5hZGxpbmt0ZWNoLmNvbTCCASIwDQYJ\n\
-KoZIhvcNAQEBBQADggEPADCCAQoCggEBALKhk7JXUpqJphyOC6oOI00LH49WTtO2\n\
-GCgDyJhcRYYAm7APMtmEDH+zptvd34N4eSu03Dc65cB/XN4Lbi2TjolVvKz0hHjz\n\
-tzmQT5jTgb1UkJX4NjKGw+RrYe9Ls0kfoAL2kvb12kmd1Oj4TIKMZP9TCrz7Vw8m\n\
-cZKQxZ56bLys6cU2XdiTp3v+Ef/vMll4+DINj4ZAMWL3CkT+q1G6ZxHRpFlsIyhc\n\
-Q1wX6gxUoY6cQdBA7TehKCCEWz4L1KM1A18ZmCHmjTniU0ssLoiAzsQs4b6Fnw8Z\n\
-MLFj8ocwzN5g66gJJWGofakXqX/V24KbGl54WX2X7FYU0tGzR234DXcCAwEAAaNT\n\
-MFEwHQYDVR0OBBYEFGeCcK8B74QWCuuCjlSUzOBBUTF5MB8GA1UdIwQYMBaAFGeC\n\
-cK8B74QWCuuCjlSUzOBBUTF5MA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQEL\n\
-BQADggEBAJQeMc4XzMFnpQKCb58rzRs3Wt9FmZZS4O596sHxMEewTkEHm5gLYMzF\n\
-9JYEdUiLoTurQuIr0KgPi+Q3kliQdLfrVPbdWTmlUDZARR5ir5d1gGHST6qnb3Xi\n\
-mG+7nwle9R/hLrtPio+gYRgwJEiS55f6p0/E1wDcc+6numvjCRQ/CGIiJfwD/R+d\n\
-pv93YLEfuliZttfBc/apIu6OL4chxF+3QgSw1ltV5nXXqDTGHMRZENkp3Yiolumc\n\
-6smL4uA7Q812pVcENi3MLjdJgBS/8DcSBQHspVuXugaKKPDMkJnD0IyLWc8vLXh4\n\
-O7JdDrmusJAZA9RsTkinl3DuPfF34Sk=\n\
------END CERTIFICATE-----"
-
-
-#define TEST_IDENTITY2_CERTIFICATE "data:,-----BEGIN CERTIFICATE-----\n\
+// created with TEST_IDENTITY_CA2_CERTIFICATE
+#define TEST_IDENTITY2_CERTIFICATE "-----BEGIN CERTIFICATE-----\n\
 MIIEDjCCAvYCFDEZQzcfGKK8IKNyH+AdNSjdyVgnMA0GCSqGSIb3DQEBCwUAMIHF\n\
 MQswCQYDVQQGEwJOTDELMAkGA1UECAwCT1YxFjAUBgNVBAcMDUxvY2FsaXR5IE5h\n\
 bWUxEzARBgNVBAsMCkV4YW1wbGUgT1UxJTAjBgNVBAoMHEV4YW1wbGUgSUQgQ0Eg\n\
@@ -124,7 +268,7 @@ AuPUgPJObxJhxJSC4p5qy37pYZHiNH1wG/+BDHgZo3wNwFsWqxabKziGB8XU3INc\n\
 USI3GDWM2jjElMSnDCj4ChM5wFbwWrqwdOEzeGWBWbo3hQ==\n\
 -----END CERTIFICATE-----"
 
-#define TEST_IDENTITY2_PRIVATE_KEY "data:,-----BEGIN RSA PRIVATE KEY-----\n\
+#define TEST_IDENTITY2_PRIVATE_KEY "-----BEGIN RSA PRIVATE KEY-----\n\
 MIIEpQIBAAKCAQEAwBAz143TONNN1kAsJOKOiDSirH+SqdZW1VaNX9zfg7I+9S4f\n\
 8M1EfoKvR8jvpSKigsP2d+8d7nZfyhkfxao1bubuDt0yWK4MkPfJWl0tGZNOCXjQ\n\
 RLwxOqZ1vbLy63vQwl/mdTPQRCz2Ve+dPSu7QHYJ/K5uI+1otJ/IOhUGREtt/N6p\n\
@@ -153,32 +297,58 @@ mi1HgIUzXZTRBNamYCltJWYnN0hOlSL6vcHgeJ9y1gSDh0QqB2BG8HY=\n\
 -----END RSA PRIVATE KEY-----"
 
 
-#define TEST_IDENTITY_CA2_CERTIFICATE "data:,-----BEGIN CERTIFICATE-----\n\
-MIIEbTCCA1WgAwIBAgIUL0mSpPRgzveYTJ8UHSmOIwkIjjYwDQYJKoZIhvcNAQEL\n\
-BQAwgcUxCzAJBgNVBAYTAk5MMQswCQYDVQQIDAJPVjEWMBQGA1UEBwwNTG9jYWxp\n\
-dHkgTmFtZTETMBEGA1UECwwKRXhhbXBsZSBPVTElMCMGA1UECgwcRXhhbXBsZSBJ\n\
-RCBDQSAyIE9yZ2FuaXphdGlvbjEYMBYGA1UEAwwPRXhhbXBsZSBJRCBDQSAyMTsw\n\
-OQYJKoZIhvcNAQkBFixhdXRob3JpdHkyQGN5Y2xvbmVkZHNzZWN1cml0eS5hZGxp\n\
-bmt0ZWNoLmNvbTAeFw0yMDAyMjcxNjI3MjRaFw0zMDAyMjQxNjI3MjRaMIHFMQsw\n\
-CQYDVQQGEwJOTDELMAkGA1UECAwCT1YxFjAUBgNVBAcMDUxvY2FsaXR5IE5hbWUx\n\
-EzARBgNVBAsMCkV4YW1wbGUgT1UxJTAjBgNVBAoMHEV4YW1wbGUgSUQgQ0EgMiBP\n\
-cmdhbml6YXRpb24xGDAWBgNVBAMMD0V4YW1wbGUgSUQgQ0EgMjE7MDkGCSqGSIb3\n\
-DQEJARYsYXV0aG9yaXR5MkBjeWNsb25lZGRzc2VjdXJpdHkuYWRsaW5rdGVjaC5j\n\
-b20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDk+ewDf871kPgBqXkm\n\
-UEXdf/vqWWoKx3KfJ4N3Gq4vt/cDOMs0xakpqr5uxm787AvbOui4P8QmT8naLhAA\n\
-TvHtNGg2LV0ZQtLcVVFsXXsBYDUEbLJYmCBtJU8zSfLLzgtN+z9nVqLthAcVyGhZ\n\
-iEkCfXKS4XzwjFUxgrXUM1VSiHHz8DbreQFDTF8mVavZ75HjieuHz1OcSaoIHCIF\n\
-mhPDlxRR/qZpc3Y52NZMNRHVPj4Tmc3N4H2eneeoG7nVn0MgNuqbssezeQtUOOoH\n\
-DgPGp3xzd8XQxaF5hVIM9E7aL77kw5v4gwccjL5xWC72zzxC3c1ltmbaEcwhHGsu\n\
-MR4lAgMBAAGjUzBRMB0GA1UdDgQWBBTTpmGTY5teWrZBA8Sd7kL5Lg/JmjAfBgNV\n\
-HSMEGDAWgBTTpmGTY5teWrZBA8Sd7kL5Lg/JmjAPBgNVHRMBAf8EBTADAQH/MA0G\n\
-CSqGSIb3DQEBCwUAA4IBAQCbelDJr9sVsYgQSp4yzSOSop5DSOWCweBF56NatcbY\n\
-3HUYc4iaH4NcB04WFkUl2XmqVCAM0zbmV0q4HoQikTK5PBHmwxuuD2HhPDWtMeFR\n\
-W96BjzGVpV27yaNIPvLwjTVV+A72r4vRvufiFhrMCovRwlWgHY6+gXKfrtyljTZ0\n\
-m1mENHOJOQWDXFAXP5yiehSMKy/izKvQ1G1hLErYMMc+sdgF/9X2KaudnTakTW0d\n\
-44kXUFKSU7mqV44D12unxCNODclznd31tiJ+70U39AXlR2BzwBzyFzPCh5JYtMog\n\
-TwbdLY3LN40gpkDUxIIH115D7ujUKNd8s2gmSHOCm1ar\n\
+// created with TEST_IDENTITY_CA1_CERTIFICATE
+#define TEST_IDENTITY3_CERTIFICATE "-----BEGIN CERTIFICATE-----\n\
+MIIEDTCCAvUCFHZ4yXyk/9yeMxgHs6Ib0bLKhXYvMA0GCSqGSIb3DQEBCwUAMIHA\n\
+MQswCQYDVQQGEwJOTDELMAkGA1UECAwCT1YxFjAUBgNVBAcMDUxvY2FsaXR5IE5h\n\
+bWUxEzARBgNVBAsMCkV4YW1wbGUgT1UxIzAhBgNVBAoMGkV4YW1wbGUgSUQgQ0Eg\n\
+T3JnYW5pemF0aW9uMRYwFAYDVQQDDA1FeGFtcGxlIElEIENBMTowOAYJKoZIhvcN\n\
+AQkBFithdXRob3JpdHlAY3ljbG9uZWRkc3NlY3VyaXR5LmFkbGlua3RlY2guY29t\n\
+MB4XDTIwMDMwNTEzMTczN1oXDTMwMDMwMzEzMTczN1owgcQxCzAJBgNVBAYTAk5M\n\
+MQswCQYDVQQIDAJPVjEWMBQGA1UEBwwNTG9jYWxpdHkgTmFtZTEhMB8GA1UECwwY\n\
+T3JnYW5pemF0aW9uYWwgVW5pdCBOYW1lMR0wGwYDVQQKDBRFeGFtcGxlIE9yZ2Fu\n\
+aXphdGlvbjEWMBQGA1UEAwwNQ2Fyb2wgRXhhbXBsZTE2MDQGCSqGSIb3DQEJARYn\n\
+Y2Fyb2xAY3ljbG9uZWRkc3NlY3VyaXR5LmFkbGlua3RlY2guY29tMIIBIjANBgkq\n\
+hkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA0QduVwXptfjiwkvbn5aXuIpwZ9aWOqmj\n\
+e36qNknnS0mng1zPhzi4RLAl6CUxa6E5bkfjGZxFfYefDNk3ynzerEotFa1f5++b\n\
+aY73hs2ecfz+9ofjqR2fsroxOFwFF9JLbeWTDPS2mf5yE0Ci2+ctq6Ep4jDeHNui\n\
+WpSOY8OoIEWq4PD/R/VGJSiHSG+OjOUN7gwuxta0yglFeyHBdzr8mDZiejj1KYBD\n\
+AzuQrtaibHNtGBo3VGFvPKs85mK/Swv1GoXxcy1uBU1Yup9JLq3Ds8R5YYecSlXk\n\
+77EmZl4dgoScbt4NKTPuo8t803Ph3PYQCggILhlaEwjpfd1YTFLxOQIDAQABMA0G\n\
+CSqGSIb3DQEBCwUAA4IBAQAtV57Zc5dV9+z51zTOtghNZrFGJ48xJhnXddMVJ1Yh\n\
+08uoODRSRJHXNxMrlSRMeZ+CNkvd/QmqzOYvok3EqusOXFNU9qfmc3DToU/DDqkf\n\
+PMEpc9lPLTjmm6MfQgjyT5pDDNPUV9Io1s2o492ozr87ULyVf6I2bNu2NnVv2IzE\n\
+j9Mz/L7TkcgJgbdDl+21CR3NRA1PpxFB/PcM+zy4C2XoFv/qcF5pkcBpkyNjva9m\n\
+xmjSJWMoIVzXk6apPsRGCJLFJ3uuj+9K6POo/xgAkrbgvZF0i0yAJSTvSQmg6x2S\n\
+FMxE89kC7Npg+fQF15aaNEn4tuQiz0WW9pq1wSTXjoqj\n\
 -----END CERTIFICATE-----"
 
+#define TEST_IDENTITY3_PRIVATE_KEY "-----BEGIN RSA PRIVATE KEY-----\n\
+MIIEpAIBAAKCAQEA0QduVwXptfjiwkvbn5aXuIpwZ9aWOqmje36qNknnS0mng1zP\n\
+hzi4RLAl6CUxa6E5bkfjGZxFfYefDNk3ynzerEotFa1f5++baY73hs2ecfz+9ofj\n\
+qR2fsroxOFwFF9JLbeWTDPS2mf5yE0Ci2+ctq6Ep4jDeHNuiWpSOY8OoIEWq4PD/\n\
+R/VGJSiHSG+OjOUN7gwuxta0yglFeyHBdzr8mDZiejj1KYBDAzuQrtaibHNtGBo3\n\
+VGFvPKs85mK/Swv1GoXxcy1uBU1Yup9JLq3Ds8R5YYecSlXk77EmZl4dgoScbt4N\n\
+KTPuo8t803Ph3PYQCggILhlaEwjpfd1YTFLxOQIDAQABAoIBAGSpyHh+L3vj/QgG\n\
+0iB7vFsxyEopbDWaBlHtwPjeBFYchWBcrNB4/zyM++RdLPyhKvAyDGsD9+8pBe6B\n\
+GT4Zfn7IRgf/c4VVvalLIWc41IoehYaiEIAb9RF0W0nB/u3m505oVbXSj7F/eN5O\n\
+rV9raHIT7gCw+fY5y2kFy8C9s9S9+VzzYOzIZPWSh6Plc/eI2niSVt+MDufDeVOR\n\
+Ug6Z54lpXkwqv0Pz8F7ELyRGBvUW5UAvgyprvXgSYz1VNeHr3fmLX/O4rGktk02x\n\
+bAFxvaNV/JEK1fLFWLZ8TJVGsni+uYu/zkvXdxw7gphdoM77UKeZ00udg7orYUhW\n\
+6MwsuRUCgYEA7KzanZVPfbL4TMCpS6EJUO8H9lebH0srzqKNJD3/NL2JPebRNjZA\n\
+niH6vXD773/8IYlFTAXe0npVApZETKVzP4LNvsSVtjNvqXKdRM0cT47Dc4Y16kn/\n\
+X9Pd/ff+HH93T8Pcpguovw8QU7nxlf5dCvlnWrCj84Dw1ZToS2NLWAcCgYEA4hiy\n\
+nz6xvbkkUc5oHWxJIHxSLrOvMsyLMNp9UlUxgrxGqth0yQsFZwinPzs/y8aUVKyi\n\
+bHJlL35fpHeuna0V054E5vyeOOM7eLLFToDITS1m91hsl6amMW8iup/HTZhSemt7\n\
+tEn4mWlINXyP47MWfOr4oQ1KDzDCA3JFfzjInL8CgYBRulL3zcKYbn/tyS3s7twP\n\
+taszNwdbJBMplNpWZI5HQRguZxFhvhRMRwGV/3kQOErxrbxfRzutxQ6sCQXmzc9h\n\
+ZCL2OF5Wf6aUhf6m7olTM8JslzDxCcKE7d2fwM5gOugRhFoigK4x49rIftJc8Gxi\n\
+yMMW/x5ujN0ddAFPXyd6awKBgQCypX8lsnzwgsR+2w+LCA+z2md5PULWaaYlgM36\n\
+6xPG0AsqXQPSAqJPKhg0LxWWZp63VPy1oaHv5/OcWXCgZ63SWo5XEQ3Xtzw7f03F\n\
+XJ5n1NMB511Oaj/w2XZgbXUmC5BH6HuDFduXJAgJMxXifZPsOiEf6Ac3f3gdDwJ4\n\
+pp5kswKBgQDNUI3uzqw8J3e81tTAn2U8eyHuQxi8swv6K4Dx+sqCKpxkFcYvDLQl\n\
+qI+v234hvmZN3CmGPCY01aZl3NUUFKx9fvwweYG/vicCsA2XKwnmaSWTTrT62vlY\n\
+S1cWlJlUjw59ZhAqgD1pe4r0suRQ6e1OT/pByTKz1BxE/lwZftpauA==\n\
+-----END RSA PRIVATE KEY-----"
 
 #endif /* PLUGIN_SECURITY_CORE_TEST_IDENTITY_H_ */
diff --git a/src/security/core/tests/handshake.c b/src/security/core/tests/handshake.c
index 5534434..62ca589 100644
--- a/src/security/core/tests/handshake.c
+++ b/src/security/core/tests/handshake.c
@@ -43,9 +43,9 @@ static const char *config =
     "  <DDSSecurity>"
     "    <Authentication>"
     "      <Library finalizeFunction=\"finalize_test_authentication_wrapped\" initFunction=\"init_test_authentication_wrapped\" path=\"" WRAPPERLIB_PATH("dds_security_authentication_wrapper") "\"/>"
-    "      <IdentityCertificate>"TEST_IDENTITY_CERTIFICATE"</IdentityCertificate>"
-    "      <PrivateKey>"TEST_IDENTITY_PRIVATE_KEY"</PrivateKey>"
-    "      <IdentityCA>"TEST_IDENTITY_CA_CERTIFICATE"</IdentityCA>"
+    "      <IdentityCertificate>data:,"TEST_IDENTITY1_CERTIFICATE"</IdentityCertificate>"
+    "      <PrivateKey>data:,"TEST_IDENTITY1_PRIVATE_KEY"</PrivateKey>"
+    "      <IdentityCA>data:,"TEST_IDENTITY_CA1_CERTIFICATE"</IdentityCA>"
     "    </Authentication>"
     "    <AccessControl>"
     "      <Library finalizeFunction=\"finalize_access_control\" initFunction=\"init_access_control\"/>"
@@ -91,6 +91,6 @@ static void handshake_fini(void)
 
 CU_Test(ddssec_handshake, happy_day, .init = handshake_init, .fini = handshake_fini)
 {
-  validate_handshake (DDS_DOMAINID_PART1, false, NULL, false, NULL);
-  validate_handshake (DDS_DOMAINID_PART2, false, NULL, false, NULL);
+  validate_handshake_nofail (DDS_DOMAINID_PART1);
+  validate_handshake_nofail (DDS_DOMAINID_PART2);
 }
diff --git a/src/security/core/tests/secure_communication.c b/src/security/core/tests/secure_communication.c
index 10769e0..7ed18b5 100644
--- a/src/security/core/tests/secure_communication.c
+++ b/src/security/core/tests/secure_communication.c
@@ -59,9 +59,9 @@ static const char *config =
     "  <DDSSecurity>"
     "    <Authentication>"
     "      <Library finalizeFunction=\"finalize_authentication\" initFunction=\"init_authentication\" />"
-    "      <IdentityCertificate>"TEST_IDENTITY_CERTIFICATE"</IdentityCertificate>"
-    "      <PrivateKey>"TEST_IDENTITY_PRIVATE_KEY"</PrivateKey>"
-    "      <IdentityCA>"TEST_IDENTITY_CA_CERTIFICATE"</IdentityCA>"
+    "      <IdentityCertificate>data:,"TEST_IDENTITY1_CERTIFICATE"</IdentityCertificate>"
+    "      <PrivateKey>data:,"TEST_IDENTITY1_PRIVATE_KEY"</PrivateKey>"
+    "      <IdentityCA>data:,"TEST_IDENTITY_CA1_CERTIFICATE"</IdentityCA>"
     "      <Password></Password>"
     "      <TrustedCADirectory>.</TrustedCADirectory>"
     "    </Authentication>"
@@ -89,6 +89,10 @@ const char * g_pk_encrypt = "ENCRYPT";
 const char * g_pk_sign_oa = "SIGN_WITH_ORIGIN_AUTHENTICATION";
 const char * g_pk_encrypt_oa = "ENCRYPT_WITH_ORIGIN_AUTHENTICATION";
 
+const char * g_pp_secret = "ppsecret";
+const char * g_groupdata_secret = "groupsecret";
+const char * g_ep_secret = "epsecret";
+
 uint32_t g_topic_nr = 0;
 
 static dds_entity_t g_pub_domains[MAX_DOMAINS];
@@ -106,6 +110,9 @@ struct domain_sec_config {
   DDS_Security_ProtectionKind metadata_pk;
   DDS_Security_BasicProtectionKind payload_pk;
   const char * payload_secret;
+  const char * pp_userdata_secret;
+  const char * groupdata_secret;
+  const char * ep_userdata_secret;
 };
 
 typedef void (*set_crypto_params_fn)(struct dds_security_cryptography_impl *, const struct domain_sec_config *);
@@ -170,6 +177,7 @@ static dds_qos_t *get_qos()
   dds_qset_history (qos, DDS_HISTORY_KEEP_ALL, -1);
   dds_qset_durability (qos, DDS_DURABILITY_TRANSIENT_LOCAL);
   dds_qset_reliability (qos, DDS_RELIABILITY_RELIABLE, DDS_INFINITY);
+  dds_qset_userdata (qos, g_ep_secret, strlen (g_ep_secret));
   return qos;
 }
 
@@ -183,12 +191,15 @@ static char *create_topic_name(const char *prefix, uint32_t nr, char *name, size
 
 static dds_entity_t create_pp (dds_domainid_t domain_id, const struct domain_sec_config * domain_config, set_crypto_params_fn set_crypto_params)
 {
-  dds_entity_t pp = dds_create_participant (domain_id, NULL, NULL);
+  dds_qos_t *qos = dds_create_qos ();
+  dds_qset_userdata (qos, g_pp_secret, strlen (g_pp_secret));
+  dds_entity_t pp = dds_create_participant (domain_id, qos, NULL);
   CU_ASSERT_FATAL (pp > 0);
+  dds_delete_qos (qos);
   struct dds_security_cryptography_impl * crypto_context = get_crypto_context (pp);
   CU_ASSERT_FATAL (crypto_context != NULL);
-  if (set_crypto_params)
-    set_crypto_params (crypto_context, domain_config);
+  assert (set_crypto_params);
+  set_crypto_params (crypto_context, domain_config);
   return pp;
 }
 
@@ -204,8 +215,11 @@ static void create_dom_pp_pubsub(dds_domainid_t domain_id_base, const char * dom
     {
       size_t pp_index = d * n_pp + p;
       pps[pp_index] = create_pp (domain_id_base + (uint32_t)d, domain_sec_config, set_crypto_params);
-      pubsubs[pp_index] = pubsub_create (pps[pp_index], NULL, NULL);
+      dds_qos_t *qos = dds_create_qos ();
+      dds_qset_groupdata (qos, g_groupdata_secret, strlen (g_groupdata_secret));
+      pubsubs[pp_index] = pubsub_create (pps[pp_index], qos, NULL);
       CU_ASSERT_FATAL (pubsubs[pp_index] > 0);
+      dds_delete_qos (qos);
     }
   }
 }
@@ -230,7 +244,7 @@ static void test_init(const struct domain_sec_config * domain_config, size_t n_s
   print_config_vars(governance_vars);
   printf("\n");
 
-  char * gov_config_signed = get_governance_config (governance_vars);
+  char * gov_config_signed = get_governance_config (governance_vars, false);
 
   struct kvp config_vars[] = {
     { "GOVERNANCE_DATA", gov_config_signed, 1 },
@@ -417,13 +431,21 @@ static void set_encryption_parameters_basic(struct dds_security_cryptography_imp
 static void set_encryption_parameters_secret(struct dds_security_cryptography_impl * crypto_context, const struct domain_sec_config *domain_config)
 {
   set_encrypted_secret (crypto_context, domain_config->payload_secret);
+  set_encryption_parameters_basic (crypto_context, domain_config);
+}
+
+static void set_encryption_parameters_disc(struct dds_security_cryptography_impl * crypto_context, const struct domain_sec_config *domain_config)
+{
+  set_entity_data_secret (crypto_context, domain_config->pp_userdata_secret, domain_config->groupdata_secret, domain_config->ep_userdata_secret);
+  set_encryption_parameters_basic (crypto_context, domain_config);
+  set_disc_protection_kinds (crypto_context, domain_config->discovery_pk, domain_config->liveliness_pk);
 }
 
 static void test_discovery_liveliness_protection(DDS_Security_ProtectionKind discovery_pk, DDS_Security_ProtectionKind liveliness_pk)
 {
   struct domain_sec_config domain_config = { discovery_pk, liveliness_pk, PK_N, PK_N, BPK_N, NULL };
   /* FIXME: add more asserts in wrapper or test instead of just testing communication */
-  test_write_read (&domain_config, 1, 1, 1, 1, 1, 1, NULL);
+  test_write_read (&domain_config, 1, 1, 1, 1, 1, 1, &set_encryption_parameters_disc);
 }
 
 static void test_data_protection_kind(DDS_Security_ProtectionKind rtps_pk, DDS_Security_ProtectionKind metadata_pk, DDS_Security_BasicProtectionKind payload_pk)

From e6500b65280ac2acdaa9994e9aa6a210cd3cba5c Mon Sep 17 00:00:00 2001
From: Dennis Potman <dennis.potman@adlinktech.com>
Date: Thu, 26 Mar 2020 13:40:28 +0100
Subject: [PATCH 158/238] Add domaingv pointer to security plugins, as a
 preparation for supporting the permissions_expiry callback (which needs the
 gv to enumerate participants.

Signed-off-by: Dennis Potman <dennis.potman@adlinktech.com>
---
 .../ddsi/include/dds/ddsi/ddsi_security_omg.h |   4 +-
 src/core/ddsi/src/ddsi_security_omg.c         | 207 ++++----
 src/core/ddsi/src/q_entity.c                  |   2 +-
 src/security/api/CMakeLists.txt               |   1 +
 .../include/dds/security/dds_security_api.h   |  22 +-
 .../dds_security_api_access_control.h         | 469 ++++++++----------
 .../dds_security_api_authentication.h         | 271 ++++------
 .../security/dds_security_api_cryptography.h  | 417 +++++++---------
 .../access_control/src/access_control.c       |  27 +-
 .../access_control/src/access_control.h       |   3 +-
 .../authentication/CMakeLists.txt             |   1 +
 .../authentication/src/authentication.c       |   5 +-
 .../authentication/src/authentication.h       |   2 +-
 .../cryptographic/CMakeLists.txt              |   1 +
 .../cryptographic/src/cryptography.c          |   5 +-
 .../cryptographic/src/cryptography.h          |  17 +-
 .../builtin_plugins/tests/common/src/loader.c |   2 +-
 .../src/listeners_access_control_utests.c     |   3 +-
 .../dds/security/core/dds_security_plugins.h  |  29 +-
 src/security/core/src/dds_security_plugins.c  |  41 +-
 .../tests/common/access_control_wrapper.c     |   6 +-
 .../tests/common/access_control_wrapper.h     |   5 +-
 .../tests/common/authentication_wrapper.c     |  23 +-
 .../tests/common/authentication_wrapper.h     |   9 +-
 .../core/tests/common/cryptography_wrapper.c  |  18 +-
 .../core/tests/common/cryptography_wrapper.h  |   7 +-
 26 files changed, 682 insertions(+), 915 deletions(-)

diff --git a/src/core/ddsi/include/dds/ddsi/ddsi_security_omg.h b/src/core/ddsi/include/dds/ddsi/ddsi_security_omg.h
index ff81274..f87629a 100644
--- a/src/core/ddsi/include/dds/ddsi/ddsi_security_omg.h
+++ b/src/core/ddsi/include/dds/ddsi/ddsi_security_omg.h
@@ -1092,7 +1092,7 @@ secure_conn_write(
  * @retval DDS_RETCODE_OK   All plugins are successfully loaded
  * @retval DDS_RETCODE_ERROR  One or more security plugins are not loaded.
  */
-dds_return_t q_omg_security_load( struct dds_security_context *security_context, const dds_qos_t *qos );
+dds_return_t q_omg_security_load( struct dds_security_context *security_context, const dds_qos_t *qos, struct ddsi_domaingv *gv );
 
 
 void q_omg_security_init( struct ddsi_domaingv *gv );
@@ -1389,7 +1389,7 @@ decode_rtps_message(
   return NN_RTPS_MSG_STATE_PLAIN;
 }
 
-inline dds_return_t q_omg_security_load( UNUSED_ARG( struct dds_security_context *security_context ), UNUSED_ARG( const dds_qos_t *property_seq) )
+inline dds_return_t q_omg_security_load( UNUSED_ARG( struct dds_security_context *security_context ), UNUSED_ARG( const dds_qos_t *property_seq), UNUSED_ARG ( struct ddsi_domaingv *gv ) )
 {
   return DDS_RETCODE_ERROR;
 }
diff --git a/src/core/ddsi/src/ddsi_security_omg.c b/src/core/ddsi/src/ddsi_security_omg.c
index 057cdf4..096608c 100644
--- a/src/core/ddsi/src/ddsi_security_omg.c
+++ b/src/core/ddsi/src/ddsi_security_omg.c
@@ -53,11 +53,11 @@
  */
 #define PENDING_MATCH_EXPIRY_TIME 300
 
-#define EXCEPTION_LOG(sc,e,cat, ...) \
-  q_omg_log_exception(sc->logcfg, cat, e, __FILE__, __LINE__, DDS_FUNCTION, __VA_ARGS__)
+#define EXCEPTION_LOG(gv,e,cat,...) \
+  q_omg_log_exception(&gv->logconfig, cat, e, __FILE__, __LINE__, DDS_FUNCTION, __VA_ARGS__)
 
-#define EXCEPTION_ERROR(s, e, ...)     EXCEPTION_LOG(s, e, DDS_LC_ERROR, __VA_ARGS__)
-#define EXCEPTION_WARNING(s, e, ...)   EXCEPTION_LOG(s, e, DDS_LC_WARNING, __VA_ARGS__)
+#define EXCEPTION_ERROR(gv,e,...)     EXCEPTION_LOG(gv, e, DDS_LC_ERROR, __VA_ARGS__)
+#define EXCEPTION_WARNING(gv,e,...)   EXCEPTION_LOG(gv, e, DDS_LC_WARNING, __VA_ARGS__)
 
 
 #define SECURITY_ATTR_IS_VALID(attr)                                      \
@@ -212,8 +212,6 @@ struct dds_security_context {
 
   struct pending_match_index security_matches;
   struct participant_sec_index partiticpant_index;
-
-  const struct ddsrt_log_cfg *logcfg;
 };
 
 typedef struct dds_security_context dds_security_context;
@@ -357,7 +355,7 @@ static struct pending_match * find_or_create_pending_entity_match(struct pending
   return match;
 }
 
-static void unregister_and_free_pending_match(dds_security_context *sc, struct pending_match *match)
+static void unregister_and_free_pending_match(const struct ddsi_domaingv * gv, dds_security_context *sc, struct pending_match *match)
 {
   if (match->crypto_handle != 0)
   {
@@ -382,7 +380,7 @@ static void unregister_and_free_pending_match(dds_security_context *sc, struct p
       break;
     }
     if (!r)
-      EXCEPTION_ERROR(sc, &exception, "Failed to unregister remote %s crypto "PGUIDFMT" related to "PGUIDFMT, ename, PGUID(match->guids.remote_guid), PGUID(match->guids.local_guid));
+      EXCEPTION_ERROR(gv, &exception, "Failed to unregister remote %s crypto "PGUIDFMT" related to "PGUIDFMT, ename, PGUID(match->guids.remote_guid), PGUID(match->guids.local_guid));
   }
   free_pending_match(match);
 }
@@ -407,7 +405,7 @@ static void pending_match_expiry_cb(struct xevent *xev, void *varg, ddsrt_mtime_
   {
     ddsrt_fibheap_delete(&pending_match_expiry_fhdef, &index->expiry_timers, match);
     ddsrt_avl_delete(&pending_match_index_treedef, &index->pending_matches, match);
-    unregister_and_free_pending_match(index->gv->security_context, match);
+    unregister_and_free_pending_match(index->gv, index->gv->security_context, match);
     match = ddsrt_fibheap_min(&pending_match_expiry_fhdef, &index->expiry_timers);
   }
   if (match)
@@ -430,7 +428,7 @@ static void clear_pending_matches_by_local_guid(dds_security_context *sc, struct
       if (match->expiry.v != DDS_NEVER)
         ddsrt_fibheap_delete(&pending_match_expiry_fhdef, &index->expiry_timers, match);
       next = ddsrt_avl_lookup_succ(&pending_match_index_treedef, &index->pending_matches, &match->guids);
-      unregister_and_free_pending_match(sc, match);
+      unregister_and_free_pending_match(index->gv, sc, match);
     }
     match = next;
   }
@@ -450,7 +448,7 @@ static void clear_pending_matches_by_remote_guid(dds_security_context *sc, struc
     ddsrt_avl_delete(&pending_match_index_treedef, &index->pending_matches, match);
     if (match->expiry.v != DDS_NEVER)
       ddsrt_fibheap_delete(&pending_match_expiry_fhdef, &index->expiry_timers, match);
-    unregister_and_free_pending_match(sc, match);
+    unregister_and_free_pending_match(index->gv, sc, match);
     match = next;
   }
   ddsrt_mutex_unlock(&index->lock);
@@ -505,7 +503,7 @@ static struct proxypp_pp_match * proxypp_pp_match_new(struct participant *pp, DD
   return pm;
 }
 
-static void proxypp_pp_match_free(struct dds_security_context *sc, struct proxypp_pp_match *pm)
+static void proxypp_pp_match_free(struct ddsi_domaingv *gv, struct dds_security_context *sc, struct proxypp_pp_match *pm)
 {
   DDS_Security_SecurityException exception = DDS_SECURITY_EXCEPTION_INIT;
 
@@ -517,8 +515,9 @@ static void proxypp_pp_match_free(struct dds_security_context *sc, struct proxyp
        * matching local and remote participant.
        */
 #if 0
-      EXCEPTION_ERROR(sc, &exception, "Failed to return remote permissions handle");
+      EXCEPTION_ERROR(gv, &exception, "Failed to return remote permissions handle");
 #else
+      DDSRT_UNUSED_ARG (gv);
       DDS_Security_Exception_reset(&exception);
 #endif
     }
@@ -552,7 +551,7 @@ static void proxypp_pp_unrelate(struct dds_security_context *sc, struct proxy_pa
     if ((pm = ddsrt_avl_lookup_dpath(&proxypp_pp_treedef, &proxypp->sec_attr->participants, &pp_crypto_handle, &dpath)) != NULL)
     {
       ddsrt_avl_delete_dpath(&proxypp_pp_treedef, &proxypp->sec_attr->participants, pm, &dpath);
-      proxypp_pp_match_free(sc, pm);
+      proxypp_pp_match_free(proxypp->e.gv, sc, pm);
     }
     ddsrt_mutex_unlock(&proxypp->sec_attr->lock);
   }
@@ -715,8 +714,6 @@ void q_omg_security_init (struct ddsi_domaingv *gv)
   pending_match_index_init(gv, &sc->security_matches);
 
   ddsrt_mutex_init (&sc->omg_security_lock);
-  sc->logcfg = &gv->logconfig;
-
   gv->security_context = sc;
 
   ddsi_handshake_admin_init(gv);
@@ -725,16 +722,16 @@ void q_omg_security_init (struct ddsi_domaingv *gv)
 /**
  * Releases all plugins
  */
-static void release_plugins (dds_security_context *sc)
+static void release_plugins (struct ddsi_domaingv *gv, dds_security_context *sc)
 {
   if (dds_security_plugin_release (&sc->auth_plugin, sc->authentication_context))
-    DDS_CERROR (sc->logcfg, "Error occurred releasing %s plugin", sc->auth_plugin.name);
+    GVERROR ("Error occurred releasing %s plugin", sc->auth_plugin.name);
 
   if (dds_security_plugin_release (&sc->crypto_plugin, sc->crypto_context))
-    DDS_CERROR (sc->logcfg, "Error occurred releasing %s plugin", sc->crypto_plugin.name);
+    GVERROR ("Error occurred releasing %s plugin", sc->crypto_plugin.name);
 
   if (dds_security_plugin_release (&sc->ac_plugin, sc->access_control_context))
-    DDS_CERROR (sc->logcfg, "Error occurred releasing %s plugin", sc->ac_plugin.name);
+    GVERROR ("Error occurred releasing %s plugin", sc->ac_plugin.name);
 
   sc->authentication_context = NULL;
   sc->access_control_context = NULL;
@@ -758,9 +755,9 @@ void q_omg_security_free (struct ddsi_domaingv *gv)
   ddsrt_avl_cfree(&participant_index_treedef, &sc->partiticpant_index.participants, 0);
   ddsrt_mutex_destroy(&sc->partiticpant_index.lock);
 
-  if (sc->authentication_context != NULL && sc->access_control_context != NULL && sc->crypto_context != NULL){
-    release_plugins (sc);
-  }
+  if (sc->authentication_context != NULL && sc->access_control_context != NULL && sc->crypto_context != NULL)
+    release_plugins (gv, sc);
+
   ddsi_handshake_admin_deinit(gv);
   ddsrt_mutex_destroy (&sc->omg_security_lock);
   ddsrt_free(sc);
@@ -801,7 +798,7 @@ static void deinit_plugin_suite_config (dds_security_plugin_suite_config *suite_
   deinit_plugin_config (&suite_config->cryptography);
 }
 
-dds_return_t q_omg_security_load (dds_security_context *sc, const dds_qos_t *qos)
+dds_return_t q_omg_security_load (dds_security_context *sc, const dds_qos_t *qos, struct ddsi_domaingv *gv)
 {
   dds_security_plugin_suite_config psc;
   memset (&psc, 0, sizeof (psc));
@@ -812,31 +809,28 @@ dds_return_t q_omg_security_load (dds_security_context *sc, const dds_qos_t *qos
   dds_qos_to_security_plugin_configuration (qos, &psc);
 
   /* Check configuration content */
-  if (dds_security_check_plugin_configuration (&psc, sc->logcfg) != DDS_RETCODE_OK)
+  if (dds_security_check_plugin_configuration (&psc, gv) != DDS_RETCODE_OK)
     goto error;
 
-  if (dds_security_load_security_library (&psc.authentication, &sc->auth_plugin, (void **) &sc->authentication_context, sc->logcfg) != DDS_RETCODE_OK)
+  if (dds_security_load_security_library (&psc.authentication, &sc->auth_plugin, (void **) &sc->authentication_context, gv) != DDS_RETCODE_OK)
   {
-    DDS_CERROR (sc->logcfg, "Could not load %s plugin.\n", sc->auth_plugin.name);
+    GVERROR ("Could not load %s plugin.\n", sc->auth_plugin.name);
     goto error;
   }
-  if (dds_security_load_security_library (&psc.access_control, &sc->ac_plugin, (void **) &sc->access_control_context, sc->logcfg) != DDS_RETCODE_OK)
+  if (dds_security_load_security_library (&psc.access_control, &sc->ac_plugin, (void **) &sc->access_control_context, gv) != DDS_RETCODE_OK)
   {
-    DDS_CERROR (sc->logcfg, "Could not load %s library\n", sc->ac_plugin.name);
+    GVERROR ("Could not load %s library\n", sc->ac_plugin.name);
     goto error;
   }
-  if (dds_security_load_security_library (&psc.cryptography, &sc->crypto_plugin, (void **) &sc->crypto_context, sc->logcfg) != DDS_RETCODE_OK)
+  if (dds_security_load_security_library (&psc.cryptography, &sc->crypto_plugin, (void **) &sc->crypto_context, gv) != DDS_RETCODE_OK)
   {
-    DDS_CERROR (sc->logcfg, "Could not load %s library\n", sc->crypto_plugin.name);
+    GVERROR ("Could not load %s library\n", sc->crypto_plugin.name);
     goto error;
   }
 
   /* now check if all plugin functions are implemented */
-  if (dds_security_verify_plugin_functions (
-              sc->authentication_context, &sc->auth_plugin,
-              sc->crypto_context, &sc->crypto_plugin,
-              sc->access_control_context, &sc->ac_plugin,
-              sc->logcfg) != DDS_RETCODE_OK)
+  if (dds_security_verify_plugin_functions (sc->authentication_context, &sc->auth_plugin, sc->crypto_context, &sc->crypto_plugin,
+    sc->access_control_context, &sc->ac_plugin, gv) != DDS_RETCODE_OK)
   {
     goto error_verify;
   }
@@ -845,12 +839,12 @@ dds_return_t q_omg_security_load (dds_security_context *sc, const dds_qos_t *qos
 #if LISTENERS_IMPLEMENTED
   if (!access_control_context->set_listener (access_control_context, &listener_ac, &ex))
   {
-    DDS_CERROR (sc->logcfg, "Could not set access_control listener: %s\n", ex.message ? ex.message : "<unknown error>");
+    GVERROR ("Could not set access_control listener: %s\n", ex.message ? ex.message : "<unknown error>");
     goto error_set_ac_listener;
   }
   if (!authentication_context->set_listener (authentication_context, &listener_auth, &ex))
   {
-    DDS_CERROR (sc->logcfg, "Could not set authentication listener: %s\n", ex.message ? ex.message : "<unknown error>");
+    GVERROR ("Could not set authentication listener: %s\n", ex.message ? ex.message : "<unknown error>");
     goto err_set_auth_listener;
   }
 #endif
@@ -861,7 +855,7 @@ dds_return_t q_omg_security_load (dds_security_context *sc, const dds_qos_t *qos
 
   deinit_plugin_suite_config (&psc);
   ddsrt_mutex_unlock (&sc->omg_security_lock);
-  DDS_CLOG (DDS_LC_TRACE, sc->logcfg, "DDS Security plugins have been loaded\n");
+  GVTRACE ("DDS Security plugins have been loaded\n");
   return DDS_RETCODE_OK;
 
 #if LISTENERS_IMPLEMENTED
@@ -870,7 +864,7 @@ error_set_auth_listener:
 error_set_ac_listener:
 #endif
 error_verify:
-  release_plugins (sc);
+  release_plugins (gv, sc);
 error:
   deinit_plugin_suite_config (&psc);
   ddsrt_mutex_unlock (&sc->omg_security_lock);
@@ -907,6 +901,7 @@ dds_return_t q_omg_security_check_create_participant(struct participant *pp, uin
 {
   dds_return_t ret = DDS_RETCODE_NOT_ALLOWED_BY_SECURITY;
   struct dds_security_context *sc = q_omg_security_get_secure_context(pp);
+  struct ddsi_domaingv *gv = pp->e.gv;
   DDS_Security_IdentityHandle identity_handle = DDS_SECURITY_HANDLE_NIL;
   DDS_Security_SecurityException exception = DDS_SECURITY_EXCEPTION_INIT;
   DDS_Security_ValidationResult_t result = 0;
@@ -933,7 +928,7 @@ dds_return_t q_omg_security_check_create_participant(struct participant *pp, uin
       (DDS_Security_GUID_t *) &candidate_guid, &exception);
   if (result != DDS_SECURITY_VALIDATION_OK)
   {
-    EXCEPTION_ERROR(sc, &exception, "Error occurred while validating local permission");
+    EXCEPTION_ERROR(gv, &exception, "Error occurred while validating local permission");
     goto validation_failed;
   }
   pp->e.guid = nn_ntoh_guid(adjusted_guid);
@@ -946,7 +941,7 @@ dds_return_t q_omg_security_check_create_participant(struct participant *pp, uin
   /* Get the identity token and add this to the plist of the participant */
   if (!sc->authentication_context->get_identity_token(sc->authentication_context, &identity_token, identity_handle, &exception))
   {
-    EXCEPTION_ERROR(sc, &exception, "Error occurred while retrieving the identity token");
+    EXCEPTION_ERROR(gv, &exception, "Error occurred while retrieving the identity token");
     goto validation_failed;
   }
   assert(exception.code == 0);
@@ -958,23 +953,24 @@ dds_return_t q_omg_security_check_create_participant(struct participant *pp, uin
   sec_attr->permissions_handle = sc->access_control_context->validate_local_permissions(
        sc->access_control_context, sc->authentication_context, identity_handle,
        (DDS_Security_DomainId)domain_id, &par_qos, &exception);
+
   if (sec_attr->permissions_handle == DDS_SECURITY_HANDLE_NIL)
   {
-    EXCEPTION_ERROR(sc, &exception, "Error occurred while validating local permissions");
+    EXCEPTION_ERROR(gv, &exception, "Error occurred while validating local permissions");
     goto not_allowed;
   }
 
   /* ask to access control security plugin for create participant permissions related to this identity*/
   if (!sc->access_control_context->check_create_participant(sc->access_control_context, sec_attr->permissions_handle, (DDS_Security_DomainId) domain_id, &par_qos, &exception))
   {
-    EXCEPTION_ERROR(sc, &exception, "It is not allowed to create participant");
+    EXCEPTION_ERROR(gv, &exception, "It is not allowed to create participant");
     goto not_allowed;
   }
 
   /* Get the identity token and add this to the plist of the participant */
   if (!sc->access_control_context->get_permissions_token(sc->access_control_context, &permissions_token, sec_attr->permissions_handle, &exception))
   {
-    EXCEPTION_ERROR(sc, &exception, "Error occurred while retrieving the permissions token");
+    EXCEPTION_ERROR(gv, &exception, "Error occurred while retrieving the permissions token");
     goto not_allowed;
   }
 
@@ -983,19 +979,19 @@ dds_return_t q_omg_security_check_create_participant(struct participant *pp, uin
 
   if (!sc->access_control_context->get_permissions_credential_token(sc->access_control_context, &credential_token, sec_attr->permissions_handle, &exception))
   {
-    EXCEPTION_ERROR(sc, &exception, "Error occurred while retrieving the permissions credential token");
+    EXCEPTION_ERROR(gv, &exception, "Error occurred while retrieving the permissions credential token");
     goto no_credentials;
   }
 
   if (!sc->authentication_context->set_permissions_credential_and_token(sc->authentication_context, sec_attr->local_identity_handle, &credential_token, &permissions_token, &exception))
   {
-    EXCEPTION_ERROR(sc, &exception, "Error occurred while setting the permissions credential token");
+    EXCEPTION_ERROR(gv, &exception, "Error occurred while setting the permissions credential token");
     goto no_credentials;
   }
 
   if (!sc->access_control_context->get_participant_sec_attributes(sc->access_control_context, sec_attr->permissions_handle, &sec_attr->attr, &exception))
   {
-    EXCEPTION_ERROR(sc, &exception, "Failed to get participant security attributes");
+    EXCEPTION_ERROR(gv, &exception, "Failed to get participant security attributes");
     goto no_sec_attr;
   }
 
@@ -1003,7 +999,7 @@ dds_return_t q_omg_security_check_create_participant(struct participant *pp, uin
   sec_attr->crypto_handle = sc->crypto_context->crypto_key_factory->register_local_participant(
             sc->crypto_context->crypto_key_factory, sec_attr->local_identity_handle, sec_attr->permissions_handle, NULL, &sec_attr->attr, &exception);
   if (!sec_attr->crypto_handle) {
-    EXCEPTION_ERROR(sc, &exception, "Failed to register participant with crypto key factory");
+    EXCEPTION_ERROR(gv, &exception, "Failed to register participant with crypto key factory");
     goto no_crypto;
   }
 
@@ -1089,21 +1085,21 @@ static void cleanup_participant_sec_attributes(void *arg)
   if (attr->permissions_handle != DDS_SECURITY_HANDLE_NIL)
   {
     if (!sc->access_control_context->return_permissions_handle(sc->access_control_context, attr->permissions_handle, &exception))
-      EXCEPTION_ERROR(sc, &exception, "Failed to return local permissions handle");
+      EXCEPTION_ERROR(gv, &exception, "Failed to return local permissions handle");
   }
   if (attr->local_identity_handle != DDS_SECURITY_HANDLE_NIL)
   {
     if (!sc->authentication_context->return_identity_handle(sc->authentication_context, attr->local_identity_handle, &exception))
-      EXCEPTION_ERROR(sc, &exception, "Failed to return local identity handle");
+      EXCEPTION_ERROR(gv, &exception, "Failed to return local identity handle");
   }
   if (attr->plugin_attr)
   {
     if (!sc->access_control_context->return_participant_sec_attributes(sc->access_control_context, &attr->attr, &exception))
-      EXCEPTION_ERROR(sc, &exception, "Failed to return participant security attributes");
+      EXCEPTION_ERROR(gv, &exception, "Failed to return participant security attributes");
   }
 
   if (!sc->crypto_context->crypto_key_factory->unregister_participant(sc->crypto_context->crypto_key_factory, attr->crypto_handle, &exception))
-    EXCEPTION_ERROR(sc, &exception, "Failed to unregister participant");
+    EXCEPTION_ERROR(gv, &exception, "Failed to unregister participant");
 
   ddsrt_avl_cfree(&pp_proxypp_treedef, &attr->proxy_participants, NULL);
   ddsrt_mutex_unlock(&attr->lock);
@@ -1286,7 +1282,7 @@ bool q_omg_security_check_create_topic(const struct ddsi_domaingv *gv, const dds
     {
       /*log if the topic discovery is not protected*/
       if (!is_topic_discovery_protected(pp->sec_attr->permissions_handle, sc->access_control_context, topic_name))
-        EXCEPTION_ERROR(sc, &exception, "Local topic permission denied");
+        EXCEPTION_ERROR(gv, &exception, "Local topic permission denied");
       else
         DDS_Security_Exception_reset(&exception);
     }
@@ -1320,7 +1316,7 @@ bool q_omg_security_check_create_writer(struct participant *pp, uint32_t domain_
   {
     /*log if the topic discovery is not protected*/
     if (!is_topic_discovery_protected( pp->sec_attr->permissions_handle, sc->access_control_context, topic_name))
-      EXCEPTION_ERROR(sc, &exception, "Local topic permission denied");
+      EXCEPTION_ERROR(pp->e.gv, &exception, "Local topic permission denied");
     else
       DDS_Security_Exception_reset(&exception);
   }
@@ -1350,7 +1346,7 @@ void q_omg_security_register_writer(struct writer *wr)
   wr->sec_attr = writer_sec_attributes_new();
   if (!sc->access_control_context->get_datawriter_sec_attributes(sc->access_control_context, pp->sec_attr->permissions_handle, wr->topic->name, &partitions, NULL, &wr->sec_attr->attr, &exception))
   {
-    EXCEPTION_ERROR(sc, &exception, "Failed to retrieve writer security attributes");
+    EXCEPTION_ERROR(pp->e.gv, &exception, "Failed to retrieve writer security attributes");
     goto no_attr;
   }
   wr->sec_attr->plugin_attr = true;
@@ -1367,7 +1363,7 @@ void q_omg_security_register_writer(struct writer *wr)
     DDS_Security_PropertySeq_freebuf(&properties);
     if (wr->sec_attr->crypto_handle == DDS_SECURITY_HANDLE_NIL)
     {
-      EXCEPTION_ERROR(sc, &exception, "Failed to register writer with crypto");
+      EXCEPTION_ERROR(pp->e.gv, &exception, "Failed to register writer with crypto");
       goto not_registered;
     }
   }
@@ -1392,12 +1388,12 @@ void q_omg_security_deregister_writer(struct writer *wr)
     if (wr->sec_attr->crypto_handle != DDS_SECURITY_HANDLE_NIL)
     {
       if (!sc->crypto_context->crypto_key_factory->unregister_datawriter(sc->crypto_context->crypto_key_factory, wr->sec_attr->crypto_handle, &exception))
-        EXCEPTION_ERROR(sc, &exception, "Failed to unregister writer with crypto");
+        EXCEPTION_ERROR(wr->e.gv, &exception, "Failed to unregister writer with crypto");
     }
     if (wr->sec_attr->plugin_attr)
     {
       if (!sc->access_control_context->return_datawriter_sec_attributes(sc->access_control_context, &wr->sec_attr->attr, &exception))
-        EXCEPTION_ERROR(sc, &exception, "Failed to return writer security attributes");
+        EXCEPTION_ERROR(wr->e.gv, &exception, "Failed to return writer security attributes");
     }
     writer_sec_attributes_free(wr->sec_attr);
     wr->sec_attr = NULL;
@@ -1441,7 +1437,7 @@ bool q_omg_security_check_create_reader(struct participant *pp, uint32_t domain_
   {
     /*log if the topic discovery is not protected*/
     if (!is_topic_discovery_protected( pp->sec_attr->permissions_handle, sc->access_control_context, topic_name))
-      EXCEPTION_ERROR(sc, &exception, "Reader is not permitted");
+      EXCEPTION_ERROR(pp->e.gv, &exception, "Reader is not permitted");
     else
       DDS_Security_Exception_reset(&exception);
   }
@@ -1472,7 +1468,7 @@ void q_omg_security_register_reader(struct reader *rd)
 
   if (!sc->access_control_context->get_datareader_sec_attributes(sc->access_control_context, pp->sec_attr->permissions_handle, rd->topic->name, &partitions, NULL, &rd->sec_attr->attr, &exception))
   {
-    EXCEPTION_ERROR(sc, &exception, "Failed to retrieve reader security attributes");
+    EXCEPTION_ERROR(pp->e.gv, &exception, "Failed to retrieve reader security attributes");
     goto no_attr;
   }
   rd->sec_attr->plugin_attr = true;
@@ -1489,7 +1485,7 @@ void q_omg_security_register_reader(struct reader *rd)
     DDS_Security_PropertySeq_freebuf(&properties);
     if (rd->sec_attr->crypto_handle == DDS_SECURITY_HANDLE_NIL)
     {
-      EXCEPTION_ERROR(sc, &exception, "Failed to register reader with crypto");
+      EXCEPTION_ERROR(pp->e.gv, &exception, "Failed to register reader with crypto");
       goto not_registered;
     }
   }
@@ -1514,14 +1510,14 @@ void q_omg_security_deregister_reader(struct reader *rd)
     {
       if (!sc->crypto_context->crypto_key_factory->unregister_datareader(sc->crypto_context->crypto_key_factory, rd->sec_attr->crypto_handle, &exception))
       {
-        EXCEPTION_ERROR(sc, &exception, "Failed to unregister reader with crypto");
+        EXCEPTION_ERROR(rd->e.gv, &exception, "Failed to unregister reader with crypto");
       }
     }
     if (rd->sec_attr->plugin_attr)
     {
       if (!sc->access_control_context->return_datareader_sec_attributes(sc->access_control_context, &rd->sec_attr->attr, &exception))
       {
-        EXCEPTION_ERROR(sc, &exception, "Failed to return reader security attributes");
+        EXCEPTION_ERROR(rd->e.gv, &exception, "Failed to return reader security attributes");
       }
     }
     reader_sec_attributes_free(rd->sec_attr);
@@ -1567,6 +1563,7 @@ static int64_t check_remote_participant_permissions(uint32_t domain_id, struct p
   DDS_Security_PermissionsToken permissions_token = DDS_SECURITY_TOKEN_INIT;
   DDS_Security_AuthenticatedPeerCredentialToken peer_credential_token = DDS_SECURITY_TOKEN_INIT;
   int64_t permissions_hdl = DDS_SECURITY_HANDLE_NIL;
+  struct ddsi_domaingv *gv = pp->e.gv;
 
   if (proxypp->plist->present & PP_PERMISSIONS_TOKEN)
       q_omg_shallow_copyin_DataHolder(&permissions_token, &proxypp->plist->permissions_token);
@@ -1576,21 +1573,20 @@ static int64_t check_remote_participant_permissions(uint32_t domain_id, struct p
   handshake = ddsi_handshake_find(pp, proxypp);
   if (!handshake)
   {
-    ELOG(DDS_LC_ERROR, pp, "Could not find handshake local participant "PGUIDFMT" and remote participant "PGUIDFMT,
-                PGUID(pp->e.guid), PGUID(proxypp->e.guid));
-      goto no_handshake;
+    GVTRACE("Could not find handshake local participant "PGUIDFMT" and remote participant "PGUIDFMT, PGUID(pp->e.guid), PGUID(proxypp->e.guid));
+    goto no_handshake;
   }
 
   if (!sc->authentication_context->get_authenticated_peer_credential_token(sc->authentication_context, &peer_credential_token, ddsi_handshake_get_handle(handshake), &exception))
   {
     if (q_omg_participant_is_access_protected(pp))
     {
-      EXCEPTION_ERROR(sc, &exception, "Could not authenticate_peer_credential_token for local participan1152t "PGUIDFMT" and remote participant "PGUIDFMT,
+      EXCEPTION_ERROR(gv, &exception, "Could not authenticate_peer_credential_token for local participan1152t "PGUIDFMT" and remote participant "PGUIDFMT,
           PGUID(pp->e.guid), PGUID(proxypp->e.guid));
       goto no_credentials;
     }
     /* Failing is allowed due to the non-protection of access. */
-    EXCEPTION_WARNING(sc, &exception, "Could not authenticate_peer_credential_token for local participant "PGUIDFMT" and remote participant "PGUIDFMT ,
+    EXCEPTION_WARNING(gv, &exception, "Could not authenticate_peer_credential_token for local participant "PGUIDFMT" and remote participant "PGUIDFMT ,
         PGUID(pp->e.guid), PGUID(proxypp->e.guid));
   }
 
@@ -1600,11 +1596,11 @@ static int64_t check_remote_participant_permissions(uint32_t domain_id, struct p
   {
     if (q_omg_participant_is_access_protected(pp))
     {
-      EXCEPTION_ERROR(sc, &exception, "Could not get remote participant "PGUIDFMT" permissions from plugin", PGUID(proxypp->e.guid));
+      EXCEPTION_ERROR(gv, &exception, "Could not get remote participant "PGUIDFMT" permissions from plugin", PGUID(proxypp->e.guid));
       goto no_permissions;
     }
     /* Failing is allowed due to the non-protection of access. */
-    EXCEPTION_WARNING(sc, &exception, "Could not get remote participant "PGUIDFMT" permissions from plugin", PGUID(proxypp->e.guid));
+    EXCEPTION_WARNING(gv, &exception, "Could not get remote participant "PGUIDFMT" permissions from plugin", PGUID(proxypp->e.guid));
   }
 
   /* Only check remote participant if joining access is protected. */
@@ -1615,11 +1611,9 @@ static int64_t check_remote_participant_permissions(uint32_t domain_id, struct p
     q_omg_shallow_copy_ParticipantBuiltinTopicDataSecure(&participant_data, &(proxypp->e.guid), proxypp->plist);
     if (!sc->access_control_context->check_remote_participant(sc->access_control_context, permissions_hdl, (DDS_Security_DomainId)domain_id, &participant_data, &exception))
     {
-      EXCEPTION_WARNING(sc, &exception, "Plugin does not allow remote participant "PGUIDFMT,  PGUID(proxypp->e.guid));
+      EXCEPTION_WARNING(gv, &exception, "Plugin does not allow remote participant "PGUIDFMT,  PGUID(proxypp->e.guid));
       if (!sc->access_control_context->return_permissions_handle(sc->access_control_context, permissions_hdl, &exception))
-      {
-        EXCEPTION_ERROR(sc, &exception, "Failed to return remote permissions handle");
-      }
+        EXCEPTION_ERROR(gv, &exception, "Failed to return remote permissions handle");
       permissions_hdl = DDS_SECURITY_HANDLE_NIL;
     }
     q_omg_shallow_free_ParticipantBuiltinTopicDataSecure(&participant_data);
@@ -1627,9 +1621,7 @@ static int64_t check_remote_participant_permissions(uint32_t domain_id, struct p
 
 no_permissions:
   if (!sc->authentication_context->return_authenticated_peer_credential_token(sc->authentication_context, &peer_credential_token, &exception))
-  {
-    EXCEPTION_ERROR(sc, &exception, "Failed to return peer credential token");
-  }
+    EXCEPTION_ERROR(gv, &exception, "Failed to return peer credential token");
 no_credentials:
   ddsi_handshake_release(handshake);
 no_handshake:
@@ -1646,7 +1638,7 @@ static void send_participant_crypto_tokens(struct participant *pp, struct proxy_
 
   r = sc->crypto_context->crypto_key_exchange->create_local_participant_crypto_tokens(sc->crypto_context->crypto_key_exchange, &tokens, local_crypto, remote_crypto, &exception);
   if (!r)
-    EXCEPTION_ERROR(sc, &exception, "Failed to create local participant crypto tokens "PGUIDFMT" for remote participant "PGUIDFMT,  PGUID(pp->e.guid), PGUID(proxypp->e.guid));
+    EXCEPTION_ERROR(pp->e.gv, &exception, "Failed to create local participant crypto tokens "PGUIDFMT" for remote participant "PGUIDFMT,  PGUID(pp->e.guid), PGUID(proxypp->e.guid));
   else if (tokens._length > 0)
   {
     nn_dataholderseq_t tholder;
@@ -1656,7 +1648,7 @@ static void send_participant_crypto_tokens(struct participant *pp, struct proxy_
     q_omg_shallow_free_nn_dataholderseq(&tholder);
 
     if (!sc->crypto_context->crypto_key_exchange->return_crypto_tokens(sc->crypto_context->crypto_key_exchange, &tokens, &exception))
-      EXCEPTION_ERROR(sc, &exception, "Failed to return local participant crypto tokens "PGUIDFMT" for remote participant "PGUIDFMT, PGUID(pp->e.guid), PGUID(proxypp->e.guid));
+      EXCEPTION_ERROR(pp->e.gv, &exception, "Failed to return local participant crypto tokens "PGUIDFMT" for remote participant "PGUIDFMT, PGUID(pp->e.guid), PGUID(proxypp->e.guid));
   }
 }
 
@@ -1758,7 +1750,7 @@ bool q_omg_security_register_remote_participant(struct participant *pp, struct p
       sc->crypto_context->crypto_key_factory, pp->sec_attr->crypto_handle, proxypp->sec_attr->remote_identity_handle, permissions_handle, shared_secret, &exception);
   if (crypto_handle == DDS_SECURITY_HANDLE_NIL)
   {
-    EXCEPTION_ERROR(sc, &exception, "Failed to register matched remote participant "PGUIDFMT" with participant "PGUIDFMT, PGUID(proxypp->e.guid), PGUID(pp->e.guid));
+    EXCEPTION_ERROR(gv, &exception, "Failed to register matched remote participant "PGUIDFMT" with participant "PGUIDFMT, PGUID(proxypp->e.guid), PGUID(pp->e.guid));
     ret = false;
     goto register_failed;
   }
@@ -1779,7 +1771,7 @@ bool q_omg_security_register_remote_participant(struct participant *pp, struct p
     {
       ret = sc->crypto_context->crypto_key_exchange->set_remote_participant_crypto_tokens(sc->crypto_context->crypto_key_exchange, pp->sec_attr->crypto_handle, crypto_handle, match->tokens, &exception);
       if (!ret)
-        EXCEPTION_ERROR(sc, &exception, " Failed to set remote participant crypto tokens "PGUIDFMT" --> "PGUIDFMT, PGUID(proxypp->e.guid), PGUID(pp->e.guid));
+        EXCEPTION_ERROR(gv, &exception, " Failed to set remote participant crypto tokens "PGUIDFMT" --> "PGUIDFMT, PGUID(proxypp->e.guid), PGUID(pp->e.guid));
       else
         GVTRACE(" set participant tokens src("PGUIDFMT") to dst("PGUIDFMT") (by registering remote)\n", PGUID(proxypp->e.guid), PGUID(pp->e.guid));
       delete_pending_match(&sc->security_matches, match);
@@ -1832,7 +1824,8 @@ void q_omg_security_deregister_remote_participant(struct proxy_participant *prox
   struct ddsi_domaingv *gv = proxypp->e.gv;
   DDS_Security_SecurityException exception = DDS_SECURITY_EXCEPTION_INIT;
 
-  if (proxypp->sec_attr) {
+  if (proxypp->sec_attr)
+  {
     dds_security_context *sc = proxypp->sec_attr->sc;
     struct proxypp_pp_match *pm;
     struct participant *pp;
@@ -1841,12 +1834,10 @@ void q_omg_security_deregister_remote_participant(struct proxy_participant *prox
     while (pm)
     {
       struct proxypp_pp_match *next = ddsrt_avl_find_succ(&proxypp_pp_treedef, &proxypp->sec_attr->participants, pm);
-
       ddsrt_avl_delete(&proxypp_pp_treedef, &proxypp->sec_attr->participants, pm);
-      pp = entidx_lookup_participant_guid(gv->entity_index, &pm->pp_guid);
-      if (pp)
+      if ((pp = entidx_lookup_participant_guid(gv->entity_index, &pm->pp_guid)) != NULL)
         pp_proxypp_unrelate(sc, pp, &proxypp->e.guid);
-      proxypp_pp_match_free(sc, pm);
+      proxypp_pp_match_free(gv, sc, pm);
       pm = next;
     }
 
@@ -1854,14 +1845,14 @@ void q_omg_security_deregister_remote_participant(struct proxy_participant *prox
 
     if (proxypp->sec_attr->crypto_handle != DDS_SECURITY_HANDLE_NIL)
     {
-        if (!sc->crypto_context->crypto_key_factory->unregister_participant(sc->crypto_context->crypto_key_factory, proxypp->sec_attr->crypto_handle, &exception))
-            EXCEPTION_ERROR(sc, &exception, "2:Failed to return remote crypto handle");
+      if (!sc->crypto_context->crypto_key_factory->unregister_participant(sc->crypto_context->crypto_key_factory, proxypp->sec_attr->crypto_handle, &exception))
+        EXCEPTION_ERROR(gv, &exception, "2:Failed to return remote crypto handle");
     }
 
     if (proxypp->sec_attr->remote_identity_handle != DDS_SECURITY_HANDLE_NIL)
     {
-        if (!sc->authentication_context->return_identity_handle(sc->authentication_context, proxypp->sec_attr->remote_identity_handle, &exception))
-            EXCEPTION_ERROR(sc, &exception, "Failed to return remote identity handle");
+      if (!sc->authentication_context->return_identity_handle(sc->authentication_context, proxypp->sec_attr->remote_identity_handle, &exception))
+        EXCEPTION_ERROR(gv, &exception, "Failed to return remote identity handle");
     }
 
     ddsrt_mutex_destroy(&proxypp->sec_attr->lock);
@@ -1960,7 +1951,7 @@ void q_omg_security_set_participant_crypto_tokens(struct participant *pp, struct
       DDS_Security_DataHolderSeq_free(tseq);
     }
     else
-      EXCEPTION_ERROR(sc, &exception, " Failed to set remote participant crypto tokens "PGUIDFMT" for participant "PGUIDFMT, PGUID(proxypp->e.guid), PGUID(pp->e.guid));
+      EXCEPTION_ERROR(gv, &exception, " Failed to set remote participant crypto tokens "PGUIDFMT" for participant "PGUIDFMT, PGUID(proxypp->e.guid), PGUID(pp->e.guid));
   }
   ddsrt_mutex_unlock(&pp->e.lock);
 
@@ -2054,7 +2045,7 @@ bool q_omg_security_check_remote_writer_permissions(const struct proxy_writer *p
       if (!ok)
       {
         if (!is_topic_discovery_protected(pp->sec_attr->permissions_handle, sc->access_control_context, publication_data.topic_name))
-          EXCEPTION_ERROR(sc, &exception, "Access control does not allow remote writer "PGUIDFMT": %s", PGUID(pwr->e.guid));
+          EXCEPTION_ERROR(gv, &exception, "Access control does not allow remote writer "PGUIDFMT": %s", PGUID(pwr->e.guid));
         else
           DDS_Security_Exception_reset(&exception);
       }
@@ -2076,7 +2067,7 @@ static void send_reader_crypto_tokens(struct reader *rd, struct proxy_writer *pw
 
   r = sc->crypto_context->crypto_key_exchange->create_local_datareader_crypto_tokens(sc->crypto_context->crypto_key_exchange, &tokens, local_crypto, remote_crypto, &exception);
   if (!r)
-    EXCEPTION_ERROR(sc, &exception,"Failed to create local reader crypto tokens "PGUIDFMT" for remote writer "PGUIDFMT, PGUID(rd->e.guid), PGUID(pwr->e.guid));
+    EXCEPTION_ERROR(gv, &exception,"Failed to create local reader crypto tokens "PGUIDFMT" for remote writer "PGUIDFMT, PGUID(rd->e.guid), PGUID(pwr->e.guid));
   else if (tokens._length > 0)
   {
     nn_dataholderseq_t tholder;
@@ -2086,7 +2077,7 @@ static void send_reader_crypto_tokens(struct reader *rd, struct proxy_writer *pw
     q_omg_shallow_free_nn_dataholderseq(&tholder);
 
     if (!sc->crypto_context->crypto_key_exchange->return_crypto_tokens(sc->crypto_context->crypto_key_exchange, &tokens, &exception))
-      EXCEPTION_ERROR(sc, &exception, "Failed to return local reader crypto tokens "PGUIDFMT" for remote writer "PGUIDFMT, PGUID(rd->e.guid), PGUID(pwr->e.guid));
+      EXCEPTION_ERROR(gv, &exception, "Failed to return local reader crypto tokens "PGUIDFMT" for remote writer "PGUIDFMT, PGUID(rd->e.guid), PGUID(pwr->e.guid));
   }
 }
 
@@ -2121,7 +2112,7 @@ static bool q_omg_security_register_remote_writer_match(struct proxy_writer *pwr
       allowed = true;
     }
     else
-      EXCEPTION_ERROR(sc, &exception, "Failed to register remote writer "PGUIDFMT" with reader "PGUIDFMT, PGUID(pwr->e.guid), PGUID(rd->e.guid));
+      EXCEPTION_ERROR(gv, &exception, "Failed to register remote writer "PGUIDFMT" with reader "PGUIDFMT, PGUID(pwr->e.guid), PGUID(rd->e.guid));
   }
   else
   {
@@ -2133,7 +2124,7 @@ static bool q_omg_security_register_remote_writer_match(struct proxy_writer *pwr
       *crypto_handle = sc->crypto_context->crypto_key_factory->register_matched_remote_datawriter(
           sc->crypto_context->crypto_key_factory, rd->sec_attr->crypto_handle, proxypp->sec_attr->crypto_handle, proxypp_match->shared_secret, &exception);
       if (*crypto_handle == 0)
-        EXCEPTION_ERROR(sc, &exception, "Failed to register remote writer "PGUIDFMT" with reader "PGUIDFMT, PGUID(pwr->e.guid), PGUID(rd->e.guid));
+        EXCEPTION_ERROR(gv, &exception, "Failed to register remote writer "PGUIDFMT" with reader "PGUIDFMT, PGUID(pwr->e.guid), PGUID(rd->e.guid));
       else
       {
         pending_match->crypto_handle = *crypto_handle;
@@ -2142,7 +2133,7 @@ static bool q_omg_security_register_remote_writer_match(struct proxy_writer *pwr
         {
           if (!sc->crypto_context->crypto_key_exchange->set_remote_datawriter_crypto_tokens(
               sc->crypto_context->crypto_key_exchange, rd->sec_attr->crypto_handle, *crypto_handle, pending_match->tokens, &exception))
-            EXCEPTION_ERROR(sc, &exception, "Failed to set remote writer crypto tokens "PGUIDFMT" --> "PGUIDFMT, PGUID(pwr->e.guid), PGUID(rd->e.guid));
+            EXCEPTION_ERROR(gv, &exception, "Failed to set remote writer crypto tokens "PGUIDFMT" --> "PGUIDFMT, PGUID(pwr->e.guid), PGUID(rd->e.guid));
           else
           {
             GVTRACE("match_remote_writer "PGUIDFMT" with reader "PGUIDFMT": tokens available\n", PGUID(pwr->e.guid), PGUID(rd->e.guid));
@@ -2227,7 +2218,7 @@ void q_omg_security_deregister_remote_writer_match(const struct ddsi_domaingv *g
   if (m->crypto_handle != 0)
   {
     if (!sc->crypto_context->crypto_key_factory->unregister_datawriter(sc->crypto_context->crypto_key_factory, m->crypto_handle, &exception))
-      EXCEPTION_ERROR(sc, &exception, "Failed to unregister remote writer "PGUIDFMT" for reader "PGUIDFMT, PGUID(m->pwr_guid), PGUID(*rd_guid));
+      EXCEPTION_ERROR(gv, &exception, "Failed to unregister remote writer "PGUIDFMT" for reader "PGUIDFMT, PGUID(m->pwr_guid), PGUID(*rd_guid));
   }
 }
 
@@ -2289,7 +2280,7 @@ bool q_omg_security_check_remote_reader_permissions(const struct proxy_reader *p
       else
       {
         if (!is_topic_discovery_protected(pp->sec_attr->permissions_handle, sc->access_control_context, subscription_data.topic_name))
-          EXCEPTION_ERROR(sc, &exception, "Access control does not allow remote reader "PGUIDFMT": %s", PGUID(prd->e.guid));
+          EXCEPTION_ERROR(gv, &exception, "Access control does not allow remote reader "PGUIDFMT": %s", PGUID(prd->e.guid));
         else
           DDS_Security_Exception_reset(&exception);
       }
@@ -2383,7 +2374,7 @@ void q_omg_security_deregister_remote_reader_match(const struct ddsi_domaingv *g
   if (m->crypto_handle != 0)
   {
     if (!sc->crypto_context->crypto_key_factory->unregister_datareader(sc->crypto_context->crypto_key_factory, m->crypto_handle, &exception))
-      EXCEPTION_ERROR(sc, &exception, "Failed to unregister remote reader "PGUIDFMT" for writer "PGUIDFMT, PGUID(m->prd_guid), PGUID(*wr_guid));
+      EXCEPTION_ERROR(gv, &exception, "Failed to unregister remote reader "PGUIDFMT" for writer "PGUIDFMT, PGUID(m->prd_guid), PGUID(*wr_guid));
   }
 }
 
@@ -2408,7 +2399,7 @@ static void send_writer_crypto_tokens(struct writer *wr, struct proxy_reader *pr
 
   r = sc->crypto_context->crypto_key_exchange->create_local_datawriter_crypto_tokens(sc->crypto_context->crypto_key_exchange, &tokens, local_crypto, remote_crypto, &exception);
   if (!r)
-    EXCEPTION_ERROR(sc, &exception,"Failed to create local writer crypto tokens "PGUIDFMT" for remote reader "PGUIDFMT, PGUID(wr->e.guid), PGUID(prd->e.guid));
+    EXCEPTION_ERROR(gv, &exception,"Failed to create local writer crypto tokens "PGUIDFMT" for remote reader "PGUIDFMT, PGUID(wr->e.guid), PGUID(prd->e.guid));
   else if (tokens._length > 0)
   {
     nn_dataholderseq_t tholder;
@@ -2418,7 +2409,7 @@ static void send_writer_crypto_tokens(struct writer *wr, struct proxy_reader *pr
     q_omg_shallow_free_nn_dataholderseq(&tholder);
 
     if (!sc->crypto_context->crypto_key_exchange->return_crypto_tokens(sc->crypto_context->crypto_key_exchange, &tokens, &exception))
-      EXCEPTION_ERROR(sc, &exception, "Failed to return local writer crypto tokens "PGUIDFMT" for remote reader "PGUIDFMT, PGUID(wr->e.guid), PGUID(prd->e.guid));
+      EXCEPTION_ERROR(gv, &exception, "Failed to return local writer crypto tokens "PGUIDFMT" for remote reader "PGUIDFMT, PGUID(wr->e.guid), PGUID(prd->e.guid));
   }
 }
 
@@ -2454,7 +2445,7 @@ static bool q_omg_security_register_remote_reader_match(struct proxy_reader *prd
       allowed = true;
     }
     else
-      EXCEPTION_ERROR(sc, &exception, "Failed to register remote reader "PGUIDFMT" with writer "PGUIDFMT, PGUID(prd->e.guid), PGUID(wr->e.guid));
+      EXCEPTION_ERROR(gv, &exception, "Failed to register remote reader "PGUIDFMT" with writer "PGUIDFMT, PGUID(prd->e.guid), PGUID(wr->e.guid));
   }
   else
   {
@@ -2466,7 +2457,7 @@ static bool q_omg_security_register_remote_reader_match(struct proxy_reader *prd
       *crypto_handle = sc->crypto_context->crypto_key_factory->register_matched_remote_datareader(
           sc->crypto_context->crypto_key_factory, wr->sec_attr->crypto_handle, proxypp->sec_attr->crypto_handle, proxypp_match->shared_secret, relay_only, &exception);
       if (*crypto_handle == 0)
-        EXCEPTION_ERROR(sc, &exception, "Failed to register remote reader "PGUIDFMT" with writer "PGUIDFMT, PGUID(prd->e.guid), PGUID(wr->e.guid));
+        EXCEPTION_ERROR(gv, &exception, "Failed to register remote reader "PGUIDFMT" with writer "PGUIDFMT, PGUID(prd->e.guid), PGUID(wr->e.guid));
       else
       {
         pending_match->crypto_handle = *crypto_handle;
@@ -2476,7 +2467,7 @@ static bool q_omg_security_register_remote_reader_match(struct proxy_reader *prd
         {
           if (!sc->crypto_context->crypto_key_exchange->set_remote_datareader_crypto_tokens(
               sc->crypto_context->crypto_key_exchange, wr->sec_attr->crypto_handle, *crypto_handle, pending_match->tokens, &exception))
-            EXCEPTION_ERROR(sc, &exception, "Failed to set remote reader crypto tokens "PGUIDFMT" --> "PGUIDFMT, PGUID(prd->e.guid), PGUID(wr->e.guid));
+            EXCEPTION_ERROR(gv, &exception, "Failed to set remote reader crypto tokens "PGUIDFMT" --> "PGUIDFMT, PGUID(prd->e.guid), PGUID(wr->e.guid));
           else
           {
             GVTRACE(" match_remote_reader "PGUIDFMT" with writer "PGUIDFMT": tokens available\n", PGUID(prd->e.guid), PGUID(wr->e.guid));
@@ -2575,7 +2566,7 @@ void q_omg_security_set_remote_writer_crypto_tokens(struct reader *rd, const dds
   else
   {
     if (!sc->crypto_context->crypto_key_exchange->set_remote_datawriter_crypto_tokens(sc->crypto_context->crypto_key_exchange, rd->sec_attr->crypto_handle, match->crypto_handle, tseq, &exception))
-      EXCEPTION_ERROR(sc, &exception, "Failed to set remote writer crypto tokens "PGUIDFMT" for reader "PGUIDFMT, PGUID(pwr->e.guid), PGUID(rd->e.guid));
+      EXCEPTION_ERROR(gv, &exception, "Failed to set remote writer crypto tokens "PGUIDFMT" for reader "PGUIDFMT, PGUID(pwr->e.guid), PGUID(rd->e.guid));
     else
     {
       GVTRACE("set_remote_writer_crypto_tokens "PGUIDFMT" with reader "PGUIDFMT"\n", PGUID(pwr->e.guid), PGUID(rd->e.guid));
@@ -2614,7 +2605,7 @@ void q_omg_security_set_remote_reader_crypto_tokens(struct writer *wr, const dds
    else
    {
      if (!sc->crypto_context->crypto_key_exchange->set_remote_datareader_crypto_tokens(sc->crypto_context->crypto_key_exchange, wr->sec_attr->crypto_handle, match->crypto_handle, tseq, &exception))
-       EXCEPTION_ERROR(sc, &exception, "Failed to set remote reader crypto tokens "PGUIDFMT" for writer "PGUIDFMT, PGUID(prd->e.guid), PGUID(wr->e.guid));
+       EXCEPTION_ERROR(gv, &exception, "Failed to set remote reader crypto tokens "PGUIDFMT" for writer "PGUIDFMT, PGUID(prd->e.guid), PGUID(wr->e.guid));
      else
      {
        GVTRACE("set_remote_reader_crypto_tokens "PGUIDFMT" with writer "PGUIDFMT"\n", PGUID(prd->e.guid), PGUID(wr->e.guid));
diff --git a/src/core/ddsi/src/q_entity.c b/src/core/ddsi/src/q_entity.c
index dfd2433..2669c09 100644
--- a/src/core/ddsi/src/q_entity.c
+++ b/src/core/ddsi/src/q_entity.c
@@ -858,7 +858,7 @@ static dds_return_t check_and_load_security_config (struct ddsi_domaingv * const
     GVLOGDISC ("new_participant("PGUIDFMT"): security is already loaded for this domain\n", PGUID (*ppguid));
     return DDS_RETCODE_OK;
   }
-  else if (q_omg_security_load (gv->security_context, qos) < 0)
+  else if (q_omg_security_load (gv->security_context, qos, gv) < 0)
   {
     GVERROR ("Could not load security\n");
     return DDS_RETCODE_NOT_ALLOWED_BY_SECURITY;
diff --git a/src/security/api/CMakeLists.txt b/src/security/api/CMakeLists.txt
index 02586c6..fe9e0b4 100644
--- a/src/security/api/CMakeLists.txt
+++ b/src/security/api/CMakeLists.txt
@@ -17,6 +17,7 @@ target_include_directories(
   security_api INTERFACE
     "$<BUILD_INTERFACE:${CMAKE_CURRENT_SOURCE_DIR}/include>"
     "$<BUILD_INTERFACE:${CMAKE_CURRENT_BINARY_DIR}/include>"
+    "$<BUILD_INTERFACE:${CMAKE_CURRENT_LIST_DIR}/../../core/ddsi/include>"
 )
 
 install(
diff --git a/src/security/api/include/dds/security/dds_security_api.h b/src/security/api/include/dds/security/dds_security_api.h
index ba29184..55ab6a0 100644
--- a/src/security/api/include/dds/security/dds_security_api.h
+++ b/src/security/api/include/dds/security/dds_security_api.h
@@ -13,8 +13,7 @@
 #ifndef DDS_SECURITY_API_H
 #define DDS_SECURITY_API_H
 
-
-/* Various security plugins. */
+#include "dds/ddsi/ddsi_domaingv.h"
 #include "dds_security_api_access_control.h"
 #include "dds_security_api_authentication.h"
 #include "dds_security_api_cryptography.h"
@@ -24,25 +23,12 @@
 extern "C" {
 #endif
 
-
-/**
- * Integration functions for Security plugins
- *
- */
-
-typedef int  (*plugin_init)(
-         const char *argument,
-         void **context
-        );
-
-typedef int  (*plugin_finalize)(
-         void *context
-        );
-
+/* Integration functions for Security plugins */
+typedef int (*plugin_init)(const char *argument, void **context, struct ddsi_domaingv *gv);
+typedef int  (*plugin_finalize)(void *context);
 
 #if defined (__cplusplus)
 }
 #endif
 
-
 #endif /* DDS_SECURITY_API_H */
diff --git a/src/security/api/include/dds/security/dds_security_api_access_control.h b/src/security/api/include/dds/security/dds_security_api_access_control.h
index 8b908b5..5bc7f26 100644
--- a/src/security/api/include/dds/security/dds_security_api_access_control.h
+++ b/src/security/api/include/dds/security/dds_security_api_access_control.h
@@ -16,359 +16,278 @@
 #include "dds_security_api_types.h"
 #include "dds_security_api_authentication.h"
 
-#if defined (__cplusplus)
-extern "C" {
+#if defined(__cplusplus)
+extern "C"
+{
 #endif
 
-
-
-/**
- * AccessControl Component
- */
+/* AccessControl Component */
 struct dds_security_access_control;
 typedef struct dds_security_access_control dds_security_access_control;
 
+
+/* AccessControlListener Interface */
 struct dds_security_access_control_listener;
 typedef struct dds_security_access_control_listener dds_security_access_control_listener;
 
-
-/**
- * AccessControlListener Interface
- * */
-
-
-typedef DDS_Security_boolean
-(*DDS_Security_access_control_listener_on_revoke_permissions)
-        ( dds_security_access_control_listener *instance,
-          const dds_security_access_control *plugin,
-          const DDS_Security_PermissionsHandle handle);
+typedef DDS_Security_boolean (*DDS_Security_access_control_listener_on_revoke_permissions)(
+    const dds_security_access_control *plugin,
+    const DDS_Security_PermissionsHandle handle);
 
 struct dds_security_access_control_listener
 {
   DDS_Security_access_control_listener_on_revoke_permissions on_revoke_permissions;
 };
 
+/* AccessControl Interface */
+typedef DDS_Security_PermissionsHandle (*DDS_Security_access_control_validate_local_permissions)(
+    dds_security_access_control *instance,
+    const dds_security_authentication *auth_plugin,
+    const DDS_Security_IdentityHandle identity,
+    const DDS_Security_DomainId domain_id,
+    const DDS_Security_Qos *participant_qos,
+    DDS_Security_SecurityException *ex);
 
-/**
- * AccessControl Interface
- */
+typedef DDS_Security_PermissionsHandle (*DDS_Security_access_control_validate_remote_permissions)(
+    dds_security_access_control *instance,
+    const dds_security_authentication *auth_plugin,
+    const DDS_Security_IdentityHandle local_identity_handle,
+    const DDS_Security_IdentityHandle remote_identity_handle,
+    const DDS_Security_PermissionsToken *remote_permissions_token,
+    const DDS_Security_AuthenticatedPeerCredentialToken *remote_credential_token,
+    DDS_Security_SecurityException *ex);
 
-typedef DDS_Security_PermissionsHandle
-(*DDS_Security_access_control_validate_local_permissions)
-        ( dds_security_access_control *instance,
-          const dds_security_authentication *auth_plugin,
-          const DDS_Security_IdentityHandle identity,
-          const DDS_Security_DomainId domain_id,
-          const DDS_Security_Qos *participant_qos,
-          DDS_Security_SecurityException *ex);
+typedef DDS_Security_boolean (*DDS_Security_access_control_check_create_participant)(
+    dds_security_access_control *instance,
+    const DDS_Security_PermissionsHandle permissions_handle,
+    const DDS_Security_DomainId domain_id,
+    const DDS_Security_Qos *participant_qos,
+    DDS_Security_SecurityException *ex);
 
-typedef DDS_Security_PermissionsHandle
-(*DDS_Security_access_control_validate_remote_permissions)
-        ( dds_security_access_control *instance,
-          const dds_security_authentication *auth_plugin,
-          const DDS_Security_IdentityHandle local_identity_handle,
-          const DDS_Security_IdentityHandle remote_identity_handle,
-          const DDS_Security_PermissionsToken *remote_permissions_token,
-          const DDS_Security_AuthenticatedPeerCredentialToken *remote_credential_token,
-          DDS_Security_SecurityException *ex);
+typedef DDS_Security_boolean (*DDS_Security_access_control_check_create_datawriter)(
+    dds_security_access_control *instance,
+    const DDS_Security_PermissionsHandle permissions_handle,
+    const DDS_Security_DomainId domain_id,
+    const DDS_Security_char *topic_name,
+    const DDS_Security_Qos *writer_qos,
+    const DDS_Security_PartitionQosPolicy *partition,
+    const DDS_Security_DataTags *data_tag,
+    DDS_Security_SecurityException *ex);
 
-typedef DDS_Security_boolean
-(*DDS_Security_access_control_check_create_participant)
-        ( dds_security_access_control *instance,
-          const DDS_Security_PermissionsHandle permissions_handle,
-          const DDS_Security_DomainId domain_id,
-          const DDS_Security_Qos *participant_qos,
-          DDS_Security_SecurityException *ex);
+typedef DDS_Security_boolean (*DDS_Security_access_control_check_create_datareader)(
+    dds_security_access_control *instance,
+    const DDS_Security_PermissionsHandle permissions_handle,
+    const DDS_Security_DomainId domain_id,
+    const DDS_Security_char *topic_name,
+    const DDS_Security_Qos *reader_qos,
+    const DDS_Security_PartitionQosPolicy *partition,
+    const DDS_Security_DataTags *data_tag,
+    DDS_Security_SecurityException *ex);
 
-typedef DDS_Security_boolean
-(*DDS_Security_access_control_check_create_datawriter)
-        ( dds_security_access_control *instance,
-          const DDS_Security_PermissionsHandle permissions_handle,
-          const DDS_Security_DomainId domain_id,
-          const DDS_Security_char *topic_name,
-          const DDS_Security_Qos *writer_qos,
-          const DDS_Security_PartitionQosPolicy *partition,
-          const DDS_Security_DataTags *data_tag,
-          DDS_Security_SecurityException *ex);
+typedef DDS_Security_boolean (*DDS_Security_access_control_check_create_topic)(
+    dds_security_access_control *instance,
+    const DDS_Security_PermissionsHandle permissions_handle,
+    const DDS_Security_DomainId domain_id,
+    const DDS_Security_char *topic_name,
+    const DDS_Security_Qos *topic_qos,
+    DDS_Security_SecurityException *ex);
 
-typedef DDS_Security_boolean
-(*DDS_Security_access_control_check_create_datareader)
-        ( dds_security_access_control *instance,
-          const DDS_Security_PermissionsHandle permissions_handle,
-          const DDS_Security_DomainId domain_id,
-          const DDS_Security_char *topic_name,
-          const DDS_Security_Qos *reader_qos,
-          const DDS_Security_PartitionQosPolicy *partition,
-          const DDS_Security_DataTags *data_tag,
-          DDS_Security_SecurityException *ex);
+typedef DDS_Security_boolean (*DDS_Security_access_control_check_local_datawriter_register_instance)(
+    dds_security_access_control *instance,
+    const DDS_Security_PermissionsHandle permissions_handle,
+    const DDS_Security_Entity *writer,
+    const DDS_Security_DynamicData *key,
+    DDS_Security_SecurityException *ex);
 
+typedef DDS_Security_boolean (*DDS_Security_access_control_check_local_datawriter_dispose_instance)(
+    dds_security_access_control *instance,
+    const DDS_Security_PermissionsHandle permissions_handle,
+    const DDS_Security_Entity *writer,
+    const DDS_Security_DynamicData key,
+    DDS_Security_SecurityException *ex);
 
-typedef DDS_Security_boolean
-(*DDS_Security_access_control_check_create_topic)
-        ( dds_security_access_control *instance,
-          const DDS_Security_PermissionsHandle permissions_handle,
-          const DDS_Security_DomainId domain_id,
-          const DDS_Security_char *topic_name,
-          const DDS_Security_Qos *topic_qos,
-          DDS_Security_SecurityException *ex);
+typedef DDS_Security_boolean (*DDS_Security_access_control_check_remote_participant)(
+    dds_security_access_control *instance,
+    const DDS_Security_PermissionsHandle permissions_handle,
+    const DDS_Security_DomainId domain_id,
+    const DDS_Security_ParticipantBuiltinTopicDataSecure *participant_data,
+    DDS_Security_SecurityException *ex);
 
-typedef DDS_Security_boolean
-(*DDS_Security_access_control_check_local_datawriter_register_instance)
-        ( dds_security_access_control *instance,
-          const DDS_Security_PermissionsHandle permissions_handle,
-          const DDS_Security_Entity *writer,
-          const DDS_Security_DynamicData *key,
-          DDS_Security_SecurityException *ex);
+typedef DDS_Security_boolean (*DDS_Security_access_control_check_remote_datawriter)(
+    dds_security_access_control *instance,
+    const DDS_Security_PermissionsHandle permissions_handle,
+    const DDS_Security_DomainId domain_id,
+    const DDS_Security_PublicationBuiltinTopicDataSecure *publication_data,
+    DDS_Security_SecurityException *ex);
 
-typedef DDS_Security_boolean
-(*DDS_Security_access_control_check_local_datawriter_dispose_instance)
-        ( dds_security_access_control *instance,
-          const DDS_Security_PermissionsHandle permissions_handle,
-          const DDS_Security_Entity *writer,
-          const DDS_Security_DynamicData key,
-          DDS_Security_SecurityException *ex);
+typedef DDS_Security_boolean (*DDS_Security_access_control_check_remote_datareader)(
+    dds_security_access_control *instance,
+    const DDS_Security_PermissionsHandle permissions_handle,
+    const DDS_Security_DomainId domain_id,
+    const DDS_Security_SubscriptionBuiltinTopicDataSecure *subscription_data,
+    DDS_Security_boolean *relay_only,
+    DDS_Security_SecurityException *ex);
 
-typedef DDS_Security_boolean
-(*DDS_Security_access_control_check_remote_participant)
-        ( dds_security_access_control *instance,
-          const DDS_Security_PermissionsHandle permissions_handle,
-          const DDS_Security_DomainId domain_id,
-          const DDS_Security_ParticipantBuiltinTopicDataSecure *participant_data,
-          DDS_Security_SecurityException *ex);
+typedef DDS_Security_boolean (*DDS_Security_access_control_check_remote_topic)(
+    dds_security_access_control *instance,
+    const DDS_Security_PermissionsHandle permissions_handle,
+    const DDS_Security_DomainId domain_id,
+    const DDS_Security_TopicBuiltinTopicData *topic_data,
+    DDS_Security_SecurityException *ex);
 
-typedef DDS_Security_boolean
-(*DDS_Security_access_control_check_remote_datawriter)
-        ( dds_security_access_control *instance,
-          const DDS_Security_PermissionsHandle permissions_handle,
-          const DDS_Security_DomainId domain_id,
-          const DDS_Security_PublicationBuiltinTopicDataSecure *publication_data,
-          DDS_Security_SecurityException *ex);
+typedef DDS_Security_boolean (*DDS_Security_access_control_check_local_datawriter_match)(
+    dds_security_access_control *instance,
+    const DDS_Security_PermissionsHandle writer_permissions_handle,
+    const DDS_Security_PermissionsHandle reader_permissions_handle,
+    const DDS_Security_PublicationBuiltinTopicDataSecure *publication_data,
+    const DDS_Security_SubscriptionBuiltinTopicDataSecure *subscription_data,
+    DDS_Security_SecurityException *ex);
 
-typedef DDS_Security_boolean
-(*DDS_Security_access_control_check_remote_datareader)
-        ( dds_security_access_control *instance,
-          const DDS_Security_PermissionsHandle permissions_handle,
-          const DDS_Security_DomainId domain_id,
-          const DDS_Security_SubscriptionBuiltinTopicDataSecure *subscription_data,
-          DDS_Security_boolean *relay_only,
-          DDS_Security_SecurityException *ex);
+typedef DDS_Security_boolean (*DDS_Security_access_control_check_local_datareader_match)(
+    dds_security_access_control *instance,
+    const DDS_Security_PermissionsHandle reader_permissions_handle,
+    const DDS_Security_PermissionsHandle writer_permissions_handle,
+    const DDS_Security_SubscriptionBuiltinTopicDataSecure *subscription_data,
+    const DDS_Security_PublicationBuiltinTopicDataSecure *publication_data,
+    DDS_Security_SecurityException *ex);
 
-typedef DDS_Security_boolean
-(*DDS_Security_access_control_check_remote_topic)
-        ( dds_security_access_control *instance,
-          const DDS_Security_PermissionsHandle permissions_handle,
-          const DDS_Security_DomainId domain_id,
-          const DDS_Security_TopicBuiltinTopicData *topic_data,
-          DDS_Security_SecurityException *ex);
+typedef DDS_Security_boolean (*DDS_Security_access_control_check_remote_datawriter_register_instance)(
+    dds_security_access_control *instance,
+    const DDS_Security_PermissionsHandle permissions_handle,
+    const DDS_Security_Entity *reader,
+    const DDS_Security_InstanceHandle publication_handle,
+    const DDS_Security_DynamicData key,
+    const DDS_Security_InstanceHandle instance_handle,
+    DDS_Security_SecurityException *ex);
 
+typedef DDS_Security_boolean (*DDS_Security_access_control_check_remote_datawriter_dispose_instance)(
+    dds_security_access_control *instance,
+    const DDS_Security_PermissionsHandle permissions_handle,
+    const DDS_Security_Entity *reader,
+    const DDS_Security_InstanceHandle publication_handle,
+    const DDS_Security_DynamicData key,
+    DDS_Security_SecurityException *ex);
 
-typedef DDS_Security_boolean
-(*DDS_Security_access_control_check_local_datawriter_match)
-        ( dds_security_access_control *instance,
-          const DDS_Security_PermissionsHandle writer_permissions_handle,
-          const DDS_Security_PermissionsHandle reader_permissions_handle,
-          const DDS_Security_PublicationBuiltinTopicDataSecure *publication_data,
-          const DDS_Security_SubscriptionBuiltinTopicDataSecure *subscription_data,
-          DDS_Security_SecurityException *ex);
+typedef DDS_Security_boolean (*DDS_Security_access_control_get_permissions_token)(
+    dds_security_access_control *instance,
+    DDS_Security_PermissionsToken *permissions_token,
+    const DDS_Security_PermissionsHandle handle,
+    DDS_Security_SecurityException *ex);
 
+typedef DDS_Security_boolean (*DDS_Security_access_control_get_permissions_credential_token)(
+    dds_security_access_control *instance,
+    DDS_Security_PermissionsCredentialToken *permissions_credential_token,
+    const DDS_Security_PermissionsHandle handle,
+    DDS_Security_SecurityException *ex);
 
-typedef DDS_Security_boolean
-(*DDS_Security_access_control_check_local_datareader_match)
-        ( dds_security_access_control *instance,
-          const DDS_Security_PermissionsHandle reader_permissions_handle,
-          const DDS_Security_PermissionsHandle writer_permissions_handle,
-          const DDS_Security_SubscriptionBuiltinTopicDataSecure *subscription_data,
-          const DDS_Security_PublicationBuiltinTopicDataSecure *publication_data,
-          DDS_Security_SecurityException *ex);
+typedef DDS_Security_boolean (*DDS_Security_access_control_set_listener)(
+    dds_security_access_control *instance,
+    const dds_security_access_control_listener *listener,
+    DDS_Security_SecurityException *ex);
 
-typedef DDS_Security_boolean
-(*DDS_Security_access_control_check_remote_datawriter_register_instance)
-        ( dds_security_access_control *instance,
-          const DDS_Security_PermissionsHandle permissions_handle,
-          const DDS_Security_Entity *reader,
-          const DDS_Security_InstanceHandle publication_handle,
-          const DDS_Security_DynamicData key,
-          const DDS_Security_InstanceHandle instance_handle,
-          DDS_Security_SecurityException *ex);
+typedef DDS_Security_boolean (*DDS_Security_access_control_return_permissions_token)(
+    dds_security_access_control *instance,
+    const DDS_Security_PermissionsToken *token,
+    DDS_Security_SecurityException *ex);
 
-typedef DDS_Security_boolean
-(*DDS_Security_access_control_check_remote_datawriter_dispose_instance)
-        ( dds_security_access_control *instance,
-          const DDS_Security_PermissionsHandle permissions_handle,
-          const DDS_Security_Entity *reader,
-          const DDS_Security_InstanceHandle publication_handle,
-          const DDS_Security_DynamicData key,
-          DDS_Security_SecurityException *ex);
+typedef DDS_Security_boolean (*DDS_Security_access_control_return_permissions_credential_token)(
+    dds_security_access_control *instance,
+    const DDS_Security_PermissionsCredentialToken *permissions_credential_token,
+    DDS_Security_SecurityException *ex);
 
-typedef DDS_Security_boolean
-(*DDS_Security_access_control_get_permissions_token)
-        ( dds_security_access_control *instance,
-          DDS_Security_PermissionsToken *permissions_token,
-          const DDS_Security_PermissionsHandle handle,
-          DDS_Security_SecurityException *ex);
+typedef DDS_Security_boolean (*DDS_Security_access_control_get_participant_sec_attributes)(
+    dds_security_access_control *instance,
+    const DDS_Security_PermissionsHandle permissions_handle,
+    DDS_Security_ParticipantSecurityAttributes *attributes,
+    DDS_Security_SecurityException *ex);
 
-typedef DDS_Security_boolean
-(*DDS_Security_access_control_get_permissions_credential_token)
-        ( dds_security_access_control *instance,
-          DDS_Security_PermissionsCredentialToken *permissions_credential_token,
-          const DDS_Security_PermissionsHandle handle,
-          DDS_Security_SecurityException *ex);
+typedef DDS_Security_boolean (*DDS_Security_access_control_get_topic_sec_attributes)(
+    dds_security_access_control *instance,
+    const DDS_Security_PermissionsHandle permissions_handle,
+    const DDS_Security_char *topic_name,
+    DDS_Security_TopicSecurityAttributes *attributes,
+    DDS_Security_SecurityException *ex);
 
-typedef DDS_Security_boolean
-(*DDS_Security_access_control_set_listener)
-        ( dds_security_access_control *instance,
-          const dds_security_access_control_listener *listener,
-          DDS_Security_SecurityException *ex);
+typedef DDS_Security_boolean (*DDS_Security_access_control_get_datawriter_sec_attributes)(
+    dds_security_access_control *instance,
+    const DDS_Security_PermissionsHandle permissions_handle,
+    const DDS_Security_char *topic_name,
+    const DDS_Security_PartitionQosPolicy *partition,
+    const DDS_Security_DataTagQosPolicy *data_tag,
+    DDS_Security_EndpointSecurityAttributes *attributes,
+    DDS_Security_SecurityException *ex);
 
-typedef DDS_Security_boolean
-(*DDS_Security_access_control_return_permissions_token)
-        ( dds_security_access_control *instance,
-          const DDS_Security_PermissionsToken *token,
-          DDS_Security_SecurityException *ex);
+typedef DDS_Security_boolean (*DDS_Security_access_control_get_datareader_sec_attributes)(
+    dds_security_access_control *instance,
+    const DDS_Security_PermissionsHandle permissions_handle,
+    const DDS_Security_char *topic_name,
+    const DDS_Security_PartitionQosPolicy *partition,
+    const DDS_Security_DataTagQosPolicy *data_tag,
+    DDS_Security_EndpointSecurityAttributes *attributes,
+    DDS_Security_SecurityException *ex);
 
-typedef DDS_Security_boolean
-(*DDS_Security_access_control_return_permissions_credential_token)
-        ( dds_security_access_control *instance,
-          const DDS_Security_PermissionsCredentialToken *permissions_credential_token,
-          DDS_Security_SecurityException *ex);
+typedef DDS_Security_boolean (*DDS_Security_access_control_return_participant_sec_attributes)(
+    dds_security_access_control *instance,
+    const DDS_Security_ParticipantSecurityAttributes *attributes,
+    DDS_Security_SecurityException *ex);
 
-typedef DDS_Security_boolean
-(*DDS_Security_access_control_get_participant_sec_attributes)
-        ( dds_security_access_control *instance,
-          const DDS_Security_PermissionsHandle permissions_handle,
-          DDS_Security_ParticipantSecurityAttributes *attributes,
-          DDS_Security_SecurityException *ex);
+typedef DDS_Security_boolean (*DDS_Security_access_control_return_topic_sec_attributes)(
+    dds_security_access_control *instance,
+    const DDS_Security_TopicSecurityAttributes *attributes,
+    DDS_Security_SecurityException *ex);
 
+typedef DDS_Security_boolean (*DDS_Security_access_control_return_datawriter_sec_attributes)(
+    dds_security_access_control *instance,
+    const DDS_Security_EndpointSecurityAttributes *attributes,
+    DDS_Security_SecurityException *ex);
 
-typedef DDS_Security_boolean
-(*DDS_Security_access_control_get_topic_sec_attributes)
-        ( dds_security_access_control *instance,
-          const DDS_Security_PermissionsHandle permissions_handle,
-          const DDS_Security_char *topic_name,
-          DDS_Security_TopicSecurityAttributes *attributes,
-          DDS_Security_SecurityException *ex);
-
-
-typedef DDS_Security_boolean
-(*DDS_Security_access_control_get_datawriter_sec_attributes)
-        ( dds_security_access_control *instance,
-          const DDS_Security_PermissionsHandle permissions_handle,
-          const DDS_Security_char *topic_name,
-          const DDS_Security_PartitionQosPolicy *partition,
-          const DDS_Security_DataTagQosPolicy *data_tag,
-          DDS_Security_EndpointSecurityAttributes *attributes,
-          DDS_Security_SecurityException *ex);
-
-
-typedef DDS_Security_boolean
-(*DDS_Security_access_control_get_datareader_sec_attributes)
-        ( dds_security_access_control *instance,
-          const DDS_Security_PermissionsHandle permissions_handle,
-          const DDS_Security_char *topic_name,
-          const DDS_Security_PartitionQosPolicy *partition,
-          const DDS_Security_DataTagQosPolicy *data_tag,
-          DDS_Security_EndpointSecurityAttributes *attributes,
-          DDS_Security_SecurityException *ex);
-
-
-typedef DDS_Security_boolean
-(*DDS_Security_access_control_return_participant_sec_attributes)
-        ( dds_security_access_control *instance,
-          const DDS_Security_ParticipantSecurityAttributes *attributes,
-          DDS_Security_SecurityException *ex);
-
-typedef DDS_Security_boolean
-(*DDS_Security_access_control_return_topic_sec_attributes)
-        ( dds_security_access_control *instance,
-          const DDS_Security_TopicSecurityAttributes *attributes,
-          DDS_Security_SecurityException *ex);
-
-typedef DDS_Security_boolean
-(*DDS_Security_access_control_return_datawriter_sec_attributes)
-        ( dds_security_access_control *instance,
-          const DDS_Security_EndpointSecurityAttributes *attributes,
-          DDS_Security_SecurityException *ex);
-
-
-typedef DDS_Security_boolean
-(*DDS_Security_access_control_return_datareader_sec_attributes)
-        ( dds_security_access_control *instance,
-          const DDS_Security_EndpointSecurityAttributes *attributes,
-          DDS_Security_SecurityException *ex);
-
-typedef DDS_Security_boolean
-(*DDS_Security_access_control_return_permissions_handle)
-        ( dds_security_access_control *instance,
-           DDS_Security_PermissionsHandle permissions_handle,
-          DDS_Security_SecurityException *ex);
+typedef DDS_Security_boolean (*DDS_Security_access_control_return_datareader_sec_attributes)(
+    dds_security_access_control *instance,
+    const DDS_Security_EndpointSecurityAttributes *attributes,
+    DDS_Security_SecurityException *ex);
 
+typedef DDS_Security_boolean (*DDS_Security_access_control_return_permissions_handle)(
+    dds_security_access_control *instance,
+    DDS_Security_PermissionsHandle permissions_handle,
+    DDS_Security_SecurityException *ex);
 
 struct dds_security_access_control
 {
+  struct ddsi_domaingv *gv;
+
   DDS_Security_access_control_validate_local_permissions validate_local_permissions;
-
   DDS_Security_access_control_validate_remote_permissions validate_remote_permissions;
-
   DDS_Security_access_control_check_create_participant check_create_participant;
-
   DDS_Security_access_control_check_create_datawriter check_create_datawriter;
-
   DDS_Security_access_control_check_create_datareader check_create_datareader;
-
   DDS_Security_access_control_check_create_topic check_create_topic;
-
   DDS_Security_access_control_check_local_datawriter_register_instance check_local_datawriter_register_instance;
-
   DDS_Security_access_control_check_local_datawriter_dispose_instance check_local_datawriter_dispose_instance;
-
   DDS_Security_access_control_check_remote_participant check_remote_participant;
-
   DDS_Security_access_control_check_remote_datawriter check_remote_datawriter;
-
   DDS_Security_access_control_check_remote_datareader check_remote_datareader;
-
   DDS_Security_access_control_check_remote_topic check_remote_topic;
-
   DDS_Security_access_control_check_local_datawriter_match check_local_datawriter_match;
-
   DDS_Security_access_control_check_local_datareader_match check_local_datareader_match;
-
   DDS_Security_access_control_check_remote_datawriter_register_instance check_remote_datawriter_register_instance;
-
   DDS_Security_access_control_check_remote_datawriter_dispose_instance check_remote_datawriter_dispose_instance;
-
   DDS_Security_access_control_get_permissions_token get_permissions_token;
-
   DDS_Security_access_control_get_permissions_credential_token get_permissions_credential_token;
-
   DDS_Security_access_control_set_listener set_listener;
-
   DDS_Security_access_control_return_permissions_token return_permissions_token;
-
   DDS_Security_access_control_return_permissions_credential_token return_permissions_credential_token;
-
   DDS_Security_access_control_get_participant_sec_attributes get_participant_sec_attributes;
-
   DDS_Security_access_control_get_topic_sec_attributes get_topic_sec_attributes;
-
   DDS_Security_access_control_get_datawriter_sec_attributes get_datawriter_sec_attributes;
-
   DDS_Security_access_control_get_datareader_sec_attributes get_datareader_sec_attributes;
-
   DDS_Security_access_control_return_participant_sec_attributes return_participant_sec_attributes;
-
   DDS_Security_access_control_return_topic_sec_attributes return_topic_sec_attributes;
-
   DDS_Security_access_control_return_datawriter_sec_attributes return_datawriter_sec_attributes;
-
   DDS_Security_access_control_return_datareader_sec_attributes return_datareader_sec_attributes;
-
   DDS_Security_access_control_return_permissions_handle return_permissions_handle;
-
 };
 
-
-#if defined (__cplusplus)
+#if defined(__cplusplus)
 }
 #endif
 
diff --git a/src/security/api/include/dds/security/dds_security_api_authentication.h b/src/security/api/include/dds/security/dds_security_api_authentication.h
index 4913985..c0d9298 100644
--- a/src/security/api/include/dds/security/dds_security_api_authentication.h
+++ b/src/security/api/include/dds/security/dds_security_api_authentication.h
@@ -15,223 +15,170 @@
 
 #include "dds_security_api_types.h"
 
-#if defined (__cplusplus)
-extern "C" {
+#if defined(__cplusplus)
+extern "C"
+{
 #endif
 
-
-/**
- * Authentication Component
- */
+/* Authentication Component */
 struct dds_security_authentication;
 typedef struct dds_security_authentication dds_security_authentication;
 
 struct dds_security_authentication_listener;
 typedef struct dds_security_authentication_listener dds_security_authentication_listener;
 
+/* AuthenticationListener interface */
+typedef DDS_Security_boolean (*DDS_Security_authentication_listener_on_revoke_identity)(
+    dds_security_authentication_listener *context,
+    const dds_security_authentication *plugin,
+    const DDS_Security_IdentityHandle handle);
 
-/**
- * AuthenticationListener interface
- */
-
-typedef DDS_Security_boolean
-(*DDS_Security_authentication_listener_on_revoke_identity)
-        ( dds_security_authentication_listener *context,
-          const dds_security_authentication *plugin,
-          const DDS_Security_IdentityHandle handle
-        );
-
-typedef DDS_Security_boolean
-(*DDS_Security_authentication_listener_on_status_changed)
-        ( dds_security_authentication_listener *context,
-          const dds_security_authentication *plugin,
-          const DDS_Security_IdentityHandle handle,
-          const DDS_Security_AuthStatusKind status_kind
-        );
-
+typedef DDS_Security_boolean (*DDS_Security_authentication_listener_on_status_changed)(
+    dds_security_authentication_listener *context,
+    const dds_security_authentication *plugin,
+    const DDS_Security_IdentityHandle handle,
+    const DDS_Security_AuthStatusKind status_kind);
 
 struct dds_security_authentication_listener
 {
   DDS_Security_authentication_listener_on_revoke_identity on_revoke_identity;
-
   DDS_Security_authentication_listener_on_status_changed on_status_changed;
 };
 
-typedef DDS_Security_ValidationResult_t
-(*DDS_Security_authentication_validate_local_identity)
-        ( dds_security_authentication *instance,
-          DDS_Security_IdentityHandle *local_identity_handle,
-          DDS_Security_GUID_t *adjusted_participant_guid,
-          const DDS_Security_DomainId domain_id,
-          const DDS_Security_Qos *participant_qos,
-          const DDS_Security_GUID_t *candidate_participant_guid,
-          DDS_Security_SecurityException *ex
-        );
+typedef DDS_Security_ValidationResult_t (*DDS_Security_authentication_validate_local_identity)(
+    dds_security_authentication *instance,
+    DDS_Security_IdentityHandle *local_identity_handle,
+    DDS_Security_GUID_t *adjusted_participant_guid,
+    const DDS_Security_DomainId domain_id,
+    const DDS_Security_Qos *participant_qos,
+    const DDS_Security_GUID_t *candidate_participant_guid,
+    DDS_Security_SecurityException *ex);
 
+typedef DDS_Security_boolean (*DDS_Security_authentication_get_identity_token)(
+    dds_security_authentication *instance,
+    DDS_Security_IdentityToken *identity_token,
+    const DDS_Security_IdentityHandle handle,
+    DDS_Security_SecurityException *ex);
 
-typedef DDS_Security_boolean
-(*DDS_Security_authentication_get_identity_token)
-        ( dds_security_authentication *instance,
-          DDS_Security_IdentityToken *identity_token,
-          const DDS_Security_IdentityHandle handle,
-          DDS_Security_SecurityException *ex);
+typedef DDS_Security_boolean (*DDS_Security_authentication_get_identity_status_token)(
+    dds_security_authentication *instance,
+    DDS_Security_IdentityStatusToken *identity_status_token,
+    const DDS_Security_IdentityHandle handle,
+    DDS_Security_SecurityException *ex);
 
+typedef DDS_Security_boolean (*DDS_Security_authentication_set_permissions_credential_and_token)(
+    dds_security_authentication *instance,
+    const DDS_Security_IdentityHandle handle,
+    const DDS_Security_PermissionsCredentialToken *permissions_credential,
+    const DDS_Security_PermissionsToken *permissions_token,
+    DDS_Security_SecurityException *ex);
 
-typedef DDS_Security_boolean
-(*DDS_Security_authentication_get_identity_status_token)
-        ( dds_security_authentication *instance,
-          DDS_Security_IdentityStatusToken *identity_status_token,
-          const DDS_Security_IdentityHandle handle,
-          DDS_Security_SecurityException *ex);
+typedef DDS_Security_ValidationResult_t (*DDS_Security_authentication_validate_remote_identity)(
+    dds_security_authentication *instance,
+    DDS_Security_IdentityHandle *remote_identity_handle,
+    DDS_Security_AuthRequestMessageToken *local_auth_request_token,
+    const DDS_Security_AuthRequestMessageToken *remote_auth_request_token,
+    const DDS_Security_IdentityHandle local_identity_handle,
+    const DDS_Security_IdentityToken *remote_identity_token,
+    const DDS_Security_GUID_t *remote_participant_guid,
+    DDS_Security_SecurityException *ex);
 
-typedef DDS_Security_boolean
-(*DDS_Security_authentication_set_permissions_credential_and_token)
-        ( dds_security_authentication *instance,
-          const DDS_Security_IdentityHandle handle,
-          const DDS_Security_PermissionsCredentialToken *permissions_credential,
-          const DDS_Security_PermissionsToken *permissions_token,
-          DDS_Security_SecurityException *ex);
+typedef DDS_Security_ValidationResult_t (*DDS_Security_authentication_begin_handshake_request)(
+    dds_security_authentication *instance,
+    DDS_Security_HandshakeHandle *handshake_handle,
+    DDS_Security_HandshakeMessageToken *handshake_message,
+    const DDS_Security_IdentityHandle initiator_identity_handle,
+    const DDS_Security_IdentityHandle replier_identity_handle,
+    const DDS_Security_OctetSeq *serialized_local_participant_data,
+    DDS_Security_SecurityException *ex);
 
+typedef DDS_Security_ValidationResult_t (*DDS_Security_authentication_begin_handshake_reply)(
+    dds_security_authentication *instance,
+    DDS_Security_HandshakeHandle *handshake_handle,
+    DDS_Security_HandshakeMessageToken *handshake_message_out,
+    const DDS_Security_HandshakeMessageToken *handshake_message_in,
+    const DDS_Security_IdentityHandle initiator_identity_handle,
+    const DDS_Security_IdentityHandle replier_identity_handle,
+    const DDS_Security_OctetSeq *serialized_local_participant_data,
+    DDS_Security_SecurityException *ex);
 
-typedef DDS_Security_ValidationResult_t
-(*DDS_Security_authentication_validate_remote_identity)
-        ( dds_security_authentication *instance,
-          DDS_Security_IdentityHandle *remote_identity_handle,
-          DDS_Security_AuthRequestMessageToken *local_auth_request_token,
-          const DDS_Security_AuthRequestMessageToken *remote_auth_request_token,
-          const DDS_Security_IdentityHandle local_identity_handle,
-          const DDS_Security_IdentityToken *remote_identity_token,
-          const DDS_Security_GUID_t *remote_participant_guid,
-          DDS_Security_SecurityException *ex);
+typedef DDS_Security_ValidationResult_t (*DDS_Security_authentication_process_handshake)(
+    dds_security_authentication *instance,
+    DDS_Security_HandshakeMessageToken *handshake_message_out,
+    const DDS_Security_HandshakeMessageToken *handshake_message_in,
+    const DDS_Security_HandshakeHandle handshake_handle,
+    DDS_Security_SecurityException *ex);
 
+typedef DDS_Security_SharedSecretHandle (*DDS_Security_authentication_get_shared_secret)(
+    dds_security_authentication *instance,
+    const DDS_Security_HandshakeHandle handshake_handle,
+    DDS_Security_SecurityException *ex);
 
-typedef DDS_Security_ValidationResult_t
-(*DDS_Security_authentication_begin_handshake_request)
-        ( dds_security_authentication *instance,
-          DDS_Security_HandshakeHandle *handshake_handle,
-          DDS_Security_HandshakeMessageToken *handshake_message,
-          const DDS_Security_IdentityHandle initiator_identity_handle,
-          const DDS_Security_IdentityHandle replier_identity_handle,
-          const DDS_Security_OctetSeq *serialized_local_participant_data,
-          DDS_Security_SecurityException *ex);
+typedef DDS_Security_boolean (*DDS_Security_authentication_get_authenticated_peer_credential_token)(
+    dds_security_authentication *instance,
+    DDS_Security_AuthenticatedPeerCredentialToken *peer_credential_token,
+    const DDS_Security_HandshakeHandle handshake_handle,
+    DDS_Security_SecurityException *ex);
 
+typedef DDS_Security_boolean (*DDS_Security_authentication_set_listener)(
+    dds_security_authentication *instance,
+    const dds_security_authentication_listener *listener,
+    DDS_Security_SecurityException *ex);
 
-typedef DDS_Security_ValidationResult_t
-(*DDS_Security_authentication_begin_handshake_reply)
-        ( dds_security_authentication *instance,
-          DDS_Security_HandshakeHandle *handshake_handle,
-          DDS_Security_HandshakeMessageToken *handshake_message_out,
-          const DDS_Security_HandshakeMessageToken *handshake_message_in,
-          const DDS_Security_IdentityHandle initiator_identity_handle,
-          const DDS_Security_IdentityHandle replier_identity_handle,
-          const DDS_Security_OctetSeq *serialized_local_participant_data,
-          DDS_Security_SecurityException *ex);
+typedef DDS_Security_boolean (*DDS_Security_authentication_return_identity_token)(
+    dds_security_authentication *instance,
+    const DDS_Security_IdentityToken *token,
+    DDS_Security_SecurityException *ex);
 
-typedef DDS_Security_ValidationResult_t
-(*DDS_Security_authentication_process_handshake)
-        ( dds_security_authentication *instance,
-          DDS_Security_HandshakeMessageToken *handshake_message_out,
-          const DDS_Security_HandshakeMessageToken *handshake_message_in,
-          const DDS_Security_HandshakeHandle handshake_handle,
-          DDS_Security_SecurityException *ex);
+typedef DDS_Security_boolean (*DDS_Security_authentication_return_identity_status_token)(
+    dds_security_authentication *instance,
+    const DDS_Security_IdentityStatusToken *token,
+    DDS_Security_SecurityException *ex);
 
-typedef DDS_Security_SharedSecretHandle
-(*DDS_Security_authentication_get_shared_secret)
-        ( dds_security_authentication *instance,
-          const DDS_Security_HandshakeHandle handshake_handle,
-          DDS_Security_SecurityException *ex);
+typedef DDS_Security_boolean (*DDS_Security_authentication_return_authenticated_peer_credential_token)(
+    dds_security_authentication *instance,
+    const DDS_Security_AuthenticatedPeerCredentialToken *peer_credential_token,
+    DDS_Security_SecurityException *ex);
 
-typedef DDS_Security_boolean
-(*DDS_Security_authentication_get_authenticated_peer_credential_token)
-        ( dds_security_authentication *instance,
-          DDS_Security_AuthenticatedPeerCredentialToken *peer_credential_token,
-          const DDS_Security_HandshakeHandle handshake_handle,
-          DDS_Security_SecurityException *ex);
+typedef DDS_Security_boolean (*DDS_Security_authentication_return_handshake_handle)(
+    dds_security_authentication *instance,
+    const DDS_Security_HandshakeHandle handshake_handle,
+    DDS_Security_SecurityException *ex);
 
-typedef DDS_Security_boolean
-(*DDS_Security_authentication_set_listener)
-        ( dds_security_authentication *instance,
-          const dds_security_authentication_listener *listener,
-          DDS_Security_SecurityException *ex);
-
-typedef DDS_Security_boolean
-(*DDS_Security_authentication_return_identity_token)
-        ( dds_security_authentication *instance,
-          const DDS_Security_IdentityToken *token,
-          DDS_Security_SecurityException *ex);
-
-
-typedef DDS_Security_boolean
-(*DDS_Security_authentication_return_identity_status_token)
-        ( dds_security_authentication *instance,
-          const DDS_Security_IdentityStatusToken *token,
-          DDS_Security_SecurityException *ex);
-
-typedef DDS_Security_boolean
-(*DDS_Security_authentication_return_authenticated_peer_credential_token)
-        ( dds_security_authentication *instance,
-          const DDS_Security_AuthenticatedPeerCredentialToken *peer_credential_token,
-          DDS_Security_SecurityException *ex);
-
-typedef DDS_Security_boolean
-(*DDS_Security_authentication_return_handshake_handle)
-        ( dds_security_authentication *instance,
-          const DDS_Security_HandshakeHandle handshake_handle,
-          DDS_Security_SecurityException *ex);
-
-typedef DDS_Security_boolean
-(*DDS_Security_authentication_return_identity_handle)
-        ( dds_security_authentication *instance,
-          const DDS_Security_IdentityHandle identity_handle,
-          DDS_Security_SecurityException *ex);
-
-typedef DDS_Security_boolean
-(*DDS_Security_authentication_return_sharedsecret_handle)
-        ( dds_security_authentication *instance,
-          const DDS_Security_SharedSecretHandle sharedsecret_handle,
-          DDS_Security_SecurityException *ex);
+typedef DDS_Security_boolean (*DDS_Security_authentication_return_identity_handle)(
+    dds_security_authentication *instance,
+    const DDS_Security_IdentityHandle identity_handle,
+    DDS_Security_SecurityException *ex);
 
+typedef DDS_Security_boolean (*DDS_Security_authentication_return_sharedsecret_handle)(
+    dds_security_authentication *instance,
+    const DDS_Security_SharedSecretHandle sharedsecret_handle,
+    DDS_Security_SecurityException *ex);
 
 struct dds_security_authentication
 {
+  struct ddsi_domaingv *gv;
 
   DDS_Security_authentication_validate_local_identity validate_local_identity;
-
   DDS_Security_authentication_get_identity_token get_identity_token;
-
   DDS_Security_authentication_get_identity_status_token get_identity_status_token;
-
   DDS_Security_authentication_set_permissions_credential_and_token set_permissions_credential_and_token;
-
   DDS_Security_authentication_validate_remote_identity validate_remote_identity;
-
   DDS_Security_authentication_begin_handshake_request begin_handshake_request;
-
   DDS_Security_authentication_begin_handshake_reply begin_handshake_reply;
-
   DDS_Security_authentication_process_handshake process_handshake;
-
   DDS_Security_authentication_get_shared_secret get_shared_secret;
-
   DDS_Security_authentication_get_authenticated_peer_credential_token get_authenticated_peer_credential_token;
-
   DDS_Security_authentication_set_listener set_listener;
-
   DDS_Security_authentication_return_identity_token return_identity_token;
-
   DDS_Security_authentication_return_identity_status_token return_identity_status_token;
-
   DDS_Security_authentication_return_authenticated_peer_credential_token return_authenticated_peer_credential_token;
-
   DDS_Security_authentication_return_handshake_handle return_handshake_handle;
-
   DDS_Security_authentication_return_identity_handle return_identity_handle;
-
   DDS_Security_authentication_return_sharedsecret_handle return_sharedsecret_handle;
 };
 
-
-#if defined (__cplusplus)
+#if defined(__cplusplus)
 }
 #endif
 
diff --git a/src/security/api/include/dds/security/dds_security_api_cryptography.h b/src/security/api/include/dds/security/dds_security_api_cryptography.h
index 5203d3d..2f3144e 100644
--- a/src/security/api/include/dds/security/dds_security_api_cryptography.h
+++ b/src/security/api/include/dds/security/dds_security_api_cryptography.h
@@ -15,14 +15,12 @@
 
 #include "dds_security_api_types.h"
 
-#if defined (__cplusplus)
-extern "C" {
+#if defined(__cplusplus)
+extern "C"
+{
 #endif
 
-/**
- * Crypto Component
- */
-
+/* Crypto Component */
 struct dds_security_crypto_key_factory;
 typedef struct dds_security_crypto_key_factory dds_security_crypto_key_factory;
 
@@ -32,305 +30,240 @@ typedef struct dds_security_crypto_key_exchange dds_security_crypto_key_exchange
 struct dds_security_crypto_transform;
 typedef struct dds_security_crypto_transform dds_security_crypto_transform;
 
-/**
- * CryptoKeyFactory interface
- */
+/* CryptoKeyFactory interface */
+typedef DDS_Security_ParticipantCryptoHandle (*DDS_Security_crypto_key_factory_register_local_participant)(
+    dds_security_crypto_key_factory *instance,
+    const DDS_Security_IdentityHandle participant_identity,
+    const DDS_Security_PermissionsHandle participant_permissions,
+    const DDS_Security_PropertySeq *participant_properties,
+    const DDS_Security_ParticipantSecurityAttributes *participant_security_attributes,
+    DDS_Security_SecurityException *ex);
 
-typedef DDS_Security_ParticipantCryptoHandle
-(*DDS_Security_crypto_key_factory_register_local_participant)
-        ( dds_security_crypto_key_factory *instance,
-          const DDS_Security_IdentityHandle participant_identity,
-          const DDS_Security_PermissionsHandle participant_permissions,
-          const DDS_Security_PropertySeq *participant_properties,
-          const DDS_Security_ParticipantSecurityAttributes *participant_security_attributes,
-          DDS_Security_SecurityException *ex);
+typedef DDS_Security_ParticipantCryptoHandle (*DDS_Security_crypto_key_factory_register_matched_remote_participant)(
+    dds_security_crypto_key_factory *instance,
+    const DDS_Security_ParticipantCryptoHandle local_participant_crypto_handle,
+    const DDS_Security_IdentityHandle remote_participant_identity,
+    const DDS_Security_PermissionsHandle remote_participant_permissions,
+    const DDS_Security_SharedSecretHandle shared_secret,
+    DDS_Security_SecurityException *ex);
 
-typedef DDS_Security_ParticipantCryptoHandle
-(*DDS_Security_crypto_key_factory_register_matched_remote_participant)
-        ( dds_security_crypto_key_factory *instance,
-          const DDS_Security_ParticipantCryptoHandle local_participant_crypto_handle,
-          const DDS_Security_IdentityHandle remote_participant_identity,
-          const DDS_Security_PermissionsHandle remote_participant_permissions,
-          const DDS_Security_SharedSecretHandle shared_secret,
-          DDS_Security_SecurityException *ex);
+typedef DDS_Security_DatawriterCryptoHandle (*DDS_Security_crypto_key_factory_register_local_datawriter)(
+    dds_security_crypto_key_factory *instance,
+    const DDS_Security_ParticipantCryptoHandle participant_crypto,
+    const DDS_Security_PropertySeq *datawriter_properties,
+    const DDS_Security_EndpointSecurityAttributes *datawriter_security_attributes,
+    DDS_Security_SecurityException *ex);
 
+typedef DDS_Security_DatareaderCryptoHandle (*DDS_Security_crypto_key_factory_register_matched_remote_datareader)(
+    dds_security_crypto_key_factory *instance,
+    const DDS_Security_DatawriterCryptoHandle local_datawriter_crypto_handle,
+    const DDS_Security_ParticipantCryptoHandle remote_participant_crypto,
+    const DDS_Security_SharedSecretHandle shared_secret,
+    const DDS_Security_boolean relay_only,
+    DDS_Security_SecurityException *ex);
 
-typedef DDS_Security_DatawriterCryptoHandle
-(*DDS_Security_crypto_key_factory_register_local_datawriter)
-        ( dds_security_crypto_key_factory *instance,
-          const DDS_Security_ParticipantCryptoHandle participant_crypto,
-          const DDS_Security_PropertySeq *datawriter_properties,
-          const DDS_Security_EndpointSecurityAttributes *datawriter_security_attributes,
-          DDS_Security_SecurityException *ex);
+typedef DDS_Security_DatareaderCryptoHandle (*DDS_Security_crypto_key_factory_register_local_datareader)(
+    dds_security_crypto_key_factory *instance,
+    const DDS_Security_ParticipantCryptoHandle participant_crypto_handle,
+    const DDS_Security_PropertySeq *datareader_properties,
+    const DDS_Security_EndpointSecurityAttributes *datareader_security_attributes,
+    DDS_Security_SecurityException *ex);
 
-typedef DDS_Security_DatareaderCryptoHandle
-(*DDS_Security_crypto_key_factory_register_matched_remote_datareader)
-        ( dds_security_crypto_key_factory *instance,
-          const DDS_Security_DatawriterCryptoHandle local_datawriter_crypto_handle,
-          const DDS_Security_ParticipantCryptoHandle remote_participant_crypto,
-          const DDS_Security_SharedSecretHandle shared_secret,
-          const DDS_Security_boolean relay_only,
-          DDS_Security_SecurityException *ex);
+typedef DDS_Security_DatawriterCryptoHandle (*DDS_Security_crypto_key_factory_register_matched_remote_datawriter)(
+    dds_security_crypto_key_factory *instance,
+    const DDS_Security_DatareaderCryptoHandle local_datareader_crypto_handle,
+    const DDS_Security_ParticipantCryptoHandle remote_participant_crypt,
+    const DDS_Security_SharedSecretHandle shared_secret,
+    DDS_Security_SecurityException *ex);
 
+typedef DDS_Security_boolean (*DDS_Security_crypto_key_factory_unregister_participant)(
+    dds_security_crypto_key_factory *instance,
+    const DDS_Security_ParticipantCryptoHandle participant_crypto_handle,
+    DDS_Security_SecurityException *ex);
 
-typedef DDS_Security_DatareaderCryptoHandle
-(*DDS_Security_crypto_key_factory_register_local_datareader)
-        ( dds_security_crypto_key_factory *instance,
-          const DDS_Security_ParticipantCryptoHandle participant_crypto_handle,
-          const DDS_Security_PropertySeq *datareader_properties,
-          const DDS_Security_EndpointSecurityAttributes *datareader_security_attributes,
-          DDS_Security_SecurityException *ex);
+typedef DDS_Security_boolean (*DDS_Security_crypto_key_factory_unregister_datawriter)(
+    dds_security_crypto_key_factory *instance,
+    const DDS_Security_DatawriterCryptoHandle datawriter_crypto_handle,
+    DDS_Security_SecurityException *ex);
 
-typedef DDS_Security_DatawriterCryptoHandle
-(*DDS_Security_crypto_key_factory_register_matched_remote_datawriter)
-        ( dds_security_crypto_key_factory *instance,
-          const DDS_Security_DatareaderCryptoHandle local_datareader_crypto_handle,
-          const DDS_Security_ParticipantCryptoHandle remote_participant_crypt,
-          const DDS_Security_SharedSecretHandle shared_secret,
-          DDS_Security_SecurityException *ex);
-
-typedef DDS_Security_boolean
-(*DDS_Security_crypto_key_factory_unregister_participant)
-        ( dds_security_crypto_key_factory *instance,
-          const DDS_Security_ParticipantCryptoHandle participant_crypto_handle,
-          DDS_Security_SecurityException *ex);
-
-typedef DDS_Security_boolean
-(*DDS_Security_crypto_key_factory_unregister_datawriter)
-        ( dds_security_crypto_key_factory *instance,
-          const DDS_Security_DatawriterCryptoHandle datawriter_crypto_handle,
-          DDS_Security_SecurityException *ex);
-
-typedef DDS_Security_boolean
-(*DDS_Security_crypto_key_factory_unregister_datareader)
-        ( dds_security_crypto_key_factory *instance,
-          const DDS_Security_DatareaderCryptoHandle datareader_crypto_handle,
-          DDS_Security_SecurityException *ex);
+typedef DDS_Security_boolean (*DDS_Security_crypto_key_factory_unregister_datareader)(
+    dds_security_crypto_key_factory *instance,
+    const DDS_Security_DatareaderCryptoHandle datareader_crypto_handle,
+    DDS_Security_SecurityException *ex);
 
 struct dds_security_crypto_key_factory
 {
-
   DDS_Security_crypto_key_factory_register_local_participant register_local_participant;
-
   DDS_Security_crypto_key_factory_register_matched_remote_participant register_matched_remote_participant;
-
   DDS_Security_crypto_key_factory_register_local_datawriter register_local_datawriter;
-
   DDS_Security_crypto_key_factory_register_matched_remote_datareader register_matched_remote_datareader;
-
   DDS_Security_crypto_key_factory_register_local_datareader register_local_datareader;
-
   DDS_Security_crypto_key_factory_register_matched_remote_datawriter register_matched_remote_datawriter;
-
   DDS_Security_crypto_key_factory_unregister_participant unregister_participant;
-
   DDS_Security_crypto_key_factory_unregister_datawriter unregister_datawriter;
-
   DDS_Security_crypto_key_factory_unregister_datareader unregister_datareader;
-} ;
+};
 
+/* CryptoKeyExchange Interface */
+typedef DDS_Security_boolean (*DDS_Security_crypto_key_exchange_create_local_participant_crypto_tokens)(
+    dds_security_crypto_key_exchange *instance,
+    DDS_Security_ParticipantCryptoTokenSeq *local_participant_crypto_tokens,
+    const DDS_Security_ParticipantCryptoHandle local_participant_crypto,
+    const DDS_Security_ParticipantCryptoHandle remote_participant_crypto,
+    DDS_Security_SecurityException *ex);
 
-/**
- * CryptoKeyExchange Interface
- */
-typedef DDS_Security_boolean
-(*DDS_Security_crypto_key_exchange_create_local_participant_crypto_tokens)
-        ( dds_security_crypto_key_exchange *instance,
-          DDS_Security_ParticipantCryptoTokenSeq *local_participant_crypto_tokens,
-          const DDS_Security_ParticipantCryptoHandle local_participant_crypto,
-          const DDS_Security_ParticipantCryptoHandle remote_participant_crypto,
-          DDS_Security_SecurityException *ex);
+typedef DDS_Security_boolean (*DDS_Security_crypto_key_exchange_set_remote_participant_crypto_tokens)(
+    dds_security_crypto_key_exchange *instance,
+    const DDS_Security_ParticipantCryptoHandle local_participant_crypto,
+    const DDS_Security_ParticipantCryptoHandle remote_participant_crypto,
+    const DDS_Security_ParticipantCryptoTokenSeq *remote_participant_tokens,
+    DDS_Security_SecurityException *ex);
 
-typedef DDS_Security_boolean
-(*DDS_Security_crypto_key_exchange_set_remote_participant_crypto_tokens)
-        ( dds_security_crypto_key_exchange *instance,
-          const DDS_Security_ParticipantCryptoHandle local_participant_crypto,
-          const DDS_Security_ParticipantCryptoHandle remote_participant_crypto,
-          const DDS_Security_ParticipantCryptoTokenSeq *remote_participant_tokens,
-          DDS_Security_SecurityException *ex);
+typedef DDS_Security_boolean (*DDS_Security_crypto_key_exchange_create_local_datawriter_crypto_tokens)(
+    dds_security_crypto_key_exchange *instance,
+    DDS_Security_DatawriterCryptoTokenSeq *local_datawriter_crypto_tokens,
+    const DDS_Security_DatawriterCryptoHandle local_datawriter_crypto,
+    const DDS_Security_DatareaderCryptoHandle remote_datareader_crypto,
+    DDS_Security_SecurityException *ex);
 
-typedef DDS_Security_boolean
-(*DDS_Security_crypto_key_exchange_create_local_datawriter_crypto_tokens)
-        ( dds_security_crypto_key_exchange *instance,
-          DDS_Security_DatawriterCryptoTokenSeq *local_datawriter_crypto_tokens,
-          const DDS_Security_DatawriterCryptoHandle local_datawriter_crypto,
-          const DDS_Security_DatareaderCryptoHandle remote_datareader_crypto,
-          DDS_Security_SecurityException *ex);
+typedef DDS_Security_boolean (*DDS_Security_crypto_key_exchange_set_remote_datawriter_crypto_tokens)(
+    dds_security_crypto_key_exchange *instance,
+    const DDS_Security_DatareaderCryptoHandle local_datareader_crypto,
+    const DDS_Security_DatawriterCryptoHandle remote_datawriter_crypto,
+    const DDS_Security_DatawriterCryptoTokenSeq *remote_datawriter_tokens,
+    DDS_Security_SecurityException *ex);
 
-typedef DDS_Security_boolean
-(*DDS_Security_crypto_key_exchange_set_remote_datawriter_crypto_tokens)
-        ( dds_security_crypto_key_exchange *instance,
-          const DDS_Security_DatareaderCryptoHandle local_datareader_crypto,
-          const DDS_Security_DatawriterCryptoHandle remote_datawriter_crypto,
-          const DDS_Security_DatawriterCryptoTokenSeq *remote_datawriter_tokens,
-          DDS_Security_SecurityException *ex);
+typedef DDS_Security_boolean (*DDS_Security_crypto_key_exchange_create_local_datareader_crypto_tokens)(
+    dds_security_crypto_key_exchange *instance,
+    DDS_Security_DatareaderCryptoTokenSeq *local_datareader_cryto_tokens,
+    const DDS_Security_DatareaderCryptoHandle local_datareader_crypto,
+    const DDS_Security_DatawriterCryptoHandle remote_datawriter_crypto,
+    DDS_Security_SecurityException *ex);
 
-typedef DDS_Security_boolean
-(*DDS_Security_crypto_key_exchange_create_local_datareader_crypto_tokens)
-        ( dds_security_crypto_key_exchange *instance,
-          DDS_Security_DatareaderCryptoTokenSeq *local_datareader_cryto_tokens,
-          const DDS_Security_DatareaderCryptoHandle local_datareader_crypto,
-          const DDS_Security_DatawriterCryptoHandle remote_datawriter_crypto,
-          DDS_Security_SecurityException *ex);
+typedef DDS_Security_boolean (*DDS_Security_crypto_key_exchange_set_remote_datareader_crypto_tokens)(
+    dds_security_crypto_key_exchange *instance,
+    const DDS_Security_DatawriterCryptoHandle local_datawriter_crypto,
+    const DDS_Security_DatareaderCryptoHandle remote_datareader_crypto,
+    const DDS_Security_DatareaderCryptoTokenSeq *remote_datareader_tokens,
+    DDS_Security_SecurityException *ex);
 
-typedef DDS_Security_boolean
-(*DDS_Security_crypto_key_exchange_set_remote_datareader_crypto_tokens)
-        ( dds_security_crypto_key_exchange *instance,
-          const DDS_Security_DatawriterCryptoHandle local_datawriter_crypto,
-          const DDS_Security_DatareaderCryptoHandle remote_datareader_crypto,
-          const DDS_Security_DatareaderCryptoTokenSeq *remote_datareader_tokens,
-          DDS_Security_SecurityException *ex);
-
-typedef DDS_Security_boolean
-(*DDS_Security_crypto_key_exchange_return_crypto_tokens)
-        ( dds_security_crypto_key_exchange *instance,
-          DDS_Security_CryptoTokenSeq *crypto_tokens,
-          DDS_Security_SecurityException *ex);
+typedef DDS_Security_boolean (*DDS_Security_crypto_key_exchange_return_crypto_tokens)(
+    dds_security_crypto_key_exchange *instance,
+    DDS_Security_CryptoTokenSeq *crypto_tokens,
+    DDS_Security_SecurityException *ex);
 
 struct dds_security_crypto_key_exchange
 {
   DDS_Security_crypto_key_exchange_create_local_participant_crypto_tokens create_local_participant_crypto_tokens;
-
   DDS_Security_crypto_key_exchange_set_remote_participant_crypto_tokens set_remote_participant_crypto_tokens;
-
   DDS_Security_crypto_key_exchange_create_local_datawriter_crypto_tokens create_local_datawriter_crypto_tokens;
-
   DDS_Security_crypto_key_exchange_set_remote_datawriter_crypto_tokens set_remote_datawriter_crypto_tokens;
-
   DDS_Security_crypto_key_exchange_create_local_datareader_crypto_tokens create_local_datareader_crypto_tokens;
-
   DDS_Security_crypto_key_exchange_set_remote_datareader_crypto_tokens set_remote_datareader_crypto_tokens;
-
   DDS_Security_crypto_key_exchange_return_crypto_tokens return_crypto_tokens;
-} ;
+};
 
+/* CryptoTransform Interface */
+typedef DDS_Security_boolean (*DDS_Security_crypto_transform_encode_serialized_payload)(
+    dds_security_crypto_transform *instance,
+    DDS_Security_OctetSeq *encoded_buffer,
+    DDS_Security_OctetSeq *extra_inline_qos,
+    const DDS_Security_OctetSeq *plain_buffer,
+    const DDS_Security_DatawriterCryptoHandle sending_datawriter_crypto,
+    DDS_Security_SecurityException *ex);
 
-/**
- * CryptoTransform Interface
- */
+typedef DDS_Security_boolean (*DDS_Security_crypto_transform_encode_datawriter_submessage)(
+    dds_security_crypto_transform *instance,
+    DDS_Security_OctetSeq *encoded_rtps_submessage,
+    const DDS_Security_OctetSeq *plain_rtps_submessage,
+    const DDS_Security_DatawriterCryptoHandle sending_datawriter_crypto,
+    const DDS_Security_DatareaderCryptoHandleSeq *receiving_datareader_crypto_list,
+    DDS_Security_long *receiving_datareader_crypto_list_index,
+    DDS_Security_SecurityException *ex);
 
-typedef DDS_Security_boolean
-(*DDS_Security_crypto_transform_encode_serialized_payload)
-        ( dds_security_crypto_transform *instance,
-          DDS_Security_OctetSeq *encoded_buffer,
-          DDS_Security_OctetSeq *extra_inline_qos,
-          const DDS_Security_OctetSeq *plain_buffer,
-          const DDS_Security_DatawriterCryptoHandle sending_datawriter_crypto,
-          DDS_Security_SecurityException *ex);
+typedef DDS_Security_boolean (*DDS_Security_crypto_transform_encode_datareader_submessage)(
+    dds_security_crypto_transform *instance,
+    DDS_Security_OctetSeq *encoded_rtps_submessage,
+    const DDS_Security_OctetSeq *plain_rtps_submessage,
+    const DDS_Security_DatareaderCryptoHandle sending_datareader_crypto,
+    const DDS_Security_DatawriterCryptoHandleSeq *receiving_datawriter_crypto_list,
+    DDS_Security_SecurityException *ex);
 
-typedef DDS_Security_boolean
-(*DDS_Security_crypto_transform_encode_datawriter_submessage)
-        ( dds_security_crypto_transform *instance,
-          DDS_Security_OctetSeq *encoded_rtps_submessage,
-          const DDS_Security_OctetSeq *plain_rtps_submessage,
-          const DDS_Security_DatawriterCryptoHandle sending_datawriter_crypto,
-          const DDS_Security_DatareaderCryptoHandleSeq *receiving_datareader_crypto_list,
-          DDS_Security_long *receiving_datareader_crypto_list_index,
-          DDS_Security_SecurityException *ex);
+typedef DDS_Security_boolean (*DDS_Security_crypto_transform_encode_rtps_message)(
+    dds_security_crypto_transform *instance,
+    DDS_Security_OctetSeq *encoded_rtps_message,
+    const DDS_Security_OctetSeq *plain_rtps_message,
+    const DDS_Security_ParticipantCryptoHandle sending_participant_crypto,
+    const DDS_Security_ParticipantCryptoHandleSeq *receiving_participant_crypto_list,
+    DDS_Security_long *receiving_participant_crypto_list_index,
+    DDS_Security_SecurityException *ex);
 
-typedef DDS_Security_boolean
-(*DDS_Security_crypto_transform_encode_datareader_submessage)
-        ( dds_security_crypto_transform *instance,
-          DDS_Security_OctetSeq *encoded_rtps_submessage,
-          const DDS_Security_OctetSeq *plain_rtps_submessage,
-          const DDS_Security_DatareaderCryptoHandle sending_datareader_crypto,
-          const DDS_Security_DatawriterCryptoHandleSeq *receiving_datawriter_crypto_list,
-          DDS_Security_SecurityException *ex);
+typedef DDS_Security_boolean (*DDS_Security_crypto_transform_decode_rtps_message)(
+    dds_security_crypto_transform *instance,
+    DDS_Security_OctetSeq *plain_buffer,
+    const DDS_Security_OctetSeq *encoded_buffer,
+    const DDS_Security_ParticipantCryptoHandle receiving_participant_crypto,
+    const DDS_Security_ParticipantCryptoHandle sending_participant_crypto,
+    DDS_Security_SecurityException *ex);
 
+typedef DDS_Security_boolean (*DDS_Security_crypto_transform_preprocess_secure_submsg)(
+    dds_security_crypto_transform *instance,
+    DDS_Security_DatawriterCryptoHandle *datawriter_crypto,
+    DDS_Security_DatareaderCryptoHandle *datareader_crypto,
+    DDS_Security_SecureSubmessageCategory_t *secure_submessage_category,
+    const DDS_Security_OctetSeq *encoded_rtps_submessage,
+    const DDS_Security_ParticipantCryptoHandle receiving_participant_crypto,
+    const DDS_Security_ParticipantCryptoHandle sending_participant_crypto,
+    DDS_Security_SecurityException *ex);
 
-typedef DDS_Security_boolean
-(*DDS_Security_crypto_transform_encode_rtps_message)
-        ( dds_security_crypto_transform *instance,
-          DDS_Security_OctetSeq *encoded_rtps_message,
-          const DDS_Security_OctetSeq *plain_rtps_message,
-          const DDS_Security_ParticipantCryptoHandle sending_participant_crypto,
-          const DDS_Security_ParticipantCryptoHandleSeq *receiving_participant_crypto_list,
-          DDS_Security_long *receiving_participant_crypto_list_index,
-          DDS_Security_SecurityException *ex);
+typedef DDS_Security_boolean (*DDS_Security_crypto_transform_decode_datawriter_submessage)(
+    dds_security_crypto_transform *instance,
+    DDS_Security_OctetSeq *plain_rtps_submessage,
+    const DDS_Security_OctetSeq *encoded_rtps_submessage,
+    const DDS_Security_DatareaderCryptoHandle receiving_datareader_crypto,
+    const DDS_Security_DatawriterCryptoHandle sending_datawriter_crypto,
+    DDS_Security_SecurityException *ex);
 
-typedef DDS_Security_boolean
-(*DDS_Security_crypto_transform_decode_rtps_message)
-        ( dds_security_crypto_transform *instance,
-          DDS_Security_OctetSeq *plain_buffer,
-          const DDS_Security_OctetSeq *encoded_buffer,
-          const DDS_Security_ParticipantCryptoHandle receiving_participant_crypto,
-          const DDS_Security_ParticipantCryptoHandle sending_participant_crypto,
-          DDS_Security_SecurityException *ex);
-
-typedef DDS_Security_boolean
-(*DDS_Security_crypto_transform_preprocess_secure_submsg)
-        ( dds_security_crypto_transform *instance,
-          DDS_Security_DatawriterCryptoHandle *datawriter_crypto,
-          DDS_Security_DatareaderCryptoHandle *datareader_crypto,
-          DDS_Security_SecureSubmessageCategory_t *secure_submessage_category,
-          const DDS_Security_OctetSeq *encoded_rtps_submessage,
-          const DDS_Security_ParticipantCryptoHandle receiving_participant_crypto,
-          const DDS_Security_ParticipantCryptoHandle sending_participant_crypto,
-          DDS_Security_SecurityException *ex);
-
-typedef DDS_Security_boolean
-(*DDS_Security_crypto_transform_decode_datawriter_submessage)
-        ( dds_security_crypto_transform *instance,
-          DDS_Security_OctetSeq *plain_rtps_submessage,
-          const DDS_Security_OctetSeq *encoded_rtps_submessage,
-          const DDS_Security_DatareaderCryptoHandle receiving_datareader_crypto,
-          const DDS_Security_DatawriterCryptoHandle sending_datawriter_crypto,
-          DDS_Security_SecurityException *ex);
-
-typedef DDS_Security_boolean
-(*DDS_Security_crypto_transform_decode_datareader_submessage)
-        ( dds_security_crypto_transform *instance,
-          DDS_Security_OctetSeq *plain_rtps_message,
-          const DDS_Security_OctetSeq *encoded_rtps_message,
-          const DDS_Security_DatawriterCryptoHandle receiving_datawriter_crypto,
-          const DDS_Security_DatareaderCryptoHandle sending_datareader_crypto,
-          DDS_Security_SecurityException *ex);
-
-
-typedef DDS_Security_boolean
-(*DDS_Security_crypto_transform_decode_serialized_payload)
-        ( dds_security_crypto_transform *instance,
-          DDS_Security_OctetSeq *plain_buffer,
-          const DDS_Security_OctetSeq *encoded_buffer,
-          const DDS_Security_OctetSeq *inline_qos,
-          const DDS_Security_DatareaderCryptoHandle receiving_datareader_crypto,
-          const DDS_Security_DatawriterCryptoHandle sending_datawriter_crypto,
-          DDS_Security_SecurityException *ex);
+typedef DDS_Security_boolean (*DDS_Security_crypto_transform_decode_datareader_submessage)(
+    dds_security_crypto_transform *instance,
+    DDS_Security_OctetSeq *plain_rtps_message,
+    const DDS_Security_OctetSeq *encoded_rtps_message,
+    const DDS_Security_DatawriterCryptoHandle receiving_datawriter_crypto,
+    const DDS_Security_DatareaderCryptoHandle sending_datareader_crypto,
+    DDS_Security_SecurityException *ex);
 
+typedef DDS_Security_boolean (*DDS_Security_crypto_transform_decode_serialized_payload)(
+    dds_security_crypto_transform *instance,
+    DDS_Security_OctetSeq *plain_buffer,
+    const DDS_Security_OctetSeq *encoded_buffer,
+    const DDS_Security_OctetSeq *inline_qos,
+    const DDS_Security_DatareaderCryptoHandle receiving_datareader_crypto,
+    const DDS_Security_DatawriterCryptoHandle sending_datawriter_crypto,
+    DDS_Security_SecurityException *ex);
 
 struct dds_security_crypto_transform
 {
   DDS_Security_crypto_transform_encode_serialized_payload encode_serialized_payload;
-
   DDS_Security_crypto_transform_encode_datawriter_submessage encode_datawriter_submessage;
-
   DDS_Security_crypto_transform_encode_datareader_submessage encode_datareader_submessage;
-
   DDS_Security_crypto_transform_encode_rtps_message encode_rtps_message;
-
   DDS_Security_crypto_transform_decode_rtps_message decode_rtps_message;
-
   DDS_Security_crypto_transform_preprocess_secure_submsg preprocess_secure_submsg;
-
   DDS_Security_crypto_transform_decode_datawriter_submessage decode_datawriter_submessage;
-
   DDS_Security_crypto_transform_decode_datareader_submessage decode_datareader_submessage;
-
   DDS_Security_crypto_transform_decode_serialized_payload decode_serialized_payload;
-} ;
-
-
-
+};
 
 typedef struct dds_security_cryptography
 {
-    dds_security_crypto_transform *crypto_transform;
-    dds_security_crypto_key_factory *crypto_key_factory;
-    dds_security_crypto_key_exchange *crypto_key_exchange;
+  struct ddsi_domaingv *gv;
+
+  dds_security_crypto_transform *crypto_transform;
+  dds_security_crypto_key_factory *crypto_key_factory;
+  dds_security_crypto_key_exchange *crypto_key_exchange;
 } dds_security_cryptography;
 
-
-#if defined (__cplusplus)
+#if defined(__cplusplus)
 }
 #endif
 
diff --git a/src/security/builtin_plugins/access_control/src/access_control.c b/src/security/builtin_plugins/access_control/src/access_control.c
index 1728a9b..df27ea7 100644
--- a/src/security/builtin_plugins/access_control/src/access_control.c
+++ b/src/security/builtin_plugins/access_control/src/access_control.c
@@ -20,13 +20,14 @@
 #include "dds/ddsrt/string.h"
 #include "dds/ddsrt/sync.h"
 #include "dds/ddsrt/types.h"
+#include "dds/ddsi/ddsi_domaingv.h"
 #include "dds/security/dds_security_api.h"
 #include "dds/security/core/dds_security_utils.h"
+#include "dds/security/core/dds_security_timed_cb.h"
 #include "access_control.h"
 #include "access_control_utils.h"
 #include "access_control_objects.h"
 #include "access_control_parser.h"
-#include "dds/security/core/dds_security_timed_cb.h"
 
 #if OPENSSL_VERSION_NUMBER >= 0x10000000L && OPENSSL_VERSION_NUMBER < 0x10100000L
 #define REMOVE_THREAD_STATE() ERR_remove_thread_state(NULL);
@@ -82,7 +83,6 @@ typedef struct dds_security_access_control_impl
 
   struct dds_security_timed_cb_data *timed_callbacks;
   struct dds_security_timed_dispatcher_t *dispatcher;
-
 } dds_security_access_control_impl;
 
 static bool get_sec_attributes(dds_security_access_control_impl *ac, const DDS_Security_PermissionsHandle permissions_handle, const char *topic_name,
@@ -162,12 +162,9 @@ validate_local_permissions(
   }
 #endif
 
-  permissions_handle = ACCESS_CONTROL_OBJECT_HANDLE(rights);
-
-  if (permissions_handle != DDS_SECURITY_HANDLE_NIL)
+  if ((permissions_handle = ACCESS_CONTROL_OBJECT_HANDLE(rights)) != DDS_SECURITY_HANDLE_NIL)
   {
     assert (rights->permissions_expiry != DDS_TIME_INVALID);
-
     if (rights->permissions_expiry != 0)
       add_validity_end_trigger(ac, permissions_handle, rights->permissions_expiry);
   }
@@ -228,10 +225,12 @@ validate_remote_permissions(
   remote_rights = check_and_create_remote_participant_rights(remote_identity_handle, local_rights, remote_permissions_token, remote_credential_token, ex);
 #endif
 
-  permissions_handle = ACCESS_CONTROL_OBJECT_HANDLE(remote_rights);
-
-  if (permissions_handle != DDS_SECURITY_HANDLE_NIL)
-    add_validity_end_trigger(ac, permissions_handle, remote_rights->permissions_expiry);
+  if ((permissions_handle = ACCESS_CONTROL_OBJECT_HANDLE(remote_rights)) != DDS_SECURITY_HANDLE_NIL)
+  {
+    assert (remote_rights->permissions_expiry != DDS_TIME_INVALID);
+    if (remote_rights->permissions_expiry != 0)
+      add_validity_end_trigger(ac, permissions_handle, remote_rights->permissions_expiry);
+  }
 
   if (remote_rights)
     access_control_table_insert(ac->remote_permissions, (AccessControlObject *)remote_rights);
@@ -1475,14 +1474,13 @@ return_permissions_handle(
   return true;
 }
 
-int init_access_control(const char *argument, void **context)
+int init_access_control(const char *argument, void **context, struct ddsi_domaingv *gv)
 {
   DDSRT_UNUSED_ARG(argument);
 
   dds_security_access_control_impl *access_control = ddsrt_malloc(sizeof(*access_control));
   memset(access_control, 0, sizeof(*access_control));
-
-
+  access_control->base.gv = gv;
   access_control->timed_callbacks = dds_security_timed_cb_new();
   access_control->dispatcher = dds_security_timed_dispatcher_new(access_control->timed_callbacks);
   access_control->base.validate_local_permissions = &validate_local_permissions;
@@ -1881,7 +1879,6 @@ validity_callback(struct dds_security_timed_dispatcher_t *d,
                   void *arg)
 {
   validity_cb_info *info = arg;
-
   DDSRT_UNUSED_ARG(d);
   assert(d);
   assert(arg);
@@ -1892,7 +1889,7 @@ validity_callback(struct dds_security_timed_dispatcher_t *d,
     {
       dds_security_access_control_listener *ac_listener = (dds_security_access_control_listener *)listener;
       if (ac_listener->on_revoke_permissions)
-        ac_listener->on_revoke_permissions(ac_listener, (dds_security_access_control *)info->ac, info->hdl);
+        ac_listener->on_revoke_permissions((dds_security_access_control *)info->ac, info->hdl);
     }
   }
   ddsrt_free(arg);
diff --git a/src/security/builtin_plugins/access_control/src/access_control.h b/src/security/builtin_plugins/access_control/src/access_control.h
index b98d2d7..e89ca00 100644
--- a/src/security/builtin_plugins/access_control/src/access_control.h
+++ b/src/security/builtin_plugins/access_control/src/access_control.h
@@ -12,10 +12,11 @@
 #ifndef ACCESS_CONTROL_H
 #define ACCESS_CONTROL_H
 
+#include "dds/ddsi/ddsi_domaingv.h"
 #include "dds/security/dds_security_api.h"
 #include "dds/security/export.h"
 
-SECURITY_EXPORT int init_access_control(const char *argument, void **context);
+SECURITY_EXPORT int init_access_control(const char *argument, void **context, struct ddsi_domaingv *gv);
 SECURITY_EXPORT int finalize_access_control(void *context);
 
 #endif /* ACCESS_CONTROL_H */
diff --git a/src/security/builtin_plugins/authentication/CMakeLists.txt b/src/security/builtin_plugins/authentication/CMakeLists.txt
index d6cb40c..c6716e7 100644
--- a/src/security/builtin_plugins/authentication/CMakeLists.txt
+++ b/src/security/builtin_plugins/authentication/CMakeLists.txt
@@ -43,6 +43,7 @@ target_include_directories(dds_security_auth
         "$<BUILD_INTERFACE:$<TARGET_PROPERTY:security_core,INTERFACE_INCLUDE_DIRECTORIES>>"
         "$<BUILD_INTERFACE:$<TARGET_PROPERTY:ddsrt,INTERFACE_INCLUDE_DIRECTORIES>>"
         "$<BUILD_INTERFACE:${CMAKE_CURRENT_BINARY_DIR}/include>"
+        "$<BUILD_INTERFACE:${CMAKE_CURRENT_LIST_DIR}/../../../core/ddsi/include>"
 )
 
 install(
diff --git a/src/security/builtin_plugins/authentication/src/authentication.c b/src/security/builtin_plugins/authentication/src/authentication.c
index 127357a..937aa7e 100644
--- a/src/security/builtin_plugins/authentication/src/authentication.c
+++ b/src/security/builtin_plugins/authentication/src/authentication.c
@@ -41,6 +41,7 @@
 #include "dds/ddsrt/string.h"
 #include "dds/ddsrt/sync.h"
 #include "dds/ddsrt/hopscotch.h"
+#include "dds/ddsi/ddsi_domaingv.h"
 #include "dds/security/dds_security_api.h"
 #include "dds/security/core/dds_security_timed_cb.h"
 #include "dds/security/core/dds_security_utils.h"
@@ -2229,14 +2230,14 @@ DDS_Security_boolean return_sharedsecret_handle(dds_security_authentication *ins
   return true;
 }
 
-int32_t init_authentication(const char *argument, void **context)
+int32_t init_authentication(const char *argument, void **context, struct ddsi_domaingv *gv)
 {
   DDSRT_UNUSED_ARG(argument);
   dds_security_authentication_impl *authentication;
 
   authentication = (dds_security_authentication_impl *)ddsrt_malloc(sizeof(dds_security_authentication_impl));
   memset(authentication, 0, sizeof(dds_security_authentication_impl));
-
+  authentication->base.gv = gv;
   authentication->timed_callbacks = dds_security_timed_cb_new();
   authentication->dispatcher = dds_security_timed_dispatcher_new(authentication->timed_callbacks);
 
diff --git a/src/security/builtin_plugins/authentication/src/authentication.h b/src/security/builtin_plugins/authentication/src/authentication.h
index 4e56a12..900d1eb 100644
--- a/src/security/builtin_plugins/authentication/src/authentication.h
+++ b/src/security/builtin_plugins/authentication/src/authentication.h
@@ -17,7 +17,7 @@
 #include "dds/security/dds_security_api.h"
 #include "dds/security/export.h"
 
-SECURITY_EXPORT int32_t init_authentication(const char *argument, void **context);
+SECURITY_EXPORT int32_t init_authentication(const char *argument, void **context, struct ddsi_domaingv *gv);
 SECURITY_EXPORT int32_t finalize_authentication(void *context);
 
 DDS_Security_ValidationResult_t validate_local_identity(dds_security_authentication *instance, DDS_Security_IdentityHandle *local_identity_handle, DDS_Security_GUID_t *adjusted_participant_guid,
diff --git a/src/security/builtin_plugins/cryptographic/CMakeLists.txt b/src/security/builtin_plugins/cryptographic/CMakeLists.txt
index e7d97f5..180e7f3 100644
--- a/src/security/builtin_plugins/cryptographic/CMakeLists.txt
+++ b/src/security/builtin_plugins/cryptographic/CMakeLists.txt
@@ -42,6 +42,7 @@ target_include_directories(dds_security_crypto
         "$<BUILD_INTERFACE:$<TARGET_PROPERTY:security_core,INTERFACE_INCLUDE_DIRECTORIES>>"
         "$<BUILD_INTERFACE:$<TARGET_PROPERTY:ddsrt,INTERFACE_INCLUDE_DIRECTORIES>>"
         "$<BUILD_INTERFACE:${CMAKE_CURRENT_BINARY_DIR}/include>"
+        "$<BUILD_INTERFACE:${CMAKE_CURRENT_LIST_DIR}/../../../core/ddsi/include>"
 )
 
 install(
diff --git a/src/security/builtin_plugins/cryptographic/src/cryptography.c b/src/security/builtin_plugins/cryptographic/src/cryptography.c
index a8aee67..6e4f780 100644
--- a/src/security/builtin_plugins/cryptographic/src/cryptography.c
+++ b/src/security/builtin_plugins/cryptographic/src/cryptography.c
@@ -11,6 +11,7 @@
  */
 #include "dds/ddsrt/heap.h"
 #include "dds/ddsrt/types.h"
+#include "dds/ddsi/ddsi_domaingv.h"
 #include "dds/security/dds_security_api.h"
 #include "cryptography.h"
 #include "crypto_key_exchange.h"
@@ -24,6 +25,7 @@
 
 typedef struct dds_security_cryptography_impl {
   dds_security_cryptography base;
+  struct ddsi_domaingv *gv;
 } dds_security_cryptography_impl;
 
 dds_security_crypto_key_factory *cryptography_get_crypto_key_factory (const struct dds_security_cryptography *crypto)
@@ -45,7 +47,7 @@ dds_security_crypto_transform *cryptography_get_crypto_transform (const struct d
 }
 
 
-int init_crypto (const char *argument, void **context)
+int init_crypto (const char *argument, void **context, struct ddsi_domaingv *gv)
 {
   dds_security_cryptography_impl *cryptography;
   dds_security_crypto_key_exchange *crypto_key_exchange;
@@ -56,6 +58,7 @@ int init_crypto (const char *argument, void **context)
 
   /* allocate new instance */
   cryptography = ddsrt_malloc (sizeof(*cryptography));
+  cryptography->base.gv = gv;
 
   /* assign the sub components */
   crypto_key_exchange = dds_security_crypto_key_exchange__alloc ((dds_security_cryptography *)cryptography);
diff --git a/src/security/builtin_plugins/cryptographic/src/cryptography.h b/src/security/builtin_plugins/cryptographic/src/cryptography.h
index eb114d4..a74b771 100644
--- a/src/security/builtin_plugins/cryptographic/src/cryptography.h
+++ b/src/security/builtin_plugins/cryptographic/src/cryptography.h
@@ -12,22 +12,15 @@
 #ifndef CRYPTOGRAPHY_H
 #define CRYPTOGRAPHY_H
 
+#include "dds/ddsi/ddsi_domaingv.h"
 #include "dds/security/dds_security_api.h"
 #include "dds/security/export.h"
 
-SECURITY_EXPORT int init_crypto(const char *argument, void **context);
+SECURITY_EXPORT int init_crypto(const char *argument, void **context, struct ddsi_domaingv *gv);
 SECURITY_EXPORT int finalize_crypto(void *instance);
 
-dds_security_crypto_key_factory *
-cryptography_get_crypto_key_factory(
-    const dds_security_cryptography *crypto);
-
-dds_security_crypto_key_exchange *
-cryptography_get_crypto_key_exchange(
-    const dds_security_cryptography *crypto);
-
-dds_security_crypto_transform *
-cryptography_get_crypto_transform(
-    const dds_security_cryptography *crypto);
+dds_security_crypto_key_factory *cryptography_get_crypto_key_factory(const dds_security_cryptography *crypto);
+dds_security_crypto_key_exchange * cryptography_get_crypto_key_exchange(const dds_security_cryptography *crypto);
+dds_security_crypto_transform *cryptography_get_crypto_transform(const dds_security_cryptography *crypto);
 
 #endif /* CRYPTOGRAPHY_H */
diff --git a/src/security/builtin_plugins/tests/common/src/loader.c b/src/security/builtin_plugins/tests/common/src/loader.c
index c6584f2..023e2c5 100644
--- a/src/security/builtin_plugins/tests/common/src/loader.c
+++ b/src/security/builtin_plugins/tests/common/src/loader.c
@@ -64,7 +64,7 @@ load_plugin(
         }
 
         char * init_parameters = "";
-        (void)info->func_init(init_parameters, &plugin);
+        (void)info->func_init(init_parameters, &plugin, NULL);
         if (plugin) {
             info->context = plugin;
         } else {
diff --git a/src/security/builtin_plugins/tests/listeners_access_control/src/listeners_access_control_utests.c b/src/security/builtin_plugins/tests/listeners_access_control/src/listeners_access_control_utests.c
index f215738..bd7eab6 100644
--- a/src/security/builtin_plugins/tests/listeners_access_control/src/listeners_access_control_utests.c
+++ b/src/security/builtin_plugins/tests/listeners_access_control/src/listeners_access_control_utests.c
@@ -568,9 +568,8 @@ CU_Clean(ddssec_builtin_listeners_access_control)
   return 0;
 }
 
-static DDS_Security_boolean on_revoke_permissions_cb(dds_security_access_control_listener *instance, const dds_security_access_control *plugin, const DDS_Security_PermissionsHandle handle)
+static DDS_Security_boolean on_revoke_permissions_cb(const dds_security_access_control *plugin, const DDS_Security_PermissionsHandle handle)
 {
-  DDSRT_UNUSED_ARG(instance);
   DDSRT_UNUSED_ARG(plugin);
   if (permission_handle_for_callback1 == DDS_SECURITY_HANDLE_NIL)
     permission_handle_for_callback1 = handle;
diff --git a/src/security/core/include/dds/security/core/dds_security_plugins.h b/src/security/core/include/dds/security/core/dds_security_plugins.h
index 3a28e43..ffc48f5 100644
--- a/src/security/core/include/dds/security/core/dds_security_plugins.h
+++ b/src/security/core/include/dds/security/core/dds_security_plugins.h
@@ -14,10 +14,11 @@
 #ifndef SECURITY_CORE_PLUGINS_H_
 #define SECURITY_CORE_PLUGINS_H_
 
+#include <stdint.h>
 #include "dds/export.h"
 #include "dds/ddsrt/retcode.h"
 #include "dds/ddsrt/dynlib.h"
-#include <stdint.h>
+#include "dds/ddsi/ddsi_domaingv.h"
 #include "dds/security/dds_security_api.h"
 
 struct ddsrt_log_cfg;
@@ -47,24 +48,14 @@ typedef struct dds_security_plugin_suite_config{
   dds_security_plugin_config access_control;
 } dds_security_plugin_suite_config;
 
-DDS_EXPORT dds_return_t dds_security_plugin_release(
-        const dds_security_plugin *security_plugin,
-        void *context );
-
-DDS_EXPORT dds_return_t dds_security_check_plugin_configuration(
-        const dds_security_plugin_suite_config *security_suite_config,
-        const struct ddsrt_log_cfg *logcfg);
-
-DDS_EXPORT dds_return_t dds_security_load_security_library(
-        const dds_security_plugin_config *plugin_config,
-        dds_security_plugin *security_plugin, void **security_plugin_context,
-        const struct ddsrt_log_cfg *logcfg);
-
+DDS_EXPORT dds_return_t dds_security_plugin_release(const dds_security_plugin *security_plugin, void *context);
+DDS_EXPORT dds_return_t dds_security_check_plugin_configuration(const dds_security_plugin_suite_config *security_suite_config, struct ddsi_domaingv *gv);
+DDS_EXPORT dds_return_t dds_security_load_security_library(const dds_security_plugin_config *plugin_config, dds_security_plugin *security_plugin,
+    void **security_plugin_context, struct ddsi_domaingv *gv);
 DDS_EXPORT dds_return_t dds_security_verify_plugin_functions(
-        dds_security_authentication *authentication_context, dds_security_plugin *auth_plugin,
-        dds_security_cryptography *crypto_context, dds_security_plugin *crypto_plugin,
-        dds_security_access_control *access_control_context, dds_security_plugin *ac_plugin,
-        const struct ddsrt_log_cfg *logcfg);
+    dds_security_authentication *authentication_context, dds_security_plugin *auth_plugin,
+    dds_security_cryptography *crypto_context, dds_security_plugin *crypto_plugin,
+    dds_security_access_control *access_control_context, dds_security_plugin *ac_plugin,
+    struct ddsi_domaingv *gv);
 
 #endif /* SECURITY_CORE_PLUGINS_H_ */
-
diff --git a/src/security/core/src/dds_security_plugins.c b/src/security/core/src/dds_security_plugins.c
index bfc75a4..15c5fb5 100644
--- a/src/security/core/src/dds_security_plugins.c
+++ b/src/security/core/src/dds_security_plugins.c
@@ -19,40 +19,40 @@
 #include "dds/ddsrt/dynlib.h"
 #include "dds/ddsrt/io.h"
 
-static bool check_plugin_configuration (const dds_security_plugin_config *config, const char *name, const struct ddsrt_log_cfg *logcfg)
+static bool check_plugin_configuration (const dds_security_plugin_config *config, const char *name, struct ddsi_domaingv *gv)
 {
   if (config->library_path == NULL || *config->library_path == 0) {
-    DDS_CERROR (logcfg, "%s security plugin library path is undefined or empty\n", name);
+    GVERROR ("%s security plugin library path is undefined or empty\n", name);
     return false;
   }
   if (config->library_init == NULL || *config->library_init == 0) {
-    DDS_CERROR (logcfg, "%s security plugin init function is undefined or empty\n", name);
+    GVERROR ("%s security plugin init function is undefined or empty\n", name);
     return false;
   }
   if (config->library_finalize == NULL || *config->library_finalize == 0) {
-    DDS_CERROR (logcfg, "%s security plugin finalize function is undefined or empty\n", name);
+    GVERROR ("%s security plugin finalize function is undefined or empty\n", name);
     return false;
   }
   return true;
 }
 
-dds_return_t dds_security_check_plugin_configuration (const dds_security_plugin_suite_config *security_suite_config, const struct ddsrt_log_cfg *logcfg)
+dds_return_t dds_security_check_plugin_configuration (const dds_security_plugin_suite_config *security_suite_config, struct ddsi_domaingv *gv)
 {
-  if (check_plugin_configuration (&security_suite_config->access_control, "AccessControl", logcfg) &&
-      check_plugin_configuration (&security_suite_config->authentication, "Authentication", logcfg) &&
-      check_plugin_configuration (&security_suite_config->cryptography, "Cryptography", logcfg))
+  if (check_plugin_configuration (&security_suite_config->access_control, "AccessControl", gv) &&
+      check_plugin_configuration (&security_suite_config->authentication, "Authentication", gv) &&
+      check_plugin_configuration (&security_suite_config->cryptography, "Cryptography", gv))
     return DDS_RETCODE_OK;
   else
     return DDS_RETCODE_ERROR;
 }
 
-static bool verify_function (const void *function_ptr, dds_security_plugin *plugin, const char *function_name, const struct ddsrt_log_cfg *logcfg)
+static bool verify_function (const void *function_ptr, dds_security_plugin *plugin, const char *function_name, struct ddsi_domaingv *gv)
 {
   if (function_ptr != NULL)
     return true;
   else
   {
-    DDS_CERROR (logcfg, "Could not find the function for %s: %s\n", plugin->name, function_name);
+    GVERROR ("Could not find the function for %s: %s\n", plugin->name, function_name);
     return false;
   }
 }
@@ -62,12 +62,12 @@ struct verify_plugin_functions_tab {
   const char *name;
 };
 
-static bool verify_plugin_functions (const void *context, dds_security_plugin *plugin, const struct verify_plugin_functions_tab *entries, size_t nentries, const struct ddsrt_log_cfg *logcfg)
+static bool verify_plugin_functions (const void *context, dds_security_plugin *plugin, const struct verify_plugin_functions_tab *entries, size_t nentries, struct ddsi_domaingv *gv)
 {
   for (size_t i = 0; i < nentries; i++)
   {
     const char *p = (const char *) context + entries[i].off;
-    if (!verify_function (*((void **) p), plugin, entries[i].name, logcfg))
+    if (!verify_function (*((void **) p), plugin, entries[i].name, gv))
       return false;
   }
   return true;
@@ -77,7 +77,7 @@ dds_return_t dds_security_verify_plugin_functions(
     dds_security_authentication *authentication_context, dds_security_plugin *auth_plugin,
     dds_security_cryptography *crypto_context, dds_security_plugin *crypto_plugin,
     dds_security_access_control *access_control_context, dds_security_plugin *ac_plugin,
-    const struct ddsrt_log_cfg *logcfg)
+    struct ddsi_domaingv *gv)
 {
 #define FGEN(context, name) { offsetof (context, name), #name }
 #define F(name) FGEN (dds_security_authentication, name)
@@ -170,7 +170,7 @@ dds_return_t dds_security_verify_plugin_functions(
     F (decode_serialized_payload)
   };
 #undef F
-#define C(context, plugin, table) verify_plugin_functions (context, plugin, table, sizeof (table) / sizeof (table[0]), logcfg)
+#define C(context, plugin, table) verify_plugin_functions (context, plugin, table, sizeof (table) / sizeof (table[0]), gv)
   if (C (authentication_context, auth_plugin, auth) &&
       C (access_control_context, ac_plugin, ac) &&
       C (crypto_context->crypto_key_factory, crypto_plugin, cryptoF) &&
@@ -189,7 +189,8 @@ dds_return_t dds_security_verify_plugin_functions(
 /**
  * All fields of the library properties are supposed to be non-empty
  */
-dds_return_t dds_security_load_security_library (const dds_security_plugin_config *plugin_config, dds_security_plugin *security_plugin, void **security_plugin_context, const struct ddsrt_log_cfg *logcfg)
+dds_return_t dds_security_load_security_library (const dds_security_plugin_config *plugin_config, dds_security_plugin *security_plugin,
+    void **security_plugin_context, struct ddsi_domaingv *gv)
 {
   dds_return_t lib_ret;
   char *init_parameters = "";
@@ -211,30 +212,30 @@ dds_return_t dds_security_load_security_library (const dds_security_plugin_confi
   {
     char buffer[256];
     ddsrt_dlerror (buffer, sizeof (buffer));
-    DDS_CERROR (logcfg, "Could not load %s library: %s\n", security_plugin->name, buffer);
+    GVERROR ("Could not load %s library: %s\n", security_plugin->name, buffer);
     goto load_error;
   }
 
   void *tmp;
   if (ddsrt_dlsym (security_plugin->lib_handle, plugin_config->library_init, &tmp) != DDS_RETCODE_OK)
   {
-    DDS_CERROR (logcfg, "Could not find the function: %s\n", plugin_config->library_init);
+    GVERROR ("Could not find the function: %s\n", plugin_config->library_init);
     goto library_error;
   }
   security_plugin->func_init = (plugin_init) tmp;
 
   if (ddsrt_dlsym (security_plugin->lib_handle, plugin_config->library_finalize, &tmp) != DDS_RETCODE_OK)
   {
-    DDS_CERROR (logcfg, "Could not find the function: %s\n", plugin_config->library_finalize);
+    GVERROR ("Could not find the function: %s\n", plugin_config->library_finalize);
     goto library_error;
   }
   security_plugin->func_finalize = (plugin_finalize) tmp;
 
   if (security_plugin->func_init != 0)
   {
-    if (security_plugin->func_init (init_parameters, (void **) security_plugin_context) != DDS_RETCODE_OK)
+    if (security_plugin->func_init (init_parameters, (void **) security_plugin_context, gv) != DDS_RETCODE_OK)
     {
-      DDS_CERROR (logcfg, "Error occured while initializing %s plugin\n", security_plugin->name);
+      GVERROR ("Error occured while initializing %s plugin\n", security_plugin->name);
       goto library_error;
     }
   }
diff --git a/src/security/core/tests/common/access_control_wrapper.c b/src/security/core/tests/common/access_control_wrapper.c
index 83b88f6..3ba5b68 100644
--- a/src/security/core/tests/common/access_control_wrapper.c
+++ b/src/security/core/tests/common/access_control_wrapper.c
@@ -514,10 +514,11 @@ static struct dds_security_access_control_impl * init_test_access_control_common
   return impl;
 }
 
-int32_t init_test_access_control_all_ok(const char *argument, void **context)
+int32_t init_test_access_control_all_ok(const char *argument, void **context, struct ddsi_domaingv *gv)
 {
   DDSRT_UNUSED_ARG(argument);
   DDSRT_UNUSED_ARG(context);
+  DDSRT_UNUSED_ARG(gv);
   struct dds_security_access_control_impl *impl = init_test_access_control_common();
   impl->mode = PLUGIN_MODE_ALL_OK;
   *context = impl;
@@ -531,10 +532,11 @@ int32_t finalize_test_access_control_all_ok(void *context)
   return 0;
 }
 
-int32_t init_test_access_control_missing_func(const char *argument, void **context)
+int32_t init_test_access_control_missing_func(const char *argument, void **context, struct ddsi_domaingv *gv)
 {
   DDSRT_UNUSED_ARG(argument);
   DDSRT_UNUSED_ARG(context);
+  DDSRT_UNUSED_ARG(gv);
   struct dds_security_access_control_impl *impl = init_test_access_control_common();
   impl->base.check_create_datareader = NULL;
   impl->mode = PLUGIN_MODE_MISSING_FUNC;
diff --git a/src/security/core/tests/common/access_control_wrapper.h b/src/security/core/tests/common/access_control_wrapper.h
index 70c9c2c..a7c2e7c 100644
--- a/src/security/core/tests/common/access_control_wrapper.h
+++ b/src/security/core/tests/common/access_control_wrapper.h
@@ -12,15 +12,16 @@
 #ifndef SECURITY_CORE_TEST_ACCESS_CONTROL_WRAPPER_H_
 #define SECURITY_CORE_TEST_ACCESS_CONTROL_WRAPPER_H_
 
+#include "dds/ddsi/ddsi_domaingv.h"
 #include "dds/security/dds_security_api.h"
 #include "dds/security/access_control_wrapper_export.h"
 
 /* Init in all-ok mode: all functions return success without calling the actual plugin */
-SECURITY_EXPORT int32_t init_test_access_control_all_ok(const char *argument, void **context);
+SECURITY_EXPORT int32_t init_test_access_control_all_ok(const char *argument, void **context, struct ddsi_domaingv *gv);
 SECURITY_EXPORT int32_t finalize_test_access_control_all_ok(void *context);
 
 /* Init in missing function mode: one of the function pointers is null */
-SECURITY_EXPORT int32_t init_test_access_control_missing_func(const char *argument, void **context);
+SECURITY_EXPORT int32_t init_test_access_control_missing_func(const char *argument, void **context, struct ddsi_domaingv *gv);
 SECURITY_EXPORT int32_t finalize_test_access_control_missing_func(void *context);
 
 #endif /* SECURITY_CORE_TEST_ACCESS_CONTROL_WRAPPER_H_ */
diff --git a/src/security/core/tests/common/authentication_wrapper.c b/src/security/core/tests/common/authentication_wrapper.c
index 0ab9882..a2d3709 100644
--- a/src/security/core/tests/common/authentication_wrapper.c
+++ b/src/security/core/tests/common/authentication_wrapper.c
@@ -22,7 +22,7 @@
 #include "test_identity.h"
 #include "plugin_wrapper_msg_q.h"
 
-int32_t init_authentication(const char *argument, void **context);
+int32_t init_authentication(const char *argument, void **context, struct ddsi_domaingv *gv);
 int32_t finalize_authentication(void *context);
 
 enum auth_plugin_mode {
@@ -41,7 +41,6 @@ struct dds_security_authentication_impl
   dds_security_authentication base;
   dds_security_authentication *instance;
   struct message_queue msg_queue;
-  const struct ddsi_domaingv *gv;
   enum auth_plugin_mode mode;
 };
 
@@ -439,7 +438,7 @@ static struct dds_security_authentication_impl * get_impl_for_domain(dds_domaini
 {
   for (size_t i = 0; i < auth_impl_idx; i++)
   {
-    if (auth_impl[i] && auth_impl[i]->gv->config.domainId == domain_id)
+    if (auth_impl[i] && auth_impl[i]->instance->gv->config.domainId == domain_id)
     {
       return auth_impl[i];
     }
@@ -483,10 +482,11 @@ static struct dds_security_authentication_impl * init_test_authentication_common
   return impl;
 }
 
-int32_t init_test_authentication_all_ok(const char *argument, void **context)
+int32_t init_test_authentication_all_ok(const char *argument, void **context, struct ddsi_domaingv *gv)
 {
   DDSRT_UNUSED_ARG(argument);
   DDSRT_UNUSED_ARG(context);
+  DDSRT_UNUSED_ARG(gv);
   struct dds_security_authentication_impl *impl = init_test_authentication_common();
   impl->mode = PLUGIN_MODE_ALL_OK;
   *context = impl;
@@ -500,10 +500,11 @@ int32_t finalize_test_authentication_all_ok(void *context)
   return 0;
 }
 
-int32_t init_test_authentication_missing_func(const char *argument, void **context)
+int32_t init_test_authentication_missing_func(const char *argument, void **context, struct ddsi_domaingv *gv)
 {
   DDSRT_UNUSED_ARG(argument);
   DDSRT_UNUSED_ARG(context);
+  DDSRT_UNUSED_ARG(gv);
   struct dds_security_authentication_impl *impl = init_test_authentication_common();
   impl->base.get_shared_secret = NULL;
   impl->mode = PLUGIN_MODE_MISSING_FUNC;
@@ -518,10 +519,11 @@ int32_t finalize_test_authentication_missing_func(void *context)
   return 0;
 }
 
-int32_t init_test_authentication_init_error(const char *argument, void **context)
+int32_t init_test_authentication_init_error(const char *argument, void **context, struct ddsi_domaingv *gv)
 {
   DDSRT_UNUSED_ARG(argument);
   DDSRT_UNUSED_ARG(context);
+  DDSRT_UNUSED_ARG(gv);
   return 1;
 }
 
@@ -535,19 +537,14 @@ int32_t finalize_test_authentication_init_error(void *context)
  * Init and fini functions for using wrapped mode for the authentication plugin.
  * These functions assumes that there are no concurrent calls, as the static
  * variables used here are not protected by a lock. */
-int32_t init_test_authentication_wrapped(const char *argument, void **context)
+int32_t init_test_authentication_wrapped(const char *argument, void **context, struct ddsi_domaingv *gv)
 {
   int32_t ret;
   struct dds_security_authentication_impl *impl = init_test_authentication_common();
   impl->mode = PLUGIN_MODE_WRAPPED;
 
   init_message_queue(&impl->msg_queue);
-  struct thread_state1 * const ts1 = lookup_thread_state ();
-  struct ddsi_domaingv const * const gv = ddsrt_atomic_ldvoidp (&ts1->gv);
-  impl->gv = gv;
-
-  ret = init_authentication(argument, (void **)&impl->instance);
-
+  ret = init_authentication(argument, (void **)&impl->instance, gv);
   auth_impl_idx++;
   auth_impl = ddsrt_realloc(auth_impl, auth_impl_idx * sizeof(*auth_impl));
   auth_impl[auth_impl_idx - 1] = impl;
diff --git a/src/security/core/tests/common/authentication_wrapper.h b/src/security/core/tests/common/authentication_wrapper.h
index be4854a..d784454 100644
--- a/src/security/core/tests/common/authentication_wrapper.h
+++ b/src/security/core/tests/common/authentication_wrapper.h
@@ -12,24 +12,25 @@
 #ifndef SECURITY_CORE_TEST_AUTHENTICATION_WRAPPER_H_
 #define SECURITY_CORE_TEST_AUTHENTICATION_WRAPPER_H_
 
+#include "dds/ddsi/ddsi_domaingv.h"
 #include "dds/security/dds_security_api.h"
 #include "dds/security/authentication_wrapper_export.h"
 #include "plugin_wrapper_msg_q.h"
 
 /* Init in wrapper mode */
-SECURITY_EXPORT int32_t init_test_authentication_wrapped(const char *argument, void **context);
+SECURITY_EXPORT int32_t init_test_authentication_wrapped(const char *argument, void **context, struct ddsi_domaingv *gv);
 SECURITY_EXPORT int32_t finalize_test_authentication_wrapped(void *context);
 
 /* Init in all-ok mode: all functions return success without calling the actual plugin */
-SECURITY_EXPORT int32_t init_test_authentication_all_ok(const char *argument, void **context);
+SECURITY_EXPORT int32_t init_test_authentication_all_ok(const char *argument, void **context, struct ddsi_domaingv *gv);
 SECURITY_EXPORT int32_t finalize_test_authentication_all_ok(void *context);
 
 /* Init in missing function mode: one of the function pointers is null */
-SECURITY_EXPORT int32_t init_test_authentication_missing_func(const char *argument, void **context);
+SECURITY_EXPORT int32_t init_test_authentication_missing_func(const char *argument, void **context, struct ddsi_domaingv *gv);
 SECURITY_EXPORT int32_t finalize_test_authentication_missing_func(void *context);
 
 /* Init function fails */
-SECURITY_EXPORT int32_t init_test_authentication_init_error(const char *argument, void **context);
+SECURITY_EXPORT int32_t init_test_authentication_init_error(const char *argument, void **context, struct ddsi_domaingv *gv);
 SECURITY_EXPORT int32_t finalize_test_authentication_init_error(void *context);
 
 SECURITY_EXPORT struct message * test_authentication_plugin_take_msg(dds_domainid_t domain_id, message_kind_t kind, DDS_Security_IdentityHandle lidHandle, DDS_Security_IdentityHandle ridHandle, DDS_Security_IdentityHandle hsHandle, dds_duration_t timeout);
diff --git a/src/security/core/tests/common/cryptography_wrapper.c b/src/security/core/tests/common/cryptography_wrapper.c
index 7af5c1b..a3d1508 100644
--- a/src/security/core/tests/common/cryptography_wrapper.c
+++ b/src/security/core/tests/common/cryptography_wrapper.c
@@ -22,7 +22,7 @@
 #include "dds/security/core/dds_security_utils.h"
 #include "cryptography_wrapper.h"
 
-int32_t init_crypto(const char *argument, void **context);
+int32_t init_crypto(const char *argument, void **context, struct ddsi_domaingv *gv);
 int32_t finalize_crypto(void *context);
 
 enum crypto_plugin_mode {
@@ -700,14 +700,14 @@ static DDS_Security_boolean decode_serialized_payload(
 /**
  * Init and finalize functions
  */
-static struct dds_security_cryptography_impl * init_test_cryptography_common(const char *argument, bool wrapped)
+static struct dds_security_cryptography_impl * init_test_cryptography_common(const char *argument, bool wrapped, struct ddsi_domaingv *gv)
 {
   struct dds_security_cryptography_impl *impl = (struct dds_security_cryptography_impl*) ddsrt_malloc(sizeof(*impl));
   memset(impl, 0, sizeof(*impl));
 
   if (wrapped)
   {
-    if (init_crypto(argument, (void **)&impl->instance) != DDS_SECURITY_SUCCESS)
+    if (init_crypto(argument, (void **)&impl->instance, gv) != DDS_SECURITY_SUCCESS)
       return NULL;
 
     impl->transform_wrap.instance = impl->instance->crypto_transform;
@@ -763,9 +763,9 @@ static int32_t finalize_test_cryptography_common(struct dds_security_cryptograph
   return DDS_SECURITY_SUCCESS;
 }
 
-int32_t init_test_cryptography_all_ok(const char *argument, void **context)
+int32_t init_test_cryptography_all_ok(const char *argument, void **context, struct ddsi_domaingv *gv)
 {
-  struct dds_security_cryptography_impl *impl = init_test_cryptography_common(argument, false);
+  struct dds_security_cryptography_impl *impl = init_test_cryptography_common(argument, false, gv);
   if (!impl)
     return DDS_SECURITY_FAILED;
   impl->mode = PLUGIN_MODE_ALL_OK;
@@ -780,9 +780,9 @@ int32_t finalize_test_cryptography_all_ok(void *context)
   return finalize_test_cryptography_common(impl, false);
 }
 
-int32_t init_test_cryptography_missing_func(const char *argument, void **context)
+int32_t init_test_cryptography_missing_func(const char *argument, void **context, struct ddsi_domaingv *gv)
 {
-  struct dds_security_cryptography_impl *impl = init_test_cryptography_common(argument, false);
+  struct dds_security_cryptography_impl *impl = init_test_cryptography_common(argument, false, gv);
   if (!impl)
     return DDS_SECURITY_FAILED;
   impl->base.crypto_key_exchange->set_remote_participant_crypto_tokens = NULL;
@@ -798,9 +798,9 @@ int32_t finalize_test_cryptography_missing_func(void *context)
   return finalize_test_cryptography_common(impl, false);
 }
 
-int32_t init_test_cryptography_wrapped(const char *argument, void **context)
+int32_t init_test_cryptography_wrapped(const char *argument, void **context, struct ddsi_domaingv *gv)
 {
-  struct dds_security_cryptography_impl *impl = init_test_cryptography_common(argument, true);
+  struct dds_security_cryptography_impl *impl = init_test_cryptography_common(argument, true, gv);
   if (!impl)
     return DDS_SECURITY_FAILED;
   impl->mode = PLUGIN_MODE_WRAPPED;
diff --git a/src/security/core/tests/common/cryptography_wrapper.h b/src/security/core/tests/common/cryptography_wrapper.h
index 44e0501..f379727 100644
--- a/src/security/core/tests/common/cryptography_wrapper.h
+++ b/src/security/core/tests/common/cryptography_wrapper.h
@@ -12,6 +12,7 @@
 #ifndef SECURITY_CORE_TEST_CRYPTO_WRAPPER_H_
 #define SECURITY_CORE_TEST_CRYPTO_WRAPPER_H_
 
+#include "dds/ddsi/ddsi_domaingv.h"
 #include "dds/security/dds_security_api.h"
 #include "dds/security/dds_security_api_defs.h"
 #include "dds/security/cryptography_wrapper_export.h"
@@ -34,15 +35,15 @@ SECURITY_EXPORT void set_disc_protection_kinds(
 SECURITY_EXPORT void set_entity_data_secret(struct dds_security_cryptography_impl * impl, const char * pp_secret, const char * groupdata_secret, const char * ep_secret);
 
 /* Init in all-ok mode: all functions return success without calling the actual plugin */
-SECURITY_EXPORT int32_t init_test_cryptography_all_ok(const char *argument, void **context);
+SECURITY_EXPORT int32_t init_test_cryptography_all_ok(const char *argument, void **context, struct ddsi_domaingv *gv);
 SECURITY_EXPORT int32_t finalize_test_cryptography_all_ok(void *context);
 
 /* Init in missing function mode: one of the function pointers is null */
-SECURITY_EXPORT int32_t init_test_cryptography_missing_func(const char *argument, void **context);
+SECURITY_EXPORT int32_t init_test_cryptography_missing_func(const char *argument, void **context, struct ddsi_domaingv *gv);
 SECURITY_EXPORT int32_t finalize_test_cryptography_missing_func(void *context);
 
 /* Init in wrapper mode */
-SECURITY_EXPORT int32_t init_test_cryptography_wrapped(const char *argument, void **context);
+SECURITY_EXPORT int32_t init_test_cryptography_wrapped(const char *argument, void **context, struct ddsi_domaingv *gv);
 SECURITY_EXPORT int32_t finalize_test_cryptography_wrapped(void *context);
 
 #endif /* SECURITY_CORE_TEST_CRYPTO_WRAPPER_H_ */

From d53cdce8fe27b587c14232dcd8920192ff3b83c2 Mon Sep 17 00:00:00 2001
From: Dennis Potman <dennis.potman@adlinktech.com>
Date: Thu, 26 Mar 2020 18:48:54 +0100
Subject: [PATCH 159/238] Access Control on_revoke_permissions implementation
 in DDSI

Implement handler for access control on_revoke_permissions. This callback
function disconnects and deletes all proxy participant that are using the
revoked permissions handle (in case of remote permissions expire) and
proxy participant that are connected with a participant for which the
permissions expire (local permissions expire).

Signed-off-by: Dennis Potman <dennis.potman@adlinktech.com>
---
 src/core/ddsi/src/ddsi_security_omg.c         | 113 +++++++++++++++---
 .../dds_security_api_authentication.h         |   1 -
 .../authentication/src/authentication.c       |   2 +-
 .../src/listeners_authentication_utests.c     |  15 +--
 .../core/tests/secure_communication.c         |   6 +-
 5 files changed, 103 insertions(+), 34 deletions(-)

diff --git a/src/core/ddsi/src/ddsi_security_omg.c b/src/core/ddsi/src/ddsi_security_omg.c
index 096608c..7766fcd 100644
--- a/src/core/ddsi/src/ddsi_security_omg.c
+++ b/src/core/ddsi/src/ddsi_security_omg.c
@@ -212,6 +212,8 @@ struct dds_security_context {
 
   struct pending_match_index security_matches;
   struct participant_sec_index partiticpant_index;
+  struct dds_security_access_control_listener ac_listener;
+  struct dds_security_authentication_listener auth_listener;
 };
 
 typedef struct dds_security_context dds_security_context;
@@ -525,34 +527,44 @@ static void proxypp_pp_match_free(struct ddsi_domaingv *gv, struct dds_security_
   ddsrt_free(pm);
 }
 
-static void pp_proxypp_unrelate(struct dds_security_context *sc, struct participant *pp, const ddsi_guid_t *proxypp_guid)
+static void pp_proxypp_unrelate_locked(struct dds_security_context *sc, struct participant *pp, const ddsi_guid_t *proxypp_guid)
 {
   struct pp_proxypp_match *pm;
   ddsrt_avl_dpath_t dpath;
 
-  ddsrt_mutex_lock(&pp->sec_attr->lock);
   if ((pm = ddsrt_avl_clookup_dpath(&pp_proxypp_treedef, &pp->sec_attr->proxy_participants, proxypp_guid, &dpath)) != NULL)
   {
     ddsrt_avl_cdelete_dpath(&pp_proxypp_treedef, &pp->sec_attr->proxy_participants, pm, &dpath);
     pp_proxypp_match_free(sc, pm);
   }
+}
+
+static void pp_proxypp_unrelate(struct dds_security_context *sc, struct participant *pp, const ddsi_guid_t *proxypp_guid)
+{
+  ddsrt_mutex_lock(&pp->sec_attr->lock);
+  pp_proxypp_unrelate_locked (sc, pp, proxypp_guid);
   ddsrt_mutex_unlock(&pp->sec_attr->lock);
 }
 
+static void proxypp_pp_unrelate_locked(struct dds_security_context *sc, struct proxy_participant *proxypp, const ddsi_guid_t *pp_guid, int64_t pp_crypto_handle)
+{
+  DDSRT_UNUSED_ARG(pp_guid);
+  struct proxypp_pp_match *pm;
+  ddsrt_avl_dpath_t dpath;
+
+  if ((pm = ddsrt_avl_lookup_dpath(&proxypp_pp_treedef, &proxypp->sec_attr->participants, &pp_crypto_handle, &dpath)) != NULL)
+  {
+    ddsrt_avl_delete_dpath(&proxypp_pp_treedef, &proxypp->sec_attr->participants, pm, &dpath);
+    proxypp_pp_match_free(proxypp->e.gv, sc, pm);
+  }
+}
+
 static void proxypp_pp_unrelate(struct dds_security_context *sc, struct proxy_participant *proxypp, const ddsi_guid_t *pp_guid, int64_t pp_crypto_handle)
 {
-  DDSRT_UNUSED_ARG(pp_guid);
   if (proxypp->sec_attr)
   {
-    struct proxypp_pp_match *pm;
-    ddsrt_avl_dpath_t dpath;
-
     ddsrt_mutex_lock(&proxypp->sec_attr->lock);
-    if ((pm = ddsrt_avl_lookup_dpath(&proxypp_pp_treedef, &proxypp->sec_attr->participants, &pp_crypto_handle, &dpath)) != NULL)
-    {
-      ddsrt_avl_delete_dpath(&proxypp_pp_treedef, &proxypp->sec_attr->participants, pm, &dpath);
-      proxypp_pp_match_free(proxypp->e.gv, sc, pm);
-    }
+    proxypp_pp_unrelate_locked(sc, proxypp, pp_guid, pp_crypto_handle);
     ddsrt_mutex_unlock(&proxypp->sec_attr->lock);
   }
 }
@@ -798,6 +810,70 @@ static void deinit_plugin_suite_config (dds_security_plugin_suite_config *suite_
   deinit_plugin_config (&suite_config->cryptography);
 }
 
+static DDS_Security_boolean on_revoke_permissions_cb(const dds_security_access_control *plugin, const DDS_Security_PermissionsHandle handle)
+{
+  struct ddsi_domaingv *gv = plugin->gv;
+  struct entidx_enum_participant epp;
+  struct entidx_enum_proxy_participant eproxypp;
+  struct participant *pp;
+  struct proxy_participant *proxypp;
+  bool local_perm = false;
+  thread_state_awake (lookup_thread_state (), gv);
+
+  /* Find participants using this permissions handle */
+  entidx_enum_participant_init (&epp, gv->entity_index);
+  while ((pp = entidx_enum_participant_next (&epp)) != NULL)
+  {
+    struct dds_security_context *sc = q_omg_security_get_secure_context(pp);
+    ddsrt_mutex_lock (&pp->sec_attr->lock);
+    if (pp->sec_attr->permissions_handle == handle)
+    {
+      uint32_t i = 0;
+      ddsrt_avl_citer_t it;
+      local_perm = true;
+      for (struct pp_proxypp_match *ppm = ddsrt_avl_citer_first (&pp_proxypp_treedef, &pp->sec_attr->proxy_participants, &it); ppm; ppm = ddsrt_avl_citer_next (&it), i++)
+        pp_proxypp_unrelate_locked (sc, pp, &ppm->proxypp_guid);
+    }
+    ddsrt_mutex_unlock (&pp->sec_attr->lock);
+  }
+  entidx_enum_participant_fini (&epp);
+
+  /* Find proxy participants using this permissions handle */
+  if (!local_perm)
+  {
+    entidx_enum_proxy_participant_init (&eproxypp, gv->entity_index);
+    while ((proxypp = entidx_enum_proxy_participant_next (&eproxypp)) != NULL)
+    {
+      ddsrt_mutex_lock (&proxypp->sec_attr->lock);
+      uint32_t i = 0;
+      ddsrt_avl_iter_t it;
+      bool del_proxypp = true;
+      for (struct proxypp_pp_match *ppm = ddsrt_avl_iter_first (&proxypp_pp_treedef, &proxypp->sec_attr->participants, &it); ppm; ppm = ddsrt_avl_iter_next (&it), i++)
+      {
+        if (ppm->permissions_handle == handle)
+          proxypp_pp_unrelate_locked (proxypp->sec_attr->sc, proxypp, &ppm->pp_guid, ppm->pp_crypto_handle);
+        else
+          del_proxypp = false;
+      }
+      ddsrt_mutex_unlock (&proxypp->sec_attr->lock);
+      if (del_proxypp)
+        delete_proxy_participant_by_guid (gv, &proxypp->e.guid, ddsrt_time_wallclock (), false);
+    }
+    entidx_enum_proxy_participant_fini (&eproxypp);
+  }
+
+  thread_state_asleep (lookup_thread_state ());
+  return true;
+}
+
+static DDS_Security_boolean on_revoke_identity_cb(const dds_security_authentication *plugin, const DDS_Security_IdentityHandle handle)
+{
+  (void)plugin;
+  (void)handle;
+  return true;
+}
+
+
 dds_return_t q_omg_security_load (dds_security_context *sc, const dds_qos_t *qos, struct ddsi_domaingv *gv)
 {
   dds_security_plugin_suite_config psc;
@@ -836,18 +912,19 @@ dds_return_t q_omg_security_load (dds_security_context *sc, const dds_qos_t *qos
   }
 
   /* Add listeners */
-#if LISTENERS_IMPLEMENTED
-  if (!access_control_context->set_listener (access_control_context, &listener_ac, &ex))
+  DDS_Security_SecurityException ex = DDS_SECURITY_EXCEPTION_INIT;
+  sc->ac_listener.on_revoke_permissions = on_revoke_permissions_cb;
+  if (!sc->access_control_context->set_listener (sc->access_control_context, &sc->ac_listener, &ex))
   {
     GVERROR ("Could not set access_control listener: %s\n", ex.message ? ex.message : "<unknown error>");
     goto error_set_ac_listener;
   }
-  if (!authentication_context->set_listener (authentication_context, &listener_auth, &ex))
+  sc->auth_listener.on_revoke_identity = on_revoke_identity_cb;
+  if (!sc->authentication_context->set_listener (sc->authentication_context, &sc->auth_listener, &ex))
   {
     GVERROR ("Could not set authentication listener: %s\n", ex.message ? ex.message : "<unknown error>");
-    goto err_set_auth_listener;
+    goto error_set_auth_listener;
   }
-#endif
 
 #if HANDSHAKE_IMPLEMENTED
     (void) q_handshake_initialize ();
@@ -858,11 +935,9 @@ dds_return_t q_omg_security_load (dds_security_context *sc, const dds_qos_t *qos
   GVTRACE ("DDS Security plugins have been loaded\n");
   return DDS_RETCODE_OK;
 
-#if LISTENERS_IMPLEMENTED
 error_set_auth_listener:
-  access_control_context->set_listener (access_control_context, NULL, &ex);
+  sc->access_control_context->set_listener (sc->access_control_context, NULL, &ex);
 error_set_ac_listener:
-#endif
 error_verify:
   release_plugins (gv, sc);
 error:
diff --git a/src/security/api/include/dds/security/dds_security_api_authentication.h b/src/security/api/include/dds/security/dds_security_api_authentication.h
index c0d9298..5909dac 100644
--- a/src/security/api/include/dds/security/dds_security_api_authentication.h
+++ b/src/security/api/include/dds/security/dds_security_api_authentication.h
@@ -29,7 +29,6 @@ typedef struct dds_security_authentication_listener dds_security_authentication_
 
 /* AuthenticationListener interface */
 typedef DDS_Security_boolean (*DDS_Security_authentication_listener_on_revoke_identity)(
-    dds_security_authentication_listener *context,
     const dds_security_authentication *plugin,
     const DDS_Security_IdentityHandle handle);
 
diff --git a/src/security/builtin_plugins/authentication/src/authentication.c b/src/security/builtin_plugins/authentication/src/authentication.c
index 937aa7e..0ff0864 100644
--- a/src/security/builtin_plugins/authentication/src/authentication.c
+++ b/src/security/builtin_plugins/authentication/src/authentication.c
@@ -639,7 +639,7 @@ static void validity_callback(struct dds_security_timed_dispatcher_t *d, dds_sec
     assert(listener);
     dds_security_authentication_listener *auth_listener = (dds_security_authentication_listener *)listener;
     if (auth_listener->on_revoke_identity)
-      auth_listener->on_revoke_identity(auth_listener, (dds_security_authentication *)info->auth, info->hdl);
+      auth_listener->on_revoke_identity((dds_security_authentication *)info->auth, info->hdl);
   }
   ddsrt_free(arg);
 }
diff --git a/src/security/builtin_plugins/tests/listeners_authentication/src/listeners_authentication_utests.c b/src/security/builtin_plugins/tests/listeners_authentication/src/listeners_authentication_utests.c
index 779b254..7575837 100644
--- a/src/security/builtin_plugins/tests/listeners_authentication/src/listeners_authentication_utests.c
+++ b/src/security/builtin_plugins/tests/listeners_authentication/src/listeners_authentication_utests.c
@@ -1811,7 +1811,7 @@ fill_handshake_message_token(
             }
             CU_ASSERT_FATAL (rc == DDS_SECURITY_VALIDATION_OK);
             assert(rc == DDS_SECURITY_VALIDATION_OK); // for Clang's static analyzer
-          
+
             set_binary_property_value(signature, "signature", sign, (uint32_t)signlen);
 
             ddsrt_free(sign);
@@ -1911,18 +1911,13 @@ fill_handshake_message_token(
 }
 
 
-static DDS_Security_boolean
-on_revoke_identity_cb( dds_security_authentication_listener *instance,
-                 const dds_security_authentication *plugin,
-                 const DDS_Security_IdentityHandle handle)
+static DDS_Security_boolean on_revoke_identity_cb(const dds_security_authentication *plugin, const DDS_Security_IdentityHandle handle)
 {
-    DDSRT_UNUSED_ARG( instance );
-    DDSRT_UNUSED_ARG( plugin );
-    if (identity_handle_for_callback1 == DDS_SECURITY_HANDLE_NIL) {
+    DDSRT_UNUSED_ARG (plugin);
+    if (identity_handle_for_callback1 == DDS_SECURITY_HANDLE_NIL)
         identity_handle_for_callback1 = handle;
-    } else if (identity_handle_for_callback2 == DDS_SECURITY_HANDLE_NIL) {
+    else if (identity_handle_for_callback2 == DDS_SECURITY_HANDLE_NIL)
         identity_handle_for_callback2 = handle;
-    }
     printf( "Listener called for handle: %lld  Local:%lld Remote:%lld\n", (long long) handle, (long long) local_identity_handle, (long long) remote_identity_handle2);
 
     return true;
diff --git a/src/security/core/tests/secure_communication.c b/src/security/core/tests/secure_communication.c
index 7ed18b5..92b40a4 100644
--- a/src/security/core/tests/secure_communication.c
+++ b/src/security/core/tests/secure_communication.c
@@ -445,13 +445,13 @@ static void test_discovery_liveliness_protection(DDS_Security_ProtectionKind dis
 {
   struct domain_sec_config domain_config = { discovery_pk, liveliness_pk, PK_N, PK_N, BPK_N, NULL };
   /* FIXME: add more asserts in wrapper or test instead of just testing communication */
-  test_write_read (&domain_config, 1, 1, 1, 1, 1, 1, &set_encryption_parameters_disc);
+  test_write_read (&domain_config, 1, 1, 1, 1, 1, 1, set_encryption_parameters_disc);
 }
 
 static void test_data_protection_kind(DDS_Security_ProtectionKind rtps_pk, DDS_Security_ProtectionKind metadata_pk, DDS_Security_BasicProtectionKind payload_pk)
 {
   struct domain_sec_config domain_config = { PK_N, PK_N, rtps_pk, metadata_pk, payload_pk, NULL };
-  test_write_read (&domain_config, 1, 1, 1, 1, 1, 1, &set_encryption_parameters_basic);
+  test_write_read (&domain_config, 1, 1, 1, 1, 1, 1, set_encryption_parameters_basic);
 }
 
 static void test_multiple_readers(size_t n_dom, size_t n_pp, size_t n_rd, DDS_Security_ProtectionKind metadata_pk, DDS_Security_BasicProtectionKind payload_pk)
@@ -486,7 +486,7 @@ static void test_payload_secret(DDS_Security_ProtectionKind rtps_pk, DDS_Securit
     memcpy (sample.text + n * strlen (secret), secret, strlen (secret));
   sample.text[payload_sz - 1] = '\0';
 
-  test_init (&domain_config, 1, 1, 1, 1, &set_encryption_parameters_secret);
+  test_init (&domain_config, 1, 1, 1, 1, set_encryption_parameters_secret);
   create_topic_name ("ddssec_secure_communication_", g_topic_nr++, name, sizeof name);
   qos = get_qos ();
   create_eps (&writers, &writer_topics, 1, 1, 1, name, &SecurityCoreTests_Type2_desc, g_pub_participants, qos, &dds_create_writer, DDS_PUBLICATION_MATCHED_STATUS);

From 736d0a027a8fc9baeb76ae2ebedfd6060a79511f Mon Sep 17 00:00:00 2001
From: Dennis Potman <dennis.potman@adlinktech.com>
Date: Thu, 26 Mar 2020 13:42:11 +0100
Subject: [PATCH 160/238] Add access control tests for permissions expiry and
 move some reused test functions to common utils file.

Signed-off-by: Dennis Potman <dennis.potman@adlinktech.com>
---
 src/security/core/tests/CMakeLists.txt        |   2 +-
 src/security/core/tests/access_control.c      | 308 +++++++++++++++---
 src/security/core/tests/authentication.c      | 151 ++-------
 .../tests/common/etc/default_permissions.p7s  |  57 +++-
 .../tests/common/etc/default_permissions.xml  |  33 ++
 .../tests/common/security_config_test_utils.c |  48 ++-
 .../tests/common/security_config_test_utils.h |   4 +-
 .../{handshake_test_utils.c => test_utils.c}  | 128 +++++++-
 .../{handshake_test_utils.h => test_utils.h}  |  15 +-
 src/security/core/tests/handshake.c           |   2 +-
 10 files changed, 543 insertions(+), 205 deletions(-)
 rename src/security/core/tests/common/{handshake_test_utils.c => test_utils.c} (68%)
 rename src/security/core/tests/common/{handshake_test_utils.h => test_utils.h} (65%)

diff --git a/src/security/core/tests/CMakeLists.txt b/src/security/core/tests/CMakeLists.txt
index 639b84b..35337ab 100644
--- a/src/security/core/tests/CMakeLists.txt
+++ b/src/security/core/tests/CMakeLists.txt
@@ -74,7 +74,7 @@ if(ENABLE_SSL)
 
   list(APPEND security_core_test_sources
     "common/security_config_test_utils.c"
-    "common/handshake_test_utils.c"
+    "common/test_utils.c"
     "common/cert_utils.c"
     "authentication.c"
     "access_control.c"
diff --git a/src/security/core/tests/access_control.c b/src/security/core/tests/access_control.c
index 061dfef..508828c 100644
--- a/src/security/core/tests/access_control.c
+++ b/src/security/core/tests/access_control.c
@@ -21,6 +21,7 @@
 #include "dds/ddsrt/environ.h"
 #include "dds/ddsrt/process.h"
 #include "dds/ddsrt/heap.h"
+#include "dds/ddsrt/io.h"
 #include "dds/ddsrt/string.h"
 #include "dds/ddsi/q_config.h"
 #include "dds/ddsi/ddsi_domaingv.h"
@@ -33,6 +34,9 @@
 #include "common/access_control_wrapper.h"
 #include "common/security_config_test_utils.h"
 #include "common/test_identity.h"
+#include "common/test_utils.h"
+#include "common/cert_utils.h"
+#include "SecurityCoreTests.h"
 
 static const char *config =
     "${CYCLONEDDS_URI}${CYCLONEDDS_URI:+,}"
@@ -43,16 +47,16 @@ static const char *config =
     "  </Discovery>"
     "  <DDSSecurity>"
     "    <Authentication>"
-    "      <Library finalizeFunction=\"finalize_test_authentication_wrapped\" initFunction=\"init_test_authentication_wrapped\" path=\"" WRAPPERLIB_PATH("dds_security_authentication_wrapper") "\"/>"
-    "      <IdentityCertificate>data:," TEST_IDENTITY1_CERTIFICATE "</IdentityCertificate>"
-    "      <PrivateKey>data:," TEST_IDENTITY1_PRIVATE_KEY "</PrivateKey>"
-    "      <IdentityCA>data:," TEST_IDENTITY_CA1_CERTIFICATE "</IdentityCA>"
+    "      <Library finalizeFunction=\"finalize_authentication\" initFunction=\"init_authentication\"/>"
+    "      <IdentityCertificate>data:,${TEST_IDENTITY_CERTIFICATE}</IdentityCertificate>"
+    "      <PrivateKey>data:,${TEST_IDENTITY_PRIVATE_KEY}</PrivateKey>"
+    "      <IdentityCA>data:,${TEST_IDENTITY_CA_CERTIFICATE}</IdentityCA>"
     "    </Authentication>"
     "    <AccessControl>"
     "      <Library finalizeFunction=\"finalize_access_control\" initFunction=\"init_access_control\"/>"
-    "      ${INCL_GOV:+<Governance>}${TEST_GOVERNANCE}${INCL_GOV:+</Governance>}"
+    "      ${INCL_GOV:+<Governance><![CDATA[}${TEST_GOVERNANCE}${INCL_GOV:+]]></Governance>}"
     "      ${INCL_PERM_CA:+<PermissionsCA>}${TEST_PERMISSIONS_CA}${INCL_PERM_CA:+</PermissionsCA>}"
-    "      ${INCL_PERM:+<Permissions>}${TEST_PERMISSIONS}${INCL_PERM:+</Permissions>}"
+    "      ${INCL_PERM:+<Permissions><![CDATA[}${TEST_PERMISSIONS}${INCL_PERM:+]]></Permissions>}"
     "    </AccessControl>"
     "    <Cryptographic>"
     "      <Library finalizeFunction=\"finalize_crypto\" initFunction=\"init_crypto\"/>"
@@ -60,48 +64,49 @@ static const char *config =
     "  </DDSSecurity>"
     "</Domain>";
 
-#define DDS_DOMAINID1 0
-#define DDS_DOMAINID2 1
+#define MAX_DOMAINS 10
+#define DDS_DOMAINID
 
-static dds_entity_t g_domain1 = 0;
-static dds_entity_t g_participant1 = 0;
+static dds_entity_t g_domain[MAX_DOMAINS];
+static dds_entity_t g_participant[MAX_DOMAINS];
+static dds_entity_t g_pubsub[MAX_DOMAINS];
+static dds_entity_t g_topic[MAX_DOMAINS];
+static uint32_t g_topic_nr = 0;
 
-static dds_entity_t g_domain2 = 0;
-static dds_entity_t g_participant2 = 0;
-
-static void access_control_init(bool incl_gov, const char * gov, bool incl_perm, const char * perm, bool incl_ca, const char * ca, bool exp_pp_fail)
+static void access_control_init(
+  const char * id_certs[], const char * id_keys[], const char * id_ca[], bool exp_pp_fail[], size_t n_nodes,
+  bool incl_gov, const char * gov,
+  bool incl_perm, const char * perm,
+  bool incl_ca, const char * ca)
 {
-  struct kvp config_vars[] = {
-    { "INCL_GOV", incl_gov ? "1" : "", 2 },
-    { "INCL_PERM", incl_perm ? "1" : "", 2 },
-    { "INCL_PERM_CA", incl_ca ? "1" : "", 2 },
-    { "TEST_GOVERNANCE", gov, 1 },
-    { "TEST_PERMISSIONS", perm, 1 },
-    { "TEST_PERMISSIONS_CA", ca, 1 },
-    { NULL, NULL, 0 }
-  };
-
-  char *conf = ddsrt_expand_vars_sh (config, &expand_lookup_vars_env, config_vars);
-  CU_ASSERT_EQUAL_FATAL (expand_lookup_unmatched (config_vars), 0);
-  g_domain1 = dds_create_domain (DDS_DOMAINID1, conf);
-  g_domain2 = dds_create_domain (DDS_DOMAINID2, conf);
-  dds_free (conf);
-
-  g_participant1 = dds_create_participant (DDS_DOMAINID1, NULL, NULL);
-  g_participant2 = dds_create_participant (DDS_DOMAINID2, NULL, NULL);
-  CU_ASSERT_EQUAL_FATAL (exp_pp_fail, g_participant1 <= 0);
-  CU_ASSERT_EQUAL_FATAL (exp_pp_fail, g_participant2 <= 0);
+  CU_ASSERT_FATAL (n_nodes <= MAX_DOMAINS);
+  for (size_t i = 0; i < n_nodes; i++)
+  {
+    struct kvp config_vars[] = {
+      { "TEST_IDENTITY_CERTIFICATE", id_certs[i], 1 },
+      { "TEST_IDENTITY_PRIVATE_KEY", id_keys[i], 1 },
+      { "TEST_IDENTITY_CA_CERTIFICATE", id_ca[i], 1 },
+      { "INCL_GOV", incl_gov ? "1" : "", 2 },
+      { "INCL_PERM", incl_perm ? "1" : "", 2 },
+      { "INCL_PERM_CA", incl_ca ? "1" : "", 2 },
+      { "TEST_GOVERNANCE", gov, 1 },
+      { "TEST_PERMISSIONS", perm, 1 },
+      { "TEST_PERMISSIONS_CA", ca, 1 },
+      { NULL, NULL, 0 }
+    };
+    char *conf = ddsrt_expand_vars_sh (config, &expand_lookup_vars_env, config_vars);
+    CU_ASSERT_EQUAL_FATAL (expand_lookup_unmatched (config_vars), 0);
+    g_domain[i] = dds_create_domain (DDS_DOMAINID + (dds_domainid_t)i, conf);
+    dds_free (conf);
+    g_participant[i] = dds_create_participant (DDS_DOMAINID + (dds_domainid_t)i, NULL, NULL);
+    CU_ASSERT_EQUAL_FATAL (exp_pp_fail[i], g_participant[i] <= 0);
+  }
 }
 
-static void access_control_fini(bool delete_pp)
+static void access_control_fini(size_t n)
 {
-  if (delete_pp)
-  {
-    CU_ASSERT_EQUAL_FATAL (dds_delete (g_participant1), DDS_RETCODE_OK);
-    CU_ASSERT_EQUAL_FATAL (dds_delete (g_participant2), DDS_RETCODE_OK);
-  }
-  CU_ASSERT_EQUAL_FATAL (dds_delete (g_domain1), DDS_RETCODE_OK);
-  CU_ASSERT_EQUAL_FATAL (dds_delete (g_domain2), DDS_RETCODE_OK);
+  for (size_t i = 0; i < n; i++)
+    CU_ASSERT_EQUAL_FATAL (dds_delete (g_domain[i]), DDS_RETCODE_OK);
 }
 
 
@@ -144,6 +149,221 @@ CU_Theory((const char * test_descr, const char * gov, const char * perm, const c
     ddssec_access_control, config_parameters_file)
 {
   printf("running test config_parameters_file: %s\n", test_descr);
-  access_control_init (incl_empty_els || strlen (gov), gov, incl_empty_els || strlen (perm), perm, incl_empty_els || strlen (ca), ca, exp_fail);
-  access_control_fini (!exp_fail);
+  access_control_init (
+      (const char *[]) { TEST_IDENTITY1_CERTIFICATE, TEST_IDENTITY1_CERTIFICATE },
+      (const char *[]) { TEST_IDENTITY1_PRIVATE_KEY, TEST_IDENTITY1_PRIVATE_KEY },
+      (const char *[]) { TEST_IDENTITY_CA1_CERTIFICATE, TEST_IDENTITY_CA1_CERTIFICATE },
+      (bool []) { exp_fail, exp_fail }, 2,
+      incl_empty_els || strlen (gov), gov,
+      incl_empty_els || strlen (perm), perm,
+      incl_empty_els || strlen (ca), ca);
+  access_control_fini (2);
 }
+
+#define S(n) (n)
+#define M(n) (S(n)*60)
+#define H(n) (M(n)*60)
+#define D(n) (H(n)*24)
+CU_TheoryDataPoints(ddssec_access_control, permissions_expiry) = {
+    CU_DataPoints(const char *,
+    /*                      */"valid 1 minute from now",
+    /*                       |     */"valid -1 minute until now",
+    /*                       |      |     */"1s valid, create pp after 1100ms",
+    /*                       |      |      |      */"node 2 permissions expired",
+    /*                       |      |      |      |     */"node 1 3s valid, write/read for 1s delayed 3s",
+    /*                       |      |      |      |      |     */"node 2 3s valid, write/read for 1s delayed 3s"),
+    CU_DataPoints(int32_t,   0,     -M(1), 0,     0,     0,     0),     /* node 1 permissions not before (offset from local time) */
+    CU_DataPoints(int32_t,   M(1),  0,     S(1),  D(1),  S(3),  D(1)),  /* node 1 permissions not after (offset from local time) */
+    CU_DataPoints(int32_t,   0,     -M(1), 0,     -D(1), 0,     0),     /* node 2 permissions not before (offset from local time) */
+    CU_DataPoints(int32_t,   M(1),  0,     S(1),  0,     D(1),  S(3)),  /* node 2 permissions not after (offset from local time) */
+    CU_DataPoints(uint32_t,  0,     0,     1100,  0,     0,     0),     /* delay (ms) after generating permissions */
+    CU_DataPoints(bool,      false, true,  true,  false, false, false), /* expect pp 1 create failure */
+    CU_DataPoints(bool,      false, true,  true,  true,  false, false), /* expect pp 2 create failure */
+    CU_DataPoints(uint32_t,  0,     0,     0,     0,     3000,  3000),  /* delay (ms) after creating readers/writers */
+    CU_DataPoints(uint32_t,  1,     0,     0,     0,     1000,  1000),  /* write/read data during x ms */
+    CU_DataPoints(bool,      false, false, false, false, true,  true),  /* expect read data failure */
+};
+CU_Theory(
+  (const char * test_descr,
+    int32_t perm1_not_before, int32_t perm1_not_after, int32_t perm2_not_before, int32_t perm2_not_after,
+    uint32_t delay_perm, bool exp_pp1_fail, bool exp_pp2_fail, uint32_t delay_wr_rd, uint32_t write_read_dur, bool exp_read_fail),
+  ddssec_access_control, permissions_expiry, .timeout=20)
+{
+  printf("running test permissions_expiry: %s\n", test_descr);
+
+  char topic_name[100];
+  create_topic_name("ddssec_access_control_", g_topic_nr++, topic_name, sizeof (topic_name));
+
+  /* create ca and id1/id2 certs that will not expire during this test */
+  char *ca, *id1, *id2, *id1_subj, *id2_subj;
+  ca = generate_ca ("ca1", TEST_IDENTITY_CA1_PRIVATE_KEY, 0, D(1));
+  id1 = generate_identity (ca, TEST_IDENTITY_CA1_PRIVATE_KEY, "id1", TEST_IDENTITY1_PRIVATE_KEY, 0, D(1), &id1_subj);
+  id2 = generate_identity (ca, TEST_IDENTITY_CA1_PRIVATE_KEY, "id2", TEST_IDENTITY1_PRIVATE_KEY, 0, D(1), &id2_subj);
+
+  /* localtime will be converted to gmtime in get_permissions_grant */
+  dds_time_t now = dds_time ();
+  char * perm_topic = get_permissions_topic(topic_name);
+  char * grants[] = {
+    get_permissions_grant ("id1", id1_subj, now + DDS_SECS(perm1_not_before), now + DDS_SECS(perm1_not_after), perm_topic, perm_topic, NULL),
+    get_permissions_grant ("id2", id2_subj, now + DDS_SECS(perm2_not_before), now + DDS_SECS(perm2_not_after), perm_topic, perm_topic, NULL) };
+  char * perm_config = get_permissions_config (grants, 2, true);
+  dds_sleepfor (DDS_MSECS (delay_perm));
+
+  access_control_init (
+      (const char *[]) { id1, id2 },
+      (const char *[]) { TEST_IDENTITY1_PRIVATE_KEY, TEST_IDENTITY1_PRIVATE_KEY },
+      (const char *[]) { ca, ca },
+      (bool []) { exp_pp1_fail, exp_pp2_fail }, 2,
+      true, PF_F COMMON_ETC_PATH("default_governance.p7s"),
+      true, perm_config,
+      true, PF_F COMMON_ETC_PATH("default_permissions_ca.pem"));
+
+  if (write_read_dur > 0)
+  {
+    dds_entity_t wr = 0, rd = 0;
+    rd_wr_init (g_participant[0], &g_pubsub[0], &g_topic[0], &wr, g_participant[1], &g_pubsub[1], &g_topic[1], &rd, topic_name);
+    dds_sleepfor (DDS_MSECS (delay_wr_rd));
+    write_read_for (wr, g_participant[1], rd, DDS_MSECS (write_read_dur), false, exp_read_fail);
+  }
+
+  access_control_fini (2);
+
+  ddsrt_free (perm_topic);
+  ddsrt_free (grants[0]);
+  ddsrt_free (grants[1]);
+  ddsrt_free (perm_config);
+  ddsrt_free (ca);
+  ddsrt_free (id1_subj);
+  ddsrt_free (id2_subj);
+  ddsrt_free (id1);
+  ddsrt_free (id2);
+}
+#undef D
+#undef H
+#undef M
+
+
+#define N_NODES 4
+#define PERM_EXP_BASE 3
+CU_Test(ddssec_access_control, permissions_expiry_multiple, .timeout=20)
+{
+  char topic_name[100];
+  create_topic_name("ddssec_access_control_", g_topic_nr++, topic_name, sizeof (topic_name));
+
+  dds_time_t t_perm = dds_time ();
+  char *ca = generate_ca ("ca1", TEST_IDENTITY_CA1_PRIVATE_KEY, 0, 3600);
+  char *perm_topic = get_permissions_topic (topic_name);
+
+  // 1st node used as reader, other nodes as writer
+  const char *id[N_NODES], *pk[N_NODES], *ca_list[N_NODES];
+  char * id_subj[N_NODES], *grants[N_NODES];
+  bool exp_fail[N_NODES];
+  for (int i = 0; i < N_NODES; i++)
+  {
+    char *id_name;
+    ddsrt_asprintf (&id_name, "id_%d", i);
+    pk[i] = TEST_IDENTITY1_PRIVATE_KEY;
+    ca_list[i] = ca;
+    id[i] = generate_identity (ca_list[i], TEST_IDENTITY_CA1_PRIVATE_KEY, id_name, pk[i], 0, 3600, &id_subj[i]);
+    exp_fail[i] = false;
+    dds_duration_t v = DDS_SECS(i == 0 ? 3600 : PERM_EXP_BASE + i); /* 1st node is reader and should not expire */
+    grants[i] = get_permissions_grant (id_name, id_subj[i], t_perm, t_perm + v, perm_topic, perm_topic, NULL);
+    ddsrt_free (id_name);
+  }
+
+  char * perm_config = get_permissions_config (grants, N_NODES, true);
+  access_control_init (
+      id, pk, ca_list, exp_fail, N_NODES,
+      true, PF_F COMMON_ETC_PATH("default_governance.p7s"),
+      true, perm_config,
+      true, PF_F COMMON_ETC_PATH("default_permissions_ca.pem"));
+
+  dds_qos_t * qos = dds_create_qos ();
+  CU_ASSERT_FATAL (qos != NULL);
+  dds_qset_history (qos, DDS_HISTORY_KEEP_ALL, -1);
+  dds_qset_durability (qos, DDS_DURABILITY_TRANSIENT_LOCAL);
+  dds_qset_reliability (qos, DDS_RELIABILITY_RELIABLE, DDS_INFINITY);
+  dds_entity_t sub_tp = dds_create_topic (g_participant[0], &SecurityCoreTests_Type1_desc, topic_name, NULL, NULL);
+  CU_ASSERT_FATAL (sub_tp > 0);
+  dds_entity_t sub = dds_create_subscriber (g_participant[0], NULL, NULL);
+  CU_ASSERT_FATAL (sub > 0);
+  dds_entity_t rd = dds_create_reader (sub, sub_tp, qos, NULL);
+  CU_ASSERT_FATAL (rd > 0);
+  dds_set_status_mask (rd, DDS_DATA_AVAILABLE_STATUS);
+
+  dds_entity_t wr[N_NODES - 1];
+  for (int i = 1; i < N_NODES; i++)
+  {
+    dds_entity_t pub = dds_create_publisher (g_participant[i], NULL, NULL);
+    CU_ASSERT_FATAL (pub > 0);
+    dds_entity_t pub_tp = dds_create_topic (g_participant[i], &SecurityCoreTests_Type1_desc, topic_name, NULL, NULL);
+    CU_ASSERT_FATAL (pub_tp > 0);
+    wr[i - 1] = dds_create_writer (pub, pub_tp, qos, NULL);
+    CU_ASSERT_FATAL (wr[i - 1] > 0);
+    dds_set_status_mask (wr[i - 1], DDS_PUBLICATION_MATCHED_STATUS);
+    sync_writer_to_readers(g_participant[i], wr[i - 1], 1);
+  }
+  dds_delete_qos (qos);
+
+  SecurityCoreTests_Type1 sample = { 1, 1 };
+  SecurityCoreTests_Type1 rd_sample;
+  void * samples[] = { &rd_sample };
+  dds_sample_info_t info[1];
+  dds_return_t ret;
+
+  for (int i = 1; i < N_NODES; i++)
+  {
+    // sleep until 1s before next writer pp permission expires
+    dds_duration_t delay = DDS_SECS (PERM_EXP_BASE + i - 1) - (dds_time () - t_perm);
+    if (delay > 0)
+      dds_sleepfor (delay);
+
+    printf ("run %d\n", i);
+
+    for (int w = 1; w < N_NODES; w++)
+    {
+      sample.id = w;
+      ret = dds_write (wr[w - 1], &sample);
+      CU_ASSERT_EQUAL_FATAL (ret, DDS_RETCODE_OK);
+      printf ("write %d\n", w);
+    }
+
+    // Expect reader to receive data from writers with non-expired permissions
+    int n_samples = 0, n_invalid = 0, n_wait = 0;
+    while (n_samples + n_invalid < N_NODES - 1 && n_wait < 5)
+    {
+      ret = dds_take (rd, samples, info, 1, 1);
+      CU_ASSERT_FATAL (ret >= 0);
+      if (ret == 0)
+      {
+        reader_wait_for_data (g_participant[0], rd, DDS_MSECS (100));
+        n_wait++;
+      }
+      else if (info[0].instance_state == DDS_IST_ALIVE)
+      {
+        printf ("recv sample %d\n", rd_sample.id);
+        n_samples++;
+      }
+      else
+      {
+        printf ("recv inv sample\n");
+        n_invalid++;
+      }
+    }
+    CU_ASSERT_EQUAL (n_samples, N_NODES - i);
+    CU_ASSERT (n_invalid < i);
+  }
+
+  access_control_fini (N_NODES);
+
+  for (int i = 0; i < N_NODES; i++)
+  {
+    ddsrt_free (grants[i]);
+    ddsrt_free (id_subj[i]);
+    ddsrt_free ((char *)id[i]);
+  }
+  ddsrt_free (ca);
+  ddsrt_free (perm_topic);
+  ddsrt_free (perm_config);
+}
+#undef N_NODES
diff --git a/src/security/core/tests/authentication.c b/src/security/core/tests/authentication.c
index a23f203..1e53a8f 100644
--- a/src/security/core/tests/authentication.c
+++ b/src/security/core/tests/authentication.c
@@ -19,7 +19,6 @@
 #include "dds/version.h"
 #include "dds/ddsrt/cdtors.h"
 #include "dds/ddsrt/environ.h"
-#include "dds/ddsrt/process.h"
 #include "dds/ddsrt/heap.h"
 #include "dds/ddsrt/string.h"
 #include "dds/ddsi/q_config.h"
@@ -31,15 +30,12 @@
 
 #include "common/config_env.h"
 #include "common/authentication_wrapper.h"
-#include "common/handshake_test_utils.h"
+#include "common/test_utils.h"
 #include "common/security_config_test_utils.h"
 #include "common/test_identity.h"
 #include "common/cert_utils.h"
 #include "common/security_config_test_utils.h"
 
-#include "SecurityCoreTests.h"
-
-
 #define ID1 TEST_IDENTITY1_CERTIFICATE
 #define ID1K TEST_IDENTITY1_PRIVATE_KEY
 #define ID2 TEST_IDENTITY2_CERTIFICATE
@@ -152,119 +148,6 @@ static void authentication_init(
   ddsrt_free (conf2);
 }
 
-static char *create_topic_name(const char *prefix, uint32_t nr, char *name, size_t size)
-{
-  ddsrt_pid_t pid = ddsrt_getpid ();
-  ddsrt_tid_t tid = ddsrt_gettid ();
-  (void)snprintf(name, size, "%s%d_pid%" PRIdPID "_tid%" PRIdTID "", prefix, nr, pid, tid);
-  return name;
-}
-
-static void sync_writer_to_reader()
-{
-  dds_attach_t triggered;
-  dds_return_t ret;
-  dds_entity_t waitset_wr = dds_create_waitset (g_participant1);
-  CU_ASSERT_FATAL (waitset_wr > 0);
-  dds_publication_matched_status_t pub_matched;
-
-  /* Sync writer to reader. */
-  ret = dds_waitset_attach (waitset_wr, g_wr, g_wr);
-  CU_ASSERT_EQUAL_FATAL (ret, DDS_RETCODE_OK);
-  while (true)
-  {
-    ret = dds_waitset_wait (waitset_wr, &triggered, 1, DDS_SECS(5));
-    CU_ASSERT_FATAL (ret >= 1);
-    CU_ASSERT_EQUAL_FATAL (g_wr, (dds_entity_t)(intptr_t) triggered);
-    ret = dds_get_publication_matched_status(g_wr, &pub_matched);
-    CU_ASSERT_EQUAL_FATAL (ret, DDS_RETCODE_OK);
-    if (pub_matched.total_count >= 1)
-      break;
-  };
-  dds_delete (waitset_wr);
-}
-
-static void reader_wait_for_data()
-{
-  dds_attach_t triggered;
-  dds_return_t ret;
-  dds_entity_t waitset_rd = dds_create_waitset (g_participant2);
-  CU_ASSERT_FATAL (waitset_rd > 0);
-
-  ret = dds_waitset_attach (waitset_rd, g_rd, g_rd);
-  CU_ASSERT_EQUAL_FATAL (ret, DDS_RETCODE_OK);
-  ret = dds_waitset_wait (waitset_rd, &triggered, 1, DDS_SECS(5));
-  CU_ASSERT_EQUAL_FATAL (ret, 1);
-  CU_ASSERT_EQUAL_FATAL (g_rd, (dds_entity_t)(intptr_t)triggered);
-  dds_delete (waitset_rd);
-}
-
-static void rd_wr_init()
-{
-  char name[100];
-  dds_qos_t * qos = dds_create_qos ();
-  CU_ASSERT_FATAL (qos != NULL);
-  dds_qset_history (qos, DDS_HISTORY_KEEP_ALL, -1);
-  dds_qset_durability (qos, DDS_DURABILITY_TRANSIENT_LOCAL);
-  dds_qset_reliability (qos, DDS_RELIABILITY_RELIABLE, DDS_INFINITY);
-
-  create_topic_name("ddssec_authentication_", g_topic_nr++, name, sizeof (name));
-  g_pub = dds_create_publisher (g_participant1, NULL, NULL);
-  CU_ASSERT_FATAL (g_pub > 0);
-  g_sub = dds_create_subscriber (g_participant2, NULL, NULL);
-  CU_ASSERT_FATAL (g_sub > 0);
-  g_pub_tp = dds_create_topic (g_participant1, &SecurityCoreTests_Type1_desc, name, NULL, NULL);
-  CU_ASSERT_FATAL (g_pub_tp > 0);
-  g_sub_tp = dds_create_topic (g_participant2, &SecurityCoreTests_Type1_desc, name, NULL, NULL);
-  CU_ASSERT_FATAL (g_sub_tp > 0);
-  g_wr = dds_create_writer (g_pub, g_pub_tp, qos, NULL);
-  CU_ASSERT_FATAL (g_wr > 0);
-  dds_set_status_mask (g_wr, DDS_PUBLICATION_MATCHED_STATUS);
-  g_rd = dds_create_reader (g_sub, g_sub_tp, qos, NULL);
-  CU_ASSERT_FATAL (g_rd > 0);
-  dds_set_status_mask (g_rd, DDS_DATA_AVAILABLE_STATUS);
-  sync_writer_to_reader();
-  dds_delete_qos (qos);
-}
-
-static void write_read(dds_duration_t dur, bool exp_write_fail, bool exp_read_fail)
-{
-  SecurityCoreTests_Type1 sample = { 1, 1 };
-  SecurityCoreTests_Type1 rd_sample;
-  void * samples[] = { &rd_sample };
-  dds_sample_info_t info[1];
-  dds_return_t ret;
-  dds_time_t tend = dds_time () + dur;
-  bool write_fail = false, read_fail = false;
-
-  rd_wr_init ();
-  do
-  {
-    ret = dds_write (g_wr, &sample);
-    if (ret != DDS_RETCODE_OK)
-      write_fail = true;
-    while (true)
-    {
-      if ((ret = dds_take (g_rd, samples, info, 1, 1)) == 0)
-      {
-        reader_wait_for_data ();
-        continue;
-      }
-      else if (ret < 0)
-      {
-        read_fail = true;
-        break;
-      }
-      CU_ASSERT_EQUAL_FATAL (ret, 1);
-      break;
-    }
-    dds_sleepfor (DDS_MSECS (1));
-  }
-  while (dds_time() < tend && !write_fail && !read_fail);
-  CU_ASSERT_EQUAL_FATAL (write_fail, exp_write_fail);
-  CU_ASSERT_EQUAL_FATAL (read_fail, exp_read_fail);
-}
-
 static void authentication_fini(bool delete_pp1, bool delete_pp2)
 {
   if (delete_pp1)
@@ -276,7 +159,7 @@ static void authentication_fini(bool delete_pp1, bool delete_pp2)
 }
 
 #define FM_CA "error: unable to get local issuer certificate"
-#define FM_INVK "Failed to finalize verify context"
+#define FM_INVK "Failed to finalize digest context"
 CU_TheoryDataPoints(ddssec_authentication, id_ca_certs) = {
     CU_DataPoints(const char *,
     /*                         */"valid ID1-ID1",
@@ -341,7 +224,7 @@ CU_Theory((const char * test_descr, const char * id2, const char *key2, const ch
     bool exp_fail_local, const char * fail_local_msg,
     bool exp_fail_hs_req, const char * fail_hs_req_msg,
     bool exp_fail_hs_reply, const char * fail_hs_reply_msg),
-    ddssec_authentication, id_ca_certs)
+    ddssec_authentication, id_ca_certs, .timeout=30)
 {
   struct Handshake *hs_list;
   int nhs;
@@ -393,12 +276,12 @@ CU_TheoryDataPoints(ddssec_authentication, expired_cert) = {
     /*                       |      |      |      |      |      |     */"id1 valid after 1s, delay 1100ms",
     /*                       |      |      |      |      |      |      |    *//*"ca and id1 expire during session"*/),
     CU_DataPoints(int32_t,   0,     -M(1), 0,     0,     0,     0,     0,     /*0*/     ),   /* CA1 not before */
-    CU_DataPoints(int32_t,   D(1),  0,     D(1),  D(1),  M(1),  D(1),  D(1),  /*2*/     ),  /* CA1 not after */
-    CU_DataPoints(int32_t,   0,     0,     -D(1), 0,     0,     0,     1,     /*0*/     ),  /* ID1 not before */
-    CU_DataPoints(int32_t,   D(1),  D(1),  0,     D(1),  M(1),  1,     D(1),  /*2*/     ),  /* ID1 not after */
+    CU_DataPoints(int32_t,   D(1),  0,     D(1),  D(1),  M(1),  D(1),  D(1),  /*2*/     ),  /* CA1 not after (offset from local time) */
+    CU_DataPoints(int32_t,   0,     0,     -D(1), 0,     0,     0,     1,     /*0*/     ),  /* ID1 not before (offset from local time) */
+    CU_DataPoints(int32_t,   D(1),  D(1),  0,     D(1),  M(1),  1,     D(1),  /*2*/     ),  /* ID1 not after (offset from local time) */
     CU_DataPoints(bool,      false, true,  true,  false, false, true,  false, /*false*/ ),  /* expect validate local ID1 fail */
-    CU_DataPoints(int32_t,   0,     0,     0,     -D(1), 0,     0,     0,     /*0*/     ),  /* ID2 not before */
-    CU_DataPoints(int32_t,   D(1),  D(1),  D(1),  0,     D(1),  1,     D(1),  /*D(1)*/  ),  /* ID2 not after */
+    CU_DataPoints(int32_t,   0,     0,     0,     -D(1), 0,     0,     0,     /*0*/     ),  /* ID2 not before (offset from local time) */
+    CU_DataPoints(int32_t,   D(1),  D(1),  D(1),  0,     D(1),  1,     D(1),  /*D(1)*/  ),  /* ID2 not after (offset from local time) */
     CU_DataPoints(bool,      false, true,  false, true,  false, true,  false, /*false*/ ),  /* expect validate local ID2 fail */
     CU_DataPoints(uint32_t,  0,     0,     0,     0,     0,     1100,  1100,  /*0*/     ),  /* delay (ms) after generating certificate */
     CU_DataPoints(uint32_t,  1,     0,     0,     0,     1,     0,     1,     /*3500*/  ),  /* write/read data during x ms */
@@ -409,22 +292,32 @@ CU_Theory(
     int32_t id1_not_before, int32_t id1_not_after, bool id1_local_fail,
     int32_t id2_not_before, int32_t id2_not_after, bool id2_local_fail,
     uint32_t delay, uint32_t write_read_dur, bool exp_read_fail),
-  ddssec_authentication, expired_cert)
+  ddssec_authentication, expired_cert, .timeout=30)
 {
-  char *ca, *id1, *id2, *id1_subj, *id2_subj;
   printf("running test expired_cert: %s\n", test_descr);
+
+  char topic_name[100];
+  create_topic_name("ddssec_authentication_", g_topic_nr++, topic_name, sizeof (topic_name));
+
+  char *ca, *id1, *id2, *id1_subj, *id2_subj;
   ca = generate_ca ("ca1", CA1K, ca_not_before, ca_not_after);
   id1 = generate_identity (ca, CA1K, "id1", ID1K, id1_not_before, id1_not_after, &id1_subj);
   id2 = generate_identity (ca, CA1K, "id2", ID1K, id2_not_before, id2_not_after, &id2_subj);
   dds_sleepfor (DDS_MSECS (delay));
 
-  char * grants[] = { get_permissions_grant ("id1", id1_subj), get_permissions_grant ("id2", id2_subj) };
+  dds_time_t now = dds_time ();
+  char * grants[] = {
+    get_permissions_grant ("id1", id1_subj, now - DDS_SECS(D(1)), now + DDS_SECS(D(1)), NULL, NULL, NULL),
+    get_permissions_grant ("id2", id2_subj, now - DDS_SECS(D(1)), now + DDS_SECS(D(1)), NULL, NULL, NULL) };
   char * perm_config = get_permissions_config (grants, 2, true);
   authentication_init (id1, ID1K, ca, id2, ID1K, ca, NULL, perm_config, id1_local_fail, id2_local_fail);
   validate_handshake (DDS_DOMAINID1, id1_local_fail, NULL, NULL, NULL);
   validate_handshake (DDS_DOMAINID2, id2_local_fail, NULL, NULL, NULL);
   if (write_read_dur > 0)
-    write_read (DDS_MSECS (write_read_dur), false, exp_read_fail);
+  {
+    rd_wr_init (g_participant1, &g_pub, &g_pub_tp, &g_wr, g_participant2, &g_sub, &g_sub_tp, &g_rd, topic_name);
+    write_read_for (g_wr, g_participant2, g_rd, DDS_MSECS (write_read_dur), false, exp_read_fail);
+  }
   authentication_fini (!id1_local_fail, !id2_local_fail);
   ddsrt_free (grants[0]);
   ddsrt_free (grants[1]);
diff --git a/src/security/core/tests/common/etc/default_permissions.p7s b/src/security/core/tests/common/etc/default_permissions.p7s
index ddc97bc..4c8985b 100644
--- a/src/security/core/tests/common/etc/default_permissions.p7s
+++ b/src/security/core/tests/common/etc/default_permissions.p7s
@@ -1,9 +1,9 @@
 MIME-Version: 1.0
-Content-Type: multipart/signed; protocol="application/x-pkcs7-signature"; micalg="sha-256"; boundary="----A38CC2CF99C9B2ECE7711B9937B56A67"
+Content-Type: multipart/signed; protocol="application/x-pkcs7-signature"; micalg="sha-256"; boundary="----82330497FB128B8C3833F86AA2902BC0"
 
 This is an S/MIME signed message
 
-------A38CC2CF99C9B2ECE7711B9937B56A67
+------82330497FB128B8C3833F86AA2902BC0
 Content-Type: text/plain
 
 <?xml version="1.0" encoding="utf-8"?>
@@ -76,10 +76,43 @@ Content-Type: text/plain
             </allow_rule>
             <default>DENY</default>
         </grant>
+        <grant name="carol_permissions">
+            <subject_name>emailAddress=carol@cycloneddssecurity.adlinktech.com,CN=Carol Example,O=Example Organization,OU=Organizational Unit Name,L=Locality Name,ST=OV,C=NL</subject_name>
+            <validity>
+                <!-- Format is CCYY-MM-DDThh:mm:ss[Z|(+|-)hh:mm] in GMT -->
+                <not_before>2015-09-15T01:00:00</not_before>
+                <not_after>2115-09-15T01:00:00</not_after>
+            </validity>
+            <allow_rule>
+                <domains>
+                    <id_range>
+                        <min>0</min>
+                        <max>230</max>
+                    </id_range>
+                </domains>
+                <publish>
+                    <topics>
+                        <topic>*</topic>
+                    </topics>
+                    <partitions>
+                        <partition>*</partition>
+                    </partitions>
+                </publish>
+                <subscribe>
+                    <topics>
+                        <topic>*</topic>
+                    </topics>
+                    <partitions>
+                        <partition>*</partition>
+                    </partitions>
+                </subscribe>
+            </allow_rule>
+            <default>DENY</default>
+        </grant>
     </permissions>
 </dds>
 
-------A38CC2CF99C9B2ECE7711B9937B56A67
+------82330497FB128B8C3833F86AA2902BC0
 Content-Type: application/x-pkcs7-signature; name="smime.p7s"
 Content-Transfer-Encoding: base64
 Content-Disposition: attachment; filename="smime.p7s"
@@ -115,16 +148,16 @@ DBdFeGFtcGxlIENBIE9yZ2FuaXphdGlvbjEfMB0GA1UEAwwWRXhhbXBsZSBQZXJt
 aXNzaW9ucyBDQTE6MDgGCSqGSIb3DQEJARYrYXV0aG9yaXR5QGN5Y2xvbmVkZHNz
 ZWN1cml0eS5hZGxpbmt0ZWNoLmNvbQIUfoby6818hlJQ+41KUHiM6BZll/0wDQYJ
 YIZIAWUDBAIBBQCggeQwGAYJKoZIhvcNAQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG
-9w0BCQUxDxcNMjAwMzI1MDczMTM5WjAvBgkqhkiG9w0BCQQxIgQg3FQPbVj9xFlc
-/eoZaddhdX1BXlKZyENrbh7DcCwklVwweQYJKoZIhvcNAQkPMWwwajALBglghkgB
+9w0BCQUxDxcNMjAwMzI3MTMyMzM3WjAvBgkqhkiG9w0BCQQxIgQgZQWM3IUTViCR
+9e+lYi65rV0rszQ5ZMG9iWStIWhT3UQweQYJKoZIhvcNAQkPMWwwajALBglghkgB
 ZQMEASowCwYJYIZIAWUDBAEWMAsGCWCGSAFlAwQBAjAKBggqhkiG9w0DBzAOBggq
 hkiG9w0DAgICAIAwDQYIKoZIhvcNAwICAUAwBwYFKw4DAgcwDQYIKoZIhvcNAwIC
-ASgwDQYJKoZIhvcNAQEBBQAEggEAWJxDp9TDqXKazAlIj9SZ8mQXhhGoTDeqZbxE
-Bs561dHUmQVtA2S85TWGiCffKqWj3wlF5GwZNneYEV1deE3LZFa0o1+/VpeIBSGO
-Qs1xKS7zx8IkGok3k88bh+eohDrgpzdLWkZeJ4P7J/3JmCMFdTXuCpuQYhRIrXO0
-pq4ueV2qGyCN6GZS2PC88GV0xeoS62Vj1Xze8omfgDI7KCPhKz6gJSEFUUqIzg7p
-Zhqm15qorUoBVXcvMwaG95/xZVfcZzMbmJB/nhwd9KYu9ImkGj6ssSbgr3VR4OkQ
-gQUib4aVQJQgBaWEPrgSjRkAp9rMB7R9IW6p2auMA/Gd/kbd7g==
+ASgwDQYJKoZIhvcNAQEBBQAEggEAaZ687ayhsPnVPmsrPM4ECEU9/+PZAuFFV094
+Cqa9YLmsnO0jFElZLu2XRx1oNVp8TxG6OVckDINAxQjMO15+k0oqsAqdJFbgFLA/
+YidfEpuhFUjOy938Y46X6tbFj527GfLS8m3vIoYX+E+db1QcGv22RHb/KKSk6Htc
+rbgEFV0pmyNK2foHp9ruBdu/nD7mXRo7h/xZdch60zDyeG40bsoKL63wC62sxQ/X
+Mjxc1gmyXXr6AAEVzCVGIr9XHgaTNrThLfoWSRGcrLJI4cwevJ+jLJBBj347FmXi
+x8nk6a09p7r9fSASX4vRiLDmDbuFwXolfNLS7Op3UKgkhJBm/A==
 
-------A38CC2CF99C9B2ECE7711B9937B56A67--
+------82330497FB128B8C3833F86AA2902BC0--
 
diff --git a/src/security/core/tests/common/etc/default_permissions.xml b/src/security/core/tests/common/etc/default_permissions.xml
index 5802a3e..d59a629 100644
--- a/src/security/core/tests/common/etc/default_permissions.xml
+++ b/src/security/core/tests/common/etc/default_permissions.xml
@@ -68,5 +68,38 @@
             </allow_rule>
             <default>DENY</default>
         </grant>
+        <grant name="carol_permissions">
+            <subject_name>emailAddress=carol@cycloneddssecurity.adlinktech.com,CN=Carol Example,O=Example Organization,OU=Organizational Unit Name,L=Locality Name,ST=OV,C=NL</subject_name>
+            <validity>
+                <!-- Format is CCYY-MM-DDThh:mm:ss[Z|(+|-)hh:mm] in GMT -->
+                <not_before>2015-09-15T01:00:00</not_before>
+                <not_after>2115-09-15T01:00:00</not_after>
+            </validity>
+            <allow_rule>
+                <domains>
+                    <id_range>
+                        <min>0</min>
+                        <max>230</max>
+                    </id_range>
+                </domains>
+                <publish>
+                    <topics>
+                        <topic>*</topic>
+                    </topics>
+                    <partitions>
+                        <partition>*</partition>
+                    </partitions>
+                </publish>
+                <subscribe>
+                    <topics>
+                        <topic>*</topic>
+                    </topics>
+                    <partitions>
+                        <partition>*</partition>
+                    </partitions>
+                </subscribe>
+            </allow_rule>
+            <default>DENY</default>
+        </grant>
     </permissions>
 </dds>
diff --git a/src/security/core/tests/common/security_config_test_utils.c b/src/security/core/tests/common/security_config_test_utils.c
index ef9f0f8..51a0a9f 100644
--- a/src/security/core/tests/common/security_config_test_utils.c
+++ b/src/security/core/tests/common/security_config_test_utils.c
@@ -60,22 +60,25 @@ static const char *governance_xml =
     "  </domain_access_rules>"
     "</dds>";
 
+static const char *topic_xml =
+    "<topic>${TOPIC_NAME}</topic>";
+
 static const char *permissions_xml_grant =
     "    <grant name=\"${GRANT_NAME}\">"
     "      <subject_name>${SUBJECT_NAME}</subject_name>"
-    "      <validity><not_before>2015-09-15T01:00:00</not_before><not_after>2115-09-15T01:00:00</not_after></validity>"
+    "      <validity><not_before>${NOT_BEFORE:-2015-09-15T01:00:00}</not_before><not_after>${NOT_AFTER:-2115-09-15T01:00:00}</not_after></validity>"
     "      <allow_rule>"
     "        <domains><id_range><min>0</min><max>230</max></id_range></domains>"
     "        <publish>"
-    "          <topics><topic>*</topic></topics>"
+    "          <topics>${PUB_TOPICS:-<topic>*</topic>}</topics>"
     "          <partitions><partition>*</partition></partitions>"
     "        </publish>"
     "        <subscribe>"
-    "          <topics><topic>*</topic></topics>"
+    "          <topics>${SUB_TOPICS:-<topic>*</topic>}</topics>"
     "          <partitions><partition>*</partition></partitions>"
     "        </subscribe>"
     "      </allow_rule>"
-    "      <default>DENY</default>"
+    "      <default>${DEFAULT_POLICY:-DENY}</default>"
     "    </grant>";
 
 static const char *permissions_xml =
@@ -212,11 +215,46 @@ char * get_governance_config(struct kvp *config_vars, bool add_prefix)
   return prefix_data (config_signed, add_prefix);
 }
 
-char * get_permissions_grant(const char * name, const char * subject)
+
+char * get_permissions_topic(const char * name)
 {
+  struct kvp vars[] = {
+    { "TOPIC_NAME", name, 1 },
+    { NULL, NULL, 0 }
+  };
+  return ddsrt_expand_vars (topic_xml, &expand_lookup_vars, vars);
+}
+
+static char * get_xml_datetime(dds_time_t t, char * buf, size_t len)
+{
+  struct tm tm;
+  time_t sec = (time_t)(t / DDS_NSECS_IN_SEC);
+#if _WIN32
+  (void)gmtime_s(&tm, &sec);
+#else
+  (void)gmtime_r(&sec, &tm);
+#endif /* _WIN32 */
+
+  strftime(buf, len, "%FT%TZ", &tm);
+  return buf;
+}
+
+char * get_permissions_grant(const char * name, const char * subject,
+    dds_time_t not_before, dds_time_t not_after, const char * pub_topics, const char * sub_topics, const char * default_policy)
+{
+  char not_before_str[] = "0000-00-00T00:00:00Z";
+  char not_after_str[] = "0000-00-00T00:00:00Z";
+  get_xml_datetime(not_before, not_before_str, sizeof(not_before_str));
+  get_xml_datetime(not_after, not_after_str, sizeof(not_after_str));
+
   struct kvp vars[] = {
     { "GRANT_NAME", name, 1 },
     { "SUBJECT_NAME", subject, 1 },
+    { "NOT_BEFORE", not_before_str, 1 },
+    { "NOT_AFTER", not_after_str, 1 },
+    { "PUB_TOPICS", pub_topics, 1 },
+    { "SUB_TOPICS", sub_topics, 1 },
+    { "DEFAULT_POLICY", default_policy, 1 },
     { NULL, NULL, 0 }
   };
   return ddsrt_expand_vars (permissions_xml_grant, &expand_lookup_vars, vars);
diff --git a/src/security/core/tests/common/security_config_test_utils.h b/src/security/core/tests/common/security_config_test_utils.h
index 056b4d5..87f8e4b 100644
--- a/src/security/core/tests/common/security_config_test_utils.h
+++ b/src/security/core/tests/common/security_config_test_utils.h
@@ -26,7 +26,9 @@ const char * expand_lookup_vars_env (const char *name, void * data);
 int32_t expand_lookup_unmatched (const struct kvp * lookup_table);
 
 char * get_governance_config (struct kvp *config_vars, bool add_prefix);
-char * get_permissions_grant(const char * name, const char * subject);
+char * get_permissions_topic(const char * name);
+char * get_permissions_grant(const char * name, const char * subject,
+    dds_time_t not_before, dds_time_t not_after, const char * pub_topics, const char * sub_topics, const char * default_policy);
 char * get_permissions_config(char * grants[], size_t ngrants, bool add_prefix);
 
 #endif /* SECURITY_CORE_TEST_SECURITY_CONFIG_TEST_UTILS_H_ */
diff --git a/src/security/core/tests/common/handshake_test_utils.c b/src/security/core/tests/common/test_utils.c
similarity index 68%
rename from src/security/core/tests/common/handshake_test_utils.c
rename to src/security/core/tests/common/test_utils.c
index 6385de2..476490c 100644
--- a/src/security/core/tests/common/handshake_test_utils.c
+++ b/src/security/core/tests/common/test_utils.c
@@ -14,13 +14,16 @@
 
 #include "CUnit/Test.h"
 #include "dds/dds.h"
+#include "dds/ddsrt/process.h"
 #include "dds/ddsrt/string.h"
+#include "dds/ddsrt/threads.h"
 #include "dds/ddsrt/heap.h"
 #include "dds/security/dds_security_api.h"
 #include "authentication_wrapper.h"
-#include "handshake_test_utils.h"
+#include "test_utils.h"
+#include "SecurityCoreTests.h"
 
-#define TIMEOUT DDS_SECS(2)
+#define HS_TIMEOUT DDS_SECS(2)
 
 struct Identity localIdentityList[MAX_LOCAL_IDENTITIES];
 int numLocal = 0;
@@ -131,7 +134,7 @@ static int find_handshake(DDS_Security_HandshakeHandle handle)
 static void handle_process_message(dds_domainid_t domain_id, DDS_Security_IdentityHandle handshake)
 {
   struct message *msg;
-  if ((msg = test_authentication_plugin_take_msg(domain_id, MESSAGE_KIND_PROCESS_HANDSHAKE, 0, 0, handshake, TIMEOUT)))
+  if ((msg = test_authentication_plugin_take_msg(domain_id, MESSAGE_KIND_PROCESS_HANDSHAKE, 0, 0, handshake, HS_TIMEOUT)))
   {
     int idx;
     if ((idx = find_handshake(msg->hsHandle)) >= 0)
@@ -148,7 +151,7 @@ static void handle_begin_handshake_request(dds_domainid_t domain_id, struct Hand
 {
   struct message *msg;
   printf("handle begin handshake request %"PRId64"<->%"PRId64"\n", lid, rid);
-  if ((msg = test_authentication_plugin_take_msg(domain_id, MESSAGE_KIND_BEGIN_HANDSHAKE_REQUEST, lid, rid, 0, TIMEOUT)))
+  if ((msg = test_authentication_plugin_take_msg(domain_id, MESSAGE_KIND_BEGIN_HANDSHAKE_REQUEST, lid, rid, 0, HS_TIMEOUT)))
   {
     hs->handle = msg->hsHandle;
     hs->handshakeResult = msg->result;
@@ -164,7 +167,7 @@ static void handle_begin_handshake_reply(dds_domainid_t domain_id, struct Handsh
 {
   struct message *msg;
   printf("handle begin handshake reply %"PRId64"<->%"PRId64"\n", lid, rid);
-  if ((msg = test_authentication_plugin_take_msg(domain_id, MESSAGE_KIND_BEGIN_HANDSHAKE_REPLY, lid, rid, 0, TIMEOUT)))
+  if ((msg = test_authentication_plugin_take_msg(domain_id, MESSAGE_KIND_BEGIN_HANDSHAKE_REPLY, lid, rid, 0, HS_TIMEOUT)))
   {
     hs->handle = msg->hsHandle;
     hs->handshakeResult = msg->result;
@@ -179,7 +182,7 @@ static void handle_begin_handshake_reply(dds_domainid_t domain_id, struct Handsh
 static void handle_validate_remote_identity(dds_domainid_t domain_id, DDS_Security_IdentityHandle lid, int count)
 {
   struct message *msg;
-  while (count-- > 0 && (msg = test_authentication_plugin_take_msg(domain_id, MESSAGE_KIND_VALIDATE_REMOTE_IDENTITY, lid, 0, 0, TIMEOUT)))
+  while (count-- > 0 && (msg = test_authentication_plugin_take_msg(domain_id, MESSAGE_KIND_VALIDATE_REMOTE_IDENTITY, lid, 0, 0, HS_TIMEOUT)))
   {
     struct Handshake *hs;
     add_remote_identity(msg->ridHandle, &msg->rguid);
@@ -204,7 +207,7 @@ static void handle_validate_remote_identity(dds_domainid_t domain_id, DDS_Securi
 
 static void handle_validate_local_identity(dds_domainid_t domain_id, bool exp_localid_fail, const char * exp_localid_msg)
 {
- struct message *msg = test_authentication_plugin_take_msg (domain_id, MESSAGE_KIND_VALIDATE_LOCAL_IDENTITY, 0, 0, 0, TIMEOUT);
+ struct message *msg = test_authentication_plugin_take_msg (domain_id, MESSAGE_KIND_VALIDATE_LOCAL_IDENTITY, 0, 0, 0, HS_TIMEOUT);
   CU_ASSERT_FATAL (msg != NULL);
   CU_ASSERT_FATAL ((msg->result == DDS_SECURITY_VALIDATION_OK) != exp_localid_fail);
   if (exp_localid_fail && exp_localid_msg)
@@ -268,4 +271,113 @@ void handshake_list_fini(struct Handshake *hs_list, int nhs)
     struct Handshake hs = hs_list[n];
     ddsrt_free (hs.err_msg);
   }
-}
\ No newline at end of file
+}
+
+void sync_writer_to_readers(dds_entity_t pp_wr, dds_entity_t wr, uint32_t exp_count)
+{
+  dds_attach_t triggered;
+  dds_entity_t ws = dds_create_waitset (pp_wr);
+  CU_ASSERT_FATAL (ws > 0);
+  dds_publication_matched_status_t pub_matched;
+
+  dds_return_t ret = dds_waitset_attach (ws, wr, wr);
+  CU_ASSERT_EQUAL_FATAL (ret, DDS_RETCODE_OK);
+  while (true)
+  {
+    ret = dds_waitset_wait (ws, &triggered, 1, DDS_SECS(5));
+    CU_ASSERT_FATAL (ret >= 1);
+    CU_ASSERT_EQUAL_FATAL (wr, (dds_entity_t)(intptr_t) triggered);
+    ret = dds_get_publication_matched_status(wr, &pub_matched);
+    CU_ASSERT_EQUAL_FATAL (ret, DDS_RETCODE_OK);
+    if (pub_matched.total_count >= exp_count)
+      break;
+  };
+  dds_delete (ws);
+  CU_ASSERT_EQUAL_FATAL (pub_matched.total_count, exp_count);
+}
+
+char *create_topic_name(const char *prefix, uint32_t nr, char *name, size_t size)
+{
+  ddsrt_pid_t pid = ddsrt_getpid ();
+  ddsrt_tid_t tid = ddsrt_gettid ();
+  (void)snprintf(name, size, "%s%d_pid%" PRIdPID "_tid%" PRIdTID "", prefix, nr, pid, tid);
+  return name;
+}
+
+bool reader_wait_for_data(dds_entity_t pp, dds_entity_t rd, dds_duration_t dur)
+{
+  dds_attach_t triggered;
+  dds_entity_t ws = dds_create_waitset (pp);
+  CU_ASSERT_FATAL (ws > 0);
+  dds_return_t ret = dds_waitset_attach (ws, rd, rd);
+  CU_ASSERT_EQUAL_FATAL (ret, DDS_RETCODE_OK);
+  ret = dds_waitset_wait (ws, &triggered, 1, dur);
+  if (ret > 0)
+    CU_ASSERT_EQUAL_FATAL (rd, (dds_entity_t)(intptr_t)triggered);
+  dds_delete (ws);
+  return ret > 0;
+}
+
+void rd_wr_init(
+    dds_entity_t pp_wr, dds_entity_t *pub, dds_entity_t *pub_tp, dds_entity_t *wr,
+    dds_entity_t pp_rd, dds_entity_t *sub, dds_entity_t *sub_tp, dds_entity_t *rd,
+    const char * topic_name)
+{
+  dds_qos_t * qos = dds_create_qos ();
+  CU_ASSERT_FATAL (qos != NULL);
+  dds_qset_history (qos, DDS_HISTORY_KEEP_ALL, -1);
+  dds_qset_durability (qos, DDS_DURABILITY_TRANSIENT_LOCAL);
+  dds_qset_reliability (qos, DDS_RELIABILITY_RELIABLE, DDS_INFINITY);
+
+  *pub = dds_create_publisher (pp_wr, NULL, NULL);
+  CU_ASSERT_FATAL (*pub > 0);
+  *sub = dds_create_subscriber (pp_rd, NULL, NULL);
+  CU_ASSERT_FATAL (*sub > 0);
+  *pub_tp = dds_create_topic (pp_wr, &SecurityCoreTests_Type1_desc, topic_name, NULL, NULL);
+  CU_ASSERT_FATAL (*pub_tp > 0);
+  *sub_tp = dds_create_topic (pp_rd, &SecurityCoreTests_Type1_desc, topic_name, NULL, NULL);
+  CU_ASSERT_FATAL (*sub_tp > 0);
+  *wr = dds_create_writer (*pub, *pub_tp, qos, NULL);
+  CU_ASSERT_FATAL (*wr > 0);
+  dds_set_status_mask (*wr, DDS_PUBLICATION_MATCHED_STATUS);
+  *rd = dds_create_reader (*sub, *sub_tp, qos, NULL);
+  CU_ASSERT_FATAL (*rd > 0);
+  dds_set_status_mask (*rd, DDS_DATA_AVAILABLE_STATUS);
+  sync_writer_to_readers(pp_wr, *wr, 1);
+  dds_delete_qos (qos);
+}
+
+void write_read_for(dds_entity_t wr, dds_entity_t pp_rd, dds_entity_t rd, dds_duration_t dur, bool exp_write_fail, bool exp_read_fail)
+{
+  SecurityCoreTests_Type1 sample = { 1, 1 };
+  SecurityCoreTests_Type1 rd_sample;
+  void * samples[] = { &rd_sample };
+  dds_sample_info_t info[1];
+  dds_return_t ret;
+  dds_time_t tend = dds_time () + dur;
+  bool write_fail = false, read_fail = false;
+
+  do
+  {
+    if (dds_write (wr, &sample) != DDS_RETCODE_OK)
+      write_fail = true;
+
+    while (!write_fail)
+    {
+      if ((ret = dds_take (rd, samples, info, 1, 1)) > 0)
+      {
+        CU_ASSERT_EQUAL_FATAL (ret, 1);
+        break;
+      }
+      if (ret < 0 || !reader_wait_for_data (pp_rd, rd, DDS_MSECS (100)))
+      {
+        read_fail = true;
+        break;
+      }
+    }
+    dds_sleepfor (DDS_MSECS (1));
+  }
+  while (dds_time() < tend && !write_fail && !read_fail);
+  CU_ASSERT_EQUAL (write_fail, exp_write_fail);
+  CU_ASSERT_EQUAL (read_fail, exp_read_fail);
+}
diff --git a/src/security/core/tests/common/handshake_test_utils.h b/src/security/core/tests/common/test_utils.h
similarity index 65%
rename from src/security/core/tests/common/handshake_test_utils.h
rename to src/security/core/tests/common/test_utils.h
index 0ae3a59..a1c30b4 100644
--- a/src/security/core/tests/common/handshake_test_utils.h
+++ b/src/security/core/tests/common/test_utils.h
@@ -9,8 +9,8 @@
  *
  * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
  */
-#ifndef SECURITY_CORE_HANDSHAKE_TEST_UTILS_H_
-#define SECURITY_CORE_HANDSHAKE_TEST_UTILS_H_
+#ifndef SECURITY_CORE_TEST_UTILS_H_
+#define SECURITY_CORE_TEST_UTILS_H_
 
 #include "dds/dds.h"
 #include "dds/ddsrt/sync.h"
@@ -20,7 +20,6 @@
 #define MAX_LOCAL_IDENTITIES 8
 #define MAX_REMOTE_IDENTITIES 8
 #define MAX_HANDSHAKES 32
-#define TIMEOUT DDS_SECS(2)
 
 union guid {
   DDS_Security_GUID_t g;
@@ -54,5 +53,13 @@ struct Handshake
 void validate_handshake(dds_domainid_t domain_id, bool exp_localid_fail, const char * exp_localid_msg, struct Handshake *hs_list[], int *nhs);
 void validate_handshake_nofail (dds_domainid_t domain_id);
 void handshake_list_fini(struct Handshake *hs_list, int nhs);
+char *create_topic_name(const char *prefix, uint32_t nr, char *name, size_t size);
+void sync_writer_to_readers(dds_entity_t pp_wr, dds_entity_t wr, uint32_t exp_count);
+bool reader_wait_for_data(dds_entity_t pp, dds_entity_t rd, dds_duration_t dur);
+void rd_wr_init(
+    dds_entity_t pp_wr, dds_entity_t *pub, dds_entity_t *pub_tp, dds_entity_t *wr,
+    dds_entity_t pp_rd, dds_entity_t *sub, dds_entity_t *sub_tp, dds_entity_t *rd,
+    const char *topic_name);
+void write_read_for(dds_entity_t wr, dds_entity_t pp_rd, dds_entity_t rd, dds_duration_t dur, bool exp_write_fail, bool exp_read_fail);
 
-#endif /* SECURITY_CORE_HANDSHAKE_TEST_UTILS_H_ */
+#endif /* SECURITY_CORE_TEST_UTILS_H_ */
diff --git a/src/security/core/tests/handshake.c b/src/security/core/tests/handshake.c
index 62ca589..66a77f9 100644
--- a/src/security/core/tests/handshake.c
+++ b/src/security/core/tests/handshake.c
@@ -30,7 +30,7 @@
 #include "common/config_env.h"
 #include "common/authentication_wrapper.h"
 #include "common/plugin_wrapper_msg_q.h"
-#include "common/handshake_test_utils.h"
+#include "common/test_utils.h"
 #include "common/test_identity.h"
 
 static const char *config =

From e3056402fc01f7415a94f6ef87cc4f219548b51f Mon Sep 17 00:00:00 2001
From: Dennis Potman <dennis.potman@adlinktech.com>
Date: Mon, 30 Mar 2020 09:32:21 +0200
Subject: [PATCH 161/238] Implement on_revoke_identity_cb

Impement the revoke identity callback in ddsi that is called when
the identity certificate of a participant expires. In case the
identity handle that expires is from a local participant, all
proxy pp connections will be dropped for this participant. In case
the identity that expires is from a remote participant, the
corresponding proxy participant is deleted.

Signed-off-by: Dennis Potman <dennis.potman@adlinktech.com>
---
 src/core/ddsi/src/ddsi_security_omg.c    | 51 +++++++++++++++++++++---
 src/security/core/tests/authentication.c | 27 +++++++------
 2 files changed, 60 insertions(+), 18 deletions(-)

diff --git a/src/core/ddsi/src/ddsi_security_omg.c b/src/core/ddsi/src/ddsi_security_omg.c
index 7766fcd..3cf463e 100644
--- a/src/core/ddsi/src/ddsi_security_omg.c
+++ b/src/core/ddsi/src/ddsi_security_omg.c
@@ -817,7 +817,7 @@ static DDS_Security_boolean on_revoke_permissions_cb(const dds_security_access_c
   struct entidx_enum_proxy_participant eproxypp;
   struct participant *pp;
   struct proxy_participant *proxypp;
-  bool local_perm = false;
+  bool local = false;
   thread_state_awake (lookup_thread_state (), gv);
 
   /* Find participants using this permissions handle */
@@ -830,7 +830,7 @@ static DDS_Security_boolean on_revoke_permissions_cb(const dds_security_access_c
     {
       uint32_t i = 0;
       ddsrt_avl_citer_t it;
-      local_perm = true;
+      local = true;
       for (struct pp_proxypp_match *ppm = ddsrt_avl_citer_first (&pp_proxypp_treedef, &pp->sec_attr->proxy_participants, &it); ppm; ppm = ddsrt_avl_citer_next (&it), i++)
         pp_proxypp_unrelate_locked (sc, pp, &ppm->proxypp_guid);
     }
@@ -839,7 +839,7 @@ static DDS_Security_boolean on_revoke_permissions_cb(const dds_security_access_c
   entidx_enum_participant_fini (&epp);
 
   /* Find proxy participants using this permissions handle */
-  if (!local_perm)
+  if (!local)
   {
     entidx_enum_proxy_participant_init (&eproxypp, gv->entity_index);
     while ((proxypp = entidx_enum_proxy_participant_next (&eproxypp)) != NULL)
@@ -868,8 +868,49 @@ static DDS_Security_boolean on_revoke_permissions_cb(const dds_security_access_c
 
 static DDS_Security_boolean on_revoke_identity_cb(const dds_security_authentication *plugin, const DDS_Security_IdentityHandle handle)
 {
-  (void)plugin;
-  (void)handle;
+  struct ddsi_domaingv *gv = plugin->gv;
+  struct entidx_enum_participant epp;
+  struct entidx_enum_proxy_participant eproxypp;
+  struct participant *pp;
+  struct proxy_participant *proxypp;
+  bool local = false;
+  thread_state_awake (lookup_thread_state (), gv);
+
+  /* Find participants using this identity handle */
+  entidx_enum_participant_init (&epp, gv->entity_index);
+  while ((pp = entidx_enum_participant_next (&epp)) != NULL)
+  {
+    struct dds_security_context *sc = q_omg_security_get_secure_context(pp);
+    ddsrt_mutex_lock (&pp->sec_attr->lock);
+    if (pp->sec_attr->local_identity_handle == handle)
+    {
+      uint32_t i = 0;
+      ddsrt_avl_citer_t it;
+      local = true;
+      for (struct pp_proxypp_match *ppm = ddsrt_avl_citer_first (&pp_proxypp_treedef, &pp->sec_attr->proxy_participants, &it); ppm; ppm = ddsrt_avl_citer_next (&it), i++)
+        pp_proxypp_unrelate_locked (sc, pp, &ppm->proxypp_guid);
+    }
+    ddsrt_mutex_unlock (&pp->sec_attr->lock);
+  }
+  entidx_enum_participant_fini (&epp);
+
+  /* Find proxy participants using this permissions handle */
+  if (!local)
+  {
+    entidx_enum_proxy_participant_init (&eproxypp, gv->entity_index);
+    while ((proxypp = entidx_enum_proxy_participant_next (&eproxypp)) != NULL)
+    {
+      bool del_pp;
+      ddsrt_mutex_lock (&proxypp->sec_attr->lock);
+      del_pp = proxypp->sec_attr->remote_identity_handle == handle;
+      ddsrt_mutex_unlock (&proxypp->sec_attr->lock);
+      if (del_pp)
+        delete_proxy_participant_by_guid (gv, &proxypp->e.guid, ddsrt_time_wallclock (), false);
+    }
+    entidx_enum_proxy_participant_fini (&eproxypp);
+  }
+
+  thread_state_asleep (lookup_thread_state ());
   return true;
 }
 
diff --git a/src/security/core/tests/authentication.c b/src/security/core/tests/authentication.c
index 1e53a8f..ab12143 100644
--- a/src/security/core/tests/authentication.c
+++ b/src/security/core/tests/authentication.c
@@ -262,7 +262,8 @@ CU_Theory((const char * ca_dir, bool exp_fail), ddssec_authentication, trusted_c
   authentication_fini (!exp_fail, !exp_fail);
 }
 
-#define M(n) ((n)*60)
+#define S(n) (n)
+#define M(n) (S(n)*60)
 #define H(n) (M(n)*60)
 #define D(n) (H(n)*24)
 CU_TheoryDataPoints(ddssec_authentication, expired_cert) = {
@@ -274,18 +275,18 @@ CU_TheoryDataPoints(ddssec_authentication, expired_cert) = {
     /*                       |      |      |      |     */"ca and id1 1min valid",
     /*                       |      |      |      |      |     */"id1 and id2 1s valid, delay 1100ms",
     /*                       |      |      |      |      |      |     */"id1 valid after 1s, delay 1100ms",
-    /*                       |      |      |      |      |      |      |    *//*"ca and id1 expire during session"*/),
-    CU_DataPoints(int32_t,   0,     -M(1), 0,     0,     0,     0,     0,     /*0*/     ),   /* CA1 not before */
-    CU_DataPoints(int32_t,   D(1),  0,     D(1),  D(1),  M(1),  D(1),  D(1),  /*2*/     ),  /* CA1 not after (offset from local time) */
-    CU_DataPoints(int32_t,   0,     0,     -D(1), 0,     0,     0,     1,     /*0*/     ),  /* ID1 not before (offset from local time) */
-    CU_DataPoints(int32_t,   D(1),  D(1),  0,     D(1),  M(1),  1,     D(1),  /*2*/     ),  /* ID1 not after (offset from local time) */
-    CU_DataPoints(bool,      false, true,  true,  false, false, true,  false, /*false*/ ),  /* expect validate local ID1 fail */
-    CU_DataPoints(int32_t,   0,     0,     0,     -D(1), 0,     0,     0,     /*0*/     ),  /* ID2 not before (offset from local time) */
-    CU_DataPoints(int32_t,   D(1),  D(1),  D(1),  0,     D(1),  1,     D(1),  /*D(1)*/  ),  /* ID2 not after (offset from local time) */
-    CU_DataPoints(bool,      false, true,  false, true,  false, true,  false, /*false*/ ),  /* expect validate local ID2 fail */
-    CU_DataPoints(uint32_t,  0,     0,     0,     0,     0,     1100,  1100,  /*0*/     ),  /* delay (ms) after generating certificate */
-    CU_DataPoints(uint32_t,  1,     0,     0,     0,     1,     0,     1,     /*3500*/  ),  /* write/read data during x ms */
-    CU_DataPoints(bool,      false, false, false, false, false, false, false, /*true*/  ),  /* expect read data failure */
+    /*                       |      |      |      |      |      |      |     */"id1 expire during session"),
+    CU_DataPoints(int32_t,   0,     -M(1), 0,     0,     0,     0,     0,     0     ),  /* CA1 not before */
+    CU_DataPoints(int32_t,   D(1),  0,     D(1),  D(1),  M(1),  D(1),  D(1),  D(1)  ),  /* CA1 not after (offset from local time) */
+    CU_DataPoints(int32_t,   0,     0,     -D(1), 0,     0,     0,     S(1),  0     ),  /* ID1 not before (offset from local time) */
+    CU_DataPoints(int32_t,   D(1),  D(1),  0,     D(1),  M(1),  S(1),  D(1),  S(2)  ),  /* ID1 not after (offset from local time) */
+    CU_DataPoints(bool,      false, true,  true,  false, false, true,  false, false ),  /* expect validate local ID1 fail */
+    CU_DataPoints(int32_t,   0,     0,     0,     -D(1), 0,     0,     0,     0     ),  /* ID2 not before (offset from local time) */
+    CU_DataPoints(int32_t,   D(1),  D(1),  D(1),  0,     D(1),  S(1),  D(1),  D(1)  ),  /* ID2 not after (offset from local time) */
+    CU_DataPoints(bool,      false, true,  false, true,  false, true,  false, false ),  /* expect validate local ID2 fail */
+    CU_DataPoints(uint32_t,  0,     0,     0,     0,     0,     1100,  1100,  0     ),  /* delay (ms) after generating certificate */
+    CU_DataPoints(uint32_t,  1,     0,     0,     0,     1,     0,     1,     3500  ),  /* write/read data during x ms */
+    CU_DataPoints(bool,      false, false, false, false, false, false, false, true  ),  /* expect read data failure */
 };
 CU_Theory(
   (const char * test_descr, int32_t ca_not_before, int32_t ca_not_after,

From 5e721c99e5894bae869f726b0fc763e3cacefb35 Mon Sep 17 00:00:00 2001
From: Dennis Potman <dennis.potman@adlinktech.com>
Date: Mon, 30 Mar 2020 14:23:18 +0200
Subject: [PATCH 162/238] Change test timing and time-outs in access-control
 and authentication expiry tests and add timestamps to test logging to get
 more stable test results on Travis and enable analysing timeing issues.

Signed-off-by: Dennis Potman <dennis.potman@adlinktech.com>
---
 src/security/core/tests/access_control.c    |  96 +++++++-------
 src/security/core/tests/authentication.c    |  13 +-
 src/security/core/tests/common/test_utils.c | 140 +++++++++++---------
 src/security/core/tests/common/test_utils.h |   1 +
 4 files changed, 140 insertions(+), 110 deletions(-)

diff --git a/src/security/core/tests/access_control.c b/src/security/core/tests/access_control.c
index 508828c..981a196 100644
--- a/src/security/core/tests/access_control.c
+++ b/src/security/core/tests/access_control.c
@@ -148,7 +148,7 @@ CU_TheoryDataPoints(ddssec_access_control, config_parameters_file) = {
 CU_Theory((const char * test_descr, const char * gov, const char * perm, const char * ca, bool incl_empty_els, bool exp_fail),
     ddssec_access_control, config_parameters_file)
 {
-  printf("running test config_parameters_file: %s\n", test_descr);
+  print_test_msg ("running test config_parameters_file: %s\n", test_descr);
   access_control_init (
       (const char *[]) { TEST_IDENTITY1_CERTIFICATE, TEST_IDENTITY1_CERTIFICATE },
       (const char *[]) { TEST_IDENTITY1_PRIVATE_KEY, TEST_IDENTITY1_PRIVATE_KEY },
@@ -170,29 +170,28 @@ CU_TheoryDataPoints(ddssec_access_control, permissions_expiry) = {
     /*                       |     */"valid -1 minute until now",
     /*                       |      |     */"1s valid, create pp after 1100ms",
     /*                       |      |      |      */"node 2 permissions expired",
-    /*                       |      |      |      |     */"node 1 3s valid, write/read for 1s delayed 3s",
-    /*                       |      |      |      |      |     */"node 2 3s valid, write/read for 1s delayed 3s"),
+    /*                       |      |      |      |     */"node 1 3s valid, write/read for 10s",
+    /*                       |      |      |      |      |     */"node 2 3s valid, write/read for 10s"),
     CU_DataPoints(int32_t,   0,     -M(1), 0,     0,     0,     0),     /* node 1 permissions not before (offset from local time) */
-    CU_DataPoints(int32_t,   M(1),  0,     S(1),  D(1),  S(3),  D(1)),  /* node 1 permissions not after (offset from local time) */
+    CU_DataPoints(int32_t,   M(1),  0,     S(1),  D(1),  S(4),  D(1)),  /* node 1 permissions not after (offset from local time) */
     CU_DataPoints(int32_t,   0,     -M(1), 0,     -D(1), 0,     0),     /* node 2 permissions not before (offset from local time) */
-    CU_DataPoints(int32_t,   M(1),  0,     S(1),  0,     D(1),  S(3)),  /* node 2 permissions not after (offset from local time) */
+    CU_DataPoints(int32_t,   M(1),  0,     S(1),  0,     D(1),  S(4)),  /* node 2 permissions not after (offset from local time) */
     CU_DataPoints(uint32_t,  0,     0,     1100,  0,     0,     0),     /* delay (ms) after generating permissions */
     CU_DataPoints(bool,      false, true,  true,  false, false, false), /* expect pp 1 create failure */
     CU_DataPoints(bool,      false, true,  true,  true,  false, false), /* expect pp 2 create failure */
-    CU_DataPoints(uint32_t,  0,     0,     0,     0,     3000,  3000),  /* delay (ms) after creating readers/writers */
-    CU_DataPoints(uint32_t,  1,     0,     0,     0,     1000,  1000),  /* write/read data during x ms */
+    CU_DataPoints(uint32_t,  1,     0,     0,     0,     10000, 10000),  /* write/read data during x ms */
     CU_DataPoints(bool,      false, false, false, false, true,  true),  /* expect read data failure */
 };
 CU_Theory(
   (const char * test_descr,
     int32_t perm1_not_before, int32_t perm1_not_after, int32_t perm2_not_before, int32_t perm2_not_after,
-    uint32_t delay_perm, bool exp_pp1_fail, bool exp_pp2_fail, uint32_t delay_wr_rd, uint32_t write_read_dur, bool exp_read_fail),
+    uint32_t delay_perm, bool exp_pp1_fail, bool exp_pp2_fail, uint32_t write_read_dur, bool exp_read_fail),
   ddssec_access_control, permissions_expiry, .timeout=20)
 {
-  printf("running test permissions_expiry: %s\n", test_descr);
+  print_test_msg ("running test permissions_expiry: %s\n", test_descr);
 
   char topic_name[100];
-  create_topic_name("ddssec_access_control_", g_topic_nr++, topic_name, sizeof (topic_name));
+  create_topic_name ("ddssec_access_control_", g_topic_nr++, topic_name, sizeof (topic_name));
 
   /* create ca and id1/id2 certs that will not expire during this test */
   char *ca, *id1, *id2, *id1_subj, *id2_subj;
@@ -202,7 +201,7 @@ CU_Theory(
 
   /* localtime will be converted to gmtime in get_permissions_grant */
   dds_time_t now = dds_time ();
-  char * perm_topic = get_permissions_topic(topic_name);
+  char * perm_topic = get_permissions_topic (topic_name);
   char * grants[] = {
     get_permissions_grant ("id1", id1_subj, now + DDS_SECS(perm1_not_before), now + DDS_SECS(perm1_not_after), perm_topic, perm_topic, NULL),
     get_permissions_grant ("id2", id2_subj, now + DDS_SECS(perm2_not_before), now + DDS_SECS(perm2_not_after), perm_topic, perm_topic, NULL) };
@@ -222,7 +221,6 @@ CU_Theory(
   {
     dds_entity_t wr = 0, rd = 0;
     rd_wr_init (g_participant[0], &g_pubsub[0], &g_topic[0], &wr, g_participant[1], &g_pubsub[1], &g_topic[1], &rd, topic_name);
-    dds_sleepfor (DDS_MSECS (delay_wr_rd));
     write_read_for (wr, g_participant[1], rd, DDS_MSECS (write_read_dur), false, exp_read_fail);
   }
 
@@ -243,12 +241,14 @@ CU_Theory(
 #undef M
 
 
-#define N_NODES 4
+#define N_RD 1 // N_RD > 1 not yet implemented
+#define N_WR 3
+#define N_NODES (N_RD + N_WR)
 #define PERM_EXP_BASE 3
 CU_Test(ddssec_access_control, permissions_expiry_multiple, .timeout=20)
 {
   char topic_name[100];
-  create_topic_name("ddssec_access_control_", g_topic_nr++, topic_name, sizeof (topic_name));
+  create_topic_name ("ddssec_access_control_", g_topic_nr++, topic_name, sizeof (topic_name));
 
   dds_time_t t_perm = dds_time ();
   char *ca = generate_ca ("ca1", TEST_IDENTITY_CA1_PRIVATE_KEY, 0, 3600);
@@ -266,7 +266,7 @@ CU_Test(ddssec_access_control, permissions_expiry_multiple, .timeout=20)
     ca_list[i] = ca;
     id[i] = generate_identity (ca_list[i], TEST_IDENTITY_CA1_PRIVATE_KEY, id_name, pk[i], 0, 3600, &id_subj[i]);
     exp_fail[i] = false;
-    dds_duration_t v = DDS_SECS(i == 0 ? 3600 : PERM_EXP_BASE + i); /* 1st node is reader and should not expire */
+    dds_duration_t v = DDS_SECS(i < N_RD ? 3600 : PERM_EXP_BASE + 2 * i); /* 1st node is reader and should not expire */
     grants[i] = get_permissions_grant (id_name, id_subj[i], t_perm, t_perm + v, perm_topic, perm_topic, NULL);
     ddsrt_free (id_name);
   }
@@ -274,34 +274,39 @@ CU_Test(ddssec_access_control, permissions_expiry_multiple, .timeout=20)
   char * perm_config = get_permissions_config (grants, N_NODES, true);
   access_control_init (
       id, pk, ca_list, exp_fail, N_NODES,
-      true, PF_F COMMON_ETC_PATH("default_governance.p7s"),
+      true, PF_F COMMON_ETC_PATH ("default_governance.p7s"),
       true, perm_config,
-      true, PF_F COMMON_ETC_PATH("default_permissions_ca.pem"));
+      true, PF_F COMMON_ETC_PATH ("default_permissions_ca.pem"));
 
   dds_qos_t * qos = dds_create_qos ();
   CU_ASSERT_FATAL (qos != NULL);
   dds_qset_history (qos, DDS_HISTORY_KEEP_ALL, -1);
   dds_qset_durability (qos, DDS_DURABILITY_TRANSIENT_LOCAL);
   dds_qset_reliability (qos, DDS_RELIABILITY_RELIABLE, DDS_INFINITY);
-  dds_entity_t sub_tp = dds_create_topic (g_participant[0], &SecurityCoreTests_Type1_desc, topic_name, NULL, NULL);
-  CU_ASSERT_FATAL (sub_tp > 0);
-  dds_entity_t sub = dds_create_subscriber (g_participant[0], NULL, NULL);
-  CU_ASSERT_FATAL (sub > 0);
-  dds_entity_t rd = dds_create_reader (sub, sub_tp, qos, NULL);
-  CU_ASSERT_FATAL (rd > 0);
-  dds_set_status_mask (rd, DDS_DATA_AVAILABLE_STATUS);
 
-  dds_entity_t wr[N_NODES - 1];
-  for (int i = 1; i < N_NODES; i++)
+  dds_entity_t rd[N_RD];
+  for (int i = 0; i < N_RD; i++)
   {
-    dds_entity_t pub = dds_create_publisher (g_participant[i], NULL, NULL);
+    dds_entity_t sub = dds_create_subscriber (g_participant[i], NULL, NULL);
+    CU_ASSERT_FATAL (sub > 0);
+    dds_entity_t sub_tp = dds_create_topic (g_participant[i], &SecurityCoreTests_Type1_desc, topic_name, NULL, NULL);
+    CU_ASSERT_FATAL (sub_tp > 0);
+    rd[i] = dds_create_reader (sub, sub_tp, qos, NULL);
+    CU_ASSERT_FATAL (rd[i] > 0);
+    dds_set_status_mask (rd[i], DDS_DATA_AVAILABLE_STATUS);
+  }
+
+  dds_entity_t wr[N_WR];
+  for (int i = 0; i < N_WR; i++)
+  {
+    dds_entity_t pub = dds_create_publisher (g_participant[i + N_RD], NULL, NULL);
     CU_ASSERT_FATAL (pub > 0);
-    dds_entity_t pub_tp = dds_create_topic (g_participant[i], &SecurityCoreTests_Type1_desc, topic_name, NULL, NULL);
+    dds_entity_t pub_tp = dds_create_topic (g_participant[i + N_RD], &SecurityCoreTests_Type1_desc, topic_name, NULL, NULL);
     CU_ASSERT_FATAL (pub_tp > 0);
-    wr[i - 1] = dds_create_writer (pub, pub_tp, qos, NULL);
-    CU_ASSERT_FATAL (wr[i - 1] > 0);
-    dds_set_status_mask (wr[i - 1], DDS_PUBLICATION_MATCHED_STATUS);
-    sync_writer_to_readers(g_participant[i], wr[i - 1], 1);
+    wr[i] = dds_create_writer (pub, pub_tp, qos, NULL);
+    CU_ASSERT_FATAL (wr[i] > 0);
+    dds_set_status_mask (wr[i], DDS_PUBLICATION_MATCHED_STATUS);
+    sync_writer_to_readers (g_participant[i + N_RD], wr[i], N_RD);
   }
   dds_delete_qos (qos);
 
@@ -311,47 +316,48 @@ CU_Test(ddssec_access_control, permissions_expiry_multiple, .timeout=20)
   dds_sample_info_t info[1];
   dds_return_t ret;
 
-  for (int i = 1; i < N_NODES; i++)
+  for (int i = 0; i < N_WR; i++)
   {
     // sleep until 1s before next writer pp permission expires
-    dds_duration_t delay = DDS_SECS (PERM_EXP_BASE + i - 1) - (dds_time () - t_perm);
+    dds_duration_t delay = DDS_SECS (PERM_EXP_BASE + 2 * i) - (dds_time () - t_perm);
     if (delay > 0)
       dds_sleepfor (delay);
 
-    printf ("run %d\n", i);
+    print_test_msg ("run %d\n", i);
 
-    for (int w = 1; w < N_NODES; w++)
+    for (int w = 0; w < N_WR; w++)
     {
       sample.id = w;
-      ret = dds_write (wr[w - 1], &sample);
+      ret = dds_write (wr[w], &sample);
       CU_ASSERT_EQUAL_FATAL (ret, DDS_RETCODE_OK);
-      printf ("write %d\n", w);
+      print_test_msg ("write %d\n", w);
     }
 
     // Expect reader to receive data from writers with non-expired permissions
     int n_samples = 0, n_invalid = 0, n_wait = 0;
-    while (n_samples + n_invalid < N_NODES - 1 && n_wait < 5)
+    while (n_samples + n_invalid < N_WR && n_wait < 5)
     {
-      ret = dds_take (rd, samples, info, 1, 1);
+      ret = dds_take (rd[0], samples, info, 1, 1);
       CU_ASSERT_FATAL (ret >= 0);
       if (ret == 0)
       {
-        reader_wait_for_data (g_participant[0], rd, DDS_MSECS (100));
+        reader_wait_for_data (g_participant[0], rd[0], DDS_MSECS (200));
+        print_test_msg ("wait for data\n");
         n_wait++;
       }
       else if (info[0].instance_state == DDS_IST_ALIVE)
       {
-        printf ("recv sample %d\n", rd_sample.id);
+        print_test_msg ("recv sample %d\n", rd_sample.id);
         n_samples++;
       }
       else
       {
-        printf ("recv inv sample\n");
+        print_test_msg ("recv inv sample\n");
         n_invalid++;
       }
     }
-    CU_ASSERT_EQUAL (n_samples, N_NODES - i);
-    CU_ASSERT (n_invalid < i);
+    CU_ASSERT_EQUAL (n_samples, N_WR - i);
+    CU_ASSERT (n_invalid <= i);
   }
 
   access_control_fini (N_NODES);
diff --git a/src/security/core/tests/authentication.c b/src/security/core/tests/authentication.c
index ab12143..7a9a21a 100644
--- a/src/security/core/tests/authentication.c
+++ b/src/security/core/tests/authentication.c
@@ -228,7 +228,7 @@ CU_Theory((const char * test_descr, const char * id2, const char *key2, const ch
 {
   struct Handshake *hs_list;
   int nhs;
-  printf("running test id_ca_certs: %s\n", test_descr);
+  print_test_msg ("running test id_ca_certs: %s\n", test_descr);
   authentication_init (ID1, ID1K, CA1, id2, key2, ca2, NULL, NULL, exp_fail_pp1, exp_fail_pp2);
 
   // Domain 1
@@ -252,7 +252,7 @@ CU_TheoryDataPoints(ddssec_authentication, trusted_ca_dir) = {
 };
 CU_Theory((const char * ca_dir, bool exp_fail), ddssec_authentication, trusted_ca_dir)
 {
-  printf("Testing custom CA dir: %s\n", ca_dir);
+  print_test_msg ("Testing custom CA dir: %s\n", ca_dir);
   authentication_init (ID1, ID1K, CA1, ID1, ID1K, CA1, ca_dir, NULL, exp_fail, exp_fail);
   if (!exp_fail)
   {
@@ -275,17 +275,17 @@ CU_TheoryDataPoints(ddssec_authentication, expired_cert) = {
     /*                       |      |      |      |     */"ca and id1 1min valid",
     /*                       |      |      |      |      |     */"id1 and id2 1s valid, delay 1100ms",
     /*                       |      |      |      |      |      |     */"id1 valid after 1s, delay 1100ms",
-    /*                       |      |      |      |      |      |      |     */"id1 expire during session"),
+    /*                       |      |      |      |      |      |      |     */"id1 expires during session"),
     CU_DataPoints(int32_t,   0,     -M(1), 0,     0,     0,     0,     0,     0     ),  /* CA1 not before */
     CU_DataPoints(int32_t,   D(1),  0,     D(1),  D(1),  M(1),  D(1),  D(1),  D(1)  ),  /* CA1 not after (offset from local time) */
     CU_DataPoints(int32_t,   0,     0,     -D(1), 0,     0,     0,     S(1),  0     ),  /* ID1 not before (offset from local time) */
-    CU_DataPoints(int32_t,   D(1),  D(1),  0,     D(1),  M(1),  S(1),  D(1),  S(2)  ),  /* ID1 not after (offset from local time) */
+    CU_DataPoints(int32_t,   D(1),  D(1),  0,     D(1),  M(1),  S(1),  D(1),  S(4)  ),  /* ID1 not after (offset from local time) */
     CU_DataPoints(bool,      false, true,  true,  false, false, true,  false, false ),  /* expect validate local ID1 fail */
     CU_DataPoints(int32_t,   0,     0,     0,     -D(1), 0,     0,     0,     0     ),  /* ID2 not before (offset from local time) */
     CU_DataPoints(int32_t,   D(1),  D(1),  D(1),  0,     D(1),  S(1),  D(1),  D(1)  ),  /* ID2 not after (offset from local time) */
     CU_DataPoints(bool,      false, true,  false, true,  false, true,  false, false ),  /* expect validate local ID2 fail */
     CU_DataPoints(uint32_t,  0,     0,     0,     0,     0,     1100,  1100,  0     ),  /* delay (ms) after generating certificate */
-    CU_DataPoints(uint32_t,  1,     0,     0,     0,     1,     0,     1,     3500  ),  /* write/read data during x ms */
+    CU_DataPoints(uint32_t,  1,     0,     0,     0,     1,     0,     1,     10000 ),  /* write/read data during x ms */
     CU_DataPoints(bool,      false, false, false, false, false, false, false, true  ),  /* expect read data failure */
 };
 CU_Theory(
@@ -295,11 +295,12 @@ CU_Theory(
     uint32_t delay, uint32_t write_read_dur, bool exp_read_fail),
   ddssec_authentication, expired_cert, .timeout=30)
 {
-  printf("running test expired_cert: %s\n", test_descr);
+  print_test_msg ("running test expired_cert: %s\n", test_descr);
 
   char topic_name[100];
   create_topic_name("ddssec_authentication_", g_topic_nr++, topic_name, sizeof (topic_name));
 
+  print_test_msg ("generate ids (id1: %d-%d, id2: %d-%d):\n", id1_not_before, id1_not_after, id2_not_before, id2_not_after);
   char *ca, *id1, *id2, *id1_subj, *id2_subj;
   ca = generate_ca ("ca1", CA1K, ca_not_before, ca_not_after);
   id1 = generate_identity (ca, CA1K, "id1", ID1K, id1_not_before, id1_not_after, &id1_subj);
diff --git a/src/security/core/tests/common/test_utils.c b/src/security/core/tests/common/test_utils.c
index 476490c..bf8c300 100644
--- a/src/security/core/tests/common/test_utils.c
+++ b/src/security/core/tests/common/test_utils.c
@@ -34,7 +34,7 @@ int numRemote = 0;
 struct Handshake handshakeList[MAX_HANDSHAKES];
 int numHandshake = 0;
 
-static char * get_validation_result_str(DDS_Security_ValidationResult_t result)
+static char * get_validation_result_str (DDS_Security_ValidationResult_t result)
 {
   switch (result)
   {
@@ -49,7 +49,7 @@ static char * get_validation_result_str(DDS_Security_ValidationResult_t result)
   return "";
 }
 
-static char * get_node_type_str(enum hs_node_type node_type)
+static char * get_node_type_str (enum hs_node_type node_type)
 {
   switch (node_type)
   {
@@ -61,17 +61,27 @@ static char * get_node_type_str(enum hs_node_type node_type)
   return "";
 }
 
-static void add_local_identity(DDS_Security_IdentityHandle handle, DDS_Security_GUID_t *guid)
+void print_test_msg (const char *msg, ...)
 {
-  printf("add local identity %"PRId64"\n", handle);
+  va_list args;
+  dds_time_t t = dds_time ();
+  printf ("%d.%06d ", (int32_t) (t / DDS_NSECS_IN_SEC), (int32_t) (t % DDS_NSECS_IN_SEC) / 1000);
+  va_start (args, msg);
+  vprintf (msg, args);
+  va_end (args);
+}
+
+static void add_local_identity (DDS_Security_IdentityHandle handle, DDS_Security_GUID_t *guid)
+{
+  print_test_msg ("add local identity %"PRId64"\n", handle);
   localIdentityList[numLocal].handle = handle;
-  memcpy(&localIdentityList[numLocal].guid, guid, sizeof(DDS_Security_GUID_t));
+  memcpy (&localIdentityList[numLocal].guid, guid, sizeof(DDS_Security_GUID_t));
   numLocal++;
 }
 
-static int find_local_identity(DDS_Security_IdentityHandle handle)
+static int find_local_identity (DDS_Security_IdentityHandle handle)
 {
-  for (int i = 0; i < (int)numLocal; i++)
+  for (int i = 0; i < (int) numLocal; i++)
   {
     if (localIdentityList[i].handle == handle)
       return i;
@@ -79,7 +89,7 @@ static int find_local_identity(DDS_Security_IdentityHandle handle)
   return -1;
 }
 
-static int find_remote_identity(DDS_Security_IdentityHandle handle)
+static int find_remote_identity (DDS_Security_IdentityHandle handle)
 {
   for (int i = 0; i < numRemote; i++)
   {
@@ -89,13 +99,13 @@ static int find_remote_identity(DDS_Security_IdentityHandle handle)
   return -1;
 }
 
-static void add_remote_identity(DDS_Security_IdentityHandle handle, DDS_Security_GUID_t *guid)
+static void add_remote_identity (DDS_Security_IdentityHandle handle, DDS_Security_GUID_t *guid)
 {
-  if (find_remote_identity(handle) < 0)
+  if (find_remote_identity (handle) < 0)
   {
-    printf("add remote identity %"PRId64"\n", handle);
+    print_test_msg ("add remote identity %"PRId64"\n", handle);
     remoteIdentityList[numRemote].handle = handle;
-    memcpy(&remoteIdentityList[numRemote].guid, guid, sizeof(DDS_Security_GUID_t));
+    memcpy (&remoteIdentityList[numRemote].guid, guid, sizeof(DDS_Security_GUID_t));
     numRemote++;
   }
 }
@@ -107,21 +117,21 @@ static void clear_stores(void)
   numHandshake = 0;
 }
 
-static struct Handshake *add_handshake(enum hs_node_type node_type, DDS_Security_IdentityHandle lHandle, DDS_Security_IdentityHandle rHandle)
+static struct Handshake *add_handshake (enum hs_node_type node_type, DDS_Security_IdentityHandle lHandle, DDS_Security_IdentityHandle rHandle)
 {
-  printf("add handshake %"PRId64"-%"PRId64"\n", lHandle, rHandle);
+  print_test_msg ("add handshake %"PRId64"-%"PRId64"\n", lHandle, rHandle);
   handshakeList[numHandshake].handle = -1;
   handshakeList[numHandshake].node_type = node_type;
   handshakeList[numHandshake].handshakeResult = DDS_SECURITY_VALIDATION_FAILED;
-  handshakeList[numHandshake].lidx = find_local_identity(lHandle);
-  handshakeList[numHandshake].ridx = find_remote_identity(rHandle);
+  handshakeList[numHandshake].lidx = find_local_identity (lHandle);
+  handshakeList[numHandshake].ridx = find_remote_identity (rHandle);
   handshakeList[numHandshake].finalResult = DDS_SECURITY_VALIDATION_FAILED;
   handshakeList[numHandshake].err_msg = NULL;
   numHandshake++;
   return &handshakeList[numHandshake - 1];
 }
 
-static int find_handshake(DDS_Security_HandshakeHandle handle)
+static int find_handshake (DDS_Security_HandshakeHandle handle)
 {
   for (int i = 0; i < numHandshake; i++)
   {
@@ -131,123 +141,123 @@ static int find_handshake(DDS_Security_HandshakeHandle handle)
   return -1;
 }
 
-static void handle_process_message(dds_domainid_t domain_id, DDS_Security_IdentityHandle handshake)
+static void handle_process_message (dds_domainid_t domain_id, DDS_Security_IdentityHandle handshake)
 {
   struct message *msg;
-  if ((msg = test_authentication_plugin_take_msg(domain_id, MESSAGE_KIND_PROCESS_HANDSHAKE, 0, 0, handshake, HS_TIMEOUT)))
+  if ((msg = test_authentication_plugin_take_msg (domain_id, MESSAGE_KIND_PROCESS_HANDSHAKE, 0, 0, handshake, HS_TIMEOUT)))
   {
     int idx;
-    if ((idx = find_handshake(msg->hsHandle)) >= 0)
+    if ((idx = find_handshake (msg->hsHandle)) >= 0)
     {
-      printf("set handshake %"PRId64" final result to '%s' (errmsg: %s)\n", msg->hsHandle, get_validation_result_str(msg->result), msg->err_msg);
+      print_test_msg ("set handshake %"PRId64" final result to '%s' (errmsg: %s)\n", msg->hsHandle, get_validation_result_str (msg->result), msg->err_msg);
       handshakeList[idx].finalResult = msg->result;
       handshakeList[idx].err_msg = ddsrt_strdup (msg->err_msg);
     }
-    test_authentication_plugin_release_msg(msg);
+    test_authentication_plugin_release_msg (msg);
   }
 }
 
-static void handle_begin_handshake_request(dds_domainid_t domain_id, struct Handshake *hs, DDS_Security_IdentityHandle lid, DDS_Security_IdentityHandle rid)
+static void handle_begin_handshake_request (dds_domainid_t domain_id, struct Handshake *hs, DDS_Security_IdentityHandle lid, DDS_Security_IdentityHandle rid)
 {
   struct message *msg;
-  printf("handle begin handshake request %"PRId64"<->%"PRId64"\n", lid, rid);
-  if ((msg = test_authentication_plugin_take_msg(domain_id, MESSAGE_KIND_BEGIN_HANDSHAKE_REQUEST, lid, rid, 0, HS_TIMEOUT)))
+  print_test_msg ("handle begin handshake request %"PRId64"<->%"PRId64"\n", lid, rid);
+  if ((msg = test_authentication_plugin_take_msg (domain_id, MESSAGE_KIND_BEGIN_HANDSHAKE_REQUEST, lid, rid, 0, HS_TIMEOUT)))
   {
     hs->handle = msg->hsHandle;
     hs->handshakeResult = msg->result;
     if (msg->result != DDS_SECURITY_VALIDATION_FAILED)
-      handle_process_message(domain_id, msg->hsHandle);
+      handle_process_message (domain_id, msg->hsHandle);
     else
       hs->err_msg = ddsrt_strdup (msg->err_msg);
-    test_authentication_plugin_release_msg(msg);
+    test_authentication_plugin_release_msg (msg);
   }
 }
 
-static void handle_begin_handshake_reply(dds_domainid_t domain_id, struct Handshake *hs, DDS_Security_IdentityHandle lid, DDS_Security_IdentityHandle rid)
+static void handle_begin_handshake_reply (dds_domainid_t domain_id, struct Handshake *hs, DDS_Security_IdentityHandle lid, DDS_Security_IdentityHandle rid)
 {
   struct message *msg;
-  printf("handle begin handshake reply %"PRId64"<->%"PRId64"\n", lid, rid);
-  if ((msg = test_authentication_plugin_take_msg(domain_id, MESSAGE_KIND_BEGIN_HANDSHAKE_REPLY, lid, rid, 0, HS_TIMEOUT)))
+  print_test_msg ("handle begin handshake reply %"PRId64"<->%"PRId64"\n", lid, rid);
+  if ((msg = test_authentication_plugin_take_msg (domain_id, MESSAGE_KIND_BEGIN_HANDSHAKE_REPLY, lid, rid, 0, HS_TIMEOUT)))
   {
     hs->handle = msg->hsHandle;
     hs->handshakeResult = msg->result;
     if (msg->result != DDS_SECURITY_VALIDATION_FAILED)
-      handle_process_message(domain_id, msg->hsHandle);
+      handle_process_message (domain_id, msg->hsHandle);
     else
       hs->err_msg = ddsrt_strdup (msg->err_msg);
-    test_authentication_plugin_release_msg(msg);
+    test_authentication_plugin_release_msg (msg);
   }
 }
 
-static void handle_validate_remote_identity(dds_domainid_t domain_id, DDS_Security_IdentityHandle lid, int count)
+static void handle_validate_remote_identity (dds_domainid_t domain_id, DDS_Security_IdentityHandle lid, int count)
 {
   struct message *msg;
-  while (count-- > 0 && (msg = test_authentication_plugin_take_msg(domain_id, MESSAGE_KIND_VALIDATE_REMOTE_IDENTITY, lid, 0, 0, HS_TIMEOUT)))
+  while (count-- > 0 && (msg = test_authentication_plugin_take_msg (domain_id, MESSAGE_KIND_VALIDATE_REMOTE_IDENTITY, lid, 0, 0, HS_TIMEOUT)))
   {
     struct Handshake *hs;
-    add_remote_identity(msg->ridHandle, &msg->rguid);
-    hs = add_handshake(HSN_UNDEFINED, lid, msg->ridHandle);
+    add_remote_identity (msg->ridHandle, &msg->rguid);
+    hs = add_handshake (HSN_UNDEFINED, lid, msg->ridHandle);
     if (msg->result == DDS_SECURITY_VALIDATION_PENDING_HANDSHAKE_REQUEST)
     {
       hs->node_type = HSN_REQUESTER;
-      handle_begin_handshake_request(domain_id, hs, lid, msg->ridHandle);
+      handle_begin_handshake_request (domain_id, hs, lid, msg->ridHandle);
     }
     else if (msg->result == DDS_SECURITY_VALIDATION_PENDING_HANDSHAKE_MESSAGE)
     {
       hs->node_type = HSN_REPLIER;
-      handle_begin_handshake_reply(domain_id, hs, lid, msg->ridHandle);
+      handle_begin_handshake_reply (domain_id, hs, lid, msg->ridHandle);
     }
     else
     {
-      printf("validate remote failed\n");
+      print_test_msg ("validate remote failed\n");
     }
-    test_authentication_plugin_release_msg(msg);
+    test_authentication_plugin_release_msg (msg);
   }
 }
 
-static void handle_validate_local_identity(dds_domainid_t domain_id, bool exp_localid_fail, const char * exp_localid_msg)
+static void handle_validate_local_identity (dds_domainid_t domain_id, bool exp_localid_fail, const char * exp_localid_msg)
 {
  struct message *msg = test_authentication_plugin_take_msg (domain_id, MESSAGE_KIND_VALIDATE_LOCAL_IDENTITY, 0, 0, 0, HS_TIMEOUT);
   CU_ASSERT_FATAL (msg != NULL);
   CU_ASSERT_FATAL ((msg->result == DDS_SECURITY_VALIDATION_OK) != exp_localid_fail);
   if (exp_localid_fail && exp_localid_msg)
   {
-    printf("validate_local_identity failed as expected (msg: %s)\n", msg->err_msg);
-    CU_ASSERT_FATAL (msg->err_msg && strstr(msg->err_msg, exp_localid_msg) != NULL);
+    print_test_msg ("validate_local_identity failed as expected (msg: %s)\n", msg->err_msg);
+    CU_ASSERT_FATAL (msg->err_msg && strstr (msg->err_msg, exp_localid_msg) != NULL);
   }
   else
     add_local_identity (msg->lidHandle, &msg->lguid);
   test_authentication_plugin_release_msg (msg);
 }
 
-void validate_handshake(dds_domainid_t domain_id, bool exp_localid_fail, const char * exp_localid_msg, struct Handshake *hs_list[], int *nhs)
+void validate_handshake (dds_domainid_t domain_id, bool exp_localid_fail, const char * exp_localid_msg, struct Handshake *hs_list[], int *nhs)
 {
-  clear_stores();
+  clear_stores ();
 
   if (nhs)
     *nhs = 0;
   if (hs_list)
     *hs_list = NULL;
 
-  handle_validate_local_identity(domain_id, exp_localid_fail, exp_localid_msg);
+  handle_validate_local_identity (domain_id, exp_localid_fail, exp_localid_msg);
   if (!exp_localid_fail)
   {
     handle_validate_remote_identity (domain_id, localIdentityList[0].handle, 1);
     for (int n = 0; n < numHandshake; n++)
     {
       struct Handshake *hs = &handshakeList[n];
-      printf("Result: hs %"PRId64", node type %s, final result %s\n", hs->handle, get_node_type_str(hs->node_type), get_validation_result_str(hs->finalResult));
+      print_test_msg ("Result: hs %"PRId64", node type %s, final result %s\n", hs->handle, get_node_type_str (hs->node_type), get_validation_result_str (hs->finalResult));
       if (hs->err_msg && strlen (hs->err_msg))
-        printf("- err_msg: %s\n", hs->err_msg);
+        print_test_msg ("- err_msg: %s\n", hs->err_msg);
     }
     if (nhs)
       *nhs = numHandshake;
     if (hs_list)
       *hs_list = handshakeList;
     else
-      handshake_list_fini(handshakeList, numHandshake);
+      handshake_list_fini (handshakeList, numHandshake);
   }
-  printf ("finished validate handshake for domain %d\n\n", domain_id);
+  print_test_msg ("finished validate handshake for domain %d\n\n", domain_id);
 }
 
 void validate_handshake_nofail (dds_domainid_t domain_id)
@@ -264,7 +274,7 @@ void validate_handshake_nofail (dds_domainid_t domain_id)
   handshake_list_fini (hs_list, nhs);
 }
 
-void handshake_list_fini(struct Handshake *hs_list, int nhs)
+void handshake_list_fini (struct Handshake *hs_list, int nhs)
 {
   for (int n = 0; n < nhs; n++)
   {
@@ -273,7 +283,7 @@ void handshake_list_fini(struct Handshake *hs_list, int nhs)
   }
 }
 
-void sync_writer_to_readers(dds_entity_t pp_wr, dds_entity_t wr, uint32_t exp_count)
+void sync_writer_to_readers (dds_entity_t pp_wr, dds_entity_t wr, uint32_t exp_count)
 {
   dds_attach_t triggered;
   dds_entity_t ws = dds_create_waitset (pp_wr);
@@ -296,7 +306,7 @@ void sync_writer_to_readers(dds_entity_t pp_wr, dds_entity_t wr, uint32_t exp_co
   CU_ASSERT_EQUAL_FATAL (pub_matched.total_count, exp_count);
 }
 
-char *create_topic_name(const char *prefix, uint32_t nr, char *name, size_t size)
+char *create_topic_name (const char *prefix, uint32_t nr, char *name, size_t size)
 {
   ddsrt_pid_t pid = ddsrt_getpid ();
   ddsrt_tid_t tid = ddsrt_gettid ();
@@ -304,7 +314,7 @@ char *create_topic_name(const char *prefix, uint32_t nr, char *name, size_t size
   return name;
 }
 
-bool reader_wait_for_data(dds_entity_t pp, dds_entity_t rd, dds_duration_t dur)
+bool reader_wait_for_data (dds_entity_t pp, dds_entity_t rd, dds_duration_t dur)
 {
   dds_attach_t triggered;
   dds_entity_t ws = dds_create_waitset (pp);
@@ -359,6 +369,7 @@ void write_read_for(dds_entity_t wr, dds_entity_t pp_rd, dds_entity_t rd, dds_du
 
   do
   {
+    print_test_msg("write\n");
     if (dds_write (wr, &sample) != DDS_RETCODE_OK)
       write_fail = true;
 
@@ -366,18 +377,29 @@ void write_read_for(dds_entity_t wr, dds_entity_t pp_rd, dds_entity_t rd, dds_du
     {
       if ((ret = dds_take (rd, samples, info, 1, 1)) > 0)
       {
+        print_test_msg ("take sample\n");
+        if (info[0].instance_state != DDS_IST_ALIVE || !info[0].valid_data)
+        {
+          print_test_msg ("invalid sample instance_state=%d valid_data=%d\n", info[0].instance_state, info[0].valid_data);
+          read_fail = true;
+        }
+        else
+          CU_ASSERT_EQUAL_FATAL (rd_sample.value, 1);
         CU_ASSERT_EQUAL_FATAL (ret, 1);
         break;
       }
-      if (ret < 0 || !reader_wait_for_data (pp_rd, rd, DDS_MSECS (100)))
+      if (ret < 0 || !reader_wait_for_data (pp_rd, rd, DDS_MSECS (1000)))
       {
+        print_test_msg ("take no sample\n");
         read_fail = true;
         break;
       }
     }
-    dds_sleepfor (DDS_MSECS (1));
+    if (write_fail || read_fail)
+      break;
+    dds_sleepfor (DDS_MSECS (100));
   }
-  while (dds_time() < tend && !write_fail && !read_fail);
-  CU_ASSERT_EQUAL (write_fail, exp_write_fail);
-  CU_ASSERT_EQUAL (read_fail, exp_read_fail);
+  while (dds_time() < tend);
+  CU_ASSERT_EQUAL_FATAL (write_fail, exp_write_fail);
+  CU_ASSERT_EQUAL_FATAL (read_fail, exp_read_fail);
 }
diff --git a/src/security/core/tests/common/test_utils.h b/src/security/core/tests/common/test_utils.h
index a1c30b4..b396f60 100644
--- a/src/security/core/tests/common/test_utils.h
+++ b/src/security/core/tests/common/test_utils.h
@@ -50,6 +50,7 @@ struct Handshake
   char * err_msg;
 };
 
+void print_test_msg (const char *msg, ...);
 void validate_handshake(dds_domainid_t domain_id, bool exp_localid_fail, const char * exp_localid_msg, struct Handshake *hs_list[], int *nhs);
 void validate_handshake_nofail (dds_domainid_t domain_id);
 void handshake_list_fini(struct Handshake *hs_list, int nhs);

From bfb48e6e585dbee98072f9731a22997b8daf2ee9 Mon Sep 17 00:00:00 2001
From: Dennis Potman <dennis.potman@adlinktech.com>
Date: Wed, 1 Apr 2020 17:05:02 +0200
Subject: [PATCH 163/238] Address issues from review: replaced
 proxypp_pp_unrelate by deleting the (proxy)participant and added a code
 comment with the rationale for this approach

Signed-off-by: Dennis Potman <dennis.potman@adlinktech.com>
---
 src/core/ddsi/src/ddsi_security_omg.c | 181 ++++++++++++++------------
 1 file changed, 96 insertions(+), 85 deletions(-)

diff --git a/src/core/ddsi/src/ddsi_security_omg.c b/src/core/ddsi/src/ddsi_security_omg.c
index 3cf463e..be0d57e 100644
--- a/src/core/ddsi/src/ddsi_security_omg.c
+++ b/src/core/ddsi/src/ddsi_security_omg.c
@@ -810,111 +810,122 @@ static void deinit_plugin_suite_config (dds_security_plugin_suite_config *suite_
   deinit_plugin_config (&suite_config->cryptography);
 }
 
+typedef bool (*expired_pp_check_fn_t)(const struct participant * pp, DDS_Security_Handle handle);
+typedef bool (*expired_proxypp_check_fn_t)(const struct proxy_participant * proxypp, DDS_Security_Handle handle);
+
+static bool delete_pp_by_handle (DDS_Security_Handle handle, expired_pp_check_fn_t expired_pp_check_fn, struct ddsi_domaingv *gv)
+{
+  struct participant *pp;
+  struct entidx_enum_participant epp;
+  bool result = false;
+  entidx_enum_participant_init (&epp, gv->entity_index);
+  while ((pp = entidx_enum_participant_next (&epp)) != NULL)
+  {
+    if (q_omg_participant_is_secure (pp) && expired_pp_check_fn (pp, handle))
+    {
+      delete_participant (gv, &pp->e.guid);
+      result = true;
+    }
+  }
+  entidx_enum_participant_fini (&epp);
+  return result;
+}
+
+static bool delete_proxypp_by_handle (const DDS_Security_Handle handle, expired_proxypp_check_fn_t expired_proxypp_check_fn, struct ddsi_domaingv *gv)
+{
+  struct proxy_participant *proxypp;
+  struct entidx_enum_proxy_participant eproxypp;
+  bool result = false;
+  entidx_enum_proxy_participant_init (&eproxypp, gv->entity_index);
+  while ((proxypp = entidx_enum_proxy_participant_next (&eproxypp)) != NULL)
+  {
+    if (q_omg_proxy_participant_is_secure(proxypp) && expired_proxypp_check_fn (proxypp, handle))
+    {
+      delete_proxy_participant_by_guid (gv, &proxypp->e.guid, ddsrt_time_wallclock (), false);
+      result = true;
+    }
+  }
+  entidx_enum_proxy_participant_fini (&eproxypp);
+  return result;
+}
+
+static bool pp_expired_by_perm (const struct participant * pp, DDS_Security_Handle handle)
+{
+  return pp->sec_attr->permissions_handle == handle;
+}
+
+static bool proxypp_expired_by_perm (const struct proxy_participant * proxypp, DDS_Security_Handle handle)
+{
+  bool result = false;
+  uint32_t i = 0;
+  ddsrt_avl_iter_t it;
+  ddsrt_mutex_lock (&proxypp->sec_attr->lock);
+  for (struct proxypp_pp_match *ppm = ddsrt_avl_iter_first (&proxypp_pp_treedef, &proxypp->sec_attr->participants, &it); ppm; ppm = ddsrt_avl_iter_next (&it), i++)
+  {
+    if (ppm->permissions_handle == handle)
+    {
+      result = true;
+      break;
+    }
+  }
+  ddsrt_mutex_unlock (&proxypp->sec_attr->lock);
+  return result;
+}
+
+static bool pp_expired_by_id (const struct participant * pp, DDS_Security_Handle handle)
+{
+  return pp->sec_attr->local_identity_handle == handle;
+}
+
+static bool proxypp_expired_by_id (const struct proxy_participant * proxypp, DDS_Security_Handle handle)
+{
+  return proxypp->sec_attr->remote_identity_handle == handle;
+}
+
+/* When a local identity (i.e. the identity of a local participant) or
+  a local permissions handle (bound to a local participant) expires,
+  the participant will be deleted. Strictly speaking, as described in the DDS
+  Security specification, the communication for this partcipant should be
+  stopped. A possible interpretation is that the participant and its
+  depending endpoints remain alive in 'expired' state and e.g. unread data
+  that was received earlier could still be retrieved by the application.
+  As we considered this as an edge case that would not be used widely,
+  the current implementation simply deletes the DDSI participant and leaves
+  the participant entity in the API in an invalid state, which could result
+  in error codes when calling API functions on these entities. This approach
+  dramatically simplifies the code for handling the revocation of permission
+  and identity handles.
+
+  For remote identity revocation, in case any of the permission handles
+  in a pp-match of a proxy participant is expired, the proxy participant
+  is deleted, as the expired permission grant for a (remote) participant
+  applies to the participant as a whole (bound to its subject of the
+  identity certificate used by the participant) */
 static DDS_Security_boolean on_revoke_permissions_cb(const dds_security_access_control *plugin, const DDS_Security_PermissionsHandle handle)
 {
   struct ddsi_domaingv *gv = plugin->gv;
-  struct entidx_enum_participant epp;
-  struct entidx_enum_proxy_participant eproxypp;
-  struct participant *pp;
-  struct proxy_participant *proxypp;
-  bool local = false;
   thread_state_awake (lookup_thread_state (), gv);
 
-  /* Find participants using this permissions handle */
-  entidx_enum_participant_init (&epp, gv->entity_index);
-  while ((pp = entidx_enum_participant_next (&epp)) != NULL)
-  {
-    struct dds_security_context *sc = q_omg_security_get_secure_context(pp);
-    ddsrt_mutex_lock (&pp->sec_attr->lock);
-    if (pp->sec_attr->permissions_handle == handle)
-    {
-      uint32_t i = 0;
-      ddsrt_avl_citer_t it;
-      local = true;
-      for (struct pp_proxypp_match *ppm = ddsrt_avl_citer_first (&pp_proxypp_treedef, &pp->sec_attr->proxy_participants, &it); ppm; ppm = ddsrt_avl_citer_next (&it), i++)
-        pp_proxypp_unrelate_locked (sc, pp, &ppm->proxypp_guid);
-    }
-    ddsrt_mutex_unlock (&pp->sec_attr->lock);
-  }
-  entidx_enum_participant_fini (&epp);
-
-  /* Find proxy participants using this permissions handle */
-  if (!local)
-  {
-    entidx_enum_proxy_participant_init (&eproxypp, gv->entity_index);
-    while ((proxypp = entidx_enum_proxy_participant_next (&eproxypp)) != NULL)
-    {
-      ddsrt_mutex_lock (&proxypp->sec_attr->lock);
-      uint32_t i = 0;
-      ddsrt_avl_iter_t it;
-      bool del_proxypp = true;
-      for (struct proxypp_pp_match *ppm = ddsrt_avl_iter_first (&proxypp_pp_treedef, &proxypp->sec_attr->participants, &it); ppm; ppm = ddsrt_avl_iter_next (&it), i++)
-      {
-        if (ppm->permissions_handle == handle)
-          proxypp_pp_unrelate_locked (proxypp->sec_attr->sc, proxypp, &ppm->pp_guid, ppm->pp_crypto_handle);
-        else
-          del_proxypp = false;
-      }
-      ddsrt_mutex_unlock (&proxypp->sec_attr->lock);
-      if (del_proxypp)
-        delete_proxy_participant_by_guid (gv, &proxypp->e.guid, ddsrt_time_wallclock (), false);
-    }
-    entidx_enum_proxy_participant_fini (&eproxypp);
-  }
+  if (!delete_pp_by_handle (handle, pp_expired_by_perm, gv))
+    delete_proxypp_by_handle (handle, proxypp_expired_by_perm, gv);
 
   thread_state_asleep (lookup_thread_state ());
   return true;
 }
 
+/* See comment above on_revoke_permissions_cb */
 static DDS_Security_boolean on_revoke_identity_cb(const dds_security_authentication *plugin, const DDS_Security_IdentityHandle handle)
 {
   struct ddsi_domaingv *gv = plugin->gv;
-  struct entidx_enum_participant epp;
-  struct entidx_enum_proxy_participant eproxypp;
-  struct participant *pp;
-  struct proxy_participant *proxypp;
-  bool local = false;
   thread_state_awake (lookup_thread_state (), gv);
 
-  /* Find participants using this identity handle */
-  entidx_enum_participant_init (&epp, gv->entity_index);
-  while ((pp = entidx_enum_participant_next (&epp)) != NULL)
-  {
-    struct dds_security_context *sc = q_omg_security_get_secure_context(pp);
-    ddsrt_mutex_lock (&pp->sec_attr->lock);
-    if (pp->sec_attr->local_identity_handle == handle)
-    {
-      uint32_t i = 0;
-      ddsrt_avl_citer_t it;
-      local = true;
-      for (struct pp_proxypp_match *ppm = ddsrt_avl_citer_first (&pp_proxypp_treedef, &pp->sec_attr->proxy_participants, &it); ppm; ppm = ddsrt_avl_citer_next (&it), i++)
-        pp_proxypp_unrelate_locked (sc, pp, &ppm->proxypp_guid);
-    }
-    ddsrt_mutex_unlock (&pp->sec_attr->lock);
-  }
-  entidx_enum_participant_fini (&epp);
-
-  /* Find proxy participants using this permissions handle */
-  if (!local)
-  {
-    entidx_enum_proxy_participant_init (&eproxypp, gv->entity_index);
-    while ((proxypp = entidx_enum_proxy_participant_next (&eproxypp)) != NULL)
-    {
-      bool del_pp;
-      ddsrt_mutex_lock (&proxypp->sec_attr->lock);
-      del_pp = proxypp->sec_attr->remote_identity_handle == handle;
-      ddsrt_mutex_unlock (&proxypp->sec_attr->lock);
-      if (del_pp)
-        delete_proxy_participant_by_guid (gv, &proxypp->e.guid, ddsrt_time_wallclock (), false);
-    }
-    entidx_enum_proxy_participant_fini (&eproxypp);
-  }
+  if (!delete_pp_by_handle (handle, pp_expired_by_id, gv))
+    delete_proxypp_by_handle (handle, proxypp_expired_by_id, gv);
 
   thread_state_asleep (lookup_thread_state ());
   return true;
 }
 
-
 dds_return_t q_omg_security_load (dds_security_context *sc, const dds_qos_t *qos, struct ddsi_domaingv *gv)
 {
   dds_security_plugin_suite_config psc;

From dae562c6028ef11c5ac6ee6b8190b9e53687ead8 Mon Sep 17 00:00:00 2001
From: Dennis Potman <dennis.potman@adlinktech.com>
Date: Wed, 1 Apr 2020 18:47:34 +0200
Subject: [PATCH 164/238] Improve delays/timing in permissions_expiry_multiple
 test

Signed-off-by: Dennis Potman <dennis.potman@adlinktech.com>
---
 src/security/core/tests/access_control.c | 22 +++++++++++++---------
 1 file changed, 13 insertions(+), 9 deletions(-)

diff --git a/src/security/core/tests/access_control.c b/src/security/core/tests/access_control.c
index 981a196..9fdf1ae 100644
--- a/src/security/core/tests/access_control.c
+++ b/src/security/core/tests/access_control.c
@@ -255,6 +255,7 @@ CU_Test(ddssec_access_control, permissions_expiry_multiple, .timeout=20)
   char *perm_topic = get_permissions_topic (topic_name);
 
   // 1st node used as reader, other nodes as writer
+  print_test_msg ("creating permissions grants\n");
   const char *id[N_NODES], *pk[N_NODES], *ca_list[N_NODES];
   char * id_subj[N_NODES], *grants[N_NODES];
   bool exp_fail[N_NODES];
@@ -266,8 +267,11 @@ CU_Test(ddssec_access_control, permissions_expiry_multiple, .timeout=20)
     ca_list[i] = ca;
     id[i] = generate_identity (ca_list[i], TEST_IDENTITY_CA1_PRIVATE_KEY, id_name, pk[i], 0, 3600, &id_subj[i]);
     exp_fail[i] = false;
-    dds_duration_t v = DDS_SECS(i < N_RD ? 3600 : PERM_EXP_BASE + 2 * i); /* 1st node is reader and should not expire */
-    grants[i] = get_permissions_grant (id_name, id_subj[i], t_perm, t_perm + v, perm_topic, perm_topic, NULL);
+    dds_duration_t v = DDS_SECS(i < N_RD ? 3600 : PERM_EXP_BASE + 2 * i); /* readers should not expire */
+    dds_time_t t_exp = ddsrt_time_add_duration (t_perm, v);
+    if (i >= N_RD)
+      print_test_msg ("w[%d] grant expires at %d.%06d\n", i - N_RD, (int32_t) (t_exp / DDS_NSECS_IN_SEC), (int32_t) (t_exp % DDS_NSECS_IN_SEC) / 1000);
+    grants[i] = get_permissions_grant (id_name, id_subj[i], t_perm, t_exp, perm_topic, perm_topic, NULL);
     ddsrt_free (id_name);
   }
 
@@ -316,16 +320,16 @@ CU_Test(ddssec_access_control, permissions_expiry_multiple, .timeout=20)
   dds_sample_info_t info[1];
   dds_return_t ret;
 
-  for (int i = 0; i < N_WR; i++)
+  for (int run = 0; run < N_WR; run++)
   {
-    // sleep until 1s before next writer pp permission expires
-    dds_duration_t delay = DDS_SECS (PERM_EXP_BASE + 2 * i) - (dds_time () - t_perm);
+    // sleep until 1s after next writer pp permission expires
+    dds_duration_t delay = DDS_SECS (PERM_EXP_BASE + 2 * run + 1) - (dds_time () - t_perm);
     if (delay > 0)
       dds_sleepfor (delay);
 
-    print_test_msg ("run %d\n", i);
+    print_test_msg ("run %d\n", run);
 
-    for (int w = 0; w < N_WR; w++)
+    for (int w = run; w < N_WR; w++)
     {
       sample.id = w;
       ret = dds_write (wr[w], &sample);
@@ -356,8 +360,8 @@ CU_Test(ddssec_access_control, permissions_expiry_multiple, .timeout=20)
         n_invalid++;
       }
     }
-    CU_ASSERT_EQUAL (n_samples, N_WR - i);
-    CU_ASSERT (n_invalid <= i);
+    CU_ASSERT_EQUAL (n_samples, N_WR - run);
+    CU_ASSERT (n_invalid <= run);
   }
 
   access_control_fini (N_NODES);

From 680c2ebf8cd1584d4bf6ae7d2dbd26b8fe8587e7 Mon Sep 17 00:00:00 2001
From: Dennis Potman <dennis.potman@adlinktech.com>
Date: Wed, 15 Apr 2020 19:37:22 +0200
Subject: [PATCH 165/238] Call delete_proxy_participant_by_guid with implicit
 flag set when revoking permission or identity

Signed-off-by: Dennis Potman <dennis.potman@adlinktech.com>
---
 src/core/ddsi/src/ddsi_security_omg.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/core/ddsi/src/ddsi_security_omg.c b/src/core/ddsi/src/ddsi_security_omg.c
index be0d57e..fce2dbf 100644
--- a/src/core/ddsi/src/ddsi_security_omg.c
+++ b/src/core/ddsi/src/ddsi_security_omg.c
@@ -841,7 +841,7 @@ static bool delete_proxypp_by_handle (const DDS_Security_Handle handle, expired_
   {
     if (q_omg_proxy_participant_is_secure(proxypp) && expired_proxypp_check_fn (proxypp, handle))
     {
-      delete_proxy_participant_by_guid (gv, &proxypp->e.guid, ddsrt_time_wallclock (), false);
+      (void) delete_proxy_participant_by_guid (gv, &proxypp->e.guid, ddsrt_time_wallclock (), true);
       result = true;
     }
   }

From c89f858b7373052f80781be1f25dd9fc070e292d Mon Sep 17 00:00:00 2001
From: Dennis Potman <dennis.potman@adlinktech.com>
Date: Wed, 15 Apr 2020 20:36:05 +0200
Subject: [PATCH 166/238] Fix memory leak that can occur when decoding rtps
 message with origin authentication being used

Signed-off-by: Dennis Potman <dennis.potman@adlinktech.com>
---
 src/core/ddsi/src/ddsi_security_omg.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/src/core/ddsi/src/ddsi_security_omg.c b/src/core/ddsi/src/ddsi_security_omg.c
index fce2dbf..aae4ebf 100644
--- a/src/core/ddsi/src/ddsi_security_omg.c
+++ b/src/core/ddsi/src/ddsi_security_omg.c
@@ -3248,7 +3248,10 @@ static bool q_omg_security_decode_rtps_message (struct proxy_participant *proxyp
     if (!sc->crypto_context->crypto_transform->decode_rtps_message (sc->crypto_context->crypto_transform, &plain_buffer, &encoded_buffer, pm->pp_crypto_handle, proxypp->sec_attr->crypto_handle, &ex))
     {
       if (ex.code == DDS_SECURITY_ERR_INVALID_CRYPTO_RECEIVER_SIGN_CODE)
+      {
+        DDS_Security_Exception_reset (&ex);
         continue; /* Could be caused by 'with_origin_authentication' being used, so try next match */
+      }
       GVTRACE ("decoding rtps message from remote participant "PGUIDFMT" failed: %s\n", PGUID (proxypp->e.guid), ex.message ? ex.message : "Unknown error");
       DDS_Security_Exception_reset (&ex);
       ddsrt_mutex_unlock (&proxypp->sec_attr->lock);

From e8dfbabd0c8a72a421cefd834462100397348e84 Mon Sep 17 00:00:00 2001
From: Dennis Potman <dennis.potman@adlinktech.com>
Date: Tue, 7 Apr 2020 21:25:12 +0200
Subject: [PATCH 167/238] Add locking when intializing remote key material

The initialization of remote participant's key material was not protected
by the remote_participant_crypto lock, which could result in using partially
initialized remote key material. This caused intermittent test failures
with assertions on key_size in crypto_cipher_decrypt_data. This commit fixes
this issue by adding locking for the remote key material.

Signed-off-by: Dennis Potman <dennis.potman@adlinktech.com>
---
 .../cryptographic/src/crypto_key_exchange.c   |  2 +-
 .../cryptographic/src/crypto_key_factory.c    | 56 +++++++++++++++----
 .../cryptographic/src/crypto_key_factory.h    |  1 +
 .../cryptographic/src/crypto_objects.c        | 55 ++++++++++++------
 .../cryptographic/src/crypto_objects.h        | 19 ++++++-
 .../cryptographic/src/crypto_transform.c      | 12 ++--
 6 files changed, 108 insertions(+), 37 deletions(-)

diff --git a/src/security/builtin_plugins/cryptographic/src/crypto_key_exchange.c b/src/security/builtin_plugins/cryptographic/src/crypto_key_exchange.c
index 59d19af..9ea8ade 100644
--- a/src/security/builtin_plugins/cryptographic/src/crypto_key_exchange.c
+++ b/src/security/builtin_plugins/cryptographic/src/crypto_key_exchange.c
@@ -179,7 +179,7 @@ create_local_participant_crypto_tokens(
   }
 
   factory = cryptography_get_crypto_key_factory(impl->crypto);
-  if (!crypto_factory_get_participant_crypto_tokens(factory, local_id, remote_id, &pp_key_material, NULL, ex))
+  if (!crypto_factory_get_participant_crypto_tokens(factory, local_id, remote_id, &pp_key_material, NULL, NULL, ex))
     goto fail_invalid_arg;
   serialize_master_key_material(pp_key_material->local_P2P_key_material, &buffer, &length);
   CRYPTO_OBJECT_RELEASE(pp_key_material);
diff --git a/src/security/builtin_plugins/cryptographic/src/crypto_key_factory.c b/src/security/builtin_plugins/cryptographic/src/crypto_key_factory.c
index ab75a63..cef6830 100644
--- a/src/security/builtin_plugins/cryptographic/src/crypto_key_factory.c
+++ b/src/security/builtin_plugins/cryptographic/src/crypto_key_factory.c
@@ -20,6 +20,7 @@
 #include "dds/ddsrt/heap.h"
 #include "dds/ddsrt/sync.h"
 #include "dds/ddsrt/types.h"
+#include "dds/ddsi/q_gc.h"
 #include "dds/security/dds_security_api.h"
 #include "dds/security/core/dds_security_utils.h"
 #include "dds/security/core/dds_security_serialize.h"
@@ -841,12 +842,14 @@ unregister_participant(
 
         if ((rmt_pp_crypto = (remote_participant_crypto *)crypto_object_table_find(implementation->crypto_objects, handles[i])) != NULL)
         {
-          if ((keymat = crypto_remote_participant_remove_keymat(rmt_pp_crypto, participant_crypto_handle)) != NULL)
+          ddsrt_mutex_lock(&rmt_pp_crypto->lock);
+          if ((keymat = crypto_remote_participant_remove_keymat_locked(rmt_pp_crypto, participant_crypto_handle)) != NULL)
           {
             if (keymat->remote_key_material && keymat->remote_key_material->receiver_specific_key_id != 0)
-              crypto_remove_specific_key_relation(rmt_pp_crypto, keymat->remote_key_material->receiver_specific_key_id);
+              crypto_remove_specific_key_relation_locked(rmt_pp_crypto, keymat->remote_key_material->receiver_specific_key_id);
             CRYPTO_OBJECT_RELEASE(keymat);
           }
+          ddsrt_mutex_unlock(&rmt_pp_crypto->lock);
           CRYPTO_OBJECT_RELEASE(rmt_pp_crypto);
         }
       }
@@ -862,12 +865,14 @@ unregister_participant(
       num = crypto_remote_participnant_get_matching(rmt_pp_crypto, &handles);
       for (i = 0; i < num; i++)
       {
-        if ((keymat = crypto_remote_participant_remove_keymat(rmt_pp_crypto, handles[i])) != NULL)
+        ddsrt_mutex_lock(&rmt_pp_crypto->lock);
+        if ((keymat = crypto_remote_participant_remove_keymat_locked(rmt_pp_crypto, handles[i])) != NULL)
         {
           if (keymat->remote_key_material && keymat->remote_key_material->receiver_specific_key_id != 0)
-            crypto_remove_specific_key_relation(rmt_pp_crypto, keymat->remote_key_material->receiver_specific_key_id);
+            crypto_remove_specific_key_relation_locked(rmt_pp_crypto, keymat->remote_key_material->receiver_specific_key_id);
           CRYPTO_OBJECT_RELEASE(keymat);
         }
+        ddsrt_mutex_unlock(&rmt_pp_crypto->lock);
 
         if ((loc_pp_crypto = (local_participant_crypto *)crypto_object_table_find(implementation->crypto_objects, handles[i])) != NULL)
         {
@@ -1063,8 +1068,8 @@ crypto_factory_get_participant_crypto_tokens(
     DDS_Security_ParticipantCryptoHandle local_id,
     DDS_Security_ParticipantCryptoHandle remote_id,
     participant_key_material **pp_key_material,
+    master_key_material **remote_key_matarial,
     DDS_Security_ProtectionKind *protection_kind,
-
     DDS_Security_SecurityException *ex)
 {
   assert (pp_key_material != NULL);
@@ -1085,14 +1090,19 @@ crypto_factory_get_participant_crypto_tokens(
     goto err_remote;
   }
 
-  if (!(*pp_key_material = (participant_key_material *)crypto_remote_participant_lookup_keymat(remote_crypto, local_id)))
+  ddsrt_mutex_lock(&remote_crypto->lock);
+  if (!(*pp_key_material = (participant_key_material *)crypto_remote_participant_lookup_keymat_locked(remote_crypto, local_id)))
   {
     DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_CODE, 0,
         DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_MESSAGE);
+    ddsrt_mutex_unlock(&remote_crypto->lock);
     goto err_remote;
   }
+  if (remote_key_matarial != NULL)
+    *remote_key_matarial = (*pp_key_material)->remote_key_material;
   if (protection_kind != NULL)
     *protection_kind = remote_crypto->rtps_protection_kind;
+  ddsrt_mutex_unlock(&remote_crypto->lock);
   result = true;
 
 err_remote:
@@ -1101,6 +1111,12 @@ err_no_remote:
   return result;
 }
 
+static void gc_remote_key_material (struct gcreq *gcreq)
+{
+  CRYPTO_OBJECT_RELEASE (gcreq->arg);
+  gcreq_free (gcreq);
+}
+
 bool
 crypto_factory_set_participant_crypto_tokens(
     const dds_security_crypto_key_factory *factory,
@@ -1128,30 +1144,46 @@ crypto_factory_set_participant_crypto_tokens(
     goto err_inv_remote;
   }
 
-  key_material = crypto_remote_participant_lookup_keymat(remote_crypto, local_id);
+  ddsrt_mutex_lock(&remote_crypto->lock);
+  key_material = crypto_remote_participant_lookup_keymat_locked(remote_crypto, local_id);
   if (key_material)
   {
-    if (!key_material->remote_key_material)
-      key_material->remote_key_material = crypto_master_key_material_new(CRYPTO_TRANSFORMATION_KIND_NONE);
-    crypto_token_copy(key_material->remote_key_material, remote_key_mat);
+    /* Because setting crypto tokens is not done very often, we're not using an
+       atomic pointer (which makes the code less readable) and do not introduce an
+       additional lock for the remote key material. Instead it is protected by the
+       remote_participant_crypto lock. For cleaning up the old remote key
+       material, the garbage collector is used so that any pointer to the remote
+       key material can be safely used until thread state sleep. */
+    master_key_material *remote_key_mat_old = key_material->remote_key_material;
+    master_key_material *remote_key_mat_new = crypto_master_key_material_new(CRYPTO_TRANSFORMATION_KIND_NONE);
+    crypto_token_copy(remote_key_mat_new, remote_key_mat);
+    key_material->remote_key_material = remote_key_mat_new;
+    if (remote_key_mat_old != NULL)
+    {
+      struct gcreq *gcreq = gcreq_new(impl->crypto->gv->gcreq_queue, gc_remote_key_material);
+      gcreq->arg = remote_key_mat_old;
+      gcreq_enqueue(gcreq);
+    }
 
     uint32_t specific_key = key_material->remote_key_material->receiver_specific_key_id;
     if (specific_key != 0)
     {
-      key_relation *relation = crypto_find_specific_key_relation(remote_crypto, specific_key);
+      key_relation *relation = crypto_find_specific_key_relation_locked(remote_crypto, specific_key);
       if (!relation)
       {
         local_participant_crypto *local_crypto = (local_participant_crypto *)crypto_object_table_find(impl->crypto_objects, local_id);
         relation = crypto_key_relation_new(0, specific_key, CRYPTO_OBJECT(local_crypto), CRYPTO_OBJECT(remote_crypto), key_material->remote_key_material);
-        crypto_insert_specific_key_relation(remote_crypto, relation);
+        crypto_insert_specific_key_relation_locked(remote_crypto, relation);
         CRYPTO_OBJECT_RELEASE(local_crypto);
       }
       CRYPTO_OBJECT_RELEASE(relation);
     }
+    ddsrt_mutex_unlock(&remote_crypto->lock);
     CRYPTO_OBJECT_RELEASE(key_material);
   }
   else
   {
+    ddsrt_mutex_unlock(&remote_crypto->lock);
     DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_CODE, 0,
         DDS_SECURITY_ERR_INVALID_CRYPTO_HANDLE_MESSAGE);
     goto err_inv_remote;
diff --git a/src/security/builtin_plugins/cryptographic/src/crypto_key_factory.h b/src/security/builtin_plugins/cryptographic/src/crypto_key_factory.h
index a908e2c..66538f4 100644
--- a/src/security/builtin_plugins/cryptographic/src/crypto_key_factory.h
+++ b/src/security/builtin_plugins/cryptographic/src/crypto_key_factory.h
@@ -40,6 +40,7 @@ bool crypto_factory_get_participant_crypto_tokens(
     DDS_Security_ParticipantCryptoHandle local_id,
     DDS_Security_ParticipantCryptoHandle remote_id,
     participant_key_material **pp_key_material,
+    master_key_material **remote_key_matarial,
     DDS_Security_ProtectionKind *protection_kind,
     DDS_Security_SecurityException *ex);
 
diff --git a/src/security/builtin_plugins/cryptographic/src/crypto_objects.c b/src/security/builtin_plugins/cryptographic/src/crypto_objects.c
index 17929af..9a9cf05 100644
--- a/src/security/builtin_plugins/cryptographic/src/crypto_objects.c
+++ b/src/security/builtin_plugins/cryptographic/src/crypto_objects.c
@@ -472,28 +472,29 @@ void crypto_remote_participant_add_keymat(remote_participant_crypto *rmt_pp_cryp
   ddsrt_mutex_unlock(&rmt_pp_crypto->lock);
 }
 
-participant_key_material * crypto_remote_participant_remove_keymat(remote_participant_crypto *rmt_pp_crypto, DDS_Security_ParticipantCryptoHandle loc_pp_handle)
+participant_key_material * crypto_remote_participant_remove_keymat_locked(remote_participant_crypto *rmt_pp_crypto, DDS_Security_ParticipantCryptoHandle loc_pp_handle)
 {
   participant_key_material *keymat;
   ddsrt_avl_dpath_t dpath;
 
-  ddsrt_mutex_lock(&rmt_pp_crypto->lock);
   keymat = ddsrt_avl_clookup_dpath(&rmt_pp_keymat_treedef, &rmt_pp_crypto->key_material_table, &loc_pp_handle, &dpath);
   if (keymat)
     ddsrt_avl_cdelete_dpath(&rmt_pp_keymat_treedef, &rmt_pp_crypto->key_material_table, keymat, &dpath);
-  ddsrt_mutex_unlock(&rmt_pp_crypto->lock);
 
   return keymat;
 }
 
+participant_key_material * crypto_remote_participant_lookup_keymat_locked(remote_participant_crypto *rmt_pp_crypto, DDS_Security_ParticipantCryptoHandle loc_pp_handle)
+{
+  return CRYPTO_OBJECT_KEEP(ddsrt_avl_clookup(&rmt_pp_keymat_treedef, &rmt_pp_crypto->key_material_table, &loc_pp_handle));
+}
+
 participant_key_material * crypto_remote_participant_lookup_keymat(remote_participant_crypto *rmt_pp_crypto, DDS_Security_ParticipantCryptoHandle loc_pp_handle)
 {
   participant_key_material *keymat;
-
   ddsrt_mutex_lock(&rmt_pp_crypto->lock);
-  keymat = CRYPTO_OBJECT_KEEP(ddsrt_avl_clookup(&rmt_pp_keymat_treedef, &rmt_pp_crypto->key_material_table, &loc_pp_handle));
+  keymat = crypto_remote_participant_lookup_keymat_locked(rmt_pp_crypto, loc_pp_handle);
   ddsrt_mutex_unlock(&rmt_pp_crypto->lock);
-
   return keymat;
 }
 
@@ -727,32 +728,52 @@ key_relation * crypto_find_endpoint_relation(
   return relation;
 }
 
+void crypto_insert_specific_key_relation_locked(
+    remote_participant_crypto *rpc,
+    key_relation *relation)
+{
+  ddsrt_avl_insert(&specific_key_treedef, &rpc->specific_key_index, CRYPTO_OBJECT_KEEP(relation));
+}
+
 void crypto_insert_specific_key_relation(
     remote_participant_crypto *rpc,
     key_relation *relation)
 {
   ddsrt_mutex_lock(&rpc->lock);
-  ddsrt_avl_insert(&specific_key_treedef, &rpc->specific_key_index, CRYPTO_OBJECT_KEEP(relation));
+  crypto_insert_specific_key_relation_locked(rpc, relation);
   ddsrt_mutex_unlock(&rpc->lock);
 }
 
+void crypto_remove_specific_key_relation_locked(
+    remote_participant_crypto *rpc,
+    uint32_t key_id)
+{
+  key_relation *relation;
+  ddsrt_avl_dpath_t dpath;
+  relation = ddsrt_avl_lookup_dpath(&specific_key_treedef, &rpc->specific_key_index, &key_id, &dpath);
+  if (relation)
+  {
+    ddsrt_avl_delete_dpath(&specific_key_treedef, &rpc->specific_key_index, relation, &dpath);
+    CRYPTO_OBJECT_RELEASE(relation);
+  }
+}
+
 void crypto_remove_specific_key_relation(
     remote_participant_crypto *rpc,
     uint32_t key_id)
 {
-  key_relation *relation;
-  ddsrt_avl_dpath_t dpath;
-
   ddsrt_mutex_lock(&rpc->lock);
-  relation =  ddsrt_avl_lookup_dpath(&specific_key_treedef, &rpc->specific_key_index, &key_id, &dpath);
-  if (relation)
-  {
-    ddsrt_avl_delete_dpath(&specific_key_treedef, &rpc->specific_key_index, relation, &dpath);
-    CRYPTO_OBJECT_RELEASE(relation);
-  }
+  crypto_remove_specific_key_relation_locked(rpc, key_id);
   ddsrt_mutex_unlock(&rpc->lock);
 }
 
+key_relation * crypto_find_specific_key_relation_locked(
+    remote_participant_crypto *rpc,
+    uint32_t key_id)
+{
+  return CRYPTO_OBJECT_KEEP(ddsrt_avl_lookup(&specific_key_treedef, &rpc->specific_key_index, &key_id));
+}
+
 key_relation * crypto_find_specific_key_relation(
     remote_participant_crypto *rpc,
     uint32_t key_id)
@@ -760,7 +781,7 @@ key_relation * crypto_find_specific_key_relation(
   key_relation *relation;
 
   ddsrt_mutex_lock(&rpc->lock);
-  relation =  CRYPTO_OBJECT_KEEP(ddsrt_avl_lookup(&specific_key_treedef, &rpc->specific_key_index, &key_id));
+  relation = crypto_find_specific_key_relation_locked(rpc, key_id);
   ddsrt_mutex_unlock(&rpc->lock);
 
   return relation;
diff --git a/src/security/builtin_plugins/cryptographic/src/crypto_objects.h b/src/security/builtin_plugins/cryptographic/src/crypto_objects.h
index 0ef700b..ebb34ed 100644
--- a/src/security/builtin_plugins/cryptographic/src/crypto_objects.h
+++ b/src/security/builtin_plugins/cryptographic/src/crypto_objects.h
@@ -261,16 +261,28 @@ crypto_find_endpoint_relation(
     CryptoObject *lch,
     uint32_t key_id);
 
+void crypto_insert_specific_key_relation_locked(
+    remote_participant_crypto *rpc,
+    key_relation *relation);
+
 void
 crypto_insert_specific_key_relation(
     remote_participant_crypto *rpc,
     key_relation *relation);
 
+void crypto_remove_specific_key_relation_locked(
+    remote_participant_crypto *rpc,
+    uint32_t key_id);
+
 void
 crypto_remove_specific_key_relation(
     remote_participant_crypto *rpc,
     uint32_t key_id);
 
+key_relation * crypto_find_specific_key_relation_locked(
+    remote_participant_crypto *rpc,
+    uint32_t key_id);
+
 key_relation *
 crypto_find_specific_key_relation(
     remote_participant_crypto *rpc,
@@ -403,10 +415,15 @@ crypto_remote_participant_add_keymat(
     participant_key_material *keymat);
 
 participant_key_material *
-crypto_remote_participant_remove_keymat(
+crypto_remote_participant_remove_keymat_locked(
     remote_participant_crypto *rmt_pp_crypte,
     DDS_Security_ParticipantCryptoHandle loc_pp_handle);
 
+participant_key_material *
+crypto_remote_participant_lookup_keymat_locked(
+    remote_participant_crypto *rmt_pp_crypto,
+    DDS_Security_ParticipantCryptoHandle loc_pp_handle);
+
 participant_key_material *
 crypto_remote_participant_lookup_keymat(
     remote_participant_crypto *rmt_pp_crypte,
diff --git a/src/security/builtin_plugins/cryptographic/src/crypto_transform.c b/src/security/builtin_plugins/cryptographic/src/crypto_transform.c
index 21c3e1c..a2f6893 100644
--- a/src/security/builtin_plugins/cryptographic/src/crypto_transform.c
+++ b/src/security/builtin_plugins/cryptographic/src/crypto_transform.c
@@ -996,7 +996,7 @@ add_receiver_specific_mac(
     return false;
 
   /* get remote crypto tokens */
-  if (!crypto_factory_get_participant_crypto_tokens(factory, sending_participant_crypto, receiving_participant_crypto, &pp_key_material, &remote_protection_kind, ex))
+  if (!crypto_factory_get_participant_crypto_tokens(factory, sending_participant_crypto, receiving_participant_crypto, &pp_key_material, NULL, &remote_protection_kind, ex))
   {
     CRYPTO_OBJECT_RELEASE(session);
     return false;
@@ -1841,6 +1841,7 @@ decode_rtps_message(dds_security_crypto_transform *instance,
   uint32_t decoded_body_size;
   static const char *context = "decode_rtps_message";
   participant_key_material *pp_key_material;
+  master_key_material *remote_key_material;
   DDS_Security_ProtectionKind remote_protection_kind;
   bool result = false;
 
@@ -1872,10 +1873,9 @@ decode_rtps_message(dds_security_crypto_transform *instance,
   transform_kind = CRYPTO_TRANSFORM_KIND(header.transform_identifier.transformation_kind);
 
   /* Retrieve key material from sending_participant_crypto and receiving_participant_crypto from factory */
-  if (!crypto_factory_get_participant_crypto_tokens(factory, receiving_participant_crypto, sending_participant_crypto, &pp_key_material, &remote_protection_kind, ex))
+  if (!crypto_factory_get_participant_crypto_tokens(factory, receiving_participant_crypto, sending_participant_crypto, &pp_key_material, &remote_key_material, &remote_protection_kind, ex))
     goto fail_tokens;
-
-  if (!pp_key_material->remote_key_material)
+  if (remote_key_material == NULL)
     goto fail_remote_keys_not_ready;
 
   if (has_origin_authentication(remote_protection_kind))
@@ -1886,8 +1886,8 @@ decode_rtps_message(dds_security_crypto_transform *instance,
 
   /* calculate the session key */
   decoded_body = DDS_Security_OctetSeq_allocbuf(contents._length);
-  if (!initialize_remote_session_info(&remote_session, &header, pp_key_material->remote_key_material->master_salt,
-        pp_key_material->remote_key_material->master_sender_key, pp_key_material->remote_key_material->transformation_kind, ex))
+  if (!initialize_remote_session_info(&remote_session, &header, remote_key_material->master_salt,
+        remote_key_material->master_sender_key, remote_key_material->transformation_kind, ex))
   {
     DDS_Security_Exception_set(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_INVALID_CRYPTO_ARGUMENT_CODE, 0,
         "decode_rtps_message: " DDS_SECURITY_ERR_INVALID_CRYPTO_ARGUMENT_MESSAGE);

From d22032c9460e691f6a9f1b98ff50bcfbc7d8820c Mon Sep 17 00:00:00 2001
From: Erik Boasson <eb@ilities.com>
Date: Sat, 18 Apr 2020 12:17:10 +0200
Subject: [PATCH 168/238] Restore SEDP tracing format

Signed-off-by: Erik Boasson <eb@ilities.com>
---
 src/core/ddsi/src/q_ddsi_discovery.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/src/core/ddsi/src/q_ddsi_discovery.c b/src/core/ddsi/src/q_ddsi_discovery.c
index 98db5b0..df4f133 100644
--- a/src/core/ddsi/src/q_ddsi_discovery.c
+++ b/src/core/ddsi/src/q_ddsi_discovery.c
@@ -1368,6 +1368,8 @@ static void handle_SEDP (const struct receiver_state *rst, seqno_t seq, struct d
   ddsi_plist_t decoded_data;
   if (ddsi_serdata_to_sample (serdata, &decoded_data, NULL, NULL))
   {
+    struct ddsi_domaingv * const gv = rst->gv;
+    GVLOGDISC ("SEDP ST%x", serdata->statusinfo);
     switch (serdata->statusinfo & (NN_STATUSINFO_DISPOSE | NN_STATUSINFO_UNREGISTER))
     {
       case 0:

From 080514d45a21cc1d7f6dcc441514d52b71bc77a7 Mon Sep 17 00:00:00 2001
From: Erik Boasson <eb@ilities.com>
Date: Sat, 18 Apr 2020 12:17:24 +0200
Subject: [PATCH 169/238] Remove redundant check for endpoint GUID in SEDP

The conversion of incoming discovery data (in "parameter list" format)
check for the presence of the entity GUID parameter for the particular
type of endpoint and use it as the key field in subsequent processing.
If the parameter is absent, deserialisation fails and the handlers are
never called and the old check is therefore no longer necessary.

Signed-off-by: Erik Boasson <eb@ilities.com>
---
 src/core/ddsi/src/q_ddsi_discovery.c | 10 ++--------
 1 file changed, 2 insertions(+), 8 deletions(-)

diff --git a/src/core/ddsi/src/q_ddsi_discovery.c b/src/core/ddsi/src/q_ddsi_discovery.c
index df4f133..1bc06c4 100644
--- a/src/core/ddsi/src/q_ddsi_discovery.c
+++ b/src/core/ddsi/src/q_ddsi_discovery.c
@@ -1162,9 +1162,7 @@ static void handle_SEDP_alive (const struct receiver_state *rst, seqno_t seq, dd
 #endif
 
   assert (datap);
-
-  if (!(datap->present & PP_ENDPOINT_GUID))
-    E (" no guid?\n", err);
+  assert (datap->present & PP_ENDPOINT_GUID);
   GVLOGDISC (" "PGUIDFMT, PGUID (datap->endpoint_guid));
 
   ppguid.prefix = datap->endpoint_guid.prefix;
@@ -1350,11 +1348,7 @@ static void handle_SEDP_dead (const struct receiver_state *rst, ddsi_plist_t *da
 {
   struct ddsi_domaingv * const gv = rst->gv;
   int res;
-  if (!(datap->present & PP_ENDPOINT_GUID))
-  {
-    GVLOGDISC (" no guid?\n");
-    return;
-  }
+  assert (datap->present & PP_ENDPOINT_GUID);
   GVLOGDISC (" "PGUIDFMT, PGUID (datap->endpoint_guid));
   if (is_writer_entityid (datap->endpoint_guid.entityid))
     res = delete_proxy_writer (gv, &datap->endpoint_guid, timestamp, 0);

From 19bc6f33cc1956db668b2468be3dc47880fbb40a Mon Sep 17 00:00:00 2001
From: Dennis Potman <dennis.potman@adlinktech.com>
Date: Tue, 14 Apr 2020 20:25:20 +0200
Subject: [PATCH 170/238] Access control tests

Add test cases for the join_access_control governance setting and for
the access control plugin check_create_ and check_remote_ hooks,
using a wrapper plugin that simulates failure for each of these,
to test the DDSI integration with the access control plugin.
This commit also contains fixes for:
- an assert on DDS_RETCODE_OK in dds_create_reader and
dds_create_writer that cased the application to terminate in case
creation of a reader or writer is not allowed by security
- do not match a proxy reader that has the 'relay_only' set to
true, which is currently unsupported

Signed-off-by: Dennis Potman <dennis.potman@adlinktech.com>
---
 src/core/ddsc/src/dds_reader.c                |  43 +-
 src/core/ddsc/src/dds_writer.c                |  48 +-
 .../include/dds/ddsi/ddsi_security_util.h     |  31 +-
 src/core/ddsi/include/dds/ddsi/q_entity.h     |   5 +-
 src/core/ddsi/src/ddsi_security_omg.c         |  56 +-
 src/core/ddsi/src/ddsi_security_util.c        |  18 +
 src/core/ddsi/src/q_entity.c                  |  50 +-
 .../include/dds/security/dds_security_api.h   |   2 +-
 src/security/core/tests/CMakeLists.txt        |   4 +-
 src/security/core/tests/access_control.c      | 265 +++++--
 src/security/core/tests/authentication.c      |   5 +-
 .../tests/common/access_control_wrapper.c     | 728 +++++++++++++-----
 .../tests/common/access_control_wrapper.h     |  32 +-
 .../tests/common/authentication_wrapper.c     |  24 +-
 .../tests/common/authentication_wrapper.h     |  16 +-
 .../core/tests/common/cryptography_wrapper.c  |  20 +-
 .../core/tests/common/cryptography_wrapper.h  |  12 +-
 .../tests/common/security_config_test_utils.c |   9 +-
 .../tests/common/security_config_test_utils.h |   2 +-
 src/security/core/tests/common/test_utils.c   |  80 +-
 src/security/core/tests/common/test_utils.h   |   9 +-
 21 files changed, 1022 insertions(+), 437 deletions(-)

diff --git a/src/core/ddsc/src/dds_reader.c b/src/core/ddsc/src/dds_reader.c
index 2bd7995..bffe59a 100644
--- a/src/core/ddsc/src/dds_reader.c
+++ b/src/core/ddsc/src/dds_reader.c
@@ -30,6 +30,7 @@
 #include "dds__builtin.h"
 #include "dds/ddsi/ddsi_sertopic.h"
 #include "dds/ddsi/ddsi_entity_index.h"
+#include "dds/ddsi/ddsi_security_omg.h"
 
 DECL_ENTITY_LOCK_UNLOCK (extern inline, dds_reader)
 
@@ -430,6 +431,7 @@ static dds_entity_t dds_create_reader_int (dds_entity_t participant_or_subscribe
 
   /* Merge qos from topic and subscriber, dds_copy_qos only fails when it is passed a null
      argument, but that isn't the case here */
+  struct ddsi_domaingv *gv = &sub->m_entity.m_domain->gv;
   rqos = dds_create_qos ();
   if (qos)
     ddsi_xqos_mergein_missing (rqos, qos, DDS_READER_QOS_MASK);
@@ -437,25 +439,43 @@ static dds_entity_t dds_create_reader_int (dds_entity_t participant_or_subscribe
     ddsi_xqos_mergein_missing (rqos, sub->m_entity.m_qos, ~(uint64_t)0);
   if (tp->m_ktopic->qos)
     ddsi_xqos_mergein_missing (rqos, tp->m_ktopic->qos, ~(uint64_t)0);
-  ddsi_xqos_mergein_missing (rqos, &sub->m_entity.m_domain->gv.default_xqos_rd, ~(uint64_t)0);
+  ddsi_xqos_mergein_missing (rqos, &gv->default_xqos_rd, ~(uint64_t)0);
 
-  if ((rc = ddsi_xqos_valid (&sub->m_entity.m_domain->gv.logconfig, rqos)) < 0 ||
-      (rc = validate_reader_qos(rqos)) != DDS_RETCODE_OK)
-  {
-    dds_delete_qos (rqos);
+  if ((rc = ddsi_xqos_valid (&gv->logconfig, rqos)) < 0 || (rc = validate_reader_qos(rqos)) != DDS_RETCODE_OK)
     goto err_bad_qos;
-  }
 
   /* Additional checks required for built-in topics: we don't want to
      run into a resource limit on a built-in topic, it is a needless
      complication */
   if (pseudo_topic && !dds__validate_builtin_reader_qos (tp->m_entity.m_domain, pseudo_topic, rqos))
   {
-    dds_delete_qos (rqos);
     rc = DDS_RETCODE_INCONSISTENT_POLICY;
     goto err_bad_qos;
   }
 
+  thread_state_awake (lookup_thread_state (), gv);
+  const struct ddsi_guid * ppguid = dds_entity_participant_guid (&sub->m_entity);
+  struct participant * pp = entidx_lookup_participant_guid (gv->entity_index, ppguid);
+  if (pp == NULL)
+  {
+    GVLOGDISC ("new_reader - participant "PGUIDFMT" not found\n", PGUID (*ppguid));
+    rc = DDS_RETCODE_BAD_PARAMETER;
+    goto err_pp_not_found;
+  }
+
+#ifdef DDSI_INCLUDE_SECURITY
+  /* Check if DDS Security is enabled */
+  if (q_omg_participant_is_secure (pp))
+  {
+    /* ask to access control security plugin for create reader permissions */
+    if (!q_omg_security_check_create_reader (pp, gv->config.domainId, tp->m_stopic->name, rqos))
+    {
+      rc = DDS_RETCODE_NOT_ALLOWED_BY_SECURITY;
+      goto err_not_allowed;
+    }
+  }
+#endif
+
   /* Create reader and associated read cache (if not provided by caller) */
   struct dds_reader * const rd = dds_alloc (sizeof (*rd));
   const dds_entity_t reader = dds_entity_init (&rd->m_entity, &sub->m_entity, DDS_KIND_READER, false, rqos, listener, DDS_READER_STATUS_MASK);
@@ -474,8 +494,7 @@ static dds_entity_t dds_create_reader_int (dds_entity_t participant_or_subscribe
      it; and then invoke those listeners that are in the pending set */
   dds_entity_init_complete (&rd->m_entity);
 
-  thread_state_awake (lookup_thread_state (), &sub->m_entity.m_domain->gv);
-  rc = new_reader (&rd->m_rd, &rd->m_entity.m_domain->gv, &rd->m_entity.m_guid, NULL, dds_entity_participant_guid (&sub->m_entity), tp->m_stopic, rqos, &rd->m_rhc->common.rhc, dds_reader_status_cb, rd);
+  rc = new_reader (&rd->m_rd, &rd->m_entity.m_guid, NULL, pp, tp->m_stopic, rqos, &rd->m_rhc->common.rhc, dds_reader_status_cb, rd);
   assert (rc == DDS_RETCODE_OK); /* FIXME: can be out-of-resources at the very least */
   thread_state_asleep (lookup_thread_state ());
 
@@ -487,7 +506,13 @@ static dds_entity_t dds_create_reader_int (dds_entity_t participant_or_subscribe
   dds_subscriber_unlock (sub);
   return reader;
 
+#ifdef DDSI_INCLUDE_SECURITY
+err_not_allowed:
+#endif
+err_pp_not_found:
+  thread_state_asleep (lookup_thread_state ());
 err_bad_qos:
+  dds_delete_qos (rqos);
   dds_topic_allow_set_qos (tp);
 err_pp_mismatch:
   dds_topic_unpin (tp);
diff --git a/src/core/ddsc/src/dds_writer.c b/src/core/ddsc/src/dds_writer.c
index caedd81..12d2676 100644
--- a/src/core/ddsc/src/dds_writer.c
+++ b/src/core/ddsc/src/dds_writer.c
@@ -20,6 +20,7 @@
 #include "dds/ddsi/q_thread.h"
 #include "dds/ddsi/q_xmsg.h"
 #include "dds/ddsi/ddsi_entity_index.h"
+#include "dds/ddsi/ddsi_security_omg.h"
 #include "dds__writer.h"
 #include "dds__listener.h"
 #include "dds__init.h"
@@ -312,6 +313,7 @@ dds_entity_t dds_create_writer (dds_entity_t participant_or_publisher, dds_entit
   dds_topic_defer_set_qos (tp);
 
   /* Merge Topic & Publisher qos */
+  struct ddsi_domaingv *gv = &pub->m_entity.m_domain->gv;
   wqos = dds_create_qos ();
   if (qos)
     ddsi_xqos_mergein_missing (wqos, qos, DDS_WRITER_QOS_MASK);
@@ -319,29 +321,47 @@ dds_entity_t dds_create_writer (dds_entity_t participant_or_publisher, dds_entit
     ddsi_xqos_mergein_missing (wqos, pub->m_entity.m_qos, ~(uint64_t)0);
   if (tp->m_ktopic->qos)
     ddsi_xqos_mergein_missing (wqos, tp->m_ktopic->qos, ~(uint64_t)0);
-  ddsi_xqos_mergein_missing (wqos, &pub->m_entity.m_domain->gv.default_xqos_wr, ~(uint64_t)0);
+  ddsi_xqos_mergein_missing (wqos, &gv->default_xqos_wr, ~(uint64_t)0);
 
-  if ((rc = ddsi_xqos_valid (&pub->m_entity.m_domain->gv.logconfig, wqos)) < 0 ||
-      (rc = validate_writer_qos(wqos)) != DDS_RETCODE_OK)
-  {
-    dds_delete_qos(wqos);
+  if ((rc = ddsi_xqos_valid (&gv->logconfig, wqos)) < 0 || (rc = validate_writer_qos(wqos)) != DDS_RETCODE_OK)
     goto err_bad_qos;
+
+  thread_state_awake (lookup_thread_state (), gv);
+  const struct ddsi_guid *ppguid = dds_entity_participant_guid (&pub->m_entity);
+  struct participant *pp = entidx_lookup_participant_guid (gv->entity_index, ppguid);
+  if (pp == NULL)
+  {
+    GVLOGDISC ("new_writer - participant "PGUIDFMT" not found\n", PGUID (*ppguid));
+    rc = DDS_RETCODE_BAD_PARAMETER;
+    goto err_pp_not_found;
   }
 
+#ifdef DDSI_INCLUDE_SECURITY
+  /* Check if DDS Security is enabled */
+  if (q_omg_participant_is_secure (pp))
+  {
+    /* ask to access control security plugin for create writer permissions */
+    if (!q_omg_security_check_create_writer (pp, gv->config.domainId, tp->m_stopic->name, wqos))
+    {
+      rc = DDS_RETCODE_NOT_ALLOWED_BY_SECURITY;
+      goto err_not_allowed;
+    }
+  }
+#endif
+
   /* Create writer */
-  ddsi_tran_conn_t conn = pub->m_entity.m_domain->gv.xmit_conn;
+  ddsi_tran_conn_t conn = gv->xmit_conn;
   struct dds_writer * const wr = dds_alloc (sizeof (*wr));
   const dds_entity_t writer = dds_entity_init (&wr->m_entity, &pub->m_entity, DDS_KIND_WRITER, false, wqos, listener, DDS_WRITER_STATUS_MASK);
   wr->m_topic = tp;
   dds_entity_add_ref_locked (&tp->m_entity);
-  wr->m_xp = nn_xpack_new (conn, get_bandwidth_limit (wqos->transport_priority), pub->m_entity.m_domain->gv.config.xpack_send_async);
+  wr->m_xp = nn_xpack_new (conn, get_bandwidth_limit (wqos->transport_priority), gv->config.xpack_send_async);
   wrinfo = whc_make_wrinfo (wr, wqos);
-  wr->m_whc = whc_new (&pub->m_entity.m_domain->gv, wrinfo);
+  wr->m_whc = whc_new (gv, wrinfo);
   whc_free_wrinfo (wrinfo);
-  wr->whc_batch = pub->m_entity.m_domain->gv.config.whc_batch;
+  wr->whc_batch = gv->config.whc_batch;
 
-  thread_state_awake (lookup_thread_state (), &pub->m_entity.m_domain->gv);
-  rc = new_writer (&wr->m_wr, &wr->m_entity.m_domain->gv, &wr->m_entity.m_guid, NULL, dds_entity_participant_guid (&pub->m_entity), tp->m_stopic, wqos, wr->m_whc, dds_writer_status_cb, wr);
+  rc = new_writer (&wr->m_wr, &wr->m_entity.m_guid, NULL, pp, tp->m_stopic, wqos, wr->m_whc, dds_writer_status_cb, wr);
   assert(rc == DDS_RETCODE_OK);
   thread_state_asleep (lookup_thread_state ());
 
@@ -355,7 +375,13 @@ dds_entity_t dds_create_writer (dds_entity_t participant_or_publisher, dds_entit
   dds_publisher_unlock (pub);
   return writer;
 
+#ifdef DDSI_INCLUDE_SECURITY
+err_not_allowed:
+#endif
+err_pp_not_found:
+  thread_state_asleep (lookup_thread_state ());
 err_bad_qos:
+  dds_delete_qos(wqos);
   dds_topic_allow_set_qos (tp);
 err_pp_mismatch:
   dds_topic_unpin (tp);
diff --git a/src/core/ddsi/include/dds/ddsi/ddsi_security_util.h b/src/core/ddsi/include/dds/ddsi/ddsi_security_util.h
index 7c03496..188675e 100644
--- a/src/core/ddsi/include/dds/ddsi/ddsi_security_util.h
+++ b/src/core/ddsi/include/dds/ddsi/ddsi_security_util.h
@@ -22,64 +22,37 @@ extern "C" {
 #endif
 
 void g_omg_shallow_copy_StringSeq(DDS_Security_StringSeq *dst, const ddsi_stringseq_t *src);
-
 void g_omg_shallow_free_StringSeq(DDS_Security_StringSeq *obj);
-
 void q_omg_copy_PropertySeq(DDS_Security_PropertySeq *dst, const dds_propertyseq_t *src);
-
 void q_omg_shallow_copyin_PropertySeq(DDS_Security_PropertySeq *dst, const dds_propertyseq_t *src);
-
 void q_omg_shallow_copyout_PropertySeq(dds_propertyseq_t *dst, const DDS_Security_PropertySeq *src);
-
 void q_omg_shallow_free_PropertySeq(DDS_Security_PropertySeq *obj);
-
 void q_omg_shallow_copyin_BinaryPropertySeq(DDS_Security_BinaryPropertySeq *dst, const dds_binarypropertyseq_t *src);
-
 void q_omg_shallow_copyout_BinaryPropertySeq(dds_binarypropertyseq_t *dst, const DDS_Security_BinaryPropertySeq *src);
-
 void q_omg_shallow_free_BinaryPropertySeq(DDS_Security_BinaryPropertySeq *obj);
-
 void q_omg_shallow_copy_PropertyQosPolicy(DDS_Security_PropertyQosPolicy *dst, const dds_property_qospolicy_t *src);
-
 void q_omg_shallow_copy_security_qos(DDS_Security_Qos *dst, const struct dds_qos *src);
-
 void q_omg_shallow_free_PropertyQosPolicy(DDS_Security_PropertyQosPolicy *obj);
-
 void q_omg_shallow_free_security_qos(DDS_Security_Qos *obj);
-
 void q_omg_security_dataholder_copyin(nn_dataholder_t *dh, const DDS_Security_DataHolder *holder);
-
 void q_omg_security_dataholder_copyout(DDS_Security_DataHolder *holder, const nn_dataholder_t *dh);
-
 void q_omg_shallow_copyin_DataHolder(DDS_Security_DataHolder *dst, const nn_dataholder_t *src);
-
 void q_omg_shallow_copyout_DataHolder(nn_dataholder_t *dst, const DDS_Security_DataHolder *src);
-
 void q_omg_shallow_free_DataHolder(DDS_Security_DataHolder *obj);
-
 void q_omg_shallow_free_nn_dataholder(nn_dataholder_t *holder);
-
 void q_omg_shallow_copyin_DataHolderSeq(DDS_Security_DataHolderSeq *dst, const nn_dataholderseq_t *src);
-
 void q_omg_copyin_DataHolderSeq(DDS_Security_DataHolderSeq *dst, const nn_dataholderseq_t *src);
-
 void q_omg_shallow_copyout_DataHolderSeq(nn_dataholderseq_t *dst, const DDS_Security_DataHolderSeq *src);
-
 void q_omg_shallow_free_DataHolderSeq(DDS_Security_DataHolderSeq *obj);
-
 void q_omg_shallow_free_nn_dataholderseq(nn_dataholderseq_t *obj);
-
 void q_omg_shallow_copy_ParticipantBuiltinTopicDataSecure(DDS_Security_ParticipantBuiltinTopicDataSecure *dst, const ddsi_guid_t *guid, const ddsi_plist_t *plist);
-
 void q_omg_shallow_free_ParticipantBuiltinTopicDataSecure(DDS_Security_ParticipantBuiltinTopicDataSecure *obj);
-
 void q_omg_shallow_copy_SubscriptionBuiltinTopicDataSecure(DDS_Security_SubscriptionBuiltinTopicDataSecure *dst, const ddsi_guid_t *guid, const struct dds_qos *qos, const nn_security_info_t *secinfo);
-
 void q_omg_shallow_free_SubscriptionBuiltinTopicDataSecure(DDS_Security_SubscriptionBuiltinTopicDataSecure *obj);
-
 void q_omg_shallow_copy_PublicationBuiltinTopicDataSecure(DDS_Security_PublicationBuiltinTopicDataSecure *dst, const ddsi_guid_t *guid, const struct dds_qos *qos, const nn_security_info_t *secinfo);
-
 void q_omg_shallow_free_PublicationBuiltinTopicDataSecure(DDS_Security_PublicationBuiltinTopicDataSecure *obj);
+void q_omg_shallow_copy_TopicBuiltinTopicData(DDS_Security_TopicBuiltinTopicData *dst, const char *topic_name, const char *type_name);
+void q_omg_shallow_free_TopicBuiltinTopicData(DDS_Security_TopicBuiltinTopicData *obj);
 
 #if defined (__cplusplus)
 }
diff --git a/src/core/ddsi/include/dds/ddsi/q_entity.h b/src/core/ddsi/include/dds/ddsi/q_entity.h
index a6f6543..9d2765e 100644
--- a/src/core/ddsi/include/dds/ddsi/q_entity.h
+++ b/src/core/ddsi/include/dds/ddsi/q_entity.h
@@ -642,9 +642,8 @@ DDS_EXPORT struct writer *get_builtin_writer (const struct participant *pp, unsi
    GUID "ppguid". May return NULL if participant unknown or
    writer/reader already known. */
 
-dds_return_t new_writer (struct writer **wr_out, struct ddsi_domaingv *gv, struct ddsi_guid *wrguid, const struct ddsi_guid *group_guid, const struct ddsi_guid *ppguid, const struct ddsi_sertopic *topic, const struct dds_qos *xqos, struct whc * whc, status_cb_t status_cb, void *status_cb_arg);
-
-dds_return_t new_reader (struct reader **rd_out, struct ddsi_domaingv *gv, struct ddsi_guid *rdguid, const struct ddsi_guid *group_guid, const struct ddsi_guid *ppguid, const struct ddsi_sertopic *topic, const struct dds_qos *xqos, struct ddsi_rhc * rhc, status_cb_t status_cb, void *status_cb_arg);
+dds_return_t new_writer (struct writer **wr_out, struct ddsi_guid *wrguid, const struct ddsi_guid *group_guid, struct participant *pp, const struct ddsi_sertopic *topic, const struct dds_qos *xqos, struct whc * whc, status_cb_t status_cb, void *status_cb_arg);
+dds_return_t new_reader (struct reader **rd_out, struct ddsi_guid *rdguid, const struct ddsi_guid *group_guid, struct participant *pp, const struct ddsi_sertopic *topic, const struct dds_qos *xqos, struct ddsi_rhc * rhc, status_cb_t status_cb, void *status_cb_arg);
 
 void update_reader_qos (struct reader *rd, const struct dds_qos *xqos);
 void update_writer_qos (struct writer *wr, const struct dds_qos *xqos);
diff --git a/src/core/ddsi/src/ddsi_security_omg.c b/src/core/ddsi/src/ddsi_security_omg.c
index aae4ebf..c7f2b10 100644
--- a/src/core/ddsi/src/ddsi_security_omg.c
+++ b/src/core/ddsi/src/ddsi_security_omg.c
@@ -2136,7 +2136,8 @@ bool q_omg_security_check_remote_writer_permissions(const struct proxy_writer *p
   struct dds_security_context *sc = q_omg_security_get_secure_context(pp);
   DDS_Security_SecurityException exception = DDS_SECURITY_EXCEPTION_INIT;
   DDS_Security_PublicationBuiltinTopicDataSecure publication_data;
-  bool ok = true;
+  DDS_Security_TopicBuiltinTopicData topic_data;
+  bool result = true;
 
   if (!sc)
     return true;
@@ -2167,19 +2168,32 @@ bool q_omg_security_check_remote_writer_permissions(const struct proxy_writer *p
     else
     {
       q_omg_shallow_copy_PublicationBuiltinTopicDataSecure(&publication_data, &pwr->e.guid, pwr->c.xqos, &pwr->c.security_info);
-      ok = sc->access_control_context->check_remote_datawriter(sc->access_control_context, permissions_handle, (int)domain_id, &publication_data, &exception);
-      q_omg_shallow_free_PublicationBuiltinTopicDataSecure(&publication_data);
-      if (!ok)
+      result = sc->access_control_context->check_remote_datawriter(sc->access_control_context, permissions_handle, (int)domain_id, &publication_data, &exception);
+      if (!result)
       {
         if (!is_topic_discovery_protected(pp->sec_attr->permissions_handle, sc->access_control_context, publication_data.topic_name))
           EXCEPTION_ERROR(gv, &exception, "Access control does not allow remote writer "PGUIDFMT": %s", PGUID(pwr->e.guid));
         else
           DDS_Security_Exception_reset(&exception);
       }
+      else
+      {
+        q_omg_shallow_copy_TopicBuiltinTopicData(&topic_data, publication_data.topic_name, publication_data.type_name);
+        result = sc->access_control_context->check_remote_topic(sc->access_control_context, permissions_handle, (int)domain_id, &topic_data, &exception);
+        q_omg_shallow_free_TopicBuiltinTopicData(&topic_data);
+        if (!result)
+        {
+          if (!is_topic_discovery_protected(pp->sec_attr->permissions_handle, sc->access_control_context, publication_data.topic_name))
+            EXCEPTION_ERROR(gv, &exception, "Access control does not allow remote topic %s: %s", publication_data.topic_name);
+          else
+            DDS_Security_Exception_reset(&exception);
+        }
+      }
+      q_omg_shallow_free_PublicationBuiltinTopicDataSecure(&publication_data);
     }
   }
 
-  return ok;
+  return result;
 }
 
 static void send_reader_crypto_tokens(struct reader *rd, struct proxy_writer *pwr, DDS_Security_DatareaderCryptoHandle local_crypto, DDS_Security_DatawriterCryptoHandle remote_crypto)
@@ -2363,7 +2377,10 @@ bool q_omg_security_check_remote_reader_permissions(const struct proxy_reader *p
   struct ddsi_domaingv *gv = pp->e.gv;
   struct dds_security_context *sc = q_omg_security_get_secure_context(pp);
   DDS_Security_SecurityException exception = DDS_SECURITY_EXCEPTION_INIT;
-  bool ok = true;
+  DDS_Security_SubscriptionBuiltinTopicDataSecure subscription_data;
+  DDS_Security_TopicBuiltinTopicData topic_data;
+  DDS_Security_boolean sec_relay_only;
+  bool result = true;
 
   /* relay_only is meaningless in all cases except the one where the access control plugin says otherwise */
   *relay_only = false;
@@ -2396,25 +2413,34 @@ bool q_omg_security_check_remote_reader_permissions(const struct proxy_reader *p
     }
     else
     {
-      DDS_Security_SubscriptionBuiltinTopicDataSecure subscription_data;
-      DDS_Security_boolean sec_relay_only;
-
       q_omg_shallow_copy_SubscriptionBuiltinTopicDataSecure(&subscription_data, &prd->e.guid, prd->c.xqos, &prd->c.security_info);
-      ok = sc->access_control_context->check_remote_datareader(sc->access_control_context, permissions_handle, (int)domain_id, &subscription_data, &sec_relay_only, &exception);
-      q_omg_shallow_free_SubscriptionBuiltinTopicDataSecure(&subscription_data);
-      if (ok)
-        *relay_only = !!sec_relay_only;
-      else
+      result = sc->access_control_context->check_remote_datareader(sc->access_control_context, permissions_handle, (int)domain_id, &subscription_data, &sec_relay_only, &exception);
+      if (!result)
       {
         if (!is_topic_discovery_protected(pp->sec_attr->permissions_handle, sc->access_control_context, subscription_data.topic_name))
           EXCEPTION_ERROR(gv, &exception, "Access control does not allow remote reader "PGUIDFMT": %s", PGUID(prd->e.guid));
         else
           DDS_Security_Exception_reset(&exception);
       }
+      else
+      {
+        *relay_only = !!sec_relay_only;
+        q_omg_shallow_copy_TopicBuiltinTopicData(&topic_data, subscription_data.topic_name, subscription_data.type_name);
+        result = sc->access_control_context->check_remote_topic(sc->access_control_context, permissions_handle, (int)domain_id, &topic_data, &exception);
+        q_omg_shallow_free_TopicBuiltinTopicData(&topic_data);
+        if (!result)
+        {
+          if (!is_topic_discovery_protected(pp->sec_attr->permissions_handle, sc->access_control_context, subscription_data.topic_name))
+            EXCEPTION_ERROR(gv, &exception, "Access control does not allow remote topic %s: %s", subscription_data.topic_name);
+          else
+            DDS_Security_Exception_reset(&exception);
+        }
+      }
+      q_omg_shallow_free_SubscriptionBuiltinTopicDataSecure(&subscription_data);
     }
   }
 
-  return ok;
+  return result;
 }
 
 void q_omg_get_proxy_endpoint_security_info(const struct entity_common *entity, nn_security_info_t *proxypp_sec_info, const ddsi_plist_t *plist, nn_security_info_t *info)
diff --git a/src/core/ddsi/src/ddsi_security_util.c b/src/core/ddsi/src/ddsi_security_util.c
index 388fb4e..11f39b5 100644
--- a/src/core/ddsi/src/ddsi_security_util.c
+++ b/src/core/ddsi/src/ddsi_security_util.c
@@ -703,6 +703,24 @@ q_omg_shallow_free_PublicationBuiltinTopicDataSecure(
   g_omg_shallow_free_StringSeq(&obj->partition.name);
 }
 
+void
+q_omg_shallow_copy_TopicBuiltinTopicData(
+    DDS_Security_TopicBuiltinTopicData *dst,
+    const char *topic_name,
+    const char *type_name)
+{
+  memset(dst, 0, sizeof(DDS_Security_TopicBuiltinTopicData));
+  dst->name = (DDS_Security_string)topic_name;
+  dst->type_name = (DDS_Security_string)type_name;
+}
+
+void
+q_omg_shallow_free_TopicBuiltinTopicData(
+    DDS_Security_TopicBuiltinTopicData *obj)
+{
+  DDSRT_UNUSED_ARG(obj);
+}
+
 
 
 #endif /* DDSI_INCLUDE_SECURITY */
diff --git a/src/core/ddsi/src/q_entity.c b/src/core/ddsi/src/q_entity.c
index 2669c09..c1f4573 100644
--- a/src/core/ddsi/src/q_entity.c
+++ b/src/core/ddsi/src/q_entity.c
@@ -2771,6 +2771,7 @@ void connect_reader_with_proxy_writer_secure(struct reader *rd, struct proxy_wri
 
 static void connect_writer_with_proxy_reader (struct writer *wr, struct proxy_reader *prd, ddsrt_mtime_t tnow)
 {
+  struct ddsi_domaingv *gv = wr->e.gv;
   const int isb0 = (is_builtin_entityid (wr->e.guid.entityid, NN_VENDORID_ECLIPSE) != 0);
   const int isb1 = (is_builtin_entityid (prd->e.guid.entityid, prd->c.vendor) != 0);
   dds_qos_policy_id_t reason;
@@ -2790,13 +2791,15 @@ static void connect_writer_with_proxy_reader (struct writer *wr, struct proxy_re
 
   if (!q_omg_security_check_remote_reader_permissions (prd, wr->e.gv->config.domainId, wr->c.pp, &relay_only))
   {
-    EELOGDISC (&wr->e, "connect_writer_with_proxy_reader (wr "PGUIDFMT") with (prd "PGUIDFMT") not allowed by security\n",
-                   PGUID (wr->e.guid), PGUID (prd->e.guid));
+    GVLOGDISC ("connect_writer_with_proxy_reader (wr "PGUIDFMT") with (prd "PGUIDFMT") not allowed by security\n", PGUID (wr->e.guid), PGUID (prd->e.guid));
+  }
+  else if (relay_only)
+  {
+    GVWARNING ("connect_writer_with_proxy_reader (wr "PGUIDFMT") with (prd "PGUIDFMT") relay_only not supported\n", PGUID (wr->e.guid), PGUID (prd->e.guid));
   }
   else if (!q_omg_security_match_remote_reader_enabled (wr, prd, relay_only, &crypto_handle))
   {
-    EELOGDISC (&wr->e, "connect_writer_with_proxy_reader (wr "PGUIDFMT") with (prd "PGUIDFMT") waiting for approval by security\n",
-                     PGUID (wr->e.guid), PGUID (prd->e.guid));
+    GVLOGDISC ("connect_writer_with_proxy_reader (wr "PGUIDFMT") with (prd "PGUIDFMT") waiting for approval by security\n", PGUID (wr->e.guid), PGUID (prd->e.guid));
   }
   else
   {
@@ -3801,28 +3804,11 @@ static dds_return_t new_writer_guid (struct writer **wr_out, const struct ddsi_g
   return 0;
 }
 
-dds_return_t new_writer (struct writer **wr_out, struct ddsi_domaingv *gv, struct ddsi_guid *wrguid, const struct ddsi_guid *group_guid, const struct ddsi_guid *ppguid, const struct ddsi_sertopic *topic, const struct dds_qos *xqos, struct whc * whc, status_cb_t status_cb, void *status_cb_arg)
+dds_return_t new_writer (struct writer **wr_out, struct ddsi_guid *wrguid, const struct ddsi_guid *group_guid, struct participant *pp, const struct ddsi_sertopic *topic, const struct dds_qos *xqos, struct whc * whc, status_cb_t status_cb, void *status_cb_arg)
 {
-  struct participant *pp;
   dds_return_t rc;
   uint32_t kind;
 
-  if ((pp = entidx_lookup_participant_guid (gv->entity_index, ppguid)) == NULL)
-  {
-    GVLOGDISC ("new_writer - participant "PGUIDFMT" not found\n", PGUID (*ppguid));
-    return DDS_RETCODE_BAD_PARAMETER;
-  }
-
-#ifdef DDSI_INCLUDE_SECURITY
-  /* Check if DDS Security is enabled */
-  if (q_omg_participant_is_secure (pp))
-  {
-    /* ask to access control security plugin for create writer permissions */
-    if (!q_omg_security_check_create_writer (pp, gv->config.domainId, topic->name, xqos))
-      return DDS_RETCODE_NOT_ALLOWED_BY_SECURITY;
-  }
-#endif
-
   /* participant can't be freed while we're mucking around cos we are
      awake and do not touch the thread's vtime (entidx_lookup already
      verifies we're awake) */
@@ -4367,10 +4353,9 @@ static dds_return_t new_reader_guid
 dds_return_t new_reader
 (
   struct reader **rd_out,
-  struct ddsi_domaingv *gv,
   struct ddsi_guid *rdguid,
   const struct ddsi_guid *group_guid,
-  const struct ddsi_guid *ppguid,
+  struct participant *pp,
   const struct ddsi_sertopic *topic,
   const struct dds_qos *xqos,
   struct ddsi_rhc * rhc,
@@ -4378,26 +4363,9 @@ dds_return_t new_reader
   void * status_cbarg
 )
 {
-  struct participant * pp;
   dds_return_t rc;
   uint32_t kind;
 
-  if ((pp = entidx_lookup_participant_guid (gv->entity_index, ppguid)) == NULL)
-  {
-    GVLOGDISC ("new_reader - participant "PGUIDFMT" not found\n", PGUID (*ppguid));
-    return DDS_RETCODE_BAD_PARAMETER;
-  }
-
-#ifdef DDSI_INCLUDE_SECURITY
-  /* Check if DDS Security is enabled */
-  if (q_omg_participant_is_secure (pp))
-  {
-    /* ask to access control security plugin for create writer permissions */
-    if (!q_omg_security_check_create_reader (pp, gv->config.domainId, topic->name, xqos))
-      return DDS_RETCODE_NOT_ALLOWED_BY_SECURITY;
-  }
-#endif
-
   rdguid->prefix = pp->e.guid.prefix;
   kind = topic->topickind_no_key ? NN_ENTITYID_KIND_READER_NO_KEY : NN_ENTITYID_KIND_READER_WITH_KEY;
   if ((rc = pp_allocate_entityid (&rdguid->entityid, kind, pp)) < 0)
diff --git a/src/security/api/include/dds/security/dds_security_api.h b/src/security/api/include/dds/security/dds_security_api.h
index 55ab6a0..d242b02 100644
--- a/src/security/api/include/dds/security/dds_security_api.h
+++ b/src/security/api/include/dds/security/dds_security_api.h
@@ -25,7 +25,7 @@ extern "C" {
 
 /* Integration functions for Security plugins */
 typedef int (*plugin_init)(const char *argument, void **context, struct ddsi_domaingv *gv);
-typedef int  (*plugin_finalize)(void *context);
+typedef int (*plugin_finalize)(void *context);
 
 #if defined (__cplusplus)
 }
diff --git a/src/security/core/tests/CMakeLists.txt b/src/security/core/tests/CMakeLists.txt
index 35337ab..299487e 100644
--- a/src/security/core/tests/CMakeLists.txt
+++ b/src/security/core/tests/CMakeLists.txt
@@ -68,7 +68,7 @@ set(security_core_test_sources
 )
 
 if(ENABLE_SSL)
-  add_wrapper(access_control "")
+  add_wrapper(access_control dds_security_ac)
   add_wrapper(authentication dds_security_auth)
   add_wrapper(cryptography dds_security_crypto)
 
@@ -108,7 +108,7 @@ configure_file("common/config_env.h.in" "common/config_env.h")
 
 target_link_libraries(cunit_security_core PRIVATE ddsc security_api SecurityCoreTests)
 if(ENABLE_SSL)
-  target_link_libraries(cunit_security_core PRIVATE dds_security_auth dds_security_ac dds_security_crypto dds_security_authentication_wrapper dds_security_cryptography_wrapper)
+  target_link_libraries(cunit_security_core PRIVATE dds_security_auth dds_security_ac dds_security_crypto dds_security_access_control_wrapper dds_security_authentication_wrapper dds_security_cryptography_wrapper)
   target_link_libraries(cunit_security_core PRIVATE OpenSSL::SSL)
 endif()
 target_include_directories(cunit_security_core PRIVATE "${CMAKE_CURRENT_BINARY_DIR}")
diff --git a/src/security/core/tests/access_control.c b/src/security/core/tests/access_control.c
index 9fdf1ae..3b04fc6 100644
--- a/src/security/core/tests/access_control.c
+++ b/src/security/core/tests/access_control.c
@@ -47,13 +47,13 @@ static const char *config =
     "  </Discovery>"
     "  <DDSSecurity>"
     "    <Authentication>"
-    "      <Library finalizeFunction=\"finalize_authentication\" initFunction=\"init_authentication\"/>"
+    "      <Library finalizeFunction=\"finalize_test_authentication_wrapped\" initFunction=\"init_test_authentication_wrapped\" path=\"" WRAPPERLIB_PATH("dds_security_authentication_wrapper") "\"/>"
     "      <IdentityCertificate>data:,${TEST_IDENTITY_CERTIFICATE}</IdentityCertificate>"
     "      <PrivateKey>data:,${TEST_IDENTITY_PRIVATE_KEY}</PrivateKey>"
     "      <IdentityCA>data:,${TEST_IDENTITY_CA_CERTIFICATE}</IdentityCA>"
     "    </Authentication>"
     "    <AccessControl>"
-    "      <Library finalizeFunction=\"finalize_access_control\" initFunction=\"init_access_control\"/>"
+    "      <Library initFunction=\"${ACCESS_CONTROL_INIT:-init_test_access_control_wrapped}\" finalizeFunction=\"${ACCESS_CONTROL_FINI:-finalize_test_access_control_wrapped}\" path=\"" WRAPPERLIB_PATH("dds_security_access_control_wrapper") "\"/>"
     "      ${INCL_GOV:+<Governance><![CDATA[}${TEST_GOVERNANCE}${INCL_GOV:+]]></Governance>}"
     "      ${INCL_PERM_CA:+<PermissionsCA>}${TEST_PERMISSIONS_CA}${INCL_PERM_CA:+</PermissionsCA>}"
     "      ${INCL_PERM:+<Permissions><![CDATA[}${TEST_PERMISSIONS}${INCL_PERM:+]]></Permissions>}"
@@ -65,19 +65,22 @@ static const char *config =
     "</Domain>";
 
 #define MAX_DOMAINS 10
-#define DDS_DOMAINID
+#define DDS_DOMAINID 0
+
+#define PF_F "file:"
+#define PF_D "data:,"
 
 static dds_entity_t g_domain[MAX_DOMAINS];
 static dds_entity_t g_participant[MAX_DOMAINS];
-static dds_entity_t g_pubsub[MAX_DOMAINS];
-static dds_entity_t g_topic[MAX_DOMAINS];
 static uint32_t g_topic_nr = 0;
 
 static void access_control_init(
-  const char * id_certs[], const char * id_keys[], const char * id_ca[], bool exp_pp_fail[], size_t n_nodes,
-  bool incl_gov, const char * gov,
-  bool incl_perm, const char * perm,
-  bool incl_ca, const char * ca)
+  size_t n_nodes,
+  const char * id_certs[], const char * id_keys[], const char * id_ca[], bool exp_pp_fail[],
+  const char * ac_init_fns[], const char * ac_fini_fns[],
+  bool incl_gov[], const char * gov[],
+  bool incl_perm[], const char * perm[],
+  bool incl_ca[], const char * ca[])
 {
   CU_ASSERT_FATAL (n_nodes <= MAX_DOMAINS);
   for (size_t i = 0; i < n_nodes; i++)
@@ -86,12 +89,14 @@ static void access_control_init(
       { "TEST_IDENTITY_CERTIFICATE", id_certs[i], 1 },
       { "TEST_IDENTITY_PRIVATE_KEY", id_keys[i], 1 },
       { "TEST_IDENTITY_CA_CERTIFICATE", id_ca[i], 1 },
-      { "INCL_GOV", incl_gov ? "1" : "", 2 },
-      { "INCL_PERM", incl_perm ? "1" : "", 2 },
-      { "INCL_PERM_CA", incl_ca ? "1" : "", 2 },
-      { "TEST_GOVERNANCE", gov, 1 },
-      { "TEST_PERMISSIONS", perm, 1 },
-      { "TEST_PERMISSIONS_CA", ca, 1 },
+      { "ACCESS_CONTROL_INIT", ac_init_fns ? ac_init_fns[i] : NULL, 1 },
+      { "ACCESS_CONTROL_FINI", ac_fini_fns ? ac_fini_fns[i] : NULL, 1 },
+      { "INCL_GOV", incl_gov[i] ? "1" : "", 2 },
+      { "INCL_PERM", incl_perm[i] ? "1" : "", 2 },
+      { "INCL_PERM_CA", incl_ca[i] ? "1" : "", 2 },
+      { "TEST_GOVERNANCE", gov[i], 1 },
+      { "TEST_PERMISSIONS", perm[i], 1 },
+      { "TEST_PERMISSIONS_CA", ca[i], 1 },
       { NULL, NULL, 0 }
     };
     char *conf = ddsrt_expand_vars_sh (config, &expand_lookup_vars_env, config_vars);
@@ -109,9 +114,6 @@ static void access_control_fini(size_t n)
     CU_ASSERT_EQUAL_FATAL (dds_delete (g_domain[i]), DDS_RETCODE_OK);
 }
 
-
-#define PF_F "file:"
-#define PF_D "data:,"
 #define GOV_F PF_F COMMON_ETC_PATH("default_governance.p7s")
 #define GOV_FNE PF_F COMMON_ETC_PATH("default_governance_non_existing.p7s")
 #define GOV_DI PF_D COMMON_ETC_PATH("default_governance.p7s")
@@ -149,14 +151,18 @@ CU_Theory((const char * test_descr, const char * gov, const char * perm, const c
     ddssec_access_control, config_parameters_file)
 {
   print_test_msg ("running test config_parameters_file: %s\n", test_descr);
+  bool has_gov = incl_empty_els || strlen (gov);
+  bool has_perm = incl_empty_els || strlen (perm);
+  bool has_ca = incl_empty_els || strlen (ca);
   access_control_init (
+      2,
       (const char *[]) { TEST_IDENTITY1_CERTIFICATE, TEST_IDENTITY1_CERTIFICATE },
       (const char *[]) { TEST_IDENTITY1_PRIVATE_KEY, TEST_IDENTITY1_PRIVATE_KEY },
       (const char *[]) { TEST_IDENTITY_CA1_CERTIFICATE, TEST_IDENTITY_CA1_CERTIFICATE },
-      (bool []) { exp_fail, exp_fail }, 2,
-      incl_empty_els || strlen (gov), gov,
-      incl_empty_els || strlen (perm), perm,
-      incl_empty_els || strlen (ca), ca);
+      (bool []) { exp_fail, exp_fail }, NULL, NULL,
+      (bool []) { has_gov, has_gov }, (const char *[]) { gov, gov },
+      (bool []) { has_perm, has_perm }, (const char *[]) { perm, perm },
+      (bool []) { has_ca, has_ca }, (const char *[]) { ca, ca });
   access_control_fini (2);
 }
 
@@ -170,8 +176,8 @@ CU_TheoryDataPoints(ddssec_access_control, permissions_expiry) = {
     /*                       |     */"valid -1 minute until now",
     /*                       |      |     */"1s valid, create pp after 1100ms",
     /*                       |      |      |      */"node 2 permissions expired",
-    /*                       |      |      |      |     */"node 1 3s valid, write/read for 10s",
-    /*                       |      |      |      |      |     */"node 2 3s valid, write/read for 10s"),
+    /*                       |      |      |      |     */"node 1 4s valid, write/read for 10s",
+    /*                       |      |      |      |      |     */"node 2 4s valid, write/read for 10s"),
     CU_DataPoints(int32_t,   0,     -M(1), 0,     0,     0,     0),     /* node 1 permissions not before (offset from local time) */
     CU_DataPoints(int32_t,   M(1),  0,     S(1),  D(1),  S(4),  D(1)),  /* node 1 permissions not after (offset from local time) */
     CU_DataPoints(int32_t,   0,     -M(1), 0,     -D(1), 0,     0),     /* node 2 permissions not before (offset from local time) */
@@ -179,14 +185,18 @@ CU_TheoryDataPoints(ddssec_access_control, permissions_expiry) = {
     CU_DataPoints(uint32_t,  0,     0,     1100,  0,     0,     0),     /* delay (ms) after generating permissions */
     CU_DataPoints(bool,      false, true,  true,  false, false, false), /* expect pp 1 create failure */
     CU_DataPoints(bool,      false, true,  true,  true,  false, false), /* expect pp 2 create failure */
-    CU_DataPoints(uint32_t,  1,     0,     0,     0,     10000, 10000),  /* write/read data during x ms */
+    CU_DataPoints(uint32_t,  1,     0,     0,     0,     10000, 10000), /* write/read data during x ms */
     CU_DataPoints(bool,      false, false, false, false, true,  true),  /* expect read data failure */
 };
+#undef S
+#undef D
+#undef H
+#undef M
 CU_Theory(
   (const char * test_descr,
     int32_t perm1_not_before, int32_t perm1_not_after, int32_t perm2_not_before, int32_t perm2_not_after,
     uint32_t delay_perm, bool exp_pp1_fail, bool exp_pp2_fail, uint32_t write_read_dur, bool exp_read_fail),
-  ddssec_access_control, permissions_expiry, .timeout=20)
+  ddssec_access_control, permissions_expiry, .timeout=30)
 {
   print_test_msg ("running test permissions_expiry: %s\n", test_descr);
 
@@ -195,32 +205,38 @@ CU_Theory(
 
   /* create ca and id1/id2 certs that will not expire during this test */
   char *ca, *id1, *id2, *id1_subj, *id2_subj;
-  ca = generate_ca ("ca1", TEST_IDENTITY_CA1_PRIVATE_KEY, 0, D(1));
-  id1 = generate_identity (ca, TEST_IDENTITY_CA1_PRIVATE_KEY, "id1", TEST_IDENTITY1_PRIVATE_KEY, 0, D(1), &id1_subj);
-  id2 = generate_identity (ca, TEST_IDENTITY_CA1_PRIVATE_KEY, "id2", TEST_IDENTITY1_PRIVATE_KEY, 0, D(1), &id2_subj);
+  ca = generate_ca ("ca1", TEST_IDENTITY_CA1_PRIVATE_KEY, 0, 3600);
+  id1 = generate_identity (ca, TEST_IDENTITY_CA1_PRIVATE_KEY, "id1", TEST_IDENTITY1_PRIVATE_KEY, 0, 3600, &id1_subj);
+  id2 = generate_identity (ca, TEST_IDENTITY_CA1_PRIVATE_KEY, "id2", TEST_IDENTITY1_PRIVATE_KEY, 0, 3600, &id2_subj);
 
   /* localtime will be converted to gmtime in get_permissions_grant */
   dds_time_t now = dds_time ();
   char * perm_topic = get_permissions_topic (topic_name);
   char * grants[] = {
-    get_permissions_grant ("id1", id1_subj, now + DDS_SECS(perm1_not_before), now + DDS_SECS(perm1_not_after), perm_topic, perm_topic, NULL),
-    get_permissions_grant ("id2", id2_subj, now + DDS_SECS(perm2_not_before), now + DDS_SECS(perm2_not_after), perm_topic, perm_topic, NULL) };
+    get_permissions_grant ("id1", id1_subj, NULL, now + DDS_SECS(perm1_not_before), now + DDS_SECS(perm1_not_after), perm_topic, perm_topic, NULL),
+    get_permissions_grant ("id2", id2_subj, NULL, now + DDS_SECS(perm2_not_before), now + DDS_SECS(perm2_not_after), perm_topic, perm_topic, NULL) };
   char * perm_config = get_permissions_config (grants, 2, true);
   dds_sleepfor (DDS_MSECS (delay_perm));
 
+  const char * def_gov = PF_F COMMON_ETC_PATH("default_governance.p7s");
+  const char * def_perm_ca = PF_F COMMON_ETC_PATH("default_permissions_ca.pem");
   access_control_init (
+      2,
       (const char *[]) { id1, id2 },
       (const char *[]) { TEST_IDENTITY1_PRIVATE_KEY, TEST_IDENTITY1_PRIVATE_KEY },
       (const char *[]) { ca, ca },
-      (bool []) { exp_pp1_fail, exp_pp2_fail }, 2,
-      true, PF_F COMMON_ETC_PATH("default_governance.p7s"),
-      true, perm_config,
-      true, PF_F COMMON_ETC_PATH("default_permissions_ca.pem"));
+      (bool []) { exp_pp1_fail, exp_pp2_fail }, NULL, NULL,
+      (bool []) { true, true }, (const char *[]) { def_gov, def_gov },
+      (bool []) { true, true }, (const char *[]) { perm_config, perm_config },
+      (bool []) { true, true }, (const char *[]) { def_perm_ca, def_perm_ca });
 
   if (write_read_dur > 0)
   {
     dds_entity_t wr = 0, rd = 0;
-    rd_wr_init (g_participant[0], &g_pubsub[0], &g_topic[0], &wr, g_participant[1], &g_pubsub[1], &g_topic[1], &rd, topic_name);
+    dds_entity_t pub, sub;
+    dds_entity_t topic0, topic1;
+    rd_wr_init (g_participant[0], &pub, &topic0, &wr, g_participant[1], &sub, &topic1, &rd, topic_name);
+    sync_writer_to_readers(g_participant[0], wr, 1);
     write_read_for (wr, g_participant[1], rd, DDS_MSECS (write_read_dur), false, exp_read_fail);
   }
 
@@ -236,9 +252,6 @@ CU_Theory(
   ddsrt_free (id1);
   ddsrt_free (id2);
 }
-#undef D
-#undef H
-#undef M
 
 
 #define N_RD 1 // N_RD > 1 not yet implemented
@@ -256,9 +269,10 @@ CU_Test(ddssec_access_control, permissions_expiry_multiple, .timeout=20)
 
   // 1st node used as reader, other nodes as writer
   print_test_msg ("creating permissions grants\n");
-  const char *id[N_NODES], *pk[N_NODES], *ca_list[N_NODES];
+  const char *id[N_NODES], *pk[N_NODES], *ca_list[N_NODES], *gov[N_NODES], *perm_conf[N_NODES], *perm_ca[N_NODES];
   char * id_subj[N_NODES], *grants[N_NODES];
-  bool exp_fail[N_NODES];
+  bool exp_fail[N_NODES], incl_el[N_NODES];
+
   for (int i = 0; i < N_NODES; i++)
   {
     char *id_name;
@@ -267,20 +281,25 @@ CU_Test(ddssec_access_control, permissions_expiry_multiple, .timeout=20)
     ca_list[i] = ca;
     id[i] = generate_identity (ca_list[i], TEST_IDENTITY_CA1_PRIVATE_KEY, id_name, pk[i], 0, 3600, &id_subj[i]);
     exp_fail[i] = false;
+    gov[i] = PF_F COMMON_ETC_PATH ("default_governance.p7s");
+    perm_ca[i] = PF_F COMMON_ETC_PATH ("default_permissions_ca.pem");
+    incl_el[i] = true;
     dds_duration_t v = DDS_SECS(i < N_RD ? 3600 : PERM_EXP_BASE + 2 * i); /* readers should not expire */
     dds_time_t t_exp = ddsrt_time_add_duration (t_perm, v);
     if (i >= N_RD)
       print_test_msg ("w[%d] grant expires at %d.%06d\n", i - N_RD, (int32_t) (t_exp / DDS_NSECS_IN_SEC), (int32_t) (t_exp % DDS_NSECS_IN_SEC) / 1000);
-    grants[i] = get_permissions_grant (id_name, id_subj[i], t_perm, t_exp, perm_topic, perm_topic, NULL);
+    grants[i] = get_permissions_grant (id_name, id_subj[i], NULL, t_perm, t_exp, perm_topic, perm_topic, NULL);
     ddsrt_free (id_name);
   }
 
-  char * perm_config = get_permissions_config (grants, N_NODES, true);
+  char * perm_config_str = get_permissions_config (grants, N_NODES, true);
+  for (int i = 0; i < N_NODES; i++)
+    perm_conf[i] = perm_config_str;
+
   access_control_init (
-      id, pk, ca_list, exp_fail, N_NODES,
-      true, PF_F COMMON_ETC_PATH ("default_governance.p7s"),
-      true, perm_config,
-      true, PF_F COMMON_ETC_PATH ("default_permissions_ca.pem"));
+      N_NODES,
+      id, pk, ca_list, exp_fail, NULL, NULL,
+      incl_el, gov, incl_el, perm_conf, incl_el, perm_ca);
 
   dds_qos_t * qos = dds_create_qos ();
   CU_ASSERT_FATAL (qos != NULL);
@@ -374,6 +393,156 @@ CU_Test(ddssec_access_control, permissions_expiry_multiple, .timeout=20)
   }
   ddsrt_free (ca);
   ddsrt_free (perm_topic);
-  ddsrt_free (perm_config);
+  ddsrt_free (perm_config_str);
 }
+#undef N_RD
+#undef N_WR
 #undef N_NODES
+#undef PERM_EXP_BASE
+
+#define na false
+CU_TheoryDataPoints(ddssec_access_control, hooks) = {
+    CU_DataPoints(const char *,
+    /*                 */"init_test_access_control_local_participant_not_allowed",
+    /*                  |     */"init_test_access_control_local_topic_not_allowed",
+    /*                  |      |     */"init_test_access_control_local_publishing_not_allowed",
+    /*                  |      |      |      */"init_test_access_control_local_subscribing_not_allowed",
+    /*                  |      |      |      |     */"init_test_access_control_remote_permissions_invalidate",
+    /*                  |      |      |      |      |     */"init_test_access_control_remote_participant_not_allowed",
+    /*                  |      |      |      |      |      |     */"init_test_access_control_remote_topic_not_allowed",
+    /*                  |      |      |      |      |      |      |     */"init_test_access_control_remote_writer_not_allowed",
+    /*                  |      |      |      |      |      |      |      |     */"init_test_access_control_remote_reader_not_allowed",
+    /*                  |      |      |      |      |      |      |      |      |     */"init_test_access_control_remote_reader_relay_only"),
+    CU_DataPoints(bool, true,  false, false, false, false, false, false, false, false, false),  // exp_pp_fail
+    CU_DataPoints(bool, na,    true,  false, false, false, false, false, false, false, false),  // exp_local_topic_fail
+    CU_DataPoints(bool, na,    false, false, false, false, false, false, false, false, false),  // exp_remote_topic_fail
+    CU_DataPoints(bool, na,    na,    true,  false, false, false, false, false, false, false),  // exp_wr_fail
+    CU_DataPoints(bool, na,    na,    false, true,  false, false, false, false, false, false),  // exp_rd_fail
+    CU_DataPoints(bool, na,    na,    na,    na,    true,  true,  true,  false, true,  true),   // exp_wr_rd_sync_fail
+    CU_DataPoints(bool, na,    na,    false, na,    true,  true,  true,  true,  false, false),  // exp_rd_wr_sync_fail
+};
+#undef na
+CU_Theory(
+  (const char * init_fn, bool exp_pp_fail, bool exp_local_topic_fail, bool exp_remote_topic_fail, bool exp_wr_fail, bool exp_rd_fail, bool exp_wr_rd_sync_fail, bool exp_rd_wr_sync_fail),
+  ddssec_access_control, hooks, .timeout=40)
+{
+  print_test_msg ("running test access_control_hooks: %s\n", init_fn);
+
+  const char * def_gov = PF_F COMMON_ETC_PATH("default_governance.p7s");
+  const char * def_perm = PF_F COMMON_ETC_PATH("default_permissions.p7s");
+  const char * def_perm_ca = PF_F COMMON_ETC_PATH("default_permissions_ca.pem");
+
+  access_control_init (
+      2,
+      (const char *[]) { TEST_IDENTITY1_CERTIFICATE, TEST_IDENTITY1_CERTIFICATE },
+      (const char *[]) { TEST_IDENTITY1_PRIVATE_KEY, TEST_IDENTITY1_PRIVATE_KEY },
+      (const char *[]) { TEST_IDENTITY_CA1_CERTIFICATE, TEST_IDENTITY_CA1_CERTIFICATE },
+      (bool []) { exp_pp_fail, false },
+      (const char *[]) { init_fn, "init_test_access_control_wrapped" }, (const char *[]) { "finalize_test_access_control_not_allowed", "finalize_test_access_control_wrapped" },
+      (bool []) { true, true, true }, (const char *[]) { def_gov, def_gov },
+      (bool []) { true, true, true }, (const char *[]) { def_perm, def_perm },
+      (bool []) { true, true, true }, (const char *[]) { def_perm_ca, def_perm_ca });
+
+  if (!exp_pp_fail)
+  {
+    dds_entity_t lwr = 0, rwr = 0, lrd = 0, rrd = 0;
+    dds_entity_t ltopic[2], rtopic[2];
+    dds_entity_t lpub, lsub, rpub, rsub;
+    char topic_name[100];
+
+    // Local writer, remote reader
+    create_topic_name (AC_WRAPPER_TOPIC_PREFIX, g_topic_nr++, topic_name, sizeof (topic_name));
+    rd_wr_init_fail (
+      g_participant[0], &lpub, &ltopic[0], &lwr,
+      g_participant[1], &rsub, &rtopic[0], &rrd,
+      topic_name, exp_local_topic_fail, exp_wr_fail, exp_remote_topic_fail, false);
+    if (!exp_local_topic_fail && !exp_remote_topic_fail && !exp_wr_fail)
+      sync_writer_to_readers (g_participant[0], lwr, exp_wr_rd_sync_fail ? 0 : 1);
+
+    // Local reader, remote writer
+    create_topic_name (AC_WRAPPER_TOPIC_PREFIX, g_topic_nr++, topic_name, sizeof (topic_name));
+    rd_wr_init_fail (
+      g_participant[1], &rpub, &rtopic[1], &rwr,
+      g_participant[0], &lsub, &ltopic[1], &lrd,
+      topic_name, exp_remote_topic_fail, false, exp_local_topic_fail, exp_rd_fail);
+    if (!exp_local_topic_fail && !exp_remote_topic_fail && !exp_rd_fail)
+      sync_reader_to_writers (g_participant[0], lrd, exp_rd_wr_sync_fail ? 0 : 1);
+  }
+
+  access_control_fini (2);
+}
+
+#define na false
+CU_TheoryDataPoints(ddssec_access_control, join_access_control) = {
+    CU_DataPoints(const char *,
+    /*                 */"no join access control",
+    /*                  |     */"join access control pp1, valid",
+    /*                  |      |     */"join access control pp1 and pp2, valid",
+    /*                  |      |      |      */"join access control pp1, invalid",
+    /*                  |      |      |      |     */"join access control pp1 and pp2, invalid"),
+    CU_DataPoints(bool, false, true,  true,  true,  true), /* join access control pp 1 enabled */
+    CU_DataPoints(bool, false, false, true,  false, true), /* join access control pp 2 enabled */
+    CU_DataPoints(bool, false, false, false, true,  true), /* permissions pp 1 invalid */
+    CU_DataPoints(bool, false, false, false, false, true), /* permissions pp 2 invalid */
+    CU_DataPoints(bool, false, false, false, true,  true), /* expect pp 1 create failure */
+    CU_DataPoints(bool, false, false, false, false, true), /* expect pp 2 create failure */
+    CU_DataPoints(bool, false, false, false, na,    na),   /* expect handshake failure */
+};
+#undef na
+CU_Theory(
+  (const char * test_descr, bool join_ac_pp1, bool join_ac_pp2, bool perm_inv_pp1, bool perm_inv_pp2, bool exp_pp1_fail, bool exp_pp2_fail, bool exp_hs_fail),
+  ddssec_access_control, join_access_control, .timeout=30)
+{
+  print_test_msg ("running test join_access_control: %s\n", test_descr);
+
+  char topic_name[100];
+  create_topic_name ("ddssec_access_control_", g_topic_nr++, topic_name, sizeof (topic_name));
+
+  /* create ca and id1/id2 certs that will not expire during this test */
+  char *ca, *id1, *id2, *id1_subj, *id2_subj;
+  ca = generate_ca ("ca1", TEST_IDENTITY_CA1_PRIVATE_KEY, 0, 3600);
+  id1 = generate_identity (ca, TEST_IDENTITY_CA1_PRIVATE_KEY, "id1", TEST_IDENTITY1_PRIVATE_KEY, 0, 3600, &id1_subj);
+  id2 = generate_identity (ca, TEST_IDENTITY_CA1_PRIVATE_KEY, "id2", TEST_IDENTITY1_PRIVATE_KEY, 0, 3600, &id2_subj);
+
+  /* localtime will be converted to gmtime in get_permissions_grant */
+  dds_time_t now = dds_time ();
+  char * perm_topic = get_permissions_topic (topic_name);
+  char * grants[] = {
+    get_permissions_grant ("id1", id1_subj, perm_inv_pp1 ? "99" : NULL, now, now + DDS_SECS(3600), perm_topic, perm_topic, NULL),
+    get_permissions_grant ("id2", id2_subj, perm_inv_pp2 ? "99" : NULL, now, now + DDS_SECS(3600), perm_topic, perm_topic, NULL) };
+  char * perm_config = get_permissions_config (grants, 2, true);
+
+  struct kvp governance_vars_pp1[] = { { "ENABLE_JOIN_AC", join_ac_pp1 ? "true" : "false", 1 }, { NULL, NULL, 0 } };
+  struct kvp governance_vars_pp2[] = { { "ENABLE_JOIN_AC", join_ac_pp2 ? "true" : "false", 1 }, { NULL, NULL, 0 } };
+
+  char * gov_config_pp1 = get_governance_config (governance_vars_pp1, true);
+  char * gov_config_pp2 = get_governance_config (governance_vars_pp2, true);
+  const char * def_perm_ca = PF_F COMMON_ETC_PATH("default_permissions_ca.pem");
+
+  access_control_init (
+      2,
+      (const char *[]) { id1, id2 },
+      (const char *[]) { TEST_IDENTITY1_PRIVATE_KEY, TEST_IDENTITY1_PRIVATE_KEY },
+      (const char *[]) { ca, ca },
+      (bool []) { exp_pp1_fail, exp_pp2_fail }, NULL, NULL,
+      (bool []) { true, true }, (const char *[]) { gov_config_pp1, gov_config_pp2 },
+      (bool []) { true, true }, (const char *[]) { perm_config, perm_config },
+      (bool []) { true, true }, (const char *[]) { def_perm_ca, def_perm_ca });
+
+  if (!exp_pp1_fail && !exp_pp2_fail)
+    validate_handshake (DDS_DOMAINID, exp_hs_fail, NULL, NULL, NULL);
+
+  access_control_fini (2);
+
+  ddsrt_free (gov_config_pp1);
+  ddsrt_free (gov_config_pp2);
+  ddsrt_free (perm_topic);
+  ddsrt_free (grants[0]);
+  ddsrt_free (grants[1]);
+  ddsrt_free (perm_config);
+  ddsrt_free (ca);
+  ddsrt_free (id1_subj);
+  ddsrt_free (id2_subj);
+  ddsrt_free (id1);
+  ddsrt_free (id2);
+}
diff --git a/src/security/core/tests/authentication.c b/src/security/core/tests/authentication.c
index 7a9a21a..fe6aa6a 100644
--- a/src/security/core/tests/authentication.c
+++ b/src/security/core/tests/authentication.c
@@ -309,8 +309,8 @@ CU_Theory(
 
   dds_time_t now = dds_time ();
   char * grants[] = {
-    get_permissions_grant ("id1", id1_subj, now - DDS_SECS(D(1)), now + DDS_SECS(D(1)), NULL, NULL, NULL),
-    get_permissions_grant ("id2", id2_subj, now - DDS_SECS(D(1)), now + DDS_SECS(D(1)), NULL, NULL, NULL) };
+    get_permissions_grant ("id1", id1_subj, NULL, now - DDS_SECS(D(1)), now + DDS_SECS(D(1)), NULL, NULL, NULL),
+    get_permissions_grant ("id2", id2_subj, NULL, now - DDS_SECS(D(1)), now + DDS_SECS(D(1)), NULL, NULL, NULL) };
   char * perm_config = get_permissions_config (grants, 2, true);
   authentication_init (id1, ID1K, ca, id2, ID1K, ca, NULL, perm_config, id1_local_fail, id2_local_fail);
   validate_handshake (DDS_DOMAINID1, id1_local_fail, NULL, NULL, NULL);
@@ -318,6 +318,7 @@ CU_Theory(
   if (write_read_dur > 0)
   {
     rd_wr_init (g_participant1, &g_pub, &g_pub_tp, &g_wr, g_participant2, &g_sub, &g_sub_tp, &g_rd, topic_name);
+    sync_writer_to_readers(g_participant1, g_wr, 1);
     write_read_for (g_wr, g_participant2, g_rd, DDS_MSECS (write_read_dur), false, exp_read_fail);
   }
   authentication_fini (!id1_local_fail, !id2_local_fail);
diff --git a/src/security/core/tests/common/access_control_wrapper.c b/src/security/core/tests/common/access_control_wrapper.c
index 3ba5b68..aead7e6 100644
--- a/src/security/core/tests/common/access_control_wrapper.c
+++ b/src/security/core/tests/common/access_control_wrapper.c
@@ -20,18 +20,49 @@
 #include "dds/security/core/dds_security_utils.h"
 #include "access_control_wrapper.h"
 
+int init_access_control(const char *argument, void **context, struct ddsi_domaingv *gv);
+int finalize_access_control(void *context);
+
 enum ac_plugin_mode {
   PLUGIN_MODE_ALL_OK,
+  PLUGIN_MODE_WRAPPED,
+  PLUGIN_MODE_NOT_ALLOWED,
   PLUGIN_MODE_MISSING_FUNC
 };
 
+enum ac_plugin_not_allowed {
+  NOT_ALLOWED_ID_LOCAL_PP,
+  NOT_ALLOWED_ID_LOCAL_TOPIC,
+  NOT_ALLOWED_ID_LOCAL_PUB,
+  NOT_ALLOWED_ID_LOCAL_SUB,
+  NOT_ALLOWED_ID_REMOTE_PERM,
+  NOT_ALLOWED_ID_REMOTE_PP,
+  NOT_ALLOWED_ID_REMOTE_TOPIC,
+  NOT_ALLOWED_ID_REMOTE_WRITER,
+  NOT_ALLOWED_ID_REMOTE_READER,
+  NOT_ALLOWED_ID_REMOTE_READER_RELAY_ONLY
+};
+
+#define NOT_ALLOWED_LOCAL_PP                      (1u << NOT_ALLOWED_ID_LOCAL_PP)
+#define NOT_ALLOWED_LOCAL_TOPIC                   (1u << NOT_ALLOWED_ID_LOCAL_TOPIC)
+#define NOT_ALLOWED_LOCAL_PUB                     (1u << NOT_ALLOWED_ID_LOCAL_PUB)
+#define NOT_ALLOWED_LOCAL_SUB                     (1u << NOT_ALLOWED_ID_LOCAL_SUB)
+#define NOT_ALLOWED_REMOTE_PERM                   (1u << NOT_ALLOWED_ID_REMOTE_PERM)
+#define NOT_ALLOWED_REMOTE_PP                     (1u << NOT_ALLOWED_ID_REMOTE_PP)
+#define NOT_ALLOWED_REMOTE_TOPIC                  (1u << NOT_ALLOWED_ID_REMOTE_TOPIC)
+#define NOT_ALLOWED_REMOTE_WRITER                 (1u << NOT_ALLOWED_ID_REMOTE_WRITER)
+#define NOT_ALLOWED_REMOTE_READER                 (1u << NOT_ALLOWED_ID_REMOTE_READER)
+#define NOT_ALLOWED_REMOTE_READER_RELAY_ONLY      (1u << NOT_ALLOWED_ID_REMOTE_READER_RELAY_ONLY)
+
 /**
  * Implementation structure for storing encapsulated members of the instance
  * while giving only the interface definition to user
  */
 struct dds_security_access_control_impl {
   dds_security_access_control base;
+  dds_security_access_control *instance;
   enum ac_plugin_mode mode;
+  uint32_t not_allowed_mask;
 };
 
 static DDS_Security_PermissionsHandle validate_local_permissions(
@@ -42,14 +73,16 @@ static DDS_Security_PermissionsHandle validate_local_permissions(
     const DDS_Security_Qos *participant_qos,
     DDS_Security_SecurityException *ex)
 {
-  DDSRT_UNUSED_ARG(auth_plugin);
-  DDSRT_UNUSED_ARG(auth_plugin);
-  DDSRT_UNUSED_ARG(identity);
-  DDSRT_UNUSED_ARG(domain_id);
-  DDSRT_UNUSED_ARG(participant_qos);
-  DDSRT_UNUSED_ARG(ex);
-  DDSRT_UNUSED_ARG(instance);
-  return 1;
+  struct dds_security_access_control_impl *impl = (struct dds_security_access_control_impl *)instance;
+  switch (impl->mode)
+  {
+    case PLUGIN_MODE_WRAPPED:
+    case PLUGIN_MODE_NOT_ALLOWED:
+      return impl->instance->validate_local_permissions(impl->instance, auth_plugin, identity, domain_id, participant_qos, ex);
+
+    default:
+      return 1;
+  }
 }
 
 static DDS_Security_PermissionsHandle validate_remote_permissions(
@@ -61,31 +94,54 @@ static DDS_Security_PermissionsHandle validate_remote_permissions(
     const DDS_Security_AuthenticatedPeerCredentialToken *remote_credential_token,
     DDS_Security_SecurityException *ex)
 {
-  DDSRT_UNUSED_ARG(auth_plugin);
-  DDSRT_UNUSED_ARG(local_identity_handle);
-  DDSRT_UNUSED_ARG(remote_identity_handle);
-  DDSRT_UNUSED_ARG(remote_permissions_token);
-  DDSRT_UNUSED_ARG(remote_credential_token);
-  DDSRT_UNUSED_ARG(ex);
-  DDSRT_UNUSED_ARG(instance);
-  return 0;
+  struct dds_security_access_control_impl *impl = (struct dds_security_access_control_impl *)instance;
+  switch (impl->mode)
+  {
+    case PLUGIN_MODE_NOT_ALLOWED:
+      if (impl->not_allowed_mask & NOT_ALLOWED_REMOTE_PERM)
+      {
+        ex->code = 1;
+        ex->message = ddsrt_strdup ("not_allowed: validate_remote_permissions");
+        return 0;
+      }
+      /* fall through */
+    case PLUGIN_MODE_WRAPPED:
+      return impl->instance->validate_remote_permissions(impl->instance, auth_plugin, local_identity_handle, remote_identity_handle,
+        remote_permissions_token, remote_credential_token, ex);
+
+    default:
+      return 0;
+  }
 }
 
-static DDS_Security_boolean check_create_participant( dds_security_access_control *instance,
+static DDS_Security_boolean check_create_participant(
+    dds_security_access_control *instance,
     const DDS_Security_PermissionsHandle permissions_handle,
     const DDS_Security_DomainId domain_id,
     const DDS_Security_Qos *participant_qos,
     DDS_Security_SecurityException *ex)
 {
-  DDSRT_UNUSED_ARG(permissions_handle);
-  DDSRT_UNUSED_ARG(domain_id);
-  DDSRT_UNUSED_ARG(participant_qos);
-  DDSRT_UNUSED_ARG(ex);
-  DDSRT_UNUSED_ARG(instance);
-  return true;
+  struct dds_security_access_control_impl *impl = (struct dds_security_access_control_impl *)instance;
+  switch (impl->mode)
+  {
+    case PLUGIN_MODE_NOT_ALLOWED:
+      if (impl->not_allowed_mask & NOT_ALLOWED_LOCAL_PP)
+      {
+        ex->code = 1;
+        ex->message = ddsrt_strdup ("not_allowed: check_create_participant");
+        return false;
+      }
+      /* fall through */
+    case PLUGIN_MODE_WRAPPED:
+      return impl->instance->check_create_participant(impl->instance, permissions_handle, domain_id, participant_qos, ex);
+
+    default:
+      return true;
+  }
 }
 
-static DDS_Security_boolean check_create_datawriter( dds_security_access_control *instance,
+static DDS_Security_boolean check_create_datawriter(
+    dds_security_access_control *instance,
     const DDS_Security_PermissionsHandle permissions_handle,
     const DDS_Security_DomainId domain_id,
     const char *topic_name,
@@ -94,18 +150,30 @@ static DDS_Security_boolean check_create_datawriter( dds_security_access_control
     const DDS_Security_DataTags *data_tag,
     DDS_Security_SecurityException *ex)
 {
-  DDSRT_UNUSED_ARG(permissions_handle);
-  DDSRT_UNUSED_ARG(domain_id);
-  DDSRT_UNUSED_ARG(topic_name);
-  DDSRT_UNUSED_ARG(writer_qos);
-  DDSRT_UNUSED_ARG(partition);
-  DDSRT_UNUSED_ARG(data_tag);
-  DDSRT_UNUSED_ARG(ex);
-  DDSRT_UNUSED_ARG(instance);
-  return true;
+  struct dds_security_access_control_impl *impl = (struct dds_security_access_control_impl *)instance;
+  switch (impl->mode)
+  {
+    case PLUGIN_MODE_NOT_ALLOWED:
+      if (impl->not_allowed_mask & NOT_ALLOWED_LOCAL_PUB)
+      {
+        if (topic_name && strncmp (topic_name, AC_WRAPPER_TOPIC_PREFIX, strlen (AC_WRAPPER_TOPIC_PREFIX)) == 0)
+        {
+          ex->code = 1;
+          ex->message = ddsrt_strdup ("not_allowed: check_create_datawriter");
+          return false;
+        }
+      }
+      /* fall through */
+    case PLUGIN_MODE_WRAPPED:
+      return impl->instance->check_create_datawriter(impl->instance, permissions_handle, domain_id, topic_name, writer_qos, partition, data_tag, ex);
+
+    default:
+      return true;
+  }
 }
 
-static DDS_Security_boolean check_create_datareader( dds_security_access_control *instance,
+static DDS_Security_boolean check_create_datareader(
+    dds_security_access_control *instance,
     const DDS_Security_PermissionsHandle permissions_handle,
     const DDS_Security_DomainId domain_id,
     const char *topic_name,
@@ -114,31 +182,50 @@ static DDS_Security_boolean check_create_datareader( dds_security_access_control
     const DDS_Security_DataTags *data_tag,
     DDS_Security_SecurityException *ex)
 {
-  DDSRT_UNUSED_ARG(permissions_handle);
-  DDSRT_UNUSED_ARG(domain_id);
-  DDSRT_UNUSED_ARG(topic_name);
-  DDSRT_UNUSED_ARG(reader_qos);
-  DDSRT_UNUSED_ARG(partition);
-  DDSRT_UNUSED_ARG(data_tag);
-  DDSRT_UNUSED_ARG(ex);
-  DDSRT_UNUSED_ARG(instance);
-  return true;
+  struct dds_security_access_control_impl *impl = (struct dds_security_access_control_impl *)instance;
+  switch (impl->mode)
+  {
+    case PLUGIN_MODE_NOT_ALLOWED:
+      if (impl->not_allowed_mask & NOT_ALLOWED_LOCAL_SUB)
+      {
+        ex->code = 1;
+        ex->message = ddsrt_strdup ("not_allowed: check_create_datareader");
+        return false;
+      }
+      /* fall through */
+    case PLUGIN_MODE_WRAPPED:
+      return impl->instance->check_create_datareader(impl->instance, permissions_handle, domain_id, topic_name, reader_qos, partition, data_tag, ex);
+
+    default:
+      return true;
+  }
 }
 
-static DDS_Security_boolean check_create_topic( dds_security_access_control *instance,
+static DDS_Security_boolean check_create_topic(
+    dds_security_access_control *instance,
     const DDS_Security_PermissionsHandle permissions_handle,
     const DDS_Security_DomainId domain_id,
     const char *topic_name,
     const DDS_Security_Qos *qos,
     DDS_Security_SecurityException *ex)
 {
-  DDSRT_UNUSED_ARG(permissions_handle);
-  DDSRT_UNUSED_ARG(domain_id);
-  DDSRT_UNUSED_ARG(topic_name);
-  DDSRT_UNUSED_ARG(qos);
-  DDSRT_UNUSED_ARG(ex);
-  DDSRT_UNUSED_ARG(instance);
-  return true;
+  struct dds_security_access_control_impl *impl = (struct dds_security_access_control_impl *)instance;
+  switch (impl->mode)
+  {
+    case PLUGIN_MODE_NOT_ALLOWED:
+      if (impl->not_allowed_mask & NOT_ALLOWED_LOCAL_TOPIC)
+      {
+        ex->code = 1;
+        ex->message = ddsrt_strdup ("not_allowed: check_create_topic");
+        return false;
+      }
+      /* fall through */
+    case PLUGIN_MODE_WRAPPED:
+      return impl->instance->check_create_topic(impl->instance, permissions_handle, domain_id, topic_name, qos, ex);
+
+    default:
+      return true;
+  }
 }
 
 static DDS_Security_boolean check_local_datawriter_register_instance(
@@ -148,12 +235,16 @@ static DDS_Security_boolean check_local_datawriter_register_instance(
     const DDS_Security_DynamicData *key,
     DDS_Security_SecurityException *ex)
 {
-  DDSRT_UNUSED_ARG(permissions_handle);
-  DDSRT_UNUSED_ARG(writer);
-  DDSRT_UNUSED_ARG(key);
-  DDSRT_UNUSED_ARG(ex);
-  DDSRT_UNUSED_ARG(instance);
-  return true;
+  struct dds_security_access_control_impl *impl = (struct dds_security_access_control_impl *)instance;
+  switch (impl->mode)
+  {
+    case PLUGIN_MODE_WRAPPED:
+    case PLUGIN_MODE_NOT_ALLOWED:
+      return impl->instance->check_local_datawriter_register_instance(impl->instance, permissions_handle, writer, key, ex);
+
+    default:
+      return true;
+  }
 }
 
 static DDS_Security_boolean check_local_datawriter_dispose_instance(
@@ -163,69 +254,137 @@ static DDS_Security_boolean check_local_datawriter_dispose_instance(
     const DDS_Security_DynamicData key,
     DDS_Security_SecurityException *ex)
 {
-  DDSRT_UNUSED_ARG(permissions_handle);
-  DDSRT_UNUSED_ARG(writer);
-  DDSRT_UNUSED_ARG(key);
-  DDSRT_UNUSED_ARG(ex);
-  DDSRT_UNUSED_ARG(instance);
-  return true;
+  struct dds_security_access_control_impl *impl = (struct dds_security_access_control_impl *)instance;
+  switch (impl->mode)
+  {
+    case PLUGIN_MODE_WRAPPED:
+    case PLUGIN_MODE_NOT_ALLOWED:
+      return impl->instance->check_local_datawriter_dispose_instance(impl->instance, permissions_handle, writer, key, ex);
+
+    default:
+      return true;
+  }
 }
 
-static DDS_Security_boolean check_remote_participant( dds_security_access_control *instance,
+static DDS_Security_boolean check_remote_participant(
+    dds_security_access_control *instance,
     const DDS_Security_PermissionsHandle permissions_handle,
     const DDS_Security_DomainId domain_id,
     const DDS_Security_ParticipantBuiltinTopicDataSecure *participant_data,
     DDS_Security_SecurityException *ex)
 {
-  DDSRT_UNUSED_ARG(permissions_handle);
-  DDSRT_UNUSED_ARG(domain_id);
-  DDSRT_UNUSED_ARG(participant_data);
-  DDSRT_UNUSED_ARG(ex);
-  DDSRT_UNUSED_ARG(instance);
-  return true;
+  struct dds_security_access_control_impl *impl = (struct dds_security_access_control_impl *)instance;
+  switch (impl->mode)
+  {
+    case PLUGIN_MODE_NOT_ALLOWED:
+      if (impl->not_allowed_mask & NOT_ALLOWED_REMOTE_PP)
+      {
+        ex->code = 1;
+        ex->message = ddsrt_strdup ("not_allowed: check_remote_participant");
+        return false;
+      }
+      /* fall through */
+    case PLUGIN_MODE_WRAPPED:
+      return impl->instance->check_remote_participant(impl->instance, permissions_handle, domain_id, participant_data, ex);
+
+    default:
+      return true;
+  }
 }
 
-static DDS_Security_boolean check_remote_datawriter( dds_security_access_control *instance,
+static DDS_Security_boolean check_remote_datawriter(
+    dds_security_access_control *instance,
     const DDS_Security_PermissionsHandle permissions_handle,
     const DDS_Security_DomainId domain_id,
     const DDS_Security_PublicationBuiltinTopicDataSecure *publication_data,
     DDS_Security_SecurityException *ex)
 {
-  DDSRT_UNUSED_ARG(permissions_handle);
-  DDSRT_UNUSED_ARG(domain_id);
-  DDSRT_UNUSED_ARG(publication_data);
-  DDSRT_UNUSED_ARG(ex);
-  DDSRT_UNUSED_ARG(instance);
-  return true;
+  struct dds_security_access_control_impl *impl = (struct dds_security_access_control_impl *)instance;
+  switch (impl->mode)
+  {
+    case PLUGIN_MODE_NOT_ALLOWED:
+      if (impl->not_allowed_mask & NOT_ALLOWED_REMOTE_WRITER)
+      {
+        ex->code = 1;
+        ex->message = ddsrt_strdup ("not_allowed: check_remote_datawriter");
+        return false;
+      }
+      /* fall through */
+    case PLUGIN_MODE_WRAPPED:
+      return impl->instance->check_remote_datawriter(impl->instance, permissions_handle, domain_id, publication_data, ex);
+
+    default:
+      return true;
+  }
 }
 
-static DDS_Security_boolean check_remote_datareader( dds_security_access_control *instance,
+static DDS_Security_boolean check_remote_datareader(
+    dds_security_access_control *instance,
     const DDS_Security_PermissionsHandle permissions_handle,
     const DDS_Security_DomainId domain_id,
     const DDS_Security_SubscriptionBuiltinTopicDataSecure *subscription_data,
-    DDS_Security_boolean *relay_only, DDS_Security_SecurityException *ex)
+    DDS_Security_boolean *relay_only,
+    DDS_Security_SecurityException *ex)
 {
-  DDSRT_UNUSED_ARG(permissions_handle);
-  DDSRT_UNUSED_ARG(domain_id);
-  DDSRT_UNUSED_ARG(subscription_data);
-  DDSRT_UNUSED_ARG(ex);
-  DDSRT_UNUSED_ARG(instance);
-  *relay_only = false;
-  return true;
+  struct dds_security_access_control_impl *impl = (struct dds_security_access_control_impl *)instance;
+  switch (impl->mode)
+  {
+    case PLUGIN_MODE_NOT_ALLOWED:
+      if (impl->not_allowed_mask & NOT_ALLOWED_REMOTE_READER)
+      {
+        if (subscription_data->topic_name && strncmp (subscription_data->topic_name, AC_WRAPPER_TOPIC_PREFIX, strlen (AC_WRAPPER_TOPIC_PREFIX)) == 0)
+        {
+          ex->code = 1;
+          ex->message = ddsrt_strdup ("not_allowed: check_remote_datareader");
+          return false;
+        }
+      }
+      /* fall through */
+    case PLUGIN_MODE_WRAPPED:
+    {
+      bool ret;
+      if ((ret = impl->instance->check_remote_datareader(impl->instance, permissions_handle, domain_id, subscription_data, relay_only, ex)))
+      {
+        /* Only relay_only for the user reader, not the builtin ones. */
+        if (impl->mode == PLUGIN_MODE_NOT_ALLOWED && impl->not_allowed_mask & NOT_ALLOWED_REMOTE_READER_RELAY_ONLY)
+        {
+          if (subscription_data->topic_name && strncmp (subscription_data->topic_name, AC_WRAPPER_TOPIC_PREFIX, strlen (AC_WRAPPER_TOPIC_PREFIX)) == 0)
+            *relay_only = true;
+        }
+      }
+      return ret;
+    }
+
+    default:
+      *relay_only = false;
+      return true;
+  }
 }
 
-static DDS_Security_boolean check_remote_topic( dds_security_access_control *instance,
+static DDS_Security_boolean check_remote_topic(
+    dds_security_access_control *instance,
     const DDS_Security_PermissionsHandle permissions_handle,
     const DDS_Security_DomainId domain_id,
     const DDS_Security_TopicBuiltinTopicData *topic_data,
     DDS_Security_SecurityException *ex)
 {
-  DDSRT_UNUSED_ARG(permissions_handle);
-  DDSRT_UNUSED_ARG(domain_id);
-  DDSRT_UNUSED_ARG(topic_data);
-  DDSRT_UNUSED_ARG(ex);
-  DDSRT_UNUSED_ARG(instance);
-  return true;
+  struct dds_security_access_control_impl *impl = (struct dds_security_access_control_impl *)instance;
+  switch (impl->mode)
+  {
+    case PLUGIN_MODE_NOT_ALLOWED:
+      if (impl->not_allowed_mask & NOT_ALLOWED_REMOTE_TOPIC)
+      {
+        ex->code = 1;
+        ex->message = ddsrt_strdup ("not_allowed: check_remote_topic");
+        return false;
+      }
+      /* fall through */
+    case PLUGIN_MODE_WRAPPED:
+      return impl->instance->check_remote_topic(impl->instance, permissions_handle, domain_id, topic_data, ex);
+
+    default:
+      return true;
+  }
 }
 
 static DDS_Security_boolean check_local_datawriter_match(
@@ -236,13 +395,16 @@ static DDS_Security_boolean check_local_datawriter_match(
     const DDS_Security_SubscriptionBuiltinTopicDataSecure *subscription_data,
     DDS_Security_SecurityException *ex)
 {
-  DDSRT_UNUSED_ARG(writer_permissions_handle);
-  DDSRT_UNUSED_ARG(reader_permissions_handle);
-  DDSRT_UNUSED_ARG(publication_data);
-  DDSRT_UNUSED_ARG(subscription_data);
-  DDSRT_UNUSED_ARG(ex);
-  DDSRT_UNUSED_ARG(instance);
-  return true;
+  struct dds_security_access_control_impl *impl = (struct dds_security_access_control_impl *)instance;
+  switch (impl->mode)
+  {
+    case PLUGIN_MODE_WRAPPED:
+    case PLUGIN_MODE_NOT_ALLOWED:
+      return impl->instance->check_local_datawriter_match(impl->instance, writer_permissions_handle, reader_permissions_handle, publication_data, subscription_data, ex);
+
+    default:
+      return true;
+  }
 }
 
 static DDS_Security_boolean check_local_datareader_match(
@@ -253,13 +415,16 @@ static DDS_Security_boolean check_local_datareader_match(
     const DDS_Security_PublicationBuiltinTopicDataSecure *publication_data,
     DDS_Security_SecurityException *ex)
 {
-  DDSRT_UNUSED_ARG(reader_permissions_handle);
-  DDSRT_UNUSED_ARG(writer_permissions_handle);
-  DDSRT_UNUSED_ARG(subscription_data);
-  DDSRT_UNUSED_ARG(publication_data);
-  DDSRT_UNUSED_ARG(ex);
-  DDSRT_UNUSED_ARG(instance);
-  return true;
+  struct dds_security_access_control_impl *impl = (struct dds_security_access_control_impl *)instance;
+  switch (impl->mode)
+  {
+    case PLUGIN_MODE_WRAPPED:
+    case PLUGIN_MODE_NOT_ALLOWED:
+      return impl->instance->check_local_datareader_match(impl->instance, reader_permissions_handle, writer_permissions_handle, subscription_data, publication_data, ex);
+
+    default:
+      return true;
+  }
 }
 
 static DDS_Security_boolean check_remote_datawriter_register_instance(
@@ -271,14 +436,16 @@ static DDS_Security_boolean check_remote_datawriter_register_instance(
     const DDS_Security_InstanceHandle instance_handle,
     DDS_Security_SecurityException *ex)
 {
-  DDSRT_UNUSED_ARG(permissions_handle);
-  DDSRT_UNUSED_ARG(reader);
-  DDSRT_UNUSED_ARG(publication_handle);
-  DDSRT_UNUSED_ARG(key);
-  DDSRT_UNUSED_ARG(instance_handle);
-  DDSRT_UNUSED_ARG(ex);
-  DDSRT_UNUSED_ARG(instance);
-  return true;
+  struct dds_security_access_control_impl *impl = (struct dds_security_access_control_impl *)instance;
+  switch (impl->mode)
+  {
+    case PLUGIN_MODE_WRAPPED:
+    case PLUGIN_MODE_NOT_ALLOWED:
+      return impl->instance->check_remote_datawriter_register_instance(impl->instance, permissions_handle, reader, publication_handle, key, instance_handle, ex);
+
+    default:
+      return true;
+  }
 }
 
 static DDS_Security_boolean check_remote_datawriter_dispose_instance(
@@ -289,13 +456,16 @@ static DDS_Security_boolean check_remote_datawriter_dispose_instance(
     const DDS_Security_DynamicData key,
     DDS_Security_SecurityException *ex)
 {
-  DDSRT_UNUSED_ARG(permissions_handle);
-  DDSRT_UNUSED_ARG(reader);
-  DDSRT_UNUSED_ARG(publication_handle);
-  DDSRT_UNUSED_ARG(key);
-  DDSRT_UNUSED_ARG(ex);
-  DDSRT_UNUSED_ARG(instance);
-  return true;
+  struct dds_security_access_control_impl *impl = (struct dds_security_access_control_impl *)instance;
+  switch (impl->mode)
+  {
+    case PLUGIN_MODE_WRAPPED:
+    case PLUGIN_MODE_NOT_ALLOWED:
+      return impl->instance->check_remote_datawriter_dispose_instance(impl->instance, permissions_handle, reader, publication_handle, key, ex);
+
+    default:
+      return true;
+  }
 }
 
 static DDS_Security_boolean get_permissions_token(
@@ -304,12 +474,18 @@ static DDS_Security_boolean get_permissions_token(
     const DDS_Security_PermissionsHandle handle,
     DDS_Security_SecurityException *ex)
 {
-  DDSRT_UNUSED_ARG(handle);
-  DDSRT_UNUSED_ARG(ex);
-  DDSRT_UNUSED_ARG(instance);
-  memset(permissions_token, 0, sizeof(*permissions_token));
-  permissions_token->class_id = ddsrt_strdup("");
-  return true;
+  struct dds_security_access_control_impl *impl = (struct dds_security_access_control_impl *)instance;
+  switch (impl->mode)
+  {
+    case PLUGIN_MODE_WRAPPED:
+    case PLUGIN_MODE_NOT_ALLOWED:
+      return impl->instance->get_permissions_token(impl->instance, permissions_token, handle, ex);
+
+    default:
+      memset(permissions_token, 0, sizeof(*permissions_token));
+      permissions_token->class_id = ddsrt_strdup ("");
+      return true;
+  }
 }
 
 static DDS_Security_boolean get_permissions_credential_token(
@@ -318,31 +494,51 @@ static DDS_Security_boolean get_permissions_credential_token(
     const DDS_Security_PermissionsHandle handle,
     DDS_Security_SecurityException *ex)
 {
-  DDSRT_UNUSED_ARG(permissions_credential_token);
-  DDSRT_UNUSED_ARG(handle);
-  DDSRT_UNUSED_ARG(ex);
-  DDSRT_UNUSED_ARG(instance);
-  return true;
+  struct dds_security_access_control_impl *impl = (struct dds_security_access_control_impl *)instance;
+  switch (impl->mode)
+  {
+    case PLUGIN_MODE_WRAPPED:
+    case PLUGIN_MODE_NOT_ALLOWED:
+      return impl->instance->get_permissions_credential_token(impl->instance, permissions_credential_token, handle, ex);
+
+    default:
+      return true;
+  }
 }
 
-static DDS_Security_boolean set_listener( dds_security_access_control *instance,
+static DDS_Security_boolean set_listener(
+    dds_security_access_control *instance,
     const dds_security_access_control_listener *listener,
     DDS_Security_SecurityException *ex)
 {
-  DDSRT_UNUSED_ARG(listener);
-  DDSRT_UNUSED_ARG(ex);
-  DDSRT_UNUSED_ARG(instance);
-  return true;
+  struct dds_security_access_control_impl *impl = (struct dds_security_access_control_impl *)instance;
+  switch (impl->mode)
+  {
+    case PLUGIN_MODE_WRAPPED:
+    case PLUGIN_MODE_NOT_ALLOWED:
+      return impl->instance->set_listener (impl->instance, listener, ex);
+
+    default:
+      return true;
+  }
 }
 
-static DDS_Security_boolean return_permissions_token( dds_security_access_control *instance,
+static DDS_Security_boolean return_permissions_token(
+    dds_security_access_control *instance,
     const DDS_Security_PermissionsToken *token,
     DDS_Security_SecurityException *ex)
 {
-  DDSRT_UNUSED_ARG(ex);
-  DDSRT_UNUSED_ARG(instance);
-  ddsrt_free (token->class_id);
-  return true;
+  struct dds_security_access_control_impl *impl = (struct dds_security_access_control_impl *)instance;
+  switch (impl->mode)
+  {
+    case PLUGIN_MODE_WRAPPED:
+    case PLUGIN_MODE_NOT_ALLOWED:
+      return impl->instance->return_permissions_token (impl->instance, token, ex);
+
+    default:
+      ddsrt_free (token->class_id);
+      return true;
+  }
 }
 
 static DDS_Security_boolean return_permissions_credential_token(
@@ -350,10 +546,16 @@ static DDS_Security_boolean return_permissions_credential_token(
     const DDS_Security_PermissionsCredentialToken *permissions_credential_token,
     DDS_Security_SecurityException *ex)
 {
-  DDSRT_UNUSED_ARG(permissions_credential_token);
-  DDSRT_UNUSED_ARG(ex);
-  DDSRT_UNUSED_ARG(instance);
-  return true;
+  struct dds_security_access_control_impl *impl = (struct dds_security_access_control_impl *)instance;
+  switch (impl->mode)
+  {
+    case PLUGIN_MODE_WRAPPED:
+    case PLUGIN_MODE_NOT_ALLOWED:
+      return impl->instance->return_permissions_credential_token(impl->instance, permissions_credential_token, ex);
+
+    default:
+      return true;
+  }
 }
 
 static DDS_Security_boolean get_participant_sec_attributes(
@@ -362,25 +564,35 @@ static DDS_Security_boolean get_participant_sec_attributes(
     DDS_Security_ParticipantSecurityAttributes *attributes,
     DDS_Security_SecurityException *ex)
 {
-  DDSRT_UNUSED_ARG(permissions_handle);
-  DDSRT_UNUSED_ARG(attributes);
-  DDSRT_UNUSED_ARG(ex);
-  DDSRT_UNUSED_ARG(instance);
-  return true;
+  struct dds_security_access_control_impl *impl = (struct dds_security_access_control_impl *)instance;
+  switch (impl->mode)
+  {
+    case PLUGIN_MODE_WRAPPED:
+    case PLUGIN_MODE_NOT_ALLOWED:
+      return impl->instance->get_participant_sec_attributes(impl->instance, permissions_handle, attributes, ex);
+
+    default:
+      return true;
+  }
 }
 
-static DDS_Security_boolean get_topic_sec_attributes( dds_security_access_control *instance,
+static DDS_Security_boolean get_topic_sec_attributes(
+    dds_security_access_control *instance,
     const DDS_Security_PermissionsHandle permissions_handle,
     const char *topic_name,
     DDS_Security_TopicSecurityAttributes *attributes,
     DDS_Security_SecurityException *ex)
 {
-  DDSRT_UNUSED_ARG(permissions_handle);
-  DDSRT_UNUSED_ARG(topic_name);
-  DDSRT_UNUSED_ARG(attributes);
-  DDSRT_UNUSED_ARG(ex);
-  DDSRT_UNUSED_ARG(instance);
-  return true;
+  struct dds_security_access_control_impl *impl = (struct dds_security_access_control_impl *)instance;
+  switch (impl->mode)
+  {
+    case PLUGIN_MODE_WRAPPED:
+    case PLUGIN_MODE_NOT_ALLOWED:
+      return impl->instance->get_topic_sec_attributes(impl->instance, permissions_handle, topic_name, attributes, ex);
+
+    default:
+      return true;
+  }
 }
 
 static DDS_Security_boolean get_datawriter_sec_attributes(
@@ -392,14 +604,16 @@ static DDS_Security_boolean get_datawriter_sec_attributes(
     DDS_Security_EndpointSecurityAttributes *attributes,
     DDS_Security_SecurityException *ex)
 {
-  DDSRT_UNUSED_ARG(permissions_handle);
-  DDSRT_UNUSED_ARG(topic_name);
-  DDSRT_UNUSED_ARG(partition);
-  DDSRT_UNUSED_ARG(data_tag);
-  DDSRT_UNUSED_ARG(attributes);
-  DDSRT_UNUSED_ARG(ex);
-  DDSRT_UNUSED_ARG(instance);
-  return true;
+  struct dds_security_access_control_impl *impl = (struct dds_security_access_control_impl *)instance;
+  switch (impl->mode)
+  {
+    case PLUGIN_MODE_WRAPPED:
+    case PLUGIN_MODE_NOT_ALLOWED:
+      return impl->instance->get_datawriter_sec_attributes(impl->instance, permissions_handle, topic_name, partition, data_tag, attributes, ex);
+
+    default:
+      return true;
+  }
 }
 
 static DDS_Security_boolean get_datareader_sec_attributes(
@@ -411,14 +625,16 @@ static DDS_Security_boolean get_datareader_sec_attributes(
     DDS_Security_EndpointSecurityAttributes *attributes,
     DDS_Security_SecurityException *ex)
 {
-  DDSRT_UNUSED_ARG(permissions_handle);
-  DDSRT_UNUSED_ARG(topic_name);
-  DDSRT_UNUSED_ARG(partition);
-  DDSRT_UNUSED_ARG(data_tag);
-  DDSRT_UNUSED_ARG(attributes);
-  DDSRT_UNUSED_ARG(ex);
-  DDSRT_UNUSED_ARG(instance);
-  return true;
+  struct dds_security_access_control_impl *impl = (struct dds_security_access_control_impl *)instance;
+  switch (impl->mode)
+  {
+    case PLUGIN_MODE_WRAPPED:
+    case PLUGIN_MODE_NOT_ALLOWED:
+      return impl->instance->get_datareader_sec_attributes(impl->instance, permissions_handle, topic_name, partition, data_tag, attributes, ex);
+
+    default:
+      return true;
+  }
 }
 
 static DDS_Security_boolean return_participant_sec_attributes(
@@ -426,10 +642,16 @@ static DDS_Security_boolean return_participant_sec_attributes(
     const DDS_Security_ParticipantSecurityAttributes *attributes,
     DDS_Security_SecurityException *ex)
 {
-  DDSRT_UNUSED_ARG(attributes);
-  DDSRT_UNUSED_ARG(ex);
-  DDSRT_UNUSED_ARG(instance);
-  return true;
+  struct dds_security_access_control_impl *impl = (struct dds_security_access_control_impl *)instance;
+  switch (impl->mode)
+  {
+    case PLUGIN_MODE_WRAPPED:
+    case PLUGIN_MODE_NOT_ALLOWED:
+      return impl->instance->return_participant_sec_attributes(impl->instance, attributes, ex);
+
+    default:
+      return true;
+  }
 }
 
 static DDS_Security_boolean return_topic_sec_attributes(
@@ -437,10 +659,16 @@ static DDS_Security_boolean return_topic_sec_attributes(
     const DDS_Security_TopicSecurityAttributes *attributes,
     DDS_Security_SecurityException *ex)
 {
-  DDSRT_UNUSED_ARG(attributes);
-  DDSRT_UNUSED_ARG(ex);
-  DDSRT_UNUSED_ARG(instance);
-  return true;
+  struct dds_security_access_control_impl *impl = (struct dds_security_access_control_impl *)instance;
+  switch (impl->mode)
+  {
+    case PLUGIN_MODE_WRAPPED:
+    case PLUGIN_MODE_NOT_ALLOWED:
+      return impl->instance->return_topic_sec_attributes(impl->instance, attributes, ex);
+
+    default:
+      return true;
+  }
 }
 
 static DDS_Security_boolean return_datawriter_sec_attributes(
@@ -448,10 +676,16 @@ static DDS_Security_boolean return_datawriter_sec_attributes(
     const DDS_Security_EndpointSecurityAttributes *attributes,
     DDS_Security_SecurityException *ex)
 {
-  DDSRT_UNUSED_ARG(attributes);
-  DDSRT_UNUSED_ARG(ex);
-  DDSRT_UNUSED_ARG(instance);
-  return true;
+  struct dds_security_access_control_impl *impl = (struct dds_security_access_control_impl *)instance;
+  switch (impl->mode)
+  {
+    case PLUGIN_MODE_WRAPPED:
+    case PLUGIN_MODE_NOT_ALLOWED:
+      return impl->instance->return_datawriter_sec_attributes(impl->instance, attributes, ex);
+
+    default:
+      return true;
+  }
 }
 
 static DDS_Security_boolean return_datareader_sec_attributes(
@@ -459,10 +693,16 @@ static DDS_Security_boolean return_datareader_sec_attributes(
     const DDS_Security_EndpointSecurityAttributes *attributes,
     DDS_Security_SecurityException *ex)
 {
-  DDSRT_UNUSED_ARG(attributes);
-  DDSRT_UNUSED_ARG(ex);
-  DDSRT_UNUSED_ARG(instance);
-  return true;
+  struct dds_security_access_control_impl *impl = (struct dds_security_access_control_impl *)instance;
+  switch (impl->mode)
+  {
+    case PLUGIN_MODE_WRAPPED:
+    case PLUGIN_MODE_NOT_ALLOWED:
+      return impl->instance->return_datareader_sec_attributes(impl->instance, attributes, ex);
+
+    default:
+      return true;
+  }
 }
 
 static DDS_Security_boolean return_permissions_handle(
@@ -470,17 +710,29 @@ static DDS_Security_boolean return_permissions_handle(
     const DDS_Security_PermissionsHandle permissions_handle,
     DDS_Security_SecurityException *ex)
 {
-  DDSRT_UNUSED_ARG(permissions_handle);
-  DDSRT_UNUSED_ARG(ex);
-  DDSRT_UNUSED_ARG(instance);
-  return true;
+  struct dds_security_access_control_impl *impl = (struct dds_security_access_control_impl *)instance;
+  switch (impl->mode)
+  {
+    case PLUGIN_MODE_WRAPPED:
+    case PLUGIN_MODE_NOT_ALLOWED:
+      return impl->instance->return_permissions_handle(impl->instance, permissions_handle, ex);
+
+    default:
+      return true;
+  }
 }
 
-
-static struct dds_security_access_control_impl * init_test_access_control_common()
+static struct dds_security_access_control_impl * init_test_access_control_common(const char *argument, bool wrapped, struct ddsi_domaingv *gv)
 {
   struct dds_security_access_control_impl *impl = ddsrt_malloc(sizeof(*impl));
   memset(impl, 0, sizeof(*impl));
+
+  if (wrapped)
+  {
+    if (init_access_control(argument, (void **)&impl->instance, gv) != DDS_SECURITY_SUCCESS)
+      return NULL;
+  }
+
   impl->base.validate_local_permissions = &validate_local_permissions;
   impl->base.validate_remote_permissions = &validate_remote_permissions;
   impl->base.check_create_participant = &check_create_participant;
@@ -514,40 +766,90 @@ static struct dds_security_access_control_impl * init_test_access_control_common
   return impl;
 }
 
-int32_t init_test_access_control_all_ok(const char *argument, void **context, struct ddsi_domaingv *gv)
+static int finalize_test_access_control_common(struct dds_security_access_control_impl * impl, bool wrapped)
+{
+  int32_t ret;
+  if (wrapped && (ret = finalize_access_control(impl->instance)) != DDS_SECURITY_SUCCESS)
+    return ret;
+  ddsrt_free(impl);
+  return DDS_SECURITY_SUCCESS;
+}
+
+int init_test_access_control_all_ok(const char *argument, void **context, struct ddsi_domaingv *gv)
 {
-  DDSRT_UNUSED_ARG(argument);
   DDSRT_UNUSED_ARG(context);
-  DDSRT_UNUSED_ARG(gv);
-  struct dds_security_access_control_impl *impl = init_test_access_control_common();
+  struct dds_security_access_control_impl *impl = init_test_access_control_common(argument, false, gv);
   impl->mode = PLUGIN_MODE_ALL_OK;
   *context = impl;
   return 0;
 }
 
-int32_t finalize_test_access_control_all_ok(void *context)
+int finalize_test_access_control_all_ok(void *context)
 {
-  assert(((struct dds_security_access_control_impl *)context)->mode == PLUGIN_MODE_ALL_OK);
-  ddsrt_free(context);
-  return 0;
+  struct dds_security_access_control_impl* impl = (struct dds_security_access_control_impl*) context;
+  assert(impl->mode == PLUGIN_MODE_ALL_OK);
+  return finalize_test_access_control_common(impl, false);
 }
 
-int32_t init_test_access_control_missing_func(const char *argument, void **context, struct ddsi_domaingv *gv)
+int init_test_access_control_wrapped(const char *argument, void **context, struct ddsi_domaingv *gv)
+{
+  struct dds_security_access_control_impl *impl = init_test_access_control_common(argument, true, gv);
+  if (!impl)
+    return DDS_SECURITY_FAILED;
+  impl->mode = PLUGIN_MODE_WRAPPED;
+  *context = impl;
+  return DDS_SECURITY_SUCCESS;
+}
+
+int finalize_test_access_control_wrapped(void *context)
+{
+  struct dds_security_access_control_impl* impl = (struct dds_security_access_control_impl*) context;
+  assert(impl->mode == PLUGIN_MODE_WRAPPED);
+  return finalize_test_access_control_common(impl, true);
+}
+
+int init_test_access_control_missing_func(const char *argument, void **context, struct ddsi_domaingv *gv)
 {
-  DDSRT_UNUSED_ARG(argument);
   DDSRT_UNUSED_ARG(context);
-  DDSRT_UNUSED_ARG(gv);
-  struct dds_security_access_control_impl *impl = init_test_access_control_common();
+  struct dds_security_access_control_impl *impl = init_test_access_control_common(argument, false, gv);
   impl->base.check_create_datareader = NULL;
   impl->mode = PLUGIN_MODE_MISSING_FUNC;
   *context = impl;
   return 0;
 }
 
-int32_t finalize_test_access_control_missing_func(void *context)
+int finalize_test_access_control_missing_func(void *context)
 {
-  assert(((struct dds_security_access_control_impl *)context)->mode == PLUGIN_MODE_MISSING_FUNC);
-  ddsrt_free(context);
-  return 0;
+  struct dds_security_access_control_impl* impl = (struct dds_security_access_control_impl*) context;
+  assert(impl->mode == PLUGIN_MODE_MISSING_FUNC);
+  return finalize_test_access_control_common(impl, false);
 }
 
+#define INIT_NOT_ALLOWED(name_, mask_) \
+  int init_test_access_control_##name_ (const char *argument, void **context, struct ddsi_domaingv *gv) \
+  { \
+    DDSRT_UNUSED_ARG(context); \
+    struct dds_security_access_control_impl *impl = init_test_access_control_common(argument, true, gv); \
+    impl->mode = PLUGIN_MODE_NOT_ALLOWED; \
+    impl->not_allowed_mask = mask_; \
+    *context = impl; \
+    return 0; \
+  }
+
+INIT_NOT_ALLOWED(local_participant_not_allowed, NOT_ALLOWED_LOCAL_PP)
+INIT_NOT_ALLOWED(local_topic_not_allowed, NOT_ALLOWED_LOCAL_TOPIC)
+INIT_NOT_ALLOWED(local_publishing_not_allowed, NOT_ALLOWED_LOCAL_PUB)
+INIT_NOT_ALLOWED(local_subscribing_not_allowed, NOT_ALLOWED_LOCAL_SUB)
+INIT_NOT_ALLOWED(remote_permissions_invalidate, NOT_ALLOWED_REMOTE_PERM)
+INIT_NOT_ALLOWED(remote_participant_not_allowed, NOT_ALLOWED_REMOTE_PP)
+INIT_NOT_ALLOWED(remote_topic_not_allowed, NOT_ALLOWED_REMOTE_TOPIC)
+INIT_NOT_ALLOWED(remote_writer_not_allowed, NOT_ALLOWED_REMOTE_WRITER)
+INIT_NOT_ALLOWED(remote_reader_not_allowed, NOT_ALLOWED_REMOTE_READER)
+INIT_NOT_ALLOWED(remote_reader_relay_only, NOT_ALLOWED_REMOTE_READER_RELAY_ONLY)
+
+int finalize_test_access_control_not_allowed(void *context)
+{
+  struct dds_security_access_control_impl* impl = (struct dds_security_access_control_impl*) context;
+  assert(impl->mode == PLUGIN_MODE_NOT_ALLOWED);
+  return finalize_test_access_control_common(impl, true);
+}
diff --git a/src/security/core/tests/common/access_control_wrapper.h b/src/security/core/tests/common/access_control_wrapper.h
index a7c2e7c..3fb04bf 100644
--- a/src/security/core/tests/common/access_control_wrapper.h
+++ b/src/security/core/tests/common/access_control_wrapper.h
@@ -16,12 +16,36 @@
 #include "dds/security/dds_security_api.h"
 #include "dds/security/access_control_wrapper_export.h"
 
+/* Topic name prefix expected by this wrapper when running in not-allowed
+   mode. This prefix is used to exclude built-in topics from being disallowed. */
+#define AC_WRAPPER_TOPIC_PREFIX "ddssec_access_control_"
+
 /* Init in all-ok mode: all functions return success without calling the actual plugin */
-SECURITY_EXPORT int32_t init_test_access_control_all_ok(const char *argument, void **context, struct ddsi_domaingv *gv);
-SECURITY_EXPORT int32_t finalize_test_access_control_all_ok(void *context);
+SECURITY_EXPORT int init_test_access_control_all_ok(const char *argument, void **context, struct ddsi_domaingv *gv);
+SECURITY_EXPORT int finalize_test_access_control_all_ok(void *context);
 
 /* Init in missing function mode: one of the function pointers is null */
-SECURITY_EXPORT int32_t init_test_access_control_missing_func(const char *argument, void **context, struct ddsi_domaingv *gv);
-SECURITY_EXPORT int32_t finalize_test_access_control_missing_func(void *context);
+SECURITY_EXPORT int init_test_access_control_missing_func(const char *argument, void **context, struct ddsi_domaingv *gv);
+SECURITY_EXPORT int finalize_test_access_control_missing_func(void *context);
+
+SECURITY_EXPORT int init_test_access_control_wrapped(const char *argument, void **context, struct ddsi_domaingv *gv);
+SECURITY_EXPORT int finalize_test_access_control_wrapped(void *context);
+
+/* Init functions for not-allowed modes */
+#define INIT_NOT_ALLOWED_DECL(name_) \
+  SECURITY_EXPORT int init_test_access_control_##name_ (const char *argument, void **context, struct ddsi_domaingv *gv);
+
+INIT_NOT_ALLOWED_DECL(local_participant_not_allowed)
+INIT_NOT_ALLOWED_DECL(local_topic_not_allowed)
+INIT_NOT_ALLOWED_DECL(local_publishing_not_allowed)
+INIT_NOT_ALLOWED_DECL(local_subscribing_not_allowed)
+INIT_NOT_ALLOWED_DECL(remote_permissions_invalidate)
+INIT_NOT_ALLOWED_DECL(remote_participant_not_allowed)
+INIT_NOT_ALLOWED_DECL(remote_topic_not_allowed)
+INIT_NOT_ALLOWED_DECL(remote_writer_not_allowed)
+INIT_NOT_ALLOWED_DECL(remote_reader_not_allowed)
+INIT_NOT_ALLOWED_DECL(remote_reader_relay_only)
+
+SECURITY_EXPORT int finalize_test_access_control_not_allowed(void *context);
 
 #endif /* SECURITY_CORE_TEST_ACCESS_CONTROL_WRAPPER_H_ */
diff --git a/src/security/core/tests/common/authentication_wrapper.c b/src/security/core/tests/common/authentication_wrapper.c
index a2d3709..86290df 100644
--- a/src/security/core/tests/common/authentication_wrapper.c
+++ b/src/security/core/tests/common/authentication_wrapper.c
@@ -22,8 +22,8 @@
 #include "test_identity.h"
 #include "plugin_wrapper_msg_q.h"
 
-int32_t init_authentication(const char *argument, void **context, struct ddsi_domaingv *gv);
-int32_t finalize_authentication(void *context);
+int init_authentication(const char *argument, void **context, struct ddsi_domaingv *gv);
+int finalize_authentication(void *context);
 
 enum auth_plugin_mode {
   PLUGIN_MODE_ALL_OK,
@@ -482,7 +482,7 @@ static struct dds_security_authentication_impl * init_test_authentication_common
   return impl;
 }
 
-int32_t init_test_authentication_all_ok(const char *argument, void **context, struct ddsi_domaingv *gv)
+int init_test_authentication_all_ok(const char *argument, void **context, struct ddsi_domaingv *gv)
 {
   DDSRT_UNUSED_ARG(argument);
   DDSRT_UNUSED_ARG(context);
@@ -493,14 +493,14 @@ int32_t init_test_authentication_all_ok(const char *argument, void **context, st
   return 0;
 }
 
-int32_t finalize_test_authentication_all_ok(void *context)
+int finalize_test_authentication_all_ok(void *context)
 {
   assert(((struct dds_security_authentication_impl *)context)->mode == PLUGIN_MODE_ALL_OK);
   ddsrt_free(context);
   return 0;
 }
 
-int32_t init_test_authentication_missing_func(const char *argument, void **context, struct ddsi_domaingv *gv)
+int init_test_authentication_missing_func(const char *argument, void **context, struct ddsi_domaingv *gv)
 {
   DDSRT_UNUSED_ARG(argument);
   DDSRT_UNUSED_ARG(context);
@@ -512,14 +512,14 @@ int32_t init_test_authentication_missing_func(const char *argument, void **conte
   return 0;
 }
 
-int32_t finalize_test_authentication_missing_func(void *context)
+int finalize_test_authentication_missing_func(void *context)
 {
   assert(((struct dds_security_authentication_impl *)context)->mode == PLUGIN_MODE_MISSING_FUNC);
   ddsrt_free(context);
   return 0;
 }
 
-int32_t init_test_authentication_init_error(const char *argument, void **context, struct ddsi_domaingv *gv)
+int init_test_authentication_init_error(const char *argument, void **context, struct ddsi_domaingv *gv)
 {
   DDSRT_UNUSED_ARG(argument);
   DDSRT_UNUSED_ARG(context);
@@ -527,7 +527,7 @@ int32_t init_test_authentication_init_error(const char *argument, void **context
   return 1;
 }
 
-int32_t finalize_test_authentication_init_error(void *context)
+int finalize_test_authentication_init_error(void *context)
 {
   DDSRT_UNUSED_ARG(context);
   return 0;
@@ -537,9 +537,9 @@ int32_t finalize_test_authentication_init_error(void *context)
  * Init and fini functions for using wrapped mode for the authentication plugin.
  * These functions assumes that there are no concurrent calls, as the static
  * variables used here are not protected by a lock. */
-int32_t init_test_authentication_wrapped(const char *argument, void **context, struct ddsi_domaingv *gv)
+int init_test_authentication_wrapped(const char *argument, void **context, struct ddsi_domaingv *gv)
 {
-  int32_t ret;
+  int ret;
   struct dds_security_authentication_impl *impl = init_test_authentication_common();
   impl->mode = PLUGIN_MODE_WRAPPED;
 
@@ -553,9 +553,9 @@ int32_t init_test_authentication_wrapped(const char *argument, void **context, s
   return ret;
 }
 
-int32_t finalize_test_authentication_wrapped(void *context)
+int finalize_test_authentication_wrapped(void *context)
 {
-  int32_t ret;
+  int ret;
   struct dds_security_authentication_impl *impl = context;
   assert(impl->mode == PLUGIN_MODE_WRAPPED);
   deinit_message_queue(&impl->msg_queue);
diff --git a/src/security/core/tests/common/authentication_wrapper.h b/src/security/core/tests/common/authentication_wrapper.h
index d784454..f58121d 100644
--- a/src/security/core/tests/common/authentication_wrapper.h
+++ b/src/security/core/tests/common/authentication_wrapper.h
@@ -18,20 +18,20 @@
 #include "plugin_wrapper_msg_q.h"
 
 /* Init in wrapper mode */
-SECURITY_EXPORT int32_t init_test_authentication_wrapped(const char *argument, void **context, struct ddsi_domaingv *gv);
-SECURITY_EXPORT int32_t finalize_test_authentication_wrapped(void *context);
+SECURITY_EXPORT int init_test_authentication_wrapped(const char *argument, void **context, struct ddsi_domaingv *gv);
+SECURITY_EXPORT int finalize_test_authentication_wrapped(void *context);
 
 /* Init in all-ok mode: all functions return success without calling the actual plugin */
-SECURITY_EXPORT int32_t init_test_authentication_all_ok(const char *argument, void **context, struct ddsi_domaingv *gv);
-SECURITY_EXPORT int32_t finalize_test_authentication_all_ok(void *context);
+SECURITY_EXPORT int init_test_authentication_all_ok(const char *argument, void **context, struct ddsi_domaingv *gv);
+SECURITY_EXPORT int finalize_test_authentication_all_ok(void *context);
 
 /* Init in missing function mode: one of the function pointers is null */
-SECURITY_EXPORT int32_t init_test_authentication_missing_func(const char *argument, void **context, struct ddsi_domaingv *gv);
-SECURITY_EXPORT int32_t finalize_test_authentication_missing_func(void *context);
+SECURITY_EXPORT int init_test_authentication_missing_func(const char *argument, void **context, struct ddsi_domaingv *gv);
+SECURITY_EXPORT int finalize_test_authentication_missing_func(void *context);
 
 /* Init function fails */
-SECURITY_EXPORT int32_t init_test_authentication_init_error(const char *argument, void **context, struct ddsi_domaingv *gv);
-SECURITY_EXPORT int32_t finalize_test_authentication_init_error(void *context);
+SECURITY_EXPORT int init_test_authentication_init_error(const char *argument, void **context, struct ddsi_domaingv *gv);
+SECURITY_EXPORT int finalize_test_authentication_init_error(void *context);
 
 SECURITY_EXPORT struct message * test_authentication_plugin_take_msg(dds_domainid_t domain_id, message_kind_t kind, DDS_Security_IdentityHandle lidHandle, DDS_Security_IdentityHandle ridHandle, DDS_Security_IdentityHandle hsHandle, dds_duration_t timeout);
 SECURITY_EXPORT void test_authentication_plugin_release_msg(struct message *msg);
diff --git a/src/security/core/tests/common/cryptography_wrapper.c b/src/security/core/tests/common/cryptography_wrapper.c
index a3d1508..034d81d 100644
--- a/src/security/core/tests/common/cryptography_wrapper.c
+++ b/src/security/core/tests/common/cryptography_wrapper.c
@@ -22,8 +22,8 @@
 #include "dds/security/core/dds_security_utils.h"
 #include "cryptography_wrapper.h"
 
-int32_t init_crypto(const char *argument, void **context, struct ddsi_domaingv *gv);
-int32_t finalize_crypto(void *context);
+int init_crypto(const char *argument, void **context, struct ddsi_domaingv *gv);
+int finalize_crypto(void *context);
 
 enum crypto_plugin_mode {
   PLUGIN_MODE_ALL_OK,
@@ -754,16 +754,16 @@ static struct dds_security_cryptography_impl * init_test_cryptography_common(con
   return impl;
 }
 
-static int32_t finalize_test_cryptography_common(struct dds_security_cryptography_impl * impl, bool wrapped)
+static int finalize_test_cryptography_common(struct dds_security_cryptography_impl * impl, bool wrapped)
 {
-  int32_t ret;
+  int ret;
   if (wrapped && (ret = finalize_crypto(impl->instance)) != DDS_SECURITY_SUCCESS)
     return ret;
   ddsrt_free(impl);
   return DDS_SECURITY_SUCCESS;
 }
 
-int32_t init_test_cryptography_all_ok(const char *argument, void **context, struct ddsi_domaingv *gv)
+int init_test_cryptography_all_ok(const char *argument, void **context, struct ddsi_domaingv *gv)
 {
   struct dds_security_cryptography_impl *impl = init_test_cryptography_common(argument, false, gv);
   if (!impl)
@@ -773,14 +773,14 @@ int32_t init_test_cryptography_all_ok(const char *argument, void **context, stru
   return DDS_SECURITY_SUCCESS;
 }
 
-int32_t finalize_test_cryptography_all_ok(void *context)
+int finalize_test_cryptography_all_ok(void *context)
 {
   struct dds_security_cryptography_impl* impl = (struct dds_security_cryptography_impl*) context;
   assert(impl->mode == PLUGIN_MODE_ALL_OK);
   return finalize_test_cryptography_common(impl, false);
 }
 
-int32_t init_test_cryptography_missing_func(const char *argument, void **context, struct ddsi_domaingv *gv)
+int init_test_cryptography_missing_func(const char *argument, void **context, struct ddsi_domaingv *gv)
 {
   struct dds_security_cryptography_impl *impl = init_test_cryptography_common(argument, false, gv);
   if (!impl)
@@ -791,14 +791,14 @@ int32_t init_test_cryptography_missing_func(const char *argument, void **context
   return DDS_SECURITY_SUCCESS;
 }
 
-int32_t finalize_test_cryptography_missing_func(void *context)
+int finalize_test_cryptography_missing_func(void *context)
 {
   struct dds_security_cryptography_impl* impl = (struct dds_security_cryptography_impl*) context;
   assert(impl->mode == PLUGIN_MODE_MISSING_FUNC);
   return finalize_test_cryptography_common(impl, false);
 }
 
-int32_t init_test_cryptography_wrapped(const char *argument, void **context, struct ddsi_domaingv *gv)
+int init_test_cryptography_wrapped(const char *argument, void **context, struct ddsi_domaingv *gv)
 {
   struct dds_security_cryptography_impl *impl = init_test_cryptography_common(argument, true, gv);
   if (!impl)
@@ -808,7 +808,7 @@ int32_t init_test_cryptography_wrapped(const char *argument, void **context, str
   return DDS_SECURITY_SUCCESS;
 }
 
-int32_t finalize_test_cryptography_wrapped(void *context)
+int finalize_test_cryptography_wrapped(void *context)
 {
   struct dds_security_cryptography_impl* impl = (struct dds_security_cryptography_impl*) context;
   assert(impl->mode == PLUGIN_MODE_WRAPPED);
diff --git a/src/security/core/tests/common/cryptography_wrapper.h b/src/security/core/tests/common/cryptography_wrapper.h
index f379727..0c50adc 100644
--- a/src/security/core/tests/common/cryptography_wrapper.h
+++ b/src/security/core/tests/common/cryptography_wrapper.h
@@ -35,15 +35,15 @@ SECURITY_EXPORT void set_disc_protection_kinds(
 SECURITY_EXPORT void set_entity_data_secret(struct dds_security_cryptography_impl * impl, const char * pp_secret, const char * groupdata_secret, const char * ep_secret);
 
 /* Init in all-ok mode: all functions return success without calling the actual plugin */
-SECURITY_EXPORT int32_t init_test_cryptography_all_ok(const char *argument, void **context, struct ddsi_domaingv *gv);
-SECURITY_EXPORT int32_t finalize_test_cryptography_all_ok(void *context);
+SECURITY_EXPORT int init_test_cryptography_all_ok(const char *argument, void **context, struct ddsi_domaingv *gv);
+SECURITY_EXPORT int finalize_test_cryptography_all_ok(void *context);
 
 /* Init in missing function mode: one of the function pointers is null */
-SECURITY_EXPORT int32_t init_test_cryptography_missing_func(const char *argument, void **context, struct ddsi_domaingv *gv);
-SECURITY_EXPORT int32_t finalize_test_cryptography_missing_func(void *context);
+SECURITY_EXPORT int init_test_cryptography_missing_func(const char *argument, void **context, struct ddsi_domaingv *gv);
+SECURITY_EXPORT int finalize_test_cryptography_missing_func(void *context);
 
 /* Init in wrapper mode */
-SECURITY_EXPORT int32_t init_test_cryptography_wrapped(const char *argument, void **context, struct ddsi_domaingv *gv);
-SECURITY_EXPORT int32_t finalize_test_cryptography_wrapped(void *context);
+SECURITY_EXPORT int init_test_cryptography_wrapped(const char *argument, void **context, struct ddsi_domaingv *gv);
+SECURITY_EXPORT int finalize_test_cryptography_wrapped(void *context);
 
 #endif /* SECURITY_CORE_TEST_CRYPTO_WRAPPER_H_ */
diff --git a/src/security/core/tests/common/security_config_test_utils.c b/src/security/core/tests/common/security_config_test_utils.c
index 51a0a9f..d66ff2d 100644
--- a/src/security/core/tests/common/security_config_test_utils.c
+++ b/src/security/core/tests/common/security_config_test_utils.c
@@ -50,8 +50,8 @@ static const char *governance_xml =
     "          <topic_expression>*</topic_expression>"
     "          <enable_discovery_protection>${ENABLE_DISC_PROTECTION:-false}</enable_discovery_protection>"
     "          <enable_liveliness_protection>${ENABLE_LIVELINESS_PROTECTION:-false}</enable_liveliness_protection>"
-    "          <enable_read_access_control>${ENABLE_READ_AC:-false}</enable_read_access_control>"
-    "          <enable_write_access_control>${ENABLE_WRITE_AC:-false}</enable_write_access_control>"
+    "          <enable_read_access_control>${ENABLE_READ_AC:-true}</enable_read_access_control>"
+    "          <enable_write_access_control>${ENABLE_WRITE_AC:-true}</enable_write_access_control>"
     "          <metadata_protection_kind>${METADATA_PROTECTION_KIND:-NONE}</metadata_protection_kind>"
     "          <data_protection_kind>${DATA_PROTECTION_KIND:-NONE}</data_protection_kind>"
     "        </topic_rule>"
@@ -68,7 +68,7 @@ static const char *permissions_xml_grant =
     "      <subject_name>${SUBJECT_NAME}</subject_name>"
     "      <validity><not_before>${NOT_BEFORE:-2015-09-15T01:00:00}</not_before><not_after>${NOT_AFTER:-2115-09-15T01:00:00}</not_after></validity>"
     "      <allow_rule>"
-    "        <domains><id_range><min>0</min><max>230</max></id_range></domains>"
+    "        <domains>${DOMAIN_ID:+<id>}${DOMAIN_ID:-<id_range><min>0</min><max>230</max></id_range>}${DOMAIN_ID:+</id>}</domains>"
     "        <publish>"
     "          <topics>${PUB_TOPICS:-<topic>*</topic>}</topics>"
     "          <partitions><partition>*</partition></partitions>"
@@ -239,7 +239,7 @@ static char * get_xml_datetime(dds_time_t t, char * buf, size_t len)
   return buf;
 }
 
-char * get_permissions_grant(const char * name, const char * subject,
+char * get_permissions_grant(const char * name, const char * subject, const char * domain_id,
     dds_time_t not_before, dds_time_t not_after, const char * pub_topics, const char * sub_topics, const char * default_policy)
 {
   char not_before_str[] = "0000-00-00T00:00:00Z";
@@ -252,6 +252,7 @@ char * get_permissions_grant(const char * name, const char * subject,
     { "SUBJECT_NAME", subject, 1 },
     { "NOT_BEFORE", not_before_str, 1 },
     { "NOT_AFTER", not_after_str, 1 },
+    { "DOMAIN_ID", domain_id, 3 },
     { "PUB_TOPICS", pub_topics, 1 },
     { "SUB_TOPICS", sub_topics, 1 },
     { "DEFAULT_POLICY", default_policy, 1 },
diff --git a/src/security/core/tests/common/security_config_test_utils.h b/src/security/core/tests/common/security_config_test_utils.h
index 87f8e4b..3cf20de 100644
--- a/src/security/core/tests/common/security_config_test_utils.h
+++ b/src/security/core/tests/common/security_config_test_utils.h
@@ -27,7 +27,7 @@ int32_t expand_lookup_unmatched (const struct kvp * lookup_table);
 
 char * get_governance_config (struct kvp *config_vars, bool add_prefix);
 char * get_permissions_topic(const char * name);
-char * get_permissions_grant(const char * name, const char * subject,
+char * get_permissions_grant(const char * name, const char * subject, const char * domain_id,
     dds_time_t not_before, dds_time_t not_after, const char * pub_topics, const char * sub_topics, const char * default_policy);
 char * get_permissions_config(char * grants[], size_t ngrants, bool add_prefix);
 
diff --git a/src/security/core/tests/common/test_utils.c b/src/security/core/tests/common/test_utils.c
index bf8c300..a75c6b9 100644
--- a/src/security/core/tests/common/test_utils.c
+++ b/src/security/core/tests/common/test_utils.c
@@ -294,10 +294,11 @@ void sync_writer_to_readers (dds_entity_t pp_wr, dds_entity_t wr, uint32_t exp_c
   CU_ASSERT_EQUAL_FATAL (ret, DDS_RETCODE_OK);
   while (true)
   {
-    ret = dds_waitset_wait (ws, &triggered, 1, DDS_SECS(5));
-    CU_ASSERT_FATAL (ret >= 1);
-    CU_ASSERT_EQUAL_FATAL (wr, (dds_entity_t)(intptr_t) triggered);
-    ret = dds_get_publication_matched_status(wr, &pub_matched);
+    ret = dds_waitset_wait (ws, &triggered, 1, DDS_SECS(2));
+    CU_ASSERT_EQUAL_FATAL (exp_count > 0, ret >= 1);
+    if (exp_count > 0)
+      CU_ASSERT_EQUAL_FATAL (wr, (dds_entity_t)(intptr_t) triggered);
+    ret = dds_get_publication_matched_status (wr, &pub_matched);
     CU_ASSERT_EQUAL_FATAL (ret, DDS_RETCODE_OK);
     if (pub_matched.total_count >= exp_count)
       break;
@@ -306,6 +307,30 @@ void sync_writer_to_readers (dds_entity_t pp_wr, dds_entity_t wr, uint32_t exp_c
   CU_ASSERT_EQUAL_FATAL (pub_matched.total_count, exp_count);
 }
 
+void sync_reader_to_writers (dds_entity_t pp_rd, dds_entity_t rd, uint32_t exp_count)
+{
+  dds_attach_t triggered;
+  dds_entity_t ws = dds_create_waitset (pp_rd);
+  CU_ASSERT_FATAL (ws > 0);
+  dds_subscription_matched_status_t sub_matched;
+
+  dds_return_t ret = dds_waitset_attach (ws, rd, rd);
+  CU_ASSERT_EQUAL_FATAL (ret, DDS_RETCODE_OK);
+  while (true)
+  {
+    ret = dds_waitset_wait (ws, &triggered, 1, DDS_SECS(2));
+    CU_ASSERT_EQUAL_FATAL (exp_count > 0, ret >= 1);
+    if (exp_count > 0)
+      CU_ASSERT_EQUAL_FATAL (rd, (dds_entity_t)(intptr_t) triggered);
+    ret = dds_get_subscription_matched_status (rd, &sub_matched);
+    CU_ASSERT_EQUAL_FATAL (ret, DDS_RETCODE_OK);
+    if (sub_matched.total_count >= exp_count)
+      break;
+  };
+  dds_delete (ws);
+  CU_ASSERT_EQUAL_FATAL (sub_matched.total_count, exp_count);
+}
+
 char *create_topic_name (const char *prefix, uint32_t nr, char *name, size_t size)
 {
   ddsrt_pid_t pid = ddsrt_getpid ();
@@ -328,10 +353,12 @@ bool reader_wait_for_data (dds_entity_t pp, dds_entity_t rd, dds_duration_t dur)
   return ret > 0;
 }
 
-void rd_wr_init(
+void rd_wr_init_fail(
     dds_entity_t pp_wr, dds_entity_t *pub, dds_entity_t *pub_tp, dds_entity_t *wr,
     dds_entity_t pp_rd, dds_entity_t *sub, dds_entity_t *sub_tp, dds_entity_t *rd,
-    const char * topic_name)
+    const char * topic_name,
+    bool exp_pubtp_fail, bool exp_wr_fail,
+    bool exp_subtp_fail, bool exp_rd_fail)
 {
   dds_qos_t * qos = dds_create_qos ();
   CU_ASSERT_FATAL (qos != NULL);
@@ -344,19 +371,37 @@ void rd_wr_init(
   *sub = dds_create_subscriber (pp_rd, NULL, NULL);
   CU_ASSERT_FATAL (*sub > 0);
   *pub_tp = dds_create_topic (pp_wr, &SecurityCoreTests_Type1_desc, topic_name, NULL, NULL);
-  CU_ASSERT_FATAL (*pub_tp > 0);
+  CU_ASSERT_EQUAL_FATAL (exp_pubtp_fail, *pub_tp <= 0);
   *sub_tp = dds_create_topic (pp_rd, &SecurityCoreTests_Type1_desc, topic_name, NULL, NULL);
-  CU_ASSERT_FATAL (*sub_tp > 0);
-  *wr = dds_create_writer (*pub, *pub_tp, qos, NULL);
-  CU_ASSERT_FATAL (*wr > 0);
-  dds_set_status_mask (*wr, DDS_PUBLICATION_MATCHED_STATUS);
-  *rd = dds_create_reader (*sub, *sub_tp, qos, NULL);
-  CU_ASSERT_FATAL (*rd > 0);
-  dds_set_status_mask (*rd, DDS_DATA_AVAILABLE_STATUS);
-  sync_writer_to_readers(pp_wr, *wr, 1);
+  CU_ASSERT_EQUAL_FATAL (exp_subtp_fail, *sub_tp <= 0);
+  if (!exp_pubtp_fail)
+  {
+    *wr = dds_create_writer (*pub, *pub_tp, qos, NULL);
+    CU_ASSERT_EQUAL_FATAL (exp_wr_fail, *wr <= 0);
+    if (exp_wr_fail)
+      goto fail;
+    dds_set_status_mask (*wr, DDS_PUBLICATION_MATCHED_STATUS);
+  }
+  if (!exp_subtp_fail)
+  {
+    *rd = dds_create_reader (*sub, *sub_tp, qos, NULL);
+    CU_ASSERT_EQUAL_FATAL (exp_rd_fail, *rd <= 0);
+    if (exp_rd_fail)
+      goto fail;
+    dds_set_status_mask (*rd, DDS_SUBSCRIPTION_MATCHED_STATUS);
+  }
+fail:
   dds_delete_qos (qos);
 }
 
+void rd_wr_init(
+    dds_entity_t pp_wr, dds_entity_t *pub, dds_entity_t *pub_tp, dds_entity_t *wr,
+    dds_entity_t pp_rd, dds_entity_t *sub, dds_entity_t *sub_tp, dds_entity_t *rd,
+    const char * topic_name)
+{
+  rd_wr_init_fail (pp_wr, pub, pub_tp, wr, pp_rd, sub, sub_tp, rd, topic_name, false, false, false, false);
+}
+
 void write_read_for(dds_entity_t wr, dds_entity_t pp_rd, dds_entity_t rd, dds_duration_t dur, bool exp_write_fail, bool exp_read_fail)
 {
   SecurityCoreTests_Type1 sample = { 1, 1 };
@@ -367,9 +412,10 @@ void write_read_for(dds_entity_t wr, dds_entity_t pp_rd, dds_entity_t rd, dds_du
   dds_time_t tend = dds_time () + dur;
   bool write_fail = false, read_fail = false;
 
+  dds_set_status_mask (rd, DDS_DATA_AVAILABLE_STATUS);
   do
   {
-    print_test_msg("write\n");
+    print_test_msg ("write\n");
     if (dds_write (wr, &sample) != DDS_RETCODE_OK)
       write_fail = true;
 
@@ -399,7 +445,7 @@ void write_read_for(dds_entity_t wr, dds_entity_t pp_rd, dds_entity_t rd, dds_du
       break;
     dds_sleepfor (DDS_MSECS (100));
   }
-  while (dds_time() < tend);
+  while (dds_time () < tend);
   CU_ASSERT_EQUAL_FATAL (write_fail, exp_write_fail);
   CU_ASSERT_EQUAL_FATAL (read_fail, exp_read_fail);
 }
diff --git a/src/security/core/tests/common/test_utils.h b/src/security/core/tests/common/test_utils.h
index b396f60..ac1e8a7 100644
--- a/src/security/core/tests/common/test_utils.h
+++ b/src/security/core/tests/common/test_utils.h
@@ -56,11 +56,18 @@ void validate_handshake_nofail (dds_domainid_t domain_id);
 void handshake_list_fini(struct Handshake *hs_list, int nhs);
 char *create_topic_name(const char *prefix, uint32_t nr, char *name, size_t size);
 void sync_writer_to_readers(dds_entity_t pp_wr, dds_entity_t wr, uint32_t exp_count);
+void sync_reader_to_writers (dds_entity_t pp_rd, dds_entity_t rd, uint32_t exp_count);
 bool reader_wait_for_data(dds_entity_t pp, dds_entity_t rd, dds_duration_t dur);
 void rd_wr_init(
     dds_entity_t pp_wr, dds_entity_t *pub, dds_entity_t *pub_tp, dds_entity_t *wr,
     dds_entity_t pp_rd, dds_entity_t *sub, dds_entity_t *sub_tp, dds_entity_t *rd,
-    const char *topic_name);
+    const char * topic_name);
+void rd_wr_init_fail(
+    dds_entity_t pp_wr, dds_entity_t *pub, dds_entity_t *pub_tp, dds_entity_t *wr,
+    dds_entity_t pp_rd, dds_entity_t *sub, dds_entity_t *sub_tp, dds_entity_t *rd,
+    const char * topic_name,
+    bool exp_pubtp_fail, bool exp_wr_fail,
+    bool exp_subtp_fail, bool exp_rd_fail);
 void write_read_for(dds_entity_t wr, dds_entity_t pp_rd, dds_entity_t rd, dds_duration_t dur, bool exp_write_fail, bool exp_read_fail);
 
 #endif /* SECURITY_CORE_TEST_UTILS_H_ */

From e8c349f96d3a42d9ce204d39ef7edd7311cbbbc9 Mon Sep 17 00:00:00 2001
From: Dennis Potman <dennis.potman@adlinktech.com>
Date: Fri, 17 Apr 2020 09:02:09 +0200
Subject: [PATCH 171/238] Fix condition for setting identity subject in remote
 rights

Signed-off-by: Dennis Potman <dennis.potman@adlinktech.com>
---
 .../access_control/src/access_control_objects.c             | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/src/security/builtin_plugins/access_control/src/access_control_objects.c b/src/security/builtin_plugins/access_control/src/access_control_objects.c
index 8988061..d418c21 100644
--- a/src/security/builtin_plugins/access_control/src/access_control_objects.c
+++ b/src/security/builtin_plugins/access_control/src/access_control_objects.c
@@ -272,10 +272,10 @@ ac_remote_participant_access_rights_new(
   {
     rights->permissions->ref_cnt++;
     if (rights->permissions->remote_permissions_token_class_id == NULL)
-    {
       rights->permissions->remote_permissions_token_class_id = ddsrt_strdup(remote_permissions_token->class_id);
-      rights->identity_subject_name = ddsrt_strdup(identity_subject);
-    }
+    else
+      assert (strcmp (rights->permissions->remote_permissions_token_class_id, remote_permissions_token->class_id) == 0);
+    rights->identity_subject_name = ddsrt_strdup(identity_subject);
   }
   else
   {

From 7e6039763baef71ad0ca741b045ada3f111968e9 Mon Sep 17 00:00:00 2001
From: Dennis Potman <dennis.potman@adlinktech.com>
Date: Tue, 21 Apr 2020 09:37:09 +0200
Subject: [PATCH 172/238] Replace pp null check by assert in dds_create_writer
 and dds_create_reader, and rewrite logic in
 q_omg_security_check_remote_writer_permissions

Signed-off-by: Dennis Potman <dennis.potman@adlinktech.com>
---
 src/core/ddsc/src/dds_reader.c        | 14 +++----
 src/core/ddsc/src/dds_writer.c        | 13 +++---
 src/core/ddsi/src/ddsi_security_omg.c | 58 +++++++++++++--------------
 3 files changed, 38 insertions(+), 47 deletions(-)

diff --git a/src/core/ddsc/src/dds_reader.c b/src/core/ddsc/src/dds_reader.c
index bffe59a..5af47a0 100644
--- a/src/core/ddsc/src/dds_reader.c
+++ b/src/core/ddsc/src/dds_reader.c
@@ -456,12 +456,11 @@ static dds_entity_t dds_create_reader_int (dds_entity_t participant_or_subscribe
   thread_state_awake (lookup_thread_state (), gv);
   const struct ddsi_guid * ppguid = dds_entity_participant_guid (&sub->m_entity);
   struct participant * pp = entidx_lookup_participant_guid (gv->entity_index, ppguid);
-  if (pp == NULL)
-  {
-    GVLOGDISC ("new_reader - participant "PGUIDFMT" not found\n", PGUID (*ppguid));
-    rc = DDS_RETCODE_BAD_PARAMETER;
-    goto err_pp_not_found;
-  }
+
+  /* When deleting a participant, the child handles (that include the subscriber)
+     are removed before removing the DDSI participant. So at this point, within
+     the subscriber lock, we can assert that the participant exists. */
+  assert (pp != NULL);
 
 #ifdef DDSI_INCLUDE_SECURITY
   /* Check if DDS Security is enabled */
@@ -508,9 +507,8 @@ static dds_entity_t dds_create_reader_int (dds_entity_t participant_or_subscribe
 
 #ifdef DDSI_INCLUDE_SECURITY
 err_not_allowed:
-#endif
-err_pp_not_found:
   thread_state_asleep (lookup_thread_state ());
+#endif
 err_bad_qos:
   dds_delete_qos (rqos);
   dds_topic_allow_set_qos (tp);
diff --git a/src/core/ddsc/src/dds_writer.c b/src/core/ddsc/src/dds_writer.c
index 12d2676..bebebcc 100644
--- a/src/core/ddsc/src/dds_writer.c
+++ b/src/core/ddsc/src/dds_writer.c
@@ -329,12 +329,10 @@ dds_entity_t dds_create_writer (dds_entity_t participant_or_publisher, dds_entit
   thread_state_awake (lookup_thread_state (), gv);
   const struct ddsi_guid *ppguid = dds_entity_participant_guid (&pub->m_entity);
   struct participant *pp = entidx_lookup_participant_guid (gv->entity_index, ppguid);
-  if (pp == NULL)
-  {
-    GVLOGDISC ("new_writer - participant "PGUIDFMT" not found\n", PGUID (*ppguid));
-    rc = DDS_RETCODE_BAD_PARAMETER;
-    goto err_pp_not_found;
-  }
+  /* When deleting a participant, the child handles (that include the publisher)
+     are removed before removing the DDSI participant. So at this point, within
+     the publisher lock, we can assert that the participant exists. */
+  assert (pp != NULL);
 
 #ifdef DDSI_INCLUDE_SECURITY
   /* Check if DDS Security is enabled */
@@ -377,9 +375,8 @@ dds_entity_t dds_create_writer (dds_entity_t participant_or_publisher, dds_entit
 
 #ifdef DDSI_INCLUDE_SECURITY
 err_not_allowed:
-#endif
-err_pp_not_found:
   thread_state_asleep (lookup_thread_state ());
+#endif
 err_bad_qos:
   dds_delete_qos(wqos);
   dds_topic_allow_set_qos (tp);
diff --git a/src/core/ddsi/src/ddsi_security_omg.c b/src/core/ddsi/src/ddsi_security_omg.c
index c7f2b10..c073166 100644
--- a/src/core/ddsi/src/ddsi_security_omg.c
+++ b/src/core/ddsi/src/ddsi_security_omg.c
@@ -2137,7 +2137,6 @@ bool q_omg_security_check_remote_writer_permissions(const struct proxy_writer *p
   DDS_Security_SecurityException exception = DDS_SECURITY_EXCEPTION_INIT;
   DDS_Security_PublicationBuiltinTopicDataSecure publication_data;
   DDS_Security_TopicBuiltinTopicData topic_data;
-  bool result = true;
 
   if (!sc)
     return true;
@@ -2156,42 +2155,39 @@ bool q_omg_security_check_remote_writer_permissions(const struct proxy_writer *p
     }
   }
 
-  if (SECURITY_INFO_IS_WRITE_PROTECTED(pwr->c.security_info))
-  {
-    DDS_Security_PermissionsHandle permissions_handle;
+  if (!SECURITY_INFO_IS_WRITE_PROTECTED(pwr->c.security_info))
+    return true;
 
-    if ((permissions_handle = get_permissions_handle(pp, pwr->c.proxypp)) == 0)
-    {
-      GVTRACE("Secure remote writer "PGUIDFMT" proxypp does not have permissions handle yet\n", PGUID(pwr->e.guid));
-      return false;
-    }
+  DDS_Security_PermissionsHandle permissions_handle;
+  if ((permissions_handle = get_permissions_handle(pp, pwr->c.proxypp)) == 0)
+  {
+    GVTRACE("Secure remote writer "PGUIDFMT" proxypp does not have permissions handle yet\n", PGUID(pwr->e.guid));
+    return false;
+  }
+
+  q_omg_shallow_copy_PublicationBuiltinTopicDataSecure(&publication_data, &pwr->e.guid, pwr->c.xqos, &pwr->c.security_info);
+  bool result = sc->access_control_context->check_remote_datawriter(sc->access_control_context, permissions_handle, (int)domain_id, &publication_data, &exception);
+  if (!result)
+  {
+    if (!is_topic_discovery_protected(pp->sec_attr->permissions_handle, sc->access_control_context, publication_data.topic_name))
+      EXCEPTION_ERROR(gv, &exception, "Access control does not allow remote writer "PGUIDFMT": %s", PGUID(pwr->e.guid));
     else
+      DDS_Security_Exception_reset(&exception);
+  }
+  else
+  {
+    q_omg_shallow_copy_TopicBuiltinTopicData(&topic_data, publication_data.topic_name, publication_data.type_name);
+    result = sc->access_control_context->check_remote_topic(sc->access_control_context, permissions_handle, (int)domain_id, &topic_data, &exception);
+    q_omg_shallow_free_TopicBuiltinTopicData(&topic_data);
+    if (!result)
     {
-      q_omg_shallow_copy_PublicationBuiltinTopicDataSecure(&publication_data, &pwr->e.guid, pwr->c.xqos, &pwr->c.security_info);
-      result = sc->access_control_context->check_remote_datawriter(sc->access_control_context, permissions_handle, (int)domain_id, &publication_data, &exception);
-      if (!result)
-      {
-        if (!is_topic_discovery_protected(pp->sec_attr->permissions_handle, sc->access_control_context, publication_data.topic_name))
-          EXCEPTION_ERROR(gv, &exception, "Access control does not allow remote writer "PGUIDFMT": %s", PGUID(pwr->e.guid));
-        else
-          DDS_Security_Exception_reset(&exception);
-      }
+      if (!is_topic_discovery_protected(pp->sec_attr->permissions_handle, sc->access_control_context, publication_data.topic_name))
+        EXCEPTION_ERROR(gv, &exception, "Access control does not allow remote topic %s: %s", publication_data.topic_name);
       else
-      {
-        q_omg_shallow_copy_TopicBuiltinTopicData(&topic_data, publication_data.topic_name, publication_data.type_name);
-        result = sc->access_control_context->check_remote_topic(sc->access_control_context, permissions_handle, (int)domain_id, &topic_data, &exception);
-        q_omg_shallow_free_TopicBuiltinTopicData(&topic_data);
-        if (!result)
-        {
-          if (!is_topic_discovery_protected(pp->sec_attr->permissions_handle, sc->access_control_context, publication_data.topic_name))
-            EXCEPTION_ERROR(gv, &exception, "Access control does not allow remote topic %s: %s", publication_data.topic_name);
-          else
-            DDS_Security_Exception_reset(&exception);
-        }
-      }
-      q_omg_shallow_free_PublicationBuiltinTopicDataSecure(&publication_data);
+        DDS_Security_Exception_reset(&exception);
     }
   }
+  q_omg_shallow_free_PublicationBuiltinTopicDataSecure(&publication_data);
 
   return result;
 }

From b86e8ce0d3d112da105641c912952c7770b8299e Mon Sep 17 00:00:00 2001
From: Dennis Potman <dennis.potman@adlinktech.com>
Date: Tue, 21 Apr 2020 21:43:27 +0200
Subject: [PATCH 173/238] Refactoring logic in
 q_omg_security_check_remote_reader_permissions

Signed-off-by: Dennis Potman <dennis.potman@adlinktech.com>
---
 src/core/ddsi/src/ddsi_security_omg.c | 64 +++++++++++++--------------
 1 file changed, 30 insertions(+), 34 deletions(-)

diff --git a/src/core/ddsi/src/ddsi_security_omg.c b/src/core/ddsi/src/ddsi_security_omg.c
index c073166..9ad902d 100644
--- a/src/core/ddsi/src/ddsi_security_omg.c
+++ b/src/core/ddsi/src/ddsi_security_omg.c
@@ -2145,7 +2145,7 @@ bool q_omg_security_check_remote_writer_permissions(const struct proxy_writer *p
   {
     if (q_omg_participant_allow_unauthenticated(pp))
     {
-      GVTRACE (" allow non-secure remote writer "PGUIDFMT, PGUID (pwr->e.guid));
+      GVTRACE(" allow non-secure remote writer "PGUIDFMT, PGUID(pwr->e.guid));
       return true;
     }
     else
@@ -2376,7 +2376,6 @@ bool q_omg_security_check_remote_reader_permissions(const struct proxy_reader *p
   DDS_Security_SubscriptionBuiltinTopicDataSecure subscription_data;
   DDS_Security_TopicBuiltinTopicData topic_data;
   DDS_Security_boolean sec_relay_only;
-  bool result = true;
 
   /* relay_only is meaningless in all cases except the one where the access control plugin says otherwise */
   *relay_only = false;
@@ -2388,7 +2387,7 @@ bool q_omg_security_check_remote_reader_permissions(const struct proxy_reader *p
   {
     if (q_omg_participant_allow_unauthenticated(pp))
     {
-      GVTRACE (" allow non-secure remote reader "PGUIDFMT, PGUID (prd->e.guid));
+      GVTRACE(" allow non-secure remote reader "PGUIDFMT, PGUID(prd->e.guid));
       return true;
     }
     else
@@ -2398,43 +2397,40 @@ bool q_omg_security_check_remote_reader_permissions(const struct proxy_reader *p
     }
   }
 
-  if (SECURITY_INFO_IS_READ_PROTECTED(prd->c.security_info))
-  {
-    DDS_Security_PermissionsHandle permissions_handle;
+  if (!SECURITY_INFO_IS_READ_PROTECTED(prd->c.security_info))
+    return true;
 
-    if ((permissions_handle = get_permissions_handle(pp, prd->c.proxypp)) == 0)
-    {
-      GVTRACE("Secure remote reader "PGUIDFMT" proxypp does not have permissions handle yet\n", PGUID(prd->e.guid));
-      return false;
-    }
+  DDS_Security_PermissionsHandle permissions_handle;
+  if ((permissions_handle = get_permissions_handle(pp, prd->c.proxypp)) == 0)
+  {
+    GVTRACE("Secure remote reader "PGUIDFMT" proxypp does not have permissions handle yet\n", PGUID(prd->e.guid));
+    return false;
+  }
+
+  q_omg_shallow_copy_SubscriptionBuiltinTopicDataSecure(&subscription_data, &prd->e.guid, prd->c.xqos, &prd->c.security_info);
+  bool result = sc->access_control_context->check_remote_datareader(sc->access_control_context, permissions_handle, (int)domain_id, &subscription_data, &sec_relay_only, &exception);
+  if (!result)
+  {
+    if (!is_topic_discovery_protected(pp->sec_attr->permissions_handle, sc->access_control_context, subscription_data.topic_name))
+      EXCEPTION_ERROR(gv, &exception, "Access control does not allow remote reader "PGUIDFMT": %s", PGUID(prd->e.guid));
     else
+      DDS_Security_Exception_reset(&exception);
+  }
+  else
+  {
+    *relay_only = !!sec_relay_only;
+    q_omg_shallow_copy_TopicBuiltinTopicData(&topic_data, subscription_data.topic_name, subscription_data.type_name);
+    result = sc->access_control_context->check_remote_topic(sc->access_control_context, permissions_handle, (int)domain_id, &topic_data, &exception);
+    q_omg_shallow_free_TopicBuiltinTopicData(&topic_data);
+    if (!result)
     {
-      q_omg_shallow_copy_SubscriptionBuiltinTopicDataSecure(&subscription_data, &prd->e.guid, prd->c.xqos, &prd->c.security_info);
-      result = sc->access_control_context->check_remote_datareader(sc->access_control_context, permissions_handle, (int)domain_id, &subscription_data, &sec_relay_only, &exception);
-      if (!result)
-      {
-        if (!is_topic_discovery_protected(pp->sec_attr->permissions_handle, sc->access_control_context, subscription_data.topic_name))
-          EXCEPTION_ERROR(gv, &exception, "Access control does not allow remote reader "PGUIDFMT": %s", PGUID(prd->e.guid));
-        else
-          DDS_Security_Exception_reset(&exception);
-      }
+      if (!is_topic_discovery_protected(pp->sec_attr->permissions_handle, sc->access_control_context, subscription_data.topic_name))
+        EXCEPTION_ERROR(gv, &exception, "Access control does not allow remote topic %s: %s", subscription_data.topic_name);
       else
-      {
-        *relay_only = !!sec_relay_only;
-        q_omg_shallow_copy_TopicBuiltinTopicData(&topic_data, subscription_data.topic_name, subscription_data.type_name);
-        result = sc->access_control_context->check_remote_topic(sc->access_control_context, permissions_handle, (int)domain_id, &topic_data, &exception);
-        q_omg_shallow_free_TopicBuiltinTopicData(&topic_data);
-        if (!result)
-        {
-          if (!is_topic_discovery_protected(pp->sec_attr->permissions_handle, sc->access_control_context, subscription_data.topic_name))
-            EXCEPTION_ERROR(gv, &exception, "Access control does not allow remote topic %s: %s", subscription_data.topic_name);
-          else
-            DDS_Security_Exception_reset(&exception);
-        }
-      }
-      q_omg_shallow_free_SubscriptionBuiltinTopicDataSecure(&subscription_data);
+        DDS_Security_Exception_reset(&exception);
     }
   }
+  q_omg_shallow_free_SubscriptionBuiltinTopicDataSecure(&subscription_data);
 
   return result;
 }

From 2aa0195d530fd2c72da79893dd28aa1c0ccb5d21 Mon Sep 17 00:00:00 2001
From: Dennis Potman <dennis.potman@adlinktech.com>
Date: Wed, 22 Apr 2020 14:17:42 +0200
Subject: [PATCH 174/238] Log category for not-allowed message depends on topic
 discovery protection state

Signed-off-by: Dennis Potman <dennis.potman@adlinktech.com>
---
 .../ddsi/include/dds/ddsi/ddsi_security_omg.h |  1 +
 src/core/ddsi/src/ddsi_security_omg.c         | 81 +++++++++----------
 2 files changed, 37 insertions(+), 45 deletions(-)

diff --git a/src/core/ddsi/include/dds/ddsi/ddsi_security_omg.h b/src/core/ddsi/include/dds/ddsi/ddsi_security_omg.h
index f87629a..e7c3214 100644
--- a/src/core/ddsi/include/dds/ddsi/ddsi_security_omg.h
+++ b/src/core/ddsi/include/dds/ddsi/ddsi_security_omg.h
@@ -113,6 +113,7 @@ struct dds_security_authentication *q_omg_participant_get_authentication(const s
 
 DDS_EXPORT struct dds_security_cryptography *q_omg_participant_get_cryptography(const struct participant *pp);
 
+void q_omg_vlog_exception(const struct ddsrt_log_cfg *lc, uint32_t cat, DDS_Security_SecurityException *exception, const char *file, uint32_t line, const char *func, const char *fmt, va_list ap);
 void q_omg_log_exception(const struct ddsrt_log_cfg *lc, uint32_t cat, DDS_Security_SecurityException *exception, const char *file, uint32_t line, const char *func, const char *fmt, ...);
 
 /**
diff --git a/src/core/ddsi/src/ddsi_security_omg.c b/src/core/ddsi/src/ddsi_security_omg.c
index 9ad902d..b4e46d4 100644
--- a/src/core/ddsi/src/ddsi_security_omg.c
+++ b/src/core/ddsi/src/ddsi_security_omg.c
@@ -55,6 +55,8 @@
 
 #define EXCEPTION_LOG(gv,e,cat,...) \
   q_omg_log_exception(&gv->logconfig, cat, e, __FILE__, __LINE__, DDS_FUNCTION, __VA_ARGS__)
+#define EXCEPTION_VLOG(gv,e,cat,fmt,va_list) \
+  q_omg_vlog_exception(&gv->logconfig, cat, e, __FILE__, __LINE__, DDS_FUNCTION, fmt, va_list)
 
 #define EXCEPTION_ERROR(gv,e,...)     EXCEPTION_LOG(gv, e, DDS_LC_ERROR, __VA_ARGS__)
 #define EXCEPTION_WARNING(gv,e,...)   EXCEPTION_LOG(gv, e, DDS_LC_WARNING, __VA_ARGS__)
@@ -296,15 +298,12 @@ static struct dds_security_context * q_omg_security_get_secure_context_from_prox
   return NULL;
 }
 
-void q_omg_log_exception(const struct ddsrt_log_cfg *lc, uint32_t cat, DDS_Security_SecurityException *exception, const char *file, uint32_t line, const char *func, const char *fmt, ...)
+void q_omg_vlog_exception(const struct ddsrt_log_cfg *lc, uint32_t cat, DDS_Security_SecurityException *exception, const char *file, uint32_t line, const char *func, const char *fmt, va_list ap)
 {
   char logbuffer[512];
-  va_list ap;
   int l;
 
-  va_start (ap, fmt);
   l = vsnprintf(logbuffer, sizeof(logbuffer), fmt, ap);
-  va_end (ap);
   if ((size_t) l >= sizeof(logbuffer))
   {
     logbuffer[sizeof(logbuffer)-1] = '\0';
@@ -313,6 +312,14 @@ void q_omg_log_exception(const struct ddsrt_log_cfg *lc, uint32_t cat, DDS_Secur
   DDS_Security_Exception_reset(exception);
 }
 
+void q_omg_log_exception(const struct ddsrt_log_cfg *lc, uint32_t cat, DDS_Security_SecurityException *exception, const char *file, uint32_t line, const char *func, const char *fmt, ...)
+{
+  va_list ap;
+  va_start (ap, fmt);
+  q_omg_vlog_exception(lc, cat, exception, file, line, func, fmt, ap);
+  va_end (ap);
+}
+
 static void free_pending_match(struct pending_match *match)
 {
   if (match)
@@ -1390,6 +1397,20 @@ static bool is_topic_discovery_protected(DDS_Security_PermissionsHandle permissi
   return false;
 }
 
+static void handle_not_allowed(const struct ddsi_domaingv *gv, DDS_Security_PermissionsHandle permissions_handle, dds_security_access_control * ac_ctx,
+  DDS_Security_SecurityException * exception, const char * topic_name, const char * fmt, ...)
+{
+  /* In case topic has discovery protection enabled: don't log in log category error, as the message
+      will contain the topic name which may be considered as sensitive information */
+  va_list ap;
+  bool discovery_protected = is_topic_discovery_protected(permissions_handle, ac_ctx, topic_name);
+  va_start (ap, fmt);
+  EXCEPTION_VLOG(gv, exception, discovery_protected ? DDS_LC_TRACE : DDS_LC_ERROR, fmt, ap);
+  va_end (ap);
+  if (discovery_protected)
+    DDS_Security_Exception_reset(exception);
+}
+
 bool q_omg_security_check_create_topic(const struct ddsi_domaingv *gv, const ddsi_guid_t *pp_guid, const char *topic_name, const struct dds_qos *qos)
 {
   bool result = true;
@@ -1406,13 +1427,7 @@ bool q_omg_security_check_create_topic(const struct ddsi_domaingv *gv, const dds
     q_omg_shallow_copy_security_qos(&topic_qos, qos);
     result = sc->access_control_context->check_create_topic(sc->access_control_context, pp->sec_attr->permissions_handle, (DDS_Security_DomainId)gv->config.domainId, topic_name, &topic_qos, &exception);
     if (!result)
-    {
-      /*log if the topic discovery is not protected*/
-      if (!is_topic_discovery_protected(pp->sec_attr->permissions_handle, sc->access_control_context, topic_name))
-        EXCEPTION_ERROR(gv, &exception, "Local topic permission denied");
-      else
-        DDS_Security_Exception_reset(&exception);
-    }
+      handle_not_allowed(gv, pp->sec_attr->permissions_handle, sc->access_control_context, &exception, topic_name, "Local topic permission denied");
     q_omg_shallow_free_security_qos(&topic_qos);
   }
   thread_state_asleep (lookup_thread_state ());
@@ -1440,13 +1455,7 @@ bool q_omg_security_check_create_writer(struct participant *pp, uint32_t domain_
 
   result = sc->access_control_context->check_create_datawriter(sc->access_control_context, pp->sec_attr->permissions_handle, (DDS_Security_DomainId)domain_id, topic_name, &security_qos, &partitions, NULL, &exception);
   if (!result)
-  {
-    /*log if the topic discovery is not protected*/
-    if (!is_topic_discovery_protected( pp->sec_attr->permissions_handle, sc->access_control_context, topic_name))
-      EXCEPTION_ERROR(pp->e.gv, &exception, "Local topic permission denied");
-    else
-      DDS_Security_Exception_reset(&exception);
-  }
+    handle_not_allowed(pp->e.gv, pp->sec_attr->permissions_handle, sc->access_control_context, &exception, topic_name, "Local topic permission denied");
 
   q_omg_shallow_free_security_qos(&security_qos);
   g_omg_shallow_free_StringSeq(&partitions.name);
@@ -1561,13 +1570,7 @@ bool q_omg_security_check_create_reader(struct participant *pp, uint32_t domain_
 
   result = sc->access_control_context->check_create_datareader(sc->access_control_context, pp->sec_attr->permissions_handle, (DDS_Security_DomainId)domain_id, topic_name, &security_qos, &partitions, NULL, &exception);
   if (!result)
-  {
-    /*log if the topic discovery is not protected*/
-    if (!is_topic_discovery_protected( pp->sec_attr->permissions_handle, sc->access_control_context, topic_name))
-      EXCEPTION_ERROR(pp->e.gv, &exception, "Reader is not permitted");
-    else
-      DDS_Security_Exception_reset(&exception);
-  }
+    handle_not_allowed(pp->e.gv, pp->sec_attr->permissions_handle, sc->access_control_context, &exception, topic_name, "Reader is not permitted");
 
   q_omg_shallow_free_security_qos(&security_qos);
   g_omg_shallow_free_StringSeq(&partitions.name);
@@ -2169,10 +2172,8 @@ bool q_omg_security_check_remote_writer_permissions(const struct proxy_writer *p
   bool result = sc->access_control_context->check_remote_datawriter(sc->access_control_context, permissions_handle, (int)domain_id, &publication_data, &exception);
   if (!result)
   {
-    if (!is_topic_discovery_protected(pp->sec_attr->permissions_handle, sc->access_control_context, publication_data.topic_name))
-      EXCEPTION_ERROR(gv, &exception, "Access control does not allow remote writer "PGUIDFMT": %s", PGUID(pwr->e.guid));
-    else
-      DDS_Security_Exception_reset(&exception);
+    handle_not_allowed(gv, pp->sec_attr->permissions_handle, sc->access_control_context, &exception, publication_data.topic_name,
+      "Access control does not allow remote writer "PGUIDFMT": %s", PGUID(pwr->e.guid));
   }
   else
   {
@@ -2180,12 +2181,8 @@ bool q_omg_security_check_remote_writer_permissions(const struct proxy_writer *p
     result = sc->access_control_context->check_remote_topic(sc->access_control_context, permissions_handle, (int)domain_id, &topic_data, &exception);
     q_omg_shallow_free_TopicBuiltinTopicData(&topic_data);
     if (!result)
-    {
-      if (!is_topic_discovery_protected(pp->sec_attr->permissions_handle, sc->access_control_context, publication_data.topic_name))
-        EXCEPTION_ERROR(gv, &exception, "Access control does not allow remote topic %s: %s", publication_data.topic_name);
-      else
-        DDS_Security_Exception_reset(&exception);
-    }
+      handle_not_allowed(gv, pp->sec_attr->permissions_handle, sc->access_control_context, &exception, publication_data.topic_name,
+        "Access control does not allow remote topic %s: %s", publication_data.topic_name);
   }
   q_omg_shallow_free_PublicationBuiltinTopicDataSecure(&publication_data);
 
@@ -2411,10 +2408,8 @@ bool q_omg_security_check_remote_reader_permissions(const struct proxy_reader *p
   bool result = sc->access_control_context->check_remote_datareader(sc->access_control_context, permissions_handle, (int)domain_id, &subscription_data, &sec_relay_only, &exception);
   if (!result)
   {
-    if (!is_topic_discovery_protected(pp->sec_attr->permissions_handle, sc->access_control_context, subscription_data.topic_name))
-      EXCEPTION_ERROR(gv, &exception, "Access control does not allow remote reader "PGUIDFMT": %s", PGUID(prd->e.guid));
-    else
-      DDS_Security_Exception_reset(&exception);
+    handle_not_allowed(gv, pp->sec_attr->permissions_handle, sc->access_control_context, &exception, subscription_data.topic_name,
+      "Access control does not allow remote reader "PGUIDFMT": %s", PGUID(prd->e.guid));
   }
   else
   {
@@ -2423,12 +2418,8 @@ bool q_omg_security_check_remote_reader_permissions(const struct proxy_reader *p
     result = sc->access_control_context->check_remote_topic(sc->access_control_context, permissions_handle, (int)domain_id, &topic_data, &exception);
     q_omg_shallow_free_TopicBuiltinTopicData(&topic_data);
     if (!result)
-    {
-      if (!is_topic_discovery_protected(pp->sec_attr->permissions_handle, sc->access_control_context, subscription_data.topic_name))
-        EXCEPTION_ERROR(gv, &exception, "Access control does not allow remote topic %s: %s", subscription_data.topic_name);
-      else
-        DDS_Security_Exception_reset(&exception);
-    }
+      handle_not_allowed(gv, pp->sec_attr->permissions_handle, sc->access_control_context, &exception, subscription_data.topic_name,
+        "Access control does not allow remote topic %s: %s", subscription_data.topic_name);
   }
   q_omg_shallow_free_SubscriptionBuiltinTopicDataSecure(&subscription_data);
 

From 4ac06895f0b0969c32ebfec31bec6964bf32f015 Mon Sep 17 00:00:00 2001
From: Dennis Potman <dennis.potman@adlinktech.com>
Date: Wed, 22 Apr 2020 15:21:46 +0200
Subject: [PATCH 175/238] Fix format strings for handle_not_allowed calls and
 add format attribute check

Signed-off-by: Dennis Potman <dennis.potman@adlinktech.com>
---
 src/core/ddsi/src/ddsi_security_omg.c | 23 ++++++++++++++++-------
 1 file changed, 16 insertions(+), 7 deletions(-)

diff --git a/src/core/ddsi/src/ddsi_security_omg.c b/src/core/ddsi/src/ddsi_security_omg.c
index b4e46d4..3e8066a 100644
--- a/src/core/ddsi/src/ddsi_security_omg.c
+++ b/src/core/ddsi/src/ddsi_security_omg.c
@@ -55,8 +55,8 @@
 
 #define EXCEPTION_LOG(gv,e,cat,...) \
   q_omg_log_exception(&gv->logconfig, cat, e, __FILE__, __LINE__, DDS_FUNCTION, __VA_ARGS__)
-#define EXCEPTION_VLOG(gv,e,cat,fmt,va_list) \
-  q_omg_vlog_exception(&gv->logconfig, cat, e, __FILE__, __LINE__, DDS_FUNCTION, fmt, va_list)
+#define EXCEPTION_VLOG(gv,e,cat,fmt,ap) \
+  q_omg_vlog_exception(&gv->logconfig, cat, e, __FILE__, __LINE__, DDS_FUNCTION, fmt, ap)
 
 #define EXCEPTION_ERROR(gv,e,...)     EXCEPTION_LOG(gv, e, DDS_LC_ERROR, __VA_ARGS__)
 #define EXCEPTION_WARNING(gv,e,...)   EXCEPTION_LOG(gv, e, DDS_LC_WARNING, __VA_ARGS__)
@@ -1397,8 +1397,17 @@ static bool is_topic_discovery_protected(DDS_Security_PermissionsHandle permissi
   return false;
 }
 
+static void handle_not_allowed(
+    const struct ddsi_domaingv *gv,
+    DDS_Security_PermissionsHandle permissions_handle,
+    dds_security_access_control * ac_ctx,
+    DDS_Security_SecurityException * exception,
+    const char * topic_name,
+    const char * fmt,
+    ...) ddsrt_attribute_format ((printf, 6, 7));
+
 static void handle_not_allowed(const struct ddsi_domaingv *gv, DDS_Security_PermissionsHandle permissions_handle, dds_security_access_control * ac_ctx,
-  DDS_Security_SecurityException * exception, const char * topic_name, const char * fmt, ...)
+    DDS_Security_SecurityException * exception, const char * topic_name, const char * fmt, ...)
 {
   /* In case topic has discovery protection enabled: don't log in log category error, as the message
       will contain the topic name which may be considered as sensitive information */
@@ -2173,7 +2182,7 @@ bool q_omg_security_check_remote_writer_permissions(const struct proxy_writer *p
   if (!result)
   {
     handle_not_allowed(gv, pp->sec_attr->permissions_handle, sc->access_control_context, &exception, publication_data.topic_name,
-      "Access control does not allow remote writer "PGUIDFMT": %s", PGUID(pwr->e.guid));
+      "Access control does not allow remote writer "PGUIDFMT, PGUID(pwr->e.guid));
   }
   else
   {
@@ -2182,7 +2191,7 @@ bool q_omg_security_check_remote_writer_permissions(const struct proxy_writer *p
     q_omg_shallow_free_TopicBuiltinTopicData(&topic_data);
     if (!result)
       handle_not_allowed(gv, pp->sec_attr->permissions_handle, sc->access_control_context, &exception, publication_data.topic_name,
-        "Access control does not allow remote topic %s: %s", publication_data.topic_name);
+        "Access control does not allow remote topic %s", publication_data.topic_name);
   }
   q_omg_shallow_free_PublicationBuiltinTopicDataSecure(&publication_data);
 
@@ -2409,7 +2418,7 @@ bool q_omg_security_check_remote_reader_permissions(const struct proxy_reader *p
   if (!result)
   {
     handle_not_allowed(gv, pp->sec_attr->permissions_handle, sc->access_control_context, &exception, subscription_data.topic_name,
-      "Access control does not allow remote reader "PGUIDFMT": %s", PGUID(prd->e.guid));
+      "Access control does not allow remote reader "PGUIDFMT, PGUID(prd->e.guid));
   }
   else
   {
@@ -2419,7 +2428,7 @@ bool q_omg_security_check_remote_reader_permissions(const struct proxy_reader *p
     q_omg_shallow_free_TopicBuiltinTopicData(&topic_data);
     if (!result)
       handle_not_allowed(gv, pp->sec_attr->permissions_handle, sc->access_control_context, &exception, subscription_data.topic_name,
-        "Access control does not allow remote topic %s: %s", subscription_data.topic_name);
+        "Access control does not allow remote topic %s", subscription_data.topic_name);
   }
   q_omg_shallow_free_SubscriptionBuiltinTopicDataSecure(&subscription_data);
 

From 623a5c02bdfe6a54d25440de1acd5f5c8a56bc88 Mon Sep 17 00:00:00 2001
From: Marcel Jordense <marcel.jordense@adlinktech.com>
Date: Fri, 1 May 2020 10:57:38 +0200
Subject: [PATCH 176/238] Correct handshake tokens verification w.r.t. optional
 fields

Signed-off-by: Marcel Jordense <marcel.jordense@adlinktech.com>
---
 docs/manual/options.md                        |  14 +-
 etc/cyclonedds.rnc                            |  10 +
 etc/cyclonedds.xsd                            |  12 +
 .../ddsi/include/dds/ddsi/ddsi_domaingv.h     |   1 +
 src/core/ddsi/include/dds/ddsi/q_config.h     |   1 +
 src/core/ddsi/src/ddsi_security_omg.c         |   5 +
 src/core/ddsi/src/q_config.c                  |   4 +-
 .../authentication/src/authentication.c       | 332 +++++++++---------
 .../dds/security/core/dds_security_utils.h    |  12 +-
 src/security/core/src/dds_security_utils.c    |  12 +-
 10 files changed, 227 insertions(+), 176 deletions(-)

diff --git a/docs/manual/options.md b/docs/manual/options.md
index b343bf1..85a1a3c 100644
--- a/docs/manual/options.md
+++ b/docs/manual/options.md
@@ -262,7 +262,7 @@ The default value is: "".
 
 
 #### //CycloneDDS/Domain/DDSSecurity/Authentication
-Children: [IdentityCA](#cycloneddsdomainddssecurityauthenticationidentityca), [IdentityCertificate](#cycloneddsdomainddssecurityauthenticationidentitycertificate), [Library](#cycloneddsdomainddssecurityauthenticationlibrary), [Password](#cycloneddsdomainddssecurityauthenticationpassword), [PrivateKey](#cycloneddsdomainddssecurityauthenticationprivatekey), [TrustedCADirectory](#cycloneddsdomainddssecurityauthenticationtrustedcadirectory)
+Children: [IdentityCA](#cycloneddsdomainddssecurityauthenticationidentityca), [IdentityCertificate](#cycloneddsdomainddssecurityauthenticationidentitycertificate), [IncludeOptionalFields](#cycloneddsdomainddssecurityauthenticationincludeoptionalfields), [Library](#cycloneddsdomainddssecurityauthenticationlibrary), [Password](#cycloneddsdomainddssecurityauthenticationpassword), [PrivateKey](#cycloneddsdomainddssecurityauthenticationprivatekey), [TrustedCADirectory](#cycloneddsdomainddssecurityauthenticationtrustedcadirectory)
 
 
 This element configures the Authentication plugin of the DDS Security
@@ -311,6 +311,18 @@ MIIDjjCCAnYCCQDCEu9...6rmT87dhTo=<br>
 -----END CERTIFICATE-----</IdentityCertificate>
 
 
+##### //CycloneDDS/Domain/DDSSecurity/Authentication/IncludeOptionalFields
+Boolean
+
+The authentication handshake tokens may contain optional fields to be
+included for finding interoperability problems.
+
+If this parameter is set to true the optional fields are included in the
+handshake token exchange.
+
+The default value is: "false".
+
+
 ##### //CycloneDDS/Domain/DDSSecurity/Authentication/Library
 Attributes: [finalizeFunction](#cycloneddsdomainddssecurityauthenticationlibraryfinalizefunction), [initFunction](#cycloneddsdomainddssecurityauthenticationlibraryinitfunction), [path](#cycloneddsdomainddssecurityauthenticationlibrarypath)
 
diff --git a/etc/cyclonedds.rnc b/etc/cyclonedds.rnc
index 1ee2c4d..7e49b53 100644
--- a/etc/cyclonedds.rnc
+++ b/etc/cyclonedds.rnc
@@ -268,6 +268,16 @@ MIIDjjCCAnYCCQDCEu9...6rmT87dhTo=<br>
             text
           }
           & [ a:documentation [ xml:lang="en" """
+<p>The authentication handshake tokens may contain optional fields to be
+included for finding interoperability problems.
+
+If this parameter is set to true the optional fields are included in the
+handshake token exchange.</p><p>The default value is:
+&quot;false&quot;.</p>""" ] ]
+          element IncludeOptionalFields {
+            xsd:boolean
+          }?
+          & [ a:documentation [ xml:lang="en" """
 <p>This element specifies the library to be loaded as the DDS Security
 Access Control plugin.</p>""" ] ]
           element Library {
diff --git a/etc/cyclonedds.xsd b/etc/cyclonedds.xsd
index d552a5c..0af9bc2 100644
--- a/etc/cyclonedds.xsd
+++ b/etc/cyclonedds.xsd
@@ -327,6 +327,7 @@ specification.&lt;/p&gt;</xs:documentation>
       <xs:all>
         <xs:element ref="config:IdentityCA"/>
         <xs:element ref="config:IdentityCertificate"/>
+        <xs:element minOccurs="0" ref="config:IncludeOptionalFields"/>
         <xs:element minOccurs="0" name="Library">
           <xs:annotation>
             <xs:documentation>
@@ -419,6 +420,17 @@ MIIDjjCCAnYCCQDCEu9...6rmT87dhTo=&lt;br&gt;
 -----END CERTIFICATE-----&lt;/IdentityCertificate&gt;&lt;/p&gt;</xs:documentation>
     </xs:annotation>
   </xs:element>
+  <xs:element name="IncludeOptionalFields" type="xs:boolean">
+    <xs:annotation>
+      <xs:documentation>
+&lt;p&gt;The authentication handshake tokens may contain optional fields to be
+included for finding interoperability problems.
+
+If this parameter is set to true the optional fields are included in the
+handshake token exchange.&lt;/p&gt;&lt;p&gt;The default value is:
+&amp;quot;false&amp;quot;.&lt;/p&gt;</xs:documentation>
+    </xs:annotation>
+  </xs:element>
   <xs:element name="Password" type="xs:string">
     <xs:annotation>
       <xs:documentation>
diff --git a/src/core/ddsi/include/dds/ddsi/ddsi_domaingv.h b/src/core/ddsi/include/dds/ddsi/ddsi_domaingv.h
index 68f040e..8446aaf 100644
--- a/src/core/ddsi/include/dds/ddsi/ddsi_domaingv.h
+++ b/src/core/ddsi/include/dds/ddsi/ddsi_domaingv.h
@@ -330,6 +330,7 @@ struct ddsi_domaingv {
 #ifdef DDSI_INCLUDE_SECURITY
   struct dds_security_context *security_context;
   struct ddsi_hsadmin *hsadmin;
+  bool handshake_include_optional;
 #endif
 
 };
diff --git a/src/core/ddsi/include/dds/ddsi/q_config.h b/src/core/ddsi/include/dds/ddsi/q_config.h
index dfc16bd..d9628e2 100644
--- a/src/core/ddsi/include/dds/ddsi/q_config.h
+++ b/src/core/ddsi/include/dds/ddsi/q_config.h
@@ -174,6 +174,7 @@ typedef struct authentication_properties_type{
   char *private_key;
   char *password;
   char *trusted_ca_dir;
+  bool include_optional_fields;
 } authentication_properties_type;
 
 typedef struct access_control_properties_type{
diff --git a/src/core/ddsi/src/ddsi_security_omg.c b/src/core/ddsi/src/ddsi_security_omg.c
index 3e8066a..36d5a3c 100644
--- a/src/core/ddsi/src/ddsi_security_omg.c
+++ b/src/core/ddsi/src/ddsi_security_omg.c
@@ -735,6 +735,11 @@ void q_omg_security_init (struct ddsi_domaingv *gv)
   ddsrt_mutex_init (&sc->omg_security_lock);
   gv->security_context = sc;
 
+  if (gv->config.omg_security_configuration)
+    gv->handshake_include_optional = gv->config.omg_security_configuration->cfg.authentication_properties.include_optional_fields;
+  else
+    gv->handshake_include_optional = false;
+
   ddsi_handshake_admin_init(gv);
 }
 
diff --git a/src/core/ddsi/src/q_config.c b/src/core/ddsi/src/q_config.c
index 515a4c6..9dcf5ec 100644
--- a/src/core/ddsi/src/q_config.c
+++ b/src/core/ddsi/src/q_config.c
@@ -353,7 +353,9 @@ The value of the password property shall be interpreted as the Base64 encoding o
 If the password property is not present, then the value supplied in the private_key property must contain the unencrypted private key. </p>") },
   { LEAF ("TrustedCADirectory"), 1, "", RELOFF (config_omg_security_listelem, cfg.authentication_properties.trusted_ca_dir), 0, uf_string, ff_free, pf_string,
     BLURB("<p>Trusted CA Directory which contains trusted CA certificates as separated files.</p>") },
-
+  { LEAF ("IncludeOptionalFields"), 1, "false", RELOFF (config_omg_security_listelem, cfg.authentication_properties.include_optional_fields), 0, uf_boolean, 0, pf_boolean,
+    BLURB("<p>The authentication handshake tokens may contain optional fields to be included for finding interoperability problems.\n\
+If this parameter is set to true the optional fields are included in the handshake token exchange.</p>") },
   END_MARKER
 };
 
diff --git a/src/security/builtin_plugins/authentication/src/authentication.c b/src/security/builtin_plugins/authentication/src/authentication.c
index 0ff0864..490654b 100644
--- a/src/security/builtin_plugins/authentication/src/authentication.c
+++ b/src/security/builtin_plugins/authentication/src/authentication.c
@@ -200,6 +200,7 @@ typedef struct dds_security_authentication_impl
   struct dds_security_timed_cb_data *timed_callbacks;
   struct dds_security_timed_dispatcher_t *dispatcher;
   X509Seq trustedCAList;
+  bool include_optional;
 } dds_security_authentication_impl;
 
 /* data type for timer dispatcher */
@@ -1123,9 +1124,9 @@ DDS_Security_ValidationResult_t begin_handshake_request(dds_security_authenticat
   LocalIdentityInfo *localIdent;
   RemoteIdentityInfo *remoteIdent;
   EVP_PKEY *dhkey;
-  DDS_Security_BinaryProperty_t *tokens, *c_id, *c_perm, *c_pdata, *c_dsign_algo, *c_kagree_algo, *hash_c1, *dh1, *challenge;
   unsigned char *certData, *dhPubKeyData = NULL;
   uint32_t certDataSize, dhPubKeyDataSize;
+  uint32_t tsz = impl->include_optional ? 8 : 7;
   int created = 0;
 
   if (!instance || !handshake_handle || !handshake_message || !serialized_local_participant_data)
@@ -1183,36 +1184,30 @@ DDS_Security_ValidationResult_t begin_handshake_request(dds_security_authenticat
   if (localIdent->pdata._length == 0)
     DDS_Security_OctetSeq_copy(&localIdent->pdata, serialized_local_participant_data);
 
-  tokens = DDS_Security_BinaryPropertySeq_allocbuf(8);
-  c_id = &tokens[0];
-  c_perm = &tokens[1];
-  c_pdata = &tokens[2];
-  c_dsign_algo = &tokens[3];
-  c_kagree_algo = &tokens[4];
-  hash_c1 = &tokens[5];
-  dh1 = &tokens[6];
-  challenge = &tokens[7];
+  DDS_Security_BinaryProperty_t *tokens = DDS_Security_BinaryPropertySeq_allocbuf(tsz);
+  uint32_t idx = 0;
 
-  DDS_Security_BinaryProperty_set_by_ref(c_id, "c.id", certData, certDataSize);
-  DDS_Security_BinaryProperty_set_by_string(c_perm, "c.perm", localIdent->permissionsDocument ? localIdent->permissionsDocument : "");
-  DDS_Security_BinaryProperty_set_by_value(c_pdata, "c.pdata", serialized_local_participant_data->_buffer, serialized_local_participant_data->_length);
-  DDS_Security_BinaryProperty_set_by_string(c_dsign_algo, "c.dsign_algo", get_dsign_algo(localIdent->dsignAlgoKind));
-  DDS_Security_BinaryProperty_set_by_string(c_kagree_algo, "c.kagree_algo", get_kagree_algo(localIdent->kagreeAlgoKind));
+  DDS_Security_BinaryProperty_set_by_ref(&tokens[idx++], "c.id", certData, certDataSize);
+  DDS_Security_BinaryProperty_set_by_string(&tokens[idx++], "c.perm", localIdent->permissionsDocument ? localIdent->permissionsDocument : "");
+  DDS_Security_BinaryProperty_set_by_value(&tokens[idx++], "c.pdata", serialized_local_participant_data->_buffer, serialized_local_participant_data->_length);
+  DDS_Security_BinaryProperty_set_by_string(&tokens[idx++], "c.dsign_algo", get_dsign_algo(localIdent->dsignAlgoKind));
+  DDS_Security_BinaryProperty_set_by_string(&tokens[idx++], "c.kagree_algo", get_kagree_algo(localIdent->kagreeAlgoKind));
 
   /* Todo: including hash_c1 is optional (conform spec); add a configuration option to leave it out */
   {
     DDS_Security_BinaryPropertySeq bseq = { ._length = 5, ._buffer = tokens };
     get_hash_binary_property_seq(&bseq, handshake->hash_c1);
-    DDS_Security_BinaryProperty_set_by_value(hash_c1, "hash_c1", handshake->hash_c1, sizeof(HashValue_t));
+    if (impl->include_optional)
+      DDS_Security_BinaryProperty_set_by_value(&tokens[idx++], "hash_c1", handshake->hash_c1, sizeof(HashValue_t));
   }
 
   /* Set the DH public key associated with the local participant in dh1 property */
   assert(dhPubKeyData);
   assert(dhPubKeyDataSize < 1200);
-  DDS_Security_BinaryProperty_set_by_ref(dh1, "dh1", dhPubKeyData, dhPubKeyDataSize);
+  DDS_Security_BinaryProperty_set_by_ref(&tokens[idx++], "dh1", dhPubKeyData, dhPubKeyDataSize);
 
   /* Set the challenge in challenge1 property */
-  DDS_Security_BinaryProperty_set_by_value(challenge, "challenge1", relation->lchallenge->value, sizeof(AuthenticationChallenge));
+  DDS_Security_BinaryProperty_set_by_value(&tokens[idx++], "challenge1", relation->lchallenge->value, sizeof(AuthenticationChallenge));
 
   (void)ddsrt_hh_add(impl->objectHash, handshake);
 
@@ -1221,7 +1216,7 @@ DDS_Security_ValidationResult_t begin_handshake_request(dds_security_authenticat
   handshake_message->class_id = ddsrt_strdup(AUTH_HANDSHAKE_REQUEST_TOKEN_ID);
   handshake_message->properties._length = 0;
   handshake_message->properties._buffer = NULL;
-  handshake_message->binary_properties._length = 8;
+  handshake_message->binary_properties._length = tsz;
   handshake_message->binary_properties._buffer = tokens;
   *handshake_handle = HANDSHAKE_HANDLE(handshake);
 
@@ -1372,10 +1367,26 @@ static X509 *load_X509_certificate_from_binprop (const DDS_Security_BinaryProper
   return cert;
 }
 
+static DDS_Security_BinaryProperty_t *
+create_dhkey_property(const char *name, EVP_PKEY *pkey, AuthenticationAlgoKind_t kagreeAlgoKind,  DDS_Security_SecurityException *ex)
+{
+  DDS_Security_BinaryProperty_t *prop;
+  unsigned char *data;
+  uint32_t len;
+
+  if (dh_public_key_to_oct(pkey, kagreeAlgoKind, &data, &len, ex) != DDS_SECURITY_VALIDATION_OK)
+    return NULL;
+
+  prop = DDS_Security_BinaryProperty_alloc();
+  DDS_Security_BinaryProperty_set_by_ref(prop, name, data, len);
+  return prop;
+}
+
 static DDS_Security_ValidationResult_t validate_handshake_token_impl (const DDS_Security_HandshakeMessageToken *token, enum handshake_token_type token_type,
-    HandshakeInfo *handshake, EVP_PKEY **pdhkey_reply, X509Seq *trusted_ca_list, EVP_PKEY **pdhkey_req, X509 **identityCert, DDS_Security_SecurityException *ex)
+    HandshakeInfo *handshake, X509Seq *trusted_ca_list, const DDS_Security_BinaryProperty_t *dh1_ref, const DDS_Security_BinaryProperty_t *dh2_ref, DDS_Security_SecurityException *ex)
 {
   IdentityRelation * const relation = handshake->relation;
+  X509 *identityCert = NULL;
   const DDS_Security_BinaryProperty_t *c_pdata = NULL;
   AuthenticationAlgoKind_t dsignAlgoKind = AUTH_ALGO_KIND_UNKNOWN, kagreeAlgoKind = AUTH_ALGO_KIND_UNKNOWN;
   const DDS_Security_BinaryProperty_t *dh1 = NULL, *dh2 = NULL;
@@ -1385,10 +1396,8 @@ static DDS_Security_ValidationResult_t validate_handshake_token_impl (const DDS_
   const char *token_class_id = NULL;
 
   assert (relation);
-  assert (pdhkey_req == NULL || *pdhkey_req == NULL);
-  assert (pdhkey_reply == NULL || *pdhkey_reply == NULL);
-  assert (pdhkey_req == NULL || token_type == HS_TOKEN_REQ);
-  assert (pdhkey_reply == NULL || token_type == HS_TOKEN_REPLY);
+  assert (dh1_ref != NULL || token_type == HS_TOKEN_REQ);
+  assert (dh2_ref != NULL || token_type == HS_TOKEN_REQ || token_type == HS_TOKEN_REPLY);
 
   switch (token_type)
   {
@@ -1407,9 +1416,14 @@ static DDS_Security_ValidationResult_t validate_handshake_token_impl (const DDS_
 
     if ((c_id = find_required_nonempty_binprop (token, "c.id", ex)) == NULL)
       return DDS_SECURITY_VALIDATION_FAILED;
-    if ((*identityCert = load_X509_certificate_from_binprop (c_id, relation->localIdentity->identityCA, trusted_ca_list, ex)) == NULL)
+    if ((identityCert = load_X509_certificate_from_binprop (c_id, relation->localIdentity->identityCA, trusted_ca_list, ex)) == NULL)
       return DDS_SECURITY_VALIDATION_FAILED;
 
+    /* TODO: check if an identity certificate was already associated with the remote identity and when that is the case both should be the same */
+    if (relation->remoteIdentity->identityCert)
+      X509_free (relation->remoteIdentity->identityCert);
+    relation->remoteIdentity->identityCert = identityCert;
+
     if ((c_perm = find_required_binprop (token, "c.perm", ex)) == NULL)
       return DDS_SECURITY_VALIDATION_FAILED;
     if (c_perm->value._length > 0)
@@ -1420,7 +1434,7 @@ static DDS_Security_ValidationResult_t validate_handshake_token_impl (const DDS_
 
     if ((c_pdata = find_required_binprop (token, "c.pdata", ex)) == NULL)
       return DDS_SECURITY_VALIDATION_FAILED;
-    if (validate_pdata (&c_pdata->value, *identityCert, ex) != DDS_SECURITY_VALIDATION_OK)
+    if (validate_pdata (&c_pdata->value, identityCert, ex) != DDS_SECURITY_VALIDATION_OK)
       return DDS_SECURITY_VALIDATION_FAILED;
 
     if ((c_dsign_algo = find_required_nonempty_binprop (token, "c.dsign_algo", ex)) == NULL)
@@ -1438,29 +1452,55 @@ static DDS_Security_ValidationResult_t validate_handshake_token_impl (const DDS_
     (void) compute_hash_value ((token_type == HS_TOKEN_REQ) ? handshake->hash_c1 : handshake->hash_c2, binary_properties, 5, NULL);
   }
 
-  if ((dh1 = find_required_nonempty_binprop (token, "dh1", ex)) == NULL)
-    return DDS_SECURITY_VALIDATION_FAILED;
-  if ((challenge1 = find_required_binprop_exactsize (token, "challenge1", sizeof (AuthenticationChallenge), ex)) == NULL)
-    return DDS_SECURITY_VALIDATION_FAILED;
   if (token_type == HS_TOKEN_REQ)
   {
-    if (dh_oct_to_public_key (pdhkey_req, kagreeAlgoKind, dh1->value._buffer, dh1->value._length, ex) != DDS_SECURITY_VALIDATION_OK)
+    EVP_PKEY *pdhkey_req = NULL;
+
+    if ((dh1 = find_required_nonempty_binprop (token, "dh1", ex)) == NULL)
       return DDS_SECURITY_VALIDATION_FAILED;
+    if (dh_oct_to_public_key (&pdhkey_req, kagreeAlgoKind, dh1->value._buffer, dh1->value._length, ex) != DDS_SECURITY_VALIDATION_OK)
+      return DDS_SECURITY_VALIDATION_FAILED;
+    if (handshake->rdh)
+      EVP_PKEY_free (handshake->rdh);
+    handshake->rdh = pdhkey_req;
   }
+  else
+  {
+    dh1 = DDS_Security_DataHolder_find_binary_property (token, "dh1");
+    if (dh1 && !DDS_Security_BinaryProperty_equal(dh1_ref, dh1))
+      return set_exception (ex, "process_handshake: %s token property dh1 not correct", (token_type == HS_TOKEN_REPLY) ? "Reply" : "Final");
+    dh1 = dh1_ref;
+  }
+
+  if ((challenge1 = find_required_binprop_exactsize (token, "challenge1", sizeof (AuthenticationChallenge), ex)) == NULL)
+    return DDS_SECURITY_VALIDATION_FAILED;
 
   if (token_type == HS_TOKEN_REPLY || token_type == HS_TOKEN_FINAL)
   {
-    if ((dh2 = find_required_nonempty_binprop (token, "dh2", ex)) == NULL)
-      return DDS_SECURITY_VALIDATION_FAILED;
     if ((challenge2 = find_required_binprop_exactsize (token, "challenge2", sizeof (AuthenticationChallenge), ex)) == NULL)
       return DDS_SECURITY_VALIDATION_FAILED;
     if ((signature = find_required_nonempty_binprop (token, "signature", ex)) == NULL)
       return DDS_SECURITY_VALIDATION_FAILED;
-  }
-  if (token_type == HS_TOKEN_REPLY)
-  {
-    if (dh_oct_to_public_key (pdhkey_reply, kagreeAlgoKind, dh2->value._buffer, dh2->value._length, ex) != DDS_SECURITY_VALIDATION_OK)
-      return DDS_SECURITY_VALIDATION_FAILED;
+
+    if (token_type == HS_TOKEN_REPLY)
+    {
+      EVP_PKEY *pdhkey_reply = NULL;
+
+      if ((dh2 = find_required_nonempty_binprop (token, "dh2", ex)) == NULL)
+        return DDS_SECURITY_VALIDATION_FAILED;
+      if (dh_oct_to_public_key (&pdhkey_reply, kagreeAlgoKind, dh2->value._buffer, dh2->value._length, ex) != DDS_SECURITY_VALIDATION_OK)
+        return DDS_SECURITY_VALIDATION_FAILED;
+      if (handshake->rdh)
+           EVP_PKEY_free (handshake->rdh);
+      handshake->rdh = pdhkey_reply;
+    }
+    else
+    {
+      dh2 = DDS_Security_DataHolder_find_binary_property (token, "dh2");
+      if (dh2 && !DDS_Security_BinaryProperty_equal(dh2_ref, dh2))
+        return set_exception (ex, "process_handshake: Final token property dh2 not correct");
+      dh2 = dh2_ref;
+    }
   }
 
   /* When validate_remote_identity was provided with a remote_auth_request_token then the future_challenge in
@@ -1506,26 +1546,12 @@ static DDS_Security_ValidationResult_t validate_handshake_token_impl (const DDS_
       return set_exception (ex, "process_handshake: HandshakeMessageToken property challenge1 does not match future_challenge");
   }
 
-  if (token_type == HS_TOKEN_REQ)
-  {
-    if (!EVP_PKEY_up_ref (*pdhkey_req))
-      return set_exception (ex, "process_handshake: failed to increment refcount of DH key");
-    handshake->rdh = *pdhkey_req;
-  }
-
   if (token_type == HS_TOKEN_REQ || token_type == HS_TOKEN_REPLY)
   {
-    assert (*identityCert != NULL);
     assert (dsignAlgoKind != AUTH_ALGO_KIND_UNKNOWN);
     assert (kagreeAlgoKind != AUTH_ALGO_KIND_UNKNOWN);
     assert (c_pdata != NULL);
 
-    /* TODO: check if an identity certificate was already associated with the remote identity and when that is the case both should be the same */
-    if (relation->remoteIdentity->identityCert)
-      X509_free (relation->remoteIdentity->identityCert);
-    if (!X509_up_ref (*identityCert))
-      return set_exception (ex, "process_handshake: failed to increment refcount of identity certificate");
-    relation->remoteIdentity->identityCert = *identityCert;
     relation->remoteIdentity->dsignAlgoKind = dsignAlgoKind;
     relation->remoteIdentity->kagreeAlgoKind = kagreeAlgoKind;
     DDS_Security_OctetSeq_copy (&relation->remoteIdentity->pdata, &c_pdata->value);
@@ -1551,6 +1577,7 @@ static DDS_Security_ValidationResult_t validate_handshake_token_impl (const DDS_
       result = validate_signature (public_key, (const DDS_Security_BinaryProperty_t *[]) {
         &hash_c1_val, challenge1, dh1, challenge2, dh2, &hash_c2_val }, 6, signature->value._buffer, signature->value._length, ex);
     EVP_PKEY_free (public_key);
+
     if (result != DDS_SECURITY_VALIDATION_OK)
       return result;
   }
@@ -1559,34 +1586,30 @@ static DDS_Security_ValidationResult_t validate_handshake_token_impl (const DDS_
 }
 
 static DDS_Security_ValidationResult_t validate_handshake_token(const DDS_Security_HandshakeMessageToken *token, enum handshake_token_type token_type, HandshakeInfo *handshake,
-    EVP_PKEY **pdhkey_reply, X509Seq *trusted_ca_list, DDS_Security_SecurityException *ex)
+    X509Seq *trusted_ca_list, const DDS_Security_BinaryProperty_t *dh1_ref, const DDS_Security_BinaryProperty_t *dh2_ref, DDS_Security_SecurityException *ex)
 {
-  X509 *identityCert = NULL;
-  EVP_PKEY *pdhkey_req = NULL;
-
-  const DDS_Security_ValidationResult_t ret = validate_handshake_token_impl (token, token_type, handshake, pdhkey_reply, trusted_ca_list,
-    (token_type == HS_TOKEN_REQ) ? &pdhkey_req : NULL, &identityCert, ex);
+  const DDS_Security_ValidationResult_t ret = validate_handshake_token_impl (token, token_type, handshake, trusted_ca_list, dh1_ref, dh2_ref, ex);
 
   if (ret != DDS_SECURITY_VALIDATION_OK)
   {
-    IdentityRelation *relation = handshake->relation;
-    if (relation->remoteIdentity->identityCert)
+    if (token_type == HS_TOKEN_REQ || token_type == HS_TOKEN_REPLY)
     {
-      X509_free (relation->remoteIdentity->identityCert);
-      relation->remoteIdentity->identityCert = NULL;
+      IdentityRelation *relation = handshake->relation;
+
+      if (relation->remoteIdentity->identityCert)
+      {
+        X509_free (relation->remoteIdentity->identityCert);
+        relation->remoteIdentity->identityCert = NULL;
+      }
+
+      if (handshake->rdh)
+      {
+        EVP_PKEY_free (handshake->rdh);
+        handshake->rdh = NULL;
+      }
     }
-    if (pdhkey_reply && *pdhkey_reply)
-      EVP_PKEY_free (*pdhkey_reply);
   }
 
-  if (pdhkey_req)
-    EVP_PKEY_free (pdhkey_req);
-  if (identityCert)
-  {
-    /* free id cert also when validation succeeded, because the refcount was increased
-       when assigning this cert to relation->remoteIdentity  */
-    X509_free (identityCert);
-  }
   return ret;
 }
 
@@ -1602,10 +1625,9 @@ DDS_Security_ValidationResult_t begin_handshake_reply(dds_security_authenticatio
   LocalIdentityInfo *localIdent;
   RemoteIdentityInfo *remoteIdent;
   EVP_PKEY *dhkeyLocal = NULL;
-  DDS_Security_BinaryProperty_t *tokens, *c_id, *c_perm, *c_pdata, *c_dsign_algo, *c_kagree_algo, *hash_c1, *hash_c2, *dh1, *dh2, *challenge1, *challenge2, *signature;
-  const DDS_Security_BinaryProperty_t *hash_c1_ref, *dh1_ref;
   unsigned char *certData, *dhPubKeyData;
-  uint32_t certDataSize, dhPubKeyDataSize, tokenSize;
+  uint32_t certDataSize, dhPubKeyDataSize;
+  uint32_t tsz = impl->include_optional ? 12 : 9;
   int created = 0;
 
   if (!instance || !handshake_handle || !handshake_message_out || !handshake_message_in || !serialized_local_participant_data)
@@ -1652,7 +1674,7 @@ DDS_Security_ValidationResult_t begin_handshake_reply(dds_security_authenticatio
     assert(relation);
   }
 
-  if (validate_handshake_token(handshake_message_in, HS_TOKEN_REQ, handshake, NULL, &(impl->trustedCAList), ex) != DDS_SECURITY_VALIDATION_OK)
+  if (validate_handshake_token(handshake_message_in, HS_TOKEN_REQ, handshake, &(impl->trustedCAList), NULL, NULL, ex) != DDS_SECURITY_VALIDATION_OK)
     goto err_inv_token;
   if (get_certificate_contents(localIdent->identityCert, &certData, &certDataSize, ex) != DDS_SECURITY_VALIDATION_OK)
     goto err_alloc_cid;
@@ -1672,58 +1694,44 @@ DDS_Security_ValidationResult_t begin_handshake_reply(dds_security_authenticatio
   if (localIdent->pdata._length == 0)
     DDS_Security_OctetSeq_copy(&localIdent->pdata, serialized_local_participant_data);
 
-  hash_c1_ref = DDS_Security_DataHolder_find_binary_property(handshake_message_in, "hash_c1");
-  tokenSize = hash_c1_ref ? 12 : 11;
-
-  tokens = DDS_Security_BinaryPropertySeq_allocbuf(tokenSize);
-  c_id = &tokens[0];
-  c_perm = &tokens[1];
-  c_pdata = &tokens[2];
-  c_dsign_algo = &tokens[3];
-  c_kagree_algo = &tokens[4];
-  signature = &tokens[5];
-  hash_c2 = &tokens[6];
-  challenge2 = &tokens[7];
-  dh2 = &tokens[8];
-  challenge1 = &tokens[9];
-  dh1 = &tokens[10];
-  hash_c1 = hash_c1_ref ? &tokens[11] : NULL;
+  DDS_Security_BinaryProperty_t *tokens = DDS_Security_BinaryPropertySeq_allocbuf(tsz);
+  uint32_t idx = 0;
 
   /* Store the Identity Certificate associated with the local identify in c.id property */
-  DDS_Security_BinaryProperty_set_by_ref(c_id, "c.id", certData, certDataSize);
+  DDS_Security_BinaryProperty_set_by_ref(&tokens[idx++], "c.id", certData, certDataSize);
   certData = NULL;
-  DDS_Security_BinaryProperty_set_by_string(c_perm, "c.perm", localIdent->permissionsDocument ? localIdent->permissionsDocument : "");
-  DDS_Security_BinaryProperty_set_by_value(c_pdata, "c.pdata", serialized_local_participant_data->_buffer, serialized_local_participant_data->_length);
-  DDS_Security_BinaryProperty_set_by_string(c_dsign_algo, "c.dsign_algo", get_dsign_algo(localIdent->dsignAlgoKind));
-  DDS_Security_BinaryProperty_set_by_string(c_kagree_algo, "c.kagree_algo", get_kagree_algo(remoteIdent->kagreeAlgoKind));
+  DDS_Security_BinaryProperty_set_by_string(&tokens[idx++], "c.perm", localIdent->permissionsDocument ? localIdent->permissionsDocument : "");
+  DDS_Security_BinaryProperty_set_by_value(&tokens[idx++], "c.pdata", serialized_local_participant_data->_buffer, serialized_local_participant_data->_length);
+  DDS_Security_BinaryProperty_set_by_string(&tokens[idx++], "c.dsign_algo", get_dsign_algo(localIdent->dsignAlgoKind));
+  DDS_Security_BinaryProperty_set_by_string(&tokens[idx++], "c.kagree_algo", get_kagree_algo(remoteIdent->kagreeAlgoKind));
 
-  /* Todo: including hash_c2 is optional (conform spec); add a configuration option to leave it out */
-  {
-    DDS_Security_BinaryPropertySeq bseq = { ._length = 5, ._buffer = tokens };
-    get_hash_binary_property_seq(&bseq, handshake->hash_c2);
-    DDS_Security_BinaryProperty_set_by_value(hash_c2, "hash_c2", handshake->hash_c2, sizeof(HashValue_t));
-  }
+  /* Calculate the hash_c2 */
+  DDS_Security_BinaryPropertySeq bseq = { ._length = 5, ._buffer = tokens };
+  get_hash_binary_property_seq(&bseq, handshake->hash_c2);
 
   /* Set the DH public key associated with the local participant in dh2 property */
+  DDS_Security_BinaryProperty_t *dh2 = &tokens[idx++];
   DDS_Security_BinaryProperty_set_by_ref(dh2, "dh2", dhPubKeyData, dhPubKeyDataSize);
 
-  /* Set the DH public key associated with the local participant in hash_c1 property */
-  if (hash_c1)
-    DDS_Security_BinaryProperty_set_by_value(hash_c1, "hash_c1", hash_c1_ref->value._buffer, hash_c1_ref->value._length);
-
-  /* Set the DH public key associated with the local participant in dh1 property */
-  if (dh1)
-  {
-    dh1_ref = DDS_Security_DataHolder_find_binary_property(handshake_message_in, "dh1");
-    if (dh1_ref)
-      DDS_Security_BinaryProperty_set_by_value(dh1, "dh1", dh1_ref->value._buffer, dh1_ref->value._length);
-  }
+  /* Find the dh1 property from the received request token */
+  const DDS_Security_BinaryProperty_t *dh1 = DDS_Security_DataHolder_find_binary_property(handshake_message_in, "dh1");
+  assert(dh1);
 
   assert(relation->rchallenge);
+  DDS_Security_BinaryProperty_t *challenge1 = &tokens[idx++];
   DDS_Security_BinaryProperty_set_by_value(challenge1, "challenge1", relation->rchallenge->value, sizeof(AuthenticationChallenge));
   assert(relation->lchallenge);
+  DDS_Security_BinaryProperty_t *challenge2 = &tokens[idx++];
   DDS_Security_BinaryProperty_set_by_value(challenge2, "challenge2", relation->lchallenge->value, sizeof(AuthenticationChallenge));
 
+  /* THe dh1 and hash_c1 and hash_c2 are optional */
+  if (impl->include_optional)
+  {
+    DDS_Security_BinaryProperty_set_by_value(&tokens[idx++], "dh1", dh1->value._buffer, dh1->value._length);
+    DDS_Security_BinaryProperty_set_by_value(&tokens[idx++], "hash_c2", handshake->hash_c2, sizeof(HashValue_t));
+    DDS_Security_BinaryProperty_set_by_value(&tokens[idx++], "hash_c1", handshake->hash_c1, sizeof(HashValue_t));
+  }
+
   /* Calculate the signature */
   {
     unsigned char *sign;
@@ -1736,12 +1744,12 @@ DDS_Security_ValidationResult_t begin_handshake_reply(dds_security_authenticatio
     DDS_Security_BinaryProperty_free(hash_c2_val);
     if (result != DDS_SECURITY_VALIDATION_OK)
       goto err_signature;
-    DDS_Security_BinaryProperty_set_by_ref(signature, "signature", sign, (uint32_t)signlen);
+    DDS_Security_BinaryProperty_set_by_ref(&tokens[idx++], "signature", sign, (uint32_t)signlen);
   }
 
   (void)ddsrt_hh_add(impl->objectHash, handshake);
   handshake_message_out->class_id = ddsrt_strdup(AUTH_HANDSHAKE_REPLY_TOKEN_ID);
-  handshake_message_out->binary_properties._length = tokenSize;
+  handshake_message_out->binary_properties._length = tsz;
   handshake_message_out->binary_properties._buffer = tokens;
 
   ddsrt_mutex_unlock(&impl->lock);
@@ -1750,7 +1758,7 @@ DDS_Security_ValidationResult_t begin_handshake_reply(dds_security_authenticatio
   return DDS_SECURITY_VALIDATION_PENDING_HANDSHAKE_MESSAGE;
 
 err_signature:
-  free_binary_properties(tokens, tokenSize);
+  free_binary_properties(tokens, tsz);
 err_get_public_key:
 err_gen_dh_keys:
   ddsrt_free(certData);
@@ -1827,10 +1835,8 @@ DDS_Security_ValidationResult_t process_handshake(dds_security_authentication *i
   HandshakeInfo *handshake = NULL;
   IdentityRelation *relation = NULL;
   SecurityObject *obj;
-  EVP_PKEY *dhkeyRemote = NULL;
-  DDS_Security_BinaryProperty_t *tokens = NULL, *hash_c1 = NULL, *hash_c2 = NULL, *dh1, *dh2, *challenge1, *challenge2, *signature;
-  const DDS_Security_BinaryProperty_t *hash_c1_ref, *hash_c2_ref, *challenge1_ref, *challenge2_ref, *dh1_ref, *dh2_ref;
-  uint32_t tokenSize = 0, idx;
+  DDS_Security_BinaryProperty_t *dh1_gen = NULL, *dh2_gen = NULL;
+  const uint32_t tsz = impl->include_optional ? 7 : 3;
   DDS_Security_octet *challenge1_ref_for_shared_secret, *challenge2_ref_for_shared_secret;
 
   /* validate provided arguments */
@@ -1857,50 +1863,37 @@ DDS_Security_ValidationResult_t process_handshake(dds_security_authentication *i
   switch (handshake->created_in)
   {
   case CREATEDREQUEST:
-    /* The source of the handshake_handle is a begin_handshake_request function. So, handshake_message_in is from a remote begin_handshake_reply function */
-    /* Verify Message Token contents according to Spec 9.3.2.5.2 (Reply Message)  */
-    if (validate_handshake_token(handshake_message_in, HS_TOKEN_REPLY, handshake, &dhkeyRemote, &(impl->trustedCAList), ex) != DDS_SECURITY_VALIDATION_OK)
+    if ((dh1_gen = create_dhkey_property("dh1", handshake->ldh, relation->localIdentity->kagreeAlgoKind, ex)) == NULL)
+      goto err_inv_token;
+
+    /* The source of the handshake_handle is a begin_handshake_request function. So, handshake_message_in is from a remote begin_handshake_reply function */
+    /* Verify Message Token contents according to Spec 9.3.2.5.2 (Reply Message)  */
+    if (validate_handshake_token(handshake_message_in, HS_TOKEN_REPLY, handshake, &(impl->trustedCAList), dh1_gen, NULL, ex) != DDS_SECURITY_VALIDATION_OK)
       goto err_inv_token;
 
-    handshake->rdh = dhkeyRemote;
     EVP_PKEY_copy_parameters(handshake->rdh, handshake->ldh);
 
-    /* Prepare HandshakeFinalMessageToken */
-    hash_c1_ref = DDS_Security_DataHolder_find_binary_property(handshake_message_in, "hash_c1");
-    hash_c2_ref = DDS_Security_DataHolder_find_binary_property(handshake_message_in, "hash_c2");
-    dh1_ref = DDS_Security_DataHolder_find_binary_property(handshake_message_in, "dh1");
-    dh2_ref = DDS_Security_DataHolder_find_binary_property(handshake_message_in, "dh2");
-    challenge1_ref = DDS_Security_DataHolder_find_binary_property(handshake_message_in, "challenge1");
-    challenge2_ref = DDS_Security_DataHolder_find_binary_property(handshake_message_in, "challenge2");
-    tokenSize = 3; /* challenge1, challenge2 and signature are in already */
-    if (hash_c1_ref) tokenSize++;
-    if (hash_c2_ref) tokenSize++;
-    if (dh1_ref) tokenSize++;
-    if (dh2_ref) tokenSize++;
-    tokens = DDS_Security_BinaryPropertySeq_allocbuf(tokenSize);
-    idx = 0;
-    signature = &tokens[idx++];
-    hash_c2 = hash_c2_ref ? &tokens[idx++] : NULL;
-    challenge2 = &tokens[idx++];
-    dh2 = dh2_ref ? &tokens[idx++] : NULL;
-    challenge1 = &tokens[idx++];
-    dh1 = dh1_ref ? &tokens[idx++] : NULL;
-    hash_c1 = hash_c1_ref ? &tokens[idx++] : NULL;
+    /* Find the dh1 property from the received request token */
+    const DDS_Security_BinaryProperty_t *dh2 = DDS_Security_DataHolder_find_binary_property(handshake_message_in, "dh2");
+    assert(dh2);
+
+    DDS_Security_BinaryProperty_t *tokens = DDS_Security_BinaryPropertySeq_allocbuf(tsz);
+    uint32_t idx = 0;
 
-    if (hash_c1)
-      DDS_Security_BinaryProperty_set_by_value(hash_c1, "hash_c1", hash_c1_ref->value._buffer, hash_c1_ref->value._length);
-    if (hash_c2)
-      DDS_Security_BinaryProperty_set_by_value(hash_c2, "hash_c2", hash_c2_ref->value._buffer, hash_c2_ref->value._length);
-    if (dh1)
-      DDS_Security_BinaryProperty_set_by_value(dh1, "dh1", dh1_ref->value._buffer, dh1_ref->value._length);
-    if (dh2)
-      DDS_Security_BinaryProperty_set_by_value(dh2, "dh2", dh2_ref->value._buffer, dh2_ref->value._length);
     assert(relation->lchallenge);
-    if (challenge1 && challenge1_ref)
-      DDS_Security_BinaryProperty_set_by_value(challenge1, "challenge1", challenge1_ref->value._buffer, challenge1_ref->value._length);
+    DDS_Security_BinaryProperty_t *challenge1 = &tokens[idx++];
+    DDS_Security_BinaryProperty_set_by_value(challenge1, "challenge1", relation->lchallenge->value, sizeof(AuthenticationChallenge));
     assert(relation->rchallenge);
-    if (challenge2 && challenge2_ref)
-      DDS_Security_BinaryProperty_set_by_value(challenge2, "challenge2", challenge2_ref->value._buffer, challenge2_ref->value._length);
+    DDS_Security_BinaryProperty_t *challenge2 = &tokens[idx++];
+    DDS_Security_BinaryProperty_set_by_value(challenge2, "challenge2", relation->rchallenge->value, sizeof(AuthenticationChallenge));
+
+    if (impl->include_optional)
+    {
+      DDS_Security_BinaryProperty_set_by_value(&tokens[idx++], "dh1", dh1_gen->value._buffer, dh1_gen->value._length);
+      DDS_Security_BinaryProperty_set_by_value(&tokens[idx++], "dh2", dh2->value._buffer, dh2->value._length);
+      DDS_Security_BinaryProperty_set_by_value(&tokens[idx++], "hash_c2", handshake->hash_c2, sizeof(HashValue_t));
+      DDS_Security_BinaryProperty_set_by_value(&tokens[idx++], "hash_c1", handshake->hash_c1, sizeof(HashValue_t));
+    }
 
     /* Calculate the signature */
     {
@@ -1908,17 +1901,17 @@ DDS_Security_ValidationResult_t process_handshake(dds_security_authentication *i
       size_t signlen;
       DDS_Security_BinaryProperty_t *hash_c1_val = hash_value_to_binary_property("hash_c1", handshake->hash_c1);
       DDS_Security_BinaryProperty_t *hash_c2_val = hash_value_to_binary_property("hash_c2", handshake->hash_c2);
-      const DDS_Security_BinaryProperty_t *binary_properties[HANDSHAKE_SIGNATURE_CONTENT_SIZE] = { hash_c1_val, challenge1, dh1, challenge2, dh2, hash_c2_val };
+      const DDS_Security_BinaryProperty_t *binary_properties[HANDSHAKE_SIGNATURE_CONTENT_SIZE] = { hash_c1_val, challenge1, dh1_gen, challenge2, dh2, hash_c2_val };
       DDS_Security_ValidationResult_t result = create_signature(relation->localIdentity->privateKey, binary_properties, HANDSHAKE_SIGNATURE_CONTENT_SIZE, &sign, &signlen, ex);
       DDS_Security_BinaryProperty_free(hash_c1_val);
       DDS_Security_BinaryProperty_free(hash_c2_val);
       if (result != DDS_SECURITY_VALIDATION_OK)
         goto err_signature;
-      DDS_Security_BinaryProperty_set_by_ref(signature, "signature", sign, (uint32_t)signlen);
+      DDS_Security_BinaryProperty_set_by_ref(&tokens[idx++], "signature", sign, (uint32_t)signlen);
     }
 
     handshake_message_out->class_id = ddsrt_strdup(AUTH_HANDSHAKE_FINAL_TOKEN_ID);
-    handshake_message_out->binary_properties._length = tokenSize;
+    handshake_message_out->binary_properties._length = tsz;
     handshake_message_out->binary_properties._buffer = tokens;
     challenge1_ref_for_shared_secret = (DDS_Security_octet *)(handshake->relation->lchallenge);
     challenge2_ref_for_shared_secret = (DDS_Security_octet *)(handshake->relation->rchallenge);
@@ -1926,9 +1919,14 @@ DDS_Security_ValidationResult_t process_handshake(dds_security_authentication *i
     break;
 
   case CREATEDREPLY:
+    if ((dh1_gen = create_dhkey_property("dh1", handshake->rdh, relation->remoteIdentity->kagreeAlgoKind, ex)) == NULL)
+      goto err_inv_token;
+    if ((dh2_gen = create_dhkey_property("dh2", handshake->ldh, relation->remoteIdentity->kagreeAlgoKind, ex)) == NULL)
+      goto err_inv_token;
+
     /* The source of the handshake_handle is a begin_handshake_reply function So, handshake_message_in is from a remote process_handshake function */
     /* Verify Message Token contents according to Spec 9.3.2.5.3 (Final Message)   */
-    if (validate_handshake_token(handshake_message_in, HS_TOKEN_FINAL, handshake, NULL, NULL, ex) != DDS_SECURITY_VALIDATION_OK)
+    if (validate_handshake_token(handshake_message_in, HS_TOKEN_FINAL, handshake, NULL, dh1_gen, dh2_gen, ex) != DDS_SECURITY_VALIDATION_OK)
       goto err_inv_token;
     challenge2_ref_for_shared_secret = (DDS_Security_octet *)(handshake->relation->lchallenge);
     challenge1_ref_for_shared_secret = (DDS_Security_octet *)(handshake->relation->rchallenge);
@@ -1964,6 +1962,10 @@ DDS_Security_ValidationResult_t process_handshake(dds_security_authentication *i
       add_validity_end_trigger(impl, IDENTITY_HANDLE(handshake->relation->remoteIdentity), cert_exp);
   }
   ddsrt_mutex_unlock(&impl->lock);
+
+  DDS_Security_BinaryProperty_free(dh1_gen);
+  DDS_Security_BinaryProperty_free(dh2_gen);
+
   return hs_result;
 
 err_invalid_expiry:
@@ -1975,6 +1977,8 @@ err_signature:
   if (handshake_message_out->class_id)
     DDS_Security_DataHolder_deinit(handshake_message_out);
 err_inv_token:
+  DDS_Security_BinaryProperty_free(dh1_gen);
+  DDS_Security_BinaryProperty_free(dh2_gen);
 err_inv_handle:
   ddsrt_mutex_unlock(&impl->lock);
 err_bad_param:
@@ -2262,6 +2266,10 @@ int32_t init_authentication(const char *argument, void **context, struct ddsi_do
   authentication->objectHash = ddsrt_hh_new(32, security_object_hash, security_object_equal);
   authentication->remoteGuidHash = ddsrt_hh_new(32, remote_guid_hash, remote_guid_equal);
   memset(&authentication->trustedCAList, 0, sizeof(X509Seq));
+  if (gv)
+    authentication->include_optional = gv->handshake_include_optional;
+  else
+    authentication->include_optional = true;
 
   OpenSSL_add_all_algorithms();
   OpenSSL_add_all_ciphers();
diff --git a/src/security/core/include/dds/security/core/dds_security_utils.h b/src/security/core/include/dds/security/core/dds_security_utils.h
index c61829a..21ac8fc 100644
--- a/src/security/core/include/dds/security/core/dds_security_utils.h
+++ b/src/security/core/include/dds/security/core/dds_security_utils.h
@@ -53,12 +53,12 @@ DDS_Security_BinaryProperty_free(
 DDS_EXPORT void
 DDS_Security_BinaryProperty_copy(
          DDS_Security_BinaryProperty_t *dst,
-         DDS_Security_BinaryProperty_t *src);
+         const DDS_Security_BinaryProperty_t *src);
 
 DDS_EXPORT bool
 DDS_Security_BinaryProperty_equal(
-         DDS_Security_BinaryProperty_t *pa,
-         DDS_Security_BinaryProperty_t *pb);
+         const DDS_Security_BinaryProperty_t *pa,
+         const DDS_Security_BinaryProperty_t *pb);
 
 DDS_EXPORT void
 DDS_Security_BinaryProperty_set_by_value(
@@ -111,12 +111,12 @@ DDS_Security_Property_deinit(
 DDS_EXPORT void
 DDS_Security_Property_copy(
          DDS_Security_Property_t *dst,
-         DDS_Security_Property_t *src);
+         const DDS_Security_Property_t *src);
 
 DDS_EXPORT bool
 DDS_Security_Property_equal(
-         DDS_Security_Property_t *pa,
-         DDS_Security_Property_t *pb);
+         const DDS_Security_Property_t *pa,
+         const DDS_Security_Property_t *pb);
 
 DDS_EXPORT char *
 DDS_Security_Property_get_value(
diff --git a/src/security/core/src/dds_security_utils.c b/src/security/core/src/dds_security_utils.c
index 723a383..0d3742a 100644
--- a/src/security/core/src/dds_security_utils.c
+++ b/src/security/core/src/dds_security_utils.c
@@ -63,7 +63,7 @@ DDS_Security_BinaryProperty_free(
 void
 DDS_Security_BinaryProperty_copy(
      DDS_Security_BinaryProperty_t *dst,
-     DDS_Security_BinaryProperty_t *src)
+     const DDS_Security_BinaryProperty_t *src)
 {
     dst->name = src->name ? ddsrt_strdup(src->name) : NULL;
     dst->propagate = src->propagate;
@@ -80,8 +80,8 @@ DDS_Security_BinaryProperty_copy(
 
 bool
 DDS_Security_BinaryProperty_equal(
-     DDS_Security_BinaryProperty_t *pa,
-     DDS_Security_BinaryProperty_t *pb)
+     const DDS_Security_BinaryProperty_t *pa,
+     const DDS_Security_BinaryProperty_t *pb)
 {
     uint32_t i;
 
@@ -248,7 +248,7 @@ DDS_Security_Property_deinit(
 void
 DDS_Security_Property_copy(
      DDS_Security_Property_t *dst,
-     DDS_Security_Property_t *src)
+     const DDS_Security_Property_t *src)
 {
     dst->name = src->name ? ddsrt_strdup(src->name) : NULL;
     dst->value = src->value ? ddsrt_strdup(src->value) : NULL;
@@ -257,8 +257,8 @@ DDS_Security_Property_copy(
 
 bool
 DDS_Security_Property_equal(
-     DDS_Security_Property_t *pa,
-     DDS_Security_Property_t *pb)
+     const DDS_Security_Property_t *pa,
+     const DDS_Security_Property_t *pb)
 {
     if (pa->name && pb->name) {
         if (strcmp(pa->name, pb->name) != 0) {

From 720c8f8fbf0cd08b96a849eb660b8d72dd3f9bf5 Mon Sep 17 00:00:00 2001
From: Marcel Jordense <marcel.jordense@adlinktech.com>
Date: Fri, 1 May 2020 10:58:07 +0200
Subject: [PATCH 177/238] Correct security (de)serialization of QosProperty
 contained in c.data field of handshake token

Signed-off-by: Marcel Jordense <marcel.jordense@adlinktech.com>
---
 .../core/src/dds_security_serialize.c         | 19 ++++++++++++++-----
 1 file changed, 14 insertions(+), 5 deletions(-)

diff --git a/src/security/core/src/dds_security_serialize.c b/src/security/core/src/dds_security_serialize.c
index d5a37d4..0e92790 100644
--- a/src/security/core/src/dds_security_serialize.c
+++ b/src/security/core/src/dds_security_serialize.c
@@ -396,7 +396,8 @@ DDS_Security_Serialize_PropertyQosPolicy(
     DDS_Security_Serialize_uint16(ser, PID_PROPERTY_LIST);
     DDS_Security_Serialize_mark_len(ser);
     DDS_Security_Serialize_PropertySeq(ser, &policy->value);
-    DDS_Security_Serialize_BinaryPropertySeq(ser, &policy->binary_value);
+    if (policy->binary_value._length > 0)
+      DDS_Security_Serialize_BinaryPropertySeq(ser, &policy->binary_value);
     DDS_Security_Serialize_update_len(ser);
 }
 
@@ -679,10 +680,18 @@ DDS_Security_Deserialize_DataHolder(
 static int
 DDS_Security_Deserialize_PropertyQosPolicy(
      DDS_Security_Deserializer dser,
-     DDS_Security_PropertyQosPolicy *policy)
+     DDS_Security_PropertyQosPolicy *policy,
+     size_t len)
 {
-    return DDS_Security_Deserialize_PropertySeq(dser, &policy->value) &&
-           DDS_Security_Deserialize_BinaryPropertySeq(dser, &policy->binary_value);
+    size_t sl = dser->remain;
+
+    if (!DDS_Security_Deserialize_PropertySeq(dser, &policy->value))
+        return 0;
+
+    if (sl - dser->remain > len)
+        return DDS_Security_Deserialize_BinaryPropertySeq(dser, &policy->binary_value);
+
+    return 1;
 }
 
 static int
@@ -742,7 +751,7 @@ DDS_Security_Deserialize_ParticipantBuiltinTopicData(
                 r = DDS_Security_Deserialize_DataHolder(dser, &pdata->permissions_token);
                 break;
             case PID_PROPERTY_LIST:
-                r = DDS_Security_Deserialize_PropertyQosPolicy(dser, &pdata->property);
+                r = DDS_Security_Deserialize_PropertyQosPolicy(dser, &pdata->property, len);
                 break;
             case PID_PARTICIPANT_SECURITY_INFO:
                 r = DDS_Security_Deserialize_ParticipantSecurityInfo(dser, &pdata->security_info);

From 860f261dc6b94ee354f6e2c34f9f7506704b7818 Mon Sep 17 00:00:00 2001
From: Marcel Jordense <marcel.jordense@adlinktech.com>
Date: Fri, 1 May 2020 14:13:05 +0200
Subject: [PATCH 178/238] Correct generation of the crypto key

Signed-off-by: Marcel Jordense <marcel.jordense@adlinktech.com>
---
 .../cryptographic/src/crypto_key_factory.c      | 17 +++++++++--------
 .../cryptographic/src/crypto_utils.c            |  1 +
 2 files changed, 10 insertions(+), 8 deletions(-)

diff --git a/src/security/builtin_plugins/cryptographic/src/crypto_key_factory.c b/src/security/builtin_plugins/cryptographic/src/crypto_key_factory.c
index cef6830..5416abf 100644
--- a/src/security/builtin_plugins/cryptographic/src/crypto_key_factory.c
+++ b/src/security/builtin_plugins/cryptographic/src/crypto_key_factory.c
@@ -89,8 +89,10 @@ calculate_kx_keys(
   unsigned char *kx_master_salt, *kx_master_sender_key;
   size_t shared_secret_size = get_secret_size_from_secret_handle(shared_secret);
   unsigned char hash[SHA256_DIGEST_LENGTH];
-  size_t concatenated_bytes1_size = DDS_SECURITY_AUTHENTICATION_CHALLENGE_SIZE * 2 + sizeof(KXSALTCOOKIE);
-  size_t concatenated_bytes2_size = DDS_SECURITY_AUTHENTICATION_CHALLENGE_SIZE * 2 + sizeof(KXKEYCOOKIE);
+  size_t KXKEYCOOKIE_SIZE = strlen(KXKEYCOOKIE);
+  size_t KXSALTCOOKIE_SIZE = strlen(KXSALTCOOKIE);
+  size_t concatenated_bytes1_size = DDS_SECURITY_AUTHENTICATION_CHALLENGE_SIZE * 2 + KXSALTCOOKIE_SIZE;
+  size_t concatenated_bytes2_size = DDS_SECURITY_AUTHENTICATION_CHALLENGE_SIZE * 2 + KXKEYCOOKIE_SIZE;
   DDS_Security_octet *concatenated_bytes1, *concatenated_bytes2;
 
   memset(ex, 0, sizeof(*ex));
@@ -108,9 +110,8 @@ calculate_kx_keys(
 
   /* master_salt */
   memcpy(concatenated_bytes1, challenge1, DDS_SECURITY_AUTHENTICATION_CHALLENGE_SIZE);
-  memcpy(concatenated_bytes1 + DDS_SECURITY_AUTHENTICATION_CHALLENGE_SIZE, KXSALTCOOKIE, sizeof(KXSALTCOOKIE));
-  memcpy(concatenated_bytes1 + DDS_SECURITY_AUTHENTICATION_CHALLENGE_SIZE + sizeof(KXSALTCOOKIE), challenge2,
-         DDS_SECURITY_AUTHENTICATION_CHALLENGE_SIZE);
+  memcpy(concatenated_bytes1 + DDS_SECURITY_AUTHENTICATION_CHALLENGE_SIZE, KXSALTCOOKIE, KXSALTCOOKIE_SIZE);
+  memcpy(concatenated_bytes1 + DDS_SECURITY_AUTHENTICATION_CHALLENGE_SIZE + KXSALTCOOKIE_SIZE, challenge2, DDS_SECURITY_AUTHENTICATION_CHALLENGE_SIZE);
 
   SHA256(concatenated_bytes1, concatenated_bytes1_size, hash);
   if (!(kx_master_salt = crypto_hmac256(hash, SHA256_DIGEST_LENGTH, shared_secret_key, (uint32_t) shared_secret_size, ex)))
@@ -118,9 +119,8 @@ calculate_kx_keys(
 
   /* master_sender_key */
   memcpy(concatenated_bytes2, challenge2, DDS_SECURITY_AUTHENTICATION_CHALLENGE_SIZE);
-  memcpy(concatenated_bytes2 + DDS_SECURITY_AUTHENTICATION_CHALLENGE_SIZE, KXKEYCOOKIE, sizeof(KXKEYCOOKIE));
-  memcpy(concatenated_bytes2 + DDS_SECURITY_AUTHENTICATION_CHALLENGE_SIZE + sizeof(KXKEYCOOKIE), challenge1,
-         DDS_SECURITY_AUTHENTICATION_CHALLENGE_SIZE);
+  memcpy(concatenated_bytes2 + DDS_SECURITY_AUTHENTICATION_CHALLENGE_SIZE, KXKEYCOOKIE, KXKEYCOOKIE_SIZE);
+  memcpy(concatenated_bytes2 + DDS_SECURITY_AUTHENTICATION_CHALLENGE_SIZE + KXKEYCOOKIE_SIZE, challenge1, DDS_SECURITY_AUTHENTICATION_CHALLENGE_SIZE);
 
   SHA256(concatenated_bytes2, concatenated_bytes2_size, hash);
   if (!(kx_master_sender_key = crypto_hmac256(hash, SHA256_DIGEST_LENGTH, shared_secret_key, (uint32_t) shared_secret_size, ex)))
@@ -1158,6 +1158,7 @@ crypto_factory_set_participant_crypto_tokens(
     master_key_material *remote_key_mat_new = crypto_master_key_material_new(CRYPTO_TRANSFORMATION_KIND_NONE);
     crypto_token_copy(remote_key_mat_new, remote_key_mat);
     key_material->remote_key_material = remote_key_mat_new;
+
     if (remote_key_mat_old != NULL)
     {
       struct gcreq *gcreq = gcreq_new(impl->crypto->gv->gcreq_queue, gc_remote_key_material);
diff --git a/src/security/builtin_plugins/cryptographic/src/crypto_utils.c b/src/security/builtin_plugins/cryptographic/src/crypto_utils.c
index 36e9f75..12ca32e 100644
--- a/src/security/builtin_plugins/cryptographic/src/crypto_utils.c
+++ b/src/security/builtin_plugins/cryptographic/src/crypto_utils.c
@@ -62,6 +62,7 @@ crypto_calculate_key_impl(
   memcpy(buffer, prefix, strlen(prefix));
   memcpy(&buffer[strlen(prefix)], master_salt, key_bytes);
   memcpy(&buffer[strlen(prefix) + key_bytes], &id, sizeof(id));
+
   if (HMAC(EVP_sha256(), master_key, (int)key_bytes, buffer, sz, md, NULL) == NULL)
   {
     DDS_Security_Exception_set_with_openssl_error(ex, DDS_CRYPTO_PLUGIN_CONTEXT, DDS_SECURITY_ERR_CIPHER_ERROR, 0, "HMAC failed: ");

From e1899df62d7c09d452543eada4bdf3d7f79ee4fc Mon Sep 17 00:00:00 2001
From: Marcel Jordense <marcel.jordense@adlinktech.com>
Date: Fri, 8 May 2020 17:09:01 +0200
Subject: [PATCH 179/238] Fix incorrect type of include_optional_fields config
 parameter

Signed-off-by: Marcel Jordense <marcel.jordense@adlinktech.com>
---
 src/core/ddsi/include/dds/ddsi/q_config.h     |  2 +-
 src/core/ddsi/src/ddsi_security_omg.c         |  2 +-
 .../authentication/src/authentication.c       | 62 ++++++++++---------
 .../cryptographic/src/crypto_key_exchange.c   | 17 ++---
 .../cryptographic/src/crypto_key_factory.c    |  4 +-
 5 files changed, 46 insertions(+), 41 deletions(-)

diff --git a/src/core/ddsi/include/dds/ddsi/q_config.h b/src/core/ddsi/include/dds/ddsi/q_config.h
index d9628e2..3c78e28 100644
--- a/src/core/ddsi/include/dds/ddsi/q_config.h
+++ b/src/core/ddsi/include/dds/ddsi/q_config.h
@@ -174,7 +174,7 @@ typedef struct authentication_properties_type{
   char *private_key;
   char *password;
   char *trusted_ca_dir;
-  bool include_optional_fields;
+  int include_optional_fields;
 } authentication_properties_type;
 
 typedef struct access_control_properties_type{
diff --git a/src/core/ddsi/src/ddsi_security_omg.c b/src/core/ddsi/src/ddsi_security_omg.c
index 36d5a3c..7824239 100644
--- a/src/core/ddsi/src/ddsi_security_omg.c
+++ b/src/core/ddsi/src/ddsi_security_omg.c
@@ -736,7 +736,7 @@ void q_omg_security_init (struct ddsi_domaingv *gv)
   gv->security_context = sc;
 
   if (gv->config.omg_security_configuration)
-    gv->handshake_include_optional = gv->config.omg_security_configuration->cfg.authentication_properties.include_optional_fields;
+    gv->handshake_include_optional = gv->config.omg_security_configuration->cfg.authentication_properties.include_optional_fields != 0;
   else
     gv->handshake_include_optional = false;
 
diff --git a/src/security/builtin_plugins/authentication/src/authentication.c b/src/security/builtin_plugins/authentication/src/authentication.c
index 490654b..316c910 100644
--- a/src/security/builtin_plugins/authentication/src/authentication.c
+++ b/src/security/builtin_plugins/authentication/src/authentication.c
@@ -1126,7 +1126,7 @@ DDS_Security_ValidationResult_t begin_handshake_request(dds_security_authenticat
   EVP_PKEY *dhkey;
   unsigned char *certData, *dhPubKeyData = NULL;
   uint32_t certDataSize, dhPubKeyDataSize;
-  uint32_t tsz = impl->include_optional ? 8 : 7;
+  uint32_t tokcount = impl->include_optional ? 8 : 7;
   int created = 0;
 
   if (!instance || !handshake_handle || !handshake_message || !serialized_local_participant_data)
@@ -1184,39 +1184,41 @@ DDS_Security_ValidationResult_t begin_handshake_request(dds_security_authenticat
   if (localIdent->pdata._length == 0)
     DDS_Security_OctetSeq_copy(&localIdent->pdata, serialized_local_participant_data);
 
-  DDS_Security_BinaryProperty_t *tokens = DDS_Security_BinaryPropertySeq_allocbuf(tsz);
-  uint32_t idx = 0;
+  DDS_Security_BinaryProperty_t *tokens = DDS_Security_BinaryPropertySeq_allocbuf(tokcount);
+  uint32_t tokidx = 0;
 
-  DDS_Security_BinaryProperty_set_by_ref(&tokens[idx++], "c.id", certData, certDataSize);
-  DDS_Security_BinaryProperty_set_by_string(&tokens[idx++], "c.perm", localIdent->permissionsDocument ? localIdent->permissionsDocument : "");
-  DDS_Security_BinaryProperty_set_by_value(&tokens[idx++], "c.pdata", serialized_local_participant_data->_buffer, serialized_local_participant_data->_length);
-  DDS_Security_BinaryProperty_set_by_string(&tokens[idx++], "c.dsign_algo", get_dsign_algo(localIdent->dsignAlgoKind));
-  DDS_Security_BinaryProperty_set_by_string(&tokens[idx++], "c.kagree_algo", get_kagree_algo(localIdent->kagreeAlgoKind));
+  DDS_Security_BinaryProperty_set_by_ref(&tokens[tokidx++], "c.id", certData, certDataSize);
+  DDS_Security_BinaryProperty_set_by_string(&tokens[tokidx++], "c.perm", localIdent->permissionsDocument ? localIdent->permissionsDocument : "");
+  DDS_Security_BinaryProperty_set_by_value(&tokens[tokidx++], "c.pdata", serialized_local_participant_data->_buffer, serialized_local_participant_data->_length);
+  DDS_Security_BinaryProperty_set_by_string(&tokens[tokidx++], "c.dsign_algo", get_dsign_algo(localIdent->dsignAlgoKind));
+  DDS_Security_BinaryProperty_set_by_string(&tokens[tokidx++], "c.kagree_algo", get_kagree_algo(localIdent->kagreeAlgoKind));
 
   /* Todo: including hash_c1 is optional (conform spec); add a configuration option to leave it out */
   {
     DDS_Security_BinaryPropertySeq bseq = { ._length = 5, ._buffer = tokens };
     get_hash_binary_property_seq(&bseq, handshake->hash_c1);
     if (impl->include_optional)
-      DDS_Security_BinaryProperty_set_by_value(&tokens[idx++], "hash_c1", handshake->hash_c1, sizeof(HashValue_t));
+      DDS_Security_BinaryProperty_set_by_value(&tokens[tokidx++], "hash_c1", handshake->hash_c1, sizeof(HashValue_t));
   }
 
   /* Set the DH public key associated with the local participant in dh1 property */
   assert(dhPubKeyData);
   assert(dhPubKeyDataSize < 1200);
-  DDS_Security_BinaryProperty_set_by_ref(&tokens[idx++], "dh1", dhPubKeyData, dhPubKeyDataSize);
+  DDS_Security_BinaryProperty_set_by_ref(&tokens[tokidx++], "dh1", dhPubKeyData, dhPubKeyDataSize);
 
   /* Set the challenge in challenge1 property */
-  DDS_Security_BinaryProperty_set_by_value(&tokens[idx++], "challenge1", relation->lchallenge->value, sizeof(AuthenticationChallenge));
+  DDS_Security_BinaryProperty_set_by_value(&tokens[tokidx++], "challenge1", relation->lchallenge->value, sizeof(AuthenticationChallenge));
 
   (void)ddsrt_hh_add(impl->objectHash, handshake);
 
   ddsrt_mutex_unlock(&impl->lock);
 
+  assert(tokcount == tokidx);
+
   handshake_message->class_id = ddsrt_strdup(AUTH_HANDSHAKE_REQUEST_TOKEN_ID);
   handshake_message->properties._length = 0;
   handshake_message->properties._buffer = NULL;
-  handshake_message->binary_properties._length = tsz;
+  handshake_message->binary_properties._length = tokidx;
   handshake_message->binary_properties._buffer = tokens;
   *handshake_handle = HANDSHAKE_HANDLE(handshake);
 
@@ -1627,7 +1629,7 @@ DDS_Security_ValidationResult_t begin_handshake_reply(dds_security_authenticatio
   EVP_PKEY *dhkeyLocal = NULL;
   unsigned char *certData, *dhPubKeyData;
   uint32_t certDataSize, dhPubKeyDataSize;
-  uint32_t tsz = impl->include_optional ? 12 : 9;
+  uint32_t tokcount = impl->include_optional ? 12 : 9;
   int created = 0;
 
   if (!instance || !handshake_handle || !handshake_message_out || !handshake_message_in || !serialized_local_participant_data)
@@ -1694,23 +1696,23 @@ DDS_Security_ValidationResult_t begin_handshake_reply(dds_security_authenticatio
   if (localIdent->pdata._length == 0)
     DDS_Security_OctetSeq_copy(&localIdent->pdata, serialized_local_participant_data);
 
-  DDS_Security_BinaryProperty_t *tokens = DDS_Security_BinaryPropertySeq_allocbuf(tsz);
-  uint32_t idx = 0;
+  DDS_Security_BinaryProperty_t *tokens = DDS_Security_BinaryPropertySeq_allocbuf(tokcount);
+  uint32_t tokidx = 0;
 
   /* Store the Identity Certificate associated with the local identify in c.id property */
-  DDS_Security_BinaryProperty_set_by_ref(&tokens[idx++], "c.id", certData, certDataSize);
+  DDS_Security_BinaryProperty_set_by_ref(&tokens[tokidx++], "c.id", certData, certDataSize);
   certData = NULL;
-  DDS_Security_BinaryProperty_set_by_string(&tokens[idx++], "c.perm", localIdent->permissionsDocument ? localIdent->permissionsDocument : "");
-  DDS_Security_BinaryProperty_set_by_value(&tokens[idx++], "c.pdata", serialized_local_participant_data->_buffer, serialized_local_participant_data->_length);
-  DDS_Security_BinaryProperty_set_by_string(&tokens[idx++], "c.dsign_algo", get_dsign_algo(localIdent->dsignAlgoKind));
-  DDS_Security_BinaryProperty_set_by_string(&tokens[idx++], "c.kagree_algo", get_kagree_algo(remoteIdent->kagreeAlgoKind));
+  DDS_Security_BinaryProperty_set_by_string(&tokens[tokidx++], "c.perm", localIdent->permissionsDocument ? localIdent->permissionsDocument : "");
+  DDS_Security_BinaryProperty_set_by_value(&tokens[tokidx++], "c.pdata", serialized_local_participant_data->_buffer, serialized_local_participant_data->_length);
+  DDS_Security_BinaryProperty_set_by_string(&tokens[tokidx++], "c.dsign_algo", get_dsign_algo(localIdent->dsignAlgoKind));
+  DDS_Security_BinaryProperty_set_by_string(&tokens[tokidx++], "c.kagree_algo", get_kagree_algo(remoteIdent->kagreeAlgoKind));
 
   /* Calculate the hash_c2 */
   DDS_Security_BinaryPropertySeq bseq = { ._length = 5, ._buffer = tokens };
   get_hash_binary_property_seq(&bseq, handshake->hash_c2);
 
   /* Set the DH public key associated with the local participant in dh2 property */
-  DDS_Security_BinaryProperty_t *dh2 = &tokens[idx++];
+  DDS_Security_BinaryProperty_t *dh2 = &tokens[tokidx++];
   DDS_Security_BinaryProperty_set_by_ref(dh2, "dh2", dhPubKeyData, dhPubKeyDataSize);
 
   /* Find the dh1 property from the received request token */
@@ -1718,18 +1720,18 @@ DDS_Security_ValidationResult_t begin_handshake_reply(dds_security_authenticatio
   assert(dh1);
 
   assert(relation->rchallenge);
-  DDS_Security_BinaryProperty_t *challenge1 = &tokens[idx++];
+  DDS_Security_BinaryProperty_t *challenge1 = &tokens[tokidx++];
   DDS_Security_BinaryProperty_set_by_value(challenge1, "challenge1", relation->rchallenge->value, sizeof(AuthenticationChallenge));
   assert(relation->lchallenge);
-  DDS_Security_BinaryProperty_t *challenge2 = &tokens[idx++];
+  DDS_Security_BinaryProperty_t *challenge2 = &tokens[tokidx++];
   DDS_Security_BinaryProperty_set_by_value(challenge2, "challenge2", relation->lchallenge->value, sizeof(AuthenticationChallenge));
 
   /* THe dh1 and hash_c1 and hash_c2 are optional */
   if (impl->include_optional)
   {
-    DDS_Security_BinaryProperty_set_by_value(&tokens[idx++], "dh1", dh1->value._buffer, dh1->value._length);
-    DDS_Security_BinaryProperty_set_by_value(&tokens[idx++], "hash_c2", handshake->hash_c2, sizeof(HashValue_t));
-    DDS_Security_BinaryProperty_set_by_value(&tokens[idx++], "hash_c1", handshake->hash_c1, sizeof(HashValue_t));
+    DDS_Security_BinaryProperty_set_by_value(&tokens[tokidx++], "dh1", dh1->value._buffer, dh1->value._length);
+    DDS_Security_BinaryProperty_set_by_value(&tokens[tokidx++], "hash_c2", handshake->hash_c2, sizeof(HashValue_t));
+    DDS_Security_BinaryProperty_set_by_value(&tokens[tokidx++], "hash_c1", handshake->hash_c1, sizeof(HashValue_t));
   }
 
   /* Calculate the signature */
@@ -1744,12 +1746,14 @@ DDS_Security_ValidationResult_t begin_handshake_reply(dds_security_authenticatio
     DDS_Security_BinaryProperty_free(hash_c2_val);
     if (result != DDS_SECURITY_VALIDATION_OK)
       goto err_signature;
-    DDS_Security_BinaryProperty_set_by_ref(&tokens[idx++], "signature", sign, (uint32_t)signlen);
+    DDS_Security_BinaryProperty_set_by_ref(&tokens[tokidx++], "signature", sign, (uint32_t)signlen);
   }
 
+  assert(tokidx == tokcount);
+
   (void)ddsrt_hh_add(impl->objectHash, handshake);
   handshake_message_out->class_id = ddsrt_strdup(AUTH_HANDSHAKE_REPLY_TOKEN_ID);
-  handshake_message_out->binary_properties._length = tsz;
+  handshake_message_out->binary_properties._length = tokidx;
   handshake_message_out->binary_properties._buffer = tokens;
 
   ddsrt_mutex_unlock(&impl->lock);
@@ -1758,7 +1762,7 @@ DDS_Security_ValidationResult_t begin_handshake_reply(dds_security_authenticatio
   return DDS_SECURITY_VALIDATION_PENDING_HANDSHAKE_MESSAGE;
 
 err_signature:
-  free_binary_properties(tokens, tsz);
+  free_binary_properties(tokens, tokcount);
 err_get_public_key:
 err_gen_dh_keys:
   ddsrt_free(certData);
diff --git a/src/security/builtin_plugins/cryptographic/src/crypto_key_exchange.c b/src/security/builtin_plugins/cryptographic/src/crypto_key_exchange.c
index 9ea8ade..7cadb64 100644
--- a/src/security/builtin_plugins/cryptographic/src/crypto_key_exchange.c
+++ b/src/security/builtin_plugins/cryptographic/src/crypto_key_exchange.c
@@ -78,18 +78,19 @@ static bool check_crypto_keymaterial(
 {
   bool status = false;
   uint32_t transform_kind = CRYPTO_TRANSFORM_KIND(keymat->transformation_kind);
-  uint32_t key_sz = CRYPTO_KEY_SIZE_BYTES(transform_kind);
 
   if (transform_kind != CRYPTO_TRANSFORMATION_KIND_NONE)
   {
-    status = (transform_kind <= CRYPTO_TRANSFORMATION_KIND_AES256_GCM &&
-        keymat->master_salt._length == key_sz && keymat->master_salt._buffer != NULL && check_not_data_empty(&keymat->master_salt) &&
-        keymat->master_sender_key._length == key_sz && keymat->master_sender_key._buffer != NULL && check_not_data_empty(&keymat->master_sender_key));
-
-    if (status && CRYPTO_TRANSFORM_ID(keymat->receiver_specific_key_id))
+    if (transform_kind <= CRYPTO_TRANSFORMATION_KIND_AES256_GCM)
     {
-      status = (keymat->master_receiver_specific_key._length == key_sz &&
-          keymat->master_receiver_specific_key._buffer != NULL && check_not_data_empty(&keymat->master_receiver_specific_key));
+      uint32_t key_sz = CRYPTO_KEY_SIZE_BYTES(transform_kind);
+      status = (keymat->master_salt._length == key_sz && keymat->master_salt._buffer != NULL && check_not_data_empty(&keymat->master_salt) &&
+                keymat->master_sender_key._length == key_sz && keymat->master_sender_key._buffer != NULL && check_not_data_empty(&keymat->master_sender_key));
+      if (status && CRYPTO_TRANSFORM_ID(keymat->receiver_specific_key_id))
+      {
+        status = (keymat->master_receiver_specific_key._length == key_sz &&
+                  keymat->master_receiver_specific_key._buffer != NULL && check_not_data_empty(&keymat->master_receiver_specific_key));
+      }
     }
   }
   else
diff --git a/src/security/builtin_plugins/cryptographic/src/crypto_key_factory.c b/src/security/builtin_plugins/cryptographic/src/crypto_key_factory.c
index 5416abf..1ce7e49 100644
--- a/src/security/builtin_plugins/cryptographic/src/crypto_key_factory.c
+++ b/src/security/builtin_plugins/cryptographic/src/crypto_key_factory.c
@@ -37,7 +37,9 @@
  */
 
 #define KXKEYCOOKIE "key exchange key"
+#define KXKEYCOOKIE_SIZE (sizeof(KXKEYCOOKIE) - 1)
 #define KXSALTCOOKIE "keyexchange salt"
+#define KXSALTCOOKIE_SIZE (sizeof(KXSALTCOOKIE) - 1)
 
 typedef struct dds_security_crypto_key_factory_impl
 {
@@ -89,8 +91,6 @@ calculate_kx_keys(
   unsigned char *kx_master_salt, *kx_master_sender_key;
   size_t shared_secret_size = get_secret_size_from_secret_handle(shared_secret);
   unsigned char hash[SHA256_DIGEST_LENGTH];
-  size_t KXKEYCOOKIE_SIZE = strlen(KXKEYCOOKIE);
-  size_t KXSALTCOOKIE_SIZE = strlen(KXSALTCOOKIE);
   size_t concatenated_bytes1_size = DDS_SECURITY_AUTHENTICATION_CHALLENGE_SIZE * 2 + KXSALTCOOKIE_SIZE;
   size_t concatenated_bytes2_size = DDS_SECURITY_AUTHENTICATION_CHALLENGE_SIZE * 2 + KXKEYCOOKIE_SIZE;
   DDS_Security_octet *concatenated_bytes1, *concatenated_bytes2;

From 364f1ce39cb3c63e6e92a49e06035103fe785089 Mon Sep 17 00:00:00 2001
From: Erik Boasson <eb@ilities.com>
Date: Mon, 11 May 2020 15:06:40 +0200
Subject: [PATCH 180/238] Bump version number to 0.7.0

Signed-off-by: Erik Boasson <eb@ilities.com>
---
 CMakeLists.txt | 2 +-
 package.xml    | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/CMakeLists.txt b/CMakeLists.txt
index ca28ca1..b999c04 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -10,7 +10,7 @@
 # SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
 #
 cmake_minimum_required(VERSION 3.7)
-project(CycloneDDS VERSION 0.6.0)
+project(CycloneDDS VERSION 0.7.0)
 
 # Set a default build type if none was specified
 set(default_build_type "RelWithDebInfo")
diff --git a/package.xml b/package.xml
index 913f141..e21d5aa 100644
--- a/package.xml
+++ b/package.xml
@@ -2,7 +2,7 @@
 <?xml-model href="http://download.ros.org/schema/package_format3.xsd" schematypens="http://www.w3.org/2001/XMLSchema"?>
 <package format="3">
     <name>cyclonedds</name>
-    <version>0.6.0</version>
+    <version>0.7.0</version>
     <description>Eclipse Cyclone DDS is a very performant and robust open-source DDS implementation. Cyclone DDS is developed completely in the open as an Eclipse IoT project.</description>
     <maintainer email="cyclonedds-dev@eclipse.org">Eclipse Foundation, Inc.</maintainer>
     <license>Eclipse Public License 2.0</license>

From fd27604a26cd2f3e1bbef0d8403eeb9340f937a3 Mon Sep 17 00:00:00 2001
From: Dennis Potman <dennis.potman@adlinktech.com>
Date: Wed, 22 Apr 2020 16:59:29 +0200
Subject: [PATCH 181/238] Add crypto token exchange test

Introduced a test that checks if all crypto tokens send by a node are
received correctly by the remote node. To support this test, the crypto
wrapper plugin is extended with a token_log mode, that stores all tokens
that are exchanged after the security handshake is finished.

Signed-off-by: Dennis Potman <dennis.potman@adlinktech.com>
---
 src/security/core/tests/authentication.c      |   1 -
 .../core/tests/common/cryptography_wrapper.c  | 258 +++++++++++++++++-
 .../core/tests/common/cryptography_wrapper.h  |  32 +++
 src/security/core/tests/common/test_utils.c   |  22 ++
 src/security/core/tests/common/test_utils.h   |   1 +
 src/security/core/tests/handshake.c           | 128 +++++++--
 .../core/tests/secure_communication.c         |  77 +-----
 7 files changed, 412 insertions(+), 107 deletions(-)

diff --git a/src/security/core/tests/authentication.c b/src/security/core/tests/authentication.c
index fe6aa6a..dbd80be 100644
--- a/src/security/core/tests/authentication.c
+++ b/src/security/core/tests/authentication.c
@@ -34,7 +34,6 @@
 #include "common/security_config_test_utils.h"
 #include "common/test_identity.h"
 #include "common/cert_utils.h"
-#include "common/security_config_test_utils.h"
 
 #define ID1 TEST_IDENTITY1_CERTIFICATE
 #define ID1K TEST_IDENTITY1_PRIVATE_KEY
diff --git a/src/security/core/tests/common/cryptography_wrapper.c b/src/security/core/tests/common/cryptography_wrapper.c
index 034d81d..1856c09 100644
--- a/src/security/core/tests/common/cryptography_wrapper.c
+++ b/src/security/core/tests/common/cryptography_wrapper.c
@@ -13,6 +13,7 @@
 #include <stdio.h>
 #include "CUnit/Test.h"
 #include "dds/dds.h"
+#include "dds/ddsrt/circlist.h"
 #include "dds/ddsrt/heap.h"
 #include "dds/ddsrt/sync.h"
 #include "dds/ddsrt/string.h"
@@ -22,13 +23,17 @@
 #include "dds/security/core/dds_security_utils.h"
 #include "cryptography_wrapper.h"
 
-int init_crypto(const char *argument, void **context, struct ddsi_domaingv *gv);
-int finalize_crypto(void *context);
+#define CRYPTO_TOKEN_CLASS_ID "DDS:Crypto:AES_GCM_GMAC"
+#define CRYPTO_TOKEN_PROPERTY_NAME "dds.cryp.keymat"
+
+int32_t init_crypto(const char *argument, void **context, struct ddsi_domaingv *gv);
+int32_t finalize_crypto(void *context);
 
 enum crypto_plugin_mode {
   PLUGIN_MODE_ALL_OK,
   PLUGIN_MODE_MISSING_FUNC,
-  PLUGIN_MODE_WRAPPED
+  PLUGIN_MODE_WRAPPED,
+  PLUGIN_MODE_TOKEN_LOG
 };
 
 struct dds_security_crypto_key_exchange_impl {
@@ -67,9 +72,13 @@ struct dds_security_cryptography_impl {
   const char * groupdata_secret;
   const char * ep_secret;
   const char * encrypted_secret;
+  ddsrt_mutex_t token_data_lock;
+  struct ddsrt_circlist token_data_list;
 };
 
 static DDS_Security_ParticipantCryptoHandle g_local_participant_handle = 0;
+static ddsrt_once_t lock_inited = DDSRT_ONCE_INIT;
+static ddsrt_mutex_t g_print_token_lock;
 
 void set_protection_kinds(
   struct dds_security_cryptography_impl * impl,
@@ -109,6 +118,144 @@ void set_entity_data_secret(struct dds_security_cryptography_impl * impl, const
   impl->ep_secret = ep_secret;
 }
 
+static bool check_crypto_tokens(const DDS_Security_DataHolderSeq *tokens)
+{
+    bool result = true;
+
+    if (tokens->_length == 0 || tokens->_buffer == NULL)
+      return false;
+
+    for (uint32_t i = 0; result && (i < tokens->_length); i++)
+    {
+      result = (tokens->_buffer[i].class_id != NULL &&
+        strcmp(CRYPTO_TOKEN_CLASS_ID, tokens->_buffer[i].class_id) == 0 &&
+        tokens->_buffer[i].binary_properties._length == 1 &&
+        tokens->_buffer[i].binary_properties._buffer != NULL &&
+        tokens->_buffer[i].binary_properties._buffer[0].name != NULL &&
+        strcmp(CRYPTO_TOKEN_PROPERTY_NAME, tokens->_buffer[i].binary_properties._buffer[0].name) == 0 &&
+        tokens->_buffer[i].binary_properties._buffer[0].value._length > 0 &&
+        tokens->_buffer[i].binary_properties._buffer[0].value._buffer != NULL);
+    }
+    return result;
+}
+
+const char *get_crypto_token_type_str (enum crypto_tokens_type type)
+{
+  switch (type)
+  {
+  case LOCAL_PARTICIPANT_TOKENS: return "LOCAL_PARTICIPANT_TOKENS";
+  case LOCAL_WRITER_TOKENS: return "LOCAL_WRITER_TOKENS";
+  case LOCAL_READER_TOKENS: return "LOCAL_READER_TOKENS";
+  case REMOTE_PARTICIPANT_TOKENS: return "REMOTE_PARTICIPANT_TOKENS";
+  case REMOTE_WRITER_TOKENS: return "REMOTE_WRITER_TOKENS";
+  case REMOTE_READER_TOKENS: return "REMOTE_READER_TOKENS";
+  default: assert (0); return "";
+  }
+}
+
+static void print_tokens (enum crypto_tokens_type type, const DDS_Security_ParticipantCryptoHandle lch, const DDS_Security_ParticipantCryptoHandle rch,
+    const DDS_Security_ParticipantCryptoTokenSeq *tokens)
+{
+  ddsrt_mutex_lock (&g_print_token_lock);
+  printf ("Token type %s, local %"PRIx64" / remote %"PRIx64", count: %u\n", get_crypto_token_type_str (type), lch, rch, tokens->_length);
+  for (uint32_t i = 0; i < tokens->_length; i++)
+  {
+    printf ("- token: ");
+    for (uint32_t j = 0; j < tokens->_buffer[i].binary_properties._buffer[0].value._length && j < 32; j++)
+      printf ("%02x", tokens->_buffer[i].binary_properties._buffer[0].value._buffer[j]);
+    printf ("\n");
+  }
+  printf ("\n");
+  ddsrt_mutex_unlock (&g_print_token_lock);
+}
+
+static void add_tokens (struct ddsrt_circlist *list, enum crypto_tokens_type type,
+    const DDS_Security_ParticipantCryptoHandle lch, const DDS_Security_ParticipantCryptoHandle rch,
+    const DDS_Security_ParticipantCryptoTokenSeq *tokens)
+{
+  struct crypto_token_data *token_data = ddsrt_malloc (sizeof (*token_data));
+  token_data->type = type;
+  token_data->local_handle = lch;
+  token_data->remote_handle = rch;
+  token_data->n_tokens = tokens->_length;
+  assert (tokens->_length <= CRYPTO_TOKEN_MAXLEN);
+  for (uint32_t i = 0; i < tokens->_length; i++)
+  {
+    size_t len = tokens->_buffer[i].binary_properties._buffer[0].value._length;
+    assert (len <= CRYPTO_TOKEN_SIZE);
+    memcpy (token_data->data[i], tokens->_buffer[i].binary_properties._buffer[0].value._buffer, len);
+    token_data->data_len[i] = len;
+  }
+  ddsrt_circlist_append(list, &token_data->e);
+}
+
+static void store_tokens (struct dds_security_crypto_key_exchange_impl *impl, enum crypto_tokens_type type, const DDS_Security_ParticipantCryptoHandle lch,
+    const DDS_Security_ParticipantCryptoHandle rch, const DDS_Security_ParticipantCryptoTokenSeq *tokens)
+{
+  if (!check_crypto_tokens ((const DDS_Security_DataHolderSeq *) tokens))
+  {
+    printf ("%d ERROR\n", type);
+    return;
+  }
+
+  ddsrt_mutex_lock (&impl->parent->token_data_lock);
+  add_tokens (&impl->parent->token_data_list, type, lch, rch, tokens);
+  ddsrt_mutex_unlock (&impl->parent->token_data_lock);
+
+  print_tokens (type, lch, rch, tokens);
+}
+
+struct ddsrt_circlist * get_crypto_tokens (struct dds_security_cryptography_impl * impl)
+{
+  struct ddsrt_circlist *tokens = ddsrt_malloc (sizeof (*tokens));
+  ddsrt_circlist_init (tokens);
+
+  ddsrt_mutex_lock (&impl->token_data_lock);
+  struct ddsrt_circlist_elem *elem0 = ddsrt_circlist_oldest (&impl->token_data_list), *elem = elem0;
+  while (elem != NULL)
+  {
+    struct crypto_token_data *elem_data = DDSRT_FROM_CIRCLIST (struct crypto_token_data, e, elem);
+    struct crypto_token_data *token_data = ddsrt_malloc (sizeof (*token_data));
+    memcpy (token_data, elem_data, sizeof (*token_data));
+    ddsrt_circlist_append (tokens, &token_data->e);
+    elem = elem->next;
+    if (elem == elem0)
+      break;
+  }
+  ddsrt_mutex_unlock (&impl->token_data_lock);
+
+  return tokens;
+}
+
+struct crypto_token_data * find_crypto_token (struct dds_security_cryptography_impl * impl, enum crypto_tokens_type type, unsigned char * data, size_t data_len)
+{
+  assert (data_len <= CRYPTO_TOKEN_SIZE);
+  ddsrt_mutex_lock (&impl->token_data_lock);
+  struct ddsrt_circlist_elem *elem0 = ddsrt_circlist_oldest (&impl->token_data_list), *elem = elem0;
+  while (elem != NULL)
+  {
+    struct crypto_token_data *elem_data = DDSRT_FROM_CIRCLIST (struct crypto_token_data, e, elem);
+    if (elem_data->type == type)
+    {
+      for (uint32_t i = 0; i < elem_data->n_tokens; i++)
+      {
+        size_t len = elem_data->data_len[i];
+        assert (len <= CRYPTO_TOKEN_SIZE);
+        if (!memcmp (data, elem_data->data[i], data_len < len ? data_len : len))
+        {
+          ddsrt_mutex_unlock (&impl->token_data_lock);
+          return elem_data;
+        }
+      }
+    }
+    elem = elem->next;
+    if (elem == elem0)
+      break;
+  }
+  ddsrt_mutex_unlock (&impl->token_data_lock);
+  return NULL;
+}
+
 static unsigned char * find_buffer_match(const unsigned char *input, size_t input_len, const unsigned char *match, size_t match_len)
 {
   if (match_len <= input_len && match_len > 0 && input_len > 0)
@@ -171,8 +318,14 @@ static DDS_Security_boolean create_local_participant_crypto_tokens(
   switch (impl->parent->mode)
   {
     case PLUGIN_MODE_WRAPPED:
-      return impl->instance->create_local_participant_crypto_tokens (impl->instance, local_participant_crypto_tokens,
+    case PLUGIN_MODE_TOKEN_LOG:
+    {
+      DDS_Security_boolean ret = impl->instance->create_local_participant_crypto_tokens (impl->instance, local_participant_crypto_tokens,
         local_participant_crypto, remote_participant_crypto, ex);
+      if (ret && impl->parent->mode == PLUGIN_MODE_TOKEN_LOG)
+        store_tokens (impl, LOCAL_PARTICIPANT_TOKENS, local_participant_crypto, remote_participant_crypto, local_participant_crypto_tokens);
+      return ret;
+    }
     default:
       return true;
   }
@@ -189,8 +342,14 @@ static DDS_Security_boolean set_remote_participant_crypto_tokens(
   switch (impl->parent->mode)
   {
     case PLUGIN_MODE_WRAPPED:
-      return impl->instance->set_remote_participant_crypto_tokens (impl->instance, check_handle (local_participant_crypto),
+    case PLUGIN_MODE_TOKEN_LOG:
+    {
+      DDS_Security_boolean ret = impl->instance->set_remote_participant_crypto_tokens (impl->instance, check_handle (local_participant_crypto),
         check_handle (remote_participant_crypto), remote_participant_tokens, ex);
+      if (ret && impl->parent->mode == PLUGIN_MODE_TOKEN_LOG)
+        store_tokens (impl, REMOTE_PARTICIPANT_TOKENS, local_participant_crypto, remote_participant_crypto, remote_participant_tokens);
+      return ret;
+    }
     default:
       return true;
   }
@@ -207,8 +366,14 @@ static DDS_Security_boolean create_local_datawriter_crypto_tokens(
   switch (impl->parent->mode)
   {
     case PLUGIN_MODE_WRAPPED:
-      return impl->instance->create_local_datawriter_crypto_tokens (impl->instance, local_datawriter_crypto_tokens,
+    case PLUGIN_MODE_TOKEN_LOG:
+    {
+      DDS_Security_boolean ret = impl->instance->create_local_datawriter_crypto_tokens (impl->instance, local_datawriter_crypto_tokens,
         check_handle (local_datawriter_crypto), check_handle (remote_datareader_crypto), ex);
+      if (ret && impl->parent->mode == PLUGIN_MODE_TOKEN_LOG)
+        store_tokens (impl, LOCAL_WRITER_TOKENS, local_datawriter_crypto, remote_datareader_crypto, local_datawriter_crypto_tokens);
+      return ret;
+    }
     default:
       return true;
   }
@@ -225,8 +390,14 @@ static DDS_Security_boolean set_remote_datawriter_crypto_tokens(
   switch (impl->parent->mode)
   {
     case PLUGIN_MODE_WRAPPED:
-      return impl->instance->set_remote_datawriter_crypto_tokens (impl->instance, check_handle (local_datareader_crypto),
+    case PLUGIN_MODE_TOKEN_LOG:
+    {
+      DDS_Security_boolean ret = impl->instance->set_remote_datawriter_crypto_tokens (impl->instance, check_handle (local_datareader_crypto),
         check_handle (remote_datawriter_crypto), remote_datawriter_tokens, ex);
+      if (ret && impl->parent->mode == PLUGIN_MODE_TOKEN_LOG)
+        store_tokens (impl, REMOTE_WRITER_TOKENS, local_datareader_crypto, remote_datawriter_crypto, remote_datawriter_tokens);
+      return ret;
+    }
     default:
       return true;
   }
@@ -243,8 +414,14 @@ static DDS_Security_boolean create_local_datareader_crypto_tokens(
   switch (impl->parent->mode)
   {
     case PLUGIN_MODE_WRAPPED:
-      return impl->instance->create_local_datareader_crypto_tokens (impl->instance, local_datareader_cryto_tokens,
+    case PLUGIN_MODE_TOKEN_LOG:
+    {
+      DDS_Security_boolean ret = impl->instance->create_local_datareader_crypto_tokens (impl->instance, local_datareader_cryto_tokens,
         check_handle (local_datareader_crypto), check_handle (remote_datawriter_crypto), ex);
+      if (ret && impl->parent->mode == PLUGIN_MODE_TOKEN_LOG)
+        store_tokens (impl, LOCAL_READER_TOKENS, local_datareader_crypto, remote_datawriter_crypto, local_datareader_cryto_tokens);
+      return ret;
+    }
     default:
       return true;
   }
@@ -261,8 +438,14 @@ static DDS_Security_boolean set_remote_datareader_crypto_tokens(
   switch (impl->parent->mode)
   {
     case PLUGIN_MODE_WRAPPED:
-      return impl->instance->set_remote_datareader_crypto_tokens (impl->instance, check_handle (local_datawriter_crypto),
+    case PLUGIN_MODE_TOKEN_LOG:
+    {
+      DDS_Security_boolean ret = impl->instance->set_remote_datareader_crypto_tokens (impl->instance, check_handle (local_datawriter_crypto),
         check_handle (remote_datareader_crypto), remote_datareader_tokens, ex);
+      if (ret && impl->parent->mode == PLUGIN_MODE_TOKEN_LOG)
+        store_tokens (impl, REMOTE_READER_TOKENS, local_datawriter_crypto, remote_datareader_crypto, remote_datareader_tokens);
+      return ret;
+    }
     default:
       return true;
   }
@@ -277,6 +460,7 @@ static DDS_Security_boolean return_crypto_tokens(
   switch (impl->parent->mode)
   {
     case PLUGIN_MODE_WRAPPED:
+    case PLUGIN_MODE_TOKEN_LOG:
       return impl->instance->return_crypto_tokens (impl->instance, crypto_tokens, ex);
     default:
       return true;
@@ -298,6 +482,7 @@ static DDS_Security_ParticipantCryptoHandle register_local_participant(
   switch (impl->parent->mode)
   {
     case PLUGIN_MODE_WRAPPED:
+    case PLUGIN_MODE_TOKEN_LOG:
       return check_handle (impl->instance->register_local_participant (impl->instance, check_handle (participant_identity),
         check_handle (participant_permissions), participant_properties, participant_security_attributes, ex));
     default:
@@ -317,6 +502,7 @@ static DDS_Security_ParticipantCryptoHandle register_matched_remote_participant(
   switch (impl->parent->mode)
   {
     case PLUGIN_MODE_WRAPPED:
+    case PLUGIN_MODE_TOKEN_LOG:
       return check_handle (impl->instance->register_matched_remote_participant (impl->instance, local_participant_crypto_handle,
         remote_participant_identity, remote_participant_permissions, shared_secret, ex));
     default:
@@ -335,6 +521,7 @@ static DDS_Security_DatawriterCryptoHandle register_local_datawriter(
   switch (impl->parent->mode)
   {
     case PLUGIN_MODE_WRAPPED:
+    case PLUGIN_MODE_TOKEN_LOG:
       return check_handle (impl->instance->register_local_datawriter (impl->instance, check_handle (participant_crypto),
         datawriter_properties, datawriter_security_attributes, ex));
     default:
@@ -354,6 +541,7 @@ static DDS_Security_DatareaderCryptoHandle register_matched_remote_datareader(
   switch (impl->parent->mode)
   {
     case PLUGIN_MODE_WRAPPED:
+    case PLUGIN_MODE_TOKEN_LOG:
       return check_handle (impl->instance->register_matched_remote_datareader (impl->instance, check_handle (local_datawriter_crypto_handle),
         check_handle (remote_participant_crypto), check_handle (shared_secret), relay_only, ex));
     default:
@@ -372,6 +560,7 @@ static DDS_Security_DatareaderCryptoHandle register_local_datareader(
   switch (impl->parent->mode)
   {
     case PLUGIN_MODE_WRAPPED:
+    case PLUGIN_MODE_TOKEN_LOG:
       return check_handle (impl->instance->register_local_datareader (impl->instance, check_handle (participant_crypto),
         datareader_properties, datareader_security_attributes, ex));
     default:
@@ -390,6 +579,7 @@ static DDS_Security_DatawriterCryptoHandle register_matched_remote_datawriter(
   switch (impl->parent->mode)
   {
     case PLUGIN_MODE_WRAPPED:
+    case PLUGIN_MODE_TOKEN_LOG:
       return check_handle (impl->instance->register_matched_remote_datawriter (impl->instance, check_handle (local_datareader_crypto_handle),
         check_handle (remote_participant_crypt), shared_secret, ex));
     default:
@@ -406,6 +596,7 @@ static DDS_Security_boolean unregister_participant(
   switch (impl->parent->mode)
   {
     case PLUGIN_MODE_WRAPPED:
+    case PLUGIN_MODE_TOKEN_LOG:
       return impl->instance->unregister_participant (impl->instance, check_handle (participant_crypto_handle), ex);
     default:
       return true;
@@ -421,6 +612,7 @@ static DDS_Security_boolean unregister_datawriter(
   switch (impl->parent->mode)
   {
     case PLUGIN_MODE_WRAPPED:
+    case PLUGIN_MODE_TOKEN_LOG:
       return impl->instance->unregister_datawriter (impl->instance, check_handle (datawriter_crypto_handle), ex);
     default:
       return true;
@@ -436,6 +628,7 @@ static DDS_Security_boolean unregister_datareader(
   switch (impl->parent->mode)
   {
     case PLUGIN_MODE_WRAPPED:
+    case PLUGIN_MODE_TOKEN_LOG:
       return impl->instance->unregister_datareader (impl->instance, check_handle (datareader_crypto_handle), ex);
     default:
       return true;
@@ -457,6 +650,7 @@ static DDS_Security_boolean encode_serialized_payload(
   switch (impl->parent->mode)
   {
     case PLUGIN_MODE_WRAPPED:
+    case PLUGIN_MODE_TOKEN_LOG:
     {
       if (!impl->instance->encode_serialized_payload (impl->instance, encoded_buffer,
           extra_inline_qos, plain_buffer, check_handle (sending_datawriter_crypto), ex))
@@ -511,6 +705,7 @@ static DDS_Security_boolean encode_datawriter_submessage(
   switch (impl->parent->mode)
   {
     case PLUGIN_MODE_WRAPPED:
+    case PLUGIN_MODE_TOKEN_LOG:
       if (!impl->instance->encode_datawriter_submessage (impl->instance, encoded_rtps_submessage,
         plain_rtps_submessage, check_handle (sending_datawriter_crypto), receiving_datareader_crypto_list, receiving_datareader_crypto_list_index, ex))
         return false;
@@ -558,6 +753,7 @@ static DDS_Security_boolean encode_datareader_submessage(
   switch (impl->parent->mode)
   {
     case PLUGIN_MODE_WRAPPED:
+    case PLUGIN_MODE_TOKEN_LOG:
       if (!impl->instance->encode_datareader_submessage (impl->instance, encoded_rtps_submessage,
         plain_rtps_submessage, check_handle (sending_datareader_crypto), receiving_datawriter_crypto_list, ex))
         return false;
@@ -580,6 +776,7 @@ static DDS_Security_boolean encode_rtps_message(
   switch (impl->parent->mode)
   {
     case PLUGIN_MODE_WRAPPED:
+    case PLUGIN_MODE_TOKEN_LOG:
       if (!impl->instance->encode_rtps_message (impl->instance, encoded_rtps_message,
           plain_rtps_message, check_handle (sending_participant_crypto), receiving_participant_crypto_list, receiving_participant_crypto_list_index, ex))
         return false;
@@ -611,6 +808,7 @@ static DDS_Security_boolean decode_rtps_message(
   switch (impl->parent->mode)
   {
     case PLUGIN_MODE_WRAPPED:
+    case PLUGIN_MODE_TOKEN_LOG:
       return impl->instance->decode_rtps_message (impl->instance, plain_buffer, encoded_buffer,
           check_handle (receiving_participant_crypto), check_handle (sending_participant_crypto), ex);
     default:
@@ -632,6 +830,7 @@ static DDS_Security_boolean preprocess_secure_submsg(
   switch (impl->parent->mode)
   {
     case PLUGIN_MODE_WRAPPED:
+    case PLUGIN_MODE_TOKEN_LOG:
       return impl->instance->preprocess_secure_submsg (impl->instance, datawriter_crypto, datareader_crypto,
         secure_submessage_category, encoded_rtps_submessage, check_handle (receiving_participant_crypto), check_handle (sending_participant_crypto), ex);
     default:
@@ -651,6 +850,7 @@ static DDS_Security_boolean decode_datawriter_submessage(
   switch (impl->parent->mode)
   {
     case PLUGIN_MODE_WRAPPED:
+    case PLUGIN_MODE_TOKEN_LOG:
       return impl->instance->decode_datawriter_submessage (impl->instance, plain_rtps_submessage,
           encoded_rtps_submessage, check_handle (receiving_datareader_crypto), check_handle (sending_datawriter_crypto), ex);
     default:
@@ -670,6 +870,7 @@ static DDS_Security_boolean decode_datareader_submessage(
   switch (impl->parent->mode)
   {
     case PLUGIN_MODE_WRAPPED:
+    case PLUGIN_MODE_TOKEN_LOG:
       return impl->instance->decode_datareader_submessage (impl->instance, plain_rtps_submessage,
           encoded_rtps_submessage, check_handle (receiving_datawriter_crypto), check_handle (sending_datareader_crypto), ex);
     default:
@@ -690,6 +891,7 @@ static DDS_Security_boolean decode_serialized_payload(
   switch (impl->parent->mode)
   {
     case PLUGIN_MODE_WRAPPED:
+    case PLUGIN_MODE_TOKEN_LOG:
       return impl->instance->decode_serialized_payload(impl->instance, plain_buffer, encoded_buffer,
           inline_qos, check_handle (receiving_datareader_crypto), check_handle (sending_datawriter_crypto), ex);
     default:
@@ -815,3 +1017,41 @@ int finalize_test_cryptography_wrapped(void *context)
   return finalize_test_cryptography_common(impl, true);
 }
 
+static void init_print_lock(void)
+{
+  ddsrt_mutex_init (&g_print_token_lock);
+}
+
+int32_t init_test_cryptography_store_tokens(const char *argument, void **context, struct ddsi_domaingv *gv)
+{
+  struct dds_security_cryptography_impl *impl = init_test_cryptography_common(argument, true, gv);
+  if (!impl)
+    return DDS_SECURITY_FAILED;
+  impl->mode = PLUGIN_MODE_TOKEN_LOG;
+  ddsrt_once (&lock_inited, &init_print_lock);
+  ddsrt_mutex_init (&impl->token_data_lock);
+  ddsrt_circlist_init (&impl->token_data_list);
+  *context = impl;
+  return DDS_SECURITY_SUCCESS;
+}
+
+int32_t finalize_test_cryptography_store_tokens(void *context)
+{
+  struct dds_security_cryptography_impl* impl = (struct dds_security_cryptography_impl*) context;
+  assert(impl->mode == PLUGIN_MODE_TOKEN_LOG);
+  ddsrt_mutex_lock (&impl->token_data_lock);
+  while (!ddsrt_circlist_isempty (&impl->token_data_list))
+  {
+    struct ddsrt_circlist_elem *list_elem = ddsrt_circlist_oldest (&impl->token_data_list);
+    struct crypto_token_data *token_data = DDSRT_FROM_CIRCLIST (struct crypto_token_data, e, list_elem);
+    ddsrt_circlist_remove (&impl->token_data_list, list_elem);
+    ddsrt_free (token_data);
+  }
+  ddsrt_mutex_unlock (&impl->token_data_lock);
+  ddsrt_mutex_destroy (&impl->token_data_lock);
+  /* don't detroy g_print_token_lock as this will result in multiple
+     calls to mutex_destroy for this lock in case of multiple domains */
+
+  return finalize_test_cryptography_common(impl, true);
+}
+
diff --git a/src/security/core/tests/common/cryptography_wrapper.h b/src/security/core/tests/common/cryptography_wrapper.h
index 0c50adc..b9384c9 100644
--- a/src/security/core/tests/common/cryptography_wrapper.h
+++ b/src/security/core/tests/common/cryptography_wrapper.h
@@ -12,13 +12,37 @@
 #ifndef SECURITY_CORE_TEST_CRYPTO_WRAPPER_H_
 #define SECURITY_CORE_TEST_CRYPTO_WRAPPER_H_
 
+#include "dds/ddsrt/circlist.h"
 #include "dds/ddsi/ddsi_domaingv.h"
 #include "dds/security/dds_security_api.h"
 #include "dds/security/dds_security_api_defs.h"
 #include "dds/security/cryptography_wrapper_export.h"
 
+#define CRYPTO_TOKEN_MAXLEN 10
+#define CRYPTO_TOKEN_SIZE 256
+
 struct dds_security_cryptography_impl;
 
+enum crypto_tokens_type {
+  LOCAL_PARTICIPANT_TOKENS,
+  LOCAL_WRITER_TOKENS,
+  LOCAL_READER_TOKENS,
+  REMOTE_PARTICIPANT_TOKENS,
+  REMOTE_WRITER_TOKENS,
+  REMOTE_READER_TOKENS,
+  TOKEN_TYPE_INVALID
+};
+
+struct crypto_token_data {
+  struct ddsrt_circlist_elem e;
+  enum crypto_tokens_type type;
+  DDS_Security_ParticipantCryptoHandle local_handle;
+  DDS_Security_ParticipantCryptoHandle remote_handle;
+  uint32_t n_tokens;
+  unsigned char data[CRYPTO_TOKEN_MAXLEN][CRYPTO_TOKEN_SIZE];
+  size_t data_len[CRYPTO_TOKEN_MAXLEN];
+};
+
 SECURITY_EXPORT void set_protection_kinds(
   struct dds_security_cryptography_impl * impl,
   DDS_Security_ProtectionKind rtps_protection_kind,
@@ -34,6 +58,10 @@ SECURITY_EXPORT void set_disc_protection_kinds(
 
 SECURITY_EXPORT void set_entity_data_secret(struct dds_security_cryptography_impl * impl, const char * pp_secret, const char * groupdata_secret, const char * ep_secret);
 
+SECURITY_EXPORT const char *get_crypto_token_type_str (enum crypto_tokens_type type);
+SECURITY_EXPORT struct ddsrt_circlist * get_crypto_tokens (struct dds_security_cryptography_impl * impl);
+SECURITY_EXPORT struct crypto_token_data * find_crypto_token (struct dds_security_cryptography_impl * impl, enum crypto_tokens_type type, unsigned char * data, size_t data_len);
+
 /* Init in all-ok mode: all functions return success without calling the actual plugin */
 SECURITY_EXPORT int init_test_cryptography_all_ok(const char *argument, void **context, struct ddsi_domaingv *gv);
 SECURITY_EXPORT int finalize_test_cryptography_all_ok(void *context);
@@ -46,4 +74,8 @@ SECURITY_EXPORT int finalize_test_cryptography_missing_func(void *context);
 SECURITY_EXPORT int init_test_cryptography_wrapped(const char *argument, void **context, struct ddsi_domaingv *gv);
 SECURITY_EXPORT int finalize_test_cryptography_wrapped(void *context);
 
+/* Init in store-token mode (stores all exchanged security tokens) */
+SECURITY_EXPORT int32_t init_test_cryptography_store_tokens(const char *argument, void **context, struct ddsi_domaingv *gv);
+SECURITY_EXPORT int32_t finalize_test_cryptography_store_tokens(void *context);
+
 #endif /* SECURITY_CORE_TEST_CRYPTO_WRAPPER_H_ */
diff --git a/src/security/core/tests/common/test_utils.c b/src/security/core/tests/common/test_utils.c
index a75c6b9..3f94a85 100644
--- a/src/security/core/tests/common/test_utils.c
+++ b/src/security/core/tests/common/test_utils.c
@@ -18,6 +18,10 @@
 #include "dds/ddsrt/string.h"
 #include "dds/ddsrt/threads.h"
 #include "dds/ddsrt/heap.h"
+#include "dds/ddsi/q_entity.h"
+#include "dds/ddsi/ddsi_entity_index.h"
+#include "dds/ddsi/ddsi_security_omg.h"
+#include "dds__entity.h"
 #include "dds/security/dds_security_api.h"
 #include "authentication_wrapper.h"
 #include "test_utils.h"
@@ -449,3 +453,21 @@ void write_read_for(dds_entity_t wr, dds_entity_t pp_rd, dds_entity_t rd, dds_du
   CU_ASSERT_EQUAL_FATAL (write_fail, exp_write_fail);
   CU_ASSERT_EQUAL_FATAL (read_fail, exp_read_fail);
 }
+
+struct dds_security_cryptography_impl * get_crypto_context(dds_entity_t participant)
+{
+  struct dds_entity *pp_entity = NULL;
+  struct participant *pp;
+  struct dds_security_cryptography_impl *context;
+  dds_return_t ret;
+
+  ret = dds_entity_lock (participant, DDS_KIND_PARTICIPANT, &pp_entity);
+  CU_ASSERT_EQUAL_FATAL (ret, 0);
+  thread_state_awake (lookup_thread_state(), &pp_entity->m_domain->gv);
+  pp = entidx_lookup_participant_guid (pp_entity->m_domain->gv.entity_index, &pp_entity->m_guid);
+  CU_ASSERT_FATAL (pp != NULL);
+  context = (struct dds_security_cryptography_impl *) q_omg_participant_get_cryptography (pp);
+  thread_state_asleep (lookup_thread_state ());
+  dds_entity_unlock (pp_entity);
+  return context;
+}
diff --git a/src/security/core/tests/common/test_utils.h b/src/security/core/tests/common/test_utils.h
index ac1e8a7..919affe 100644
--- a/src/security/core/tests/common/test_utils.h
+++ b/src/security/core/tests/common/test_utils.h
@@ -69,5 +69,6 @@ void rd_wr_init_fail(
     bool exp_pubtp_fail, bool exp_wr_fail,
     bool exp_subtp_fail, bool exp_rd_fail);
 void write_read_for(dds_entity_t wr, dds_entity_t pp_rd, dds_entity_t rd, dds_duration_t dur, bool exp_write_fail, bool exp_read_fail);
+struct dds_security_cryptography_impl * get_crypto_context(dds_entity_t participant);
 
 #endif /* SECURITY_CORE_TEST_UTILS_H_ */
diff --git a/src/security/core/tests/handshake.c b/src/security/core/tests/handshake.c
index 66a77f9..5947a8f 100644
--- a/src/security/core/tests/handshake.c
+++ b/src/security/core/tests/handshake.c
@@ -20,6 +20,7 @@
 #include "dds/ddsrt/environ.h"
 #include "dds/ddsrt/heap.h"
 #include "dds/ddsrt/string.h"
+#include "dds/ddsrt/string.h"
 #include "dds/ddsi/q_config.h"
 #include "dds/ddsi/ddsi_domaingv.h"
 #include "dds/ddsi/q_misc.h"
@@ -29,9 +30,11 @@
 
 #include "common/config_env.h"
 #include "common/authentication_wrapper.h"
+#include "common/cryptography_wrapper.h"
 #include "common/plugin_wrapper_msg_q.h"
 #include "common/test_utils.h"
 #include "common/test_identity.h"
+#include "common/security_config_test_utils.h"
 
 static const char *config =
     "${CYCLONEDDS_URI}${CYCLONEDDS_URI:+,}"
@@ -42,7 +45,7 @@ static const char *config =
     "  </Discovery>"
     "  <DDSSecurity>"
     "    <Authentication>"
-    "      <Library finalizeFunction=\"finalize_test_authentication_wrapped\" initFunction=\"init_test_authentication_wrapped\" path=\"" WRAPPERLIB_PATH("dds_security_authentication_wrapper") "\"/>"
+    "      <Library initFunction=\"${AUTH_INIT}\" finalizeFunction=\"${AUTH_FINI}\" path=\"" WRAPPERLIB_PATH("dds_security_authentication_wrapper") "\"/>"
     "      <IdentityCertificate>data:,"TEST_IDENTITY1_CERTIFICATE"</IdentityCertificate>"
     "      <PrivateKey>data:,"TEST_IDENTITY1_PRIVATE_KEY"</PrivateKey>"
     "      <IdentityCA>data:,"TEST_IDENTITY_CA1_CERTIFICATE"</IdentityCA>"
@@ -54,43 +57,120 @@ static const char *config =
     "      <Permissions>file:" COMMON_ETC_PATH("default_permissions.p7s") "</Permissions>"
     "    </AccessControl>"
     "    <Cryptographic>"
-    "      <Library finalizeFunction=\"finalize_crypto\" initFunction=\"init_crypto\"/>"
+    "      <Library initFunction=\"${CRYPTO_INIT}\" finalizeFunction=\"${CRYPTO_FINI}\" path=\"" WRAPPERLIB_PATH("dds_security_cryptography_wrapper") "\"/>"
     "    </Cryptographic>"
     "  </DDSSecurity>"
     "</Domain>";
 
-#define DDS_DOMAINID_PART1 0
-#define DDS_DOMAINID_PART2 1
+#define DDS_DOMAINID1 0
+#define DDS_DOMAINID2 1
 
-static dds_entity_t g_part1_domain = 0;
-static dds_entity_t g_part1_participant = 0;
+static dds_entity_t g_domain1 = 0;
+static dds_entity_t g_participant1 = 0;
 
-static dds_entity_t g_part2_domain = 0;
-static dds_entity_t g_part2_participant = 0;
+static dds_entity_t g_domain2 = 0;
+static dds_entity_t g_participant2 = 0;
 
-static void handshake_init(void)
+static uint32_t g_topic_nr = 0;
+static dds_entity_t g_pub = 0, g_pub_tp = 0, g_wr = 0, g_sub = 0, g_sub_tp = 0, g_rd = 0;
+
+static void handshake_init(const char * auth_init, const char * auth_fini, const char * crypto_init, const char * crypto_fini)
 {
-  char *conf_part1 = ddsrt_expand_envvars_sh (config, DDS_DOMAINID_PART1);
-  char *conf_part2 = ddsrt_expand_envvars_sh (config, DDS_DOMAINID_PART2);
-  g_part1_domain = dds_create_domain (DDS_DOMAINID_PART1, conf_part1);
-  g_part2_domain = dds_create_domain (DDS_DOMAINID_PART2, conf_part2);
-  dds_free (conf_part1);
-  dds_free (conf_part2);
+  struct kvp config_vars[] = {
+    { "AUTH_INIT", auth_init, 1},
+    { "AUTH_FINI", auth_fini, 1},
+    { "CRYPTO_INIT", crypto_init, 1 },
+    { "CRYPTO_FINI", crypto_fini, 1 },
+    { NULL, NULL, 0 }
+  };
 
-  CU_ASSERT_FATAL ((g_part1_participant = dds_create_participant (DDS_DOMAINID_PART1, NULL, NULL)) > 0);
-  CU_ASSERT_FATAL ((g_part2_participant = dds_create_participant (DDS_DOMAINID_PART2, NULL, NULL)) > 0);
+  char *conf = ddsrt_expand_vars_sh (config, &expand_lookup_vars_env, config_vars);
+  int32_t unmatched = expand_lookup_unmatched (config_vars);
+  CU_ASSERT_EQUAL_FATAL (unmatched, 0);
+  g_domain1 = dds_create_domain (DDS_DOMAINID1, conf);
+  g_domain2 = dds_create_domain (DDS_DOMAINID2, conf);
+  dds_free (conf);
+
+  g_participant1 = dds_create_participant (DDS_DOMAINID1, NULL, NULL);
+  CU_ASSERT_FATAL (g_participant1 > 0);
+  g_participant2 = dds_create_participant (DDS_DOMAINID2, NULL, NULL);
+  CU_ASSERT_FATAL (g_participant2 > 0);
 }
 
 static void handshake_fini(void)
 {
-  CU_ASSERT_EQUAL_FATAL (dds_delete (g_part1_participant), DDS_RETCODE_OK);
-  CU_ASSERT_EQUAL_FATAL (dds_delete (g_part2_participant), DDS_RETCODE_OK);
-  CU_ASSERT_EQUAL_FATAL (dds_delete (g_part1_domain), DDS_RETCODE_OK);
-  CU_ASSERT_EQUAL_FATAL (dds_delete (g_part2_domain), DDS_RETCODE_OK);
+  dds_return_t ret = dds_delete (g_domain1);
+  CU_ASSERT_EQUAL_FATAL (ret, DDS_RETCODE_OK);
+  ret = dds_delete (g_domain2);
+  CU_ASSERT_EQUAL_FATAL (ret, DDS_RETCODE_OK);
 }
 
-CU_Test(ddssec_handshake, happy_day, .init = handshake_init, .fini = handshake_fini)
+CU_Test(ddssec_handshake, happy_day)
 {
-  validate_handshake_nofail (DDS_DOMAINID_PART1);
-  validate_handshake_nofail (DDS_DOMAINID_PART2);
+  handshake_init (
+    "init_test_authentication_wrapped", "finalize_test_authentication_wrapped",
+    "init_test_cryptography_wrapped", "finalize_test_cryptography_wrapped");
+  validate_handshake_nofail (DDS_DOMAINID1);
+  validate_handshake_nofail (DDS_DOMAINID2);
+  handshake_fini ();
+}
+
+CU_Test(ddssec_handshake, check_tokens)
+{
+  handshake_init (
+    "init_test_authentication_wrapped", "finalize_test_authentication_wrapped",
+    "init_test_cryptography_store_tokens", "finalize_test_cryptography_store_tokens");
+  validate_handshake_nofail (DDS_DOMAINID1);
+  validate_handshake_nofail (DDS_DOMAINID2);
+
+  char topic_name[100];
+  create_topic_name("ddssec_authentication_", g_topic_nr++, topic_name, sizeof (topic_name));
+  rd_wr_init (g_participant1, &g_pub, &g_pub_tp, &g_wr, g_participant2, &g_sub, &g_sub_tp, &g_rd, topic_name);
+  write_read_for (g_wr, g_participant2, g_rd, DDS_MSECS (100), false, false);
+
+  // Get subscriber and publisher crypto tokens
+  struct dds_security_cryptography_impl * crypto_context_pub = get_crypto_context (g_participant1);
+  CU_ASSERT_FATAL (crypto_context_pub != NULL);
+  struct ddsrt_circlist *pub_tokens = get_crypto_tokens (crypto_context_pub);
+
+  struct dds_security_cryptography_impl * crypto_context_sub = get_crypto_context (g_participant2);
+  CU_ASSERT_FATAL (crypto_context_sub != NULL);
+  struct ddsrt_circlist *sub_tokens = get_crypto_tokens (crypto_context_sub);
+
+  // Find all publisher tokens in subscribers token store
+  while (!ddsrt_circlist_isempty (pub_tokens))
+  {
+    struct ddsrt_circlist_elem *list_elem = ddsrt_circlist_oldest (pub_tokens);
+    struct crypto_token_data *token_data = DDSRT_FROM_CIRCLIST (struct crypto_token_data, e, list_elem);
+    enum crypto_tokens_type exp_type = TOKEN_TYPE_INVALID;
+    for (size_t n = 0; n < token_data->n_tokens; n++)
+    {
+      switch (token_data->type)
+      {
+        case LOCAL_PARTICIPANT_TOKENS: exp_type = REMOTE_PARTICIPANT_TOKENS; break;
+        case REMOTE_PARTICIPANT_TOKENS: exp_type = LOCAL_PARTICIPANT_TOKENS; break;
+        case LOCAL_WRITER_TOKENS: exp_type = REMOTE_WRITER_TOKENS; break;
+        case REMOTE_WRITER_TOKENS: exp_type = LOCAL_WRITER_TOKENS; break;
+        case LOCAL_READER_TOKENS: exp_type = REMOTE_READER_TOKENS; break;
+        case REMOTE_READER_TOKENS: exp_type = LOCAL_READER_TOKENS; break;
+        default: CU_FAIL ("Unexpected token type");
+      }
+      printf("- find token %s #%"PRIuSIZE", len %"PRIuSIZE"\n", get_crypto_token_type_str (token_data->type), n, token_data->data_len[n]);
+      struct crypto_token_data *st = find_crypto_token (crypto_context_sub, exp_type, token_data->data[n], token_data->data_len[n]);
+      CU_ASSERT_FATAL (st != NULL);
+    }
+    ddsrt_circlist_remove (pub_tokens, list_elem);
+    ddsrt_free (token_data);
+  }
+
+  // Cleanup
+  while (!ddsrt_circlist_isempty (sub_tokens))
+  {
+    struct ddsrt_circlist_elem *list_elem = ddsrt_circlist_oldest (sub_tokens);
+    ddsrt_circlist_remove (sub_tokens, list_elem);
+    ddsrt_free (list_elem);
+  }
+  ddsrt_free (sub_tokens);
+  ddsrt_free (pub_tokens);
+  handshake_fini ();
 }
diff --git a/src/security/core/tests/secure_communication.c b/src/security/core/tests/secure_communication.c
index 92b40a4..186944c 100644
--- a/src/security/core/tests/secure_communication.c
+++ b/src/security/core/tests/secure_communication.c
@@ -27,14 +27,11 @@
 #include "dds/ddsi/ddsi_domaingv.h"
 #include "dds/ddsi/q_misc.h"
 #include "dds/ddsi/ddsi_xqos.h"
-#include "dds/ddsi/q_entity.h"
-#include "dds/ddsi/ddsi_entity_index.h"
-#include "dds/ddsi/ddsi_security_omg.h"
-#include "dds__entity.h"
 #include "dds/security/dds_security_api.h"
 
 #include "common/config_env.h"
 #include "common/test_identity.h"
+#include "common/test_utils.h"
 #include "common/security_config_test_utils.h"
 #include "common/cryptography_wrapper.h"
 
@@ -119,25 +116,6 @@ typedef void (*set_crypto_params_fn)(struct dds_security_cryptography_impl *, co
 typedef dds_entity_t (*pubsub_create_fn)(dds_entity_t, const dds_qos_t *qos, const dds_listener_t *listener);
 typedef dds_entity_t (*ep_create_fn)(dds_entity_t, dds_entity_t, const dds_qos_t *qos, const dds_listener_t *listener);
 
-
-static struct dds_security_cryptography_impl * get_crypto_context(dds_entity_t participant)
-{
-  struct dds_entity *pp_entity = NULL;
-  struct participant *pp;
-  struct dds_security_cryptography_impl *context;
-  dds_return_t ret;
-
-  ret = dds_entity_lock (participant, DDS_KIND_PARTICIPANT, &pp_entity);
-  CU_ASSERT_EQUAL_FATAL (ret, 0);
-  thread_state_awake (lookup_thread_state(), &pp_entity->m_domain->gv);
-  pp = entidx_lookup_participant_guid (pp_entity->m_domain->gv.entity_index, &pp_entity->m_guid);
-  CU_ASSERT_FATAL (pp != NULL);
-  context = (struct dds_security_cryptography_impl *) q_omg_participant_get_cryptography (pp);
-  thread_state_asleep (lookup_thread_state ());
-  dds_entity_unlock (pp_entity);
-  return context;
-}
-
 static const char * pk_to_str(DDS_Security_ProtectionKind pk)
 {
   switch (pk)
@@ -181,14 +159,6 @@ static dds_qos_t *get_qos()
   return qos;
 }
 
-static char *create_topic_name(const char *prefix, uint32_t nr, char *name, size_t size)
-{
-  ddsrt_pid_t pid = ddsrt_getpid ();
-  ddsrt_tid_t tid = ddsrt_gettid ();
-  (void)snprintf(name, size, "%s%d_pid%" PRIdPID "_tid%" PRIdTID "", prefix, nr, pid, tid);
-  return name;
-}
-
 static dds_entity_t create_pp (dds_domainid_t domain_id, const struct domain_sec_config * domain_config, set_crypto_params_fn set_crypto_params)
 {
   dds_qos_t *qos = dds_create_qos ();
@@ -280,45 +250,6 @@ static void test_fini(size_t n_sub_domain, size_t n_pub_domain)
   printf("Test finished\n");
 }
 
-static void sync_writer_to_readers(dds_entity_t pub_participant, dds_entity_t writer, size_t n_exp_rd)
-{
-  dds_attach_t triggered;
-  dds_return_t ret;
-  dds_entity_t waitset_wr = dds_create_waitset (pub_participant);
-  CU_ASSERT_FATAL (waitset_wr > 0);
-  dds_publication_matched_status_t pub_matched;
-
-  /* Sync writer to reader. */
-  ret = dds_waitset_attach (waitset_wr, writer, writer);
-  CU_ASSERT_EQUAL_FATAL (ret, DDS_RETCODE_OK);
-  while (true)
-  {
-    ret = dds_waitset_wait (waitset_wr, &triggered, 1, DDS_SECS(5));
-    CU_ASSERT_FATAL (ret >= 1);
-    CU_ASSERT_EQUAL_FATAL (writer, (dds_entity_t)(intptr_t) triggered);
-    ret = dds_get_publication_matched_status(writer, &pub_matched);
-    CU_ASSERT_EQUAL_FATAL (ret, DDS_RETCODE_OK);
-    if (pub_matched.total_count >= n_exp_rd)
-      break;
-  };
-  dds_delete (waitset_wr);
-}
-
-static void reader_wait_for_data(dds_entity_t sub_participant, dds_entity_t reader)
-{
-  dds_attach_t triggered;
-  dds_return_t ret;
-  dds_entity_t waitset_rd = dds_create_waitset (sub_participant);
-  CU_ASSERT_FATAL (waitset_rd > 0);
-
-  ret = dds_waitset_attach (waitset_rd, reader, reader);
-  CU_ASSERT_EQUAL_FATAL (ret, DDS_RETCODE_OK);
-  ret = dds_waitset_wait (waitset_rd, &triggered, 1, DDS_SECS(5));
-  CU_ASSERT_EQUAL_FATAL (ret, 1);
-  CU_ASSERT_EQUAL_FATAL (reader, (dds_entity_t)(intptr_t)triggered);
-  dds_delete (waitset_rd);
-}
-
 static void create_eps (dds_entity_t **endpoints, dds_entity_t **topics, size_t n_dom, size_t n_pp, size_t n_eps, const char * topic_name, const dds_topic_descriptor_t *topic_descriptor,
     const dds_entity_t * pps, const dds_qos_t * qos, ep_create_fn ep_create, unsigned status_mask)
 {
@@ -381,7 +312,7 @@ static void test_write_read(struct domain_sec_config *domain_config,
       for (size_t w = 0; w < n_writers; w++)
       {
         size_t wr_index = pp_index * n_writers + w;
-        sync_writer_to_readers (g_pub_participants[pp_index], writers[wr_index], n_sub_domains * n_sub_participants * n_readers);
+        sync_writer_to_readers (g_pub_participants[pp_index], writers[wr_index], (uint32_t)(n_sub_domains * n_sub_participants * n_readers));
         sample.id = (int32_t) wr_index;
         printf("writer %"PRId32" writing sample %d\n", writers[wr_index], sample.id);
         ret = dds_write (writers[wr_index], &sample);
@@ -404,7 +335,7 @@ static void test_write_read(struct domain_sec_config *domain_config,
           ret = dds_take (readers[rd_index], samples, info, 1, 1);
           if (ret == 0)
           {
-            reader_wait_for_data (g_sub_participants[pp_index], readers[rd_index]);
+            reader_wait_for_data (g_sub_participants[pp_index], readers[rd_index], DDS_SECS(5));
             continue;
           }
           printf("reader %"PRId32" received sample %d\n", readers[rd_index], rd_sample.id);
@@ -500,7 +431,7 @@ static void test_payload_secret(DDS_Security_ProtectionKind rtps_pk, DDS_Securit
   {
     if ((ret = dds_take (readers[0], samples, info, 1, 1)) == 0)
     {
-      reader_wait_for_data (g_sub_participants[0], readers[0]);
+      reader_wait_for_data (g_sub_participants[0], readers[0], DDS_SECS(5));
       continue;
     }
     CU_ASSERT_EQUAL_FATAL (ret, 1);

From 9f261423e3ef0727a960001cc4c23f918f5474ea Mon Sep 17 00:00:00 2001
From: Dennis Potman <dennis.potman@adlinktech.com>
Date: Fri, 24 Apr 2020 19:43:55 +0200
Subject: [PATCH 182/238] Add tests for discovery protection

Adding a test that checks the effects of using different configuration settings
for discovery protection. This test set uses the cryptography wrapper to count
the number of invocations of the encode and decode functions during a session
and checks the counts with the expected values.

Signed-off-by: Dennis Potman <dennis.potman@adlinktech.com>
---
 src/security/core/tests/access_control.c      | 153 +++++++++++++++++-
 src/security/core/tests/authentication.c      |  12 +-
 .../core/tests/common/cryptography_wrapper.c  |  90 ++++++++++-
 .../core/tests/common/cryptography_wrapper.h  |  15 ++
 .../tests/common/security_config_test_utils.c |  62 +++++--
 .../tests/common/security_config_test_utils.h |   6 +-
 src/security/core/tests/common/test_utils.c   |  32 ++++
 src/security/core/tests/common/test_utils.h   |  11 ++
 .../core/tests/secure_communication.c         |  71 +-------
 9 files changed, 359 insertions(+), 93 deletions(-)

diff --git a/src/security/core/tests/access_control.c b/src/security/core/tests/access_control.c
index 3b04fc6..23c32f3 100644
--- a/src/security/core/tests/access_control.c
+++ b/src/security/core/tests/access_control.c
@@ -23,15 +23,20 @@
 #include "dds/ddsrt/heap.h"
 #include "dds/ddsrt/io.h"
 #include "dds/ddsrt/string.h"
+#include "dds/ddsi/q_entity.h"
+#include "dds/ddsi/ddsi_entity_index.h"
+#include "dds/ddsi/ddsi_security_omg.h"
 #include "dds/ddsi/q_config.h"
 #include "dds/ddsi/ddsi_domaingv.h"
 #include "dds/ddsi/q_misc.h"
 #include "dds/ddsi/ddsi_xqos.h"
+#include "dds__entity.h"
 
 #include "dds/security/dds_security_api.h"
 
 #include "common/config_env.h"
 #include "common/access_control_wrapper.h"
+#include "common/cryptography_wrapper.h"
 #include "common/security_config_test_utils.h"
 #include "common/test_identity.h"
 #include "common/test_utils.h"
@@ -59,7 +64,7 @@ static const char *config =
     "      ${INCL_PERM:+<Permissions><![CDATA[}${TEST_PERMISSIONS}${INCL_PERM:+]]></Permissions>}"
     "    </AccessControl>"
     "    <Cryptographic>"
-    "      <Library finalizeFunction=\"finalize_crypto\" initFunction=\"init_crypto\"/>"
+    "      <Library initFunction=\"${CRYPTO_INIT:-init_test_cryptography_wrapped}\" finalizeFunction=\"${CRYPTO_INIT:-finalize_test_cryptography_wrapped}\" path=\"" WRAPPERLIB_PATH("dds_security_cryptography_wrapper") "\"/>"
     "    </Cryptographic>"
     "  </DDSSecurity>"
     "</Domain>";
@@ -114,6 +119,41 @@ static void access_control_fini(size_t n)
     CU_ASSERT_EQUAL_FATAL (dds_delete (g_domain[i]), DDS_RETCODE_OK);
 }
 
+static DDS_Security_DatawriterCryptoHandle get_builtin_writer_crypto_handle(dds_entity_t participant, unsigned entityid)
+{
+  DDS_Security_DatawriterCryptoHandle crypto_handle;
+  struct dds_entity *pp_entity;
+  struct participant *pp;
+  struct writer *wr;
+  CU_ASSERT_EQUAL_FATAL(dds_entity_pin(participant, &pp_entity), 0);
+  thread_state_awake(lookup_thread_state(), &pp_entity->m_domain->gv);
+  pp = entidx_lookup_participant_guid(pp_entity->m_domain->gv.entity_index, &pp_entity->m_guid);
+  wr = get_builtin_writer(pp, entityid);
+  CU_ASSERT_FATAL(wr != NULL);
+  assert(wr != NULL); /* for Clang's static analyzer */
+  crypto_handle = wr->sec_attr->crypto_handle;
+  thread_state_asleep(lookup_thread_state());
+  dds_entity_unpin(pp_entity);
+  return crypto_handle;
+}
+
+// static DDS_Security_DatawriterCryptoHandle get_writer_crypto_handle(dds_entity_t writer)
+// {
+//   DDS_Security_DatawriterCryptoHandle crypto_handle;
+//   struct dds_entity *wr_entity;
+//   struct writer *wr;
+//   CU_ASSERT_EQUAL_FATAL(dds_entity_pin(writer, &wr_entity), 0);
+//   thread_state_awake(lookup_thread_state(), &wr_entity->m_domain->gv);
+//   wr = entidx_lookup_writer_guid(wr_entity->m_domain->gv.entity_index, &wr_entity->m_guid);
+//   CU_ASSERT_FATAL(wr != NULL);
+//   assert(wr != NULL); /* for Clang's static analyzer */
+//   crypto_handle = wr->sec_attr->crypto_handle;
+//   thread_state_asleep(lookup_thread_state());
+//   dds_entity_unpin(wr_entity);
+//   return crypto_handle;
+// }
+
+
 #define GOV_F PF_F COMMON_ETC_PATH("default_governance.p7s")
 #define GOV_FNE PF_F COMMON_ETC_PATH("default_governance_non_existing.p7s")
 #define GOV_DI PF_D COMMON_ETC_PATH("default_governance.p7s")
@@ -512,11 +552,9 @@ CU_Theory(
     get_permissions_grant ("id2", id2_subj, perm_inv_pp2 ? "99" : NULL, now, now + DDS_SECS(3600), perm_topic, perm_topic, NULL) };
   char * perm_config = get_permissions_config (grants, 2, true);
 
-  struct kvp governance_vars_pp1[] = { { "ENABLE_JOIN_AC", join_ac_pp1 ? "true" : "false", 1 }, { NULL, NULL, 0 } };
-  struct kvp governance_vars_pp2[] = { { "ENABLE_JOIN_AC", join_ac_pp2 ? "true" : "false", 1 }, { NULL, NULL, 0 } };
-
-  char * gov_config_pp1 = get_governance_config (governance_vars_pp1, true);
-  char * gov_config_pp2 = get_governance_config (governance_vars_pp2, true);
+  char * gov_topic_rule = get_governance_topic_rule ("*", false, false, true, true, "NONE", "NONE");
+  char * gov_config_pp1 = get_governance_config (false, join_ac_pp1, NULL, NULL, NULL, gov_topic_rule, true);
+  char * gov_config_pp2 = get_governance_config (false, join_ac_pp2, NULL, NULL, NULL, gov_topic_rule, true);
   const char * def_perm_ca = PF_F COMMON_ETC_PATH("default_permissions_ca.pem");
 
   access_control_init (
@@ -536,6 +574,109 @@ CU_Theory(
 
   ddsrt_free (gov_config_pp1);
   ddsrt_free (gov_config_pp2);
+  ddsrt_free (gov_topic_rule);
+  ddsrt_free (perm_topic);
+  ddsrt_free (grants[0]);
+  ddsrt_free (grants[1]);
+  ddsrt_free (perm_config);
+  ddsrt_free (ca);
+  ddsrt_free (id1_subj);
+  ddsrt_free (id2_subj);
+  ddsrt_free (id1);
+  ddsrt_free (id2);
+}
+
+#define na false
+#define E ENCRYPT
+CU_TheoryDataPoints(ddssec_access_control, discovery_protection) = {
+    CU_DataPoints(const char *,
+    /*                                        */"disabled",
+    /*                                         |     */"enabled, protection kind none",
+    /*                                         |      |     */"disabled, protection kind encrypt",
+    /*                                         |      |      |     */"enabled, protection kind encrypt",
+    /*                                         |      |      |      |     */"enabled, protection kind sign",
+    /*                                         |      |      |      |      |     */"enabled, protection kind encrypt-with-origin_auth",
+    /*                                         |      |      |      |      |      |      */"enabled for node 1, disabled for node 2",
+    /*                                         |      |      |      |      |      |       |     */"node 1 and node 2 different protection kinds"),
+    CU_DataPoints(bool,                        false, true,  false, true,  true,  true,   true,  true),   /* enable_discovery_protection for pp 1 */
+    CU_DataPoints(bool,                        false, true,  false, true,  true,  true,   false, true),   /* enable_discovery_protection for pp 2 */
+    CU_DataPoints(DDS_Security_ProtectionKind, PK_N,  PK_N,  PK_E,  PK_E,  PK_S,  PK_EOA, PK_E,  PK_E),   /* discovery_protection_kind pp 1 */
+    CU_DataPoints(DDS_Security_ProtectionKind, PK_N,  PK_N,  PK_E,  PK_E,  PK_S,  PK_EOA, PK_N,  PK_S),   /* discovery_protection_kind pp 2 */
+    CU_DataPoints(bool,                        false, false, false, false, false, false,  true,  true),   /* expect rd-wr match fail */
+    CU_DataPoints(bool,                        false, false, true,  true,  true,  true,   true,  true),   /* expect SEDP_BUILTIN_PUBLICATIONS_SECURE_WRITER of pp 1 to have a crypto handle */
+    CU_DataPoints(bool,                        na,    na,    true,  true,  true,  true,   false, false),  /* expect encode_datawriter_submessage for SEDP_BUILTIN_PUBLICATIONS_SECURE_WRITER of pp 1 */
+};
+#undef na
+CU_Theory(
+  (const char * test_descr, bool enable_discovery_protection_pp1, bool enable_discovery_protection_pp2,
+    DDS_Security_ProtectionKind discovery_protection_kind_pp1, DDS_Security_ProtectionKind discovery_protection_kind_pp2,
+    bool exp_rd_wr_match_fail, bool exp_secure_pub_wr_handle, bool exp_secure_pub_wr_encode_decode),
+  ddssec_access_control, discovery_protection, .timeout=30)
+{
+  print_test_msg ("running test discovery_protection: %s\n", test_descr);
+
+  char topic_name[100];
+  create_topic_name ("ddssec_access_control_", g_topic_nr++, topic_name, sizeof (topic_name));
+
+  /* create ca and id1/id2 certs that will not expire during this test */
+  char *ca, *id1, *id2, *id1_subj, *id2_subj;
+  ca = generate_ca ("ca1", TEST_IDENTITY_CA1_PRIVATE_KEY, 0, 3600);
+  id1 = generate_identity (ca, TEST_IDENTITY_CA1_PRIVATE_KEY, "id1", TEST_IDENTITY1_PRIVATE_KEY, 0, 3600, &id1_subj);
+  id2 = generate_identity (ca, TEST_IDENTITY_CA1_PRIVATE_KEY, "id2", TEST_IDENTITY1_PRIVATE_KEY, 0, 3600, &id2_subj);
+
+  /* localtime will be converted to gmtime in get_permissions_grant */
+  dds_time_t now = dds_time ();
+  char * perm_topic = get_permissions_topic (topic_name);
+  char * grants[] = {
+    get_permissions_grant ("id1", id1_subj, NULL, now, now + DDS_SECS(3600), perm_topic, perm_topic, NULL),
+    get_permissions_grant ("id2", id2_subj, NULL, now, now + DDS_SECS(3600), perm_topic, perm_topic, NULL) };
+  char * perm_config = get_permissions_config (grants, 2, true);
+
+  char * gov_topic_rule1 = get_governance_topic_rule (topic_name, enable_discovery_protection_pp1, false, true, true, "ENCRYPT", "NONE");
+  char * gov_topic_rule2 = get_governance_topic_rule (topic_name, enable_discovery_protection_pp2, false, true, true, "ENCRYPT", "NONE");
+  char * gov_config1 = get_governance_config (false, true, pk_to_str (discovery_protection_kind_pp1), NULL, "ENCRYPT", gov_topic_rule1, true);
+  char * gov_config2 = get_governance_config (false, true, pk_to_str (discovery_protection_kind_pp2), NULL, "ENCRYPT", gov_topic_rule2, true);
+  const char * def_perm_ca = PF_F COMMON_ETC_PATH("default_permissions_ca.pem");
+
+  access_control_init (
+      2,
+      (const char *[]) { id1, id2 },
+      (const char *[]) { TEST_IDENTITY1_PRIVATE_KEY, TEST_IDENTITY1_PRIVATE_KEY },
+      (const char *[]) { ca, ca },
+      (bool []) { false, false }, NULL, NULL,
+      (bool []) { true, true }, (const char *[]) { gov_config1, gov_config2 },
+      (bool []) { true, true }, (const char *[]) { perm_config, perm_config },
+      (bool []) { true, true }, (const char *[]) { def_perm_ca, def_perm_ca });
+  validate_handshake (DDS_DOMAINID, false, NULL, NULL, NULL);
+
+  dds_entity_t pub, sub, pub_tp, sub_tp, wr, rd;
+  rd_wr_init (g_participant[0], &pub, &pub_tp, &wr, g_participant[1], &sub, &sub_tp, &rd, topic_name);
+  sync_writer_to_readers (g_participant[0], wr, exp_rd_wr_match_fail ? 0 : 1);
+  if (!exp_rd_wr_match_fail)
+    write_read_for (wr, g_participant[1], rd, DDS_MSECS (100), false, false);
+
+  DDS_Security_DatawriterCryptoHandle secure_pub_wr_handle = get_builtin_writer_crypto_handle (g_participant[0], NN_ENTITYID_SEDP_BUILTIN_PUBLICATIONS_SECURE_WRITER);
+  print_test_msg ("crypto handle for SEDP_BUILTIN_PUBLICATIONS_SECURE_WRITER: %ld\n", secure_pub_wr_handle);
+  CU_ASSERT_EQUAL_FATAL (exp_secure_pub_wr_handle, secure_pub_wr_handle != 0);
+
+  struct dds_security_cryptography_impl * crypto_context_pub = get_crypto_context (g_participant[0]);
+  CU_ASSERT_FATAL (crypto_context_pub != NULL);
+
+  struct crypto_encode_decode_data *log = get_encode_decode_log (crypto_context_pub, ENCODE_DATAWRITER_SUBMESSAGE, secure_pub_wr_handle);
+  CU_ASSERT_EQUAL_FATAL (exp_secure_pub_wr_handle && exp_secure_pub_wr_encode_decode, log != NULL);
+  if (log != NULL)
+  {
+    print_test_msg ("encode_datawriter_submessage count for SEDP_BUILTIN_PUBLICATIONS_SECURE_WRITER: %u\n", log->count);
+    CU_ASSERT_FATAL (log->count > 0);
+    ddsrt_free (log);
+  }
+
+  access_control_fini (2);
+
+  ddsrt_free (gov_config1);
+  ddsrt_free (gov_config2);
+  ddsrt_free (gov_topic_rule1);
+  ddsrt_free (gov_topic_rule2);
   ddsrt_free (perm_topic);
   ddsrt_free (grants[0]);
   ddsrt_free (grants[1]);
diff --git a/src/security/core/tests/authentication.c b/src/security/core/tests/authentication.c
index dbd80be..0af4138 100644
--- a/src/security/core/tests/authentication.c
+++ b/src/security/core/tests/authentication.c
@@ -101,15 +101,8 @@ static void authentication_init(
   if (perm_config == NULL)
     perm_config = DEF_PERM_CONF;
 
-  struct kvp governance_vars[] = {
-    { "DISCOVERY_PROTECTION_KIND", "NONE", 1 },
-    { "LIVELINESS_PROTECTION_KIND", "NONE", 1 },
-    { "RTPS_PROTECTION_KIND", "NONE", 1 },
-    { "METADATA_PROTECTION_KIND", "NONE", 1 },
-    { "DATA_PROTECTION_KIND", "NONE", 1 },
-    { NULL, NULL, 0 }
-  };
-  char * gov_config_signed = get_governance_config (governance_vars, true);
+  char * gov_topic_rule = get_governance_topic_rule ("*", false, false, true, true, "NONE", "NONE");
+  char * gov_config_signed = get_governance_config (false, false, NULL, NULL, NULL, gov_topic_rule, true);
 
   struct kvp config_vars1[] = {
     { "TEST_IDENTITY_CERTIFICATE", id1_cert, 1 },
@@ -143,6 +136,7 @@ static void authentication_init(
   CU_ASSERT_EQUAL_FATAL (exp_pp2_fail, g_participant2 <= 0);
 
   ddsrt_free (gov_config_signed);
+  ddsrt_free (gov_topic_rule);
   ddsrt_free (conf1);
   ddsrt_free (conf2);
 }
diff --git a/src/security/core/tests/common/cryptography_wrapper.c b/src/security/core/tests/common/cryptography_wrapper.c
index 1856c09..990e2c8 100644
--- a/src/security/core/tests/common/cryptography_wrapper.c
+++ b/src/security/core/tests/common/cryptography_wrapper.c
@@ -74,6 +74,8 @@ struct dds_security_cryptography_impl {
   const char * encrypted_secret;
   ddsrt_mutex_t token_data_lock;
   struct ddsrt_circlist token_data_list;
+  ddsrt_mutex_t encode_decode_log_lock;
+  struct ddsrt_circlist encode_decode_log;
 };
 
 static DDS_Security_ParticipantCryptoHandle g_local_participant_handle = 0;
@@ -211,6 +213,12 @@ struct ddsrt_circlist * get_crypto_tokens (struct dds_security_cryptography_impl
   ddsrt_circlist_init (tokens);
 
   ddsrt_mutex_lock (&impl->token_data_lock);
+  if (ddsrt_circlist_isempty (&impl->encode_decode_log))
+  {
+    ddsrt_mutex_unlock (&impl->token_data_lock);
+    return tokens;
+  }
+
   struct ddsrt_circlist_elem *elem0 = ddsrt_circlist_oldest (&impl->token_data_list), *elem = elem0;
   while (elem != NULL)
   {
@@ -231,6 +239,11 @@ struct crypto_token_data * find_crypto_token (struct dds_security_cryptography_i
 {
   assert (data_len <= CRYPTO_TOKEN_SIZE);
   ddsrt_mutex_lock (&impl->token_data_lock);
+  if (ddsrt_circlist_isempty (&impl->encode_decode_log))
+  {
+    ddsrt_mutex_unlock (&impl->token_data_lock);
+    return NULL;
+  }
   struct ddsrt_circlist_elem *elem0 = ddsrt_circlist_oldest (&impl->token_data_list), *elem = elem0;
   while (elem != NULL)
   {
@@ -256,6 +269,60 @@ struct crypto_token_data * find_crypto_token (struct dds_security_cryptography_i
   return NULL;
 }
 
+static void log_encode_decode (struct dds_security_cryptography_impl * impl, enum crypto_encode_decode_fn function, DDS_Security_long_long handle)
+{
+  ddsrt_mutex_lock (&impl->encode_decode_log_lock);
+  if (!ddsrt_circlist_isempty (&impl->encode_decode_log))
+  {
+    struct ddsrt_circlist_elem *elem0 = ddsrt_circlist_oldest (&impl->encode_decode_log), *elem = elem0;
+    while (elem != NULL)
+    {
+      struct crypto_encode_decode_data *data = DDSRT_FROM_CIRCLIST (struct crypto_encode_decode_data, e, elem);
+      if (data->function == function && data->handle == handle)
+      {
+        data->count++;
+        ddsrt_mutex_unlock (&impl->encode_decode_log_lock);
+        return;
+      }
+      elem = elem->next;
+      if (elem == elem0)
+        break;
+    }
+  }
+  /* add new entry */
+  struct crypto_encode_decode_data *new_data = ddsrt_malloc (sizeof (*new_data));
+  new_data->function = function;
+  new_data->handle = handle;
+  new_data->count = 1;
+  ddsrt_circlist_append(&impl->encode_decode_log, &new_data->e);
+  ddsrt_mutex_unlock (&impl->encode_decode_log_lock);
+}
+
+struct crypto_encode_decode_data * get_encode_decode_log (struct dds_security_cryptography_impl * impl, enum crypto_encode_decode_fn function, DDS_Security_long_long handle)
+{
+  ddsrt_mutex_lock (&impl->encode_decode_log_lock);
+  if (!ddsrt_circlist_isempty (&impl->encode_decode_log))
+  {
+    struct ddsrt_circlist_elem *elem0 = ddsrt_circlist_oldest (&impl->encode_decode_log), *elem = elem0;
+    while (elem != NULL)
+    {
+      struct crypto_encode_decode_data *data = DDSRT_FROM_CIRCLIST (struct crypto_encode_decode_data, e, elem);
+      if (data->function == function && data->handle == handle)
+      {
+        struct crypto_encode_decode_data *result = ddsrt_malloc (sizeof (*result));
+        memcpy (result, data, sizeof (*result));
+        ddsrt_mutex_unlock (&impl->encode_decode_log_lock);
+        return result;
+      }
+      elem = elem->next;
+      if (elem == elem0)
+        break;
+    }
+  }
+  ddsrt_mutex_unlock (&impl->encode_decode_log_lock);
+  return NULL;
+}
+
 static unsigned char * find_buffer_match(const unsigned char *input, size_t input_len, const unsigned char *match, size_t match_len)
 {
   if (match_len <= input_len && match_len > 0 && input_len > 0)
@@ -705,6 +772,8 @@ static DDS_Security_boolean encode_datawriter_submessage(
   switch (impl->parent->mode)
   {
     case PLUGIN_MODE_WRAPPED:
+      log_encode_decode (impl->parent, ENCODE_DATAWRITER_SUBMESSAGE, sending_datawriter_crypto);
+      /* fall-through */
     case PLUGIN_MODE_TOKEN_LOG:
       if (!impl->instance->encode_datawriter_submessage (impl->instance, encoded_rtps_submessage,
         plain_rtps_submessage, check_handle (sending_datawriter_crypto), receiving_datareader_crypto_list, receiving_datareader_crypto_list_index, ex))
@@ -753,6 +822,8 @@ static DDS_Security_boolean encode_datareader_submessage(
   switch (impl->parent->mode)
   {
     case PLUGIN_MODE_WRAPPED:
+      log_encode_decode (impl->parent, ENCODE_DATAREADER_SUBMESSAGE, sending_datareader_crypto);
+      /* fall-through */
     case PLUGIN_MODE_TOKEN_LOG:
       if (!impl->instance->encode_datareader_submessage (impl->instance, encoded_rtps_submessage,
         plain_rtps_submessage, check_handle (sending_datareader_crypto), receiving_datawriter_crypto_list, ex))
@@ -850,6 +921,8 @@ static DDS_Security_boolean decode_datawriter_submessage(
   switch (impl->parent->mode)
   {
     case PLUGIN_MODE_WRAPPED:
+      log_encode_decode (impl->parent, DECODE_DATAWRITER_SUBMESSAGE, receiving_datareader_crypto);
+      /* fall-through */
     case PLUGIN_MODE_TOKEN_LOG:
       return impl->instance->decode_datawriter_submessage (impl->instance, plain_rtps_submessage,
           encoded_rtps_submessage, check_handle (receiving_datareader_crypto), check_handle (sending_datawriter_crypto), ex);
@@ -870,6 +943,8 @@ static DDS_Security_boolean decode_datareader_submessage(
   switch (impl->parent->mode)
   {
     case PLUGIN_MODE_WRAPPED:
+      log_encode_decode (impl->parent, DECODE_DATAREADER_SUBMESSAGE, receiving_datawriter_crypto);
+      /* fall-through */
     case PLUGIN_MODE_TOKEN_LOG:
       return impl->instance->decode_datareader_submessage (impl->instance, plain_rtps_submessage,
           encoded_rtps_submessage, check_handle (receiving_datawriter_crypto), check_handle (sending_datareader_crypto), ex);
@@ -1006,6 +1081,8 @@ int init_test_cryptography_wrapped(const char *argument, void **context, struct
   if (!impl)
     return DDS_SECURITY_FAILED;
   impl->mode = PLUGIN_MODE_WRAPPED;
+  ddsrt_mutex_init (&impl->encode_decode_log_lock);
+  ddsrt_circlist_init (&impl->encode_decode_log);
   *context = impl;
   return DDS_SECURITY_SUCCESS;
 }
@@ -1014,6 +1091,15 @@ int finalize_test_cryptography_wrapped(void *context)
 {
   struct dds_security_cryptography_impl* impl = (struct dds_security_cryptography_impl*) context;
   assert(impl->mode == PLUGIN_MODE_WRAPPED);
+  ddsrt_mutex_lock (&impl->encode_decode_log_lock);
+  while (!ddsrt_circlist_isempty (&impl->encode_decode_log))
+  {
+    struct ddsrt_circlist_elem *list_elem = ddsrt_circlist_oldest (&impl->encode_decode_log);
+    ddsrt_circlist_remove (&impl->encode_decode_log, list_elem);
+    ddsrt_free (list_elem);
+  }
+  ddsrt_mutex_unlock (&impl->encode_decode_log_lock);
+  ddsrt_mutex_destroy (&impl->encode_decode_log_lock);
   return finalize_test_cryptography_common(impl, true);
 }
 
@@ -1043,12 +1129,12 @@ int32_t finalize_test_cryptography_store_tokens(void *context)
   while (!ddsrt_circlist_isempty (&impl->token_data_list))
   {
     struct ddsrt_circlist_elem *list_elem = ddsrt_circlist_oldest (&impl->token_data_list);
-    struct crypto_token_data *token_data = DDSRT_FROM_CIRCLIST (struct crypto_token_data, e, list_elem);
     ddsrt_circlist_remove (&impl->token_data_list, list_elem);
-    ddsrt_free (token_data);
+    ddsrt_free (list_elem);
   }
   ddsrt_mutex_unlock (&impl->token_data_lock);
   ddsrt_mutex_destroy (&impl->token_data_lock);
+
   /* don't detroy g_print_token_lock as this will result in multiple
      calls to mutex_destroy for this lock in case of multiple domains */
 
diff --git a/src/security/core/tests/common/cryptography_wrapper.h b/src/security/core/tests/common/cryptography_wrapper.h
index b9384c9..d802247 100644
--- a/src/security/core/tests/common/cryptography_wrapper.h
+++ b/src/security/core/tests/common/cryptography_wrapper.h
@@ -43,6 +43,20 @@ struct crypto_token_data {
   size_t data_len[CRYPTO_TOKEN_MAXLEN];
 };
 
+enum crypto_encode_decode_fn {
+  ENCODE_DATAWRITER_SUBMESSAGE,
+  ENCODE_DATAREADER_SUBMESSAGE,
+  DECODE_DATAWRITER_SUBMESSAGE,
+  DECODE_DATAREADER_SUBMESSAGE
+};
+
+struct crypto_encode_decode_data {
+  struct ddsrt_circlist_elem e;
+  enum crypto_encode_decode_fn function;
+  DDS_Security_long_long handle;
+  uint32_t count;
+};
+
 SECURITY_EXPORT void set_protection_kinds(
   struct dds_security_cryptography_impl * impl,
   DDS_Security_ProtectionKind rtps_protection_kind,
@@ -61,6 +75,7 @@ SECURITY_EXPORT void set_entity_data_secret(struct dds_security_cryptography_imp
 SECURITY_EXPORT const char *get_crypto_token_type_str (enum crypto_tokens_type type);
 SECURITY_EXPORT struct ddsrt_circlist * get_crypto_tokens (struct dds_security_cryptography_impl * impl);
 SECURITY_EXPORT struct crypto_token_data * find_crypto_token (struct dds_security_cryptography_impl * impl, enum crypto_tokens_type type, unsigned char * data, size_t data_len);
+SECURITY_EXPORT struct crypto_encode_decode_data * get_encode_decode_log (struct dds_security_cryptography_impl * impl, enum crypto_encode_decode_fn function, DDS_Security_long_long handle);
 
 /* Init in all-ok mode: all functions return success without calling the actual plugin */
 SECURITY_EXPORT int init_test_cryptography_all_ok(const char *argument, void **context, struct ddsi_domaingv *gv);
diff --git a/src/security/core/tests/common/security_config_test_utils.c b/src/security/core/tests/common/security_config_test_utils.c
index d66ff2d..74f3e5e 100644
--- a/src/security/core/tests/common/security_config_test_utils.c
+++ b/src/security/core/tests/common/security_config_test_utils.c
@@ -29,6 +29,17 @@
 #include "common/config_env.h"
 #include "security_config_test_utils.h"
 
+static const char *topic_rule =
+    "        <topic_rule>"
+    "          <topic_expression>${TOPIC_EXPRESSION}</topic_expression>"
+    "          <enable_discovery_protection>${ENABLE_DISC_PROTECTION}</enable_discovery_protection>"
+    "          <enable_liveliness_protection>${ENABLE_LIVELINESS_PROTECTION}</enable_liveliness_protection>"
+    "          <enable_read_access_control>${ENABLE_READ_AC}</enable_read_access_control>"
+    "          <enable_write_access_control>${ENABLE_WRITE_AC}</enable_write_access_control>"
+    "          <metadata_protection_kind>${METADATA_PROTECTION_KIND}</metadata_protection_kind>"
+    "          <data_protection_kind>${DATA_PROTECTION_KIND}</data_protection_kind>"
+    "        </topic_rule>";
+
 static const char *governance_xml =
     "<?xml version=\"1.0\" encoding=\"utf-8\"?>"
     "<dds xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" xsi:noNamespaceSchemaLocation=\"https://www.omg.org/spec/DDS-SECURITY/20170901/omg_shared_ca_governance.xsd\">"
@@ -46,15 +57,7 @@ static const char *governance_xml =
     "      <liveliness_protection_kind>${LIVELINESS_PROTECTION_KIND:-NONE}</liveliness_protection_kind>"
     "      <rtps_protection_kind>${RTPS_PROTECTION_KIND:-NONE}</rtps_protection_kind>"
     "      <topic_access_rules>"
-    "        <topic_rule>"
-    "          <topic_expression>*</topic_expression>"
-    "          <enable_discovery_protection>${ENABLE_DISC_PROTECTION:-false}</enable_discovery_protection>"
-    "          <enable_liveliness_protection>${ENABLE_LIVELINESS_PROTECTION:-false}</enable_liveliness_protection>"
-    "          <enable_read_access_control>${ENABLE_READ_AC:-true}</enable_read_access_control>"
-    "          <enable_write_access_control>${ENABLE_WRITE_AC:-true}</enable_write_access_control>"
-    "          <metadata_protection_kind>${METADATA_PROTECTION_KIND:-NONE}</metadata_protection_kind>"
-    "          <data_protection_kind>${DATA_PROTECTION_KIND:-NONE}</data_protection_kind>"
-    "        </topic_rule>"
+    "        ${TOPIC_RULES}"
     "      </topic_access_rules>"
     "    </domain_rule>"
     "  </domain_access_rules>"
@@ -207,11 +210,48 @@ static char * prefix_data (char * config_signed, bool add_prefix)
   return config_signed;
 }
 
-char * get_governance_config(struct kvp *config_vars, bool add_prefix)
+static void print_config_vars(struct kvp *vars)
 {
-  char * config = ddsrt_expand_vars (governance_xml, &expand_lookup_vars, config_vars);
+  for (uint32_t i = 0; vars[i].key != NULL; i++)
+    printf("%s=%s; ", vars[i].key, vars[i].value);
+}
+
+char * get_governance_topic_rule(const char * topic_expr, bool discovery_protection, bool liveliness_protection,
+    bool read_ac, bool write_ac, const char * metadata_protection_kind, const char * data_protection_kind)
+{
+  struct kvp vars[] = {
+    { "TOPIC_EXPRESSION", topic_expr != NULL ? topic_expr : "*", 1 },
+    { "ENABLE_DISC_PROTECTION", discovery_protection ? "true" : "false", 1 },
+    { "ENABLE_LIVELINESS_PROTECTION", liveliness_protection ? "true" : "false", 1 },
+    { "ENABLE_READ_AC", read_ac ? "true" : "false", 1 },
+    { "ENABLE_WRITE_AC", write_ac ? "true" : "false", 1 },
+    { "METADATA_PROTECTION_KIND", metadata_protection_kind != NULL ? metadata_protection_kind : "NONE", 1 },
+    { "DATA_PROTECTION_KIND", data_protection_kind != NULL ? data_protection_kind : "NONE", 1 },
+    { NULL, NULL, 0 }
+  };
+  return ddsrt_expand_vars (topic_rule, &expand_lookup_vars, vars);
+}
+
+char * get_governance_config(bool allow_unauth_pp, bool enable_join_ac, const char * discovery_protection_kind, const char * liveliness_protection_kind,
+    const char * rtps_protection_kind, const char * topic_rules, bool add_prefix)
+{
+  struct kvp vars[] = {
+    { "ALLOW_UNAUTH_PP", allow_unauth_pp ? "true" : "false", 1 },
+    { "ENABLE_JOIN_AC", enable_join_ac ? "true" : "false", 1 },
+    { "DISCOVERY_PROTECTION_KIND", discovery_protection_kind != NULL ? discovery_protection_kind : "NONE", 1 },
+    { "LIVELINESS_PROTECTION_KIND", liveliness_protection_kind != NULL ? liveliness_protection_kind : "NONE", 1 },
+    { "RTPS_PROTECTION_KIND", rtps_protection_kind != NULL ? rtps_protection_kind : "NONE", 1 },
+    { "TOPIC_RULES", topic_rules != NULL ? topic_rules : get_governance_topic_rule (NULL, false, false, false, false, NULL, NULL), 1 },
+    { NULL, NULL, 0 }
+  };
+  char * config = ddsrt_expand_vars (governance_xml, &expand_lookup_vars, vars);
   char * config_signed = get_signed_data (config);
   ddsrt_free (config);
+
+  printf("Governance configuration: ");
+  print_config_vars(vars);
+  printf("\n");
+
   return prefix_data (config_signed, add_prefix);
 }
 
diff --git a/src/security/core/tests/common/security_config_test_utils.h b/src/security/core/tests/common/security_config_test_utils.h
index 3cf20de..770c979 100644
--- a/src/security/core/tests/common/security_config_test_utils.h
+++ b/src/security/core/tests/common/security_config_test_utils.h
@@ -25,7 +25,11 @@ const char * expand_lookup_vars (const char *name, void * data);
 const char * expand_lookup_vars_env (const char *name, void * data);
 int32_t expand_lookup_unmatched (const struct kvp * lookup_table);
 
-char * get_governance_config (struct kvp *config_vars, bool add_prefix);
+char * get_governance_topic_rule(const char * topic_expr, bool discovery_protection, bool liveliness_protection,
+    bool read_ac, bool write_ac, const char * metadata_protection_kind, const char * data_protection_kind);
+char * get_governance_config(bool allow_unauth_pp, bool enable_join_ac, const char * discovery_protection_kind, const char * liveliness_protection_kind,
+    const char * rtps_protection_kind, const char * topic_rules, bool add_prefix);
+
 char * get_permissions_topic(const char * name);
 char * get_permissions_grant(const char * name, const char * subject, const char * domain_id,
     dds_time_t not_before, dds_time_t not_after, const char * pub_topics, const char * sub_topics, const char * default_policy);
diff --git a/src/security/core/tests/common/test_utils.c b/src/security/core/tests/common/test_utils.c
index 3f94a85..99a4eaf 100644
--- a/src/security/core/tests/common/test_utils.c
+++ b/src/security/core/tests/common/test_utils.c
@@ -38,6 +38,12 @@ int numRemote = 0;
 struct Handshake handshakeList[MAX_HANDSHAKES];
 int numHandshake = 0;
 
+const char * g_pk_none = "NONE";
+const char * g_pk_sign = "SIGN";
+const char * g_pk_encrypt = "ENCRYPT";
+const char * g_pk_sign_oa = "SIGN_WITH_ORIGIN_AUTHENTICATION";
+const char * g_pk_encrypt_oa = "ENCRYPT_WITH_ORIGIN_AUTHENTICATION";
+
 static char * get_validation_result_str (DDS_Security_ValidationResult_t result)
 {
   switch (result)
@@ -471,3 +477,29 @@ struct dds_security_cryptography_impl * get_crypto_context(dds_entity_t particip
   dds_entity_unlock (pp_entity);
   return context;
 }
+
+const char * pk_to_str(DDS_Security_ProtectionKind pk)
+{
+  switch (pk)
+  {
+    case DDS_SECURITY_PROTECTION_KIND_NONE: return g_pk_none;
+    case DDS_SECURITY_PROTECTION_KIND_SIGN: return g_pk_sign;
+    case DDS_SECURITY_PROTECTION_KIND_ENCRYPT: return g_pk_encrypt;
+    case DDS_SECURITY_PROTECTION_KIND_SIGN_WITH_ORIGIN_AUTHENTICATION: return g_pk_sign_oa;
+    case DDS_SECURITY_PROTECTION_KIND_ENCRYPT_WITH_ORIGIN_AUTHENTICATION: return g_pk_encrypt_oa;
+  }
+  assert (false);
+  return NULL;
+}
+
+const char * bpk_to_str(DDS_Security_BasicProtectionKind bpk)
+{
+  switch (bpk)
+  {
+    case DDS_SECURITY_BASICPROTECTION_KIND_NONE: return g_pk_none;
+    case DDS_SECURITY_BASICPROTECTION_KIND_SIGN: return g_pk_sign;
+    case DDS_SECURITY_BASICPROTECTION_KIND_ENCRYPT: return g_pk_encrypt;
+  }
+  assert (false);
+  return NULL;
+}
diff --git a/src/security/core/tests/common/test_utils.h b/src/security/core/tests/common/test_utils.h
index 919affe..5fb9ccb 100644
--- a/src/security/core/tests/common/test_utils.h
+++ b/src/security/core/tests/common/test_utils.h
@@ -17,6 +17,15 @@
 
 #include "dds/security/dds_security_api.h"
 
+#define PK_N DDS_SECURITY_PROTECTION_KIND_NONE
+#define PK_S DDS_SECURITY_PROTECTION_KIND_SIGN
+#define PK_SOA DDS_SECURITY_PROTECTION_KIND_SIGN_WITH_ORIGIN_AUTHENTICATION
+#define PK_E DDS_SECURITY_PROTECTION_KIND_ENCRYPT
+#define PK_EOA DDS_SECURITY_PROTECTION_KIND_ENCRYPT_WITH_ORIGIN_AUTHENTICATION
+#define BPK_N DDS_SECURITY_BASICPROTECTION_KIND_NONE
+#define BPK_S DDS_SECURITY_BASICPROTECTION_KIND_SIGN
+#define BPK_E DDS_SECURITY_BASICPROTECTION_KIND_ENCRYPT
+
 #define MAX_LOCAL_IDENTITIES 8
 #define MAX_REMOTE_IDENTITIES 8
 #define MAX_HANDSHAKES 32
@@ -70,5 +79,7 @@ void rd_wr_init_fail(
     bool exp_subtp_fail, bool exp_rd_fail);
 void write_read_for(dds_entity_t wr, dds_entity_t pp_rd, dds_entity_t rd, dds_duration_t dur, bool exp_write_fail, bool exp_read_fail);
 struct dds_security_cryptography_impl * get_crypto_context(dds_entity_t participant);
+const char * pk_to_str(DDS_Security_ProtectionKind pk);
+const char * bpk_to_str(DDS_Security_BasicProtectionKind bpk);
 
 #endif /* SECURITY_CORE_TEST_UTILS_H_ */
diff --git a/src/security/core/tests/secure_communication.c b/src/security/core/tests/secure_communication.c
index 186944c..fb7386f 100644
--- a/src/security/core/tests/secure_communication.c
+++ b/src/security/core/tests/secure_communication.c
@@ -37,15 +37,6 @@
 
 #include "SecurityCoreTests.h"
 
-#define PK_N DDS_SECURITY_PROTECTION_KIND_NONE
-#define PK_S DDS_SECURITY_PROTECTION_KIND_SIGN
-#define PK_SOA DDS_SECURITY_PROTECTION_KIND_SIGN_WITH_ORIGIN_AUTHENTICATION
-#define PK_E DDS_SECURITY_PROTECTION_KIND_ENCRYPT
-#define PK_EOA DDS_SECURITY_PROTECTION_KIND_ENCRYPT_WITH_ORIGIN_AUTHENTICATION
-#define BPK_N DDS_SECURITY_BASICPROTECTION_KIND_NONE
-#define BPK_S DDS_SECURITY_BASICPROTECTION_KIND_SIGN
-#define BPK_E DDS_SECURITY_BASICPROTECTION_KIND_ENCRYPT
-
 static const char *config =
     "${CYCLONEDDS_URI}${CYCLONEDDS_URI:+,}"
     "<Domain id=\"any\">"
@@ -80,16 +71,6 @@ static const char *config =
 #define MAX_DOMAINS 10
 #define MAX_PARTICIPANTS 10
 
-const char * g_pk_none = "NONE";
-const char * g_pk_sign = "SIGN";
-const char * g_pk_encrypt = "ENCRYPT";
-const char * g_pk_sign_oa = "SIGN_WITH_ORIGIN_AUTHENTICATION";
-const char * g_pk_encrypt_oa = "ENCRYPT_WITH_ORIGIN_AUTHENTICATION";
-
-const char * g_pp_secret = "ppsecret";
-const char * g_groupdata_secret = "groupsecret";
-const char * g_ep_secret = "epsecret";
-
 uint32_t g_topic_nr = 0;
 
 static dds_entity_t g_pub_domains[MAX_DOMAINS];
@@ -116,37 +97,9 @@ typedef void (*set_crypto_params_fn)(struct dds_security_cryptography_impl *, co
 typedef dds_entity_t (*pubsub_create_fn)(dds_entity_t, const dds_qos_t *qos, const dds_listener_t *listener);
 typedef dds_entity_t (*ep_create_fn)(dds_entity_t, dds_entity_t, const dds_qos_t *qos, const dds_listener_t *listener);
 
-static const char * pk_to_str(DDS_Security_ProtectionKind pk)
-{
-  switch (pk)
-  {
-    case DDS_SECURITY_PROTECTION_KIND_NONE: return g_pk_none;
-    case DDS_SECURITY_PROTECTION_KIND_SIGN: return g_pk_sign;
-    case DDS_SECURITY_PROTECTION_KIND_ENCRYPT: return g_pk_encrypt;
-    case DDS_SECURITY_PROTECTION_KIND_SIGN_WITH_ORIGIN_AUTHENTICATION: return g_pk_sign_oa;
-    case DDS_SECURITY_PROTECTION_KIND_ENCRYPT_WITH_ORIGIN_AUTHENTICATION: return g_pk_encrypt_oa;
-  }
-  assert (false);
-  return NULL;
-}
-
-static const char * bpk_to_str(DDS_Security_BasicProtectionKind bpk)
-{
-  switch (bpk)
-  {
-    case DDS_SECURITY_BASICPROTECTION_KIND_NONE: return g_pk_none;
-    case DDS_SECURITY_BASICPROTECTION_KIND_SIGN: return g_pk_sign;
-    case DDS_SECURITY_BASICPROTECTION_KIND_ENCRYPT: return g_pk_encrypt;
-  }
-  assert (false);
-  return NULL;
-}
-
-static void print_config_vars(struct kvp *vars)
-{
-  for (uint32_t i = 0; vars[i].key != NULL; i++)
-    printf("%s=%s; ", vars[i].key, vars[i].value);
-}
+const char * g_pp_secret = "ppsecret";
+const char * g_groupdata_secret = "groupsecret";
+const char * g_ep_secret = "epsecret";
 
 static dds_qos_t *get_qos()
 {
@@ -201,20 +154,9 @@ static void test_init(const struct domain_sec_config * domain_config, size_t n_s
   assert (n_pub_domains < MAX_DOMAINS);
   assert (n_pub_participants < MAX_PARTICIPANTS);
 
-  struct kvp governance_vars[] = {
-    { "DISCOVERY_PROTECTION_KIND", pk_to_str (domain_config->discovery_pk), 1 },
-    { "LIVELINESS_PROTECTION_KIND", pk_to_str (domain_config->liveliness_pk), 1 },
-    { "RTPS_PROTECTION_KIND", pk_to_str (domain_config->rtps_pk), 1 },
-    { "METADATA_PROTECTION_KIND", pk_to_str (domain_config->metadata_pk), 1 },
-    { "DATA_PROTECTION_KIND", bpk_to_str (domain_config->payload_pk), 1 },
-    { NULL, NULL, 0 }
-  };
-
-  printf("Governance configuration: ");
-  print_config_vars(governance_vars);
-  printf("\n");
-
-  char * gov_config_signed = get_governance_config (governance_vars, false);
+  char * gov_topic_rule = get_governance_topic_rule ("*", false, false, true, true, pk_to_str (domain_config->metadata_pk), bpk_to_str (domain_config->payload_pk));
+  char * gov_config_signed = get_governance_config (false, false, pk_to_str (domain_config->discovery_pk), pk_to_str (domain_config->liveliness_pk),
+    pk_to_str (domain_config->rtps_pk), gov_topic_rule, false);
 
   struct kvp config_vars[] = {
     { "GOVERNANCE_DATA", gov_config_signed, 1 },
@@ -232,6 +174,7 @@ static void test_init(const struct domain_sec_config * domain_config, size_t n_s
   dds_free (conf_sub);
 
   dds_free (gov_config_signed);
+  dds_free (gov_topic_rule);
 }
 
 static void test_fini(size_t n_sub_domain, size_t n_pub_domain)

From 231d8200520437f39d31b6b941aea59029d0d8ea Mon Sep 17 00:00:00 2001
From: Dennis Potman <dennis.potman@adlinktech.com>
Date: Tue, 28 Apr 2020 13:24:10 +0200
Subject: [PATCH 183/238] Add security encoding-mismatch test

A test that checks that the security handshake fails in case of non-matching
encoding settings in the governance xml. All combinations of values for
rtps, discovery and liveliness protection are checked. For meta-data and
payload encoding, this test checks that a reader and writer do not connect
in case of non-matching values.

Signed-off-by: Dennis Potman <dennis.potman@adlinktech.com>
---
 src/security/core/tests/access_control.c      | 166 ++++++++++++------
 src/security/core/tests/authentication.c      |  55 +-----
 src/security/core/tests/common/test_utils.c   |  85 ++++++---
 src/security/core/tests/common/test_utils.h   |  27 +--
 src/security/core/tests/handshake.c           |  22 ++-
 .../core/tests/secure_communication.c         |   4 +-
 6 files changed, 217 insertions(+), 142 deletions(-)

diff --git a/src/security/core/tests/access_control.c b/src/security/core/tests/access_control.c
index 23c32f3..3a388c1 100644
--- a/src/security/core/tests/access_control.c
+++ b/src/security/core/tests/access_control.c
@@ -113,10 +113,15 @@ static void access_control_init(
   }
 }
 
-static void access_control_fini(size_t n)
+static void access_control_fini(size_t n, void * res[], size_t nres)
 {
   for (size_t i = 0; i < n; i++)
     CU_ASSERT_EQUAL_FATAL (dds_delete (g_domain[i]), DDS_RETCODE_OK);
+  if (res != NULL)
+  {
+    for (size_t i = 0; i < nres; i++)
+      ddsrt_free (res[i]);
+  }
 }
 
 static DDS_Security_DatawriterCryptoHandle get_builtin_writer_crypto_handle(dds_entity_t participant, unsigned entityid)
@@ -203,7 +208,7 @@ CU_Theory((const char * test_descr, const char * gov, const char * perm, const c
       (bool []) { has_gov, has_gov }, (const char *[]) { gov, gov },
       (bool []) { has_perm, has_perm }, (const char *[]) { perm, perm },
       (bool []) { has_ca, has_ca }, (const char *[]) { ca, ca });
-  access_control_fini (2);
+  access_control_fini (2, NULL, 0);
 }
 
 #define S(n) (n)
@@ -276,21 +281,11 @@ CU_Theory(
     dds_entity_t pub, sub;
     dds_entity_t topic0, topic1;
     rd_wr_init (g_participant[0], &pub, &topic0, &wr, g_participant[1], &sub, &topic1, &rd, topic_name);
-    sync_writer_to_readers(g_participant[0], wr, 1);
+    sync_writer_to_readers(g_participant[0], wr, 1, DDS_SECS(2));
     write_read_for (wr, g_participant[1], rd, DDS_MSECS (write_read_dur), false, exp_read_fail);
   }
 
-  access_control_fini (2);
-
-  ddsrt_free (perm_topic);
-  ddsrt_free (grants[0]);
-  ddsrt_free (grants[1]);
-  ddsrt_free (perm_config);
-  ddsrt_free (ca);
-  ddsrt_free (id1_subj);
-  ddsrt_free (id2_subj);
-  ddsrt_free (id1);
-  ddsrt_free (id2);
+  access_control_fini (2, (void * []) { perm_topic, grants[0], grants[1], perm_config, ca, id1_subj, id2_subj, id1, id2 }, 9);
 }
 
 
@@ -369,7 +364,7 @@ CU_Test(ddssec_access_control, permissions_expiry_multiple, .timeout=20)
     wr[i] = dds_create_writer (pub, pub_tp, qos, NULL);
     CU_ASSERT_FATAL (wr[i] > 0);
     dds_set_status_mask (wr[i], DDS_PUBLICATION_MATCHED_STATUS);
-    sync_writer_to_readers (g_participant[i + N_RD], wr[i], N_RD);
+    sync_writer_to_readers (g_participant[i + N_RD], wr[i], N_RD, DDS_SECS(2));
   }
   dds_delete_qos (qos);
 
@@ -423,7 +418,7 @@ CU_Test(ddssec_access_control, permissions_expiry_multiple, .timeout=20)
     CU_ASSERT (n_invalid <= run);
   }
 
-  access_control_fini (N_NODES);
+  access_control_fini (N_NODES, NULL, 0);
 
   for (int i = 0; i < N_NODES; i++)
   {
@@ -497,7 +492,7 @@ CU_Theory(
       g_participant[1], &rsub, &rtopic[0], &rrd,
       topic_name, exp_local_topic_fail, exp_wr_fail, exp_remote_topic_fail, false);
     if (!exp_local_topic_fail && !exp_remote_topic_fail && !exp_wr_fail)
-      sync_writer_to_readers (g_participant[0], lwr, exp_wr_rd_sync_fail ? 0 : 1);
+      sync_writer_to_readers (g_participant[0], lwr, exp_wr_rd_sync_fail ? 0 : 1, DDS_SECS(2));
 
     // Local reader, remote writer
     create_topic_name (AC_WRAPPER_TOPIC_PREFIX, g_topic_nr++, topic_name, sizeof (topic_name));
@@ -506,10 +501,10 @@ CU_Theory(
       g_participant[0], &lsub, &ltopic[1], &lrd,
       topic_name, exp_remote_topic_fail, false, exp_local_topic_fail, exp_rd_fail);
     if (!exp_local_topic_fail && !exp_remote_topic_fail && !exp_rd_fail)
-      sync_reader_to_writers (g_participant[0], lrd, exp_rd_wr_sync_fail ? 0 : 1);
+      sync_reader_to_writers (g_participant[0], lrd, exp_rd_wr_sync_fail ? 0 : 1, DDS_SECS(2));
   }
 
-  access_control_fini (2);
+  access_control_fini (2, NULL, 0);
 }
 
 #define na false
@@ -568,26 +563,12 @@ CU_Theory(
       (bool []) { true, true }, (const char *[]) { def_perm_ca, def_perm_ca });
 
   if (!exp_pp1_fail && !exp_pp2_fail)
-    validate_handshake (DDS_DOMAINID, exp_hs_fail, NULL, NULL, NULL);
+    validate_handshake (DDS_DOMAINID, exp_hs_fail, NULL, NULL, NULL, DDS_SECS(2));
 
-  access_control_fini (2);
-
-  ddsrt_free (gov_config_pp1);
-  ddsrt_free (gov_config_pp2);
-  ddsrt_free (gov_topic_rule);
-  ddsrt_free (perm_topic);
-  ddsrt_free (grants[0]);
-  ddsrt_free (grants[1]);
-  ddsrt_free (perm_config);
-  ddsrt_free (ca);
-  ddsrt_free (id1_subj);
-  ddsrt_free (id2_subj);
-  ddsrt_free (id1);
-  ddsrt_free (id2);
+  access_control_fini (2, (void * []) { gov_config_pp1, gov_config_pp2, gov_topic_rule, perm_topic, grants[0], grants[1], perm_config, ca, id1_subj, id2_subj, id1, id2 }, 12);
 }
 
 #define na false
-#define E ENCRYPT
 CU_TheoryDataPoints(ddssec_access_control, discovery_protection) = {
     CU_DataPoints(const char *,
     /*                                        */"disabled",
@@ -647,11 +628,11 @@ CU_Theory(
       (bool []) { true, true }, (const char *[]) { gov_config1, gov_config2 },
       (bool []) { true, true }, (const char *[]) { perm_config, perm_config },
       (bool []) { true, true }, (const char *[]) { def_perm_ca, def_perm_ca });
-  validate_handshake (DDS_DOMAINID, false, NULL, NULL, NULL);
+  validate_handshake (DDS_DOMAINID, false, NULL, NULL, NULL, DDS_SECS(2));
 
   dds_entity_t pub, sub, pub_tp, sub_tp, wr, rd;
   rd_wr_init (g_participant[0], &pub, &pub_tp, &wr, g_participant[1], &sub, &sub_tp, &rd, topic_name);
-  sync_writer_to_readers (g_participant[0], wr, exp_rd_wr_match_fail ? 0 : 1);
+  sync_writer_to_readers (g_participant[0], wr, exp_rd_wr_match_fail ? 0 : 1, DDS_SECS(2));
   if (!exp_rd_wr_match_fail)
     write_read_for (wr, g_participant[1], rd, DDS_MSECS (100), false, false);
 
@@ -671,19 +652,100 @@ CU_Theory(
     ddsrt_free (log);
   }
 
-  access_control_fini (2);
-
-  ddsrt_free (gov_config1);
-  ddsrt_free (gov_config2);
-  ddsrt_free (gov_topic_rule1);
-  ddsrt_free (gov_topic_rule2);
-  ddsrt_free (perm_topic);
-  ddsrt_free (grants[0]);
-  ddsrt_free (grants[1]);
-  ddsrt_free (perm_config);
-  ddsrt_free (ca);
-  ddsrt_free (id1_subj);
-  ddsrt_free (id2_subj);
-  ddsrt_free (id1);
-  ddsrt_free (id2);
+  access_control_fini (2, (void * []) { gov_config1, gov_config2, gov_topic_rule1, gov_topic_rule2, perm_topic, grants[0], grants[1], perm_config, ca, id1_subj, id2_subj, id1, id2 }, 13);
+}
+
+static void test_encoding_mismatch(
+    bool exp_hs_fail, bool exp_rd_wr_fail,
+    DDS_Security_ProtectionKind rtps_pk1, DDS_Security_ProtectionKind rtps_pk2,
+    DDS_Security_ProtectionKind discovery_pk1, DDS_Security_ProtectionKind discovery_pk2,
+    DDS_Security_ProtectionKind liveliness_pk1, DDS_Security_ProtectionKind liveliness_pk2,
+    DDS_Security_ProtectionKind metadata_pk1, DDS_Security_ProtectionKind metadata_pk2,
+    DDS_Security_BasicProtectionKind payload_pk1, DDS_Security_BasicProtectionKind payload_pk2)
+{
+  char topic_name[100];
+  create_topic_name ("ddssec_access_control_", g_topic_nr++, topic_name, sizeof (topic_name));
+
+  /* create ca and id1/id2 certs that will not expire during this test */
+  char *ca, *id1, *id2, *id1_subj, *id2_subj;
+  ca = generate_ca ("ca1", TEST_IDENTITY_CA1_PRIVATE_KEY, 0, 3600);
+  id1 = generate_identity (ca, TEST_IDENTITY_CA1_PRIVATE_KEY, "id1", TEST_IDENTITY1_PRIVATE_KEY, 0, 3600, &id1_subj);
+  id2 = generate_identity (ca, TEST_IDENTITY_CA1_PRIVATE_KEY, "id2", TEST_IDENTITY1_PRIVATE_KEY, 0, 3600, &id2_subj);
+
+  /* localtime will be converted to gmtime in get_permissions_grant */
+  dds_time_t now = dds_time ();
+  char * perm_topic = get_permissions_topic (topic_name);
+  char * grants[] = {
+    get_permissions_grant ("id1", id1_subj, NULL, now, now + DDS_SECS(3600), perm_topic, perm_topic, NULL),
+    get_permissions_grant ("id2", id2_subj, NULL, now, now + DDS_SECS(3600), perm_topic, perm_topic, NULL) };
+  char * perm_config = get_permissions_config (grants, 2, true);
+
+  char * gov_topic_rule1 = get_governance_topic_rule (topic_name, true, true, true, true, pk_to_str (metadata_pk1), bpk_to_str (payload_pk1));
+  char * gov_topic_rule2 = get_governance_topic_rule (topic_name, true, true, true, true, pk_to_str (metadata_pk2), bpk_to_str (payload_pk2));
+  char * gov_config1 = get_governance_config (false, true, pk_to_str (discovery_pk1), pk_to_str (liveliness_pk1), pk_to_str (rtps_pk1), gov_topic_rule1, true);
+  char * gov_config2 = get_governance_config (false, true, pk_to_str (discovery_pk2), pk_to_str (liveliness_pk2), pk_to_str (rtps_pk2), gov_topic_rule2, true);
+  const char * def_perm_ca = PF_F COMMON_ETC_PATH("default_permissions_ca.pem");
+
+  access_control_init (
+      2,
+      (const char *[]) { id1, id2 },
+      (const char *[]) { TEST_IDENTITY1_PRIVATE_KEY, TEST_IDENTITY1_PRIVATE_KEY },
+      (const char *[]) { ca, ca },
+      (bool []) { false, false }, NULL, NULL,
+      (bool []) { true, true }, (const char *[]) { gov_config1, gov_config2 },
+      (bool []) { true, true }, (const char *[]) { perm_config, perm_config },
+      (bool []) { true, true }, (const char *[]) { def_perm_ca, def_perm_ca });
+
+  struct Handshake *hs_list;
+  int nhs;
+  validate_handshake (DDS_DOMAINID, false, NULL, &hs_list, &nhs, DDS_MSECS(500));
+  CU_ASSERT_EQUAL_FATAL (exp_hs_fail, nhs < 1);
+  handshake_list_fini (hs_list, nhs);
+
+  if (!exp_hs_fail)
+  {
+    dds_entity_t pub, sub, pub_tp, sub_tp, wr, rd;
+    rd_wr_init (g_participant[0], &pub, &pub_tp, &wr, g_participant[1], &sub, &sub_tp, &rd, topic_name);
+    sync_writer_to_readers (g_participant[0], wr, exp_rd_wr_fail ? 0 : 1, DDS_SECS(1));
+  }
+
+  access_control_fini (2, (void * []) { gov_config1, gov_config2, gov_topic_rule1, gov_topic_rule2, perm_topic, grants[0], grants[1], perm_config, ca, id1_subj, id2_subj, id1, id2 }, 13);
+}
+
+static DDS_Security_ProtectionKind pk[] = { PK_N, PK_S, PK_E, PK_SOA, PK_EOA };
+static DDS_Security_BasicProtectionKind bpk[] = { BPK_N, BPK_S, BPK_E };
+
+CU_Test(ddssec_access_control, encoding_mismatch_rtps, .timeout=30)
+{
+  for (size_t pk1 = 0; pk1 < sizeof (pk) / sizeof (pk[0]); pk1++)
+    for (size_t pk2 = pk1 + 1; pk2 < sizeof (pk) / sizeof (pk[0]); pk2++)
+      test_encoding_mismatch (pk1 != pk2, false, pk[pk1], pk[pk2], PK_N, PK_N, PK_N, PK_N, PK_N, PK_N, BPK_N, BPK_N);
+}
+
+CU_Test(ddssec_access_control, encoding_mismatch_discovery, .timeout=30)
+{
+  for (size_t pk1 = 0; pk1 < sizeof (pk) / sizeof (pk[0]); pk1++)
+    for (size_t pk2 = pk1 + 1; pk2 < sizeof (pk) / sizeof (pk[0]); pk2++)
+      test_encoding_mismatch (pk1 != pk2, false, PK_N, PK_N, pk[pk1], pk[pk2], PK_N, PK_N, PK_N, PK_N, BPK_N, BPK_N);
+}
+
+CU_Test(ddssec_access_control, encoding_mismatch_liveliness, .timeout=30)
+{
+  for (size_t pk1 = 0; pk1 < sizeof (pk) / sizeof (pk[0]); pk1++)
+    for (size_t pk2 = pk1 + 1; pk2 < sizeof (pk) / sizeof (pk[0]); pk2++)
+      test_encoding_mismatch (pk1 != pk2, false, PK_N, PK_N, PK_N, PK_N, pk[pk1], pk[pk2], PK_N, PK_N, BPK_N, BPK_N);
+}
+
+CU_Test(ddssec_access_control, encoding_mismatch_metadata, .timeout=30)
+{
+  for (size_t pk1 = 0; pk1 < sizeof (pk) / sizeof (pk[0]); pk1++)
+    for (size_t pk2 = pk1 + 1; pk2 < sizeof (pk) / sizeof (pk[0]); pk2++)
+      test_encoding_mismatch (false, pk1 != pk2, PK_N, PK_N, PK_N, PK_N, PK_N, PK_N, pk[pk1], pk[pk2], BPK_N, BPK_N);
+}
+
+CU_Test(ddssec_access_control, encoding_mismatch_payload, .timeout=30)
+{
+  for (size_t pk1 = 0; pk1 < sizeof (bpk) / sizeof (bpk[0]); pk1++)
+    for (size_t pk2 = pk1 + 1; pk2 < sizeof (bpk) / sizeof (bpk[0]); pk2++)
+      test_encoding_mismatch (false, pk1 != pk2, PK_N, PK_N, PK_N, PK_N, PK_N, PK_N, PK_N, PK_N, bpk[pk1], bpk[pk2]);
 }
diff --git a/src/security/core/tests/authentication.c b/src/security/core/tests/authentication.c
index 0af4138..bbfb69b 100644
--- a/src/security/core/tests/authentication.c
+++ b/src/security/core/tests/authentication.c
@@ -175,43 +175,6 @@ CU_TheoryDataPoints(ddssec_authentication, id_ca_certs) = {
 #undef FM_CA
 #undef FM_INVK
 
-static void validate_hs(struct Handshake *hs, bool exp_fail_hs_req, const char * fail_hs_req_msg, bool exp_fail_hs_reply, const char * fail_hs_reply_msg)
-{
-  DDS_Security_ValidationResult_t exp_result = hs->node_type == HSN_REQUESTER ? DDS_SECURITY_VALIDATION_OK_FINAL_MESSAGE : DDS_SECURITY_VALIDATION_OK;
-  if (hs->node_type == HSN_REQUESTER)
-  {
-    CU_ASSERT_EQUAL_FATAL (hs->finalResult, exp_fail_hs_req ? DDS_SECURITY_VALIDATION_FAILED : exp_result);
-    if (exp_fail_hs_req)
-    {
-      if (fail_hs_req_msg == NULL)
-      {
-        CU_ASSERT_EQUAL_FATAL (hs->err_msg, NULL);
-      }
-      else
-      {
-        CU_ASSERT_FATAL (hs->err_msg != NULL);
-        CU_ASSERT_FATAL (strstr(hs->err_msg, fail_hs_req_msg) != NULL);
-      }
-    }
-  }
-  else if (hs->node_type == HSN_REPLIER)
-  {
-    CU_ASSERT_EQUAL_FATAL (hs->finalResult, exp_fail_hs_reply ? DDS_SECURITY_VALIDATION_FAILED : exp_result);
-    if (exp_fail_hs_reply)
-    {
-      if (fail_hs_reply_msg == NULL)
-      {
-        CU_ASSERT_EQUAL_FATAL (hs->err_msg, NULL);
-      }
-      else
-      {
-        CU_ASSERT_FATAL (hs->err_msg != NULL);
-        CU_ASSERT_FATAL (strstr(hs->err_msg, fail_hs_reply_msg) != NULL);
-      }
-    }
-  }
-}
-
 CU_Theory((const char * test_descr, const char * id2, const char *key2, const char *ca2,
     bool exp_fail_pp1, bool exp_fail_pp2,
     bool exp_fail_local, const char * fail_local_msg,
@@ -225,15 +188,15 @@ CU_Theory((const char * test_descr, const char * id2, const char *key2, const ch
   authentication_init (ID1, ID1K, CA1, id2, key2, ca2, NULL, NULL, exp_fail_pp1, exp_fail_pp2);
 
   // Domain 1
-  validate_handshake (DDS_DOMAINID1, false, NULL, &hs_list, &nhs);
+  validate_handshake (DDS_DOMAINID1, false, NULL, &hs_list, &nhs, DDS_SECS(2));
   for (int n = 0; n < nhs; n++)
-    validate_hs (&hs_list[n], exp_fail_hs_req, fail_hs_req_msg, exp_fail_hs_reply, fail_hs_reply_msg);
+    validate_handshake_result (&hs_list[n], exp_fail_hs_req, fail_hs_req_msg, exp_fail_hs_reply, fail_hs_reply_msg);
   handshake_list_fini (hs_list, nhs);
 
   // Domain 2
-  validate_handshake (DDS_DOMAINID2, exp_fail_local, fail_local_msg, &hs_list, &nhs);
+  validate_handshake (DDS_DOMAINID2, exp_fail_local, fail_local_msg, &hs_list, &nhs, DDS_SECS(2));
   for (int n = 0; n < nhs; n++)
-    validate_hs (&hs_list[n], exp_fail_hs_req, fail_hs_req_msg, exp_fail_hs_reply, fail_hs_reply_msg);
+    validate_handshake_result (&hs_list[n], exp_fail_hs_req, fail_hs_req_msg, exp_fail_hs_reply, fail_hs_reply_msg);
   handshake_list_fini (hs_list, nhs);
 
   authentication_fini (!exp_fail_pp1, !exp_fail_pp2);
@@ -249,8 +212,8 @@ CU_Theory((const char * ca_dir, bool exp_fail), ddssec_authentication, trusted_c
   authentication_init (ID1, ID1K, CA1, ID1, ID1K, CA1, ca_dir, NULL, exp_fail, exp_fail);
   if (!exp_fail)
   {
-    validate_handshake_nofail (DDS_DOMAINID1);
-    validate_handshake_nofail (DDS_DOMAINID2);
+    validate_handshake_nofail (DDS_DOMAINID1, DDS_SECS (2));
+    validate_handshake_nofail (DDS_DOMAINID2, DDS_SECS (2));
   }
   authentication_fini (!exp_fail, !exp_fail);
 }
@@ -306,12 +269,12 @@ CU_Theory(
     get_permissions_grant ("id2", id2_subj, NULL, now - DDS_SECS(D(1)), now + DDS_SECS(D(1)), NULL, NULL, NULL) };
   char * perm_config = get_permissions_config (grants, 2, true);
   authentication_init (id1, ID1K, ca, id2, ID1K, ca, NULL, perm_config, id1_local_fail, id2_local_fail);
-  validate_handshake (DDS_DOMAINID1, id1_local_fail, NULL, NULL, NULL);
-  validate_handshake (DDS_DOMAINID2, id2_local_fail, NULL, NULL, NULL);
+  validate_handshake (DDS_DOMAINID1, id1_local_fail, NULL, NULL, NULL, DDS_SECS(2));
+  validate_handshake (DDS_DOMAINID2, id2_local_fail, NULL, NULL, NULL, DDS_SECS(2));
   if (write_read_dur > 0)
   {
     rd_wr_init (g_participant1, &g_pub, &g_pub_tp, &g_wr, g_participant2, &g_sub, &g_sub_tp, &g_rd, topic_name);
-    sync_writer_to_readers(g_participant1, g_wr, 1);
+    sync_writer_to_readers(g_participant1, g_wr, 1, DDS_SECS(2));
     write_read_for (g_wr, g_participant2, g_rd, DDS_MSECS (write_read_dur), false, exp_read_fail);
   }
   authentication_fini (!id1_local_fail, !id2_local_fail);
diff --git a/src/security/core/tests/common/test_utils.c b/src/security/core/tests/common/test_utils.c
index 99a4eaf..89d22f3 100644
--- a/src/security/core/tests/common/test_utils.c
+++ b/src/security/core/tests/common/test_utils.c
@@ -27,8 +27,6 @@
 #include "test_utils.h"
 #include "SecurityCoreTests.h"
 
-#define HS_TIMEOUT DDS_SECS(2)
-
 struct Identity localIdentityList[MAX_LOCAL_IDENTITIES];
 int numLocal = 0;
 
@@ -151,10 +149,10 @@ static int find_handshake (DDS_Security_HandshakeHandle handle)
   return -1;
 }
 
-static void handle_process_message (dds_domainid_t domain_id, DDS_Security_IdentityHandle handshake)
+static void handle_process_message (dds_domainid_t domain_id, DDS_Security_IdentityHandle handshake, dds_duration_t timeout)
 {
   struct message *msg;
-  if ((msg = test_authentication_plugin_take_msg (domain_id, MESSAGE_KIND_PROCESS_HANDSHAKE, 0, 0, handshake, HS_TIMEOUT)))
+  if ((msg = test_authentication_plugin_take_msg (domain_id, MESSAGE_KIND_PROCESS_HANDSHAKE, 0, 0, handshake, timeout)))
   {
     int idx;
     if ((idx = find_handshake (msg->hsHandle)) >= 0)
@@ -167,42 +165,42 @@ static void handle_process_message (dds_domainid_t domain_id, DDS_Security_Ident
   }
 }
 
-static void handle_begin_handshake_request (dds_domainid_t domain_id, struct Handshake *hs, DDS_Security_IdentityHandle lid, DDS_Security_IdentityHandle rid)
+static void handle_begin_handshake_request (dds_domainid_t domain_id, struct Handshake *hs, DDS_Security_IdentityHandle lid, DDS_Security_IdentityHandle rid, dds_duration_t timeout)
 {
   struct message *msg;
   print_test_msg ("handle begin handshake request %"PRId64"<->%"PRId64"\n", lid, rid);
-  if ((msg = test_authentication_plugin_take_msg (domain_id, MESSAGE_KIND_BEGIN_HANDSHAKE_REQUEST, lid, rid, 0, HS_TIMEOUT)))
+  if ((msg = test_authentication_plugin_take_msg (domain_id, MESSAGE_KIND_BEGIN_HANDSHAKE_REQUEST, lid, rid, 0, timeout)))
   {
     hs->handle = msg->hsHandle;
     hs->handshakeResult = msg->result;
     if (msg->result != DDS_SECURITY_VALIDATION_FAILED)
-      handle_process_message (domain_id, msg->hsHandle);
+      handle_process_message (domain_id, msg->hsHandle, timeout);
     else
       hs->err_msg = ddsrt_strdup (msg->err_msg);
     test_authentication_plugin_release_msg (msg);
   }
 }
 
-static void handle_begin_handshake_reply (dds_domainid_t domain_id, struct Handshake *hs, DDS_Security_IdentityHandle lid, DDS_Security_IdentityHandle rid)
+static void handle_begin_handshake_reply (dds_domainid_t domain_id, struct Handshake *hs, DDS_Security_IdentityHandle lid, DDS_Security_IdentityHandle rid, dds_duration_t timeout)
 {
   struct message *msg;
   print_test_msg ("handle begin handshake reply %"PRId64"<->%"PRId64"\n", lid, rid);
-  if ((msg = test_authentication_plugin_take_msg (domain_id, MESSAGE_KIND_BEGIN_HANDSHAKE_REPLY, lid, rid, 0, HS_TIMEOUT)))
+  if ((msg = test_authentication_plugin_take_msg (domain_id, MESSAGE_KIND_BEGIN_HANDSHAKE_REPLY, lid, rid, 0, timeout)))
   {
     hs->handle = msg->hsHandle;
     hs->handshakeResult = msg->result;
     if (msg->result != DDS_SECURITY_VALIDATION_FAILED)
-      handle_process_message (domain_id, msg->hsHandle);
+      handle_process_message (domain_id, msg->hsHandle, timeout);
     else
       hs->err_msg = ddsrt_strdup (msg->err_msg);
     test_authentication_plugin_release_msg (msg);
   }
 }
 
-static void handle_validate_remote_identity (dds_domainid_t domain_id, DDS_Security_IdentityHandle lid, int count)
+static void handle_validate_remote_identity (dds_domainid_t domain_id, DDS_Security_IdentityHandle lid, int count, dds_duration_t timeout)
 {
   struct message *msg;
-  while (count-- > 0 && (msg = test_authentication_plugin_take_msg (domain_id, MESSAGE_KIND_VALIDATE_REMOTE_IDENTITY, lid, 0, 0, HS_TIMEOUT)))
+  while (count-- > 0 && (msg = test_authentication_plugin_take_msg (domain_id, MESSAGE_KIND_VALIDATE_REMOTE_IDENTITY, lid, 0, 0, timeout)))
   {
     struct Handshake *hs;
     add_remote_identity (msg->ridHandle, &msg->rguid);
@@ -210,12 +208,12 @@ static void handle_validate_remote_identity (dds_domainid_t domain_id, DDS_Secur
     if (msg->result == DDS_SECURITY_VALIDATION_PENDING_HANDSHAKE_REQUEST)
     {
       hs->node_type = HSN_REQUESTER;
-      handle_begin_handshake_request (domain_id, hs, lid, msg->ridHandle);
+      handle_begin_handshake_request (domain_id, hs, lid, msg->ridHandle, timeout);
     }
     else if (msg->result == DDS_SECURITY_VALIDATION_PENDING_HANDSHAKE_MESSAGE)
     {
       hs->node_type = HSN_REPLIER;
-      handle_begin_handshake_reply (domain_id, hs, lid, msg->ridHandle);
+      handle_begin_handshake_reply (domain_id, hs, lid, msg->ridHandle, timeout);
     }
     else
     {
@@ -225,9 +223,9 @@ static void handle_validate_remote_identity (dds_domainid_t domain_id, DDS_Secur
   }
 }
 
-static void handle_validate_local_identity (dds_domainid_t domain_id, bool exp_localid_fail, const char * exp_localid_msg)
+static void handle_validate_local_identity (dds_domainid_t domain_id, bool exp_localid_fail, const char * exp_localid_msg, dds_duration_t timeout)
 {
- struct message *msg = test_authentication_plugin_take_msg (domain_id, MESSAGE_KIND_VALIDATE_LOCAL_IDENTITY, 0, 0, 0, HS_TIMEOUT);
+ struct message *msg = test_authentication_plugin_take_msg (domain_id, MESSAGE_KIND_VALIDATE_LOCAL_IDENTITY, 0, 0, 0, timeout);
   CU_ASSERT_FATAL (msg != NULL);
   CU_ASSERT_FATAL ((msg->result == DDS_SECURITY_VALIDATION_OK) != exp_localid_fail);
   if (exp_localid_fail && exp_localid_msg)
@@ -240,7 +238,7 @@ static void handle_validate_local_identity (dds_domainid_t domain_id, bool exp_l
   test_authentication_plugin_release_msg (msg);
 }
 
-void validate_handshake (dds_domainid_t domain_id, bool exp_localid_fail, const char * exp_localid_msg, struct Handshake *hs_list[], int *nhs)
+void validate_handshake (dds_domainid_t domain_id, bool exp_localid_fail, const char * exp_localid_msg, struct Handshake *hs_list[], int *nhs, dds_duration_t timeout)
 {
   clear_stores ();
 
@@ -249,10 +247,10 @@ void validate_handshake (dds_domainid_t domain_id, bool exp_localid_fail, const
   if (hs_list)
     *hs_list = NULL;
 
-  handle_validate_local_identity (domain_id, exp_localid_fail, exp_localid_msg);
+  handle_validate_local_identity (domain_id, exp_localid_fail, exp_localid_msg, timeout);
   if (!exp_localid_fail)
   {
-    handle_validate_remote_identity (domain_id, localIdentityList[0].handle, 1);
+    handle_validate_remote_identity (domain_id, localIdentityList[0].handle, 1, timeout);
     for (int n = 0; n < numHandshake; n++)
     {
       struct Handshake *hs = &handshakeList[n];
@@ -270,11 +268,11 @@ void validate_handshake (dds_domainid_t domain_id, bool exp_localid_fail, const
   print_test_msg ("finished validate handshake for domain %d\n\n", domain_id);
 }
 
-void validate_handshake_nofail (dds_domainid_t domain_id)
+void validate_handshake_nofail (dds_domainid_t domain_id, dds_duration_t timeout)
 {
   struct Handshake *hs_list;
   int nhs;
-  validate_handshake (domain_id, false, NULL, &hs_list, &nhs);
+  validate_handshake (domain_id, false, NULL, &hs_list, &nhs, timeout);
   for (int n = 0; n < nhs; n++)
   {
     struct Handshake hs = hs_list[n];
@@ -284,6 +282,43 @@ void validate_handshake_nofail (dds_domainid_t domain_id)
   handshake_list_fini (hs_list, nhs);
 }
 
+void validate_handshake_result(struct Handshake *hs, bool exp_fail_hs_req, const char * fail_hs_req_msg, bool exp_fail_hs_reply, const char * fail_hs_reply_msg)
+{
+  DDS_Security_ValidationResult_t exp_result = hs->node_type == HSN_REQUESTER ? DDS_SECURITY_VALIDATION_OK_FINAL_MESSAGE : DDS_SECURITY_VALIDATION_OK;
+  if (hs->node_type == HSN_REQUESTER)
+  {
+    CU_ASSERT_EQUAL_FATAL (hs->finalResult, exp_fail_hs_req ? DDS_SECURITY_VALIDATION_FAILED : exp_result);
+    if (exp_fail_hs_req)
+    {
+      if (fail_hs_req_msg == NULL)
+      {
+        CU_ASSERT_EQUAL_FATAL (hs->err_msg, NULL);
+      }
+      else
+      {
+        CU_ASSERT_FATAL (hs->err_msg != NULL);
+        CU_ASSERT_FATAL (strstr(hs->err_msg, fail_hs_req_msg) != NULL);
+      }
+    }
+  }
+  else if (hs->node_type == HSN_REPLIER)
+  {
+    CU_ASSERT_EQUAL_FATAL (hs->finalResult, exp_fail_hs_reply ? DDS_SECURITY_VALIDATION_FAILED : exp_result);
+    if (exp_fail_hs_reply)
+    {
+      if (fail_hs_reply_msg == NULL)
+      {
+        CU_ASSERT_EQUAL_FATAL (hs->err_msg, NULL);
+      }
+      else
+      {
+        CU_ASSERT_FATAL (hs->err_msg != NULL);
+        CU_ASSERT_FATAL (strstr(hs->err_msg, fail_hs_reply_msg) != NULL);
+      }
+    }
+  }
+}
+
 void handshake_list_fini (struct Handshake *hs_list, int nhs)
 {
   for (int n = 0; n < nhs; n++)
@@ -293,7 +328,7 @@ void handshake_list_fini (struct Handshake *hs_list, int nhs)
   }
 }
 
-void sync_writer_to_readers (dds_entity_t pp_wr, dds_entity_t wr, uint32_t exp_count)
+void sync_writer_to_readers (dds_entity_t pp_wr, dds_entity_t wr, uint32_t exp_count, dds_duration_t timeout)
 {
   dds_attach_t triggered;
   dds_entity_t ws = dds_create_waitset (pp_wr);
@@ -304,7 +339,7 @@ void sync_writer_to_readers (dds_entity_t pp_wr, dds_entity_t wr, uint32_t exp_c
   CU_ASSERT_EQUAL_FATAL (ret, DDS_RETCODE_OK);
   while (true)
   {
-    ret = dds_waitset_wait (ws, &triggered, 1, DDS_SECS(2));
+    ret = dds_waitset_wait (ws, &triggered, 1, timeout);
     CU_ASSERT_EQUAL_FATAL (exp_count > 0, ret >= 1);
     if (exp_count > 0)
       CU_ASSERT_EQUAL_FATAL (wr, (dds_entity_t)(intptr_t) triggered);
@@ -317,7 +352,7 @@ void sync_writer_to_readers (dds_entity_t pp_wr, dds_entity_t wr, uint32_t exp_c
   CU_ASSERT_EQUAL_FATAL (pub_matched.total_count, exp_count);
 }
 
-void sync_reader_to_writers (dds_entity_t pp_rd, dds_entity_t rd, uint32_t exp_count)
+void sync_reader_to_writers (dds_entity_t pp_rd, dds_entity_t rd, uint32_t exp_count, dds_duration_t timeout)
 {
   dds_attach_t triggered;
   dds_entity_t ws = dds_create_waitset (pp_rd);
@@ -328,7 +363,7 @@ void sync_reader_to_writers (dds_entity_t pp_rd, dds_entity_t rd, uint32_t exp_c
   CU_ASSERT_EQUAL_FATAL (ret, DDS_RETCODE_OK);
   while (true)
   {
-    ret = dds_waitset_wait (ws, &triggered, 1, DDS_SECS(2));
+    ret = dds_waitset_wait (ws, &triggered, 1, timeout);
     CU_ASSERT_EQUAL_FATAL (exp_count > 0, ret >= 1);
     if (exp_count > 0)
       CU_ASSERT_EQUAL_FATAL (rd, (dds_entity_t)(intptr_t) triggered);
diff --git a/src/security/core/tests/common/test_utils.h b/src/security/core/tests/common/test_utils.h
index 5fb9ccb..2a68327 100644
--- a/src/security/core/tests/common/test_utils.h
+++ b/src/security/core/tests/common/test_utils.h
@@ -60,26 +60,27 @@ struct Handshake
 };
 
 void print_test_msg (const char *msg, ...);
-void validate_handshake(dds_domainid_t domain_id, bool exp_localid_fail, const char * exp_localid_msg, struct Handshake *hs_list[], int *nhs);
-void validate_handshake_nofail (dds_domainid_t domain_id);
-void handshake_list_fini(struct Handshake *hs_list, int nhs);
-char *create_topic_name(const char *prefix, uint32_t nr, char *name, size_t size);
-void sync_writer_to_readers(dds_entity_t pp_wr, dds_entity_t wr, uint32_t exp_count);
-void sync_reader_to_writers (dds_entity_t pp_rd, dds_entity_t rd, uint32_t exp_count);
-bool reader_wait_for_data(dds_entity_t pp, dds_entity_t rd, dds_duration_t dur);
-void rd_wr_init(
+void validate_handshake (dds_domainid_t domain_id, bool exp_localid_fail, const char * exp_localid_msg, struct Handshake *hs_list[], int *nhs, dds_duration_t timeout);
+void validate_handshake_nofail (dds_domainid_t domain_id, dds_duration_t timeout);
+void validate_handshake_result (struct Handshake *hs, bool exp_fail_hs_req, const char * fail_hs_req_msg, bool exp_fail_hs_reply, const char * fail_hs_reply_msg);
+void handshake_list_fini (struct Handshake *hs_list, int nhs);
+char *create_topic_name (const char *prefix, uint32_t nr, char *name, size_t size);
+void sync_writer_to_readers (dds_entity_t pp_wr, dds_entity_t wr, uint32_t exp_count, dds_duration_t timeout);
+void sync_reader_to_writers (dds_entity_t pp_rd, dds_entity_t rd, uint32_t exp_count, dds_duration_t timeout);
+bool reader_wait_for_data (dds_entity_t pp, dds_entity_t rd, dds_duration_t dur);
+void rd_wr_init (
     dds_entity_t pp_wr, dds_entity_t *pub, dds_entity_t *pub_tp, dds_entity_t *wr,
     dds_entity_t pp_rd, dds_entity_t *sub, dds_entity_t *sub_tp, dds_entity_t *rd,
     const char * topic_name);
-void rd_wr_init_fail(
+void rd_wr_init_fail (
     dds_entity_t pp_wr, dds_entity_t *pub, dds_entity_t *pub_tp, dds_entity_t *wr,
     dds_entity_t pp_rd, dds_entity_t *sub, dds_entity_t *sub_tp, dds_entity_t *rd,
     const char * topic_name,
     bool exp_pubtp_fail, bool exp_wr_fail,
     bool exp_subtp_fail, bool exp_rd_fail);
-void write_read_for(dds_entity_t wr, dds_entity_t pp_rd, dds_entity_t rd, dds_duration_t dur, bool exp_write_fail, bool exp_read_fail);
-struct dds_security_cryptography_impl * get_crypto_context(dds_entity_t participant);
-const char * pk_to_str(DDS_Security_ProtectionKind pk);
-const char * bpk_to_str(DDS_Security_BasicProtectionKind bpk);
+void write_read_for (dds_entity_t wr, dds_entity_t pp_rd, dds_entity_t rd, dds_duration_t dur, bool exp_write_fail, bool exp_read_fail);
+struct dds_security_cryptography_impl * get_crypto_context (dds_entity_t participant);
+const char * pk_to_str (DDS_Security_ProtectionKind pk);
+const char * bpk_to_str (DDS_Security_BasicProtectionKind bpk);
 
 #endif /* SECURITY_CORE_TEST_UTILS_H_ */
diff --git a/src/security/core/tests/handshake.c b/src/security/core/tests/handshake.c
index 5947a8f..26d6d9a 100644
--- a/src/security/core/tests/handshake.c
+++ b/src/security/core/tests/handshake.c
@@ -107,11 +107,25 @@ static void handshake_fini(void)
 
 CU_Test(ddssec_handshake, happy_day)
 {
+  struct Handshake *hs_list;
+  int nhs;
+
   handshake_init (
     "init_test_authentication_wrapped", "finalize_test_authentication_wrapped",
     "init_test_cryptography_wrapped", "finalize_test_cryptography_wrapped");
-  validate_handshake_nofail (DDS_DOMAINID1);
-  validate_handshake_nofail (DDS_DOMAINID2);
+
+  validate_handshake (DDS_DOMAINID1, false, NULL, &hs_list, &nhs, DDS_SECS(2));
+  CU_ASSERT_EQUAL_FATAL (nhs, 1);
+  for (int n = 0; n < nhs; n++)
+    validate_handshake_result (&hs_list[n], false, NULL, false, NULL);
+  handshake_list_fini (hs_list, nhs);
+
+  validate_handshake (DDS_DOMAINID2, false, NULL, &hs_list, &nhs, DDS_SECS(2));
+  CU_ASSERT_EQUAL_FATAL (nhs, 1);
+  for (int n = 0; n < nhs; n++)
+    validate_handshake_result (&hs_list[n], false, NULL, false, NULL);
+  handshake_list_fini (hs_list, nhs);
+
   handshake_fini ();
 }
 
@@ -120,8 +134,8 @@ CU_Test(ddssec_handshake, check_tokens)
   handshake_init (
     "init_test_authentication_wrapped", "finalize_test_authentication_wrapped",
     "init_test_cryptography_store_tokens", "finalize_test_cryptography_store_tokens");
-  validate_handshake_nofail (DDS_DOMAINID1);
-  validate_handshake_nofail (DDS_DOMAINID2);
+  validate_handshake_nofail (DDS_DOMAINID1, DDS_SECS (2));
+  validate_handshake_nofail (DDS_DOMAINID2, DDS_SECS (2));
 
   char topic_name[100];
   create_topic_name("ddssec_authentication_", g_topic_nr++, topic_name, sizeof (topic_name));
diff --git a/src/security/core/tests/secure_communication.c b/src/security/core/tests/secure_communication.c
index fb7386f..7236657 100644
--- a/src/security/core/tests/secure_communication.c
+++ b/src/security/core/tests/secure_communication.c
@@ -255,7 +255,7 @@ static void test_write_read(struct domain_sec_config *domain_config,
       for (size_t w = 0; w < n_writers; w++)
       {
         size_t wr_index = pp_index * n_writers + w;
-        sync_writer_to_readers (g_pub_participants[pp_index], writers[wr_index], (uint32_t)(n_sub_domains * n_sub_participants * n_readers));
+        sync_writer_to_readers (g_pub_participants[pp_index], writers[wr_index], (uint32_t)(n_sub_domains * n_sub_participants * n_readers), DDS_SECS(2));
         sample.id = (int32_t) wr_index;
         printf("writer %"PRId32" writing sample %d\n", writers[wr_index], sample.id);
         ret = dds_write (writers[wr_index], &sample);
@@ -366,7 +366,7 @@ static void test_payload_secret(DDS_Security_ProtectionKind rtps_pk, DDS_Securit
   create_eps (&writers, &writer_topics, 1, 1, 1, name, &SecurityCoreTests_Type2_desc, g_pub_participants, qos, &dds_create_writer, DDS_PUBLICATION_MATCHED_STATUS);
   create_eps (&readers, &reader_topics, 1, 1, 1, name, &SecurityCoreTests_Type2_desc, g_sub_participants, qos, &dds_create_reader, DDS_DATA_AVAILABLE_STATUS);
   dds_delete_qos (qos);
-  sync_writer_to_readers (g_pub_participants[0], writers[0], 1);
+  sync_writer_to_readers (g_pub_participants[0], writers[0], 1, DDS_SECS(2));
   ret = dds_write (writers[0], &sample);
   CU_ASSERT_EQUAL_FATAL (ret, DDS_RETCODE_OK);
 

From 0348bb274164fa96272f74ea5ef43de0a69f5585 Mon Sep 17 00:00:00 2001
From: Dennis Potman <dennis.potman@adlinktech.com>
Date: Tue, 28 Apr 2020 14:45:20 +0200
Subject: [PATCH 184/238] Security liveliness protection tests

Add testing liveness protection to the existing discovery protection
test. The test checks if the P2P_BUILTIN_PARTICIPANT_MESSAGE_SECURE_WRITER
is using the encode_decode_submessage function of the crypto plugin
to secure liveliness messages.

Signed-off-by: Dennis Potman <dennis.potman@adlinktech.com>
---
 src/security/core/tests/access_control.c      | 52 +++++++++++++------
 .../core/tests/secure_communication.c         |  4 +-
 2 files changed, 39 insertions(+), 17 deletions(-)

diff --git a/src/security/core/tests/access_control.c b/src/security/core/tests/access_control.c
index 3a388c1..a4f44f6 100644
--- a/src/security/core/tests/access_control.c
+++ b/src/security/core/tests/access_control.c
@@ -569,7 +569,7 @@ CU_Theory(
 }
 
 #define na false
-CU_TheoryDataPoints(ddssec_access_control, discovery_protection) = {
+CU_TheoryDataPoints(ddssec_access_control, discovery_liveliness_protection) = {
     CU_DataPoints(const char *,
     /*                                        */"disabled",
     /*                                         |     */"enabled, protection kind none",
@@ -588,14 +588,19 @@ CU_TheoryDataPoints(ddssec_access_control, discovery_protection) = {
     CU_DataPoints(bool,                        na,    na,    true,  true,  true,  true,   false, false),  /* expect encode_datawriter_submessage for SEDP_BUILTIN_PUBLICATIONS_SECURE_WRITER of pp 1 */
 };
 #undef na
-CU_Theory(
-  (const char * test_descr, bool enable_discovery_protection_pp1, bool enable_discovery_protection_pp2,
-    DDS_Security_ProtectionKind discovery_protection_kind_pp1, DDS_Security_ProtectionKind discovery_protection_kind_pp2,
-    bool exp_rd_wr_match_fail, bool exp_secure_pub_wr_handle, bool exp_secure_pub_wr_encode_decode),
-  ddssec_access_control, discovery_protection, .timeout=30)
-{
-  print_test_msg ("running test discovery_protection: %s\n", test_descr);
 
+enum test_discovery_liveliness
+{
+  TEST_DISCOVERY,
+  TEST_LIVELINESS
+};
+
+static void test_discovery_liveliness_protection(enum test_discovery_liveliness kind,
+    bool enable_protection_pp1, bool enable_protection_pp2,
+    DDS_Security_ProtectionKind protection_kind_pp1, DDS_Security_ProtectionKind protection_kind_pp2,
+    bool exp_rd_wr_match_fail, bool exp_secure_pub_wr_handle, bool exp_secure_pub_wr_encode_decode)
+{
+  bool dp = kind == TEST_DISCOVERY, lp = kind == TEST_LIVELINESS;
   char topic_name[100];
   create_topic_name ("ddssec_access_control_", g_topic_nr++, topic_name, sizeof (topic_name));
 
@@ -613,10 +618,10 @@ CU_Theory(
     get_permissions_grant ("id2", id2_subj, NULL, now, now + DDS_SECS(3600), perm_topic, perm_topic, NULL) };
   char * perm_config = get_permissions_config (grants, 2, true);
 
-  char * gov_topic_rule1 = get_governance_topic_rule (topic_name, enable_discovery_protection_pp1, false, true, true, "ENCRYPT", "NONE");
-  char * gov_topic_rule2 = get_governance_topic_rule (topic_name, enable_discovery_protection_pp2, false, true, true, "ENCRYPT", "NONE");
-  char * gov_config1 = get_governance_config (false, true, pk_to_str (discovery_protection_kind_pp1), NULL, "ENCRYPT", gov_topic_rule1, true);
-  char * gov_config2 = get_governance_config (false, true, pk_to_str (discovery_protection_kind_pp2), NULL, "ENCRYPT", gov_topic_rule2, true);
+  char * gov_topic_rule1 = get_governance_topic_rule (topic_name, dp && enable_protection_pp1, lp && enable_protection_pp1, true, true, "ENCRYPT", "NONE");
+  char * gov_topic_rule2 = get_governance_topic_rule (topic_name, dp && enable_protection_pp2, lp && enable_protection_pp2, true, true, "ENCRYPT", "NONE");
+  char * gov_config1 = get_governance_config (false, true, dp ? pk_to_str (protection_kind_pp1) : NULL, lp ? pk_to_str (protection_kind_pp1) : NULL, "ENCRYPT", gov_topic_rule1, true);
+  char * gov_config2 = get_governance_config (false, true, dp ? pk_to_str (protection_kind_pp2) : NULL, lp ? pk_to_str (protection_kind_pp2) : NULL, "ENCRYPT", gov_topic_rule2, true);
   const char * def_perm_ca = PF_F COMMON_ETC_PATH("default_permissions_ca.pem");
 
   access_control_init (
@@ -636,8 +641,10 @@ CU_Theory(
   if (!exp_rd_wr_match_fail)
     write_read_for (wr, g_participant[1], rd, DDS_MSECS (100), false, false);
 
-  DDS_Security_DatawriterCryptoHandle secure_pub_wr_handle = get_builtin_writer_crypto_handle (g_participant[0], NN_ENTITYID_SEDP_BUILTIN_PUBLICATIONS_SECURE_WRITER);
-  print_test_msg ("crypto handle for SEDP_BUILTIN_PUBLICATIONS_SECURE_WRITER: %ld\n", secure_pub_wr_handle);
+  unsigned builtin_wr = dp ? NN_ENTITYID_SEDP_BUILTIN_PUBLICATIONS_SECURE_WRITER : NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_MESSAGE_SECURE_WRITER;
+  const char * builtin_wr_descr = dp ? "SEDP_BUILTIN_PUBLICATIONS_SECURE_WRITER" : "P2P_BUILTIN_PARTICIPANT_MESSAGE_SECURE_WRITER";
+  DDS_Security_DatawriterCryptoHandle secure_pub_wr_handle = get_builtin_writer_crypto_handle (g_participant[0], builtin_wr);
+  print_test_msg ("crypto handle for %s: %ld\n", builtin_wr_descr, secure_pub_wr_handle);
   CU_ASSERT_EQUAL_FATAL (exp_secure_pub_wr_handle, secure_pub_wr_handle != 0);
 
   struct dds_security_cryptography_impl * crypto_context_pub = get_crypto_context (g_participant[0]);
@@ -647,7 +654,7 @@ CU_Theory(
   CU_ASSERT_EQUAL_FATAL (exp_secure_pub_wr_handle && exp_secure_pub_wr_encode_decode, log != NULL);
   if (log != NULL)
   {
-    print_test_msg ("encode_datawriter_submessage count for SEDP_BUILTIN_PUBLICATIONS_SECURE_WRITER: %u\n", log->count);
+    print_test_msg ("encode_datawriter_submessage count for %s: %u\n", builtin_wr_descr, log->count);
     CU_ASSERT_FATAL (log->count > 0);
     ddsrt_free (log);
   }
@@ -655,6 +662,21 @@ CU_Theory(
   access_control_fini (2, (void * []) { gov_config1, gov_config2, gov_topic_rule1, gov_topic_rule2, perm_topic, grants[0], grants[1], perm_config, ca, id1_subj, id2_subj, id1, id2 }, 13);
 }
 
+CU_Theory(
+  (const char * test_descr, bool enable_discovery_protection_pp1, bool enable_discovery_protection_pp2,
+    DDS_Security_ProtectionKind discovery_protection_kind_pp1, DDS_Security_ProtectionKind discovery_protection_kind_pp2,
+    bool exp_rd_wr_match_fail, bool exp_secure_pub_wr_handle, bool exp_secure_pub_wr_encode_decode),
+  ddssec_access_control, discovery_liveliness_protection, .timeout=40)
+{
+  enum test_discovery_liveliness kinds[2] = { TEST_DISCOVERY, TEST_LIVELINESS };
+  for (size_t i = 0; i < sizeof (kinds) / sizeof (kinds[0]); i++)
+  {
+    print_test_msg ("running test %s_protection: %s\n", kinds[i] == TEST_DISCOVERY ? "discovery" : "liveliness", test_descr);
+    test_discovery_liveliness_protection (kinds[i], enable_discovery_protection_pp1, enable_discovery_protection_pp2,
+      discovery_protection_kind_pp1, discovery_protection_kind_pp2, exp_rd_wr_match_fail, exp_secure_pub_wr_handle, exp_secure_pub_wr_encode_decode);
+  }
+}
+
 static void test_encoding_mismatch(
     bool exp_hs_fail, bool exp_rd_wr_fail,
     DDS_Security_ProtectionKind rtps_pk1, DDS_Security_ProtectionKind rtps_pk2,
diff --git a/src/security/core/tests/secure_communication.c b/src/security/core/tests/secure_communication.c
index 7236657..4b3e790 100644
--- a/src/security/core/tests/secure_communication.c
+++ b/src/security/core/tests/secure_communication.c
@@ -154,8 +154,8 @@ static void test_init(const struct domain_sec_config * domain_config, size_t n_s
   assert (n_pub_domains < MAX_DOMAINS);
   assert (n_pub_participants < MAX_PARTICIPANTS);
 
-  char * gov_topic_rule = get_governance_topic_rule ("*", false, false, true, true, pk_to_str (domain_config->metadata_pk), bpk_to_str (domain_config->payload_pk));
-  char * gov_config_signed = get_governance_config (false, false, pk_to_str (domain_config->discovery_pk), pk_to_str (domain_config->liveliness_pk),
+  char * gov_topic_rule = get_governance_topic_rule ("*", true, true, true, true, pk_to_str (domain_config->metadata_pk), bpk_to_str (domain_config->payload_pk));
+  char * gov_config_signed = get_governance_config (false, true, pk_to_str (domain_config->discovery_pk), pk_to_str (domain_config->liveliness_pk),
     pk_to_str (domain_config->rtps_pk), gov_topic_rule, false);
 
   struct kvp config_vars[] = {

From 45adb6f0c7c4c1cfa1f365f304e2ac7671bcb3a7 Mon Sep 17 00:00:00 2001
From: Dennis Potman <dennis.potman@adlinktech.com>
Date: Tue, 28 Apr 2020 21:25:57 +0200
Subject: [PATCH 185/238] Extend access-control tests with
 validate_local_permissions

Add validate_local_permissions to the set of access control plugin
hooks tests, and add discovery_protection_enabled as an additional
parameter for the access control hook tests.

Signed-off-by: Dennis Potman <dennis.potman@adlinktech.com>
---
 src/security/core/tests/access_control.c      | 122 ++++++++++--------
 .../tests/common/access_control_wrapper.c     |  36 ++++--
 .../tests/common/access_control_wrapper.h     |   7 +-
 3 files changed, 92 insertions(+), 73 deletions(-)

diff --git a/src/security/core/tests/access_control.c b/src/security/core/tests/access_control.c
index a4f44f6..4e5b54e 100644
--- a/src/security/core/tests/access_control.c
+++ b/src/security/core/tests/access_control.c
@@ -439,72 +439,80 @@ CU_Test(ddssec_access_control, permissions_expiry_multiple, .timeout=20)
 CU_TheoryDataPoints(ddssec_access_control, hooks) = {
     CU_DataPoints(const char *,
     /*                 */"init_test_access_control_local_participant_not_allowed",
-    /*                  |     */"init_test_access_control_local_topic_not_allowed",
-    /*                  |      |     */"init_test_access_control_local_publishing_not_allowed",
-    /*                  |      |      |      */"init_test_access_control_local_subscribing_not_allowed",
-    /*                  |      |      |      |     */"init_test_access_control_remote_permissions_invalidate",
-    /*                  |      |      |      |      |     */"init_test_access_control_remote_participant_not_allowed",
-    /*                  |      |      |      |      |      |     */"init_test_access_control_remote_topic_not_allowed",
-    /*                  |      |      |      |      |      |      |     */"init_test_access_control_remote_writer_not_allowed",
-    /*                  |      |      |      |      |      |      |      |     */"init_test_access_control_remote_reader_not_allowed",
-    /*                  |      |      |      |      |      |      |      |      |     */"init_test_access_control_remote_reader_relay_only"),
-    CU_DataPoints(bool, true,  false, false, false, false, false, false, false, false, false),  // exp_pp_fail
-    CU_DataPoints(bool, na,    true,  false, false, false, false, false, false, false, false),  // exp_local_topic_fail
-    CU_DataPoints(bool, na,    false, false, false, false, false, false, false, false, false),  // exp_remote_topic_fail
-    CU_DataPoints(bool, na,    na,    true,  false, false, false, false, false, false, false),  // exp_wr_fail
-    CU_DataPoints(bool, na,    na,    false, true,  false, false, false, false, false, false),  // exp_rd_fail
-    CU_DataPoints(bool, na,    na,    na,    na,    true,  true,  true,  false, true,  true),   // exp_wr_rd_sync_fail
-    CU_DataPoints(bool, na,    na,    false, na,    true,  true,  true,  true,  false, false),  // exp_rd_wr_sync_fail
+    /*                  |     */"init_test_access_control_local_permissions_not_allowed",
+    /*                  |      |     */"init_test_access_control_local_topic_not_allowed",
+    /*                  |      |      |     */"init_test_access_control_local_writer_not_allowed",
+    /*                  |      |      |      |      */"init_test_access_control_local_reader_not_allowed",
+    /*                  |      |      |      |      |     */"init_test_access_control_remote_permissions_not_allowed",
+    /*                  |      |      |      |      |      |     */"init_test_access_control_remote_participant_not_allowed",
+    /*                  |      |      |      |      |      |      |     */"init_test_access_control_remote_topic_not_allowed",
+    /*                  |      |      |      |      |      |      |      |     */"init_test_access_control_remote_writer_not_allowed",
+    /*                  |      |      |      |      |      |      |      |      |     */"init_test_access_control_remote_reader_not_allowed",
+    /*                  |      |      |      |      |      |      |      |      |      |     */"init_test_access_control_remote_reader_relay_only"),
+    CU_DataPoints(bool, true,  true,  false, false, false, false, false, false, false, false, false),  // exp_pp_fail
+    CU_DataPoints(bool, na,    na,    true,  false, false, false, false, false, false, false, false),  // exp_local_topic_fail
+    CU_DataPoints(bool, na,    na,    false, false, false, false, false, false, false, false, false),  // exp_remote_topic_fail
+    CU_DataPoints(bool, na,    na,    na,    true,  false, false, false, false, false, false, false),  // exp_wr_fail
+    CU_DataPoints(bool, na,    na,    na,    false, true,  false, false, false, false, false, false),  // exp_rd_fail
+    CU_DataPoints(bool, na,    na,    na,    na,    na,    true,  true,  true,  false, true,  true),   // exp_wr_rd_sync_fail
+    CU_DataPoints(bool, na,    na,    na,    false, na,    true,  true,  true,  true,  false, false),  // exp_rd_wr_sync_fail
 };
 #undef na
+
 CU_Theory(
   (const char * init_fn, bool exp_pp_fail, bool exp_local_topic_fail, bool exp_remote_topic_fail, bool exp_wr_fail, bool exp_rd_fail, bool exp_wr_rd_sync_fail, bool exp_rd_wr_sync_fail),
-  ddssec_access_control, hooks, .timeout=40)
+  ddssec_access_control, hooks, .timeout=60)
 {
-  print_test_msg ("running test access_control_hooks: %s\n", init_fn);
-
-  const char * def_gov = PF_F COMMON_ETC_PATH("default_governance.p7s");
-  const char * def_perm = PF_F COMMON_ETC_PATH("default_permissions.p7s");
-  const char * def_perm_ca = PF_F COMMON_ETC_PATH("default_permissions_ca.pem");
-
-  access_control_init (
-      2,
-      (const char *[]) { TEST_IDENTITY1_CERTIFICATE, TEST_IDENTITY1_CERTIFICATE },
-      (const char *[]) { TEST_IDENTITY1_PRIVATE_KEY, TEST_IDENTITY1_PRIVATE_KEY },
-      (const char *[]) { TEST_IDENTITY_CA1_CERTIFICATE, TEST_IDENTITY_CA1_CERTIFICATE },
-      (bool []) { exp_pp_fail, false },
-      (const char *[]) { init_fn, "init_test_access_control_wrapped" }, (const char *[]) { "finalize_test_access_control_not_allowed", "finalize_test_access_control_wrapped" },
-      (bool []) { true, true, true }, (const char *[]) { def_gov, def_gov },
-      (bool []) { true, true, true }, (const char *[]) { def_perm, def_perm },
-      (bool []) { true, true, true }, (const char *[]) { def_perm_ca, def_perm_ca });
-
-  if (!exp_pp_fail)
+  for (int i = 0; i <= 1; i++)
   {
-    dds_entity_t lwr = 0, rwr = 0, lrd = 0, rrd = 0;
-    dds_entity_t ltopic[2], rtopic[2];
-    dds_entity_t lpub, lsub, rpub, rsub;
-    char topic_name[100];
+    bool discovery_protection = (i == 0);
+    print_test_msg ("running test access_control_hooks: %s with discovery protection %s\n", init_fn, discovery_protection ? "enabled" : "disabled");
 
-    // Local writer, remote reader
-    create_topic_name (AC_WRAPPER_TOPIC_PREFIX, g_topic_nr++, topic_name, sizeof (topic_name));
-    rd_wr_init_fail (
-      g_participant[0], &lpub, &ltopic[0], &lwr,
-      g_participant[1], &rsub, &rtopic[0], &rrd,
-      topic_name, exp_local_topic_fail, exp_wr_fail, exp_remote_topic_fail, false);
-    if (!exp_local_topic_fail && !exp_remote_topic_fail && !exp_wr_fail)
-      sync_writer_to_readers (g_participant[0], lwr, exp_wr_rd_sync_fail ? 0 : 1, DDS_SECS(2));
+    char * gov_topic_rule = get_governance_topic_rule ("*", discovery_protection, false, true, true, NULL, NULL);
+    char * gov_config = get_governance_config (false, true, "ENCRYPT", NULL, NULL, gov_topic_rule, true);
 
-    // Local reader, remote writer
-    create_topic_name (AC_WRAPPER_TOPIC_PREFIX, g_topic_nr++, topic_name, sizeof (topic_name));
-    rd_wr_init_fail (
-      g_participant[1], &rpub, &rtopic[1], &rwr,
-      g_participant[0], &lsub, &ltopic[1], &lrd,
-      topic_name, exp_remote_topic_fail, false, exp_local_topic_fail, exp_rd_fail);
-    if (!exp_local_topic_fail && !exp_remote_topic_fail && !exp_rd_fail)
-      sync_reader_to_writers (g_participant[0], lrd, exp_rd_wr_sync_fail ? 0 : 1, DDS_SECS(2));
+    const char * def_perm = PF_F COMMON_ETC_PATH("default_permissions.p7s");
+    const char * def_perm_ca = PF_F COMMON_ETC_PATH("default_permissions_ca.pem");
+
+    access_control_init (
+        2,
+        (const char *[]) { TEST_IDENTITY1_CERTIFICATE, TEST_IDENTITY1_CERTIFICATE },
+        (const char *[]) { TEST_IDENTITY1_PRIVATE_KEY, TEST_IDENTITY1_PRIVATE_KEY },
+        (const char *[]) { TEST_IDENTITY_CA1_CERTIFICATE, TEST_IDENTITY_CA1_CERTIFICATE },
+        (bool []) { exp_pp_fail, false },
+        (const char *[]) { init_fn, "init_test_access_control_wrapped" }, (const char *[]) { "finalize_test_access_control_not_allowed", "finalize_test_access_control_wrapped" },
+        (bool []) { true, true, true }, (const char *[]) { gov_config, gov_config },
+        (bool []) { true, true, true }, (const char *[]) { def_perm, def_perm },
+        (bool []) { true, true, true }, (const char *[]) { def_perm_ca, def_perm_ca });
+
+    if (!exp_pp_fail)
+    {
+      dds_entity_t lwr = 0, rwr = 0, lrd = 0, rrd = 0;
+      dds_entity_t ltopic[2], rtopic[2];
+      dds_entity_t lpub, lsub, rpub, rsub;
+      char topic_name[100];
+
+      // Local writer, remote reader
+      create_topic_name (AC_WRAPPER_TOPIC_PREFIX, g_topic_nr++, topic_name, sizeof (topic_name));
+      rd_wr_init_fail (
+        g_participant[0], &lpub, &ltopic[0], &lwr,
+        g_participant[1], &rsub, &rtopic[0], &rrd,
+        topic_name, exp_local_topic_fail, exp_wr_fail, exp_remote_topic_fail, false);
+      if (!exp_local_topic_fail && !exp_remote_topic_fail && !exp_wr_fail)
+        sync_writer_to_readers (g_participant[0], lwr, exp_wr_rd_sync_fail ? 0 : 1, DDS_SECS(2));
+
+      // Local reader, remote writer
+      create_topic_name (AC_WRAPPER_TOPIC_PREFIX, g_topic_nr++, topic_name, sizeof (topic_name));
+      rd_wr_init_fail (
+        g_participant[1], &rpub, &rtopic[1], &rwr,
+        g_participant[0], &lsub, &ltopic[1], &lrd,
+        topic_name, exp_remote_topic_fail, false, exp_local_topic_fail, exp_rd_fail);
+      if (!exp_local_topic_fail && !exp_remote_topic_fail && !exp_rd_fail)
+        sync_reader_to_writers (g_participant[0], lrd, exp_rd_wr_sync_fail ? 0 : 1, DDS_SECS(1));
+    }
+
+    access_control_fini (2, (void * []) { gov_topic_rule, gov_config }, 2);
   }
-
-  access_control_fini (2, NULL, 0);
 }
 
 #define na false
diff --git a/src/security/core/tests/common/access_control_wrapper.c b/src/security/core/tests/common/access_control_wrapper.c
index aead7e6..327dae3 100644
--- a/src/security/core/tests/common/access_control_wrapper.c
+++ b/src/security/core/tests/common/access_control_wrapper.c
@@ -33,26 +33,28 @@ enum ac_plugin_mode {
 enum ac_plugin_not_allowed {
   NOT_ALLOWED_ID_LOCAL_PP,
   NOT_ALLOWED_ID_LOCAL_TOPIC,
-  NOT_ALLOWED_ID_LOCAL_PUB,
-  NOT_ALLOWED_ID_LOCAL_SUB,
-  NOT_ALLOWED_ID_REMOTE_PERM,
+  NOT_ALLOWED_ID_LOCAL_WRITER,
+  NOT_ALLOWED_ID_LOCAL_READER,
+  NOT_ALLOWED_ID_LOCAL_PERM,
   NOT_ALLOWED_ID_REMOTE_PP,
   NOT_ALLOWED_ID_REMOTE_TOPIC,
   NOT_ALLOWED_ID_REMOTE_WRITER,
   NOT_ALLOWED_ID_REMOTE_READER,
-  NOT_ALLOWED_ID_REMOTE_READER_RELAY_ONLY
+  NOT_ALLOWED_ID_REMOTE_READER_RELAY_ONLY,
+  NOT_ALLOWED_ID_REMOTE_PERM,
 };
 
 #define NOT_ALLOWED_LOCAL_PP                      (1u << NOT_ALLOWED_ID_LOCAL_PP)
 #define NOT_ALLOWED_LOCAL_TOPIC                   (1u << NOT_ALLOWED_ID_LOCAL_TOPIC)
-#define NOT_ALLOWED_LOCAL_PUB                     (1u << NOT_ALLOWED_ID_LOCAL_PUB)
-#define NOT_ALLOWED_LOCAL_SUB                     (1u << NOT_ALLOWED_ID_LOCAL_SUB)
-#define NOT_ALLOWED_REMOTE_PERM                   (1u << NOT_ALLOWED_ID_REMOTE_PERM)
+#define NOT_ALLOWED_LOCAL_WRITER                  (1u << NOT_ALLOWED_ID_LOCAL_WRITER)
+#define NOT_ALLOWED_LOCAL_READER                  (1u << NOT_ALLOWED_ID_LOCAL_READER)
+#define NOT_ALLOWED_LOCAL_PERM                    (1u << NOT_ALLOWED_ID_LOCAL_PERM)
 #define NOT_ALLOWED_REMOTE_PP                     (1u << NOT_ALLOWED_ID_REMOTE_PP)
 #define NOT_ALLOWED_REMOTE_TOPIC                  (1u << NOT_ALLOWED_ID_REMOTE_TOPIC)
 #define NOT_ALLOWED_REMOTE_WRITER                 (1u << NOT_ALLOWED_ID_REMOTE_WRITER)
 #define NOT_ALLOWED_REMOTE_READER                 (1u << NOT_ALLOWED_ID_REMOTE_READER)
 #define NOT_ALLOWED_REMOTE_READER_RELAY_ONLY      (1u << NOT_ALLOWED_ID_REMOTE_READER_RELAY_ONLY)
+#define NOT_ALLOWED_REMOTE_PERM                   (1u << NOT_ALLOWED_ID_REMOTE_PERM)
 
 /**
  * Implementation structure for storing encapsulated members of the instance
@@ -76,8 +78,15 @@ static DDS_Security_PermissionsHandle validate_local_permissions(
   struct dds_security_access_control_impl *impl = (struct dds_security_access_control_impl *)instance;
   switch (impl->mode)
   {
-    case PLUGIN_MODE_WRAPPED:
     case PLUGIN_MODE_NOT_ALLOWED:
+      if (impl->not_allowed_mask & NOT_ALLOWED_LOCAL_PERM)
+      {
+        ex->code = 1;
+        ex->message = ddsrt_strdup ("not_allowed: validate_local_permissions");
+        return 0;
+      }
+      /* fall through */
+    case PLUGIN_MODE_WRAPPED:
       return impl->instance->validate_local_permissions(impl->instance, auth_plugin, identity, domain_id, participant_qos, ex);
 
     default:
@@ -154,7 +163,7 @@ static DDS_Security_boolean check_create_datawriter(
   switch (impl->mode)
   {
     case PLUGIN_MODE_NOT_ALLOWED:
-      if (impl->not_allowed_mask & NOT_ALLOWED_LOCAL_PUB)
+      if (impl->not_allowed_mask & NOT_ALLOWED_LOCAL_WRITER)
       {
         if (topic_name && strncmp (topic_name, AC_WRAPPER_TOPIC_PREFIX, strlen (AC_WRAPPER_TOPIC_PREFIX)) == 0)
         {
@@ -186,7 +195,7 @@ static DDS_Security_boolean check_create_datareader(
   switch (impl->mode)
   {
     case PLUGIN_MODE_NOT_ALLOWED:
-      if (impl->not_allowed_mask & NOT_ALLOWED_LOCAL_SUB)
+      if (impl->not_allowed_mask & NOT_ALLOWED_LOCAL_READER)
       {
         ex->code = 1;
         ex->message = ddsrt_strdup ("not_allowed: check_create_datareader");
@@ -838,14 +847,15 @@ int finalize_test_access_control_missing_func(void *context)
 
 INIT_NOT_ALLOWED(local_participant_not_allowed, NOT_ALLOWED_LOCAL_PP)
 INIT_NOT_ALLOWED(local_topic_not_allowed, NOT_ALLOWED_LOCAL_TOPIC)
-INIT_NOT_ALLOWED(local_publishing_not_allowed, NOT_ALLOWED_LOCAL_PUB)
-INIT_NOT_ALLOWED(local_subscribing_not_allowed, NOT_ALLOWED_LOCAL_SUB)
-INIT_NOT_ALLOWED(remote_permissions_invalidate, NOT_ALLOWED_REMOTE_PERM)
+INIT_NOT_ALLOWED(local_writer_not_allowed, NOT_ALLOWED_LOCAL_WRITER)
+INIT_NOT_ALLOWED(local_reader_not_allowed, NOT_ALLOWED_LOCAL_READER)
+INIT_NOT_ALLOWED(local_permissions_not_allowed, NOT_ALLOWED_LOCAL_PERM)
 INIT_NOT_ALLOWED(remote_participant_not_allowed, NOT_ALLOWED_REMOTE_PP)
 INIT_NOT_ALLOWED(remote_topic_not_allowed, NOT_ALLOWED_REMOTE_TOPIC)
 INIT_NOT_ALLOWED(remote_writer_not_allowed, NOT_ALLOWED_REMOTE_WRITER)
 INIT_NOT_ALLOWED(remote_reader_not_allowed, NOT_ALLOWED_REMOTE_READER)
 INIT_NOT_ALLOWED(remote_reader_relay_only, NOT_ALLOWED_REMOTE_READER_RELAY_ONLY)
+INIT_NOT_ALLOWED(remote_permissions_not_allowed, NOT_ALLOWED_REMOTE_PERM)
 
 int finalize_test_access_control_not_allowed(void *context)
 {
diff --git a/src/security/core/tests/common/access_control_wrapper.h b/src/security/core/tests/common/access_control_wrapper.h
index 3fb04bf..6f733fc 100644
--- a/src/security/core/tests/common/access_control_wrapper.h
+++ b/src/security/core/tests/common/access_control_wrapper.h
@@ -37,14 +37,15 @@ SECURITY_EXPORT int finalize_test_access_control_wrapped(void *context);
 
 INIT_NOT_ALLOWED_DECL(local_participant_not_allowed)
 INIT_NOT_ALLOWED_DECL(local_topic_not_allowed)
-INIT_NOT_ALLOWED_DECL(local_publishing_not_allowed)
-INIT_NOT_ALLOWED_DECL(local_subscribing_not_allowed)
-INIT_NOT_ALLOWED_DECL(remote_permissions_invalidate)
+INIT_NOT_ALLOWED_DECL(local_writer_not_allowed)
+INIT_NOT_ALLOWED_DECL(local_reader_not_allowed)
+INIT_NOT_ALLOWED_DECL(local_permissions_not_allowed)
 INIT_NOT_ALLOWED_DECL(remote_participant_not_allowed)
 INIT_NOT_ALLOWED_DECL(remote_topic_not_allowed)
 INIT_NOT_ALLOWED_DECL(remote_writer_not_allowed)
 INIT_NOT_ALLOWED_DECL(remote_reader_not_allowed)
 INIT_NOT_ALLOWED_DECL(remote_reader_relay_only)
+INIT_NOT_ALLOWED_DECL(remote_permissions_not_allowed)
 
 SECURITY_EXPORT int finalize_test_access_control_not_allowed(void *context);
 

From 155f8c059d560ee3cf75e991bf5f5a84465933dc Mon Sep 17 00:00:00 2001
From: Dennis Potman <dennis.potman@adlinktech.com>
Date: Wed, 29 Apr 2020 20:53:14 +0200
Subject: [PATCH 186/238] Add read-write protection tests

Introduced a test that checks for the correct matching behavious for  combinations
of the read/write access control settings in the governance xml (enable read/write
access control in the topic rules) and in the permissions xml (the publish/subscribe
grants for a topic).

Signed-off-by: Dennis Potman <dennis.potman@adlinktech.com>
---
 src/security/core/tests/access_control.c      | 123 ++++++++++++---
 src/security/core/tests/authentication.c      |   5 +-
 .../tests/common/security_config_test_utils.c | 142 +++++++++++++-----
 .../tests/common/security_config_test_utils.h |  14 +-
 4 files changed, 210 insertions(+), 74 deletions(-)

diff --git a/src/security/core/tests/access_control.c b/src/security/core/tests/access_control.c
index 4e5b54e..c508d55 100644
--- a/src/security/core/tests/access_control.c
+++ b/src/security/core/tests/access_control.c
@@ -90,6 +90,7 @@ static void access_control_init(
   CU_ASSERT_FATAL (n_nodes <= MAX_DOMAINS);
   for (size_t i = 0; i < n_nodes; i++)
   {
+    print_test_msg ("init domain %"PRIuSIZE"\n", i);
     struct kvp config_vars[] = {
       { "TEST_IDENTITY_CERTIFICATE", id_certs[i], 1 },
       { "TEST_IDENTITY_PRIVATE_KEY", id_keys[i], 1 },
@@ -256,10 +257,10 @@ CU_Theory(
 
   /* localtime will be converted to gmtime in get_permissions_grant */
   dds_time_t now = dds_time ();
-  char * perm_topic = get_permissions_topic (topic_name);
+  char * rules_xml = get_permissions_rules (NULL, topic_name, topic_name, NULL, NULL);
   char * grants[] = {
-    get_permissions_grant ("id1", id1_subj, NULL, now + DDS_SECS(perm1_not_before), now + DDS_SECS(perm1_not_after), perm_topic, perm_topic, NULL),
-    get_permissions_grant ("id2", id2_subj, NULL, now + DDS_SECS(perm2_not_before), now + DDS_SECS(perm2_not_after), perm_topic, perm_topic, NULL) };
+    get_permissions_grant ("id1", id1_subj, now + DDS_SECS(perm1_not_before), now + DDS_SECS(perm1_not_after), rules_xml, NULL),
+    get_permissions_grant ("id2", id2_subj, now + DDS_SECS(perm2_not_before), now + DDS_SECS(perm2_not_after), rules_xml, NULL) };
   char * perm_config = get_permissions_config (grants, 2, true);
   dds_sleepfor (DDS_MSECS (delay_perm));
 
@@ -285,7 +286,7 @@ CU_Theory(
     write_read_for (wr, g_participant[1], rd, DDS_MSECS (write_read_dur), false, exp_read_fail);
   }
 
-  access_control_fini (2, (void * []) { perm_topic, grants[0], grants[1], perm_config, ca, id1_subj, id2_subj, id1, id2 }, 9);
+  access_control_fini (2, (void * []) { rules_xml, grants[0], grants[1], perm_config, ca, id1_subj, id2_subj, id1, id2 }, 9);
 }
 
 
@@ -300,7 +301,7 @@ CU_Test(ddssec_access_control, permissions_expiry_multiple, .timeout=20)
 
   dds_time_t t_perm = dds_time ();
   char *ca = generate_ca ("ca1", TEST_IDENTITY_CA1_PRIVATE_KEY, 0, 3600);
-  char *perm_topic = get_permissions_topic (topic_name);
+  char *rules_xml = get_permissions_rules (NULL, topic_name, topic_name, NULL, NULL);
 
   // 1st node used as reader, other nodes as writer
   print_test_msg ("creating permissions grants\n");
@@ -323,7 +324,7 @@ CU_Test(ddssec_access_control, permissions_expiry_multiple, .timeout=20)
     dds_time_t t_exp = ddsrt_time_add_duration (t_perm, v);
     if (i >= N_RD)
       print_test_msg ("w[%d] grant expires at %d.%06d\n", i - N_RD, (int32_t) (t_exp / DDS_NSECS_IN_SEC), (int32_t) (t_exp % DDS_NSECS_IN_SEC) / 1000);
-    grants[i] = get_permissions_grant (id_name, id_subj[i], NULL, t_perm, t_exp, perm_topic, perm_topic, NULL);
+    grants[i] = get_permissions_grant (id_name, id_subj[i], t_perm, t_exp, rules_xml, NULL);
     ddsrt_free (id_name);
   }
 
@@ -427,7 +428,7 @@ CU_Test(ddssec_access_control, permissions_expiry_multiple, .timeout=20)
     ddsrt_free ((char *)id[i]);
   }
   ddsrt_free (ca);
-  ddsrt_free (perm_topic);
+  ddsrt_free (rules_xml);
   ddsrt_free (perm_config_str);
 }
 #undef N_RD
@@ -547,12 +548,12 @@ CU_Theory(
   id1 = generate_identity (ca, TEST_IDENTITY_CA1_PRIVATE_KEY, "id1", TEST_IDENTITY1_PRIVATE_KEY, 0, 3600, &id1_subj);
   id2 = generate_identity (ca, TEST_IDENTITY_CA1_PRIVATE_KEY, "id2", TEST_IDENTITY1_PRIVATE_KEY, 0, 3600, &id2_subj);
 
-  /* localtime will be converted to gmtime in get_permissions_grant */
   dds_time_t now = dds_time ();
-  char * perm_topic = get_permissions_topic (topic_name);
+  char * rules1_xml = get_permissions_rules (perm_inv_pp1 ? "99" : NULL, topic_name, topic_name, NULL, NULL);
+  char * rules2_xml = get_permissions_rules (perm_inv_pp2 ? "99" : NULL, topic_name, topic_name, NULL, NULL);
   char * grants[] = {
-    get_permissions_grant ("id1", id1_subj, perm_inv_pp1 ? "99" : NULL, now, now + DDS_SECS(3600), perm_topic, perm_topic, NULL),
-    get_permissions_grant ("id2", id2_subj, perm_inv_pp2 ? "99" : NULL, now, now + DDS_SECS(3600), perm_topic, perm_topic, NULL) };
+    get_permissions_grant ("id1", id1_subj, now, now + DDS_SECS(3600), rules1_xml, NULL),
+    get_permissions_grant ("id2", id2_subj, now, now + DDS_SECS(3600), rules2_xml, NULL) };
   char * perm_config = get_permissions_config (grants, 2, true);
 
   char * gov_topic_rule = get_governance_topic_rule ("*", false, false, true, true, "NONE", "NONE");
@@ -573,7 +574,7 @@ CU_Theory(
   if (!exp_pp1_fail && !exp_pp2_fail)
     validate_handshake (DDS_DOMAINID, exp_hs_fail, NULL, NULL, NULL, DDS_SECS(2));
 
-  access_control_fini (2, (void * []) { gov_config_pp1, gov_config_pp2, gov_topic_rule, perm_topic, grants[0], grants[1], perm_config, ca, id1_subj, id2_subj, id1, id2 }, 12);
+  access_control_fini (2, (void * []) { gov_config_pp1, gov_config_pp2, gov_topic_rule, rules1_xml, rules2_xml, grants[0], grants[1], perm_config, ca, id1_subj, id2_subj, id1, id2 }, 13);
 }
 
 #define na false
@@ -618,12 +619,9 @@ static void test_discovery_liveliness_protection(enum test_discovery_liveliness
   id1 = generate_identity (ca, TEST_IDENTITY_CA1_PRIVATE_KEY, "id1", TEST_IDENTITY1_PRIVATE_KEY, 0, 3600, &id1_subj);
   id2 = generate_identity (ca, TEST_IDENTITY_CA1_PRIVATE_KEY, "id2", TEST_IDENTITY1_PRIVATE_KEY, 0, 3600, &id2_subj);
 
-  /* localtime will be converted to gmtime in get_permissions_grant */
-  dds_time_t now = dds_time ();
-  char * perm_topic = get_permissions_topic (topic_name);
   char * grants[] = {
-    get_permissions_grant ("id1", id1_subj, NULL, now, now + DDS_SECS(3600), perm_topic, perm_topic, NULL),
-    get_permissions_grant ("id2", id2_subj, NULL, now, now + DDS_SECS(3600), perm_topic, perm_topic, NULL) };
+    get_permissions_default_grant ("id1", id1_subj, topic_name),
+    get_permissions_default_grant ("id2", id2_subj, topic_name) };
   char * perm_config = get_permissions_config (grants, 2, true);
 
   char * gov_topic_rule1 = get_governance_topic_rule (topic_name, dp && enable_protection_pp1, lp && enable_protection_pp1, true, true, "ENCRYPT", "NONE");
@@ -667,7 +665,7 @@ static void test_discovery_liveliness_protection(enum test_discovery_liveliness
     ddsrt_free (log);
   }
 
-  access_control_fini (2, (void * []) { gov_config1, gov_config2, gov_topic_rule1, gov_topic_rule2, perm_topic, grants[0], grants[1], perm_config, ca, id1_subj, id2_subj, id1, id2 }, 13);
+  access_control_fini (2, (void * []) { gov_config1, gov_config2, gov_topic_rule1, gov_topic_rule2, grants[0], grants[1], perm_config, ca, id1_subj, id2_subj, id1, id2 }, 12);
 }
 
 CU_Theory(
@@ -702,12 +700,9 @@ static void test_encoding_mismatch(
   id1 = generate_identity (ca, TEST_IDENTITY_CA1_PRIVATE_KEY, "id1", TEST_IDENTITY1_PRIVATE_KEY, 0, 3600, &id1_subj);
   id2 = generate_identity (ca, TEST_IDENTITY_CA1_PRIVATE_KEY, "id2", TEST_IDENTITY1_PRIVATE_KEY, 0, 3600, &id2_subj);
 
-  /* localtime will be converted to gmtime in get_permissions_grant */
-  dds_time_t now = dds_time ();
-  char * perm_topic = get_permissions_topic (topic_name);
   char * grants[] = {
-    get_permissions_grant ("id1", id1_subj, NULL, now, now + DDS_SECS(3600), perm_topic, perm_topic, NULL),
-    get_permissions_grant ("id2", id2_subj, NULL, now, now + DDS_SECS(3600), perm_topic, perm_topic, NULL) };
+    get_permissions_default_grant ("id1", id1_subj, topic_name),
+    get_permissions_default_grant ("id2", id2_subj, topic_name) };
   char * perm_config = get_permissions_config (grants, 2, true);
 
   char * gov_topic_rule1 = get_governance_topic_rule (topic_name, true, true, true, true, pk_to_str (metadata_pk1), bpk_to_str (payload_pk1));
@@ -739,7 +734,7 @@ static void test_encoding_mismatch(
     sync_writer_to_readers (g_participant[0], wr, exp_rd_wr_fail ? 0 : 1, DDS_SECS(1));
   }
 
-  access_control_fini (2, (void * []) { gov_config1, gov_config2, gov_topic_rule1, gov_topic_rule2, perm_topic, grants[0], grants[1], perm_config, ca, id1_subj, id2_subj, id1, id2 }, 13);
+  access_control_fini (2, (void * []) { gov_config1, gov_config2, gov_topic_rule1, gov_topic_rule2, grants[0], grants[1], perm_config, ca, id1_subj, id2_subj, id1, id2 }, 12);
 }
 
 static DDS_Security_ProtectionKind pk[] = { PK_N, PK_S, PK_E, PK_SOA, PK_EOA };
@@ -779,3 +774,83 @@ CU_Test(ddssec_access_control, encoding_mismatch_payload, .timeout=30)
     for (size_t pk2 = pk1 + 1; pk2 < sizeof (bpk) / sizeof (bpk[0]); pk2++)
       test_encoding_mismatch (false, pk1 != pk2, PK_N, PK_N, PK_N, PK_N, PK_N, PK_N, PK_N, PK_N, bpk[pk1], bpk[pk2]);
 }
+
+
+static void test_readwrite_protection (
+  bool allow_pub, bool allow_sub, bool deny_pub, bool deny_sub, bool write_ac, bool read_ac,
+  bool exp_pub_pp_fail, bool exp_pub_tp_fail, bool exp_wr_fail,
+  bool exp_sub_pp_fail, bool exp_sub_tp_fail, bool exp_rd_fail,
+  bool exp_sync_fail, const char * default_policy)
+{
+  print_test_msg ("running test readwrite_protection: \n");
+  print_test_msg ("- allow_pub=%d | allow_sub=%d | deny_pub=%d | deny_sub=%d | write_ac=%d | read_ac=%d | default_policy=%s\n", allow_pub, allow_sub, deny_pub, deny_sub, write_ac, read_ac, default_policy);
+  print_test_msg ("- exp_pub_pp_fail=%d | exp_pub_tp_fail=%d | exp_wr_fail=%d | exp_sub_pp_fail=%d | exp_sub_tp_fail=%d | exp_rd_fail=%d | exp_sync_fail=%d\n", exp_pub_pp_fail, exp_pub_tp_fail, exp_wr_fail, exp_sub_pp_fail, exp_sub_tp_fail, exp_rd_fail, exp_sync_fail);
+
+  char topic_name[100];
+  create_topic_name ("ddssec_access_control_", g_topic_nr++, topic_name, sizeof (topic_name));
+
+  /* create ca and id1/id2 certs that will not expire during this test */
+  char *ca, *id1, *id2, *id1_subj, *id2_subj;
+  ca = generate_ca ("ca1", TEST_IDENTITY_CA1_PRIVATE_KEY, 0, 3600);
+  id1 = generate_identity (ca, TEST_IDENTITY_CA1_PRIVATE_KEY, "id1", TEST_IDENTITY1_PRIVATE_KEY, 0, 3600, &id1_subj);
+  id2 = generate_identity (ca, TEST_IDENTITY_CA1_PRIVATE_KEY, "id2", TEST_IDENTITY1_PRIVATE_KEY, 0, 3600, &id2_subj);
+
+  dds_time_t now = dds_time ();
+  char * rules_xml = get_permissions_rules (NULL, allow_pub ? topic_name : NULL, allow_sub ? topic_name : NULL, deny_pub ? topic_name : NULL, deny_sub ? topic_name : NULL);
+  char * grants[] = {
+    get_permissions_grant ("id1", id1_subj, now, now + DDS_SECS(3600), rules_xml, default_policy),
+    get_permissions_grant ("id2", id2_subj, now, now + DDS_SECS(3600), rules_xml, default_policy) };
+  char * perm_config = get_permissions_config (grants, 2, true);
+
+  char * gov_topic_rule = get_governance_topic_rule (topic_name, false, false, read_ac, write_ac, pk_to_str (PK_E), bpk_to_str (BPK_E));
+  char * gov_config = get_governance_config (false, true, NULL, NULL, NULL, gov_topic_rule, true);
+  const char * def_perm_ca = PF_F COMMON_ETC_PATH("default_permissions_ca.pem");
+
+  access_control_init (
+      2,
+      (const char *[]) { id1, id2 },
+      (const char *[]) { TEST_IDENTITY1_PRIVATE_KEY, TEST_IDENTITY1_PRIVATE_KEY },
+      (const char *[]) { ca, ca },
+      (bool []) { exp_pub_pp_fail, exp_sub_pp_fail }, NULL, NULL,
+      (bool []) { true, true }, (const char *[]) { gov_config, gov_config },
+      (bool []) { true, true }, (const char *[]) { perm_config, perm_config },
+      (bool []) { true, true }, (const char *[]) { def_perm_ca, def_perm_ca });
+
+  if (!exp_pub_pp_fail && !exp_sub_pp_fail)
+  {
+    dds_entity_t pub, sub, pub_tp, sub_tp, wr, rd;
+    validate_handshake_nofail (DDS_DOMAINID, DDS_MSECS(500));
+    rd_wr_init_fail (g_participant[0], &pub, &pub_tp, &wr, g_participant[1], &sub, &sub_tp, &rd, topic_name, exp_pub_tp_fail, exp_wr_fail, exp_sub_tp_fail, exp_rd_fail);
+    if (!exp_pub_tp_fail && !exp_wr_fail && !exp_sub_tp_fail && !exp_rd_fail)
+      sync_writer_to_readers (g_participant[0], wr, exp_sync_fail ? 0 : 1, DDS_SECS(1));
+  }
+
+  access_control_fini (2, (void * []) { gov_config, gov_topic_rule, rules_xml, grants[0], grants[1], perm_config, ca, id1_subj, id2_subj, id1, id2 }, 11);
+}
+
+CU_Test(ddssec_access_control, readwrite_protection, .timeout=60)
+{
+  for (int allow_pub = 0; allow_pub <= 1; allow_pub++)
+    for (int allow_sub = 0; allow_sub <= 1; allow_sub++)
+      for (int deny_pub = 0; deny_pub <= 1 && !(allow_pub && deny_pub); deny_pub++)
+        for (int deny_sub = 0; deny_sub <= 1 && !(allow_sub && deny_sub); deny_sub++)
+          for (int write_ac = 0; write_ac <= 1; write_ac++)
+            for (int read_ac = 0; read_ac <= 1; read_ac++)
+              for (int default_deny = 0; default_deny <= 1; default_deny++)
+              {
+                /* creating local writer/reader fails if write_ac/read_ac enabled and no allow-pub/sub or a deny-pub/sub rule exists */
+                bool exp_wr_fail = write_ac && !allow_pub && (deny_pub || default_deny);
+                bool exp_rd_fail = read_ac && !allow_sub && (deny_sub || default_deny);
+                /* if both read_ac and write_ac are enabled, and pub and sub not allowed, topic creation should fail */
+                bool exp_tp_fail = write_ac && read_ac && !allow_pub && !allow_sub && (deny_pub || deny_sub || default_deny);
+                /* participant creation should fail under same conditions as topic creation (as opposed to the DDS Security spec,
+                  table 63, that states that participant creation fails when there is not any topic that has enable_read/write_ac
+                  set to false and join_ac is enabled; it seems that the allow_rule condition is missing there) */
+                bool exp_pp_fail = write_ac && read_ac && !allow_pub && !allow_sub && default_deny;
+                /* join-ac is enabled in this test, so check_remote_pp fails (and therefore the reader/writer sync) in case not any allow rule exists */
+                bool exp_sync_fail = !allow_pub && !allow_sub && default_deny;
+
+                test_readwrite_protection (allow_pub, allow_sub, deny_pub, deny_sub, write_ac, read_ac,
+                  exp_pp_fail, exp_tp_fail, exp_wr_fail, exp_pp_fail, exp_tp_fail, exp_rd_fail, exp_sync_fail, default_deny ? "DENY" : "ALLOW");
+              }
+}
diff --git a/src/security/core/tests/authentication.c b/src/security/core/tests/authentication.c
index bbfb69b..07d637e 100644
--- a/src/security/core/tests/authentication.c
+++ b/src/security/core/tests/authentication.c
@@ -263,10 +263,9 @@ CU_Theory(
   id2 = generate_identity (ca, CA1K, "id2", ID1K, id2_not_before, id2_not_after, &id2_subj);
   dds_sleepfor (DDS_MSECS (delay));
 
-  dds_time_t now = dds_time ();
   char * grants[] = {
-    get_permissions_grant ("id1", id1_subj, NULL, now - DDS_SECS(D(1)), now + DDS_SECS(D(1)), NULL, NULL, NULL),
-    get_permissions_grant ("id2", id2_subj, NULL, now - DDS_SECS(D(1)), now + DDS_SECS(D(1)), NULL, NULL, NULL) };
+    get_permissions_default_grant ("id1", id1_subj, topic_name),
+    get_permissions_default_grant ("id2", id2_subj, topic_name) };
   char * perm_config = get_permissions_config (grants, 2, true);
   authentication_init (id1, ID1K, ca, id2, ID1K, ca, NULL, perm_config, id1_local_fail, id2_local_fail);
   validate_handshake (DDS_DOMAINID1, id1_local_fail, NULL, NULL, NULL, DDS_SECS(2));
diff --git a/src/security/core/tests/common/security_config_test_utils.c b/src/security/core/tests/common/security_config_test_utils.c
index 74f3e5e..8c46848 100644
--- a/src/security/core/tests/common/security_config_test_utils.c
+++ b/src/security/core/tests/common/security_config_test_utils.c
@@ -27,6 +27,7 @@
 #include "dds/ddsrt/string.h"
 #include "dds/ddsrt/io.h"
 #include "common/config_env.h"
+#include "common/test_utils.h"
 #include "security_config_test_utils.h"
 
 static const char *topic_rule =
@@ -63,24 +64,37 @@ static const char *governance_xml =
     "  </domain_access_rules>"
     "</dds>";
 
-static const char *topic_xml =
-    "<topic>${TOPIC_NAME}</topic>";
+static const char *permissions_xml_pub =
+    "        <publish>"
+    "          <topics><topic>${TOPIC_NAME}</topic></topics>"
+    "          <partitions><partition>*</partition></partitions>"
+    "        </publish>";
+
+static const char *permissions_xml_sub =
+    "        <subscribe>"
+    "          <topics><topic>${TOPIC_NAME}</topic></topics>"
+    "          <partitions><partition>*</partition></partitions>"
+    "        </subscribe>";
+
+static const char *permissions_xml_allow_rule =
+    "      <allow_rule>"
+    "        <domains>${DOMAIN_ID:+<id>}${DOMAIN_ID:-<id_range><min>0</min><max>230</max></id_range>}${DOMAIN_ID:+</id>}</domains>"
+    "        ${PUBLISH}"
+    "        ${SUBSCRIBE}"
+    "      </allow_rule>";
+
+static const char *permissions_xml_deny_rule =
+    "      <deny_rule>"
+    "        <domains>${DOMAIN_ID:+<id>}${DOMAIN_ID:-<id_range><min>0</min><max>230</max></id_range>}${DOMAIN_ID:+</id>}</domains>"
+    "        ${PUBLISH}"
+    "        ${SUBSCRIBE}"
+    "      </deny_rule>";
 
 static const char *permissions_xml_grant =
     "    <grant name=\"${GRANT_NAME}\">"
     "      <subject_name>${SUBJECT_NAME}</subject_name>"
     "      <validity><not_before>${NOT_BEFORE:-2015-09-15T01:00:00}</not_before><not_after>${NOT_AFTER:-2115-09-15T01:00:00}</not_after></validity>"
-    "      <allow_rule>"
-    "        <domains>${DOMAIN_ID:+<id>}${DOMAIN_ID:-<id_range><min>0</min><max>230</max></id_range>}${DOMAIN_ID:+</id>}</domains>"
-    "        <publish>"
-    "          <topics>${PUB_TOPICS:-<topic>*</topic>}</topics>"
-    "          <partitions><partition>*</partition></partitions>"
-    "        </publish>"
-    "        <subscribe>"
-    "          <topics>${SUB_TOPICS:-<topic>*</topic>}</topics>"
-    "          <partitions><partition>*</partition></partitions>"
-    "        </subscribe>"
-    "      </allow_rule>"
+    "      ${RULES}"
     "      <default>${DEFAULT_POLICY:-DENY}</default>"
     "    </grant>";
 
@@ -130,6 +144,20 @@ int32_t expand_lookup_unmatched (const struct kvp * lookup_table)
   return unmatched;
 }
 
+static char * get_xml_datetime(dds_time_t t, char * buf, size_t len)
+{
+  struct tm tm;
+  time_t sec = (time_t)(t / DDS_NSECS_IN_SEC);
+#if _WIN32
+  (void)gmtime_s(&tm, &sec);
+#else
+  (void)gmtime_r(&sec, &tm);
+#endif /* _WIN32 */
+
+  strftime(buf, len, "%FT%TZ", &tm);
+  return buf;
+}
+
 static char * smime_sign(char * ca_cert_path, char * ca_priv_key_path, const char * data)
 {
   // Read CA certificate
@@ -232,7 +260,7 @@ char * get_governance_topic_rule(const char * topic_expr, bool discovery_protect
   return ddsrt_expand_vars (topic_rule, &expand_lookup_vars, vars);
 }
 
-char * get_governance_config(bool allow_unauth_pp, bool enable_join_ac, const char * discovery_protection_kind, const char * liveliness_protection_kind,
+char * get_governance_config (bool allow_unauth_pp, bool enable_join_ac, const char * discovery_protection_kind, const char * liveliness_protection_kind,
     const char * rtps_protection_kind, const char * topic_rules, bool add_prefix)
 {
   struct kvp vars[] = {
@@ -248,57 +276,89 @@ char * get_governance_config(bool allow_unauth_pp, bool enable_join_ac, const ch
   char * config_signed = get_signed_data (config);
   ddsrt_free (config);
 
-  printf("Governance configuration: ");
-  print_config_vars(vars);
+  print_test_msg ("governance configuration: ");
+  print_config_vars (vars);
   printf("\n");
 
   return prefix_data (config_signed, add_prefix);
 }
 
-
-char * get_permissions_topic(const char * name)
+static char * expand_permissions_pubsub (const char * template, const char * topic_name)
 {
   struct kvp vars[] = {
-    { "TOPIC_NAME", name, 1 },
+    { "TOPIC_NAME", topic_name, 1 },
     { NULL, NULL, 0 }
   };
-  return ddsrt_expand_vars (topic_xml, &expand_lookup_vars, vars);
+  return ddsrt_expand_vars (template, &expand_lookup_vars, vars);
 }
 
-static char * get_xml_datetime(dds_time_t t, char * buf, size_t len)
+static char * expand_permissions_rule (const char * template, const char * domain_id, const char * pub_xml, const char * sub_xml)
 {
-  struct tm tm;
-  time_t sec = (time_t)(t / DDS_NSECS_IN_SEC);
-#if _WIN32
-  (void)gmtime_s(&tm, &sec);
-#else
-  (void)gmtime_r(&sec, &tm);
-#endif /* _WIN32 */
-
-  strftime(buf, len, "%FT%TZ", &tm);
-  return buf;
+  struct kvp vars[] = {
+    { "DOMAIN_ID", domain_id, 3 },
+    { "PUBLISH", pub_xml, 1 },
+    { "SUBSCRIBE", sub_xml, 1 },
+    { NULL, NULL, 0 }
+  };
+  return ddsrt_expand_vars (template, &expand_lookup_vars, vars);
 }
 
-char * get_permissions_grant(const char * name, const char * subject, const char * domain_id,
-    dds_time_t not_before, dds_time_t not_after, const char * pub_topics, const char * sub_topics, const char * default_policy)
+char * get_permissions_rules (const char * domain_id, const char * allow_pub_topic, const char * allow_sub_topic, const char * deny_pub_topic, const char * deny_sub_topic)
+{
+  char * allow_pub_xml = NULL, * allow_sub_xml = NULL, * deny_pub_xml = NULL, * deny_sub_xml = NULL;
+  char * allow_rule_xml = NULL, * deny_rule_xml = NULL, * rules_xml;
+
+  if (allow_pub_topic != NULL) allow_pub_xml = expand_permissions_pubsub (permissions_xml_pub, allow_pub_topic);
+  if (allow_sub_topic != NULL) allow_sub_xml = expand_permissions_pubsub (permissions_xml_sub, allow_sub_topic);
+  if (deny_pub_topic != NULL) deny_pub_xml = expand_permissions_pubsub (permissions_xml_pub, deny_pub_topic);
+  if (deny_sub_topic != NULL) deny_sub_xml = expand_permissions_pubsub (permissions_xml_sub, deny_sub_topic);
+
+  if (allow_pub_xml != NULL || allow_sub_xml != NULL)
+  {
+    allow_rule_xml = expand_permissions_rule (permissions_xml_allow_rule, domain_id, allow_pub_xml, allow_sub_xml);
+    if (allow_pub_xml != NULL) ddsrt_free (allow_pub_xml);
+    if (allow_sub_xml != NULL) ddsrt_free (allow_sub_xml);
+  }
+  if (deny_pub_xml != NULL || deny_sub_xml != NULL)
+  {
+    deny_rule_xml = expand_permissions_rule (permissions_xml_deny_rule, domain_id, deny_pub_xml, deny_sub_xml);
+    if (deny_pub_xml != NULL) ddsrt_free (deny_pub_xml);
+    if (deny_sub_xml != NULL) ddsrt_free (deny_sub_xml);
+  }
+  ddsrt_asprintf (&rules_xml, "%s%s", allow_rule_xml != NULL ? allow_rule_xml : "", deny_rule_xml != NULL ? deny_rule_xml : "");
+  if (allow_rule_xml != NULL) ddsrt_free (allow_rule_xml);
+  if (deny_rule_xml != NULL) ddsrt_free (deny_rule_xml);
+  return rules_xml;
+}
+
+char * get_permissions_grant (const char * grant_name, const char * subject_name, dds_time_t not_before, dds_time_t not_after, const char * rules_xml, const char * default_policy)
 {
   char not_before_str[] = "0000-00-00T00:00:00Z";
   char not_after_str[] = "0000-00-00T00:00:00Z";
-  get_xml_datetime(not_before, not_before_str, sizeof(not_before_str));
-  get_xml_datetime(not_after, not_after_str, sizeof(not_after_str));
+  get_xml_datetime (not_before, not_before_str, sizeof(not_before_str));
+  get_xml_datetime (not_after, not_after_str, sizeof(not_after_str));
 
   struct kvp vars[] = {
-    { "GRANT_NAME", name, 1 },
-    { "SUBJECT_NAME", subject, 1 },
+    { "GRANT_NAME", grant_name, 1 },
+    { "SUBJECT_NAME", subject_name, 1 },
     { "NOT_BEFORE", not_before_str, 1 },
     { "NOT_AFTER", not_after_str, 1 },
-    { "DOMAIN_ID", domain_id, 3 },
-    { "PUB_TOPICS", pub_topics, 1 },
-    { "SUB_TOPICS", sub_topics, 1 },
+    { "RULES", rules_xml, 1 },
     { "DEFAULT_POLICY", default_policy, 1 },
     { NULL, NULL, 0 }
   };
-  return ddsrt_expand_vars (permissions_xml_grant, &expand_lookup_vars, vars);
+  char * res = ddsrt_expand_vars (permissions_xml_grant, &expand_lookup_vars, vars);
+  CU_ASSERT_FATAL (expand_lookup_unmatched (vars) == 0);
+  return res;
+}
+
+char * get_permissions_default_grant (const char * grant_name, const char * subject_name, const char * topic_name)
+{
+  dds_time_t now = dds_time ();
+  char * rules_xml = get_permissions_rules (NULL, topic_name, topic_name, NULL, NULL);
+  char * grant_xml = get_permissions_grant (grant_name, subject_name, now, now + DDS_SECS(3600), rules_xml, "DENY");
+  ddsrt_free (rules_xml);
+  return grant_xml;
 }
 
 char * get_permissions_config(char * grants[], size_t ngrants, bool add_prefix)
diff --git a/src/security/core/tests/common/security_config_test_utils.h b/src/security/core/tests/common/security_config_test_utils.h
index 770c979..e70b98e 100644
--- a/src/security/core/tests/common/security_config_test_utils.h
+++ b/src/security/core/tests/common/security_config_test_utils.h
@@ -25,14 +25,16 @@ const char * expand_lookup_vars (const char *name, void * data);
 const char * expand_lookup_vars_env (const char *name, void * data);
 int32_t expand_lookup_unmatched (const struct kvp * lookup_table);
 
-char * get_governance_topic_rule(const char * topic_expr, bool discovery_protection, bool liveliness_protection,
+char * get_governance_topic_rule (const char * topic_expr, bool discovery_protection, bool liveliness_protection,
     bool read_ac, bool write_ac, const char * metadata_protection_kind, const char * data_protection_kind);
-char * get_governance_config(bool allow_unauth_pp, bool enable_join_ac, const char * discovery_protection_kind, const char * liveliness_protection_kind,
+char * get_governance_config (bool allow_unauth_pp, bool enable_join_ac, const char * discovery_protection_kind, const char * liveliness_protection_kind,
     const char * rtps_protection_kind, const char * topic_rules, bool add_prefix);
 
-char * get_permissions_topic(const char * name);
-char * get_permissions_grant(const char * name, const char * subject, const char * domain_id,
-    dds_time_t not_before, dds_time_t not_after, const char * pub_topics, const char * sub_topics, const char * default_policy);
-char * get_permissions_config(char * grants[], size_t ngrants, bool add_prefix);
+char * get_permissions_rules (const char * domain_id, const char * allow_pub_topic, const char * allow_sub_topic,
+    const char * deny_pub_topic, const char * deny_sub_topic);
+char * get_permissions_grant (const char * grant_name, const char * subject_name, dds_time_t not_before, dds_time_t not_after,
+    const char * rules_xml, const char * default_policy);
+char * get_permissions_default_grant (const char * grant_name, const char * subject_name, const char * topic_name);
+char * get_permissions_config (char * grants[], size_t ngrants, bool add_prefix);
 
 #endif /* SECURITY_CORE_TEST_SECURITY_CONFIG_TEST_UTILS_H_ */

From 2fc2cdc22533047dc93000fe502d4edb3956f5f4 Mon Sep 17 00:00:00 2001
From: Dennis Potman <dennis.potman@adlinktech.com>
Date: Mon, 11 May 2020 21:33:47 +0200
Subject: [PATCH 187/238] Enable matching local non-secure participants with
 remote secure participants that allow unauthenticated participants

Signed-off-by: Dennis Potman <dennis.potman@adlinktech.com>
---
 src/core/ddsi/src/q_entity.c | 22 +++++++++++-----------
 1 file changed, 11 insertions(+), 11 deletions(-)

diff --git a/src/core/ddsi/src/q_entity.c b/src/core/ddsi/src/q_entity.c
index c1f4573..b8858ca 100644
--- a/src/core/ddsi/src/q_entity.c
+++ b/src/core/ddsi/src/q_entity.c
@@ -4774,21 +4774,21 @@ void handshake_end_cb(struct ddsi_handshake *handshake, struct participant *pp,
   }
 }
 
-static int proxy_participant_check_security_info(struct ddsi_domaingv *gv, struct proxy_participant *proxypp)
+static bool proxy_participant_has_pp_match(struct ddsi_domaingv *gv, struct proxy_participant *proxypp)
 {
-  int r = 0;
+  bool match = false;
   struct participant *pp;
   struct entidx_enum_participant est;
 
   entidx_enum_participant_init (&est, gv->entity_index);
-  while (((pp = entidx_enum_participant_next (&est)) != NULL) && (r == 0)) {
-    if (q_omg_is_similar_participant_security_info(pp, proxypp)) {
-      r = 1;
-      break;
-    }
+  while ((pp = entidx_enum_participant_next (&est)) != NULL && !match)
+  {
+    /* remote secure pp can possibly match with local non-secured pp in case allow-unauthenticated pp
+       is enabled in the remote pp's security settings */
+    match = !q_omg_participant_is_secure (pp) || q_omg_is_similar_participant_security_info (pp, proxypp);
   }
-  entidx_enum_participant_fini(&est);
-  return r;
+  entidx_enum_participant_fini (&est);
+  return match;
 }
 
 static void proxy_participant_create_handshakes(struct ddsi_domaingv *gv, struct proxy_participant *proxypp)
@@ -4955,9 +4955,9 @@ void new_proxy_participant (struct ddsi_domaingv *gv, const struct ddsi_guid *pp
   {
     q_omg_security_init_remote_participant (proxypp);
     /* check if the proxy participant has a match with a local participant */
-    if (!proxy_participant_check_security_info (gv, proxypp))
+    if (!proxy_participant_has_pp_match (gv, proxypp))
     {
- //     GVWARNING ("Remote secure participant "PGUIDFMT" not allowed\n", PGUID (*ppguid));
+      GVWARNING ("Remote secure participant "PGUIDFMT" not allowed\n", PGUID (*ppguid));
       free_proxy_participant (proxypp);
       return;
     }

From 6185a5ab2a0092f0cbc1a6ad8410e4229276f6a4 Mon Sep 17 00:00:00 2001
From: Dennis Potman <dennis.potman@adlinktech.com>
Date: Mon, 11 May 2020 21:37:13 +0200
Subject: [PATCH 188/238] Add a test to validate that a non-secure participant
 can connect with a secure participant that allows unauthenticated
 participants. The non-secure pp should only be able to read data for a topic
 that is not secured

Signed-off-by: Dennis Potman <dennis.potman@adlinktech.com>
---
 src/security/core/tests/access_control.c      |  70 ++-----
 src/security/core/tests/authentication.c      | 176 ++++++++++++------
 .../tests/common/security_config_test_utils.c |  18 +-
 .../tests/common/security_config_test_utils.h |   6 +-
 src/security/core/tests/common/test_utils.c   |  34 ++++
 src/security/core/tests/common/test_utils.h   |   5 +
 .../core/tests/secure_communication.c         |   5 +-
 7 files changed, 182 insertions(+), 132 deletions(-)

diff --git a/src/security/core/tests/access_control.c b/src/security/core/tests/access_control.c
index c508d55..ea08591 100644
--- a/src/security/core/tests/access_control.c
+++ b/src/security/core/tests/access_control.c
@@ -23,8 +23,6 @@
 #include "dds/ddsrt/heap.h"
 #include "dds/ddsrt/io.h"
 #include "dds/ddsrt/string.h"
-#include "dds/ddsi/q_entity.h"
-#include "dds/ddsi/ddsi_entity_index.h"
 #include "dds/ddsi/ddsi_security_omg.h"
 #include "dds/ddsi/q_config.h"
 #include "dds/ddsi/ddsi_domaingv.h"
@@ -72,9 +70,6 @@ static const char *config =
 #define MAX_DOMAINS 10
 #define DDS_DOMAINID 0
 
-#define PF_F "file:"
-#define PF_D "data:,"
-
 static dds_entity_t g_domain[MAX_DOMAINS];
 static dds_entity_t g_participant[MAX_DOMAINS];
 static uint32_t g_topic_nr = 0;
@@ -125,41 +120,6 @@ static void access_control_fini(size_t n, void * res[], size_t nres)
   }
 }
 
-static DDS_Security_DatawriterCryptoHandle get_builtin_writer_crypto_handle(dds_entity_t participant, unsigned entityid)
-{
-  DDS_Security_DatawriterCryptoHandle crypto_handle;
-  struct dds_entity *pp_entity;
-  struct participant *pp;
-  struct writer *wr;
-  CU_ASSERT_EQUAL_FATAL(dds_entity_pin(participant, &pp_entity), 0);
-  thread_state_awake(lookup_thread_state(), &pp_entity->m_domain->gv);
-  pp = entidx_lookup_participant_guid(pp_entity->m_domain->gv.entity_index, &pp_entity->m_guid);
-  wr = get_builtin_writer(pp, entityid);
-  CU_ASSERT_FATAL(wr != NULL);
-  assert(wr != NULL); /* for Clang's static analyzer */
-  crypto_handle = wr->sec_attr->crypto_handle;
-  thread_state_asleep(lookup_thread_state());
-  dds_entity_unpin(pp_entity);
-  return crypto_handle;
-}
-
-// static DDS_Security_DatawriterCryptoHandle get_writer_crypto_handle(dds_entity_t writer)
-// {
-//   DDS_Security_DatawriterCryptoHandle crypto_handle;
-//   struct dds_entity *wr_entity;
-//   struct writer *wr;
-//   CU_ASSERT_EQUAL_FATAL(dds_entity_pin(writer, &wr_entity), 0);
-//   thread_state_awake(lookup_thread_state(), &wr_entity->m_domain->gv);
-//   wr = entidx_lookup_writer_guid(wr_entity->m_domain->gv.entity_index, &wr_entity->m_guid);
-//   CU_ASSERT_FATAL(wr != NULL);
-//   assert(wr != NULL); /* for Clang's static analyzer */
-//   crypto_handle = wr->sec_attr->crypto_handle;
-//   thread_state_asleep(lookup_thread_state());
-//   dds_entity_unpin(wr_entity);
-//   return crypto_handle;
-// }
-
-
 #define GOV_F PF_F COMMON_ETC_PATH("default_governance.p7s")
 #define GOV_FNE PF_F COMMON_ETC_PATH("default_governance_non_existing.p7s")
 #define GOV_DI PF_D COMMON_ETC_PATH("default_governance.p7s")
@@ -469,8 +429,8 @@ CU_Theory(
     bool discovery_protection = (i == 0);
     print_test_msg ("running test access_control_hooks: %s with discovery protection %s\n", init_fn, discovery_protection ? "enabled" : "disabled");
 
-    char * gov_topic_rule = get_governance_topic_rule ("*", discovery_protection, false, true, true, NULL, NULL);
-    char * gov_config = get_governance_config (false, true, "ENCRYPT", NULL, NULL, gov_topic_rule, true);
+    char * gov_topic_rule = get_governance_topic_rule ("*", discovery_protection, false, true, true, PK_N, BPK_N);
+    char * gov_config = get_governance_config (false, true, PK_E, PK_N, PK_N, gov_topic_rule, true);
 
     const char * def_perm = PF_F COMMON_ETC_PATH("default_permissions.p7s");
     const char * def_perm_ca = PF_F COMMON_ETC_PATH("default_permissions_ca.pem");
@@ -556,9 +516,9 @@ CU_Theory(
     get_permissions_grant ("id2", id2_subj, now, now + DDS_SECS(3600), rules2_xml, NULL) };
   char * perm_config = get_permissions_config (grants, 2, true);
 
-  char * gov_topic_rule = get_governance_topic_rule ("*", false, false, true, true, "NONE", "NONE");
-  char * gov_config_pp1 = get_governance_config (false, join_ac_pp1, NULL, NULL, NULL, gov_topic_rule, true);
-  char * gov_config_pp2 = get_governance_config (false, join_ac_pp2, NULL, NULL, NULL, gov_topic_rule, true);
+  char * gov_topic_rule = get_governance_topic_rule ("*", false, false, true, true, PK_N, BPK_N);
+  char * gov_config_pp1 = get_governance_config (false, join_ac_pp1, PK_N, PK_N, PK_N, gov_topic_rule, true);
+  char * gov_config_pp2 = get_governance_config (false, join_ac_pp2, PK_N, PK_N, PK_N, gov_topic_rule, true);
   const char * def_perm_ca = PF_F COMMON_ETC_PATH("default_permissions_ca.pem");
 
   access_control_init (
@@ -624,10 +584,10 @@ static void test_discovery_liveliness_protection(enum test_discovery_liveliness
     get_permissions_default_grant ("id2", id2_subj, topic_name) };
   char * perm_config = get_permissions_config (grants, 2, true);
 
-  char * gov_topic_rule1 = get_governance_topic_rule (topic_name, dp && enable_protection_pp1, lp && enable_protection_pp1, true, true, "ENCRYPT", "NONE");
-  char * gov_topic_rule2 = get_governance_topic_rule (topic_name, dp && enable_protection_pp2, lp && enable_protection_pp2, true, true, "ENCRYPT", "NONE");
-  char * gov_config1 = get_governance_config (false, true, dp ? pk_to_str (protection_kind_pp1) : NULL, lp ? pk_to_str (protection_kind_pp1) : NULL, "ENCRYPT", gov_topic_rule1, true);
-  char * gov_config2 = get_governance_config (false, true, dp ? pk_to_str (protection_kind_pp2) : NULL, lp ? pk_to_str (protection_kind_pp2) : NULL, "ENCRYPT", gov_topic_rule2, true);
+  char * gov_topic_rule1 = get_governance_topic_rule (topic_name, dp && enable_protection_pp1, lp && enable_protection_pp1, true, true, PK_E, BPK_N);
+  char * gov_topic_rule2 = get_governance_topic_rule (topic_name, dp && enable_protection_pp2, lp && enable_protection_pp2, true, true, PK_E, BPK_N);
+  char * gov_config1 = get_governance_config (false, true, dp ? protection_kind_pp1 : PK_N, lp ? protection_kind_pp1 : PK_N, PK_E, gov_topic_rule1, true);
+  char * gov_config2 = get_governance_config (false, true, dp ? protection_kind_pp2 : PK_N, lp ? protection_kind_pp2 : PK_N, PK_E, gov_topic_rule2, true);
   const char * def_perm_ca = PF_F COMMON_ETC_PATH("default_permissions_ca.pem");
 
   access_control_init (
@@ -705,10 +665,10 @@ static void test_encoding_mismatch(
     get_permissions_default_grant ("id2", id2_subj, topic_name) };
   char * perm_config = get_permissions_config (grants, 2, true);
 
-  char * gov_topic_rule1 = get_governance_topic_rule (topic_name, true, true, true, true, pk_to_str (metadata_pk1), bpk_to_str (payload_pk1));
-  char * gov_topic_rule2 = get_governance_topic_rule (topic_name, true, true, true, true, pk_to_str (metadata_pk2), bpk_to_str (payload_pk2));
-  char * gov_config1 = get_governance_config (false, true, pk_to_str (discovery_pk1), pk_to_str (liveliness_pk1), pk_to_str (rtps_pk1), gov_topic_rule1, true);
-  char * gov_config2 = get_governance_config (false, true, pk_to_str (discovery_pk2), pk_to_str (liveliness_pk2), pk_to_str (rtps_pk2), gov_topic_rule2, true);
+  char * gov_topic_rule1 = get_governance_topic_rule (topic_name, true, true, true, true, metadata_pk1, payload_pk1);
+  char * gov_topic_rule2 = get_governance_topic_rule (topic_name, true, true, true, true, metadata_pk2, payload_pk2);
+  char * gov_config1 = get_governance_config (false, true, discovery_pk1, liveliness_pk1, rtps_pk1, gov_topic_rule1, true);
+  char * gov_config2 = get_governance_config (false, true, discovery_pk2, liveliness_pk2, rtps_pk2, gov_topic_rule2, true);
   const char * def_perm_ca = PF_F COMMON_ETC_PATH("default_permissions_ca.pem");
 
   access_control_init (
@@ -802,8 +762,8 @@ static void test_readwrite_protection (
     get_permissions_grant ("id2", id2_subj, now, now + DDS_SECS(3600), rules_xml, default_policy) };
   char * perm_config = get_permissions_config (grants, 2, true);
 
-  char * gov_topic_rule = get_governance_topic_rule (topic_name, false, false, read_ac, write_ac, pk_to_str (PK_E), bpk_to_str (BPK_E));
-  char * gov_config = get_governance_config (false, true, NULL, NULL, NULL, gov_topic_rule, true);
+  char * gov_topic_rule = get_governance_topic_rule (topic_name, false, false, read_ac, write_ac, PK_E, BPK_E);
+  char * gov_config = get_governance_config (false, true, PK_N, PK_N, PK_N, gov_topic_rule, true);
   const char * def_perm_ca = PF_F COMMON_ETC_PATH("default_permissions_ca.pem");
 
   access_control_init (
diff --git a/src/security/core/tests/authentication.c b/src/security/core/tests/authentication.c
index 07d637e..79e9cb2 100644
--- a/src/security/core/tests/authentication.c
+++ b/src/security/core/tests/authentication.c
@@ -20,6 +20,7 @@
 #include "dds/ddsrt/cdtors.h"
 #include "dds/ddsrt/environ.h"
 #include "dds/ddsrt/heap.h"
+#include "dds/ddsrt/io.h"
 #include "dds/ddsrt/string.h"
 #include "dds/ddsi/q_config.h"
 #include "dds/ddsi/ddsi_domaingv.h"
@@ -65,7 +66,7 @@ static const char *config =
     "      <Library finalizeFunction=\"finalize_access_control\" initFunction=\"init_access_control\"/>"
     "      <Governance><![CDATA[${GOVERNANCE_CONFIG}]]></Governance>"
     "      <PermissionsCA>file:" COMMON_ETC_PATH("default_permissions_ca.pem") "</PermissionsCA>"
-    "      <Permissions><![CDATA[${PERM_CONFIG}]]></Permissions>"
+    "      <Permissions><![CDATA[${PERMISSIONS_CONFIG}]]></Permissions>"
     "    </AccessControl>"
     "    <Cryptographic>"
     "      <Library finalizeFunction=\"finalize_crypto\" initFunction=\"init_crypto\"/>"
@@ -73,10 +74,21 @@ static const char *config =
     "  </DDSSecurity>"
     "</Domain>";
 
+static const char *config_non_secure =
+    "${CYCLONEDDS_URI}${CYCLONEDDS_URI:+,}"
+    "<Domain id=\"any\">"
+    "  <Discovery>"
+    "    <ExternalDomainId>0</ExternalDomainId>"
+    "    <Tag>\\${CYCLONEDDS_PID}</Tag>"
+    "  </Discovery>"
+    "</Domain>";
+
+
 #define DDS_DOMAINID1 0
 #define DDS_DOMAINID2 1
 
 #define DEF_PERM_CONF "file:" COMMON_ETC_PATH("default_permissions.p7s")
+#define DEF_GOV_CONF "file:" COMMON_ETC_PATH("default_governance.p7s")
 
 static dds_entity_t g_domain1;
 static dds_entity_t g_participant1;
@@ -92,56 +104,48 @@ static dds_entity_t g_rd;
 
 static uint32_t g_topic_nr = 0;
 
-static void authentication_init(
-    const char * id1_cert, const char * id1_key, const char * id1_ca,
-    const char * id2_cert, const char * id2_key, const char * id2_ca,
-    const char * trusted_ca_dir, const char * perm_config,
-    bool exp_pp1_fail, bool exp_pp2_fail)
+static void init_domain_pp (bool pp_secure, bool exp_pp_fail,
+    dds_domainid_t domain_id, const char *id_cert, const char * id_key, const char * id_ca, const char * gov_config, const char * perm_config, const char * trusted_ca_dir,
+    dds_entity_t *domain, dds_entity_t *pp)
 {
-  if (perm_config == NULL)
-    perm_config = DEF_PERM_CONF;
-
-  char * gov_topic_rule = get_governance_topic_rule ("*", false, false, true, true, "NONE", "NONE");
-  char * gov_config_signed = get_governance_config (false, false, NULL, NULL, NULL, gov_topic_rule, true);
-
-  struct kvp config_vars1[] = {
-    { "TEST_IDENTITY_CERTIFICATE", id1_cert, 1 },
-    { "TEST_IDENTITY_PRIVATE_KEY", id1_key, 1 },
-    { "TEST_IDENTITY_CA_CERTIFICATE", id1_ca, 1 },
-    { "TRUSTED_CA_DIR", trusted_ca_dir, 3 },
-    { "PERM_CONFIG", perm_config, 1 },
-    { "GOVERNANCE_CONFIG", gov_config_signed, 1 },
-    { NULL, NULL, 0 }
-  };
-
-  struct kvp config_vars2[] = {
-    { "TEST_IDENTITY_CERTIFICATE", id2_cert, 1 },
-    { "TEST_IDENTITY_PRIVATE_KEY", id2_key, 1 },
-    { "TEST_IDENTITY_CA_CERTIFICATE", id2_ca, 1 },
-    { "TRUSTED_CA_DIR", trusted_ca_dir, 3 },
-    { "PERM_CONFIG", perm_config, 1 },
-    { "GOVERNANCE_CONFIG", gov_config_signed, 1 },
-    { NULL, NULL, 0 }
-  };
-
-  char *conf1 = ddsrt_expand_vars_sh (config, &expand_lookup_vars_env, config_vars1);
-  char *conf2 = ddsrt_expand_vars_sh (config, &expand_lookup_vars_env, config_vars2);
-  CU_ASSERT_EQUAL_FATAL (expand_lookup_unmatched (config_vars1), 0);
-  CU_ASSERT_EQUAL_FATAL (expand_lookup_unmatched (config_vars2), 0);
-  g_domain1 = dds_create_domain (DDS_DOMAINID1, conf1);
-  g_domain2 = dds_create_domain (DDS_DOMAINID2, conf2);
-  g_participant1 = dds_create_participant (DDS_DOMAINID1, NULL, NULL);
-  g_participant2 = dds_create_participant (DDS_DOMAINID2, NULL, NULL);
-  CU_ASSERT_EQUAL_FATAL (exp_pp1_fail, g_participant1 <= 0);
-  CU_ASSERT_EQUAL_FATAL (exp_pp2_fail, g_participant2 <= 0);
-
-  ddsrt_free (gov_config_signed);
-  ddsrt_free (gov_topic_rule);
-  ddsrt_free (conf1);
-  ddsrt_free (conf2);
+  char *conf;
+  if (pp_secure)
+  {
+    struct kvp config_vars[] =
+    {
+      { "TEST_IDENTITY_CERTIFICATE", id_cert, 1 },
+      { "TEST_IDENTITY_PRIVATE_KEY", id_key, 1 },
+      { "TEST_IDENTITY_CA_CERTIFICATE", id_ca, 1 },
+      { "TRUSTED_CA_DIR", trusted_ca_dir, 3 },
+      { "PERMISSIONS_CONFIG", perm_config, 1 },
+      { "GOVERNANCE_CONFIG", gov_config, 1 },
+      { NULL, NULL, 0 }
+    };
+    conf = ddsrt_expand_vars_sh (config, &expand_lookup_vars_env, config_vars);
+    CU_ASSERT_EQUAL_FATAL (expand_lookup_unmatched (config_vars), 0);
+  }
+  else
+  {
+    struct kvp config_vars[] = { { NULL, NULL, 0 } };
+    conf = ddsrt_expand_vars_sh (config_non_secure, &expand_lookup_vars_env, config_vars);
+    CU_ASSERT_EQUAL_FATAL (expand_lookup_unmatched (config_vars), 0);
+  }
+  *domain = dds_create_domain (domain_id, conf);
+  *pp = dds_create_participant (domain_id, NULL, NULL);
+  CU_ASSERT_EQUAL_FATAL (exp_pp_fail, *pp <= 0);
+  ddsrt_free (conf);
 }
 
-static void authentication_fini(bool delete_pp1, bool delete_pp2)
+static void authentication_init(
+    bool pp1_secure, const char * id1_cert, const char * id1_key, const char * id1_ca, bool exp_pp1_fail, const char * gov_conf1, const char * perm_conf1,
+    bool pp2_secure, const char * id2_cert, const char * id2_key, const char * id2_ca, bool exp_pp2_fail, const char * gov_conf2, const char * perm_conf2,
+    const char * trusted_ca_dir)
+{
+  init_domain_pp (pp1_secure, exp_pp1_fail, DDS_DOMAINID1, id1_cert, id1_key, id1_ca, gov_conf1, perm_conf1, trusted_ca_dir, &g_domain1, &g_participant1);
+  init_domain_pp (pp2_secure, exp_pp2_fail, DDS_DOMAINID2, id2_cert, id2_key, id2_ca, gov_conf2, perm_conf2, trusted_ca_dir, &g_domain2, &g_participant2);
+}
+
+static void authentication_fini(bool delete_pp1, bool delete_pp2, void * res[], size_t nres)
 {
   if (delete_pp1)
     CU_ASSERT_EQUAL_FATAL (dds_delete (g_participant1), DDS_RETCODE_OK);
@@ -149,6 +153,11 @@ static void authentication_fini(bool delete_pp1, bool delete_pp2)
     CU_ASSERT_EQUAL_FATAL (dds_delete (g_participant2), DDS_RETCODE_OK);
   CU_ASSERT_EQUAL_FATAL (dds_delete (g_domain1), DDS_RETCODE_OK);
   CU_ASSERT_EQUAL_FATAL (dds_delete (g_domain2), DDS_RETCODE_OK);
+  if (res != NULL)
+  {
+    for (size_t i = 0; i < nres; i++)
+      ddsrt_free (res[i]);
+  }
 }
 
 #define FM_CA "error: unable to get local issuer certificate"
@@ -185,7 +194,10 @@ CU_Theory((const char * test_descr, const char * id2, const char *key2, const ch
   struct Handshake *hs_list;
   int nhs;
   print_test_msg ("running test id_ca_certs: %s\n", test_descr);
-  authentication_init (ID1, ID1K, CA1, id2, key2, ca2, NULL, NULL, exp_fail_pp1, exp_fail_pp2);
+  authentication_init (
+      true, ID1, ID1K, CA1, exp_fail_pp1, DEF_GOV_CONF, DEF_PERM_CONF,
+      true, id2, key2, ca2, exp_fail_pp2, DEF_GOV_CONF, DEF_PERM_CONF,
+      NULL);
 
   // Domain 1
   validate_handshake (DDS_DOMAINID1, false, NULL, &hs_list, &nhs, DDS_SECS(2));
@@ -199,7 +211,7 @@ CU_Theory((const char * test_descr, const char * id2, const char *key2, const ch
     validate_handshake_result (&hs_list[n], exp_fail_hs_req, fail_hs_req_msg, exp_fail_hs_reply, fail_hs_reply_msg);
   handshake_list_fini (hs_list, nhs);
 
-  authentication_fini (!exp_fail_pp1, !exp_fail_pp2);
+  authentication_fini (!exp_fail_pp1, !exp_fail_pp2, NULL, 0);
 }
 
 CU_TheoryDataPoints(ddssec_authentication, trusted_ca_dir) = {
@@ -209,13 +221,16 @@ CU_TheoryDataPoints(ddssec_authentication, trusted_ca_dir) = {
 CU_Theory((const char * ca_dir, bool exp_fail), ddssec_authentication, trusted_ca_dir)
 {
   print_test_msg ("Testing custom CA dir: %s\n", ca_dir);
-  authentication_init (ID1, ID1K, CA1, ID1, ID1K, CA1, ca_dir, NULL, exp_fail, exp_fail);
+  authentication_init (
+      true, ID1, ID1K, CA1, exp_fail, DEF_GOV_CONF, DEF_PERM_CONF,
+      true, ID1, ID1K, CA1, exp_fail, DEF_GOV_CONF, DEF_PERM_CONF,
+      ca_dir);
   if (!exp_fail)
   {
     validate_handshake_nofail (DDS_DOMAINID1, DDS_SECS (2));
     validate_handshake_nofail (DDS_DOMAINID2, DDS_SECS (2));
   }
-  authentication_fini (!exp_fail, !exp_fail);
+  authentication_fini (!exp_fail, !exp_fail, NULL, 0);
 }
 
 #define S(n) (n)
@@ -267,7 +282,10 @@ CU_Theory(
     get_permissions_default_grant ("id1", id1_subj, topic_name),
     get_permissions_default_grant ("id2", id2_subj, topic_name) };
   char * perm_config = get_permissions_config (grants, 2, true);
-  authentication_init (id1, ID1K, ca, id2, ID1K, ca, NULL, perm_config, id1_local_fail, id2_local_fail);
+  authentication_init (
+    true, id1, ID1K, ca, id1_local_fail, DEF_GOV_CONF, perm_config,
+    true, id2, ID1K, ca, id2_local_fail, DEF_GOV_CONF, perm_config,
+    NULL);
   validate_handshake (DDS_DOMAINID1, id1_local_fail, NULL, NULL, NULL, DDS_SECS(2));
   validate_handshake (DDS_DOMAINID2, id2_local_fail, NULL, NULL, NULL, DDS_SECS(2));
   if (write_read_dur > 0)
@@ -276,17 +294,51 @@ CU_Theory(
     sync_writer_to_readers(g_participant1, g_wr, 1, DDS_SECS(2));
     write_read_for (g_wr, g_participant2, g_rd, DDS_MSECS (write_read_dur), false, exp_read_fail);
   }
-  authentication_fini (!id1_local_fail, !id2_local_fail);
-  ddsrt_free (grants[0]);
-  ddsrt_free (grants[1]);
-  ddsrt_free (perm_config);
-  ddsrt_free (ca);
-  ddsrt_free (id1_subj);
-  ddsrt_free (id2_subj);
-  ddsrt_free (id1);
-  ddsrt_free (id2);
+  authentication_fini (!id1_local_fail, !id2_local_fail, (void * []){ grants[0], grants[1], perm_config, ca, id1_subj, id2_subj, id1, id2 }, 8);
 }
 #undef D
 #undef H
 #undef M
 
+
+CU_Test(ddssec_authentication, unauthenticated_pp)
+{
+  char topic_name_secure[100];
+  char topic_name_plain[100];
+  create_topic_name ("ddssec_authentication_secure_", g_topic_nr++, topic_name_secure, sizeof (topic_name_secure));
+  create_topic_name ("ddssec_authentication_plain_", g_topic_nr++, topic_name_plain, sizeof (topic_name_plain));
+
+  /* create ca and id1 cert that will not expire during this test */
+  char *ca, *id1, *id1_subj;
+  ca = generate_ca ("ca1", TEST_IDENTITY_CA1_PRIVATE_KEY, 0, 3600);
+  id1 = generate_identity (ca, TEST_IDENTITY_CA1_PRIVATE_KEY, "id1", TEST_IDENTITY1_PRIVATE_KEY, 0, 3600, &id1_subj);
+
+  char * grants[] = { get_permissions_default_grant ("id1", id1_subj, topic_name_secure) };
+  char * perm_config = get_permissions_config (grants, 1, true);
+
+  char * topic_rule_sec = get_governance_topic_rule (topic_name_secure, true, true, true, true, PK_E, BPK_N);
+  char * topic_rule_plain = get_governance_topic_rule (topic_name_plain, false, false, false, false, PK_N, BPK_N);
+  char * gov_topic_rules;
+  ddsrt_asprintf(&gov_topic_rules, "%s%s", topic_rule_sec, topic_rule_plain);
+  char * gov_config = get_governance_config (true, true, PK_N, PK_N, PK_N, gov_topic_rules, true);
+
+  authentication_init (
+    true, id1, TEST_IDENTITY1_PRIVATE_KEY, ca, false, gov_config, perm_config,
+    false, NULL, NULL, NULL, false, NULL, NULL,
+    NULL);
+
+  print_test_msg ("writing sample for plain topic\n");
+  dds_entity_t pub, sub, pub_tp, sub_tp, wr, rd;
+  rd_wr_init (g_participant1, &pub, &pub_tp, &wr, g_participant2, &sub, &sub_tp, &rd, topic_name_plain);
+  sync_writer_to_readers(g_participant1, wr, 1, DDS_SECS(5));
+  write_read_for (wr, g_participant2, rd, DDS_MSECS (10), false, false);
+
+  print_test_msg ("writing sample for secured topic\n");
+  dds_entity_t spub, ssub, spub_tp, ssub_tp, swr, srd;
+  rd_wr_init (g_participant1, &spub, &spub_tp, &swr, g_participant2, &ssub, &ssub_tp, &srd, topic_name_secure);
+  sync_writer_to_readers(g_participant1, swr, 0, DDS_SECS(2));
+  write_read_for (swr, g_participant2, srd, DDS_MSECS (10), false, true);
+
+  authentication_fini (true, true, (void * []) { gov_config, gov_topic_rules, topic_rule_sec, topic_rule_plain, grants[0], perm_config, ca, id1_subj, id1 }, 9);
+}
+
diff --git a/src/security/core/tests/common/security_config_test_utils.c b/src/security/core/tests/common/security_config_test_utils.c
index 8c46848..ea8158b 100644
--- a/src/security/core/tests/common/security_config_test_utils.c
+++ b/src/security/core/tests/common/security_config_test_utils.c
@@ -245,7 +245,7 @@ static void print_config_vars(struct kvp *vars)
 }
 
 char * get_governance_topic_rule(const char * topic_expr, bool discovery_protection, bool liveliness_protection,
-    bool read_ac, bool write_ac, const char * metadata_protection_kind, const char * data_protection_kind)
+    bool read_ac, bool write_ac, DDS_Security_ProtectionKind metadata_protection_kind, DDS_Security_BasicProtectionKind data_protection_kind)
 {
   struct kvp vars[] = {
     { "TOPIC_EXPRESSION", topic_expr != NULL ? topic_expr : "*", 1 },
@@ -253,23 +253,23 @@ char * get_governance_topic_rule(const char * topic_expr, bool discovery_protect
     { "ENABLE_LIVELINESS_PROTECTION", liveliness_protection ? "true" : "false", 1 },
     { "ENABLE_READ_AC", read_ac ? "true" : "false", 1 },
     { "ENABLE_WRITE_AC", write_ac ? "true" : "false", 1 },
-    { "METADATA_PROTECTION_KIND", metadata_protection_kind != NULL ? metadata_protection_kind : "NONE", 1 },
-    { "DATA_PROTECTION_KIND", data_protection_kind != NULL ? data_protection_kind : "NONE", 1 },
+    { "METADATA_PROTECTION_KIND", pk_to_str (metadata_protection_kind), 1 },
+    { "DATA_PROTECTION_KIND", bpk_to_str (data_protection_kind), 1 },
     { NULL, NULL, 0 }
   };
   return ddsrt_expand_vars (topic_rule, &expand_lookup_vars, vars);
 }
 
-char * get_governance_config (bool allow_unauth_pp, bool enable_join_ac, const char * discovery_protection_kind, const char * liveliness_protection_kind,
-    const char * rtps_protection_kind, const char * topic_rules, bool add_prefix)
+char * get_governance_config (bool allow_unauth_pp, bool enable_join_ac, DDS_Security_ProtectionKind discovery_protection_kind, DDS_Security_ProtectionKind liveliness_protection_kind,
+    DDS_Security_ProtectionKind rtps_protection_kind, const char * topic_rules, bool add_prefix)
 {
   struct kvp vars[] = {
     { "ALLOW_UNAUTH_PP", allow_unauth_pp ? "true" : "false", 1 },
     { "ENABLE_JOIN_AC", enable_join_ac ? "true" : "false", 1 },
-    { "DISCOVERY_PROTECTION_KIND", discovery_protection_kind != NULL ? discovery_protection_kind : "NONE", 1 },
-    { "LIVELINESS_PROTECTION_KIND", liveliness_protection_kind != NULL ? liveliness_protection_kind : "NONE", 1 },
-    { "RTPS_PROTECTION_KIND", rtps_protection_kind != NULL ? rtps_protection_kind : "NONE", 1 },
-    { "TOPIC_RULES", topic_rules != NULL ? topic_rules : get_governance_topic_rule (NULL, false, false, false, false, NULL, NULL), 1 },
+    { "DISCOVERY_PROTECTION_KIND", pk_to_str (discovery_protection_kind), 1 },
+    { "LIVELINESS_PROTECTION_KIND", pk_to_str (liveliness_protection_kind), 1 },
+    { "RTPS_PROTECTION_KIND", pk_to_str (rtps_protection_kind), 1 },
+    { "TOPIC_RULES", topic_rules != NULL ? topic_rules : get_governance_topic_rule (NULL, false, false, false, false, PK_N, BPK_N), 1 },
     { NULL, NULL, 0 }
   };
   char * config = ddsrt_expand_vars (governance_xml, &expand_lookup_vars, vars);
diff --git a/src/security/core/tests/common/security_config_test_utils.h b/src/security/core/tests/common/security_config_test_utils.h
index e70b98e..eaac17b 100644
--- a/src/security/core/tests/common/security_config_test_utils.h
+++ b/src/security/core/tests/common/security_config_test_utils.h
@@ -26,9 +26,9 @@ const char * expand_lookup_vars_env (const char *name, void * data);
 int32_t expand_lookup_unmatched (const struct kvp * lookup_table);
 
 char * get_governance_topic_rule (const char * topic_expr, bool discovery_protection, bool liveliness_protection,
-    bool read_ac, bool write_ac, const char * metadata_protection_kind, const char * data_protection_kind);
-char * get_governance_config (bool allow_unauth_pp, bool enable_join_ac, const char * discovery_protection_kind, const char * liveliness_protection_kind,
-    const char * rtps_protection_kind, const char * topic_rules, bool add_prefix);
+    bool read_ac, bool write_ac, DDS_Security_ProtectionKind metadata_protection_kind, DDS_Security_BasicProtectionKind data_protection_kind);
+char * get_governance_config (bool allow_unauth_pp, bool enable_join_ac, DDS_Security_ProtectionKind discovery_protection_kind, DDS_Security_ProtectionKind liveliness_protection_kind,
+    DDS_Security_ProtectionKind rtps_protection_kind, const char * topic_rules, bool add_prefix);
 
 char * get_permissions_rules (const char * domain_id, const char * allow_pub_topic, const char * allow_sub_topic,
     const char * deny_pub_topic, const char * deny_sub_topic);
diff --git a/src/security/core/tests/common/test_utils.c b/src/security/core/tests/common/test_utils.c
index 89d22f3..eff8f51 100644
--- a/src/security/core/tests/common/test_utils.c
+++ b/src/security/core/tests/common/test_utils.c
@@ -538,3 +538,37 @@ const char * bpk_to_str(DDS_Security_BasicProtectionKind bpk)
   assert (false);
   return NULL;
 }
+
+DDS_Security_DatawriterCryptoHandle get_builtin_writer_crypto_handle(dds_entity_t participant, unsigned entityid)
+{
+  DDS_Security_DatawriterCryptoHandle crypto_handle;
+  struct dds_entity *pp_entity;
+  struct participant *pp;
+  struct writer *wr;
+  CU_ASSERT_EQUAL_FATAL(dds_entity_pin(participant, &pp_entity), 0);
+  thread_state_awake(lookup_thread_state(), &pp_entity->m_domain->gv);
+  pp = entidx_lookup_participant_guid(pp_entity->m_domain->gv.entity_index, &pp_entity->m_guid);
+  wr = get_builtin_writer(pp, entityid);
+  CU_ASSERT_FATAL(wr != NULL);
+  assert(wr != NULL); /* for Clang's static analyzer */
+  crypto_handle = wr->sec_attr->crypto_handle;
+  thread_state_asleep(lookup_thread_state());
+  dds_entity_unpin(pp_entity);
+  return crypto_handle;
+}
+
+DDS_Security_DatawriterCryptoHandle get_writer_crypto_handle(dds_entity_t writer)
+{
+  DDS_Security_DatawriterCryptoHandle crypto_handle;
+  struct dds_entity *wr_entity;
+  struct writer *wr;
+  CU_ASSERT_EQUAL_FATAL(dds_entity_pin(writer, &wr_entity), 0);
+  thread_state_awake(lookup_thread_state(), &wr_entity->m_domain->gv);
+  wr = entidx_lookup_writer_guid(wr_entity->m_domain->gv.entity_index, &wr_entity->m_guid);
+  CU_ASSERT_FATAL(wr != NULL);
+  assert(wr != NULL); /* for Clang's static analyzer */
+  crypto_handle = wr->sec_attr->crypto_handle;
+  thread_state_asleep(lookup_thread_state());
+  dds_entity_unpin(wr_entity);
+  return crypto_handle;
+}
diff --git a/src/security/core/tests/common/test_utils.h b/src/security/core/tests/common/test_utils.h
index 2a68327..7fe1487 100644
--- a/src/security/core/tests/common/test_utils.h
+++ b/src/security/core/tests/common/test_utils.h
@@ -26,6 +26,9 @@
 #define BPK_S DDS_SECURITY_BASICPROTECTION_KIND_SIGN
 #define BPK_E DDS_SECURITY_BASICPROTECTION_KIND_ENCRYPT
 
+#define PF_F "file:"
+#define PF_D "data:,"
+
 #define MAX_LOCAL_IDENTITIES 8
 #define MAX_REMOTE_IDENTITIES 8
 #define MAX_HANDSHAKES 32
@@ -82,5 +85,7 @@ void write_read_for (dds_entity_t wr, dds_entity_t pp_rd, dds_entity_t rd, dds_d
 struct dds_security_cryptography_impl * get_crypto_context (dds_entity_t participant);
 const char * pk_to_str (DDS_Security_ProtectionKind pk);
 const char * bpk_to_str (DDS_Security_BasicProtectionKind bpk);
+DDS_Security_DatawriterCryptoHandle get_builtin_writer_crypto_handle(dds_entity_t participant, unsigned entityid);
+DDS_Security_DatawriterCryptoHandle get_writer_crypto_handle(dds_entity_t writer);
 
 #endif /* SECURITY_CORE_TEST_UTILS_H_ */
diff --git a/src/security/core/tests/secure_communication.c b/src/security/core/tests/secure_communication.c
index 4b3e790..94f8c13 100644
--- a/src/security/core/tests/secure_communication.c
+++ b/src/security/core/tests/secure_communication.c
@@ -154,9 +154,8 @@ static void test_init(const struct domain_sec_config * domain_config, size_t n_s
   assert (n_pub_domains < MAX_DOMAINS);
   assert (n_pub_participants < MAX_PARTICIPANTS);
 
-  char * gov_topic_rule = get_governance_topic_rule ("*", true, true, true, true, pk_to_str (domain_config->metadata_pk), bpk_to_str (domain_config->payload_pk));
-  char * gov_config_signed = get_governance_config (false, true, pk_to_str (domain_config->discovery_pk), pk_to_str (domain_config->liveliness_pk),
-    pk_to_str (domain_config->rtps_pk), gov_topic_rule, false);
+  char * gov_topic_rule = get_governance_topic_rule ("*", true, true, true, true, domain_config->metadata_pk, domain_config->payload_pk);
+  char * gov_config_signed = get_governance_config (false, true, domain_config->discovery_pk, domain_config->liveliness_pk, domain_config->rtps_pk, gov_topic_rule, false);
 
   struct kvp config_vars[] = {
     { "GOVERNANCE_DATA", gov_config_signed, 1 },

From 9ba54c70e73255ae46d85587936954eeb3ab1f65 Mon Sep 17 00:00:00 2001
From: Dennis Potman <dennis.potman@adlinktech.com>
Date: Mon, 11 May 2020 21:49:16 +0200
Subject: [PATCH 189/238] Don't accept plain payload in case payload encryption
 or payload signing is enabled in the security settings. And fixed a typo in
 writer not allowed message

Signed-off-by: Dennis Potman <dennis.potman@adlinktech.com>
---
 src/core/ddsi/src/ddsi_security_omg.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/core/ddsi/src/ddsi_security_omg.c b/src/core/ddsi/src/ddsi_security_omg.c
index 7824239..a0d186a 100644
--- a/src/core/ddsi/src/ddsi_security_omg.c
+++ b/src/core/ddsi/src/ddsi_security_omg.c
@@ -1469,7 +1469,7 @@ bool q_omg_security_check_create_writer(struct participant *pp, uint32_t domain_
 
   result = sc->access_control_context->check_create_datawriter(sc->access_control_context, pp->sec_attr->permissions_handle, (DDS_Security_DomainId)domain_id, topic_name, &security_qos, &partitions, NULL, &exception);
   if (!result)
-    handle_not_allowed(pp->e.gv, pp->sec_attr->permissions_handle, sc->access_control_context, &exception, topic_name, "Local topic permission denied");
+    handle_not_allowed(pp->e.gv, pp->sec_attr->permissions_handle, sc->access_control_context, &exception, topic_name, "Writer is not permitted");
 
   q_omg_shallow_free_security_qos(&security_qos);
   g_omg_shallow_free_StringSeq(&partitions.name);
@@ -3340,7 +3340,7 @@ static bool decode_payload (const struct ddsi_domaingv *gv, struct nn_rsample_in
   if (!q_omg_security_decode_serialized_payload (sampleinfo->pwr, payloadp, *payloadsz, &dst_buf, &dst_len))
   {
     GVTRACE ("decode_payload: failed to decrypt data from "PGUIDFMT"\n", PGUID (sampleinfo->pwr->e.guid));
-    return true;
+    return false;
   }
 
   /* Expect result to always fit into the original buffer. */

From cf75263d1da2b326f5e4e152a2b5c131e3f75c18 Mon Sep 17 00:00:00 2001
From: Dennis Potman <dennis.potman@adlinktech.com>
Date: Mon, 11 May 2020 21:53:56 +0200
Subject: [PATCH 190/238] Add a test that validates that a plain message is not
 read by a remote reader in case payload/submsg/rtps encryption or signing is
 enabled

Signed-off-by: Dennis Potman <dennis.potman@adlinktech.com>
---
 src/security/core/tests/CMakeLists.txt        |   1 +
 .../core/tests/common/cryptography_wrapper.c  | 133 ++++++++++++--
 .../core/tests/common/cryptography_wrapper.h  |   8 +-
 src/security/core/tests/crypto.c              | 170 ++++++++++++++++++
 4 files changed, 298 insertions(+), 14 deletions(-)
 create mode 100644 src/security/core/tests/crypto.c

diff --git a/src/security/core/tests/CMakeLists.txt b/src/security/core/tests/CMakeLists.txt
index 299487e..19fc14a 100644
--- a/src/security/core/tests/CMakeLists.txt
+++ b/src/security/core/tests/CMakeLists.txt
@@ -79,6 +79,7 @@ if(ENABLE_SSL)
     "authentication.c"
     "access_control.c"
     "config.c"
+    "crypto.c"
     "handshake.c"
     "plugin_loading.c"
     "secure_communication.c"
diff --git a/src/security/core/tests/common/cryptography_wrapper.c b/src/security/core/tests/common/cryptography_wrapper.c
index 990e2c8..ada7591 100644
--- a/src/security/core/tests/common/cryptography_wrapper.c
+++ b/src/security/core/tests/common/cryptography_wrapper.c
@@ -33,7 +33,8 @@ enum crypto_plugin_mode {
   PLUGIN_MODE_ALL_OK,
   PLUGIN_MODE_MISSING_FUNC,
   PLUGIN_MODE_WRAPPED,
-  PLUGIN_MODE_TOKEN_LOG
+  PLUGIN_MODE_TOKEN_LOG,
+  PLUGIN_MODE_PLAIN_DATA
 };
 
 struct dds_security_crypto_key_exchange_impl {
@@ -76,6 +77,10 @@ struct dds_security_cryptography_impl {
   struct ddsrt_circlist token_data_list;
   ddsrt_mutex_t encode_decode_log_lock;
   struct ddsrt_circlist encode_decode_log;
+  bool force_plain_rtps;
+  bool force_plain_submsg;
+  bool force_plain_payload;
+  DDS_Security_DatawriterCryptoHandle force_plain_sender_handle;
 };
 
 static DDS_Security_ParticipantCryptoHandle g_local_participant_handle = 0;
@@ -120,6 +125,16 @@ void set_entity_data_secret(struct dds_security_cryptography_impl * impl, const
   impl->ep_secret = ep_secret;
 }
 
+void set_force_plain_data(struct dds_security_cryptography_impl * impl, DDS_Security_DatawriterCryptoHandle handle, bool plain_rtps, bool plain_submsg, bool plain_payload)
+{
+  assert (impl);
+  assert (impl->mode == PLUGIN_MODE_PLAIN_DATA);
+  impl->force_plain_rtps = plain_rtps;
+  impl->force_plain_submsg = plain_submsg;
+  impl->force_plain_payload = plain_payload;
+  impl->force_plain_sender_handle = handle;
+}
+
 static bool check_crypto_tokens(const DDS_Security_DataHolderSeq *tokens)
 {
     bool result = true;
@@ -371,6 +386,20 @@ static bool expect_encrypted_buffer (DDS_Security_ProtectionKind pk)
   return pk == DDS_SECURITY_PROTECTION_KIND_ENCRYPT || pk == DDS_SECURITY_PROTECTION_KIND_ENCRYPT_WITH_ORIGIN_AUTHENTICATION;
 }
 
+static void copy_octetseq(DDS_Security_OctetSeq *encoded_submsg, const DDS_Security_OctetSeq *plain_submsg)
+{
+  encoded_submsg->_length = encoded_submsg->_maximum = plain_submsg->_length;
+  if (plain_submsg->_length > 0)
+  {
+    encoded_submsg->_buffer = ddsrt_malloc(encoded_submsg->_length);
+    memcpy(encoded_submsg->_buffer, plain_submsg->_buffer, encoded_submsg->_length);
+  }
+  else
+  {
+    encoded_submsg->_buffer = NULL;
+  }
+}
+
 /**
  * Crypto key exchange
  */
@@ -386,6 +415,7 @@ static DDS_Security_boolean create_local_participant_crypto_tokens(
   {
     case PLUGIN_MODE_WRAPPED:
     case PLUGIN_MODE_TOKEN_LOG:
+    case PLUGIN_MODE_PLAIN_DATA:
     {
       DDS_Security_boolean ret = impl->instance->create_local_participant_crypto_tokens (impl->instance, local_participant_crypto_tokens,
         local_participant_crypto, remote_participant_crypto, ex);
@@ -410,6 +440,7 @@ static DDS_Security_boolean set_remote_participant_crypto_tokens(
   {
     case PLUGIN_MODE_WRAPPED:
     case PLUGIN_MODE_TOKEN_LOG:
+    case PLUGIN_MODE_PLAIN_DATA:
     {
       DDS_Security_boolean ret = impl->instance->set_remote_participant_crypto_tokens (impl->instance, check_handle (local_participant_crypto),
         check_handle (remote_participant_crypto), remote_participant_tokens, ex);
@@ -434,6 +465,7 @@ static DDS_Security_boolean create_local_datawriter_crypto_tokens(
   {
     case PLUGIN_MODE_WRAPPED:
     case PLUGIN_MODE_TOKEN_LOG:
+    case PLUGIN_MODE_PLAIN_DATA:
     {
       DDS_Security_boolean ret = impl->instance->create_local_datawriter_crypto_tokens (impl->instance, local_datawriter_crypto_tokens,
         check_handle (local_datawriter_crypto), check_handle (remote_datareader_crypto), ex);
@@ -458,6 +490,7 @@ static DDS_Security_boolean set_remote_datawriter_crypto_tokens(
   {
     case PLUGIN_MODE_WRAPPED:
     case PLUGIN_MODE_TOKEN_LOG:
+    case PLUGIN_MODE_PLAIN_DATA:
     {
       DDS_Security_boolean ret = impl->instance->set_remote_datawriter_crypto_tokens (impl->instance, check_handle (local_datareader_crypto),
         check_handle (remote_datawriter_crypto), remote_datawriter_tokens, ex);
@@ -482,6 +515,7 @@ static DDS_Security_boolean create_local_datareader_crypto_tokens(
   {
     case PLUGIN_MODE_WRAPPED:
     case PLUGIN_MODE_TOKEN_LOG:
+    case PLUGIN_MODE_PLAIN_DATA:
     {
       DDS_Security_boolean ret = impl->instance->create_local_datareader_crypto_tokens (impl->instance, local_datareader_cryto_tokens,
         check_handle (local_datareader_crypto), check_handle (remote_datawriter_crypto), ex);
@@ -506,6 +540,7 @@ static DDS_Security_boolean set_remote_datareader_crypto_tokens(
   {
     case PLUGIN_MODE_WRAPPED:
     case PLUGIN_MODE_TOKEN_LOG:
+    case PLUGIN_MODE_PLAIN_DATA:
     {
       DDS_Security_boolean ret = impl->instance->set_remote_datareader_crypto_tokens (impl->instance, check_handle (local_datawriter_crypto),
         check_handle (remote_datareader_crypto), remote_datareader_tokens, ex);
@@ -528,6 +563,7 @@ static DDS_Security_boolean return_crypto_tokens(
   {
     case PLUGIN_MODE_WRAPPED:
     case PLUGIN_MODE_TOKEN_LOG:
+    case PLUGIN_MODE_PLAIN_DATA:
       return impl->instance->return_crypto_tokens (impl->instance, crypto_tokens, ex);
     default:
       return true;
@@ -550,6 +586,7 @@ static DDS_Security_ParticipantCryptoHandle register_local_participant(
   {
     case PLUGIN_MODE_WRAPPED:
     case PLUGIN_MODE_TOKEN_LOG:
+    case PLUGIN_MODE_PLAIN_DATA:
       return check_handle (impl->instance->register_local_participant (impl->instance, check_handle (participant_identity),
         check_handle (participant_permissions), participant_properties, participant_security_attributes, ex));
     default:
@@ -570,6 +607,7 @@ static DDS_Security_ParticipantCryptoHandle register_matched_remote_participant(
   {
     case PLUGIN_MODE_WRAPPED:
     case PLUGIN_MODE_TOKEN_LOG:
+    case PLUGIN_MODE_PLAIN_DATA:
       return check_handle (impl->instance->register_matched_remote_participant (impl->instance, local_participant_crypto_handle,
         remote_participant_identity, remote_participant_permissions, shared_secret, ex));
     default:
@@ -589,6 +627,7 @@ static DDS_Security_DatawriterCryptoHandle register_local_datawriter(
   {
     case PLUGIN_MODE_WRAPPED:
     case PLUGIN_MODE_TOKEN_LOG:
+    case PLUGIN_MODE_PLAIN_DATA:
       return check_handle (impl->instance->register_local_datawriter (impl->instance, check_handle (participant_crypto),
         datawriter_properties, datawriter_security_attributes, ex));
     default:
@@ -609,6 +648,7 @@ static DDS_Security_DatareaderCryptoHandle register_matched_remote_datareader(
   {
     case PLUGIN_MODE_WRAPPED:
     case PLUGIN_MODE_TOKEN_LOG:
+    case PLUGIN_MODE_PLAIN_DATA:
       return check_handle (impl->instance->register_matched_remote_datareader (impl->instance, check_handle (local_datawriter_crypto_handle),
         check_handle (remote_participant_crypto), check_handle (shared_secret), relay_only, ex));
     default:
@@ -628,6 +668,7 @@ static DDS_Security_DatareaderCryptoHandle register_local_datareader(
   {
     case PLUGIN_MODE_WRAPPED:
     case PLUGIN_MODE_TOKEN_LOG:
+    case PLUGIN_MODE_PLAIN_DATA:
       return check_handle (impl->instance->register_local_datareader (impl->instance, check_handle (participant_crypto),
         datareader_properties, datareader_security_attributes, ex));
     default:
@@ -647,6 +688,7 @@ static DDS_Security_DatawriterCryptoHandle register_matched_remote_datawriter(
   {
     case PLUGIN_MODE_WRAPPED:
     case PLUGIN_MODE_TOKEN_LOG:
+    case PLUGIN_MODE_PLAIN_DATA:
       return check_handle (impl->instance->register_matched_remote_datawriter (impl->instance, check_handle (local_datareader_crypto_handle),
         check_handle (remote_participant_crypt), shared_secret, ex));
     default:
@@ -664,6 +706,7 @@ static DDS_Security_boolean unregister_participant(
   {
     case PLUGIN_MODE_WRAPPED:
     case PLUGIN_MODE_TOKEN_LOG:
+    case PLUGIN_MODE_PLAIN_DATA:
       return impl->instance->unregister_participant (impl->instance, check_handle (participant_crypto_handle), ex);
     default:
       return true;
@@ -680,6 +723,7 @@ static DDS_Security_boolean unregister_datawriter(
   {
     case PLUGIN_MODE_WRAPPED:
     case PLUGIN_MODE_TOKEN_LOG:
+    case PLUGIN_MODE_PLAIN_DATA:
       return impl->instance->unregister_datawriter (impl->instance, check_handle (datawriter_crypto_handle), ex);
     default:
       return true;
@@ -696,6 +740,7 @@ static DDS_Security_boolean unregister_datareader(
   {
     case PLUGIN_MODE_WRAPPED:
     case PLUGIN_MODE_TOKEN_LOG:
+    case PLUGIN_MODE_PLAIN_DATA:
       return impl->instance->unregister_datareader (impl->instance, check_handle (datareader_crypto_handle), ex);
     default:
       return true;
@@ -716,6 +761,13 @@ static DDS_Security_boolean encode_serialized_payload(
   struct dds_security_crypto_transform_impl *impl = (struct dds_security_crypto_transform_impl *)instance;
   switch (impl->parent->mode)
   {
+    case PLUGIN_MODE_PLAIN_DATA:
+      if (impl->parent->force_plain_payload && impl->parent->force_plain_sender_handle == sending_datawriter_crypto)
+      {
+        copy_octetseq (encoded_buffer, plain_buffer);
+        return true;
+      }
+      /* fall through */
     case PLUGIN_MODE_WRAPPED:
     case PLUGIN_MODE_TOKEN_LOG:
     {
@@ -771,6 +823,15 @@ static DDS_Security_boolean encode_datawriter_submessage(
   struct dds_security_crypto_transform_impl *impl = (struct dds_security_crypto_transform_impl *)instance;
   switch (impl->parent->mode)
   {
+    case PLUGIN_MODE_PLAIN_DATA:
+      if (impl->parent->force_plain_submsg && impl->parent->force_plain_sender_handle == sending_datawriter_crypto)
+      {
+        copy_octetseq (encoded_rtps_submessage, plain_rtps_submessage);
+        assert (receiving_datareader_crypto_list->_length <= INT32_MAX);
+        *receiving_datareader_crypto_list_index = (int32_t) receiving_datareader_crypto_list->_length;
+        return true;
+      }
+      /* fall through */
     case PLUGIN_MODE_WRAPPED:
       log_encode_decode (impl->parent, ENCODE_DATAWRITER_SUBMESSAGE, sending_datawriter_crypto);
       /* fall-through */
@@ -821,6 +882,13 @@ static DDS_Security_boolean encode_datareader_submessage(
   struct dds_security_crypto_transform_impl *impl = (struct dds_security_crypto_transform_impl *)instance;
   switch (impl->parent->mode)
   {
+    case PLUGIN_MODE_PLAIN_DATA:
+      if (impl->parent->force_plain_submsg && impl->parent->force_plain_sender_handle == sending_datareader_crypto)
+      {
+        copy_octetseq (encoded_rtps_submessage, plain_rtps_submessage);
+        return true;
+      }
+      /* fall through */
     case PLUGIN_MODE_WRAPPED:
       log_encode_decode (impl->parent, ENCODE_DATAREADER_SUBMESSAGE, sending_datareader_crypto);
       /* fall-through */
@@ -846,6 +914,15 @@ static DDS_Security_boolean encode_rtps_message(
   struct dds_security_crypto_transform_impl *impl = (struct dds_security_crypto_transform_impl *)instance;
   switch (impl->parent->mode)
   {
+    case PLUGIN_MODE_PLAIN_DATA:
+      if (impl->parent->force_plain_rtps)
+      {
+        copy_octetseq (encoded_rtps_message, plain_rtps_message);
+        assert (receiving_participant_crypto_list->_length <= INT32_MAX);
+        *receiving_participant_crypto_list_index = (int32_t) receiving_participant_crypto_list->_length;
+        return true;
+      }
+      /* fall through */
     case PLUGIN_MODE_WRAPPED:
     case PLUGIN_MODE_TOKEN_LOG:
       if (!impl->instance->encode_rtps_message (impl->instance, encoded_rtps_message,
@@ -880,6 +957,7 @@ static DDS_Security_boolean decode_rtps_message(
   {
     case PLUGIN_MODE_WRAPPED:
     case PLUGIN_MODE_TOKEN_LOG:
+    case PLUGIN_MODE_PLAIN_DATA:
       return impl->instance->decode_rtps_message (impl->instance, plain_buffer, encoded_buffer,
           check_handle (receiving_participant_crypto), check_handle (sending_participant_crypto), ex);
     default:
@@ -902,6 +980,7 @@ static DDS_Security_boolean preprocess_secure_submsg(
   {
     case PLUGIN_MODE_WRAPPED:
     case PLUGIN_MODE_TOKEN_LOG:
+    case PLUGIN_MODE_PLAIN_DATA:
       return impl->instance->preprocess_secure_submsg (impl->instance, datawriter_crypto, datareader_crypto,
         secure_submessage_category, encoded_rtps_submessage, check_handle (receiving_participant_crypto), check_handle (sending_participant_crypto), ex);
     default:
@@ -920,6 +999,7 @@ static DDS_Security_boolean decode_datawriter_submessage(
   struct dds_security_crypto_transform_impl *impl = (struct dds_security_crypto_transform_impl *)instance;
   switch (impl->parent->mode)
   {
+    case PLUGIN_MODE_PLAIN_DATA:
     case PLUGIN_MODE_WRAPPED:
       log_encode_decode (impl->parent, DECODE_DATAWRITER_SUBMESSAGE, receiving_datareader_crypto);
       /* fall-through */
@@ -942,6 +1022,7 @@ static DDS_Security_boolean decode_datareader_submessage(
   struct dds_security_crypto_transform_impl *impl = (struct dds_security_crypto_transform_impl *)instance;
   switch (impl->parent->mode)
   {
+    case PLUGIN_MODE_PLAIN_DATA:
     case PLUGIN_MODE_WRAPPED:
       log_encode_decode (impl->parent, DECODE_DATAREADER_SUBMESSAGE, receiving_datawriter_crypto);
       /* fall-through */
@@ -967,6 +1048,7 @@ static DDS_Security_boolean decode_serialized_payload(
   {
     case PLUGIN_MODE_WRAPPED:
     case PLUGIN_MODE_TOKEN_LOG:
+    case PLUGIN_MODE_PLAIN_DATA:
       return impl->instance->decode_serialized_payload(impl->instance, plain_buffer, encoded_buffer,
           inline_qos, check_handle (receiving_datareader_crypto), check_handle (sending_datawriter_crypto), ex);
     default:
@@ -1075,22 +1157,14 @@ int finalize_test_cryptography_missing_func(void *context)
   return finalize_test_cryptography_common(impl, false);
 }
 
-int init_test_cryptography_wrapped(const char *argument, void **context, struct ddsi_domaingv *gv)
+static void init_encode_decode_log(struct dds_security_cryptography_impl *impl)
 {
-  struct dds_security_cryptography_impl *impl = init_test_cryptography_common(argument, true, gv);
-  if (!impl)
-    return DDS_SECURITY_FAILED;
-  impl->mode = PLUGIN_MODE_WRAPPED;
   ddsrt_mutex_init (&impl->encode_decode_log_lock);
   ddsrt_circlist_init (&impl->encode_decode_log);
-  *context = impl;
-  return DDS_SECURITY_SUCCESS;
 }
 
-int finalize_test_cryptography_wrapped(void *context)
+static void fini_encode_decode_log(struct dds_security_cryptography_impl *impl)
 {
-  struct dds_security_cryptography_impl* impl = (struct dds_security_cryptography_impl*) context;
-  assert(impl->mode == PLUGIN_MODE_WRAPPED);
   ddsrt_mutex_lock (&impl->encode_decode_log_lock);
   while (!ddsrt_circlist_isempty (&impl->encode_decode_log))
   {
@@ -1100,6 +1174,24 @@ int finalize_test_cryptography_wrapped(void *context)
   }
   ddsrt_mutex_unlock (&impl->encode_decode_log_lock);
   ddsrt_mutex_destroy (&impl->encode_decode_log_lock);
+}
+
+int init_test_cryptography_wrapped(const char *argument, void **context, struct ddsi_domaingv *gv)
+{
+  struct dds_security_cryptography_impl *impl = init_test_cryptography_common(argument, true, gv);
+  if (!impl)
+    return DDS_SECURITY_FAILED;
+  impl->mode = PLUGIN_MODE_WRAPPED;
+  init_encode_decode_log(impl);
+  *context = impl;
+  return DDS_SECURITY_SUCCESS;
+}
+
+int finalize_test_cryptography_wrapped(void *context)
+{
+  struct dds_security_cryptography_impl* impl = (struct dds_security_cryptography_impl*) context;
+  assert(impl->mode == PLUGIN_MODE_WRAPPED);
+  fini_encode_decode_log(impl);
   return finalize_test_cryptography_common(impl, true);
 }
 
@@ -1141,3 +1233,22 @@ int32_t finalize_test_cryptography_store_tokens(void *context)
   return finalize_test_cryptography_common(impl, true);
 }
 
+int init_test_cryptography_plain_data(const char *argument, void **context, struct ddsi_domaingv *gv)
+{
+  struct dds_security_cryptography_impl *impl = init_test_cryptography_common(argument, true, gv);
+  if (!impl)
+    return DDS_SECURITY_FAILED;
+  impl->mode = PLUGIN_MODE_PLAIN_DATA;
+  init_encode_decode_log(impl);
+  *context = impl;
+  return DDS_SECURITY_SUCCESS;
+}
+
+int finalize_test_cryptography_plain_data(void *context)
+{
+  struct dds_security_cryptography_impl* impl = (struct dds_security_cryptography_impl*) context;
+  assert(impl->mode == PLUGIN_MODE_PLAIN_DATA);
+  fini_encode_decode_log(impl);
+  return finalize_test_cryptography_common(impl, true);
+}
+
diff --git a/src/security/core/tests/common/cryptography_wrapper.h b/src/security/core/tests/common/cryptography_wrapper.h
index d802247..98a6658 100644
--- a/src/security/core/tests/common/cryptography_wrapper.h
+++ b/src/security/core/tests/common/cryptography_wrapper.h
@@ -62,15 +62,13 @@ SECURITY_EXPORT void set_protection_kinds(
   DDS_Security_ProtectionKind rtps_protection_kind,
   DDS_Security_ProtectionKind metadata_protection_kind,
   DDS_Security_BasicProtectionKind payload_protection_kind);
-
 SECURITY_EXPORT void set_encrypted_secret(struct dds_security_cryptography_impl * impl, const char * secret);
-
 SECURITY_EXPORT void set_disc_protection_kinds(
   struct dds_security_cryptography_impl * impl,
   DDS_Security_ProtectionKind disc_protection_kind,
   DDS_Security_ProtectionKind liveliness_protection_kind);
-
 SECURITY_EXPORT void set_entity_data_secret(struct dds_security_cryptography_impl * impl, const char * pp_secret, const char * groupdata_secret, const char * ep_secret);
+SECURITY_EXPORT void set_force_plain_data(struct dds_security_cryptography_impl * impl, DDS_Security_DatawriterCryptoHandle wr_handle, bool plain_rtps, bool plain_submsg, bool plain_payload);
 
 SECURITY_EXPORT const char *get_crypto_token_type_str (enum crypto_tokens_type type);
 SECURITY_EXPORT struct ddsrt_circlist * get_crypto_tokens (struct dds_security_cryptography_impl * impl);
@@ -93,4 +91,8 @@ SECURITY_EXPORT int finalize_test_cryptography_wrapped(void *context);
 SECURITY_EXPORT int32_t init_test_cryptography_store_tokens(const char *argument, void **context, struct ddsi_domaingv *gv);
 SECURITY_EXPORT int32_t finalize_test_cryptography_store_tokens(void *context);
 
+/* Init in plain-data mode (force plain data for payload, submsg and/or rtps) */
+SECURITY_EXPORT int init_test_cryptography_plain_data(const char *argument, void **context, struct ddsi_domaingv *gv);
+SECURITY_EXPORT int finalize_test_cryptography_plain_data(void *context);
+
 #endif /* SECURITY_CORE_TEST_CRYPTO_WRAPPER_H_ */
diff --git a/src/security/core/tests/crypto.c b/src/security/core/tests/crypto.c
new file mode 100644
index 0000000..098b0d7
--- /dev/null
+++ b/src/security/core/tests/crypto.c
@@ -0,0 +1,170 @@
+/*
+ * Copyright(c) 2006 to 2020 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+#include <stdlib.h>
+#include <assert.h>
+
+#include "dds/dds.h"
+#include "CUnit/Test.h"
+#include "CUnit/Theory.h"
+
+#include "dds/version.h"
+#include "dds/ddsrt/cdtors.h"
+#include "dds/ddsrt/environ.h"
+#include "dds/ddsrt/heap.h"
+#include "dds/ddsrt/string.h"
+#include "dds/ddsi/q_config.h"
+#include "dds/ddsi/ddsi_domaingv.h"
+#include "dds/ddsi/q_misc.h"
+#include "dds/ddsi/ddsi_xqos.h"
+
+#include "dds/security/dds_security_api.h"
+
+#include "common/config_env.h"
+#include "common/cryptography_wrapper.h"
+#include "common/test_utils.h"
+#include "common/security_config_test_utils.h"
+#include "common/test_identity.h"
+#include "common/cert_utils.h"
+
+static const char *config =
+    "${CYCLONEDDS_URI}${CYCLONEDDS_URI:+,}"
+    "<Domain id=\"any\">"
+    "  <Discovery>"
+    "    <ExternalDomainId>0</ExternalDomainId>"
+    "    <Tag>\\${CYCLONEDDS_PID}</Tag>"
+    "  </Discovery>"
+    "  <DDSSecurity>"
+    "    <Authentication>"
+    "      <Library finalizeFunction=\"finalize_authentication\" initFunction=\"init_authentication\"/>"
+    "      <IdentityCertificate>data:,${TEST_IDENTITY_CERTIFICATE}</IdentityCertificate>"
+    "      <PrivateKey>data:,${TEST_IDENTITY_PRIVATE_KEY}</PrivateKey>"
+    "      <IdentityCA>data:,${TEST_IDENTITY_CA_CERTIFICATE}</IdentityCA>"
+    "    </Authentication>"
+    "    <AccessControl>"
+    "      <Library finalizeFunction=\"finalize_access_control\" initFunction=\"init_access_control\"/>"
+    "      <Governance><![CDATA[${GOVERNANCE_CONFIG}]]></Governance>"
+    "      <PermissionsCA>file:" COMMON_ETC_PATH("default_permissions_ca.pem") "</PermissionsCA>"
+    "      <Permissions><![CDATA[${PERMISSIONS_CONFIG}]]></Permissions>"
+    "    </AccessControl>"
+    "    <Cryptographic>"
+    "      <Library initFunction=\"${CRYPTO_INIT:-init_test_cryptography_wrapped}\" finalizeFunction=\"${CRYPTO_FINI:-finalize_test_cryptography_wrapped}\" path=\"" WRAPPERLIB_PATH("dds_security_cryptography_wrapper") "\"/>"
+    "    </Cryptographic>"
+    "  </DDSSecurity>"
+    "</Domain>";
+
+#define DDS_DOMAINID1 0
+#define DDS_DOMAINID2 1
+
+static dds_entity_t g_domain1;
+static dds_entity_t g_participant1;
+static dds_entity_t g_domain2;
+static dds_entity_t g_participant2;
+
+static uint32_t g_topic_nr = 0;
+
+static void init_domain_pp (dds_domainid_t domain_id, const char *id_cert, const char * id_key, const char * id_ca,
+    const char * gov_config, const char * perm_config, const char * crypto_init, const char * crypto_fini, dds_entity_t *domain, dds_entity_t *pp)
+{
+  struct kvp config_vars[] =
+  {
+    { "TEST_IDENTITY_CERTIFICATE", id_cert, 1 },
+    { "TEST_IDENTITY_PRIVATE_KEY", id_key, 1 },
+    { "TEST_IDENTITY_CA_CERTIFICATE", id_ca, 1 },
+    { "PERMISSIONS_CONFIG", perm_config, 1 },
+    { "GOVERNANCE_CONFIG", gov_config, 1 },
+    { "CRYPTO_INIT", crypto_init, 1 },
+    { "CRYPTO_FINI", crypto_fini, 1 },
+    { NULL, NULL, 0 }
+  };
+  char *conf = ddsrt_expand_vars_sh (config, &expand_lookup_vars_env, config_vars);
+  CU_ASSERT_EQUAL_FATAL (expand_lookup_unmatched (config_vars), 0);
+  *domain = dds_create_domain (domain_id, conf);
+  *pp = dds_create_participant (domain_id, NULL, NULL);
+  CU_ASSERT_FATAL (*pp > 0);
+  ddsrt_free (conf);
+}
+
+static void crypto_init (
+    const char * gov_config1, const char * perm_config1, const char * id_cert1, const char * id_key1, const char * crypto_init1, const char * crypto_fini1,
+    const char * gov_config2, const char * perm_config2, const char * id_cert2, const char * id_key2, const char * crypto_init2, const char * crypto_fini2,
+    const char * id_ca)
+{
+  init_domain_pp (DDS_DOMAINID1, id_cert1, id_key1, id_ca, gov_config1, perm_config1, crypto_init1, crypto_fini1, &g_domain1, &g_participant1);
+  init_domain_pp (DDS_DOMAINID2, id_cert2, id_key2, id_ca, gov_config2, perm_config2, crypto_init2, crypto_fini2, &g_domain2, &g_participant2);
+}
+
+static void crypto_fini (void * res[], size_t nres)
+{
+  CU_ASSERT_EQUAL_FATAL (dds_delete (g_domain1), DDS_RETCODE_OK);
+  CU_ASSERT_EQUAL_FATAL (dds_delete (g_domain2), DDS_RETCODE_OK);
+  if (res != NULL)
+  {
+    for (size_t i = 0; i < nres; i++)
+      ddsrt_free (res[i]);
+  }
+}
+
+CU_TheoryDataPoints(ddssec_crypto, inject_plain_data) = {
+    CU_DataPoints(const char *,
+    /*                                             */"payload encrypt",
+    /*                                              |     */"payload sign",
+    /*                                              |      |     */"submessage encrypt",
+    /*                                              |      |      |     */"submessage sign",
+    /*                                              |      |      |      |     */"rtps encrypt",
+    /*                                              |      |      |      |      |     */"rtps sign"),
+    CU_DataPoints(DDS_Security_BasicProtectionKind, BPK_E, BPK_S, BPK_N, BPK_N, BPK_N, BPK_N),  /* payload protection */
+    CU_DataPoints(DDS_Security_ProtectionKind,      PK_N,  PK_N,  PK_E,  PK_S,  PK_N,  PK_N),   /* submessage protection */
+    CU_DataPoints(DDS_Security_ProtectionKind,      PK_N,  PK_N,  PK_N,  PK_N,  PK_E,  PK_S),   /* rtps protection */
+};
+CU_Theory((const char * test_descr, DDS_Security_BasicProtectionKind payload_pk, DDS_Security_ProtectionKind submsg_pk, DDS_Security_ProtectionKind rtps_pk),
+  ddssec_crypto, inject_plain_data, .timeout=30)
+{
+  print_test_msg ("running test inject_plain_data: %s\n", test_descr);
+
+  char topic_name[100];
+  create_topic_name ("ddssec_crypto_", g_topic_nr++, topic_name, sizeof (topic_name));
+
+  char *ca, *id1, *id1_subj, *id2, *id2_subj;
+  ca = generate_ca ("ca1", TEST_IDENTITY_CA1_PRIVATE_KEY, 0, 3600);
+  id1 = generate_identity (ca, TEST_IDENTITY_CA1_PRIVATE_KEY, "id1", TEST_IDENTITY1_PRIVATE_KEY, 0, 3600, &id1_subj);
+  id2 = generate_identity (ca, TEST_IDENTITY_CA1_PRIVATE_KEY, "id2", TEST_IDENTITY1_PRIVATE_KEY, 0, 3600, &id2_subj);
+
+  char * grants[] = {
+      get_permissions_default_grant ("id1", id1_subj, topic_name),
+      get_permissions_default_grant ("id2", id2_subj, topic_name) };
+  char * perm_config = get_permissions_config (grants, 2, true);
+
+  char * gov_topic_rule = get_governance_topic_rule (topic_name, false, false, false, false, submsg_pk, payload_pk);
+  char * gov_config = get_governance_config (false, true, PK_N, PK_N, rtps_pk, gov_topic_rule, true);
+
+  crypto_init (
+    gov_config, perm_config, id1, TEST_IDENTITY1_PRIVATE_KEY, "init_test_cryptography_plain_data", "finalize_test_cryptography_plain_data",
+    gov_config, perm_config, id2, TEST_IDENTITY1_PRIVATE_KEY, "init_test_cryptography_wrapped", "finalize_test_cryptography_wrapped",
+    ca);
+
+  dds_entity_t pub, sub, pub_tp, sub_tp, wr, rd;
+  rd_wr_init (g_participant1, &pub, &pub_tp, &wr, g_participant2, &sub, &sub_tp, &rd, topic_name);
+
+  /* set forced plain data for payload/submsg/rtps */
+  DDS_Security_DatawriterCryptoHandle wr_handle = get_writer_crypto_handle (wr);
+  struct dds_security_cryptography_impl * crypto_impl = get_crypto_context (g_participant1);
+  set_force_plain_data (crypto_impl, wr_handle, rtps_pk != PK_N, submsg_pk != PK_N, payload_pk != BPK_N);
+
+  /* sync and write/take sample */
+  sync_writer_to_readers (g_participant1, wr, 1, DDS_SECS (2));
+  write_read_for (wr, g_participant2, rd, DDS_MSECS (10), false, true);
+
+  /* reset forced plain data */
+  set_force_plain_data (crypto_impl, wr_handle, false, false, false);
+
+  crypto_fini ((void * []) { gov_config, gov_topic_rule, grants[0], grants[1], perm_config, ca, id1_subj, id1, id2_subj, id2 }, 10);
+}

From edcbe1b22e3bea4c93261df7906bccc5ef7840a1 Mon Sep 17 00:00:00 2001
From: Dennis Potman <dennis.potman@adlinktech.com>
Date: Tue, 12 May 2020 20:28:11 +0200
Subject: [PATCH 191/238] Add a test that checks if all tokens and attributes
 are returned to the access control plugin

Signed-off-by: Dennis Potman <dennis.potman@adlinktech.com>
---
 .../ddsi/include/dds/ddsi/ddsi_security_omg.h |   4 +-
 src/core/ddsi/src/ddsi_security_omg.c         |  21 ++-
 src/security/core/tests/access_control.c      |  45 ++++-
 .../tests/common/access_control_wrapper.c     | 166 +++++++++++++++++-
 .../tests/common/access_control_wrapper.h     |   9 +
 src/security/core/tests/common/test_utils.c   |  33 ++--
 src/security/core/tests/common/test_utils.h   |   8 +-
 src/security/core/tests/crypto.c              |   2 +-
 src/security/core/tests/handshake.c           |   4 +-
 .../core/tests/secure_communication.c         |   2 +-
 10 files changed, 260 insertions(+), 34 deletions(-)

diff --git a/src/core/ddsi/include/dds/ddsi/ddsi_security_omg.h b/src/core/ddsi/include/dds/ddsi/ddsi_security_omg.h
index e7c3214..460a4ad 100644
--- a/src/core/ddsi/include/dds/ddsi/ddsi_security_omg.h
+++ b/src/core/ddsi/include/dds/ddsi/ddsi_security_omg.h
@@ -109,8 +109,8 @@ struct reader_sec_attributes {
   bool plugin_attr;
 };
 
-struct dds_security_authentication *q_omg_participant_get_authentication(const struct participant *pp);
-
+DDS_EXPORT struct dds_security_access_control *q_omg_participant_get_access_control(const struct participant *pp);
+DDS_EXPORT struct dds_security_authentication *q_omg_participant_get_authentication(const struct participant *pp);
 DDS_EXPORT struct dds_security_cryptography *q_omg_participant_get_cryptography(const struct participant *pp);
 
 void q_omg_vlog_exception(const struct ddsrt_log_cfg *lc, uint32_t cat, DDS_Security_SecurityException *exception, const char *file, uint32_t line, const char *func, const char *fmt, va_list ap);
diff --git a/src/core/ddsi/src/ddsi_security_omg.c b/src/core/ddsi/src/ddsi_security_omg.c
index a0d186a..d064105 100644
--- a/src/core/ddsi/src/ddsi_security_omg.c
+++ b/src/core/ddsi/src/ddsi_security_omg.c
@@ -284,6 +284,13 @@ static struct dds_security_context * q_omg_security_get_secure_context(const str
   return NULL;
 }
 
+struct dds_security_access_control *q_omg_participant_get_access_control(const struct participant *pp)
+{
+  if (pp && pp->e.gv->security_context && q_omg_is_security_loaded(pp->e.gv->security_context))
+    return pp->e.gv->security_context->access_control_context;
+  return NULL;
+}
+
 struct dds_security_authentication *q_omg_participant_get_authentication(const struct participant *pp)
 {
   if (pp && pp->e.gv->security_context && q_omg_is_security_loaded(pp->e.gv->security_context))
@@ -291,6 +298,13 @@ struct dds_security_authentication *q_omg_participant_get_authentication(const s
   return NULL;
 }
 
+struct dds_security_cryptography *q_omg_participant_get_cryptography(const struct participant *pp)
+{
+  if (pp && pp->e.gv->security_context && q_omg_is_security_loaded(pp->e.gv->security_context))
+    return pp->e.gv->security_context->crypto_context;
+  return NULL;
+}
+
 static struct dds_security_context * q_omg_security_get_secure_context_from_proxypp(const struct proxy_participant *proxypp)
 {
   if (proxypp && proxypp->e.gv->security_context && q_omg_is_security_loaded(proxypp->e.gv->security_context))
@@ -705,13 +719,6 @@ get_first_matched_proxypp_crypto_handle(struct participant_sec_attributes *attr)
   return handle;
 }
 
-struct dds_security_cryptography *q_omg_participant_get_cryptography(const struct participant *pp)
-{
-  if (pp && pp->e.gv->security_context && q_omg_is_security_loaded(pp->e.gv->security_context))
-    return pp->e.gv->security_context->crypto_context;
-  return NULL;
-}
-
 bool q_omg_is_security_loaded (dds_security_context *sc)
 {
   return (sc->crypto_context != NULL || sc->authentication_context != NULL || sc->access_control_context != NULL);
diff --git a/src/security/core/tests/access_control.c b/src/security/core/tests/access_control.c
index ea08591..19912ea 100644
--- a/src/security/core/tests/access_control.c
+++ b/src/security/core/tests/access_control.c
@@ -613,7 +613,7 @@ static void test_discovery_liveliness_protection(enum test_discovery_liveliness
   print_test_msg ("crypto handle for %s: %ld\n", builtin_wr_descr, secure_pub_wr_handle);
   CU_ASSERT_EQUAL_FATAL (exp_secure_pub_wr_handle, secure_pub_wr_handle != 0);
 
-  struct dds_security_cryptography_impl * crypto_context_pub = get_crypto_context (g_participant[0]);
+  struct dds_security_cryptography_impl * crypto_context_pub = get_cryptography_context (g_participant[0]);
   CU_ASSERT_FATAL (crypto_context_pub != NULL);
 
   struct crypto_encode_decode_data *log = get_encode_decode_log (crypto_context_pub, ENCODE_DATAWRITER_SUBMESSAGE, secure_pub_wr_handle);
@@ -814,3 +814,46 @@ CU_Test(ddssec_access_control, readwrite_protection, .timeout=60)
                   exp_pp_fail, exp_tp_fail, exp_wr_fail, exp_pp_fail, exp_tp_fail, exp_rd_fail, exp_sync_fail, default_deny ? "DENY" : "ALLOW");
               }
 }
+
+
+CU_Test(ddssec_access_control, check_returns)
+{
+  char topic_name[100];
+  create_topic_name ("ddssec_access_control_", g_topic_nr++, topic_name, sizeof (topic_name));
+
+  char *ca, *id1, *id2, *id1_subj, *id2_subj;
+  ca = generate_ca ("ca1", TEST_IDENTITY_CA1_PRIVATE_KEY, 0, 3600);
+  id1 = generate_identity (ca, TEST_IDENTITY_CA1_PRIVATE_KEY, "id1", TEST_IDENTITY1_PRIVATE_KEY, 0, 3600, &id1_subj);
+  id2 = generate_identity (ca, TEST_IDENTITY_CA1_PRIVATE_KEY, "id2", TEST_IDENTITY1_PRIVATE_KEY, 0, 3600, &id2_subj);
+
+  char * grants[] = {
+    get_permissions_default_grant ("id1", id1_subj, topic_name),
+    get_permissions_default_grant ("id2", id2_subj, topic_name) };
+  char * perm_config = get_permissions_config (grants, 2, true);
+
+  char * gov_topic_rule = get_governance_topic_rule (NULL, true, true, true, true, PK_E, BPK_E);
+  char * gov_config = get_governance_config (false, true, PK_E, PK_E, PK_E, gov_topic_rule, true);
+  const char * def_perm_ca = PF_F COMMON_ETC_PATH("default_permissions_ca.pem");
+
+  access_control_init (
+      2,
+      (const char *[]) { id1, id2 },
+      (const char *[]) { TEST_IDENTITY1_PRIVATE_KEY, TEST_IDENTITY1_PRIVATE_KEY },
+      (const char *[]) { ca, ca },
+      (bool []) { false, false },
+      (const char *[]) { "init_test_access_control_check_returns", "init_test_access_control_wrapped" },
+      (const char *[]) { "finalize_test_access_control_check_returns", "finalize_test_access_control_wrapped" },
+      (bool []) { true, true }, (const char *[]) { gov_config, gov_config },
+      (bool []) { true, true }, (const char *[]) { perm_config, perm_config },
+      (bool []) { true, true }, (const char *[]) { def_perm_ca, def_perm_ca });
+
+  dds_entity_t pub, sub, pub_tp, sub_tp, wr, rd;
+  rd_wr_init (g_participant[0], &pub, &pub_tp, &wr, g_participant[1], &sub, &sub_tp, &rd, topic_name);
+  sync_writer_to_readers (g_participant[0], wr, 1, DDS_SECS (1));
+  sync_reader_to_writers (g_participant[1], rd, 1, DDS_SECS (1));
+
+  struct dds_security_access_control_impl * ac_context = get_access_control_context (g_participant[0]);
+  CU_ASSERT_FATAL (check_returns (ac_context));
+
+  access_control_fini (2, (void * []) { gov_config, gov_topic_rule, grants[0], grants[1], perm_config, ca, id1_subj, id2_subj, id1, id2 }, 10);
+}
diff --git a/src/security/core/tests/common/access_control_wrapper.c b/src/security/core/tests/common/access_control_wrapper.c
index 327dae3..7a80087 100644
--- a/src/security/core/tests/common/access_control_wrapper.c
+++ b/src/security/core/tests/common/access_control_wrapper.c
@@ -12,6 +12,7 @@
 #include <string.h>
 #include <stdio.h>
 #include "dds/dds.h"
+#include "dds/ddsrt/circlist.h"
 #include "dds/ddsrt/heap.h"
 #include "dds/ddsrt/sync.h"
 #include "dds/ddsrt/string.h"
@@ -27,7 +28,8 @@ enum ac_plugin_mode {
   PLUGIN_MODE_ALL_OK,
   PLUGIN_MODE_WRAPPED,
   PLUGIN_MODE_NOT_ALLOWED,
-  PLUGIN_MODE_MISSING_FUNC
+  PLUGIN_MODE_MISSING_FUNC,
+  PLUGIN_MODE_CHECK_RETURNS,
 };
 
 enum ac_plugin_not_allowed {
@@ -56,6 +58,12 @@ enum ac_plugin_not_allowed {
 #define NOT_ALLOWED_REMOTE_READER_RELAY_ONLY      (1u << NOT_ALLOWED_ID_REMOTE_READER_RELAY_ONLY)
 #define NOT_ALLOWED_REMOTE_PERM                   (1u << NOT_ALLOWED_ID_REMOTE_PERM)
 
+struct returns_log_data {
+  struct ddsrt_circlist_elem e;
+  void * obj;
+};
+
+
 /**
  * Implementation structure for storing encapsulated members of the instance
  * while giving only the interface definition to user
@@ -65,8 +73,75 @@ struct dds_security_access_control_impl {
   dds_security_access_control *instance;
   enum ac_plugin_mode mode;
   uint32_t not_allowed_mask;
+  ddsrt_mutex_t returns_log_lock;
+  struct ddsrt_circlist returns_log;
+  bool invalid_return;
 };
 
+
+static void init_returns_log(struct dds_security_access_control_impl *impl)
+{
+  ddsrt_mutex_init (&impl->returns_log_lock);
+  ddsrt_circlist_init (&impl->returns_log);
+}
+
+static void fini_returns_log(struct dds_security_access_control_impl *impl)
+{
+  ddsrt_mutex_lock (&impl->returns_log_lock);
+  while (!ddsrt_circlist_isempty (&impl->returns_log))
+  {
+    struct ddsrt_circlist_elem *list_elem = ddsrt_circlist_oldest (&impl->returns_log);
+    ddsrt_circlist_remove (&impl->returns_log, list_elem);
+    ddsrt_free (list_elem);
+  }
+  ddsrt_mutex_unlock (&impl->returns_log_lock);
+  ddsrt_mutex_destroy (&impl->returns_log_lock);
+}
+
+static void register_return_obj (struct dds_security_access_control_impl * impl, void * obj)
+{
+  assert(impl->mode == PLUGIN_MODE_CHECK_RETURNS);
+  ddsrt_mutex_lock (&impl->returns_log_lock);
+  struct returns_log_data * attr_data = ddsrt_malloc (sizeof (*attr_data));
+  attr_data->obj = obj;
+  ddsrt_circlist_append(&impl->returns_log, &attr_data->e);
+  printf("log obj %p\n", obj);
+  ddsrt_mutex_unlock (&impl->returns_log_lock);
+}
+
+static void unregister_return_obj (struct dds_security_access_control_impl * impl, void * obj)
+{
+  assert(impl->mode == PLUGIN_MODE_CHECK_RETURNS);
+  ddsrt_mutex_lock (&impl->returns_log_lock);
+  struct ddsrt_circlist_elem *elem0 = ddsrt_circlist_oldest (&impl->returns_log), *elem = elem0;
+  while (elem != NULL)
+  {
+    struct returns_log_data *data = DDSRT_FROM_CIRCLIST (struct returns_log_data, e, elem);
+    if (data->obj == obj)
+    {
+      ddsrt_circlist_remove (&impl->returns_log, elem);
+      ddsrt_mutex_unlock (&impl->returns_log_lock);
+      ddsrt_free (elem);
+      printf("return obj %p\n", obj);
+      return;
+    }
+    elem = elem->next;
+    if (elem == elem0)
+      break;
+  }
+  impl->invalid_return = true;
+  ddsrt_mutex_unlock (&impl->returns_log_lock);
+}
+
+bool check_returns (struct dds_security_access_control_impl * impl)
+{
+  assert(impl->mode == PLUGIN_MODE_CHECK_RETURNS);
+  ddsrt_mutex_lock (&impl->returns_log_lock);
+  bool result = impl->invalid_return || !ddsrt_circlist_isempty (&impl->returns_log);
+  ddsrt_mutex_unlock (&impl->returns_log_lock);
+  return result;
+}
+
 static DDS_Security_PermissionsHandle validate_local_permissions(
     dds_security_access_control *instance,
     const dds_security_authentication *auth_plugin,
@@ -87,7 +162,13 @@ static DDS_Security_PermissionsHandle validate_local_permissions(
       }
       /* fall through */
     case PLUGIN_MODE_WRAPPED:
-      return impl->instance->validate_local_permissions(impl->instance, auth_plugin, identity, domain_id, participant_qos, ex);
+    case PLUGIN_MODE_CHECK_RETURNS:
+    {
+      DDS_Security_PermissionsHandle handle = impl->instance->validate_local_permissions(impl->instance, auth_plugin, identity, domain_id, participant_qos, ex);
+      if (impl->mode == PLUGIN_MODE_CHECK_RETURNS)
+          register_return_obj (impl, (void *) handle);
+      return handle;
+    }
 
     default:
       return 1;
@@ -115,8 +196,14 @@ static DDS_Security_PermissionsHandle validate_remote_permissions(
       }
       /* fall through */
     case PLUGIN_MODE_WRAPPED:
-      return impl->instance->validate_remote_permissions(impl->instance, auth_plugin, local_identity_handle, remote_identity_handle,
+    case PLUGIN_MODE_CHECK_RETURNS:
+    {
+      DDS_Security_PermissionsHandle handle = impl->instance->validate_remote_permissions(impl->instance, auth_plugin, local_identity_handle, remote_identity_handle,
         remote_permissions_token, remote_credential_token, ex);
+      if (impl->mode == PLUGIN_MODE_CHECK_RETURNS)
+          register_return_obj (impl, (void *) handle);
+      return handle;
+    }
 
     default:
       return 0;
@@ -142,6 +229,7 @@ static DDS_Security_boolean check_create_participant(
       }
       /* fall through */
     case PLUGIN_MODE_WRAPPED:
+    case PLUGIN_MODE_CHECK_RETURNS:
       return impl->instance->check_create_participant(impl->instance, permissions_handle, domain_id, participant_qos, ex);
 
     default:
@@ -174,6 +262,7 @@ static DDS_Security_boolean check_create_datawriter(
       }
       /* fall through */
     case PLUGIN_MODE_WRAPPED:
+    case PLUGIN_MODE_CHECK_RETURNS:
       return impl->instance->check_create_datawriter(impl->instance, permissions_handle, domain_id, topic_name, writer_qos, partition, data_tag, ex);
 
     default:
@@ -203,6 +292,7 @@ static DDS_Security_boolean check_create_datareader(
       }
       /* fall through */
     case PLUGIN_MODE_WRAPPED:
+    case PLUGIN_MODE_CHECK_RETURNS:
       return impl->instance->check_create_datareader(impl->instance, permissions_handle, domain_id, topic_name, reader_qos, partition, data_tag, ex);
 
     default:
@@ -230,6 +320,7 @@ static DDS_Security_boolean check_create_topic(
       }
       /* fall through */
     case PLUGIN_MODE_WRAPPED:
+    case PLUGIN_MODE_CHECK_RETURNS:
       return impl->instance->check_create_topic(impl->instance, permissions_handle, domain_id, topic_name, qos, ex);
 
     default:
@@ -249,6 +340,7 @@ static DDS_Security_boolean check_local_datawriter_register_instance(
   {
     case PLUGIN_MODE_WRAPPED:
     case PLUGIN_MODE_NOT_ALLOWED:
+    case PLUGIN_MODE_CHECK_RETURNS:
       return impl->instance->check_local_datawriter_register_instance(impl->instance, permissions_handle, writer, key, ex);
 
     default:
@@ -268,6 +360,7 @@ static DDS_Security_boolean check_local_datawriter_dispose_instance(
   {
     case PLUGIN_MODE_WRAPPED:
     case PLUGIN_MODE_NOT_ALLOWED:
+    case PLUGIN_MODE_CHECK_RETURNS:
       return impl->instance->check_local_datawriter_dispose_instance(impl->instance, permissions_handle, writer, key, ex);
 
     default:
@@ -294,6 +387,7 @@ static DDS_Security_boolean check_remote_participant(
       }
       /* fall through */
     case PLUGIN_MODE_WRAPPED:
+    case PLUGIN_MODE_CHECK_RETURNS:
       return impl->instance->check_remote_participant(impl->instance, permissions_handle, domain_id, participant_data, ex);
 
     default:
@@ -320,6 +414,7 @@ static DDS_Security_boolean check_remote_datawriter(
       }
       /* fall through */
     case PLUGIN_MODE_WRAPPED:
+    case PLUGIN_MODE_CHECK_RETURNS:
       return impl->instance->check_remote_datawriter(impl->instance, permissions_handle, domain_id, publication_data, ex);
 
     default:
@@ -350,6 +445,7 @@ static DDS_Security_boolean check_remote_datareader(
       }
       /* fall through */
     case PLUGIN_MODE_WRAPPED:
+    case PLUGIN_MODE_CHECK_RETURNS:
     {
       bool ret;
       if ((ret = impl->instance->check_remote_datareader(impl->instance, permissions_handle, domain_id, subscription_data, relay_only, ex)))
@@ -389,6 +485,7 @@ static DDS_Security_boolean check_remote_topic(
       }
       /* fall through */
     case PLUGIN_MODE_WRAPPED:
+    case PLUGIN_MODE_CHECK_RETURNS:
       return impl->instance->check_remote_topic(impl->instance, permissions_handle, domain_id, topic_data, ex);
 
     default:
@@ -409,6 +506,7 @@ static DDS_Security_boolean check_local_datawriter_match(
   {
     case PLUGIN_MODE_WRAPPED:
     case PLUGIN_MODE_NOT_ALLOWED:
+    case PLUGIN_MODE_CHECK_RETURNS:
       return impl->instance->check_local_datawriter_match(impl->instance, writer_permissions_handle, reader_permissions_handle, publication_data, subscription_data, ex);
 
     default:
@@ -429,6 +527,7 @@ static DDS_Security_boolean check_local_datareader_match(
   {
     case PLUGIN_MODE_WRAPPED:
     case PLUGIN_MODE_NOT_ALLOWED:
+    case PLUGIN_MODE_CHECK_RETURNS:
       return impl->instance->check_local_datareader_match(impl->instance, reader_permissions_handle, writer_permissions_handle, subscription_data, publication_data, ex);
 
     default:
@@ -450,6 +549,7 @@ static DDS_Security_boolean check_remote_datawriter_register_instance(
   {
     case PLUGIN_MODE_WRAPPED:
     case PLUGIN_MODE_NOT_ALLOWED:
+    case PLUGIN_MODE_CHECK_RETURNS:
       return impl->instance->check_remote_datawriter_register_instance(impl->instance, permissions_handle, reader, publication_handle, key, instance_handle, ex);
 
     default:
@@ -470,6 +570,7 @@ static DDS_Security_boolean check_remote_datawriter_dispose_instance(
   {
     case PLUGIN_MODE_WRAPPED:
     case PLUGIN_MODE_NOT_ALLOWED:
+    case PLUGIN_MODE_CHECK_RETURNS:
       return impl->instance->check_remote_datawriter_dispose_instance(impl->instance, permissions_handle, reader, publication_handle, key, ex);
 
     default:
@@ -486,6 +587,9 @@ static DDS_Security_boolean get_permissions_token(
   struct dds_security_access_control_impl *impl = (struct dds_security_access_control_impl *)instance;
   switch (impl->mode)
   {
+    case PLUGIN_MODE_CHECK_RETURNS:
+      register_return_obj (impl, (void*) permissions_token);
+      /* fall through */
     case PLUGIN_MODE_WRAPPED:
     case PLUGIN_MODE_NOT_ALLOWED:
       return impl->instance->get_permissions_token(impl->instance, permissions_token, handle, ex);
@@ -506,6 +610,9 @@ static DDS_Security_boolean get_permissions_credential_token(
   struct dds_security_access_control_impl *impl = (struct dds_security_access_control_impl *)instance;
   switch (impl->mode)
   {
+    case PLUGIN_MODE_CHECK_RETURNS:
+      register_return_obj (impl, (void*) permissions_credential_token);
+      /* fall through */
     case PLUGIN_MODE_WRAPPED:
     case PLUGIN_MODE_NOT_ALLOWED:
       return impl->instance->get_permissions_credential_token(impl->instance, permissions_credential_token, handle, ex);
@@ -525,6 +632,7 @@ static DDS_Security_boolean set_listener(
   {
     case PLUGIN_MODE_WRAPPED:
     case PLUGIN_MODE_NOT_ALLOWED:
+    case PLUGIN_MODE_CHECK_RETURNS:
       return impl->instance->set_listener (impl->instance, listener, ex);
 
     default:
@@ -540,6 +648,9 @@ static DDS_Security_boolean return_permissions_token(
   struct dds_security_access_control_impl *impl = (struct dds_security_access_control_impl *)instance;
   switch (impl->mode)
   {
+    case PLUGIN_MODE_CHECK_RETURNS:
+      unregister_return_obj (impl, (void*) token);
+      /* fall through */
     case PLUGIN_MODE_WRAPPED:
     case PLUGIN_MODE_NOT_ALLOWED:
       return impl->instance->return_permissions_token (impl->instance, token, ex);
@@ -558,6 +669,9 @@ static DDS_Security_boolean return_permissions_credential_token(
   struct dds_security_access_control_impl *impl = (struct dds_security_access_control_impl *)instance;
   switch (impl->mode)
   {
+    case PLUGIN_MODE_CHECK_RETURNS:
+      unregister_return_obj (impl, (void*) permissions_credential_token);
+      /* fall through */
     case PLUGIN_MODE_WRAPPED:
     case PLUGIN_MODE_NOT_ALLOWED:
       return impl->instance->return_permissions_credential_token(impl->instance, permissions_credential_token, ex);
@@ -576,6 +690,9 @@ static DDS_Security_boolean get_participant_sec_attributes(
   struct dds_security_access_control_impl *impl = (struct dds_security_access_control_impl *)instance;
   switch (impl->mode)
   {
+    case PLUGIN_MODE_CHECK_RETURNS:
+      register_return_obj (impl, (void*) attributes);
+      /* fall through */
     case PLUGIN_MODE_WRAPPED:
     case PLUGIN_MODE_NOT_ALLOWED:
       return impl->instance->get_participant_sec_attributes(impl->instance, permissions_handle, attributes, ex);
@@ -595,6 +712,9 @@ static DDS_Security_boolean get_topic_sec_attributes(
   struct dds_security_access_control_impl *impl = (struct dds_security_access_control_impl *)instance;
   switch (impl->mode)
   {
+    case PLUGIN_MODE_CHECK_RETURNS:
+      register_return_obj (impl, (void*) attributes);
+      /* fall through */
     case PLUGIN_MODE_WRAPPED:
     case PLUGIN_MODE_NOT_ALLOWED:
       return impl->instance->get_topic_sec_attributes(impl->instance, permissions_handle, topic_name, attributes, ex);
@@ -616,6 +736,9 @@ static DDS_Security_boolean get_datawriter_sec_attributes(
   struct dds_security_access_control_impl *impl = (struct dds_security_access_control_impl *)instance;
   switch (impl->mode)
   {
+    case PLUGIN_MODE_CHECK_RETURNS:
+      register_return_obj (impl, (void*) attributes);
+      /* fall through */
     case PLUGIN_MODE_WRAPPED:
     case PLUGIN_MODE_NOT_ALLOWED:
       return impl->instance->get_datawriter_sec_attributes(impl->instance, permissions_handle, topic_name, partition, data_tag, attributes, ex);
@@ -637,6 +760,9 @@ static DDS_Security_boolean get_datareader_sec_attributes(
   struct dds_security_access_control_impl *impl = (struct dds_security_access_control_impl *)instance;
   switch (impl->mode)
   {
+    case PLUGIN_MODE_CHECK_RETURNS:
+      register_return_obj (impl, (void*) attributes);
+      /* fall through */
     case PLUGIN_MODE_WRAPPED:
     case PLUGIN_MODE_NOT_ALLOWED:
       return impl->instance->get_datareader_sec_attributes(impl->instance, permissions_handle, topic_name, partition, data_tag, attributes, ex);
@@ -654,6 +780,9 @@ static DDS_Security_boolean return_participant_sec_attributes(
   struct dds_security_access_control_impl *impl = (struct dds_security_access_control_impl *)instance;
   switch (impl->mode)
   {
+    case PLUGIN_MODE_CHECK_RETURNS:
+      unregister_return_obj (impl, (void*) attributes);
+      /* fall through */
     case PLUGIN_MODE_WRAPPED:
     case PLUGIN_MODE_NOT_ALLOWED:
       return impl->instance->return_participant_sec_attributes(impl->instance, attributes, ex);
@@ -671,6 +800,9 @@ static DDS_Security_boolean return_topic_sec_attributes(
   struct dds_security_access_control_impl *impl = (struct dds_security_access_control_impl *)instance;
   switch (impl->mode)
   {
+    case PLUGIN_MODE_CHECK_RETURNS:
+      unregister_return_obj (impl, (void*) attributes);
+      /* fall through */
     case PLUGIN_MODE_WRAPPED:
     case PLUGIN_MODE_NOT_ALLOWED:
       return impl->instance->return_topic_sec_attributes(impl->instance, attributes, ex);
@@ -688,6 +820,9 @@ static DDS_Security_boolean return_datawriter_sec_attributes(
   struct dds_security_access_control_impl *impl = (struct dds_security_access_control_impl *)instance;
   switch (impl->mode)
   {
+    case PLUGIN_MODE_CHECK_RETURNS:
+      unregister_return_obj (impl, (void*) attributes);
+      /* fall through */
     case PLUGIN_MODE_WRAPPED:
     case PLUGIN_MODE_NOT_ALLOWED:
       return impl->instance->return_datawriter_sec_attributes(impl->instance, attributes, ex);
@@ -705,6 +840,9 @@ static DDS_Security_boolean return_datareader_sec_attributes(
   struct dds_security_access_control_impl *impl = (struct dds_security_access_control_impl *)instance;
   switch (impl->mode)
   {
+    case PLUGIN_MODE_CHECK_RETURNS:
+      unregister_return_obj (impl, (void*) attributes);
+      /* fall through */
     case PLUGIN_MODE_WRAPPED:
     case PLUGIN_MODE_NOT_ALLOWED:
       return impl->instance->return_datareader_sec_attributes(impl->instance, attributes, ex);
@@ -722,6 +860,9 @@ static DDS_Security_boolean return_permissions_handle(
   struct dds_security_access_control_impl *impl = (struct dds_security_access_control_impl *)instance;
   switch (impl->mode)
   {
+    case PLUGIN_MODE_CHECK_RETURNS:
+      unregister_return_obj (impl, (void*) permissions_handle);
+      /* fall through */
     case PLUGIN_MODE_WRAPPED:
     case PLUGIN_MODE_NOT_ALLOWED:
       return impl->instance->return_permissions_handle(impl->instance, permissions_handle, ex);
@@ -863,3 +1004,22 @@ int finalize_test_access_control_not_allowed(void *context)
   assert(impl->mode == PLUGIN_MODE_NOT_ALLOWED);
   return finalize_test_access_control_common(impl, true);
 }
+
+int init_test_access_control_check_returns(const char *argument, void **context, struct ddsi_domaingv *gv)
+{
+  struct dds_security_access_control_impl *impl = init_test_access_control_common(argument, true, gv);
+  if (!impl)
+    return DDS_SECURITY_FAILED;
+  impl->mode = PLUGIN_MODE_CHECK_RETURNS;
+  init_returns_log (impl);
+  *context = impl;
+  return DDS_SECURITY_SUCCESS;
+}
+
+int finalize_test_access_control_check_returns(void *context)
+{
+  struct dds_security_access_control_impl* impl = (struct dds_security_access_control_impl*) context;
+  assert(impl->mode == PLUGIN_MODE_CHECK_RETURNS);
+  fini_returns_log (impl);
+  return finalize_test_access_control_common(impl, true);
+}
diff --git a/src/security/core/tests/common/access_control_wrapper.h b/src/security/core/tests/common/access_control_wrapper.h
index 6f733fc..8dc0ecd 100644
--- a/src/security/core/tests/common/access_control_wrapper.h
+++ b/src/security/core/tests/common/access_control_wrapper.h
@@ -20,6 +20,10 @@
    mode. This prefix is used to exclude built-in topics from being disallowed. */
 #define AC_WRAPPER_TOPIC_PREFIX "ddssec_access_control_"
 
+struct dds_security_access_control_impl;
+
+SECURITY_EXPORT bool check_returns (struct dds_security_access_control_impl * impl);
+
 /* Init in all-ok mode: all functions return success without calling the actual plugin */
 SECURITY_EXPORT int init_test_access_control_all_ok(const char *argument, void **context, struct ddsi_domaingv *gv);
 SECURITY_EXPORT int finalize_test_access_control_all_ok(void *context);
@@ -49,4 +53,9 @@ INIT_NOT_ALLOWED_DECL(remote_permissions_not_allowed)
 
 SECURITY_EXPORT int finalize_test_access_control_not_allowed(void *context);
 
+/* Init in attribute get and return logging mode */
+SECURITY_EXPORT int init_test_access_control_check_returns(const char *argument, void **context, struct ddsi_domaingv *gv);
+SECURITY_EXPORT int finalize_test_access_control_check_returns(void *context);
+
+
 #endif /* SECURITY_CORE_TEST_ACCESS_CONTROL_WRAPPER_H_ */
diff --git a/src/security/core/tests/common/test_utils.c b/src/security/core/tests/common/test_utils.c
index eff8f51..c17f1cd 100644
--- a/src/security/core/tests/common/test_utils.c
+++ b/src/security/core/tests/common/test_utils.c
@@ -495,23 +495,24 @@ void write_read_for(dds_entity_t wr, dds_entity_t pp_rd, dds_entity_t rd, dds_du
   CU_ASSERT_EQUAL_FATAL (read_fail, exp_read_fail);
 }
 
-struct dds_security_cryptography_impl * get_crypto_context(dds_entity_t participant)
-{
-  struct dds_entity *pp_entity = NULL;
-  struct participant *pp;
-  struct dds_security_cryptography_impl *context;
-  dds_return_t ret;
+#define GET_SECURITY_PLUGIN_CONTEXT(name_) \
+  struct dds_security_##name_##_impl * get_##name_##_context(dds_entity_t participant) \
+  { \
+    struct dds_entity *pp_entity = NULL; \
+    dds_return_t ret = dds_entity_lock (participant, DDS_KIND_PARTICIPANT, &pp_entity); \
+    CU_ASSERT_EQUAL_FATAL (ret, 0); \
+    thread_state_awake (lookup_thread_state(), &pp_entity->m_domain->gv); \
+    struct participant *pp = entidx_lookup_participant_guid (pp_entity->m_domain->gv.entity_index, &pp_entity->m_guid); \
+    CU_ASSERT_FATAL (pp != NULL); \
+    struct dds_security_##name_##_impl *context = (struct dds_security_##name_##_impl *) q_omg_participant_get_##name_ (pp); \
+    thread_state_asleep (lookup_thread_state ()); \
+    dds_entity_unlock (pp_entity); \
+    return context; \
+  }
 
-  ret = dds_entity_lock (participant, DDS_KIND_PARTICIPANT, &pp_entity);
-  CU_ASSERT_EQUAL_FATAL (ret, 0);
-  thread_state_awake (lookup_thread_state(), &pp_entity->m_domain->gv);
-  pp = entidx_lookup_participant_guid (pp_entity->m_domain->gv.entity_index, &pp_entity->m_guid);
-  CU_ASSERT_FATAL (pp != NULL);
-  context = (struct dds_security_cryptography_impl *) q_omg_participant_get_cryptography (pp);
-  thread_state_asleep (lookup_thread_state ());
-  dds_entity_unlock (pp_entity);
-  return context;
-}
+GET_SECURITY_PLUGIN_CONTEXT(access_control)
+GET_SECURITY_PLUGIN_CONTEXT(authentication)
+GET_SECURITY_PLUGIN_CONTEXT(cryptography)
 
 const char * pk_to_str(DDS_Security_ProtectionKind pk)
 {
diff --git a/src/security/core/tests/common/test_utils.h b/src/security/core/tests/common/test_utils.h
index 7fe1487..8b930c3 100644
--- a/src/security/core/tests/common/test_utils.h
+++ b/src/security/core/tests/common/test_utils.h
@@ -82,10 +82,16 @@ void rd_wr_init_fail (
     bool exp_pubtp_fail, bool exp_wr_fail,
     bool exp_subtp_fail, bool exp_rd_fail);
 void write_read_for (dds_entity_t wr, dds_entity_t pp_rd, dds_entity_t rd, dds_duration_t dur, bool exp_write_fail, bool exp_read_fail);
-struct dds_security_cryptography_impl * get_crypto_context (dds_entity_t participant);
 const char * pk_to_str (DDS_Security_ProtectionKind pk);
 const char * bpk_to_str (DDS_Security_BasicProtectionKind bpk);
 DDS_Security_DatawriterCryptoHandle get_builtin_writer_crypto_handle(dds_entity_t participant, unsigned entityid);
 DDS_Security_DatawriterCryptoHandle get_writer_crypto_handle(dds_entity_t writer);
 
+#define GET_SECURITY_PLUGIN_CONTEXT_DECL(name_) \
+  struct dds_security_##name_##_impl * get_##name_##_context(dds_entity_t participant);
+GET_SECURITY_PLUGIN_CONTEXT_DECL(access_control)
+GET_SECURITY_PLUGIN_CONTEXT_DECL(authentication)
+GET_SECURITY_PLUGIN_CONTEXT_DECL(cryptography)
+
+
 #endif /* SECURITY_CORE_TEST_UTILS_H_ */
diff --git a/src/security/core/tests/crypto.c b/src/security/core/tests/crypto.c
index 098b0d7..ca41f2f 100644
--- a/src/security/core/tests/crypto.c
+++ b/src/security/core/tests/crypto.c
@@ -156,7 +156,7 @@ CU_Theory((const char * test_descr, DDS_Security_BasicProtectionKind payload_pk,
 
   /* set forced plain data for payload/submsg/rtps */
   DDS_Security_DatawriterCryptoHandle wr_handle = get_writer_crypto_handle (wr);
-  struct dds_security_cryptography_impl * crypto_impl = get_crypto_context (g_participant1);
+  struct dds_security_cryptography_impl * crypto_impl = get_cryptography_context (g_participant1);
   set_force_plain_data (crypto_impl, wr_handle, rtps_pk != PK_N, submsg_pk != PK_N, payload_pk != BPK_N);
 
   /* sync and write/take sample */
diff --git a/src/security/core/tests/handshake.c b/src/security/core/tests/handshake.c
index 26d6d9a..0891d34 100644
--- a/src/security/core/tests/handshake.c
+++ b/src/security/core/tests/handshake.c
@@ -143,11 +143,11 @@ CU_Test(ddssec_handshake, check_tokens)
   write_read_for (g_wr, g_participant2, g_rd, DDS_MSECS (100), false, false);
 
   // Get subscriber and publisher crypto tokens
-  struct dds_security_cryptography_impl * crypto_context_pub = get_crypto_context (g_participant1);
+  struct dds_security_cryptography_impl * crypto_context_pub = get_cryptography_context (g_participant1);
   CU_ASSERT_FATAL (crypto_context_pub != NULL);
   struct ddsrt_circlist *pub_tokens = get_crypto_tokens (crypto_context_pub);
 
-  struct dds_security_cryptography_impl * crypto_context_sub = get_crypto_context (g_participant2);
+  struct dds_security_cryptography_impl * crypto_context_sub = get_cryptography_context (g_participant2);
   CU_ASSERT_FATAL (crypto_context_sub != NULL);
   struct ddsrt_circlist *sub_tokens = get_crypto_tokens (crypto_context_sub);
 
diff --git a/src/security/core/tests/secure_communication.c b/src/security/core/tests/secure_communication.c
index 94f8c13..52dd62d 100644
--- a/src/security/core/tests/secure_communication.c
+++ b/src/security/core/tests/secure_communication.c
@@ -119,7 +119,7 @@ static dds_entity_t create_pp (dds_domainid_t domain_id, const struct domain_sec
   dds_entity_t pp = dds_create_participant (domain_id, qos, NULL);
   CU_ASSERT_FATAL (pp > 0);
   dds_delete_qos (qos);
-  struct dds_security_cryptography_impl * crypto_context = get_crypto_context (pp);
+  struct dds_security_cryptography_impl * crypto_context = get_cryptography_context (pp);
   CU_ASSERT_FATAL (crypto_context != NULL);
   assert (set_crypto_params);
   set_crypto_params (crypto_context, domain_config);

From 24594f68fbf018a06539c0be0b3d87b6d741e6ba Mon Sep 17 00:00:00 2001
From: Dennis Potman <dennis.potman@adlinktech.com>
Date: Tue, 12 May 2020 21:16:30 +0200
Subject: [PATCH 192/238] Add access control test for testing that
 communication for an allowed topic keeps working when a writer for a denied
 topic is created

Signed-off-by: Dennis Potman <dennis.potman@adlinktech.com>
---
 src/security/core/tests/access_control.c    | 57 +++++++++++++++++++++
 src/security/core/tests/common/test_utils.c | 17 +++---
 src/security/core/tests/common/test_utils.h |  1 +
 3 files changed, 69 insertions(+), 6 deletions(-)

diff --git a/src/security/core/tests/access_control.c b/src/security/core/tests/access_control.c
index 19912ea..db1b27b 100644
--- a/src/security/core/tests/access_control.c
+++ b/src/security/core/tests/access_control.c
@@ -857,3 +857,60 @@ CU_Test(ddssec_access_control, check_returns)
 
   access_control_fini (2, (void * []) { gov_config, gov_topic_rule, grants[0], grants[1], perm_config, ca, id1_subj, id2_subj, id1, id2 }, 10);
 }
+
+
+CU_Test(ddssec_access_control, denied_topic)
+{
+  char topic_name[100], denied_topic_name[100];
+  create_topic_name ("ddssec_access_control_", g_topic_nr++, topic_name, sizeof (topic_name));
+  create_topic_name ("ddssec_access_control_", g_topic_nr++, denied_topic_name, sizeof (denied_topic_name));
+
+  char *ca, *id1, *id2, *id1_subj, *id2_subj;
+  ca = generate_ca ("ca1", TEST_IDENTITY_CA1_PRIVATE_KEY, 0, 3600);
+  id1 = generate_identity (ca, TEST_IDENTITY_CA1_PRIVATE_KEY, "id1", TEST_IDENTITY1_PRIVATE_KEY, 0, 3600, &id1_subj);
+  id2 = generate_identity (ca, TEST_IDENTITY_CA1_PRIVATE_KEY, "id2", TEST_IDENTITY1_PRIVATE_KEY, 0, 3600, &id2_subj);
+
+   dds_time_t now = dds_time ();
+  char * sub_rules_xml = get_permissions_rules (NULL, NULL, NULL, denied_topic_name, denied_topic_name);
+  char * grants_pub[] = { get_permissions_grant ("id1", id1_subj, now, now + DDS_SECS(3600), NULL, "ALLOW") };
+  char * grants_sub[] = { get_permissions_grant ("id2", id2_subj, now, now + DDS_SECS(3600), sub_rules_xml, "ALLOW") };
+  char * perm_config_pub = get_permissions_config (grants_pub, 1, true);
+  char * perm_config_sub = get_permissions_config (grants_sub, 1, true);
+
+  char * gov_topic_rule = get_governance_topic_rule (NULL, true, true, true, true, PK_E, BPK_E);
+  char * gov_config = get_governance_config (false, true, PK_E, PK_E, PK_E, gov_topic_rule, true);
+  const char * def_perm_ca = PF_F COMMON_ETC_PATH("default_permissions_ca.pem");
+
+  access_control_init (
+      2,
+      (const char *[]) { id1, id2 },
+      (const char *[]) { TEST_IDENTITY1_PRIVATE_KEY, TEST_IDENTITY1_PRIVATE_KEY },
+      (const char *[]) { ca, ca },
+      (bool []) { false, false },
+      NULL, NULL,
+      (bool []) { true, true }, (const char *[]) { gov_config, gov_config },
+      (bool []) { true, true }, (const char *[]) { perm_config_pub, perm_config_sub },
+      (bool []) { true, true }, (const char *[]) { def_perm_ca, def_perm_ca });
+
+  dds_entity_t pub, sub, pub_tp, sub_tp, wr, rd;
+  rd_wr_init (g_participant[0], &pub, &pub_tp, &wr, g_participant[1], &sub, &sub_tp, &rd, topic_name);
+  sync_writer_to_readers (g_participant[0], wr, 1, DDS_SECS (1));
+  sync_reader_to_writers (g_participant[1], rd, 1, DDS_SECS (1));
+
+  /* Create a topic that is denied in the subscriber pp security config */
+  dds_entity_t denied_pub_tp = dds_create_topic (g_participant[0], &SecurityCoreTests_Type1_desc, denied_topic_name, NULL, NULL);
+  CU_ASSERT_FATAL (denied_pub_tp > 0);
+  dds_qos_t * qos = get_default_test_qos ();
+  dds_entity_t denied_tp_wr = dds_create_writer (pub, denied_pub_tp, qos, NULL);
+  CU_ASSERT_FATAL (denied_tp_wr > 0);
+
+  /* Check that creating denied topic for subscriber fails */
+  dds_entity_t denied_sub_tp = dds_create_topic (g_participant[1], &SecurityCoreTests_Type1_desc, denied_topic_name, NULL, NULL);
+  CU_ASSERT_FATAL (denied_sub_tp == DDS_RETCODE_NOT_ALLOWED_BY_SECURITY);
+
+  /* Check if communication for allowed topic is still working */
+  write_read_for (wr, g_participant[1], rd, DDS_MSECS (10), false, false);
+
+  dds_delete_qos (qos);
+  access_control_fini (2, (void * []) { gov_config, gov_topic_rule, sub_rules_xml, grants_pub[0], grants_sub[0], perm_config_pub, perm_config_sub, ca, id1_subj, id2_subj, id1, id2 }, 12);
+}
\ No newline at end of file
diff --git a/src/security/core/tests/common/test_utils.c b/src/security/core/tests/common/test_utils.c
index c17f1cd..e7e7ed4 100644
--- a/src/security/core/tests/common/test_utils.c
+++ b/src/security/core/tests/common/test_utils.c
@@ -398,6 +398,16 @@ bool reader_wait_for_data (dds_entity_t pp, dds_entity_t rd, dds_duration_t dur)
   return ret > 0;
 }
 
+dds_qos_t * get_default_test_qos (void)
+{
+  dds_qos_t * qos = dds_create_qos ();
+  CU_ASSERT_FATAL (qos != NULL);
+  dds_qset_history (qos, DDS_HISTORY_KEEP_ALL, -1);
+  dds_qset_durability (qos, DDS_DURABILITY_TRANSIENT_LOCAL);
+  dds_qset_reliability (qos, DDS_RELIABILITY_RELIABLE, DDS_INFINITY);
+  return qos;
+}
+
 void rd_wr_init_fail(
     dds_entity_t pp_wr, dds_entity_t *pub, dds_entity_t *pub_tp, dds_entity_t *wr,
     dds_entity_t pp_rd, dds_entity_t *sub, dds_entity_t *sub_tp, dds_entity_t *rd,
@@ -405,12 +415,7 @@ void rd_wr_init_fail(
     bool exp_pubtp_fail, bool exp_wr_fail,
     bool exp_subtp_fail, bool exp_rd_fail)
 {
-  dds_qos_t * qos = dds_create_qos ();
-  CU_ASSERT_FATAL (qos != NULL);
-  dds_qset_history (qos, DDS_HISTORY_KEEP_ALL, -1);
-  dds_qset_durability (qos, DDS_DURABILITY_TRANSIENT_LOCAL);
-  dds_qset_reliability (qos, DDS_RELIABILITY_RELIABLE, DDS_INFINITY);
-
+  dds_qos_t * qos = get_default_test_qos ();
   *pub = dds_create_publisher (pp_wr, NULL, NULL);
   CU_ASSERT_FATAL (*pub > 0);
   *sub = dds_create_subscriber (pp_rd, NULL, NULL);
diff --git a/src/security/core/tests/common/test_utils.h b/src/security/core/tests/common/test_utils.h
index 8b930c3..b2dfff5 100644
--- a/src/security/core/tests/common/test_utils.h
+++ b/src/security/core/tests/common/test_utils.h
@@ -71,6 +71,7 @@ char *create_topic_name (const char *prefix, uint32_t nr, char *name, size_t siz
 void sync_writer_to_readers (dds_entity_t pp_wr, dds_entity_t wr, uint32_t exp_count, dds_duration_t timeout);
 void sync_reader_to_writers (dds_entity_t pp_rd, dds_entity_t rd, uint32_t exp_count, dds_duration_t timeout);
 bool reader_wait_for_data (dds_entity_t pp, dds_entity_t rd, dds_duration_t dur);
+dds_qos_t * get_default_test_qos (void);
 void rd_wr_init (
     dds_entity_t pp_wr, dds_entity_t *pub, dds_entity_t *pub_tp, dds_entity_t *wr,
     dds_entity_t pp_rd, dds_entity_t *sub, dds_entity_t *sub_tp, dds_entity_t *rd,

From 48e411bb766b8ae99f6f0db6bb83fc18edf229cc Mon Sep 17 00:00:00 2001
From: Dennis Potman <dennis.potman@adlinktech.com>
Date: Wed, 13 May 2020 11:17:15 +0200
Subject: [PATCH 193/238] Fix rd-wr synchronization in access control
 expiry_multiple test

Signed-off-by: Dennis Potman <dennis.potman@adlinktech.com>
---
 src/security/core/tests/access_control.c | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/src/security/core/tests/access_control.c b/src/security/core/tests/access_control.c
index db1b27b..c481c5b 100644
--- a/src/security/core/tests/access_control.c
+++ b/src/security/core/tests/access_control.c
@@ -297,12 +297,7 @@ CU_Test(ddssec_access_control, permissions_expiry_multiple, .timeout=20)
       id, pk, ca_list, exp_fail, NULL, NULL,
       incl_el, gov, incl_el, perm_conf, incl_el, perm_ca);
 
-  dds_qos_t * qos = dds_create_qos ();
-  CU_ASSERT_FATAL (qos != NULL);
-  dds_qset_history (qos, DDS_HISTORY_KEEP_ALL, -1);
-  dds_qset_durability (qos, DDS_DURABILITY_TRANSIENT_LOCAL);
-  dds_qset_reliability (qos, DDS_RELIABILITY_RELIABLE, DDS_INFINITY);
-
+  dds_qos_t * qos = get_default_test_qos ();
   dds_entity_t rd[N_RD];
   for (int i = 0; i < N_RD; i++)
   {
@@ -312,7 +307,7 @@ CU_Test(ddssec_access_control, permissions_expiry_multiple, .timeout=20)
     CU_ASSERT_FATAL (sub_tp > 0);
     rd[i] = dds_create_reader (sub, sub_tp, qos, NULL);
     CU_ASSERT_FATAL (rd[i] > 0);
-    dds_set_status_mask (rd[i], DDS_DATA_AVAILABLE_STATUS);
+    dds_set_status_mask (rd[i], DDS_SUBSCRIPTION_MATCHED_STATUS);
   }
 
   dds_entity_t wr[N_WR];
@@ -328,6 +323,11 @@ CU_Test(ddssec_access_control, permissions_expiry_multiple, .timeout=20)
     sync_writer_to_readers (g_participant[i + N_RD], wr[i], N_RD, DDS_SECS(2));
   }
   dds_delete_qos (qos);
+  for (int i = 0; i < N_RD; i++)
+  {
+    sync_reader_to_writers (g_participant[i], rd[i], N_WR, DDS_SECS (2));
+    dds_set_status_mask (rd[i], DDS_DATA_AVAILABLE_STATUS);
+  }
 
   SecurityCoreTests_Type1 sample = { 1, 1 };
   SecurityCoreTests_Type1 rd_sample;

From 32bba389c854754c4d69eaf813c3fe4763d5c9c0 Mon Sep 17 00:00:00 2001
From: Dennis Potman <dennis.potman@adlinktech.com>
Date: Wed, 13 May 2020 16:37:41 +0200
Subject: [PATCH 194/238] Add test descriptions as code comment in security
 core tests

Signed-off-by: Dennis Potman <dennis.potman@adlinktech.com>
---
 src/security/core/tests/access_control.c      | 34 ++++++++++++++++---
 src/security/core/tests/authentication.c      | 14 ++++++--
 src/security/core/tests/crypto.c              |  4 +++
 src/security/core/tests/handshake.c           |  5 +++
 .../core/tests/secure_communication.c         | 11 ++++++
 5 files changed, 61 insertions(+), 7 deletions(-)

diff --git a/src/security/core/tests/access_control.c b/src/security/core/tests/access_control.c
index c481c5b..ed91c66 100644
--- a/src/security/core/tests/access_control.c
+++ b/src/security/core/tests/access_control.c
@@ -153,6 +153,10 @@ CU_TheoryDataPoints(ddssec_access_control, config_parameters_file) = {
     CU_DataPoints(bool,         true,   true,     true,    true,     true,   true,   true,  true,   true,  true,   true,   false,  false, false),   // include empty config elements
     CU_DataPoints(bool,         false,  true,     true,    true,     true,   true,   true,  true,   false, true,   false,  true,   true,  true)     // expect failure
 };
+/* Testing configuration parameters for the access control security plugin,
+   using configuration from file. The test cases include using non-existing
+   files, empty configuration files, mixing configudation from file and inline
+   in the cyclone XML configuration. */
 CU_Theory((const char * test_descr, const char * gov, const char * perm, const char * ca, bool incl_empty_els, bool exp_fail),
     ddssec_access_control, config_parameters_file)
 {
@@ -198,6 +202,9 @@ CU_TheoryDataPoints(ddssec_access_control, permissions_expiry) = {
 #undef D
 #undef H
 #undef M
+/* Testing expiry of the (signed) permissions XML. Test cases include using
+   permissions config that is valid for 1 minute, was valid in the past minute,
+   expires before data is written, expires during writing data. */
 CU_Theory(
   (const char * test_descr,
     int32_t perm1_not_before, int32_t perm1_not_after, int32_t perm2_not_before, int32_t perm2_not_after,
@@ -254,6 +261,9 @@ CU_Theory(
 #define N_WR 3
 #define N_NODES (N_RD + N_WR)
 #define PERM_EXP_BASE 3
+/* Tests permissions configuration expiry using multiple writers, to validate
+   that a reader still received data from writers that still have valid
+   permissions config */
 CU_Test(ddssec_access_control, permissions_expiry_multiple, .timeout=20)
 {
   char topic_name[100];
@@ -419,7 +429,10 @@ CU_TheoryDataPoints(ddssec_access_control, hooks) = {
     CU_DataPoints(bool, na,    na,    na,    false, na,    true,  true,  true,  true,  false, false),  // exp_rd_wr_sync_fail
 };
 #undef na
-
+/* Test that the security implementation in DDSI is correctly handling denial of
+   creating enities, e.g. local participant not allowed, local writer not allowed,
+   remote topic not allowed, etc. This test is initializing the wrapper plugin in a
+   not-allowed mode to force denial of a specified entity. */
 CU_Theory(
   (const char * init_fn, bool exp_pp_fail, bool exp_local_topic_fail, bool exp_remote_topic_fail, bool exp_wr_fail, bool exp_rd_fail, bool exp_wr_rd_sync_fail, bool exp_rd_wr_sync_fail),
   ddssec_access_control, hooks, .timeout=60)
@@ -493,6 +506,8 @@ CU_TheoryDataPoints(ddssec_access_control, join_access_control) = {
     CU_DataPoints(bool, false, false, false, na,    na),   /* expect handshake failure */
 };
 #undef na
+/* Testing handshake result using join access control setting enabled/disabled and
+   valid/invalid permissions for 2 participants. */
 CU_Theory(
   (const char * test_descr, bool join_ac_pp1, bool join_ac_pp2, bool perm_inv_pp1, bool perm_inv_pp2, bool exp_pp1_fail, bool exp_pp2_fail, bool exp_hs_fail),
   ddssec_access_control, join_access_control, .timeout=30)
@@ -627,7 +642,9 @@ static void test_discovery_liveliness_protection(enum test_discovery_liveliness
 
   access_control_fini (2, (void * []) { gov_config1, gov_config2, gov_topic_rule1, gov_topic_rule2, grants[0], grants[1], perm_config, ca, id1_subj, id2_subj, id1, id2 }, 12);
 }
-
+/* Testing discovery and liveliness protection by checking that encode_datawriter_submessage
+   is called for SEDP_BUILTIN_PUBLICATIONS_SECURE_WRITER and/or P2P_BUILTIN_PARTICIPANT_MESSAGE_SECURE_WRITER
+   depending on the discovery and liveliness protection settings in security configuration. */
 CU_Theory(
   (const char * test_descr, bool enable_discovery_protection_pp1, bool enable_discovery_protection_pp2,
     DDS_Security_ProtectionKind discovery_protection_kind_pp1, DDS_Security_ProtectionKind discovery_protection_kind_pp2,
@@ -697,6 +714,9 @@ static void test_encoding_mismatch(
   access_control_fini (2, (void * []) { gov_config1, gov_config2, gov_topic_rule1, gov_topic_rule2, grants[0], grants[1], perm_config, ca, id1_subj, id2_subj, id1, id2 }, 12);
 }
 
+/* Testing handshake result for any combination of protection kind values for rtps, discovery,
+   liveliness, metadata (submsg) and payload encoding. In all cases where there is an encoding
+   mismatch, the security handshake is expect to fail */
 static DDS_Security_ProtectionKind pk[] = { PK_N, PK_S, PK_E, PK_SOA, PK_EOA };
 static DDS_Security_BasicProtectionKind bpk[] = { BPK_N, BPK_S, BPK_E };
 
@@ -787,7 +807,9 @@ static void test_readwrite_protection (
 
   access_control_fini (2, (void * []) { gov_config, gov_topic_rule, rules_xml, grants[0], grants[1], perm_config, ca, id1_subj, id2_subj, id1, id2 }, 11);
 }
-
+/* Test read/write access control by running test cases with different combinations
+   of allow and deny rules for publishing and subscribing on a topic, and check correct
+   working of the default policy. */
 CU_Test(ddssec_access_control, readwrite_protection, .timeout=60)
 {
   for (int allow_pub = 0; allow_pub <= 1; allow_pub++)
@@ -815,7 +837,8 @@ CU_Test(ddssec_access_control, readwrite_protection, .timeout=60)
               }
 }
 
-
+/* Test that all attributes and token retrieved from the access control plugin
+   are correctly returned. */
 CU_Test(ddssec_access_control, check_returns)
 {
   char topic_name[100];
@@ -858,7 +881,8 @@ CU_Test(ddssec_access_control, check_returns)
   access_control_fini (2, (void * []) { gov_config, gov_topic_rule, grants[0], grants[1], perm_config, ca, id1_subj, id2_subj, id1, id2 }, 10);
 }
 
-
+/* Check that communication for a topic that is allowed in the permissions config
+   keeps working in case the publisher also creates a writer for a non-allowed topic */
 CU_Test(ddssec_access_control, denied_topic)
 {
   char topic_name[100], denied_topic_name[100];
diff --git a/src/security/core/tests/authentication.c b/src/security/core/tests/authentication.c
index 79e9cb2..a09ad7d 100644
--- a/src/security/core/tests/authentication.c
+++ b/src/security/core/tests/authentication.c
@@ -183,7 +183,9 @@ CU_TheoryDataPoints(ddssec_authentication, id_ca_certs) = {
 };
 #undef FM_CA
 #undef FM_INVK
-
+/* Test the security handshake result in test-cases using identity CA's that match and do not
+   match (i.e. a different CA that was not used for creating the identity) the identities used
+   in the participants security configuration. */
 CU_Theory((const char * test_descr, const char * id2, const char *key2, const char *ca2,
     bool exp_fail_pp1, bool exp_fail_pp2,
     bool exp_fail_local, const char * fail_local_msg,
@@ -218,6 +220,8 @@ CU_TheoryDataPoints(ddssec_authentication, trusted_ca_dir) = {
     CU_DataPoints(const char *, "",    ".",   "/nonexisting", NULL),
     CU_DataPoints(bool,         false, false, true,           false)
 };
+/* Test correct and incorrect values for the trusted CA directory in the
+   authentication plugin configuration */
 CU_Theory((const char * ca_dir, bool exp_fail), ddssec_authentication, trusted_ca_dir)
 {
   print_test_msg ("Testing custom CA dir: %s\n", ca_dir);
@@ -259,6 +263,9 @@ CU_TheoryDataPoints(ddssec_authentication, expired_cert) = {
     CU_DataPoints(uint32_t,  1,     0,     0,     0,     1,     0,     1,     10000 ),  /* write/read data during x ms */
     CU_DataPoints(bool,      false, false, false, false, false, false, false, true  ),  /* expect read data failure */
 };
+/* Test the security handshake result and check communication for scenarios using
+   valid identities, identities that are expired and identities that are not yet valid.
+   A test case using an identity that expires during the test is also included. */
 CU_Theory(
   (const char * test_descr, int32_t ca_not_before, int32_t ca_not_after,
     int32_t id1_not_before, int32_t id1_not_after, bool id1_local_fail,
@@ -300,7 +307,10 @@ CU_Theory(
 #undef H
 #undef M
 
-
+/* Test communication for a non-secure participant with a secure participant that
+   allows unauthenticated nodes in its governance configuration. Samples for a secured
+   topic should not be received by a reader in the non-secure participant; samples for
+   a non-secure topic should. */
 CU_Test(ddssec_authentication, unauthenticated_pp)
 {
   char topic_name_secure[100];
diff --git a/src/security/core/tests/crypto.c b/src/security/core/tests/crypto.c
index ca41f2f..68ae5fd 100644
--- a/src/security/core/tests/crypto.c
+++ b/src/security/core/tests/crypto.c
@@ -125,6 +125,10 @@ CU_TheoryDataPoints(ddssec_crypto, inject_plain_data) = {
     CU_DataPoints(DDS_Security_ProtectionKind,      PK_N,  PK_N,  PK_E,  PK_S,  PK_N,  PK_N),   /* submessage protection */
     CU_DataPoints(DDS_Security_ProtectionKind,      PK_N,  PK_N,  PK_N,  PK_N,  PK_E,  PK_S),   /* rtps protection */
 };
+/* This test validates that non-encrypted data will not be received by a reader that has protection
+   enabled for rtps/submsg/payload. The test uses a crypto plugin wrapper mode that force the plugin
+   to write plain data in the encoded output buffer to DDSI, ignoring the security attributes for the
+   reader and writer. */
 CU_Theory((const char * test_descr, DDS_Security_BasicProtectionKind payload_pk, DDS_Security_ProtectionKind submsg_pk, DDS_Security_ProtectionKind rtps_pk),
   ddssec_crypto, inject_plain_data, .timeout=30)
 {
diff --git a/src/security/core/tests/handshake.c b/src/security/core/tests/handshake.c
index 0891d34..4988f69 100644
--- a/src/security/core/tests/handshake.c
+++ b/src/security/core/tests/handshake.c
@@ -105,6 +105,8 @@ static void handshake_fini(void)
   CU_ASSERT_EQUAL_FATAL (ret, DDS_RETCODE_OK);
 }
 
+/* Happy-day test for the security handshake, that tests succesfull handshake for
+   two participants using the same typical security settings. */
 CU_Test(ddssec_handshake, happy_day)
 {
   struct Handshake *hs_list;
@@ -129,6 +131,9 @@ CU_Test(ddssec_handshake, happy_day)
   handshake_fini ();
 }
 
+/* This test checks that all tokens that are sent to a remote participant are received
+   correctly by that participant and the token-data stored in the remote participant
+   is equal to the data in the token that was sent. */
 CU_Test(ddssec_handshake, check_tokens)
 {
   handshake_init (
diff --git a/src/security/core/tests/secure_communication.c b/src/security/core/tests/secure_communication.c
index 52dd62d..3a3a6ec 100644
--- a/src/security/core/tests/secure_communication.c
+++ b/src/security/core/tests/secure_communication.c
@@ -387,6 +387,8 @@ static void test_payload_secret(DDS_Security_ProtectionKind rtps_pk, DDS_Securit
   ddsrt_free (sample.text);
 }
 
+/* Test communication between 2 nodes for all combinations of RTPS, metadata (submsg)
+   and payload protection kinds using a single reader and writer */
 CU_Test(ddssec_secure_communication, protection_kinds, .timeout = 120)
 {
   DDS_Security_ProtectionKind rtps_pk[] = { PK_N, PK_S, PK_E };
@@ -404,6 +406,8 @@ CU_Test(ddssec_secure_communication, protection_kinds, .timeout = 120)
   }
 }
 
+/* Test communication between 2 nodes for all combinations of discovery and
+   liveliness protection kinds using a single reader and writer */
 CU_Test(ddssec_secure_communication, discovery_liveliness_protection, .timeout = 60)
 {
   DDS_Security_ProtectionKind discovery_pk[] = { PK_N, PK_S, PK_E };
@@ -417,6 +421,8 @@ CU_Test(ddssec_secure_communication, discovery_liveliness_protection, .timeout =
   }
 }
 
+/* Test that a specific character sequence from the plain data does not appear in
+   encrypted payload, submessage or rtps message when protection kind is ENCRYPT*/
 CU_Test(ddssec_secure_communication, check_encrypted_secret, .timeout = 60)
 {
   DDS_Security_ProtectionKind rtps_pk[] = { PK_N, PK_E, PK_EOA };
@@ -434,6 +440,8 @@ CU_Test(ddssec_secure_communication, check_encrypted_secret, .timeout = 60)
   }
 }
 
+/* Test communication with specific combinations payload and submsg protection
+   kinds for 1-3 domains, 1-3 participants per domain and 1-3 readers per participant */
 CU_TheoryDataPoints(ddssec_secure_communication, multiple_readers) = {
     CU_DataPoints(size_t, 1, 1, 1, 3), /* number of domains */
     CU_DataPoints(size_t, 1, 3, 1, 3), /* number of participants per domain */
@@ -452,6 +460,9 @@ CU_Theory((size_t n_dom, size_t n_pp, size_t n_rd), ddssec_secure_communication,
   }
 }
 
+/* Test communication with specific combinations payload and submsg protection
+   kinds for 1-2 domains, 1-3 participants per domain, 1-3 readers per participant
+   and 1-3 writers per participant */
 CU_TheoryDataPoints(ddssec_secure_communication, multiple_readers_writers) = {
     CU_DataPoints(size_t, 1, 1, 2), /* number of reader domains */
     CU_DataPoints(size_t, 1, 3, 3), /* number of readers per domain */

From a151c5f1845f2934f675ebc5a099557f381049a8 Mon Sep 17 00:00:00 2001
From: Dennis Potman <dennis.potman@adlinktech.com>
Date: Thu, 14 May 2020 21:27:29 +0200
Subject: [PATCH 195/238] Processed review comments: added missing return
 topic_sec_attr in function is_topic_discovery_protected, moved
 returns-logging in access plugin to wrapper mode and removed specific test
 for this (as it will be tested in other access control tests now). Some
 cleanup in circular list usage in crypto and access control plugins

Signed-off-by: Dennis Potman <dennis.potman@adlinktech.com>
---
 src/core/ddsi/src/ddsi_security_omg.c         |  10 +-
 src/security/core/tests/access_control.c      |  44 ------
 .../tests/common/access_control_wrapper.c     | 144 +++++++-----------
 .../tests/common/access_control_wrapper.h     |   7 -
 .../core/tests/common/cryptography_wrapper.c  |  26 ++--
 .../core/tests/common/cryptography_wrapper.h  |   6 +-
 6 files changed, 72 insertions(+), 165 deletions(-)

diff --git a/src/core/ddsi/src/ddsi_security_omg.c b/src/core/ddsi/src/ddsi_security_omg.c
index d064105..79052b2 100644
--- a/src/core/ddsi/src/ddsi_security_omg.c
+++ b/src/core/ddsi/src/ddsi_security_omg.c
@@ -1401,12 +1401,18 @@ static bool is_topic_discovery_protected(DDS_Security_PermissionsHandle permissi
 {
   DDS_Security_TopicSecurityAttributes attributes = {0,0,0,0};
   DDS_Security_SecurityException exception = DDS_SECURITY_EXCEPTION_INIT;
+  bool result = false;
 
   if (access_control->get_topic_sec_attributes(access_control, permission_handle, topic_name, &attributes, &exception))
-    return attributes.is_discovery_protected;
+  {
+    result = attributes.is_discovery_protected;
+    access_control->return_topic_sec_attributes(access_control, &attributes, &exception);
+  }
   else
+  {
     DDS_Security_Exception_reset(&exception);
-  return false;
+  }
+  return result;
 }
 
 static void handle_not_allowed(
diff --git a/src/security/core/tests/access_control.c b/src/security/core/tests/access_control.c
index ed91c66..261fbdf 100644
--- a/src/security/core/tests/access_control.c
+++ b/src/security/core/tests/access_control.c
@@ -837,50 +837,6 @@ CU_Test(ddssec_access_control, readwrite_protection, .timeout=60)
               }
 }
 
-/* Test that all attributes and token retrieved from the access control plugin
-   are correctly returned. */
-CU_Test(ddssec_access_control, check_returns)
-{
-  char topic_name[100];
-  create_topic_name ("ddssec_access_control_", g_topic_nr++, topic_name, sizeof (topic_name));
-
-  char *ca, *id1, *id2, *id1_subj, *id2_subj;
-  ca = generate_ca ("ca1", TEST_IDENTITY_CA1_PRIVATE_KEY, 0, 3600);
-  id1 = generate_identity (ca, TEST_IDENTITY_CA1_PRIVATE_KEY, "id1", TEST_IDENTITY1_PRIVATE_KEY, 0, 3600, &id1_subj);
-  id2 = generate_identity (ca, TEST_IDENTITY_CA1_PRIVATE_KEY, "id2", TEST_IDENTITY1_PRIVATE_KEY, 0, 3600, &id2_subj);
-
-  char * grants[] = {
-    get_permissions_default_grant ("id1", id1_subj, topic_name),
-    get_permissions_default_grant ("id2", id2_subj, topic_name) };
-  char * perm_config = get_permissions_config (grants, 2, true);
-
-  char * gov_topic_rule = get_governance_topic_rule (NULL, true, true, true, true, PK_E, BPK_E);
-  char * gov_config = get_governance_config (false, true, PK_E, PK_E, PK_E, gov_topic_rule, true);
-  const char * def_perm_ca = PF_F COMMON_ETC_PATH("default_permissions_ca.pem");
-
-  access_control_init (
-      2,
-      (const char *[]) { id1, id2 },
-      (const char *[]) { TEST_IDENTITY1_PRIVATE_KEY, TEST_IDENTITY1_PRIVATE_KEY },
-      (const char *[]) { ca, ca },
-      (bool []) { false, false },
-      (const char *[]) { "init_test_access_control_check_returns", "init_test_access_control_wrapped" },
-      (const char *[]) { "finalize_test_access_control_check_returns", "finalize_test_access_control_wrapped" },
-      (bool []) { true, true }, (const char *[]) { gov_config, gov_config },
-      (bool []) { true, true }, (const char *[]) { perm_config, perm_config },
-      (bool []) { true, true }, (const char *[]) { def_perm_ca, def_perm_ca });
-
-  dds_entity_t pub, sub, pub_tp, sub_tp, wr, rd;
-  rd_wr_init (g_participant[0], &pub, &pub_tp, &wr, g_participant[1], &sub, &sub_tp, &rd, topic_name);
-  sync_writer_to_readers (g_participant[0], wr, 1, DDS_SECS (1));
-  sync_reader_to_writers (g_participant[1], rd, 1, DDS_SECS (1));
-
-  struct dds_security_access_control_impl * ac_context = get_access_control_context (g_participant[0]);
-  CU_ASSERT_FATAL (check_returns (ac_context));
-
-  access_control_fini (2, (void * []) { gov_config, gov_topic_rule, grants[0], grants[1], perm_config, ca, id1_subj, id2_subj, id1, id2 }, 10);
-}
-
 /* Check that communication for a topic that is allowed in the permissions config
    keeps working in case the publisher also creates a writer for a non-allowed topic */
 CU_Test(ddssec_access_control, denied_topic)
diff --git a/src/security/core/tests/common/access_control_wrapper.c b/src/security/core/tests/common/access_control_wrapper.c
index 7a80087..ac9cbd9 100644
--- a/src/security/core/tests/common/access_control_wrapper.c
+++ b/src/security/core/tests/common/access_control_wrapper.c
@@ -11,6 +11,7 @@
  */
 #include <string.h>
 #include <stdio.h>
+#include "CUnit/Test.h"
 #include "dds/dds.h"
 #include "dds/ddsrt/circlist.h"
 #include "dds/ddsrt/heap.h"
@@ -29,7 +30,6 @@ enum ac_plugin_mode {
   PLUGIN_MODE_WRAPPED,
   PLUGIN_MODE_NOT_ALLOWED,
   PLUGIN_MODE_MISSING_FUNC,
-  PLUGIN_MODE_CHECK_RETURNS,
 };
 
 enum ac_plugin_not_allowed {
@@ -83,6 +83,7 @@ static void init_returns_log(struct dds_security_access_control_impl *impl)
 {
   ddsrt_mutex_init (&impl->returns_log_lock);
   ddsrt_circlist_init (&impl->returns_log);
+  impl->invalid_return = false;
 }
 
 static void fini_returns_log(struct dds_security_access_control_impl *impl)
@@ -100,46 +101,55 @@ static void fini_returns_log(struct dds_security_access_control_impl *impl)
 
 static void register_return_obj (struct dds_security_access_control_impl * impl, void * obj)
 {
-  assert(impl->mode == PLUGIN_MODE_CHECK_RETURNS);
+  assert(impl->mode == PLUGIN_MODE_WRAPPED);
   ddsrt_mutex_lock (&impl->returns_log_lock);
   struct returns_log_data * attr_data = ddsrt_malloc (sizeof (*attr_data));
   attr_data->obj = obj;
   ddsrt_circlist_append(&impl->returns_log, &attr_data->e);
-  printf("log obj %p\n", obj);
   ddsrt_mutex_unlock (&impl->returns_log_lock);
 }
 
+static struct ddsrt_circlist_elem *find_return_obj_data (struct dds_security_access_control_impl * impl, void * obj)
+{
+  struct ddsrt_circlist_elem *elem0 = ddsrt_circlist_oldest (&impl->returns_log), *elem = elem0;
+  if (elem != NULL)
+  {
+    do
+    {
+      struct returns_log_data *data = DDSRT_FROM_CIRCLIST (struct returns_log_data, e, elem);
+      if (data->obj == obj)
+        return elem;
+      elem = elem->next;
+    } while (elem != elem0);
+  }
+  return NULL;
+}
+
 static void unregister_return_obj (struct dds_security_access_control_impl * impl, void * obj)
 {
-  assert(impl->mode == PLUGIN_MODE_CHECK_RETURNS);
+  struct ddsrt_circlist_elem *elem;
+  assert(impl->mode == PLUGIN_MODE_WRAPPED);
   ddsrt_mutex_lock (&impl->returns_log_lock);
-  struct ddsrt_circlist_elem *elem0 = ddsrt_circlist_oldest (&impl->returns_log), *elem = elem0;
-  while (elem != NULL)
+  if ((elem = find_return_obj_data (impl, obj)) != NULL)
   {
-    struct returns_log_data *data = DDSRT_FROM_CIRCLIST (struct returns_log_data, e, elem);
-    if (data->obj == obj)
-    {
-      ddsrt_circlist_remove (&impl->returns_log, elem);
-      ddsrt_mutex_unlock (&impl->returns_log_lock);
-      ddsrt_free (elem);
-      printf("return obj %p\n", obj);
-      return;
-    }
-    elem = elem->next;
-    if (elem == elem0)
-      break;
+    ddsrt_circlist_remove (&impl->returns_log, elem);
+    ddsrt_free (elem);
+  }
+  else
+  {
+    impl->invalid_return = true;
+    printf ("invalid return %p\n", obj);
   }
-  impl->invalid_return = true;
   ddsrt_mutex_unlock (&impl->returns_log_lock);
 }
 
-bool check_returns (struct dds_security_access_control_impl * impl)
+static bool all_returns_valid (struct dds_security_access_control_impl * impl)
 {
-  assert(impl->mode == PLUGIN_MODE_CHECK_RETURNS);
+  assert(impl->mode == PLUGIN_MODE_WRAPPED);
   ddsrt_mutex_lock (&impl->returns_log_lock);
-  bool result = impl->invalid_return || !ddsrt_circlist_isempty (&impl->returns_log);
+  bool valid = !impl->invalid_return && ddsrt_circlist_isempty (&impl->returns_log);
   ddsrt_mutex_unlock (&impl->returns_log_lock);
-  return result;
+  return valid;
 }
 
 static DDS_Security_PermissionsHandle validate_local_permissions(
@@ -162,11 +172,8 @@ static DDS_Security_PermissionsHandle validate_local_permissions(
       }
       /* fall through */
     case PLUGIN_MODE_WRAPPED:
-    case PLUGIN_MODE_CHECK_RETURNS:
     {
       DDS_Security_PermissionsHandle handle = impl->instance->validate_local_permissions(impl->instance, auth_plugin, identity, domain_id, participant_qos, ex);
-      if (impl->mode == PLUGIN_MODE_CHECK_RETURNS)
-          register_return_obj (impl, (void *) handle);
       return handle;
     }
 
@@ -196,12 +203,9 @@ static DDS_Security_PermissionsHandle validate_remote_permissions(
       }
       /* fall through */
     case PLUGIN_MODE_WRAPPED:
-    case PLUGIN_MODE_CHECK_RETURNS:
     {
       DDS_Security_PermissionsHandle handle = impl->instance->validate_remote_permissions(impl->instance, auth_plugin, local_identity_handle, remote_identity_handle,
         remote_permissions_token, remote_credential_token, ex);
-      if (impl->mode == PLUGIN_MODE_CHECK_RETURNS)
-          register_return_obj (impl, (void *) handle);
       return handle;
     }
 
@@ -229,7 +233,6 @@ static DDS_Security_boolean check_create_participant(
       }
       /* fall through */
     case PLUGIN_MODE_WRAPPED:
-    case PLUGIN_MODE_CHECK_RETURNS:
       return impl->instance->check_create_participant(impl->instance, permissions_handle, domain_id, participant_qos, ex);
 
     default:
@@ -262,7 +265,6 @@ static DDS_Security_boolean check_create_datawriter(
       }
       /* fall through */
     case PLUGIN_MODE_WRAPPED:
-    case PLUGIN_MODE_CHECK_RETURNS:
       return impl->instance->check_create_datawriter(impl->instance, permissions_handle, domain_id, topic_name, writer_qos, partition, data_tag, ex);
 
     default:
@@ -292,7 +294,6 @@ static DDS_Security_boolean check_create_datareader(
       }
       /* fall through */
     case PLUGIN_MODE_WRAPPED:
-    case PLUGIN_MODE_CHECK_RETURNS:
       return impl->instance->check_create_datareader(impl->instance, permissions_handle, domain_id, topic_name, reader_qos, partition, data_tag, ex);
 
     default:
@@ -320,7 +321,6 @@ static DDS_Security_boolean check_create_topic(
       }
       /* fall through */
     case PLUGIN_MODE_WRAPPED:
-    case PLUGIN_MODE_CHECK_RETURNS:
       return impl->instance->check_create_topic(impl->instance, permissions_handle, domain_id, topic_name, qos, ex);
 
     default:
@@ -340,7 +340,6 @@ static DDS_Security_boolean check_local_datawriter_register_instance(
   {
     case PLUGIN_MODE_WRAPPED:
     case PLUGIN_MODE_NOT_ALLOWED:
-    case PLUGIN_MODE_CHECK_RETURNS:
       return impl->instance->check_local_datawriter_register_instance(impl->instance, permissions_handle, writer, key, ex);
 
     default:
@@ -360,7 +359,6 @@ static DDS_Security_boolean check_local_datawriter_dispose_instance(
   {
     case PLUGIN_MODE_WRAPPED:
     case PLUGIN_MODE_NOT_ALLOWED:
-    case PLUGIN_MODE_CHECK_RETURNS:
       return impl->instance->check_local_datawriter_dispose_instance(impl->instance, permissions_handle, writer, key, ex);
 
     default:
@@ -387,7 +385,6 @@ static DDS_Security_boolean check_remote_participant(
       }
       /* fall through */
     case PLUGIN_MODE_WRAPPED:
-    case PLUGIN_MODE_CHECK_RETURNS:
       return impl->instance->check_remote_participant(impl->instance, permissions_handle, domain_id, participant_data, ex);
 
     default:
@@ -414,7 +411,6 @@ static DDS_Security_boolean check_remote_datawriter(
       }
       /* fall through */
     case PLUGIN_MODE_WRAPPED:
-    case PLUGIN_MODE_CHECK_RETURNS:
       return impl->instance->check_remote_datawriter(impl->instance, permissions_handle, domain_id, publication_data, ex);
 
     default:
@@ -445,7 +441,6 @@ static DDS_Security_boolean check_remote_datareader(
       }
       /* fall through */
     case PLUGIN_MODE_WRAPPED:
-    case PLUGIN_MODE_CHECK_RETURNS:
     {
       bool ret;
       if ((ret = impl->instance->check_remote_datareader(impl->instance, permissions_handle, domain_id, subscription_data, relay_only, ex)))
@@ -485,7 +480,6 @@ static DDS_Security_boolean check_remote_topic(
       }
       /* fall through */
     case PLUGIN_MODE_WRAPPED:
-    case PLUGIN_MODE_CHECK_RETURNS:
       return impl->instance->check_remote_topic(impl->instance, permissions_handle, domain_id, topic_data, ex);
 
     default:
@@ -506,7 +500,6 @@ static DDS_Security_boolean check_local_datawriter_match(
   {
     case PLUGIN_MODE_WRAPPED:
     case PLUGIN_MODE_NOT_ALLOWED:
-    case PLUGIN_MODE_CHECK_RETURNS:
       return impl->instance->check_local_datawriter_match(impl->instance, writer_permissions_handle, reader_permissions_handle, publication_data, subscription_data, ex);
 
     default:
@@ -527,7 +520,6 @@ static DDS_Security_boolean check_local_datareader_match(
   {
     case PLUGIN_MODE_WRAPPED:
     case PLUGIN_MODE_NOT_ALLOWED:
-    case PLUGIN_MODE_CHECK_RETURNS:
       return impl->instance->check_local_datareader_match(impl->instance, reader_permissions_handle, writer_permissions_handle, subscription_data, publication_data, ex);
 
     default:
@@ -549,7 +541,6 @@ static DDS_Security_boolean check_remote_datawriter_register_instance(
   {
     case PLUGIN_MODE_WRAPPED:
     case PLUGIN_MODE_NOT_ALLOWED:
-    case PLUGIN_MODE_CHECK_RETURNS:
       return impl->instance->check_remote_datawriter_register_instance(impl->instance, permissions_handle, reader, publication_handle, key, instance_handle, ex);
 
     default:
@@ -570,7 +561,6 @@ static DDS_Security_boolean check_remote_datawriter_dispose_instance(
   {
     case PLUGIN_MODE_WRAPPED:
     case PLUGIN_MODE_NOT_ALLOWED:
-    case PLUGIN_MODE_CHECK_RETURNS:
       return impl->instance->check_remote_datawriter_dispose_instance(impl->instance, permissions_handle, reader, publication_handle, key, ex);
 
     default:
@@ -587,10 +577,9 @@ static DDS_Security_boolean get_permissions_token(
   struct dds_security_access_control_impl *impl = (struct dds_security_access_control_impl *)instance;
   switch (impl->mode)
   {
-    case PLUGIN_MODE_CHECK_RETURNS:
+    case PLUGIN_MODE_WRAPPED:
       register_return_obj (impl, (void*) permissions_token);
       /* fall through */
-    case PLUGIN_MODE_WRAPPED:
     case PLUGIN_MODE_NOT_ALLOWED:
       return impl->instance->get_permissions_token(impl->instance, permissions_token, handle, ex);
 
@@ -610,10 +599,9 @@ static DDS_Security_boolean get_permissions_credential_token(
   struct dds_security_access_control_impl *impl = (struct dds_security_access_control_impl *)instance;
   switch (impl->mode)
   {
-    case PLUGIN_MODE_CHECK_RETURNS:
+    case PLUGIN_MODE_WRAPPED:
       register_return_obj (impl, (void*) permissions_credential_token);
       /* fall through */
-    case PLUGIN_MODE_WRAPPED:
     case PLUGIN_MODE_NOT_ALLOWED:
       return impl->instance->get_permissions_credential_token(impl->instance, permissions_credential_token, handle, ex);
 
@@ -632,7 +620,6 @@ static DDS_Security_boolean set_listener(
   {
     case PLUGIN_MODE_WRAPPED:
     case PLUGIN_MODE_NOT_ALLOWED:
-    case PLUGIN_MODE_CHECK_RETURNS:
       return impl->instance->set_listener (impl->instance, listener, ex);
 
     default:
@@ -648,10 +635,9 @@ static DDS_Security_boolean return_permissions_token(
   struct dds_security_access_control_impl *impl = (struct dds_security_access_control_impl *)instance;
   switch (impl->mode)
   {
-    case PLUGIN_MODE_CHECK_RETURNS:
+    case PLUGIN_MODE_WRAPPED:
       unregister_return_obj (impl, (void*) token);
       /* fall through */
-    case PLUGIN_MODE_WRAPPED:
     case PLUGIN_MODE_NOT_ALLOWED:
       return impl->instance->return_permissions_token (impl->instance, token, ex);
 
@@ -669,10 +655,9 @@ static DDS_Security_boolean return_permissions_credential_token(
   struct dds_security_access_control_impl *impl = (struct dds_security_access_control_impl *)instance;
   switch (impl->mode)
   {
-    case PLUGIN_MODE_CHECK_RETURNS:
+    case PLUGIN_MODE_WRAPPED:
       unregister_return_obj (impl, (void*) permissions_credential_token);
       /* fall through */
-    case PLUGIN_MODE_WRAPPED:
     case PLUGIN_MODE_NOT_ALLOWED:
       return impl->instance->return_permissions_credential_token(impl->instance, permissions_credential_token, ex);
 
@@ -690,10 +675,9 @@ static DDS_Security_boolean get_participant_sec_attributes(
   struct dds_security_access_control_impl *impl = (struct dds_security_access_control_impl *)instance;
   switch (impl->mode)
   {
-    case PLUGIN_MODE_CHECK_RETURNS:
+    case PLUGIN_MODE_WRAPPED:
       register_return_obj (impl, (void*) attributes);
       /* fall through */
-    case PLUGIN_MODE_WRAPPED:
     case PLUGIN_MODE_NOT_ALLOWED:
       return impl->instance->get_participant_sec_attributes(impl->instance, permissions_handle, attributes, ex);
 
@@ -712,10 +696,9 @@ static DDS_Security_boolean get_topic_sec_attributes(
   struct dds_security_access_control_impl *impl = (struct dds_security_access_control_impl *)instance;
   switch (impl->mode)
   {
-    case PLUGIN_MODE_CHECK_RETURNS:
+    case PLUGIN_MODE_WRAPPED:
       register_return_obj (impl, (void*) attributes);
       /* fall through */
-    case PLUGIN_MODE_WRAPPED:
     case PLUGIN_MODE_NOT_ALLOWED:
       return impl->instance->get_topic_sec_attributes(impl->instance, permissions_handle, topic_name, attributes, ex);
 
@@ -736,10 +719,9 @@ static DDS_Security_boolean get_datawriter_sec_attributes(
   struct dds_security_access_control_impl *impl = (struct dds_security_access_control_impl *)instance;
   switch (impl->mode)
   {
-    case PLUGIN_MODE_CHECK_RETURNS:
+    case PLUGIN_MODE_WRAPPED:
       register_return_obj (impl, (void*) attributes);
       /* fall through */
-    case PLUGIN_MODE_WRAPPED:
     case PLUGIN_MODE_NOT_ALLOWED:
       return impl->instance->get_datawriter_sec_attributes(impl->instance, permissions_handle, topic_name, partition, data_tag, attributes, ex);
 
@@ -760,10 +742,9 @@ static DDS_Security_boolean get_datareader_sec_attributes(
   struct dds_security_access_control_impl *impl = (struct dds_security_access_control_impl *)instance;
   switch (impl->mode)
   {
-    case PLUGIN_MODE_CHECK_RETURNS:
+    case PLUGIN_MODE_WRAPPED:
       register_return_obj (impl, (void*) attributes);
       /* fall through */
-    case PLUGIN_MODE_WRAPPED:
     case PLUGIN_MODE_NOT_ALLOWED:
       return impl->instance->get_datareader_sec_attributes(impl->instance, permissions_handle, topic_name, partition, data_tag, attributes, ex);
 
@@ -780,10 +761,9 @@ static DDS_Security_boolean return_participant_sec_attributes(
   struct dds_security_access_control_impl *impl = (struct dds_security_access_control_impl *)instance;
   switch (impl->mode)
   {
-    case PLUGIN_MODE_CHECK_RETURNS:
+    case PLUGIN_MODE_WRAPPED:
       unregister_return_obj (impl, (void*) attributes);
       /* fall through */
-    case PLUGIN_MODE_WRAPPED:
     case PLUGIN_MODE_NOT_ALLOWED:
       return impl->instance->return_participant_sec_attributes(impl->instance, attributes, ex);
 
@@ -800,10 +780,9 @@ static DDS_Security_boolean return_topic_sec_attributes(
   struct dds_security_access_control_impl *impl = (struct dds_security_access_control_impl *)instance;
   switch (impl->mode)
   {
-    case PLUGIN_MODE_CHECK_RETURNS:
+    case PLUGIN_MODE_WRAPPED:
       unregister_return_obj (impl, (void*) attributes);
       /* fall through */
-    case PLUGIN_MODE_WRAPPED:
     case PLUGIN_MODE_NOT_ALLOWED:
       return impl->instance->return_topic_sec_attributes(impl->instance, attributes, ex);
 
@@ -820,10 +799,9 @@ static DDS_Security_boolean return_datawriter_sec_attributes(
   struct dds_security_access_control_impl *impl = (struct dds_security_access_control_impl *)instance;
   switch (impl->mode)
   {
-    case PLUGIN_MODE_CHECK_RETURNS:
+    case PLUGIN_MODE_WRAPPED:
       unregister_return_obj (impl, (void*) attributes);
       /* fall through */
-    case PLUGIN_MODE_WRAPPED:
     case PLUGIN_MODE_NOT_ALLOWED:
       return impl->instance->return_datawriter_sec_attributes(impl->instance, attributes, ex);
 
@@ -840,10 +818,9 @@ static DDS_Security_boolean return_datareader_sec_attributes(
   struct dds_security_access_control_impl *impl = (struct dds_security_access_control_impl *)instance;
   switch (impl->mode)
   {
-    case PLUGIN_MODE_CHECK_RETURNS:
+    case PLUGIN_MODE_WRAPPED:
       unregister_return_obj (impl, (void*) attributes);
       /* fall through */
-    case PLUGIN_MODE_WRAPPED:
     case PLUGIN_MODE_NOT_ALLOWED:
       return impl->instance->return_datareader_sec_attributes(impl->instance, attributes, ex);
 
@@ -860,9 +837,6 @@ static DDS_Security_boolean return_permissions_handle(
   struct dds_security_access_control_impl *impl = (struct dds_security_access_control_impl *)instance;
   switch (impl->mode)
   {
-    case PLUGIN_MODE_CHECK_RETURNS:
-      unregister_return_obj (impl, (void*) permissions_handle);
-      /* fall through */
     case PLUGIN_MODE_WRAPPED:
     case PLUGIN_MODE_NOT_ALLOWED:
       return impl->instance->return_permissions_handle(impl->instance, permissions_handle, ex);
@@ -947,6 +921,7 @@ int init_test_access_control_wrapped(const char *argument, void **context, struc
   if (!impl)
     return DDS_SECURITY_FAILED;
   impl->mode = PLUGIN_MODE_WRAPPED;
+  init_returns_log (impl);
   *context = impl;
   return DDS_SECURITY_SUCCESS;
 }
@@ -954,8 +929,12 @@ int init_test_access_control_wrapped(const char *argument, void **context, struc
 int finalize_test_access_control_wrapped(void *context)
 {
   struct dds_security_access_control_impl* impl = (struct dds_security_access_control_impl*) context;
-  assert(impl->mode == PLUGIN_MODE_WRAPPED);
-  return finalize_test_access_control_common(impl, true);
+  assert (impl->mode == PLUGIN_MODE_WRAPPED);
+  bool returns_valid = all_returns_valid (impl);
+  fini_returns_log (impl);
+  printf("returns result (impl %p): %s\n", impl, returns_valid ? "all valid" : "invalid");
+  CU_ASSERT_FATAL (returns_valid);
+  return finalize_test_access_control_common (impl, true);
 }
 
 int init_test_access_control_missing_func(const char *argument, void **context, struct ddsi_domaingv *gv)
@@ -1004,22 +983,3 @@ int finalize_test_access_control_not_allowed(void *context)
   assert(impl->mode == PLUGIN_MODE_NOT_ALLOWED);
   return finalize_test_access_control_common(impl, true);
 }
-
-int init_test_access_control_check_returns(const char *argument, void **context, struct ddsi_domaingv *gv)
-{
-  struct dds_security_access_control_impl *impl = init_test_access_control_common(argument, true, gv);
-  if (!impl)
-    return DDS_SECURITY_FAILED;
-  impl->mode = PLUGIN_MODE_CHECK_RETURNS;
-  init_returns_log (impl);
-  *context = impl;
-  return DDS_SECURITY_SUCCESS;
-}
-
-int finalize_test_access_control_check_returns(void *context)
-{
-  struct dds_security_access_control_impl* impl = (struct dds_security_access_control_impl*) context;
-  assert(impl->mode == PLUGIN_MODE_CHECK_RETURNS);
-  fini_returns_log (impl);
-  return finalize_test_access_control_common(impl, true);
-}
diff --git a/src/security/core/tests/common/access_control_wrapper.h b/src/security/core/tests/common/access_control_wrapper.h
index 8dc0ecd..a876311 100644
--- a/src/security/core/tests/common/access_control_wrapper.h
+++ b/src/security/core/tests/common/access_control_wrapper.h
@@ -22,8 +22,6 @@
 
 struct dds_security_access_control_impl;
 
-SECURITY_EXPORT bool check_returns (struct dds_security_access_control_impl * impl);
-
 /* Init in all-ok mode: all functions return success without calling the actual plugin */
 SECURITY_EXPORT int init_test_access_control_all_ok(const char *argument, void **context, struct ddsi_domaingv *gv);
 SECURITY_EXPORT int finalize_test_access_control_all_ok(void *context);
@@ -53,9 +51,4 @@ INIT_NOT_ALLOWED_DECL(remote_permissions_not_allowed)
 
 SECURITY_EXPORT int finalize_test_access_control_not_allowed(void *context);
 
-/* Init in attribute get and return logging mode */
-SECURITY_EXPORT int init_test_access_control_check_returns(const char *argument, void **context, struct ddsi_domaingv *gv);
-SECURITY_EXPORT int finalize_test_access_control_check_returns(void *context);
-
-
 #endif /* SECURITY_CORE_TEST_ACCESS_CONTROL_WRAPPER_H_ */
diff --git a/src/security/core/tests/common/cryptography_wrapper.c b/src/security/core/tests/common/cryptography_wrapper.c
index ada7591..47d06c7 100644
--- a/src/security/core/tests/common/cryptography_wrapper.c
+++ b/src/security/core/tests/common/cryptography_wrapper.c
@@ -195,7 +195,7 @@ static void add_tokens (struct ddsrt_circlist *list, enum crypto_tokens_type typ
   token_data->local_handle = lch;
   token_data->remote_handle = rch;
   token_data->n_tokens = tokens->_length;
-  assert (tokens->_length <= CRYPTO_TOKEN_MAXLEN);
+  assert (tokens->_length <= CRYPTO_TOKEN_MAXCOUNT);
   for (uint32_t i = 0; i < tokens->_length; i++)
   {
     size_t len = tokens->_buffer[i].binary_properties._buffer[0].value._length;
@@ -235,16 +235,14 @@ struct ddsrt_circlist * get_crypto_tokens (struct dds_security_cryptography_impl
   }
 
   struct ddsrt_circlist_elem *elem0 = ddsrt_circlist_oldest (&impl->token_data_list), *elem = elem0;
-  while (elem != NULL)
+  do
   {
     struct crypto_token_data *elem_data = DDSRT_FROM_CIRCLIST (struct crypto_token_data, e, elem);
     struct crypto_token_data *token_data = ddsrt_malloc (sizeof (*token_data));
     memcpy (token_data, elem_data, sizeof (*token_data));
     ddsrt_circlist_append (tokens, &token_data->e);
     elem = elem->next;
-    if (elem == elem0)
-      break;
-  }
+  } while (elem != elem0);
   ddsrt_mutex_unlock (&impl->token_data_lock);
 
   return tokens;
@@ -260,7 +258,7 @@ struct crypto_token_data * find_crypto_token (struct dds_security_cryptography_i
     return NULL;
   }
   struct ddsrt_circlist_elem *elem0 = ddsrt_circlist_oldest (&impl->token_data_list), *elem = elem0;
-  while (elem != NULL)
+  do
   {
     struct crypto_token_data *elem_data = DDSRT_FROM_CIRCLIST (struct crypto_token_data, e, elem);
     if (elem_data->type == type)
@@ -277,9 +275,7 @@ struct crypto_token_data * find_crypto_token (struct dds_security_cryptography_i
       }
     }
     elem = elem->next;
-    if (elem == elem0)
-      break;
-  }
+  } while (elem != elem0);
   ddsrt_mutex_unlock (&impl->token_data_lock);
   return NULL;
 }
@@ -290,7 +286,7 @@ static void log_encode_decode (struct dds_security_cryptography_impl * impl, enu
   if (!ddsrt_circlist_isempty (&impl->encode_decode_log))
   {
     struct ddsrt_circlist_elem *elem0 = ddsrt_circlist_oldest (&impl->encode_decode_log), *elem = elem0;
-    while (elem != NULL)
+    do
     {
       struct crypto_encode_decode_data *data = DDSRT_FROM_CIRCLIST (struct crypto_encode_decode_data, e, elem);
       if (data->function == function && data->handle == handle)
@@ -300,9 +296,7 @@ static void log_encode_decode (struct dds_security_cryptography_impl * impl, enu
         return;
       }
       elem = elem->next;
-      if (elem == elem0)
-        break;
-    }
+    } while (elem != elem0);
   }
   /* add new entry */
   struct crypto_encode_decode_data *new_data = ddsrt_malloc (sizeof (*new_data));
@@ -319,7 +313,7 @@ struct crypto_encode_decode_data * get_encode_decode_log (struct dds_security_cr
   if (!ddsrt_circlist_isempty (&impl->encode_decode_log))
   {
     struct ddsrt_circlist_elem *elem0 = ddsrt_circlist_oldest (&impl->encode_decode_log), *elem = elem0;
-    while (elem != NULL)
+    do
     {
       struct crypto_encode_decode_data *data = DDSRT_FROM_CIRCLIST (struct crypto_encode_decode_data, e, elem);
       if (data->function == function && data->handle == handle)
@@ -330,9 +324,7 @@ struct crypto_encode_decode_data * get_encode_decode_log (struct dds_security_cr
         return result;
       }
       elem = elem->next;
-      if (elem == elem0)
-        break;
-    }
+    } while (elem != elem0);
   }
   ddsrt_mutex_unlock (&impl->encode_decode_log_lock);
   return NULL;
diff --git a/src/security/core/tests/common/cryptography_wrapper.h b/src/security/core/tests/common/cryptography_wrapper.h
index 98a6658..f466c55 100644
--- a/src/security/core/tests/common/cryptography_wrapper.h
+++ b/src/security/core/tests/common/cryptography_wrapper.h
@@ -18,7 +18,7 @@
 #include "dds/security/dds_security_api_defs.h"
 #include "dds/security/cryptography_wrapper_export.h"
 
-#define CRYPTO_TOKEN_MAXLEN 10
+#define CRYPTO_TOKEN_MAXCOUNT 10
 #define CRYPTO_TOKEN_SIZE 256
 
 struct dds_security_cryptography_impl;
@@ -39,8 +39,8 @@ struct crypto_token_data {
   DDS_Security_ParticipantCryptoHandle local_handle;
   DDS_Security_ParticipantCryptoHandle remote_handle;
   uint32_t n_tokens;
-  unsigned char data[CRYPTO_TOKEN_MAXLEN][CRYPTO_TOKEN_SIZE];
-  size_t data_len[CRYPTO_TOKEN_MAXLEN];
+  unsigned char data[CRYPTO_TOKEN_MAXCOUNT][CRYPTO_TOKEN_SIZE];
+  size_t data_len[CRYPTO_TOKEN_MAXCOUNT];
 };
 
 enum crypto_encode_decode_fn {

From 2e6ea36fda40e62e02444c8dc53d5e222b49e66e Mon Sep 17 00:00:00 2001
From: Dennis Potman <dennis.potman@adlinktech.com>
Date: Fri, 15 May 2020 14:10:11 +0200
Subject: [PATCH 196/238] Fix a race condition in delete_participant, that
 could occur on security permissions or identity expiry, which triggers a
 delete of the local participant

Signed-off-by: Dennis Potman <dennis.potman@adlinktech.com>
---
 src/core/ddsi/src/ddsi_security_omg.c | 2 +-
 src/core/ddsi/src/q_entity.c          | 5 +++++
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/src/core/ddsi/src/ddsi_security_omg.c b/src/core/ddsi/src/ddsi_security_omg.c
index 79052b2..9ef815a 100644
--- a/src/core/ddsi/src/ddsi_security_omg.c
+++ b/src/core/ddsi/src/ddsi_security_omg.c
@@ -842,7 +842,7 @@ static bool delete_pp_by_handle (DDS_Security_Handle handle, expired_pp_check_fn
   {
     if (q_omg_participant_is_secure (pp) && expired_pp_check_fn (pp, handle))
     {
-      delete_participant (gv, &pp->e.guid);
+      (void) delete_participant (gv, &pp->e.guid);
       result = true;
     }
   }
diff --git a/src/core/ddsi/src/q_entity.c b/src/core/ddsi/src/q_entity.c
index b8858ca..4fb30cd 100644
--- a/src/core/ddsi/src/q_entity.c
+++ b/src/core/ddsi/src/q_entity.c
@@ -1308,14 +1308,19 @@ dds_return_t delete_participant (struct ddsi_domaingv *gv, const struct ddsi_gui
 {
   struct participant *pp;
   GVLOGDISC ("delete_participant("PGUIDFMT")\n", PGUID (*ppguid));
+  ddsrt_mutex_lock (&gv->lock);
   if ((pp = entidx_lookup_participant_guid (gv->entity_index, ppguid)) == NULL)
+  {
+    ddsrt_mutex_unlock (&gv->lock);
     return DDS_RETCODE_BAD_PARAMETER;
+  }
   builtintopic_write (gv->builtin_topic_interface, &pp->e, ddsrt_time_wallclock(), false);
   remember_deleted_participant_guid (gv->deleted_participants, &pp->e.guid);
 #ifdef DDSI_INCLUDE_SECURITY
   disconnect_participant_secure (pp);
 #endif
   entidx_remove_participant_guid (gv->entity_index, pp);
+  ddsrt_mutex_unlock (&gv->lock);
   gcreq_participant (pp);
   return 0;
 }

From 5f829684effc2e68c13a46fb1789cbc6397f8ce7 Mon Sep 17 00:00:00 2001
From: Erik Boasson <eb@ilities.com>
Date: Sat, 18 Apr 2020 17:32:56 +0200
Subject: [PATCH 197/238] Distinguish signed, float in type descriptor

* Add a flag to indicate signed integral values and one to indicate
  floating-point values
* Set these flags in the output of idlc
* Use them when printing sample contents to the trace

By encoding the information as flags in reserved bits the actual
serialization and deserialization is unaffected.

Signed-off-by: Erik Boasson <eb@ilities.com>
---
 .../ddsc/include/dds/ddsc/dds_public_impl.h   |  7 +++
 src/core/ddsi/src/ddsi_cdrstream.c            | 62 ++++++++++++++-----
 .../cyclonedds/generator/BasicType.java       | 12 ++--
 3 files changed, 58 insertions(+), 23 deletions(-)

diff --git a/src/core/ddsc/include/dds/ddsc/dds_public_impl.h b/src/core/ddsc/include/dds/ddsc/dds_public_impl.h
index 730020c..46bfcbe 100644
--- a/src/core/ddsc/include/dds/ddsc/dds_public_impl.h
+++ b/src/core/ddsc/include/dds/ddsc/dds_public_impl.h
@@ -225,6 +225,13 @@ enum dds_stream_typecode_subtype {
 #define DDS_OP_FLAG_KEY 0x01 /* key field: applicable to {1,2,4,8}BY, STR, BST, ARR-of-{1,2,4,8}BY */
 #define DDS_OP_FLAG_DEF 0x02 /* union has a default case (for DDS_OP_ADR | DDS_OP_TYPE_UNI) */
 
+/* For a union: (1) the discriminator may be a key field; (2) there may be a default value;
+   and (3) the discriminator can be an integral type (or enumerated - here treated as equivalent).
+   What it can't be is a floating-point type. So DEF and FP need never be set at the same time.
+   There are only a few flag bits, so saving one is not such a bad idea. */
+#define DDS_OP_FLAG_FP  0x02 /* floating-point: applicable to {4,8}BY and arrays, sequences of them */
+#define DDS_OP_FLAG_SGN 0x04 /* signed: applicable to {1,2,4,8}BY and arrays, sequences of them */
+
 /**
  * Description : Enable or disable write batching. Overrides default configuration
  * setting for write batching (Internal/WriteBatch).
diff --git a/src/core/ddsi/src/ddsi_cdrstream.c b/src/core/ddsi/src/ddsi_cdrstream.c
index 3565d45..6cdfb80 100644
--- a/src/core/ddsi/src/ddsi_cdrstream.c
+++ b/src/core/ddsi/src/ddsi_cdrstream.c
@@ -1995,14 +1995,42 @@ static size_t isprint_runlen (const unsigned char *s, size_t n)
   return m;
 }
 
-static bool prtf_simple (char * __restrict *buf, size_t * __restrict bufsize, dds_istream_t * __restrict is, enum dds_stream_typecode type)
+static bool prtf_simple (char * __restrict *buf, size_t * __restrict bufsize, dds_istream_t * __restrict is, enum dds_stream_typecode type, unsigned flags)
 {
   switch (type)
   {
-    case DDS_OP_VAL_1BY: return prtf (buf, bufsize, "%"PRIu8, dds_is_get1 (is));
-    case DDS_OP_VAL_2BY: return prtf (buf, bufsize, "%"PRIu16, dds_is_get2 (is));
-    case DDS_OP_VAL_4BY: return prtf (buf, bufsize, "%"PRIu32, dds_is_get4 (is));
-    case DDS_OP_VAL_8BY: return prtf (buf, bufsize, "%"PRIu64, dds_is_get8 (is));
+    case DDS_OP_VAL_1BY: {
+      const union { int8_t s; uint8_t u; } x = { .u = dds_is_get1 (is) };
+      if (flags & DDS_OP_FLAG_SGN)
+        return prtf (buf, bufsize, "%"PRId8, x.s);
+      else
+        return prtf (buf, bufsize, "%"PRIu8, x.u);
+    }
+    case DDS_OP_VAL_2BY: {
+      const union { int16_t s; uint16_t u; } x = { .u = dds_is_get2 (is) };
+      if (flags & DDS_OP_FLAG_SGN)
+        return prtf (buf, bufsize, "%"PRId16, x.s);
+      else
+        return prtf (buf, bufsize, "%"PRIu16, x.u);
+    }
+    case DDS_OP_VAL_4BY: {
+      const union { int32_t s; uint32_t u; float f; } x = { .u = dds_is_get4 (is) };
+      if (flags & DDS_OP_FLAG_FP)
+        return prtf (buf, bufsize, "%g", x.f);
+      else if (flags & DDS_OP_FLAG_SGN)
+        return prtf (buf, bufsize, "%"PRId32, x.s);
+      else
+        return prtf (buf, bufsize, "%"PRIu32, x.u);
+    }
+    case DDS_OP_VAL_8BY: {
+      const union { int64_t s; uint64_t u; double f; } x = { .u = dds_is_get8 (is) };
+      if (flags & DDS_OP_FLAG_FP)
+        return prtf (buf, bufsize, "%g", x.f);
+      else if (flags & DDS_OP_FLAG_SGN)
+        return prtf (buf, bufsize, "%"PRId64, x.s);
+      else
+        return prtf (buf, bufsize, "%"PRIu64, x.u);
+    }
     case DDS_OP_VAL_STR: case DDS_OP_VAL_BST: return prtf_str (buf, bufsize, is);
     case DDS_OP_VAL_ARR: case DDS_OP_VAL_SEQ: case DDS_OP_VAL_UNI: case DDS_OP_VAL_STU:
       abort ();
@@ -2010,7 +2038,7 @@ static bool prtf_simple (char * __restrict *buf, size_t * __restrict bufsize, dd
   return false;
 }
 
-static bool prtf_simple_array (char * __restrict *buf, size_t * __restrict bufsize, dds_istream_t * __restrict is, uint32_t num, enum dds_stream_typecode type)
+static bool prtf_simple_array (char * __restrict *buf, size_t * __restrict bufsize, dds_istream_t * __restrict is, uint32_t num, enum dds_stream_typecode type, unsigned flags)
 {
   bool cont = prtf (buf, bufsize, "{");
   switch (type)
@@ -2033,7 +2061,7 @@ static bool prtf_simple_array (char * __restrict *buf, size_t * __restrict bufsi
         {
           if (i != 0)
             (void) prtf (buf, bufsize, ",");
-          cont = prtf_simple (buf, bufsize, is, type);
+          cont = prtf_simple (buf, bufsize, is, type, flags);
           i++;
         }
       }
@@ -2045,7 +2073,7 @@ static bool prtf_simple_array (char * __restrict *buf, size_t * __restrict bufsi
       {
         if (i != 0)
           (void) prtf (buf, bufsize, ",");
-        cont = prtf_simple (buf, bufsize, is, type);
+        cont = prtf_simple (buf, bufsize, is, type, flags);
       }
       break;
     default:
@@ -2070,10 +2098,10 @@ static const uint32_t *prtf_seq (char * __restrict *buf, size_t *bufsize, dds_is
   switch (subtype)
   {
     case DDS_OP_VAL_1BY: case DDS_OP_VAL_2BY: case DDS_OP_VAL_4BY: case DDS_OP_VAL_8BY:
-      (void) prtf_simple_array (buf, bufsize, is, num, subtype);
+      (void) prtf_simple_array (buf, bufsize, is, num, subtype, DDS_OP_FLAGS (insn));
       return ops + 2;
     case DDS_OP_VAL_STR: case DDS_OP_VAL_BST:
-      (void) prtf_simple_array (buf, bufsize, is, num, subtype);
+      (void) prtf_simple_array (buf, bufsize, is, num, subtype, DDS_OP_FLAGS (insn));
       return ops + (subtype == DDS_OP_VAL_STR ? 2 : 3);
     case DDS_OP_VAL_SEQ: case DDS_OP_VAL_ARR: case DDS_OP_VAL_UNI: case DDS_OP_VAL_STU: {
       const uint32_t jmp = DDS_OP_ADR_JMP (ops[3]);
@@ -2098,10 +2126,10 @@ static const uint32_t *prtf_arr (char * __restrict *buf, size_t *bufsize, dds_is
   switch (subtype)
   {
     case DDS_OP_VAL_1BY: case DDS_OP_VAL_2BY: case DDS_OP_VAL_4BY: case DDS_OP_VAL_8BY:
-      (void) prtf_simple_array (buf, bufsize, is, num, subtype);
+      (void) prtf_simple_array (buf, bufsize, is, num, subtype, DDS_OP_FLAGS (insn));
       return ops + 3;
     case DDS_OP_VAL_STR: case DDS_OP_VAL_BST:
-      (void) prtf_simple_array (buf, bufsize, is, num, subtype);
+      (void) prtf_simple_array (buf, bufsize, is, num, subtype, DDS_OP_FLAGS (insn));
       return ops + (subtype == DDS_OP_VAL_STR ? 3 : 5);
     case DDS_OP_VAL_SEQ: case DDS_OP_VAL_ARR: case DDS_OP_VAL_UNI: case DDS_OP_VAL_STU: {
       const uint32_t *jsr_ops = ops + DDS_OP_ADR_JSR (ops[3]);
@@ -2132,7 +2160,7 @@ static const uint32_t *prtf_uni (char * __restrict *buf, size_t *bufsize, dds_is
     {
       case DDS_OP_VAL_1BY: case DDS_OP_VAL_2BY: case DDS_OP_VAL_4BY: case DDS_OP_VAL_8BY:
       case DDS_OP_VAL_STR: case DDS_OP_VAL_BST:
-        (void) prtf_simple (buf, bufsize, is, valtype);
+        (void) prtf_simple (buf, bufsize, is, valtype, DDS_OP_FLAGS (jeq_op[0]));
         break;
       case DDS_OP_VAL_SEQ: case DDS_OP_VAL_ARR: case DDS_OP_VAL_UNI: case DDS_OP_VAL_STU:
         (void) dds_stream_print_sample1 (buf, bufsize, is, jeq_op + DDS_OP_ADR_JSR (jeq_op[0]), valtype == DDS_OP_VAL_STU);
@@ -2161,11 +2189,11 @@ static bool dds_stream_print_sample1 (char * __restrict *buf, size_t * __restric
         {
           case DDS_OP_VAL_1BY: case DDS_OP_VAL_2BY: case DDS_OP_VAL_4BY: case DDS_OP_VAL_8BY:
           case DDS_OP_VAL_STR:
-            cont = prtf_simple (buf, bufsize, is, DDS_OP_TYPE (insn));
+            cont = prtf_simple (buf, bufsize, is, DDS_OP_TYPE (insn), DDS_OP_FLAGS (insn));
             ops += 2;
             break;
           case DDS_OP_VAL_BST:
-            cont = prtf_simple (buf, bufsize, is, DDS_OP_TYPE (insn));
+            cont = prtf_simple (buf, bufsize, is, DDS_OP_TYPE (insn), DDS_OP_FLAGS (insn));
             ops += 3;
             break;
           case DDS_OP_VAL_SEQ:
@@ -2217,10 +2245,10 @@ size_t dds_stream_print_key (dds_istream_t * __restrict is, const struct ddsi_se
     {
       case DDS_OP_VAL_1BY: case DDS_OP_VAL_2BY: case DDS_OP_VAL_4BY: case DDS_OP_VAL_8BY:
       case DDS_OP_VAL_STR: case DDS_OP_VAL_BST:
-        cont = prtf_simple (&buf, &bufsize, is, DDS_OP_TYPE (*op));
+        cont = prtf_simple (&buf, &bufsize, is, DDS_OP_TYPE (*op), DDS_OP_FLAGS (*op));
         break;
       case DDS_OP_VAL_ARR:
-        cont = prtf_simple_array (&buf, &bufsize, is, op[2], DDS_OP_SUBTYPE (*op));
+        cont = prtf_simple_array (&buf, &bufsize, is, op[2], DDS_OP_SUBTYPE (*op), DDS_OP_FLAGS (*op));
         break;
       case DDS_OP_VAL_SEQ: case DDS_OP_VAL_UNI: case DDS_OP_VAL_STU:
         abort ();
diff --git a/src/idlc/src/org/eclipse/cyclonedds/generator/BasicType.java b/src/idlc/src/org/eclipse/cyclonedds/generator/BasicType.java
index 6ddb67b..8964e7f 100644
--- a/src/idlc/src/org/eclipse/cyclonedds/generator/BasicType.java
+++ b/src/idlc/src/org/eclipse/cyclonedds/generator/BasicType.java
@@ -20,15 +20,15 @@ public class BasicType extends AbstractType
   {
     BOOLEAN ("bool", "DDS_OP_TYPE_BOO", "DDS_OP_SUBTYPE_BOO", Alignment.BOOL, "Boolean"),
     OCTET ("uint8_t", "DDS_OP_TYPE_1BY", "DDS_OP_SUBTYPE_1BY", Alignment.ONE, "Octet"),
-    CHAR ("char", "DDS_OP_TYPE_1BY", "DDS_OP_SUBTYPE_1BY", Alignment.ONE, "Char"),
-    SHORT ("int16_t", "DDS_OP_TYPE_2BY", "DDS_OP_SUBTYPE_2BY", Alignment.TWO, "Short"),
+    CHAR ("char", "DDS_OP_TYPE_1BY | DDS_OP_FLAG_SGN", "DDS_OP_SUBTYPE_1BY | DDS_OP_FLAG_SGN", Alignment.ONE, "Char"),
+    SHORT ("int16_t", "DDS_OP_TYPE_2BY | DDS_OP_FLAG_SGN", "DDS_OP_SUBTYPE_2BY | DDS_OP_FLAG_SGN", Alignment.TWO, "Short"),
     USHORT ("uint16_t", "DDS_OP_TYPE_2BY", "DDS_OP_SUBTYPE_2BY", Alignment.TWO, "UShort"),
-    LONG ("int32_t", "DDS_OP_TYPE_4BY", "DDS_OP_SUBTYPE_4BY", Alignment.FOUR, "Long"),
+    LONG ("int32_t", "DDS_OP_TYPE_4BY | DDS_OP_FLAG_SGN", "DDS_OP_SUBTYPE_4BY | DDS_OP_FLAG_SGN", Alignment.FOUR, "Long"),
     ULONG ("uint32_t", "DDS_OP_TYPE_4BY", "DDS_OP_SUBTYPE_4BY", Alignment.FOUR, "ULong"),
-    LONGLONG ("int64_t", "DDS_OP_TYPE_8BY", "DDS_OP_SUBTYPE_8BY", Alignment.EIGHT, "LongLong"),
+    LONGLONG ("int64_t", "DDS_OP_TYPE_8BY | DDS_OP_FLAG_SGN", "DDS_OP_SUBTYPE_8BY | DDS_OP_FLAG_SGN", Alignment.EIGHT, "LongLong"),
     ULONGLONG ("uint64_t", "DDS_OP_TYPE_8BY", "DDS_OP_SUBTYPE_8BY", Alignment.EIGHT, "ULongLong"),
-    FLOAT ("float", "DDS_OP_TYPE_4BY", "DDS_OP_SUBTYPE_4BY", Alignment.FOUR, "Float"),
-    DOUBLE ("double", "DDS_OP_TYPE_8BY", "DDS_OP_SUBTYPE_8BY", Alignment.EIGHT, "Double"),
+    FLOAT ("float", "DDS_OP_TYPE_4BY | DDS_OP_FLAG_FP", "DDS_OP_SUBTYPE_4BY | DDS_OP_FLAG_FP", Alignment.FOUR, "Float"),
+    DOUBLE ("double", "DDS_OP_TYPE_8BY | DDS_OP_FLAG_FP", "DDS_OP_SUBTYPE_8BY | DDS_OP_FLAG_FP", Alignment.EIGHT, "Double"),
     STRING ("char *", "DDS_OP_TYPE_STR", "DDS_OP_SUBTYPE_STR", Alignment.PTR, "String");
 
     public final String cType;

From 9aef05542f4d00a060b036e50a1a3e1118ddf7c7 Mon Sep 17 00:00:00 2001
From: Erik Boasson <eb@ilities.com>
Date: Sun, 19 Apr 2020 17:36:01 +0200
Subject: [PATCH 198/238] Do not scan instances in dds_{read,take}_instance

Scanning all instances was never good for anything: the RHC is organised
as hash table on instance id (which is an alias for "instance handle")
and it was always designed to do this with a fast lookup.

Signed-off-by: Erik Boasson <eb@ilities.com>
---
 src/core/ddsc/include/dds/ddsc/dds_rhc.h |  17 +-
 src/core/ddsc/src/dds_read.c             |  20 +-
 src/core/ddsc/src/dds_rhc_default.c      | 708 ++++++++++-------------
 3 files changed, 320 insertions(+), 425 deletions(-)

diff --git a/src/core/ddsc/include/dds/ddsc/dds_rhc.h b/src/core/ddsc/include/dds/ddsc/dds_rhc.h
index d0413e6..b5cba34 100644
--- a/src/core/ddsc/include/dds/ddsc/dds_rhc.h
+++ b/src/core/ddsc/include/dds/ddsc/dds_rhc.h
@@ -27,9 +27,8 @@ struct dds_reader;
 struct ddsi_tkmap;
 
 typedef dds_return_t (*dds_rhc_associate_t) (struct dds_rhc *rhc, struct dds_reader *reader, const struct ddsi_sertopic *topic, struct ddsi_tkmap *tkmap);
-typedef int (*dds_rhc_read_t) (struct dds_rhc *rhc, bool lock, void **values, dds_sample_info_t *info_seq, uint32_t max_samples, uint32_t mask, dds_instance_handle_t handle, struct dds_readcond *cond);
-typedef int (*dds_rhc_take_t) (struct dds_rhc *rhc, bool lock, void **values, dds_sample_info_t *info_seq, uint32_t max_samples, uint32_t mask, dds_instance_handle_t handle, struct dds_readcond *cond);
-typedef int (*dds_rhc_takecdr_t) (struct dds_rhc *rhc, bool lock, struct ddsi_serdata **values, dds_sample_info_t *info_seq, uint32_t max_samples, uint32_t sample_states, uint32_t view_states, uint32_t instance_states, dds_instance_handle_t handle);
+typedef int32_t (*dds_rhc_read_take_t) (struct dds_rhc *rhc, bool lock, void **values, dds_sample_info_t *info_seq, uint32_t max_samples, uint32_t mask, dds_instance_handle_t handle, struct dds_readcond *cond);
+typedef int32_t (*dds_rhc_read_take_cdr_t) (struct dds_rhc *rhc, bool lock, struct ddsi_serdata **values, dds_sample_info_t *info_seq, uint32_t max_samples, uint32_t sample_states, uint32_t view_states, uint32_t instance_states, dds_instance_handle_t handle);
 
 typedef bool (*dds_rhc_add_readcondition_t) (struct dds_rhc *rhc, struct dds_readcond *cond);
 typedef void (*dds_rhc_remove_readcondition_t) (struct dds_rhc *rhc, struct dds_readcond *cond);
@@ -40,9 +39,9 @@ struct dds_rhc_ops {
   /* A copy of DDSI rhc ops comes first so we can use either interface without
      additional indirections */
   struct ddsi_rhc_ops rhc_ops;
-  dds_rhc_read_t read;
-  dds_rhc_take_t take;
-  dds_rhc_takecdr_t takecdr;
+  dds_rhc_read_take_t read;
+  dds_rhc_read_take_t take;
+  dds_rhc_read_take_cdr_t takecdr;
   dds_rhc_add_readcondition_t add_readcondition;
   dds_rhc_remove_readcondition_t remove_readcondition;
   dds_rhc_lock_samples_t lock_samples;
@@ -76,13 +75,13 @@ DDS_EXPORT inline void dds_rhc_set_qos (struct dds_rhc *rhc, const struct dds_qo
 DDS_EXPORT inline void dds_rhc_free (struct dds_rhc *rhc) {
   rhc->common.ops->rhc_ops.free (&rhc->common.rhc);
 }
-DDS_EXPORT inline int dds_rhc_read (struct dds_rhc *rhc, bool lock, void **values, dds_sample_info_t *info_seq, uint32_t max_samples, uint32_t mask, dds_instance_handle_t handle, struct dds_readcond *cond) {
+DDS_EXPORT inline int32_t dds_rhc_read (struct dds_rhc *rhc, bool lock, void **values, dds_sample_info_t *info_seq, uint32_t max_samples, uint32_t mask, dds_instance_handle_t handle, struct dds_readcond *cond) {
   return (rhc->common.ops->read) (rhc, lock, values, info_seq, max_samples, mask, handle, cond);
 }
-DDS_EXPORT inline int dds_rhc_take (struct dds_rhc *rhc, bool lock, void **values, dds_sample_info_t *info_seq, uint32_t max_samples, uint32_t mask, dds_instance_handle_t handle, struct dds_readcond *cond) {
+DDS_EXPORT inline int32_t dds_rhc_take (struct dds_rhc *rhc, bool lock, void **values, dds_sample_info_t *info_seq, uint32_t max_samples, uint32_t mask, dds_instance_handle_t handle, struct dds_readcond *cond) {
   return rhc->common.ops->take (rhc, lock, values, info_seq, max_samples, mask, handle, cond);
 }
-DDS_EXPORT inline int dds_rhc_takecdr (struct dds_rhc *rhc, bool lock, struct ddsi_serdata **values, dds_sample_info_t *info_seq, uint32_t max_samples, uint32_t sample_states, uint32_t view_states, uint32_t instance_states, dds_instance_handle_t handle) {
+DDS_EXPORT inline int32_t dds_rhc_takecdr (struct dds_rhc *rhc, bool lock, struct ddsi_serdata **values, dds_sample_info_t *info_seq, uint32_t max_samples, uint32_t sample_states, uint32_t view_states, uint32_t instance_states, dds_instance_handle_t handle) {
   return rhc->common.ops->takecdr (rhc, lock, values, info_seq, max_samples, sample_states, view_states, instance_states, handle);
 }
 DDS_EXPORT inline bool dds_rhc_add_readcondition (struct dds_rhc *rhc, struct dds_readcond *cond) {
diff --git a/src/core/ddsc/src/dds_read.c b/src/core/ddsc/src/dds_read.c
index 701f50d..fd9ae5b 100644
--- a/src/core/ddsc/src/dds_read.c
+++ b/src/core/ddsc/src/dds_read.c
@@ -40,7 +40,7 @@ static dds_return_t dds_read_impl (bool take, dds_entity_t reader_or_condition,
 #define NC_FREE_BUF 2u
 #define NC_RESET_BUF 4u
 
-  if (buf == NULL || si == NULL || maxs == 0 || bufsz == 0 || bufsz < maxs)
+  if (buf == NULL || si == NULL || maxs == 0 || bufsz == 0 || bufsz < maxs || maxs > INT32_MAX)
     return DDS_RETCODE_BAD_PARAMETER;
 
   if ((ret = dds_entity_pin (reader_or_condition, &entity)) < 0) {
@@ -61,14 +61,6 @@ static dds_return_t dds_read_impl (bool take, dds_entity_t reader_or_condition,
 
   thread_state_awake (ts1, &entity->m_domain->gv);
 
-  if (hand != DDS_HANDLE_NIL)
-  {
-    if (ddsi_tkmap_find_by_id (entity->m_domain->gv.m_tkmap, hand) == NULL) {
-      ret = DDS_RETCODE_PRECONDITION_NOT_MET;
-      goto fail_awake_pinned;
-    }
-  }
-
   /* Allocate samples if not provided (assuming all or none provided) */
   if (buf[0] == NULL)
   {
@@ -142,8 +134,6 @@ static dds_return_t dds_read_impl (bool take, dds_entity_t reader_or_condition,
 #undef NC_FREE_BUF
 #undef NC_RESET_BUF
 
-fail_awake_pinned:
-  thread_state_asleep (ts1);
 fail_pinned:
   dds_entity_unpin (entity);
 fail:
@@ -157,12 +147,8 @@ static dds_return_t dds_readcdr_impl (bool take, dds_entity_t reader_or_conditio
   struct dds_reader *rd;
   struct dds_entity *entity;
 
-  assert (take);
-  assert (buf);
-  assert (si);
-  assert (hand == DDS_HANDLE_NIL);
-  assert (maxs > 0);
-  (void)take;
+  if (buf == NULL || si == NULL || maxs == 0 || maxs > INT32_MAX)
+    return DDS_RETCODE_BAD_PARAMETER;
 
   if ((ret = dds_entity_pin (reader_or_condition, &entity)) < 0) {
     return ret;
diff --git a/src/core/ddsc/src/dds_rhc_default.c b/src/core/ddsc/src/dds_rhc_default.c
index 50313ed..07692e7 100644
--- a/src/core/ddsc/src/dds_rhc_default.c
+++ b/src/core/ddsc/src/dds_rhc_default.c
@@ -337,7 +337,7 @@ struct dds_rhc_default {
 };
 
 struct trigger_info_cmn {
-  unsigned qminst;
+  uint32_t qminst;
   bool has_read;
   bool has_not_read;
 };
@@ -368,9 +368,9 @@ static bool dds_rhc_default_store (struct dds_rhc_default * __restrict rhc, cons
 static void dds_rhc_default_unregister_wr (struct dds_rhc_default * __restrict rhc, const struct ddsi_writer_info * __restrict wrinfo);
 static void dds_rhc_default_relinquish_ownership (struct dds_rhc_default * __restrict rhc, const uint64_t wr_iid);
 static void dds_rhc_default_set_qos (struct dds_rhc_default *rhc, const struct dds_qos *qos);
-static int dds_rhc_default_read (struct dds_rhc_default *rhc, bool lock, void **values, dds_sample_info_t *info_seq, uint32_t max_samples, uint32_t mask, dds_instance_handle_t handle, dds_readcond *cond);
-static int dds_rhc_default_take (struct dds_rhc_default *rhc, bool lock, void **values, dds_sample_info_t *info_seq, uint32_t max_samples, uint32_t mask, dds_instance_handle_t handle, dds_readcond *cond);
-static int dds_rhc_default_takecdr (struct dds_rhc_default *rhc, bool lock, struct ddsi_serdata ** values, dds_sample_info_t *info_seq, uint32_t max_samples, uint32_t sample_states, uint32_t view_states, uint32_t instance_states, dds_instance_handle_t handle);
+static int32_t dds_rhc_default_read (struct dds_rhc_default *rhc, bool lock, void **values, dds_sample_info_t *info_seq, uint32_t max_samples, uint32_t mask, dds_instance_handle_t handle, dds_readcond *cond);
+static int32_t dds_rhc_default_take (struct dds_rhc_default *rhc, bool lock, void **values, dds_sample_info_t *info_seq, uint32_t max_samples, uint32_t mask, dds_instance_handle_t handle, dds_readcond *cond);
+static int32_t dds_rhc_default_takecdr (struct dds_rhc_default *rhc, bool lock, struct ddsi_serdata ** values, dds_sample_info_t *info_seq, uint32_t max_samples, uint32_t sample_states, uint32_t view_states, uint32_t instance_states, dds_instance_handle_t handle);
 static bool dds_rhc_default_add_readcondition (struct dds_rhc_default *rhc, dds_readcond *cond);
 static void dds_rhc_default_remove_readcondition (struct dds_rhc_default *rhc, dds_readcond *cond);
 static uint32_t dds_rhc_default_lock_samples (struct dds_rhc_default *rhc);
@@ -390,13 +390,13 @@ static void dds_rhc_default_relinquish_ownership_wrap (struct ddsi_rhc * __restr
 static void dds_rhc_default_set_qos_wrap (struct ddsi_rhc *rhc, const struct dds_qos *qos) {
   dds_rhc_default_set_qos ((struct dds_rhc_default *) rhc, qos);
 }
-static int dds_rhc_default_read_wrap (struct dds_rhc *rhc, bool lock, void **values, dds_sample_info_t *info_seq, uint32_t max_samples, uint32_t mask, dds_instance_handle_t handle, dds_readcond *cond) {
+static int32_t dds_rhc_default_read_wrap (struct dds_rhc *rhc, bool lock, void **values, dds_sample_info_t *info_seq, uint32_t max_samples, uint32_t mask, dds_instance_handle_t handle, dds_readcond *cond) {
   return dds_rhc_default_read ((struct dds_rhc_default *) rhc, lock, values, info_seq, max_samples, mask, handle, cond);
 }
-static int dds_rhc_default_take_wrap (struct dds_rhc *rhc, bool lock, void **values, dds_sample_info_t *info_seq, uint32_t max_samples, uint32_t mask, dds_instance_handle_t handle, dds_readcond *cond) {
+static int32_t dds_rhc_default_take_wrap (struct dds_rhc *rhc, bool lock, void **values, dds_sample_info_t *info_seq, uint32_t max_samples, uint32_t mask, dds_instance_handle_t handle, dds_readcond *cond) {
   return dds_rhc_default_take ((struct dds_rhc_default *) rhc, lock, values, info_seq, max_samples, mask, handle, cond);
 }
-static int dds_rhc_default_takecdr_wrap (struct dds_rhc *rhc, bool lock, struct ddsi_serdata **values, dds_sample_info_t *info_seq, uint32_t max_samples, uint32_t sample_states, uint32_t view_states, uint32_t instance_states, dds_instance_handle_t handle) {
+static int32_t dds_rhc_default_takecdr_wrap (struct dds_rhc *rhc, bool lock, struct ddsi_serdata **values, dds_sample_info_t *info_seq, uint32_t max_samples, uint32_t sample_states, uint32_t view_states, uint32_t instance_states, dds_instance_handle_t handle) {
   return dds_rhc_default_takecdr ((struct dds_rhc_default *) rhc, lock, values, info_seq, max_samples, sample_states, view_states, instance_states, handle);
 }
 static bool dds_rhc_default_add_readcondition_wrap (struct dds_rhc *rhc, dds_readcond *cond) {
@@ -432,12 +432,12 @@ static const struct dds_rhc_ops dds_rhc_default_ops = {
   .associate = dds_rhc_default_associate
 };
 
-static unsigned qmask_of_sample (const struct rhc_sample *s)
+static uint32_t qmask_of_sample (const struct rhc_sample *s)
 {
   return s->isread ? DDS_READ_SAMPLE_STATE : DDS_NOT_READ_SAMPLE_STATE;
 }
 
-static unsigned qmask_of_invsample (const struct rhc_instance *i)
+static uint32_t qmask_of_invsample (const struct rhc_instance *i)
 {
   return i->inv_isread ? DDS_READ_SAMPLE_STATE : DDS_NOT_READ_SAMPLE_STATE;
 }
@@ -467,17 +467,17 @@ static bool inst_has_unread (const struct rhc_instance *i)
   return inst_nread (i) < inst_nsamples (i);
 }
 
-static void topicless_to_clean_invsample (const struct ddsi_sertopic *topic, const struct ddsi_serdata *d, void *sample, void **bufptr, void *buflim)
+static bool topicless_to_clean_invsample (const struct ddsi_sertopic *topic, const struct ddsi_serdata *d, void *sample, void **bufptr, void *buflim)
 {
   /* ddsi_serdata_topicless_to_sample just deals with the key value, without paying any attention to attributes;
      but that makes life harder for the user: the attributes of an invalid sample would be garbage, but would
      nonetheless have to be freed in the end.  Zero'ing it explicitly solves that problem. */
   ddsi_sertopic_free_sample (topic, sample, DDS_FREE_CONTENTS);
   ddsi_sertopic_zero_sample (topic, sample);
-  ddsi_serdata_topicless_to_sample (topic, d, sample, bufptr, buflim);
+  return ddsi_serdata_topicless_to_sample (topic, d, sample, bufptr, buflim);
 }
 
-static unsigned qmask_of_inst (const struct rhc_instance *inst);
+static uint32_t qmask_of_inst (const struct rhc_instance *inst);
 static void free_sample (struct dds_rhc_default *rhc, struct rhc_instance *inst, struct rhc_sample *s);
 static void get_trigger_info_cmn (struct trigger_info_cmn *info, struct rhc_instance *inst);
 static void get_trigger_info_pre (struct trigger_info_pre *info, struct rhc_instance *inst);
@@ -1462,7 +1462,7 @@ static rhc_store_result_t rhc_store_new_instance (struct rhc_instance **out_inst
 static bool dds_rhc_default_store (struct dds_rhc_default * __restrict rhc, const struct ddsi_writer_info * __restrict wrinfo, struct ddsi_serdata * __restrict sample, struct ddsi_tkmap_instance * __restrict tk)
 {
   const uint64_t wr_iid = wrinfo->iid;
-  const unsigned statusinfo = sample->statusinfo;
+  const uint32_t statusinfo = sample->statusinfo;
   const bool has_data = (sample->kind == SDK_DATA);
   const int is_dispose = (statusinfo & NN_STATUSINFO_DISPOSE) != 0;
   struct rhc_instance dummy_instance;
@@ -1845,9 +1845,9 @@ static void dds_rhc_default_relinquish_ownership (struct dds_rhc_default * __res
    instance: ANY, ALIVE, NOT_ALIVE, NOT_ALIVE_NO_WRITERS, NOT_ALIVE_DISPOSED
 */
 
-static unsigned qmask_of_inst (const struct rhc_instance *inst)
+static uint32_t qmask_of_inst (const struct rhc_instance *inst)
 {
-  unsigned qm = inst->isnew ? DDS_NEW_VIEW_STATE : DDS_NOT_NEW_VIEW_STATE;
+  uint32_t qm = inst->isnew ? DDS_NEW_VIEW_STATE : DDS_NOT_NEW_VIEW_STATE;
 
   if (inst->isdisposed)
     qm |= DDS_NOT_ALIVE_DISPOSED_INSTANCE_STATE;
@@ -1905,9 +1905,9 @@ static uint32_t qmask_from_dcpsquery (uint32_t sample_states, uint32_t view_stat
   return qminv;
 }
 
-static unsigned qmask_from_mask_n_cond (uint32_t mask, dds_readcond* cond)
+static uint32_t qmask_from_mask_n_cond (uint32_t mask, dds_readcond* cond)
 {
-    unsigned qminv;
+    uint32_t qminv;
     if (mask == NO_STATE_MASK_SET) {
         if (cond) {
             /* No mask set, use the one from the condition. */
@@ -1962,12 +1962,11 @@ static void patch_generations (dds_sample_info_t *si, uint32_t last_of_inst)
 {
   if (last_of_inst > 0)
   {
-    const unsigned ref =
+    const uint32_t ref =
       si[last_of_inst].disposed_generation_count + si[last_of_inst].no_writers_generation_count;
-    uint32_t i;
     assert (si[last_of_inst].sample_rank == 0);
     assert (si[last_of_inst].generation_rank == 0);
-    for (i = 0; i < last_of_inst; i++)
+    for (uint32_t i = 0; i < last_of_inst; i++)
     {
       si[i].sample_rank = last_of_inst - i;
       si[i].generation_rank = ref - (si[i].disposed_generation_count + si[i].no_writers_generation_count);
@@ -2014,418 +2013,329 @@ static bool take_sample_update_conditions (struct dds_rhc_default *rhc, struct t
   return false;
 }
 
-static int dds_rhc_read_w_qminv (struct dds_rhc_default *rhc, bool lock, void **values, dds_sample_info_t *info_seq, uint32_t max_samples, unsigned qminv, dds_instance_handle_t handle, dds_readcond *cond)
-{
-  uint32_t n = 0;
+typedef bool (*read_take_to_sample_t) (const struct ddsi_serdata * __restrict d, void *__restrict  *__restrict  sample, void * __restrict * __restrict bufptr, void * __restrict buflim);
+typedef bool (*read_take_to_invsample_t) (const struct ddsi_sertopic * __restrict topic, const struct ddsi_serdata * __restrict d, void *__restrict * __restrict sample, void * __restrict * __restrict bufptr, void * __restrict buflim);
 
+static bool read_take_to_sample (const struct ddsi_serdata * __restrict d, void * __restrict * __restrict sample, void * __restrict * __restrict bufptr, void * __restrict buflim)
+{
+  return ddsi_serdata_to_sample (d, *sample, (void **) bufptr, buflim);
+}
+
+static bool read_take_to_invsample (const struct ddsi_sertopic * __restrict topic, const struct ddsi_serdata * __restrict d, void * __restrict * __restrict sample, void * __restrict * __restrict bufptr, void * __restrict buflim)
+{
+  return topicless_to_clean_invsample (topic, d, *sample, (void **) bufptr, buflim);
+}
+
+static bool read_take_to_sample_ref (const struct ddsi_serdata * __restrict d, void * __restrict * __restrict sample, void * __restrict * __restrict bufptr, void * __restrict buflim)
+{
+  (void) bufptr; (void) buflim;
+  *sample = ddsi_serdata_ref (d);
+  return true;
+}
+
+static bool read_take_to_invsample_ref (const struct ddsi_sertopic * __restrict topic, const struct ddsi_serdata * __restrict d, void * __restrict * __restrict sample, void * __restrict * __restrict bufptr, void * __restrict buflim)
+{
+  (void) topic; (void) bufptr; (void) buflim;
+  *sample = ddsi_serdata_ref (d);
+  return true;
+}
+
+static int32_t read_w_qminv_inst (struct dds_rhc_default * const __restrict rhc, struct rhc_instance * const __restrict inst, void * __restrict * __restrict values, dds_sample_info_t * __restrict info_seq, const int32_t max_samples, const uint32_t qminv, const dds_querycond_mask_t qcmask, read_take_to_sample_t to_sample, read_take_to_invsample_t to_invsample)
+{
+  assert (max_samples > 0);
+  if (inst_is_empty (inst) || (qmask_of_inst (inst) & qminv) != 0)
+  {
+    /* no samples present, or the instance/view state doesn't match */
+    return 0;
+  }
+
+  struct trigger_info_pre pre;
+  struct trigger_info_post post;
+  struct trigger_info_qcond trig_qc;
+  const uint32_t nread = inst_nread (inst);
+  int32_t n = 0;
+  get_trigger_info_pre (&pre, inst);
+  init_trigger_info_qcond (&trig_qc);
+
+  /* any valid samples precede a possible invalid sample */
+  if (inst->latest)
+  {
+    struct rhc_sample *sample = inst->latest->next, * const end1 = sample;
+    do {
+      if ((qmask_of_sample (sample) & qminv) == 0 && (qcmask == 0 || (sample->conds & qcmask)))
+      {
+        /* sample state matches too */
+        set_sample_info (info_seq + n, inst, sample);
+        to_sample (sample->sample, values + n, 0, 0);
+        if (!sample->isread)
+        {
+          TRACE ("s");
+          read_sample_update_conditions (rhc, &pre, &post, &trig_qc, inst, sample->conds, false);
+          sample->isread = true;
+          inst->nvread++;
+          rhc->n_vread++;
+        }
+        ++n;
+      }
+      sample = sample->next;
+    } while (n < max_samples && sample != end1);
+  }
+
+  /* add an invalid sample if it exists, matches and there is room in the result */
+  if (inst->inv_exists && n < max_samples && (qmask_of_invsample (inst) & qminv) == 0 && (qcmask == 0 || (inst->conds & qcmask)))
+  {
+    set_sample_info_invsample (info_seq + n, inst);
+    to_invsample (rhc->topic, inst->tk->m_sample, values + n, 0, 0);
+    if (!inst->inv_isread)
+    {
+      TRACE ("i");
+      read_sample_update_conditions (rhc, &pre, &post, &trig_qc, inst, inst->conds, false);
+      inst->inv_isread = 1;
+      rhc->n_invread++;
+    }
+    ++n;
+  }
+
+  /* set generation counts in sample info now that we can compute them; update instance state */
+  bool inst_became_old = false;
+  if (n > 0)
+  {
+    patch_generations (info_seq, (uint32_t) n - 1);
+    if (inst->isnew)
+    {
+      inst_became_old = true;
+      inst->isnew = 0;
+      rhc->n_new--;
+    }
+  }
+  if (nread != inst_nread (inst) || inst_became_old)
+  {
+    size_t ntriggers = SIZE_MAX;
+    get_trigger_info_cmn (&post.c, inst);
+    assert (trig_qc.dec_conds_invsample == 0);
+    assert (trig_qc.dec_conds_sample == 0);
+    assert (trig_qc.inc_conds_invsample == 0);
+    assert (trig_qc.inc_conds_sample == 0);
+    update_conditions_locked (rhc, false, &pre, &post, &trig_qc, inst, NULL, &ntriggers);
+  }
+  return n;
+}
+
+static int32_t take_w_qminv_inst (struct dds_rhc_default * const __restrict rhc, struct rhc_instance * const __restrict inst, void * __restrict * __restrict values, dds_sample_info_t * __restrict info_seq, const int32_t max_samples, const uint32_t qminv, const dds_querycond_mask_t qcmask, size_t * __restrict ntriggers, read_take_to_sample_t to_sample, read_take_to_invsample_t to_invsample)
+{
+  assert (max_samples > 0);
+  if (inst_is_empty (inst) || (qmask_of_inst (inst) & qminv) != 0)
+  {
+    /* no samples present, or the instance/view state doesn't match */
+    return 0;
+  }
+
+  struct trigger_info_pre pre;
+  struct trigger_info_post post;
+  struct trigger_info_qcond trig_qc;
+  int32_t n = 0;
+  get_trigger_info_pre (&pre, inst);
+  init_trigger_info_qcond (&trig_qc);
+
+  if (inst->latest)
+  {
+    struct rhc_sample *psample = inst->latest;
+    struct rhc_sample *sample = psample->next;
+    uint32_t nvsamples = inst->nvsamples;
+    while (nvsamples--)
+    {
+      struct rhc_sample * const sample1 = sample->next;
+      if ((qmask_of_sample (sample) & qminv) != 0 || (qcmask != 0 && !(sample->conds & qcmask)))
+      {
+        /* sample mask doesn't match, or content predicate doesn't match */
+        psample = sample;
+      }
+      else
+      {
+        take_sample_update_conditions (rhc, &pre, &post, &trig_qc, inst, sample->conds, sample->isread);
+        set_sample_info (info_seq + n, inst, sample);
+        to_sample (sample->sample, values + n, 0, 0);
+        rhc->n_vsamples--;
+        if (sample->isread)
+        {
+          inst->nvread--;
+          rhc->n_vread--;
+        }
+        if (--inst->nvsamples == 0)
+          inst->latest = NULL;
+        else
+        {
+          if (inst->latest == sample)
+            inst->latest = psample;
+          psample->next = sample1;
+        }
+        free_sample (rhc, inst, sample);
+        if (++n == max_samples)
+          break;
+      }
+      sample = sample1;
+    }
+  }
+
+  if (inst->inv_exists && n < max_samples && (qmask_of_invsample (inst) & qminv) == 0 && (qcmask == 0 || (inst->conds & qcmask) != 0))
+  {
+    struct trigger_info_qcond dummy_trig_qc;
+#ifndef NDEBUG
+    init_trigger_info_qcond (&dummy_trig_qc);
+#endif
+    take_sample_update_conditions (rhc, &pre, &post, &trig_qc, inst, inst->conds, inst->inv_isread);
+    set_sample_info_invsample (info_seq + n, inst);
+    to_invsample (rhc->topic, inst->tk->m_sample, values + n, 0, 0);
+    inst_clear_invsample (rhc, inst, &dummy_trig_qc);
+    ++n;
+  }
+
+  if (n > 0)
+  {
+    patch_generations (info_seq, (uint32_t) n - 1);
+    if (inst->isnew)
+    {
+      inst->isnew = 0;
+      rhc->n_new--;
+    }
+    /* if nsamples = 0, it won't match anything, so no need to do anything here for drop_instance_noupdate_no_writers */
+    get_trigger_info_cmn (&post.c, inst);
+    assert (trig_qc.dec_conds_invsample == 0);
+    assert (trig_qc.dec_conds_sample == 0);
+    assert (trig_qc.inc_conds_invsample == 0);
+    assert (trig_qc.inc_conds_sample == 0);
+    update_conditions_locked (rhc, false, &pre, &post, &trig_qc, inst, NULL, ntriggers);
+  }
+
+  if (inst_is_empty (inst))
+  {
+    remove_inst_from_nonempty_list (rhc, inst);
+    if (inst->isdisposed)
+      rhc->n_not_alive_disposed--;
+    if (inst->wrcount == 0)
+    {
+      TRACE ("take: iid %"PRIx64" #0,empty,drop\n", inst->iid);
+      if (!inst->isdisposed)
+      {
+        /* disposed has priority over no writers (why not just 2 bits?) */
+        rhc->n_not_alive_no_writers--;
+      }
+      drop_instance_noupdate_no_writers (rhc, inst);
+    }
+  }
+  return n;
+}
+
+static int32_t read_w_qminv (struct dds_rhc_default * __restrict rhc, bool lock, void * __restrict * __restrict values, dds_sample_info_t * __restrict info_seq, int32_t max_samples, uint32_t qminv, dds_instance_handle_t handle, dds_readcond * __restrict cond, read_take_to_sample_t to_sample, read_take_to_invsample_t to_invsample)
+{
+  int32_t n = 0;
+  assert (max_samples > 0);
   if (lock)
   {
     ddsrt_mutex_lock (&rhc->lock);
   }
 
-  TRACE ("read_w_qminv(%p,%p,%p,%"PRIu32",%x,%p) - inst %"PRIu32" nonempty %"PRIu32" disp %"PRIu32" nowr %"PRIu32" new %"PRIu32" samples %"PRIu32"+%"PRIu32" read %"PRIu32"+%"PRIu32"\n",
-    (void *) rhc, (void *) values, (void *) info_seq, max_samples, qminv, (void *) cond,
+  TRACE ("read_w_qminv(%p,%p,%p,%"PRId32",%x,%"PRIx64",%p) - inst %"PRIu32" nonempty %"PRIu32" disp %"PRIu32" nowr %"PRIu32" new %"PRIu32" samples %"PRIu32"+%"PRIu32" read %"PRIu32"+%"PRIu32"\n",
+    (void *) rhc, (void *) values, (void *) info_seq, max_samples, qminv, handle, (void *) cond,
     rhc->n_instances, rhc->n_nonempty_instances, rhc->n_not_alive_disposed,
     rhc->n_not_alive_no_writers, rhc->n_new, rhc->n_vsamples, rhc->n_invsamples,
     rhc->n_vread, rhc->n_invread);
 
-  if (!ddsrt_circlist_isempty (&rhc->nonempty_instances))
+  const dds_querycond_mask_t qcmask = (cond && cond->m_query.m_filter) ? cond->m_query.m_qcmask : 0;
+  if (handle)
+  {
+    struct rhc_instance template, *inst;
+    template.iid = handle;
+    if ((inst = ddsrt_hh_lookup (rhc->instances, &template)) != NULL)
+      n = read_w_qminv_inst (rhc, inst, values, info_seq, max_samples, qminv, qcmask, to_sample, to_invsample);
+    else
+      n = DDS_RETCODE_PRECONDITION_NOT_MET;
+  }
+  else if (!ddsrt_circlist_isempty (&rhc->nonempty_instances))
   {
-    const dds_querycond_mask_t qcmask = (cond && cond->m_query.m_filter) ? cond->m_query.m_qcmask : 0;
     struct rhc_instance * inst = oldest_nonempty_instance (rhc);
     struct rhc_instance * const end = inst;
-    do
-    {
-      if (handle == DDS_HANDLE_NIL || inst->iid == handle)
-      {
-        if (!inst_is_empty (inst) && (qmask_of_inst (inst) & qminv) == 0)
-        {
-          /* samples present & instance, view state matches */
-          struct trigger_info_pre pre;
-          struct trigger_info_post post;
-          struct trigger_info_qcond trig_qc;
-          const unsigned nread = inst_nread (inst);
-          const uint32_t n_first = n;
-          get_trigger_info_pre (&pre, inst);
-          init_trigger_info_qcond (&trig_qc);
-
-          if (inst->latest)
-          {
-            struct rhc_sample *sample = inst->latest->next, * const end1 = sample;
-            do
-            {
-              if ((qmask_of_sample (sample) & qminv) == 0 && (qcmask == 0 || (sample->conds & qcmask)))
-              {
-                /* sample state matches too */
-                set_sample_info (info_seq + n, inst, sample);
-                ddsi_serdata_to_sample (sample->sample, values[n], 0, 0);
-                if (!sample->isread)
-                {
-                  TRACE ("s");
-                  read_sample_update_conditions (rhc, &pre, &post, &trig_qc, inst, sample->conds, false);
-                  sample->isread = true;
-                  inst->nvread++;
-                  rhc->n_vread++;
-                }
-                if (++n == max_samples)
-                {
-                  break;
-                }
-              }
-              sample = sample->next;
-            }
-            while (sample != end1);
-          }
-
-          if (inst->inv_exists && n < max_samples && (qmask_of_invsample (inst) & qminv) == 0 && (qcmask == 0 || (inst->conds & qcmask)))
-          {
-            set_sample_info_invsample (info_seq + n, inst);
-            topicless_to_clean_invsample (rhc->topic, inst->tk->m_sample, values[n], 0, 0);
-            if (!inst->inv_isread)
-            {
-              TRACE ("i");
-              read_sample_update_conditions (rhc, &pre, &post, &trig_qc, inst, inst->conds, false);
-              inst->inv_isread = 1;
-              rhc->n_invread++;
-            }
-            ++n;
-          }
-
-          bool inst_became_old = false;
-          if (n > n_first && inst->isnew)
-          {
-            inst_became_old = true;
-            inst->isnew = 0;
-            rhc->n_new--;
-          }
-          if (nread != inst_nread (inst) || inst_became_old)
-          {
-            size_t ntriggers = SIZE_MAX;
-            get_trigger_info_cmn (&post.c, inst);
-            assert (trig_qc.dec_conds_invsample == 0);
-            assert (trig_qc.dec_conds_sample == 0);
-            assert (trig_qc.inc_conds_invsample == 0);
-            assert (trig_qc.inc_conds_sample == 0);
-            update_conditions_locked (rhc, false, &pre, &post, &trig_qc, inst, NULL, &ntriggers);
-          }
-
-          if (n > n_first) {
-            patch_generations (info_seq + n_first, n - n_first - 1);
-          }
-        }
-        if (inst->iid == handle)
-        {
-          break;
-        }
-      }
+    do {
+      n += read_w_qminv_inst(rhc, inst, values + n, info_seq + n, max_samples - n, qminv, qcmask, to_sample, to_invsample);
       inst = next_nonempty_instance (inst);
-    }
-    while (inst != end && n < max_samples);
+    } while (inst != end && n < max_samples);
   }
   TRACE ("read: returning %"PRIu32"\n", n);
   assert (rhc_check_counts_locked (rhc, true, false));
+
+  // FIXME: conditional "lock" plus unconditional "unlock" is inexcusably bad design
+  // It appears to have been introduced at some point so another language binding could lock
+  // the RHC using dds_rhc_default_lock_samples to find out the number of samples present,
+  // then allocate stuff and call read/take with lock=true. All that needs fixing.
   ddsrt_mutex_unlock (&rhc->lock);
-  assert (n <= INT_MAX);
-  return (int)n;
+  return n;
 }
 
-static int dds_rhc_take_w_qminv (struct dds_rhc_default *rhc, bool lock, void **values, dds_sample_info_t *info_seq, uint32_t max_samples, unsigned qminv, dds_instance_handle_t handle, dds_readcond *cond)
+static int32_t take_w_qminv (struct dds_rhc_default * __restrict rhc, bool lock, void * __restrict * __restrict values, dds_sample_info_t * __restrict info_seq, int32_t max_samples, uint32_t qminv, dds_instance_handle_t handle, dds_readcond * __restrict cond, read_take_to_sample_t to_sample, read_take_to_invsample_t to_invsample)
 {
-  uint64_t iid;
-  uint32_t n = 0;
+  int32_t n = 0;
   size_t ntriggers = SIZE_MAX;
-
+  assert (max_samples > 0);
   if (lock)
   {
     ddsrt_mutex_lock (&rhc->lock);
   }
 
-  TRACE ("take_w_qminv(%p,%p,%p,%"PRIu32",%x) - inst %"PRIu32" nonempty %"PRIu32" disp %"PRIu32" nowr %"PRIu32" new %"PRIu32" samples %"PRIu32"+%"PRIu32" read %"PRIu32"+%"PRIu32"\n",
-    (void*) rhc, (void*) values, (void*) info_seq, max_samples, qminv,
+  TRACE ("take_w_qminv(%p,%p,%p,%"PRId32",%x,%"PRIx64",%p) - inst %"PRIu32" nonempty %"PRIu32" disp %"PRIu32" nowr %"PRIu32" new %"PRIu32" samples %"PRIu32"+%"PRIu32" read %"PRIu32"+%"PRIu32"\n",
+    (void*) rhc, (void*) values, (void*) info_seq, max_samples, qminv, handle, (void *) cond,
     rhc->n_instances, rhc->n_nonempty_instances, rhc->n_not_alive_disposed,
     rhc->n_not_alive_no_writers, rhc->n_new, rhc->n_vsamples,
     rhc->n_invsamples, rhc->n_vread, rhc->n_invread);
 
-  if (!ddsrt_circlist_isempty (&rhc->nonempty_instances))
+  const dds_querycond_mask_t qcmask = (cond && cond->m_query.m_filter) ? cond->m_query.m_qcmask : 0;
+  if (handle)
+  {
+    struct rhc_instance template, *inst;
+    template.iid = handle;
+    if ((inst = ddsrt_hh_lookup (rhc->instances, &template)) != NULL)
+      n = take_w_qminv_inst (rhc, inst, values, info_seq, max_samples, qminv, qcmask, &ntriggers, to_sample, to_invsample);
+    else
+      n = DDS_RETCODE_PRECONDITION_NOT_MET;
+  }
+  else if (!ddsrt_circlist_isempty (&rhc->nonempty_instances))
   {
-    const dds_querycond_mask_t qcmask = (cond && cond->m_query.m_filter) ? cond->m_query.m_qcmask : 0;
     struct rhc_instance *inst = oldest_nonempty_instance (rhc);
-    unsigned n_insts = rhc->n_nonempty_instances;
+    uint32_t n_insts = rhc->n_nonempty_instances;
     while (n_insts-- > 0 && n < max_samples)
     {
       struct rhc_instance * const inst1 = next_nonempty_instance (inst);
-      iid = inst->iid;
-      if (handle == DDS_HANDLE_NIL || iid == handle)
-      {
-        if (!inst_is_empty (inst) && (qmask_of_inst (inst) & qminv) == 0)
-        {
-          struct trigger_info_pre pre;
-          struct trigger_info_post post;
-          struct trigger_info_qcond trig_qc;
-          unsigned nvsamples = inst->nvsamples;
-          const uint32_t n_first = n;
-          get_trigger_info_pre (&pre, inst);
-          init_trigger_info_qcond (&trig_qc);
-
-          if (inst->latest)
-          {
-            struct rhc_sample *psample = inst->latest;
-            struct rhc_sample *sample = psample->next;
-            while (nvsamples--)
-            {
-              struct rhc_sample * const sample1 = sample->next;
-
-              if ((qmask_of_sample (sample) & qminv) != 0 || (qcmask != 0 && !(sample->conds & qcmask)))
-              {
-                /* sample mask doesn't match, or content predicate doesn't match */
-                psample = sample;
-              }
-              else
-              {
-                take_sample_update_conditions (rhc, &pre, &post, &trig_qc, inst, sample->conds, sample->isread);
-
-                set_sample_info (info_seq + n, inst, sample);
-                ddsi_serdata_to_sample (sample->sample, values[n], 0, 0);
-                rhc->n_vsamples--;
-                if (sample->isread)
-                {
-                  inst->nvread--;
-                  rhc->n_vread--;
-                }
-
-                if (--inst->nvsamples > 0)
-                {
-                  if (inst->latest == sample)
-                    inst->latest = psample;
-                  psample->next = sample1;
-                }
-                else
-                {
-                  inst->latest = NULL;
-                }
-
-                free_sample (rhc, inst, sample);
-
-                if (++n == max_samples)
-                {
-                  break;
-                }
-              }
-              sample = sample1;
-            }
-          }
-
-          if (inst->inv_exists && n < max_samples && (qmask_of_invsample (inst) & qminv) == 0 && (qcmask == 0 || (inst->conds & qcmask) != 0))
-          {
-            struct trigger_info_qcond dummy_trig_qc;
-#ifndef NDEBUG
-            init_trigger_info_qcond (&dummy_trig_qc);
-#endif
-            take_sample_update_conditions (rhc, &pre, &post, &trig_qc, inst, inst->conds, inst->inv_isread);
-            set_sample_info_invsample (info_seq + n, inst);
-            topicless_to_clean_invsample (rhc->topic, inst->tk->m_sample, values[n], 0, 0);
-            inst_clear_invsample (rhc, inst, &dummy_trig_qc);
-            ++n;
-          }
-
-          if (n > n_first && inst->isnew)
-          {
-            inst->isnew = 0;
-            rhc->n_new--;
-          }
-
-          if (n > n_first)
-          {
-            /* if nsamples = 0, it won't match anything, so no need to do
-               anything here for drop_instance_noupdate_no_writers */
-            get_trigger_info_cmn (&post.c, inst);
-            assert (trig_qc.dec_conds_invsample == 0);
-            assert (trig_qc.dec_conds_sample == 0);
-            assert (trig_qc.inc_conds_invsample == 0);
-            assert (trig_qc.inc_conds_sample == 0);
-            update_conditions_locked (rhc, false, &pre, &post, &trig_qc, inst, NULL, &ntriggers);
-          }
-
-          if (inst_is_empty (inst))
-          {
-            remove_inst_from_nonempty_list (rhc, inst);
-
-            if (inst->isdisposed)
-            {
-              rhc->n_not_alive_disposed--;
-            }
-            if (inst->wrcount == 0)
-            {
-              TRACE ("take: iid %"PRIx64" #0,empty,drop\n", iid);
-              if (!inst->isdisposed)
-              {
-                /* disposed has priority over no writers (why not just 2 bits?) */
-                rhc->n_not_alive_no_writers--;
-              }
-              drop_instance_noupdate_no_writers (rhc, inst);
-            }
-          }
-
-          if (n > n_first)
-            patch_generations (info_seq + n_first, n - n_first - 1);
-        }
-        if (iid == handle)
-        {
-          break;
-        }
-      }
+      n += take_w_qminv_inst (rhc, inst, values + n, info_seq + n, max_samples - n, qminv, qcmask, &ntriggers, to_sample, to_invsample);
       inst = inst1;
     }
   }
   TRACE ("take: returning %"PRIu32"\n", n);
   assert (rhc_check_counts_locked (rhc, true, false));
+
+  // FIXME: conditional "lock" plus unconditional "unlock" is inexcusably bad design
+  // It appears to have been introduced at some point so another language binding could lock
+  // the RHC using dds_rhc_default_lock_samples to find out the number of samples present,
+  // then allocate stuff and call read/take with lock=true. All that needs fixing.
   ddsrt_mutex_unlock (&rhc->lock);
-  assert (n <= INT_MAX);
-  return (int)n;
+  return n;
 }
 
-static int dds_rhc_takecdr_w_qminv (struct dds_rhc_default *rhc, bool lock, struct ddsi_serdata ** values, dds_sample_info_t *info_seq, uint32_t max_samples, unsigned qminv, dds_instance_handle_t handle, dds_readcond *cond)
+static int32_t dds_rhc_read_w_qminv (struct dds_rhc_default *rhc, bool lock, void **values, dds_sample_info_t *info_seq, uint32_t max_samples, uint32_t qminv, dds_instance_handle_t handle, dds_readcond *cond)
 {
-  uint64_t iid;
-  uint32_t n = 0;
-  (void)cond;
+  assert (max_samples <= INT32_MAX);
+  return read_w_qminv (rhc, lock, values, info_seq, (int32_t) max_samples, qminv, handle, cond, read_take_to_sample, read_take_to_invsample);
+}
 
-  if (lock)
-  {
-    ddsrt_mutex_lock (&rhc->lock);
-  }
+static int32_t dds_rhc_take_w_qminv (struct dds_rhc_default *rhc, bool lock, void **values, dds_sample_info_t *info_seq, uint32_t max_samples, uint32_t qminv, dds_instance_handle_t handle, dds_readcond *cond)
+{
+  assert (max_samples <= INT32_MAX);
+  return take_w_qminv (rhc, lock, values, info_seq, (int32_t) max_samples, qminv, handle, cond, read_take_to_sample, read_take_to_invsample);
+}
 
-  TRACE ("take_w_qminv(%p,%p,%p,%"PRIu32",%x) - inst %"PRIu32" nonempty %"PRIu32" disp %"PRIu32" nowr %"PRIu32" new %"PRIu32" samples %"PRIu32"+%"PRIu32" read %"PRIu32"+%"PRIu32"\n",
-          (void*) rhc, (void*) values, (void*) info_seq, max_samples, qminv,
-          rhc->n_instances, rhc->n_nonempty_instances, rhc->n_not_alive_disposed,
-          rhc->n_not_alive_no_writers, rhc->n_new, rhc->n_vsamples,
-          rhc->n_invsamples, rhc->n_vread, rhc->n_invread);
-
-  if (!ddsrt_circlist_isempty (&rhc->nonempty_instances))
-  {
-    const dds_querycond_mask_t qcmask = (cond && cond->m_query.m_filter) ? cond->m_query.m_qcmask : 0;
-    struct rhc_instance *inst = oldest_nonempty_instance (rhc);
-    unsigned n_insts = rhc->n_nonempty_instances;
-    while (n_insts-- > 0 && n < max_samples)
-    {
-      struct rhc_instance * const inst1 = next_nonempty_instance (inst);
-      iid = inst->iid;
-      if (handle == DDS_HANDLE_NIL || iid == handle)
-      {
-        if (!inst_is_empty (inst) && (qmask_of_inst (inst) & qminv) == 0)
-        {
-          struct trigger_info_pre pre;
-          struct trigger_info_post post;
-          struct trigger_info_qcond trig_qc;
-          unsigned nvsamples = inst->nvsamples;
-          const uint32_t n_first = n;
-          get_trigger_info_pre (&pre, inst);
-          init_trigger_info_qcond (&trig_qc);
-
-          if (inst->latest)
-          {
-            struct rhc_sample *psample = inst->latest;
-            struct rhc_sample *sample = psample->next;
-            while (nvsamples--)
-            {
-              struct rhc_sample * const sample1 = sample->next;
-
-              if ((qmask_of_sample (sample) & qminv) != 0 || (qcmask && !(sample->conds & qcmask)))
-              {
-                psample = sample;
-              }
-              else
-              {
-                take_sample_update_conditions (rhc, &pre, &post, &trig_qc, inst, sample->conds, sample->isread);
-                set_sample_info (info_seq + n, inst, sample);
-                values[n] = ddsi_serdata_ref(sample->sample);
-                rhc->n_vsamples--;
-                if (sample->isread)
-                {
-                  inst->nvread--;
-                  rhc->n_vread--;
-                }
-
-                if (--inst->nvsamples > 0)
-                  psample->next = sample1;
-                else
-                  inst->latest = NULL;
-
-                free_sample (rhc, inst, sample);
-
-                if (++n == max_samples)
-                {
-                  break;
-                }
-              }
-              sample = sample1;
-            }
-          }
-
-          if (inst->inv_exists && n < max_samples && (qmask_of_invsample (inst) & qminv) == 0 && (qcmask == 0 || (inst->conds & qcmask) != 0))
-          {
-            struct trigger_info_qcond dummy_trig_qc;
-#ifndef NDEBUG
-            init_trigger_info_qcond (&dummy_trig_qc);
-#endif
-            take_sample_update_conditions (rhc, &pre, &post, &trig_qc, inst, inst->conds, inst->inv_isread);
-            set_sample_info_invsample (info_seq + n, inst);
-            values[n] = ddsi_serdata_ref(inst->tk->m_sample);
-            inst_clear_invsample (rhc, inst, &dummy_trig_qc);
-            ++n;
-          }
-
-          if (n > n_first && inst->isnew)
-          {
-            inst->isnew = 0;
-            rhc->n_new--;
-          }
-
-          if (n > n_first)
-          {
-            /* if nsamples = 0, it won't match anything, so no need to do
-             anything here for drop_instance_noupdate_no_writers */
-            size_t ntriggers = SIZE_MAX;
-            get_trigger_info_cmn (&post.c, inst);
-            update_conditions_locked (rhc, false, &pre, &post, &trig_qc, inst, NULL, &ntriggers);
-          }
-
-          if (inst_is_empty (inst))
-          {
-            remove_inst_from_nonempty_list (rhc, inst);
-
-            if (inst->isdisposed)
-            {
-              rhc->n_not_alive_disposed--;
-            }
-            if (inst->wrcount == 0)
-            {
-              TRACE ("take: iid %"PRIx64" #0,empty,drop\n", iid);
-              if (!inst->isdisposed)
-              {
-                /* disposed has priority over no writers (why not just 2 bits?) */
-                rhc->n_not_alive_no_writers--;
-              }
-              drop_instance_noupdate_no_writers (rhc, inst);
-            }
-          }
-
-          if (n > n_first)
-            patch_generations (info_seq + n_first, n - n_first - 1);
-        }
-        if (iid == handle)
-        {
-          break;
-        }
-      }
-      inst = inst1;
-    }
-  }
-  TRACE ("take: returning %"PRIu32"\n", n);
-  assert (rhc_check_counts_locked (rhc, true, false));
-  ddsrt_mutex_unlock (&rhc->lock);
-  assert (n <= INT_MAX);
-  return (int)n;
+static int32_t dds_rhc_takecdr_w_qminv (struct dds_rhc_default *rhc, bool lock, struct ddsi_serdata **values, dds_sample_info_t *info_seq, uint32_t max_samples, uint32_t qminv, dds_instance_handle_t handle, dds_readcond *cond)
+{
+  DDSRT_STATIC_ASSERT (sizeof (void *) == sizeof (struct ddsi_serdata *));
+  assert (max_samples <= INT32_MAX);
+  return take_w_qminv (rhc, lock, (void **) values, info_seq, (int32_t) max_samples, qminv, handle, cond, read_take_to_sample_ref, read_take_to_invsample_ref);
 }
 
 /*************************
@@ -2805,21 +2715,21 @@ static bool update_conditions_locked (struct dds_rhc_default *rhc, bool called_f
  ******  READ/TAKE  ******
  *************************/
 
-static int dds_rhc_default_read (struct dds_rhc_default *rhc, bool lock, void **values, dds_sample_info_t *info_seq, uint32_t max_samples, uint32_t mask, dds_instance_handle_t handle, dds_readcond *cond)
+static int32_t dds_rhc_default_read (struct dds_rhc_default *rhc, bool lock, void **values, dds_sample_info_t *info_seq, uint32_t max_samples, uint32_t mask, dds_instance_handle_t handle, dds_readcond *cond)
 {
-    unsigned qminv = qmask_from_mask_n_cond (mask, cond);
-    return dds_rhc_read_w_qminv (rhc, lock, values, info_seq, max_samples, qminv, handle, cond);
+  uint32_t qminv = qmask_from_mask_n_cond (mask, cond);
+  return dds_rhc_read_w_qminv (rhc, lock, values, info_seq, max_samples, qminv, handle, cond);
 }
 
-static int dds_rhc_default_take (struct dds_rhc_default *rhc, bool lock, void **values, dds_sample_info_t *info_seq, uint32_t max_samples, uint32_t mask, dds_instance_handle_t handle, dds_readcond *cond)
+static int32_t dds_rhc_default_take (struct dds_rhc_default *rhc, bool lock, void **values, dds_sample_info_t *info_seq, uint32_t max_samples, uint32_t mask, dds_instance_handle_t handle, dds_readcond *cond)
 {
-    unsigned qminv = qmask_from_mask_n_cond(mask, cond);
-    return dds_rhc_take_w_qminv (rhc, lock, values, info_seq, max_samples, qminv, handle, cond);
+  uint32_t qminv = qmask_from_mask_n_cond(mask, cond);
+  return dds_rhc_take_w_qminv (rhc, lock, values, info_seq, max_samples, qminv, handle, cond);
 }
 
-static int dds_rhc_default_takecdr (struct dds_rhc_default *rhc, bool lock, struct ddsi_serdata ** values, dds_sample_info_t *info_seq, uint32_t max_samples, uint32_t sample_states, uint32_t view_states, uint32_t instance_states, dds_instance_handle_t handle)
+static int32_t dds_rhc_default_takecdr (struct dds_rhc_default *rhc, bool lock, struct ddsi_serdata ** values, dds_sample_info_t *info_seq, uint32_t max_samples, uint32_t sample_states, uint32_t view_states, uint32_t instance_states, dds_instance_handle_t handle)
 {
-  unsigned qminv = qmask_from_dcpsquery (sample_states, view_states, instance_states);
+  uint32_t qminv = qmask_from_dcpsquery (sample_states, view_states, instance_states);
   return dds_rhc_takecdr_w_qminv (rhc, lock, values, info_seq, max_samples, qminv, handle, NULL);
 }
 
@@ -2835,11 +2745,11 @@ static int rhc_check_counts_locked (struct dds_rhc_default *rhc, bool check_cond
     return 1;
 
   const uint32_t ncheck = rhc->nconds < CHECK_MAX_CONDS ? rhc->nconds : CHECK_MAX_CONDS;
-  unsigned n_instances = 0, n_nonempty_instances = 0;
-  unsigned n_not_alive_disposed = 0, n_not_alive_no_writers = 0, n_new = 0;
-  unsigned n_vsamples = 0, n_vread = 0;
-  unsigned n_invsamples = 0, n_invread = 0;
-  unsigned cond_match_count[CHECK_MAX_CONDS];
+  uint32_t n_instances = 0, n_nonempty_instances = 0;
+  uint32_t n_not_alive_disposed = 0, n_not_alive_no_writers = 0, n_new = 0;
+  uint32_t n_vsamples = 0, n_vread = 0;
+  uint32_t n_invsamples = 0, n_invread = 0;
+  uint32_t cond_match_count[CHECK_MAX_CONDS];
   dds_querycond_mask_t enabled_qcmask = 0;
   struct rhc_instance *inst;
   struct ddsrt_hh_iter iter;
@@ -2860,7 +2770,7 @@ static int rhc_check_counts_locked (struct dds_rhc_default *rhc, bool check_cond
 
   for (inst = ddsrt_hh_iter_first (rhc->instances, &iter); inst; inst = ddsrt_hh_iter_next (&iter))
   {
-    unsigned n_vsamples_in_instance = 0, n_read_vsamples_in_instance = 0;
+    uint32_t n_vsamples_in_instance = 0, n_read_vsamples_in_instance = 0;
     bool a_sample_free = true;
 
     n_instances++;

From 0006e09566c8050be22b258335d48c4cc4e59b7c Mon Sep 17 00:00:00 2001
From: Erik Boasson <eb@ilities.com>
Date: Sun, 19 Apr 2020 17:38:25 +0200
Subject: [PATCH 199/238] Add a dds_readcdr analogous to dds_takecdr

Signed-off-by: Erik Boasson <eb@ilities.com>
---
 src/core/ddsc/include/dds/dds.h          | 47 ++++++++++++++++++++++++
 src/core/ddsc/include/dds/ddsc/dds_rhc.h |  4 ++
 src/core/ddsc/src/dds_read.c             | 18 ++++++++-
 src/core/ddsc/src/dds_rhc.c              |  1 +
 src/core/ddsc/src/dds_rhc_default.c      | 18 +++++++++
 5 files changed, 87 insertions(+), 1 deletion(-)

diff --git a/src/core/ddsc/include/dds/dds.h b/src/core/ddsc/include/dds/dds.h
index e62be5e..8383b06 100644
--- a/src/core/ddsc/include/dds/dds.h
+++ b/src/core/ddsc/include/dds/dds.h
@@ -2756,6 +2756,53 @@ dds_take_mask_wl(
   uint32_t maxs,
   uint32_t mask);
 
+#define DDS_HAS_READCDR 1
+/**
+ * @brief Access the collection of serialized data values (of same type) and
+ *        sample info from the data reader, readcondition or querycondition.
+ *
+ * This call accesses the serialized data from the data reader, readcondition or
+ * querycondition and makes it available to the application. The serialized data
+ * is made available through \ref ddsi_serdata structures. Returned samples are
+ * marked as READ.
+ *
+ * Return value provides information about the number of samples read, which will
+ * be <= maxs. Based on the count, the buffer will contain serialized data to be
+ * read only when valid_data bit in sample info structure is set.
+ * The buffer required for data values, could be allocated explicitly or can
+ * use the memory from data reader to prevent copy. In the latter case, buffer and
+ * sample_info should be returned back, once it is no longer using the data.
+ *
+ * @param[in]  reader_or_condition Reader, readcondition or querycondition entity.
+ * @param[out] buf An array of pointers to \ref ddsi_serdata structures that contain
+ *                 the serialized data. The pointers can be NULL.
+ * @param[in]  maxs Maximum number of samples to read.
+ * @param[out] si Pointer to an array of \ref dds_sample_info_t returned for each data value.
+ * @param[in]  mask Filter the data based on dds_sample_state_t|dds_view_state_t|dds_instance_state_t.
+ *
+ * @returns A dds_return_t with the number of samples read or an error code.
+ *
+ * @retval >=0
+ *             Number of samples read.
+ * @retval DDS_RETCODE_ERROR
+ *             An internal error has occurred.
+ * @retval DDS_RETCODE_BAD_PARAMETER
+ *             One of the given arguments is not valid.
+ * @retval DDS_RETCODE_ILLEGAL_OPERATION
+ *             The operation is invoked on an inappropriate object.
+ * @retval DDS_RETCODE_ALREADY_DELETED
+ *             The entity has already been deleted.
+ * @retval DDS_RETCODE_PRECONDITION_NOT_MET
+ *             The precondition for this operation is not met.
+ */
+DDS_EXPORT dds_return_t
+dds_readcdr(
+  dds_entity_t reader_or_condition,
+  struct ddsi_serdata **buf,
+  uint32_t maxs,
+  dds_sample_info_t *si,
+  uint32_t mask);
+
 /**
  * @brief Access the collection of serialized data values (of same type) and
  *        sample info from the data reader, readcondition or querycondition.
diff --git a/src/core/ddsc/include/dds/ddsc/dds_rhc.h b/src/core/ddsc/include/dds/ddsc/dds_rhc.h
index b5cba34..e3bf4d6 100644
--- a/src/core/ddsc/include/dds/ddsc/dds_rhc.h
+++ b/src/core/ddsc/include/dds/ddsc/dds_rhc.h
@@ -41,6 +41,7 @@ struct dds_rhc_ops {
   struct ddsi_rhc_ops rhc_ops;
   dds_rhc_read_take_t read;
   dds_rhc_read_take_t take;
+  dds_rhc_read_take_cdr_t readcdr;
   dds_rhc_read_take_cdr_t takecdr;
   dds_rhc_add_readcondition_t add_readcondition;
   dds_rhc_remove_readcondition_t remove_readcondition;
@@ -81,6 +82,9 @@ DDS_EXPORT inline int32_t dds_rhc_read (struct dds_rhc *rhc, bool lock, void **v
 DDS_EXPORT inline int32_t dds_rhc_take (struct dds_rhc *rhc, bool lock, void **values, dds_sample_info_t *info_seq, uint32_t max_samples, uint32_t mask, dds_instance_handle_t handle, struct dds_readcond *cond) {
   return rhc->common.ops->take (rhc, lock, values, info_seq, max_samples, mask, handle, cond);
 }
+DDS_EXPORT inline int32_t dds_rhc_readcdr (struct dds_rhc *rhc, bool lock, struct ddsi_serdata **values, dds_sample_info_t *info_seq, uint32_t max_samples, uint32_t sample_states, uint32_t view_states, uint32_t instance_states, dds_instance_handle_t handle) {
+  return rhc->common.ops->readcdr (rhc, lock, values, info_seq, max_samples, sample_states, view_states, instance_states, handle);
+}
 DDS_EXPORT inline int32_t dds_rhc_takecdr (struct dds_rhc *rhc, bool lock, struct ddsi_serdata **values, dds_sample_info_t *info_seq, uint32_t max_samples, uint32_t sample_states, uint32_t view_states, uint32_t instance_states, dds_instance_handle_t handle) {
   return rhc->common.ops->takecdr (rhc, lock, values, info_seq, max_samples, sample_states, view_states, instance_states, handle);
 }
diff --git a/src/core/ddsc/src/dds_read.c b/src/core/ddsc/src/dds_read.c
index fd9ae5b..a5c932d 100644
--- a/src/core/ddsc/src/dds_read.c
+++ b/src/core/ddsc/src/dds_read.c
@@ -171,7 +171,11 @@ static dds_return_t dds_readcdr_impl (bool take, dds_entity_t reader_or_conditio
   assert (dds_entity_kind (rd->m_entity.m_parent) == DDS_KIND_SUBSCRIBER);
   dds_entity_status_reset (rd->m_entity.m_parent, DDS_DATA_ON_READERS_STATUS);
 
-  ret = dds_rhc_takecdr (rd->m_rhc, lock, buf, si, maxs, mask & DDS_ANY_SAMPLE_STATE, mask & DDS_ANY_VIEW_STATE, mask & DDS_ANY_INSTANCE_STATE, hand);
+  if (take)
+    ret = dds_rhc_takecdr (rd->m_rhc, lock, buf, si, maxs, mask & DDS_ANY_SAMPLE_STATE, mask & DDS_ANY_VIEW_STATE, mask & DDS_ANY_INSTANCE_STATE, hand);
+  else
+    ret = dds_rhc_readcdr (rd->m_rhc, lock, buf, si, maxs, mask & DDS_ANY_SAMPLE_STATE, mask & DDS_ANY_VIEW_STATE, mask & DDS_ANY_INSTANCE_STATE, hand);
+
   dds_entity_unpin (entity);
   thread_state_asleep (ts1);
   return ret;
@@ -225,6 +229,18 @@ dds_return_t dds_read_mask_wl (dds_entity_t rd_or_cnd, void **buf, dds_sample_in
   return dds_read_impl (false, rd_or_cnd, buf, maxs, maxs, si, mask, DDS_HANDLE_NIL, lock, false);
 }
 
+dds_return_t dds_readcdr (dds_entity_t rd_or_cnd, struct ddsi_serdata **buf, uint32_t maxs, dds_sample_info_t *si, uint32_t mask)
+{
+  bool lock = true;
+  if (maxs == DDS_READ_WITHOUT_LOCK)
+  {
+    lock = false;
+    /* FIXME: Fix the interface. */
+    maxs = 100;
+  }
+  return dds_readcdr_impl (false, rd_or_cnd, buf, maxs, si, mask, DDS_HANDLE_NIL, lock);
+}
+
 dds_return_t dds_read_instance (dds_entity_t rd_or_cnd, void **buf, dds_sample_info_t *si, size_t bufsz, uint32_t maxs, dds_instance_handle_t handle)
 {
   bool lock = true;
diff --git a/src/core/ddsc/src/dds_rhc.c b/src/core/ddsc/src/dds_rhc.c
index f159422..7db2ff0 100644
--- a/src/core/ddsc/src/dds_rhc.c
+++ b/src/core/ddsc/src/dds_rhc.c
@@ -22,6 +22,7 @@ extern inline void dds_rhc_set_qos (struct dds_rhc *rhc, const struct dds_qos *q
 extern inline void dds_rhc_free (struct dds_rhc *rhc);
 extern inline int dds_rhc_read (struct dds_rhc *rhc, bool lock, void **values, dds_sample_info_t *info_seq, uint32_t max_samples, uint32_t mask, dds_instance_handle_t handle, struct dds_readcond *cond);
 extern inline int dds_rhc_take (struct dds_rhc *rhc, bool lock, void **values, dds_sample_info_t *info_seq, uint32_t max_samples, uint32_t mask, dds_instance_handle_t handle, struct dds_readcond *cond);
+extern inline int dds_rhc_readcdr (struct dds_rhc *rhc, bool lock, struct ddsi_serdata **values, dds_sample_info_t *info_seq, uint32_t max_samples, uint32_t sample_states, uint32_t view_states, uint32_t instance_states, dds_instance_handle_t handle);
 extern inline int dds_rhc_takecdr (struct dds_rhc *rhc, bool lock, struct ddsi_serdata **values, dds_sample_info_t *info_seq, uint32_t max_samples, uint32_t sample_states, uint32_t view_states, uint32_t instance_states, dds_instance_handle_t handle);
 extern inline bool dds_rhc_add_readcondition (struct dds_rhc *rhc, struct dds_readcond *cond);
 extern inline void dds_rhc_remove_readcondition (struct dds_rhc *rhc, struct dds_readcond *cond);
diff --git a/src/core/ddsc/src/dds_rhc_default.c b/src/core/ddsc/src/dds_rhc_default.c
index 07692e7..d5754f3 100644
--- a/src/core/ddsc/src/dds_rhc_default.c
+++ b/src/core/ddsc/src/dds_rhc_default.c
@@ -370,6 +370,7 @@ static void dds_rhc_default_relinquish_ownership (struct dds_rhc_default * __res
 static void dds_rhc_default_set_qos (struct dds_rhc_default *rhc, const struct dds_qos *qos);
 static int32_t dds_rhc_default_read (struct dds_rhc_default *rhc, bool lock, void **values, dds_sample_info_t *info_seq, uint32_t max_samples, uint32_t mask, dds_instance_handle_t handle, dds_readcond *cond);
 static int32_t dds_rhc_default_take (struct dds_rhc_default *rhc, bool lock, void **values, dds_sample_info_t *info_seq, uint32_t max_samples, uint32_t mask, dds_instance_handle_t handle, dds_readcond *cond);
+static int32_t dds_rhc_default_readcdr (struct dds_rhc_default *rhc, bool lock, struct ddsi_serdata ** values, dds_sample_info_t *info_seq, uint32_t max_samples, uint32_t sample_states, uint32_t view_states, uint32_t instance_states, dds_instance_handle_t handle);
 static int32_t dds_rhc_default_takecdr (struct dds_rhc_default *rhc, bool lock, struct ddsi_serdata ** values, dds_sample_info_t *info_seq, uint32_t max_samples, uint32_t sample_states, uint32_t view_states, uint32_t instance_states, dds_instance_handle_t handle);
 static bool dds_rhc_default_add_readcondition (struct dds_rhc_default *rhc, dds_readcond *cond);
 static void dds_rhc_default_remove_readcondition (struct dds_rhc_default *rhc, dds_readcond *cond);
@@ -396,6 +397,9 @@ static int32_t dds_rhc_default_read_wrap (struct dds_rhc *rhc, bool lock, void *
 static int32_t dds_rhc_default_take_wrap (struct dds_rhc *rhc, bool lock, void **values, dds_sample_info_t *info_seq, uint32_t max_samples, uint32_t mask, dds_instance_handle_t handle, dds_readcond *cond) {
   return dds_rhc_default_take ((struct dds_rhc_default *) rhc, lock, values, info_seq, max_samples, mask, handle, cond);
 }
+static int32_t dds_rhc_default_readcdr_wrap (struct dds_rhc *rhc, bool lock, struct ddsi_serdata **values, dds_sample_info_t *info_seq, uint32_t max_samples, uint32_t sample_states, uint32_t view_states, uint32_t instance_states, dds_instance_handle_t handle) {
+  return dds_rhc_default_readcdr ((struct dds_rhc_default *) rhc, lock, values, info_seq, max_samples, sample_states, view_states, instance_states, handle);
+}
 static int32_t dds_rhc_default_takecdr_wrap (struct dds_rhc *rhc, bool lock, struct ddsi_serdata **values, dds_sample_info_t *info_seq, uint32_t max_samples, uint32_t sample_states, uint32_t view_states, uint32_t instance_states, dds_instance_handle_t handle) {
   return dds_rhc_default_takecdr ((struct dds_rhc_default *) rhc, lock, values, info_seq, max_samples, sample_states, view_states, instance_states, handle);
 }
@@ -425,6 +429,7 @@ static const struct dds_rhc_ops dds_rhc_default_ops = {
   },
   .read = dds_rhc_default_read_wrap,
   .take = dds_rhc_default_take_wrap,
+  .readcdr = dds_rhc_default_readcdr_wrap,
   .takecdr = dds_rhc_default_takecdr_wrap,
   .add_readcondition = dds_rhc_default_add_readcondition_wrap,
   .remove_readcondition = dds_rhc_default_remove_readcondition_wrap,
@@ -2331,6 +2336,13 @@ static int32_t dds_rhc_take_w_qminv (struct dds_rhc_default *rhc, bool lock, voi
   return take_w_qminv (rhc, lock, values, info_seq, (int32_t) max_samples, qminv, handle, cond, read_take_to_sample, read_take_to_invsample);
 }
 
+static int32_t dds_rhc_readcdr_w_qminv (struct dds_rhc_default *rhc, bool lock, struct ddsi_serdata **values, dds_sample_info_t *info_seq, uint32_t max_samples, uint32_t qminv, dds_instance_handle_t handle, dds_readcond *cond)
+{
+  DDSRT_STATIC_ASSERT (sizeof (void *) == sizeof (struct ddsi_serdata *));
+  assert (max_samples <= INT32_MAX);
+  return read_w_qminv (rhc, lock, (void **) values, info_seq, (int32_t) max_samples, qminv, handle, cond, read_take_to_sample_ref, read_take_to_invsample_ref);
+}
+
 static int32_t dds_rhc_takecdr_w_qminv (struct dds_rhc_default *rhc, bool lock, struct ddsi_serdata **values, dds_sample_info_t *info_seq, uint32_t max_samples, uint32_t qminv, dds_instance_handle_t handle, dds_readcond *cond)
 {
   DDSRT_STATIC_ASSERT (sizeof (void *) == sizeof (struct ddsi_serdata *));
@@ -2727,6 +2739,12 @@ static int32_t dds_rhc_default_take (struct dds_rhc_default *rhc, bool lock, voi
   return dds_rhc_take_w_qminv (rhc, lock, values, info_seq, max_samples, qminv, handle, cond);
 }
 
+static int32_t dds_rhc_default_readcdr (struct dds_rhc_default *rhc, bool lock, struct ddsi_serdata ** values, dds_sample_info_t *info_seq, uint32_t max_samples, uint32_t sample_states, uint32_t view_states, uint32_t instance_states, dds_instance_handle_t handle)
+{
+  uint32_t qminv = qmask_from_dcpsquery (sample_states, view_states, instance_states);
+  return dds_rhc_readcdr_w_qminv (rhc, lock, values, info_seq, max_samples, qminv, handle, NULL);
+}
+
 static int32_t dds_rhc_default_takecdr (struct dds_rhc_default *rhc, bool lock, struct ddsi_serdata ** values, dds_sample_info_t *info_seq, uint32_t max_samples, uint32_t sample_states, uint32_t view_states, uint32_t instance_states, dds_instance_handle_t handle)
 {
   uint32_t qminv = qmask_from_dcpsquery (sample_states, view_states, instance_states);

From 8b934a7dddb9a10b2d95228286b366edab8357d7 Mon Sep 17 00:00:00 2001
From: Erik Boasson <eb@ilities.com>
Date: Mon, 20 Apr 2020 11:10:54 +0200
Subject: [PATCH 200/238] Remove a layer of wrapper functions in default RHC

Signed-off-by: Erik Boasson <eb@ilities.com>
---
 src/core/ddsc/src/dds_rhc_default.c | 135 +++++++++++-----------------
 1 file changed, 50 insertions(+), 85 deletions(-)

diff --git a/src/core/ddsc/src/dds_rhc_default.c b/src/core/ddsc/src/dds_rhc_default.c
index d5754f3..a4c774c 100644
--- a/src/core/ddsc/src/dds_rhc_default.c
+++ b/src/core/ddsc/src/dds_rhc_default.c
@@ -363,79 +363,7 @@ struct trigger_info_post {
   struct trigger_info_cmn c;
 };
 
-static void dds_rhc_default_free (struct dds_rhc_default *rhc);
-static bool dds_rhc_default_store (struct dds_rhc_default * __restrict rhc, const struct ddsi_writer_info * __restrict wrinfo, struct ddsi_serdata * __restrict sample, struct ddsi_tkmap_instance * __restrict tk);
-static void dds_rhc_default_unregister_wr (struct dds_rhc_default * __restrict rhc, const struct ddsi_writer_info * __restrict wrinfo);
-static void dds_rhc_default_relinquish_ownership (struct dds_rhc_default * __restrict rhc, const uint64_t wr_iid);
-static void dds_rhc_default_set_qos (struct dds_rhc_default *rhc, const struct dds_qos *qos);
-static int32_t dds_rhc_default_read (struct dds_rhc_default *rhc, bool lock, void **values, dds_sample_info_t *info_seq, uint32_t max_samples, uint32_t mask, dds_instance_handle_t handle, dds_readcond *cond);
-static int32_t dds_rhc_default_take (struct dds_rhc_default *rhc, bool lock, void **values, dds_sample_info_t *info_seq, uint32_t max_samples, uint32_t mask, dds_instance_handle_t handle, dds_readcond *cond);
-static int32_t dds_rhc_default_readcdr (struct dds_rhc_default *rhc, bool lock, struct ddsi_serdata ** values, dds_sample_info_t *info_seq, uint32_t max_samples, uint32_t sample_states, uint32_t view_states, uint32_t instance_states, dds_instance_handle_t handle);
-static int32_t dds_rhc_default_takecdr (struct dds_rhc_default *rhc, bool lock, struct ddsi_serdata ** values, dds_sample_info_t *info_seq, uint32_t max_samples, uint32_t sample_states, uint32_t view_states, uint32_t instance_states, dds_instance_handle_t handle);
-static bool dds_rhc_default_add_readcondition (struct dds_rhc_default *rhc, dds_readcond *cond);
-static void dds_rhc_default_remove_readcondition (struct dds_rhc_default *rhc, dds_readcond *cond);
-static uint32_t dds_rhc_default_lock_samples (struct dds_rhc_default *rhc);
-
-static void dds_rhc_default_free_wrap (struct ddsi_rhc *rhc) {
-  dds_rhc_default_free ((struct dds_rhc_default *) rhc);
-}
-static bool dds_rhc_default_store_wrap (struct ddsi_rhc * __restrict rhc, const struct ddsi_writer_info * __restrict wrinfo, struct ddsi_serdata * __restrict sample, struct ddsi_tkmap_instance * __restrict tk) {
-  return dds_rhc_default_store ((struct dds_rhc_default *) rhc, wrinfo, sample, tk);
-}
-static void dds_rhc_default_unregister_wr_wrap (struct ddsi_rhc * __restrict rhc, const struct ddsi_writer_info * __restrict wrinfo) {
-  dds_rhc_default_unregister_wr ((struct dds_rhc_default *) rhc, wrinfo);
-}
-static void dds_rhc_default_relinquish_ownership_wrap (struct ddsi_rhc * __restrict rhc, const uint64_t wr_iid) {
-  dds_rhc_default_relinquish_ownership ((struct dds_rhc_default *) rhc, wr_iid);
-}
-static void dds_rhc_default_set_qos_wrap (struct ddsi_rhc *rhc, const struct dds_qos *qos) {
-  dds_rhc_default_set_qos ((struct dds_rhc_default *) rhc, qos);
-}
-static int32_t dds_rhc_default_read_wrap (struct dds_rhc *rhc, bool lock, void **values, dds_sample_info_t *info_seq, uint32_t max_samples, uint32_t mask, dds_instance_handle_t handle, dds_readcond *cond) {
-  return dds_rhc_default_read ((struct dds_rhc_default *) rhc, lock, values, info_seq, max_samples, mask, handle, cond);
-}
-static int32_t dds_rhc_default_take_wrap (struct dds_rhc *rhc, bool lock, void **values, dds_sample_info_t *info_seq, uint32_t max_samples, uint32_t mask, dds_instance_handle_t handle, dds_readcond *cond) {
-  return dds_rhc_default_take ((struct dds_rhc_default *) rhc, lock, values, info_seq, max_samples, mask, handle, cond);
-}
-static int32_t dds_rhc_default_readcdr_wrap (struct dds_rhc *rhc, bool lock, struct ddsi_serdata **values, dds_sample_info_t *info_seq, uint32_t max_samples, uint32_t sample_states, uint32_t view_states, uint32_t instance_states, dds_instance_handle_t handle) {
-  return dds_rhc_default_readcdr ((struct dds_rhc_default *) rhc, lock, values, info_seq, max_samples, sample_states, view_states, instance_states, handle);
-}
-static int32_t dds_rhc_default_takecdr_wrap (struct dds_rhc *rhc, bool lock, struct ddsi_serdata **values, dds_sample_info_t *info_seq, uint32_t max_samples, uint32_t sample_states, uint32_t view_states, uint32_t instance_states, dds_instance_handle_t handle) {
-  return dds_rhc_default_takecdr ((struct dds_rhc_default *) rhc, lock, values, info_seq, max_samples, sample_states, view_states, instance_states, handle);
-}
-static bool dds_rhc_default_add_readcondition_wrap (struct dds_rhc *rhc, dds_readcond *cond) {
-  return dds_rhc_default_add_readcondition ((struct dds_rhc_default *) rhc, cond);
-}
-static void dds_rhc_default_remove_readcondition_wrap (struct dds_rhc *rhc, dds_readcond *cond) {
-  dds_rhc_default_remove_readcondition ((struct dds_rhc_default *) rhc, cond);
-}
-static uint32_t dds_rhc_default_lock_samples_wrap (struct dds_rhc *rhc) {
-  return dds_rhc_default_lock_samples ((struct dds_rhc_default *) rhc);
-}
-static dds_return_t dds_rhc_default_associate (struct dds_rhc *rhc, dds_reader *reader, const struct ddsi_sertopic *topic, struct ddsi_tkmap *tkmap)
-{
-  /* ignored out of laziness */
-  (void) rhc; (void) reader; (void) topic; (void) tkmap;
-  return DDS_RETCODE_OK;
-}
-
-static const struct dds_rhc_ops dds_rhc_default_ops = {
-  .rhc_ops = {
-    .store = dds_rhc_default_store_wrap,
-    .unregister_wr = dds_rhc_default_unregister_wr_wrap,
-    .relinquish_ownership = dds_rhc_default_relinquish_ownership_wrap,
-    .set_qos = dds_rhc_default_set_qos_wrap,
-    .free = dds_rhc_default_free_wrap
-  },
-  .read = dds_rhc_default_read_wrap,
-  .take = dds_rhc_default_take_wrap,
-  .readcdr = dds_rhc_default_readcdr_wrap,
-  .takecdr = dds_rhc_default_takecdr_wrap,
-  .add_readcondition = dds_rhc_default_add_readcondition_wrap,
-  .remove_readcondition = dds_rhc_default_remove_readcondition_wrap,
-  .lock_samples = dds_rhc_default_lock_samples_wrap,
-  .associate = dds_rhc_default_associate
-};
+static const struct dds_rhc_ops dds_rhc_default_ops;
 
 static uint32_t qmask_of_sample (const struct rhc_sample *s)
 {
@@ -675,8 +603,16 @@ struct dds_rhc *dds_rhc_default_new (dds_reader *reader, const struct ddsi_serto
   return dds_rhc_default_new_xchecks (reader, &reader->m_entity.m_domain->gv, topic, (reader->m_entity.m_domain->gv.config.enabled_xchecks & DDS_XCHECK_RHC) != 0);
 }
 
-static void dds_rhc_default_set_qos (struct dds_rhc_default * rhc, const dds_qos_t * qos)
+static dds_return_t dds_rhc_default_associate (struct dds_rhc *rhc, dds_reader *reader, const struct ddsi_sertopic *topic, struct ddsi_tkmap *tkmap)
 {
+  /* ignored out of laziness */
+  (void) rhc; (void) reader; (void) topic; (void) tkmap;
+  return DDS_RETCODE_OK;
+}
+
+static void dds_rhc_default_set_qos (struct ddsi_rhc *rhc_common, const dds_qos_t * qos)
+{
+  struct dds_rhc_default * const rhc = (struct dds_rhc_default *) rhc_common;
   /* Set read related QoS */
 
   rhc->max_samples = qos->resource_limits.max_samples;
@@ -822,8 +758,9 @@ static void free_instance_rhc_free (struct rhc_instance *inst, struct dds_rhc_de
   free_empty_instance(inst, rhc);
 }
 
-static uint32_t dds_rhc_default_lock_samples (struct dds_rhc_default *rhc)
+static uint32_t dds_rhc_default_lock_samples (struct dds_rhc *rhc_common)
 {
+  struct dds_rhc_default * const rhc = (struct dds_rhc_default *) rhc_common;
   uint32_t no;
   ddsrt_mutex_lock (&rhc->lock);
   no = rhc->n_vsamples + rhc->n_invsamples;
@@ -839,8 +776,9 @@ static void free_instance_rhc_free_wrap (void *vnode, void *varg)
   free_instance_rhc_free (vnode, varg);
 }
 
-static void dds_rhc_default_free (struct dds_rhc_default *rhc)
+static void dds_rhc_default_free (struct ddsi_rhc *rhc_common)
 {
+  struct dds_rhc_default *rhc = (struct dds_rhc_default *) rhc_common;
 #ifdef DDSI_INCLUDE_LIFESPAN
   dds_rhc_default_sample_expired_cb (rhc, DDSRT_MTIME_NEVER);
   lifespan_fini (&rhc->lifespan);
@@ -1464,8 +1402,9 @@ static rhc_store_result_t rhc_store_new_instance (struct rhc_instance **out_inst
   delivered (true unless a reliable sample rejected).
 */
 
-static bool dds_rhc_default_store (struct dds_rhc_default * __restrict rhc, const struct ddsi_writer_info * __restrict wrinfo, struct ddsi_serdata * __restrict sample, struct ddsi_tkmap_instance * __restrict tk)
+static bool dds_rhc_default_store (struct ddsi_rhc * __restrict rhc_common, const struct ddsi_writer_info * __restrict wrinfo, struct ddsi_serdata * __restrict sample, struct ddsi_tkmap_instance * __restrict tk)
 {
+  struct dds_rhc_default * const __restrict rhc = (struct dds_rhc_default * __restrict) rhc_common;
   const uint64_t wr_iid = wrinfo->iid;
   const uint32_t statusinfo = sample->statusinfo;
   const bool has_data = (sample->kind == SDK_DATA);
@@ -1740,7 +1679,7 @@ error_or_nochange:
   return delivered;
 }
 
-static void dds_rhc_default_unregister_wr (struct dds_rhc_default * __restrict rhc, const struct ddsi_writer_info * __restrict wrinfo)
+static void dds_rhc_default_unregister_wr (struct ddsi_rhc * __restrict rhc_common, const struct ddsi_writer_info * __restrict wrinfo)
 {
   /* Only to be called when writer with ID WR_IID has died.
 
@@ -1757,6 +1696,7 @@ static void dds_rhc_default_unregister_wr (struct dds_rhc_default * __restrict r
      need to get two IIDs: the one visible to the application in the
      built-in topics and in get_instance_handle, and one used internally
      for tracking registrations and unregistrations. */
+  struct dds_rhc_default * __restrict const rhc = (struct dds_rhc_default * __restrict) rhc_common;
   bool notify_data_available = false;
   struct rhc_instance *inst;
   struct ddsrt_hh_iter iter;
@@ -1825,8 +1765,9 @@ static void dds_rhc_default_unregister_wr (struct dds_rhc_default * __restrict r
   }
 }
 
-static void dds_rhc_default_relinquish_ownership (struct dds_rhc_default * __restrict rhc, const uint64_t wr_iid)
+static void dds_rhc_default_relinquish_ownership (struct ddsi_rhc * __restrict rhc_common, const uint64_t wr_iid)
 {
+  struct dds_rhc_default * __restrict const rhc = (struct dds_rhc_default * __restrict) rhc_common;
   struct rhc_instance *inst;
   struct ddsrt_hh_iter iter;
   ddsrt_mutex_lock (&rhc->lock);
@@ -2393,12 +2334,13 @@ static bool cond_is_sample_state_dependent (const struct dds_readcond *cond)
   }
 }
 
-static bool dds_rhc_default_add_readcondition (struct dds_rhc_default *rhc, dds_readcond *cond)
+static bool dds_rhc_default_add_readcondition (struct dds_rhc *rhc_common, dds_readcond *cond)
 {
   /* On the assumption that a readcondition will be attached to a
      waitset for nearly all of its life, we keep track of all
      readconditions on a reader in one set, without distinguishing
      between those attached to a waitset or not. */
+  struct dds_rhc_default * const rhc = (struct dds_rhc_default *) rhc_common;
   struct ddsrt_hh_iter it;
 
   assert ((dds_entity_kind (&cond->m_entity) == DDS_KIND_COND_READ && cond->m_query.m_filter == 0) ||
@@ -2498,8 +2440,9 @@ static bool dds_rhc_default_add_readcondition (struct dds_rhc_default *rhc, dds_
   return true;
 }
 
-static void dds_rhc_default_remove_readcondition (struct dds_rhc_default *rhc, dds_readcond *cond)
+static void dds_rhc_default_remove_readcondition (struct dds_rhc *rhc_common, dds_readcond *cond)
 {
+  struct dds_rhc_default * const rhc = (struct dds_rhc_default *) rhc_common;
   dds_readcond **ptr;
   ddsrt_mutex_lock (&rhc->lock);
   ptr = &rhc->conds;
@@ -2727,26 +2670,30 @@ static bool update_conditions_locked (struct dds_rhc_default *rhc, bool called_f
  ******  READ/TAKE  ******
  *************************/
 
-static int32_t dds_rhc_default_read (struct dds_rhc_default *rhc, bool lock, void **values, dds_sample_info_t *info_seq, uint32_t max_samples, uint32_t mask, dds_instance_handle_t handle, dds_readcond *cond)
+static int32_t dds_rhc_default_read (struct dds_rhc *rhc_common, bool lock, void **values, dds_sample_info_t *info_seq, uint32_t max_samples, uint32_t mask, dds_instance_handle_t handle, dds_readcond *cond)
 {
+  struct dds_rhc_default * const rhc = (struct dds_rhc_default *) rhc_common;
   uint32_t qminv = qmask_from_mask_n_cond (mask, cond);
   return dds_rhc_read_w_qminv (rhc, lock, values, info_seq, max_samples, qminv, handle, cond);
 }
 
-static int32_t dds_rhc_default_take (struct dds_rhc_default *rhc, bool lock, void **values, dds_sample_info_t *info_seq, uint32_t max_samples, uint32_t mask, dds_instance_handle_t handle, dds_readcond *cond)
+static int32_t dds_rhc_default_take (struct dds_rhc *rhc_common, bool lock, void **values, dds_sample_info_t *info_seq, uint32_t max_samples, uint32_t mask, dds_instance_handle_t handle, dds_readcond *cond)
 {
+  struct dds_rhc_default * const rhc = (struct dds_rhc_default *) rhc_common;
   uint32_t qminv = qmask_from_mask_n_cond(mask, cond);
   return dds_rhc_take_w_qminv (rhc, lock, values, info_seq, max_samples, qminv, handle, cond);
 }
 
-static int32_t dds_rhc_default_readcdr (struct dds_rhc_default *rhc, bool lock, struct ddsi_serdata ** values, dds_sample_info_t *info_seq, uint32_t max_samples, uint32_t sample_states, uint32_t view_states, uint32_t instance_states, dds_instance_handle_t handle)
+static int32_t dds_rhc_default_readcdr (struct dds_rhc *rhc_common, bool lock, struct ddsi_serdata ** values, dds_sample_info_t *info_seq, uint32_t max_samples, uint32_t sample_states, uint32_t view_states, uint32_t instance_states, dds_instance_handle_t handle)
 {
+  struct dds_rhc_default * const rhc = (struct dds_rhc_default *) rhc_common;
   uint32_t qminv = qmask_from_dcpsquery (sample_states, view_states, instance_states);
   return dds_rhc_readcdr_w_qminv (rhc, lock, values, info_seq, max_samples, qminv, handle, NULL);
 }
 
-static int32_t dds_rhc_default_takecdr (struct dds_rhc_default *rhc, bool lock, struct ddsi_serdata ** values, dds_sample_info_t *info_seq, uint32_t max_samples, uint32_t sample_states, uint32_t view_states, uint32_t instance_states, dds_instance_handle_t handle)
+static int32_t dds_rhc_default_takecdr (struct dds_rhc *rhc_common, bool lock, struct ddsi_serdata ** values, dds_sample_info_t *info_seq, uint32_t max_samples, uint32_t sample_states, uint32_t view_states, uint32_t instance_states, dds_instance_handle_t handle)
 {
+  struct dds_rhc_default * const rhc = (struct dds_rhc_default *) rhc_common;
   uint32_t qminv = qmask_from_dcpsquery (sample_states, view_states, instance_states);
   return dds_rhc_takecdr_w_qminv (rhc, lock, values, info_seq, max_samples, qminv, handle, NULL);
 }
@@ -2924,3 +2871,21 @@ static int rhc_check_counts_locked (struct dds_rhc_default *rhc, bool check_cond
 }
 #undef CHECK_MAX_CONDS
 #endif
+
+static const struct dds_rhc_ops dds_rhc_default_ops = {
+  .rhc_ops = {
+    .store = dds_rhc_default_store,
+    .unregister_wr = dds_rhc_default_unregister_wr,
+    .relinquish_ownership = dds_rhc_default_relinquish_ownership,
+    .set_qos = dds_rhc_default_set_qos,
+    .free = dds_rhc_default_free
+  },
+  .read = dds_rhc_default_read,
+  .take = dds_rhc_default_take,
+  .readcdr = dds_rhc_default_readcdr,
+  .takecdr = dds_rhc_default_takecdr,
+  .add_readcondition = dds_rhc_default_add_readcondition,
+  .remove_readcondition = dds_rhc_default_remove_readcondition,
+  .lock_samples = dds_rhc_default_lock_samples,
+  .associate = dds_rhc_default_associate
+};

From ff591ae68469e36031ed5d43c5491fc269e0ac3d Mon Sep 17 00:00:00 2001
From: Erik Boasson <eb@ilities.com>
Date: Sun, 26 Apr 2020 10:13:15 +0200
Subject: [PATCH 201/238] Null instance pointer after dropping instance

Do not pass a dangling pointer to update_conditions_locked after
dropping an instance.  The dangling pointer did not actually get
dereferenced because of the state changes caused by dropping the
samples, but that is cutting a bit fine.

Signed-off-by: Erik Boasson <eb@ilities.com>
---
 src/core/ddsc/src/dds_rhc_default.c | 101 +++++++++++++++-------------
 1 file changed, 53 insertions(+), 48 deletions(-)

diff --git a/src/core/ddsc/src/dds_rhc_default.c b/src/core/ddsc/src/dds_rhc_default.c
index a4c774c..e1a17b1 100644
--- a/src/core/ddsc/src/dds_rhc_default.c
+++ b/src/core/ddsc/src/dds_rhc_default.c
@@ -415,8 +415,9 @@ static void free_sample (struct dds_rhc_default *rhc, struct rhc_instance *inst,
 static void get_trigger_info_cmn (struct trigger_info_cmn *info, struct rhc_instance *inst);
 static void get_trigger_info_pre (struct trigger_info_pre *info, struct rhc_instance *inst);
 static void init_trigger_info_qcond (struct trigger_info_qcond *qc);
-static void drop_instance_noupdate_no_writers (struct dds_rhc_default *rhc, struct rhc_instance *inst);
+static void drop_instance_noupdate_no_writers (struct dds_rhc_default * __restrict rhc, struct rhc_instance * __restrict * __restrict instptr);
 static bool update_conditions_locked (struct dds_rhc_default *rhc, bool called_from_insert, const struct trigger_info_pre *pre, const struct trigger_info_post *post, const struct trigger_info_qcond *trig_qc, const struct rhc_instance *inst, struct dds_entity *triggers[], size_t *ntriggers);
+static void account_for_nonempty_to_empty_transition (struct dds_rhc_default * __restrict rhc, struct rhc_instance * __restrict * __restrict instptr, const char *__restrict traceprefix);
 #ifndef NDEBUG
 static int rhc_check_counts_locked (struct dds_rhc_default *rhc, bool check_conds, bool check_qcmask);
 #endif
@@ -512,18 +513,7 @@ static void drop_expired_samples (struct dds_rhc_default *rhc, struct rhc_sample
   get_trigger_info_cmn (&post.c, inst);
   update_conditions_locked (rhc, false, &pre, &post, &trig_qc, inst, NULL, &ntriggers);
   if (inst_is_empty (inst))
-  {
-    remove_inst_from_nonempty_list (rhc, inst);
-    if (inst->isdisposed)
-      rhc->n_not_alive_disposed--;
-    if (inst->wrcount == 0)
-    {
-      TRACE ("; iid %"PRIx64" #0,empty,drop", inst->iid);
-      if (!inst->isdisposed)
-        rhc->n_not_alive_no_writers--;
-      drop_instance_noupdate_no_writers (rhc, inst);
-    }
-  }
+    account_for_nonempty_to_empty_transition(rhc, &inst, "; ");
   TRACE (")\n");
 }
 
@@ -1023,8 +1013,9 @@ static void update_inst (struct rhc_instance *inst, const struct ddsi_writer_inf
   inst->strength = wrinfo->ownership_strength;
 }
 
-static void drop_instance_noupdate_no_writers (struct dds_rhc_default *rhc, struct rhc_instance *inst)
+static void drop_instance_noupdate_no_writers (struct dds_rhc_default *__restrict rhc, struct rhc_instance * __restrict * __restrict instptr)
 {
+  struct rhc_instance *inst = *instptr;
   int ret;
   assert (inst_is_empty (inst));
 
@@ -1037,6 +1028,7 @@ static void drop_instance_noupdate_no_writers (struct dds_rhc_default *rhc, stru
   (void) ret;
 
   free_empty_instance (inst, rhc);
+  *instptr = NULL;
 }
 
 static void dds_rhc_register (struct dds_rhc_default *rhc, struct rhc_instance *inst, uint64_t wr_iid, bool iid_update)
@@ -1163,6 +1155,25 @@ static void account_for_empty_to_nonempty_transition (struct dds_rhc_default *rh
     rhc->n_not_alive_no_writers++;
 }
 
+static void account_for_nonempty_to_empty_transition (struct dds_rhc_default *__restrict rhc, struct rhc_instance * __restrict * __restrict instptr, const char * __restrict traceprefix)
+{
+  struct rhc_instance *inst = *instptr;
+  assert (inst_is_empty (inst));
+  remove_inst_from_nonempty_list (rhc, inst);
+  if (inst->isdisposed)
+    rhc->n_not_alive_disposed--;
+  if (inst->wrcount == 0)
+  {
+    TRACE ("%siid %"PRIx64" #0,empty,drop\n", traceprefix, inst->iid);
+    if (!inst->isdisposed)
+    {
+      /* disposed has priority over no writers (why not just 2 bits?) */
+      rhc->n_not_alive_no_writers--;
+    }
+    drop_instance_noupdate_no_writers (rhc, instptr);
+  }
+}
+
 static int rhc_unregister_isreg_w_sideeffects (struct dds_rhc_default *rhc, const struct rhc_instance *inst, uint64_t wr_iid)
 {
   /* Returns 1 if last registration just disappeared */
@@ -1207,8 +1218,9 @@ static int rhc_unregister_isreg_w_sideeffects (struct dds_rhc_default *rhc, cons
   }
 }
 
-static int rhc_unregister_updateinst (struct dds_rhc_default *rhc, struct rhc_instance *inst, const struct ddsi_writer_info * __restrict wrinfo, ddsrt_wctime_t tstamp, struct trigger_info_qcond *trig_qc, bool *nda)
+static int rhc_unregister_updateinst (struct dds_rhc_default *rhc, struct rhc_instance **instptr, const struct ddsi_writer_info * __restrict wrinfo, ddsrt_wctime_t tstamp, struct trigger_info_qcond *trig_qc, bool *nda)
 {
+  struct rhc_instance * const inst = *instptr;
   assert (inst->wrcount > 0);
 
   if (--inst->wrcount > 0)
@@ -1253,7 +1265,7 @@ static int rhc_unregister_updateinst (struct dds_rhc_default *rhc, struct rhc_in
     {
       /* No content left, no registrations left, so drop */
       TRACE (",#0,empty,disposed,drop");
-      drop_instance_noupdate_no_writers (rhc, inst);
+      drop_instance_noupdate_no_writers (rhc, instptr);
       return 1;
     }
     else
@@ -1270,8 +1282,9 @@ static int rhc_unregister_updateinst (struct dds_rhc_default *rhc, struct rhc_in
   }
 }
 
-static bool dds_rhc_unregister (struct dds_rhc_default *rhc, struct rhc_instance *inst, const struct ddsi_writer_info * __restrict wrinfo, ddsrt_wctime_t tstamp, struct trigger_info_post *post, struct trigger_info_qcond *trig_qc)
+static bool dds_rhc_unregister (struct dds_rhc_default *rhc, struct rhc_instance **instptr, const struct ddsi_writer_info * __restrict wrinfo, ddsrt_wctime_t tstamp, struct trigger_info_post *post, struct trigger_info_qcond *trig_qc)
 {
+  struct rhc_instance * const inst = *instptr;
   bool notify_data_available = false;
 
   /* 'post' always gets set; instance may have been freed upon return. */
@@ -1281,7 +1294,7 @@ static bool dds_rhc_unregister (struct dds_rhc_default *rhc, struct rhc_instance
     /* other registrations remain */
     get_trigger_info_cmn (&post->c, inst);
   }
-  else if (rhc_unregister_updateinst (rhc, inst, wrinfo, tstamp, trig_qc, &notify_data_available))
+  else if (rhc_unregister_updateinst (rhc, instptr, wrinfo, tstamp, trig_qc, &notify_data_available))
   {
     /* instance dropped */
     init_trigger_info_cmn_nonmatch (&post->c);
@@ -1477,7 +1490,7 @@ static bool dds_rhc_default_store (struct ddsi_rhc * __restrict rhc_common, cons
     }
     if (statusinfo & NN_STATUSINFO_UNREGISTER)
     {
-      if (dds_rhc_unregister (rhc, inst, wrinfo, sample->timestamp, &post, &trig_qc))
+      if (dds_rhc_unregister (rhc, &inst, wrinfo, sample->timestamp, &post, &trig_qc))
         notify_data_available = true;
     }
     else
@@ -1633,7 +1646,7 @@ static bool dds_rhc_default_store (struct ddsi_rhc * __restrict rhc_common, cons
          mean an application reading "x" after the write and reading it
          again after the unregister will see a change in the
          no_writers_generation field? */
-      dds_rhc_unregister (rhc, inst, wrinfo, sample->timestamp, &post, &trig_qc);
+      dds_rhc_unregister (rhc, &inst, wrinfo, sample->timestamp, &post, &trig_qc);
     }
     else
     {
@@ -1744,7 +1757,7 @@ static void dds_rhc_default_unregister_wr (struct ddsi_rhc * __restrict rhc_comm
         }
       }
 
-      (void) dds_rhc_unregister (rhc, inst, wrinfo, inst->tstamp, &post, &trig_qc);
+      (void) dds_rhc_unregister (rhc, &inst, wrinfo, inst->tstamp, &post, &trig_qc);
 
       TRACE ("\n");
 
@@ -2067,8 +2080,9 @@ static int32_t read_w_qminv_inst (struct dds_rhc_default * const __restrict rhc,
   return n;
 }
 
-static int32_t take_w_qminv_inst (struct dds_rhc_default * const __restrict rhc, struct rhc_instance * const __restrict inst, void * __restrict * __restrict values, dds_sample_info_t * __restrict info_seq, const int32_t max_samples, const uint32_t qminv, const dds_querycond_mask_t qcmask, size_t * __restrict ntriggers, read_take_to_sample_t to_sample, read_take_to_invsample_t to_invsample)
+static int32_t take_w_qminv_inst (struct dds_rhc_default * const __restrict rhc, struct rhc_instance * __restrict * __restrict instptr, void * __restrict * __restrict values, dds_sample_info_t * __restrict info_seq, const int32_t max_samples, const uint32_t qminv, const dds_querycond_mask_t qcmask, size_t * __restrict ntriggers, read_take_to_sample_t to_sample, read_take_to_invsample_t to_invsample)
 {
+  struct rhc_instance *inst = *instptr;
   assert (max_samples > 0);
   if (inst_is_empty (inst) || (qmask_of_inst (inst) & qminv) != 0)
   {
@@ -2154,21 +2168,7 @@ static int32_t take_w_qminv_inst (struct dds_rhc_default * const __restrict rhc,
   }
 
   if (inst_is_empty (inst))
-  {
-    remove_inst_from_nonempty_list (rhc, inst);
-    if (inst->isdisposed)
-      rhc->n_not_alive_disposed--;
-    if (inst->wrcount == 0)
-    {
-      TRACE ("take: iid %"PRIx64" #0,empty,drop\n", inst->iid);
-      if (!inst->isdisposed)
-      {
-        /* disposed has priority over no writers (why not just 2 bits?) */
-        rhc->n_not_alive_no_writers--;
-      }
-      drop_instance_noupdate_no_writers (rhc, inst);
-    }
-  }
+    account_for_nonempty_to_empty_transition (rhc, instptr, "take: ");
   return n;
 }
 
@@ -2239,7 +2239,7 @@ static int32_t take_w_qminv (struct dds_rhc_default * __restrict rhc, bool lock,
     struct rhc_instance template, *inst;
     template.iid = handle;
     if ((inst = ddsrt_hh_lookup (rhc->instances, &template)) != NULL)
-      n = take_w_qminv_inst (rhc, inst, values, info_seq, max_samples, qminv, qcmask, &ntriggers, to_sample, to_invsample);
+      n = take_w_qminv_inst (rhc, &inst, values, info_seq, max_samples, qminv, qcmask, &ntriggers, to_sample, to_invsample);
     else
       n = DDS_RETCODE_PRECONDITION_NOT_MET;
   }
@@ -2250,7 +2250,7 @@ static int32_t take_w_qminv (struct dds_rhc_default * __restrict rhc, bool lock,
     while (n_insts-- > 0 && n < max_samples)
     {
       struct rhc_instance * const inst1 = next_nonempty_instance (inst);
-      n += take_w_qminv_inst (rhc, inst, values + n, info_seq + n, max_samples - n, qminv, qcmask, &ntriggers, to_sample, to_invsample);
+      n += take_w_qminv_inst (rhc, &inst, values + n, info_seq + n, max_samples - n, qminv, qcmask, &ntriggers, to_sample, to_invsample);
       inst = inst1;
     }
   }
@@ -2475,7 +2475,9 @@ static bool update_conditions_locked (struct dds_rhc_default *rhc, bool called_f
   TRACE ("update_conditions_locked(%p %p) - inst %"PRIu32" nonempty %"PRIu32" disp %"PRIu32" nowr %"PRIu32" new %"PRIu32" samples %"PRIu32" read %"PRIu32"\n",
          (void *) rhc, (void *) inst, rhc->n_instances, rhc->n_nonempty_instances, rhc->n_not_alive_disposed,
          rhc->n_not_alive_no_writers, rhc->n_new, rhc->n_vsamples, rhc->n_vread);
-  TRACE ("  read -[%d,%d]+[%d,%d] qcmask -[%"PRIx32",%"PRIx32"]+[%"PRIx32",%"PRIx32"]\n",
+  TRACE ("  pre (%"PRIx32",%d,%d) post (%"PRIx32",%d,%d) read -[%d,%d]+[%d,%d] qcmask -[%"PRIx32",%"PRIx32"]+[%"PRIx32",%"PRIx32"]\n",
+         pre->c.qminst, pre->c.has_read, pre->c.has_not_read,
+         post->c.qminst, post->c.has_read, post->c.has_not_read,
          trig_qc->dec_invsample_read, trig_qc->dec_sample_read, trig_qc->inc_invsample_read, trig_qc->inc_sample_read,
          trig_qc->dec_conds_invsample, trig_qc->dec_conds_sample, trig_qc->inc_conds_invsample, trig_qc->inc_conds_sample);
 
@@ -2611,15 +2613,18 @@ static bool update_conditions_locked (struct dds_rhc_default *rhc, bool called_f
            or there was a match and now there is not: so also scan all samples for matches.  The only
            difference is in whether the number of matches should be added or subtracted. */
         int32_t mcurrent = 0;
-        if (inst->inv_exists)
-          mcurrent += (qmask_of_invsample (inst) & iter->m_qminv) == 0 && (inst->conds & qcmask) != 0;
-        if (inst->latest)
+        if (inst)
         {
-          struct rhc_sample *sample = inst->latest->next, * const end = sample;
-          do {
-            mcurrent += (qmask_of_sample (sample) & iter->m_qminv) == 0 && (sample->conds & qcmask) != 0;
-            sample = sample->next;
-          } while (sample != end);
+          if (inst->inv_exists)
+            mcurrent += (qmask_of_invsample (inst) & iter->m_qminv) == 0 && (inst->conds & qcmask) != 0;
+          if (inst->latest)
+          {
+            struct rhc_sample *sample = inst->latest->next, * const end = sample;
+            do {
+              mcurrent += (qmask_of_sample (sample) & iter->m_qminv) == 0 && (sample->conds & qcmask) != 0;
+              sample = sample->next;
+            } while (sample != end);
+          }
         }
         if (mdelta == 0 && mcurrent == 0)
           TRACE ("no change @ %"PRIu32" (2)", ddsrt_atomic_ld32 (&iter->m_entity.m_status.m_trigger));

From c29a81b339de245dd3fd13152c00e70bbadb9c8e Mon Sep 17 00:00:00 2001
From: Erik Boasson <eb@ilities.com>
Date: Wed, 29 Apr 2020 17:47:13 +0200
Subject: [PATCH 202/238] Track deadline registration, consolidate updates

Deadline registration, renewal and deregistration was somewhat spread
through the code and relied on the "isdisposed" flag as a proxy for
whether it was registered or not.  This consolidates the deadline
handling code in a final step of updating the instance and uses a
separate flag to track whether the instance is currently registered in
the deadline administration or not.

This also makes it possible to trivially change the rules for when
deadline notifications are required, and so allows for, e.g., adding a
mode in which instances in the "no writers" state do not trigger any
deadline missed notifications, or just once (both of which seem useful
modes).

Signed-off-by: Erik Boasson <eb@ilities.com>
---
 src/core/ddsc/src/dds_rhc_default.c | 129 +++++++++++++---------------
 1 file changed, 59 insertions(+), 70 deletions(-)

diff --git a/src/core/ddsc/src/dds_rhc_default.c b/src/core/ddsc/src/dds_rhc_default.c
index e1a17b1..2ee62f2 100644
--- a/src/core/ddsc/src/dds_rhc_default.c
+++ b/src/core/ddsc/src/dds_rhc_default.c
@@ -270,6 +270,7 @@ struct rhc_instance {
   unsigned wr_iid_islive : 1;  /* whether wr_iid is of a live writer */
   unsigned inv_exists : 1;     /* whether or not state change occurred since last sample (i.e., must return invalid sample) */
   unsigned inv_isread : 1;     /* whether or not that state change has been read before */
+  unsigned deadline_reg : 1;   /* whether or not registered for a deadline (== isdisposed, except store() defers updates) */
   uint32_t disposed_gen;       /* bloody generation counters - worst invention of mankind */
   uint32_t no_writers_gen;     /* __/ */
   int32_t strength;            /* "current" ownership strength */
@@ -713,7 +714,7 @@ static void free_empty_instance (struct rhc_instance *inst, struct dds_rhc_defau
   assert (inst_is_empty (inst));
   ddsi_tkmap_instance_unref (rhc->tkmap, inst->tk);
 #ifdef DDSI_INCLUDE_DEADLINE_MISSED
-  if (!inst->isdisposed)
+  if (inst->deadline_reg)
     deadline_unregister_instance_locked (&rhc->deadline, &inst->deadline);
 #endif
   ddsrt_free (inst);
@@ -918,11 +919,6 @@ static bool add_sample (struct dds_rhc_default *rhc, struct rhc_instance *inst,
   s->lifespan.t_expire = wrinfo->lifespan_exp;
   lifespan_register_sample_locked (&rhc->lifespan, &s->lifespan);
 #endif
-#ifdef DDSI_INCLUDE_DEADLINE_MISSED
-  /* Only renew the deadline missed counter in case the sample is actually stored in the rhc */
-  if (!inst->isdisposed)
-    deadline_renew_instance_locked (&rhc->deadline, &inst->deadline);
-#endif
 
   s->conds = 0;
   if (rhc->nqconds != 0)
@@ -1264,8 +1260,7 @@ static int rhc_unregister_updateinst (struct dds_rhc_default *rhc, struct rhc_in
     else if (inst->isdisposed)
     {
       /* No content left, no registrations left, so drop */
-      TRACE (",#0,empty,disposed,drop");
-      drop_instance_noupdate_no_writers (rhc, instptr);
+      TRACE (",#0,empty,nowriters,disposed");
       return 1;
     }
     else
@@ -1318,6 +1313,7 @@ static struct rhc_instance *alloc_new_instance (struct dds_rhc_default *rhc, con
   inst->tk = tk;
   inst->wrcount = (serdata->statusinfo & NN_STATUSINFO_UNREGISTER) ? 0 : 1;
   inst->isdisposed = (serdata->statusinfo & NN_STATUSINFO_DISPOSE) != 0;
+  inst->deadline_reg = 0;
   inst->isnew = 1;
   inst->a_sample_free = 1;
   inst->conds = 0;
@@ -1337,12 +1333,6 @@ static struct rhc_instance *alloc_new_instance (struct dds_rhc_default *rhc, con
         inst->conds |= c->m_query.m_qcmask;
     }
   }
-
-#ifdef DDSI_INCLUDE_DEADLINE_MISSED
-  if (!inst->isdisposed)
-    deadline_register_instance_locked (&rhc->deadline, &inst->deadline, ddsrt_time_monotonic ());
-#endif
-
   return inst;
 }
 
@@ -1410,6 +1400,44 @@ static rhc_store_result_t rhc_store_new_instance (struct rhc_instance **out_inst
   return RHC_STORED;
 }
 
+static void postprocess_instance_update (struct dds_rhc_default * __restrict rhc, struct rhc_instance * __restrict * __restrict instptr, const struct trigger_info_pre *pre, const struct trigger_info_post *post, struct trigger_info_qcond *trig_qc, dds_entity *triggers[], size_t *ntriggers)
+{
+  {
+    struct rhc_instance *inst = *instptr;
+
+#ifdef DDSI_INCLUDE_DEADLINE_MISSED
+    if (inst->isdisposed)
+    {
+      if (inst->deadline_reg)
+      {
+        inst->deadline_reg = 0;
+        deadline_unregister_instance_locked (&rhc->deadline, &inst->deadline);
+      }
+    }
+    else
+    {
+      if (inst->deadline_reg)
+        deadline_renew_instance_locked (&rhc->deadline, &inst->deadline);
+      else
+      {
+        deadline_register_instance_locked (&rhc->deadline, &inst->deadline, ddsrt_time_monotonic ());
+        inst->deadline_reg = 1;
+      }
+    }
+#endif
+
+    if (inst_is_empty (inst) && inst->wrcount == 0)
+    {
+      drop_instance_noupdate_no_writers (rhc, instptr);
+    }
+  }
+
+  if (trigger_info_differs (rhc, pre, post, trig_qc))
+    update_conditions_locked (rhc, true, pre, post, trig_qc, *instptr, triggers, ntriggers);
+
+  assert (rhc_check_counts_locked (rhc, true, true));
+}
+
 /*
   dds_rhc_store: DDSI up call into read cache to store new sample. Returns whether sample
   delivered (true unless a reliable sample rejected).
@@ -1429,22 +1457,25 @@ static bool dds_rhc_default_store (struct ddsi_rhc * __restrict rhc_common, cons
   struct trigger_info_qcond trig_qc;
   rhc_store_result_t stored;
   status_cb_data_t cb_data;   /* Callback data for reader status callback */
-  bool delivered = true;
-  bool notify_data_available = false;
+  bool notify_data_available;
+  dds_entity *triggers[MAX_FAST_TRIGGERS];
+  size_t ntriggers;
 
-  TRACE ("rhc_store(%"PRIx64",%"PRIx64" si %x has_data %d:", tk->m_iid, wr_iid, statusinfo, has_data);
+  TRACE ("rhc_store %"PRIx64",%"PRIx64" si %x has_data %d:", tk->m_iid, wr_iid, statusinfo, has_data);
   if (!has_data && statusinfo == 0)
   {
     /* Write with nothing but a key -- I guess that would be a
        register, which we do implicitly. (Currently DDSI2 won't allow
        it through anyway.) */
-    TRACE (" ignore explicit register)\n");
-    return delivered;
+    TRACE (" ignore explicit register\n");
+    return true;
   }
 
+  notify_data_available = false;
   dummy_instance.iid = tk->m_iid;
   stored = RHC_FILTERED;
   cb_data.raw_status_id = -1;
+  ntriggers = 0;
 
   init_trigger_info_qcond (&trig_qc);
 
@@ -1459,7 +1490,7 @@ static bool dds_rhc_default_store (struct ddsi_rhc * __restrict rhc_common, cons
      */
     if (!has_data && !is_dispose)
     {
-      TRACE (" disp/unreg on unknown instance");
+      TRACE (" unreg on unknown instance\n");
       goto error_or_nochange;
     }
     else
@@ -1481,7 +1512,7 @@ static bool dds_rhc_default_store (struct ddsi_rhc * __restrict rhc_common, cons
        will raise a SAMPLE_REJECTED, and indicate that the system should
        kill itself.)  Not letting instances go to ALIVE or NEW based on
        a rejected sample - (no one knows, it seemed) */
-    TRACE (" instance rejects sample");
+    TRACE (" instance rejects sample\n");
 
     get_trigger_info_pre (&pre, inst);
     if (has_data || is_dispose)
@@ -1553,19 +1584,11 @@ static bool dds_rhc_default_store (struct ddsi_rhc * __restrict rhc_common, cons
         TRACE (" disposed->notdisposed");
         inst->isdisposed = 0;
         inst->disposed_gen++;
-#ifdef DDSI_INCLUDE_DEADLINE_MISSED
-        if (!is_dispose)
-          deadline_register_instance_locked (&rhc->deadline, &inst->deadline, ddsrt_time_monotonic ());
-#endif
       }
       if (is_dispose)
       {
         inst->isdisposed = 1;
         inst_became_disposed = !old_isdisposed;
-#ifdef DDSI_INCLUDE_DEADLINE_MISSED
-        if (inst_became_disposed)
-          deadline_unregister_instance_locked (&rhc->deadline, &inst->deadline);
-#endif
         TRACE (" dispose(%d)", inst_became_disposed);
       }
 
@@ -1587,17 +1610,11 @@ static bool dds_rhc_default_store (struct ddsi_rhc * __restrict rhc_common, cons
             if (!inst->isdisposed)
             {
               inst->isdisposed = 1;
-#ifdef DDSI_INCLUDE_DEADLINE_MISSED
-              deadline_unregister_instance_locked (&rhc->deadline, &inst->deadline);
-#endif
             }
           }
           else if (inst->isdisposed)
           {
             inst->isdisposed = 0;
-#ifdef DDSI_INCLUDE_DEADLINE_MISSED
-            deadline_register_instance_locked (&rhc->deadline, &inst->deadline, ddsrt_time_monotonic ());
-#endif
           }
           goto error_or_nochange;
         }
@@ -1654,15 +1671,9 @@ static bool dds_rhc_default_store (struct ddsi_rhc * __restrict rhc_common, cons
     }
   }
 
-  TRACE (")\n");
-
-  dds_entity *triggers[MAX_FAST_TRIGGERS];
-  size_t ntriggers = 0;
-  if (trigger_info_differs (rhc, &pre, &post, &trig_qc))
-    update_conditions_locked (rhc, true, &pre, &post, &trig_qc, inst, triggers, &ntriggers);
-
-  assert (rhc_check_counts_locked (rhc, true, true));
+  postprocess_instance_update (rhc, &inst, &pre, &post, &trig_qc, triggers, &ntriggers);
 
+error_or_nochange:
   ddsrt_mutex_unlock (&rhc->lock);
 
   if (rhc->reader)
@@ -1671,25 +1682,10 @@ static bool dds_rhc_default_store (struct ddsi_rhc * __restrict rhc_common, cons
       dds_reader_data_available_cb (rhc->reader);
     for (size_t i = 0; i < ntriggers; i++)
       dds_entity_status_signal (triggers[i], 0);
+    if (cb_data.raw_status_id >= 0)
+      dds_reader_status_cb (&rhc->reader->m_entity, &cb_data);
   }
-
-  return delivered;
-
-error_or_nochange:
-
-  if (rhc->reliable && (stored == RHC_REJECTED))
-  {
-    delivered = false;
-  }
-
-  ddsrt_mutex_unlock (&rhc->lock);
-  TRACE (")\n");
-
-  /* Make any reader status callback */
-
-  if (cb_data.raw_status_id >= 0 && rhc->reader)
-    dds_reader_status_cb (&rhc->reader->m_entity, &cb_data);
-  return delivered;
+  return !(rhc->reliable && stored == RHC_REJECTED);
 }
 
 static void dds_rhc_default_unregister_wr (struct ddsi_rhc * __restrict rhc_common, const struct ddsi_writer_info * __restrict wrinfo)
@@ -1736,9 +1732,6 @@ static void dds_rhc_default_unregister_wr (struct ddsi_rhc * __restrict rhc_comm
       if (auto_dispose && !inst->isdisposed)
       {
         inst->isdisposed = 1;
-#ifdef DDSI_INCLUDE_DEADLINE_MISSED
-        deadline_unregister_instance_locked (&rhc->deadline, &inst->deadline);
-#endif
 
         /* Set invalid sample for disposing it (unregister may also set it for unregistering) */
         if (inst->latest)
@@ -1758,13 +1751,9 @@ static void dds_rhc_default_unregister_wr (struct ddsi_rhc * __restrict rhc_comm
       }
 
       (void) dds_rhc_unregister (rhc, &inst, wrinfo, inst->tstamp, &post, &trig_qc);
-
-      TRACE ("\n");
-
       notify_data_available = true;
-      if (trigger_info_differs (rhc, &pre, &post, &trig_qc))
-        update_conditions_locked (rhc, true, &pre, &post, &trig_qc, inst, NULL, &ntriggers);
-      assert (rhc_check_counts_locked (rhc, true, false));
+      postprocess_instance_update (rhc, &inst, &pre, &post, &trig_qc, NULL, &ntriggers);
+      TRACE ("\n");
     }
   }
   TRACE (")\n");

From 7f8f1d1a125a060168d4d563ba7db95d4043781f Mon Sep 17 00:00:00 2001
From: Erik Boasson <eb@ilities.com>
Date: Wed, 29 Apr 2020 17:59:22 +0200
Subject: [PATCH 203/238] Auto-dispose when the instance goes to NO_WRITERS

This changes the behaviour of auto-dispose writers: instead of always
disposing when the writer disposes the data, it now only disposes the
data when the instance would otherwise go to the "no writers" state.
This only affects the behaviour when there are multiple writers for the
same instance.

In case the writers use a different value for the auto-dispose setting,
it now tracks whether an instance has ever been touched by an writer
with auto-dispose enabled, and treats auto-disposes the instance when
the last writer leaves if this is the case.  This way, if an instance is
registered by one auto-dispose and one non-auto-dispose writer, the
order of unregistering does not matter.

Signed-off-by: Erik Boasson <eb@ilities.com>
---
 src/core/ddsc/src/dds_rhc_default.c       | 67 ++++++++++++++++-------
 src/core/ddsc/tests/listener.c            |  6 +-
 src/core/xtests/rhc_torture/rhc_torture.c | 44 +++++++++++----
 3 files changed, 84 insertions(+), 33 deletions(-)

diff --git a/src/core/ddsc/src/dds_rhc_default.c b/src/core/ddsc/src/dds_rhc_default.c
index 2ee62f2..09989e0 100644
--- a/src/core/ddsc/src/dds_rhc_default.c
+++ b/src/core/ddsc/src/dds_rhc_default.c
@@ -267,6 +267,7 @@ struct rhc_instance {
   unsigned isnew : 1;          /* NEW or NOT_NEW view state */
   unsigned a_sample_free : 1;  /* whether or not a_sample is in use */
   unsigned isdisposed : 1;     /* DISPOSED or NOT_DISPOSED (if not disposed, wrcount determines ALIVE/NOT_ALIVE_NO_WRITERS) */
+  unsigned autodispose : 1;    /* wrcount > 0 => at least one registered writer has had auto-dispose set on some update */
   unsigned wr_iid_islive : 1;  /* whether wr_iid is of a live writer */
   unsigned inv_exists : 1;     /* whether or not state change occurred since last sample (i.e., must return invalid sample) */
   unsigned inv_isread : 1;     /* whether or not that state change has been read before */
@@ -696,7 +697,12 @@ static void inst_clear_invsample_if_exists (struct dds_rhc_default *rhc, struct
 
 static void inst_set_invsample (struct dds_rhc_default *rhc, struct rhc_instance *inst, struct trigger_info_qcond *trig_qc, bool *nda)
 {
-  if (!inst->inv_exists || inst->inv_isread)
+  if (inst->inv_exists && !inst->inv_isread)
+  {
+    /* FIXME: should this indeed trigger a "notify data available" event?*/
+    *nda = true;
+  }
+  else
   {
     /* Obviously optimisable, but that is perhaps not worth the bother */
     inst_clear_invsample_if_exists (rhc, inst, trig_qc);
@@ -1027,7 +1033,7 @@ static void drop_instance_noupdate_no_writers (struct dds_rhc_default *__restric
   *instptr = NULL;
 }
 
-static void dds_rhc_register (struct dds_rhc_default *rhc, struct rhc_instance *inst, uint64_t wr_iid, bool iid_update)
+static void dds_rhc_register (struct dds_rhc_default *rhc, struct rhc_instance *inst, uint64_t wr_iid, bool autodispose, bool iid_update)
 {
   const uint64_t inst_wr_iid = inst->wr_iid_islive ? inst->wr_iid : 0;
 
@@ -1064,6 +1070,7 @@ static void dds_rhc_register (struct dds_rhc_default *rhc, struct rhc_instance *
     }
     inst->wrcount++;
     inst->no_writers_gen++;
+    inst->autodispose = autodispose;
     TRACE ("new1");
 
     if (!inst_is_empty (inst) && !inst->isdisposed)
@@ -1089,6 +1096,8 @@ static void dds_rhc_register (struct dds_rhc_default *rhc, struct rhc_instance *
     if (lwregs_add (&rhc->registrations, inst->iid, wr_iid))
     {
       inst->wrcount++;
+      if (autodispose)
+        inst->autodispose = 1;
       TRACE ("new2iidnull");
     }
     else
@@ -1125,6 +1134,8 @@ static void dds_rhc_register (struct dds_rhc_default *rhc, struct rhc_instance *
          registers a previously unknown writer or not */
       TRACE ("new3");
       inst->wrcount++;
+      if (autodispose)
+        inst->autodispose = 1;
     }
     else
     {
@@ -1218,6 +1229,8 @@ static int rhc_unregister_updateinst (struct dds_rhc_default *rhc, struct rhc_in
 {
   struct rhc_instance * const inst = *instptr;
   assert (inst->wrcount > 0);
+  if (wrinfo->auto_dispose)
+    inst->autodispose = 1;
 
   if (--inst->wrcount > 0)
   {
@@ -1239,20 +1252,27 @@ static int rhc_unregister_updateinst (struct dds_rhc_default *rhc, struct rhc_in
     if (!inst_is_empty (inst))
     {
       /* Instance still has content - do not drop until application
-       takes the last sample.  Set the invalid sample if the latest
-       sample has been read already, so that the application can
-       read the change to not-alive.  (If the latest sample is still
-       unread, we don't bother, even though it means the application
-       won't see the timestamp for the unregister event. It shouldn't
-       care.) */
-      if (inst->latest == NULL || inst->latest->isread)
-      {
-        inst_set_invsample (rhc, inst, trig_qc, nda);
-        update_inst (inst, wrinfo, false, tstamp);
-      }
+         takes the last sample.  Set the invalid sample if the latest
+         sample has been read already, so that the application can
+         read the change to not-alive.  (If the latest sample is still
+         unread, we don't bother, even though it means the application
+         won't see the timestamp for the unregister event. It shouldn't
+         care.) */
       if (!inst->isdisposed)
       {
-        rhc->n_not_alive_no_writers++;
+        if (inst->latest == NULL || inst->latest->isread)
+        {
+          inst_set_invsample (rhc, inst, trig_qc, nda);
+          update_inst (inst, wrinfo, false, tstamp);
+        }
+        if (!inst->autodispose)
+          rhc->n_not_alive_no_writers++;
+        else
+        {
+          TRACE (",autodispose");
+          inst->isdisposed = 1;
+          rhc->n_not_alive_disposed++;
+        }
       }
       inst->wr_iid_islive = 0;
       return 0;
@@ -1270,6 +1290,11 @@ static int rhc_unregister_updateinst (struct dds_rhc_default *rhc, struct rhc_in
       assert (inst_is_empty (inst));
       inst_set_invsample (rhc, inst, trig_qc, nda);
       update_inst (inst, wrinfo, false, tstamp);
+      if (inst->autodispose)
+      {
+        TRACE (",autodispose");
+        inst->isdisposed = 1;
+      }
       account_for_empty_to_nonempty_transition (rhc, inst);
       inst->wr_iid_islive = 0;
       return 0;
@@ -1313,6 +1338,7 @@ static struct rhc_instance *alloc_new_instance (struct dds_rhc_default *rhc, con
   inst->tk = tk;
   inst->wrcount = (serdata->statusinfo & NN_STATUSINFO_UNREGISTER) ? 0 : 1;
   inst->isdisposed = (serdata->statusinfo & NN_STATUSINFO_DISPOSE) != 0;
+  inst->autodispose = wrinfo->auto_dispose;
   inst->deadline_reg = 0;
   inst->isnew = 1;
   inst->a_sample_free = 1;
@@ -1517,7 +1543,7 @@ static bool dds_rhc_default_store (struct ddsi_rhc * __restrict rhc_common, cons
     get_trigger_info_pre (&pre, inst);
     if (has_data || is_dispose)
     {
-      dds_rhc_register (rhc, inst, wr_iid, false);
+      dds_rhc_register (rhc, inst, wr_iid, wrinfo->auto_dispose, false);
     }
     if (statusinfo & NN_STATUSINFO_UNREGISTER)
     {
@@ -1563,7 +1589,7 @@ static bool dds_rhc_default_store (struct ddsi_rhc * __restrict rhc_common, cons
          (i.e., out-of-memory), abort the operation and hope that the
          caller can still notify the application.  */
 
-      dds_rhc_register (rhc, inst, wr_iid, true);
+      dds_rhc_register (rhc, inst, wr_iid, wrinfo->auto_dispose, true);
 
       /* Sample arriving for a NOT_ALIVE instance => view state NEW */
       if (has_data && not_alive)
@@ -1710,16 +1736,16 @@ static void dds_rhc_default_unregister_wr (struct ddsi_rhc * __restrict rhc_comm
   struct rhc_instance *inst;
   struct ddsrt_hh_iter iter;
   const uint64_t wr_iid = wrinfo->iid;
-  const int auto_dispose = wrinfo->auto_dispose;
-
+  const bool auto_dispose = wrinfo->auto_dispose;
   size_t ntriggers = SIZE_MAX;
 
   ddsrt_mutex_lock (&rhc->lock);
-  TRACE ("rhc_unregister_wr_iid(%"PRIx64",%d:\n", wr_iid, auto_dispose);
+  TRACE ("rhc_unregister_wr_iid %"PRIx64",%d:\n", wr_iid, wrinfo->auto_dispose);
   for (inst = ddsrt_hh_iter_first (rhc->instances, &iter); inst; inst = ddsrt_hh_iter_next (&iter))
   {
     if ((inst->wr_iid_islive && inst->wr_iid == wr_iid) || lwregs_contains (&rhc->registrations, inst->iid, wr_iid))
     {
+      assert (inst->wrcount > 0);
       struct trigger_info_pre pre;
       struct trigger_info_post post;
       struct trigger_info_qcond trig_qc;
@@ -1731,10 +1757,11 @@ static void dds_rhc_default_unregister_wr (struct ddsi_rhc * __restrict rhc_comm
       assert (inst->wrcount > 0);
       if (auto_dispose && !inst->isdisposed)
       {
+        notify_data_available = true;
         inst->isdisposed = 1;
 
         /* Set invalid sample for disposing it (unregister may also set it for unregistering) */
-        if (inst->latest)
+        if (inst->latest && !inst->latest->isread)
         {
           assert (!inst->inv_exists);
           rhc->n_not_alive_disposed++;
diff --git a/src/core/ddsc/tests/listener.c b/src/core/ddsc/tests/listener.c
index 1ad9f71..0ab0108 100644
--- a/src/core/ddsc/tests/listener.c
+++ b/src/core/ddsc/tests/listener.c
@@ -997,9 +997,9 @@ CU_Test(ddsc_listener, data_available_delete_writer_disposed, .init=init_trigger
     ret = dds_delete (g_writer);
     CU_ASSERT_EQUAL_FATAL(ret, DDS_RETCODE_OK);
     g_writer = 0;
-    triggered = waitfor_cb(DDS_DATA_AVAILABLE_STATUS);
-    CU_ASSERT_EQUAL_FATAL(triggered & DDS_DATA_AVAILABLE_STATUS, DDS_DATA_AVAILABLE_STATUS);
-    CU_ASSERT_EQUAL_FATAL(cb_reader, g_reader);
+    ddsrt_mutex_lock(&g_mutex);
+    CU_ASSERT_EQUAL_FATAL(cb_called & DDS_DATA_AVAILABLE_STATUS_ID, 0);
+    ddsrt_mutex_unlock(&g_mutex);
 
     /* The listener should have swallowed the status. */
     ret = dds_read_status(g_subscriber, &status, DDS_DATA_ON_READERS_STATUS);
diff --git a/src/core/xtests/rhc_torture/rhc_torture.c b/src/core/xtests/rhc_torture/rhc_torture.c
index fe9dc53..132fbc6 100644
--- a/src/core/xtests/rhc_torture/rhc_torture.c
+++ b/src/core/xtests/rhc_torture/rhc_torture.c
@@ -935,6 +935,7 @@ int main (int argc, char **argv)
       printf ("************* 0 *************\n");
     struct dds_rhc *rhc = mkrhc (gv, NULL, DDS_HISTORY_KEEP_LAST, 1, DDS_DESTINATIONORDER_BY_SOURCE_TIMESTAMP);
     struct proxy_writer *wr0 = mkwr (gv, 1);
+    struct proxy_writer *wr1 = mkwr (gv, 1);
     uint64_t iid0, iid1, iid_t;
     iid0 = store (tkmap, rhc, wr0, mksample (0, 0), print, false);
     iid1 = store (tkmap, rhc, wr0, mksample (1, NN_STATUSINFO_DISPOSE), print, false);
@@ -944,17 +945,38 @@ int main (int argc, char **argv)
       { 0, 0, 0, 0, 0, 0, 0, 0 }
     };
     rdall (rhc, c0, print, states_seen);
-    iid_t = store (tkmap, rhc, wr0, mkkeysample (0, NN_STATUSINFO_UNREGISTER), print, false);
+    /* write instance 0 with 2nd writer to have 2 live writers */
+    iid_t = store (tkmap, rhc, wr1, mksample (0, 0), print, false);
     assert (iid_t == iid0);
-    (void)iid0;
-    (void)iid_t;
     const struct check c1[] = {
-      { "ROU", iid0, wr0->e.iid, 0,0, 1, 0,1 },
-      { "NOU", iid0, 0, 0,0, 0, 0,0 },
+      { "NOA", iid0, wr1->e.iid, 0,0, 1, 0,3 },
       { "ROD", iid1, wr0->e.iid, 0,0, 1, 1,2 },
       { 0, 0, 0, 0, 0, 0, 0, 0 }
     };
     rdall (rhc, c1, print, states_seen);
+    /* unregister instance 0 with wr0 - autodispose, but 2nd writer keeps it alive, no visible change */
+    iid_t = store (tkmap, rhc, wr0, mkkeysample (0, NN_STATUSINFO_UNREGISTER), print, false);
+    assert (iid_t == iid0);
+    const struct check c2[] = {
+      { "ROA", iid0, wr1->e.iid, 0,0, 1, 0,3 },
+      { "ROD", iid1, wr0->e.iid, 0,0, 1, 1,2 },
+      { 0, 0, 0, 0, 0, 0, 0, 0 }
+    };
+    rdall (rhc, c2, print, states_seen);
+    /* unregistering instance 0 again should be a no-op because wr0 no longer has it registered */
+    iid_t = store (tkmap, rhc, wr0, mkkeysample (0, NN_STATUSINFO_UNREGISTER), print, false);
+    assert (iid_t == iid0);
+    rdall (rhc, c2, print, states_seen);
+    /* unregistering instance 0 with wr1 - autodispose, no live writers -> dispose */
+    iid_t = store (tkmap, rhc, wr1, mkkeysample (0, NN_STATUSINFO_UNREGISTER), print, false);
+    assert (iid_t == iid0);
+    const struct check c3[] = {
+      { "ROD", iid0, wr1->e.iid, 0,0, 1, 0,3 },
+      { "NOD", iid0, 0, 0,0, 0, 0,0 },
+      { "ROD", iid1, wr0->e.iid, 0,0, 1, 1,2 },
+      { 0, 0, 0, 0, 0, 0, 0, 0 }
+    };
+    rdall (rhc, c3, print, states_seen);
     thread_state_awake_domain_ok (lookup_thread_state ());
     struct ddsi_writer_info wr0_info;
     wr0_info.auto_dispose = wr0->c.xqos->writer_data_lifecycle.autodispose_unregistered_instances;
@@ -966,16 +988,18 @@ int main (int argc, char **argv)
 #endif
     dds_rhc_unregister_wr (rhc, &wr0_info);
     thread_state_asleep (lookup_thread_state ());
-    const struct check c2[] = {
-      { "ROU", iid0, wr0->e.iid, 0,0, 1, 0,1 },
-      { "ROU", iid0, 0, 0,0, 0, 0,0 },
+    const struct check c4[] = {
+      { "ROD", iid0, wr1->e.iid, 0,0, 1, 0,3 },
+      { "ROD", iid0, 0, 0,0, 0, 0,0 },
       { "ROD", iid1, wr0->e.iid, 0,0, 1, 1,2 },
-      { "NOD", iid1, 0, 0,0, 0, 1,0 },
+      // { "NOD", iid1, 0, 0,0, 0, 1,0 }, doesn't exist because it is already disposed
       { 0, 0, 0, 0, 0, 0, 0, 0 }
     };
-    tkall (rhc, c2, print, states_seen);
+    tkall (rhc, c4, print, states_seen);
     frhc (rhc);
     fwr (wr0);
+    fwr (wr1);
+    (void)iid_t;
   }
 
   if (1 >= first)

From 347b6edf047cb8ba08da6ef21c7a06623d19e82e Mon Sep 17 00:00:00 2001
From: Erik Boasson <eb@ilities.com>
Date: Wed, 29 Apr 2020 19:49:59 +0200
Subject: [PATCH 204/238] Default to doing expensive checks in rhc_torture

The entire point of this test program is to exercise the RHC while
checking its internal state.  The likelihood of (at least some)
forgetting to enable the "expensive" checks has been proven to be
significant.

Signed-off-by: Erik Boasson <eb@ilities.com>
---
 src/core/xtests/rhc_torture/rhc_torture.c | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/src/core/xtests/rhc_torture/rhc_torture.c b/src/core/xtests/rhc_torture/rhc_torture.c
index 132fbc6..b08fa4f 100644
--- a/src/core/xtests/rhc_torture/rhc_torture.c
+++ b/src/core/xtests/rhc_torture/rhc_torture.c
@@ -894,6 +894,7 @@ int main (int argc, char **argv)
   uint32_t states_seen[2 * 2 * 3][2] = {{ 0 }};
   unsigned seed = 0;
   bool print = false;
+  int xchecks = 1;
   int first = 0, count = 10000;
 
   ddsrt_mutex_init (&wait_gc_cycle_lock);
@@ -909,10 +910,21 @@ int main (int argc, char **argv)
     count = atoi (argv[3]);
   if (argc > 4)
     print = (atoi (argv[4]) != 0);
+  if (argc > 5)
+    xchecks = atoi (argv[4]);
 
-  printf ("prng seed %u first %d count %d print %d\n", seed, first, count, print);
+  printf ("prng seed %u first %d count %d print %d xchecks %d\n", seed, first, count, print, xchecks);
   ddsrt_prng_init_simple (&prng, seed);
 
+  if (xchecks != 0)
+  {
+    struct ddsi_domaingv *gv = get_gv (pp);
+    if (xchecks > 0)
+      gv->config.enabled_xchecks = ~0u;
+    else
+      gv->config.enabled_xchecks = 0u;
+  }
+
   memset (rres_mseq, 0, sizeof (rres_mseq));
   for (size_t i = 0; i < sizeof (rres_iseq) / sizeof(rres_iseq[0]); i++)
     rres_ptrs[i] = &rres_mseq[i];

From 0be287b67bca5e778cd42ef4a7d92a202d3c6619 Mon Sep 17 00:00:00 2001
From: Erik Boasson <eb@ilities.com>
Date: Wed, 29 Apr 2020 19:50:52 +0200
Subject: [PATCH 205/238] No auto-dispose in deadline test

Use of an auto-dispose writer meant the NO_WRITERS case did not actually
get tested.  The behaviour of the implementation was to generate
deadline missed notifications for such instances, but the test expected
otherwise.

There is a disagreement between different DDS implementations on the
desirability of generating deadline missed notifications for NOT_ALIVE
instances.  Deadline notifications on DISPOSED instances seems silly, as
it means end-of-life.  Deadline notifications on a NO_WRITERS instance
are certainly valuable for applications that don't pay attention to the
number of writers (otherwise one has to monitor both liveliness changed
and deadline missed notifications to be be sure to get some
notification).

Different usage patterns definitely affect what is desirable and I doubt
one-size-fits-all is the right approach.  This commit changes the test
and retains the behaviour, and if it errs, it at least errs on the side
of caution.

Signed-off-by: Erik Boasson <eb@ilities.com>
---
 src/core/ddsc/tests/deadline.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/src/core/ddsc/tests/deadline.c b/src/core/ddsc/tests/deadline.c
index e10bd74..c97debb 100644
--- a/src/core/ddsc/tests/deadline.c
+++ b/src/core/ddsc/tests/deadline.c
@@ -125,6 +125,7 @@ static void deadline_init(void)
   dds_qset_history(g_qos, DDS_HISTORY_KEEP_ALL, DDS_LENGTH_UNLIMITED);
   dds_qset_durability(g_qos, DDS_DURABILITY_TRANSIENT_LOCAL);
   dds_qset_reliability(g_qos, DDS_RELIABILITY_RELIABLE, DDS_INFINITY);
+  dds_qset_writer_data_lifecycle(g_qos, false);
 }
 
 static void deadline_fini(void)
@@ -422,7 +423,10 @@ CU_Theory((int32_t n_inst, uint8_t unreg_nth, uint8_t dispose_nth), ddsc_deadlin
         n_dispose++;
       }
     }
-    n_alive = n_inst - n_dispose - n_unreg;
+    /* FIXME: should unregistered instances cause deadline expirations? I do think so
+       and that is what it actually implemented
+       if they shouldn't: n_alive = n_inst - n_dispose - n_unreg */
+    n_alive = n_inst - n_dispose;
 
     /* Sleep deadline_dur + 50% and check missed deadline count */
     sleepfor(3 * deadline_dur / 2);

From 6800887a7433796e1731c86a94d15731b90145d7 Mon Sep 17 00:00:00 2001
From: Erik Boasson <eb@ilities.com>
Date: Wed, 29 Apr 2020 20:00:51 +0200
Subject: [PATCH 206/238] Always add invalid sample if empty or latest read

Disposing an instance would only add an invalid sample if the instance
is empty, but it should also do so when the latest sample is read.
Otherwise reading all NOT_READ samples gives nothing or nonsensical
output.

Signed-off-by: Erik Boasson <eb@ilities.com>
---
 src/core/ddsc/src/dds_rhc_default.c   | 2 +-
 src/core/ddsc/tests/reader_iterator.c | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/core/ddsc/src/dds_rhc_default.c b/src/core/ddsc/src/dds_rhc_default.c
index 09989e0..0a373e7 100644
--- a/src/core/ddsc/src/dds_rhc_default.c
+++ b/src/core/ddsc/src/dds_rhc_default.c
@@ -1648,7 +1648,7 @@ static bool dds_rhc_default_store (struct ddsi_rhc * __restrict rhc_common, cons
       }
 
       /* If instance became disposed, add an invalid sample if there are no samples left */
-      if (inst_became_disposed && inst->latest == NULL)
+      if (inst_became_disposed && (inst->latest == NULL || inst->latest->isread))
         inst_set_invsample (rhc, inst, &trig_qc, &notify_data_available);
 
       update_inst (inst, wrinfo, true, sample->timestamp);
diff --git a/src/core/ddsc/tests/reader_iterator.c b/src/core/ddsc/tests/reader_iterator.c
index df1e4c1..945564c 100644
--- a/src/core/ddsc/tests/reader_iterator.c
+++ b/src/core/ddsc/tests/reader_iterator.c
@@ -55,7 +55,7 @@
 #define MAX_SAMPLES                 21
 
 #define RDR_NOT_READ_CNT            11
-#define RDR_INV_READ_CNT             1
+#define RDR_INV_READ_CNT             2
 int rdr_expected_long_2[RDR_NOT_READ_CNT] = { 0, 1, 2, 6, 7, 9, 11, 13, 14, 16, 19 };
 
 /* Because we only read one sample at a time, only the first sample of an instance

From ebdb3fc5cf38c3bee423155d064842f4859d1e8d Mon Sep 17 00:00:00 2001
From: Erik Boasson <eb@ilities.com>
Date: Wed, 29 Apr 2020 20:08:48 +0200
Subject: [PATCH 207/238] Refactor storing and unregistering writers in RHC

Signed-off-by: Erik Boasson <eb@ilities.com>
---
 src/core/ddsc/src/dds_rhc_default.c | 245 +++++++++++-----------------
 1 file changed, 94 insertions(+), 151 deletions(-)

diff --git a/src/core/ddsc/src/dds_rhc_default.c b/src/core/ddsc/src/dds_rhc_default.c
index 0a373e7..9195cd9 100644
--- a/src/core/ddsc/src/dds_rhc_default.c
+++ b/src/core/ddsc/src/dds_rhc_default.c
@@ -695,7 +695,7 @@ static void inst_clear_invsample_if_exists (struct dds_rhc_default *rhc, struct
     inst_clear_invsample (rhc, inst, trig_qc);
 }
 
-static void inst_set_invsample (struct dds_rhc_default *rhc, struct rhc_instance *inst, struct trigger_info_qcond *trig_qc, bool *nda)
+static void inst_set_invsample (struct dds_rhc_default *rhc, struct rhc_instance *inst, struct trigger_info_qcond *trig_qc, bool * __restrict nda)
 {
   if (inst->inv_exists && !inst->inv_isread)
   {
@@ -842,7 +842,7 @@ static bool trigger_info_differs (const struct dds_rhc_default *rhc, const struc
             trig_qc->dec_sample_read != trig_qc->inc_sample_read);
 }
 
-static bool add_sample (struct dds_rhc_default *rhc, struct rhc_instance *inst, const struct ddsi_writer_info *wrinfo, const struct ddsi_serdata *sample, status_cb_data_t *cb_data, struct trigger_info_qcond *trig_qc)
+static bool add_sample (struct dds_rhc_default *rhc, struct rhc_instance *inst, const struct ddsi_writer_info *wrinfo, const struct ddsi_serdata *sample, status_cb_data_t *cb_data, struct trigger_info_qcond *trig_qc, bool * __restrict nda)
 {
   struct rhc_sample *s;
 
@@ -936,6 +936,7 @@ static bool add_sample (struct dds_rhc_default *rhc, struct rhc_instance *inst,
 
   trig_qc->inc_conds_sample = s->conds;
   inst->latest = s;
+  *nda = true;
   return true;
 }
 
@@ -1033,7 +1034,7 @@ static void drop_instance_noupdate_no_writers (struct dds_rhc_default *__restric
   *instptr = NULL;
 }
 
-static void dds_rhc_register (struct dds_rhc_default *rhc, struct rhc_instance *inst, uint64_t wr_iid, bool autodispose, bool iid_update)
+static void dds_rhc_register (struct dds_rhc_default *rhc, struct rhc_instance *inst, uint64_t wr_iid, bool autodispose, bool iid_update, bool * __restrict nda)
 {
   const uint64_t inst_wr_iid = inst->wr_iid_islive ? inst->wr_iid : 0;
 
@@ -1054,10 +1055,8 @@ static void dds_rhc_register (struct dds_rhc_default *rhc, struct rhc_instance *
        else. */
     TRACE ("cached");
     assert (inst->wrcount > 0);
-    return;
   }
-
-  if (inst->wrcount == 0)
+  else if (inst->wrcount == 0)
   {
     /* Currently no writers at all */
     assert (!inst->wr_iid_islive);
@@ -1075,6 +1074,7 @@ static void dds_rhc_register (struct dds_rhc_default *rhc, struct rhc_instance *
 
     if (!inst_is_empty (inst) && !inst->isdisposed)
       rhc->n_not_alive_no_writers--;
+    *nda = true;
   }
   else if (inst_wr_iid == 0 && inst->wrcount == 1)
   {
@@ -1136,6 +1136,7 @@ static void dds_rhc_register (struct dds_rhc_default *rhc, struct rhc_instance *
       inst->wrcount++;
       if (autodispose)
         inst->autodispose = 1;
+      *nda = true;
     }
     else
     {
@@ -1181,7 +1182,7 @@ static void account_for_nonempty_to_empty_transition (struct dds_rhc_default *__
   }
 }
 
-static int rhc_unregister_isreg_w_sideeffects (struct dds_rhc_default *rhc, const struct rhc_instance *inst, uint64_t wr_iid)
+static int rhc_unregister_delete_registration (struct dds_rhc_default *rhc, const struct rhc_instance *inst, uint64_t wr_iid)
 {
   /* Returns 1 if last registration just disappeared */
   if (inst->wrcount == 0)
@@ -1225,9 +1226,8 @@ static int rhc_unregister_isreg_w_sideeffects (struct dds_rhc_default *rhc, cons
   }
 }
 
-static int rhc_unregister_updateinst (struct dds_rhc_default *rhc, struct rhc_instance **instptr, const struct ddsi_writer_info * __restrict wrinfo, ddsrt_wctime_t tstamp, struct trigger_info_qcond *trig_qc, bool *nda)
+static int rhc_unregister_updateinst (struct dds_rhc_default *rhc, struct rhc_instance *inst, const struct ddsi_writer_info * __restrict wrinfo, ddsrt_wctime_t tstamp, struct trigger_info_qcond *trig_qc, bool * __restrict nda)
 {
-  struct rhc_instance * const inst = *instptr;
   assert (inst->wrcount > 0);
   if (wrinfo->auto_dispose)
     inst->autodispose = 1;
@@ -1273,6 +1273,7 @@ static int rhc_unregister_updateinst (struct dds_rhc_default *rhc, struct rhc_in
           inst->isdisposed = 1;
           rhc->n_not_alive_disposed++;
         }
+        *nda = true;
       }
       inst->wr_iid_islive = 0;
       return 0;
@@ -1297,34 +1298,27 @@ static int rhc_unregister_updateinst (struct dds_rhc_default *rhc, struct rhc_in
       }
       account_for_empty_to_nonempty_transition (rhc, inst);
       inst->wr_iid_islive = 0;
+      *nda = true;
       return 0;
     }
   }
 }
 
-static bool dds_rhc_unregister (struct dds_rhc_default *rhc, struct rhc_instance **instptr, const struct ddsi_writer_info * __restrict wrinfo, ddsrt_wctime_t tstamp, struct trigger_info_post *post, struct trigger_info_qcond *trig_qc)
+static void dds_rhc_unregister (struct dds_rhc_default *rhc, struct rhc_instance *inst, const struct ddsi_writer_info * __restrict wrinfo, ddsrt_wctime_t tstamp, struct trigger_info_post *post, struct trigger_info_qcond *trig_qc, bool * __restrict nda)
 {
-  struct rhc_instance * const inst = *instptr;
-  bool notify_data_available = false;
-
-  /* 'post' always gets set; instance may have been freed upon return. */
+  /* 'post' always gets set */
   TRACE (" unregister:");
-  if (!rhc_unregister_isreg_w_sideeffects (rhc, inst, wrinfo->iid))
-  {
+  if (!rhc_unregister_delete_registration (rhc, inst, wrinfo->iid)) {
     /* other registrations remain */
     get_trigger_info_cmn (&post->c, inst);
-  }
-  else if (rhc_unregister_updateinst (rhc, instptr, wrinfo, tstamp, trig_qc, &notify_data_available))
-  {
+  } else if (rhc_unregister_updateinst (rhc, inst, wrinfo, tstamp, trig_qc, nda)) {
     /* instance dropped */
     init_trigger_info_cmn_nonmatch (&post->c);
-  }
-  else
-  {
+  } else {
     /* no writers remain, but instance not empty */
     get_trigger_info_cmn (&post->c, inst);
   }
-  return notify_data_available;
+  TRACE (" nda=%d\n", *nda);
 }
 
 static struct rhc_instance *alloc_new_instance (struct dds_rhc_default *rhc, const struct ddsi_writer_info *wrinfo, struct ddsi_serdata *serdata, struct ddsi_tkmap_instance *tk)
@@ -1336,7 +1330,7 @@ static struct rhc_instance *alloc_new_instance (struct dds_rhc_default *rhc, con
   memset (inst, 0, sizeof (*inst));
   inst->iid = tk->m_iid;
   inst->tk = tk;
-  inst->wrcount = (serdata->statusinfo & NN_STATUSINFO_UNREGISTER) ? 0 : 1;
+  inst->wrcount = 1;
   inst->isdisposed = (serdata->statusinfo & NN_STATUSINFO_DISPOSE) != 0;
   inst->autodispose = wrinfo->auto_dispose;
   inst->deadline_reg = 0;
@@ -1362,7 +1356,7 @@ static struct rhc_instance *alloc_new_instance (struct dds_rhc_default *rhc, con
   return inst;
 }
 
-static rhc_store_result_t rhc_store_new_instance (struct rhc_instance **out_inst, struct dds_rhc_default *rhc, const struct ddsi_writer_info *wrinfo, struct ddsi_serdata *sample, struct ddsi_tkmap_instance *tk, const bool has_data, status_cb_data_t *cb_data, struct trigger_info_post *post, struct trigger_info_qcond *trig_qc)
+static rhc_store_result_t rhc_store_new_instance (struct rhc_instance **out_inst, struct dds_rhc_default *rhc, const struct ddsi_writer_info *wrinfo, struct ddsi_serdata *sample, struct ddsi_tkmap_instance *tk, const bool has_data, status_cb_data_t *cb_data, struct trigger_info_qcond *trig_qc, bool * __restrict nda)
 {
   struct rhc_instance *inst;
   int ret;
@@ -1400,7 +1394,7 @@ static rhc_store_result_t rhc_store_new_instance (struct rhc_instance **out_inst
   inst = alloc_new_instance (rhc, wrinfo, sample, tk);
   if (has_data)
   {
-    if (!add_sample (rhc, inst, wrinfo, sample, cb_data, trig_qc))
+    if (!add_sample (rhc, inst, wrinfo, sample, cb_data, trig_qc, nda))
     {
       free_empty_instance (inst, rhc);
       return RHC_REJECTED;
@@ -1408,10 +1402,8 @@ static rhc_store_result_t rhc_store_new_instance (struct rhc_instance **out_inst
   }
   else
   {
-    if (inst->isdisposed) {
-      bool nda_dummy = false;
-      inst_set_invsample (rhc, inst, trig_qc, &nda_dummy);
-    }
+    if (inst->isdisposed)
+      inst_set_invsample (rhc, inst, trig_qc, nda);
   }
 
   account_for_empty_to_nonempty_transition (rhc, inst);
@@ -1420,7 +1412,6 @@ static rhc_store_result_t rhc_store_new_instance (struct rhc_instance **out_inst
   (void) ret;
   rhc->n_instances++;
   rhc->n_new++;
-  get_trigger_info_cmn (&post->c, inst);
 
   *out_inst = inst;
   return RHC_STORED;
@@ -1464,6 +1455,43 @@ static void postprocess_instance_update (struct dds_rhc_default * __restrict rhc
   assert (rhc_check_counts_locked (rhc, true, true));
 }
 
+static void update_viewstate_and_disposedness (struct dds_rhc_default * __restrict rhc, struct rhc_instance * __restrict inst, bool has_data, bool not_alive, bool is_dispose, bool * __restrict nda)
+{
+  /* Sample arriving for a NOT_ALIVE instance => view state NEW */
+  if (has_data && not_alive)
+  {
+    TRACE (" notalive->alive");
+    inst->isnew = 1;
+    *nda = true;
+  }
+
+  /* Desired effect on instance state and disposed_gen:
+       op     DISPOSED    NOT_DISPOSED
+       W      ND;gen++    ND
+       D      D           D
+       WD     D;gen++     D
+     Simplest way is to toggle istate when it is currently DISPOSED
+     and the operation is WD. */
+  if (has_data && inst->isdisposed)
+  {
+    TRACE (" disposed->notdisposed");
+    inst->disposed_gen++;
+    if (!is_dispose)
+      inst->isdisposed = 0;
+    *nda = true;
+  }
+  if (is_dispose)
+  {
+    bool wasdisposed = inst->isdisposed;
+    if (!inst->isdisposed)
+    {
+      inst->isdisposed = 1;
+      *nda = true;
+    }
+    TRACE (" dispose(%d)", !wasdisposed);
+  }
+}
+
 /*
   dds_rhc_store: DDSI up call into read cache to store new sample. Returns whether sample
   delivered (true unless a reliable sample rejected).
@@ -1521,14 +1549,12 @@ static bool dds_rhc_default_store (struct ddsi_rhc * __restrict rhc_common, cons
     }
     else
     {
-      TRACE (" new instance");
-      stored = rhc_store_new_instance (&inst, rhc, wrinfo, sample, tk, has_data, &cb_data, &post, &trig_qc);
+      TRACE (" new instance\n");
+      stored = rhc_store_new_instance (&inst, rhc, wrinfo, sample, tk, has_data, &cb_data, &trig_qc, &notify_data_available);
       if (stored != RHC_STORED)
-      {
         goto error_or_nochange;
-      }
+
       init_trigger_info_cmn_nonmatch (&pre.c);
-      notify_data_available = true;
     }
   }
   else if (!inst_accepts_sample (rhc, inst, wrinfo, sample, has_data))
@@ -1542,25 +1568,13 @@ static bool dds_rhc_default_store (struct ddsi_rhc * __restrict rhc_common, cons
 
     get_trigger_info_pre (&pre, inst);
     if (has_data || is_dispose)
-    {
-      dds_rhc_register (rhc, inst, wr_iid, wrinfo->auto_dispose, false);
-    }
-    if (statusinfo & NN_STATUSINFO_UNREGISTER)
-    {
-      if (dds_rhc_unregister (rhc, &inst, wrinfo, sample->timestamp, &post, &trig_qc))
-        notify_data_available = true;
-    }
-    else
-    {
-      get_trigger_info_cmn (&post.c, inst);
-    }
-    /* notify sample lost */
+      dds_rhc_register (rhc, inst, wr_iid, wrinfo->auto_dispose, false, &notify_data_available);
 
+    /* notify sample lost */
     cb_data.raw_status_id = (int) DDS_SAMPLE_LOST_STATUS_ID;
     cb_data.extra = 0;
     cb_data.handle = 0;
     cb_data.add = true;
-    goto error_or_nochange;
   }
   else
   {
@@ -1579,7 +1593,6 @@ static bool dds_rhc_default_store (struct ddsi_rhc * __restrict rhc_common, cons
       const bool old_isdisposed = inst->isdisposed;
       const bool old_isnew = inst->isnew;
       const bool was_empty = inst_is_empty (inst);
-      int inst_became_disposed = 0;
 
       /* Not just an unregister, so a write and/or a dispose (possibly
          combined with an unregister).  Write & dispose create a
@@ -1589,66 +1602,29 @@ static bool dds_rhc_default_store (struct ddsi_rhc * __restrict rhc_common, cons
          (i.e., out-of-memory), abort the operation and hope that the
          caller can still notify the application.  */
 
-      dds_rhc_register (rhc, inst, wr_iid, wrinfo->auto_dispose, true);
+      dds_rhc_register (rhc, inst, wr_iid, wrinfo->auto_dispose, true, &notify_data_available);
+      update_viewstate_and_disposedness (rhc, inst, has_data, not_alive, is_dispose, &notify_data_available);
 
-      /* Sample arriving for a NOT_ALIVE instance => view state NEW */
-      if (has_data && not_alive)
-      {
-        TRACE (" notalive->alive");
-        inst->isnew = 1;
-      }
-
-      /* Desired effect on instance state and disposed_gen:
-         op     DISPOSED    NOT_DISPOSED
-         W      ND;gen++    ND
-         D      D           D
-         WD     D;gen++     D
-         Simplest way is to toggle istate when it is currently DISPOSED
-         and the operation is WD. */
-      if (has_data && inst->isdisposed)
-      {
-        TRACE (" disposed->notdisposed");
-        inst->isdisposed = 0;
-        inst->disposed_gen++;
-      }
-      if (is_dispose)
-      {
-        inst->isdisposed = 1;
-        inst_became_disposed = !old_isdisposed;
-        TRACE (" dispose(%d)", inst_became_disposed);
-      }
-
-      /* Only need to add a sample to the history if the input actually
-         is a sample. */
+      /* Only need to add a sample to the history if the input actually is a sample. */
       if (has_data)
       {
         TRACE (" add_sample");
-        if (!add_sample (rhc, inst, wrinfo, sample, &cb_data, &trig_qc))
+        if (!add_sample (rhc, inst, wrinfo, sample, &cb_data, &trig_qc, &notify_data_available))
         {
-          TRACE ("(reject)");
+          TRACE ("(reject)\n");
           stored = RHC_REJECTED;
 
           /* FIXME: fix the bad rejection handling, probably put back in a proper rollback, until then a band-aid like this will have to do: */
           inst->isnew = old_isnew;
           if (old_isdisposed)
-          {
             inst->disposed_gen--;
-            if (!inst->isdisposed)
-            {
-              inst->isdisposed = 1;
-            }
-          }
-          else if (inst->isdisposed)
-          {
-            inst->isdisposed = 0;
-          }
+          inst->isdisposed = old_isdisposed;
           goto error_or_nochange;
         }
-        notify_data_available = true;
       }
 
       /* If instance became disposed, add an invalid sample if there are no samples left */
-      if (inst_became_disposed && (inst->latest == NULL || inst->latest->isread))
+      if ((bool) inst->isdisposed > old_isdisposed && (inst->latest == NULL || inst->latest->isread))
         inst_set_invsample (rhc, inst, &trig_qc, &notify_data_available);
 
       update_inst (inst, wrinfo, true, sample->timestamp);
@@ -1658,7 +1634,7 @@ static bool dds_rhc_default_store (struct ddsi_rhc * __restrict rhc_common, cons
          guaranteed that we end up with a non-empty instance: for
          example, if the instance was disposed & empty, nothing
          changes. */
-      if (inst->latest || inst_became_disposed)
+      if (inst->latest || (bool) inst->isdisposed > old_isdisposed)
       {
         if (was_empty)
           account_for_empty_to_nonempty_transition (rhc, inst);
@@ -1672,29 +1648,30 @@ static bool dds_rhc_default_store (struct ddsi_rhc * __restrict rhc_common, cons
       }
     }
 
+    TRACE(" nda=%d\n", notify_data_available);
     assert (rhc_check_counts_locked (rhc, false, false));
+  }
 
-    if (statusinfo & NN_STATUSINFO_UNREGISTER)
-    {
-      /* Either a pure unregister, or the instance rejected the sample
-         because of time stamps, content filter, or something else.  If
-         the writer unregisters the instance, I think we should ignore
-         the acceptance filters and process it anyway.
+  if (statusinfo & NN_STATUSINFO_UNREGISTER)
+  {
+    /* Either a pure unregister, or the instance rejected the sample
+       because of time stamps, content filter, or something else.  If
+       the writer unregisters the instance, I think we should ignore
+       the acceptance filters and process it anyway.
 
-         It is a bit unclear what
+       It is a bit unclear what
 
-           write_w_timestamp(x,1) ; unregister_w_timestamp(x,0)
+         write_w_timestamp(x,1) ; unregister_w_timestamp(x,0)
 
-         actually means if BY_SOURCE ordering is selected: does that
-         mean an application reading "x" after the write and reading it
-         again after the unregister will see a change in the
-         no_writers_generation field? */
-      dds_rhc_unregister (rhc, &inst, wrinfo, sample->timestamp, &post, &trig_qc);
-    }
-    else
-    {
-      get_trigger_info_cmn (&post.c, inst);
-    }
+       actually means if BY_SOURCE ordering is selected: does that
+       mean an application reading "x" after the write and reading it
+       again after the unregister will see a change in the
+       no_writers_generation field? */
+    dds_rhc_unregister (rhc, inst, wrinfo, sample->timestamp, &post, &trig_qc, &notify_data_available);
+  }
+  else
+  {
+    get_trigger_info_cmn (&post.c, inst);
   }
 
   postprocess_instance_update (rhc, &inst, &pre, &post, &trig_qc, triggers, &ntriggers);
@@ -1736,7 +1713,6 @@ static void dds_rhc_default_unregister_wr (struct ddsi_rhc * __restrict rhc_comm
   struct rhc_instance *inst;
   struct ddsrt_hh_iter iter;
   const uint64_t wr_iid = wrinfo->iid;
-  const bool auto_dispose = wrinfo->auto_dispose;
   size_t ntriggers = SIZE_MAX;
 
   ddsrt_mutex_lock (&rhc->lock);
@@ -1751,47 +1727,16 @@ static void dds_rhc_default_unregister_wr (struct ddsi_rhc * __restrict rhc_comm
       struct trigger_info_qcond trig_qc;
       get_trigger_info_pre (&pre, inst);
       init_trigger_info_qcond (&trig_qc);
-
       TRACE ("  %"PRIx64":", inst->iid);
-
-      assert (inst->wrcount > 0);
-      if (auto_dispose && !inst->isdisposed)
-      {
-        notify_data_available = true;
-        inst->isdisposed = 1;
-
-        /* Set invalid sample for disposing it (unregister may also set it for unregistering) */
-        if (inst->latest && !inst->latest->isread)
-        {
-          assert (!inst->inv_exists);
-          rhc->n_not_alive_disposed++;
-        }
-        else
-        {
-          const bool was_empty = inst_is_empty (inst);
-          inst_set_invsample (rhc, inst, &trig_qc, &notify_data_available);
-          if (was_empty)
-            account_for_empty_to_nonempty_transition (rhc, inst);
-          else
-            rhc->n_not_alive_disposed++;
-        }
-      }
-
-      (void) dds_rhc_unregister (rhc, &inst, wrinfo, inst->tstamp, &post, &trig_qc);
-      notify_data_available = true;
+      dds_rhc_unregister (rhc, inst, wrinfo, inst->tstamp, &post, &trig_qc, &notify_data_available);
       postprocess_instance_update (rhc, &inst, &pre, &post, &trig_qc, NULL, &ntriggers);
       TRACE ("\n");
     }
   }
-  TRACE (")\n");
-
   ddsrt_mutex_unlock (&rhc->lock);
 
-  if (rhc->reader)
-  {
-    if (notify_data_available)
-      dds_reader_data_available_cb (rhc->reader);
-  }
+  if (rhc->reader && notify_data_available)
+    dds_reader_data_available_cb (rhc->reader);
 }
 
 static void dds_rhc_default_relinquish_ownership (struct ddsi_rhc * __restrict rhc_common, const uint64_t wr_iid)
@@ -2044,7 +1989,6 @@ static int32_t read_w_qminv_inst (struct dds_rhc_default * const __restrict rhc,
         to_sample (sample->sample, values + n, 0, 0);
         if (!sample->isread)
         {
-          TRACE ("s");
           read_sample_update_conditions (rhc, &pre, &post, &trig_qc, inst, sample->conds, false);
           sample->isread = true;
           inst->nvread++;
@@ -2063,7 +2007,6 @@ static int32_t read_w_qminv_inst (struct dds_rhc_default * const __restrict rhc,
     to_invsample (rhc->topic, inst->tk->m_sample, values + n, 0, 0);
     if (!inst->inv_isread)
     {
-      TRACE ("i");
       read_sample_update_conditions (rhc, &pre, &post, &trig_qc, inst, inst->conds, false);
       inst->inv_isread = 1;
       rhc->n_invread++;

From 6ee69374ec67d58af3fdab2d744774ec35140a55 Mon Sep 17 00:00:00 2001
From: Erik Boasson <eb@ilities.com>
Date: Thu, 30 Apr 2020 09:20:04 +0200
Subject: [PATCH 208/238] Standard byte order when creating built-in samples

The standard defines GUIDs as an array of 16 uint8_t and so they are
presented on the network and in built-in topic samples.  Internally they
are arrays of 4 uint32_t, requiring byte-order conversion.

A keyhash is also an array of 16 uint8_t, and used almost exclusively on
the network.  The exception is the generation of built-in topic samples,
which relies on the "from_keyhash" function.  One would expect the
keyhash here to contain the GUID in the external representation, and
this commit adds the byte-order conversions to conform to the
expectation.

Signed-off-by: Erik Boasson <eb@ilities.com>
---
 src/core/ddsc/src/dds_builtin.c              | 18 +++++++++++-------
 src/core/ddsc/src/dds_serdata_builtintopic.c | 10 ++++++----
 2 files changed, 17 insertions(+), 11 deletions(-)

diff --git a/src/core/ddsc/src/dds_builtin.c b/src/core/ddsc/src/dds_builtin.c
index eee50f1..d224810 100644
--- a/src/core/ddsc/src/dds_builtin.c
+++ b/src/core/ddsc/src/dds_builtin.c
@@ -15,6 +15,7 @@
 #include "dds/ddsi/q_entity.h"
 #include "dds/ddsi/q_thread.h"
 #include "dds/ddsi/q_config.h"
+#include "dds/ddsi/q_bswap.h"
 #include "dds/ddsi/ddsi_domaingv.h"
 #include "dds/ddsi/ddsi_plist.h"
 #include "dds__init.h"
@@ -181,10 +182,13 @@ static struct ddsi_tkmap_instance *dds__builtin_get_tkmap_entry (const struct dd
   struct dds_domain *domain = vdomain;
   struct ddsi_tkmap_instance *tk;
   struct ddsi_serdata *sd;
-  struct ddsi_keyhash kh;
-  memcpy (&kh, guid, sizeof (kh));
-  /* any random builtin topic will do (provided it has a GUID for a key), because what matters is the "class" of the topic, not the actual topic; also, this is called early in the initialisation of the entity with this GUID, which simply causes serdata_from_keyhash to create a key-only serdata because the key lookup fails. */
-  sd = ddsi_serdata_from_keyhash (domain->builtin_participant_topic, &kh);
+  union { ddsi_guid_t guid; struct ddsi_keyhash keyhash; } x;
+  x.guid = nn_hton_guid (*guid);
+  /* any random builtin topic will do (provided it has a GUID for a key), because what matters is the "class"
+     of the topic, not the actual topic; also, this is called early in the initialisation of the entity with
+     this GUID, which simply causes serdata_from_keyhash to create a key-only serdata because the key lookup
+     fails. */
+  sd = ddsi_serdata_from_keyhash (domain->builtin_participant_topic, &x.keyhash);
   tk = ddsi_tkmap_find (domain->gv.m_tkmap, sd, true);
   ddsi_serdata_unref (sd);
   return tk;
@@ -196,7 +200,7 @@ struct ddsi_serdata *dds__builtin_make_sample (const struct entity_common *e, dd
   struct dds_domain *dom = e->gv->builtin_topic_interface->arg;
   struct ddsi_sertopic *topic = NULL;
   struct ddsi_serdata *serdata;
-  struct ddsi_keyhash keyhash;
+  union { ddsi_guid_t guid; struct ddsi_keyhash keyhash; } x;
   switch (e->kind)
   {
     case EK_PARTICIPANT:
@@ -213,8 +217,8 @@ struct ddsi_serdata *dds__builtin_make_sample (const struct entity_common *e, dd
       break;
   }
   assert (topic != NULL);
-  memcpy (&keyhash, &e->guid, sizeof (keyhash));
-  serdata = ddsi_serdata_from_keyhash (topic, &keyhash);
+  x.guid = nn_hton_guid (e->guid);
+  serdata = ddsi_serdata_from_keyhash (topic, &x.keyhash);
   serdata->timestamp = timestamp;
   serdata->statusinfo = alive ? 0 : NN_STATUSINFO_DISPOSE | NN_STATUSINFO_UNREGISTER;
   return serdata;
diff --git a/src/core/ddsc/src/dds_serdata_builtintopic.c b/src/core/ddsc/src/dds_serdata_builtintopic.c
index 614a566..9991e8b 100644
--- a/src/core/ddsc/src/dds_serdata_builtintopic.c
+++ b/src/core/ddsc/src/dds_serdata_builtintopic.c
@@ -130,10 +130,12 @@ static struct ddsi_serdata *ddsi_serdata_builtin_from_keyhash (const struct ddsi
 {
   /* FIXME: not quite elegant to manage the creation of a serdata for a built-in topic via this function, but I also find it quite unelegant to let from_sample read straight from the underlying internal entity, and to_sample convert to the external format ... I could claim the internal entity is the "serialised form", but that forces wrapping it in a fragchain in one way or another, which, though possible, is also a bit lacking in elegance. */
   const struct ddsi_sertopic_builtintopic *tp = (const struct ddsi_sertopic_builtintopic *)tpcmn;
-  /* keyhash must in host format (which the GUIDs always are internally) */
-  struct entity_common *entity = entidx_lookup_guid_untyped (tp->c.gv->entity_index, (const ddsi_guid_t *) keyhash->value);
-  struct ddsi_serdata_builtintopic *d = serdata_builtin_new(tp, entity ? SDK_DATA : SDK_KEY);
-  memcpy (&d->key, keyhash->value, sizeof (d->key));
+  union { ddsi_guid_t guid; ddsi_keyhash_t keyhash; } x;
+  x.keyhash = *keyhash;
+  x.guid = nn_ntoh_guid (x.guid);
+  struct entity_common *entity = entidx_lookup_guid_untyped (tp->c.gv->entity_index, &x.guid);
+  struct ddsi_serdata_builtintopic *d = serdata_builtin_new (tp, entity ? SDK_DATA : SDK_KEY);
+  d->key = x.guid;
   if (entity)
   {
     ddsrt_mutex_lock (&entity->qos_lock);

From 23678edad535b0bb76a0e52127bd13a93248aeff Mon Sep 17 00:00:00 2001
From: Erik Boasson <eb@ilities.com>
Date: Thu, 30 Apr 2020 09:30:14 +0200
Subject: [PATCH 209/238] Implement "from_sample" for built-in topics

One cannot create writers for built-in topics, therefore one generally
does not create samples for them.  However, one can lookup an instance
handle from a sample with just a key value in it, and so the function is
needed.

Signed-off-by: Erik Boasson <eb@ilities.com>
---
 src/core/ddsc/src/dds_serdata_builtintopic.c | 37 +++++++++++++++++++-
 1 file changed, 36 insertions(+), 1 deletion(-)

diff --git a/src/core/ddsc/src/dds_serdata_builtintopic.c b/src/core/ddsc/src/dds_serdata_builtintopic.c
index 9991e8b..cc07285 100644
--- a/src/core/ddsc/src/dds_serdata_builtintopic.c
+++ b/src/core/ddsc/src/dds_serdata_builtintopic.c
@@ -171,6 +171,41 @@ static struct ddsi_serdata *ddsi_serdata_builtin_from_keyhash (const struct ddsi
   return fix_serdata_builtin(d, tp->c.serdata_basehash);
 }
 
+static struct ddsi_serdata *ddsi_serdata_builtin_from_sample (const struct ddsi_sertopic *tpcmn, enum ddsi_serdata_kind kind, const void *sample)
+{
+  const struct ddsi_sertopic_builtintopic *tp = (const struct ddsi_sertopic_builtintopic *)tpcmn;
+  union {
+    dds_guid_t extguid;
+    ddsi_keyhash_t keyhash;
+  } x;
+
+  /* no-one should be trying to convert user-provided data into a built-in topic sample, but converting
+     a key is something that can be necessary, e.g., dds_lookup_instance depends on it */
+  if (kind != SDK_KEY)
+    return NULL;
+
+  /* memset x (even though it is entirely superfluous) so we can leave out a default case from the
+     switch (ensuring at least some compilers will warn when more types are added) without getting
+     warnings from any compiler */
+  memset (&x, 0, sizeof (x));
+  switch (tp->type)
+  {
+    case DSBT_PARTICIPANT: {
+      const dds_builtintopic_participant_t *s = sample;
+      x.extguid = s->key;
+      break;
+    }
+    case DSBT_READER:
+    case DSBT_WRITER: {
+      const dds_builtintopic_endpoint_t *s = sample;
+      x.extguid = s->key;
+      break;
+    }
+  }
+
+  return ddsi_serdata_from_keyhash (tpcmn, &x.keyhash);
+}
+
 static struct ddsi_serdata *serdata_builtin_to_topicless (const struct ddsi_serdata *serdata_common)
 {
   /* All built-in ones are currently topicless */
@@ -291,7 +326,7 @@ const struct ddsi_serdata_ops ddsi_serdata_ops_builtintopic = {
   .from_ser = 0,
   .from_ser_iov = 0,
   .from_keyhash = ddsi_serdata_builtin_from_keyhash,
-  .from_sample = 0,
+  .from_sample = ddsi_serdata_builtin_from_sample,
   .to_ser = serdata_builtin_to_ser,
   .to_sample = serdata_builtin_to_sample,
   .to_ser_ref = serdata_builtin_to_ser_ref,

From 06a0ba26c935421297cc5f77841011e6ef0f7e2b Mon Sep 17 00:00:00 2001
From: Erik Boasson <eb@ilities.com>
Date: Wed, 29 Apr 2020 20:10:14 +0200
Subject: [PATCH 210/238] Rework listener tests

A few failures to signal DATA_AVAILABLE (as well as some where it was
signalled unnecessarily) were discovered while refactoring the RHC
despite the tests all passing.  Clearly the tests were inadequate.

The enormous amount of boilerplate in the tests prompted a small rewrite
to a programmable listener invocation tester that one simply feeds a
noise-like one-liner in a string.  This trades the boilerplate for
somewhat inscrutable code.

Signed-off-by: Erik Boasson <eb@ilities.com>
---
 src/core/ddsc/tests/listener.c | 2321 ++++++++++++++++----------------
 1 file changed, 1158 insertions(+), 1163 deletions(-)

diff --git a/src/core/ddsc/tests/listener.c b/src/core/ddsc/tests/listener.c
index 0ab0108..6738cf7 100644
--- a/src/core/ddsc/tests/listener.c
+++ b/src/core/ddsc/tests/listener.c
@@ -1,5 +1,5 @@
 /*
- * Copyright(c) 2006 to 2018 ADLINK Technology Limited and others
+ * Copyright(c) 2006 to 2020 ADLINK Technology Limited and others
  *
  * This program and the accompanying materials are made available under the
  * terms of the Eclipse Public License v. 2.0 which is available at
@@ -9,1254 +9,1249 @@
  *
  * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
  */
+#include <stdlib.h>
+
 #include "dds/dds.h"
-
-#include "dds/ddsrt/cdtors.h"
 #include "dds/ddsrt/misc.h"
-#include "dds/ddsrt/process.h"
 #include "dds/ddsrt/sync.h"
-#include "dds/ddsrt/threads.h"
-
+#include "dds/ddsrt/heap.h"
+#include "dds/ddsrt/string.h"
+#include "dds/ddsrt/environ.h"
 #include "test_common.h"
 
-/****************************************************************************
- * TODO: Add DDS_INCONSISTENT_TOPIC_STATUS test
- * TODO: Add DDS_OFFERED/REQUESTED_DEADLINE_MISSED_STATUS test
- * TODO: Add DDS_LIVELINESS_LOST_STATUS test
- * TODO: Check DDS_REQUESTED_INCOMPATIBLE_QOS_STATUS intermittent fail (total_count != 1)
- ****************************************************************************/
+static ddsrt_mutex_t g_mutex;
+static ddsrt_cond_t g_cond;
+static uint32_t cb_called;
+static dds_entity_t cb_topic, cb_writer, cb_reader, cb_subscriber;
+
+#define DEFINE_STATUS_CALLBACK(name, NAME, kind) \
+  static dds_##name##_status_t cb_##name##_status; \
+  static void name##_cb (dds_entity_t kind, const dds_##name##_status_t status, void *arg) \
+  { \
+    (void) arg; \
+    ddsrt_mutex_lock (&g_mutex); \
+    cb_##kind = kind; \
+    cb_##name##_status = status; \
+    cb_called |= DDS_##NAME##_STATUS; \
+    ddsrt_cond_broadcast (&g_cond); \
+    ddsrt_mutex_unlock (&g_mutex); \
+  }
+
+DEFINE_STATUS_CALLBACK (inconsistent_topic, INCONSISTENT_TOPIC, topic)
+DEFINE_STATUS_CALLBACK (liveliness_changed, LIVELINESS_CHANGED, reader)
+DEFINE_STATUS_CALLBACK (liveliness_lost, LIVELINESS_LOST, writer)
+DEFINE_STATUS_CALLBACK (offered_deadline_missed, OFFERED_DEADLINE_MISSED, writer)
+DEFINE_STATUS_CALLBACK (offered_incompatible_qos, OFFERED_INCOMPATIBLE_QOS, writer)
+DEFINE_STATUS_CALLBACK (publication_matched, PUBLICATION_MATCHED, writer)
+DEFINE_STATUS_CALLBACK (requested_deadline_missed, REQUESTED_DEADLINE_MISSED, reader)
+DEFINE_STATUS_CALLBACK (requested_incompatible_qos, REQUESTED_INCOMPATIBLE_QOS, reader)
+DEFINE_STATUS_CALLBACK (sample_lost, SAMPLE_LOST, reader)
+DEFINE_STATUS_CALLBACK (sample_rejected, SAMPLE_REJECTED, reader)
+DEFINE_STATUS_CALLBACK (subscription_matched, SUBSCRIPTION_MATCHED, reader)
+
+static void data_on_readers_cb (dds_entity_t subscriber, void *arg)
+{
+  (void) arg;
+  ddsrt_mutex_lock (&g_mutex);
+  cb_subscriber = subscriber;
+  cb_called |= DDS_DATA_ON_READERS_STATUS;
+  ddsrt_cond_broadcast (&g_cond);
+  ddsrt_mutex_unlock (&g_mutex);
+}
+
+static void data_available_cb (dds_entity_t reader, void *arg)
+{
+  (void)arg;
+  ddsrt_mutex_lock (&g_mutex);
+  cb_reader = reader;
+  cb_called |= DDS_DATA_AVAILABLE_STATUS;
+  ddsrt_cond_broadcast (&g_cond);
+  ddsrt_mutex_unlock (&g_mutex);
+}
+
+static void dummy_data_on_readers_cb (dds_entity_t subscriber, void *arg)
+{
+  (void)subscriber;
+  (void)arg;
+}
+
+static void dummy_data_available_cb (dds_entity_t reader, void *arg)
+{
+  (void)reader;
+  (void)arg;
+}
+
+static void dummy_subscription_matched_cb (dds_entity_t reader, const dds_subscription_matched_status_t status, void *arg)
+{
+  (void)reader;
+  (void)status;
+  (void)arg;
+}
+
+static void dummy_liveliness_changed_cb (dds_entity_t reader, const dds_liveliness_changed_status_t status, void *arg)
+{
+  (void)reader;
+  (void)status;
+  (void)arg;
+}
+
+static void dummy_cb (void)
+{
+  // Used as a listener function in checking merging of listeners,
+  // and for that purpose, casting it to whatever function type is
+  // required is ok.  It is not supposed to ever be called.
+  abort ();
+}
+
+#undef DEFINE_STATUS_CALLBACK
+
+/**************************************************
+ ****                                          ****
+ ****  create/delete/get/set/copy/merge/reset  ****
+ ****                                          ****
+ **************************************************/
+
+static void set_all_const (dds_listener_t *l, void (*c) (void))
+{
+  dds_lset_data_available (l, (dds_on_data_available_fn) c);
+  dds_lset_data_on_readers (l, (dds_on_data_on_readers_fn) c);
+  dds_lset_inconsistent_topic (l, (dds_on_inconsistent_topic_fn) c);
+  dds_lset_liveliness_changed (l, (dds_on_liveliness_changed_fn) c);
+  dds_lset_liveliness_lost (l, (dds_on_liveliness_lost_fn) c);
+  dds_lset_offered_deadline_missed (l, (dds_on_offered_deadline_missed_fn) c);
+  dds_lset_offered_incompatible_qos (l, (dds_on_offered_incompatible_qos_fn) c);
+  dds_lset_publication_matched (l, (dds_on_publication_matched_fn) c);
+  dds_lset_requested_deadline_missed (l, (dds_on_requested_deadline_missed_fn) c);
+  dds_lset_requested_incompatible_qos (l, (dds_on_requested_incompatible_qos_fn) c);
+  dds_lset_sample_lost (l, (dds_on_sample_lost_fn) c);
+  dds_lset_sample_rejected (l, (dds_on_sample_rejected_fn) c);
+  dds_lset_subscription_matched (l, (dds_on_subscription_matched_fn) c);
+}
+
+static void set_all (dds_listener_t *l)
+{
+  dds_lset_data_available (l, data_available_cb);
+  dds_lset_data_on_readers (l, data_on_readers_cb);
+  dds_lset_inconsistent_topic (l, inconsistent_topic_cb);
+  dds_lset_liveliness_changed (l, liveliness_changed_cb);
+  dds_lset_liveliness_lost (l, liveliness_lost_cb);
+  dds_lset_offered_deadline_missed (l, offered_deadline_missed_cb);
+  dds_lset_offered_incompatible_qos (l, offered_incompatible_qos_cb);
+  dds_lset_publication_matched (l, publication_matched_cb);
+  dds_lset_requested_deadline_missed (l, requested_deadline_missed_cb);
+  dds_lset_requested_incompatible_qos (l, requested_incompatible_qos_cb);
+  dds_lset_sample_lost (l, sample_lost_cb);
+  dds_lset_sample_rejected (l, sample_rejected_cb);
+  dds_lset_subscription_matched (l, subscription_matched_cb);
+}
 
-/****************************************************************************
- * Convenience test macros.
- ****************************************************************************/
 #define ASSERT_CALLBACK_EQUAL(fntype, listener, expected) \
-    do { \
-        dds_on_##fntype##_fn cb; \
-        dds_lget_##fntype(listener, &cb); \
-        CU_ASSERT_EQUAL(cb, expected); \
-    } while (0)
+  do { \
+    dds_on_##fntype##_fn cb; \
+    dds_lget_##fntype(listener, &cb); \
+    CU_ASSERT_EQUAL(cb, expected); \
+  } while (0)
 
-#define STR(fntype) #fntype##_cb
-
-#define TEST_GET_SET(listener, fntype, cb) \
-    do { \
-        dds_on_##fntype##_fn dummy = NULL; \
-        /* Initially expect DDS_LUNSET on a newly created listener */ \
-        ASSERT_CALLBACK_EQUAL(fntype, listener, DDS_LUNSET); \
-        /* Using listener or callback NULL, shouldn't crash and be noop */ \
-        dds_lset_##fntype(NULL, NULL); \
-        dds_lget_##fntype(NULL, NULL); \
-        dds_lget_##fntype(listener, NULL); \
-        dds_lget_##fntype(NULL, &dummy);  \
-        CU_ASSERT_EQUAL_FATAL(dummy, NULL); \
-        /* Set to NULL, get to confirm it succeeds */ \
-        dds_lset_##fntype(listener, NULL); \
-        ASSERT_CALLBACK_EQUAL(fntype, listener, NULL); \
-        /* Set to a proper cb method, get to confirm it succeeds */ \
-        dds_lset_##fntype(listener, cb); \
-        ASSERT_CALLBACK_EQUAL(fntype, listener, cb); \
-    } while (0)
-
-
-
-/****************************************************************************
- * Test globals.
- ****************************************************************************/
-static dds_entity_t    g_participant = 0;
-static dds_entity_t    g_subscriber  = 0;
-static dds_entity_t    g_publisher   = 0;
-static dds_entity_t    g_topic       = 0;
-static dds_entity_t    g_writer      = 0;
-static dds_entity_t    g_reader      = 0;
-
-static dds_listener_t *g_listener = NULL;
-static dds_qos_t      *g_qos = NULL;
-static ddsrt_mutex_t   g_mutex;
-static ddsrt_cond_t    g_cond;
-
-
-
-/****************************************************************************
- * Callback stuff.
- ****************************************************************************/
-static uint32_t        cb_called     = 0;
-static dds_entity_t    cb_topic      = 0;
-static dds_entity_t    cb_writer     = 0;
-static dds_entity_t    cb_reader     = 0;
-static dds_entity_t    cb_subscriber = 0;
-
-static dds_inconsistent_topic_status_t          cb_inconsistent_topic_status;
-static dds_liveliness_lost_status_t             cb_liveliness_lost_status;
-static dds_offered_deadline_missed_status_t     cb_offered_deadline_missed_status;
-static dds_offered_incompatible_qos_status_t    cb_offered_incompatible_qos_status;
-static dds_sample_lost_status_t                 cb_sample_lost_status;
-static dds_sample_rejected_status_t             cb_sample_rejected_status;
-static dds_liveliness_changed_status_t          cb_liveliness_changed_status;
-static dds_requested_deadline_missed_status_t   cb_requested_deadline_missed_status;
-static dds_requested_incompatible_qos_status_t  cb_requested_incompatible_qos_status;
-static dds_publication_matched_status_t         cb_publication_matched_status;
-static dds_subscription_matched_status_t        cb_subscription_matched_status;
-
-
-static void
-inconsistent_topic_cb(
-        dds_entity_t topic,
-        const dds_inconsistent_topic_status_t status, void* arg)
+static void check_all_const (const dds_listener_t *l, void (*c) (void))
 {
-    (void)arg;
-    ddsrt_mutex_lock(&g_mutex);
-    cb_topic = topic;
-    cb_inconsistent_topic_status = status;
-    cb_called |= DDS_INCONSISTENT_TOPIC_STATUS;
-    ddsrt_cond_broadcast(&g_cond);
-    ddsrt_mutex_unlock(&g_mutex);
+  ASSERT_CALLBACK_EQUAL (data_available, l, (dds_on_data_available_fn) c);
+  ASSERT_CALLBACK_EQUAL (data_on_readers, l, (dds_on_data_on_readers_fn) c);
+  ASSERT_CALLBACK_EQUAL (inconsistent_topic, l, (dds_on_inconsistent_topic_fn) c);
+  ASSERT_CALLBACK_EQUAL (liveliness_changed, l, (dds_on_liveliness_changed_fn) c);
+  ASSERT_CALLBACK_EQUAL (liveliness_lost, l, (dds_on_liveliness_lost_fn) c);
+  ASSERT_CALLBACK_EQUAL (offered_deadline_missed, l, (dds_on_offered_deadline_missed_fn) c);
+  ASSERT_CALLBACK_EQUAL (offered_incompatible_qos, l, (dds_on_offered_incompatible_qos_fn) c);
+  ASSERT_CALLBACK_EQUAL (publication_matched, l, (dds_on_publication_matched_fn) c);
+  ASSERT_CALLBACK_EQUAL (requested_deadline_missed, l, (dds_on_requested_deadline_missed_fn) c);
+  ASSERT_CALLBACK_EQUAL (requested_incompatible_qos, l, (dds_on_requested_incompatible_qos_fn) c);
+  ASSERT_CALLBACK_EQUAL (sample_lost, l, (dds_on_sample_lost_fn) c);
+  ASSERT_CALLBACK_EQUAL (sample_rejected, l, (dds_on_sample_rejected_fn) c);
+  ASSERT_CALLBACK_EQUAL (subscription_matched, l, (dds_on_subscription_matched_fn) c);
 }
 
-static void
-liveliness_lost_cb(
-        dds_entity_t writer,
-        const dds_liveliness_lost_status_t status,
-        void* arg)
+static void check_all (const dds_listener_t *l)
 {
-    (void)arg;
-    ddsrt_mutex_lock(&g_mutex);
-    cb_writer = writer;
-    cb_liveliness_lost_status = status;
-    cb_called |= DDS_LIVELINESS_LOST_STATUS;
-    ddsrt_cond_broadcast(&g_cond);
-    ddsrt_mutex_unlock(&g_mutex);
+  ASSERT_CALLBACK_EQUAL (data_available, l, data_available_cb);
+  ASSERT_CALLBACK_EQUAL (data_on_readers, l, data_on_readers_cb);
+  ASSERT_CALLBACK_EQUAL (inconsistent_topic, l, inconsistent_topic_cb);
+  ASSERT_CALLBACK_EQUAL (liveliness_changed, l, liveliness_changed_cb);
+  ASSERT_CALLBACK_EQUAL (liveliness_lost, l, liveliness_lost_cb);
+  ASSERT_CALLBACK_EQUAL (offered_deadline_missed, l, offered_deadline_missed_cb);
+  ASSERT_CALLBACK_EQUAL (offered_incompatible_qos, l, offered_incompatible_qos_cb);
+  ASSERT_CALLBACK_EQUAL (publication_matched, l, publication_matched_cb);
+  ASSERT_CALLBACK_EQUAL (requested_deadline_missed, l, requested_deadline_missed_cb);
+  ASSERT_CALLBACK_EQUAL (requested_incompatible_qos, l, requested_incompatible_qos_cb);
+  ASSERT_CALLBACK_EQUAL (sample_lost, l, sample_lost_cb);
+  ASSERT_CALLBACK_EQUAL (sample_rejected, l, sample_rejected_cb);
+  ASSERT_CALLBACK_EQUAL (subscription_matched, l, subscription_matched_cb);
 }
 
-static void
-offered_deadline_missed_cb(
-        dds_entity_t writer,
-        const dds_offered_deadline_missed_status_t status,
-        void* arg)
+CU_Test (ddsc_listener, create_and_delete)
 {
-    (void)arg;
-    ddsrt_mutex_lock(&g_mutex);
-    cb_writer = writer;
-    cb_offered_deadline_missed_status = status;
-    cb_called |= DDS_OFFERED_DEADLINE_MISSED_STATUS;
-    ddsrt_cond_broadcast(&g_cond);
-    ddsrt_mutex_unlock(&g_mutex);
+  dds_listener_t *listener = dds_create_listener (NULL);
+  CU_ASSERT_PTR_NOT_NULL_FATAL (listener);
+  check_all_const (listener, 0);
+  dds_delete_listener (listener);
+
+  // check delete_listeners handles a null pointer gracefully
+  dds_delete_listener (NULL);
 }
 
-static void
-offered_incompatible_qos_cb(
-        dds_entity_t writer,
-        const dds_offered_incompatible_qos_status_t status,
-        void* arg)
+CU_Test (ddsc_listener, reset)
 {
-    (void)arg;
-    ddsrt_mutex_lock(&g_mutex);
-    cb_writer = writer;
-    cb_offered_incompatible_qos_status = status;
-    cb_called |= DDS_OFFERED_INCOMPATIBLE_QOS_STATUS;
-    ddsrt_cond_broadcast(&g_cond);
-    ddsrt_mutex_unlock(&g_mutex);
+  dds_listener_t *listener = dds_create_listener (NULL);
+  CU_ASSERT_PTR_NOT_NULL_FATAL (listener);
+
+  set_all (listener);
+
+  // all callbacks should revert to default after reset
+  dds_reset_listener (listener);
+  check_all_const (listener, 0);
+  dds_delete_listener (listener);
+
+  // check reset_listeners handles a null pointer gracefully
+  dds_reset_listener (NULL);
 }
 
-static void
-data_on_readers_cb(
-        dds_entity_t subscriber,
-        void* arg)
+CU_Test (ddsc_listener, copy)
 {
-    (void)arg;
-    ddsrt_mutex_lock(&g_mutex);
-    cb_subscriber = subscriber;
-    cb_called |= DDS_DATA_ON_READERS_STATUS;
-    ddsrt_cond_broadcast(&g_cond);
-    ddsrt_mutex_unlock(&g_mutex);
+  dds_listener_t *listener1 = dds_create_listener (NULL);
+  CU_ASSERT_PTR_NOT_NULL_FATAL (listener1);
+  set_all (listener1);
+
+  dds_listener_t *listener2 = dds_create_listener (NULL);
+  CU_ASSERT_PTR_NOT_NULL_FATAL (listener2);
+  dds_copy_listener (listener2, listener1);
+  check_all (listener2);
+
+  // Calling copy with NULL should not crash and be noops
+  dds_copy_listener (listener2, NULL);
+  dds_copy_listener (NULL, listener1);
+  dds_copy_listener (NULL, NULL);
+
+  dds_delete_listener (listener1);
+  dds_delete_listener (listener2);
 }
 
-static void
-sample_lost_cb(
-        dds_entity_t reader,
-        const dds_sample_lost_status_t status,
-        void* arg)
+CU_Test (ddsc_listener, merge)
 {
-    (void)arg;
-    ddsrt_mutex_lock(&g_mutex);
-    cb_reader = reader;
-    cb_sample_lost_status = status;
-    cb_called |= DDS_SAMPLE_LOST_STATUS;
-    ddsrt_cond_broadcast(&g_cond);
-    ddsrt_mutex_unlock(&g_mutex);
-}
+  dds_listener_t *listener1 = dds_create_listener (NULL);
+  CU_ASSERT_PTR_NOT_NULL_FATAL (listener1);
+  set_all (listener1);
 
-static void
-data_available_cb(
-        dds_entity_t reader,
-        void* arg)
-{
-    (void)arg;
-    ddsrt_mutex_lock(&g_mutex);
-    cb_reader = reader;
-    cb_called |= DDS_DATA_AVAILABLE_STATUS;
-    ddsrt_cond_broadcast(&g_cond);
-    ddsrt_mutex_unlock(&g_mutex);
-}
+  // Merging listener1 into empty listener2 be like a copy
+  dds_listener_t *listener2 = dds_create_listener (NULL);
+  CU_ASSERT_PTR_NOT_NULL_FATAL (listener2);
+  dds_merge_listener (listener2, listener1);
+  check_all (listener2);
 
-static void
-sample_rejected_cb(
-        dds_entity_t reader,
-        const dds_sample_rejected_status_t status,
-        void* arg)
-{
-    (void)arg;
-    ddsrt_mutex_lock(&g_mutex);
-    cb_reader = reader;
-    cb_sample_rejected_status = status;
-    cb_called |= DDS_SAMPLE_REJECTED_STATUS;
-    ddsrt_cond_broadcast(&g_cond);
-    ddsrt_mutex_unlock(&g_mutex);
-}
+  // Merging listener into a full listener2 should not overwrite anything
+  set_all_const (listener2, dummy_cb);
+  dds_merge_listener (listener2, listener1);
+  check_all_const (listener2, dummy_cb);
 
-static void
-liveliness_changed_cb(
-        dds_entity_t reader,
-        const dds_liveliness_changed_status_t status,
-        void* arg)
-{
-    (void)arg;
-    ddsrt_mutex_lock(&g_mutex);
-    cb_reader = reader;
-    cb_liveliness_changed_status = status;
-    cb_called |= DDS_LIVELINESS_CHANGED_STATUS;
-    ddsrt_cond_broadcast(&g_cond);
-    ddsrt_mutex_unlock(&g_mutex);
-}
+  // Using NULLs shouldn't crash and be noops
+  dds_merge_listener (listener2, NULL);
+  dds_merge_listener (NULL, listener1);
+  dds_merge_listener (NULL, NULL);
 
-static void
-requested_deadline_missed_cb(
-        dds_entity_t reader,
-        const dds_requested_deadline_missed_status_t status,
-        void* arg)
-{
-    (void)arg;
-    ddsrt_mutex_lock(&g_mutex);
-    cb_reader = reader;
-    cb_requested_deadline_missed_status = status;
-    cb_called |= DDS_REQUESTED_DEADLINE_MISSED_STATUS;
-    ddsrt_cond_broadcast(&g_cond);
-    ddsrt_mutex_unlock(&g_mutex);
-}
-
-static void
-requested_incompatible_qos_cb(
-        dds_entity_t reader,
-        const dds_requested_incompatible_qos_status_t status,
-        void* arg)
-{
-    (void)arg;
-    ddsrt_mutex_lock(&g_mutex);
-    cb_reader = reader;
-    cb_requested_incompatible_qos_status = status;
-    cb_called |= DDS_REQUESTED_INCOMPATIBLE_QOS_STATUS;
-    ddsrt_cond_broadcast(&g_cond);
-    ddsrt_mutex_unlock(&g_mutex);
-}
-
-static void
-publication_matched_cb(
-        dds_entity_t writer,
-        const dds_publication_matched_status_t status,
-        void* arg)
-{
-    (void)arg;
-    ddsrt_mutex_lock(&g_mutex);
-    cb_writer = writer;
-    cb_publication_matched_status = status;
-    cb_called |= DDS_PUBLICATION_MATCHED_STATUS;
-    ddsrt_cond_broadcast(&g_cond);
-    ddsrt_mutex_unlock(&g_mutex);
-}
-
-static void
-subscription_matched_cb(
-        dds_entity_t reader,
-        const dds_subscription_matched_status_t status,
-        void* arg)
-{
-    (void)arg;
-    ddsrt_mutex_lock(&g_mutex);
-    cb_reader = reader;
-    cb_subscription_matched_status = status;
-    cb_called |= DDS_SUBSCRIPTION_MATCHED_STATUS;
-    ddsrt_cond_broadcast(&g_cond);
-    ddsrt_mutex_unlock(&g_mutex);
-}
-
-static void
-callback_dummy(void)
-{
-}
-
-static uint32_t
-waitfor_cb(uint32_t expected)
-{
-    dds_time_t timeout = 5 * DDS_NSECS_IN_SEC;
-    bool signalled = true;
-    ddsrt_mutex_lock(&g_mutex);
-    while (((cb_called & expected) != expected) && (signalled)) {
-        signalled = ddsrt_cond_waitfor(&g_cond, &g_mutex, timeout);
-    }
-    ddsrt_mutex_unlock(&g_mutex);
-    return cb_called;
-}
-
-
-
-/****************************************************************************
- * Test initializations and teardowns.
- ****************************************************************************/
-
-static void
-init_triggering_base(void)
-{
-    char name[100];
-
-    ddsrt_init();
-
-    ddsrt_mutex_init(&g_mutex);
-    ddsrt_cond_init(&g_cond);
-
-    g_participant = dds_create_participant(DDS_DOMAIN_DEFAULT, NULL, NULL);
-    CU_ASSERT_FATAL(g_participant > 0);
-
-    g_subscriber = dds_create_subscriber(g_participant, NULL, NULL);
-    CU_ASSERT_FATAL(g_subscriber > 0);
-
-    g_publisher = dds_create_publisher(g_participant, NULL, NULL);
-    CU_ASSERT_FATAL(g_publisher > 0);
-
-    g_topic = dds_create_topic(g_participant, &RoundTripModule_DataType_desc, create_unique_topic_name("ddsc_listener_test", name, 100), NULL, NULL);
-    CU_ASSERT_FATAL(g_topic > 0);
-
-    g_listener = dds_create_listener(NULL);
-    CU_ASSERT_PTR_NOT_NULL_FATAL(g_listener);
-
-    g_qos = dds_create_qos();
-    CU_ASSERT_PTR_NOT_NULL_FATAL(g_qos);
-    dds_qset_reliability(g_qos, DDS_RELIABILITY_RELIABLE, DDS_SECS(1));
-    dds_qset_history(g_qos, DDS_HISTORY_KEEP_ALL, 0);
-
-    cb_called = 0;
-}
-
-static void
-init_triggering_test(void)
-{
-    uint32_t triggered;
-
-    /* Initialize base. */
-    init_triggering_base();
-
-    /* Set QoS Policies that'll help us test various status callbacks. */
-    dds_qset_destination_order(g_qos, DDS_DESTINATIONORDER_BY_SOURCE_TIMESTAMP);
-    dds_qset_reliability(g_qos, DDS_RELIABILITY_BEST_EFFORT, DDS_MSECS(100));
-    dds_qset_resource_limits(g_qos, 1, 1, 1);
-
-    /* Use these to be sure reader and writer know each other. */
-    dds_lset_publication_matched(g_listener, publication_matched_cb);
-    dds_lset_subscription_matched(g_listener, subscription_matched_cb);
-    dds_lset_liveliness_changed(g_listener, liveliness_changed_cb);
-
-    /* Create reader and writer with proper listeners. */
-    g_writer = dds_create_writer(g_publisher, g_topic, g_qos, g_listener);
-    CU_ASSERT(g_writer > 0);
-    g_reader = dds_create_reader(g_subscriber, g_topic, g_qos, g_listener);
-    CU_ASSERT(g_reader > 0);
-
-    /* Sync. */
-    triggered = waitfor_cb(DDS_PUBLICATION_MATCHED_STATUS | DDS_SUBSCRIPTION_MATCHED_STATUS | DDS_LIVELINESS_CHANGED_STATUS);
-    CU_ASSERT_EQUAL_FATAL(triggered & DDS_LIVELINESS_CHANGED_STATUS,    DDS_LIVELINESS_CHANGED_STATUS);
-    CU_ASSERT_EQUAL_FATAL(triggered & DDS_PUBLICATION_MATCHED_STATUS,   DDS_PUBLICATION_MATCHED_STATUS);
-    CU_ASSERT_EQUAL_FATAL(triggered & DDS_SUBSCRIPTION_MATCHED_STATUS,  DDS_SUBSCRIPTION_MATCHED_STATUS);
-}
-
-static void
-fini_triggering_base(void)
-{
-    dds_delete_qos(g_qos);
-    dds_delete_listener(g_listener);
-    dds_delete(g_participant);
-    ddsrt_cond_destroy(&g_cond);
-    ddsrt_mutex_destroy(&g_mutex);
-    ddsrt_fini();
-}
-
-static void
-fini_triggering_test(void)
-{
-    dds_delete(g_reader);
-    if (g_writer)
-      dds_delete(g_writer);
-    fini_triggering_base();
-}
-
-
-/****************************************************************************
- * API tests
- ****************************************************************************/
-CU_Test(ddsc_listener, create_and_delete)
-{
-    /* Verify create doesn't return null */
-    dds_listener_t *listener;
-    listener = dds_create_listener(NULL);
-    CU_ASSERT_PTR_NOT_NULL_FATAL(listener);
-
-    /* Check default cb's are set */
-    ASSERT_CALLBACK_EQUAL(inconsistent_topic, listener, DDS_LUNSET);
-    ASSERT_CALLBACK_EQUAL(liveliness_lost, listener, DDS_LUNSET);
-    ASSERT_CALLBACK_EQUAL(offered_deadline_missed, listener, DDS_LUNSET);
-    ASSERT_CALLBACK_EQUAL(offered_incompatible_qos, listener, DDS_LUNSET);
-    ASSERT_CALLBACK_EQUAL(data_on_readers, listener, DDS_LUNSET);
-    ASSERT_CALLBACK_EQUAL(sample_lost, listener, DDS_LUNSET);
-    ASSERT_CALLBACK_EQUAL(sample_rejected, listener, DDS_LUNSET);
-    ASSERT_CALLBACK_EQUAL(liveliness_changed, listener, DDS_LUNSET);
-    ASSERT_CALLBACK_EQUAL(requested_deadline_missed, listener, DDS_LUNSET);
-    ASSERT_CALLBACK_EQUAL(requested_incompatible_qos, listener, DDS_LUNSET);
-    ASSERT_CALLBACK_EQUAL(publication_matched, listener, DDS_LUNSET);
-    ASSERT_CALLBACK_EQUAL(subscription_matched, listener, DDS_LUNSET);
-    ASSERT_CALLBACK_EQUAL(data_available, listener, DDS_LUNSET);
-
-    dds_delete_listener(listener);
-    DDSRT_WARNING_MSVC_OFF(6387); /* Disable SAL warning on intentional misuse of the API */
-    dds_delete_listener(NULL);
-    DDSRT_WARNING_MSVC_ON(6387);
-}
-
-CU_Test(ddsc_listener, reset)
-{
-    dds_listener_t *listener;
-    listener = dds_create_listener(NULL);
-    CU_ASSERT_PTR_NOT_NULL_FATAL(listener);
-
-    /* Set a listener cb to a non-default value */
-    dds_lset_data_available(listener, NULL);
-    ASSERT_CALLBACK_EQUAL(data_available, listener, NULL);
-
-    /* Listener cb should revert to default after reset */
-    dds_reset_listener(listener);
-    ASSERT_CALLBACK_EQUAL(data_available, listener, DDS_LUNSET);
-
-    /* Resetting a NULL listener should not crash */
-    dds_reset_listener(NULL);
-
-    dds_delete_listener(listener);
-}
-
-CU_Test(ddsc_listener, copy)
-{
-    dds_listener_t *listener1 = NULL, *listener2 = NULL;
-    listener1 = dds_create_listener(NULL);
-    listener2 = dds_create_listener(NULL);
-    CU_ASSERT_PTR_NOT_NULL_FATAL(listener1);
-    CU_ASSERT_PTR_NOT_NULL_FATAL(listener2);
-
-    /* Set some listener1 callbacks to non-default values */
-    dds_lset_data_available(listener1, NULL);
-    dds_lset_sample_lost(listener1, sample_lost_cb);
-    ASSERT_CALLBACK_EQUAL(data_available, listener1, NULL);
-    ASSERT_CALLBACK_EQUAL(sample_lost, listener1, sample_lost_cb);
-    ASSERT_CALLBACK_EQUAL(data_available, listener2, DDS_LUNSET);
-    ASSERT_CALLBACK_EQUAL(sample_lost, listener2, DDS_LUNSET);
-
-    /* Cb's should be copied to listener2 */
-    dds_copy_listener(listener2, listener1);
-    ASSERT_CALLBACK_EQUAL(data_available, listener1, NULL);
-    ASSERT_CALLBACK_EQUAL(data_available, listener2, NULL);
-    ASSERT_CALLBACK_EQUAL(sample_lost, listener1, sample_lost_cb);
-    ASSERT_CALLBACK_EQUAL(sample_lost, listener2, sample_lost_cb);
-
-    /* Calling copy with NULL should not crash and be noops. */
-    DDSRT_WARNING_MSVC_OFF(6387); /* Disable SAL warning on intentional misuse of the API */
-    dds_copy_listener(listener2, NULL);
-    dds_copy_listener(NULL, listener1);
-    dds_copy_listener(NULL, NULL);
-    DDSRT_WARNING_MSVC_ON(6387);
-
-    dds_delete_listener(listener1);
-    dds_delete_listener(listener2);
-}
-
-CU_Test(ddsc_listener, merge)
-{
-    dds_listener_t *listener1 = NULL, *listener2 = NULL;
-    listener1 = dds_create_listener(NULL);
-    listener2 = dds_create_listener(NULL);
-    CU_ASSERT_PTR_NOT_NULL_FATAL(listener1);
-    CU_ASSERT_PTR_NOT_NULL_FATAL(listener2);
-
-    /* Set all listener1 callbacks to non-default values */
-    dds_lset_inconsistent_topic         (listener1, inconsistent_topic_cb);
-    dds_lset_liveliness_lost            (listener1, liveliness_lost_cb);
-    dds_lset_offered_deadline_missed    (listener1, offered_deadline_missed_cb);
-    dds_lset_offered_incompatible_qos   (listener1, offered_incompatible_qos_cb);
-    dds_lset_data_on_readers            (listener1, data_on_readers_cb);
-    dds_lset_sample_lost                (listener1, sample_lost_cb);
-    dds_lset_data_available             (listener1, data_available_cb);
-    dds_lset_sample_rejected            (listener1, sample_rejected_cb);
-    dds_lset_liveliness_changed         (listener1, liveliness_changed_cb);
-    dds_lset_requested_deadline_missed  (listener1, requested_deadline_missed_cb);
-    dds_lset_requested_incompatible_qos (listener1, requested_incompatible_qos_cb);
-    dds_lset_publication_matched        (listener1, publication_matched_cb);
-    dds_lset_subscription_matched       (listener1, subscription_matched_cb);
-
-    /* Merging listener1 into empty listener2 should act a bit like a copy. */
-    dds_merge_listener(listener2, listener1);
-    ASSERT_CALLBACK_EQUAL(inconsistent_topic,           listener2, inconsistent_topic_cb);
-    ASSERT_CALLBACK_EQUAL(liveliness_lost,              listener2, liveliness_lost_cb);
-    ASSERT_CALLBACK_EQUAL(offered_deadline_missed,      listener2, offered_deadline_missed_cb);
-    ASSERT_CALLBACK_EQUAL(offered_incompatible_qos,     listener2, offered_incompatible_qos_cb);
-    ASSERT_CALLBACK_EQUAL(data_on_readers,              listener2, data_on_readers_cb);
-    ASSERT_CALLBACK_EQUAL(sample_lost,                  listener2, sample_lost_cb);
-    ASSERT_CALLBACK_EQUAL(data_available,               listener2, data_available_cb);
-    ASSERT_CALLBACK_EQUAL(sample_rejected,              listener2, sample_rejected_cb);
-    ASSERT_CALLBACK_EQUAL(liveliness_changed,           listener2, liveliness_changed_cb);
-    ASSERT_CALLBACK_EQUAL(requested_deadline_missed,    listener2, requested_deadline_missed_cb);
-    ASSERT_CALLBACK_EQUAL(requested_incompatible_qos,   listener2, requested_incompatible_qos_cb);
-    ASSERT_CALLBACK_EQUAL(publication_matched,          listener2, publication_matched_cb);
-    ASSERT_CALLBACK_EQUAL(subscription_matched,         listener2, subscription_matched_cb);
-
-    /* Merging listener into a full listener2 should act as a noop. */
-    dds_lset_inconsistent_topic         (listener2, (dds_on_inconsistent_topic_fn)callback_dummy);
-    dds_lset_liveliness_lost            (listener2, (dds_on_liveliness_lost_fn)callback_dummy);
-    dds_lset_offered_deadline_missed    (listener2, (dds_on_offered_deadline_missed_fn)callback_dummy);
-    dds_lset_offered_incompatible_qos   (listener2, (dds_on_offered_incompatible_qos_fn)callback_dummy);
-    dds_lset_data_on_readers            (listener2, (dds_on_data_on_readers_fn)callback_dummy);
-    dds_lset_sample_lost                (listener2, (dds_on_sample_lost_fn)callback_dummy);
-    dds_lset_data_available             (listener2, (dds_on_data_available_fn)callback_dummy);
-    dds_lset_sample_rejected            (listener2, (dds_on_sample_rejected_fn)callback_dummy);
-    dds_lset_liveliness_changed         (listener2, (dds_on_liveliness_changed_fn)callback_dummy);
-    dds_lset_requested_deadline_missed  (listener2, (dds_on_requested_deadline_missed_fn)callback_dummy);
-    dds_lset_requested_incompatible_qos (listener2, (dds_on_requested_incompatible_qos_fn)callback_dummy);
-    dds_lset_publication_matched        (listener2, (dds_on_publication_matched_fn)callback_dummy);
-    dds_lset_subscription_matched       (listener2, (dds_on_subscription_matched_fn)callback_dummy);
-    dds_merge_listener(listener2, listener1);
-    ASSERT_CALLBACK_EQUAL(inconsistent_topic,           listener2, (dds_on_inconsistent_topic_fn)callback_dummy);
-    ASSERT_CALLBACK_EQUAL(liveliness_lost,              listener2, (dds_on_liveliness_lost_fn)callback_dummy);
-    ASSERT_CALLBACK_EQUAL(offered_deadline_missed,      listener2, (dds_on_offered_deadline_missed_fn)callback_dummy);
-    ASSERT_CALLBACK_EQUAL(offered_incompatible_qos,     listener2, (dds_on_offered_incompatible_qos_fn)callback_dummy);
-    ASSERT_CALLBACK_EQUAL(data_on_readers,              listener2, (dds_on_data_on_readers_fn)callback_dummy);
-    ASSERT_CALLBACK_EQUAL(sample_lost,                  listener2, (dds_on_sample_lost_fn)callback_dummy);
-    ASSERT_CALLBACK_EQUAL(data_available,               listener2, (dds_on_data_available_fn)callback_dummy);
-    ASSERT_CALLBACK_EQUAL(sample_rejected,              listener2, (dds_on_sample_rejected_fn)callback_dummy);
-    ASSERT_CALLBACK_EQUAL(liveliness_changed,           listener2, (dds_on_liveliness_changed_fn)callback_dummy);
-    ASSERT_CALLBACK_EQUAL(requested_deadline_missed,    listener2, (dds_on_requested_deadline_missed_fn)callback_dummy);
-    ASSERT_CALLBACK_EQUAL(requested_incompatible_qos,   listener2, (dds_on_requested_incompatible_qos_fn)callback_dummy);
-    ASSERT_CALLBACK_EQUAL(publication_matched,          listener2, (dds_on_publication_matched_fn)callback_dummy);
-    ASSERT_CALLBACK_EQUAL(subscription_matched,         listener2, (dds_on_subscription_matched_fn)callback_dummy);
-
-    /* Using NULLs shouldn't crash and be noops. */
-    dds_merge_listener(listener2, NULL);
-    dds_merge_listener(NULL, listener1);
-    dds_merge_listener(NULL, NULL);
-
-    dds_delete_listener(listener1);
-    dds_delete_listener(listener2);
+  dds_delete_listener (listener1);
+  dds_delete_listener (listener2);
 }
 
 CU_Test(ddsc_listener, getters_setters)
 {
-    /* test all individual cb get/set methods */
-    dds_listener_t *listener = dds_create_listener(NULL);
-    CU_ASSERT_PTR_NOT_NULL_FATAL(listener);
+  // test all individual cb get/set methods
+  dds_listener_t *listener = dds_create_listener (NULL);
+  CU_ASSERT_PTR_NOT_NULL_FATAL (listener);
 
-    DDSRT_WARNING_MSVC_OFF(6387); /* Disable SAL warning on intentional misuse of the API */ \
-    TEST_GET_SET(listener, inconsistent_topic, inconsistent_topic_cb);
-    TEST_GET_SET(listener, liveliness_lost, liveliness_lost_cb);
-    TEST_GET_SET(listener, offered_deadline_missed, offered_deadline_missed_cb);
-    TEST_GET_SET(listener, offered_incompatible_qos, offered_incompatible_qos_cb);
-    TEST_GET_SET(listener, data_on_readers, data_on_readers_cb);
-    TEST_GET_SET(listener, sample_lost, sample_lost_cb);
-    TEST_GET_SET(listener, sample_rejected, sample_rejected_cb);
-    TEST_GET_SET(listener, liveliness_changed, liveliness_changed_cb);
-    TEST_GET_SET(listener, requested_deadline_missed, requested_deadline_missed_cb);
-    TEST_GET_SET(listener, requested_incompatible_qos, requested_incompatible_qos_cb);
-    TEST_GET_SET(listener, publication_matched, publication_matched_cb);
-    TEST_GET_SET(listener, subscription_matched, subscription_matched_cb);
-    TEST_GET_SET(listener, data_available, data_available_cb);
-    DDSRT_WARNING_MSVC_ON(6387);
+#define TEST_GET_SET(listener, fntype, cb) \
+  do { \
+    dds_on_##fntype##_fn dummy = NULL; \
+    /* Initially expect DDS_LUNSET on a newly created listener */ \
+    ASSERT_CALLBACK_EQUAL (fntype, listener, 0); \
+    /* Using listener or callback NULL, shouldn't crash and be noop */ \
+    dds_lset_##fntype (NULL, NULL); \
+    dds_lget_##fntype (NULL, NULL); \
+    dds_lget_##fntype (listener, NULL); \
+    dds_lget_##fntype (NULL, &dummy);  \
+    CU_ASSERT_EQUAL_FATAL (dummy, NULL); \
+    /* Set to NULL, get to confirm it succeeds */ \
+    dds_lset_##fntype (listener, NULL); \
+    ASSERT_CALLBACK_EQUAL (fntype, listener, NULL); \
+    /* Set to a proper cb method, get to confirm it succeeds */ \
+    dds_lset_##fntype (listener, cb); \
+    ASSERT_CALLBACK_EQUAL (fntype, listener, cb); \
+  } while (0)
+  TEST_GET_SET (listener, data_available, data_available_cb);
+  TEST_GET_SET (listener, data_on_readers, data_on_readers_cb);
+  TEST_GET_SET (listener, inconsistent_topic, inconsistent_topic_cb);
+  TEST_GET_SET (listener, liveliness_changed, liveliness_changed_cb);
+  TEST_GET_SET (listener, liveliness_lost, liveliness_lost_cb);
+  TEST_GET_SET (listener, offered_deadline_missed, offered_deadline_missed_cb);
+  TEST_GET_SET (listener, offered_incompatible_qos, offered_incompatible_qos_cb);
+  TEST_GET_SET (listener, publication_matched, publication_matched_cb);
+  TEST_GET_SET (listener, requested_deadline_missed, requested_deadline_missed_cb);
+  TEST_GET_SET (listener, requested_incompatible_qos, requested_incompatible_qos_cb);
+  TEST_GET_SET (listener, sample_lost, sample_lost_cb);
+  TEST_GET_SET (listener, sample_rejected, sample_rejected_cb);
+  TEST_GET_SET (listener, subscription_matched, subscription_matched_cb);
+#undef TEST_GET_SET
 
-    dds_delete_listener(listener);
+  dds_delete_listener (listener);
 }
 
+#undef ASSERT_CALLBACK_EQUAL
 
+/**************************************************
+ ****                                          ****
+ ****  programmable listener checker           ****
+ ****                                          ****
+ **************************************************/
 
-/****************************************************************************
- * Triggering tests
- ****************************************************************************/
-CU_Test(ddsc_listener, propagation, .init=init_triggering_base, .fini=fini_triggering_base)
+// These had better match the corresponding type definitions!
+// n   uint32_t ...count
+// c   int32_t  ...count_change
+// I            instance handle of a data instance
+// P   uint32_t QoS policy ID
+// E            instance handle of an entity
+// R            sample_rejected_status_kind
+static const struct {
+  size_t size;                   // size of status struct
+  const char *desc;              // description of status struct
+  uint32_t mask;                 // status mask, bit in "cb_called"
+  const dds_entity_t *cb_entity; // which cb_... entity to look at
+  const void *cb_status;         // cb_..._status to look at
+} lldesc[] = {
+  { 0, NULL, DDS_DATA_AVAILABLE_STATUS, &cb_reader, NULL }, // data available
+  { 0, NULL, DDS_DATA_ON_READERS_STATUS, &cb_subscriber, NULL }, // data on readers
+  { sizeof (dds_inconsistent_topic_status_t), "nc", DDS_INCONSISTENT_TOPIC_STATUS, &cb_topic, &cb_inconsistent_topic_status },
+  { sizeof (dds_liveliness_changed_status_t), "nnccE", DDS_LIVELINESS_CHANGED_STATUS, &cb_reader, &cb_liveliness_changed_status },
+  { sizeof (dds_liveliness_lost_status_t), "nc", DDS_LIVELINESS_LOST_STATUS, &cb_writer, &cb_liveliness_lost_status },
+  { sizeof (dds_offered_deadline_missed_status_t), "ncI", DDS_OFFERED_DEADLINE_MISSED_STATUS, &cb_writer, &cb_offered_deadline_missed_status },
+  { sizeof (dds_offered_incompatible_qos_status_t), "ncP", DDS_OFFERED_INCOMPATIBLE_QOS_STATUS, &cb_writer, &cb_offered_incompatible_qos_status },
+  { sizeof (dds_publication_matched_status_t), "ncncE", DDS_PUBLICATION_MATCHED_STATUS, &cb_writer, &cb_publication_matched_status },
+  { sizeof (dds_requested_deadline_missed_status_t), "ncI", DDS_REQUESTED_DEADLINE_MISSED_STATUS, &cb_reader, &cb_requested_deadline_missed_status },
+  { sizeof (dds_requested_incompatible_qos_status_t), "ncP", DDS_REQUESTED_INCOMPATIBLE_QOS_STATUS, &cb_reader, &cb_requested_incompatible_qos_status },
+  { sizeof (dds_sample_lost_status_t), "nc", DDS_SAMPLE_LOST_STATUS, &cb_reader, &cb_sample_lost_status },
+  { sizeof (dds_sample_rejected_status_t), "ncRI", DDS_SAMPLE_REJECTED_STATUS, &cb_reader, &cb_sample_rejected_status },
+  { sizeof (dds_subscription_matched_status_t), "ncncE", DDS_SUBSCRIPTION_MATCHED_STATUS, &cb_reader, &cb_subscription_matched_status }
+};
+
+static const void *advance (const void *status, size_t *off, char code)
 {
-    dds_listener_t *listener_par = NULL;
-    dds_listener_t *listener_pub = NULL;
-    dds_listener_t *listener_sub = NULL;
-    uint32_t triggered;
+#define alignof(type_) offsetof (struct { char c; type_ d; }, d)
+  size_t align = 1, size = 1;
+  switch (code)
+  {
+    case 'n': case 'c': case 'P':
+      align = alignof (uint32_t); size = sizeof (uint32_t);
+      break;
+    case 'E': case 'I':
+      align = alignof (dds_instance_handle_t); size = sizeof (dds_instance_handle_t);
+      break;
+    case 'R':
+      align = alignof (dds_sample_rejected_status_kind); size = sizeof (dds_sample_rejected_status_kind);
+      break;
+    default:
+      abort ();
+  }
+#undef alignof
+  *off = (*off + align - 1) & ~(align - 1);
+  const void *p = (const char *) status + *off;
+  *off += size;
+  return p;
+}
+
+static void get_status (int ll, dds_entity_t ent, void *status)
+{
+  dds_return_t ret;
+  switch (ll)
+  {
+    case 2: ret = dds_get_inconsistent_topic_status (ent, status); break;
+    case 3: ret = dds_get_liveliness_changed_status (ent, status); break;
+    case 4: ret = dds_get_liveliness_lost_status (ent, status); break;
+    case 5: ret = dds_get_offered_deadline_missed_status (ent, status); break;
+    case 6: ret = dds_get_offered_incompatible_qos_status (ent, status); break;
+    case 7: ret = dds_get_publication_matched_status (ent, status); break;
+    case 8: ret = dds_get_requested_deadline_missed_status (ent, status); break;
+    case 9: ret = dds_get_requested_incompatible_qos_status (ent, status); break;
+    case 10: ret = dds_get_sample_lost_status (ent, status); break;
+    case 11: ret = dds_get_sample_rejected_status (ent, status); break;
+    case 12: ret = dds_get_subscription_matched_status (ent, status); break;
+    default: abort ();
+  }
+  CU_ASSERT_FATAL (ret == 0);
+}
+
+static void assert_status_change_fields_are_0 (int ll, dds_entity_t ent)
+{
+  if (lldesc[ll].desc)
+  {
+    const char *d = lldesc[ll].desc;
+    void *status = malloc (lldesc[ll].size);
+    get_status (ll, ent, status);
+    size_t off = 0;
+    while (*d)
+    {
+      const uint32_t *p = advance (status, &off, *d);
+      if (*d == 'c')
+        CU_ASSERT_FATAL (*p == 0);
+      d++;
+    }
+    assert (off <= lldesc[ll].size);
+    free (status);
+  }
+}
+
+static int getentity (const char *tok, bool *isbang, bool *ishash)
+{
+  static const char *known = "PRWrstwxy";
+  const char *p;
+  if (isbang)
+    *isbang = false;
+  if (ishash)
+    *ishash = false;
+  if ((p = strchr (known, *tok)) == NULL)
+    return -1;
+  int ent = (int) (p - known);
+  if (*++tok == 0)
+    return ent;
+  if (*tok == '\'')
+  {
+    ent += (int) strlen (known);
+    tok++;
+  }
+  while (*tok == '!' || *tok == '#')
+  {
+    if (strchr (known + 3, *p) == NULL)
+      return -1; // only readers, writers
+    if (*tok == '!' && isbang)
+      *isbang = true;
+    else if (*tok == '#' && ishash)
+      *ishash = true;
+    tok++;
+  }
+  return (*tok == 0) ? ent : -1;
+}
+
+static int getlistener (const char *tok, bool *isbang)
+{
+  // note: sort order is on full name (so sample rejected precedes subscription matched)
+  static const char *ls[] = {
+    "da", "dor", "it", "lc", "ll", "odm", "oiq", "pm", "rdm", "riq", "sl", "sr", "sm"
+  };
+  if (isbang)
+    *isbang = false;
+  for (size_t i = 0; i < sizeof (ls) / sizeof (*ls); i++)
+  {
+    size_t n = strlen (ls[i]);
+    if (strncmp (tok, ls[i], n) == 0 && (tok[n] == 0 || tok[n+1] == ','))
+    {
+      if (isbang)
+        *isbang = (tok[n] == '!');
+      return (int) i;
+    }
+  }
+  return -1;
+}
+
+struct ents {
+  dds_entity_t es[2 * 9];
+  dds_entity_t tps[2];
+  dds_entity_t doms[2];
+  dds_instance_handle_t esi[2 * 9];
+  // built-in topic readers for cross-referencing instance handles
+  dds_entity_t pubrd[2];
+  dds_entity_t subrd[2];
+};
+
+static void make_participant (struct ents *es, const char *topicname, int ent, const dds_qos_t *qos, dds_listener_t *list)
+{
+  const dds_domainid_t domid = (ent < 9) ? 0 : 1;
+  char *conf = ddsrt_expand_envvars ("${CYCLONEDDS_URI}${CYCLONEDDS_URI:+,}<Discovery><ExternalDomainId>0</ExternalDomainId></Discovery>", domid);
+  printf ("create domain %"PRIu32, domid);
+  fflush (stdout);
+  es->doms[domid] = dds_create_domain (domid, conf);
+  CU_ASSERT_FATAL (es->doms[domid] > 0);
+  ddsrt_free (conf);
+  printf (" create participant P%s", (ent < 9) ? "" : "'");
+  fflush (stdout);
+  es->es[ent] = dds_create_participant (domid, NULL, list);
+  CU_ASSERT_FATAL (es->es[ent] > 0);
+  es->tps[domid] = dds_create_topic (es->es[ent], &Space_Type1_desc, topicname, qos, NULL);
+  CU_ASSERT_FATAL (es->tps[domid] > 0);
+
+  // Create the built-in topic readers with a dummy listener to avoid any event (data available comes to mind)
+  // from propagating to the normal data available listener, in case it has been set on the participant.
+  //
+  // - dummy_cb aborts when it is invoked, but all reader-related listeners that can possibly trigger are set
+  //   separately (incompatible qos, deadline missed, sample lost and sample rejected are all impossible by
+  //   construction)
+  // - regarding data_on_readers: Cyclone handles listeners installed on an ancestor by *inheriting* them,
+  //   rather than by walking up ancestor chain. Setting data_on_readers on the reader therefore overrides the
+  //   listener set on the subscriber. It is a nice feature!
+  dds_listener_t *dummylist = dds_create_listener (NULL);
+  set_all_const (dummylist, dummy_cb);
+  dds_lset_data_available (dummylist, dummy_data_available_cb);
+  dds_lset_data_on_readers (dummylist, dummy_data_on_readers_cb);
+  dds_lset_subscription_matched (dummylist, dummy_subscription_matched_cb);
+  dds_lset_liveliness_changed (dummylist, dummy_liveliness_changed_cb);
+  es->pubrd[domid] = dds_create_reader (es->es[ent], DDS_BUILTIN_TOPIC_DCPSPUBLICATION, NULL, dummylist);
+  CU_ASSERT_FATAL (es->pubrd[domid] > 0);
+  es->subrd[domid] = dds_create_reader (es->es[ent], DDS_BUILTIN_TOPIC_DCPSSUBSCRIPTION, NULL, dummylist);
+  CU_ASSERT_FATAL (es->subrd[domid] > 0);
+  dds_delete_listener (dummylist);
+  printf ("pubrd %"PRId32" subrd %"PRId32" sub %"PRId32"\n", es->pubrd[domid], es->subrd[domid], dds_get_parent (es->pubrd[domid]));
+}
+
+static void make_entity1 (struct ents *es, const char *topicname, int ent, bool isbang, bool ishash, const dds_qos_t *qos, dds_qos_t *rwqos, dds_listener_t *list)
+{
+  dds_return_t ret;
+  switch (ent)
+  {
+    case 0: case 9:
+      make_participant (es, topicname, ent, qos, list);
+      break;
+    case 1: case 10:
+      if (es->es[ent-1] == 0)
+      {
+        printf ("[");
+        make_entity1 (es, topicname, ent-1, false, false, qos, rwqos, NULL);
+        printf ("] ");
+      }
+      printf ("create subscriber R%s", (ent < 9) ? "" : "'");
+      fflush (stdout);
+      es->es[ent] = dds_create_subscriber (es->es[ent-1], NULL, list);
+      break;
+    case 2: case 11:
+      if (es->es[ent-2] == 0)
+      {
+        printf ("[");
+        make_entity1 (es, topicname, ent-2, false, false, qos, rwqos, NULL);
+        printf ("] ");
+      }
+      printf ("create publisher W%s", (ent < 9) ? "" : "'");
+      fflush (stdout);
+      es->es[ent] = dds_create_publisher (es->es[ent-2], NULL, list);
+      break;
+    case 3: case 4: case 5: case 12: case 13: case 14:
+      if (es->es[ent < 9 ? 1 : 10] == 0)
+      {
+        printf ("[");
+        make_entity1 (es, topicname, ent < 9 ? 1 : 10, false, false, qos, rwqos, NULL);
+        printf ("] ");
+      }
+      printf ("create %s reader %c%s", isbang ? "best-effort" : "reliable", 'r' + (ent < 9 ? ent-3 : ent-12), (ent < 9) ? "" : "'");
+      fflush (stdout);
+      dds_reset_qos (rwqos);
+      if (isbang)
+        dds_qset_reliability (rwqos, DDS_RELIABILITY_BEST_EFFORT, DDS_MSECS (100));
+      if (ishash)
+        dds_qset_resource_limits (rwqos, 1, DDS_LENGTH_UNLIMITED, DDS_LENGTH_UNLIMITED);
+      es->es[ent] = dds_create_reader (es->es[ent < 9 ? 1 : 10], es->tps[ent < 9 ? 0 : 1], rwqos, list);
+      break;
+    case 6: case 7: case 8: case 15: case 16: case 17:
+      if (es->es[ent < 9 ? 2 : 11] == 0)
+      {
+        printf ("[");
+        make_entity1 (es, topicname, ent < 9 ? 2 : 11, false, false, qos, rwqos, NULL);
+        printf ("] ");
+      }
+      printf ("create %s writer %c%s", isbang ? "best-effort" : "reliable", 'w' + (ent < 9 ? ent-6 : ent-15), (ent < 9) ? "" : "'");
+      fflush (stdout);
+      dds_reset_qos (rwqos);
+      if (isbang)
+        dds_qset_reliability (rwqos, DDS_RELIABILITY_BEST_EFFORT, DDS_MSECS (100));
+      if (ishash)
+        dds_qset_resource_limits (rwqos, 1, DDS_LENGTH_UNLIMITED, DDS_LENGTH_UNLIMITED);
+      es->es[ent] = dds_create_writer (es->es[ent < 9 ? 2 : 11], es->tps[ent < 9 ? 0 : 1], rwqos, list);
+      break;
+    default:
+      abort ();
+  }
+  printf (" = %"PRId32, es->es[ent]);
+  fflush (stdout);
+  CU_ASSERT_FATAL (es->es[ent] > 0);
+  ret = dds_get_instance_handle (es->es[ent], &es->esi[ent]);
+  //printf (" %"PRIx64, es->esi[ent]);
+  //fflush (stdout);
+  CU_ASSERT_FATAL (ret == 0);
+}
+
+static void make_entity (struct ents *es, const char *topicname, int ent, bool isbang, bool ishash, const dds_qos_t *qos, dds_qos_t *rwqos, dds_listener_t *list)
+{
+  make_entity1 (es, topicname, ent, isbang, ishash, qos, rwqos, list);
+  printf ("\n");
+}
+
+static char *strsep_noempty (char **cursor, const char *sep)
+{
+  char *tok;
+  while ((tok = ddsrt_strsep (cursor, sep)) != NULL && *tok == 0) { }
+  return tok;
+}
+
+static dds_instance_handle_t lookup_insthandle (const struct ents *es, int ent, int ent1)
+{
+  // if both are in the same domain, it's easy
+  if (ent / 9 == ent1 / 9)
+    return es->esi[ent1];
+  else
+  {
+    // if they aren't ... find GUID from instance handle in the one domain,
+    // then find instance handle for GUID in the other
+    dds_entity_t rd1 = 0, rd2 = 0;
+    switch (ent1)
+    {
+      case  3: case  4: case  5: rd1 = es->subrd[0]; rd2 = es->subrd[1]; break;
+      case 12: case 13: case 14: rd1 = es->subrd[1]; rd2 = es->subrd[0]; break;
+      case  6: case  7: case  8: rd1 = es->pubrd[0]; rd2 = es->pubrd[1]; break;
+      case 15: case 16: case 17: rd1 = es->pubrd[1]; rd2 = es->pubrd[0]; break;
+      default: abort ();
+    }
+
     dds_return_t ret;
-    RoundTripModule_DataType sample;
-    memset (&sample, 0, sizeof (sample));
-
-    /* Let participant be interested in data. */
-    listener_par = dds_create_listener(NULL);
-    CU_ASSERT_PTR_NOT_NULL_FATAL(listener_par);
-    dds_lset_data_on_readers(listener_par, data_on_readers_cb);
-    ret = dds_set_listener(g_participant, listener_par);
-    CU_ASSERT_EQUAL_FATAL(ret, DDS_RETCODE_OK);
-    dds_delete_listener(listener_par);
-
-    /* Let publisher be interested in publication matched. */
-    listener_pub = dds_create_listener(NULL);
-    CU_ASSERT_PTR_NOT_NULL_FATAL(listener_pub);
-    dds_lset_publication_matched(listener_pub, publication_matched_cb);
-    ret = dds_set_listener(g_publisher, listener_pub);
-    CU_ASSERT_EQUAL_FATAL(ret, DDS_RETCODE_OK);
-    dds_delete_listener(listener_pub);
-
-    /* Let subscriber be interested in subscription matched. */
-    listener_sub = dds_create_listener(NULL);
-    CU_ASSERT_PTR_NOT_NULL_FATAL(listener_pub);
-    dds_lset_subscription_matched(listener_sub, subscription_matched_cb);
-    ret = dds_set_listener(g_subscriber, listener_sub);
-    CU_ASSERT_EQUAL_FATAL(ret, DDS_RETCODE_OK);
-    dds_delete_listener(listener_sub);
-
-    /* Create reader and writer without listeners. */
-    g_reader = dds_create_reader(g_subscriber, g_topic, g_qos, NULL);
-    CU_ASSERT_FATAL(g_reader > 0);
-    g_writer = dds_create_writer(g_publisher, g_topic, g_qos, NULL);
-    CU_ASSERT_FATAL(g_writer > 0);
-
-    /* Publication and Subscription should be matched. */
-    triggered = waitfor_cb(DDS_PUBLICATION_MATCHED_STATUS | DDS_SUBSCRIPTION_MATCHED_STATUS);
-    CU_ASSERT_EQUAL_FATAL(triggered & DDS_SUBSCRIPTION_MATCHED_STATUS, DDS_SUBSCRIPTION_MATCHED_STATUS);
-    CU_ASSERT_EQUAL_FATAL(triggered & DDS_PUBLICATION_MATCHED_STATUS,  DDS_PUBLICATION_MATCHED_STATUS);
-    CU_ASSERT_EQUAL_FATAL(cb_writer, g_writer);
-    CU_ASSERT_EQUAL_FATAL(cb_reader, g_reader);
-
-    /* Write sample. */
-    ret = dds_write(g_writer, &sample);
-    CU_ASSERT_EQUAL_FATAL(ret, DDS_RETCODE_OK);
-
-    /* Data on readers should be triggered with the right status. */
-    triggered = waitfor_cb(DDS_DATA_ON_READERS_STATUS);
-    CU_ASSERT_EQUAL_FATAL(triggered & DDS_DATA_ON_READERS_STATUS, DDS_DATA_ON_READERS_STATUS);
-    CU_ASSERT_EQUAL_FATAL(cb_subscriber, g_subscriber);
-    CU_ASSERT_NOT_EQUAL_FATAL(triggered & DDS_DATA_AVAILABLE_STATUS, DDS_DATA_AVAILABLE_STATUS);
-
-    dds_delete(g_writer);
-    dds_delete(g_reader);
+    dds_builtintopic_endpoint_t keysample;
+    //printf ("(in %"PRId32" %"PRIx64" -> ", rd1, es->esi[ent1]);
+    //fflush (stdout);
+    ret = dds_instance_get_key (rd1, es->esi[ent1], &keysample);
+    CU_ASSERT_FATAL (ret == 0);
+    // In principle, only key fields are set in sample returned by get_key;
+    // in the case of a built-in topic that is extended to the participant
+    // key. The qos and topic/type names should not be set, and there is no
+    // (therefore) memory allocated for the sample.
+    CU_ASSERT_FATAL (keysample.qos == NULL);
+    CU_ASSERT_FATAL (keysample.topic_name == NULL);
+    CU_ASSERT_FATAL (keysample.type_name == NULL);
+    //for (size_t j = 0; j < sizeof (keysample.key.v); j++)
+    //  printf ("%s%02x", (j > 0 && j % 4 == 0) ? ":" : "", keysample.key.v[j]);
+    const dds_instance_handle_t ih = dds_lookup_instance (rd2, &keysample);
+    CU_ASSERT_FATAL (ih != 0);
+    //printf (" -> %"PRIx64")", ih);
+    //fflush (stdout);
+    return ih;
+  }
 }
 
-
-CU_Test(ddsc_listener, matched, .init=init_triggering_base, .fini=fini_triggering_base)
+static void checkstatus (int ll, const struct ents *es, int ent, const char *args, const void *status)
 {
-    uint32_t triggered;
-
-    /* We will basically do the same as the 'normal' init_triggering_test() and
-     * fini_triggering_test() calls. It's just that we do it in a different
-     * order and use the participant iso subscriber and publisher. */
-
-    /* We are interested in matched notifications. */
-    dds_lset_publication_matched(g_listener, publication_matched_cb);
-    dds_lset_subscription_matched(g_listener, subscription_matched_cb);
-
-    /* Create reader and writer with proper listeners.
-     * The creation order is deliberately different from publication_matched and subscription_matched. */
-    g_reader = dds_create_reader(g_participant, g_topic, g_qos, g_listener);
-    CU_ASSERT_FATAL(g_reader > 0);
-    g_writer = dds_create_writer(g_participant, g_topic, g_qos, g_listener);
-    CU_ASSERT_FATAL(g_writer > 0);
-
-    /* Both matched should be triggered on the right entities. */
-    triggered = waitfor_cb(DDS_PUBLICATION_MATCHED_STATUS | DDS_SUBSCRIPTION_MATCHED_STATUS);
-    CU_ASSERT_EQUAL_FATAL(triggered & DDS_SUBSCRIPTION_MATCHED_STATUS, DDS_SUBSCRIPTION_MATCHED_STATUS);
-    CU_ASSERT_EQUAL_FATAL(triggered & DDS_PUBLICATION_MATCHED_STATUS,  DDS_PUBLICATION_MATCHED_STATUS);
-    CU_ASSERT_EQUAL_FATAL(cb_writer, g_writer);
-    CU_ASSERT_EQUAL_FATAL(cb_reader, g_reader);
-
-    dds_delete(g_writer);
-    dds_delete(g_reader);
+  DDSRT_WARNING_MSVC_OFF(4996); // use of sscanf triggers a warning
+  if (*args == 0)
+    return;
+  if (*args++ != '(')
+    abort ();
+  assert (lldesc[ll].desc != NULL);
+  const char *d = lldesc[ll].desc;
+  const char *sep = "(";
+  size_t off = 0;
+  while (*d)
+  {
+    const void *p = advance (status, &off, *d);
+    char str[32];
+    unsigned u;
+    int i, pos = -1;
+    switch (*d)
+    {
+      case 'n':
+        if (sscanf (args, "%u%n", &u, &pos) != 1 || (args[pos] != ',' && args[pos] != ')'))
+          abort ();
+        printf ("%s%"PRIu32" %u", sep, *(uint32_t *)p, u); fflush (stdout);
+        CU_ASSERT_FATAL (*(uint32_t *)p == u);
+        break;
+      case 'c':
+        if (sscanf (args, "%d%n", &i, &pos) != 1 || (args[pos] != ',' && args[pos] != ')'))
+          abort ();
+        printf ("%s%"PRId32" %d", sep, *(int32_t *)p, i); fflush (stdout);
+        CU_ASSERT_FATAL (*(int32_t *)p == i);
+        break;
+      case 'P': // policy id: currently fixed at reliability
+        pos = -1; // not actually consuming an argument
+        printf ("%s%"PRIu32" %d", sep, *(uint32_t *)p, (int) DDS_RELIABILITY_QOS_POLICY_ID); fflush (stdout);
+        CU_ASSERT_FATAL (*(uint32_t *)p == (uint32_t) DDS_RELIABILITY_QOS_POLICY_ID);
+        break;
+      case 'R':
+        if (sscanf (args, "%31[^,)]%n", str, &pos) != 1 || (args[pos] != ',' && args[pos] != ')'))
+          abort ();
+        if (strcmp (str, "i") == 0)
+          i = (int) DDS_REJECTED_BY_INSTANCES_LIMIT;
+        else if (strcmp (str, "s") == 0)
+          i = (int) DDS_REJECTED_BY_SAMPLES_LIMIT;
+        else if (strcmp (str, "spi") == 0)
+          i = (int) DDS_REJECTED_BY_SAMPLES_PER_INSTANCE_LIMIT;
+        else
+          abort ();
+        printf ("%s%d %d", sep, (int) *(dds_sample_rejected_status_kind *)p, i); fflush (stdout);
+        CU_ASSERT_FATAL (*(dds_sample_rejected_status_kind *)p == (dds_sample_rejected_status_kind) i);
+        break;
+      case 'I': // instance handle is too complicated
+        pos = -1; // not actually consuming an argument
+        break;
+      case 'E': {
+        int ent1 = -1;
+        dds_instance_handle_t esi1 = 0;
+        if (sscanf (args, "%31[^,)]%n", str, &pos) != 1 || (args[pos] != ',' && args[pos] != ')'))
+          abort ();
+        if (strcmp (str, "*") != 0 && (ent1 = getentity (str, NULL, NULL)) < 0)
+          abort ();
+        if (ent1 != -1)
+          esi1 = lookup_insthandle (es, ent, ent1);
+        printf ("%s%"PRIx64" %"PRIx64, sep, *(dds_instance_handle_t *)p, esi1); fflush (stdout);
+        CU_ASSERT_FATAL (ent1 == -1 || *(dds_instance_handle_t *)p == esi1);
+        break;
+      }
+      default: abort ();
+    }
+    args += pos + 1;
+    sep = ", ";
+    d++;
+  }
+  printf (")");
+  assert (*args == 0);
+  assert (off <= lldesc[ll].size);
+  DDSRT_WARNING_MSVC_ON(4996);
 }
 
-CU_Test(ddsc_listener, publication_matched, .init=init_triggering_test, .fini=fini_triggering_test)
+/** @brief run a "test" consisting of a sequence of simplish operations
+ *
+ * This operation takes a test description, really a program in a bizarre syntax, and executes it.  Any failures,
+ * be it because of error codes coming out of the Cyclone calls or expected values being wrong cause it to fail
+ * the test via CU_ASSERT_FATAL. While it is doing this, it outputs the test steps to stdout including some
+ * actual values. An invalid program is mostly reported by calling abort(). It is geared towards checking for
+ * listener invocations and the effects on statuses.
+ *
+ * Entities in play:
+ *
+ * - participants:   P      P'
+ * - subscribers:    R      R'
+ * - publishers:     W      W'
+ * - readers:        r s t  r' s' t'
+ * - writers:        w x y  w' x' y'
+ *
+ * The unprimed ones exist in domain 0, the primed ones in domain 1 (but configured such that it talks to
+ * domain 0), so that network-related listener invocations can be checked as well.
+ *
+ * The first mention of an entity creates it as well as its ancestors.  Implicitly created ancestors always have
+ * standard QoS and have no listeners. There is one topic that is created implicitly when the participant is
+ * created.
+ *
+ * Standard QoS is: default + reliable (100ms), by-source-timestamp, keep-all.
+ * The QoS of a reader/writer can be altered at the first mention of it by suffixing its name with "!" and/or "#"
+ * (the apostrophe is part of the name, so w#! or r'! are valid). Those suffixes are ignored if the entity
+ * already exists.
+ *
+ * A program consists of a sequence of operations separated by whitespace, ';' or '/' (there is no meaning to the
+ * separators, they exist to allow visual grouping):
+ *
+ * PROGRAM     ::= (OP (\s+|[/;])*)*
+ *
+ * OP          ::= (LISTENER)* ENTITY-NAME
+ *                       if entity ENTITY-NAME does not exist:
+ *                         creates the entity with the given listeners installed
+ *                       else
+ *                         changes the entity's listeners to the specified ones
+ *                       (see above for the valid ENTITY-NAMEs)
+ *               | -ENTITY-NAME
+ *                       deletes the specified entity
+ *               | WRITE-LIKE[fail][@DT] KEY <entity name>
+ *                       writes/disposes/unregisters key KEY (an integer), if "fail" is appended, the
+ *                       expectation is that it fails with a timeout, if @DT is appended, the timestamp is the
+ *                       start time of the test + <dt>s rather than the current time; DT is a floating-point
+ *                       number
+ *               | READ-LIKE[(A,B))] <entity name>
+ *                       reads/takes at most 10 samples, counting the number of valid and invalid samples seen
+ *                       and checking it against A and B if given
+ *               | ?LISTENER[(ARGS)] <entity name>
+ *                       waits until the specified listener has been invoked on <entity name> using a flag set
+ *                       by the listener function, resets the flag and verifies that neither the entity status
+ *                       bit nor the "change" fields in the various statuses were set
+ *                       ARGS is used to check the status argument most recently passed to the listener:
+ *                         it        (A,B) verifies count and change match A and B, policy matches RELIABILITY
+ *                         lc        (A,B,C,D,E) verifies that alive and not-alive counts match A and B, that
+ *                                   alive and not-alive changes match C and D and that the last handle matches
+ *                                   E if an entity name (ignored if E = "*")
+ *                         ll        (A,B) verifies count and change match A and B
+ *                         odm       (A,B) verifies count and change match A and B, last handle is ignored
+ *                         oiq       (A,B) verifies that total count and change match A and B and that the
+ *                                   mismatching QoS is reliability (the only one that can for now)
+ *                         pm        (A,B,C,D,E) verifies that total count and change match A and B, that
+ *                                   current count and change match C and D and that the last handle matches E
+ *                                   if an entity name (ignored if E = "*")
+ *                         rdm       see odm
+ *                         riq       see oiq
+ *                         sl        (A,B) verifies that total count and change match A and B
+ *                         sr        (A,B,C) verifies total count and change match A and B, and that the reason
+ *                                   matches C (one of "s" for samples, "i" for instances, "spi" for samples
+ *                                   per instance)
+ *                         sm        see pm
+ *               | ?!LISTENER
+ *                       (not listener) tests that LISTENER has not been invoked since last reset
+ *               | sleep D
+ *                       delay program execution for D s (D is a floating-point number)
+ * WRITE-LIKE  ::= wr    write
+ *               | wrdisp  write-dispose
+ *               | disp  dispose
+ *               | unreg unregister
+ * READ-LIKE   ::= read  dds_read (so any state)
+ *               | take  dds_take (so any state)
+ * LISTENER    ::= da    data available (acts on a reader)
+ *               | dor   data on readers (acts on a subcsriber)
+ *               | it    incompatible topic (acts on a topic)
+ *               | lc    liveliness changed (acts on a reader)
+ *               | ll    liveliness lost (acts on a writer)
+ *               | odm   offered deadline missed (acts on a writer)
+ *               | oiq   offered incompatible QoS (acts on a writer)
+ *               | pm    publication matched (acts on a writer)
+ *               | rdm   requested deadline missed (acts on a reader)
+ *               | riq   requested incompatible QoS (acts on a reader)
+ *               | sl    sample lost (acts on a reader)
+ *               | sr    sample rejected (acts on a reader)
+ *               | sm    subscription matched (acts on a reader)
+ *
+ * All entities share the listeners with their global state. Only the latest invocation is visible.
+ *
+ * @param[in]  ops  Program to execute.
+ */
+static void dotest (const char *ops)
 {
-    dds_publication_matched_status_t publication_matched;
-    dds_instance_handle_t reader_hdl;
-    dds_return_t ret;
-    uint32_t triggered;
-    uint32_t status;
+  DDSRT_WARNING_MSVC_OFF(4996); // use of sscanf triggers a warning
+  static const char *sep = " /;\n\t\r\v";
+  char *opscopy = ddsrt_strdup (ops), *cursor = opscopy, *tok;
+  struct ents es;
+  dds_return_t ret;
+  Space_Type1 sample;
+  char topicname[100];
+  dds_qos_t *qos = dds_create_qos (), *rwqos = dds_create_qos ();
+  dds_listener_t *list = dds_create_listener (NULL);
+  const dds_time_t tref = dds_time ();
+  CU_ASSERT_FATAL (qos != NULL);
+  CU_ASSERT_FATAL (rwqos != NULL);
+  CU_ASSERT_FATAL (list != NULL);
+  dds_qset_reliability (qos, DDS_RELIABILITY_RELIABLE, DDS_MSECS (100));
+  dds_qset_destination_order (qos, DDS_DESTINATIONORDER_BY_SOURCE_TIMESTAMP);
+  dds_qset_history (qos, DDS_HISTORY_KEEP_ALL, 0);
+  memset (&es, 0, sizeof (es));
+  memset (&sample, 0, sizeof (sample));
 
-    /* Get reader handle that should be part of the status. */
-    ret = dds_get_instance_handle(g_reader, &reader_hdl);
-    CU_ASSERT_EQUAL_FATAL(ret, DDS_RETCODE_OK);
+  ddsrt_mutex_init (&g_mutex);
+  ddsrt_cond_init (&g_cond);
+  ddsrt_mutex_lock (&g_mutex);
+  cb_called = 0;
+  ddsrt_mutex_unlock (&g_mutex);
 
-    /* Publication matched should be triggered with the right status. */
-    triggered = waitfor_cb(DDS_PUBLICATION_MATCHED_STATUS);
-    CU_ASSERT_EQUAL_FATAL(triggered & DDS_PUBLICATION_MATCHED_STATUS, DDS_PUBLICATION_MATCHED_STATUS);
-    CU_ASSERT_EQUAL_FATAL(cb_writer, g_writer);
-    CU_ASSERT_EQUAL_FATAL(cb_publication_matched_status.current_count, 1);
-    CU_ASSERT_EQUAL_FATAL(cb_publication_matched_status.current_count_change, 1);
-    CU_ASSERT_EQUAL_FATAL(cb_publication_matched_status.total_count, 1);
-    CU_ASSERT_EQUAL_FATAL(cb_publication_matched_status.total_count_change, 1);
-    CU_ASSERT_EQUAL_FATAL(cb_publication_matched_status.last_subscription_handle, reader_hdl);
+  create_unique_topic_name ("ddsc_listener_test", topicname, 100);
+  printf ("dotest: %s\n", ops);
+  printf ("topic: %s\n", topicname);
+  while ((tok = strsep_noempty (&cursor, sep)) != NULL)
+  {
+    int ent, ll;
+    bool isbang, ishash;
+    if ((ent = getentity (tok, &isbang, &ishash)) >= 0)
+    {
+      make_entity (&es, topicname, ent, isbang, ishash, qos, rwqos, NULL);
+    }
+    else if (*tok == '-' && (ent = getentity (tok + 1, NULL, NULL)) >= 0)
+    {
+      // delete deliberately leaves the instance handle in place for checking
+      // the publication/subscription handle in subscription matched/publication
+      // matched for a lost match
+      printf ("delete %"PRId32"\n", es.es[ent]);
+      ret = dds_delete (es.es[ent]);
+      CU_ASSERT_FATAL (ret == 0);
+      es.es[ent] = 0;
+    }
+    else if ((ll = getlistener (tok, &isbang)) >= 0)
+    {
+      printf ("set listener:");
+      dds_reset_listener (list);
+      do {
+        printf (" %s", tok);
+        switch (ll)
+        {
+          case 0: dds_lset_data_available (list, isbang ? 0 : data_available_cb); break;
+          case 1: dds_lset_data_on_readers (list, isbang ? 0 : data_on_readers_cb); break;
+          case 2: dds_lset_inconsistent_topic (list, isbang ? 0: inconsistent_topic_cb); break;
+          case 3: dds_lset_liveliness_changed (list, isbang ? 0 : liveliness_changed_cb); break;
+          case 4: dds_lset_liveliness_lost (list, isbang ? 0 : liveliness_lost_cb); break;
+          case 5: dds_lset_offered_deadline_missed (list, isbang ? 0 : offered_deadline_missed_cb); break;
+          case 6: dds_lset_offered_incompatible_qos (list, isbang ? 0 : offered_incompatible_qos_cb); break;
+          case 7: dds_lset_publication_matched (list, isbang ? 0 : publication_matched_cb); break;
+          case 8: dds_lset_requested_deadline_missed (list, isbang ? 0 : requested_deadline_missed_cb); break;
+          case 9: dds_lset_requested_incompatible_qos (list, isbang ? 0 : requested_incompatible_qos_cb); break;
+          case 10: dds_lset_sample_lost (list, isbang ? 0 : sample_lost_cb); break;
+          case 11: dds_lset_sample_rejected (list, isbang ? 0 : sample_rejected_cb); break;
+          case 12: dds_lset_subscription_matched (list, isbang ? 0 : subscription_matched_cb); break;
+          default: abort ();
+        }
+      } while ((tok = strsep_noempty (&cursor, sep)) != NULL && (ll = getlistener (tok, &isbang)) >= 0);
+      if (tok == NULL || (ent = getentity (tok, &isbang, &ishash)) < 0)
+        abort ();
+      if (es.es[ent] == 0)
+      {
+        printf (" for ");
+        make_entity (&es, topicname, ent, isbang, ishash, qos, rwqos, list);
+      }
+      else
+      {
+        dds_listener_t *tmplist = dds_create_listener (NULL);
+        CU_ASSERT_FATAL (tmplist != NULL);
+        ret = dds_get_listener (es.es[ent], tmplist);
+        CU_ASSERT_FATAL (ret == 0);
+        dds_merge_listener (list, tmplist);
+        dds_delete_listener (tmplist);
+        printf (" on entity %"PRId32"\n", es.es[ent]);
+        ret = dds_set_listener (es.es[ent], list);
+        CU_ASSERT_FATAL (ret == 0);
+      }
+    }
+    else if (strncmp (tok, "wr", 2) == 0 || strncmp (tok, "disp", 4) == 0 || strncmp (tok, "unreg", 5) == 0)
+    {
+      dds_return_t (*fn) (dds_entity_t wr, const void *sample, dds_time_t ts) = 0;
+      double dt = 0.0;
+      dds_time_t ts = dds_time ();
+      char *cmd = tok;
+      bool expectfail = false;
+      int off, pos, key;
+      if ((tok = strsep_noempty (&cursor, sep)) == NULL)
+        abort ();
+      if (sscanf (tok, "%d%n", &key, &pos) != 1 || tok[pos] != 0)
+        abort ();
+      if ((tok = strsep_noempty (&cursor, sep)) == NULL || (ent = getentity (tok, &isbang, &ishash)) < 0)
+        abort ();
+      if (es.es[ent] == 0)
+        make_entity (&es, topicname, ent, isbang, ishash, qos, rwqos, NULL);
+      switch (cmd[0])
+      {
+        case 'w':
+          if (strncmp (cmd + 2, "disp", 4) == 0) {
+            off = 6; fn = dds_writedispose_ts;
+          } else {
+            off = 2; fn = dds_write_ts;
+          }
+          break;
+        case 'd': off = 4; fn = dds_dispose_ts; break;
+        case 'u': off = 5; fn = dds_unregister_instance_ts; break;
+        default: abort ();
+      }
+      if (strncmp (cmd + off, "fail", 4) == 0)
+      {
+        expectfail = true;
+        off += 4;
+      }
+      if (cmd[off] == '@')
+      {
+        if (sscanf (cmd + off, "@%lf%n", &dt, &pos) != 1 || cmd[off + pos] != 0)
+          abort ();
+        ts = tref + (dds_time_t) (dt * 1e9);
+      }
+      sample.long_1 = key;
+      printf ("entity %"PRId32": %*.*s@%"PRId64".%09"PRId64" %d\n", es.es[ent], off, off, cmd, ts / DDS_NSECS_IN_SEC, ts % DDS_NSECS_IN_SEC, key);
+      ret = fn (es.es[ent], &sample, ts);
+      if (expectfail) {
+        CU_ASSERT_FATAL (ret == DDS_RETCODE_TIMEOUT);
+      } else {
+        CU_ASSERT_FATAL (ret == 0);
+      }
+    }
+    else if (strncmp (tok, "take", 4) == 0 || strncmp(tok, "read", 4) == 0)
+    {
+      char *args = (tok[4] ? tok + 4 : NULL);
+      int exp_nvalid = -1, exp_ninvalid = -1, pos;
+      dds_return_t (*fn) (dds_entity_t, void **buf, dds_sample_info_t *, size_t, uint32_t);
+      fn = (strncmp (tok, "take", 4) == 0) ? dds_take : dds_read;
+      assert (args == NULL || *args == '(');
+      if (args && (sscanf (args, "(%d,%d)%n", &exp_nvalid, &exp_ninvalid, &pos) != 2 || args[pos] != 0))
+        abort ();
+      if ((tok = strsep_noempty (&cursor, sep)) == NULL || (ent = getentity (tok, &isbang, &ishash)) < 0)
+        abort ();
+      if (es.es[ent] == 0)
+        make_entity (&es, topicname, ent, isbang, ishash, qos, rwqos, NULL);
+      printf ("entity %"PRId32": %s", es.es[ent], (fn == dds_take) ? "take" : "read");
+      fflush (stdout);
+      void *raw[10] = { NULL };
+      dds_sample_info_t si[10];
+      const uint32_t maxs = (uint32_t) (sizeof (raw) / sizeof (raw[0]));
+      int count[2] = { 0, 0 };
+      ret = fn (es.es[ent], raw, si, maxs, maxs);
+      CU_ASSERT_FATAL (ret >= 0);
+      for (int32_t i = 0; i < ret; i++)
+        count[si[i].valid_data]++;
+      ret = dds_return_loan (es.es[ent], raw, ret);
+      CU_ASSERT_FATAL (ret == 0);
+      printf (" valid %d %d invalid %d %d\n", count[1], exp_nvalid, count[0], exp_ninvalid);
+      if (exp_nvalid >= 0)
+        CU_ASSERT_FATAL (count[1] == exp_nvalid);
+      if (exp_ninvalid >= 0)
+        CU_ASSERT_FATAL (count[0] == exp_ninvalid);
+    }
+    else if (tok[0] == '?')
+    {
+      const bool expectclear = (tok[1] == '!');
+      const char *llname = tok + (expectclear ? 2 : 1);
+      char *checkargs;
+      if ((checkargs = strchr (llname, '(')) != NULL)
+        *checkargs = 0; // clear so getlistener groks the input
+      if ((ll = getlistener (llname, NULL)) < 0)
+        abort ();
+      if (expectclear)
+      {
+        printf ("listener %s: check not called", llname);
+        fflush (stdout);
+        ddsrt_mutex_lock (&g_mutex);
+        printf (" cb_called %"PRIx32" %s\n", cb_called, (cb_called & lldesc[ll].mask) == 0 ? "ok" : "fail");
+        CU_ASSERT_FATAL ((cb_called & lldesc[ll].mask) == 0);
+        ddsrt_mutex_unlock (&g_mutex);
+      }
+      else
+      {
+        bool signalled = true;
+        uint32_t status;
+        if ((tok = strsep_noempty (&cursor, sep)) == NULL || (ent = getentity (tok, &isbang, &ishash)) < 0)
+          abort ();
+        if (es.es[ent] == 0)
+          make_entity (&es, topicname, ent, isbang, ishash, qos, rwqos, NULL);
+        if ((size_t) ll >= sizeof (lldesc) / sizeof (*lldesc))
+          abort ();
+        printf ("listener %s: check called for entity %"PRId32, llname, es.es[ent]);
+        fflush (stdout);
+        ddsrt_mutex_lock (&g_mutex);
+        while ((cb_called & lldesc[ll].mask) == 0 && signalled)
+          signalled = ddsrt_cond_waitfor (&g_cond, &g_mutex, DDS_SECS (5));
+        printf (" cb_called %"PRIx32" (%s)", cb_called, (cb_called & lldesc[ll].mask) != 0 ? "ok" : "fail");
+        fflush (stdout);
+        CU_ASSERT_FATAL ((cb_called & lldesc[ll].mask) != 0);
+        printf (" cb_entity %"PRId32" %"PRId32" (%s)", *lldesc[ll].cb_entity, es.es[ent], (*lldesc[ll].cb_entity == es.es[ent]) ? "ok" : "fail");
+        fflush (stdout);
+        CU_ASSERT_FATAL (*lldesc[ll].cb_entity == es.es[ent]);
+        if (!(es.doms[0] && es.doms[1]))
+        {
+          // FIXME: two domains: listener invocation happens on another thread and we can observe non-0 "change" fields
+          // they get updated, listener gets invoked, then they get reset -- pretty sure it is allowed by the spec, but
+          // not quite elegant
+          assert_status_change_fields_are_0 (ll, es.es[ent]);
+        }
+        if (checkargs && lldesc[ll].cb_status)
+        {
+          *checkargs = '('; // restore ( so checkargs function gets a more sensible input
+          checkstatus (ll, &es, ent, checkargs, lldesc[ll].cb_status);
+        }
+        printf ("\n");
+        cb_called &= ~lldesc[ll].mask;
+        ddsrt_mutex_unlock (&g_mutex);
+        ret = dds_get_status_changes (es.es[ent], &status);
+        CU_ASSERT_FATAL (ret == 0);
+        CU_ASSERT_FATAL ((status & lldesc[ll].mask) == 0);
+      }
+    }
+    else if (strcmp (tok, "sleep") == 0)
+    {
+      if ((tok = strsep_noempty (&cursor, sep)) == NULL)
+        abort ();
+      double d; int pos;
+      if (sscanf (tok, "%lf%n", &d, &pos) != 1 || tok[pos] != 0)
+        abort ();
+      printf ("sleep %fs\n", d);
+      dds_sleepfor ((dds_duration_t) (d * 1e9));
+    }
+    else
+    {
+      printf ("tok '%s': unrecognized\n", tok);
+      abort ();
+    }
+  }
 
-    /* The listener should have swallowed the status. */
-    ret = dds_read_status(g_writer, &status, DDS_PUBLICATION_MATCHED_STATUS);
-    CU_ASSERT_EQUAL_FATAL(ret, DDS_RETCODE_OK);
-    CU_ASSERT_EQUAL_FATAL(status, 0);
-
-    /* The listener should have reset the count_change. */
-    ret = dds_get_publication_matched_status(g_writer, &publication_matched);
-    CU_ASSERT_EQUAL_FATAL(ret, DDS_RETCODE_OK);
-    CU_ASSERT_EQUAL_FATAL(publication_matched.current_count,        1);
-    CU_ASSERT_EQUAL_FATAL(publication_matched.current_count_change, 0);
-    CU_ASSERT_EQUAL_FATAL(publication_matched.total_count,          1);
-    CU_ASSERT_EQUAL_FATAL(publication_matched.total_count_change,   0);
-    CU_ASSERT_EQUAL_FATAL(publication_matched.last_subscription_handle, reader_hdl);
-
-    /* Reset the trigger flags. */
-    ddsrt_mutex_lock(&g_mutex);
-    cb_called = 0;
-    ddsrt_mutex_unlock(&g_mutex);
-
-    /* Un-match the publication by deleting the reader. */
-    dds_delete(g_reader);
-
-    /* Publication matched should be triggered with the right status. */
-    triggered = waitfor_cb(DDS_PUBLICATION_MATCHED_STATUS);
-    CU_ASSERT_EQUAL_FATAL(triggered & DDS_PUBLICATION_MATCHED_STATUS, DDS_PUBLICATION_MATCHED_STATUS);
-    CU_ASSERT_EQUAL_FATAL(cb_writer, g_writer);
-    CU_ASSERT_EQUAL_FATAL(cb_publication_matched_status.current_count, 0);
-    CU_ASSERT_EQUAL_FATAL(cb_publication_matched_status.current_count_change, -1);
-    CU_ASSERT_EQUAL_FATAL(cb_publication_matched_status.total_count, 1);
-    CU_ASSERT_EQUAL_FATAL(cb_publication_matched_status.total_count_change, 0);
-    CU_ASSERT_EQUAL_FATAL(cb_publication_matched_status.last_subscription_handle, reader_hdl);
-
-    /* The listener should have reset the count_change. */
-    ret = dds_get_publication_matched_status(g_writer, &publication_matched);
-    CU_ASSERT_EQUAL_FATAL(ret, DDS_RETCODE_OK);
-    CU_ASSERT_EQUAL_FATAL(publication_matched.current_count,        0);
-    CU_ASSERT_EQUAL_FATAL(publication_matched.current_count_change, 0);
-    CU_ASSERT_EQUAL_FATAL(publication_matched.total_count,          1);
-    CU_ASSERT_EQUAL_FATAL(publication_matched.total_count_change,   0);
-    CU_ASSERT_EQUAL_FATAL(publication_matched.last_subscription_handle, reader_hdl);
+  dds_delete_listener (list);
+  dds_delete_qos (rwqos);
+  dds_delete_qos (qos);
+  // prevent any listeners from being invoked so we can safely delete the
+  // mutex and the condition variable -- must do this going down the
+  // hierarchy, or listeners may remain set through inheritance
+  for (size_t i = 0; i < sizeof (es.es) / sizeof (es.es[0]); i++)
+  {
+    if (es.es[i])
+    {
+      ret = dds_set_listener (es.es[i], NULL);
+      CU_ASSERT_FATAL (ret == 0);
+    }
+  }
+  ddsrt_mutex_destroy (&g_mutex);
+  ddsrt_cond_destroy (&g_cond);
+  for (size_t i = 0; i < sizeof (es.doms) / sizeof (es.doms[0]); i++)
+  {
+    if (es.doms[i])
+    {
+      ret = dds_delete (es.doms[i]);
+      CU_ASSERT_FATAL (ret == 0);
+    }
+  }
+  ddsrt_free (opscopy);
+  DDSRT_WARNING_MSVC_ON(4996);
 }
 
-CU_Test(ddsc_listener, subscription_matched, .init=init_triggering_test, .fini=fini_triggering_test)
+/**************************************************
+ ****                                          ****
+ ****  listener invocation checks              ****
+ ****                                          ****
+ **************************************************/
+
+CU_Test (ddsc_listener, propagation)
 {
-    dds_subscription_matched_status_t subscription_matched;
-    dds_instance_handle_t writer_hdl;
-    dds_return_t ret;
-    uint32_t triggered;
-    uint32_t status;
-
-    /* Get writer handle that should be part of the status. */
-    ret = dds_get_instance_handle(g_writer, &writer_hdl);
-    CU_ASSERT_EQUAL_FATAL(ret, DDS_RETCODE_OK);
-
-    /* Subscription matched should be triggered with the right status. */
-    triggered = waitfor_cb(DDS_SUBSCRIPTION_MATCHED_STATUS);
-    CU_ASSERT_EQUAL_FATAL(triggered & DDS_SUBSCRIPTION_MATCHED_STATUS, DDS_SUBSCRIPTION_MATCHED_STATUS);
-    CU_ASSERT_EQUAL_FATAL(cb_reader, g_reader);
-    CU_ASSERT_EQUAL_FATAL(cb_subscription_matched_status.current_count, 1);
-    CU_ASSERT_EQUAL_FATAL(cb_subscription_matched_status.current_count_change, 1);
-    CU_ASSERT_EQUAL_FATAL(cb_subscription_matched_status.total_count, 1);
-    CU_ASSERT_EQUAL_FATAL(cb_subscription_matched_status.total_count_change, 1);
-    CU_ASSERT_EQUAL_FATAL(cb_subscription_matched_status.last_publication_handle, writer_hdl);
-
-    /* The listener should have swallowed the status. */
-    ret = dds_read_status(g_reader, &status, DDS_SUBSCRIPTION_MATCHED_STATUS);
-    CU_ASSERT_EQUAL_FATAL(ret, DDS_RETCODE_OK);
-    CU_ASSERT_EQUAL_FATAL(status, 0);
-
-    /* The listener should have reset the count_change. */
-    ret = dds_get_subscription_matched_status(g_reader, &subscription_matched);
-    CU_ASSERT_EQUAL_FATAL(ret, DDS_RETCODE_OK);
-    CU_ASSERT_EQUAL_FATAL(subscription_matched.current_count, 1);
-    CU_ASSERT_EQUAL_FATAL(subscription_matched.current_count_change, 0);
-    CU_ASSERT_EQUAL_FATAL(subscription_matched.total_count, 1);
-    CU_ASSERT_EQUAL_FATAL(subscription_matched.total_count_change, 0);
-    CU_ASSERT_EQUAL_FATAL(subscription_matched.last_publication_handle, writer_hdl);
-
-    /* Reset the trigger flags. */
-    ddsrt_mutex_lock(&g_mutex);
-    cb_called = 0;
-    ddsrt_mutex_unlock(&g_mutex);
-
-    /* Un-match the subscription by deleting the writer. */
-    dds_delete(g_writer);
-
-    /* Subscription matched should be triggered with the right status. */
-    triggered = waitfor_cb(DDS_SUBSCRIPTION_MATCHED_STATUS);
-    CU_ASSERT_EQUAL_FATAL(triggered & DDS_SUBSCRIPTION_MATCHED_STATUS, DDS_SUBSCRIPTION_MATCHED_STATUS);
-    CU_ASSERT_EQUAL_FATAL(cb_reader, g_reader);
-    CU_ASSERT_EQUAL_FATAL(cb_subscription_matched_status.current_count, 0);
-    CU_ASSERT_EQUAL_FATAL(cb_subscription_matched_status.current_count_change, -1);
-    CU_ASSERT_EQUAL_FATAL(cb_subscription_matched_status.total_count, 1);
-    CU_ASSERT_EQUAL_FATAL(cb_subscription_matched_status.total_count_change, 0);
-    CU_ASSERT_EQUAL_FATAL(cb_subscription_matched_status.last_publication_handle, writer_hdl);
-
-    /* The listener should have reset the count_change. */
-    ret = dds_get_subscription_matched_status(g_reader, &subscription_matched);
-    CU_ASSERT_EQUAL_FATAL(ret, DDS_RETCODE_OK);
-    CU_ASSERT_EQUAL_FATAL(subscription_matched.current_count, 0);
-    CU_ASSERT_EQUAL_FATAL(subscription_matched.current_count_change, 0);
-    CU_ASSERT_EQUAL_FATAL(subscription_matched.total_count, 1);
-    CU_ASSERT_EQUAL_FATAL(subscription_matched.total_count_change, 0);
-    CU_ASSERT_EQUAL_FATAL(subscription_matched.last_publication_handle, writer_hdl);
+  // data-on-readers set on a participant at creation time must not trigger for
+  // the readers for DCPSPublication and DCPSSubscription: those events must be
+  // invisible for the test logic to work reliably. Installing a dummy listener
+  // for it on the reader should prevent that from happening
+  dotest ("da dor lc sm P ; ?!dor ?!da ?!sm ?!lc");
+  // writing data should trigger data-available unless data-on-readers is set
+  dotest ("da lc sm P ; r ; wr 0 w ; ?da r ?sm r ?lc r");
+  dotest ("da dor lc sm P ; r ; wr 0 w ; ?!da ; ?dor R ?sm r ?lc r");
+  // setting listeners after entity creation should work, too
+  dotest ("P W R ; dor P pm W sm R ; r w ; ?sm r ?pm w ; wr 0 w ; ?dor R ; ?!da");
 }
 
-CU_Test(ddsc_listener, incompatible_qos, .init=init_triggering_base, .fini=fini_triggering_base)
+CU_Test (ddsc_listener, matched)
 {
-    dds_offered_incompatible_qos_status_t offered_incompatible_qos;
-    dds_requested_incompatible_qos_status_t requested_incompatible_qos;
-    dds_return_t ret;
-    uint32_t triggered;
-    uint32_t status;
-
-    /* We are interested in incompatible qos notifications. */
-    dds_lset_offered_incompatible_qos(g_listener, offered_incompatible_qos_cb);
-    dds_lset_requested_incompatible_qos(g_listener, requested_incompatible_qos_cb);
-
-    /* Create reader and writer with proper listeners.
-     * But create reader with persistent durability to get incompatible qos. */
-    g_writer = dds_create_writer(g_participant, g_topic, g_qos, g_listener);
-    CU_ASSERT_FATAL(g_writer > 0);
-    dds_qset_durability (g_qos, DDS_DURABILITY_PERSISTENT);
-    g_reader = dds_create_reader(g_participant, g_topic, g_qos, g_listener);
-    CU_ASSERT_FATAL(g_reader > 0);
-
-    /* Incompatible QoS should be triggered with the right status. */
-    triggered = waitfor_cb(DDS_OFFERED_INCOMPATIBLE_QOS_STATUS | DDS_REQUESTED_INCOMPATIBLE_QOS_STATUS);
-    CU_ASSERT_EQUAL_FATAL(triggered & DDS_OFFERED_INCOMPATIBLE_QOS_STATUS, DDS_OFFERED_INCOMPATIBLE_QOS_STATUS);
-    CU_ASSERT_EQUAL_FATAL(triggered & DDS_REQUESTED_INCOMPATIBLE_QOS_STATUS, DDS_REQUESTED_INCOMPATIBLE_QOS_STATUS);
-    CU_ASSERT_EQUAL_FATAL(cb_reader, g_reader);
-    CU_ASSERT_EQUAL_FATAL(cb_writer, g_writer);
-    CU_ASSERT_EQUAL_FATAL(cb_offered_incompatible_qos_status.total_count, 1);
-    CU_ASSERT_EQUAL_FATAL(cb_offered_incompatible_qos_status.total_count_change, 1);
-    CU_ASSERT_EQUAL_FATAL(cb_offered_incompatible_qos_status.last_policy_id, DDS_DURABILITY_QOS_POLICY_ID);
-    CU_ASSERT_EQUAL_FATAL(cb_requested_incompatible_qos_status.total_count, 1);
-    CU_ASSERT_EQUAL_FATAL(cb_requested_incompatible_qos_status.total_count_change, 1);
-    CU_ASSERT_EQUAL_FATAL(cb_requested_incompatible_qos_status.last_policy_id, DDS_DURABILITY_QOS_POLICY_ID);
-
-    /* The listener should have swallowed the status. */
-    ret = dds_read_status(g_writer, &status, DDS_OFFERED_INCOMPATIBLE_QOS_STATUS);
-    CU_ASSERT_EQUAL_FATAL(ret, DDS_RETCODE_OK);
-    CU_ASSERT_EQUAL_FATAL(status, 0);
-    ret = dds_read_status(g_reader, &status, DDS_REQUESTED_INCOMPATIBLE_QOS_STATUS);
-    CU_ASSERT_EQUAL_FATAL(ret, DDS_RETCODE_OK);
-    CU_ASSERT_EQUAL_FATAL(status, 0);
-
-    /* The listener should have reset the count_change. */
-    ret = dds_get_offered_incompatible_qos_status(g_writer, &offered_incompatible_qos);
-    CU_ASSERT_EQUAL_FATAL(ret, DDS_RETCODE_OK);
-    ret = dds_get_requested_incompatible_qos_status(g_reader, &requested_incompatible_qos);
-    CU_ASSERT_EQUAL_FATAL(ret, DDS_RETCODE_OK);
-    CU_ASSERT_EQUAL_FATAL(offered_incompatible_qos.total_count, 1);
-    CU_ASSERT_EQUAL_FATAL(offered_incompatible_qos.total_count_change, 0);
-    CU_ASSERT_EQUAL_FATAL(offered_incompatible_qos.last_policy_id, DDS_DURABILITY_QOS_POLICY_ID);
-    CU_ASSERT_EQUAL_FATAL(requested_incompatible_qos.total_count, 1);
-    CU_ASSERT_EQUAL_FATAL(requested_incompatible_qos.total_count_change, 0);
-    CU_ASSERT_EQUAL_FATAL(requested_incompatible_qos.last_policy_id, DDS_DURABILITY_QOS_POLICY_ID);
-
-    dds_delete(g_writer);
-    dds_delete(g_reader);
+  // publication & subscription matched must both trigger; note: reader/writer matching inside
+  // a process is synchronous, no need to check everywhere
+  dotest ("sm r pm w ?pm w ?sm r");
+  // across the network it should work just as well (matching happens on different threads for
+  // remote & local entity creation, so it is meaningfully different test)
+  dotest ("sm r pm w' ?pm w' ?sm r");
 }
 
-CU_Test(ddsc_listener, data_available, .init=init_triggering_test, .fini=fini_triggering_test)
+CU_Test (ddsc_listener, publication_matched)
 {
-    dds_return_t ret;
-    uint32_t triggered;
-    uint32_t status;
-    RoundTripModule_DataType sample;
-    memset (&sample, 0, sizeof (sample));
+  // regardless of order of creation, the writer should see one reader come & then go
+  dotest ("sm r pm w ; ?pm(1,1,1,1,r) w ?sm r ; -r ; ?pm(1,0,0,-1,r) w");
+  dotest ("pm w sm r ; ?pm(1,1,1,1,r) w ?sm r ; -r ; ?pm(1,0,0,-1,r) w");
 
-    /* We are interested in data available notifications. */
-    dds_lset_data_available(g_listener, data_available_cb);
-    ret = dds_set_listener(g_reader, g_listener);
-    CU_ASSERT_EQUAL_FATAL(ret, DDS_RETCODE_OK);
+  // regardless of order of creation, the writer should see one reader come & then go, also
+  // when a second reader introduced
+  dotest ("sm r pm w ; ?pm(1,1,1,1,r) w ?sm r ; t ?pm(2,1,2,1,t) w ; -r ; ?pm(2,0,1,-1,r) w");
+  dotest ("pm w sm r ; ?pm(1,1,1,1,r) w ?sm r ; t ?pm(2,1,2,1,t) w ; -t ; ?pm(2,0,1,-1,t) w");
 
-    /* Write sample. */
-    ret = dds_write(g_writer, &sample);
-    CU_ASSERT_EQUAL_FATAL(ret, DDS_RETCODE_OK);
+  // same with 2 domains
+  dotest ("sm r pm w' ; ?pm(1,1,1,1,r) w' ?sm r ; -r ; ?pm(1,0,0,-1,r) w'");
+  dotest ("pm w sm r' ; ?pm(1,1,1,1,r') w ?sm r' ; -r' ; ?pm(1,0,0,-1,r') w");
 
-    /* Data available should be triggered with the right status. */
-    triggered = waitfor_cb(DDS_DATA_AVAILABLE_STATUS);
-    CU_ASSERT_EQUAL_FATAL(triggered & DDS_DATA_AVAILABLE_STATUS, DDS_DATA_AVAILABLE_STATUS);
-    CU_ASSERT_EQUAL_FATAL(cb_reader, g_reader);
-
-    /* The listener should have swallowed the status. */
-    ret = dds_read_status(g_subscriber, &status, DDS_DATA_ON_READERS_STATUS);
-    CU_ASSERT_EQUAL_FATAL(ret, DDS_RETCODE_OK);
-    CU_ASSERT_EQUAL_FATAL(status, 0);
-    ret = dds_read_status(g_reader, &status, DDS_DATA_AVAILABLE_STATUS);
-    CU_ASSERT_EQUAL_FATAL(ret, DDS_RETCODE_OK);
-    CU_ASSERT_EQUAL_FATAL(status, 0);
-
-    /* Deleting the writer causes unregisters (or dispose+unregister), and those
-       should trigger DATA_AVAILABLE as well */
-    ddsrt_mutex_lock(&g_mutex);
-    cb_called = 0;
-    cb_reader = 0;
-    ddsrt_mutex_unlock(&g_mutex);
-    ret = dds_delete (g_writer);
-    CU_ASSERT_EQUAL_FATAL(ret, DDS_RETCODE_OK);
-    g_writer = 0;
-    triggered = waitfor_cb(DDS_DATA_AVAILABLE_STATUS);
-    CU_ASSERT_EQUAL_FATAL(triggered & DDS_DATA_AVAILABLE_STATUS, DDS_DATA_AVAILABLE_STATUS);
-    CU_ASSERT_EQUAL_FATAL(cb_reader, g_reader);
-
-    /* The listener should have swallowed the status. */
-    ret = dds_read_status(g_subscriber, &status, DDS_DATA_ON_READERS_STATUS);
-    CU_ASSERT_EQUAL_FATAL(ret, DDS_RETCODE_OK);
-    CU_ASSERT_EQUAL_FATAL(status, 0);
-    ret = dds_read_status(g_reader, &status, DDS_DATA_AVAILABLE_STATUS);
-    CU_ASSERT_EQUAL_FATAL(ret, DDS_RETCODE_OK);
-    CU_ASSERT_EQUAL_FATAL(status, 0);
+  dotest ("sm r pm w' ; ?pm(1,1,1,1,r) w' ?sm r ; t ?pm(2,1,2,1,t) w' ; -r ; ?pm(2,0,1,-1,r) w'");
+  dotest ("pm w sm r' ; ?pm(1,1,1,1,r') w ?sm r' ; t ?pm(2,1,2,1,t) w ; -t ; ?pm(2,0,1,-1,t) w");
+  dotest ("sm r pm w' ; ?pm(1,1,1,1,r) w' ?sm r ; t' ?pm(2,1,2,1,t') w' ; -r ; ?pm(2,0,1,-1,r) w'");
+  dotest ("pm w sm r' ; ?pm(1,1,1,1,r') w ?sm r' ; t' ?pm(2,1,2,1,t') w ; -t' ; ?pm(2,0,1,-1,t') w");
 }
 
-CU_Test(ddsc_listener, data_available_delete_writer, .init=init_triggering_test, .fini=fini_triggering_test)
+CU_Test (ddsc_listener, subscription_matched)
 {
-    dds_return_t ret;
-    uint32_t triggered;
-    uint32_t status;
-    RoundTripModule_DataType sample;
-    memset (&sample, 0, sizeof (sample));
+  // regardless of order of creation, the reader should see one writer come & then go
+  dotest ("sm r pm w ; ?pm w ?sm(1,1,1,1,w) r ; -w ; ?sm(1,0,0,-1,w) r");
+  dotest ("pm w sm r ; ?pm w ?sm(1,1,1,1,w) r ; -w ; ?sm(1,0,0,-1,w) r");
 
-    /* We are interested in data available notifications. */
-    dds_lset_data_available(g_listener, data_available_cb);
-    ret = dds_set_listener(g_reader, g_listener);
-    CU_ASSERT_EQUAL_FATAL(ret, DDS_RETCODE_OK);
+  // regardless of order of creation, the reader should see one writer come & then go, also
+  // when a second writer is introduced
+  dotest ("sm r pm w ; ?pm w ?sm(1,1,1,1,w) r ; x ?sm(2,1,2,1,x) r ; -w ; ?sm(2,0,1,-1,w) r");
+  dotest ("pm w sm r ; ?pm w ?sm(1,1,1,1,w) r ; x ?sm(2,1,2,1,x) r ; -x ; ?sm(2,0,1,-1,x) r");
 
-    /* Write sample, wait for the listener to swallow the status. */
-    ret = dds_write(g_writer, &sample);
-    CU_ASSERT_EQUAL_FATAL(ret, DDS_RETCODE_OK);
-    triggered = waitfor_cb(DDS_DATA_AVAILABLE_STATUS);
-    CU_ASSERT_EQUAL_FATAL(triggered & DDS_DATA_AVAILABLE_STATUS, DDS_DATA_AVAILABLE_STATUS);
-    CU_ASSERT_EQUAL_FATAL(cb_reader, g_reader);
+  // same with 2 domains
+  dotest ("sm r pm w' ; ?pm w' ?sm(1,1,1,1,w') r ; -w' ; ?sm(1,0,0,-1,w') r");
+  dotest ("pm w sm r' ; ?pm w ?sm(1,1,1,1,w) r' ; -w ; ?sm(1,0,0,-1,w) r'");
 
-    /* Deleting the writer must trigger DATA_AVAILABLE as well */
-    ddsrt_mutex_lock(&g_mutex);
-    cb_called = 0;
-    cb_reader = 0;
-    ddsrt_mutex_unlock(&g_mutex);
-    ret = dds_delete (g_writer);
-    CU_ASSERT_EQUAL_FATAL(ret, DDS_RETCODE_OK);
-    g_writer = 0;
-    triggered = waitfor_cb(DDS_DATA_AVAILABLE_STATUS);
-    CU_ASSERT_EQUAL_FATAL(triggered & DDS_DATA_AVAILABLE_STATUS, DDS_DATA_AVAILABLE_STATUS);
-    CU_ASSERT_EQUAL_FATAL(cb_reader, g_reader);
-
-    /* The listener should have swallowed the status. */
-    ret = dds_read_status(g_subscriber, &status, DDS_DATA_ON_READERS_STATUS);
-    CU_ASSERT_EQUAL_FATAL(ret, DDS_RETCODE_OK);
-    CU_ASSERT_EQUAL_FATAL(status, 0);
-    ret = dds_read_status(g_reader, &status, DDS_DATA_AVAILABLE_STATUS);
-    CU_ASSERT_EQUAL_FATAL(ret, DDS_RETCODE_OK);
-    CU_ASSERT_EQUAL_FATAL(status, 0);
+  dotest ("sm r pm w' ; ?pm w' ?sm(1,1,1,1,w') r ; x ?sm(2,1,2,1,x) r ; -w' ; ?sm(2,0,1,-1,w') r");
+  dotest ("pm w sm r' ; ?pm w ?sm(1,1,1,1,w) r' ; x ?sm(2,1,2,1,x) r' ; -x ; ?sm(2,0,1,-1,x) r'");
+  dotest ("sm r pm w' ; ?pm w' ?sm(1,1,1,1,w') r ; x' ?sm(2,1,2,1,x') r ; -w' ; ?sm(2,0,1,-1,w') r");
+  dotest ("pm w sm r' ; ?pm w ?sm(1,1,1,1,w) r' ; x' ?sm(2,1,2,1,x') r' ; -x' ; ?sm(2,0,1,-1,x') r'");
 }
 
-CU_Test(ddsc_listener, data_available_delete_writer_disposed, .init=init_triggering_test, .fini=fini_triggering_test)
+CU_Test (ddsc_listener, incompatible_qos)
 {
-    dds_return_t ret;
-    uint32_t triggered;
-    uint32_t status;
-    RoundTripModule_DataType sample;
-    memset (&sample, 0, sizeof (sample));
-
-    /* We are interested in data available notifications. */
-    dds_lset_data_available(g_listener, data_available_cb);
-    ret = dds_set_listener(g_reader, g_listener);
-    CU_ASSERT_EQUAL_FATAL(ret, DDS_RETCODE_OK);
-
-    /* Write & dispose sample and take it so that the instance is empty & disposed.  Then deleting
-       the writer should silently drop the instance. */
-    ret = dds_write(g_writer, &sample);
-    CU_ASSERT_EQUAL_FATAL(ret, DDS_RETCODE_OK);
-    ret = dds_dispose(g_writer, &sample);
-    CU_ASSERT_EQUAL_FATAL(ret, DDS_RETCODE_OK);
-    triggered = waitfor_cb(DDS_DATA_AVAILABLE_STATUS);
-    CU_ASSERT_EQUAL_FATAL(triggered & DDS_DATA_AVAILABLE_STATUS, DDS_DATA_AVAILABLE_STATUS);
-    CU_ASSERT_EQUAL_FATAL(cb_reader, g_reader);
-
-    /* Take all data so that the instance becomes empty & disposed */
-    do {
-      void *sampleptr = &sample;
-      dds_sample_info_t info;
-      ret = dds_take (g_reader, &sampleptr, &info, 1, 1);
-    } while (ret > 0);
-
-    /* Deleting the writer should not trigger DATA_AVAILABLE with all instances empty & disposed */
-    ddsrt_mutex_lock(&g_mutex);
-    cb_called = 0;
-    cb_reader = 0;
-    ddsrt_mutex_unlock(&g_mutex);
-    ret = dds_delete (g_writer);
-    CU_ASSERT_EQUAL_FATAL(ret, DDS_RETCODE_OK);
-    g_writer = 0;
-    ddsrt_mutex_lock(&g_mutex);
-    CU_ASSERT_EQUAL_FATAL(cb_called & DDS_DATA_AVAILABLE_STATUS_ID, 0);
-    ddsrt_mutex_unlock(&g_mutex);
-
-    /* The listener should have swallowed the status. */
-    ret = dds_read_status(g_subscriber, &status, DDS_DATA_ON_READERS_STATUS);
-    CU_ASSERT_EQUAL_FATAL(ret, DDS_RETCODE_OK);
-    CU_ASSERT_EQUAL_FATAL(status, 0);
-    ret = dds_read_status(g_reader, &status, DDS_DATA_AVAILABLE_STATUS);
-    CU_ASSERT_EQUAL_FATAL(ret, DDS_RETCODE_OK);
-    CU_ASSERT_EQUAL_FATAL(status, 0);
+  // best-effort writer & reliable reader: both must trigger incompatible QoS event
+  dotest ("oiq w! riq r ; ?oiq(1,1) w ?riq(1,1) r");
+  dotest ("riq r oiq w! ; ?oiq(1,1) w ?riq(1,1) r");
 }
 
-CU_Test(ddsc_listener, data_on_readers, .init=init_triggering_test, .fini=fini_triggering_test)
+CU_Test (ddsc_listener, data_available)
 {
-    dds_return_t ret;
-    uint32_t triggered;
-    uint32_t status;
-    RoundTripModule_DataType sample;
-    memset (&sample, 0, sizeof (sample));
-
-    /* We are interested in data available notifications. */
-    dds_lset_data_on_readers(g_listener, data_on_readers_cb);
-    ret = dds_set_listener(g_subscriber, g_listener);
-    CU_ASSERT_EQUAL_FATAL(ret, DDS_RETCODE_OK);
-
-    /* Setting data available notifications should not 'sabotage' the on_readers call. */
-    dds_lset_data_available(g_listener, data_available_cb);
-    ret = dds_set_listener(g_reader, g_listener);
-    CU_ASSERT_EQUAL_FATAL(ret, DDS_RETCODE_OK);
-
-    /* Write sample. */
-    ret = dds_write(g_writer, &sample);
-    CU_ASSERT_EQUAL_FATAL(ret, DDS_RETCODE_OK);
-
-    /* Data on readers should be triggered with the right status. */
-    triggered = waitfor_cb(DDS_DATA_ON_READERS_STATUS);
-    CU_ASSERT_EQUAL_FATAL(triggered & DDS_DATA_ON_READERS_STATUS, DDS_DATA_ON_READERS_STATUS);
-    CU_ASSERT_EQUAL_FATAL(cb_subscriber, g_subscriber);
-    CU_ASSERT_NOT_EQUAL_FATAL(triggered & DDS_DATA_AVAILABLE_STATUS, DDS_DATA_AVAILABLE_STATUS);
-
-    /* The listener should have swallowed the status. */
-    ret = dds_read_status(g_subscriber, &status, DDS_DATA_ON_READERS_STATUS);
-    CU_ASSERT_EQUAL_FATAL(ret, DDS_RETCODE_OK);
-    CU_ASSERT_EQUAL_FATAL(status, 0);
-    ret = dds_read_status(g_reader, &status, DDS_DATA_AVAILABLE_STATUS);
-    CU_ASSERT_EQUAL_FATAL(ret, DDS_RETCODE_OK);
-    CU_ASSERT_EQUAL_FATAL(status, 0);
+  // data available on reader
+  dotest ("da sm r pm w ?pm w ?sm r wr 0 w ?da r ?!dor");
+  // data available set on subscriber
+  dotest ("da R sm r pm w ?pm w ?sm r wr 0 w ?da r ?!dor");
+  // data available set on participant
+  dotest ("da P sm r pm w ?pm w ?sm r wr 0 w ?da r ?!dor");
 }
 
-
-CU_Test(ddsc_listener, sample_lost, .init=init_triggering_test, .fini=fini_triggering_test)
+CU_Test (ddsc_listener, data_available_delete_writer)
 {
-    dds_sample_lost_status_t sample_lost;
-    dds_return_t ret;
-    uint32_t triggered;
-    dds_time_t the_past;
-    uint32_t status;
-    RoundTripModule_DataType sample;
-    memset (&sample, 0, sizeof (sample));
-
-    /* Get a time that should be historic on all platforms.*/
-    the_past = dds_time() - 1000000;
-
-    /* We are interested in sample lost notifications. */
-    dds_lset_sample_lost(g_listener, sample_lost_cb);
-    ret = dds_set_listener(g_reader, g_listener);
-    CU_ASSERT_EQUAL_FATAL(ret, DDS_RETCODE_OK);
-
-    /* Write first sample with current timestamp. */
-    ret = dds_write_ts(g_writer, &sample, dds_time());
-    CU_ASSERT_EQUAL_FATAL(ret, DDS_RETCODE_OK);
-
-    /* Write second sample with older timestamp. */
-    ret = dds_write_ts(g_writer, &sample, the_past);
-    CU_ASSERT_EQUAL_FATAL(ret, DDS_RETCODE_OK);
-
-    /* Sample lost should be triggered with the right status. */
-    triggered = waitfor_cb(DDS_SAMPLE_LOST_STATUS);
-    CU_ASSERT_EQUAL_FATAL(triggered & DDS_SAMPLE_LOST_STATUS, DDS_SAMPLE_LOST_STATUS);
-    CU_ASSERT_EQUAL_FATAL(cb_reader, g_reader);
-    CU_ASSERT_EQUAL_FATAL(cb_sample_lost_status.total_count, 1);
-    CU_ASSERT_EQUAL_FATAL(cb_sample_lost_status.total_count_change, 1);
-
-    /* The listener should have swallowed the status. */
-    ret = dds_read_status(g_reader, &status, DDS_SAMPLE_LOST_STATUS);
-    CU_ASSERT_EQUAL_FATAL(ret, DDS_RETCODE_OK);
-    CU_ASSERT_EQUAL_FATAL(status, 0);
-
-    /* The listener should have reset the count_change. */
-    ret = dds_get_sample_lost_status(g_reader, &sample_lost);
-    CU_ASSERT_EQUAL_FATAL(ret, DDS_RETCODE_OK);
-    CU_ASSERT_EQUAL_FATAL(sample_lost.total_count, 1);
-    CU_ASSERT_EQUAL_FATAL(sample_lost.total_count_change, 0);
+  // unmatching a writer that didn't read anything has no visible effect on RHC
+  // subscription-matched event is generated synchronously, so "?sm r" doesn't
+  // really add anything (it'd be different if there are two domain instances)
+  dotest ("da sm r w ; -w ?sm r ?!da ; take(0,0) r");
+  // after writing: auto-dispose should always trigger data available, an invalid
+  // sample needs to show up if there isn't an unread sample to use instead
+  dotest ("da r w ; wr 0 w ?da r ; -w ?da r ; take(1,0) r");
+  dotest ("da r w ; wr 0 w ?da r ; read(1,0) r ; -w ?da r ; take(1,1) r");
+  dotest ("da r w ; wr 0 w ?da r ; take(1,0) r ; -w ?da r ; take(0,1) r");
+  // same with two writers (no point in doing this also with two domains)
+  dotest ("da r w x ; -w ?!da -x ?!da ; take(0,0) r");
+  dotest ("da r w x ; wr 0 w ?da r ; -x ?!da ; -w ?da r ; take(1,0) r");
+  dotest ("da r w x ; wr 0 w ?da r ; -w ?da r ; take(1,0) r ; -x ?!da ; take(0,0) r");
+  dotest ("da r w x ; wr 0 w wr 0 x ?da r ; -w ?!da ; take(2,0) r ; -x ?da r ; take(0,1) r");
+  dotest ("da r w x ; wr 0 w wr 0 x ?da r ; read(2,0) r ; -w ?!da -x ?da r ; take(2,1) r");
+  dotest ("da r w x ; wr 0 w wr 0 x ?da r ; read(2,0) r ; -x ?!da -w ?da r ; take(2,1) r");
+  dotest ("da r w x ; wr 0 w read(1,0) r ; wr 0 x ?da r ; -w ?!da -x ?da r ; take(2,0) r");
+  dotest ("da r w x ; wr 0 w read(1,0) r ; wr 0 x ?da r ; -x ?!da -w ?da r ; take(2,0) r");
+  dotest ("da r w x ; wr 0 w read(1,0) r ; wr 0 x ?da r ; read(2,0) r ; -w ?!da -x ?da r ; take(2,1) r");
+  dotest ("da r w x ; wr 0 w read(1,0) r ; wr 0 x ?da r ; read(2,0) r ; -x ?!da -w ?da r ; take(2,1) r");
+  dotest ("da r w x ; wr 0 w wr 0 x ?da r ; take(2,0) r ; -w ?!da -x ?da r ; take(0,1) r");
+  dotest ("da r w x ; wr 0 w wr 0 x ?da r ; take(2,0) r ; -x ?!da -w ?da r ; take(0,1) r");
 }
 
-CU_Test(ddsc_listener, sample_rejected, .init=init_triggering_test, .fini=fini_triggering_test)
+CU_Test (ddsc_listener, data_available_delete_writer_disposed)
 {
-    dds_sample_rejected_status_t sample_rejected;
-    dds_return_t ret;
-    uint32_t triggered;
-    uint32_t status;
-    RoundTripModule_DataType sample;
-    memset (&sample, 0, sizeof (sample));
+  // same as data_available_delete_writer, but now with the instance disposed first
+  dotest ("da r w ; wr 0 w disp 0 w ?da r ; -w ?!da");
+  dotest ("da r w ; wr 0 w disp 0 w ?da r ; read(1,0) r ; -w ?!da");
+  dotest ("da r w ; wr 0 w disp 0 w ?da r ; take(1,0) r ; -w ?!da");
 
-    /* We are interested in sample rejected notifications. */
-    dds_lset_sample_rejected(g_listener, sample_rejected_cb);
-    ret = dds_set_listener(g_reader, g_listener);
-    CU_ASSERT_EQUAL_FATAL(ret, DDS_RETCODE_OK);
+  dotest ("da r w x ; wr 0 w ?da r ; read(1,0) r ; disp 0 w ?da r ; read(1,1) r ; -w ?!da -x ?!da");
+  dotest ("da r w x ; wr 0 w ?da r ; take(1,0) r ; disp 0 w ?da r ; take(0,1) r ; -w ?!da -x ?!da");
+  dotest ("da r w x ; wr 0 w ?da r ; read(1,0) r ; disp 0 w ?da r ; read(1,1) r ; -x ?!da -w ?!da");
+  dotest ("da r w x ; wr 0 w ?da r ; take(1,0) r ; disp 0 w ?da r ; take(0,1) r ; -x ?!da -w ?!da");
 
-    /* Write more than resource limits set by the reader. */
-    ret = dds_write(g_writer, &sample);
-    CU_ASSERT_EQUAL_FATAL(ret, DDS_RETCODE_OK);
-    ret = dds_write(g_writer, &sample);
-    CU_ASSERT_EQUAL_FATAL(ret, DDS_RETCODE_OK);
-    ret = dds_write(g_writer, &sample);
-    CU_ASSERT_EQUAL_FATAL(ret, DDS_RETCODE_OK);
-
-    /* Sample lost should be triggered with the right status. */
-    triggered = waitfor_cb(DDS_SAMPLE_REJECTED_STATUS);
-    CU_ASSERT_EQUAL_FATAL(triggered & DDS_SAMPLE_REJECTED_STATUS, DDS_SAMPLE_REJECTED_STATUS);
-    CU_ASSERT_EQUAL_FATAL(cb_reader, g_reader);
-    CU_ASSERT_EQUAL_FATAL(cb_sample_rejected_status.total_count, 2);
-    CU_ASSERT_EQUAL_FATAL(cb_sample_rejected_status.total_count_change, 1);
-    CU_ASSERT_EQUAL_FATAL(cb_sample_rejected_status.last_reason, DDS_REJECTED_BY_SAMPLES_LIMIT);
-
-    /* The listener should have swallowed the status. */
-    ret = dds_read_status(g_reader, &status, DDS_SAMPLE_REJECTED_STATUS);
-    CU_ASSERT_EQUAL_FATAL(ret, DDS_RETCODE_OK);
-    CU_ASSERT_EQUAL_FATAL(status, 0);
-
-    /* The listener should have reset the count_change. */
-    ret = dds_get_sample_rejected_status(g_reader, &sample_rejected);
-    CU_ASSERT_EQUAL_FATAL(ret, DDS_RETCODE_OK);
-    CU_ASSERT_EQUAL_FATAL(sample_rejected.total_count, 2);
-    CU_ASSERT_EQUAL_FATAL(sample_rejected.total_count_change, 0);
-    CU_ASSERT_EQUAL_FATAL(cb_sample_rejected_status.last_reason, DDS_REJECTED_BY_SAMPLES_LIMIT);
+  dotest ("da r w x ; wr 0 w ?da r ; read(1,0) r ; disp 0 x ?da r ; read(1,1) r ; -w ?!da -x ?!da");
+  dotest ("da r w x ; wr 0 w ?da r ; take(1,0) r ; disp 0 x ?da r ; take(0,1) r ; -w ?!da -x ?!da");
+  dotest ("da r w x ; wr 0 w ?da r ; read(1,0) r ; disp 0 x ?da r ; read(1,1) r ; -x ?!da -w ?!da");
+  dotest ("da r w x ; wr 0 w ?da r ; take(1,0) r ; disp 0 x ?da r ; take(0,1) r ; -x ?!da -w ?!da");
 }
 
-CU_Test(ddsc_listener, liveliness_changed, .init=init_triggering_test, .fini=fini_triggering_base)
+CU_Test (ddsc_listener, data_on_readers)
 {
-    dds_liveliness_changed_status_t liveliness_changed;
-    dds_instance_handle_t writer_hdl;
-    dds_return_t ret;
-    uint32_t triggered;
-    uint32_t status;
-
-    /* The init_triggering_test_byliveliness set our interest in liveliness. */
-
-    /* Get writer handle that should be part of the status. */
-    ret = dds_get_instance_handle(g_writer, &writer_hdl);
-    CU_ASSERT_EQUAL_FATAL(ret, DDS_RETCODE_OK);
-
-    /* Liveliness changed should be triggered with the right status. */
-    triggered = waitfor_cb(DDS_LIVELINESS_CHANGED_STATUS);
-    CU_ASSERT_EQUAL_FATAL(triggered & DDS_LIVELINESS_CHANGED_STATUS,  DDS_LIVELINESS_CHANGED_STATUS);
-    CU_ASSERT_EQUAL_FATAL(cb_reader, g_reader);
-    CU_ASSERT_EQUAL_FATAL(cb_liveliness_changed_status.alive_count, 1);
-    CU_ASSERT_EQUAL_FATAL(cb_liveliness_changed_status.alive_count_change, 1);
-    CU_ASSERT_EQUAL_FATAL(cb_liveliness_changed_status.not_alive_count, 0);
-    CU_ASSERT_EQUAL_FATAL(cb_liveliness_changed_status.not_alive_count_change, 0);
-    CU_ASSERT_EQUAL_FATAL(cb_liveliness_changed_status.last_publication_handle, writer_hdl);
-
-    /* The listener should have swallowed the status. */
-    ret = dds_read_status(g_reader, &status, DDS_LIVELINESS_CHANGED_STATUS);
-    CU_ASSERT_EQUAL_FATAL(ret, DDS_RETCODE_OK);
-    CU_ASSERT_EQUAL_FATAL(status, 0);
-
-    /* The listener should have reset the count_change. */
-    ret = dds_get_liveliness_changed_status(g_reader, &liveliness_changed);
-    CU_ASSERT_EQUAL_FATAL(ret, DDS_RETCODE_OK);
-    CU_ASSERT_EQUAL_FATAL(liveliness_changed.alive_count, 1);
-    CU_ASSERT_EQUAL_FATAL(liveliness_changed.alive_count_change, 0);
-    CU_ASSERT_EQUAL_FATAL(liveliness_changed.not_alive_count, 0);
-    CU_ASSERT_EQUAL_FATAL(liveliness_changed.not_alive_count_change, 0);
-    CU_ASSERT_EQUAL_FATAL(liveliness_changed.last_publication_handle, writer_hdl);
-
-    /* Reset the trigger flags. */
-    ddsrt_mutex_lock(&g_mutex);
-    cb_called = 0;
-    ddsrt_mutex_unlock(&g_mutex);
-
-    /* Change liveliness again by deleting the writer. */
-    dds_delete(g_writer);
-
-    /* Liveliness changed should be triggered with the right status. */
-    triggered = waitfor_cb(DDS_LIVELINESS_CHANGED_STATUS);
-    CU_ASSERT_EQUAL_FATAL(triggered & DDS_LIVELINESS_CHANGED_STATUS,  DDS_LIVELINESS_CHANGED_STATUS);
-    CU_ASSERT_EQUAL_FATAL(cb_reader, g_reader);
-    CU_ASSERT_EQUAL_FATAL(cb_liveliness_changed_status.alive_count, 0);
-    CU_ASSERT_EQUAL_FATAL(cb_liveliness_changed_status.alive_count_change, -1);
-    CU_ASSERT_EQUAL_FATAL(cb_liveliness_changed_status.not_alive_count, 0);
-    CU_ASSERT_EQUAL_FATAL(cb_liveliness_changed_status.not_alive_count_change, 0);
-    CU_ASSERT_EQUAL_FATAL(cb_liveliness_changed_status.last_publication_handle, writer_hdl);
-
-    /* The listener should have reset the count_change. */
-    ret = dds_get_liveliness_changed_status(g_reader, &liveliness_changed);
-    CU_ASSERT_EQUAL_FATAL(ret, DDS_RETCODE_OK);
-    CU_ASSERT_EQUAL_FATAL(liveliness_changed.alive_count, 0);
-    CU_ASSERT_EQUAL_FATAL(liveliness_changed.alive_count_change, 0);
-    CU_ASSERT_EQUAL_FATAL(liveliness_changed.not_alive_count, 0);
-    CU_ASSERT_EQUAL_FATAL(liveliness_changed.not_alive_count_change, 0);
-    CU_ASSERT_EQUAL_FATAL(liveliness_changed.last_publication_handle, writer_hdl);
+  // data on readers wins from data available
+  dotest ("dor R da r ; wr 0 w ; ?dor R ?!da");
+  dotest ("dor P da r ; wr 0 w ; ?dor R ?!da");
 }
 
-#if 0
-/* This is basically the same as the Lite test, but inconsistent topic is not triggered.
- * That is actually what I would expect, because the code doesn't seem to be the way
- * to go to test for inconsistent topic. */
-Test(ddsc_listener, inconsistent_topic, .init=init_triggering_base, .fini=fini_triggering_base)
+CU_Test (ddsc_listener, sample_lost)
 {
-    dds_entity_t wr_topic;
-    dds_entity_t rd_topic;
-    dds_entity_t writer;
-    dds_entity_t reader;
-    uint32_t triggered;
-
-    os_osInit();
-
-    ddsrt_mutex_init(&g_mutex);
-    ddsrt_cond_init(&g_cond);
-
-    g_qos = dds_create_qos();
-    cr_assert_not_null(g_qos, "Failed to create prerequisite g_qos");
-
-    g_listener = dds_create_listener(NULL);
-    cr_assert_not_null(g_listener, "Failed to create prerequisite g_listener");
-
-    g_participant = dds_create_participant(DDS_DOMAIN_DEFAULT, NULL, NULL);
-    cr_assert_gt(g_participant, 0, "Failed to create prerequisite g_participant");
-
-    /* We are interested in inconsistent topics. */
-    dds_lset_inconsistent_topic(g_listener, inconsistent_topic_cb);
-
-    wr_topic = dds_create_topic(g_participant, &RoundTripModule_DataType_desc, "WRITER_TOPIC", NULL, g_listener);
-    cr_assert_gt(g_topic, 0, "Failed to create prerequisite wr_topic");
-
-    rd_topic = dds_create_topic(g_participant, &RoundTripModule_DataType_desc, "READER_TOPIC", NULL, g_listener);
-    cr_assert_gt(g_topic, 0, "Failed to create prerequisite rd_topic");
-
-    /* Create reader and writer. */
-    writer = dds_create_writer(g_participant, g_topic, NULL, NULL);
-    cr_assert_gt(writer, 0, "Failed to create prerequisite writer");
-    dds_qset_reliability (g_qos, DDS_RELIABILITY_RELIABLE, DDS_SECS (1));
-    dds_qset_history (g_qos, DDS_HISTORY_KEEP_ALL, 0);
-    reader = dds_create_reader(g_subscriber, g_topic, g_qos, NULL);
-    cr_assert_gt(reader, 0, "Failed to create prerequisite reader");
-
-    /* Inconsistent topic should be triggered with the right status. */
-    triggered = waitfor_cb(DDS_INCONSISTENT_TOPIC_STATUS);
-    cr_assert_eq(triggered & DDS_INCONSISTENT_TOPIC_STATUS,  DDS_INCONSISTENT_TOPIC_STATUS, "DDS_INCONSISTENT_TOPIC_STATUS not triggered");
-
-    dds_delete(reader);
-    dds_delete(writer);
-    dds_delete(rd_topic);
-    dds_delete(wr_topic);
-    dds_delete(g_participant);
-
-    dds_delete_listener(g_listener);
-    dds_delete_qos(g_qos);
+  // FIXME: figure out what really constitutes a "lost sample"
+  dotest ("sl r ; wr@0 0 w ?!sl ; wr@-1 0 w ?sl(1,1) r");
 }
-#endif
 
+CU_Test (ddsc_listener, sample_rejected)
+{
+  // FIXME: rejection counts with retries?
+  // reliable: expect timeout on the write when max samples has been reached
+  // invalid samples don't count towards resource limits, so dispose should
+  // not be blocked
+  dotest ("sr r# ; wr 0 w wrfail 0 w wrfail 0 w ; ?sr r");
+  dotest ("sr r# ; wr 0 w wrfail 0 w ; read(1,0) r ; disp 0 w ; read(1,1) r ; ?sr r");
+
+  // best-effort: writes should succeed despite not delivering the data adding
+  // the data in the RHC, also check number of samples rejected
+  dotest ("sr r#! ; wr 0 w! wr 0 w wr 0 w ; ?sr(2,1,s) r");
+  dotest ("sr r#! ; wr 0 w! wr 0 w ; read(1,0) r ; disp 0 w ; read(1,1) r ; ?sr(1,1,s) r");
+}
+
+CU_Test (ddsc_listener, liveliness_changed)
+{
+  // liveliness changed should trigger along with matching
+  dotest ("pm w lc sm r ; ?pm w ?sm r ; ?lc(1,0,1,0,w) r ; -w ; ?lc(0,0,-1,0,w) r");
+  dotest ("pm w lc sm r' ; ?pm w ?sm r' ; ?lc(1,0,1,0,w) r' ; -w ; ?lc(0,0,-1,0,w) r'");
+}

From bf25c6ec807c1b33b23e5369d3715cce8b2fc7f0 Mon Sep 17 00:00:00 2001
From: Erik Boasson <eb@ilities.com>
Date: Wed, 6 May 2020 21:31:58 +0200
Subject: [PATCH 211/238] Properly pair entity_pin/mutex_lock

Coverity has difficulty observering that dds_entity_pin /
ddsrt_mutex_lock / dds_entity_unlock is correct.  It is perhaps a bit
confusing, so change it.

Signed-off-by: Erik Boasson <eb@ilities.com>
---
 src/core/ddsc/src/dds_topic.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/src/core/ddsc/src/dds_topic.c b/src/core/ddsc/src/dds_topic.c
index a07b4e3..0f48cbd 100644
--- a/src/core/ddsc/src/dds_topic.c
+++ b/src/core/ddsc/src/dds_topic.c
@@ -359,7 +359,8 @@ dds_entity_t dds_create_topic_impl (dds_entity_t participant, struct ddsi_sertop
   hdl = create_topic_pp_locked (pp, ktp, (sertopic_registered->ops == &ddsi_sertopic_ops_builtintopic), sertopic_registered, listener, sedp_plist);
   ddsi_sertopic_unref (*sertopic);
   *sertopic = sertopic_registered;
-  dds_participant_unlock (pp);
+  ddsrt_mutex_unlock (&pp->m_entity.m_mutex);
+  dds_entity_unpin (&pp->m_entity);
   GVTRACE ("dds_create_topic_generic: new topic %"PRId32"\n", hdl);
   return hdl;
 

From 02ed74e6bdcfee32512c454e780663768903ba88 Mon Sep 17 00:00:00 2001
From: Erik Boasson <eb@ilities.com>
Date: Wed, 6 May 2020 21:34:21 +0200
Subject: [PATCH 212/238] Fix conversion of user_data to security plugin

The security plugins currently use the standardized representations of
octet sequences, unlike the DDSI stack's internal representation.  A
shallow copy is therefore not simply a memcpy.

Signed-off-by: Erik Boasson <eb@ilities.com>
---
 src/core/ddsi/src/ddsi_security_util.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/core/ddsi/src/ddsi_security_util.c b/src/core/ddsi/src/ddsi_security_util.c
index 11f39b5..65959bc 100644
--- a/src/core/ddsi/src/ddsi_security_util.c
+++ b/src/core/ddsi/src/ddsi_security_util.c
@@ -517,7 +517,7 @@ q_omg_shallow_copy_ParticipantBuiltinTopicDataSecure(
 
   /* Copy the DDS_Security_OctetSeq content (length, pointer, etc), not the buffer content. */
   if (plist->qos.present & QP_USER_DATA)
-    memcpy(&(dst->user_data.value), &(plist->qos.user_data.value), sizeof(DDS_Security_OctetSeq));
+    g_omg_shallow_copy_octSeq(&dst->user_data.value, &plist->qos.user_data);
   /* Tokens are actually DataHolders. */
   if (plist->present & PP_IDENTITY_TOKEN)
     q_omg_shallow_copyin_DataHolder(&(dst->identity_token), &(plist->identity_token));

From 58e02d0b12c2c53aa075048712445f1b764cab43 Mon Sep 17 00:00:00 2001
From: Erik Boasson <eb@ilities.com>
Date: Wed, 6 May 2020 21:35:55 +0200
Subject: [PATCH 213/238] Fix leak when inserting p2p message in WHC fails

Signed-off-by: Erik Boasson <eb@ilities.com>
---
 src/core/ddsi/src/q_transmit.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/src/core/ddsi/src/q_transmit.c b/src/core/ddsi/src/q_transmit.c
index 2b27d54..4a52fdb 100644
--- a/src/core/ddsi/src/q_transmit.c
+++ b/src/core/ddsi/src/q_transmit.c
@@ -1212,6 +1212,10 @@ int write_sample_p2p_wrlock_held(struct writer *wr, seqno_t seq, struct ddsi_pli
     if (wr->heartbeat_xevent)
       writer_hbcontrol_note_asyncwrite(wr, tnow);
   }
+  else if (gap)
+  {
+    nn_xmsg_free (gap);
+  }
 
 prd_is_deleting:
   return r;

From a0d7b71e52e981a0146e577cfd40f10b466dd5df Mon Sep 17 00:00:00 2001
From: Erik Boasson <eb@ilities.com>
Date: Wed, 6 May 2020 21:37:23 +0200
Subject: [PATCH 214/238] Atomic update next heartbeat time for p2p writers

Sending a heartbeat to all matched readers for the P2P builtin
participant volatile secure writer unlocks the writer before pushing
each individual message out, and so determining the time of the next
heartbeat event before writing and updating it afterwards means the
state may have changed.  While this is appears benign, it is better to
do the update atomically.

Signed-off-by: Erik Boasson <eb@ilities.com>
---
 src/core/ddsi/src/q_xevent.c | 40 ++++++++++++++++++++++++------------
 1 file changed, 27 insertions(+), 13 deletions(-)

diff --git a/src/core/ddsi/src/q_xevent.c b/src/core/ddsi/src/q_xevent.c
index b535bbd..443a9fc 100644
--- a/src/core/ddsi/src/q_xevent.c
+++ b/src/core/ddsi/src/q_xevent.c
@@ -620,6 +620,31 @@ static void handle_xevk_entityid (struct nn_xpack *xp, struct xevent_nt *ev)
 }
 
 #ifdef DDSI_INCLUDE_SECURITY
+static int send_heartbeat_to_all_readers_check_and_sched (struct xevent *ev, struct writer *wr, const struct whc_state *whcst, ddsrt_mtime_t tnow, ddsrt_mtime_t *t_next)
+{
+  int send;
+  if (!writer_must_have_hb_scheduled (wr, whcst))
+  {
+    wr->hbcontrol.tsched = DDSRT_MTIME_NEVER;
+    send = -1;
+  }
+  else if (!writer_hbcontrol_must_send (wr, whcst, tnow))
+  {
+    wr->hbcontrol.tsched = ddsrt_mtime_add_duration (tnow, writer_hbcontrol_intv (wr, whcst, tnow));
+    send = -1;
+  }
+  else
+  {
+    const int hbansreq = writer_hbcontrol_ack_required (wr, whcst, tnow);
+    wr->hbcontrol.tsched = ddsrt_mtime_add_duration (tnow, writer_hbcontrol_intv (wr, whcst, tnow));
+    send = hbansreq;
+  }
+
+  resched_xevent_if_earlier (ev, wr->hbcontrol.tsched);
+  *t_next = wr->hbcontrol.tsched;
+  return send;
+}
+
 static void send_heartbeat_to_all_readers (struct nn_xpack *xp, struct xevent *ev, struct writer *wr, ddsrt_mtime_t tnow)
 {
   struct whc_state whcst;
@@ -629,17 +654,11 @@ static void send_heartbeat_to_all_readers (struct nn_xpack *xp, struct xevent *e
   ddsrt_mutex_lock (&wr->e.lock);
 
   whc_get_state(wr->whc, &whcst);
-
-  if (!writer_must_have_hb_scheduled (wr, &whcst))
-    t_next = DDSRT_MTIME_NEVER;
-  else if (!writer_hbcontrol_must_send (wr, &whcst, tnow))
-    t_next = ddsrt_mtime_add_duration (tnow, writer_hbcontrol_intv (wr, &whcst, tnow));
-  else
+  const int hbansreq = send_heartbeat_to_all_readers_check_and_sched (ev, wr, &whcst, tnow, &t_next);
+  if (hbansreq >= 0)
   {
     struct wr_prd_match *m;
     struct ddsi_guid last_guid = { .prefix = {.u = {0,0,0}}, .entityid = {0} };
-    const int hbansreq = writer_hbcontrol_ack_required (wr, &whcst, tnow);
-    t_next = ddsrt_mtime_add_duration (tnow, writer_hbcontrol_intv (wr, &whcst, tnow));
 
     while ((m = ddsrt_avl_lookup_succ (&wr_readers_treedef, &wr->readers, &last_guid)) != NULL)
     {
@@ -669,16 +688,11 @@ static void send_heartbeat_to_all_readers (struct nn_xpack *xp, struct xevent *e
           count++;
         }
       }
-
     }
   }
 
-  resched_xevent_if_earlier (ev, t_next);
-  wr->hbcontrol.tsched = t_next;
-
   if (count == 0)
   {
-    (void)resched_xevent_if_earlier (ev, t_next);
     ETRACE (wr, "heartbeat(wr "PGUIDFMT") suppressed, resched in %g s (min-ack %"PRId64"%s, avail-seq %"PRId64", xmit %"PRId64")\n",
         PGUID (wr->e.guid),
         (t_next.v == DDS_NEVER) ? INFINITY : (double)(t_next.v - tnow.v) / 1e9,

From fa6dbe6c3d845813b4d6ac99e62f7245531b10db Mon Sep 17 00:00:00 2001
From: Erik Boasson <eb@ilities.com>
Date: Wed, 6 May 2020 21:41:48 +0200
Subject: [PATCH 215/238] Memory leak reading access control configuration

Signed-off-by: Erik Boasson <eb@ilities.com>
---
 .../access_control/src/access_control.c       | 30 +++++++++++--------
 1 file changed, 17 insertions(+), 13 deletions(-)

diff --git a/src/security/builtin_plugins/access_control/src/access_control.c b/src/security/builtin_plugins/access_control/src/access_control.c
index df27ea7..e9d91e0 100644
--- a/src/security/builtin_plugins/access_control/src/access_control.c
+++ b/src/security/builtin_plugins/access_control/src/access_control.c
@@ -2063,23 +2063,27 @@ read_document(
     char **doc,
     DDS_Security_SecurityException *ex)
 {
-  bool result = true;
   char *data = NULL;
-
   switch (DDS_Security_get_conf_item_type(doc_uri, &data))
   {
-  case DDS_SECURITY_CONFIG_ITEM_PREFIX_DATA:
-    *doc = data;
-    break;
-  case DDS_SECURITY_CONFIG_ITEM_PREFIX_FILE:
-    result = read_document_from_file(data, doc, ex);
-    ddsrt_free(data);
-    break;
-  default:
-    DDS_Security_Exception_set(ex, DDS_ACCESS_CONTROL_PLUGIN_CONTEXT, DDS_SECURITY_ERR_URI_TYPE_NOT_SUPPORTED_CODE, 0, DDS_SECURITY_ERR_URI_TYPE_NOT_SUPPORTED_MESSAGE, doc_uri);
-    return false;
+    case DDS_SECURITY_CONFIG_ITEM_PREFIX_DATA:
+      *doc = data;
+      return true;
+
+    case DDS_SECURITY_CONFIG_ITEM_PREFIX_FILE: {
+      const bool result = read_document_from_file(data, doc, ex);
+      ddsrt_free(data);
+      return result;
+    }
+
+    case DDS_SECURITY_CONFIG_ITEM_PREFIX_PKCS11:
+    case DDS_SECURITY_CONFIG_ITEM_PREFIX_UNKNOWN:
+      DDS_Security_Exception_set(ex, DDS_ACCESS_CONTROL_PLUGIN_CONTEXT, DDS_SECURITY_ERR_URI_TYPE_NOT_SUPPORTED_CODE, 0, DDS_SECURITY_ERR_URI_TYPE_NOT_SUPPORTED_MESSAGE, doc_uri);
+      ddsrt_free(data);
+      return false;
   }
-  return result;
+  assert (0);
+  return false;
 }
 
 static bool

From 59a2b9d273112a6d2a39d6b19cbc31158f8fa8e1 Mon Sep 17 00:00:00 2001
From: Erik Boasson <eb@ilities.com>
Date: Wed, 6 May 2020 21:44:12 +0200
Subject: [PATCH 216/238] Fix double free if local identity validation fails on
 certificate expiry

Signed-off-by: Erik Boasson <eb@ilities.com>
---
 .../authentication/src/authentication.c             | 13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)

diff --git a/src/security/builtin_plugins/authentication/src/authentication.c b/src/security/builtin_plugins/authentication/src/authentication.c
index 316c910..f17ae41 100644
--- a/src/security/builtin_plugins/authentication/src/authentication.c
+++ b/src/security/builtin_plugins/authentication/src/authentication.c
@@ -762,6 +762,12 @@ DDS_Security_ValidationResult_t validate_local_identity(dds_security_authenticat
   if (verify_certificate(identityCert, identityCA, ex) != DDS_SECURITY_VALIDATION_OK)
     goto err_verification_failed;
 
+  if ((certExpiry = get_certificate_expiry(identityCert)) == DDS_TIME_INVALID)
+  {
+    DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "Expiry date of the certificate is invalid");
+    goto err_verification_failed;
+  }
+
   if (get_adjusted_participant_guid(identityCert, candidate_participant_guid, adjusted_participant_guid, ex) != DDS_SECURITY_VALIDATION_OK)
     goto err_adj_guid_failed;
 
@@ -774,12 +780,7 @@ DDS_Security_ValidationResult_t validate_local_identity(dds_security_authenticat
   identity = local_identity_info_new(domain_id, identityCert, identityCA, privateKey, candidate_participant_guid, adjusted_participant_guid);
   *local_identity_handle = IDENTITY_HANDLE(identity);
 
-  if ((certExpiry = get_certificate_expiry(identityCert)) == DDS_TIME_INVALID)
-  {
-    DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "Expiry date of the certificate is invalid");
-    goto err_verification_failed;
-  }
-  else if (certExpiry != DDS_NEVER)
+  if (certExpiry != DDS_NEVER)
     add_validity_end_trigger(implementation, *local_identity_handle, certExpiry);
 
   ddsrt_mutex_lock(&implementation->lock);

From fa7999c5d8075284b0d6a3aba7c315f7cf1fa636 Mon Sep 17 00:00:00 2001
From: Erik Boasson <eb@ilities.com>
Date: Wed, 6 May 2020 21:45:56 +0200
Subject: [PATCH 217/238] Vet lengths of property lists in crypto
 deserialization

The memory allocation in deserializing property lists within the crypto
code should not trust the deserialized length and try to allocate that
much memory but should first verify that the length is consistent with
the number of bytes remaining in the input.  (Noted by Coverity as use
of tainted data.)

Signed-off-by: Erik Boasson <eb@ilities.com>
---
 .../core/src/dds_security_serialize.c         | 23 ++++++++++++++-----
 1 file changed, 17 insertions(+), 6 deletions(-)

diff --git a/src/security/core/src/dds_security_serialize.c b/src/security/core/src/dds_security_serialize.c
index 0e92790..7e182df 100644
--- a/src/security/core/src/dds_security_serialize.c
+++ b/src/security/core/src/dds_security_serialize.c
@@ -627,14 +627,20 @@ DDS_Security_Deserialize_PropertySeq(
      DDS_Security_Deserializer dser,
      DDS_Security_PropertySeq *seq)
 {
+    /* A well-formed CDR string is length + content including terminating 0, length is
+       4 bytes and 4-byte aligned, so the minimum length for a non-empty property
+       sequence is 4+1+(3 pad)+4+1 = 13 bytes.  Just use 8 because it is way faster
+       and just as good for checking that the length value isn't completely ridiculous. */
+    const uint32_t minpropsize = (uint32_t) (2 * sizeof (uint32_t));
     int r = 1;
     uint32_t i;
 
     if (!DDS_Security_Deserialize_uint32_t(dser, &seq->_length)) {
         return 0;
-    }
-
-    if (seq->_length > 0) {
+    } else if (seq->_length > dser->remain / minpropsize) {
+        seq->_length = 0;
+        return 0;
+    } else if (seq->_length > 0) {
         seq->_buffer = DDS_Security_PropertySeq_allocbuf(seq->_length);
         for (i = 0; i < seq->_length && r; i++) {
             r = DDS_Security_Deserialize_Property(dser, &seq->_buffer[i]);
@@ -649,14 +655,19 @@ DDS_Security_Deserialize_BinaryPropertySeq(
      DDS_Security_Deserializer dser,
      DDS_Security_BinaryPropertySeq *seq)
 {
+    /* A well-formed CDR string + a well-formed octet sequence: 4+1+(3 pad)+4 = 12 bytes.
+       Just use 8 because it is way faster and just as good for checking that the length
+       value isn't completely ridiculous. */
+    const uint32_t minpropsize = (uint32_t) (2 * sizeof (uint32_t));
     int r = 1;
     uint32_t i;
 
     if (!DDS_Security_Deserialize_uint32_t(dser, &seq->_length)) {
         return 0;
-    }
-
-    if (seq->_length > 0) {
+    } else if (seq->_length > dser->remain / minpropsize) {
+        seq->_length = 0;
+        return 0;
+    } else if (seq->_length > 0) {
         seq->_buffer = DDS_Security_BinaryPropertySeq_allocbuf(seq->_length);
         for (i = 0; i < seq->_length && r; i++) {
             r = DDS_Security_Deserialize_BinaryProperty(dser, &seq->_buffer[i]);

From 4447fb87ee2acb283bf8b7eaa5b60ab2f38f210f Mon Sep 17 00:00:00 2001
From: Erik Boasson <eb@ilities.com>
Date: Thu, 7 May 2020 09:33:25 +0200
Subject: [PATCH 218/238] No reason to prevent rediscovery for 10s by default

Signed-off-by: Erik Boasson <eb@ilities.com>
---
 docs/manual/options.md       | 2 +-
 etc/cyclonedds.rnc           | 2 +-
 etc/cyclonedds.xsd           | 2 +-
 src/core/ddsi/src/q_config.c | 2 +-
 4 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/docs/manual/options.md b/docs/manual/options.md
index 8341f3d..f8a7aa5 100644
--- a/docs/manual/options.md
+++ b/docs/manual/options.md
@@ -1349,7 +1349,7 @@ is therefore recommended to set it to at least several seconds.
 Valid values are finite durations with an explicit unit or the keyword
 'inf' for infinity. Recognised units: ns, us, ms, s, min, hr, day.
 
-The default value is: "10s".
+The default value is: "0s".
 
 
 #### //CycloneDDS/Domain/Internal/RediscoveryBlacklistDuration[@enforce]
diff --git a/etc/cyclonedds.rnc b/etc/cyclonedds.rnc
index e6ce80d..0898f32 100644
--- a/etc/cyclonedds.rnc
+++ b/etc/cyclonedds.rnc
@@ -1113,7 +1113,7 @@ is therefore recommended to set it to at least several seconds.</p>
 
 <p>Valid values are finite durations with an explicit unit or the keyword
 'inf' for infinity. Recognised units: ns, us, ms, s, min, hr,
-day.</p><p>The default value is: &quot;10s&quot;.</p>""" ] ]
+day.</p><p>The default value is: &quot;0s&quot;.</p>""" ] ]
         element RediscoveryBlacklistDuration {
           [ a:documentation [ xml:lang="en" """
 <p>This attribute controls whether the configured time during which
diff --git a/etc/cyclonedds.xsd b/etc/cyclonedds.xsd
index cca1c3c..8214bf1 100644
--- a/etc/cyclonedds.xsd
+++ b/etc/cyclonedds.xsd
@@ -1475,7 +1475,7 @@ is therefore recommended to set it to at least several seconds.&lt;/p&gt;
 
 &lt;p&gt;Valid values are finite durations with an explicit unit or the keyword
 'inf' for infinity. Recognised units: ns, us, ms, s, min, hr,
-day.&lt;/p&gt;&lt;p&gt;The default value is: &amp;quot;10s&amp;quot;.&lt;/p&gt;</xs:documentation>
+day.&lt;/p&gt;&lt;p&gt;The default value is: &amp;quot;0s&amp;quot;.&lt;/p&gt;</xs:documentation>
     </xs:annotation>
     <xs:complexType>
       <xs:simpleContent>
diff --git a/src/core/ddsi/src/q_config.c b/src/core/ddsi/src/q_config.c
index 6808f31..6bfb3de 100644
--- a/src/core/ddsi/src/q_config.c
+++ b/src/core/ddsi/src/q_config.c
@@ -728,7 +728,7 @@ static const struct cfgelem internal_cfgelems[] = {
     BLURB("<p>Do not use.</p>") },
   { LEAF("SendAsync"), 1, "false", ABSOFF(xpack_send_async), 0, uf_boolean, 0, pf_boolean,
     BLURB("<p>This element controls whether the actual sending of packets occurs on the same thread that prepares them, or is done asynchronously by another thread.</p>") },
-  { LEAF_W_ATTRS("RediscoveryBlacklistDuration", rediscovery_blacklist_duration_attrs), 1, "10s", ABSOFF(prune_deleted_ppant.delay), 0, uf_duration_inf, 0, pf_duration,
+  { LEAF_W_ATTRS("RediscoveryBlacklistDuration", rediscovery_blacklist_duration_attrs), 1, "0s", ABSOFF(prune_deleted_ppant.delay), 0, uf_duration_inf, 0, pf_duration,
     BLURB("<p>This element controls for how long a remote participant that was previously deleted will remain on a blacklist to prevent rediscovery, giving the software on a node time to perform any cleanup actions it needs to do. To some extent this delay is required internally by DDSI2E, but in the default configuration with the 'enforce' attribute set to false, DDSI2E will reallow rediscovery as soon as it has cleared its internal administration. Setting it to too small a value may result in the entry being pruned from the blacklist before DDSI2E is ready, it is therefore recommended to set it to at least several seconds.</p>") },
   { LEAF_W_ATTRS("MultipleReceiveThreads", multiple_recv_threads_attrs), 1, "default", ABSOFF(multiple_recv_threads), 0, uf_boolean_default, 0, pf_boolean_default,
     BLURB("<p>This element controls whether all traffic is handled by a single receive thread (false) or whether multiple receive threads may be used to improve latency (true). By default it is disabled on Windows because it appears that one cannot count on being able to send packets to oneself, which is necessary to stop the thread during shutdown. Currently multiple receive threads are only used for connectionless transport (e.g., UDP) and ManySocketsMode not set to single (the default).</p>") },

From db4f96dc02eeaeabbdfe3399e697644c59dc666c Mon Sep 17 00:00:00 2001
From: Erik Boasson <eb@ilities.com>
Date: Mon, 11 May 2020 16:00:45 +0200
Subject: [PATCH 219/238] Add DDS_STATUS_ID_MAX for ranging over status ids

Signed-off-by: Erik Boasson <eb@ilities.com>
---
 src/core/ddsc/include/dds/dds.h | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src/core/ddsc/include/dds/dds.h b/src/core/ddsc/include/dds/dds.h
index 8383b06..2a63fbb 100644
--- a/src/core/ddsc/include/dds/dds.h
+++ b/src/core/ddsc/include/dds/dds.h
@@ -90,6 +90,7 @@ typedef enum dds_status_id {
   DDS_PUBLICATION_MATCHED_STATUS_ID,
   DDS_SUBSCRIPTION_MATCHED_STATUS_ID
 } dds_status_id_t;
+#define DDS_STATUS_ID_MAX (DDS_SUBSCRIPTION_MATCHED_STATUS_ID)
 
 /** Another topic exists with the same name but with different characteristics. */
 #define DDS_INCONSISTENT_TOPIC_STATUS          (1u << DDS_INCONSISTENT_TOPIC_STATUS_ID)

From 7897dff9ce39110edc23dd14b0c9943529c50e64 Mon Sep 17 00:00:00 2001
From: Erik Boasson <eb@ilities.com>
Date: Mon, 11 May 2020 16:01:48 +0200
Subject: [PATCH 220/238] Merging listeners: only when source is set

This leaves the argument pointer in the destination unchanged, rather
than resetting it to an irrelevant value.

Signed-off-by: Erik Boasson <eb@ilities.com>
---
 src/core/ddsc/src/dds_listener.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/src/core/ddsc/src/dds_listener.c b/src/core/ddsc/src/dds_listener.c
index eee9ef6..ae71ec9 100644
--- a/src/core/ddsc/src/dds_listener.c
+++ b/src/core/ddsc/src/dds_listener.c
@@ -90,8 +90,7 @@ void dds_listener_copy(dds_listener_t * __restrict dst, const dds_listener_t * _
 static bool dds_combine_listener_merge (uint32_t inherited, void (*dst)(void), void (*src)(void))
 {
   (void)inherited;
-  (void)src;
-  return dst == 0;
+  return dst == 0 && src != 0;
 }
 
 static bool dds_combine_listener_override_inherited (uint32_t inherited, void (*dst)(void), void (*src)(void))

From d5d44cc8be3538f72c18d532ff803df19de19f94 Mon Sep 17 00:00:00 2001
From: Erik Boasson <eb@ilities.com>
Date: Thu, 7 May 2020 09:36:20 +0200
Subject: [PATCH 221/238] Refactor oneliner listener tests

The code for executing one-liner tests might be more generally useful.

Signed-off-by: Erik Boasson <eb@ilities.com>
---
 src/core/ddsc/tests/CMakeLists.txt        |    4 +-
 src/core/ddsc/tests/listener.c            |  969 ++---------
 src/core/ddsc/tests/test_oneliner.c       | 1780 +++++++++++++++++++++
 src/core/ddsc/tests/test_oneliner.h       |  326 ++++
 src/core/ddsi/include/dds/ddsi/q_entity.h |    2 +-
 5 files changed, 2200 insertions(+), 881 deletions(-)
 create mode 100644 src/core/ddsc/tests/test_oneliner.c
 create mode 100644 src/core/ddsc/tests/test_oneliner.h

diff --git a/src/core/ddsc/tests/CMakeLists.txt b/src/core/ddsc/tests/CMakeLists.txt
index 0942ce3..bde5eae 100644
--- a/src/core/ddsc/tests/CMakeLists.txt
+++ b/src/core/ddsc/tests/CMakeLists.txt
@@ -59,7 +59,9 @@ set(ddsc_test_sources
     "write_various_types.c"
     "writer.c"
     "test_common.c"
-    "test_common.h")
+    "test_common.h"
+    "test_oneliner.c"
+    "test_oneliner.h")
 
 if(ENABLE_LIFESPAN)
   list(APPEND ddsc_test_sources "lifespan.c")
diff --git a/src/core/ddsc/tests/listener.c b/src/core/ddsc/tests/listener.c
index 6738cf7..2bd4112 100644
--- a/src/core/ddsc/tests/listener.c
+++ b/src/core/ddsc/tests/listener.c
@@ -18,23 +18,14 @@
 #include "dds/ddsrt/string.h"
 #include "dds/ddsrt/environ.h"
 #include "test_common.h"
-
-static ddsrt_mutex_t g_mutex;
-static ddsrt_cond_t g_cond;
-static uint32_t cb_called;
-static dds_entity_t cb_topic, cb_writer, cb_reader, cb_subscriber;
+#include "test_oneliner.h"
 
 #define DEFINE_STATUS_CALLBACK(name, NAME, kind) \
-  static dds_##name##_status_t cb_##name##_status; \
   static void name##_cb (dds_entity_t kind, const dds_##name##_status_t status, void *arg) \
   { \
     (void) arg; \
-    ddsrt_mutex_lock (&g_mutex); \
-    cb_##kind = kind; \
-    cb_##name##_status = status; \
-    cb_called |= DDS_##NAME##_STATUS; \
-    ddsrt_cond_broadcast (&g_cond); \
-    ddsrt_mutex_unlock (&g_mutex); \
+    (void) kind; \
+    (void) status; \
   }
 
 DEFINE_STATUS_CALLBACK (inconsistent_topic, INCONSISTENT_TOPIC, topic)
@@ -51,48 +42,14 @@ DEFINE_STATUS_CALLBACK (subscription_matched, SUBSCRIPTION_MATCHED, reader)
 
 static void data_on_readers_cb (dds_entity_t subscriber, void *arg)
 {
+  (void) subscriber;
   (void) arg;
-  ddsrt_mutex_lock (&g_mutex);
-  cb_subscriber = subscriber;
-  cb_called |= DDS_DATA_ON_READERS_STATUS;
-  ddsrt_cond_broadcast (&g_cond);
-  ddsrt_mutex_unlock (&g_mutex);
 }
 
 static void data_available_cb (dds_entity_t reader, void *arg)
 {
-  (void)arg;
-  ddsrt_mutex_lock (&g_mutex);
-  cb_reader = reader;
-  cb_called |= DDS_DATA_AVAILABLE_STATUS;
-  ddsrt_cond_broadcast (&g_cond);
-  ddsrt_mutex_unlock (&g_mutex);
-}
-
-static void dummy_data_on_readers_cb (dds_entity_t subscriber, void *arg)
-{
-  (void)subscriber;
-  (void)arg;
-}
-
-static void dummy_data_available_cb (dds_entity_t reader, void *arg)
-{
-  (void)reader;
-  (void)arg;
-}
-
-static void dummy_subscription_matched_cb (dds_entity_t reader, const dds_subscription_matched_status_t status, void *arg)
-{
-  (void)reader;
-  (void)status;
-  (void)arg;
-}
-
-static void dummy_liveliness_changed_cb (dds_entity_t reader, const dds_liveliness_changed_status_t status, void *arg)
-{
-  (void)reader;
-  (void)status;
-  (void)arg;
+  (void) reader;
+  (void) arg;
 }
 
 static void dummy_cb (void)
@@ -303,796 +260,7 @@ CU_Test(ddsc_listener, getters_setters)
 
 #undef ASSERT_CALLBACK_EQUAL
 
-/**************************************************
- ****                                          ****
- ****  programmable listener checker           ****
- ****                                          ****
- **************************************************/
-
-// These had better match the corresponding type definitions!
-// n   uint32_t ...count
-// c   int32_t  ...count_change
-// I            instance handle of a data instance
-// P   uint32_t QoS policy ID
-// E            instance handle of an entity
-// R            sample_rejected_status_kind
-static const struct {
-  size_t size;                   // size of status struct
-  const char *desc;              // description of status struct
-  uint32_t mask;                 // status mask, bit in "cb_called"
-  const dds_entity_t *cb_entity; // which cb_... entity to look at
-  const void *cb_status;         // cb_..._status to look at
-} lldesc[] = {
-  { 0, NULL, DDS_DATA_AVAILABLE_STATUS, &cb_reader, NULL }, // data available
-  { 0, NULL, DDS_DATA_ON_READERS_STATUS, &cb_subscriber, NULL }, // data on readers
-  { sizeof (dds_inconsistent_topic_status_t), "nc", DDS_INCONSISTENT_TOPIC_STATUS, &cb_topic, &cb_inconsistent_topic_status },
-  { sizeof (dds_liveliness_changed_status_t), "nnccE", DDS_LIVELINESS_CHANGED_STATUS, &cb_reader, &cb_liveliness_changed_status },
-  { sizeof (dds_liveliness_lost_status_t), "nc", DDS_LIVELINESS_LOST_STATUS, &cb_writer, &cb_liveliness_lost_status },
-  { sizeof (dds_offered_deadline_missed_status_t), "ncI", DDS_OFFERED_DEADLINE_MISSED_STATUS, &cb_writer, &cb_offered_deadline_missed_status },
-  { sizeof (dds_offered_incompatible_qos_status_t), "ncP", DDS_OFFERED_INCOMPATIBLE_QOS_STATUS, &cb_writer, &cb_offered_incompatible_qos_status },
-  { sizeof (dds_publication_matched_status_t), "ncncE", DDS_PUBLICATION_MATCHED_STATUS, &cb_writer, &cb_publication_matched_status },
-  { sizeof (dds_requested_deadline_missed_status_t), "ncI", DDS_REQUESTED_DEADLINE_MISSED_STATUS, &cb_reader, &cb_requested_deadline_missed_status },
-  { sizeof (dds_requested_incompatible_qos_status_t), "ncP", DDS_REQUESTED_INCOMPATIBLE_QOS_STATUS, &cb_reader, &cb_requested_incompatible_qos_status },
-  { sizeof (dds_sample_lost_status_t), "nc", DDS_SAMPLE_LOST_STATUS, &cb_reader, &cb_sample_lost_status },
-  { sizeof (dds_sample_rejected_status_t), "ncRI", DDS_SAMPLE_REJECTED_STATUS, &cb_reader, &cb_sample_rejected_status },
-  { sizeof (dds_subscription_matched_status_t), "ncncE", DDS_SUBSCRIPTION_MATCHED_STATUS, &cb_reader, &cb_subscription_matched_status }
-};
-
-static const void *advance (const void *status, size_t *off, char code)
-{
-#define alignof(type_) offsetof (struct { char c; type_ d; }, d)
-  size_t align = 1, size = 1;
-  switch (code)
-  {
-    case 'n': case 'c': case 'P':
-      align = alignof (uint32_t); size = sizeof (uint32_t);
-      break;
-    case 'E': case 'I':
-      align = alignof (dds_instance_handle_t); size = sizeof (dds_instance_handle_t);
-      break;
-    case 'R':
-      align = alignof (dds_sample_rejected_status_kind); size = sizeof (dds_sample_rejected_status_kind);
-      break;
-    default:
-      abort ();
-  }
-#undef alignof
-  *off = (*off + align - 1) & ~(align - 1);
-  const void *p = (const char *) status + *off;
-  *off += size;
-  return p;
-}
-
-static void get_status (int ll, dds_entity_t ent, void *status)
-{
-  dds_return_t ret;
-  switch (ll)
-  {
-    case 2: ret = dds_get_inconsistent_topic_status (ent, status); break;
-    case 3: ret = dds_get_liveliness_changed_status (ent, status); break;
-    case 4: ret = dds_get_liveliness_lost_status (ent, status); break;
-    case 5: ret = dds_get_offered_deadline_missed_status (ent, status); break;
-    case 6: ret = dds_get_offered_incompatible_qos_status (ent, status); break;
-    case 7: ret = dds_get_publication_matched_status (ent, status); break;
-    case 8: ret = dds_get_requested_deadline_missed_status (ent, status); break;
-    case 9: ret = dds_get_requested_incompatible_qos_status (ent, status); break;
-    case 10: ret = dds_get_sample_lost_status (ent, status); break;
-    case 11: ret = dds_get_sample_rejected_status (ent, status); break;
-    case 12: ret = dds_get_subscription_matched_status (ent, status); break;
-    default: abort ();
-  }
-  CU_ASSERT_FATAL (ret == 0);
-}
-
-static void assert_status_change_fields_are_0 (int ll, dds_entity_t ent)
-{
-  if (lldesc[ll].desc)
-  {
-    const char *d = lldesc[ll].desc;
-    void *status = malloc (lldesc[ll].size);
-    get_status (ll, ent, status);
-    size_t off = 0;
-    while (*d)
-    {
-      const uint32_t *p = advance (status, &off, *d);
-      if (*d == 'c')
-        CU_ASSERT_FATAL (*p == 0);
-      d++;
-    }
-    assert (off <= lldesc[ll].size);
-    free (status);
-  }
-}
-
-static int getentity (const char *tok, bool *isbang, bool *ishash)
-{
-  static const char *known = "PRWrstwxy";
-  const char *p;
-  if (isbang)
-    *isbang = false;
-  if (ishash)
-    *ishash = false;
-  if ((p = strchr (known, *tok)) == NULL)
-    return -1;
-  int ent = (int) (p - known);
-  if (*++tok == 0)
-    return ent;
-  if (*tok == '\'')
-  {
-    ent += (int) strlen (known);
-    tok++;
-  }
-  while (*tok == '!' || *tok == '#')
-  {
-    if (strchr (known + 3, *p) == NULL)
-      return -1; // only readers, writers
-    if (*tok == '!' && isbang)
-      *isbang = true;
-    else if (*tok == '#' && ishash)
-      *ishash = true;
-    tok++;
-  }
-  return (*tok == 0) ? ent : -1;
-}
-
-static int getlistener (const char *tok, bool *isbang)
-{
-  // note: sort order is on full name (so sample rejected precedes subscription matched)
-  static const char *ls[] = {
-    "da", "dor", "it", "lc", "ll", "odm", "oiq", "pm", "rdm", "riq", "sl", "sr", "sm"
-  };
-  if (isbang)
-    *isbang = false;
-  for (size_t i = 0; i < sizeof (ls) / sizeof (*ls); i++)
-  {
-    size_t n = strlen (ls[i]);
-    if (strncmp (tok, ls[i], n) == 0 && (tok[n] == 0 || tok[n+1] == ','))
-    {
-      if (isbang)
-        *isbang = (tok[n] == '!');
-      return (int) i;
-    }
-  }
-  return -1;
-}
-
-struct ents {
-  dds_entity_t es[2 * 9];
-  dds_entity_t tps[2];
-  dds_entity_t doms[2];
-  dds_instance_handle_t esi[2 * 9];
-  // built-in topic readers for cross-referencing instance handles
-  dds_entity_t pubrd[2];
-  dds_entity_t subrd[2];
-};
-
-static void make_participant (struct ents *es, const char *topicname, int ent, const dds_qos_t *qos, dds_listener_t *list)
-{
-  const dds_domainid_t domid = (ent < 9) ? 0 : 1;
-  char *conf = ddsrt_expand_envvars ("${CYCLONEDDS_URI}${CYCLONEDDS_URI:+,}<Discovery><ExternalDomainId>0</ExternalDomainId></Discovery>", domid);
-  printf ("create domain %"PRIu32, domid);
-  fflush (stdout);
-  es->doms[domid] = dds_create_domain (domid, conf);
-  CU_ASSERT_FATAL (es->doms[domid] > 0);
-  ddsrt_free (conf);
-  printf (" create participant P%s", (ent < 9) ? "" : "'");
-  fflush (stdout);
-  es->es[ent] = dds_create_participant (domid, NULL, list);
-  CU_ASSERT_FATAL (es->es[ent] > 0);
-  es->tps[domid] = dds_create_topic (es->es[ent], &Space_Type1_desc, topicname, qos, NULL);
-  CU_ASSERT_FATAL (es->tps[domid] > 0);
-
-  // Create the built-in topic readers with a dummy listener to avoid any event (data available comes to mind)
-  // from propagating to the normal data available listener, in case it has been set on the participant.
-  //
-  // - dummy_cb aborts when it is invoked, but all reader-related listeners that can possibly trigger are set
-  //   separately (incompatible qos, deadline missed, sample lost and sample rejected are all impossible by
-  //   construction)
-  // - regarding data_on_readers: Cyclone handles listeners installed on an ancestor by *inheriting* them,
-  //   rather than by walking up ancestor chain. Setting data_on_readers on the reader therefore overrides the
-  //   listener set on the subscriber. It is a nice feature!
-  dds_listener_t *dummylist = dds_create_listener (NULL);
-  set_all_const (dummylist, dummy_cb);
-  dds_lset_data_available (dummylist, dummy_data_available_cb);
-  dds_lset_data_on_readers (dummylist, dummy_data_on_readers_cb);
-  dds_lset_subscription_matched (dummylist, dummy_subscription_matched_cb);
-  dds_lset_liveliness_changed (dummylist, dummy_liveliness_changed_cb);
-  es->pubrd[domid] = dds_create_reader (es->es[ent], DDS_BUILTIN_TOPIC_DCPSPUBLICATION, NULL, dummylist);
-  CU_ASSERT_FATAL (es->pubrd[domid] > 0);
-  es->subrd[domid] = dds_create_reader (es->es[ent], DDS_BUILTIN_TOPIC_DCPSSUBSCRIPTION, NULL, dummylist);
-  CU_ASSERT_FATAL (es->subrd[domid] > 0);
-  dds_delete_listener (dummylist);
-  printf ("pubrd %"PRId32" subrd %"PRId32" sub %"PRId32"\n", es->pubrd[domid], es->subrd[domid], dds_get_parent (es->pubrd[domid]));
-}
-
-static void make_entity1 (struct ents *es, const char *topicname, int ent, bool isbang, bool ishash, const dds_qos_t *qos, dds_qos_t *rwqos, dds_listener_t *list)
-{
-  dds_return_t ret;
-  switch (ent)
-  {
-    case 0: case 9:
-      make_participant (es, topicname, ent, qos, list);
-      break;
-    case 1: case 10:
-      if (es->es[ent-1] == 0)
-      {
-        printf ("[");
-        make_entity1 (es, topicname, ent-1, false, false, qos, rwqos, NULL);
-        printf ("] ");
-      }
-      printf ("create subscriber R%s", (ent < 9) ? "" : "'");
-      fflush (stdout);
-      es->es[ent] = dds_create_subscriber (es->es[ent-1], NULL, list);
-      break;
-    case 2: case 11:
-      if (es->es[ent-2] == 0)
-      {
-        printf ("[");
-        make_entity1 (es, topicname, ent-2, false, false, qos, rwqos, NULL);
-        printf ("] ");
-      }
-      printf ("create publisher W%s", (ent < 9) ? "" : "'");
-      fflush (stdout);
-      es->es[ent] = dds_create_publisher (es->es[ent-2], NULL, list);
-      break;
-    case 3: case 4: case 5: case 12: case 13: case 14:
-      if (es->es[ent < 9 ? 1 : 10] == 0)
-      {
-        printf ("[");
-        make_entity1 (es, topicname, ent < 9 ? 1 : 10, false, false, qos, rwqos, NULL);
-        printf ("] ");
-      }
-      printf ("create %s reader %c%s", isbang ? "best-effort" : "reliable", 'r' + (ent < 9 ? ent-3 : ent-12), (ent < 9) ? "" : "'");
-      fflush (stdout);
-      dds_reset_qos (rwqos);
-      if (isbang)
-        dds_qset_reliability (rwqos, DDS_RELIABILITY_BEST_EFFORT, DDS_MSECS (100));
-      if (ishash)
-        dds_qset_resource_limits (rwqos, 1, DDS_LENGTH_UNLIMITED, DDS_LENGTH_UNLIMITED);
-      es->es[ent] = dds_create_reader (es->es[ent < 9 ? 1 : 10], es->tps[ent < 9 ? 0 : 1], rwqos, list);
-      break;
-    case 6: case 7: case 8: case 15: case 16: case 17:
-      if (es->es[ent < 9 ? 2 : 11] == 0)
-      {
-        printf ("[");
-        make_entity1 (es, topicname, ent < 9 ? 2 : 11, false, false, qos, rwqos, NULL);
-        printf ("] ");
-      }
-      printf ("create %s writer %c%s", isbang ? "best-effort" : "reliable", 'w' + (ent < 9 ? ent-6 : ent-15), (ent < 9) ? "" : "'");
-      fflush (stdout);
-      dds_reset_qos (rwqos);
-      if (isbang)
-        dds_qset_reliability (rwqos, DDS_RELIABILITY_BEST_EFFORT, DDS_MSECS (100));
-      if (ishash)
-        dds_qset_resource_limits (rwqos, 1, DDS_LENGTH_UNLIMITED, DDS_LENGTH_UNLIMITED);
-      es->es[ent] = dds_create_writer (es->es[ent < 9 ? 2 : 11], es->tps[ent < 9 ? 0 : 1], rwqos, list);
-      break;
-    default:
-      abort ();
-  }
-  printf (" = %"PRId32, es->es[ent]);
-  fflush (stdout);
-  CU_ASSERT_FATAL (es->es[ent] > 0);
-  ret = dds_get_instance_handle (es->es[ent], &es->esi[ent]);
-  //printf (" %"PRIx64, es->esi[ent]);
-  //fflush (stdout);
-  CU_ASSERT_FATAL (ret == 0);
-}
-
-static void make_entity (struct ents *es, const char *topicname, int ent, bool isbang, bool ishash, const dds_qos_t *qos, dds_qos_t *rwqos, dds_listener_t *list)
-{
-  make_entity1 (es, topicname, ent, isbang, ishash, qos, rwqos, list);
-  printf ("\n");
-}
-
-static char *strsep_noempty (char **cursor, const char *sep)
-{
-  char *tok;
-  while ((tok = ddsrt_strsep (cursor, sep)) != NULL && *tok == 0) { }
-  return tok;
-}
-
-static dds_instance_handle_t lookup_insthandle (const struct ents *es, int ent, int ent1)
-{
-  // if both are in the same domain, it's easy
-  if (ent / 9 == ent1 / 9)
-    return es->esi[ent1];
-  else
-  {
-    // if they aren't ... find GUID from instance handle in the one domain,
-    // then find instance handle for GUID in the other
-    dds_entity_t rd1 = 0, rd2 = 0;
-    switch (ent1)
-    {
-      case  3: case  4: case  5: rd1 = es->subrd[0]; rd2 = es->subrd[1]; break;
-      case 12: case 13: case 14: rd1 = es->subrd[1]; rd2 = es->subrd[0]; break;
-      case  6: case  7: case  8: rd1 = es->pubrd[0]; rd2 = es->pubrd[1]; break;
-      case 15: case 16: case 17: rd1 = es->pubrd[1]; rd2 = es->pubrd[0]; break;
-      default: abort ();
-    }
-
-    dds_return_t ret;
-    dds_builtintopic_endpoint_t keysample;
-    //printf ("(in %"PRId32" %"PRIx64" -> ", rd1, es->esi[ent1]);
-    //fflush (stdout);
-    ret = dds_instance_get_key (rd1, es->esi[ent1], &keysample);
-    CU_ASSERT_FATAL (ret == 0);
-    // In principle, only key fields are set in sample returned by get_key;
-    // in the case of a built-in topic that is extended to the participant
-    // key. The qos and topic/type names should not be set, and there is no
-    // (therefore) memory allocated for the sample.
-    CU_ASSERT_FATAL (keysample.qos == NULL);
-    CU_ASSERT_FATAL (keysample.topic_name == NULL);
-    CU_ASSERT_FATAL (keysample.type_name == NULL);
-    //for (size_t j = 0; j < sizeof (keysample.key.v); j++)
-    //  printf ("%s%02x", (j > 0 && j % 4 == 0) ? ":" : "", keysample.key.v[j]);
-    const dds_instance_handle_t ih = dds_lookup_instance (rd2, &keysample);
-    CU_ASSERT_FATAL (ih != 0);
-    //printf (" -> %"PRIx64")", ih);
-    //fflush (stdout);
-    return ih;
-  }
-}
-
-static void checkstatus (int ll, const struct ents *es, int ent, const char *args, const void *status)
-{
-  DDSRT_WARNING_MSVC_OFF(4996); // use of sscanf triggers a warning
-  if (*args == 0)
-    return;
-  if (*args++ != '(')
-    abort ();
-  assert (lldesc[ll].desc != NULL);
-  const char *d = lldesc[ll].desc;
-  const char *sep = "(";
-  size_t off = 0;
-  while (*d)
-  {
-    const void *p = advance (status, &off, *d);
-    char str[32];
-    unsigned u;
-    int i, pos = -1;
-    switch (*d)
-    {
-      case 'n':
-        if (sscanf (args, "%u%n", &u, &pos) != 1 || (args[pos] != ',' && args[pos] != ')'))
-          abort ();
-        printf ("%s%"PRIu32" %u", sep, *(uint32_t *)p, u); fflush (stdout);
-        CU_ASSERT_FATAL (*(uint32_t *)p == u);
-        break;
-      case 'c':
-        if (sscanf (args, "%d%n", &i, &pos) != 1 || (args[pos] != ',' && args[pos] != ')'))
-          abort ();
-        printf ("%s%"PRId32" %d", sep, *(int32_t *)p, i); fflush (stdout);
-        CU_ASSERT_FATAL (*(int32_t *)p == i);
-        break;
-      case 'P': // policy id: currently fixed at reliability
-        pos = -1; // not actually consuming an argument
-        printf ("%s%"PRIu32" %d", sep, *(uint32_t *)p, (int) DDS_RELIABILITY_QOS_POLICY_ID); fflush (stdout);
-        CU_ASSERT_FATAL (*(uint32_t *)p == (uint32_t) DDS_RELIABILITY_QOS_POLICY_ID);
-        break;
-      case 'R':
-        if (sscanf (args, "%31[^,)]%n", str, &pos) != 1 || (args[pos] != ',' && args[pos] != ')'))
-          abort ();
-        if (strcmp (str, "i") == 0)
-          i = (int) DDS_REJECTED_BY_INSTANCES_LIMIT;
-        else if (strcmp (str, "s") == 0)
-          i = (int) DDS_REJECTED_BY_SAMPLES_LIMIT;
-        else if (strcmp (str, "spi") == 0)
-          i = (int) DDS_REJECTED_BY_SAMPLES_PER_INSTANCE_LIMIT;
-        else
-          abort ();
-        printf ("%s%d %d", sep, (int) *(dds_sample_rejected_status_kind *)p, i); fflush (stdout);
-        CU_ASSERT_FATAL (*(dds_sample_rejected_status_kind *)p == (dds_sample_rejected_status_kind) i);
-        break;
-      case 'I': // instance handle is too complicated
-        pos = -1; // not actually consuming an argument
-        break;
-      case 'E': {
-        int ent1 = -1;
-        dds_instance_handle_t esi1 = 0;
-        if (sscanf (args, "%31[^,)]%n", str, &pos) != 1 || (args[pos] != ',' && args[pos] != ')'))
-          abort ();
-        if (strcmp (str, "*") != 0 && (ent1 = getentity (str, NULL, NULL)) < 0)
-          abort ();
-        if (ent1 != -1)
-          esi1 = lookup_insthandle (es, ent, ent1);
-        printf ("%s%"PRIx64" %"PRIx64, sep, *(dds_instance_handle_t *)p, esi1); fflush (stdout);
-        CU_ASSERT_FATAL (ent1 == -1 || *(dds_instance_handle_t *)p == esi1);
-        break;
-      }
-      default: abort ();
-    }
-    args += pos + 1;
-    sep = ", ";
-    d++;
-  }
-  printf (")");
-  assert (*args == 0);
-  assert (off <= lldesc[ll].size);
-  DDSRT_WARNING_MSVC_ON(4996);
-}
-
-/** @brief run a "test" consisting of a sequence of simplish operations
- *
- * This operation takes a test description, really a program in a bizarre syntax, and executes it.  Any failures,
- * be it because of error codes coming out of the Cyclone calls or expected values being wrong cause it to fail
- * the test via CU_ASSERT_FATAL. While it is doing this, it outputs the test steps to stdout including some
- * actual values. An invalid program is mostly reported by calling abort(). It is geared towards checking for
- * listener invocations and the effects on statuses.
- *
- * Entities in play:
- *
- * - participants:   P      P'
- * - subscribers:    R      R'
- * - publishers:     W      W'
- * - readers:        r s t  r' s' t'
- * - writers:        w x y  w' x' y'
- *
- * The unprimed ones exist in domain 0, the primed ones in domain 1 (but configured such that it talks to
- * domain 0), so that network-related listener invocations can be checked as well.
- *
- * The first mention of an entity creates it as well as its ancestors.  Implicitly created ancestors always have
- * standard QoS and have no listeners. There is one topic that is created implicitly when the participant is
- * created.
- *
- * Standard QoS is: default + reliable (100ms), by-source-timestamp, keep-all.
- * The QoS of a reader/writer can be altered at the first mention of it by suffixing its name with "!" and/or "#"
- * (the apostrophe is part of the name, so w#! or r'! are valid). Those suffixes are ignored if the entity
- * already exists.
- *
- * A program consists of a sequence of operations separated by whitespace, ';' or '/' (there is no meaning to the
- * separators, they exist to allow visual grouping):
- *
- * PROGRAM     ::= (OP (\s+|[/;])*)*
- *
- * OP          ::= (LISTENER)* ENTITY-NAME
- *                       if entity ENTITY-NAME does not exist:
- *                         creates the entity with the given listeners installed
- *                       else
- *                         changes the entity's listeners to the specified ones
- *                       (see above for the valid ENTITY-NAMEs)
- *               | -ENTITY-NAME
- *                       deletes the specified entity
- *               | WRITE-LIKE[fail][@DT] KEY <entity name>
- *                       writes/disposes/unregisters key KEY (an integer), if "fail" is appended, the
- *                       expectation is that it fails with a timeout, if @DT is appended, the timestamp is the
- *                       start time of the test + <dt>s rather than the current time; DT is a floating-point
- *                       number
- *               | READ-LIKE[(A,B))] <entity name>
- *                       reads/takes at most 10 samples, counting the number of valid and invalid samples seen
- *                       and checking it against A and B if given
- *               | ?LISTENER[(ARGS)] <entity name>
- *                       waits until the specified listener has been invoked on <entity name> using a flag set
- *                       by the listener function, resets the flag and verifies that neither the entity status
- *                       bit nor the "change" fields in the various statuses were set
- *                       ARGS is used to check the status argument most recently passed to the listener:
- *                         it        (A,B) verifies count and change match A and B, policy matches RELIABILITY
- *                         lc        (A,B,C,D,E) verifies that alive and not-alive counts match A and B, that
- *                                   alive and not-alive changes match C and D and that the last handle matches
- *                                   E if an entity name (ignored if E = "*")
- *                         ll        (A,B) verifies count and change match A and B
- *                         odm       (A,B) verifies count and change match A and B, last handle is ignored
- *                         oiq       (A,B) verifies that total count and change match A and B and that the
- *                                   mismatching QoS is reliability (the only one that can for now)
- *                         pm        (A,B,C,D,E) verifies that total count and change match A and B, that
- *                                   current count and change match C and D and that the last handle matches E
- *                                   if an entity name (ignored if E = "*")
- *                         rdm       see odm
- *                         riq       see oiq
- *                         sl        (A,B) verifies that total count and change match A and B
- *                         sr        (A,B,C) verifies total count and change match A and B, and that the reason
- *                                   matches C (one of "s" for samples, "i" for instances, "spi" for samples
- *                                   per instance)
- *                         sm        see pm
- *               | ?!LISTENER
- *                       (not listener) tests that LISTENER has not been invoked since last reset
- *               | sleep D
- *                       delay program execution for D s (D is a floating-point number)
- * WRITE-LIKE  ::= wr    write
- *               | wrdisp  write-dispose
- *               | disp  dispose
- *               | unreg unregister
- * READ-LIKE   ::= read  dds_read (so any state)
- *               | take  dds_take (so any state)
- * LISTENER    ::= da    data available (acts on a reader)
- *               | dor   data on readers (acts on a subcsriber)
- *               | it    incompatible topic (acts on a topic)
- *               | lc    liveliness changed (acts on a reader)
- *               | ll    liveliness lost (acts on a writer)
- *               | odm   offered deadline missed (acts on a writer)
- *               | oiq   offered incompatible QoS (acts on a writer)
- *               | pm    publication matched (acts on a writer)
- *               | rdm   requested deadline missed (acts on a reader)
- *               | riq   requested incompatible QoS (acts on a reader)
- *               | sl    sample lost (acts on a reader)
- *               | sr    sample rejected (acts on a reader)
- *               | sm    subscription matched (acts on a reader)
- *
- * All entities share the listeners with their global state. Only the latest invocation is visible.
- *
- * @param[in]  ops  Program to execute.
- */
-static void dotest (const char *ops)
-{
-  DDSRT_WARNING_MSVC_OFF(4996); // use of sscanf triggers a warning
-  static const char *sep = " /;\n\t\r\v";
-  char *opscopy = ddsrt_strdup (ops), *cursor = opscopy, *tok;
-  struct ents es;
-  dds_return_t ret;
-  Space_Type1 sample;
-  char topicname[100];
-  dds_qos_t *qos = dds_create_qos (), *rwqos = dds_create_qos ();
-  dds_listener_t *list = dds_create_listener (NULL);
-  const dds_time_t tref = dds_time ();
-  CU_ASSERT_FATAL (qos != NULL);
-  CU_ASSERT_FATAL (rwqos != NULL);
-  CU_ASSERT_FATAL (list != NULL);
-  dds_qset_reliability (qos, DDS_RELIABILITY_RELIABLE, DDS_MSECS (100));
-  dds_qset_destination_order (qos, DDS_DESTINATIONORDER_BY_SOURCE_TIMESTAMP);
-  dds_qset_history (qos, DDS_HISTORY_KEEP_ALL, 0);
-  memset (&es, 0, sizeof (es));
-  memset (&sample, 0, sizeof (sample));
-
-  ddsrt_mutex_init (&g_mutex);
-  ddsrt_cond_init (&g_cond);
-  ddsrt_mutex_lock (&g_mutex);
-  cb_called = 0;
-  ddsrt_mutex_unlock (&g_mutex);
-
-  create_unique_topic_name ("ddsc_listener_test", topicname, 100);
-  printf ("dotest: %s\n", ops);
-  printf ("topic: %s\n", topicname);
-  while ((tok = strsep_noempty (&cursor, sep)) != NULL)
-  {
-    int ent, ll;
-    bool isbang, ishash;
-    if ((ent = getentity (tok, &isbang, &ishash)) >= 0)
-    {
-      make_entity (&es, topicname, ent, isbang, ishash, qos, rwqos, NULL);
-    }
-    else if (*tok == '-' && (ent = getentity (tok + 1, NULL, NULL)) >= 0)
-    {
-      // delete deliberately leaves the instance handle in place for checking
-      // the publication/subscription handle in subscription matched/publication
-      // matched for a lost match
-      printf ("delete %"PRId32"\n", es.es[ent]);
-      ret = dds_delete (es.es[ent]);
-      CU_ASSERT_FATAL (ret == 0);
-      es.es[ent] = 0;
-    }
-    else if ((ll = getlistener (tok, &isbang)) >= 0)
-    {
-      printf ("set listener:");
-      dds_reset_listener (list);
-      do {
-        printf (" %s", tok);
-        switch (ll)
-        {
-          case 0: dds_lset_data_available (list, isbang ? 0 : data_available_cb); break;
-          case 1: dds_lset_data_on_readers (list, isbang ? 0 : data_on_readers_cb); break;
-          case 2: dds_lset_inconsistent_topic (list, isbang ? 0: inconsistent_topic_cb); break;
-          case 3: dds_lset_liveliness_changed (list, isbang ? 0 : liveliness_changed_cb); break;
-          case 4: dds_lset_liveliness_lost (list, isbang ? 0 : liveliness_lost_cb); break;
-          case 5: dds_lset_offered_deadline_missed (list, isbang ? 0 : offered_deadline_missed_cb); break;
-          case 6: dds_lset_offered_incompatible_qos (list, isbang ? 0 : offered_incompatible_qos_cb); break;
-          case 7: dds_lset_publication_matched (list, isbang ? 0 : publication_matched_cb); break;
-          case 8: dds_lset_requested_deadline_missed (list, isbang ? 0 : requested_deadline_missed_cb); break;
-          case 9: dds_lset_requested_incompatible_qos (list, isbang ? 0 : requested_incompatible_qos_cb); break;
-          case 10: dds_lset_sample_lost (list, isbang ? 0 : sample_lost_cb); break;
-          case 11: dds_lset_sample_rejected (list, isbang ? 0 : sample_rejected_cb); break;
-          case 12: dds_lset_subscription_matched (list, isbang ? 0 : subscription_matched_cb); break;
-          default: abort ();
-        }
-      } while ((tok = strsep_noempty (&cursor, sep)) != NULL && (ll = getlistener (tok, &isbang)) >= 0);
-      if (tok == NULL || (ent = getentity (tok, &isbang, &ishash)) < 0)
-        abort ();
-      if (es.es[ent] == 0)
-      {
-        printf (" for ");
-        make_entity (&es, topicname, ent, isbang, ishash, qos, rwqos, list);
-      }
-      else
-      {
-        dds_listener_t *tmplist = dds_create_listener (NULL);
-        CU_ASSERT_FATAL (tmplist != NULL);
-        ret = dds_get_listener (es.es[ent], tmplist);
-        CU_ASSERT_FATAL (ret == 0);
-        dds_merge_listener (list, tmplist);
-        dds_delete_listener (tmplist);
-        printf (" on entity %"PRId32"\n", es.es[ent]);
-        ret = dds_set_listener (es.es[ent], list);
-        CU_ASSERT_FATAL (ret == 0);
-      }
-    }
-    else if (strncmp (tok, "wr", 2) == 0 || strncmp (tok, "disp", 4) == 0 || strncmp (tok, "unreg", 5) == 0)
-    {
-      dds_return_t (*fn) (dds_entity_t wr, const void *sample, dds_time_t ts) = 0;
-      double dt = 0.0;
-      dds_time_t ts = dds_time ();
-      char *cmd = tok;
-      bool expectfail = false;
-      int off, pos, key;
-      if ((tok = strsep_noempty (&cursor, sep)) == NULL)
-        abort ();
-      if (sscanf (tok, "%d%n", &key, &pos) != 1 || tok[pos] != 0)
-        abort ();
-      if ((tok = strsep_noempty (&cursor, sep)) == NULL || (ent = getentity (tok, &isbang, &ishash)) < 0)
-        abort ();
-      if (es.es[ent] == 0)
-        make_entity (&es, topicname, ent, isbang, ishash, qos, rwqos, NULL);
-      switch (cmd[0])
-      {
-        case 'w':
-          if (strncmp (cmd + 2, "disp", 4) == 0) {
-            off = 6; fn = dds_writedispose_ts;
-          } else {
-            off = 2; fn = dds_write_ts;
-          }
-          break;
-        case 'd': off = 4; fn = dds_dispose_ts; break;
-        case 'u': off = 5; fn = dds_unregister_instance_ts; break;
-        default: abort ();
-      }
-      if (strncmp (cmd + off, "fail", 4) == 0)
-      {
-        expectfail = true;
-        off += 4;
-      }
-      if (cmd[off] == '@')
-      {
-        if (sscanf (cmd + off, "@%lf%n", &dt, &pos) != 1 || cmd[off + pos] != 0)
-          abort ();
-        ts = tref + (dds_time_t) (dt * 1e9);
-      }
-      sample.long_1 = key;
-      printf ("entity %"PRId32": %*.*s@%"PRId64".%09"PRId64" %d\n", es.es[ent], off, off, cmd, ts / DDS_NSECS_IN_SEC, ts % DDS_NSECS_IN_SEC, key);
-      ret = fn (es.es[ent], &sample, ts);
-      if (expectfail) {
-        CU_ASSERT_FATAL (ret == DDS_RETCODE_TIMEOUT);
-      } else {
-        CU_ASSERT_FATAL (ret == 0);
-      }
-    }
-    else if (strncmp (tok, "take", 4) == 0 || strncmp(tok, "read", 4) == 0)
-    {
-      char *args = (tok[4] ? tok + 4 : NULL);
-      int exp_nvalid = -1, exp_ninvalid = -1, pos;
-      dds_return_t (*fn) (dds_entity_t, void **buf, dds_sample_info_t *, size_t, uint32_t);
-      fn = (strncmp (tok, "take", 4) == 0) ? dds_take : dds_read;
-      assert (args == NULL || *args == '(');
-      if (args && (sscanf (args, "(%d,%d)%n", &exp_nvalid, &exp_ninvalid, &pos) != 2 || args[pos] != 0))
-        abort ();
-      if ((tok = strsep_noempty (&cursor, sep)) == NULL || (ent = getentity (tok, &isbang, &ishash)) < 0)
-        abort ();
-      if (es.es[ent] == 0)
-        make_entity (&es, topicname, ent, isbang, ishash, qos, rwqos, NULL);
-      printf ("entity %"PRId32": %s", es.es[ent], (fn == dds_take) ? "take" : "read");
-      fflush (stdout);
-      void *raw[10] = { NULL };
-      dds_sample_info_t si[10];
-      const uint32_t maxs = (uint32_t) (sizeof (raw) / sizeof (raw[0]));
-      int count[2] = { 0, 0 };
-      ret = fn (es.es[ent], raw, si, maxs, maxs);
-      CU_ASSERT_FATAL (ret >= 0);
-      for (int32_t i = 0; i < ret; i++)
-        count[si[i].valid_data]++;
-      ret = dds_return_loan (es.es[ent], raw, ret);
-      CU_ASSERT_FATAL (ret == 0);
-      printf (" valid %d %d invalid %d %d\n", count[1], exp_nvalid, count[0], exp_ninvalid);
-      if (exp_nvalid >= 0)
-        CU_ASSERT_FATAL (count[1] == exp_nvalid);
-      if (exp_ninvalid >= 0)
-        CU_ASSERT_FATAL (count[0] == exp_ninvalid);
-    }
-    else if (tok[0] == '?')
-    {
-      const bool expectclear = (tok[1] == '!');
-      const char *llname = tok + (expectclear ? 2 : 1);
-      char *checkargs;
-      if ((checkargs = strchr (llname, '(')) != NULL)
-        *checkargs = 0; // clear so getlistener groks the input
-      if ((ll = getlistener (llname, NULL)) < 0)
-        abort ();
-      if (expectclear)
-      {
-        printf ("listener %s: check not called", llname);
-        fflush (stdout);
-        ddsrt_mutex_lock (&g_mutex);
-        printf (" cb_called %"PRIx32" %s\n", cb_called, (cb_called & lldesc[ll].mask) == 0 ? "ok" : "fail");
-        CU_ASSERT_FATAL ((cb_called & lldesc[ll].mask) == 0);
-        ddsrt_mutex_unlock (&g_mutex);
-      }
-      else
-      {
-        bool signalled = true;
-        uint32_t status;
-        if ((tok = strsep_noempty (&cursor, sep)) == NULL || (ent = getentity (tok, &isbang, &ishash)) < 0)
-          abort ();
-        if (es.es[ent] == 0)
-          make_entity (&es, topicname, ent, isbang, ishash, qos, rwqos, NULL);
-        if ((size_t) ll >= sizeof (lldesc) / sizeof (*lldesc))
-          abort ();
-        printf ("listener %s: check called for entity %"PRId32, llname, es.es[ent]);
-        fflush (stdout);
-        ddsrt_mutex_lock (&g_mutex);
-        while ((cb_called & lldesc[ll].mask) == 0 && signalled)
-          signalled = ddsrt_cond_waitfor (&g_cond, &g_mutex, DDS_SECS (5));
-        printf (" cb_called %"PRIx32" (%s)", cb_called, (cb_called & lldesc[ll].mask) != 0 ? "ok" : "fail");
-        fflush (stdout);
-        CU_ASSERT_FATAL ((cb_called & lldesc[ll].mask) != 0);
-        printf (" cb_entity %"PRId32" %"PRId32" (%s)", *lldesc[ll].cb_entity, es.es[ent], (*lldesc[ll].cb_entity == es.es[ent]) ? "ok" : "fail");
-        fflush (stdout);
-        CU_ASSERT_FATAL (*lldesc[ll].cb_entity == es.es[ent]);
-        if (!(es.doms[0] && es.doms[1]))
-        {
-          // FIXME: two domains: listener invocation happens on another thread and we can observe non-0 "change" fields
-          // they get updated, listener gets invoked, then they get reset -- pretty sure it is allowed by the spec, but
-          // not quite elegant
-          assert_status_change_fields_are_0 (ll, es.es[ent]);
-        }
-        if (checkargs && lldesc[ll].cb_status)
-        {
-          *checkargs = '('; // restore ( so checkargs function gets a more sensible input
-          checkstatus (ll, &es, ent, checkargs, lldesc[ll].cb_status);
-        }
-        printf ("\n");
-        cb_called &= ~lldesc[ll].mask;
-        ddsrt_mutex_unlock (&g_mutex);
-        ret = dds_get_status_changes (es.es[ent], &status);
-        CU_ASSERT_FATAL (ret == 0);
-        CU_ASSERT_FATAL ((status & lldesc[ll].mask) == 0);
-      }
-    }
-    else if (strcmp (tok, "sleep") == 0)
-    {
-      if ((tok = strsep_noempty (&cursor, sep)) == NULL)
-        abort ();
-      double d; int pos;
-      if (sscanf (tok, "%lf%n", &d, &pos) != 1 || tok[pos] != 0)
-        abort ();
-      printf ("sleep %fs\n", d);
-      dds_sleepfor ((dds_duration_t) (d * 1e9));
-    }
-    else
-    {
-      printf ("tok '%s': unrecognized\n", tok);
-      abort ();
-    }
-  }
-
-  dds_delete_listener (list);
-  dds_delete_qos (rwqos);
-  dds_delete_qos (qos);
-  // prevent any listeners from being invoked so we can safely delete the
-  // mutex and the condition variable -- must do this going down the
-  // hierarchy, or listeners may remain set through inheritance
-  for (size_t i = 0; i < sizeof (es.es) / sizeof (es.es[0]); i++)
-  {
-    if (es.es[i])
-    {
-      ret = dds_set_listener (es.es[i], NULL);
-      CU_ASSERT_FATAL (ret == 0);
-    }
-  }
-  ddsrt_mutex_destroy (&g_mutex);
-  ddsrt_cond_destroy (&g_cond);
-  for (size_t i = 0; i < sizeof (es.doms) / sizeof (es.doms[0]); i++)
-  {
-    if (es.doms[i])
-    {
-      ret = dds_delete (es.doms[i]);
-      CU_ASSERT_FATAL (ret == 0);
-    }
-  }
-  ddsrt_free (opscopy);
-  DDSRT_WARNING_MSVC_ON(4996);
-}
-
-/**************************************************
- ****                                          ****
- ****  listener invocation checks              ****
- ****                                          ****
- **************************************************/
+#define dotest(ops) CU_ASSERT_FATAL (test_oneliner (ops) > 0)
 
 CU_Test (ddsc_listener, propagation)
 {
@@ -1102,10 +270,10 @@ CU_Test (ddsc_listener, propagation)
   // for it on the reader should prevent that from happening
   dotest ("da dor lc sm P ; ?!dor ?!da ?!sm ?!lc");
   // writing data should trigger data-available unless data-on-readers is set
-  dotest ("da lc sm P ; r ; wr 0 w ; ?da r ?sm r ?lc r");
-  dotest ("da dor lc sm P ; r ; wr 0 w ; ?!da ; ?dor R ?sm r ?lc r");
+  dotest ("da lc sm P ; r ; wr w 0 ; ?da r ?sm r ?lc r");
+  dotest ("da dor lc sm P ; r ; wr w 0 ; ?!da ; ?dor R ?sm r ?lc r");
   // setting listeners after entity creation should work, too
-  dotest ("P W R ; dor P pm W sm R ; r w ; ?sm r ?pm w ; wr 0 w ; ?dor R ; ?!da");
+  dotest ("P W R ; dor P pm W sm R ; r w ; ?sm r ?pm w ; wr w 0 ; ?dor R ; ?!da");
 }
 
 CU_Test (ddsc_listener, matched)
@@ -1116,6 +284,47 @@ CU_Test (ddsc_listener, matched)
   // across the network it should work just as well (matching happens on different threads for
   // remote & local entity creation, so it is meaningfully different test)
   dotest ("sm r pm w' ?pm w' ?sm r");
+
+  // Disconnect + reconnect; "deaf P" means the disconnect is asymmetrical: P no longer observes P'
+  // but P' still observes P.  If r did not ACK the data before losing connectivity, w' will hold
+  // the data and it will be re-delivered after reconnecting, depending on QoS settings (the "..."
+  // allows for extra samples) and whether the instance was taken or not
+  //
+  // the uncertainty also means we don't really know how many "data available" events there will be
+  // and the "sleep 0.3" simply gives it a bit more time after the first event
+  dotest ("sm da r pm w' ; ?sm r ?pm w' ;"
+          " wr w' 1 ; ?da r take{(1,0,0)} r sleep 1;"
+          " deaf P ; ?sm(1,0,0,-1,w') r ?da r take{d1} r ; wr w' 2 ;"
+          " hearing P ; ?sm(2,1,1,1,w') r ?da r sleep 0.3 take{(2,0,0),...} r ; ?!pm");
+  // same without taking the "dispose" after disconnect
+  // sample 1 will be delivered anew
+  dotest ("sm da r pm w' ; ?sm r ?pm w' ; wr w' 1 ; ?da r take{(1,0,0)} r ;"
+          " deaf P ; ?sm(1,0,0,-1,w') r ?da r ; wr w' 2 ;"
+          " hearing P ; ?sm(2,1,1,1,w') r ?da r sleep 0.3 take{d1,(2,0,0)} r ; ?!pm");
+
+  // if a volatile writer loses the reader temporarily, the data won't show up
+  dotest ("sm da r pm w' ; ?sm r ?pm w' ; wr w' 1 ; ?da r read{(1,0,0)} r ;"
+          " deaf P' ; ?!sm ?!da ?pm(1,0,0,-1,r) w' ; wr w' 2 ;"
+          " hearing P' ; ?!sm ?pm(2,1,1,1,r) w' ?!da ; wr w' 3 ;"
+          " ?da r sleep 0.3 read{s(1,0,0),f(3,0,0)} r");
+  // if a transient-local writer loses the reader temporarily, what data
+  // has been published during the disconnect must still show up; delete
+  // writer, &c. checks nothing else showed up afterward
+  // - first: durability service history depth 1: 2nd write of 2 pushes
+  //   the 1st write of it out of the history and only 2 samples arrive
+  // - second: d.s. keep-all: both writes are kept and 3 samples arrive
+  dotest ("sm da r(d=tl) pm w'(d=tl,h=1,ds=0/1) ; ?sm r ?pm w' ;"
+          " wr w' 1 ; ?da r read{(1,0,0)} r ;"
+          " deaf P' ; ?pm(1,0,0,-1,r) w' ; wr w' 2 wr w' 2 ;"
+          " hearing P' ; ?pm(2,1,1,1,r) w' ; wr w' 3 ;"
+          " ?da(2) r read{s(1,0,0),f(2,0,0),f(3,0,0)} r ;"
+          " -w' ?sm r ?da r read(3,3) r");
+  dotest ("sm da r(d=tl) pm w'(d=tl,h=1,ds=0/all) ; ?sm r ?pm w' ;"
+          " wr w' 1 ; ?da r read{(1,0,0)} r ;"
+          " deaf P' ; ?pm(1,0,0,-1,r) w' ; wr w' 2 wr w' 2 ;"
+          " hearing P' ; ?pm(2,1,1,1,r) w' ; wr w' 3 ;"
+          " ?da(3) r read{s(1,0,0),f(2,0,0),f(2,0,0),f(3,0,0)} r ;"
+          " -w' ?sm r ?da r read(4,3) r");
 }
 
 CU_Test (ddsc_listener, publication_matched)
@@ -1163,18 +372,20 @@ CU_Test (ddsc_listener, subscription_matched)
 CU_Test (ddsc_listener, incompatible_qos)
 {
   // best-effort writer & reliable reader: both must trigger incompatible QoS event
-  dotest ("oiq w! riq r ; ?oiq(1,1) w ?riq(1,1) r");
-  dotest ("riq r oiq w! ; ?oiq(1,1) w ?riq(1,1) r");
+  dotest ("oiq w(r=be) riq r ; ?oiq(1,1,r) w ?riq(1,1,r) r");
+  dotest ("riq r oiq w(r=be) ; ?oiq(1,1,r) w ?riq(1,1,r) r");
+  dotest ("oiq w(o=x) riq r ; ?oiq(1,1,o) w ?riq(1,1,o) r");
+  dotest ("riq r oiq w(o=x) ; ?oiq(1,1,o) w ?riq(1,1,o) r");
 }
 
 CU_Test (ddsc_listener, data_available)
 {
   // data available on reader
-  dotest ("da sm r pm w ?pm w ?sm r wr 0 w ?da r ?!dor");
+  dotest ("da sm r pm w ?pm w ?sm r wr w 0 ?da r ?!dor");
   // data available set on subscriber
-  dotest ("da R sm r pm w ?pm w ?sm r wr 0 w ?da r ?!dor");
+  dotest ("da R sm r pm w ?pm w ?sm r wr w 0 ?da r ?!dor");
   // data available set on participant
-  dotest ("da P sm r pm w ?pm w ?sm r wr 0 w ?da r ?!dor");
+  dotest ("da P sm r pm w ?pm w ?sm r wr w 0 ?da r ?!dor");
 }
 
 CU_Test (ddsc_listener, data_available_delete_writer)
@@ -1185,53 +396,53 @@ CU_Test (ddsc_listener, data_available_delete_writer)
   dotest ("da sm r w ; -w ?sm r ?!da ; take(0,0) r");
   // after writing: auto-dispose should always trigger data available, an invalid
   // sample needs to show up if there isn't an unread sample to use instead
-  dotest ("da r w ; wr 0 w ?da r ; -w ?da r ; take(1,0) r");
-  dotest ("da r w ; wr 0 w ?da r ; read(1,0) r ; -w ?da r ; take(1,1) r");
-  dotest ("da r w ; wr 0 w ?da r ; take(1,0) r ; -w ?da r ; take(0,1) r");
+  dotest ("da r w ; wr w 0 ?da r ; -w ?da r ; take(1,0) r");
+  dotest ("da r w ; wr w 0 ?da r ; read(1,0) r ; -w ?da r ; take(1,1) r");
+  dotest ("da r w ; wr w 0 ?da r ; take(1,0) r ; -w ?da r ; take(0,1) r");
   // same with two writers (no point in doing this also with two domains)
   dotest ("da r w x ; -w ?!da -x ?!da ; take(0,0) r");
-  dotest ("da r w x ; wr 0 w ?da r ; -x ?!da ; -w ?da r ; take(1,0) r");
-  dotest ("da r w x ; wr 0 w ?da r ; -w ?da r ; take(1,0) r ; -x ?!da ; take(0,0) r");
-  dotest ("da r w x ; wr 0 w wr 0 x ?da r ; -w ?!da ; take(2,0) r ; -x ?da r ; take(0,1) r");
-  dotest ("da r w x ; wr 0 w wr 0 x ?da r ; read(2,0) r ; -w ?!da -x ?da r ; take(2,1) r");
-  dotest ("da r w x ; wr 0 w wr 0 x ?da r ; read(2,0) r ; -x ?!da -w ?da r ; take(2,1) r");
-  dotest ("da r w x ; wr 0 w read(1,0) r ; wr 0 x ?da r ; -w ?!da -x ?da r ; take(2,0) r");
-  dotest ("da r w x ; wr 0 w read(1,0) r ; wr 0 x ?da r ; -x ?!da -w ?da r ; take(2,0) r");
-  dotest ("da r w x ; wr 0 w read(1,0) r ; wr 0 x ?da r ; read(2,0) r ; -w ?!da -x ?da r ; take(2,1) r");
-  dotest ("da r w x ; wr 0 w read(1,0) r ; wr 0 x ?da r ; read(2,0) r ; -x ?!da -w ?da r ; take(2,1) r");
-  dotest ("da r w x ; wr 0 w wr 0 x ?da r ; take(2,0) r ; -w ?!da -x ?da r ; take(0,1) r");
-  dotest ("da r w x ; wr 0 w wr 0 x ?da r ; take(2,0) r ; -x ?!da -w ?da r ; take(0,1) r");
+  dotest ("da r w x ; wr w 0 ?da r ; -x ?!da ; -w ?da r ; take(1,0) r");
+  dotest ("da r w x ; wr w 0 ?da r ; -w ?da r ; take(1,0) r ; -x ?!da ; take(0,0) r");
+  dotest ("da r w x ; wr w 0 wr x 0 ?da r ; -w ?!da ; take(2,0) r ; -x ?da r ; take(0,1) r");
+  dotest ("da r w x ; wr w 0 wr x 0 ?da r ; read(2,0) r ; -w ?!da -x ?da r ; take(2,1) r");
+  dotest ("da r w x ; wr w 0 wr x 0 ?da r ; read(2,0) r ; -x ?!da -w ?da r ; take(2,1) r");
+  dotest ("da r w x ; wr w 0 read(1,0) r ; wr x 0 ?da r ; -w ?!da -x ?da r ; take(2,0) r");
+  dotest ("da r w x ; wr w 0 read(1,0) r ; wr x 0 ?da r ; -x ?!da -w ?da r ; take(2,0) r");
+  dotest ("da r w x ; wr w 0 read(1,0) r ; wr x 0 ?da r ; read(2,0) r ; -w ?!da -x ?da r ; take(2,1) r");
+  dotest ("da r w x ; wr w 0 read(1,0) r ; wr x 0 ?da r ; read(2,0) r ; -x ?!da -w ?da r ; take(2,1) r");
+  dotest ("da r w x ; wr w 0 wr x 0 ?da r ; take(2,0) r ; -w ?!da -x ?da r ; take(0,1) r");
+  dotest ("da r w x ; wr w 0 wr x 0 ?da r ; take(2,0) r ; -x ?!da -w ?da r ; take(0,1) r");
 }
 
 CU_Test (ddsc_listener, data_available_delete_writer_disposed)
 {
   // same as data_available_delete_writer, but now with the instance disposed first
-  dotest ("da r w ; wr 0 w disp 0 w ?da r ; -w ?!da");
-  dotest ("da r w ; wr 0 w disp 0 w ?da r ; read(1,0) r ; -w ?!da");
-  dotest ("da r w ; wr 0 w disp 0 w ?da r ; take(1,0) r ; -w ?!da");
+  dotest ("da r w ; wr w 0 disp w 0 ?da r ; -w ?!da");
+  dotest ("da r w ; wr w 0 disp w 0 ?da r ; read(1,0) r ; -w ?!da");
+  dotest ("da r w ; wr w 0 disp w 0 ?da r ; take(1,0) r ; -w ?!da");
 
-  dotest ("da r w x ; wr 0 w ?da r ; read(1,0) r ; disp 0 w ?da r ; read(1,1) r ; -w ?!da -x ?!da");
-  dotest ("da r w x ; wr 0 w ?da r ; take(1,0) r ; disp 0 w ?da r ; take(0,1) r ; -w ?!da -x ?!da");
-  dotest ("da r w x ; wr 0 w ?da r ; read(1,0) r ; disp 0 w ?da r ; read(1,1) r ; -x ?!da -w ?!da");
-  dotest ("da r w x ; wr 0 w ?da r ; take(1,0) r ; disp 0 w ?da r ; take(0,1) r ; -x ?!da -w ?!da");
+  dotest ("da r w x ; wr w 0 ?da r ; read(1,0) r ; disp w 0 ?da r ; read(1,1) r ; -w ?!da -x ?!da");
+  dotest ("da r w x ; wr w 0 ?da r ; take(1,0) r ; disp w 0 ?da r ; take(0,1) r ; -w ?!da -x ?!da");
+  dotest ("da r w x ; wr w 0 ?da r ; read(1,0) r ; disp w 0 ?da r ; read(1,1) r ; -x ?!da -w ?!da");
+  dotest ("da r w x ; wr w 0 ?da r ; take(1,0) r ; disp w 0 ?da r ; take(0,1) r ; -x ?!da -w ?!da");
 
-  dotest ("da r w x ; wr 0 w ?da r ; read(1,0) r ; disp 0 x ?da r ; read(1,1) r ; -w ?!da -x ?!da");
-  dotest ("da r w x ; wr 0 w ?da r ; take(1,0) r ; disp 0 x ?da r ; take(0,1) r ; -w ?!da -x ?!da");
-  dotest ("da r w x ; wr 0 w ?da r ; read(1,0) r ; disp 0 x ?da r ; read(1,1) r ; -x ?!da -w ?!da");
-  dotest ("da r w x ; wr 0 w ?da r ; take(1,0) r ; disp 0 x ?da r ; take(0,1) r ; -x ?!da -w ?!da");
+  dotest ("da r w x ; wr w 0 ?da r ; read(1,0) r ; disp x 0 ?da r ; read(1,1) r ; -w ?!da -x ?!da");
+  dotest ("da r w x ; wr w 0 ?da r ; take(1,0) r ; disp x 0 ?da r ; take(0,1) r ; -w ?!da -x ?!da");
+  dotest ("da r w x ; wr w 0 ?da r ; read(1,0) r ; disp x 0 ?da r ; read(1,1) r ; -x ?!da -w ?!da");
+  dotest ("da r w x ; wr w 0 ?da r ; take(1,0) r ; disp x 0 ?da r ; take(0,1) r ; -x ?!da -w ?!da");
 }
 
 CU_Test (ddsc_listener, data_on_readers)
 {
   // data on readers wins from data available
-  dotest ("dor R da r ; wr 0 w ; ?dor R ?!da");
-  dotest ("dor P da r ; wr 0 w ; ?dor R ?!da");
+  dotest ("dor R da r ; wr w 0 ; ?dor R ?!da");
+  dotest ("dor P da r ; wr w 0 ; ?dor R ?!da");
 }
 
 CU_Test (ddsc_listener, sample_lost)
 {
   // FIXME: figure out what really constitutes a "lost sample"
-  dotest ("sl r ; wr@0 0 w ?!sl ; wr@-1 0 w ?sl(1,1) r");
+  dotest ("sl r ; wr w 0@0 ?!sl ; wr w 0@-1 ?sl(1,1) r");
 }
 
 CU_Test (ddsc_listener, sample_rejected)
@@ -1240,13 +451,13 @@ CU_Test (ddsc_listener, sample_rejected)
   // reliable: expect timeout on the write when max samples has been reached
   // invalid samples don't count towards resource limits, so dispose should
   // not be blocked
-  dotest ("sr r# ; wr 0 w wrfail 0 w wrfail 0 w ; ?sr r");
-  dotest ("sr r# ; wr 0 w wrfail 0 w ; read(1,0) r ; disp 0 w ; read(1,1) r ; ?sr r");
+  dotest ("sr r(rl=1) ; wr w 0 wrfail w 0 wrfail w 0 ; ?sr r");
+  dotest ("sr r(rl=1) ; wr w 0 wrfail w 0 ; read(1,0) r ; disp w 0 ; read(1,1) r ; ?sr r");
 
   // best-effort: writes should succeed despite not delivering the data adding
   // the data in the RHC, also check number of samples rejected
-  dotest ("sr r#! ; wr 0 w! wr 0 w wr 0 w ; ?sr(2,1,s) r");
-  dotest ("sr r#! ; wr 0 w! wr 0 w ; read(1,0) r ; disp 0 w ; read(1,1) r ; ?sr(1,1,s) r");
+  dotest ("sr r(rl=1,r=be) ; wr w(r=be) 0 wr w 0 wr w 0 ; ?sr(2,1,s) r");
+  dotest ("sr r(rl=1,r=be) ; wr w(r=be) 0 wr w 0 ; read(1,0) r ; disp w 0 ; read(1,1) r ; ?sr(1,1,s) r");
 }
 
 CU_Test (ddsc_listener, liveliness_changed)
diff --git a/src/core/ddsc/tests/test_oneliner.c b/src/core/ddsc/tests/test_oneliner.c
new file mode 100644
index 0000000..255400a
--- /dev/null
+++ b/src/core/ddsc/tests/test_oneliner.c
@@ -0,0 +1,1780 @@
+/*
+ * Copyright(c) 2020 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+#include <stdio.h>
+#include <ctype.h>
+#include <stdlib.h>
+#include <stdarg.h>
+#include <setjmp.h>
+
+#include "dds/dds.h"
+#include "dds/ddsrt/misc.h"
+#include "dds/ddsrt/sync.h"
+#include "dds/ddsrt/heap.h"
+#include "dds/ddsrt/strtod.h"
+#include "dds/ddsrt/string.h"
+#include "dds/ddsrt/environ.h"
+
+#include "dds__types.h"
+#include "dds__entity.h"
+#include "dds/ddsi/q_lease.h"
+#include "dds/ddsi/q_xevent.h"
+#include "dds/ddsi/ddsi_entity_index.h"
+
+#include "test_common.h"
+#include "test_oneliner.h"
+
+#define MAXDOMS (sizeof (((struct oneliner_ctx){.result=0}).doms) / sizeof (((struct oneliner_ctx){.result=0}).doms[0]))
+
+static const char knownentities[] = "PRWrstwxy";
+typedef struct { char n[MAXDOMS + 1]; } entname_t;
+
+#define DEFINE_STATUS_CALLBACK(name, NAME, kind) \
+  static void name##_cb (dds_entity_t kind, const dds_##name##_status_t status, void *arg) \
+  { \
+    struct oneliner_cb *cb = arg; \
+    ddsrt_mutex_lock (&cb->ctx->g_mutex); \
+    cb->cb_##kind = kind; \
+    cb->cb_##name##_status = status; \
+    cb->cb_called[DDS_##NAME##_STATUS_ID]++; \
+    ddsrt_cond_broadcast (&cb->ctx->g_cond); \
+    ddsrt_mutex_unlock (&cb->ctx->g_mutex); \
+  }
+
+DEFINE_STATUS_CALLBACK (inconsistent_topic, INCONSISTENT_TOPIC, topic)
+DEFINE_STATUS_CALLBACK (liveliness_changed, LIVELINESS_CHANGED, reader)
+DEFINE_STATUS_CALLBACK (liveliness_lost, LIVELINESS_LOST, writer)
+DEFINE_STATUS_CALLBACK (offered_deadline_missed, OFFERED_DEADLINE_MISSED, writer)
+DEFINE_STATUS_CALLBACK (offered_incompatible_qos, OFFERED_INCOMPATIBLE_QOS, writer)
+DEFINE_STATUS_CALLBACK (publication_matched, PUBLICATION_MATCHED, writer)
+DEFINE_STATUS_CALLBACK (requested_deadline_missed, REQUESTED_DEADLINE_MISSED, reader)
+DEFINE_STATUS_CALLBACK (requested_incompatible_qos, REQUESTED_INCOMPATIBLE_QOS, reader)
+DEFINE_STATUS_CALLBACK (sample_lost, SAMPLE_LOST, reader)
+DEFINE_STATUS_CALLBACK (sample_rejected, SAMPLE_REJECTED, reader)
+DEFINE_STATUS_CALLBACK (subscription_matched, SUBSCRIPTION_MATCHED, reader)
+
+static void data_on_readers_cb (dds_entity_t subscriber, void *arg)
+{
+  struct oneliner_cb *cb = arg;
+  ddsrt_mutex_lock (&cb->ctx->g_mutex);
+  cb->cb_subscriber = subscriber;
+  cb->cb_called[DDS_DATA_ON_READERS_STATUS_ID]++;
+  ddsrt_cond_broadcast (&cb->ctx->g_cond);
+  ddsrt_mutex_unlock (&cb->ctx->g_mutex);
+}
+
+static void data_available_cb (dds_entity_t reader, void *arg)
+{
+  struct oneliner_cb *cb = arg;
+  ddsrt_mutex_lock (&cb->ctx->g_mutex);
+  cb->cb_reader = reader;
+  cb->cb_called[DDS_DATA_AVAILABLE_STATUS_ID]++;
+  ddsrt_cond_broadcast (&cb->ctx->g_cond);
+  ddsrt_mutex_unlock (&cb->ctx->g_mutex);
+}
+
+static void dummy_data_on_readers_cb (dds_entity_t subscriber, void *arg)
+{
+  (void)subscriber;
+  (void)arg;
+}
+
+static void dummy_data_available_cb (dds_entity_t reader, void *arg)
+{
+  (void)reader;
+  (void)arg;
+}
+
+static void dummy_subscription_matched_cb (dds_entity_t reader, const dds_subscription_matched_status_t status, void *arg)
+{
+  (void)reader;
+  (void)status;
+  (void)arg;
+}
+
+static void dummy_liveliness_changed_cb (dds_entity_t reader, const dds_liveliness_changed_status_t status, void *arg)
+{
+  (void)reader;
+  (void)status;
+  (void)arg;
+}
+
+static void dummy_cb (void)
+{
+  // Used as a listener function in checking merging of listeners,
+  // and for that purpose, casting it to whatever function type is
+  // required is ok.  It is not supposed to ever be called.
+  abort ();
+}
+
+#undef DEFINE_STATUS_CALLBACK
+
+// These had better match the corresponding type definitions!
+// n   uint32_t ...count
+// c   int32_t  ...count_change
+// I            instance handle of a data instance
+// P   uint32_t QoS policy ID
+// E            instance handle of an entity
+// R            sample_rejected_status_kind
+static const struct {
+  const char *name;
+  size_t size;           // size of status struct
+  const char *desc;      // description of status struct
+  dds_status_id_t id;    // status id, entry in "cb_called"
+  size_t cb_entity_off;  // which cb_... entity to look at
+  size_t cb_status_off;  // cb_..._status to look at
+} lldesc[] = {
+#define S0(abbrev, NAME, entity) \
+  { abbrev, 0, NULL, DDS_##NAME##_STATUS_ID, offsetof (struct oneliner_cb, cb_##entity), 0 }
+#define S(abbrev, name, NAME, desc, entity) \
+  { abbrev, sizeof (dds_##name##_status_t), desc, DDS_##NAME##_STATUS_ID, offsetof (struct oneliner_cb, cb_##entity), offsetof (struct oneliner_cb, cb_##name##_status) }
+  S0 ("da", DATA_AVAILABLE, reader),
+  S0 ("dor", DATA_ON_READERS, subscriber),
+  S ("it", inconsistent_topic, INCONSISTENT_TOPIC, "nc", topic),
+  S ("lc", liveliness_changed, LIVELINESS_CHANGED, "nnccE", reader),
+  S ("ll", liveliness_lost, LIVELINESS_LOST, "nc", writer),
+  S ("odm", offered_deadline_missed, OFFERED_DEADLINE_MISSED, "ncI", writer),
+  S ("oiq", offered_incompatible_qos, OFFERED_INCOMPATIBLE_QOS, "ncP", writer),
+  S ("pm",  publication_matched, PUBLICATION_MATCHED, "ncncE", writer),
+  S ("rdm", requested_deadline_missed, REQUESTED_DEADLINE_MISSED, "ncI", reader),
+  S ("riq", requested_incompatible_qos, REQUESTED_INCOMPATIBLE_QOS, "ncP", reader),
+  S ("sl",  sample_lost, SAMPLE_LOST, "nc", reader),
+  S ("sr",  sample_rejected, SAMPLE_REJECTED, "ncRI", reader),
+  S ("sm",  subscription_matched, SUBSCRIPTION_MATCHED, "ncncE", reader)
+#undef S
+#undef S0
+};
+
+
+static const void *advance (const void *status, size_t *off, char code)
+{
+#define alignof(type_) offsetof (struct { char c; type_ d; }, d)
+  size_t align = 1, size = 1;
+  switch (code)
+  {
+    case 'n': case 'c': case 'P':
+      align = alignof (uint32_t); size = sizeof (uint32_t);
+      break;
+    case 'E': case 'I':
+      align = alignof (dds_instance_handle_t); size = sizeof (dds_instance_handle_t);
+      break;
+    case 'R':
+      align = alignof (dds_sample_rejected_status_kind); size = sizeof (dds_sample_rejected_status_kind);
+      break;
+    default:
+      abort ();
+  }
+#undef alignof
+  *off = (*off + align - 1) & ~(align - 1);
+  const void *p = (const char *) status + *off;
+  *off += size;
+  return p;
+}
+
+static dds_return_t get_status (int ll, dds_entity_t ent, void *status)
+{
+  dds_return_t ret;
+  switch (ll)
+  {
+    case 2: ret = dds_get_inconsistent_topic_status (ent, status); break;
+    case 3: ret = dds_get_liveliness_changed_status (ent, status); break;
+    case 4: ret = dds_get_liveliness_lost_status (ent, status); break;
+    case 5: ret = dds_get_offered_deadline_missed_status (ent, status); break;
+    case 6: ret = dds_get_offered_incompatible_qos_status (ent, status); break;
+    case 7: ret = dds_get_publication_matched_status (ent, status); break;
+    case 8: ret = dds_get_requested_deadline_missed_status (ent, status); break;
+    case 9: ret = dds_get_requested_incompatible_qos_status (ent, status); break;
+    case 10: ret = dds_get_sample_lost_status (ent, status); break;
+    case 11: ret = dds_get_sample_rejected_status (ent, status); break;
+    case 12: ret = dds_get_subscription_matched_status (ent, status); break;
+    default: return -1;
+  }
+  return (ret == 0);
+}
+
+static dds_return_t check_status_change_fields_are_0 (int ll, dds_entity_t ent)
+{
+  if (lldesc[ll].desc)
+  {
+    const char *d = lldesc[ll].desc;
+    void *status = malloc (lldesc[ll].size);
+    dds_return_t ret;
+    if ((ret = get_status (ll, ent, status)) <= 0)
+    {
+      free (status);
+      return ret;
+    }
+    size_t off = 0;
+    while (*d)
+    {
+      const uint32_t *p = advance (status, &off, *d);
+      if (*d == 'c' && *p != 0)
+      {
+        free (status);
+        return 0;
+      }
+      d++;
+    }
+    assert (off <= lldesc[ll].size);
+    free (status);
+  }
+  return 1;
+}
+
+#define TOK_END -1
+#define TOK_NAME -2
+#define TOK_INT -3
+#define TOK_DURATION -4
+#define TOK_TIMESTAMP -5
+#define TOK_ELLIPSIS -6
+#define TOK_INVALID -7
+
+static int setresult (struct oneliner_ctx *ctx, int result, const char *msg, ...) ddsrt_attribute_format((printf, 3, 4));
+static void error (struct oneliner_ctx *ctx, const char *msg, ...) ddsrt_attribute_format((printf, 2, 3));
+static void error_dds (struct oneliner_ctx *ctx, dds_return_t ret, const char *msg, ...) ddsrt_attribute_format((printf, 3, 4));
+static void testfail (struct oneliner_ctx *ctx, const char *msg, ...) ddsrt_attribute_format((printf, 2, 3));
+
+static void vsetresult (struct oneliner_ctx *ctx, int result, const char *msg, va_list ap)
+{
+  assert (result <= 0);
+  ctx->result = result;
+  vsnprintf (ctx->msg, sizeof (ctx->msg), msg, ap);
+}
+
+static int setresult (struct oneliner_ctx *ctx, int result, const char *msg, ...)
+{
+  va_list ap;
+  va_start (ap, msg);
+  vsetresult (ctx, result, msg, ap);
+  va_end (ap);
+  return result;
+}
+
+static void error (struct oneliner_ctx *ctx, const char *msg, ...)
+{
+  va_list ap;
+  va_start (ap, msg);
+  vsetresult (ctx, -1, msg, ap);
+  va_end (ap);
+  longjmp (ctx->jb, 1);
+}
+
+static void error_dds (struct oneliner_ctx *ctx, dds_return_t ret, const char *msg, ...)
+{
+  va_list ap;
+  va_start (ap, msg);
+  vsetresult (ctx, -1, msg, ap);
+  va_end (ap);
+  size_t n = strlen (ctx->msg);
+  if (n < sizeof (ctx->msg))
+    snprintf (ctx->msg + n, sizeof (ctx->msg) - n, " (%s)", dds_strretcode (ret));
+  longjmp (ctx->jb, 1);
+}
+
+static void testfail (struct oneliner_ctx *ctx, const char *msg, ...)
+{
+  va_list ap;
+  va_start (ap, msg);
+  vsetresult (ctx, 0, msg, ap);
+  va_end (ap);
+  longjmp (ctx->jb, 1);
+}
+
+static void advancetok (struct oneliner_lex *l)
+{
+  while (isspace ((unsigned char) *l->inp))
+    l->inp++;
+}
+
+static int issymchar0 (char c)
+{
+  return isalpha ((unsigned char) c) || c == '_';
+}
+
+static int issymchar (char c)
+{
+  return isalnum ((unsigned char) c) || c == '_' || c == '\'';
+}
+
+static bool lookingatnum (const struct oneliner_lex *l)
+{
+  return (isdigit ((unsigned char) l->inp[(l->inp[0] == '-')]));
+}
+
+static int nexttok_dur (struct oneliner_lex *l, union oneliner_tokval *v, bool expecting_duration)
+{
+  advancetok (l);
+  if (l->inp[0] == 0)
+  {
+    l->tok = TOK_END;
+  }
+  else if (strncmp (l->inp, "...", 3) == 0)
+  {
+    l->inp += 3;
+    l->tok = TOK_ELLIPSIS;
+  }
+  else if (!expecting_duration && lookingatnum (l))
+  {
+    char *endp;
+    // strtol: [0-9]+ ; endp = l->inp if no digits present
+    l->v.i = (int) strtol (l->inp, &endp, 10);
+    l->inp = endp;
+    if (v) *v = l->v;
+    l->tok = TOK_INT;
+  }
+  else if (l->inp[0] == '@' || (expecting_duration && lookingatnum (l)))
+  {
+    const int ists = (l->inp[0] == '@');
+    char *endp;
+    if (!ists && strncmp (l->inp + ists, "inf", 3) == 0 && !issymchar (l->inp[ists + 3]))
+    {
+      l->inp += ists + 3;
+      l->v.d = DDS_INFINITY;
+    }
+    else
+    {
+      double d;
+      if (ddsrt_strtod (l->inp + ists, &endp, &d) != DDS_RETCODE_OK)
+        return false;
+      if (!ists && d < 0)
+        return false;
+      if (d >= (double) (INT64_MAX / DDS_NSECS_IN_SEC))
+        l->v.d = DDS_INFINITY;
+      else if (d >= 0)
+        l->v.d = (int64_t) (d * 1e9 + 0.5);
+      else
+        l->v.d = -(int64_t) (-d * 1e9 + 0.5);
+      if (ists)
+        l->v.d += l->tref;
+      l->inp = endp;
+    }
+    if (v) *v = l->v;
+    l->tok = ists ? TOK_TIMESTAMP : TOK_DURATION;
+  }
+  else if (issymchar0 (l->inp[0]))
+  {
+    int p = 0;
+    while (issymchar (l->inp[p]))
+    {
+      if (p == (int) sizeof (l->v.n))
+        return TOK_INVALID;
+      l->v.n[p] = l->inp[p];
+      p++;
+    }
+    l->v.n[p] = 0;
+    l->inp += p;
+    if (v) *v = l->v;
+    l->tok = TOK_NAME;
+  }
+  else
+  {
+    l->tok = *l->inp++;
+  }
+  return l->tok;
+}
+
+static int nexttok (struct oneliner_lex *l, union oneliner_tokval *v)
+{
+  return nexttok_dur (l, v, false);
+}
+
+static int peektok (const struct oneliner_lex *l, union oneliner_tokval *v)
+{
+  struct oneliner_lex l1 = *l;
+  return nexttok (&l1, v);
+}
+
+static bool nexttok_if (struct oneliner_lex *l, int tok)
+{
+  if (peektok (l, NULL) != tok)
+    return false;
+  nexttok (l, NULL);
+  return true;
+}
+
+static bool nexttok_int (struct oneliner_lex *l, int *dst)
+{
+  if (peektok (l, NULL) != TOK_INT)
+    return false;
+  (void) nexttok (l, NULL);
+  *dst = l->v.i;
+  return true;
+}
+
+struct kvarg {
+  const char *k;
+  size_t klen;
+  int v;
+  bool (*arg) (struct oneliner_lex *l, void *dst); // *inp unchanged when false
+  void (*def) (void *dst);
+};
+
+static void def_kvarg_int0 (void *dst) { *(int *)dst = 0; }
+static void def_kvarg_int1 (void *dst) { *(int *)dst = 1; }
+static void def_kvarg_dur_inf (void *dst) { *(dds_duration_t *)dst = DDS_INFINITY; }
+static void def_kvarg_dur_100ms (void *dst) { *(dds_duration_t *)dst = DDS_MSECS (100); }
+
+static bool read_kvarg_int (struct oneliner_lex *l, void *dst)
+{
+  return nexttok_int (l, dst);
+}
+
+static bool read_kvarg_posint (struct oneliner_lex *l, void *dst)
+{
+  return nexttok_int (l, dst) && l->v.i > 0;
+}
+
+static bool read_kvarg_dur (struct oneliner_lex *l, void *dst)
+{
+  dds_duration_t *x = dst;
+  struct oneliner_lex l1 = *l;
+  if (nexttok_dur (&l1, NULL, true) != TOK_DURATION)
+    return false;
+  *x = l1.v.d;
+  *l = l1;
+  return true;
+}
+
+static bool read_kvarg_3len (struct oneliner_lex *l, void *dst)
+{
+  struct oneliner_lex l1 = *l;
+  int *x = dst, i = 0;
+  x[0] = x[1] = x[2] = DDS_LENGTH_UNLIMITED;
+  do {
+    if (!nexttok_int (&l1, &x[i]) || (x[i] <= 0 && x[i] != DDS_LENGTH_UNLIMITED))
+      return false;
+  } while (++i < 3 && nexttok_if (&l1, '/'));
+  *l = l1;
+  return true;
+}
+
+static bool read_kvarg (const struct kvarg *ks, size_t sizeof_ks, struct oneliner_lex *l, int *v, void *arg)
+{
+  // l points at name, *inp is , or ) terminated; *l unchanged when false
+  const struct kvarg *kend = ks + sizeof_ks / sizeof (*ks);
+  struct oneliner_lex l1 = *l;
+  advancetok (&l1);
+  for (const struct kvarg *k = ks; k < kend; k++)
+  {
+    assert (strlen (k->k) == k->klen);
+    *v = k->v;
+    if (k->klen == 0)
+    {
+      assert (k->arg != 0 && k->def == 0);
+      struct oneliner_lex l2 = l1;
+      if (k->arg (&l2, arg) && (peektok (&l2, NULL) == ',' || peektok (&l2, NULL) == ')'))
+      {
+        *l = l2;
+        return true;
+      }
+    }
+    else if (strncmp (l1.inp, k->k, k->klen) != 0)
+    {
+      continue;
+    }
+    else
+    {
+      /* skip symbol */
+      struct oneliner_lex l2 = l1;
+      l2.inp += k->klen;
+      if (peektok (&l2, NULL) == ',' || peektok (&l2, NULL) == ')')
+      {
+        if (k->arg == 0 || k->def != 0)
+        {
+          if (k->def) k->def (arg);
+          *l = l2;
+          return true;
+        }
+      }
+      else if (k->arg != 0 && nexttok (&l2, NULL) == ':')
+      {
+        if (k->arg (&l2, arg) && (peektok (&l2, NULL) == ',' || peektok (&l2, NULL) == ')'))
+        {
+          *l = l2;
+          return true;
+        }
+      }
+    }
+  }
+  return false;
+}
+
+static bool qos_durability (struct oneliner_lex *l, dds_qos_t *q)
+{
+  static const struct kvarg ks[] = {
+    { "v",  1, (int) DDS_DURABILITY_VOLATILE },
+    { "tl", 2, (int) DDS_DURABILITY_TRANSIENT_LOCAL },
+    { "t",  1, (int) DDS_DURABILITY_TRANSIENT },
+    { "p",  1, (int) DDS_DURABILITY_PERSISTENT }
+  };
+  int v;
+  if (!read_kvarg (ks, sizeof ks, l, &v, NULL))
+    return false;
+  dds_qset_durability (q, (dds_durability_kind_t) v);
+  return true;
+}
+
+static const struct kvarg ks_history[] = {
+  { "all", 3, (int) DDS_HISTORY_KEEP_ALL, .def = def_kvarg_int1 },
+  { "",    0, (int) DDS_HISTORY_KEEP_LAST, .arg = read_kvarg_posint }
+};
+
+static bool qos_history (struct oneliner_lex *l, dds_qos_t *q)
+{
+  int v, x = 1;
+  if (!read_kvarg (ks_history, sizeof ks_history, l, &v, &x))
+    return false;
+  dds_qset_history (q, (dds_history_kind_t) v, x);
+  return true;
+}
+
+static bool qos_destination_order (struct oneliner_lex *l, dds_qos_t *q)
+{
+  static const struct kvarg ks[] = {
+    { "r", 1, (int) DDS_DESTINATIONORDER_BY_RECEPTION_TIMESTAMP },
+    { "s", 1, (int) DDS_DESTINATIONORDER_BY_SOURCE_TIMESTAMP }
+  };
+  int v;
+  if (!read_kvarg (ks, sizeof ks, l, &v, NULL))
+    return false;
+  dds_qset_destination_order (q, (dds_destination_order_kind_t) v);
+  return true;
+}
+
+static bool qos_ownership (struct oneliner_lex *l, dds_qos_t *q)
+{
+  static const struct kvarg ks[] = {
+    { "s", 1, (int) DDS_OWNERSHIP_SHARED, .def = def_kvarg_int0 },
+    { "x", 1, (int) DDS_OWNERSHIP_EXCLUSIVE, .arg = read_kvarg_int, .def = def_kvarg_int0 }
+  };
+  int v, x;
+  if (!read_kvarg (ks, sizeof ks, l, &v, &x))
+    return false;
+  dds_qset_ownership (q, (dds_ownership_kind_t) v);
+  dds_qset_ownership_strength (q, x);
+  return true;
+}
+
+static bool qos_transport_priority (struct oneliner_lex *l, dds_qos_t *q)
+{
+  static const struct kvarg k = { "", 0, 0, .arg = read_kvarg_int };
+  int v, x;
+  if (!read_kvarg (&k, sizeof k, l, &v, &x))
+    return false;
+  dds_qset_transport_priority (q, x);
+  return true;
+}
+
+static bool qos_reliability (struct oneliner_lex *l, dds_qos_t *q)
+{
+  static const struct kvarg ks[] = {
+    { "be", 2, (int) DDS_RELIABILITY_BEST_EFFORT, .def = def_kvarg_dur_100ms },
+    { "r",  1, (int) DDS_RELIABILITY_RELIABLE,    .def = def_kvarg_dur_100ms, .arg = read_kvarg_dur }
+  };
+  int v;
+  dds_duration_t x;
+  if (!read_kvarg (ks, sizeof ks, l, &v, &x))
+    return false;
+  dds_qset_reliability (q, (dds_reliability_kind_t) v, x);
+  return true;
+}
+
+static bool qos_liveliness (struct oneliner_lex *l, dds_qos_t *q)
+{
+  static const struct kvarg ks[] = {
+    { "a", 1, (int) DDS_LIVELINESS_AUTOMATIC, .def = def_kvarg_dur_inf, .arg = read_kvarg_dur },
+    { "p", 1, (int) DDS_LIVELINESS_MANUAL_BY_PARTICIPANT, .arg = read_kvarg_dur },
+    { "w", 1, (int) DDS_LIVELINESS_MANUAL_BY_TOPIC, .arg = read_kvarg_dur }
+  };
+  int v;
+  dds_duration_t x;
+  if (!read_kvarg (ks, sizeof ks, l, &v, &x))
+    return false;
+  dds_qset_liveliness (q, (dds_liveliness_kind_t) v, x);
+  return true;
+}
+
+static bool qos_simple_duration (struct oneliner_lex *l, dds_qos_t *q, void (*set) (dds_qos_t * __restrict q, dds_duration_t dur))
+{
+  static const struct kvarg k = { "", 0, 0, .arg = read_kvarg_dur };
+  int v;
+  dds_duration_t x;
+  if (!read_kvarg (&k, sizeof k, l, &v, &x))
+    return false;
+  set (q, x);
+  return true;
+}
+
+static bool qos_latency_budget (struct oneliner_lex *l, dds_qos_t *q)
+{
+  return qos_simple_duration (l, q, dds_qset_latency_budget);
+}
+
+static bool qos_deadline (struct oneliner_lex *l, dds_qos_t *q)
+{
+  return qos_simple_duration (l, q, dds_qset_deadline);
+}
+
+static bool qos_lifespan (struct oneliner_lex *l, dds_qos_t *q)
+{
+  return qos_simple_duration (l, q, dds_qset_lifespan);
+}
+
+static bool qos_resource_limits (struct oneliner_lex *l, dds_qos_t *q)
+{
+  int rl[3];
+  if (!read_kvarg_3len (l, rl))
+    return false;
+  dds_qset_resource_limits (q, rl[0], rl[1], rl[2]);
+  return true;
+}
+
+static bool qos_durability_service (struct oneliner_lex *l, dds_qos_t *q)
+{
+  struct oneliner_lex l1 = *l;
+  dds_duration_t scd;
+  int hk = DDS_HISTORY_KEEP_LAST, hd = 1, rl[3];
+  if (!read_kvarg_dur (&l1, &scd))
+    return false;
+  if (peektok (&l1, NULL) == '/')
+  {
+    (void) nexttok (&l1, NULL);
+    if (!read_kvarg (ks_history, sizeof ks_history, &l1, &hk, &hd))
+      return false;
+  }
+  if (peektok (&l1, NULL) != '/')
+    rl[0] = rl[1] = rl[2] = DDS_LENGTH_UNLIMITED;
+  else
+  {
+    (void) nexttok (&l1, NULL);
+    if (!read_kvarg_3len (&l1, rl))
+      return false;
+  }
+  dds_qset_durability_service (q, scd, (dds_history_kind_t) hk, hd, rl[0], rl[1], rl[2]);
+  *l = l1;
+  return true;
+}
+
+static bool qos_presentation (struct oneliner_lex *l, dds_qos_t *q)
+{
+  static const struct kvarg ks[] = {
+    { "i", 1, (int) DDS_PRESENTATION_INSTANCE, .def = def_kvarg_int0 },
+    { "t", 1, (int) DDS_PRESENTATION_TOPIC,    .def = def_kvarg_int1 },
+    { "g", 1, (int) DDS_PRESENTATION_GROUP,    .def = def_kvarg_int1 }
+  };
+  int v, x;
+  if (!read_kvarg (ks, sizeof ks, l, &v, &x))
+    return false;
+  dds_qset_presentation (q, (dds_presentation_access_scope_kind_t) v, x, 0);
+  return true;
+}
+
+static bool qos_autodispose_unregistered_instances (struct oneliner_lex *l, dds_qos_t *q)
+{
+  static const struct kvarg ks[] = {
+    { "y", 1, 1 },
+    { "n", 1, 0 }
+  };
+  int v;
+  if (!read_kvarg (ks, sizeof ks, l, &v, NULL))
+    return false;
+  dds_qset_writer_data_lifecycle (q, !!v);
+  return true;
+}
+
+static const struct {
+  char *abbrev;
+  size_t n;
+  bool (*fn) (struct oneliner_lex *l, dds_qos_t *q);
+  dds_qos_policy_id_t id;
+} qostab[] = {
+  { "ll", 2, qos_liveliness, DDS_LIVELINESS_QOS_POLICY_ID },
+  { "d",  1, qos_durability, DDS_DURABILITY_QOS_POLICY_ID },
+  { "dl", 2, qos_deadline, DDS_DEADLINE_QOS_POLICY_ID },
+  { "h",  1, qos_history, DDS_HISTORY_QOS_POLICY_ID },
+  { "lb", 2, qos_latency_budget, DDS_LATENCYBUDGET_QOS_POLICY_ID },
+  { "ls", 2, qos_lifespan, DDS_LIFESPAN_QOS_POLICY_ID },
+  { "do", 2, qos_destination_order, DDS_DESTINATIONORDER_QOS_POLICY_ID },
+  { "o",  1, qos_ownership, DDS_OWNERSHIP_QOS_POLICY_ID },
+  { "tp", 2, qos_transport_priority, DDS_OWNERSHIPSTRENGTH_QOS_POLICY_ID },
+  { "p",  1, qos_presentation, DDS_PRESENTATION_QOS_POLICY_ID },
+  { "r",  1, qos_reliability, DDS_RELIABILITY_QOS_POLICY_ID },
+  { "rl", 2, qos_resource_limits, DDS_RESOURCELIMITS_QOS_POLICY_ID },
+  { "ds", 2, qos_durability_service, DDS_DURABILITYSERVICE_QOS_POLICY_ID },
+  { "ad", 2, qos_autodispose_unregistered_instances, DDS_WRITERDATALIFECYCLE_QOS_POLICY_ID }
+};
+
+static bool setqos (struct oneliner_lex *l, dds_qos_t *q)
+{
+  struct oneliner_lex l1 = *l;
+  dds_reset_qos (q);
+  // no whitespace between name & QoS
+  if (*l1.inp != '(')
+    return true;
+  nexttok (&l1, NULL); // eat '('
+  do {
+    size_t i;
+    union oneliner_tokval name;
+    if (nexttok (&l1, &name) != TOK_NAME || nexttok (&l1, NULL) != '=')
+      return false;
+    for (i = 0; i < sizeof (qostab) / sizeof (qostab[0]); i++)
+    {
+      assert (strlen (qostab[i].abbrev) == qostab[i].n);
+      if (strcmp (name.n, qostab[i].abbrev) == 0)
+        break;
+    }
+    if (i == sizeof (qostab) / sizeof (qostab[0]))
+      return false;
+    if (!qostab[i].fn (&l1, q))
+      return false;
+  } while (nexttok_if (&l1, ','));
+  if (nexttok (&l1, NULL) != ')')
+    return false;
+  *l = l1;
+  return true;
+}
+
+static int parse_entity1 (struct oneliner_lex *l, dds_qos_t *qos)
+{
+  struct oneliner_lex l1 = *l;
+  if (nexttok (&l1, NULL) != TOK_NAME)
+    return -1;
+  const char *p;
+  if ((p = strchr (knownentities, l1.v.n[0])) == NULL)
+    return -1;
+  int ent = (int) (p - knownentities);
+  int i;
+  for (i = 1; l1.v.n[i] == '\''; i++)
+    ent += (int) sizeof (knownentities) - 1;
+  if (l1.v.n[i] != 0)
+    return -1;
+  if (ent / 9 >= (int) MAXDOMS)
+    return -1;
+  if (!setqos (&l1, qos))
+    return -1;
+  *l = l1;
+  return ent;
+}
+
+static int parse_entity (struct oneliner_ctx *ctx)
+{
+  return parse_entity1 (&ctx->l, ctx->rwqos);
+}
+
+static int parse_listener1 (struct oneliner_lex *l)
+{
+  struct oneliner_lex l1 = *l;
+  size_t i;
+  if (nexttok (&l1, NULL) != TOK_NAME)
+    return -1;
+  for (i = 0; i < sizeof (lldesc) / sizeof (lldesc[0]); i++)
+    if (strcmp (l1.v.n, lldesc[i].name) == 0)
+      break;
+  if (i == sizeof (lldesc) / sizeof (lldesc[0]))
+    return -1;
+  *l = l1;
+  return (int) i;
+}
+
+static int parse_listener (struct oneliner_ctx *ctx)
+{
+  return parse_listener1 (&ctx->l);
+}
+
+static const char *getentname (entname_t *name, int ent)
+{
+  DDSRT_STATIC_ASSERT (sizeof (knownentities) == 10);
+  DDSRT_STATIC_ASSERT (MAXDOMS == 3);
+  name->n[0] = knownentities[ent % 9];
+  const int dom = ent / 9;
+  int i;
+  for (i = 1; i <= dom; i++)
+    name->n[i] = '\'';
+  name->n[i] = 0;
+  return name->n;
+}
+
+static void make_participant (struct oneliner_ctx *ctx, int ent, dds_listener_t *list)
+{
+  const dds_domainid_t domid = (dds_domainid_t) (ent / 9);
+  char *conf = ddsrt_expand_envvars ("${CYCLONEDDS_URI}${CYCLONEDDS_URI:+,}<Discovery><ExternalDomainId>0</ExternalDomainId></Discovery>", domid);
+  entname_t name;
+  printf ("create domain %"PRIu32, domid);
+  fflush (stdout);
+  if ((ctx->doms[domid] = dds_create_domain (domid, conf)) <= 0)
+    error_dds (ctx, ctx->doms[domid], "make_participant: create domain %"PRIu32" failed", domid);
+  ddsrt_free (conf);
+  printf (" create participant %s", getentname (&name, ent));
+  fflush (stdout);
+  if ((ctx->es[ent] = dds_create_participant (domid, NULL, list)) <= 0)
+    error_dds (ctx, ctx->es[ent], "make_participant: create participant failed in domain %"PRIu32, domid);
+  if ((ctx->tps[domid] = dds_create_topic (ctx->es[ent], &Space_Type1_desc, ctx->topicname, ctx->qos, NULL)) <= 0)
+    error_dds (ctx, ctx->tps[domid], "make_participant: create topic failed in domain %"PRIu32, domid);
+
+  // Create the built-in topic readers with a dummy listener to avoid any event (data available comes to mind)
+  // from propagating to the normal data available listener, in case it has been set on the participant.
+  //
+  // - dummy_cb aborts when it is invoked, but all reader-related listeners that can possibly trigger are set
+  //   separately (incompatible qos, deadline missed, sample lost and sample rejected are all impossible by
+  //   construction)
+  // - regarding data_on_readers: Cyclone handles listeners installed on an ancestor by *inheriting* them,
+  //   rather than by walking up ancestor chain. Setting data_on_readers on the reader therefore overrides the
+  //   listener set on the subscriber. It is a nice feature!
+  dds_listener_t *dummylist = dds_create_listener (ctx);
+  dds_lset_data_available (dummylist, dummy_data_available_cb);
+  dds_lset_data_on_readers (dummylist, dummy_data_on_readers_cb);
+  dds_lset_inconsistent_topic (dummylist, (dds_on_inconsistent_topic_fn) dummy_cb);
+  dds_lset_liveliness_changed (dummylist, dummy_liveliness_changed_cb);
+  dds_lset_liveliness_lost (dummylist, (dds_on_liveliness_lost_fn) dummy_cb);
+  dds_lset_offered_deadline_missed (dummylist, (dds_on_offered_deadline_missed_fn) dummy_cb);
+  dds_lset_offered_incompatible_qos (dummylist, (dds_on_offered_incompatible_qos_fn) dummy_cb);
+  dds_lset_publication_matched (dummylist, (dds_on_publication_matched_fn) dummy_cb);
+  dds_lset_requested_deadline_missed (dummylist, (dds_on_requested_deadline_missed_fn) dummy_cb);
+  dds_lset_requested_incompatible_qos (dummylist, (dds_on_requested_incompatible_qos_fn) dummy_cb);
+  dds_lset_sample_lost (dummylist, (dds_on_sample_lost_fn) dummy_cb);
+  dds_lset_sample_rejected (dummylist, (dds_on_sample_rejected_fn) dummy_cb);
+  dds_lset_subscription_matched (dummylist, dummy_subscription_matched_cb);
+  if ((ctx->pubrd[domid] = dds_create_reader (ctx->es[ent], DDS_BUILTIN_TOPIC_DCPSPUBLICATION, NULL, dummylist)) <= 0)
+    error_dds (ctx, ctx->pubrd[domid], "make_participant: create DCPSPublication reader in domain %"PRIu32, domid);
+  if ((ctx->subrd[domid] = dds_create_reader (ctx->es[ent], DDS_BUILTIN_TOPIC_DCPSSUBSCRIPTION, NULL, dummylist)) <= 0)
+    error_dds (ctx, ctx->subrd[domid], "make_participant: create DCPSSubscription reader in domain %"PRIu32, domid);
+  dds_delete_listener (dummylist);
+  //printf ("pubrd %"PRId32" subrd %"PRId32" sub %"PRId32"\n", es->pubrd[domid], es->subrd[domid], dds_get_parent (es->pubrd[domid]));
+}
+
+static void make_entity1 (struct oneliner_ctx *ctx, int ent, dds_listener_t *list)
+{
+  entname_t wrname;
+  dds_return_t ret;
+  int domid = ent / 9;
+  int ent1 = ent % 9;
+  switch (ent1)
+  {
+    case 0:
+      make_participant (ctx, ent, list);
+      break;
+    case 1:
+      if (ctx->es[ent-1] == 0)
+      {
+        printf ("[");
+        make_entity1 (ctx, ent-1, NULL);
+        printf ("] ");
+      }
+      printf ("create subscriber %s", getentname (&wrname, ent));
+      fflush (stdout);
+      ctx->es[ent] = dds_create_subscriber (ctx->es[ent-1], NULL, list);
+      break;
+    case 2:
+      if (ctx->es[ent-2] == 0)
+      {
+        printf ("[");
+        make_entity1 (ctx, ent-2, NULL);
+        printf ("] ");
+      }
+      printf ("create publisher %s", getentname (&wrname, ent));
+      fflush (stdout);
+      ctx->es[ent] = dds_create_publisher (ctx->es[ent-2], NULL, list);
+      break;
+    case 3: case 4: case 5:
+      if (ctx->es[9*domid+1] == 0)
+      {
+        printf ("[");
+        make_entity1 (ctx, 9*domid+1, NULL);
+        printf ("] ");
+      }
+      printf ("create reader %s", getentname (&wrname, ent));
+      fflush (stdout);
+      ctx->es[ent] = dds_create_reader (ctx->es[9*domid+1], ctx->tps[domid], ctx->rwqos, list);
+      break;
+    case 6: case 7: case 8:
+      if (ctx->es[9*domid+2] == 0)
+      {
+        printf ("[");
+        make_entity1 (ctx, 9*domid+2, NULL);
+        printf ("] ");
+      }
+      printf ("create writer %s", getentname (&wrname, ent));
+      fflush (stdout);
+      ctx->es[ent] = dds_create_writer (ctx->es[9*domid+2], ctx->tps[domid], ctx->rwqos, list);
+      break;
+    default:
+      abort ();
+  }
+  printf (" = %"PRId32, ctx->es[ent]);
+  fflush (stdout);
+  if (ctx->es[ent] <= 0)
+    error_dds (ctx, ctx->es[ent], "create entity %d failed", ent);
+  if ((ret = dds_get_instance_handle (ctx->es[ent], &ctx->esi[ent])) != 0)
+    error_dds (ctx, ret, "get instance handle for entity %"PRId32" failed", ctx->es[ent]);
+  //printf (" %"PRIx64, es->esi[ent]);
+  //fflush (stdout);
+}
+
+static void make_entity (struct oneliner_ctx *ctx, int ent, dds_listener_t *list)
+{
+  make_entity1 (ctx, ent, list);
+  printf ("\n");
+}
+
+static void setlistener (struct oneliner_ctx *ctx, struct oneliner_lex *l, int ll, int ent)
+{
+  printf ("set listener:");
+  dds_return_t ret;
+  int dom = ent / 9;
+  dds_listener_t *list = ctx->cb[dom].list;
+  dds_reset_listener (list);
+  do {
+    printf (" %s", lldesc[ll].name);
+    switch (ll)
+    {
+      case 0: dds_lset_data_available (list, data_available_cb); break;
+      case 1: dds_lset_data_on_readers (list, data_on_readers_cb); break;
+      case 2: dds_lset_inconsistent_topic (list, inconsistent_topic_cb); break;
+      case 3: dds_lset_liveliness_changed (list, liveliness_changed_cb); break;
+      case 4: dds_lset_liveliness_lost (list, liveliness_lost_cb); break;
+      case 5: dds_lset_offered_deadline_missed (list, offered_deadline_missed_cb); break;
+      case 6: dds_lset_offered_incompatible_qos (list, offered_incompatible_qos_cb); break;
+      case 7: dds_lset_publication_matched (list, publication_matched_cb); break;
+      case 8: dds_lset_requested_deadline_missed (list, requested_deadline_missed_cb); break;
+      case 9: dds_lset_requested_incompatible_qos (list, requested_incompatible_qos_cb); break;
+      case 10: dds_lset_sample_lost (list, sample_lost_cb); break;
+      case 11: dds_lset_sample_rejected (list, sample_rejected_cb); break;
+      case 12: dds_lset_subscription_matched (list, subscription_matched_cb); break;
+      default: abort ();
+    }
+  } while (l && (ll = parse_listener1 (l)) >= 0);
+  if (ctx->es[ent] == 0)
+  {
+    printf (" for ");
+    make_entity (ctx, ent, list);
+  }
+  else
+  {
+    dds_listener_t *tmplist = dds_create_listener (&ctx->cb[dom]);
+    if ((ret = dds_get_listener (ctx->es[ent], tmplist)) != 0)
+    {
+      dds_delete_listener (tmplist);
+      error_dds (ctx, ret, "set listener: dds_get_listener failed on %"PRId32, ctx->es[ent]);
+    }
+    dds_merge_listener (list, tmplist);
+    dds_delete_listener (tmplist);
+    printf (" on entity %"PRId32"\n", ctx->es[ent]);
+    if ((ret = dds_set_listener (ctx->es[ent], list)) != 0)
+      error_dds (ctx, ret, "set listener: dds_set_listener failed on %"PRId32, ctx->es[ent]);
+  }
+}
+
+static dds_instance_handle_t lookup_insthandle (const struct oneliner_ctx *ctx, int ent, int ent1)
+{
+  // if both are in the same domain, it's easy
+  if (ent / 9 == ent1 / 9)
+    return ctx->esi[ent1];
+  else
+  {
+    // if they aren't ... find GUID from instance handle in the one domain,
+    // then find instance handle for GUID in the other
+    dds_entity_t rd1 = 0, rd2 = 0;
+    switch (ent1 % 9)
+    {
+      case  3: case  4: case  5: rd1 = ctx->subrd[ent1/9]; rd2 = ctx->subrd[ent/9]; break;
+      case  6: case  7: case  8: rd1 = ctx->pubrd[ent1/9]; rd2 = ctx->pubrd[ent/9]; break;
+      default: return 0;
+    }
+
+    dds_builtintopic_endpoint_t keysample;
+    //printf ("(in %"PRId32" %"PRIx64" -> ", rd1, es->esi[ent1]);
+    //fflush (stdout);
+    if (dds_instance_get_key (rd1, ctx->esi[ent1], &keysample) != 0)
+      return 0;
+    // In principle, only key fields are set in sample returned by get_key;
+    // in the case of a built-in topic that is extended to the participant
+    // key. The qos and topic/type names should not be set, and there is no
+    // (therefore) memory allocated for the sample.
+    assert (keysample.qos == NULL);
+    assert (keysample.topic_name == NULL);
+    assert (keysample.type_name == NULL);
+    //for (size_t j = 0; j < sizeof (keysample.key.v); j++)
+    //  printf ("%s%02x", (j > 0 && j % 4 == 0) ? ":" : "", keysample.key.v[j]);
+    const dds_instance_handle_t ih = dds_lookup_instance (rd2, &keysample);
+    //printf (" -> %"PRIx64")", ih);
+    //fflush (stdout);
+    return ih;
+  }
+}
+
+static void print_timestamp (struct oneliner_ctx *ctx, dds_time_t ts)
+{
+  dds_time_t dt = ts - ctx->l.tref;
+  if ((dt % DDS_NSECS_IN_SEC) == 0)
+    printf ("@%"PRId64, dt / DDS_NSECS_IN_SEC);
+  else
+  {
+    unsigned frac = (unsigned) (dt % DDS_NSECS_IN_SEC);
+    int digs = 9;
+    while ((frac % 10) == 0)
+    {
+      digs--;
+      frac /= 10;
+    }
+    printf ("@%"PRId64".%0*u", dt / DDS_NSECS_IN_SEC, digs, frac);
+  }
+}
+
+static bool parse_sample_value (struct oneliner_ctx *ctx, Space_Type1 *s, bool *valid_data, int def)
+{
+  s->long_1 = s->long_2 = s->long_3 = def;
+  if (nexttok (&ctx->l, NULL) == TOK_INT) // key value (invalid sample)
+  {
+    if (ctx->l.v.i < 0)
+      return false;
+    s->long_1 = ctx->l.v.i;
+    *valid_data = false;
+    return true;
+  }
+  else if (ctx->l.tok == '(')
+  {
+    if (nexttok (&ctx->l, NULL) != TOK_INT || ctx->l.v.i < 0)
+      return false;
+    s->long_1 = ctx->l.v.i;
+    if (nexttok (&ctx->l, NULL) != ',' || nexttok (&ctx->l, NULL) != TOK_INT || ctx->l.v.i < 0)
+      return false;
+    s->long_2 = ctx->l.v.i;
+    if (nexttok (&ctx->l, NULL) != ',' || nexttok (&ctx->l, NULL) != TOK_INT || ctx->l.v.i < 0)
+      return false;
+    s->long_3 = ctx->l.v.i;
+    *valid_data = true;
+    return nexttok (&ctx->l, NULL) == ')';
+  }
+  else
+  {
+    return false;
+  }
+}
+
+struct doreadlike_sample {
+  uint32_t state;
+  bool valid_data;
+  dds_time_t ts;
+  int wrent;
+  dds_instance_handle_t wrih;
+  Space_Type1 data;
+};
+
+static bool wrname_from_pubhandle (const struct oneliner_ctx *ctx, int ent, dds_instance_handle_t pubhandle, entname_t *wrname)
+{
+  dds_builtintopic_endpoint_t inf, inf1;
+  if (dds_instance_get_key (ctx->pubrd[ent/9], pubhandle, &inf) != 0)
+    return false;
+  for (int j = 0; j < (int) (sizeof (ctx->doms) / sizeof (ctx->doms[0])); j++)
+  {
+    for (int k = 6; k < 9; k++)
+    {
+      if (ctx->esi[9*j+k] != 0)
+      {
+        if (dds_instance_get_key (ctx->pubrd[j], ctx->esi[9*j+k], &inf1) != 0)
+          return false;
+        if (memcmp (&inf.key, &inf1.key, sizeof (inf.key)) == 0)
+        {
+          getentname (wrname, 9*j+k);
+          return true;
+        }
+      }
+    }
+  }
+  return false;
+}
+
+static bool doreadlike_parse_sample (struct oneliner_ctx *ctx, struct doreadlike_sample *s)
+{
+  static const char *statechars = "fsaudno";
+  static const uint32_t statemap[] = {
+    DDS_NOT_READ_SAMPLE_STATE, DDS_READ_SAMPLE_STATE,
+    DDS_ALIVE_INSTANCE_STATE, DDS_NOT_ALIVE_NO_WRITERS_INSTANCE_STATE, DDS_NOT_ALIVE_DISPOSED_INSTANCE_STATE,
+    DDS_NEW_VIEW_STATE, DDS_NOT_NEW_VIEW_STATE
+  };
+  // syntax: [state]k[pubhandle][@ts] or [state](k,l,m)[pubhandle][@ts]
+  // the first is an invalid sample, the second a valid one, the third says anything goes
+  // state is a combination of: sample state (F,S fresh/stale), instance state (A,U,D), view state (N,O)
+  // unspecified: don't care
+  s->state = 0;
+  s->ts = -1;
+  s->wrent = -1;
+  s->wrih = 0;
+  struct oneliner_lex l1 = ctx->l;
+  if (nexttok_if (&ctx->l, TOK_NAME))
+  {
+    char *inp1 = ctx->l.v.n;
+    char *p;
+    while (*inp1 && (p = strchr (statechars, *inp1)) != NULL)
+    {
+      s->state |= statemap[(int) (p - statechars)];
+      inp1++;
+    }
+    if (*inp1 == 0)
+      ;
+    else if (!isdigit (*inp1))
+      return false;
+    else // rewind input to digit
+      ctx->l.inp = l1.inp + (inp1 - ctx->l.v.n);
+  }
+  // missing states: allow everything
+  if ((s->state & (statemap[0] | statemap[1])) == 0)
+    s->state |= statemap[0] | statemap[1];
+  if ((s->state & (statemap[2] | statemap[3] | statemap[4])) == 0)
+    s->state |= statemap[2] | statemap[3] | statemap[4];
+  if ((s->state & (statemap[5] | statemap[6])) == 0)
+    s->state |= statemap[5] | statemap[6];
+  if (!parse_sample_value (ctx, &s->data, &s->valid_data, -1))
+    return false;
+  s->wrent = parse_entity1 (&ctx->l, NULL);
+  if (nexttok_if (&ctx->l, TOK_TIMESTAMP))
+    s->ts = ctx->l.v.d;
+  return true;
+}
+
+static bool doreadlike_ismatch (const dds_sample_info_t *si, const Space_Type1 *s, const struct doreadlike_sample *exp)
+{
+  return (si->valid_data == exp->valid_data &&
+          (si->sample_state & exp->state) != 0 &&
+          (si->instance_state & exp->state) != 0 &&
+          (si->view_state & exp->state) != 0 &&
+          (exp->data.long_1 < 0 || s->long_1 == exp->data.long_1) &&
+          (!exp->valid_data || exp->data.long_2 < 0 || s->long_2 == exp->data.long_2) &&
+          (!exp->valid_data || exp->data.long_3 < 0 || s->long_3 == exp->data.long_3) &&
+          (exp->ts < 0 || si->source_timestamp == exp->ts) &&
+          (exp->wrent < 0 || si->publication_handle == exp->wrih));
+}
+
+static bool doreadlike_matchstep (const dds_sample_info_t *si, const Space_Type1 *s, const struct doreadlike_sample *exp, int nexp, bool ellipsis, unsigned *tomatch, int *cursor, dds_instance_handle_t *lastih, int *matchidx)
+{
+  if (si->instance_handle != *lastih)
+  {
+    *lastih = si->instance_handle;
+    *cursor = -1;
+    for (int m = 0; m < nexp; m++)
+    {
+      if ((*tomatch & (1u << m)) && s->long_1 == exp[m].data.long_1)
+      {
+        *cursor = m;
+        break;
+      }
+    }
+  }
+  if (*cursor < 0 || *cursor >= nexp)
+  {
+    *matchidx = ellipsis ? nexp : -1;
+    return ellipsis;
+  }
+  else if (doreadlike_ismatch (si, s, &exp[*cursor]))
+  {
+    *matchidx = *cursor;
+    *tomatch &= ~(1u << *cursor);
+    (*cursor)++;
+    return true;
+  }
+  else if (ellipsis)
+  {
+    *matchidx = nexp;
+    return true;
+  }
+  else
+  {
+    *matchidx = -1;
+    return false;
+  }
+}
+
+static void doreadlike (struct oneliner_ctx *ctx, const char *name, dds_return_t (*fn) (dds_entity_t, void **buf, dds_sample_info_t *, size_t, uint32_t))
+{
+#define MAXN 10
+  struct doreadlike_sample exp[MAXN];
+  int nexp = 0;
+  bool ellipsis = false;
+  int exp_nvalid = -1, exp_ninvalid = -1;
+  int ent;
+  switch (peektok (&ctx->l, NULL))
+  {
+    default: // no expectations
+      ellipsis = true;
+      break;
+    case '(': // (# valid, # invalid)
+      nexttok (&ctx->l, NULL);
+      if (!(nexttok_int (&ctx->l, &exp_nvalid) && nexttok_if (&ctx->l, ',') && nexttok_int (&ctx->l, &exp_ninvalid) && nexttok_if (&ctx->l, ')')))
+        error (ctx, "%s: expecting (NINVALID, NVALID)", name);
+      ellipsis = true;
+      break;
+    case '{':
+      nexttok (&ctx->l, NULL);
+      if (!nexttok_if (&ctx->l, '}'))
+      {
+        do {
+          if (nexttok_if (&ctx->l, TOK_ELLIPSIS)) {
+            ellipsis = true; break;
+          } else if (nexp == MAXN) {
+            error (ctx, "%s: too many samples specified", name);
+          } else if (!doreadlike_parse_sample (ctx, &exp[nexp++])) {
+            error (ctx, "%s: expecting sample", name);
+          }
+        } while (nexttok_if (&ctx->l, ','));
+        if (!nexttok_if (&ctx->l, '}'))
+          error (ctx, "%s: expecting '}'", name);
+      }
+      break;
+  }
+  if ((ent = parse_entity1 (&ctx->l, NULL)) < 0)
+    error (ctx, "%s: entity required", name);
+
+  for (int i = 0; i < nexp; i++)
+  {
+    if (exp[i].wrent >= 0 && (exp[i].wrih = lookup_insthandle (ctx, ent, exp[i].wrent)) == 0)
+      error (ctx, "%s: instance lookup failed", name);
+  }
+
+  printf ("entity %"PRId32": %s: ", ctx->es[ent], (fn == dds_take) ? "take" : "read");
+  fflush (stdout);
+  Space_Type1 data[MAXN];
+  void *raw[MAXN];
+  for (int i = 0; i < MAXN; i++)
+    raw[i] = &data[i];
+  int matchidx[MAXN];
+  dds_sample_info_t si[MAXN];
+  DDSRT_STATIC_ASSERT (MAXN < CHAR_BIT * sizeof (unsigned));
+  const uint32_t maxs = (uint32_t) (sizeof (raw) / sizeof (raw[0]));
+  const int32_t n = fn (ctx->es[ent], raw, si, maxs, maxs);
+  if (n < 0)
+    error_dds (ctx, n, "%s: failed on %"PRId32, name, ctx->es[ent]);
+  unsigned tomatch = (1u << nexp) - 1; // used to track result entries matched by spec
+  dds_instance_handle_t lastih = 0;
+  int cursor = -1;
+  int count[2] = { 0, 0 };
+  bool matchok = true;
+  printf ("{");
+  for (int i = 0; i < n; i++)
+  {
+    const Space_Type1 *s = raw[i];
+    entname_t wrname;
+    count[si[i].valid_data]++;
+    printf ("%s%c%c%c",
+            (i > 0) ? "," : "",
+            (si[i].sample_state == DDS_NOT_READ_SAMPLE_STATE) ? 'f' : 's',
+            (si[i].instance_state == DDS_ALIVE_INSTANCE_STATE) ? 'a' : (si[i].instance_state == DDS_NOT_ALIVE_NO_WRITERS_INSTANCE_STATE) ? 'u' : 'd',
+            (si[i].view_state == DDS_NEW_VIEW_STATE) ? 'n' : 'o');
+    if (si[i].valid_data)
+      printf ("(%"PRId32",%"PRId32",%"PRId32")", s->long_1, s->long_2, s->long_3);
+    else
+      printf ("%"PRId32, s->long_1);
+    if (!wrname_from_pubhandle (ctx, ent, si[i].publication_handle, &wrname))
+      error (ctx, "%s: unknown publication handle received", name);
+    printf ("%s", wrname.n);
+    print_timestamp (ctx, si[i].source_timestamp);
+    if (!doreadlike_matchstep (&si[i], s, exp, nexp, ellipsis, &tomatch, &cursor, &lastih, &matchidx[i]))
+      matchok = false;
+  }
+  printf ("}:");
+  for (int i = 0; i < n; i++)
+    printf (" %d", matchidx[i]);
+  if (tomatch != 0)
+  {
+    printf (" (samples missing)");
+    matchok = false;
+  }
+  printf (" valid %d %d invalid %d %d", count[1], exp_nvalid, count[0], exp_ninvalid);
+  if (exp_nvalid >= 0 && (count[1] != exp_nvalid))
+    matchok = false;
+  if (exp_ninvalid >= 0 && (count[0] != exp_ninvalid))
+    matchok = false;
+  printf ("\n");
+  fflush (stdout);
+  if (!matchok)
+    testfail (ctx, "%s: mismatch between actual and expected set\n", name);
+#undef MAXN
+}
+
+static void dotake (struct oneliner_ctx *ctx) { doreadlike (ctx, "take", dds_take); }
+static void doread (struct oneliner_ctx *ctx) { doreadlike (ctx, "read", dds_read); }
+
+static void dowritelike (struct oneliner_ctx *ctx, const char *name, bool fail, dds_return_t (*fn) (dds_entity_t wr, const void *sample, dds_time_t ts))
+{
+  dds_return_t ret;
+  dds_time_t ts = dds_time ();
+  bool valid_data;
+  int ent;
+  Space_Type1 sample;
+  if ((ent = parse_entity (ctx)) < 0)
+    error (ctx, "%s: expecting entity", name);
+  if (ctx->es[ent] == 0)
+    make_entity (ctx, ent, NULL);
+  if (!parse_sample_value (ctx, &sample, &valid_data, 0))
+    error (ctx, "%s: expecting sample value", name);
+  if (nexttok_if (&ctx->l, TOK_TIMESTAMP))
+    ts = ctx->l.v.d;
+  printf ("entity %"PRId32": %s (%"PRId32",%"PRId32",%"PRId32")", ctx->es[ent], name, sample.long_1, sample.long_2, sample.long_3);
+  print_timestamp (ctx, ts);
+  printf ("\n");
+  ret = fn (ctx->es[ent], &sample, ts);
+  if (!fail)
+  {
+    if (ret != 0)
+      error_dds (ctx, ret, "%s: failed", name);
+  }
+  else
+  {
+    if (ret == 0)
+      testfail (ctx, "%s: succeeded unexpectedly", name);
+    else if (ret != DDS_RETCODE_TIMEOUT)
+      error_dds (ctx, ret, "%s: failed", name);
+  }
+}
+
+static void dowr (struct oneliner_ctx *ctx) { dowritelike (ctx, "wr", false, dds_write_ts); }
+static void dowrfail (struct oneliner_ctx *ctx) { dowritelike (ctx, "wrfail", true, dds_write_ts); }
+static void dowrdisp (struct oneliner_ctx *ctx) { dowritelike (ctx, "wrdisp", false, dds_writedispose_ts); }
+static void dowrdispfail (struct oneliner_ctx *ctx) { dowritelike (ctx, "wrdispfail", true, dds_writedispose_ts); }
+static void dodisp (struct oneliner_ctx *ctx) { dowritelike (ctx, "disp", false, dds_dispose_ts); }
+static void dodispfail (struct oneliner_ctx *ctx) { dowritelike (ctx, "dispfail", true, dds_dispose_ts); }
+static void dounreg (struct oneliner_ctx *ctx) { dowritelike (ctx, "unreg", false, dds_unregister_instance_ts); }
+static void dounregfail (struct oneliner_ctx *ctx) { dowritelike (ctx, "unregfail", true, dds_unregister_instance_ts); }
+
+static int checkstatus (struct oneliner_ctx *ctx, int ll, int ent, struct oneliner_lex *argl, const void *status)
+{
+  assert (lldesc[ll].desc != NULL);
+  const char *d = lldesc[ll].desc;
+  int field = 0;
+  const char *sep = "(";
+  size_t off = 0;
+  if (nexttok (argl, NULL) != '(')
+    abort ();
+  while (*d)
+  {
+    const void *p = advance (status, &off, *d);
+    int i;
+    switch (*d)
+    {
+      case 'n':
+        if (!nexttok_int (argl, &i) || i < 0)
+          return setresult (ctx, -1, "checkstatus: field %d expecting non-negative integer", field);
+        printf ("%s%"PRIu32" %d", sep, *(uint32_t *)p, i); fflush (stdout);
+        if (*(uint32_t *)p != (uint32_t)i)
+          return setresult (ctx, 0, "checkstatus: field %d has actual %"PRIu32" expected %d", field, *(uint32_t *)p, i);
+        break;
+      case 'c':
+        if (!nexttok_int (argl, &i))
+          return setresult (ctx, -1, "checkstatus: field %d expecting integer", field);
+        printf ("%s%"PRId32" %d", sep, *(int32_t *)p, i); fflush (stdout);
+        if (*(int32_t *)p != i)
+          return setresult (ctx, 0, "checkstatus: field %d has actual %"PRId32" expected %d", field, *(int32_t *)p, i);
+        break;
+      case 'P':
+        if (nexttok (argl, NULL) != TOK_NAME)
+          return setresult (ctx, -1, "checkstatus: field %d expecting policy name", field);
+        size_t polidx;
+        for (polidx = 0; polidx < sizeof (qostab) / sizeof (qostab[0]); polidx++)
+          if (strcmp (argl->v.n, qostab[polidx].abbrev) == 0)
+            break;
+        if (polidx == sizeof (qostab) / sizeof (qostab[0]))
+          return setresult (ctx, -1, "checkstatus: field %d expecting policy name", field);
+        printf ("%s%"PRIu32" %"PRIu32, sep, *(uint32_t *)p, (uint32_t) qostab[polidx].id); fflush (stdout);
+        if (*(uint32_t *)p != (uint32_t) qostab[polidx].id)
+          return setresult (ctx, 0, "checkstatus: field %d has actual %"PRIu32" expected %d", field, *(uint32_t *)p, (int) qostab[polidx].id);
+        break;
+      case 'R':
+        if (nexttok (argl, NULL) != TOK_NAME)
+          return setresult (ctx, -1, "checkstatus: field %d expecting reason", field);
+        if (strcmp (argl->v.n, "i") == 0) i = (int) DDS_REJECTED_BY_INSTANCES_LIMIT;
+        else if (strcmp (argl->v.n, "s") == 0) i = (int) DDS_REJECTED_BY_SAMPLES_LIMIT;
+        else if (strcmp (argl->v.n, "spi") == 0) i = (int) DDS_REJECTED_BY_SAMPLES_PER_INSTANCE_LIMIT;
+        else return setresult (ctx, -1, "checkstatus: field %d expecting reason", field);
+        printf ("%s%d %d", sep, (int) *(dds_sample_rejected_status_kind *)p, i); fflush (stdout);
+        if (*(dds_sample_rejected_status_kind *)p != (dds_sample_rejected_status_kind) i)
+          return setresult (ctx, 0, "checkstatus: field %d has actual %d expected %d", field, (int) (*(dds_sample_rejected_status_kind *)p), i);
+        break;
+      case 'I': // instance handle is too complicated
+        break;
+      case 'E': {
+        int ent1 = -1;
+        dds_instance_handle_t esi1 = 0;
+        if (nexttok_if (argl, '*'))
+          ent1 = -1;
+        else if ((ent1 = parse_entity1 (argl, NULL)) < 0)
+          return setresult (ctx, -1, "checkstatus: field %d expecting * or entity name", field);
+        else if ((esi1 = lookup_insthandle (ctx, ent, ent1)) == 0)
+          return setresult (ctx, -1, "checkstatus: field %d instance handle lookup failed", field);
+        printf ("%s%"PRIx64" %"PRIx64, sep, *(dds_instance_handle_t *)p, esi1); fflush (stdout);
+        if (ent1 >= 0 && *(dds_instance_handle_t *)p != esi1)
+          return setresult (ctx, 0, "checkstatus: field %d has actual %"PRIx64" expected %"PRIx64, field, *(dds_instance_handle_t *)p, esi1);
+        break;
+      }
+      default:
+        return DDS_RETCODE_BAD_PARAMETER;
+    }
+    sep = ", ";
+    if (*d != 'I')
+      field++;
+    ++d;
+    if (*d && *d != 'I' && !nexttok_if (argl, ','))
+      return setresult (ctx, -1, "checkstatus: field %d expecting ','", field);
+  }
+  printf (")");
+  if (!nexttok_if (argl, ')'))
+    return setresult (ctx, -1, "checkstatus: field %d expecting ')'", field);
+  assert (off <= lldesc[ll].size);
+  return 1;
+}
+
+static void checklistener (struct oneliner_ctx *ctx, int ll, int ent, struct oneliner_lex *argl)
+{
+  bool signalled = true;
+  uint32_t min_cnt = 1, max_cnt = UINT32_MAX;
+  uint32_t status;
+  const int dom = ent / 9;
+  dds_return_t ret;
+  printf ("listener %s: check called for entity %"PRId32, lldesc[ll].name, ctx->es[ent]);
+  fflush (stdout);
+  if (argl && lldesc[ll].cb_status_off == 0)
+  {
+    // those that don't have a status can check the number of invocations
+    int cnt = -1;
+    if (!(nexttok_if (argl, '(') && nexttok_int (argl, &cnt) && nexttok_if (argl, ')')))
+      error (ctx, "listener %s: expecting (COUNT)", lldesc[ll].name);
+    if (cnt < 0)
+      error (ctx, "listener %s: invocation count must be at least 0", lldesc[ll].name);
+    min_cnt = max_cnt = (uint32_t) cnt;
+  }
+  ddsrt_mutex_lock (&ctx->g_mutex);
+  bool cnt_ok = (ctx->cb[dom].cb_called[lldesc[ll].id] >= min_cnt && ctx->cb[dom].cb_called[lldesc[ll].id] <= max_cnt);
+  while (ctx->cb[dom].cb_called[lldesc[ll].id] < min_cnt && signalled)
+  {
+    signalled = ddsrt_cond_waitfor (&ctx->g_cond, &ctx->g_mutex, DDS_SECS (5));
+    cnt_ok = (ctx->cb[dom].cb_called[lldesc[ll].id] >= min_cnt && ctx->cb[dom].cb_called[lldesc[ll].id] <= max_cnt);
+  }
+  printf (" cb_called %"PRIu32" (%s)", ctx->cb[dom].cb_called[lldesc[ll].id], cnt_ok ? "ok" : "fail");
+  fflush (stdout);
+  if (!cnt_ok)
+  {
+    ddsrt_mutex_unlock (&ctx->g_mutex);
+    testfail (ctx, "listener %s: not invoked [%"PRIu32",%"PRIu32"] times", lldesc[ll].name, min_cnt, max_cnt);
+  }
+  dds_entity_t * const cb_entity = (dds_entity_t *) ((char *) &ctx->cb[dom] + lldesc[ll].cb_entity_off);
+  printf (" cb_entity %"PRId32" %"PRId32" (%s)", *cb_entity, ctx->es[ent], (*cb_entity == ctx->es[ent]) ? "ok" : "fail");
+  fflush (stdout);
+  if (*cb_entity != ctx->es[ent])
+  {
+    ddsrt_mutex_unlock (&ctx->g_mutex);
+    testfail (ctx, "listener %s: invoked on %"PRId32" instead of %"PRId32, lldesc[ll].name, *cb_entity, ctx->es[ent]);
+  }
+  if (!(ctx->doms[0] && ctx->doms[1]))
+  {
+    // FIXME: two domains: listener invocation happens on another thread and we can observe non-0 "change" fields
+    // they get updated, listener gets invoked, then they get reset -- pretty sure it is allowed by the spec, but
+    // not quite elegant
+    if ((ret = check_status_change_fields_are_0 (ll, ctx->es[ent])) <= 0)
+    {
+      ddsrt_mutex_unlock (&ctx->g_mutex);
+      if (ret == 0)
+        testfail (ctx, "listener %s: status contains non-zero change fields", lldesc[ll].name);
+      else if (ret < 0)
+        error_dds (ctx, ret, "listener %s: get entity status failed", lldesc[ll].name);
+    }
+  }
+  if (argl && lldesc[ll].cb_status_off != 0)
+  {
+    void *cb_status = (char *) &ctx->cb[dom] + lldesc[ll].cb_status_off;
+    if (checkstatus (ctx, ll, ent, argl, cb_status) <= 0)
+    {
+      ddsrt_mutex_unlock (&ctx->g_mutex);
+      longjmp (ctx->jb, 1);
+    }
+  }
+  printf ("\n");
+  ctx->cb[dom].cb_called[lldesc[ll].id] = 0;
+  ddsrt_mutex_unlock (&ctx->g_mutex);
+  if ((ret = dds_get_status_changes (ctx->es[ent], &status)) != 0)
+    error_dds (ctx, ret, "listener %s: dds_get_status_change on %"PRId32, lldesc[ll].name, ctx->es[ent]);
+  if ((status & (1u << lldesc[ll].id)) != 0)
+    testfail (ctx, "listener %s: status mask not cleared", lldesc[ll].name);
+}
+
+static void dochecklistener (struct oneliner_ctx *ctx)
+{
+  const bool expectclear = nexttok_if (&ctx->l, '!');
+  const int ll = parse_listener (ctx);
+  if (ll < 0)
+    error (ctx, "check listener: requires listener name");
+  else if (expectclear)
+  {
+    printf ("listener %s: check not called", lldesc[ll].name);
+    fflush (stdout);
+    ddsrt_mutex_lock (&ctx->g_mutex);
+    bool ret = true;
+    for (int i = 0; i < (int) (sizeof (ctx->doms) / sizeof (ctx->doms[0])); i++)
+    {
+      printf (" cb_called %"PRIu32" %s\n", ctx->cb[i].cb_called[lldesc[ll].id], ctx->cb[i].cb_called[lldesc[ll].id] == 0 ? "ok" : "fail");
+      if (ctx->cb[i].cb_called[lldesc[ll].id] != 0)
+        ret = false;
+    }
+    ddsrt_mutex_unlock (&ctx->g_mutex);
+    if (!ret)
+      testfail (ctx, "callback %s invoked unexpectedly", lldesc[ll].name);
+  }
+  else
+  {
+    struct oneliner_lex l1 = ctx->l;
+    // no whitespace between name and args
+    const bool have_args = (*ctx->l.inp == '(');
+    if (have_args)
+    {
+      // skip args: we need the entity before we can interpret them
+      int tok;
+      while ((tok = nexttok (&ctx->l, NULL)) != EOF && tok != ')')
+        ;
+    }
+    const int ent = parse_entity (ctx);
+    if (ent < 0)
+      error (ctx, "check listener: requires an entity");
+    if (ctx->es[ent] == 0)
+      setlistener (ctx, NULL, ll, ent);
+    checklistener (ctx, ll, ent, have_args ? &l1 : NULL);
+  }
+}
+
+static void dodelete (struct oneliner_ctx *ctx)
+{
+  dds_return_t ret;
+  int ent;
+  if ((ent = parse_entity (ctx)) < 0)
+    error (ctx, "delete: requires entity");
+  if ((ret = dds_delete (ctx->es[ent])) != 0)
+    error_dds (ctx, ret, "delete: failed on %"PRId32, ctx->es[ent]);
+  ctx->es[ent] = 0;
+}
+
+static void dodeaf (struct oneliner_ctx *ctx)
+{
+  dds_return_t ret;
+  entname_t name;
+  int ent;
+  if ((ent = parse_entity (ctx)) < 0 || (ent % 9) != 0)
+    error (ctx, "deaf: requires participant");
+  printf ("deaf: %s\n", getentname (&name, ent));
+  if ((ret = dds_domain_set_deafmute (ctx->es[ent], true, false, DDS_INFINITY)) != 0)
+    error_dds (ctx, ret, "deaf: dds_domain_set_deafmute failed on %"PRId32, ctx->es[ent]);
+  // speed up the process by forcing lease expiry
+  dds_entity *x, *xprime;
+  if ((ret = dds_entity_pin (ctx->es[ent], &x)) < 0)
+    error_dds (ctx, ret, "deaf: pin participant failed %"PRId32, ctx->es[ent]);
+  for (int i = 0; i < (int) (sizeof (ctx->doms) / sizeof (ctx->doms[0])); i++)
+  {
+    if (i == ent / 9 || ctx->es[9*i] == 0)
+      continue;
+    if ((ret = dds_entity_pin (ctx->es[9*i], &xprime)) < 0)
+    {
+      dds_entity_unpin (x);
+      error_dds (ctx, ret, "deaf: pin counterpart participant failed %"PRId32, ctx->es[9*i]);
+    }
+    thread_state_awake (lookup_thread_state (), &x->m_domain->gv);
+    delete_proxy_participant_by_guid (&x->m_domain->gv, &xprime->m_guid, ddsrt_time_wallclock (), true);
+    thread_state_asleep (lookup_thread_state ());
+    dds_entity_unpin (xprime);
+  }
+  dds_entity_unpin (x);
+}
+
+static void dohearing (struct oneliner_ctx *ctx)
+{
+  dds_return_t ret;
+  entname_t name;
+  int ent;
+  if ((ent = parse_entity (ctx)) < 0 || (ent % 9) != 0)
+    error (ctx, "hearing: requires participant");
+  printf ("hearing: %s\n", getentname (&name, ent));
+  if ((ret = dds_domain_set_deafmute (ctx->es[ent], false, false, DDS_INFINITY)) != 0)
+    error_dds (ctx, ret, "hearing: dds_domain_set_deafmute failed %"PRId32, ctx->es[ent]);
+  // speed up the process by forcing SPDP publication on the remote
+  for (int i = 0; i < (int) (sizeof (ctx->doms) / sizeof (ctx->doms[0])); i++)
+  {
+    if (i == ent / 9 || ctx->es[9*i] == 0)
+      continue;
+    dds_entity *xprime;
+    struct participant *pp;
+    if ((ret = dds_entity_pin (ctx->es[9*i], &xprime)) < 0)
+      error_dds (ctx, ret, "hearing: pin counterpart participant failed %"PRId32, ctx->es[9*i]);
+    thread_state_awake (lookup_thread_state (), &xprime->m_domain->gv);
+    if ((pp = entidx_lookup_participant_guid (xprime->m_domain->gv.entity_index, &xprime->m_guid)) != NULL)
+      resched_xevent_if_earlier (pp->spdp_xevent, ddsrt_mtime_add_duration (ddsrt_time_monotonic (), DDS_MSECS (100)));
+    thread_state_asleep (lookup_thread_state ());
+    dds_entity_unpin (xprime);
+  }
+}
+
+static void dosleep (struct oneliner_ctx *ctx)
+{
+  if (nexttok_dur (&ctx->l, NULL, true) != TOK_DURATION)
+    error (ctx, "sleep: invalid duration");
+  dds_sleepfor (ctx->l.v.d);
+}
+
+static void dispatchcmd (struct oneliner_ctx *ctx)
+{
+  static const struct {
+    const char *name;
+    void (*fn) (struct oneliner_ctx *ct);
+  } cs[] = {
+    { "-",          dodelete },
+    { "?",          dochecklistener },
+    { "wr",         dowr },
+    { "wrdisp",     dowrdisp },
+    { "disp",       dodisp },
+    { "unreg",      dounreg },
+    { "wrfail",     dowrfail },
+    { "wrdispfail", dowrdispfail },
+    { "dispfail",   dodispfail },
+    { "unregfail",  dounregfail },
+    { "take",       dotake },
+    { "read",       doread },
+    { "deaf",       dodeaf },
+    { "hearing",    dohearing },
+    { "sleep",      dosleep }
+  };
+  size_t i;
+  if (ctx->l.tok > 0)
+  {
+    // convert single-character token to string
+    ctx->l.v.n[0] = (char) ctx->l.tok;
+    ctx->l.v.n[1] = 0;
+  }
+  for (i = 0; i < sizeof (cs) / sizeof (cs[0]); i++)
+    if (strcmp (ctx->l.v.n, cs[i].name) == 0)
+      break;
+  if (i == sizeof (cs) / sizeof (cs[0]))
+    error (ctx, "%s: unknown command", ctx->l.v.n);
+  cs[i].fn (ctx);
+}
+
+static void dosetlistener (struct oneliner_ctx *ctx, int ll)
+{
+  int ent;
+  struct oneliner_lex l1 = ctx->l;
+  // scan past listener names to get at the entity, which we need
+  // to get the right listener object (and hence argument)
+  while (parse_listener1 (&ctx->l) >= 0)
+    ;
+  if ((ent = parse_entity (ctx)) < 0)
+    error (ctx, "set listener: entity required");
+  setlistener (ctx, &l1, ll, ent);
+}
+
+static void test_oneliner_step1 (struct oneliner_ctx *ctx)
+{
+  while (peektok (&ctx->l, NULL) != TOK_END)
+  {
+    int ent, ll;
+    if (nexttok_if (&ctx->l, ';'))
+      ; // skip ;s
+    else if ((ent = parse_entity (ctx)) >= 0)
+      make_entity (ctx, ent, NULL);
+    else if ((ll = parse_listener (ctx)) >= 0)
+      dosetlistener (ctx, ll);
+    else if (nexttok (&ctx->l, NULL) == TOK_NAME || ctx->l.tok > 0)
+      dispatchcmd (ctx);
+    else
+      error (ctx, "unexpected token %d", ctx->l.tok);
+  }
+}
+
+void test_oneliner_init (struct oneliner_ctx *ctx)
+{
+  dds_qos_t *qos = dds_create_qos ();
+  dds_qset_reliability (qos, DDS_RELIABILITY_RELIABLE, DDS_MSECS (100));
+  dds_qset_destination_order (qos, DDS_DESTINATIONORDER_BY_SOURCE_TIMESTAMP);
+  dds_qset_history (qos, DDS_HISTORY_KEEP_ALL, 0);
+
+  *ctx = (struct oneliner_ctx) {
+    .l = { .tref = dds_time () },
+    .qos = qos,
+    .rwqos = dds_create_qos (),
+    .result = 1,
+    .cb = {
+      [0] = { .ctx = ctx, .list = dds_create_listener (&ctx->cb[0]) },
+      [1] = { .ctx = ctx, .list = dds_create_listener (&ctx->cb[1]) },
+      [2] = { .ctx = ctx, .list = dds_create_listener (&ctx->cb[2]) }
+    }
+  };
+
+  ddsrt_mutex_init (&ctx->g_mutex);
+  ddsrt_cond_init (&ctx->g_cond);
+
+  create_unique_topic_name ("ddsc_listener_test", ctx->topicname, sizeof (ctx->topicname));
+}
+
+int test_oneliner_step (struct oneliner_ctx *ctx, const char *ops)
+{
+  if (ctx->result > 0 && setjmp (ctx->jb) == 0)
+  {
+    ctx->l.inp = ops;
+    test_oneliner_step1 (ctx);
+  }
+  return ctx->result;
+}
+
+const char *test_oneliner_message (const struct oneliner_ctx *ctx)
+{
+  return ctx->msg;
+}
+
+int test_oneliner_fini (struct oneliner_ctx *ctx)
+{
+  for (size_t i = 0; i < sizeof (ctx->cb) / sizeof (ctx->cb[0]); i++)
+    dds_delete_listener (ctx->cb[i].list);
+  dds_delete_qos (ctx->rwqos);
+  dds_delete_qos ((dds_qos_t *) ctx->qos);
+  // prevent any listeners from being invoked so we can safely delete the
+  // mutex and the condition variable -- must do this going down the
+  // hierarchy, or listeners may remain set through inheritance
+  dds_return_t ret;
+  for (size_t i = 0; i < sizeof (ctx->es) / sizeof (ctx->es[0]); i++)
+    if (ctx->es[i] && (ret = dds_set_listener (ctx->es[i], NULL)) != 0)
+      setresult (ctx, ret, "terminate: reset listener failed on %"PRId32, ctx->es[i]);
+  if (ctx->result == 0)
+  {
+    printf ("\n");
+    for (int i = 0; i < (int) (sizeof (ctx->doms) / sizeof (ctx->doms[0])); i++)
+    {
+      for (int j = 3; j <= 5; j++)
+      {
+        if (ctx->es[9*i + j])
+        {
+          const char *inp_orig = ctx->l.inp;
+          entname_t n;
+          ctx->l.inp = getentname (&n, 9*i + j);
+          doreadlike (ctx, "read", dds_read);
+          ctx->l.inp = inp_orig;
+        }
+      }
+    }
+  }
+  ddsrt_mutex_destroy (&ctx->g_mutex);
+  ddsrt_cond_destroy (&ctx->g_cond);
+  for (size_t i = 0; i < sizeof (ctx->doms) / sizeof (ctx->doms[0]); i++)
+    if (ctx->doms[i] && (ret = dds_delete (ctx->doms[i])) != 0)
+      setresult (ctx, ret, "terminate: delete domain on %"PRId32, ctx->doms[i]);
+  return ctx->result;
+}
+
+int test_oneliner (const char *ops)
+{
+  struct oneliner_ctx ctx;
+  printf ("dotest: %s\n", ops);
+  test_oneliner_init (&ctx);
+  test_oneliner_step (&ctx, ops);
+  if (test_oneliner_fini (&ctx) <= 0)
+    fprintf (stderr, "FAIL: %s\n", test_oneliner_message (&ctx));
+  return ctx.result;
+}
diff --git a/src/core/ddsc/tests/test_oneliner.h b/src/core/ddsc/tests/test_oneliner.h
new file mode 100644
index 0000000..1a8b75e
--- /dev/null
+++ b/src/core/ddsc/tests/test_oneliner.h
@@ -0,0 +1,326 @@
+/*
+ * Copyright(c) 2020 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+#ifndef _TEST_ONELINER_H_
+#define _TEST_ONELINER_H_
+
+#include <stdint.h>
+#include <setjmp.h>
+
+#include "dds/dds.h"
+#include "dds/ddsrt/sync.h"
+
+/** @brief run a "test" consisting of a sequence of simplish operations
+ *
+ * This operation takes a test description, really a program in a bizarre syntax, and
+ * executes it.  Any failures, be it because of error codes coming out of the Cyclone
+ * calls or expected values being wrong cause it to fail the test via CU_ASSERT_FATAL.
+ * While it is doing this, it outputs the test steps to stdout including some actual
+ * values. An invalid program is mostly reported by calling abort(). It is geared towards
+ * checking for listener invocations and the effects on statuses.
+ *
+ * Entities in play:
+ *
+ * - participants:   P      P'        P''
+ * - subscribers:    R      R'        R''
+ * - publishers:     W      W'        W''
+ * - readers:        r s t  r' s' t'  r'' s'' t''
+ * - writers:        w x y  w' x' y'  w'' x'' y''
+ *
+ * The unprimed ones exist in domain 0, the primed ones in domain 1 (but configured such
+ * that it talks to domain 0), and the double-primed ones in domain 2 (again configured such
+ * that it talks to domain 0) so that network-related listener invocations can be checked
+ * as well.
+ *
+ * The first mention of an entity creates it as well as its ancestors.  Implicitly created
+ * ancestors always have standard QoS and have no listeners.  There is one topic that is
+ * created implicitly when the participant is created.
+ *
+ * Standard QoS is: default + reliable (100ms), by-source-timestamp, keep-all.  The QoS of
+ * a reader/writer can be overridden at the first mention of it (i.e., when it is created)
+ * by appending a list of QoS overrides between parentheses.
+ *
+ * A program consists of a sequence of operations separated by whitespace, ';' or '/'
+ * (there is no meaning to the separators, they exist to allow visual grouping):
+ *
+ * PROGRAM     ::= (OP (\s+|;)*)*
+ *
+ * OP          ::= (LISTENER)* ENTITY-NAME[(QOS[,QOS[,QOS...]])]
+ *
+ *                       If entity ENTITY-NAME does not exist:
+ *                         creates the entity with the given listeners installed
+ *                         QOS can be used to override the standard QoS
+ *                       else
+ *                         changes the entity's listeners to the specified ones
+ *                       (see above for the valid ENTITY-NAMEs)
+ *
+ *               | -ENTITY-NAME
+ *
+ *                       Deletes the specified entity
+ *
+ *               | WRITE-LIKE[fail] ENTITY-NAME K[@DT]
+ *               | WRITE-LIKE[fail] ENTITY-NAME (K,X,Y)[@DT]
+ *
+ *                       Writes/disposes/unregisters (K,0,0) (first form) or (K,X,Y).  If
+ *                       "fail" is appended, the expectation is that it fails with a
+ *                       timeout, if @DT is appended, the timestamp is the start time of
+ *                       the test + <dt>s rather than the current time; DT is a
+ *                       floating-point number
+ *
+ *               | READ-LIKE ENTITY-NAME
+ *               | READ-LIKE(A,B) ENTITY-NAME
+ *               | READ-LIKE{[S1[,S2[,S3...]][,...]} ENTITY-NAME
+ *
+ *                       Reads/takes at most 10 samples.  The second form counts the
+ *                       number of valid and invalid samples seen and checks them against
+ *                       A and B.
+ *
+ *                       In the third form, the exact result set is given by the sample
+ *                       Si, which is a comma-separated list of samples:
+ *
+ *                         [STATE]K[ENTITY-NAME][@DT]
+ *                         [STATE](K,X,Y)[ENTITY-NAME][@DT]
+ *
+ *                       The first form is an invalid sample with only the (integer) key
+ *                       value K, the second form also specifies the two (integer)
+ *                       attribute fields.
+ *
+ *                       STATE specifies allowed sample (f - not-read (fresh), s - read
+ *                       (stale)), instance (a - alive, u - no-writers (unregistered) d -
+ *                       disposed) and view states (n - new, o - old).  If no sample state
+ *                       is specified, all sample states are allowed, &c.
+ *
+ *                       ENTITY-NAME is the name of the publishing writer expected in the
+ *                       publication_handle.  Not specifying a writer means any writer is
+ *                       ok.  DT is the timestamp in the same manner as the write-like
+ *                       operations.  Not specifying a timestamp means any timestamp is
+ *                       ok.
+ *
+ *                       If the expected set ends up with "..." there may be other samples
+ *                       in the result as well.
+ *
+ *               | ?LISTENER[(ARGS)] ENTITY-NAME
+ *
+ *                       Waits until the specified listener has been invoked on <entity
+ *                       name> using a flag set by the listener function, resets the flag
+ *                       and verifies that neither the entity status bit nor the "change"
+ *                       fields in the various statuses were set.
+ *
+ *                       ARGS is used to check the status argument most recently passed to
+ *                       the listener:
+ *
+ *                         da(A)     verifies that it has been invoked A times
+ *                         dor(A)    see da
+ *                         it(A,B)   verifies count and change match A and B, policy
+ *                                   matches RELIABILITY
+ *                         lc(A,B,C,D,E) verifies that alive and not-alive counts match A
+ *                                   and B, that alive and not-alive changes match C and D
+ *                                   and that the last handle matches E if an entity name
+ *                                   (ignored if E = "*")
+ *                         ll (A,B)  verifies count and change match A and B
+ *                         odm (A,B) verifies count and change match A and B, last handle
+ *                                   is ignored
+ *                         oiq (A,B,C) verifies that total count and change match A and B
+ *                                   and that the mismatching QoS is C (using the same
+ *                                   abbreviations as used for defining QoS on entity
+ *                                   creation)
+ *                         pm (A,B,C,D,E) verifies that total count and change match A and
+ *                                   B, that current count and change match C and D and
+ *                                   that the last handle matches E if an entity name
+ *                                   (ignored if E = "*")
+ *                         rdm       see odm
+ *                         riq       see oiq
+ *                         sl (A,B)  verifies that total count and change match A and B
+ *                         sr (A,B,C) verifies total count and change match A and B, and
+ *                                   that the reason matches C (one of "s" for samples,
+ *                                   "i" for instances, "spi" for samples per instance)
+ *                         sm        see pm
+ *
+ *               | ?!LISTENER
+ *
+ *                       (Not listener) tests that LISTENER has not been invoked since
+ *                       last reset
+ *
+ *               | sleep D
+ *
+ *                       Delay program execution for D s (D is a floating-point number)
+ *
+ *               | deaf ENTITY-NAME
+ *               | hearing ENTITY-NAME
+ *
+ *                       Makes the domain wherein the specified entity exists deaf,
+ *                       respectively restoring hearing.  The entity must be either P or
+ *                       P' and both must exist.  Plays some tricks to speed up lease
+ *                       expiry and reconnection (like forcibly deleting a proxy
+ *                       participant or triggering the publication of SPDP packets).
+ *
+ * WRITE-LIKE  ::= wr    write
+ *               | wrdisp  write-dispose
+ *               | disp  dispose
+ *               | unreg unregister
+ *
+ * READ-LIKE   ::= read  dds_read (so any state)
+ *               | take  dds_take (so any state)
+ *
+ * LISTENER    ::= da    data available (acts on a reader)
+ *               | dor   data on readers (acts on a subcsriber)
+ *               | it    incompatible topic (acts on a topic)
+ *               | lc    liveliness changed (acts on a reader)
+ *               | ll    liveliness lost (acts on a writer)
+ *               | odm   offered deadline missed (acts on a writer)
+ *               | oiq   offered incompatible QoS (acts on a writer)
+ *               | pm    publication matched (acts on a writer)
+ *               | rdm   requested deadline missed (acts on a reader)
+ *               | riq   requested incompatible QoS (acts on a reader)
+ *               | sl    sample lost (acts on a reader)
+ *               | sr    sample rejected (acts on a reader)
+ *               | sm    subscription matched (acts on a reader)
+ *
+ * QOS         ::= ad={y|n}      auto-dispose unregistered instances
+ *               | d={v|tl|t|p}  durability
+ *               | dl={inf|DT}   deadline (infinite or DT seconds)
+ *               | ds=DT/H/RL    durability service: cleanup delay, history,
+ *                               resource limits
+ *               | do={r|s}      by-reception or by-source destination order
+ *               | h={N|all}     history keep-last-N or keep-all
+ *               | lb={inf|DT}   latency budget
+ *               | ll={a[:DT]|p:DT|w:DT} liveliness (automatic, manual by
+ *                               participant, manual by topic)
+ *               | ls={inf|DT}   lifespan
+ *               | o={s|x[:N]}   ownership shared or exclusive (strength N)
+ *               | p={i|t|g}     presentation: instance, coherent-topic or
+ *                               coherent-group
+ *               | r={be|r[:DT]} best-effort or reliable (with max blocking time)
+ *               | rl=N[/N[/N]]  resource limits (sample, instances, samples per
+ *                               instance; "inf" is allowed, ommitted ones are
+ *                               unlimited)
+ *               | tp=N          transport-priority
+ *               | ud=...        user data (with escape sequences and hex/octal
+ *                               input allowed)
+ *
+ * All entities share the listeners with their global state. Only the latest invocation is visible.
+ *
+ * @param[in]  ops  Program to execute.
+ *
+ * @return > 0 success, 0 failure, < 0 invalid input
+ */
+int test_oneliner (const char *ops);
+
+union oneliner_tokval {
+  int i;
+  int64_t d;
+  char n[32];
+};
+
+struct oneliner_lex {
+  const char *inp;
+  dds_time_t tref;
+  int tok;
+  union oneliner_tokval v;
+};
+
+struct oneliner_ctx;
+
+struct oneliner_cb {
+  struct oneliner_ctx *ctx;
+  dds_listener_t *list;
+  uint32_t cb_called[DDS_STATUS_ID_MAX + 1];
+  dds_entity_t cb_topic, cb_writer, cb_reader, cb_subscriber;
+  dds_inconsistent_topic_status_t cb_inconsistent_topic_status;
+  dds_liveliness_changed_status_t cb_liveliness_changed_status;
+  dds_liveliness_lost_status_t cb_liveliness_lost_status;
+  dds_offered_deadline_missed_status_t cb_offered_deadline_missed_status;
+  dds_offered_incompatible_qos_status_t cb_offered_incompatible_qos_status;
+  dds_publication_matched_status_t cb_publication_matched_status;
+  dds_requested_deadline_missed_status_t cb_requested_deadline_missed_status;
+  dds_requested_incompatible_qos_status_t cb_requested_incompatible_qos_status;
+  dds_sample_lost_status_t cb_sample_lost_status;
+  dds_sample_rejected_status_t cb_sample_rejected_status;
+  dds_subscription_matched_status_t cb_subscription_matched_status;
+};
+
+struct oneliner_ctx {
+  struct oneliner_lex l;
+
+  dds_entity_t es[3 * 9];
+  dds_entity_t tps[3];
+  dds_entity_t doms[3];
+  dds_instance_handle_t esi[3 * 9];
+  // built-in topic readers for cross-referencing instance handles
+  dds_entity_t pubrd[3];
+  dds_entity_t subrd[3];
+  // topic name used for data
+  char topicname[100];
+
+  const dds_qos_t *qos;
+  dds_qos_t *rwqos;
+
+  int result;
+  char msg[256];
+
+  jmp_buf jb;
+
+  ddsrt_mutex_t g_mutex;
+  ddsrt_cond_t g_cond;
+  struct oneliner_cb cb[3];
+};
+
+/** @brief Initialize a "oneliner test" context
+ *
+ * @param[out] ctx   context to initialize
+ */
+void test_oneliner_init (struct oneliner_ctx *ctx);
+
+/** @brief Run a sequence of operations in an initialized context
+ *
+ * If the context indicates a preceding step has failed, this is a
+ * no-op and the previous result is propagated to the return value.
+ *
+ * @param[in,out] ctx   context to operate in
+ * @param[in] ops       sequence of operations to execute (@ref test_oneliner)
+ *
+ * @return integer indicating success or failure
+ *
+ * @retval 1   success
+ * @retval 0   test failure
+ * @retval <0  syntax error unexpected error
+ */
+int test_oneliner_step (struct oneliner_ctx *ctx, const char *ops);
+
+/** @brief Get a pointer to the error message from a "oneliner test"
+ *
+ * If a preceding step has failed, this returns a pointer to a message
+ * containing some information about the failure.  If no error
+ * occurred, the message is meaningless.
+ *
+ *
+ * @param[in] ctx   context to retrieve message from
+ *
+ * @return pointer to null-terminated string aliasing a string in ctx
+ */
+const char *test_oneliner_message (const struct oneliner_ctx *ctx);
+
+/** @brief Deinitialize a "oneliner test" context
+ *
+ * This releases all resources used by the context.
+ *
+ * @param[in,out] ctx   context to operate in
+ *
+ * @return integer indicating success or failure in any of the
+ * preceding steps.  If no steps were taken, the result is success.
+ *
+ * @retval 1   success
+ * @retval 0   test failure
+ * @retval <0  syntax error unexpected error
+ */
+int test_oneliner_fini (struct oneliner_ctx *ctx);
+
+#endif
diff --git a/src/core/ddsi/include/dds/ddsi/q_entity.h b/src/core/ddsi/include/dds/ddsi/q_entity.h
index 9d2765e..14f59f8 100644
--- a/src/core/ddsi/include/dds/ddsi/q_entity.h
+++ b/src/core/ddsi/include/dds/ddsi/q_entity.h
@@ -696,7 +696,7 @@ int writer_set_notalive (struct writer *wr, bool notify);
 #define CF_PROXYPP_NO_SPDP                     (1 << 2)
 
 void new_proxy_participant (struct ddsi_domaingv *gv, const struct ddsi_guid *guid, uint32_t bes, const struct ddsi_guid *privileged_pp_guid, struct addrset *as_default, struct addrset *as_meta, const struct ddsi_plist *plist, dds_duration_t tlease_dur, nn_vendorid_t vendor, unsigned custom_flags, ddsrt_wctime_t timestamp, seqno_t seq);
-int delete_proxy_participant_by_guid (struct ddsi_domaingv *gv, const struct ddsi_guid *guid, ddsrt_wctime_t timestamp, int isimplicit);
+DDS_EXPORT int delete_proxy_participant_by_guid (struct ddsi_domaingv *gv, const struct ddsi_guid *guid, ddsrt_wctime_t timestamp, int isimplicit);
 
 int update_proxy_participant_plist_locked (struct proxy_participant *proxypp, seqno_t seq, const struct ddsi_plist *datap, ddsrt_wctime_t timestamp);
 int update_proxy_participant_plist (struct proxy_participant *proxypp, seqno_t seq, const struct ddsi_plist *datap, ddsrt_wctime_t timestamp);

From bb95de69c362c7b51fe2d643bc960a9e0472adeb Mon Sep 17 00:00:00 2001
From: Erik Boasson <eb@ilities.com>
Date: Thu, 7 May 2020 14:43:20 +0200
Subject: [PATCH 222/238] Instance to ALIVE also for rejected samples

In particular, this means instances published by a transient-local
writer will go back to ALIVE following a disconnect and reconnect.

Signed-off-by: Erik Boasson <eb@ilities.com>
---
 src/core/ddsc/src/dds_rhc_default.c | 33 +++++++++++++++++++++--------
 src/core/ddsc/tests/listener.c      | 12 ++++++++---
 2 files changed, 33 insertions(+), 12 deletions(-)

diff --git a/src/core/ddsc/src/dds_rhc_default.c b/src/core/ddsc/src/dds_rhc_default.c
index 9195cd9..4a56d32 100644
--- a/src/core/ddsc/src/dds_rhc_default.c
+++ b/src/core/ddsc/src/dds_rhc_default.c
@@ -1034,7 +1034,7 @@ static void drop_instance_noupdate_no_writers (struct dds_rhc_default *__restric
   *instptr = NULL;
 }
 
-static void dds_rhc_register (struct dds_rhc_default *rhc, struct rhc_instance *inst, uint64_t wr_iid, bool autodispose, bool iid_update, bool * __restrict nda)
+static void dds_rhc_register (struct dds_rhc_default *rhc, struct rhc_instance *inst, uint64_t wr_iid, bool autodispose, bool sample_accepted, bool * __restrict nda)
 {
   const uint64_t inst_wr_iid = inst->wr_iid_islive ? inst->wr_iid : 0;
 
@@ -1061,12 +1061,16 @@ static void dds_rhc_register (struct dds_rhc_default *rhc, struct rhc_instance *
     /* Currently no writers at all */
     assert (!inst->wr_iid_islive);
 
-    /* to avoid wr_iid update when register is called for sample rejected */
-    if (iid_update)
-    {
-      inst->wr_iid = wr_iid;
+    /* When registering a writer based on a rejected sample and causing
+       the instance to transition from not-alive to alive, we do want
+       to generate an invalid sample with the id of the newly registered
+       (or re-registered) writer, but we don't want inst_accepts_sample
+       to be affected (it was "too old" in the ordering).  wr_iid_islive
+       determines whether wr_iid is meaningful, so setting wr_iid while
+       leaving wr_iid_islive false gets us the desired behaviour. */
+    inst->wr_iid = wr_iid;
+    if (sample_accepted)
       inst->wr_iid_islive = 1;
-    }
     inst->wrcount++;
     inst->no_writers_gen++;
     inst->autodispose = autodispose;
@@ -1108,7 +1112,7 @@ static void dds_rhc_register (struct dds_rhc_default *rhc, struct rhc_instance *
       TRACE ("restore");
     }
     /* to avoid wr_iid update when register is called for sample rejected */
-    if (iid_update)
+    if (sample_accepted)
     {
       inst->wr_iid = wr_iid;
       inst->wr_iid_islive = 1;
@@ -1136,7 +1140,6 @@ static void dds_rhc_register (struct dds_rhc_default *rhc, struct rhc_instance *
       inst->wrcount++;
       if (autodispose)
         inst->autodispose = 1;
-      *nda = true;
     }
     else
     {
@@ -1145,7 +1148,7 @@ static void dds_rhc_register (struct dds_rhc_default *rhc, struct rhc_instance *
     assert (inst->wrcount >= 2);
     /* the most recent writer gets the fast path */
     /* to avoid wr_iid update when register is called for sample rejected */
-    if (iid_update)
+    if (sample_accepted)
     {
       inst->wr_iid = wr_iid;
       inst->wr_iid_islive = 1;
@@ -1568,7 +1571,19 @@ static bool dds_rhc_default_store (struct ddsi_rhc * __restrict rhc_common, cons
 
     get_trigger_info_pre (&pre, inst);
     if (has_data || is_dispose)
+    {
       dds_rhc_register (rhc, inst, wr_iid, wrinfo->auto_dispose, false, &notify_data_available);
+      if (notify_data_available)
+      {
+        if (inst->latest == NULL || inst->latest->isread)
+        {
+          const bool was_empty = inst_is_empty (inst);
+          inst_set_invsample (rhc, inst, &trig_qc, &notify_data_available);
+          if (was_empty)
+            account_for_empty_to_nonempty_transition (rhc, inst);
+        }
+      }
+    }
 
     /* notify sample lost */
     cb_data.raw_status_id = (int) DDS_SAMPLE_LOST_STATUS_ID;
diff --git a/src/core/ddsc/tests/listener.c b/src/core/ddsc/tests/listener.c
index 2bd4112..378f0b3 100644
--- a/src/core/ddsc/tests/listener.c
+++ b/src/core/ddsc/tests/listener.c
@@ -380,12 +380,18 @@ CU_Test (ddsc_listener, incompatible_qos)
 
 CU_Test (ddsc_listener, data_available)
 {
-  // data available on reader
+  // data available on reader (+ absence of data-on-readers)
   dotest ("da sm r pm w ?pm w ?sm r wr w 0 ?da r ?!dor");
-  // data available set on subscriber
+  // data available set on subscriber (+ absence of data-on-readers)
   dotest ("da R sm r pm w ?pm w ?sm r wr w 0 ?da r ?!dor");
-  // data available set on participant
+  // data available set on participant (+ absence of data-on-readers)
   dotest ("da P sm r pm w ?pm w ?sm r wr w 0 ?da r ?!dor");
+
+  // non-auto-dispose, transient-local: disconnect => no_writers, reconnect => alive (using invalid samples)
+  // the invalid sample has the source time stamp of the latest update -- one wonders whether that is wise?
+  dotest ("da r(d=tl) ?pm w'(d=tl,ad=n) ; wr w' (1,2,3)@1.1 ?da r read{fan(1,2,3)w'} r ;"
+          " deaf P ; ?da r read{suo(1,2,3)w'@1.1,fuo1w'@1.1} r ;"
+          " hearing P ; ?da r read{sao(1,2,3)w'@1.1,fao1w'@1.1} r");
 }
 
 CU_Test (ddsc_listener, data_available_delete_writer)

From b9660e46c9a2f2944be6b653907e3c1dfe7d8a63 Mon Sep 17 00:00:00 2001
From: Erik Boasson <eb@ilities.com>
Date: Mon, 11 May 2020 14:08:12 +0200
Subject: [PATCH 223/238] Remove dead stores triggering clang warnings

Signed-off-by: Erik Boasson <eb@ilities.com>
---
 src/core/ddsc/src/dds_matched.c       | 6 ++----
 src/core/ddsc/src/dds_write.c         | 3 +--
 src/core/ddsi/src/ddsi_mcgroup.c      | 2 +-
 src/core/ddsi/src/ddsi_security_omg.c | 6 ++----
 src/core/ddsi/src/ddsi_udp.c          | 6 +++---
 src/core/ddsi/src/q_config.c          | 3 +--
 src/ddsrt/src/sync/posix/sync.c       | 8 ++------
 7 files changed, 12 insertions(+), 22 deletions(-)

diff --git a/src/core/ddsc/src/dds_matched.c b/src/core/ddsc/src/dds_matched.c
index d2cc6a9..f10ab4c 100644
--- a/src/core/ddsc/src/dds_matched.c
+++ b/src/core/ddsc/src/dds_matched.c
@@ -144,8 +144,7 @@ static dds_builtintopic_endpoint_t *make_builtintopic_endpoint (const ddsi_guid_
 dds_builtintopic_endpoint_t *dds_get_matched_subscription_data (dds_entity_t writer, dds_instance_handle_t ih)
 {
   dds_writer *wr;
-  dds_return_t rc;
-  if ((rc = dds_writer_lock (writer, &wr)) != DDS_RETCODE_OK)
+  if (dds_writer_lock (writer, &wr))
     return NULL;
   else
   {
@@ -187,8 +186,7 @@ dds_builtintopic_endpoint_t *dds_get_matched_subscription_data (dds_entity_t wri
 dds_builtintopic_endpoint_t *dds_get_matched_publication_data (dds_entity_t reader, dds_instance_handle_t ih)
 {
   dds_reader *rd;
-  dds_return_t rc;
-  if ((rc = dds_reader_lock (reader, &rd)) != DDS_RETCODE_OK)
+  if (dds_reader_lock (reader, &rd))
     return NULL;
   else
   {
diff --git a/src/core/ddsc/src/dds_write.c b/src/core/ddsc/src/dds_write.c
index a2b978b..cc0b1e8 100644
--- a/src/core/ddsc/src/dds_write.c
+++ b/src/core/ddsc/src/dds_write.c
@@ -267,8 +267,7 @@ void dds_write_flush (dds_entity_t writer)
 {
   struct thread_state1 * const ts1 = lookup_thread_state ();
   dds_writer *wr;
-  dds_return_t rc;
-  if ((rc = dds_writer_lock (writer, &wr)) == DDS_RETCODE_OK)
+  if (dds_writer_lock (writer, &wr) == DDS_RETCODE_OK)
   {
     thread_state_awake (ts1, &wr->m_entity.m_domain->gv);
     nn_xpack_send (wr->m_xp, true);
diff --git a/src/core/ddsi/src/ddsi_mcgroup.c b/src/core/ddsi/src/ddsi_mcgroup.c
index cd49444..b01b33e 100644
--- a/src/core/ddsi/src/ddsi_mcgroup.c
+++ b/src/core/ddsi/src/ddsi_mcgroup.c
@@ -203,7 +203,7 @@ static int joinleave_mcgroups (const struct ddsi_domaingv *gv, ddsi_tran_conn_t
         {
           if (gv->recvips_mode == RECVIPS_MODE_ALL || interface_in_recvips_p (gv->recvips, &gv->interfaces[i]))
           {
-            if ((rc = joinleave_mcgroup (conn, join, srcloc, mcloc, &gv->interfaces[i])) < 0)
+            if (joinleave_mcgroup (conn, join, srcloc, mcloc, &gv->interfaces[i]) < 0)
               fails++;
             else
               oks++;
diff --git a/src/core/ddsi/src/ddsi_security_omg.c b/src/core/ddsi/src/ddsi_security_omg.c
index 9ef815a..92c9529 100644
--- a/src/core/ddsi/src/ddsi_security_omg.c
+++ b/src/core/ddsi/src/ddsi_security_omg.c
@@ -2250,7 +2250,6 @@ static bool q_omg_security_register_remote_writer_match(struct proxy_writer *pwr
   struct dds_security_context *sc = q_omg_security_get_secure_context(pp);
   DDS_Security_SecurityException exception = DDS_SECURITY_EXCEPTION_INIT;
   struct proxypp_pp_match *proxypp_match;
-  struct rd_pwr_match *match;
   bool send_tokens = false;
   bool allowed = false;
 
@@ -2258,7 +2257,7 @@ static bool q_omg_security_register_remote_writer_match(struct proxy_writer *pwr
     return false;
 
   ddsrt_mutex_lock(&rd->e.lock);
-  if ((match = ddsrt_avl_lookup (&rd_writers_treedef, &rd->writers, &pwr->e.guid)) != NULL)
+  if (ddsrt_avl_lookup (&rd_writers_treedef, &rd->writers, &pwr->e.guid) != NULL)
     allowed = true;
   else if (rd->e.guid.entityid.u == NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_VOLATILE_SECURE_READER)
   {
@@ -2584,7 +2583,6 @@ static bool q_omg_security_register_remote_reader_match(struct proxy_reader *prd
   struct dds_security_context *sc = q_omg_security_get_secure_context(pp);
   DDS_Security_SecurityException exception = DDS_SECURITY_EXCEPTION_INIT;
   struct proxypp_pp_match *proxypp_match;
-  struct wr_prd_match *match;
   bool send_tokens = false;
   bool allowed = false;
 
@@ -2592,7 +2590,7 @@ static bool q_omg_security_register_remote_reader_match(struct proxy_reader *prd
     return false;
 
   ddsrt_mutex_lock(&wr->e.lock);
-  if ((match = ddsrt_avl_lookup (&wr_readers_treedef, &wr->readers, &prd->e.guid)) != NULL)
+  if (ddsrt_avl_lookup (&wr_readers_treedef, &wr->readers, &prd->e.guid) != NULL)
     allowed = true;
   else if (wr->e.guid.entityid.u == NN_ENTITYID_P2P_BUILTIN_PARTICIPANT_VOLATILE_SECURE_WRITER || !wr->sec_attr->attr.is_submessage_protected)
   {
diff --git a/src/core/ddsi/src/ddsi_udp.c b/src/core/ddsi/src/ddsi_udp.c
index 65d10fd..d67929d 100644
--- a/src/core/ddsi/src/ddsi_udp.c
+++ b/src/core/ddsi/src/ddsi_udp.c
@@ -477,11 +477,11 @@ static dds_return_t ddsi_udp_create_conn (ddsi_tran_conn_t *conn_out, ddsi_tran_
     }
   }
 
-  if ((rc = set_rcvbuf (gv, sock, &gv->config.socket_min_rcvbuf_size)) != DDS_RETCODE_OK)
+  if (set_rcvbuf (gv, sock, &gv->config.socket_min_rcvbuf_size) != DDS_RETCODE_OK)
     goto fail_w_socket;
-  if ((rc = set_sndbuf (gv, sock, gv->config.socket_min_sndbuf_size)) != DDS_RETCODE_OK)
+  if (set_sndbuf (gv, sock, gv->config.socket_min_sndbuf_size) != DDS_RETCODE_OK)
     goto fail_w_socket;
-  if (gv->config.dontRoute && (rc = set_dont_route (gv, sock, ipv6)) != DDS_RETCODE_OK)
+  if (gv->config.dontRoute && set_dont_route (gv, sock, ipv6) != DDS_RETCODE_OK)
     goto fail_w_socket;
 
   if ((rc = ddsrt_bind (sock, &socketname.a, ddsrt_sockaddr_get_size (&socketname.a))) != DDS_RETCODE_OK)
diff --git a/src/core/ddsi/src/q_config.c b/src/core/ddsi/src/q_config.c
index 6bfb3de..e54c7e6 100644
--- a/src/core/ddsi/src/q_config.c
+++ b/src/core/ddsi/src/q_config.c
@@ -2246,14 +2246,13 @@ static int set_defaults (struct cfgst *cfgst, void *parent, int isattr, struct c
   int ok = 1;
   for (const struct cfgelem *ce = cfgelem; ce && ce->name; ce++)
   {
-    struct cfgst_node *n;
     struct cfgst_nodekey key;
     key.e = ce;
     key.p = parent;
     cfgst_push (cfgst, isattr, ce, parent);
     if (ce->multiplicity <= 1)
     {
-      if ((n = ddsrt_avl_lookup (&cfgst_found_treedef, &cfgst->found, &key)) == NULL)
+      if (ddsrt_avl_lookup (&cfgst_found_treedef, &cfgst->found, &key) == NULL)
       {
         if (ce->update)
         {
diff --git a/src/ddsrt/src/sync/posix/sync.c b/src/ddsrt/src/sync/posix/sync.c
index a7f92e8..7dcd203 100644
--- a/src/ddsrt/src/sync/posix/sync.c
+++ b/src/ddsrt/src/sync/posix/sync.c
@@ -159,22 +159,18 @@ ddsrt_cond_broadcast (ddsrt_cond_t *cond)
 void
 ddsrt_rwlock_init (ddsrt_rwlock_t *rwlock)
 {
-  int err = 0;
-
   assert(rwlock != NULL);
 
   /* process-shared attribute is set to PTHREAD_PROCESS_PRIVATE by default */
-  if ((err = pthread_rwlock_init(&rwlock->rwlock, NULL)) != 0)
+  if (pthread_rwlock_init(&rwlock->rwlock, NULL) != 0)
     abort();
 }
 
 void
 ddsrt_rwlock_destroy (ddsrt_rwlock_t *rwlock)
 {
-  int err;
-
   assert(rwlock != NULL);
-  if ((err = pthread_rwlock_destroy (&rwlock->rwlock)) != 0)
+  if (pthread_rwlock_destroy (&rwlock->rwlock) != 0)
     abort();
 }
 

From 0b6ea7946924ea0b66174aa9cdb9de0ad17e65ad Mon Sep 17 00:00:00 2001
From: Erik Boasson <eb@ilities.com>
Date: Mon, 11 May 2020 14:08:30 +0200
Subject: [PATCH 224/238] Assertions to help clang static analyzer

Signed-off-by: Erik Boasson <eb@ilities.com>
---
 src/core/ddsc/tests/loan.c              | 4 ++++
 src/core/ddsi/src/ddsi_serdata_pserop.c | 1 +
 2 files changed, 5 insertions(+)

diff --git a/src/core/ddsc/tests/loan.c b/src/core/ddsc/tests/loan.c
index 5e12d84..2b822c7 100644
--- a/src/core/ddsc/tests/loan.c
+++ b/src/core/ddsc/tests/loan.c
@@ -110,6 +110,7 @@ CU_Test (ddsc_loan, success, .init = create_entities, .fini = delete_entities)
   CU_ASSERT_FATAL (result == DDS_RETCODE_OK);
   /* return resets buf[0] (so that it picks up the loan the next time) and zeros the data */
   CU_ASSERT_FATAL (ptrs[0] == NULL);
+  assert (ptr0copy != NULL); /* clang static analyzer */
   CU_ASSERT_FATAL (memcmp (ptr0copy, zeros, sizeof (s)) == 0);
 
   /* read 3, return: should work fine, causes realloc */
@@ -121,6 +122,7 @@ CU_Test (ddsc_loan, success, .init = create_entities, .fini = delete_entities)
   result = dds_return_loan (reader, ptrs, n);
   CU_ASSERT_FATAL (result == DDS_RETCODE_OK);
   CU_ASSERT_FATAL (ptrs[0] == NULL);
+  assert (ptr0copy != NULL); /* clang static analyzer */
   CU_ASSERT_FATAL (memcmp (ptr0copy, zeros, 3 * sizeof (s)) == 0);
 
   /* read 1 using loan, expecting to get the same address (no realloc needed), defer return.
@@ -145,6 +147,7 @@ CU_Test (ddsc_loan, success, .init = create_entities, .fini = delete_entities)
   {
     const struct RoundTripModule_DataType *a = ptrs[0];
     const struct RoundTripModule_DataType *b = ptrs2[0];
+    assert (a != NULL && b != NULL); /* clang static analyzer */
     CU_ASSERT_FATAL (a->payload._length == b->payload._length);
     CU_ASSERT_FATAL (a->payload._buffer != b->payload._buffer);
     CU_ASSERT_FATAL (a->payload._buffer[0] == b->payload._buffer[0]);
@@ -164,6 +167,7 @@ CU_Test (ddsc_loan, success, .init = create_entities, .fini = delete_entities)
 
   //This should be a use-after-free
   //CU_ASSERT_FATAL (memcmp (ptr0copy, zeros, sizeof (s)) == 0);
+  (void) ptr0copy;
 }
 
 CU_Test (ddsc_loan, take_cleanup, .init = create_entities, .fini = delete_entities)
diff --git a/src/core/ddsi/src/ddsi_serdata_pserop.c b/src/core/ddsi/src/ddsi_serdata_pserop.c
index a3df6d2..1796497 100644
--- a/src/core/ddsi/src/ddsi_serdata_pserop.c
+++ b/src/core/ddsi/src/ddsi_serdata_pserop.c
@@ -213,6 +213,7 @@ static struct ddsi_serdata *serdata_pserop_from_sample (const struct ddsi_sertop
     const size_t size4 = (size + 3) & ~(size_t)3;
     struct ddsi_serdata_pserop *d = serdata_pserop_new (tp, kind, size4, &header);
     assert (tp->ops_key == NULL || (size >= 16 && tp->memsize >= 16));
+    assert (d->data != NULL); // clang static analyzer
     memcpy (d->data, data, size);
     memset (d->data + size, 0, size4 - size);
     d->pos = (uint32_t) size;

From 659e7dc446909115b9f1aa2a4fe4ff0a7f37165b Mon Sep 17 00:00:00 2001
From: Erik Boasson <eb@ilities.com>
Date: Mon, 11 May 2020 14:13:06 +0200
Subject: [PATCH 225/238] Fix documentation comment

Signed-off-by: Erik Boasson <eb@ilities.com>
---
 .../ddsi/include/dds/ddsi/ddsi_security_omg.h | 19 ++++++-------------
 1 file changed, 6 insertions(+), 13 deletions(-)

diff --git a/src/core/ddsi/include/dds/ddsi/ddsi_security_omg.h b/src/core/ddsi/include/dds/ddsi/ddsi_security_omg.h
index 460a4ad..6eeb9eb 100644
--- a/src/core/ddsi/include/dds/ddsi/ddsi_security_omg.h
+++ b/src/core/ddsi/include/dds/ddsi/ddsi_security_omg.h
@@ -485,22 +485,15 @@ bool q_omg_security_is_remote_rtps_protected(const struct proxy_participant *pro
 void set_proxy_participant_security_info(struct proxy_participant *proxypp, const ddsi_plist_t *plist);
 
 /**
- * @brief Check if the participant and the proxy participant
- *        have compatible security info settings.
+ * @brief Determine if the messages, related to the given remote
+ * entity, are RTPS protected or not.
  *
- * Associated with a secure participant is the ParticipantSecurityInfo parameter.
- * This parameter contains the setting of the security attributes and the associated
- * plugin security attributes of the secure participant.
- * This function will check if the received ParticipantSecurityInfo parameter is
- * compatible with the local ParticipantSecurityInfo parameter.
- *
- * @param[in] pp      The participant.
- * @param[in] proxypp The proxy participant.
+ * @param[in] pp       The participant.
+ * @param[in] entityid ID of the entity to check.
  *
  * @returns bool
- * @retval true   The participant and the proxy participant have compatible
- *                security info settings.
- * @retval false  Otherwise.
+ * @retval true   The entity messages are RTPS protected.
+ * @retval false  The entity messages are not RTPS protected.
  */
 bool q_omg_security_is_local_rtps_protected(const struct participant *pp, ddsi_entityid_t entityid);
 

From 8fea8d56731887d1f7a2b9755d038602e8a5f3d8 Mon Sep 17 00:00:00 2001
From: Erik Boasson <eb@ilities.com>
Date: Mon, 11 May 2020 14:20:36 +0200
Subject: [PATCH 226/238] Use C99 flex array member instead of length-1 array

Signed-off-by: Erik Boasson <eb@ilities.com>
---
 .../builtin_plugins/cryptographic/src/crypto_transform.c    | 6 +++---
 .../src/encode_datareader_submessage_utests.c               | 2 +-
 .../src/encode_datawriter_submessage_utests.c               | 2 +-
 3 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/src/security/builtin_plugins/cryptographic/src/crypto_transform.c b/src/security/builtin_plugins/cryptographic/src/crypto_transform.c
index a2f6893..1fd32b9 100644
--- a/src/security/builtin_plugins/cryptographic/src/crypto_transform.c
+++ b/src/security/builtin_plugins/cryptographic/src/crypto_transform.c
@@ -59,7 +59,7 @@ struct crypto_header
 struct crypto_contents
 {
   uint32_t _length;
-  unsigned char _data[1];
+  unsigned char _data[];
 };
 
 struct crypto_contents_ref
@@ -71,7 +71,7 @@ struct crypto_contents_ref
 struct receiver_specific_mac_seq
 {
   uint32_t _length;
-  struct receiver_specific_mac _buffer[1];
+  struct receiver_specific_mac _buffer[];
 };
 
 struct crypto_footer
@@ -83,7 +83,7 @@ struct crypto_footer
 struct encrypted_data
 {
   uint32_t length;
-  unsigned char data[1];
+  unsigned char data[];
 };
 
 /*
diff --git a/src/security/builtin_plugins/tests/encode_datareader_submessage/src/encode_datareader_submessage_utests.c b/src/security/builtin_plugins/tests/encode_datareader_submessage/src/encode_datareader_submessage_utests.c
index 30bacaa..2962aca 100644
--- a/src/security/builtin_plugins/tests/encode_datareader_submessage/src/encode_datareader_submessage_utests.c
+++ b/src/security/builtin_plugins/tests/encode_datareader_submessage/src/encode_datareader_submessage_utests.c
@@ -77,7 +77,7 @@ struct receiver_specific_mac
 struct encrypted_data
 {
   uint32_t length;
-  unsigned char data[1];
+  unsigned char data[];
 };
 
 struct seq_number
diff --git a/src/security/builtin_plugins/tests/encode_datawriter_submessage/src/encode_datawriter_submessage_utests.c b/src/security/builtin_plugins/tests/encode_datawriter_submessage/src/encode_datawriter_submessage_utests.c
index a186641..30a4ce4 100644
--- a/src/security/builtin_plugins/tests/encode_datawriter_submessage/src/encode_datawriter_submessage_utests.c
+++ b/src/security/builtin_plugins/tests/encode_datawriter_submessage/src/encode_datawriter_submessage_utests.c
@@ -83,7 +83,7 @@ struct receiver_specific_mac
 struct encrypted_data
 {
   uint32_t length;
-  unsigned char data[1];
+  unsigned char data[];
 };
 
 static void reset_exception(DDS_Security_SecurityException *ex)

From fe81a6bda50cd84cb6537524c8f07884f122fafd Mon Sep 17 00:00:00 2001
From: Erik Boasson <eb@ilities.com>
Date: Tue, 12 May 2020 09:07:08 +0200
Subject: [PATCH 227/238] Make wait_for_acks implementation capable of waiting
 for one reader

The dds_wait_for_acks function follows the DCPS specification and allows
waiting for all matching readers to have acknowledged all data written
prior to that point.  This commit leaves the API unchanged but extends
the implementation to make it possible to wait until a specific reader
has acknowledged everything, as this is a useful device in testing with
deliberate one-way disconnections using dds_domain_set_deafmute.

Signed-off-by: Erik Boasson <eb@ilities.com>
---
 src/core/ddsc/src/dds__writer.h           |  2 +-
 src/core/ddsc/src/dds_publisher.c         |  2 +-
 src/core/ddsc/src/dds_writer.c            |  4 ++--
 src/core/ddsi/include/dds/ddsi/q_entity.h |  2 +-
 src/core/ddsi/src/q_entity.c              | 24 ++++++++++++++++++-----
 5 files changed, 24 insertions(+), 10 deletions(-)

diff --git a/src/core/ddsc/src/dds__writer.h b/src/core/ddsc/src/dds__writer.h
index 69ff7e1..111e93d 100644
--- a/src/core/ddsc/src/dds__writer.h
+++ b/src/core/ddsc/src/dds__writer.h
@@ -23,7 +23,7 @@ DEFINE_ENTITY_LOCK_UNLOCK(inline, dds_writer, DDS_KIND_WRITER)
 struct status_cb_data;
 
 void dds_writer_status_cb (void *entity, const struct status_cb_data * data);
-dds_return_t dds__writer_wait_for_acks (struct dds_writer *wr, dds_time_t abstimeout);
+DDS_EXPORT dds_return_t dds__writer_wait_for_acks (struct dds_writer *wr, ddsi_guid_t *rdguid, dds_time_t abstimeout);
 
 #if defined (__cplusplus)
 }
diff --git a/src/core/ddsc/src/dds_publisher.c b/src/core/ddsc/src/dds_publisher.c
index 00ea520..ca17999 100644
--- a/src/core/ddsc/src/dds_publisher.c
+++ b/src/core/ddsc/src/dds_publisher.c
@@ -114,7 +114,7 @@ dds_return_t dds_wait_for_acks (dds_entity_t publisher_or_writer, dds_duration_t
       return DDS_RETCODE_UNSUPPORTED;
 
     case DDS_KIND_WRITER:
-      ret = dds__writer_wait_for_acks ((struct dds_writer *) p_or_w_ent, abstimeout);
+      ret = dds__writer_wait_for_acks ((struct dds_writer *) p_or_w_ent, NULL, abstimeout);
       dds_entity_unpin (p_or_w_ent);
       return ret;
 
diff --git a/src/core/ddsc/src/dds_writer.c b/src/core/ddsc/src/dds_writer.c
index bebebcc..cad0492 100644
--- a/src/core/ddsc/src/dds_writer.c
+++ b/src/core/ddsc/src/dds_writer.c
@@ -410,14 +410,14 @@ dds_entity_t dds_get_publisher (dds_entity_t writer)
   }
 }
 
-dds_return_t dds__writer_wait_for_acks (struct dds_writer *wr, dds_time_t abstimeout)
+dds_return_t dds__writer_wait_for_acks (struct dds_writer *wr, ddsi_guid_t *rdguid, dds_time_t abstimeout)
 {
   /* during lifetime of the writer m_wr is constant, it is only during deletion that it
      gets erased at some point */
   if (wr->m_wr == NULL)
     return DDS_RETCODE_OK;
   else
-    return writer_wait_for_acks (wr->m_wr, abstimeout);
+    return writer_wait_for_acks (wr->m_wr, rdguid, abstimeout);
 }
 
 DDS_GET_STATUS(writer, publication_matched, PUBLICATION_MATCHED, total_count_change, current_count_change)
diff --git a/src/core/ddsi/include/dds/ddsi/q_entity.h b/src/core/ddsi/include/dds/ddsi/q_entity.h
index 14f59f8..289ab84 100644
--- a/src/core/ddsi/include/dds/ddsi/q_entity.h
+++ b/src/core/ddsi/include/dds/ddsi/q_entity.h
@@ -655,7 +655,7 @@ seqno_t writer_max_drop_seq (const struct writer *wr);
 int writer_must_have_hb_scheduled (const struct writer *wr, const struct whc_state *whcst);
 void writer_set_retransmitting (struct writer *wr);
 void writer_clear_retransmitting (struct writer *wr);
-dds_return_t writer_wait_for_acks (struct writer *wr, dds_time_t abstimeout);
+dds_return_t writer_wait_for_acks (struct writer *wr, const ddsi_guid_t *rdguid, dds_time_t abstimeout);
 
 dds_return_t unblock_throttled_writer (struct ddsi_domaingv *gv, const struct ddsi_guid *guid);
 dds_return_t delete_writer (struct ddsi_domaingv *gv, const struct ddsi_guid *guid);
diff --git a/src/core/ddsi/src/q_entity.c b/src/core/ddsi/src/q_entity.c
index 4fb30cd..9a8b5ef 100644
--- a/src/core/ddsi/src/q_entity.c
+++ b/src/core/ddsi/src/q_entity.c
@@ -3969,16 +3969,30 @@ dds_return_t unblock_throttled_writer (struct ddsi_domaingv *gv, const struct dd
   return 0;
 }
 
-dds_return_t writer_wait_for_acks (struct writer *wr, dds_time_t abstimeout)
+dds_return_t writer_wait_for_acks (struct writer *wr, const ddsi_guid_t *rdguid, dds_time_t abstimeout)
 {
   dds_return_t rc;
   seqno_t ref_seq;
   ddsrt_mutex_lock (&wr->e.lock);
   ref_seq = wr->seq;
-  while (wr->state == WRST_OPERATIONAL && ref_seq > writer_max_drop_seq (wr))
-    if (!ddsrt_cond_waituntil (&wr->throttle_cond, &wr->e.lock, abstimeout))
-      break;
-  rc = (ref_seq <= writer_max_drop_seq (wr)) ? DDS_RETCODE_OK : DDS_RETCODE_TIMEOUT;
+  if (rdguid == NULL)
+  {
+    while (wr->state == WRST_OPERATIONAL && ref_seq > writer_max_drop_seq (wr))
+      if (!ddsrt_cond_waituntil (&wr->throttle_cond, &wr->e.lock, abstimeout))
+        break;
+    rc = (ref_seq <= writer_max_drop_seq (wr)) ? DDS_RETCODE_OK : DDS_RETCODE_TIMEOUT;
+  }
+  else
+  {
+    struct wr_prd_match *m = ddsrt_avl_lookup (&wr_readers_treedef, &wr->readers, rdguid);
+    while (wr->state == WRST_OPERATIONAL && m && ref_seq > m->seq)
+    {
+      if (!ddsrt_cond_waituntil (&wr->throttle_cond, &wr->e.lock, abstimeout))
+        break;
+      m = ddsrt_avl_lookup (&wr_readers_treedef, &wr->readers, rdguid);
+    }
+    rc = (m == NULL || ref_seq <= m->seq) ? DDS_RETCODE_OK : DDS_RETCODE_TIMEOUT;
+  }
   ddsrt_mutex_unlock (&wr->e.lock);
   return rc;
 }

From 1b448dee9bf9c133e9c47a56db175faf69ddc26f Mon Sep 17 00:00:00 2001
From: Erik Boasson <eb@ilities.com>
Date: Tue, 12 May 2020 09:22:56 +0200
Subject: [PATCH 228/238] Add wait-for-acknowledgement to oneliner tests

Signed-off-by: Erik Boasson <eb@ilities.com>
---
 src/core/ddsc/tests/listener.c           |  29 ++++-
 src/core/ddsc/tests/test_oneliner.c      | 136 +++++++++++++++++------
 src/core/ddsi/include/dds/ddsi/q_bswap.h |   4 +-
 3 files changed, 124 insertions(+), 45 deletions(-)

diff --git a/src/core/ddsc/tests/listener.c b/src/core/ddsc/tests/listener.c
index 378f0b3..1bc7005 100644
--- a/src/core/ddsc/tests/listener.c
+++ b/src/core/ddsc/tests/listener.c
@@ -286,16 +286,33 @@ CU_Test (ddsc_listener, matched)
   dotest ("sm r pm w' ?pm w' ?sm r");
 
   // Disconnect + reconnect; "deaf P" means the disconnect is asymmetrical: P no longer observes P'
-  // but P' still observes P.  If r did not ACK the data before losing connectivity, w' will hold
+  // but P' still observes P.  If r did not ack the data before losing connectivity, w' will hold
   // the data and it will be re-delivered after reconnecting, depending on QoS settings (the "..."
   // allows for extra samples) and whether the instance was taken or not
   //
-  // the uncertainty also means we don't really know how many "data available" events there will be
-  // and the "sleep 0.3" simply gives it a bit more time after the first event
+  // If r did ack the data, w will drop it and it can't be delivered.  If there is another r'' that
+  // did not ack, r will still not get the data because the writer determines that it was ack'd
+  // already and it won't retransmit.
+  // FIXME: this differs from what the spec says should happen, maybe it should be changed?
+  // (It is a fall-out from changes to make sure a volatile reader doesn't get historical data, but
+  // it could be handled differently.)
+  //
+  // Waiting for an acknowledgement therefore makes sense (and in the other runs, a 0.3s sleep
+  // kind-a solves the problem of not known exactly how many events there will be: it means at
+  // least one event has been observed, and behaviour of Cyclone in a simple case like this means
+  // the full retransmit request will be replied to with a single packet, and that therefore the
+  // likelihood of the retransmitted data arriving within a window of 0.3s is very high.  (Where
+  // 0.3s is an attempt to pick a duration on the long side of what's needed and short enough not
+  // to delay things much.)
+  dotest ("sm da r pm w' ?sm r ?pm w' ;" // matched reader/writer pair
+          " wr w' 1   ; ?da r take{(1,0,0)} r ?ack w' ;" // wait-for-acks => writer drops data
+          " deaf P    ; ?sm(1,0,0,-1,w') r ?da r take{d1} r ; wr w' 2 ;" // write lost on "wire"
+          " hearing P ; ?sm(2,1,1,1,w') r  ?da r sleep 0.3 take{(2,0,0)} r ; ?!pm");
   dotest ("sm da r pm w' ; ?sm r ?pm w' ;"
-          " wr w' 1 ; ?da r take{(1,0,0)} r sleep 1;"
-          " deaf P ; ?sm(1,0,0,-1,w') r ?da r take{d1} r ; wr w' 2 ;"
-          " hearing P ; ?sm(2,1,1,1,w') r ?da r sleep 0.3 take{(2,0,0),...} r ; ?!pm");
+          " r'' ?pm w' deaf P'' ;" // with second reader: reader is deaf so won't ACK
+          " wr w' 1   ; ?da r take{(1,0,0)} r ?ack(r) w' ;" // wait for ack from r' (not r'')
+          " deaf P    ; ?sm(1,0,0,-1,w') r ?da r take{d1} r ; wr w' 2 ;" // write lost on "wire"
+          " hearing P ; ?sm(2,1,1,1,w') r  ?da r sleep 0.3 take{(2,0,0)} r ; ?!pm");
   // same without taking the "dispose" after disconnect
   // sample 1 will be delivered anew
   dotest ("sm da r pm w' ; ?sm r ?pm w' ; wr w' 1 ; ?da r take{(1,0,0)} r ;"
diff --git a/src/core/ddsc/tests/test_oneliner.c b/src/core/ddsc/tests/test_oneliner.c
index 255400a..2b635bd 100644
--- a/src/core/ddsc/tests/test_oneliner.c
+++ b/src/core/ddsc/tests/test_oneliner.c
@@ -25,6 +25,8 @@
 
 #include "dds__types.h"
 #include "dds__entity.h"
+#include "dds__writer.h"
+#include "dds/ddsi/q_bswap.h"
 #include "dds/ddsi/q_lease.h"
 #include "dds/ddsi/q_xevent.h"
 #include "dds/ddsi/ddsi_entity_index.h"
@@ -1502,46 +1504,106 @@ static void checklistener (struct oneliner_ctx *ctx, int ll, int ent, struct one
     testfail (ctx, "listener %s: status mask not cleared", lldesc[ll].name);
 }
 
-static void dochecklistener (struct oneliner_ctx *ctx)
+static void dowaitforack (struct oneliner_ctx *ctx)
 {
-  const bool expectclear = nexttok_if (&ctx->l, '!');
-  const int ll = parse_listener (ctx);
-  if (ll < 0)
-    error (ctx, "check listener: requires listener name");
-  else if (expectclear)
+  dds_return_t ret;
+  int ent, ent1 = -1;
+  union { dds_guid_t x; ddsi_guid_t i; } rdguid;
+  if (*ctx->l.inp == '(') // reader present
   {
-    printf ("listener %s: check not called", lldesc[ll].name);
-    fflush (stdout);
-    ddsrt_mutex_lock (&ctx->g_mutex);
-    bool ret = true;
-    for (int i = 0; i < (int) (sizeof (ctx->doms) / sizeof (ctx->doms[0])); i++)
-    {
-      printf (" cb_called %"PRIu32" %s\n", ctx->cb[i].cb_called[lldesc[ll].id], ctx->cb[i].cb_called[lldesc[ll].id] == 0 ? "ok" : "fail");
-      if (ctx->cb[i].cb_called[lldesc[ll].id] != 0)
-        ret = false;
-    }
-    ddsrt_mutex_unlock (&ctx->g_mutex);
-    if (!ret)
-      testfail (ctx, "callback %s invoked unexpectedly", lldesc[ll].name);
+    nexttok (&ctx->l, NULL);
+    if ((ent1 = parse_entity (ctx)) < 0)
+      error (ctx, "wait for ack: expecting entity");
+    if ((ent1 % 9) < 3 || (ent1 % 9) > 5 || ctx->es[ent1] == 0)
+      error (ctx, "wait for ack: expecting existing reader as argument");
+    if ((ret = dds_get_guid (ctx->es[ent1], &rdguid.x)) != 0)
+      error_dds (ctx, ret, "wait for ack: failed to get GUID for reader %"PRId32, ctx->es[ent1]);
+    rdguid.i = nn_ntoh_guid (rdguid.i);
+    if (!nexttok_if (&ctx->l, ')'))
+      error (ctx, "wait for ack: expecting ')'");
+  }
+  if ((ent = parse_entity (ctx)) < 0)
+    error (ctx, "wait for ack: expecting writer");
+  if (ent1 >= 0 && ent / 9 == ent1 / 9)
+    error (ctx, "wait for ack: reader and writer must be in different domains");
+  if (ctx->es[ent] == 0)
+    make_entity (ctx, ent, NULL);
+  printf ("wait for ack %"PRId32" reader %"PRId32"\n", ctx->es[ent], ent1 < 0 ? 0 : ctx->es[ent1]);
+
+  // without a reader argument a simple dds_wait_for_acks (ctx->es[ent], DDS_SECS (5)) suffices
+  struct dds_entity *x;
+  if ((ret = dds_entity_pin (ctx->es[ent], &x)) < 0)
+    error_dds (ctx, ret, "wait for ack: pin entity failed %"PRId32, ctx->es[ent]);
+  if (dds_entity_kind (x) != DDS_KIND_WRITER)
+    error_dds (ctx, ret, "wait for ack: %"PRId32" is not a writer", ctx->es[ent]);
+  else
+    ret = dds__writer_wait_for_acks ((struct dds_writer *) x, (ent1 < 0) ? NULL : &rdguid.i, dds_time () + DDS_SECS (5));
+  dds_entity_unpin (x);
+  if (ret != 0)
+  {
+    if (ret == DDS_RETCODE_TIMEOUT)
+      testfail (ctx, "wait for acks timed out on entity %"PRId32, ctx->es[ent]);
+    else
+      error_dds (ctx, ret, "wait for acks failed on entity %"PRId32, ctx->es[ent]);
+  }
+}
+
+static void dowaitfornolistener (struct oneliner_ctx *ctx, int ll)
+{
+  printf ("listener %s: check not called", lldesc[ll].name);
+  fflush (stdout);
+  ddsrt_mutex_lock (&ctx->g_mutex);
+  bool ret = true;
+  for (int i = 0; i < (int) (sizeof (ctx->doms) / sizeof (ctx->doms[0])); i++)
+  {
+    printf (" %"PRIu32, ctx->cb[i].cb_called[lldesc[ll].id]);
+    if (ctx->cb[i].cb_called[lldesc[ll].id] != 0)
+      ret = false;
+  }
+  printf (" (%s)\n", ret ? "ok" : "fail");
+  ddsrt_mutex_unlock (&ctx->g_mutex);
+  if (!ret)
+    testfail (ctx, "callback %s invoked unexpectedly", lldesc[ll].name);
+}
+
+static void dowaitforlistener (struct oneliner_ctx *ctx, int ll)
+{
+  struct oneliner_lex l1 = ctx->l;
+  // no whitespace between name and args
+  const bool have_args = (*ctx->l.inp == '(');
+  if (have_args)
+  {
+    // skip args: we need the entity before we can interpret them
+    int tok;
+    while ((tok = nexttok (&ctx->l, NULL)) != EOF && tok != ')')
+      ;
+  }
+  const int ent = parse_entity (ctx);
+  if (ent < 0)
+    error (ctx, "check listener: requires an entity");
+  if (ctx->es[ent] == 0)
+    setlistener (ctx, NULL, ll, ent);
+  checklistener (ctx, ll, ent, have_args ? &l1 : NULL);
+}
+
+static void dowait (struct oneliner_ctx *ctx)
+{
+  union oneliner_tokval tokval;
+  if (peektok (&ctx->l, &tokval) == TOK_NAME && strcmp (tokval.n, "ack") == 0)
+  {
+    nexttok (&ctx->l, NULL);
+    dowaitforack (ctx);
   }
   else
   {
-    struct oneliner_lex l1 = ctx->l;
-    // no whitespace between name and args
-    const bool have_args = (*ctx->l.inp == '(');
-    if (have_args)
-    {
-      // skip args: we need the entity before we can interpret them
-      int tok;
-      while ((tok = nexttok (&ctx->l, NULL)) != EOF && tok != ')')
-        ;
-    }
-    const int ent = parse_entity (ctx);
-    if (ent < 0)
-      error (ctx, "check listener: requires an entity");
-    if (ctx->es[ent] == 0)
-      setlistener (ctx, NULL, ll, ent);
-    checklistener (ctx, ll, ent, have_args ? &l1 : NULL);
+    const bool expectclear = nexttok_if (&ctx->l, '!');
+    const int ll = parse_listener (ctx);
+    if (ll < 0)
+      error (ctx, "check listener: requires listener name");
+    if (expectclear)
+      dowaitfornolistener (ctx, ll);
+    else
+      dowaitforlistener (ctx, ll);
   }
 }
 
@@ -1628,7 +1690,7 @@ static void dispatchcmd (struct oneliner_ctx *ctx)
     void (*fn) (struct oneliner_ctx *ct);
   } cs[] = {
     { "-",          dodelete },
-    { "?",          dochecklistener },
+    { "?",          dowait },
     { "wr",         dowr },
     { "wrdisp",     dowrdisp },
     { "disp",       dodisp },
@@ -1744,7 +1806,7 @@ int test_oneliner_fini (struct oneliner_ctx *ctx)
       setresult (ctx, ret, "terminate: reset listener failed on %"PRId32, ctx->es[i]);
   if (ctx->result == 0)
   {
-    printf ("\n");
+    printf ("\n-- dumping content of readers after failure --\n");
     for (int i = 0; i < (int) (sizeof (ctx->doms) / sizeof (ctx->doms[0])); i++)
     {
       for (int j = 3; j <= 5; j++)
diff --git a/src/core/ddsi/include/dds/ddsi/q_bswap.h b/src/core/ddsi/include/dds/ddsi/q_bswap.h
index 93a3706..2a2dded 100644
--- a/src/core/ddsi/include/dds/ddsi/q_bswap.h
+++ b/src/core/ddsi/include/dds/ddsi/q_bswap.h
@@ -33,8 +33,8 @@ ddsi_guid_prefix_t nn_hton_guid_prefix (ddsi_guid_prefix_t p);
 ddsi_guid_prefix_t nn_ntoh_guid_prefix (ddsi_guid_prefix_t p);
 ddsi_entityid_t nn_hton_entityid (ddsi_entityid_t e);
 ddsi_entityid_t nn_ntoh_entityid (ddsi_entityid_t e);
-ddsi_guid_t nn_hton_guid (ddsi_guid_t g);
-ddsi_guid_t nn_ntoh_guid (ddsi_guid_t g);
+DDS_EXPORT ddsi_guid_t nn_hton_guid (ddsi_guid_t g);
+DDS_EXPORT ddsi_guid_t nn_ntoh_guid (ddsi_guid_t g);
 
 void bswap_sequence_number_set_hdr (nn_sequence_number_set_header_t *snset);
 void bswap_sequence_number_set_bitmap (nn_sequence_number_set_header_t *snset, uint32_t *bits);

From 2ef17d02008155a11392fedf65cd7c6d46594ae4 Mon Sep 17 00:00:00 2001
From: Erik Boasson <eb@ilities.com>
Date: Fri, 15 May 2020 15:00:12 +0200
Subject: [PATCH 229/238] Ignore backward jumps in computing serializer size

When defining a new topic, typically the serializer instructions that
are usually in constant memory and generated by the IDL compiler are
copied into memory managed by the Cyclone implementation.  For this it
needs to compute the size of the serializer, which the IDL compiler
doesn't provide.  It does this by effectively dry-running the
program.  (Note that it doesn't validate the program.)

All but the JSR operations move the program counter forward, but the JSR
operation can cause it to go backward instead and allows implementing
recursive types (the IDL compiler doesn't support them, but one might
decide to work around that limitation).  When dry-running the program,
following a backwards jump can cause a non-terminating loop.

The jump could potentially be to an unexplored address and so ignoring
all backwards jumps potentially means it skips part of the program.  As
this is not a validator and the program can always be arranged so that a
following a backwards jump is not relevant to computing the size
correctly, this is reasonable approximation.

Signed-off-by: Erik Boasson <eb@ilities.com>
---
 src/core/ddsi/src/ddsi_cdrstream.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/src/core/ddsi/src/ddsi_cdrstream.c b/src/core/ddsi/src/ddsi_cdrstream.c
index 6cdfb80..9556766 100644
--- a/src/core/ddsi/src/ddsi_cdrstream.c
+++ b/src/core/ddsi/src/ddsi_cdrstream.c
@@ -364,7 +364,8 @@ static void dds_stream_countops1 (const uint32_t * __restrict ops, const uint32_
         break;
       }
       case DDS_OP_JSR: {
-        dds_stream_countops1 (ops + DDS_OP_JUMP (insn), ops_end);
+        if (DDS_OP_JUMP (insn) > 0)
+          dds_stream_countops1 (ops + DDS_OP_JUMP (insn), ops_end);
         ops++;
         break;
       }

From be7f7af7416668492bf1cebc2db8f82266737ba7 Mon Sep 17 00:00:00 2001
From: Erik Boasson <eb@ilities.com>
Date: Sat, 16 May 2020 08:38:58 +0200
Subject: [PATCH 230/238] Tweak timeout handling of authentication tests

* Compute the time at which the handshake must have completed from the
  initial timeout specification, rather than using it as a timeout for
  the individual steps of the handshake
* If the handshake fails because an expected message is not present,
  print this, including whether the timeout occured because the message
  queue was empty or because the expected message could not be found in
  a non-empty queue.
* Replace the 0.5s per-step timeout to a single 2s timeout.

Signed-off-by: Erik Boasson <eb@ilities.com>
---
 src/security/core/tests/access_control.c      |   6 +-
 .../tests/common/authentication_wrapper.c     |   4 +-
 .../tests/common/authentication_wrapper.h     |   2 +-
 .../core/tests/common/plugin_wrapper_msg_q.c  |  27 ++--
 .../core/tests/common/plugin_wrapper_msg_q.h  |   8 +-
 src/security/core/tests/common/test_utils.c   | 130 +++++++++++++-----
 6 files changed, 122 insertions(+), 55 deletions(-)

diff --git a/src/security/core/tests/access_control.c b/src/security/core/tests/access_control.c
index 261fbdf..f22dbe5 100644
--- a/src/security/core/tests/access_control.c
+++ b/src/security/core/tests/access_control.c
@@ -700,7 +700,7 @@ static void test_encoding_mismatch(
 
   struct Handshake *hs_list;
   int nhs;
-  validate_handshake (DDS_DOMAINID, false, NULL, &hs_list, &nhs, DDS_MSECS(500));
+  validate_handshake (DDS_DOMAINID, false, NULL, &hs_list, &nhs, DDS_SECS(2));
   CU_ASSERT_EQUAL_FATAL (exp_hs_fail, nhs < 1);
   handshake_list_fini (hs_list, nhs);
 
@@ -799,7 +799,7 @@ static void test_readwrite_protection (
   if (!exp_pub_pp_fail && !exp_sub_pp_fail)
   {
     dds_entity_t pub, sub, pub_tp, sub_tp, wr, rd;
-    validate_handshake_nofail (DDS_DOMAINID, DDS_MSECS(500));
+    validate_handshake_nofail (DDS_DOMAINID, DDS_SECS(2));
     rd_wr_init_fail (g_participant[0], &pub, &pub_tp, &wr, g_participant[1], &sub, &sub_tp, &rd, topic_name, exp_pub_tp_fail, exp_wr_fail, exp_sub_tp_fail, exp_rd_fail);
     if (!exp_pub_tp_fail && !exp_wr_fail && !exp_sub_tp_fail && !exp_rd_fail)
       sync_writer_to_readers (g_participant[0], wr, exp_sync_fail ? 0 : 1, DDS_SECS(1));
@@ -893,4 +893,4 @@ CU_Test(ddssec_access_control, denied_topic)
 
   dds_delete_qos (qos);
   access_control_fini (2, (void * []) { gov_config, gov_topic_rule, sub_rules_xml, grants_pub[0], grants_sub[0], perm_config_pub, perm_config_sub, ca, id1_subj, id2_subj, id1, id2 }, 12);
-}
\ No newline at end of file
+}
diff --git a/src/security/core/tests/common/authentication_wrapper.c b/src/security/core/tests/common/authentication_wrapper.c
index 86290df..693ac11 100644
--- a/src/security/core/tests/common/authentication_wrapper.c
+++ b/src/security/core/tests/common/authentication_wrapper.c
@@ -446,11 +446,11 @@ static struct dds_security_authentication_impl * get_impl_for_domain(dds_domaini
   return NULL;
 }
 
-struct message * test_authentication_plugin_take_msg(dds_domainid_t domain_id, message_kind_t kind, DDS_Security_IdentityHandle lidHandle, DDS_Security_IdentityHandle ridHandle, DDS_Security_IdentityHandle hsHandle, dds_duration_t timeout)
+enum take_message_result test_authentication_plugin_take_msg(dds_domainid_t domain_id, message_kind_t kind, DDS_Security_IdentityHandle lidHandle, DDS_Security_IdentityHandle ridHandle, DDS_Security_IdentityHandle hsHandle, dds_time_t abstimeout, struct message **msg)
 {
   struct dds_security_authentication_impl *impl = get_impl_for_domain(domain_id);
   assert(impl);
-  return take_message(&impl->msg_queue, kind, lidHandle, ridHandle, hsHandle, timeout);
+  return take_message(&impl->msg_queue, kind, lidHandle, ridHandle, hsHandle, abstimeout, msg);
 }
 
 void test_authentication_plugin_release_msg(struct message *msg)
diff --git a/src/security/core/tests/common/authentication_wrapper.h b/src/security/core/tests/common/authentication_wrapper.h
index f58121d..939db10 100644
--- a/src/security/core/tests/common/authentication_wrapper.h
+++ b/src/security/core/tests/common/authentication_wrapper.h
@@ -33,7 +33,7 @@ SECURITY_EXPORT int finalize_test_authentication_missing_func(void *context);
 SECURITY_EXPORT int init_test_authentication_init_error(const char *argument, void **context, struct ddsi_domaingv *gv);
 SECURITY_EXPORT int finalize_test_authentication_init_error(void *context);
 
-SECURITY_EXPORT struct message * test_authentication_plugin_take_msg(dds_domainid_t domain_id, message_kind_t kind, DDS_Security_IdentityHandle lidHandle, DDS_Security_IdentityHandle ridHandle, DDS_Security_IdentityHandle hsHandle, dds_duration_t timeout);
+SECURITY_EXPORT enum take_message_result test_authentication_plugin_take_msg(dds_domainid_t domain_id, message_kind_t kind, DDS_Security_IdentityHandle lidHandle, DDS_Security_IdentityHandle ridHandle, DDS_Security_IdentityHandle hsHandle, dds_time_t abstimeout, struct message **msg);
 SECURITY_EXPORT void test_authentication_plugin_release_msg(struct message *msg);
 
 #endif /* SECURITY_CORE_TEST_AUTHENTICATION_WRAPPER_H_ */
diff --git a/src/security/core/tests/common/plugin_wrapper_msg_q.c b/src/security/core/tests/common/plugin_wrapper_msg_q.c
index 3ecad82..0b03ded 100644
--- a/src/security/core/tests/common/plugin_wrapper_msg_q.c
+++ b/src/security/core/tests/common/plugin_wrapper_msg_q.c
@@ -95,25 +95,26 @@ int message_matched(struct message *msg, message_kind_t kind, DDS_Security_Ident
     (!hsHandle || msg->hsHandle == hsHandle);
 }
 
-struct message * take_message(struct message_queue *queue, message_kind_t kind, DDS_Security_IdentityHandle lidHandle, DDS_Security_IdentityHandle ridHandle, DDS_Security_IdentityHandle hsHandle, dds_duration_t timeout)
+enum take_message_result take_message(struct message_queue *queue, message_kind_t kind, DDS_Security_IdentityHandle lidHandle, DDS_Security_IdentityHandle ridHandle, DDS_Security_IdentityHandle hsHandle, dds_time_t abstimeout, struct message **msg)
 {
-  struct message *msg = NULL, *cur, *prev;
-  int r = 1;
+  struct message *cur, *prev;
+  enum take_message_result ret = TAKE_MESSAGE_OK;
+  *msg = NULL;
   ddsrt_mutex_lock(&queue->lock);
   do
   {
     cur = queue->head;
     prev = NULL;
-    while (cur && !msg)
+    while (cur && *msg == NULL)
     {
       if (message_matched(cur, kind, lidHandle, ridHandle, hsHandle))
       {
-        msg = cur;
+        *msg = cur;
         if (prev)
-          prev->next = msg->next;
+          prev->next = cur->next;
         else
-          queue->head = msg->next;
-        if (queue->tail == msg)
+          queue->head = cur->next;
+        if (queue->tail == cur)
           queue->tail = prev;
       }
       else
@@ -122,13 +123,13 @@ struct message * take_message(struct message_queue *queue, message_kind_t kind,
         cur = cur->next;
       }
     }
-    if (!msg)
+    if (*msg == NULL)
     {
-      if (!ddsrt_cond_waitfor(&queue->cond, &queue->lock, timeout))
-        r = 0;
+      if (!ddsrt_cond_waituntil(&queue->cond, &queue->lock, abstimeout))
+        ret = queue->head ? TAKE_MESSAGE_TIMEOUT_NONEMPTY : TAKE_MESSAGE_TIMEOUT_EMPTY;
     }
-  } while (r && !msg);
+  } while (ret == TAKE_MESSAGE_OK && *msg == NULL);
 
   ddsrt_mutex_unlock(&queue->lock);
-  return msg;
+  return ret;
 }
diff --git a/src/security/core/tests/common/plugin_wrapper_msg_q.h b/src/security/core/tests/common/plugin_wrapper_msg_q.h
index 32ec557..c70e5f2 100644
--- a/src/security/core/tests/common/plugin_wrapper_msg_q.h
+++ b/src/security/core/tests/common/plugin_wrapper_msg_q.h
@@ -46,6 +46,12 @@ struct message_queue {
     struct message *tail;
 };
 
+enum take_message_result {
+  TAKE_MESSAGE_OK, /* message found */
+  TAKE_MESSAGE_TIMEOUT_EMPTY, /* no message found, queue is empty */
+  TAKE_MESSAGE_TIMEOUT_NONEMPTY /* no message found, queue is not empty */
+};
+
 struct dds_security_authentication_impl;
 
 void insert_message(struct message_queue *queue, struct message *msg);
@@ -56,7 +62,7 @@ void delete_message(struct message *msg);
 void init_message_queue(struct message_queue *queue);
 void deinit_message_queue(struct message_queue *queue);
 int message_matched(struct message *msg, message_kind_t kind, DDS_Security_IdentityHandle lidHandle, DDS_Security_IdentityHandle ridHandle, DDS_Security_IdentityHandle hsHandle);
-struct message * take_message(struct message_queue *queue, message_kind_t kind, DDS_Security_IdentityHandle lidHandle, DDS_Security_IdentityHandle ridHandle, DDS_Security_IdentityHandle hsHandle, dds_duration_t timeout);
+enum take_message_result take_message(struct message_queue *queue, message_kind_t kind, DDS_Security_IdentityHandle lidHandle, DDS_Security_IdentityHandle ridHandle, DDS_Security_IdentityHandle hsHandle, dds_time_t abstimeout, struct message **msg);
 
 
 #endif /* SECURITY_CORE_PLUGIN_WRAPPER_MSG_Q_H_ */
diff --git a/src/security/core/tests/common/test_utils.c b/src/security/core/tests/common/test_utils.c
index e7e7ed4..cab9bef 100644
--- a/src/security/core/tests/common/test_utils.c
+++ b/src/security/core/tests/common/test_utils.c
@@ -149,58 +149,92 @@ static int find_handshake (DDS_Security_HandshakeHandle handle)
   return -1;
 }
 
-static void handle_process_message (dds_domainid_t domain_id, DDS_Security_IdentityHandle handshake, dds_duration_t timeout)
+static void handle_process_message (dds_domainid_t domain_id, DDS_Security_IdentityHandle handshake, dds_time_t abstimeout)
 {
   struct message *msg;
-  if ((msg = test_authentication_plugin_take_msg (domain_id, MESSAGE_KIND_PROCESS_HANDSHAKE, 0, 0, handshake, timeout)))
+  switch (test_authentication_plugin_take_msg (domain_id, MESSAGE_KIND_PROCESS_HANDSHAKE, 0, 0, handshake, abstimeout, &msg))
   {
-    int idx;
-    if ((idx = find_handshake (msg->hsHandle)) >= 0)
-    {
-      print_test_msg ("set handshake %"PRId64" final result to '%s' (errmsg: %s)\n", msg->hsHandle, get_validation_result_str (msg->result), msg->err_msg);
-      handshakeList[idx].finalResult = msg->result;
-      handshakeList[idx].err_msg = ddsrt_strdup (msg->err_msg);
+    case TAKE_MESSAGE_OK: {
+      int idx;
+      if ((idx = find_handshake (msg->hsHandle)) >= 0)
+      {
+        print_test_msg ("set handshake %"PRId64" final result to '%s' (errmsg: %s)\n", msg->hsHandle, get_validation_result_str (msg->result), msg->err_msg);
+        handshakeList[idx].finalResult = msg->result;
+        handshakeList[idx].err_msg = ddsrt_strdup (msg->err_msg);
+      }
+      test_authentication_plugin_release_msg (msg);
+      break;
+    }
+    case TAKE_MESSAGE_TIMEOUT_EMPTY: {
+      print_test_msg ("handle_process_message: timed out on empty queue\n");
+      break;
+    }
+    case TAKE_MESSAGE_TIMEOUT_NONEMPTY: {
+      print_test_msg ("handle_process_message: timed out on non-empty queue\n");
+      break;
     }
-    test_authentication_plugin_release_msg (msg);
   }
 }
 
-static void handle_begin_handshake_request (dds_domainid_t domain_id, struct Handshake *hs, DDS_Security_IdentityHandle lid, DDS_Security_IdentityHandle rid, dds_duration_t timeout)
+static void handle_begin_handshake_request (dds_domainid_t domain_id, struct Handshake *hs, DDS_Security_IdentityHandle lid, DDS_Security_IdentityHandle rid, dds_time_t abstimeout)
 {
   struct message *msg;
   print_test_msg ("handle begin handshake request %"PRId64"<->%"PRId64"\n", lid, rid);
-  if ((msg = test_authentication_plugin_take_msg (domain_id, MESSAGE_KIND_BEGIN_HANDSHAKE_REQUEST, lid, rid, 0, timeout)))
+  switch (test_authentication_plugin_take_msg (domain_id, MESSAGE_KIND_BEGIN_HANDSHAKE_REQUEST, lid, rid, 0, abstimeout, &msg))
   {
-    hs->handle = msg->hsHandle;
-    hs->handshakeResult = msg->result;
-    if (msg->result != DDS_SECURITY_VALIDATION_FAILED)
-      handle_process_message (domain_id, msg->hsHandle, timeout);
-    else
-      hs->err_msg = ddsrt_strdup (msg->err_msg);
-    test_authentication_plugin_release_msg (msg);
+    case TAKE_MESSAGE_OK: {
+      hs->handle = msg->hsHandle;
+      hs->handshakeResult = msg->result;
+      if (msg->result != DDS_SECURITY_VALIDATION_FAILED)
+        handle_process_message (domain_id, msg->hsHandle, abstimeout);
+      else
+        hs->err_msg = ddsrt_strdup (msg->err_msg);
+      test_authentication_plugin_release_msg (msg);
+      break;
+    }
+    case TAKE_MESSAGE_TIMEOUT_EMPTY: {
+      print_test_msg ("handle_begin_handshake_request: timed out on empty queue\n");
+      break;
+    }
+    case TAKE_MESSAGE_TIMEOUT_NONEMPTY: {
+      print_test_msg ("handle_begin_handshake_request: timed out on non-empty queue\n");
+      break;
+    }
   }
 }
 
-static void handle_begin_handshake_reply (dds_domainid_t domain_id, struct Handshake *hs, DDS_Security_IdentityHandle lid, DDS_Security_IdentityHandle rid, dds_duration_t timeout)
+static void handle_begin_handshake_reply (dds_domainid_t domain_id, struct Handshake *hs, DDS_Security_IdentityHandle lid, DDS_Security_IdentityHandle rid, dds_time_t abstimeout)
 {
   struct message *msg;
   print_test_msg ("handle begin handshake reply %"PRId64"<->%"PRId64"\n", lid, rid);
-  if ((msg = test_authentication_plugin_take_msg (domain_id, MESSAGE_KIND_BEGIN_HANDSHAKE_REPLY, lid, rid, 0, timeout)))
+  switch (test_authentication_plugin_take_msg (domain_id, MESSAGE_KIND_BEGIN_HANDSHAKE_REPLY, lid, rid, 0, abstimeout, &msg))
   {
-    hs->handle = msg->hsHandle;
-    hs->handshakeResult = msg->result;
-    if (msg->result != DDS_SECURITY_VALIDATION_FAILED)
-      handle_process_message (domain_id, msg->hsHandle, timeout);
-    else
-      hs->err_msg = ddsrt_strdup (msg->err_msg);
-    test_authentication_plugin_release_msg (msg);
+    case TAKE_MESSAGE_OK: {
+      hs->handle = msg->hsHandle;
+      hs->handshakeResult = msg->result;
+      if (msg->result != DDS_SECURITY_VALIDATION_FAILED)
+        handle_process_message (domain_id, msg->hsHandle, abstimeout);
+      else
+        hs->err_msg = ddsrt_strdup (msg->err_msg);
+      test_authentication_plugin_release_msg (msg);
+      break;
+    }
+    case TAKE_MESSAGE_TIMEOUT_EMPTY: {
+      print_test_msg ("handle_begin_handshake_reply: timed out on empty queue\n");
+      break;
+    }
+    case TAKE_MESSAGE_TIMEOUT_NONEMPTY: {
+      print_test_msg ("handle_begin_handshake_reply: timed out on non-empty queue\n");
+      break;
+    }
   }
 }
 
-static void handle_validate_remote_identity (dds_domainid_t domain_id, DDS_Security_IdentityHandle lid, int count, dds_duration_t timeout)
+static void handle_validate_remote_identity (dds_domainid_t domain_id, DDS_Security_IdentityHandle lid, int count, dds_time_t abstimeout)
 {
+  enum take_message_result res = TAKE_MESSAGE_OK;
   struct message *msg;
-  while (count-- > 0 && (msg = test_authentication_plugin_take_msg (domain_id, MESSAGE_KIND_VALIDATE_REMOTE_IDENTITY, lid, 0, 0, timeout)))
+  while (count-- > 0 && (res = test_authentication_plugin_take_msg (domain_id, MESSAGE_KIND_VALIDATE_REMOTE_IDENTITY, lid, 0, 0, abstimeout, &msg)) == TAKE_MESSAGE_OK)
   {
     struct Handshake *hs;
     add_remote_identity (msg->ridHandle, &msg->rguid);
@@ -208,12 +242,12 @@ static void handle_validate_remote_identity (dds_domainid_t domain_id, DDS_Secur
     if (msg->result == DDS_SECURITY_VALIDATION_PENDING_HANDSHAKE_REQUEST)
     {
       hs->node_type = HSN_REQUESTER;
-      handle_begin_handshake_request (domain_id, hs, lid, msg->ridHandle, timeout);
+      handle_begin_handshake_request (domain_id, hs, lid, msg->ridHandle, abstimeout);
     }
     else if (msg->result == DDS_SECURITY_VALIDATION_PENDING_HANDSHAKE_MESSAGE)
     {
       hs->node_type = HSN_REPLIER;
-      handle_begin_handshake_reply (domain_id, hs, lid, msg->ridHandle, timeout);
+      handle_begin_handshake_reply (domain_id, hs, lid, msg->ridHandle, abstimeout);
     }
     else
     {
@@ -221,11 +255,34 @@ static void handle_validate_remote_identity (dds_domainid_t domain_id, DDS_Secur
     }
     test_authentication_plugin_release_msg (msg);
   }
+
+  switch (res)
+  {
+    case TAKE_MESSAGE_OK:
+      break;
+    case TAKE_MESSAGE_TIMEOUT_EMPTY:
+      print_test_msg ("handle_validate_remote_identity: timed out on empty queue\n");
+      break;
+    case TAKE_MESSAGE_TIMEOUT_NONEMPTY:
+      print_test_msg ("handle_validate_remote_identity: timed out on non-empty queue\n");
+      break;
+  }
 }
 
-static void handle_validate_local_identity (dds_domainid_t domain_id, bool exp_localid_fail, const char * exp_localid_msg, dds_duration_t timeout)
+static void handle_validate_local_identity (dds_domainid_t domain_id, bool exp_localid_fail, const char * exp_localid_msg, dds_time_t abstimeout)
 {
- struct message *msg = test_authentication_plugin_take_msg (domain_id, MESSAGE_KIND_VALIDATE_LOCAL_IDENTITY, 0, 0, 0, timeout);
+  struct message *msg;
+  switch (test_authentication_plugin_take_msg (domain_id, MESSAGE_KIND_VALIDATE_LOCAL_IDENTITY, 0, 0, 0, abstimeout, &msg))
+  {
+    case TAKE_MESSAGE_OK:
+      break;
+    case TAKE_MESSAGE_TIMEOUT_EMPTY:
+      print_test_msg ("handle_validate_local_identity: timed out on empty queue\n");
+      break;
+    case TAKE_MESSAGE_TIMEOUT_NONEMPTY:
+      print_test_msg ("handle_validate_local_identity: timed out on non-empty queue\n");
+      break;
+  }
   CU_ASSERT_FATAL (msg != NULL);
   CU_ASSERT_FATAL ((msg->result == DDS_SECURITY_VALIDATION_OK) != exp_localid_fail);
   if (exp_localid_fail && exp_localid_msg)
@@ -234,12 +291,15 @@ static void handle_validate_local_identity (dds_domainid_t domain_id, bool exp_l
     CU_ASSERT_FATAL (msg->err_msg && strstr (msg->err_msg, exp_localid_msg) != NULL);
   }
   else
+  {
     add_local_identity (msg->lidHandle, &msg->lguid);
+  }
   test_authentication_plugin_release_msg (msg);
 }
 
 void validate_handshake (dds_domainid_t domain_id, bool exp_localid_fail, const char * exp_localid_msg, struct Handshake *hs_list[], int *nhs, dds_duration_t timeout)
 {
+  dds_time_t abstimeout = dds_time() + timeout;
   clear_stores ();
 
   if (nhs)
@@ -247,10 +307,10 @@ void validate_handshake (dds_domainid_t domain_id, bool exp_localid_fail, const
   if (hs_list)
     *hs_list = NULL;
 
-  handle_validate_local_identity (domain_id, exp_localid_fail, exp_localid_msg, timeout);
+  handle_validate_local_identity (domain_id, exp_localid_fail, exp_localid_msg, abstimeout);
   if (!exp_localid_fail)
   {
-    handle_validate_remote_identity (domain_id, localIdentityList[0].handle, 1, timeout);
+    handle_validate_remote_identity (domain_id, localIdentityList[0].handle, 1, abstimeout);
     for (int n = 0; n < numHandshake; n++)
     {
       struct Handshake *hs = &handshakeList[n];

From a292e800acf11d67a13fc7fe26bc747769b2ea60 Mon Sep 17 00:00:00 2001
From: Erik Boasson <eb@ilities.com>
Date: Sat, 16 May 2020 11:12:45 +0200
Subject: [PATCH 231/238] Do not respond to an ignored SPDP message

Signed-off-by: Erik Boasson <eb@ilities.com>
---
 src/core/ddsi/include/dds/ddsi/q_entity.h |  2 +-
 src/core/ddsi/src/q_ddsi_discovery.c      | 67 ++++++++++-------------
 src/core/ddsi/src/q_entity.c              |  5 +-
 3 files changed, 32 insertions(+), 42 deletions(-)

diff --git a/src/core/ddsi/include/dds/ddsi/q_entity.h b/src/core/ddsi/include/dds/ddsi/q_entity.h
index 289ab84..8a4f22f 100644
--- a/src/core/ddsi/include/dds/ddsi/q_entity.h
+++ b/src/core/ddsi/include/dds/ddsi/q_entity.h
@@ -695,7 +695,7 @@ int writer_set_notalive (struct writer *wr, bool notify);
 /* Set when this proxy participant is not to be announced on the built-in topics yet */
 #define CF_PROXYPP_NO_SPDP                     (1 << 2)
 
-void new_proxy_participant (struct ddsi_domaingv *gv, const struct ddsi_guid *guid, uint32_t bes, const struct ddsi_guid *privileged_pp_guid, struct addrset *as_default, struct addrset *as_meta, const struct ddsi_plist *plist, dds_duration_t tlease_dur, nn_vendorid_t vendor, unsigned custom_flags, ddsrt_wctime_t timestamp, seqno_t seq);
+bool new_proxy_participant (struct ddsi_domaingv *gv, const struct ddsi_guid *guid, uint32_t bes, const struct ddsi_guid *privileged_pp_guid, struct addrset *as_default, struct addrset *as_meta, const struct ddsi_plist *plist, dds_duration_t tlease_dur, nn_vendorid_t vendor, unsigned custom_flags, ddsrt_wctime_t timestamp, seqno_t seq);
 DDS_EXPORT int delete_proxy_participant_by_guid (struct ddsi_domaingv *gv, const struct ddsi_guid *guid, ddsrt_wctime_t timestamp, int isimplicit);
 
 int update_proxy_participant_plist_locked (struct proxy_participant *proxypp, seqno_t seq, const struct ddsi_plist *datap, ddsrt_wctime_t timestamp);
diff --git a/src/core/ddsi/src/q_ddsi_discovery.c b/src/core/ddsi/src/q_ddsi_discovery.c
index 1bc06c4..1f031d2 100644
--- a/src/core/ddsi/src/q_ddsi_discovery.c
+++ b/src/core/ddsi/src/q_ddsi_discovery.c
@@ -764,28 +764,17 @@ static int handle_SPDP_alive (const struct receiver_state *rst, seqno_t seq, dds
 
   maybe_add_pp_as_meta_to_as_disc (gv, as_meta);
 
-  new_proxy_participant
-  (
-    gv,
-    &datap->participant_guid,
-    builtin_endpoint_set,
-    &privileged_pp_guid,
-    as_default,
-    as_meta,
-    datap,
-    lease_duration,
-    rst->vendor,
-    custom_flags,
-    timestamp,
-    seq
-  );
-
-  /* Force transmission of SPDP messages - we're not very careful
-     in avoiding the processing of SPDP packets addressed to others
-     so filter here */
+  if (!new_proxy_participant (gv, &datap->participant_guid, builtin_endpoint_set, &privileged_pp_guid, as_default, as_meta, datap, lease_duration, rst->vendor, custom_flags, timestamp, seq))
   {
-    int have_dst =
-      (rst->dst_guid_prefix.u[0] != 0 || rst->dst_guid_prefix.u[1] != 0 || rst->dst_guid_prefix.u[2] != 0);
+    /* If no proxy participant was created, don't respond */
+    return 0;
+  }
+  else
+  {
+    /* Force transmission of SPDP messages - we're not very careful
+       in avoiding the processing of SPDP packets addressed to others
+       so filter here */
+    int have_dst = (rst->dst_guid_prefix.u[0] != 0 || rst->dst_guid_prefix.u[1] != 0 || rst->dst_guid_prefix.u[2] != 0);
     if (!have_dst)
     {
       GVLOGDISC ("broadcasted SPDP packet -> answering");
@@ -795,27 +784,27 @@ static int handle_SPDP_alive (const struct receiver_state *rst, seqno_t seq, dds
     {
       GVLOGDISC ("directed SPDP packet -> not responding\n");
     }
-  }
 
-  if (custom_flags & CF_PARTICIPANT_IS_DDSI2)
-  {
-    /* If we just discovered DDSI2, make sure any existing
-       participants served by it are made dependent on it */
-    make_participants_dependent_on_ddsi2 (gv, &datap->participant_guid, timestamp);
-  }
-  else if (privileged_pp_guid.prefix.u[0] || privileged_pp_guid.prefix.u[1] || privileged_pp_guid.prefix.u[2])
-  {
-    /* If we just created a participant dependent on DDSI2, make sure
-       DDSI2 still exists.  There is a risk of racing the lease expiry
-       of DDSI2. */
-    if (entidx_lookup_proxy_participant_guid (gv->entity_index, &privileged_pp_guid) == NULL)
+    if (custom_flags & CF_PARTICIPANT_IS_DDSI2)
     {
-      GVLOGDISC ("make_participants_dependent_on_ddsi2: ddsi2 "PGUIDFMT" is no more, delete "PGUIDFMT"\n",
-                 PGUID (privileged_pp_guid), PGUID (datap->participant_guid));
-      delete_proxy_participant_by_guid (gv, &datap->participant_guid, timestamp, 1);
+      /* If we just discovered DDSI2, make sure any existing
+         participants served by it are made dependent on it */
+      make_participants_dependent_on_ddsi2 (gv, &datap->participant_guid, timestamp);
     }
+    else if (privileged_pp_guid.prefix.u[0] || privileged_pp_guid.prefix.u[1] || privileged_pp_guid.prefix.u[2])
+    {
+      /* If we just created a participant dependent on DDSI2, make sure
+         DDSI2 still exists.  There is a risk of racing the lease expiry
+         of DDSI2. */
+      if (entidx_lookup_proxy_participant_guid (gv->entity_index, &privileged_pp_guid) == NULL)
+      {
+        GVLOGDISC ("make_participants_dependent_on_ddsi2: ddsi2 "PGUIDFMT" is no more, delete "PGUIDFMT"\n",
+                   PGUID (privileged_pp_guid), PGUID (datap->participant_guid));
+        delete_proxy_participant_by_guid (gv, &datap->participant_guid, timestamp, 1);
+      }
+    }
+    return 1;
   }
-  return 1;
 }
 
 static void handle_SPDP (const struct receiver_state *rst, ddsi_entityid_t pwr_entityid, seqno_t seq, const struct ddsi_serdata *serdata)
@@ -1102,7 +1091,7 @@ static struct proxy_participant *implicitly_create_proxypp (struct ddsi_domaingv
        doing anything about (1).  That means we fall back to the legacy mode of locally generating
        GIDs but leaving the system id unchanged if the remote is OSPL.  */
     actual_vendorid = (datap->present & PP_VENDORID) ?  datap->vendorid : vendorid;
-    new_proxy_participant(gv, ppguid, 0, &privguid, new_addrset(), new_addrset(), &pp_plist, DDS_INFINITY, actual_vendorid, CF_IMPLICITLY_CREATED_PROXYPP, timestamp, seq);
+    (void) new_proxy_participant(gv, ppguid, 0, &privguid, new_addrset(), new_addrset(), &pp_plist, DDS_INFINITY, actual_vendorid, CF_IMPLICITLY_CREATED_PROXYPP, timestamp, seq);
   }
   else if (ppguid->prefix.u[0] == src_guid_prefix->u[0] && vendor_is_eclipse_or_opensplice (vendorid))
   {
diff --git a/src/core/ddsi/src/q_entity.c b/src/core/ddsi/src/q_entity.c
index 9a8b5ef..5ea7def 100644
--- a/src/core/ddsi/src/q_entity.c
+++ b/src/core/ddsi/src/q_entity.c
@@ -4872,7 +4872,7 @@ static void free_proxy_participant(struct proxy_participant *proxypp)
   ddsrt_free (proxypp);
 }
 
-void new_proxy_participant (struct ddsi_domaingv *gv, const struct ddsi_guid *ppguid, uint32_t bes, const struct ddsi_guid *privileged_pp_guid, struct addrset *as_default, struct addrset *as_meta, const ddsi_plist_t *plist, dds_duration_t tlease_dur, nn_vendorid_t vendor, unsigned custom_flags, ddsrt_wctime_t timestamp, seqno_t seq)
+bool new_proxy_participant (struct ddsi_domaingv *gv, const struct ddsi_guid *ppguid, uint32_t bes, const struct ddsi_guid *privileged_pp_guid, struct addrset *as_default, struct addrset *as_meta, const ddsi_plist_t *plist, dds_duration_t tlease_dur, nn_vendorid_t vendor, unsigned custom_flags, ddsrt_wctime_t timestamp, seqno_t seq)
 {
   /* No locking => iff all participants use unique guids, and sedp
      runs on a single thread, it can't go wrong. FIXME, maybe? The
@@ -4978,7 +4978,7 @@ void new_proxy_participant (struct ddsi_domaingv *gv, const struct ddsi_guid *pp
     {
       GVWARNING ("Remote secure participant "PGUIDFMT" not allowed\n", PGUID (*ppguid));
       free_proxy_participant (proxypp);
-      return;
+      return false;
     }
   }
 #endif
@@ -5004,6 +5004,7 @@ void new_proxy_participant (struct ddsi_domaingv *gv, const struct ddsi_guid *pp
     proxy_participant_create_handshakes (gv, proxypp);
   }
 #endif
+  return true;
 }
 
 int update_proxy_participant_plist_locked (struct proxy_participant *proxypp, seqno_t seq, const struct ddsi_plist *datap, ddsrt_wctime_t timestamp)

From 2aa70548cc05a851f8f205861e9f6c04b76c5587 Mon Sep 17 00:00:00 2001
From: Erik Boasson <eb@ilities.com>
Date: Sat, 16 May 2020 11:13:58 +0200
Subject: [PATCH 232/238] Tweak timeouts in secure communication tests

* Increase the matching timeout to 5s (there are some hints the failures
  on Travis are timing related)
* Replace the relative timeout in the waitset by a timestamp so that it
  gives up after the specified timeout regardless of the number of
  events that occur

Signed-off-by: Erik Boasson <eb@ilities.com>
---
 src/security/core/tests/common/test_utils.c    | 6 ++++--
 src/security/core/tests/secure_communication.c | 2 +-
 2 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/src/security/core/tests/common/test_utils.c b/src/security/core/tests/common/test_utils.c
index cab9bef..39c0489 100644
--- a/src/security/core/tests/common/test_utils.c
+++ b/src/security/core/tests/common/test_utils.c
@@ -390,6 +390,7 @@ void handshake_list_fini (struct Handshake *hs_list, int nhs)
 
 void sync_writer_to_readers (dds_entity_t pp_wr, dds_entity_t wr, uint32_t exp_count, dds_duration_t timeout)
 {
+  dds_time_t abstimeout = dds_time() + timeout;
   dds_attach_t triggered;
   dds_entity_t ws = dds_create_waitset (pp_wr);
   CU_ASSERT_FATAL (ws > 0);
@@ -399,7 +400,7 @@ void sync_writer_to_readers (dds_entity_t pp_wr, dds_entity_t wr, uint32_t exp_c
   CU_ASSERT_EQUAL_FATAL (ret, DDS_RETCODE_OK);
   while (true)
   {
-    ret = dds_waitset_wait (ws, &triggered, 1, timeout);
+    ret = dds_waitset_wait_until (ws, &triggered, 1, abstimeout);
     CU_ASSERT_EQUAL_FATAL (exp_count > 0, ret >= 1);
     if (exp_count > 0)
       CU_ASSERT_EQUAL_FATAL (wr, (dds_entity_t)(intptr_t) triggered);
@@ -414,6 +415,7 @@ void sync_writer_to_readers (dds_entity_t pp_wr, dds_entity_t wr, uint32_t exp_c
 
 void sync_reader_to_writers (dds_entity_t pp_rd, dds_entity_t rd, uint32_t exp_count, dds_duration_t timeout)
 {
+  dds_time_t abstimeout = dds_time() + timeout;
   dds_attach_t triggered;
   dds_entity_t ws = dds_create_waitset (pp_rd);
   CU_ASSERT_FATAL (ws > 0);
@@ -423,7 +425,7 @@ void sync_reader_to_writers (dds_entity_t pp_rd, dds_entity_t rd, uint32_t exp_c
   CU_ASSERT_EQUAL_FATAL (ret, DDS_RETCODE_OK);
   while (true)
   {
-    ret = dds_waitset_wait (ws, &triggered, 1, timeout);
+    ret = dds_waitset_wait_until (ws, &triggered, 1, abstimeout);
     CU_ASSERT_EQUAL_FATAL (exp_count > 0, ret >= 1);
     if (exp_count > 0)
       CU_ASSERT_EQUAL_FATAL (rd, (dds_entity_t)(intptr_t) triggered);
diff --git a/src/security/core/tests/secure_communication.c b/src/security/core/tests/secure_communication.c
index 3a3a6ec..2d1720d 100644
--- a/src/security/core/tests/secure_communication.c
+++ b/src/security/core/tests/secure_communication.c
@@ -254,7 +254,7 @@ static void test_write_read(struct domain_sec_config *domain_config,
       for (size_t w = 0; w < n_writers; w++)
       {
         size_t wr_index = pp_index * n_writers + w;
-        sync_writer_to_readers (g_pub_participants[pp_index], writers[wr_index], (uint32_t)(n_sub_domains * n_sub_participants * n_readers), DDS_SECS(2));
+        sync_writer_to_readers (g_pub_participants[pp_index], writers[wr_index], (uint32_t)(n_sub_domains * n_sub_participants * n_readers), DDS_SECS(5));
         sample.id = (int32_t) wr_index;
         printf("writer %"PRId32" writing sample %d\n", writers[wr_index], sample.id);
         ret = dds_write (writers[wr_index], &sample);

From 296b49cf2077bf262ca9d97f5117e6669e081f6b Mon Sep 17 00:00:00 2001
From: Erik Boasson <eb@ilities.com>
Date: Sat, 16 May 2020 21:54:11 +0200
Subject: [PATCH 233/238] Fix use-after-free via (proxy)pp min lease pointer

This changes the handling of the removal of the lease of a manual
liveliness (proxy) writer from the (proxy) participant, such that the
invariant maintained for the "min lease" objects in the (proxy)
participant changes from: a clone of some lease with the minimum
duration, to: a clone of the lease that is returned by the
ddsrt_fibheap_min operation on the lease heap.

This fixes a use-after-free of the entity pointed to by the cloned lease
object in a scenario where the shortest lease duration is used by
multiple writers and the removal of a lease from the heap shuffles the
remaining entries around.  For example (before this change):

1. initial situation: three writers w1, w2 and w3 with equal lease
   durations:
   - pp.heap = w1.lease : w2.lease w3.lease
   - pp.minl = clone of w1.lease

2. delete w2:
   - assuming deleting w2.lease from the heap moves w3.lease to the
     front (only guarantee is that there are no smaller keys in the heap
     than that of the entry returned by minimum operation)
   - min(pp.heap) = w1.lease != w2.lease
     thus: pp.minl unchanged, pp.minl.entity = w1
   - pp.heap = w3.lease : w1.lease

3. delete w1:
   - min(pp.heap) = w3.lease != w1.lease,
     thus: pp.minl unchanged, pp.minl.entity = w1
   - pp.heap = w3
   - free w1
   - now pp.minl.entity has a dangling pointer, touched on deleting
     the (proxy) particpant or on lease expiry.

With this chamge, pp.minl is updated in step 2 to be a clone of w3.lease
because the lease returned by min(pp.heap) changes.  This ensures that
in step 3 there is no dangling pointer and no use-after-free.

Signed-off-by: Erik Boasson <eb@ilities.com>
---
 src/core/ddsi/include/dds/ddsi/q_entity.h |  6 ++--
 src/core/ddsi/src/q_entity.c              | 36 +++++++++++++----------
 2 files changed, 23 insertions(+), 19 deletions(-)

diff --git a/src/core/ddsi/include/dds/ddsi/q_entity.h b/src/core/ddsi/include/dds/ddsi/q_entity.h
index 8a4f22f..ce1c7c3 100644
--- a/src/core/ddsi/include/dds/ddsi/q_entity.h
+++ b/src/core/ddsi/include/dds/ddsi/q_entity.h
@@ -231,7 +231,7 @@ struct participant
   int32_t builtin_refc; /* number of built-in endpoints in this participant [refc_lock] */
   int builtins_deleted; /* whether deletion of built-in endpoints has been initiated [refc_lock] */
   ddsrt_fibheap_t ldur_auto_wr; /* Heap that contains lease duration for writers with automatic liveliness in this participant */
-  ddsrt_atomic_voidp_t minl_man; /* lease object for shortest manual-by-participant liveliness writer's lease */
+  ddsrt_atomic_voidp_t minl_man; /* clone of min(leaseheap_man) */
   ddsrt_fibheap_t leaseheap_man; /* keeps leases for this participant's writers (with liveliness manual-by-participant) */
 #ifdef DDSI_INCLUDE_SECURITY
   struct participant_sec_attributes *sec_attr;
@@ -369,9 +369,9 @@ struct proxy_participant
   unsigned bes; /* built-in endpoint set */
   ddsi_guid_t privileged_pp_guid; /* if this PP depends on another PP for its SEDP writing */
   struct ddsi_plist *plist; /* settings/QoS for this participant */
-  ddsrt_atomic_voidp_t minl_auto; /* lease object for shortest automatic liveliness pwr's lease (includes this proxypp's lease) */
+  ddsrt_atomic_voidp_t minl_auto; /* clone of min(leaseheap_auto) */
   ddsrt_fibheap_t leaseheap_auto; /* keeps leases for this proxypp and leases for pwrs (with liveliness automatic) */
-  ddsrt_atomic_voidp_t minl_man; /* lease object for shortest manual-by-participant liveliness pwr's lease */
+  ddsrt_atomic_voidp_t minl_man; /* clone of min(leaseheap_man) */
   ddsrt_fibheap_t leaseheap_man; /* keeps leases for this proxypp and leases for pwrs (with liveliness manual-by-participant) */
   struct lease *lease; /* lease for this proxypp */
   struct addrset *as_default; /* default address set to use for user data traffic */
diff --git a/src/core/ddsi/src/q_entity.c b/src/core/ddsi/src/q_entity.c
index 5ea7def..2c3ca90 100644
--- a/src/core/ddsi/src/q_entity.c
+++ b/src/core/ddsi/src/q_entity.c
@@ -750,7 +750,7 @@ static void participant_add_wr_lease_locked (struct participant * pp, const stru
   minl_prev = ddsrt_fibheap_min (&lease_fhdef_pp, &pp->leaseheap_man);
   ddsrt_fibheap_insert (&lease_fhdef_pp, &pp->leaseheap_man, wr->lease);
   minl_new = ddsrt_fibheap_min (&lease_fhdef_pp, &pp->leaseheap_man);
-  /* if inserted lease is new shortest lease */
+  /* ensure pp->minl_man is equivalent to min(leaseheap_man) */
   if (minl_prev != minl_new)
   {
     ddsrt_etime_t texp = ddsrt_etime_add_duration (ddsrt_time_elapsed (), minl_new->tdur);
@@ -770,21 +770,23 @@ static void participant_add_wr_lease_locked (struct participant * pp, const stru
 
 static void participant_remove_wr_lease_locked (struct participant * pp, struct writer * wr)
 {
-  struct lease *minl;
+  struct lease *minl_prev;
+  struct lease *minl_new;
 
   assert (wr->lease != NULL);
   assert (wr->xqos->liveliness.kind == DDS_LIVELINESS_MANUAL_BY_PARTICIPANT);
-  minl = ddsrt_fibheap_min (&lease_fhdef_pp, &pp->leaseheap_man);
+  minl_prev = ddsrt_fibheap_min (&lease_fhdef_pp, &pp->leaseheap_man);
   ddsrt_fibheap_delete (&lease_fhdef_pp, &pp->leaseheap_man, wr->lease);
-  /* if writer with min lease is removed: update participant lease to use new minimal duration */
-  if (wr->lease == minl)
+  minl_new = ddsrt_fibheap_min (&lease_fhdef_pp, &pp->leaseheap_man);
+  /* ensure pp->minl_man is equivalent to min(leaseheap_man) */
+  if (minl_prev != minl_new)
   {
-    if ((minl = ddsrt_fibheap_min (&lease_fhdef_pp, &pp->leaseheap_man)) != NULL)
+    if (minl_new != NULL)
     {
-      dds_duration_t trem = minl->tdur - wr->lease->tdur;
+      dds_duration_t trem = minl_new->tdur - minl_prev->tdur;
       assert (trem >= 0);
       ddsrt_etime_t texp = ddsrt_etime_add_duration (ddsrt_time_elapsed(), trem);
-      struct lease *lnew = lease_new (texp, minl->tdur, minl->entity);
+      struct lease *lnew = lease_new (texp, minl_new->tdur, minl_new->entity);
       participant_replace_minl (pp, lnew);
       lease_register (lnew);
     }
@@ -4692,7 +4694,7 @@ static void proxy_participant_add_pwr_lease_locked (struct proxy_participant * p
   minl_prev = ddsrt_fibheap_min (&lease_fhdef_pp, lh);
   ddsrt_fibheap_insert (&lease_fhdef_pp, lh, pwr->lease);
   minl_new = ddsrt_fibheap_min (&lease_fhdef_pp, lh);
-  /* if inserted lease is new shortest lease */
+  /* ensure proxypp->minl_man/minl_auto is equivalent to min(leaseheap_man/auto) */
   if (proxypp->owns_lease && minl_prev != minl_new)
   {
     ddsrt_etime_t texp = ddsrt_etime_add_duration (ddsrt_time_elapsed (), minl_new->tdur);
@@ -4713,24 +4715,26 @@ static void proxy_participant_add_pwr_lease_locked (struct proxy_participant * p
 
 static void proxy_participant_remove_pwr_lease_locked (struct proxy_participant * proxypp, struct proxy_writer * pwr)
 {
-  struct lease *minl;
+  struct lease *minl_prev;
+  struct lease *minl_new;
   bool manbypp;
   ddsrt_fibheap_t *lh;
 
   assert (pwr->lease != NULL);
   manbypp = (pwr->c.xqos->liveliness.kind == DDS_LIVELINESS_MANUAL_BY_PARTICIPANT);
   lh = manbypp ? &proxypp->leaseheap_man : &proxypp->leaseheap_auto;
-  minl = ddsrt_fibheap_min (&lease_fhdef_pp, lh);
+  minl_prev = ddsrt_fibheap_min (&lease_fhdef_pp, lh);
   ddsrt_fibheap_delete (&lease_fhdef_pp, lh, pwr->lease);
-  /* if pwr with min lease is removed: update proxypp lease to use new minimal duration */
-  if (proxypp->owns_lease && pwr->lease == minl)
+  minl_new = ddsrt_fibheap_min (&lease_fhdef_pp, lh);
+  /* ensure proxypp->minl_man/minl_auto is equivalent to min(leaseheap_man/auto) */
+  if (proxypp->owns_lease && minl_prev != minl_new)
   {
-    if ((minl = ddsrt_fibheap_min (&lease_fhdef_pp, lh)) != NULL)
+    if (minl_new != NULL)
     {
-      dds_duration_t trem = minl->tdur - pwr->lease->tdur;
+      dds_duration_t trem = minl_new->tdur - minl_prev->tdur;
       assert (trem >= 0);
       ddsrt_etime_t texp = ddsrt_etime_add_duration (ddsrt_time_elapsed(), trem);
-      struct lease *lnew = lease_new (texp, minl->tdur, minl->entity);
+      struct lease *lnew = lease_new (texp, minl_new->tdur, minl_new->entity);
       proxy_participant_replace_minl (proxypp, manbypp, lnew);
       lease_register (lnew);
     }

From d4013f9c82f531cdcd6e9eaf3867595dc2ffa822 Mon Sep 17 00:00:00 2001
From: Erik Boasson <eb@ilities.com>
Date: Mon, 18 May 2020 14:03:30 +0200
Subject: [PATCH 234/238] Handling of syntax errors in network partitions

The various network partition-related structs were left mostly
uninitialized by the various init functions (e.g., if_partition_mapping)
and these were moreover interpreted on parse errors.  This initializes
them to null pointers and skips all configuration post-processing in
case of an error.

Signed-off-by: Erik Boasson <eb@ilities.com>
---
 src/core/ddsi/src/q_config.c | 28 ++++++++++++++++++++++------
 1 file changed, 22 insertions(+), 6 deletions(-)

diff --git a/src/core/ddsi/src/q_config.c b/src/core/ddsi/src/q_config.c
index e54c7e6..1f5ffa1 100644
--- a/src/core/ddsi/src/q_config.c
+++ b/src/core/ddsi/src/q_config.c
@@ -1388,20 +1388,30 @@ static int if_network_partition (struct cfgst *cfgst, void *parent, struct cfgel
   if (new == NULL)
     return -1;
   new->address_string = NULL;
+  new->as = NULL;
+  new->name = NULL;
+  new->partitionId = 0;
+  new->connected = 0;
   return 0;
 }
 
 static int if_ignored_partition (struct cfgst *cfgst, void *parent, struct cfgelem const * const cfgelem)
 {
+  struct config_ignoredpartition_listelem *new = if_common (cfgst, parent, cfgelem, sizeof(*new));
   if (if_common (cfgst, parent, cfgelem, sizeof (struct config_ignoredpartition_listelem)) == NULL)
     return -1;
+  new->DCPSPartitionTopic = NULL;
   return 0;
 }
 
 static int if_partition_mapping (struct cfgst *cfgst, void *parent, struct cfgelem const * const cfgelem)
 {
-  if (if_common (cfgst, parent, cfgelem, sizeof (struct config_partitionmapping_listelem)) == NULL)
+  struct config_partitionmapping_listelem *new = if_common (cfgst, parent, cfgelem, sizeof(*new));
+  if (new == NULL)
     return -1;
+  new->DCPSPartitionTopic = NULL;
+  new->networkPartition = NULL;
+  new->partition = NULL;
   return 0;
 }
 #endif /* DDSI_INCLUDE_NETWORK_PARTITIONS */
@@ -2937,6 +2947,7 @@ struct cfgst *config_init (const char *config, struct config *cfg, uint32_t domi
 
   /* Compatibility settings of IPv6, TCP -- a bit too complicated for
      the poor framework */
+  if (ok)
   {
     int ok1 = 1;
     switch (cfgst->cfg->transport_selector)
@@ -2946,7 +2957,7 @@ struct cfgst *config_init (const char *config, struct config *cfg, uint32_t domi
           cfgst->cfg->transport_selector = (cfgst->cfg->compat_use_ipv6 == BOOLDEF_TRUE) ? TRANS_TCP6 : TRANS_TCP;
         else
           cfgst->cfg->transport_selector = (cfgst->cfg->compat_use_ipv6 == BOOLDEF_TRUE) ? TRANS_UDP6 : TRANS_UDP;
-            break;
+        break;
       case TRANS_TCP:
         ok1 = !(cfgst->cfg->compat_tcp_enable == BOOLDEF_FALSE || cfgst->cfg->compat_use_ipv6 == BOOLDEF_TRUE);
         break;
@@ -2973,14 +2984,18 @@ struct cfgst *config_init (const char *config, struct config *cfg, uint32_t domi
 #ifdef DDSI_INCLUDE_NETWORK_CHANNELS
   /* Default channel gets set outside set_defaults -- a bit too
      complicated for the poor framework */
-  if (set_default_channel (cfgst->cfg) < 0)
-    ok = 0;
-  if (cfgst->cfg->channels && sort_channels_check_nodups (cfgst->cfg) < 0)
-    ok = 0;
+  if (ok)
+  {
+    if (set_default_channel (cfgst->cfg) < 0)
+      ok = 0;
+    if (cfgst->cfg->channels && sort_channels_check_nodups (cfgst->cfg) < 0)
+      ok = 0;
+  }
 #endif
 
 #ifdef DDSI_INCLUDE_NETWORK_PARTITIONS
   /* Assign network partition ids */
+  if (ok)
   {
     struct config_networkpartition_listelem *p = cfgst->cfg->networkPartitions;
     cfgst->cfg->nof_networkPartitions = 0;
@@ -2994,6 +3009,7 @@ struct cfgst *config_init (const char *config, struct config *cfg, uint32_t domi
 
   /* Create links from the partitionmappings to the network partitions
      and signal errors if partitions do not exist */
+  if (ok)
   {
     struct config_partitionmapping_listelem * m = cfgst->cfg->partitionMappings;
     while (m)

From cc8308819d75958bf84dc2cf43e8c667afbbf2a5 Mon Sep 17 00:00:00 2001
From: Dennis Potman <dennis.potman@adlinktech.com>
Date: Tue, 19 May 2020 17:13:34 +0200
Subject: [PATCH 235/238] Refactor access control test
 permissions_expiry_multiple to reduce timing issues in test runs on travis

Signed-off-by: Dennis Potman <dennis.potman@adlinktech.com>
---
 src/security/core/tests/access_control.c | 133 +++++++++++------------
 1 file changed, 61 insertions(+), 72 deletions(-)

diff --git a/src/security/core/tests/access_control.c b/src/security/core/tests/access_control.c
index f22dbe5..6fbdb52 100644
--- a/src/security/core/tests/access_control.c
+++ b/src/security/core/tests/access_control.c
@@ -257,13 +257,12 @@ CU_Theory(
 }
 
 
-#define N_RD 1 // N_RD > 1 not yet implemented
 #define N_WR 3
-#define N_NODES (N_RD + N_WR)
-#define PERM_EXP_BASE 3
+#define N_NODES (1 + N_WR)
+#define PERM_EXP_BASE 2
+#define PERM_EXP_INCR 2
 /* Tests permissions configuration expiry using multiple writers, to validate
-   that a reader still received data from writers that still have valid
-   permissions config */
+   that a reader keeps receiving data from writers that have valid permissions config */
 CU_Test(ddssec_access_control, permissions_expiry_multiple, .timeout=20)
 {
   char topic_name[100];
@@ -290,10 +289,10 @@ CU_Test(ddssec_access_control, permissions_expiry_multiple, .timeout=20)
     gov[i] = PF_F COMMON_ETC_PATH ("default_governance.p7s");
     perm_ca[i] = PF_F COMMON_ETC_PATH ("default_permissions_ca.pem");
     incl_el[i] = true;
-    dds_duration_t v = DDS_SECS(i < N_RD ? 3600 : PERM_EXP_BASE + 2 * i); /* readers should not expire */
+    dds_duration_t v = DDS_SECS(i == 0 ? 3600 : PERM_EXP_BASE + PERM_EXP_INCR * i); /* reader should not expire */
     dds_time_t t_exp = ddsrt_time_add_duration (t_perm, v);
-    if (i >= N_RD)
-      print_test_msg ("w[%d] grant expires at %d.%06d\n", i - N_RD, (int32_t) (t_exp / DDS_NSECS_IN_SEC), (int32_t) (t_exp % DDS_NSECS_IN_SEC) / 1000);
+    if (i >= 1)
+      print_test_msg ("w[%d] grant expires at %d.%06d\n", i - 1, (int32_t) (t_exp / DDS_NSECS_IN_SEC), (int32_t) (t_exp % DDS_NSECS_IN_SEC) / 1000);
     grants[i] = get_permissions_grant (id_name, id_subj[i], t_perm, t_exp, rules_xml, NULL);
     ddsrt_free (id_name);
   }
@@ -307,104 +306,94 @@ CU_Test(ddssec_access_control, permissions_expiry_multiple, .timeout=20)
       id, pk, ca_list, exp_fail, NULL, NULL,
       incl_el, gov, incl_el, perm_conf, incl_el, perm_ca);
 
-  dds_qos_t * qos = get_default_test_qos ();
-  dds_entity_t rd[N_RD];
-  for (int i = 0; i < N_RD; i++)
-  {
-    dds_entity_t sub = dds_create_subscriber (g_participant[i], NULL, NULL);
-    CU_ASSERT_FATAL (sub > 0);
-    dds_entity_t sub_tp = dds_create_topic (g_participant[i], &SecurityCoreTests_Type1_desc, topic_name, NULL, NULL);
-    CU_ASSERT_FATAL (sub_tp > 0);
-    rd[i] = dds_create_reader (sub, sub_tp, qos, NULL);
-    CU_ASSERT_FATAL (rd[i] > 0);
-    dds_set_status_mask (rd[i], DDS_SUBSCRIPTION_MATCHED_STATUS);
-  }
+  // create 1 reader
+  dds_qos_t * rdqos = get_default_test_qos ();
+  dds_entity_t sub = dds_create_subscriber (g_participant[0], NULL, NULL);
+  CU_ASSERT_FATAL (sub > 0);
+  dds_entity_t sub_tp = dds_create_topic (g_participant[0], &SecurityCoreTests_Type1_desc, topic_name, NULL, NULL);
+  CU_ASSERT_FATAL (sub_tp > 0);
+  dds_entity_t rd = dds_create_reader (sub, sub_tp, rdqos, NULL);
+  CU_ASSERT_FATAL (rd > 0);
+  dds_set_status_mask (rd, DDS_SUBSCRIPTION_MATCHED_STATUS);
+  dds_delete_qos (rdqos);
 
+  // create N_WR writers
+  dds_qos_t * wrqos = get_default_test_qos ();
   dds_entity_t wr[N_WR];
   for (int i = 0; i < N_WR; i++)
   {
-    dds_entity_t pub = dds_create_publisher (g_participant[i + N_RD], NULL, NULL);
+    dds_entity_t pub = dds_create_publisher (g_participant[i + 1], NULL, NULL);
     CU_ASSERT_FATAL (pub > 0);
-    dds_entity_t pub_tp = dds_create_topic (g_participant[i + N_RD], &SecurityCoreTests_Type1_desc, topic_name, NULL, NULL);
+    dds_entity_t pub_tp = dds_create_topic (g_participant[i + 1], &SecurityCoreTests_Type1_desc, topic_name, NULL, NULL);
     CU_ASSERT_FATAL (pub_tp > 0);
-    wr[i] = dds_create_writer (pub, pub_tp, qos, NULL);
+    wr[i] = dds_create_writer (pub, pub_tp, wrqos, NULL);
     CU_ASSERT_FATAL (wr[i] > 0);
     dds_set_status_mask (wr[i], DDS_PUBLICATION_MATCHED_STATUS);
-    sync_writer_to_readers (g_participant[i + N_RD], wr[i], N_RD, DDS_SECS(2));
-  }
-  dds_delete_qos (qos);
-  for (int i = 0; i < N_RD; i++)
-  {
-    sync_reader_to_writers (g_participant[i], rd[i], N_WR, DDS_SECS (2));
-    dds_set_status_mask (rd[i], DDS_DATA_AVAILABLE_STATUS);
+    sync_writer_to_readers (g_participant[i + 1], wr[i], 1, DDS_SECS(2));
   }
+  dds_delete_qos (wrqos);
 
+  sync_reader_to_writers (g_participant[0], rd, N_WR, DDS_SECS (2));
+
+  // write data
   SecurityCoreTests_Type1 sample = { 1, 1 };
-  SecurityCoreTests_Type1 rd_sample;
-  void * samples[] = { &rd_sample };
-  dds_sample_info_t info[1];
   dds_return_t ret;
+  dds_entity_t ws = dds_create_waitset (g_participant[0]);
+  dds_entity_t gcond = dds_create_guardcondition (g_participant[0]);
+  dds_set_guardcondition (gcond, false);
+  dds_waitset_attach (ws, gcond, 0);
 
+  dds_set_status_mask (rd, DDS_DATA_AVAILABLE_STATUS);
   for (int run = 0; run < N_WR; run++)
   {
-    // sleep until 1s after next writer pp permission expires
-    dds_duration_t delay = DDS_SECS (PERM_EXP_BASE + 2 * run + 1) - (dds_time () - t_perm);
-    if (delay > 0)
-      dds_sleepfor (delay);
-
+    // wait until 1s after next writer pp permission expires
+    dds_waitset_wait_until (ws, NULL, 0, t_perm + DDS_SECS (PERM_EXP_BASE + PERM_EXP_INCR * run + 1));
     print_test_msg ("run %d\n", run);
-
-    for (int w = run; w < N_WR; w++)
+    for (int w = 0; w < N_WR; w++)
     {
       sample.id = w;
       ret = dds_write (wr[w], &sample);
-      CU_ASSERT_EQUAL_FATAL (ret, DDS_RETCODE_OK);
       print_test_msg ("write %d\n", w);
+      CU_ASSERT_EQUAL_FATAL (ret, DDS_RETCODE_OK);
     }
-
-    // Expect reader to receive data from writers with non-expired permissions
-    int n_samples = 0, n_invalid = 0, n_wait = 0;
-    while (n_samples + n_invalid < N_WR && n_wait < 5)
-    {
-      ret = dds_take (rd[0], samples, info, 1, 1);
-      CU_ASSERT_FATAL (ret >= 0);
-      if (ret == 0)
-      {
-        reader_wait_for_data (g_participant[0], rd[0], DDS_MSECS (200));
-        print_test_msg ("wait for data\n");
-        n_wait++;
-      }
-      else if (info[0].instance_state == DDS_IST_ALIVE)
-      {
-        print_test_msg ("recv sample %d\n", rd_sample.id);
-        n_samples++;
-      }
-      else
-      {
-        print_test_msg ("recv inv sample\n");
-        n_invalid++;
-      }
-    }
-    CU_ASSERT_EQUAL (n_samples, N_WR - run);
-    CU_ASSERT (n_invalid <= run);
   }
 
-  access_control_fini (N_NODES, NULL, 0);
+  // wait until last pp's permissions are expired
+  dds_waitset_wait_until (ws, NULL, 0, t_perm + DDS_SECS (PERM_EXP_BASE + PERM_EXP_INCR * N_WR + 1));
 
+  // check received data
+  SecurityCoreTests_Type1 * data = ddsrt_calloc (N_WR, sizeof (*data));
+  dds_sample_info_t rd_info[N_WR];
+  static void * rd_samples[N_WR];
+  for (int i = 0; i < N_WR; i++)
+    rd_samples[i] = &data[i];
+
+  for (int w = 0; w < N_WR; w++)
+  {
+    sample.id = w;
+    dds_instance_handle_t ih = dds_lookup_instance(rd, &sample);
+    CU_ASSERT_NOT_EQUAL_FATAL(ih, DDS_HANDLE_NIL);
+    ret = dds_take_instance (rd, rd_samples, rd_info, N_WR, N_WR, ih);
+    print_test_msg ("samples from writer %d: %d\n", w, ret);
+    CU_ASSERT_EQUAL_FATAL (ret, w + 1);
+    print_test_msg ("writer %d instance state: %d\n", w, rd_info[w].instance_state);
+    CU_ASSERT_EQUAL_FATAL (rd_info[w].instance_state, DDS_NOT_ALIVE_DISPOSED_INSTANCE_STATE);
+    print_test_msg ("writer %d valid data: %d\n", w, rd_info[w].valid_data);
+    CU_ASSERT_EQUAL_FATAL (rd_info[w].valid_data, true);
+  }
+
+  access_control_fini (N_NODES, (void * []) { ca, rules_xml, perm_config_str, data }, 4);
   for (int i = 0; i < N_NODES; i++)
   {
     ddsrt_free (grants[i]);
     ddsrt_free (id_subj[i]);
     ddsrt_free ((char *)id[i]);
   }
-  ddsrt_free (ca);
-  ddsrt_free (rules_xml);
-  ddsrt_free (perm_config_str);
 }
-#undef N_RD
 #undef N_WR
 #undef N_NODES
 #undef PERM_EXP_BASE
+#undef PERM_EXP_INCR
 
 #define na false
 CU_TheoryDataPoints(ddssec_access_control, hooks) = {

From 6a9ebf88eba8b73091a38d200129f45c6836f78e Mon Sep 17 00:00:00 2001
From: Erik Boasson <eb@ilities.com>
Date: Mon, 25 May 2020 09:10:10 +0200
Subject: [PATCH 236/238] OpenSSL 1.0.2 compatibility

This addresses a number of issues with building Cyclone DDS including
DDS Security while using OpenSSL 1.0.2. Compatibility with 1.0.2 is a
courtesy towards those who are unable to move to 1.1.x or later because
of other libraries.

* On Windows, one must include Winsock2.h prior to including the OpenSSL
  header files, or it'll pull in incompatible definitions from Winsock.h
  and that breaks some of the files.

* OpenSSL 1.0.2 requires initializing the library (or more particular,
  loading all the required algorithms) but this is no longer needed in
  OpenSSL 1.1.x. It ends up being needed in a few places and having tons
  of essentially dead initialization code lying around is unpleasant.
  Hence this has been consolidated in a single function and protected
  with ddsrt_once().

* One ought to undo the above initialization on 1.0.2g and older, but it
  is impossible to know whether that can safely be done from a library.
  This is also the reason OpenSSL deprecated all the initialization and
  cleanup interfaces. So if one insists on trying it with such an old
  version, let there be some leaks.

* Thread state cleanup is sort-of required prior 1.1.0, but that suffers
  from the same problems; we'd have to do per-thread cleanup code for
  OpenSSL for any thread that could call into it (which is pretty much
  any thread). So once again, people should just use 1.1.0 or newer.

* There are some interfaces added in 1.1.0 that we use, but a few small
  workarounds those can be made to work on 1.0.2 as well. These also
  were replicated in a number of places and consolidated by this commit.

Signed-off-by: Erik Boasson <eb@ilities.com>
---
 src/ddsrt/include/dds/ddsrt/xmlparser.h       |   1 +
 src/security/CMakeLists.txt                   |   1 +
 .../access_control/CMakeLists.txt             |   2 +
 .../access_control/src/access_control.c       |  23 +---
 .../src/access_control_objects.h              |   2 +-
 .../src/access_control_parser.c               |   6 +-
 .../access_control/src/access_control_utils.c |   7 +-
 .../access_control/src/access_control_utils.h |   4 +-
 .../authentication/CMakeLists.txt             |   2 +
 .../authentication/src/auth_utils.c           |  41 ++----
 .../authentication/src/auth_utils.h           |   7 +
 .../authentication/src/authentication.c       |  47 +------
 .../cryptographic/CMakeLists.txt              |   2 +
 .../cryptographic/src/crypto_cipher.c         |   4 +-
 .../cryptographic/src/crypto_key_factory.c    |   7 +-
 .../cryptographic/src/crypto_transform.c      |  25 +---
 .../cryptographic/src/crypto_utils.c          |   6 +-
 .../builtin_plugins/tests/CMakeLists.txt      |  15 +--
 .../tests/common/src/crypto_helper.c          |   5 +-
 .../tests/common/src/handshake_helper.c       |  30 ++---
 .../tests/common/src/handshake_helper.h       |  10 +-
 ...te_local_datareader_crypto_tokens_utests.c |   6 +-
 ...te_local_datawriter_crypto_tokens_utests.c |   6 +-
 ...e_local_participant_crypto_tokens_utests.c |   6 +-
 .../src/decode_datareader_submessage_utests.c |   7 +-
 .../src/decode_datawriter_submessage_utests.c |   5 +-
 .../src/decode_rtps_message_utests.c          |   5 +-
 .../src/decode_serialized_payload_utests.c    |   6 +-
 .../src/encode_datareader_submessage_utests.c |   5 +-
 .../src/encode_datawriter_submessage_utests.c |   5 +-
 .../src/encode_rtps_message_utests.c          |   5 +-
 .../src/encode_serialized_payload_utests.c    |   5 +-
 ...thenticated_peer_credential_token_utests.c |  28 ++--
 .../get_permissions_credential_token_utests.c |   5 +-
 .../src/get_permissions_token_utests.c        |   5 +-
 .../src/get_xxx_sec_attributes_utests.c       |   5 +-
 .../src/listeners_access_control_utests.c     |  23 +---
 .../src/listeners_authentication_utests.c     |  50 ++-----
 .../src/preprocess_secure_submsg_utests.c     |   6 +-
 .../src/process_handshake_utests.c            |  37 ++---
 .../src/register_local_datareader_utests.c    |   6 +-
 .../src/register_local_datawriter_utests.c    |   6 +-
 .../src/register_local_participant_utests.c   |   6 +-
 ...egister_matched_remote_datareader_utests.c |   6 +-
 ...egister_matched_remote_datawriter_utests.c |   6 +-
 ...gister_matched_remote_participant_utests.c |   6 +-
 ...t_remote_datareader_crypto_tokens_utests.c |   6 +-
 ...t_remote_datawriter_crypto_tokens_utests.c |   6 +-
 ..._remote_participant_crypto_tokens_utests.c |   6 +-
 .../validate_begin_handshake_reply_utests.c   |  36 ++---
 .../validate_begin_handshake_request_utests.c |   4 +
 .../src/validate_local_identity_utests.c      |   3 +-
 .../src/validate_local_permissions_utests.c   |   5 +-
 .../src/validate_remote_permissions_utests.c  |   5 +-
 .../dds/security/core/dds_security_utils.h    |  12 +-
 src/security/core/src/dds_security_utils.c    |  47 +------
 src/security/core/tests/CMakeLists.txt        |   7 +
 src/security/core/tests/common/cert_utils.c   |   7 +-
 .../tests/common/security_config_test_utils.c |   9 +-
 src/security/openssl/CMakeLists.txt           |  21 +++
 .../include/dds/security/openssl_support.h    |  80 +++++++++++
 src/security/openssl/src/openssl_support.c    | 127 ++++++++++++++++++
 62 files changed, 380 insertions(+), 504 deletions(-)
 create mode 100644 src/security/openssl/CMakeLists.txt
 create mode 100644 src/security/openssl/include/dds/security/openssl_support.h
 create mode 100644 src/security/openssl/src/openssl_support.c

diff --git a/src/ddsrt/include/dds/ddsrt/xmlparser.h b/src/ddsrt/include/dds/ddsrt/xmlparser.h
index 93bd92d..732bb2a 100644
--- a/src/ddsrt/include/dds/ddsrt/xmlparser.h
+++ b/src/ddsrt/include/dds/ddsrt/xmlparser.h
@@ -12,6 +12,7 @@
 #ifndef DDSRT_XMLPARSER_H
 #define DDSRT_XMLPARSER_H
 
+#include <stdio.h>
 #include <stdint.h>
 
 #include "dds/export.h"
diff --git a/src/security/CMakeLists.txt b/src/security/CMakeLists.txt
index fd9af5d..1c8ec01 100644
--- a/src/security/CMakeLists.txt
+++ b/src/security/CMakeLists.txt
@@ -16,6 +16,7 @@ if(ENABLE_SECURITY)
   add_subdirectory(core)
 
   if(ENABLE_SSL)
+    add_subdirectory(openssl)
     add_subdirectory(builtin_plugins)
   endif()
 endif()
diff --git a/src/security/builtin_plugins/access_control/CMakeLists.txt b/src/security/builtin_plugins/access_control/CMakeLists.txt
index e7bf471..d21815c 100644
--- a/src/security/builtin_plugins/access_control/CMakeLists.txt
+++ b/src/security/builtin_plugins/access_control/CMakeLists.txt
@@ -26,6 +26,7 @@ generate_export_header(
         EXPORT_FILE_NAME "${CMAKE_CURRENT_BINARY_DIR}/include/dds/security/export.h"
 )
 
+target_link_libraries(dds_security_ac PRIVATE security_openssl)
 target_link_libraries(dds_security_ac PUBLIC ddsc)
 target_link_libraries(dds_security_ac PUBLIC OpenSSL::SSL)
 if(CMAKE_GENERATOR MATCHES "Visual Studio")
@@ -36,6 +37,7 @@ target_include_directories(dds_security_ac
     PUBLIC
         "$<BUILD_INTERFACE:$<TARGET_PROPERTY:security_api,INTERFACE_INCLUDE_DIRECTORIES>>"
         "$<BUILD_INTERFACE:$<TARGET_PROPERTY:security_core,INTERFACE_INCLUDE_DIRECTORIES>>"
+        "$<BUILD_INTERFACE:$<TARGET_PROPERTY:security_openssl,INTERFACE_INCLUDE_DIRECTORIES>>"
         "$<BUILD_INTERFACE:$<TARGET_PROPERTY:ddsrt,INTERFACE_INCLUDE_DIRECTORIES>>"
         "$<BUILD_INTERFACE:${CMAKE_CURRENT_BINARY_DIR}/include>"
 )
diff --git a/src/security/builtin_plugins/access_control/src/access_control.c b/src/security/builtin_plugins/access_control/src/access_control.c
index e9d91e0..1a45c4e 100644
--- a/src/security/builtin_plugins/access_control/src/access_control.c
+++ b/src/security/builtin_plugins/access_control/src/access_control.c
@@ -13,8 +13,7 @@
 
 #include <assert.h>
 #include <string.h>
-#include <openssl/x509.h>
-#include <openssl/err.h>
+
 #include "dds/ddsrt/heap.h"
 #include "dds/ddsrt/misc.h"
 #include "dds/ddsrt/string.h"
@@ -24,19 +23,12 @@
 #include "dds/security/dds_security_api.h"
 #include "dds/security/core/dds_security_utils.h"
 #include "dds/security/core/dds_security_timed_cb.h"
+#include "dds/security/openssl_support.h"
 #include "access_control.h"
 #include "access_control_utils.h"
 #include "access_control_objects.h"
 #include "access_control_parser.h"
 
-#if OPENSSL_VERSION_NUMBER >= 0x10000000L && OPENSSL_VERSION_NUMBER < 0x10100000L
-#define REMOVE_THREAD_STATE() ERR_remove_thread_state(NULL);
-#elif OPENSSL_VERSION_NUMBER < 0x10000000L
-#define REMOVE_THREAD_STATE() ERR_remove_state(0);
-#else
-#define REMOVE_THREAD_STATE()
-#endif
-
 static const char *ACCESS_CONTROL_PROTOCOL_CLASS = "DDS:Access";
 static const unsigned ACCESS_CONTROL_PROTOCOL_VERSION_MAJOR = 1;
 static const unsigned ACCESS_CONTROL_PROTOCOL_VERSION_MINOR = 0;
@@ -1522,12 +1514,7 @@ int init_access_control(const char *argument, void **context, struct ddsi_domain
 #endif
   access_control->remote_permissions = access_control_table_new();
 
-  OpenSSL_add_all_algorithms();
-  OpenSSL_add_all_ciphers();
-  OpenSSL_add_all_digests();
-  ERR_load_BIO_strings();
-  ERR_load_crypto_strings();
-
+  dds_openssl_init ();
   *context = access_control;
   return 0;
 }
@@ -2473,9 +2460,5 @@ int finalize_access_control(void *context)
     ddsrt_mutex_destroy(&access_control->lock);
     ddsrt_free(access_control);
   }
-  EVP_cleanup();
-  CRYPTO_cleanup_all_ex_data();
-  REMOVE_THREAD_STATE();
-  ERR_free_strings();
   return 0;
 }
diff --git a/src/security/builtin_plugins/access_control/src/access_control_objects.h b/src/security/builtin_plugins/access_control/src/access_control_objects.h
index b1f033b..867bab9 100644
--- a/src/security/builtin_plugins/access_control/src/access_control_objects.h
+++ b/src/security/builtin_plugins/access_control/src/access_control_objects.h
@@ -12,10 +12,10 @@
 #ifndef ACCESS_CONTROL_OBJECTS_H
 #define ACCESS_CONTROL_OBJECTS_H
 
-#include <openssl/x509.h>
 #include "dds/ddsrt/atomics.h"
 #include "dds/ddsrt/types.h"
 #include "dds/security/dds_security_api.h"
+#include "dds/security/openssl_support.h"
 
 #define ACCESS_CONTROL_OBJECT(o)            ((AccessControlObject *)(o))
 #define ACCESS_CONTROL_OBJECT_HANDLE(o)     ((o) ? ACCESS_CONTROL_OBJECT(o)->handle : DDS_SECURITY_HANDLE_NIL)
diff --git a/src/security/builtin_plugins/access_control/src/access_control_parser.c b/src/security/builtin_plugins/access_control/src/access_control_parser.c
index efd72ef..2d7d3af 100644
--- a/src/security/builtin_plugins/access_control/src/access_control_parser.c
+++ b/src/security/builtin_plugins/access_control/src/access_control_parser.c
@@ -11,11 +11,7 @@
  */
 #include <assert.h>
 #include <string.h>
-#include <openssl/x509.h>
-#include <openssl/pkcs7.h>
-#include <openssl/pem.h>
-#include <openssl/bio.h>
-#include <openssl/err.h>
+
 #include "dds/ddsrt/heap.h"
 #include "dds/ddsrt/misc.h"
 #include "dds/ddsrt/string.h"
diff --git a/src/security/builtin_plugins/access_control/src/access_control_utils.c b/src/security/builtin_plugins/access_control/src/access_control_utils.c
index ca80d77..c30dbf2 100644
--- a/src/security/builtin_plugins/access_control/src/access_control_utils.c
+++ b/src/security/builtin_plugins/access_control/src/access_control_utils.c
@@ -14,11 +14,7 @@
 #include <string.h>
 #include <sys/types.h>
 #include <sys/stat.h>
-#include <openssl/x509.h>
-#include <openssl/pkcs7.h>
-#include <openssl/pem.h>
-#include <openssl/bio.h>
-#include <openssl/err.h>
+
 #include "dds/ddsrt/heap.h"
 #include "dds/ddsrt/misc.h"
 #include "dds/ddsrt/string.h"
@@ -26,6 +22,7 @@
 #include "dds/ddsrt/types.h"
 #include "dds/security/dds_security_api.h"
 #include "dds/security/core/dds_security_utils.h"
+#include "dds/security/openssl_support.h"
 #include "access_control_utils.h"
 
 #define SEQ_ERR -1
diff --git a/src/security/builtin_plugins/access_control/src/access_control_utils.h b/src/security/builtin_plugins/access_control/src/access_control_utils.h
index 008ab21..d786416 100644
--- a/src/security/builtin_plugins/access_control/src/access_control_utils.h
+++ b/src/security/builtin_plugins/access_control/src/access_control_utils.h
@@ -12,10 +12,10 @@
 #ifndef ACCESS_CONTROL_UTILS_H
 #define ACCESS_CONTROL_UTILS_H
 
-#include <openssl/x509.h>
 #include "dds/ddsrt/types.h"
-#include "dds/security/dds_security_api.h"
 #include "dds/security/export.h"
+#include "dds/security/dds_security_api.h"
+#include "dds/security/openssl_support.h"
 
 #define DDS_ACCESS_CONTROL_PLUGIN_CONTEXT "Access Control"
 
diff --git a/src/security/builtin_plugins/authentication/CMakeLists.txt b/src/security/builtin_plugins/authentication/CMakeLists.txt
index c6716e7..880b832 100644
--- a/src/security/builtin_plugins/authentication/CMakeLists.txt
+++ b/src/security/builtin_plugins/authentication/CMakeLists.txt
@@ -31,6 +31,7 @@ generate_export_header(
         EXPORT_FILE_NAME "${CMAKE_CURRENT_BINARY_DIR}/include/dds/security/export.h"
 )
 
+target_link_libraries(dds_security_auth PRIVATE security_openssl)
 target_link_libraries(dds_security_auth PUBLIC ddsc)
 target_link_libraries(dds_security_auth PUBLIC OpenSSL::SSL)
 if(CMAKE_GENERATOR MATCHES "Visual Studio")
@@ -41,6 +42,7 @@ target_include_directories(dds_security_auth
     PUBLIC
         "$<BUILD_INTERFACE:$<TARGET_PROPERTY:security_api,INTERFACE_INCLUDE_DIRECTORIES>>"
         "$<BUILD_INTERFACE:$<TARGET_PROPERTY:security_core,INTERFACE_INCLUDE_DIRECTORIES>>"
+        "$<BUILD_INTERFACE:$<TARGET_PROPERTY:security_openssl,INTERFACE_INCLUDE_DIRECTORIES>>"
         "$<BUILD_INTERFACE:$<TARGET_PROPERTY:ddsrt,INTERFACE_INCLUDE_DIRECTORIES>>"
         "$<BUILD_INTERFACE:${CMAKE_CURRENT_BINARY_DIR}/include>"
         "$<BUILD_INTERFACE:${CMAKE_CURRENT_LIST_DIR}/../../../core/ddsi/include>"
diff --git a/src/security/builtin_plugins/authentication/src/auth_utils.c b/src/security/builtin_plugins/authentication/src/auth_utils.c
index e79a951..1eea973 100644
--- a/src/security/builtin_plugins/authentication/src/auth_utils.c
+++ b/src/security/builtin_plugins/authentication/src/auth_utils.c
@@ -12,24 +12,7 @@
 
 #include <assert.h>
 #include <string.h>
-#include <openssl/bn.h>
-#include <openssl/asn1.h>
-#include <openssl/x509.h>
-#include <openssl/x509_vfy.h>
-#include <openssl/pem.h>
-#include <openssl/bio.h>
-#include <openssl/err.h>
-#include <openssl/evp.h>
-#include <openssl/rand.h>
-#if OPENSSL_VERSION_NUMBER >= 0x1000200fL
-#define AUTH_INCLUDE_EC
-#include <openssl/ec.h>
-#if OPENSSL_VERSION_NUMBER >= 0x10100000L
-#define AUTH_INCLUDE_DH_ACCESSORS
-#endif
-#else
-#error "OpenSSL version is not supported"
-#endif
+
 #include "dds/ddsrt/time.h"
 #include "dds/ddsrt/heap.h"
 #include "dds/ddsrt/filesystem.h"
@@ -40,17 +23,9 @@
 #include "dds/ddsrt/io.h"
 #include "dds/security/dds_security_api_defs.h"
 #include "dds/security/core/dds_security_utils.h"
+#include "dds/security/openssl_support.h"
 #include "auth_utils.h"
 
-/* There is a problem when compiling on windows w.r.t. X509_NAME.
- * The windows api already defines the type X509_NAME which
- * conficts with some openssl versions. The workaround is to
- * undef the openssl X509_NAME
- */
-#ifdef _WIN32
-#undef X509_NAME
-#endif
-
 #define MAX_TRUSTED_CA 100
 
 char *get_openssl_error_message(void)
@@ -151,8 +126,10 @@ static DDS_Security_ValidationResult_t check_key_type_and_size(EVP_PKEY *key, in
     }
     if (isPrivate)
     {
-      RSA *rsaKey = EVP_PKEY_get0_RSA(key);
-      if (rsaKey && RSA_check_key(rsaKey) != 1)
+      RSA *rsaKey = EVP_PKEY_get1_RSA(key);
+      const bool fail = (rsaKey && RSA_check_key(rsaKey) != 1);
+      RSA_free(rsaKey);
+      if (fail)
       {
         DDS_Security_Exception_set_with_openssl_error(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "RSA key not correct : ");
         return DDS_SECURITY_VALIDATION_FAILED;
@@ -166,8 +143,10 @@ static DDS_Security_ValidationResult_t check_key_type_and_size(EVP_PKEY *key, in
       DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "EC %s has unsupported key size (%d)", sub, EVP_PKEY_bits(key));
       return DDS_SECURITY_VALIDATION_FAILED;
     }
-    EC_KEY *ecKey = EVP_PKEY_get0_EC_KEY(key);
-    if (ecKey && EC_KEY_check_key(ecKey) != 1)
+    EC_KEY *ecKey = EVP_PKEY_get1_EC_KEY(key);
+    const bool fail = (ecKey && EC_KEY_check_key(ecKey) != 1);
+    EC_KEY_free(ecKey);
+    if (fail)
     {
       DDS_Security_Exception_set(ex, DDS_AUTH_PLUGIN_CONTEXT, DDS_SECURITY_ERR_UNDEFINED_CODE, DDS_SECURITY_VALIDATION_FAILED, "EC key not correct : ");
       return DDS_SECURITY_VALIDATION_FAILED;
diff --git a/src/security/builtin_plugins/authentication/src/auth_utils.h b/src/security/builtin_plugins/authentication/src/auth_utils.h
index 52ca1f7..31eb5d9 100644
--- a/src/security/builtin_plugins/authentication/src/auth_utils.h
+++ b/src/security/builtin_plugins/authentication/src/auth_utils.h
@@ -13,6 +13,13 @@
 #ifndef AUTH_UTILS_H
 #define AUTH_UTILS_H
 
+#ifdef _WIN32
+/* supposedly WinSock2 must be included before openssl 1.0.2 headers otherwise winsock will be used */
+#include <WinSock2.h>
+#endif
+#include <openssl/x509.h>
+#include <openssl/evp.h>
+
 #include "dds/security/dds_security_api.h"
 #include "dds/ddsrt/time.h"
 
diff --git a/src/security/builtin_plugins/authentication/src/authentication.c b/src/security/builtin_plugins/authentication/src/authentication.c
index f17ae41..20f2c2c 100644
--- a/src/security/builtin_plugins/authentication/src/authentication.c
+++ b/src/security/builtin_plugins/authentication/src/authentication.c
@@ -13,28 +13,6 @@
 #include <assert.h>
 #include <stdbool.h>
 #include <string.h>
-#include <openssl/bn.h>
-#include <openssl/asn1.h>
-#include <openssl/x509.h>
-#include <openssl/x509_vfy.h>
-#include <openssl/pem.h>
-#include <openssl/bio.h>
-#include <openssl/err.h>
-#include <openssl/evp.h>
-#if OPENSLL_VERSION_NUMBER >= 0x10002000L
-#define AUTH_INCLUDE_EC
-#include <openssl/ec.h>
-#endif
-#include <openssl/rand.h>
-
-/* There is a problem when compiling on windows w.r.t. X509_NAME.
- * The windows api already defines the type X509_NAME which
- * conficts with some openssl versions. The workaround is to
- * undef the openssl X509_NAME
- */
-#ifdef _WIN32
-#undef X509_NAME
-#endif
 
 #include "dds/ddsrt/heap.h"
 #include "dds/ddsrt/atomics.h"
@@ -43,13 +21,13 @@
 #include "dds/ddsrt/hopscotch.h"
 #include "dds/ddsi/ddsi_domaingv.h"
 #include "dds/security/dds_security_api.h"
+#include "dds/security/dds_security_api_types.h"
 #include "dds/security/core/dds_security_timed_cb.h"
 #include "dds/security/core/dds_security_utils.h"
-#include "dds/security/dds_security_api.h"
-#include "dds/security/dds_security_api_types.h"
 #include "dds/security/core/shared_secret.h"
 #include "dds/security/core/dds_security_utils.h"
 #include "dds/security/core/dds_security_serialize.h"
+#include "dds/security/openssl_support.h"
 #include "auth_utils.h"
 #include "authentication.h"
 
@@ -57,14 +35,6 @@
 #define EVP_PKEY_id(k) ((k)->type)
 #endif
 
-#if OPENSSL_VERSION_NUMBER >= 0x10000000L && OPENSSL_VERSION_NUMBER < 0x10100000L
-#define REMOVE_THREAD_STATE() ERR_remove_thread_state(NULL);
-#elif OPENSSL_VERSION_NUMBER < 0x10000000L
-#define REMOVE_THREAD_STATE() ERR_remove_state(0);
-#else
-#define REMOVE_THREAD_STATE()
-#endif
-
 #define HANDSHAKE_SIGNATURE_CONTENT_SIZE 6
 #define ADJUSTED_GUID_PREFIX_FLAG 0x80
 
@@ -2276,12 +2246,7 @@ int32_t init_authentication(const char *argument, void **context, struct ddsi_do
   else
     authentication->include_optional = true;
 
-  OpenSSL_add_all_algorithms();
-  OpenSSL_add_all_ciphers();
-  OpenSSL_add_all_digests();
-  ERR_load_BIO_strings();
-  ERR_load_crypto_strings();
-
+  dds_openssl_init ();
   *context = authentication;
   return 0;
 }
@@ -2308,11 +2273,5 @@ int32_t finalize_authentication(void *instance)
     ddsrt_mutex_destroy(&authentication->lock);
     ddsrt_free((dds_security_authentication_impl *)instance);
   }
-
-  RAND_cleanup();
-  EVP_cleanup();
-  CRYPTO_cleanup_all_ex_data();
-  REMOVE_THREAD_STATE();
-  ERR_free_strings();
   return 0;
 }
diff --git a/src/security/builtin_plugins/cryptographic/CMakeLists.txt b/src/security/builtin_plugins/cryptographic/CMakeLists.txt
index 180e7f3..7fac1df 100644
--- a/src/security/builtin_plugins/cryptographic/CMakeLists.txt
+++ b/src/security/builtin_plugins/cryptographic/CMakeLists.txt
@@ -29,6 +29,7 @@ generate_export_header(
         EXPORT_FILE_NAME "${CMAKE_CURRENT_BINARY_DIR}/include/dds/security/export.h"
 )
 
+target_link_libraries(dds_security_crypto PRIVATE security_openssl)
 target_link_libraries(dds_security_crypto PUBLIC ddsc)
 target_link_libraries(dds_security_crypto PUBLIC OpenSSL::SSL)
 if(CMAKE_GENERATOR MATCHES "Visual Studio")
@@ -40,6 +41,7 @@ target_include_directories(dds_security_crypto
     PUBLIC
         "$<BUILD_INTERFACE:$<TARGET_PROPERTY:security_api,INTERFACE_INCLUDE_DIRECTORIES>>"
         "$<BUILD_INTERFACE:$<TARGET_PROPERTY:security_core,INTERFACE_INCLUDE_DIRECTORIES>>"
+        "$<BUILD_INTERFACE:$<TARGET_PROPERTY:security_openssl,INTERFACE_INCLUDE_DIRECTORIES>>"
         "$<BUILD_INTERFACE:$<TARGET_PROPERTY:ddsrt,INTERFACE_INCLUDE_DIRECTORIES>>"
         "$<BUILD_INTERFACE:${CMAKE_CURRENT_BINARY_DIR}/include>"
         "$<BUILD_INTERFACE:${CMAKE_CURRENT_LIST_DIR}/../../../core/ddsi/include>"
diff --git a/src/security/builtin_plugins/cryptographic/src/crypto_cipher.c b/src/security/builtin_plugins/cryptographic/src/crypto_cipher.c
index 80d79f3..a870699 100644
--- a/src/security/builtin_plugins/cryptographic/src/crypto_cipher.c
+++ b/src/security/builtin_plugins/cryptographic/src/crypto_cipher.c
@@ -10,10 +10,10 @@
  * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
  */
 #include <assert.h>
-#include <openssl/evp.h>
-#include <openssl/hmac.h>
+
 #include "dds/ddsrt/heap.h"
 #include "dds/ddsrt/types.h"
+#include "dds/security/openssl_support.h"
 #include "crypto_defs.h"
 #include "crypto_utils.h"
 #include "crypto_cipher.h"
diff --git a/src/security/builtin_plugins/cryptographic/src/crypto_key_factory.c b/src/security/builtin_plugins/cryptographic/src/crypto_key_factory.c
index 1ce7e49..7a04865 100644
--- a/src/security/builtin_plugins/cryptographic/src/crypto_key_factory.c
+++ b/src/security/builtin_plugins/cryptographic/src/crypto_key_factory.c
@@ -11,11 +11,7 @@
  */
 #include <assert.h>
 #include <string.h>
-#include <openssl/rand.h>
-#include <openssl/sha.h>
-#include <openssl/hmac.h>
-#include <openssl/bio.h>
-#include <openssl/err.h>
+
 #include "dds/ddsrt/atomics.h"
 #include "dds/ddsrt/heap.h"
 #include "dds/ddsrt/sync.h"
@@ -25,6 +21,7 @@
 #include "dds/security/core/dds_security_utils.h"
 #include "dds/security/core/dds_security_serialize.h"
 #include "dds/security/core/shared_secret.h"
+#include "dds/security/openssl_support.h"
 #include "crypto_defs.h"
 #include "crypto_utils.h"
 #include "crypto_cipher.h"
diff --git a/src/security/builtin_plugins/cryptographic/src/crypto_transform.c b/src/security/builtin_plugins/cryptographic/src/crypto_transform.c
index 1fd32b9..58b1da3 100644
--- a/src/security/builtin_plugins/cryptographic/src/crypto_transform.c
+++ b/src/security/builtin_plugins/cryptographic/src/crypto_transform.c
@@ -12,14 +12,14 @@
 #include <assert.h>
 #include <stdint.h>
 #include <string.h>
-#include <openssl/err.h>
-#include <openssl/evp.h>
+
 #include "dds/ddsrt/bswap.h"
 #include "dds/ddsrt/endian.h"
 #include "dds/ddsrt/heap.h"
 #include "dds/ddsrt/types.h"
 #include "dds/security/dds_security_api.h"
 #include "dds/security/core/dds_security_utils.h"
+#include "dds/security/openssl_support.h"
 #include "cryptography.h"
 #include "crypto_cipher.h"
 #include "crypto_defs.h"
@@ -34,14 +34,6 @@
 #define INFO_SRC_HDR_SIZE 8
 #define RTPS_HEADER_SIZE 20
 
-#if OPENSSL_VERSION_NUMBER >= 0x10000000L && OPENSSL_VERSION_NUMBER < 0x10100000L
-#define REMOVE_THREAD_STATE() ERR_remove_thread_state(NULL);
-#elif OPENSSL_VERSION_NUMBER < 0x10000000L
-#define REMOVE_THREAD_STATE() ERR_remove_state(0);
-#else
-#define REMOVE_THREAD_STATE()
-#endif
-
 struct submsg_header
 {
   unsigned char id;
@@ -2444,23 +2436,12 @@ dds_security_crypto_transform__alloc(
   instance->base.decode_datareader_submessage = &decode_datareader_submessage;
   instance->base.decode_serialized_payload = &decode_serialized_payload;
 
-  OpenSSL_add_all_algorithms();
-  OpenSSL_add_all_ciphers();
-  OpenSSL_add_all_digests();
-  ERR_load_BIO_strings();
-  ERR_load_crypto_strings();
-
+  dds_openssl_init ();
   return (dds_security_crypto_transform *)instance;
 }
 
 void dds_security_crypto_transform__dealloc(
     dds_security_crypto_transform *instance)
 {
-  RAND_cleanup();
-  EVP_cleanup();
-  CRYPTO_cleanup_all_ex_data();
-  REMOVE_THREAD_STATE();
-  ERR_free_strings();
-
   ddsrt_free((dds_security_crypto_transform_impl *)instance);
 }
diff --git a/src/security/builtin_plugins/cryptographic/src/crypto_utils.c b/src/security/builtin_plugins/cryptographic/src/crypto_utils.c
index 12ca32e..075a8ef 100644
--- a/src/security/builtin_plugins/cryptographic/src/crypto_utils.c
+++ b/src/security/builtin_plugins/cryptographic/src/crypto_utils.c
@@ -11,16 +11,14 @@
  */
 #include <assert.h>
 #include <string.h>
-#include <openssl/bio.h>
-#include <openssl/err.h>
-#include <openssl/hmac.h>
-#include <openssl/rand.h>
+
 #include "dds/ddsrt/bswap.h"
 #include "dds/ddsrt/heap.h"
 #include "dds/ddsrt/string.h"
 #include "dds/ddsrt/types.h"
 #include "dds/security/dds_security_api.h"
 #include "dds/security/core/dds_security_utils.h"
+#include "dds/security/openssl_support.h"
 #include "crypto_defs.h"
 #include "crypto_utils.h"
 
diff --git a/src/security/builtin_plugins/tests/CMakeLists.txt b/src/security/builtin_plugins/tests/CMakeLists.txt
index 60a9704..6f26a68 100644
--- a/src/security/builtin_plugins/tests/CMakeLists.txt
+++ b/src/security/builtin_plugins/tests/CMakeLists.txt
@@ -63,30 +63,23 @@ add_cunit_executable(cunit_security_plugins ${security_auth_test_sources} ${secu
 
 target_include_directories(
   cunit_security_plugins PRIVATE
+  "$<BUILD_INTERFACE:${CMAKE_CURRENT_LIST_DIR}/../access_control/src/>"
+  "$<BUILD_INTERFACE:${CMAKE_CURRENT_LIST_DIR}/../cryptographic/src/>"
   "$<BUILD_INTERFACE:${CMAKE_BINARY_DIR}/src/include/>"
   "$<BUILD_INTERFACE:$<TARGET_PROPERTY:security_api,INTERFACE_INCLUDE_DIRECTORIES>>"
   "$<BUILD_INTERFACE:$<TARGET_PROPERTY:security_core,INTERFACE_INCLUDE_DIRECTORIES>>"
+  "$<BUILD_INTERFACE:$<TARGET_PROPERTY:security_openssl,INTERFACE_INCLUDE_DIRECTORIES>>"
   "$<BUILD_INTERFACE:$<TARGET_PROPERTY:ddsrt,INTERFACE_INCLUDE_DIRECTORIES>>"
   "$<BUILD_INTERFACE:${CMAKE_CURRENT_LIST_DIR}>"
   "$<BUILD_INTERFACE:${CMAKE_CURRENT_BINARY_DIR}>"
 )
 target_link_libraries(cunit_security_plugins PRIVATE ddsc security_api dds_security_ac dds_security_crypto)
+target_link_libraries(cunit_security_plugins PRIVATE security_openssl)
 target_link_libraries(cunit_security_plugins PRIVATE OpenSSL::SSL)
 if(CMAKE_GENERATOR MATCHES "Visual Studio")
   set_target_properties(cunit_security_plugins PROPERTIES LINK_FLAGS "/ignore:4099")
 endif()
 
-target_include_directories(
-  cunit_security_plugins PRIVATE
-      "$<BUILD_INTERFACE:${CMAKE_CURRENT_LIST_DIR}/../access_control/src/>"
-      "$<BUILD_INTERFACE:${CMAKE_CURRENT_LIST_DIR}/../cryptographic/src/>"
-      "$<BUILD_INTERFACE:$<TARGET_PROPERTY:security_api,INTERFACE_INCLUDE_DIRECTORIES>>"
-      "$<BUILD_INTERFACE:$<TARGET_PROPERTY:security_core,INTERFACE_INCLUDE_DIRECTORIES>>"
-      "$<BUILD_INTERFACE:$<TARGET_PROPERTY:ddsrt,INTERFACE_INCLUDE_DIRECTORIES>>"
-      "$<BUILD_INTERFACE:${CMAKE_CURRENT_LIST_DIR}>"
-      "$<BUILD_INTERFACE:${CMAKE_CURRENT_BINARY_DIR}>"
-)
-
 set(CUnit_builtin_plugins_tests_dir "${CMAKE_CURRENT_LIST_DIR}")
 set(CUnit_build_dir "${CMAKE_CURRENT_BINARY_DIR}")
 configure_file("config_env.h.in" "config_env.h")
diff --git a/src/security/builtin_plugins/tests/common/src/crypto_helper.c b/src/security/builtin_plugins/tests/common/src/crypto_helper.c
index 8497f80..824918b 100644
--- a/src/security/builtin_plugins/tests/common/src/crypto_helper.c
+++ b/src/security/builtin_plugins/tests/common/src/crypto_helper.c
@@ -10,10 +10,6 @@
  * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
  */
 #include <assert.h>
-#include <openssl/evp.h>
-#include <openssl/hmac.h>
-#include <openssl/bio.h>
-#include <openssl/err.h>
 
 #include "dds/ddsrt/bswap.h"
 #include "dds/ddsrt/endian.h"
@@ -25,6 +21,7 @@
 #include "dds/security/core/dds_security_serialize.h"
 #include "dds/security/core/dds_security_utils.h"
 #include "dds/security/core/shared_secret.h"
+#include "dds/security/openssl_support.h"
 #include "CUnit/CUnit.h"
 #include "CUnit/Test.h"
 #include "crypto_helper.h"
diff --git a/src/security/builtin_plugins/tests/common/src/handshake_helper.c b/src/security/builtin_plugins/tests/common/src/handshake_helper.c
index 2ff63bd..ae755f8 100644
--- a/src/security/builtin_plugins/tests/common/src/handshake_helper.c
+++ b/src/security/builtin_plugins/tests/common/src/handshake_helper.c
@@ -9,31 +9,21 @@
  *
  * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
  */
-#include "handshake_helper.h"
-#include "dds/security/core/dds_security_serialize.h"
-#include "dds/ddsrt/string.h"
-#include "dds/ddsrt/heap.h"
 #include <stdio.h>
 #include <string.h>
+#include <assert.h>
+
+#include "dds/ddsrt/string.h"
+#include "dds/ddsrt/heap.h"
 #include "dds/ddsrt/environ.h"
-#include "CUnit/CUnit.h"
-#include "CUnit/Test.h"
-#include "assert.h"
 #include "dds/ddsrt/misc.h"
 #include "dds/security/core/shared_secret.h"
-
-#if OPENSSL_VERSION_NUMBER >= 0x1000200fL
-#define AUTH_INCLUDE_EC
-#include <openssl/ec.h>
-#include <dds/security/core/dds_security_utils.h>
-
-#if OPENSSL_VERSION_NUMBER >= 0x10100000L
-#define AUTH_INCLUDE_DH_ACCESSORS
-#endif
-#else
-#error "version not found"
-#endif
-
+#include "dds/security/openssl_support.h"
+#include "dds/security/core/dds_security_serialize.h"
+#include "dds/security/core/dds_security_utils.h"
+#include "CUnit/CUnit.h"
+#include "CUnit/Test.h"
+#include "handshake_helper.h"
 
 const BIGNUM *
 dh_get_public_key(
diff --git a/src/security/builtin_plugins/tests/common/src/handshake_helper.h b/src/security/builtin_plugins/tests/common/src/handshake_helper.h
index ac3ec24..b0e3df2 100644
--- a/src/security/builtin_plugins/tests/common/src/handshake_helper.h
+++ b/src/security/builtin_plugins/tests/common/src/handshake_helper.h
@@ -15,15 +15,7 @@
 
 #include "dds/security/dds_security_api.h"
 #include "dds/security/core/dds_security_serialize.h"
-
-#include <openssl/bn.h>
-#include <openssl/asn1.h>
-#include <openssl/x509.h>
-#include <openssl/x509_vfy.h>
-#include <openssl/pem.h>
-#include <openssl/bio.h>
-#include <openssl/err.h>
-#include <openssl/evp.h>
+#include "dds/security/openssl_support.h"
 
 const BIGNUM *
 dh_get_public_key(
diff --git a/src/security/builtin_plugins/tests/create_local_datareader_crypto_tokens/src/create_local_datareader_crypto_tokens_utests.c b/src/security/builtin_plugins/tests/create_local_datareader_crypto_tokens/src/create_local_datareader_crypto_tokens_utests.c
index be6a188..014b3e2 100644
--- a/src/security/builtin_plugins/tests/create_local_datareader_crypto_tokens/src/create_local_datareader_crypto_tokens_utests.c
+++ b/src/security/builtin_plugins/tests/create_local_datareader_crypto_tokens/src/create_local_datareader_crypto_tokens_utests.c
@@ -9,11 +9,6 @@
  *
  * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
  */
-#include <openssl/evp.h>
-#include <openssl/hmac.h>
-#include <openssl/bio.h>
-#include <openssl/err.h>
-
 #include "dds/ddsrt/heap.h"
 #include "dds/ddsrt/string.h"
 #include "dds/ddsrt/types.h"
@@ -22,6 +17,7 @@
 #include "dds/security/core/dds_security_serialize.h"
 #include "dds/security/core/dds_security_utils.h"
 #include "dds/security/core/shared_secret.h"
+#include "dds/security/openssl_support.h"
 #include "CUnit/CUnit.h"
 #include "CUnit/Test.h"
 #include "common/src/loader.h"
diff --git a/src/security/builtin_plugins/tests/create_local_datawriter_crypto_tokens/src/create_local_datawriter_crypto_tokens_utests.c b/src/security/builtin_plugins/tests/create_local_datawriter_crypto_tokens/src/create_local_datawriter_crypto_tokens_utests.c
index 0913528..e29ab77 100644
--- a/src/security/builtin_plugins/tests/create_local_datawriter_crypto_tokens/src/create_local_datawriter_crypto_tokens_utests.c
+++ b/src/security/builtin_plugins/tests/create_local_datawriter_crypto_tokens/src/create_local_datawriter_crypto_tokens_utests.c
@@ -9,11 +9,6 @@
  *
  * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
  */
-#include <openssl/evp.h>
-#include <openssl/hmac.h>
-#include <openssl/bio.h>
-#include <openssl/err.h>
-
 #include "dds/ddsrt/heap.h"
 #include "dds/ddsrt/string.h"
 #include "dds/ddsrt/types.h"
@@ -22,6 +17,7 @@
 #include "dds/security/core/dds_security_serialize.h"
 #include "dds/security/core/dds_security_utils.h"
 #include "dds/security/core/shared_secret.h"
+#include "dds/security/openssl_support.h"
 #include "CUnit/CUnit.h"
 #include "CUnit/Test.h"
 #include "common/src/loader.h"
diff --git a/src/security/builtin_plugins/tests/create_local_participant_crypto_tokens/src/create_local_participant_crypto_tokens_utests.c b/src/security/builtin_plugins/tests/create_local_participant_crypto_tokens/src/create_local_participant_crypto_tokens_utests.c
index d568d58..f06138f 100644
--- a/src/security/builtin_plugins/tests/create_local_participant_crypto_tokens/src/create_local_participant_crypto_tokens_utests.c
+++ b/src/security/builtin_plugins/tests/create_local_participant_crypto_tokens/src/create_local_participant_crypto_tokens_utests.c
@@ -9,11 +9,6 @@
  *
  * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
  */
-#include <openssl/evp.h>
-#include <openssl/hmac.h>
-#include <openssl/bio.h>
-#include <openssl/err.h>
-
 #include "dds/ddsrt/heap.h"
 #include "dds/ddsrt/string.h"
 #include "dds/ddsrt/types.h"
@@ -22,6 +17,7 @@
 #include "dds/security/core/dds_security_serialize.h"
 #include "dds/security/core/dds_security_utils.h"
 #include "dds/security/core/shared_secret.h"
+#include "dds/security/openssl_support.h"
 #include "CUnit/CUnit.h"
 #include "CUnit/Test.h"
 #include "common/src/loader.h"
diff --git a/src/security/builtin_plugins/tests/decode_datareader_submessage/src/decode_datareader_submessage_utests.c b/src/security/builtin_plugins/tests/decode_datareader_submessage/src/decode_datareader_submessage_utests.c
index 6af6f07..d3e1972 100644
--- a/src/security/builtin_plugins/tests/decode_datareader_submessage/src/decode_datareader_submessage_utests.c
+++ b/src/security/builtin_plugins/tests/decode_datareader_submessage/src/decode_datareader_submessage_utests.c
@@ -9,12 +9,6 @@
  *
  * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
  */
-#include <assert.h>
-#include <openssl/evp.h>
-#include <openssl/hmac.h>
-#include <openssl/bio.h>
-#include <openssl/err.h>
-
 #include "dds/ddsrt/bswap.h"
 #include "dds/ddsrt/heap.h"
 #include "dds/ddsrt/string.h"
@@ -24,6 +18,7 @@
 #include "dds/security/core/dds_security_serialize.h"
 #include "dds/security/core/dds_security_utils.h"
 #include "dds/security/core/shared_secret.h"
+#include "dds/security/openssl_support.h"
 #include "CUnit/CUnit.h"
 #include "CUnit/Test.h"
 #include "common/src/loader.h"
diff --git a/src/security/builtin_plugins/tests/decode_datawriter_submessage/src/decode_datawriter_submessage_utests.c b/src/security/builtin_plugins/tests/decode_datawriter_submessage/src/decode_datawriter_submessage_utests.c
index 4c297fc..15e1139 100644
--- a/src/security/builtin_plugins/tests/decode_datawriter_submessage/src/decode_datawriter_submessage_utests.c
+++ b/src/security/builtin_plugins/tests/decode_datawriter_submessage/src/decode_datawriter_submessage_utests.c
@@ -10,10 +10,6 @@
  * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
  */
 #include <assert.h>
-#include <openssl/evp.h>
-#include <openssl/hmac.h>
-#include <openssl/bio.h>
-#include <openssl/err.h>
 
 #include "dds/ddsrt/bswap.h"
 #include "dds/ddsrt/heap.h"
@@ -25,6 +21,7 @@
 #include "dds/security/core/dds_security_serialize.h"
 #include "dds/security/core/dds_security_utils.h"
 #include "dds/security/core/shared_secret.h"
+#include "dds/security/openssl_support.h"
 #include "CUnit/CUnit.h"
 #include "CUnit/Test.h"
 #include "common/src/loader.h"
diff --git a/src/security/builtin_plugins/tests/decode_rtps_message/src/decode_rtps_message_utests.c b/src/security/builtin_plugins/tests/decode_rtps_message/src/decode_rtps_message_utests.c
index 0923af3..778701b 100644
--- a/src/security/builtin_plugins/tests/decode_rtps_message/src/decode_rtps_message_utests.c
+++ b/src/security/builtin_plugins/tests/decode_rtps_message/src/decode_rtps_message_utests.c
@@ -10,10 +10,6 @@
  * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
  */
 #include <assert.h>
-#include <openssl/evp.h>
-#include <openssl/hmac.h>
-#include <openssl/bio.h>
-#include <openssl/err.h>
 
 #include "dds/ddsrt/bswap.h"
 #include "dds/ddsrt/endian.h"
@@ -25,6 +21,7 @@
 #include "dds/security/core/dds_security_serialize.h"
 #include "dds/security/core/dds_security_utils.h"
 #include "dds/security/core/shared_secret.h"
+#include "dds/security/openssl_support.h"
 #include "CUnit/CUnit.h"
 #include "CUnit/Test.h"
 #include "common/src/loader.h"
diff --git a/src/security/builtin_plugins/tests/decode_serialized_payload/src/decode_serialized_payload_utests.c b/src/security/builtin_plugins/tests/decode_serialized_payload/src/decode_serialized_payload_utests.c
index 05fcf46..85a3c2d 100644
--- a/src/security/builtin_plugins/tests/decode_serialized_payload/src/decode_serialized_payload_utests.c
+++ b/src/security/builtin_plugins/tests/decode_serialized_payload/src/decode_serialized_payload_utests.c
@@ -11,11 +11,6 @@
  */
 #include <assert.h>
 
-#include <openssl/evp.h>
-#include <openssl/hmac.h>
-#include <openssl/bio.h>
-#include <openssl/err.h>
-
 #include "dds/ddsrt/bswap.h"
 #include "dds/ddsrt/heap.h"
 #include "dds/ddsrt/string.h"
@@ -25,6 +20,7 @@
 #include "dds/security/core/dds_security_serialize.h"
 #include "dds/security/core/dds_security_utils.h"
 #include "dds/security/core/shared_secret.h"
+#include "dds/security/openssl_support.h"
 #include "CUnit/CUnit.h"
 #include "CUnit/Test.h"
 #include "common/src/loader.h"
diff --git a/src/security/builtin_plugins/tests/encode_datareader_submessage/src/encode_datareader_submessage_utests.c b/src/security/builtin_plugins/tests/encode_datareader_submessage/src/encode_datareader_submessage_utests.c
index 2962aca..2924299 100644
--- a/src/security/builtin_plugins/tests/encode_datareader_submessage/src/encode_datareader_submessage_utests.c
+++ b/src/security/builtin_plugins/tests/encode_datareader_submessage/src/encode_datareader_submessage_utests.c
@@ -10,10 +10,6 @@
  * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
  */
 #include <assert.h>
-#include <openssl/evp.h>
-#include <openssl/hmac.h>
-#include <openssl/bio.h>
-#include <openssl/err.h>
 
 #include "dds/ddsrt/bswap.h"
 #include "dds/ddsrt/endian.h"
@@ -25,6 +21,7 @@
 #include "dds/security/core/dds_security_serialize.h"
 #include "dds/security/core/dds_security_utils.h"
 #include "dds/security/core/shared_secret.h"
+#include "dds/security/openssl_support.h"
 #include "CUnit/CUnit.h"
 #include "CUnit/Test.h"
 #include "common/src/loader.h"
diff --git a/src/security/builtin_plugins/tests/encode_datawriter_submessage/src/encode_datawriter_submessage_utests.c b/src/security/builtin_plugins/tests/encode_datawriter_submessage/src/encode_datawriter_submessage_utests.c
index 30a4ce4..389c27c 100644
--- a/src/security/builtin_plugins/tests/encode_datawriter_submessage/src/encode_datawriter_submessage_utests.c
+++ b/src/security/builtin_plugins/tests/encode_datawriter_submessage/src/encode_datawriter_submessage_utests.c
@@ -10,10 +10,6 @@
  * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
  */
 #include <assert.h>
-#include <openssl/evp.h>
-#include <openssl/hmac.h>
-#include <openssl/bio.h>
-#include <openssl/err.h>
 
 #include "dds/ddsrt/bswap.h"
 #include "dds/ddsrt/endian.h"
@@ -25,6 +21,7 @@
 #include "dds/security/core/dds_security_serialize.h"
 #include "dds/security/core/dds_security_utils.h"
 #include "dds/security/core/shared_secret.h"
+#include "dds/security/openssl_support.h"
 #include "CUnit/CUnit.h"
 #include "CUnit/Test.h"
 #include "common/src/loader.h"
diff --git a/src/security/builtin_plugins/tests/encode_rtps_message/src/encode_rtps_message_utests.c b/src/security/builtin_plugins/tests/encode_rtps_message/src/encode_rtps_message_utests.c
index ea77f41..c6d6244 100644
--- a/src/security/builtin_plugins/tests/encode_rtps_message/src/encode_rtps_message_utests.c
+++ b/src/security/builtin_plugins/tests/encode_rtps_message/src/encode_rtps_message_utests.c
@@ -10,10 +10,6 @@
  * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
  */
 #include <assert.h>
-#include <openssl/evp.h>
-#include <openssl/hmac.h>
-#include <openssl/bio.h>
-#include <openssl/err.h>
 
 #include "dds/ddsrt/bswap.h"
 #include "dds/ddsrt/heap.h"
@@ -24,6 +20,7 @@
 #include "dds/security/core/dds_security_serialize.h"
 #include "dds/security/core/dds_security_utils.h"
 #include "dds/security/core/shared_secret.h"
+#include "dds/security/openssl_support.h"
 #include "CUnit/CUnit.h"
 #include "CUnit/Test.h"
 #include "common/src/loader.h"
diff --git a/src/security/builtin_plugins/tests/encode_serialized_payload/src/encode_serialized_payload_utests.c b/src/security/builtin_plugins/tests/encode_serialized_payload/src/encode_serialized_payload_utests.c
index e4cd8ea..302972b 100644
--- a/src/security/builtin_plugins/tests/encode_serialized_payload/src/encode_serialized_payload_utests.c
+++ b/src/security/builtin_plugins/tests/encode_serialized_payload/src/encode_serialized_payload_utests.c
@@ -10,10 +10,6 @@
  * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
  */
 #include <assert.h>
-#include <openssl/evp.h>
-#include <openssl/hmac.h>
-#include <openssl/bio.h>
-#include <openssl/err.h>
 
 #include "dds/ddsrt/bswap.h"
 #include "dds/ddsrt/heap.h"
@@ -24,6 +20,7 @@
 #include "dds/security/core/dds_security_serialize.h"
 #include "dds/security/core/dds_security_utils.h"
 #include "dds/security/core/shared_secret.h"
+#include "dds/security/openssl_support.h"
 #include "CUnit/CUnit.h"
 #include "CUnit/Test.h"
 #include "common/src/loader.h"
diff --git a/src/security/builtin_plugins/tests/get_authenticated_peer_credential_token/src/get_authenticated_peer_credential_token_utests.c b/src/security/builtin_plugins/tests/get_authenticated_peer_credential_token/src/get_authenticated_peer_credential_token_utests.c
index 6ae66d7..28f88e2 100644
--- a/src/security/builtin_plugins/tests/get_authenticated_peer_credential_token/src/get_authenticated_peer_credential_token_utests.c
+++ b/src/security/builtin_plugins/tests/get_authenticated_peer_credential_token/src/get_authenticated_peer_credential_token_utests.c
@@ -10,32 +10,23 @@
  * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
  */
 
-/* CUnit includes. */
-
-#include "CUnit/CUnit.h"
-#include "CUnit/Test.h"
-#include "assert.h"
-/* Test helper includes. */
-#include "common/src/loader.h"
-#include "common/src/handshake_helper.h"
-
-#include "dds/security/dds_security_api.h"
-#include <openssl/opensslv.h>
-#include <openssl/sha.h>
-#include <openssl/x509.h>
-#include <openssl/pem.h>
+#include <stdio.h>
+#include <string.h>
+#include <assert.h>
 
 #include "dds/ddsrt/string.h"
 #include "dds/ddsrt/heap.h"
-#include <stdio.h>
-#include <string.h>
 #include "dds/ddsrt/environ.h"
-
 #include "dds/ddsrt/bswap.h"
 #include "dds/ddsrt/misc.h"
-#include "dds/security/core/dds_security_serialize.h"
 #include "dds/security/dds_security_api.h"
+#include "dds/security/core/dds_security_serialize.h"
 #include "dds/security/core/dds_security_utils.h"
+#include "dds/security/openssl_support.h"
+#include "CUnit/CUnit.h"
+#include "CUnit/Test.h"
+#include "common/src/loader.h"
+#include "common/src/handshake_helper.h"
 
 #define HANDSHAKE_SIGNATURE_SIZE 6
 
@@ -884,6 +875,7 @@ release_remote_identities(void)
 CU_Init(ddssec_builtin_get_authenticated_peer_credential)
 {
     int result = 0;
+    dds_openssl_init ();
 
     /* Only need the authentication plugin. */
     g_plugins = load_plugins(NULL   /* Access Control */,
diff --git a/src/security/builtin_plugins/tests/get_permissions_credential_token/src/get_permissions_credential_token_utests.c b/src/security/builtin_plugins/tests/get_permissions_credential_token/src/get_permissions_credential_token_utests.c
index bed337f..0a7c2b8 100644
--- a/src/security/builtin_plugins/tests/get_permissions_credential_token/src/get_permissions_credential_token_utests.c
+++ b/src/security/builtin_plugins/tests/get_permissions_credential_token/src/get_permissions_credential_token_utests.c
@@ -11,10 +11,6 @@
  */
 #include <assert.h>
 #include <string.h>
-#include <openssl/evp.h>
-#include <openssl/hmac.h>
-#include <openssl/bio.h>
-#include <openssl/err.h>
 
 #include "dds/ddsrt/environ.h"
 #include "dds/ddsrt/heap.h"
@@ -23,6 +19,7 @@
 #include "dds/ddsrt/types.h"
 #include "dds/security/dds_security_api.h"
 #include "dds/security/core/dds_security_utils.h"
+#include "dds/security/openssl_support.h"
 #include "CUnit/CUnit.h"
 #include "CUnit/Test.h"
 #include "common/src/loader.h"
diff --git a/src/security/builtin_plugins/tests/get_permissions_token/src/get_permissions_token_utests.c b/src/security/builtin_plugins/tests/get_permissions_token/src/get_permissions_token_utests.c
index ca4f708..5d39735 100644
--- a/src/security/builtin_plugins/tests/get_permissions_token/src/get_permissions_token_utests.c
+++ b/src/security/builtin_plugins/tests/get_permissions_token/src/get_permissions_token_utests.c
@@ -10,10 +10,6 @@
  * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
  */
 #include <assert.h>
-#include <openssl/evp.h>
-#include <openssl/hmac.h>
-#include <openssl/bio.h>
-#include <openssl/err.h>
 
 #include "dds/ddsrt/environ.h"
 #include "dds/ddsrt/heap.h"
@@ -22,6 +18,7 @@
 #include "dds/ddsrt/types.h"
 #include "dds/security/dds_security_api.h"
 #include "dds/security/core/dds_security_utils.h"
+#include "dds/security/openssl_support.h"
 #include "CUnit/CUnit.h"
 #include "CUnit/Test.h"
 #include "common/src/loader.h"
diff --git a/src/security/builtin_plugins/tests/get_xxx_sec_attributes/src/get_xxx_sec_attributes_utests.c b/src/security/builtin_plugins/tests/get_xxx_sec_attributes/src/get_xxx_sec_attributes_utests.c
index 04df354..2b0c47e 100644
--- a/src/security/builtin_plugins/tests/get_xxx_sec_attributes/src/get_xxx_sec_attributes_utests.c
+++ b/src/security/builtin_plugins/tests/get_xxx_sec_attributes/src/get_xxx_sec_attributes_utests.c
@@ -10,10 +10,6 @@
  * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
  */
 #include <assert.h>
-#include <openssl/evp.h>
-#include <openssl/hmac.h>
-#include <openssl/bio.h>
-#include <openssl/err.h>
 
 #include "dds/ddsrt/environ.h"
 #include "dds/ddsrt/heap.h"
@@ -22,6 +18,7 @@
 #include "dds/ddsrt/types.h"
 #include "dds/security/dds_security_api.h"
 #include "dds/security/core/dds_security_utils.h"
+#include "dds/security/openssl_support.h"
 #include "CUnit/CUnit.h"
 #include "CUnit/Test.h"
 #include "common/src/loader.h"
diff --git a/src/security/builtin_plugins/tests/listeners_access_control/src/listeners_access_control_utests.c b/src/security/builtin_plugins/tests/listeners_access_control/src/listeners_access_control_utests.c
index bd7eab6..5cc898a 100644
--- a/src/security/builtin_plugins/tests/listeners_access_control/src/listeners_access_control_utests.c
+++ b/src/security/builtin_plugins/tests/listeners_access_control/src/listeners_access_control_utests.c
@@ -10,12 +10,6 @@
  * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
  */
 #include <assert.h>
-#include <openssl/evp.h>
-#include <openssl/hmac.h>
-#include <openssl/bio.h>
-#include <openssl/err.h>
-#include <openssl/pkcs7.h>
-#include <openssl/pem.h>
 
 #include "dds/ddsrt/environ.h"
 #include "dds/ddsrt/heap.h"
@@ -25,19 +19,12 @@
 #include "dds/ddsrt/types.h"
 #include "dds/security/dds_security_api.h"
 #include "dds/security/core/dds_security_utils.h"
+#include "dds/security/openssl_support.h"
 #include "CUnit/CUnit.h"
 #include "CUnit/Test.h"
 #include "common/src/loader.h"
 #include "config_env.h"
 
-#if OPENSSL_VERSION_NUMBER >= 0x10000000L && OPENSSL_VERSION_NUMBER < 0x10100000L
-#define REMOVE_THREAD_STATE() ERR_remove_thread_state(NULL);
-#elif OPENSSL_VERSION_NUMBER < 0x10000000L
-#define REMOVE_THREAD_STATE() ERR_remove_state(0);
-#else
-#define REMOVE_THREAD_STATE()
-#endif
-
 static const char *ACCESS_PERMISSIONS_TOKEN_ID = "DDS:Access:Permissions:1.0";
 static const char *AUTH_PROTOCOL_CLASS_ID = "DDS:Auth:PKI-DH:1.0";
 
@@ -549,8 +536,7 @@ CU_Init(ddssec_builtin_listeners_access_control)
   } else {
     set_path_to_etc_dir();
     set_path_build_dir();
-    OpenSSL_add_all_algorithms();
-    ERR_load_crypto_strings();
+    dds_openssl_init ();
   }
 
   return res;
@@ -560,11 +546,6 @@ CU_Clean(ddssec_builtin_listeners_access_control)
 {
   unload_plugins(plugins);
   ddsrt_free(g_path_to_etc_dir);
-  EVP_cleanup();
-  CRYPTO_cleanup_all_ex_data();
-  REMOVE_THREAD_STATE();
-  ERR_free_strings();
-
   return 0;
 }
 
diff --git a/src/security/builtin_plugins/tests/listeners_authentication/src/listeners_authentication_utests.c b/src/security/builtin_plugins/tests/listeners_authentication/src/listeners_authentication_utests.c
index 7575837..fb27369 100644
--- a/src/security/builtin_plugins/tests/listeners_authentication/src/listeners_authentication_utests.c
+++ b/src/security/builtin_plugins/tests/listeners_authentication/src/listeners_authentication_utests.c
@@ -2,49 +2,23 @@
  *  @brief Unit tests for qos APIs
  *
  */
-/* CUnit includes. */
-#include "CUnit/CUnit.h"
-#include "CUnit/Test.h"
-
 #include <assert.h>
 
-/* Test helper includes. */
-#include "common/src/loader.h"
-
-#include "config_env.h"
-
 #include "dds/ddsrt/time.h"
-#include "dds/security/dds_security_api.h"
-#include "dds/security/dds_security_api_authentication.h"
 #include "dds/ddsrt/heap.h"
 #include "dds/ddsrt/string.h"
 #include "dds/ddsrt/misc.h"
 #include "dds/ddsrt/endian.h"
 #include "dds/ddsrt/io.h"
+#include "dds/security/dds_security_api.h"
+#include "dds/security/dds_security_api_authentication.h"
 #include "dds/security/core/dds_security_serialize.h"
 #include "dds/security/core/dds_security_utils.h"
-
-#include <openssl/pem.h>
-#include <openssl/pkcs7.h>
-#include <openssl/err.h>
-#include <openssl/bio.h>
-#include <openssl/x509v3.h>
-#include <openssl/opensslv.h>
-#include <openssl/sha.h>
-#include <openssl/x509.h>
-#include <openssl/pem.h>
-
-
-#if OPENSSL_VERSION_NUMBER >= 0x1000200fL
-#define AUTH_INCLUDE_EC
-#include <openssl/ec.h>
-#if OPENSSL_VERSION_NUMBER >= 0x10100000L
-#define AUTH_INCLUDE_DH_ACCESSORS
-#endif
-#else
-#error "version not found"
-#endif
-
+#include "dds/security/openssl_support.h"
+#include "CUnit/CUnit.h"
+#include "CUnit/Test.h"
+#include "common/src/loader.h"
+#include "config_env.h"
 
 static const char * ACCESS_PERMISSIONS_TOKEN_ID     = "DDS:Access:Permissions:1.0";
 static const char * AUTH_PROTOCOL_CLASS_ID          = "DDS:Auth:PKI-DH:1.0";
@@ -1119,6 +1093,7 @@ get_dh_public_key_ecdh(
 CU_Init(ddssec_builtin_listeners_auth)
 {
     int res = 0;
+    dds_openssl_init ();
 
     plugins = load_plugins(&access_control   /* Access Control */,
                            &auth  /* Authentication */,
@@ -1146,11 +1121,7 @@ CU_Init(ddssec_builtin_listeners_auth)
         res = -1;
     }
 
-    /* Openssl init */
-    OpenSSL_add_all_algorithms();
-    ERR_load_BIO_strings();
-    ERR_load_crypto_strings();
-
+    dds_openssl_init ();
     return res;
 }
 
@@ -1168,9 +1139,6 @@ CU_Clean(ddssec_builtin_listeners_auth)
     unload_plugins(plugins);
 
     ddsrt_free(path_to_etc_dir);
-    EVP_cleanup();
-    CRYPTO_cleanup_all_ex_data();
-    ERR_free_strings();
     return 0;
 }
 
diff --git a/src/security/builtin_plugins/tests/preprocess_secure_submsg/src/preprocess_secure_submsg_utests.c b/src/security/builtin_plugins/tests/preprocess_secure_submsg/src/preprocess_secure_submsg_utests.c
index 62a6973..d8c5201 100644
--- a/src/security/builtin_plugins/tests/preprocess_secure_submsg/src/preprocess_secure_submsg_utests.c
+++ b/src/security/builtin_plugins/tests/preprocess_secure_submsg/src/preprocess_secure_submsg_utests.c
@@ -9,11 +9,6 @@
  *
  * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
  */
-#include <openssl/evp.h>
-#include <openssl/hmac.h>
-#include <openssl/bio.h>
-#include <openssl/err.h>
-
 #include "dds/ddsrt/bswap.h"
 #include "dds/ddsrt/heap.h"
 #include "dds/ddsrt/string.h"
@@ -23,6 +18,7 @@
 #include "dds/security/core/dds_security_serialize.h"
 #include "dds/security/core/dds_security_utils.h"
 #include "dds/security/core/shared_secret.h"
+#include "dds/security/openssl_support.h"
 #include "CUnit/CUnit.h"
 #include "CUnit/Test.h"
 #include "common/src/loader.h"
diff --git a/src/security/builtin_plugins/tests/process_handshake/src/process_handshake_utests.c b/src/security/builtin_plugins/tests/process_handshake/src/process_handshake_utests.c
index dabd5a8..d342cfb 100644
--- a/src/security/builtin_plugins/tests/process_handshake/src/process_handshake_utests.c
+++ b/src/security/builtin_plugins/tests/process_handshake/src/process_handshake_utests.c
@@ -1,36 +1,20 @@
+#include <stdio.h>
+#include <string.h>
+#include <assert.h>
 
-
-/* CUnit includes. */
-#include "common/src/handshake_helper.h"
-
-/* Test helper includes. */
-#include "common/src/loader.h"
-
-/* Private header include */
-#include "dds/security/dds_security_api.h"
-#include "dds/security/core/dds_security_serialize.h"
-#include "dds/security/core/dds_security_utils.h"
-#include "dds/security/dds_security_api.h"
 #include "dds/ddsrt/bswap.h"
 #include "dds/ddsrt/heap.h"
 #include "dds/ddsrt/string.h"
-#include <stdio.h>
-#include <string.h>
 #include "dds/ddsrt/environ.h"
+#include "dds/security/dds_security_api.h"
+#include "dds/security/core/dds_security_serialize.h"
+#include "dds/security/core/dds_security_utils.h"
+#include "dds/security/openssl_support.h"
+#include "common/src/handshake_helper.h"
+#include "common/src/loader.h"
 #include "CUnit/CUnit.h"
 #include "CUnit/Test.h"
-#include "assert.h"
-
-#include <openssl/opensslv.h>
-#include <openssl/sha.h>
-#include <openssl/x509.h>
-#include <openssl/pem.h>
-#include <config_env.h>
-
-
-#include "dds/security/core/dds_security_serialize.h"
-#include "dds/security/dds_security_api.h"
-#include "dds/security/core/dds_security_utils.h"
+#include "config_env.h"
 
 #define HANDSHAKE_SIGNATURE_SIZE 6
 
@@ -1003,6 +987,7 @@ release_remote_identities(void)
 CU_Init(ddssec_builtin_process_handshake)
 {
     int result = 0;
+    dds_openssl_init ();
 
     /* Only need the authentication plugin. */
     plugins = load_plugins(NULL   /* Access Control */,
diff --git a/src/security/builtin_plugins/tests/register_local_datareader/src/register_local_datareader_utests.c b/src/security/builtin_plugins/tests/register_local_datareader/src/register_local_datareader_utests.c
index 503ef14..9001047 100644
--- a/src/security/builtin_plugins/tests/register_local_datareader/src/register_local_datareader_utests.c
+++ b/src/security/builtin_plugins/tests/register_local_datareader/src/register_local_datareader_utests.c
@@ -11,11 +11,6 @@
  */
 #include <assert.h>
 
-#include <openssl/evp.h>
-#include <openssl/hmac.h>
-#include <openssl/bio.h>
-#include <openssl/err.h>
-
 #include "dds/ddsrt/heap.h"
 #include "dds/ddsrt/string.h"
 #include "dds/ddsrt/types.h"
@@ -24,6 +19,7 @@
 #include "dds/security/core/dds_security_serialize.h"
 #include "dds/security/core/dds_security_utils.h"
 #include "dds/security/core/shared_secret.h"
+#include "dds/security/openssl_support.h"
 #include "CUnit/CUnit.h"
 #include "CUnit/Test.h"
 #include "common/src/loader.h"
diff --git a/src/security/builtin_plugins/tests/register_local_datawriter/src/register_local_datawriter_utests.c b/src/security/builtin_plugins/tests/register_local_datawriter/src/register_local_datawriter_utests.c
index 4830f68..80486e5 100644
--- a/src/security/builtin_plugins/tests/register_local_datawriter/src/register_local_datawriter_utests.c
+++ b/src/security/builtin_plugins/tests/register_local_datawriter/src/register_local_datawriter_utests.c
@@ -11,11 +11,6 @@
  */
 #include <assert.h>
 
-#include <openssl/evp.h>
-#include <openssl/hmac.h>
-#include <openssl/bio.h>
-#include <openssl/err.h>
-
 #include "dds/ddsrt/heap.h"
 #include "dds/ddsrt/string.h"
 #include "dds/ddsrt/types.h"
@@ -24,6 +19,7 @@
 #include "dds/security/core/dds_security_serialize.h"
 #include "dds/security/core/dds_security_utils.h"
 #include "dds/security/core/shared_secret.h"
+#include "dds/security/openssl_support.h"
 #include "CUnit/CUnit.h"
 #include "CUnit/Test.h"
 #include "common/src/loader.h"
diff --git a/src/security/builtin_plugins/tests/register_local_participant/src/register_local_participant_utests.c b/src/security/builtin_plugins/tests/register_local_participant/src/register_local_participant_utests.c
index 1602d9a..c3f39fc 100644
--- a/src/security/builtin_plugins/tests/register_local_participant/src/register_local_participant_utests.c
+++ b/src/security/builtin_plugins/tests/register_local_participant/src/register_local_participant_utests.c
@@ -11,11 +11,6 @@
  */
 #include <assert.h>
 
-#include <openssl/evp.h>
-#include <openssl/hmac.h>
-#include <openssl/bio.h>
-#include <openssl/err.h>
-
 #include "dds/ddsrt/heap.h"
 #include "dds/ddsrt/string.h"
 #include "dds/ddsrt/types.h"
@@ -24,6 +19,7 @@
 #include "dds/security/core/dds_security_serialize.h"
 #include "dds/security/core/dds_security_utils.h"
 #include "dds/security/core/shared_secret.h"
+#include "dds/security/openssl_support.h"
 #include "CUnit/CUnit.h"
 #include "CUnit/Test.h"
 #include "common/src/loader.h"
diff --git a/src/security/builtin_plugins/tests/register_matched_remote_datareader/src/register_matched_remote_datareader_utests.c b/src/security/builtin_plugins/tests/register_matched_remote_datareader/src/register_matched_remote_datareader_utests.c
index 2f0eadb..1ed3591 100644
--- a/src/security/builtin_plugins/tests/register_matched_remote_datareader/src/register_matched_remote_datareader_utests.c
+++ b/src/security/builtin_plugins/tests/register_matched_remote_datareader/src/register_matched_remote_datareader_utests.c
@@ -11,11 +11,6 @@
  */
 #include <assert.h>
 
-#include <openssl/evp.h>
-#include <openssl/hmac.h>
-#include <openssl/bio.h>
-#include <openssl/err.h>
-
 #include "dds/ddsrt/heap.h"
 #include "dds/ddsrt/string.h"
 #include "dds/ddsrt/types.h"
@@ -24,6 +19,7 @@
 #include "dds/security/core/dds_security_serialize.h"
 #include "dds/security/core/dds_security_utils.h"
 #include "dds/security/core/shared_secret.h"
+#include "dds/security/openssl_support.h"
 #include "CUnit/CUnit.h"
 #include "CUnit/Test.h"
 #include "common/src/loader.h"
diff --git a/src/security/builtin_plugins/tests/register_matched_remote_datawriter/src/register_matched_remote_datawriter_utests.c b/src/security/builtin_plugins/tests/register_matched_remote_datawriter/src/register_matched_remote_datawriter_utests.c
index c9dc669..6e4ac1a 100644
--- a/src/security/builtin_plugins/tests/register_matched_remote_datawriter/src/register_matched_remote_datawriter_utests.c
+++ b/src/security/builtin_plugins/tests/register_matched_remote_datawriter/src/register_matched_remote_datawriter_utests.c
@@ -11,11 +11,6 @@
  */
 #include <assert.h>
 
-#include <openssl/evp.h>
-#include <openssl/hmac.h>
-#include <openssl/bio.h>
-#include <openssl/err.h>
-
 #include "dds/ddsrt/heap.h"
 #include "dds/ddsrt/string.h"
 #include "dds/ddsrt/types.h"
@@ -24,6 +19,7 @@
 #include "dds/security/core/dds_security_serialize.h"
 #include "dds/security/core/dds_security_utils.h"
 #include "dds/security/core/shared_secret.h"
+#include "dds/security/openssl_support.h"
 #include "CUnit/CUnit.h"
 #include "CUnit/Test.h"
 #include "common/src/loader.h"
diff --git a/src/security/builtin_plugins/tests/register_matched_remote_participant/src/register_matched_remote_participant_utests.c b/src/security/builtin_plugins/tests/register_matched_remote_participant/src/register_matched_remote_participant_utests.c
index 2402697..43b4c53 100644
--- a/src/security/builtin_plugins/tests/register_matched_remote_participant/src/register_matched_remote_participant_utests.c
+++ b/src/security/builtin_plugins/tests/register_matched_remote_participant/src/register_matched_remote_participant_utests.c
@@ -9,11 +9,6 @@
  *
  * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
  */
-#include <openssl/evp.h>
-#include <openssl/hmac.h>
-#include <openssl/bio.h>
-#include <openssl/err.h>
-
 #include "dds/ddsrt/heap.h"
 #include "dds/ddsrt/string.h"
 #include "dds/ddsrt/types.h"
@@ -22,6 +17,7 @@
 #include "dds/security/core/dds_security_serialize.h"
 #include "dds/security/core/dds_security_utils.h"
 #include "dds/security/core/shared_secret.h"
+#include "dds/security/openssl_support.h"
 #include "CUnit/CUnit.h"
 #include "CUnit/Test.h"
 #include "common/src/loader.h"
diff --git a/src/security/builtin_plugins/tests/set_remote_datareader_crypto_tokens/src/set_remote_datareader_crypto_tokens_utests.c b/src/security/builtin_plugins/tests/set_remote_datareader_crypto_tokens/src/set_remote_datareader_crypto_tokens_utests.c
index 68e3448..5cdb615 100644
--- a/src/security/builtin_plugins/tests/set_remote_datareader_crypto_tokens/src/set_remote_datareader_crypto_tokens_utests.c
+++ b/src/security/builtin_plugins/tests/set_remote_datareader_crypto_tokens/src/set_remote_datareader_crypto_tokens_utests.c
@@ -9,11 +9,6 @@
  *
  * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
  */
-#include <openssl/evp.h>
-#include <openssl/hmac.h>
-#include <openssl/bio.h>
-#include <openssl/err.h>
-
 #include "dds/ddsrt/heap.h"
 #include "dds/ddsrt/string.h"
 #include "dds/ddsrt/types.h"
@@ -22,6 +17,7 @@
 #include "dds/security/core/dds_security_serialize.h"
 #include "dds/security/core/dds_security_utils.h"
 #include "dds/security/core/shared_secret.h"
+#include "dds/security/openssl_support.h"
 #include "CUnit/CUnit.h"
 #include "CUnit/Test.h"
 #include "common/src/loader.h"
diff --git a/src/security/builtin_plugins/tests/set_remote_datawriter_crypto_tokens/src/set_remote_datawriter_crypto_tokens_utests.c b/src/security/builtin_plugins/tests/set_remote_datawriter_crypto_tokens/src/set_remote_datawriter_crypto_tokens_utests.c
index a223604..5816149 100644
--- a/src/security/builtin_plugins/tests/set_remote_datawriter_crypto_tokens/src/set_remote_datawriter_crypto_tokens_utests.c
+++ b/src/security/builtin_plugins/tests/set_remote_datawriter_crypto_tokens/src/set_remote_datawriter_crypto_tokens_utests.c
@@ -9,11 +9,6 @@
  *
  * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
  */
-#include <openssl/evp.h>
-#include <openssl/hmac.h>
-#include <openssl/bio.h>
-#include <openssl/err.h>
-
 #include "dds/ddsrt/heap.h"
 #include "dds/ddsrt/string.h"
 #include "dds/ddsrt/types.h"
@@ -22,6 +17,7 @@
 #include "dds/security/core/dds_security_serialize.h"
 #include "dds/security/core/dds_security_utils.h"
 #include "dds/security/core/shared_secret.h"
+#include "dds/security/openssl_support.h"
 #include "CUnit/CUnit.h"
 #include "CUnit/Test.h"
 #include "common/src/loader.h"
diff --git a/src/security/builtin_plugins/tests/set_remote_participant_crypto_tokens/src/set_remote_participant_crypto_tokens_utests.c b/src/security/builtin_plugins/tests/set_remote_participant_crypto_tokens/src/set_remote_participant_crypto_tokens_utests.c
index 433b8fc..ddaf325 100644
--- a/src/security/builtin_plugins/tests/set_remote_participant_crypto_tokens/src/set_remote_participant_crypto_tokens_utests.c
+++ b/src/security/builtin_plugins/tests/set_remote_participant_crypto_tokens/src/set_remote_participant_crypto_tokens_utests.c
@@ -9,11 +9,6 @@
  *
  * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
  */
-#include <openssl/evp.h>
-#include <openssl/hmac.h>
-#include <openssl/bio.h>
-#include <openssl/err.h>
-
 #include "dds/ddsrt/heap.h"
 #include "dds/ddsrt/string.h"
 #include "dds/ddsrt/types.h"
@@ -22,6 +17,7 @@
 #include "dds/security/core/dds_security_serialize.h"
 #include "dds/security/core/dds_security_utils.h"
 #include "dds/security/core/shared_secret.h"
+#include "dds/security/openssl_support.h"
 #include "CUnit/CUnit.h"
 #include "CUnit/Test.h"
 #include "common/src/loader.h"
diff --git a/src/security/builtin_plugins/tests/validate_begin_handshake_reply/src/validate_begin_handshake_reply_utests.c b/src/security/builtin_plugins/tests/validate_begin_handshake_reply/src/validate_begin_handshake_reply_utests.c
index e8f5259..bd2021b 100644
--- a/src/security/builtin_plugins/tests/validate_begin_handshake_reply/src/validate_begin_handshake_reply_utests.c
+++ b/src/security/builtin_plugins/tests/validate_begin_handshake_reply/src/validate_begin_handshake_reply_utests.c
@@ -1,35 +1,19 @@
+#include <stdio.h>
+#include <string.h>
+#include <assert.h>
 
-
-
-
-/* CUnit includes. */
-
-
-/* Test helper includes. */
-#include "common/src/loader.h"
-#include "config_env.h"
-
-/* Private header include */
-#include <openssl/opensslv.h>
-#include <openssl/sha.h>
-#include <openssl/x509.h>
-#include <openssl/pem.h>
-#include <openssl/asn1.h>
-#include <openssl/err.h>
-
-#include "dds/security/dds_security_api.h"
+#include "dds/ddsrt/heap.h"
+#include "dds/ddsrt/string.h"
+#include "dds/ddsrt/bswap.h"
+#include "dds/ddsrt/environ.h"
 #include "dds/security/core/dds_security_serialize.h"
 #include "dds/security/core/dds_security_utils.h"
 #include "dds/security/dds_security_api.h"
-#include "dds/ddsrt/heap.h"
-#include "dds/ddsrt/string.h"
-#include <stdio.h>
-#include <string.h>
-#include "dds/ddsrt/bswap.h"
-#include "dds/ddsrt/environ.h"
+#include "dds/security/openssl_support.h"
 #include "CUnit/CUnit.h"
 #include "CUnit/Test.h"
-#include "assert.h"
+#include "common/src/loader.h"
+#include "config_env.h"
 
 static const char * AUTH_PROTOCOL_CLASS_ID          = "DDS:Auth:PKI-DH:1.0";
 static const char * PERM_ACCESS_CLASS_ID            = "DDS:Access:Permissions:1.0";
diff --git a/src/security/builtin_plugins/tests/validate_begin_handshake_request/src/validate_begin_handshake_request_utests.c b/src/security/builtin_plugins/tests/validate_begin_handshake_request/src/validate_begin_handshake_request_utests.c
index 5137565..0c1b198 100644
--- a/src/security/builtin_plugins/tests/validate_begin_handshake_request/src/validate_begin_handshake_request_utests.c
+++ b/src/security/builtin_plugins/tests/validate_begin_handshake_request/src/validate_begin_handshake_request_utests.c
@@ -22,6 +22,10 @@
 
 /* Private header include */
 
+#ifdef _WIN32
+/* supposedly WinSock2 must be included before openssl 1.0.2 headers otherwise winsock will be used */
+#include <WinSock2.h>
+#endif
 #include <openssl/opensslv.h>
 
 static const char * AUTH_PROTOCOL_CLASS_ID          = "DDS:Auth:PKI-DH:1.0";
diff --git a/src/security/builtin_plugins/tests/validate_local_identity/src/validate_local_identity_utests.c b/src/security/builtin_plugins/tests/validate_local_identity/src/validate_local_identity_utests.c
index 721e854..2d27668 100644
--- a/src/security/builtin_plugins/tests/validate_local_identity/src/validate_local_identity_utests.c
+++ b/src/security/builtin_plugins/tests/validate_local_identity/src/validate_local_identity_utests.c
@@ -16,7 +16,8 @@
 
 
 #include "dds/security/dds_security_api.h"
-#include <openssl/opensslv.h>
+#include "dds/security/openssl_support.h"
+
 #include <dds/ddsrt/heap.h>
 #include <dds/ddsrt/string.h>
 #include <config_env.h>
diff --git a/src/security/builtin_plugins/tests/validate_local_permissions/src/validate_local_permissions_utests.c b/src/security/builtin_plugins/tests/validate_local_permissions/src/validate_local_permissions_utests.c
index f0a4cb5..2db3d15 100644
--- a/src/security/builtin_plugins/tests/validate_local_permissions/src/validate_local_permissions_utests.c
+++ b/src/security/builtin_plugins/tests/validate_local_permissions/src/validate_local_permissions_utests.c
@@ -10,10 +10,6 @@
  * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
  */
 #include <assert.h>
-#include <openssl/evp.h>
-#include <openssl/hmac.h>
-#include <openssl/bio.h>
-#include <openssl/err.h>
 
 #include "dds/ddsrt/environ.h"
 #include "dds/ddsrt/heap.h"
@@ -22,6 +18,7 @@
 #include "dds/ddsrt/types.h"
 #include "dds/security/dds_security_api.h"
 #include "dds/security/core/dds_security_utils.h"
+#include "dds/security/openssl_support.h"
 #include "CUnit/CUnit.h"
 #include "CUnit/Test.h"
 #include "common/src/loader.h"
diff --git a/src/security/builtin_plugins/tests/validate_remote_permissions/src/validate_remote_permissions_utests.c b/src/security/builtin_plugins/tests/validate_remote_permissions/src/validate_remote_permissions_utests.c
index 84c413f..700a38a 100644
--- a/src/security/builtin_plugins/tests/validate_remote_permissions/src/validate_remote_permissions_utests.c
+++ b/src/security/builtin_plugins/tests/validate_remote_permissions/src/validate_remote_permissions_utests.c
@@ -10,10 +10,6 @@
  * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
  */
 #include <assert.h>
-#include <openssl/evp.h>
-#include <openssl/hmac.h>
-#include <openssl/bio.h>
-#include <openssl/err.h>
 
 #include "dds/ddsrt/environ.h"
 #include "dds/ddsrt/heap.h"
@@ -22,6 +18,7 @@
 #include "dds/ddsrt/types.h"
 #include "dds/security/dds_security_api.h"
 #include "dds/security/core/dds_security_utils.h"
+#include "dds/security/openssl_support.h"
 #include "CUnit/CUnit.h"
 #include "CUnit/Test.h"
 #include "common/src/loader.h"
diff --git a/src/security/core/include/dds/security/core/dds_security_utils.h b/src/security/core/include/dds/security/core/dds_security_utils.h
index 21ac8fc..e56a5f9 100644
--- a/src/security/core/include/dds/security/core/dds_security_utils.h
+++ b/src/security/core/include/dds/security/core/dds_security_utils.h
@@ -17,6 +17,7 @@
 #include <stdarg.h>
 #include <stdint.h>
 #include <stdbool.h>
+
 #include "dds/export.h"
 #include "dds/ddsrt/strtol.h"
 #include "dds/ddsrt/time.h"
@@ -280,17 +281,6 @@ DDS_Security_Exception_set(
          const char *fmt,
          ...);
 
-
-#ifdef DDSI_INCLUDE_SSL
-DDS_EXPORT void
-DDS_Security_Exception_set_with_openssl_error(
-         DDS_Security_SecurityException *ex,
-         const char *context,
-         int code,
-         int minor_code,
-         const char *fmt);
-#endif
-
 DDS_EXPORT void
 DDS_Security_Exception_reset(
          DDS_Security_SecurityException *ex);
diff --git a/src/security/core/src/dds_security_utils.c b/src/security/core/src/dds_security_utils.c
index 0d3742a..5bf7843 100644
--- a/src/security/core/src/dds_security_utils.c
+++ b/src/security/core/src/dds_security_utils.c
@@ -13,19 +13,14 @@
 #include <assert.h>
 #include <string.h>
 #include <stdarg.h>
+#include <stdlib.h>
 #include <stdio.h>
+
+#include "dds/ddsrt/string.h"
+#include "dds/ddsrt/misc.h"
 #include "dds/security/dds_security_api.h"
 #include "dds/security/core/dds_security_utils.h"
 #include "dds/ddsrt/heap.h"
-#include "stdlib.h"
-#include "stdarg.h"
-#include "dds/ddsrt/string.h"
-#include "dds/ddsrt/misc.h"
-
-#ifdef DDSI_INCLUDE_SSL
-#include <openssl/bio.h>
-#include <openssl/err.h>
-#endif
 
 DDS_Security_BinaryProperty_t *
 DDS_Security_BinaryProperty_alloc (void)
@@ -805,40 +800,6 @@ void DDS_Security_Exception_set (DDS_Security_SecurityException *ex, const char
   va_end(args1);
 }
 
-#ifdef DDSI_INCLUDE_SSL
-DDS_EXPORT void
-DDS_Security_Exception_set_with_openssl_error(
-    DDS_Security_SecurityException *ex,
-    const char *context,
-    int code,
-    int minor_code,
-    const char *error_area)
-{
-    BIO *bio;
-    assert(context);
-    assert(error_area);
-    assert(ex);
-    DDSRT_UNUSED_ARG(context);
-
-    if ((bio = BIO_new(BIO_s_mem()))) {
-        ERR_print_errors(bio);
-        char *buf = NULL;
-        size_t len = (size_t)BIO_get_mem_data(bio, &buf);
-        size_t exception_msg_len = len + strlen(error_area) + 1;
-        char *str = ddsrt_malloc(exception_msg_len);
-        ddsrt_strlcpy(str, error_area, exception_msg_len);
-        memcpy(str + strlen(error_area), buf, len);
-        str[exception_msg_len - 1] = '\0';
-        ex->message = str;
-        ex->code = code;
-        ex->minor_code = minor_code;
-        BIO_free(bio);
-    } else {
-        DDS_Security_Exception_set(ex, context, code, minor_code, "BIO_new failed");
-    }
-}
-#endif
-
 void
 DDS_Security_Exception_reset(
     DDS_Security_SecurityException *ex)
diff --git a/src/security/core/tests/CMakeLists.txt b/src/security/core/tests/CMakeLists.txt
index 19fc14a..a1aaa93 100644
--- a/src/security/core/tests/CMakeLists.txt
+++ b/src/security/core/tests/CMakeLists.txt
@@ -102,6 +102,12 @@ target_include_directories(
         "$<BUILD_INTERFACE:${CMAKE_CURRENT_SOURCE_DIR}/../../../core/ddsi/include>"
         "$<BUILD_INTERFACE:${CMAKE_CURRENT_SOURCE_DIR}/../../../core/ddsc/src>"
  )
+if(ENABLE_SSL)
+  target_include_directories(
+    cunit_security_core PRIVATE
+      "$<BUILD_INTERFACE:$<TARGET_PROPERTY:security_openssl,INTERFACE_INCLUDE_DIRECTORIES>>"
+  )
+endif()
 
 set(common_etc_dir "${CMAKE_CURRENT_SOURCE_DIR}/common/etc")
 set(plugin_wrapper_lib_dir "${CMAKE_CURRENT_BINARY_DIR}")
@@ -111,5 +117,6 @@ target_link_libraries(cunit_security_core PRIVATE ddsc security_api SecurityCore
 if(ENABLE_SSL)
   target_link_libraries(cunit_security_core PRIVATE dds_security_auth dds_security_ac dds_security_crypto dds_security_access_control_wrapper dds_security_authentication_wrapper dds_security_cryptography_wrapper)
   target_link_libraries(cunit_security_core PRIVATE OpenSSL::SSL)
+  target_link_libraries(cunit_security_core PRIVATE security_openssl)
 endif()
 target_include_directories(cunit_security_core PRIVATE "${CMAKE_CURRENT_BINARY_DIR}")
diff --git a/src/security/core/tests/common/cert_utils.c b/src/security/core/tests/common/cert_utils.c
index f2e7386..fbaf7a9 100644
--- a/src/security/core/tests/common/cert_utils.c
+++ b/src/security/core/tests/common/cert_utils.c
@@ -12,15 +12,10 @@
 
 #include <stdlib.h>
 #include <string.h>
-#include <openssl/asn1.h>
-#include <openssl/bio.h>
-#include <openssl/conf.h>
-#include <openssl/err.h>
-#include <openssl/pem.h>
-#include <openssl/x509.h>
 
 #include "dds/ddsrt/heap.h"
 #include "dds/ddsrt/string.h"
+#include "dds/security/openssl_support.h"
 #include "CUnit/Test.h"
 #include "cert_utils.h"
 
diff --git a/src/security/core/tests/common/security_config_test_utils.c b/src/security/core/tests/common/security_config_test_utils.c
index ea8158b..bde2eee 100644
--- a/src/security/core/tests/common/security_config_test_utils.c
+++ b/src/security/core/tests/common/security_config_test_utils.c
@@ -12,12 +12,6 @@
 
 #include <stdlib.h>
 #include <string.h>
-#include <openssl/asn1.h>
-#include <openssl/bio.h>
-#include <openssl/conf.h>
-#include <openssl/err.h>
-#include <openssl/pem.h>
-#include <openssl/x509.h>
 
 #include "CUnit/Test.h"
 #include "dds/dds.h"
@@ -26,6 +20,7 @@
 #include "dds/ddsrt/heap.h"
 #include "dds/ddsrt/string.h"
 #include "dds/ddsrt/io.h"
+#include "dds/security/openssl_support.h"
 #include "common/config_env.h"
 #include "common/test_utils.h"
 #include "security_config_test_utils.h"
@@ -160,6 +155,8 @@ static char * get_xml_datetime(dds_time_t t, char * buf, size_t len)
 
 static char * smime_sign(char * ca_cert_path, char * ca_priv_key_path, const char * data)
 {
+  dds_openssl_init ();
+
   // Read CA certificate
   BIO *ca_cert_bio = BIO_new (BIO_s_file ());
   if (BIO_read_filename (ca_cert_bio, ca_cert_path) <= 0)
diff --git a/src/security/openssl/CMakeLists.txt b/src/security/openssl/CMakeLists.txt
new file mode 100644
index 0000000..ebcbfc9
--- /dev/null
+++ b/src/security/openssl/CMakeLists.txt
@@ -0,0 +1,21 @@
+#
+# Copyright(c) 2020 ADLINK Technology Limited and others
+#
+# This program and the accompanying materials are made available under the
+# terms of the Eclipse Public License v. 2.0 which is available at
+# http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+# v. 1.0 which is available at
+# http://www.eclipse.org/org/documents/edl-v10.php.
+#
+# SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+#
+
+add_library(security_openssl INTERFACE)
+
+target_sources(security_openssl INTERFACE
+  "${CMAKE_CURRENT_SOURCE_DIR}/src/openssl_support.c")
+
+target_include_directories(
+  security_openssl INTERFACE
+    "$<BUILD_INTERFACE:${CMAKE_CURRENT_SOURCE_DIR}/include>"
+)
diff --git a/src/security/openssl/include/dds/security/openssl_support.h b/src/security/openssl/include/dds/security/openssl_support.h
new file mode 100644
index 0000000..a6cf7d8
--- /dev/null
+++ b/src/security/openssl/include/dds/security/openssl_support.h
@@ -0,0 +1,80 @@
+/*
+ * Copyright(c) 2020 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+
+#ifndef DDS_OPENSSL_SUPPORT_H
+#define DDS_OPENSSL_SUPPORT_H
+
+#include "dds/security/dds_security_api_types.h"
+
+/* There's OpenSSL 1.1.x and there's OpenSSL 1.0.2 and the difference is like
+   night and day: 1.1.0 deprecated all the initialization and cleanup routines
+   and so any library can link with OpenSSL and use it safely without breaking
+   the application code or some other library in the same process.
+
+   OpenSSL 1.0.2h deprecated the cleanup functions such as EVP_cleanup because
+   calling the initialisation functions multiple times was survivable, but an
+   premature invocation of the cleanup functions deadly. It still has the per-
+   thread error state that one ought to clean up, but that firstly requires
+   keeping track of which threads make OpenSSL calls, and secondly we do
+   perform OpenSSL calls on the applications main-thread and so cleaning up
+   might interfere with the application code.
+
+   Compatibility with 1.0.2 exists merely as a courtesy to those who insist on
+   using it with that problematic piece of code. We only initialise it, and we
+   don't clean up thread state. If Cyclone DDS is the only part of the process
+   that uses OpenSSL, it should be ok (just some some minor leaks at the end),
+   if the application code or another library also uses it, it'll probably be
+   fine too. */
+
+#ifdef _WIN32
+/* WinSock2 must be included before openssl 1.0.2 headers otherwise winsock will be used */
+#include <WinSock2.h>
+#endif
+
+#include <openssl/opensslv.h>
+#include <openssl/opensslconf.h>
+#include <openssl/asn1.h>
+#include <openssl/bio.h>
+#include <openssl/conf.h>
+
+#if OPENSSL_VERSION_NUMBER >= 0x1000200fL
+#define AUTH_INCLUDE_EC
+#include <openssl/ec.h>
+#if OPENSSL_VERSION_NUMBER >= 0x10100000L
+#define AUTH_INCLUDE_DH_ACCESSORS
+#endif
+#else
+#error "OpenSSL version is not supported"
+#endif
+
+#include <openssl/err.h>
+#include <openssl/evp.h>
+#include <openssl/hmac.h>
+#include <openssl/rand.h>
+#include <openssl/sha.h>
+#include <openssl/pem.h>
+#include <openssl/pkcs7.h>
+#include <openssl/x509.h>
+#include <openssl/x509v3.h>
+#include <openssl/x509_vfy.h>
+
+void dds_openssl_init (void);
+
+#if OPENSSL_VERSION_NUMBER < 0x10100000L
+/* 1.1.0 has it as a supported API. 1.0.2 has it in practice and since that has been
+   obsolete for ages, chances are that we can safely use it */
+struct tm *OPENSSL_gmtime(const time_t *timer, struct tm *result);
+#endif
+
+void DDS_Security_Exception_set_with_openssl_error (DDS_Security_SecurityException *ex, const char *context, int code, int minor_code, const char *error_area);
+
+#endif
diff --git a/src/security/openssl/src/openssl_support.c b/src/security/openssl/src/openssl_support.c
new file mode 100644
index 0000000..a212439
--- /dev/null
+++ b/src/security/openssl/src/openssl_support.c
@@ -0,0 +1,127 @@
+/*
+ * Copyright(c) 2020 ADLINK Technology Limited and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0, or the Eclipse Distribution License
+ * v. 1.0 which is available at
+ * http://www.eclipse.org/org/documents/edl-v10.php.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
+ */
+#include <string.h>
+#include "dds/ddsrt/heap.h"
+#include "dds/ddsrt/sync.h"
+#include "dds/ddsrt/misc.h"
+#include "dds/ddsrt/string.h"
+#include "dds/ddsrt/threads.h"
+#include "dds/ddsrt/atomics.h"
+#include "dds/security/core/dds_security_utils.h"
+#include "dds/security/openssl_support.h"
+
+#if OPENSSL_VERSION_NUMBER < 0x10100000L
+static unsigned long ssl_id (void)
+{
+  return (unsigned long) ddsrt_gettid ();
+}
+
+typedef struct CRYPTO_dynlock_value {
+  ddsrt_mutex_t m_mutex;
+} CRYPTO_dynlock_value;
+
+CRYPTO_dynlock_value *dds_openssl102_ssl_locks = NULL;
+
+static void ssl_dynlock_lock (int mode, CRYPTO_dynlock_value *lock, const char *file, int line)
+{
+  (void) file;
+  (void) line;
+  if (mode & CRYPTO_LOCK)
+    ddsrt_mutex_lock (&lock->m_mutex);
+  else
+    ddsrt_mutex_unlock (&lock->m_mutex);
+}
+
+static void ssl_lock (int mode, int n, const char *file, int line)
+{
+  ssl_dynlock_lock (mode, &dds_openssl102_ssl_locks[n], file, line);
+}
+
+static CRYPTO_dynlock_value *ssl_dynlock_create (const char *file, int line)
+{
+  (void) file;
+  (void) line;
+  CRYPTO_dynlock_value *val = ddsrt_malloc (sizeof (*val));
+  ddsrt_mutex_init (&val->m_mutex);
+  return val;
+}
+
+static void ssl_dynlock_destroy (CRYPTO_dynlock_value *lock, const char *file, int line)
+{
+  (void) file;
+  (void) line;
+  ddsrt_mutex_destroy (&lock->m_mutex);
+  ddsrt_free (lock);
+}
+
+void dds_openssl_init (void)
+{
+  // This is terribly fragile and broken-by-design, but with OpenSSL sometimes
+  // linked dynamically and sometimes linked statically, with Windows and Unix
+  // in the mix, this appears to be the compromise that makes it work reliably
+  // enough ...
+  if (CRYPTO_get_id_callback () == 0)
+  {
+    CRYPTO_set_id_callback (ssl_id);
+    CRYPTO_set_locking_callback (ssl_lock);
+    CRYPTO_set_dynlock_create_callback (ssl_dynlock_create);
+    CRYPTO_set_dynlock_lock_callback (ssl_dynlock_lock);
+    CRYPTO_set_dynlock_destroy_callback (ssl_dynlock_destroy);
+
+    if (dds_openssl102_ssl_locks == NULL)
+    {
+      const int locks = CRYPTO_num_locks ();
+      assert (locks >= 0);
+      dds_openssl102_ssl_locks = ddsrt_malloc (sizeof (CRYPTO_dynlock_value) * (size_t) locks);
+      for (int i = 0; i < locks; i++)
+        ddsrt_mutex_init (&dds_openssl102_ssl_locks[i].m_mutex);
+    }
+
+    OpenSSL_add_all_algorithms ();
+    OpenSSL_add_all_ciphers ();
+    OpenSSL_add_all_digests ();
+    ERR_load_BIO_strings ();
+    ERR_load_crypto_strings ();
+  }
+}
+#else
+void dds_openssl_init (void)
+{
+  // nothing needed for OpenSSL 1.1.0 and later
+}
+#endif
+
+void DDS_Security_Exception_set_with_openssl_error (DDS_Security_SecurityException *ex, const char *context, int code, int minor_code, const char *error_area)
+{
+  BIO *bio;
+  assert (context);
+  assert (error_area);
+  assert (ex);
+  DDSRT_UNUSED_ARG (context);
+
+  if ((bio = BIO_new (BIO_s_mem ()))) {
+    ERR_print_errors (bio);
+    char *buf = NULL;
+    size_t len = (size_t) BIO_get_mem_data (bio, &buf);
+    size_t exception_msg_len = len + strlen (error_area) + 1;
+    char *str = ddsrt_malloc (exception_msg_len);
+    ddsrt_strlcpy (str, error_area, exception_msg_len);
+    memcpy (str + strlen (error_area), buf, len);
+    str[exception_msg_len - 1] = '\0';
+    ex->message = str;
+    ex->code = code;
+    ex->minor_code = minor_code;
+    BIO_free (bio);
+  } else {
+    DDS_Security_Exception_set (ex, context, code, minor_code, "BIO_new failed");
+  }
+}

From 7c7814e878ec5a4534d3ad210cfc65acda9cfa82 Mon Sep 17 00:00:00 2001
From: Erik Boasson <eb@ilities.com>
Date: Mon, 25 May 2020 10:46:24 +0200
Subject: [PATCH 237/238] Include OpenSSL 1.0.2 in CI

Signed-off-by: Erik Boasson <eb@ilities.com>
---
 .travis.yml      | 6 ++++--
 conanfile102.txt | 6 ++++++
 2 files changed, 10 insertions(+), 2 deletions(-)
 create mode 100644 conanfile102.txt

diff --git a/.travis.yml b/.travis.yml
index b0032c7..65b4303 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -147,6 +147,8 @@ jobs:
       if: type = cron
     - <<: *linux_gcc8
       env: [ ARCH=x86_64, ASAN=none, BUILD_TYPE=Debug, SSL=YES, SECURITY=YES, LIFESPAN=YES, DEADLINE=YES, GENERATOR="Unix Makefiles" ]
+    - <<: *linux_gcc8
+      env: [ ARCH=x86_64, ASAN=none, BUILD_TYPE=Debug, SSL=YES, SECURITY=YES, LIFESPAN=YES, DEADLINE=YES, GENERATOR="Unix Makefiles", CONANFILE=conanfile102.txt ]
     - <<: *linux_gcc8
       env: [ ARCH=x86_64, ASAN=none, BUILD_TYPE=Release, SSL=YES, SECURITY=YES, LIFESPAN=YES, DEADLINE=YES, GENERATOR="Unix Makefiles" ]
     - <<: *linux_gcc8
@@ -167,7 +169,7 @@ jobs:
     - <<: *osx_xcode
       env: [ ARCH=x86_64, ASAN=none, BUILD_TYPE=Release, SSL=YES, SECURITY=YES, LIFESPAN=YES, DEADLINE=YES, GENERATOR="Unix Makefiles" ]
     - <<: *windows_vs2017
-      env: [ ARCH=x86, ASAN=none, BUILD_TYPE=Debug, SSL=YES, SECURITY=YES, LIFESPAN=YES, DEADLINE=YES, GENERATOR="Visual Studio 15 2017" ]
+      env: [ ARCH=x86, ASAN=none, BUILD_TYPE=Debug, SSL=YES, SECURITY=YES, LIFESPAN=YES, DEADLINE=YES, GENERATOR="Visual Studio 15 2017", CONANFILE=conanfile102.txt ]
     - <<: *windows_vs2017
       env: [ ARCH=x86_64, ASAN=none, BUILD_TYPE=Debug, SSL=YES, SECURITY=YES, LIFESPAN=YES, DEADLINE=YES, GENERATOR="Visual Studio 15 2017 Win64" ]
     - <<: *windows_vs2017
@@ -197,7 +199,7 @@ script:
   - INSTALLPREFIX="$(pwd)/install"
   - mkdir build
   - cd build
-  - conan install -b missing -s arch=${ARCH} -s build_type=${BUILD_TYPE} ..
+  - conan install -b missing -s arch=${ARCH} -s build_type=${BUILD_TYPE} ../${CONANFILE:-conanfile.txt}
   - which trang && BUILD_SCHEMA=1 || BUILD_SCHEMA=0
   - cmake -DCMAKE_BUILD_TYPE=${BUILD_TYPE}
           -DCMAKE_INSTALL_PREFIX=${INSTALLPREFIX}
diff --git a/conanfile102.txt b/conanfile102.txt
new file mode 100644
index 0000000..64560b9
--- /dev/null
+++ b/conanfile102.txt
@@ -0,0 +1,6 @@
+[requires]
+cunit/2.1-3@bincrafters/stable
+OpenSSL/1.0.2@conan/stable
+
+[generators]
+cmake

From 62608242518b6e3cb0194a9c19f9ef41c55e823f Mon Sep 17 00:00:00 2001
From: Dennis Potman <dennis.potman@adlinktech.com>
Date: Fri, 29 May 2020 13:31:16 +0200
Subject: [PATCH 238/238] Fix uninitialized use of relay_only

Fix using the variable relay_only uninitialized in the function
connect_proxy_writer_with_reader when security is disabled in the
build configuration.

Signed-off-by: Dennis Potman <dennis.potman@adlinktech.com>
---
 src/core/ddsi/include/dds/ddsi/ddsi_security_omg.h | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src/core/ddsi/include/dds/ddsi/ddsi_security_omg.h b/src/core/ddsi/include/dds/ddsi/ddsi_security_omg.h
index 6eeb9eb..bcf81ec 100644
--- a/src/core/ddsi/include/dds/ddsi/ddsi_security_omg.h
+++ b/src/core/ddsi/include/dds/ddsi/ddsi_security_omg.h
@@ -1290,6 +1290,7 @@ inline bool q_omg_reader_is_submessage_protected(UNUSED_ARG(const struct reader
 
 inline bool q_omg_security_check_remote_reader_permissions(UNUSED_ARG(const struct proxy_reader *prd), UNUSED_ARG(uint32_t domain_id), UNUSED_ARG(struct participant *pp), UNUSED_ARG(bool *relay_only))
 {
+  *relay_only = false;
   return true;
 }